Merge tag 'v4.11-rc7' into drm-next

Backmerge Linux 4.11-rc7 from Linus tree, to fix some
conflicts that were causing problems with the rerere cache
in drm-tip.

85 files changed, 1199 insertions, 746 deletions

diff --git a/drivers/acpi/acpica/utresrc.c b/drivers/acpi/acpica/utresrc.c
index c86bae7b1d0f..ff096d9755b9 100644
--- a/drivers/acpi/acpica/utresrc.c
+++ b/drivers/acpi/acpica/utresrc.c
@@ -421,10 +421,8 @@ acpi_ut_walk_aml_resources(struct acpi_walk_state *walk_state,
 
         ACPI_FUNCTION_TRACE(ut_walk_aml_resources);
 
-        /*
-         * The absolute minimum resource template is one end_tag descriptor.
-         * However, we will treat a lone end_tag as just a simple buffer.
-         */
+        /* The absolute minimum resource template is one end_tag descriptor */
+
         if (aml_length < sizeof(struct aml_resource_end_tag)) {
                 return_ACPI_STATUS(AE_AML_NO_RESOURCE_END_TAG);
         }
@@ -456,8 +454,9 @@ acpi_ut_walk_aml_resources(struct acpi_walk_state *walk_state,
                 /* Invoke the user function */
 
                 if (user_function) {
-                        status = user_function(aml, length, offset,
-                                               resource_index, context);
+                        status =
+                            user_function(aml, length, offset, resource_index,
+                                          context);
                         if (ACPI_FAILURE(status)) {
                                 return_ACPI_STATUS(status);
                         }
@@ -481,12 +480,6 @@ acpi_ut_walk_aml_resources(struct acpi_walk_state *walk_state,
                                 *context = aml;
                         }
 
-                        /* Check if buffer is defined to be longer than the resource length */
-
-                        if (aml_length > (offset + length)) {
-                                return_ACPI_STATUS(AE_AML_NO_RESOURCE_END_TAG);
-                        }
-
                         /* Normal exit */
 
                         return_ACPI_STATUS(AE_OK);
diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
index 662036bdc65e..c8ea9d698cd0 100644
--- a/drivers/acpi/nfit/core.c
+++ b/drivers/acpi/nfit/core.c
@@ -1617,7 +1617,11 @@ static int cmp_map(const void *m0, const void *m1)
         const struct nfit_set_info_map *map0 = m0;
         const struct nfit_set_info_map *map1 = m1;
 
-        return map0->region_offset - map1->region_offset;
+        if (map0->region_offset < map1->region_offset)
+                return -1;
+        else if (map0->region_offset > map1->region_offset)
+                return 1;
+        return 0;
 }
 
 /* Retrieve the nth entry referencing this spa */
diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
index 192691880d55..2433569b02ef 100644
--- a/drivers/acpi/scan.c
+++ b/drivers/acpi/scan.c
@@ -1857,15 +1857,20 @@ static void acpi_bus_attach(struct acpi_device *device)
                 return;
 
         device->flags.match_driver = true;
-        if (!ret) {
-                ret = device_attach(&device->dev);
-                if (ret < 0)
-                        return;
-
-                if (!ret && device->pnp.type.platform_id)
-                        acpi_default_enumeration(device);
+        if (ret > 0) {
+                acpi_device_set_enumerated(device);
+                goto ok;
         }
 
+        ret = device_attach(&device->dev);
+        if (ret < 0)
+                return;
+
+        if (ret > 0 || !device->pnp.type.platform_id)
+                acpi_device_set_enumerated(device);
+        else
+                acpi_default_enumeration(device);
+
  ok:
         list_for_each_entry(child, &device->children, node)
                 acpi_bus_attach(child);
diff --git a/drivers/ata/pata_atiixp.c b/drivers/ata/pata_atiixp.c
index 6c9aa95a9a05..49d705c9f0f7 100644
--- a/drivers/ata/pata_atiixp.c
+++ b/drivers/ata/pata_atiixp.c
@@ -278,11 +278,6 @@ static int atiixp_init_one(struct pci_dev *pdev, const struct pci_device_id *id)
         };
         const struct ata_port_info *ppi[] = { &info, &info };
 
-        /* SB600/700 don't have secondary port wired */
-        if ((pdev->device == PCI_DEVICE_ID_ATI_IXP600_IDE) ||
-                (pdev->device == PCI_DEVICE_ID_ATI_IXP700_IDE))
-                ppi[1] = &ata_dummy_port_info;
-
         return ata_pci_bmdma_init_one(pdev, ppi, &atiixp_sht, NULL,
                                       ATA_HOST_PARALLEL_SCAN);
 }
diff --git a/drivers/ata/sata_via.c b/drivers/ata/sata_via.c
index 0636d84fbefe..f3f538eec7b3 100644
--- a/drivers/ata/sata_via.c
+++ b/drivers/ata/sata_via.c
@@ -644,14 +644,16 @@ static void svia_configure(struct pci_dev *pdev, int board_id,
                 pci_write_config_byte(pdev, SATA_NATIVE_MODE, tmp8);
         }
 
-        /* enable IRQ on hotplug */
-        pci_read_config_byte(pdev, SVIA_MISC_3, &tmp8);
-        if ((tmp8 & SATA_HOTPLUG) != SATA_HOTPLUG) {
-                dev_dbg(&pdev->dev,
-                        "enabling SATA hotplug (0x%x)\n",
-                        (int) tmp8);
-                tmp8 |= SATA_HOTPLUG;
-                pci_write_config_byte(pdev, SVIA_MISC_3, tmp8);
+        if (board_id == vt6421) {
+                /* enable IRQ on hotplug */
+                pci_read_config_byte(pdev, SVIA_MISC_3, &tmp8);
+                if ((tmp8 & SATA_HOTPLUG) != SATA_HOTPLUG) {
+                        dev_dbg(&pdev->dev,
+                                "enabling SATA hotplug (0x%x)\n",
+                                (int) tmp8);
+                        tmp8 |= SATA_HOTPLUG;
+                        pci_write_config_byte(pdev, SVIA_MISC_3, tmp8);
+                }
         }
 
         /*
diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
index dceb5edd1e54..0c09d4256108 100644
--- a/drivers/block/zram/zram_drv.c
+++ b/drivers/block/zram/zram_drv.c
@@ -523,7 +523,7 @@ static int zram_decompress_page(struct zram *zram, char *mem, u32 index)
 
         cmem = zs_map_object(meta->mem_pool, handle, ZS_MM_RO);
         if (size == PAGE_SIZE) {
-                copy_page(mem, cmem);
+                memcpy(mem, cmem, PAGE_SIZE);
         } else {
                 struct zcomp_strm *zstrm = zcomp_stream_get(zram->comp);
 
@@ -717,7 +717,7 @@ compress_again:
 
         if ((clen == PAGE_SIZE) && !is_partial_io(bvec)) {
                 src = kmap_atomic(page);
-                copy_page(cmem, src);
+                memcpy(cmem, src, PAGE_SIZE);
                 kunmap_atomic(src);
         } else {
                 memcpy(cmem, src, clen);
@@ -928,7 +928,7 @@ static int zram_rw_page(struct block_device *bdev, sector_t sector,
         }
 
         index = sector >> SECTORS_PER_PAGE_SHIFT;
-        offset = sector & (SECTORS_PER_PAGE - 1) << SECTOR_SHIFT;
+        offset = (sector & (SECTORS_PER_PAGE - 1)) << SECTOR_SHIFT;
 
         bv.bv_page = page;
         bv.bv_len = PAGE_SIZE;
diff --git a/drivers/char/mem.c b/drivers/char/mem.c
index 6d9cc2d39d22..7e4a9d1296bb 100644
--- a/drivers/char/mem.c
+++ b/drivers/char/mem.c
@@ -60,6 +60,10 @@ static inline int valid_mmap_phys_addr_range(unsigned long pfn, size_t size)
 #endif
 
 #ifdef CONFIG_STRICT_DEVMEM
+static inline int page_is_allowed(unsigned long pfn)
+{
+        return devmem_is_allowed(pfn);
+}
 static inline int range_is_allowed(unsigned long pfn, unsigned long size)
 {
         u64 from = ((u64)pfn) << PAGE_SHIFT;
@@ -75,6 +79,10 @@ static inline int range_is_allowed(unsigned long pfn, unsigned long size)
         return 1;
 }
 #else
+static inline int page_is_allowed(unsigned long pfn)
+{
+        return 1;
+}
 static inline int range_is_allowed(unsigned long pfn, unsigned long size)
 {
         return 1;
@@ -122,23 +130,31 @@ static ssize_t read_mem(struct file *file, char __user *buf,
 
         while (count > 0) {
                 unsigned long remaining;
+                int allowed;
 
                 sz = size_inside_page(p, count);
 
-                if (!range_is_allowed(p >> PAGE_SHIFT, count))
+                allowed = page_is_allowed(p >> PAGE_SHIFT);
+                if (!allowed)
                         return -EPERM;
+                if (allowed == 2) {
+                        /* Show zeros for restricted memory. */
+                        remaining = clear_user(buf, sz);
+                } else {
+                        /*
+                         * On ia64 if a page has been mapped somewhere as
+                         * uncached, then it must also be accessed uncached
+                         * by the kernel or data corruption may occur.
+                         */
+                        ptr = xlate_dev_mem_ptr(p);
+                        if (!ptr)
+                                return -EFAULT;
 
-                /*
-                 * On ia64 if a page has been mapped somewhere as uncached, then
-                 * it must also be accessed uncached by the kernel or data
-                 * corruption may occur.
-                 */
-                ptr = xlate_dev_mem_ptr(p);
-                if (!ptr)
-                        return -EFAULT;
+                        remaining = copy_to_user(buf, ptr, sz);
+
+                        unxlate_dev_mem_ptr(p, ptr);
+                }
 
-                remaining = copy_to_user(buf, ptr, sz);
-                unxlate_dev_mem_ptr(p, ptr);
                 if (remaining)
                         return -EFAULT;
 
@@ -181,30 +197,36 @@ static ssize_t write_mem(struct file *file, const char __user *buf,
 #endif
 
         while (count > 0) {
+                int allowed;
+
                 sz = size_inside_page(p, count);
 
-                if (!range_is_allowed(p >> PAGE_SHIFT, sz))
+                allowed = page_is_allowed(p >> PAGE_SHIFT);
+                if (!allowed)
                         return -EPERM;
 
-                /*
-                 * On ia64 if a page has been mapped somewhere as uncached, then
-                 * it must also be accessed uncached by the kernel or data
-                 * corruption may occur.
-                 */
-                ptr = xlate_dev_mem_ptr(p);
-                if (!ptr) {
-                        if (written)
-                                break;
-                        return -EFAULT;
-                }
+                /* Skip actual writing when a page is marked as restricted. */
+                if (allowed == 1) {
+                        /*
+                         * On ia64 if a page has been mapped somewhere as
+                         * uncached, then it must also be accessed uncached
+                         * by the kernel or data corruption may occur.
+                         */
+                        ptr = xlate_dev_mem_ptr(p);
+                        if (!ptr) {
+                                if (written)
+                                        break;
+                                return -EFAULT;
+                        }
 
-                copied = copy_from_user(ptr, buf, sz);
-                unxlate_dev_mem_ptr(p, ptr);
-                if (copied) {
-                        written += sz - copied;
-                        if (written)
-                                break;
-                        return -EFAULT;
+                        copied = copy_from_user(ptr, buf, sz);
+                        unxlate_dev_mem_ptr(p, ptr);
+                        if (copied) {
+                                written += sz - copied;
+                                if (written)
+                                        break;
+                                return -EFAULT;
+                        }
                 }
 
                 buf += sz;
diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
index e9b7e0b3cabe..87fe111d0be6 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -2202,14 +2202,16 @@ static int virtcons_freeze(struct virtio_device *vdev)
 
         vdev->config->reset(vdev);
 
-        virtqueue_disable_cb(portdev->c_ivq);
+        if (use_multiport(portdev))
+                virtqueue_disable_cb(portdev->c_ivq);
         cancel_work_sync(&portdev->control_work);
         cancel_work_sync(&portdev->config_work);
         /*
          * Once more: if control_work_handler() was running, it would
          * enable the cb as the last step.
          */
-        virtqueue_disable_cb(portdev->c_ivq);
+        if (use_multiport(portdev))
+                virtqueue_disable_cb(portdev->c_ivq);
         remove_controlq_data(portdev);
 
         list_for_each_entry(port, &portdev->ports, list) {
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index bc96d423781a..0e3f6496524d 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -2398,6 +2398,20 @@ EXPORT_SYMBOL_GPL(cpufreq_boost_enabled);
  *********************************************************************/
 static enum cpuhp_state hp_online;
 
+static int cpuhp_cpufreq_online(unsigned int cpu)
+{
+        cpufreq_online(cpu);
+
+        return 0;
+}
+
+static int cpuhp_cpufreq_offline(unsigned int cpu)
+{
+        cpufreq_offline(cpu);
+
+        return 0;
+}
+
 /**
  * cpufreq_register_driver - register a CPU Frequency driver
  * @driver_data: A struct cpufreq_driver containing the values#
@@ -2460,8 +2474,8 @@ int cpufreq_register_driver(struct cpufreq_driver *driver_data)
         }
 
         ret = cpuhp_setup_state_nocalls(CPUHP_AP_ONLINE_DYN, "cpufreq:online",
-                                        cpufreq_online,
-                                        cpufreq_offline);
+                                        cpuhp_cpufreq_online,
+                                        cpuhp_cpufreq_offline);
         if (ret < 0)
                 goto err_if_unreg;
         hp_online = ret;
diff --git a/drivers/crypto/caam/caampkc.c b/drivers/crypto/caam/caampkc.c
index 32100c4851dd..49cbdcba7883 100644
--- a/drivers/crypto/caam/caampkc.c
+++ b/drivers/crypto/caam/caampkc.c
@@ -506,7 +506,7 @@ static int caam_rsa_init_tfm(struct crypto_akcipher *tfm)
         ctx->dev = caam_jr_alloc();
 
         if (IS_ERR(ctx->dev)) {
-                dev_err(ctx->dev, "Job Ring Device allocation for transform failed\n");
+                pr_err("Job Ring Device allocation for transform failed\n");
                 return PTR_ERR(ctx->dev);
         }
 
diff --git a/drivers/crypto/caam/ctrl.c b/drivers/crypto/caam/ctrl.c
index fef39f9f41ee..5d7f73d60515 100644
--- a/drivers/crypto/caam/ctrl.c
+++ b/drivers/crypto/caam/ctrl.c
@@ -281,7 +281,8 @@ static int deinstantiate_rng(struct device *ctrldev, int state_handle_mask)
                         /* Try to run it through DECO0 */
                         ret = run_descriptor_deco0(ctrldev, desc, &status);
 
-                        if (ret || status) {
+                        if (ret ||
+                            (status && status != JRSTA_SSRC_JUMP_HALT_CC)) {
                                 dev_err(ctrldev,
                                         "Failed to deinstantiate RNG4 SH%d\n",
                                         sh_idx);
@@ -301,15 +302,13 @@ static int caam_remove(struct platform_device *pdev)
         struct device *ctrldev;
         struct caam_drv_private *ctrlpriv;
         struct caam_ctrl __iomem *ctrl;
-        int ring;
 
         ctrldev = &pdev->dev;
         ctrlpriv = dev_get_drvdata(ctrldev);
         ctrl = (struct caam_ctrl __iomem *)ctrlpriv->ctrl;
 
-        /* Remove platform devices for JobRs */
-        for (ring = 0; ring < ctrlpriv->total_jobrs; ring++)
-                of_device_unregister(ctrlpriv->jrpdev[ring]);
+        /* Remove platform devices under the crypto node */
+        of_platform_depopulate(ctrldev);
 
         /* De-initialize RNG state handles initialized by this driver. */
         if (ctrlpriv->rng4_sh_init)
@@ -418,10 +417,21 @@ DEFINE_SIMPLE_ATTRIBUTE(caam_fops_u32_ro, caam_debugfs_u32_get, NULL, "%llu\n");
 DEFINE_SIMPLE_ATTRIBUTE(caam_fops_u64_ro, caam_debugfs_u64_get, NULL, "%llu\n");
 #endif
 
+static const struct of_device_id caam_match[] = {
+        {
+                .compatible = "fsl,sec-v4.0",
+        },
+        {
+                .compatible = "fsl,sec4.0",
+        },
+        {},
+};
+MODULE_DEVICE_TABLE(of, caam_match);
+
 /* Probe routine for CAAM top (controller) level */
 static int caam_probe(struct platform_device *pdev)
 {
-        int ret, ring, ridx, rspec, gen_sk, ent_delay = RTSDCTL_ENT_DLY_MIN;
+        int ret, ring, gen_sk, ent_delay = RTSDCTL_ENT_DLY_MIN;
         u64 caam_id;
         struct device *dev;
         struct device_node *nprop, *np;
@@ -597,47 +607,24 @@ static int caam_probe(struct platform_device *pdev)
                 goto iounmap_ctrl;
         }
 
-        /*
-         * Detect and enable JobRs
-         * First, find out how many ring spec'ed, allocate references
-         * for all, then go probe each one.
-         */
-        rspec = 0;
-        for_each_available_child_of_node(nprop, np)
-                if (of_device_is_compatible(np, "fsl,sec-v4.0-job-ring") ||
-                    of_device_is_compatible(np, "fsl,sec4.0-job-ring"))
-                        rspec++;
-
-        ctrlpriv->jrpdev = devm_kcalloc(&pdev->dev, rspec,
-                                        sizeof(*ctrlpriv->jrpdev), GFP_KERNEL);
-        if (ctrlpriv->jrpdev == NULL) {
-                ret = -ENOMEM;
+        ret = of_platform_populate(nprop, caam_match, NULL, dev);
+        if (ret) {
+                dev_err(dev, "JR platform devices creation error\n");
                 goto iounmap_ctrl;
         }
 
         ring = 0;
-        ridx = 0;
-        ctrlpriv->total_jobrs = 0;
         for_each_available_child_of_node(nprop, np)
                 if (of_device_is_compatible(np, "fsl,sec-v4.0-job-ring") ||
                     of_device_is_compatible(np, "fsl,sec4.0-job-ring")) {
-                        ctrlpriv->jrpdev[ring] =
-                                of_platform_device_create(np, NULL, dev);
-                        if (!ctrlpriv->jrpdev[ring]) {
-                                pr_warn("JR physical index %d: Platform device creation error\n",
-                                        ridx);
-                                ridx++;
-                                continue;
-                        }
                         ctrlpriv->jr[ring] = (struct caam_job_ring __iomem __force *)
                                              ((__force uint8_t *)ctrl +
-                                             (ridx + JR_BLOCK_NUMBER) *
+                                             (ring + JR_BLOCK_NUMBER) *
                                               BLOCK_OFFSET
                                              );
                         ctrlpriv->total_jobrs++;
                         ring++;
-                        ridx++;
-        }
+                }
 
