Merge branch 'sched/urgent' into sched/core, to pick up fixes before merging new patches

Signed-off-by: Ingo Molnar <mingo@kernel.org>

526 files changed, 8581 insertions, 4024 deletions

diff --git a/drivers/Makefile b/drivers/Makefile
index 73d039156ea7..795d0ca714bf 100644
--- a/drivers/Makefile
+++ b/drivers/Makefile
@@ -63,6 +63,7 @@ obj-$(CONFIG_FB_I810)           += video/fbdev/i810/
 obj-$(CONFIG_FB_INTEL)          += video/fbdev/intelfb/
 
 obj-$(CONFIG_PARPORT)           += parport/
+obj-$(CONFIG_NVM)               += lightnvm/
 obj-y                           += base/ block/ misc/ mfd/ nfc/
 obj-$(CONFIG_LIBNVDIMM)         += nvdimm/
 obj-$(CONFIG_DMA_SHARED_BUFFER) += dma-buf/
@@ -70,7 +71,6 @@ obj-$(CONFIG_NUBUS)		+= nubus/
 obj-y                           += macintosh/
 obj-$(CONFIG_IDE)               += ide/
 obj-$(CONFIG_SCSI)              += scsi/
-obj-$(CONFIG_NVM)               += lightnvm/
 obj-y                           += nvme/
 obj-$(CONFIG_ATA)               += ata/
 obj-$(CONFIG_TARGET_CORE)       += target/
diff --git a/drivers/acpi/Kconfig b/drivers/acpi/Kconfig
index 25dbb76c02cc..5eef4cb4f70e 100644
--- a/drivers/acpi/Kconfig
+++ b/drivers/acpi/Kconfig
@@ -58,10 +58,10 @@ config ACPI_CCA_REQUIRED
         bool
 
 config ACPI_DEBUGGER
-        bool "In-kernel debugger (EXPERIMENTAL)"
+        bool "AML debugger interface (EXPERIMENTAL)"
         select ACPI_DEBUG
         help
-          Enable in-kernel debugging facilities: statistics, internal
+          Enable in-kernel debugging of AML facilities: statistics, internal
           object dump, single step control method execution.
           This is still under development, currently enabling this only
           results in the compilation of the ACPICA debugger files.
diff --git a/drivers/acpi/nfit.c b/drivers/acpi/nfit.c
index f7dab53b352a..aa45d4802707 100644
--- a/drivers/acpi/nfit.c
+++ b/drivers/acpi/nfit.c
@@ -233,11 +233,12 @@ static bool add_spa(struct acpi_nfit_desc *acpi_desc,
                 struct nfit_table_prev *prev,
                 struct acpi_nfit_system_address *spa)
 {
+        size_t length = min_t(size_t, sizeof(*spa), spa->header.length);
         struct device *dev = acpi_desc->dev;
         struct nfit_spa *nfit_spa;
 
         list_for_each_entry(nfit_spa, &prev->spas, list) {
-                if (memcmp(nfit_spa->spa, spa, sizeof(*spa)) == 0) {
+                if (memcmp(nfit_spa->spa, spa, length) == 0) {
                         list_move_tail(&nfit_spa->list, &acpi_desc->spas);
                         return true;
                 }
@@ -259,11 +260,12 @@ static bool add_memdev(struct acpi_nfit_desc *acpi_desc,
                 struct nfit_table_prev *prev,
                 struct acpi_nfit_memory_map *memdev)
 {
+        size_t length = min_t(size_t, sizeof(*memdev), memdev->header.length);
         struct device *dev = acpi_desc->dev;
         struct nfit_memdev *nfit_memdev;
 
         list_for_each_entry(nfit_memdev, &prev->memdevs, list)
-                if (memcmp(nfit_memdev->memdev, memdev, sizeof(*memdev)) == 0) {
+                if (memcmp(nfit_memdev->memdev, memdev, length) == 0) {
                         list_move_tail(&nfit_memdev->list, &acpi_desc->memdevs);
                         return true;
                 }
@@ -284,11 +286,12 @@ static bool add_dcr(struct acpi_nfit_desc *acpi_desc,
                 struct nfit_table_prev *prev,
                 struct acpi_nfit_control_region *dcr)
 {
+        size_t length = min_t(size_t, sizeof(*dcr), dcr->header.length);
         struct device *dev = acpi_desc->dev;
         struct nfit_dcr *nfit_dcr;
 
         list_for_each_entry(nfit_dcr, &prev->dcrs, list)
-                if (memcmp(nfit_dcr->dcr, dcr, sizeof(*dcr)) == 0) {
+                if (memcmp(nfit_dcr->dcr, dcr, length) == 0) {
                         list_move_tail(&nfit_dcr->list, &acpi_desc->dcrs);
                         return true;
                 }
@@ -308,11 +311,12 @@ static bool add_bdw(struct acpi_nfit_desc *acpi_desc,
                 struct nfit_table_prev *prev,
                 struct acpi_nfit_data_region *bdw)
 {
+        size_t length = min_t(size_t, sizeof(*bdw), bdw->header.length);
         struct device *dev = acpi_desc->dev;
         struct nfit_bdw *nfit_bdw;
 
         list_for_each_entry(nfit_bdw, &prev->bdws, list)
-                if (memcmp(nfit_bdw->bdw, bdw, sizeof(*bdw)) == 0) {
+                if (memcmp(nfit_bdw->bdw, bdw, length) == 0) {
                         list_move_tail(&nfit_bdw->list, &acpi_desc->bdws);
                         return true;
                 }
@@ -332,11 +336,12 @@ static bool add_idt(struct acpi_nfit_desc *acpi_desc,
                 struct nfit_table_prev *prev,
                 struct acpi_nfit_interleave *idt)
 {
+        size_t length = min_t(size_t, sizeof(*idt), idt->header.length);
         struct device *dev = acpi_desc->dev;
         struct nfit_idt *nfit_idt;
 
         list_for_each_entry(nfit_idt, &prev->idts, list)
-                if (memcmp(nfit_idt->idt, idt, sizeof(*idt)) == 0) {
+                if (memcmp(nfit_idt->idt, idt, length) == 0) {
                         list_move_tail(&nfit_idt->list, &acpi_desc->idts);
                         return true;
                 }
@@ -356,11 +361,12 @@ static bool add_flush(struct acpi_nfit_desc *acpi_desc,
                 struct nfit_table_prev *prev,
                 struct acpi_nfit_flush_address *flush)
 {
+        size_t length = min_t(size_t, sizeof(*flush), flush->header.length);
         struct device *dev = acpi_desc->dev;
         struct nfit_flush *nfit_flush;
 
         list_for_each_entry(nfit_flush, &prev->flushes, list)
-                if (memcmp(nfit_flush->flush, flush, sizeof(*flush)) == 0) {
+                if (memcmp(nfit_flush->flush, flush, length) == 0) {
                         list_move_tail(&nfit_flush->list, &acpi_desc->flushes);
                         return true;
                 }
@@ -655,7 +661,7 @@ static ssize_t revision_show(struct device *dev,
         struct nvdimm_bus_descriptor *nd_desc = to_nd_desc(nvdimm_bus);
         struct acpi_nfit_desc *acpi_desc = to_acpi_desc(nd_desc);
 
-        return sprintf(buf, "%d\n", acpi_desc->nfit->header.revision);
+        return sprintf(buf, "%d\n", acpi_desc->acpi_header.revision);
 }
 static DEVICE_ATTR_RO(revision);
 
@@ -1652,7 +1658,6 @@ int acpi_nfit_init(struct acpi_nfit_desc *acpi_desc, acpi_size sz)
 
         data = (u8 *) acpi_desc->nfit;
         end = data + sz;
-        data += sizeof(struct acpi_table_nfit);
         while (!IS_ERR_OR_NULL(data))
                 data = add_table(acpi_desc, &prev, data, end);
 
@@ -1748,13 +1753,29 @@ static int acpi_nfit_add(struct acpi_device *adev)
                 return PTR_ERR(acpi_desc);
         }
 
-        acpi_desc->nfit = (struct acpi_table_nfit *) tbl;
+        /*
+         * Save the acpi header for later and then skip it,
+         * making nfit point to the first nfit table header.
+         */
+        acpi_desc->acpi_header = *tbl;
+        acpi_desc->nfit = (void *) tbl + sizeof(struct acpi_table_nfit);
+        sz -= sizeof(struct acpi_table_nfit);
 
         /* Evaluate _FIT and override with that if present */
         status = acpi_evaluate_object(adev->handle, "_FIT", NULL, &buf);
         if (ACPI_SUCCESS(status) && buf.length > 0) {
-                acpi_desc->nfit = (struct acpi_table_nfit *)buf.pointer;
-                sz = buf.length;
+                union acpi_object *obj;
+                /*
+                 * Adjust for the acpi_object header of the _FIT
+                 */
+                obj = buf.pointer;
+                if (obj->type == ACPI_TYPE_BUFFER) {
+                        acpi_desc->nfit =
+                                (struct acpi_nfit_header *)obj->buffer.pointer;
+                        sz = obj->buffer.length;
+                } else
+                        dev_dbg(dev, "%s invalid type %d, ignoring _FIT\n",
+                                 __func__, (int) obj->type);
         }
 
         rc = acpi_nfit_init(acpi_desc, sz);
@@ -1777,7 +1798,8 @@ static void acpi_nfit_notify(struct acpi_device *adev, u32 event)
 {
         struct acpi_nfit_desc *acpi_desc = dev_get_drvdata(&adev->dev);
         struct acpi_buffer buf = { ACPI_ALLOCATE_BUFFER, NULL };
-        struct acpi_table_nfit *nfit_saved;
+        struct acpi_nfit_header *nfit_saved;
+        union acpi_object *obj;
         struct device *dev = &adev->dev;
         acpi_status status;
         int ret;
@@ -1788,7 +1810,7 @@ static void acpi_nfit_notify(struct acpi_device *adev, u32 event)
         if (!dev->driver) {
                 /* dev->driver may be null if we're being removed */
                 dev_dbg(dev, "%s: no driver found for dev\n", __func__);
-                return;
+                goto out_unlock;
         }
 
         if (!acpi_desc) {
@@ -1808,12 +1830,19 @@ static void acpi_nfit_notify(struct acpi_device *adev, u32 event)
         }
 
         nfit_saved = acpi_desc->nfit;
-        acpi_desc->nfit = (struct acpi_table_nfit *)buf.pointer;
-        ret = acpi_nfit_init(acpi_desc, buf.length);
-        if (!ret) {
-                /* Merge failed, restore old nfit, and exit */
-                acpi_desc->nfit = nfit_saved;
-                dev_err(dev, "failed to merge updated NFIT\n");
+        obj = buf.pointer;
+        if (obj->type == ACPI_TYPE_BUFFER) {
+                acpi_desc->nfit =
+                        (struct acpi_nfit_header *)obj->buffer.pointer;
+                ret = acpi_nfit_init(acpi_desc, obj->buffer.length);
+                if (ret) {
+                        /* Merge failed, restore old nfit, and exit */
+                        acpi_desc->nfit = nfit_saved;
+                        dev_err(dev, "failed to merge updated NFIT\n");
+                }
+        } else {
+                /* Bad _FIT, restore old nfit */
+                dev_err(dev, "Invalid _FIT\n");
         }
         kfree(buf.pointer);
 
diff --git a/drivers/acpi/nfit.h b/drivers/acpi/nfit.h
index 2ea5c0797c8f..3d549a383659 100644
--- a/drivers/acpi/nfit.h
+++ b/drivers/acpi/nfit.h
@@ -96,7 +96,8 @@ struct nfit_mem {
 
 struct acpi_nfit_desc {
         struct nvdimm_bus_descriptor nd_desc;
-        struct acpi_table_nfit *nfit;
+        struct acpi_table_header acpi_header;
+        struct acpi_nfit_header *nfit;
         struct mutex spa_map_mutex;
         struct mutex init_mutex;
         struct list_head spa_maps;
diff --git a/drivers/acpi/pci_root.c b/drivers/acpi/pci_root.c
index 850d7bf0c873..ae3fe4e64203 100644
--- a/drivers/acpi/pci_root.c
+++ b/drivers/acpi/pci_root.c
@@ -768,6 +768,13 @@ static void pci_acpi_root_add_resources(struct acpi_pci_root_info *info)
                 else
                         continue;
 
+                /*
+                 * Some legacy x86 host bridge drivers use iomem_resource and
+                 * ioport_resource as default resource pool, skip it.
+                 */
+                if (res == root)
+                        continue;
+
                 conflict = insert_resource_conflict(root, res);
                 if (conflict) {
                         dev_info(&info->bridge->dev,
diff --git a/drivers/acpi/processor_driver.c b/drivers/acpi/processor_driver.c
index f4e02ae93f58..11154a330f07 100644
--- a/drivers/acpi/processor_driver.c
+++ b/drivers/acpi/processor_driver.c
@@ -200,7 +200,8 @@ static int acpi_pss_perf_init(struct acpi_processor *pr,
                 goto err_remove_sysfs_thermal;
         }
 
-        sysfs_remove_link(&pr->cdev->device.kobj, "device");
+        return 0;
+
  err_remove_sysfs_thermal:
         sysfs_remove_link(&device->dev.kobj, "thermal_cooling");
  err_thermal_unregister:
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index ff02bb4218fc..cdfbcc54821f 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -314,16 +314,6 @@ static const struct pci_device_id ahci_pci_tbl[] = {
         { PCI_VDEVICE(INTEL, 0x1f37), board_ahci_avn }, /* Avoton RAID */
         { PCI_VDEVICE(INTEL, 0x1f3e), board_ahci_avn }, /* Avoton RAID */
         { PCI_VDEVICE(INTEL, 0x1f3f), board_ahci_avn }, /* Avoton RAID */
-        { PCI_VDEVICE(INTEL, 0xa182), board_ahci }, /* Lewisburg AHCI*/
-        { PCI_VDEVICE(INTEL, 0xa202), board_ahci }, /* Lewisburg AHCI*/
-        { PCI_VDEVICE(INTEL, 0xa184), board_ahci }, /* Lewisburg RAID*/
-        { PCI_VDEVICE(INTEL, 0xa204), board_ahci }, /* Lewisburg RAID*/
-        { PCI_VDEVICE(INTEL, 0xa186), board_ahci }, /* Lewisburg RAID*/
-        { PCI_VDEVICE(INTEL, 0xa206), board_ahci }, /* Lewisburg RAID*/
-        { PCI_VDEVICE(INTEL, 0x2822), board_ahci }, /* Lewisburg RAID*/
-        { PCI_VDEVICE(INTEL, 0x2826), board_ahci }, /* Lewisburg RAID*/
-        { PCI_VDEVICE(INTEL, 0xa18e), board_ahci }, /* Lewisburg RAID*/
-        { PCI_VDEVICE(INTEL, 0xa20e), board_ahci }, /* Lewisburg RAID*/
         { PCI_VDEVICE(INTEL, 0x2823), board_ahci }, /* Wellsburg RAID */
         { PCI_VDEVICE(INTEL, 0x2827), board_ahci }, /* Wellsburg RAID */
         { PCI_VDEVICE(INTEL, 0x8d02), board_ahci }, /* Wellsburg AHCI */
@@ -350,10 +340,22 @@ static const struct pci_device_id ahci_pci_tbl[] = {
         { PCI_VDEVICE(INTEL, 0x9d03), board_ahci }, /* Sunrise Point-LP AHCI */
         { PCI_VDEVICE(INTEL, 0x9d05), board_ahci }, /* Sunrise Point-LP RAID */
         { PCI_VDEVICE(INTEL, 0x9d07), board_ahci }, /* Sunrise Point-LP RAID */
+        { PCI_VDEVICE(INTEL, 0xa102), board_ahci }, /* Sunrise Point-H AHCI */
         { PCI_VDEVICE(INTEL, 0xa103), board_ahci }, /* Sunrise Point-H AHCI */
         { PCI_VDEVICE(INTEL, 0xa105), board_ahci }, /* Sunrise Point-H RAID */
+        { PCI_VDEVICE(INTEL, 0xa106), board_ahci }, /* Sunrise Point-H RAID */
         { PCI_VDEVICE(INTEL, 0xa107), board_ahci }, /* Sunrise Point-H RAID */
         { PCI_VDEVICE(INTEL, 0xa10f), board_ahci }, /* Sunrise Point-H RAID */
+        { PCI_VDEVICE(INTEL, 0x2822), board_ahci }, /* Lewisburg RAID*/
+        { PCI_VDEVICE(INTEL, 0x2826), board_ahci }, /* Lewisburg RAID*/
+        { PCI_VDEVICE(INTEL, 0xa182), board_ahci }, /* Lewisburg AHCI*/
+        { PCI_VDEVICE(INTEL, 0xa184), board_ahci }, /* Lewisburg RAID*/
+        { PCI_VDEVICE(INTEL, 0xa186), board_ahci }, /* Lewisburg RAID*/
+        { PCI_VDEVICE(INTEL, 0xa18e), board_ahci }, /* Lewisburg RAID*/
+        { PCI_VDEVICE(INTEL, 0xa202), board_ahci }, /* Lewisburg AHCI*/
+        { PCI_VDEVICE(INTEL, 0xa204), board_ahci }, /* Lewisburg RAID*/
+        { PCI_VDEVICE(INTEL, 0xa206), board_ahci }, /* Lewisburg RAID*/
+        { PCI_VDEVICE(INTEL, 0xa20e), board_ahci }, /* Lewisburg RAID*/
 
         /* JMicron 360/1/3/5/6, match class to avoid IDE function */
         { PCI_VENDOR_ID_JMICRON, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID,
diff --git a/drivers/ata/ahci_mvebu.c b/drivers/ata/ahci_mvebu.c
index 8490d37aee2a..f7a7fa81740e 100644
--- a/drivers/ata/ahci_mvebu.c
+++ b/drivers/ata/ahci_mvebu.c
@@ -62,6 +62,7 @@ static void ahci_mvebu_regret_option(struct ahci_host_priv *hpriv)
         writel(0x80, hpriv->mmio + AHCI_VENDOR_SPECIFIC_0_DATA);
 }
 
+#ifdef CONFIG_PM_SLEEP
 static int ahci_mvebu_suspend(struct platform_device *pdev, pm_message_t state)
 {
         return ahci_platform_suspend_host(&pdev->dev);
@@ -81,6 +82,10 @@ static int ahci_mvebu_resume(struct platform_device *pdev)
 
         return ahci_platform_resume_host(&pdev->dev);
 }
+#else
+#define ahci_mvebu_suspend NULL
+#define ahci_mvebu_resume NULL
+#endif
 
 static const struct ata_port_info ahci_mvebu_port_info = {
         .flags     = AHCI_FLAG_COMMON,
diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
index 096064cd6c52..4665512dae44 100644
--- a/drivers/ata/libahci.c
+++ b/drivers/ata/libahci.c
@@ -1273,6 +1273,15 @@ static int ahci_exec_polled_cmd(struct ata_port *ap, int pmp,
         ata_tf_to_fis(tf, pmp, is_cmd, fis);
         ahci_fill_cmd_slot(pp, 0, cmd_fis_len | flags | (pmp << 12));
 
+        /* set port value for softreset of Port Multiplier */
+        if (pp->fbs_enabled && pp->fbs_last_dev != pmp) {
+                tmp = readl(port_mmio + PORT_FBS);
+                tmp &= ~(PORT_FBS_DEV_MASK | PORT_FBS_DEC);
+                tmp |= pmp << PORT_FBS_DEV_OFFSET;
+                writel(tmp, port_mmio + PORT_FBS);
+                pp->fbs_last_dev = pmp;
+        }
+
         /* issue & wait */
         writel(1, port_mmio + PORT_CMD_ISSUE);
 
diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
index cb0508af1459..961acc788f44 100644
--- a/drivers/ata/libata-eh.c
+++ b/drivers/ata/libata-eh.c
@@ -1505,12 +1505,20 @@ static const char *ata_err_string(unsigned int err_mask)
 unsigned int ata_read_log_page(struct ata_device *dev, u8 log,
                                u8 page, void *buf, unsigned int sectors)
 {
+        unsigned long ap_flags = dev->link->ap->flags;
         struct ata_taskfile tf;
         unsigned int err_mask;
         bool dma = false;
 
         DPRINTK("read log page - log 0x%x, page 0x%x\n", log, page);
 
+        /*
+         * Return error without actually issuing the command on controllers
+         * which e.g. lockup on a read log page.
+         */
+        if (ap_flags & ATA_FLAG_NO_LOG_PAGE)
+                return AC_ERR_DEV;
+
 retry:
         ata_tf_init(dev, &tf);
         if (dev->dma_mode && ata_id_has_read_log_dma_ext(dev->id) &&
diff --git a/drivers/ata/sata_fsl.c b/drivers/ata/sata_fsl.c
index 5389579c5120..a723ae929783 100644
--- a/drivers/ata/sata_fsl.c
+++ b/drivers/ata/sata_fsl.c
@@ -45,7 +45,8 @@ enum {
         SATA_FSL_MAX_PRD_DIRECT = 16,   /* Direct PRDT entries */
 
         SATA_FSL_HOST_FLAGS     = (ATA_FLAG_SATA | ATA_FLAG_PIO_DMA |
-                                ATA_FLAG_PMP | ATA_FLAG_NCQ | ATA_FLAG_AN),
+                                   ATA_FLAG_PMP | ATA_FLAG_NCQ |
+                                   ATA_FLAG_AN | ATA_FLAG_NO_LOG_PAGE),
 
         SATA_FSL_MAX_CMDS       = SATA_FSL_QUEUE_DEPTH,
         SATA_FSL_CMD_HDR_SIZE   = 16,   /* 4 DWORDS */
diff --git a/drivers/ata/sata_sil.c b/drivers/ata/sata_sil.c
index dea6edcbf145..29bcff086bce 100644
--- a/drivers/ata/sata_sil.c
+++ b/drivers/ata/sata_sil.c
@@ -630,6 +630,9 @@ static void sil_dev_config(struct ata_device *dev)
         unsigned int n, quirks = 0;
         unsigned char model_num[ATA_ID_PROD_LEN + 1];
 
+        /* This controller doesn't support trim */
+        dev->horkage |= ATA_HORKAGE_NOTRIM;
+
         ata_id_c_string(dev->id, model_num, ATA_ID_PROD, sizeof(model_num));
 
         for (n = 0; sil_blacklist[n].product; n++)
diff --git a/drivers/base/memory.c b/drivers/base/memory.c
index 2804aed3f416..25425d3f2575 100644
--- a/drivers/base/memory.c
+++ b/drivers/base/memory.c
@@ -303,6 +303,10 @@ static int memory_subsys_offline(struct device *dev)
         if (mem->state == MEM_OFFLINE)
                 return 0;
 
+        /* Can't offline block with non-present sections */
+        if (mem->section_count != sections_per_block)
+                return -EINVAL;
+
         return memory_block_change_state(mem, MEM_OFFLINE, MEM_ONLINE);
 }
 
diff --git a/drivers/base/power/domain.c b/drivers/base/power/domain.c
index e03b1ad25a90..65f50eccd49b 100644
--- a/drivers/base/power/domain.c
+++ b/drivers/base/power/domain.c
@@ -390,6 +390,7 @@ static int pm_genpd_runtime_suspend(struct device *dev)
         struct generic_pm_domain *genpd;
         bool (*stop_ok)(struct device *__dev);
         struct gpd_timing_data *td = &dev_gpd_data(dev)->td;
+        bool runtime_pm = pm_runtime_enabled(dev);
         ktime_t time_start;
         s64 elapsed_ns;
         int ret;
@@ -400,12 +401,19 @@ static int pm_genpd_runtime_suspend(struct device *dev)
         if (IS_ERR(genpd))
                 return -EINVAL;
 
+        /*
+         * A runtime PM centric subsystem/driver may re-use the runtime PM
+         * callbacks for other purposes than runtime PM. In those scenarios
+         * runtime PM is disabled. Under these circumstances, we shall skip
+         * validating/measuring the PM QoS latency.
+         */
         stop_ok = genpd->gov ? genpd->gov->stop_ok : NULL;
-        if (stop_ok && !stop_ok(dev))
+        if (runtime_pm && stop_ok && !stop_ok(dev))
                 return -EBUSY;
 
         /* Measure suspend latency. */
-        time_start = ktime_get();
+        if (runtime_pm)
+                time_start = ktime_get();
 
         ret = genpd_save_dev(genpd, dev);
         if (ret)
@@ -418,13 +426,15 @@ static int pm_genpd_runtime_suspend(struct device *dev)
         }
 
         /* Update suspend latency value if the measured time exceeds it. */
-        elapsed_ns = ktime_to_ns(ktime_sub(ktime_get(), time_start));
-        if (elapsed_ns > td->suspend_latency_ns) {
-                td->suspend_latency_ns = elapsed_ns;
-                dev_dbg(dev, "suspend latency exceeded, %lld ns\n",
-                        elapsed_ns);
-                genpd->max_off_time_changed = true;
-                td->constraint_changed = true;
+        if (runtime_pm) {
+                elapsed_ns = ktime_to_ns(ktime_sub(ktime_get(), time_start));
+                if (elapsed_ns > td->suspend_latency_ns) {
+                        td->suspend_latency_ns = elapsed_ns;
+                        dev_dbg(dev, "suspend latency exceeded, %lld ns\n",
+                                elapsed_ns);
+                        genpd->max_off_time_changed = true;
+                        td->constraint_changed = true;
+                }
         }
 
         /*
@@ -453,6 +463,7 @@ static int pm_genpd_runtime_resume(struct device *dev)
 {
         struct generic_pm_domain *genpd;
         struct gpd_timing_data *td = &dev_gpd_data(dev)->td;
+        bool runtime_pm = pm_runtime_enabled(dev);
         ktime_t time_start;
         s64 elapsed_ns;
         int ret;
@@ -479,14 +490,14 @@ static int pm_genpd_runtime_resume(struct device *dev)
 
  out:
         /* Measure resume latency. */
-        if (timed)
+        if (timed && runtime_pm)
                 time_start = ktime_get();
 
         genpd_start_dev(genpd, dev);
         genpd_restore_dev(genpd, dev);
 
         /* Update resume latency value if the measured time exceeds it. */
-        if (timed) {
+        if (timed && runtime_pm) {
                 elapsed_ns = ktime_to_ns(ktime_sub(ktime_get(), time_start));
                 if (elapsed_ns > td->resume_latency_ns) {
                         td->resume_latency_ns = elapsed_ns;
@@ -1775,10 +1786,10 @@ int genpd_dev_pm_attach(struct device *dev)
         }
 
         pd = of_genpd_get_from_provider(&pd_args);
+        of_node_put(pd_args.np);
         if (IS_ERR(pd)) {
                 dev_dbg(dev, "%s() failed to find PM domain: %ld\n",
                         __func__, PTR_ERR(pd));
-                of_node_put(dev->of_node);
                 return -EPROBE_DEFER;
         }
 
@@ -1796,7 +1807,6 @@ int genpd_dev_pm_attach(struct device *dev)
         if (ret < 0) {
                 dev_err(dev, "failed to add to PM domain %s: %d",
                         pd->name, ret);
-                of_node_put(dev->of_node);
                 goto out;
         }
 
diff --git a/drivers/base/power/domain_governor.c b/drivers/base/power/domain_governor.c
index e60dd12e23aa..1e937ac5f456 100644
--- a/drivers/base/power/domain_governor.c
+++ b/drivers/base/power/domain_governor.c
@@ -160,9 +160,6 @@ static bool default_power_down_ok(struct dev_pm_domain *pd)
                 struct gpd_timing_data *td;
                 s64 constraint_ns;
 
-                if (!pdd->dev->driver)
-                        continue;
-
                 /*
                  * Check if the device is allowed to be off long enough for the
                  * domain to turn off and on (that's how much time it will
diff --git a/drivers/block/mtip32xx/mtip32xx.c b/drivers/block/mtip32xx/mtip32xx.c
index a28a562f7b7f..3457ac8c03e2 100644
--- a/drivers/block/mtip32xx/mtip32xx.c
+++ b/drivers/block/mtip32xx/mtip32xx.c
@@ -3810,7 +3810,6 @@ static int mtip_block_initialize(struct driver_data *dd)
         sector_t capacity;
         unsigned int index = 0;
         struct kobject *kobj;
-        unsigned char thd_name[16];
 
         if (dd->disk)
                 goto skip_create_disk; /* hw init done, before rebuild */
@@ -3958,10 +3957,9 @@ skip_create_disk:
         }
 
 start_service_thread:
-        sprintf(thd_name, "mtip_svc_thd_%02d", index);
         dd->mtip_svc_handler = kthread_create_on_node(mtip_service_thread,
-                                                dd, dd->numa_node, "%s",
-                                                thd_name);
+                                                dd, dd->numa_node,
+                                                "mtip_svc_thd_%02d", index);
 
         if (IS_ERR(dd->mtip_svc_handler)) {
                 dev_err(&dd->pdev->dev, "service thread failed to start\n");
diff --git a/drivers/block/null_blk.c b/drivers/block/null_blk.c
index 6255d1c4bba4..09e3c0d87ecc 100644
--- a/drivers/block/null_blk.c
+++ b/drivers/block/null_blk.c
@@ -8,6 +8,7 @@
 #include <linux/slab.h>
 #include <linux/blk-mq.h>
 #include <linux/hrtimer.h>
+#include <linux/lightnvm.h>
 
 struct nullb_cmd {
         struct list_head list;
@@ -17,6 +18,7 @@ struct nullb_cmd {
         struct bio *bio;
         unsigned int tag;
         struct nullb_queue *nq;
+        struct hrtimer timer;
 };
 
 struct nullb_queue {
@@ -39,23 +41,14 @@ struct nullb {
 
         struct nullb_queue *queues;
         unsigned int nr_queues;
+        char disk_name[DISK_NAME_LEN];
 };
 
 static LIST_HEAD(nullb_list);
 static struct mutex lock;
 static int null_major;
 static int nullb_indexes;
-
-struct completion_queue {
-        struct llist_head list;
-        struct hrtimer timer;
-};
-
-/*
- * These are per-cpu for now, they will need to be configured by the
- * complete_queues parameter and appropriately mapped.
- */
-static DEFINE_PER_CPU(struct completion_queue, completion_queues);
+static struct kmem_cache *ppa_cache;
 
 enum {
         NULL_IRQ_NONE           = 0,
@@ -119,6 +112,10 @@ static int nr_devices = 2;
 module_param(nr_devices, int, S_IRUGO);
 MODULE_PARM_DESC(nr_devices, "Number of devices to register");
 
+static bool use_lightnvm;
+module_param(use_lightnvm, bool, S_IRUGO);
+MODULE_PARM_DESC(use_lightnvm, "Register as a LightNVM device");
+
 static int irqmode = NULL_IRQ_SOFTIRQ;
 
 static int null_set_irqmode(const char *str, const struct kernel_param *kp)
@@ -135,8 +132,8 @@ static const struct kernel_param_ops null_irqmode_param_ops = {
 device_param_cb(irqmode, &null_irqmode_param_ops, &irqmode, S_IRUGO);
 MODULE_PARM_DESC(irqmode, "IRQ completion handler. 0-none, 1-softirq, 2-timer");
 
-static int completion_nsec = 10000;
-module_param(completion_nsec, int, S_IRUGO);
+static unsigned long completion_nsec = 10000;
+module_param(completion_nsec, ulong, S_IRUGO);
 MODULE_PARM_DESC(completion_nsec, "Time in ns to complete a request in hardware. Default: 10,000ns");
 
 static int hw_queue_depth = 64;
@@ -173,6 +170,8 @@ static void free_cmd(struct nullb_cmd *cmd)
         put_tag(cmd->nq, cmd->tag);
 }
 
+static enum hrtimer_restart null_cmd_timer_expired(struct hrtimer *timer);
+
 static struct nullb_cmd *__alloc_cmd(struct nullb_queue *nq)
 {
         struct nullb_cmd *cmd;
@@ -183,6 +182,11 @@ static struct nullb_cmd *__alloc_cmd(struct nullb_queue *nq)
                 cmd = &nq->cmds[tag];
                 cmd->tag = tag;
                 cmd->nq = nq;
+                if (irqmode == NULL_IRQ_TIMER) {
+                        hrtimer_init(&cmd->timer, CLOCK_MONOTONIC,
+                                     HRTIMER_MODE_REL);
+                        cmd->timer.function = null_cmd_timer_expired;
+                }
                 return cmd;
         }
 
@@ -213,6 +217,11 @@ static struct nullb_cmd *alloc_cmd(struct nullb_queue *nq, int can_wait)
 
 static void end_cmd(struct nullb_cmd *cmd)
 {
+        struct request_queue *q = NULL;
+
+        if (cmd->rq)
+                q = cmd->rq->q;
+
         switch (queue_mode)  {
         case NULL_Q_MQ:
                 blk_mq_end_request(cmd->rq, 0);
@@ -227,51 +236,29 @@ static void end_cmd(struct nullb_cmd *cmd)
         }
 
         free_cmd(cmd);
+
+        /* Restart queue if needed, as we are freeing a tag */
+        if (queue_mode == NULL_Q_RQ && blk_queue_stopped(q)) {
+                unsigned long flags;
+
+                spin_lock_irqsave(q->queue_lock, flags);
+                blk_start_queue_async(q);
+                spin_unlock_irqrestore(q->queue_lock, flags);
+        }
 }
 
 static enum hrtimer_restart null_cmd_timer_expired(struct hrtimer *timer)
 {
-        struct completion_queue *cq;
-        struct llist_node *entry;
-        struct nullb_cmd *cmd;
-
-        cq = &per_cpu(completion_queues, smp_processor_id());
-
-        while ((entry = llist_del_all(&cq->list)) != NULL) {
-                entry = llist_reverse_order(entry);
-                do {
-                        struct request_queue *q = NULL;
-
-                        cmd = container_of(entry, struct nullb_cmd, ll_list);
-                        entry = entry->next;
-                        if (cmd->rq)
-                                q = cmd->rq->q;
-                        end_cmd(cmd);
-
-                        if (q && !q->mq_ops && blk_queue_stopped(q)) {
-                                spin_lock(q->queue_lock);
-                                if (blk_queue_stopped(q))
-                                        blk_start_queue(q);
-                                spin_unlock(q->queue_lock);
-                        }
-                } while (entry);
-        }
+        end_cmd(container_of(timer, struct nullb_cmd, timer));
 
         return HRTIMER_NORESTART;
 }
 
 static void null_cmd_end_timer(struct nullb_cmd *cmd)
 {
-        struct completion_queue *cq = &per_cpu(completion_queues, get_cpu());
+        ktime_t kt = ktime_set(0, completion_nsec);
 
-        cmd->ll_list.next = NULL;
-        if (llist_add(&cmd->ll_list, &cq->list)) {
-                ktime_t kt = ktime_set(0, completion_nsec);
-
-                hrtimer_start(&cq->timer, kt, HRTIMER_MODE_REL_PINNED);
-        }
-
-        put_cpu();
+        hrtimer_start(&cmd->timer, kt, HRTIMER_MODE_REL);
 }
 
 static void null_softirq_done_fn(struct request *rq)
@@ -369,6 +356,10 @@ static int null_queue_rq(struct blk_mq_hw_ctx *hctx,
 {
         struct nullb_cmd *cmd = blk_mq_rq_to_pdu(bd->rq);
 
+        if (irqmode == NULL_IRQ_TIMER) {
+                hrtimer_init(&cmd->timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
+                cmd->timer.function = null_cmd_timer_expired;
+        }
         cmd->rq = bd->rq;
         cmd->nq = hctx->driver_data;
 
@@ -427,15 +418,157 @@ static void null_del_dev(struct nullb *nullb)
 {
         list_del_init(&nullb->list);
 
-        del_gendisk(nullb->disk);
+        if (use_lightnvm)
+                nvm_unregister(nullb->disk_name);
+        else
+                del_gendisk(nullb->disk);
         blk_cleanup_queue(nullb->q);
         if (queue_mode == NULL_Q_MQ)
                 blk_mq_free_tag_set(&nullb->tag_set);
-        put_disk(nullb->disk);
+        if (!use_lightnvm)
+                put_disk(nullb->disk);
         cleanup_queues(nullb);
         kfree(nullb);
 }
 
+#ifdef CONFIG_NVM
+
+static void null_lnvm_end_io(struct request *rq, int error)
+{
+        struct nvm_rq *rqd = rq->end_io_data;
+        struct nvm_dev *dev = rqd->dev;
+
+        dev->mt->end_io(rqd, error);
+
+        blk_put_request(rq);
+}
+
+static int null_lnvm_submit_io(struct nvm_dev *dev, struct nvm_rq *rqd)
+{
+        struct request_queue *q = dev->q;
+        struct request *rq;
+        struct bio *bio = rqd->bio;
+
+        rq = blk_mq_alloc_request(q, bio_rw(bio), GFP_KERNEL, 0);
+        if (IS_ERR(rq))
+                return -ENOMEM;
+
+        rq->cmd_type = REQ_TYPE_DRV_PRIV;
+        rq->__sector = bio->bi_iter.bi_sector;
+        rq->ioprio = bio_prio(bio);
+
+        if (bio_has_data(bio))
+                rq->nr_phys_segments = bio_phys_segments(q, bio);
+
+        rq->__data_len = bio->bi_iter.bi_size;
+        rq->bio = rq->biotail = bio;
+
+        rq->end_io_data = rqd;
+
+        blk_execute_rq_nowait(q, NULL, rq, 0, null_lnvm_end_io);
+
+        return 0;
+}
+
+static int null_lnvm_id(struct nvm_dev *dev, struct nvm_id *id)
+{
+        sector_t size = gb * 1024 * 1024 * 1024ULL;
+        sector_t blksize;
+        struct nvm_id_group *grp;
+
+        id->ver_id = 0x1;
+        id->vmnt = 0;
+        id->cgrps = 1;
+        id->cap = 0x3;
+        id->dom = 0x1;
+
+        id->ppaf.blk_offset = 0;
+        id->ppaf.blk_len = 16;
+        id->ppaf.pg_offset = 16;
+        id->ppaf.pg_len = 16;
+        id->ppaf.sect_offset = 32;
+        id->ppaf.sect_len = 8;
+        id->ppaf.pln_offset = 40;
+        id->ppaf.pln_len = 8;
+        id->ppaf.lun_offset = 48;
+        id->ppaf.lun_len = 8;
+        id->ppaf.ch_offset = 56;
+        id->ppaf.ch_len = 8;
+
+        do_div(size, bs); /* convert size to pages */
+        do_div(size, 256); /* concert size to pgs pr blk */
+        grp = &id->groups[0];
+        grp->mtype = 0;
+        grp->fmtype = 0;
+        grp->num_ch = 1;
+        grp->num_pg = 256;
+        blksize = size;
+        do_div(size, (1 << 16));
+        grp->num_lun = size + 1;
+        do_div(blksize, grp->num_lun);
+        grp->num_blk = blksize;
+        grp->num_pln = 1;
+
+        grp->fpg_sz = bs;
+        grp->csecs = bs;
+        grp->trdt = 25000;
+        grp->trdm = 25000;
+        grp->tprt = 500000;
+        grp->tprm = 500000;
+        grp->tbet = 1500000;
+        grp->tbem = 1500000;
+        grp->mpos = 0x010101; /* single plane rwe */
+        grp->cpar = hw_queue_depth;
+
+        return 0;
+}
+
+static void *null_lnvm_create_dma_pool(struct nvm_dev *dev, char *name)
+{
+        mempool_t *virtmem_pool;
+
+        virtmem_pool = mempool_create_slab_pool(64, ppa_cache);
+        if (!virtmem_pool) {
+                pr_err("null_blk: Unable to create virtual memory pool\n");
+                return NULL;
+        }
+
+        return virtmem_pool;
+}
+
+static void null_lnvm_destroy_dma_pool(void *pool)
+{
+        mempool_destroy(pool);
+}
+
+static void *null_lnvm_dev_dma_alloc(struct nvm_dev *dev, void *pool,
+                                gfp_t mem_flags, dma_addr_t *dma_handler)
+{
+        return mempool_alloc(pool, mem_flags);
+}
+
+static void null_lnvm_dev_dma_free(void *pool, void *entry,
+                                                        dma_addr_t dma_handler)
+{
+        mempool_free(entry, pool);
+}
+
+static struct nvm_dev_ops null_lnvm_dev_ops = {
+        .identity               = null_lnvm_id,
+        .submit_io              = null_lnvm_submit_io,
+
+        .create_dma_pool        = null_lnvm_create_dma_pool,
+        .destroy_dma_pool       = null_lnvm_destroy_dma_pool,
+        .dev_dma_alloc          = null_lnvm_dev_dma_alloc,
+        .dev_dma_free           = null_lnvm_dev_dma_free,
+
+        /* Simulate nvme protocol restriction */
+        .max_phys_sect          = 64,
+};
+#else
+static struct nvm_dev_ops null_lnvm_dev_ops;
+#endif /* CONFIG_NVM */
+
 static int null_open(struct block_device *bdev, fmode_t mode)
 {
         return 0;
@@ -575,11 +708,6 @@ static int null_add_dev(void)
         queue_flag_set_unlocked(QUEUE_FLAG_NONROT, nullb->q);
         queue_flag_clear_unlocked(QUEUE_FLAG_ADD_RANDOM, nullb->q);
 
-        disk = nullb->disk = alloc_disk_node(1, home_node);
-        if (!disk) {
-                rv = -ENOMEM;
-                goto out_cleanup_blk_queue;
-        }
 
         mutex_lock(&lock);
         list_add_tail(&nullb->list, &nullb_list);
@@ -589,6 +717,21 @@ static int null_add_dev(void)
         blk_queue_logical_block_size(nullb->q, bs);
         blk_queue_physical_block_size(nullb->q, bs);
 
+        sprintf(nullb->disk_name, "nullb%d", nullb->index);
+
+        if (use_lightnvm) {
+                rv = nvm_register(nullb->q, nullb->disk_name,
+                                                        &null_lnvm_dev_ops);
+                if (rv)
+                        goto out_cleanup_blk_queue;
+                goto done;
+        }
+
+        disk = nullb->disk = alloc_disk_node(1, home_node);
+        if (!disk) {
+                rv = -ENOMEM;
+                goto out_cleanup_lightnvm;
+        }
         size = gb * 1024 * 1024 * 1024ULL;
         set_capacity(disk, size >> 9);
 
@@ -598,10 +741,15 @@ static int null_add_dev(void)
         disk->fops              = &null_fops;
         disk->private_data      = nullb;
         disk->queue             = nullb->q;
-        sprintf(disk->disk_name, "nullb%d", nullb->index);
+        strncpy(disk->disk_name, nullb->disk_name, DISK_NAME_LEN);
+
         add_disk(disk);
+done:
         return 0;
 
+out_cleanup_lightnvm:
+        if (use_lightnvm)
+                nvm_unregister(nullb->disk_name);
 out_cleanup_blk_queue:
         blk_cleanup_queue(nullb->q);
 out_cleanup_tags:
@@ -617,7 +765,9 @@ out:
 
 static int __init null_init(void)
 {
+        int ret = 0;
         unsigned int i;
+        struct nullb *nullb;
 
         if (bs > PAGE_SIZE) {
                 pr_warn("null_blk: invalid block size\n");
@@ -625,6 +775,18 @@ static int __init null_init(void)
                 bs = PAGE_SIZE;
         }
 
+        if (use_lightnvm && bs != 4096) {
+                pr_warn("null_blk: LightNVM only supports 4k block size\n");
+                pr_warn("null_blk: defaults block size to 4k\n");
+                bs = 4096;
+        }
+
+        if (use_lightnvm && queue_mode != NULL_Q_MQ) {
+                pr_warn("null_blk: LightNVM only supported for blk-mq\n");
+                pr_warn("null_blk: defaults queue mode to blk-mq\n");
+                queue_mode = NULL_Q_MQ;
+        }
+
         if (queue_mode == NULL_Q_MQ && use_per_node_hctx) {
                 if (submit_queues < nr_online_nodes) {
                         pr_warn("null_blk: submit_queues param is set to %u.",
@@ -638,32 +800,38 @@ static int __init null_init(void)
 
         mutex_init(&lock);
 
-        /* Initialize a separate list for each CPU for issuing softirqs */
-        for_each_possible_cpu(i) {
-                struct completion_queue *cq = &per_cpu(completion_queues, i);
-
-                init_llist_head(&cq->list);
-
-                if (irqmode != NULL_IRQ_TIMER)
-                        continue;
-
-                hrtimer_init(&cq->timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
-                cq->timer.function = null_cmd_timer_expired;
-        }
-
         null_major = register_blkdev(0, "nullb");
         if (null_major < 0)
                 return null_major;
 
-        for (i = 0; i < nr_devices; i++) {
-                if (null_add_dev()) {
-                        unregister_blkdev(null_major, "nullb");
-                        return -EINVAL;
+        if (use_lightnvm) {
+                ppa_cache = kmem_cache_create("ppa_cache", 64 * sizeof(u64),
+                                                                0, 0, NULL);
+                if (!ppa_cache) {
+                        pr_err("null_blk: unable to create ppa cache\n");
+                        ret = -ENOMEM;
+                        goto err_ppa;
                 }
         }
 
+        for (i = 0; i < nr_devices; i++) {
+                ret = null_add_dev();
+                if (ret)
+                        goto err_dev;
+        }
+
         pr_info("null: module loaded\n");
         return 0;
+
+err_dev:
+        while (!list_empty(&nullb_list)) {
+                nullb = list_entry(nullb_list.next, struct nullb, list);
+                null_del_dev(nullb);
+        }
+        kmem_cache_destroy(ppa_cache);
+err_ppa:
+        unregister_blkdev(null_major, "nullb");
+        return ret;
 }
 
 static void __exit null_exit(void)
@@ -678,6 +846,8 @@ static void __exit null_exit(void)
                 null_del_dev(nullb);
         }
         mutex_unlock(&lock);
+
+        kmem_cache_destroy(ppa_cache);
 }
 
 module_init(null_init);
diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
index 235708c7c46e..81ea69fee7ca 100644
--- a/drivers/block/rbd.c
+++ b/drivers/block/rbd.c
@@ -3442,6 +3442,7 @@ static void rbd_queue_workfn(struct work_struct *work)
                 goto err_rq;
         }
         img_request->rq = rq;
+        snapc = NULL; /* img_request consumes a ref */
 
         if (op_type == OBJ_OP_DISCARD)
                 result = rbd_img_request_fill(img_request, OBJ_REQUEST_NODATA,
diff --git a/drivers/block/xen-blkback/blkback.c b/drivers/block/xen-blkback/blkback.c
index f9099940c272..41fb1a917b17 100644
--- a/drivers/block/xen-blkback/blkback.c
+++ b/drivers/block/xen-blkback/blkback.c
@@ -950,6 +950,8 @@ static int xen_blkbk_parse_indirect(struct blkif_request *req,
                 goto unmap;
 
         for (n = 0, i = 0; n < nseg; n++) {
+                uint8_t first_sect, last_sect;
+
                 if ((n % SEGS_PER_INDIRECT_FRAME) == 0) {
                         /* Map indirect segments */
                         if (segments)
@@ -957,15 +959,18 @@ static int xen_blkbk_parse_indirect(struct blkif_request *req,
                         segments = kmap_atomic(pages[n/SEGS_PER_INDIRECT_FRAME]->page);
                 }
                 i = n % SEGS_PER_INDIRECT_FRAME;
+
                 pending_req->segments[n]->gref = segments[i].gref;
-                seg[n].nsec = segments[i].last_sect -
-                        segments[i].first_sect + 1;
-                seg[n].offset = (segments[i].first_sect << 9);
-                if ((segments[i].last_sect >= (XEN_PAGE_SIZE >> 9)) ||
-                    (segments[i].last_sect < segments[i].first_sect)) {
+
+                first_sect = READ_ONCE(segments[i].first_sect);
+                last_sect = READ_ONCE(segments[i].last_sect);
+                if (last_sect >= (XEN_PAGE_SIZE >> 9) || last_sect < first_sect) {
                         rc = -EINVAL;
                         goto unmap;
                 }
+
+                seg[n].nsec = last_sect - first_sect + 1;
+                seg[n].offset = first_sect << 9;
                 preq->nr_sects += seg[n].nsec;
         }
 
diff --git a/drivers/block/xen-blkback/common.h b/drivers/block/xen-blkback/common.h
index 68e87a037b99..c929ae22764c 100644
--- a/drivers/block/xen-blkback/common.h
+++ b/drivers/block/xen-blkback/common.h
@@ -408,8 +408,8 @@ static inline void blkif_get_x86_32_req(struct blkif_request *dst,
                                         struct blkif_x86_32_request *src)
 {
         int i, n = BLKIF_MAX_SEGMENTS_PER_REQUEST, j;
-        dst->operation = src->operation;
-        switch (src->operation) {
+        dst->operation = READ_ONCE(src->operation);
+        switch (dst->operation) {
         case BLKIF_OP_READ:
         case BLKIF_OP_WRITE:
         case BLKIF_OP_WRITE_BARRIER:
@@ -456,8 +456,8 @@ static inline void blkif_get_x86_64_req(struct blkif_request *dst,
                                         struct blkif_x86_64_request *src)
 {
         int i, n = BLKIF_MAX_SEGMENTS_PER_REQUEST, j;
-        dst->operation = src->operation;
-        switch (src->operation) {
+        dst->operation = READ_ONCE(src->operation);
+        switch (dst->operation) {
         case BLKIF_OP_READ:
         case BLKIF_OP_WRITE:
         case BLKIF_OP_WRITE_BARRIER:
diff --git a/drivers/bus/omap-ocp2scp.c b/drivers/bus/omap-ocp2scp.c
index 9f1856948758..bf500e0e7362 100644
--- a/drivers/bus/omap-ocp2scp.c
+++ b/drivers/bus/omap-ocp2scp.c
@@ -117,7 +117,7 @@ static struct platform_driver omap_ocp2scp_driver = {
 
 module_platform_driver(omap_ocp2scp_driver);
 
-MODULE_ALIAS("platform: omap-ocp2scp");
+MODULE_ALIAS("platform:omap-ocp2scp");
 MODULE_AUTHOR("Texas Instruments Inc.");
 MODULE_DESCRIPTION("OMAP OCP2SCP driver");
 MODULE_LICENSE("GPL v2");
diff --git a/drivers/bus/sunxi-rsb.c b/drivers/bus/sunxi-rsb.c
index 846bc29c157d..25996e256110 100644
--- a/drivers/bus/sunxi-rsb.c
+++ b/drivers/bus/sunxi-rsb.c
@@ -342,13 +342,13 @@ static int sunxi_rsb_read(struct sunxi_rsb *rsb, u8 rtaddr, u8 addr,
 
         ret = _sunxi_rsb_run_xfer(rsb);
         if (ret)
-                goto out;
+                goto unlock;
 
         *buf = readl(rsb->regs + RSB_DATA);
 
+unlock:
         mutex_unlock(&rsb->lock);
 
-out:
         return ret;
 }
 
@@ -527,9 +527,9 @@ static int sunxi_rsb_init_device_mode(struct sunxi_rsb *rsb)
  */
 
 static const struct sunxi_rsb_addr_map sunxi_rsb_addr_maps[] = {
-        { 0x3e3, 0x2d }, /* Primary PMIC: AXP223, AXP809, AXP81X, ... */
+        { 0x3a3, 0x2d }, /* Primary PMIC: AXP223, AXP809, AXP81X, ... */
         { 0x745, 0x3a }, /* Secondary PMIC: AXP806, ... */
-        { 0xe89, 0x45 }, /* Peripheral IC: AC100, ... */
+        { 0xe89, 0x4e }, /* Peripheral IC: AC100, ... */
 };
 
 static u8 sunxi_rsb_get_rtaddr(u16 hwaddr)
diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
index 55fe9020459f..4cc72fa017c7 100644
--- a/drivers/char/ipmi/ipmi_si_intf.c
+++ b/drivers/char/ipmi/ipmi_si_intf.c
@@ -1230,14 +1230,14 @@ static int smi_start_processing(void       *send_info,
 
         new_smi->intf = intf;
 
-        /* Try to claim any interrupts. */
-        if (new_smi->irq_setup)
-                new_smi->irq_setup(new_smi);
-
         /* Set up the timer that drives the interface. */
         setup_timer(&new_smi->si_timer, smi_timeout, (long)new_smi);
         smi_mod_timer(new_smi, jiffies + SI_TIMEOUT_JIFFIES);
 
+        /* Try to claim any interrupts. */
+        if (new_smi->irq_setup)
+                new_smi->irq_setup(new_smi);
+
         /*
          * Check if the user forcefully enabled the daemon.
          */
diff --git a/drivers/clk/clk-gpio.c b/drivers/clk/clk-gpio.c
index 10819e248414..335322dc403f 100644
--- a/drivers/clk/clk-gpio.c
+++ b/drivers/clk/clk-gpio.c
@@ -209,6 +209,8 @@ EXPORT_SYMBOL_GPL(clk_register_gpio_mux);
 
 struct clk_gpio_delayed_register_data {
         const char *gpio_name;
+        int num_parents;
+        const char **parent_names;
         struct device_node *node;
         struct mutex lock;
         struct clk *clk;
@@ -222,8 +224,6 @@ static struct clk *of_clk_gpio_delayed_register_get(
 {
         struct clk_gpio_delayed_register_data *data = _data;
         struct clk *clk;
-        const char **parent_names;
-        int i, num_parents;
         int gpio;
         enum of_gpio_flags of_flags;
 
@@ -248,26 +248,14 @@ static struct clk *of_clk_gpio_delayed_register_get(
                 return ERR_PTR(gpio);
         }
 
-        num_parents = of_clk_get_parent_count(data->node);
-
-        parent_names = kcalloc(num_parents, sizeof(char *), GFP_KERNEL);
-        if (!parent_names) {
-                clk = ERR_PTR(-ENOMEM);
-                goto out;
-        }
-
-        for (i = 0; i < num_parents; i++)
-                parent_names[i] = of_clk_get_parent_name(data->node, i);
-
-        clk = data->clk_register_get(data->node->name, parent_names,
-                        num_parents, gpio, of_flags & OF_GPIO_ACTIVE_LOW);
+        clk = data->clk_register_get(data->node->name, data->parent_names,
+                        data->num_parents, gpio, of_flags & OF_GPIO_ACTIVE_LOW);
         if (IS_ERR(clk))
                 goto out;
 
         data->clk = clk;
 out:
         mutex_unlock(&data->lock);
-        kfree(parent_names);
 
         return clk;
 }
@@ -296,11 +284,24 @@ static void __init of_gpio_clk_setup(struct device_node *node,
                                 unsigned gpio, bool active_low))
 {
         struct clk_gpio_delayed_register_data *data;
+        const char **parent_names;
+        int i, num_parents;
 
         data = kzalloc(sizeof(*data), GFP_KERNEL);
         if (!data)
                 return;
 
+        num_parents = of_clk_get_parent_count(node);
+
+        parent_names = kcalloc(num_parents, sizeof(char *), GFP_KERNEL);
+        if (!parent_names)
+                return;
+
+        for (i = 0; i < num_parents; i++)
+                parent_names[i] = of_clk_get_parent_name(node, i);
+
+        data->num_parents = num_parents;
+        data->parent_names = parent_names;
         data->node = node;
         data->gpio_name = gpio_name;
         data->clk_register_get = clk_register_get;
diff --git a/drivers/clk/clk-qoriq.c b/drivers/clk/clk-qoriq.c
index 1ab0fb81c6a0..7bc1c4527ae4 100644
--- a/drivers/clk/clk-qoriq.c
+++ b/drivers/clk/clk-qoriq.c
@@ -778,8 +778,10 @@ static struct clk * __init create_one_cmux(struct clockgen *cg, int idx)
          */
         clksel = (cg_in(cg, hwc->reg) & CLKSEL_MASK) >> CLKSEL_SHIFT;
         div = get_pll_div(cg, hwc, clksel);
-        if (!div)
+        if (!div) {
+                kfree(hwc);
                 return NULL;
+        }
 
         pct80_rate = clk_get_rate(div->clk);
         pct80_rate *= 8;
diff --git a/drivers/clk/clk-scpi.c b/drivers/clk/clk-scpi.c
index 0b501a9fef92..cd0f2726f5e0 100644
--- a/drivers/clk/clk-scpi.c
+++ b/drivers/clk/clk-scpi.c
@@ -292,6 +292,7 @@ static int scpi_clocks_probe(struct platform_device *pdev)
                 ret = scpi_clk_add(dev, child, match);
                 if (ret) {
                         scpi_clocks_remove(pdev);
+                        of_node_put(child);
                         return ret;
                 }
         }
diff --git a/drivers/clk/imx/clk-pllv1.c b/drivers/clk/imx/clk-pllv1.c
index 8564e4342c7d..82fe3662b5f6 100644
--- a/drivers/clk/imx/clk-pllv1.c
+++ b/drivers/clk/imx/clk-pllv1.c
@@ -52,7 +52,7 @@ static unsigned long clk_pllv1_recalc_rate(struct clk_hw *hw,
                 unsigned long parent_rate)
 {
         struct clk_pllv1 *pll = to_clk_pllv1(hw);
-        long long ll;
+        unsigned long long ull;
         int mfn_abs;
         unsigned int mfi, mfn, mfd, pd;
         u32 reg;
@@ -94,16 +94,16 @@ static unsigned long clk_pllv1_recalc_rate(struct clk_hw *hw,
         rate = parent_rate * 2;
         rate /= pd + 1;
 
-        ll = (unsigned long long)rate * mfn_abs;
+        ull = (unsigned long long)rate * mfn_abs;
 
-        do_div(ll, mfd + 1);
+        do_div(ull, mfd + 1);
 
         if (mfn_is_negative(pll, mfn))
-                ll = -ll;
+                ull = (rate * mfi) - ull;
+        else
+                ull = (rate * mfi) + ull;
 
-        ll = (rate * mfi) + ll;
-
-        return ll;
+        return ull;
 }
 
 static struct clk_ops clk_pllv1_ops = {
diff --git a/drivers/clk/imx/clk-pllv2.c b/drivers/clk/imx/clk-pllv2.c
index b18f875eac6a..4aeda56ce372 100644
--- a/drivers/clk/imx/clk-pllv2.c
+++ b/drivers/clk/imx/clk-pllv2.c
@@ -79,7 +79,7 @@ static unsigned long __clk_pllv2_recalc_rate(unsigned long parent_rate,
 {
         long mfi, mfn, mfd, pdf, ref_clk;
         unsigned long dbl;
-        s64 temp;
+        u64 temp;
 
         dbl = dp_ctl & MXC_PLL_DP_CTL_DPDCK0_2_EN;
 
@@ -98,8 +98,9 @@ static unsigned long __clk_pllv2_recalc_rate(unsigned long parent_rate,
         temp = (u64) ref_clk * abs(mfn);
         do_div(temp, mfd + 1);
         if (mfn < 0)
-                temp = -temp;
-        temp = (ref_clk * mfi) + temp;
+                temp = (ref_clk * mfi) - temp;
+        else
+                temp = (ref_clk * mfi) + temp;
 
         return temp;
 }
@@ -126,7 +127,7 @@ static int __clk_pllv2_set_rate(unsigned long rate, unsigned long parent_rate,
 {
         u32 reg;
         long mfi, pdf, mfn, mfd = 999999;
-        s64 temp64;
+        u64 temp64;
         unsigned long quad_parent_rate;
 
         quad_parent_rate = 4 * parent_rate;
diff --git a/drivers/clk/imx/clk-vf610.c b/drivers/clk/imx/clk-vf610.c
index d1b1c95177bb..0a94d9661d91 100644
--- a/drivers/clk/imx/clk-vf610.c
+++ b/drivers/clk/imx/clk-vf610.c
@@ -335,22 +335,22 @@ static void __init vf610_clocks_init(struct device_node *ccm_node)
         clk[VF610_CLK_SAI0_SEL] = imx_clk_mux("sai0_sel", CCM_CSCMR1, 0, 2, sai_sels, 4);
         clk[VF610_CLK_SAI0_EN] = imx_clk_gate("sai0_en", "sai0_sel", CCM_CSCDR1, 16);
         clk[VF610_CLK_SAI0_DIV] = imx_clk_divider("sai0_div", "sai0_en", CCM_CSCDR1, 0, 4);
-        clk[VF610_CLK_SAI0] = imx_clk_gate2("sai0", "sai0_div", CCM_CCGR0, CCM_CCGRx_CGn(15));
+        clk[VF610_CLK_SAI0] = imx_clk_gate2("sai0", "ipg_bus", CCM_CCGR0, CCM_CCGRx_CGn(15));
 
         clk[VF610_CLK_SAI1_SEL] = imx_clk_mux("sai1_sel", CCM_CSCMR1, 2, 2, sai_sels, 4);
         clk[VF610_CLK_SAI1_EN] = imx_clk_gate("sai1_en", "sai1_sel", CCM_CSCDR1, 17);
         clk[VF610_CLK_SAI1_DIV] = imx_clk_divider("sai1_div", "sai1_en", CCM_CSCDR1, 4, 4);
-        clk[VF610_CLK_SAI1] = imx_clk_gate2("sai1", "sai1_div", CCM_CCGR1, CCM_CCGRx_CGn(0));
+        clk[VF610_CLK_SAI1] = imx_clk_gate2("sai1", "ipg_bus", CCM_CCGR1, CCM_CCGRx_CGn(0));
 
         clk[VF610_CLK_SAI2_SEL] = imx_clk_mux("sai2_sel", CCM_CSCMR1, 4, 2, sai_sels, 4);
         clk[VF610_CLK_SAI2_EN] = imx_clk_gate("sai2_en", "sai2_sel", CCM_CSCDR1, 18);
         clk[VF610_CLK_SAI2_DIV] = imx_clk_divider("sai2_div", "sai2_en", CCM_CSCDR1, 8, 4);
-        clk[VF610_CLK_SAI2] = imx_clk_gate2("sai2", "sai2_div", CCM_CCGR1, CCM_CCGRx_CGn(1));
+        clk[VF610_CLK_SAI2] = imx_clk_gate2("sai2", "ipg_bus", CCM_CCGR1, CCM_CCGRx_CGn(1));
 
         clk[VF610_CLK_SAI3_SEL] = imx_clk_mux("sai3_sel", CCM_CSCMR1, 6, 2, sai_sels, 4);
         clk[VF610_CLK_SAI3_EN] = imx_clk_gate("sai3_en", "sai3_sel", CCM_CSCDR1, 19);
         clk[VF610_CLK_SAI3_DIV] = imx_clk_divider("sai3_div", "sai3_en", CCM_CSCDR1, 12, 4);
-        clk[VF610_CLK_SAI3] = imx_clk_gate2("sai3", "sai3_div", CCM_CCGR1, CCM_CCGRx_CGn(2));
+        clk[VF610_CLK_SAI3] = imx_clk_gate2("sai3", "ipg_bus", CCM_CCGR1, CCM_CCGRx_CGn(2));
 
         clk[VF610_CLK_NFC_SEL] = imx_clk_mux("nfc_sel", CCM_CSCMR1, 12, 2, nfc_sels, 4);
         clk[VF610_CLK_NFC_EN] = imx_clk_gate("nfc_en", "nfc_sel", CCM_CSCDR2, 9);
diff --git a/drivers/clk/mmp/clk-mmp2.c b/drivers/clk/mmp/clk-mmp2.c
index 09d2832fbd78..71fd29348f28 100644
--- a/drivers/clk/mmp/clk-mmp2.c
+++ b/drivers/clk/mmp/clk-mmp2.c
@@ -9,6 +9,7 @@
  * warranty of any kind, whether express or implied.
  */
 
+#include <linux/clk.h>
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/spinlock.h>
diff --git a/drivers/clk/mmp/clk-pxa168.c b/drivers/clk/mmp/clk-pxa168.c
index 93e967c0f972..75244915df05 100644
--- a/drivers/clk/mmp/clk-pxa168.c
+++ b/drivers/clk/mmp/clk-pxa168.c
@@ -9,6 +9,7 @@
  * warranty of any kind, whether express or implied.
  */
 
+#include <linux/clk.h>
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/spinlock.h>
diff --git a/drivers/clk/mmp/clk-pxa910.c b/drivers/clk/mmp/clk-pxa910.c
index 993abcdb32cc..37ba04ba1368 100644
--- a/drivers/clk/mmp/clk-pxa910.c
+++ b/drivers/clk/mmp/clk-pxa910.c
@@ -9,6 +9,7 @@
  * warranty of any kind, whether express or implied.
  */
 
+#include <linux/clk.h>
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/spinlock.h>
diff --git a/drivers/clk/sunxi/clk-a10-pll2.c b/drivers/clk/sunxi/clk-a10-pll2.c
index 5484c31ec568..0ee1f363e4be 100644
--- a/drivers/clk/sunxi/clk-a10-pll2.c
+++ b/drivers/clk/sunxi/clk-a10-pll2.c
@@ -41,15 +41,10 @@
 
 #define SUN4I_PLL2_OUTPUTS              4
 
-struct sun4i_pll2_data {
-        u32     post_div_offset;
-        u32     pre_div_flags;
-};
-
 static DEFINE_SPINLOCK(sun4i_a10_pll2_lock);
 
 static void __init sun4i_pll2_setup(struct device_node *node,
-                                    struct sun4i_pll2_data *data)
+                                    int post_div_offset)
 {
         const char *clk_name = node->name, *parent;
         struct clk **clks, *base_clk, *prediv_clk;
@@ -76,7 +71,7 @@ static void __init sun4i_pll2_setup(struct device_node *node,
                                           parent, 0, reg,
                                           SUN4I_PLL2_PRE_DIV_SHIFT,
                                           SUN4I_PLL2_PRE_DIV_WIDTH,
-                                          data->pre_div_flags,
+                                          CLK_DIVIDER_ONE_BASED | CLK_DIVIDER_ALLOW_ZERO,
                                           &sun4i_a10_pll2_lock);
         if (!prediv_clk) {
                 pr_err("Couldn't register the prediv clock\n");
@@ -127,7 +122,7 @@ static void __init sun4i_pll2_setup(struct device_node *node,
          */
         val = readl(reg);
         val &= ~(SUN4I_PLL2_POST_DIV_MASK << SUN4I_PLL2_POST_DIV_SHIFT);
-        val |= (SUN4I_PLL2_POST_DIV_VALUE - data->post_div_offset) << SUN4I_PLL2_POST_DIV_SHIFT;
+        val |= (SUN4I_PLL2_POST_DIV_VALUE - post_div_offset) << SUN4I_PLL2_POST_DIV_SHIFT;
         writel(val, reg);
 
         of_property_read_string_index(node, "clock-output-names",
@@ -191,25 +186,17 @@ err_unmap:
         iounmap(reg);
 }
 
-static struct sun4i_pll2_data sun4i_a10_pll2_data = {
-        .pre_div_flags  = CLK_DIVIDER_ONE_BASED | CLK_DIVIDER_ALLOW_ZERO,
-};
-
 static void __init sun4i_a10_pll2_setup(struct device_node *node)
 {
-        sun4i_pll2_setup(node, &sun4i_a10_pll2_data);
+        sun4i_pll2_setup(node, 0);
 }
 
 CLK_OF_DECLARE(sun4i_a10_pll2, "allwinner,sun4i-a10-pll2-clk",
                sun4i_a10_pll2_setup);
 
-static struct sun4i_pll2_data sun5i_a13_pll2_data = {
-        .post_div_offset        = 1,
-};
-
 static void __init sun5i_a13_pll2_setup(struct device_node *node)
 {
-        sun4i_pll2_setup(node, &sun5i_a13_pll2_data);
+        sun4i_pll2_setup(node, 1);
 }
 
 CLK_OF_DECLARE(sun5i_a13_pll2, "allwinner,sun5i-a13-pll2-clk",
diff --git a/drivers/clk/ti/clk-816x.c b/drivers/clk/ti/clk-816x.c
index 1dfad0c712cd..2a5d84fdddc5 100644
--- a/drivers/clk/ti/clk-816x.c
+++ b/drivers/clk/ti/clk-816x.c
@@ -20,6 +20,8 @@ static struct ti_dt_clk dm816x_clks[] = {
         DT_CLK(NULL, "sys_clkin", "sys_clkin_ck"),
         DT_CLK(NULL, "timer_sys_ck", "sys_clkin_ck"),
         DT_CLK(NULL, "sys_32k_ck", "sys_32k_ck"),
+        DT_CLK(NULL, "timer_32k_ck", "sysclk18_ck"),
+        DT_CLK(NULL, "timer_ext_ck", "tclkin_ck"),
         DT_CLK(NULL, "mpu_ck", "mpu_ck"),
         DT_CLK(NULL, "timer1_fck", "timer1_fck"),
         DT_CLK(NULL, "timer2_fck", "timer2_fck"),
diff --git a/drivers/clk/ti/clkt_dpll.c b/drivers/clk/ti/clkt_dpll.c
index 9023ca9caf84..b5cc6f66ae5d 100644
--- a/drivers/clk/ti/clkt_dpll.c
+++ b/drivers/clk/ti/clkt_dpll.c
@@ -240,7 +240,7 @@ u8 omap2_init_dpll_parent(struct clk_hw *hw)
  */
 unsigned long omap2_get_dpll_rate(struct clk_hw_omap *clk)
 {
-        long long dpll_clk;
+        u64 dpll_clk;
         u32 dpll_mult, dpll_div, v;
         struct dpll_data *dd;
 
@@ -262,7 +262,7 @@ unsigned long omap2_get_dpll_rate(struct clk_hw_omap *clk)
         dpll_div = v & dd->div1_mask;
         dpll_div >>= __ffs(dd->div1_mask);
 
-        dpll_clk = (long long)clk_get_rate(dd->clk_ref) * dpll_mult;
+        dpll_clk = (u64)clk_get_rate(dd->clk_ref) * dpll_mult;
         do_div(dpll_clk, dpll_div + 1);
 
         return dpll_clk;
diff --git a/drivers/clk/ti/divider.c b/drivers/clk/ti/divider.c
index 5b1726829e6d..df2558350fc1 100644
--- a/drivers/clk/ti/divider.c
+++ b/drivers/clk/ti/divider.c
@@ -214,7 +214,6 @@ static int ti_clk_divider_set_rate(struct clk_hw *hw, unsigned long rate,
 {
         struct clk_divider *divider;
         unsigned int div, value;
-        unsigned long flags = 0;
         u32 val;
 
         if (!hw || !rate)
@@ -228,9 +227,6 @@ static int ti_clk_divider_set_rate(struct clk_hw *hw, unsigned long rate,
         if (value > div_mask(divider))
                 value = div_mask(divider);
 
-        if (divider->lock)
-                spin_lock_irqsave(divider->lock, flags);
-
         if (divider->flags & CLK_DIVIDER_HIWORD_MASK) {
                 val = div_mask(divider) << (divider->shift + 16);
         } else {
@@ -240,9 +236,6 @@ static int ti_clk_divider_set_rate(struct clk_hw *hw, unsigned long rate,
         val |= value << divider->shift;
         ti_clk_ll_ops->clk_writel(val, divider->reg);
 
-        if (divider->lock)
-                spin_unlock_irqrestore(divider->lock, flags);
-
         return 0;
 }
 
@@ -256,8 +249,7 @@ static struct clk *_register_divider(struct device *dev, const char *name,
                                      const char *parent_name,
                                      unsigned long flags, void __iomem *reg,
                                      u8 shift, u8 width, u8 clk_divider_flags,
-                                     const struct clk_div_table *table,
-                                     spinlock_t *lock)
+                                     const struct clk_div_table *table)
 {
         struct clk_divider *div;
         struct clk *clk;
@@ -288,7 +280,6 @@ static struct clk *_register_divider(struct device *dev, const char *name,
         div->shift = shift;
         div->width = width;
         div->flags = clk_divider_flags;
-        div->lock = lock;
         div->hw.init = &init;
         div->table = table;
 
@@ -421,7 +412,7 @@ struct clk *ti_clk_register_divider(struct ti_clk *setup)
 
         clk = _register_divider(NULL, setup->name, div->parent,
                                 flags, (void __iomem *)reg, div->bit_shift,
-                                width, div_flags, table, NULL);
+                                width, div_flags, table);
 
         if (IS_ERR(clk))
                 kfree(table);
@@ -584,8 +575,7 @@ static void __init of_ti_divider_clk_setup(struct device_node *node)
                 goto cleanup;
 
         clk = _register_divider(NULL, node->name, parent_name, flags, reg,
-                                shift, width, clk_divider_flags, table,
-                                NULL);
+                                shift, width, clk_divider_flags, table);
 
         if (!IS_ERR(clk)) {
                 of_clk_add_provider(node, of_clk_src_simple_get, clk);
diff --git a/drivers/clk/ti/fapll.c b/drivers/clk/ti/fapll.c
index f4b2e9888bdf..66a0d0ed8b55 100644
--- a/drivers/clk/ti/fapll.c
+++ b/drivers/clk/ti/fapll.c
@@ -168,7 +168,7 @@ static unsigned long ti_fapll_recalc_rate(struct clk_hw *hw,
 {
         struct fapll_data *fd = to_fapll(hw);
         u32 fapll_n, fapll_p, v;
-        long long rate;
+        u64 rate;
 
         if (ti_fapll_clock_is_bypass(fd))
                 return parent_rate;
@@ -314,7 +314,7 @@ static unsigned long ti_fapll_synth_recalc_rate(struct clk_hw *hw,
 {
         struct fapll_synth *synth = to_synth(hw);
         u32 synth_div_m;
-        long long rate;
+        u64 rate;
 
         /* The audio_pll_clk1 is hardwired to produce 32.768KiHz clock */
         if (!synth->div)
diff --git a/drivers/clk/ti/mux.c b/drivers/clk/ti/mux.c
index 69f08a1d047d..dab9ba88b9d6 100644
--- a/drivers/clk/ti/mux.c
+++ b/drivers/clk/ti/mux.c
@@ -69,7 +69,6 @@ static int ti_clk_mux_set_parent(struct clk_hw *hw, u8 index)
 {
         struct clk_mux *mux = to_clk_mux(hw);
         u32 val;
-        unsigned long flags = 0;
 
         if (mux->table) {
                 index = mux->table[index];
@@ -81,9 +80,6 @@ static int ti_clk_mux_set_parent(struct clk_hw *hw, u8 index)
                         index++;
         }
 
-        if (mux->lock)
-                spin_lock_irqsave(mux->lock, flags);
-
         if (mux->flags & CLK_MUX_HIWORD_MASK) {
                 val = mux->mask << (mux->shift + 16);
         } else {
@@ -93,9 +89,6 @@ static int ti_clk_mux_set_parent(struct clk_hw *hw, u8 index)
         val |= index << mux->shift;
         ti_clk_ll_ops->clk_writel(val, mux->reg);
 
-        if (mux->lock)
-                spin_unlock_irqrestore(mux->lock, flags);
-
         return 0;
 }
 
@@ -109,7 +102,7 @@ static struct clk *_register_mux(struct device *dev, const char *name,
                                  const char **parent_names, u8 num_parents,
                                  unsigned long flags, void __iomem *reg,
                                  u8 shift, u32 mask, u8 clk_mux_flags,
-                                 u32 *table, spinlock_t *lock)
+                                 u32 *table)
 {
         struct clk_mux *mux;
         struct clk *clk;
@@ -133,7 +126,6 @@ static struct clk *_register_mux(struct device *dev, const char *name,
         mux->shift = shift;
         mux->mask = mask;
         mux->flags = clk_mux_flags;
-        mux->lock = lock;
         mux->table = table;
         mux->hw.init = &init;
 
@@ -175,7 +167,7 @@ struct clk *ti_clk_register_mux(struct ti_clk *setup)
 
         return _register_mux(NULL, setup->name, mux->parents, mux->num_parents,
                              flags, (void __iomem *)reg, mux->bit_shift, mask,
-                             mux_flags, NULL, NULL);
+                             mux_flags, NULL);
 }
 
 /**
@@ -227,8 +219,7 @@ static void of_mux_clk_setup(struct device_node *node)
         mask = (1 << fls(mask)) - 1;
 
         clk = _register_mux(NULL, node->name, parent_names, num_parents,
-                            flags, reg, shift, mask, clk_mux_flags, NULL,
-                            NULL);
+                            flags, reg, shift, mask, clk_mux_flags, NULL);
 
         if (!IS_ERR(clk))
                 of_clk_add_provider(node, of_clk_src_simple_get, clk);
diff --git a/drivers/clocksource/mmio.c b/drivers/clocksource/mmio.c
index 1593ade2a815..c4f7d7a9b689 100644
--- a/drivers/clocksource/mmio.c
+++ b/drivers/clocksource/mmio.c
@@ -55,7 +55,7 @@ int __init clocksource_mmio_init(void __iomem *base, const char *name,
 {
         struct clocksource_mmio *cs;
 
-        if (bits > 32 || bits < 16)
+        if (bits > 64 || bits < 16)
                 return -EINVAL;
 
         cs = kzalloc(sizeof(struct clocksource_mmio), GFP_KERNEL);
diff --git a/drivers/cpufreq/Kconfig.arm b/drivers/cpufreq/Kconfig.arm
index 8014c2307332..b1f8a73e5a94 100644
--- a/drivers/cpufreq/Kconfig.arm
+++ b/drivers/cpufreq/Kconfig.arm
@@ -202,7 +202,7 @@ config ARM_SA1110_CPUFREQ
 
 config ARM_SCPI_CPUFREQ
         tristate "SCPI based CPUfreq driver"
-        depends on ARM_BIG_LITTLE_CPUFREQ && ARM_SCPI_PROTOCOL
+        depends on ARM_BIG_LITTLE_CPUFREQ && ARM_SCPI_PROTOCOL && COMMON_CLK_SCPI
         help
           This adds the CPUfreq driver support for ARM big.LITTLE platforms
           using SCPI protocol for CPU power management.
@@ -226,7 +226,7 @@ config ARM_TEGRA20_CPUFREQ
 
 config ARM_TEGRA124_CPUFREQ
         tristate "Tegra124 CPUFreq support"
-        depends on ARCH_TEGRA && CPUFREQ_DT
+        depends on ARCH_TEGRA && CPUFREQ_DT && REGULATOR
         default y
         help
           This adds the CPUFreq driver support for Tegra124 SOCs.
diff --git a/drivers/cpufreq/cppc_cpufreq.c b/drivers/cpufreq/cppc_cpufreq.c
index e8cb334094b0..7c0bdfb1a2ca 100644
--- a/drivers/cpufreq/cppc_cpufreq.c
+++ b/drivers/cpufreq/cppc_cpufreq.c
@@ -98,10 +98,11 @@ static int cppc_cpufreq_cpu_init(struct cpufreq_policy *policy)
         policy->max = cpu->perf_caps.highest_perf;
         policy->cpuinfo.min_freq = policy->min;
         policy->cpuinfo.max_freq = policy->max;
+        policy->shared_type = cpu->shared_type;
 
         if (policy->shared_type == CPUFREQ_SHARED_TYPE_ANY)
                 cpumask_copy(policy->cpus, cpu->shared_cpu_map);
-        else {
+        else if (policy->shared_type == CPUFREQ_SHARED_TYPE_ALL) {
                 /* Support only SW_ANY for now. */
                 pr_debug("Unsupported CPU co-ord type\n");
                 return -EFAULT;
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index 7c48e7316d91..8412ce5f93a7 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -976,10 +976,14 @@ static int cpufreq_init_policy(struct cpufreq_policy *policy)
 
         new_policy.governor = gov;
 
-        /* Use the default policy if its valid. */
-        if (cpufreq_driver->setpolicy)
-                cpufreq_parse_governor(gov->name, &new_policy.policy, NULL);
-
+        /* Use the default policy if there is no last_policy. */
+        if (cpufreq_driver->setpolicy) {
+                if (policy->last_policy)
+                        new_policy.policy = policy->last_policy;
+                else
+                        cpufreq_parse_governor(gov->name, &new_policy.policy,
+                                               NULL);
+        }
         /* set default policy */
         return cpufreq_set_policy(policy, &new_policy);
 }
@@ -1330,6 +1334,8 @@ static void cpufreq_offline_prepare(unsigned int cpu)
                 if (has_target())
                         strncpy(policy->last_governor, policy->governor->name,
                                 CPUFREQ_NAME_LEN);
+                else
+                        policy->last_policy = policy->policy;
         } else if (cpu == policy->cpu) {
                 /* Nominate new CPU */
                 policy->cpu = cpumask_any(policy->cpus);
@@ -1401,13 +1407,10 @@ static void cpufreq_remove_dev(struct device *dev, struct subsys_interface *sif)
         }
 
         cpumask_clear_cpu(cpu, policy->real_cpus);
+        remove_cpu_dev_symlink(policy, cpu);
 
-        if (cpumask_empty(policy->real_cpus)) {
+        if (cpumask_empty(policy->real_cpus))
                 cpufreq_policy_free(policy, true);
-                return;
-        }
-
-        remove_cpu_dev_symlink(policy, cpu);
 }
 
 static void handle_update(struct work_struct *work)
diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
index 001a532e342e..98fb8821382d 100644
--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -1101,6 +1101,8 @@ static int intel_pstate_set_policy(struct cpufreq_policy *policy)
             policy->max >= policy->cpuinfo.max_freq) {
                 pr_debug("intel_pstate: set performance\n");
                 limits = &performance_limits;
+                if (hwp_active)
+                        intel_pstate_hwp_set();
                 return 0;
         }
 
@@ -1108,7 +1110,8 @@ static int intel_pstate_set_policy(struct cpufreq_policy *policy)
         limits = &powersave_limits;
         limits->min_policy_pct = (policy->min * 100) / policy->cpuinfo.max_freq;
         limits->min_policy_pct = clamp_t(int, limits->min_policy_pct, 0 , 100);
-        limits->max_policy_pct = (policy->max * 100) / policy->cpuinfo.max_freq;
+        limits->max_policy_pct = DIV_ROUND_UP(policy->max * 100,
+                                              policy->cpuinfo.max_freq);
         limits->max_policy_pct = clamp_t(int, limits->max_policy_pct, 0 , 100);
 
         /* Normalize user input to [min_policy_pct, max_policy_pct] */
@@ -1120,6 +1123,7 @@ static int intel_pstate_set_policy(struct cpufreq_policy *policy)
                                    limits->max_sysfs_pct);
         limits->max_perf_pct = max(limits->min_policy_pct,
                                    limits->max_perf_pct);
+        limits->max_perf = round_up(limits->max_perf, FRAC_BITS);
 
         /* Make sure min_perf_pct <= max_perf_pct */
         limits->min_perf_pct = min(limits->max_perf_pct, limits->min_perf_pct);
diff --git a/drivers/cpufreq/s3c24xx-cpufreq.c b/drivers/cpufreq/s3c24xx-cpufreq.c
index 733aa5153e74..68ef8fd9482f 100644
--- a/drivers/cpufreq/s3c24xx-cpufreq.c
+++ b/drivers/cpufreq/s3c24xx-cpufreq.c
@@ -648,7 +648,7 @@ late_initcall(s3c_cpufreq_initcall);
  *
  * Register the given set of PLLs with the system.
  */
-int __init s3c_plltab_register(struct cpufreq_frequency_table *plls,
+int s3c_plltab_register(struct cpufreq_frequency_table *plls,
                                unsigned int plls_no)
 {
         struct cpufreq_frequency_table *vals;
diff --git a/drivers/cpufreq/scpi-cpufreq.c b/drivers/cpufreq/scpi-cpufreq.c
index 2c3b16fd3a01..de5e89b2eaaa 100644
--- a/drivers/cpufreq/scpi-cpufreq.c
+++ b/drivers/cpufreq/scpi-cpufreq.c
@@ -31,7 +31,7 @@ static struct scpi_ops *scpi_ops;
 
 static struct scpi_dvfs_info *scpi_get_dvfs_info(struct device *cpu_dev)
 {
-        u8 domain = topology_physical_package_id(cpu_dev->id);
+        int domain = topology_physical_package_id(cpu_dev->id);
 
         if (domain < 0)
                 return ERR_PTR(-EINVAL);
diff --git a/drivers/crypto/nx/nx-aes-ccm.c b/drivers/crypto/nx/nx-aes-ccm.c
index 73ef49922788..7038f364acb5 100644
--- a/drivers/crypto/nx/nx-aes-ccm.c
+++ b/drivers/crypto/nx/nx-aes-ccm.c
@@ -409,7 +409,7 @@ static int ccm_nx_decrypt(struct aead_request   *req,
                 processed += to_process;
         } while (processed < nbytes);
 
-        rc = memcmp(csbcpb->cpb.aes_ccm.out_pat_or_mac, priv->oauth_tag,
+        rc = crypto_memneq(csbcpb->cpb.aes_ccm.out_pat_or_mac, priv->oauth_tag,
                     authsize) ? -EBADMSG : 0;
 out:
         spin_unlock_irqrestore(&nx_ctx->lock, irq_flags);
diff --git a/drivers/crypto/nx/nx-aes-gcm.c b/drivers/crypto/nx/nx-aes-gcm.c
index eee624f589b6..abd465f479c4 100644
--- a/drivers/crypto/nx/nx-aes-gcm.c
+++ b/drivers/crypto/nx/nx-aes-gcm.c
@@ -21,6 +21,7 @@
 
 #include <crypto/internal/aead.h>
 #include <crypto/aes.h>
+#include <crypto/algapi.h>
 #include <crypto/scatterwalk.h>
 #include <linux/module.h>
 #include <linux/types.h>
@@ -418,7 +419,7 @@ mac:
                         itag, req->src, req->assoclen + nbytes,
                         crypto_aead_authsize(crypto_aead_reqtfm(req)),
                         SCATTERWALK_FROM_SG);
-                rc = memcmp(itag, otag,
+                rc = crypto_memneq(itag, otag,
                             crypto_aead_authsize(crypto_aead_reqtfm(req))) ?
                      -EBADMSG : 0;
         }
diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
index 46f531e19ccf..b6f9f42e2985 100644
--- a/drivers/crypto/talitos.c
+++ b/drivers/crypto/talitos.c
@@ -977,7 +977,7 @@ static void ipsec_esp_decrypt_swauth_done(struct device *dev,
                 } else
                         oicv = (char *)&edesc->link_tbl[0];
 
-                err = memcmp(oicv, icv, authsize) ? -EBADMSG : 0;
+                err = crypto_memneq(oicv, icv, authsize) ? -EBADMSG : 0;
         }
 
         kfree(edesc);
diff --git a/drivers/dma/at_xdmac.c b/drivers/dma/at_xdmac.c
index 7f039de143f0..370c661c7d7b 100644
--- a/drivers/dma/at_xdmac.c
+++ b/drivers/dma/at_xdmac.c
@@ -156,7 +156,7 @@
 #define         AT_XDMAC_CC_WRIP        (0x1 << 23)     /* Write in Progress (read only) */
 #define                 AT_XDMAC_CC_WRIP_DONE           (0x0 << 23)
 #define                 AT_XDMAC_CC_WRIP_IN_PROGRESS    (0x1 << 23)
-#define         AT_XDMAC_CC_PERID(i)    (0x7f & (h) << 24)      /* Channel Peripheral Identifier */
+#define         AT_XDMAC_CC_PERID(i)    (0x7f & (i) << 24)      /* Channel Peripheral Identifier */
 #define AT_XDMAC_CDS_MSP        0x2C    /* Channel Data Stride Memory Set Pattern */
 #define AT_XDMAC_CSUS           0x30    /* Channel Source Microblock Stride */
 #define AT_XDMAC_CDUS           0x34    /* Channel Destination Microblock Stride */
@@ -965,7 +965,9 @@ at_xdmac_prep_interleaved(struct dma_chan *chan,
                                                         NULL,
                                                         src_addr, dst_addr,
                                                         xt, xt->sgl);
-                for (i = 0; i < xt->numf; i++)
+
+                /* Length of the block is (BLEN+1) microblocks. */
+                for (i = 0; i < xt->numf - 1; i++)
                         at_xdmac_increment_block_count(chan, first);
 
                 dev_dbg(chan2dev(chan), "%s: add desc 0x%p to descs_list 0x%p\n",
@@ -1086,6 +1088,7 @@ at_xdmac_prep_dma_memcpy(struct dma_chan *chan, dma_addr_t dest, dma_addr_t src,
                 /* Check remaining length and change data width if needed. */
                 dwidth = at_xdmac_align_width(chan,
                                               src_addr | dst_addr | xfer_size);
+                chan_cc &= ~AT_XDMAC_CC_DWIDTH_MASK;
                 chan_cc |= AT_XDMAC_CC_DWIDTH(dwidth);
 
                 ublen = xfer_size >> dwidth;
@@ -1333,7 +1336,7 @@ at_xdmac_prep_dma_memset_sg(struct dma_chan *chan, struct scatterlist *sgl,
                  * since we don't care about the stride anymore.
                  */
                 if ((i == (sg_len - 1)) &&
-                    sg_dma_len(ppsg) == sg_dma_len(psg)) {
+                    sg_dma_len(psg) == sg_dma_len(sg)) {
                         dev_dbg(chan2dev(chan),
                                 "%s: desc 0x%p can be merged with desc 0x%p\n",
                                 __func__, desc, pdesc);
diff --git a/drivers/dma/bcm2835-dma.c b/drivers/dma/bcm2835-dma.c
index c92d6a70ccf3..996c4b00d323 100644
--- a/drivers/dma/bcm2835-dma.c
+++ b/drivers/dma/bcm2835-dma.c
@@ -31,6 +31,7 @@
  */
 #include <linux/dmaengine.h>
 #include <linux/dma-mapping.h>
+#include <linux/dmapool.h>
 #include <linux/err.h>
 #include <linux/init.h>
 #include <linux/interrupt.h>
@@ -62,6 +63,11 @@ struct bcm2835_dma_cb {
         uint32_t pad[2];
 };
 
+struct bcm2835_cb_entry {
+        struct bcm2835_dma_cb *cb;
+        dma_addr_t paddr;
+};
+
 struct bcm2835_chan {
         struct virt_dma_chan vc;
         struct list_head node;
@@ -72,18 +78,18 @@ struct bcm2835_chan {
 
         int ch;
         struct bcm2835_desc *desc;
+        struct dma_pool *cb_pool;
 
         void __iomem *chan_base;
         int irq_number;
 };
 
 struct bcm2835_desc {
+        struct bcm2835_chan *c;
         struct virt_dma_desc vd;
         enum dma_transfer_direction dir;
 
-        unsigned int control_block_size;
-        struct bcm2835_dma_cb *control_block_base;
-        dma_addr_t control_block_base_phys;
+        struct bcm2835_cb_entry *cb_list;
 
         unsigned int frames;
         size_t size;
@@ -143,10 +149,13 @@ static inline struct bcm2835_desc *to_bcm2835_dma_desc(
 static void bcm2835_dma_desc_free(struct virt_dma_desc *vd)
 {
         struct bcm2835_desc *desc = container_of(vd, struct bcm2835_desc, vd);
-        dma_free_coherent(desc->vd.tx.chan->device->dev,
-                        desc->control_block_size,
-                        desc->control_block_base,
-                        desc->control_block_base_phys);
+        int i;
+
+        for (i = 0; i < desc->frames; i++)
+                dma_pool_free(desc->c->cb_pool, desc->cb_list[i].cb,
+                              desc->cb_list[i].paddr);
+
+        kfree(desc->cb_list);
         kfree(desc);
 }
 
@@ -199,7 +208,7 @@ static void bcm2835_dma_start_desc(struct bcm2835_chan *c)
 
         c->desc = d = to_bcm2835_dma_desc(&vd->tx);
 
-        writel(d->control_block_base_phys, c->chan_base + BCM2835_DMA_ADDR);
+        writel(d->cb_list[0].paddr, c->chan_base + BCM2835_DMA_ADDR);
         writel(BCM2835_DMA_ACTIVE, c->chan_base + BCM2835_DMA_CS);
 }
 
@@ -232,9 +241,16 @@ static irqreturn_t bcm2835_dma_callback(int irq, void *data)
 static int bcm2835_dma_alloc_chan_resources(struct dma_chan *chan)
 {
         struct bcm2835_chan *c = to_bcm2835_dma_chan(chan);
+        struct device *dev = c->vc.chan.device->dev;
+
+        dev_dbg(dev, "Allocating DMA channel %d\n", c->ch);
 
-        dev_dbg(c->vc.chan.device->dev,
-                        "Allocating DMA channel %d\n", c->ch);
+        c->cb_pool = dma_pool_create(dev_name(dev), dev,
+                                     sizeof(struct bcm2835_dma_cb), 0, 0);
+        if (!c->cb_pool) {
+                dev_err(dev, "unable to allocate descriptor pool\n");
+                return -ENOMEM;
+        }
 
         return request_irq(c->irq_number,
                         bcm2835_dma_callback, 0, "DMA IRQ", c);
@@ -246,6 +262,7 @@ static void bcm2835_dma_free_chan_resources(struct dma_chan *chan)
 
         vchan_free_chan_resources(&c->vc);
         free_irq(c->irq_number, c);
+        dma_pool_destroy(c->cb_pool);
 
         dev_dbg(c->vc.chan.device->dev, "Freeing DMA channel %u\n", c->ch);
 }
@@ -261,8 +278,7 @@ static size_t bcm2835_dma_desc_size_pos(struct bcm2835_desc *d, dma_addr_t addr)
         size_t size;
 
         for (size = i = 0; i < d->frames; i++) {
-                struct bcm2835_dma_cb *control_block =
-                        &d->control_block_base[i];
+                struct bcm2835_dma_cb *control_block = d->cb_list[i].cb;
                 size_t this_size = control_block->length;
                 dma_addr_t dma;
 
@@ -343,6 +359,7 @@ static struct dma_async_tx_descriptor *bcm2835_dma_prep_dma_cyclic(
         dma_addr_t dev_addr;
         unsigned int es, sync_type;
         unsigned int frame;
+        int i;
 
         /* Grab configuration */
         if (!is_slave_direction(direction)) {
@@ -374,27 +391,31 @@ static struct dma_async_tx_descriptor *bcm2835_dma_prep_dma_cyclic(
         if (!d)
                 return NULL;
 
+        d->c = c;
         d->dir = direction;
         d->frames = buf_len / period_len;
 
-        /* Allocate memory for control blocks */
-        d->control_block_size = d->frames * sizeof(struct bcm2835_dma_cb);
-        d->control_block_base = dma_zalloc_coherent(chan->device->dev,
-                        d->control_block_size, &d->control_block_base_phys,
-                        GFP_NOWAIT);
-
-        if (!d->control_block_base) {
+        d->cb_list = kcalloc(d->frames, sizeof(*d->cb_list), GFP_KERNEL);
+        if (!d->cb_list) {
                 kfree(d);
                 return NULL;
         }
+        /* Allocate memory for control blocks */
+        for (i = 0; i < d->frames; i++) {
+                struct bcm2835_cb_entry *cb_entry = &d->cb_list[i];
+
+                cb_entry->cb = dma_pool_zalloc(c->cb_pool, GFP_ATOMIC,
+                                               &cb_entry->paddr);
+                if (!cb_entry->cb)
+                        goto error_cb;
+        }
 
         /*
          * Iterate over all frames, create a control block
          * for each frame and link them together.
          */
         for (frame = 0; frame < d->frames; frame++) {
-                struct bcm2835_dma_cb *control_block =
-                        &d->control_block_base[frame];
+                struct bcm2835_dma_cb *control_block = d->cb_list[frame].cb;
 
                 /* Setup adresses */
                 if (d->dir == DMA_DEV_TO_MEM) {
@@ -428,12 +449,21 @@ static struct dma_async_tx_descriptor *bcm2835_dma_prep_dma_cyclic(
                  * This DMA engine driver currently only supports cyclic DMA.
                  * Therefore, wrap around at number of frames.
                  */
-                control_block->next = d->control_block_base_phys +
-                        sizeof(struct bcm2835_dma_cb)
-                        * ((frame + 1) % d->frames);
+                control_block->next = d->cb_list[((frame + 1) % d->frames)].paddr;
         }
 
         return vchan_tx_prep(&c->vc, &d->vd, flags);
+error_cb:
+        i--;
+        for (; i >= 0; i--) {
+                struct bcm2835_cb_entry *cb_entry = &d->cb_list[i];
+
+                dma_pool_free(c->cb_pool, cb_entry->cb, cb_entry->paddr);
+        }
+
+        kfree(d->cb_list);
+        kfree(d);
+        return NULL;
 }
 
 static int bcm2835_dma_slave_config(struct dma_chan *chan,
diff --git a/drivers/dma/edma.c b/drivers/dma/edma.c
index 0675e268d577..16fe773fb846 100644
--- a/drivers/dma/edma.c
+++ b/drivers/dma/edma.c
@@ -1752,16 +1752,14 @@ static enum dma_status edma_tx_status(struct dma_chan *chan,
         return ret;
 }
 
-static bool edma_is_memcpy_channel(int ch_num, u16 *memcpy_channels)
+static bool edma_is_memcpy_channel(int ch_num, s32 *memcpy_channels)
 {
-        s16 *memcpy_ch = memcpy_channels;
-
         if (!memcpy_channels)
                 return false;
-        while (*memcpy_ch != -1) {
-                if (*memcpy_ch == ch_num)
+        while (*memcpy_channels != -1) {
+                if (*memcpy_channels == ch_num)
                         return true;
-                memcpy_ch++;
+                memcpy_channels++;
         }
         return false;
 }
@@ -1775,7 +1773,7 @@ static void edma_dma_init(struct edma_cc *ecc, bool legacy_mode)
 {
         struct dma_device *s_ddev = &ecc->dma_slave;
         struct dma_device *m_ddev = NULL;
-        s16 *memcpy_channels = ecc->info->memcpy_channels;
+        s32 *memcpy_channels = ecc->info->memcpy_channels;
         int i, j;
 
         dma_cap_zero(s_ddev->cap_mask);
@@ -1996,16 +1994,16 @@ static struct edma_soc_info *edma_setup_info_from_dt(struct device *dev,
         prop = of_find_property(dev->of_node, "ti,edma-memcpy-channels", &sz);
         if (prop) {
                 const char pname[] = "ti,edma-memcpy-channels";
-                size_t nelm = sz / sizeof(s16);
-                s16 *memcpy_ch;
+                size_t nelm = sz / sizeof(s32);
+                s32 *memcpy_ch;
 
-                memcpy_ch = devm_kcalloc(dev, nelm + 1, sizeof(s16),
+                memcpy_ch = devm_kcalloc(dev, nelm + 1, sizeof(s32),
                                          GFP_KERNEL);
                 if (!memcpy_ch)
                         return ERR_PTR(-ENOMEM);
 
-                ret = of_property_read_u16_array(dev->of_node, pname,
-                                                 (u16 *)memcpy_ch, nelm);
+                ret = of_property_read_u32_array(dev->of_node, pname,
+                                                 (u32 *)memcpy_ch, nelm);
                 if (ret)
                         return ERR_PTR(ret);
 
@@ -2017,31 +2015,50 @@ static struct edma_soc_info *edma_setup_info_from_dt(struct device *dev,
                                 &sz);
         if (prop) {
                 const char pname[] = "ti,edma-reserved-slot-ranges";
+                u32 (*tmp)[2];
                 s16 (*rsv_slots)[2];
-                size_t nelm = sz / sizeof(*rsv_slots);
+                size_t nelm = sz / sizeof(*tmp);
                 struct edma_rsv_info *rsv_info;
+                int i;
 
                 if (!nelm)
                         return info;
 
+                tmp = kcalloc(nelm, sizeof(*tmp), GFP_KERNEL);
+                if (!tmp)
+                        return ERR_PTR(-ENOMEM);
+
                 rsv_info = devm_kzalloc(dev, sizeof(*rsv_info), GFP_KERNEL);
-                if (!rsv_info)
+                if (!rsv_info) {
+                        kfree(tmp);
                         return ERR_PTR(-ENOMEM);
+                }
 
                 rsv_slots = devm_kcalloc(dev, nelm + 1, sizeof(*rsv_slots),
                                          GFP_KERNEL);
-                if (!rsv_slots)
+                if (!rsv_slots) {
+                        kfree(tmp);
                         return ERR_PTR(-ENOMEM);
+                }
 
-                ret = of_property_read_u16_array(dev->of_node, pname,
-                                                 (u16 *)rsv_slots, nelm * 2);
-                if (ret)
+                ret = of_property_read_u32_array(dev->of_node, pname,
+                                                 (u32 *)tmp, nelm * 2);
+                if (ret) {
+                        kfree(tmp);
                         return ERR_PTR(ret);
+                }
 
+                for (i = 0; i < nelm; i++) {
+                        rsv_slots[i][0] = tmp[i][0];
+                        rsv_slots[i][1] = tmp[i][1];
+                }
                 rsv_slots[nelm][0] = -1;
                 rsv_slots[nelm][1] = -1;
+
                 info->rsv = rsv_info;
                 info->rsv->rsv_slots = (const s16 (*)[2])rsv_slots;
+
+                kfree(tmp);
         }
 
         return info;
diff --git a/drivers/dma/mic_x100_dma.c b/drivers/dma/mic_x100_dma.c
index 068e920ecb68..cddfa8dbf4bd 100644
--- a/drivers/dma/mic_x100_dma.c
+++ b/drivers/dma/mic_x100_dma.c
@@ -317,6 +317,7 @@ mic_dma_prep_memcpy_lock(struct dma_chan *ch, dma_addr_t dma_dest,
         struct mic_dma_chan *mic_ch = to_mic_dma_chan(ch);
         struct device *dev = mic_dma_ch_to_device(mic_ch);
         int result;
+        struct dma_async_tx_descriptor *tx = NULL;
 
         if (!len && !flags)
                 return NULL;
@@ -324,10 +325,13 @@ mic_dma_prep_memcpy_lock(struct dma_chan *ch, dma_addr_t dma_dest,
         spin_lock(&mic_ch->prep_lock);
         result = mic_dma_do_dma(mic_ch, flags, dma_src, dma_dest, len);
         if (result >= 0)
-                return allocate_tx(mic_ch);
-        dev_err(dev, "Error enqueueing dma, error=%d\n", result);
+                tx = allocate_tx(mic_ch);
+
+        if (!tx)
+                dev_err(dev, "Error enqueueing dma, error=%d\n", result);
+
         spin_unlock(&mic_ch->prep_lock);
-        return NULL;
+        return tx;
 }
 
 static struct dma_async_tx_descriptor *
@@ -335,13 +339,14 @@ mic_dma_prep_interrupt_lock(struct dma_chan *ch, unsigned long flags)
 {
         struct mic_dma_chan *mic_ch = to_mic_dma_chan(ch);
         int ret;
+        struct dma_async_tx_descriptor *tx = NULL;
 
         spin_lock(&mic_ch->prep_lock);
         ret = mic_dma_do_dma(mic_ch, flags, 0, 0, 0);
         if (!ret)
-                return allocate_tx(mic_ch);
+                tx = allocate_tx(mic_ch);
         spin_unlock(&mic_ch->prep_lock);
-        return NULL;
+        return tx;
 }
 
 /* Return the status of the transaction */
diff --git a/drivers/fpga/fpga-mgr.c b/drivers/fpga/fpga-mgr.c
index a24f5cb877e0..953dc9195937 100644
--- a/drivers/fpga/fpga-mgr.c
+++ b/drivers/fpga/fpga-mgr.c
@@ -122,12 +122,10 @@ int fpga_mgr_firmware_load(struct fpga_manager *mgr, u32 flags,
         }
 
         ret = fpga_mgr_buf_load(mgr, flags, fw->data, fw->size);
-        if (ret)
-                return ret;
 
         release_firmware(fw);
 
-        return 0;
+        return ret;
 }
 EXPORT_SYMBOL_GPL(fpga_mgr_firmware_load);
 
@@ -256,7 +254,6 @@ int fpga_mgr_register(struct device *dev, const char *name,
                       void *priv)
 {
         struct fpga_manager *mgr;
-        const char *dt_label;
         int id, ret;
 
         if (!mops || !mops->write_init || !mops->write ||
@@ -300,11 +297,9 @@ int fpga_mgr_register(struct device *dev, const char *name,
         mgr->dev.id = id;
         dev_set_drvdata(dev, mgr);
 
-        dt_label = of_get_property(mgr->dev.of_node, "label", NULL);
-        if (dt_label)
-                ret = dev_set_name(&mgr->dev, "%s", dt_label);
-        else
-                ret = dev_set_name(&mgr->dev, "fpga%d", id);
+        ret = dev_set_name(&mgr->dev, "fpga%d", id);
+        if (ret)
+                goto error_device;
 
         ret = device_add(&mgr->dev);
         if (ret)
diff --git a/drivers/gpio/gpio-74xx-mmio.c b/drivers/gpio/gpio-74xx-mmio.c
index 6ed7c0fb3378..6b186829087c 100644
--- a/drivers/gpio/gpio-74xx-mmio.c
+++ b/drivers/gpio/gpio-74xx-mmio.c
@@ -113,13 +113,16 @@ static int mmio_74xx_dir_out(struct gpio_chip *gc, unsigned int gpio, int val)
 
 static int mmio_74xx_gpio_probe(struct platform_device *pdev)
 {
-        const struct of_device_id *of_id =
-                of_match_device(mmio_74xx_gpio_ids, &pdev->dev);
+        const struct of_device_id *of_id;
         struct mmio_74xx_gpio_priv *priv;
         struct resource *res;
         void __iomem *dat;
         int err;
 
+        of_id = of_match_device(mmio_74xx_gpio_ids, &pdev->dev);
+        if (!of_id)
+                return -ENODEV;
+
         priv = devm_kzalloc(&pdev->dev, sizeof(*priv), GFP_KERNEL);
         if (!priv)
                 return -ENOMEM;
diff --git a/drivers/gpio/gpio-ath79.c b/drivers/gpio/gpio-ath79.c
index e5827a56ff3b..5eaea8b812cf 100644
--- a/drivers/gpio/gpio-ath79.c
+++ b/drivers/gpio/gpio-ath79.c
@@ -113,7 +113,7 @@ static int ar934x_gpio_direction_output(struct gpio_chip *chip, unsigned offset,
                 __raw_writel(BIT(offset), ctrl->base + AR71XX_GPIO_REG_CLEAR);
 
         __raw_writel(
-                __raw_readl(ctrl->base + AR71XX_GPIO_REG_OE) & BIT(offset),
+                __raw_readl(ctrl->base + AR71XX_GPIO_REG_OE) & ~BIT(offset),
                 ctrl->base + AR71XX_GPIO_REG_OE);
 
         spin_unlock_irqrestore(&ctrl->lock, flags);
diff --git a/drivers/gpio/gpio-generic.c b/drivers/gpio/gpio-generic.c
index bd5193c67a9c..88ae70ddb127 100644
--- a/drivers/gpio/gpio-generic.c
+++ b/drivers/gpio/gpio-generic.c
@@ -141,9 +141,9 @@ static int bgpio_get_set(struct gpio_chip *gc, unsigned int gpio)
         unsigned long pinmask = bgc->pin2mask(bgc, gpio);
 
         if (bgc->dir & pinmask)
-                return bgc->read_reg(bgc->reg_set) & pinmask;
+                return !!(bgc->read_reg(bgc->reg_set) & pinmask);
         else
-                return bgc->read_reg(bgc->reg_dat) & pinmask;
+                return !!(bgc->read_reg(bgc->reg_dat) & pinmask);
 }
 
 static int bgpio_get(struct gpio_chip *gc, unsigned int gpio)
diff --git a/drivers/gpio/gpio-omap.c b/drivers/gpio/gpio-omap.c
index 56d2d026e62e..f7fbb46d5d79 100644
--- a/drivers/gpio/gpio-omap.c
+++ b/drivers/gpio/gpio-omap.c
@@ -1122,8 +1122,6 @@ static int omap_gpio_chip_init(struct gpio_bank *bank, struct irq_chip *irqc)
         /* MPUIO is a bit different, reading IRQ status clears it */
         if (bank->is_mpuio) {
                 irqc->irq_ack = dummy_irq_chip.irq_ack;
-                irqc->irq_mask = irq_gc_mask_set_bit;
-                irqc->irq_unmask = irq_gc_mask_clr_bit;
                 if (!bank->regs->wkup_en)
                         irqc->irq_set_wake = NULL;
         }
diff --git a/drivers/gpio/gpio-palmas.c b/drivers/gpio/gpio-palmas.c
index 171a6389f9ce..52b447c071cb 100644
--- a/drivers/gpio/gpio-palmas.c
+++ b/drivers/gpio/gpio-palmas.c
@@ -167,6 +167,8 @@ static int palmas_gpio_probe(struct platform_device *pdev)
         const struct palmas_device_data *dev_data;
 
         match = of_match_device(of_palmas_gpio_match, &pdev->dev);
+        if (!match)
+                return -ENODEV;
         dev_data = match->data;
         if (!dev_data)
                 dev_data = &palmas_dev_data;
diff --git a/drivers/gpio/gpio-syscon.c b/drivers/gpio/gpio-syscon.c
index 045a952576c7..7b25fdf64802 100644
--- a/drivers/gpio/gpio-syscon.c
+++ b/drivers/gpio/gpio-syscon.c
@@ -187,11 +187,15 @@ MODULE_DEVICE_TABLE(of, syscon_gpio_ids);
 static int syscon_gpio_probe(struct platform_device *pdev)
 {
         struct device *dev = &pdev->dev;
-        const struct of_device_id *of_id = of_match_device(syscon_gpio_ids, dev);
+        const struct of_device_id *of_id;
         struct syscon_gpio_priv *priv;
         struct device_node *np = dev->of_node;
         int ret;
 
+        of_id = of_match_device(syscon_gpio_ids, dev);
+        if (!of_id)
+                return -ENODEV;
+
         priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
         if (!priv)
                 return -ENOMEM;
diff --git a/drivers/gpio/gpio-tegra.c b/drivers/gpio/gpio-tegra.c
index 027e5f47dd28..896bf29776b0 100644
--- a/drivers/gpio/gpio-tegra.c
+++ b/drivers/gpio/gpio-tegra.c
@@ -375,6 +375,60 @@ static int tegra_gpio_irq_set_wake(struct irq_data *d, unsigned int enable)
 }
 #endif
 
+#ifdef  CONFIG_DEBUG_FS
+
+#include <linux/debugfs.h>
+#include <linux/seq_file.h>
+
+static int dbg_gpio_show(struct seq_file *s, void *unused)
+{
+        int i;
+        int j;
+
+        for (i = 0; i < tegra_gpio_bank_count; i++) {
+                for (j = 0; j < 4; j++) {
+                        int gpio = tegra_gpio_compose(i, j, 0);
+                        seq_printf(s,
+                                "%d:%d %02x %02x %02x %02x %02x %02x %06x\n",
+                                i, j,
+                                tegra_gpio_readl(GPIO_CNF(gpio)),
+                                tegra_gpio_readl(GPIO_OE(gpio)),
+                                tegra_gpio_readl(GPIO_OUT(gpio)),
+                                tegra_gpio_readl(GPIO_IN(gpio)),
+                                tegra_gpio_readl(GPIO_INT_STA(gpio)),
+                                tegra_gpio_readl(GPIO_INT_ENB(gpio)),
+                                tegra_gpio_readl(GPIO_INT_LVL(gpio)));
+                }
+        }
+        return 0;
+}
+
+static int dbg_gpio_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, dbg_gpio_show, &inode->i_private);
+}
+
+static const struct file_operations debug_fops = {
+        .open           = dbg_gpio_open,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = single_release,
+};
+
+static void tegra_gpio_debuginit(void)
+{
+        (void) debugfs_create_file("tegra_gpio", S_IRUGO,
+                                        NULL, NULL, &debug_fops);
+}
+
+#else
+
+static inline void tegra_gpio_debuginit(void)
+{
+}
+
+#endif
+
 static struct irq_chip tegra_gpio_irq_chip = {
         .name           = "GPIO",
         .irq_ack        = tegra_gpio_irq_ack,
@@ -519,6 +573,8 @@ static int tegra_gpio_probe(struct platform_device *pdev)
                         spin_lock_init(&bank->lvl_lock[j]);
         }
 
+        tegra_gpio_debuginit();
+
         return 0;
 }
 
@@ -536,52 +592,3 @@ static int __init tegra_gpio_init(void)
         return platform_driver_register(&tegra_gpio_driver);
 }
 postcore_initcall(tegra_gpio_init);
-
-#ifdef  CONFIG_DEBUG_FS
-
-#include <linux/debugfs.h>
-#include <linux/seq_file.h>
-
-static int dbg_gpio_show(struct seq_file *s, void *unused)
-{
-        int i;
-        int j;
-
-        for (i = 0; i < tegra_gpio_bank_count; i++) {
-                for (j = 0; j < 4; j++) {
-                        int gpio = tegra_gpio_compose(i, j, 0);
-                        seq_printf(s,
-                                "%d:%d %02x %02x %02x %02x %02x %02x %06x\n",
-                                i, j,
-                                tegra_gpio_readl(GPIO_CNF(gpio)),
-                                tegra_gpio_readl(GPIO_OE(gpio)),
-                                tegra_gpio_readl(GPIO_OUT(gpio)),
-                                tegra_gpio_readl(GPIO_IN(gpio)),
-                                tegra_gpio_readl(GPIO_INT_STA(gpio)),
-                                tegra_gpio_readl(GPIO_INT_ENB(gpio)),
-                                tegra_gpio_readl(GPIO_INT_LVL(gpio)));
-                }
-        }
-        return 0;
-}
-
-static int dbg_gpio_open(struct inode *inode, struct file *file)
-{
-        return single_open(file, dbg_gpio_show, &inode->i_private);
-}
-
-static const struct file_operations debug_fops = {
-        .open           = dbg_gpio_open,
-        .read           = seq_read,
-        .llseek         = seq_lseek,
-        .release        = single_release,
-};
-
-static int __init tegra_gpio_debuginit(void)
-{
-        (void) debugfs_create_file("tegra_gpio", S_IRUGO,
-                                        NULL, NULL, &debug_fops);
-        return 0;
-}
-late_initcall(tegra_gpio_debuginit);
-#endif
diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index a18f00fc1bb8..4e4c3083ae56 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -233,7 +233,7 @@ static struct gpio_desc *gpio_name_to_desc(const char * const name)
                 for (i = 0; i != chip->ngpio; ++i) {
                         struct gpio_desc *gpio = &chip->desc[i];
 
-                        if (!gpio->name)
+                        if (!gpio->name || !name)
                                 continue;
 
                         if (!strcmp(gpio->name, name)) {
@@ -1279,7 +1279,13 @@ static int _gpiod_get_raw_value(const struct gpio_desc *desc)
         chip = desc->chip;
         offset = gpio_chip_hwgpio(desc);
         value = chip->get ? chip->get(chip, offset) : -EIO;
-        value = value < 0 ? value : !!value;
+        /*
+         * FIXME: fix all drivers to clamp to [0,1] or return negative,
+         * then change this to:
+         * value = value < 0 ? value : !!value;
+         * so we can properly propagate error codes.
+         */
+        value = !!value;
         trace_gpio_value(desc_to_gpio(desc), 1, value);
         return value;
 }
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu.h b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
index 306f75700bf8..048cfe073dae 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
@@ -496,6 +496,7 @@ struct amdgpu_bo_va_mapping {
 
 /* bo virtual addresses in a specific vm */
 struct amdgpu_bo_va {
+        struct mutex                    mutex;
         /* protected by bo being reserved */
         struct list_head                bo_list;
         struct fence                    *last_pt_update;
@@ -538,6 +539,7 @@ struct amdgpu_bo {
         /* Constant after initialization */
         struct amdgpu_device            *adev;
         struct drm_gem_object           gem_base;
+        struct amdgpu_bo                *parent;
 
         struct ttm_bo_kmap_obj          dma_buf_vmap;
         pid_t                           pid;
@@ -928,8 +930,6 @@ struct amdgpu_vm_id {
 };
 
 struct amdgpu_vm {
-        struct mutex            mutex;
-
         struct rb_root          va;
 
         /* protecting invalidated */
@@ -956,6 +956,8 @@ struct amdgpu_vm {
         struct amdgpu_vm_id     ids[AMDGPU_MAX_RINGS];
         /* for interval tree */
         spinlock_t              it_lock;
+        /* protecting freed */
+        spinlock_t              freed_lock;
 };
 
 struct amdgpu_vm_manager {
@@ -1262,7 +1264,8 @@ struct amdgpu_cs_parser {
         struct ww_acquire_ctx   ticket;
 
         /* user fence */
-        struct amdgpu_user_fence uf;
+        struct amdgpu_user_fence        uf;
+        struct amdgpu_bo_list_entry     uf_entry;
 };
 
 struct amdgpu_job {
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
index 3afcf0237c25..25a3e2485cc2 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
@@ -127,6 +127,37 @@ int amdgpu_cs_get_ring(struct amdgpu_device *adev, u32 ip_type,
         return 0;
 }
 
+static int amdgpu_cs_user_fence_chunk(struct amdgpu_cs_parser *p,
+                                      struct drm_amdgpu_cs_chunk_fence *fence_data)
+{
+        struct drm_gem_object *gobj;
+        uint32_t handle;
+
+        handle = fence_data->handle;
+        gobj = drm_gem_object_lookup(p->adev->ddev, p->filp,
+                                     fence_data->handle);
+        if (gobj == NULL)
+                return -EINVAL;
+
+        p->uf.bo = amdgpu_bo_ref(gem_to_amdgpu_bo(gobj));
+        p->uf.offset = fence_data->offset;
+
+        if (amdgpu_ttm_tt_has_userptr(p->uf.bo->tbo.ttm)) {
+                drm_gem_object_unreference_unlocked(gobj);
+                return -EINVAL;
+        }
+
+        p->uf_entry.robj = amdgpu_bo_ref(p->uf.bo);
+        p->uf_entry.prefered_domains = AMDGPU_GEM_DOMAIN_GTT;
+        p->uf_entry.allowed_domains = AMDGPU_GEM_DOMAIN_GTT;
+        p->uf_entry.priority = 0;
+        p->uf_entry.tv.bo = &p->uf_entry.robj->tbo;
+        p->uf_entry.tv.shared = true;
+
+        drm_gem_object_unreference_unlocked(gobj);
+        return 0;
+}
+
 int amdgpu_cs_parser_init(struct amdgpu_cs_parser *p, void *data)
 {
         union drm_amdgpu_cs *cs = data;
@@ -207,26 +238,15 @@ int amdgpu_cs_parser_init(struct amdgpu_cs_parser *p, void *data)
 
                 case AMDGPU_CHUNK_ID_FENCE:
                         size = sizeof(struct drm_amdgpu_cs_chunk_fence);
-                        if (p->chunks[i].length_dw * sizeof(uint32_t) >= size) {
-                                uint32_t handle;
-                                struct drm_gem_object *gobj;
-                                struct drm_amdgpu_cs_chunk_fence *fence_data;
-
-                                fence_data = (void *)p->chunks[i].kdata;
-                                handle = fence_data->handle;
-                                gobj = drm_gem_object_lookup(p->adev->ddev,
-                                                             p->filp, handle);
-                                if (gobj == NULL) {
-                                        ret = -EINVAL;
-                                        goto free_partial_kdata;
-                                }
-
-                                p->uf.bo = gem_to_amdgpu_bo(gobj);
-                                p->uf.offset = fence_data->offset;
-                        } else {
+                        if (p->chunks[i].length_dw * sizeof(uint32_t) < size) {
                                 ret = -EINVAL;
                                 goto free_partial_kdata;
                         }
+
+                        ret = amdgpu_cs_user_fence_chunk(p, (void *)p->chunks[i].kdata);
+                        if (ret)
+                                goto free_partial_kdata;
+
                         break;
 
                 case AMDGPU_CHUNK_ID_DEPENDENCIES:
@@ -389,6 +409,9 @@ static int amdgpu_cs_parser_relocs(struct amdgpu_cs_parser *p)
         p->vm_bos = amdgpu_vm_get_bos(p->adev, &fpriv->vm,
                                       &p->validated);
 
+        if (p->uf.bo)
+                list_add(&p->uf_entry.tv.head, &p->validated);
+
         if (need_mmap_lock)
                 down_read(&current->mm->mmap_sem);
 
@@ -486,8 +509,8 @@ static void amdgpu_cs_parser_fini(struct amdgpu_cs_parser *parser, int error, bo
                 for (i = 0; i < parser->num_ibs; i++)
                         amdgpu_ib_free(parser->adev, &parser->ibs[i]);
         kfree(parser->ibs);
-        if (parser->uf.bo)
-                drm_gem_object_unreference_unlocked(&parser->uf.bo->gem_base);
+        amdgpu_bo_unref(&parser->uf.bo);
+        amdgpu_bo_unref(&parser->uf_entry.robj);
 }
 
 static int amdgpu_bo_vm_update_pte(struct amdgpu_cs_parser *p,
@@ -776,7 +799,7 @@ static int amdgpu_cs_free_job(struct amdgpu_job *job)
                         amdgpu_ib_free(job->adev, &job->ibs[i]);
         kfree(job->ibs);
         if (job->uf.bo)
-                drm_gem_object_unreference_unlocked(&job->uf.bo->gem_base);
+                amdgpu_bo_unref(&job->uf.bo);
         return 0;
 }
 
@@ -784,8 +807,6 @@ int amdgpu_cs_ioctl(struct drm_device *dev, void *data, struct drm_file *filp)
 {
         struct amdgpu_device *adev = dev->dev_private;
         union drm_amdgpu_cs *cs = data;
-        struct amdgpu_fpriv *fpriv = filp->driver_priv;
-        struct amdgpu_vm *vm = &fpriv->vm;
         struct amdgpu_cs_parser parser = {};
         bool reserved_buffers = false;
         int i, r;
@@ -803,7 +824,6 @@ int amdgpu_cs_ioctl(struct drm_device *dev, void *data, struct drm_file *filp)
                 r = amdgpu_cs_handle_lockup(adev, r);
                 return r;
         }
-        mutex_lock(&vm->mutex);
         r = amdgpu_cs_parser_relocs(&parser);
         if (r == -ENOMEM)
                 DRM_ERROR("Not enough memory for command submission!\n");
@@ -888,7 +908,6 @@ int amdgpu_cs_ioctl(struct drm_device *dev, void *data, struct drm_file *filp)
 
 out:
         amdgpu_cs_parser_fini(&parser, r, reserved_buffers);
-        mutex_unlock(&vm->mutex);
         r = amdgpu_cs_handle_lockup(adev, r);
         return r;
 }
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
index e173a5a02f0d..5580d3420c3a 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
@@ -73,6 +73,8 @@ static void amdgpu_flip_work_func(struct work_struct *__work)
         struct drm_crtc *crtc = &amdgpuCrtc->base;
         unsigned long flags;
         unsigned i;
+        int vpos, hpos, stat, min_udelay;
+        struct drm_vblank_crtc *vblank = &crtc->dev->vblank[work->crtc_id];
 
         amdgpu_flip_wait_fence(adev, &work->excl);
         for (i = 0; i < work->shared_count; ++i)
@@ -81,6 +83,41 @@ static void amdgpu_flip_work_func(struct work_struct *__work)
         /* We borrow the event spin lock for protecting flip_status */
         spin_lock_irqsave(&crtc->dev->event_lock, flags);
 
+        /* If this happens to execute within the "virtually extended" vblank
+         * interval before the start of the real vblank interval then it needs
+         * to delay programming the mmio flip until the real vblank is entered.
+         * This prevents completing a flip too early due to the way we fudge
+         * our vblank counter and vblank timestamps in order to work around the
+         * problem that the hw fires vblank interrupts before actual start of
+         * vblank (when line buffer refilling is done for a frame). It
+         * complements the fudging logic in amdgpu_get_crtc_scanoutpos() for
+         * timestamping and amdgpu_get_vblank_counter_kms() for vblank counts.
+         *
+         * In practice this won't execute very often unless on very fast
+         * machines because the time window for this to happen is very small.
+         */
+        for (;;) {
+                /* GET_DISTANCE_TO_VBLANKSTART returns distance to real vblank
+                 * start in hpos, and to the "fudged earlier" vblank start in
+                 * vpos.
+                 */
+                stat = amdgpu_get_crtc_scanoutpos(adev->ddev, work->crtc_id,
+                                                  GET_DISTANCE_TO_VBLANKSTART,
+                                                  &vpos, &hpos, NULL, NULL,
+                                                  &crtc->hwmode);
+
+                if ((stat & (DRM_SCANOUTPOS_VALID | DRM_SCANOUTPOS_ACCURATE)) !=
+                    (DRM_SCANOUTPOS_VALID | DRM_SCANOUTPOS_ACCURATE) ||
+                    !(vpos >= 0 && hpos <= 0))
+                        break;
+
+                /* Sleep at least until estimated real start of hw vblank */
+                spin_unlock_irqrestore(&crtc->dev->event_lock, flags);
+                min_udelay = (-hpos + 1) * max(vblank->linedur_ns / 1000, 5);
+                usleep_range(min_udelay, 2 * min_udelay);
+                spin_lock_irqsave(&crtc->dev->event_lock, flags);
+        };
+
         /* do the flip (mmio) */
         adev->mode_info.funcs->page_flip(adev, work->crtc_id, work->base);
         /* set the flip status */
@@ -109,7 +146,7 @@ static void amdgpu_unpin_work_func(struct work_struct *__work)
         } else
                 DRM_ERROR("failed to reserve buffer after flip\n");
 
-        drm_gem_object_unreference_unlocked(&work->old_rbo->gem_base);
+        amdgpu_bo_unref(&work->old_rbo);
         kfree(work->shared);
         kfree(work);
 }
@@ -148,8 +185,8 @@ int amdgpu_crtc_page_flip(struct drm_crtc *crtc,
         obj = old_amdgpu_fb->obj;
 
         /* take a reference to the old object */
-        drm_gem_object_reference(obj);
         work->old_rbo = gem_to_amdgpu_bo(obj);
+        amdgpu_bo_ref(work->old_rbo);
 
         new_amdgpu_fb = to_amdgpu_framebuffer(fb);
         obj = new_amdgpu_fb->obj;
@@ -222,7 +259,7 @@ pflip_cleanup:
         amdgpu_bo_unreserve(new_rbo);
 
 cleanup:
-        drm_gem_object_unreference_unlocked(&work->old_rbo->gem_base);
+        amdgpu_bo_unref(&work->old_rbo);
         fence_put(work->excl);
         for (i = 0; i < work->shared_count; ++i)
                 fence_put(work->shared[i]);
@@ -712,6 +749,15 @@ bool amdgpu_crtc_scaling_mode_fixup(struct drm_crtc *crtc,
  * \param dev Device to query.
  * \param pipe Crtc to query.
  * \param flags Flags from caller (DRM_CALLED_FROM_VBLIRQ or 0).
+ *              For driver internal use only also supports these flags:
+ *
+ *              USE_REAL_VBLANKSTART to use the real start of vblank instead
+ *              of a fudged earlier start of vblank.
+ *
+ *              GET_DISTANCE_TO_VBLANKSTART to return distance to the
+ *              fudged earlier start of vblank in *vpos and the distance
+ *              to true start of vblank in *hpos.
+ *
  * \param *vpos Location where vertical scanout position should be stored.
  * \param *hpos Location where horizontal scanout position should go.
  * \param *stime Target location for timestamp taken immediately before
@@ -776,10 +822,40 @@ int amdgpu_get_crtc_scanoutpos(struct drm_device *dev, unsigned int pipe,
                 vbl_end = 0;
         }
 
+        /* Called from driver internal vblank counter query code? */
+        if (flags & GET_DISTANCE_TO_VBLANKSTART) {
+            /* Caller wants distance from real vbl_start in *hpos */
+            *hpos = *vpos - vbl_start;
+        }
+
+        /* Fudge vblank to start a few scanlines earlier to handle the
+         * problem that vblank irqs fire a few scanlines before start
+         * of vblank. Some driver internal callers need the true vblank
+         * start to be used and signal this via the USE_REAL_VBLANKSTART flag.
+         *
+         * The cause of the "early" vblank irq is that the irq is triggered
+         * by the line buffer logic when the line buffer read position enters
+         * the vblank, whereas our crtc scanout position naturally lags the
+         * line buffer read position.
+         */
+        if (!(flags & USE_REAL_VBLANKSTART))
+                vbl_start -= adev->mode_info.crtcs[pipe]->lb_vblank_lead_lines;
+
         /* Test scanout position against vblank region. */
         if ((*vpos < vbl_start) && (*vpos >= vbl_end))
                 in_vbl = false;
 
+        /* In vblank? */
+        if (in_vbl)
+            ret |= DRM_SCANOUTPOS_IN_VBLANK;
+
+        /* Called from driver internal vblank counter query code? */
+        if (flags & GET_DISTANCE_TO_VBLANKSTART) {
+                /* Caller wants distance from fudged earlier vbl_start */
+                *vpos -= vbl_start;
+                return ret;
+        }
+
         /* Check if inside vblank area and apply corrective offsets:
          * vpos will then be >=0 in video scanout area, but negative
          * within vblank area, counting down the number of lines until
@@ -795,32 +871,6 @@ int amdgpu_get_crtc_scanoutpos(struct drm_device *dev, unsigned int pipe,
         /* Correct for shifted end of vbl at vbl_end. */
         *vpos = *vpos - vbl_end;
 
-        /* In vblank? */
-        if (in_vbl)
-                ret |= DRM_SCANOUTPOS_IN_VBLANK;
-
-        /* Is vpos outside nominal vblank area, but less than
-         * 1/100 of a frame height away from start of vblank?
-         * If so, assume this isn't a massively delayed vblank
-         * interrupt, but a vblank interrupt that fired a few
-         * microseconds before true start of vblank. Compensate
-         * by adding a full frame duration to the final timestamp.
-         * Happens, e.g., on ATI R500, R600.
-         *
-         * We only do this if DRM_CALLED_FROM_VBLIRQ.
-         */
-        if ((flags & DRM_CALLED_FROM_VBLIRQ) && !in_vbl) {
-                vbl_start = mode->crtc_vdisplay;
-                vtotal = mode->crtc_vtotal;
-
-                if (vbl_start - *vpos < vtotal / 100) {
-                        *vpos -= vtotal;
-
-                        /* Signal this correction as "applied". */
-                        ret |= 0x8;
-                }
-        }
-
         return ret;
 }
 
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
index 00c5b580f56c..9c253c535d26 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
@@ -115,12 +115,9 @@ int amdgpu_gem_object_open(struct drm_gem_object *obj, struct drm_file *file_pri
         struct amdgpu_vm *vm = &fpriv->vm;
         struct amdgpu_bo_va *bo_va;
         int r;
-        mutex_lock(&vm->mutex);
         r = amdgpu_bo_reserve(rbo, false);
-        if (r) {
-                mutex_unlock(&vm->mutex);
+        if (r)
                 return r;
-        }
 
         bo_va = amdgpu_vm_bo_find(vm, rbo);
         if (!bo_va) {
@@ -129,7 +126,6 @@ int amdgpu_gem_object_open(struct drm_gem_object *obj, struct drm_file *file_pri
                 ++bo_va->ref_count;
         }
         amdgpu_bo_unreserve(rbo);
-        mutex_unlock(&vm->mutex);
         return 0;
 }
 
@@ -142,10 +138,8 @@ void amdgpu_gem_object_close(struct drm_gem_object *obj,
         struct amdgpu_vm *vm = &fpriv->vm;
         struct amdgpu_bo_va *bo_va;
         int r;
-        mutex_lock(&vm->mutex);
         r = amdgpu_bo_reserve(rbo, true);
         if (r) {
-                mutex_unlock(&vm->mutex);
                 dev_err(adev->dev, "leaking bo va because "
                         "we fail to reserve bo (%d)\n", r);
                 return;
@@ -157,7 +151,6 @@ void amdgpu_gem_object_close(struct drm_gem_object *obj,
                 }
         }
         amdgpu_bo_unreserve(rbo);
-        mutex_unlock(&vm->mutex);
 }
 
 static int amdgpu_gem_handle_lockup(struct amdgpu_device *adev, int r)
@@ -242,8 +235,9 @@ int amdgpu_gem_userptr_ioctl(struct drm_device *dev, void *data,
             AMDGPU_GEM_USERPTR_REGISTER))
                 return -EINVAL;
 
-        if (!(args->flags & AMDGPU_GEM_USERPTR_ANONONLY) ||
-                   !(args->flags & AMDGPU_GEM_USERPTR_REGISTER)) {
+        if (!(args->flags & AMDGPU_GEM_USERPTR_READONLY) && (
+             !(args->flags & AMDGPU_GEM_USERPTR_ANONONLY) ||
+             !(args->flags & AMDGPU_GEM_USERPTR_REGISTER))) {
 
                 /* if we want to write to it we must require anonymous
                    memory and install a MMU notifier */
@@ -483,6 +477,14 @@ static void amdgpu_gem_va_update_vm(struct amdgpu_device *adev,
                 if (domain == AMDGPU_GEM_DOMAIN_CPU)
                         goto error_unreserve;
         }
+        list_for_each_entry(entry, &duplicates, head) {
+                domain = amdgpu_mem_type_to_domain(entry->bo->mem.mem_type);
+                /* if anything is swapped out don't swap it in here,
+                   just abort and wait for the next CS */
+                if (domain == AMDGPU_GEM_DOMAIN_CPU)
+                        goto error_unreserve;
+        }
+
         r = amdgpu_vm_update_page_directory(adev, bo_va->vm);
         if (r)
                 goto error_unreserve;
@@ -553,7 +555,6 @@ int amdgpu_gem_va_ioctl(struct drm_device *dev, void *data,
         gobj = drm_gem_object_lookup(dev, filp, args->handle);
         if (gobj == NULL)
                 return -ENOENT;
-        mutex_lock(&fpriv->vm.mutex);
         rbo = gem_to_amdgpu_bo(gobj);
         INIT_LIST_HEAD(&list);
         INIT_LIST_HEAD(&duplicates);
@@ -568,7 +569,6 @@ int amdgpu_gem_va_ioctl(struct drm_device *dev, void *data,
         }
         r = ttm_eu_reserve_buffers(&ticket, &list, true, &duplicates);
         if (r) {
-                mutex_unlock(&fpriv->vm.mutex);
                 drm_gem_object_unreference_unlocked(gobj);
                 return r;
         }
@@ -577,7 +577,6 @@ int amdgpu_gem_va_ioctl(struct drm_device *dev, void *data,
         if (!bo_va) {
                 ttm_eu_backoff_reservation(&ticket, &list);
                 drm_gem_object_unreference_unlocked(gobj);
-                mutex_unlock(&fpriv->vm.mutex);
                 return -ENOENT;
         }
 
@@ -602,7 +601,7 @@ int amdgpu_gem_va_ioctl(struct drm_device *dev, void *data,
         ttm_eu_backoff_reservation(&ticket, &list);
         if (!r && !(args->flags & AMDGPU_VM_DELAY_UPDATE))
                 amdgpu_gem_va_update_vm(adev, bo_va, args->operation);
-        mutex_unlock(&fpriv->vm.mutex);
+
         drm_gem_object_unreference_unlocked(gobj);
         return r;
 }
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
index 1618e2294a16..e23843f4d877 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
@@ -611,13 +611,59 @@ void amdgpu_driver_preclose_kms(struct drm_device *dev,
 u32 amdgpu_get_vblank_counter_kms(struct drm_device *dev, unsigned int pipe)
 {
         struct amdgpu_device *adev = dev->dev_private;
+        int vpos, hpos, stat;
+        u32 count;
 
         if (pipe >= adev->mode_info.num_crtc) {
                 DRM_ERROR("Invalid crtc %u\n", pipe);
                 return -EINVAL;
         }
 
-        return amdgpu_display_vblank_get_counter(adev, pipe);
+        /* The hw increments its frame counter at start of vsync, not at start
+         * of vblank, as is required by DRM core vblank counter handling.
+         * Cook the hw count here to make it appear to the caller as if it
+         * incremented at start of vblank. We measure distance to start of
+         * vblank in vpos. vpos therefore will be >= 0 between start of vblank
+         * and start of vsync, so vpos >= 0 means to bump the hw frame counter
+         * result by 1 to give the proper appearance to caller.
+         */
+        if (adev->mode_info.crtcs[pipe]) {
+                /* Repeat readout if needed to provide stable result if
+                 * we cross start of vsync during the queries.
+                 */
+                do {
+                        count = amdgpu_display_vblank_get_counter(adev, pipe);
+                        /* Ask amdgpu_get_crtc_scanoutpos to return vpos as
+                         * distance to start of vblank, instead of regular
+                         * vertical scanout pos.
+                         */
+                        stat = amdgpu_get_crtc_scanoutpos(
+                                dev, pipe, GET_DISTANCE_TO_VBLANKSTART,
+                                &vpos, &hpos, NULL, NULL,
+                                &adev->mode_info.crtcs[pipe]->base.hwmode);
+                } while (count != amdgpu_display_vblank_get_counter(adev, pipe));
+
+                if (((stat & (DRM_SCANOUTPOS_VALID | DRM_SCANOUTPOS_ACCURATE)) !=
+                    (DRM_SCANOUTPOS_VALID | DRM_SCANOUTPOS_ACCURATE))) {
+                        DRM_DEBUG_VBL("Query failed! stat %d\n", stat);
+                } else {
+                        DRM_DEBUG_VBL("crtc %d: dist from vblank start %d\n",
+                                      pipe, vpos);
+
+                        /* Bump counter if we are at >= leading edge of vblank,
+                         * but before vsync where vpos would turn negative and
+                         * the hw counter really increments.
+                         */
+                        if (vpos >= 0)
+                                count++;
+                }
+        } else {
+                /* Fallback to use value as is. */
+                count = amdgpu_display_vblank_get_counter(adev, pipe);
+                DRM_DEBUG_VBL("NULL mode info! Returned count may be wrong.\n");
+        }
+
+        return count;
 }
 
 /**
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_mode.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_mode.h
index b62c1710cab6..064ebb347074 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_mode.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_mode.h
@@ -407,6 +407,7 @@ struct amdgpu_crtc {
         u32 line_time;
         u32 wm_low;
         u32 wm_high;
+        u32 lb_vblank_lead_lines;
         struct drm_display_mode hw_mode;
 };
 
@@ -528,6 +529,10 @@ struct amdgpu_framebuffer {
 #define ENCODER_MODE_IS_DP(em) (((em) == ATOM_ENCODER_MODE_DP) || \
                                 ((em) == ATOM_ENCODER_MODE_DP_MST))
 
+/* Driver internal use only flags of amdgpu_get_crtc_scanoutpos() */
+#define USE_REAL_VBLANKSTART            (1 << 30)
+#define GET_DISTANCE_TO_VBLANKSTART     (1 << 31)
+
 void amdgpu_link_encoder_connector(struct drm_device *dev);
 
 struct drm_connector *
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
index 0d524384ff79..c3ce103b6a33 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
@@ -100,6 +100,7 @@ static void amdgpu_ttm_bo_destroy(struct ttm_buffer_object *tbo)
         list_del_init(&bo->list);
         mutex_unlock(&bo->adev->gem.mutex);
         drm_gem_object_release(&bo->gem_base);
+        amdgpu_bo_unref(&bo->parent);
         kfree(bo->metadata);
         kfree(bo);
 }
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
index d4bac5f49939..8a1752ff3d8e 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
@@ -587,9 +587,13 @@ static int amdgpu_ttm_backend_bind(struct ttm_tt *ttm,
         uint32_t flags = amdgpu_ttm_tt_pte_flags(gtt->adev, ttm, bo_mem);
         int r;
 
-        if (gtt->userptr)
-                amdgpu_ttm_tt_pin_userptr(ttm);
-
+        if (gtt->userptr) {
+                r = amdgpu_ttm_tt_pin_userptr(ttm);
+                if (r) {
+                        DRM_ERROR("failed to pin userptr\n");
+                        return r;
+                }
+        }
         gtt->offset = (unsigned long)(bo_mem->start << PAGE_SHIFT);
         if (!ttm->num_pages) {
                 WARN(1, "nothing to bind %lu pages for mreg %p back %p!\n",
@@ -797,11 +801,12 @@ uint32_t amdgpu_ttm_tt_pte_flags(struct amdgpu_device *adev, struct ttm_tt *ttm,
         if (mem && mem->mem_type != TTM_PL_SYSTEM)
                 flags |= AMDGPU_PTE_VALID;
 
-        if (mem && mem->mem_type == TTM_PL_TT)
+        if (mem && mem->mem_type == TTM_PL_TT) {
                 flags |= AMDGPU_PTE_SYSTEM;
 
-        if (!ttm || ttm->caching_state == tt_cached)
-                flags |= AMDGPU_PTE_SNOOPED;
+                if (ttm->caching_state == tt_cached)
+                        flags |= AMDGPU_PTE_SNOOPED;
+        }
 
         if (adev->asic_type >= CHIP_TOPAZ)
                 flags |= AMDGPU_PTE_EXECUTABLE;
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c
index 03f0c3bae516..a745eeeb5d82 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c
@@ -392,7 +392,10 @@ int amdgpu_vce_get_create_msg(struct amdgpu_ring *ring, uint32_t handle,
         ib->ptr[ib->length_dw++] = 0x00000001; /* session cmd */
         ib->ptr[ib->length_dw++] = handle;
 
-        ib->ptr[ib->length_dw++] = 0x00000030; /* len */
+        if ((ring->adev->vce.fw_version >> 24) >= 52)
+                ib->ptr[ib->length_dw++] = 0x00000040; /* len */
+        else
+                ib->ptr[ib->length_dw++] = 0x00000030; /* len */
         ib->ptr[ib->length_dw++] = 0x01000001; /* create cmd */
         ib->ptr[ib->length_dw++] = 0x00000000;
         ib->ptr[ib->length_dw++] = 0x00000042;
@@ -404,6 +407,12 @@ int amdgpu_vce_get_create_msg(struct amdgpu_ring *ring, uint32_t handle,
         ib->ptr[ib->length_dw++] = 0x00000100;
         ib->ptr[ib->length_dw++] = 0x0000000c;
         ib->ptr[ib->length_dw++] = 0x00000000;
+        if ((ring->adev->vce.fw_version >> 24) >= 52) {
+                ib->ptr[ib->length_dw++] = 0x00000000;
+                ib->ptr[ib->length_dw++] = 0x00000000;
+                ib->ptr[ib->length_dw++] = 0x00000000;
+                ib->ptr[ib->length_dw++] = 0x00000000;
+        }
 
         ib->ptr[ib->length_dw++] = 0x00000014; /* len */
         ib->ptr[ib->length_dw++] = 0x05000005; /* feedback buffer */
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
index 159ce54bbd8d..b53d273eb7a1 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
@@ -885,17 +885,21 @@ int amdgpu_vm_clear_freed(struct amdgpu_device *adev,
         struct amdgpu_bo_va_mapping *mapping;
         int r;
 
+        spin_lock(&vm->freed_lock);
         while (!list_empty(&vm->freed)) {
                 mapping = list_first_entry(&vm->freed,
                         struct amdgpu_bo_va_mapping, list);
                 list_del(&mapping->list);
-
+                spin_unlock(&vm->freed_lock);
                 r = amdgpu_vm_bo_update_mapping(adev, vm, mapping, 0, 0, NULL);
                 kfree(mapping);
                 if (r)
                         return r;
 
+                spin_lock(&vm->freed_lock);
         }
+        spin_unlock(&vm->freed_lock);
+
         return 0;
 