         /* Check to see if QI present. If so, enable */
         ctrlpriv->qi_present =
@@ -847,17 +834,6 @@ disable_caam_ipg:
         return ret;
 }
 
-static struct of_device_id caam_match[] = {
-        {
-                .compatible = "fsl,sec-v4.0",
-        },
-        {
-                .compatible = "fsl,sec4.0",
-        },
-        {},
-};
-MODULE_DEVICE_TABLE(of, caam_match);
-
 static struct platform_driver caam_driver = {
         .driver = {
                 .name = "caam",
diff --git a/drivers/crypto/caam/intern.h b/drivers/crypto/caam/intern.h
index e2bcacc1a921..dbed8baeebe5 100644
--- a/drivers/crypto/caam/intern.h
+++ b/drivers/crypto/caam/intern.h
@@ -66,7 +66,6 @@ struct caam_drv_private_jr {
 struct caam_drv_private {
 
         struct device *dev;
-        struct platform_device **jrpdev; /* Alloc'ed array per sub-device */
         struct platform_device *pdev;
 
         /* Physical-presence section */
diff --git a/drivers/dax/Kconfig b/drivers/dax/Kconfig
index 3e2ab3b14eea..9e95bf94eb13 100644
--- a/drivers/dax/Kconfig
+++ b/drivers/dax/Kconfig
@@ -2,6 +2,7 @@ menuconfig DEV_DAX
         tristate "DAX: direct access to differentiated memory"
         default m if NVDIMM_DAX
         depends on TRANSPARENT_HUGEPAGE
+        select SRCU
         help
           Support raw access to differentiated (persistence, bandwidth,
           latency...) memory via an mmap(2) capable character
diff --git a/drivers/dax/dax.c b/drivers/dax/dax.c
index 80c6db279ae1..806f180c80d8 100644
--- a/drivers/dax/dax.c
+++ b/drivers/dax/dax.c
@@ -25,6 +25,7 @@
 #include "dax.h"
 
 static dev_t dax_devt;
+DEFINE_STATIC_SRCU(dax_srcu);
 static struct class *dax_class;
 static DEFINE_IDA(dax_minor_ida);
 static int nr_dax = CONFIG_NR_DEV_DAX;
@@ -60,7 +61,7 @@ struct dax_region {
  * @region - parent region
  * @dev - device backing the character device
  * @cdev - core chardev data
- * @alive - !alive + rcu grace period == no new mappings can be established
+ * @alive - !alive + srcu grace period == no new mappings can be established
  * @id - child id in the region
  * @num_resources - number of physical address extents in this device
  * @res - array of physical address ranges
@@ -569,7 +570,7 @@ static int __dax_dev_pud_fault(struct dax_dev *dax_dev, struct vm_fault *vmf)
 static int dax_dev_huge_fault(struct vm_fault *vmf,
                 enum page_entry_size pe_size)
 {
-        int rc;
+        int rc, id;
         struct file *filp = vmf->vma->vm_file;
         struct dax_dev *dax_dev = filp->private_data;
 
@@ -578,7 +579,7 @@ static int dax_dev_huge_fault(struct vm_fault *vmf,
                         ? "write" : "read",
                         vmf->vma->vm_start, vmf->vma->vm_end);
 
-        rcu_read_lock();
+        id = srcu_read_lock(&dax_srcu);
         switch (pe_size) {
         case PE_SIZE_PTE:
                 rc = __dax_dev_pte_fault(dax_dev, vmf);
@@ -592,7 +593,7 @@ static int dax_dev_huge_fault(struct vm_fault *vmf,
         default:
                 return VM_FAULT_FALLBACK;
         }
-        rcu_read_unlock();
+        srcu_read_unlock(&dax_srcu, id);
 
         return rc;
 }
@@ -713,11 +714,11 @@ static void unregister_dax_dev(void *dev)
          * Note, rcu is not protecting the liveness of dax_dev, rcu is
          * ensuring that any fault handlers that might have seen
          * dax_dev->alive == true, have completed.  Any fault handlers
-         * that start after synchronize_rcu() has started will abort
+         * that start after synchronize_srcu() has started will abort
          * upon seeing dax_dev->alive == false.
          */
         dax_dev->alive = false;
-        synchronize_rcu();
+        synchronize_srcu(&dax_srcu);
         unmap_mapping_range(dax_dev->inode->i_mapping, 0, 0, 1);
         cdev_del(cdev);
         device_unregister(dev);
diff --git a/drivers/firmware/efi/libstub/gop.c b/drivers/firmware/efi/libstub/gop.c
index 932742e4cf23..24c461dea7af 100644
--- a/drivers/firmware/efi/libstub/gop.c
+++ b/drivers/firmware/efi/libstub/gop.c
@@ -149,7 +149,8 @@ setup_gop32(efi_system_table_t *sys_table_arg, struct screen_info *si,
 
                 status = __gop_query32(sys_table_arg, gop32, &info, &size,
                                        &current_fb_base);
-                if (status == EFI_SUCCESS && (!first_gop || conout_found)) {
+                if (status == EFI_SUCCESS && (!first_gop || conout_found) &&
+                    info->pixel_format != PIXEL_BLT_ONLY) {
                         /*
                          * Systems that use the UEFI Console Splitter may
                          * provide multiple GOP devices, not all of which are
@@ -266,7 +267,8 @@ setup_gop64(efi_system_table_t *sys_table_arg, struct screen_info *si,
 
                 status = __gop_query64(sys_table_arg, gop64, &info, &size,
                                        &current_fb_base);
-                if (status == EFI_SUCCESS && (!first_gop || conout_found)) {
+                if (status == EFI_SUCCESS && (!first_gop || conout_found) &&
+                    info->pixel_format != PIXEL_BLT_ONLY) {
                         /*
                          * Systems that use the UEFI Console Splitter may
                          * provide multiple GOP devices, not all of which are
diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gpu.c b/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
index 4f587058a3aa..9a9c40717801 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
@@ -1333,7 +1333,7 @@ int etnaviv_gpu_submit(struct etnaviv_gpu *gpu,
         if (!fence) {
                 event_free(gpu, event);
                 ret = -ENOMEM;
-                goto out_pm_put;
+                goto out_unlock;
         }
 
         gpu->event[event].fence = fence;
@@ -1373,6 +1373,7 @@ int etnaviv_gpu_submit(struct etnaviv_gpu *gpu,
         hangcheck_timer_reset(gpu);
         ret = 0;
 
+out_unlock:
         mutex_unlock(&gpu->lock);
 
 out_pm_put:
diff --git a/drivers/gpu/drm/i915/gvt/cfg_space.c b/drivers/gpu/drm/i915/gvt/cfg_space.c
index b7d7721e72fa..40af17ec6312 100644
--- a/drivers/gpu/drm/i915/gvt/cfg_space.c
+++ b/drivers/gpu/drm/i915/gvt/cfg_space.c
@@ -285,9 +285,6 @@ int intel_vgpu_emulate_cfg_write(struct intel_vgpu *vgpu, unsigned int offset,
 {
         int ret;
 
-        if (vgpu->failsafe)
-                return 0;
-
         if (WARN_ON(bytes > 4))
                 return -EINVAL;
 
diff --git a/drivers/gpu/drm/i915/gvt/execlist.c b/drivers/gpu/drm/i915/gvt/execlist.c
index ce4276a7cf9c..536bde8638c8 100644
--- a/drivers/gpu/drm/i915/gvt/execlist.c
+++ b/drivers/gpu/drm/i915/gvt/execlist.c
@@ -776,7 +776,8 @@ static void init_vgpu_execlist(struct intel_vgpu *vgpu, int ring_id)
                         _EL_OFFSET_STATUS_PTR);
 
         ctx_status_ptr.dw = vgpu_vreg(vgpu, ctx_status_ptr_reg);
-        ctx_status_ptr.read_ptr = ctx_status_ptr.write_ptr = 0x7;
+        ctx_status_ptr.read_ptr = 0;
+        ctx_status_ptr.write_ptr = 0x7;
         vgpu_vreg(vgpu, ctx_status_ptr_reg) = ctx_status_ptr.dw;
 }
 
diff --git a/drivers/gpu/drm/i915/gvt/firmware.c b/drivers/gpu/drm/i915/gvt/firmware.c
index 933a7c211a1c..dce8d15f706f 100644
--- a/drivers/gpu/drm/i915/gvt/firmware.c
+++ b/drivers/gpu/drm/i915/gvt/firmware.c
@@ -75,11 +75,11 @@ static int expose_firmware_sysfs(struct intel_gvt *gvt)
         struct gvt_firmware_header *h;
         void *firmware;
         void *p;
-        unsigned long size;
+        unsigned long size, crc32_start;
         int i;
         int ret;
 
-        size = sizeof(*h) + info->mmio_size + info->cfg_space_size - 1;
+        size = sizeof(*h) + info->mmio_size + info->cfg_space_size;
         firmware = vzalloc(size);
         if (!firmware)
                 return -ENOMEM;
@@ -112,6 +112,9 @@ static int expose_firmware_sysfs(struct intel_gvt *gvt)
 
         memcpy(gvt->firmware.mmio, p, info->mmio_size);
 
+        crc32_start = offsetof(struct gvt_firmware_header, crc32) + 4;
+        h->crc32 = crc32_le(0, firmware + crc32_start, size - crc32_start);
+
         firmware_attr.size = size;
         firmware_attr.private = firmware;
 
@@ -234,7 +237,7 @@ int intel_gvt_load_firmware(struct intel_gvt *gvt)
 
         firmware->mmio = mem;
 
-        sprintf(path, "%s/vid_0x%04x_did_0x%04x_rid_0x%04x.golden_hw_state",
+        sprintf(path, "%s/vid_0x%04x_did_0x%04x_rid_0x%02x.golden_hw_state",
                  GVT_FIRMWARE_PATH, pdev->vendor, pdev->device,
                  pdev->revision);
 
diff --git a/drivers/gpu/drm/i915/gvt/gvt.c b/drivers/gpu/drm/i915/gvt/gvt.c
index 0f3a98865a58..7dea5e5d5567 100644
--- a/drivers/gpu/drm/i915/gvt/gvt.c
+++ b/drivers/gpu/drm/i915/gvt/gvt.c
@@ -52,6 +52,8 @@ static const struct intel_gvt_ops intel_gvt_ops = {
         .vgpu_create = intel_gvt_create_vgpu,
         .vgpu_destroy = intel_gvt_destroy_vgpu,
         .vgpu_reset = intel_gvt_reset_vgpu,
+        .vgpu_activate = intel_gvt_activate_vgpu,
+        .vgpu_deactivate = intel_gvt_deactivate_vgpu,
 };
 
 /**
diff --git a/drivers/gpu/drm/i915/gvt/gvt.h b/drivers/gpu/drm/i915/gvt/gvt.h
index 806da96b6a92..930732e5c780 100644
--- a/drivers/gpu/drm/i915/gvt/gvt.h
+++ b/drivers/gpu/drm/i915/gvt/gvt.h
@@ -395,7 +395,8 @@ void intel_gvt_destroy_vgpu(struct intel_vgpu *vgpu);
 void intel_gvt_reset_vgpu_locked(struct intel_vgpu *vgpu, bool dmlr,
                                  unsigned int engine_mask);
 void intel_gvt_reset_vgpu(struct intel_vgpu *vgpu);
-
+void intel_gvt_activate_vgpu(struct intel_vgpu *vgpu);
+void intel_gvt_deactivate_vgpu(struct intel_vgpu *vgpu);
 
 /* validating GM functions */
 #define vgpu_gmadr_is_aperture(vgpu, gmadr) \
@@ -462,6 +463,8 @@ struct intel_gvt_ops {
                                 struct intel_vgpu_type *);
         void (*vgpu_destroy)(struct intel_vgpu *);
         void (*vgpu_reset)(struct intel_vgpu *);
+        void (*vgpu_activate)(struct intel_vgpu *);
+        void (*vgpu_deactivate)(struct intel_vgpu *);
 };
 
 
diff --git a/drivers/gpu/drm/i915/gvt/kvmgt.c b/drivers/gpu/drm/i915/gvt/kvmgt.c
index 42ff7ffb6066..1ae0b4083ce1 100644
--- a/drivers/gpu/drm/i915/gvt/kvmgt.c
+++ b/drivers/gpu/drm/i915/gvt/kvmgt.c
@@ -546,6 +546,8 @@ static int intel_vgpu_open(struct mdev_device *mdev)
         if (ret)
                 goto undo_group;
 
+        intel_gvt_ops->vgpu_activate(vgpu);
+
         atomic_set(&vgpu->vdev.released, 0);
         return ret;
 
@@ -571,6 +573,8 @@ static void __intel_vgpu_release(struct intel_vgpu *vgpu)
         if (atomic_cmpxchg(&vgpu->vdev.released, 0, 1))
                 return;
 
+        intel_gvt_ops->vgpu_deactivate(vgpu);
+
         ret = vfio_unregister_notifier(mdev_dev(vgpu->vdev.mdev), VFIO_IOMMU_NOTIFY,
                                         &vgpu->vdev.iommu_notifier);
         WARN(ret, "vfio_unregister_notifier for iommu failed: %d\n", ret);
diff --git a/drivers/gpu/drm/i915/gvt/vgpu.c b/drivers/gpu/drm/i915/gvt/vgpu.c
index 6ba02525e905..6e3cbd8caec2 100644
--- a/drivers/gpu/drm/i915/gvt/vgpu.c
+++ b/drivers/gpu/drm/i915/gvt/vgpu.c
@@ -196,20 +196,34 @@ static void intel_gvt_update_vgpu_types(struct intel_gvt *gvt)
 }
 
 /**
- * intel_gvt_destroy_vgpu - destroy a virtual GPU
+ * intel_gvt_active_vgpu - activate a virtual GPU
  * @vgpu: virtual GPU
  *
- * This function is called when user wants to destroy a virtual GPU.
+ * This function is called when user wants to activate a virtual GPU.
  *
  */
-void intel_gvt_destroy_vgpu(struct intel_vgpu *vgpu)
+void intel_gvt_activate_vgpu(struct intel_vgpu *vgpu)
+{
+        mutex_lock(&vgpu->gvt->lock);
+        vgpu->active = true;
+        mutex_unlock(&vgpu->gvt->lock);
+}
+
+/**
+ * intel_gvt_deactive_vgpu - deactivate a virtual GPU
+ * @vgpu: virtual GPU
+ *
+ * This function is called when user wants to deactivate a virtual GPU.
+ * All virtual GPU runtime information will be destroyed.
+ *
+ */
+void intel_gvt_deactivate_vgpu(struct intel_vgpu *vgpu)
 {
         struct intel_gvt *gvt = vgpu->gvt;
 
         mutex_lock(&gvt->lock);
 
         vgpu->active = false;
-        idr_remove(&gvt->vgpu_idr, vgpu->id);
 
         if (atomic_read(&vgpu->running_workload_num)) {
                 mutex_unlock(&gvt->lock);
@@ -218,6 +232,26 @@ void intel_gvt_destroy_vgpu(struct intel_vgpu *vgpu)
         }
 
         intel_vgpu_stop_schedule(vgpu);
+
+        mutex_unlock(&gvt->lock);
+}
+
+/**
+ * intel_gvt_destroy_vgpu - destroy a virtual GPU
+ * @vgpu: virtual GPU
+ *
+ * This function is called when user wants to destroy a virtual GPU.
+ *
+ */
+void intel_gvt_destroy_vgpu(struct intel_vgpu *vgpu)
+{
+        struct intel_gvt *gvt = vgpu->gvt;
+
+        mutex_lock(&gvt->lock);
+
+        WARN(vgpu->active, "vGPU is still active!\n");
+
+        idr_remove(&gvt->vgpu_idr, vgpu->id);
         intel_vgpu_clean_sched_policy(vgpu);
         intel_vgpu_clean_gvt_context(vgpu);
         intel_vgpu_clean_execlist(vgpu);
@@ -349,7 +383,6 @@ static struct intel_vgpu *__intel_gvt_create_vgpu(struct intel_gvt *gvt,
         if (ret)
                 goto out_clean_shadow_ctx;
 
-        vgpu->active = true;
         mutex_unlock(&gvt->lock);
 
         return vgpu;
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index c616b4e755bc..7b4fa84cbc3c 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -1469,8 +1469,6 @@ static int i915_drm_suspend(struct drm_device *dev)
                 goto out;
         }
 
-        intel_guc_suspend(dev_priv);
-
         intel_display_suspend(dev);
 
         intel_dp_mst_suspend(dev);
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index bbc6f1c9f175..92343343044f 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -4456,6 +4456,8 @@ int i915_gem_suspend(struct drm_i915_private *dev_priv)
         i915_gem_context_lost(dev_priv);
         mutex_unlock(&dev->struct_mutex);
 
+        intel_guc_suspend(dev_priv);
+
         cancel_delayed_work_sync(&dev_priv->gpu_error.hangcheck_work);
         cancel_delayed_work_sync(&dev_priv->gt.retire_work);
 
diff --git a/drivers/gpu/drm/i915/i915_gem_shrinker.c b/drivers/gpu/drm/i915/i915_gem_shrinker.c
index 2978acdd995e..129ed303a6c4 100644
--- a/drivers/gpu/drm/i915/i915_gem_shrinker.c
+++ b/drivers/gpu/drm/i915/i915_gem_shrinker.c
@@ -53,6 +53,17 @@ static bool i915_gem_shrinker_lock(struct drm_device *dev, bool *unlock)
         BUG();
 }
 
+static void i915_gem_shrinker_unlock(struct drm_device *dev, bool unlock)
+{
+        if (!unlock)
+                return;
+
+        mutex_unlock(&dev->struct_mutex);
+
+        /* expedite the RCU grace period to free some request slabs */
+        synchronize_rcu_expedited();
+}
+
 static bool any_vma_pinned(struct drm_i915_gem_object *obj)
 {
         struct i915_vma *vma;
@@ -232,11 +243,8 @@ i915_gem_shrink(struct drm_i915_private *dev_priv,
                 intel_runtime_pm_put(dev_priv);
 
         i915_gem_retire_requests(dev_priv);
-        if (unlock)
-                mutex_unlock(&dev_priv->drm.struct_mutex);
 
-        /* expedite the RCU grace period to free some request slabs */
-        synchronize_rcu_expedited();
+        i915_gem_shrinker_unlock(&dev_priv->drm, unlock);
 
         return count;
 }
@@ -296,8 +304,7 @@ i915_gem_shrinker_count(struct shrinker *shrinker, struct shrink_control *sc)
                         count += obj->base.size >> PAGE_SHIFT;
         }
 