 }
@@ -922,8 +926,9 @@ int amdgpu_vm_clear_invalids(struct amdgpu_device *adev,
                 bo_va = list_first_entry(&vm->invalidated,
                         struct amdgpu_bo_va, vm_status);
                 spin_unlock(&vm->status_lock);
-
+                mutex_lock(&bo_va->mutex);
                 r = amdgpu_vm_bo_update(adev, bo_va, NULL);
+                mutex_unlock(&bo_va->mutex);
                 if (r)
                         return r;
 
@@ -967,7 +972,7 @@ struct amdgpu_bo_va *amdgpu_vm_bo_add(struct amdgpu_device *adev,
         INIT_LIST_HEAD(&bo_va->valids);
         INIT_LIST_HEAD(&bo_va->invalids);
         INIT_LIST_HEAD(&bo_va->vm_status);
-
+        mutex_init(&bo_va->mutex);
         list_add_tail(&bo_va->bo_list, &bo->va);
 
         return bo_va;
@@ -1045,7 +1050,9 @@ int amdgpu_vm_bo_map(struct amdgpu_device *adev,
         mapping->offset = offset;
         mapping->flags = flags;
 
+        mutex_lock(&bo_va->mutex);
         list_add(&mapping->list, &bo_va->invalids);
+        mutex_unlock(&bo_va->mutex);
         spin_lock(&vm->it_lock);
         interval_tree_insert(&mapping->it, &vm->va);
         spin_unlock(&vm->it_lock);
@@ -1076,6 +1083,11 @@ int amdgpu_vm_bo_map(struct amdgpu_device *adev,
                 if (r)
                         goto error_free;
 
+                /* Keep a reference to the page table to avoid freeing
+                 * them up in the wrong order.
+                 */
+                pt->parent = amdgpu_bo_ref(vm->page_directory);
+
                 r = amdgpu_vm_clear_bo(adev, pt);
                 if (r) {
                         amdgpu_bo_unref(&pt);
@@ -1121,7 +1133,7 @@ int amdgpu_vm_bo_unmap(struct amdgpu_device *adev,
         bool valid = true;
 
         saddr /= AMDGPU_GPU_PAGE_SIZE;
-
+        mutex_lock(&bo_va->mutex);
         list_for_each_entry(mapping, &bo_va->valids, list) {
                 if (mapping->it.start == saddr)
                         break;
@@ -1135,20 +1147,25 @@ int amdgpu_vm_bo_unmap(struct amdgpu_device *adev,
                                 break;
                 }
 
-                if (&mapping->list == &bo_va->invalids)
+                if (&mapping->list == &bo_va->invalids) {
+                        mutex_unlock(&bo_va->mutex);
                         return -ENOENT;
+                }
         }
-
+        mutex_unlock(&bo_va->mutex);
         list_del(&mapping->list);
         spin_lock(&vm->it_lock);
         interval_tree_remove(&mapping->it, &vm->va);
         spin_unlock(&vm->it_lock);
         trace_amdgpu_vm_bo_unmap(bo_va, mapping);
 
-        if (valid)
+        if (valid) {
+                spin_lock(&vm->freed_lock);
                 list_add(&mapping->list, &vm->freed);
-        else
+                spin_unlock(&vm->freed_lock);
+        } else {
                 kfree(mapping);
+        }
 
         return 0;
 }
@@ -1181,7 +1198,9 @@ void amdgpu_vm_bo_rmv(struct amdgpu_device *adev,
                 interval_tree_remove(&mapping->it, &vm->va);
                 spin_unlock(&vm->it_lock);
                 trace_amdgpu_vm_bo_unmap(bo_va, mapping);
+                spin_lock(&vm->freed_lock);
                 list_add(&mapping->list, &vm->freed);
+                spin_unlock(&vm->freed_lock);
         }
         list_for_each_entry_safe(mapping, next, &bo_va->invalids, list) {
                 list_del(&mapping->list);
@@ -1190,8 +1209,8 @@ void amdgpu_vm_bo_rmv(struct amdgpu_device *adev,
                 spin_unlock(&vm->it_lock);
                 kfree(mapping);
         }
-
         fence_put(bo_va->last_pt_update);
+        mutex_destroy(&bo_va->mutex);
         kfree(bo_va);
 }
 
@@ -1236,13 +1255,13 @@ int amdgpu_vm_init(struct amdgpu_device *adev, struct amdgpu_vm *vm)
                 vm->ids[i].id = 0;
                 vm->ids[i].flushed_updates = NULL;
         }
-        mutex_init(&vm->mutex);
         vm->va = RB_ROOT;
         spin_lock_init(&vm->status_lock);
         INIT_LIST_HEAD(&vm->invalidated);
         INIT_LIST_HEAD(&vm->cleared);
         INIT_LIST_HEAD(&vm->freed);
         spin_lock_init(&vm->it_lock);
+        spin_lock_init(&vm->freed_lock);
         pd_size = amdgpu_vm_directory_size(adev);
         pd_entries = amdgpu_vm_num_pdes(adev);
 
@@ -1320,7 +1339,6 @@ void amdgpu_vm_fini(struct amdgpu_device *adev, struct amdgpu_vm *vm)
                 fence_put(vm->ids[i].flushed_updates);
         }
 
-        mutex_destroy(&vm->mutex);
 }
 
 /**
diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c
index cb0f7747e3dc..4dcc8fba5792 100644
--- a/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c
@@ -1250,7 +1250,7 @@ static void dce_v10_0_program_watermarks(struct amdgpu_device *adev,
         u32 pixel_period;
         u32 line_time = 0;
         u32 latency_watermark_a = 0, latency_watermark_b = 0;
-        u32 tmp, wm_mask;
+        u32 tmp, wm_mask, lb_vblank_lead_lines = 0;
 
         if (amdgpu_crtc->base.enabled && num_heads && mode) {
                 pixel_period = 1000000 / (u32)mode->clock;
@@ -1333,6 +1333,7 @@ static void dce_v10_0_program_watermarks(struct amdgpu_device *adev,
                     (adev->mode_info.disp_priority == 2)) {
                         DRM_DEBUG_KMS("force priority to high\n");
                 }
+                lb_vblank_lead_lines = DIV_ROUND_UP(lb_size, mode->crtc_hdisplay);
         }
 
         /* select wm A */
@@ -1357,6 +1358,8 @@ static void dce_v10_0_program_watermarks(struct amdgpu_device *adev,
         amdgpu_crtc->line_time = line_time;
         amdgpu_crtc->wm_high = latency_watermark_a;
         amdgpu_crtc->wm_low = latency_watermark_b;
+        /* Save number of lines the linebuffer leads before the scanout */
+        amdgpu_crtc->lb_vblank_lead_lines = lb_vblank_lead_lines;
 }
 
 /**
diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c
index 5af3721851d6..8f1e51128b33 100644
--- a/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c
@@ -1238,7 +1238,7 @@ static void dce_v11_0_program_watermarks(struct amdgpu_device *adev,
         u32 pixel_period;
         u32 line_time = 0;
         u32 latency_watermark_a = 0, latency_watermark_b = 0;
-        u32 tmp, wm_mask;
+        u32 tmp, wm_mask, lb_vblank_lead_lines = 0;
 
         if (amdgpu_crtc->base.enabled && num_heads && mode) {
                 pixel_period = 1000000 / (u32)mode->clock;
@@ -1321,6 +1321,7 @@ static void dce_v11_0_program_watermarks(struct amdgpu_device *adev,
                     (adev->mode_info.disp_priority == 2)) {
                         DRM_DEBUG_KMS("force priority to high\n");
                 }
+                lb_vblank_lead_lines = DIV_ROUND_UP(lb_size, mode->crtc_hdisplay);
         }
 
         /* select wm A */
@@ -1345,6 +1346,8 @@ static void dce_v11_0_program_watermarks(struct amdgpu_device *adev,
         amdgpu_crtc->line_time = line_time;
         amdgpu_crtc->wm_high = latency_watermark_a;
         amdgpu_crtc->wm_low = latency_watermark_b;
+        /* Save number of lines the linebuffer leads before the scanout */
+        amdgpu_crtc->lb_vblank_lead_lines = lb_vblank_lead_lines;
 }
 
 /**
diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c
index 4f7b49a6dc50..42d954dc436d 100644
--- a/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c
@@ -1193,7 +1193,7 @@ static void dce_v8_0_program_watermarks(struct amdgpu_device *adev,
         u32 pixel_period;
         u32 line_time = 0;
         u32 latency_watermark_a = 0, latency_watermark_b = 0;
-        u32 tmp, wm_mask;
+        u32 tmp, wm_mask, lb_vblank_lead_lines = 0;
 
         if (amdgpu_crtc->base.enabled && num_heads && mode) {
                 pixel_period = 1000000 / (u32)mode->clock;
@@ -1276,6 +1276,7 @@ static void dce_v8_0_program_watermarks(struct amdgpu_device *adev,
                     (adev->mode_info.disp_priority == 2)) {
                         DRM_DEBUG_KMS("force priority to high\n");
                 }
+                lb_vblank_lead_lines = DIV_ROUND_UP(lb_size, mode->crtc_hdisplay);
         }
 
         /* select wm A */
@@ -1302,6 +1303,8 @@ static void dce_v8_0_program_watermarks(struct amdgpu_device *adev,
         amdgpu_crtc->line_time = line_time;
         amdgpu_crtc->wm_high = latency_watermark_a;
         amdgpu_crtc->wm_low = latency_watermark_b;
+        /* Save number of lines the linebuffer leads before the scanout */
+        amdgpu_crtc->lb_vblank_lead_lines = lb_vblank_lead_lines;
 }
 
 /**
diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c
index 7427d8cd4c43..ed8abb58a785 100644
--- a/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c
@@ -513,7 +513,7 @@ static int gmc_v7_0_gart_enable(struct amdgpu_device *adev)
         WREG32(mmVM_L2_CNTL3, tmp);
         /* setup context0 */
         WREG32(mmVM_CONTEXT0_PAGE_TABLE_START_ADDR, adev->mc.gtt_start >> 12);
-        WREG32(mmVM_CONTEXT0_PAGE_TABLE_END_ADDR, (adev->mc.gtt_end >> 12) - 1);
+        WREG32(mmVM_CONTEXT0_PAGE_TABLE_END_ADDR, adev->mc.gtt_end >> 12);
         WREG32(mmVM_CONTEXT0_PAGE_TABLE_BASE_ADDR, adev->gart.table_addr >> 12);
         WREG32(mmVM_CONTEXT0_PROTECTION_FAULT_DEFAULT_ADDR,
                         (u32)(adev->dummy_page.addr >> 12));
diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c
index cb0e50ebb528..d39028440814 100644
--- a/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c
@@ -657,7 +657,7 @@ static int gmc_v8_0_gart_enable(struct amdgpu_device *adev)
         WREG32(mmVM_L2_CNTL4, tmp);
         /* setup context0 */
         WREG32(mmVM_CONTEXT0_PAGE_TABLE_START_ADDR, adev->mc.gtt_start >> 12);
-        WREG32(mmVM_CONTEXT0_PAGE_TABLE_END_ADDR, (adev->mc.gtt_end >> 12) - 1);
+        WREG32(mmVM_CONTEXT0_PAGE_TABLE_END_ADDR, adev->mc.gtt_end >> 12);
         WREG32(mmVM_CONTEXT0_PAGE_TABLE_BASE_ADDR, adev->gart.table_addr >> 12);
         WREG32(mmVM_CONTEXT0_PROTECTION_FAULT_DEFAULT_ADDR,
                         (u32)(adev->dummy_page.addr >> 12));
diff --git a/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c b/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c
index 6a52db6ad8d7..370c6c9d81c2 100644
--- a/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c
@@ -40,6 +40,9 @@
 
 #define GRBM_GFX_INDEX__VCE_INSTANCE__SHIFT     0x04
 #define GRBM_GFX_INDEX__VCE_INSTANCE_MASK       0x10
+#define mmVCE_LMI_VCPU_CACHE_40BIT_BAR0         0x8616
+#define mmVCE_LMI_VCPU_CACHE_40BIT_BAR1         0x8617
+#define mmVCE_LMI_VCPU_CACHE_40BIT_BAR2         0x8618
 
 #define VCE_V3_0_FW_SIZE        (384 * 1024)
 #define VCE_V3_0_STACK_SIZE     (64 * 1024)
@@ -130,9 +133,11 @@ static int vce_v3_0_start(struct amdgpu_device *adev)
 
                 /* set BUSY flag */
                 WREG32_P(mmVCE_STATUS, 1, ~1);
-
-                WREG32_P(mmVCE_VCPU_CNTL, VCE_VCPU_CNTL__CLK_EN_MASK,
-                        ~VCE_VCPU_CNTL__CLK_EN_MASK);
+                if (adev->asic_type >= CHIP_STONEY)
+                        WREG32_P(mmVCE_VCPU_CNTL, 1, ~0x200001);
+                else
+                        WREG32_P(mmVCE_VCPU_CNTL, VCE_VCPU_CNTL__CLK_EN_MASK,
+                                ~VCE_VCPU_CNTL__CLK_EN_MASK);
 
                 WREG32_P(mmVCE_SOFT_RESET,
                          VCE_SOFT_RESET__ECPU_SOFT_RESET_MASK,
@@ -391,8 +396,12 @@ static void vce_v3_0_mc_resume(struct amdgpu_device *adev, int idx)
         WREG32(mmVCE_LMI_SWAP_CNTL, 0);
         WREG32(mmVCE_LMI_SWAP_CNTL1, 0);
         WREG32(mmVCE_LMI_VM_CTRL, 0);
-
-        WREG32(mmVCE_LMI_VCPU_CACHE_40BIT_BAR, (adev->vce.gpu_addr >> 8));
+        if (adev->asic_type >= CHIP_STONEY) {
+                WREG32(mmVCE_LMI_VCPU_CACHE_40BIT_BAR0, (adev->vce.gpu_addr >> 8));
+                WREG32(mmVCE_LMI_VCPU_CACHE_40BIT_BAR1, (adev->vce.gpu_addr >> 8));
+                WREG32(mmVCE_LMI_VCPU_CACHE_40BIT_BAR2, (adev->vce.gpu_addr >> 8));
+        } else
+                WREG32(mmVCE_LMI_VCPU_CACHE_40BIT_BAR, (adev->vce.gpu_addr >> 8));
         offset = AMDGPU_VCE_FIRMWARE_OFFSET;
         size = VCE_V3_0_FW_SIZE;
         WREG32(mmVCE_VCPU_CACHE_OFFSET0, offset & 0x7fffffff);
@@ -576,6 +585,11 @@ static int vce_v3_0_process_interrupt(struct amdgpu_device *adev,
                                       struct amdgpu_iv_entry *entry)
 {
         DRM_DEBUG("IH: VCE\n");
+
+        WREG32_P(mmVCE_SYS_INT_STATUS,
+                VCE_SYS_INT_STATUS__VCE_SYS_INT_TRAP_INTERRUPT_INT_MASK,
+                ~VCE_SYS_INT_STATUS__VCE_SYS_INT_TRAP_INTERRUPT_INT_MASK);
+
         switch (entry->src_data) {
         case 0:
                 amdgpu_fence_process(&adev->vce.ring[0]);
diff --git a/drivers/gpu/drm/amd/scheduler/gpu_scheduler.c b/drivers/gpu/drm/amd/scheduler/gpu_scheduler.c
index ea30d6ad4c13..3a4820e863ec 100644
--- a/drivers/gpu/drm/amd/scheduler/gpu_scheduler.c
+++ b/drivers/gpu/drm/amd/scheduler/gpu_scheduler.c
@@ -30,8 +30,7 @@
 #define CREATE_TRACE_POINTS
 #include "gpu_sched_trace.h"
 
-static struct amd_sched_job *
-amd_sched_entity_pop_job(struct amd_sched_entity *entity);
+static bool amd_sched_entity_is_ready(struct amd_sched_entity *entity);
 static void amd_sched_wakeup(struct amd_gpu_scheduler *sched);
 
 struct kmem_cache *sched_fence_slab;
@@ -64,36 +63,36 @@ static void amd_sched_rq_remove_entity(struct amd_sched_rq *rq,
 }
 
 /**
- * Select next job from a specified run queue with round robin policy.
- * Return NULL if nothing available.
+ * Select an entity which could provide a job to run
+ *
+ * @rq          The run queue to check.
+ *
+ * Try to find a ready entity, returns NULL if none found.
  */
-static struct amd_sched_job *
-amd_sched_rq_select_job(struct amd_sched_rq *rq)
+static struct amd_sched_entity *
+amd_sched_rq_select_entity(struct amd_sched_rq *rq)
 {
         struct amd_sched_entity *entity;
-        struct amd_sched_job *sched_job;
 
         spin_lock(&rq->lock);
 
         entity = rq->current_entity;
         if (entity) {
                 list_for_each_entry_continue(entity, &rq->entities, list) {
-                        sched_job = amd_sched_entity_pop_job(entity);
-                        if (sched_job) {
+                        if (amd_sched_entity_is_ready(entity)) {
                                 rq->current_entity = entity;
                                 spin_unlock(&rq->lock);
-                                return sched_job;
+                                return entity;
                         }
                 }
         }
 
         list_for_each_entry(entity, &rq->entities, list) {
 
-                sched_job = amd_sched_entity_pop_job(entity);
-                if (sched_job) {
+                if (amd_sched_entity_is_ready(entity)) {
                         rq->current_entity = entity;
                         spin_unlock(&rq->lock);
-                        return sched_job;
+                        return entity;
                 }
 
                 if (entity == rq->current_entity)
@@ -177,6 +176,24 @@ static bool amd_sched_entity_is_idle(struct amd_sched_entity *entity)
 }
 
 /**
+ * Check if entity is ready
+ *
+ * @entity      The pointer to a valid scheduler entity
+ *
+ * Return true if entity could provide a job.
+ */
+static bool amd_sched_entity_is_ready(struct amd_sched_entity *entity)
+{
+        if (kfifo_is_empty(&entity->job_queue))
+                return false;
+
+        if (ACCESS_ONCE(entity->dependency))
+                return false;
+
+        return true;
+}
+
+/**
  * Destroy a context entity
  *
  * @sched       Pointer to scheduler instance
@@ -211,32 +228,53 @@ static void amd_sched_entity_wakeup(struct fence *f, struct fence_cb *cb)
         amd_sched_wakeup(entity->sched);
 }
 
+static bool amd_sched_entity_add_dependency_cb(struct amd_sched_entity *entity)
+{
+        struct amd_gpu_scheduler *sched = entity->sched;
+        struct fence * fence = entity->dependency;
+        struct amd_sched_fence *s_fence;
+
+        if (fence->context == entity->fence_context) {
+                /* We can ignore fences from ourself */
+                fence_put(entity->dependency);
+                return false;
+        }
+
+        s_fence = to_amd_sched_fence(fence);
+        if (s_fence && s_fence->sched == sched) {
+                /* Fence is from the same scheduler */
+                if (test_bit(AMD_SCHED_FENCE_SCHEDULED_BIT, &fence->flags)) {
+                        /* Ignore it when it is already scheduled */
+                        fence_put(entity->dependency);
+                        return false;
+                }
+
+                /* Wait for fence to be scheduled */
+                entity->cb.func = amd_sched_entity_wakeup;
+                list_add_tail(&entity->cb.node, &s_fence->scheduled_cb);
+                return true;
+        }
+
+        if (!fence_add_callback(entity->dependency, &entity->cb,
+                                amd_sched_entity_wakeup))
+                return true;
+
+        fence_put(entity->dependency);
+        return false;
+}
+
 static struct amd_sched_job *
 amd_sched_entity_pop_job(struct amd_sched_entity *entity)
 {
         struct amd_gpu_scheduler *sched = entity->sched;
         struct amd_sched_job *sched_job;
 
-        if (ACCESS_ONCE(entity->dependency))
-                return NULL;
-
         if (!kfifo_out_peek(&entity->job_queue, &sched_job, sizeof(sched_job)))
                 return NULL;
 
-        while ((entity->dependency = sched->ops->dependency(sched_job))) {
-
-                if (entity->dependency->context == entity->fence_context) {
-                        /* We can ignore fences from ourself */
-                        fence_put(entity->dependency);
-                        continue;
-                }
-
-                if (fence_add_callback(entity->dependency, &entity->cb,
-                                       amd_sched_entity_wakeup))
-                        fence_put(entity->dependency);
-                else
+        while ((entity->dependency = sched->ops->dependency(sched_job)))
+                if (amd_sched_entity_add_dependency_cb(entity))
                         return NULL;
-        }
 
         return sched_job;
 }
@@ -250,6 +288,7 @@ amd_sched_entity_pop_job(struct amd_sched_entity *entity)
  */
 static bool amd_sched_entity_in(struct amd_sched_job *sched_job)
 {
+        struct amd_gpu_scheduler *sched = sched_job->sched;
         struct amd_sched_entity *entity = sched_job->s_entity;
         bool added, first = false;
 
@@ -264,7 +303,7 @@ static bool amd_sched_entity_in(struct amd_sched_job *sched_job)
 
         /* first job wakes up scheduler */
         if (first)
-                amd_sched_wakeup(sched_job->sched);
+                amd_sched_wakeup(sched);
 
         return added;
 }
@@ -280,9 +319,9 @@ void amd_sched_entity_push_job(struct amd_sched_job *sched_job)
 {
         struct amd_sched_entity *entity = sched_job->s_entity;
 
+        trace_amd_sched_job(sched_job);
         wait_event(entity->sched->job_scheduled,
                    amd_sched_entity_in(sched_job));
-        trace_amd_sched_job(sched_job);
 }
 
 /**
@@ -304,22 +343,22 @@ static void amd_sched_wakeup(struct amd_gpu_scheduler *sched)
 }
 
 /**
- * Select next to run
+ * Select next entity to process
 */
-static struct amd_sched_job *
-amd_sched_select_job(struct amd_gpu_scheduler *sched)
+static struct amd_sched_entity *
+amd_sched_select_entity(struct amd_gpu_scheduler *sched)
 {
-        struct amd_sched_job *sched_job;
+        struct amd_sched_entity *entity;
 
         if (!amd_sched_ready(sched))
                 return NULL;
 
         /* Kernel run queue has higher priority than normal run queue*/
-        sched_job = amd_sched_rq_select_job(&sched->kernel_rq);
-        if (sched_job == NULL)
-                sched_job = amd_sched_rq_select_job(&sched->sched_rq);
+        entity = amd_sched_rq_select_entity(&sched->kernel_rq);
+        if (entity == NULL)
+                entity = amd_sched_rq_select_entity(&sched->sched_rq);
 
-        return sched_job;
+        return entity;
 }
 
 static void amd_sched_process_job(struct fence *f, struct fence_cb *cb)
@@ -381,13 +420,16 @@ static int amd_sched_main(void *param)
                 unsigned long flags;
 
                 wait_event_interruptible(sched->wake_up_worker,
-                        kthread_should_stop() ||
-                        (sched_job = amd_sched_select_job(sched)));
+                        (entity = amd_sched_select_entity(sched)) ||
+                        kthread_should_stop());
 
+                if (!entity)
+                        continue;
+
+                sched_job = amd_sched_entity_pop_job(entity);
                 if (!sched_job)
                         continue;
 
-                entity = sched_job->s_entity;
                 s_fence = sched_job->s_fence;
 
                 if (sched->timeout != MAX_SCHEDULE_TIMEOUT) {
@@ -400,6 +442,7 @@ static int amd_sched_main(void *param)
 
                 atomic_inc(&sched->hw_rq_count);
                 fence = sched->ops->run_job(sched_job);
+                amd_sched_fence_scheduled(s_fence);
                 if (fence) {
                         r = fence_add_callback(fence, &s_fence->cb,
                                                amd_sched_process_job);
diff --git a/drivers/gpu/drm/amd/scheduler/gpu_scheduler.h b/drivers/gpu/drm/amd/scheduler/gpu_scheduler.h
index 939692b14f4b..a0f0ae53aacd 100644
--- a/drivers/gpu/drm/amd/scheduler/gpu_scheduler.h
+++ b/drivers/gpu/drm/amd/scheduler/gpu_scheduler.h
@@ -27,6 +27,8 @@
 #include <linux/kfifo.h>
 #include <linux/fence.h>
 
+#define AMD_SCHED_FENCE_SCHEDULED_BIT   FENCE_FLAG_USER_BITS
+
 struct amd_gpu_scheduler;
 struct amd_sched_rq;
 
@@ -68,6 +70,7 @@ struct amd_sched_rq {
 struct amd_sched_fence {
         struct fence                    base;
         struct fence_cb                 cb;
+        struct list_head                scheduled_cb;
         struct amd_gpu_scheduler        *sched;
         spinlock_t                      lock;
         void                            *owner;
@@ -134,7 +137,7 @@ void amd_sched_entity_push_job(struct amd_sched_job *sched_job);
 
 struct amd_sched_fence *amd_sched_fence_create(
         struct amd_sched_entity *s_entity, void *owner);
+void amd_sched_fence_scheduled(struct amd_sched_fence *fence);
 void amd_sched_fence_signal(struct amd_sched_fence *fence);
 
-
 #endif
diff --git a/drivers/gpu/drm/amd/scheduler/sched_fence.c b/drivers/gpu/drm/amd/scheduler/sched_fence.c
index 8d2130b9ff05..87c78eecea64 100644
--- a/drivers/gpu/drm/amd/scheduler/sched_fence.c
+++ b/drivers/gpu/drm/amd/scheduler/sched_fence.c
@@ -35,6 +35,8 @@ struct amd_sched_fence *amd_sched_fence_create(struct amd_sched_entity *s_entity
         fence = kmem_cache_zalloc(sched_fence_slab, GFP_KERNEL);
         if (fence == NULL)
                 return NULL;
+
+        INIT_LIST_HEAD(&fence->scheduled_cb);
         fence->owner = owner;
         fence->sched = s_entity->sched;
         spin_lock_init(&fence->lock);
@@ -55,6 +57,17 @@ void amd_sched_fence_signal(struct amd_sched_fence *fence)
                 FENCE_TRACE(&fence->base, "was already signaled\n");
 }
 
+void amd_sched_fence_scheduled(struct amd_sched_fence *s_fence)
+{
+        struct fence_cb *cur, *tmp;
+
+        set_bit(AMD_SCHED_FENCE_SCHEDULED_BIT, &s_fence->base.flags);
+        list_for_each_entry_safe(cur, tmp, &s_fence->scheduled_cb, node) {
+                list_del_init(&cur->node);
+                cur->func(&s_fence->base, cur);
+        }
+}
+
 static const char *amd_sched_fence_get_driver_name(struct fence *fence)
 {
         return "amd_sched";
diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
index 9362609df38a..7dd6728dd092 100644
--- a/drivers/gpu/drm/drm_drv.c
+++ b/drivers/gpu/drm/drm_drv.c
@@ -160,6 +160,11 @@ int drm_setmaster_ioctl(struct drm_device *dev, void *data,
                 goto out_unlock;
         }
 
+        if (!file_priv->allowed_master) {
+                ret = drm_new_set_master(dev, file_priv);
+                goto out_unlock;
+        }
+
         file_priv->minor->master = drm_master_get(file_priv->master);
         file_priv->is_master = 1;
         if (dev->driver->master_set) {
diff --git a/drivers/gpu/drm/drm_fops.c b/drivers/gpu/drm/drm_fops.c
index c59ce4d0ef75..6b5625e66119 100644
--- a/drivers/gpu/drm/drm_fops.c
+++ b/drivers/gpu/drm/drm_fops.c
@@ -126,6 +126,60 @@ static int drm_cpu_valid(void)
 }
 
 /**
+ * drm_new_set_master - Allocate a new master object and become master for the
+ * associated master realm.
+ *
+ * @dev: The associated device.
+ * @fpriv: File private identifying the client.
+ *
+ * This function must be called with dev::struct_mutex held.
+ * Returns negative error code on failure. Zero on success.
+ */
+int drm_new_set_master(struct drm_device *dev, struct drm_file *fpriv)
+{
+        struct drm_master *old_master;
+        int ret;
+
+        lockdep_assert_held_once(&dev->master_mutex);
+
+        /* create a new master */
+        fpriv->minor->master = drm_master_create(fpriv->minor);
+        if (!fpriv->minor->master)
+                return -ENOMEM;
+
+        /* take another reference for the copy in the local file priv */
+        old_master = fpriv->master;
+        fpriv->master = drm_master_get(fpriv->minor->master);
+
+        if (dev->driver->master_create) {
+                ret = dev->driver->master_create(dev, fpriv->master);
+                if (ret)
+                        goto out_err;
+        }
+        if (dev->driver->master_set) {
+                ret = dev->driver->master_set(dev, fpriv, true);
+                if (ret)
+                        goto out_err;
+        }
+
+        fpriv->is_master = 1;
+        fpriv->allowed_master = 1;
+        fpriv->authenticated = 1;
+        if (old_master)
+                drm_master_put(&old_master);
+
+        return 0;
+
+out_err:
+        /* drop both references and restore old master on failure */
+        drm_master_put(&fpriv->minor->master);
+        drm_master_put(&fpriv->master);
+        fpriv->master = old_master;
+
+        return ret;
+}
+
+/**
  * Called whenever a process opens /dev/drm.
  *
  * \param filp file pointer.
@@ -189,35 +243,9 @@ static int drm_open_helper(struct file *filp, struct drm_minor *minor)
         mutex_lock(&dev->master_mutex);
         if (drm_is_primary_client(priv) && !priv->minor->master) {
                 /* create a new master */
-                priv->minor->master = drm_master_create(priv->minor);
-                if (!priv->minor->master) {
-                        ret = -ENOMEM;
+                ret = drm_new_set_master(dev, priv);
+                if (ret)
                         goto out_close;
-                }
-
-                priv->is_master = 1;
-                /* take another reference for the copy in the local file priv */
-                priv->master = drm_master_get(priv->minor->master);
-                priv->authenticated = 1;
-
-                if (dev->driver->master_create) {
-                        ret = dev->driver->master_create(dev, priv->master);
-                        if (ret) {
-                                /* drop both references if this fails */
-                                drm_master_put(&priv->minor->master);
-                                drm_master_put(&priv->master);
-                                goto out_close;
-                        }
-                }
-                if (dev->driver->master_set) {
-                        ret = dev->driver->master_set(dev, priv, true);
-                        if (ret) {
-                                /* drop both references if this fails */
-                                drm_master_put(&priv->minor->master);
-                                drm_master_put(&priv->master);
-                                goto out_close;
-                        }
-                }
         } else if (drm_is_primary_client(priv)) {
                 /* get a reference to the master */
                 priv->master = drm_master_get(priv->minor->master);
diff --git a/drivers/gpu/drm/drm_irq.c b/drivers/gpu/drm/drm_irq.c
index 2151ea551d3b..607f493ae801 100644
--- a/drivers/gpu/drm/drm_irq.c
+++ b/drivers/gpu/drm/drm_irq.c
@@ -980,7 +980,8 @@ static void send_vblank_event(struct drm_device *dev,
                 struct drm_pending_vblank_event *e,
                 unsigned long seq, struct timeval *now)
 {
-        WARN_ON_SMP(!spin_is_locked(&dev->event_lock));
+        assert_spin_locked(&dev->event_lock);
+
         e->event.sequence = seq;
         e->event.tv_sec = now->tv_sec;
         e->event.tv_usec = now->tv_usec;
@@ -993,6 +994,57 @@ static void send_vblank_event(struct drm_device *dev,
 }
 
 /**
+ * drm_arm_vblank_event - arm vblank event after pageflip
+ * @dev: DRM device
+ * @pipe: CRTC index
+ * @e: the event to prepare to send
+ *
+ * A lot of drivers need to generate vblank events for the very next vblank
+ * interrupt. For example when the page flip interrupt happens when the page
+ * flip gets armed, but not when it actually executes within the next vblank
+ * period. This helper function implements exactly the required vblank arming
+ * behaviour.
+ *
+ * Caller must hold event lock. Caller must also hold a vblank reference for
+ * the event @e, which will be dropped when the next vblank arrives.
+ *
+ * This is the legacy version of drm_crtc_arm_vblank_event().
+ */
+void drm_arm_vblank_event(struct drm_device *dev, unsigned int pipe,
+                          struct drm_pending_vblank_event *e)
+{
+        assert_spin_locked(&dev->event_lock);
+
+        e->pipe = pipe;
+        e->event.sequence = drm_vblank_count(dev, pipe);
+        list_add_tail(&e->base.link, &dev->vblank_event_list);
+}
+EXPORT_SYMBOL(drm_arm_vblank_event);
+
+/**
+ * drm_crtc_arm_vblank_event - arm vblank event after pageflip
+ * @crtc: the source CRTC of the vblank event
+ * @e: the event to send
+ *
+ * A lot of drivers need to generate vblank events for the very next vblank
+ * interrupt. For example when the page flip interrupt happens when the page
+ * flip gets armed, but not when it actually executes within the next vblank
+ * period. This helper function implements exactly the required vblank arming
+ * behaviour.
+ *
+ * Caller must hold event lock. Caller must also hold a vblank reference for
+ * the event @e, which will be dropped when the next vblank arrives.
+ *
+ * This is the native KMS version of drm_arm_vblank_event().
+ */
+void drm_crtc_arm_vblank_event(struct drm_crtc *crtc,
+                               struct drm_pending_vblank_event *e)
+{
+        drm_arm_vblank_event(crtc->dev, drm_crtc_index(crtc), e);
+}
+EXPORT_SYMBOL(drm_crtc_arm_vblank_event);
+
+/**
  * drm_send_vblank_event - helper to send vblank event after pageflip
  * @dev: DRM device
  * @pipe: CRTC index
diff --git a/drivers/gpu/drm/drm_probe_helper.c b/drivers/gpu/drm/drm_probe_helper.c
index a18164f2f6d2..f8b5fcfa91a2 100644
--- a/drivers/gpu/drm/drm_probe_helper.c
+++ b/drivers/gpu/drm/drm_probe_helper.c
@@ -229,7 +229,8 @@ static int drm_helper_probe_single_connector_modes_merge_bits(struct drm_connect
                 mode_flags |= DRM_MODE_FLAG_3D_MASK;
 
         list_for_each_entry(mode, &connector->modes, head) {
-                mode->status = drm_mode_validate_basic(mode);
+                if (mode->status == MODE_OK)
+                        mode->status = drm_mode_validate_basic(mode);
 
                 if (mode->status == MODE_OK)
                         mode->status = drm_mode_validate_size(mode, maxX, maxY);
diff --git a/drivers/gpu/drm/exynos/exynos_drm_crtc.c b/drivers/gpu/drm/exynos/exynos_drm_crtc.c
index b3ba27fd9a6b..e69357172ffb 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_crtc.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_crtc.c
@@ -55,6 +55,9 @@ static int exynos_crtc_atomic_check(struct drm_crtc *crtc,
 {
         struct exynos_drm_crtc *exynos_crtc = to_exynos_crtc(crtc);
 
+        if (!state->enable)
+                return 0;
+
         if (exynos_crtc->ops->atomic_check)
                 return exynos_crtc->ops->atomic_check(exynos_crtc, state);
 
diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
index a3b22bdacd44..8aab974b0564 100644
--- a/drivers/gpu/drm/i915/i915_debugfs.c
+++ b/drivers/gpu/drm/i915/i915_debugfs.c
@@ -2734,6 +2734,8 @@ static const char *power_domain_str(enum intel_display_power_domain domain)
                 return "AUX_C";
         case POWER_DOMAIN_AUX_D:
                 return "AUX_D";
+        case POWER_DOMAIN_GMBUS:
+                return "GMBUS";
         case POWER_DOMAIN_INIT:
                 return "INIT";
         default:
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index 95bb27de774f..f4af19a0d569 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -199,6 +199,7 @@ enum intel_display_power_domain {
         POWER_DOMAIN_AUX_B,
         POWER_DOMAIN_AUX_C,
         POWER_DOMAIN_AUX_D,
+        POWER_DOMAIN_GMBUS,
         POWER_DOMAIN_INIT,
 
         POWER_DOMAIN_NUM,
@@ -2192,8 +2193,17 @@ struct drm_i915_gem_request {
         struct drm_i915_private *i915;
         struct intel_engine_cs *ring;
 
-        /** GEM sequence number associated with this request. */
-        uint32_t seqno;
+         /** GEM sequence number associated with the previous request,
+          * when the HWS breadcrumb is equal to this the GPU is processing
+          * this request.
+          */
+        u32 previous_seqno;
+
+         /** GEM sequence number associated with this request,
+          * when the HWS breadcrumb is equal or greater than this the GPU
+          * has finished processing this request.
+          */
+        u32 seqno;
 
         /** Position in the ringbuffer of the start of the request */
         u32 head;
@@ -2838,6 +2848,7 @@ i915_gem_object_ggtt_pin(struct drm_i915_gem_object *obj,
 
 int i915_vma_bind(struct i915_vma *vma, enum i915_cache_level cache_level,
                   u32 flags);
+void __i915_vma_set_map_and_fenceable(struct i915_vma *vma);
 int __must_check i915_vma_unbind(struct i915_vma *vma);
 /*
  * BEWARE: Do not use the function below unless you can _absolutely_
@@ -2909,15 +2920,17 @@ i915_seqno_passed(uint32_t seq1, uint32_t seq2)
         return (int32_t)(seq1 - seq2) >= 0;
 }
 
+static inline bool i915_gem_request_started(struct drm_i915_gem_request *req,
+                                           bool lazy_coherency)
+{
+        u32 seqno = req->ring->get_seqno(req->ring, lazy_coherency);
+        return i915_seqno_passed(seqno, req->previous_seqno);
+}
+
 static inline bool i915_gem_request_completed(struct drm_i915_gem_request *req,
                                               bool lazy_coherency)
 {
-        u32 seqno;
-
-        BUG_ON(req == NULL);
-
-        seqno = req->ring->get_seqno(req->ring, lazy_coherency);
-
+        u32 seqno = req->ring->get_seqno(req->ring, lazy_coherency);
         return i915_seqno_passed(seqno, req->seqno);
 }
 
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 91bb1fc27420..f56af0aaafde 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -1146,23 +1146,74 @@ static bool missed_irq(struct drm_i915_private *dev_priv,
         return test_bit(ring->id, &dev_priv->gpu_error.missed_irq_rings);
 }
 
-static int __i915_spin_request(struct drm_i915_gem_request *req)
+static unsigned long local_clock_us(unsigned *cpu)
+{
+        unsigned long t;
+
+        /* Cheaply and approximately convert from nanoseconds to microseconds.
+         * The result and subsequent calculations are also defined in the same
+         * approximate microseconds units. The principal source of timing
+         * error here is from the simple truncation.
+         *
+         * Note that local_clock() is only defined wrt to the current CPU;
+         * the comparisons are no longer valid if we switch CPUs. Instead of
+         * blocking preemption for the entire busywait, we can detect the CPU
+         * switch and use that as indicator of system load and a reason to
+         * stop busywaiting, see busywait_stop().
+         */
+        *cpu = get_cpu();
+        t = local_clock() >> 10;
+        put_cpu();
+
+        return t;
+}
+
+static bool busywait_stop(unsigned long timeout, unsigned cpu)
+{
+        unsigned this_cpu;
+
+        if (time_after(local_clock_us(&this_cpu), timeout))
+                return true;
+
+        return this_cpu != cpu;
+}
+
+static int __i915_spin_request(struct drm_i915_gem_request *req, int state)
 {
         unsigned long timeout;
+        unsigned cpu;
+
+        /* When waiting for high frequency requests, e.g. during synchronous
+         * rendering split between the CPU and GPU, the finite amount of time
+         * required to set up the irq and wait upon it limits the response
+         * rate. By busywaiting on the request completion for a short while we
+         * can service the high frequency waits as quick as possible. However,
+         * if it is a slow request, we want to sleep as quickly as possible.
+         * The tradeoff between waiting and sleeping is roughly the time it
+         * takes to sleep on a request, on the order of a microsecond.
+         */
 
-        if (i915_gem_request_get_ring(req)->irq_refcount)
+        if (req->ring->irq_refcount)
                 return -EBUSY;
 
-        timeout = jiffies + 1;
+        /* Only spin if we know the GPU is processing this request */
+        if (!i915_gem_request_started(req, true))
+                return -EAGAIN;
+
+        timeout = local_clock_us(&cpu) + 5;
         while (!need_resched()) {
                 if (i915_gem_request_completed(req, true))
                         return 0;
 
-                if (time_after_eq(jiffies, timeout))
+                if (signal_pending_state(state, current))
+                        break;
+
+                if (busywait_stop(timeout, cpu))
                         break;
 
                 cpu_relax_lowlatency();
         }
+
         if (i915_gem_request_completed(req, false))
                 return 0;
 
@@ -1197,6 +1248,7 @@ int __i915_wait_request(struct drm_i915_gem_request *req,
         struct drm_i915_private *dev_priv = dev->dev_private;
         const bool irq_test_in_progress =
                 ACCESS_ONCE(dev_priv->gpu_error.test_irq_rings) & intel_ring_flag(ring);
+        int state = interruptible ? TASK_INTERRUPTIBLE : TASK_UNINTERRUPTIBLE;
         DEFINE_WAIT(wait);
         unsigned long timeout_expire;
         s64 before, now;
@@ -1210,8 +1262,16 @@ int __i915_wait_request(struct drm_i915_gem_request *req,
         if (i915_gem_request_completed(req, true))
                 return 0;
 
-        timeout_expire = timeout ?
-                jiffies + nsecs_to_jiffies_timeout((u64)*timeout) : 0;
+        timeout_expire = 0;
+        if (timeout) {
+                if (WARN_ON(*timeout < 0))
+                        return -EINVAL;
+
+                if (*timeout == 0)
+                        return -ETIME;
+
+                timeout_expire = jiffies + nsecs_to_jiffies_timeout(*timeout);
+        }
 
         if (INTEL_INFO(dev_priv)->gen >= 6)
                 gen6_rps_boost(dev_priv, rps, req->emitted_jiffies);
@@ -1221,7 +1281,7 @@ int __i915_wait_request(struct drm_i915_gem_request *req,
         before = ktime_get_raw_ns();
 
         /* Optimistic spin for the next jiffie before touching IRQs */
-        ret = __i915_spin_request(req);
+        ret = __i915_spin_request(req, state);
         if (ret == 0)
                 goto out;
 
@@ -1233,8 +1293,7 @@ int __i915_wait_request(struct drm_i915_gem_request *req,
         for (;;) {
                 struct timer_list timer;
 
-                prepare_to_wait(&ring->irq_queue, &wait,
-                                interruptible ? TASK_INTERRUPTIBLE : TASK_UNINTERRUPTIBLE);
+                prepare_to_wait(&ring->irq_queue, &wait, state);
 
                 /* We need to check whether any gpu reset happened in between
                  * the caller grabbing the seqno and now ... */
@@ -1252,7 +1311,7 @@ int __i915_wait_request(struct drm_i915_gem_request *req,
                         break;
                 }
 
-                if (interruptible && signal_pending(current)) {
+                if (signal_pending_state(state, current)) {
                         ret = -ERESTARTSYS;
                         break;
                 }
@@ -2546,6 +2605,7 @@ void __i915_add_request(struct drm_i915_gem_request *request,
         request->batch_obj = obj;
 
         request->emitted_jiffies = jiffies;
+        request->previous_seqno = ring->last_submitted_seqno;
         ring->last_submitted_seqno = request->seqno;
         list_add_tail(&request->list, &ring->request_list);
 
@@ -4072,6 +4132,29 @@ i915_vma_misplaced(struct i915_vma *vma, uint32_t alignment, uint64_t flags)
         return false;
 }
 
+void __i915_vma_set_map_and_fenceable(struct i915_vma *vma)
+{
+        struct drm_i915_gem_object *obj = vma->obj;
+        bool mappable, fenceable;
+        u32 fence_size, fence_alignment;
+
+        fence_size = i915_gem_get_gtt_size(obj->base.dev,
+                                           obj->base.size,
+                                           obj->tiling_mode);
+        fence_alignment = i915_gem_get_gtt_alignment(obj->base.dev,
+                                                     obj->base.size,
+                                                     obj->tiling_mode,
+                                                     true);
+
+        fenceable = (vma->node.size == fence_size &&
+                     (vma->node.start & (fence_alignment - 1)) == 0);
+
+        mappable = (vma->node.start + fence_size <=
+                    to_i915(obj->base.dev)->gtt.mappable_end);
+
+        obj->map_and_fenceable = mappable && fenceable;
+}
+
 static int
 i915_gem_object_do_pin(struct drm_i915_gem_object *obj,
                        struct i915_address_space *vm,
@@ -4139,25 +4222,7 @@ i915_gem_object_do_pin(struct drm_i915_gem_object *obj,
 
         if (ggtt_view && ggtt_view->type == I915_GGTT_VIEW_NORMAL &&
             (bound ^ vma->bound) & GLOBAL_BIND) {
-                bool mappable, fenceable;
-                u32 fence_size, fence_alignment;
-
-                fence_size = i915_gem_get_gtt_size(obj->base.dev,
-                                                   obj->base.size,
-                                                   obj->tiling_mode);
-                fence_alignment = i915_gem_get_gtt_alignment(obj->base.dev,
-                                                             obj->base.size,
-                                                             obj->tiling_mode,
-                                                             true);
-
-                fenceable = (vma->node.size == fence_size &&
-                             (vma->node.start & (fence_alignment - 1)) == 0);
-
-                mappable = (vma->node.start + fence_size <=
-                            dev_priv->gtt.mappable_end);
-
-                obj->map_and_fenceable = mappable && fenceable;
-
+                __i915_vma_set_map_and_fenceable(vma);
                 WARN_ON(flags & PIN_MAPPABLE && !obj->map_and_fenceable);
         }
 
diff --git a/drivers/gpu/drm/i915/i915_gem_context.c b/drivers/gpu/drm/i915/i915_gem_context.c
index 8c688a5f1589..02ceb7a4b481 100644
--- a/drivers/gpu/drm/i915/i915_gem_context.c
+++ b/drivers/gpu/drm/i915/i915_gem_context.c
@@ -141,8 +141,6 @@ static void i915_gem_context_clean(struct intel_context *ctx)
         if (!ppgtt)
                 return;
 
-        WARN_ON(!list_empty(&ppgtt->base.active_list));
-
         list_for_each_entry_safe(vma, next, &ppgtt->base.inactive_list,
                                  mm_list) {
                 if (WARN_ON(__i915_vma_unbind_no_wait(vma)))
diff --git a/drivers/gpu/drm/i915/i915_gem_fence.c b/drivers/gpu/drm/i915/i915_gem_fence.c
index 40a10b25956c..f010391b87f5 100644
--- a/drivers/gpu/drm/i915/i915_gem_fence.c
+++ b/drivers/gpu/drm/i915/i915_gem_fence.c
@@ -642,11 +642,10 @@ i915_gem_detect_bit_6_swizzle(struct drm_device *dev)
                 }
 
                 /* check for L-shaped memory aka modified enhanced addressing */
-                if (IS_GEN4(dev)) {
-                        uint32_t ddc2 = I915_READ(DCC2);
-
-                        if (!(ddc2 & DCC2_MODIFIED_ENHANCED_DISABLE))
-                                dev_priv->quirks |= QUIRK_PIN_SWIZZLED_PAGES;
+                if (IS_GEN4(dev) &&
+                    !(I915_READ(DCC2) & DCC2_MODIFIED_ENHANCED_DISABLE)) {
+                        swizzle_x = I915_BIT_6_SWIZZLE_UNKNOWN;
+                        swizzle_y = I915_BIT_6_SWIZZLE_UNKNOWN;
                 }
 
                 if (dcc == 0xffffffff) {
@@ -675,16 +674,35 @@ i915_gem_detect_bit_6_swizzle(struct drm_device *dev)
                  * matching, which was the case for the swizzling required in
                  * the table above, or from the 1-ch value being less than
                  * the minimum size of a rank.
+                 *
+                 * Reports indicate that the swizzling actually
+                 * varies depending upon page placement inside the
+                 * channels, i.e. we see swizzled pages where the
+                 * banks of memory are paired and unswizzled on the
+                 * uneven portion, so leave that as unknown.
                  */
-                if (I915_READ16(C0DRB3) != I915_READ16(C1DRB3)) {
-                        swizzle_x = I915_BIT_6_SWIZZLE_NONE;
-                        swizzle_y = I915_BIT_6_SWIZZLE_NONE;
-                } else {
+                if (I915_READ16(C0DRB3) == I915_READ16(C1DRB3)) {
                         swizzle_x = I915_BIT_6_SWIZZLE_9_10;
                         swizzle_y = I915_BIT_6_SWIZZLE_9;
                 }
         }
 
+        if (swizzle_x == I915_BIT_6_SWIZZLE_UNKNOWN ||
+            swizzle_y == I915_BIT_6_SWIZZLE_UNKNOWN) {
+                /* Userspace likes to explode if it sees unknown swizzling,
+                 * so lie. We will finish the lie when reporting through
+                 * the get-tiling-ioctl by reporting the physical swizzle
+                 * mode as unknown instead.
+                 *
+                 * As we don't strictly know what the swizzling is, it may be
+                 * bit17 dependent, and so we need to also prevent the pages
+                 * from being moved.
+                 */
+                dev_priv->quirks |= QUIRK_PIN_SWIZZLED_PAGES;
+                swizzle_x = I915_BIT_6_SWIZZLE_NONE;
+                swizzle_y = I915_BIT_6_SWIZZLE_NONE;
+        }
+
         dev_priv->mm.bit_6_swizzle_x = swizzle_x;
         dev_priv->mm.bit_6_swizzle_y = swizzle_y;
 }
diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c
index 43f35d12b677..86c7500454b4 100644
--- a/drivers/gpu/drm/i915/i915_gem_gtt.c
+++ b/drivers/gpu/drm/i915/i915_gem_gtt.c
@@ -2676,6 +2676,7 @@ static int i915_gem_setup_global_gtt(struct drm_device *dev,
                         return ret;
                 }
                 vma->bound |= GLOBAL_BIND;
+                __i915_vma_set_map_and_fenceable(vma);
                 list_add_tail(&vma->mm_list, &ggtt_vm->inactive_list);
         }
 
diff --git a/drivers/gpu/drm/i915/i915_gem_stolen.c b/drivers/gpu/drm/i915/i915_gem_stolen.c
index cdacf3f5b77a..87e919a06b27 100644
--- a/drivers/gpu/drm/i915/i915_gem_stolen.c
+++ b/drivers/gpu/drm/i915/i915_gem_stolen.c
@@ -687,6 +687,7 @@ i915_gem_object_create_stolen_for_preallocated(struct drm_device *dev,
                 }
 
                 vma->bound |= GLOBAL_BIND;
+                __i915_vma_set_map_and_fenceable(vma);
                 list_add_tail(&vma->mm_list, &ggtt->inactive_list);
         }
 
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 71860f8680f9..32cf97346978 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -116,6 +116,7 @@ static void skylake_pfit_enable(struct intel_crtc *crtc);
 static void ironlake_pfit_disable(struct intel_crtc *crtc, bool force);
 static void ironlake_pfit_enable(struct intel_crtc *crtc);
 static void intel_modeset_setup_hw_state(struct drm_device *dev);
+static void intel_pre_disable_primary(struct drm_crtc *crtc);
 
 typedef struct {
         int     min, max;
@@ -2607,6 +2608,8 @@ intel_find_initial_plane_obj(struct intel_crtc *intel_crtc,
         struct drm_i915_gem_object *obj;
         struct drm_plane *primary = intel_crtc->base.primary;
         struct drm_plane_state *plane_state = primary->state;
+        struct drm_crtc_state *crtc_state = intel_crtc->base.state;
+        struct intel_plane *intel_plane = to_intel_plane(primary);
         struct drm_framebuffer *fb;
 
         if (!plane_config->fb)
@@ -2643,6 +2646,18 @@ intel_find_initial_plane_obj(struct intel_crtc *intel_crtc,
                 }
         }
 
+        /*
+         * We've failed to reconstruct the BIOS FB.  Current display state
+         * indicates that the primary plane is visible, but has a NULL FB,
+         * which will lead to problems later if we don't fix it up.  The
+         * simplest solution is to just disable the primary plane now and
+         * pretend the BIOS never had it enabled.
+         */
+        to_intel_plane_state(plane_state)->visible = false;
+        crtc_state->plane_mask &= ~(1 << drm_plane_index(primary));
+        intel_pre_disable_primary(&intel_crtc->base);
+        intel_plane->disable_plane(primary, &intel_crtc->base);
+
         return;
 
 valid_fb:
@@ -5194,11 +5209,31 @@ static enum intel_display_power_domain port_to_power_domain(enum port port)
         case PORT_E:
                 return POWER_DOMAIN_PORT_DDI_E_2_LANES;
         default:
-                WARN_ON_ONCE(1);
+                MISSING_CASE(port);
                 return POWER_DOMAIN_PORT_OTHER;
         }
 }
 
+static enum intel_display_power_domain port_to_aux_power_domain(enum port port)
+{
+        switch (port) {
+        case PORT_A:
+                return POWER_DOMAIN_AUX_A;
+        case PORT_B:
+                return POWER_DOMAIN_AUX_B;
+        case PORT_C:
+                return POWER_DOMAIN_AUX_C;
+        case PORT_D:
+                return POWER_DOMAIN_AUX_D;
+        case PORT_E:
+                /* FIXME: Check VBT for actual wiring of PORT E */
+                return POWER_DOMAIN_AUX_D;
+        default:
+                MISSING_CASE(port);
+                return POWER_DOMAIN_AUX_A;
+        }
+}
+
 #define for_each_power_domain(domain, mask)                             \
         for ((domain) = 0; (domain) < POWER_DOMAIN_NUM; (domain)++)     \
                 if ((1 << (domain)) & (mask))
@@ -5230,6 +5265,36 @@ intel_display_port_power_domain(struct intel_encoder *intel_encoder)
         }
 }
 
+enum intel_display_power_domain
+intel_display_port_aux_power_domain(struct intel_encoder *intel_encoder)
+{
+        struct drm_device *dev = intel_encoder->base.dev;
+        struct intel_digital_port *intel_dig_port;
+
+        switch (intel_encoder->type) {
+        case INTEL_OUTPUT_UNKNOWN:
+        case INTEL_OUTPUT_HDMI:
+                /*
+                 * Only DDI platforms should ever use these output types.
+                 * We can get here after the HDMI detect code has already set
+                 * the type of the shared encoder. Since we can't be sure
+                 * what's the status of the given connectors, play safe and
+                 * run the DP detection too.
+                 */
+                WARN_ON_ONCE(!HAS_DDI(dev));
+        case INTEL_OUTPUT_DISPLAYPORT:
+        case INTEL_OUTPUT_EDP:
+                intel_dig_port = enc_to_dig_port(&intel_encoder->base);
+                return port_to_aux_power_domain(intel_dig_port->port);
+        case INTEL_OUTPUT_DP_MST:
+                intel_dig_port = enc_to_mst(&intel_encoder->base)->primary;
+                return port_to_aux_power_domain(intel_dig_port->port);
+        default:
+                MISSING_CASE(intel_encoder->type);
+                return POWER_DOMAIN_AUX_A;
+        }
+}
+
 static unsigned long get_crtc_power_domains(struct drm_crtc *crtc)
 {
         struct drm_device *dev = crtc->dev;
@@ -6259,9 +6324,11 @@ static void intel_crtc_disable_noatomic(struct drm_crtc *crtc)
         if (to_intel_plane_state(crtc->primary->state)->visible) {
                 intel_crtc_wait_for_pending_flips(crtc);
                 intel_pre_disable_primary(crtc);
+
+                intel_crtc_disable_planes(crtc, 1 << drm_plane_index(crtc->primary));
+                to_intel_plane_state(crtc->primary->state)->visible = false;
         }
 
-        intel_crtc_disable_planes(crtc, crtc->state->plane_mask);
         dev_priv->display.crtc_disable(crtc);
         intel_crtc->active = false;
         intel_update_watermarks(crtc);
@@ -9858,14 +9925,14 @@ static bool haswell_get_pipe_config(struct intel_crtc *crtc,
         return true;
 }
 
-static void i845_update_cursor(struct drm_crtc *crtc, u32 base)
+static void i845_update_cursor(struct drm_crtc *crtc, u32 base, bool on)
 {
         struct drm_device *dev = crtc->dev;
         struct drm_i915_private *dev_priv = dev->dev_private;
         struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
         uint32_t cntl = 0, size = 0;
 
-        if (base) {
+        if (on) {
                 unsigned int width = intel_crtc->base.cursor->state->crtc_w;
                 unsigned int height = intel_crtc->base.cursor->state->crtc_h;
                 unsigned int stride = roundup_pow_of_two(width) * 4;
@@ -9920,16 +9987,15 @@ static void i845_update_cursor(struct drm_crtc *crtc, u32 base)
         }
 }
 
-static void i9xx_update_cursor(struct drm_crtc *crtc, u32 base)
+static void i9xx_update_cursor(struct drm_crtc *crtc, u32 base, bool on)
 {
         struct drm_device *dev = crtc->dev;
         struct drm_i915_private *dev_priv = dev->dev_private;
         struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
         int pipe = intel_crtc->pipe;
-        uint32_t cntl;
+        uint32_t cntl = 0;
 
-        cntl = 0;
-        if (base) {
+        if (on) {
                 cntl = MCURSOR_GAMMA_ENABLE;
                 switch (intel_crtc->base.cursor->state->crtc_w) {
                         case 64:
@@ -9980,18 +10046,17 @@ static void intel_crtc_update_cursor(struct drm_crtc *crtc,
         int y = cursor_state->crtc_y;
         u32 base = 0, pos = 0;
 
-        if (on)
-                base = intel_crtc->cursor_addr;
+        base = intel_crtc->cursor_addr;
 
         if (x >= intel_crtc->config->pipe_src_w)
-                base = 0;
+                on = false;
 
         if (y >= intel_crtc->config->pipe_src_h)
-                base = 0;
+                on = false;
 
         if (x < 0) {
                 if (x + cursor_state->crtc_w <= 0)
-                        base = 0;
+                        on = false;
 
                 pos |= CURSOR_POS_SIGN << CURSOR_X_SHIFT;
                 x = -x;
@@ -10000,16 +10065,13 @@ static void intel_crtc_update_cursor(struct drm_crtc *crtc,
 
         if (y < 0) {
                 if (y + cursor_state->crtc_h <= 0)
-                        base = 0;
+                        on = false;
 
                 pos |= CURSOR_POS_SIGN << CURSOR_Y_SHIFT;
                 y = -y;
         }
         pos |= y << CURSOR_Y_SHIFT;
 
-        if (base == 0 && intel_crtc->cursor_base == 0)
-                return;
-
         I915_WRITE(CURPOS(pipe), pos);
 
         /* ILK+ do this automagically */
@@ -10020,9 +10082,9 @@ static void intel_crtc_update_cursor(struct drm_crtc *crtc,
         }
 
         if (IS_845G(dev) || IS_I865G(dev))
-                i845_update_cursor(crtc, base);
+                i845_update_cursor(crtc, base, on);
         else
-                i9xx_update_cursor(crtc, base);
+                i9xx_update_cursor(crtc, base, on);
 }
 
 static bool cursor_size_ok(struct drm_device *dev,
@@ -12061,18 +12123,22 @@ static void intel_dump_pipe_config(struct intel_crtc *crtc,
 static bool check_digital_port_conflicts(struct drm_atomic_state *state)
 {
         struct drm_device *dev = state->dev;
-        struct intel_encoder *encoder;
         struct drm_connector *connector;
-        struct drm_connector_state *connector_state;
         unsigned int used_ports = 0;
-        int i;
 
         /*
          * Walk the connector list instead of the encoder
          * list to detect the problem on ddi platforms
          * where there's just one encoder per digital port.
          */
-        for_each_connector_in_state(state, connector, connector_state, i) {
+        drm_for_each_connector(connector, dev) {
+                struct drm_connector_state *connector_state;
+                struct intel_encoder *encoder;
+
+                connector_state = drm_atomic_get_existing_connector_state(state, connector);
+                if (!connector_state)
+                        connector_state = connector->state;
+
                 if (!connector_state->best_encoder)
                         continue;
 
@@ -12460,7 +12526,6 @@ intel_pipe_config_compare(struct drm_device *dev,
         if (INTEL_INFO(dev)->gen < 8) {
                 PIPE_CONF_CHECK_M_N(dp_m_n);
 
-                PIPE_CONF_CHECK_I(has_drrs);
                 if (current_config->has_drrs)
                         PIPE_CONF_CHECK_M_N(dp_m2_n2);
         } else
@@ -13667,6 +13732,7 @@ intel_check_cursor_plane(struct drm_plane *plane,
         struct drm_crtc *crtc = crtc_state->base.crtc;
         struct drm_framebuffer *fb = state->base.fb;
         struct drm_i915_gem_object *obj = intel_fb_obj(fb);
+        enum pipe pipe = to_intel_plane(plane)->pipe;
         unsigned stride;
         int ret;
 
@@ -13700,6 +13766,22 @@ intel_check_cursor_plane(struct drm_plane *plane,
                 return -EINVAL;
         }
 
+        /*
+         * There's something wrong with the cursor on CHV pipe C.
+         * If it straddles the left edge of the screen then
+         * moving it away from the edge or disabling it often
+         * results in a pipe underrun, and often that can lead to
+         * dead pipe (constant underrun reported, and it scans
+         * out just a solid color). To recover from that, the
+         * display power well must be turned off and on again.
+         * Refuse the put the cursor into that compromised position.
+         */
+        if (IS_CHERRYVIEW(plane->dev) && pipe == PIPE_C &&
+            state->visible && state->base.crtc_x < 0) {
+                DRM_DEBUG_KMS("CHV cursor C not allowed to straddle the left screen edge\n");
+                return -EINVAL;
+        }
+
         return 0;
 }
 
@@ -13723,9 +13805,6 @@ intel_commit_cursor_plane(struct drm_plane *plane,
         crtc = crtc ? crtc : plane->crtc;
         intel_crtc = to_intel_crtc(crtc);
 
-        if (intel_crtc->cursor_bo == obj)
-                goto update;
-
         if (!obj)
                 addr = 0;
         else if (!INTEL_INFO(dev)->cursor_needs_physical)
@@ -13734,9 +13813,7 @@ intel_commit_cursor_plane(struct drm_plane *plane,
                 addr = obj->phys_handle->busaddr;
 
         intel_crtc->cursor_addr = addr;
-        intel_crtc->cursor_bo = obj;
 
-update:
         if (crtc->state->active)
                 intel_crtc_update_cursor(crtc, state->visible);
 }
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index 09bdd94ca3ba..78b8ec84d576 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -277,7 +277,7 @@ static void pps_lock(struct intel_dp *intel_dp)
          * See vlv_power_sequencer_reset() why we need
          * a power domain reference here.
          */
-        power_domain = intel_display_port_power_domain(encoder);
+        power_domain = intel_display_port_aux_power_domain(encoder);
         intel_display_power_get(dev_priv, power_domain);
 
         mutex_lock(&dev_priv->pps_mutex);
@@ -293,7 +293,7 @@ static void pps_unlock(struct intel_dp *intel_dp)
 
         mutex_unlock(&dev_priv->pps_mutex);
 
-        power_domain = intel_display_port_power_domain(encoder);
+        power_domain = intel_display_port_aux_power_domain(encoder);
         intel_display_power_put(dev_priv, power_domain);
 }
 
@@ -816,8 +816,6 @@ intel_dp_aux_ch(struct intel_dp *intel_dp,
 
         intel_dp_check_edp(intel_dp);
 
-        intel_aux_display_runtime_get(dev_priv);
-
         /* Try to wait for any previous AUX channel activity */
         for (try = 0; try < 3; try++) {
                 status = I915_READ_NOTRACE(ch_ctl);
@@ -926,7 +924,6 @@ done:
         ret = recv_bytes;
 out:
         pm_qos_update_request(&dev_priv->pm_qos, PM_QOS_DEFAULT_VALUE);
-        intel_aux_display_runtime_put(dev_priv);
 
         if (vdd)
                 edp_panel_vdd_off(intel_dp, false);
@@ -1784,7 +1781,7 @@ static bool edp_panel_vdd_on(struct intel_dp *intel_dp)
         if (edp_have_panel_vdd(intel_dp))
                 return need_to_disable;
 
-        power_domain = intel_display_port_power_domain(intel_encoder);
+        power_domain = intel_display_port_aux_power_domain(intel_encoder);
         intel_display_power_get(dev_priv, power_domain);
 
         DRM_DEBUG_KMS("Turning eDP port %c VDD on\n",
@@ -1874,7 +1871,7 @@ static void edp_panel_vdd_off_sync(struct intel_dp *intel_dp)
         if ((pp & POWER_TARGET_ON) == 0)
                 intel_dp->last_power_cycle = jiffies;
 
-        power_domain = intel_display_port_power_domain(intel_encoder);
+        power_domain = intel_display_port_aux_power_domain(intel_encoder);
         intel_display_power_put(dev_priv, power_domain);
 }
 
@@ -2025,7 +2022,7 @@ static void edp_panel_off(struct intel_dp *intel_dp)
         wait_panel_off(intel_dp);
 
         /* We got a reference when we enabled the VDD. */
-        power_domain = intel_display_port_power_domain(intel_encoder);
+        power_domain = intel_display_port_aux_power_domain(intel_encoder);
         intel_display_power_put(dev_priv, power_domain);
 }
 
@@ -4765,26 +4762,6 @@ intel_dp_unset_edid(struct intel_dp *intel_dp)
         intel_dp->has_audio = false;
 }
 
-static enum intel_display_power_domain
-intel_dp_power_get(struct intel_dp *dp)
-{
-        struct intel_encoder *encoder = &dp_to_dig_port(dp)->base;
-        enum intel_display_power_domain power_domain;
-
-        power_domain = intel_display_port_power_domain(encoder);
-        intel_display_power_get(to_i915(encoder->base.dev), power_domain);
-
-        return power_domain;
-}
-
-static void
-intel_dp_power_put(struct intel_dp *dp,
-                   enum intel_display_power_domain power_domain)
-{
-        struct intel_encoder *encoder = &dp_to_dig_port(dp)->base;
-        intel_display_power_put(to_i915(encoder->base.dev), power_domain);
-}
-
 static enum drm_connector_status
 intel_dp_detect(struct drm_connector *connector, bool force)
 {
@@ -4808,7 +4785,8 @@ intel_dp_detect(struct drm_connector *connector, bool force)
                 return connector_status_disconnected;
         }
 
-        power_domain = intel_dp_power_get(intel_dp);
+        power_domain = intel_display_port_aux_power_domain(intel_encoder);
+        intel_display_power_get(to_i915(dev), power_domain);
 
         /* Can't disconnect eDP, but you can close the lid... */
         if (is_edp(intel_dp))
@@ -4853,7 +4831,7 @@ intel_dp_detect(struct drm_connector *connector, bool force)
         }
 
 out:
-        intel_dp_power_put(intel_dp, power_domain);
+        intel_display_power_put(to_i915(dev), power_domain);
         return status;
 }
 
@@ -4862,6 +4840,7 @@ intel_dp_force(struct drm_connector *connector)
 {
         struct intel_dp *intel_dp = intel_attached_dp(connector);
         struct intel_encoder *intel_encoder = &dp_to_dig_port(intel_dp)->base;
+        struct drm_i915_private *dev_priv = to_i915(intel_encoder->base.dev);
         enum intel_display_power_domain power_domain;
 
         DRM_DEBUG_KMS("[CONNECTOR:%d:%s]\n",
@@ -4871,11 +4850,12 @@ intel_dp_force(struct drm_connector *connector)
         if (connector->status != connector_status_connected)
                 return;
 
-        power_domain = intel_dp_power_get(intel_dp);
+        power_domain = intel_display_port_aux_power_domain(intel_encoder);
+        intel_display_power_get(dev_priv, power_domain);
 
         intel_dp_set_edid(intel_dp);
 
-        intel_dp_power_put(intel_dp, power_domain);
+        intel_display_power_put(dev_priv, power_domain);
 
         if (intel_encoder->type != INTEL_OUTPUT_EDP)
                 intel_encoder->type = INTEL_OUTPUT_DISPLAYPORT;
@@ -5091,7 +5071,7 @@ static void intel_edp_panel_vdd_sanitize(struct intel_dp *intel_dp)
          * indefinitely.
          */
         DRM_DEBUG_KMS("VDD left on by BIOS, adjusting state tracking\n");
-        power_domain = intel_display_port_power_domain(&intel_dig_port->base);
+        power_domain = intel_display_port_aux_power_domain(&intel_dig_port->base);
         intel_display_power_get(dev_priv, power_domain);
 
         edp_panel_vdd_schedule_off(intel_dp);
@@ -5153,7 +5133,8 @@ intel_dp_hpd_pulse(struct intel_digital_port *intel_dig_port, bool long_hpd)
         enum intel_display_power_domain power_domain;
         enum irqreturn ret = IRQ_NONE;
 
-        if (intel_dig_port->base.type != INTEL_OUTPUT_EDP)
+        if (intel_dig_port->base.type != INTEL_OUTPUT_EDP &&
+            intel_dig_port->base.type != INTEL_OUTPUT_HDMI)
                 intel_dig_port->base.type = INTEL_OUTPUT_DISPLAYPORT;
 
         if (long_hpd && intel_dig_port->base.type == INTEL_OUTPUT_EDP) {
@@ -5172,7 +5153,7 @@ intel_dp_hpd_pulse(struct intel_digital_port *intel_dig_port, bool long_hpd)
                       port_name(intel_dig_port->port),
                       long_hpd ? "long" : "short");
 
-        power_domain = intel_display_port_power_domain(intel_encoder);
+        power_domain = intel_display_port_aux_power_domain(intel_encoder);
         intel_display_power_get(dev_priv, power_domain);
 
         if (long_hpd) {
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index 0598932ce623..0d00f07b7163 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -550,7 +550,6 @@ struct intel_crtc {
         int adjusted_x;
         int adjusted_y;
 
-        struct drm_i915_gem_object *cursor_bo;
         uint32_t cursor_addr;
         uint32_t cursor_cntl;
         uint32_t cursor_size;
@@ -1169,6 +1168,8 @@ void hsw_enable_ips(struct intel_crtc *crtc);
 void hsw_disable_ips(struct intel_crtc *crtc);
 enum intel_display_power_domain
 intel_display_port_power_domain(struct intel_encoder *intel_encoder);
+enum intel_display_power_domain
+intel_display_port_aux_power_domain(struct intel_encoder *intel_encoder);
 void intel_mode_from_pipe_config(struct drm_display_mode *mode,
                                  struct intel_crtc_state *pipe_config);
 void intel_crtc_wait_for_pending_flips(struct drm_crtc *crtc);
@@ -1377,8 +1378,6 @@ void intel_display_power_get(struct drm_i915_private *dev_priv,
                              enum intel_display_power_domain domain);
 void intel_display_power_put(struct drm_i915_private *dev_priv,
                              enum intel_display_power_domain domain);
-void intel_aux_display_runtime_get(struct drm_i915_private *dev_priv);
-void intel_aux_display_runtime_put(struct drm_i915_private *dev_priv);
 void intel_runtime_pm_get(struct drm_i915_private *dev_priv);
 void intel_runtime_pm_get_noresume(struct drm_i915_private *dev_priv);
 void intel_runtime_pm_put(struct drm_i915_private *dev_priv);
diff --git a/drivers/gpu/drm/i915/intel_hdmi.c b/drivers/gpu/drm/i915/intel_hdmi.c
index 9eafa191cee2..e6c035b0fc1c 100644
--- a/drivers/gpu/drm/i915/intel_hdmi.c
+++ b/drivers/gpu/drm/i915/intel_hdmi.c
@@ -1335,21 +1335,17 @@ intel_hdmi_set_edid(struct drm_connector *connector, bool force)
 {
         struct drm_i915_private *dev_priv = to_i915(connector->dev);
         struct intel_hdmi *intel_hdmi = intel_attached_hdmi(connector);
-        struct intel_encoder *intel_encoder =
-                &hdmi_to_dig_port(intel_hdmi)->base;
-        enum intel_display_power_domain power_domain;
         struct edid *edid = NULL;
         bool connected = false;
 
-        power_domain = intel_display_port_power_domain(intel_encoder);
-        intel_display_power_get(dev_priv, power_domain);
+        intel_display_power_get(dev_priv, POWER_DOMAIN_GMBUS);
 
         if (force)
                 edid = drm_get_edid(connector,
                                     intel_gmbus_get_adapter(dev_priv,
                                     intel_hdmi->ddc_bus));
 
-        intel_display_power_put(dev_priv, power_domain);
+        intel_display_power_put(dev_priv, POWER_DOMAIN_GMBUS);
 
         to_intel_connector(connector)->detect_edid = edid;
         if (edid && edid->input & DRM_EDID_INPUT_DIGITAL) {
@@ -1378,15 +1374,18 @@ intel_hdmi_detect(struct drm_connector *connector, bool force)
         struct intel_hdmi *intel_hdmi = intel_attached_hdmi(connector);
         struct drm_i915_private *dev_priv = to_i915(connector->dev);
         bool live_status = false;
-        unsigned int retry = 3;
+        unsigned int try;
 
         DRM_DEBUG_KMS("[CONNECTOR:%d:%s]\n",
                       connector->base.id, connector->name);
 
-        while (!live_status && --retry) {
+        intel_display_power_get(dev_priv, POWER_DOMAIN_GMBUS);
+
+        for (try = 0; !live_status && try < 9; try++) {
+                if (try)
+                        msleep(10);
                 live_status = intel_digital_port_connected(dev_priv,
                                 hdmi_to_dig_port(intel_hdmi));
-                mdelay(10);
         }
 
         if (!live_status)
@@ -1402,6 +1401,8 @@ intel_hdmi_detect(struct drm_connector *connector, bool force)
         } else
                 status = connector_status_disconnected;
 
+        intel_display_power_put(dev_priv, POWER_DOMAIN_GMBUS);
+
         return status;
 }
 
diff --git a/drivers/gpu/drm/i915/intel_i2c.c b/drivers/gpu/drm/i915/intel_i2c.c
index 1369fc41d039..8324654037b6 100644
--- a/drivers/gpu/drm/i915/intel_i2c.c
+++ b/drivers/gpu/drm/i915/intel_i2c.c
@@ -483,7 +483,7 @@ gmbus_xfer(struct i2c_adapter *adapter,
         int i = 0, inc, try = 0;
         int ret = 0;
 
-        intel_aux_display_runtime_get(dev_priv);
+        intel_display_power_get(dev_priv, POWER_DOMAIN_GMBUS);
         mutex_lock(&dev_priv->gmbus_mutex);
 
         if (bus->force_bit) {
@@ -595,7 +595,9 @@ timeout:
 
 out:
         mutex_unlock(&dev_priv->gmbus_mutex);
-        intel_aux_display_runtime_put(dev_priv);
+
+        intel_display_power_put(dev_priv, POWER_DOMAIN_GMBUS);
+
         return ret;
 }
 
diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index 071a76b9ac52..f091ad12d694 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -4782,8 +4782,7 @@ static void gen9_enable_rc6(struct drm_device *dev)
         /* 2b: Program RC6 thresholds.*/
 
         /* WaRsDoubleRc6WrlWithCoarsePowerGating: Doubling WRL only when CPG is enabled */
-        if (IS_SKYLAKE(dev) && !((IS_SKL_GT3(dev) || IS_SKL_GT4(dev)) &&
-                                 (INTEL_REVID(dev) <= SKL_REVID_E0)))
+        if (IS_SKYLAKE(dev))
                 I915_WRITE(GEN6_RC6_WAKE_RATE_LIMIT, 108 << 16);
         else
                 I915_WRITE(GEN6_RC6_WAKE_RATE_LIMIT, 54 << 16);
@@ -4825,7 +4824,7 @@ static void gen9_enable_rc6(struct drm_device *dev)
          * WaRsDisableCoarsePowerGating:skl,bxt - Render/Media PG need to be disabled with RC6.
          */
         if ((IS_BROXTON(dev) && (INTEL_REVID(dev) < BXT_REVID_B0)) ||
-            ((IS_SKL_GT3(dev) || IS_SKL_GT4(dev)) && (INTEL_REVID(dev) <= SKL_REVID_E0)))
+            ((IS_SKL_GT3(dev) || IS_SKL_GT4(dev)) && (INTEL_REVID(dev) <= SKL_REVID_F0)))
                 I915_WRITE(GEN9_PG_ENABLE, 0);
         else
                 I915_WRITE(GEN9_PG_ENABLE, (rc6_mask & GEN6_RC_CTL_RC6_ENABLE) ?
diff --git a/drivers/gpu/drm/i915/intel_runtime_pm.c b/drivers/gpu/drm/i915/intel_runtime_pm.c
index d89c1d0aa1b7..7e23d65c9b24 100644
--- a/drivers/gpu/drm/i915/intel_runtime_pm.c
+++ b/drivers/gpu/drm/i915/intel_runtime_pm.c
@@ -362,6 +362,7 @@ static void hsw_set_power_well(struct drm_i915_private *dev_priv,
         BIT(POWER_DOMAIN_AUX_C) |                       \
         BIT(POWER_DOMAIN_AUDIO) |                       \
         BIT(POWER_DOMAIN_VGA) |                         \
+        BIT(POWER_DOMAIN_GMBUS) |                       \
         BIT(POWER_DOMAIN_INIT))
 #define BXT_DISPLAY_POWERWELL_1_POWER_DOMAINS (         \
         BXT_DISPLAY_POWERWELL_2_POWER_DOMAINS |         \
@@ -1483,6 +1484,7 @@ void intel_display_power_put(struct drm_i915_private *dev_priv,
         BIT(POWER_DOMAIN_AUX_B) |                       \
         BIT(POWER_DOMAIN_AUX_C) |                       \
         BIT(POWER_DOMAIN_AUX_D) |                       \
+        BIT(POWER_DOMAIN_GMBUS) |                       \
         BIT(POWER_DOMAIN_INIT))
 #define HSW_DISPLAY_POWER_DOMAINS (                             \
         (POWER_DOMAIN_MASK & ~HSW_ALWAYS_ON_POWER_DOMAINS) |    \
@@ -1845,6 +1847,8 @@ int intel_power_domains_init(struct drm_i915_private *dev_priv)
         i915.disable_power_well = sanitize_disable_power_well_option(dev_priv,
                                                      i915.disable_power_well);
 
+        BUILD_BUG_ON(POWER_DOMAIN_NUM > 31);
+
         mutex_init(&power_domains->lock);
 
         /*
@@ -2064,36 +2068,6 @@ void intel_power_domains_init_hw(struct drm_i915_private *dev_priv)
 }
 
 /**
- * intel_aux_display_runtime_get - grab an auxiliary power domain reference
- * @dev_priv: i915 device instance
- *
- * This function grabs a power domain reference for the auxiliary power domain
- * (for access to the GMBUS and DP AUX blocks) and ensures that it and all its
- * parents are powered up. Therefore users should only grab a reference to the
- * innermost power domain they need.
- *
- * Any power domain reference obtained by this function must have a symmetric
- * call to intel_aux_display_runtime_put() to release the reference again.
- */
-void intel_aux_display_runtime_get(struct drm_i915_private *dev_priv)
-{
-        intel_runtime_pm_get(dev_priv);
-}
-
-/**
- * intel_aux_display_runtime_put - release an auxiliary power domain reference
- * @dev_priv: i915 device instance
- *
- * This function drops the auxiliary power domain reference obtained by
- * intel_aux_display_runtime_get() and might power down the corresponding
- * hardware block right away if this is the last reference.
- */
-void intel_aux_display_runtime_put(struct drm_i915_private *dev_priv)
-{
-        intel_runtime_pm_put(dev_priv);
-}
-
-/**
  * intel_runtime_pm_get - grab a runtime pm reference
  * @dev_priv: i915 device instance
  *
diff --git a/drivers/gpu/drm/imx/imx-drm-core.c b/drivers/gpu/drm/imx/imx-drm-core.c
index 64f16ea779ef..7b990b4e96d2 100644
--- a/drivers/gpu/drm/imx/imx-drm-core.c
+++ b/drivers/gpu/drm/imx/imx-drm-core.c
@@ -63,8 +63,7 @@ static void imx_drm_driver_lastclose(struct drm_device *drm)
 #if IS_ENABLED(CONFIG_DRM_IMX_FB_HELPER)
         struct imx_drm_device *imxdrm = drm->dev_private;
 
-        if (imxdrm->fbhelper)
-                drm_fbdev_cma_restore_mode(imxdrm->fbhelper);
+        drm_fbdev_cma_restore_mode(imxdrm->fbhelper);
 #endif
 }
 
@@ -340,7 +339,7 @@ err_kms:
  * imx_drm_add_crtc - add a new crtc
  */
 int imx_drm_add_crtc(struct drm_device *drm, struct drm_crtc *crtc,
-                struct imx_drm_crtc **new_crtc,
+                struct imx_drm_crtc **new_crtc, struct drm_plane *primary_plane,
                 const struct imx_drm_crtc_helper_funcs *imx_drm_helper_funcs,
                 struct device_node *port)
 {
@@ -379,7 +378,7 @@ int imx_drm_add_crtc(struct drm_device *drm, struct drm_crtc *crtc,
         drm_crtc_helper_add(crtc,
                         imx_drm_crtc->imx_drm_helper_funcs.crtc_helper_funcs);
 
-        drm_crtc_init(drm, crtc,
+        drm_crtc_init_with_planes(drm, crtc, primary_plane, NULL,
                         imx_drm_crtc->imx_drm_helper_funcs.crtc_funcs);
 
         return 0;
diff --git a/drivers/gpu/drm/imx/imx-drm.h b/drivers/gpu/drm/imx/imx-drm.h
index 28e776d8d9d2..83284b4d4be1 100644
--- a/drivers/gpu/drm/imx/imx-drm.h
+++ b/drivers/gpu/drm/imx/imx-drm.h
@@ -9,6 +9,7 @@ struct drm_display_mode;
 struct drm_encoder;
 struct drm_fbdev_cma;
 struct drm_framebuffer;
+struct drm_plane;
 struct imx_drm_crtc;
 struct platform_device;
 
@@ -24,7 +25,7 @@ struct imx_drm_crtc_helper_funcs {
 };
 
 int imx_drm_add_crtc(struct drm_device *drm, struct drm_crtc *crtc,
-                struct imx_drm_crtc **new_crtc,
+                struct imx_drm_crtc **new_crtc, struct drm_plane *primary_plane,
                 const struct imx_drm_crtc_helper_funcs *imx_helper_funcs,
                 struct device_node *port);
 int imx_drm_remove_crtc(struct imx_drm_crtc *);
diff --git a/drivers/gpu/drm/imx/imx-tve.c b/drivers/gpu/drm/imx/imx-tve.c
index e671ad369416..f9597146dc67 100644
--- a/drivers/gpu/drm/imx/imx-tve.c
+++ b/drivers/gpu/drm/imx/imx-tve.c
@@ -721,6 +721,7 @@ static const struct of_device_id imx_tve_dt_ids[] = {
         { .compatible = "fsl,imx53-tve", },
         { /* sentinel */ }
 };
+MODULE_DEVICE_TABLE(of, imx_tve_dt_ids);
 
 static struct platform_driver imx_tve_driver = {
         .probe          = imx_tve_probe,
diff --git a/drivers/gpu/drm/imx/ipuv3-crtc.c b/drivers/gpu/drm/imx/ipuv3-crtc.c
index 7bc8301fafff..4ab841eebee1 100644
--- a/drivers/gpu/drm/imx/ipuv3-crtc.c
+++ b/drivers/gpu/drm/imx/ipuv3-crtc.c
@@ -212,7 +212,8 @@ static void ipu_crtc_handle_pageflip(struct ipu_crtc *ipu_crtc)
 
         spin_lock_irqsave(&drm->event_lock, flags);
         if (ipu_crtc->page_flip_event)
-                drm_send_vblank_event(drm, -1, ipu_crtc->page_flip_event);
+                drm_crtc_send_vblank_event(&ipu_crtc->base,
+                                           ipu_crtc->page_flip_event);
         ipu_crtc->page_flip_event = NULL;
         imx_drm_crtc_vblank_put(ipu_crtc->imx_crtc);
         spin_unlock_irqrestore(&drm->event_lock, flags);
@@ -349,7 +350,6 @@ static int ipu_crtc_init(struct ipu_crtc *ipu_crtc,
         struct ipu_soc *ipu = dev_get_drvdata(ipu_crtc->dev->parent);
         int dp = -EINVAL;
         int ret;
-        int id;
 
         ret = ipu_get_resources(ipu_crtc, pdata);
         if (ret) {
@@ -358,18 +358,23 @@ static int ipu_crtc_init(struct ipu_crtc *ipu_crtc,
                 return ret;
         }
 
+        if (pdata->dp >= 0)
+                dp = IPU_DP_FLOW_SYNC_BG;
+        ipu_crtc->plane[0] = ipu_plane_init(drm, ipu, pdata->dma[0], dp, 0,
+                                            DRM_PLANE_TYPE_PRIMARY);
+        if (IS_ERR(ipu_crtc->plane[0])) {
+                ret = PTR_ERR(ipu_crtc->plane[0]);
+                goto err_put_resources;
+        }
+
         ret = imx_drm_add_crtc(drm, &ipu_crtc->base, &ipu_crtc->imx_crtc,
-                        &ipu_crtc_helper_funcs, ipu_crtc->dev->of_node);
+                        &ipu_crtc->plane[0]->base, &ipu_crtc_helper_funcs,
+                        ipu_crtc->dev->of_node);
         if (ret) {
                 dev_err(ipu_crtc->dev, "adding crtc failed with %d.\n", ret);
                 goto err_put_resources;
         }
 
-        if (pdata->dp >= 0)
-                dp = IPU_DP_FLOW_SYNC_BG;
-        id = imx_drm_crtc_id(ipu_crtc->imx_crtc);
-        ipu_crtc->plane[0] = ipu_plane_init(ipu_crtc->base.dev, ipu,
-                                            pdata->dma[0], dp, BIT(id), true);
         ret = ipu_plane_get_resources(ipu_crtc->plane[0]);
         if (ret) {
                 dev_err(ipu_crtc->dev, "getting plane 0 resources failed with %d.\n",
@@ -379,10 +384,10 @@ static int ipu_crtc_init(struct ipu_crtc *ipu_crtc,
 
         /* If this crtc is using the DP, add an overlay plane */
         if (pdata->dp >= 0 && pdata->dma[1] > 0) {
-                ipu_crtc->plane[1] = ipu_plane_init(ipu_crtc->base.dev, ipu,
-                                                    pdata->dma[1],
-                                                    IPU_DP_FLOW_SYNC_FG,
-                                                    BIT(id), false);
+                ipu_crtc->plane[1] = ipu_plane_init(drm, ipu, pdata->dma[1],
+                                                IPU_DP_FLOW_SYNC_FG,
+                                                drm_crtc_mask(&ipu_crtc->base),
+                                                DRM_PLANE_TYPE_OVERLAY);
                 if (IS_ERR(ipu_crtc->plane[1]))
                         ipu_crtc->plane[1] = NULL;
         }
@@ -407,28 +412,6 @@ err_put_resources:
         return ret;
 }
 
-static struct device_node *ipu_drm_get_port_by_id(struct device_node *parent,
-                                                  int port_id)
-{
-        struct device_node *port;
-        int id, ret;
-
-        port = of_get_child_by_name(parent, "port");
-        while (port) {
-                ret = of_property_read_u32(port, "reg", &id);
-                if (!ret && id == port_id)
-                        return port;
-
-                do {
-                        port = of_get_next_child(parent, port);
-                        if (!port)
-                                return NULL;
-                } while (of_node_cmp(port->name, "port"));
-        }
-
-        return NULL;
-}
-
 static int ipu_drm_bind(struct device *dev, struct device *master, void *data)
 {
         struct ipu_client_platformdata *pdata = dev->platform_data;
@@ -470,23 +453,11 @@ static const struct component_ops ipu_crtc_ops = {
 static int ipu_drm_probe(struct platform_device *pdev)
 {
         struct device *dev = &pdev->dev;
-        struct ipu_client_platformdata *pdata = dev->platform_data;
         int ret;
 
         if (!dev->platform_data)
                 return -EINVAL;
 
-        if (!dev->of_node) {
-                /* Associate crtc device with the corresponding DI port node */
-                dev->of_node = ipu_drm_get_port_by_id(dev->parent->of_node,
-                                                      pdata->di + 2);
-                if (!dev->of_node) {
-                        dev_err(dev, "missing port@%d node in %s\n",
-                                pdata->di + 2, dev->parent->of_node->full_name);
-                        return -ENODEV;
-                }
-        }
-
         ret = dma_set_coherent_mask(dev, DMA_BIT_MASK(32));
         if (ret)
                 return ret;
diff --git a/drivers/gpu/drm/imx/ipuv3-plane.c b/drivers/gpu/drm/imx/ipuv3-plane.c
index 575f4c84388f..e2ff410bab74 100644
--- a/drivers/gpu/drm/imx/ipuv3-plane.c
+++ b/drivers/gpu/drm/imx/ipuv3-plane.c
@@ -381,7 +381,7 @@ static struct drm_plane_funcs ipu_plane_funcs = {
 
 struct ipu_plane *ipu_plane_init(struct drm_device *dev, struct ipu_soc *ipu,
                                  int dma, int dp, unsigned int possible_crtcs,
-                                 bool priv)
+                                 enum drm_plane_type type)
 {
         struct ipu_plane *ipu_plane;
         int ret;
@@ -399,10 +399,9 @@ struct ipu_plane *ipu_plane_init(struct drm_device *dev, struct ipu_soc *ipu,
         ipu_plane->dma = dma;
         ipu_plane->dp_flow = dp;
 
-        ret = drm_plane_init(dev, &ipu_plane->base, possible_crtcs,
-                             &ipu_plane_funcs, ipu_plane_formats,
-                             ARRAY_SIZE(ipu_plane_formats),
-                             priv);
+        ret = drm_universal_plane_init(dev, &ipu_plane->base, possible_crtcs,
+                                       &ipu_plane_funcs, ipu_plane_formats,
+                                       ARRAY_SIZE(ipu_plane_formats), type);
         if (ret) {
                 DRM_ERROR("failed to initialize plane\n");
                 kfree(ipu_plane);
diff --git a/drivers/gpu/drm/imx/ipuv3-plane.h b/drivers/gpu/drm/imx/ipuv3-plane.h
index 9b5eff18f5b8..3a443b413c60 100644
--- a/drivers/gpu/drm/imx/ipuv3-plane.h
+++ b/drivers/gpu/drm/imx/ipuv3-plane.h
@@ -34,7 +34,7 @@ struct ipu_plane {
 
 struct ipu_plane *ipu_plane_init(struct drm_device *dev, struct ipu_soc *ipu,
                                  int dma, int dp, unsigned int possible_crtcs,
-                                 bool priv);
+                                 enum drm_plane_type type);
 
 /* Init IDMAC, DMFC, DP */
 int ipu_plane_mode_set(struct ipu_plane *plane, struct drm_crtc *crtc,
diff --git a/drivers/gpu/drm/imx/parallel-display.c b/drivers/gpu/drm/imx/parallel-display.c
index b4deb9cf9d71..2e9b9f1b5cd2 100644
--- a/drivers/gpu/drm/imx/parallel-display.c
+++ b/drivers/gpu/drm/imx/parallel-display.c
@@ -54,7 +54,11 @@ static int imx_pd_connector_get_modes(struct drm_connector *connector)
 
         if (imxpd->panel && imxpd->panel->funcs &&
             imxpd->panel->funcs->get_modes) {
+                struct drm_display_info *di = &connector->display_info;
+
                 num_modes = imxpd->panel->funcs->get_modes(imxpd->panel);
+                if (!imxpd->bus_format && di->num_bus_formats)
+                        imxpd->bus_format = di->bus_formats[0];
                 if (num_modes > 0)
                         return num_modes;
         }
diff --git a/drivers/gpu/drm/nouveau/include/nvkm/core/device.h b/drivers/gpu/drm/nouveau/include/nvkm/core/device.h
index 8f760002e401..913192c94876 100644
--- a/drivers/gpu/drm/nouveau/include/nvkm/core/device.h
+++ b/drivers/gpu/drm/nouveau/include/nvkm/core/device.h
@@ -159,7 +159,6 @@ struct nvkm_device_func {
 struct nvkm_device_quirk {
         u8 tv_pin_mask;
         u8 tv_gpio;
-        bool War00C800_0;
 };
 
 struct nvkm_device_chip {
diff --git a/drivers/gpu/drm/nouveau/include/nvkm/subdev/instmem.h b/drivers/gpu/drm/nouveau/include/nvkm/subdev/instmem.h
index 28bc202f9753..40f845e31272 100644
--- a/drivers/gpu/drm/nouveau/include/nvkm/subdev/instmem.h
+++ b/drivers/gpu/drm/nouveau/include/nvkm/subdev/instmem.h
@@ -7,6 +7,7 @@ struct nvkm_instmem {
         const struct nvkm_instmem_func *func;
         struct nvkm_subdev subdev;
 
+        spinlock_t lock;
         struct list_head list;
         u32 reserved;
 
diff --git a/drivers/gpu/drm/nouveau/nouveau_acpi.c b/drivers/gpu/drm/nouveau/nouveau_acpi.c
index 8b8332e46f24..d5e6938cc6bc 100644
--- a/drivers/gpu/drm/nouveau/nouveau_acpi.c
+++ b/drivers/gpu/drm/nouveau/nouveau_acpi.c
@@ -367,6 +367,7 @@ static int nouveau_rom_call(acpi_handle rom_handle, uint8_t *bios,
                 return -ENODEV;
         }
         obj = (union acpi_object *)buffer.pointer;
+        len = min(len, (int)obj->buffer.length);
         memcpy(bios+offset, obj->buffer.pointer, len);
         kfree(buffer.pointer);
         return len;
diff --git a/drivers/gpu/drm/nouveau/nouveau_display.c b/drivers/gpu/drm/nouveau/nouveau_display.c
index db6bc6760545..64c8d932d5f1 100644
--- a/drivers/gpu/drm/nouveau/nouveau_display.c
+++ b/drivers/gpu/drm/nouveau/nouveau_display.c
@@ -829,7 +829,6 @@ nouveau_finish_page_flip(struct nouveau_channel *chan,
         struct drm_device *dev = drm->dev;
         struct nouveau_page_flip_state *s;
         unsigned long flags;
-        int crtcid = -1;
 
         spin_lock_irqsave(&dev->event_lock, flags);
 
@@ -841,15 +840,19 @@ nouveau_finish_page_flip(struct nouveau_channel *chan,
 
         s = list_first_entry(&fctx->flip, struct nouveau_page_flip_state, head);
         if (s->event) {
-                /* Vblank timestamps/counts are only correct on >= NV-50 */
-                if (drm->device.info.family >= NV_DEVICE_INFO_V0_TESLA)
-                        crtcid = s->crtc;
+                if (drm->device.info.family < NV_DEVICE_INFO_V0_TESLA) {
+                        drm_arm_vblank_event(dev, s->crtc, s->event);
+                } else {
+                        drm_send_vblank_event(dev, s->crtc, s->event);
 
-                drm_send_vblank_event(dev, crtcid, s->event);
+                        /* Give up ownership of vblank for page-flipped crtc */
+                        drm_vblank_put(dev, s->crtc);
+                }
+        }
+        else {
+                /* Give up ownership of vblank for page-flipped crtc */
+                drm_vblank_put(dev, s->crtc);
         }
-
-        /* Give up ownership of vblank for page-flipped crtc */
-        drm_vblank_put(dev, s->crtc);
 
         list_del(&s->head);
         if (ps)
diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.h b/drivers/gpu/drm/nouveau/nouveau_drm.h
index 3050042e6c6d..a02813e994ec 100644
--- a/drivers/gpu/drm/nouveau/nouveau_drm.h
+++ b/drivers/gpu/drm/nouveau/nouveau_drm.h
@@ -39,6 +39,7 @@
 
 #include <nvif/client.h>
 #include <nvif/device.h>
+#include <nvif/ioctl.h>
 
 #include <drmP.h>
 
@@ -65,9 +66,10 @@ struct nouveau_drm_tile {
 };
 
 enum nouveau_drm_object_route {
-        NVDRM_OBJECT_NVIF = 0,
+        NVDRM_OBJECT_NVIF = NVIF_IOCTL_V0_OWNER_NVIF,
         NVDRM_OBJECT_USIF,
         NVDRM_OBJECT_ABI16,
+        NVDRM_OBJECT_ANY = NVIF_IOCTL_V0_OWNER_ANY,
 };
 
 enum nouveau_drm_notify_route {
diff --git a/drivers/gpu/drm/nouveau/nouveau_usif.c b/drivers/gpu/drm/nouveau/nouveau_usif.c
index 89dc4ce63490..6ae1b3494bcd 100644
--- a/drivers/gpu/drm/nouveau/nouveau_usif.c
+++ b/drivers/gpu/drm/nouveau/nouveau_usif.c
@@ -313,7 +313,10 @@ usif_ioctl(struct drm_file *filp, void __user *user, u32 argc)
         if (nvif_unpack(argv->v0, 0, 0, true)) {
                 /* block access to objects not created via this interface */
                 owner = argv->v0.owner;
-                argv->v0.owner = NVDRM_OBJECT_USIF;
+                if (argv->v0.object == 0ULL)
+                        argv->v0.owner = NVDRM_OBJECT_ANY; /* except client */
+                else
+                        argv->v0.owner = NVDRM_OBJECT_USIF;
         } else
                 goto done;
 
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/device/pci.c b/drivers/gpu/drm/nouveau/nvkm/engine/device/pci.c
index e3c783d0e2ab..62ad0300cfa5 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/device/pci.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/device/pci.c
@@ -259,12 +259,6 @@ nvkm_device_pci_10de_0df4[] = {
 };
 
 static const struct nvkm_device_pci_vendor
-nvkm_device_pci_10de_0fcd[] = {
-        { 0x17aa, 0x3801, NULL, { .War00C800_0 = true } }, /* Lenovo Y510P */
-        {}
-};
-
-static const struct nvkm_device_pci_vendor
 nvkm_device_pci_10de_0fd2[] = {
         { 0x1028, 0x0595, "GeForce GT 640M LE" },
         { 0x1028, 0x05b2, "GeForce GT 640M LE" },
@@ -684,7 +678,6 @@ nvkm_device_pci_10de_1189[] = {
 static const struct nvkm_device_pci_vendor
 nvkm_device_pci_10de_1199[] = {
         { 0x1458, 0xd001, "GeForce GTX 760" },
-        { 0x1462, 0x1106, "GeForce GTX 780M", { .War00C800_0 = true } }, /* Medion Erazer X7827 */
         {}
 };
 
@@ -695,14 +688,6 @@ nvkm_device_pci_10de_11e3[] = {
 };
 
 static const struct nvkm_device_pci_vendor
-nvkm_device_pci_10de_11fc[] = {
-        { 0x1179, 0x0001, NULL, { .War00C800_0 = true } }, /* Toshiba Tecra W50 */
-        { 0x17aa, 0x2211, NULL, { .War00C800_0 = true } }, /* Lenovo W541 */
-        { 0x17aa, 0x221e, NULL, { .War00C800_0 = true } }, /* Lenovo W541 */
-        {}
-};
-
-static const struct nvkm_device_pci_vendor
 nvkm_device_pci_10de_1247[] = {
         { 0x1043, 0x212a, "GeForce GT 635M" },
         { 0x1043, 0x212b, "GeForce GT 635M" },
@@ -1356,7 +1341,7 @@ nvkm_device_pci_10de[] = {
         { 0x0fc6, "GeForce GTX 650" },
         { 0x0fc8, "GeForce GT 740" },
         { 0x0fc9, "GeForce GT 730" },
-        { 0x0fcd, "GeForce GT 755M", nvkm_device_pci_10de_0fcd },
+        { 0x0fcd, "GeForce GT 755M" },
         { 0x0fce, "GeForce GT 640M LE" },
         { 0x0fd1, "GeForce GT 650M" },
         { 0x0fd2, "GeForce GT 640M", nvkm_device_pci_10de_0fd2 },
@@ -1490,7 +1475,7 @@ nvkm_device_pci_10de[] = {
         { 0x11e2, "GeForce GTX 765M" },
         { 0x11e3, "GeForce GTX 760M", nvkm_device_pci_10de_11e3 },
         { 0x11fa, "Quadro K4000" },
-        { 0x11fc, "Quadro K2100M", nvkm_device_pci_10de_11fc },
+        { 0x11fc, "Quadro K2100M" },
         { 0x1200, "GeForce GTX 560 Ti" },
         { 0x1201, "GeForce GTX 560" },
         { 0x1203, "GeForce GTX 460 SE v2" },
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgf117.c b/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgf117.c
index b5b875928aba..74de7a96c22a 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgf117.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgf117.c
@@ -207,6 +207,8 @@ gf117_grctx_generate_attrib(struct gf100_grctx *info)
                         const u32 b =  beta * gr->ppc_tpc_nr[gpc][ppc];
                         const u32 t = timeslice_mode;
                         const u32 o = PPC_UNIT(gpc, ppc, 0);
+                        if (!(gr->ppc_mask[gpc] & (1 << ppc)))
+                                continue;
                         mmio_skip(info, o + 0xc0, (t << 28) | (b << 16) | ++bo);
                         mmio_wr32(info, o + 0xc0, (t << 28) | (b << 16) | --bo);
                         bo += grctx->attrib_nr_max * gr->ppc_tpc_nr[gpc][ppc];
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/gr/fuc/gpc.fuc b/drivers/gpu/drm/nouveau/nvkm/engine/gr/fuc/gpc.fuc
index 194afe910d21..7dacb3cc0668 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/fuc/gpc.fuc
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/fuc/gpc.fuc
@@ -52,10 +52,12 @@ mmio_list_base:
 #endif
 
 #ifdef INCLUDE_CODE
+#define gpc_addr(reg,addr)                                                    /*
+*/      imm32(reg,addr)                                                       /*
+*/      or reg NV_PGRAPH_GPCX_GPCCS_MMIO_CTRL_BASE_ENABLE
 #define gpc_wr32(addr,reg)                                                    /*
+*/      gpc_addr($r14,addr)                                                   /*
 */      mov b32 $r15 reg                                                      /*
-*/      imm32($r14, addr)                                                     /*
-*/      or $r14 NV_PGRAPH_GPCX_GPCCS_MMIO_CTRL_BASE_ENABLE                    /*
 */      call(nv_wr32)
 
 // reports an exception to the host
@@ -161,7 +163,7 @@ init:
 
 #if NV_PGRAPH_GPCX_UNK__SIZE > 0
         // figure out which, and how many, UNKs are actually present
-        imm32($r14, 0x500c30)
+        gpc_addr($r14, 0x500c30)
         clear b32 $r2
         clear b32 $r3
         clear b32 $r4
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/gr/fuc/gpcgf117.fuc3.h b/drivers/gpu/drm/nouveau/nvkm/engine/gr/fuc/gpcgf117.fuc3.h
index 64d07df4b8b1..bb820ff28621 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/fuc/gpcgf117.fuc3.h
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/fuc/gpcgf117.fuc3.h
@@ -314,7 +314,7 @@ uint32_t gf117_grgpc_code[] = {
         0x03f01200,
         0x0002d000,
         0x17f104bd,
-        0x10fe0542,
+        0x10fe0545,
         0x0007f100,
         0x0003f007,
         0xbd0000d0,
@@ -338,184 +338,184 @@ uint32_t gf117_grgpc_code[] = {
         0x02d00103,
         0xf104bd00,
         0xf00c30e7,
-        0x24bd50e3,
-        0x44bd34bd,
-/* 0x0430: init_unk_loop */
-        0xb06821f4,
-        0x0bf400f6,
-        0x01f7f00f,
-        0xfd04f2bb,
-        0x30b6054f,
-/* 0x0445: init_unk_next */
-        0x0120b601,
-        0xb004e0b6,
-        0x1bf40126,
-/* 0x0451: init_unk_done */
-        0x070380e2,
-        0xf1080480,
-        0xf0010027,
-        0x22cf0223,
-        0x9534bd00,
-        0x07f10825,
-        0x03f0c000,
-        0x0005d001,
-        0x07f104bd,
-        0x03f0c100,
-        0x0005d001,
-        0x0e9804bd,
-        0x010f9800,
-        0x015021f5,
-        0xbb002fbb,
-        0x0e98003f,
-        0x020f9801,
-        0x015021f5,
-        0xfd050e98,
-        0x2ebb00ef,
-        0x003ebb00,
-        0x98020e98,
-        0x21f5030f,
-        0x0e980150,
-        0x00effd07,
-        0xbb002ebb,
-        0x35b6003e,
-        0x0007f102,
-        0x0103f0d3,
-        0xbd0003d0,
-        0x0825b604,
-        0xb60635b6,
-        0x30b60120,
-        0x0824b601,
-        0xb90834b6,
-        0x21f5022f,
-        0x2fbb02d3,
-        0x003fbb00,
-        0x010007f1,
-        0xd00203f0,
+        0xe5f050e3,
+        0xbd24bd01,
+/* 0x0433: init_unk_loop */
+        0xf444bd34,
+        0xf6b06821,
+        0x0f0bf400,
+        0xbb01f7f0,
+        0x4ffd04f2,
+        0x0130b605,
+/* 0x0448: init_unk_next */
+        0xb60120b6,
+        0x26b004e0,
+        0xe21bf401,
+/* 0x0454: init_unk_done */
+        0x80070380,
+        0x27f10804,
+        0x23f00100,
+        0x0022cf02,
+        0x259534bd,
+        0x0007f108,
+        0x0103f0c0,
+        0xbd0005d0,
+        0x0007f104,
+        0x0103f0c1,
+        0xbd0005d0,
+        0x000e9804,
+        0xf5010f98,
+        0xbb015021,
+        0x3fbb002f,
+        0x010e9800,
+        0xf5020f98,
+        0x98015021,
+        0xeffd050e,
+        0x002ebb00,
+        0x98003ebb,
+        0x0f98020e,
+        0x5021f503,
+        0x070e9801,
+        0xbb00effd,
+        0x3ebb002e,
+        0x0235b600,
+        0xd30007f1,
+        0xd00103f0,
         0x04bd0003,
-        0x29f024bd,
-        0x0007f11f,
-        0x0203f008,
-        0xbd0002d0,
-/* 0x0505: main */
-        0x0031f404,
-        0xf00028f4,
-        0x21f424d7,
-        0xf401f439,
-        0xf404e4b0,
-        0x81fe1e18,
-        0x0627f001,
-        0x12fd20bd,
-        0x01e4b604,
-        0xfe051efd,
-        0x21f50018,
-        0x0ef405fa,
-/* 0x0535: main_not_ctx_xfer */
-        0x10ef94d3,
-        0xf501f5f0,
-        0xf4037e21,
-/* 0x0542: ih */
-        0x80f9c60e,
-        0xf90188fe,
-        0xf990f980,
-        0xf9b0f9a0,
-        0xf9e0f9d0,
-        0xf104bdf0,
-        0xf00200a7,
-        0xaacf00a3,
-        0x04abc400,
-        0xf02c0bf4,
-        0xe7f124d7,
-        0xe3f01a00,
-        0x00eecf00,
-        0x1900f7f1,
-        0xcf00f3f0,
-        0x21f400ff,
-        0x01e7f004,
-        0x1d0007f1,
-        0xd00003f0,
-        0x04bd000e,
-/* 0x0590: ih_no_fifo */
-        0x010007f1,
-        0xd00003f0,
-        0x04bd000a,
-        0xe0fcf0fc,
-        0xb0fcd0fc,
-        0x90fca0fc,
-        0x88fe80fc,
-        0xf480fc00,
-        0x01f80032,
-/* 0x05b4: hub_barrier_done */
-        0x9801f7f0,
-        0xfebb040e,
-        0x02ffb904,
-        0x9418e7f1,
-        0xf440e3f0,
-        0x00f89d21,
-/* 0x05cc: ctx_redswitch */
-        0xf120f7f0,
+        0xb60825b6,
+        0x20b60635,
+        0x0130b601,
+        0xb60824b6,
+        0x2fb90834,
+        0xd321f502,
+        0x002fbb02,
+        0xf1003fbb,
+        0xf0010007,
+        0x03d00203,
+        0xbd04bd00,
+        0x1f29f024,
+        0x080007f1,
+        0xd00203f0,
+        0x04bd0002,
+/* 0x0508: main */
+        0xf40031f4,
+        0xd7f00028,
+        0x3921f424,
+        0xb0f401f4,
+        0x18f404e4,
+        0x0181fe1e,
+        0xbd0627f0,
+        0x0412fd20,
+        0xfd01e4b6,
+        0x18fe051e,
+        0xfd21f500,
+        0xd30ef405,
+/* 0x0538: main_not_ctx_xfer */
+        0xf010ef94,
+        0x21f501f5,
+        0x0ef4037e,
+/* 0x0545: ih */
+        0xfe80f9c6,
+        0x80f90188,
+        0xa0f990f9,
+        0xd0f9b0f9,
+        0xf0f9e0f9,
+        0xa7f104bd,
+        0xa3f00200,
+        0x00aacf00,
+        0xf404abc4,
+        0xd7f02c0b,
+        0x00e7f124,
+        0x00e3f01a,
+        0xf100eecf,
+        0xf01900f7,
+        0xffcf00f3,
+        0x0421f400,
+        0xf101e7f0,
+        0xf01d0007,
+        0x0ed00003,
+/* 0x0593: ih_no_fifo */
+        0xf104bd00,
+        0xf0010007,
+        0x0ad00003,
+        0xfc04bd00,
+        0xfce0fcf0,
+        0xfcb0fcd0,
+        0xfc90fca0,
+        0x0088fe80,
+        0x32f480fc,
+/* 0x05b7: hub_barrier_done */
+        0xf001f800,
+        0x0e9801f7,
+        0x04febb04,
+        0xf102ffb9,
+        0xf09418e7,
+        0x21f440e3,
+/* 0x05cf: ctx_redswitch */
+        0xf000f89d,
+        0x07f120f7,
+        0x03f08500,
+        0x000fd001,
+        0xe7f004bd,
+/* 0x05e1: ctx_redswitch_delay */
+        0x01e2b608,
+        0xf1fd1bf4,
+        0xf10800f5,
+        0xf10200f5,
         0xf0850007,
         0x0fd00103,
-        0xf004bd00,
-/* 0x05de: ctx_redswitch_delay */
-        0xe2b608e7,
-        0xfd1bf401,
-        0x0800f5f1,
-        0x0200f5f1,
-        0x850007f1,
-        0xd00103f0,
-        0x04bd000f,
-/* 0x05fa: ctx_xfer */
-        0x07f100f8,
-        0x03f08100,
-        0x000fd002,
-        0x11f404bd,
-        0xcc21f507,
-/* 0x060d: ctx_xfer_not_load */
-        0x6a21f505,
-        0xf124bd02,
-        0xf047fc07,
-        0x02d00203,
-        0xf004bd00,
-        0x20b6012c,
-        0xfc07f103,
-        0x0203f04a,
-        0xbd0002d0,
-        0x01acf004,
-        0xf102a5f0,
-        0xf00000b7,
-        0x0c9850b3,
-        0x0fc4b604,
-        0x9800bcbb,
-        0x0d98000c,
-        0x00e7f001,
-        0x016f21f5,
-        0xf101acf0,
-        0xf04000b7,
-        0x0c9850b3,
-        0x0fc4b604,
-        0x9800bcbb,
-        0x0d98010c,
-        0x060f9802,
-        0x0800e7f1,
-        0x016f21f5,
+        0xf804bd00,
+/* 0x05fd: ctx_xfer */
+        0x0007f100,
+        0x0203f081,
+        0xbd000fd0,
+        0x0711f404,
+        0x05cf21f5,
+/* 0x0610: ctx_xfer_not_load */
+        0x026a21f5,
+        0x07f124bd,
+        0x03f047fc,
+        0x0002d002,
+        0x2cf004bd,
+        0x0320b601,
+        0x4afc07f1,
+        0xd00203f0,
+        0x04bd0002,
         0xf001acf0,
-        0xb7f104a5,
-        0xb3f03000,
+        0xb7f102a5,
+        0xb3f00000,
         0x040c9850,
         0xbb0fc4b6,
         0x0c9800bc,
-        0x030d9802,
-        0xf1080f98,
-        0xf50200e7,
-        0xf5016f21,
-        0xf4025e21,
-        0x12f40601,
-/* 0x06a9: ctx_xfer_post */
-        0x7f21f507,
-/* 0x06ad: ctx_xfer_done */
-        0xb421f502,
-        0x0000f805,
-        0x00000000,
+        0x010d9800,
+        0xf500e7f0,
+        0xf0016f21,
+        0xb7f101ac,
+        0xb3f04000,
+        0x040c9850,
+        0xbb0fc4b6,
+        0x0c9800bc,
+        0x020d9801,
+        0xf1060f98,
+        0xf50800e7,
+        0xf0016f21,
+        0xa5f001ac,
+        0x00b7f104,
+        0x50b3f030,
+        0xb6040c98,
+        0xbcbb0fc4,
+        0x020c9800,
+        0x98030d98,
+        0xe7f1080f,
+        0x21f50200,
+        0x21f5016f,
+        0x01f4025e,
+        0x0712f406,
+/* 0x06ac: ctx_xfer_post */
+        0x027f21f5,
+/* 0x06b0: ctx_xfer_done */
+        0x05b721f5,
+        0x000000f8,
         0x00000000,
         0x00000000,
         0x00000000,
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/gr/fuc/gpcgk104.fuc3.h b/drivers/gpu/drm/nouveau/nvkm/engine/gr/fuc/gpcgk104.fuc3.h
index 2f596433c222..911976d20940 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/fuc/gpcgk104.fuc3.h
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/fuc/gpcgk104.fuc3.h
@@ -314,7 +314,7 @@ uint32_t gk104_grgpc_code[] = {
         0x03f01200,
         0x0002d000,
         0x17f104bd,
-        0x10fe0542,
+        0x10fe0545,
         0x0007f100,
         0x0003f007,
         0xbd0000d0,
@@ -338,184 +338,184 @@ uint32_t gk104_grgpc_code[] = {
         0x02d00103,
         0xf104bd00,
         0xf00c30e7,
-        0x24bd50e3,
-        0x44bd34bd,
-/* 0x0430: init_unk_loop */
-        0xb06821f4,
-        0x0bf400f6,
-        0x01f7f00f,
-        0xfd04f2bb,
-        0x30b6054f,
-/* 0x0445: init_unk_next */
-        0x0120b601,
-        0xb004e0b6,
-        0x1bf40126,
-/* 0x0451: init_unk_done */
-        0x070380e2,
-        0xf1080480,
-        0xf0010027,
-        0x22cf0223,
-        0x9534bd00,
-        0x07f10825,
-        0x03f0c000,
-        0x0005d001,
-        0x07f104bd,
-        0x03f0c100,
-        0x0005d001,
-        0x0e9804bd,
-        0x010f9800,
-        0x015021f5,
-        0xbb002fbb,
-        0x0e98003f,
-        0x020f9801,
-        0x015021f5,
-        0xfd050e98,
-        0x2ebb00ef,
-        0x003ebb00,
-        0x98020e98,
-        0x21f5030f,
-        0x0e980150,
-        0x00effd07,
-        0xbb002ebb,
-        0x35b6003e,
-        0x0007f102,
-        0x0103f0d3,
-        0xbd0003d0,
-        0x0825b604,
-        0xb60635b6,
-        0x30b60120,
-        0x0824b601,
-        0xb90834b6,
-        0x21f5022f,
-        0x2fbb02d3,
-        0x003fbb00,
-        0x010007f1,
-        0xd00203f0,
+        0xe5f050e3,
+        0xbd24bd01,
+/* 0x0433: init_unk_loop */
+        0xf444bd34,
+        0xf6b06821,
+        0x0f0bf400,
+        0xbb01f7f0,
+        0x4ffd04f2,
+        0x0130b605,
+/* 0x0448: init_unk_next */
+        0xb60120b6,
+        0x26b004e0,
+        0xe21bf401,
+/* 0x0454: init_unk_done */
+        0x80070380,
+        0x27f10804,
+        0x23f00100,
+        0x0022cf02,
+        0x259534bd,
+        0x0007f108,
+        0x0103f0c0,
+        0xbd0005d0,
+        0x0007f104,
+        0x0103f0c1,
+        0xbd0005d0,
+        0x000e9804,
+        0xf5010f98,
+        0xbb015021,
+        0x3fbb002f,
+        0x010e9800,
+        0xf5020f98,
+        0x98015021,
+        0xeffd050e,
+        0x002ebb00,
+        0x98003ebb,
+        0x0f98020e,
+        0x5021f503,
+        0x070e9801,
+        0xbb00effd,
+        0x3ebb002e,
+        0x0235b600,
+        0xd30007f1,
+        0xd00103f0,
         0x04bd0003,
-        0x29f024bd,
-        0x0007f11f,
-        0x0203f008,
-        0xbd0002d0,
-/* 0x0505: main */
-        0x0031f404,
-        0xf00028f4,
-        0x21f424d7,
-        0xf401f439,
-        0xf404e4b0,
-        0x81fe1e18,
-        0x0627f001,
-        0x12fd20bd,
-        0x01e4b604,
-        0xfe051efd,
-        0x21f50018,
-        0x0ef405fa,
-/* 0x0535: main_not_ctx_xfer */
-        0x10ef94d3,
-        0xf501f5f0,
-        0xf4037e21,
-/* 0x0542: ih */
-        0x80f9c60e,
-        0xf90188fe,
-        0xf990f980,
-        0xf9b0f9a0,
-        0xf9e0f9d0,
-        0xf104bdf0,
-        0xf00200a7,
-        0xaacf00a3,
-        0x04abc400,
-        0xf02c0bf4,
-        0xe7f124d7,
-        0xe3f01a00,
-        0x00eecf00,
-        0x1900f7f1,
-        0xcf00f3f0,
-        0x21f400ff,
-        0x01e7f004,
-        0x1d0007f1,
-        0xd00003f0,
-        0x04bd000e,
-/* 0x0590: ih_no_fifo */
-        0x010007f1,
-        0xd00003f0,
-        0x04bd000a,
-        0xe0fcf0fc,
-        0xb0fcd0fc,
-        0x90fca0fc,
-        0x88fe80fc,
-        0xf480fc00,
-        0x01f80032,
-/* 0x05b4: hub_barrier_done */
-        0x9801f7f0,
-        0xfebb040e,
-        0x02ffb904,
-        0x9418e7f1,
-        0xf440e3f0,
-        0x00f89d21,
-/* 0x05cc: ctx_redswitch */
-        0xf120f7f0,
+        0xb60825b6,
+        0x20b60635,
+        0x0130b601,
+        0xb60824b6,
+        0x2fb90834,
+        0xd321f502,
+        0x002fbb02,
+        0xf1003fbb,
+        0xf0010007,
+        0x03d00203,
+        0xbd04bd00,
+        0x1f29f024,
+        0x080007f1,
+        0xd00203f0,
+        0x04bd0002,
+/* 0x0508: main */
+        0xf40031f4,
+        0xd7f00028,
+        0x3921f424,
+        0xb0f401f4,
+        0x18f404e4,
+        0x0181fe1e,
+        0xbd0627f0,
+        0x0412fd20,
+        0xfd01e4b6,
+        0x18fe051e,
+        0xfd21f500,
+        0xd30ef405,
+/* 0x0538: main_not_ctx_xfer */
+        0xf010ef94,
+        0x21f501f5,
+        0x0ef4037e,
+/* 0x0545: ih */
+        0xfe80f9c6,
+        0x80f90188,
+        0xa0f990f9,
+        0xd0f9b0f9,
+        0xf0f9e0f9,
+        0xa7f104bd,
+        0xa3f00200,
+        0x00aacf00,
+        0xf404abc4,
+        0xd7f02c0b,
+        0x00e7f124,
+        0x00e3f01a,
+        0xf100eecf,
+        0xf01900f7,
+        0xffcf00f3,
+        0x0421f400,
+        0xf101e7f0,
+        0xf01d0007,
+        0x0ed00003,
+/* 0x0593: ih_no_fifo */
+        0xf104bd00,
+        0xf0010007,
+        0x0ad00003,
+        0xfc04bd00,
+        0xfce0fcf0,
+        0xfcb0fcd0,
+        0xfc90fca0,
+        0x0088fe80,
+        0x32f480fc,
+/* 0x05b7: hub_barrier_done */
+        0xf001f800,
+        0x0e9801f7,
+        0x04febb04,
+        0xf102ffb9,
+        0xf09418e7,
+        0x21f440e3,
+/* 0x05cf: ctx_redswitch */
+        0xf000f89d,
+        0x07f120f7,
+        0x03f08500,
+        0x000fd001,
+        0xe7f004bd,
+/* 0x05e1: ctx_redswitch_delay */
+        0x01e2b608,
+        0xf1fd1bf4,
+        0xf10800f5,
+        0xf10200f5,
         0xf0850007,
         0x0fd00103,
-        0xf004bd00,
-/* 0x05de: ctx_redswitch_delay */
-        0xe2b608e7,
-        0xfd1bf401,
-        0x0800f5f1,
-        0x0200f5f1,
-        0x850007f1,
-        0xd00103f0,
-        0x04bd000f,
-/* 0x05fa: ctx_xfer */
-        0x07f100f8,
-        0x03f08100,
-        0x000fd002,
-        0x11f404bd,
-        0xcc21f507,
-/* 0x060d: ctx_xfer_not_load */
-        0x6a21f505,
-        0xf124bd02,
-        0xf047fc07,
-        0x02d00203,
-        0xf004bd00,
-        0x20b6012c,
-        0xfc07f103,
-        0x0203f04a,
-        0xbd0002d0,
-        0x01acf004,
-        0xf102a5f0,
-        0xf00000b7,
-        0x0c9850b3,
-        0x0fc4b604,
-        0x9800bcbb,
-        0x0d98000c,
-        0x00e7f001,
-        0x016f21f5,
-        0xf101acf0,
-        0xf04000b7,
-        0x0c9850b3,
-        0x0fc4b604,
-        0x9800bcbb,
-        0x0d98010c,
-        0x060f9802,
-        0x0800e7f1,
-        0x016f21f5,
+        0xf804bd00,
+/* 0x05fd: ctx_xfer */
+        0x0007f100,
+        0x0203f081,
+        0xbd000fd0,
+        0x0711f404,
+        0x05cf21f5,
+/* 0x0610: ctx_xfer_not_load */
+        0x026a21f5,
+        0x07f124bd,
+        0x03f047fc,
+        0x0002d002,
+        0x2cf004bd,
+        0x0320b601,
+        0x4afc07f1,
+        0xd00203f0,
+        0x04bd0002,
         0xf001acf0,
-        0xb7f104a5,
-        0xb3f03000,
+        0xb7f102a5,
+        0xb3f00000,
         0x040c9850,
         0xbb0fc4b6,
         0x0c9800bc,
-        0x030d9802,
-        0xf1080f98,
-        0xf50200e7,
-        0xf5016f21,
-        0xf4025e21,
-        0x12f40601,
-/* 0x06a9: ctx_xfer_post */
-        0x7f21f507,
-/* 0x06ad: ctx_xfer_done */
-        0xb421f502,
-        0x0000f805,
-        0x00000000,
+        0x010d9800,
+        0xf500e7f0,
+        0xf0016f21,
+        0xb7f101ac,
+        0xb3f04000,
+        0x040c9850,
+        0xbb0fc4b6,
+        0x0c9800bc,
+        0x020d9801,
+        0xf1060f98,
+        0xf50800e7,
+        0xf0016f21,
+        0xa5f001ac,
+        0x00b7f104,
+        0x50b3f030,
+        0xb6040c98,
+        0xbcbb0fc4,
+        0x020c9800,
+        0x98030d98,
+        0xe7f1080f,
+        0x21f50200,
+        0x21f5016f,
+        0x01f4025e,
+        0x0712f406,
+/* 0x06ac: ctx_xfer_post */
+        0x027f21f5,
+/* 0x06b0: ctx_xfer_done */
+        0x05b721f5,
+        0x000000f8,
         0x00000000,
         0x00000000,
         0x00000000,
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/gr/fuc/gpcgk110.fuc3.h b/drivers/gpu/drm/nouveau/nvkm/engine/gr/fuc/gpcgk110.fuc3.h
index ee8e54db8fc9..1c6e11b05df2 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/fuc/gpcgk110.fuc3.h
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/fuc/gpcgk110.fuc3.h
@@ -314,7 +314,7 @@ uint32_t gk110_grgpc_code[] = {
         0x03f01200,
         0x0002d000,
         0x17f104bd,
-        0x10fe0542,
+        0x10fe0545,
         0x0007f100,
         0x0003f007,
         0xbd0000d0,
@@ -338,184 +338,184 @@ uint32_t gk110_grgpc_code[] = {
         0x02d00103,
         0xf104bd00,
         0xf00c30e7,
-        0x24bd50e3,
-        0x44bd34bd,
-/* 0x0430: init_unk_loop */
-        0xb06821f4,
-        0x0bf400f6,
-        0x01f7f00f,
-        0xfd04f2bb,
-        0x30b6054f,
-/* 0x0445: init_unk_next */
-        0x0120b601,
-        0xb004e0b6,
-        0x1bf40226,
-/* 0x0451: init_unk_done */
-        0x070380e2,
-        0xf1080480,
-        0xf0010027,
-        0x22cf0223,
-        0x9534bd00,
-        0x07f10825,
-        0x03f0c000,
-        0x0005d001,
-        0x07f104bd,
-        0x03f0c100,
-        0x0005d001,
-        0x0e9804bd,
-        0x010f9800,
-        0x015021f5,
-        0xbb002fbb,
-        0x0e98003f,
-        0x020f9801,
-        0x015021f5,
-        0xfd050e98,
-        0x2ebb00ef,
-        0x003ebb00,
-        0x98020e98,
-        0x21f5030f,
-        0x0e980150,
-        0x00effd07,
-        0xbb002ebb,
-        0x35b6003e,
-        0x0007f102,
-        0x0103f0d3,
-        0xbd0003d0,
-        0x0825b604,
-        0xb60635b6,
-        0x30b60120,
-        0x0824b601,
-        0xb90834b6,
-        0x21f5022f,
-        0x2fbb02d3,
-        0x003fbb00,
-        0x010007f1,
-        0xd00203f0,
+        0xe5f050e3,
+        0xbd24bd01,
+/* 0x0433: init_unk_loop */
+        0xf444bd34,
+        0xf6b06821,
+        0x0f0bf400,
+        0xbb01f7f0,
+        0x4ffd04f2,
+        0x0130b605,
+/* 0x0448: init_unk_next */
+        0xb60120b6,
+        0x26b004e0,
+        0xe21bf402,
+/* 0x0454: init_unk_done */
+        0x80070380,
+        0x27f10804,
+        0x23f00100,
+        0x0022cf02,
+        0x259534bd,
+        0x0007f108,
+        0x0103f0c0,
+        0xbd0005d0,
+        0x0007f104,
+        0x0103f0c1,
+        0xbd0005d0,
+        0x000e9804,
+        0xf5010f98,
+        0xbb015021,
+        0x3fbb002f,
+        0x010e9800,
+        0xf5020f98,
+        0x98015021,
+        0xeffd050e,
+        0x002ebb00,
+        0x98003ebb,
+        0x0f98020e,
+        0x5021f503,
+        0x070e9801,
+        0xbb00effd,
+        0x3ebb002e,
+        0x0235b600,
+        0xd30007f1,
+        0xd00103f0,
         0x04bd0003,
-        0x29f024bd,
-        0x0007f11f,
-        0x0203f030,
-        0xbd0002d0,
-/* 0x0505: main */
-        0x0031f404,
-        0xf00028f4,
-        0x21f424d7,
-        0xf401f439,
-        0xf404e4b0,
-        0x81fe1e18,
-        0x0627f001,
-        0x12fd20bd,
-        0x01e4b604,
-        0xfe051efd,
-        0x21f50018,
-        0x0ef405fa,
-/* 0x0535: main_not_ctx_xfer */
-        0x10ef94d3,
-        0xf501f5f0,
-        0xf4037e21,
-/* 0x0542: ih */
-        0x80f9c60e,
-        0xf90188fe,
-        0xf990f980,
-        0xf9b0f9a0,
-        0xf9e0f9d0,
-        0xf104bdf0,
-        0xf00200a7,
-        0xaacf00a3,
-        0x04abc400,
-        0xf02c0bf4,
-        0xe7f124d7,
-        0xe3f01a00,
-        0x00eecf00,
-        0x1900f7f1,
-        0xcf00f3f0,
-        0x21f400ff,
-        0x01e7f004,
-        0x1d0007f1,
-        0xd00003f0,
-        0x04bd000e,
-/* 0x0590: ih_no_fifo */
-        0x010007f1,
-        0xd00003f0,
-        0x04bd000a,
-        0xe0fcf0fc,
-        0xb0fcd0fc,
-        0x90fca0fc,
-        0x88fe80fc,
-        0xf480fc00,
-        0x01f80032,
-/* 0x05b4: hub_barrier_done */
-        0x9801f7f0,
-        0xfebb040e,
-        0x02ffb904,
-        0x9418e7f1,
-        0xf440e3f0,
-        0x00f89d21,
-/* 0x05cc: ctx_redswitch */
-        0xf120f7f0,
+        0xb60825b6,
+        0x20b60635,
+        0x0130b601,
+        0xb60824b6,
+        0x2fb90834,
+        0xd321f502,
+        0x002fbb02,
+        0xf1003fbb,
+        0xf0010007,
+        0x03d00203,
+        0xbd04bd00,
+        0x1f29f024,
+        0x300007f1,
+        0xd00203f0,
+        0x04bd0002,
+/* 0x0508: main */
+        0xf40031f4,
+        0xd7f00028,
+        0x3921f424,
+        0xb0f401f4,
+        0x18f404e4,
+        0x0181fe1e,
+        0xbd0627f0,
+        0x0412fd20,
+        0xfd01e4b6,
+        0x18fe051e,
+        0xfd21f500,
+        0xd30ef405,
+/* 0x0538: main_not_ctx_xfer */
+        0xf010ef94,
+        0x21f501f5,
+        0x0ef4037e,
+/* 0x0545: ih */
+        0xfe80f9c6,
+        0x80f90188,
+        0xa0f990f9,
+        0xd0f9b0f9,
+        0xf0f9e0f9,
+        0xa7f104bd,
+        0xa3f00200,
+        0x00aacf00,
+        0xf404abc4,
+        0xd7f02c0b,
+        0x00e7f124,
+        0x00e3f01a,
+        0xf100eecf,
+        0xf01900f7,
+        0xffcf00f3,
+        0x0421f400,
+        0xf101e7f0,
+        0xf01d0007,
+        0x0ed00003,
+/* 0x0593: ih_no_fifo */
+        0xf104bd00,
+        0xf0010007,
+        0x0ad00003,
+        0xfc04bd00,
+        0xfce0fcf0,
+        0xfcb0fcd0,
+        0xfc90fca0,
+        0x0088fe80,
+        0x32f480fc,
+/* 0x05b7: hub_barrier_done */
+        0xf001f800,
+        0x0e9801f7,
+        0x04febb04,
+        0xf102ffb9,
+        0xf09418e7,
+        0x21f440e3,
+/* 0x05cf: ctx_redswitch */
+        0xf000f89d,
+        0x07f120f7,
+        0x03f08500,
+        0x000fd001,
+        0xe7f004bd,
+/* 0x05e1: ctx_redswitch_delay */
+        0x01e2b608,
+        0xf1fd1bf4,
+        0xf10800f5,
+        0xf10200f5,
         0xf0850007,
         0x0fd00103,
-        0xf004bd00,
-/* 0x05de: ctx_redswitch_delay */
-        0xe2b608e7,
-        0xfd1bf401,
-        0x0800f5f1,
-        0x0200f5f1,
-        0x850007f1,
-        0xd00103f0,
-        0x04bd000f,
-/* 0x05fa: ctx_xfer */
-        0x07f100f8,
-        0x03f08100,
-        0x000fd002,
-        0x11f404bd,
-        0xcc21f507,
-/* 0x060d: ctx_xfer_not_load */
-        0x6a21f505,
-        0xf124bd02,
-        0xf047fc07,
-        0x02d00203,
-        0xf004bd00,
-        0x20b6012c,
-        0xfc07f103,
-        0x0203f04a,
-        0xbd0002d0,
-        0x01acf004,
-        0xf102a5f0,
-        0xf00000b7,
-        0x0c9850b3,
-        0x0fc4b604,
-        0x9800bcbb,
-        0x0d98000c,
-        0x00e7f001,
-        0x016f21f5,
-        0xf101acf0,
-        0xf04000b7,
-        0x0c9850b3,
-        0x0fc4b604,
-        0x9800bcbb,
-        0x0d98010c,
-        0x060f9802,
-        0x0800e7f1,
-        0x016f21f5,
+        0xf804bd00,
+/* 0x05fd: ctx_xfer */
+        0x0007f100,
+        0x0203f081,
+        0xbd000fd0,
+        0x0711f404,
+        0x05cf21f5,
+/* 0x0610: ctx_xfer_not_load */
+        0x026a21f5,
+        0x07f124bd,
+        0x03f047fc,
+        0x0002d002,
+        0x2cf004bd,
+        0x0320b601,
+        0x4afc07f1,
+        0xd00203f0,
+        0x04bd0002,
         0xf001acf0,
-        0xb7f104a5,
-        0xb3f03000,
+        0xb7f102a5,
+        0xb3f00000,
         0x040c9850,
         0xbb0fc4b6,
         0x0c9800bc,
-        0x030d9802,
-        0xf1080f98,
-        0xf50200e7,
-        0xf5016f21,
-        0xf4025e21,
-        0x12f40601,
-/* 0x06a9: ctx_xfer_post */
-        0x7f21f507,
-/* 0x06ad: ctx_xfer_done */
-        0xb421f502,
-        0x0000f805,
-        0x00000000,
+        0x010d9800,
+        0xf500e7f0,
+        0xf0016f21,
+        0xb7f101ac,
+        0xb3f04000,
+        0x040c9850,
+        0xbb0fc4b6,
+        0x0c9800bc,
+        0x020d9801,
+        0xf1060f98,
+        0xf50800e7,
+        0xf0016f21,
+        0xa5f001ac,
+        0x00b7f104,
+        0x50b3f030,
+        0xb6040c98,
+        0xbcbb0fc4,
+        0x020c9800,
+        0x98030d98,
+        0xe7f1080f,
+        0x21f50200,
+        0x21f5016f,
+        0x01f4025e,
+        0x0712f406,
+/* 0x06ac: ctx_xfer_post */
+        0x027f21f5,
+/* 0x06b0: ctx_xfer_done */
+        0x05b721f5,
+        0x000000f8,
         0x00000000,
         0x00000000,
         0x00000000,
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/gr/fuc/gpcgk208.fuc5.h b/drivers/gpu/drm/nouveau/nvkm/engine/gr/fuc/gpcgk208.fuc5.h
index fbcc342f896f..84af7ec6a78e 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/fuc/gpcgk208.fuc5.h
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/fuc/gpcgk208.fuc5.h
@@ -276,7 +276,7 @@ uint32_t gk208_grgpc_code[] = {
         0x02020014,
         0xf6120040,
         0x04bd0002,
-        0xfe048141,
+        0xfe048441,
         0x00400010,
         0x0000f607,
         0x040204bd,
@@ -295,165 +295,165 @@ uint32_t gk208_grgpc_code[] = {
         0x01c90080,
         0xbd0002f6,
         0x0c308e04,
-        0xbd24bd50,
-/* 0x0383: init_unk_loop */
-        0x7e44bd34,
-        0xb0000065,
-        0x0bf400f6,
-        0xbb010f0e,
-        0x4ffd04f2,
-        0x0130b605,
-/* 0x0398: init_unk_next */
-        0xb60120b6,
-        0x26b004e0,
-        0xe21bf401,
-/* 0x03a4: init_unk_done */
-        0xb50703b5,
-        0x00820804,
-        0x22cf0201,
-        0x9534bd00,
-        0x00800825,
-        0x05f601c0,
-        0x8004bd00,
-        0xf601c100,
-        0x04bd0005,
-        0x98000e98,
-        0x207e010f,
-        0x2fbb0001,
-        0x003fbb00,
-        0x98010e98,
-        0x207e020f,
-        0x0e980001,
-        0x00effd05,
-        0xbb002ebb,
-        0x0e98003e,
-        0x030f9802,
-        0x0001207e,
-        0xfd070e98,
-        0x2ebb00ef,
-        0x003ebb00,
-        0x800235b6,
-        0xf601d300,
-        0x04bd0003,
-        0xb60825b6,
-        0x20b60635,
-        0x0130b601,
-        0xb60824b6,
-        0x2fb20834,
-        0x0002687e,
-        0xbb002fbb,
-        0x0080003f,
-        0x03f60201,
-        0xbd04bd00,
-        0x1f29f024,
-        0x02300080,
-        0xbd0002f6,
-/* 0x0445: main */
-        0x0031f404,
-        0x0d0028f4,
-        0x00377e24,
-        0xf401f400,
-        0xf404e4b0,
-        0x81fe1d18,
-        0xbd060201,
-        0x0412fd20,
-        0xfd01e4b6,
-        0x18fe051e,
-        0x05187e00,
-        0xd40ef400,
-/* 0x0474: main_not_ctx_xfer */
-        0xf010ef94,
-        0xf87e01f5,
-        0x0ef40002,
-/* 0x0481: ih */
-        0xfe80f9c7,
-        0x80f90188,
-        0xa0f990f9,
-        0xd0f9b0f9,
-        0xf0f9e0f9,
-        0x004a04bd,
-        0x00aacf02,
-        0xf404abc4,
-        0x240d1f0b,
-        0xcf1a004e,
-        0x004f00ee,
-        0x00ffcf19,
-        0x0000047e,
-        0x0040010e,
-        0x000ef61d,
-/* 0x04be: ih_no_fifo */
-        0x004004bd,
-        0x000af601,
-        0xf0fc04bd,
-        0xd0fce0fc,
-        0xa0fcb0fc,
-        0x80fc90fc,
-        0xfc0088fe,
-        0x0032f480,
-/* 0x04de: hub_barrier_done */
-        0x010f01f8,
-        0xbb040e98,
-        0xffb204fe,
-        0x4094188e,
-        0x00008f7e,
-/* 0x04f2: ctx_redswitch */
-        0x200f00f8,
+        0x01e5f050,
+        0x34bd24bd,
+/* 0x0386: init_unk_loop */
+        0x657e44bd,
+        0xf6b00000,
+        0x0e0bf400,
+        0xf2bb010f,
+        0x054ffd04,
+/* 0x039b: init_unk_next */
+        0xb60130b6,
+        0xe0b60120,
+        0x0126b004,
+/* 0x03a7: init_unk_done */
+        0xb5e21bf4,
+        0x04b50703,
+        0x01008208,
+        0x0022cf02,
+        0x259534bd,
+        0xc0008008,
+        0x0005f601,
+        0x008004bd,
+        0x05f601c1,
+        0x9804bd00,
+        0x0f98000e,
+        0x01207e01,
+        0x002fbb00,
+        0x98003fbb,
+        0x0f98010e,
+        0x01207e02,
+        0x050e9800,
+        0xbb00effd,
+        0x3ebb002e,
+        0x020e9800,
+        0x7e030f98,
+        0x98000120,
+        0xeffd070e,
+        0x002ebb00,
+        0xb6003ebb,
+        0x00800235,
+        0x03f601d3,
+        0xb604bd00,
+        0x35b60825,
+        0x0120b606,
+        0xb60130b6,
+        0x34b60824,
+        0x7e2fb208,
+        0xbb000268,
+        0x3fbb002f,
+        0x01008000,
+        0x0003f602,
+        0x24bd04bd,
+        0x801f29f0,
+        0xf6023000,
+        0x04bd0002,
+/* 0x0448: main */
+        0xf40031f4,
+        0x240d0028,
+        0x0000377e,
+        0xb0f401f4,
+        0x18f404e4,
+        0x0181fe1d,
+        0x20bd0602,
+        0xb60412fd,
+        0x1efd01e4,
+        0x0018fe05,
+        0x00051b7e,
+/* 0x0477: main_not_ctx_xfer */
+        0x94d40ef4,
+        0xf5f010ef,
+        0x02f87e01,
+        0xc70ef400,
+/* 0x0484: ih */
+        0x88fe80f9,
+        0xf980f901,
+        0xf9a0f990,
+        0xf9d0f9b0,
+        0xbdf0f9e0,
+        0x02004a04,
+        0xc400aacf,
+        0x0bf404ab,
+        0x4e240d1f,
+        0xeecf1a00,
+        0x19004f00,
+        0x7e00ffcf,
+        0x0e000004,
+        0x1d004001,
+        0xbd000ef6,
+/* 0x04c1: ih_no_fifo */
+        0x01004004,
+        0xbd000af6,
+        0xfcf0fc04,
+        0xfcd0fce0,
+        0xfca0fcb0,
+        0xfe80fc90,
+        0x80fc0088,
+        0xf80032f4,
+/* 0x04e1: hub_barrier_done */
+        0x98010f01,
+        0xfebb040e,
+        0x8effb204,
+        0x7e409418,
+        0xf800008f,
+/* 0x04f5: ctx_redswitch */
+        0x80200f00,
+        0xf6018500,
+        0x04bd000f,
+/* 0x0502: ctx_redswitch_delay */
+        0xe2b6080e,
+        0xfd1bf401,
+        0x0800f5f1,
+        0x0200f5f1,
         0x01850080,
         0xbd000ff6,
-/* 0x04ff: ctx_redswitch_delay */
-        0xb6080e04,
-        0x1bf401e2,
-        0x00f5f1fd,
-        0x00f5f108,
-        0x85008002,
-        0x000ff601,
-        0x00f804bd,
-/* 0x0518: ctx_xfer */
-        0x02810080,
-        0xbd000ff6,
-        0x0711f404,
-        0x0004f27e,
-/* 0x0528: ctx_xfer_not_load */
-        0x0002167e,
-        0xfc8024bd,
-        0x02f60247,
-        0xf004bd00,
-        0x20b6012c,
-        0x4afc8003,
+/* 0x051b: ctx_xfer */
+        0x8000f804,
+        0xf6028100,
+        0x04bd000f,
+        0x7e0711f4,
+/* 0x052b: ctx_xfer_not_load */
+        0x7e0004f5,
+        0xbd000216,
+        0x47fc8024,
         0x0002f602,
-        0xacf004bd,
-        0x02a5f001,
-        0x5000008b,
-        0xb6040c98,
-        0xbcbb0fc4,
-        0x000c9800,
-        0x0e010d98,
-        0x013d7e00,
-        0x01acf000,
-        0x5040008b,
-        0xb6040c98,
-        0xbcbb0fc4,
-        0x010c9800,
-        0x98020d98,
-        0x004e060f,
-        0x013d7e08,
-        0x01acf000,
-        0x8b04a5f0,
-        0x98503000,
+        0x2cf004bd,
+        0x0320b601,
+        0x024afc80,
+        0xbd0002f6,
+        0x01acf004,
+        0x8b02a5f0,
+        0x98500000,
         0xc4b6040c,
         0x00bcbb0f,
-        0x98020c98,
-        0x0f98030d,
-        0x02004e08,
+        0x98000c98,
+        0x000e010d,
         0x00013d7e,
-        0x00020a7e,
-        0xf40601f4,
-/* 0x05b2: ctx_xfer_post */
-        0x277e0712,
-/* 0x05b6: ctx_xfer_done */
-        0xde7e0002,
-        0x00f80004,
-        0x00000000,
+        0x8b01acf0,
+        0x98504000,
+        0xc4b6040c,
+        0x00bcbb0f,
+        0x98010c98,
+        0x0f98020d,
+        0x08004e06,
+        0x00013d7e,
+        0xf001acf0,
+        0x008b04a5,
+        0x0c985030,
+        0x0fc4b604,
+        0x9800bcbb,
+        0x0d98020c,
+        0x080f9803,
+        0x7e02004e,
+        0x7e00013d,
+        0xf400020a,
+        0x12f40601,
+/* 0x05b5: ctx_xfer_post */
+        0x02277e07,
+/* 0x05b9: ctx_xfer_done */
+        0x04e17e00,
+        0x0000f800,
         0x00000000,
         0x00000000,
         0x00000000,
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/gr/fuc/gpcgm107.fuc5.h b/drivers/gpu/drm/nouveau/nvkm/engine/gr/fuc/gpcgm107.fuc5.h
index 51f5c3c6e966..11bf363a6ae9 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/fuc/gpcgm107.fuc5.h
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/fuc/gpcgm107.fuc5.h
@@ -289,7 +289,7 @@ uint32_t gm107_grgpc_code[] = {
         0x020014fe,
         0x12004002,
         0xbd0002f6,
-        0x05b04104,
+        0x05b34104,
         0x400010fe,
         0x00f60700,
         0x0204bd00,
@@ -308,259 +308,259 @@ uint32_t gm107_grgpc_code[] = {
         0xc900800f,
         0x0002f601,
         0x308e04bd,
-        0x24bd500c,
-        0x44bd34bd,
-/* 0x03b0: init_unk_loop */
-        0x0000657e,
-        0xf400f6b0,
-        0x010f0e0b,
-        0xfd04f2bb,
-        0x30b6054f,
-/* 0x03c5: init_unk_next */
-        0x0120b601,
-        0xb004e0b6,
-        0x1bf40226,
-/* 0x03d1: init_unk_done */
-        0x0703b5e2,
-        0x820804b5,
-        0xcf020100,
-        0x34bd0022,
-        0x80082595,
-        0xf601c000,
+        0xe5f0500c,
+        0xbd24bd01,
+/* 0x03b3: init_unk_loop */
+        0x7e44bd34,
+        0xb0000065,
+        0x0bf400f6,
+        0xbb010f0e,
+        0x4ffd04f2,
+        0x0130b605,
+/* 0x03c8: init_unk_next */
+        0xb60120b6,
+        0x26b004e0,
+        0xe21bf402,
+/* 0x03d4: init_unk_done */
+        0xb50703b5,
+        0x00820804,
+        0x22cf0201,
+        0x9534bd00,
+        0x00800825,
+        0x05f601c0,
+        0x8004bd00,
+        0xf601c100,
         0x04bd0005,
-        0x01c10080,
-        0xbd0005f6,
-        0x000e9804,
-        0x7e010f98,
-        0xbb000120,
-        0x3fbb002f,
-        0x010e9800,
-        0x7e020f98,
-        0x98000120,
-        0xeffd050e,
-        0x002ebb00,
-        0x98003ebb,
-        0x0f98020e,
-        0x01207e03,
-        0x070e9800,
-        0xbb00effd,
-        0x3ebb002e,
-        0x0235b600,
-        0x01d30080,
-        0xbd0003f6,
-        0x0825b604,
-        0xb60635b6,
-        0x30b60120,
-        0x0824b601,
-        0xb20834b6,
-        0x02687e2f,
-        0x002fbb00,
-        0x0f003fbb,
-        0x8effb23f,
-        0xf0501d60,
-        0x8f7e01e5,
-        0x0c0f0000,
-        0xa88effb2,
-        0xe5f0501d,
-        0x008f7e01,
-        0x03147e00,
-        0xb23f0f00,
-        0x1d608eff,
-        0x01e5f050,
-        0x00008f7e,
-        0xffb2000f,
-        0x501d9c8e,
-        0x7e01e5f0,
-        0x0f00008f,
-        0x03147e01,
-        0x8effb200,
+        0x98000e98,
+        0x207e010f,
+        0x2fbb0001,
+        0x003fbb00,
+        0x98010e98,
+        0x207e020f,
+        0x0e980001,
+        0x00effd05,
+        0xbb002ebb,
+        0x0e98003e,
+        0x030f9802,
+        0x0001207e,
+        0xfd070e98,
+        0x2ebb00ef,
+        0x003ebb00,
+        0x800235b6,
+        0xf601d300,
+        0x04bd0003,
+        0xb60825b6,
+        0x20b60635,
+        0x0130b601,
+        0xb60824b6,
+        0x2fb20834,
+        0x0002687e,
+        0xbb002fbb,
+        0x3f0f003f,
+        0x501d608e,
+        0xb201e5f0,
+        0x008f7eff,
+        0x8e0c0f00,
         0xf0501da8,
-        0x8f7e01e5,
-        0xff0f0000,
-        0x988effb2,
+        0xffb201e5,
+        0x00008f7e,
+        0x0003147e,
+        0x608e3f0f,
         0xe5f0501d,
-        0x008f7e01,
-        0xb2020f00,
-        0x1da88eff,
+        0x7effb201,
+        0x0f00008f,
+        0x1d9c8e00,
         0x01e5f050,
-        0x00008f7e,
+        0x8f7effb2,
+        0x010f0000,
         0x0003147e,
-        0x85050498,
-        0x98504000,
-        0x64b60406,
-        0x0056bb0f,
-/* 0x04e0: tpc_strand_init_tpc_loop */
-        0x05705eb8,
-        0x00657e00,
-        0xbdf6b200,
-/* 0x04ed: tpc_strand_init_idx_loop */
-        0x605eb874,
-        0x7fb20005,
-        0x00008f7e,
-        0x05885eb8,
-        0x082f9500,
-        0x00008f7e,
-        0x058c5eb8,
-        0x082f9500,
+        0x501da88e,
+        0xb201e5f0,
+        0x008f7eff,
+        0x8eff0f00,
+        0xf0501d98,
+        0xffb201e5,
         0x00008f7e,
-        0x05905eb8,
-        0x00657e00,
-        0x06f5b600,
-        0xb601f0b6,
-        0x2fbb08f4,
-        0x003fbb00,
-        0xb60170b6,
-        0x1bf40162,
-        0x0050b7bf,
-        0x0142b608,
-        0x0fa81bf4,
-        0x8effb23f,
-        0xf0501d60,
-        0x8f7e01e5,
-        0x0d0f0000,
-        0xa88effb2,
+        0xa88e020f,
         0xe5f0501d,
-        0x008f7e01,
-        0x03147e00,
-        0x01008000,
-        0x0003f602,
-        0x24bd04bd,
-        0x801f29f0,
-        0xf6023000,
-        0x04bd0002,
-/* 0x0574: main */
-        0xf40031f4,
-        0x240d0028,
-        0x0000377e,
-        0xb0f401f4,
-        0x18f404e4,
-        0x0181fe1d,
-        0x20bd0602,
-        0xb60412fd,
-        0x1efd01e4,
-        0x0018fe05,
-        0x0006477e,
-/* 0x05a3: main_not_ctx_xfer */
-        0x94d40ef4,
-        0xf5f010ef,
-        0x02f87e01,
-        0xc70ef400,
-/* 0x05b0: ih */
-        0x88fe80f9,
-        0xf980f901,
-        0xf9a0f990,
-        0xf9d0f9b0,
-        0xbdf0f9e0,
-        0x02004a04,
-        0xc400aacf,
-        0x0bf404ab,
-        0x4e240d1f,
-        0xeecf1a00,
-        0x19004f00,
-        0x7e00ffcf,
-        0x0e000004,
-        0x1d004001,
-        0xbd000ef6,
-/* 0x05ed: ih_no_fifo */
-        0x01004004,
-        0xbd000af6,
-        0xfcf0fc04,
-        0xfcd0fce0,
-        0xfca0fcb0,
-        0xfe80fc90,
-        0x80fc0088,
-        0xf80032f4,
-/* 0x060d: hub_barrier_done */
-        0x98010f01,
-        0xfebb040e,
-        0x8effb204,
-        0x7e409418,
-        0xf800008f,
-/* 0x0621: ctx_redswitch */
-        0x80200f00,
+        0x7effb201,
+        0x7e00008f,
+        0x98000314,
+        0x00850504,
+        0x06985040,
+        0x0f64b604,
+/* 0x04e3: tpc_strand_init_tpc_loop */
+        0xb80056bb,
+        0x0005705e,
+        0x0000657e,
+        0x74bdf6b2,
+/* 0x04f0: tpc_strand_init_idx_loop */
+        0x05605eb8,
+        0x7e7fb200,
+        0xb800008f,
+        0x0005885e,
+        0x7e082f95,
+        0xb800008f,
+        0x00058c5e,
+        0x7e082f95,
+        0xb800008f,
+        0x0005905e,
+        0x0000657e,
+        0xb606f5b6,
+        0xf4b601f0,
+        0x002fbb08,
+        0xb6003fbb,
+        0x62b60170,
+        0xbf1bf401,
+        0x080050b7,
+        0xf40142b6,
+        0x3f0fa81b,
+        0x501d608e,
+        0xb201e5f0,
+        0x008f7eff,
+        0x8e0d0f00,
+        0xf0501da8,
+        0xffb201e5,
+        0x00008f7e,
+        0x0003147e,
+        0x02010080,
+        0xbd0003f6,
+        0xf024bd04,
+        0x00801f29,
+        0x02f60230,
+/* 0x0577: main */
+        0xf404bd00,
+        0x28f40031,
+        0x7e240d00,
+        0xf4000037,
+        0xe4b0f401,
+        0x1d18f404,
+        0x020181fe,
+        0xfd20bd06,
+        0xe4b60412,
+        0x051efd01,
+        0x7e0018fe,
+        0xf400064a,
+/* 0x05a6: main_not_ctx_xfer */
+        0xef94d40e,
+        0x01f5f010,
+        0x0002f87e,
+/* 0x05b3: ih */
+        0xf9c70ef4,
+        0x0188fe80,
+        0x90f980f9,
+        0xb0f9a0f9,
+        0xe0f9d0f9,
+        0x04bdf0f9,
+        0xcf02004a,
+        0xabc400aa,
+        0x1f0bf404,
+        0x004e240d,
+        0x00eecf1a,
+        0xcf19004f,
+        0x047e00ff,
+        0x010e0000,
+        0xf61d0040,
+        0x04bd000e,
+/* 0x05f0: ih_no_fifo */
+        0xf6010040,
+        0x04bd000a,
+        0xe0fcf0fc,
+        0xb0fcd0fc,
+        0x90fca0fc,
+        0x88fe80fc,
+        0xf480fc00,
+        0x01f80032,
+/* 0x0610: hub_barrier_done */
+        0x0e98010f,
+        0x04febb04,
+        0x188effb2,
+        0x8f7e4094,
+        0x00f80000,
+/* 0x0624: ctx_redswitch */
+        0x0080200f,
+        0x0ff60185,
+        0x0e04bd00,
+/* 0x0631: ctx_redswitch_delay */
+        0x01e2b608,
+        0xf1fd1bf4,
+        0xf10800f5,
+        0x800200f5,
         0xf6018500,
         0x04bd000f,
-/* 0x062e: ctx_redswitch_delay */
-        0xe2b6080e,
-        0xfd1bf401,
-        0x0800f5f1,
-        0x0200f5f1,
-        0x01850080,
-        0xbd000ff6,
-/* 0x0647: ctx_xfer */
-        0x8000f804,
-        0xf6028100,
-        0x04bd000f,
-        0xc48effb2,
-        0xe5f0501d,
-        0x008f7e01,
-        0x0711f400,
-        0x0006217e,
-/* 0x0664: ctx_xfer_not_load */
-        0x0002167e,
-        0xfc8024bd,
-        0x02f60247,
-        0xf004bd00,
-        0x20b6012c,
-        0x4afc8003,
+/* 0x064a: ctx_xfer */
+        0x008000f8,
+        0x0ff60281,
+        0x8e04bd00,
+        0xf0501dc4,
+        0xffb201e5,
+        0x00008f7e,
+        0x7e0711f4,
+/* 0x0667: ctx_xfer_not_load */
+        0x7e000624,
+        0xbd000216,
+        0x47fc8024,
         0x0002f602,
-        0x0c0f04bd,
-        0xa88effb2,
-        0xe5f0501d,
-        0x008f7e01,
-        0x03147e00,
-        0xb23f0f00,
-        0x1d608eff,
-        0x01e5f050,
+        0x2cf004bd,
+        0x0320b601,
+        0x024afc80,
+        0xbd0002f6,
+        0x8e0c0f04,
+        0xf0501da8,
+        0xffb201e5,
         0x00008f7e,
-        0xffb2000f,
-        0x501d9c8e,
-        0x7e01e5f0,
+        0x0003147e,
+        0x608e3f0f,
+        0xe5f0501d,
+        0x7effb201,
         0x0f00008f,
-        0x03147e01,
-        0x01fcf000,
-        0xb203f0b6,
-        0x1da88eff,
+        0x1d9c8e00,
         0x01e5f050,
-        0x00008f7e,
-        0xf001acf0,
-        0x008b02a5,
-        0x0c985000,
-        0x0fc4b604,
-        0x9800bcbb,
-        0x0d98000c,
-        0x7e000e01,
-        0xf000013d,
-        0x008b01ac,
-        0x0c985040,
-        0x0fc4b604,
-        0x9800bcbb,
-        0x0d98010c,
-        0x060f9802,
-        0x7e08004e,
-        0xf000013d,
+        0x8f7effb2,
+        0x010f0000,
+        0x0003147e,
+        0xb601fcf0,
+        0xa88e03f0,
+        0xe5f0501d,
+        0x7effb201,
+        0xf000008f,
         0xa5f001ac,
-        0x30008b04,
+        0x00008b02,
         0x040c9850,
         0xbb0fc4b6,
         0x0c9800bc,
-        0x030d9802,
-        0x4e080f98,
-        0x3d7e0200,
-        0x0a7e0001,
-        0x147e0002,
-        0x01f40003,
-        0x1a12f406,
-/* 0x073c: ctx_xfer_post */
-        0x0002277e,
-        0xffb20d0f,
-        0x501da88e,
-        0x7e01e5f0,
-        0x7e00008f,
-/* 0x0753: ctx_xfer_done */
-        0x7e000314,
-        0xf800060d,
-        0x00000000,
+        0x010d9800,
+        0x3d7e000e,
+        0xacf00001,
+        0x40008b01,
+        0x040c9850,
+        0xbb0fc4b6,
+        0x0c9800bc,
+        0x020d9801,
+        0x4e060f98,
+        0x3d7e0800,
+        0xacf00001,
+        0x04a5f001,
+        0x5030008b,
+        0xb6040c98,
+        0xbcbb0fc4,
+        0x020c9800,
+        0x98030d98,
+        0x004e080f,
+        0x013d7e02,
+        0x020a7e00,
+        0x03147e00,
+        0x0601f400,
+/* 0x073f: ctx_xfer_post */
+        0x7e1a12f4,
+        0x0f000227,
+        0x1da88e0d,
+        0x01e5f050,
+        0x8f7effb2,
+        0x147e0000,
+/* 0x0756: ctx_xfer_done */
+        0x107e0003,
+        0x00f80006,
         0x00000000,
         0x00000000,
         0x00000000,
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c b/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c
index dda7a7d224c9..9f5dfc85147a 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c
@@ -143,7 +143,7 @@ gf100_gr_zbc_depth_get(struct gf100_gr *gr, int format,
 static int
 gf100_fermi_mthd_zbc_color(struct nvkm_object *object, void *data, u32 size)
 {
-        struct gf100_gr *gr = (void *)object->engine;
+        struct gf100_gr *gr = gf100_gr(nvkm_gr(object->engine));
         union {
                 struct fermi_a_zbc_color_v0 v0;
         } *args = data;
@@ -189,7 +189,7 @@ gf100_fermi_mthd_zbc_color(struct nvkm_object *object, void *data, u32 size)
 static int
 gf100_fermi_mthd_zbc_depth(struct nvkm_object *object, void *data, u32 size)
 {
-        struct gf100_gr *gr = (void *)object->engine;
+        struct gf100_gr *gr = gf100_gr(nvkm_gr(object->engine));
         union {
                 struct fermi_a_zbc_depth_v0 v0;
         } *args = data;
@@ -1530,6 +1530,8 @@ gf100_gr_oneinit(struct nvkm_gr *base)
                 gr->ppc_nr[i]  = gr->func->ppc_nr;
                 for (j = 0; j < gr->ppc_nr[i]; j++) {
                         u8 mask = nvkm_rd32(device, GPC_UNIT(i, 0x0c30 + (j * 4)));
+                        if (mask)
+                                gr->ppc_mask[i] |= (1 << j);
                         gr->ppc_tpc_nr[i][j] = hweight8(mask);
                 }
         }
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.h b/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.h
index 4611961b1187..02e78b8d93f6 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.h
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.h
@@ -97,6 +97,7 @@ struct gf100_gr {
         u8 tpc_nr[GPC_MAX];
         u8 tpc_total;
         u8 ppc_nr[GPC_MAX];
+        u8 ppc_mask[GPC_MAX];
         u8 ppc_tpc_nr[GPC_MAX][4];
 
         struct nvkm_memory *unk4188b4;
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/fan.c b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/fan.c
index 43006db6fd58..80fed7e78dcb 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/fan.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/fan.c
@@ -83,6 +83,7 @@ nvbios_fan_parse(struct nvkm_bios *bios, struct nvbios_therm_fan *fan)
                         fan->type = NVBIOS_THERM_FAN_UNK;
                 }
 
+                fan->fan_mode = NVBIOS_THERM_FAN_LINEAR;
                 fan->min_duty = nvbios_rd08(bios, data + 0x02);
                 fan->max_duty = nvbios_rd08(bios, data + 0x03);
 
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/instmem/base.c b/drivers/gpu/drm/nouveau/nvkm/subdev/instmem/base.c
index 895ba74057d4..1d7dd38292b3 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/instmem/base.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/instmem/base.c
@@ -97,7 +97,9 @@ static void *
 nvkm_instobj_dtor(struct nvkm_memory *memory)
 {
         struct nvkm_instobj *iobj = nvkm_instobj(memory);
+        spin_lock(&iobj->imem->lock);
         list_del(&iobj->head);
+        spin_unlock(&iobj->imem->lock);
         nvkm_memory_del(&iobj->parent);
         return iobj;
 }
@@ -190,7 +192,9 @@ nvkm_instobj_new(struct nvkm_instmem *imem, u32 size, u32 align, bool zero,
                 nvkm_memory_ctor(&nvkm_instobj_func_slow, &iobj->memory);
                 iobj->parent = memory;
                 iobj->imem = imem;
+                spin_lock(&iobj->imem->lock);
                 list_add_tail(&iobj->head, &imem->list);
+                spin_unlock(&iobj->imem->lock);
                 memory = &iobj->memory;
         }
 
@@ -309,5 +313,6 @@ nvkm_instmem_ctor(const struct nvkm_instmem_func *func,
 {
         nvkm_subdev_ctor(&nvkm_instmem, device, index, 0, &imem->subdev);
         imem->func = func;
+        spin_lock_init(&imem->lock);
         INIT_LIST_HEAD(&imem->list);
 }
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/gk104.c b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/gk104.c
index d942fa7b9f18..86f9f3b13f71 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/gk104.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/gk104.c
@@ -81,9 +81,7 @@ gk104_pmu_pgob(struct nvkm_pmu *pmu, bool enable)
         nvkm_mask(device, 0x000200, 0x00001000, 0x00001000);
         nvkm_rd32(device, 0x000200);
 
-        if ( nvkm_boolopt(device->cfgopt, "War00C800_0",
-            device->quirk ? device->quirk->War00C800_0 : false)) {
-                nvkm_info(&pmu->subdev, "hw bug workaround enabled\n");
+        if (nvkm_boolopt(device->cfgopt, "War00C800_0", true)) {
                 switch (device->chipset) {
                 case 0xe4:
                         magic(device, 0x04000000);
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/volt/gk104.c b/drivers/gpu/drm/nouveau/nvkm/subdev/volt/gk104.c
index b61509e26ec9..b735173a18ff 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/volt/gk104.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/volt/gk104.c
@@ -59,7 +59,7 @@ gk104_volt_set(struct nvkm_volt *base, u32 uv)
         duty = (uv - bios->base) * div / bios->pwm_range;
 
         nvkm_wr32(device, 0x20340, div);
-        nvkm_wr32(device, 0x20344, 0x8000000 | duty);
+        nvkm_wr32(device, 0x20344, 0x80000000 | duty);
 
         return 0;
 }
diff --git a/drivers/gpu/drm/omapdrm/omap_fbdev.c b/drivers/gpu/drm/omapdrm/omap_fbdev.c
index b8e4cdec28c3..24f92bea39c7 100644
--- a/drivers/gpu/drm/omapdrm/omap_fbdev.c
+++ b/drivers/gpu/drm/omapdrm/omap_fbdev.c
@@ -112,11 +112,8 @@ static int omap_fbdev_create(struct drm_fb_helper *helper,
         dma_addr_t paddr;
         int ret;
 
-        /* only doing ARGB32 since this is what is needed to alpha-blend
-         * with video overlays:
-         */
         sizes->surface_bpp = 32;
-        sizes->surface_depth = 32;
+        sizes->surface_depth = 24;
 
         DBG("create fbdev: %dx%d@%d (%dx%d)", sizes->surface_width,
                         sizes->surface_height, sizes->surface_bpp,
diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
index 248953d2fdb7..f81fb2641097 100644
--- a/drivers/gpu/drm/radeon/cik.c
+++ b/drivers/gpu/drm/radeon/cik.c
@@ -4173,11 +4173,7 @@ void cik_ring_ib_execute(struct radeon_device *rdev, struct radeon_ib *ib)
         control |= ib->length_dw | (vm_id << 24);
 
         radeon_ring_write(ring, header);
-        radeon_ring_write(ring,
-#ifdef __BIG_ENDIAN
-                          (2 << 0) |
-#endif
-                          (ib->gpu_addr & 0xFFFFFFFC));
+        radeon_ring_write(ring, (ib->gpu_addr & 0xFFFFFFFC));
         radeon_ring_write(ring, upper_32_bits(ib->gpu_addr) & 0xFFFF);
         radeon_ring_write(ring, control);
 }
@@ -8472,7 +8468,7 @@ restart_ih:
         if (queue_dp)
                 schedule_work(&rdev->dp_work);
         if (queue_hotplug)
-                schedule_work(&rdev->hotplug_work);
+                schedule_delayed_work(&rdev->hotplug_work, 0);
         if (queue_reset) {
                 rdev->needs_reset = true;
                 wake_up_all(&rdev->fence_queue);
@@ -9630,6 +9626,9 @@ static void dce8_program_watermarks(struct radeon_device *rdev,
                     (rdev->disp_priority == 2)) {
                         DRM_DEBUG_KMS("force priority to high\n");
                 }
+
+                /* Save number of lines the linebuffer leads before the scanout */
+                radeon_crtc->lb_vblank_lead_lines = DIV_ROUND_UP(lb_size, mode->crtc_hdisplay);
         }
 
         /* select wm A */
diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
index 7f33767d7ed6..2ad462896896 100644
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -2372,6 +2372,9 @@ static void evergreen_program_watermarks(struct radeon_device *rdev,
                 c.full = dfixed_div(c, a);
                 priority_b_mark = dfixed_trunc(c);
                 priority_b_cnt |= priority_b_mark & PRIORITY_MARK_MASK;
+
+                /* Save number of lines the linebuffer leads before the scanout */
+                radeon_crtc->lb_vblank_lead_lines = DIV_ROUND_UP(lb_size, mode->crtc_hdisplay);
         }
 
         /* select wm A */
@@ -5344,7 +5347,7 @@ restart_ih:
         if (queue_dp)
                 schedule_work(&rdev->dp_work);
         if (queue_hotplug)
-                schedule_work(&rdev->hotplug_work);
+                schedule_delayed_work(&rdev->hotplug_work, 0);
         if (queue_hdmi)
                 schedule_work(&rdev->audio_work);
         if (queue_thermal && rdev->pm.dpm_enabled)
diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
index 238b13f045c1..9e7e2bf03b81 100644
--- a/drivers/gpu/drm/radeon/r100.c
+++ b/drivers/gpu/drm/radeon/r100.c
@@ -806,7 +806,7 @@ int r100_irq_process(struct radeon_device *rdev)
                 status = r100_irq_ack(rdev);
         }
         if (queue_hotplug)
-                schedule_work(&rdev->hotplug_work);
+                schedule_delayed_work(&rdev->hotplug_work, 0);
         if (rdev->msi_enabled) {
                 switch (rdev->family) {
                 case CHIP_RS400:
@@ -3217,6 +3217,9 @@ void r100_bandwidth_update(struct radeon_device *rdev)
         uint32_t pixel_bytes1 = 0;
         uint32_t pixel_bytes2 = 0;
 
+        /* Guess line buffer size to be 8192 pixels */
+        u32 lb_size = 8192;
+
         if (!rdev->mode_info.mode_config_initialized)
                 return;
 
@@ -3631,6 +3634,13 @@ void r100_bandwidth_update(struct radeon_device *rdev)
                 DRM_DEBUG_KMS("GRPH2_BUFFER_CNTL from to %x\n",
                           (unsigned int)RREG32(RADEON_GRPH2_BUFFER_CNTL));
         }
+
+        /* Save number of lines the linebuffer leads before the scanout */
+        if (mode1)
+            rdev->mode_info.crtcs[0]->lb_vblank_lead_lines = DIV_ROUND_UP(lb_size, mode1->crtc_hdisplay);
+
+        if (mode2)
+            rdev->mode_info.crtcs[1]->lb_vblank_lead_lines = DIV_ROUND_UP(lb_size, mode2->crtc_hdisplay);
 }
 
 int r100_ring_test(struct radeon_device *rdev, struct radeon_ring *ring)
diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
index 4ea5b10ff5f4..cc2fdf0be37a 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -4276,7 +4276,7 @@ restart_ih:
                 WREG32(IH_RB_RPTR, rptr);
         }
         if (queue_hotplug)
-                schedule_work(&rdev->hotplug_work);
+                schedule_delayed_work(&rdev->hotplug_work, 0);
         if (queue_hdmi)
                 schedule_work(&rdev->audio_work);
         if (queue_thermal && rdev->pm.dpm_enabled)
diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
index b6cbd816537e..87db64983ea8 100644
--- a/drivers/gpu/drm/radeon/radeon.h
+++ b/drivers/gpu/drm/radeon/radeon.h
@@ -2414,7 +2414,7 @@ struct radeon_device {
         struct r600_ih ih; /* r6/700 interrupt ring */
         struct radeon_rlc rlc;
         struct radeon_mec mec;
-        struct work_struct hotplug_work;
+        struct delayed_work hotplug_work;
         struct work_struct dp_work;
         struct work_struct audio_work;
         int num_crtc; /* number of crtcs */
diff --git a/drivers/gpu/drm/radeon/radeon_agp.c b/drivers/gpu/drm/radeon/radeon_agp.c
index fe994aac3b04..c77d349c561c 100644
--- a/drivers/gpu/drm/radeon/radeon_agp.c
+++ b/drivers/gpu/drm/radeon/radeon_agp.c
@@ -54,6 +54,9 @@ static struct radeon_agpmode_quirk radeon_agpmode_quirk_list[] = {
         /* Intel 82855PM host bridge / Mobility 9600 M10 RV350 Needs AGPMode 1 (lp #195051) */
         { PCI_VENDOR_ID_INTEL, 0x3340, PCI_VENDOR_ID_ATI, 0x4e50,
                 PCI_VENDOR_ID_IBM, 0x0550, 1},
+        /* Intel 82855PM host bridge / RV250/M9 GL [Mobility FireGL 9000/Radeon 9000] needs AGPMode 1 (Thinkpad T40p) */
+        { PCI_VENDOR_ID_INTEL, 0x3340, PCI_VENDOR_ID_ATI, 0x4c66,
+                PCI_VENDOR_ID_IBM, 0x054d, 1},
         /* Intel 82855PM host bridge / Mobility M7 needs AGPMode 1 */
         { PCI_VENDOR_ID_INTEL, 0x3340, PCI_VENDOR_ID_ATI, 0x4c57,
                 PCI_VENDOR_ID_IBM, 0x0530, 1},
diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
index 5a2cafb4f1bc..340f3f549f29 100644
--- a/drivers/gpu/drm/radeon/radeon_connectors.c
+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
@@ -1234,13 +1234,32 @@ radeon_dvi_detect(struct drm_connector *connector, bool force)
         if (r < 0)
                 return connector_status_disconnected;
 
+        if (radeon_connector->detected_hpd_without_ddc) {
+                force = true;
+                radeon_connector->detected_hpd_without_ddc = false;
+        }
+
         if (!force && radeon_check_hpd_status_unchanged(connector)) {
                 ret = connector->status;
                 goto exit;
         }
 
-        if (radeon_connector->ddc_bus)
+        if (radeon_connector->ddc_bus) {
                 dret = radeon_ddc_probe(radeon_connector, false);
+
+                /* Sometimes the pins required for the DDC probe on DVI
+                 * connectors don't make contact at the same time that the ones
+                 * for HPD do. If the DDC probe fails even though we had an HPD
+                 * signal, try again later */
+                if (!dret && !force &&
+                    connector->status != connector_status_connected) {
+                        DRM_DEBUG_KMS("hpd detected without ddc, retrying in 1 second\n");
+                        radeon_connector->detected_hpd_without_ddc = true;
+                        schedule_delayed_work(&rdev->hotplug_work,
+                                              msecs_to_jiffies(1000));
+                        goto exit;
+                }
+        }
         if (dret) {
                 radeon_connector->detected_by_load = false;
                 radeon_connector_free_edid(connector);
diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
index a8d9927ed9eb..1eca0acac016 100644
--- a/drivers/gpu/drm/radeon/radeon_display.c
+++ b/drivers/gpu/drm/radeon/radeon_display.c
@@ -322,7 +322,9 @@ void radeon_crtc_handle_vblank(struct radeon_device *rdev, int crtc_id)
          * to complete in this vblank?
          */
         if (update_pending &&
-            (DRM_SCANOUTPOS_VALID & radeon_get_crtc_scanoutpos(rdev->ddev, crtc_id, 0,
+            (DRM_SCANOUTPOS_VALID & radeon_get_crtc_scanoutpos(rdev->ddev,
+                                                               crtc_id,
+                                                               USE_REAL_VBLANKSTART,
                                                                &vpos, &hpos, NULL, NULL,
                                                                &rdev->mode_info.crtcs[crtc_id]->base.hwmode)) &&
             ((vpos >= (99 * rdev->mode_info.crtcs[crtc_id]->base.hwmode.crtc_vdisplay)/100) ||
@@ -401,6 +403,8 @@ static void radeon_flip_work_func(struct work_struct *__work)
         struct drm_crtc *crtc = &radeon_crtc->base;
         unsigned long flags;
         int r;
+        int vpos, hpos, stat, min_udelay;
+        struct drm_vblank_crtc *vblank = &crtc->dev->vblank[work->crtc_id];
 
         down_read(&rdev->exclusive_lock);
         if (work->fence) {
@@ -437,6 +441,41 @@ static void radeon_flip_work_func(struct work_struct *__work)
         /* set the proper interrupt */
         radeon_irq_kms_pflip_irq_get(rdev, radeon_crtc->crtc_id);
 
+        /* If this happens to execute within the "virtually extended" vblank
+         * interval before the start of the real vblank interval then it needs
+         * to delay programming the mmio flip until the real vblank is entered.
+         * This prevents completing a flip too early due to the way we fudge
+         * our vblank counter and vblank timestamps in order to work around the
+         * problem that the hw fires vblank interrupts before actual start of
+         * vblank (when line buffer refilling is done for a frame). It
+         * complements the fudging logic in radeon_get_crtc_scanoutpos() for
+         * timestamping and radeon_get_vblank_counter_kms() for vblank counts.
+         *
+         * In practice this won't execute very often unless on very fast
+         * machines because the time window for this to happen is very small.
+         */
+        for (;;) {
+                /* GET_DISTANCE_TO_VBLANKSTART returns distance to real vblank
+                 * start in hpos, and to the "fudged earlier" vblank start in
+                 * vpos.
+                 */
+                stat = radeon_get_crtc_scanoutpos(rdev->ddev, work->crtc_id,
+                                                  GET_DISTANCE_TO_VBLANKSTART,
+                                                  &vpos, &hpos, NULL, NULL,
+                                                  &crtc->hwmode);
+
+                if ((stat & (DRM_SCANOUTPOS_VALID | DRM_SCANOUTPOS_ACCURATE)) !=
+                    (DRM_SCANOUTPOS_VALID | DRM_SCANOUTPOS_ACCURATE) ||
+                    !(vpos >= 0 && hpos <= 0))
+                        break;
+
+                /* Sleep at least until estimated real start of hw vblank */
+                spin_unlock_irqrestore(&crtc->dev->event_lock, flags);
+                min_udelay = (-hpos + 1) * max(vblank->linedur_ns / 1000, 5);
+                usleep_range(min_udelay, 2 * min_udelay);
+                spin_lock_irqsave(&crtc->dev->event_lock, flags);
+        };
+
         /* do the flip (mmio) */
         radeon_page_flip(rdev, radeon_crtc->crtc_id, work->base);
 
@@ -1768,6 +1807,15 @@ bool radeon_crtc_scaling_mode_fixup(struct drm_crtc *crtc,
  * \param dev Device to query.
  * \param crtc Crtc to query.
  * \param flags Flags from caller (DRM_CALLED_FROM_VBLIRQ or 0).
+ *              For driver internal use only also supports these flags:
+ *
+ *              USE_REAL_VBLANKSTART to use the real start of vblank instead
+ *              of a fudged earlier start of vblank.
+ *
+ *              GET_DISTANCE_TO_VBLANKSTART to return distance to the
+ *              fudged earlier start of vblank in *vpos and the distance
+ *              to true start of vblank in *hpos.
+ *
  * \param *vpos Location where vertical scanout position should be stored.
  * \param *hpos Location where horizontal scanout position should go.
  * \param *stime Target location for timestamp taken immediately before
@@ -1911,10 +1959,40 @@ int radeon_get_crtc_scanoutpos(struct drm_device *dev, unsigned int pipe,
                 vbl_end = 0;
         }
 
+        /* Called from driver internal vblank counter query code? */
+        if (flags & GET_DISTANCE_TO_VBLANKSTART) {
+            /* Caller wants distance from real vbl_start in *hpos */
+            *hpos = *vpos - vbl_start;
+        }
+
+        /* Fudge vblank to start a few scanlines earlier to handle the
+         * problem that vblank irqs fire a few scanlines before start
+         * of vblank. Some driver internal callers need the true vblank
+         * start to be used and signal this via the USE_REAL_VBLANKSTART flag.
+         *
+         * The cause of the "early" vblank irq is that the irq is triggered
+         * by the line buffer logic when the line buffer read position enters
+         * the vblank, whereas our crtc scanout position naturally lags the
+         * line buffer read position.
+         */
+        if (!(flags & USE_REAL_VBLANKSTART))
+                vbl_start -= rdev->mode_info.crtcs[pipe]->lb_vblank_lead_lines;
+
         /* Test scanout position against vblank region. */
         if ((*vpos < vbl_start) && (*vpos >= vbl_end))
                 in_vbl = false;
 
+        /* In vblank? */
+        if (in_vbl)
+            ret |= DRM_SCANOUTPOS_IN_VBLANK;
+
+        /* Called from driver internal vblank counter query code? */
+        if (flags & GET_DISTANCE_TO_VBLANKSTART) {
+                /* Caller wants distance from fudged earlier vbl_start */
+                *vpos -= vbl_start;
+                return ret;
+        }
+
         /* Check if inside vblank area and apply corrective offsets:
          * vpos will then be >=0 in video scanout area, but negative
          * within vblank area, counting down the number of lines until
@@ -1930,31 +2008,5 @@ int radeon_get_crtc_scanoutpos(struct drm_device *dev, unsigned int pipe,
         /* Correct for shifted end of vbl at vbl_end. */
         *vpos = *vpos - vbl_end;
 
-        /* In vblank? */
-        if (in_vbl)
-                ret |= DRM_SCANOUTPOS_IN_VBLANK;
-
-        /* Is vpos outside nominal vblank area, but less than
-         * 1/100 of a frame height away from start of vblank?
-         * If so, assume this isn't a massively delayed vblank
-         * interrupt, but a vblank interrupt that fired a few
-         * microseconds before true start of vblank. Compensate
-         * by adding a full frame duration to the final timestamp.
-         * Happens, e.g., on ATI R500, R600.
-         *
-         * We only do this if DRM_CALLED_FROM_VBLIRQ.
-         */
-        if ((flags & DRM_CALLED_FROM_VBLIRQ) && !in_vbl) {
-                vbl_start = mode->crtc_vdisplay;
-                vtotal = mode->crtc_vtotal;
-
-                if (vbl_start - *vpos < vtotal / 100) {
-                        *vpos -= vtotal;
-
-                        /* Signal this correction as "applied". */
-                        ret |= 0x8;
-                }
-        }
-
         return ret;
 }
diff --git a/drivers/gpu/drm/radeon/radeon_irq_kms.c b/drivers/gpu/drm/radeon/radeon_irq_kms.c
index 171d3e43c30c..979f3bf65f2c 100644
--- a/drivers/gpu/drm/radeon/radeon_irq_kms.c
+++ b/drivers/gpu/drm/radeon/radeon_irq_kms.c
@@ -74,7 +74,7 @@ irqreturn_t radeon_driver_irq_handler_kms(int irq, void *arg)
 static void radeon_hotplug_work_func(struct work_struct *work)
 {
         struct radeon_device *rdev = container_of(work, struct radeon_device,
-                                                  hotplug_work);
+                                                  hotplug_work.work);
         struct drm_device *dev = rdev->ddev;
         struct drm_mode_config *mode_config = &dev->mode_config;
         struct drm_connector *connector;
@@ -302,7 +302,7 @@ int radeon_irq_kms_init(struct radeon_device *rdev)
                 }
         }
 
-        INIT_WORK(&rdev->hotplug_work, radeon_hotplug_work_func);
+        INIT_DELAYED_WORK(&rdev->hotplug_work, radeon_hotplug_work_func);
         INIT_WORK(&rdev->dp_work, radeon_dp_work_func);
         INIT_WORK(&rdev->audio_work, r600_audio_update_hdmi);
 
@@ -310,7 +310,7 @@ int radeon_irq_kms_init(struct radeon_device *rdev)
         r = drm_irq_install(rdev->ddev, rdev->ddev->pdev->irq);
         if (r) {
                 rdev->irq.installed = false;
-                flush_work(&rdev->hotplug_work);
+                flush_delayed_work(&rdev->hotplug_work);
                 return r;
         }
 
@@ -333,7 +333,7 @@ void radeon_irq_kms_fini(struct radeon_device *rdev)
                 rdev->irq.installed = false;
                 if (rdev->msi_enabled)
                         pci_disable_msi(rdev->pdev);
-                flush_work(&rdev->hotplug_work);
+                flush_delayed_work(&rdev->hotplug_work);
         }
 }
 
diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c
index 0ec6fcca16d3..d290a8a09036 100644
--- a/drivers/gpu/drm/radeon/radeon_kms.c
+++ b/drivers/gpu/drm/radeon/radeon_kms.c
@@ -755,6 +755,8 @@ void radeon_driver_preclose_kms(struct drm_device *dev,
  */
 u32 radeon_get_vblank_counter_kms(struct drm_device *dev, int crtc)
 {
+        int vpos, hpos, stat;
+        u32 count;
         struct radeon_device *rdev = dev->dev_private;
 
         if (crtc < 0 || crtc >= rdev->num_crtc) {
@@ -762,7 +764,53 @@ u32 radeon_get_vblank_counter_kms(struct drm_device *dev, int crtc)
                 return -EINVAL;
         }
 
-        return radeon_get_vblank_counter(rdev, crtc);
+        /* The hw increments its frame counter at start of vsync, not at start
+         * of vblank, as is required by DRM core vblank counter handling.
+         * Cook the hw count here to make it appear to the caller as if it
+         * incremented at start of vblank. We measure distance to start of
+         * vblank in vpos. vpos therefore will be >= 0 between start of vblank
+         * and start of vsync, so vpos >= 0 means to bump the hw frame counter
+         * result by 1 to give the proper appearance to caller.
+         */
+        if (rdev->mode_info.crtcs[crtc]) {
+                /* Repeat readout if needed to provide stable result if
+                 * we cross start of vsync during the queries.
+                 */
+                do {
+                        count = radeon_get_vblank_counter(rdev, crtc);
+                        /* Ask radeon_get_crtc_scanoutpos to return vpos as
+                         * distance to start of vblank, instead of regular
+                         * vertical scanout pos.
+                         */
+                        stat = radeon_get_crtc_scanoutpos(
+                                dev, crtc, GET_DISTANCE_TO_VBLANKSTART,
+                                &vpos, &hpos, NULL, NULL,
+                                &rdev->mode_info.crtcs[crtc]->base.hwmode);
+                } while (count != radeon_get_vblank_counter(rdev, crtc));
+
+                if (((stat & (DRM_SCANOUTPOS_VALID | DRM_SCANOUTPOS_ACCURATE)) !=
+                    (DRM_SCANOUTPOS_VALID | DRM_SCANOUTPOS_ACCURATE))) {
+                        DRM_DEBUG_VBL("Query failed! stat %d\n", stat);
+                }
+                else {
+                        DRM_DEBUG_VBL("crtc %d: dist from vblank start %d\n",
+                                      crtc, vpos);
+
+                        /* Bump counter if we are at >= leading edge of vblank,
+                         * but before vsync where vpos would turn negative and
+                         * the hw counter really increments.
+                         */
+                        if (vpos >= 0)
+                                count++;
+                }
+        }
+        else {
+            /* Fallback to use value as is. */
+            count = radeon_get_vblank_counter(rdev, crtc);
+            DRM_DEBUG_VBL("NULL mode info! Returned count may be wrong.\n");
+        }
+
+        return count;
 }
 
 /**
diff --git a/drivers/gpu/drm/radeon/radeon_mode.h b/drivers/gpu/drm/radeon/radeon_mode.h
index 830e171c3a9e..bba112628b47 100644
--- a/drivers/gpu/drm/radeon/radeon_mode.h
+++ b/drivers/gpu/drm/radeon/radeon_mode.h
@@ -367,6 +367,7 @@ struct radeon_crtc {
         u32 line_time;
         u32 wm_low;
         u32 wm_high;
+        u32 lb_vblank_lead_lines;
         struct drm_display_mode hw_mode;
         enum radeon_output_csc output_csc;
 };
@@ -553,6 +554,7 @@ struct radeon_connector {
         void *con_priv;
         bool dac_load_detect;
         bool detected_by_load; /* if the connection status was determined by load */
+        bool detected_hpd_without_ddc; /* if an HPD signal was detected on DVI, but ddc probing failed */
         uint16_t connector_object_id;
         struct radeon_hpd hpd;
         struct radeon_router router;
@@ -686,6 +688,9 @@ struct atom_voltage_table
         struct atom_voltage_table_entry entries[MAX_VOLTAGE_ENTRIES];
 };
 
+/* Driver internal use only flags of radeon_get_crtc_scanoutpos() */
+#define USE_REAL_VBLANKSTART            (1 << 30)
+#define GET_DISTANCE_TO_VBLANKSTART     (1 << 31)
 
 extern void
 radeon_add_atom_connector(struct drm_device *dev,
diff --git a/drivers/gpu/drm/radeon/radeon_pm.c b/drivers/gpu/drm/radeon/radeon_pm.c
index f4f03dcc1530..59abebd6b5dc 100644
--- a/drivers/gpu/drm/radeon/radeon_pm.c
+++ b/drivers/gpu/drm/radeon/radeon_pm.c
@@ -1756,7 +1756,9 @@ static bool radeon_pm_in_vbl(struct radeon_device *rdev)
          */
         for (crtc = 0; (crtc < rdev->num_crtc) && in_vbl; crtc++) {
                 if (rdev->pm.active_crtcs & (1 << crtc)) {
-                        vbl_status = radeon_get_crtc_scanoutpos(rdev->ddev, crtc, 0,
+                        vbl_status = radeon_get_crtc_scanoutpos(rdev->ddev,
+                                                                crtc,
+                                                                USE_REAL_VBLANKSTART,
                                                                 &vpos, &hpos, NULL, NULL,
                                                                 &rdev->mode_info.crtcs[crtc]->base.hwmode);
                         if ((vbl_status & DRM_SCANOUTPOS_VALID) &&
diff --git a/drivers/gpu/drm/radeon/radeon_vce.c b/drivers/gpu/drm/radeon/radeon_vce.c
index 574f62bbd215..7eb1ae758906 100644
--- a/drivers/gpu/drm/radeon/radeon_vce.c
+++ b/drivers/gpu/drm/radeon/radeon_vce.c
@@ -361,31 +361,31 @@ int radeon_vce_get_create_msg(struct radeon_device *rdev, int ring,
 
         /* stitch together an VCE create msg */
         ib.length_dw = 0;
-        ib.ptr[ib.length_dw++] = 0x0000000c; /* len */
-        ib.ptr[ib.length_dw++] = 0x00000001; /* session cmd */
-        ib.ptr[ib.length_dw++] = handle;
-
-        ib.ptr[ib.length_dw++] = 0x00000030; /* len */
-        ib.ptr[ib.length_dw++] = 0x01000001; /* create cmd */
-        ib.ptr[ib.length_dw++] = 0x00000000;
-        ib.ptr[ib.length_dw++] = 0x00000042;
-        ib.ptr[ib.length_dw++] = 0x0000000a;
-        ib.ptr[ib.length_dw++] = 0x00000001;
-        ib.ptr[ib.length_dw++] = 0x00000080;
-        ib.ptr[ib.length_dw++] = 0x00000060;
-        ib.ptr[ib.length_dw++] = 0x00000100;
-        ib.ptr[ib.length_dw++] = 0x00000100;
-        ib.ptr[ib.length_dw++] = 0x0000000c;
-        ib.ptr[ib.length_dw++] = 0x00000000;
-
-        ib.ptr[ib.length_dw++] = 0x00000014; /* len */
-        ib.ptr[ib.length_dw++] = 0x05000005; /* feedback buffer */
-        ib.ptr[ib.length_dw++] = upper_32_bits(dummy);
-        ib.ptr[ib.length_dw++] = dummy;
-        ib.ptr[ib.length_dw++] = 0x00000001;
+        ib.ptr[ib.length_dw++] = cpu_to_le32(0x0000000c); /* len */
+        ib.ptr[ib.length_dw++] = cpu_to_le32(0x00000001); /* session cmd */
+        ib.ptr[ib.length_dw++] = cpu_to_le32(handle);
+
+        ib.ptr[ib.length_dw++] = cpu_to_le32(0x00000030); /* len */
+        ib.ptr[ib.length_dw++] = cpu_to_le32(0x01000001); /* create cmd */
+        ib.ptr[ib.length_dw++] = cpu_to_le32(0x00000000);
+        ib.ptr[ib.length_dw++] = cpu_to_le32(0x00000042);
+        ib.ptr[ib.length_dw++] = cpu_to_le32(0x0000000a);
+        ib.ptr[ib.length_dw++] = cpu_to_le32(0x00000001);
+        ib.ptr[ib.length_dw++] = cpu_to_le32(0x00000080);
+        ib.ptr[ib.length_dw++] = cpu_to_le32(0x00000060);
+        ib.ptr[ib.length_dw++] = cpu_to_le32(0x00000100);
+        ib.ptr[ib.length_dw++] = cpu_to_le32(0x00000100);
+        ib.ptr[ib.length_dw++] = cpu_to_le32(0x0000000c);
+        ib.ptr[ib.length_dw++] = cpu_to_le32(0x00000000);
+
+        ib.ptr[ib.length_dw++] = cpu_to_le32(0x00000014); /* len */
+        ib.ptr[ib.length_dw++] = cpu_to_le32(0x05000005); /* feedback buffer */
+        ib.ptr[ib.length_dw++] = cpu_to_le32(upper_32_bits(dummy));
+        ib.ptr[ib.length_dw++] = cpu_to_le32(dummy);
+        ib.ptr[ib.length_dw++] = cpu_to_le32(0x00000001);
 
         for (i = ib.length_dw; i < ib_size_dw; ++i)
-                ib.ptr[i] = 0x0;
+                ib.ptr[i] = cpu_to_le32(0x0);
 
         r = radeon_ib_schedule(rdev, &ib, NULL, false);
         if (r) {
@@ -428,21 +428,21 @@ int radeon_vce_get_destroy_msg(struct radeon_device *rdev, int ring,
 
         /* stitch together an VCE destroy msg */
         ib.length_dw = 0;
-        ib.ptr[ib.length_dw++] = 0x0000000c; /* len */
-        ib.ptr[ib.length_dw++] = 0x00000001; /* session cmd */
-        ib.ptr[ib.length_dw++] = handle;
+        ib.ptr[ib.length_dw++] = cpu_to_le32(0x0000000c); /* len */
+        ib.ptr[ib.length_dw++] = cpu_to_le32(0x00000001); /* session cmd */
+        ib.ptr[ib.length_dw++] = cpu_to_le32(handle);
 
-        ib.ptr[ib.length_dw++] = 0x00000014; /* len */
-        ib.ptr[ib.length_dw++] = 0x05000005; /* feedback buffer */
-        ib.ptr[ib.length_dw++] = upper_32_bits(dummy);
-        ib.ptr[ib.length_dw++] = dummy;
-        ib.ptr[ib.length_dw++] = 0x00000001;
+        ib.ptr[ib.length_dw++] = cpu_to_le32(0x00000014); /* len */
+        ib.ptr[ib.length_dw++] = cpu_to_le32(0x05000005); /* feedback buffer */
+        ib.ptr[ib.length_dw++] = cpu_to_le32(upper_32_bits(dummy));
+        ib.ptr[ib.length_dw++] = cpu_to_le32(dummy);
+        ib.ptr[ib.length_dw++] = cpu_to_le32(0x00000001);
 
-        ib.ptr[ib.length_dw++] = 0x00000008; /* len */
-        ib.ptr[ib.length_dw++] = 0x02000001; /* destroy cmd */
+        ib.ptr[ib.length_dw++] = cpu_to_le32(0x00000008); /* len */
+        ib.ptr[ib.length_dw++] = cpu_to_le32(0x02000001); /* destroy cmd */
 
         for (i = ib.length_dw; i < ib_size_dw; ++i)
-                ib.ptr[i] = 0x0;
+                ib.ptr[i] = cpu_to_le32(0x0);
 
         r = radeon_ib_schedule(rdev, &ib, NULL, false);
         if (r) {
@@ -699,12 +699,12 @@ bool radeon_vce_semaphore_emit(struct radeon_device *rdev,
 {
         uint64_t addr = semaphore->gpu_addr;
 
-        radeon_ring_write(ring, VCE_CMD_SEMAPHORE);
-        radeon_ring_write(ring, (addr >> 3) & 0x000FFFFF);
-        radeon_ring_write(ring, (addr >> 23) & 0x000FFFFF);
-        radeon_ring_write(ring, 0x01003000 | (emit_wait ? 1 : 0));
+        radeon_ring_write(ring, cpu_to_le32(VCE_CMD_SEMAPHORE));
+        radeon_ring_write(ring, cpu_to_le32((addr >> 3) & 0x000FFFFF));
+        radeon_ring_write(ring, cpu_to_le32((addr >> 23) & 0x000FFFFF));
+        radeon_ring_write(ring, cpu_to_le32(0x01003000 | (emit_wait ? 1 : 0)));
         if (!emit_wait)
-                radeon_ring_write(ring, VCE_CMD_END);
+                radeon_ring_write(ring, cpu_to_le32(VCE_CMD_END));
 
         return true;
 }
@@ -719,10 +719,10 @@ bool radeon_vce_semaphore_emit(struct radeon_device *rdev,
 void radeon_vce_ib_execute(struct radeon_device *rdev, struct radeon_ib *ib)
 {
         struct radeon_ring *ring = &rdev->ring[ib->ring];
-        radeon_ring_write(ring, VCE_CMD_IB);
-        radeon_ring_write(ring, ib->gpu_addr);
-        radeon_ring_write(ring, upper_32_bits(ib->gpu_addr));
-        radeon_ring_write(ring, ib->length_dw);
+        radeon_ring_write(ring, cpu_to_le32(VCE_CMD_IB));
+        radeon_ring_write(ring, cpu_to_le32(ib->gpu_addr));
+        radeon_ring_write(ring, cpu_to_le32(upper_32_bits(ib->gpu_addr)));
+        radeon_ring_write(ring, cpu_to_le32(ib->length_dw));
 }
 
 /**
@@ -738,12 +738,12 @@ void radeon_vce_fence_emit(struct radeon_device *rdev,
         struct radeon_ring *ring = &rdev->ring[fence->ring];
         uint64_t addr = rdev->fence_drv[fence->ring].gpu_addr;
 
-        radeon_ring_write(ring, VCE_CMD_FENCE);
-        radeon_ring_write(ring, addr);
-        radeon_ring_write(ring, upper_32_bits(addr));
-        radeon_ring_write(ring, fence->seq);
-        radeon_ring_write(ring, VCE_CMD_TRAP);
-        radeon_ring_write(ring, VCE_CMD_END);
+        radeon_ring_write(ring, cpu_to_le32(VCE_CMD_FENCE));
+        radeon_ring_write(ring, cpu_to_le32(addr));
+        radeon_ring_write(ring, cpu_to_le32(upper_32_bits(addr)));
+        radeon_ring_write(ring, cpu_to_le32(fence->seq));
+        radeon_ring_write(ring, cpu_to_le32(VCE_CMD_TRAP));
+        radeon_ring_write(ring, cpu_to_le32(VCE_CMD_END));
 }
 
 /**
@@ -765,7 +765,7 @@ int radeon_vce_ring_test(struct radeon_device *rdev, struct radeon_ring *ring)
                           ring->idx, r);
                 return r;
         }
-        radeon_ring_write(ring, VCE_CMD_END);
+        radeon_ring_write(ring, cpu_to_le32(VCE_CMD_END));
         radeon_ring_unlock_commit(rdev, ring, false);
 
         for (i = 0; i < rdev->usec_timeout; i++) {
diff --git a/drivers/gpu/drm/radeon/rs600.c b/drivers/gpu/drm/radeon/rs600.c
index 97a904835759..6244f4e44e9a 100644
--- a/drivers/gpu/drm/radeon/rs600.c
+++ b/drivers/gpu/drm/radeon/rs600.c
@@ -813,7 +813,7 @@ int rs600_irq_process(struct radeon_device *rdev)
                 status = rs600_irq_ack(rdev);
         }
         if (queue_hotplug)
-                schedule_work(&rdev->hotplug_work);
+                schedule_delayed_work(&rdev->hotplug_work, 0);
         if (queue_hdmi)
                 schedule_work(&rdev->audio_work);
         if (rdev->msi_enabled) {
diff --git a/drivers/gpu/drm/radeon/rs690.c b/drivers/gpu/drm/radeon/rs690.c
index 516ca27cfa12..6bc44c24e837 100644
--- a/drivers/gpu/drm/radeon/rs690.c
+++ b/drivers/gpu/drm/radeon/rs690.c
@@ -207,6 +207,9 @@ void rs690_line_buffer_adjust(struct radeon_device *rdev,
 {
         u32 tmp;
 
+        /* Guess line buffer size to be 8192 pixels */
+        u32 lb_size = 8192;
+
         /*
          * Line Buffer Setup
          * There is a single line buffer shared by both display controllers.
@@ -243,6 +246,13 @@ void rs690_line_buffer_adjust(struct radeon_device *rdev,
                 tmp |= V_006520_DC_LB_MEMORY_SPLIT_D1_1Q_D2_3Q;
         }
         WREG32(R_006520_DC_LB_MEMORY_SPLIT, tmp);
+
+        /* Save number of lines the linebuffer leads before the scanout */
+        if (mode1)
+                rdev->mode_info.crtcs[0]->lb_vblank_lead_lines = DIV_ROUND_UP(lb_size, mode1->crtc_hdisplay);
+
+        if (mode2)
+                rdev->mode_info.crtcs[1]->lb_vblank_lead_lines = DIV_ROUND_UP(lb_size, mode2->crtc_hdisplay);
 }
 
 struct rs690_watermark {
diff --git a/drivers/gpu/drm/radeon/rv730_dpm.c b/drivers/gpu/drm/radeon/rv730_dpm.c
index 3f5e1cf138ba..d37ba2cb886e 100644
--- a/drivers/gpu/drm/radeon/rv730_dpm.c
+++ b/drivers/gpu/drm/radeon/rv730_dpm.c
@@ -464,7 +464,7 @@ void rv730_stop_dpm(struct radeon_device *rdev)
         result = rv770_send_msg_to_smc(rdev, PPSMC_MSG_TwoLevelsDisabled);
 
         if (result != PPSMC_Result_OK)
-                DRM_ERROR("Could not force DPM to low\n");
+                DRM_DEBUG("Could not force DPM to low\n");
 
         WREG32_P(GENERAL_PWRMGT, 0, ~GLOBAL_PWRMGT_EN);
 
diff --git a/drivers/gpu/drm/radeon/rv770_dpm.c b/drivers/gpu/drm/radeon/rv770_dpm.c
index b9c770745a7a..e830c8935db0 100644
--- a/drivers/gpu/drm/radeon/rv770_dpm.c
+++ b/drivers/gpu/drm/radeon/rv770_dpm.c
@@ -193,7 +193,7 @@ void rv770_stop_dpm(struct radeon_device *rdev)
         result = rv770_send_msg_to_smc(rdev, PPSMC_MSG_TwoLevelsDisabled);
 
         if (result != PPSMC_Result_OK)
-                DRM_ERROR("Could not force DPM to low.\n");
+                DRM_DEBUG("Could not force DPM to low.\n");
 
         WREG32_P(GENERAL_PWRMGT, 0, ~GLOBAL_PWRMGT_EN);
 
@@ -1418,7 +1418,7 @@ int rv770_resume_smc(struct radeon_device *rdev)
 int rv770_set_sw_state(struct radeon_device *rdev)
 {
         if (rv770_send_msg_to_smc(rdev, PPSMC_MSG_SwitchToSwState) != PPSMC_Result_OK)
-                return -EINVAL;
+                DRM_DEBUG("rv770_set_sw_state failed\n");
         return 0;
 }
 
diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
index 07037e32dea3..f878d6962da5 100644
--- a/drivers/gpu/drm/radeon/si.c
+++ b/drivers/gpu/drm/radeon/si.c
@@ -2376,6 +2376,9 @@ static void dce6_program_watermarks(struct radeon_device *rdev,
                 c.full = dfixed_div(c, a);
                 priority_b_mark = dfixed_trunc(c);
                 priority_b_cnt |= priority_b_mark & PRIORITY_MARK_MASK;
+
+                /* Save number of lines the linebuffer leads before the scanout */
+                radeon_crtc->lb_vblank_lead_lines = DIV_ROUND_UP(lb_size, mode->crtc_hdisplay);
         }
 
         /* select wm A */
@@ -6848,7 +6851,7 @@ restart_ih:
         if (queue_dp)
                 schedule_work(&rdev->dp_work);
         if (queue_hotplug)
-                schedule_work(&rdev->hotplug_work);
+                schedule_delayed_work(&rdev->hotplug_work, 0);
         if (queue_thermal && rdev->pm.dpm_enabled)
                 schedule_work(&rdev->pm.dpm.thermal.work);
         rdev->ih.rptr = rptr;
diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_gem.c b/drivers/gpu/drm/rockchip/rockchip_drm_gem.c
index 8caea0a33dd8..d908321b94ce 100644
--- a/drivers/gpu/drm/rockchip/rockchip_drm_gem.c
+++ b/drivers/gpu/drm/rockchip/rockchip_drm_gem.c
@@ -67,6 +67,7 @@ static int rockchip_drm_gem_object_mmap(struct drm_gem_object *obj,
          * VM_PFNMAP flag that was set by drm_gem_mmap_obj()/drm_gem_mmap().
          */
         vma->vm_flags &= ~VM_PFNMAP;
+        vma->vm_pgoff = 0;
 
         ret = dma_mmap_attrs(drm->dev, vma, rk_obj->kvaddr, rk_obj->dma_addr,
                              obj->size, &rk_obj->dma_attrs);
diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
index 5d8ae5e49c44..03c47eeadc81 100644
--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
+++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
@@ -374,6 +374,7 @@ static const struct of_device_id vop_driver_dt_match[] = {
           .data = &rk3288_vop },
         {},
 };
+MODULE_DEVICE_TABLE(of, vop_driver_dt_match);
 
 static inline void vop_writel(struct vop *vop, uint32_t offset, uint32_t v)
 {
@@ -959,8 +960,8 @@ static int vop_update_plane_event(struct drm_plane *plane,
         val = (dest.y2 - dest.y1 - 1) << 16;
         val |= (dest.x2 - dest.x1 - 1) & 0xffff;
         VOP_WIN_SET(vop, win, dsp_info, val);
-        val = (dsp_sty - 1) << 16;
-        val |= (dsp_stx - 1) & 0xffff;
+        val = dsp_sty << 16;
+        val |= dsp_stx & 0xffff;
         VOP_WIN_SET(vop, win, dsp_st, val);
         VOP_WIN_SET(vop, win, rb_swap, rb_swap);
 
@@ -1289,7 +1290,7 @@ static void vop_win_state_complete(struct vop_win *vop_win,
 
         if (state->event) {
                 spin_lock_irqsave(&drm->event_lock, flags);
-                drm_send_vblank_event(drm, -1, state->event);
+                drm_crtc_send_vblank_event(crtc, state->event);
                 spin_unlock_irqrestore(&drm->event_lock, flags);
         }
 
@@ -1575,32 +1576,25 @@ static int vop_initial(struct vop *vop)
                 return PTR_ERR(vop->dclk);
         }
 
-        ret = clk_prepare(vop->hclk);
-        if (ret < 0) {
-                dev_err(vop->dev, "failed to prepare hclk\n");
-                return ret;
-        }
-
         ret = clk_prepare(vop->dclk);
         if (ret < 0) {
                 dev_err(vop->dev, "failed to prepare dclk\n");
-                goto err_unprepare_hclk;
+                return ret;
         }
 
-        ret = clk_prepare(vop->aclk);
+        /* Enable both the hclk and aclk to setup the vop */
+        ret = clk_prepare_enable(vop->hclk);
         if (ret < 0) {
-                dev_err(vop->dev, "failed to prepare aclk\n");
+                dev_err(vop->dev, "failed to prepare/enable hclk\n");
                 goto err_unprepare_dclk;
         }
 
-        /*
-         * enable hclk, so that we can config vop register.
-         */
-        ret = clk_enable(vop->hclk);
+        ret = clk_prepare_enable(vop->aclk);
         if (ret < 0) {
-                dev_err(vop->dev, "failed to prepare aclk\n");
-                goto err_unprepare_aclk;
+                dev_err(vop->dev, "failed to prepare/enable aclk\n");
+                goto err_disable_hclk;
         }
+
         /*
          * do hclk_reset, reset all vop registers.
          */
@@ -1608,7 +1602,7 @@ static int vop_initial(struct vop *vop)
         if (IS_ERR(ahb_rst)) {
                 dev_err(vop->dev, "failed to get ahb reset\n");
                 ret = PTR_ERR(ahb_rst);
-                goto err_disable_hclk;
+                goto err_disable_aclk;
         }
         reset_control_assert(ahb_rst);
         usleep_range(10, 20);
@@ -1634,26 +1628,25 @@ static int vop_initial(struct vop *vop)
         if (IS_ERR(vop->dclk_rst)) {
                 dev_err(vop->dev, "failed to get dclk reset\n");
                 ret = PTR_ERR(vop->dclk_rst);
-                goto err_unprepare_aclk;
+                goto err_disable_aclk;
         }
         reset_control_assert(vop->dclk_rst);
         usleep_range(10, 20);
         reset_control_deassert(vop->dclk_rst);
 
         clk_disable(vop->hclk);
+        clk_disable(vop->aclk);
 
         vop->is_enabled = false;
 
         return 0;
 
+err_disable_aclk:
+        clk_disable_unprepare(vop->aclk);
 err_disable_hclk:
-        clk_disable(vop->hclk);
-err_unprepare_aclk:
-        clk_unprepare(vop->aclk);
+        clk_disable_unprepare(vop->hclk);
 err_unprepare_dclk:
         clk_unprepare(vop->dclk);
-err_unprepare_hclk:
-        clk_unprepare(vop->hclk);
         return ret;
 }
 
diff --git a/drivers/gpu/drm/ttm/ttm_lock.c b/drivers/gpu/drm/ttm/ttm_lock.c
index 6a954544727f..f154fb1929bd 100644
--- a/drivers/gpu/drm/ttm/ttm_lock.c
+++ b/drivers/gpu/drm/ttm/ttm_lock.c
@@ -180,7 +180,7 @@ int ttm_write_lock(struct ttm_lock *lock, bool interruptible)
                         spin_unlock(&lock->lock);
                 }
         } else
-                wait_event(lock->queue, __ttm_read_lock(lock));
+                wait_event(lock->queue, __ttm_write_lock(lock));
 
         return ret;
 }
diff --git a/drivers/gpu/drm/virtio/virtgpu_display.c b/drivers/gpu/drm/virtio/virtgpu_display.c
index f545913a56c7..578fe0a9324c 100644
--- a/drivers/gpu/drm/virtio/virtgpu_display.c
+++ b/drivers/gpu/drm/virtio/virtgpu_display.c
@@ -412,7 +412,7 @@ static const struct drm_connector_funcs virtio_gpu_connector_funcs = {
         .save = virtio_gpu_conn_save,
         .restore = virtio_gpu_conn_restore,
         .detect = virtio_gpu_conn_detect,
-        .fill_modes = drm_helper_probe_single_connector_modes,
+        .fill_modes = drm_helper_probe_single_connector_modes_nomerge,
         .destroy = virtio_gpu_conn_destroy,
         .reset = drm_atomic_helper_connector_reset,
         .atomic_duplicate_state = drm_atomic_helper_connector_duplicate_state,
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
index a09cf8529b9f..c49812b80dd0 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
@@ -1233,6 +1233,7 @@ static void vmw_master_drop(struct drm_device *dev,
 
         vmw_fp->locked_master = drm_master_get(file_priv->master);
         ret = ttm_vt_lock(&vmaster->lock, false, vmw_fp->tfile);
+        vmw_kms_legacy_hotspot_clear(dev_priv);
         if (unlikely((ret != 0))) {
                 DRM_ERROR("Unable to lock TTM at VT switch.\n");
                 drm_master_put(&vmw_fp->locked_master);
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
index a8ae9dfb83b7..469cdd520615 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
@@ -925,6 +925,7 @@ int vmw_kms_present(struct vmw_private *dev_priv,
                     uint32_t num_clips);
 int vmw_kms_update_layout_ioctl(struct drm_device *dev, void *data,
                                 struct drm_file *file_priv);
+void vmw_kms_legacy_hotspot_clear(struct vmw_private *dev_priv);
 
 int vmw_dumb_create(struct drm_file *file_priv,
                     struct drm_device *dev,
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
index a8baf5f5e765..b6a0806b06bf 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
@@ -390,7 +390,7 @@ void *vmw_fifo_reserve_dx(struct vmw_private *dev_priv, uint32_t bytes,
         else if (ctx_id == SVGA3D_INVALID_ID)
                 ret = vmw_local_fifo_reserve(dev_priv, bytes);
         else {
-                WARN_ON("Command buffer has not been allocated.\n");
+                WARN(1, "Command buffer has not been allocated.\n");
                 ret = NULL;
         }
         if (IS_ERR_OR_NULL(ret)) {
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
index 9fcd7f82995c..9b4bb9e74d73 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
@@ -133,13 +133,19 @@ void vmw_cursor_update_position(struct vmw_private *dev_priv,
         vmw_mmio_write(++count, fifo_mem + SVGA_FIFO_CURSOR_COUNT);
 }
 
-int vmw_du_crtc_cursor_set(struct drm_crtc *crtc, struct drm_file *file_priv,
-                           uint32_t handle, uint32_t width, uint32_t height)
+
+/*
+ * vmw_du_crtc_cursor_set2 - Driver cursor_set2 callback.
+ */
+int vmw_du_crtc_cursor_set2(struct drm_crtc *crtc, struct drm_file *file_priv,
+                            uint32_t handle, uint32_t width, uint32_t height,
+                            int32_t hot_x, int32_t hot_y)
 {
         struct vmw_private *dev_priv = vmw_priv(crtc->dev);
         struct vmw_display_unit *du = vmw_crtc_to_du(crtc);
         struct vmw_surface *surface = NULL;
         struct vmw_dma_buffer *dmabuf = NULL;
+        s32 hotspot_x, hotspot_y;
         int ret;
 
         /*
@@ -151,6 +157,8 @@ int vmw_du_crtc_cursor_set(struct drm_crtc *crtc, struct drm_file *file_priv,
          */
         drm_modeset_unlock_crtc(crtc);
         drm_modeset_lock_all(dev_priv->dev);
+        hotspot_x = hot_x + du->hotspot_x;
+        hotspot_y = hot_y + du->hotspot_y;
 
         /* A lot of the code assumes this */
         if (handle && (width != 64 || height != 64)) {
@@ -187,31 +195,34 @@ int vmw_du_crtc_cursor_set(struct drm_crtc *crtc, struct drm_file *file_priv,
                 vmw_dmabuf_unreference(&du->cursor_dmabuf);
 
         /* setup new image */
+        ret = 0;
         if (surface) {
                 /* vmw_user_surface_lookup takes one reference */
                 du->cursor_surface = surface;
 
                 du->cursor_surface->snooper.crtc = crtc;
                 du->cursor_age = du->cursor_surface->snooper.age;
-                vmw_cursor_update_image(dev_priv, surface->snooper.image,
-                                        64, 64, du->hotspot_x, du->hotspot_y);
+                ret = vmw_cursor_update_image(dev_priv, surface->snooper.image,
+                                              64, 64, hotspot_x, hotspot_y);
         } else if (dmabuf) {
                 /* vmw_user_surface_lookup takes one reference */
                 du->cursor_dmabuf = dmabuf;
 
                 ret = vmw_cursor_update_dmabuf(dev_priv, dmabuf, width, height,
-                                               du->hotspot_x, du->hotspot_y);
+                                               hotspot_x, hotspot_y);
         } else {
                 vmw_cursor_update_position(dev_priv, false, 0, 0);
-                ret = 0;
                 goto out;
         }
 
-        vmw_cursor_update_position(dev_priv, true,
-                                   du->cursor_x + du->hotspot_x,
-                                   du->cursor_y + du->hotspot_y);
+        if (!ret) {
+                vmw_cursor_update_position(dev_priv, true,
+                                           du->cursor_x + hotspot_x,
+                                           du->cursor_y + hotspot_y);
+                du->core_hotspot_x = hot_x;
+                du->core_hotspot_y = hot_y;
+        }
 
-        ret = 0;
 out:
         drm_modeset_unlock_all(dev_priv->dev);
         drm_modeset_lock_crtc(crtc, crtc->cursor);
@@ -239,8 +250,10 @@ int vmw_du_crtc_cursor_move(struct drm_crtc *crtc, int x, int y)
         drm_modeset_lock_all(dev_priv->dev);
 
         vmw_cursor_update_position(dev_priv, shown,
-                                   du->cursor_x + du->hotspot_x,
-                                   du->cursor_y + du->hotspot_y);
+                                   du->cursor_x + du->hotspot_x +
+                                   du->core_hotspot_x,
+                                   du->cursor_y + du->hotspot_y +
+                                   du->core_hotspot_y);
 
         drm_modeset_unlock_all(dev_priv->dev);
         drm_modeset_lock_crtc(crtc, crtc->cursor);
@@ -334,6 +347,29 @@ err_unreserve:
         ttm_bo_unreserve(bo);
 }
 
+/**
+ * vmw_kms_legacy_hotspot_clear - Clear legacy hotspots
+ *
+ * @dev_priv: Pointer to the device private struct.
+ *
+ * Clears all legacy hotspots.
+ */
+void vmw_kms_legacy_hotspot_clear(struct vmw_private *dev_priv)
+{
+        struct drm_device *dev = dev_priv->dev;
+        struct vmw_display_unit *du;
+        struct drm_crtc *crtc;
+
+        drm_modeset_lock_all(dev);
+        drm_for_each_crtc(crtc, dev) {
+                du = vmw_crtc_to_du(crtc);
+
+                du->hotspot_x = 0;
+                du->hotspot_y = 0;
+        }
+        drm_modeset_unlock_all(dev);
+}
+
 void vmw_kms_cursor_post_execbuf(struct vmw_private *dev_priv)
 {
         struct drm_device *dev = dev_priv->dev;
@@ -351,7 +387,9 @@ void vmw_kms_cursor_post_execbuf(struct vmw_private *dev_priv)
                 du->cursor_age = du->cursor_surface->snooper.age;
                 vmw_cursor_update_image(dev_priv,
                                         du->cursor_surface->snooper.image,
-                                        64, 64, du->hotspot_x, du->hotspot_y);
+                                        64, 64,
+                                        du->hotspot_x + du->core_hotspot_x,
+                                        du->hotspot_y + du->core_hotspot_y);
         }
 
         mutex_unlock(&dev->mode_config.mutex);
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.h b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.h
index 782df7ca9794..edd81503516d 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.h
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.h
@@ -159,6 +159,8 @@ struct vmw_display_unit {
 
         int hotspot_x;
         int hotspot_y;
+        s32 core_hotspot_x;
+        s32 core_hotspot_y;
 
         unsigned unit;
 
@@ -193,8 +195,9 @@ void vmw_du_crtc_restore(struct drm_crtc *crtc);
 void vmw_du_crtc_gamma_set(struct drm_crtc *crtc,
                            u16 *r, u16 *g, u16 *b,
                            uint32_t start, uint32_t size);
-int vmw_du_crtc_cursor_set(struct drm_crtc *crtc, struct drm_file *file_priv,
-                           uint32_t handle, uint32_t width, uint32_t height);
+int vmw_du_crtc_cursor_set2(struct drm_crtc *crtc, struct drm_file *file_priv,
+                            uint32_t handle, uint32_t width, uint32_t height,
+                            int32_t hot_x, int32_t hot_y);
 int vmw_du_crtc_cursor_move(struct drm_crtc *crtc, int x, int y);
 int vmw_du_connector_dpms(struct drm_connector *connector, int mode);
 void vmw_du_connector_save(struct drm_connector *connector);
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c b/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c
index bb63e4d795fa..52caecb4502e 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c
@@ -297,7 +297,7 @@ static int vmw_ldu_crtc_set_config(struct drm_mode_set *set)
 static struct drm_crtc_funcs vmw_legacy_crtc_funcs = {
         .save = vmw_du_crtc_save,
         .restore = vmw_du_crtc_restore,
-        .cursor_set = vmw_du_crtc_cursor_set,
+        .cursor_set2 = vmw_du_crtc_cursor_set2,
         .cursor_move = vmw_du_crtc_cursor_move,
         .gamma_set = vmw_du_crtc_gamma_set,
         .destroy = vmw_ldu_crtc_destroy,
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c b/drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c
index b96d1ab610c5..13926ff192e3 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c
@@ -533,7 +533,7 @@ out_no_fence:
 static struct drm_crtc_funcs vmw_screen_object_crtc_funcs = {
         .save = vmw_du_crtc_save,
         .restore = vmw_du_crtc_restore,
-        .cursor_set = vmw_du_crtc_cursor_set,
+        .cursor_set2 = vmw_du_crtc_cursor_set2,
         .cursor_move = vmw_du_crtc_cursor_move,
         .gamma_set = vmw_du_crtc_gamma_set,
         .destroy = vmw_sou_crtc_destroy,
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c b/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c
index b1fc1c02792d..f823fc3efed7 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c
@@ -1043,7 +1043,7 @@ out_finish:
 static struct drm_crtc_funcs vmw_stdu_crtc_funcs = {
         .save = vmw_du_crtc_save,
         .restore = vmw_du_crtc_restore,
-        .cursor_set = vmw_du_crtc_cursor_set,
+        .cursor_set2 = vmw_du_crtc_cursor_set2,
         .cursor_move = vmw_du_crtc_cursor_move,
         .gamma_set = vmw_du_crtc_gamma_set,
         .destroy = vmw_stdu_crtc_destroy,
diff --git a/drivers/gpu/ipu-v3/ipu-common.c b/drivers/gpu/ipu-v3/ipu-common.c
index ba47b30d28fa..f2e13eb8339f 100644
--- a/drivers/gpu/ipu-v3/ipu-common.c
+++ b/drivers/gpu/ipu-v3/ipu-common.c
@@ -28,6 +28,7 @@
 #include <linux/irqchip/chained_irq.h>
 #include <linux/irqdomain.h>
 #include <linux/of_device.h>
+#include <linux/of_graph.h>
 
 #include <drm/drm_fourcc.h>
 
@@ -993,12 +994,26 @@ static void platform_device_unregister_children(struct platform_device *pdev)
 struct ipu_platform_reg {
         struct ipu_client_platformdata pdata;
         const char *name;
-        int reg_offset;
 };
 
+/* These must be in the order of the corresponding device tree port nodes */
 static const struct ipu_platform_reg client_reg[] = {
         {
                 .pdata = {
+                        .csi = 0,
+                        .dma[0] = IPUV3_CHANNEL_CSI0,
+                        .dma[1] = -EINVAL,
+                },
+                .name = "imx-ipuv3-camera",
+        }, {
+                .pdata = {
+                        .csi = 1,
+                        .dma[0] = IPUV3_CHANNEL_CSI1,
+                        .dma[1] = -EINVAL,
+                },
+                .name = "imx-ipuv3-camera",
+        }, {
+                .pdata = {
                         .di = 0,
                         .dc = 5,
                         .dp = IPU_DP_FLOW_SYNC_BG,
@@ -1015,22 +1030,6 @@ static const struct ipu_platform_reg client_reg[] = {
                         .dma[1] = -EINVAL,
                 },
                 .name = "imx-ipuv3-crtc",
-        }, {
-                .pdata = {
-                        .csi = 0,
-                        .dma[0] = IPUV3_CHANNEL_CSI0,
-                        .dma[1] = -EINVAL,
-                },
-                .reg_offset = IPU_CM_CSI0_REG_OFS,
-                .name = "imx-ipuv3-camera",
-        }, {
-                .pdata = {
-                        .csi = 1,
-                        .dma[0] = IPUV3_CHANNEL_CSI1,
-                        .dma[1] = -EINVAL,
-                },
-                .reg_offset = IPU_CM_CSI1_REG_OFS,
-                .name = "imx-ipuv3-camera",
         },
 };
 
@@ -1051,22 +1050,30 @@ static int ipu_add_client_devices(struct ipu_soc *ipu, unsigned long ipu_base)
         for (i = 0; i < ARRAY_SIZE(client_reg); i++) {
                 const struct ipu_platform_reg *reg = &client_reg[i];
                 struct platform_device *pdev;
-                struct resource res;
-
-                if (reg->reg_offset) {
-                        memset(&res, 0, sizeof(res));
-                        res.flags = IORESOURCE_MEM;
-                        res.start = ipu_base + ipu->devtype->cm_ofs + reg->reg_offset;
-                        res.end = res.start + PAGE_SIZE - 1;
-                        pdev = platform_device_register_resndata(dev, reg->name,
-                                id++, &res, 1, &reg->pdata, sizeof(reg->pdata));
-                } else {
-                        pdev = platform_device_register_data(dev, reg->name,
-                                id++, &reg->pdata, sizeof(reg->pdata));
+
+                pdev = platform_device_alloc(reg->name, id++);
+                if (!pdev) {
+                        ret = -ENOMEM;
+                        goto err_register;
+                }
+
+                pdev->dev.parent = dev;
+
+                /* Associate subdevice with the corresponding port node */
+                pdev->dev.of_node = of_graph_get_port_by_id(dev->of_node, i);
+                if (!pdev->dev.of_node) {
+                        dev_err(dev, "missing port@%d node in %s\n", i,
+                                dev->of_node->full_name);
+                        ret = -ENODEV;
+                        goto err_register;
                 }
 
-                if (IS_ERR(pdev)) {
-                        ret = PTR_ERR(pdev);
+                ret = platform_device_add_data(pdev, &reg->pdata,
+                                               sizeof(reg->pdata));
+                if (!ret)
+                        ret = platform_device_add(pdev);
+                if (ret) {
+                        platform_device_put(pdev);
                         goto err_register;
                 }
         }
diff --git a/drivers/gpu/vga/vgaarb.c b/drivers/gpu/vga/vgaarb.c
index 3166e4bc4eb6..9abcaa53bd25 100644
--- a/drivers/gpu/vga/vgaarb.c
+++ b/drivers/gpu/vga/vgaarb.c
@@ -395,8 +395,10 @@ int vga_get(struct pci_dev *pdev, unsigned int rsrc, int interruptible)
                 set_current_state(interruptible ?
                                   TASK_INTERRUPTIBLE :
                                   TASK_UNINTERRUPTIBLE);
-                if (signal_pending(current)) {
-                        rc = -EINTR;
+                if (interruptible && signal_pending(current)) {
+                        __set_current_state(TASK_RUNNING);
+                        remove_wait_queue(&vga_wait_queue, &wait);
+                        rc = -ERESTARTSYS;
                         break;
                 }
                 schedule();
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index ac1feea51be3..8b78a7f1f779 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -316,11 +316,6 @@
 #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_A001       0xa001
 
 #define USB_VENDOR_ID_ELAN              0x04f3
-#define USB_DEVICE_ID_ELAN_TOUCHSCREEN  0x0089
-#define USB_DEVICE_ID_ELAN_TOUCHSCREEN_009B     0x009b
-#define USB_DEVICE_ID_ELAN_TOUCHSCREEN_0103     0x0103
-#define USB_DEVICE_ID_ELAN_TOUCHSCREEN_010c     0x010c
-#define USB_DEVICE_ID_ELAN_TOUCHSCREEN_016F     0x016f
 
 #define USB_VENDOR_ID_ELECOM            0x056e
 #define USB_DEVICE_ID_ELECOM_BM084      0x0061
@@ -609,6 +604,7 @@
 #define USB_DEVICE_ID_LOGITECH_HARMONY_FIRST  0xc110
 #define USB_DEVICE_ID_LOGITECH_HARMONY_LAST 0xc14f
 #define USB_DEVICE_ID_LOGITECH_HARMONY_PS3 0x0306
+#define USB_DEVICE_ID_LOGITECH_KEYBOARD_G710_PLUS 0xc24d
 #define USB_DEVICE_ID_LOGITECH_MOUSE_C01A       0xc01a
 #define USB_DEVICE_ID_LOGITECH_MOUSE_C05A       0xc05a
 #define USB_DEVICE_ID_LOGITECH_MOUSE_C06A       0xc06a
diff --git a/drivers/hid/hid-lg.c b/drivers/hid/hid-lg.c
index c20ac76c0a8c..c690fae02cf8 100644
--- a/drivers/hid/hid-lg.c
+++ b/drivers/hid/hid-lg.c
@@ -665,8 +665,9 @@ static int lg_probe(struct hid_device *hdev, const struct hid_device_id *id)
         struct lg_drv_data *drv_data;
         int ret;
 
-        /* Only work with the 1st interface (G29 presents multiple) */
-        if (iface_num != 0) {
+        /* G29 only work with the 1st interface */
+        if ((hdev->product == USB_DEVICE_ID_LOGITECH_G29_WHEEL) &&
+            (iface_num != 0)) {
                 dbg_hid("%s: ignoring ifnum %d\n", __func__, iface_num);
                 return -ENODEV;
         }
diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
index 94bb137abe32..7dd0953cd70f 100644
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -72,11 +72,7 @@ static const struct hid_blacklist {
         { USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_PIXART_USB_OPTICAL_MOUSE, HID_QUIRK_ALWAYS_POLL },
         { USB_VENDOR_ID_DMI, USB_DEVICE_ID_DMI_ENC, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_WIIU, HID_QUIRK_MULTI_INPUT },
-        { USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ELAN_TOUCHSCREEN, HID_QUIRK_ALWAYS_POLL },
-        { USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ELAN_TOUCHSCREEN_009B, HID_QUIRK_ALWAYS_POLL },
-        { USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ELAN_TOUCHSCREEN_0103, HID_QUIRK_ALWAYS_POLL },
-        { USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ELAN_TOUCHSCREEN_010c, HID_QUIRK_ALWAYS_POLL },
-        { USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ELAN_TOUCHSCREEN_016F, HID_QUIRK_ALWAYS_POLL },
+        { USB_VENDOR_ID_ELAN, HID_ANY_ID, HID_QUIRK_ALWAYS_POLL },
         { USB_VENDOR_ID_ELO, USB_DEVICE_ID_ELO_TS2700, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_FORMOSA, USB_DEVICE_ID_FORMOSA_IR_RECEIVER, HID_QUIRK_NO_INIT_REPORTS },
         { USB_VENDOR_ID_FREESCALE, USB_DEVICE_ID_FREESCALE_MX28, HID_QUIRK_NOGET },
@@ -84,6 +80,7 @@ static const struct hid_blacklist {
         { USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_LOGITECH_OEM_USB_OPTICAL_MOUSE_0B4A, HID_QUIRK_ALWAYS_POLL },
         { USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE, HID_QUIRK_ALWAYS_POLL },
         { USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_C077, HID_QUIRK_ALWAYS_POLL },
+        { USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_KEYBOARD_G710_PLUS, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_MOUSE_C01A, HID_QUIRK_ALWAYS_POLL },
         { USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_MOUSE_C05A, HID_QUIRK_ALWAYS_POLL },
         { USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_MOUSE_C06A, HID_QUIRK_ALWAYS_POLL },
@@ -339,7 +336,8 @@ static const struct hid_blacklist *usbhid_exists_squirk(const u16 idVendor,
 
         for (; hid_blacklist[n].idVendor; n++)
                 if (hid_blacklist[n].idVendor == idVendor &&
-                                hid_blacklist[n].idProduct == idProduct)
+                        (hid_blacklist[n].idProduct == (__u16) HID_ANY_ID ||
+                                hid_blacklist[n].idProduct == idProduct))
                         bl_entry = &hid_blacklist[n];
 
         if (bl_entry != NULL)
diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig
index 8f59f057cdf4..80a73bfc1a65 100644
--- a/drivers/hwmon/Kconfig
+++ b/drivers/hwmon/Kconfig
@@ -1217,6 +1217,7 @@ config SENSORS_PWM_FAN
 config SENSORS_SHT15
         tristate "Sensiron humidity and temperature sensors. SHT15 and compat."
         depends on GPIOLIB || COMPILE_TEST
+        select BITREVERSE
         help
           If you say yes here you get support for the Sensiron SHT10, SHT11,
           SHT15, SHT71, SHT75 humidity and temperature sensors.
diff --git a/drivers/hwmon/tmp102.c b/drivers/hwmon/tmp102.c
index 65482624ea2c..5289aa0980a8 100644
--- a/drivers/hwmon/tmp102.c
+++ b/drivers/hwmon/tmp102.c
@@ -58,6 +58,7 @@ struct tmp102 {
         u16 config_orig;
         unsigned long last_update;
         int temp[3];
+        bool first_time;
 };
 
 /* convert left adjusted 13-bit TMP102 register value to milliCelsius */
@@ -93,6 +94,7 @@ static struct tmp102 *tmp102_update_device(struct device *dev)
                                 tmp102->temp[i] = tmp102_reg_to_mC(status);
                 }
                 tmp102->last_update = jiffies;
+                tmp102->first_time = false;
         }
         mutex_unlock(&tmp102->lock);
         return tmp102;
@@ -102,6 +104,12 @@ static int tmp102_read_temp(void *dev, int *temp)
 {
         struct tmp102 *tmp102 = tmp102_update_device(dev);
 
+        /* Is it too early even to return a conversion? */
+        if (tmp102->first_time) {
+                dev_dbg(dev, "%s: Conversion not ready yet..\n", __func__);
+                return -EAGAIN;
+        }
+
         *temp = tmp102->temp[0];
 
         return 0;
@@ -114,6 +122,10 @@ static ssize_t tmp102_show_temp(struct device *dev,
         struct sensor_device_attribute *sda = to_sensor_dev_attr(attr);
         struct tmp102 *tmp102 = tmp102_update_device(dev);
 
+        /* Is it too early even to return a read? */
+        if (tmp102->first_time)
+                return -EAGAIN;
+
         return sprintf(buf, "%d\n", tmp102->temp[sda->index]);
 }
 
@@ -207,7 +219,9 @@ static int tmp102_probe(struct i2c_client *client,
                 status = -ENODEV;
                 goto fail_restore_config;
         }
-        tmp102->last_update = jiffies - HZ;
+        tmp102->last_update = jiffies;
+        /* Mark that we are not ready with data until conversion is complete */
+        tmp102->first_time = true;
         mutex_init(&tmp102->lock);
 
         hwmon_dev = hwmon_device_register_with_groups(dev, client->name,
diff --git a/drivers/i2c/busses/i2c-davinci.c b/drivers/i2c/busses/i2c-davinci.c
index c5628a42170a..a8bdcb5292f5 100644
--- a/drivers/i2c/busses/i2c-davinci.c
+++ b/drivers/i2c/busses/i2c-davinci.c
@@ -202,8 +202,15 @@ static void i2c_davinci_calc_clk_dividers(struct davinci_i2c_dev *dev)
          * d is always 6 on Keystone I2C controller
          */
 
-        /* get minimum of 7 MHz clock, but max of 12 MHz */
-        psc = (input_clock / 7000000) - 1;
+        /*
+         * Both Davinci and current Keystone User Guides recommend a value
+         * between 7MHz and 12MHz. In reality 7MHz module clock doesn't
+         * always produce enough margin between SDA and SCL transitions.
+         * Measurements show that the higher the module clock is, the
+         * bigger is the margin, providing more reliable communication.
+         * So we better target for 12MHz.
+         */
+        psc = (input_clock / 12000000) - 1;
         if ((input_clock / (psc + 1)) > 12000000)
                 psc++;  /* better to run under spec than over */
         d = (psc >= 2) ? 5 : 7 - psc;
diff --git a/drivers/i2c/busses/i2c-designware-core.c b/drivers/i2c/busses/i2c-designware-core.c
index 8c48b27ba059..de7fbbb374cd 100644
--- a/drivers/i2c/busses/i2c-designware-core.c
+++ b/drivers/i2c/busses/i2c-designware-core.c
@@ -813,6 +813,12 @@ static irqreturn_t i2c_dw_isr(int this_irq, void *dev_id)
 tx_aborted:
         if ((stat & (DW_IC_INTR_TX_ABRT | DW_IC_INTR_STOP_DET)) || dev->msg_err)
                 complete(&dev->cmd_complete);
+        else if (unlikely(dev->accessor_flags & ACCESS_INTR_MASK)) {
+                /* workaround to trigger pending interrupt */
+                stat = dw_readl(dev, DW_IC_INTR_MASK);
+                i2c_dw_disable_int(dev);
+                dw_writel(dev, stat, DW_IC_INTR_MASK);
+        }
 
         return IRQ_HANDLED;
 }
diff --git a/drivers/i2c/busses/i2c-designware-core.h b/drivers/i2c/busses/i2c-designware-core.h
index 1d50898e7b24..9ffb63a60f95 100644
--- a/drivers/i2c/busses/i2c-designware-core.h
+++ b/drivers/i2c/busses/i2c-designware-core.h
@@ -111,6 +111,7 @@ struct dw_i2c_dev {
 
 #define ACCESS_SWAP             0x00000001
 #define ACCESS_16BIT            0x00000002
+#define ACCESS_INTR_MASK        0x00000004
 
 extern int i2c_dw_init(struct dw_i2c_dev *dev);
 extern void i2c_dw_disable(struct dw_i2c_dev *dev);
diff --git a/drivers/i2c/busses/i2c-designware-platdrv.c b/drivers/i2c/busses/i2c-designware-platdrv.c
index 809579ecb5a4..6b00061c3746 100644
--- a/drivers/i2c/busses/i2c-designware-platdrv.c
+++ b/drivers/i2c/busses/i2c-designware-platdrv.c
@@ -93,6 +93,7 @@ static void dw_i2c_acpi_params(struct platform_device *pdev, char method[],
 static int dw_i2c_acpi_configure(struct platform_device *pdev)
 {
         struct dw_i2c_dev *dev = platform_get_drvdata(pdev);
+        const struct acpi_device_id *id;
 
         dev->adapter.nr = -1;
         dev->tx_fifo_depth = 32;
@@ -106,6 +107,10 @@ static int dw_i2c_acpi_configure(struct platform_device *pdev)
         dw_i2c_acpi_params(pdev, "FMCN", &dev->fs_hcnt, &dev->fs_lcnt,
                            &dev->sda_hold_time);
 
+        id = acpi_match_device(pdev->dev.driver->acpi_match_table, &pdev->dev);
+        if (id && id->driver_data)
+                dev->accessor_flags |= (u32)id->driver_data;
+
         return 0;
 }
 
@@ -116,7 +121,7 @@ static const struct acpi_device_id dw_i2c_acpi_match[] = {
         { "INT3433", 0 },
         { "80860F41", 0 },
         { "808622C1", 0 },
-        { "AMD0010", 0 },
+        { "AMD0010", ACCESS_INTR_MASK },
         { }
 };
 MODULE_DEVICE_TABLE(acpi, dw_i2c_acpi_match);
@@ -240,12 +245,10 @@ static int dw_i2c_plat_probe(struct platform_device *pdev)
         }
 
         r = i2c_dw_probe(dev);
-        if (r) {
+        if (r && !dev->pm_runtime_disabled)
                 pm_runtime_disable(&pdev->dev);
-                return r;
-        }
 
-        return 0;
+        return r;
 }
 
 static int dw_i2c_plat_remove(struct platform_device *pdev)
@@ -260,7 +263,8 @@ static int dw_i2c_plat_remove(struct platform_device *pdev)
 
         pm_runtime_dont_use_autosuspend(&pdev->dev);
         pm_runtime_put_sync(&pdev->dev);
-        pm_runtime_disable(&pdev->dev);
+        if (!dev->pm_runtime_disabled)
+                pm_runtime_disable(&pdev->dev);
 
         return 0;
 }
diff --git a/drivers/i2c/busses/i2c-imx.c b/drivers/i2c/busses/i2c-imx.c
index 9bb0b056b25f..d4d853680ae4 100644
--- a/drivers/i2c/busses/i2c-imx.c
+++ b/drivers/i2c/busses/i2c-imx.c
@@ -1119,6 +1119,8 @@ static int i2c_imx_probe(struct platform_device *pdev)
                         i2c_imx, IMX_I2C_I2CR);
         imx_i2c_write_reg(i2c_imx->hwdata->i2sr_clr_opcode, i2c_imx, IMX_I2C_I2SR);
 
+        i2c_imx_init_recovery_info(i2c_imx, pdev);
+
         /* Add I2C adapter */
         ret = i2c_add_numbered_adapter(&i2c_imx->adapter);
         if (ret < 0) {
@@ -1126,8 +1128,6 @@ static int i2c_imx_probe(struct platform_device *pdev)
                 goto clk_disable;
         }
 
-        i2c_imx_init_recovery_info(i2c_imx, pdev);
-
         /* Set up platform driver data */
         platform_set_drvdata(pdev, i2c_imx);
         clk_disable_unprepare(i2c_imx->clk);
diff --git a/drivers/i2c/busses/i2c-mv64xxx.c b/drivers/i2c/busses/i2c-mv64xxx.c
index 5801227b97ab..43207f52e5a3 100644
--- a/drivers/i2c/busses/i2c-mv64xxx.c
+++ b/drivers/i2c/busses/i2c-mv64xxx.c
@@ -146,6 +146,8 @@ struct mv64xxx_i2c_data {
         bool                    errata_delay;
         struct reset_control    *rstc;
         bool                    irq_clear_inverted;
+        /* Clk div is 2 to the power n, not 2 to the power n + 1 */
+        bool                    clk_n_base_0;
 };
 
 static struct mv64xxx_i2c_regs mv64xxx_i2c_regs_mv64xxx = {
@@ -757,25 +759,29 @@ MODULE_DEVICE_TABLE(of, mv64xxx_i2c_of_match_table);
 #ifdef CONFIG_OF
 #ifdef CONFIG_HAVE_CLK
 static int
-mv64xxx_calc_freq(const int tclk, const int n, const int m)
+mv64xxx_calc_freq(struct mv64xxx_i2c_data *drv_data,
+                  const int tclk, const int n, const int m)
 {
-        return tclk / (10 * (m + 1) * (2 << n));
+        if (drv_data->clk_n_base_0)
+                return tclk / (10 * (m + 1) * (1 << n));
+        else
+                return tclk / (10 * (m + 1) * (2 << n));
 }
 
 static bool
-mv64xxx_find_baud_factors(const u32 req_freq, const u32 tclk, u32 *best_n,
-                          u32 *best_m)
+mv64xxx_find_baud_factors(struct mv64xxx_i2c_data *drv_data,
+                          const u32 req_freq, const u32 tclk)
 {
         int freq, delta, best_delta = INT_MAX;
         int m, n;
 
         for (n = 0; n <= 7; n++)
                 for (m = 0; m <= 15; m++) {
-                        freq = mv64xxx_calc_freq(tclk, n, m);
+                        freq = mv64xxx_calc_freq(drv_data, tclk, n, m);
                         delta = req_freq - freq;
                         if (delta >= 0 && delta < best_delta) {
-                                *best_m = m;
-                                *best_n = n;
+                                drv_data->freq_m = m;
+                                drv_data->freq_n = n;
                                 best_delta = delta;
                         }
                         if (best_delta == 0)
@@ -813,8 +819,11 @@ mv64xxx_of_config(struct mv64xxx_i2c_data *drv_data,
         if (of_property_read_u32(np, "clock-frequency", &bus_freq))
                 bus_freq = 100000; /* 100kHz by default */
 
-        if (!mv64xxx_find_baud_factors(bus_freq, tclk,
-                                       &drv_data->freq_n, &drv_data->freq_m)) {
+        if (of_device_is_compatible(np, "allwinner,sun4i-a10-i2c") ||
+            of_device_is_compatible(np, "allwinner,sun6i-a31-i2c"))
+                drv_data->clk_n_base_0 = true;
+
+        if (!mv64xxx_find_baud_factors(drv_data, bus_freq, tclk)) {
                 rc = -EINVAL;
                 goto out;
         }
diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c
index b0ae560b38c3..599c0d7bd906 100644
--- a/drivers/i2c/busses/i2c-rcar.c
+++ b/drivers/i2c/busses/i2c-rcar.c
@@ -576,7 +576,7 @@ static int rcar_reg_slave(struct i2c_client *slave)
         if (slave->flags & I2C_CLIENT_TEN)
                 return -EAFNOSUPPORT;
 
-        pm_runtime_forbid(rcar_i2c_priv_to_dev(priv));
+        pm_runtime_get_sync(rcar_i2c_priv_to_dev(priv));
 
         priv->slave = slave;
         rcar_i2c_write(priv, ICSAR, slave->addr);
@@ -598,7 +598,7 @@ static int rcar_unreg_slave(struct i2c_client *slave)
 
         priv->slave = NULL;
 
-        pm_runtime_allow(rcar_i2c_priv_to_dev(priv));
+        pm_runtime_put(rcar_i2c_priv_to_dev(priv));
 
         return 0;
 }
diff --git a/drivers/i2c/busses/i2c-rk3x.c b/drivers/i2c/busses/i2c-rk3x.c
index c1935ebd6a9c..9096d17beb5b 100644
--- a/drivers/i2c/busses/i2c-rk3x.c
+++ b/drivers/i2c/busses/i2c-rk3x.c
@@ -908,7 +908,7 @@ static int rk3x_i2c_probe(struct platform_device *pdev)
                                  &i2c->scl_fall_ns))
                 i2c->scl_fall_ns = 300;
         if (of_property_read_u32(pdev->dev.of_node, "i2c-sda-falling-time-ns",
-                                 &i2c->scl_fall_ns))
+                                 &i2c->sda_fall_ns))
                 i2c->sda_fall_ns = i2c->scl_fall_ns;
 
         strlcpy(i2c->adap.name, "rk3x-i2c", sizeof(i2c->adap.name));
diff --git a/drivers/i2c/busses/i2c-st.c b/drivers/i2c/busses/i2c-st.c
index ea72dca32fdf..25020ec777c9 100644
--- a/drivers/i2c/busses/i2c-st.c
+++ b/drivers/i2c/busses/i2c-st.c
@@ -822,7 +822,7 @@ static int st_i2c_probe(struct platform_device *pdev)
 
         adap = &i2c_dev->adap;
         i2c_set_adapdata(adap, i2c_dev);
-        snprintf(adap->name, sizeof(adap->name), "ST I2C(0x%pa)", &res->start);
+        snprintf(adap->name, sizeof(adap->name), "ST I2C(%pa)", &res->start);
         adap->owner = THIS_MODULE;
         adap->timeout = 2 * HZ;
         adap->retries = 0;
diff --git a/drivers/iio/adc/qcom-spmi-vadc.c b/drivers/iio/adc/qcom-spmi-vadc.c
index 0c4618b4d515..c2babe50a0d8 100644
--- a/drivers/iio/adc/qcom-spmi-vadc.c
+++ b/drivers/iio/adc/qcom-spmi-vadc.c
@@ -839,8 +839,10 @@ static int vadc_get_dt_data(struct vadc_priv *vadc, struct device_node *node)
 
         for_each_available_child_of_node(node, child) {
                 ret = vadc_get_dt_channel_data(vadc->dev, &prop, child);
-                if (ret)
+                if (ret) {
+                        of_node_put(child);
                         return ret;
+                }
 
                 vadc->chan_props[index] = prop;
 
diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio-buffer.c
index d7e908acb480..0f6f63b20263 100644
--- a/drivers/iio/industrialio-buffer.c
+++ b/drivers/iio/industrialio-buffer.c
@@ -302,7 +302,7 @@ static int iio_scan_mask_set(struct iio_dev *indio_dev,
         if (trialmask == NULL)
                 return -ENOMEM;
         if (!indio_dev->masklength) {
-                WARN_ON("Trying to set scanmask prior to registering buffer\n");
+                WARN(1, "Trying to set scanmask prior to registering buffer\n");
                 goto err_invalid_mask;
         }
         bitmap_copy(trialmask, buffer->scan_mask, indio_dev->masklength);
diff --git a/drivers/iio/industrialio-core.c b/drivers/iio/industrialio-core.c
index 208358f9e7e3..159ede61f793 100644
--- a/drivers/iio/industrialio-core.c
+++ b/drivers/iio/industrialio-core.c
@@ -655,7 +655,7 @@ int __iio_device_attr_init(struct device_attribute *dev_attr,
                         break;
                 case IIO_SEPARATE:
                         if (!chan->indexed) {
-                                WARN_ON("Differential channels must be indexed\n");
+                                WARN(1, "Differential channels must be indexed\n");
                                 ret = -EINVAL;
                                 goto error_free_full_postfix;
                         }
diff --git a/drivers/iio/light/apds9960.c b/drivers/iio/light/apds9960.c
index 7d269ef9e062..f6a07dc32ae4 100644
--- a/drivers/iio/light/apds9960.c
+++ b/drivers/iio/light/apds9960.c
@@ -453,6 +453,7 @@ static int apds9960_set_power_state(struct apds9960_data *data, bool on)
                         usleep_range(data->als_adc_int_us,
                                      APDS9960_MAX_INT_TIME_IN_US);
         } else {
+                pm_runtime_mark_last_busy(dev);
                 ret = pm_runtime_put_autosuspend(dev);
         }
 
diff --git a/drivers/iio/proximity/pulsedlight-lidar-lite-v2.c b/drivers/iio/proximity/pulsedlight-lidar-lite-v2.c
index 961f9f990faf..e544fcfd5ced 100644
--- a/drivers/iio/proximity/pulsedlight-lidar-lite-v2.c
+++ b/drivers/iio/proximity/pulsedlight-lidar-lite-v2.c
@@ -130,10 +130,10 @@ static int lidar_get_measurement(struct lidar_data *data, u16 *reg)
                 if (ret < 0)
                         break;
 
-                /* return 0 since laser is likely pointed out of range */
+                /* return -EINVAL since laser is likely pointed out of range */
                 if (ret & LIDAR_REG_STATUS_INVALID) {
                         *reg = 0;
-                        ret = 0;
+                        ret = -EINVAL;
                         break;
                 }
 
@@ -197,7 +197,7 @@ static irqreturn_t lidar_trigger_handler(int irq, void *private)
         if (!ret) {
                 iio_push_to_buffers_with_timestamp(indio_dev, data->buffer,
                                                    iio_get_time_ns());
-        } else {
+        } else if (ret != -EINVAL) {
                 dev_err(&data->client->dev, "cannot read LIDAR measurement");
         }
 
diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index 944cd90417bc..2d762a2ecd81 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -1126,10 +1126,7 @@ static bool validate_ipv4_net_dev(struct net_device *net_dev,
 
         rcu_read_lock();
         err = fib_lookup(dev_net(net_dev), &fl4, &res, 0);
-        if (err)
-                return false;
-
-        ret = FIB_RES_DEV(res) == net_dev;
+        ret = err == 0 && FIB_RES_DEV(res) == net_dev;
         rcu_read_unlock();
 
         return ret;
@@ -1268,15 +1265,17 @@ static bool cma_protocol_roce(const struct rdma_cm_id *id)
         return cma_protocol_roce_dev_port(device, port_num);
 }
 
-static bool cma_match_net_dev(const struct rdma_id_private *id_priv,
-                              const struct net_device *net_dev)
+static bool cma_match_net_dev(const struct rdma_cm_id *id,
+                              const struct net_device *net_dev,
+                              u8 port_num)
 {
-        const struct rdma_addr *addr = &id_priv->id.route.addr;
+        const struct rdma_addr *addr = &id->route.addr;
 
         if (!net_dev)
                 /* This request is an AF_IB request or a RoCE request */
-                return addr->src_addr.ss_family == AF_IB ||
-                       cma_protocol_roce(&id_priv->id);
+                return (!id->port_num || id->port_num == port_num) &&
+                       (addr->src_addr.ss_family == AF_IB ||
+                        cma_protocol_roce_dev_port(id->device, port_num));
 
         return !addr->dev_addr.bound_dev_if ||
                (net_eq(dev_net(net_dev), addr->dev_addr.net) &&
@@ -1298,13 +1297,13 @@ static struct rdma_id_private *cma_find_listener(
         hlist_for_each_entry(id_priv, &bind_list->owners, node) {
                 if (cma_match_private_data(id_priv, ib_event->private_data)) {
                         if (id_priv->id.device == cm_id->device &&
-                            cma_match_net_dev(id_priv, net_dev))
+                            cma_match_net_dev(&id_priv->id, net_dev, req->port))
                                 return id_priv;
                         list_for_each_entry(id_priv_dev,
                                             &id_priv->listen_list,
                                             listen_list) {
                                 if (id_priv_dev->id.device == cm_id->device &&
-                                    cma_match_net_dev(id_priv_dev, net_dev))
+                                    cma_match_net_dev(&id_priv_dev->id, net_dev, req->port))
                                         return id_priv_dev;
                         }
                 }
diff --git a/drivers/infiniband/core/mad.c b/drivers/infiniband/core/mad.c
index 8d8af7a41a30..2281de122038 100644
--- a/drivers/infiniband/core/mad.c
+++ b/drivers/infiniband/core/mad.c
@@ -1811,6 +1811,11 @@ static int validate_mad(const struct ib_mad_hdr *mad_hdr,
                 if (qp_num == 0)
                         valid = 1;
         } else {
+                /* CM attributes other than ClassPortInfo only use Send method */
+                if ((mad_hdr->mgmt_class == IB_MGMT_CLASS_CM) &&
+                    (mad_hdr->attr_id != IB_MGMT_CLASSPORTINFO_ATTR_ID) &&
+                    (mad_hdr->method != IB_MGMT_METHOD_SEND))
+                        goto out;
                 /* Filter GSI packets sent to QP0 */
                 if (qp_num != 0)
                         valid = 1;
diff --git a/drivers/infiniband/core/sa_query.c b/drivers/infiniband/core/sa_query.c
index 2aba774f835b..a95a32ba596e 100644
--- a/drivers/infiniband/core/sa_query.c
+++ b/drivers/infiniband/core/sa_query.c
@@ -512,7 +512,7 @@ static int ib_nl_get_path_rec_attrs_len(ib_sa_comp_mask comp_mask)
         return len;
 }
 
-static int ib_nl_send_msg(struct ib_sa_query *query)
+static int ib_nl_send_msg(struct ib_sa_query *query, gfp_t gfp_mask)
 {
         struct sk_buff *skb = NULL;
         struct nlmsghdr *nlh;
@@ -526,7 +526,7 @@ static int ib_nl_send_msg(struct ib_sa_query *query)
         if (len <= 0)
                 return -EMSGSIZE;
 
-        skb = nlmsg_new(len, GFP_KERNEL);
+        skb = nlmsg_new(len, gfp_mask);
         if (!skb)
                 return -ENOMEM;
 
@@ -544,7 +544,7 @@ static int ib_nl_send_msg(struct ib_sa_query *query)
         /* Repair the nlmsg header length */
         nlmsg_end(skb, nlh);
 
-        ret = ibnl_multicast(skb, nlh, RDMA_NL_GROUP_LS, GFP_KERNEL);
+        ret = ibnl_multicast(skb, nlh, RDMA_NL_GROUP_LS, gfp_mask);
         if (!ret)
                 ret = len;
         else
@@ -553,7 +553,7 @@ static int ib_nl_send_msg(struct ib_sa_query *query)
         return ret;
 }
 
-static int ib_nl_make_request(struct ib_sa_query *query)
+static int ib_nl_make_request(struct ib_sa_query *query, gfp_t gfp_mask)
 {
         unsigned long flags;
         unsigned long delay;
@@ -562,25 +562,27 @@ static int ib_nl_make_request(struct ib_sa_query *query)
         INIT_LIST_HEAD(&query->list);
         query->seq = (u32)atomic_inc_return(&ib_nl_sa_request_seq);
 
+        /* Put the request on the list first.*/
         spin_lock_irqsave(&ib_nl_request_lock, flags);
-        ret = ib_nl_send_msg(query);
-        if (ret <= 0) {
-                ret = -EIO;
-                goto request_out;
-        } else {
-                ret = 0;
-        }
-
         delay = msecs_to_jiffies(sa_local_svc_timeout_ms);
         query->timeout = delay + jiffies;
         list_add_tail(&query->list, &ib_nl_request_list);
         /* Start the timeout if this is the only request */
         if (ib_nl_request_list.next == &query->list)
                 queue_delayed_work(ib_nl_wq, &ib_nl_timed_work, delay);
-
-request_out:
         spin_unlock_irqrestore(&ib_nl_request_lock, flags);
 
+        ret = ib_nl_send_msg(query, gfp_mask);
+        if (ret <= 0) {
+                ret = -EIO;
+                /* Remove the request */
+                spin_lock_irqsave(&ib_nl_request_lock, flags);
+                list_del(&query->list);
+                spin_unlock_irqrestore(&ib_nl_request_lock, flags);
+        } else {
+                ret = 0;
+        }
+
         return ret;
 }
 
@@ -1108,7 +1110,7 @@ static int send_mad(struct ib_sa_query *query, int timeout_ms, gfp_t gfp_mask)
 
         if (query->flags & IB_SA_ENABLE_LOCAL_SERVICE) {
                 if (!ibnl_chk_listeners(RDMA_NL_GROUP_LS)) {
-                        if (!ib_nl_make_request(query))
+                        if (!ib_nl_make_request(query, gfp_mask))
                                 return id;
                 }
                 ib_sa_disable_local_svc(query);
diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
index 94816aeb95a0..1c02deab068f 100644
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -62,9 +62,11 @@ static struct uverbs_lock_class rule_lock_class = { .name = "RULE-uobj" };
  * The ib_uobject locking scheme is as follows:
  *
  * - ib_uverbs_idr_lock protects the uverbs idrs themselves, so it
- *   needs to be held during all idr operations.  When an object is
+ *   needs to be held during all idr write operations.  When an object is
  *   looked up, a reference must be taken on the object's kref before
- *   dropping this lock.
+ *   dropping this lock.  For read operations, the rcu_read_lock()
+ *   and rcu_write_lock() but similarly the kref reference is grabbed
+ *   before the rcu_read_unlock().
  *
  * - Each object also has an rwsem.  This rwsem must be held for
  *   reading while an operation that uses the object is performed.
@@ -96,7 +98,7 @@ static void init_uobj(struct ib_uobject *uobj, u64 user_handle,
 
 static void release_uobj(struct kref *kref)
 {
-        kfree(container_of(kref, struct ib_uobject, ref));
+        kfree_rcu(container_of(kref, struct ib_uobject, ref), rcu);
 }
 
 static void put_uobj(struct ib_uobject *uobj)
@@ -145,7 +147,7 @@ static struct ib_uobject *__idr_get_uobj(struct idr *idr, int id,
 {
         struct ib_uobject *uobj;
 
-        spin_lock(&ib_uverbs_idr_lock);
+        rcu_read_lock();
         uobj = idr_find(idr, id);
         if (uobj) {
                 if (uobj->context == context)
@@ -153,7 +155,7 @@ static struct ib_uobject *__idr_get_uobj(struct idr *idr, int id,
                 else
                         uobj = NULL;
         }
-        spin_unlock(&ib_uverbs_idr_lock);
+        rcu_read_unlock();
 
         return uobj;
 }
@@ -2446,6 +2448,7 @@ ssize_t ib_uverbs_post_send(struct ib_uverbs_file *file,
         int                             i, sg_ind;
         int                             is_ud;
         ssize_t                         ret = -EINVAL;
+        size_t                          next_size;
 
         if (copy_from_user(&cmd, buf, sizeof cmd))
                 return -EFAULT;
@@ -2490,7 +2493,8 @@ ssize_t ib_uverbs_post_send(struct ib_uverbs_file *file,
                                 goto out_put;
                         }
 
-                        ud = alloc_wr(sizeof(*ud), user_wr->num_sge);
+                        next_size = sizeof(*ud);
+                        ud = alloc_wr(next_size, user_wr->num_sge);
                         if (!ud) {
                                 ret = -ENOMEM;
                                 goto out_put;
@@ -2511,7 +2515,8 @@ ssize_t ib_uverbs_post_send(struct ib_uverbs_file *file,
                            user_wr->opcode == IB_WR_RDMA_READ) {
                         struct ib_rdma_wr *rdma;
 
-                        rdma = alloc_wr(sizeof(*rdma), user_wr->num_sge);
+                        next_size = sizeof(*rdma);
+                        rdma = alloc_wr(next_size, user_wr->num_sge);
                         if (!rdma) {
                                 ret = -ENOMEM;
                                 goto out_put;
@@ -2525,7 +2530,8 @@ ssize_t ib_uverbs_post_send(struct ib_uverbs_file *file,
                            user_wr->opcode == IB_WR_ATOMIC_FETCH_AND_ADD) {
                         struct ib_atomic_wr *atomic;
 
-                        atomic = alloc_wr(sizeof(*atomic), user_wr->num_sge);
+                        next_size = sizeof(*atomic);
+                        atomic = alloc_wr(next_size, user_wr->num_sge);
                         if (!atomic) {
                                 ret = -ENOMEM;
                                 goto out_put;
@@ -2540,7 +2546,8 @@ ssize_t ib_uverbs_post_send(struct ib_uverbs_file *file,
                 } else if (user_wr->opcode == IB_WR_SEND ||
                            user_wr->opcode == IB_WR_SEND_WITH_IMM ||
                            user_wr->opcode == IB_WR_SEND_WITH_INV) {
-                        next = alloc_wr(sizeof(*next), user_wr->num_sge);
+                        next_size = sizeof(*next);
+                        next = alloc_wr(next_size, user_wr->num_sge);
                         if (!next) {
                                 ret = -ENOMEM;
                                 goto out_put;
@@ -2572,7 +2579,7 @@ ssize_t ib_uverbs_post_send(struct ib_uverbs_file *file,
 
                 if (next->num_sge) {
                         next->sg_list = (void *) next +
-                                ALIGN(sizeof *next, sizeof (struct ib_sge));
+                                ALIGN(next_size, sizeof(struct ib_sge));
                         if (copy_from_user(next->sg_list,
                                            buf + sizeof cmd +
                                            cmd.wr_count * cmd.wqe_size +
diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c
index 043a60ee6836..545906dec26d 100644
--- a/drivers/infiniband/core/verbs.c
+++ b/drivers/infiniband/core/verbs.c
@@ -1516,7 +1516,7 @@ EXPORT_SYMBOL(ib_map_mr_sg);
  * @sg_nents:      number of entries in sg
  * @set_page:      driver page assignment function pointer
  *
- * Core service helper for drivers to covert the largest
+ * Core service helper for drivers to convert the largest
  * prefix of given sg list to a page vector. The sg list
  * prefix converted is the prefix that meet the requirements
  * of ib_map_mr_sg.
@@ -1533,7 +1533,7 @@ int ib_sg_to_pages(struct ib_mr *mr,
         u64 last_end_dma_addr = 0, last_page_addr = 0;
         unsigned int last_page_off = 0;
         u64 page_mask = ~((u64)mr->page_size - 1);
-        int i;
+        int i, ret;
 
         mr->iova = sg_dma_address(&sgl[0]);
         mr->length = 0;
@@ -1544,27 +1544,29 @@ int ib_sg_to_pages(struct ib_mr *mr,
                 u64 end_dma_addr = dma_addr + dma_len;
                 u64 page_addr = dma_addr & page_mask;
 
-                if (i && page_addr != dma_addr) {
-                        if (last_end_dma_addr != dma_addr) {
-                                /* gap */
-                                goto done;
-
-                        } else if (last_page_off + dma_len <= mr->page_size) {
-                                /* chunk this fragment with the last */
-                                mr->length += dma_len;
-                                last_end_dma_addr += dma_len;
-                                last_page_off += dma_len;
-                                continue;
-                        } else {
-                                /* map starting from the next page */
-                                page_addr = last_page_addr + mr->page_size;
-                                dma_len -= mr->page_size - last_page_off;
-                        }
+                /*
+                 * For the second and later elements, check whether either the
+                 * end of element i-1 or the start of element i is not aligned
+                 * on a page boundary.
+                 */
+                if (i && (last_page_off != 0 || page_addr != dma_addr)) {
+                        /* Stop mapping if there is a gap. */
+                        if (last_end_dma_addr != dma_addr)
+                                break;
+
+                        /*
+                         * Coalesce this element with the last. If it is small
+                         * enough just update mr->length. Otherwise start
+                         * mapping from the next page.
+                         */
+                        goto next_page;
                 }
 
                 do {
-                        if (unlikely(set_page(mr, page_addr)))
-                                goto done;
+                        ret = set_page(mr, page_addr);
+                        if (unlikely(ret < 0))
+                                return i ? : ret;
+next_page:
                         page_addr += mr->page_size;
                 } while (page_addr < end_dma_addr);
 
@@ -1574,7 +1576,6 @@ int ib_sg_to_pages(struct ib_mr *mr,
                 last_page_off = end_dma_addr & ~page_mask;
         }
 
-done:
         return i;
 }
 EXPORT_SYMBOL(ib_sg_to_pages);
diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c
index f567160a4a56..97d6878f9938 100644
--- a/drivers/infiniband/hw/mlx4/main.c
+++ b/drivers/infiniband/hw/mlx4/main.c
@@ -456,7 +456,7 @@ static int mlx4_ib_query_device(struct ib_device *ibdev,
         props->max_qp_wr           = dev->dev->caps.max_wqes - MLX4_IB_SQ_MAX_SPARE;
         props->max_sge             = min(dev->dev->caps.max_sq_sg,
                                          dev->dev->caps.max_rq_sg);
-        props->max_sge_rd = props->max_sge;
+        props->max_sge_rd          = MLX4_MAX_SGE_RD;
         props->max_cq              = dev->dev->quotas.cq;
         props->max_cqe             = dev->dev->caps.max_cqes;
         props->max_mr              = dev->dev->quotas.mpt;
diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c
index a2e4ca56da44..13eaaf45288f 100644
--- a/drivers/infiniband/hw/mlx4/qp.c
+++ b/drivers/infiniband/hw/mlx4/qp.c
@@ -34,6 +34,7 @@
 #include <linux/log2.h>
 #include <linux/slab.h>
 #include <linux/netdevice.h>
+#include <linux/vmalloc.h>
 
 #include <rdma/ib_cache.h>
 #include <rdma/ib_pack.h>
@@ -795,8 +796,14 @@ static int create_qp_common(struct mlx4_ib_dev *dev, struct ib_pd *pd,
                 if (err)
                         goto err_mtt;
 
-                qp->sq.wrid  = kmalloc(qp->sq.wqe_cnt * sizeof (u64), gfp);
-                qp->rq.wrid  = kmalloc(qp->rq.wqe_cnt * sizeof (u64), gfp);
+                qp->sq.wrid = kmalloc(qp->sq.wqe_cnt * sizeof(u64), gfp);
+                if (!qp->sq.wrid)
+                        qp->sq.wrid = __vmalloc(qp->sq.wqe_cnt * sizeof(u64),
+                                                gfp, PAGE_KERNEL);
+                qp->rq.wrid = kmalloc(qp->rq.wqe_cnt * sizeof(u64), gfp);
+                if (!qp->rq.wrid)
+                        qp->rq.wrid = __vmalloc(qp->rq.wqe_cnt * sizeof(u64),
+                                                gfp, PAGE_KERNEL);
                 if (!qp->sq.wrid || !qp->rq.wrid) {
                         err = -ENOMEM;
                         goto err_wrid;
@@ -886,8 +893,8 @@ err_wrid:
                 if (qp_has_rq(init_attr))
                         mlx4_ib_db_unmap_user(to_mucontext(pd->uobject->context), &qp->db);
         } else {
-                kfree(qp->sq.wrid);
-                kfree(qp->rq.wrid);
+                kvfree(qp->sq.wrid);
+                kvfree(qp->rq.wrid);
         }
 
 err_mtt:
@@ -1062,8 +1069,8 @@ static void destroy_qp_common(struct mlx4_ib_dev *dev, struct mlx4_ib_qp *qp,
                                               &qp->db);
                 ib_umem_release(qp->umem);
         } else {
-                kfree(qp->sq.wrid);
-                kfree(qp->rq.wrid);
+                kvfree(qp->sq.wrid);
+                kvfree(qp->rq.wrid);
                 if (qp->mlx4_ib_qp_type & (MLX4_IB_QPT_PROXY_SMI_OWNER |
                     MLX4_IB_QPT_PROXY_SMI | MLX4_IB_QPT_PROXY_GSI))
                         free_proxy_bufs(&dev->ib_dev, qp);
diff --git a/drivers/infiniband/hw/mlx4/srq.c b/drivers/infiniband/hw/mlx4/srq.c
index dce5dfe3a70e..c394376ebe06 100644
--- a/drivers/infiniband/hw/mlx4/srq.c
+++ b/drivers/infiniband/hw/mlx4/srq.c
@@ -34,6 +34,7 @@
 #include <linux/mlx4/qp.h>
 #include <linux/mlx4/srq.h>
 #include <linux/slab.h>
+#include <linux/vmalloc.h>
 
 #include "mlx4_ib.h"
 #include "user.h"
@@ -172,8 +173,12 @@ struct ib_srq *mlx4_ib_create_srq(struct ib_pd *pd,
 
                 srq->wrid = kmalloc(srq->msrq.max * sizeof (u64), GFP_KERNEL);
                 if (!srq->wrid) {
-                        err = -ENOMEM;
-                        goto err_mtt;
+                        srq->wrid = __vmalloc(srq->msrq.max * sizeof(u64),
+                                              GFP_KERNEL, PAGE_KERNEL);
+                        if (!srq->wrid) {
+                                err = -ENOMEM;
+                                goto err_mtt;
+                        }
                 }
         }
 
@@ -204,7 +209,7 @@ err_wrid:
         if (pd->uobject)
                 mlx4_ib_db_unmap_user(to_mucontext(pd->uobject->context), &srq->db);
         else
-                kfree(srq->wrid);
+                kvfree(srq->wrid);
 
 err_mtt:
         mlx4_mtt_cleanup(dev->dev, &srq->mtt);
@@ -281,7 +286,7 @@ int mlx4_ib_destroy_srq(struct ib_srq *srq)
                 mlx4_ib_db_unmap_user(to_mucontext(srq->uobject->context), &msrq->db);
                 ib_umem_release(msrq->umem);
         } else {
-                kfree(msrq->wrid);
+                kvfree(msrq->wrid);
                 mlx4_buf_free(dev->dev, msrq->msrq.max << msrq->msrq.wqe_shift,
                               &msrq->buf);
                 mlx4_db_free(dev->dev, &msrq->db);
diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c
index ec8993a7b3be..6000f7aeede9 100644
--- a/drivers/infiniband/hw/mlx5/mr.c
+++ b/drivers/infiniband/hw/mlx5/mr.c
@@ -381,7 +381,19 @@ static void __cache_work_func(struct mlx5_cache_ent *ent)
                         }
                 }
         } else if (ent->cur > 2 * ent->limit) {
-                if (!someone_adding(cache) &&
+                /*
+                 * The remove_keys() logic is performed as garbage collection
+                 * task. Such task is intended to be run when no other active
+                 * processes are running.
+                 *
+                 * The need_resched() will return TRUE if there are user tasks
+                 * to be activated in near future.
+                 *
+                 * In such case, we don't execute remove_keys() and postpone
+                 * the garbage collection work to try to run in next cycle,
+                 * in order to free CPU resources to other tasks.
+                 */
+                if (!need_resched() && !someone_adding(cache) &&
                     time_after(jiffies, cache->last_add + 300 * HZ)) {
                         remove_keys(dev, i, 1);
                         if (ent->cur > ent->limit)
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma.h b/drivers/infiniband/hw/ocrdma/ocrdma.h
index ae80590aabdf..040bb8b5cb15 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma.h
+++ b/drivers/infiniband/hw/ocrdma/ocrdma.h
@@ -232,6 +232,10 @@ struct phy_info {
         u16 interface_type;
 };
 
+enum ocrdma_flags {
+        OCRDMA_FLAGS_LINK_STATUS_INIT = 0x01
+};
+
 struct ocrdma_dev {
         struct ib_device ibdev;
         struct ocrdma_dev_attr attr;
@@ -287,6 +291,7 @@ struct ocrdma_dev {
         atomic_t update_sl;
         u16 pvid;
         u32 asic_id;
+        u32 flags;
 
         ulong last_stats_time;
         struct mutex stats_lock; /* provide synch for debugfs operations */
@@ -591,4 +596,9 @@ static inline u8 ocrdma_is_enabled_and_synced(u32 state)
                 (state & OCRDMA_STATE_FLAG_SYNC);
 }
 
+static inline u8 ocrdma_get_ae_link_state(u32 ae_state)
+{
+        return ((ae_state & OCRDMA_AE_LSC_LS_MASK) >> OCRDMA_AE_LSC_LS_SHIFT);
+}
+
 #endif
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_hw.c b/drivers/infiniband/hw/ocrdma/ocrdma_hw.c
index 30f67bebffa3..283ca842ff74 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_hw.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_hw.c
@@ -579,6 +579,8 @@ static int ocrdma_mbx_create_mq(struct ocrdma_dev *dev,
 
         cmd->async_event_bitmap = BIT(OCRDMA_ASYNC_GRP5_EVE_CODE);
         cmd->async_event_bitmap |= BIT(OCRDMA_ASYNC_RDMA_EVE_CODE);
+        /* Request link events on this  MQ. */
+        cmd->async_event_bitmap |= BIT(OCRDMA_ASYNC_LINK_EVE_CODE);
 
         cmd->async_cqid_ringsize = cq->id;
         cmd->async_cqid_ringsize |= (ocrdma_encoded_q_len(mq->len) <<
@@ -819,20 +821,42 @@ static void ocrdma_process_grp5_aync(struct ocrdma_dev *dev,
         }
 }
 
+static void ocrdma_process_link_state(struct ocrdma_dev *dev,
+                                      struct ocrdma_ae_mcqe *cqe)
+{
+        struct ocrdma_ae_lnkst_mcqe *evt;
+        u8 lstate;
+
+        evt = (struct ocrdma_ae_lnkst_mcqe *)cqe;
+        lstate = ocrdma_get_ae_link_state(evt->speed_state_ptn);
+
+        if (!(lstate & OCRDMA_AE_LSC_LLINK_MASK))
+                return;
+
+        if (dev->flags & OCRDMA_FLAGS_LINK_STATUS_INIT)
+                ocrdma_update_link_state(dev, (lstate & OCRDMA_LINK_ST_MASK));
+}
+
 static void ocrdma_process_acqe(struct ocrdma_dev *dev, void *ae_cqe)
 {
         /* async CQE processing */
         struct ocrdma_ae_mcqe *cqe = ae_cqe;
         u32 evt_code = (cqe->valid_ae_event & OCRDMA_AE_MCQE_EVENT_CODE_MASK) >>
                         OCRDMA_AE_MCQE_EVENT_CODE_SHIFT;
-
-        if (evt_code == OCRDMA_ASYNC_RDMA_EVE_CODE)
+        switch (evt_code) {
+        case OCRDMA_ASYNC_LINK_EVE_CODE:
+                ocrdma_process_link_state(dev, cqe);
+                break;
+        case OCRDMA_ASYNC_RDMA_EVE_CODE:
                 ocrdma_dispatch_ibevent(dev, cqe);
-        else if (evt_code == OCRDMA_ASYNC_GRP5_EVE_CODE)
+                break;
+        case OCRDMA_ASYNC_GRP5_EVE_CODE:
                 ocrdma_process_grp5_aync(dev, cqe);
-        else
+                break;
+        default:
                 pr_err("%s(%d) invalid evt code=0x%x\n", __func__,
                        dev->id, evt_code);
+        }
 }
 
 static void ocrdma_process_mcqe(struct ocrdma_dev *dev, struct ocrdma_mcqe *cqe)
@@ -1363,7 +1387,8 @@ mbx_err:
         return status;
 }
 
-int ocrdma_mbx_get_link_speed(struct ocrdma_dev *dev, u8 *lnk_speed)
+int ocrdma_mbx_get_link_speed(struct ocrdma_dev *dev, u8 *lnk_speed,
+                              u8 *lnk_state)
 {
         int status = -ENOMEM;
         struct ocrdma_get_link_speed_rsp *rsp;
@@ -1384,8 +1409,11 @@ int ocrdma_mbx_get_link_speed(struct ocrdma_dev *dev, u8 *lnk_speed)
                 goto mbx_err;
 
         rsp = (struct ocrdma_get_link_speed_rsp *)cmd;
-        *lnk_speed = (rsp->pflt_pps_ld_pnum & OCRDMA_PHY_PS_MASK)
-                        >> OCRDMA_PHY_PS_SHIFT;
+        if (lnk_speed)
+                *lnk_speed = (rsp->pflt_pps_ld_pnum & OCRDMA_PHY_PS_MASK)
+                              >> OCRDMA_PHY_PS_SHIFT;
+        if (lnk_state)
+                *lnk_state = (rsp->res_lnk_st & OCRDMA_LINK_ST_MASK);
 
 mbx_err:
         kfree(cmd);
@@ -2515,9 +2543,10 @@ static int ocrdma_set_av_params(struct ocrdma_qp *qp,
         ocrdma_cpu_to_le32(&cmd->params.sgid[0], sizeof(cmd->params.sgid));
         cmd->params.vlan_dmac_b4_to_b5 = mac_addr[4] | (mac_addr[5] << 8);
 
-        if (vlan_id < 0x1000) {
-                if (dev->pfc_state) {
-                        vlan_id = 0;
+        if (vlan_id == 0xFFFF)
+                vlan_id = 0;
+        if (vlan_id || dev->pfc_state) {
+                if (!vlan_id) {
                         pr_err("ocrdma%d:Using VLAN with PFC is recommended\n",
                                dev->id);
                         pr_err("ocrdma%d:Using VLAN 0 for this connection\n",
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_hw.h b/drivers/infiniband/hw/ocrdma/ocrdma_hw.h
index 7ed885c1851e..ebc1f442aec3 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_hw.h
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_hw.h
@@ -106,7 +106,8 @@ void ocrdma_ring_cq_db(struct ocrdma_dev *, u16 cq_id, bool armed,
                        bool solicited, u16 cqe_popped);
 
 /* verbs specific mailbox commands */
-int ocrdma_mbx_get_link_speed(struct ocrdma_dev *dev, u8 *lnk_speed);
+int ocrdma_mbx_get_link_speed(struct ocrdma_dev *dev, u8 *lnk_speed,
+                              u8 *lnk_st);
 int ocrdma_query_config(struct ocrdma_dev *,
                         struct ocrdma_mbx_query_config *config);
 
@@ -153,5 +154,6 @@ char *port_speed_string(struct ocrdma_dev *dev);
 void ocrdma_init_service_level(struct ocrdma_dev *);
 void ocrdma_alloc_pd_pool(struct ocrdma_dev *dev);
 void ocrdma_free_pd_range(struct ocrdma_dev *dev);
+void ocrdma_update_link_state(struct ocrdma_dev *dev, u8 lstate);
 
 #endif                          /* __OCRDMA_HW_H__ */
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_main.c b/drivers/infiniband/hw/ocrdma/ocrdma_main.c
index 62b7009daa6c..3afb40b85159 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_main.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_main.c
@@ -290,6 +290,7 @@ static void ocrdma_remove_sysfiles(struct ocrdma_dev *dev)
 static struct ocrdma_dev *ocrdma_add(struct be_dev_info *dev_info)
 {
         int status = 0, i;
+        u8 lstate = 0;
         struct ocrdma_dev *dev;
 
         dev = (struct ocrdma_dev *)ib_alloc_device(sizeof(struct ocrdma_dev));
@@ -319,6 +320,11 @@ static struct ocrdma_dev *ocrdma_add(struct be_dev_info *dev_info)
         if (status)
                 goto alloc_err;
 
+        /* Query Link state and update */
+        status = ocrdma_mbx_get_link_speed(dev, NULL, &lstate);
+        if (!status)
+                ocrdma_update_link_state(dev, lstate);
+
         for (i = 0; i < ARRAY_SIZE(ocrdma_attributes); i++)
                 if (device_create_file(&dev->ibdev.dev, ocrdma_attributes[i]))
                         goto sysfs_err;
@@ -373,7 +379,7 @@ static void ocrdma_remove(struct ocrdma_dev *dev)
         ocrdma_remove_free(dev);
 }
 
-static int ocrdma_open(struct ocrdma_dev *dev)
+static int ocrdma_dispatch_port_active(struct ocrdma_dev *dev)
 {
         struct ib_event port_event;
 
@@ -384,32 +390,9 @@ static int ocrdma_open(struct ocrdma_dev *dev)
         return 0;
 }
 
-static int ocrdma_close(struct ocrdma_dev *dev)
+static int ocrdma_dispatch_port_error(struct ocrdma_dev *dev)
 {
-        int i;
-        struct ocrdma_qp *qp, **cur_qp;
         struct ib_event err_event;
-        struct ib_qp_attr attrs;
-        int attr_mask = IB_QP_STATE;
-
-        attrs.qp_state = IB_QPS_ERR;
-        mutex_lock(&dev->dev_lock);
-        if (dev->qp_tbl) {
-                cur_qp = dev->qp_tbl;
-                for (i = 0; i < OCRDMA_MAX_QP; i++) {
-                        qp = cur_qp[i];
-                        if (qp && qp->ibqp.qp_type != IB_QPT_GSI) {
-                                /* change the QP state to ERROR */
-                                _ocrdma_modify_qp(&qp->ibqp, &attrs, attr_mask);
-
-                                err_event.event = IB_EVENT_QP_FATAL;
-                                err_event.element.qp = &qp->ibqp;
-                                err_event.device = &dev->ibdev;
-                                ib_dispatch_event(&err_event);
-                        }
-                }
-        }
-        mutex_unlock(&dev->dev_lock);
 
         err_event.event = IB_EVENT_PORT_ERR;
         err_event.element.port_num = 1;
@@ -420,7 +403,7 @@ static int ocrdma_close(struct ocrdma_dev *dev)
 
 static void ocrdma_shutdown(struct ocrdma_dev *dev)
 {
-        ocrdma_close(dev);
+        ocrdma_dispatch_port_error(dev);
         ocrdma_remove(dev);
 }
 
@@ -431,18 +414,28 @@ static void ocrdma_shutdown(struct ocrdma_dev *dev)
 static void ocrdma_event_handler(struct ocrdma_dev *dev, u32 event)
 {
         switch (event) {
-        case BE_DEV_UP:
-                ocrdma_open(dev);
-                break;
-        case BE_DEV_DOWN:
-                ocrdma_close(dev);
-                break;
         case BE_DEV_SHUTDOWN:
                 ocrdma_shutdown(dev);
                 break;
+        default:
+                break;
         }
 }
 
+void ocrdma_update_link_state(struct ocrdma_dev *dev, u8 lstate)
+{
+        if (!(dev->flags & OCRDMA_FLAGS_LINK_STATUS_INIT)) {
+                dev->flags |= OCRDMA_FLAGS_LINK_STATUS_INIT;
+                if (!lstate)
+                        return;
+        }
+
+        if (!lstate)
+                ocrdma_dispatch_port_error(dev);
+        else
+                ocrdma_dispatch_port_active(dev);
+}
+
 static struct ocrdma_driver ocrdma_drv = {
         .name                   = "ocrdma_driver",
         .add                    = ocrdma_add,
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_sli.h b/drivers/infiniband/hw/ocrdma/ocrdma_sli.h
index 6a38268bbe9f..99dd6fdf06d7 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_sli.h
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_sli.h
@@ -465,8 +465,11 @@ struct ocrdma_ae_qp_mcqe {
         u32 valid_ae_event;
 };
 
-#define OCRDMA_ASYNC_RDMA_EVE_CODE 0x14
-#define OCRDMA_ASYNC_GRP5_EVE_CODE 0x5
+enum ocrdma_async_event_code {
+        OCRDMA_ASYNC_LINK_EVE_CODE      = 0x01,
+        OCRDMA_ASYNC_GRP5_EVE_CODE      = 0x05,
+        OCRDMA_ASYNC_RDMA_EVE_CODE      = 0x14
+};
 
 enum ocrdma_async_grp5_events {
         OCRDMA_ASYNC_EVENT_QOS_VALUE    = 0x01,
@@ -489,6 +492,44 @@ enum OCRDMA_ASYNC_EVENT_TYPE {
         OCRDMA_MAX_ASYNC_ERRORS
 };
 
+struct ocrdma_ae_lnkst_mcqe {
+        u32 speed_state_ptn;
+        u32 qos_reason_falut;
+        u32 evt_tag;
+        u32 valid_ae_event;
+};
+
+enum {
+        OCRDMA_AE_LSC_PORT_NUM_MASK     = 0x3F,
+        OCRDMA_AE_LSC_PT_SHIFT          = 0x06,
+        OCRDMA_AE_LSC_PT_MASK           = (0x03 <<
+                        OCRDMA_AE_LSC_PT_SHIFT),
+        OCRDMA_AE_LSC_LS_SHIFT          = 0x08,
+        OCRDMA_AE_LSC_LS_MASK           = (0xFF <<
+                        OCRDMA_AE_LSC_LS_SHIFT),
+        OCRDMA_AE_LSC_LD_SHIFT          = 0x10,
+        OCRDMA_AE_LSC_LD_MASK           = (0xFF <<
+                        OCRDMA_AE_LSC_LD_SHIFT),
+        OCRDMA_AE_LSC_PPS_SHIFT         = 0x18,
+        OCRDMA_AE_LSC_PPS_MASK          = (0xFF <<
+                        OCRDMA_AE_LSC_PPS_SHIFT),
+        OCRDMA_AE_LSC_PPF_MASK          = 0xFF,
+        OCRDMA_AE_LSC_ER_SHIFT          = 0x08,
+        OCRDMA_AE_LSC_ER_MASK           = (0xFF <<
+                        OCRDMA_AE_LSC_ER_SHIFT),
+        OCRDMA_AE_LSC_QOS_SHIFT         = 0x10,
+        OCRDMA_AE_LSC_QOS_MASK          = (0xFFFF <<
+                        OCRDMA_AE_LSC_QOS_SHIFT)
+};
+
+enum {
+        OCRDMA_AE_LSC_PLINK_DOWN        = 0x00,
+        OCRDMA_AE_LSC_PLINK_UP          = 0x01,
+        OCRDMA_AE_LSC_LLINK_DOWN        = 0x02,
+        OCRDMA_AE_LSC_LLINK_MASK        = 0x02,
+        OCRDMA_AE_LSC_LLINK_UP          = 0x03
+};
+
 /* mailbox command request and responses */
 enum {
         OCRDMA_MBX_QUERY_CFG_CQ_OVERFLOW_SHIFT          = 2,
@@ -676,7 +717,7 @@ enum {
         OCRDMA_PHY_PFLT_SHIFT   = 0x18,
         OCRDMA_QOS_LNKSP_MASK   = 0xFFFF0000,
         OCRDMA_QOS_LNKSP_SHIFT  = 0x10,
-        OCRDMA_LLST_MASK        = 0xFF,
+        OCRDMA_LINK_ST_MASK     = 0x01,
         OCRDMA_PLFC_MASK        = 0x00000400,
         OCRDMA_PLFC_SHIFT       = 0x8,
         OCRDMA_PLRFC_MASK       = 0x00000200,
@@ -691,7 +732,7 @@ struct ocrdma_get_link_speed_rsp {
 
         u32 pflt_pps_ld_pnum;
         u32 qos_lsp;
-        u32 res_lls;
+        u32 res_lnk_st;
 };
 
 enum {
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
index 583001bcfb8f..76e96f97b3f6 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
@@ -171,7 +171,7 @@ static inline void get_link_speed_and_width(struct ocrdma_dev *dev,
         int status;
         u8 speed;
 
-        status = ocrdma_mbx_get_link_speed(dev, &speed);
+        status = ocrdma_mbx_get_link_speed(dev, &speed, NULL);
         if (status)
                 speed = OCRDMA_PHYS_LINK_SPEED_ZERO;
 
diff --git a/drivers/infiniband/hw/qib/qib_qsfp.c b/drivers/infiniband/hw/qib/qib_qsfp.c
index 5e27f76805e2..4c7c3c84a741 100644
--- a/drivers/infiniband/hw/qib/qib_qsfp.c
+++ b/drivers/infiniband/hw/qib/qib_qsfp.c
@@ -292,7 +292,7 @@ int qib_refresh_qsfp_cache(struct qib_pportdata *ppd, struct qib_qsfp_cache *cp)
                 qib_dev_porterr(ppd->dd, ppd->port,
                                 "QSFP byte0 is 0x%02X, S/B 0x0C/D\n", peek[0]);
 