-        if (unlock)
-                mutex_unlock(&dev->struct_mutex);
+        i915_gem_shrinker_unlock(dev, unlock);
 
         return count;
 }
@@ -324,8 +331,8 @@ i915_gem_shrinker_scan(struct shrinker *shrinker, struct shrink_control *sc)
                                          sc->nr_to_scan - freed,
                                          I915_SHRINK_BOUND |
                                          I915_SHRINK_UNBOUND);
-        if (unlock)
-                mutex_unlock(&dev->struct_mutex);
+
+        i915_gem_shrinker_unlock(dev, unlock);
 
         return freed;
 }
@@ -367,8 +374,7 @@ i915_gem_shrinker_unlock_uninterruptible(struct drm_i915_private *dev_priv,
                                          struct shrinker_lock_uninterruptible *slu)
 {
         dev_priv->mm.interruptible = slu->was_interruptible;
-        if (slu->unlock)
-                mutex_unlock(&dev_priv->drm.struct_mutex);
+        i915_gem_shrinker_unlock(&dev_priv->drm, slu->unlock);
 }
 
 static int
diff --git a/drivers/gpu/drm/udl/udl_transfer.c b/drivers/gpu/drm/udl/udl_transfer.c
index 917dcb978c2c..0c87b1ac6b68 100644
--- a/drivers/gpu/drm/udl/udl_transfer.c
+++ b/drivers/gpu/drm/udl/udl_transfer.c
@@ -14,6 +14,7 @@
 #include <linux/slab.h>
 #include <linux/fb.h>
 #include <linux/prefetch.h>
+#include <asm/unaligned.h>
 
 #include <drm/drmP.h>
 #include "udl_drv.h"
@@ -163,7 +164,7 @@ static void udl_compress_hline16(
                         const u8 *const start = pixel;
                         const uint16_t repeating_pixel_val16 = pixel_val16;
 
-                        *(uint16_t *)cmd = cpu_to_be16(pixel_val16);
+                        put_unaligned_be16(pixel_val16, cmd);
 
                         cmd += 2;
                         pixel += bpp;
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 63ec1993eaaa..d162f0dc76e3 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -819,8 +819,7 @@ static int hid_scan_report(struct hid_device *hid)
                 hid->group = HID_GROUP_WACOM;
                 break;
         case USB_VENDOR_ID_SYNAPTICS:
-                if (hid->group == HID_GROUP_GENERIC ||
-                    hid->group == HID_GROUP_MULTITOUCH_WIN_8)
+                if (hid->group == HID_GROUP_GENERIC)
                         if ((parser->scan_flags & HID_SCAN_FLAG_VENDOR_SPECIFIC)
                             && (parser->scan_flags & HID_SCAN_FLAG_GD_POINTER))
                                 /*
@@ -2096,6 +2095,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UGEE_TABLET_45) },
         { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_DRAWIMAGE_G3) },
         { HID_USB_DEVICE(USB_VENDOR_ID_UGTIZER, USB_DEVICE_ID_UGTIZER_TABLET_GP0610) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_UGEE, USB_DEVICE_ID_UGEE_TABLET_EX07S) },
         { HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP, USB_DEVICE_ID_SMARTJOY_PLUS) },
         { HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP, USB_DEVICE_ID_SUPER_JOY_BOX_3) },
         { HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP, USB_DEVICE_ID_DUAL_USB_JOYPAD) },
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 4e2648c86c8c..b26c030926c1 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -1028,6 +1028,9 @@
 #define USB_DEVICE_ID_UGEE_TABLET_45            0x0045
 #define USB_DEVICE_ID_YIYNOVA_TABLET            0x004d
 
+#define USB_VENDOR_ID_UGEE              0x28bd
+#define USB_DEVICE_ID_UGEE_TABLET_EX07S         0x0071
+
 #define USB_VENDOR_ID_UNITEC    0x227d
 #define USB_DEVICE_ID_UNITEC_USB_TOUCH_0709     0x0709
 #define USB_DEVICE_ID_UNITEC_USB_TOUCH_0A19     0x0a19
diff --git a/drivers/hid/hid-uclogic.c b/drivers/hid/hid-uclogic.c
index 1509d7287ff3..e3e6e5c893cc 100644
--- a/drivers/hid/hid-uclogic.c
+++ b/drivers/hid/hid-uclogic.c
@@ -977,6 +977,7 @@ static int uclogic_probe(struct hid_device *hdev,
                 }
                 break;
         case USB_DEVICE_ID_UGTIZER_TABLET_GP0610:
+        case USB_DEVICE_ID_UGEE_TABLET_EX07S:
                 /* If this is the pen interface */
                 if (intf->cur_altsetting->desc.bInterfaceNumber == 1) {
                         rc = uclogic_tablet_enable(hdev);
@@ -1069,6 +1070,7 @@ static const struct hid_device_id uclogic_devices[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UGEE_TABLET_45) },
         { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_DRAWIMAGE_G3) },
         { HID_USB_DEVICE(USB_VENDOR_ID_UGTIZER, USB_DEVICE_ID_UGTIZER_TABLET_GP0610) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_UGEE, USB_DEVICE_ID_UGEE_TABLET_EX07S) },
         { }
 };
 MODULE_DEVICE_TABLE(hid, uclogic_devices);
diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
index 91cbe86b25c8..fcbed35e95a8 100644
--- a/drivers/infiniband/ulp/isert/ib_isert.c
+++ b/drivers/infiniband/ulp/isert/ib_isert.c
@@ -817,6 +817,7 @@ isert_post_recvm(struct isert_conn *isert_conn, u32 count)
                 rx_wr->sg_list = &rx_desc->rx_sg;
                 rx_wr->num_sge = 1;
                 rx_wr->next = rx_wr + 1;
+                rx_desc->in_use = false;
         }
         rx_wr--;
         rx_wr->next = NULL; /* mark end of work requests list */
@@ -835,6 +836,15 @@ isert_post_recv(struct isert_conn *isert_conn, struct iser_rx_desc *rx_desc)
         struct ib_recv_wr *rx_wr_failed, rx_wr;
         int ret;
 
+        if (!rx_desc->in_use) {
+                /*
+                 * if the descriptor is not in-use we already reposted it
+                 * for recv, so just silently return
+                 */
+                return 0;
+        }
+
+        rx_desc->in_use = false;
         rx_wr.wr_cqe = &rx_desc->rx_cqe;
         rx_wr.sg_list = &rx_desc->rx_sg;
         rx_wr.num_sge = 1;
@@ -1397,6 +1407,8 @@ isert_recv_done(struct ib_cq *cq, struct ib_wc *wc)
                 return;
         }
 
+        rx_desc->in_use = true;
+
         ib_dma_sync_single_for_cpu(ib_dev, rx_desc->dma_addr,
                         ISER_RX_PAYLOAD_SIZE, DMA_FROM_DEVICE);
 
@@ -1659,10 +1671,23 @@ isert_rdma_write_done(struct ib_cq *cq, struct ib_wc *wc)
         ret = isert_check_pi_status(cmd, isert_cmd->rw.sig->sig_mr);
         isert_rdma_rw_ctx_destroy(isert_cmd, isert_conn);
 
-        if (ret)
-                transport_send_check_condition_and_sense(cmd, cmd->pi_err, 0);
-        else
-                isert_put_response(isert_conn->conn, isert_cmd->iscsi_cmd);
+        if (ret) {
+                /*
+                 * transport_generic_request_failure() expects to have
+                 * plus two references to handle queue-full, so re-add
+                 * one here as target-core will have already dropped
+                 * it after the first isert_put_datain() callback.
+                 */
+                kref_get(&cmd->cmd_kref);
+                transport_generic_request_failure(cmd, cmd->pi_err);
+        } else {
+                /*
+                 * XXX: isert_put_response() failure is not retried.
+                 */
+                ret = isert_put_response(isert_conn->conn, isert_cmd->iscsi_cmd);
+                if (ret)
+                        pr_warn_ratelimited("isert_put_response() ret: %d\n", ret);
+        }
 }
 
 static void
@@ -1699,13 +1724,15 @@ isert_rdma_read_done(struct ib_cq *cq, struct ib_wc *wc)
         cmd->i_state = ISTATE_RECEIVED_LAST_DATAOUT;
         spin_unlock_bh(&cmd->istate_lock);
 
-        if (ret) {
-                target_put_sess_cmd(se_cmd);
-                transport_send_check_condition_and_sense(se_cmd,
-                                                         se_cmd->pi_err, 0);
-        } else {
+        /*
+         * transport_generic_request_failure() will drop the extra
+         * se_cmd->cmd_kref reference after T10-PI error, and handle
+         * any non-zero ->queue_status() callback error retries.
+         */
+        if (ret)
+                transport_generic_request_failure(se_cmd, se_cmd->pi_err);
+        else
                 target_execute_cmd(se_cmd);
-        }
 }
 
 static void
@@ -2171,26 +2198,28 @@ isert_put_datain(struct iscsi_conn *conn, struct iscsi_cmd *cmd)
                 chain_wr = &isert_cmd->tx_desc.send_wr;
         }
 
-        isert_rdma_rw_ctx_post(isert_cmd, isert_conn, cqe, chain_wr);
-        isert_dbg("Cmd: %p posted RDMA_WRITE for iSER Data READ\n", isert_cmd);
-        return 1;
+        rc = isert_rdma_rw_ctx_post(isert_cmd, isert_conn, cqe, chain_wr);
+        isert_dbg("Cmd: %p posted RDMA_WRITE for iSER Data READ rc: %d\n",
+                  isert_cmd, rc);
+        return rc;
 }
 
 static int
 isert_get_dataout(struct iscsi_conn *conn, struct iscsi_cmd *cmd, bool recovery)
 {
         struct isert_cmd *isert_cmd = iscsit_priv_cmd(cmd);
+        int ret;
 
         isert_dbg("Cmd: %p RDMA_READ data_length: %u write_data_done: %u\n",
                  isert_cmd, cmd->se_cmd.data_length, cmd->write_data_done);
 
         isert_cmd->tx_desc.tx_cqe.done = isert_rdma_read_done;
-        isert_rdma_rw_ctx_post(isert_cmd, conn->context,
-                        &isert_cmd->tx_desc.tx_cqe, NULL);
+        ret = isert_rdma_rw_ctx_post(isert_cmd, conn->context,
+                                     &isert_cmd->tx_desc.tx_cqe, NULL);
 
-        isert_dbg("Cmd: %p posted RDMA_READ memory for ISER Data WRITE\n",
-                 isert_cmd);
-        return 0;
+        isert_dbg("Cmd: %p posted RDMA_READ memory for ISER Data WRITE rc: %d\n",
+                 isert_cmd, ret);
+        return ret;
 }
 
 static int
diff --git a/drivers/infiniband/ulp/isert/ib_isert.h b/drivers/infiniband/ulp/isert/ib_isert.h
index c02ada57d7f5..87d994de8c91 100644
--- a/drivers/infiniband/ulp/isert/ib_isert.h
+++ b/drivers/infiniband/ulp/isert/ib_isert.h
@@ -60,7 +60,7 @@
 
 #define ISER_RX_PAD_SIZE        (ISCSI_DEF_MAX_RECV_SEG_LEN + 4096 - \
                 (ISER_RX_PAYLOAD_SIZE + sizeof(u64) + sizeof(struct ib_sge) + \
-                 sizeof(struct ib_cqe)))
+                 sizeof(struct ib_cqe) + sizeof(bool)))
 
 #define ISCSI_ISER_SG_TABLESIZE         256
 
@@ -85,6 +85,7 @@ struct iser_rx_desc {
         u64             dma_addr;
         struct ib_sge   rx_sg;
         struct ib_cqe   rx_cqe;
+        bool            in_use;
         char            pad[ISER_RX_PAD_SIZE];
 } __packed;
 
diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
index 155fcb3b6230..153b1ee13e03 100644
--- a/drivers/input/joystick/xpad.c
+++ b/drivers/input/joystick/xpad.c
@@ -202,6 +202,7 @@ static const struct xpad_device {
         { 0x1430, 0x8888, "TX6500+ Dance Pad (first generation)", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX },
         { 0x146b, 0x0601, "BigBen Interactive XBOX 360 Controller", 0, XTYPE_XBOX360 },
         { 0x1532, 0x0037, "Razer Sabertooth", 0, XTYPE_XBOX360 },
+        { 0x1532, 0x0a03, "Razer Wildcat", 0, XTYPE_XBOXONE },
         { 0x15e4, 0x3f00, "Power A Mini Pro Elite", 0, XTYPE_XBOX360 },
         { 0x15e4, 0x3f0a, "Xbox Airflo wired controller", 0, XTYPE_XBOX360 },
         { 0x15e4, 0x3f10, "Batarang Xbox 360 controller", 0, XTYPE_XBOX360 },
@@ -326,6 +327,7 @@ static struct usb_device_id xpad_table[] = {
         XPAD_XBOX360_VENDOR(0x1430),            /* RedOctane X-Box 360 controllers */
         XPAD_XBOX360_VENDOR(0x146b),            /* BigBen Interactive Controllers */
         XPAD_XBOX360_VENDOR(0x1532),            /* Razer Sabertooth */
+        XPAD_XBOXONE_VENDOR(0x1532),            /* Razer Wildcat */
         XPAD_XBOX360_VENDOR(0x15e4),            /* Numark X-Box 360 controllers */
         XPAD_XBOX360_VENDOR(0x162e),            /* Joytech X-Box 360 controllers */
         XPAD_XBOX360_VENDOR(0x1689),            /* Razer Onza */
diff --git a/drivers/irqchip/irq-imx-gpcv2.c b/drivers/irqchip/irq-imx-gpcv2.c
index 15af9a9753e5..2d203b422129 100644
--- a/drivers/irqchip/irq-imx-gpcv2.c
+++ b/drivers/irqchip/irq-imx-gpcv2.c
@@ -230,6 +230,8 @@ static int __init imx_gpcv2_irqchip_init(struct device_node *node,
                 return -ENOMEM;
         }
 
+        raw_spin_lock_init(&cd->rlock);
+
         cd->gpc_base = of_iomap(node, 0);
         if (!cd->gpc_base) {
                 pr_err("fsl-gpcv2: unable to map gpc registers\n");
diff --git a/drivers/net/can/ifi_canfd/ifi_canfd.c b/drivers/net/can/ifi_canfd/ifi_canfd.c
index 138f5ae75c0b..4d1fe8d95042 100644
--- a/drivers/net/can/ifi_canfd/ifi_canfd.c
+++ b/drivers/net/can/ifi_canfd/ifi_canfd.c
@@ -557,7 +557,7 @@ static int ifi_canfd_poll(struct napi_struct *napi, int quota)
         int work_done = 0;
 
         u32 stcmd = readl(priv->base + IFI_CANFD_STCMD);
-        u32 rxstcmd = readl(priv->base + IFI_CANFD_STCMD);
+        u32 rxstcmd = readl(priv->base + IFI_CANFD_RXSTCMD);
         u32 errctr = readl(priv->base + IFI_CANFD_ERROR_CTR);
 
         /* Handle bus state changes */
diff --git a/drivers/net/can/rcar/rcar_can.c b/drivers/net/can/rcar/rcar_can.c
index caed4e6960f8..11662f479e76 100644
--- a/drivers/net/can/rcar/rcar_can.c
+++ b/drivers/net/can/rcar/rcar_can.c
@@ -826,8 +826,7 @@ static int rcar_can_probe(struct platform_device *pdev)
 
         devm_can_led_init(ndev);
 
-        dev_info(&pdev->dev, "device registered (regs @ %p, IRQ%d)\n",
-                 priv->regs, ndev->irq);
+        dev_info(&pdev->dev, "device registered (IRQ%d)\n", ndev->irq);
 
         return 0;
 fail_candev:
diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
index 1b52520715ae..f8c81f12d988 100644
--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -990,7 +990,7 @@ static void team_port_disable(struct team *team,
 #define TEAM_ENC_FEATURES       (NETIF_F_HW_CSUM | NETIF_F_SG | \
                                  NETIF_F_RXCSUM | NETIF_F_ALL_TSO)
 
-static void ___team_compute_features(struct team *team)
+static void __team_compute_features(struct team *team)
 {
         struct team_port *port;
         u32 vlan_features = TEAM_VLAN_FEATURES & NETIF_F_ALL_FOR_ALL;
@@ -1023,16 +1023,10 @@ static void ___team_compute_features(struct team *team)
                 team->dev->priv_flags |= IFF_XMIT_DST_RELEASE;
 }
 
-static void __team_compute_features(struct team *team)
-{
-        ___team_compute_features(team);
-        netdev_change_features(team->dev);
-}
-
 static void team_compute_features(struct team *team)
 {
         mutex_lock(&team->lock);
-        ___team_compute_features(team);
+        __team_compute_features(team);
         mutex_unlock(&team->lock);
         netdev_change_features(team->dev);
 }
@@ -1641,6 +1635,7 @@ static void team_uninit(struct net_device *dev)
         team_notify_peers_fini(team);
         team_queue_override_fini(team);
         mutex_unlock(&team->lock);
+        netdev_change_features(dev);
 }
 
 static void team_destructor(struct net_device *dev)
@@ -1928,6 +1923,10 @@ static int team_add_slave(struct net_device *dev, struct net_device *port_dev)
         mutex_lock(&team->lock);
         err = team_port_add(team, port_dev);
         mutex_unlock(&team->lock);
+
+        if (!err)
+                netdev_change_features(dev);
+
         return err;
 }
 
@@ -1939,6 +1938,10 @@ static int team_del_slave(struct net_device *dev, struct net_device *port_dev)
         mutex_lock(&team->lock);
         err = team_port_del(team, port_dev);
         mutex_unlock(&team->lock);
+
+        if (!err)
+                netdev_change_features(dev);
+
         return err;
 }
 
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 156f7f85e486..2474618404f5 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -908,7 +908,7 @@ static const struct usb_device_id products[] = {
         {QMI_FIXED_INTF(0x2357, 0x9000, 4)},    /* TP-LINK MA260 */
         {QMI_QUIRK_SET_DTR(0x1bc7, 0x1040, 2)}, /* Telit LE922A */
         {QMI_FIXED_INTF(0x1bc7, 0x1200, 5)},    /* Telit LE920 */
-        {QMI_FIXED_INTF(0x1bc7, 0x1201, 2)},    /* Telit LE920 */
+        {QMI_QUIRK_SET_DTR(0x1bc7, 0x1201, 2)}, /* Telit LE920, LE920A4 */
         {QMI_FIXED_INTF(0x1c9e, 0x9b01, 3)},    /* XS Stick W100-2 from 4G Systems */
         {QMI_FIXED_INTF(0x0b3c, 0xc000, 4)},    /* Olivetti Olicard 100 */
         {QMI_FIXED_INTF(0x0b3c, 0xc001, 4)},    /* Olivetti Olicard 120 */
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index 3de65ea6531a..453244805c52 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -1929,7 +1929,7 @@ static int __usbnet_read_cmd(struct usbnet *dev, u8 cmd, u8 reqtype,
                    " value=0x%04x index=0x%04x size=%d\n",
                    cmd, reqtype, value, index, size);
 