-        if ((peek[2] & 2) == 0) {
+        if ((peek[2] & 4) == 0) {
                 /*
                  * If cable is paged, rather than "flat memory", we need to
                  * set the page to zero, Even if it already appears to be zero.
@@ -538,7 +538,7 @@ int qib_qsfp_dump(struct qib_pportdata *ppd, char *buf, int len)
         sofar += scnprintf(buf + sofar, len - sofar, "Date:%.*s\n",
                            QSFP_DATE_LEN, cd.date);
         sofar += scnprintf(buf + sofar, len - sofar, "Lot:%.*s\n",
-                           QSFP_LOT_LEN, cd.date);
+                           QSFP_LOT_LEN, cd.lot);
 
         while (bidx < QSFP_DEFAULT_HDR_CNT) {
                 int iidx;
diff --git a/drivers/infiniband/hw/qib/qib_verbs.h b/drivers/infiniband/hw/qib/qib_verbs.h
index 2baf5ad251ed..bc803f33d5f6 100644
--- a/drivers/infiniband/hw/qib/qib_verbs.h
+++ b/drivers/infiniband/hw/qib/qib_verbs.h
@@ -329,9 +329,9 @@ struct qib_sge {
 struct qib_mr {
         struct ib_mr ibmr;
         struct ib_umem *umem;
-        struct qib_mregion mr;  /* must be last */
         u64 *pages;
         u32 npages;
+        struct qib_mregion mr;  /* must be last */
 };
 
 /*
diff --git a/drivers/infiniband/ulp/iser/iser_verbs.c b/drivers/infiniband/ulp/iser/iser_verbs.c
index a93070210109..42f4da620f2e 100644
--- a/drivers/infiniband/ulp/iser/iser_verbs.c
+++ b/drivers/infiniband/ulp/iser/iser_verbs.c
@@ -1293,7 +1293,7 @@ u8 iser_check_task_pi_status(struct iscsi_iser_task *iser_task,
                 if (mr_status.fail_status & IB_MR_CHECK_SIG_STATUS) {
                         sector_t sector_off = mr_status.sig_err.sig_err_offset;
 
-                        do_div(sector_off, sector_size + 8);
+                        sector_div(sector_off, sector_size + 8);
                         *sector = scsi_get_lba(iser_task->sc) + sector_off;
 
                         pr_err("PI error found type %d at sector %llx "
diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
index dfbbbb28090b..8a51c3b5d657 100644
--- a/drivers/infiniband/ulp/isert/ib_isert.c
+++ b/drivers/infiniband/ulp/isert/ib_isert.c
@@ -157,16 +157,9 @@ isert_create_qp(struct isert_conn *isert_conn,
         attr.recv_cq = comp->cq;
         attr.cap.max_send_wr = ISERT_QP_MAX_REQ_DTOS;
         attr.cap.max_recv_wr = ISERT_QP_MAX_RECV_DTOS + 1;
-        /*
-         * FIXME: Use devattr.max_sge - 2 for max_send_sge as
-         * work-around for RDMA_READs with ConnectX-2.
-         *
-         * Also, still make sure to have at least two SGEs for
-         * outgoing control PDU responses.
-         */
-        attr.cap.max_send_sge = max(2, device->dev_attr.max_sge - 2);
-        isert_conn->max_sge = attr.cap.max_send_sge;
-
+        attr.cap.max_send_sge = device->dev_attr.max_sge;
+        isert_conn->max_sge = min(device->dev_attr.max_sge,
+                                  device->dev_attr.max_sge_rd);
         attr.cap.max_recv_sge = 1;
         attr.sq_sig_type = IB_SIGNAL_REQ_WR;
         attr.qp_type = IB_QPT_RC;
diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
index 9909022dc6c3..3db9a659719b 100644
--- a/drivers/infiniband/ulp/srp/ib_srp.c
+++ b/drivers/infiniband/ulp/srp/ib_srp.c
@@ -488,7 +488,7 @@ static int srp_create_ch_ib(struct srp_rdma_ch *ch)
         struct ib_qp *qp;
         struct ib_fmr_pool *fmr_pool = NULL;
         struct srp_fr_pool *fr_pool = NULL;
-        const int m = 1 + dev->use_fast_reg;
+        const int m = dev->use_fast_reg ? 3 : 1;
         struct ib_cq_init_attr cq_attr = {};
         int ret;
 
@@ -994,16 +994,16 @@ static int srp_connect_ch(struct srp_rdma_ch *ch, bool multich)
 
         ret = srp_lookup_path(ch);
         if (ret)
-                return ret;
+                goto out;
 
         while (1) {
                 init_completion(&ch->done);
                 ret = srp_send_req(ch, multich);
                 if (ret)
-                        return ret;
+                        goto out;
                 ret = wait_for_completion_interruptible(&ch->done);
                 if (ret < 0)
-                        return ret;
+                        goto out;
 
                 /*
                  * The CM event handling code will set status to
@@ -1011,15 +1011,16 @@ static int srp_connect_ch(struct srp_rdma_ch *ch, bool multich)
                  * back, or SRP_DLID_REDIRECT if we get a lid/qp
                  * redirect REJ back.
                  */
-                switch (ch->status) {
+                ret = ch->status;
+                switch (ret) {
                 case 0:
                         ch->connected = true;
-                        return 0;
+                        goto out;
 
                 case SRP_PORT_REDIRECT:
                         ret = srp_lookup_path(ch);
                         if (ret)
-                                return ret;
+                                goto out;
                         break;
 
                 case SRP_DLID_REDIRECT:
@@ -1028,13 +1029,16 @@ static int srp_connect_ch(struct srp_rdma_ch *ch, bool multich)
                 case SRP_STALE_CONN:
                         shost_printk(KERN_ERR, target->scsi_host, PFX
                                      "giving up on stale connection\n");
-                        ch->status = -ECONNRESET;
-                        return ch->status;
+                        ret = -ECONNRESET;
+                        goto out;
 
                 default:
-                        return ch->status;
+                        goto out;
                 }
         }
+
+out:
+        return ret <= 0 ? ret : -ENODEV;
 }
 
 static int srp_inv_rkey(struct srp_rdma_ch *ch, u32 rkey)
@@ -1309,7 +1313,7 @@ reset_state:
 }
 
 static int srp_map_finish_fr(struct srp_map_state *state,
-                             struct srp_rdma_ch *ch)
+                             struct srp_rdma_ch *ch, int sg_nents)
 {
         struct srp_target_port *target = ch->target;
         struct srp_device *dev = target->srp_host->srp_dev;
@@ -1324,10 +1328,10 @@ static int srp_map_finish_fr(struct srp_map_state *state,
 
         WARN_ON_ONCE(!dev->use_fast_reg);
 
-        if (state->sg_nents == 0)
+        if (sg_nents == 0)
                 return 0;
 
-        if (state->sg_nents == 1 && target->global_mr) {
+        if (sg_nents == 1 && target->global_mr) {
                 srp_map_desc(state, sg_dma_address(state->sg),
                              sg_dma_len(state->sg),
                              target->global_mr->rkey);
@@ -1341,8 +1345,7 @@ static int srp_map_finish_fr(struct srp_map_state *state,
         rkey = ib_inc_rkey(desc->mr->rkey);
         ib_update_fast_reg_key(desc->mr, rkey);
 
-        n = ib_map_mr_sg(desc->mr, state->sg, state->sg_nents,
-                         dev->mr_page_size);
+        n = ib_map_mr_sg(desc->mr, state->sg, sg_nents, dev->mr_page_size);
         if (unlikely(n < 0))
                 return n;
 
@@ -1448,16 +1451,15 @@ static int srp_map_sg_fr(struct srp_map_state *state, struct srp_rdma_ch *ch,
         state->fr.next = req->fr_list;
         state->fr.end = req->fr_list + ch->target->cmd_sg_cnt;
         state->sg = scat;
-        state->sg_nents = scsi_sg_count(req->scmnd);
 
-        while (state->sg_nents) {
+        while (count) {
                 int i, n;
 
-                n = srp_map_finish_fr(state, ch);
+                n = srp_map_finish_fr(state, ch, count);
                 if (unlikely(n < 0))
                         return n;
 
-                state->sg_nents -= n;
+                count -= n;
                 for (i = 0; i < n; i++)
                         state->sg = sg_next(state->sg);
         }
@@ -1517,10 +1519,12 @@ static int srp_map_idb(struct srp_rdma_ch *ch, struct srp_request *req,
 
         if (dev->use_fast_reg) {
                 state.sg = idb_sg;
-                state.sg_nents = 1;
                 sg_set_buf(idb_sg, req->indirect_desc, idb_len);
                 idb_sg->dma_address = req->indirect_dma_addr; /* hack! */
-                ret = srp_map_finish_fr(&state, ch);
+#ifdef CONFIG_NEED_SG_DMA_LENGTH
+                idb_sg->dma_length = idb_sg->length;          /* hack^2 */
+#endif
+                ret = srp_map_finish_fr(&state, ch, 1);
                 if (ret < 0)
                         return ret;
         } else if (dev->use_fmr) {
@@ -1655,7 +1659,7 @@ static int srp_map_data(struct scsi_cmnd *scmnd, struct srp_rdma_ch *ch,
                         return ret;
                 req->nmdesc++;
         } else {
-                idb_rkey = target->global_mr->rkey;
+                idb_rkey = cpu_to_be32(target->global_mr->rkey);
         }
 
         indirect_hdr->table_desc.va = cpu_to_be64(req->indirect_dma_addr);
diff --git a/drivers/infiniband/ulp/srp/ib_srp.h b/drivers/infiniband/ulp/srp/ib_srp.h
index 87a2a919dc43..f6af531f9f32 100644
--- a/drivers/infiniband/ulp/srp/ib_srp.h
+++ b/drivers/infiniband/ulp/srp/ib_srp.h
@@ -300,10 +300,7 @@ struct srp_map_state {
         dma_addr_t              base_dma_addr;
         u32                     dma_len;
         u32                     total_len;
-        union {
-                unsigned int    npages;
-                int             sg_nents;
-        };
+        unsigned int            npages;
         unsigned int            nmdesc;
         unsigned int            ndesc;
 };
diff --git a/drivers/input/joystick/db9.c b/drivers/input/joystick/db9.c
index 932d07307454..da326090c2b0 100644
--- a/drivers/input/joystick/db9.c
+++ b/drivers/input/joystick/db9.c
@@ -592,6 +592,7 @@ static void db9_attach(struct parport *pp)
                 return;
         }
 
+        memset(&db9_parport_cb, 0, sizeof(db9_parport_cb));
         db9_parport_cb.flags = PARPORT_FLAG_EXCL;
 
         pd = parport_register_dev_model(pp, "db9", &db9_parport_cb, port_idx);
diff --git a/drivers/input/joystick/gamecon.c b/drivers/input/joystick/gamecon.c
index 5a672dcac0d8..eae14d512353 100644
--- a/drivers/input/joystick/gamecon.c
+++ b/drivers/input/joystick/gamecon.c
@@ -951,6 +951,7 @@ static void gc_attach(struct parport *pp)
         pads = gc_cfg[port_idx].args + 1;
         n_pads = gc_cfg[port_idx].nargs - 1;
 
+        memset(&gc_parport_cb, 0, sizeof(gc_parport_cb));
         gc_parport_cb.flags = PARPORT_FLAG_EXCL;
 
         pd = parport_register_dev_model(pp, "gamecon", &gc_parport_cb,
diff --git a/drivers/input/joystick/turbografx.c b/drivers/input/joystick/turbografx.c
index 9f5bca26bd2f..77f575dd0901 100644
--- a/drivers/input/joystick/turbografx.c
+++ b/drivers/input/joystick/turbografx.c
@@ -181,6 +181,7 @@ static void tgfx_attach(struct parport *pp)
         n_buttons = tgfx_cfg[port_idx].args + 1;
         n_devs = tgfx_cfg[port_idx].nargs - 1;
 
+        memset(&tgfx_parport_cb, 0, sizeof(tgfx_parport_cb));
         tgfx_parport_cb.flags = PARPORT_FLAG_EXCL;
 
         pd = parport_register_dev_model(pp, "turbografx", &tgfx_parport_cb,
diff --git a/drivers/input/joystick/walkera0701.c b/drivers/input/joystick/walkera0701.c
index 9c07fe911075..70a893a17467 100644
--- a/drivers/input/joystick/walkera0701.c
+++ b/drivers/input/joystick/walkera0701.c
@@ -218,6 +218,7 @@ static void walkera0701_attach(struct parport *pp)
 
         w->parport = pp;
 
+        memset(&walkera0701_parport_cb, 0, sizeof(walkera0701_parport_cb));
         walkera0701_parport_cb.flags = PARPORT_FLAG_EXCL;
         walkera0701_parport_cb.irq_func = walkera0701_irq_handler;
         walkera0701_parport_cb.private = w;
diff --git a/drivers/input/misc/arizona-haptics.c b/drivers/input/misc/arizona-haptics.c
index 4bf678541496..d5994a745ffa 100644
--- a/drivers/input/misc/arizona-haptics.c
+++ b/drivers/input/misc/arizona-haptics.c
@@ -97,8 +97,7 @@ static void arizona_haptics_work(struct work_struct *work)
 
                 ret = regmap_update_bits(arizona->regmap,
                                          ARIZONA_HAPTICS_CONTROL_1,
-                                         ARIZONA_HAP_CTRL_MASK,
-                                         1 << ARIZONA_HAP_CTRL_SHIFT);
+                                         ARIZONA_HAP_CTRL_MASK, 0);
                 if (ret != 0) {
                         dev_err(arizona->dev, "Failed to stop haptics: %d\n",
                                 ret);
diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c
index 5e1665bbaa0b..2f589857a039 100644
--- a/drivers/input/mouse/elan_i2c_core.c
+++ b/drivers/input/mouse/elan_i2c_core.c
@@ -41,6 +41,7 @@
 
 #define DRIVER_NAME             "elan_i2c"
 #define ELAN_DRIVER_VERSION     "1.6.1"
+#define ELAN_VENDOR_ID          0x04f3
 #define ETP_MAX_PRESSURE        255
 #define ETP_FWIDTH_REDUCE       90
 #define ETP_FINGER_WIDTH        15
@@ -914,6 +915,8 @@ static int elan_setup_input_device(struct elan_tp_data *data)
 
         input->name = "Elan Touchpad";
         input->id.bustype = BUS_I2C;
+        input->id.vendor = ELAN_VENDOR_ID;
+        input->id.product = data->product_id;
         input_set_drvdata(input, data);
 
         error = input_mt_init_slots(input, ETP_MAX_FINGERS,
diff --git a/drivers/input/serio/parkbd.c b/drivers/input/serio/parkbd.c
index 92c31b8f8fb4..1edfac78d4ac 100644
--- a/drivers/input/serio/parkbd.c
+++ b/drivers/input/serio/parkbd.c
@@ -145,6 +145,7 @@ static int parkbd_getport(struct parport *pp)
 {
         struct pardev_cb parkbd_parport_cb;
 
+        memset(&parkbd_parport_cb, 0, sizeof(parkbd_parport_cb));
         parkbd_parport_cb.irq_func = parkbd_interrupt;
         parkbd_parport_cb.flags = PARPORT_FLAG_EXCL;
 
diff --git a/drivers/input/tablet/aiptek.c b/drivers/input/tablet/aiptek.c
index e7f966da6efa..78ca44840d60 100644
--- a/drivers/input/tablet/aiptek.c
+++ b/drivers/input/tablet/aiptek.c
@@ -1819,6 +1819,14 @@ aiptek_probe(struct usb_interface *intf, const struct usb_device_id *id)
         input_set_abs_params(inputdev, ABS_TILT_Y, AIPTEK_TILT_MIN, AIPTEK_TILT_MAX, 0, 0);
         input_set_abs_params(inputdev, ABS_WHEEL, AIPTEK_WHEEL_MIN, AIPTEK_WHEEL_MAX - 1, 0, 0);
 
+        /* Verify that a device really has an endpoint */
+        if (intf->altsetting[0].desc.bNumEndpoints < 1) {
+                dev_err(&intf->dev,
+                        "interface has %d endpoints, but must have minimum 1\n",
+                        intf->altsetting[0].desc.bNumEndpoints);
+                err = -EINVAL;
+                goto fail3;
+        }
         endpoint = &intf->altsetting[0].endpoint[0].desc;
 
         /* Go set up our URB, which is called when the tablet receives
@@ -1861,6 +1869,7 @@ aiptek_probe(struct usb_interface *intf, const struct usb_device_id *id)
         if (i == ARRAY_SIZE(speeds)) {
                 dev_info(&intf->dev,
                          "Aiptek tried all speeds, no sane response\n");
+                err = -EINVAL;
                 goto fail3;
         }
 
diff --git a/drivers/input/touchscreen/atmel_mxt_ts.c b/drivers/input/touchscreen/atmel_mxt_ts.c
index c5622058c22b..2d5794ec338b 100644
--- a/drivers/input/touchscreen/atmel_mxt_ts.c
+++ b/drivers/input/touchscreen/atmel_mxt_ts.c
@@ -2487,6 +2487,31 @@ static struct mxt_acpi_platform_data samus_platform_data[] = {
         { }
 };
 
+static unsigned int chromebook_tp_buttons[] = {
+        KEY_RESERVED,
+        KEY_RESERVED,
+        KEY_RESERVED,
+        KEY_RESERVED,
+        KEY_RESERVED,
+        BTN_LEFT
+};
+
+static struct mxt_acpi_platform_data chromebook_platform_data[] = {
+        {
+                /* Touchpad */
+                .hid    = "ATML0000",
+                .pdata  = {
+                        .t19_num_keys   = ARRAY_SIZE(chromebook_tp_buttons),
+                        .t19_keymap     = chromebook_tp_buttons,
+                },
+        },
+        {
+                /* Touchscreen */
+                .hid    = "ATML0001",
+        },
+        { }
+};
+
 static const struct dmi_system_id mxt_dmi_table[] = {
         {
                 /* 2015 Google Pixel */
@@ -2497,6 +2522,14 @@ static const struct dmi_system_id mxt_dmi_table[] = {
                 },
                 .driver_data = samus_platform_data,
         },
+        {
+                /* Other Google Chromebooks */
+                .ident = "Chromebook",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "GOOGLE"),
+                },
+                .driver_data = chromebook_platform_data,
+        },
         { }
 };
 
@@ -2701,6 +2734,7 @@ static const struct i2c_device_id mxt_id[] = {
         { "qt602240_ts", 0 },
         { "atmel_mxt_ts", 0 },
         { "atmel_mxt_tp", 0 },
+        { "maxtouch", 0 },
         { "mXT224", 0 },
         { }
 };
diff --git a/drivers/input/touchscreen/elants_i2c.c b/drivers/input/touchscreen/elants_i2c.c
index 17cc20ef4923..ac09855fa435 100644
--- a/drivers/input/touchscreen/elants_i2c.c
+++ b/drivers/input/touchscreen/elants_i2c.c
@@ -1316,7 +1316,13 @@ static int __maybe_unused elants_i2c_suspend(struct device *dev)
 
         disable_irq(client->irq);
 
-        if (device_may_wakeup(dev) || ts->keep_power_in_suspend) {
+        if (device_may_wakeup(dev)) {
+                /*
+                 * The device will automatically enter idle mode
+                 * that has reduced power consumption.
+                 */
+                ts->wake_irq_enabled = (enable_irq_wake(client->irq) == 0);
+        } else if (ts->keep_power_in_suspend) {
                 for (retry_cnt = 0; retry_cnt < MAX_RETRIES; retry_cnt++) {
                         error = elants_i2c_send(client, set_sleep_cmd,
                                                 sizeof(set_sleep_cmd));
@@ -1326,10 +1332,6 @@ static int __maybe_unused elants_i2c_suspend(struct device *dev)
                         dev_err(&client->dev,
                                 "suspend command failed: %d\n", error);
                 }
-
-                if (device_may_wakeup(dev))
-                        ts->wake_irq_enabled =
-                                        (enable_irq_wake(client->irq) == 0);
         } else {
                 elants_i2c_power_off(ts);
         }
@@ -1345,10 +1347,11 @@ static int __maybe_unused elants_i2c_resume(struct device *dev)
         int retry_cnt;
         int error;
 
-        if (device_may_wakeup(dev) && ts->wake_irq_enabled)
-                disable_irq_wake(client->irq);
-
-        if (ts->keep_power_in_suspend) {
+        if (device_may_wakeup(dev)) {
+                if (ts->wake_irq_enabled)
+                        disable_irq_wake(client->irq);
+                elants_i2c_sw_reset(client);
+        } else if (ts->keep_power_in_suspend) {
                 for (retry_cnt = 0; retry_cnt < MAX_RETRIES; retry_cnt++) {
                         error = elants_i2c_send(client, set_active_cmd,
                                                 sizeof(set_active_cmd));
diff --git a/drivers/iommu/amd_iommu_v2.c b/drivers/iommu/amd_iommu_v2.c
index d21d4edf7236..7caf2fa237f2 100644
--- a/drivers/iommu/amd_iommu_v2.c
+++ b/drivers/iommu/amd_iommu_v2.c
@@ -494,6 +494,22 @@ static void handle_fault_error(struct fault *fault)
         }
 }
 
+static bool access_error(struct vm_area_struct *vma, struct fault *fault)
+{
+        unsigned long requested = 0;
+
+        if (fault->flags & PPR_FAULT_EXEC)
+                requested |= VM_EXEC;
+
+        if (fault->flags & PPR_FAULT_READ)
+                requested |= VM_READ;
+
+        if (fault->flags & PPR_FAULT_WRITE)
+                requested |= VM_WRITE;
+
+        return (requested & ~vma->vm_flags) != 0;
+}
+
 static void do_fault(struct work_struct *work)
 {
         struct fault *fault = container_of(work, struct fault, work);
@@ -516,8 +532,8 @@ static void do_fault(struct work_struct *work)
                 goto out;
         }
 
-        if (!(vma->vm_flags & (VM_READ | VM_EXEC | VM_WRITE))) {
-                /* handle_mm_fault would BUG_ON() */
+        /* Check if we have the right permissions on the vma */
+        if (access_error(vma, fault)) {
                 up_read(&mm->mmap_sem);
                 handle_fault_error(fault);
                 goto out;
diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index f1042daef9ad..ac7387686ddc 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -2159,7 +2159,7 @@ static int __domain_mapping(struct dmar_domain *domain, unsigned long iov_pfn,
                         sg_res = aligned_nrpages(sg->offset, sg->length);
                         sg->dma_address = ((dma_addr_t)iov_pfn << VTD_PAGE_SHIFT) + sg->offset;
                         sg->dma_length = sg->length;
-                        pteval = (sg_phys(sg) & PAGE_MASK) | prot;
+                        pteval = page_to_phys(sg_page(sg)) | prot;
                         phys_pfn = pteval >> VTD_PAGE_SHIFT;
                 }
 
@@ -3704,7 +3704,7 @@ static int intel_nontranslate_map_sg(struct device *hddev,
 
         for_each_sg(sglist, sg, nelems, i) {
                 BUG_ON(!sg_page(sg));
-                sg->dma_address = sg_phys(sg);
+                sg->dma_address = page_to_phys(sg_page(sg)) + sg->offset;
                 sg->dma_length = sg->length;
         }
         return nelems;
diff --git a/drivers/iommu/intel-svm.c b/drivers/iommu/intel-svm.c
index c69e3f9ec958..50464833d0b8 100644
--- a/drivers/iommu/intel-svm.c
+++ b/drivers/iommu/intel-svm.c
@@ -484,6 +484,23 @@ struct page_req_dsc {
 };
 
 #define PRQ_RING_MASK ((0x1000 << PRQ_ORDER) - 0x10)
+
+static bool access_error(struct vm_area_struct *vma, struct page_req_dsc *req)
+{
+        unsigned long requested = 0;
+
+        if (req->exe_req)
+                requested |= VM_EXEC;
+
+        if (req->rd_req)
+                requested |= VM_READ;
+
+        if (req->wr_req)
+                requested |= VM_WRITE;
+
+        return (requested & ~vma->vm_flags) != 0;
+}
+
 static irqreturn_t prq_event_thread(int irq, void *d)
 {
         struct intel_iommu *iommu = d;
@@ -539,6 +556,9 @@ static irqreturn_t prq_event_thread(int irq, void *d)
                 if (!vma || address < vma->vm_start)
                         goto invalid;
 
+                if (access_error(vma, req))
+                        goto invalid;
+
                 ret = handle_mm_fault(svm->mm, vma, address,
                                       req->wr_req ? FAULT_FLAG_WRITE : 0);
                 if (ret & VM_FAULT_ERROR)
diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c
index abae363c7b9b..0e3b0092ec92 100644
--- a/drivers/iommu/iommu.c
+++ b/drivers/iommu/iommu.c
@@ -1430,7 +1430,7 @@ size_t default_iommu_map_sg(struct iommu_domain *domain, unsigned long iova,
         min_pagesz = 1 << __ffs(domain->ops->pgsize_bitmap);
 
         for_each_sg(sg, s, nents, i) {
-                phys_addr_t phys = sg_phys(s);
+                phys_addr_t phys = page_to_phys(sg_page(s)) + s->offset;
 
                 /*
                  * We are mapping on IOMMU page boundaries, so offset within
diff --git a/drivers/irqchip/irq-versatile-fpga.c b/drivers/irqchip/irq-versatile-fpga.c
index 598ab3f0e0ac..cadf104e3074 100644
--- a/drivers/irqchip/irq-versatile-fpga.c
+++ b/drivers/irqchip/irq-versatile-fpga.c
@@ -210,7 +210,12 @@ int __init fpga_irq_of_init(struct device_node *node,
                 parent_irq = -1;
         }
 
+#ifdef CONFIG_ARCH_VERSATILE
+        fpga_irq_init(base, node->name, IRQ_SIC_START, parent_irq, valid_mask,
+                                  node);
+#else
         fpga_irq_init(base, node->name, 0, parent_irq, valid_mask, node);
+#endif
 
         writel(clear_mask, base + IRQ_ENABLE_CLEAR);
         writel(clear_mask, base + FIQ_ENABLE_CLEAR);
diff --git a/drivers/isdn/gigaset/ser-gigaset.c b/drivers/isdn/gigaset/ser-gigaset.c
index 375be509e95f..2a506fe0c8a4 100644
--- a/drivers/isdn/gigaset/ser-gigaset.c
+++ b/drivers/isdn/gigaset/ser-gigaset.c
@@ -67,8 +67,7 @@ static int write_modem(struct cardstate *cs)
         struct sk_buff *skb = bcs->tx_skb;
         int sent = -EOPNOTSUPP;
 
-        if (!tty || !tty->driver || !skb)
-                return -EINVAL;
+        WARN_ON(!tty || !tty->ops || !skb);
 
         if (!skb->len) {
                 dev_kfree_skb_any(skb);
@@ -109,8 +108,7 @@ static int send_cb(struct cardstate *cs)
         unsigned long flags;
         int sent = 0;
 
-        if (!tty || !tty->driver)
-                return -EFAULT;
+        WARN_ON(!tty || !tty->ops);
 
         cb = cs->cmdbuf;
         if (!cb)
@@ -370,19 +368,18 @@ static void gigaset_freecshw(struct cardstate *cs)
         tasklet_kill(&cs->write_tasklet);
         if (!cs->hw.ser)
                 return;
-        dev_set_drvdata(&cs->hw.ser->dev.dev, NULL);
         platform_device_unregister(&cs->hw.ser->dev);
-        kfree(cs->hw.ser);
-        cs->hw.ser = NULL;
 }
 
 static void gigaset_device_release(struct device *dev)
 {
-        struct platform_device *pdev = to_platform_device(dev);
+        struct cardstate *cs = dev_get_drvdata(dev);
 
-        /* adapted from platform_device_release() in drivers/base/platform.c */
-        kfree(dev->platform_data);
-        kfree(pdev->resource);
+        if (!cs)
+                return;
+        dev_set_drvdata(dev, NULL);
+        kfree(cs->hw.ser);
+        cs->hw.ser = NULL;
 }
 
 /*
@@ -432,7 +429,9 @@ static int gigaset_set_modem_ctrl(struct cardstate *cs, unsigned old_state,
         struct tty_struct *tty = cs->hw.ser->tty;
         unsigned int set, clear;
 
-        if (!tty || !tty->driver || !tty->ops->tiocmset)
+        WARN_ON(!tty || !tty->ops);
+        /* tiocmset is an optional tty driver method */
+        if (!tty->ops->tiocmset)
                 return -EINVAL;
         set = new_state & ~old_state;
         clear = old_state & ~new_state;
diff --git a/drivers/isdn/hardware/mISDN/mISDNipac.c b/drivers/isdn/hardware/mISDN/mISDNipac.c
index a77eea594b69..cb428b9ee441 100644
--- a/drivers/isdn/hardware/mISDN/mISDNipac.c
+++ b/drivers/isdn/hardware/mISDN/mISDNipac.c
@@ -1170,7 +1170,7 @@ mISDNipac_irq(struct ipac_hw *ipac, int maxloop)
 
         if (ipac->type & IPAC_TYPE_IPACX) {
                 ista = ReadIPAC(ipac, ISACX_ISTA);
-                while (ista && cnt--) {
+                while (ista && --cnt) {
                         pr_debug("%s: ISTA %02x\n", ipac->name, ista);
                         if (ista & IPACX__ICA)
                                 ipac_irq(&ipac->hscx[0], ista);
@@ -1182,7 +1182,7 @@ mISDNipac_irq(struct ipac_hw *ipac, int maxloop)
                 }
         } else if (ipac->type & IPAC_TYPE_IPAC) {
                 ista = ReadIPAC(ipac, IPAC_ISTA);
-                while (ista && cnt--) {
+                while (ista && --cnt) {
                         pr_debug("%s: ISTA %02x\n", ipac->name, ista);
                         if (ista & (IPAC__ICD | IPAC__EXD)) {
                                 istad = ReadISAC(isac, ISAC_ISTA);
@@ -1200,7 +1200,7 @@ mISDNipac_irq(struct ipac_hw *ipac, int maxloop)
                         ista = ReadIPAC(ipac, IPAC_ISTA);
                 }
         } else if (ipac->type & IPAC_TYPE_HSCX) {
-                while (cnt) {
+                while (--cnt) {
                         ista = ReadIPAC(ipac, IPAC_ISTAB + ipac->hscx[1].off);
                         pr_debug("%s: B2 ISTA %02x\n", ipac->name, ista);
                         if (ista)
@@ -1211,7 +1211,6 @@ mISDNipac_irq(struct ipac_hw *ipac, int maxloop)
                                 mISDNisac_irq(isac, istad);
                         if (0 == (ista | istad))
                                 break;
-                        cnt--;
                 }
         }
         if (cnt > maxloop) /* only for ISAC/HSCX without PCI IRQ test */
diff --git a/drivers/isdn/hisax/config.c b/drivers/isdn/hisax/config.c
index b33f53b3ca93..bf04d2a3cf4a 100644
--- a/drivers/isdn/hisax/config.c
+++ b/drivers/isdn/hisax/config.c
@@ -1896,7 +1896,7 @@ static void EChannel_proc_rcv(struct hisax_d_if *d_if)
                                 ptr--;
                                 *ptr++ = '\n';
                                 *ptr = 0;
-                                HiSax_putstatus(cs, NULL, "%s", cs->dlog);
+                                HiSax_putstatus(cs, NULL, cs->dlog);
                         } else
                                 HiSax_putstatus(cs, "LogEcho: ",
                                                 "warning Frame too big (%d)",
diff --git a/drivers/isdn/hisax/hfc_pci.c b/drivers/isdn/hisax/hfc_pci.c
index 4a4825528188..90449e1e91e5 100644
--- a/drivers/isdn/hisax/hfc_pci.c
+++ b/drivers/isdn/hisax/hfc_pci.c
@@ -901,7 +901,7 @@ Begin:
                                         ptr--;
                                         *ptr++ = '\n';
                                         *ptr = 0;
-                                        HiSax_putstatus(cs, NULL, "%s", cs->dlog);
+                                        HiSax_putstatus(cs, NULL, cs->dlog);
                                 } else
                                         HiSax_putstatus(cs, "LogEcho: ", "warning Frame too big (%d)", total - 3);
                         }
diff --git a/drivers/isdn/hisax/hfc_sx.c b/drivers/isdn/hisax/hfc_sx.c
index b1fad81f0722..13b2151c10f5 100644
--- a/drivers/isdn/hisax/hfc_sx.c
+++ b/drivers/isdn/hisax/hfc_sx.c
@@ -674,7 +674,7 @@ receive_emsg(struct IsdnCardState *cs)
                                         ptr--;
                                         *ptr++ = '\n';
                                         *ptr = 0;
-                                        HiSax_putstatus(cs, NULL, "%s", cs->dlog);
+                                        HiSax_putstatus(cs, NULL, cs->dlog);
                                 } else
                                         HiSax_putstatus(cs, "LogEcho: ", "warning Frame too big (%d)", skb->len);
                         }
diff --git a/drivers/isdn/hisax/q931.c b/drivers/isdn/hisax/q931.c
index b420f8bd862e..ba4beb25d872 100644
--- a/drivers/isdn/hisax/q931.c
+++ b/drivers/isdn/hisax/q931.c
@@ -1179,7 +1179,7 @@ LogFrame(struct IsdnCardState *cs, u_char *buf, int size)
                 dp--;
                 *dp++ = '\n';
                 *dp = 0;
-                HiSax_putstatus(cs, NULL, "%s", cs->dlog);
+                HiSax_putstatus(cs, NULL, cs->dlog);
         } else
                 HiSax_putstatus(cs, "LogFrame: ", "warning Frame too big (%d)", size);
 }
@@ -1246,7 +1246,7 @@ dlogframe(struct IsdnCardState *cs, struct sk_buff *skb, int dir)
         }
         if (finish) {
                 *dp = 0;
-                HiSax_putstatus(cs, NULL, "%s", cs->dlog);
+                HiSax_putstatus(cs, NULL, cs->dlog);
                 return;
         }
         if ((0xfe & buf[0]) == PROTO_DIS_N0) {  /* 1TR6 */
@@ -1509,5 +1509,5 @@ dlogframe(struct IsdnCardState *cs, struct sk_buff *skb, int dir)
                 dp += sprintf(dp, "Unknown protocol %x!", buf[0]);
         }
         *dp = 0;
-        HiSax_putstatus(cs, NULL, "%s", cs->dlog);
+        HiSax_putstatus(cs, NULL, cs->dlog);
 }
diff --git a/drivers/lightnvm/Kconfig b/drivers/lightnvm/Kconfig
index a16bf56d3f28..85a339030e4b 100644
--- a/drivers/lightnvm/Kconfig
+++ b/drivers/lightnvm/Kconfig
@@ -18,6 +18,7 @@ if NVM
 
 config NVM_DEBUG
         bool "Open-Channel SSD debugging support"
+        default n
         ---help---
         Exposes a debug management interface to create/remove targets at:
 
diff --git a/drivers/lightnvm/core.c b/drivers/lightnvm/core.c
index f659e605a406..8f41b245cd55 100644
--- a/drivers/lightnvm/core.c
+++ b/drivers/lightnvm/core.c
@@ -74,7 +74,7 @@ EXPORT_SYMBOL(nvm_unregister_target);
 void *nvm_dev_dma_alloc(struct nvm_dev *dev, gfp_t mem_flags,
                                                         dma_addr_t *dma_handler)
 {
-        return dev->ops->dev_dma_alloc(dev->q, dev->ppalist_pool, mem_flags,
+        return dev->ops->dev_dma_alloc(dev, dev->ppalist_pool, mem_flags,
                                                                 dma_handler);
 }
 EXPORT_SYMBOL(nvm_dev_dma_alloc);
@@ -97,15 +97,47 @@ static struct nvmm_type *nvm_find_mgr_type(const char *name)
         return NULL;
 }
 
+struct nvmm_type *nvm_init_mgr(struct nvm_dev *dev)
+{
+        struct nvmm_type *mt;
+        int ret;
+
+        lockdep_assert_held(&nvm_lock);
+
+        list_for_each_entry(mt, &nvm_mgrs, list) {
+                ret = mt->register_mgr(dev);
+                if (ret < 0) {
+                        pr_err("nvm: media mgr failed to init (%d) on dev %s\n",
+                                                                ret, dev->name);
+                        return NULL; /* initialization failed */
+                } else if (ret > 0)
+                        return mt;
+        }
+
+        return NULL;
+}
+
 int nvm_register_mgr(struct nvmm_type *mt)
 {
+        struct nvm_dev *dev;
         int ret = 0;
 
         down_write(&nvm_lock);
-        if (nvm_find_mgr_type(mt->name))
+        if (nvm_find_mgr_type(mt->name)) {
                 ret = -EEXIST;
-        else
+                goto finish;
+        } else {
                 list_add(&mt->list, &nvm_mgrs);
+        }
+
+        /* try to register media mgr if any device have none configured */
+        list_for_each_entry(dev, &nvm_devices, devices) {
+                if (dev->mt)
+                        continue;
+
+                dev->mt = nvm_init_mgr(dev);
+        }
+finish:
         up_write(&nvm_lock);
 
         return ret;
@@ -160,11 +192,6 @@ int nvm_erase_blk(struct nvm_dev *dev, struct nvm_block *blk)
 }
 EXPORT_SYMBOL(nvm_erase_blk);
 
-static void nvm_core_free(struct nvm_dev *dev)
-{
-        kfree(dev);
-}
-
 static int nvm_core_init(struct nvm_dev *dev)
 {
         struct nvm_id *id = &dev->identity;
@@ -179,12 +206,21 @@ static int nvm_core_init(struct nvm_dev *dev)
         dev->sec_size = grp->csecs;
         dev->oob_size = grp->sos;
         dev->sec_per_pg = grp->fpg_sz / grp->csecs;
-        dev->addr_mode = id->ppat;
-        dev->addr_format = id->ppaf;
+        memcpy(&dev->ppaf, &id->ppaf, sizeof(struct nvm_addr_format));
 
         dev->plane_mode = NVM_PLANE_SINGLE;
         dev->max_rq_size = dev->ops->max_phys_sect * dev->sec_size;
 
+        if (grp->mtype != 0) {
+                pr_err("nvm: memory type not supported\n");
+                return -EINVAL;
+        }
+
+        if (grp->fmtype != 0 && grp->fmtype != 1) {
+                pr_err("nvm: flash type not supported\n");
+                return -EINVAL;
+        }
+
         if (grp->mpos & 0x020202)
                 dev->plane_mode = NVM_PLANE_DOUBLE;
         if (grp->mpos & 0x040404)
@@ -213,21 +249,17 @@ static void nvm_free(struct nvm_dev *dev)
 
         if (dev->mt)
                 dev->mt->unregister_mgr(dev);
-
-        nvm_core_free(dev);
 }
 
 static int nvm_init(struct nvm_dev *dev)
 {
-        struct nvmm_type *mt;
-        int ret = 0;
+        int ret = -EINVAL;
 
         if (!dev->q || !dev->ops)
-                return -EINVAL;
+                return ret;
 
-        if (dev->ops->identity(dev->q, &dev->identity)) {
+        if (dev->ops->identity(dev, &dev->identity)) {
                 pr_err("nvm: device could not be identified\n");
-                ret = -EINVAL;
                 goto err;
         }
 
@@ -251,29 +283,12 @@ static int nvm_init(struct nvm_dev *dev)
                 goto err;
         }
 
-        /* register with device with a supported manager */
-        list_for_each_entry(mt, &nvm_mgrs, list) {
-                ret = mt->register_mgr(dev);
-                if (ret < 0)
-                        goto err; /* initialization failed */
-                if (ret > 0) {
-                        dev->mt = mt;
-                        break; /* successfully initialized */
-                }
-        }
-
-        if (!ret) {
-                pr_info("nvm: no compatible manager found.\n");
-                return 0;
-        }
-
         pr_info("nvm: registered %s [%u/%u/%u/%u/%u/%u]\n",
                         dev->name, dev->sec_per_pg, dev->nr_planes,
                         dev->pgs_per_blk, dev->blks_per_lun, dev->nr_luns,
                         dev->nr_chnls);
         return 0;
 err:
-        nvm_free(dev);
         pr_err("nvm: failed to initialize nvm\n");
         return ret;
 }
@@ -308,22 +323,27 @@ int nvm_register(struct request_queue *q, char *disk_name,
         if (ret)
                 goto err_init;
 
-        down_write(&nvm_lock);
-        list_add(&dev->devices, &nvm_devices);
-        up_write(&nvm_lock);
+        if (dev->ops->max_phys_sect > 256) {
+                pr_info("nvm: max sectors supported is 256.\n");
+                ret = -EINVAL;
+                goto err_init;
+        }
 
         if (dev->ops->max_phys_sect > 1) {
-                dev->ppalist_pool = dev->ops->create_dma_pool(dev->q,
-                                                                "ppalist");
+                dev->ppalist_pool = dev->ops->create_dma_pool(dev, "ppalist");
                 if (!dev->ppalist_pool) {
                         pr_err("nvm: could not create ppa pool\n");
-                        return -ENOMEM;
+                        ret = -ENOMEM;
+                        goto err_init;
                 }
-        } else if (dev->ops->max_phys_sect > 256) {
-                pr_info("nvm: max sectors supported is 256.\n");
-                return -EINVAL;
         }
 
+        /* register device with a supported media manager */
+        down_write(&nvm_lock);
+        dev->mt = nvm_init_mgr(dev);
+        list_add(&dev->devices, &nvm_devices);
+        up_write(&nvm_lock);
+
         return 0;
 err_init:
         kfree(dev);
@@ -333,19 +353,22 @@ EXPORT_SYMBOL(nvm_register);
 
 void nvm_unregister(char *disk_name)
 {
-        struct nvm_dev *dev = nvm_find_nvm_dev(disk_name);
+        struct nvm_dev *dev;
 
+        down_write(&nvm_lock);
+        dev = nvm_find_nvm_dev(disk_name);
         if (!dev) {
                 pr_err("nvm: could not find device %s to unregister\n",
                                                                 disk_name);
+                up_write(&nvm_lock);
                 return;
         }
 
-        nvm_exit(dev);
-
-        down_write(&nvm_lock);
         list_del(&dev->devices);
         up_write(&nvm_lock);
+
+        nvm_exit(dev);
+        kfree(dev);
 }
 EXPORT_SYMBOL(nvm_unregister);
 
@@ -358,38 +381,24 @@ static int nvm_create_target(struct nvm_dev *dev,
 {
         struct nvm_ioctl_create_simple *s = &create->conf.s;
         struct request_queue *tqueue;
-        struct nvmm_type *mt;
         struct gendisk *tdisk;
         struct nvm_tgt_type *tt;
         struct nvm_target *t;
         void *targetdata;
-        int ret = 0;
 
         if (!dev->mt) {
-                /* register with device with a supported NVM manager */
-                list_for_each_entry(mt, &nvm_mgrs, list) {
-                        ret = mt->register_mgr(dev);
-                        if (ret < 0)
-                                return ret; /* initialization failed */
-                        if (ret > 0) {
-                                dev->mt = mt;
-                                break; /* successfully initialized */
-                        }
-                }
-
-                if (!ret) {
-                        pr_info("nvm: no compatible nvm manager found.\n");
-                        return -ENODEV;
-                }
+                pr_info("nvm: device has no media manager registered.\n");
+                return -ENODEV;
         }
 
+        down_write(&nvm_lock);
         tt = nvm_find_target_type(create->tgttype);
         if (!tt) {
                 pr_err("nvm: target type %s not found\n", create->tgttype);
+                up_write(&nvm_lock);
                 return -EINVAL;
         }
 
-        down_write(&nvm_lock);
         list_for_each_entry(t, &dev->online_targets, list) {
                 if (!strcmp(create->tgtname, t->disk->disk_name)) {
                         pr_err("nvm: target name already exists.\n");
@@ -457,11 +466,11 @@ static void nvm_remove_target(struct nvm_target *t)
         lockdep_assert_held(&nvm_lock);
 
         del_gendisk(tdisk);
+        blk_cleanup_queue(q);
+
         if (tt->exit)
                 tt->exit(tdisk->private_data);
 
-        blk_cleanup_queue(q);
-
         put_disk(tdisk);
 
         list_del(&t->list);
@@ -473,7 +482,9 @@ static int __nvm_configure_create(struct nvm_ioctl_create *create)
         struct nvm_dev *dev;
         struct nvm_ioctl_create_simple *s;
 
+        down_write(&nvm_lock);
         dev = nvm_find_nvm_dev(create->dev);
+        up_write(&nvm_lock);
         if (!dev) {
                 pr_err("nvm: device not found\n");
                 return -EINVAL;
@@ -532,7 +543,9 @@ static int nvm_configure_show(const char *val)
                 return -EINVAL;
         }
 
+        down_write(&nvm_lock);
         dev = nvm_find_nvm_dev(devname);
+        up_write(&nvm_lock);
         if (!dev) {
                 pr_err("nvm: device not found\n");
                 return -EINVAL;
@@ -541,7 +554,7 @@ static int nvm_configure_show(const char *val)
         if (!dev->mt)
                 return 0;
 
-        dev->mt->free_blocks_print(dev);
+        dev->mt->lun_info_print(dev);
 
         return 0;
 }
@@ -677,8 +690,10 @@ static long nvm_ioctl_info(struct file *file, void __user *arg)
         info->tgtsize = tgt_iter;
         up_write(&nvm_lock);
 
-        if (copy_to_user(arg, info, sizeof(struct nvm_ioctl_info)))
+        if (copy_to_user(arg, info, sizeof(struct nvm_ioctl_info))) {
+                kfree(info);
                 return -EFAULT;
+        }
 
         kfree(info);
         return 0;
@@ -721,8 +736,11 @@ static long nvm_ioctl_get_devices(struct file *file, void __user *arg)
 
         devices->nr_devices = i;
 
-        if (copy_to_user(arg, devices, sizeof(struct nvm_ioctl_get_devices)))
+        if (copy_to_user(arg, devices,
+                         sizeof(struct nvm_ioctl_get_devices))) {
+                kfree(devices);
                 return -EFAULT;
+        }
 
         kfree(devices);
         return 0;
diff --git a/drivers/lightnvm/gennvm.c b/drivers/lightnvm/gennvm.c
index ae1fb2bdc5f4..a54b339951a3 100644
--- a/drivers/lightnvm/gennvm.c
+++ b/drivers/lightnvm/gennvm.c
@@ -60,23 +60,27 @@ static int gennvm_luns_init(struct nvm_dev *dev, struct gen_nvm *gn)
                 lun->vlun.lun_id = i % dev->luns_per_chnl;
                 lun->vlun.chnl_id = i / dev->luns_per_chnl;
                 lun->vlun.nr_free_blocks = dev->blks_per_lun;
+                lun->vlun.nr_inuse_blocks = 0;
+                lun->vlun.nr_bad_blocks = 0;
         }
         return 0;
 }
 
-static int gennvm_block_bb(u32 lun_id, void *bb_bitmap, unsigned int nr_blocks,
+static int gennvm_block_bb(struct ppa_addr ppa, int nr_blocks, u8 *blks,
                                                                 void *private)
 {
         struct gen_nvm *gn = private;
-        struct gen_lun *lun = &gn->luns[lun_id];
+        struct nvm_dev *dev = gn->dev;
+        struct gen_lun *lun;
         struct nvm_block *blk;
         int i;
 
-        if (unlikely(bitmap_empty(bb_bitmap, nr_blocks)))
-                return 0;
+        lun = &gn->luns[(dev->luns_per_chnl * ppa.g.ch) + ppa.g.lun];
+
+        for (i = 0; i < nr_blocks; i++) {
+                if (blks[i] == 0)
+                        continue;
 
-        i = -1;
-        while ((i = find_next_bit(bb_bitmap, nr_blocks, i + 1)) < nr_blocks) {
                 blk = &lun->vlun.blocks[i];
                 if (!blk) {
                         pr_err("gennvm: BB data is out of bounds.\n");
@@ -84,6 +88,7 @@ static int gennvm_block_bb(u32 lun_id, void *bb_bitmap, unsigned int nr_blocks,
                 }
 
                 list_move_tail(&blk->list, &lun->bb_list);
+                lun->vlun.nr_bad_blocks++;
         }
 
         return 0;
@@ -136,6 +141,7 @@ static int gennvm_block_map(u64 slba, u32 nlb, __le64 *entries, void *private)
                         list_move_tail(&blk->list, &lun->used_list);
                         blk->type = 1;
                         lun->vlun.nr_free_blocks--;
+                        lun->vlun.nr_inuse_blocks++;
                 }
         }
 
@@ -164,22 +170,32 @@ static int gennvm_blocks_init(struct nvm_dev *dev, struct gen_nvm *gn)
                         block->id = cur_block_id++;
 
                         /* First block is reserved for device */
-                        if (unlikely(lun_iter == 0 && blk_iter == 0))
+                        if (unlikely(lun_iter == 0 && blk_iter == 0)) {
+                                lun->vlun.nr_free_blocks--;
                                 continue;
+                        }
 
                         list_add_tail(&block->list, &lun->free_list);
                 }
 
                 if (dev->ops->get_bb_tbl) {
-                        ret = dev->ops->get_bb_tbl(dev->q, lun->vlun.id,
-                                        dev->blks_per_lun, gennvm_block_bb, gn);
+                        struct ppa_addr ppa;
+
+                        ppa.ppa = 0;
+                        ppa.g.ch = lun->vlun.chnl_id;
+                        ppa.g.lun = lun->vlun.id;
+                        ppa = generic_to_dev_addr(dev, ppa);
+
+                        ret = dev->ops->get_bb_tbl(dev, ppa,
+                                                dev->blks_per_lun,
+                                                gennvm_block_bb, gn);
                         if (ret)
                                 pr_err("gennvm: could not read BB table\n");
                 }
         }
 
         if (dev->ops->get_l2p_tbl) {
-                ret = dev->ops->get_l2p_tbl(dev->q, 0, dev->total_pages,
+                ret = dev->ops->get_l2p_tbl(dev, 0, dev->total_pages,
                                                         gennvm_block_map, dev);
                 if (ret) {
                         pr_err("gennvm: could not read L2P table.\n");
@@ -190,15 +206,27 @@ static int gennvm_blocks_init(struct nvm_dev *dev, struct gen_nvm *gn)
         return 0;
 }
 
+static void gennvm_free(struct nvm_dev *dev)
+{
+        gennvm_blocks_free(dev);
+        gennvm_luns_free(dev);
+        kfree(dev->mp);
+        dev->mp = NULL;
+}
+
 static int gennvm_register(struct nvm_dev *dev)
 {
         struct gen_nvm *gn;
         int ret;
 
+        if (!try_module_get(THIS_MODULE))
+                return -ENODEV;
+
         gn = kzalloc(sizeof(struct gen_nvm), GFP_KERNEL);
         if (!gn)
                 return -ENOMEM;
 
+        gn->dev = dev;
         gn->nr_luns = dev->nr_luns;
         dev->mp = gn;
 
@@ -216,16 +244,15 @@ static int gennvm_register(struct nvm_dev *dev)
 
         return 1;
 err:
-        kfree(gn);
+        gennvm_free(dev);
+        module_put(THIS_MODULE);
         return ret;
 }
 
 static void gennvm_unregister(struct nvm_dev *dev)
 {
-        gennvm_blocks_free(dev);
-        gennvm_luns_free(dev);
-        kfree(dev->mp);
-        dev->mp = NULL;
+        gennvm_free(dev);
+        module_put(THIS_MODULE);
 }
 
 static struct nvm_block *gennvm_get_blk(struct nvm_dev *dev,
@@ -240,23 +267,21 @@ static struct nvm_block *gennvm_get_blk(struct nvm_dev *dev,
         if (list_empty(&lun->free_list)) {
                 pr_err_ratelimited("gennvm: lun %u have no free pages available",
                                                                 lun->vlun.id);
-                spin_unlock(&vlun->lock);
                 goto out;
         }
 
-        while (!is_gc && lun->vlun.nr_free_blocks < lun->reserved_blocks) {
-                spin_unlock(&vlun->lock);
+        if (!is_gc && lun->vlun.nr_free_blocks < lun->reserved_blocks)
                 goto out;
-        }
 
         blk = list_first_entry(&lun->free_list, struct nvm_block, list);
         list_move_tail(&blk->list, &lun->used_list);
         blk->type = 1;
 
         lun->vlun.nr_free_blocks--;
+        lun->vlun.nr_inuse_blocks++;
 
-        spin_unlock(&vlun->lock);
 out:
+        spin_unlock(&vlun->lock);
         return blk;
 }
 
@@ -271,16 +296,21 @@ static void gennvm_put_blk(struct nvm_dev *dev, struct nvm_block *blk)
         case 1:
                 list_move_tail(&blk->list, &lun->free_list);
                 lun->vlun.nr_free_blocks++;
+                lun->vlun.nr_inuse_blocks--;
                 blk->type = 0;
                 break;
         case 2:
                 list_move_tail(&blk->list, &lun->bb_list);
+                lun->vlun.nr_bad_blocks++;
+                lun->vlun.nr_inuse_blocks--;
                 break;
         default:
                 WARN_ON_ONCE(1);
                 pr_err("gennvm: erroneous block type (%lu -> %u)\n",
                                                         blk->id, blk->type);
                 list_move_tail(&blk->list, &lun->bb_list);
+                lun->vlun.nr_bad_blocks++;
+                lun->vlun.nr_inuse_blocks--;
         }
 
         spin_unlock(&vlun->lock);
@@ -292,10 +322,10 @@ static void gennvm_addr_to_generic_mode(struct nvm_dev *dev, struct nvm_rq *rqd)
 
         if (rqd->nr_pages > 1) {
                 for (i = 0; i < rqd->nr_pages; i++)
-                        rqd->ppa_list[i] = addr_to_generic_mode(dev,
+                        rqd->ppa_list[i] = dev_to_generic_addr(dev,
                                                         rqd->ppa_list[i]);
         } else {
-                rqd->ppa_addr = addr_to_generic_mode(dev, rqd->ppa_addr);
+                rqd->ppa_addr = dev_to_generic_addr(dev, rqd->ppa_addr);
         }
 }
 
@@ -305,10 +335,10 @@ static void gennvm_generic_to_addr_mode(struct nvm_dev *dev, struct nvm_rq *rqd)
 
         if (rqd->nr_pages > 1) {
                 for (i = 0; i < rqd->nr_pages; i++)
-                        rqd->ppa_list[i] = generic_to_addr_mode(dev,
+                        rqd->ppa_list[i] = generic_to_dev_addr(dev,
                                                         rqd->ppa_list[i]);
         } else {
-                rqd->ppa_addr = generic_to_addr_mode(dev, rqd->ppa_addr);
+                rqd->ppa_addr = generic_to_dev_addr(dev, rqd->ppa_addr);
         }
 }
 
@@ -321,7 +351,7 @@ static int gennvm_submit_io(struct nvm_dev *dev, struct nvm_rq *rqd)
         gennvm_generic_to_addr_mode(dev, rqd);
 
         rqd->dev = dev;
-        return dev->ops->submit_io(dev->q, rqd);
+        return dev->ops->submit_io(dev, rqd);
 }
 
 static void gennvm_blk_set_type(struct nvm_dev *dev, struct ppa_addr *ppa,
@@ -354,10 +384,10 @@ static void gennvm_mark_blk_bad(struct nvm_dev *dev, struct nvm_rq *rqd)
 {
         int i;
 
-        if (!dev->ops->set_bb)
+        if (!dev->ops->set_bb_tbl)
                 return;
 
-        if (dev->ops->set_bb(dev->q, rqd, 1))
+        if (dev->ops->set_bb_tbl(dev, rqd, 1))
                 return;
 
         gennvm_addr_to_generic_mode(dev, rqd);
@@ -425,7 +455,7 @@ static int gennvm_erase_blk(struct nvm_dev *dev, struct nvm_block *blk,
 
         gennvm_generic_to_addr_mode(dev, &rqd);
 
-        ret = dev->ops->erase_block(dev->q, &rqd);
+        ret = dev->ops->erase_block(dev, &rqd);
 
         if (plane_cnt)
                 nvm_dev_dma_free(dev, rqd.ppa_list, rqd.dma_ppa_list);
@@ -440,15 +470,24 @@ static struct nvm_lun *gennvm_get_lun(struct nvm_dev *dev, int lunid)
         return &gn->luns[lunid].vlun;
 }
 
-static void gennvm_free_blocks_print(struct nvm_dev *dev)
+static void gennvm_lun_info_print(struct nvm_dev *dev)
 {
         struct gen_nvm *gn = dev->mp;
         struct gen_lun *lun;
         unsigned int i;
 
-        gennvm_for_each_lun(gn, lun, i)
-                pr_info("%s: lun%8u\t%u\n",
-                                        dev->name, i, lun->vlun.nr_free_blocks);
+
+        gennvm_for_each_lun(gn, lun, i) {
+                spin_lock(&lun->vlun.lock);
+
+                pr_info("%s: lun%8u\t%u\t%u\t%u\n",
+                                dev->name, i,
+                                lun->vlun.nr_free_blocks,
+                                lun->vlun.nr_inuse_blocks,
+                                lun->vlun.nr_bad_blocks);
+
+                spin_unlock(&lun->vlun.lock);
+        }
 }
 
 static struct nvmm_type gennvm = {
@@ -466,7 +505,7 @@ static struct nvmm_type gennvm = {
         .erase_blk      = gennvm_erase_blk,
 
         .get_lun        = gennvm_get_lun,
-        .free_blocks_print = gennvm_free_blocks_print,
+        .lun_info_print = gennvm_lun_info_print,
 };
 
 static int __init gennvm_module_init(void)
diff --git a/drivers/lightnvm/gennvm.h b/drivers/lightnvm/gennvm.h
index d23bd3501ddc..9c24b5b32dac 100644
--- a/drivers/lightnvm/gennvm.h
+++ b/drivers/lightnvm/gennvm.h
@@ -35,6 +35,8 @@ struct gen_lun {
 };
 
 struct gen_nvm {
+        struct nvm_dev *dev;
+
         int nr_luns;
         struct gen_lun *luns;
 };
diff --git a/drivers/lightnvm/rrpc.c b/drivers/lightnvm/rrpc.c
index 7ba64c87ba1c..134e4faba482 100644
--- a/drivers/lightnvm/rrpc.c
+++ b/drivers/lightnvm/rrpc.c
@@ -123,12 +123,42 @@ static u64 block_to_addr(struct rrpc *rrpc, struct rrpc_block *rblk)
         return blk->id * rrpc->dev->pgs_per_blk;
 }
 
+static struct ppa_addr linear_to_generic_addr(struct nvm_dev *dev,
+                                                        struct ppa_addr r)
+{
+        struct ppa_addr l;
+        int secs, pgs, blks, luns;
+        sector_t ppa = r.ppa;
+
+        l.ppa = 0;
+
+        div_u64_rem(ppa, dev->sec_per_pg, &secs);
+        l.g.sec = secs;
+
+        sector_div(ppa, dev->sec_per_pg);
+        div_u64_rem(ppa, dev->sec_per_blk, &pgs);
+        l.g.pg = pgs;
+
+        sector_div(ppa, dev->pgs_per_blk);
+        div_u64_rem(ppa, dev->blks_per_lun, &blks);
+        l.g.blk = blks;
+
+        sector_div(ppa, dev->blks_per_lun);
+        div_u64_rem(ppa, dev->luns_per_chnl, &luns);
+        l.g.lun = luns;
+
+        sector_div(ppa, dev->luns_per_chnl);
+        l.g.ch = ppa;
+
+        return l;
+}
+
 static struct ppa_addr rrpc_ppa_to_gaddr(struct nvm_dev *dev, u64 addr)
 {
         struct ppa_addr paddr;
 
         paddr.ppa = addr;
-        return __linear_to_generic_addr(dev, paddr);
+        return linear_to_generic_addr(dev, paddr);
 }
 
 /* requires lun->lock taken */
@@ -152,7 +182,7 @@ static struct rrpc_block *rrpc_get_blk(struct rrpc *rrpc, struct rrpc_lun *rlun,
         struct nvm_block *blk;
         struct rrpc_block *rblk;
 
-        blk = nvm_get_blk(rrpc->dev, rlun->parent, 0);
+        blk = nvm_get_blk(rrpc->dev, rlun->parent, flags);
         if (!blk)
                 return NULL;
 
@@ -172,6 +202,20 @@ static void rrpc_put_blk(struct rrpc *rrpc, struct rrpc_block *rblk)
         nvm_put_blk(rrpc->dev, rblk->parent);
 }
 
+static void rrpc_put_blks(struct rrpc *rrpc)
+{
+        struct rrpc_lun *rlun;
+        int i;
+
+        for (i = 0; i < rrpc->nr_luns; i++) {
+                rlun = &rrpc->luns[i];
+                if (rlun->cur)
+                        rrpc_put_blk(rrpc, rlun->cur);
+                if (rlun->gc_cur)
+                        rrpc_put_blk(rrpc, rlun->gc_cur);
+        }
+}
+
 static struct rrpc_lun *get_next_lun(struct rrpc *rrpc)
 {
         int next = atomic_inc_return(&rrpc->next_lun);
@@ -972,7 +1016,7 @@ static int rrpc_map_init(struct rrpc *rrpc)
                 return 0;
 
         /* Bring up the mapping table from device */
-        ret = dev->ops->get_l2p_tbl(dev->q, 0, dev->total_pages,
+        ret = dev->ops->get_l2p_tbl(dev, 0, dev->total_pages,
                                                         rrpc_l2p_update, rrpc);
         if (ret) {
                 pr_err("nvm: rrpc: could not read L2P table.\n");
@@ -1194,18 +1238,21 @@ static int rrpc_luns_configure(struct rrpc *rrpc)
 
                 rblk = rrpc_get_blk(rrpc, rlun, 0);
                 if (!rblk)
-                        return -EINVAL;
+                        goto err;
 
                 rrpc_set_lun_cur(rlun, rblk);
 
                 /* Emergency gc block */
                 rblk = rrpc_get_blk(rrpc, rlun, 1);
                 if (!rblk)
-                        return -EINVAL;
+                        goto err;
                 rlun->gc_cur = rblk;
         }
 
         return 0;
+err:
+        rrpc_put_blks(rrpc);
+        return -EINVAL;
 }
 
 static struct nvm_tgt_type tt_rrpc;
diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
index 917d47e290ae..3147c8d09ea8 100644
--- a/drivers/md/dm-crypt.c
+++ b/drivers/md/dm-crypt.c
@@ -112,7 +112,8 @@ struct iv_tcw_private {
  * and encrypts / decrypts at the same time.
  */
 enum flags { DM_CRYPT_SUSPENDED, DM_CRYPT_KEY_VALID,
-             DM_CRYPT_SAME_CPU, DM_CRYPT_NO_OFFLOAD };
+             DM_CRYPT_SAME_CPU, DM_CRYPT_NO_OFFLOAD,
+             DM_CRYPT_EXIT_THREAD};
 
 /*
  * The fields in here must be read only after initialization.
@@ -1203,20 +1204,18 @@ continue_locked:
                 if (!RB_EMPTY_ROOT(&cc->write_tree))
                         goto pop_from_list;
 
+                if (unlikely(test_bit(DM_CRYPT_EXIT_THREAD, &cc->flags))) {
+                        spin_unlock_irq(&cc->write_thread_wait.lock);
+                        break;
+                }
+
                 __set_current_state(TASK_INTERRUPTIBLE);
                 __add_wait_queue(&cc->write_thread_wait, &wait);
 
                 spin_unlock_irq(&cc->write_thread_wait.lock);
 
-                if (unlikely(kthread_should_stop())) {
-                        set_task_state(current, TASK_RUNNING);
-                        remove_wait_queue(&cc->write_thread_wait, &wait);
-                        break;
-                }
-
                 schedule();
 
-                set_task_state(current, TASK_RUNNING);
                 spin_lock_irq(&cc->write_thread_wait.lock);
                 __remove_wait_queue(&cc->write_thread_wait, &wait);
                 goto continue_locked;
@@ -1531,8 +1530,13 @@ static void crypt_dtr(struct dm_target *ti)
         if (!cc)
                 return;
 
-        if (cc->write_thread)
+        if (cc->write_thread) {
+                spin_lock_irq(&cc->write_thread_wait.lock);
+                set_bit(DM_CRYPT_EXIT_THREAD, &cc->flags);
+                wake_up_locked(&cc->write_thread_wait);
+                spin_unlock_irq(&cc->write_thread_wait.lock);
                 kthread_stop(cc->write_thread);
+        }
 
         if (cc->io_queue)
                 destroy_workqueue(cc->io_queue);
diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
index aaa6caa46a9f..cfa29f574c2a 100644
--- a/drivers/md/dm-mpath.c
+++ b/drivers/md/dm-mpath.c
@@ -1537,32 +1537,34 @@ static int multipath_prepare_ioctl(struct dm_target *ti,
                 struct block_device **bdev, fmode_t *mode)
 {
         struct multipath *m = ti->private;
-        struct pgpath *pgpath;
         unsigned long flags;
         int r;
 
-        r = 0;
-
         spin_lock_irqsave(&m->lock, flags);
 
         if (!m->current_pgpath)
                 __choose_pgpath(m, 0);
 
-        pgpath = m->current_pgpath;
-
-        if (pgpath) {
-                *bdev = pgpath->path.dev->bdev;
-                *mode = pgpath->path.dev->mode;
+        if (m->current_pgpath) {
+                if (!m->queue_io) {
+                        *bdev = m->current_pgpath->path.dev->bdev;
+                        *mode = m->current_pgpath->path.dev->mode;
+                        r = 0;
+                } else {
+                        /* pg_init has not started or completed */
+                        r = -ENOTCONN;
+                }
+        } else {
+                /* No path is available */
+                if (m->queue_if_no_path)
+                        r = -ENOTCONN;
+                else
+                        r = -EIO;
         }
 
-        if ((pgpath && m->queue_io) || (!pgpath && m->queue_if_no_path))
-                r = -ENOTCONN;
-        else if (!*bdev)
-                r = -EIO;
-
         spin_unlock_irqrestore(&m->lock, flags);
 
-        if (r == -ENOTCONN && !fatal_signal_pending(current)) {
+        if (r == -ENOTCONN) {
                 spin_lock_irqsave(&m->lock, flags);
                 if (!m->current_pg) {
                         /* Path status changed, redo selection */
diff --git a/drivers/md/dm-thin-metadata.c b/drivers/md/dm-thin-metadata.c
index 1fa45695b68a..c219a053c7f6 100644
--- a/drivers/md/dm-thin-metadata.c
+++ b/drivers/md/dm-thin-metadata.c
@@ -1207,6 +1207,12 @@ static int __reserve_metadata_snap(struct dm_pool_metadata *pmd)
         dm_block_t held_root;
 
         /*
+         * We commit to ensure the btree roots which we increment in a
+         * moment are up to date.
+         */
+        __commit_transaction(pmd);
+
+        /*
          * Copy the superblock.
          */
         dm_sm_inc_block(pmd->metadata_sm, THIN_SUPERBLOCK_LOCATION);
@@ -1538,7 +1544,7 @@ static int __remove(struct dm_thin_device *td, dm_block_t block)
 static int __remove_range(struct dm_thin_device *td, dm_block_t begin, dm_block_t end)
 {
         int r;
-        unsigned count;
+        unsigned count, total_count = 0;
         struct dm_pool_metadata *pmd = td->pmd;
         dm_block_t keys[1] = { td->id };
         __le64 value;
@@ -1561,11 +1567,29 @@ static int __remove_range(struct dm_thin_device *td, dm_block_t begin, dm_block_
         if (r)
                 return r;
 
-        r = dm_btree_remove_leaves(&pmd->bl_info, mapping_root, &begin, end, &mapping_root, &count);
-        if (r)
-                return r;
+        /*
+         * Remove leaves stops at the first unmapped entry, so we have to
+         * loop round finding mapped ranges.
+         */
+        while (begin < end) {
+                r = dm_btree_lookup_next(&pmd->bl_info, mapping_root, &begin, &begin, &value);
+                if (r == -ENODATA)
+                        break;
+
+                if (r)
+                        return r;
+
+                if (begin >= end)
+                        break;
+
+                r = dm_btree_remove_leaves(&pmd->bl_info, mapping_root, &begin, end, &mapping_root, &count);
+                if (r)
+                        return r;
+
+                total_count += count;
+        }
 
-        td->mapped_blocks -= count;
+        td->mapped_blocks -= total_count;
         td->changed = 1;
 
         /*
diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
index 3897b90bd462..63903a5a5d9e 100644
--- a/drivers/md/dm-thin.c
+++ b/drivers/md/dm-thin.c
@@ -2432,6 +2432,7 @@ static void set_pool_mode(struct pool *pool, enum pool_mode new_mode)
         case PM_WRITE:
                 if (old_mode != new_mode)
                         notify_of_pool_mode_change(pool, "write");
+                pool->pf.error_if_no_space = pt->requested_pf.error_if_no_space;
                 dm_pool_metadata_read_write(pool->pmd);
                 pool->process_bio = process_bio;
                 pool->process_discard = process_discard_bio;
@@ -4249,10 +4250,9 @@ static void thin_io_hints(struct dm_target *ti, struct queue_limits *limits)
 {
         struct thin_c *tc = ti->private;
         struct pool *pool = tc->pool;
-        struct queue_limits *pool_limits = dm_get_queue_limits(pool->pool_md);
 
-        if (!pool_limits->discard_granularity)
-                return; /* pool's discard support is disabled */
+        if (!pool->pf.discard_enabled)
+                return;
 
         limits->discard_granularity = pool->sectors_per_block << SECTOR_SHIFT;
         limits->max_discard_sectors = 2048 * 1024 * 16; /* 16G */
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index 6e15f3565892..5df40480228b 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -591,7 +591,7 @@ retry:
 
 out:
         dm_put_live_table(md, *srcu_idx);
-        if (r == -ENOTCONN) {
+        if (r == -ENOTCONN && !fatal_signal_pending(current)) {
                 msleep(10);
                 goto retry;
         }
@@ -603,9 +603,10 @@ static int dm_blk_ioctl(struct block_device *bdev, fmode_t mode,
 {
         struct mapped_device *md = bdev->bd_disk->private_data;
         struct dm_target *tgt;
+        struct block_device *tgt_bdev = NULL;
         int srcu_idx, r;
 
-        r = dm_get_live_table_for_ioctl(md, &tgt, &bdev, &mode, &srcu_idx);
+        r = dm_get_live_table_for_ioctl(md, &tgt, &tgt_bdev, &mode, &srcu_idx);
         if (r < 0)
                 return r;
 
@@ -620,7 +621,7 @@ static int dm_blk_ioctl(struct block_device *bdev, fmode_t mode,
                         goto out;
         }
 
-        r =  __blkdev_driver_ioctl(bdev, mode, cmd, arg);
+        r =  __blkdev_driver_ioctl(tgt_bdev, mode, cmd, arg);
 out:
         dm_put_live_table(md, srcu_idx);
         return r;
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 807095f4c793..61aacab424cf 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -314,8 +314,8 @@ static blk_qc_t md_make_request(struct request_queue *q, struct bio *bio)
  */
 void mddev_suspend(struct mddev *mddev)
 {
-        BUG_ON(mddev->suspended);
-        mddev->suspended = 1;
+        if (mddev->suspended++)
+                return;
         synchronize_rcu();
         wait_event(mddev->sb_wait, atomic_read(&mddev->active_io) == 0);
         mddev->pers->quiesce(mddev, 1);
@@ -326,7 +326,8 @@ EXPORT_SYMBOL_GPL(mddev_suspend);
 
 void mddev_resume(struct mddev *mddev)
 {
-        mddev->suspended = 0;
+        if (--mddev->suspended)
+                return;
         wake_up(&mddev->sb_wait);
         mddev->pers->quiesce(mddev, 0);
 
@@ -1652,7 +1653,7 @@ static int super_1_validate(struct mddev *mddev, struct md_rdev *rdev)
                         rdev->journal_tail = le64_to_cpu(sb->journal_tail);
                         if (mddev->recovery_cp == MaxSector)
                                 set_bit(MD_JOURNAL_CLEAN, &mddev->flags);
-                        rdev->raid_disk = mddev->raid_disks;
+                        rdev->raid_disk = 0;
                         break;
                 default:
                         rdev->saved_raid_disk = role;
@@ -2773,6 +2774,7 @@ slot_store(struct md_rdev *rdev, const char *buf, size_t len)
                 /* Activating a spare .. or possibly reactivating
                  * if we ever get bitmaps working here.
                  */
+                int err;
 
                 if (rdev->raid_disk != -1)
                         return -EBUSY;
@@ -2794,9 +2796,15 @@ slot_store(struct md_rdev *rdev, const char *buf, size_t len)
                         rdev->saved_raid_disk = -1;
                 clear_bit(In_sync, &rdev->flags);
                 clear_bit(Bitmap_sync, &rdev->flags);
-                remove_and_add_spares(rdev->mddev, rdev);
-                if (rdev->raid_disk == -1)
-                        return -EBUSY;
+                err = rdev->mddev->pers->
+                        hot_add_disk(rdev->mddev, rdev);
+                if (err) {
+                        rdev->raid_disk = -1;
+                        return err;
+                } else
+                        sysfs_notify_dirent_safe(rdev->sysfs_state);
+                if (sysfs_link_rdev(rdev->mddev, rdev))
+                        /* failure here is OK */;
                 /* don't wakeup anyone, leave that to userspace. */
         } else {
                 if (slot >= rdev->mddev->raid_disks &&
@@ -4318,8 +4326,7 @@ action_store(struct mddev *mddev, const char *page, size_t len)
                         }
                         mddev_unlock(mddev);
                 }
-        } else if (test_bit(MD_RECOVERY_RUNNING, &mddev->recovery) ||
-                   test_bit(MD_RECOVERY_NEEDED, &mddev->recovery))
+        } else if (test_bit(MD_RECOVERY_RUNNING, &mddev->recovery))
                 return -EBUSY;
         else if (cmd_match(page, "resync"))
                 clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
@@ -4332,8 +4339,12 @@ action_store(struct mddev *mddev, const char *page, size_t len)
                         return -EINVAL;
                 err = mddev_lock(mddev);
                 if (!err) {
-                        clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
-                        err = mddev->pers->start_reshape(mddev);
+                        if (test_bit(MD_RECOVERY_RUNNING, &mddev->recovery))
+                                err =  -EBUSY;
+                        else {
+                                clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
+                                err = mddev->pers->start_reshape(mddev);
+                        }
                         mddev_unlock(mddev);
                 }
                 if (err)
diff --git a/drivers/md/md.h b/drivers/md/md.h
index 2bea51edfab7..ca0b643fe3c1 100644
--- a/drivers/md/md.h
+++ b/drivers/md/md.h
@@ -566,7 +566,9 @@ static inline char * mdname (struct mddev * mddev)
 static inline int sysfs_link_rdev(struct mddev *mddev, struct md_rdev *rdev)
 {
         char nm[20];
-        if (!test_bit(Replacement, &rdev->flags) && mddev->kobj.sd) {
+        if (!test_bit(Replacement, &rdev->flags) &&
+            !test_bit(Journal, &rdev->flags) &&
+            mddev->kobj.sd) {
                 sprintf(nm, "rd%d", rdev->raid_disk);
                 return sysfs_create_link(&mddev->kobj, &rdev->kobj, nm);
         } else
@@ -576,7 +578,9 @@ static inline int sysfs_link_rdev(struct mddev *mddev, struct md_rdev *rdev)
 static inline void sysfs_unlink_rdev(struct mddev *mddev, struct md_rdev *rdev)
 {
         char nm[20];
-        if (!test_bit(Replacement, &rdev->flags) && mddev->kobj.sd) {
+        if (!test_bit(Replacement, &rdev->flags) &&
+            !test_bit(Journal, &rdev->flags) &&
+            mddev->kobj.sd) {
                 sprintf(nm, "rd%d", rdev->raid_disk);
                 sysfs_remove_link(&mddev->kobj, nm);
         }
diff --git a/drivers/md/persistent-data/dm-btree.c b/drivers/md/persistent-data/dm-btree.c
index c573402033b2..b1ced58eb5e1 100644
--- a/drivers/md/persistent-data/dm-btree.c
+++ b/drivers/md/persistent-data/dm-btree.c
@@ -63,6 +63,11 @@ int lower_bound(struct btree_node *n, uint64_t key)
         return bsearch(n, key, 0);
 }
 
+static int upper_bound(struct btree_node *n, uint64_t key)
+{
+        return bsearch(n, key, 1);
+}
+
 void inc_children(struct dm_transaction_manager *tm, struct btree_node *n,
                   struct dm_btree_value_type *vt)
 {
@@ -252,6 +257,16 @@ static void pop_frame(struct del_stack *s)
         dm_tm_unlock(s->tm, f->b);
 }
 
+static void unlock_all_frames(struct del_stack *s)
+{
+        struct frame *f;
+
+        while (unprocessed_frames(s)) {
+                f = s->spine + s->top--;
+                dm_tm_unlock(s->tm, f->b);
+        }
+}
+
 int dm_btree_del(struct dm_btree_info *info, dm_block_t root)
 {
         int r;
@@ -308,9 +323,13 @@ int dm_btree_del(struct dm_btree_info *info, dm_block_t root)
                         pop_frame(s);
                 }
         }
-
 out:
+        if (r) {
+                /* cleanup all frames of del_stack */
+                unlock_all_frames(s);
+        }
         kfree(s);
+
         return r;
 }
 EXPORT_SYMBOL_GPL(dm_btree_del);
@@ -392,6 +411,82 @@ int dm_btree_lookup(struct dm_btree_info *info, dm_block_t root,
 }
 EXPORT_SYMBOL_GPL(dm_btree_lookup);
 
+static int dm_btree_lookup_next_single(struct dm_btree_info *info, dm_block_t root,
+                                       uint64_t key, uint64_t *rkey, void *value_le)
+{
+        int r, i;
+        uint32_t flags, nr_entries;
+        struct dm_block *node;
+        struct btree_node *n;
+
+        r = bn_read_lock(info, root, &node);
+        if (r)
+                return r;
+
+        n = dm_block_data(node);
+        flags = le32_to_cpu(n->header.flags);
+        nr_entries = le32_to_cpu(n->header.nr_entries);
+
+        if (flags & INTERNAL_NODE) {
+                i = lower_bound(n, key);
+                if (i < 0 || i >= nr_entries) {
+                        r = -ENODATA;
+                        goto out;
+                }
+
+                r = dm_btree_lookup_next_single(info, value64(n, i), key, rkey, value_le);
+                if (r == -ENODATA && i < (nr_entries - 1)) {
+                        i++;
+                        r = dm_btree_lookup_next_single(info, value64(n, i), key, rkey, value_le);
+                }
+
+        } else {
+                i = upper_bound(n, key);
+                if (i < 0 || i >= nr_entries) {
+                        r = -ENODATA;
+                        goto out;
+                }
+
+                *rkey = le64_to_cpu(n->keys[i]);
+                memcpy(value_le, value_ptr(n, i), info->value_type.size);
+        }
+out:
+        dm_tm_unlock(info->tm, node);
+        return r;
+}
+
+int dm_btree_lookup_next(struct dm_btree_info *info, dm_block_t root,
+                         uint64_t *keys, uint64_t *rkey, void *value_le)
+{
+        unsigned level;
+        int r = -ENODATA;
+        __le64 internal_value_le;
+        struct ro_spine spine;
+
+        init_ro_spine(&spine, info);
+        for (level = 0; level < info->levels - 1u; level++) {
+                r = btree_lookup_raw(&spine, root, keys[level],
+                                     lower_bound, rkey,
+                                     &internal_value_le, sizeof(uint64_t));
+                if (r)
+                        goto out;
+
+                if (*rkey != keys[level]) {
+                        r = -ENODATA;
+                        goto out;
+                }
+
+                root = le64_to_cpu(internal_value_le);
+        }
+
+        r = dm_btree_lookup_next_single(info, root, keys[level], rkey, value_le);
+out:
+        exit_ro_spine(&spine);
+        return r;
+}
+
+EXPORT_SYMBOL_GPL(dm_btree_lookup_next);
+
 /*
  * Splits a node by creating a sibling node and shifting half the nodes
  * contents across.  Assumes there is a parent node, and it has room for
@@ -473,8 +568,10 @@ static int btree_split_sibling(struct shadow_spine *s, unsigned parent_index,
 
         r = insert_at(sizeof(__le64), pn, parent_index + 1,
                       le64_to_cpu(rn->keys[0]), &location);
-        if (r)
+        if (r) {
+                unlock_block(s->info, right);
                 return r;
+        }
 
         if (key < le64_to_cpu(rn->keys[0])) {
                 unlock_block(s->info, right);
diff --git a/drivers/md/persistent-data/dm-btree.h b/drivers/md/persistent-data/dm-btree.h
index 11d8cf78621d..c74301fa5a37 100644
--- a/drivers/md/persistent-data/dm-btree.h
+++ b/drivers/md/persistent-data/dm-btree.h
@@ -110,6 +110,13 @@ int dm_btree_lookup(struct dm_btree_info *info, dm_block_t root,
                     uint64_t *keys, void *value_le);
 
 /*
+ * Tries to find the first key where the bottom level key is >= to that
+ * given.  Useful for skipping empty sections of the btree.
+ */
+int dm_btree_lookup_next(struct dm_btree_info *info, dm_block_t root,
+                         uint64_t *keys, uint64_t *rkey, void *value_le);
+
+/*
  * Insertion (or overwrite an existing value).  O(ln(n))
  */
 int dm_btree_insert(struct dm_btree_info *info, dm_block_t root,
@@ -135,9 +142,10 @@ int dm_btree_remove(struct dm_btree_info *info, dm_block_t root,
                     uint64_t *keys, dm_block_t *new_root);
 
 /*
- * Removes values between 'keys' and keys2, where keys2 is keys with the
- * final key replaced with 'end_key'.  'end_key' is the one-past-the-end
- * value.  'keys' may be altered.
+ * Removes a _contiguous_ run of values starting from 'keys' and not
+ * reaching keys2 (where keys2 is keys with the final key replaced with
+ * 'end_key').  'end_key' is the one-past-the-end value.  'keys' may be
+ * altered.
  */
 int dm_btree_remove_leaves(struct dm_btree_info *info, dm_block_t root,
                            uint64_t *keys, uint64_t end_key,
diff --git a/drivers/md/persistent-data/dm-space-map-metadata.c b/drivers/md/persistent-data/dm-space-map-metadata.c
index 53091295fce9..fca6dbcf9a47 100644
--- a/drivers/md/persistent-data/dm-space-map-metadata.c
+++ b/drivers/md/persistent-data/dm-space-map-metadata.c
@@ -136,7 +136,7 @@ static int brb_push(struct bop_ring_buffer *brb,
         return 0;
 }
 
-static int brb_pop(struct bop_ring_buffer *brb, struct block_op *result)
+static int brb_peek(struct bop_ring_buffer *brb, struct block_op *result)
 {
         struct block_op *bop;
 
@@ -147,6 +147,17 @@ static int brb_pop(struct bop_ring_buffer *brb, struct block_op *result)
         result->type = bop->type;
         result->block = bop->block;
 
+        return 0;
+}
+
+static int brb_pop(struct bop_ring_buffer *brb)
+{
+        struct block_op *bop;
+
+        if (brb_empty(brb))
+                return -ENODATA;
+
+        bop = brb->bops + brb->begin;
         brb->begin = brb_next(brb, brb->begin);
 
         return 0;
@@ -211,7 +222,7 @@ static int apply_bops(struct sm_metadata *smm)
         while (!brb_empty(&smm->uncommitted)) {
                 struct block_op bop;
 
-                r = brb_pop(&smm->uncommitted, &bop);
+                r = brb_peek(&smm->uncommitted, &bop);
                 if (r) {
                         DMERR("bug in bop ring buffer");
                         break;
@@ -220,6 +231,8 @@ static int apply_bops(struct sm_metadata *smm)
                 r = commit_bop(smm, &bop);
                 if (r)
                         break;
+
+                brb_pop(&smm->uncommitted);
         }
 
         return r;
@@ -683,7 +696,6 @@ static struct dm_space_map bootstrap_ops = {
 static int sm_metadata_extend(struct dm_space_map *sm, dm_block_t extra_blocks)
 {
         int r, i;
-        enum allocation_event ev;
         struct sm_metadata *smm = container_of(sm, struct sm_metadata, sm);
         dm_block_t old_len = smm->ll.nr_blocks;
 
@@ -705,11 +717,12 @@ static int sm_metadata_extend(struct dm_space_map *sm, dm_block_t extra_blocks)
          * allocate any new blocks.
          */
         do {
-                for (i = old_len; !r && i < smm->begin; i++) {
-                        r = sm_ll_inc(&smm->ll, i, &ev);
-                        if (r)
-                                goto out;
-                }
+                for (i = old_len; !r && i < smm->begin; i++)
+                        r = add_bop(smm, BOP_INC, i);
+
+                if (r)
+                        goto out;
+
                 old_len = smm->begin;
 
                 r = apply_bops(smm);
@@ -754,7 +767,6 @@ int dm_sm_metadata_create(struct dm_space_map *sm,
 {
         int r;
         dm_block_t i;
-        enum allocation_event ev;
         struct sm_metadata *smm = container_of(sm, struct sm_metadata, sm);
 
         smm->begin = superblock + 1;
@@ -782,7 +794,7 @@ int dm_sm_metadata_create(struct dm_space_map *sm,
          * allocated blocks that they were built from.
          */
         for (i = superblock; !r && i < smm->begin; i++)
-                r = sm_ll_inc(&smm->ll, i, &ev);
+                r = add_bop(smm, BOP_INC, i);
 
         if (r)
                 return r;
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 41d70bc9ba2f..84e597e1c489 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -1946,6 +1946,8 @@ static void sync_request_write(struct mddev *mddev, struct r10bio *r10_bio)
 
         first = i;
         fbio = r10_bio->devs[i].bio;
+        fbio->bi_iter.bi_size = r10_bio->sectors << 9;
+        fbio->bi_iter.bi_idx = 0;
 
         vcnt = (r10_bio->sectors + (PAGE_SIZE >> 9) - 1) >> (PAGE_SHIFT - 9);
         /* now find blocks with errors */
@@ -1989,7 +1991,7 @@ static void sync_request_write(struct mddev *mddev, struct r10bio *r10_bio)
                 bio_reset(tbio);
 
                 tbio->bi_vcnt = vcnt;
-                tbio->bi_iter.bi_size = r10_bio->sectors << 9;
+                tbio->bi_iter.bi_size = fbio->bi_iter.bi_size;
                 tbio->bi_rw = WRITE;
                 tbio->bi_private = r10_bio;
                 tbio->bi_iter.bi_sector = r10_bio->devs[i].addr;
diff --git a/drivers/media/pci/ivtv/ivtv-driver.c b/drivers/media/pci/ivtv/ivtv-driver.c
index 8616fa8193bc..c2e60b4f292d 100644
--- a/drivers/media/pci/ivtv/ivtv-driver.c
+++ b/drivers/media/pci/ivtv/ivtv-driver.c
@@ -805,11 +805,11 @@ static void ivtv_init_struct2(struct ivtv *itv)
 {
         int i;
 
-        for (i = 0; i < IVTV_CARD_MAX_VIDEO_INPUTS - 1; i++)
+        for (i = 0; i < IVTV_CARD_MAX_VIDEO_INPUTS; i++)
                 if (itv->card->video_inputs[i].video_type == 0)
                         break;
         itv->nof_inputs = i;
-        for (i = 0; i < IVTV_CARD_MAX_AUDIO_INPUTS - 1; i++)
+        for (i = 0; i < IVTV_CARD_MAX_AUDIO_INPUTS; i++)
                 if (itv->card->audio_inputs[i].audio_type == 0)
                         break;
         itv->nof_audio_inputs = i;
diff --git a/drivers/media/usb/airspy/airspy.c b/drivers/media/usb/airspy/airspy.c
index fcbb49757614..565a59310747 100644
--- a/drivers/media/usb/airspy/airspy.c
+++ b/drivers/media/usb/airspy/airspy.c
@@ -134,7 +134,7 @@ struct airspy {
         int            urbs_submitted;
 
         /* USB control message buffer */
-        #define BUF_SIZE 24
+        #define BUF_SIZE 128
         u8 buf[BUF_SIZE];
 
         /* Current configuration */
diff --git a/drivers/media/usb/hackrf/hackrf.c b/drivers/media/usb/hackrf/hackrf.c
index e05bfec90f46..0fe5cb2c260c 100644
--- a/drivers/media/usb/hackrf/hackrf.c
+++ b/drivers/media/usb/hackrf/hackrf.c
@@ -24,6 +24,15 @@
 #include <media/videobuf2-v4l2.h>
 #include <media/videobuf2-vmalloc.h>
 
+/*
+ * Used Avago MGA-81563 RF amplifier could be destroyed pretty easily with too
+ * strong signal or transmitting to bad antenna.
+ * Set RF gain control to 'grabbed' state by default for sure.
+ */
+static bool hackrf_enable_rf_gain_ctrl;
+module_param_named(enable_rf_gain_ctrl, hackrf_enable_rf_gain_ctrl, bool, 0644);
+MODULE_PARM_DESC(enable_rf_gain_ctrl, "enable RX/TX RF amplifier control (warn: could damage amplifier)");
+
 /* HackRF USB API commands (from HackRF Library) */
 enum {
         CMD_SET_TRANSCEIVER_MODE           = 0x01,
@@ -1451,6 +1460,7 @@ static int hackrf_probe(struct usb_interface *intf,
                 dev_err(dev->dev, "Could not initialize controls\n");
                 goto err_v4l2_ctrl_handler_free_rx;
         }
+        v4l2_ctrl_grab(dev->rx_rf_gain, !hackrf_enable_rf_gain_ctrl);
         v4l2_ctrl_handler_setup(&dev->rx_ctrl_handler);
 
         /* Register controls for transmitter */
@@ -1471,6 +1481,7 @@ static int hackrf_probe(struct usb_interface *intf,
                 dev_err(dev->dev, "Could not initialize controls\n");
                 goto err_v4l2_ctrl_handler_free_tx;
         }
+        v4l2_ctrl_grab(dev->tx_rf_gain, !hackrf_enable_rf_gain_ctrl);
         v4l2_ctrl_handler_setup(&dev->tx_ctrl_handler);
 
         /* Register the v4l2_device structure */
@@ -1530,7 +1541,7 @@ err_v4l2_ctrl_handler_free_rx:
 err_kfree:
         kfree(dev);
 err:
-        dev_dbg(dev->dev, "failed=%d\n", ret);
+        dev_dbg(&intf->dev, "failed=%d\n", ret);
         return ret;
 }
 
diff --git a/drivers/memory/fsl_ifc.c b/drivers/memory/fsl_ifc.c
index e87459f6d686..acd1460cf787 100644
--- a/drivers/memory/fsl_ifc.c
+++ b/drivers/memory/fsl_ifc.c
@@ -22,6 +22,7 @@
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/compiler.h>
+#include <linux/sched.h>
 #include <linux/spinlock.h>
 #include <linux/types.h>
 #include <linux/slab.h>
diff --git a/drivers/misc/cxl/native.c b/drivers/misc/cxl/native.c
index d2e75c88f4d2..f40909793490 100644
--- a/drivers/misc/cxl/native.c
+++ b/drivers/misc/cxl/native.c
@@ -497,6 +497,7 @@ static u64 calculate_sr(struct cxl_context *ctx)
 {
         u64 sr = 0;
 
+        set_endian(sr);
         if (ctx->master)
                 sr |= CXL_PSL_SR_An_MP;
         if (mfspr(SPRN_LPCR) & LPCR_TC)
@@ -506,7 +507,6 @@ static u64 calculate_sr(struct cxl_context *ctx)
                 sr |= CXL_PSL_SR_An_HV;
         } else {
                 sr |= CXL_PSL_SR_An_PR | CXL_PSL_SR_An_R;
-                set_endian(sr);
                 sr &= ~(CXL_PSL_SR_An_HV);
                 if (!test_tsk_thread_flag(current, TIF_32BIT))
                         sr |= CXL_PSL_SR_An_SF;
diff --git a/drivers/mtd/ofpart.c b/drivers/mtd/ofpart.c
index 669c3452f278..9ed6038e47d2 100644
--- a/drivers/mtd/ofpart.c
+++ b/drivers/mtd/ofpart.c
@@ -46,10 +46,18 @@ static int parse_ofpart_partitions(struct mtd_info *master,
 
         ofpart_node = of_get_child_by_name(mtd_node, "partitions");
         if (!ofpart_node) {
-                pr_warn("%s: 'partitions' subnode not found on %s. Trying to parse direct subnodes as partitions.\n",
-                        master->name, mtd_node->full_name);
+                /*
+                 * We might get here even when ofpart isn't used at all (e.g.,
+                 * when using another parser), so don't be louder than
+                 * KERN_DEBUG
+                 */
+                pr_debug("%s: 'partitions' subnode not found on %s. Trying to parse direct subnodes as partitions.\n",
+                         master->name, mtd_node->full_name);
                 ofpart_node = mtd_node;
                 dedicated = false;
+        } else if (!of_device_is_compatible(ofpart_node, "fixed-partitions")) {
+                /* The 'partitions' subnode might be used by another parser */
+                return 0;
         }
 
         /* First count the subnodes */
diff --git a/drivers/mtd/ubi/debug.c b/drivers/mtd/ubi/debug.c
index b077e43b5ba9..c4cb15a3098c 100644
--- a/drivers/mtd/ubi/debug.c
+++ b/drivers/mtd/ubi/debug.c
@@ -236,7 +236,7 @@ int ubi_debugfs_init(void)
 
         dfs_rootdir = debugfs_create_dir("ubi", NULL);
         if (IS_ERR_OR_NULL(dfs_rootdir)) {
-                int err = dfs_rootdir ? -ENODEV : PTR_ERR(dfs_rootdir);
+                int err = dfs_rootdir ? PTR_ERR(dfs_rootdir) : -ENODEV;
 
                 pr_err("UBI error: cannot create \"ubi\" debugfs directory, error %d\n",
                        err);
diff --git a/drivers/mtd/ubi/io.c b/drivers/mtd/ubi/io.c
index 1fc23e48fe8e..10cf3b549959 100644
--- a/drivers/mtd/ubi/io.c
+++ b/drivers/mtd/ubi/io.c
@@ -1299,7 +1299,7 @@ static int self_check_peb_vid_hdr(const struct ubi_device *ubi, int pnum)
         if (err && err != UBI_IO_BITFLIPS && !mtd_is_eccerr(err))
                 goto exit;
 
-        crc = crc32(UBI_CRC32_INIT, vid_hdr, UBI_EC_HDR_SIZE_CRC);
+        crc = crc32(UBI_CRC32_INIT, vid_hdr, UBI_VID_HDR_SIZE_CRC);
         hdr_crc = be32_to_cpu(vid_hdr->hdr_crc);
         if (hdr_crc != crc) {
                 ubi_err(ubi, "bad VID header CRC at PEB %d, calculated %#08x, read %#08x",
diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c
index eb4489f9082f..56065632a5b8 100644
--- a/drivers/mtd/ubi/wl.c
+++ b/drivers/mtd/ubi/wl.c
@@ -603,6 +603,7 @@ static int schedule_erase(struct ubi_device *ubi, struct ubi_wl_entry *e,
         return 0;
 }
 
+static int __erase_worker(struct ubi_device *ubi, struct ubi_work *wl_wrk);
 /**
  * do_sync_erase - run the erase worker synchronously.
  * @ubi: UBI device description object
@@ -615,20 +616,16 @@ static int schedule_erase(struct ubi_device *ubi, struct ubi_wl_entry *e,
 static int do_sync_erase(struct ubi_device *ubi, struct ubi_wl_entry *e,
                          int vol_id, int lnum, int torture)
 {
-        struct ubi_work *wl_wrk;
+        struct ubi_work wl_wrk;
 
         dbg_wl("sync erase of PEB %i", e->pnum);
 
-        wl_wrk = kmalloc(sizeof(struct ubi_work), GFP_NOFS);
-        if (!wl_wrk)
-                return -ENOMEM;
-
-        wl_wrk->e = e;
-        wl_wrk->vol_id = vol_id;
-        wl_wrk->lnum = lnum;
-        wl_wrk->torture = torture;
+        wl_wrk.e = e;
+        wl_wrk.vol_id = vol_id;
+        wl_wrk.lnum = lnum;
+        wl_wrk.torture = torture;
 
-        return erase_worker(ubi, wl_wrk, 0);
+        return __erase_worker(ubi, &wl_wrk);
 }
 
 /**
@@ -1014,7 +1011,7 @@ out_unlock:
 }
 
 /**
- * erase_worker - physical eraseblock erase worker function.
+ * __erase_worker - physical eraseblock erase worker function.
  * @ubi: UBI device description object
  * @wl_wrk: the work object
  * @shutdown: non-zero if the worker has to free memory and exit
@@ -1025,8 +1022,7 @@ out_unlock:
  * needed. Returns zero in case of success and a negative error code in case of
  * failure.
  */
-static int erase_worker(struct ubi_device *ubi, struct ubi_work *wl_wrk,
-                        int shutdown)
+static int __erase_worker(struct ubi_device *ubi, struct ubi_work *wl_wrk)
 {
         struct ubi_wl_entry *e = wl_wrk->e;
         int pnum = e->pnum;
@@ -1034,21 +1030,11 @@ static int erase_worker(struct ubi_device *ubi, struct ubi_work *wl_wrk,
         int lnum = wl_wrk->lnum;
         int err, available_consumed = 0;
 
-        if (shutdown) {
-                dbg_wl("cancel erasure of PEB %d EC %d", pnum, e->ec);
-                kfree(wl_wrk);
-                wl_entry_destroy(ubi, e);
-                return 0;
-        }
-
         dbg_wl("erase PEB %d EC %d LEB %d:%d",
                pnum, e->ec, wl_wrk->vol_id, wl_wrk->lnum);
 
         err = sync_erase(ubi, e, wl_wrk->torture);
         if (!err) {
-                /* Fine, we've erased it successfully */
-                kfree(wl_wrk);
-
                 spin_lock(&ubi->wl_lock);
                 wl_tree_add(e, &ubi->free);
                 ubi->free_count++;
@@ -1066,7 +1052,6 @@ static int erase_worker(struct ubi_device *ubi, struct ubi_work *wl_wrk,
         }
 
         ubi_err(ubi, "failed to erase PEB %d, error %d", pnum, err);
-        kfree(wl_wrk);
 
         if (err == -EINTR || err == -ENOMEM || err == -EAGAIN ||
             err == -EBUSY) {
@@ -1075,6 +1060,7 @@ static int erase_worker(struct ubi_device *ubi, struct ubi_work *wl_wrk,
                 /* Re-schedule the LEB for erasure */
                 err1 = schedule_erase(ubi, e, vol_id, lnum, 0);
                 if (err1) {
+                        wl_entry_destroy(ubi, e);
                         err = err1;
                         goto out_ro;
                 }
@@ -1150,6 +1136,25 @@ out_ro:
         return err;
 }
 
+static int erase_worker(struct ubi_device *ubi, struct ubi_work *wl_wrk,
+                          int shutdown)
+{
+        int ret;
+
+        if (shutdown) {
+                struct ubi_wl_entry *e = wl_wrk->e;
+
+                dbg_wl("cancel erasure of PEB %d EC %d", e->pnum, e->ec);
+                kfree(wl_wrk);
+                wl_entry_destroy(ubi, e);
+                return 0;
+        }
+
+        ret = __erase_worker(ubi, wl_wrk);
+        kfree(wl_wrk);
+        return ret;
+}
+
 /**
  * ubi_wl_put_peb - return a PEB to the wear-leveling sub-system.
  * @ubi: UBI device description object
diff --git a/drivers/net/can/bfin_can.c b/drivers/net/can/bfin_can.c
index 57dadd52b428..1deb8ff90a89 100644
--- a/drivers/net/can/bfin_can.c
+++ b/drivers/net/can/bfin_can.c
@@ -501,8 +501,6 @@ static int bfin_can_err(struct net_device *dev, u16 isrc, u16 status)
                         cf->data[2] |= CAN_ERR_PROT_FORM;
                 else if (status & SER)
                         cf->data[2] |= CAN_ERR_PROT_STUFF;
-                else
-                        cf->data[2] |= CAN_ERR_PROT_UNSPEC;
         }
 
         priv->can.state = state;
diff --git a/drivers/net/can/c_can/c_can.c b/drivers/net/can/c_can/c_can.c
index 5d214d135332..f91b094288da 100644
--- a/drivers/net/can/c_can/c_can.c
+++ b/drivers/net/can/c_can/c_can.c
@@ -962,7 +962,6 @@ static int c_can_handle_bus_err(struct net_device *dev,
          * type of the last error to occur on the CAN bus
          */
         cf->can_id |= CAN_ERR_PROT | CAN_ERR_BUSERROR;
-        cf->data[2] |= CAN_ERR_PROT_UNSPEC;
 
         switch (lec_type) {
         case LEC_STUFF_ERROR:
@@ -975,8 +974,7 @@ static int c_can_handle_bus_err(struct net_device *dev,
                 break;
         case LEC_ACK_ERROR:
                 netdev_dbg(dev, "ack error\n");
-                cf->data[3] |= (CAN_ERR_PROT_LOC_ACK |
-                                CAN_ERR_PROT_LOC_ACK_DEL);
+                cf->data[3] = CAN_ERR_PROT_LOC_ACK;
                 break;
         case LEC_BIT1_ERROR:
                 netdev_dbg(dev, "bit1 error\n");
@@ -988,8 +986,7 @@ static int c_can_handle_bus_err(struct net_device *dev,
                 break;
         case LEC_CRC_ERROR:
                 netdev_dbg(dev, "CRC error\n");
-                cf->data[3] |= (CAN_ERR_PROT_LOC_CRC_SEQ |
-                                CAN_ERR_PROT_LOC_CRC_DEL);
+                cf->data[3] = CAN_ERR_PROT_LOC_CRC_SEQ;
                 break;
         default:
                 break;
diff --git a/drivers/net/can/cc770/cc770.c b/drivers/net/can/cc770/cc770.c
index 70a8cbb29e75..1e37313054f3 100644
--- a/drivers/net/can/cc770/cc770.c
+++ b/drivers/net/can/cc770/cc770.c
@@ -578,7 +578,7 @@ static int cc770_err(struct net_device *dev, u8 status)
                                 cf->data[2] |= CAN_ERR_PROT_BIT0;
                                 break;
                         case STAT_LEC_CRC:
-                                cf->data[3] |= CAN_ERR_PROT_LOC_CRC_SEQ;
+                                cf->data[3] = CAN_ERR_PROT_LOC_CRC_SEQ;
                                 break;
                         }
                 }
diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
index 868fe945e35a..41c0fc9f3b14 100644
--- a/drivers/net/can/flexcan.c
+++ b/drivers/net/can/flexcan.c
@@ -535,13 +535,13 @@ static void do_bus_err(struct net_device *dev,
         if (reg_esr & FLEXCAN_ESR_ACK_ERR) {
                 netdev_dbg(dev, "ACK_ERR irq\n");
                 cf->can_id |= CAN_ERR_ACK;
-                cf->data[3] |= CAN_ERR_PROT_LOC_ACK;
+                cf->data[3] = CAN_ERR_PROT_LOC_ACK;
                 tx_errors = 1;
         }
         if (reg_esr & FLEXCAN_ESR_CRC_ERR) {
                 netdev_dbg(dev, "CRC_ERR irq\n");
                 cf->data[2] |= CAN_ERR_PROT_BIT;
-                cf->data[3] |= CAN_ERR_PROT_LOC_CRC_SEQ;
+                cf->data[3] = CAN_ERR_PROT_LOC_CRC_SEQ;
                 rx_errors = 1;
         }
         if (reg_esr & FLEXCAN_ESR_FRM_ERR) {
diff --git a/drivers/net/can/janz-ican3.c b/drivers/net/can/janz-ican3.c
index c1e85368a198..5d04f5464faf 100644
--- a/drivers/net/can/janz-ican3.c
+++ b/drivers/net/can/janz-ican3.c
@@ -1096,7 +1096,6 @@ static int ican3_handle_cevtind(struct ican3_dev *mod, struct ican3_msg *msg)
                         cf->data[2] |= CAN_ERR_PROT_STUFF;
                         break;
                 default:
-                        cf->data[2] |= CAN_ERR_PROT_UNSPEC;
                         cf->data[3] = ecc & ECC_SEG;
                         break;
                 }
diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c
index ef655177bb5e..39cf911f7a1e 100644
--- a/drivers/net/can/m_can/m_can.c
+++ b/drivers/net/can/m_can/m_can.c
@@ -487,7 +487,6 @@ static int m_can_handle_lec_err(struct net_device *dev,
          * type of the last error to occur on the CAN bus
          */
         cf->can_id |= CAN_ERR_PROT | CAN_ERR_BUSERROR;
-        cf->data[2] |= CAN_ERR_PROT_UNSPEC;
 
         switch (lec_type) {
         case LEC_STUFF_ERROR:
@@ -500,8 +499,7 @@ static int m_can_handle_lec_err(struct net_device *dev,
                 break;
         case LEC_ACK_ERROR:
                 netdev_dbg(dev, "ack error\n");
-                cf->data[3] |= (CAN_ERR_PROT_LOC_ACK |
-                                CAN_ERR_PROT_LOC_ACK_DEL);
+                cf->data[3] = CAN_ERR_PROT_LOC_ACK;
                 break;
         case LEC_BIT1_ERROR:
                 netdev_dbg(dev, "bit1 error\n");
@@ -513,8 +511,7 @@ static int m_can_handle_lec_err(struct net_device *dev,
                 break;
         case LEC_CRC_ERROR:
                 netdev_dbg(dev, "CRC error\n");
-                cf->data[3] |= (CAN_ERR_PROT_LOC_CRC_SEQ |
-                                CAN_ERR_PROT_LOC_CRC_DEL);
+                cf->data[3] = CAN_ERR_PROT_LOC_CRC_SEQ;
                 break;
         default:
                 break;
diff --git a/drivers/net/can/pch_can.c b/drivers/net/can/pch_can.c
index e187ca783da0..c1317889d3d8 100644
--- a/drivers/net/can/pch_can.c
+++ b/drivers/net/can/pch_can.c
@@ -559,8 +559,7 @@ static void pch_can_error(struct net_device *ndev, u32 status)
                 stats->rx_errors++;
                 break;
         case PCH_CRC_ERR:
-                cf->data[3] |= CAN_ERR_PROT_LOC_CRC_SEQ |
-                               CAN_ERR_PROT_LOC_CRC_DEL;
+                cf->data[3] = CAN_ERR_PROT_LOC_CRC_SEQ;
                 priv->can.can_stats.bus_error++;
                 stats->rx_errors++;
                 break;
diff --git a/drivers/net/can/rcar_can.c b/drivers/net/can/rcar_can.c
index 7bd54191f962..bc46be39549d 100644
--- a/drivers/net/can/rcar_can.c
+++ b/drivers/net/can/rcar_can.c
@@ -241,17 +241,16 @@ static void rcar_can_error(struct net_device *ndev)
                 u8 ecsr;
 
                 netdev_dbg(priv->ndev, "Bus error interrupt:\n");
-                if (skb) {
+                if (skb)
                         cf->can_id |= CAN_ERR_BUSERROR | CAN_ERR_PROT;
-                        cf->data[2] = CAN_ERR_PROT_UNSPEC;
-                }
+
                 ecsr = readb(&priv->regs->ecsr);
                 if (ecsr & RCAR_CAN_ECSR_ADEF) {
                         netdev_dbg(priv->ndev, "ACK Delimiter Error\n");
                         tx_errors++;
                         writeb(~RCAR_CAN_ECSR_ADEF, &priv->regs->ecsr);
                         if (skb)
-                                cf->data[3] |= CAN_ERR_PROT_LOC_ACK_DEL;
+                                cf->data[3] = CAN_ERR_PROT_LOC_ACK_DEL;
                 }
                 if (ecsr & RCAR_CAN_ECSR_BE0F) {
                         netdev_dbg(priv->ndev, "Bit Error (dominant)\n");
@@ -272,7 +271,7 @@ static void rcar_can_error(struct net_device *ndev)
                         rx_errors++;
                         writeb(~RCAR_CAN_ECSR_CEF, &priv->regs->ecsr);
                         if (skb)
-                                cf->data[3] |= CAN_ERR_PROT_LOC_CRC_SEQ;
+                                cf->data[3] = CAN_ERR_PROT_LOC_CRC_SEQ;
                 }
                 if (ecsr & RCAR_CAN_ECSR_AEF) {
                         netdev_dbg(priv->ndev, "ACK Error\n");
@@ -280,7 +279,7 @@ static void rcar_can_error(struct net_device *ndev)
                         writeb(~RCAR_CAN_ECSR_AEF, &priv->regs->ecsr);
                         if (skb) {
                                 cf->can_id |= CAN_ERR_ACK;
-                                cf->data[3] |= CAN_ERR_PROT_LOC_ACK;
+                                cf->data[3] = CAN_ERR_PROT_LOC_ACK;
                         }
                 }
                 if (ecsr & RCAR_CAN_ECSR_FEF) {
diff --git a/drivers/net/can/sja1000/sja1000.c b/drivers/net/can/sja1000/sja1000.c
index 7b92e911a616..8dda3b703d39 100644
--- a/drivers/net/can/sja1000/sja1000.c
+++ b/drivers/net/can/sja1000/sja1000.c
@@ -218,6 +218,9 @@ static void sja1000_start(struct net_device *dev)
         priv->write_reg(priv, SJA1000_RXERR, 0x0);
         priv->read_reg(priv, SJA1000_ECC);
 
+        /* clear interrupt flags */
+        priv->read_reg(priv, SJA1000_IR);
+
         /* leave reset mode */
         set_normal_mode(dev);
 }
@@ -446,7 +449,6 @@ static int sja1000_err(struct net_device *dev, uint8_t isrc, uint8_t status)
                         cf->data[2] |= CAN_ERR_PROT_STUFF;
                         break;
                 default:
-                        cf->data[2] |= CAN_ERR_PROT_UNSPEC;
                         cf->data[3] = ecc & ECC_SEG;
                         break;
                 }
diff --git a/drivers/net/can/sun4i_can.c b/drivers/net/can/sun4i_can.c
index d9a42c646783..68ef0a4cd821 100644
--- a/drivers/net/can/sun4i_can.c
+++ b/drivers/net/can/sun4i_can.c
@@ -575,7 +575,6 @@ static int sun4i_can_err(struct net_device *dev, u8 isrc, u8 status)
                                 cf->data[2] |= CAN_ERR_PROT_STUFF;
                                 break;
                         default:
-                                cf->data[2] |= CAN_ERR_PROT_UNSPEC;
                                 cf->data[3] = (ecc & SUN4I_STA_ERR_SEG_CODE)
                                                >> 16;
                                 break;
diff --git a/drivers/net/can/ti_hecc.c b/drivers/net/can/ti_hecc.c
index cf345cbfe819..680d1ff07a55 100644
--- a/drivers/net/can/ti_hecc.c
+++ b/drivers/net/can/ti_hecc.c
@@ -722,7 +722,6 @@ static int ti_hecc_error(struct net_device *ndev, int int_status,
         if (err_status & HECC_BUS_ERROR) {
                 ++priv->can.can_stats.bus_error;
                 cf->can_id |= CAN_ERR_BUSERROR | CAN_ERR_PROT;
-                cf->data[2] |= CAN_ERR_PROT_UNSPEC;
                 if (err_status & HECC_CANES_FE) {
                         hecc_set_bit(priv, HECC_CANES, HECC_CANES_FE);
                         cf->data[2] |= CAN_ERR_PROT_FORM;
@@ -737,13 +736,11 @@ static int ti_hecc_error(struct net_device *ndev, int int_status,
                 }
                 if (err_status & HECC_CANES_CRCE) {
                         hecc_set_bit(priv, HECC_CANES, HECC_CANES_CRCE);
-                        cf->data[3] |= CAN_ERR_PROT_LOC_CRC_SEQ |
-                                        CAN_ERR_PROT_LOC_CRC_DEL;
+                        cf->data[3] = CAN_ERR_PROT_LOC_CRC_SEQ;
                 }
                 if (err_status & HECC_CANES_ACKE) {
                         hecc_set_bit(priv, HECC_CANES, HECC_CANES_ACKE);
-                        cf->data[3] |= CAN_ERR_PROT_LOC_ACK |
-                                        CAN_ERR_PROT_LOC_ACK_DEL;
+                        cf->data[3] = CAN_ERR_PROT_LOC_ACK;
                 }
         }
 
diff --git a/drivers/net/can/usb/ems_usb.c b/drivers/net/can/usb/ems_usb.c
index 2d390384ef3b..fc5b75675cd8 100644
--- a/drivers/net/can/usb/ems_usb.c
+++ b/drivers/net/can/usb/ems_usb.c
@@ -377,7 +377,6 @@ static void ems_usb_rx_err(struct ems_usb *dev, struct ems_cpc_msg *msg)
                         cf->data[2] |= CAN_ERR_PROT_STUFF;
                         break;
                 default:
-                        cf->data[2] |= CAN_ERR_PROT_UNSPEC;
                         cf->data[3] = ecc & SJA1000_ECC_SEG;
                         break;
                 }
diff --git a/drivers/net/can/usb/esd_usb2.c b/drivers/net/can/usb/esd_usb2.c
index 0e5a4493ba4f..113e64fcd73b 100644
--- a/drivers/net/can/usb/esd_usb2.c
+++ b/drivers/net/can/usb/esd_usb2.c
@@ -282,7 +282,6 @@ static void esd_usb2_rx_event(struct esd_usb2_net_priv *priv,
                                 cf->data[2] |= CAN_ERR_PROT_STUFF;
                                 break;
                         default:
-                                cf->data[2] |= CAN_ERR_PROT_UNSPEC;
                                 cf->data[3] = ecc & SJA1000_ECC_SEG;
                                 break;
                         }
diff --git a/drivers/net/can/usb/kvaser_usb.c b/drivers/net/can/usb/kvaser_usb.c
index 8b17a9065b0b..022bfa13ebfa 100644
--- a/drivers/net/can/usb/kvaser_usb.c
+++ b/drivers/net/can/usb/kvaser_usb.c
@@ -944,10 +944,9 @@ static void kvaser_usb_rx_error(const struct kvaser_usb *dev,
                         cf->can_id |= CAN_ERR_BUSERROR | CAN_ERR_PROT;
 
                         if (es->leaf.error_factor & M16C_EF_ACKE)
-                                cf->data[3] |= (CAN_ERR_PROT_LOC_ACK);
+                                cf->data[3] = CAN_ERR_PROT_LOC_ACK;
                         if (es->leaf.error_factor & M16C_EF_CRCE)
-                                cf->data[3] |= (CAN_ERR_PROT_LOC_CRC_SEQ |
-                                                CAN_ERR_PROT_LOC_CRC_DEL);
+                                cf->data[3] = CAN_ERR_PROT_LOC_CRC_SEQ;
                         if (es->leaf.error_factor & M16C_EF_FORME)
                                 cf->data[2] |= CAN_ERR_PROT_FORM;
                         if (es->leaf.error_factor & M16C_EF_STFE)
diff --git a/drivers/net/can/usb/usb_8dev.c b/drivers/net/can/usb/usb_8dev.c
index de95b1ccba3e..a731720f1d13 100644
--- a/drivers/net/can/usb/usb_8dev.c
+++ b/drivers/net/can/usb/usb_8dev.c
@@ -401,9 +401,7 @@ static void usb_8dev_rx_err_msg(struct usb_8dev_priv *priv,
                 tx_errors = 1;
                 break;
         case USB_8DEV_STATUSMSG_CRC:
-                cf->data[2] |= CAN_ERR_PROT_UNSPEC;
-                cf->data[3] |= CAN_ERR_PROT_LOC_CRC_SEQ |
-                               CAN_ERR_PROT_LOC_CRC_DEL;
+                cf->data[3] = CAN_ERR_PROT_LOC_CRC_SEQ;
                 rx_errors = 1;
                 break;
         case USB_8DEV_STATUSMSG_BIT0:
diff --git a/drivers/net/can/xilinx_can.c b/drivers/net/can/xilinx_can.c
index fc55e8e0351d..51670b322409 100644
--- a/drivers/net/can/xilinx_can.c
+++ b/drivers/net/can/xilinx_can.c
@@ -608,17 +608,15 @@ static void xcan_err_interrupt(struct net_device *ndev, u32 isr)
 
         /* Check for error interrupt */
         if (isr & XCAN_IXR_ERROR_MASK) {
-                if (skb) {
+                if (skb)
                         cf->can_id |= CAN_ERR_PROT | CAN_ERR_BUSERROR;
-                        cf->data[2] |= CAN_ERR_PROT_UNSPEC;
-                }
 
                 /* Check for Ack error interrupt */
                 if (err_status & XCAN_ESR_ACKER_MASK) {
                         stats->tx_errors++;
                         if (skb) {
                                 cf->can_id |= CAN_ERR_ACK;
-                                cf->data[3] |= CAN_ERR_PROT_LOC_ACK;
+                                cf->data[3] = CAN_ERR_PROT_LOC_ACK;
                         }
                 }
 
@@ -654,8 +652,7 @@ static void xcan_err_interrupt(struct net_device *ndev, u32 isr)
                         stats->rx_errors++;
                         if (skb) {
                                 cf->can_id |= CAN_ERR_PROT;
-                                cf->data[3] = CAN_ERR_PROT_LOC_CRC_SEQ |
-                                                CAN_ERR_PROT_LOC_CRC_DEL;
+                                cf->data[3] = CAN_ERR_PROT_LOC_CRC_SEQ;
                         }
                 }
                         priv->can.can_stats.bus_error++;
diff --git a/drivers/net/ethernet/Kconfig b/drivers/net/ethernet/Kconfig
index 955d06b9cdba..31c5e476fd64 100644
--- a/drivers/net/ethernet/Kconfig
+++ b/drivers/net/ethernet/Kconfig
@@ -29,6 +29,7 @@ source "drivers/net/ethernet/apm/Kconfig"
 source "drivers/net/ethernet/apple/Kconfig"
 source "drivers/net/ethernet/arc/Kconfig"
 source "drivers/net/ethernet/atheros/Kconfig"
+source "drivers/net/ethernet/aurora/Kconfig"
 source "drivers/net/ethernet/cadence/Kconfig"
 source "drivers/net/ethernet/adi/Kconfig"
 source "drivers/net/ethernet/broadcom/Kconfig"
diff --git a/drivers/net/ethernet/Makefile b/drivers/net/ethernet/Makefile
index 4a2ee98738f0..071f84eb6f3f 100644
--- a/drivers/net/ethernet/Makefile
+++ b/drivers/net/ethernet/Makefile
@@ -15,6 +15,7 @@ obj-$(CONFIG_NET_XGENE) += apm/
 obj-$(CONFIG_NET_VENDOR_APPLE) += apple/
 obj-$(CONFIG_NET_VENDOR_ARC) += arc/
 obj-$(CONFIG_NET_VENDOR_ATHEROS) += atheros/
+obj-$(CONFIG_NET_VENDOR_AURORA) += aurora/
 obj-$(CONFIG_NET_CADENCE) += cadence/
 obj-$(CONFIG_NET_BFIN) += adi/
 obj-$(CONFIG_NET_VENDOR_BROADCOM) += broadcom/
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-dev.c b/drivers/net/ethernet/amd/xgbe/xgbe-dev.c
index 970781a9e677..f6a7161e3b85 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-dev.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-dev.c
@@ -1849,7 +1849,7 @@ static int xgbe_exit(struct xgbe_prv_data *pdata)
         usleep_range(10, 15);
 
         /* Poll Until Poll Condition */
-        while (count-- && XGMAC_IOREAD_BITS(pdata, DMA_MR, SWR))
+        while (--count && XGMAC_IOREAD_BITS(pdata, DMA_MR, SWR))
                 usleep_range(500, 600);
 
         if (!count)
@@ -1873,7 +1873,7 @@ static int xgbe_flush_tx_queues(struct xgbe_prv_data *pdata)
         /* Poll Until Poll Condition */
         for (i = 0; i < pdata->tx_q_count; i++) {
                 count = 2000;
-                while (count-- && XGMAC_MTL_IOREAD_BITS(pdata, i,
+                while (--count && XGMAC_MTL_IOREAD_BITS(pdata, i,
                                                         MTL_Q_TQOMR, FTQ))
                         usleep_range(500, 600);
 
diff --git a/drivers/net/ethernet/apm/xgene/xgene_enet_main.c b/drivers/net/ethernet/apm/xgene/xgene_enet_main.c
index 991412ce6f48..d0ae1a6cc212 100644
--- a/drivers/net/ethernet/apm/xgene/xgene_enet_main.c
+++ b/drivers/net/ethernet/apm/xgene/xgene_enet_main.c
@@ -289,6 +289,7 @@ static int xgene_enet_setup_tx_desc(struct xgene_enet_desc_ring *tx_ring,
                                     struct sk_buff *skb)
 {
         struct device *dev = ndev_to_dev(tx_ring->ndev);
+        struct xgene_enet_pdata *pdata = netdev_priv(tx_ring->ndev);
         struct xgene_enet_raw_desc *raw_desc;
         __le64 *exp_desc = NULL, *exp_bufs = NULL;
         dma_addr_t dma_addr, pbuf_addr, *frag_dma_addr;
@@ -419,6 +420,7 @@ out:
         raw_desc->m0 = cpu_to_le64(SET_VAL(LL, ll) | SET_VAL(NV, nv) |
                                    SET_VAL(USERINFO, tx_ring->tail));
         tx_ring->cp_ring->cp_skb[tx_ring->tail] = skb;
+        pdata->tx_level += count;
         tx_ring->tail = tail;
 
         return count;
@@ -429,14 +431,13 @@ static netdev_tx_t xgene_enet_start_xmit(struct sk_buff *skb,
 {
         struct xgene_enet_pdata *pdata = netdev_priv(ndev);
         struct xgene_enet_desc_ring *tx_ring = pdata->tx_ring;
-        struct xgene_enet_desc_ring *cp_ring = tx_ring->cp_ring;
-        u32 tx_level, cq_level;
+        u32 tx_level = pdata->tx_level;
         int count;
 
-        tx_level = pdata->ring_ops->len(tx_ring);
-        cq_level = pdata->ring_ops->len(cp_ring);
-        if (unlikely(tx_level > pdata->tx_qcnt_hi ||
-                     cq_level > pdata->cp_qcnt_hi)) {
+        if (tx_level < pdata->txc_level)
+                tx_level += ((typeof(pdata->tx_level))~0U);
+
+        if ((tx_level - pdata->txc_level) > pdata->tx_qcnt_hi) {
                 netif_stop_queue(ndev);
                 return NETDEV_TX_BUSY;
         }
@@ -450,12 +451,12 @@ static netdev_tx_t xgene_enet_start_xmit(struct sk_buff *skb,
                 return NETDEV_TX_OK;
         }
 
-        pdata->ring_ops->wr_cmd(tx_ring, count);
         skb_tx_timestamp(skb);
 
         pdata->stats.tx_packets++;
         pdata->stats.tx_bytes += skb->len;
 
+        pdata->ring_ops->wr_cmd(tx_ring, count);
         return NETDEV_TX_OK;
 }
 
@@ -539,10 +540,13 @@ static int xgene_enet_process_ring(struct xgene_enet_desc_ring *ring,
         struct xgene_enet_raw_desc *raw_desc, *exp_desc;
         u16 head = ring->head;
         u16 slots = ring->slots - 1;
-        int ret, count = 0, processed = 0;
+        int ret, desc_count, count = 0, processed = 0;
+        bool is_completion;
 
         do {
                 raw_desc = &ring->raw_desc[head];
+                desc_count = 0;
+                is_completion = false;
                 exp_desc = NULL;
                 if (unlikely(xgene_enet_is_desc_slot_empty(raw_desc)))
                         break;
@@ -559,18 +563,24 @@ static int xgene_enet_process_ring(struct xgene_enet_desc_ring *ring,
                         }
                         dma_rmb();
                         count++;
+                        desc_count++;
                 }
-                if (is_rx_desc(raw_desc))
+                if (is_rx_desc(raw_desc)) {
                         ret = xgene_enet_rx_frame(ring, raw_desc);
-                else
+                } else {
                         ret = xgene_enet_tx_completion(ring, raw_desc);
+                        is_completion = true;
+                }
                 xgene_enet_mark_desc_slot_empty(raw_desc);
                 if (exp_desc)
                         xgene_enet_mark_desc_slot_empty(exp_desc);
 
                 head = (head + 1) & slots;
                 count++;
+                desc_count++;
                 processed++;
+                if (is_completion)
+                        pdata->txc_level += desc_count;
 
                 if (ret)
                         break;
@@ -580,10 +590,8 @@ static int xgene_enet_process_ring(struct xgene_enet_desc_ring *ring,
                 pdata->ring_ops->wr_cmd(ring, -count);
                 ring->head = head;
 
-                if (netif_queue_stopped(ring->ndev)) {
-                        if (pdata->ring_ops->len(ring) < pdata->cp_qcnt_low)
-                                netif_wake_queue(ring->ndev);
-                }
+                if (netif_queue_stopped(ring->ndev))
+                        netif_start_queue(ring->ndev);
         }
 
         return processed;
@@ -688,10 +696,10 @@ static int xgene_enet_open(struct net_device *ndev)
         mac_ops->tx_enable(pdata);
         mac_ops->rx_enable(pdata);
 
+        xgene_enet_napi_enable(pdata);
         ret = xgene_enet_register_irq(ndev);
         if (ret)
                 return ret;
-        xgene_enet_napi_enable(pdata);
 
         if (pdata->phy_mode == PHY_INTERFACE_MODE_RGMII)
                 phy_start(pdata->phy_dev);
@@ -715,13 +723,13 @@ static int xgene_enet_close(struct net_device *ndev)
         else
                 cancel_delayed_work_sync(&pdata->link_work);
 
-        xgene_enet_napi_disable(pdata);
-        xgene_enet_free_irq(ndev);
-        xgene_enet_process_ring(pdata->rx_ring, -1);
-
         mac_ops->tx_disable(pdata);
         mac_ops->rx_disable(pdata);
 
+        xgene_enet_free_irq(ndev);
+        xgene_enet_napi_disable(pdata);
+        xgene_enet_process_ring(pdata->rx_ring, -1);
+
         return 0;
 }
 
@@ -1033,9 +1041,7 @@ static int xgene_enet_create_desc_rings(struct net_device *ndev)
         pdata->tx_ring->cp_ring = cp_ring;
         pdata->tx_ring->dst_ring_num = xgene_enet_dst_ring_num(cp_ring);
 
-        pdata->tx_qcnt_hi = pdata->tx_ring->slots / 2;
-        pdata->cp_qcnt_hi = pdata->rx_ring->slots / 2;
-        pdata->cp_qcnt_low = pdata->cp_qcnt_hi / 2;
+        pdata->tx_qcnt_hi = pdata->tx_ring->slots - 128;
 
         return 0;
 
@@ -1474,15 +1480,15 @@ static int xgene_enet_probe(struct platform_device *pdev)
         }
         ndev->hw_features = ndev->features;
 
-        ret = register_netdev(ndev);
+        ret = dma_coerce_mask_and_coherent(dev, DMA_BIT_MASK(64));
         if (ret) {
-                netdev_err(ndev, "Failed to register netdev\n");
+                netdev_err(ndev, "No usable DMA configuration\n");
                 goto err;
         }
 
-        ret = dma_coerce_mask_and_coherent(dev, DMA_BIT_MASK(64));
+        ret = register_netdev(ndev);
         if (ret) {
-                netdev_err(ndev, "No usable DMA configuration\n");
+                netdev_err(ndev, "Failed to register netdev\n");
                 goto err;
         }
 
@@ -1490,14 +1496,17 @@ static int xgene_enet_probe(struct platform_device *pdev)
         if (ret)
                 goto err;
 
-        xgene_enet_napi_add(pdata);
         mac_ops = pdata->mac_ops;
-        if (pdata->phy_mode == PHY_INTERFACE_MODE_RGMII)
+        if (pdata->phy_mode == PHY_INTERFACE_MODE_RGMII) {
                 ret = xgene_enet_mdio_config(pdata);
-        else
+                if (ret)
+                        goto err;
+        } else {
                 INIT_DELAYED_WORK(&pdata->link_work, mac_ops->link_state);
+        }
 
-        return ret;
+        xgene_enet_napi_add(pdata);
+        return 0;
 err:
         unregister_netdev(ndev);
         free_netdev(ndev);
diff --git a/drivers/net/ethernet/apm/xgene/xgene_enet_main.h b/drivers/net/ethernet/apm/xgene/xgene_enet_main.h
index a6e56b88c0a0..1aa72c787f8d 100644
--- a/drivers/net/ethernet/apm/xgene/xgene_enet_main.h
+++ b/drivers/net/ethernet/apm/xgene/xgene_enet_main.h
@@ -155,11 +155,11 @@ struct xgene_enet_pdata {
         enum xgene_enet_id enet_id;
         struct xgene_enet_desc_ring *tx_ring;
         struct xgene_enet_desc_ring *rx_ring;
+        u16 tx_level;
+        u16 txc_level;
         char *dev_name;
         u32 rx_buff_cnt;
         u32 tx_qcnt_hi;
-        u32 cp_qcnt_hi;
-        u32 cp_qcnt_low;
         u32 rx_irq;
         u32 txc_irq;
         u8 cq_cnt;
diff --git a/drivers/net/ethernet/atheros/alx/main.c b/drivers/net/ethernet/atheros/alx/main.c
index c8af3ce3ea38..bd377a6b067d 100644
--- a/drivers/net/ethernet/atheros/alx/main.c
+++ b/drivers/net/ethernet/atheros/alx/main.c
@@ -1534,6 +1534,8 @@ static const struct pci_device_id alx_pci_tbl[] = {
           .driver_data = ALX_DEV_QUIRK_MSI_INTX_DISABLE_BUG },
         { PCI_VDEVICE(ATTANSIC, ALX_DEV_ID_E2200),
           .driver_data = ALX_DEV_QUIRK_MSI_INTX_DISABLE_BUG },
+        { PCI_VDEVICE(ATTANSIC, ALX_DEV_ID_E2400),
+          .driver_data = ALX_DEV_QUIRK_MSI_INTX_DISABLE_BUG },
         { PCI_VDEVICE(ATTANSIC, ALX_DEV_ID_AR8162),
           .driver_data = ALX_DEV_QUIRK_MSI_INTX_DISABLE_BUG },
         { PCI_VDEVICE(ATTANSIC, ALX_DEV_ID_AR8171) },
diff --git a/drivers/net/ethernet/atheros/alx/reg.h b/drivers/net/ethernet/atheros/alx/reg.h
index af006b44b2a6..0959e6824cb6 100644
--- a/drivers/net/ethernet/atheros/alx/reg.h
+++ b/drivers/net/ethernet/atheros/alx/reg.h
@@ -37,6 +37,7 @@
 
 #define ALX_DEV_ID_AR8161                               0x1091
 #define ALX_DEV_ID_E2200                                0xe091
+#define ALX_DEV_ID_E2400                                0xe0a1
 #define ALX_DEV_ID_AR8162                               0x1090
 #define ALX_DEV_ID_AR8171                               0x10A1
 #define ALX_DEV_ID_AR8172                               0x10A0
diff --git a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
index 2795d6db10e1..8b5988e210d5 100644
--- a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
+++ b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
@@ -1016,13 +1016,12 @@ static int atl1c_setup_ring_resources(struct atl1c_adapter *adapter)
                 sizeof(struct atl1c_recv_ret_status) * rx_desc_count +
                 8 * 4;
 