-        if (data) {
+        if (size) {
                 buf = kmalloc(size, GFP_KERNEL);
                 if (!buf)
                         goto out;
@@ -1938,8 +1938,13 @@ static int __usbnet_read_cmd(struct usbnet *dev, u8 cmd, u8 reqtype,
         err = usb_control_msg(dev->udev, usb_rcvctrlpipe(dev->udev, 0),
                               cmd, reqtype, value, index, buf, size,
                               USB_CTRL_GET_TIMEOUT);
-        if (err > 0 && err <= size)
-                memcpy(data, buf, err);
+        if (err > 0 && err <= size) {
+        if (data)
+            memcpy(data, buf, err);
+        else
+            netdev_dbg(dev->net,
+                "Huh? Data requested but thrown away.\n");
+    }
         kfree(buf);
 out:
         return err;
@@ -1960,7 +1965,13 @@ static int __usbnet_write_cmd(struct usbnet *dev, u8 cmd, u8 reqtype,
                 buf = kmemdup(data, size, GFP_KERNEL);
                 if (!buf)
                         goto out;
-        }
+        } else {
+        if (size) {
+            WARN_ON_ONCE(1);
+            err = -EINVAL;
+            goto out;
+        }
+    }
 
         err = usb_control_msg(dev->udev, usb_sndctrlpipe(dev->udev, 0),
                               cmd, reqtype, value, index, buf, size,
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index ea9890d61967..f36584616e7d 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -2230,14 +2230,8 @@ static bool virtnet_validate_features(struct virtio_device *vdev)
 #define MIN_MTU ETH_MIN_MTU
 #define MAX_MTU ETH_MAX_MTU
 
-static int virtnet_probe(struct virtio_device *vdev)
+static int virtnet_validate(struct virtio_device *vdev)
 {
-        int i, err;
-        struct net_device *dev;
-        struct virtnet_info *vi;
-        u16 max_queue_pairs;
-        int mtu;
-
         if (!vdev->config->get) {
                 dev_err(&vdev->dev, "%s failure: config access disabled\n",
                         __func__);
@@ -2247,6 +2241,25 @@ static int virtnet_probe(struct virtio_device *vdev)
         if (!virtnet_validate_features(vdev))
                 return -EINVAL;
 
+        if (virtio_has_feature(vdev, VIRTIO_NET_F_MTU)) {
+                int mtu = virtio_cread16(vdev,
+                                         offsetof(struct virtio_net_config,
+                                                  mtu));
+                if (mtu < MIN_MTU)
+                        __virtio_clear_bit(vdev, VIRTIO_NET_F_MTU);
+        }
+
+        return 0;
+}
+
+static int virtnet_probe(struct virtio_device *vdev)
+{
+        int i, err;
+        struct net_device *dev;
+        struct virtnet_info *vi;
+        u16 max_queue_pairs;
+        int mtu;
+
         /* Find if host supports multiqueue virtio_net device */
         err = virtio_cread_feature(vdev, VIRTIO_NET_F_MQ,
                                    struct virtio_net_config,
@@ -2362,11 +2375,20 @@ static int virtnet_probe(struct virtio_device *vdev)
                                      offsetof(struct virtio_net_config,
                                               mtu));
                 if (mtu < dev->min_mtu) {
-                        __virtio_clear_bit(vdev, VIRTIO_NET_F_MTU);
-                } else {
-                        dev->mtu = mtu;
-                        dev->max_mtu = mtu;
+                        /* Should never trigger: MTU was previously validated
+                         * in virtnet_validate.
+                         */
+                        dev_err(&vdev->dev, "device MTU appears to have changed "
+                                "it is now %d < %d", mtu, dev->min_mtu);
+                        goto free_stats;
                 }
+
+                dev->mtu = mtu;
+                dev->max_mtu = mtu;
+
+                /* TODO: size buffers correctly in this case. */
+                if (dev->mtu > ETH_DATA_LEN)
+                        vi->big_packets = true;
         }
 
         if (vi->any_header_sg)
@@ -2544,6 +2566,7 @@ static struct virtio_driver virtio_net_driver = {
         .driver.name =  KBUILD_MODNAME,
         .driver.owner = THIS_MODULE,
         .id_table =     id_table,
+        .validate =     virtnet_validate,
         .probe =        virtnet_probe,
         .remove =       virtnet_remove,
         .config_changed = virtnet_config_changed,
diff --git a/drivers/nvdimm/bus.c b/drivers/nvdimm/bus.c
index 23d4a1728cdf..351bac8f6503 100644
--- a/drivers/nvdimm/bus.c
+++ b/drivers/nvdimm/bus.c
@@ -934,8 +934,14 @@ static int __nd_ioctl(struct nvdimm_bus *nvdimm_bus, struct nvdimm *nvdimm,
         rc = nd_desc->ndctl(nd_desc, nvdimm, cmd, buf, buf_len, NULL);
         if (rc < 0)
                 goto out_unlock;
+        nvdimm_bus_unlock(&nvdimm_bus->dev);
+
         if (copy_to_user(p, buf, buf_len))
                 rc = -EFAULT;
+
+        vfree(buf);
+        return rc;
+
  out_unlock:
         nvdimm_bus_unlock(&nvdimm_bus->dev);
  out:
diff --git a/drivers/nvdimm/claim.c b/drivers/nvdimm/claim.c
index b3323c0697f6..ca6d572c48fc 100644
--- a/drivers/nvdimm/claim.c
+++ b/drivers/nvdimm/claim.c
@@ -243,7 +243,15 @@ static int nsio_rw_bytes(struct nd_namespace_common *ndns,
         }
 
         if (unlikely(is_bad_pmem(&nsio->bb, sector, sz_align))) {
-                if (IS_ALIGNED(offset, 512) && IS_ALIGNED(size, 512)) {
+                /*
+                 * FIXME: nsio_rw_bytes() may be called from atomic
+                 * context in the btt case and nvdimm_clear_poison()
+                 * takes a sleeping lock. Until the locking can be
+                 * reworked this capability requires that the namespace
+                 * is not claimed by btt.
+                 */
+                if (IS_ALIGNED(offset, 512) && IS_ALIGNED(size, 512)
+                                && (!ndns->claim || !is_nd_btt(ndns->claim))) {
                         long cleared;
 
                         cleared = nvdimm_clear_poison(&ndns->dev, offset, size);
diff --git a/drivers/nvdimm/dimm_devs.c b/drivers/nvdimm/dimm_devs.c
index 0eedc49e0d47..8b721321be5b 100644
--- a/drivers/nvdimm/dimm_devs.c
+++ b/drivers/nvdimm/dimm_devs.c
@@ -395,7 +395,7 @@ EXPORT_SYMBOL_GPL(nvdimm_create);
 
 int alias_dpa_busy(struct device *dev, void *data)
 {
-        resource_size_t map_end, blk_start, new, busy;
+        resource_size_t map_end, blk_start, new;
         struct blk_alloc_info *info = data;
         struct nd_mapping *nd_mapping;
         struct nd_region *nd_region;
@@ -436,29 +436,19 @@ int alias_dpa_busy(struct device *dev, void *data)
  retry:
         /*
          * Find the free dpa from the end of the last pmem allocation to
-         * the end of the interleave-set mapping that is not already
-         * covered by a blk allocation.
+         * the end of the interleave-set mapping.
          */
-        busy = 0;
         for_each_dpa_resource(ndd, res) {
+                if (strncmp(res->name, "pmem", 4) != 0)
+                        continue;
                 if ((res->start >= blk_start && res->start < map_end)
                                 || (res->end >= blk_start
                                         && res->end <= map_end)) {
-                        if (strncmp(res->name, "pmem", 4) == 0) {
-                                new = max(blk_start, min(map_end + 1,
-                                                        res->end + 1));
-                                if (new != blk_start) {
-                                        blk_start = new;
-                                        goto retry;
-                                }
-                        } else
-                                busy += min(map_end, res->end)
-                                        - max(nd_mapping->start, res->start) + 1;
-                } else if (nd_mapping->start > res->start
-                                && map_end < res->end) {
-                        /* total eclipse of the PMEM region mapping */
-                        busy += nd_mapping->size;
-                        break;
+                        new = max(blk_start, min(map_end + 1, res->end + 1));
+                        if (new != blk_start) {
+                                blk_start = new;
+                                goto retry;
+                        }
                 }
         }
 
@@ -470,52 +460,11 @@ int alias_dpa_busy(struct device *dev, void *data)
                 return 1;
         }
 
-        info->available -= blk_start - nd_mapping->start + busy;
+        info->available -= blk_start - nd_mapping->start;
 
         return 0;
 }
 
-static int blk_dpa_busy(struct device *dev, void *data)
-{
-        struct blk_alloc_info *info = data;
-        struct nd_mapping *nd_mapping;
-        struct nd_region *nd_region;
-        resource_size_t map_end;
-        int i;
-
-        if (!is_nd_pmem(dev))
-                return 0;
-
-        nd_region = to_nd_region(dev);
-        for (i = 0; i < nd_region->ndr_mappings; i++) {
-                nd_mapping  = &nd_region->mapping[i];
-                if (nd_mapping->nvdimm == info->nd_mapping->nvdimm)
-                        break;
-        }
-
-        if (i >= nd_region->ndr_mappings)
-                return 0;
-
-        map_end = nd_mapping->start + nd_mapping->size - 1;
-        if (info->res->start >= nd_mapping->start
-                        && info->res->start < map_end) {
-                if (info->res->end <= map_end) {
-                        info->busy = 0;
-                        return 1;
-                } else {
-                        info->busy -= info->res->end - map_end;
-                        return 0;
-                }
-        } else if (info->res->end >= nd_mapping->start
-                        && info->res->end <= map_end) {
-                info->busy -= nd_mapping->start - info->res->start;
-                return 0;
-        } else {
-                info->busy -= nd_mapping->size;
-                return 0;
-        }
-}
-
 /**
  * nd_blk_available_dpa - account the unused dpa of BLK region
  * @nd_mapping: container of dpa-resource-root + labels
@@ -545,11 +494,7 @@ resource_size_t nd_blk_available_dpa(struct nd_region *nd_region)
         for_each_dpa_resource(ndd, res) {
                 if (strncmp(res->name, "blk", 3) != 0)
                         continue;
-
-                info.res = res;
-                info.busy = resource_size(res);
-                device_for_each_child(&nvdimm_bus->dev, &info, blk_dpa_busy);
-                info.available -= info.busy;
+                info.available -= resource_size(res);
         }
 
         return info.available;
diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
index 9690beb15e69..d996ca73d3be 100644
--- a/drivers/nvme/host/fc.c
+++ b/drivers/nvme/host/fc.c
@@ -2023,7 +2023,7 @@ nvme_fc_configure_admin_queue(struct nvme_fc_ctrl *ctrl)
         }
 
         ctrl->ctrl.sqsize =
-                min_t(int, NVME_CAP_MQES(ctrl->cap) + 1, ctrl->ctrl.sqsize);
+                min_t(int, NVME_CAP_MQES(ctrl->cap), ctrl->ctrl.sqsize);
 
         error = nvme_enable_ctrl(&ctrl->ctrl, ctrl->cap);
         if (error)
diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
index 47a479f26e5d..16f84eb0b95e 100644
--- a/drivers/nvme/host/rdma.c
+++ b/drivers/nvme/host/rdma.c
@@ -1606,7 +1606,7 @@ static int nvme_rdma_configure_admin_queue(struct nvme_rdma_ctrl *ctrl)
         }
 
         ctrl->ctrl.sqsize =
-                min_t(int, NVME_CAP_MQES(ctrl->cap) + 1, ctrl->ctrl.sqsize);
+                min_t(int, NVME_CAP_MQES(ctrl->cap), ctrl->ctrl.sqsize);
 
         error = nvme_enable_ctrl(&ctrl->ctrl, ctrl->cap);
         if (error)
diff --git a/drivers/nvme/target/loop.c b/drivers/nvme/target/loop.c
index 22f7bc6bac7f..c7b0b6a52708 100644
--- a/drivers/nvme/target/loop.c
+++ b/drivers/nvme/target/loop.c
@@ -392,7 +392,7 @@ static int nvme_loop_configure_admin_queue(struct nvme_loop_ctrl *ctrl)
         }
 
         ctrl->ctrl.sqsize =
-                min_t(int, NVME_CAP_MQES(ctrl->cap) + 1, ctrl->ctrl.sqsize);
+                min_t(int, NVME_CAP_MQES(ctrl->cap), ctrl->ctrl.sqsize);
 
         error = nvme_enable_ctrl(&ctrl->ctrl, ctrl->cap);
         if (error)
diff --git a/drivers/pinctrl/intel/pinctrl-cherryview.c b/drivers/pinctrl/intel/pinctrl-cherryview.c
index f80134e3e0b6..9ff790174906 100644
--- a/drivers/pinctrl/intel/pinctrl-cherryview.c
+++ b/drivers/pinctrl/intel/pinctrl-cherryview.c
@@ -13,6 +13,7 @@
  * published by the Free Software Foundation.
  */
 
+#include <linux/dmi.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/init.h>
@@ -1524,10 +1525,31 @@ static void chv_gpio_irq_handler(struct irq_desc *desc)
         chained_irq_exit(chip, desc);
 }
 
+/*
+ * Certain machines seem to hardcode Linux IRQ numbers in their ACPI
+ * tables. Since we leave GPIOs that are not capable of generating
+ * interrupts out of the irqdomain the numbering will be different and
+ * cause devices using the hardcoded IRQ numbers fail. In order not to
+ * break such machines we will only mask pins from irqdomain if the machine
+ * is not listed below.
+ */
+static const struct dmi_system_id chv_no_valid_mask[] = {
+        {
+                /* See https://bugzilla.kernel.org/show_bug.cgi?id=194945 */
+                .ident = "Acer Chromebook (CYAN)",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "GOOGLE"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Edgar"),
+                        DMI_MATCH(DMI_BIOS_DATE, "05/21/2016"),
+                },
+        }
+};
+
 static int chv_gpio_probe(struct chv_pinctrl *pctrl, int irq)
 {
         const struct chv_gpio_pinrange *range;
         struct gpio_chip *chip = &pctrl->chip;
+        bool need_valid_mask = !dmi_check_system(chv_no_valid_mask);
         int ret, i, offset;
 
         *chip = chv_gpio_chip;
@@ -1536,7 +1558,7 @@ static int chv_gpio_probe(struct chv_pinctrl *pctrl, int irq)
         chip->label = dev_name(pctrl->dev);
         chip->parent = pctrl->dev;
         chip->base = -1;
-        chip->irq_need_valid_mask = true;
+        chip->irq_need_valid_mask = need_valid_mask;
 
         ret = devm_gpiochip_add_data(pctrl->dev, chip, pctrl);
         if (ret) {
@@ -1567,7 +1589,7 @@ static int chv_gpio_probe(struct chv_pinctrl *pctrl, int irq)
                 intsel &= CHV_PADCTRL0_INTSEL_MASK;
                 intsel >>= CHV_PADCTRL0_INTSEL_SHIFT;
 
-                if (intsel >= pctrl->community->nirqs)
+                if (need_valid_mask && intsel >= pctrl->community->nirqs)
                         clear_bit(i, chip->irq_valid_mask);
         }
 
diff --git a/drivers/pinctrl/samsung/pinctrl-exynos.c b/drivers/pinctrl/samsung/pinctrl-exynos.c
index f9b49967f512..63e51b56a22a 100644
--- a/drivers/pinctrl/samsung/pinctrl-exynos.c
+++ b/drivers/pinctrl/samsung/pinctrl-exynos.c
@@ -1468,82 +1468,82 @@ const struct samsung_pin_ctrl exynos5420_pin_ctrl[] __initconst = {
 
 /* pin banks of exynos5433 pin-controller - ALIVE */
 static const struct samsung_pin_bank_data exynos5433_pin_banks0[] __initconst = {
-        EXYNOS_PIN_BANK_EINTW(8, 0x000, "gpa0", 0x00),
-        EXYNOS_PIN_BANK_EINTW(8, 0x020, "gpa1", 0x04),
-        EXYNOS_PIN_BANK_EINTW(8, 0x040, "gpa2", 0x08),
-        EXYNOS_PIN_BANK_EINTW(8, 0x060, "gpa3", 0x0c),
-        EXYNOS_PIN_BANK_EINTW_EXT(8, 0x020, "gpf1", 0x1004, 1),
-        EXYNOS_PIN_BANK_EINTW_EXT(4, 0x040, "gpf2", 0x1008, 1),
-        EXYNOS_PIN_BANK_EINTW_EXT(4, 0x060, "gpf3", 0x100c, 1),
-        EXYNOS_PIN_BANK_EINTW_EXT(8, 0x080, "gpf4", 0x1010, 1),
-        EXYNOS_PIN_BANK_EINTW_EXT(8, 0x0a0, "gpf5", 0x1014, 1),
+        EXYNOS5433_PIN_BANK_EINTW(8, 0x000, "gpa0", 0x00),
+        EXYNOS5433_PIN_BANK_EINTW(8, 0x020, "gpa1", 0x04),
+        EXYNOS5433_PIN_BANK_EINTW(8, 0x040, "gpa2", 0x08),
+        EXYNOS5433_PIN_BANK_EINTW(8, 0x060, "gpa3", 0x0c),
+        EXYNOS5433_PIN_BANK_EINTW_EXT(8, 0x020, "gpf1", 0x1004, 1),
+        EXYNOS5433_PIN_BANK_EINTW_EXT(4, 0x040, "gpf2", 0x1008, 1),
+        EXYNOS5433_PIN_BANK_EINTW_EXT(4, 0x060, "gpf3", 0x100c, 1),
+        EXYNOS5433_PIN_BANK_EINTW_EXT(8, 0x080, "gpf4", 0x1010, 1),
+        EXYNOS5433_PIN_BANK_EINTW_EXT(8, 0x0a0, "gpf5", 0x1014, 1),
 };
 
 /* pin banks of exynos5433 pin-controller - AUD */
 static const struct samsung_pin_bank_data exynos5433_pin_banks1[] __initconst = {
-        EXYNOS_PIN_BANK_EINTG(7, 0x000, "gpz0", 0x00),
-        EXYNOS_PIN_BANK_EINTG(4, 0x020, "gpz1", 0x04),
+        EXYNOS5433_PIN_BANK_EINTG(7, 0x000, "gpz0", 0x00),
+        EXYNOS5433_PIN_BANK_EINTG(4, 0x020, "gpz1", 0x04),
 };
 
 /* pin banks of exynos5433 pin-controller - CPIF */
 static const struct samsung_pin_bank_data exynos5433_pin_banks2[] __initconst = {
-        EXYNOS_PIN_BANK_EINTG(2, 0x000, "gpv6", 0x00),
+        EXYNOS5433_PIN_BANK_EINTG(2, 0x000, "gpv6", 0x00),
 };
 
 /* pin banks of exynos5433 pin-controller - eSE */
 static const struct samsung_pin_bank_data exynos5433_pin_banks3[] __initconst = {
-        EXYNOS_PIN_BANK_EINTG(3, 0x000, "gpj2", 0x00),
+        EXYNOS5433_PIN_BANK_EINTG(3, 0x000, "gpj2", 0x00),
 };
 
 /* pin banks of exynos5433 pin-controller - FINGER */
 static const struct samsung_pin_bank_data exynos5433_pin_banks4[] __initconst = {
-        EXYNOS_PIN_BANK_EINTG(4, 0x000, "gpd5", 0x00),
+        EXYNOS5433_PIN_BANK_EINTG(4, 0x000, "gpd5", 0x00),
 };
 
 /* pin banks of exynos5433 pin-controller - FSYS */
 static const struct samsung_pin_bank_data exynos5433_pin_banks5[] __initconst = {
-        EXYNOS_PIN_BANK_EINTG(6, 0x000, "gph1", 0x00),
-        EXYNOS_PIN_BANK_EINTG(7, 0x020, "gpr4", 0x04),
-        EXYNOS_PIN_BANK_EINTG(5, 0x040, "gpr0", 0x08),
-        EXYNOS_PIN_BANK_EINTG(8, 0x060, "gpr1", 0x0c),
-        EXYNOS_PIN_BANK_EINTG(2, 0x080, "gpr2", 0x10),
-        EXYNOS_PIN_BANK_EINTG(8, 0x0a0, "gpr3", 0x14),
+        EXYNOS5433_PIN_BANK_EINTG(6, 0x000, "gph1", 0x00),
+        EXYNOS5433_PIN_BANK_EINTG(7, 0x020, "gpr4", 0x04),
+        EXYNOS5433_PIN_BANK_EINTG(5, 0x040, "gpr0", 0x08),
+        EXYNOS5433_PIN_BANK_EINTG(8, 0x060, "gpr1", 0x0c),
+        EXYNOS5433_PIN_BANK_EINTG(2, 0x080, "gpr2", 0x10),
+        EXYNOS5433_PIN_BANK_EINTG(8, 0x0a0, "gpr3", 0x14),
 };
 
 /* pin banks of exynos5433 pin-controller - IMEM */
 static const struct samsung_pin_bank_data exynos5433_pin_banks6[] __initconst = {
-        EXYNOS_PIN_BANK_EINTG(8, 0x000, "gpf0", 0x00),
+        EXYNOS5433_PIN_BANK_EINTG(8, 0x000, "gpf0", 0x00),
 };
 
 /* pin banks of exynos5433 pin-controller - NFC */
 static const struct samsung_pin_bank_data exynos5433_pin_banks7[] __initconst = {
-        EXYNOS_PIN_BANK_EINTG(3, 0x000, "gpj0", 0x00),
+        EXYNOS5433_PIN_BANK_EINTG(3, 0x000, "gpj0", 0x00),
 };
 
 /* pin banks of exynos5433 pin-controller - PERIC */
 static const struct samsung_pin_bank_data exynos5433_pin_banks8[] __initconst = {
-        EXYNOS_PIN_BANK_EINTG(6, 0x000, "gpv7", 0x00),
-        EXYNOS_PIN_BANK_EINTG(5, 0x020, "gpb0", 0x04),
-        EXYNOS_PIN_BANK_EINTG(8, 0x040, "gpc0", 0x08),
-        EXYNOS_PIN_BANK_EINTG(2, 0x060, "gpc1", 0x0c),
-        EXYNOS_PIN_BANK_EINTG(6, 0x080, "gpc2", 0x10),
-        EXYNOS_PIN_BANK_EINTG(8, 0x0a0, "gpc3", 0x14),
-        EXYNOS_PIN_BANK_EINTG(2, 0x0c0, "gpg0", 0x18),
-        EXYNOS_PIN_BANK_EINTG(4, 0x0e0, "gpd0", 0x1c),
-        EXYNOS_PIN_BANK_EINTG(6, 0x100, "gpd1", 0x20),
-        EXYNOS_PIN_BANK_EINTG(8, 0x120, "gpd2", 0x24),
-        EXYNOS_PIN_BANK_EINTG(5, 0x140, "gpd4", 0x28),
-        EXYNOS_PIN_BANK_EINTG(2, 0x160, "gpd8", 0x2c),
-        EXYNOS_PIN_BANK_EINTG(7, 0x180, "gpd6", 0x30),
-        EXYNOS_PIN_BANK_EINTG(3, 0x1a0, "gpd7", 0x34),
-        EXYNOS_PIN_BANK_EINTG(5, 0x1c0, "gpg1", 0x38),
-        EXYNOS_PIN_BANK_EINTG(2, 0x1e0, "gpg2", 0x3c),
-        EXYNOS_PIN_BANK_EINTG(8, 0x200, "gpg3", 0x40),
+        EXYNOS5433_PIN_BANK_EINTG(6, 0x000, "gpv7", 0x00),
+        EXYNOS5433_PIN_BANK_EINTG(5, 0x020, "gpb0", 0x04),
+        EXYNOS5433_PIN_BANK_EINTG(8, 0x040, "gpc0", 0x08),
+        EXYNOS5433_PIN_BANK_EINTG(2, 0x060, "gpc1", 0x0c),
+        EXYNOS5433_PIN_BANK_EINTG(6, 0x080, "gpc2", 0x10),
+        EXYNOS5433_PIN_BANK_EINTG(8, 0x0a0, "gpc3", 0x14),
+        EXYNOS5433_PIN_BANK_EINTG(2, 0x0c0, "gpg0", 0x18),
+        EXYNOS5433_PIN_BANK_EINTG(4, 0x0e0, "gpd0", 0x1c),
+        EXYNOS5433_PIN_BANK_EINTG(6, 0x100, "gpd1", 0x20),
+        EXYNOS5433_PIN_BANK_EINTG(8, 0x120, "gpd2", 0x24),
+        EXYNOS5433_PIN_BANK_EINTG(5, 0x140, "gpd4", 0x28),
+        EXYNOS5433_PIN_BANK_EINTG(2, 0x160, "gpd8", 0x2c),
+        EXYNOS5433_PIN_BANK_EINTG(7, 0x180, "gpd6", 0x30),
+        EXYNOS5433_PIN_BANK_EINTG(3, 0x1a0, "gpd7", 0x34),
+        EXYNOS5433_PIN_BANK_EINTG(5, 0x1c0, "gpg1", 0x38),
+        EXYNOS5433_PIN_BANK_EINTG(2, 0x1e0, "gpg2", 0x3c),
+        EXYNOS5433_PIN_BANK_EINTG(8, 0x200, "gpg3", 0x40),
 };
 
 /* pin banks of exynos5433 pin-controller - TOUCH */
 static const struct samsung_pin_bank_data exynos5433_pin_banks9[] __initconst = {
-        EXYNOS_PIN_BANK_EINTG(3, 0x000, "gpj1", 0x00),
+        EXYNOS5433_PIN_BANK_EINTG(3, 0x000, "gpj1", 0x00),
 };
 
 /*
diff --git a/drivers/pinctrl/samsung/pinctrl-exynos.h b/drivers/pinctrl/samsung/pinctrl-exynos.h
index a473092fb8d2..cd046eb7d705 100644
--- a/drivers/pinctrl/samsung/pinctrl-exynos.h
+++ b/drivers/pinctrl/samsung/pinctrl-exynos.h
@@ -79,17 +79,6 @@
                 .name           = id                    \
         }
 
-#define EXYNOS_PIN_BANK_EINTW_EXT(pins, reg, id, offs, pctl_idx) \
-        {                                               \
-                .type           = &bank_type_alive,     \
-                .pctl_offset    = reg,                  \
-                .nr_pins        = pins,                 \
-                .eint_type      = EINT_TYPE_WKUP,       \
-                .eint_offset    = offs,                 \
-                .name           = id,                   \
-                .pctl_res_idx   = pctl_idx,             \
-        }                                               \
-
 #define EXYNOS5433_PIN_BANK_EINTG(pins, reg, id, offs)          \
         {                                                       \
                 .type           = &exynos5433_bank_type_off,    \
diff --git a/drivers/pwm/pwm-lpss-pci.c b/drivers/pwm/pwm-lpss-pci.c
index 053088b9b66e..c1527cb645be 100644
--- a/drivers/pwm/pwm-lpss-pci.c
+++ b/drivers/pwm/pwm-lpss-pci.c
@@ -36,6 +36,14 @@ static const struct pwm_lpss_boardinfo pwm_lpss_bxt_info = {
         .clk_rate = 19200000,
         .npwm = 4,
         .base_unit_bits = 22,
+        .bypass = true,
+};
+
+/* Tangier */
+static const struct pwm_lpss_boardinfo pwm_lpss_tng_info = {
+        .clk_rate = 19200000,
+        .npwm = 4,
+        .base_unit_bits = 22,
 };
 
 static int pwm_lpss_probe_pci(struct pci_dev *pdev,
@@ -97,7 +105,7 @@ static const struct pci_device_id pwm_lpss_pci_ids[] = {
         { PCI_VDEVICE(INTEL, 0x0ac8), (unsigned long)&pwm_lpss_bxt_info},
         { PCI_VDEVICE(INTEL, 0x0f08), (unsigned long)&pwm_lpss_byt_info},
         { PCI_VDEVICE(INTEL, 0x0f09), (unsigned long)&pwm_lpss_byt_info},
-        { PCI_VDEVICE(INTEL, 0x11a5), (unsigned long)&pwm_lpss_bxt_info},
+        { PCI_VDEVICE(INTEL, 0x11a5), (unsigned long)&pwm_lpss_tng_info},
         { PCI_VDEVICE(INTEL, 0x1ac8), (unsigned long)&pwm_lpss_bxt_info},
         { PCI_VDEVICE(INTEL, 0x2288), (unsigned long)&pwm_lpss_bsw_info},
         { PCI_VDEVICE(INTEL, 0x2289), (unsigned long)&pwm_lpss_bsw_info},
diff --git a/drivers/pwm/pwm-lpss-platform.c b/drivers/pwm/pwm-lpss-platform.c
index b22b6fdadb9a..5d6ed1507d29 100644
--- a/drivers/pwm/pwm-lpss-platform.c
+++ b/drivers/pwm/pwm-lpss-platform.c
@@ -37,6 +37,7 @@ static const struct pwm_lpss_boardinfo pwm_lpss_bxt_info = {
         .clk_rate = 19200000,
         .npwm = 4,
         .base_unit_bits = 22,
+        .bypass = true,
 };
 
 static int pwm_lpss_probe_platform(struct platform_device *pdev)
diff --git a/drivers/pwm/pwm-lpss.c b/drivers/pwm/pwm-lpss.c
index 689d2c1cbead..8db0d40ccacd 100644
--- a/drivers/pwm/pwm-lpss.c
+++ b/drivers/pwm/pwm-lpss.c
@@ -57,7 +57,7 @@ static inline void pwm_lpss_write(const struct pwm_device *pwm, u32 value)
         writel(value, lpwm->regs + pwm->hwpwm * PWM_SIZE + PWM);
 }
 
-static int pwm_lpss_update(struct pwm_device *pwm)
+static int pwm_lpss_wait_for_update(struct pwm_device *pwm)
 {
         struct pwm_lpss_chip *lpwm = to_lpwm(pwm->chip);
         const void __iomem *addr = lpwm->regs + pwm->hwpwm * PWM_SIZE + PWM;
@@ -65,8 +65,6 @@ static int pwm_lpss_update(struct pwm_device *pwm)
         u32 val;
         int err;
 
-        pwm_lpss_write(pwm, pwm_lpss_read(pwm) | PWM_SW_UPDATE);
-
         /*
          * PWM Configuration register has SW_UPDATE bit that is set when a new
          * configuration is written to the register. The bit is automatically
@@ -122,6 +120,12 @@ static void pwm_lpss_prepare(struct pwm_lpss_chip *lpwm, struct pwm_device *pwm,
         pwm_lpss_write(pwm, ctrl);
 }
 
+static inline void pwm_lpss_cond_enable(struct pwm_device *pwm, bool cond)
+{
+        if (cond)
+                pwm_lpss_write(pwm, pwm_lpss_read(pwm) | PWM_ENABLE);
+}
+
 static int pwm_lpss_apply(struct pwm_chip *chip, struct pwm_device *pwm,
                           struct pwm_state *state)
 {
@@ -137,18 +141,21 @@ static int pwm_lpss_apply(struct pwm_chip *chip, struct pwm_device *pwm,
                                 return ret;
                         }
                         pwm_lpss_prepare(lpwm, pwm, state->duty_cycle, state->period);
-                        ret = pwm_lpss_update(pwm);
+                        pwm_lpss_write(pwm, pwm_lpss_read(pwm) | PWM_SW_UPDATE);
+                        pwm_lpss_cond_enable(pwm, lpwm->info->bypass == false);
+                        ret = pwm_lpss_wait_for_update(pwm);
                         if (ret) {
                                 pm_runtime_put(chip->dev);
                                 return ret;
                         }
-                        pwm_lpss_write(pwm, pwm_lpss_read(pwm) | PWM_ENABLE);
+                        pwm_lpss_cond_enable(pwm, lpwm->info->bypass == true);
                 } else {
                         ret = pwm_lpss_is_updating(pwm);
                         if (ret)
                                 return ret;
                         pwm_lpss_prepare(lpwm, pwm, state->duty_cycle, state->period);
-                        return pwm_lpss_update(pwm);
+                        pwm_lpss_write(pwm, pwm_lpss_read(pwm) | PWM_SW_UPDATE);
+                        return pwm_lpss_wait_for_update(pwm);
                 }
         } else if (pwm_is_enabled(pwm)) {
                 pwm_lpss_write(pwm, pwm_lpss_read(pwm) & ~PWM_ENABLE);
diff --git a/drivers/pwm/pwm-lpss.h b/drivers/pwm/pwm-lpss.h
index c94cd7c2695d..98306bb02cfe 100644
--- a/drivers/pwm/pwm-lpss.h
+++ b/drivers/pwm/pwm-lpss.h
@@ -22,6 +22,7 @@ struct pwm_lpss_boardinfo {
         unsigned long clk_rate;
         unsigned int npwm;
         unsigned long base_unit_bits;
+        bool bypass;
 };
 
 struct pwm_lpss_chip *pwm_lpss_probe(struct device *dev, struct resource *r,
diff --git a/drivers/pwm/pwm-rockchip.c b/drivers/pwm/pwm-rockchip.c
index ef89df1f7336..744d56197286 100644
--- a/drivers/pwm/pwm-rockchip.c
+++ b/drivers/pwm/pwm-rockchip.c
@@ -191,6 +191,28 @@ static int rockchip_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
         return 0;
 }
 
+static int rockchip_pwm_enable(struct pwm_chip *chip,
+                         struct pwm_device *pwm,
+                         bool enable,
+                         enum pwm_polarity polarity)
+{
+        struct rockchip_pwm_chip *pc = to_rockchip_pwm_chip(chip);
+        int ret;
+
+        if (enable) {
+                ret = clk_enable(pc->clk);
+                if (ret)
+                        return ret;
+        }
+
+        pc->data->set_enable(chip, pwm, enable, polarity);
+
+        if (!enable)
+                clk_disable(pc->clk);
+
+        return 0;
+}
+
 static int rockchip_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm,
                               struct pwm_state *state)
 {
@@ -207,22 +229,26 @@ static int rockchip_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm,
                 return ret;
 
         if (state->polarity != curstate.polarity && enabled) {
-                pc->data->set_enable(chip, pwm, false, state->polarity);
+                ret = rockchip_pwm_enable(chip, pwm, false, state->polarity);
+                if (ret)
+                        goto out;
                 enabled = false;
         }
 
         ret = rockchip_pwm_config(chip, pwm, state->duty_cycle, state->period);
         if (ret) {
                 if (enabled != curstate.enabled)
-                        pc->data->set_enable(chip, pwm, !enabled,
-                                             state->polarity);
-
+                        rockchip_pwm_enable(chip, pwm, !enabled,
+                                      state->polarity);
                 goto out;
         }
 
-        if (state->enabled != enabled)
-                pc->data->set_enable(chip, pwm, state->enabled,
-                                     state->polarity);
+        if (state->enabled != enabled) {
+                ret = rockchip_pwm_enable(chip, pwm, state->enabled,
+                                    state->polarity);
+                if (ret)
+                        goto out;
+        }
 
         /*
          * Update the state with the real hardware, which can differ a bit
diff --git a/drivers/reset/core.c b/drivers/reset/core.c
index f1e5e65388bb..cd739d2fa160 100644
--- a/drivers/reset/core.c
+++ b/drivers/reset/core.c
@@ -275,7 +275,7 @@ int reset_control_status(struct reset_control *rstc)
 }
 EXPORT_SYMBOL_GPL(reset_control_status);
 
-static struct reset_control *__reset_control_get(
+static struct reset_control *__reset_control_get_internal(
                                 struct reset_controller_dev *rcdev,
                                 unsigned int index, bool shared)
 {
@@ -308,7 +308,7 @@ static struct reset_control *__reset_control_get(
         return rstc;
 }
 
-static void __reset_control_put(struct reset_control *rstc)
+static void __reset_control_put_internal(struct reset_control *rstc)
 {
         lockdep_assert_held(&reset_list_mutex);
 
@@ -377,7 +377,7 @@ struct reset_control *__of_reset_control_get(struct device_node *node,
         }
 
         /* reset_list_mutex also protects the rcdev's reset_control list */
-        rstc = __reset_control_get(rcdev, rstc_id, shared);
+        rstc = __reset_control_get_internal(rcdev, rstc_id, shared);
 
         mutex_unlock(&reset_list_mutex);
 
@@ -385,6 +385,17 @@ struct reset_control *__of_reset_control_get(struct device_node *node,
 }
 EXPORT_SYMBOL_GPL(__of_reset_control_get);
 