-        ring_header->desc = pci_alloc_consistent(pdev, ring_header->size,
-                                &ring_header->dma);
+        ring_header->desc = dma_zalloc_coherent(&pdev->dev, ring_header->size,
+                                                &ring_header->dma, GFP_KERNEL);
         if (unlikely(!ring_header->desc)) {
-                dev_err(&pdev->dev, "pci_alloc_consistend failed\n");
+                dev_err(&pdev->dev, "could not get memory for DMA buffer\n");
                 goto err_nomem;
         }
-        memset(ring_header->desc, 0, ring_header->size);
         /* init TPD ring */
 
         tpd_ring[0].dma = roundup(ring_header->dma, 8);
diff --git a/drivers/net/ethernet/aurora/Kconfig b/drivers/net/ethernet/aurora/Kconfig
new file mode 100644
index 000000000000..8ba7f8ff3434
--- /dev/null
+++ b/drivers/net/ethernet/aurora/Kconfig
@@ -0,0 +1,21 @@
+config NET_VENDOR_AURORA
+        bool "Aurora VLSI devices"
+        help
+          If you have a network (Ethernet) device belonging to this class,
+          say Y.
+
+          Note that the answer to this question doesn't directly affect the
+          kernel: saying N will just cause the configurator to skip all
+          questions about Aurora devices. If you say Y, you will be asked
+          for your specific device in the following questions.
+
+if NET_VENDOR_AURORA
+
+config AURORA_NB8800
+        tristate "Aurora AU-NB8800 support"
+        depends on HAS_DMA
+        select PHYLIB
+        help
+         Support for the AU-NB8800 gigabit Ethernet controller.
+
+endif
diff --git a/drivers/net/ethernet/aurora/Makefile b/drivers/net/ethernet/aurora/Makefile
new file mode 100644
index 000000000000..6cb528a2fc26
--- /dev/null
+++ b/drivers/net/ethernet/aurora/Makefile
@@ -0,0 +1 @@
+obj-$(CONFIG_AURORA_NB8800) += nb8800.o
diff --git a/drivers/net/ethernet/aurora/nb8800.c b/drivers/net/ethernet/aurora/nb8800.c
new file mode 100644
index 000000000000..ecc4a334c507
--- /dev/null
+++ b/drivers/net/ethernet/aurora/nb8800.c
@@ -0,0 +1,1552 @@
+/*
+ * Copyright (C) 2015 Mans Rullgard <mans@mansr.com>
+ *
+ * Mostly rewritten, based on driver from Sigma Designs.  Original
+ * copyright notice below.
+ *
+ *
+ * Driver for tangox SMP864x/SMP865x/SMP867x/SMP868x builtin Ethernet Mac.
+ *
+ * Copyright (C) 2005 Maxime Bizon <mbizon@freebox.fr>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include <linux/module.h>
+#include <linux/etherdevice.h>
+#include <linux/delay.h>
+#include <linux/ethtool.h>
+#include <linux/interrupt.h>
+#include <linux/platform_device.h>
+#include <linux/of_device.h>
+#include <linux/of_mdio.h>
+#include <linux/of_net.h>
+#include <linux/dma-mapping.h>
+#include <linux/phy.h>
+#include <linux/cache.h>
+#include <linux/jiffies.h>
+#include <linux/io.h>
+#include <linux/iopoll.h>
+#include <asm/barrier.h>
+
+#include "nb8800.h"
+
+static void nb8800_tx_done(struct net_device *dev);
+static int nb8800_dma_stop(struct net_device *dev);
+
+static inline u8 nb8800_readb(struct nb8800_priv *priv, int reg)
+{
+        return readb_relaxed(priv->base + reg);
+}
+
+static inline u32 nb8800_readl(struct nb8800_priv *priv, int reg)
+{
+        return readl_relaxed(priv->base + reg);
+}
+
+static inline void nb8800_writeb(struct nb8800_priv *priv, int reg, u8 val)
+{
+        writeb_relaxed(val, priv->base + reg);
+}
+
+static inline void nb8800_writew(struct nb8800_priv *priv, int reg, u16 val)
+{
+        writew_relaxed(val, priv->base + reg);
+}
+
+static inline void nb8800_writel(struct nb8800_priv *priv, int reg, u32 val)
+{
+        writel_relaxed(val, priv->base + reg);
+}
+
+static inline void nb8800_maskb(struct nb8800_priv *priv, int reg,
+                                u32 mask, u32 val)
+{
+        u32 old = nb8800_readb(priv, reg);
+        u32 new = (old & ~mask) | (val & mask);
+
+        if (new != old)
+                nb8800_writeb(priv, reg, new);
+}
+
+static inline void nb8800_maskl(struct nb8800_priv *priv, int reg,
+                                u32 mask, u32 val)
+{
+        u32 old = nb8800_readl(priv, reg);
+        u32 new = (old & ~mask) | (val & mask);
+
+        if (new != old)
+                nb8800_writel(priv, reg, new);
+}
+
+static inline void nb8800_modb(struct nb8800_priv *priv, int reg, u8 bits,
+                               bool set)
+{
+        nb8800_maskb(priv, reg, bits, set ? bits : 0);
+}
+
+static inline void nb8800_setb(struct nb8800_priv *priv, int reg, u8 bits)
+{
+        nb8800_maskb(priv, reg, bits, bits);
+}
+
+static inline void nb8800_clearb(struct nb8800_priv *priv, int reg, u8 bits)
+{
+        nb8800_maskb(priv, reg, bits, 0);
+}
+
+static inline void nb8800_modl(struct nb8800_priv *priv, int reg, u32 bits,
+                               bool set)
+{
+        nb8800_maskl(priv, reg, bits, set ? bits : 0);
+}
+
+static inline void nb8800_setl(struct nb8800_priv *priv, int reg, u32 bits)
+{
+        nb8800_maskl(priv, reg, bits, bits);
+}
+
+static inline void nb8800_clearl(struct nb8800_priv *priv, int reg, u32 bits)
+{
+        nb8800_maskl(priv, reg, bits, 0);
+}
+
+static int nb8800_mdio_wait(struct mii_bus *bus)
+{
+        struct nb8800_priv *priv = bus->priv;
+        u32 val;
+
+        return readl_poll_timeout_atomic(priv->base + NB8800_MDIO_CMD,
+                                         val, !(val & MDIO_CMD_GO), 1, 1000);
+}
+
+static int nb8800_mdio_cmd(struct mii_bus *bus, u32 cmd)
+{
+        struct nb8800_priv *priv = bus->priv;
+        int err;
+
+        err = nb8800_mdio_wait(bus);
+        if (err)
+                return err;
+
+        nb8800_writel(priv, NB8800_MDIO_CMD, cmd);
+        udelay(10);
+        nb8800_writel(priv, NB8800_MDIO_CMD, cmd | MDIO_CMD_GO);
+
+        return nb8800_mdio_wait(bus);
+}
+
+static int nb8800_mdio_read(struct mii_bus *bus, int phy_id, int reg)
+{
+        struct nb8800_priv *priv = bus->priv;
+        u32 val;
+        int err;
+
+        err = nb8800_mdio_cmd(bus, MDIO_CMD_ADDR(phy_id) | MDIO_CMD_REG(reg));
+        if (err)
+                return err;
+
+        val = nb8800_readl(priv, NB8800_MDIO_STS);
+        if (val & MDIO_STS_ERR)
+                return 0xffff;
+
+        return val & 0xffff;
+}
+
+static int nb8800_mdio_write(struct mii_bus *bus, int phy_id, int reg, u16 val)
+{
+        u32 cmd = MDIO_CMD_ADDR(phy_id) | MDIO_CMD_REG(reg) |
+                MDIO_CMD_DATA(val) | MDIO_CMD_WR;
+
+        return nb8800_mdio_cmd(bus, cmd);
+}
+
+static void nb8800_mac_tx(struct net_device *dev, bool enable)
+{
+        struct nb8800_priv *priv = netdev_priv(dev);
+
+        while (nb8800_readl(priv, NB8800_TXC_CR) & TCR_EN)
+                cpu_relax();
+
+        nb8800_modb(priv, NB8800_TX_CTL1, TX_EN, enable);
+}
+
+static void nb8800_mac_rx(struct net_device *dev, bool enable)
+{
+        nb8800_modb(netdev_priv(dev), NB8800_RX_CTL, RX_EN, enable);
+}
+
+static void nb8800_mac_af(struct net_device *dev, bool enable)
+{
+        nb8800_modb(netdev_priv(dev), NB8800_RX_CTL, RX_AF_EN, enable);
+}
+
+static void nb8800_start_rx(struct net_device *dev)
+{
+        nb8800_setl(netdev_priv(dev), NB8800_RXC_CR, RCR_EN);
+}
+
+static int nb8800_alloc_rx(struct net_device *dev, unsigned int i, bool napi)
+{
+        struct nb8800_priv *priv = netdev_priv(dev);
+        struct nb8800_rx_desc *rxd = &priv->rx_descs[i];
+        struct nb8800_rx_buf *rxb = &priv->rx_bufs[i];
+        int size = L1_CACHE_ALIGN(RX_BUF_SIZE);
+        dma_addr_t dma_addr;
+        struct page *page;
+        unsigned long offset;
+        void *data;
+
+        data = napi ? napi_alloc_frag(size) : netdev_alloc_frag(size);
+        if (!data)
+                return -ENOMEM;
+
+        page = virt_to_head_page(data);
+        offset = data - page_address(page);
+
+        dma_addr = dma_map_page(&dev->dev, page, offset, RX_BUF_SIZE,
+                                DMA_FROM_DEVICE);
+
+        if (dma_mapping_error(&dev->dev, dma_addr)) {
+                skb_free_frag(data);
+                return -ENOMEM;
+        }
+
+        rxb->page = page;
+        rxb->offset = offset;
+        rxd->desc.s_addr = dma_addr;
+
+        return 0;
+}
+
+static void nb8800_receive(struct net_device *dev, unsigned int i,
+                           unsigned int len)
+{
+        struct nb8800_priv *priv = netdev_priv(dev);
+        struct nb8800_rx_desc *rxd = &priv->rx_descs[i];
+        struct page *page = priv->rx_bufs[i].page;
+        int offset = priv->rx_bufs[i].offset;
+        void *data = page_address(page) + offset;
+        dma_addr_t dma = rxd->desc.s_addr;
+        struct sk_buff *skb;
+        unsigned int size;
+        int err;
+
+        size = len <= RX_COPYBREAK ? len : RX_COPYHDR;
+
+        skb = napi_alloc_skb(&priv->napi, size);
+        if (!skb) {
+                netdev_err(dev, "rx skb allocation failed\n");
+                dev->stats.rx_dropped++;
+                return;
+        }
+
+        if (len <= RX_COPYBREAK) {
+                dma_sync_single_for_cpu(&dev->dev, dma, len, DMA_FROM_DEVICE);
+                memcpy(skb_put(skb, len), data, len);
+                dma_sync_single_for_device(&dev->dev, dma, len,
+                                           DMA_FROM_DEVICE);
+        } else {
+                err = nb8800_alloc_rx(dev, i, true);
+                if (err) {
+                        netdev_err(dev, "rx buffer allocation failed\n");
+                        dev->stats.rx_dropped++;
+                        return;
+                }
+
+                dma_unmap_page(&dev->dev, dma, RX_BUF_SIZE, DMA_FROM_DEVICE);
+                memcpy(skb_put(skb, RX_COPYHDR), data, RX_COPYHDR);
+                skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, page,
+                                offset + RX_COPYHDR, len - RX_COPYHDR,
+                                RX_BUF_SIZE);
+        }
+
+        skb->protocol = eth_type_trans(skb, dev);
+        napi_gro_receive(&priv->napi, skb);
+}
+
+static void nb8800_rx_error(struct net_device *dev, u32 report)
+{
+        if (report & RX_LENGTH_ERR)
+                dev->stats.rx_length_errors++;
+
+        if (report & RX_FCS_ERR)
+                dev->stats.rx_crc_errors++;
+
+        if (report & RX_FIFO_OVERRUN)
+                dev->stats.rx_fifo_errors++;
+
+        if (report & RX_ALIGNMENT_ERROR)
+                dev->stats.rx_frame_errors++;
+
+        dev->stats.rx_errors++;
+}
+
+static int nb8800_poll(struct napi_struct *napi, int budget)
+{
+        struct net_device *dev = napi->dev;
+        struct nb8800_priv *priv = netdev_priv(dev);
+        struct nb8800_rx_desc *rxd;
+        unsigned int last = priv->rx_eoc;
+        unsigned int next;
+        int work = 0;
+
+        nb8800_tx_done(dev);
+
+again:
+        while (work < budget) {
+                struct nb8800_rx_buf *rxb;
+                unsigned int len;
+
+                next = (last + 1) % RX_DESC_COUNT;
+
+                rxb = &priv->rx_bufs[next];
+                rxd = &priv->rx_descs[next];
+
+                if (!rxd->report)
+                        break;
+
+                len = RX_BYTES_TRANSFERRED(rxd->report);
+
+                if (IS_RX_ERROR(rxd->report))
+                        nb8800_rx_error(dev, rxd->report);
+                else
+                        nb8800_receive(dev, next, len);
+
+                dev->stats.rx_packets++;
+                dev->stats.rx_bytes += len;
+
+                if (rxd->report & RX_MULTICAST_PKT)
+                        dev->stats.multicast++;
+
+                rxd->report = 0;
+                last = next;
+                work++;
+        }
+
+        if (work) {
+                priv->rx_descs[last].desc.config |= DESC_EOC;
+                wmb();  /* ensure new EOC is written before clearing old */
+                priv->rx_descs[priv->rx_eoc].desc.config &= ~DESC_EOC;
+                priv->rx_eoc = last;
+                nb8800_start_rx(dev);
+        }
+
+        if (work < budget) {
+                nb8800_writel(priv, NB8800_RX_ITR, priv->rx_itr_irq);
+
+                /* If a packet arrived after we last checked but
+                 * before writing RX_ITR, the interrupt will be
+                 * delayed, so we retrieve it now.
+                 */
+                if (priv->rx_descs[next].report)
+                        goto again;
+
+                napi_complete_done(napi, work);
+        }
+
+        return work;
+}
+
+static void __nb8800_tx_dma_start(struct net_device *dev)
+{
+        struct nb8800_priv *priv = netdev_priv(dev);
+        struct nb8800_tx_buf *txb;
+        u32 txc_cr;
+
+        txb = &priv->tx_bufs[priv->tx_queue];
+        if (!txb->ready)
+                return;
+
+        txc_cr = nb8800_readl(priv, NB8800_TXC_CR);
+        if (txc_cr & TCR_EN)
+                return;
+
+        nb8800_writel(priv, NB8800_TX_DESC_ADDR, txb->dma_desc);
+        wmb();          /* ensure desc addr is written before starting DMA */
+        nb8800_writel(priv, NB8800_TXC_CR, txc_cr | TCR_EN);
+
+        priv->tx_queue = (priv->tx_queue + txb->chain_len) % TX_DESC_COUNT;
+}
+
+static void nb8800_tx_dma_start(struct net_device *dev)
+{
+        struct nb8800_priv *priv = netdev_priv(dev);
+
+        spin_lock_irq(&priv->tx_lock);
+        __nb8800_tx_dma_start(dev);
+        spin_unlock_irq(&priv->tx_lock);
+}
+
+static void nb8800_tx_dma_start_irq(struct net_device *dev)
+{
+        struct nb8800_priv *priv = netdev_priv(dev);
+
+        spin_lock(&priv->tx_lock);
+        __nb8800_tx_dma_start(dev);
+        spin_unlock(&priv->tx_lock);
+}
+
+static int nb8800_xmit(struct sk_buff *skb, struct net_device *dev)
+{
+        struct nb8800_priv *priv = netdev_priv(dev);
+        struct nb8800_tx_desc *txd;
+        struct nb8800_tx_buf *txb;
+        struct nb8800_dma_desc *desc;
+        dma_addr_t dma_addr;
+        unsigned int dma_len;
+        unsigned int align;
+        unsigned int next;
+
+        if (atomic_read(&priv->tx_free) <= NB8800_DESC_LOW) {
+                netif_stop_queue(dev);
+                return NETDEV_TX_BUSY;
+        }
+
+        align = (8 - (uintptr_t)skb->data) & 7;
+
+        dma_len = skb->len - align;
+        dma_addr = dma_map_single(&dev->dev, skb->data + align,
+                                  dma_len, DMA_TO_DEVICE);
+
+        if (dma_mapping_error(&dev->dev, dma_addr)) {
+                netdev_err(dev, "tx dma mapping error\n");
+                kfree_skb(skb);
+                dev->stats.tx_dropped++;
+                return NETDEV_TX_OK;
+        }
+
+        if (atomic_dec_return(&priv->tx_free) <= NB8800_DESC_LOW) {
+                netif_stop_queue(dev);
+                skb->xmit_more = 0;
+        }
+
+        next = priv->tx_next;
+        txb = &priv->tx_bufs[next];
+        txd = &priv->tx_descs[next];
+        desc = &txd->desc[0];
+
+        next = (next + 1) % TX_DESC_COUNT;
+
+        if (align) {
+                memcpy(txd->buf, skb->data, align);
+
+                desc->s_addr =
+                        txb->dma_desc + offsetof(struct nb8800_tx_desc, buf);
+                desc->n_addr = txb->dma_desc + sizeof(txd->desc[0]);
+                desc->config = DESC_BTS(2) | DESC_DS | align;
+
+                desc++;
+        }
+
+        desc->s_addr = dma_addr;
+        desc->n_addr = priv->tx_bufs[next].dma_desc;
+        desc->config = DESC_BTS(2) | DESC_DS | DESC_EOF | dma_len;
+
+        if (!skb->xmit_more)
+                desc->config |= DESC_EOC;
+
+        txb->skb = skb;
+        txb->dma_addr = dma_addr;
+        txb->dma_len = dma_len;
+
+        if (!priv->tx_chain) {
+                txb->chain_len = 1;
+                priv->tx_chain = txb;
+        } else {
+                priv->tx_chain->chain_len++;
+        }
+
+        netdev_sent_queue(dev, skb->len);
+
+        priv->tx_next = next;
+
+        if (!skb->xmit_more) {
+                smp_wmb();
+                priv->tx_chain->ready = true;
+                priv->tx_chain = NULL;
+                nb8800_tx_dma_start(dev);
+        }
+
+        return NETDEV_TX_OK;
+}
+
+static void nb8800_tx_error(struct net_device *dev, u32 report)
+{
+        if (report & TX_LATE_COLLISION)
+                dev->stats.collisions++;
+
+        if (report & TX_PACKET_DROPPED)
+                dev->stats.tx_dropped++;
+
+        if (report & TX_FIFO_UNDERRUN)
+                dev->stats.tx_fifo_errors++;
+
+        dev->stats.tx_errors++;
+}
+
+static void nb8800_tx_done(struct net_device *dev)
+{
+        struct nb8800_priv *priv = netdev_priv(dev);
+        unsigned int limit = priv->tx_next;
+        unsigned int done = priv->tx_done;
+        unsigned int packets = 0;
+        unsigned int len = 0;
+
+        while (done != limit) {
+                struct nb8800_tx_desc *txd = &priv->tx_descs[done];
+                struct nb8800_tx_buf *txb = &priv->tx_bufs[done];
+                struct sk_buff *skb;
+
+                if (!txd->report)
+                        break;
+
+                skb = txb->skb;
+                len += skb->len;
+
+                dma_unmap_single(&dev->dev, txb->dma_addr, txb->dma_len,
+                                 DMA_TO_DEVICE);
+
+                if (IS_TX_ERROR(txd->report)) {
+                        nb8800_tx_error(dev, txd->report);
+                        kfree_skb(skb);
+                } else {
+                        consume_skb(skb);
+                }
+
+                dev->stats.tx_packets++;
+                dev->stats.tx_bytes += TX_BYTES_TRANSFERRED(txd->report);
+                dev->stats.collisions += TX_EARLY_COLLISIONS(txd->report);
+
+                txb->skb = NULL;
+                txb->ready = false;
+                txd->report = 0;
+
+                done = (done + 1) % TX_DESC_COUNT;
+                packets++;
+        }
+
+        if (packets) {
+                smp_mb__before_atomic();
+                atomic_add(packets, &priv->tx_free);
+                netdev_completed_queue(dev, packets, len);
+                netif_wake_queue(dev);
+                priv->tx_done = done;
+        }
+}
+
+static irqreturn_t nb8800_irq(int irq, void *dev_id)
+{
+        struct net_device *dev = dev_id;
+        struct nb8800_priv *priv = netdev_priv(dev);
+        irqreturn_t ret = IRQ_NONE;
+        u32 val;
+
+        /* tx interrupt */
+        val = nb8800_readl(priv, NB8800_TXC_SR);
+        if (val) {
+                nb8800_writel(priv, NB8800_TXC_SR, val);
+
+                if (val & TSR_DI)
+                        nb8800_tx_dma_start_irq(dev);
+
+                if (val & TSR_TI)
+                        napi_schedule_irqoff(&priv->napi);
+
+                if (unlikely(val & TSR_DE))
+                        netdev_err(dev, "TX DMA error\n");
+
+                /* should never happen with automatic status retrieval */
+                if (unlikely(val & TSR_TO))
+                        netdev_err(dev, "TX Status FIFO overflow\n");
+
+                ret = IRQ_HANDLED;
+        }
+
+        /* rx interrupt */
+        val = nb8800_readl(priv, NB8800_RXC_SR);
+        if (val) {
+                nb8800_writel(priv, NB8800_RXC_SR, val);
+
+                if (likely(val & (RSR_RI | RSR_DI))) {
+                        nb8800_writel(priv, NB8800_RX_ITR, priv->rx_itr_poll);
+                        napi_schedule_irqoff(&priv->napi);
+                }
+
+                if (unlikely(val & RSR_DE))
+                        netdev_err(dev, "RX DMA error\n");
+
+                /* should never happen with automatic status retrieval */
+                if (unlikely(val & RSR_RO))
+                        netdev_err(dev, "RX Status FIFO overflow\n");
+
+                ret = IRQ_HANDLED;
+        }
+
+        return ret;
+}
+
+static void nb8800_mac_config(struct net_device *dev)
+{
+        struct nb8800_priv *priv = netdev_priv(dev);
+        bool gigabit = priv->speed == SPEED_1000;
+        u32 mac_mode_mask = RGMII_MODE | HALF_DUPLEX | GMAC_MODE;
+        u32 mac_mode = 0;
+        u32 slot_time;
+        u32 phy_clk;
+        u32 ict;
+
+        if (!priv->duplex)
+                mac_mode |= HALF_DUPLEX;
+
+        if (gigabit) {
+                if (priv->phy_mode == PHY_INTERFACE_MODE_RGMII)
+                        mac_mode |= RGMII_MODE;
+
+                mac_mode |= GMAC_MODE;
+                phy_clk = 125000000;
+
+                /* Should be 512 but register is only 8 bits */
+                slot_time = 255;
+        } else {
+                phy_clk = 25000000;
+                slot_time = 128;
+        }
+
+        ict = DIV_ROUND_UP(phy_clk, clk_get_rate(priv->clk));
+
+        nb8800_writeb(priv, NB8800_IC_THRESHOLD, ict);
+        nb8800_writeb(priv, NB8800_SLOT_TIME, slot_time);
+        nb8800_maskb(priv, NB8800_MAC_MODE, mac_mode_mask, mac_mode);
+}
+
+static void nb8800_pause_config(struct net_device *dev)
+{
+        struct nb8800_priv *priv = netdev_priv(dev);
+        struct phy_device *phydev = priv->phydev;
+        u32 rxcr;
+
+        if (priv->pause_aneg) {
+                if (!phydev || !phydev->link)
+                        return;
+
+                priv->pause_rx = phydev->pause;
+                priv->pause_tx = phydev->pause ^ phydev->asym_pause;
+        }
+
+        nb8800_modb(priv, NB8800_RX_CTL, RX_PAUSE_EN, priv->pause_rx);
+
+        rxcr = nb8800_readl(priv, NB8800_RXC_CR);
+        if (!!(rxcr & RCR_FL) == priv->pause_tx)
+                return;
+
+        if (netif_running(dev)) {
+                napi_disable(&priv->napi);
+                netif_tx_lock_bh(dev);
+                nb8800_dma_stop(dev);
+                nb8800_modl(priv, NB8800_RXC_CR, RCR_FL, priv->pause_tx);
+                nb8800_start_rx(dev);
+                netif_tx_unlock_bh(dev);
+                napi_enable(&priv->napi);
+        } else {
+                nb8800_modl(priv, NB8800_RXC_CR, RCR_FL, priv->pause_tx);
+        }
+}
+
+static void nb8800_link_reconfigure(struct net_device *dev)
+{
+        struct nb8800_priv *priv = netdev_priv(dev);
+        struct phy_device *phydev = priv->phydev;
+        int change = 0;
+
+        if (phydev->link) {
+                if (phydev->speed != priv->speed) {
+                        priv->speed = phydev->speed;
+                        change = 1;
+                }
+
+                if (phydev->duplex != priv->duplex) {
+                        priv->duplex = phydev->duplex;
+                        change = 1;
+                }
+
+                if (change)
+                        nb8800_mac_config(dev);
+
+                nb8800_pause_config(dev);
+        }
+
+        if (phydev->link != priv->link) {
+                priv->link = phydev->link;
+                change = 1;
+        }
+
+        if (change)
+                phy_print_status(priv->phydev);
+}
+
+static void nb8800_update_mac_addr(struct net_device *dev)
+{
+        struct nb8800_priv *priv = netdev_priv(dev);
+        int i;
+
+        for (i = 0; i < ETH_ALEN; i++)
+                nb8800_writeb(priv, NB8800_SRC_ADDR(i), dev->dev_addr[i]);
+
+        for (i = 0; i < ETH_ALEN; i++)
+                nb8800_writeb(priv, NB8800_UC_ADDR(i), dev->dev_addr[i]);
+}
+
+static int nb8800_set_mac_address(struct net_device *dev, void *addr)
+{
+        struct sockaddr *sock = addr;
+
+        if (netif_running(dev))
+                return -EBUSY;
+
+        ether_addr_copy(dev->dev_addr, sock->sa_data);
+        nb8800_update_mac_addr(dev);
+
+        return 0;
+}
+
+static void nb8800_mc_init(struct net_device *dev, int val)
+{
+        struct nb8800_priv *priv = netdev_priv(dev);
+
+        nb8800_writeb(priv, NB8800_MC_INIT, val);
+        readb_poll_timeout_atomic(priv->base + NB8800_MC_INIT, val, !val,
+                                  1, 1000);
+}
+
+static void nb8800_set_rx_mode(struct net_device *dev)
+{
+        struct nb8800_priv *priv = netdev_priv(dev);
+        struct netdev_hw_addr *ha;
+        int i;
+
+        if (dev->flags & (IFF_PROMISC | IFF_ALLMULTI)) {
+                nb8800_mac_af(dev, false);
+                return;
+        }
+
+        nb8800_mac_af(dev, true);
+        nb8800_mc_init(dev, 0);
+
+        netdev_for_each_mc_addr(ha, dev) {
+                for (i = 0; i < ETH_ALEN; i++)
+                        nb8800_writeb(priv, NB8800_MC_ADDR(i), ha->addr[i]);
+
+                nb8800_mc_init(dev, 0xff);
+        }
+}
+
+#define RX_DESC_SIZE (RX_DESC_COUNT * sizeof(struct nb8800_rx_desc))
+#define TX_DESC_SIZE (TX_DESC_COUNT * sizeof(struct nb8800_tx_desc))
+
+static void nb8800_dma_free(struct net_device *dev)
+{
+        struct nb8800_priv *priv = netdev_priv(dev);
+        unsigned int i;
+
+        if (priv->rx_bufs) {
+                for (i = 0; i < RX_DESC_COUNT; i++)
+                        if (priv->rx_bufs[i].page)
+                                put_page(priv->rx_bufs[i].page);
+
+                kfree(priv->rx_bufs);
+                priv->rx_bufs = NULL;
+        }
+
+        if (priv->tx_bufs) {
+                for (i = 0; i < TX_DESC_COUNT; i++)
+                        kfree_skb(priv->tx_bufs[i].skb);
+
+                kfree(priv->tx_bufs);
+                priv->tx_bufs = NULL;
+        }
+
+        if (priv->rx_descs) {
+                dma_free_coherent(dev->dev.parent, RX_DESC_SIZE, priv->rx_descs,
+                                  priv->rx_desc_dma);
+                priv->rx_descs = NULL;
+        }
+
+        if (priv->tx_descs) {
+                dma_free_coherent(dev->dev.parent, TX_DESC_SIZE, priv->tx_descs,
+                                  priv->tx_desc_dma);
+                priv->tx_descs = NULL;
+        }
+}
+
+static void nb8800_dma_reset(struct net_device *dev)
+{
+        struct nb8800_priv *priv = netdev_priv(dev);
+        struct nb8800_rx_desc *rxd;
+        struct nb8800_tx_desc *txd;
+        unsigned int i;
+
+        for (i = 0; i < RX_DESC_COUNT; i++) {
+                dma_addr_t rx_dma = priv->rx_desc_dma + i * sizeof(*rxd);
+
+                rxd = &priv->rx_descs[i];
+                rxd->desc.n_addr = rx_dma + sizeof(*rxd);
+                rxd->desc.r_addr =
+                        rx_dma + offsetof(struct nb8800_rx_desc, report);
+                rxd->desc.config = priv->rx_dma_config;
+                rxd->report = 0;
+        }
+
+        rxd->desc.n_addr = priv->rx_desc_dma;
+        rxd->desc.config |= DESC_EOC;
+
+        priv->rx_eoc = RX_DESC_COUNT - 1;
+
+        for (i = 0; i < TX_DESC_COUNT; i++) {
+                struct nb8800_tx_buf *txb = &priv->tx_bufs[i];
+                dma_addr_t r_dma = txb->dma_desc +
+                        offsetof(struct nb8800_tx_desc, report);
+
+                txd = &priv->tx_descs[i];
+                txd->desc[0].r_addr = r_dma;
+                txd->desc[1].r_addr = r_dma;
+                txd->report = 0;
+        }
+
+        priv->tx_next = 0;
+        priv->tx_queue = 0;
+        priv->tx_done = 0;
+        atomic_set(&priv->tx_free, TX_DESC_COUNT);
+
+        nb8800_writel(priv, NB8800_RX_DESC_ADDR, priv->rx_desc_dma);
+
+        wmb();          /* ensure all setup is written before starting */
+}
+
+static int nb8800_dma_init(struct net_device *dev)
+{
+        struct nb8800_priv *priv = netdev_priv(dev);
+        unsigned int n_rx = RX_DESC_COUNT;
+        unsigned int n_tx = TX_DESC_COUNT;
+        unsigned int i;
+        int err;
+
+        priv->rx_descs = dma_alloc_coherent(dev->dev.parent, RX_DESC_SIZE,
+                                            &priv->rx_desc_dma, GFP_KERNEL);
+        if (!priv->rx_descs)
+                goto err_out;
+
+        priv->rx_bufs = kcalloc(n_rx, sizeof(*priv->rx_bufs), GFP_KERNEL);
+        if (!priv->rx_bufs)
+                goto err_out;
+
+        for (i = 0; i < n_rx; i++) {
+                err = nb8800_alloc_rx(dev, i, false);
+                if (err)
+                        goto err_out;
+        }
+
+        priv->tx_descs = dma_alloc_coherent(dev->dev.parent, TX_DESC_SIZE,
+                                            &priv->tx_desc_dma, GFP_KERNEL);
+        if (!priv->tx_descs)
+                goto err_out;
+
+        priv->tx_bufs = kcalloc(n_tx, sizeof(*priv->tx_bufs), GFP_KERNEL);
+        if (!priv->tx_bufs)
+                goto err_out;
+
+        for (i = 0; i < n_tx; i++)
+                priv->tx_bufs[i].dma_desc =
+                        priv->tx_desc_dma + i * sizeof(struct nb8800_tx_desc);
+
+        nb8800_dma_reset(dev);
+
+        return 0;
+
+err_out:
+        nb8800_dma_free(dev);
+
+        return -ENOMEM;
+}
+
+static int nb8800_dma_stop(struct net_device *dev)
+{
+        struct nb8800_priv *priv = netdev_priv(dev);
+        struct nb8800_tx_buf *txb = &priv->tx_bufs[0];
+        struct nb8800_tx_desc *txd = &priv->tx_descs[0];
+        int retry = 5;
+        u32 txcr;
+        u32 rxcr;
+        int err;
+        unsigned int i;
+
+        /* wait for tx to finish */
+        err = readl_poll_timeout_atomic(priv->base + NB8800_TXC_CR, txcr,
+                                        !(txcr & TCR_EN) &&
+                                        priv->tx_done == priv->tx_next,
+                                        1000, 1000000);
+        if (err)
+                return err;
+
+        /* The rx DMA only stops if it reaches the end of chain.
+         * To make this happen, we set the EOC flag on all rx
+         * descriptors, put the device in loopback mode, and send
+         * a few dummy frames.  The interrupt handler will ignore
+         * these since NAPI is disabled and no real frames are in
+         * the tx queue.
+         */
+
+        for (i = 0; i < RX_DESC_COUNT; i++)
+                priv->rx_descs[i].desc.config |= DESC_EOC;
+
+        txd->desc[0].s_addr =
+                txb->dma_desc + offsetof(struct nb8800_tx_desc, buf);
+        txd->desc[0].config = DESC_BTS(2) | DESC_DS | DESC_EOF | DESC_EOC | 8;
+        memset(txd->buf, 0, sizeof(txd->buf));
+
+        nb8800_mac_af(dev, false);
+        nb8800_setb(priv, NB8800_MAC_MODE, LOOPBACK_EN);
+
+        do {
+                nb8800_writel(priv, NB8800_TX_DESC_ADDR, txb->dma_desc);
+                wmb();
+                nb8800_writel(priv, NB8800_TXC_CR, txcr | TCR_EN);
+
+                err = readl_poll_timeout_atomic(priv->base + NB8800_RXC_CR,
+                                                rxcr, !(rxcr & RCR_EN),
+                                                1000, 100000);
+        } while (err && --retry);
+
+        nb8800_mac_af(dev, true);
+        nb8800_clearb(priv, NB8800_MAC_MODE, LOOPBACK_EN);
+        nb8800_dma_reset(dev);
+
+        return retry ? 0 : -ETIMEDOUT;
+}
+
+static void nb8800_pause_adv(struct net_device *dev)
+{
+        struct nb8800_priv *priv = netdev_priv(dev);
+        u32 adv = 0;
+
+        if (!priv->phydev)
+                return;
+
+        if (priv->pause_rx)
+                adv |= ADVERTISED_Pause | ADVERTISED_Asym_Pause;
+        if (priv->pause_tx)
+                adv ^= ADVERTISED_Asym_Pause;
+
+        priv->phydev->supported |= adv;
+        priv->phydev->advertising |= adv;
+}
+
+static int nb8800_open(struct net_device *dev)
+{
+        struct nb8800_priv *priv = netdev_priv(dev);
+        int err;
+
+        /* clear any pending interrupts */
+        nb8800_writel(priv, NB8800_RXC_SR, 0xf);
+        nb8800_writel(priv, NB8800_TXC_SR, 0xf);
+
+        err = nb8800_dma_init(dev);
+        if (err)
+                return err;
+
+        err = request_irq(dev->irq, nb8800_irq, 0, dev_name(&dev->dev), dev);
+        if (err)
+                goto err_free_dma;
+
+        nb8800_mac_rx(dev, true);
+        nb8800_mac_tx(dev, true);
+
+        priv->phydev = of_phy_connect(dev, priv->phy_node,
+                                      nb8800_link_reconfigure, 0,
+                                      priv->phy_mode);
+        if (!priv->phydev)
+                goto err_free_irq;
+
+        nb8800_pause_adv(dev);
+
+        netdev_reset_queue(dev);
+        napi_enable(&priv->napi);
+        netif_start_queue(dev);
+
+        nb8800_start_rx(dev);
+        phy_start(priv->phydev);
+
+        return 0;
+
+err_free_irq:
+        free_irq(dev->irq, dev);
+err_free_dma:
+        nb8800_dma_free(dev);
+
+        return err;
+}
+
+static int nb8800_stop(struct net_device *dev)
+{
+        struct nb8800_priv *priv = netdev_priv(dev);
+
+        phy_stop(priv->phydev);
+
+        netif_stop_queue(dev);
+        napi_disable(&priv->napi);
+
+        nb8800_dma_stop(dev);
+        nb8800_mac_rx(dev, false);
+        nb8800_mac_tx(dev, false);
+
+        phy_disconnect(priv->phydev);
+        priv->phydev = NULL;
+
+        free_irq(dev->irq, dev);
+
+        nb8800_dma_free(dev);
+
+        return 0;
+}
+
+static int nb8800_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
+{
+        struct nb8800_priv *priv = netdev_priv(dev);
+
+        return phy_mii_ioctl(priv->phydev, rq, cmd);
+}
+
+static const struct net_device_ops nb8800_netdev_ops = {
+        .ndo_open               = nb8800_open,
+        .ndo_stop               = nb8800_stop,
+        .ndo_start_xmit         = nb8800_xmit,
+        .ndo_set_mac_address    = nb8800_set_mac_address,
+        .ndo_set_rx_mode        = nb8800_set_rx_mode,
+        .ndo_do_ioctl           = nb8800_ioctl,
+        .ndo_change_mtu         = eth_change_mtu,
+        .ndo_validate_addr      = eth_validate_addr,
+};
+
+static int nb8800_get_settings(struct net_device *dev, struct ethtool_cmd *cmd)
+{
+        struct nb8800_priv *priv = netdev_priv(dev);
+
+        if (!priv->phydev)
+                return -ENODEV;
+
+        return phy_ethtool_gset(priv->phydev, cmd);
+}
+
+static int nb8800_set_settings(struct net_device *dev, struct ethtool_cmd *cmd)
+{
+        struct nb8800_priv *priv = netdev_priv(dev);
+
+        if (!priv->phydev)
+                return -ENODEV;
+
+        return phy_ethtool_sset(priv->phydev, cmd);
+}
+
+static int nb8800_nway_reset(struct net_device *dev)
+{
+        struct nb8800_priv *priv = netdev_priv(dev);
+
+        if (!priv->phydev)
+                return -ENODEV;
+
+        return genphy_restart_aneg(priv->phydev);
+}
+
+static void nb8800_get_pauseparam(struct net_device *dev,
+                                  struct ethtool_pauseparam *pp)
+{
+        struct nb8800_priv *priv = netdev_priv(dev);
+
+        pp->autoneg = priv->pause_aneg;
+        pp->rx_pause = priv->pause_rx;
+        pp->tx_pause = priv->pause_tx;
+}
+
+static int nb8800_set_pauseparam(struct net_device *dev,
+                                 struct ethtool_pauseparam *pp)
+{
+        struct nb8800_priv *priv = netdev_priv(dev);
+
+        priv->pause_aneg = pp->autoneg;
+        priv->pause_rx = pp->rx_pause;
+        priv->pause_tx = pp->tx_pause;
+
+        nb8800_pause_adv(dev);
+
+        if (!priv->pause_aneg)
+                nb8800_pause_config(dev);
+        else if (priv->phydev)
+                phy_start_aneg(priv->phydev);
+
+        return 0;
+}
+
+static const char nb8800_stats_names[][ETH_GSTRING_LEN] = {
+        "rx_bytes_ok",
+        "rx_frames_ok",
+        "rx_undersize_frames",
+        "rx_fragment_frames",
+        "rx_64_byte_frames",
+        "rx_127_byte_frames",
+        "rx_255_byte_frames",
+        "rx_511_byte_frames",
+        "rx_1023_byte_frames",
+        "rx_max_size_frames",
+        "rx_oversize_frames",
+        "rx_bad_fcs_frames",
+        "rx_broadcast_frames",
+        "rx_multicast_frames",
+        "rx_control_frames",
+        "rx_pause_frames",
+        "rx_unsup_control_frames",
+        "rx_align_error_frames",
+        "rx_overrun_frames",
+        "rx_jabber_frames",
+        "rx_bytes",
+        "rx_frames",
+
+        "tx_bytes_ok",
+        "tx_frames_ok",
+        "tx_64_byte_frames",
+        "tx_127_byte_frames",
+        "tx_255_byte_frames",
+        "tx_511_byte_frames",
+        "tx_1023_byte_frames",
+        "tx_max_size_frames",
+        "tx_oversize_frames",
+        "tx_broadcast_frames",
+        "tx_multicast_frames",
+        "tx_control_frames",
+        "tx_pause_frames",
+        "tx_underrun_frames",
+        "tx_single_collision_frames",
+        "tx_multi_collision_frames",
+        "tx_deferred_collision_frames",
+        "tx_late_collision_frames",
+        "tx_excessive_collision_frames",
+        "tx_bytes",
+        "tx_frames",
+        "tx_collisions",
+};
+
+#define NB8800_NUM_STATS ARRAY_SIZE(nb8800_stats_names)
+
+static int nb8800_get_sset_count(struct net_device *dev, int sset)
+{
+        if (sset == ETH_SS_STATS)
+                return NB8800_NUM_STATS;
+
+        return -EOPNOTSUPP;
+}
+
+static void nb8800_get_strings(struct net_device *dev, u32 sset, u8 *buf)
+{
+        if (sset == ETH_SS_STATS)
+                memcpy(buf, &nb8800_stats_names, sizeof(nb8800_stats_names));
+}
+
+static u32 nb8800_read_stat(struct net_device *dev, int index)
+{
+        struct nb8800_priv *priv = netdev_priv(dev);
+
+        nb8800_writeb(priv, NB8800_STAT_INDEX, index);
+
+        return nb8800_readl(priv, NB8800_STAT_DATA);
+}
+
+static void nb8800_get_ethtool_stats(struct net_device *dev,
+                                     struct ethtool_stats *estats, u64 *st)
+{
+        unsigned int i;
+        u32 rx, tx;
+
+        for (i = 0; i < NB8800_NUM_STATS / 2; i++) {
+                rx = nb8800_read_stat(dev, i);
+                tx = nb8800_read_stat(dev, i | 0x80);
+                st[i] = rx;
+                st[i + NB8800_NUM_STATS / 2] = tx;
+        }
+}
+
+static const struct ethtool_ops nb8800_ethtool_ops = {
+        .get_settings           = nb8800_get_settings,
+        .set_settings           = nb8800_set_settings,
+        .nway_reset             = nb8800_nway_reset,
+        .get_link               = ethtool_op_get_link,
+        .get_pauseparam         = nb8800_get_pauseparam,
+        .set_pauseparam         = nb8800_set_pauseparam,
+        .get_sset_count         = nb8800_get_sset_count,
+        .get_strings            = nb8800_get_strings,
+        .get_ethtool_stats      = nb8800_get_ethtool_stats,
+};
+
+static int nb8800_hw_init(struct net_device *dev)
+{
+        struct nb8800_priv *priv = netdev_priv(dev);
+        u32 val;
+
+        val = TX_RETRY_EN | TX_PAD_EN | TX_APPEND_FCS;
+        nb8800_writeb(priv, NB8800_TX_CTL1, val);
+
+        /* Collision retry count */
+        nb8800_writeb(priv, NB8800_TX_CTL2, 5);
+
+        val = RX_PAD_STRIP | RX_AF_EN;
+        nb8800_writeb(priv, NB8800_RX_CTL, val);
+
+        /* Chosen by fair dice roll */
+        nb8800_writeb(priv, NB8800_RANDOM_SEED, 4);
+
+        /* TX cycles per deferral period */
+        nb8800_writeb(priv, NB8800_TX_SDP, 12);
+
+        /* The following three threshold values have been
+         * experimentally determined for good results.
+         */
+
+        /* RX/TX FIFO threshold for partial empty (64-bit entries) */
+        nb8800_writeb(priv, NB8800_PE_THRESHOLD, 0);
+
+        /* RX/TX FIFO threshold for partial full (64-bit entries) */
+        nb8800_writeb(priv, NB8800_PF_THRESHOLD, 255);
+
+        /* Buffer size for transmit (64-bit entries) */
+        nb8800_writeb(priv, NB8800_TX_BUFSIZE, 64);
+
+        /* Configure tx DMA */
+
+        val = nb8800_readl(priv, NB8800_TXC_CR);
+        val &= TCR_LE;          /* keep endian setting */
+        val |= TCR_DM;          /* DMA descriptor mode */
+        val |= TCR_RS;          /* automatically store tx status  */
+        val |= TCR_DIE;         /* interrupt on DMA chain completion */
+        val |= TCR_TFI(7);      /* interrupt after 7 frames transmitted */
+        val |= TCR_BTS(2);      /* 32-byte bus transaction size */
+        nb8800_writel(priv, NB8800_TXC_CR, val);
+
+        /* TX complete interrupt after 10 ms or 7 frames (see above) */
+        val = clk_get_rate(priv->clk) / 100;
+        nb8800_writel(priv, NB8800_TX_ITR, val);
+
+        /* Configure rx DMA */
+
+        val = nb8800_readl(priv, NB8800_RXC_CR);
+        val &= RCR_LE;          /* keep endian setting */
+        val |= RCR_DM;          /* DMA descriptor mode */
+        val |= RCR_RS;          /* automatically store rx status */
+        val |= RCR_DIE;         /* interrupt at end of DMA chain */
+        val |= RCR_RFI(7);      /* interrupt after 7 frames received */
+        val |= RCR_BTS(2);      /* 32-byte bus transaction size */
+        nb8800_writel(priv, NB8800_RXC_CR, val);
+
+        /* The rx interrupt can fire before the DMA has completed
+         * unless a small delay is added.  50 us is hopefully enough.
+         */
+        priv->rx_itr_irq = clk_get_rate(priv->clk) / 20000;
+
+        /* In NAPI poll mode we want to disable interrupts, but the
+         * hardware does not permit this.  Delay 10 ms instead.
+         */
+        priv->rx_itr_poll = clk_get_rate(priv->clk) / 100;
+
+        nb8800_writel(priv, NB8800_RX_ITR, priv->rx_itr_irq);
+
+        priv->rx_dma_config = RX_BUF_SIZE | DESC_BTS(2) | DESC_DS | DESC_EOF;
+
+        /* Flow control settings */
+
+        /* Pause time of 0.1 ms */
+        val = 100000 / 512;
+        nb8800_writeb(priv, NB8800_PQ1, val >> 8);
+        nb8800_writeb(priv, NB8800_PQ2, val & 0xff);
+
+        /* Auto-negotiate by default */
+        priv->pause_aneg = true;
+        priv->pause_rx = true;
+        priv->pause_tx = true;
+
+        nb8800_mc_init(dev, 0);
+
+        return 0;
+}
+
+static int nb8800_tangox_init(struct net_device *dev)
+{
+        struct nb8800_priv *priv = netdev_priv(dev);
+        u32 pad_mode = PAD_MODE_MII;
+
+        switch (priv->phy_mode) {
+        case PHY_INTERFACE_MODE_MII:
+        case PHY_INTERFACE_MODE_GMII:
+                pad_mode = PAD_MODE_MII;
+                break;
+
+        case PHY_INTERFACE_MODE_RGMII:
+                pad_mode = PAD_MODE_RGMII;
+                break;
+
+        case PHY_INTERFACE_MODE_RGMII_TXID:
+                pad_mode = PAD_MODE_RGMII | PAD_MODE_GTX_CLK_DELAY;
+                break;
+
+        default:
+                dev_err(dev->dev.parent, "unsupported phy mode %s\n",
+                        phy_modes(priv->phy_mode));
+                return -EINVAL;
+        }
+
+        nb8800_writeb(priv, NB8800_TANGOX_PAD_MODE, pad_mode);
+
+        return 0;
+}
+
+static int nb8800_tangox_reset(struct net_device *dev)
+{
+        struct nb8800_priv *priv = netdev_priv(dev);
+        int clk_div;
+
+        nb8800_writeb(priv, NB8800_TANGOX_RESET, 0);
+        usleep_range(1000, 10000);
+        nb8800_writeb(priv, NB8800_TANGOX_RESET, 1);
+
+        wmb();          /* ensure reset is cleared before proceeding */
+
+        clk_div = DIV_ROUND_UP(clk_get_rate(priv->clk), 2 * MAX_MDC_CLOCK);
+        nb8800_writew(priv, NB8800_TANGOX_MDIO_CLKDIV, clk_div);
+
+        return 0;
+}
+
+static const struct nb8800_ops nb8800_tangox_ops = {
+        .init   = nb8800_tangox_init,
+        .reset  = nb8800_tangox_reset,
+};
+
+static int nb8800_tango4_init(struct net_device *dev)
+{
+        struct nb8800_priv *priv = netdev_priv(dev);
+        int err;
+
+        err = nb8800_tangox_init(dev);
+        if (err)
+                return err;
+
+        /* On tango4 interrupt on DMA completion per frame works and gives
+         * better performance despite generating more rx interrupts.
+         */
+
+        /* Disable unnecessary interrupt on rx completion */
+        nb8800_clearl(priv, NB8800_RXC_CR, RCR_RFI(7));
+
+        /* Request interrupt on descriptor DMA completion */
+        priv->rx_dma_config |= DESC_ID;
+
+        return 0;
+}
+
+static const struct nb8800_ops nb8800_tango4_ops = {
+        .init   = nb8800_tango4_init,
+        .reset  = nb8800_tangox_reset,
+};
+
+static const struct of_device_id nb8800_dt_ids[] = {
+        {
+                .compatible = "aurora,nb8800",
+        },
+        {
+                .compatible = "sigma,smp8642-ethernet",
+                .data = &nb8800_tangox_ops,
+        },
+        {
+                .compatible = "sigma,smp8734-ethernet",
+                .data = &nb8800_tango4_ops,
+        },
+        { }
+};
+
+static int nb8800_probe(struct platform_device *pdev)
+{
+        const struct of_device_id *match;
+        const struct nb8800_ops *ops = NULL;
+        struct nb8800_priv *priv;
+        struct resource *res;
+        struct net_device *dev;
+        struct mii_bus *bus;
+        const unsigned char *mac;
+        void __iomem *base;
+        int irq;
+        int ret;
+
+        match = of_match_device(nb8800_dt_ids, &pdev->dev);
+        if (match)
+                ops = match->data;
+
+        irq = platform_get_irq(pdev, 0);
+        if (irq <= 0) {
+                dev_err(&pdev->dev, "No IRQ\n");
+                return -EINVAL;
+        }
+
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        base = devm_ioremap_resource(&pdev->dev, res);
+        if (IS_ERR(base))
+                return PTR_ERR(base);
+
+        dev_dbg(&pdev->dev, "AU-NB8800 Ethernet at %pa\n", &res->start);
+
+        dev = alloc_etherdev(sizeof(*priv));
+        if (!dev)
+                return -ENOMEM;
+
+        platform_set_drvdata(pdev, dev);
+        SET_NETDEV_DEV(dev, &pdev->dev);
+
+        priv = netdev_priv(dev);
+        priv->base = base;
+
+        priv->phy_mode = of_get_phy_mode(pdev->dev.of_node);
+        if (priv->phy_mode < 0)
+                priv->phy_mode = PHY_INTERFACE_MODE_RGMII;
+
+        priv->clk = devm_clk_get(&pdev->dev, NULL);
+        if (IS_ERR(priv->clk)) {
+                dev_err(&pdev->dev, "failed to get clock\n");
+                ret = PTR_ERR(priv->clk);
+                goto err_free_dev;
+        }
+
+        ret = clk_prepare_enable(priv->clk);
+        if (ret)
+                goto err_free_dev;
+
+        spin_lock_init(&priv->tx_lock);
+
+        if (ops && ops->reset) {
+                ret = ops->reset(dev);
+                if (ret)
+                        goto err_free_dev;
+        }
+
+        bus = devm_mdiobus_alloc(&pdev->dev);
+        if (!bus) {
+                ret = -ENOMEM;
+                goto err_disable_clk;
+        }
+
+        bus->name = "nb8800-mii";
+        bus->read = nb8800_mdio_read;
+        bus->write = nb8800_mdio_write;
+        bus->parent = &pdev->dev;
+        snprintf(bus->id, MII_BUS_ID_SIZE, "%lx.nb8800-mii",
+                 (unsigned long)res->start);
+        bus->priv = priv;
+
+        ret = of_mdiobus_register(bus, pdev->dev.of_node);
+        if (ret) {
+                dev_err(&pdev->dev, "failed to register MII bus\n");
+                goto err_disable_clk;
+        }
+
+        priv->phy_node = of_parse_phandle(pdev->dev.of_node, "phy-handle", 0);
+        if (!priv->phy_node) {
+                dev_err(&pdev->dev, "no PHY specified\n");
+                ret = -ENODEV;
+                goto err_free_bus;
+        }
+
+        priv->mii_bus = bus;
+
+        ret = nb8800_hw_init(dev);
+        if (ret)
+                goto err_free_bus;
+
+        if (ops && ops->init) {
+                ret = ops->init(dev);
+                if (ret)
+                        goto err_free_bus;
+        }
+
+        dev->netdev_ops = &nb8800_netdev_ops;
+        dev->ethtool_ops = &nb8800_ethtool_ops;
+        dev->flags |= IFF_MULTICAST;
+        dev->irq = irq;
+
+        mac = of_get_mac_address(pdev->dev.of_node);
+        if (mac)
+                ether_addr_copy(dev->dev_addr, mac);
+
+        if (!is_valid_ether_addr(dev->dev_addr))
+                eth_hw_addr_random(dev);
+
+        nb8800_update_mac_addr(dev);
+
+        netif_carrier_off(dev);
+
+        ret = register_netdev(dev);
+        if (ret) {
+                netdev_err(dev, "failed to register netdev\n");
+                goto err_free_dma;
+        }
+
+        netif_napi_add(dev, &priv->napi, nb8800_poll, NAPI_POLL_WEIGHT);
+
+        netdev_info(dev, "MAC address %pM\n", dev->dev_addr);
+
+        return 0;
+
+err_free_dma:
+        nb8800_dma_free(dev);
+err_free_bus:
+        mdiobus_unregister(bus);
+err_disable_clk:
+        clk_disable_unprepare(priv->clk);
+err_free_dev:
+        free_netdev(dev);
+
+        return ret;
+}
+
+static int nb8800_remove(struct platform_device *pdev)
+{
+        struct net_device *ndev = platform_get_drvdata(pdev);
+        struct nb8800_priv *priv = netdev_priv(ndev);
+
+        unregister_netdev(ndev);
+
+        mdiobus_unregister(priv->mii_bus);
+
+        clk_disable_unprepare(priv->clk);
+
+        nb8800_dma_free(ndev);
+        free_netdev(ndev);
+
+        return 0;
+}
+
+static struct platform_driver nb8800_driver = {
+        .driver = {
+                .name           = "nb8800",
+                .of_match_table = nb8800_dt_ids,
+        },
+        .probe  = nb8800_probe,
+        .remove = nb8800_remove,
+};
+
+module_platform_driver(nb8800_driver);
+
+MODULE_DESCRIPTION("Aurora AU-NB8800 Ethernet driver");
+MODULE_AUTHOR("Mans Rullgard <mans@mansr.com>");
+MODULE_LICENSE("GPL");
diff --git a/drivers/net/ethernet/aurora/nb8800.h b/drivers/net/ethernet/aurora/nb8800.h
new file mode 100644
index 000000000000..e5adbc2aac9f
--- /dev/null
+++ b/drivers/net/ethernet/aurora/nb8800.h
@@ -0,0 +1,316 @@
+#ifndef _NB8800_H_
+#define _NB8800_H_
+
+#include <linux/types.h>
+#include <linux/skbuff.h>
+#include <linux/phy.h>
+#include <linux/clk.h>
+#include <linux/bitops.h>
+
+#define RX_DESC_COUNT                   256
+#define TX_DESC_COUNT                   256
+
+#define NB8800_DESC_LOW                 4
+
+#define RX_BUF_SIZE                     1552
+
+#define RX_COPYBREAK                    256
+#define RX_COPYHDR                      128
+
+#define MAX_MDC_CLOCK                   2500000
+
+/* Stargate Solutions SSN8800 core registers */
+#define NB8800_TX_CTL1                  0x000
+#define TX_TPD                          BIT(5)
+#define TX_APPEND_FCS                   BIT(4)
+#define TX_PAD_EN                       BIT(3)
+#define TX_RETRY_EN                     BIT(2)
+#define TX_EN                           BIT(0)
+
+#define NB8800_TX_CTL2                  0x001
+
+#define NB8800_RX_CTL                   0x004
+#define RX_BC_DISABLE                   BIT(7)
+#define RX_RUNT                         BIT(6)
+#define RX_AF_EN                        BIT(5)
+#define RX_PAUSE_EN                     BIT(3)
+#define RX_SEND_CRC                     BIT(2)
+#define RX_PAD_STRIP                    BIT(1)
+#define RX_EN                           BIT(0)
+
+#define NB8800_RANDOM_SEED              0x008
+#define NB8800_TX_SDP                   0x14
+#define NB8800_TX_TPDP1                 0x18
+#define NB8800_TX_TPDP2                 0x19
+#define NB8800_SLOT_TIME                0x1c
+
+#define NB8800_MDIO_CMD                 0x020
+#define MDIO_CMD_GO                     BIT(31)
+#define MDIO_CMD_WR                     BIT(26)
+#define MDIO_CMD_ADDR(x)                ((x) << 21)
+#define MDIO_CMD_REG(x)                 ((x) << 16)
+#define MDIO_CMD_DATA(x)                ((x) <<  0)
+
+#define NB8800_MDIO_STS                 0x024
+#define MDIO_STS_ERR                    BIT(31)
+
+#define NB8800_MC_ADDR(i)               (0x028 + (i))
+#define NB8800_MC_INIT                  0x02e
+#define NB8800_UC_ADDR(i)               (0x03c + (i))
+
+#define NB8800_MAC_MODE                 0x044
+#define RGMII_MODE                      BIT(7)
+#define HALF_DUPLEX                     BIT(4)
+#define BURST_EN                        BIT(3)
+#define LOOPBACK_EN                     BIT(2)
+#define GMAC_MODE                       BIT(0)
+
+#define NB8800_IC_THRESHOLD             0x050
+#define NB8800_PE_THRESHOLD             0x051
+#define NB8800_PF_THRESHOLD             0x052
+#define NB8800_TX_BUFSIZE               0x054
+#define NB8800_FIFO_CTL                 0x056
+#define NB8800_PQ1                      0x060
+#define NB8800_PQ2                      0x061
+#define NB8800_SRC_ADDR(i)              (0x06a + (i))
+#define NB8800_STAT_DATA                0x078
+#define NB8800_STAT_INDEX               0x07c
+#define NB8800_STAT_CLEAR               0x07d
+
+#define NB8800_SLEEP_MODE               0x07e
+#define SLEEP_MODE                      BIT(0)
+
+#define NB8800_WAKEUP                   0x07f
+#define WAKEUP                          BIT(0)
+
+/* Aurora NB8800 host interface registers */
+#define NB8800_TXC_CR                   0x100
+#define TCR_LK                          BIT(12)
+#define TCR_DS                          BIT(11)
+#define TCR_BTS(x)                      (((x) & 0x7) << 8)
+#define TCR_DIE                         BIT(7)
+#define TCR_TFI(x)                      (((x) & 0x7) << 4)
+#define TCR_LE                          BIT(3)
+#define TCR_RS                          BIT(2)
+#define TCR_DM                          BIT(1)
+#define TCR_EN                          BIT(0)
+
+#define NB8800_TXC_SR                   0x104
+#define TSR_DE                          BIT(3)
+#define TSR_DI                          BIT(2)
+#define TSR_TO                          BIT(1)
+#define TSR_TI                          BIT(0)
+
+#define NB8800_TX_SAR                   0x108
+#define NB8800_TX_DESC_ADDR             0x10c
+
+#define NB8800_TX_REPORT_ADDR           0x110
+#define TX_BYTES_TRANSFERRED(x)         (((x) >> 16) & 0xffff)
+#define TX_FIRST_DEFERRAL               BIT(7)
+#define TX_EARLY_COLLISIONS(x)          (((x) >> 3) & 0xf)
+#define TX_LATE_COLLISION               BIT(2)
+#define TX_PACKET_DROPPED               BIT(1)
+#define TX_FIFO_UNDERRUN                BIT(0)
+#define IS_TX_ERROR(r)                  ((r) & 0x07)
+
+#define NB8800_TX_FIFO_SR               0x114
+#define NB8800_TX_ITR                   0x118
+
+#define NB8800_RXC_CR                   0x200
+#define RCR_FL                          BIT(13)
+#define RCR_LK                          BIT(12)
+#define RCR_DS                          BIT(11)
+#define RCR_BTS(x)                      (((x) & 7) << 8)
+#define RCR_DIE                         BIT(7)
+#define RCR_RFI(x)                      (((x) & 7) << 4)
+#define RCR_LE                          BIT(3)
+#define RCR_RS                          BIT(2)
+#define RCR_DM                          BIT(1)
+#define RCR_EN                          BIT(0)
+
+#define NB8800_RXC_SR                   0x204
+#define RSR_DE                          BIT(3)
+#define RSR_DI                          BIT(2)
+#define RSR_RO                          BIT(1)
+#define RSR_RI                          BIT(0)
+
+#define NB8800_RX_SAR                   0x208
+#define NB8800_RX_DESC_ADDR             0x20c
+
+#define NB8800_RX_REPORT_ADDR           0x210
+#define RX_BYTES_TRANSFERRED(x)         (((x) >> 16) & 0xFFFF)
+#define RX_MULTICAST_PKT                BIT(9)
+#define RX_BROADCAST_PKT                BIT(8)
+#define RX_LENGTH_ERR                   BIT(7)
+#define RX_FCS_ERR                      BIT(6)
+#define RX_RUNT_PKT                     BIT(5)
+#define RX_FIFO_OVERRUN                 BIT(4)
+#define RX_LATE_COLLISION               BIT(3)
+#define RX_ALIGNMENT_ERROR              BIT(2)
+#define RX_ERROR_MASK                   0xfc
+#define IS_RX_ERROR(r)                  ((r) & RX_ERROR_MASK)
+
+#define NB8800_RX_FIFO_SR               0x214
+#define NB8800_RX_ITR                   0x218
+
+/* Sigma Designs SMP86xx additional registers */
+#define NB8800_TANGOX_PAD_MODE          0x400
+#define PAD_MODE_MASK                   0x7
+#define PAD_MODE_MII                    0x0
+#define PAD_MODE_RGMII                  0x1
+#define PAD_MODE_GTX_CLK_INV            BIT(3)
+#define PAD_MODE_GTX_CLK_DELAY          BIT(4)
+
+#define NB8800_TANGOX_MDIO_CLKDIV       0x420
+#define NB8800_TANGOX_RESET             0x424
+
+/* Hardware DMA descriptor */
+struct nb8800_dma_desc {
+        u32                             s_addr; /* start address */
+        u32                             n_addr; /* next descriptor address */
+        u32                             r_addr; /* report address */
+        u32                             config;
+} __aligned(8);
+
+#define DESC_ID                         BIT(23)
+#define DESC_EOC                        BIT(22)
+#define DESC_EOF                        BIT(21)
+#define DESC_LK                         BIT(20)
+#define DESC_DS                         BIT(19)
+#define DESC_BTS(x)                     (((x) & 0x7) << 16)
+
+/* DMA descriptor and associated data for rx.
+ * Allocated from coherent memory.
+ */
+struct nb8800_rx_desc {
+        /* DMA descriptor */
+        struct nb8800_dma_desc          desc;
+
+        /* Status report filled in by hardware */
+        u32                             report;
+};
+
+/* Address of buffer on rx ring */
+struct nb8800_rx_buf {
+        struct page                     *page;
+        unsigned long                   offset;
+};
+
+/* DMA descriptors and associated data for tx.
+ * Allocated from coherent memory.
+ */
+struct nb8800_tx_desc {
+        /* DMA descriptor.  The second descriptor is used if packet
+         * data is unaligned.
+         */
+        struct nb8800_dma_desc          desc[2];
+
+        /* Status report filled in by hardware */
+        u32                             report;
+
+        /* Bounce buffer for initial unaligned part of packet */
+        u8                              buf[8] __aligned(8);
+};
+
+/* Packet in tx queue */
+struct nb8800_tx_buf {
+        /* Currently queued skb */
+        struct sk_buff                  *skb;
+
+        /* DMA address of the first descriptor */
+        dma_addr_t                      dma_desc;
+
+        /* DMA address of packet data */
+        dma_addr_t                      dma_addr;
+
+        /* Length of DMA mapping, less than skb->len if alignment
+         * buffer is used.
+         */
+        unsigned int                    dma_len;
+
+        /* Number of packets in chain starting here */
+        unsigned int                    chain_len;
+
+        /* Packet chain ready to be submitted to hardware */
+        bool                            ready;
+};
+
+struct nb8800_priv {
+        struct napi_struct              napi;
+
+        void __iomem                    *base;
+
+        /* RX DMA descriptors */
+        struct nb8800_rx_desc           *rx_descs;
+
+        /* RX buffers referenced by DMA descriptors */
+        struct nb8800_rx_buf            *rx_bufs;
+
+        /* Current end of chain */
+        u32                             rx_eoc;
+
+        /* Value for rx interrupt time register in NAPI interrupt mode */
+        u32                             rx_itr_irq;
+
+        /* Value for rx interrupt time register in NAPI poll mode */
+        u32                             rx_itr_poll;
+
+        /* Value for config field of rx DMA descriptors */
+        u32                             rx_dma_config;
+
+        /* TX DMA descriptors */
+        struct nb8800_tx_desc           *tx_descs;
+
+        /* TX packet queue */
+        struct nb8800_tx_buf            *tx_bufs;
+
+        /* Number of free tx queue entries */
+        atomic_t                        tx_free;
+
+        /* First free tx queue entry */
+        u32                             tx_next;
+
+        /* Next buffer to transmit */
+        u32                             tx_queue;
+
+        /* Start of current packet chain */
+        struct nb8800_tx_buf            *tx_chain;
+
+        /* Next buffer to reclaim */
+        u32                             tx_done;
+
+        /* Lock for DMA activation */
+        spinlock_t                      tx_lock;
+
+        struct mii_bus                  *mii_bus;
+        struct device_node              *phy_node;
+        struct phy_device               *phydev;
+
+        /* PHY connection type from DT */
+        int                             phy_mode;
+
+        /* Current link status */
+        int                             speed;
+        int                             duplex;
+        int                             link;
+
+        /* Pause settings */
+        bool                            pause_aneg;
+        bool                            pause_rx;
+        bool                            pause_tx;
+
+        /* DMA base address of rx descriptors, see rx_descs above */
+        dma_addr_t                      rx_desc_dma;
+
+        /* DMA base address of tx descriptors, see tx_descs above */
+        dma_addr_t                      tx_desc_dma;
+
+        struct clk                      *clk;
+};
+
+struct nb8800_ops {
+        int                             (*init)(struct net_device *dev);
+        int                             (*reset)(struct net_device *dev);
+};
+
+#endif /* _NB8800_H_ */
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
index f8d7a2f06950..c82ab87fcbe8 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -3430,25 +3430,29 @@ static u32 bnx2x_xmit_type(struct bnx2x *bp, struct sk_buff *skb)
         return rc;
 }
 
-#if (MAX_SKB_FRAGS >= MAX_FETCH_BD - 3)
+/* VXLAN: 4 = 1 (for linear data BD) + 3 (2 for PBD and last BD) */
+#define BNX2X_NUM_VXLAN_TSO_WIN_SUB_BDS         4
+
+/* Regular: 3 = 1 (for linear data BD) + 2 (for PBD and last BD) */
+#define BNX2X_NUM_TSO_WIN_SUB_BDS               3
+
+#if (MAX_SKB_FRAGS >= MAX_FETCH_BD - BDS_PER_TX_PKT)
 /* check if packet requires linearization (packet is too fragmented)
    no need to check fragmentation if page size > 8K (there will be no
    violation to FW restrictions) */
 static int bnx2x_pkt_req_lin(struct bnx2x *bp, struct sk_buff *skb,
                              u32 xmit_type)
 {
-        int to_copy = 0;
-        int hlen = 0;
-        int first_bd_sz = 0;
+        int first_bd_sz = 0, num_tso_win_sub = BNX2X_NUM_TSO_WIN_SUB_BDS;
+        int to_copy = 0, hlen = 0;
 
-        /* 3 = 1 (for linear data BD) + 2 (for PBD and last BD) */
-        if (skb_shinfo(skb)->nr_frags >= (MAX_FETCH_BD - 3)) {
+        if (xmit_type & XMIT_GSO_ENC)
+                num_tso_win_sub = BNX2X_NUM_VXLAN_TSO_WIN_SUB_BDS;
 
+        if (skb_shinfo(skb)->nr_frags >= (MAX_FETCH_BD - num_tso_win_sub)) {
                 if (xmit_type & XMIT_GSO) {
                         unsigned short lso_mss = skb_shinfo(skb)->gso_size;
-                        /* Check if LSO packet needs to be copied:
-                           3 = 1 (for headers BD) + 2 (for PBD and last BD) */
-                        int wnd_size = MAX_FETCH_BD - 3;
+                        int wnd_size = MAX_FETCH_BD - num_tso_win_sub;
                         /* Number of windows to check */
                         int num_wnds = skb_shinfo(skb)->nr_frags - wnd_size;
                         int wnd_idx = 0;
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index c9b036789184..2e611dc5f162 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -10139,8 +10139,8 @@ static void __bnx2x_del_vxlan_port(struct bnx2x *bp, u16 port)
                 DP(BNX2X_MSG_SP, "Invalid vxlan port\n");
                 return;
         }
-        bp->vxlan_dst_port--;
-        if (bp->vxlan_dst_port)
+        bp->vxlan_dst_port_count--;
+        if (bp->vxlan_dst_port_count)
                 return;
 
         if (netif_running(bp->dev)) {
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index db15c5ee09c5..07f5f239cb65 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -2693,17 +2693,16 @@ static int bnxt_hwrm_func_drv_rgtr(struct bnxt *bp)
         req.ver_upd = DRV_VER_UPD;
 
         if (BNXT_PF(bp)) {
-                unsigned long vf_req_snif_bmap[4];
+                DECLARE_BITMAP(vf_req_snif_bmap, 256);
                 u32 *data = (u32 *)vf_req_snif_bmap;
 
-                memset(vf_req_snif_bmap, 0, 32);
+                memset(vf_req_snif_bmap, 0, sizeof(vf_req_snif_bmap));
                 for (i = 0; i < ARRAY_SIZE(bnxt_vf_req_snif); i++)
                         __set_bit(bnxt_vf_req_snif[i], vf_req_snif_bmap);
 
-                for (i = 0; i < 8; i++) {
-                        req.vf_req_fwd[i] = cpu_to_le32(*data);
-                        data++;
-                }
+                for (i = 0; i < 8; i++)
+                        req.vf_req_fwd[i] = cpu_to_le32(data[i]);
+
                 req.enables |=
                         cpu_to_le32(FUNC_DRV_RGTR_REQ_ENABLES_VF_REQ_FWD);
         }
@@ -3625,6 +3624,7 @@ static int bnxt_hwrm_func_qcaps(struct bnxt *bp)
                 pf->fw_fid = le16_to_cpu(resp->fid);
                 pf->port_id = le16_to_cpu(resp->port_id);
                 memcpy(pf->mac_addr, resp->perm_mac_address, ETH_ALEN);
+                memcpy(bp->dev->dev_addr, pf->mac_addr, ETH_ALEN);
                 pf->max_rsscos_ctxs = le16_to_cpu(resp->max_rsscos_ctx);
                 pf->max_cp_rings = le16_to_cpu(resp->max_cmpl_rings);
                 pf->max_tx_rings = le16_to_cpu(resp->max_tx_rings);
@@ -3648,8 +3648,11 @@ static int bnxt_hwrm_func_qcaps(struct bnxt *bp)
 
                 vf->fw_fid = le16_to_cpu(resp->fid);
                 memcpy(vf->mac_addr, resp->perm_mac_address, ETH_ALEN);
-                if (!is_valid_ether_addr(vf->mac_addr))
-                        random_ether_addr(vf->mac_addr);
+                if (is_valid_ether_addr(vf->mac_addr))
+                        /* overwrite netdev dev_adr with admin VF MAC */
+                        memcpy(bp->dev->dev_addr, vf->mac_addr, ETH_ALEN);
+                else
+                        random_ether_addr(bp->dev->dev_addr);
 
                 vf->max_rsscos_ctxs = le16_to_cpu(resp->max_rsscos_ctx);
                 vf->max_cp_rings = le16_to_cpu(resp->max_cmpl_rings);
@@ -3880,6 +3883,8 @@ static int bnxt_alloc_rfs_vnics(struct bnxt *bp)
 #endif
 }
 
+static int bnxt_cfg_rx_mode(struct bnxt *);
+
 static int bnxt_init_chip(struct bnxt *bp, bool irq_re_init)
 {
         int rc = 0;
@@ -3946,11 +3951,9 @@ static int bnxt_init_chip(struct bnxt *bp, bool irq_re_init)
                 bp->vnic_info[0].rx_mask |=
                                 CFA_L2_SET_RX_MASK_REQ_MASK_PROMISCUOUS;
 
-        rc = bnxt_hwrm_cfa_l2_set_rx_mask(bp, 0);
-        if (rc) {
-                netdev_err(bp->dev, "HWRM cfa l2 rx mask failure rc: %x\n", rc);
+        rc = bnxt_cfg_rx_mode(bp);
+        if (rc)
                 goto err_out;
-        }
 
         rc = bnxt_hwrm_set_coal(bp);
         if (rc)
@@ -4599,7 +4602,7 @@ static int __bnxt_open_nic(struct bnxt *bp, bool irq_re_init, bool link_re_init)
                         bp->nge_port_cnt = 1;
         }
 
-        bp->state = BNXT_STATE_OPEN;
+        set_bit(BNXT_STATE_OPEN, &bp->state);
         bnxt_enable_int(bp);
         /* Enable TX queues */
         bnxt_tx_enable(bp);
@@ -4675,8 +4678,10 @@ int bnxt_close_nic(struct bnxt *bp, bool irq_re_init, bool link_re_init)
         /* Change device state to avoid TX queue wake up's */
         bnxt_tx_disable(bp);
 
-        bp->state = BNXT_STATE_CLOSED;
-        cancel_work_sync(&bp->sp_task);
+        clear_bit(BNXT_STATE_OPEN, &bp->state);
+        smp_mb__after_atomic();
+        while (test_bit(BNXT_STATE_IN_SP_TASK, &bp->state))
+                msleep(20);
 
         /* Flush rings before disabling interrupts */
         bnxt_shutdown_nic(bp, irq_re_init);
@@ -4865,7 +4870,7 @@ static void bnxt_set_rx_mode(struct net_device *dev)
         }
 }
 
-static void bnxt_cfg_rx_mode(struct bnxt *bp)
+static int bnxt_cfg_rx_mode(struct bnxt *bp)
 {
         struct net_device *dev = bp->dev;
         struct bnxt_vnic_info *vnic = &bp->vnic_info[0];
@@ -4914,6 +4919,7 @@ static void bnxt_cfg_rx_mode(struct bnxt *bp)
                         netdev_err(bp->dev, "HWRM vnic filter failure rc: %x\n",
                                    rc);
                         vnic->uc_filter_count = i;
+                        return rc;
                 }
         }
 
@@ -4922,6 +4928,8 @@ skip_uc:
         if (rc)
                 netdev_err(bp->dev, "HWRM cfa l2 rx mask failure rc: %x\n",
                            rc);
+
+        return rc;
 }
 
 static netdev_features_t bnxt_fix_features(struct net_device *dev,
@@ -5023,8 +5031,10 @@ static void bnxt_dbg_dump_states(struct bnxt *bp)
 static void bnxt_reset_task(struct bnxt *bp)
 {
         bnxt_dbg_dump_states(bp);
-        if (netif_running(bp->dev))
-                bnxt_tx_disable(bp); /* prevent tx timout again */
+        if (netif_running(bp->dev)) {
+                bnxt_close_nic(bp, false, false);
+                bnxt_open_nic(bp, false, false);
+        }
 }
 
 static void bnxt_tx_timeout(struct net_device *dev)
@@ -5074,8 +5084,12 @@ static void bnxt_sp_task(struct work_struct *work)
         struct bnxt *bp = container_of(work, struct bnxt, sp_task);
         int rc;
 
-        if (bp->state != BNXT_STATE_OPEN)
+        set_bit(BNXT_STATE_IN_SP_TASK, &bp->state);
+        smp_mb__after_atomic();
+        if (!test_bit(BNXT_STATE_OPEN, &bp->state)) {
+                clear_bit(BNXT_STATE_IN_SP_TASK, &bp->state);
                 return;
+        }
 
         if (test_and_clear_bit(BNXT_RX_MASK_SP_EVENT, &bp->sp_event))
                 bnxt_cfg_rx_mode(bp);
@@ -5099,8 +5113,19 @@ static void bnxt_sp_task(struct work_struct *work)
                 bnxt_hwrm_tunnel_dst_port_free(
                         bp, TUNNEL_DST_PORT_FREE_REQ_TUNNEL_TYPE_VXLAN);
         }
-        if (test_and_clear_bit(BNXT_RESET_TASK_SP_EVENT, &bp->sp_event))
+        if (test_and_clear_bit(BNXT_RESET_TASK_SP_EVENT, &bp->sp_event)) {
+                /* bnxt_reset_task() calls bnxt_close_nic() which waits
+                 * for BNXT_STATE_IN_SP_TASK to clear.
+                 */
+                clear_bit(BNXT_STATE_IN_SP_TASK, &bp->state);
+                rtnl_lock();
                 bnxt_reset_task(bp);
+                set_bit(BNXT_STATE_IN_SP_TASK, &bp->state);
+                rtnl_unlock();
+        }
+
+        smp_mb__before_atomic();
+        clear_bit(BNXT_STATE_IN_SP_TASK, &bp->state);
 }
 
 static int bnxt_init_board(struct pci_dev *pdev, struct net_device *dev)
@@ -5179,7 +5204,7 @@ static int bnxt_init_board(struct pci_dev *pdev, struct net_device *dev)
         bp->timer.function = bnxt_timer;
         bp->current_interval = BNXT_TIMER_INTERVAL;
 
-        bp->state = BNXT_STATE_CLOSED;
+        clear_bit(BNXT_STATE_OPEN, &bp->state);
 
         return 0;
 
@@ -5212,13 +5237,27 @@ init_err:
 static int bnxt_change_mac_addr(struct net_device *dev, void *p)
 {
         struct sockaddr *addr = p;
+        struct bnxt *bp = netdev_priv(dev);
+        int rc = 0;
 
         if (!is_valid_ether_addr(addr->sa_data))
                 return -EADDRNOTAVAIL;
 
+#ifdef CONFIG_BNXT_SRIOV
+        if (BNXT_VF(bp) && is_valid_ether_addr(bp->vf.mac_addr))
+                return -EADDRNOTAVAIL;
+#endif
+
+        if (ether_addr_equal(addr->sa_data, dev->dev_addr))
+                return 0;
+
         memcpy(dev->dev_addr, addr->sa_data, dev->addr_len);
+        if (netif_running(dev)) {
+                bnxt_close_nic(bp, false, false);
+                rc = bnxt_open_nic(bp, false, false);
+        }
 
-        return 0;
+        return rc;
 }
 
 /* rtnl_lock held */
@@ -5686,15 +5725,12 @@ static int bnxt_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         bnxt_set_tpa_flags(bp);
         bnxt_set_ring_params(bp);
         dflt_rings = netif_get_num_default_rss_queues();
-        if (BNXT_PF(bp)) {
-                memcpy(dev->dev_addr, bp->pf.mac_addr, ETH_ALEN);
+        if (BNXT_PF(bp))
                 bp->pf.max_irqs = max_irqs;
-        } else {
 #if defined(CONFIG_BNXT_SRIOV)
-                memcpy(dev->dev_addr, bp->vf.mac_addr, ETH_ALEN);
+        else
                 bp->vf.max_irqs = max_irqs;
 #endif
-        }
         bnxt_get_max_rings(bp, &max_rx_rings, &max_tx_rings);
         bp->rx_nr_rings = min_t(int, dflt_rings, max_rx_rings);
         bp->tx_nr_rings_per_tc = min_t(int, dflt_rings, max_tx_rings);
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
index 674bc5159b91..f199f4cc8ffe 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
@@ -925,9 +925,9 @@ struct bnxt {
 
         struct timer_list       timer;
 
-        int                     state;
-#define BNXT_STATE_CLOSED       0
-#define BNXT_STATE_OPEN         1
+        unsigned long           state;
+#define BNXT_STATE_OPEN         0
+#define BNXT_STATE_IN_SP_TASK   1
 
         struct bnxt_irq *irq_tbl;
         u8                      mac_addr[ETH_ALEN];
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c
index f4cf68861069..ea044bbcd384 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c
@@ -21,7 +21,7 @@
 #ifdef CONFIG_BNXT_SRIOV
 static int bnxt_vf_ndo_prep(struct bnxt *bp, int vf_id)
 {
-        if (bp->state != BNXT_STATE_OPEN) {
+        if (!test_bit(BNXT_STATE_OPEN, &bp->state)) {
                 netdev_err(bp->dev, "vf ndo called though PF is down\n");
                 return -EINVAL;
         }
@@ -804,10 +804,9 @@ void bnxt_update_vf_mac(struct bnxt *bp)
         if (!is_valid_ether_addr(resp->perm_mac_address))
                 goto update_vf_mac_exit;
 
-        if (ether_addr_equal(resp->perm_mac_address, bp->vf.mac_addr))
-                goto update_vf_mac_exit;
-
-        memcpy(bp->vf.mac_addr, resp->perm_mac_address, ETH_ALEN);
+        if (!ether_addr_equal(resp->perm_mac_address, bp->vf.mac_addr))
+                memcpy(bp->vf.mac_addr, resp->perm_mac_address, ETH_ALEN);
+        /* overwrite netdev dev_adr with admin VF MAC */
         memcpy(bp->dev->dev_addr, bp->vf.mac_addr, ETH_ALEN);
 update_vf_mac_exit:
         mutex_unlock(&bp->hwrm_cmd_lock);
diff --git a/drivers/net/ethernet/cadence/macb.c b/drivers/net/ethernet/cadence/macb.c
index 88c1e1a834f8..169059c92f80 100644
--- a/drivers/net/ethernet/cadence/macb.c
+++ b/drivers/net/ethernet/cadence/macb.c
@@ -1682,6 +1682,8 @@ static void macb_init_hw(struct macb *bp)
         macb_set_hwaddr(bp);
 
         config = macb_mdc_clk_div(bp);
+        if (bp->phy_interface == PHY_INTERFACE_MODE_SGMII)
+                config |= GEM_BIT(SGMIIEN) | GEM_BIT(PCSSEL);
         config |= MACB_BF(RBOF, NET_IP_ALIGN);  /* Make eth data aligned */
         config |= MACB_BIT(PAE);                /* PAuse Enable */
         config |= MACB_BIT(DRFCS);              /* Discard Rx FCS */
@@ -2416,6 +2418,8 @@ static int macb_init(struct platform_device *pdev)
         /* Set MII management clock divider */
         val = macb_mdc_clk_div(bp);
         val |= macb_dbw(bp);
+        if (bp->phy_interface == PHY_INTERFACE_MODE_SGMII)
+                val |= GEM_BIT(SGMIIEN) | GEM_BIT(PCSSEL);
         macb_writel(bp, NCFGR, val);
 
         return 0;
diff --git a/drivers/net/ethernet/cadence/macb.h b/drivers/net/ethernet/cadence/macb.h
index 6e1faea00ca8..d83b0db77821 100644
--- a/drivers/net/ethernet/cadence/macb.h
+++ b/drivers/net/ethernet/cadence/macb.h
@@ -215,12 +215,17 @@
 /* GEM specific NCFGR bitfields. */
 #define GEM_GBE_OFFSET          10 /* Gigabit mode enable */
 #define GEM_GBE_SIZE            1
+#define GEM_PCSSEL_OFFSET       11
+#define GEM_PCSSEL_SIZE         1
 #define GEM_CLK_OFFSET          18 /* MDC clock division */
 #define GEM_CLK_SIZE            3
 #define GEM_DBW_OFFSET          21 /* Data bus width */
 #define GEM_DBW_SIZE            2
 #define GEM_RXCOEN_OFFSET       24
 #define GEM_RXCOEN_SIZE         1
+#define GEM_SGMIIEN_OFFSET      27
+#define GEM_SGMIIEN_SIZE        1
+
 
 /* Constants for data bus width. */
 #define GEM_DBW32               0 /* 32 bit AMBA AHB data bus width */
diff --git a/drivers/net/ethernet/cavium/thunder/nic.h b/drivers/net/ethernet/cavium/thunder/nic.h
index d3950b20feb9..39ca6744a4e6 100644
--- a/drivers/net/ethernet/cavium/thunder/nic.h
+++ b/drivers/net/ethernet/cavium/thunder/nic.h
@@ -120,10 +120,9 @@
  * Calculated for SCLK of 700Mhz
  * value written should be a 1/16th of what is expected
  *
- * 1 tick per 0.05usec = value of 2.2
- * This 10% would be covered in CQ timer thresh value
+ * 1 tick per 0.025usec
  */
-#define NICPF_CLK_PER_INT_TICK          2
+#define NICPF_CLK_PER_INT_TICK          1
 
 /* Time to wait before we decide that a SQ is stuck.
  *
diff --git a/drivers/net/ethernet/cavium/thunder/nic_main.c b/drivers/net/ethernet/cavium/thunder/nic_main.c
index c561fdcb79a7..5f24d11cb16a 100644
--- a/drivers/net/ethernet/cavium/thunder/nic_main.c
+++ b/drivers/net/ethernet/cavium/thunder/nic_main.c
@@ -615,6 +615,21 @@ static int nic_config_loopback(struct nicpf *nic, struct set_loopback *lbk)
         return 0;
 }
 
+static void nic_enable_vf(struct nicpf *nic, int vf, bool enable)
+{
+        int bgx, lmac;
+
+        nic->vf_enabled[vf] = enable;
+
+        if (vf >= nic->num_vf_en)
+                return;
+
+        bgx = NIC_GET_BGX_FROM_VF_LMAC_MAP(nic->vf_lmac_map[vf]);
+        lmac = NIC_GET_LMAC_FROM_VF_LMAC_MAP(nic->vf_lmac_map[vf]);
+
+        bgx_lmac_rx_tx_enable(nic->node, bgx, lmac, enable);
+}
+
 /* Interrupt handler to handle mailbox messages from VFs */
 static void nic_handle_mbx_intr(struct nicpf *nic, int vf)
 {
@@ -714,14 +729,14 @@ static void nic_handle_mbx_intr(struct nicpf *nic, int vf)
                 break;
         case NIC_MBOX_MSG_CFG_DONE:
                 /* Last message of VF config msg sequence */
-                nic->vf_enabled[vf] = true;
+                nic_enable_vf(nic, vf, true);
                 goto unlock;
         case NIC_MBOX_MSG_SHUTDOWN:
                 /* First msg in VF teardown sequence */
-                nic->vf_enabled[vf] = false;
                 if (vf >= nic->num_vf_en)
                         nic->sqs_used[vf - nic->num_vf_en] = false;
                 nic->pqs_vf[vf] = 0;
+                nic_enable_vf(nic, vf, false);
                 break;
         case NIC_MBOX_MSG_ALLOC_SQS:
                 nic_alloc_sqs(nic, &mbx.sqs_alloc);
@@ -1074,8 +1089,7 @@ static void nic_remove(struct pci_dev *pdev)
 
         if (nic->check_link) {
                 /* Destroy work Queue */
-                cancel_delayed_work(&nic->dwork);
-                flush_workqueue(nic->check_link);
+                cancel_delayed_work_sync(&nic->dwork);
                 destroy_workqueue(nic->check_link);
         }
 
diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_ethtool.c b/drivers/net/ethernet/cavium/thunder/nicvf_ethtool.c
index af54c10945c2..a12b2e38cf61 100644
--- a/drivers/net/ethernet/cavium/thunder/nicvf_ethtool.c
+++ b/drivers/net/ethernet/cavium/thunder/nicvf_ethtool.c
@@ -112,6 +112,13 @@ static int nicvf_get_settings(struct net_device *netdev,
 
         cmd->supported = 0;
         cmd->transceiver = XCVR_EXTERNAL;
+
+        if (!nic->link_up) {
+                cmd->duplex = DUPLEX_UNKNOWN;
+                ethtool_cmd_speed_set(cmd, SPEED_UNKNOWN);
+                return 0;
+        }
+
         if (nic->speed <= 1000) {
                 cmd->port = PORT_MII;
                 cmd->autoneg = AUTONEG_ENABLE;
@@ -125,6 +132,13 @@ static int nicvf_get_settings(struct net_device *netdev,
         return 0;
 }
 
+static u32 nicvf_get_link(struct net_device *netdev)
+{
+        struct nicvf *nic = netdev_priv(netdev);
+
+        return nic->link_up;
+}
+
 static void nicvf_get_drvinfo(struct net_device *netdev,
                               struct ethtool_drvinfo *info)
 {
@@ -660,7 +674,7 @@ static int nicvf_set_channels(struct net_device *dev,
 
 static const struct ethtool_ops nicvf_ethtool_ops = {
         .get_settings           = nicvf_get_settings,
-        .get_link               = ethtool_op_get_link,
+        .get_link               = nicvf_get_link,
         .get_drvinfo            = nicvf_get_drvinfo,
         .get_msglevel           = nicvf_get_msglevel,
         .set_msglevel           = nicvf_set_msglevel,
diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_main.c b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
index 7f709cbdcd87..dde8dc720cd3 100644
--- a/drivers/net/ethernet/cavium/thunder/nicvf_main.c
+++ b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
@@ -1057,6 +1057,7 @@ int nicvf_stop(struct net_device *netdev)
 
         netif_carrier_off(netdev);
         netif_tx_stop_all_queues(nic->netdev);
+        nic->link_up = false;
 
         /* Teardown secondary qsets first */
         if (!nic->sqs_mode) {
@@ -1211,9 +1212,6 @@ int nicvf_open(struct net_device *netdev)
         nic->drv_stats.txq_stop = 0;
         nic->drv_stats.txq_wake = 0;
 
-        netif_carrier_on(netdev);
-        netif_tx_start_all_queues(netdev);
-
         return 0;
 cleanup:
         nicvf_disable_intr(nic, NICVF_INTR_MBOX, 0);
diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_queues.c b/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
index e404ea837727..206b6a71a545 100644
--- a/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
+++ b/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
@@ -592,7 +592,7 @@ void nicvf_cmp_queue_config(struct nicvf *nic, struct queue_set *qs,
         /* Set threshold value for interrupt generation */
         nicvf_queue_reg_write(nic, NIC_QSET_CQ_0_7_THRESH, qidx, cq->thresh);
         nicvf_queue_reg_write(nic, NIC_QSET_CQ_0_7_CFG2,
-                              qidx, nic->cq_coalesce_usecs);
+                              qidx, CMP_QUEUE_TIMER_THRESH);
 }
 
 /* Configures transmit queue */
diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_queues.h b/drivers/net/ethernet/cavium/thunder/nicvf_queues.h
index fb4957d09914..033e8306e91c 100644
--- a/drivers/net/ethernet/cavium/thunder/nicvf_queues.h
+++ b/drivers/net/ethernet/cavium/thunder/nicvf_queues.h
@@ -76,7 +76,7 @@
 #define CMP_QSIZE               CMP_QUEUE_SIZE2
 #define CMP_QUEUE_LEN           (1ULL << (CMP_QSIZE + 10))
 #define CMP_QUEUE_CQE_THRESH    0
-#define CMP_QUEUE_TIMER_THRESH  220 /* 10usec */
+#define CMP_QUEUE_TIMER_THRESH  80 /* ~2usec */
 
 #define RBDR_SIZE               RBDR_SIZE0
 #define RCV_BUF_COUNT           (1ULL << (RBDR_SIZE + 13))
diff --git a/drivers/net/ethernet/cavium/thunder/thunder_bgx.c b/drivers/net/ethernet/cavium/thunder/thunder_bgx.c
index 180aa9fabf48..9df26c2263bc 100644
--- a/drivers/net/ethernet/cavium/thunder/thunder_bgx.c
+++ b/drivers/net/ethernet/cavium/thunder/thunder_bgx.c
@@ -186,6 +186,23 @@ void bgx_set_lmac_mac(int node, int bgx_idx, int lmacid, const u8 *mac)
 }
 EXPORT_SYMBOL(bgx_set_lmac_mac);
 
+void bgx_lmac_rx_tx_enable(int node, int bgx_idx, int lmacid, bool enable)
+{
+        struct bgx *bgx = bgx_vnic[(node * MAX_BGX_PER_CN88XX) + bgx_idx];
+        u64 cfg;
+
+        if (!bgx)
+                return;
+
+        cfg = bgx_reg_read(bgx, lmacid, BGX_CMRX_CFG);
+        if (enable)
+                cfg |= CMR_PKT_RX_EN | CMR_PKT_TX_EN;
+        else
+                cfg &= ~(CMR_PKT_RX_EN | CMR_PKT_TX_EN);
+        bgx_reg_write(bgx, lmacid, BGX_CMRX_CFG, cfg);
+}
+EXPORT_SYMBOL(bgx_lmac_rx_tx_enable);
+
 static void bgx_sgmii_change_link_state(struct lmac *lmac)
 {
         struct bgx *bgx = lmac->bgx;
@@ -612,6 +629,8 @@ static void bgx_poll_for_link(struct work_struct *work)
                 lmac->last_duplex = 1;
         } else {
                 lmac->link_up = 0;
+                lmac->last_speed = SPEED_UNKNOWN;
+                lmac->last_duplex = DUPLEX_UNKNOWN;
         }
 
         if (lmac->last_link != lmac->link_up) {
@@ -654,8 +673,7 @@ static int bgx_lmac_enable(struct bgx *bgx, u8 lmacid)
         }
 
         /* Enable lmac */
-        bgx_reg_modify(bgx, lmacid, BGX_CMRX_CFG,
-                       CMR_EN | CMR_PKT_RX_EN | CMR_PKT_TX_EN);
+        bgx_reg_modify(bgx, lmacid, BGX_CMRX_CFG, CMR_EN);
 
         /* Restore default cfg, incase low level firmware changed it */
         bgx_reg_write(bgx, lmacid, BGX_CMRX_RX_DMAC_CTL, 0x03);
@@ -695,8 +713,7 @@ static void bgx_lmac_disable(struct bgx *bgx, u8 lmacid)
         lmac = &bgx->lmac[lmacid];
         if (lmac->check_link) {
                 /* Destroy work queue */
-                cancel_delayed_work(&lmac->dwork);
-                flush_workqueue(lmac->check_link);
+                cancel_delayed_work_sync(&lmac->dwork);
                 destroy_workqueue(lmac->check_link);
         }
 
@@ -1009,6 +1026,9 @@ static int bgx_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         struct bgx *bgx = NULL;
         u8 lmac;
 
+        /* Load octeon mdio driver */
+        octeon_mdiobus_force_mod_depencency();
+
         bgx = devm_kzalloc(dev, sizeof(*bgx), GFP_KERNEL);
         if (!bgx)
                 return -ENOMEM;
diff --git a/drivers/net/ethernet/cavium/thunder/thunder_bgx.h b/drivers/net/ethernet/cavium/thunder/thunder_bgx.h
index 07b7ec66c60d..149e179363a1 100644
--- a/drivers/net/ethernet/cavium/thunder/thunder_bgx.h
+++ b/drivers/net/ethernet/cavium/thunder/thunder_bgx.h
@@ -182,6 +182,8 @@ enum MCAST_MODE {
 #define BCAST_ACCEPT    1
 #define CAM_ACCEPT      1
 
+void octeon_mdiobus_force_mod_depencency(void);
+void bgx_lmac_rx_tx_enable(int node, int bgx_idx, int lmacid, bool enable);
 void bgx_add_dmac_addr(u64 dmac, int node, int bgx_idx, int lmac);
 unsigned bgx_get_map(int node);
 int bgx_get_lmac_count(int node, int bgx);
diff --git a/drivers/net/ethernet/dec/tulip/tulip_core.c b/drivers/net/ethernet/dec/tulip/tulip_core.c
index ed41559bae77..b553409e04ad 100644
--- a/drivers/net/ethernet/dec/tulip/tulip_core.c
+++ b/drivers/net/ethernet/dec/tulip/tulip_core.c
@@ -98,8 +98,7 @@ static int csr0 = 0x01A00000 | 0x4800;
 #elif defined(__mips__)
 static int csr0 = 0x00200000 | 0x4000;
 #else
-#warning Processor architecture undefined!
-static int csr0 = 0x00A00000 | 0x4800;
+static int csr0;
 #endif
 
 /* Operational parameters that usually are not changed. */
@@ -1982,6 +1981,12 @@ static int __init tulip_init (void)
         pr_info("%s", version);
 #endif
 
+        if (!csr0) {
+                pr_warn("tulip: unknown CPU architecture, using default csr0\n");
+                /* default to 8 longword cache line alignment */
+                csr0 = 0x00A00000 | 0x4800;
+        }
+
         /* copy module parms into globals */
         tulip_rx_copybreak = rx_copybreak;
         tulip_max_interrupt_work = max_interrupt_work;
diff --git a/drivers/net/ethernet/dec/tulip/winbond-840.c b/drivers/net/ethernet/dec/tulip/winbond-840.c
index 9beb3d34d4ba..3c0e4d5c5fef 100644
--- a/drivers/net/ethernet/dec/tulip/winbond-840.c
+++ b/drivers/net/ethernet/dec/tulip/winbond-840.c
@@ -907,7 +907,7 @@ static void init_registers(struct net_device *dev)
 #elif defined(CONFIG_SPARC) || defined (CONFIG_PARISC) || defined(CONFIG_ARM)
         i |= 0x4800;
 #else
-#warning Processor architecture undefined
+        dev_warn(&dev->dev, "unknown CPU architecture, using default csr0 setting\n");
         i |= 0x4800;
 #endif
         iowrite32(i, ioaddr + PCIBusCfg);
diff --git a/drivers/net/ethernet/emulex/benet/be.h b/drivers/net/ethernet/emulex/benet/be.h
index d463563e1f70..6ee78c203eca 100644
--- a/drivers/net/ethernet/emulex/benet/be.h
+++ b/drivers/net/ethernet/emulex/benet/be.h
@@ -848,8 +848,6 @@ void be_roce_dev_remove(struct be_adapter *);
 /*
  * internal function to open-close roce device during ifup-ifdown.
  */
-void be_roce_dev_open(struct be_adapter *);
-void be_roce_dev_close(struct be_adapter *);
 void be_roce_dev_shutdown(struct be_adapter *);
 
 #endif                          /* BE_H */
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index b6ad02909d6b..8a1d9fffd7d6 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -3299,8 +3299,10 @@ static int be_msix_register(struct be_adapter *adapter)
 
         return 0;
 err_msix:
-        for (i--, eqo = &adapter->eq_obj[i]; i >= 0; i--, eqo--)
+        for (i--; i >= 0; i--) {
+                eqo = &adapter->eq_obj[i];
                 free_irq(be_msix_vec_get(adapter, eqo), eqo);
+        }
         dev_warn(&adapter->pdev->dev, "MSIX Request IRQ failed - err %d\n",
                  status);
         be_msix_disable(adapter);
@@ -3432,8 +3434,6 @@ static int be_close(struct net_device *netdev)
 
         be_disable_if_filters(adapter);
 
-        be_roce_dev_close(adapter);
-
         if (adapter->flags & BE_FLAGS_NAPI_ENABLED) {
                 for_all_evt_queues(adapter, eqo, i) {
                         napi_disable(&eqo->napi);
@@ -3601,8 +3601,6 @@ static int be_open(struct net_device *netdev)
                 be_link_status_update(adapter, link_status);
 
         netif_tx_start_all_queues(netdev);
-        be_roce_dev_open(adapter);
-
 #ifdef CONFIG_BE2NET_VXLAN
         if (skyhawk_chip(adapter))
                 vxlan_get_rx_port(netdev);
diff --git a/drivers/net/ethernet/emulex/benet/be_roce.c b/drivers/net/ethernet/emulex/benet/be_roce.c
index 60368207bf58..4089156a7f5e 100644
--- a/drivers/net/ethernet/emulex/benet/be_roce.c
+++ b/drivers/net/ethernet/emulex/benet/be_roce.c
@@ -116,40 +116,6 @@ void be_roce_dev_remove(struct be_adapter *adapter)
         }
 }
 
-static void _be_roce_dev_open(struct be_adapter *adapter)
-{
-        if (ocrdma_drv && adapter->ocrdma_dev &&
-            ocrdma_drv->state_change_handler)
-                ocrdma_drv->state_change_handler(adapter->ocrdma_dev,
-                                                 BE_DEV_UP);
-}
-
-void be_roce_dev_open(struct be_adapter *adapter)
-{
-        if (be_roce_supported(adapter)) {
-                mutex_lock(&be_adapter_list_lock);
-                _be_roce_dev_open(adapter);
-                mutex_unlock(&be_adapter_list_lock);
-        }
-}
-
-static void _be_roce_dev_close(struct be_adapter *adapter)
-{
-        if (ocrdma_drv && adapter->ocrdma_dev &&
-            ocrdma_drv->state_change_handler)
-                ocrdma_drv->state_change_handler(adapter->ocrdma_dev,
-                                                 BE_DEV_DOWN);
-}
-
-void be_roce_dev_close(struct be_adapter *adapter)
-{
-        if (be_roce_supported(adapter)) {
-                mutex_lock(&be_adapter_list_lock);
-                _be_roce_dev_close(adapter);
-                mutex_unlock(&be_adapter_list_lock);
-        }
-}
-
 void be_roce_dev_shutdown(struct be_adapter *adapter)
 {
         if (be_roce_supported(adapter)) {
@@ -177,8 +143,6 @@ int be_roce_register_driver(struct ocrdma_driver *drv)
 
                 _be_roce_dev_add(dev);
                 netdev = dev->netdev;
-                if (netif_running(netdev) && netif_oper_up(netdev))
-                        _be_roce_dev_open(dev);
         }
         mutex_unlock(&be_adapter_list_lock);
         return 0;
diff --git a/drivers/net/ethernet/emulex/benet/be_roce.h b/drivers/net/ethernet/emulex/benet/be_roce.h
index cde6ef905ec4..fde609789483 100644
--- a/drivers/net/ethernet/emulex/benet/be_roce.h
+++ b/drivers/net/ethernet/emulex/benet/be_roce.h
@@ -60,9 +60,7 @@ struct ocrdma_driver {
         void (*state_change_handler) (struct ocrdma_dev *, u32 new_state);
 };
 
-enum {
-        BE_DEV_UP       = 0,
-        BE_DEV_DOWN     = 1,
+enum be_roce_event {
         BE_DEV_SHUTDOWN = 2
 };
 
diff --git a/drivers/net/ethernet/ezchip/nps_enet.c b/drivers/net/ethernet/ezchip/nps_enet.c
index 63c2bcf8031a..b1026689b78f 100644
--- a/drivers/net/ethernet/ezchip/nps_enet.c
+++ b/drivers/net/ethernet/ezchip/nps_enet.c
@@ -48,21 +48,15 @@ static void nps_enet_read_rx_fifo(struct net_device *ndev,
                         *reg = nps_enet_reg_get(priv, NPS_ENET_REG_RX_BUF);
         else { /* !dst_is_aligned */
                 for (i = 0; i < len; i++, reg++) {
-                        u32 buf =
-                                nps_enet_reg_get(priv, NPS_ENET_REG_RX_BUF);
-
-                        /* to accommodate word-unaligned address of "reg"
-                         * we have to do memcpy_toio() instead of simple "=".
-                         */
-                        memcpy_toio((void __iomem *)reg, &buf, sizeof(buf));
+                        u32 buf = nps_enet_reg_get(priv, NPS_ENET_REG_RX_BUF);
+                        put_unaligned(buf, reg);
                 }
         }
 
         /* copy last bytes (if any) */
         if (last) {
                 u32 buf = nps_enet_reg_get(priv, NPS_ENET_REG_RX_BUF);
-
-                memcpy_toio((void __iomem *)reg, &buf, last);
+                memcpy((u8*)reg, &buf, last);
         }
 }
 
@@ -367,7 +361,7 @@ static void nps_enet_send_frame(struct net_device *ndev,
         struct nps_enet_tx_ctl tx_ctrl;
         short length = skb->len;
         u32 i, len = DIV_ROUND_UP(length, sizeof(u32));
-        u32 *src = (u32 *)virt_to_phys(skb->data);
+        u32 *src = (void *)skb->data;
         bool src_is_aligned = IS_ALIGNED((unsigned long)src, sizeof(u32));
 
         tx_ctrl.value = 0;
@@ -375,17 +369,11 @@ static void nps_enet_send_frame(struct net_device *ndev,
         if (src_is_aligned)
                 for (i = 0; i < len; i++, src++)
                         nps_enet_reg_set(priv, NPS_ENET_REG_TX_BUF, *src);
-        else { /* !src_is_aligned */
-                for (i = 0; i < len; i++, src++) {
-                        u32 buf;
-
-                        /* to accommodate word-unaligned address of "src"
-                         * we have to do memcpy_fromio() instead of simple "="
-                         */
-                        memcpy_fromio(&buf, (void __iomem *)src, sizeof(buf));
-                        nps_enet_reg_set(priv, NPS_ENET_REG_TX_BUF, buf);
-                }
-        }
+        else /* !src_is_aligned */
+                for (i = 0; i < len; i++, src++)
+                        nps_enet_reg_set(priv, NPS_ENET_REG_TX_BUF,
+                                         get_unaligned(src));
+
         /* Write the length of the Frame */
         tx_ctrl.nt = length;
 
diff --git a/drivers/net/ethernet/freescale/Kconfig b/drivers/net/ethernet/freescale/Kconfig
index ff76d4e9dc1b..bee32a9d9876 100644
--- a/drivers/net/ethernet/freescale/Kconfig
+++ b/drivers/net/ethernet/freescale/Kconfig
@@ -7,7 +7,8 @@ config NET_VENDOR_FREESCALE
         default y
         depends on FSL_SOC || QUICC_ENGINE || CPM1 || CPM2 || PPC_MPC512x || \
                    M523x || M527x || M5272 || M528x || M520x || M532x || \
-                   ARCH_MXC || ARCH_MXS || (PPC_MPC52xx && PPC_BESTCOMM)
+                   ARCH_MXC || ARCH_MXS || (PPC_MPC52xx && PPC_BESTCOMM) || \
+                   ARCH_LAYERSCAPE
         ---help---
           If you have a network (Ethernet) card belonging to this class, say Y.
 
diff --git a/drivers/net/ethernet/freescale/fs_enet/mac-fcc.c b/drivers/net/ethernet/freescale/fs_enet/mac-fcc.c
index 08f5b911d96b..52e0091b4fb2 100644
--- a/drivers/net/ethernet/freescale/fs_enet/mac-fcc.c
+++ b/drivers/net/ethernet/freescale/fs_enet/mac-fcc.c
@@ -552,7 +552,7 @@ static void tx_restart(struct net_device *dev)
         cbd_t __iomem *prev_bd;
         cbd_t __iomem *last_tx_bd;
 
-        last_tx_bd = fep->tx_bd_base + (fpi->tx_ring * sizeof(cbd_t));
+        last_tx_bd = fep->tx_bd_base + ((fpi->tx_ring - 1) * sizeof(cbd_t));
 
         /* get the current bd held in TBPTR  and scan back from this point */
         recheck_bd = curr_tbptr = (cbd_t __iomem *)
diff --git a/drivers/net/ethernet/freescale/fsl_pq_mdio.c b/drivers/net/ethernet/freescale/fsl_pq_mdio.c
index 55c36230e176..40071dad1c57 100644
--- a/drivers/net/ethernet/freescale/fsl_pq_mdio.c
+++ b/drivers/net/ethernet/freescale/fsl_pq_mdio.c
@@ -464,7 +464,7 @@ static int fsl_pq_mdio_probe(struct platform_device *pdev)
                          * address). Print error message but continue anyway.
                          */
                         if ((void *)tbipa > priv->map + resource_size(&res) - 4)
-                                dev_err(&pdev->dev, "invalid register map (should be at least 0x%04x to contain TBI address)\n",
+                                dev_err(&pdev->dev, "invalid register map (should be at least 0x%04zx to contain TBI address)\n",
                                         ((void *)tbipa - priv->map) + 4);
 
                         iowrite32be(be32_to_cpup(prop), tbipa);
diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c
index 3e6b9b437497..3e233d924cce 100644
--- a/drivers/net/ethernet/freescale/gianfar.c
+++ b/drivers/net/ethernet/freescale/gianfar.c
@@ -647,9 +647,9 @@ static int gfar_parse_group(struct device_node *np,
         if (model && strcasecmp(model, "FEC")) {
                 gfar_irq(grp, RX)->irq = irq_of_parse_and_map(np, 1);
                 gfar_irq(grp, ER)->irq = irq_of_parse_and_map(np, 2);
-                if (gfar_irq(grp, TX)->irq == NO_IRQ ||
-                    gfar_irq(grp, RX)->irq == NO_IRQ ||
-                    gfar_irq(grp, ER)->irq == NO_IRQ)
+                if (!gfar_irq(grp, TX)->irq ||
+                    !gfar_irq(grp, RX)->irq ||
+                    !gfar_irq(grp, ER)->irq)
                         return -EINVAL;
         }
 
@@ -894,7 +894,8 @@ static int gfar_of_init(struct platform_device *ofdev, struct net_device **pdev)
                                      FSL_GIANFAR_DEV_HAS_VLAN |
                                      FSL_GIANFAR_DEV_HAS_MAGIC_PACKET |
                                      FSL_GIANFAR_DEV_HAS_EXTENDED_HASH |
-                                     FSL_GIANFAR_DEV_HAS_TIMER;
+                                     FSL_GIANFAR_DEV_HAS_TIMER |
+                                     FSL_GIANFAR_DEV_HAS_RX_FILER;
 
         err = of_property_read_string(np, "phy-connection-type", &ctype);
 
@@ -1396,8 +1397,9 @@ static int gfar_probe(struct platform_device *ofdev)
                 priv->rx_queue[i]->rxic = DEFAULT_RXIC;
         }
 
-        /* always enable rx filer */
-        priv->rx_filer_enable = 1;
+        /* Always enable rx filer if available */
+        priv->rx_filer_enable =
+            (priv->device_flags & FSL_GIANFAR_DEV_HAS_RX_FILER) ? 1 : 0;
         /* Enable most messages by default */
         priv->msg_enable = (NETIF_MSG_IFUP << 1 ) - 1;
         /* use pritority h/w tx queue scheduling for single queue devices */
diff --git a/drivers/net/ethernet/freescale/gianfar.h b/drivers/net/ethernet/freescale/gianfar.h
index f266b20f9ef5..cb77667971a7 100644
--- a/drivers/net/ethernet/freescale/gianfar.h
+++ b/drivers/net/ethernet/freescale/gianfar.h
@@ -923,6 +923,7 @@ struct gfar {
 #define FSL_GIANFAR_DEV_HAS_BUF_STASHING        0x00000400
 #define FSL_GIANFAR_DEV_HAS_TIMER               0x00000800
 #define FSL_GIANFAR_DEV_HAS_WAKE_ON_FILER       0x00001000
+#define FSL_GIANFAR_DEV_HAS_RX_FILER            0x00002000
 
 #if (MAXGROUPS == 2)
 #define DEFAULT_MAPPING         0xAA
diff --git a/drivers/net/ethernet/freescale/gianfar_ptp.c b/drivers/net/ethernet/freescale/gianfar_ptp.c
index 664d0c261269..b40fba929d65 100644
--- a/drivers/net/ethernet/freescale/gianfar_ptp.c
+++ b/drivers/net/ethernet/freescale/gianfar_ptp.c
@@ -467,7 +467,7 @@ static int gianfar_ptp_probe(struct platform_device *dev)
 
         etsects->irq = platform_get_irq(dev, 0);
 
-        if (etsects->irq == NO_IRQ) {
+        if (etsects->irq < 0) {
                 pr_err("irq not in device tree\n");
                 goto no_node;
         }
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
index 2a98eba660c0..b674414a4d72 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
@@ -1259,12 +1259,8 @@ int hns_dsaf_set_mac_uc_entry(
         if (MAC_IS_ALL_ZEROS(mac_entry->addr) ||
             MAC_IS_BROADCAST(mac_entry->addr) ||
             MAC_IS_MULTICAST(mac_entry->addr)) {
-                dev_err(dsaf_dev->dev,
-                        "set_uc %s Mac %02x:%02x:%02x:%02x:%02x:%02x err!\n",
-                        dsaf_dev->ae_dev.name, mac_entry->addr[0],
-                        mac_entry->addr[1], mac_entry->addr[2],
-                        mac_entry->addr[3], mac_entry->addr[4],
-                        mac_entry->addr[5]);
+                dev_err(dsaf_dev->dev, "set_uc %s Mac %pM err!\n",
+                        dsaf_dev->ae_dev.name, mac_entry->addr);
                 return -EINVAL;
         }
 
@@ -1331,12 +1327,8 @@ int hns_dsaf_set_mac_mc_entry(
 
         /* mac addr check */
         if (MAC_IS_ALL_ZEROS(mac_entry->addr)) {
-                dev_err(dsaf_dev->dev,
-                        "set uc %s Mac %02x:%02x:%02x:%02x:%02x:%02x err!\n",
-                        dsaf_dev->ae_dev.name, mac_entry->addr[0],
-                        mac_entry->addr[1], mac_entry->addr[2],
-                        mac_entry->addr[3],
-                        mac_entry->addr[4], mac_entry->addr[5]);
+                dev_err(dsaf_dev->dev, "set uc %s Mac %pM err!\n",
+                        dsaf_dev->ae_dev.name, mac_entry->addr);
                 return -EINVAL;
         }
 
@@ -1410,11 +1402,8 @@ int hns_dsaf_add_mac_mc_port(struct dsaf_device *dsaf_dev,
 
         /*chechk mac addr */
         if (MAC_IS_ALL_ZEROS(mac_entry->addr)) {
-                dev_err(dsaf_dev->dev,
-                        "set_entry failed,addr %02x:%02x:%02x:%02x:%02x:%02x!\n",
-                        mac_entry->addr[0], mac_entry->addr[1],
-                        mac_entry->addr[2], mac_entry->addr[3],
-                        mac_entry->addr[4], mac_entry->addr[5]);
+                dev_err(dsaf_dev->dev, "set_entry failed,addr %pM!\n",
+                        mac_entry->addr);
                 return -EINVAL;
         }
 
@@ -1497,9 +1486,8 @@ int hns_dsaf_del_mac_entry(struct dsaf_device *dsaf_dev, u16 vlan_id,
 
         /*check mac addr */
         if (MAC_IS_ALL_ZEROS(addr) || MAC_IS_BROADCAST(addr)) {
-                dev_err(dsaf_dev->dev,
-                        "del_entry failed,addr %02x:%02x:%02x:%02x:%02x:%02x!\n",
-                        addr[0], addr[1], addr[2], addr[3], addr[4], addr[5]);
+                dev_err(dsaf_dev->dev, "del_entry failed,addr %pM!\n",
+                        addr);
                 return -EINVAL;
         }
 
@@ -1563,11 +1551,8 @@ int hns_dsaf_del_mac_mc_port(struct dsaf_device *dsaf_dev,
 
         /*check mac addr */
         if (MAC_IS_ALL_ZEROS(mac_entry->addr)) {
-                dev_err(dsaf_dev->dev,
-                        "del_port failed, addr %02x:%02x:%02x:%02x:%02x:%02x!\n",
-                        mac_entry->addr[0], mac_entry->addr[1],
-                        mac_entry->addr[2], mac_entry->addr[3],
-                        mac_entry->addr[4], mac_entry->addr[5]);
+                dev_err(dsaf_dev->dev, "del_port failed, addr %pM!\n",
+                        mac_entry->addr);
                 return -EINVAL;
         }
 
@@ -1644,11 +1629,8 @@ int hns_dsaf_get_mac_uc_entry(struct dsaf_device *dsaf_dev,
         /* check macaddr */
         if (MAC_IS_ALL_ZEROS(mac_entry->addr) ||
             MAC_IS_BROADCAST(mac_entry->addr)) {
-                dev_err(dsaf_dev->dev,
-                        "get_entry failed,addr %02x:%02x:%02x:%02x:%02x:%02x\n",
-                        mac_entry->addr[0], mac_entry->addr[1],
-                        mac_entry->addr[2], mac_entry->addr[3],
-                        mac_entry->addr[4], mac_entry->addr[5]);
+                dev_err(dsaf_dev->dev, "get_entry failed,addr %pM\n",
+                        mac_entry->addr);
                 return -EINVAL;
         }
 
@@ -1695,11 +1677,8 @@ int hns_dsaf_get_mac_mc_entry(struct dsaf_device *dsaf_dev,
         /*check mac addr */
         if (MAC_IS_ALL_ZEROS(mac_entry->addr) ||
             MAC_IS_BROADCAST(mac_entry->addr)) {
-                dev_err(dsaf_dev->dev,
-                        "get_entry failed,addr %02x:%02x:%02x:%02x:%02x:%02x\n",
-                        mac_entry->addr[0], mac_entry->addr[1],
-                        mac_entry->addr[2], mac_entry->addr[3],
-                        mac_entry->addr[4], mac_entry->addr[5]);
+                dev_err(dsaf_dev->dev, "get_entry failed,addr %pM\n",
+                        mac_entry->addr);
                 return -EINVAL;
         }
 
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h
index b475e1bf2e6f..bdbd80423b17 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h
@@ -898,7 +898,7 @@
 #define XGMAC_PAUSE_CTL_RSP_MODE_B      2
 #define XGMAC_PAUSE_CTL_TX_XOFF_B       3
 
-static inline void dsaf_write_reg(void *base, u32 reg, u32 value)
+static inline void dsaf_write_reg(void __iomem *base, u32 reg, u32 value)
 {
         u8 __iomem *reg_addr = ACCESS_ONCE(base);
 
@@ -908,7 +908,7 @@ static inline void dsaf_write_reg(void *base, u32 reg, u32 value)
 #define dsaf_write_dev(a, reg, value) \
         dsaf_write_reg((a)->io_base, (reg), (value))
 
-static inline u32 dsaf_read_reg(u8 *base, u32 reg)
+static inline u32 dsaf_read_reg(u8 __iomem *base, u32 reg)
 {
         u8 __iomem *reg_addr = ACCESS_ONCE(base);
 
@@ -927,8 +927,8 @@ static inline u32 dsaf_read_reg(u8 *base, u32 reg)
 #define dsaf_set_bit(origin, shift, val) \
         dsaf_set_field((origin), (1ull << (shift)), (shift), (val))
 
-static inline void dsaf_set_reg_field(void *base, u32 reg, u32 mask, u32 shift,
-                                      u32 val)
+static inline void dsaf_set_reg_field(void __iomem *base, u32 reg, u32 mask,
+                                      u32 shift, u32 val)
 {
         u32 origin = dsaf_read_reg(base, reg);
 
@@ -947,7 +947,8 @@ static inline void dsaf_set_reg_field(void *base, u32 reg, u32 mask, u32 shift,
 #define dsaf_get_bit(origin, shift) \
         dsaf_get_field((origin), (1ull << (shift)), (shift))
 
-static inline u32 dsaf_get_reg_field(void *base, u32 reg, u32 mask, u32 shift)
+static inline u32 dsaf_get_reg_field(void __iomem *base, u32 reg, u32 mask,
+                                     u32 shift)
 {
         u32 origin;
 
diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_netdev.c b/drivers/net/ethernet/intel/fm10k/fm10k_netdev.c
index 639263d5e833..7781e80896a6 100644
--- a/drivers/net/ethernet/intel/fm10k/fm10k_netdev.c
+++ b/drivers/net/ethernet/intel/fm10k/fm10k_netdev.c
@@ -627,8 +627,10 @@ static netdev_tx_t fm10k_xmit_frame(struct sk_buff *skb, struct net_device *dev)
 
                 /* verify the skb head is not shared */
                 err = skb_cow_head(skb, 0);
-                if (err)
+                if (err) {
+                        dev_kfree_skb(skb);
                         return NETDEV_TX_OK;
+                }
 
                 /* locate vlan header */
                 vhdr = (struct vlan_hdr *)(skb->data + ETH_HLEN);
diff --git a/drivers/net/ethernet/intel/i40e/i40e_adminq.c b/drivers/net/ethernet/intel/i40e/i40e_adminq.c
index 0ff8f01e57ee..1fd5ea82a9bc 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_adminq.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_adminq.c
@@ -567,10 +567,6 @@ i40e_status i40e_init_adminq(struct i40e_hw *hw)
                 goto init_adminq_exit;
         }
 
-        /* initialize locks */
-        mutex_init(&hw->aq.asq_mutex);
-        mutex_init(&hw->aq.arq_mutex);
-
         /* Set up register offsets */
         i40e_adminq_init_regs(hw);
 
@@ -664,8 +660,6 @@ i40e_status i40e_shutdown_adminq(struct i40e_hw *hw)
         i40e_shutdown_asq(hw);
         i40e_shutdown_arq(hw);
 
-        /* destroy the locks */
-
         if (hw->nvm_buff.va)
                 i40e_free_virt_mem(hw, &hw->nvm_buff);
 
diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
index b825f978d441..4a9873ec28c7 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
@@ -10295,6 +10295,12 @@ static int i40e_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         /* set up a default setting for link flow control */
         pf->hw.fc.requested_mode = I40E_FC_NONE;
 
+        /* set up the locks for the AQ, do this only once in probe
+         * and destroy them only once in remove
+         */
+        mutex_init(&hw->aq.asq_mutex);
+        mutex_init(&hw->aq.arq_mutex);
+
         err = i40e_init_adminq(hw);
 
         /* provide nvm, fw, api versions */
@@ -10697,7 +10703,6 @@ static void i40e_remove(struct pci_dev *pdev)
         set_bit(__I40E_DOWN, &pf->state);
         del_timer_sync(&pf->service_timer);
         cancel_work_sync(&pf->service_task);
-        i40e_fdir_teardown(pf);
 
         if (pf->flags & I40E_FLAG_SRIOV_ENABLED) {
                 i40e_free_vfs(pf);
@@ -10740,6 +10745,10 @@ static void i40e_remove(struct pci_dev *pdev)
                          "Failed to destroy the Admin Queue resources: %d\n",
                          ret_code);
 
+        /* destroy the locks only once, here */
+        mutex_destroy(&hw->aq.arq_mutex);
+        mutex_destroy(&hw->aq.asq_mutex);
+
         /* Clear all dynamic memory lists of rings, q_vectors, and VSIs */
         i40e_clear_interrupt_scheme(pf);
         for (i = 0; i < pf->num_alloc_vsi; i++) {
diff --git a/drivers/net/ethernet/intel/i40evf/i40e_adminq.c b/drivers/net/ethernet/intel/i40evf/i40e_adminq.c
index fd123ca60761..3f65e39b3fe4 100644
--- a/drivers/net/ethernet/intel/i40evf/i40e_adminq.c
+++ b/drivers/net/ethernet/intel/i40evf/i40e_adminq.c
@@ -551,10 +551,6 @@ i40e_status i40evf_init_adminq(struct i40e_hw *hw)
                 goto init_adminq_exit;
         }
 
-        /* initialize locks */
-        mutex_init(&hw->aq.asq_mutex);
-        mutex_init(&hw->aq.arq_mutex);
-
         /* Set up register offsets */
         i40e_adminq_init_regs(hw);
 
@@ -596,8 +592,6 @@ i40e_status i40evf_shutdown_adminq(struct i40e_hw *hw)
         i40e_shutdown_asq(hw);
         i40e_shutdown_arq(hw);
 
-        /* destroy the locks */
-
         if (hw->nvm_buff.va)
                 i40e_free_virt_mem(hw, &hw->nvm_buff);
 
diff --git a/drivers/net/ethernet/intel/i40evf/i40evf_main.c b/drivers/net/ethernet/intel/i40evf/i40evf_main.c
index d962164dfb0f..99d2cffae0cd 100644
--- a/drivers/net/ethernet/intel/i40evf/i40evf_main.c
+++ b/drivers/net/ethernet/intel/i40evf/i40evf_main.c
@@ -2476,6 +2476,12 @@ static int i40evf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         hw->bus.device = PCI_SLOT(pdev->devfn);
         hw->bus.func = PCI_FUNC(pdev->devfn);
 
+        /* set up the locks for the AQ, do this only once in probe
+         * and destroy them only once in remove
+         */
+        mutex_init(&hw->aq.asq_mutex);
+        mutex_init(&hw->aq.arq_mutex);
+
         INIT_LIST_HEAD(&adapter->mac_filter_list);
         INIT_LIST_HEAD(&adapter->vlan_filter_list);
 
@@ -2629,6 +2635,10 @@ static void i40evf_remove(struct pci_dev *pdev)
         if (hw->aq.asq.count)
                 i40evf_shutdown_adminq(hw);
 
+        /* destroy the locks only once, here */
+        mutex_destroy(&hw->aq.arq_mutex);
+        mutex_destroy(&hw->aq.asq_mutex);
+
         iounmap(hw->hw_addr);
         pci_release_regions(pdev);
 
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index 47395ff5d908..aed8d029b23d 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -7920,6 +7920,9 @@ int ixgbe_setup_tc(struct net_device *dev, u8 tc)
          */
         if (netif_running(dev))
                 ixgbe_close(dev);
+        else
+                ixgbe_reset(adapter);
+
         ixgbe_clear_interrupt_scheme(adapter);
 
 #ifdef CONFIG_IXGBE_DCB
diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
index e84c7f2634d3..ed622fa29dfa 100644
--- a/drivers/net/ethernet/marvell/mvneta.c
+++ b/drivers/net/ethernet/marvell/mvneta.c
@@ -36,7 +36,7 @@
 
 /* Registers */
 #define MVNETA_RXQ_CONFIG_REG(q)                (0x1400 + ((q) << 2))
-#define      MVNETA_RXQ_HW_BUF_ALLOC            BIT(1)
+#define      MVNETA_RXQ_HW_BUF_ALLOC            BIT(0)
 #define      MVNETA_RXQ_PKT_OFFSET_ALL_MASK     (0xf    << 8)
 #define      MVNETA_RXQ_PKT_OFFSET_MASK(offs)   ((offs) << 8)
 #define MVNETA_RXQ_THRESHOLD_REG(q)             (0x14c0 + ((q) << 2))
@@ -62,6 +62,7 @@
 #define MVNETA_WIN_SIZE(w)                      (0x2204 + ((w) << 3))
 #define MVNETA_WIN_REMAP(w)                     (0x2280 + ((w) << 2))
 #define MVNETA_BASE_ADDR_ENABLE                 0x2290
+#define MVNETA_ACCESS_PROTECT_ENABLE            0x2294
 #define MVNETA_PORT_CONFIG                      0x2400
 #define      MVNETA_UNI_PROMISC_MODE            BIT(0)
 #define      MVNETA_DEF_RXQ(q)                  ((q) << 1)
@@ -159,7 +160,7 @@
 
 #define MVNETA_INTR_ENABLE                       0x25b8
 #define      MVNETA_TXQ_INTR_ENABLE_ALL_MASK     0x0000ff00
-#define      MVNETA_RXQ_INTR_ENABLE_ALL_MASK     0xff000000  // note: neta says it's 0x000000FF
+#define      MVNETA_RXQ_INTR_ENABLE_ALL_MASK     0x000000ff
 
 #define MVNETA_RXQ_CMD                           0x2680
 #define      MVNETA_RXQ_DISABLE_SHIFT            8
@@ -242,6 +243,7 @@
 #define MVNETA_VLAN_TAG_LEN             4
 
 #define MVNETA_CPU_D_CACHE_LINE_SIZE    32
+#define MVNETA_TX_CSUM_DEF_SIZE         1600
 #define MVNETA_TX_CSUM_MAX_SIZE         9800
 #define MVNETA_ACC_MODE_EXT             1
 
@@ -1579,12 +1581,16 @@ static int mvneta_rx(struct mvneta_port *pp, int rx_todo,
                 }
 
                 skb = build_skb(data, pp->frag_size > PAGE_SIZE ? 0 : pp->frag_size);
-                if (!skb)
-                        goto err_drop_frame;
 
+                /* After refill old buffer has to be unmapped regardless
+                 * the skb is successfully built or not.
+                 */
                 dma_unmap_single(dev->dev.parent, phys_addr,
                                  MVNETA_RX_BUF_SIZE(pp->pkt_size), DMA_FROM_DEVICE);
 
+                if (!skb)
+                        goto err_drop_frame;
+
                 rcvd_pkts++;
                 rcvd_bytes += rx_bytes;
 
@@ -3191,6 +3197,7 @@ static void mvneta_conf_mbus_windows(struct mvneta_port *pp,
         }
 
         mvreg_write(pp, MVNETA_BASE_ADDR_ENABLE, win_enable);
+        mvreg_write(pp, MVNETA_ACCESS_PROTECT_ENABLE, win_protect);
 }
 
 /* Power up the port */
@@ -3250,6 +3257,7 @@ static int mvneta_probe(struct platform_device *pdev)
         char hw_mac_addr[ETH_ALEN];
         const char *mac_from;
         const char *managed;
+        int tx_csum_limit;
         int phy_mode;
         int err;
         int cpu;
@@ -3350,8 +3358,21 @@ static int mvneta_probe(struct platform_device *pdev)
                 }
         }
 
-        if (of_device_is_compatible(dn, "marvell,armada-370-neta"))
-                pp->tx_csum_limit = 1600;
+        if (!of_property_read_u32(dn, "tx-csum-limit", &tx_csum_limit)) {
+                if (tx_csum_limit < 0 ||
+                    tx_csum_limit > MVNETA_TX_CSUM_MAX_SIZE) {
+                        tx_csum_limit = MVNETA_TX_CSUM_DEF_SIZE;
+                        dev_info(&pdev->dev,
+                                 "Wrong TX csum limit in DT, set to %dB\n",
+                                 MVNETA_TX_CSUM_DEF_SIZE);
+                }
+        } else if (of_device_is_compatible(dn, "marvell,armada-370-neta")) {
+                tx_csum_limit = MVNETA_TX_CSUM_DEF_SIZE;
+        } else {
+                tx_csum_limit = MVNETA_TX_CSUM_MAX_SIZE;
+        }
+
+        pp->tx_csum_limit = tx_csum_limit;
 
         pp->tx_ring_size = MVNETA_MAX_TXD;
         pp->rx_ring_size = MVNETA_MAX_RXD;
diff --git a/drivers/net/ethernet/marvell/mvpp2.c b/drivers/net/ethernet/marvell/mvpp2.c
index d9884fd15b45..a4beccf1fd46 100644
--- a/drivers/net/ethernet/marvell/mvpp2.c
+++ b/drivers/net/ethernet/marvell/mvpp2.c
@@ -3413,16 +3413,23 @@ static void mvpp2_bm_pool_bufsize_set(struct mvpp2 *priv,
 }
 
 /* Free all buffers from the pool */
-static void mvpp2_bm_bufs_free(struct mvpp2 *priv, struct mvpp2_bm_pool *bm_pool)
+static void mvpp2_bm_bufs_free(struct device *dev, struct mvpp2 *priv,
+                               struct mvpp2_bm_pool *bm_pool)
 {
         int i;
 
         for (i = 0; i < bm_pool->buf_num; i++) {
+                dma_addr_t buf_phys_addr;
                 u32 vaddr;
 
                 /* Get buffer virtual address (indirect access) */
-                mvpp2_read(priv, MVPP2_BM_PHY_ALLOC_REG(bm_pool->id));
+                buf_phys_addr = mvpp2_read(priv,
+                                           MVPP2_BM_PHY_ALLOC_REG(bm_pool->id));
                 vaddr = mvpp2_read(priv, MVPP2_BM_VIRT_ALLOC_REG);
+
+                dma_unmap_single(dev, buf_phys_addr,
+                                 bm_pool->buf_size, DMA_FROM_DEVICE);
+
                 if (!vaddr)
                         break;
                 dev_kfree_skb_any((struct sk_buff *)vaddr);
@@ -3439,7 +3446,7 @@ static int mvpp2_bm_pool_destroy(struct platform_device *pdev,
 {
         u32 val;
 
-        mvpp2_bm_bufs_free(priv, bm_pool);
+        mvpp2_bm_bufs_free(&pdev->dev, priv, bm_pool);
         if (bm_pool->buf_num) {
                 WARN(1, "cannot free all buffers in pool %d\n", bm_pool->id);
                 return 0;
@@ -3692,7 +3699,8 @@ mvpp2_bm_pool_use(struct mvpp2_port *port, int pool, enum mvpp2_bm_type type,
                                    MVPP2_BM_LONG_BUF_NUM :
                                    MVPP2_BM_SHORT_BUF_NUM;
                 else
-                        mvpp2_bm_bufs_free(port->priv, new_pool);
+                        mvpp2_bm_bufs_free(port->dev->dev.parent,
+                                           port->priv, new_pool);
 
                 new_pool->pkt_size = pkt_size;
 
@@ -3756,7 +3764,7 @@ static int mvpp2_bm_update_mtu(struct net_device *dev, int mtu)
         int pkt_size = MVPP2_RX_PKT_SIZE(mtu);
 
         /* Update BM pool with new buffer size */
-        mvpp2_bm_bufs_free(port->priv, port_pool);
+        mvpp2_bm_bufs_free(dev->dev.parent, port->priv, port_pool);
         if (port_pool->buf_num) {
                 WARN(1, "cannot free all buffers in pool %d\n", port_pool->id);
                 return -EIO;
@@ -4401,11 +4409,10 @@ static void mvpp2_txq_bufs_free(struct mvpp2_port *port,
 
                 mvpp2_txq_inc_get(txq_pcpu);
 
-                if (!skb)
-                        continue;
-
                 dma_unmap_single(port->dev->dev.parent, buf_phys_addr,
                                  skb_headlen(skb), DMA_TO_DEVICE);
+                if (!skb)
+                        continue;
                 dev_kfree_skb_any(skb);
         }
 }
@@ -5092,7 +5099,8 @@ static int mvpp2_rx(struct mvpp2_port *port, int rx_todo,
                     struct mvpp2_rx_queue *rxq)
 {
         struct net_device *dev = port->dev;
-        int rx_received, rx_filled, i;
+        int rx_received;
+        int rx_done = 0;
         u32 rcvd_pkts = 0;
         u32 rcvd_bytes = 0;
 
@@ -5101,17 +5109,18 @@ static int mvpp2_rx(struct mvpp2_port *port, int rx_todo,
         if (rx_todo > rx_received)
                 rx_todo = rx_received;
 
-        rx_filled = 0;
-        for (i = 0; i < rx_todo; i++) {
+        while (rx_done < rx_todo) {
                 struct mvpp2_rx_desc *rx_desc = mvpp2_rxq_next_desc_get(rxq);
                 struct mvpp2_bm_pool *bm_pool;
                 struct sk_buff *skb;
+                dma_addr_t phys_addr;
                 u32 bm, rx_status;
                 int pool, rx_bytes, err;
 
-                rx_filled++;
+                rx_done++;
                 rx_status = rx_desc->status;
                 rx_bytes = rx_desc->data_size - MVPP2_MH_SIZE;
+                phys_addr = rx_desc->buf_phys_addr;
 
                 bm = mvpp2_bm_cookie_build(rx_desc);
                 pool = mvpp2_bm_cookie_pool_get(bm);
@@ -5128,8 +5137,10 @@ static int mvpp2_rx(struct mvpp2_port *port, int rx_todo,
                  * comprised by the RX descriptor.
                  */
                 if (rx_status & MVPP2_RXD_ERR_SUMMARY) {
+                err_drop_frame:
                         dev->stats.rx_errors++;
                         mvpp2_rx_error(port, rx_desc);
+                        /* Return the buffer to the pool */
                         mvpp2_pool_refill(port, bm, rx_desc->buf_phys_addr,
                                           rx_desc->buf_cookie);
                         continue;
@@ -5137,6 +5148,15 @@ static int mvpp2_rx(struct mvpp2_port *port, int rx_todo,
 
                 skb = (struct sk_buff *)rx_desc->buf_cookie;
 
+                err = mvpp2_rx_refill(port, bm_pool, bm, 0);
+                if (err) {
+                        netdev_err(port->dev, "failed to refill BM pools\n");
+                        goto err_drop_frame;
+                }
+
+                dma_unmap_single(dev->dev.parent, phys_addr,
+                                 bm_pool->buf_size, DMA_FROM_DEVICE);
+
                 rcvd_pkts++;
                 rcvd_bytes += rx_bytes;
                 atomic_inc(&bm_pool->in_use);
@@ -5147,12 +5167,6 @@ static int mvpp2_rx(struct mvpp2_port *port, int rx_todo,
                 mvpp2_rx_csum(port, rx_status, skb);
 
                 napi_gro_receive(&port->napi, skb);
-
-                err = mvpp2_rx_refill(port, bm_pool, bm, 0);
-                if (err) {
-                        netdev_err(port->dev, "failed to refill BM pools\n");
-                        rx_filled--;
-                }
         }
 
         if (rcvd_pkts) {
@@ -5166,7 +5180,7 @@ static int mvpp2_rx(struct mvpp2_port *port, int rx_todo,
 
         /* Update Rx queue management counters */
         wmb();
-        mvpp2_rxq_status_update(port, rxq->id, rx_todo, rx_filled);
+        mvpp2_rxq_status_update(port, rxq->id, rx_done, rx_done);
 
         return rx_todo;
 }
diff --git a/drivers/net/ethernet/mellanox/mlx4/cmd.c b/drivers/net/ethernet/mellanox/mlx4/cmd.c
index 2177e56ed0be..d48d5793407d 100644
--- a/drivers/net/ethernet/mellanox/mlx4/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx4/cmd.c
@@ -1010,7 +1010,7 @@ static int mlx4_MAD_IFC_wrapper(struct mlx4_dev *dev, int slave,
                 if (!(smp->mgmt_class == IB_MGMT_CLASS_SUBN_LID_ROUTED &&
                       smp->method == IB_MGMT_METHOD_GET) || network_view) {
                         mlx4_err(dev, "Unprivileged slave %d is trying to execute a Subnet MGMT MAD, class 0x%x, method 0x%x, view=%s for attr 0x%x. Rejecting\n",
-                                 slave, smp->method, smp->mgmt_class,
+                                 slave, smp->mgmt_class, smp->method,
                                  network_view ? "Network" : "Host",
                                  be16_to_cpu(smp->attr_id));
                         return -EPERM;
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_clock.c b/drivers/net/ethernet/mellanox/mlx4/en_clock.c
index 8a083d73efdb..038f9ce391e6 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_clock.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_clock.c
@@ -242,6 +242,13 @@ void mlx4_en_init_timestamp(struct mlx4_en_dev *mdev)
         unsigned long flags;
         u64 ns, zero = 0;
 
+        /* mlx4_en_init_timestamp is called for each netdev.
+         * mdev->ptp_clock is common for all ports, skip initialization if
+         * was done for other port.
+         */
+        if (mdev->ptp_clock)
+                return;
+
         rwlock_init(&mdev->clock_lock);
 
         memset(&mdev->cycles, 0, sizeof(mdev->cycles));
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_main.c b/drivers/net/ethernet/mellanox/mlx4/en_main.c
index 005f910ec955..e0ec280a7fa1 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_main.c
@@ -232,9 +232,6 @@ static void mlx4_en_remove(struct mlx4_dev *dev, void *endev_ptr)
                 if (mdev->pndev[i])
                         mlx4_en_destroy_netdev(mdev->pndev[i]);
 
-        if (mdev->dev->caps.flags2 & MLX4_DEV_CAP_FLAG2_TS)
-                mlx4_en_remove_timestamp(mdev);
-
         flush_workqueue(mdev->workqueue);
         destroy_workqueue(mdev->workqueue);
         (void) mlx4_mr_free(dev, &mdev->mr);
@@ -320,10 +317,6 @@ static void *mlx4_en_add(struct mlx4_dev *dev)
         mlx4_foreach_port(i, dev, MLX4_PORT_TYPE_ETH)
                 mdev->port_cnt++;
 
-        /* Initialize time stamp mechanism */
-        if (mdev->dev->caps.flags2 & MLX4_DEV_CAP_FLAG2_TS)
-                mlx4_en_init_timestamp(mdev);
-
         /* Set default number of RX rings*/
         mlx4_en_set_num_rx_rings(mdev);
 
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
index 886e1bc86374..7869f97de5da 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
@@ -2072,6 +2072,9 @@ void mlx4_en_destroy_netdev(struct net_device *dev)
         /* flush any pending task for this netdev */
         flush_workqueue(mdev->workqueue);
 
+        if (mdev->dev->caps.flags2 & MLX4_DEV_CAP_FLAG2_TS)
+                mlx4_en_remove_timestamp(mdev);
+
         /* Detach the netdev so tasks would not attempt to access it */
         mutex_lock(&mdev->state_lock);
         mdev->pndev[priv->port] = NULL;
@@ -3058,9 +3061,12 @@ int mlx4_en_init_netdev(struct mlx4_en_dev *mdev, int port,
         }
         queue_delayed_work(mdev->workqueue, &priv->stats_task, STATS_DELAY);
 
+        /* Initialize time stamp mechanism */
         if (mdev->dev->caps.flags2 & MLX4_DEV_CAP_FLAG2_TS)
-                queue_delayed_work(mdev->workqueue, &priv->service_task,
-                                   SERVICE_TASK_DELAY);
+                mlx4_en_init_timestamp(mdev);
+
+        queue_delayed_work(mdev->workqueue, &priv->service_task,
+                           SERVICE_TASK_DELAY);
 
         mlx4_en_set_stats_bitmap(mdev->dev, &priv->stats_bitmap,
                                  mdev->profile.prof[priv->port].rx_ppp,
diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
index 6fec3e993d02..cad6c44df91c 100644
--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
+++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
@@ -4306,9 +4306,10 @@ int mlx4_QP_FLOW_STEERING_ATTACH_wrapper(struct mlx4_dev *dev, int slave,
                 return -EOPNOTSUPP;
 
         ctrl = (struct mlx4_net_trans_rule_hw_ctrl *)inbox->buf;
-        ctrl->port = mlx4_slave_convert_port(dev, slave, ctrl->port);
-        if (ctrl->port <= 0)
+        err = mlx4_slave_convert_port(dev, slave, ctrl->port);
+        if (err <= 0)
                 return -EINVAL;
+        ctrl->port = err;
         qpn = be32_to_cpu(ctrl->qpn) & 0xffffff;
         err = get_res(dev, slave, qpn, RES_QP, &rqp);
         if (err) {
diff --git a/drivers/net/ethernet/natsemi/natsemi.c b/drivers/net/ethernet/natsemi/natsemi.c
index b83f7c0fcf99..122c2ee3dfe2 100644
--- a/drivers/net/ethernet/natsemi/natsemi.c
+++ b/drivers/net/ethernet/natsemi/natsemi.c
@@ -1937,6 +1937,12 @@ static void refill_rx(struct net_device *dev)
                                 break; /* Better luck next round. */
                         np->rx_dma[entry] = pci_map_single(np->pci_dev,
                                 skb->data, buflen, PCI_DMA_FROMDEVICE);
+                        if (pci_dma_mapping_error(np->pci_dev,
+                                                  np->rx_dma[entry])) {
+                                dev_kfree_skb_any(skb);
+                                np->rx_skbuff[entry] = NULL;
+                                break; /* Better luck next round. */
+                        }
                         np->rx_ring[entry].addr = cpu_to_le32(np->rx_dma[entry]);
                 }
                 np->rx_ring[entry].cmd_status = cpu_to_le32(np->rx_buf_sz);
@@ -2093,6 +2099,12 @@ static netdev_tx_t start_tx(struct sk_buff *skb, struct net_device *dev)
         np->tx_skbuff[entry] = skb;
         np->tx_dma[entry] = pci_map_single(np->pci_dev,
                                 skb->data,skb->len, PCI_DMA_TODEVICE);
+        if (pci_dma_mapping_error(np->pci_dev, np->tx_dma[entry])) {
+                np->tx_skbuff[entry] = NULL;
+                dev_kfree_skb_irq(skb);
+                dev->stats.tx_dropped++;
+                return NETDEV_TX_OK;
+        }
 
         np->tx_ring[entry].addr = cpu_to_le32(np->tx_dma[entry]);
 
diff --git a/drivers/net/ethernet/nxp/lpc_eth.c b/drivers/net/ethernet/nxp/lpc_eth.c
index b159ef8303cc..057665180f13 100644
--- a/drivers/net/ethernet/nxp/lpc_eth.c
+++ b/drivers/net/ethernet/nxp/lpc_eth.c
@@ -1326,7 +1326,7 @@ static int lpc_eth_drv_probe(struct platform_device *pdev)
         /* Get platform resources */
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         irq = platform_get_irq(pdev, 0);
-        if ((!res) || (irq < 0) || (irq >= NR_IRQS)) {
+        if (!res || irq < 0) {
                 dev_err(&pdev->dev, "error getting resources.\n");
                 ret = -ENXIO;
                 goto err_exit;
diff --git a/drivers/net/ethernet/qlogic/qed/qed.h b/drivers/net/ethernet/qlogic/qed/qed.h
index ac17d8669b1a..1292c360390c 100644
--- a/drivers/net/ethernet/qlogic/qed/qed.h
+++ b/drivers/net/ethernet/qlogic/qed/qed.h
@@ -299,6 +299,7 @@ struct qed_hwfn {
 
         /* Flag indicating whether interrupts are enabled or not*/
         bool                            b_int_enabled;
+        bool                            b_int_requested;
 
         struct qed_mcp_info             *mcp_info;
 
@@ -491,6 +492,8 @@ u32 qed_unzip_data(struct qed_hwfn *p_hwfn,
                    u32 input_len, u8 *input_buf,
                    u32 max_size, u8 *unzip_buf);
 
+int qed_slowpath_irq_req(struct qed_hwfn *hwfn);
+
 #define QED_ETH_INTERFACE_VERSION       300
 
 #endif /* _QED_H */
diff --git a/drivers/net/ethernet/qlogic/qed/qed_dev.c b/drivers/net/ethernet/qlogic/qed/qed_dev.c
index 803b190ccada..817bbd5476ff 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_dev.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_dev.c
@@ -1385,52 +1385,63 @@ err0:
         return rc;
 }
 
-static u32 qed_hw_bar_size(struct qed_dev *cdev,
-                           u8 bar_id)
+static u32 qed_hw_bar_size(struct qed_hwfn      *p_hwfn,
+                           u8                   bar_id)
 {
-        u32 size = pci_resource_len(cdev->pdev, (bar_id > 0) ? 2 : 0);
+        u32 bar_reg = (bar_id == 0 ? PGLUE_B_REG_PF_BAR0_SIZE
+                       : PGLUE_B_REG_PF_BAR1_SIZE);
+        u32 val = qed_rd(p_hwfn, p_hwfn->p_main_ptt, bar_reg);
 
-        return size / cdev->num_hwfns;
+        /* Get the BAR size(in KB) from hardware given val */
+        return 1 << (val + 15);
 }
 
 int qed_hw_prepare(struct qed_dev *cdev,
                    int personality)
 {
-        int rc, i;
+        struct qed_hwfn *p_hwfn = QED_LEADING_HWFN(cdev);
+        int rc;
 
         /* Store the precompiled init data ptrs */
         qed_init_iro_array(cdev);
 
         /* Initialize the first hwfn - will learn number of hwfns */
-        rc = qed_hw_prepare_single(&cdev->hwfns[0], cdev->regview,
+        rc = qed_hw_prepare_single(p_hwfn,
+                                   cdev->regview,
                                    cdev->doorbells, personality);
         if (rc)
                 return rc;
 
-        personality = cdev->hwfns[0].hw_info.personality;
+        personality = p_hwfn->hw_info.personality;
 
         /* Initialize the rest of the hwfns */
-        for (i = 1; i < cdev->num_hwfns; i++) {
+        if (cdev->num_hwfns > 1) {
                 void __iomem *p_regview, *p_doorbell;
+                u8 __iomem *addr;
+
+                /* adjust bar offset for second engine */
+                addr = cdev->regview + qed_hw_bar_size(p_hwfn, 0) / 2;
+                p_regview = addr;
 
-                p_regview =  cdev->regview +
-                             i * qed_hw_bar_size(cdev, 0);
-                p_doorbell = cdev->doorbells +
-                             i * qed_hw_bar_size(cdev, 1);
-                rc = qed_hw_prepare_single(&cdev->hwfns[i], p_regview,
+                /* adjust doorbell bar offset for second engine */
+                addr = cdev->doorbells + qed_hw_bar_size(p_hwfn, 1) / 2;
+                p_doorbell = addr;
+
+                /* prepare second hw function */
+                rc = qed_hw_prepare_single(&cdev->hwfns[1], p_regview,
                                            p_doorbell, personality);
+
+                /* in case of error, need to free the previously
+                 * initiliazed hwfn 0.
+                 */
                 if (rc) {
-                        /* Cleanup previously initialized hwfns */
-                        while (--i >= 0) {
-                                qed_init_free(&cdev->hwfns[i]);
-                                qed_mcp_free(&cdev->hwfns[i]);
-                                qed_hw_hwfn_free(&cdev->hwfns[i]);
-                        }
-                        return rc;
+                        qed_init_free(p_hwfn);
+                        qed_mcp_free(p_hwfn);
+                        qed_hw_hwfn_free(p_hwfn);
                 }
         }
 
-        return 0;
+        return rc;
 }
 
 void qed_hw_remove(struct qed_dev *cdev)
diff --git a/drivers/net/ethernet/qlogic/qed/qed_int.c b/drivers/net/ethernet/qlogic/qed/qed_int.c
index de50e84902af..9cc9d62c1fec 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_int.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_int.c
@@ -783,22 +783,16 @@ void qed_int_igu_enable_int(struct qed_hwfn *p_hwfn,
         qed_wr(p_hwfn, p_ptt, IGU_REG_PF_CONFIGURATION, igu_pf_conf);
 }
 
-void qed_int_igu_enable(struct qed_hwfn *p_hwfn,
-                        struct qed_ptt *p_ptt,
-                        enum qed_int_mode int_mode)
+int qed_int_igu_enable(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt,
+                       enum qed_int_mode int_mode)
 {
-        int i;
-
-        p_hwfn->b_int_enabled = 1;
+        int rc, i;
 
         /* Mask non-link attentions */
         for (i = 0; i < 9; i++)
                 qed_wr(p_hwfn, p_ptt,
                        MISC_REG_AEU_ENABLE1_IGU_OUT_0 + (i << 2), 0);
 
-        /* Enable interrupt Generation */
-        qed_int_igu_enable_int(p_hwfn, p_ptt, int_mode);
-
         /* Configure AEU signal change to produce attentions for link */
         qed_wr(p_hwfn, p_ptt, IGU_REG_LEADING_EDGE_LATCH, 0xfff);
         qed_wr(p_hwfn, p_ptt, IGU_REG_TRAILING_EDGE_LATCH, 0xfff);
@@ -808,6 +802,19 @@ void qed_int_igu_enable(struct qed_hwfn *p_hwfn,
 
         /* Unmask AEU signals toward IGU */
         qed_wr(p_hwfn, p_ptt, MISC_REG_AEU_MASK_ATTN_IGU, 0xff);
+        if ((int_mode != QED_INT_MODE_INTA) || IS_LEAD_HWFN(p_hwfn)) {
+                rc = qed_slowpath_irq_req(p_hwfn);
+                if (rc != 0) {
+                        DP_NOTICE(p_hwfn, "Slowpath IRQ request failed\n");
+                        return -EINVAL;
+                }
+                p_hwfn->b_int_requested = true;
+        }
+        /* Enable interrupt Generation */
+        qed_int_igu_enable_int(p_hwfn, p_ptt, int_mode);
+        p_hwfn->b_int_enabled = 1;
+
+        return rc;
 }
 
 void qed_int_igu_disable_int(struct qed_hwfn *p_hwfn,
@@ -1127,3 +1134,11 @@ int qed_int_get_num_sbs(struct qed_hwfn *p_hwfn,
 
         return info->igu_sb_cnt;
 }
+
+void qed_int_disable_post_isr_release(struct qed_dev *cdev)
+{
+        int i;
+
+        for_each_hwfn(cdev, i)
+                cdev->hwfns[i].b_int_requested = false;
+}
diff --git a/drivers/net/ethernet/qlogic/qed/qed_int.h b/drivers/net/ethernet/qlogic/qed/qed_int.h
index 16b57518e706..51e0b09a7f47 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_int.h
+++ b/drivers/net/ethernet/qlogic/qed/qed_int.h
@@ -169,10 +169,14 @@ int qed_int_get_num_sbs(struct qed_hwfn *p_hwfn,
                         int *p_iov_blks);
 
 /**
- * @file
+ * @brief qed_int_disable_post_isr_release - performs the cleanup post ISR
+ *        release. The API need to be called after releasing all slowpath IRQs
+ *        of the device.
+ *
+ * @param cdev
  *
- * @brief Interrupt handler
  */
+void qed_int_disable_post_isr_release(struct qed_dev *cdev);
 
 #define QED_CAU_DEF_RX_TIMER_RES 0
 #define QED_CAU_DEF_TX_TIMER_RES 0
@@ -366,10 +370,11 @@ void qed_int_setup(struct qed_hwfn *p_hwfn,
  * @param p_hwfn
  * @param p_ptt
  * @param int_mode
+ *
+ * @return int
  */
-void qed_int_igu_enable(struct qed_hwfn *p_hwfn,
-                        struct qed_ptt *p_ptt,
-                        enum qed_int_mode int_mode);
+int qed_int_igu_enable(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt,
+                       enum qed_int_mode int_mode);
 
 /**
  * @brief - Initialize CAU status block entry
diff --git a/drivers/net/ethernet/qlogic/qed/qed_main.c b/drivers/net/ethernet/qlogic/qed/qed_main.c
index 947c7af72b25..174f7341c5c3 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_main.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_main.c
@@ -476,41 +476,22 @@ static irqreturn_t qed_single_int(int irq, void *dev_instance)
         return rc;
 }
 
-static int qed_slowpath_irq_req(struct qed_dev *cdev)
+int qed_slowpath_irq_req(struct qed_hwfn *hwfn)
 {
-        int i = 0, rc = 0;
+        struct qed_dev *cdev = hwfn->cdev;
+        int rc = 0;
+        u8 id;
 
         if (cdev->int_params.out.int_mode == QED_INT_MODE_MSIX) {
-                /* Request all the slowpath MSI-X vectors */
-                for (i = 0; i < cdev->num_hwfns; i++) {
-                        snprintf(cdev->hwfns[i].name, NAME_SIZE,
-                                 "sp-%d-%02x:%02x.%02x",
-                                 i, cdev->pdev->bus->number,
-                                 PCI_SLOT(cdev->pdev->devfn),
-                                 cdev->hwfns[i].abs_pf_id);
-
-                        rc = request_irq(cdev->int_params.msix_table[i].vector,
-                                         qed_msix_sp_int, 0,
-                                         cdev->hwfns[i].name,
-                                         cdev->hwfns[i].sp_dpc);
-                        if (rc)
-                                break;
-
-                        DP_VERBOSE(&cdev->hwfns[i],
-                                   (NETIF_MSG_INTR | QED_MSG_SP),
+                id = hwfn->my_id;
+                snprintf(hwfn->name, NAME_SIZE, "sp-%d-%02x:%02x.%02x",
+                         id, cdev->pdev->bus->number,
+                         PCI_SLOT(cdev->pdev->devfn), hwfn->abs_pf_id);
+                rc = request_irq(cdev->int_params.msix_table[id].vector,
+                                 qed_msix_sp_int, 0, hwfn->name, hwfn->sp_dpc);
+                if (!rc)
+                        DP_VERBOSE(hwfn, (NETIF_MSG_INTR | QED_MSG_SP),
                                    "Requested slowpath MSI-X\n");
-                }
-
-                if (i != cdev->num_hwfns) {
-                        /* Free already request MSI-X vectors */
-                        for (i--; i >= 0; i--) {
-                                unsigned int vec =
-                                        cdev->int_params.msix_table[i].vector;
-                                synchronize_irq(vec);
-                                free_irq(cdev->int_params.msix_table[i].vector,
-                                         cdev->hwfns[i].sp_dpc);
-                        }
-                }
         } else {
                 unsigned long flags = 0;
 