+struct reset_control *__reset_control_get(struct device *dev, const char *id,
+                                          int index, bool shared, bool optional)
+{
+        if (dev->of_node)
+                return __of_reset_control_get(dev->of_node, id, index, shared,
+                                              optional);
+
+        return optional ? NULL : ERR_PTR(-EINVAL);
+}
+EXPORT_SYMBOL_GPL(__reset_control_get);
+
 /**
  * reset_control_put - free the reset controller
  * @rstc: reset controller
@@ -396,7 +407,7 @@ void reset_control_put(struct reset_control *rstc)
                 return;
 
         mutex_lock(&reset_list_mutex);
-        __reset_control_put(rstc);
+        __reset_control_put_internal(rstc);
         mutex_unlock(&reset_list_mutex);
 }
 EXPORT_SYMBOL_GPL(reset_control_put);
@@ -417,8 +428,7 @@ struct reset_control *__devm_reset_control_get(struct device *dev,
         if (!ptr)
                 return ERR_PTR(-ENOMEM);
 
-        rstc = __of_reset_control_get(dev ? dev->of_node : NULL,
-                                      id, index, shared, optional);
+        rstc = __reset_control_get(dev, id, index, shared, optional);
         if (!IS_ERR(rstc)) {
                 *ptr = rstc;
                 devres_add(dev, ptr);
diff --git a/drivers/scsi/aacraid/aacraid.h b/drivers/scsi/aacraid/aacraid.h
index d036a806f31c..d281492009fb 100644
--- a/drivers/scsi/aacraid/aacraid.h
+++ b/drivers/scsi/aacraid/aacraid.h
@@ -1690,9 +1690,6 @@ struct aac_dev
 #define aac_adapter_sync_cmd(dev, command, p1, p2, p3, p4, p5, p6, status, r1, r2, r3, r4) \
         (dev)->a_ops.adapter_sync_cmd(dev, command, p1, p2, p3, p4, p5, p6, status, r1, r2, r3, r4)
 
-#define aac_adapter_check_health(dev) \
-        (dev)->a_ops.adapter_check_health(dev)
-
 #define aac_adapter_restart(dev, bled, reset_type) \
         ((dev)->a_ops.adapter_restart(dev, bled, reset_type))
 
@@ -2615,6 +2612,14 @@ static inline unsigned int cap_to_cyls(sector_t capacity, unsigned divisor)
         return capacity;
 }
 
+static inline int aac_adapter_check_health(struct aac_dev *dev)
+{
+        if (unlikely(pci_channel_offline(dev->pdev)))
+                return -1;
+
+        return (dev)->a_ops.adapter_check_health(dev);
+}
+
 /* SCp.phase values */
 #define AAC_OWNER_MIDLEVEL      0x101
 #define AAC_OWNER_LOWLEVEL      0x102
diff --git a/drivers/scsi/aacraid/commsup.c b/drivers/scsi/aacraid/commsup.c
index c8172f16cf33..1f4918355fdb 100644
--- a/drivers/scsi/aacraid/commsup.c
+++ b/drivers/scsi/aacraid/commsup.c
@@ -1873,7 +1873,8 @@ int aac_check_health(struct aac_dev * aac)
         spin_unlock_irqrestore(&aac->fib_lock, flagv);
 
         if (BlinkLED < 0) {
-                printk(KERN_ERR "%s: Host adapter dead %d\n", aac->name, BlinkLED);
+                printk(KERN_ERR "%s: Host adapter is dead (or got a PCI error) %d\n",
+                                aac->name, BlinkLED);
                 goto out;
         }
 
diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c
index b29afafc2885..5d5e272fd815 100644
--- a/drivers/scsi/ipr.c
+++ b/drivers/scsi/ipr.c
@@ -6293,7 +6293,12 @@ static void ipr_erp_start(struct ipr_ioa_cfg *ioa_cfg,
                 break;
         case IPR_IOASC_MED_DO_NOT_REALLOC: /* prevent retries */
         case IPR_IOASA_IR_DUAL_IOA_DISABLED:
-                scsi_cmd->result |= (DID_PASSTHROUGH << 16);
+                /*
+                 * exception: do not set DID_PASSTHROUGH on CHECK CONDITION
+                 * so SCSI mid-layer and upper layers handle it accordingly.
+                 */
+                if (scsi_cmd->result != SAM_STAT_CHECK_CONDITION)
+                        scsi_cmd->result |= (DID_PASSTHROUGH << 16);
                 break;
         case IPR_IOASC_BUS_WAS_RESET:
         case IPR_IOASC_BUS_WAS_RESET_BY_OTHER:
diff --git a/drivers/scsi/qedf/qedf_fip.c b/drivers/scsi/qedf/qedf_fip.c
index ed58b9104f58..e10b91cc3c62 100644
--- a/drivers/scsi/qedf/qedf_fip.c
+++ b/drivers/scsi/qedf/qedf_fip.c
@@ -99,7 +99,8 @@ static void qedf_fcoe_process_vlan_resp(struct qedf_ctx *qedf,
                 qedf_set_vlan_id(qedf, vid);
 
                 /* Inform waiter that it's ok to call fcoe_ctlr_link up() */
-                complete(&qedf->fipvlan_compl);
+                if (!completion_done(&qedf->fipvlan_compl))
+                        complete(&qedf->fipvlan_compl);
         }
 }
 
diff --git a/drivers/scsi/qedf/qedf_main.c b/drivers/scsi/qedf/qedf_main.c
index 8e2a160490e6..cceddd995a4b 100644
--- a/drivers/scsi/qedf/qedf_main.c
+++ b/drivers/scsi/qedf/qedf_main.c
@@ -2803,6 +2803,7 @@ static int __qedf_probe(struct pci_dev *pdev, int mode)
                 atomic_set(&qedf->num_offloads, 0);
                 qedf->stop_io_on_error = false;
                 pci_set_drvdata(pdev, qedf);
+                init_completion(&qedf->fipvlan_compl);
 
                 QEDF_INFO(&(qedf->dbg_ctx), QEDF_LOG_INFO,
                    "QLogic FastLinQ FCoE Module qedf %s, "
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index 3e7011757c82..83d61d2142e9 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -1160,8 +1160,13 @@ static inline
 uint32_t qla2x00_isp_reg_stat(struct qla_hw_data *ha)
 {
         struct device_reg_24xx __iomem *reg = &ha->iobase->isp24;
+        struct device_reg_82xx __iomem *reg82 = &ha->iobase->isp82;
 
-        return ((RD_REG_DWORD(&reg->host_status)) == ISP_REG_DISCONNECT);
+        if (IS_P3P_TYPE(ha))
+                return ((RD_REG_DWORD(&reg82->host_int)) == ISP_REG_DISCONNECT);
+        else
+                return ((RD_REG_DWORD(&reg->host_status)) ==
+                        ISP_REG_DISCONNECT);
 }
 
 /**************************************************************************
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index fcfeddc79331..35ad5e8a31ab 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -2102,6 +2102,22 @@ static void read_capacity_error(struct scsi_disk *sdkp, struct scsi_device *sdp,
 
 #define READ_CAPACITY_RETRIES_ON_RESET  10
 
+/*
+ * Ensure that we don't overflow sector_t when CONFIG_LBDAF is not set
+ * and the reported logical block size is bigger than 512 bytes. Note
+ * that last_sector is a u64 and therefore logical_to_sectors() is not
+ * applicable.
+ */
+static bool sd_addressable_capacity(u64 lba, unsigned int sector_size)
+{
+        u64 last_sector = (lba + 1ULL) << (ilog2(sector_size) - 9);
+
+        if (sizeof(sector_t) == 4 && last_sector > U32_MAX)
+                return false;
+
+        return true;
+}
+
 static int read_capacity_16(struct scsi_disk *sdkp, struct scsi_device *sdp,
                                                 unsigned char *buffer)
 {
@@ -2167,7 +2183,7 @@ static int read_capacity_16(struct scsi_disk *sdkp, struct scsi_device *sdp,
                 return -ENODEV;
         }
 
-        if ((sizeof(sdkp->capacity) == 4) && (lba >= 0xffffffffULL)) {
+        if (!sd_addressable_capacity(lba, sector_size)) {
                 sd_printk(KERN_ERR, sdkp, "Too big for this kernel. Use a "
                         "kernel compiled with support for large block "
                         "devices.\n");
@@ -2256,7 +2272,7 @@ static int read_capacity_10(struct scsi_disk *sdkp, struct scsi_device *sdp,
                 return sector_size;
         }
 
-        if ((sizeof(sdkp->capacity) == 4) && (lba == 0xffffffff)) {
+        if (!sd_addressable_capacity(lba, sector_size)) {
                 sd_printk(KERN_ERR, sdkp, "Too big for this kernel. Use a "
                         "kernel compiled with support for large block "
                         "devices.\n");
@@ -2956,7 +2972,8 @@ static int sd_revalidate_disk(struct gendisk *disk)
                 q->limits.io_opt = logical_to_bytes(sdp, sdkp->opt_xfer_blocks);
                 rw_max = logical_to_sectors(sdp, sdkp->opt_xfer_blocks);
         } else
-                rw_max = BLK_DEF_MAX_SECTORS;
+                rw_max = min_not_zero(logical_to_sectors(sdp, dev_max),
+                                      (sector_t)BLK_DEF_MAX_SECTORS);
 
         /* Combine with controller limits */
         q->limits.max_sectors = min(rw_max, queue_max_hw_sectors(q));
diff --git a/drivers/scsi/sr.c b/drivers/scsi/sr.c
index 0b29b9329b1c..a8f630213a1a 100644
--- a/drivers/scsi/sr.c
+++ b/drivers/scsi/sr.c
@@ -836,6 +836,7 @@ static void get_capabilities(struct scsi_cd *cd)
         unsigned char *buffer;
         struct scsi_mode_data data;
         struct scsi_sense_hdr sshdr;
+        unsigned int ms_len = 128;
         int rc, n;
 
         static const char *loadmech[] =
@@ -862,10 +863,11 @@ static void get_capabilities(struct scsi_cd *cd)
         scsi_test_unit_ready(cd->device, SR_TIMEOUT, MAX_RETRIES, &sshdr);
 
         /* ask for mode page 0x2a */
-        rc = scsi_mode_sense(cd->device, 0, 0x2a, buffer, 128,
+        rc = scsi_mode_sense(cd->device, 0, 0x2a, buffer, ms_len,
                              SR_TIMEOUT, 3, &data, NULL);
 
-        if (!scsi_status_is_good(rc)) {
+        if (!scsi_status_is_good(rc) || data.length > ms_len ||
+            data.header_length + data.block_descriptor_length > data.length) {
                 /* failed, drive doesn't have capabilities mode page */
                 cd->cdi.speed = 1;
                 cd->cdi.mask |= (CDC_CD_R | CDC_CD_RW | CDC_DVD_R |
diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
index a91802432f2f..e3f9ed3690b7 100644
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -485,8 +485,7 @@ static void iscsit_get_rx_pdu(struct iscsi_conn *);
 
 int iscsit_queue_rsp(struct iscsi_conn *conn, struct iscsi_cmd *cmd)
 {
-        iscsit_add_cmd_to_response_queue(cmd, cmd->conn, cmd->i_state);
-        return 0;
+        return iscsit_add_cmd_to_response_queue(cmd, cmd->conn, cmd->i_state);
 }
 EXPORT_SYMBOL(iscsit_queue_rsp);
 
diff --git a/drivers/target/iscsi/iscsi_target_configfs.c b/drivers/target/iscsi/iscsi_target_configfs.c
index bf40f03755dd..344e8448869c 100644
--- a/drivers/target/iscsi/iscsi_target_configfs.c
+++ b/drivers/target/iscsi/iscsi_target_configfs.c
@@ -1398,11 +1398,10 @@ static u32 lio_sess_get_initiator_sid(
 static int lio_queue_data_in(struct se_cmd *se_cmd)
 {
         struct iscsi_cmd *cmd = container_of(se_cmd, struct iscsi_cmd, se_cmd);
+        struct iscsi_conn *conn = cmd->conn;
 
         cmd->i_state = ISTATE_SEND_DATAIN;
-        cmd->conn->conn_transport->iscsit_queue_data_in(cmd->conn, cmd);
-
-        return 0;
+        return conn->conn_transport->iscsit_queue_data_in(conn, cmd);
 }
 
 static int lio_write_pending(struct se_cmd *se_cmd)
@@ -1431,16 +1430,14 @@ static int lio_write_pending_status(struct se_cmd *se_cmd)
 static int lio_queue_status(struct se_cmd *se_cmd)
 {
         struct iscsi_cmd *cmd = container_of(se_cmd, struct iscsi_cmd, se_cmd);
+        struct iscsi_conn *conn = cmd->conn;
 
         cmd->i_state = ISTATE_SEND_STATUS;
 
         if (cmd->se_cmd.scsi_status || cmd->sense_reason) {
-                iscsit_add_cmd_to_response_queue(cmd, cmd->conn, cmd->i_state);
-                return 0;
+                return iscsit_add_cmd_to_response_queue(cmd, conn, cmd->i_state);
         }
-        cmd->conn->conn_transport->iscsit_queue_status(cmd->conn, cmd);
-
-        return 0;
+        return conn->conn_transport->iscsit_queue_status(conn, cmd);
 }
 
 static void lio_queue_tm_rsp(struct se_cmd *se_cmd)
diff --git a/drivers/target/iscsi/iscsi_target_parameters.c b/drivers/target/iscsi/iscsi_target_parameters.c
index e65bf78ceef3..fce627628200 100644
--- a/drivers/target/iscsi/iscsi_target_parameters.c
+++ b/drivers/target/iscsi/iscsi_target_parameters.c
@@ -782,22 +782,6 @@ static void iscsi_check_proposer_for_optional_reply(struct iscsi_param *param)
                 if (!strcmp(param->name, MAXRECVDATASEGMENTLENGTH))
                         SET_PSTATE_REPLY_OPTIONAL(param);
                 /*
-                 * The GlobalSAN iSCSI Initiator for MacOSX does
-                 * not respond to MaxBurstLength, FirstBurstLength,
-                 * DefaultTime2Wait or DefaultTime2Retain parameter keys.
-                 * So, we set them to 'reply optional' here, and assume the
-                 * the defaults from iscsi_parameters.h if the initiator
-                 * is not RFC compliant and the keys are not negotiated.
-                 */
-                if (!strcmp(param->name, MAXBURSTLENGTH))
-                        SET_PSTATE_REPLY_OPTIONAL(param);
-                if (!strcmp(param->name, FIRSTBURSTLENGTH))
-                        SET_PSTATE_REPLY_OPTIONAL(param);
-                if (!strcmp(param->name, DEFAULTTIME2WAIT))
-                        SET_PSTATE_REPLY_OPTIONAL(param);
-                if (!strcmp(param->name, DEFAULTTIME2RETAIN))
-                        SET_PSTATE_REPLY_OPTIONAL(param);
-                /*
                  * Required for gPXE iSCSI boot client
                  */
                 if (!strcmp(param->name, MAXCONNECTIONS))
diff --git a/drivers/target/iscsi/iscsi_target_util.c b/drivers/target/iscsi/iscsi_target_util.c
index 5041a9c8bdcb..7d3e2fcc26a0 100644
--- a/drivers/target/iscsi/iscsi_target_util.c
+++ b/drivers/target/iscsi/iscsi_target_util.c
@@ -567,7 +567,7 @@ static void iscsit_remove_cmd_from_immediate_queue(
         }
 }
 
-void iscsit_add_cmd_to_response_queue(
+int iscsit_add_cmd_to_response_queue(
         struct iscsi_cmd *cmd,
         struct iscsi_conn *conn,
         u8 state)
@@ -578,7 +578,7 @@ void iscsit_add_cmd_to_response_queue(
         if (!qr) {
                 pr_err("Unable to allocate memory for"
                         " struct iscsi_queue_req\n");
-                return;
+                return -ENOMEM;
         }
         INIT_LIST_HEAD(&qr->qr_list);
         qr->cmd = cmd;
@@ -590,6 +590,7 @@ void iscsit_add_cmd_to_response_queue(
         spin_unlock_bh(&conn->response_queue_lock);
 
         wake_up(&conn->queues_wq);
+        return 0;
 }
 
 struct iscsi_queue_req *iscsit_get_cmd_from_response_queue(struct iscsi_conn *conn)
@@ -737,21 +738,23 @@ void iscsit_free_cmd(struct iscsi_cmd *cmd, bool shutdown)
 {
         struct se_cmd *se_cmd = NULL;
         int rc;
+        bool op_scsi = false;
         /*
          * Determine if a struct se_cmd is associated with
          * this struct iscsi_cmd.
          */
         switch (cmd->iscsi_opcode) {
         case ISCSI_OP_SCSI_CMD:
-                se_cmd = &cmd->se_cmd;
-                __iscsit_free_cmd(cmd, true, shutdown);
+                op_scsi = true;
                 /*
                  * Fallthrough
                  */
         case ISCSI_OP_SCSI_TMFUNC:
-                rc = transport_generic_free_cmd(&cmd->se_cmd, shutdown);
-                if (!rc && shutdown && se_cmd && se_cmd->se_sess) {
-                        __iscsit_free_cmd(cmd, true, shutdown);
+                se_cmd = &cmd->se_cmd;
+                __iscsit_free_cmd(cmd, op_scsi, shutdown);
+                rc = transport_generic_free_cmd(se_cmd, shutdown);
+                if (!rc && shutdown && se_cmd->se_sess) {
+                        __iscsit_free_cmd(cmd, op_scsi, shutdown);
                         target_put_sess_cmd(se_cmd);
                 }
                 break;
diff --git a/drivers/target/iscsi/iscsi_target_util.h b/drivers/target/iscsi/iscsi_target_util.h
index 8ff08856516a..9e4197af8708 100644
--- a/drivers/target/iscsi/iscsi_target_util.h
+++ b/drivers/target/iscsi/iscsi_target_util.h
@@ -31,7 +31,7 @@ extern int iscsit_find_cmd_for_recovery(struct iscsi_session *, struct iscsi_cmd
                         struct iscsi_conn_recovery **, itt_t);
 extern void iscsit_add_cmd_to_immediate_queue(struct iscsi_cmd *, struct iscsi_conn *, u8);
 extern struct iscsi_queue_req *iscsit_get_cmd_from_immediate_queue(struct iscsi_conn *);
-extern void iscsit_add_cmd_to_response_queue(struct iscsi_cmd *, struct iscsi_conn *, u8);
+extern int iscsit_add_cmd_to_response_queue(struct iscsi_cmd *, struct iscsi_conn *, u8);
 extern struct iscsi_queue_req *iscsit_get_cmd_from_response_queue(struct iscsi_conn *);
 extern void iscsit_remove_cmd_from_tx_queues(struct iscsi_cmd *, struct iscsi_conn *);
 extern bool iscsit_conn_all_queues_empty(struct iscsi_conn *);
diff --git a/drivers/target/target_core_alua.c b/drivers/target/target_core_alua.c
index fd7c16a7ca6e..fc4a9c303d55 100644
--- a/drivers/target/target_core_alua.c
+++ b/drivers/target/target_core_alua.c
@@ -197,8 +197,7 @@ target_emulate_report_target_port_groups(struct se_cmd *cmd)
                 /*
                  * Set the ASYMMETRIC ACCESS State
                  */
-                buf[off++] |= (atomic_read(
-                        &tg_pt_gp->tg_pt_gp_alua_access_state) & 0xff);
+                buf[off++] |= tg_pt_gp->tg_pt_gp_alua_access_state & 0xff;
                 /*
                  * Set supported ASYMMETRIC ACCESS State bits
                  */
@@ -710,7 +709,7 @@ target_alua_state_check(struct se_cmd *cmd)
 
         spin_lock(&lun->lun_tg_pt_gp_lock);
         tg_pt_gp = lun->lun_tg_pt_gp;
-        out_alua_state = atomic_read(&tg_pt_gp->tg_pt_gp_alua_access_state);
+        out_alua_state = tg_pt_gp->tg_pt_gp_alua_access_state;
         nonop_delay_msecs = tg_pt_gp->tg_pt_gp_nonop_delay_msecs;
 