@@ -534,13 +515,17 @@ static void qed_slowpath_irq_free(struct qed_dev *cdev)
 
         if (cdev->int_params.out.int_mode == QED_INT_MODE_MSIX) {
                 for_each_hwfn(cdev, i) {
+                        if (!cdev->hwfns[i].b_int_requested)
+                                break;
                         synchronize_irq(cdev->int_params.msix_table[i].vector);
                         free_irq(cdev->int_params.msix_table[i].vector,
                                  cdev->hwfns[i].sp_dpc);
                 }
         } else {
-                free_irq(cdev->pdev->irq, cdev);
+                if (QED_LEADING_HWFN(cdev)->b_int_requested)
+                        free_irq(cdev->pdev->irq, cdev);
         }
+        qed_int_disable_post_isr_release(cdev);
 }
 
 static int qed_nic_stop(struct qed_dev *cdev)
@@ -765,16 +750,11 @@ static int qed_slowpath_start(struct qed_dev *cdev,
         if (rc)
                 goto err1;
 
-        /* Request the slowpath IRQ */
-        rc = qed_slowpath_irq_req(cdev);
-        if (rc)
-                goto err2;
-
         /* Allocate stream for unzipping */
         rc = qed_alloc_stream_mem(cdev);
         if (rc) {
                 DP_NOTICE(cdev, "Failed to allocate stream memory\n");
-                goto err3;
+                goto err2;
         }
 
         /* Start the slowpath */
diff --git a/drivers/net/ethernet/qlogic/qed/qed_reg_addr.h b/drivers/net/ethernet/qlogic/qed/qed_reg_addr.h
index 7a5ce5914ace..e8df12335a97 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_reg_addr.h
+++ b/drivers/net/ethernet/qlogic/qed/qed_reg_addr.h
@@ -363,4 +363,8 @@
                 0x7 << 0)
 #define  MCP_REG_NVM_CFG4_FLASH_SIZE_SHIFT \
         0
+#define PGLUE_B_REG_PF_BAR0_SIZE \
+        0x2aae60UL
+#define PGLUE_B_REG_PF_BAR1_SIZE \
+        0x2aae64UL
 #endif
diff --git a/drivers/net/ethernet/qlogic/qed/qed_sp.h b/drivers/net/ethernet/qlogic/qed/qed_sp.h
index 31a1f1eb4f56..287fadfab52d 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_sp.h
+++ b/drivers/net/ethernet/qlogic/qed/qed_sp.h
@@ -124,8 +124,12 @@ struct qed_spq {
         dma_addr_t              p_phys;
         struct qed_spq_entry    *p_virt;
 
-        /* Used as index for completions (returns on EQ by FW) */
-        u16                     echo_idx;
+#define SPQ_RING_SIZE \
+        (CORE_SPQE_PAGE_SIZE_BYTES / sizeof(struct slow_path_element))
+
+        /* Bitmap for handling out-of-order completions */
+        DECLARE_BITMAP(p_comp_bitmap, SPQ_RING_SIZE);
+        u8                      comp_bitmap_idx;
 
         /* Statistics */
         u32                     unlimited_pending_count;
diff --git a/drivers/net/ethernet/qlogic/qed/qed_spq.c b/drivers/net/ethernet/qlogic/qed/qed_spq.c
index 7c0b8459666e..3dd548ab8df1 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_spq.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_spq.c
@@ -112,8 +112,6 @@ static int
 qed_spq_fill_entry(struct qed_hwfn *p_hwfn,
                    struct qed_spq_entry *p_ent)
 {
-        p_ent->elem.hdr.echo = 0;
-        p_hwfn->p_spq->echo_idx++;
         p_ent->flags = 0;
 
         switch (p_ent->comp_mode) {
@@ -195,10 +193,12 @@ static int qed_spq_hw_post(struct qed_hwfn *p_hwfn,
                            struct qed_spq *p_spq,
                            struct qed_spq_entry *p_ent)
 {
-        struct qed_chain                *p_chain = &p_hwfn->p_spq->chain;
+        struct qed_chain *p_chain = &p_hwfn->p_spq->chain;
+        u16 echo = qed_chain_get_prod_idx(p_chain);
         struct slow_path_element        *elem;
         struct core_db_data             db;
 
+        p_ent->elem.hdr.echo    = cpu_to_le16(echo);
         elem = qed_chain_produce(p_chain);
         if (!elem) {
                 DP_NOTICE(p_hwfn, "Failed to produce from SPQ chain\n");
@@ -437,7 +437,9 @@ void qed_spq_setup(struct qed_hwfn *p_hwfn)
         p_spq->comp_count               = 0;
         p_spq->comp_sent_count          = 0;
         p_spq->unlimited_pending_count  = 0;
-        p_spq->echo_idx                 = 0;
+
+        bitmap_zero(p_spq->p_comp_bitmap, SPQ_RING_SIZE);
+        p_spq->comp_bitmap_idx = 0;
 
         /* SPQ cid, cannot fail */
         qed_cxt_acquire_cid(p_hwfn, PROTOCOLID_CORE, &p_spq->cid);
@@ -582,26 +584,32 @@ qed_spq_add_entry(struct qed_hwfn *p_hwfn,
         struct qed_spq *p_spq = p_hwfn->p_spq;
 
         if (p_ent->queue == &p_spq->unlimited_pending) {
-                struct qed_spq_entry *p_en2;
 
                 if (list_empty(&p_spq->free_pool)) {
                         list_add_tail(&p_ent->list, &p_spq->unlimited_pending);
                         p_spq->unlimited_pending_count++;
 
                         return 0;
-                }
+                } else {
+                        struct qed_spq_entry *p_en2;
 
-                p_en2 = list_first_entry(&p_spq->free_pool,
-                                         struct qed_spq_entry,
-                                         list);
-                list_del(&p_en2->list);
+                        p_en2 = list_first_entry(&p_spq->free_pool,
+                                                 struct qed_spq_entry,
+                                                 list);
+                        list_del(&p_en2->list);
+
+                        /* Copy the ring element physical pointer to the new
+                         * entry, since we are about to override the entire ring
+                         * entry and don't want to lose the pointer.
+                         */
+                        p_ent->elem.data_ptr = p_en2->elem.data_ptr;
 
-                /* Strcut assignment */
-                *p_en2 = *p_ent;
+                        *p_en2 = *p_ent;
 
-                kfree(p_ent);
+                        kfree(p_ent);
 
-                p_ent = p_en2;
+                        p_ent = p_en2;
+                }
         }
 
         /* entry is to be placed in 'pending' queue */
@@ -777,13 +785,38 @@ int qed_spq_completion(struct qed_hwfn *p_hwfn,
         list_for_each_entry_safe(p_ent, tmp, &p_spq->completion_pending,
                                  list) {
                 if (p_ent->elem.hdr.echo == echo) {
+                        u16 pos = le16_to_cpu(echo) % SPQ_RING_SIZE;
+
                         list_del(&p_ent->list);
 
-                        qed_chain_return_produced(&p_spq->chain);
+                        /* Avoid overriding of SPQ entries when getting
+                         * out-of-order completions, by marking the completions
+                         * in a bitmap and increasing the chain consumer only
+                         * for the first successive completed entries.
+                         */
+                        bitmap_set(p_spq->p_comp_bitmap, pos, SPQ_RING_SIZE);
+
+                        while (test_bit(p_spq->comp_bitmap_idx,
+                                        p_spq->p_comp_bitmap)) {
+                                bitmap_clear(p_spq->p_comp_bitmap,
+                                             p_spq->comp_bitmap_idx,
+                                             SPQ_RING_SIZE);
+                                p_spq->comp_bitmap_idx++;
+                                qed_chain_return_produced(&p_spq->chain);
+                        }
+
                         p_spq->comp_count++;
                         found = p_ent;
                         break;
                 }
+
+                /* This is relatively uncommon - depends on scenarios
+                 * which have mutliple per-PF sent ramrods.
+                 */
+                DP_VERBOSE(p_hwfn, QED_MSG_SPQ,
+                           "Got completion for echo %04x - doesn't match echo %04x in completion pending list\n",
+                           le16_to_cpu(echo),
+                           le16_to_cpu(p_ent->elem.hdr.echo));
         }
 
         /* Release lock before callback, as callback may post
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_vnic.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_vnic.c
index be7d7a62cc0d..34906750b7e7 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_vnic.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_vnic.c
@@ -246,12 +246,13 @@ int qlcnic_83xx_check_vnic_state(struct qlcnic_adapter *adapter)
         u32 state;
 
         state = QLCRDX(ahw, QLC_83XX_VNIC_STATE);
-        while (state != QLCNIC_DEV_NPAR_OPER && idc->vnic_wait_limit--) {
+        while (state != QLCNIC_DEV_NPAR_OPER && idc->vnic_wait_limit) {
+                idc->vnic_wait_limit--;
                 msleep(1000);
                 state = QLCRDX(ahw, QLC_83XX_VNIC_STATE);
         }
 
-        if (!idc->vnic_wait_limit) {
+        if (state != QLCNIC_DEV_NPAR_OPER) {
                 dev_err(&adapter->pdev->dev,
                         "vNIC mode not operational, state check timed out.\n");
                 return -EIO;
diff --git a/drivers/net/ethernet/qlogic/qlge/qlge_main.c b/drivers/net/ethernet/qlogic/qlge/qlge_main.c
index 02b7115b6aaa..997976426799 100644
--- a/drivers/net/ethernet/qlogic/qlge/qlge_main.c
+++ b/drivers/net/ethernet/qlogic/qlge/qlge_main.c
@@ -4211,8 +4211,9 @@ static int ql_change_rx_buffers(struct ql_adapter *qdev)
 
         /* Wait for an outstanding reset to complete. */
         if (!test_bit(QL_ADAPTER_UP, &qdev->flags)) {
-                int i = 3;
-                while (i-- && !test_bit(QL_ADAPTER_UP, &qdev->flags)) {
+                int i = 4;
+
+                while (--i && !test_bit(QL_ADAPTER_UP, &qdev->flags)) {
                         netif_err(qdev, ifup, qdev->ndev,
                                   "Waiting for adapter UP...\n");
                         ssleep(1);
diff --git a/drivers/net/ethernet/qualcomm/qca_spi.c b/drivers/net/ethernet/qualcomm/qca_spi.c
index ddb2c6c6ec94..689a4a5c8dcf 100644
--- a/drivers/net/ethernet/qualcomm/qca_spi.c
+++ b/drivers/net/ethernet/qualcomm/qca_spi.c
@@ -736,9 +736,8 @@ qcaspi_netdev_tx_timeout(struct net_device *dev)
         netdev_info(qca->net_dev, "Transmit timeout at %ld, latency %ld\n",
                     jiffies, jiffies - dev->trans_start);
         qca->net_dev->stats.tx_errors++;
-        /* wake the queue if there is room */
-        if (qcaspi_tx_ring_has_space(&qca->txr))
-                netif_wake_queue(dev);
+        /* Trigger tx queue flush and QCA7000 reset */
+        qca->sync = QCASPI_SYNC_UNKNOWN;
 }
 
 static int
diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c
index ee8d1ec61fab..467d41698fd5 100644
--- a/drivers/net/ethernet/renesas/ravb_main.c
+++ b/drivers/net/ethernet/renesas/ravb_main.c
@@ -905,6 +905,9 @@ static int ravb_phy_init(struct net_device *ndev)
                 netdev_info(ndev, "limited PHY to 100Mbit/s\n");
         }
 
+        /* 10BASE is not supported */
+        phydev->supported &= ~PHY_10BT_FEATURES;
+
         netdev_info(ndev, "attached PHY %d (IRQ %d) to driver %s\n",
                     phydev->addr, phydev->irq, phydev->drv->name);
 
@@ -1037,7 +1040,7 @@ static const char ravb_gstrings_stats[][ETH_GSTRING_LEN] = {
         "rx_queue_1_mcast_packets",
         "rx_queue_1_errors",
         "rx_queue_1_crc_errors",
-        "rx_queue_1_frame_errors_",
+        "rx_queue_1_frame_errors",
         "rx_queue_1_length_errors",
         "rx_queue_1_missed_errors",
         "rx_queue_1_over_errors",
@@ -1225,7 +1228,7 @@ static int ravb_open(struct net_device *ndev)
         /* Device init */
         error = ravb_dmac_init(ndev);
         if (error)
-                goto out_free_irq;
+                goto out_free_irq2;
         ravb_emac_init(ndev);
 
         /* Initialise PTP Clock driver */
@@ -1243,9 +1246,11 @@ static int ravb_open(struct net_device *ndev)
 out_ptp_stop:
         /* Stop PTP Clock driver */
         ravb_ptp_stop(ndev);
+out_free_irq2:
+        if (priv->chip_id == RCAR_GEN3)
+                free_irq(priv->emac_irq, ndev);
 out_free_irq:
         free_irq(ndev->irq, ndev);
-        free_irq(priv->emac_irq, ndev);
 out_napi_off:
         napi_disable(&priv->napi[RAVB_NC]);
         napi_disable(&priv->napi[RAVB_BE]);
diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
index e7bab7909ed9..6a8fc0f341ff 100644
--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -52,6 +52,8 @@
                 NETIF_MSG_RX_ERR| \
                 NETIF_MSG_TX_ERR)
 
+#define SH_ETH_OFFSET_INVALID   ((u16)~0)
+
 #define SH_ETH_OFFSET_DEFAULTS                  \
         [0 ... SH_ETH_MAX_REGISTER_OFFSET - 1] = SH_ETH_OFFSET_INVALID
 
@@ -404,6 +406,28 @@ static const u16 sh_eth_offset_fast_sh3_sh2[SH_ETH_MAX_REGISTER_OFFSET] = {
 static void sh_eth_rcv_snd_disable(struct net_device *ndev);
 static struct net_device_stats *sh_eth_get_stats(struct net_device *ndev);
 
+static void sh_eth_write(struct net_device *ndev, u32 data, int enum_index)
+{
+        struct sh_eth_private *mdp = netdev_priv(ndev);
+        u16 offset = mdp->reg_offset[enum_index];
+
+        if (WARN_ON(offset == SH_ETH_OFFSET_INVALID))
+                return;
+
+        iowrite32(data, mdp->addr + offset);
+}
+
+static u32 sh_eth_read(struct net_device *ndev, int enum_index)
+{
+        struct sh_eth_private *mdp = netdev_priv(ndev);
+        u16 offset = mdp->reg_offset[enum_index];
+
+        if (WARN_ON(offset == SH_ETH_OFFSET_INVALID))
+                return ~0U;
+
+        return ioread32(mdp->addr + offset);
+}
+
 static bool sh_eth_is_gether(struct sh_eth_private *mdp)
 {
         return mdp->reg_offset == sh_eth_offset_gigabit;
@@ -1143,6 +1167,7 @@ static void sh_eth_ring_format(struct net_device *ndev)
         int tx_ringsize = sizeof(*txdesc) * mdp->num_tx_ring;
         int skbuff_size = mdp->rx_buf_sz + SH_ETH_RX_ALIGN + 32 - 1;
         dma_addr_t dma_addr;
+        u32 buf_len;
 
         mdp->cur_rx = 0;
         mdp->cur_tx = 0;
@@ -1163,16 +1188,16 @@ static void sh_eth_ring_format(struct net_device *ndev)
                 /* RX descriptor */
                 rxdesc = &mdp->rx_ring[i];
                 /* The size of the buffer is a multiple of 32 bytes. */
-                rxdesc->buffer_length = ALIGN(mdp->rx_buf_sz, 32);
-                dma_addr = dma_map_single(&ndev->dev, skb->data,
-                                          rxdesc->buffer_length,
+                buf_len = ALIGN(mdp->rx_buf_sz, 32);
+                rxdesc->len = cpu_to_edmac(mdp, buf_len << 16);
+                dma_addr = dma_map_single(&ndev->dev, skb->data, buf_len,
                                           DMA_FROM_DEVICE);
                 if (dma_mapping_error(&ndev->dev, dma_addr)) {
                         kfree_skb(skb);
                         break;
                 }
                 mdp->rx_skbuff[i] = skb;
-                rxdesc->addr = dma_addr;
+                rxdesc->addr = cpu_to_edmac(mdp, dma_addr);
                 rxdesc->status = cpu_to_edmac(mdp, RD_RACT | RD_RFP);
 
                 /* Rx descriptor address set */
@@ -1196,7 +1221,7 @@ static void sh_eth_ring_format(struct net_device *ndev)
                 mdp->tx_skbuff[i] = NULL;
                 txdesc = &mdp->tx_ring[i];
                 txdesc->status = cpu_to_edmac(mdp, TD_TFP);
-                txdesc->buffer_length = 0;
+                txdesc->len = cpu_to_edmac(mdp, 0);
                 if (i == 0) {
                         /* Tx descriptor address set */
                         sh_eth_write(ndev, mdp->tx_desc_dma, TDLAR);
@@ -1403,8 +1428,10 @@ static int sh_eth_txfree(struct net_device *ndev)
                            entry, edmac_to_cpu(mdp, txdesc->status));
                 /* Free the original skb. */
                 if (mdp->tx_skbuff[entry]) {
-                        dma_unmap_single(&ndev->dev, txdesc->addr,
-                                         txdesc->buffer_length, DMA_TO_DEVICE);
+                        dma_unmap_single(&ndev->dev,
+                                         edmac_to_cpu(mdp, txdesc->addr),
+                                         edmac_to_cpu(mdp, txdesc->len) >> 16,
+                                         DMA_TO_DEVICE);
                         dev_kfree_skb_irq(mdp->tx_skbuff[entry]);
                         mdp->tx_skbuff[entry] = NULL;
                         free_num++;
@@ -1414,7 +1441,7 @@ static int sh_eth_txfree(struct net_device *ndev)
                         txdesc->status |= cpu_to_edmac(mdp, TD_TDLE);
 
                 ndev->stats.tx_packets++;
-                ndev->stats.tx_bytes += txdesc->buffer_length;
+                ndev->stats.tx_bytes += edmac_to_cpu(mdp, txdesc->len) >> 16;
         }
         return free_num;
 }
@@ -1433,6 +1460,7 @@ static int sh_eth_rx(struct net_device *ndev, u32 intr_status, int *quota)
         u32 desc_status;
         int skbuff_size = mdp->rx_buf_sz + SH_ETH_RX_ALIGN + 32 - 1;
         dma_addr_t dma_addr;
+        u32 buf_len;
 
         boguscnt = min(boguscnt, *quota);
         limit = boguscnt;
@@ -1441,7 +1469,7 @@ static int sh_eth_rx(struct net_device *ndev, u32 intr_status, int *quota)
                 /* RACT bit must be checked before all the following reads */
                 dma_rmb();
                 desc_status = edmac_to_cpu(mdp, rxdesc->status);
-                pkt_len = rxdesc->frame_length;
+                pkt_len = edmac_to_cpu(mdp, rxdesc->len) & RD_RFL;
 
                 if (--boguscnt < 0)
                         break;
@@ -1462,6 +1490,7 @@ static int sh_eth_rx(struct net_device *ndev, u32 intr_status, int *quota)
                 if (mdp->cd->shift_rd0)
                         desc_status >>= 16;
 
+                skb = mdp->rx_skbuff[entry];
                 if (desc_status & (RD_RFS1 | RD_RFS2 | RD_RFS3 | RD_RFS4 |
                                    RD_RFS5 | RD_RFS6 | RD_RFS10)) {
                         ndev->stats.rx_errors++;
@@ -1477,16 +1506,16 @@ static int sh_eth_rx(struct net_device *ndev, u32 intr_status, int *quota)
                                 ndev->stats.rx_missed_errors++;
                         if (desc_status & RD_RFS10)
                                 ndev->stats.rx_over_errors++;
-                } else {
+                } else  if (skb) {
+                        dma_addr = edmac_to_cpu(mdp, rxdesc->addr);
                         if (!mdp->cd->hw_swap)
                                 sh_eth_soft_swap(
-                                        phys_to_virt(ALIGN(rxdesc->addr, 4)),
+                                        phys_to_virt(ALIGN(dma_addr, 4)),
                                         pkt_len + 2);
-                        skb = mdp->rx_skbuff[entry];
                         mdp->rx_skbuff[entry] = NULL;
                         if (mdp->cd->rpadir)
                                 skb_reserve(skb, NET_IP_ALIGN);
-                        dma_unmap_single(&ndev->dev, rxdesc->addr,
+                        dma_unmap_single(&ndev->dev, dma_addr,
                                          ALIGN(mdp->rx_buf_sz, 32),
                                          DMA_FROM_DEVICE);
                         skb_put(skb, pkt_len);
@@ -1506,7 +1535,8 @@ static int sh_eth_rx(struct net_device *ndev, u32 intr_status, int *quota)
                 entry = mdp->dirty_rx % mdp->num_rx_ring;
                 rxdesc = &mdp->rx_ring[entry];
                 /* The size of the buffer is 32 byte boundary. */
-                rxdesc->buffer_length = ALIGN(mdp->rx_buf_sz, 32);
+                buf_len = ALIGN(mdp->rx_buf_sz, 32);
+                rxdesc->len = cpu_to_edmac(mdp, buf_len << 16);
 
                 if (mdp->rx_skbuff[entry] == NULL) {
                         skb = netdev_alloc_skb(ndev, skbuff_size);
@@ -1514,8 +1544,7 @@ static int sh_eth_rx(struct net_device *ndev, u32 intr_status, int *quota)
                                 break;  /* Better luck next round. */
                         sh_eth_set_receive_align(skb);
                         dma_addr = dma_map_single(&ndev->dev, skb->data,
-                                                  rxdesc->buffer_length,
-                                                  DMA_FROM_DEVICE);
+                                                  buf_len, DMA_FROM_DEVICE);
                         if (dma_mapping_error(&ndev->dev, dma_addr)) {
                                 kfree_skb(skb);
                                 break;
@@ -1523,7 +1552,7 @@ static int sh_eth_rx(struct net_device *ndev, u32 intr_status, int *quota)
                         mdp->rx_skbuff[entry] = skb;
 
                         skb_checksum_none_assert(skb);
-                        rxdesc->addr = dma_addr;
+                        rxdesc->addr = cpu_to_edmac(mdp, dma_addr);
                 }
                 dma_wmb(); /* RACT bit must be set after all the above writes */
                 if (entry >= mdp->num_rx_ring - 1)
@@ -2331,8 +2360,8 @@ static void sh_eth_tx_timeout(struct net_device *ndev)
         /* Free all the skbuffs in the Rx queue. */
         for (i = 0; i < mdp->num_rx_ring; i++) {
                 rxdesc = &mdp->rx_ring[i];
-                rxdesc->status = 0;
-                rxdesc->addr = 0xBADF00D0;
+                rxdesc->status = cpu_to_edmac(mdp, 0);
+                rxdesc->addr = cpu_to_edmac(mdp, 0xBADF00D0);
                 dev_kfree_skb(mdp->rx_skbuff[i]);
                 mdp->rx_skbuff[i] = NULL;
         }
@@ -2350,6 +2379,7 @@ static int sh_eth_start_xmit(struct sk_buff *skb, struct net_device *ndev)
 {
         struct sh_eth_private *mdp = netdev_priv(ndev);
         struct sh_eth_txdesc *txdesc;
+        dma_addr_t dma_addr;
         u32 entry;
         unsigned long flags;
 
@@ -2372,15 +2402,15 @@ static int sh_eth_start_xmit(struct sk_buff *skb, struct net_device *ndev)
         txdesc = &mdp->tx_ring[entry];
         /* soft swap. */
         if (!mdp->cd->hw_swap)
-                sh_eth_soft_swap(phys_to_virt(ALIGN(txdesc->addr, 4)),
-                                 skb->len + 2);
-        txdesc->addr = dma_map_single(&ndev->dev, skb->data, skb->len,
-                                      DMA_TO_DEVICE);
-        if (dma_mapping_error(&ndev->dev, txdesc->addr)) {
+                sh_eth_soft_swap(PTR_ALIGN(skb->data, 4), skb->len + 2);
+        dma_addr = dma_map_single(&ndev->dev, skb->data, skb->len,
+                                  DMA_TO_DEVICE);
+        if (dma_mapping_error(&ndev->dev, dma_addr)) {
                 kfree_skb(skb);
                 return NETDEV_TX_OK;
         }
-        txdesc->buffer_length = skb->len;
+        txdesc->addr = cpu_to_edmac(mdp, dma_addr);
+        txdesc->len  = cpu_to_edmac(mdp, skb->len << 16);
 
         dma_wmb(); /* TACT bit must be set after all the above writes */
         if (entry >= mdp->num_tx_ring - 1)
diff --git a/drivers/net/ethernet/renesas/sh_eth.h b/drivers/net/ethernet/renesas/sh_eth.h
index 50382b1c9ddc..72fcfc924589 100644
--- a/drivers/net/ethernet/renesas/sh_eth.h
+++ b/drivers/net/ethernet/renesas/sh_eth.h
@@ -283,7 +283,7 @@ enum DMAC_IM_BIT {
         DMAC_M_RINT1 = 0x00000001,
 };
 
-/* Receive descriptor bit */
+/* Receive descriptor 0 bits */
 enum RD_STS_BIT {
         RD_RACT = 0x80000000, RD_RDLE = 0x40000000,
         RD_RFP1 = 0x20000000, RD_RFP0 = 0x10000000,
@@ -298,6 +298,12 @@ enum RD_STS_BIT {
 #define RDFEND  RD_RFP0
 #define RD_RFP  (RD_RFP1|RD_RFP0)
 
+/* Receive descriptor 1 bits */
+enum RD_LEN_BIT {
+        RD_RFL  = 0x0000ffff,   /* receive frame  length */
+        RD_RBL  = 0xffff0000,   /* receive buffer length */
+};
+
 /* FCFTR */
 enum FCFTR_BIT {
         FCFTR_RFF2 = 0x00040000, FCFTR_RFF1 = 0x00020000,
@@ -307,7 +313,7 @@ enum FCFTR_BIT {
 #define DEFAULT_FIFO_F_D_RFF    (FCFTR_RFF2 | FCFTR_RFF1 | FCFTR_RFF0)
 #define DEFAULT_FIFO_F_D_RFD    (FCFTR_RFD2 | FCFTR_RFD1 | FCFTR_RFD0)
 
-/* Transmit descriptor bit */
+/* Transmit descriptor 0 bits */
 enum TD_STS_BIT {
         TD_TACT = 0x80000000, TD_TDLE = 0x40000000,
         TD_TFP1 = 0x20000000, TD_TFP0 = 0x10000000,
@@ -317,6 +323,11 @@ enum TD_STS_BIT {
 #define TDFEND  TD_TFP0
 #define TD_TFP  (TD_TFP1|TD_TFP0)
 
+/* Transmit descriptor 1 bits */
+enum TD_LEN_BIT {
+        TD_TBL  = 0xffff0000,   /* transmit buffer length */
+};
+
 /* RMCR */
 enum RMCR_BIT {
         RMCR_RNC = 0x00000001,
@@ -425,15 +436,9 @@ enum TSU_FWSLC_BIT {
  */
 struct sh_eth_txdesc {
         u32 status;             /* TD0 */
-#if defined(__LITTLE_ENDIAN)
-        u16 pad0;               /* TD1 */
-        u16 buffer_length;      /* TD1 */
-#else
-        u16 buffer_length;      /* TD1 */
-        u16 pad0;               /* TD1 */
-#endif
+        u32 len;                /* TD1 */
         u32 addr;               /* TD2 */
-        u32 pad1;               /* padding data */
+        u32 pad0;               /* padding data */
 } __aligned(2) __packed;
 
 /* The sh ether Rx buffer descriptors.
@@ -441,13 +446,7 @@ struct sh_eth_txdesc {
  */
 struct sh_eth_rxdesc {
         u32 status;             /* RD0 */
-#if defined(__LITTLE_ENDIAN)
-        u16 frame_length;       /* RD1 */
-        u16 buffer_length;      /* RD1 */
-#else
-        u16 buffer_length;      /* RD1 */
-        u16 frame_length;       /* RD1 */
-#endif
+        u32 len;                /* RD1 */
         u32 addr;               /* RD2 */
         u32 pad0;               /* padding data */
 } __aligned(2) __packed;
@@ -546,31 +545,6 @@ static inline void sh_eth_soft_swap(char *src, int len)
 #endif
 }
 
-#define SH_ETH_OFFSET_INVALID   ((u16) ~0)
-
-static inline void sh_eth_write(struct net_device *ndev, u32 data,
-                                int enum_index)
-{
-        struct sh_eth_private *mdp = netdev_priv(ndev);
-        u16 offset = mdp->reg_offset[enum_index];
-
-        if (WARN_ON(offset == SH_ETH_OFFSET_INVALID))
-                return;
-
-        iowrite32(data, mdp->addr + offset);
-}
-
-static inline u32 sh_eth_read(struct net_device *ndev, int enum_index)
-{
-        struct sh_eth_private *mdp = netdev_priv(ndev);
-        u16 offset = mdp->reg_offset[enum_index];
-
-        if (WARN_ON(offset == SH_ETH_OFFSET_INVALID))
-                return ~0U;
-
-        return ioread32(mdp->addr + offset);
-}
-
 static inline void *sh_eth_tsu_get_offset(struct sh_eth_private *mdp,
                                           int enum_index)
 {
diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c
index bc6d21b471be..e6a084a6be12 100644
--- a/drivers/net/ethernet/sfc/ef10.c
+++ b/drivers/net/ethernet/sfc/ef10.c
@@ -3299,7 +3299,8 @@ static int efx_ef10_filter_remove_internal(struct efx_nic *efx,
 
                 new_spec.priority = EFX_FILTER_PRI_AUTO;
                 new_spec.flags = (EFX_FILTER_FLAG_RX |
-                                  EFX_FILTER_FLAG_RX_RSS);
+                                  (efx_rss_enabled(efx) ?
+                                   EFX_FILTER_FLAG_RX_RSS : 0));
                 new_spec.dmaq_id = 0;
                 new_spec.rss_context = EFX_FILTER_RSS_CONTEXT_DEFAULT;
                 rc = efx_ef10_filter_push(efx, &new_spec,
@@ -3921,6 +3922,7 @@ static int efx_ef10_filter_insert_addr_list(struct efx_nic *efx,
 {
         struct efx_ef10_filter_table *table = efx->filter_state;
         struct efx_ef10_dev_addr *addr_list;
+        enum efx_filter_flags filter_flags;
         struct efx_filter_spec spec;
         u8 baddr[ETH_ALEN];
         unsigned int i, j;
@@ -3935,11 +3937,11 @@ static int efx_ef10_filter_insert_addr_list(struct efx_nic *efx,
                 addr_count = table->dev_uc_count;
         }
 
+        filter_flags = efx_rss_enabled(efx) ? EFX_FILTER_FLAG_RX_RSS : 0;
+
         /* Insert/renew filters */
         for (i = 0; i < addr_count; i++) {
-                efx_filter_init_rx(&spec, EFX_FILTER_PRI_AUTO,
-                                   EFX_FILTER_FLAG_RX_RSS,
-                                   0);
+                efx_filter_init_rx(&spec, EFX_FILTER_PRI_AUTO, filter_flags, 0);
                 efx_filter_set_eth_local(&spec, EFX_FILTER_VID_UNSPEC,
                                          addr_list[i].addr);
                 rc = efx_ef10_filter_insert(efx, &spec, true);
@@ -3968,9 +3970,7 @@ static int efx_ef10_filter_insert_addr_list(struct efx_nic *efx,
 
         if (multicast && rollback) {
                 /* Also need an Ethernet broadcast filter */
-                efx_filter_init_rx(&spec, EFX_FILTER_PRI_AUTO,
-                                   EFX_FILTER_FLAG_RX_RSS,
-                                   0);
+                efx_filter_init_rx(&spec, EFX_FILTER_PRI_AUTO, filter_flags, 0);
                 eth_broadcast_addr(baddr);
                 efx_filter_set_eth_local(&spec, EFX_FILTER_VID_UNSPEC, baddr);
                 rc = efx_ef10_filter_insert(efx, &spec, true);
@@ -4000,13 +4000,14 @@ static int efx_ef10_filter_insert_def(struct efx_nic *efx, bool multicast,
 {
         struct efx_ef10_filter_table *table = efx->filter_state;
         struct efx_ef10_nic_data *nic_data = efx->nic_data;
+        enum efx_filter_flags filter_flags;
         struct efx_filter_spec spec;
         u8 baddr[ETH_ALEN];
         int rc;
 
-        efx_filter_init_rx(&spec, EFX_FILTER_PRI_AUTO,
-                           EFX_FILTER_FLAG_RX_RSS,
-                           0);
+        filter_flags = efx_rss_enabled(efx) ? EFX_FILTER_FLAG_RX_RSS : 0;
+
+        efx_filter_init_rx(&spec, EFX_FILTER_PRI_AUTO, filter_flags, 0);
 
         if (multicast)
                 efx_filter_set_mc_def(&spec);
@@ -4023,8 +4024,7 @@ static int efx_ef10_filter_insert_def(struct efx_nic *efx, bool multicast,
                 if (!nic_data->workaround_26807) {
                         /* Also need an Ethernet broadcast filter */
                         efx_filter_init_rx(&spec, EFX_FILTER_PRI_AUTO,
-                                           EFX_FILTER_FLAG_RX_RSS,
-                                           0);
+                                           filter_flags, 0);
                         eth_broadcast_addr(baddr);
                         efx_filter_set_eth_local(&spec, EFX_FILTER_VID_UNSPEC,
                                                  baddr);
diff --git a/drivers/net/ethernet/sfc/efx.h b/drivers/net/ethernet/sfc/efx.h
index 1aaf76c1ace8..10827476bc0b 100644
--- a/drivers/net/ethernet/sfc/efx.h
+++ b/drivers/net/ethernet/sfc/efx.h
@@ -76,6 +76,11 @@ void efx_schedule_slow_fill(struct efx_rx_queue *rx_queue);
 #define EFX_TXQ_MAX_ENT(efx)    (EFX_WORKAROUND_35388(efx) ? \
                                  EFX_MAX_DMAQ_SIZE / 2 : EFX_MAX_DMAQ_SIZE)
 
+static inline bool efx_rss_enabled(struct efx_nic *efx)
+{
+        return efx->rss_spread > 1;
+}
+
 /* Filters */
 
 void efx_mac_reconfigure(struct efx_nic *efx);
diff --git a/drivers/net/ethernet/sfc/farch.c b/drivers/net/ethernet/sfc/farch.c
index 5a1c5a8f278a..133e9e35be9e 100644
--- a/drivers/net/ethernet/sfc/farch.c
+++ b/drivers/net/ethernet/sfc/farch.c
@@ -2242,7 +2242,7 @@ efx_farch_filter_init_rx_auto(struct efx_nic *efx,
          */
         spec->priority = EFX_FILTER_PRI_AUTO;
         spec->flags = (EFX_FILTER_FLAG_RX |
-                       (efx->n_rx_channels > 1 ? EFX_FILTER_FLAG_RX_RSS : 0) |
+                       (efx_rss_enabled(efx) ? EFX_FILTER_FLAG_RX_RSS : 0) |
                        (efx->rx_scatter ? EFX_FILTER_FLAG_RX_SCATTER : 0));
         spec->dmaq_id = 0;
 }
diff --git a/drivers/net/ethernet/sfc/txc43128_phy.c b/drivers/net/ethernet/sfc/txc43128_phy.c
index 3d5ee3259885..194f67d9f3bf 100644
--- a/drivers/net/ethernet/sfc/txc43128_phy.c
+++ b/drivers/net/ethernet/sfc/txc43128_phy.c
@@ -418,7 +418,7 @@ static void txc_reset_logic_mmd(struct efx_nic *efx, int mmd)
 
         val |= (1 << TXC_GLCMD_LMTSWRST_LBN);
         efx_mdio_write(efx, mmd, TXC_GLRGS_GLCMD, val);
-        while (tries--) {
+        while (--tries) {
                 val = efx_mdio_read(efx, mmd, TXC_GLRGS_GLCMD);
                 if (!(val & (1 << TXC_GLCMD_LMTSWRST_LBN)))
                         break;
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-sti.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-sti.c
index 7f6f4a4fcc70..58c05acc2aab 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sti.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sti.c
@@ -299,16 +299,17 @@ static int sti_dwmac_parse_data(struct sti_dwmac *dwmac,
         if (IS_PHY_IF_MODE_GBIT(dwmac->interface)) {
                 const char *rs;
 
+                dwmac->tx_retime_src = TX_RETIME_SRC_CLKGEN;
+
                 err = of_property_read_string(np, "st,tx-retime-src", &rs);
                 if (err < 0) {
                         dev_warn(dev, "Use internal clock source\n");
-                        dwmac->tx_retime_src = TX_RETIME_SRC_CLKGEN;
-                } else if (!strcasecmp(rs, "clk_125")) {
-                        dwmac->tx_retime_src = TX_RETIME_SRC_CLK_125;
-                } else if (!strcasecmp(rs, "txclk")) {
-                        dwmac->tx_retime_src = TX_RETIME_SRC_TXCLK;
+                } else {
+                        if (!strcasecmp(rs, "clk_125"))
+                                dwmac->tx_retime_src = TX_RETIME_SRC_CLK_125;
+                        else if (!strcasecmp(rs, "txclk"))
+                                dwmac->tx_retime_src = TX_RETIME_SRC_TXCLK;
                 }
-
                 dwmac->speed = SPEED_1000;
         }
 
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c
index 52b8ed9bd87c..adff46375a32 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c
@@ -153,7 +153,11 @@ static int sun7i_gmac_probe(struct platform_device *pdev)
         if (ret)
                 return ret;
 
-        return stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
+        ret = stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
+        if (ret)
+                sun7i_gmac_exit(pdev, plat_dat->bsp_priv);
+
+        return ret;
 }
 
 static const struct of_device_id sun7i_dwmac_match[] = {
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 64d8aa4e0cad..a5b869eb4678 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -185,7 +185,7 @@ static void stmmac_clk_csr_set(struct stmmac_priv *priv)
                         priv->clk_csr = STMMAC_CSR_100_150M;
                 else if ((clk_rate >= CSR_F_150M) && (clk_rate < CSR_F_250M))
                         priv->clk_csr = STMMAC_CSR_150_250M;
-                else if ((clk_rate >= CSR_F_250M) && (clk_rate < CSR_F_300M))
+                else if ((clk_rate >= CSR_F_250M) && (clk_rate <= CSR_F_300M))
                         priv->clk_csr = STMMAC_CSR_250_300M;
         }
 }
@@ -2232,6 +2232,12 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit)
 
                         frame_len = priv->hw->desc->get_rx_frame_len(p, coe);
 
+                        /*  check if frame_len fits the preallocated memory */
+                        if (frame_len > priv->dma_buf_sz) {
+                                priv->dev->stats.rx_length_errors++;
+                                break;
+                        }
+
                         /* ACS is set; GMAC core strips PAD/FCS for IEEE 802.3
                          * Type frames (LLC/LLC-SNAP)
                          */
@@ -3040,8 +3046,6 @@ int stmmac_suspend(struct net_device *ndev)
         priv->hw->dma->stop_tx(priv->ioaddr);
         priv->hw->dma->stop_rx(priv->ioaddr);
 
-        stmmac_clear_descriptors(priv);
-
         /* Enable Power down mode by programming the PMT regs */
         if (device_may_wakeup(priv->device)) {
                 priv->hw->mac->pmt(priv->hw, priv->wolopts);
@@ -3099,9 +3103,15 @@ int stmmac_resume(struct net_device *ndev)
 
         netif_device_attach(ndev);
 
-        init_dma_desc_rings(ndev, GFP_ATOMIC);
+        priv->cur_rx = 0;
+        priv->dirty_rx = 0;
+        priv->dirty_tx = 0;
+        priv->cur_tx = 0;
+        stmmac_clear_descriptors(priv);
+
         stmmac_hw_setup(ndev, false);
         stmmac_init_tx_coalesce(priv);
+        stmmac_set_rx_mode(ndev);
 
         napi_enable(&priv->napi);
 
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c
index ebf6abc4853f..bba670c42e37 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c
@@ -138,7 +138,6 @@ int stmmac_mdio_reset(struct mii_bus *bus)
 
 #ifdef CONFIG_OF
         if (priv->device->of_node) {
-                int reset_gpio, active_low;
 
                 if (data->reset_gpio < 0) {
                         struct device_node *np = priv->device->of_node;
@@ -154,24 +153,23 @@ int stmmac_mdio_reset(struct mii_bus *bus)
                                                 "snps,reset-active-low");
                         of_property_read_u32_array(np,
                                 "snps,reset-delays-us", data->delays, 3);
-                }
 
-                reset_gpio = data->reset_gpio;
-                active_low = data->active_low;
+                        if (gpio_request(data->reset_gpio, "mdio-reset"))
+                                return 0;
+                }
 
-                if (!gpio_request(reset_gpio, "mdio-reset")) {
-                        gpio_direction_output(reset_gpio, active_low ? 1 : 0);
-                        if (data->delays[0])
-                                msleep(DIV_ROUND_UP(data->delays[0], 1000));
+                gpio_direction_output(data->reset_gpio,
+                                      data->active_low ? 1 : 0);
+                if (data->delays[0])
+                        msleep(DIV_ROUND_UP(data->delays[0], 1000));
 
-                        gpio_set_value(reset_gpio, active_low ? 0 : 1);
-                        if (data->delays[1])
-                                msleep(DIV_ROUND_UP(data->delays[1], 1000));
+                gpio_set_value(data->reset_gpio, data->active_low ? 0 : 1);
+                if (data->delays[1])
+                        msleep(DIV_ROUND_UP(data->delays[1], 1000));
 
-                        gpio_set_value(reset_gpio, active_low ? 1 : 0);
-                        if (data->delays[2])
-                                msleep(DIV_ROUND_UP(data->delays[2], 1000));
-                }
+                gpio_set_value(data->reset_gpio, data->active_low ? 1 : 0);
+                if (data->delays[2])
+                        msleep(DIV_ROUND_UP(data->delays[2], 1000));
         }
 #endif
 
diff --git a/drivers/net/ethernet/ti/cpsw-common.c b/drivers/net/ethernet/ti/cpsw-common.c
index c08be62bceba..1562ab4151e1 100644
--- a/drivers/net/ethernet/ti/cpsw-common.c
+++ b/drivers/net/ethernet/ti/cpsw-common.c
@@ -78,6 +78,9 @@ static int cpsw_am33xx_cm_get_macid(struct device *dev, u16 offset, int slave,
 
 int ti_cm_get_macid(struct device *dev, int slave, u8 *mac_addr)
 {
+        if (of_machine_is_compatible("ti,dm8148"))
+                return cpsw_am33xx_cm_get_macid(dev, 0x630, slave, mac_addr);
+
         if (of_machine_is_compatible("ti,am33xx"))
                 return cpsw_am33xx_cm_get_macid(dev, 0x630, slave, mac_addr);
 
diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
index 48b92c9de12a..fc958067d10a 100644
--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -2026,45 +2026,54 @@ static int cpsw_probe_dt(struct cpsw_priv *priv,
         for_each_child_of_node(node, slave_node) {
                 struct cpsw_slave_data *slave_data = data->slave_data + i;
                 const void *mac_addr = NULL;
-                u32 phyid;
                 int lenp;
                 const __be32 *parp;
-                struct device_node *mdio_node;
-                struct platform_device *mdio;
 
                 /* This is no slave child node, continue */
                 if (strcmp(slave_node->name, "slave"))
                         continue;
 
                 priv->phy_node = of_parse_phandle(slave_node, "phy-handle", 0);
+                parp = of_get_property(slave_node, "phy_id", &lenp);
                 if (of_phy_is_fixed_link(slave_node)) {
-                        struct phy_device *pd;
+                        struct device_node *phy_node;
+                        struct phy_device *phy_dev;
 
+                        /* In the case of a fixed PHY, the DT node associated
+                         * to the PHY is the Ethernet MAC DT node.
+                         */
                         ret = of_phy_register_fixed_link(slave_node);
                         if (ret)
                                 return ret;
-                        pd = of_phy_find_device(slave_node);
-                        if (!pd)
+                        phy_node = of_node_get(slave_node);
+                        phy_dev = of_phy_find_device(phy_node);
+                        if (!phy_dev)
                                 return -ENODEV;
                         snprintf(slave_data->phy_id, sizeof(slave_data->phy_id),
-                                 PHY_ID_FMT, pd->bus->id, pd->phy_id);
-                        goto no_phy_slave;
-                }
-                parp = of_get_property(slave_node, "phy_id", &lenp);
-                if ((parp == NULL) || (lenp != (sizeof(void *) * 2))) {
-                        dev_err(&pdev->dev, "Missing slave[%d] phy_id property\n", i);
+                                 PHY_ID_FMT, phy_dev->bus->id, phy_dev->addr);
+                } else if (parp) {
+                        u32 phyid;
+                        struct device_node *mdio_node;
+                        struct platform_device *mdio;
+
+                        if (lenp != (sizeof(__be32) * 2)) {
+                                dev_err(&pdev->dev, "Invalid slave[%d] phy_id property\n", i);
+                                goto no_phy_slave;
+                        }
+                        mdio_node = of_find_node_by_phandle(be32_to_cpup(parp));
+                        phyid = be32_to_cpup(parp+1);
+                        mdio = of_find_device_by_node(mdio_node);
+                        of_node_put(mdio_node);
+                        if (!mdio) {
+                                dev_err(&pdev->dev, "Missing mdio platform device\n");
+                                return -EINVAL;
+                        }
+                        snprintf(slave_data->phy_id, sizeof(slave_data->phy_id),
+                                 PHY_ID_FMT, mdio->name, phyid);
+                } else {
+                        dev_err(&pdev->dev, "No slave[%d] phy_id or fixed-link property\n", i);
                         goto no_phy_slave;
                 }
-                mdio_node = of_find_node_by_phandle(be32_to_cpup(parp));
-                phyid = be32_to_cpup(parp+1);
-                mdio = of_find_device_by_node(mdio_node);
-                of_node_put(mdio_node);
-                if (!mdio) {
-                        dev_err(&pdev->dev, "Missing mdio platform device\n");
-                        return -EINVAL;
-                }
-                snprintf(slave_data->phy_id, sizeof(slave_data->phy_id),
-                         PHY_ID_FMT, mdio->name, phyid);
                 slave_data->phy_if = of_get_phy_mode(slave_node);
                 if (slave_data->phy_if < 0) {
                         dev_err(&pdev->dev, "Missing or malformed slave[%d] phy-mode property\n",
@@ -2418,7 +2427,7 @@ static int cpsw_probe(struct platform_device *pdev)
         ndev->irq = platform_get_irq(pdev, 1);
         if (ndev->irq < 0) {
                 dev_err(priv->dev, "error getting irq resource\n");
-                ret = -ENOENT;
+                ret = ndev->irq;
                 goto clean_ale_ret;
         }
 
@@ -2439,8 +2448,10 @@ static int cpsw_probe(struct platform_device *pdev)
 
         /* RX IRQ */
         irq = platform_get_irq(pdev, 1);
-        if (irq < 0)
+        if (irq < 0) {
+                ret = irq;
                 goto clean_ale_ret;
+        }
 
         priv->irqs_table[0] = irq;
         ret = devm_request_irq(&pdev->dev, irq, cpsw_rx_interrupt,
@@ -2452,8 +2463,10 @@ static int cpsw_probe(struct platform_device *pdev)
 
         /* TX IRQ */
         irq = platform_get_irq(pdev, 2);
-        if (irq < 0)
+        if (irq < 0) {
+                ret = irq;
                 goto clean_ale_ret;
+        }
 
         priv->irqs_table[1] = irq;
         ret = devm_request_irq(&pdev->dev, irq, cpsw_tx_interrupt,
diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c
index de5c30c9f059..58efdec12f30 100644
--- a/drivers/net/geneve.c
+++ b/drivers/net/geneve.c
@@ -967,8 +967,6 @@ static netdev_tx_t geneve6_xmit_skb(struct sk_buff *skb, struct net_device *dev,
         err = udp_tunnel6_xmit_skb(dst, gs6->sock->sk, skb, dev,
                                    &fl6.saddr, &fl6.daddr, prio, ttl,
                                    sport, geneve->dst_port, !udp_csum);
-
-        iptunnel_xmit_stats(err, &dev->stats, dev->tstats);
         return NETDEV_TX_OK;
 
 tx_error:
@@ -1157,7 +1155,7 @@ static int geneve_configure(struct net *net, struct net_device *dev,
         struct geneve_net *gn = net_generic(net, geneve_net_id);
         struct geneve_dev *t, *geneve = netdev_priv(dev);
         bool tun_collect_md, tun_on_same_port;
-        int err;
+        int err, encap_len;
 
         if (!remote)
                 return -EINVAL;
@@ -1189,6 +1187,14 @@ static int geneve_configure(struct net *net, struct net_device *dev,
         if (t)
                 return -EBUSY;
 
+        /* make enough headroom for basic scenario */
+        encap_len = GENEVE_BASE_HLEN + ETH_HLEN;
+        if (remote->sa.sa_family == AF_INET)
+                encap_len += sizeof(struct iphdr);
+        else
+                encap_len += sizeof(struct ipv6hdr);
+        dev->needed_headroom = encap_len + ETH_HLEN;
+
         if (metadata) {
                 if (tun_on_same_port)
                         return -EPERM;
diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c
index 7c4a4151ef0f..9f0b1c342b77 100644
--- a/drivers/net/hamradio/6pack.c
+++ b/drivers/net/hamradio/6pack.c
@@ -683,14 +683,14 @@ static void sixpack_close(struct tty_struct *tty)
         if (!atomic_dec_and_test(&sp->refcnt))
                 down(&sp->dead_sem);
 
-        unregister_netdev(sp->dev);
-
-        del_timer(&sp->tx_t);
-        del_timer(&sp->resync_t);
+        del_timer_sync(&sp->tx_t);
+        del_timer_sync(&sp->resync_t);
 
         /* Free all 6pack frame buffers. */
         kfree(sp->rbuff);
         kfree(sp->xbuff);
+
+        unregister_netdev(sp->dev);
 }
 
 /* Perform I/O control on an active 6pack channel. */
diff --git a/drivers/net/hamradio/mkiss.c b/drivers/net/hamradio/mkiss.c
index 216bfd350169..0b72b9de5207 100644
--- a/drivers/net/hamradio/mkiss.c
+++ b/drivers/net/hamradio/mkiss.c
@@ -798,13 +798,13 @@ static void mkiss_close(struct tty_struct *tty)
         if (!atomic_dec_and_test(&ax->refcnt))
                 down(&ax->dead_sem);
 
-        unregister_netdev(ax->dev);
-
         /* Free all AX25 frame buffers. */
         kfree(ax->rbuff);
         kfree(ax->xbuff);
 
         ax->tty = NULL;
+
+        unregister_netdev(ax->dev);
 }
 
 /* Perform I/O control on an active ax25 channel. */
diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
index 54036ae0a388..0fc521941c71 100644
--- a/drivers/net/macvtap.c
+++ b/drivers/net/macvtap.c
@@ -498,7 +498,7 @@ static void macvtap_sock_write_space(struct sock *sk)
         wait_queue_head_t *wqueue;
 
         if (!sock_writeable(sk) ||
-            !test_and_clear_bit(SOCK_ASYNC_NOSPACE, &sk->sk_socket->flags))
+            !test_and_clear_bit(SOCKWQ_ASYNC_NOSPACE, &sk->sk_socket->flags))
                 return;
 
         wqueue = sk_sleep(sk);
@@ -585,7 +585,7 @@ static unsigned int macvtap_poll(struct file *file, poll_table * wait)
                 mask |= POLLIN | POLLRDNORM;
 
         if (sock_writeable(&q->sk) ||
-            (!test_and_set_bit(SOCK_ASYNC_NOSPACE, &q->sock.flags) &&
+            (!test_and_set_bit(SOCKWQ_ASYNC_NOSPACE, &q->sock.flags) &&
              sock_writeable(&q->sk)))
                 mask |= POLLOUT | POLLWRNORM;
 
diff --git a/drivers/net/phy/broadcom.c b/drivers/net/phy/broadcom.c
index 07a6119121c3..3ce5d9514623 100644
--- a/drivers/net/phy/broadcom.c
+++ b/drivers/net/phy/broadcom.c
@@ -614,7 +614,7 @@ static struct mdio_device_id __maybe_unused broadcom_tbl[] = {
         { PHY_ID_BCM5461, 0xfffffff0 },
         { PHY_ID_BCM54616S, 0xfffffff0 },
         { PHY_ID_BCM5464, 0xfffffff0 },
-        { PHY_ID_BCM5482, 0xfffffff0 },
+        { PHY_ID_BCM5481, 0xfffffff0 },
         { PHY_ID_BCM5482, 0xfffffff0 },
         { PHY_ID_BCM50610, 0xfffffff0 },
         { PHY_ID_BCM50610M, 0xfffffff0 },
diff --git a/drivers/net/phy/mdio-mux.c b/drivers/net/phy/mdio-mux.c
index 908e8d486342..7f8e7662e28c 100644
--- a/drivers/net/phy/mdio-mux.c
+++ b/drivers/net/phy/mdio-mux.c
@@ -149,9 +149,14 @@ int mdio_mux_init(struct device *dev,
                 }
                 cb->bus_number = v;
                 cb->parent = pb;
+
                 cb->mii_bus = mdiobus_alloc();
+                if (!cb->mii_bus) {
+                        ret_val = -ENOMEM;
+                        of_node_put(child_bus_node);
+                        break;
+                }
                 cb->mii_bus->priv = cb;
-
                 cb->mii_bus->irq = cb->phy_irq;
                 cb->mii_bus->name = "mdio_mux";
                 snprintf(cb->mii_bus->id, MII_BUS_ID_SIZE, "%x.%x",
diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c
index cf6312fafea5..e13ad6cdcc22 100644
--- a/drivers/net/phy/micrel.c
+++ b/drivers/net/phy/micrel.c
@@ -339,9 +339,18 @@ static int ksz9021_config_init(struct phy_device *phydev)
 {
         const struct device *dev = &phydev->dev;
         const struct device_node *of_node = dev->of_node;
+        const struct device *dev_walker;
 
-        if (!of_node && dev->parent->of_node)
-                of_node = dev->parent->of_node;
+        /* The Micrel driver has a deprecated option to place phy OF
+         * properties in the MAC node. Walk up the tree of devices to
+         * find a device with an OF node.
+         */
+        dev_walker = &phydev->dev;
+        do {
+                of_node = dev_walker->of_node;
+                dev_walker = dev_walker->parent;
+
+        } while (!of_node && dev_walker);
 
         if (of_node) {
                 ksz9021_load_values_from_of(phydev, of_node,
diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
index 48ce6ef400fe..47cd306dbb3c 100644
--- a/drivers/net/phy/phy.c
+++ b/drivers/net/phy/phy.c
@@ -448,7 +448,8 @@ int phy_mii_ioctl(struct phy_device *phydev, struct ifreq *ifr, int cmd)
                 mdiobus_write(phydev->bus, mii_data->phy_id,
                               mii_data->reg_num, val);
 
-                if (mii_data->reg_num == MII_BMCR &&
+                if (mii_data->phy_id == phydev->addr &&
+                    mii_data->reg_num == MII_BMCR &&
                     val & BMCR_RESET)
                         return phy_init_hw(phydev);
 
diff --git a/drivers/net/ppp/pppoe.c b/drivers/net/ppp/pppoe.c
index 5e0b43283bce..0a37f840fcc5 100644
--- a/drivers/net/ppp/pppoe.c
+++ b/drivers/net/ppp/pppoe.c
@@ -568,6 +568,9 @@ static int pppoe_create(struct net *net, struct socket *sock, int kern)
         sk->sk_family           = PF_PPPOX;
         sk->sk_protocol         = PX_PROTO_OE;
 
+        INIT_WORK(&pppox_sk(sk)->proto.pppoe.padt_work,
+                  pppoe_unbind_sock_work);
+
         return 0;
 }
 
@@ -632,8 +635,6 @@ static int pppoe_connect(struct socket *sock, struct sockaddr *uservaddr,
 
         lock_sock(sk);
 
-        INIT_WORK(&po->proto.pppoe.padt_work, pppoe_unbind_sock_work);
-
         error = -EINVAL;
         if (sp->sa_protocol != PX_PROTO_OE)
                 goto end;
@@ -663,8 +664,13 @@ static int pppoe_connect(struct socket *sock, struct sockaddr *uservaddr,
                         po->pppoe_dev = NULL;
                 }
 
-                memset(sk_pppox(po) + 1, 0,
-                       sizeof(struct pppox_sock) - sizeof(struct sock));
+                po->pppoe_ifindex = 0;
+                memset(&po->pppoe_pa, 0, sizeof(po->pppoe_pa));
+                memset(&po->pppoe_relay, 0, sizeof(po->pppoe_relay));
+                memset(&po->chan, 0, sizeof(po->chan));
+                po->next = NULL;
+                po->num = 0;
+
                 sk->sk_state = PPPOX_NONE;
         }
 
diff --git a/drivers/net/ppp/pptp.c b/drivers/net/ppp/pptp.c
index fc69e41d0950..597c53e0a2ec 100644
--- a/drivers/net/ppp/pptp.c
+++ b/drivers/net/ppp/pptp.c
@@ -419,6 +419,9 @@ static int pptp_bind(struct socket *sock, struct sockaddr *uservaddr,
         struct pptp_opt *opt = &po->proto.pptp;
         int error = 0;
 
+        if (sockaddr_len < sizeof(struct sockaddr_pppox))
+                return -EINVAL;
+
         lock_sock(sk);
 
         opt->src_addr = sp->sa_addr.pptp;
@@ -440,6 +443,9 @@ static int pptp_connect(struct socket *sock, struct sockaddr *uservaddr,
         struct flowi4 fl4;
         int error = 0;
 
+        if (sockaddr_len < sizeof(struct sockaddr_pppox))
+                return -EINVAL;
+
         if (sp->sa_protocol != PX_PROTO_PPTP)
                 return -EINVAL;
 
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index b1878faea397..f0db770e8b2f 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1040,7 +1040,7 @@ static unsigned int tun_chr_poll(struct file *file, poll_table *wait)
                 mask |= POLLIN | POLLRDNORM;
 
         if (sock_writeable(sk) ||
-            (!test_and_set_bit(SOCK_ASYNC_NOSPACE, &sk->sk_socket->flags) &&
+            (!test_and_set_bit(SOCKWQ_ASYNC_NOSPACE, &sk->sk_socket->flags) &&
              sock_writeable(sk)))
                 mask |= POLLOUT | POLLWRNORM;
 
@@ -1488,7 +1488,7 @@ static void tun_sock_write_space(struct sock *sk)
         if (!sock_writeable(sk))
                 return;
 
-        if (!test_and_clear_bit(SOCK_ASYNC_NOSPACE, &sk->sk_socket->flags))
+        if (!test_and_clear_bit(SOCKWQ_ASYNC_NOSPACE, &sk->sk_socket->flags))
                 return;
 
         wqueue = sk_sleep(sk);
diff --git a/drivers/net/usb/cdc_mbim.c b/drivers/net/usb/cdc_mbim.c
index bbde9884ab8a..bdd83d95ec0a 100644
--- a/drivers/net/usb/cdc_mbim.c
+++ b/drivers/net/usb/cdc_mbim.c
@@ -100,7 +100,7 @@ static const struct net_device_ops cdc_mbim_netdev_ops = {
         .ndo_stop             = usbnet_stop,
         .ndo_start_xmit       = usbnet_start_xmit,
         .ndo_tx_timeout       = usbnet_tx_timeout,
-        .ndo_change_mtu       = usbnet_change_mtu,
+        .ndo_change_mtu       = cdc_ncm_change_mtu,
         .ndo_set_mac_address  = eth_mac_addr,
         .ndo_validate_addr    = eth_validate_addr,
         .ndo_vlan_rx_add_vid  = cdc_mbim_rx_add_vid,
@@ -158,7 +158,7 @@ static int cdc_mbim_bind(struct usbnet *dev, struct usb_interface *intf)
         if (!cdc_ncm_comm_intf_is_mbim(intf->cur_altsetting))
                 goto err;
 
-        ret = cdc_ncm_bind_common(dev, intf, data_altsetting, 0);
+        ret = cdc_ncm_bind_common(dev, intf, data_altsetting, dev->driver_info->data);
         if (ret)
                 goto err;
 
@@ -582,6 +582,26 @@ static const struct driver_info cdc_mbim_info_zlp = {
         .tx_fixup = cdc_mbim_tx_fixup,
 };
 
+/* The spefication explicitly allows NDPs to be placed anywhere in the
+ * frame, but some devices fail unless the NDP is placed after the IP
+ * packets.  Using the CDC_NCM_FLAG_NDP_TO_END flags to force this
+ * behaviour.
+ *
+ * Note: The current implementation of this feature restricts each NTB
+ * to a single NDP, implying that multiplexed sessions cannot share an
+ * NTB. This might affect performace for multiplexed sessions.
+ */
+static const struct driver_info cdc_mbim_info_ndp_to_end = {
+        .description = "CDC MBIM",
+        .flags = FLAG_NO_SETINT | FLAG_MULTI_PACKET | FLAG_WWAN,
+        .bind = cdc_mbim_bind,
+        .unbind = cdc_mbim_unbind,
+        .manage_power = cdc_mbim_manage_power,
+        .rx_fixup = cdc_mbim_rx_fixup,
+        .tx_fixup = cdc_mbim_tx_fixup,
+        .data = CDC_NCM_FLAG_NDP_TO_END,
+};
+
 static const struct usb_device_id mbim_devs[] = {
         /* This duplicate NCM entry is intentional. MBIM devices can
          * be disguised as NCM by default, and this is necessary to
@@ -597,6 +617,10 @@ static const struct usb_device_id mbim_devs[] = {
         { USB_VENDOR_AND_INTERFACE_INFO(0x0bdb, USB_CLASS_COMM, USB_CDC_SUBCLASS_MBIM, USB_CDC_PROTO_NONE),
           .driver_info = (unsigned long)&cdc_mbim_info,
         },
+        /* Huawei E3372 fails unless NDP comes after the IP packets */
+        { USB_DEVICE_AND_INTERFACE_INFO(0x12d1, 0x157d, USB_CLASS_COMM, USB_CDC_SUBCLASS_MBIM, USB_CDC_PROTO_NONE),
+          .driver_info = (unsigned long)&cdc_mbim_info_ndp_to_end,
+        },
         /* default entry */
         { USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_MBIM, USB_CDC_PROTO_NONE),
           .driver_info = (unsigned long)&cdc_mbim_info_zlp,
diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
index a187f08113ec..e8a1144c5a8b 100644
--- a/drivers/net/usb/cdc_ncm.c
+++ b/drivers/net/usb/cdc_ncm.c
@@ -41,6 +41,7 @@
 #include <linux/module.h>
 #include <linux/netdevice.h>
 #include <linux/ctype.h>
+#include <linux/etherdevice.h>
 #include <linux/ethtool.h>
 #include <linux/workqueue.h>
 #include <linux/mii.h>
@@ -689,9 +690,35 @@ static void cdc_ncm_free(struct cdc_ncm_ctx *ctx)
         kfree(ctx);
 }
 
+/* we need to override the usbnet change_mtu ndo for two reasons:
+ *  - respect the negotiated maximum datagram size
+ *  - avoid unwanted changes to rx and tx buffers
+ */
+int cdc_ncm_change_mtu(struct net_device *net, int new_mtu)
+{
+        struct usbnet *dev = netdev_priv(net);
+        struct cdc_ncm_ctx *ctx = (struct cdc_ncm_ctx *)dev->data[0];
+        int maxmtu = ctx->max_datagram_size - cdc_ncm_eth_hlen(dev);
+
+        if (new_mtu <= 0 || new_mtu > maxmtu)
+                return -EINVAL;
+        net->mtu = new_mtu;
+        return 0;
+}
+EXPORT_SYMBOL_GPL(cdc_ncm_change_mtu);
+
+static const struct net_device_ops cdc_ncm_netdev_ops = {
+        .ndo_open            = usbnet_open,
+        .ndo_stop            = usbnet_stop,
+        .ndo_start_xmit      = usbnet_start_xmit,
+        .ndo_tx_timeout      = usbnet_tx_timeout,
+        .ndo_change_mtu      = cdc_ncm_change_mtu,
+        .ndo_set_mac_address = eth_mac_addr,
+        .ndo_validate_addr   = eth_validate_addr,
+};
+
 int cdc_ncm_bind_common(struct usbnet *dev, struct usb_interface *intf, u8 data_altsetting, int drvflags)
 {
-        const struct usb_cdc_union_desc *union_desc = NULL;
         struct cdc_ncm_ctx *ctx;
         struct usb_driver *driver;
         u8 *buf;
@@ -725,15 +752,16 @@ int cdc_ncm_bind_common(struct usbnet *dev, struct usb_interface *intf, u8 data_
         /* parse through descriptors associated with control interface */
         cdc_parse_cdc_header(&hdr, intf, buf, len);
 
-        ctx->data = usb_ifnum_to_if(dev->udev,
-                                    hdr.usb_cdc_union_desc->bSlaveInterface0);
+        if (hdr.usb_cdc_union_desc)
+                ctx->data = usb_ifnum_to_if(dev->udev,
+                                            hdr.usb_cdc_union_desc->bSlaveInterface0);
         ctx->ether_desc = hdr.usb_cdc_ether_desc;
         ctx->func_desc = hdr.usb_cdc_ncm_desc;
         ctx->mbim_desc = hdr.usb_cdc_mbim_desc;
         ctx->mbim_extended_desc = hdr.usb_cdc_mbim_extended_desc;
 
         /* some buggy devices have an IAD but no CDC Union */
-        if (!union_desc && intf->intf_assoc && intf->intf_assoc->bInterfaceCount == 2) {
+        if (!hdr.usb_cdc_union_desc && intf->intf_assoc && intf->intf_assoc->bInterfaceCount == 2) {
                 ctx->data = usb_ifnum_to_if(dev->udev, intf->cur_altsetting->desc.bInterfaceNumber + 1);
                 dev_dbg(&intf->dev, "CDC Union missing - got slave from IAD\n");
         }
@@ -823,6 +851,9 @@ int cdc_ncm_bind_common(struct usbnet *dev, struct usb_interface *intf, u8 data_
         /* add our sysfs attrs */
         dev->net->sysfs_groups[0] = &cdc_ncm_sysfs_attr_group;
 
+        /* must handle MTU changes */
+        dev->net->netdev_ops = &cdc_ncm_netdev_ops;
+
         return 0;
 
 error2:
@@ -955,10 +986,18 @@ static struct usb_cdc_ncm_ndp16 *cdc_ncm_ndp(struct cdc_ncm_ctx *ctx, struct sk_
         * NTH16 header as we would normally do. NDP isn't written to the SKB yet, and
         * the wNdpIndex field in the header is actually not consistent with reality. It will be later.
         */
-        if (ctx->drvflags & CDC_NCM_FLAG_NDP_TO_END)
+        if (ctx->drvflags & CDC_NCM_FLAG_NDP_TO_END) {
                 if (ctx->delayed_ndp16->dwSignature == sign)
                         return ctx->delayed_ndp16;
 
+                /* We can only push a single NDP to the end. Return
+                 * NULL to send what we've already got and queue this
+                 * skb for later.
+                 */
+                else if (ctx->delayed_ndp16->dwSignature)
+                        return NULL;
+        }
+
         /* follow the chain of NDPs, looking for a match */
         while (ndpoffset) {
                 ndp16 = (struct usb_cdc_ncm_ndp16 *)(skb->data + ndpoffset);
@@ -1550,6 +1589,24 @@ static const struct usb_device_id cdc_devs[] = {
           .driver_info = (unsigned long) &wwan_info,
         },
 
+        /* DW5812 LTE Verizon Mobile Broadband Card
+         * Unlike DW5550 this device requires FLAG_NOARP
+         */
+        { USB_DEVICE_AND_INTERFACE_INFO(0x413c, 0x81bb,
+                USB_CLASS_COMM,
+                USB_CDC_SUBCLASS_NCM, USB_CDC_PROTO_NONE),
+          .driver_info = (unsigned long)&wwan_noarp_info,
+        },
+
+        /* DW5813 LTE AT&T Mobile Broadband Card
+         * Unlike DW5550 this device requires FLAG_NOARP
+         */
+        { USB_DEVICE_AND_INTERFACE_INFO(0x413c, 0x81bc,
+                USB_CLASS_COMM,
+                USB_CDC_SUBCLASS_NCM, USB_CDC_PROTO_NONE),
+          .driver_info = (unsigned long)&wwan_noarp_info,
+        },
+
         /* Dell branded MBM devices like DW5550 */
         { .match_flags = USB_DEVICE_ID_MATCH_INT_INFO
                 | USB_DEVICE_ID_MATCH_VENDOR,
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 34799eaace41..9a5be8b85186 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -725,6 +725,7 @@ static const struct usb_device_id products[] = {
         {QMI_FIXED_INTF(0x2357, 0x9000, 4)},    /* TP-LINK MA260 */
         {QMI_FIXED_INTF(0x1bc7, 0x1200, 5)},    /* Telit LE920 */
         {QMI_FIXED_INTF(0x1bc7, 0x1201, 2)},    /* Telit LE920 */
+        {QMI_FIXED_INTF(0x1c9e, 0x9b01, 3)},    /* XS Stick W100-2 from 4G Systems */
         {QMI_FIXED_INTF(0x0b3c, 0xc000, 4)},    /* Olivetti Olicard 100 */
         {QMI_FIXED_INTF(0x0b3c, 0xc001, 4)},    /* Olivetti Olicard 120 */
         {QMI_FIXED_INTF(0x0b3c, 0xc002, 4)},    /* Olivetti Olicard 140 */
diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index d9427ca3dba7..2e32c41536ae 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -3067,17 +3067,6 @@ static int rtl8152_open(struct net_device *netdev)
 
         mutex_lock(&tp->control);
 
-        /* The WORK_ENABLE may be set when autoresume occurs */
-        if (test_bit(WORK_ENABLE, &tp->flags)) {
-                clear_bit(WORK_ENABLE, &tp->flags);
-                usb_kill_urb(tp->intr_urb);
-                cancel_delayed_work_sync(&tp->schedule);
-
-                /* disable the tx/rx, if the workqueue has enabled them. */
-                if (netif_carrier_ok(netdev))
-                        tp->rtl_ops.disable(tp);
-        }
-
         tp->rtl_ops.up(tp);
 
         rtl8152_set_speed(tp, AUTONEG_ENABLE,
@@ -3124,12 +3113,6 @@ static int rtl8152_close(struct net_device *netdev)
         } else {
                 mutex_lock(&tp->control);
 
-                /* The autosuspend may have been enabled and wouldn't
-                 * be disable when autoresume occurs, because the
-                 * netif_running() would be false.
-                 */
-                rtl_runtime_suspend_enable(tp, false);
-
                 tp->rtl_ops.down(tp);
 
                 mutex_unlock(&tp->control);
@@ -3512,7 +3495,7 @@ static int rtl8152_resume(struct usb_interface *intf)
                 netif_device_attach(tp->netdev);
         }
 
-        if (netif_running(tp->netdev)) {
+        if (netif_running(tp->netdev) && tp->netdev->flags & IFF_UP) {
                 if (test_bit(SELECTIVE_SUSPEND, &tp->flags)) {
                         rtl_runtime_suspend_enable(tp, false);
                         clear_bit(SELECTIVE_SUSPEND, &tp->flags);
@@ -3532,6 +3515,8 @@ static int rtl8152_resume(struct usb_interface *intf)
                 }
                 usb_submit_urb(tp->intr_urb, GFP_KERNEL);
         } else if (test_bit(SELECTIVE_SUSPEND, &tp->flags)) {
+                if (tp->netdev->flags & IFF_UP)
+                        rtl_runtime_suspend_enable(tp, false);
                 clear_bit(SELECTIVE_SUSPEND, &tp->flags);
         }
 
diff --git a/drivers/net/veth.c b/drivers/net/veth.c
index 0ef4a5ad5557..ba21d072be31 100644
--- a/drivers/net/veth.c
+++ b/drivers/net/veth.c
@@ -117,12 +117,6 @@ static netdev_tx_t veth_xmit(struct sk_buff *skb, struct net_device *dev)
                 kfree_skb(skb);
                 goto drop;
         }
-        /* don't change ip_summed == CHECKSUM_PARTIAL, as that
-         * will cause bad checksum on forwarded packets
-         */
-        if (skb->ip_summed == CHECKSUM_NONE &&
-            rcv->features & NETIF_F_RXCSUM)
-                skb->ip_summed = CHECKSUM_UNNECESSARY;
 
         if (likely(dev_forward_skb(rcv, skb) == NET_RX_SUCCESS)) {
                 struct pcpu_vstats *stats = this_cpu_ptr(dev->vstats);
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index d8838dedb7a4..f94ab786088f 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -140,6 +140,12 @@ struct virtnet_info {
 
         /* CPU hot plug notifier */
         struct notifier_block nb;
+
+        /* Control VQ buffers: protected by the rtnl lock */
+        struct virtio_net_ctrl_hdr ctrl_hdr;
+        virtio_net_ctrl_ack ctrl_status;
+        u8 ctrl_promisc;
+        u8 ctrl_allmulti;
 };
 
 struct padded_vnet_hdr {
@@ -976,31 +982,30 @@ static bool virtnet_send_command(struct virtnet_info *vi, u8 class, u8 cmd,
                                  struct scatterlist *out)
 {
         struct scatterlist *sgs[4], hdr, stat;
-        struct virtio_net_ctrl_hdr ctrl;
-        virtio_net_ctrl_ack status = ~0;
         unsigned out_num = 0, tmp;
 
         /* Caller should know better */
         BUG_ON(!virtio_has_feature(vi->vdev, VIRTIO_NET_F_CTRL_VQ));
 
-        ctrl.class = class;
-        ctrl.cmd = cmd;
+        vi->ctrl_status = ~0;
+        vi->ctrl_hdr.class = class;
+        vi->ctrl_hdr.cmd = cmd;
         /* Add header */
-        sg_init_one(&hdr, &ctrl, sizeof(ctrl));
+        sg_init_one(&hdr, &vi->ctrl_hdr, sizeof(vi->ctrl_hdr));
         sgs[out_num++] = &hdr;
 
         if (out)
                 sgs[out_num++] = out;
 
         /* Add return status. */
-        sg_init_one(&stat, &status, sizeof(status));
+        sg_init_one(&stat, &vi->ctrl_status, sizeof(vi->ctrl_status));
         sgs[out_num] = &stat;
 
         BUG_ON(out_num + 1 > ARRAY_SIZE(sgs));
         virtqueue_add_sgs(vi->cvq, sgs, out_num, 1, vi, GFP_ATOMIC);
 
         if (unlikely(!virtqueue_kick(vi->cvq)))
-                return status == VIRTIO_NET_OK;
+                return vi->ctrl_status == VIRTIO_NET_OK;
 
         /* Spin for a response, the kick causes an ioport write, trapping
          * into the hypervisor, so the request should be handled immediately.
@@ -1009,7 +1014,7 @@ static bool virtnet_send_command(struct virtnet_info *vi, u8 class, u8 cmd,
                !virtqueue_is_broken(vi->cvq))
                 cpu_relax();
 
-        return status == VIRTIO_NET_OK;
+        return vi->ctrl_status == VIRTIO_NET_OK;
 }
 
 static int virtnet_set_mac_address(struct net_device *dev, void *p)
@@ -1151,7 +1156,6 @@ static void virtnet_set_rx_mode(struct net_device *dev)
 {
         struct virtnet_info *vi = netdev_priv(dev);
         struct scatterlist sg[2];
-        u8 promisc, allmulti;
         struct virtio_net_ctrl_mac *mac_data;
         struct netdev_hw_addr *ha;
         int uc_count;
@@ -1163,22 +1167,22 @@ static void virtnet_set_rx_mode(struct net_device *dev)
         if (!virtio_has_feature(vi->vdev, VIRTIO_NET_F_CTRL_RX))
                 return;
 
-        promisc = ((dev->flags & IFF_PROMISC) != 0);
-        allmulti = ((dev->flags & IFF_ALLMULTI) != 0);
+        vi->ctrl_promisc = ((dev->flags & IFF_PROMISC) != 0);
+        vi->ctrl_allmulti = ((dev->flags & IFF_ALLMULTI) != 0);
 
-        sg_init_one(sg, &promisc, sizeof(promisc));
+        sg_init_one(sg, &vi->ctrl_promisc, sizeof(vi->ctrl_promisc));
 
         if (!virtnet_send_command(vi, VIRTIO_NET_CTRL_RX,
                                   VIRTIO_NET_CTRL_RX_PROMISC, sg))
                 dev_warn(&dev->dev, "Failed to %sable promisc mode.\n",
-                         promisc ? "en" : "dis");
+                         vi->ctrl_promisc ? "en" : "dis");
 
-        sg_init_one(sg, &allmulti, sizeof(allmulti));
+        sg_init_one(sg, &vi->ctrl_allmulti, sizeof(vi->ctrl_allmulti));
 
         if (!virtnet_send_command(vi, VIRTIO_NET_CTRL_RX,
                                   VIRTIO_NET_CTRL_RX_ALLMULTI, sg))
                 dev_warn(&dev->dev, "Failed to %sable allmulti mode.\n",
-                         allmulti ? "en" : "dis");
+                         vi->ctrl_allmulti ? "en" : "dis");
 
         uc_count = netdev_uc_count(dev);
         mc_count = netdev_mc_count(dev);
diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
index 899ea4288197..417903715437 100644
--- a/drivers/net/vmxnet3/vmxnet3_drv.c
+++ b/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -587,6 +587,12 @@ vmxnet3_rq_alloc_rx_buf(struct vmxnet3_rx_queue *rq, u32 ring_idx,
                                                 &adapter->pdev->dev,
                                                 rbi->skb->data, rbi->len,
                                                 PCI_DMA_FROMDEVICE);
+                                if (dma_mapping_error(&adapter->pdev->dev,
+                                                      rbi->dma_addr)) {
+                                        dev_kfree_skb_any(rbi->skb);
+                                        rq->stats.rx_buf_alloc_failure++;
+                                        break;
+                                }
                         } else {
                                 /* rx buffer skipped by the device */
                         }
@@ -605,13 +611,18 @@ vmxnet3_rq_alloc_rx_buf(struct vmxnet3_rx_queue *rq, u32 ring_idx,
                                                 &adapter->pdev->dev,
                                                 rbi->page, 0, PAGE_SIZE,
                                                 PCI_DMA_FROMDEVICE);
+                                if (dma_mapping_error(&adapter->pdev->dev,
+                                                      rbi->dma_addr)) {
+                                        put_page(rbi->page);
+                                        rq->stats.rx_buf_alloc_failure++;
+                                        break;
+                                }
                         } else {
                                 /* rx buffers skipped by the device */
                         }
                         val = VMXNET3_RXD_BTYPE_BODY << VMXNET3_RXD_BTYPE_SHIFT;
                 }
 
-                BUG_ON(rbi->dma_addr == 0);
                 gd->rxd.addr = cpu_to_le64(rbi->dma_addr);
                 gd->dword[2] = cpu_to_le32((!ring->gen << VMXNET3_RXD_GEN_SHIFT)
                                            | val | rbi->len);
@@ -655,7 +666,7 @@ vmxnet3_append_frag(struct sk_buff *skb, struct Vmxnet3_RxCompDesc *rcd,
 }
 
 
-static void
+static int
 vmxnet3_map_pkt(struct sk_buff *skb, struct vmxnet3_tx_ctx *ctx,
                 struct vmxnet3_tx_queue *tq, struct pci_dev *pdev,
                 struct vmxnet3_adapter *adapter)
@@ -715,6 +726,8 @@ vmxnet3_map_pkt(struct sk_buff *skb, struct vmxnet3_tx_ctx *ctx,
                 tbi->dma_addr = dma_map_single(&adapter->pdev->dev,
                                 skb->data + buf_offset, buf_size,
                                 PCI_DMA_TODEVICE);
+                if (dma_mapping_error(&adapter->pdev->dev, tbi->dma_addr))
+                        return -EFAULT;
 
                 tbi->len = buf_size;
 
@@ -755,6 +768,8 @@ vmxnet3_map_pkt(struct sk_buff *skb, struct vmxnet3_tx_ctx *ctx,
                         tbi->dma_addr = skb_frag_dma_map(&adapter->pdev->dev, frag,
                                                          buf_offset, buf_size,
                                                          DMA_TO_DEVICE);
+                        if (dma_mapping_error(&adapter->pdev->dev, tbi->dma_addr))
+                                return -EFAULT;
 
                         tbi->len = buf_size;
 
@@ -782,6 +797,8 @@ vmxnet3_map_pkt(struct sk_buff *skb, struct vmxnet3_tx_ctx *ctx,
         /* set the last buf_info for the pkt */
         tbi->skb = skb;
         tbi->sop_idx = ctx->sop_txd - tq->tx_ring.base;
+
+        return 0;
 }
 
 
@@ -1020,7 +1037,8 @@ vmxnet3_tq_xmit(struct sk_buff *skb, struct vmxnet3_tx_queue *tq,
         }
 
         /* fill tx descs related to addr & len */
-        vmxnet3_map_pkt(skb, &ctx, tq, adapter->pdev, adapter);
+        if (vmxnet3_map_pkt(skb, &ctx, tq, adapter->pdev, adapter))
+                goto unlock_drop_pkt;
 
         /* setup the EOP desc */
         ctx.eop_txd->dword[3] = cpu_to_le32(VMXNET3_TXD_CQ | VMXNET3_TXD_EOP);
@@ -1231,6 +1249,7 @@ vmxnet3_rq_rx_complete(struct vmxnet3_rx_queue *rq,
                 struct vmxnet3_rx_buf_info *rbi;
                 struct sk_buff *skb, *new_skb = NULL;
                 struct page *new_page = NULL;
+                dma_addr_t new_dma_addr;
                 int num_to_alloc;
                 struct Vmxnet3_RxDesc *rxd;
                 u32 idx, ring_idx;
@@ -1287,6 +1306,21 @@ vmxnet3_rq_rx_complete(struct vmxnet3_rx_queue *rq,
                                 skip_page_frags = true;
                                 goto rcd_done;
                         }
+                        new_dma_addr = dma_map_single(&adapter->pdev->dev,
+                                                      new_skb->data, rbi->len,
+                                                      PCI_DMA_FROMDEVICE);
+                        if (dma_mapping_error(&adapter->pdev->dev,
+                                              new_dma_addr)) {
+                                dev_kfree_skb(new_skb);
+                                /* Skb allocation failed, do not handover this
+                                 * skb to stack. Reuse it. Drop the existing pkt
+                                 */
+                                rq->stats.rx_buf_alloc_failure++;
+                                ctx->skb = NULL;
+                                rq->stats.drop_total++;
+                                skip_page_frags = true;
+                                goto rcd_done;
+                        }
 
                         dma_unmap_single(&adapter->pdev->dev, rbi->dma_addr,
                                          rbi->len,
@@ -1303,9 +1337,7 @@ vmxnet3_rq_rx_complete(struct vmxnet3_rx_queue *rq,
 
                         /* Immediate refill */
                         rbi->skb = new_skb;
-                        rbi->dma_addr = dma_map_single(&adapter->pdev->dev,
-                                                       rbi->skb->data, rbi->len,
-                                                       PCI_DMA_FROMDEVICE);
+                        rbi->dma_addr = new_dma_addr;
                         rxd->addr = cpu_to_le64(rbi->dma_addr);
                         rxd->len = rbi->len;
                         if (adapter->version == 2 &&
@@ -1348,6 +1380,19 @@ vmxnet3_rq_rx_complete(struct vmxnet3_rx_queue *rq,
                                         skip_page_frags = true;
                                         goto rcd_done;
                                 }
+                                new_dma_addr = dma_map_page(&adapter->pdev->dev
+                                                        , rbi->page,
+                                                        0, PAGE_SIZE,
+                                                        PCI_DMA_FROMDEVICE);
+                                if (dma_mapping_error(&adapter->pdev->dev,
+                                                      new_dma_addr)) {
+                                        put_page(new_page);
+                                        rq->stats.rx_buf_alloc_failure++;
+                                        dev_kfree_skb(ctx->skb);
+                                        ctx->skb = NULL;
+                                        skip_page_frags = true;
+                                        goto rcd_done;
+                                }
 
                                 dma_unmap_page(&adapter->pdev->dev,
                                                rbi->dma_addr, rbi->len,
@@ -1357,10 +1402,7 @@ vmxnet3_rq_rx_complete(struct vmxnet3_rx_queue *rq,
 
                                 /* Immediate refill */
                                 rbi->page = new_page;
-                                rbi->dma_addr = dma_map_page(&adapter->pdev->dev
-                                                        , rbi->page,
-                                                        0, PAGE_SIZE,
-                                                        PCI_DMA_FROMDEVICE);
+                                rbi->dma_addr = new_dma_addr;
                                 rxd->addr = cpu_to_le64(rbi->dma_addr);
                                 rxd->len = rbi->len;
                         }
@@ -2167,7 +2209,8 @@ vmxnet3_set_mc(struct net_device *netdev)
                                                         PCI_DMA_TODEVICE);
                         }
 
-                        if (new_table_pa) {
+                        if (!dma_mapping_error(&adapter->pdev->dev,
+                                               new_table_pa)) {
                                 new_mode |= VMXNET3_RXM_MCAST;
                                 rxConf->mfTablePA = cpu_to_le64(new_table_pa);
                         } else {
@@ -3075,6 +3118,11 @@ vmxnet3_probe_device(struct pci_dev *pdev,
         adapter->adapter_pa = dma_map_single(&adapter->pdev->dev, adapter,
                                              sizeof(struct vmxnet3_adapter),
                                              PCI_DMA_TODEVICE);
+        if (dma_mapping_error(&adapter->pdev->dev, adapter->adapter_pa)) {
+                dev_err(&pdev->dev, "Failed to map dma\n");
+                err = -EFAULT;
+                goto err_dma_map;
+        }
         adapter->shared = dma_alloc_coherent(
                                 &adapter->pdev->dev,
                                 sizeof(struct Vmxnet3_DriverShared),
@@ -3233,6 +3281,7 @@ err_alloc_queue_desc:
 err_alloc_shared:
         dma_unmap_single(&adapter->pdev->dev, adapter->adapter_pa,
                          sizeof(struct vmxnet3_adapter), PCI_DMA_TODEVICE);
+err_dma_map:
         free_netdev(netdev);
         return err;
 }
diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c
index 92fa3e1ea65c..4f9748457f5a 100644
--- a/drivers/net/vrf.c
+++ b/drivers/net/vrf.c
@@ -907,7 +907,6 @@ static int vrf_newlink(struct net *src_net, struct net_device *dev,
                        struct nlattr *tb[], struct nlattr *data[])
 {
         struct net_vrf *vrf = netdev_priv(dev);
-        int err;
 
         if (!data || !data[IFLA_VRF_TABLE])
                 return -EINVAL;
@@ -916,15 +915,7 @@ static int vrf_newlink(struct net *src_net, struct net_device *dev,
 
         dev->priv_flags |= IFF_L3MDEV_MASTER;
 
-        err = register_netdevice(dev);
-        if (err < 0)
-                goto out_fail;
-
-        return 0;
-
-out_fail:
-        free_netdev(dev);
-        return err;
+        return register_netdevice(dev);
 }
 
 static size_t vrf_nl_getsize(const struct net_device *dev)
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index 6369a5734d4c..ba363cedef80 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -1158,7 +1158,6 @@ static void vxlan_rcv(struct vxlan_sock *vs, struct sk_buff *skb,
         struct pcpu_sw_netstats *stats;
         union vxlan_addr saddr;
         int err = 0;
-        union vxlan_addr *remote_ip;
 
         /* For flow based devices, map all packets to VNI 0 */
         if (vs->flags & VXLAN_F_COLLECT_METADATA)
@@ -1169,7 +1168,6 @@ static void vxlan_rcv(struct vxlan_sock *vs, struct sk_buff *skb,
         if (!vxlan)
                 goto drop;
 
-        remote_ip = &vxlan->default_dst.remote_ip;
         skb_reset_mac_header(skb);
         skb_scrub_packet(skb, !net_eq(vxlan->net, dev_net(vxlan->dev)));
         skb->protocol = eth_type_trans(skb, vxlan->dev);
@@ -1179,8 +1177,8 @@ static void vxlan_rcv(struct vxlan_sock *vs, struct sk_buff *skb,
         if (ether_addr_equal(eth_hdr(skb)->h_source, vxlan->dev->dev_addr))
                 goto drop;
 
-        /* Re-examine inner Ethernet packet */
-        if (remote_ip->sa.sa_family == AF_INET) {
+        /* Get data from the outer IP header */
+        if (vxlan_get_sk_family(vs) == AF_INET) {
                 oip = ip_hdr(skb);
                 saddr.sin.sin_addr.s_addr = oip->saddr;
                 saddr.sa.sa_family = AF_INET;
@@ -1848,6 +1846,34 @@ static int vxlan_xmit_skb(struct rtable *rt, struct sock *sk, struct sk_buff *sk
                                    !(vxflags & VXLAN_F_UDP_CSUM));
 }
 
+#if IS_ENABLED(CONFIG_IPV6)
+static struct dst_entry *vxlan6_get_route(struct vxlan_dev *vxlan,
+                                          struct sk_buff *skb, int oif,
+                                          const struct in6_addr *daddr,
+                                          struct in6_addr *saddr)
+{
+        struct dst_entry *ndst;
+        struct flowi6 fl6;
+        int err;
+
+        memset(&fl6, 0, sizeof(fl6));
+        fl6.flowi6_oif = oif;
+        fl6.daddr = *daddr;
+        fl6.saddr = vxlan->cfg.saddr.sin6.sin6_addr;
+        fl6.flowi6_mark = skb->mark;
+        fl6.flowi6_proto = IPPROTO_UDP;
+
+        err = ipv6_stub->ipv6_dst_lookup(vxlan->net,
+                                         vxlan->vn6_sock->sock->sk,
+                                         &ndst, &fl6);
+        if (err < 0)
+                return ERR_PTR(err);
+
+        *saddr = fl6.saddr;
+        return ndst;
+}
+#endif
+
 /* Bypass encapsulation if the destination is local */
 static void vxlan_encap_bypass(struct sk_buff *skb, struct vxlan_dev *src_vxlan,
                                struct vxlan_dev *dst_vxlan)
@@ -2035,21 +2061,17 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
 #if IS_ENABLED(CONFIG_IPV6)
         } else {
                 struct dst_entry *ndst;
-                struct flowi6 fl6;
+                struct in6_addr saddr;
                 u32 rt6i_flags;
 
                 if (!vxlan->vn6_sock)
                         goto drop;
                 sk = vxlan->vn6_sock->sock->sk;
 
-                memset(&fl6, 0, sizeof(fl6));
-                fl6.flowi6_oif = rdst ? rdst->remote_ifindex : 0;
-                fl6.daddr = dst->sin6.sin6_addr;
-                fl6.saddr = vxlan->cfg.saddr.sin6.sin6_addr;
-                fl6.flowi6_mark = skb->mark;
-                fl6.flowi6_proto = IPPROTO_UDP;
-
-                if (ipv6_stub->ipv6_dst_lookup(vxlan->net, sk, &ndst, &fl6)) {
+                ndst = vxlan6_get_route(vxlan, skb,
+                                        rdst ? rdst->remote_ifindex : 0,
+                                        &dst->sin6.sin6_addr, &saddr);
+                if (IS_ERR(ndst)) {
                         netdev_dbg(dev, "no route to %pI6\n",
                                    &dst->sin6.sin6_addr);
                         dev->stats.tx_carrier_errors++;
@@ -2081,7 +2103,7 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
                 }
 
                 ttl = ttl ? : ip6_dst_hoplimit(ndst);
-                err = vxlan6_xmit_skb(ndst, sk, skb, dev, &fl6.saddr, &fl6.daddr,
+                err = vxlan6_xmit_skb(ndst, sk, skb, dev, &saddr, &dst->sin6.sin6_addr,
                                       0, ttl, src_port, dst_port, htonl(vni << 8), md,
                                       !net_eq(vxlan->net, dev_net(vxlan->dev)),
                                       flags);
@@ -2395,9 +2417,30 @@ static int vxlan_fill_metadata_dst(struct net_device *dev, struct sk_buff *skb)
                                   vxlan->cfg.port_max, true);
         dport = info->key.tp_dst ? : vxlan->cfg.dst_port;
 
-        if (ip_tunnel_info_af(info) == AF_INET)
+        if (ip_tunnel_info_af(info) == AF_INET) {
+                if (!vxlan->vn4_sock)
+                        return -EINVAL;
                 return egress_ipv4_tun_info(dev, skb, info, sport, dport);
-        return -EINVAL;
+        } else {
+#if IS_ENABLED(CONFIG_IPV6)
+                struct dst_entry *ndst;
+
+                if (!vxlan->vn6_sock)
+                        return -EINVAL;
+                ndst = vxlan6_get_route(vxlan, skb, 0,
+                                        &info->key.u.ipv6.dst,
+                                        &info->key.u.ipv6.src);
+                if (IS_ERR(ndst))
+                        return PTR_ERR(ndst);
+                dst_release(ndst);
+
+                info->key.tp_src = sport;
+                info->key.tp_dst = dport;
+#else /* !CONFIG_IPV6 */
+                return -EPFNOSUPPORT;
+#endif
+        }
+        return 0;
 }
 
 static const struct net_device_ops vxlan_netdev_ops = {
diff --git a/drivers/net/wan/hdlc_fr.c b/drivers/net/wan/hdlc_fr.c
index e92aaf615901..89541cc90e87 100644
--- a/drivers/net/wan/hdlc_fr.c
+++ b/drivers/net/wan/hdlc_fr.c
@@ -1075,11 +1075,10 @@ static int fr_add_pvc(struct net_device *frad, unsigned int dlci, int type)
 
         used = pvc_is_used(pvc);
 
-        if (type == ARPHRD_ETHER) {
+        if (type == ARPHRD_ETHER)
                 dev = alloc_netdev(0, "pvceth%d", NET_NAME_UNKNOWN,
                                    ether_setup);
-                dev->priv_flags &= ~IFF_TX_SKB_SHARING;
-        } else
+        else
                 dev = alloc_netdev(0, "pvc%d", NET_NAME_UNKNOWN, pvc_setup);
 
         if (!dev) {
@@ -1088,9 +1087,10 @@ static int fr_add_pvc(struct net_device *frad, unsigned int dlci, int type)
                 return -ENOBUFS;
         }
 
-        if (type == ARPHRD_ETHER)
+        if (type == ARPHRD_ETHER) {
+                dev->priv_flags &= ~IFF_TX_SKB_SHARING;
                 eth_hw_addr_random(dev);
-        else {
+        } else {
                 *(__be16*)dev->dev_addr = htons(dlci);
                 dlci_to_q922(dev->broadcast, dlci);
         }
diff --git a/drivers/net/wan/x25_asy.c b/drivers/net/wan/x25_asy.c
index 5c47b011a9d7..cd39025d2abf 100644
--- a/drivers/net/wan/x25_asy.c
+++ b/drivers/net/wan/x25_asy.c
@@ -549,16 +549,12 @@ static void x25_asy_receive_buf(struct tty_struct *tty,
 
 static int x25_asy_open_tty(struct tty_struct *tty)
 {
-        struct x25_asy *sl = tty->disc_data;
+        struct x25_asy *sl;
         int err;
 
         if (tty->ops->write == NULL)
                 return -EOPNOTSUPP;
 
-        /* First make sure we're not already connected. */
-        if (sl && sl->magic == X25_ASY_MAGIC)
-                return -EEXIST;
-
         /* OK.  Find a free X.25 channel to use. */
         sl = x25_asy_alloc();
         if (sl == NULL)
diff --git a/drivers/net/wireless/ath/ath10k/core.c b/drivers/net/wireless/ath/ath10k/core.c
index aa9bd92ac4ed..0947cc271e69 100644
--- a/drivers/net/wireless/ath/ath10k/core.c
+++ b/drivers/net/wireless/ath/ath10k/core.c
@@ -51,6 +51,7 @@ MODULE_PARM_DESC(rawmode, "Use raw 802.11 frame datapath");
 static const struct ath10k_hw_params ath10k_hw_params_list[] = {
         {
                 .id = QCA988X_HW_2_0_VERSION,
+                .dev_id = QCA988X_2_0_DEVICE_ID,
                 .name = "qca988x hw2.0",
                 .patch_load_addr = QCA988X_HW_2_0_PATCH_LOAD_ADDR,
                 .uart_pin = 7,
@@ -69,6 +70,25 @@ static const struct ath10k_hw_params ath10k_hw_params_list[] = {
         },
         {
                 .id = QCA6174_HW_2_1_VERSION,
+                .dev_id = QCA6164_2_1_DEVICE_ID,
+                .name = "qca6164 hw2.1",
+                .patch_load_addr = QCA6174_HW_2_1_PATCH_LOAD_ADDR,
+                .uart_pin = 6,
+                .otp_exe_param = 0,
+                .channel_counters_freq_hz = 88000,
+                .max_probe_resp_desc_thres = 0,
+                .fw = {
+                        .dir = QCA6174_HW_2_1_FW_DIR,
+                        .fw = QCA6174_HW_2_1_FW_FILE,
+                        .otp = QCA6174_HW_2_1_OTP_FILE,
+                        .board = QCA6174_HW_2_1_BOARD_DATA_FILE,
+                        .board_size = QCA6174_BOARD_DATA_SZ,
+                        .board_ext_size = QCA6174_BOARD_EXT_DATA_SZ,
+                },
+        },
+        {
+                .id = QCA6174_HW_2_1_VERSION,
+                .dev_id = QCA6174_2_1_DEVICE_ID,
                 .name = "qca6174 hw2.1",
                 .patch_load_addr = QCA6174_HW_2_1_PATCH_LOAD_ADDR,
                 .uart_pin = 6,
@@ -86,6 +106,7 @@ static const struct ath10k_hw_params ath10k_hw_params_list[] = {
         },
         {
                 .id = QCA6174_HW_3_0_VERSION,
+                .dev_id = QCA6174_2_1_DEVICE_ID,
                 .name = "qca6174 hw3.0",
                 .patch_load_addr = QCA6174_HW_3_0_PATCH_LOAD_ADDR,
                 .uart_pin = 6,
@@ -103,6 +124,7 @@ static const struct ath10k_hw_params ath10k_hw_params_list[] = {
         },
         {
                 .id = QCA6174_HW_3_2_VERSION,
+                .dev_id = QCA6174_2_1_DEVICE_ID,
                 .name = "qca6174 hw3.2",
                 .patch_load_addr = QCA6174_HW_3_0_PATCH_LOAD_ADDR,
                 .uart_pin = 6,
@@ -121,6 +143,7 @@ static const struct ath10k_hw_params ath10k_hw_params_list[] = {
         },
         {
                 .id = QCA99X0_HW_2_0_DEV_VERSION,
+                .dev_id = QCA99X0_2_0_DEVICE_ID,
                 .name = "qca99x0 hw2.0",
                 .patch_load_addr = QCA99X0_HW_2_0_PATCH_LOAD_ADDR,
                 .uart_pin = 7,
@@ -139,10 +162,31 @@ static const struct ath10k_hw_params ath10k_hw_params_list[] = {
         },
         {
                 .id = QCA9377_HW_1_0_DEV_VERSION,
+                .dev_id = QCA9377_1_0_DEVICE_ID,
                 .name = "qca9377 hw1.0",
                 .patch_load_addr = QCA9377_HW_1_0_PATCH_LOAD_ADDR,
-                .uart_pin = 7,
+                .uart_pin = 6,
                 .otp_exe_param = 0,
+                .channel_counters_freq_hz = 88000,
+                .max_probe_resp_desc_thres = 0,
+                .fw = {
+                        .dir = QCA9377_HW_1_0_FW_DIR,
+                        .fw = QCA9377_HW_1_0_FW_FILE,
+                        .otp = QCA9377_HW_1_0_OTP_FILE,
+                        .board = QCA9377_HW_1_0_BOARD_DATA_FILE,
+                        .board_size = QCA9377_BOARD_DATA_SZ,
+                        .board_ext_size = QCA9377_BOARD_EXT_DATA_SZ,
+                },
+        },
+        {
+                .id = QCA9377_HW_1_1_DEV_VERSION,
+                .dev_id = QCA9377_1_0_DEVICE_ID,
+                .name = "qca9377 hw1.1",
+                .patch_load_addr = QCA9377_HW_1_0_PATCH_LOAD_ADDR,
+                .uart_pin = 6,
+                .otp_exe_param = 0,
+                .channel_counters_freq_hz = 88000,
+                .max_probe_resp_desc_thres = 0,
                 .fw = {
                         .dir = QCA9377_HW_1_0_FW_DIR,
                         .fw = QCA9377_HW_1_0_FW_FILE,
@@ -1263,7 +1307,8 @@ static int ath10k_init_hw_params(struct ath10k *ar)
         for (i = 0; i < ARRAY_SIZE(ath10k_hw_params_list); i++) {
                 hw_params = &ath10k_hw_params_list[i];
 
-                if (hw_params->id == ar->target_version)
+                if (hw_params->id == ar->target_version &&
+                    hw_params->dev_id == ar->dev_id)
                         break;
         }
 
diff --git a/drivers/net/wireless/ath/ath10k/core.h b/drivers/net/wireless/ath/ath10k/core.h
index 018c64f4fd25..858d75f49a9f 100644
--- a/drivers/net/wireless/ath/ath10k/core.h
+++ b/drivers/net/wireless/ath/ath10k/core.h
@@ -636,6 +636,7 @@ struct ath10k {
 
         struct ath10k_hw_params {
                 u32 id;
+                u16 dev_id;
                 const char *name;
                 u32 patch_load_addr;
                 int uart_pin;
diff --git a/drivers/net/wireless/ath/ath10k/hw.h b/drivers/net/wireless/ath/ath10k/hw.h
index 39966a05c1cc..713c2bcea178 100644
--- a/drivers/net/wireless/ath/ath10k/hw.h
+++ b/drivers/net/wireless/ath/ath10k/hw.h
@@ -22,6 +22,12 @@
 
 #define ATH10K_FW_DIR                   "ath10k"
 
+#define QCA988X_2_0_DEVICE_ID   (0x003c)
+#define QCA6164_2_1_DEVICE_ID   (0x0041)
+#define QCA6174_2_1_DEVICE_ID   (0x003e)
+#define QCA99X0_2_0_DEVICE_ID   (0x0040)
+#define QCA9377_1_0_DEVICE_ID   (0x0042)
+
 /* QCA988X 1.0 definitions (unsupported) */
 #define QCA988X_HW_1_0_CHIP_ID_REV      0x0
 
@@ -42,6 +48,10 @@
 #define QCA6174_HW_3_0_VERSION          0x05020000
 #define QCA6174_HW_3_2_VERSION          0x05030000
 
+/* QCA9377 target BMI version signatures */
+#define QCA9377_HW_1_0_DEV_VERSION      0x05020000
+#define QCA9377_HW_1_1_DEV_VERSION      0x05020001
+
 enum qca6174_pci_rev {
         QCA6174_PCI_REV_1_1 = 0x11,
         QCA6174_PCI_REV_1_3 = 0x13,
@@ -60,6 +70,11 @@ enum qca6174_chip_id_rev {
         QCA6174_HW_3_2_CHIP_ID_REV = 10,
 };
 
+enum qca9377_chip_id_rev {
+        QCA9377_HW_1_0_CHIP_ID_REV = 0x0,
+        QCA9377_HW_1_1_CHIP_ID_REV = 0x1,
+};
+
 #define QCA6174_HW_2_1_FW_DIR           "ath10k/QCA6174/hw2.1"
 #define QCA6174_HW_2_1_FW_FILE          "firmware.bin"
 #define QCA6174_HW_2_1_OTP_FILE         "otp.bin"
@@ -85,8 +100,6 @@ enum qca6174_chip_id_rev {
 #define QCA99X0_HW_2_0_PATCH_LOAD_ADDR  0x1234
 
 /* QCA9377 1.0 definitions */
-#define QCA9377_HW_1_0_DEV_VERSION     0x05020001
-#define QCA9377_HW_1_0_CHIP_ID_REV     0x1
 #define QCA9377_HW_1_0_FW_DIR          ATH10K_FW_DIR "/QCA9377/hw1.0"
 #define QCA9377_HW_1_0_FW_FILE         "firmware.bin"
 #define QCA9377_HW_1_0_OTP_FILE        "otp.bin"
diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
index a7411fe90cc4..95a55405ebf0 100644
--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -4225,7 +4225,7 @@ static int ath10k_config(struct ieee80211_hw *hw, u32 changed)
 
 static u32 get_nss_from_chainmask(u16 chain_mask)
 {
-        if ((chain_mask & 0x15) == 0x15)
+        if ((chain_mask & 0xf) == 0xf)
                 return 4;
         else if ((chain_mask & 0x7) == 0x7)
                 return 3;
diff --git a/drivers/net/wireless/ath/ath10k/pci.c b/drivers/net/wireless/ath/ath10k/pci.c
index 3fca200b986c..930785a724e1 100644
--- a/drivers/net/wireless/ath/ath10k/pci.c
+++ b/drivers/net/wireless/ath/ath10k/pci.c
@@ -57,12 +57,6 @@ MODULE_PARM_DESC(reset_mode, "0: auto, 1: warm only (default: 0)");
 #define ATH10K_PCI_TARGET_WAIT 3000
 #define ATH10K_PCI_NUM_WARM_RESET_ATTEMPTS 3
 
-#define QCA988X_2_0_DEVICE_ID   (0x003c)
-#define QCA6164_2_1_DEVICE_ID   (0x0041)
-#define QCA6174_2_1_DEVICE_ID   (0x003e)
-#define QCA99X0_2_0_DEVICE_ID   (0x0040)
-#define QCA9377_1_0_DEVICE_ID   (0x0042)
-
 static const struct pci_device_id ath10k_pci_id_table[] = {
         { PCI_VDEVICE(ATHEROS, QCA988X_2_0_DEVICE_ID) }, /* PCI-E QCA988X V2 */
         { PCI_VDEVICE(ATHEROS, QCA6164_2_1_DEVICE_ID) }, /* PCI-E QCA6164 V2.1 */
@@ -92,7 +86,9 @@ static const struct ath10k_pci_supp_chip ath10k_pci_supp_chips[] = {
         { QCA6174_2_1_DEVICE_ID, QCA6174_HW_3_2_CHIP_ID_REV },
 
         { QCA99X0_2_0_DEVICE_ID, QCA99X0_HW_2_0_CHIP_ID_REV },
+
         { QCA9377_1_0_DEVICE_ID, QCA9377_HW_1_0_CHIP_ID_REV },
+        { QCA9377_1_0_DEVICE_ID, QCA9377_HW_1_1_CHIP_ID_REV },
 };
 
 static void ath10k_pci_buffer_cleanup(struct ath10k *ar);
@@ -111,8 +107,9 @@ static void ath10k_pci_htc_tx_cb(struct ath10k_ce_pipe *ce_state);
 static void ath10k_pci_htc_rx_cb(struct ath10k_ce_pipe *ce_state);
 static void ath10k_pci_htt_tx_cb(struct ath10k_ce_pipe *ce_state);
 static void ath10k_pci_htt_rx_cb(struct ath10k_ce_pipe *ce_state);
+static void ath10k_pci_htt_htc_rx_cb(struct ath10k_ce_pipe *ce_state);
 
-static const struct ce_attr host_ce_config_wlan[] = {
+static struct ce_attr host_ce_config_wlan[] = {
         /* CE0: host->target HTC control and raw streams */
         {
                 .flags = CE_ATTR_FLAGS,
@@ -128,7 +125,7 @@ static const struct ce_attr host_ce_config_wlan[] = {
                 .src_nentries = 0,
                 .src_sz_max = 2048,
                 .dest_nentries = 512,
-                .recv_cb = ath10k_pci_htc_rx_cb,
+                .recv_cb = ath10k_pci_htt_htc_rx_cb,
         },
 
         /* CE2: target->host WMI */
@@ -217,7 +214,7 @@ static const struct ce_attr host_ce_config_wlan[] = {
 };
 
 /* Target firmware's Copy Engine configuration. */
-static const struct ce_pipe_config target_ce_config_wlan[] = {
+static struct ce_pipe_config target_ce_config_wlan[] = {
         /* CE0: host->target HTC control and raw streams */
         {
                 .pipenum = __cpu_to_le32(0),
@@ -330,7 +327,7 @@ static const struct ce_pipe_config target_ce_config_wlan[] = {
  * This table is derived from the CE_PCI TABLE, above.
  * It is passed to the Target at startup for use by firmware.
  */
-static const struct service_to_pipe target_service_to_ce_map_wlan[] = {
+static struct service_to_pipe target_service_to_ce_map_wlan[] = {
         {
                 __cpu_to_le32(ATH10K_HTC_SVC_ID_WMI_DATA_VO),
                 __cpu_to_le32(PIPEDIR_OUT),     /* out = UL = host -> target */
@@ -1208,6 +1205,16 @@ static void ath10k_pci_htc_rx_cb(struct ath10k_ce_pipe *ce_state)
         ath10k_pci_process_rx_cb(ce_state, ath10k_htc_rx_completion_handler);
 }
 
+static void ath10k_pci_htt_htc_rx_cb(struct ath10k_ce_pipe *ce_state)
+{
+        /* CE4 polling needs to be done whenever CE pipe which transports
+         * HTT Rx (target->host) is processed.
+         */
+        ath10k_ce_per_engine_service(ce_state->ar, 4);
+
+        ath10k_pci_process_rx_cb(ce_state, ath10k_htc_rx_completion_handler);
+}
+
 /* Called by lower (CE) layer when a send to HTT Target completes. */
 static void ath10k_pci_htt_tx_cb(struct ath10k_ce_pipe *ce_state)
 {
@@ -2027,6 +2034,29 @@ static int ath10k_pci_init_config(struct ath10k *ar)
         return 0;
 }
 
+static void ath10k_pci_override_ce_config(struct ath10k *ar)
+{
+        struct ce_attr *attr;
+        struct ce_pipe_config *config;
+
+        /* For QCA6174 we're overriding the Copy Engine 5 configuration,
+         * since it is currently used for other feature.
+         */
+
+        /* Override Host's Copy Engine 5 configuration */
+        attr = &host_ce_config_wlan[5];
+        attr->src_sz_max = 0;
+        attr->dest_nentries = 0;
+
+        /* Override Target firmware's Copy Engine configuration */
+        config = &target_ce_config_wlan[5];
+        config->pipedir = __cpu_to_le32(PIPEDIR_OUT);
+        config->nbytes_max = __cpu_to_le32(2048);
+
+        /* Map from service/endpoint to Copy Engine */
+        target_service_to_ce_map_wlan[15].pipenum = __cpu_to_le32(1);
+}
+
 static int ath10k_pci_alloc_pipes(struct ath10k *ar)
 {
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
@@ -3020,6 +3050,9 @@ static int ath10k_pci_probe(struct pci_dev *pdev,
                 goto err_core_destroy;
         }
 
+        if (QCA_REV_6174(ar))
+                ath10k_pci_override_ce_config(ar);
+
         ret = ath10k_pci_alloc_pipes(ar);
         if (ret) {
                 ath10k_err(ar, "failed to allocate copy engine pipes: %d\n",
diff --git a/drivers/net/wireless/iwlwifi/iwl-7000.c b/drivers/net/wireless/iwlwifi/iwl-7000.c
index 1a73c7a1da77..d9a4aee246a6 100644
--- a/drivers/net/wireless/iwlwifi/iwl-7000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-7000.c
@@ -70,12 +70,18 @@
 
 /* Highest firmware API version supported */
 #define IWL7260_UCODE_API_MAX   17
+#define IWL7265_UCODE_API_MAX   19
+#define IWL7265D_UCODE_API_MAX  19
 
 /* Oldest version we won't warn about */
 #define IWL7260_UCODE_API_OK    13
+#define IWL7265_UCODE_API_OK    13
+#define IWL7265D_UCODE_API_OK   13
 
 /* Lowest firmware API version supported */
 #define IWL7260_UCODE_API_MIN   13
+#define IWL7265_UCODE_API_MIN   13
+#define IWL7265D_UCODE_API_MIN  13
 
 /* NVM versions */
 #define IWL7260_NVM_VERSION             0x0a1d
@@ -149,10 +155,7 @@ static const struct iwl_ht_params iwl7000_ht_params = {
         .ht40_bands = BIT(IEEE80211_BAND_2GHZ) | BIT(IEEE80211_BAND_5GHZ),
 };
 
-#define IWL_DEVICE_7000                                         \
-        .ucode_api_max = IWL7260_UCODE_API_MAX,                 \
-        .ucode_api_ok = IWL7260_UCODE_API_OK,                   \
-        .ucode_api_min = IWL7260_UCODE_API_MIN,                 \
+#define IWL_DEVICE_7000_COMMON                                  \
         .device_family = IWL_DEVICE_FAMILY_7000,                \
         .max_inst_size = IWL60_RTC_INST_SIZE,                   \
         .max_data_size = IWL60_RTC_DATA_SIZE,                   \
@@ -163,6 +166,24 @@ static const struct iwl_ht_params iwl7000_ht_params = {
         .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K,    \
         .dccm_offset = IWL7000_DCCM_OFFSET
 
+#define IWL_DEVICE_7000                                         \
+        IWL_DEVICE_7000_COMMON,                                 \
+        .ucode_api_max = IWL7260_UCODE_API_MAX,                 \
+        .ucode_api_ok = IWL7260_UCODE_API_OK,                   \
+        .ucode_api_min = IWL7260_UCODE_API_MIN
+
+#define IWL_DEVICE_7005                                         \
+        IWL_DEVICE_7000_COMMON,                                 \
+        .ucode_api_max = IWL7265_UCODE_API_MAX,                 \
+        .ucode_api_ok = IWL7265_UCODE_API_OK,                   \
+        .ucode_api_min = IWL7265_UCODE_API_MIN
+
+#define IWL_DEVICE_7005D                                        \
+        IWL_DEVICE_7000_COMMON,                                 \
+        .ucode_api_max = IWL7265D_UCODE_API_MAX,                \
+        .ucode_api_ok = IWL7265D_UCODE_API_OK,                  \
+        .ucode_api_min = IWL7265D_UCODE_API_MIN
+
 const struct iwl_cfg iwl7260_2ac_cfg = {
         .name = "Intel(R) Dual Band Wireless AC 7260",
         .fw_name_pre = IWL7260_FW_PRE,
@@ -266,7 +287,7 @@ static const struct iwl_ht_params iwl7265_ht_params = {
 const struct iwl_cfg iwl3165_2ac_cfg = {
         .name = "Intel(R) Dual Band Wireless AC 3165",
         .fw_name_pre = IWL7265D_FW_PRE,
-        IWL_DEVICE_7000,
+        IWL_DEVICE_7005D,
         .ht_params = &iwl7000_ht_params,
         .nvm_ver = IWL3165_NVM_VERSION,
         .nvm_calib_ver = IWL3165_TX_POWER_VERSION,
@@ -277,7 +298,7 @@ const struct iwl_cfg iwl3165_2ac_cfg = {
 const struct iwl_cfg iwl7265_2ac_cfg = {
         .name = "Intel(R) Dual Band Wireless AC 7265",
         .fw_name_pre = IWL7265_FW_PRE,
-        IWL_DEVICE_7000,
+        IWL_DEVICE_7005,
         .ht_params = &iwl7265_ht_params,
         .nvm_ver = IWL7265_NVM_VERSION,
         .nvm_calib_ver = IWL7265_TX_POWER_VERSION,
@@ -288,7 +309,7 @@ const struct iwl_cfg iwl7265_2ac_cfg = {
 const struct iwl_cfg iwl7265_2n_cfg = {
         .name = "Intel(R) Dual Band Wireless N 7265",
         .fw_name_pre = IWL7265_FW_PRE,
-        IWL_DEVICE_7000,
+        IWL_DEVICE_7005,
         .ht_params = &iwl7265_ht_params,
         .nvm_ver = IWL7265_NVM_VERSION,
         .nvm_calib_ver = IWL7265_TX_POWER_VERSION,
@@ -299,7 +320,7 @@ const struct iwl_cfg iwl7265_2n_cfg = {
 const struct iwl_cfg iwl7265_n_cfg = {
         .name = "Intel(R) Wireless N 7265",
         .fw_name_pre = IWL7265_FW_PRE,
-        IWL_DEVICE_7000,
+        IWL_DEVICE_7005,
         .ht_params = &iwl7265_ht_params,
         .nvm_ver = IWL7265_NVM_VERSION,
         .nvm_calib_ver = IWL7265_TX_POWER_VERSION,
@@ -310,7 +331,7 @@ const struct iwl_cfg iwl7265_n_cfg = {
 const struct iwl_cfg iwl7265d_2ac_cfg = {
         .name = "Intel(R) Dual Band Wireless AC 7265",
         .fw_name_pre = IWL7265D_FW_PRE,
-        IWL_DEVICE_7000,
+        IWL_DEVICE_7005D,
         .ht_params = &iwl7265_ht_params,
         .nvm_ver = IWL7265D_NVM_VERSION,
         .nvm_calib_ver = IWL7265_TX_POWER_VERSION,
@@ -321,7 +342,7 @@ const struct iwl_cfg iwl7265d_2ac_cfg = {
 const struct iwl_cfg iwl7265d_2n_cfg = {
         .name = "Intel(R) Dual Band Wireless N 7265",
         .fw_name_pre = IWL7265D_FW_PRE,
-        IWL_DEVICE_7000,
+        IWL_DEVICE_7005D,
         .ht_params = &iwl7265_ht_params,
         .nvm_ver = IWL7265D_NVM_VERSION,
         .nvm_calib_ver = IWL7265_TX_POWER_VERSION,
@@ -332,7 +353,7 @@ const struct iwl_cfg iwl7265d_2n_cfg = {
 const struct iwl_cfg iwl7265d_n_cfg = {
         .name = "Intel(R) Wireless N 7265",
         .fw_name_pre = IWL7265D_FW_PRE,
-        IWL_DEVICE_7000,
+        IWL_DEVICE_7005D,
         .ht_params = &iwl7265_ht_params,
         .nvm_ver = IWL7265D_NVM_VERSION,
         .nvm_calib_ver = IWL7265_TX_POWER_VERSION,
@@ -342,5 +363,5 @@ const struct iwl_cfg iwl7265d_n_cfg = {
 
 MODULE_FIRMWARE(IWL7260_MODULE_FIRMWARE(IWL7260_UCODE_API_OK));
 MODULE_FIRMWARE(IWL3160_MODULE_FIRMWARE(IWL7260_UCODE_API_OK));
-MODULE_FIRMWARE(IWL7265_MODULE_FIRMWARE(IWL7260_UCODE_API_OK));
-MODULE_FIRMWARE(IWL7265D_MODULE_FIRMWARE(IWL7260_UCODE_API_OK));
+MODULE_FIRMWARE(IWL7265_MODULE_FIRMWARE(IWL7265_UCODE_API_OK));
+MODULE_FIRMWARE(IWL7265D_MODULE_FIRMWARE(IWL7265D_UCODE_API_OK));
diff --git a/drivers/net/wireless/iwlwifi/iwl-8000.c b/drivers/net/wireless/iwlwifi/iwl-8000.c
index 0116e5a4c393..9bcc0bf937d8 100644
--- a/drivers/net/wireless/iwlwifi/iwl-8000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-8000.c
@@ -69,7 +69,7 @@
 #include "iwl-agn-hw.h"
 
 /* Highest firmware API version supported */
-#define IWL8000_UCODE_API_MAX   17
+#define IWL8000_UCODE_API_MAX   19
 
 /* Oldest version we won't warn about */
 #define IWL8000_UCODE_API_OK    13
diff --git a/drivers/net/wireless/iwlwifi/mvm/d3.c b/drivers/net/wireless/iwlwifi/mvm/d3.c
index 85ae902df7c0..29ae58ebf223 100644
--- a/drivers/net/wireless/iwlwifi/mvm/d3.c
+++ b/drivers/net/wireless/iwlwifi/mvm/d3.c
@@ -309,9 +309,9 @@ static void iwl_mvm_wowlan_program_keys(struct ieee80211_hw *hw,
          * to transmit packets to the AP, i.e. the PTK.
          */
         if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE) {
-                key->hw_key_idx = 0;
                 mvm->ptk_ivlen = key->iv_len;
                 mvm->ptk_icvlen = key->icv_len;
+                ret = iwl_mvm_set_sta_key(mvm, vif, sta, key, 0);
         } else {
                 /*
                  * firmware only supports TSC/RSC for a single key,
@@ -319,12 +319,11 @@ static void iwl_mvm_wowlan_program_keys(struct ieee80211_hw *hw,
                  * with new ones -- this relies on mac80211 doing
                  * list_add_tail().
                  */
-                key->hw_key_idx = 1;
                 mvm->gtk_ivlen = key->iv_len;
                 mvm->gtk_icvlen = key->icv_len;
+                ret = iwl_mvm_set_sta_key(mvm, vif, sta, key, 1);
         }
 
-        ret = iwl_mvm_set_sta_key(mvm, vif, sta, key, true);
         data->error = ret != 0;
 out_unlock:
         mutex_unlock(&mvm->mutex);
@@ -772,9 +771,6 @@ static int iwl_mvm_switch_to_d3(struct iwl_mvm *mvm)
          */
         set_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status);
 
-        /* We reprogram keys and shouldn't allocate new key indices */
-        memset(mvm->fw_key_table, 0, sizeof(mvm->fw_key_table));
-
         mvm->ptk_ivlen = 0;
         mvm->ptk_icvlen = 0;
         mvm->ptk_ivlen = 0;
diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
index 1fb684693040..e88afac51c5d 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
@@ -2941,6 +2941,7 @@ static int iwl_mvm_mac_set_key(struct ieee80211_hw *hw,
 {
         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
         int ret;
+        u8 key_offset;
 
         if (iwlwifi_mod_params.sw_crypto) {
                 IWL_DEBUG_MAC80211(mvm, "leave - hwcrypto disabled\n");
@@ -3006,10 +3007,14 @@ static int iwl_mvm_mac_set_key(struct ieee80211_hw *hw,
                         break;
                 }
 
+                /* in HW restart reuse the index, otherwise request a new one */
+                if (test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status))
+                        key_offset = key->hw_key_idx;
+                else
+                        key_offset = STA_KEY_IDX_INVALID;
+
                 IWL_DEBUG_MAC80211(mvm, "set hwcrypto key\n");
-                ret = iwl_mvm_set_sta_key(mvm, vif, sta, key,
-                                          test_bit(IWL_MVM_STATUS_IN_HW_RESTART,
-                                                   &mvm->status));
+                ret = iwl_mvm_set_sta_key(mvm, vif, sta, key, key_offset);
                 if (ret) {
                         IWL_WARN(mvm, "set key failed\n");
                         /*
diff --git a/drivers/net/wireless/iwlwifi/mvm/sta.c b/drivers/net/wireless/iwlwifi/mvm/sta.c
index 300a249486e4..2b976b110207 100644
--- a/drivers/net/wireless/iwlwifi/mvm/sta.c
+++ b/drivers/net/wireless/iwlwifi/mvm/sta.c
@@ -1201,7 +1201,8 @@ static int iwl_mvm_set_fw_key_idx(struct iwl_mvm *mvm)
         return max_offs;
 }
 
-static u8 iwl_mvm_get_key_sta_id(struct ieee80211_vif *vif,
+static u8 iwl_mvm_get_key_sta_id(struct iwl_mvm *mvm,
+                                 struct ieee80211_vif *vif,
                                  struct ieee80211_sta *sta)
 {
         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
@@ -1218,8 +1219,21 @@ static u8 iwl_mvm_get_key_sta_id(struct ieee80211_vif *vif,
          * station ID, then use AP's station ID.
          */
         if (vif->type == NL80211_IFTYPE_STATION &&
-            mvmvif->ap_sta_id != IWL_MVM_STATION_COUNT)
-                return mvmvif->ap_sta_id;
+            mvmvif->ap_sta_id != IWL_MVM_STATION_COUNT) {
+                u8 sta_id = mvmvif->ap_sta_id;
+
+                sta = rcu_dereference_check(mvm->fw_id_to_mac_id[sta_id],
+                                            lockdep_is_held(&mvm->mutex));
+                /*
+                 * It is possible that the 'sta' parameter is NULL,
+                 * for example when a GTK is removed - the sta_id will then
+                 * be the AP ID, and no station was passed by mac80211.
+                 */
+                if (IS_ERR_OR_NULL(sta))
+                        return IWL_MVM_STATION_COUNT;
+
+                return sta_id;
+        }
 
         return IWL_MVM_STATION_COUNT;
 }
@@ -1227,7 +1241,8 @@ static u8 iwl_mvm_get_key_sta_id(struct ieee80211_vif *vif,
 static int iwl_mvm_send_sta_key(struct iwl_mvm *mvm,
                                 struct iwl_mvm_sta *mvm_sta,
                                 struct ieee80211_key_conf *keyconf, bool mcast,
-                                u32 tkip_iv32, u16 *tkip_p1k, u32 cmd_flags)
+                                u32 tkip_iv32, u16 *tkip_p1k, u32 cmd_flags,
+                                u8 key_offset)
 {
         struct iwl_mvm_add_sta_key_cmd cmd = {};
         __le16 key_flags;
@@ -1269,7 +1284,7 @@ static int iwl_mvm_send_sta_key(struct iwl_mvm *mvm,
         if (mcast)
                 key_flags |= cpu_to_le16(STA_KEY_MULTICAST);
 
-        cmd.key_offset = keyconf->hw_key_idx;
+        cmd.key_offset = key_offset;
         cmd.key_flags = key_flags;
         cmd.sta_id = sta_id;
 
@@ -1360,6 +1375,7 @@ static int __iwl_mvm_set_sta_key(struct iwl_mvm *mvm,
                                  struct ieee80211_vif *vif,
                                  struct ieee80211_sta *sta,
                                  struct ieee80211_key_conf *keyconf,
+                                 u8 key_offset,
                                  bool mcast)
 {
         struct iwl_mvm_sta *mvm_sta = iwl_mvm_sta_from_mac80211(sta);
@@ -1375,17 +1391,17 @@ static int __iwl_mvm_set_sta_key(struct iwl_mvm *mvm,
                 ieee80211_get_key_rx_seq(keyconf, 0, &seq);
                 ieee80211_get_tkip_rx_p1k(keyconf, addr, seq.tkip.iv32, p1k);
                 ret = iwl_mvm_send_sta_key(mvm, mvm_sta, keyconf, mcast,
-                                           seq.tkip.iv32, p1k, 0);
+                                           seq.tkip.iv32, p1k, 0, key_offset);
                 break;
         case WLAN_CIPHER_SUITE_CCMP:
         case WLAN_CIPHER_SUITE_WEP40:
         case WLAN_CIPHER_SUITE_WEP104:
                 ret = iwl_mvm_send_sta_key(mvm, mvm_sta, keyconf, mcast,
-                                           0, NULL, 0);
+                                           0, NULL, 0, key_offset);
                 break;
         default:
                 ret = iwl_mvm_send_sta_key(mvm, mvm_sta, keyconf, mcast,
-                                           0, NULL, 0);
+                                           0, NULL, 0, key_offset);
         }
 
         return ret;
@@ -1433,7 +1449,7 @@ int iwl_mvm_set_sta_key(struct iwl_mvm *mvm,
                         struct ieee80211_vif *vif,
                         struct ieee80211_sta *sta,
                         struct ieee80211_key_conf *keyconf,
-                        bool have_key_offset)
+                        u8 key_offset)
 {
         bool mcast = !(keyconf->flags & IEEE80211_KEY_FLAG_PAIRWISE);
         u8 sta_id;
@@ -1443,7 +1459,7 @@ int iwl_mvm_set_sta_key(struct iwl_mvm *mvm,
         lockdep_assert_held(&mvm->mutex);
 
         /* Get the station id from the mvm local station table */
-        sta_id = iwl_mvm_get_key_sta_id(vif, sta);
+        sta_id = iwl_mvm_get_key_sta_id(mvm, vif, sta);
         if (sta_id == IWL_MVM_STATION_COUNT) {
                 IWL_ERR(mvm, "Failed to find station id\n");
                 return -EINVAL;
@@ -1470,18 +1486,25 @@ int iwl_mvm_set_sta_key(struct iwl_mvm *mvm,
         if (WARN_ON_ONCE(iwl_mvm_sta_from_mac80211(sta)->vif != vif))
                 return -EINVAL;
 
-        if (!have_key_offset) {
-                /*
-                 * The D3 firmware hardcodes the PTK offset to 0, so we have to
-                 * configure it there. As a result, this workaround exists to
-                 * let the caller set the key offset (hw_key_idx), see d3.c.
-                 */
-                keyconf->hw_key_idx = iwl_mvm_set_fw_key_idx(mvm);
-                if (keyconf->hw_key_idx == STA_KEY_IDX_INVALID)
+        /* If the key_offset is not pre-assigned, we need to find a
+         * new offset to use.  In normal cases, the offset is not
+         * pre-assigned, but during HW_RESTART we want to reuse the
+         * same indices, so we pass them when this function is called.
+         *
+         * In D3 entry, we need to hardcoded the indices (because the
+         * firmware hardcodes the PTK offset to 0).  In this case, we
+         * need to make sure we don't overwrite the hw_key_idx in the
+         * keyconf structure, because otherwise we cannot configure
+         * the original ones back when resuming.
+         */
+        if (key_offset == STA_KEY_IDX_INVALID) {
+                key_offset  = iwl_mvm_set_fw_key_idx(mvm);
+                if (key_offset == STA_KEY_IDX_INVALID)
                         return -ENOSPC;
+                keyconf->hw_key_idx = key_offset;
         }
 
-        ret = __iwl_mvm_set_sta_key(mvm, vif, sta, keyconf, mcast);
+        ret = __iwl_mvm_set_sta_key(mvm, vif, sta, keyconf, key_offset, mcast);
         if (ret) {
                 __clear_bit(keyconf->hw_key_idx, mvm->fw_key_table);
                 goto end;
@@ -1495,7 +1518,8 @@ int iwl_mvm_set_sta_key(struct iwl_mvm *mvm,
          */
         if (keyconf->cipher == WLAN_CIPHER_SUITE_WEP40 ||
             keyconf->cipher == WLAN_CIPHER_SUITE_WEP104) {
-                ret = __iwl_mvm_set_sta_key(mvm, vif, sta, keyconf, !mcast);
+                ret = __iwl_mvm_set_sta_key(mvm, vif, sta, keyconf,
+                                            key_offset, !mcast);
                 if (ret) {
                         __clear_bit(keyconf->hw_key_idx, mvm->fw_key_table);
                         __iwl_mvm_remove_sta_key(mvm, sta_id, keyconf, mcast);
@@ -1521,7 +1545,7 @@ int iwl_mvm_remove_sta_key(struct iwl_mvm *mvm,
         lockdep_assert_held(&mvm->mutex);
 
         /* Get the station id from the mvm local station table */
-        sta_id = iwl_mvm_get_key_sta_id(vif, sta);
+        sta_id = iwl_mvm_get_key_sta_id(mvm, vif, sta);
 
         IWL_DEBUG_WEP(mvm, "mvm remove dynamic key: idx=%d sta=%d\n",
                       keyconf->keyidx, sta_id);
@@ -1547,24 +1571,6 @@ int iwl_mvm_remove_sta_key(struct iwl_mvm *mvm,
                 return 0;
         }
 
-        /*
-         * It is possible that the 'sta' parameter is NULL, and thus
-         * there is a need to retrieve the sta from the local station table,
-         * for example when a GTK is removed (where the sta_id will then be
-         * the AP ID, and no station was passed by mac80211.)
-         */
-        if (!sta) {
-                sta = rcu_dereference_protected(mvm->fw_id_to_mac_id[sta_id],
-                                                lockdep_is_held(&mvm->mutex));
-                if (!sta) {
-                        IWL_ERR(mvm, "Invalid station id\n");
-                        return -EINVAL;
-                }
-        }
-
-        if (WARN_ON_ONCE(iwl_mvm_sta_from_mac80211(sta)->vif != vif))
-                return -EINVAL;
-
         ret = __iwl_mvm_remove_sta_key(mvm, sta_id, keyconf, mcast);
         if (ret)
                 return ret;
@@ -1584,14 +1590,15 @@ void iwl_mvm_update_tkip_key(struct iwl_mvm *mvm,
                              u16 *phase1key)
 {
         struct iwl_mvm_sta *mvm_sta;
-        u8 sta_id = iwl_mvm_get_key_sta_id(vif, sta);
+        u8 sta_id;
         bool mcast = !(keyconf->flags & IEEE80211_KEY_FLAG_PAIRWISE);
 
-        if (WARN_ON_ONCE(sta_id == IWL_MVM_STATION_COUNT))
-                return;
-
         rcu_read_lock();
 
+        sta_id = iwl_mvm_get_key_sta_id(mvm, vif, sta);
+        if (WARN_ON_ONCE(sta_id == IWL_MVM_STATION_COUNT))
+                goto unlock;
+
         if (!sta) {
                 sta = rcu_dereference(mvm->fw_id_to_mac_id[sta_id]);
                 if (WARN_ON(IS_ERR_OR_NULL(sta))) {
@@ -1602,7 +1609,9 @@ void iwl_mvm_update_tkip_key(struct iwl_mvm *mvm,
 
         mvm_sta = iwl_mvm_sta_from_mac80211(sta);
         iwl_mvm_send_sta_key(mvm, mvm_sta, keyconf, mcast,
-                             iv32, phase1key, CMD_ASYNC);
+                             iv32, phase1key, CMD_ASYNC, keyconf->hw_key_idx);
+
+ unlock:
         rcu_read_unlock();
 }
 
diff --git a/drivers/net/wireless/iwlwifi/mvm/sta.h b/drivers/net/wireless/iwlwifi/mvm/sta.h
index eedb215eba3f..0631cc0a6d3c 100644
--- a/drivers/net/wireless/iwlwifi/mvm/sta.h
+++ b/drivers/net/wireless/iwlwifi/mvm/sta.h
@@ -365,8 +365,8 @@ int iwl_mvm_rm_sta_id(struct iwl_mvm *mvm,
 int iwl_mvm_set_sta_key(struct iwl_mvm *mvm,
                         struct ieee80211_vif *vif,
                         struct ieee80211_sta *sta,
-                        struct ieee80211_key_conf *key,
-                        bool have_key_offset);
+                        struct ieee80211_key_conf *keyconf,
+                        u8 key_offset);
 int iwl_mvm_remove_sta_key(struct iwl_mvm *mvm,
                            struct ieee80211_vif *vif,
                            struct ieee80211_sta *sta,
diff --git a/drivers/net/wireless/iwlwifi/pcie/drv.c b/drivers/net/wireless/iwlwifi/pcie/drv.c
index 644b58bc5226..639761fb2bfb 100644
--- a/drivers/net/wireless/iwlwifi/pcie/drv.c
+++ b/drivers/net/wireless/iwlwifi/pcie/drv.c
@@ -423,14 +423,21 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
 /* 8000 Series */
         {IWL_PCI_DEVICE(0x24F3, 0x0010, iwl8260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x24F3, 0x1010, iwl8260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x24F3, 0x0130, iwl8260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x24F3, 0x1130, iwl8260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x24F3, 0x0132, iwl8260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x24F3, 0x1132, iwl8260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x24F3, 0x0110, iwl8260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x24F3, 0x01F0, iwl8260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x24F3, 0x0012, iwl8260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x24F3, 0x1012, iwl8260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x24F3, 0x1110, iwl8260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x24F3, 0x0050, iwl8260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x24F3, 0x0250, iwl8260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x24F3, 0x1050, iwl8260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x24F3, 0x0150, iwl8260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x24F3, 0x1150, iwl8260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x24F4, 0x0030, iwl8260_2ac_cfg)},
-        {IWL_PCI_DEVICE(0x24F4, 0x1130, iwl8260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x24F4, 0x1030, iwl8260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x24F3, 0xC010, iwl8260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x24F3, 0xC110, iwl8260_2ac_cfg)},
@@ -438,18 +445,28 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
         {IWL_PCI_DEVICE(0x24F3, 0xC050, iwl8260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x24F3, 0xD050, iwl8260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x24F3, 0x8010, iwl8260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x24F3, 0x8110, iwl8260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x24F3, 0x9010, iwl8260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x24F3, 0x9110, iwl8260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x24F4, 0x8030, iwl8260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x24F4, 0x9030, iwl8260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x24F3, 0x8130, iwl8260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x24F3, 0x9130, iwl8260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x24F3, 0x8132, iwl8260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x24F3, 0x9132, iwl8260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x24F3, 0x8050, iwl8260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x24F3, 0x8150, iwl8260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x24F3, 0x9050, iwl8260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x24F3, 0x9150, iwl8260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x24F3, 0x0004, iwl8260_2n_cfg)},
+        {IWL_PCI_DEVICE(0x24F3, 0x0044, iwl8260_2n_cfg)},
         {IWL_PCI_DEVICE(0x24F5, 0x0010, iwl4165_2ac_cfg)},
         {IWL_PCI_DEVICE(0x24F6, 0x0030, iwl4165_2ac_cfg)},
         {IWL_PCI_DEVICE(0x24F3, 0x0810, iwl8260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x24F3, 0x0910, iwl8260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x24F3, 0x0850, iwl8260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x24F3, 0x0950, iwl8260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x24F3, 0x0930, iwl8260_2ac_cfg)},
 #endif /* CONFIG_IWLMVM */
 
         {0}
diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c
index 6e9418ed90c2..bbb789f8990b 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c
@@ -2272,7 +2272,7 @@ void rtl8821ae_enable_interrupt(struct ieee80211_hw *hw)
         struct rtl_priv *rtlpriv = rtl_priv(hw);
         struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
 
-        if (!rtlpci->int_clear)
+        if (rtlpci->int_clear)
                 rtl8821ae_clear_interrupt(hw);/*clear it here first*/
 
         rtl_write_dword(rtlpriv, REG_HIMR, rtlpci->irq_mask[0] & 0xFFFFFFFF);
diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/sw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/sw.c
index 8ee141a55bc5..142bdff4ed60 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/sw.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/sw.c
@@ -448,7 +448,7 @@ MODULE_PARM_DESC(fwlps, "Set to 1 to use FW control power save (default 1)\n");
 MODULE_PARM_DESC(msi, "Set to 1 to use MSI interrupts mode (default 1)\n");
 MODULE_PARM_DESC(debug, "Set debug level (0-5) (default 0)");
 MODULE_PARM_DESC(disable_watchdog, "Set to 1 to disable the watchdog (default 0)\n");
-MODULE_PARM_DESC(int_clear, "Set to 1 to disable interrupt clear before set (default 0)\n");
+MODULE_PARM_DESC(int_clear, "Set to 0 to disable interrupt clear before set (default 1)\n");
 
 static SIMPLE_DEV_PM_OPS(rtlwifi_pm_ops, rtl_pci_suspend, rtl_pci_resume);
 
diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index e481f3710bd3..1049c34e7d43 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -258,18 +258,18 @@ static struct xenvif_rx_meta *get_next_rx_buffer(struct xenvif_queue *queue,
                                                  struct netrx_pending_operations *npo)
 {
         struct xenvif_rx_meta *meta;
-        struct xen_netif_rx_request *req;
+        struct xen_netif_rx_request req;
 
-        req = RING_GET_REQUEST(&queue->rx, queue->rx.req_cons++);
+        RING_COPY_REQUEST(&queue->rx, queue->rx.req_cons++, &req);
 
         meta = npo->meta + npo->meta_prod++;
         meta->gso_type = XEN_NETIF_GSO_TYPE_NONE;
         meta->gso_size = 0;
         meta->size = 0;
-        meta->id = req->id;
+        meta->id = req.id;
 
         npo->copy_off = 0;
-        npo->copy_gref = req->gref;
+        npo->copy_gref = req.gref;
 
         return meta;
 }
@@ -424,7 +424,7 @@ static int xenvif_gop_skb(struct sk_buff *skb,
         struct xenvif *vif = netdev_priv(skb->dev);
         int nr_frags = skb_shinfo(skb)->nr_frags;
         int i;
-        struct xen_netif_rx_request *req;
+        struct xen_netif_rx_request req;
         struct xenvif_rx_meta *meta;
         unsigned char *data;
         int head = 1;
@@ -443,15 +443,15 @@ static int xenvif_gop_skb(struct sk_buff *skb,
 
         /* Set up a GSO prefix descriptor, if necessary */
         if ((1 << gso_type) & vif->gso_prefix_mask) {
-                req = RING_GET_REQUEST(&queue->rx, queue->rx.req_cons++);
+                RING_COPY_REQUEST(&queue->rx, queue->rx.req_cons++, &req);
                 meta = npo->meta + npo->meta_prod++;
                 meta->gso_type = gso_type;
                 meta->gso_size = skb_shinfo(skb)->gso_size;
                 meta->size = 0;
-                meta->id = req->id;
+                meta->id = req.id;
         }
 
-        req = RING_GET_REQUEST(&queue->rx, queue->rx.req_cons++);
+        RING_COPY_REQUEST(&queue->rx, queue->rx.req_cons++, &req);
         meta = npo->meta + npo->meta_prod++;
 
         if ((1 << gso_type) & vif->gso_mask) {
@@ -463,9 +463,9 @@ static int xenvif_gop_skb(struct sk_buff *skb,
         }
 
         meta->size = 0;
-        meta->id = req->id;
+        meta->id = req.id;
         npo->copy_off = 0;
-        npo->copy_gref = req->gref;
+        npo->copy_gref = req.gref;
 
         data = skb->data;
         while (data < skb_tail_pointer(skb)) {
@@ -679,9 +679,7 @@ static void tx_add_credit(struct xenvif_queue *queue)
          * Allow a burst big enough to transmit a jumbo packet of up to 128kB.
          * Otherwise the interface can seize up due to insufficient credit.
          */
-        max_burst = RING_GET_REQUEST(&queue->tx, queue->tx.req_cons)->size;
-        max_burst = min(max_burst, 131072UL);
-        max_burst = max(max_burst, queue->credit_bytes);
+        max_burst = max(131072UL, queue->credit_bytes);
 