         // XXX: keeps using tg_pt_gp witout reference after unlock
@@ -911,7 +910,7 @@ static int core_alua_write_tpg_metadata(
 }
 
 /*
- * Called with tg_pt_gp->tg_pt_gp_md_mutex held
+ * Called with tg_pt_gp->tg_pt_gp_transition_mutex held
  */
 static int core_alua_update_tpg_primary_metadata(
         struct t10_alua_tg_pt_gp *tg_pt_gp)
@@ -934,7 +933,7 @@ static int core_alua_update_tpg_primary_metadata(
                         "alua_access_state=0x%02x\n"
                         "alua_access_status=0x%02x\n",
                         tg_pt_gp->tg_pt_gp_id,
-                        tg_pt_gp->tg_pt_gp_alua_pending_state,
+                        tg_pt_gp->tg_pt_gp_alua_access_state,
                         tg_pt_gp->tg_pt_gp_alua_access_status);
 
         snprintf(path, ALUA_METADATA_PATH_LEN,
@@ -1013,93 +1012,41 @@ static void core_alua_queue_state_change_ua(struct t10_alua_tg_pt_gp *tg_pt_gp)
         spin_unlock(&tg_pt_gp->tg_pt_gp_lock);
 }
 
-static void core_alua_do_transition_tg_pt_work(struct work_struct *work)
-{
-        struct t10_alua_tg_pt_gp *tg_pt_gp = container_of(work,
-                struct t10_alua_tg_pt_gp, tg_pt_gp_transition_work);
-        struct se_device *dev = tg_pt_gp->tg_pt_gp_dev;
-        bool explicit = (tg_pt_gp->tg_pt_gp_alua_access_status ==
-                         ALUA_STATUS_ALTERED_BY_EXPLICIT_STPG);
-
-        /*
-         * Update the ALUA metadata buf that has been allocated in
-         * core_alua_do_port_transition(), this metadata will be written
-         * to struct file.
-         *
-         * Note that there is the case where we do not want to update the
-         * metadata when the saved metadata is being parsed in userspace
-         * when setting the existing port access state and access status.
-         *
-         * Also note that the failure to write out the ALUA metadata to
-         * struct file does NOT affect the actual ALUA transition.
-         */
-        if (tg_pt_gp->tg_pt_gp_write_metadata) {
-                mutex_lock(&tg_pt_gp->tg_pt_gp_md_mutex);
-                core_alua_update_tpg_primary_metadata(tg_pt_gp);
-                mutex_unlock(&tg_pt_gp->tg_pt_gp_md_mutex);
-        }
-        /*
-         * Set the current primary ALUA access state to the requested new state
-         */
-        atomic_set(&tg_pt_gp->tg_pt_gp_alua_access_state,
-                   tg_pt_gp->tg_pt_gp_alua_pending_state);
-
-        pr_debug("Successful %s ALUA transition TG PT Group: %s ID: %hu"
-                " from primary access state %s to %s\n", (explicit) ? "explicit" :
-                "implicit", config_item_name(&tg_pt_gp->tg_pt_gp_group.cg_item),
-                tg_pt_gp->tg_pt_gp_id,
-                core_alua_dump_state(tg_pt_gp->tg_pt_gp_alua_previous_state),
-                core_alua_dump_state(tg_pt_gp->tg_pt_gp_alua_pending_state));
-
-        core_alua_queue_state_change_ua(tg_pt_gp);
-
-        spin_lock(&dev->t10_alua.tg_pt_gps_lock);
-        atomic_dec(&tg_pt_gp->tg_pt_gp_ref_cnt);
-        spin_unlock(&dev->t10_alua.tg_pt_gps_lock);
-
-        if (tg_pt_gp->tg_pt_gp_transition_complete)
-                complete(tg_pt_gp->tg_pt_gp_transition_complete);
-}
-
 static int core_alua_do_transition_tg_pt(
         struct t10_alua_tg_pt_gp *tg_pt_gp,
         int new_state,
         int explicit)
 {
-        struct se_device *dev = tg_pt_gp->tg_pt_gp_dev;
-        DECLARE_COMPLETION_ONSTACK(wait);
+        int prev_state;
 
+        mutex_lock(&tg_pt_gp->tg_pt_gp_transition_mutex);
         /* Nothing to be done here */
-        if (atomic_read(&tg_pt_gp->tg_pt_gp_alua_access_state) == new_state)
+        if (tg_pt_gp->tg_pt_gp_alua_access_state == new_state) {
+                mutex_unlock(&tg_pt_gp->tg_pt_gp_transition_mutex);
                 return 0;
+        }
 
-        if (explicit && new_state == ALUA_ACCESS_STATE_TRANSITION)
+        if (explicit && new_state == ALUA_ACCESS_STATE_TRANSITION) {
+                mutex_unlock(&tg_pt_gp->tg_pt_gp_transition_mutex);
                 return -EAGAIN;
-
-        /*
-         * Flush any pending transitions
-         */
-        if (!explicit)
-                flush_work(&tg_pt_gp->tg_pt_gp_transition_work);
+        }
 
         /*
          * Save the old primary ALUA access state, and set the current state
          * to ALUA_ACCESS_STATE_TRANSITION.
          */
-        atomic_set(&tg_pt_gp->tg_pt_gp_alua_access_state,
-                        ALUA_ACCESS_STATE_TRANSITION);
+        prev_state = tg_pt_gp->tg_pt_gp_alua_access_state;
+        tg_pt_gp->tg_pt_gp_alua_access_state = ALUA_ACCESS_STATE_TRANSITION;
         tg_pt_gp->tg_pt_gp_alua_access_status = (explicit) ?
                                 ALUA_STATUS_ALTERED_BY_EXPLICIT_STPG :
                                 ALUA_STATUS_ALTERED_BY_IMPLICIT_ALUA;
 
         core_alua_queue_state_change_ua(tg_pt_gp);
 
-        if (new_state == ALUA_ACCESS_STATE_TRANSITION)
+        if (new_state == ALUA_ACCESS_STATE_TRANSITION) {
+                mutex_unlock(&tg_pt_gp->tg_pt_gp_transition_mutex);
                 return 0;
-
-        tg_pt_gp->tg_pt_gp_alua_previous_state =
-                atomic_read(&tg_pt_gp->tg_pt_gp_alua_access_state);
-        tg_pt_gp->tg_pt_gp_alua_pending_state = new_state;
+        }
 
         /*
          * Check for the optional ALUA primary state transition delay
@@ -1108,19 +1055,36 @@ static int core_alua_do_transition_tg_pt(
                 msleep_interruptible(tg_pt_gp->tg_pt_gp_trans_delay_msecs);
 
         /*
-         * Take a reference for workqueue item
+         * Set the current primary ALUA access state to the requested new state
          */
-        spin_lock(&dev->t10_alua.tg_pt_gps_lock);
-        atomic_inc(&tg_pt_gp->tg_pt_gp_ref_cnt);
-        spin_unlock(&dev->t10_alua.tg_pt_gps_lock);
+        tg_pt_gp->tg_pt_gp_alua_access_state = new_state;
 
-        schedule_work(&tg_pt_gp->tg_pt_gp_transition_work);
-        if (explicit) {
-                tg_pt_gp->tg_pt_gp_transition_complete = &wait;
-                wait_for_completion(&wait);
-                tg_pt_gp->tg_pt_gp_transition_complete = NULL;
+        /*
+         * Update the ALUA metadata buf that has been allocated in
+         * core_alua_do_port_transition(), this metadata will be written
+         * to struct file.
+         *
+         * Note that there is the case where we do not want to update the
+         * metadata when the saved metadata is being parsed in userspace
+         * when setting the existing port access state and access status.
+         *
+         * Also note that the failure to write out the ALUA metadata to
+         * struct file does NOT affect the actual ALUA transition.
+         */
+        if (tg_pt_gp->tg_pt_gp_write_metadata) {
+                core_alua_update_tpg_primary_metadata(tg_pt_gp);
         }
 
+        pr_debug("Successful %s ALUA transition TG PT Group: %s ID: %hu"
+                " from primary access state %s to %s\n", (explicit) ? "explicit" :
+                "implicit", config_item_name(&tg_pt_gp->tg_pt_gp_group.cg_item),
+                tg_pt_gp->tg_pt_gp_id,
+                core_alua_dump_state(prev_state),
+                core_alua_dump_state(new_state));
+
+        core_alua_queue_state_change_ua(tg_pt_gp);
+
+        mutex_unlock(&tg_pt_gp->tg_pt_gp_transition_mutex);
         return 0;
 }
 
@@ -1685,14 +1649,12 @@ struct t10_alua_tg_pt_gp *core_alua_allocate_tg_pt_gp(struct se_device *dev,
         }
         INIT_LIST_HEAD(&tg_pt_gp->tg_pt_gp_list);
         INIT_LIST_HEAD(&tg_pt_gp->tg_pt_gp_lun_list);
-        mutex_init(&tg_pt_gp->tg_pt_gp_md_mutex);
+        mutex_init(&tg_pt_gp->tg_pt_gp_transition_mutex);
         spin_lock_init(&tg_pt_gp->tg_pt_gp_lock);
         atomic_set(&tg_pt_gp->tg_pt_gp_ref_cnt, 0);
-        INIT_WORK(&tg_pt_gp->tg_pt_gp_transition_work,
-                  core_alua_do_transition_tg_pt_work);
         tg_pt_gp->tg_pt_gp_dev = dev;
-        atomic_set(&tg_pt_gp->tg_pt_gp_alua_access_state,
-                ALUA_ACCESS_STATE_ACTIVE_OPTIMIZED);
+        tg_pt_gp->tg_pt_gp_alua_access_state =
+                        ALUA_ACCESS_STATE_ACTIVE_OPTIMIZED;
         /*
          * Enable both explicit and implicit ALUA support by default
          */
@@ -1797,8 +1759,6 @@ void core_alua_free_tg_pt_gp(
         dev->t10_alua.alua_tg_pt_gps_counter--;
         spin_unlock(&dev->t10_alua.tg_pt_gps_lock);
 
-        flush_work(&tg_pt_gp->tg_pt_gp_transition_work);
-
         /*
          * Allow a struct t10_alua_tg_pt_gp_member * referenced by
          * core_alua_get_tg_pt_gp_by_name() in
@@ -1938,8 +1898,8 @@ ssize_t core_alua_show_tg_pt_gp_info(struct se_lun *lun, char *page)
                         "Primary Access Status: %s\nTG Port Secondary Access"
                         " State: %s\nTG Port Secondary Access Status: %s\n",
                         config_item_name(tg_pt_ci), tg_pt_gp->tg_pt_gp_id,
-                        core_alua_dump_state(atomic_read(
-                                        &tg_pt_gp->tg_pt_gp_alua_access_state)),
+                        core_alua_dump_state(
+                                tg_pt_gp->tg_pt_gp_alua_access_state),
                         core_alua_dump_status(
                                 tg_pt_gp->tg_pt_gp_alua_access_status),
                         atomic_read(&lun->lun_tg_pt_secondary_offline) ?
diff --git a/drivers/target/target_core_configfs.c b/drivers/target/target_core_configfs.c
index 38b5025e4c7a..70657fd56440 100644
--- a/drivers/target/target_core_configfs.c
+++ b/drivers/target/target_core_configfs.c
@@ -2392,7 +2392,7 @@ static ssize_t target_tg_pt_gp_alua_access_state_show(struct config_item *item,
                 char *page)
 {
         return sprintf(page, "%d\n",
-                atomic_read(&to_tg_pt_gp(item)->tg_pt_gp_alua_access_state));
+                       to_tg_pt_gp(item)->tg_pt_gp_alua_access_state);
 }
 
 static ssize_t target_tg_pt_gp_alua_access_state_store(struct config_item *item,
diff --git a/drivers/target/target_core_fabric_configfs.c b/drivers/target/target_core_fabric_configfs.c
index d8a16ca6baa5..d1e6cab8e3d3 100644
--- a/drivers/target/target_core_fabric_configfs.c
+++ b/drivers/target/target_core_fabric_configfs.c
@@ -92,6 +92,11 @@ static int target_fabric_mappedlun_link(
                 pr_err("Source se_lun->lun_se_dev does not exist\n");
                 return -EINVAL;
         }
+        if (lun->lun_shutdown) {
+                pr_err("Unable to create mappedlun symlink because"
+                        " lun->lun_shutdown=true\n");
+                return -EINVAL;
+        }
         se_tpg = lun->lun_tpg;
 
         nacl_ci = &lun_acl_ci->ci_parent->ci_group->cg_item;
diff --git a/drivers/target/target_core_tpg.c b/drivers/target/target_core_tpg.c
index 6fb191914f45..dfaef4d3b2d2 100644
--- a/drivers/target/target_core_tpg.c
+++ b/drivers/target/target_core_tpg.c
@@ -642,6 +642,8 @@ void core_tpg_remove_lun(
          */
         struct se_device *dev = rcu_dereference_raw(lun->lun_se_dev);
 
+        lun->lun_shutdown = true;
+
         core_clear_lun_from_tpg(lun, tpg);
         /*
          * Wait for any active I/O references to percpu se_lun->lun_ref to
@@ -663,6 +665,8 @@ void core_tpg_remove_lun(
         }
         if (!(dev->se_hba->hba_flags & HBA_FLAGS_INTERNAL_USE))
                 hlist_del_rcu(&lun->link);
+
+        lun->lun_shutdown = false;
         mutex_unlock(&tpg->tpg_lun_mutex);
 
         percpu_ref_exit(&lun->lun_ref);
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index b1a3cdb29468..a0cd56ee5fe9 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -64,8 +64,9 @@ struct kmem_cache *t10_alua_lba_map_cache;
 struct kmem_cache *t10_alua_lba_map_mem_cache;
 
 static void transport_complete_task_attr(struct se_cmd *cmd);
+static int translate_sense_reason(struct se_cmd *cmd, sense_reason_t reason);
 static void transport_handle_queue_full(struct se_cmd *cmd,
-                struct se_device *dev);
+                struct se_device *dev, int err, bool write_pending);
 static int transport_put_cmd(struct se_cmd *cmd);
 static void target_complete_ok_work(struct work_struct *work);
 
@@ -804,7 +805,8 @@ void target_qf_do_work(struct work_struct *work)
 
                 if (cmd->t_state == TRANSPORT_COMPLETE_QF_WP)
                         transport_write_pending_qf(cmd);
-                else if (cmd->t_state == TRANSPORT_COMPLETE_QF_OK)
+                else if (cmd->t_state == TRANSPORT_COMPLETE_QF_OK ||
+                         cmd->t_state == TRANSPORT_COMPLETE_QF_ERR)
                         transport_complete_qf(cmd);
         }
 }
@@ -1719,7 +1721,7 @@ void transport_generic_request_failure(struct se_cmd *cmd,
                 }
                 trace_target_cmd_complete(cmd);
                 ret = cmd->se_tfo->queue_status(cmd);
-                if (ret == -EAGAIN || ret == -ENOMEM)
+                if (ret)
                         goto queue_full;
                 goto check_stop;
         default:
@@ -1730,7 +1732,7 @@ void transport_generic_request_failure(struct se_cmd *cmd,
         }
 
         ret = transport_send_check_condition_and_sense(cmd, sense_reason, 0);
-        if (ret == -EAGAIN || ret == -ENOMEM)
+        if (ret)
                 goto queue_full;
 
 check_stop:
@@ -1739,8 +1741,7 @@ check_stop:
         return;
 
 queue_full:
-        cmd->t_state = TRANSPORT_COMPLETE_QF_OK;
-        transport_handle_queue_full(cmd, cmd->se_dev);
+        transport_handle_queue_full(cmd, cmd->se_dev, ret, false);
 }
 EXPORT_SYMBOL(transport_generic_request_failure);
 
@@ -1977,13 +1978,29 @@ static void transport_complete_qf(struct se_cmd *cmd)
         int ret = 0;
 
         transport_complete_task_attr(cmd);
+        /*
+         * If a fabric driver ->write_pending() or ->queue_data_in() callback
+         * has returned neither -ENOMEM or -EAGAIN, assume it's fatal and
+         * the same callbacks should not be retried.  Return CHECK_CONDITION
+         * if a scsi_status is not already set.
+         *
+         * If a fabric driver ->queue_status() has returned non zero, always
+         * keep retrying no matter what..
+         */
+        if (cmd->t_state == TRANSPORT_COMPLETE_QF_ERR) {
+                if (cmd->scsi_status)
+                        goto queue_status;
 
-        if (cmd->se_cmd_flags & SCF_TRANSPORT_TASK_SENSE) {
-                trace_target_cmd_complete(cmd);
-                ret = cmd->se_tfo->queue_status(cmd);
-                goto out;
+                cmd->se_cmd_flags |= SCF_EMULATED_TASK_SENSE;
+                cmd->scsi_status = SAM_STAT_CHECK_CONDITION;
+                cmd->scsi_sense_length  = TRANSPORT_SENSE_BUFFER;
+                translate_sense_reason(cmd, TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE);
+                goto queue_status;
         }
 
+        if (cmd->se_cmd_flags & SCF_TRANSPORT_TASK_SENSE)
+                goto queue_status;
+
         switch (cmd->data_direction) {
         case DMA_FROM_DEVICE:
                 if (cmd->scsi_status)
@@ -2007,19 +2024,33 @@ queue_status:
                 break;
         }
 
-out:
         if (ret < 0) {
-                transport_handle_queue_full(cmd, cmd->se_dev);
+                transport_handle_queue_full(cmd, cmd->se_dev, ret, false);
                 return;
         }
         transport_lun_remove_cmd(cmd);
         transport_cmd_check_stop_to_fabric(cmd);
 }
 