         /* Take care that adding a new chunk of credit doesn't wrap to zero. */
         max_credit = queue->remaining_credit + queue->credit_bytes;
@@ -711,7 +709,7 @@ static void xenvif_tx_err(struct xenvif_queue *queue,
                 spin_unlock_irqrestore(&queue->response_lock, flags);
                 if (cons == end)
                         break;
-                txp = RING_GET_REQUEST(&queue->tx, cons++);
+                RING_COPY_REQUEST(&queue->tx, cons++, txp);
         } while (1);
         queue->tx.req_cons = cons;
 }
@@ -778,8 +776,7 @@ static int xenvif_count_requests(struct xenvif_queue *queue,
                 if (drop_err)
                         txp = &dropped_tx;
 
-                memcpy(txp, RING_GET_REQUEST(&queue->tx, cons + slots),
-                       sizeof(*txp));
+                RING_COPY_REQUEST(&queue->tx, cons + slots, txp);
 
                 /* If the guest submitted a frame >= 64 KiB then
                  * first->size overflowed and following slots will
@@ -1112,8 +1109,7 @@ static int xenvif_get_extras(struct xenvif_queue *queue,
                         return -EBADR;
                 }
 
-                memcpy(&extra, RING_GET_REQUEST(&queue->tx, cons),
-                       sizeof(extra));
+                RING_COPY_REQUEST(&queue->tx, cons, &extra);
                 if (unlikely(!extra.type ||
                              extra.type >= XEN_NETIF_EXTRA_TYPE_MAX)) {
                         queue->tx.req_cons = ++cons;
@@ -1322,7 +1318,7 @@ static void xenvif_tx_build_gops(struct xenvif_queue *queue,
 
                 idx = queue->tx.req_cons;
                 rmb(); /* Ensure that we see the request before we copy it. */
-                memcpy(&txreq, RING_GET_REQUEST(&queue->tx, idx), sizeof(txreq));
+                RING_COPY_REQUEST(&queue->tx, idx, &txreq);
 
                 /* Credit-based scheduling. */
                 if (txreq.size > queue->remaining_credit &&
diff --git a/drivers/nvme/host/Makefile b/drivers/nvme/host/Makefile
index 219dc206fa5f..a5fe23952586 100644
--- a/drivers/nvme/host/Makefile
+++ b/drivers/nvme/host/Makefile
@@ -1,4 +1,5 @@
 
 obj-$(CONFIG_BLK_DEV_NVME)     += nvme.o
 
-nvme-y          += pci.o scsi.o lightnvm.o
+lightnvm-$(CONFIG_NVM)  := lightnvm.o
+nvme-y          += pci.o scsi.o $(lightnvm-y)
diff --git a/drivers/nvme/host/lightnvm.c b/drivers/nvme/host/lightnvm.c
index e0b7b95813bc..15f2acb4d5cd 100644
--- a/drivers/nvme/host/lightnvm.c
+++ b/drivers/nvme/host/lightnvm.c
@@ -22,8 +22,6 @@
 
 #include "nvme.h"
 
-#ifdef CONFIG_NVM
-
 #include <linux/nvme.h>
 #include <linux/bitops.h>
 #include <linux/lightnvm.h>
@@ -93,7 +91,7 @@ struct nvme_nvm_l2ptbl {
         __le16                  cdw14[6];
 };
 
-struct nvme_nvm_bbtbl {
+struct nvme_nvm_getbbtbl {
         __u8                    opcode;
         __u8                    flags;
         __u16                   command_id;
@@ -101,10 +99,23 @@ struct nvme_nvm_bbtbl {
         __u64                   rsvd[2];
         __le64                  prp1;
         __le64                  prp2;
-        __le32                  prp1_len;
-        __le32                  prp2_len;
-        __le32                  lbb;
-        __u32                   rsvd11[3];
+        __le64                  spba;
+        __u32                   rsvd4[4];
+};
+
+struct nvme_nvm_setbbtbl {
+        __u8                    opcode;
+        __u8                    flags;
+        __u16                   command_id;
+        __le32                  nsid;
+        __le64                  rsvd[2];
+        __le64                  prp1;
+        __le64                  prp2;
+        __le64                  spba;
+        __le16                  nlb;
+        __u8                    value;
+        __u8                    rsvd3;
+        __u32                   rsvd4[3];
 };
 
 struct nvme_nvm_erase_blk {
@@ -129,8 +140,8 @@ struct nvme_nvm_command {
                 struct nvme_nvm_hb_rw hb_rw;
                 struct nvme_nvm_ph_rw ph_rw;
                 struct nvme_nvm_l2ptbl l2p;
-                struct nvme_nvm_bbtbl get_bb;
-                struct nvme_nvm_bbtbl set_bb;
+                struct nvme_nvm_getbbtbl get_bb;
+                struct nvme_nvm_setbbtbl set_bb;
                 struct nvme_nvm_erase_blk erase;
         };
 };
@@ -142,11 +153,13 @@ struct nvme_nvm_id_group {
         __u8                    num_ch;
         __u8                    num_lun;
         __u8                    num_pln;
+        __u8                    rsvd1;
         __le16                  num_blk;
         __le16                  num_pg;
         __le16                  fpg_sz;
         __le16                  csecs;
         __le16                  sos;
+        __le16                  rsvd2;
         __le32                  trdt;
         __le32                  trdm;
         __le32                  tprt;
@@ -154,8 +167,9 @@ struct nvme_nvm_id_group {
         __le32                  tbet;
         __le32                  tbem;
         __le32                  mpos;
+        __le32                  mccap;
         __le16                  cpar;
-        __u8                    reserved[913];
+        __u8                    reserved[906];
 } __packed;
 
 struct nvme_nvm_addr_format {
@@ -178,15 +192,28 @@ struct nvme_nvm_id {
         __u8                    ver_id;
         __u8                    vmnt;
         __u8                    cgrps;
-        __u8                    res[5];
+        __u8                    res;
         __le32                  cap;
         __le32                  dom;
         struct nvme_nvm_addr_format ppaf;
-        __u8                    ppat;
-        __u8                    resv[223];
+        __u8                    resv[228];
         struct nvme_nvm_id_group groups[4];
 } __packed;
 
+struct nvme_nvm_bb_tbl {
+        __u8    tblid[4];
+        __le16  verid;
+        __le16  revid;
+        __le32  rvsd1;
+        __le32  tblks;
+        __le32  tfact;
+        __le32  tgrown;
+        __le32  tdresv;
+        __le32  thresv;
+        __le32  rsvd2[8];
+        __u8    blk[0];
+};
+
 /*
  * Check we didn't inadvertently grow the command struct
  */
@@ -195,12 +222,14 @@ static inline void _nvme_nvm_check_size(void)
         BUILD_BUG_ON(sizeof(struct nvme_nvm_identity) != 64);
         BUILD_BUG_ON(sizeof(struct nvme_nvm_hb_rw) != 64);
         BUILD_BUG_ON(sizeof(struct nvme_nvm_ph_rw) != 64);
-        BUILD_BUG_ON(sizeof(struct nvme_nvm_bbtbl) != 64);
+        BUILD_BUG_ON(sizeof(struct nvme_nvm_getbbtbl) != 64);
+        BUILD_BUG_ON(sizeof(struct nvme_nvm_setbbtbl) != 64);
         BUILD_BUG_ON(sizeof(struct nvme_nvm_l2ptbl) != 64);
         BUILD_BUG_ON(sizeof(struct nvme_nvm_erase_blk) != 64);
         BUILD_BUG_ON(sizeof(struct nvme_nvm_id_group) != 960);
         BUILD_BUG_ON(sizeof(struct nvme_nvm_addr_format) != 128);
         BUILD_BUG_ON(sizeof(struct nvme_nvm_id) != 4096);
+        BUILD_BUG_ON(sizeof(struct nvme_nvm_bb_tbl) != 512);
 }
 
 static int init_grps(struct nvm_id *nvm_id, struct nvme_nvm_id *nvme_nvm_id)
@@ -234,6 +263,7 @@ static int init_grps(struct nvm_id *nvm_id, struct nvme_nvm_id *nvme_nvm_id)
                 dst->tbet = le32_to_cpu(src->tbet);
                 dst->tbem = le32_to_cpu(src->tbem);
                 dst->mpos = le32_to_cpu(src->mpos);
+                dst->mccap = le32_to_cpu(src->mccap);
 
                 dst->cpar = le16_to_cpu(src->cpar);
         }
@@ -241,9 +271,10 @@ static int init_grps(struct nvm_id *nvm_id, struct nvme_nvm_id *nvme_nvm_id)
         return 0;
 }
 
-static int nvme_nvm_identity(struct request_queue *q, struct nvm_id *nvm_id)
+static int nvme_nvm_identity(struct nvm_dev *nvmdev, struct nvm_id *nvm_id)
 {
-        struct nvme_ns *ns = q->queuedata;
+        struct nvme_ns *ns = nvmdev->q->queuedata;
+        struct nvme_dev *dev = ns->dev;
         struct nvme_nvm_id *nvme_nvm_id;
         struct nvme_nvm_command c = {};
         int ret;
@@ -256,8 +287,8 @@ static int nvme_nvm_identity(struct request_queue *q, struct nvm_id *nvm_id)
         if (!nvme_nvm_id)
                 return -ENOMEM;
 
-        ret = nvme_submit_sync_cmd(q, (struct nvme_command *)&c, nvme_nvm_id,
-                                                sizeof(struct nvme_nvm_id));
+        ret = nvme_submit_sync_cmd(dev->admin_q, (struct nvme_command *)&c,
+                                nvme_nvm_id, sizeof(struct nvme_nvm_id));
         if (ret) {
                 ret = -EIO;
                 goto out;
@@ -268,6 +299,8 @@ static int nvme_nvm_identity(struct request_queue *q, struct nvm_id *nvm_id)
         nvm_id->cgrps = nvme_nvm_id->cgrps;
         nvm_id->cap = le32_to_cpu(nvme_nvm_id->cap);
         nvm_id->dom = le32_to_cpu(nvme_nvm_id->dom);
+        memcpy(&nvm_id->ppaf, &nvme_nvm_id->ppaf,
+                                        sizeof(struct nvme_nvm_addr_format));
 
         ret = init_grps(nvm_id, nvme_nvm_id);
 out:
@@ -275,13 +308,13 @@ out:
         return ret;
 }
 
-static int nvme_nvm_get_l2p_tbl(struct request_queue *q, u64 slba, u32 nlb,
+static int nvme_nvm_get_l2p_tbl(struct nvm_dev *nvmdev, u64 slba, u32 nlb,
                                 nvm_l2p_update_fn *update_l2p, void *priv)
 {
-        struct nvme_ns *ns = q->queuedata;
+        struct nvme_ns *ns = nvmdev->q->queuedata;
         struct nvme_dev *dev = ns->dev;
         struct nvme_nvm_command c = {};
-        u32 len = queue_max_hw_sectors(q) << 9;
+        u32 len = queue_max_hw_sectors(dev->admin_q) << 9;
         u32 nlb_pr_rq = len / sizeof(u64);
         u64 cmd_slba = slba;
         void *entries;
@@ -299,8 +332,8 @@ static int nvme_nvm_get_l2p_tbl(struct request_queue *q, u64 slba, u32 nlb,
                 c.l2p.slba = cpu_to_le64(cmd_slba);
                 c.l2p.nlb = cpu_to_le32(cmd_nlb);
 
-                ret = nvme_submit_sync_cmd(q, (struct nvme_command *)&c,
-                                                                entries, len);
+                ret = nvme_submit_sync_cmd(dev->admin_q,
+                                (struct nvme_command *)&c, entries, len);
                 if (ret) {
                         dev_err(dev->dev, "L2P table transfer failed (%d)\n",
                                                                         ret);
@@ -322,43 +355,84 @@ out:
         return ret;
 }
 
-static int nvme_nvm_get_bb_tbl(struct request_queue *q, int lunid,
-                                unsigned int nr_blocks,
-                                nvm_bb_update_fn *update_bbtbl, void *priv)
+static int nvme_nvm_get_bb_tbl(struct nvm_dev *nvmdev, struct ppa_addr ppa,
+                                int nr_blocks, nvm_bb_update_fn *update_bbtbl,
+                                void *priv)
 {
+        struct request_queue *q = nvmdev->q;
         struct nvme_ns *ns = q->queuedata;
         struct nvme_dev *dev = ns->dev;
         struct nvme_nvm_command c = {};
-        void *bb_bitmap;
-        u16 bb_bitmap_size;
+        struct nvme_nvm_bb_tbl *bb_tbl;
+        int tblsz = sizeof(struct nvme_nvm_bb_tbl) + nr_blocks;
         int ret = 0;
 
         c.get_bb.opcode = nvme_nvm_admin_get_bb_tbl;
         c.get_bb.nsid = cpu_to_le32(ns->ns_id);
-        c.get_bb.lbb = cpu_to_le32(lunid);
-        bb_bitmap_size = ((nr_blocks >> 15) + 1) * PAGE_SIZE;
-        bb_bitmap = kmalloc(bb_bitmap_size, GFP_KERNEL);
-        if (!bb_bitmap)
-                return -ENOMEM;
+        c.get_bb.spba = cpu_to_le64(ppa.ppa);
 
-        bitmap_zero(bb_bitmap, nr_blocks);
+        bb_tbl = kzalloc(tblsz, GFP_KERNEL);
+        if (!bb_tbl)
+                return -ENOMEM;
 
-        ret = nvme_submit_sync_cmd(q, (struct nvme_command *)&c, bb_bitmap,
-                                                                bb_bitmap_size);
+        ret = nvme_submit_sync_cmd(dev->admin_q, (struct nvme_command *)&c,
+                                                                bb_tbl, tblsz);
         if (ret) {
                 dev_err(dev->dev, "get bad block table failed (%d)\n", ret);
                 ret = -EIO;
                 goto out;
         }
 
-        ret = update_bbtbl(lunid, bb_bitmap, nr_blocks, priv);
+        if (bb_tbl->tblid[0] != 'B' || bb_tbl->tblid[1] != 'B' ||
+                bb_tbl->tblid[2] != 'L' || bb_tbl->tblid[3] != 'T') {
+                dev_err(dev->dev, "bbt format mismatch\n");
+                ret = -EINVAL;
+                goto out;
+        }
+
+        if (le16_to_cpu(bb_tbl->verid) != 1) {
+                ret = -EINVAL;
+                dev_err(dev->dev, "bbt version not supported\n");
+                goto out;
+        }
+
+        if (le32_to_cpu(bb_tbl->tblks) != nr_blocks) {
+                ret = -EINVAL;
+                dev_err(dev->dev, "bbt unsuspected blocks returned (%u!=%u)",
+                                        le32_to_cpu(bb_tbl->tblks), nr_blocks);
+                goto out;
+        }
+
+        ppa = dev_to_generic_addr(nvmdev, ppa);
+        ret = update_bbtbl(ppa, nr_blocks, bb_tbl->blk, priv);
         if (ret) {
                 ret = -EINTR;
                 goto out;
         }
 
 out:
-        kfree(bb_bitmap);
+        kfree(bb_tbl);
+        return ret;
+}
+
+static int nvme_nvm_set_bb_tbl(struct nvm_dev *nvmdev, struct nvm_rq *rqd,
+                                                                int type)
+{
+        struct nvme_ns *ns = nvmdev->q->queuedata;
+        struct nvme_dev *dev = ns->dev;
+        struct nvme_nvm_command c = {};
+        int ret = 0;
+
+        c.set_bb.opcode = nvme_nvm_admin_set_bb_tbl;
+        c.set_bb.nsid = cpu_to_le32(ns->ns_id);
+        c.set_bb.spba = cpu_to_le64(rqd->ppa_addr.ppa);
+        c.set_bb.nlb = cpu_to_le16(rqd->nr_pages - 1);
+        c.set_bb.value = type;
+
+        ret = nvme_submit_sync_cmd(dev->admin_q, (struct nvme_command *)&c,
+                                                                NULL, 0);
+        if (ret)
+                dev_err(dev->dev, "set bad block table failed (%d)\n", ret);
         return ret;
 }
 
@@ -381,7 +455,7 @@ static void nvme_nvm_end_io(struct request *rq, int error)
         struct nvm_rq *rqd = rq->end_io_data;
         struct nvm_dev *dev = rqd->dev;
 
-        if (dev->mt->end_io(rqd, error))
+        if (dev->mt && dev->mt->end_io(rqd, error))
                 pr_err("nvme: err status: %x result: %lx\n",
                                 rq->errors, (unsigned long)rq->special);
 
@@ -389,8 +463,9 @@ static void nvme_nvm_end_io(struct request *rq, int error)
         blk_mq_free_request(rq);
 }
 
-static int nvme_nvm_submit_io(struct request_queue *q, struct nvm_rq *rqd)
+static int nvme_nvm_submit_io(struct nvm_dev *dev, struct nvm_rq *rqd)
 {
+        struct request_queue *q = dev->q;
         struct nvme_ns *ns = q->queuedata;
         struct request *rq;
         struct bio *bio = rqd->bio;
@@ -428,8 +503,9 @@ static int nvme_nvm_submit_io(struct request_queue *q, struct nvm_rq *rqd)
         return 0;
 }
 
-static int nvme_nvm_erase_block(struct request_queue *q, struct nvm_rq *rqd)
+static int nvme_nvm_erase_block(struct nvm_dev *dev, struct nvm_rq *rqd)
 {
+        struct request_queue *q = dev->q;
         struct nvme_ns *ns = q->queuedata;
         struct nvme_nvm_command c = {};
 
@@ -441,9 +517,9 @@ static int nvme_nvm_erase_block(struct request_queue *q, struct nvm_rq *rqd)
         return nvme_submit_sync_cmd(q, (struct nvme_command *)&c, NULL, 0);
 }
 
-static void *nvme_nvm_create_dma_pool(struct request_queue *q, char *name)
+static void *nvme_nvm_create_dma_pool(struct nvm_dev *nvmdev, char *name)
 {
-        struct nvme_ns *ns = q->queuedata;
+        struct nvme_ns *ns = nvmdev->q->queuedata;
         struct nvme_dev *dev = ns->dev;
 
         return dma_pool_create(name, dev->dev, PAGE_SIZE, PAGE_SIZE, 0);
@@ -456,7 +532,7 @@ static void nvme_nvm_destroy_dma_pool(void *pool)
         dma_pool_destroy(dma_pool);
 }
 
-static void *nvme_nvm_dev_dma_alloc(struct request_queue *q, void *pool,
+static void *nvme_nvm_dev_dma_alloc(struct nvm_dev *dev, void *pool,
                                     gfp_t mem_flags, dma_addr_t *dma_handler)
 {
         return dma_pool_alloc(pool, mem_flags, dma_handler);
@@ -474,6 +550,7 @@ static struct nvm_dev_ops nvme_nvm_dev_ops = {
         .get_l2p_tbl            = nvme_nvm_get_l2p_tbl,
 
         .get_bb_tbl             = nvme_nvm_get_bb_tbl,
+        .set_bb_tbl             = nvme_nvm_set_bb_tbl,
 
         .submit_io              = nvme_nvm_submit_io,
         .erase_block            = nvme_nvm_erase_block,
@@ -496,31 +573,27 @@ void nvme_nvm_unregister(struct request_queue *q, char *disk_name)
         nvm_unregister(disk_name);
 }
 
+/* move to shared place when used in multiple places. */
+#define PCI_VENDOR_ID_CNEX 0x1d1d
+#define PCI_DEVICE_ID_CNEX_WL 0x2807
+#define PCI_DEVICE_ID_CNEX_QEMU 0x1f1f
+
 int nvme_nvm_ns_supported(struct nvme_ns *ns, struct nvme_id_ns *id)
 {
         struct nvme_dev *dev = ns->dev;
         struct pci_dev *pdev = to_pci_dev(dev->dev);
 
         /* QEMU NVMe simulator - PCI ID + Vendor specific bit */
-        if (pdev->vendor == PCI_VENDOR_ID_INTEL && pdev->device == 0x5845 &&
+        if (pdev->vendor == PCI_VENDOR_ID_CNEX &&
+                                pdev->device == PCI_DEVICE_ID_CNEX_QEMU &&
                                                         id->vs[0] == 0x1)
                 return 1;
 
         /* CNEX Labs - PCI ID + Vendor specific bit */
-        if (pdev->vendor == 0x1d1d && pdev->device == 0x2807 &&
+        if (pdev->vendor == PCI_VENDOR_ID_CNEX &&
+                                pdev->device == PCI_DEVICE_ID_CNEX_WL &&
                                                         id->vs[0] == 0x1)
                 return 1;
 
         return 0;
 }
-#else
-int nvme_nvm_register(struct request_queue *q, char *disk_name)
-{
-        return 0;
-}
-void nvme_nvm_unregister(struct request_queue *q, char *disk_name) {};
-int nvme_nvm_ns_supported(struct nvme_ns *ns, struct nvme_id_ns *id)
-{
-        return 0;
-}
-#endif /* CONFIG_NVM */
diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h
index fdb4e5bad9ac..044253dca30a 100644
--- a/drivers/nvme/host/nvme.h
+++ b/drivers/nvme/host/nvme.h
@@ -136,8 +136,22 @@ int nvme_sg_io(struct nvme_ns *ns, struct sg_io_hdr __user *u_hdr);
 int nvme_sg_io32(struct nvme_ns *ns, unsigned long arg);
 int nvme_sg_get_version_num(int __user *ip);
 
+#ifdef CONFIG_NVM
 int nvme_nvm_ns_supported(struct nvme_ns *ns, struct nvme_id_ns *id);
 int nvme_nvm_register(struct request_queue *q, char *disk_name);
 void nvme_nvm_unregister(struct request_queue *q, char *disk_name);
+#else
+static inline int nvme_nvm_register(struct request_queue *q, char *disk_name)
+{
+        return 0;
+}
+
+static inline void nvme_nvm_unregister(struct request_queue *q, char *disk_name) {};
+
+static inline int nvme_nvm_ns_supported(struct nvme_ns *ns, struct nvme_id_ns *id)
+{
+        return 0;
+}
+#endif /* CONFIG_NVM */
 
 #endif /* _NVME_H */
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index 8187df204695..0c67b57be83c 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -896,19 +896,28 @@ static int nvme_queue_rq(struct blk_mq_hw_ctx *hctx,
                         goto retry_cmd;
                 }
                 if (blk_integrity_rq(req)) {
-                        if (blk_rq_count_integrity_sg(req->q, req->bio) != 1)
+                        if (blk_rq_count_integrity_sg(req->q, req->bio) != 1) {
+                                dma_unmap_sg(dev->dev, iod->sg, iod->nents,
+                                                dma_dir);
                                 goto error_cmd;
+                        }
 
                         sg_init_table(iod->meta_sg, 1);
                         if (blk_rq_map_integrity_sg(
-                                        req->q, req->bio, iod->meta_sg) != 1)
+                                        req->q, req->bio, iod->meta_sg) != 1) {
+                                dma_unmap_sg(dev->dev, iod->sg, iod->nents,
+                                                dma_dir);
                                 goto error_cmd;
+                        }
 
                         if (rq_data_dir(req))
                                 nvme_dif_remap(req, nvme_dif_prep);
 
-                        if (!dma_map_sg(nvmeq->q_dmadev, iod->meta_sg, 1, dma_dir))
+                        if (!dma_map_sg(nvmeq->q_dmadev, iod->meta_sg, 1, dma_dir)) {
+                                dma_unmap_sg(dev->dev, iod->sg, iod->nents,
+                                                dma_dir);
                                 goto error_cmd;
+                        }
                 }
         }
 
@@ -968,7 +977,8 @@ static void __nvme_process_cq(struct nvme_queue *nvmeq, unsigned int *tag)
         if (head == nvmeq->cq_head && phase == nvmeq->cq_phase)
                 return;
 
-        writel(head, nvmeq->q_db + nvmeq->dev->db_stride);
+        if (likely(nvmeq->cq_vector >= 0))
+                writel(head, nvmeq->q_db + nvmeq->dev->db_stride);
         nvmeq->cq_head = head;
         nvmeq->cq_phase = phase;
 
@@ -1727,9 +1737,13 @@ static int nvme_configure_admin_queue(struct nvme_dev *dev)
         u32 aqa;
         u64 cap = lo_hi_readq(&dev->bar->cap);
         struct nvme_queue *nvmeq;
-        unsigned page_shift = PAGE_SHIFT;
+        /*
+         * default to a 4K page size, with the intention to update this
+         * path in the future to accomodate architectures with differing
+         * kernel and IO page sizes.
+         */
+        unsigned page_shift = 12;
         unsigned dev_page_min = NVME_CAP_MPSMIN(cap) + 12;
-        unsigned dev_page_max = NVME_CAP_MPSMAX(cap) + 12;
 
         if (page_shift < dev_page_min) {
                 dev_err(dev->dev,
@@ -1738,13 +1752,6 @@ static int nvme_configure_admin_queue(struct nvme_dev *dev)
                                 1 << page_shift);
                 return -ENODEV;
         }
-        if (page_shift > dev_page_max) {
-                dev_info(dev->dev,
-                                "Device maximum page size (%u) smaller than "
-                                "host (%u); enabling work-around\n",
-                                1 << dev_page_max, 1 << page_shift);
-                page_shift = dev_page_max;
-        }
 
         dev->subsystem = readl(&dev->bar->vs) >= NVME_VS(1, 1) ?
                                                 NVME_CAP_NSSRC(cap) : 0;
@@ -2268,7 +2275,7 @@ static void nvme_alloc_ns(struct nvme_dev *dev, unsigned nsid)
         if (dev->max_hw_sectors) {
                 blk_queue_max_hw_sectors(ns->queue, dev->max_hw_sectors);
                 blk_queue_max_segments(ns->queue,
-                        ((dev->max_hw_sectors << 9) / dev->page_size) + 1);
+                        (dev->max_hw_sectors / (dev->page_size >> 9)) + 1);
         }
         if (dev->stripe_size)
                 blk_queue_chunk_sectors(ns->queue, dev->stripe_size >> 9);
@@ -2533,8 +2540,17 @@ static void nvme_ns_remove(struct nvme_ns *ns)
 {
         bool kill = nvme_io_incapable(ns->dev) && !blk_queue_dying(ns->queue);
 
-        if (kill)
+        if (kill) {
                 blk_set_queue_dying(ns->queue);
+
+                /*
+                 * The controller was shutdown first if we got here through
+                 * device removal. The shutdown may requeue outstanding
+                 * requests. These need to be aborted immediately so
+                 * del_gendisk doesn't block indefinitely for their completion.
+                 */
+                blk_mq_abort_requeue_list(ns->queue);
+        }
         if (ns->disk->flags & GENHD_FL_UP)
                 del_gendisk(ns->disk);
         if (kill || !blk_queue_dying(ns->queue)) {
@@ -2701,6 +2717,18 @@ static int nvme_dev_map(struct nvme_dev *dev)
         dev->q_depth = min_t(int, NVME_CAP_MQES(cap) + 1, NVME_Q_DEPTH);
         dev->db_stride = 1 << NVME_CAP_STRIDE(cap);
         dev->dbs = ((void __iomem *)dev->bar) + 4096;
+
+        /*
+         * Temporary fix for the Apple controller found in the MacBook8,1 and
+         * some MacBook7,1 to avoid controller resets and data loss.
+         */
+        if (pdev->vendor == PCI_VENDOR_ID_APPLE && pdev->device == 0x2001) {
+                dev->q_depth = 2;
+                dev_warn(dev->dev, "detected Apple NVMe controller, set "
+                        "queue depth=%u to work around controller resets\n",
+                        dev->q_depth);
+        }
+
         if (readl(&dev->bar->vs) >= NVME_VS(1, 2))
                 dev->cmb = nvme_map_cmb(dev);
 
@@ -2787,6 +2815,10 @@ static void nvme_del_queue_end(struct nvme_queue *nvmeq)
 {
         struct nvme_delq_ctx *dq = nvmeq->cmdinfo.ctx;
         nvme_put_dq(dq);
+
+        spin_lock_irq(&nvmeq->q_lock);
+        nvme_process_cq(nvmeq);
+        spin_unlock_irq(&nvmeq->q_lock);
 }
 
 static int adapter_async_del_queue(struct nvme_queue *nvmeq, u8 opcode,
@@ -2954,6 +2986,15 @@ static void nvme_dev_remove(struct nvme_dev *dev)
 {
         struct nvme_ns *ns, *next;
 
+        if (nvme_io_incapable(dev)) {
+                /*
+                 * If the device is not capable of IO (surprise hot-removal,
+                 * for example), we need to quiesce prior to deleting the
+                 * namespaces. This will end outstanding requests and prevent
+                 * attempts to sync dirty data.
+                 */
+                nvme_dev_shutdown(dev);
+        }
         list_for_each_entry_safe(ns, next, &dev->namespaces, list)
                 nvme_ns_remove(ns);
 }
diff --git a/drivers/of/address.c b/drivers/of/address.c
index cd53fe4a0c86..9582c5703b3c 100644
--- a/drivers/of/address.c
+++ b/drivers/of/address.c
@@ -485,9 +485,10 @@ static int of_translate_one(struct device_node *parent, struct of_bus *bus,
         int rone;
         u64 offset = OF_BAD_ADDR;
 
-        /* Normally, an absence of a "ranges" property means we are
+        /*
+         * Normally, an absence of a "ranges" property means we are
          * crossing a non-translatable boundary, and thus the addresses
-         * below the current not cannot be converted to CPU physical ones.
+         * below the current cannot be converted to CPU physical ones.
          * Unfortunately, while this is very clear in the spec, it's not
          * what Apple understood, and they do have things like /uni-n or
          * /ht nodes with no "ranges" property and a lot of perfectly
diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
index d2430298a309..655f79db7899 100644
--- a/drivers/of/fdt.c
+++ b/drivers/of/fdt.c
@@ -13,6 +13,7 @@
 #include <linux/kernel.h>
 #include <linux/initrd.h>
 #include <linux/memblock.h>
+#include <linux/mutex.h>
 #include <linux/of.h>
 #include <linux/of_fdt.h>
 #include <linux/of_reserved_mem.h>
@@ -436,6 +437,8 @@ static void *kernel_tree_alloc(u64 size, u64 align)
         return kzalloc(size, GFP_KERNEL);
 }
 
+static DEFINE_MUTEX(of_fdt_unflatten_mutex);
+
 /**
  * of_fdt_unflatten_tree - create tree of device_nodes from flat blob
  *
@@ -447,7 +450,9 @@ static void *kernel_tree_alloc(u64 size, u64 align)
 void of_fdt_unflatten_tree(const unsigned long *blob,
                         struct device_node **mynodes)
 {
+        mutex_lock(&of_fdt_unflatten_mutex);
         __unflatten_device_tree(blob, mynodes, &kernel_tree_alloc);
+        mutex_unlock(&of_fdt_unflatten_mutex);
 }
 EXPORT_SYMBOL_GPL(of_fdt_unflatten_tree);
 
@@ -1041,7 +1046,7 @@ void __init __weak early_init_dt_add_memory_arch(u64 base, u64 size)
 int __init __weak early_init_dt_reserve_memory_arch(phys_addr_t base,
                                         phys_addr_t size, bool nomap)
 {
-        pr_err("Reserved memory not supported, ignoring range 0x%pa - 0x%pa%s\n",
+        pr_err("Reserved memory not supported, ignoring range %pa - %pa%s\n",
                   &base, &size, nomap ? " (nomap)" : "");
         return -ENOSYS;
 }
diff --git a/drivers/of/irq.c b/drivers/of/irq.c
index 902b89be7217..4fa916dffc91 100644
--- a/drivers/of/irq.c
+++ b/drivers/of/irq.c
@@ -53,7 +53,7 @@ EXPORT_SYMBOL_GPL(irq_of_parse_and_map);
  * Returns a pointer to the interrupt parent node, or NULL if the interrupt
  * parent could not be determined.
  */
-static struct device_node *of_irq_find_parent(struct device_node *child)
+struct device_node *of_irq_find_parent(struct device_node *child)
 {
         struct device_node *p;
         const __be32 *parp;
@@ -77,6 +77,7 @@ static struct device_node *of_irq_find_parent(struct device_node *child)
 
         return p;
 }
+EXPORT_SYMBOL_GPL(of_irq_find_parent);
 
 /**
  * of_irq_parse_raw - Low level interrupt tree parsing
diff --git a/drivers/of/of_reserved_mem.c b/drivers/of/of_reserved_mem.c
index be77e75c587d..1a3556a9e9ea 100644
--- a/drivers/of/of_reserved_mem.c
+++ b/drivers/of/of_reserved_mem.c
@@ -206,7 +206,13 @@ static int __init __rmem_cmp(const void *a, const void *b)
 {
         const struct reserved_mem *ra = a, *rb = b;
 
-        return ra->base - rb->base;
+        if (ra->base < rb->base)
+                return -1;
+
+        if (ra->base > rb->base)
+                return 1;
+
+        return 0;
 }
 
 static void __init __rmem_check_for_overlap(void)
diff --git a/drivers/parisc/iommu-helpers.h b/drivers/parisc/iommu-helpers.h
index 761e77bfce5d..e56f1569f6c3 100644
--- a/drivers/parisc/iommu-helpers.h
+++ b/drivers/parisc/iommu-helpers.h
@@ -104,7 +104,11 @@ iommu_coalesce_chunks(struct ioc *ioc, struct device *dev,
         struct scatterlist *contig_sg;     /* contig chunk head */
         unsigned long dma_offset, dma_len; /* start/len of DMA stream */
         unsigned int n_mappings = 0;
-        unsigned int max_seg_size = dma_get_max_seg_size(dev);
+        unsigned int max_seg_size = min(dma_get_max_seg_size(dev),
+                                        (unsigned)DMA_CHUNK_SIZE);
+        unsigned int max_seg_boundary = dma_get_seg_boundary(dev) + 1;
+        if (max_seg_boundary)   /* check if the addition above didn't overflow */
+                max_seg_size = min(max_seg_size, max_seg_boundary);
 
         while (nents > 0) {
 
@@ -138,14 +142,11 @@ iommu_coalesce_chunks(struct ioc *ioc, struct device *dev,
 
                         /*
                         ** First make sure current dma stream won't
-                        ** exceed DMA_CHUNK_SIZE if we coalesce the
+                        ** exceed max_seg_size if we coalesce the
                         ** next entry.
                         */   
-                        if(unlikely(ALIGN(dma_len + dma_offset + startsg->length,
-                                            IOVP_SIZE) > DMA_CHUNK_SIZE))
-                                break;
-
-                        if (startsg->length + dma_len > max_seg_size)
+                        if (unlikely(ALIGN(dma_len + dma_offset + startsg->length, IOVP_SIZE) >
+                                     max_seg_size))
                                 break;
 
                         /*
diff --git a/drivers/pci/host/pcie-altera.c b/drivers/pci/host/pcie-altera.c
index e5dda38bdde5..99da549d5d06 100644
--- a/drivers/pci/host/pcie-altera.c
+++ b/drivers/pci/host/pcie-altera.c
@@ -55,8 +55,10 @@
 #define TLP_CFG_DW2(bus, devfn, offset) \
                                 (((bus) << 24) | ((devfn) << 16) | (offset))
 #define TLP_REQ_ID(bus, devfn)          (((bus) << 8) | (devfn))
+#define TLP_COMP_STATUS(s)              (((s) >> 12) & 7)
 #define TLP_HDR_SIZE                    3
 #define TLP_LOOP                        500
+#define RP_DEVFN                        0
 
 #define INTX_NUM                        4
 
@@ -166,34 +168,41 @@ static bool altera_pcie_valid_config(struct altera_pcie *pcie,
 
 static int tlp_read_packet(struct altera_pcie *pcie, u32 *value)
 {
-        u8 loop;
+        int i;
         bool sop = 0;
         u32 ctrl;
         u32 reg0, reg1;
+        u32 comp_status = 1;
 
         /*
          * Minimum 2 loops to read TLP headers and 1 loop to read data
          * payload.
          */
-        for (loop = 0; loop < TLP_LOOP; loop++) {
+        for (i = 0; i < TLP_LOOP; i++) {
                 ctrl = cra_readl(pcie, RP_RXCPL_STATUS);
                 if ((ctrl & RP_RXCPL_SOP) || (ctrl & RP_RXCPL_EOP) || sop) {
                         reg0 = cra_readl(pcie, RP_RXCPL_REG0);
                         reg1 = cra_readl(pcie, RP_RXCPL_REG1);
 
-                        if (ctrl & RP_RXCPL_SOP)
+                        if (ctrl & RP_RXCPL_SOP) {
                                 sop = true;
+                                comp_status = TLP_COMP_STATUS(reg1);
+                        }
 
                         if (ctrl & RP_RXCPL_EOP) {
+                                if (comp_status)
+                                        return PCIBIOS_DEVICE_NOT_FOUND;
+
                                 if (value)
                                         *value = reg0;
+
                                 return PCIBIOS_SUCCESSFUL;
                         }
                 }
                 udelay(5);
         }
 
-        return -ENOENT;
+        return PCIBIOS_DEVICE_NOT_FOUND;
 }
 
 static void tlp_write_packet(struct altera_pcie *pcie, u32 *headers,
@@ -233,7 +242,7 @@ static int tlp_cfg_dword_read(struct altera_pcie *pcie, u8 bus, u32 devfn,
         else
                 headers[0] = TLP_CFG_DW0(TLP_FMTTYPE_CFGRD1);
 
-        headers[1] = TLP_CFG_DW1(TLP_REQ_ID(pcie->root_bus_nr, devfn),
+        headers[1] = TLP_CFG_DW1(TLP_REQ_ID(pcie->root_bus_nr, RP_DEVFN),
                                         TLP_READ_TAG, byte_en);
         headers[2] = TLP_CFG_DW2(bus, devfn, where);
 
@@ -253,7 +262,7 @@ static int tlp_cfg_dword_write(struct altera_pcie *pcie, u8 bus, u32 devfn,
         else
                 headers[0] = TLP_CFG_DW0(TLP_FMTTYPE_CFGWR1);
 
-        headers[1] = TLP_CFG_DW1(TLP_REQ_ID(pcie->root_bus_nr, devfn),
+        headers[1] = TLP_CFG_DW1(TLP_REQ_ID(pcie->root_bus_nr, RP_DEVFN),
                                         TLP_WRITE_TAG, byte_en);
         headers[2] = TLP_CFG_DW2(bus, devfn, where);
 
@@ -458,7 +467,7 @@ static int altera_pcie_init_irq_domain(struct altera_pcie *pcie)
         struct device_node *node = dev->of_node;
 
         /* Setup INTx */
-        pcie->irq_domain = irq_domain_add_linear(node, INTX_NUM,
+        pcie->irq_domain = irq_domain_add_linear(node, INTX_NUM + 1,
                                         &intx_domain_ops, pcie);
         if (!pcie->irq_domain) {
                 dev_err(dev, "Failed to get a INTx IRQ domain\n");
diff --git a/drivers/pci/host/pcie-designware.c b/drivers/pci/host/pcie-designware.c
index 540f077c37ea..02a7452bdf23 100644
--- a/drivers/pci/host/pcie-designware.c
+++ b/drivers/pci/host/pcie-designware.c
@@ -440,7 +440,6 @@ int dw_pcie_host_init(struct pcie_port *pp)
                                          ret, pp->io);
                                 continue;
                         }
-                        pp->io_base = pp->io->start;
                         break;
                 case IORESOURCE_MEM:
                         pp->mem = win->res;
diff --git a/drivers/pci/host/pcie-hisi.c b/drivers/pci/host/pcie-hisi.c
index 35457ecd8e70..77f7c669a1b9 100644
--- a/drivers/pci/host/pcie-hisi.c
+++ b/drivers/pci/host/pcie-hisi.c
@@ -61,7 +61,9 @@ static int hisi_pcie_cfg_read(struct pcie_port *pp, int where, int size,
                 *val = *(u8 __force *) walker;
         else if (size == 2)
                 *val = *(u16 __force *) walker;
-        else if (size != 4)
+        else if (size == 4)
+                *val = reg_val;
+        else
                 return PCIBIOS_BAD_REGISTER_NUMBER;
 
         return PCIBIOS_SUCCESSFUL;
@@ -111,7 +113,7 @@ static struct pcie_host_ops hisi_pcie_host_ops = {
         .link_up = hisi_pcie_link_up,
 };
 
-static int __init hisi_add_pcie_port(struct pcie_port *pp,
+static int hisi_add_pcie_port(struct pcie_port *pp,
                                      struct platform_device *pdev)
 {
         int ret;
@@ -139,7 +141,7 @@ static int __init hisi_add_pcie_port(struct pcie_port *pp,
         return 0;
 }
 
-static int __init hisi_pcie_probe(struct platform_device *pdev)
+static int hisi_pcie_probe(struct platform_device *pdev)
 {
         struct hisi_pcie *hisi_pcie;
         struct pcie_port *pp;
diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
index 53e463244bb7..7eaa4c87fec7 100644
--- a/drivers/pci/msi.c
+++ b/drivers/pci/msi.c
@@ -54,7 +54,7 @@ static int pci_msi_setup_msi_irqs(struct pci_dev *dev, int nvec, int type)
         struct irq_domain *domain;
 
         domain = pci_msi_get_domain(dev);
-        if (domain)
+        if (domain && irq_domain_is_hierarchy(domain))
                 return pci_msi_domain_alloc_irqs(domain, dev, nvec, type);
 
         return arch_setup_msi_irqs(dev, nvec, type);
@@ -65,7 +65,7 @@ static void pci_msi_teardown_msi_irqs(struct pci_dev *dev)
         struct irq_domain *domain;
 
         domain = pci_msi_get_domain(dev);
-        if (domain)
+        if (domain && irq_domain_is_hierarchy(domain))
                 pci_msi_domain_free_irqs(domain, dev);
         else
                 arch_teardown_msi_irqs(dev);
diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c
index 4446fcb5effd..d7ffd66814bb 100644
--- a/drivers/pci/pci-driver.c
+++ b/drivers/pci/pci-driver.c
@@ -1146,9 +1146,21 @@ static int pci_pm_runtime_suspend(struct device *dev)
         pci_dev->state_saved = false;
         pci_dev->no_d3cold = false;
         error = pm->runtime_suspend(dev);
-        suspend_report_result(pm->runtime_suspend, error);
-        if (error)
+        if (error) {
+                /*
+                 * -EBUSY and -EAGAIN is used to request the runtime PM core
+                 * to schedule a new suspend, so log the event only with debug
+                 * log level.
+                 */
+                if (error == -EBUSY || error == -EAGAIN)
+                        dev_dbg(dev, "can't suspend now (%pf returned %d)\n",
+                                pm->runtime_suspend, error);
+                else
+                        dev_err(dev, "can't suspend (%pf returned %d)\n",
+                                pm->runtime_suspend, error);
+
                 return error;
+        }
         if (!pci_dev->d3cold_allowed)
                 pci_dev->no_d3cold = true;
 
diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
index 92618686604c..eead54cd01b2 100644
--- a/drivers/pci/pci-sysfs.c
+++ b/drivers/pci/pci-sysfs.c
@@ -216,7 +216,10 @@ static ssize_t numa_node_store(struct device *dev,
         if (ret)
                 return ret;
 
-        if (node >= MAX_NUMNODES || !node_online(node))
+        if ((node < 0 && node != NUMA_NO_NODE) || node >= MAX_NUMNODES)
+                return -EINVAL;
+
+        if (node != NUMA_NO_NODE && !node_online(node))
                 return -EINVAL;
 
         add_taint(TAINT_FIRMWARE_WORKAROUND, LOCKDEP_STILL_OK);
diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h
index fd2f03fa53f3..d390fc1475ec 100644
--- a/drivers/pci/pci.h
+++ b/drivers/pci/pci.h
@@ -337,6 +337,4 @@ static inline int pci_dev_specific_reset(struct pci_dev *dev, int probe)
 }
 #endif
 
-struct pci_host_bridge *pci_find_host_bridge(struct pci_bus *bus);
-
 #endif /* DRIVERS_PCI_H */
diff --git a/drivers/phy/Kconfig b/drivers/phy/Kconfig
index 7eb5859dd035..03cb3ea2d2c0 100644
--- a/drivers/phy/Kconfig
+++ b/drivers/phy/Kconfig
@@ -233,6 +233,7 @@ config PHY_SUN9I_USB
         tristate "Allwinner sun9i SoC USB PHY driver"
         depends on ARCH_SUNXI && HAS_IOMEM && OF
         depends on RESET_CONTROLLER
+        depends on USB_COMMON
         select GENERIC_PHY
         help
           Enable this to support the transceiver that is part of Allwinner
diff --git a/drivers/phy/phy-bcm-cygnus-pcie.c b/drivers/phy/phy-bcm-cygnus-pcie.c
index 7ad72b7d2b98..082c03f6438f 100644
--- a/drivers/phy/phy-bcm-cygnus-pcie.c
+++ b/drivers/phy/phy-bcm-cygnus-pcie.c
@@ -128,6 +128,7 @@ static int cygnus_pcie_phy_probe(struct platform_device *pdev)
         struct phy_provider *provider;
         struct resource *res;
         unsigned cnt = 0;
+        int ret;
 
         if (of_get_child_count(node) == 0) {
                 dev_err(dev, "PHY no child node\n");
@@ -154,24 +155,28 @@ static int cygnus_pcie_phy_probe(struct platform_device *pdev)
                 if (of_property_read_u32(child, "reg", &id)) {
                         dev_err(dev, "missing reg property for %s\n",
                                 child->name);
-                        return -EINVAL;
+                        ret = -EINVAL;
+                        goto put_child;
                 }
 
                 if (id >= MAX_NUM_PHYS) {
                         dev_err(dev, "invalid PHY id: %u\n", id);
-                        return -EINVAL;
+                        ret = -EINVAL;
+                        goto put_child;
                 }
 
                 if (core->phys[id].phy) {
                         dev_err(dev, "duplicated PHY id: %u\n", id);
-                        return -EINVAL;
+                        ret = -EINVAL;
+                        goto put_child;
                 }
 
                 p = &core->phys[id];
                 p->phy = devm_phy_create(dev, child, &cygnus_pcie_phy_ops);
                 if (IS_ERR(p->phy)) {
                         dev_err(dev, "failed to create PHY\n");
-                        return PTR_ERR(p->phy);
+                        ret = PTR_ERR(p->phy);
+                        goto put_child;
                 }
 
                 p->core = core;
@@ -191,6 +196,9 @@ static int cygnus_pcie_phy_probe(struct platform_device *pdev)
         dev_dbg(dev, "registered %u PCIe PHY(s)\n", cnt);
 
         return 0;
+put_child:
+        of_node_put(child);
+        return ret;
 }
 
 static const struct of_device_id cygnus_pcie_phy_match_table[] = {
diff --git a/drivers/phy/phy-berlin-sata.c b/drivers/phy/phy-berlin-sata.c
index 77a2e054fdea..f84a33a1bdd9 100644
--- a/drivers/phy/phy-berlin-sata.c
+++ b/drivers/phy/phy-berlin-sata.c
@@ -195,7 +195,7 @@ static int phy_berlin_sata_probe(struct platform_device *pdev)
         struct phy_provider *phy_provider;
         struct phy_berlin_priv *priv;
         struct resource *res;
-        int i = 0;
+        int ret, i = 0;
         u32 phy_id;
 
         priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
@@ -237,22 +237,27 @@ static int phy_berlin_sata_probe(struct platform_device *pdev)
                 if (of_property_read_u32(child, "reg", &phy_id)) {
                         dev_err(dev, "missing reg property in node %s\n",
                                 child->name);
-                        return -EINVAL;
+                        ret = -EINVAL;
+                        goto put_child;
                 }
 
                 if (phy_id >= ARRAY_SIZE(phy_berlin_power_down_bits)) {
                         dev_err(dev, "invalid reg in node %s\n", child->name);
-                        return -EINVAL;
+                        ret = -EINVAL;
+                        goto put_child;
                 }
 
                 phy_desc = devm_kzalloc(dev, sizeof(*phy_desc), GFP_KERNEL);
-                if (!phy_desc)
-                        return -ENOMEM;
+                if (!phy_desc) {
+                        ret = -ENOMEM;
+                        goto put_child;
+                }
 
                 phy = devm_phy_create(dev, NULL, &phy_berlin_sata_ops);
                 if (IS_ERR(phy)) {
                         dev_err(dev, "failed to create PHY %d\n", phy_id);
-                        return PTR_ERR(phy);
+                        ret = PTR_ERR(phy);
+                        goto put_child;
                 }
 
                 phy_desc->phy = phy;
@@ -269,6 +274,9 @@ static int phy_berlin_sata_probe(struct platform_device *pdev)
         phy_provider =
                 devm_of_phy_provider_register(dev, phy_berlin_sata_phy_xlate);
         return PTR_ERR_OR_ZERO(phy_provider);
+put_child:
+        of_node_put(child);
+        return ret;
 }
 
 static const struct of_device_id phy_berlin_sata_of_match[] = {
diff --git a/drivers/phy/phy-brcmstb-sata.c b/drivers/phy/phy-brcmstb-sata.c
index 8a2cb16a1937..cd9dba820566 100644
--- a/drivers/phy/phy-brcmstb-sata.c
+++ b/drivers/phy/phy-brcmstb-sata.c
@@ -140,7 +140,7 @@ static int brcm_sata_phy_probe(struct platform_device *pdev)
         struct brcm_sata_phy *priv;
         struct resource *res;
         struct phy_provider *provider;
-        int count = 0;
+        int ret, count = 0;
 
         if (of_get_child_count(dn) == 0)
                 return -ENODEV;
@@ -163,16 +163,19 @@ static int brcm_sata_phy_probe(struct platform_device *pdev)
                 if (of_property_read_u32(child, "reg", &id)) {
                         dev_err(dev, "missing reg property in node %s\n",
                                         child->name);
-                        return -EINVAL;
+                        ret = -EINVAL;
+                        goto put_child;
                 }
 
                 if (id >= MAX_PORTS) {
                         dev_err(dev, "invalid reg: %u\n", id);
-                        return -EINVAL;
+                        ret = -EINVAL;
+                        goto put_child;
                 }
                 if (priv->phys[id].phy) {
                         dev_err(dev, "already registered port %u\n", id);
-                        return -EINVAL;
+                        ret = -EINVAL;
+                        goto put_child;
                 }
 
                 port = &priv->phys[id];
@@ -182,7 +185,8 @@ static int brcm_sata_phy_probe(struct platform_device *pdev)
                 port->ssc_en = of_property_read_bool(child, "brcm,enable-ssc");
                 if (IS_ERR(port->phy)) {
                         dev_err(dev, "failed to create PHY\n");
-                        return PTR_ERR(port->phy);
+                        ret = PTR_ERR(port->phy);
+                        goto put_child;
                 }
 
                 phy_set_drvdata(port->phy, port);
@@ -198,6 +202,9 @@ static int brcm_sata_phy_probe(struct platform_device *pdev)
         dev_info(dev, "registered %d port(s)\n", count);
 
         return 0;
+put_child:
+        of_node_put(child);
+        return ret;
 }
 
 static struct platform_driver brcm_sata_phy_driver = {
diff --git a/drivers/phy/phy-core.c b/drivers/phy/phy-core.c
index fc48fac003a6..8c7f27db6ad3 100644
--- a/drivers/phy/phy-core.c
+++ b/drivers/phy/phy-core.c
@@ -636,8 +636,9 @@ EXPORT_SYMBOL_GPL(devm_of_phy_get);
  * @np: node containing the phy
  * @index: index of the phy
  *
- * Gets the phy using _of_phy_get(), and associates a device with it using
- * devres. On driver detach, release function is invoked on the devres data,
+ * Gets the phy using _of_phy_get(), then gets a refcount to it,
+ * and associates a device with it using devres. On driver detach,
+ * release function is invoked on the devres data,
  * then, devres data is freed.
  *
  */
@@ -651,13 +652,21 @@ struct phy *devm_of_phy_get_by_index(struct device *dev, struct device_node *np,
                 return ERR_PTR(-ENOMEM);
 
         phy = _of_phy_get(np, index);
-        if (!IS_ERR(phy)) {
-                *ptr = phy;
-                devres_add(dev, ptr);
-        } else {
+        if (IS_ERR(phy)) {
                 devres_free(ptr);
+                return phy;
         }
 
+        if (!try_module_get(phy->ops->owner)) {
+                devres_free(ptr);
+                return ERR_PTR(-EPROBE_DEFER);
+        }
+
+        get_device(&phy->dev);
+
+        *ptr = phy;
+        devres_add(dev, ptr);
+
         return phy;
 }
 EXPORT_SYMBOL_GPL(devm_of_phy_get_by_index);
diff --git a/drivers/phy/phy-miphy28lp.c b/drivers/phy/phy-miphy28lp.c
index c47b56b4a2b8..3acd2a1808df 100644
--- a/drivers/phy/phy-miphy28lp.c
+++ b/drivers/phy/phy-miphy28lp.c
@@ -1226,15 +1226,18 @@ static int miphy28lp_probe(struct platform_device *pdev)
 
                 miphy_phy = devm_kzalloc(&pdev->dev, sizeof(*miphy_phy),
                                          GFP_KERNEL);
-                if (!miphy_phy)
-                        return -ENOMEM;
+                if (!miphy_phy) {
+                        ret = -ENOMEM;
+                        goto put_child;
+                }
 
                 miphy_dev->phys[port] = miphy_phy;
 
                 phy = devm_phy_create(&pdev->dev, child, &miphy28lp_ops);
                 if (IS_ERR(phy)) {
                         dev_err(&pdev->dev, "failed to create PHY\n");
-                        return PTR_ERR(phy);
+                        ret = PTR_ERR(phy);
+                        goto put_child;
                 }
 
                 miphy_dev->phys[port]->phy = phy;
@@ -1242,11 +1245,11 @@ static int miphy28lp_probe(struct platform_device *pdev)
 
                 ret = miphy28lp_of_probe(child, miphy_phy);
                 if (ret)
-                        return ret;
+                        goto put_child;
 
                 ret = miphy28lp_probe_resets(child, miphy_dev->phys[port]);
                 if (ret)
-                        return ret;
+                        goto put_child;
 
                 phy_set_drvdata(phy, miphy_dev->phys[port]);
                 port++;
@@ -1255,6 +1258,9 @@ static int miphy28lp_probe(struct platform_device *pdev)
 
         provider = devm_of_phy_provider_register(&pdev->dev, miphy28lp_xlate);
         return PTR_ERR_OR_ZERO(provider);
+put_child:
+        of_node_put(child);
+        return ret;
 }
 
 static const struct of_device_id miphy28lp_of_match[] = {
diff --git a/drivers/phy/phy-miphy365x.c b/drivers/phy/phy-miphy365x.c
index 00a686a073ed..e661f3b36eaa 100644
--- a/drivers/phy/phy-miphy365x.c
+++ b/drivers/phy/phy-miphy365x.c
@@ -566,22 +566,25 @@ static int miphy365x_probe(struct platform_device *pdev)
 
                 miphy_phy = devm_kzalloc(&pdev->dev, sizeof(*miphy_phy),
                                          GFP_KERNEL);
-                if (!miphy_phy)
-                        return -ENOMEM;
+                if (!miphy_phy) {
+                        ret = -ENOMEM;
+                        goto put_child;
+                }
 
                 miphy_dev->phys[port] = miphy_phy;
 
                 phy = devm_phy_create(&pdev->dev, child, &miphy365x_ops);
                 if (IS_ERR(phy)) {
                         dev_err(&pdev->dev, "failed to create PHY\n");
-                        return PTR_ERR(phy);
+                        ret = PTR_ERR(phy);
+                        goto put_child;
                 }
 
                 miphy_dev->phys[port]->phy = phy;
 
                 ret = miphy365x_of_probe(child, miphy_phy);
                 if (ret)
-                        return ret;
+                        goto put_child;
 
                 phy_set_drvdata(phy, miphy_dev->phys[port]);
 
@@ -591,12 +594,15 @@ static int miphy365x_probe(struct platform_device *pdev)
                                         &miphy_phy->ctrlreg);
                 if (ret) {
                         dev_err(&pdev->dev, "No sysconfig offset found\n");
-                        return ret;
+                        goto put_child;
                 }
         }
 
         provider = devm_of_phy_provider_register(&pdev->dev, miphy365x_xlate);
         return PTR_ERR_OR_ZERO(provider);
+put_child:
+        of_node_put(child);
+        return ret;
 }
 
 static const struct of_device_id miphy365x_of_match[] = {
diff --git a/drivers/phy/phy-mt65xx-usb3.c b/drivers/phy/phy-mt65xx-usb3.c
index f30b28bd41fe..e427c3b788ff 100644
--- a/drivers/phy/phy-mt65xx-usb3.c
+++ b/drivers/phy/phy-mt65xx-usb3.c
@@ -415,7 +415,7 @@ static int mt65xx_u3phy_probe(struct platform_device *pdev)
         struct resource *sif_res;
         struct mt65xx_u3phy *u3phy;
         struct resource res;
-        int port;
+        int port, retval;
 
         u3phy = devm_kzalloc(dev, sizeof(*u3phy), GFP_KERNEL);
         if (!u3phy)
@@ -447,31 +447,34 @@ static int mt65xx_u3phy_probe(struct platform_device *pdev)
         for_each_child_of_node(np, child_np) {
                 struct mt65xx_phy_instance *instance;
                 struct phy *phy;
-                int retval;
 
                 instance = devm_kzalloc(dev, sizeof(*instance), GFP_KERNEL);
-                if (!instance)
-                        return -ENOMEM;
+                if (!instance) {
+                        retval = -ENOMEM;
+                        goto put_child;
+                }
 
                 u3phy->phys[port] = instance;
 
                 phy = devm_phy_create(dev, child_np, &mt65xx_u3phy_ops);
                 if (IS_ERR(phy)) {
                         dev_err(dev, "failed to create phy\n");
-                        return PTR_ERR(phy);
+                        retval = PTR_ERR(phy);
+                        goto put_child;
                 }
 
                 retval = of_address_to_resource(child_np, 0, &res);
                 if (retval) {
                         dev_err(dev, "failed to get address resource(id-%d)\n",
                                 port);
-                        return retval;
+                        goto put_child;
                 }
 
                 instance->port_base = devm_ioremap_resource(&phy->dev, &res);
                 if (IS_ERR(instance->port_base)) {
                         dev_err(dev, "failed to remap phy regs\n");
-                        return PTR_ERR(instance->port_base);
+                        retval = PTR_ERR(instance->port_base);
+                        goto put_child;
                 }
 
                 instance->phy = phy;
@@ -483,6 +486,9 @@ static int mt65xx_u3phy_probe(struct platform_device *pdev)
         provider = devm_of_phy_provider_register(dev, mt65xx_phy_xlate);
 
         return PTR_ERR_OR_ZERO(provider);
+put_child:
+        of_node_put(child_np);
+        return retval;
 }
 
 static const struct of_device_id mt65xx_u3phy_id_table[] = {
diff --git a/drivers/phy/phy-rockchip-usb.c b/drivers/phy/phy-rockchip-usb.c
index 91d6f342c565..62c43c435194 100644
--- a/drivers/phy/phy-rockchip-usb.c
+++ b/drivers/phy/phy-rockchip-usb.c
@@ -108,13 +108,16 @@ static int rockchip_usb_phy_probe(struct platform_device *pdev)
 
         for_each_available_child_of_node(dev->of_node, child) {
                 rk_phy = devm_kzalloc(dev, sizeof(*rk_phy), GFP_KERNEL);
-                if (!rk_phy)
-                        return -ENOMEM;
+                if (!rk_phy) {
+                        err = -ENOMEM;
+                        goto put_child;
+                }
 
                 if (of_property_read_u32(child, "reg", &reg_offset)) {
                         dev_err(dev, "missing reg property in node %s\n",
                                 child->name);
-                        return -EINVAL;
+                        err = -EINVAL;
+                        goto put_child;
                 }
 
                 rk_phy->reg_offset = reg_offset;
@@ -127,18 +130,22 @@ static int rockchip_usb_phy_probe(struct platform_device *pdev)
                 rk_phy->phy = devm_phy_create(dev, child, &ops);
                 if (IS_ERR(rk_phy->phy)) {
                         dev_err(dev, "failed to create PHY\n");
-                        return PTR_ERR(rk_phy->phy);
+                        err = PTR_ERR(rk_phy->phy);
+                        goto put_child;
                 }
                 phy_set_drvdata(rk_phy->phy, rk_phy);
 
                 /* only power up usb phy when it use, so disable it when init*/
                 err = rockchip_usb_phy_power(rk_phy, 1);
                 if (err)
-                        return err;
+                        goto put_child;
         }
 
         phy_provider = devm_of_phy_provider_register(dev, of_phy_simple_xlate);
         return PTR_ERR_OR_ZERO(phy_provider);
+put_child:
+        of_node_put(child);
+        return err;
 }
 
 static const struct of_device_id rockchip_usb_phy_dt_ids[] = {
diff --git a/drivers/pinctrl/Kconfig b/drivers/pinctrl/Kconfig
index b422e4ed73f4..312c78b27a32 100644
--- a/drivers/pinctrl/Kconfig
+++ b/drivers/pinctrl/Kconfig
@@ -5,8 +5,6 @@
 config PINCTRL
         bool
 
-if PINCTRL
-
 menu "Pin controllers"
         depends on PINCTRL
 
@@ -274,5 +272,3 @@ config PINCTRL_TB10X
         select GPIOLIB
 
 endmenu
-
-endif
diff --git a/drivers/pinctrl/bcm/pinctrl-bcm2835.c b/drivers/pinctrl/bcm/pinctrl-bcm2835.c
index a1ea565fcd46..2e6ca69635aa 100644
--- a/drivers/pinctrl/bcm/pinctrl-bcm2835.c
+++ b/drivers/pinctrl/bcm/pinctrl-bcm2835.c
@@ -342,12 +342,6 @@ static int bcm2835_gpio_get(struct gpio_chip *chip, unsigned offset)
         return bcm2835_gpio_get_bit(pc, GPLEV0, offset);
 }
 
-static int bcm2835_gpio_direction_output(struct gpio_chip *chip,
-                unsigned offset, int value)
-{
-        return pinctrl_gpio_direction_output(chip->base + offset);
-}
-
 static void bcm2835_gpio_set(struct gpio_chip *chip, unsigned offset, int value)
 {
         struct bcm2835_pinctrl *pc = dev_get_drvdata(chip->dev);
@@ -355,6 +349,13 @@ static void bcm2835_gpio_set(struct gpio_chip *chip, unsigned offset, int value)
         bcm2835_gpio_set_bit(pc, value ? GPSET0 : GPCLR0, offset);
 }
 
+static int bcm2835_gpio_direction_output(struct gpio_chip *chip,
+                unsigned offset, int value)
+{
+        bcm2835_gpio_set(chip, offset, value);
+        return pinctrl_gpio_direction_output(chip->base + offset);
+}
+
 static int bcm2835_gpio_to_irq(struct gpio_chip *chip, unsigned offset)
 {
         struct bcm2835_pinctrl *pc = dev_get_drvdata(chip->dev);
diff --git a/drivers/pinctrl/freescale/pinctrl-imx1-core.c b/drivers/pinctrl/freescale/pinctrl-imx1-core.c
index 88a7fac11bd4..acaf84cadca3 100644
--- a/drivers/pinctrl/freescale/pinctrl-imx1-core.c
+++ b/drivers/pinctrl/freescale/pinctrl-imx1-core.c
@@ -538,8 +538,10 @@ static int imx1_pinctrl_parse_functions(struct device_node *np,
                 func->groups[i] = child->name;
                 grp = &info->groups[grp_index++];
                 ret = imx1_pinctrl_parse_groups(child, grp, info, i++);
-                if (ret == -ENOMEM)
+                if (ret == -ENOMEM) {
+                        of_node_put(child);
                         return ret;
+                }
         }
 
         return 0;
@@ -582,8 +584,10 @@ static int imx1_pinctrl_parse_dt(struct platform_device *pdev,
 
         for_each_child_of_node(np, child) {
                 ret = imx1_pinctrl_parse_functions(child, info, ifunc++);
-                if (ret == -ENOMEM)
+                if (ret == -ENOMEM) {
+                        of_node_put(child);
                         return -ENOMEM;
+                }
         }
 
         return 0;
diff --git a/drivers/pinctrl/freescale/pinctrl-vf610.c b/drivers/pinctrl/freescale/pinctrl-vf610.c
index 37a037543d29..587d1ff6210e 100644
--- a/drivers/pinctrl/freescale/pinctrl-vf610.c
+++ b/drivers/pinctrl/freescale/pinctrl-vf610.c
@@ -299,7 +299,7 @@ static const struct pinctrl_pin_desc vf610_pinctrl_pads[] = {
 static struct imx_pinctrl_soc_info vf610_pinctrl_info = {
         .pins = vf610_pinctrl_pads,
         .npins = ARRAY_SIZE(vf610_pinctrl_pads),
-        .flags = SHARE_MUX_CONF_REG,
+        .flags = SHARE_MUX_CONF_REG | ZERO_OFFSET_VALID,
 };
 
 static const struct of_device_id vf610_pinctrl_of_match[] = {
diff --git a/drivers/pinctrl/intel/pinctrl-broxton.c b/drivers/pinctrl/intel/pinctrl-broxton.c
index e42d5d4183f5..5979d38c46b2 100644
--- a/drivers/pinctrl/intel/pinctrl-broxton.c
+++ b/drivers/pinctrl/intel/pinctrl-broxton.c
@@ -28,6 +28,7 @@
                 .padcfglock_offset = BXT_PADCFGLOCK,    \
                 .hostown_offset = BXT_HOSTSW_OWN,       \
                 .ie_offset = BXT_GPI_IE,                \
+                .gpp_size = 32,                         \
                 .pin_base = (s),                        \
                 .npins = ((e) - (s) + 1),               \
         }
diff --git a/drivers/pinctrl/intel/pinctrl-intel.c b/drivers/pinctrl/intel/pinctrl-intel.c
index 392e28d3f48d..26f6b6ffea5b 100644
--- a/drivers/pinctrl/intel/pinctrl-intel.c
+++ b/drivers/pinctrl/intel/pinctrl-intel.c
@@ -25,9 +25,6 @@
 
 #include "pinctrl-intel.h"
 
-/* Maximum number of pads in each group */
-#define NPADS_IN_GPP                    24
-
 /* Offset from regs */
 #define PADBAR                          0x00c
 #define GPI_IS                          0x100
@@ -37,6 +34,7 @@
 #define PADOWN_BITS                     4
 #define PADOWN_SHIFT(p)                 ((p) % 8 * PADOWN_BITS)
 #define PADOWN_MASK(p)                  (0xf << PADOWN_SHIFT(p))
+#define PADOWN_GPP(p)                   ((p) / 8)
 
 /* Offset from pad_regs */
 #define PADCFG0                         0x000
@@ -142,7 +140,7 @@ static void __iomem *intel_get_padcfg(struct intel_pinctrl *pctrl, unsigned pin,
 static bool intel_pad_owned_by_host(struct intel_pinctrl *pctrl, unsigned pin)
 {
         const struct intel_community *community;
-        unsigned padno, gpp, gpp_offset, offset;
+        unsigned padno, gpp, offset, group;
         void __iomem *padown;
 
         community = intel_get_community(pctrl, pin);
@@ -152,9 +150,9 @@ static bool intel_pad_owned_by_host(struct intel_pinctrl *pctrl, unsigned pin)
                 return true;
 
         padno = pin_to_padno(community, pin);
-        gpp = padno / NPADS_IN_GPP;
-        gpp_offset = padno % NPADS_IN_GPP;
-        offset = community->padown_offset + gpp * 16 + (gpp_offset / 8) * 4;
+        group = padno / community->gpp_size;
+        gpp = PADOWN_GPP(padno % community->gpp_size);
+        offset = community->padown_offset + 0x10 * group + gpp * 4;
         padown = community->regs + offset;
 
         return !(readl(padown) & PADOWN_MASK(padno));
@@ -173,11 +171,11 @@ static bool intel_pad_acpi_mode(struct intel_pinctrl *pctrl, unsigned pin)
                 return false;
 
         padno = pin_to_padno(community, pin);
-        gpp = padno / NPADS_IN_GPP;
+        gpp = padno / community->gpp_size;
         offset = community->hostown_offset + gpp * 4;
         hostown = community->regs + offset;
 
-        return !(readl(hostown) & BIT(padno % NPADS_IN_GPP));
+        return !(readl(hostown) & BIT(padno % community->gpp_size));
 }
 
 static bool intel_pad_locked(struct intel_pinctrl *pctrl, unsigned pin)
@@ -193,7 +191,7 @@ static bool intel_pad_locked(struct intel_pinctrl *pctrl, unsigned pin)
                 return false;
 
         padno = pin_to_padno(community, pin);
-        gpp = padno / NPADS_IN_GPP;
+        gpp = padno / community->gpp_size;
 
         /*
          * If PADCFGLOCK and PADCFGLOCKTX bits are both clear for this pad,
@@ -202,12 +200,12 @@ static bool intel_pad_locked(struct intel_pinctrl *pctrl, unsigned pin)
          */
         offset = community->padcfglock_offset + gpp * 8;
         value = readl(community->regs + offset);
-        if (value & BIT(pin % NPADS_IN_GPP))
+        if (value & BIT(pin % community->gpp_size))
                 return true;
 
         offset = community->padcfglock_offset + 4 + gpp * 8;
         value = readl(community->regs + offset);
-        if (value & BIT(pin % NPADS_IN_GPP))
+        if (value & BIT(pin % community->gpp_size))
                 return true;
 
         return false;
@@ -663,8 +661,8 @@ static void intel_gpio_irq_ack(struct irq_data *d)
         community = intel_get_community(pctrl, pin);
         if (community) {
                 unsigned padno = pin_to_padno(community, pin);
-                unsigned gpp_offset = padno % NPADS_IN_GPP;
-                unsigned gpp = padno / NPADS_IN_GPP;
+                unsigned gpp_offset = padno % community->gpp_size;
+                unsigned gpp = padno / community->gpp_size;
 
                 writel(BIT(gpp_offset), community->regs + GPI_IS + gpp * 4);
         }
@@ -685,8 +683,8 @@ static void intel_gpio_irq_mask_unmask(struct irq_data *d, bool mask)
         community = intel_get_community(pctrl, pin);
         if (community) {
                 unsigned padno = pin_to_padno(community, pin);
-                unsigned gpp_offset = padno % NPADS_IN_GPP;
-                unsigned gpp = padno / NPADS_IN_GPP;
+                unsigned gpp_offset = padno % community->gpp_size;
+                unsigned gpp = padno / community->gpp_size;
                 void __iomem *reg;
                 u32 value;
 
@@ -780,8 +778,8 @@ static int intel_gpio_irq_wake(struct irq_data *d, unsigned int on)
                 return -EINVAL;
 
         padno = pin_to_padno(community, pin);
-        gpp = padno / NPADS_IN_GPP;
-        gpp_offset = padno % NPADS_IN_GPP;
+        gpp = padno / community->gpp_size;
+        gpp_offset = padno % community->gpp_size;
 
         /* Clear the existing wake status */
         writel(BIT(gpp_offset), community->regs + GPI_GPE_STS + gpp * 4);
@@ -819,14 +817,14 @@ static irqreturn_t intel_gpio_community_irq_handler(struct intel_pinctrl *pctrl,
                 /* Only interrupts that are enabled */
                 pending &= enabled;
 
-                for_each_set_bit(gpp_offset, &pending, NPADS_IN_GPP) {
+                for_each_set_bit(gpp_offset, &pending, community->gpp_size) {
                         unsigned padno, irq;
 
                         /*
                          * The last group in community can have less pins
                          * than NPADS_IN_GPP.
                          */
-                        padno = gpp_offset + gpp * NPADS_IN_GPP;
+                        padno = gpp_offset + gpp * community->gpp_size;
                         if (padno >= community->npins)
                                 break;
 
@@ -1002,7 +1000,8 @@ int intel_pinctrl_probe(struct platform_device *pdev,
 
                 community->regs = regs;
                 community->pad_regs = regs + padbar;
-                community->ngpps = DIV_ROUND_UP(community->npins, NPADS_IN_GPP);
+                community->ngpps = DIV_ROUND_UP(community->npins,
+                                                community->gpp_size);
         }
 
         irq = platform_get_irq(pdev, 0);
diff --git a/drivers/pinctrl/intel/pinctrl-intel.h b/drivers/pinctrl/intel/pinctrl-intel.h
index 4ec8b572a288..b60215793017 100644
--- a/drivers/pinctrl/intel/pinctrl-intel.h
+++ b/drivers/pinctrl/intel/pinctrl-intel.h
@@ -55,6 +55,8 @@ struct intel_function {
  *                  ACPI).
  * @ie_offset: Register offset of GPI_IE from @regs.
  * @pin_base: Starting pin of pins in this community
+ * @gpp_size: Maximum number of pads in each group, such as PADCFGLOCK,
+ *            HOSTSW_OWN,  GPI_IS, GPI_IE, etc.
  * @npins: Number of pins in this community
  * @regs: Community specific common registers (reserved for core driver)
  * @pad_regs: Community specific pad registers (reserved for core driver)
@@ -68,6 +70,7 @@ struct intel_community {
         unsigned hostown_offset;
         unsigned ie_offset;
         unsigned pin_base;
+        unsigned gpp_size;
         size_t npins;
         void __iomem *regs;
         void __iomem *pad_regs;
diff --git a/drivers/pinctrl/intel/pinctrl-sunrisepoint.c b/drivers/pinctrl/intel/pinctrl-sunrisepoint.c
index 1de9ae5010db..c725a5313b4e 100644
--- a/drivers/pinctrl/intel/pinctrl-sunrisepoint.c
+++ b/drivers/pinctrl/intel/pinctrl-sunrisepoint.c
@@ -30,6 +30,7 @@
                 .padcfglock_offset = SPT_PADCFGLOCK,    \
                 .hostown_offset = SPT_HOSTSW_OWN,       \
                 .ie_offset = SPT_GPI_IE,                \
+                .gpp_size = 24,                         \
                 .pin_base = (s),                        \
                 .npins = ((e) - (s) + 1),               \
         }
diff --git a/drivers/pinctrl/mediatek/pinctrl-mtk-common.c b/drivers/pinctrl/mediatek/pinctrl-mtk-common.c
index f307f1d27d64..5c717275a7fa 100644
--- a/drivers/pinctrl/mediatek/pinctrl-mtk-common.c
+++ b/drivers/pinctrl/mediatek/pinctrl-mtk-common.c
@@ -747,7 +747,7 @@ static int mtk_gpio_get_direction(struct gpio_chip *chip, unsigned offset)
         reg_addr =  mtk_get_port(pctl, offset) + pctl->devdata->dir_offset;
         bit = BIT(offset & 0xf);
         regmap_read(pctl->regmap1, reg_addr, &read_val);
-        return !!(read_val & bit);
+        return !(read_val & bit);
 }
 
 static int mtk_gpio_get(struct gpio_chip *chip, unsigned offset)
@@ -757,12 +757,8 @@ static int mtk_gpio_get(struct gpio_chip *chip, unsigned offset)
         unsigned int read_val = 0;
         struct mtk_pinctrl *pctl = dev_get_drvdata(chip->dev);
 
-        if (mtk_gpio_get_direction(chip, offset))
-                reg_addr = mtk_get_port(pctl, offset) +
-                        pctl->devdata->dout_offset;
-        else
-                reg_addr = mtk_get_port(pctl, offset) +
-                        pctl->devdata->din_offset;
+        reg_addr = mtk_get_port(pctl, offset) +
+                pctl->devdata->din_offset;
 
         bit = BIT(offset & 0xf);
         regmap_read(pctl->regmap1, reg_addr, &read_val);
@@ -997,6 +993,7 @@ static struct gpio_chip mtk_gpio_chip = {
         .owner                  = THIS_MODULE,
         .request                = gpiochip_generic_request,
         .free                   = gpiochip_generic_free,
+        .get_direction          = mtk_gpio_get_direction,
         .direction_input        = mtk_gpio_direction_input,
         .direction_output       = mtk_gpio_direction_output,
         .get                    = mtk_gpio_get,
diff --git a/drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c b/drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c
index d809c9eaa323..19a3c3bc2f1f 100644
--- a/drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c
+++ b/drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c
@@ -672,7 +672,7 @@ static int pm8xxx_gpio_probe(struct platform_device *pdev)
                 return -ENOMEM;
 
         pctrl->dev = &pdev->dev;
-        pctrl->npins = (unsigned)of_device_get_match_data(&pdev->dev);
+        pctrl->npins = (unsigned long)of_device_get_match_data(&pdev->dev);
 
         pctrl->regmap = dev_get_regmap(pdev->dev.parent, NULL);
         if (!pctrl->regmap) {
diff --git a/drivers/pinctrl/qcom/pinctrl-ssbi-mpp.c b/drivers/pinctrl/qcom/pinctrl-ssbi-mpp.c
index 8982027de8e8..b868ef1766a0 100644
--- a/drivers/pinctrl/qcom/pinctrl-ssbi-mpp.c
+++ b/drivers/pinctrl/qcom/pinctrl-ssbi-mpp.c
@@ -763,7 +763,7 @@ static int pm8xxx_mpp_probe(struct platform_device *pdev)
                 return -ENOMEM;
 
         pctrl->dev = &pdev->dev;
-        pctrl->npins = (unsigned)of_device_get_match_data(&pdev->dev);
+        pctrl->npins = (unsigned long)of_device_get_match_data(&pdev->dev);
 
         pctrl->regmap = dev_get_regmap(pdev->dev.parent, NULL);
         if (!pctrl->regmap) {
diff --git a/drivers/pinctrl/sh-pfc/pfc-sh7734.c b/drivers/pinctrl/sh-pfc/pfc-sh7734.c
index e7deb51de7dc..9842bb106796 100644
--- a/drivers/pinctrl/sh-pfc/pfc-sh7734.c
+++ b/drivers/pinctrl/sh-pfc/pfc-sh7734.c
@@ -31,11 +31,11 @@
         PORT_GP_12(5, fn, sfx)
 
 #undef _GP_DATA
-#define _GP_DATA(bank, pin, name, sfx)                                  \
+#define _GP_DATA(bank, pin, name, sfx, cfg)                             \
         PINMUX_DATA(name##_DATA, name##_FN, name##_IN, name##_OUT)
 
-#define _GP_INOUTSEL(bank, pin, name, sfx)      name##_IN, name##_OUT
-#define _GP_INDT(bank, pin, name, sfx)          name##_DATA
+#define _GP_INOUTSEL(bank, pin, name, sfx, cfg) name##_IN, name##_OUT
+#define _GP_INDT(bank, pin, name, sfx, cfg)     name##_DATA
 #define GP_INOUTSEL(bank)       PORT_GP_32_REV(bank, _GP_INOUTSEL, unused)
 #define GP_INDT(bank)           PORT_GP_32_REV(bank, _GP_INDT, unused)
 
diff --git a/drivers/powercap/intel_rapl.c b/drivers/powercap/intel_rapl.c
index cc97f0869791..48747c28a43d 100644
--- a/drivers/powercap/intel_rapl.c
+++ b/drivers/powercap/intel_rapl.c
@@ -1341,10 +1341,13 @@ static int rapl_detect_domains(struct rapl_package *rp, int cpu)
 
         for (rd = rp->domains; rd < rp->domains + rp->nr_domains; rd++) {
                 /* check if the domain is locked by BIOS */
-                if (rapl_read_data_raw(rd, FW_LOCK, false, &locked)) {
+                ret = rapl_read_data_raw(rd, FW_LOCK, false, &locked);
+                if (ret)
+                        return ret;
+                if (locked) {
                         pr_info("RAPL package %d domain %s locked by BIOS\n",
                                 rp->id, rd->name);
-                                rd->state |= DOMAIN_STATE_BIOS_LOCKED;
+                        rd->state |= DOMAIN_STATE_BIOS_LOCKED;
                 }
         }
 
diff --git a/drivers/remoteproc/remoteproc_core.c b/drivers/remoteproc/remoteproc_core.c
index 8b3130f22b42..9e03d158f411 100644
--- a/drivers/remoteproc/remoteproc_core.c
+++ b/drivers/remoteproc/remoteproc_core.c
@@ -1478,6 +1478,8 @@ module_init(remoteproc_init);
 
 static void __exit remoteproc_exit(void)
 {
+        ida_destroy(&rproc_dev_index);
+
         rproc_exit_debugfs();
 }
 module_exit(remoteproc_exit);
diff --git a/drivers/remoteproc/remoteproc_debugfs.c b/drivers/remoteproc/remoteproc_debugfs.c
index 9d30809bb407..916af5096f57 100644
--- a/drivers/remoteproc/remoteproc_debugfs.c
+++ b/drivers/remoteproc/remoteproc_debugfs.c
@@ -156,7 +156,7 @@ rproc_recovery_write(struct file *filp, const char __user *user_buf,
         char buf[10];
         int ret;
 
-        if (count > sizeof(buf))
+        if (count < 1 || count > sizeof(buf))
                 return count;
 
         ret = copy_from_user(buf, user_buf, count);
diff --git a/drivers/rtc/rtc-da9063.c b/drivers/rtc/rtc-da9063.c
index 284b587da65c..d6c853bbfa9f 100644
--- a/drivers/rtc/rtc-da9063.c
+++ b/drivers/rtc/rtc-da9063.c
@@ -483,24 +483,23 @@ static int da9063_rtc_probe(struct platform_device *pdev)
 
         platform_set_drvdata(pdev, rtc);
 
+        rtc->rtc_dev = devm_rtc_device_register(&pdev->dev, DA9063_DRVNAME_RTC,
+                                           &da9063_rtc_ops, THIS_MODULE);
+        if (IS_ERR(rtc->rtc_dev))
+                return PTR_ERR(rtc->rtc_dev);
+
+        da9063_data_to_tm(data, &rtc->alarm_time, rtc);
+        rtc->rtc_sync = false;
+
         irq_alarm = platform_get_irq_byname(pdev, "ALARM");
         ret = devm_request_threaded_irq(&pdev->dev, irq_alarm, NULL,
                                         da9063_alarm_event,
                                         IRQF_TRIGGER_LOW | IRQF_ONESHOT,
                                         "ALARM", rtc);
-        if (ret) {
+        if (ret)
                 dev_err(&pdev->dev, "Failed to request ALARM IRQ %d: %d\n",
                         irq_alarm, ret);
-                return ret;
-        }
-
-        rtc->rtc_dev = devm_rtc_device_register(&pdev->dev, DA9063_DRVNAME_RTC,
-                                           &da9063_rtc_ops, THIS_MODULE);
-        if (IS_ERR(rtc->rtc_dev))
-                return PTR_ERR(rtc->rtc_dev);
 
-        da9063_data_to_tm(data, &rtc->alarm_time, rtc);
-        rtc->rtc_sync = false;
         return ret;
 }
 
diff --git a/drivers/rtc/rtc-ds1307.c b/drivers/rtc/rtc-ds1307.c
index 188006c55ce0..aa705bb4748c 100644
--- a/drivers/rtc/rtc-ds1307.c
+++ b/drivers/rtc/rtc-ds1307.c
@@ -15,9 +15,6 @@
 #include <linux/i2c.h>
 #include <linux/init.h>
 #include <linux/module.h>
-#include <linux/of_device.h>
-#include <linux/of_irq.h>
-#include <linux/pm_wakeirq.h>
 #include <linux/rtc/ds1307.h>
 #include <linux/rtc.h>
 #include <linux/slab.h>
@@ -117,7 +114,6 @@ struct ds1307 {
 #define HAS_ALARM       1               /* bit 1 == irq claimed */
         struct i2c_client       *client;
         struct rtc_device       *rtc;
-        int                     wakeirq;
         s32 (*read_block_data)(const struct i2c_client *client, u8 command,
                                u8 length, u8 *values);
         s32 (*write_block_data)(const struct i2c_client *client, u8 command,
@@ -1138,7 +1134,10 @@ read_rtc:
                                 bin2bcd(tmp));
         }
 
-        device_set_wakeup_capable(&client->dev, want_irq);
+        if (want_irq) {
+                device_set_wakeup_capable(&client->dev, true);
+                set_bit(HAS_ALARM, &ds1307->flags);
+        }
         ds1307->rtc = devm_rtc_device_register(&client->dev, client->name,
                                 rtc_ops, THIS_MODULE);
         if (IS_ERR(ds1307->rtc)) {
@@ -1146,43 +1145,19 @@ read_rtc:
         }
 
         if (want_irq) {
-                struct device_node *node = client->dev.of_node;
-
                 err = devm_request_threaded_irq(&client->dev,
                                                 client->irq, NULL, irq_handler,
                                                 IRQF_SHARED | IRQF_ONESHOT,
                                                 ds1307->rtc->name, client);
                 if (err) {
                         client->irq = 0;
+                        device_set_wakeup_capable(&client->dev, false);
+                        clear_bit(HAS_ALARM, &ds1307->flags);
                         dev_err(&client->dev, "unable to request IRQ!\n");
-                        goto no_irq;
-                }
-
-                set_bit(HAS_ALARM, &ds1307->flags);
-                dev_dbg(&client->dev, "got IRQ %d\n", client->irq);
-
-                /* Currently supported by OF code only! */
-                if (!node)
-                        goto no_irq;
-
-                err = of_irq_get(node, 1);
-                if (err <= 0) {
-                        if (err == -EPROBE_DEFER)
-                                goto exit;
-                        goto no_irq;
-                }
-                ds1307->wakeirq = err;
-
-                err = dev_pm_set_dedicated_wake_irq(&client->dev,
-                                                    ds1307->wakeirq);
-                if (err) {
-                        dev_err(&client->dev, "unable to setup wakeIRQ %d!\n",
-                                err);
-                        goto exit;
-                }
+                } else
+                        dev_dbg(&client->dev, "got IRQ %d\n", client->irq);
         }
 
-no_irq:
         if (chip->nvram_size) {
 
                 ds1307->nvram = devm_kzalloc(&client->dev,
@@ -1226,9 +1201,6 @@ static int ds1307_remove(struct i2c_client *client)
 {
         struct ds1307 *ds1307 = i2c_get_clientdata(client);
 
-        if (ds1307->wakeirq)
-                dev_pm_clear_wake_irq(&client->dev);
-
         if (test_and_clear_bit(HAS_NVRAM, &ds1307->flags))
                 sysfs_remove_bin_file(&client->dev.kobj, ds1307->nvram);
 
diff --git a/drivers/rtc/rtc-rk808.c b/drivers/rtc/rtc-rk808.c
index 91ca0bc1b484..35c9aada07c8 100644
--- a/drivers/rtc/rtc-rk808.c
+++ b/drivers/rtc/rtc-rk808.c
@@ -56,6 +56,42 @@ struct rk808_rtc {
         int irq;
 };
 
+/*
+ * The Rockchip calendar used by the RK808 counts November with 31 days. We use
+ * these translation functions to convert its dates to/from the Gregorian
+ * calendar used by the rest of the world. We arbitrarily define Jan 1st, 2016
+ * as the day when both calendars were in sync, and treat all other dates
+ * relative to that.
+ * NOTE: Other system software (e.g. firmware) that reads the same hardware must
+ * implement this exact same conversion algorithm, with the same anchor date.
+ */
+static time64_t nov2dec_transitions(struct rtc_time *tm)
+{
+        return (tm->tm_year + 1900) - 2016 + (tm->tm_mon + 1 > 11 ? 1 : 0);
+}
+
+static void rockchip_to_gregorian(struct rtc_time *tm)
+{
+        /* If it's Nov 31st, rtc_tm_to_time64() will count that like Dec 1st */
+        time64_t time = rtc_tm_to_time64(tm);
+        rtc_time64_to_tm(time + nov2dec_transitions(tm) * 86400, tm);
+}
+
+static void gregorian_to_rockchip(struct rtc_time *tm)
+{
+        time64_t extra_days = nov2dec_transitions(tm);
+        time64_t time = rtc_tm_to_time64(tm);
+        rtc_time64_to_tm(time - extra_days * 86400, tm);
+
+        /* Compensate if we went back over Nov 31st (will work up to 2381) */
+        if (nov2dec_transitions(tm) < extra_days) {
+                if (tm->tm_mon + 1 == 11)
+                        tm->tm_mday++;  /* This may result in 31! */
+                else
+                        rtc_time64_to_tm(time - (extra_days - 1) * 86400, tm);
+        }
+}
+
 /* Read current time and date in RTC */
 static int rk808_rtc_readtime(struct device *dev, struct rtc_time *tm)
 {
@@ -101,9 +137,10 @@ static int rk808_rtc_readtime(struct device *dev, struct rtc_time *tm)
         tm->tm_mon = (bcd2bin(rtc_data[4] & MONTHS_REG_MSK)) - 1;
         tm->tm_year = (bcd2bin(rtc_data[5] & YEARS_REG_MSK)) + 100;
         tm->tm_wday = bcd2bin(rtc_data[6] & WEEKS_REG_MSK);
+        rockchip_to_gregorian(tm);
         dev_dbg(dev, "RTC date/time %4d-%02d-%02d(%d) %02d:%02d:%02d\n",
                 1900 + tm->tm_year, tm->tm_mon + 1, tm->tm_mday,
-                tm->tm_wday, tm->tm_hour , tm->tm_min, tm->tm_sec);
+                tm->tm_wday, tm->tm_hour, tm->tm_min, tm->tm_sec);
 
         return ret;
 }
@@ -116,6 +153,10 @@ static int rk808_rtc_set_time(struct device *dev, struct rtc_time *tm)
         u8 rtc_data[NUM_TIME_REGS];
         int ret;
 
+        dev_dbg(dev, "set RTC date/time %4d-%02d-%02d(%d) %02d:%02d:%02d\n",
+                1900 + tm->tm_year, tm->tm_mon + 1, tm->tm_mday,
+                tm->tm_wday, tm->tm_hour, tm->tm_min, tm->tm_sec);
+        gregorian_to_rockchip(tm);
         rtc_data[0] = bin2bcd(tm->tm_sec);
         rtc_data[1] = bin2bcd(tm->tm_min);
         rtc_data[2] = bin2bcd(tm->tm_hour);
@@ -123,9 +164,6 @@ static int rk808_rtc_set_time(struct device *dev, struct rtc_time *tm)
         rtc_data[4] = bin2bcd(tm->tm_mon + 1);
         rtc_data[5] = bin2bcd(tm->tm_year - 100);
         rtc_data[6] = bin2bcd(tm->tm_wday);
-        dev_dbg(dev, "set RTC date/time %4d-%02d-%02d(%d) %02d:%02d:%02d\n",
-                1900 + tm->tm_year, tm->tm_mon + 1, tm->tm_mday,
-                tm->tm_wday, tm->tm_hour , tm->tm_min, tm->tm_sec);
 
         /* Stop RTC while updating the RTC registers */
         ret = regmap_update_bits(rk808->regmap, RK808_RTC_CTRL_REG,
@@ -170,6 +208,7 @@ static int rk808_rtc_readalarm(struct device *dev, struct rtc_wkalrm *alrm)
         alrm->time.tm_mday = bcd2bin(alrm_data[3] & DAYS_REG_MSK);
         alrm->time.tm_mon = (bcd2bin(alrm_data[4] & MONTHS_REG_MSK)) - 1;
         alrm->time.tm_year = (bcd2bin(alrm_data[5] & YEARS_REG_MSK)) + 100;
+        rockchip_to_gregorian(&alrm->time);
 
         ret = regmap_read(rk808->regmap, RK808_RTC_INT_REG, &int_reg);
         if (ret) {
@@ -227,6 +266,7 @@ static int rk808_rtc_setalarm(struct device *dev, struct rtc_wkalrm *alrm)
                 alrm->time.tm_mday, alrm->time.tm_wday, alrm->time.tm_hour,
                 alrm->time.tm_min, alrm->time.tm_sec);
 
+        gregorian_to_rockchip(&alrm->time);
         alrm_data[0] = bin2bcd(alrm->time.tm_sec);
         alrm_data[1] = bin2bcd(alrm->time.tm_min);
         alrm_data[2] = bin2bcd(alrm->time.tm_hour);
diff --git a/drivers/s390/crypto/ap_bus.c b/drivers/s390/crypto/ap_bus.c
index 61f768518a34..24ec282e15d8 100644
--- a/drivers/s390/crypto/ap_bus.c
+++ b/drivers/s390/crypto/ap_bus.c
@@ -599,8 +599,10 @@ static enum ap_wait ap_sm_read(struct ap_device *ap_dev)
         status = ap_sm_recv(ap_dev);
         switch (status.response_code) {
         case AP_RESPONSE_NORMAL:
-                if (ap_dev->queue_count > 0)
+                if (ap_dev->queue_count > 0) {
+                        ap_dev->state = AP_STATE_WORKING;
                         return AP_WAIT_AGAIN;
+                }
                 ap_dev->state = AP_STATE_IDLE;
                 return AP_WAIT_NONE;
         case AP_RESPONSE_NO_PENDING_REPLY:
diff --git a/drivers/s390/virtio/virtio_ccw.c b/drivers/s390/virtio/virtio_ccw.c
index b2a1a81e6fc8..1b831598df7c 100644
--- a/drivers/s390/virtio/virtio_ccw.c
+++ b/drivers/s390/virtio/virtio_ccw.c
@@ -984,6 +984,36 @@ static struct virtqueue *virtio_ccw_vq_by_ind(struct virtio_ccw_device *vcdev,
         return vq;
 }
 
+static void virtio_ccw_check_activity(struct virtio_ccw_device *vcdev,
+                                      __u32 activity)
+{
+        if (vcdev->curr_io & activity) {
+                switch (activity) {
+                case VIRTIO_CCW_DOING_READ_FEAT:
+                case VIRTIO_CCW_DOING_WRITE_FEAT:
+                case VIRTIO_CCW_DOING_READ_CONFIG:
+                case VIRTIO_CCW_DOING_WRITE_CONFIG:
+                case VIRTIO_CCW_DOING_WRITE_STATUS:
+                case VIRTIO_CCW_DOING_SET_VQ:
+                case VIRTIO_CCW_DOING_SET_IND:
+                case VIRTIO_CCW_DOING_SET_CONF_IND:
+                case VIRTIO_CCW_DOING_RESET:
+                case VIRTIO_CCW_DOING_READ_VQ_CONF:
+                case VIRTIO_CCW_DOING_SET_IND_ADAPTER:
+                case VIRTIO_CCW_DOING_SET_VIRTIO_REV:
+                        vcdev->curr_io &= ~activity;
+                        wake_up(&vcdev->wait_q);
+                        break;
+                default:
+                        /* don't know what to do... */
+                        dev_warn(&vcdev->cdev->dev,
+                                 "Suspicious activity '%08x'\n", activity);
+                        WARN_ON(1);
+                        break;
+                }
+        }
+}
+
 static void virtio_ccw_int_handler(struct ccw_device *cdev,
                                    unsigned long intparm,
                                    struct irb *irb)
@@ -995,6 +1025,12 @@ static void virtio_ccw_int_handler(struct ccw_device *cdev,
 
         if (!vcdev)
                 return;
+        if (IS_ERR(irb)) {
+                vcdev->err = PTR_ERR(irb);
+                virtio_ccw_check_activity(vcdev, activity);
+                /* Don't poke around indicators, something's wrong. */
+                return;
+        }
         /* Check if it's a notification from the host. */
         if ((intparm == 0) &&
             (scsw_stctl(&irb->scsw) ==
@@ -1010,31 +1046,7 @@ static void virtio_ccw_int_handler(struct ccw_device *cdev,
                         /* Map everything else to -EIO. */
                         vcdev->err = -EIO;
         }
-        if (vcdev->curr_io & activity) {
-                switch (activity) {
-                case VIRTIO_CCW_DOING_READ_FEAT:
-                case VIRTIO_CCW_DOING_WRITE_FEAT:
-                case VIRTIO_CCW_DOING_READ_CONFIG:
-                case VIRTIO_CCW_DOING_WRITE_CONFIG:
-                case VIRTIO_CCW_DOING_WRITE_STATUS:
-                case VIRTIO_CCW_DOING_SET_VQ:
-                case VIRTIO_CCW_DOING_SET_IND:
-                case VIRTIO_CCW_DOING_SET_CONF_IND:
-                case VIRTIO_CCW_DOING_RESET:
-                case VIRTIO_CCW_DOING_READ_VQ_CONF:
-                case VIRTIO_CCW_DOING_SET_IND_ADAPTER:
-                case VIRTIO_CCW_DOING_SET_VIRTIO_REV:
-                        vcdev->curr_io &= ~activity;
-                        wake_up(&vcdev->wait_q);
-                        break;
-                default:
-                        /* don't know what to do... */
-                        dev_warn(&cdev->dev, "Suspicious activity '%08x'\n",
-                                 activity);
-                        WARN_ON(1);
-                        break;
-                }
-        }
+        virtio_ccw_check_activity(vcdev, activity);
         for_each_set_bit(i, &vcdev->indicators,
                          sizeof(vcdev->indicators) * BITS_PER_BYTE) {
                 /* The bit clear must happen before the vring kick. */
diff --git a/drivers/scsi/Kconfig b/drivers/scsi/Kconfig
index 5f692ae40749..64eed87d34a8 100644
--- a/drivers/scsi/Kconfig
+++ b/drivers/scsi/Kconfig
@@ -364,6 +364,7 @@ config SCSI_HPSA
         tristate "HP Smart Array SCSI driver"
         depends on PCI && SCSI
         select CHECK_SIGNATURE
+        select SCSI_SAS_ATTRS
         help
           This driver supports HP Smart Array Controllers (circa 2009).
           It is a SCSI alternative to the cciss driver, which is a block
@@ -499,6 +500,7 @@ config SCSI_ADVANSYS
         tristate "AdvanSys SCSI support"
         depends on SCSI
         depends on ISA || EISA || PCI
+        depends on ISA_DMA_API || !ISA
         help
           This is a driver for all SCSI host adapters manufactured by
           AdvanSys. It is documented in the kernel source in
diff --git a/drivers/scsi/advansys.c b/drivers/scsi/advansys.c
index 519f9a4b3dad..febbd83e2ecd 100644
--- a/drivers/scsi/advansys.c
+++ b/drivers/scsi/advansys.c
@@ -7803,7 +7803,7 @@ adv_build_req(struct asc_board *boardp, struct scsi_cmnd *scp,
                 return ASC_BUSY;
         }
         scsiqp->sense_addr = cpu_to_le32(sense_addr);
-        scsiqp->sense_len = cpu_to_le32(SCSI_SENSE_BUFFERSIZE);
+        scsiqp->sense_len = SCSI_SENSE_BUFFERSIZE;
 
         /* Build ADV_SCSI_REQ_Q */
 
diff --git a/drivers/scsi/hosts.c b/drivers/scsi/hosts.c
index 323982fd00c3..82ac1cd818ac 100644
--- a/drivers/scsi/hosts.c
+++ b/drivers/scsi/hosts.c
@@ -333,6 +333,17 @@ static void scsi_host_dev_release(struct device *dev)
                 kfree(queuedata);
         }
 
+        if (shost->shost_state == SHOST_CREATED) {
+                /*
+                 * Free the shost_dev device name here if scsi_host_alloc()
+                 * and scsi_host_put() have been called but neither
+                 * scsi_host_add() nor scsi_host_remove() has been called.
+                 * This avoids that the memory allocated for the shost_dev
+                 * name is leaked.
+                 */
+                kfree(dev_name(&shost->shost_dev));
+        }
+
         scsi_destroy_command_freelist(shost);
         if (shost_use_blk_mq(shost)) {
                 if (shost->tag_set.tags)
diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
index 6a8f95808ee0..a3860367b568 100644
--- a/drivers/scsi/hpsa.c
+++ b/drivers/scsi/hpsa.c
@@ -8671,7 +8671,7 @@ static void hpsa_disable_rld_caching(struct ctlr_info *h)
         if ((rc != 0)  || (c->err_info->CommandStatus != 0))
                 goto errout;
 
-        if (*options && HPSA_DIAG_OPTS_DISABLE_RLD_CACHING)
+        if (*options & HPSA_DIAG_OPTS_DISABLE_RLD_CACHING)
                 goto out;
 
 errout:
diff --git a/drivers/scsi/mpt3sas/Kconfig b/drivers/scsi/mpt3sas/Kconfig
index 29061467cc17..b736dbc80485 100644
--- a/drivers/scsi/mpt3sas/Kconfig
+++ b/drivers/scsi/mpt3sas/Kconfig
@@ -71,3 +71,12 @@ config SCSI_MPT3SAS_MAX_SGE
         MAX_PHYS_SEGMENTS in most kernels.  However in SuSE kernels this
         can be 256. However, it may decreased down to 16.  Decreasing this
         parameter will reduce memory requirements on a per controller instance.
+
+config SCSI_MPT2SAS
+        tristate "Legacy MPT2SAS config option"
+        default n
+        select SCSI_MPT3SAS
+        depends on PCI && SCSI
+        ---help---
+        Dummy config option for backwards compatiblity: configure the MPT3SAS
+        driver instead.
diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
index d95206b7e116..9ab77b06434d 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
@@ -3905,8 +3905,7 @@ scsih_qcmd(struct Scsi_Host *shost, struct scsi_cmnd *scmd)
          * We do not expose raid functionality to upper layer for warpdrive.
          */
         if (!ioc->is_warpdrive && !scsih_is_raid(&scmd->device->sdev_gendev)
-            && (sas_device_priv_data->flags & MPT_DEVICE_TLR_ON) &&
-            scmd->cmd_len != 32)
+            && sas_is_tlr_enabled(scmd->device) && scmd->cmd_len != 32)
                 mpi_control |= MPI2_SCSIIO_CONTROL_TLR_ON;
 
         smid = mpt3sas_base_get_smid_scsiio(ioc, ioc->scsi_io_cb_idx, scmd);
diff --git a/drivers/scsi/mvsas/mv_init.c b/drivers/scsi/mvsas/mv_init.c
index 90fdf0e859e3..675e7fab0796 100644
--- a/drivers/scsi/mvsas/mv_init.c
+++ b/drivers/scsi/mvsas/mv_init.c
@@ -758,7 +758,7 @@ mvs_store_interrupt_coalescing(struct device *cdev,
                         struct device_attribute *attr,
                         const char *buffer, size_t size)
 {
-        int val = 0;
+        unsigned int val = 0;
         struct mvs_info *mvi = NULL;
         struct Scsi_Host *shost = class_to_shost(cdev);
         struct sas_ha_struct *sha = SHOST_TO_SAS_HA(shost);
@@ -766,7 +766,7 @@ mvs_store_interrupt_coalescing(struct device *cdev,
         if (buffer == NULL)
                 return size;
 
-        if (sscanf(buffer, "%d", &val) != 1)
+        if (sscanf(buffer, "%u", &val) != 1)
                 return -EINVAL;
 
         if (val >= 0x10000) {
diff --git a/drivers/scsi/qla2xxx/qla_nx.c b/drivers/scsi/qla2xxx/qla_nx.c
index eb0cc5475c45..b6b4cfdd7620 100644
--- a/drivers/scsi/qla2xxx/qla_nx.c
+++ b/drivers/scsi/qla2xxx/qla_nx.c
@@ -433,7 +433,7 @@ qla82xx_pci_get_crb_addr_2M(struct qla_hw_data *ha, ulong off_in,
         if (off_in < QLA82XX_PCI_CRBSPACE)
                 return -1;
 
-        *off_out = (void __iomem *)(off_in - QLA82XX_PCI_CRBSPACE);
+        off_in -= QLA82XX_PCI_CRBSPACE;
 
         /* Try direct map */
         m = &crb_128M_2M_map[CRB_BLK(off_in)].sub_block[CRB_SUBBLK(off_in)];
@@ -443,6 +443,7 @@ qla82xx_pci_get_crb_addr_2M(struct qla_hw_data *ha, ulong off_in,
                 return 0;
         }
         /* Not in direct map, use crb window */
+        *off_out = (void __iomem *)off_in;
         return 1;
 }
 
diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.c b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
index 3ba2e9564b9a..81af294f15a7 100644
--- a/drivers/scsi/qla2xxx/tcm_qla2xxx.c
+++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
@@ -902,7 +902,7 @@ static ssize_t tcm_qla2xxx_tpg_fabric_prot_type_show(struct config_item *item,
         return sprintf(page, "%d\n", tpg->tpg_attrib.fabric_prot_type);
 }
 
-CONFIGFS_ATTR_WO(tcm_qla2xxx_tpg_, enable);
+CONFIGFS_ATTR(tcm_qla2xxx_tpg_, enable);
 CONFIGFS_ATTR_RO(tcm_qla2xxx_tpg_, dynamic_sessions);
 CONFIGFS_ATTR(tcm_qla2xxx_tpg_, fabric_prot_type);
 
diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c
index dfcc45bb03b1..d09d60293c27 100644
--- a/drivers/scsi/scsi_debug.c
+++ b/drivers/scsi/scsi_debug.c
@@ -465,8 +465,9 @@ static const struct opcode_info_t opcode_info_arr[SDEB_I_LAST_ELEMENT + 1] = {
              0} },
         {0, 0, 0, F_INV_OP | FF_RESPOND, NULL, NULL, /* MAINT OUT */
             {0,  0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} },
-        {0, 0, 0, F_INV_OP | FF_RESPOND, NULL, NULL, /* VERIFY */
-            {0,  0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} },
+        {0, 0x2f, 0, F_D_OUT_MAYBE | FF_DIRECT_IO, NULL, NULL, /* VERIFY(10) */
+            {10,  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xc7,
+             0, 0, 0, 0, 0, 0} },
         {1, 0x7f, 0x9, F_SA_HIGH | F_D_IN | FF_DIRECT_IO, resp_read_dt0,
             vl_iarr, {32,  0xc7, 0, 0, 0, 0, 0x1f, 0x18, 0x0, 0x9, 0xfe, 0,
                       0xff, 0xff, 0xff, 0xff} },/* VARIABLE LENGTH, READ(32) */
@@ -477,8 +478,8 @@ static const struct opcode_info_t opcode_info_arr[SDEB_I_LAST_ELEMENT + 1] = {
             {10,  0x13, 0xff, 0xff, 0, 0, 0, 0xff, 0xff, 0xc7, 0, 0, 0, 0, 0,
              0} },
 /* 20 */
-        {0, 0, 0, F_INV_OP | FF_RESPOND, NULL, NULL, /* ALLOW REMOVAL */
-            {0,  0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} },
+        {0, 0x1e, 0, 0, NULL, NULL, /* ALLOW REMOVAL */
+            {6,  0, 0, 0, 0x3, 0xc7, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} },
         {0, 0x1, 0, 0, resp_start_stop, NULL, /* REWIND ?? */
             {6,  0x1, 0, 0, 0, 0xc7, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} },
         {0, 0, 0, F_INV_OP | FF_RESPOND, NULL, NULL, /* ATA_PT */
diff --git a/drivers/scsi/scsi_pm.c b/drivers/scsi/scsi_pm.c
index e4b799837948..459abe1dcc87 100644
--- a/drivers/scsi/scsi_pm.c
+++ b/drivers/scsi/scsi_pm.c
@@ -219,13 +219,13 @@ static int sdev_runtime_suspend(struct device *dev)
         struct scsi_device *sdev = to_scsi_device(dev);
         int err = 0;
 
-        if (pm && pm->runtime_suspend) {
-                err = blk_pre_runtime_suspend(sdev->request_queue);
-                if (err)
-                        return err;
+        err = blk_pre_runtime_suspend(sdev->request_queue);
+        if (err)
+                return err;
+        if (pm && pm->runtime_suspend)
                 err = pm->runtime_suspend(dev);
-                blk_post_runtime_suspend(sdev->request_queue, err);
-        }
+        blk_post_runtime_suspend(sdev->request_queue, err);
+
         return err;
 }
 
@@ -248,11 +248,11 @@ static int sdev_runtime_resume(struct device *dev)
         const struct dev_pm_ops *pm = dev->driver ? dev->driver->pm : NULL;
         int err = 0;
 
-        if (pm && pm->runtime_resume) {
-                blk_pre_runtime_resume(sdev->request_queue);
+        blk_pre_runtime_resume(sdev->request_queue);
+        if (pm && pm->runtime_resume)
                 err = pm->runtime_resume(dev);
-                blk_post_runtime_resume(sdev->request_queue, err);
-        }
+        blk_post_runtime_resume(sdev->request_queue, err);
+
         return err;
 }
 
diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
index 83245391e956..054923e3393c 100644
--- a/drivers/scsi/scsi_scan.c
+++ b/drivers/scsi/scsi_scan.c
@@ -701,9 +701,12 @@ static int scsi_probe_lun(struct scsi_device *sdev, unsigned char *inq_result,
          * strings.
          */
         if (sdev->inquiry_len < 36) {
-                sdev_printk(KERN_INFO, sdev,
-                            "scsi scan: INQUIRY result too short (%d),"
-                            " using 36\n", sdev->inquiry_len);
+                if (!sdev->host->short_inquiry) {
+                        shost_printk(KERN_INFO, sdev->host,
+                                    "scsi scan: INQUIRY result too short (%d),"
+                                    " using 36\n", sdev->inquiry_len);
+                        sdev->host->short_inquiry = 1;
+                }
                 sdev->inquiry_len = 36;
         }
 
diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
index 8d2312239ae0..21930c9ac9cd 100644
--- a/drivers/scsi/scsi_sysfs.c
+++ b/drivers/scsi/scsi_sysfs.c
@@ -1102,6 +1102,14 @@ void __scsi_remove_device(struct scsi_device *sdev)
 {
         struct device *dev = &sdev->sdev_gendev;
 
+        /*
+         * This cleanup path is not reentrant and while it is impossible
+         * to get a new reference with scsi_device_get() someone can still
+         * hold a previously acquired one.
+         */
+        if (sdev->sdev_state == SDEV_DEL)
+                return;
+
         if (sdev->is_visible) {
                 if (scsi_device_set_state(sdev, SDEV_CANCEL) != 0)
                         return;
@@ -1110,7 +1118,9 @@ void __scsi_remove_device(struct scsi_device *sdev)
                 device_unregister(&sdev->sdev_dev);
                 transport_remove_device(dev);
                 scsi_dh_remove_device(sdev);
-        }
+                device_del(dev);
+        } else
+                put_device(&sdev->sdev_dev);
 
         /*
          * Stop accepting new requests and wait until all queuecommand() and
@@ -1121,16 +1131,6 @@ void __scsi_remove_device(struct scsi_device *sdev)
         blk_cleanup_queue(sdev->request_queue);
         cancel_work_sync(&sdev->requeue_work);
 
-        /*
-         * Remove the device after blk_cleanup_queue() has been called such
-         * a possible bdi_register() call with the same name occurs after
-         * blk_cleanup_queue() has called bdi_destroy().
-         */
-        if (sdev->is_visible)
-                device_del(dev);
-        else
-                put_device(&sdev->sdev_dev);
-
         if (sdev->host->hostt->slave_destroy)
                 sdev->host->hostt->slave_destroy(sdev);
         transport_destroy_device(dev);
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index 54519804c46a..3d22fc3e3c1a 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -638,11 +638,24 @@ static void sd_config_discard(struct scsi_disk *sdkp, unsigned int mode)
         unsigned int max_blocks = 0;
 
         q->limits.discard_zeroes_data = 0;
-        q->limits.discard_alignment = sdkp->unmap_alignment *
-                logical_block_size;
-        q->limits.discard_granularity =
-                max(sdkp->physical_block_size,
-                    sdkp->unmap_granularity * logical_block_size);
+
+        /*
+         * When LBPRZ is reported, discard alignment and granularity
+         * must be fixed to the logical block size. Otherwise the block
+         * layer will drop misaligned portions of the request which can
+         * lead to data corruption. If LBPRZ is not set, we honor the
+         * device preference.
+         */
+        if (sdkp->lbprz) {
+                q->limits.discard_alignment = 0;
+                q->limits.discard_granularity = 1;
+        } else {
+                q->limits.discard_alignment = sdkp->unmap_alignment *
+                        logical_block_size;
+                q->limits.discard_granularity =
+                        max(sdkp->physical_block_size,
+                            sdkp->unmap_granularity * logical_block_size);
+        }
 
         sdkp->provisioning_mode = mode;
 
@@ -2321,11 +2334,8 @@ got_data:
                 }
         }
 
-        if (sdkp->capacity > 0xffffffff) {
+        if (sdkp->capacity > 0xffffffff)
                 sdp->use_16_for_rw = 1;
-                sdkp->max_xfer_blocks = SD_MAX_XFER_BLOCKS;
-        } else
-                sdkp->max_xfer_blocks = SD_DEF_XFER_BLOCKS;
 
         /* Rescale capacity to 512-byte units */
         if (sector_size == 4096)
@@ -2642,7 +2652,6 @@ static void sd_read_block_limits(struct scsi_disk *sdkp)
 {
         unsigned int sector_sz = sdkp->device->sector_size;
         const int vpd_len = 64;
-        u32 max_xfer_length;
         unsigned char *buffer = kmalloc(vpd_len, GFP_KERNEL);
 
         if (!buffer ||
@@ -2650,14 +2659,11 @@ static void sd_read_block_limits(struct scsi_disk *sdkp)
             scsi_get_vpd_page(sdkp->device, 0xb0, buffer, vpd_len))
                 goto out;
 
-        max_xfer_length = get_unaligned_be32(&buffer[8]);
-        if (max_xfer_length)
-                sdkp->max_xfer_blocks = max_xfer_length;
-
         blk_queue_io_min(sdkp->disk->queue,
                          get_unaligned_be16(&buffer[6]) * sector_sz);
-        blk_queue_io_opt(sdkp->disk->queue,
-                         get_unaligned_be32(&buffer[12]) * sector_sz);
+
+        sdkp->max_xfer_blocks = get_unaligned_be32(&buffer[8]);
+        sdkp->opt_xfer_blocks = get_unaligned_be32(&buffer[12]);
 
         if (buffer[3] == 0x3c) {
                 unsigned int lba_count, desc_count;
@@ -2806,6 +2812,11 @@ static int sd_try_extended_inquiry(struct scsi_device *sdp)
         return 0;
 }
 
+static inline u32 logical_to_sectors(struct scsi_device *sdev, u32 blocks)
+{
+        return blocks << (ilog2(sdev->sector_size) - 9);
+}
+
 /**
  *      sd_revalidate_disk - called the first time a new disk is seen,
  *      performs disk spin up, read_capacity, etc.
@@ -2815,8 +2826,9 @@ static int sd_revalidate_disk(struct gendisk *disk)
 {
         struct scsi_disk *sdkp = scsi_disk(disk);
         struct scsi_device *sdp = sdkp->device;
+        struct request_queue *q = sdkp->disk->queue;
         unsigned char *buffer;
-        unsigned int max_xfer;
+        unsigned int dev_max, rw_max;
 
         SCSI_LOG_HLQUEUE(3, sd_printk(KERN_INFO, sdkp,
                                       "sd_revalidate_disk\n"));
@@ -2864,11 +2876,26 @@ static int sd_revalidate_disk(struct gendisk *disk)
          */
         sd_set_flush_flag(sdkp);
 
-        max_xfer = sdkp->max_xfer_blocks;
-        max_xfer <<= ilog2(sdp->sector_size) - 9;
+        /* Initial block count limit based on CDB TRANSFER LENGTH field size. */
+        dev_max = sdp->use_16_for_rw ? SD_MAX_XFER_BLOCKS : SD_DEF_XFER_BLOCKS;
+
+        /* Some devices report a maximum block count for READ/WRITE requests. */
+        dev_max = min_not_zero(dev_max, sdkp->max_xfer_blocks);
+        q->limits.max_dev_sectors = logical_to_sectors(sdp, dev_max);
+
+        /*
+         * Use the device's preferred I/O size for reads and writes
+         * unless the reported value is unreasonably large (or garbage).
+         */
+        if (sdkp->opt_xfer_blocks && sdkp->opt_xfer_blocks <= dev_max &&
+            sdkp->opt_xfer_blocks <= SD_DEF_XFER_BLOCKS)
+                rw_max = q->limits.io_opt =
+                        logical_to_sectors(sdp, sdkp->opt_xfer_blocks);
+        else
+                rw_max = BLK_DEF_MAX_SECTORS;
 
-        sdkp->disk->queue->limits.max_sectors =
-                min_not_zero(queue_max_hw_sectors(sdkp->disk->queue), max_xfer);
+        /* Combine with controller limits */
+        q->limits.max_sectors = min(rw_max, queue_max_hw_sectors(q));
 
         set_capacity(disk, sdkp->capacity);
         sd_config_write_same(sdkp);
diff --git a/drivers/scsi/sd.h b/drivers/scsi/sd.h
index 63ba5ca7f9a1..5f2a84aff29f 100644
--- a/drivers/scsi/sd.h
+++ b/drivers/scsi/sd.h
@@ -67,6 +67,7 @@ struct scsi_disk {
         atomic_t        openers;
         sector_t        capacity;       /* size in 512-byte sectors */
         u32             max_xfer_blocks;
+        u32             opt_xfer_blocks;
         u32             max_ws_blocks;
         u32             max_unmap_blocks;
         u32             unmap_granularity;
diff --git a/drivers/scsi/ses.c b/drivers/scsi/ses.c
index dcb0d76d7312..044d06410d4c 100644
--- a/drivers/scsi/ses.c
+++ b/drivers/scsi/ses.c
@@ -84,6 +84,7 @@ static void init_device_slot_control(unsigned char *dest_desc,
 static int ses_recv_diag(struct scsi_device *sdev, int page_code,
                          void *buf, int bufflen)
 {
+        int ret;
         unsigned char cmd[] = {
                 RECEIVE_DIAGNOSTIC,
                 1,              /* Set PCV bit */
@@ -92,9 +93,26 @@ static int ses_recv_diag(struct scsi_device *sdev, int page_code,
                 bufflen & 0xff,
                 0
         };
+        unsigned char recv_page_code;
 
-        return scsi_execute_req(sdev, cmd, DMA_FROM_DEVICE, buf, bufflen,
+        ret =  scsi_execute_req(sdev, cmd, DMA_FROM_DEVICE, buf, bufflen,
                                 NULL, SES_TIMEOUT, SES_RETRIES, NULL);
+        if (unlikely(!ret))
+                return ret;
+
+        recv_page_code = ((unsigned char *)buf)[0];
+
+        if (likely(recv_page_code == page_code))
+                return ret;
+
+        /* successful diagnostic but wrong page code.  This happens to some
+         * USB devices, just print a message and pretend there was an error */
+
+        sdev_printk(KERN_ERR, sdev,
+                    "Wrong diagnostic page; asked for %d got %u\n",
+                    page_code, recv_page_code);
+
+        return -EINVAL;
 }
 
 static int ses_send_diag(struct scsi_device *sdev, int page_code,
@@ -541,7 +559,15 @@ static void ses_enclosure_data_process(struct enclosure_device *edev,
                         if (desc_ptr)
                                 desc_ptr += len;
 
-                        if (addl_desc_ptr)
+                        if (addl_desc_ptr &&
+                            /* only find additional descriptions for specific devices */
+                            (type_ptr[0] == ENCLOSURE_COMPONENT_DEVICE ||
+                             type_ptr[0] == ENCLOSURE_COMPONENT_ARRAY_DEVICE ||
+                             type_ptr[0] == ENCLOSURE_COMPONENT_SAS_EXPANDER ||
+                             /* these elements are optional */
+                             type_ptr[0] == ENCLOSURE_COMPONENT_SCSI_TARGET_PORT ||
+                             type_ptr[0] == ENCLOSURE_COMPONENT_SCSI_INITIATOR_PORT ||
+                             type_ptr[0] == ENCLOSURE_COMPONENT_CONTROLLER_ELECTRONICS))
                                 addl_desc_ptr += addl_desc_ptr[1] + 2;
 
                 }
diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c
index e0a1e52a04e7..2e522951b619 100644
--- a/drivers/scsi/st.c
+++ b/drivers/scsi/st.c
@@ -4083,6 +4083,7 @@ static int create_one_cdev(struct scsi_tape *tape, int mode, int rew)
         }
         cdev->owner = THIS_MODULE;
         cdev->ops = &st_fops;
+        STm->cdevs[rew] = cdev;
 
         error = cdev_add(cdev, cdev_devno, 1);
         if (error) {
@@ -4091,7 +4092,6 @@ static int create_one_cdev(struct scsi_tape *tape, int mode, int rew)
                 pr_err("st%d: Device not attached.\n", dev_num);
                 goto out_free;
         }
-        STm->cdevs[rew] = cdev;
 
         i = mode << (4 - ST_NBR_MODE_BITS);
         snprintf(name, 10, "%s%s%s", rew ? "n" : "",
@@ -4110,8 +4110,9 @@ static int create_one_cdev(struct scsi_tape *tape, int mode, int rew)
         return 0;
 out_free:
         cdev_del(STm->cdevs[rew]);
-        STm->cdevs[rew] = NULL;
 out:
+        STm->cdevs[rew] = NULL;
+        STm->devs[rew] = NULL;
         return error;
 }
 
diff --git a/drivers/soc/mediatek/Kconfig b/drivers/soc/mediatek/Kconfig
index 9d5068248aa0..0a4ea809a61b 100644
--- a/drivers/soc/mediatek/Kconfig
+++ b/drivers/soc/mediatek/Kconfig
@@ -23,6 +23,7 @@ config MTK_PMIC_WRAP
 config MTK_SCPSYS
         bool "MediaTek SCPSYS Support"
         depends on ARCH_MEDIATEK || COMPILE_TEST
+        default ARM64 && ARCH_MEDIATEK
         select REGMAP
         select MTK_INFRACFG
         select PM_GENERIC_DOMAINS if PM
diff --git a/drivers/soc/ti/knav_qmss_queue.c b/drivers/soc/ti/knav_qmss_queue.c
index f3a0b6a4b54e..8c03a80b482d 100644
--- a/drivers/soc/ti/knav_qmss_queue.c
+++ b/drivers/soc/ti/knav_qmss_queue.c
@@ -1179,7 +1179,7 @@ static int knav_queue_setup_link_ram(struct knav_device *kdev)
 
                 block++;
                 if (!block->size)
-                        return 0;
+                        continue;
 
                 dev_dbg(kdev->dev, "linkram1: phys:%x, virt:%p, size:%x\n",
                         block->phys, block->virt, block->size);
@@ -1519,9 +1519,9 @@ static int knav_queue_load_pdsp(struct knav_device *kdev,
 
         for (i = 0; i < ARRAY_SIZE(knav_acc_firmwares); i++) {
                 if (knav_acc_firmwares[i]) {
-                        ret = request_firmware(&fw,
-                                               knav_acc_firmwares[i],
-                                               kdev->dev);
+                        ret = request_firmware_direct(&fw,
+                                                      knav_acc_firmwares[i],
+                                                      kdev->dev);
                         if (!ret) {
                                 found = true;
                                 break;
diff --git a/drivers/spi/spi-bcm63xx.c b/drivers/spi/spi-bcm63xx.c
index 06858e04ec59..bf9a610e5b89 100644
--- a/drivers/spi/spi-bcm63xx.c
+++ b/drivers/spi/spi-bcm63xx.c
@@ -562,8 +562,8 @@ static int bcm63xx_spi_probe(struct platform_device *pdev)
                 goto out_clk_disable;
         }
 
-        dev_info(dev, "at 0x%08x (irq %d, FIFOs size %d)\n",
-                 r->start, irq, bs->fifo_size);
+        dev_info(dev, "at %pr (irq %d, FIFOs size %d)\n",
+                 r, irq, bs->fifo_size);
 
         return 0;
 
diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c
index 59a11437db70..39412c9097c6 100644
--- a/drivers/spi/spi-fsl-dspi.c
+++ b/drivers/spi/spi-fsl-dspi.c
@@ -167,7 +167,7 @@ static inline int is_double_byte_mode(struct fsl_dspi *dspi)
 {
         unsigned int val;
 
-        regmap_read(dspi->regmap, SPI_CTAR(dspi->cs), &val);
+        regmap_read(dspi->regmap, SPI_CTAR(0), &val);
 
         return ((val & SPI_FRAME_BITS_MASK) == SPI_FRAME_BITS(8)) ? 0 : 1;
 }
@@ -257,7 +257,7 @@ static u32 dspi_data_to_pushr(struct fsl_dspi *dspi, int tx_word)
 
         return  SPI_PUSHR_TXDATA(d16) |
                 SPI_PUSHR_PCS(dspi->cs) |
-                SPI_PUSHR_CTAS(dspi->cs) |
+                SPI_PUSHR_CTAS(0) |
                 SPI_PUSHR_CONT;
 }
 
@@ -290,7 +290,7 @@ static int dspi_eoq_write(struct fsl_dspi *dspi)
                  */
                 if (tx_word && (dspi->len == 1)) {
                         dspi->dataflags |= TRAN_STATE_WORD_ODD_NUM;
-                        regmap_update_bits(dspi->regmap, SPI_CTAR(dspi->cs),
+                        regmap_update_bits(dspi->regmap, SPI_CTAR(0),
                                         SPI_FRAME_BITS_MASK, SPI_FRAME_BITS(8));
                         tx_word = 0;
                 }
@@ -339,7 +339,7 @@ static int dspi_tcfq_write(struct fsl_dspi *dspi)
 
         if (tx_word && (dspi->len == 1)) {
                 dspi->dataflags |= TRAN_STATE_WORD_ODD_NUM;
-                regmap_update_bits(dspi->regmap, SPI_CTAR(dspi->cs),
+                regmap_update_bits(dspi->regmap, SPI_CTAR(0),
                                 SPI_FRAME_BITS_MASK, SPI_FRAME_BITS(8));
                 tx_word = 0;
         }
@@ -407,7 +407,7 @@ static int dspi_transfer_one_message(struct spi_master *master,
                 regmap_update_bits(dspi->regmap, SPI_MCR,
                                 SPI_MCR_CLR_TXF | SPI_MCR_CLR_RXF,
                                 SPI_MCR_CLR_TXF | SPI_MCR_CLR_RXF);
-                regmap_write(dspi->regmap, SPI_CTAR(dspi->cs),
+                regmap_write(dspi->regmap, SPI_CTAR(0),
                                 dspi->cur_chip->ctar_val);
 
                 trans_mode = dspi->devtype_data->trans_mode;
@@ -566,7 +566,7 @@ static irqreturn_t dspi_interrupt(int irq, void *dev_id)
                 if (!dspi->len) {
                         if (dspi->dataflags & TRAN_STATE_WORD_ODD_NUM) {
                                 regmap_update_bits(dspi->regmap,
-                                                   SPI_CTAR(dspi->cs),
+                                                   SPI_CTAR(0),
                                                    SPI_FRAME_BITS_MASK,
                                                    SPI_FRAME_BITS(16));
                                 dspi->dataflags &= ~TRAN_STATE_WORD_ODD_NUM;
diff --git a/drivers/spi/spi-mt65xx.c b/drivers/spi/spi-mt65xx.c
index 563954a61424..7840067062a8 100644
--- a/drivers/spi/spi-mt65xx.c
+++ b/drivers/spi/spi-mt65xx.c
@@ -410,7 +410,7 @@ static int mtk_spi_setup(struct spi_device *spi)
         if (!spi->controller_data)
                 spi->controller_data = (void *)&mtk_default_chip_info;
 
-        if (mdata->dev_comp->need_pad_sel)
+        if (mdata->dev_comp->need_pad_sel && gpio_is_valid(spi->cs_gpio))
                 gpio_direction_output(spi->cs_gpio, !(spi->mode & SPI_CS_HIGH));
 
         return 0;
@@ -632,13 +632,23 @@ static int mtk_spi_probe(struct platform_device *pdev)
                         goto err_put_master;
                 }
 
-                for (i = 0; i < master->num_chipselect; i++) {
-                        ret = devm_gpio_request(&pdev->dev, master->cs_gpios[i],
-                                                dev_name(&pdev->dev));
-                        if (ret) {
-                                dev_err(&pdev->dev,
-                                        "can't get CS GPIO %i\n", i);
-                                goto err_put_master;
+                if (!master->cs_gpios && master->num_chipselect > 1) {
+                        dev_err(&pdev->dev,
+                                "cs_gpios not specified and num_chipselect > 1\n");
+                        ret = -EINVAL;
+                        goto err_put_master;
+                }
+
+                if (master->cs_gpios) {
+                        for (i = 0; i < master->num_chipselect; i++) {
+                                ret = devm_gpio_request(&pdev->dev,
+                                                        master->cs_gpios[i],
+                                                        dev_name(&pdev->dev));
+                                if (ret) {
+                                        dev_err(&pdev->dev,
+                                                "can't get CS GPIO %i\n", i);
+                                        goto err_put_master;
+                                }
                         }
                 }
         }
diff --git a/drivers/spi/spi-pl022.c b/drivers/spi/spi-pl022.c
index 94af80676684..5e5fd77e2711 100644
--- a/drivers/spi/spi-pl022.c
+++ b/drivers/spi/spi-pl022.c
@@ -1171,19 +1171,31 @@ err_no_rxchan:
 static int pl022_dma_autoprobe(struct pl022 *pl022)
 {
         struct device *dev = &pl022->adev->dev;
+        struct dma_chan *chan;
+        int err;
 
         /* automatically configure DMA channels from platform, normally using DT */
-        pl022->dma_rx_channel = dma_request_slave_channel(dev, "rx");
-        if (!pl022->dma_rx_channel)
+        chan = dma_request_slave_channel_reason(dev, "rx");
+        if (IS_ERR(chan)) {
+                err = PTR_ERR(chan);
                 goto err_no_rxchan;
+        }
+
+        pl022->dma_rx_channel = chan;
 
-        pl022->dma_tx_channel = dma_request_slave_channel(dev, "tx");
-        if (!pl022->dma_tx_channel)
+        chan = dma_request_slave_channel_reason(dev, "tx");
+        if (IS_ERR(chan)) {
+                err = PTR_ERR(chan);
                 goto err_no_txchan;
+        }
+
+        pl022->dma_tx_channel = chan;
 
         pl022->dummypage = kmalloc(PAGE_SIZE, GFP_KERNEL);
-        if (!pl022->dummypage)
+        if (!pl022->dummypage) {
+                err = -ENOMEM;
                 goto err_no_dummypage;
+        }
 
         return 0;
 
@@ -1194,7 +1206,7 @@ err_no_txchan:
         dma_release_channel(pl022->dma_rx_channel);
         pl022->dma_rx_channel = NULL;
 err_no_rxchan:
-        return -ENODEV;
+        return err;
 }
                 
 static void terminate_dma(struct pl022 *pl022)
@@ -2236,6 +2248,10 @@ static int pl022_probe(struct amba_device *adev, const struct amba_id *id)
 
         /* Get DMA channels, try autoconfiguration first */
         status = pl022_dma_autoprobe(pl022);
+        if (status == -EPROBE_DEFER) {
+                dev_dbg(dev, "deferring probe to get DMA channel\n");
+                goto err_no_irq;
+        }
 
         /* If that failed, use channels from platform_info */
         if (status == 0)
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index e2415be209d5..dee1cb87d24f 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -376,6 +376,7 @@ static void spi_drv_shutdown(struct device *dev)
 
 /**
  * __spi_register_driver - register a SPI driver
+ * @owner: owner module of the driver to register
  * @sdrv: the driver to register
  * Context: can sleep
  *
@@ -1704,7 +1705,7 @@ struct spi_master *spi_alloc_master(struct device *dev, unsigned size)
         master->bus_num = -1;
         master->num_chipselect = 1;
         master->dev.class = &spi_master_class;
-        master->dev.parent = get_device(dev);
+        master->dev.parent = dev;
         spi_master_set_devdata(master, &master[1]);
 
         return master;
@@ -2130,6 +2131,7 @@ static int __spi_validate(struct spi_device *spi, struct spi_message *message)
          * Set transfer tx_nbits and rx_nbits as single transfer default
          * (SPI_NBITS_SINGLE) if it is not set for this transfer.
          */
+        message->frame_length = 0;
         list_for_each_entry(xfer, &message->transfers, transfer_list) {
                 message->frame_length += xfer->len;
                 if (!xfer->bits_per_word)
diff --git a/drivers/spi/spidev.c b/drivers/spi/spidev.c
index 91a0fcd72423..d0e7dfc647cf 100644
--- a/drivers/spi/spidev.c
+++ b/drivers/spi/spidev.c
@@ -651,11 +651,11 @@ static int spidev_release(struct inode *inode, struct file *filp)
                 kfree(spidev->rx_buffer);
                 spidev->rx_buffer = NULL;
 
+                spin_lock_irq(&spidev->spi_lock);
                 if (spidev->spi)
                         spidev->speed_hz = spidev->spi->max_speed_hz;
 
                 /* ... after we unbound from the underlying device? */
-                spin_lock_irq(&spidev->spi_lock);
                 dofree = (spidev->spi == NULL);
                 spin_unlock_irq(&spidev->spi_lock);
 
diff --git a/drivers/staging/android/ion/ion_chunk_heap.c b/drivers/staging/android/ion/ion_chunk_heap.c
index 195c41d7bd53..0813163f962f 100644
--- a/drivers/staging/android/ion/ion_chunk_heap.c
+++ b/drivers/staging/android/ion/ion_chunk_heap.c
@@ -81,7 +81,7 @@ static int ion_chunk_heap_allocate(struct ion_heap *heap,
 err:
         sg = table->sgl;
         for (i -= 1; i >= 0; i--) {
-                gen_pool_free(chunk_heap->pool, sg_phys(sg) & PAGE_MASK,
+                gen_pool_free(chunk_heap->pool, page_to_phys(sg_page(sg)),
                               sg->length);
                 sg = sg_next(sg);
         }
@@ -109,7 +109,7 @@ static void ion_chunk_heap_free(struct ion_buffer *buffer)
                                                         DMA_BIDIRECTIONAL);
 
         for_each_sg(table->sgl, sg, table->nents, i) {
-                gen_pool_free(chunk_heap->pool, sg_phys(sg) & PAGE_MASK,
+                gen_pool_free(chunk_heap->pool, page_to_phys(sg_page(sg)),
                               sg->length);
         }
         chunk_heap->allocated -= allocated_size;
diff --git a/drivers/staging/iio/iio_simple_dummy_events.c b/drivers/staging/iio/iio_simple_dummy_events.c
index bfbf1c56bd22..6eb600ff7056 100644
--- a/drivers/staging/iio/iio_simple_dummy_events.c
+++ b/drivers/staging/iio/iio_simple_dummy_events.c
@@ -159,7 +159,7 @@ static irqreturn_t iio_simple_dummy_get_timestamp(int irq, void *private)
         struct iio_dummy_state *st = iio_priv(indio_dev);
 
         st->event_timestamp = iio_get_time_ns();
-        return IRQ_HANDLED;
+        return IRQ_WAKE_THREAD;
 }
 
 /**
diff --git a/drivers/staging/lustre/include/linux/libcfs/libcfs_ioctl.h b/drivers/staging/lustre/include/linux/libcfs/libcfs_ioctl.h
index f5d741f25ffd..485ab2670918 100644
--- a/drivers/staging/lustre/include/linux/libcfs/libcfs_ioctl.h
+++ b/drivers/staging/lustre/include/linux/libcfs/libcfs_ioctl.h
@@ -110,7 +110,6 @@ struct libcfs_ioctl_handler {
 #define IOC_LIBCFS_CLEAR_DEBUG       _IOWR('e', 31, long)
 #define IOC_LIBCFS_MARK_DEBUG         _IOWR('e', 32, long)
 #define IOC_LIBCFS_MEMHOG                 _IOWR('e', 36, long)
-#define IOC_LIBCFS_PING_TEST           _IOWR('e', 37, long)
 /* lnet ioctls */
 #define IOC_LIBCFS_GET_NI                 _IOWR('e', 50, long)
 #define IOC_LIBCFS_FAIL_NID             _IOWR('e', 51, long)
diff --git a/drivers/staging/lustre/lustre/libcfs/module.c b/drivers/staging/lustre/lustre/libcfs/module.c
index 07a68594c279..e7c2b26156b9 100644
--- a/drivers/staging/lustre/lustre/libcfs/module.c
+++ b/drivers/staging/lustre/lustre/libcfs/module.c
@@ -274,23 +274,6 @@ static int libcfs_ioctl_int(struct cfs_psdev_file *pfile, unsigned long cmd,
                 }
                 break;
 
-        case IOC_LIBCFS_PING_TEST: {
-                extern void (kping_client)(struct libcfs_ioctl_data *);
-                void (*ping)(struct libcfs_ioctl_data *);
-
-                CDEBUG(D_IOCTL, "doing %d pings to nid %s (%s)\n",
-                       data->ioc_count, libcfs_nid2str(data->ioc_nid),
-                       libcfs_nid2str(data->ioc_nid));
-                ping = symbol_get(kping_client);
-                if (!ping)
-                        CERROR("symbol_get failed\n");
-                else {
-                        ping(data);
-                        symbol_put(kping_client);
-                }
-                return 0;
-        }
-
         default: {
                 struct libcfs_ioctl_handler *hand;
 
diff --git a/drivers/staging/lustre/lustre/obdecho/echo_client.c b/drivers/staging/lustre/lustre/obdecho/echo_client.c
index f61ef669644c..a4a9a763ff02 100644
--- a/drivers/staging/lustre/lustre/obdecho/echo_client.c
+++ b/drivers/staging/lustre/lustre/obdecho/echo_client.c
@@ -1270,6 +1270,7 @@ static int
 echo_copyout_lsm(struct lov_stripe_md *lsm, void *_ulsm, int ulsm_nob)
 {
         struct lov_stripe_md *ulsm = _ulsm;
+        struct lov_oinfo **p;
         int nob, i;
 
         nob = offsetof(struct lov_stripe_md, lsm_oinfo[lsm->lsm_stripe_count]);
@@ -1279,9 +1280,10 @@ echo_copyout_lsm(struct lov_stripe_md *lsm, void *_ulsm, int ulsm_nob)
         if (copy_to_user(ulsm, lsm, sizeof(*ulsm)))
                 return -EFAULT;
 
-        for (i = 0; i < lsm->lsm_stripe_count; i++) {
-                if (copy_to_user(ulsm->lsm_oinfo[i], lsm->lsm_oinfo[i],
-                                      sizeof(lsm->lsm_oinfo[0])))
+        for (i = 0, p = lsm->lsm_oinfo; i < lsm->lsm_stripe_count; i++, p++) {
+                struct lov_oinfo __user *up;
+                if (get_user(up, ulsm->lsm_oinfo + i) ||
+                    copy_to_user(up, *p, sizeof(struct lov_oinfo)))
                         return -EFAULT;
         }
         return 0;
@@ -1289,9 +1291,10 @@ echo_copyout_lsm(struct lov_stripe_md *lsm, void *_ulsm, int ulsm_nob)
 
 static int
 echo_copyin_lsm(struct echo_device *ed, struct lov_stripe_md *lsm,
-                 void *ulsm, int ulsm_nob)
+                struct lov_stripe_md __user *ulsm, int ulsm_nob)
 {
         struct echo_client_obd *ec = ed->ed_ec;
+        struct lov_oinfo **p;
         int                  i;
 
         if (ulsm_nob < sizeof(*lsm))
@@ -1306,11 +1309,10 @@ echo_copyin_lsm(struct echo_device *ed, struct lov_stripe_md *lsm,
             ((__u64)lsm->lsm_stripe_size * lsm->lsm_stripe_count > ~0UL))
                 return -EINVAL;
 
-        for (i = 0; i < lsm->lsm_stripe_count; i++) {
-                if (copy_from_user(lsm->lsm_oinfo[i],
-                                       ((struct lov_stripe_md *)ulsm)-> \
-                                       lsm_oinfo[i],
-                                       sizeof(lsm->lsm_oinfo[0])))
+        for (i = 0, p = lsm->lsm_oinfo; i < lsm->lsm_stripe_count; i++, p++) {
+                struct lov_oinfo __user *up;
+                if (get_user(up, ulsm->lsm_oinfo + i) ||
+                    copy_from_user(*p, up, sizeof(struct lov_oinfo)))
                         return -EFAULT;
         }
         return 0;
diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
index 342a07c58d89..72204fbf2bb1 100644
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -4074,6 +4074,17 @@ reject:
         return iscsit_add_reject(conn, ISCSI_REASON_BOOKMARK_NO_RESOURCES, buf);
 }
 
+static bool iscsi_target_check_conn_state(struct iscsi_conn *conn)
+{
+        bool ret;
+
+        spin_lock_bh(&conn->state_lock);
+        ret = (conn->conn_state != TARG_CONN_STATE_LOGGED_IN);
+        spin_unlock_bh(&conn->state_lock);
+
+        return ret;
+}
+
 int iscsi_target_rx_thread(void *arg)
 {
         int ret, rc;
@@ -4091,7 +4102,7 @@ int iscsi_target_rx_thread(void *arg)
          * incoming iscsi/tcp socket I/O, and/or failing the connection.
          */
         rc = wait_for_completion_interruptible(&conn->rx_login_comp);
-        if (rc < 0)
+        if (rc < 0 || iscsi_target_check_conn_state(conn))
                 return 0;
 
         if (conn->conn_transport->transport_type == ISCSI_INFINIBAND) {
diff --git a/drivers/target/iscsi/iscsi_target_nego.c b/drivers/target/iscsi/iscsi_target_nego.c
index 5c964c09c89f..9fc9117d0f22 100644
--- a/drivers/target/iscsi/iscsi_target_nego.c
+++ b/drivers/target/iscsi/iscsi_target_nego.c
@@ -388,6 +388,7 @@ err:
         if (login->login_complete) {
                 if (conn->rx_thread && conn->rx_thread_active) {
                         send_sig(SIGINT, conn->rx_thread, 1);
+                        complete(&conn->rx_login_comp);
                         kthread_stop(conn->rx_thread);
                 }
                 if (conn->tx_thread && conn->tx_thread_active) {
diff --git a/drivers/target/iscsi/iscsi_target_parameters.c b/drivers/target/iscsi/iscsi_target_parameters.c
index 51d1734d5390..2cbea2af7cd0 100644
--- a/drivers/target/iscsi/iscsi_target_parameters.c
+++ b/drivers/target/iscsi/iscsi_target_parameters.c
@@ -208,7 +208,7 @@ int iscsi_create_default_params(struct iscsi_param_list **param_list_ptr)
         if (!pl) {
                 pr_err("Unable to allocate memory for"
                                 " struct iscsi_param_list.\n");
-                return -1 ;
+                return -ENOMEM;
         }
         INIT_LIST_HEAD(&pl->param_list);
         INIT_LIST_HEAD(&pl->extra_response_list);
@@ -578,7 +578,7 @@ int iscsi_copy_param_list(
         param_list = kzalloc(sizeof(struct iscsi_param_list), GFP_KERNEL);
         if (!param_list) {
                 pr_err("Unable to allocate memory for struct iscsi_param_list.\n");
-                return -1;
+                return -ENOMEM;
         }
         INIT_LIST_HEAD(&param_list->param_list);
         INIT_LIST_HEAD(&param_list->extra_response_list);
@@ -629,7 +629,7 @@ int iscsi_copy_param_list(
 
 err_out:
         iscsi_release_param_list(param_list);
-        return -1;
+        return -ENOMEM;
 }
 
 static void iscsi_release_extra_responses(struct iscsi_param_list *param_list)
@@ -729,7 +729,7 @@ static int iscsi_add_notunderstood_response(
         if (!extra_response) {
                 pr_err("Unable to allocate memory for"
                         " struct iscsi_extra_response.\n");
-                return -1;
+                return -ENOMEM;
         }
         INIT_LIST_HEAD(&extra_response->er_list);
 
@@ -1370,7 +1370,7 @@ int iscsi_decode_text_input(
         tmpbuf = kzalloc(length + 1, GFP_KERNEL);
         if (!tmpbuf) {
                 pr_err("Unable to allocate %u + 1 bytes for tmpbuf.\n", length);
-                return -1;
+                return -ENOMEM;
         }
 
         memcpy(tmpbuf, textbuf, length);
diff --git a/drivers/target/target_core_sbc.c b/drivers/target/target_core_sbc.c
index 0b4b2a67d9f9..98698d875742 100644
--- a/drivers/target/target_core_sbc.c
+++ b/drivers/target/target_core_sbc.c
@@ -371,7 +371,8 @@ sbc_setup_write_same(struct se_cmd *cmd, unsigned char *flags, struct sbc_ops *o
         return 0;
 }
 
-static sense_reason_t xdreadwrite_callback(struct se_cmd *cmd, bool success)
+static sense_reason_t xdreadwrite_callback(struct se_cmd *cmd, bool success,
+                                           int *post_ret)
 {
         unsigned char *buf, *addr;
         struct scatterlist *sg;
@@ -437,7 +438,8 @@ sbc_execute_rw(struct se_cmd *cmd)
                                cmd->data_direction);
 }
 
-static sense_reason_t compare_and_write_post(struct se_cmd *cmd, bool success)
+static sense_reason_t compare_and_write_post(struct se_cmd *cmd, bool success,
+                                             int *post_ret)
 {
         struct se_device *dev = cmd->se_dev;
 
@@ -447,8 +449,10 @@ static sense_reason_t compare_and_write_post(struct se_cmd *cmd, bool success)
          * sent to the backend driver.
          */
         spin_lock_irq(&cmd->t_state_lock);
-        if ((cmd->transport_state & CMD_T_SENT) && !cmd->scsi_status)
+        if ((cmd->transport_state & CMD_T_SENT) && !cmd->scsi_status) {
                 cmd->se_cmd_flags |= SCF_COMPARE_AND_WRITE_POST;
+                *post_ret = 1;
+        }
         spin_unlock_irq(&cmd->t_state_lock);
 
         /*
@@ -460,7 +464,8 @@ static sense_reason_t compare_and_write_post(struct se_cmd *cmd, bool success)
         return TCM_NO_SENSE;
 }
 
-static sense_reason_t compare_and_write_callback(struct se_cmd *cmd, bool success)
+static sense_reason_t compare_and_write_callback(struct se_cmd *cmd, bool success,
+                                                 int *post_ret)
 {
         struct se_device *dev = cmd->se_dev;
         struct scatterlist *write_sg = NULL, *sg;
@@ -556,11 +561,11 @@ static sense_reason_t compare_and_write_callback(struct se_cmd *cmd, bool succes
 
                 if (block_size < PAGE_SIZE) {
                         sg_set_page(&write_sg[i], m.page, block_size,
-                                    block_size);
+                                    m.piter.sg->offset + block_size);
                 } else {
                         sg_miter_next(&m);
                         sg_set_page(&write_sg[i], m.page, block_size,
-                                    0);
+                                    m.piter.sg->offset);
                 }
                 len -= block_size;
                 i++;
diff --git a/drivers/target/target_core_stat.c b/drivers/target/target_core_stat.c
index 273c72b2b83d..81a6b3e07687 100644
--- a/drivers/target/target_core_stat.c
+++ b/drivers/target/target_core_stat.c
@@ -246,7 +246,7 @@ static ssize_t target_stat_lu_prod_show(struct config_item *item, char *page)
         char str[sizeof(dev->t10_wwn.model)+1];
 
         /* scsiLuProductId */
-        for (i = 0; i < sizeof(dev->t10_wwn.vendor); i++)
+        for (i = 0; i < sizeof(dev->t10_wwn.model); i++)
                 str[i] = ISPRINT(dev->t10_wwn.model[i]) ?
                         dev->t10_wwn.model[i] : ' ';
         str[i] = '\0';
diff --git a/drivers/target/target_core_tmr.c b/drivers/target/target_core_tmr.c
index 5b2820312310..28fb3016370f 100644
--- a/drivers/target/target_core_tmr.c
+++ b/drivers/target/target_core_tmr.c
@@ -130,6 +130,9 @@ void core_tmr_abort_task(
                 if (tmr->ref_task_tag != ref_tag)
                         continue;
 
+                if (!kref_get_unless_zero(&se_cmd->cmd_kref))
+                        continue;
+
                 printk("ABORT_TASK: Found referenced %s task_tag: %llu\n",
                         se_cmd->se_tfo->get_fabric_name(), ref_tag);
 
@@ -139,13 +142,15 @@ void core_tmr_abort_task(
                                " skipping\n", ref_tag);
                         spin_unlock(&se_cmd->t_state_lock);
                         spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags);
+
+                        target_put_sess_cmd(se_cmd);
+
                         goto out;
                 }
                 se_cmd->transport_state |= CMD_T_ABORTED;
                 spin_unlock(&se_cmd->t_state_lock);
 
                 list_del_init(&se_cmd->se_cmd_list);
-                kref_get(&se_cmd->cmd_kref);
                 spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags);
 
                 cancel_work_sync(&se_cmd->work);
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index 5bacc7b5ed6d..4fdcee2006d1 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -1658,7 +1658,7 @@ bool target_stop_cmd(struct se_cmd *cmd, unsigned long *flags)
 void transport_generic_request_failure(struct se_cmd *cmd,
                 sense_reason_t sense_reason)
 {
-        int ret = 0;
+        int ret = 0, post_ret = 0;
 
         pr_debug("-----[ Storage Engine Exception for cmd: %p ITT: 0x%08llx"
                 " CDB: 0x%02x\n", cmd, cmd->tag, cmd->t_task_cdb[0]);
@@ -1680,7 +1680,7 @@ void transport_generic_request_failure(struct se_cmd *cmd,
          */
         if ((cmd->se_cmd_flags & SCF_COMPARE_AND_WRITE) &&
              cmd->transport_complete_callback)
-                cmd->transport_complete_callback(cmd, false);
+                cmd->transport_complete_callback(cmd, false, &post_ret);
 
         switch (sense_reason) {
         case TCM_NON_EXISTENT_LUN:
@@ -2068,11 +2068,13 @@ static void target_complete_ok_work(struct work_struct *work)
          */
         if (cmd->transport_complete_callback) {
                 sense_reason_t rc;
+                bool caw = (cmd->se_cmd_flags & SCF_COMPARE_AND_WRITE);
+                bool zero_dl = !(cmd->data_length);
+                int post_ret = 0;
 
-                rc = cmd->transport_complete_callback(cmd, true);
-                if (!rc && !(cmd->se_cmd_flags & SCF_COMPARE_AND_WRITE_POST)) {
-                        if ((cmd->se_cmd_flags & SCF_COMPARE_AND_WRITE) &&
-                            !cmd->data_length)
+                rc = cmd->transport_complete_callback(cmd, true, &post_ret);
+                if (!rc && !post_ret) {
+                        if (caw && zero_dl)
                                 goto queue_rsp;
 
                         return;
@@ -2507,23 +2509,24 @@ out:
 EXPORT_SYMBOL(target_get_sess_cmd);
 
 static void target_release_cmd_kref(struct kref *kref)
-                __releases(&se_cmd->se_sess->sess_cmd_lock)
 {
         struct se_cmd *se_cmd = container_of(kref, struct se_cmd, cmd_kref);
         struct se_session *se_sess = se_cmd->se_sess;
+        unsigned long flags;
 
+        spin_lock_irqsave(&se_sess->sess_cmd_lock, flags);
         if (list_empty(&se_cmd->se_cmd_list)) {
-                spin_unlock(&se_sess->sess_cmd_lock);
+                spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags);
                 se_cmd->se_tfo->release_cmd(se_cmd);
                 return;
         }
         if (se_sess->sess_tearing_down && se_cmd->cmd_wait_set) {
-                spin_unlock(&se_sess->sess_cmd_lock);
+                spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags);
                 complete(&se_cmd->cmd_wait_comp);
                 return;
         }
         list_del(&se_cmd->se_cmd_list);
-        spin_unlock(&se_sess->sess_cmd_lock);
+        spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags);
 
         se_cmd->se_tfo->release_cmd(se_cmd);
 }
@@ -2539,8 +2542,7 @@ int target_put_sess_cmd(struct se_cmd *se_cmd)
                 se_cmd->se_tfo->release_cmd(se_cmd);
                 return 1;
         }
-        return kref_put_spinlock_irqsave(&se_cmd->cmd_kref, target_release_cmd_kref,
-                        &se_sess->sess_cmd_lock);
+        return kref_put(&se_cmd->cmd_kref, target_release_cmd_kref);
 }
 EXPORT_SYMBOL(target_put_sess_cmd);
 
diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c
index 937cebf76633..5e6d6cb348fc 100644
--- a/drivers/target/target_core_user.c
+++ b/drivers/target/target_core_user.c
@@ -638,7 +638,7 @@ static int tcmu_check_expired_cmd(int id, void *p, void *data)
         if (test_bit(TCMU_CMD_BIT_EXPIRED, &cmd->flags))
                 return 0;
 
-        if (!time_after(cmd->deadline, jiffies))
+        if (!time_after(jiffies, cmd->deadline))
                 return 0;
 
         set_bit(TCMU_CMD_BIT_EXPIRED, &cmd->flags);
@@ -1101,8 +1101,6 @@ tcmu_parse_cdb(struct se_cmd *cmd)
 
 static const struct target_backend_ops tcmu_ops = {
         .name                   = "user",
-        .inquiry_prod           = "USER",
-        .inquiry_rev            = TCMU_VERSION,
         .owner                  = THIS_MODULE,
         .transport_flags        = TRANSPORT_FLAG_PASSTHROUGH,
         .attach_hba             = tcmu_attach_hba,
diff --git a/drivers/thermal/Kconfig b/drivers/thermal/Kconfig
index c463c89b90ef..8cc4ac64a91c 100644
--- a/drivers/thermal/Kconfig
+++ b/drivers/thermal/Kconfig
@@ -382,7 +382,7 @@ endmenu
 
 config QCOM_SPMI_TEMP_ALARM
         tristate "Qualcomm SPMI PMIC Temperature Alarm"
-        depends on OF && (SPMI || COMPILE_TEST) && IIO
+        depends on OF && SPMI && IIO
         select REGMAP_SPMI
         help
           This enables a thermal sysfs driver for Qualcomm plug-and-play (QPNP)
diff --git a/drivers/thermal/imx_thermal.c b/drivers/thermal/imx_thermal.c
index c8fe3cac2e0e..c5547bd711db 100644
--- a/drivers/thermal/imx_thermal.c
+++ b/drivers/thermal/imx_thermal.c
@@ -55,6 +55,7 @@
 #define TEMPSENSE2_PANIC_VALUE_SHIFT    16
 #define TEMPSENSE2_PANIC_VALUE_MASK     0xfff0000
 
+#define OCOTP_MEM0                      0x0480
 #define OCOTP_ANA1                      0x04e0
 
 /* The driver supports 1 passive trip point and 1 critical trip point */
@@ -64,12 +65,6 @@ enum imx_thermal_trip {
         IMX_TRIP_NUM,
 };
 
-/*
- * It defines the temperature in millicelsius for passive trip point
- * that will trigger cooling action when crossed.
- */
-#define IMX_TEMP_PASSIVE                85000
-
 #define IMX_POLLING_DELAY               2000 /* millisecond */
 #define IMX_PASSIVE_DELAY               1000
 
@@ -100,12 +95,14 @@ struct imx_thermal_data {
         u32 c1, c2; /* See formula in imx_get_sensor_data() */
         int temp_passive;
         int temp_critical;
+        int temp_max;
         int alarm_temp;
         int last_temp;
         bool irq_enabled;
         int irq;
         struct clk *thermal_clk;
         const struct thermal_soc_data *socdata;
+        const char *temp_grade;
 };
 
 static void imx_set_panic_temp(struct imx_thermal_data *data,
@@ -285,10 +282,12 @@ static int imx_set_trip_temp(struct thermal_zone_device *tz, int trip,
 {
         struct imx_thermal_data *data = tz->devdata;
 
+        /* do not allow changing critical threshold */
         if (trip == IMX_TRIP_CRITICAL)
                 return -EPERM;
 
-        if (temp < 0 || temp > IMX_TEMP_PASSIVE)
+        /* do not allow passive to be set higher than critical */
+        if (temp < 0 || temp > data->temp_critical)
                 return -EINVAL;
 
         data->temp_passive = temp;
@@ -404,17 +403,39 @@ static int imx_get_sensor_data(struct platform_device *pdev)
         data->c1 = temp64;
         data->c2 = n1 * data->c1 + 1000 * t1;
 
-        /*
-         * Set the default passive cooling trip point,
-         * can be changed from userspace.
-         */
-        data->temp_passive = IMX_TEMP_PASSIVE;
+        /* use OTP for thermal grade */
+        ret = regmap_read(map, OCOTP_MEM0, &val);
+        if (ret) {
+                dev_err(&pdev->dev, "failed to read temp grade: %d\n", ret);
+                return ret;
+        }
+
+        /* The maximum die temp is specified by the Temperature Grade */
+        switch ((val >> 6) & 0x3) {
+        case 0: /* Commercial (0 to 95C) */
+                data->temp_grade = "Commercial";
+                data->temp_max = 95000;
+                break;
+        case 1: /* Extended Commercial (-20 to 105C) */
+                data->temp_grade = "Extended Commercial";
+                data->temp_max = 105000;
+                break;
+        case 2: /* Industrial (-40 to 105C) */
+                data->temp_grade = "Industrial";
+                data->temp_max = 105000;
+                break;
+        case 3: /* Automotive (-40 to 125C) */
+                data->temp_grade = "Automotive";
+                data->temp_max = 125000;
+                break;
+        }
 
         /*
-         * The maximum die temperature set to 20 C higher than
-         * IMX_TEMP_PASSIVE.
+         * Set the critical trip point at 5C under max
+         * Set the passive trip point at 10C under max (can change via sysfs)
          */
-        data->temp_critical = 1000 * 20 + data->temp_passive;
+        data->temp_critical = data->temp_max - (1000 * 5);
+        data->temp_passive = data->temp_max - (1000 * 10);
 
         return 0;
 }
@@ -551,6 +572,11 @@ static int imx_thermal_probe(struct platform_device *pdev)
                 return ret;
         }
 
+        dev_info(&pdev->dev, "%s CPU temperature grade - max:%dC"
+                 " critical:%dC passive:%dC\n", data->temp_grade,
+                 data->temp_max / 1000, data->temp_critical / 1000,
+                 data->temp_passive / 1000);
+
         /* Enable measurements at ~ 10 Hz */
         regmap_write(map, TEMPSENSE1 + REG_CLR, TEMPSENSE1_MEASURE_FREQ);
         measure_freq = DIV_ROUND_UP(32768, 10); /* 10 Hz */
diff --git a/drivers/thermal/of-thermal.c b/drivers/thermal/of-thermal.c
index 42b7d4253b94..be4eedcb839a 100644
--- a/drivers/thermal/of-thermal.c
+++ b/drivers/thermal/of-thermal.c
@@ -964,7 +964,7 @@ void of_thermal_destroy_zones(void)
 
         np = of_find_node_by_name(NULL, "thermal-zones");
         if (!np) {
-                pr_err("unable to find thermal zones\n");
+                pr_debug("unable to find thermal zones\n");
                 return;
         }
 
diff --git a/drivers/thermal/power_allocator.c b/drivers/thermal/power_allocator.c
index f0fbea386869..1246aa6fcab0 100644
--- a/drivers/thermal/power_allocator.c
+++ b/drivers/thermal/power_allocator.c
@@ -174,7 +174,6 @@ static void estimate_pid_constants(struct thermal_zone_device *tz,
 /**
  * pid_controller() - PID controller
  * @tz: thermal zone we are operating in
- * @current_temp:       the current temperature in millicelsius
  * @control_temp:       the target temperature in millicelsius
  * @max_allocatable_power:      maximum allocatable power for this thermal zone
  *
@@ -191,7 +190,6 @@ static void estimate_pid_constants(struct thermal_zone_device *tz,
  * Return: The power budget for the next period.
  */
 static u32 pid_controller(struct thermal_zone_device *tz,
-                          int current_temp,
                           int control_temp,
                           u32 max_allocatable_power)
 {
@@ -211,7 +209,7 @@ static u32 pid_controller(struct thermal_zone_device *tz,
                                        true);
         }
 
-        err = control_temp - current_temp;
+        err = control_temp - tz->temperature;
         err = int_to_frac(err);
 
         /* Calculate the proportional term */
@@ -332,7 +330,6 @@ static void divvy_up_power(u32 *req_power, u32 *max_power, int num_actors,
 }
 
 static int allocate_power(struct thermal_zone_device *tz,
-                          int current_temp,
                           int control_temp)
 {
         struct thermal_instance *instance;
@@ -418,8 +415,7 @@ static int allocate_power(struct thermal_zone_device *tz,
                 i++;
         }
 
-        power_range = pid_controller(tz, current_temp, control_temp,
-                                     max_allocatable_power);
+        power_range = pid_controller(tz, control_temp, max_allocatable_power);
 
         divvy_up_power(weighted_req_power, max_power, num_actors,
                        total_weighted_req_power, power_range, granted_power,
@@ -444,8 +440,8 @@ static int allocate_power(struct thermal_zone_device *tz,
         trace_thermal_power_allocator(tz, req_power, total_req_power,
                                       granted_power, total_granted_power,
                                       num_actors, power_range,
-                                      max_allocatable_power, current_temp,
-                                      control_temp - current_temp);
+                                      max_allocatable_power, tz->temperature,
+                                      control_temp - tz->temperature);
 
         kfree(req_power);
 unlock:
@@ -612,7 +608,7 @@ static void power_allocator_unbind(struct thermal_zone_device *tz)
 static int power_allocator_throttle(struct thermal_zone_device *tz, int trip)
 {
         int ret;
-        int switch_on_temp, control_temp, current_temp;
+        int switch_on_temp, control_temp;
         struct power_allocator_params *params = tz->governor_data;
 
         /*
@@ -622,15 +618,9 @@ static int power_allocator_throttle(struct thermal_zone_device *tz, int trip)
         if (trip != params->trip_max_desired_temperature)
                 return 0;
 
-        ret = thermal_zone_get_temp(tz, &current_temp);
-        if (ret) {
-                dev_warn(&tz->device, "Failed to get temperature: %d\n", ret);
-                return ret;
-        }
-
         ret = tz->ops->get_trip_temp(tz, params->trip_switch_on,
                                      &switch_on_temp);
-        if (!ret && (current_temp < switch_on_temp)) {
+        if (!ret && (tz->temperature < switch_on_temp)) {
                 tz->passive = 0;
                 reset_pid_controller(params);
                 allow_maximum_power(tz);
@@ -648,7 +638,7 @@ static int power_allocator_throttle(struct thermal_zone_device *tz, int trip)
                 return ret;
         }
 
-        return allocate_power(tz, current_temp, control_temp);
+        return allocate_power(tz, control_temp);
 }
 
 static struct thermal_governor thermal_gov_power_allocator = {
diff --git a/drivers/thermal/rcar_thermal.c b/drivers/thermal/rcar_thermal.c
index 5d4ae7d705e0..13d01edc7a04 100644
--- a/drivers/thermal/rcar_thermal.c
+++ b/drivers/thermal/rcar_thermal.c
@@ -361,6 +361,24 @@ static irqreturn_t rcar_thermal_irq(int irq, void *data)
 /*
  *              platform functions
  */
+static int rcar_thermal_remove(struct platform_device *pdev)
+{
+        struct rcar_thermal_common *common = platform_get_drvdata(pdev);
+        struct device *dev = &pdev->dev;
+        struct rcar_thermal_priv *priv;
+
+        rcar_thermal_for_each_priv(priv, common) {
+                if (rcar_has_irq_support(priv))
+                        rcar_thermal_irq_disable(priv);
+                thermal_zone_device_unregister(priv->zone);
+        }
+
+        pm_runtime_put(dev);
+        pm_runtime_disable(dev);
+
+        return 0;
+}
+
 static int rcar_thermal_probe(struct platform_device *pdev)
 {
         struct rcar_thermal_common *common;
@@ -377,6 +395,8 @@ static int rcar_thermal_probe(struct platform_device *pdev)
         if (!common)
                 return -ENOMEM;
 
+        platform_set_drvdata(pdev, common);
+
         INIT_LIST_HEAD(&common->head);
         spin_lock_init(&common->lock);
         common->dev = dev;
@@ -454,43 +474,16 @@ static int rcar_thermal_probe(struct platform_device *pdev)
                 rcar_thermal_common_write(common, ENR, enr_bits);
         }
 
-        platform_set_drvdata(pdev, common);
-
         dev_info(dev, "%d sensor probed\n", i);
 
         return 0;
 
 error_unregister:
-        rcar_thermal_for_each_priv(priv, common) {
-                if (rcar_has_irq_support(priv))
-                        rcar_thermal_irq_disable(priv);
-                thermal_zone_device_unregister(priv->zone);
-        }
-
-        pm_runtime_put(dev);
-        pm_runtime_disable(dev);
+        rcar_thermal_remove(pdev);
 
         return ret;
 }
 
-static int rcar_thermal_remove(struct platform_device *pdev)
-{
-        struct rcar_thermal_common *common = platform_get_drvdata(pdev);
-        struct device *dev = &pdev->dev;
-        struct rcar_thermal_priv *priv;
-
-        rcar_thermal_for_each_priv(priv, common) {
-                if (rcar_has_irq_support(priv))
-                        rcar_thermal_irq_disable(priv);
-                thermal_zone_device_unregister(priv->zone);
-        }
-
-        pm_runtime_put(dev);
-        pm_runtime_disable(dev);
-
-        return 0;
-}
-
 static const struct of_device_id rcar_thermal_dt_ids[] = {
         { .compatible = "renesas,rcar-thermal", },
         {},
diff --git a/drivers/thermal/rockchip_thermal.c b/drivers/thermal/rockchip_thermal.c
index 9787e8aa509f..e845841ab036 100644
--- a/drivers/thermal/rockchip_thermal.c
+++ b/drivers/thermal/rockchip_thermal.c
@@ -1,6 +1,9 @@
 /*
  * Copyright (c) 2014, Fuzhou Rockchip Electronics Co., Ltd
  *
+ * Copyright (c) 2015, Fuzhou Rockchip Electronics Co., Ltd
+ * Caesar Wang <wxt@rock-chips.com>
+ *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
  * version 2, as published by the Free Software Foundation.
@@ -45,17 +48,50 @@ enum tshut_polarity {
 };
 
 /**
- * The system has three Temperature Sensors.  channel 0 is reserved,
- * channel 1 is for CPU, and channel 2 is for GPU.
+ * The system has two Temperature Sensors.
+ * sensor0 is for CPU, and sensor1 is for GPU.
  */
 enum sensor_id {
-        SENSOR_CPU = 1,
+        SENSOR_CPU = 0,
         SENSOR_GPU,
 };
 
+/**
+* The conversion table has the adc value and temperature.
+* ADC_DECREMENT is the adc value decremnet.(e.g. v2_code_table)
+* ADC_INCREMNET is the adc value incremnet.(e.g. v3_code_table)
+*/
+enum adc_sort_mode {
+        ADC_DECREMENT = 0,
+        ADC_INCREMENT,
+};
+
+/**
+ * The max sensors is two in rockchip SoCs.
+ * Two sensors: CPU and GPU sensor.
+ */
+#define SOC_MAX_SENSORS 2
+
+struct chip_tsadc_table {
+        const struct tsadc_table *id;
+
+        /* the array table size*/
+        unsigned int length;
+
+        /* that analogic mask data */
+        u32 data_mask;
+
+        /* the sort mode is adc value that increment or decrement in table */
+        enum adc_sort_mode mode;
+};
+
 struct rockchip_tsadc_chip {
+        /* The sensor id of chip correspond to the ADC channel */
+        int chn_id[SOC_MAX_SENSORS];
+        int chn_num;
+
         /* The hardware-controlled tshut property */
-        long tshut_temp;
+        int tshut_temp;
         enum tshut_mode tshut_mode;
         enum tshut_polarity tshut_polarity;
 
@@ -65,37 +101,40 @@ struct rockchip_tsadc_chip {
         void (*control)(void __iomem *reg, bool on);
 
         /* Per-sensor methods */
-        int (*get_temp)(int chn, void __iomem *reg, int *temp);
-        void (*set_tshut_temp)(int chn, void __iomem *reg, long temp);
+        int (*get_temp)(struct chip_tsadc_table table,
+                        int chn, void __iomem *reg, int *temp);
+        void (*set_tshut_temp)(struct chip_tsadc_table table,
+                               int chn, void __iomem *reg, int temp);
         void (*set_tshut_mode)(int chn, void __iomem *reg, enum tshut_mode m);
+
+        /* Per-table methods */
+        struct chip_tsadc_table table;
 };
 
 struct rockchip_thermal_sensor {
         struct rockchip_thermal_data *thermal;
         struct thermal_zone_device *tzd;
-        enum sensor_id id;
+        int id;
 };
 
-#define NUM_SENSORS     2 /* Ignore unused sensor 0 */
-
 struct rockchip_thermal_data {
         const struct rockchip_tsadc_chip *chip;
         struct platform_device *pdev;
         struct reset_control *reset;
 
-        struct rockchip_thermal_sensor sensors[NUM_SENSORS];
+        struct rockchip_thermal_sensor sensors[SOC_MAX_SENSORS];
 
         struct clk *clk;
         struct clk *pclk;
 
         void __iomem *regs;
 
-        long tshut_temp;
+        int tshut_temp;
         enum tshut_mode tshut_mode;
         enum tshut_polarity tshut_polarity;
 };
 
-/* TSADC V2 Sensor info define: */
+/* TSADC Sensor info define: */
 #define TSADCV2_AUTO_CON                        0x04
 #define TSADCV2_INT_EN                          0x08
 #define TSADCV2_INT_PD                          0x0c
@@ -117,6 +156,8 @@ struct rockchip_thermal_data {
 #define TSADCV2_INT_PD_CLEAR_MASK               ~BIT(8)
 
 #define TSADCV2_DATA_MASK                       0xfff
+#define TSADCV3_DATA_MASK                       0x3ff
+
 #define TSADCV2_HIGHT_INT_DEBOUNCE_COUNT        4
 #define TSADCV2_HIGHT_TSHUT_DEBOUNCE_COUNT      4
 #define TSADCV2_AUTO_PERIOD_TIME                250 /* msec */
@@ -124,7 +165,7 @@ struct rockchip_thermal_data {
 
 struct tsadc_table {
         u32 code;
-        long temp;
+        int temp;
 };
 
 static const struct tsadc_table v2_code_table[] = {
@@ -165,21 +206,61 @@ static const struct tsadc_table v2_code_table[] = {
         {3421, 125000},
 };
 
-static u32 rk_tsadcv2_temp_to_code(long temp)
+static const struct tsadc_table v3_code_table[] = {
+        {0, -40000},
+        {106, -40000},
+        {108, -35000},
+        {110, -30000},
+        {112, -25000},
+        {114, -20000},
+        {116, -15000},
+        {118, -10000},
+        {120, -5000},
+        {122, 0},
+        {124, 5000},
+        {126, 10000},
+        {128, 15000},
+        {130, 20000},
+        {132, 25000},
+        {134, 30000},
+        {136, 35000},
+        {138, 40000},
+        {140, 45000},
+        {142, 50000},
+        {144, 55000},
+        {146, 60000},
+        {148, 65000},
+        {150, 70000},
+        {152, 75000},
+        {154, 80000},
+        {156, 85000},
+        {158, 90000},
+        {160, 95000},
+        {162, 100000},
+        {163, 105000},
+        {165, 110000},
+        {167, 115000},
+        {169, 120000},
+        {171, 125000},
+        {TSADCV3_DATA_MASK, 125000},
+};
+
+static u32 rk_tsadcv2_temp_to_code(struct chip_tsadc_table table,
+                                   int temp)
 {
         int high, low, mid;
 
         low = 0;
-        high = ARRAY_SIZE(v2_code_table) - 1;
+        high = table.length - 1;
         mid = (high + low) / 2;
 
-        if (temp < v2_code_table[low].temp || temp > v2_code_table[high].temp)
+        if (temp < table.id[low].temp || temp > table.id[high].temp)
                 return 0;
 
         while (low <= high) {
-                if (temp == v2_code_table[mid].temp)
-                        return v2_code_table[mid].code;
-                else if (temp < v2_code_table[mid].temp)
+                if (temp == table.id[mid].temp)
+                        return table.id[mid].code;
+                else if (temp < table.id[mid].temp)
                         high = mid - 1;
                 else
                         low = mid + 1;
@@ -189,29 +270,54 @@ static u32 rk_tsadcv2_temp_to_code(long temp)
         return 0;
 }
 
-static int rk_tsadcv2_code_to_temp(u32 code, int *temp)
+static int rk_tsadcv2_code_to_temp(struct chip_tsadc_table table, u32 code,
+                                   int *temp)
 {
         unsigned int low = 1;
-        unsigned int high = ARRAY_SIZE(v2_code_table) - 1;
+        unsigned int high = table.length - 1;
         unsigned int mid = (low + high) / 2;
         unsigned int num;
         unsigned long denom;
 
-        BUILD_BUG_ON(ARRAY_SIZE(v2_code_table) < 2);
-
-        code &= TSADCV2_DATA_MASK;
-        if (code < v2_code_table[high].code)
-                return -EAGAIN;         /* Incorrect reading */
-
-        while (low <= high) {
-                if (code >= v2_code_table[mid].code &&
-                    code < v2_code_table[mid - 1].code)
-                        break;
-                else if (code < v2_code_table[mid].code)
-                        low = mid + 1;
-                else
-                        high = mid - 1;
-                mid = (low + high) / 2;
+        WARN_ON(table.length < 2);
+
+        switch (table.mode) {
+        case ADC_DECREMENT:
+                code &= table.data_mask;
+                if (code < table.id[high].code)
+                        return -EAGAIN;         /* Incorrect reading */
+
+                while (low <= high) {
+                        if (code >= table.id[mid].code &&
+                            code < table.id[mid - 1].code)
+                                break;
+                        else if (code < table.id[mid].code)
+                                low = mid + 1;
+                        else
+                                high = mid - 1;
+
+                        mid = (low + high) / 2;
+                }
+                break;
+        case ADC_INCREMENT:
+                code &= table.data_mask;
+                if (code < table.id[low].code)
+                        return -EAGAIN;         /* Incorrect reading */
+
+                while (low <= high) {
+                        if (code >= table.id[mid - 1].code &&
+                            code < table.id[mid].code)
+                                break;
+                        else if (code > table.id[mid].code)
+                                low = mid + 1;
+                        else
+                                high = mid - 1;
+
+                        mid = (low + high) / 2;
+                }
+                break;
+        default:
+                pr_err("Invalid the conversion table\n");
         }
 
         /*
@@ -220,24 +326,28 @@ static int rk_tsadcv2_code_to_temp(u32 code, int *temp)
          * temperature between 2 table entries is linear and interpolate
          * to produce less granular result.
          */
-        num = v2_code_table[mid].temp - v2_code_table[mid - 1].temp;
-        num *= v2_code_table[mid - 1].code - code;
-        denom = v2_code_table[mid - 1].code - v2_code_table[mid].code;
-        *temp = v2_code_table[mid - 1].temp + (num / denom);
+        num = table.id[mid].temp - v2_code_table[mid - 1].temp;
+        num *= abs(table.id[mid - 1].code - code);
+        denom = abs(table.id[mid - 1].code - table.id[mid].code);
+        *temp = table.id[mid - 1].temp + (num / denom);
 
         return 0;
 }
 
 /**
- * rk_tsadcv2_initialize - initialize TASDC Controller
- * (1) Set TSADCV2_AUTO_PERIOD, configure the interleave between
- * every two accessing of TSADC in normal operation.
- * (2) Set TSADCV2_AUTO_PERIOD_HT, configure the interleave between
- * every two accessing of TSADC after the temperature is higher
- * than COM_SHUT or COM_INT.
- * (3) Set TSADCV2_HIGH_INT_DEBOUNCE and TSADC_HIGHT_TSHUT_DEBOUNCE,
- * if the temperature is higher than COMP_INT or COMP_SHUT for
- * "debounce" times, TSADC controller will generate interrupt or TSHUT.
+ * rk_tsadcv2_initialize - initialize TASDC Controller.
+ *
+ * (1) Set TSADC_V2_AUTO_PERIOD:
+ *     Configure the interleave between every two accessing of
+ *     TSADC in normal operation.
+ *
+ * (2) Set TSADCV2_AUTO_PERIOD_HT:
+ *     Configure the interleave between every two accessing of
+ *     TSADC after the temperature is higher than COM_SHUT or COM_INT.
+ *
+ * (3) Set TSADCV2_HIGH_INT_DEBOUNCE and TSADC_HIGHT_TSHUT_DEBOUNCE:
+ *     If the temperature is higher than COMP_INT or COMP_SHUT for
+ *     "debounce" times, TSADC controller will generate interrupt or TSHUT.
  */
 static void rk_tsadcv2_initialize(void __iomem *regs,
                                   enum tshut_polarity tshut_polarity)
@@ -279,20 +389,22 @@ static void rk_tsadcv2_control(void __iomem *regs, bool enable)
         writel_relaxed(val, regs + TSADCV2_AUTO_CON);
 }
 
-static int rk_tsadcv2_get_temp(int chn, void __iomem *regs, int *temp)
+static int rk_tsadcv2_get_temp(struct chip_tsadc_table table,
+                               int chn, void __iomem *regs, int *temp)
 {
         u32 val;
 
         val = readl_relaxed(regs + TSADCV2_DATA(chn));
 
-        return rk_tsadcv2_code_to_temp(val, temp);
+        return rk_tsadcv2_code_to_temp(table, val, temp);
 }
 
-static void rk_tsadcv2_tshut_temp(int chn, void __iomem *regs, long temp)
+static void rk_tsadcv2_tshut_temp(struct chip_tsadc_table table,
+                                  int chn, void __iomem *regs, int temp)
 {
         u32 tshut_value, val;
 
-        tshut_value = rk_tsadcv2_temp_to_code(temp);
+        tshut_value = rk_tsadcv2_temp_to_code(table, temp);
         writel_relaxed(tshut_value, regs + TSADCV2_COMP_SHUT(chn));
 
         /* TSHUT will be valid */
@@ -318,6 +430,10 @@ static void rk_tsadcv2_tshut_mode(int chn, void __iomem *regs,
 }
 
 static const struct rockchip_tsadc_chip rk3288_tsadc_data = {
+        .chn_id[SENSOR_CPU] = 1, /* cpu sensor is channel 1 */
+        .chn_id[SENSOR_GPU] = 2, /* gpu sensor is channel 2 */
+        .chn_num = 2, /* two channels for tsadc */
+
         .tshut_mode = TSHUT_MODE_GPIO, /* default TSHUT via GPIO give PMIC */
         .tshut_polarity = TSHUT_LOW_ACTIVE, /* default TSHUT LOW ACTIVE */
         .tshut_temp = 95000,
@@ -328,6 +444,37 @@ static const struct rockchip_tsadc_chip rk3288_tsadc_data = {
         .get_temp = rk_tsadcv2_get_temp,
         .set_tshut_temp = rk_tsadcv2_tshut_temp,
         .set_tshut_mode = rk_tsadcv2_tshut_mode,
+
+        .table = {
+                .id = v2_code_table,
+                .length = ARRAY_SIZE(v2_code_table),
+                .data_mask = TSADCV2_DATA_MASK,
+                .mode = ADC_DECREMENT,
+        },
+};
+
+static const struct rockchip_tsadc_chip rk3368_tsadc_data = {
+        .chn_id[SENSOR_CPU] = 0, /* cpu sensor is channel 0 */
+        .chn_id[SENSOR_GPU] = 1, /* gpu sensor is channel 1 */
+        .chn_num = 2, /* two channels for tsadc */
+
+        .tshut_mode = TSHUT_MODE_GPIO, /* default TSHUT via GPIO give PMIC */
+        .tshut_polarity = TSHUT_LOW_ACTIVE, /* default TSHUT LOW ACTIVE */
+        .tshut_temp = 95000,
+
+        .initialize = rk_tsadcv2_initialize,
+        .irq_ack = rk_tsadcv2_irq_ack,
+        .control = rk_tsadcv2_control,
+        .get_temp = rk_tsadcv2_get_temp,
+        .set_tshut_temp = rk_tsadcv2_tshut_temp,
+        .set_tshut_mode = rk_tsadcv2_tshut_mode,
+
+        .table = {
+                .id = v3_code_table,
+                .length = ARRAY_SIZE(v3_code_table),
+                .data_mask = TSADCV3_DATA_MASK,
+                .mode = ADC_INCREMENT,
+        },
 };
 
 static const struct of_device_id of_rockchip_thermal_match[] = {
@@ -335,6 +482,10 @@ static const struct of_device_id of_rockchip_thermal_match[] = {
                 .compatible = "rockchip,rk3288-tsadc",
                 .data = (void *)&rk3288_tsadc_data,
         },
+        {
+                .compatible = "rockchip,rk3368-tsadc",
+                .data = (void *)&rk3368_tsadc_data,
+        },
         { /* end */ },
 };
 MODULE_DEVICE_TABLE(of, of_rockchip_thermal_match);
@@ -357,7 +508,7 @@ static irqreturn_t rockchip_thermal_alarm_irq_thread(int irq, void *dev)
 
         thermal->chip->irq_ack(thermal->regs);
 
-        for (i = 0; i < ARRAY_SIZE(thermal->sensors); i++)
+        for (i = 0; i < thermal->chip->chn_num; i++)
                 thermal_zone_device_update(thermal->sensors[i].tzd);
 
         return IRQ_HANDLED;
@@ -370,7 +521,8 @@ static int rockchip_thermal_get_temp(void *_sensor, int *out_temp)
         const struct rockchip_tsadc_chip *tsadc = sensor->thermal->chip;
         int retval;
 
-        retval = tsadc->get_temp(sensor->id, thermal->regs, out_temp);
+        retval = tsadc->get_temp(tsadc->table,
+                                 sensor->id, thermal->regs, out_temp);
         dev_dbg(&thermal->pdev->dev, "sensor %d - temp: %d, retval: %d\n",
                 sensor->id, *out_temp, retval);
 
@@ -389,7 +541,7 @@ static int rockchip_configure_from_dt(struct device *dev,
 
         if (of_property_read_u32(np, "rockchip,hw-tshut-temp", &shut_temp)) {
                 dev_warn(dev,
-                         "Missing tshut temp property, using default %ld\n",
+                         "Missing tshut temp property, using default %d\n",
                          thermal->chip->tshut_temp);
                 thermal->tshut_temp = thermal->chip->tshut_temp;
         } else {
@@ -397,7 +549,7 @@ static int rockchip_configure_from_dt(struct device *dev,
         }
 
         if (thermal->tshut_temp > INT_MAX) {
-                dev_err(dev, "Invalid tshut temperature specified: %ld\n",
+                dev_err(dev, "Invalid tshut temperature specified: %d\n",
                         thermal->tshut_temp);
                 return -ERANGE;
         }
@@ -442,13 +594,14 @@ static int
 rockchip_thermal_register_sensor(struct platform_device *pdev,
                                  struct rockchip_thermal_data *thermal,
                                  struct rockchip_thermal_sensor *sensor,
-                                 enum sensor_id id)
+                                 int id)
 {
         const struct rockchip_tsadc_chip *tsadc = thermal->chip;
         int error;
 
         tsadc->set_tshut_mode(id, thermal->regs, thermal->tshut_mode);
-        tsadc->set_tshut_temp(id, thermal->regs, thermal->tshut_temp);
+        tsadc->set_tshut_temp(tsadc->table, id, thermal->regs,
+                              thermal->tshut_temp);
 
         sensor->thermal = thermal;
         sensor->id = id;
@@ -481,7 +634,7 @@ static int rockchip_thermal_probe(struct platform_device *pdev)
         const struct of_device_id *match;
         struct resource *res;
         int irq;
-        int i;
+        int i, j;
         int error;
 
         match = of_match_node(of_rockchip_thermal_match, np);
@@ -556,22 +709,19 @@ static int rockchip_thermal_probe(struct platform_device *pdev)
 
         thermal->chip->initialize(thermal->regs, thermal->tshut_polarity);
 
-        error = rockchip_thermal_register_sensor(pdev, thermal,
-                                                 &thermal->sensors[0],
-                                                 SENSOR_CPU);
-        if (error) {
-                dev_err(&pdev->dev,
-                        "failed to register CPU thermal sensor: %d\n", error);
-                goto err_disable_pclk;
-        }
-
-        error = rockchip_thermal_register_sensor(pdev, thermal,
-                                                 &thermal->sensors[1],
-                                                 SENSOR_GPU);
-        if (error) {
-                dev_err(&pdev->dev,
-                        "failed to register GPU thermal sensor: %d\n", error);
-                goto err_unregister_cpu_sensor;
+        for (i = 0; i < thermal->chip->chn_num; i++) {
+                error = rockchip_thermal_register_sensor(pdev, thermal,
+                                                &thermal->sensors[i],
+                                                thermal->chip->chn_id[i]);
+                if (error) {
+                        dev_err(&pdev->dev,
+                                "failed to register sensor[%d] : error = %d\n",
+                                i, error);
+                        for (j = 0; j < i; j++)
+                                thermal_zone_of_sensor_unregister(&pdev->dev,
+                                                thermal->sensors[j].tzd);
+                        goto err_disable_pclk;
+                }
         }
 
         error = devm_request_threaded_irq(&pdev->dev, irq, NULL,
@@ -581,22 +731,23 @@ static int rockchip_thermal_probe(struct platform_device *pdev)
         if (error) {
                 dev_err(&pdev->dev,
                         "failed to request tsadc irq: %d\n", error);
-                goto err_unregister_gpu_sensor;
+                goto err_unregister_sensor;
         }
 
         thermal->chip->control(thermal->regs, true);
 
-        for (i = 0; i < ARRAY_SIZE(thermal->sensors); i++)
+        for (i = 0; i < thermal->chip->chn_num; i++)
                 rockchip_thermal_toggle_sensor(&thermal->sensors[i], true);
 
         platform_set_drvdata(pdev, thermal);
 
         return 0;
 
-err_unregister_gpu_sensor:
-        thermal_zone_of_sensor_unregister(&pdev->dev, thermal->sensors[1].tzd);
-err_unregister_cpu_sensor:
-        thermal_zone_of_sensor_unregister(&pdev->dev, thermal->sensors[0].tzd);
+err_unregister_sensor:
+        while (i--)
+                thermal_zone_of_sensor_unregister(&pdev->dev,
+                                                  thermal->sensors[i].tzd);
+
 err_disable_pclk:
         clk_disable_unprepare(thermal->pclk);
 err_disable_clk:
@@ -610,7 +761,7 @@ static int rockchip_thermal_remove(struct platform_device *pdev)
         struct rockchip_thermal_data *thermal = platform_get_drvdata(pdev);
         int i;
 
-        for (i = 0; i < ARRAY_SIZE(thermal->sensors); i++) {
+        for (i = 0; i < thermal->chip->chn_num; i++) {
                 struct rockchip_thermal_sensor *sensor = &thermal->sensors[i];
 
                 rockchip_thermal_toggle_sensor(sensor, false);
@@ -631,7 +782,7 @@ static int __maybe_unused rockchip_thermal_suspend(struct device *dev)
         struct rockchip_thermal_data *thermal = platform_get_drvdata(pdev);
         int i;
 
-        for (i = 0; i < ARRAY_SIZE(thermal->sensors); i++)
+        for (i = 0; i < thermal->chip->chn_num; i++)
                 rockchip_thermal_toggle_sensor(&thermal->sensors[i], false);
 
         thermal->chip->control(thermal->regs, false);
@@ -663,18 +814,19 @@ static int __maybe_unused rockchip_thermal_resume(struct device *dev)
 
         thermal->chip->initialize(thermal->regs, thermal->tshut_polarity);
 
-        for (i = 0; i < ARRAY_SIZE(thermal->sensors); i++) {
-                enum sensor_id id = thermal->sensors[i].id;
+        for (i = 0; i < thermal->chip->chn_num; i++) {
+                int id = thermal->sensors[i].id;
 
                 thermal->chip->set_tshut_mode(id, thermal->regs,
                                               thermal->tshut_mode);
-                thermal->chip->set_tshut_temp(id, thermal->regs,
+                thermal->chip->set_tshut_temp(thermal->chip->table,
+                                              id, thermal->regs,
                                               thermal->tshut_temp);
         }
 
         thermal->chip->control(thermal->regs, true);
 
-        for (i = 0; i < ARRAY_SIZE(thermal->sensors); i++)
+        for (i = 0; i < thermal->chip->chn_num; i++)
                 rockchip_thermal_toggle_sensor(&thermal->sensors[i], true);
 
         pinctrl_pm_select_default_state(dev);
diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
index ed776149261e..e49c2bce551d 100644
--- a/drivers/tty/n_tty.c
+++ b/drivers/tty/n_tty.c
@@ -2054,13 +2054,13 @@ static int canon_copy_from_read_buf(struct tty_struct *tty,
         size_t eol;
         size_t tail;
         int ret, found = 0;
-        bool eof_push = 0;
 
         /* N.B. avoid overrun if nr == 0 */
-        n = min(*nr, smp_load_acquire(&ldata->canon_head) - ldata->read_tail);
-        if (!n)
+        if (!*nr)
                 return 0;
 
+        n = min(*nr + 1, smp_load_acquire(&ldata->canon_head) - ldata->read_tail);
+
         tail = ldata->read_tail & (N_TTY_BUF_SIZE - 1);
         size = min_t(size_t, tail + n, N_TTY_BUF_SIZE);
 
@@ -2081,12 +2081,11 @@ static int canon_copy_from_read_buf(struct tty_struct *tty,
         n = eol - tail;
         if (n > N_TTY_BUF_SIZE)
                 n += N_TTY_BUF_SIZE;
-        n += found;
-        c = n;
+        c = n + found;
 
-        if (found && !ldata->push && read_buf(ldata, eol) == __DISABLED_CHAR) {
-                n--;
-                eof_push = !n && ldata->read_tail != ldata->line_start;
+        if (!found || read_buf(ldata, eol) != __DISABLED_CHAR) {
+                c = min(*nr, c);
+                n = c;
         }
 
         n_tty_trace("%s: eol:%zu found:%d n:%zu c:%zu size:%zu more:%zu\n",
@@ -2116,7 +2115,7 @@ static int canon_copy_from_read_buf(struct tty_struct *tty,
                         ldata->push = 0;
                 tty_audit_push(tty);
         }
-        return eof_push ? -EAGAIN : 0;
+        return 0;
 }
 
 extern ssize_t redirected_tty_write(struct file *, const char __user *,
@@ -2273,10 +2272,7 @@ static ssize_t n_tty_read(struct tty_struct *tty, struct file *file,
 
                 if (ldata->icanon && !L_EXTPROC(tty)) {
                         retval = canon_copy_from_read_buf(tty, &b, &nr);
-                        if (retval == -EAGAIN) {
-                                retval = 0;
-                                continue;
-                        } else if (retval)
+                        if (retval)
                                 break;
                 } else {
                         int uncopied;
diff --git a/drivers/tty/serial/8250/8250_uniphier.c b/drivers/tty/serial/8250/8250_uniphier.c
index d11621e2cf1d..245edbb68d4b 100644
--- a/drivers/tty/serial/8250/8250_uniphier.c
+++ b/drivers/tty/serial/8250/8250_uniphier.c
@@ -115,12 +115,16 @@ static void uniphier_serial_out(struct uart_port *p, int offset, int value)
  */
 static int uniphier_serial_dl_read(struct uart_8250_port *up)
 {
-        return readl(up->port.membase + UNIPHIER_UART_DLR);
+        int offset = UNIPHIER_UART_DLR << up->port.regshift;
+
+        return readl(up->port.membase + offset);
 }
 
 static void uniphier_serial_dl_write(struct uart_8250_port *up, int value)
 {
-        writel(value, up->port.membase + UNIPHIER_UART_DLR);
+        int offset = UNIPHIER_UART_DLR << up->port.regshift;
+
+        writel(value, up->port.membase + offset);
 }
 
 static int uniphier_of_serial_setup(struct device *dev, struct uart_port *port,
diff --git a/drivers/tty/serial/earlycon.c b/drivers/tty/serial/earlycon.c
index f09636083426..b5b2f2be6be7 100644
--- a/drivers/tty/serial/earlycon.c
+++ b/drivers/tty/serial/earlycon.c
@@ -115,6 +115,7 @@ static int __init register_earlycon(char *buf, const struct earlycon_id *match)
         if (buf && !parse_options(&early_console_dev, buf))
                 buf = NULL;
 
+        spin_lock_init(&port->lock);
         port->uartclk = BASE_BAUD * 16;
         if (port->mapbase)
                 port->membase = earlycon_map(port->mapbase, 64);
@@ -202,6 +203,7 @@ int __init of_setup_earlycon(unsigned long addr,
         int err;
         struct uart_port *port = &early_console_dev.port;
 
+        spin_lock_init(&port->lock);
         port->iotype = UPIO_MEM;
         port->mapbase = addr;
         port->uartclk = BASE_BAUD * 16;
diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c
index 960e50a97558..51c7507b0444 100644
--- a/drivers/tty/serial/sh-sci.c
+++ b/drivers/tty/serial/sh-sci.c
@@ -1437,7 +1437,7 @@ static void sci_request_dma(struct uart_port *port)
                         sg_init_table(sg, 1);
                         s->rx_buf[i] = buf;
                         sg_dma_address(sg) = dma;
-                        sg->length = s->buf_len_rx;
+                        sg_dma_len(sg) = s->buf_len_rx;
 
                         buf += s->buf_len_rx;
                         dma += s->buf_len_rx;
diff --git a/drivers/tty/serial/sunhv.c b/drivers/tty/serial/sunhv.c
index 064031870ba0..ca0d3802f2af 100644
--- a/drivers/tty/serial/sunhv.c
+++ b/drivers/tty/serial/sunhv.c
@@ -148,8 +148,10 @@ static int receive_chars_read(struct uart_port *port)
                         uart_handle_dcd_change(port, 1);
                 }
 
-                for (i = 0; i < bytes_read; i++)
-                        uart_handle_sysrq_char(port, con_read_page[i]);
+                if (port->sysrq != 0 &&  *con_read_page) {
+                        for (i = 0; i < bytes_read; i++)
+                                uart_handle_sysrq_char(port, con_read_page[i]);
+                }
 
                 if (port->state == NULL)
                         continue;
@@ -168,17 +170,17 @@ struct sunhv_ops {
         int (*receive_chars)(struct uart_port *port);
 };
 
-static struct sunhv_ops bychar_ops = {
+static const struct sunhv_ops bychar_ops = {
         .transmit_chars = transmit_chars_putchar,
         .receive_chars = receive_chars_getchar,
 };
 
-static struct sunhv_ops bywrite_ops = {
+static const struct sunhv_ops bywrite_ops = {
         .transmit_chars = transmit_chars_write,
         .receive_chars = receive_chars_read,
 };
 
-static struct sunhv_ops *sunhv_ops = &bychar_ops;
+static const struct sunhv_ops *sunhv_ops = &bychar_ops;
 
 static struct tty_port *receive_chars(struct uart_port *port)
 {
diff --git a/drivers/tty/tty_buffer.c b/drivers/tty/tty_buffer.c
index 9a479e61791a..3cd31e0d4bd9 100644
--- a/drivers/tty/tty_buffer.c
+++ b/drivers/tty/tty_buffer.c
@@ -450,7 +450,7 @@ receive_buf(struct tty_struct *tty, struct tty_buffer *head, int count)
                 count = disc->ops->receive_buf2(tty, p, f, count);
         else {
                 count = min_t(int, count, tty->receive_room);
-                if (count)
+                if (count && disc->ops->receive_buf)
                         disc->ops->receive_buf(tty, p, f, count);
         }
         return count;
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index b30e7423549b..26ca4f910cb0 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1838,6 +1838,11 @@ static const struct usb_device_id acm_ids[] = {
         },
 #endif
 
+        /* Exclude Infineon Flash Loader utility */
+        { USB_DEVICE(0x058b, 0x0041),
+        .driver_info = IGNORE_DEVICE,
+        },
+
         /* control interfaces without any protocol set */
         { USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ACM,
                 USB_CDC_PROTO_NONE) },
diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
index 7caff020106e..5050760f5e17 100644
--- a/drivers/usb/core/config.c
+++ b/drivers/usb/core/config.c
@@ -115,7 +115,8 @@ static void usb_parse_ss_endpoint_companion(struct device *ddev, int cfgno,
                    USB_SS_MULT(desc->bmAttributes) > 3) {
                 dev_warn(ddev, "Isoc endpoint has Mult of %d in "
                                 "config %d interface %d altsetting %d ep %d: "
-                                "setting to 3\n", desc->bmAttributes + 1,
+                                "setting to 3\n",
+                                USB_SS_MULT(desc->bmAttributes),
                                 cfgno, inum, asnum, ep->desc.bEndpointAddress);
                 ep->ss_ep_comp.bmAttributes = 2;
         }
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index bdeadc112d29..ddbf32d599cb 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -124,6 +124,10 @@ struct usb_hub *usb_hub_to_struct_hub(struct usb_device *hdev)
 
 int usb_device_supports_lpm(struct usb_device *udev)
 {
+        /* Some devices have trouble with LPM */
+        if (udev->quirks & USB_QUIRK_NO_LPM)
+                return 0;
+
         /* USB 2.1 (and greater) devices indicate LPM support through
          * their USB 2.0 Extended Capabilities BOS descriptor.
          */
@@ -1031,10 +1035,20 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
         unsigned delay;
 
         /* Continue a partial initialization */
-        if (type == HUB_INIT2)
-                goto init2;
-        if (type == HUB_INIT3)
+        if (type == HUB_INIT2 || type == HUB_INIT3) {
+                device_lock(hub->intfdev);
+
+                /* Was the hub disconnected while we were waiting? */
+                if (hub->disconnected) {
+                        device_unlock(hub->intfdev);
+                        kref_put(&hub->kref, hub_release);
+                        return;
+                }
+                if (type == HUB_INIT2)
+                        goto init2;
                 goto init3;
+        }
+        kref_get(&hub->kref);
 
         /* The superspeed hub except for root hub has to use Hub Depth
          * value as an offset into the route string to locate the bits
@@ -1232,6 +1246,7 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
                         queue_delayed_work(system_power_efficient_wq,
                                         &hub->init_work,
                                         msecs_to_jiffies(delay));
+                        device_unlock(hub->intfdev);
                         return;         /* Continues at init3: below */
                 } else {
                         msleep(delay);
@@ -1253,6 +1268,11 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
         /* Allow autosuspend if it was suppressed */
         if (type <= HUB_INIT3)
                 usb_autopm_put_interface_async(to_usb_interface(hub->intfdev));
+
+        if (type == HUB_INIT2 || type == HUB_INIT3)
+                device_unlock(hub->intfdev);
+
+        kref_put(&hub->kref, hub_release);
 }
 
 /* Implement the continuations for the delays above */
@@ -4512,6 +4532,8 @@ hub_port_init(struct usb_hub *hub, struct usb_device *udev, int port1,
                 goto fail;
         }
 
+        usb_detect_quirks(udev);
+
         if (udev->wusb == 0 && le16_to_cpu(udev->descriptor.bcdUSB) >= 0x0201) {
                 retval = usb_get_bos_descriptor(udev);
                 if (!retval) {
@@ -4710,7 +4732,6 @@ static void hub_port_connect(struct usb_hub *hub, int port1, u16 portstatus,
                 if (status < 0)
                         goto loop;
 
-                usb_detect_quirks(udev);
                 if (udev->quirks & USB_QUIRK_DELAY_INIT)
                         msleep(1000);
 
@@ -5326,9 +5347,6 @@ static int usb_reset_and_verify_device(struct usb_device *udev)
         if (udev->usb2_hw_lpm_enabled == 1)
                 usb_set_usb2_hardware_lpm(udev, 0);
 
-        bos = udev->bos;
-        udev->bos = NULL;
-
         /* Disable LPM and LTM while we reset the device and reinstall the alt
          * settings.  Device-initiated LPM settings, and system exit latency
          * settings are cleared when the device is reset, so we have to set
@@ -5337,15 +5355,18 @@ static int usb_reset_and_verify_device(struct usb_device *udev)
         ret = usb_unlocked_disable_lpm(udev);
         if (ret) {
                 dev_err(&udev->dev, "%s Failed to disable LPM\n.", __func__);
-                goto re_enumerate;
+                goto re_enumerate_no_bos;
         }
         ret = usb_disable_ltm(udev);
         if (ret) {
                 dev_err(&udev->dev, "%s Failed to disable LTM\n.",
                                 __func__);
-                goto re_enumerate;
+                goto re_enumerate_no_bos;
         }
 
+        bos = udev->bos;
+        udev->bos = NULL;
+
         for (i = 0; i < SET_CONFIG_TRIES; ++i) {
 
                 /* ep0 maxpacket size may change; let the HCD know about it.
@@ -5442,10 +5463,11 @@ done:
         return 0;
 
 re_enumerate:
-        /* LPM state doesn't matter when we're about to destroy the device. */
-        hub_port_logical_disconnect(parent_hub, port1);
         usb_release_bos_descriptor(udev);
         udev->bos = bos;
+re_enumerate_no_bos:
+        /* LPM state doesn't matter when we're about to destroy the device. */
+        hub_port_logical_disconnect(parent_hub, port1);
         return -ENODEV;
 }
 
diff --git a/drivers/usb/core/port.c b/drivers/usb/core/port.c
index 210618319f10..5487fe308f01 100644
--- a/drivers/usb/core/port.c
+++ b/drivers/usb/core/port.c
@@ -206,7 +206,7 @@ static int link_peers(struct usb_port *left, struct usb_port *right)
                 else
                         method = "default";
 
-                pr_warn("usb: failed to peer %s and %s by %s (%s:%s) (%s:%s)\n",
+                pr_debug("usb: failed to peer %s and %s by %s (%s:%s) (%s:%s)\n",
                         dev_name(&left->dev), dev_name(&right->dev), method,
                         dev_name(&left->dev),
                         lpeer ? dev_name(&lpeer->dev) : "none",
@@ -265,7 +265,7 @@ static void link_peers_report(struct usb_port *left, struct usb_port *right)
         if (rc == 0) {
                 dev_dbg(&left->dev, "peered to %s\n", dev_name(&right->dev));
         } else {
-                dev_warn(&left->dev, "failed to peer to %s (%d)\n",
+                dev_dbg(&left->dev, "failed to peer to %s (%d)\n",
                                 dev_name(&right->dev), rc);
                 pr_warn_once("usb: port power management may be unreliable\n");
                 usb_port_block_power_off = 1;
diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index f5a381945db2..6dc810bce295 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -125,6 +125,9 @@ static const struct usb_device_id usb_quirk_list[] = {
         { USB_DEVICE(0x04f3, 0x016f), .driver_info =
                         USB_QUIRK_DEVICE_QUALIFIER },
 
+        { USB_DEVICE(0x04f3, 0x21b8), .driver_info =
+                        USB_QUIRK_DEVICE_QUALIFIER },
+
         /* Roland SC-8820 */
         { USB_DEVICE(0x0582, 0x0007), .driver_info = USB_QUIRK_RESET_RESUME },
 
@@ -199,6 +202,12 @@ static const struct usb_device_id usb_quirk_list[] = {
         { USB_DEVICE(0x1a0a, 0x0200), .driver_info =
                         USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL },
 
+        /* Blackmagic Design Intensity Shuttle */
+        { USB_DEVICE(0x1edb, 0xbd3b), .driver_info = USB_QUIRK_NO_LPM },
+
+        /* Blackmagic Design UltraStudio SDI */
+        { USB_DEVICE(0x1edb, 0xbd4f), .driver_info = USB_QUIRK_NO_LPM },
+
         { }  /* terminating entry must be last */
 };
 
diff --git a/drivers/usb/dwc2/platform.c b/drivers/usb/dwc2/platform.c
index e61d773cf65e..39c1cbf0e75d 100644
--- a/drivers/usb/dwc2/platform.c
+++ b/drivers/usb/dwc2/platform.c
@@ -125,9 +125,11 @@ static int __dwc2_lowlevel_hw_enable(struct dwc2_hsotg *hsotg)
         if (ret)
                 return ret;
 
-        ret = clk_prepare_enable(hsotg->clk);
-        if (ret)
-                return ret;
+        if (hsotg->clk) {
+                ret = clk_prepare_enable(hsotg->clk);
+                if (ret)
+                        return ret;
+        }
 
         if (hsotg->uphy)
                 ret = usb_phy_init(hsotg->uphy);
@@ -175,7 +177,8 @@ static int __dwc2_lowlevel_hw_disable(struct dwc2_hsotg *hsotg)
         if (ret)
                 return ret;
 
-        clk_disable_unprepare(hsotg->clk);
+        if (hsotg->clk)
+                clk_disable_unprepare(hsotg->clk);
 
         ret = regulator_bulk_disable(ARRAY_SIZE(hsotg->supplies),
                                      hsotg->supplies);
@@ -212,14 +215,41 @@ static int dwc2_lowlevel_hw_init(struct dwc2_hsotg *hsotg)
          */
         hsotg->phy = devm_phy_get(hsotg->dev, "usb2-phy");
         if (IS_ERR(hsotg->phy)) {
-                hsotg->phy = NULL;
+                ret = PTR_ERR(hsotg->phy);
+                switch (ret) {
+                case -ENODEV:
+                case -ENOSYS:
+                        hsotg->phy = NULL;
+                        break;
+                case -EPROBE_DEFER:
+                        return ret;
+                default:
+                        dev_err(hsotg->dev, "error getting phy %d\n", ret);
+                        return ret;
+                }
+        }
+
+        if (!hsotg->phy) {
                 hsotg->uphy = devm_usb_get_phy(hsotg->dev, USB_PHY_TYPE_USB2);
-                if (IS_ERR(hsotg->uphy))
-                        hsotg->uphy = NULL;
-                else
-                        hsotg->plat = dev_get_platdata(hsotg->dev);
+                if (IS_ERR(hsotg->uphy)) {
+                        ret = PTR_ERR(hsotg->uphy);
+                        switch (ret) {
+                        case -ENODEV:
+                        case -ENXIO:
+                                hsotg->uphy = NULL;
+                                break;
+                        case -EPROBE_DEFER:
+                                return ret;
+                        default:
+                                dev_err(hsotg->dev, "error getting usb phy %d\n",
+                                        ret);
+                                return ret;
+                        }
+                }
         }
 
+        hsotg->plat = dev_get_platdata(hsotg->dev);
+
         if (hsotg->phy) {
                 /*
                  * If using the generic PHY framework, check if the PHY bus
@@ -229,11 +259,6 @@ static int dwc2_lowlevel_hw_init(struct dwc2_hsotg *hsotg)
                         hsotg->phyif = GUSBCFG_PHYIF8;
         }
 
-        if (!hsotg->phy && !hsotg->uphy && !hsotg->plat) {
-                dev_err(hsotg->dev, "no platform data or transceiver defined\n");
-                return -EPROBE_DEFER;
-        }
-
         /* Clock */
         hsotg->clk = devm_clk_get(hsotg->dev, "otg");
         if (IS_ERR(hsotg->clk)) {
@@ -342,20 +367,6 @@ static int dwc2_driver_probe(struct platform_device *dev)
         if (retval)
                 return retval;
 
-        irq = platform_get_irq(dev, 0);
-        if (irq < 0) {
-                dev_err(&dev->dev, "missing IRQ resource\n");
-                return irq;
-        }
-
-        dev_dbg(hsotg->dev, "registering common handler for irq%d\n",
-                irq);
-        retval = devm_request_irq(hsotg->dev, irq,
-                                  dwc2_handle_common_intr, IRQF_SHARED,
-                                  dev_name(hsotg->dev), hsotg);
-        if (retval)
-                return retval;
-
         res = platform_get_resource(dev, IORESOURCE_MEM, 0);
         hsotg->regs = devm_ioremap_resource(&dev->dev, res);
         if (IS_ERR(hsotg->regs))
@@ -390,6 +401,20 @@ static int dwc2_driver_probe(struct platform_device *dev)
 
         dwc2_set_all_params(hsotg->core_params, -1);
 
+        irq = platform_get_irq(dev, 0);
+        if (irq < 0) {
+                dev_err(&dev->dev, "missing IRQ resource\n");
+                return irq;
+        }
+
+        dev_dbg(hsotg->dev, "registering common handler for irq%d\n",
+                irq);
+        retval = devm_request_irq(hsotg->dev, irq,
+                                  dwc2_handle_common_intr, IRQF_SHARED,
+                                  dev_name(hsotg->dev), hsotg);
+        if (retval)
+                return retval;
+
         retval = dwc2_lowlevel_hw_enable(hsotg);
         if (retval)
                 return retval;
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index e24a01cc98df..a58376fd65fe 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -1078,6 +1078,7 @@ static int __dwc3_gadget_ep_queue(struct dwc3_ep *dep, struct dwc3_request *req)
          * little bit faster.
          */
         if (!usb_endpoint_xfer_isoc(dep->endpoint.desc) &&
+                        !usb_endpoint_xfer_int(dep->endpoint.desc) &&
                         !(dep->flags & DWC3_EP_BUSY)) {
                 ret = __dwc3_gadget_kick_transfer(dep, 0, true);
                 goto out;
diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index adc6d52efa46..cf43e9e18368 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -423,7 +423,7 @@ static ssize_t __ffs_ep0_read_events(struct ffs_data *ffs, char __user *buf,
         spin_unlock_irq(&ffs->ev.waitq.lock);
         mutex_unlock(&ffs->mutex);
 
-        return unlikely(__copy_to_user(buf, events, size)) ? -EFAULT : size;
+        return unlikely(copy_to_user(buf, events, size)) ? -EFAULT : size;
 }
 
 static ssize_t ffs_ep0_read(struct file *file, char __user *buf,
@@ -513,7 +513,7 @@ static ssize_t ffs_ep0_read(struct file *file, char __user *buf,
 
                 /* unlocks spinlock */
                 ret = __ffs_ep0_queue_wait(ffs, data, len);
-                if (likely(ret > 0) && unlikely(__copy_to_user(buf, data, len)))
+                if (likely(ret > 0) && unlikely(copy_to_user(buf, data, len)))
                         ret = -EFAULT;
                 goto done_mutex;
 
@@ -3493,7 +3493,7 @@ static char *ffs_prepare_buffer(const char __user *buf, size_t len)
         if (unlikely(!data))
                 return ERR_PTR(-ENOMEM);
 
-        if (unlikely(__copy_from_user(data, buf, len))) {
+        if (unlikely(copy_from_user(data, buf, len))) {
                 kfree(data);
                 return ERR_PTR(-EFAULT);
         }
diff --git a/drivers/usb/gadget/function/f_midi.c b/drivers/usb/gadget/function/f_midi.c
index 42acb45e1ab4..898a570319f1 100644
--- a/drivers/usb/gadget/function/f_midi.c
+++ b/drivers/usb/gadget/function/f_midi.c
@@ -370,6 +370,7 @@ static int f_midi_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
                 if (err) {
                         ERROR(midi, "%s queue req: %d\n",
                                     midi->out_ep->name, err);
+                        free_ep_req(midi->out_ep, req);
                 }
         }
 
@@ -545,7 +546,7 @@ static void f_midi_transmit(struct f_midi *midi, struct usb_request *req)
                 }
         }
 
-        if (req->length > 0) {
+        if (req->length > 0 && ep->enabled) {
                 int err;
 
                 err = usb_ep_queue(ep, req, GFP_ATOMIC);
diff --git a/drivers/usb/gadget/function/uvc_configfs.c b/drivers/usb/gadget/function/uvc_configfs.c
index 289ebca316d3..ad8c9b05572d 100644
--- a/drivers/usb/gadget/function/uvc_configfs.c
+++ b/drivers/usb/gadget/function/uvc_configfs.c
@@ -20,7 +20,7 @@
 #define UVC_ATTR(prefix, cname, aname) \
 static struct configfs_attribute prefix##attr_##cname = { \
         .ca_name        = __stringify(aname),                           \
-        .ca_mode        = S_IRUGO,                                      \
+        .ca_mode        = S_IRUGO | S_IWUGO,                            \
         .ca_owner       = THIS_MODULE,                                  \
         .show           = prefix##cname##_show,                         \
         .store          = prefix##cname##_store,                        \
diff --git a/drivers/usb/gadget/udc/pxa27x_udc.c b/drivers/usb/gadget/udc/pxa27x_udc.c
index 670ac0b12f00..001a3b74a993 100644
--- a/drivers/usb/gadget/udc/pxa27x_udc.c
+++ b/drivers/usb/gadget/udc/pxa27x_udc.c
@@ -2536,6 +2536,9 @@ static int pxa_udc_suspend(struct platform_device *_dev, pm_message_t state)
         udc->pullup_resume = udc->pullup_on;
         dplus_pullup(udc, 0);
 
+        if (udc->driver)
+                udc->driver->disconnect(&udc->gadget);
+
         return 0;
 }
 
diff --git a/drivers/usb/host/ohci-at91.c b/drivers/usb/host/ohci-at91.c
index 342ffd140122..8c6e15bd6ff0 100644
--- a/drivers/usb/host/ohci-at91.c
+++ b/drivers/usb/host/ohci-at91.c
@@ -473,6 +473,8 @@ static int ohci_hcd_at91_drv_probe(struct platform_device *pdev)
         if (!pdata)
                 return -ENOMEM;
 
+        pdev->dev.platform_data = pdata;
+
         if (!of_property_read_u32(np, "num-ports", &ports))
                 pdata->ports = ports;
 
@@ -483,6 +485,7 @@ static int ohci_hcd_at91_drv_probe(struct platform_device *pdev)
                  */
                 if (i >= pdata->ports) {
                         pdata->vbus_pin[i] = -EINVAL;
+                        pdata->overcurrent_pin[i] = -EINVAL;
                         continue;
                 }
 
@@ -513,10 +516,8 @@ static int ohci_hcd_at91_drv_probe(struct platform_device *pdev)
         }
 
         at91_for_each_port(i) {
-                if (i >= pdata->ports) {
-                        pdata->overcurrent_pin[i] = -EINVAL;
-                        continue;
-                }
+                if (i >= pdata->ports)
+                        break;
 
                 pdata->overcurrent_pin[i] =
                         of_get_named_gpio_flags(np, "atmel,oc-gpio", i, &flags);
@@ -552,8 +553,6 @@ static int ohci_hcd_at91_drv_probe(struct platform_device *pdev)
                 }
         }
 
-        pdev->dev.platform_data = pdata;
-
         device_init_wakeup(&pdev->dev, 1);
         return usb_hcd_at91_probe(&ohci_at91_hc_driver, pdev);
 }
diff --git a/drivers/usb/host/whci/qset.c b/drivers/usb/host/whci/qset.c
index dc31c425ce01..9f1c0538b211 100644
--- a/drivers/usb/host/whci/qset.c
+++ b/drivers/usb/host/whci/qset.c
@@ -377,6 +377,10 @@ static int qset_fill_page_list(struct whc *whc, struct whc_std *std, gfp_t mem_f
         if (std->pl_virt == NULL)
                 return -ENOMEM;
         std->dma_addr = dma_map_single(whc->wusbhc.dev, std->pl_virt, pl_len, DMA_TO_DEVICE);
+        if (dma_mapping_error(whc->wusbhc.dev, std->dma_addr)) {
+                kfree(std->pl_virt);
+                return -EFAULT;
+        }
 
         for (p = 0; p < std->num_pointers; p++) {
                 std->pl_virt[p].buf_ptr = cpu_to_le64(dma_addr);
diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index 0230965fb78c..f980c239eded 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -733,8 +733,30 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd,
                 if ((raw_port_status & PORT_RESET) ||
                                 !(raw_port_status & PORT_PE))
                         return 0xffffffff;
-                if (time_after_eq(jiffies,
-                                        bus_state->resume_done[wIndex])) {
+                /* did port event handler already start resume timing? */
+                if (!bus_state->resume_done[wIndex]) {
+                        /* If not, maybe we are in a host initated resume? */
+                        if (test_bit(wIndex, &bus_state->resuming_ports)) {
+                                /* Host initated resume doesn't time the resume
+                                 * signalling using resume_done[].
+                                 * It manually sets RESUME state, sleeps 20ms
+                                 * and sets U0 state. This should probably be
+                                 * changed, but not right now.
+                                 */
+                        } else {
+                                /* port resume was discovered now and here,
+                                 * start resume timing
+                                 */
+                                unsigned long timeout = jiffies +
+                                        msecs_to_jiffies(USB_RESUME_TIMEOUT);
+
+                                set_bit(wIndex, &bus_state->resuming_ports);
+                                bus_state->resume_done[wIndex] = timeout;
+                                mod_timer(&hcd->rh_timer, timeout);
+                        }
+                /* Has resume been signalled for USB_RESUME_TIME yet? */
+                } else if (time_after_eq(jiffies,
+                                         bus_state->resume_done[wIndex])) {
                         int time_left;
 
                         xhci_dbg(xhci, "Resume USB2 port %d\n",
@@ -775,13 +797,26 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd,
                 } else {
                         /*
                          * The resume has been signaling for less than
-                         * 20ms. Report the port status as SUSPEND,
-                         * let the usbcore check port status again
-                         * and clear resume signaling later.
+                         * USB_RESUME_TIME. Report the port status as SUSPEND,
+                         * let the usbcore check port status again and clear
+                         * resume signaling later.
                          */
                         status |= USB_PORT_STAT_SUSPEND;
                 }
         }
+        /*
+         * Clear stale usb2 resume signalling variables in case port changed
+         * state during resume signalling. For example on error
+         */
+        if ((bus_state->resume_done[wIndex] ||
+             test_bit(wIndex, &bus_state->resuming_ports)) &&
+            (raw_port_status & PORT_PLS_MASK) != XDEV_U3 &&
+            (raw_port_status & PORT_PLS_MASK) != XDEV_RESUME) {
+                bus_state->resume_done[wIndex] = 0;
+                clear_bit(wIndex, &bus_state->resuming_ports);
+        }
+
+
         if ((raw_port_status & PORT_PLS_MASK) == XDEV_U0 &&
             (raw_port_status & PORT_POWER)) {
                 if (bus_state->suspended_ports & (1 << wIndex)) {
@@ -1115,6 +1150,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
                                 if ((temp & PORT_PE) == 0)
                                         goto error;
 
+                                set_bit(wIndex, &bus_state->resuming_ports);
                                 xhci_set_link_state(xhci, port_array, wIndex,
                                                         XDEV_RESUME);
                                 spin_unlock_irqrestore(&xhci->lock, flags);
@@ -1122,6 +1158,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
                                 spin_lock_irqsave(&xhci->lock, flags);
                                 xhci_set_link_state(xhci, port_array, wIndex,
                                                         XDEV_U0);
+                                clear_bit(wIndex, &bus_state->resuming_ports);
                         }
                         bus_state->port_c_suspend |= 1 << wIndex;
 
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index 17f6897acde2..c62109091d12 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -188,10 +188,14 @@ static void xhci_pme_acpi_rtd3_enable(struct pci_dev *dev)
                 0xb7, 0x0c, 0x34, 0xac, 0x01, 0xe9, 0xbf, 0x45,
                 0xb7, 0xe6, 0x2b, 0x34, 0xec, 0x93, 0x1e, 0x23,
         };
-        acpi_evaluate_dsm(ACPI_HANDLE(&dev->dev), intel_dsm_uuid, 3, 1, NULL);
+        union acpi_object *obj;
+
+        obj = acpi_evaluate_dsm(ACPI_HANDLE(&dev->dev), intel_dsm_uuid, 3, 1,
+                                NULL);
+        ACPI_FREE(obj);
 }
 #else
-        static void xhci_pme_acpi_rtd3_enable(struct pci_dev *dev) { }
+static void xhci_pme_acpi_rtd3_enable(struct pci_dev *dev) { }
 #endif /* CONFIG_ACPI */
 
 /* called during probe() after chip reset completes */
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 6c5e8133cf87..eeaa6c6bd540 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -1583,7 +1583,8 @@ static void handle_port_status(struct xhci_hcd *xhci,
                          */
                         bogus_port_status = true;
                         goto cleanup;
-                } else {
+                } else if (!test_bit(faked_port_index,
+                                     &bus_state->resuming_ports)) {
                         xhci_dbg(xhci, "resume HS port %d\n", port_id);
                         bus_state->resume_done[faked_port_index] = jiffies +
                                 msecs_to_jiffies(USB_RESUME_TIMEOUT);
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index dfa44d3e8eee..3f912705dcef 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -4778,8 +4778,16 @@ int xhci_update_hub_device(struct usb_hcd *hcd, struct usb_device *hdev,
         ctrl_ctx->add_flags |= cpu_to_le32(SLOT_FLAG);
         slot_ctx = xhci_get_slot_ctx(xhci, config_cmd->in_ctx);
         slot_ctx->dev_info |= cpu_to_le32(DEV_HUB);
+        /*
+         * refer to section 6.2.2: MTT should be 0 for full speed hub,
+         * but it may be already set to 1 when setup an xHCI virtual
+         * device, so clear it anyway.
+         */
         if (tt->multi)
                 slot_ctx->dev_info |= cpu_to_le32(DEV_MTT);
+        else if (hdev->speed == USB_SPEED_FULL)
+                slot_ctx->dev_info &= cpu_to_le32(~DEV_MTT);
+
         if (xhci->hci_version > 0x95) {
                 xhci_dbg(xhci, "xHCI version %x needs hub "
                                 "TT think time and number of ports\n",
diff --git a/drivers/usb/musb/Kconfig b/drivers/usb/musb/Kconfig
index 1f2037bbeb0d..45c83baf675d 100644
--- a/drivers/usb/musb/Kconfig
+++ b/drivers/usb/musb/Kconfig
@@ -159,7 +159,7 @@ config USB_TI_CPPI_DMA
 
 config USB_TI_CPPI41_DMA
         bool 'TI CPPI 4.1 (AM335x)'
-        depends on ARCH_OMAP
+        depends on ARCH_OMAP && DMADEVICES
         select TI_CPPI41
 
 config USB_TUSB_OMAP_DMA
diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
index 18cfc0a361cb..ee9ff7028b92 100644
--- a/drivers/usb/musb/musb_core.c
+++ b/drivers/usb/musb/musb_core.c
@@ -2017,7 +2017,6 @@ musb_init_controller(struct device *dev, int nIrq, void __iomem *ctrl)
         /* We need musb_read/write functions initialized for PM */
         pm_runtime_use_autosuspend(musb->controller);
         pm_runtime_set_autosuspend_delay(musb->controller, 200);
-        pm_runtime_irq_safe(musb->controller);
         pm_runtime_enable(musb->controller);
 
         /* The musb_platform_init() call:
@@ -2095,6 +2094,7 @@ musb_init_controller(struct device *dev, int nIrq, void __iomem *ctrl)
 #ifndef CONFIG_MUSB_PIO_ONLY
         if (!musb->ops->dma_init || !musb->ops->dma_exit) {
                 dev_err(dev, "DMA controller not set\n");
+                status = -ENODEV;
                 goto fail2;
         }
         musb_dma_controller_create = musb->ops->dma_init;
@@ -2218,6 +2218,12 @@ musb_init_controller(struct device *dev, int nIrq, void __iomem *ctrl)
 
         pm_runtime_put(musb->controller);
 
+        /*
+         * For why this is currently needed, see commit 3e43a0725637
+         * ("usb: musb: core: add pm_runtime_irq_safe()")
+         */
+        pm_runtime_irq_safe(musb->controller);
+
         return 0;
 
 fail5:
diff --git a/drivers/usb/phy/phy-msm-usb.c b/drivers/usb/phy/phy-msm-usb.c
index 80eb991c2506..0d19a6d61a71 100644
--- a/drivers/usb/phy/phy-msm-usb.c
+++ b/drivers/usb/phy/phy-msm-usb.c
@@ -1506,7 +1506,6 @@ static int msm_otg_read_dt(struct platform_device *pdev, struct msm_otg *motg)
 {
         struct msm_otg_platform_data *pdata;
         struct extcon_dev *ext_id, *ext_vbus;
-        const struct of_device_id *id;
         struct device_node *node = pdev->dev.of_node;
         struct property *prop;
         int len, ret, words;
@@ -1518,8 +1517,9 @@ static int msm_otg_read_dt(struct platform_device *pdev, struct msm_otg *motg)
 
         motg->pdata = pdata;
 
-        id = of_match_device(msm_otg_dt_match, &pdev->dev);
-        pdata->phy_type = (enum msm_usb_phy_type) id->data;
+        pdata->phy_type = (enum msm_usb_phy_type)of_device_get_match_data(&pdev->dev);
+        if (!pdata->phy_type)
+                return 1;
 
         motg->link_rst = devm_reset_control_get(&pdev->dev, "link");
         if (IS_ERR(motg->link_rst))
diff --git a/drivers/usb/phy/phy-mxs-usb.c b/drivers/usb/phy/phy-mxs-usb.c
index b7536af777ab..c2936dc48ca7 100644
--- a/drivers/usb/phy/phy-mxs-usb.c
+++ b/drivers/usb/phy/phy-mxs-usb.c
@@ -143,12 +143,17 @@ static const struct mxs_phy_data imx6sx_phy_data = {
         .flags = MXS_PHY_DISCONNECT_LINE_WITHOUT_VBUS,
 };
 
+static const struct mxs_phy_data imx6ul_phy_data = {
+        .flags = MXS_PHY_DISCONNECT_LINE_WITHOUT_VBUS,
+};
+
 static const struct of_device_id mxs_phy_dt_ids[] = {
         { .compatible = "fsl,imx6sx-usbphy", .data = &imx6sx_phy_data, },
         { .compatible = "fsl,imx6sl-usbphy", .data = &imx6sl_phy_data, },
         { .compatible = "fsl,imx6q-usbphy", .data = &imx6q_phy_data, },
         { .compatible = "fsl,imx23-usbphy", .data = &imx23_phy_data, },
         { .compatible = "fsl,vf610-usbphy", .data = &vf610_phy_data, },
+        { .compatible = "fsl,imx6ul-usbphy", .data = &imx6ul_phy_data, },
         { /* sentinel */ }
 };
 MODULE_DEVICE_TABLE(of, mxs_phy_dt_ids);
diff --git a/drivers/usb/renesas_usbhs/mod_gadget.c b/drivers/usb/renesas_usbhs/mod_gadget.c
index de4f97d84a82..8f7a78e70975 100644
--- a/drivers/usb/renesas_usbhs/mod_gadget.c
+++ b/drivers/usb/renesas_usbhs/mod_gadget.c
@@ -131,7 +131,8 @@ static void __usbhsg_queue_pop(struct usbhsg_uep *uep,
         struct device *dev = usbhsg_gpriv_to_dev(gpriv);
         struct usbhs_priv *priv = usbhsg_gpriv_to_priv(gpriv);
 
-        dev_dbg(dev, "pipe %d : queue pop\n", usbhs_pipe_number(pipe));
+        if (pipe)
+                dev_dbg(dev, "pipe %d : queue pop\n", usbhs_pipe_number(pipe));
 
         ureq->req.status = status;
         spin_unlock(usbhs_priv_to_lock(priv));
@@ -685,7 +686,13 @@ static int usbhsg_ep_dequeue(struct usb_ep *ep, struct usb_request *req)
         struct usbhsg_request *ureq = usbhsg_req_to_ureq(req);
         struct usbhs_pipe *pipe = usbhsg_uep_to_pipe(uep);
 
-        usbhs_pkt_pop(pipe, usbhsg_ureq_to_pkt(ureq));
+        if (pipe)
+                usbhs_pkt_pop(pipe, usbhsg_ureq_to_pkt(ureq));
+
+        /*
+         * To dequeue a request, this driver should call the usbhsg_queue_pop()
+         * even if the pipe is NULL.
+         */
         usbhsg_queue_pop(uep, ureq, -ECONNRESET);
 
         return 0;
diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
index eac7ccaa3c85..7d4f51a32e66 100644
--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
@@ -132,7 +132,6 @@ static const struct usb_device_id id_table[] = {
         { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */
         { USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */
         { USB_DEVICE(0x10C4, 0xEA70) }, /* Silicon Labs factory default */
-        { USB_DEVICE(0x10C4, 0xEA80) }, /* Silicon Labs factory default */
         { USB_DEVICE(0x10C4, 0xEA71) }, /* Infinity GPS-MIC-1 Radio Monophone */
         { USB_DEVICE(0x10C4, 0xF001) }, /* Elan Digital Systems USBscope50 */
         { USB_DEVICE(0x10C4, 0xF002) }, /* Elan Digital Systems USBwave12 */
diff --git a/drivers/usb/serial/ipaq.c b/drivers/usb/serial/ipaq.c
index f51a5d52c0ed..ec1b8f2c1183 100644
--- a/drivers/usb/serial/ipaq.c
+++ b/drivers/usb/serial/ipaq.c
@@ -531,7 +531,8 @@ static int ipaq_open(struct tty_struct *tty,
          * through. Since this has a reasonably high failure rate, we retry
          * several times.
          */
-        while (retries--) {
+        while (retries) {
+                retries--;
                 result = usb_control_msg(serial->dev,
                                 usb_sndctrlpipe(serial->dev, 0), 0x22, 0x21,
                                 0x1, 0, NULL, 0, 100);
diff --git a/drivers/usb/serial/usb-serial-simple.c b/drivers/usb/serial/usb-serial-simple.c
index 3658662898fc..a204782ae530 100644
--- a/drivers/usb/serial/usb-serial-simple.c
+++ b/drivers/usb/serial/usb-serial-simple.c
@@ -53,6 +53,7 @@ DEVICE(funsoft, FUNSOFT_IDS);
 
 /* Infineon Flashloader driver */
 #define FLASHLOADER_IDS()               \
+        { USB_DEVICE_INTERFACE_CLASS(0x058b, 0x0041, USB_CLASS_CDC_DATA) }, \
         { USB_DEVICE(0x8087, 0x0716) }
 DEVICE(flashloader, FLASHLOADER_IDS);
 
diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c
index e69151664436..5c66d3f7a6d0 100644
--- a/drivers/usb/storage/uas.c
+++ b/drivers/usb/storage/uas.c
@@ -796,6 +796,10 @@ static int uas_slave_configure(struct scsi_device *sdev)
         if (devinfo->flags & US_FL_NO_REPORT_OPCODES)
                 sdev->no_report_opcodes = 1;
 
+        /* A few buggy USB-ATA bridges don't understand FUA */
+        if (devinfo->flags & US_FL_BROKEN_FUA)
+                sdev->broken_fua = 1;
+
         scsi_change_queue_depth(sdev, devinfo->qdepth - 2);
         return 0;
 }
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index 6b2479123de7..7ffe4209067b 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -1987,7 +1987,7 @@ UNUSUAL_DEV(  0x14cd, 0x6600, 0x0201, 0x0201,
                 US_FL_IGNORE_RESIDUE ),
 
 /* Reported by Michael Büsch <m@bues.ch> */
-UNUSUAL_DEV(  0x152d, 0x0567, 0x0114, 0x0114,
+UNUSUAL_DEV(  0x152d, 0x0567, 0x0114, 0x0116,
                 "JMicron",
                 "USB to ATA/ATAPI Bridge",
                 USB_SC_DEVICE, USB_PR_DEVICE, NULL,
diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h
index c85ea530085f..ccc113e83d88 100644
--- a/drivers/usb/storage/unusual_uas.h
+++ b/drivers/usb/storage/unusual_uas.h
@@ -132,7 +132,7 @@ UNUSUAL_DEV(0x152d, 0x0567, 0x0000, 0x9999,
                 "JMicron",
                 "JMS567",
                 USB_SC_DEVICE, USB_PR_DEVICE, NULL,
-                US_FL_NO_REPORT_OPCODES),
+                US_FL_BROKEN_FUA | US_FL_NO_REPORT_OPCODES),
 
 /* Reported-by: Hans de Goede <hdegoede@redhat.com> */
 UNUSUAL_DEV(0x2109, 0x0711, 0x0000, 0x9999,
diff --git a/drivers/vfio/Kconfig b/drivers/vfio/Kconfig
index da6e2ce77495..850d86ca685b 100644
--- a/drivers/vfio/Kconfig
+++ b/drivers/vfio/Kconfig
@@ -31,21 +31,6 @@ menuconfig VFIO
 
           If you don't know what to do here, say N.
 
-menuconfig VFIO_NOIOMMU
-        bool "VFIO No-IOMMU support"
-        depends on VFIO
-        help
-          VFIO is built on the ability to isolate devices using the IOMMU.
-          Only with an IOMMU can userspace access to DMA capable devices be
-          considered secure.  VFIO No-IOMMU mode enables IOMMU groups for
-          devices without IOMMU backing for the purpose of re-using the VFIO
-          infrastructure in a non-secure mode.  Use of this mode will result
-          in an unsupportable kernel and will therefore taint the kernel.
-          Device assignment to virtual machines is also not possible with
-          this mode since there is no IOMMU to provide DMA translation.
-
-          If you don't know what to do here, say N.
-
 source "drivers/vfio/pci/Kconfig"
 source "drivers/vfio/platform/Kconfig"
 source "virt/lib/Kconfig"
diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
index 32b88bd2c82c..56bf6dbb93db 100644
--- a/drivers/vfio/pci/vfio_pci.c
+++ b/drivers/vfio/pci/vfio_pci.c
@@ -940,13 +940,13 @@ static int vfio_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
         if (pdev->hdr_type != PCI_HEADER_TYPE_NORMAL)
                 return -EINVAL;
 
-        group = vfio_iommu_group_get(&pdev->dev);
+        group = iommu_group_get(&pdev->dev);
         if (!group)
                 return -EINVAL;
 
         vdev = kzalloc(sizeof(*vdev), GFP_KERNEL);
         if (!vdev) {
-                vfio_iommu_group_put(group, &pdev->dev);
+                iommu_group_put(group);
                 return -ENOMEM;
         }
 
@@ -957,7 +957,7 @@ static int vfio_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 
         ret = vfio_add_group_dev(&pdev->dev, &vfio_pci_ops, vdev);
         if (ret) {
-                vfio_iommu_group_put(group, &pdev->dev);
+                iommu_group_put(group);
                 kfree(vdev);
                 return ret;
         }
@@ -993,7 +993,7 @@ static void vfio_pci_remove(struct pci_dev *pdev)
         if (!vdev)
                 return;
 
-        vfio_iommu_group_put(pdev->dev.iommu_group, &pdev->dev);
+        iommu_group_put(pdev->dev.iommu_group);
         kfree(vdev);
 
         if (vfio_pci_is_vga(pdev)) {
@@ -1035,7 +1035,7 @@ static pci_ers_result_t vfio_pci_aer_err_detected(struct pci_dev *pdev,
         return PCI_ERS_RESULT_CAN_RECOVER;
 }
 
-static struct pci_error_handlers vfio_err_handlers = {
+static const struct pci_error_handlers vfio_err_handlers = {
         .error_detected = vfio_pci_aer_err_detected,
 };
 
diff --git a/drivers/vfio/platform/vfio_platform.c b/drivers/vfio/platform/vfio_platform.c
index f1625dcfbb23..b1cc3a768784 100644
--- a/drivers/vfio/platform/vfio_platform.c
+++ b/drivers/vfio/platform/vfio_platform.c
@@ -92,7 +92,6 @@ static struct platform_driver vfio_platform_driver = {
         .remove         = vfio_platform_remove,
         .driver = {
                 .name   = "vfio-platform",
-                .owner  = THIS_MODULE,
         },
 };
 
diff --git a/drivers/vfio/platform/vfio_platform_common.c b/drivers/vfio/platform/vfio_platform_common.c
index a1c50d630792..418cdd9ba3f4 100644
--- a/drivers/vfio/platform/vfio_platform_common.c
+++ b/drivers/vfio/platform/vfio_platform_common.c
@@ -51,13 +51,10 @@ static vfio_platform_reset_fn_t vfio_platform_lookup_reset(const char *compat,
 
 static void vfio_platform_get_reset(struct vfio_platform_device *vdev)
 {
-        char modname[256];
-
         vdev->reset = vfio_platform_lookup_reset(vdev->compat,
                                                 &vdev->reset_module);
         if (!vdev->reset) {
-                snprintf(modname, 256, "vfio-reset:%s", vdev->compat);
-                request_module(modname);
+                request_module("vfio-reset:%s", vdev->compat);
                 vdev->reset = vfio_platform_lookup_reset(vdev->compat,
                                                          &vdev->reset_module);
         }
diff --git a/drivers/vfio/vfio.c b/drivers/vfio/vfio.c
index de632da2e22f..6070b793cbcb 100644
--- a/drivers/vfio/vfio.c
+++ b/drivers/vfio/vfio.c
@@ -62,7 +62,6 @@ struct vfio_container {
         struct rw_semaphore             group_lock;
         struct vfio_iommu_driver        *iommu_driver;
         void                            *iommu_data;
-        bool                            noiommu;
 };
 
 struct vfio_unbound_dev {
@@ -85,7 +84,6 @@ struct vfio_group {
         struct list_head                unbound_list;
         struct mutex                    unbound_lock;
         atomic_t                        opened;
-        bool                            noiommu;
 };
 
 struct vfio_device {
@@ -97,147 +95,6 @@ struct vfio_device {
         void                            *device_data;
 };
 
-#ifdef CONFIG_VFIO_NOIOMMU
-static bool noiommu __read_mostly;
-module_param_named(enable_unsafe_noiommu_support,
-                   noiommu, bool, S_IRUGO | S_IWUSR);
-MODULE_PARM_DESC(enable_unsafe_noiommu_mode, "Enable UNSAFE, no-IOMMU mode.  This mode provides no device isolation, no DMA translation, no host kernel protection, cannot be used for device assignment to virtual machines, requires RAWIO permissions, and will taint the kernel.  If you do not know what this is for, step away. (default: false)");
-#endif
-
-/*
- * vfio_iommu_group_{get,put} are only intended for VFIO bus driver probe
- * and remove functions, any use cases other than acquiring the first
- * reference for the purpose of calling vfio_add_group_dev() or removing
- * that symmetric reference after vfio_del_group_dev() should use the raw
- * iommu_group_{get,put} functions.  In particular, vfio_iommu_group_put()
- * removes the device from the dummy group and cannot be nested.
- */
-struct iommu_group *vfio_iommu_group_get(struct device *dev)
-{
-        struct iommu_group *group;
-        int __maybe_unused ret;
-
-        group = iommu_group_get(dev);
-
-#ifdef CONFIG_VFIO_NOIOMMU
-        /*
-         * With noiommu enabled, an IOMMU group will be created for a device
-         * that doesn't already have one and doesn't have an iommu_ops on their
-         * bus.  We use iommu_present() again in the main code to detect these
-         * fake groups.
-         */
-        if (group || !noiommu || iommu_present(dev->bus))
-                return group;
-
-        group = iommu_group_alloc();
-        if (IS_ERR(group))
-                return NULL;
-
-        iommu_group_set_name(group, "vfio-noiommu");
-        ret = iommu_group_add_device(group, dev);
-        iommu_group_put(group);
-        if (ret)
-                return NULL;
-
-        /*
-         * Where to taint?  At this point we've added an IOMMU group for a
-         * device that is not backed by iommu_ops, therefore any iommu_
-         * callback using iommu_ops can legitimately Oops.  So, while we may
-         * be about to give a DMA capable device to a user without IOMMU
-         * protection, which is clearly taint-worthy, let's go ahead and do
-         * it here.
-         */
-        add_taint(TAINT_USER, LOCKDEP_STILL_OK);
-        dev_warn(dev, "Adding kernel taint for vfio-noiommu group on device\n");
-#endif
-
-        return group;
-}
-EXPORT_SYMBOL_GPL(vfio_iommu_group_get);
-
-void vfio_iommu_group_put(struct iommu_group *group, struct device *dev)
-{
-#ifdef CONFIG_VFIO_NOIOMMU
-        if (!iommu_present(dev->bus))
-                iommu_group_remove_device(dev);
-#endif
-
-        iommu_group_put(group);
-}
-EXPORT_SYMBOL_GPL(vfio_iommu_group_put);
-
-#ifdef CONFIG_VFIO_NOIOMMU
-static void *vfio_noiommu_open(unsigned long arg)
-{
-        if (arg != VFIO_NOIOMMU_IOMMU)
-                return ERR_PTR(-EINVAL);
-        if (!capable(CAP_SYS_RAWIO))
-                return ERR_PTR(-EPERM);
-
-        return NULL;
-}
-
-static void vfio_noiommu_release(void *iommu_data)
-{
-}
-
-static long vfio_noiommu_ioctl(void *iommu_data,
-                               unsigned int cmd, unsigned long arg)
-{
-        if (cmd == VFIO_CHECK_EXTENSION)
-                return arg == VFIO_NOIOMMU_IOMMU ? 1 : 0;
-
-        return -ENOTTY;
-}
-
-static int vfio_iommu_present(struct device *dev, void *unused)
-{
-        return iommu_present(dev->bus) ? 1 : 0;
-}
-
-static int vfio_noiommu_attach_group(void *iommu_data,
-                                     struct iommu_group *iommu_group)
-{
-        return iommu_group_for_each_dev(iommu_group, NULL,
-                                        vfio_iommu_present) ? -EINVAL : 0;
-}
-
-static void vfio_noiommu_detach_group(void *iommu_data,
-                                      struct iommu_group *iommu_group)
-{
-}
-
-static struct vfio_iommu_driver_ops vfio_noiommu_ops = {
-        .name = "vfio-noiommu",
-        .owner = THIS_MODULE,
-        .open = vfio_noiommu_open,
-        .release = vfio_noiommu_release,
-        .ioctl = vfio_noiommu_ioctl,
-        .attach_group = vfio_noiommu_attach_group,
-        .detach_group = vfio_noiommu_detach_group,
-};
-
-static struct vfio_iommu_driver vfio_noiommu_driver = {
-        .ops = &vfio_noiommu_ops,
-};
-
-/*
- * Wrap IOMMU drivers, the noiommu driver is the one and only driver for
- * noiommu groups (and thus containers) and not available for normal groups.
- */
-#define vfio_for_each_iommu_driver(con, pos)                            \
-        for (pos = con->noiommu ? &vfio_noiommu_driver :                \
-             list_first_entry(&vfio.iommu_drivers_list,                 \
-                              struct vfio_iommu_driver, vfio_next);     \
-             (con->noiommu ? pos != NULL :                              \
-                        &pos->vfio_next != &vfio.iommu_drivers_list);   \
-              pos = con->noiommu ? NULL : list_next_entry(pos, vfio_next))
-#else
-#define vfio_for_each_iommu_driver(con, pos)                            \
-        list_for_each_entry(pos, &vfio.iommu_drivers_list, vfio_next)
-#endif
-
-
 /**
  * IOMMU driver registration
  */
@@ -342,8 +199,7 @@ static void vfio_group_unlock_and_free(struct vfio_group *group)
 /**
  * Group objects - create, release, get, put, search
  */
-static struct vfio_group *vfio_create_group(struct iommu_group *iommu_group,
-                                            bool noiommu)
+static struct vfio_group *vfio_create_group(struct iommu_group *iommu_group)
 {
         struct vfio_group *group, *tmp;
         struct device *dev;
@@ -361,7 +217,6 @@ static struct vfio_group *vfio_create_group(struct iommu_group *iommu_group,
         atomic_set(&group->container_users, 0);
         atomic_set(&group->opened, 0);
         group->iommu_group = iommu_group;
-        group->noiommu = noiommu;
 
         group->nb.notifier_call = vfio_iommu_group_notifier;
 
@@ -397,8 +252,7 @@ static struct vfio_group *vfio_create_group(struct iommu_group *iommu_group,
 
         dev = device_create(vfio.class, NULL,
                             MKDEV(MAJOR(vfio.group_devt), minor),
-                            group, "%s%d", noiommu ? "noiommu-" : "",
-                            iommu_group_id(iommu_group));
+                            group, "%d", iommu_group_id(iommu_group));
         if (IS_ERR(dev)) {
                 vfio_free_group_minor(minor);
                 vfio_group_unlock_and_free(group);
@@ -682,7 +536,7 @@ static int vfio_group_nb_add_dev(struct vfio_group *group, struct device *dev)
                 return 0;
 
         /* TODO Prevent device auto probing */
-        WARN("Device %s added to live group %d!\n", dev_name(dev),
+        WARN(1, "Device %s added to live group %d!\n", dev_name(dev),
              iommu_group_id(group->iommu_group));
 
         return 0;
@@ -786,8 +640,7 @@ int vfio_add_group_dev(struct device *dev,
 
         group = vfio_group_get_from_iommu(iommu_group);
         if (!group) {
-                group = vfio_create_group(iommu_group,
-                                          !iommu_present(dev->bus));
+                group = vfio_create_group(iommu_group);
                 if (IS_ERR(group)) {
                         iommu_group_put(iommu_group);
                         return PTR_ERR(group);
@@ -999,7 +852,8 @@ static long vfio_ioctl_check_extension(struct vfio_container *container,
                  */
                 if (!driver) {
                         mutex_lock(&vfio.iommu_drivers_lock);
-                        vfio_for_each_iommu_driver(container, driver) {
+                        list_for_each_entry(driver, &vfio.iommu_drivers_list,
+                                            vfio_next) {
                                 if (!try_module_get(driver->ops->owner))
                                         continue;
 
@@ -1068,7 +922,7 @@ static long vfio_ioctl_set_iommu(struct vfio_container *container,
         }
 
         mutex_lock(&vfio.iommu_drivers_lock);
-        vfio_for_each_iommu_driver(container, driver) {
+        list_for_each_entry(driver, &vfio.iommu_drivers_list, vfio_next) {
                 void *data;
 
                 if (!try_module_get(driver->ops->owner))
@@ -1333,9 +1187,6 @@ static int vfio_group_set_container(struct vfio_group *group, int container_fd)
         if (atomic_read(&group->container_users))
                 return -EINVAL;
 
-        if (group->noiommu && !capable(CAP_SYS_RAWIO))
-                return -EPERM;
-
         f = fdget(container_fd);
         if (!f.file)
                 return -EBADF;
@@ -1351,13 +1202,6 @@ static int vfio_group_set_container(struct vfio_group *group, int container_fd)
 
         down_write(&container->group_lock);
 
-        /* Real groups and fake groups cannot mix */
-        if (!list_empty(&container->group_list) &&
-            container->noiommu != group->noiommu) {
-                ret = -EPERM;
-                goto unlock_out;
-        }
-
         driver = container->iommu_driver;
         if (driver) {
                 ret = driver->ops->attach_group(container->iommu_data,
@@ -1367,7 +1211,6 @@ static int vfio_group_set_container(struct vfio_group *group, int container_fd)
         }
 
         group->container = container;
-        container->noiommu = group->noiommu;
         list_add(&group->container_next, &container->group_list);
 
         /* Get a reference on the container and mark a user within the group */
@@ -1398,9 +1241,6 @@ static int vfio_group_get_device_fd(struct vfio_group *group, char *buf)
             !group->container->iommu_driver || !vfio_group_viable(group))
                 return -EINVAL;
 
-        if (group->noiommu && !capable(CAP_SYS_RAWIO))
-                return -EPERM;
-
         device = vfio_device_get_from_name(group, buf);
         if (!device)
                 return -ENODEV;
@@ -1443,10 +1283,6 @@ static int vfio_group_get_device_fd(struct vfio_group *group, char *buf)
 
         fd_install(ret, filep);
 
-        if (group->noiommu)
-                dev_warn(device->dev, "vfio-noiommu device opened by user "
-                         "(%s:%d)\n", current->comm, task_pid_nr(current));
-
         return ret;
 }
 
@@ -1535,11 +1371,6 @@ static int vfio_group_fops_open(struct inode *inode, struct file *filep)
         if (!group)
                 return -ENODEV;
 
-        if (group->noiommu && !capable(CAP_SYS_RAWIO)) {
-                vfio_group_put(group);
-                return -EPERM;
-        }
-
         /* Do we need multiple instances of the group open?  Seems not. */
         opened = atomic_cmpxchg(&group->opened, 0, 1);
         if (opened) {
@@ -1702,11 +1533,6 @@ struct vfio_group *vfio_group_get_external_user(struct file *filep)
         if (!atomic_inc_not_zero(&group->container_users))
                 return ERR_PTR(-EINVAL);
 
-        if (group->noiommu) {
-                atomic_dec(&group->container_users);
-                return ERR_PTR(-EPERM);
-        }
-
         if (!group->container->iommu_driver ||
                         !vfio_group_viable(group)) {
                 atomic_dec(&group->container_users);
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index eec2f11809ff..ad2146a9ab2d 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -819,7 +819,7 @@ long vhost_vring_ioctl(struct vhost_dev *d, int ioctl, void __user *argp)
                 BUILD_BUG_ON(__alignof__ *vq->used > VRING_USED_ALIGN_SIZE);
                 if ((a.avail_user_addr & (VRING_AVAIL_ALIGN_SIZE - 1)) ||
                     (a.used_user_addr & (VRING_USED_ALIGN_SIZE - 1)) ||
-                    (a.log_guest_addr & (sizeof(u64) - 1))) {
+                    (a.log_guest_addr & (VRING_USED_ALIGN_SIZE - 1))) {
                         r = -EINVAL;
                         break;
                 }
@@ -1369,7 +1369,7 @@ int vhost_get_vq_desc(struct vhost_virtqueue *vq,
         /* Grab the next descriptor number they're advertising, and increment
          * the index we've seen. */
         if (unlikely(__get_user(ring_head,
-                                &vq->avail->ring[last_avail_idx % vq->num]))) {
+                                &vq->avail->ring[last_avail_idx & (vq->num - 1)]))) {
                 vq_err(vq, "Failed to read head: idx %d address %p\n",
                        last_avail_idx,
                        &vq->avail->ring[last_avail_idx % vq->num]);
@@ -1489,7 +1489,7 @@ static int __vhost_add_used_n(struct vhost_virtqueue *vq,
         u16 old, new;
         int start;
 
-        start = vq->last_used_idx % vq->num;
+        start = vq->last_used_idx & (vq->num - 1);
         used = vq->used->ring + start;
         if (count == 1) {
                 if (__put_user(heads[0].id, &used->id)) {
@@ -1531,7 +1531,7 @@ int vhost_add_used_n(struct vhost_virtqueue *vq, struct vring_used_elem *heads,
 {
         int start, n, r;
 
-        start = vq->last_used_idx % vq->num;
+        start = vq->last_used_idx & (vq->num - 1);
         n = vq->num - start;
         if (n < count) {
                 r = __vhost_add_used_n(vq, heads, n);
diff --git a/drivers/video/fbdev/fsl-diu-fb.c b/drivers/video/fbdev/fsl-diu-fb.c
index b335c1ae8625..fe00a07c122e 100644
--- a/drivers/video/fbdev/fsl-diu-fb.c
+++ b/drivers/video/fbdev/fsl-diu-fb.c
@@ -479,7 +479,10 @@ static enum fsl_diu_monitor_port fsl_diu_name_to_port(const char *s)
                         port = FSL_DIU_PORT_DLVDS;
         }
 
-        return diu_ops.valid_monitor_port(port);
+        if (diu_ops.valid_monitor_port)
+                port = diu_ops.valid_monitor_port(port);
+
+        return port;
 }
 
 /*
@@ -1915,6 +1918,14 @@ static int __init fsl_diu_init(void)
 #else
         monitor_port = fsl_diu_name_to_port(monitor_string);
 #endif
+
+        /*
+         * Must to verify set_pixel_clock. If not implement on platform,
+         * then that means that there is no platform support for the DIU.
+         */
+        if (!diu_ops.set_pixel_clock)
+                return -ENODEV;
+
         pr_info("Freescale Display Interface Unit (DIU) framebuffer driver\n");
 
 #ifdef CONFIG_NOT_COHERENT_CACHE
diff --git a/drivers/video/fbdev/omap2/dss/venc.c b/drivers/video/fbdev/omap2/dss/venc.c
index 99ca268c1cdd..d05a54922ba6 100644
--- a/drivers/video/fbdev/omap2/dss/venc.c
+++ b/drivers/video/fbdev/omap2/dss/venc.c
@@ -275,6 +275,12 @@ const struct omap_video_timings omap_dss_pal_timings = {
         .vbp            = 41,
 
         .interlace      = true,
+
+        .hsync_level = OMAPDSS_SIG_ACTIVE_LOW,
+        .vsync_level = OMAPDSS_SIG_ACTIVE_LOW,
+        .data_pclk_edge = OMAPDSS_DRIVE_SIG_RISING_EDGE,
+        .de_level = OMAPDSS_SIG_ACTIVE_HIGH,
+        .sync_pclk_edge = OMAPDSS_DRIVE_SIG_FALLING_EDGE,
 };
 EXPORT_SYMBOL(omap_dss_pal_timings);
 
@@ -290,6 +296,12 @@ const struct omap_video_timings omap_dss_ntsc_timings = {
         .vbp            = 31,
 
         .interlace      = true,
+
+        .hsync_level = OMAPDSS_SIG_ACTIVE_LOW,
+        .vsync_level = OMAPDSS_SIG_ACTIVE_LOW,
+        .data_pclk_edge = OMAPDSS_DRIVE_SIG_RISING_EDGE,
+        .de_level = OMAPDSS_SIG_ACTIVE_HIGH,
+        .sync_pclk_edge = OMAPDSS_DRIVE_SIG_FALLING_EDGE,
 };
 EXPORT_SYMBOL(omap_dss_ntsc_timings);
 
diff --git a/drivers/virtio/virtio.c b/drivers/virtio/virtio.c
index b1877d73fa56..7062bb0975a5 100644
--- a/drivers/virtio/virtio.c
+++ b/drivers/virtio/virtio.c
@@ -412,6 +412,7 @@ static int virtio_init(void)
 static void __exit virtio_exit(void)
 {
         bus_unregister(&virtio_bus);
+        ida_destroy(&virtio_index_ida);
 }
 core_initcall(virtio_init);
 module_exit(virtio_exit);
diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
index 096b857e7b75..ee663c458b20 100644
--- a/drivers/virtio/virtio_ring.c
+++ b/drivers/virtio/virtio_ring.c
@@ -80,6 +80,12 @@ struct vring_virtqueue {
         /* Last used index we've seen. */
         u16 last_used_idx;
 
+        /* Last written value to avail->flags */
+        u16 avail_flags_shadow;
+
+        /* Last written value to avail->idx in guest byte order */
+        u16 avail_idx_shadow;
+
         /* How to notify other side. FIXME: commonalize hcalls! */
         bool (*notify)(struct virtqueue *vq);
 
@@ -109,7 +115,7 @@ static struct vring_desc *alloc_indirect(struct virtqueue *_vq,
          * otherwise virt_to_phys will give us bogus addresses in the
          * virtqueue.
          */
-        gfp &= ~(__GFP_HIGHMEM | __GFP_HIGH);
+        gfp &= ~__GFP_HIGHMEM;
 
         desc = kmalloc(total_sg * sizeof(struct vring_desc), gfp);
         if (!desc)
@@ -235,13 +241,14 @@ static inline int virtqueue_add(struct virtqueue *_vq,
 
         /* Put entry in available array (but don't update avail->idx until they
          * do sync). */
-        avail = virtio16_to_cpu(_vq->vdev, vq->vring.avail->idx) & (vq->vring.num - 1);
+        avail = vq->avail_idx_shadow & (vq->vring.num - 1);
         vq->vring.avail->ring[avail] = cpu_to_virtio16(_vq->vdev, head);
 
         /* Descriptors and available array need to be set before we expose the
          * new available array entries. */
         virtio_wmb(vq->weak_barriers);
-        vq->vring.avail->idx = cpu_to_virtio16(_vq->vdev, virtio16_to_cpu(_vq->vdev, vq->vring.avail->idx) + 1);
+        vq->avail_idx_shadow++;
+        vq->vring.avail->idx = cpu_to_virtio16(_vq->vdev, vq->avail_idx_shadow);
         vq->num_added++;
 
         pr_debug("Added buffer head %i to %p\n", head, vq);
@@ -354,8 +361,8 @@ bool virtqueue_kick_prepare(struct virtqueue *_vq)
          * event. */
         virtio_mb(vq->weak_barriers);
 
-        old = virtio16_to_cpu(_vq->vdev, vq->vring.avail->idx) - vq->num_added;
-        new = virtio16_to_cpu(_vq->vdev, vq->vring.avail->idx);
+        old = vq->avail_idx_shadow - vq->num_added;
+        new = vq->avail_idx_shadow;
         vq->num_added = 0;
 
 #ifdef DEBUG
@@ -510,7 +517,7 @@ void *virtqueue_get_buf(struct virtqueue *_vq, unsigned int *len)
         /* If we expect an interrupt for the next entry, tell host
          * by writing event index and flush out the write before
          * the read in the next get_buf call. */
-        if (!(vq->vring.avail->flags & cpu_to_virtio16(_vq->vdev, VRING_AVAIL_F_NO_INTERRUPT))) {
+        if (!(vq->avail_flags_shadow & VRING_AVAIL_F_NO_INTERRUPT)) {
                 vring_used_event(&vq->vring) = cpu_to_virtio16(_vq->vdev, vq->last_used_idx);
                 virtio_mb(vq->weak_barriers);
         }
@@ -537,7 +544,11 @@ void virtqueue_disable_cb(struct virtqueue *_vq)
 {
         struct vring_virtqueue *vq = to_vvq(_vq);
 
-        vq->vring.avail->flags |= cpu_to_virtio16(_vq->vdev, VRING_AVAIL_F_NO_INTERRUPT);
+        if (!(vq->avail_flags_shadow & VRING_AVAIL_F_NO_INTERRUPT)) {
+                vq->avail_flags_shadow |= VRING_AVAIL_F_NO_INTERRUPT;
+                vq->vring.avail->flags = cpu_to_virtio16(_vq->vdev, vq->avail_flags_shadow);
+        }
+
 }
 EXPORT_SYMBOL_GPL(virtqueue_disable_cb);
 
@@ -565,7 +576,10 @@ unsigned virtqueue_enable_cb_prepare(struct virtqueue *_vq)
         /* Depending on the VIRTIO_RING_F_EVENT_IDX feature, we need to
          * either clear the flags bit or point the event index at the next
          * entry. Always do both to keep code simple. */
-        vq->vring.avail->flags &= cpu_to_virtio16(_vq->vdev, ~VRING_AVAIL_F_NO_INTERRUPT);
+        if (vq->avail_flags_shadow & VRING_AVAIL_F_NO_INTERRUPT) {
+                vq->avail_flags_shadow &= ~VRING_AVAIL_F_NO_INTERRUPT;
+                vq->vring.avail->flags = cpu_to_virtio16(_vq->vdev, vq->avail_flags_shadow);
+        }
         vring_used_event(&vq->vring) = cpu_to_virtio16(_vq->vdev, last_used_idx = vq->last_used_idx);
         END_USE(vq);
         return last_used_idx;
@@ -633,9 +647,12 @@ bool virtqueue_enable_cb_delayed(struct virtqueue *_vq)
         /* Depending on the VIRTIO_RING_F_USED_EVENT_IDX feature, we need to
          * either clear the flags bit or point the event index at the next
          * entry. Always do both to keep code simple. */
-        vq->vring.avail->flags &= cpu_to_virtio16(_vq->vdev, ~VRING_AVAIL_F_NO_INTERRUPT);
+        if (vq->avail_flags_shadow & VRING_AVAIL_F_NO_INTERRUPT) {
+                vq->avail_flags_shadow &= ~VRING_AVAIL_F_NO_INTERRUPT;
+                vq->vring.avail->flags = cpu_to_virtio16(_vq->vdev, vq->avail_flags_shadow);
+        }
         /* TODO: tune this threshold */
-        bufs = (u16)(virtio16_to_cpu(_vq->vdev, vq->vring.avail->idx) - vq->last_used_idx) * 3 / 4;
+        bufs = (u16)(vq->avail_idx_shadow - vq->last_used_idx) * 3 / 4;
         vring_used_event(&vq->vring) = cpu_to_virtio16(_vq->vdev, vq->last_used_idx + bufs);
         virtio_mb(vq->weak_barriers);
         if (unlikely((u16)(virtio16_to_cpu(_vq->vdev, vq->vring.used->idx) - vq->last_used_idx) > bufs)) {
@@ -670,7 +687,8 @@ void *virtqueue_detach_unused_buf(struct virtqueue *_vq)
                 /* detach_buf clears data, so grab it now. */
                 buf = vq->data[i];
                 detach_buf(vq, i);
-                vq->vring.avail->idx = cpu_to_virtio16(_vq->vdev, virtio16_to_cpu(_vq->vdev, vq->vring.avail->idx) - 1);
+                vq->avail_idx_shadow--;
+                vq->vring.avail->idx = cpu_to_virtio16(_vq->vdev, vq->avail_idx_shadow);
                 END_USE(vq);
                 return buf;
         }
@@ -735,6 +753,8 @@ struct virtqueue *vring_new_virtqueue(unsigned int index,
         vq->weak_barriers = weak_barriers;
         vq->broken = false;
         vq->last_used_idx = 0;
+        vq->avail_flags_shadow = 0;
+        vq->avail_idx_shadow = 0;
         vq->num_added = 0;
         list_add_tail(&vq->vq.list, &vdev->vqs);
 #ifdef DEBUG
@@ -746,8 +766,10 @@ struct virtqueue *vring_new_virtqueue(unsigned int index,
         vq->event = virtio_has_feature(vdev, VIRTIO_RING_F_EVENT_IDX);
 
         /* No callback?  Tell other side not to bother us. */
-        if (!callback)
-                vq->vring.avail->flags |= cpu_to_virtio16(vdev, VRING_AVAIL_F_NO_INTERRUPT);
+        if (!callback) {
+                vq->avail_flags_shadow |= VRING_AVAIL_F_NO_INTERRUPT;
+                vq->vring.avail->flags = cpu_to_virtio16(vdev, vq->avail_flags_shadow);
+        }
 
         /* Put everything in free lists. */
         vq->free_head = 0;
diff --git a/drivers/watchdog/Kconfig b/drivers/watchdog/Kconfig
index 7a8a6c6952e9..1c427beffadd 100644
--- a/drivers/watchdog/Kconfig
+++ b/drivers/watchdog/Kconfig
@@ -446,7 +446,7 @@ config MAX63XX_WATCHDOG
 
 config IMX2_WDT
         tristate "IMX2+ Watchdog"
-        depends on ARCH_MXC
+        depends on ARCH_MXC || ARCH_LAYERSCAPE
         select REGMAP_MMIO
         select WATCHDOG_CORE
         help
diff --git a/drivers/watchdog/mtk_wdt.c b/drivers/watchdog/mtk_wdt.c
index 6ad9df948711..b751f43d76ed 100644
--- a/drivers/watchdog/mtk_wdt.c
+++ b/drivers/watchdog/mtk_wdt.c
@@ -123,6 +123,7 @@ static int mtk_wdt_stop(struct watchdog_device *wdt_dev)
 
         reg = readl(wdt_base + WDT_MODE);
         reg &= ~WDT_MODE_EN;
+        reg |= WDT_MODE_KEY;
         iowrite32(reg, wdt_base + WDT_MODE);
 
         return 0;
diff --git a/drivers/watchdog/omap_wdt.c b/drivers/watchdog/omap_wdt.c
index d96bee017fd3..6f17c935a6cf 100644
--- a/drivers/watchdog/omap_wdt.c
+++ b/drivers/watchdog/omap_wdt.c
@@ -205,7 +205,7 @@ static int omap_wdt_set_timeout(struct watchdog_device *wdog,
 
 static unsigned int omap_wdt_get_timeleft(struct watchdog_device *wdog)
 {
-        struct omap_wdt_dev *wdev = watchdog_get_drvdata(wdog);
+        struct omap_wdt_dev *wdev = to_omap_wdt_dev(wdog);
         void __iomem *base = wdev->base;
         u32 value;
 
diff --git a/drivers/watchdog/pnx4008_wdt.c b/drivers/watchdog/pnx4008_wdt.c
index 4224b3ec83a5..313cd1c6fda0 100644
--- a/drivers/watchdog/pnx4008_wdt.c
+++ b/drivers/watchdog/pnx4008_wdt.c
@@ -80,7 +80,7 @@ static unsigned int heartbeat = DEFAULT_HEARTBEAT;
 
 static DEFINE_SPINLOCK(io_lock);
 static void __iomem     *wdt_base;
-struct clk              *wdt_clk;
+static struct clk       *wdt_clk;
 
 static int pnx4008_wdt_start(struct watchdog_device *wdd)
 {
@@ -161,7 +161,7 @@ static int pnx4008_wdt_probe(struct platform_device *pdev)
         if (IS_ERR(wdt_clk))
                 return PTR_ERR(wdt_clk);
 
-        ret = clk_enable(wdt_clk);
+        ret = clk_prepare_enable(wdt_clk);
         if (ret)
                 return ret;
 
@@ -184,7 +184,7 @@ static int pnx4008_wdt_probe(struct platform_device *pdev)
         return 0;
 
 disable_clk:
-        clk_disable(wdt_clk);
+        clk_disable_unprepare(wdt_clk);
         return ret;
 }
 
@@ -192,7 +192,7 @@ static int pnx4008_wdt_remove(struct platform_device *pdev)
 {
         watchdog_unregister_device(&pnx4008_wdd);
 
-        clk_disable(wdt_clk);
+        clk_disable_unprepare(wdt_clk);
 
         return 0;
 }
diff --git a/drivers/watchdog/tegra_wdt.c b/drivers/watchdog/tegra_wdt.c
index 7f97cdd53f29..9ec57608da82 100644
--- a/drivers/watchdog/tegra_wdt.c
+++ b/drivers/watchdog/tegra_wdt.c
@@ -140,8 +140,10 @@ static int tegra_wdt_set_timeout(struct watchdog_device *wdd,
 {
         wdd->timeout = timeout;
 
-        if (watchdog_active(wdd))
+        if (watchdog_active(wdd)) {
+                tegra_wdt_stop(wdd);
                 return tegra_wdt_start(wdd);
+        }
 
         return 0;
 }
diff --git a/drivers/watchdog/w83977f_wdt.c b/drivers/watchdog/w83977f_wdt.c
index 91bf55a20024..20e2bba10400 100644
--- a/drivers/watchdog/w83977f_wdt.c
+++ b/drivers/watchdog/w83977f_wdt.c
@@ -224,7 +224,7 @@ static int wdt_keepalive(void)
 
 static int wdt_set_timeout(int t)
 {
-        int tmrval;
+        unsigned int tmrval;
 
         /*
          * Convert seconds to watchdog counter time units, rounding up.
diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c
index 849500e4e14d..524c22146429 100644
--- a/drivers/xen/events/events_base.c
+++ b/drivers/xen/events/events_base.c
@@ -39,6 +39,7 @@
 #include <asm/irq.h>
 #include <asm/idle.h>
 #include <asm/io_apic.h>
+#include <asm/i8259.h>
 #include <asm/xen/pci.h>
 #endif
 #include <asm/sync_bitops.h>
@@ -420,7 +421,7 @@ static int __must_check xen_allocate_irq_gsi(unsigned gsi)
                 return xen_allocate_irq_dynamic();
 
         /* Legacy IRQ descriptors are already allocated by the arch. */
-        if (gsi < NR_IRQS_LEGACY)
+        if (gsi < nr_legacy_irqs())
                 irq = gsi;
         else
                 irq = irq_alloc_desc_at(gsi, -1);
@@ -446,7 +447,7 @@ static void xen_free_irq(unsigned irq)
         kfree(info);
 
         /* Legacy IRQ descriptors are managed by the arch. */
-        if (irq < NR_IRQS_LEGACY)
+        if (irq < nr_legacy_irqs())
                 return;
 
         irq_free_desc(irq);
diff --git a/drivers/xen/events/events_fifo.c b/drivers/xen/events/events_fifo.c
index e3e9e3d46d1b..96a1b8da5371 100644
--- a/drivers/xen/events/events_fifo.c
+++ b/drivers/xen/events/events_fifo.c
@@ -281,7 +281,8 @@ static void handle_irq_for_port(unsigned port)
 
 static void consume_one_event(unsigned cpu,
                               struct evtchn_fifo_control_block *control_block,
-                              unsigned priority, unsigned long *ready)
+                              unsigned priority, unsigned long *ready,
+                              bool drop)
 {
         struct evtchn_fifo_queue *q = &per_cpu(cpu_queue, cpu);
         uint32_t head;
@@ -313,13 +314,17 @@ static void consume_one_event(unsigned cpu,
         if (head == 0)
                 clear_bit(priority, ready);
 
-        if (evtchn_fifo_is_pending(port) && !evtchn_fifo_is_masked(port))
-                handle_irq_for_port(port);
+        if (evtchn_fifo_is_pending(port) && !evtchn_fifo_is_masked(port)) {
+                if (unlikely(drop))
+                        pr_warn("Dropping pending event for port %u\n", port);
+                else
+                        handle_irq_for_port(port);
+        }
 
         q->head[priority] = head;
 }
 
-static void evtchn_fifo_handle_events(unsigned cpu)
+static void __evtchn_fifo_handle_events(unsigned cpu, bool drop)
 {
         struct evtchn_fifo_control_block *control_block;
         unsigned long ready;
@@ -331,11 +336,16 @@ static void evtchn_fifo_handle_events(unsigned cpu)
 
         while (ready) {
                 q = find_first_bit(&ready, EVTCHN_FIFO_MAX_QUEUES);
-                consume_one_event(cpu, control_block, q, &ready);
+                consume_one_event(cpu, control_block, q, &ready, drop);
                 ready |= xchg(&control_block->ready, 0);
         }
 }
 
+static void evtchn_fifo_handle_events(unsigned cpu)
+{
+        __evtchn_fifo_handle_events(cpu, false);
+}
+
 static void evtchn_fifo_resume(void)
 {
         unsigned cpu;
@@ -420,6 +430,9 @@ static int evtchn_fifo_cpu_notification(struct notifier_block *self,
                 if (!per_cpu(cpu_control_block, cpu))
                         ret = evtchn_fifo_alloc_control_block(cpu);
                 break;
+        case CPU_DEAD:
+                __evtchn_fifo_handle_events(cpu, true);
+                break;
         default:
                 break;
         }
diff --git a/drivers/xen/evtchn.c b/drivers/xen/evtchn.c
index 00f40f051d95..38272ad24551 100644
--- a/drivers/xen/evtchn.c
+++ b/drivers/xen/evtchn.c
@@ -49,6 +49,8 @@
 #include <linux/init.h>
 #include <linux/mutex.h>
 #include <linux/cpu.h>
+#include <linux/mm.h>
+#include <linux/vmalloc.h>
 
 #include <xen/xen.h>
 #include <xen/events.h>
@@ -58,10 +60,10 @@
 struct per_user_data {
         struct mutex bind_mutex; /* serialize bind/unbind operations */
         struct rb_root evtchns;
+        unsigned int nr_evtchns;
 
         /* Notification ring, accessed via /dev/xen/evtchn. */
-#define EVTCHN_RING_SIZE     (PAGE_SIZE / sizeof(evtchn_port_t))
-#define EVTCHN_RING_MASK(_i) ((_i)&(EVTCHN_RING_SIZE-1))
+        unsigned int ring_size;
         evtchn_port_t *ring;
         unsigned int ring_cons, ring_prod, ring_overflow;
         struct mutex ring_cons_mutex; /* protect against concurrent readers */
@@ -80,10 +82,41 @@ struct user_evtchn {
         bool enabled;
 };
 
+static evtchn_port_t *evtchn_alloc_ring(unsigned int size)
+{
+        evtchn_port_t *ring;
+        size_t s = size * sizeof(*ring);
+
+        ring = kmalloc(s, GFP_KERNEL);
+        if (!ring)
+                ring = vmalloc(s);
+
+        return ring;
+}
+
+static void evtchn_free_ring(evtchn_port_t *ring)
+{
+        kvfree(ring);
+}
+
+static unsigned int evtchn_ring_offset(struct per_user_data *u,
+                                       unsigned int idx)
+{
+        return idx & (u->ring_size - 1);
+}
+
+static evtchn_port_t *evtchn_ring_entry(struct per_user_data *u,
+                                        unsigned int idx)
+{
+        return u->ring + evtchn_ring_offset(u, idx);
+}
+
 static int add_evtchn(struct per_user_data *u, struct user_evtchn *evtchn)
 {
         struct rb_node **new = &(u->evtchns.rb_node), *parent = NULL;
 
+        u->nr_evtchns++;
+
         while (*new) {
                 struct user_evtchn *this;
 
@@ -107,6 +140,7 @@ static int add_evtchn(struct per_user_data *u, struct user_evtchn *evtchn)
 
 static void del_evtchn(struct per_user_data *u, struct user_evtchn *evtchn)
 {
+        u->nr_evtchns--;
         rb_erase(&evtchn->node, &u->evtchns);
         kfree(evtchn);
 }
@@ -144,8 +178,8 @@ static irqreturn_t evtchn_interrupt(int irq, void *data)
 
         spin_lock(&u->ring_prod_lock);
 
-        if ((u->ring_prod - u->ring_cons) < EVTCHN_RING_SIZE) {
-                u->ring[EVTCHN_RING_MASK(u->ring_prod)] = evtchn->port;
+        if ((u->ring_prod - u->ring_cons) < u->ring_size) {
+                *evtchn_ring_entry(u, u->ring_prod) = evtchn->port;
                 wmb(); /* Ensure ring contents visible */
                 if (u->ring_cons == u->ring_prod++) {
                         wake_up_interruptible(&u->evtchn_wait);
@@ -200,10 +234,10 @@ static ssize_t evtchn_read(struct file *file, char __user *buf,
         }
 
         /* Byte lengths of two chunks. Chunk split (if any) is at ring wrap. */
-        if (((c ^ p) & EVTCHN_RING_SIZE) != 0) {
-                bytes1 = (EVTCHN_RING_SIZE - EVTCHN_RING_MASK(c)) *
+        if (((c ^ p) & u->ring_size) != 0) {
+                bytes1 = (u->ring_size - evtchn_ring_offset(u, c)) *
                         sizeof(evtchn_port_t);
-                bytes2 = EVTCHN_RING_MASK(p) * sizeof(evtchn_port_t);
+                bytes2 = evtchn_ring_offset(u, p) * sizeof(evtchn_port_t);
         } else {
                 bytes1 = (p - c) * sizeof(evtchn_port_t);
                 bytes2 = 0;
@@ -219,7 +253,7 @@ static ssize_t evtchn_read(struct file *file, char __user *buf,
 
         rc = -EFAULT;
         rmb(); /* Ensure that we see the port before we copy it. */
-        if (copy_to_user(buf, &u->ring[EVTCHN_RING_MASK(c)], bytes1) ||
+        if (copy_to_user(buf, evtchn_ring_entry(u, c), bytes1) ||
             ((bytes2 != 0) &&
              copy_to_user(&buf[bytes1], &u->ring[0], bytes2)))
                 goto unlock_out;
@@ -278,6 +312,66 @@ static ssize_t evtchn_write(struct file *file, const char __user *buf,
         return rc;
 }
 
+static int evtchn_resize_ring(struct per_user_data *u)
+{
+        unsigned int new_size;
+        evtchn_port_t *new_ring, *old_ring;
+        unsigned int p, c;
+
+        /*
+         * Ensure the ring is large enough to capture all possible
+         * events. i.e., one free slot for each bound event.
+         */
+        if (u->nr_evtchns <= u->ring_size)
+                return 0;
+
+        if (u->ring_size == 0)
+                new_size = 64;
+        else
+                new_size = 2 * u->ring_size;
+
+        new_ring = evtchn_alloc_ring(new_size);
+        if (!new_ring)
+                return -ENOMEM;
+
+        old_ring = u->ring;
+
+        /*
+         * Access to the ring contents is serialized by either the
+         * prod /or/ cons lock so take both when resizing.
+         */
+        mutex_lock(&u->ring_cons_mutex);
+        spin_lock_irq(&u->ring_prod_lock);
+
+        /*
+         * Copy the old ring contents to the new ring.
+         *
+         * If the ring contents crosses the end of the current ring,
+         * it needs to be copied in two chunks.
+         *
+         * +---------+    +------------------+
+         * |34567  12| -> |       1234567    |
+         * +-----p-c-+    +------------------+
+         */
+        p = evtchn_ring_offset(u, u->ring_prod);
+        c = evtchn_ring_offset(u, u->ring_cons);
+        if (p < c) {
+                memcpy(new_ring + c, u->ring + c, (u->ring_size - c) * sizeof(*u->ring));
+                memcpy(new_ring + u->ring_size, u->ring, p * sizeof(*u->ring));
+        } else
+                memcpy(new_ring + c, u->ring + c, (p - c) * sizeof(*u->ring));
+
+        u->ring = new_ring;
+        u->ring_size = new_size;
+
+        spin_unlock_irq(&u->ring_prod_lock);
+        mutex_unlock(&u->ring_cons_mutex);
+
+        evtchn_free_ring(old_ring);
+
+        return 0;
+}
+
 static int evtchn_bind_to_user(struct per_user_data *u, int port)
 {
         struct user_evtchn *evtchn;
@@ -305,6 +399,10 @@ static int evtchn_bind_to_user(struct per_user_data *u, int port)
         if (rc < 0)
                 goto err;
 
+        rc = evtchn_resize_ring(u);
+        if (rc < 0)
+                goto err;
+
         rc = bind_evtchn_to_irqhandler(port, evtchn_interrupt, 0,
                                        u->name, evtchn);
         if (rc < 0)
@@ -503,13 +601,6 @@ static int evtchn_open(struct inode *inode, struct file *filp)
 
         init_waitqueue_head(&u->evtchn_wait);
 
-        u->ring = (evtchn_port_t *)__get_free_page(GFP_KERNEL);
-        if (u->ring == NULL) {
-                kfree(u->name);
-                kfree(u);
-                return -ENOMEM;
-        }
-
         mutex_init(&u->bind_mutex);
         mutex_init(&u->ring_cons_mutex);
         spin_lock_init(&u->ring_prod_lock);
@@ -532,7 +623,7 @@ static int evtchn_release(struct inode *inode, struct file *filp)
                 evtchn_unbind_from_user(u, evtchn);
         }
 
-        free_page((unsigned long)u->ring);
+        evtchn_free_ring(u->ring);
         kfree(u->name);
         kfree(u);
 
diff --git a/drivers/xen/gntdev.c b/drivers/xen/gntdev.c
index 2ea0b3b2a91d..1be5dd048622 100644
--- a/drivers/xen/gntdev.c
+++ b/drivers/xen/gntdev.c
@@ -804,7 +804,7 @@ static int gntdev_mmap(struct file *flip, struct vm_area_struct *vma)
 
         vma->vm_ops = &gntdev_vmops;
 
-        vma->vm_flags |= VM_DONTEXPAND | VM_DONTDUMP;
+        vma->vm_flags |= VM_DONTEXPAND | VM_DONTDUMP | VM_IO;
 
         if (use_ptemod)
                 vma->vm_flags |= VM_DONTCOPY;
diff --git a/drivers/xen/xen-pciback/pciback.h b/drivers/xen/xen-pciback/pciback.h
index 58e38d586f52..4d529f3e40df 100644
--- a/drivers/xen/xen-pciback/pciback.h
+++ b/drivers/xen/xen-pciback/pciback.h
@@ -37,6 +37,7 @@ struct xen_pcibk_device {
         struct xen_pci_sharedinfo *sh_info;
         unsigned long flags;
         struct work_struct op_work;
+        struct xen_pci_op op;
 };
 
 struct xen_pcibk_dev_data {
diff --git a/drivers/xen/xen-pciback/pciback_ops.c b/drivers/xen/xen-pciback/pciback_ops.c
index c4a0666de6f5..73dafdc494aa 100644
--- a/drivers/xen/xen-pciback/pciback_ops.c
+++ b/drivers/xen/xen-pciback/pciback_ops.c
@@ -70,6 +70,13 @@ static void xen_pcibk_control_isr(struct pci_dev *dev, int reset)
                 enable ? "enable" : "disable");
 
         if (enable) {
+                /*
+                 * The MSI or MSI-X should not have an IRQ handler. Otherwise
+                 * if the guest terminates we BUG_ON in free_msi_irqs.
+                 */
+                if (dev->msi_enabled || dev->msix_enabled)
+                        goto out;
+
                 rc = request_irq(dev_data->irq,
                                 xen_pcibk_guest_interrupt, IRQF_SHARED,
                                 dev_data->irq_name, dev);
@@ -144,7 +151,12 @@ int xen_pcibk_enable_msi(struct xen_pcibk_device *pdev,
         if (unlikely(verbose_request))
                 printk(KERN_DEBUG DRV_NAME ": %s: enable MSI\n", pci_name(dev));
 
-        status = pci_enable_msi(dev);
+        if (dev->msi_enabled)
+                status = -EALREADY;
+        else if (dev->msix_enabled)
+                status = -ENXIO;
+        else
+                status = pci_enable_msi(dev);
 
         if (status) {
                 pr_warn_ratelimited("%s: error enabling MSI for guest %u: err %d\n",
@@ -173,20 +185,23 @@ static
 int xen_pcibk_disable_msi(struct xen_pcibk_device *pdev,
                           struct pci_dev *dev, struct xen_pci_op *op)
 {
-        struct xen_pcibk_dev_data *dev_data;
-
         if (unlikely(verbose_request))
                 printk(KERN_DEBUG DRV_NAME ": %s: disable MSI\n",
                        pci_name(dev));
-        pci_disable_msi(dev);
 
+        if (dev->msi_enabled) {
+                struct xen_pcibk_dev_data *dev_data;
+
+                pci_disable_msi(dev);
+
+                dev_data = pci_get_drvdata(dev);
+                if (dev_data)
+                        dev_data->ack_intr = 1;
+        }
         op->value = dev->irq ? xen_pirq_from_irq(dev->irq) : 0;
         if (unlikely(verbose_request))
                 printk(KERN_DEBUG DRV_NAME ": %s: MSI: %d\n", pci_name(dev),
                         op->value);
-        dev_data = pci_get_drvdata(dev);
-        if (dev_data)
-                dev_data->ack_intr = 1;
         return 0;
 }
 
@@ -197,13 +212,26 @@ int xen_pcibk_enable_msix(struct xen_pcibk_device *pdev,
         struct xen_pcibk_dev_data *dev_data;
         int i, result;
         struct msix_entry *entries;
+        u16 cmd;
 
         if (unlikely(verbose_request))
                 printk(KERN_DEBUG DRV_NAME ": %s: enable MSI-X\n",
                        pci_name(dev));
+
         if (op->value > SH_INFO_MAX_VEC)
                 return -EINVAL;
 
+        if (dev->msix_enabled)
+                return -EALREADY;
+
+        /*
+         * PCI_COMMAND_MEMORY must be enabled, otherwise we may not be able
+         * to access the BARs where the MSI-X entries reside.
+         */
+        pci_read_config_word(dev, PCI_COMMAND, &cmd);
+        if (dev->msi_enabled || !(cmd & PCI_COMMAND_MEMORY))
+                return -ENXIO;
+
         entries = kmalloc(op->value * sizeof(*entries), GFP_KERNEL);
         if (entries == NULL)
                 return -ENOMEM;
@@ -245,23 +273,27 @@ static
 int xen_pcibk_disable_msix(struct xen_pcibk_device *pdev,
                            struct pci_dev *dev, struct xen_pci_op *op)
 {
-        struct xen_pcibk_dev_data *dev_data;
         if (unlikely(verbose_request))
                 printk(KERN_DEBUG DRV_NAME ": %s: disable MSI-X\n",
                         pci_name(dev));
-        pci_disable_msix(dev);
 
+        if (dev->msix_enabled) {
+                struct xen_pcibk_dev_data *dev_data;
+
+                pci_disable_msix(dev);
+
+                dev_data = pci_get_drvdata(dev);
+                if (dev_data)
+                        dev_data->ack_intr = 1;
+        }
         /*
          * SR-IOV devices (which don't have any legacy IRQ) have
          * an undefined IRQ value of zero.
          */
         op->value = dev->irq ? xen_pirq_from_irq(dev->irq) : 0;
         if (unlikely(verbose_request))
-                printk(KERN_DEBUG DRV_NAME ": %s: MSI-X: %d\n", pci_name(dev),
-                        op->value);
-        dev_data = pci_get_drvdata(dev);
-        if (dev_data)
-                dev_data->ack_intr = 1;
+                printk(KERN_DEBUG DRV_NAME ": %s: MSI-X: %d\n",
+                       pci_name(dev), op->value);
         return 0;
 }
 #endif
@@ -298,9 +330,11 @@ void xen_pcibk_do_op(struct work_struct *data)
                 container_of(data, struct xen_pcibk_device, op_work);
         struct pci_dev *dev;
         struct xen_pcibk_dev_data *dev_data = NULL;
-        struct xen_pci_op *op = &pdev->sh_info->op;
+        struct xen_pci_op *op = &pdev->op;
         int test_intx = 0;
 
+        *op = pdev->sh_info->op;
+        barrier();
         dev = xen_pcibk_get_pci_dev(pdev, op->domain, op->bus, op->devfn);
 
         if (dev == NULL)
@@ -342,6 +376,17 @@ void xen_pcibk_do_op(struct work_struct *data)
                 if ((dev_data->enable_intx != test_intx))
                         xen_pcibk_control_isr(dev, 0 /* no reset */);
         }
+        pdev->sh_info->op.err = op->err;
+        pdev->sh_info->op.value = op->value;
+#ifdef CONFIG_PCI_MSI
+        if (op->cmd == XEN_PCI_OP_enable_msix && op->err == 0) {
+                unsigned int i;
+
+                for (i = 0; i < op->value; i++)
+                        pdev->sh_info->op.msix_entries[i].vector =
+                                op->msix_entries[i].vector;
+        }
+#endif
         /* Tell the driver domain that we're done. */
         wmb();
         clear_bit(_XEN_PCIF_active, (unsigned long *)&pdev->sh_info->flags);
diff --git a/drivers/xen/xen-pciback/xenbus.c b/drivers/xen/xen-pciback/xenbus.c
index 98bc345f296e..4843741e703a 100644
--- a/drivers/xen/xen-pciback/xenbus.c
+++ b/drivers/xen/xen-pciback/xenbus.c
@@ -44,7 +44,6 @@ static struct xen_pcibk_device *alloc_pdev(struct xenbus_device *xdev)
         dev_dbg(&xdev->dev, "allocated pdev @ 0x%p\n", pdev);
 
         pdev->xdev = xdev;
-        dev_set_drvdata(&xdev->dev, pdev);
 
         mutex_init(&pdev->dev_lock);
 
@@ -58,6 +57,9 @@ static struct xen_pcibk_device *alloc_pdev(struct xenbus_device *xdev)
                 kfree(pdev);
                 pdev = NULL;
         }
+
+        dev_set_drvdata(&xdev->dev, pdev);
+
 out:
         return pdev;
 }
diff --git a/drivers/xen/xen-scsiback.c b/drivers/xen/xen-scsiback.c
index 43bcae852546..ad4eb1024d1f 100644
--- a/drivers/xen/xen-scsiback.c
+++ b/drivers/xen/xen-scsiback.c
@@ -726,7 +726,7 @@ static int scsiback_do_cmd_fn(struct vscsibk_info *info)
                 if (!pending_req)
                         return 1;
 
-                ring_req = *RING_GET_REQUEST(ring, rc);
+                RING_COPY_REQUEST(ring, rc, &ring_req);
                 ring->req_cons = ++rc;
 
                 err = prepare_pending_reqs(info, &ring_req, pending_req);