-static void transport_handle_queue_full(
-        struct se_cmd *cmd,
-        struct se_device *dev)
+static void transport_handle_queue_full(struct se_cmd *cmd, struct se_device *dev,
+                                        int err, bool write_pending)
 {
+        /*
+         * -EAGAIN or -ENOMEM signals retry of ->write_pending() and/or
+         * ->queue_data_in() callbacks from new process context.
+         *
+         * Otherwise for other errors, transport_complete_qf() will send
+         * CHECK_CONDITION via ->queue_status() instead of attempting to
+         * retry associated fabric driver data-transfer callbacks.
+         */
+        if (err == -EAGAIN || err == -ENOMEM) {
+                cmd->t_state = (write_pending) ? TRANSPORT_COMPLETE_QF_WP :
+                                                 TRANSPORT_COMPLETE_QF_OK;
+        } else {
+                pr_warn_ratelimited("Got unknown fabric queue status: %d\n", err);
+                cmd->t_state = TRANSPORT_COMPLETE_QF_ERR;
+        }
+
         spin_lock_irq(&dev->qf_cmd_lock);
         list_add_tail(&cmd->se_qf_node, &cmd->se_dev->qf_cmd_list);
         atomic_inc_mb(&dev->dev_qf_count);
@@ -2083,7 +2114,7 @@ static void target_complete_ok_work(struct work_struct *work)
                 WARN_ON(!cmd->scsi_status);
                 ret = transport_send_check_condition_and_sense(
                                         cmd, 0, 1);
-                if (ret == -EAGAIN || ret == -ENOMEM)
+                if (ret)
                         goto queue_full;
 
                 transport_lun_remove_cmd(cmd);
@@ -2109,7 +2140,7 @@ static void target_complete_ok_work(struct work_struct *work)
                 } else if (rc) {
                         ret = transport_send_check_condition_and_sense(cmd,
                                                 rc, 0);
-                        if (ret == -EAGAIN || ret == -ENOMEM)
+                        if (ret)
                                 goto queue_full;
 
                         transport_lun_remove_cmd(cmd);
@@ -2134,7 +2165,7 @@ queue_rsp:
                 if (target_read_prot_action(cmd)) {
                         ret = transport_send_check_condition_and_sense(cmd,
                                                 cmd->pi_err, 0);
-                        if (ret == -EAGAIN || ret == -ENOMEM)
+                        if (ret)
                                 goto queue_full;
 
                         transport_lun_remove_cmd(cmd);
@@ -2144,7 +2175,7 @@ queue_rsp:
 
                 trace_target_cmd_complete(cmd);
                 ret = cmd->se_tfo->queue_data_in(cmd);
-                if (ret == -EAGAIN || ret == -ENOMEM)
+                if (ret)
                         goto queue_full;
                 break;
         case DMA_TO_DEVICE:
@@ -2157,7 +2188,7 @@ queue_rsp:
                         atomic_long_add(cmd->data_length,
                                         &cmd->se_lun->lun_stats.tx_data_octets);
                         ret = cmd->se_tfo->queue_data_in(cmd);
-                        if (ret == -EAGAIN || ret == -ENOMEM)
+                        if (ret)
                                 goto queue_full;
                         break;
                 }
@@ -2166,7 +2197,7 @@ queue_rsp:
 queue_status:
                 trace_target_cmd_complete(cmd);
                 ret = cmd->se_tfo->queue_status(cmd);
-                if (ret == -EAGAIN || ret == -ENOMEM)
+                if (ret)
                         goto queue_full;
                 break;
         default:
@@ -2180,8 +2211,8 @@ queue_status:
 queue_full:
         pr_debug("Handling complete_ok QUEUE_FULL: se_cmd: %p,"
                 " data_direction: %d\n", cmd, cmd->data_direction);
-        cmd->t_state = TRANSPORT_COMPLETE_QF_OK;
-        transport_handle_queue_full(cmd, cmd->se_dev);
+
+        transport_handle_queue_full(cmd, cmd->se_dev, ret, false);
 }
 
 void target_free_sgl(struct scatterlist *sgl, int nents)
@@ -2449,18 +2480,14 @@ transport_generic_new_cmd(struct se_cmd *cmd)
         spin_unlock_irqrestore(&cmd->t_state_lock, flags);
 
         ret = cmd->se_tfo->write_pending(cmd);
-        if (ret == -EAGAIN || ret == -ENOMEM)
+        if (ret)
                 goto queue_full;
 
-        /* fabric drivers should only return -EAGAIN or -ENOMEM as error */
-        WARN_ON(ret);
-
-        return (!ret) ? 0 : TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
+        return 0;
 
 queue_full:
         pr_debug("Handling write_pending QUEUE__FULL: se_cmd: %p\n", cmd);
-        cmd->t_state = TRANSPORT_COMPLETE_QF_WP;
-        transport_handle_queue_full(cmd, cmd->se_dev);
+        transport_handle_queue_full(cmd, cmd->se_dev, ret, true);
         return 0;
 }
 EXPORT_SYMBOL(transport_generic_new_cmd);
@@ -2470,10 +2497,10 @@ static void transport_write_pending_qf(struct se_cmd *cmd)
         int ret;
 
         ret = cmd->se_tfo->write_pending(cmd);
-        if (ret == -EAGAIN || ret == -ENOMEM) {
+        if (ret) {
                 pr_debug("Handling write_pending QUEUE__FULL: se_cmd: %p\n",
                          cmd);
-                transport_handle_queue_full(cmd, cmd->se_dev);
+                transport_handle_queue_full(cmd, cmd->se_dev, ret, true);
         }
 }
 
@@ -3011,6 +3038,8 @@ static int __transport_check_aborted_status(struct se_cmd *cmd, int send_status)
         __releases(&cmd->t_state_lock)
         __acquires(&cmd->t_state_lock)
 {
+        int ret;
+
         assert_spin_locked(&cmd->t_state_lock);
         WARN_ON_ONCE(!irqs_disabled());
 
@@ -3034,7 +3063,9 @@ static int __transport_check_aborted_status(struct se_cmd *cmd, int send_status)
         trace_target_cmd_complete(cmd);
 
         spin_unlock_irq(&cmd->t_state_lock);
-        cmd->se_tfo->queue_status(cmd);
+        ret = cmd->se_tfo->queue_status(cmd);
+        if (ret)
+                transport_handle_queue_full(cmd, cmd->se_dev, ret, false);
         spin_lock_irq(&cmd->t_state_lock);
 
         return 1;
@@ -3055,6 +3086,7 @@ EXPORT_SYMBOL(transport_check_aborted_status);
 void transport_send_task_abort(struct se_cmd *cmd)
 {
         unsigned long flags;
+        int ret;
 
         spin_lock_irqsave(&cmd->t_state_lock, flags);
         if (cmd->se_cmd_flags & (SCF_SENT_CHECK_CONDITION)) {
@@ -3090,7 +3122,9 @@ send_abort:
                  cmd->t_task_cdb[0], cmd->tag);
 
         trace_target_cmd_complete(cmd);
-        cmd->se_tfo->queue_status(cmd);
+        ret = cmd->se_tfo->queue_status(cmd);
+        if (ret)
+                transport_handle_queue_full(cmd, cmd->se_dev, ret, false);
 }
 
 static void target_tmr_work(struct work_struct *work)
diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c
index c6874c38a10b..f615c3bbb73e 100644
--- a/drivers/target/target_core_user.c
+++ b/drivers/target/target_core_user.c
@@ -311,24 +311,50 @@ static void free_data_area(struct tcmu_dev *udev, struct tcmu_cmd *cmd)
                    DATA_BLOCK_BITS);
 }
 
-static void gather_data_area(struct tcmu_dev *udev, unsigned long *cmd_bitmap,
-                struct scatterlist *data_sg, unsigned int data_nents)
+static void gather_data_area(struct tcmu_dev *udev, struct tcmu_cmd *cmd,
+                             bool bidi)
 {
+        struct se_cmd *se_cmd = cmd->se_cmd;
         int i, block;
         int block_remaining = 0;
         void *from, *to;
         size_t copy_bytes, from_offset;
-        struct scatterlist *sg;
+        struct scatterlist *sg, *data_sg;
+        unsigned int data_nents;
+        DECLARE_BITMAP(bitmap, DATA_BLOCK_BITS);
+
+        bitmap_copy(bitmap, cmd->data_bitmap, DATA_BLOCK_BITS);
+
+        if (!bidi) {
+                data_sg = se_cmd->t_data_sg;
+                data_nents = se_cmd->t_data_nents;
+        } else {
+                uint32_t count;
+
+                /*
+                 * For bidi case, the first count blocks are for Data-Out
+                 * buffer blocks, and before gathering the Data-In buffer
+                 * the Data-Out buffer blocks should be discarded.
+                 */
+                count = DIV_ROUND_UP(se_cmd->data_length, DATA_BLOCK_SIZE);
+                while (count--) {
+                        block = find_first_bit(bitmap, DATA_BLOCK_BITS);
+                        clear_bit(block, bitmap);
+                }
+
+                data_sg = se_cmd->t_bidi_data_sg;
+                data_nents = se_cmd->t_bidi_data_nents;
+        }
 
         for_each_sg(data_sg, sg, data_nents, i) {
                 int sg_remaining = sg->length;
                 to = kmap_atomic(sg_page(sg)) + sg->offset;
                 while (sg_remaining > 0) {
                         if (block_remaining == 0) {
-                                block = find_first_bit(cmd_bitmap,
+                                block = find_first_bit(bitmap,
                                                 DATA_BLOCK_BITS);
                                 block_remaining = DATA_BLOCK_SIZE;
-                                clear_bit(block, cmd_bitmap);
+                                clear_bit(block, bitmap);
                         }
                         copy_bytes = min_t(size_t, sg_remaining,
                                         block_remaining);
@@ -394,6 +420,27 @@ static bool is_ring_space_avail(struct tcmu_dev *udev, size_t cmd_size, size_t d
         return true;
 }
 
+static inline size_t tcmu_cmd_get_data_length(struct tcmu_cmd *tcmu_cmd)
+{
+        struct se_cmd *se_cmd = tcmu_cmd->se_cmd;
+        size_t data_length = round_up(se_cmd->data_length, DATA_BLOCK_SIZE);
+
+        if (se_cmd->se_cmd_flags & SCF_BIDI) {
+                BUG_ON(!(se_cmd->t_bidi_data_sg && se_cmd->t_bidi_data_nents));
+                data_length += round_up(se_cmd->t_bidi_data_sg->length,
+                                DATA_BLOCK_SIZE);
+        }
+
+        return data_length;
+}
+
+static inline uint32_t tcmu_cmd_get_block_cnt(struct tcmu_cmd *tcmu_cmd)
+{
+        size_t data_length = tcmu_cmd_get_data_length(tcmu_cmd);
+
+        return data_length / DATA_BLOCK_SIZE;
+}
+
 static sense_reason_t
 tcmu_queue_cmd_ring(struct tcmu_cmd *tcmu_cmd)
 {
@@ -407,7 +454,7 @@ tcmu_queue_cmd_ring(struct tcmu_cmd *tcmu_cmd)
         uint32_t cmd_head;
         uint64_t cdb_off;
         bool copy_to_data_area;
-        size_t data_length;
+        size_t data_length = tcmu_cmd_get_data_length(tcmu_cmd);
         DECLARE_BITMAP(old_bitmap, DATA_BLOCK_BITS);
 
         if (test_bit(TCMU_DEV_BIT_BROKEN, &udev->flags))
@@ -421,8 +468,7 @@ tcmu_queue_cmd_ring(struct tcmu_cmd *tcmu_cmd)
          * expensive to tell how many regions are freed in the bitmap
         */
         base_command_size = max(offsetof(struct tcmu_cmd_entry,
-                                req.iov[se_cmd->t_bidi_data_nents +
-                                        se_cmd->t_data_nents]),
+                                req.iov[tcmu_cmd_get_block_cnt(tcmu_cmd)]),
                                 sizeof(struct tcmu_cmd_entry));
         command_size = base_command_size
                 + round_up(scsi_command_size(se_cmd->t_task_cdb), TCMU_OP_ALIGN_SIZE);
@@ -433,11 +479,6 @@ tcmu_queue_cmd_ring(struct tcmu_cmd *tcmu_cmd)
 
         mb = udev->mb_addr;
         cmd_head = mb->cmd_head % udev->cmdr_size; /* UAM */
-        data_length = se_cmd->data_length;
-        if (se_cmd->se_cmd_flags & SCF_BIDI) {
-                BUG_ON(!(se_cmd->t_bidi_data_sg && se_cmd->t_bidi_data_nents));
-                data_length += se_cmd->t_bidi_data_sg->length;
-        }
         if ((command_size > (udev->cmdr_size / 2)) ||
             data_length > udev->data_size) {
                 pr_warn("TCMU: Request of size %zu/%zu is too big for %u/%zu "
@@ -511,11 +552,14 @@ tcmu_queue_cmd_ring(struct tcmu_cmd *tcmu_cmd)
         entry->req.iov_dif_cnt = 0;
 
         /* Handle BIDI commands */
-        iov_cnt = 0;
-        alloc_and_scatter_data_area(udev, se_cmd->t_bidi_data_sg,
-                se_cmd->t_bidi_data_nents, &iov, &iov_cnt, false);
-        entry->req.iov_bidi_cnt = iov_cnt;
-
+        if (se_cmd->se_cmd_flags & SCF_BIDI) {
+                iov_cnt = 0;
+                iov++;
+                alloc_and_scatter_data_area(udev, se_cmd->t_bidi_data_sg,
+                                se_cmd->t_bidi_data_nents, &iov, &iov_cnt,
+                                false);
+                entry->req.iov_bidi_cnt = iov_cnt;
+        }
         /* cmd's data_bitmap is what changed in process */
         bitmap_xor(tcmu_cmd->data_bitmap, old_bitmap, udev->data_bitmap,
                         DATA_BLOCK_BITS);
@@ -592,19 +636,11 @@ static void tcmu_handle_completion(struct tcmu_cmd *cmd, struct tcmu_cmd_entry *
                                se_cmd->scsi_sense_length);
                 free_data_area(udev, cmd);
         } else if (se_cmd->se_cmd_flags & SCF_BIDI) {
-                DECLARE_BITMAP(bitmap, DATA_BLOCK_BITS);
-
                 /* Get Data-In buffer before clean up */
-                bitmap_copy(bitmap, cmd->data_bitmap, DATA_BLOCK_BITS);
-                gather_data_area(udev, bitmap,
-                        se_cmd->t_bidi_data_sg, se_cmd->t_bidi_data_nents);
+                gather_data_area(udev, cmd, true);
                 free_data_area(udev, cmd);
         } else if (se_cmd->data_direction == DMA_FROM_DEVICE) {
-                DECLARE_BITMAP(bitmap, DATA_BLOCK_BITS);
-
-                bitmap_copy(bitmap, cmd->data_bitmap, DATA_BLOCK_BITS);
-                gather_data_area(udev, bitmap,
-                        se_cmd->t_data_sg, se_cmd->t_data_nents);
+                gather_data_area(udev, cmd, false);
                 free_data_area(udev, cmd);
         } else if (se_cmd->data_direction == DMA_TO_DEVICE) {
                 free_data_area(udev, cmd);
@@ -1196,11 +1232,6 @@ static ssize_t tcmu_cmd_time_out_store(struct config_item *item, const char *pag
         if (ret < 0)
                 return ret;
 
-        if (!val) {
-                pr_err("Illegal value for cmd_time_out\n");
-                return -EINVAL;
-        }
-
         udev->cmd_time_out = val * MSEC_PER_SEC;
         return count;
 }
diff --git a/drivers/tty/tty_ldisc.c b/drivers/tty/tty_ldisc.c
index b0500a0a87b8..e4603b09863a 100644
--- a/drivers/tty/tty_ldisc.c
+++ b/drivers/tty/tty_ldisc.c
@@ -492,6 +492,41 @@ static void tty_ldisc_close(struct tty_struct *tty, struct tty_ldisc *ld)
 }
 
 /**
+ *      tty_ldisc_restore       -       helper for tty ldisc change
+ *      @tty: tty to recover
+ *      @old: previous ldisc
+ *
+ *      Restore the previous line discipline or N_TTY when a line discipline
+ *      change fails due to an open error
+ */
+
+static void tty_ldisc_restore(struct tty_struct *tty, struct tty_ldisc *old)
+{
+        struct tty_ldisc *new_ldisc;
+        int r;
+
+        /* There is an outstanding reference here so this is safe */
+        old = tty_ldisc_get(tty, old->ops->num);
+        WARN_ON(IS_ERR(old));
+        tty->ldisc = old;
+        tty_set_termios_ldisc(tty, old->ops->num);
+        if (tty_ldisc_open(tty, old) < 0) {
+                tty_ldisc_put(old);
+                /* This driver is always present */
+                new_ldisc = tty_ldisc_get(tty, N_TTY);
+                if (IS_ERR(new_ldisc))
+                        panic("n_tty: get");
+                tty->ldisc = new_ldisc;
+                tty_set_termios_ldisc(tty, N_TTY);
+                r = tty_ldisc_open(tty, new_ldisc);
+                if (r < 0)
+                        panic("Couldn't open N_TTY ldisc for "
+                              "%s --- error %d.",
+                              tty_name(tty), r);
+        }
+}
+
+/**
  *      tty_set_ldisc           -       set line discipline
  *      @tty: the terminal to set
  *      @ldisc: the line discipline
@@ -504,7 +539,12 @@ static void tty_ldisc_close(struct tty_struct *tty, struct tty_ldisc *ld)
 
 int tty_set_ldisc(struct tty_struct *tty, int disc)
 {
-        int retval, old_disc;
+        int retval;
+        struct tty_ldisc *old_ldisc, *new_ldisc;
+
+        new_ldisc = tty_ldisc_get(tty, disc);
+        if (IS_ERR(new_ldisc))
+                return PTR_ERR(new_ldisc);
 
         tty_lock(tty);
         retval = tty_ldisc_lock(tty, 5 * HZ);
@@ -517,8 +557,7 @@ int tty_set_ldisc(struct tty_struct *tty, int disc)
         }
 
         /* Check the no-op case */
-        old_disc = tty->ldisc->ops->num;
-        if (old_disc == disc)
+        if (tty->ldisc->ops->num == disc)
                 goto out;
 
         if (test_bit(TTY_HUPPED, &tty->flags)) {
@@ -527,25 +566,34 @@ int tty_set_ldisc(struct tty_struct *tty, int disc)
                 goto out;
         }
 
-        retval = tty_ldisc_reinit(tty, disc);
+        old_ldisc = tty->ldisc;
+
+        /* Shutdown the old discipline. */
+        tty_ldisc_close(tty, old_ldisc);
+
+        /* Now set up the new line discipline. */
+        tty->ldisc = new_ldisc;
+        tty_set_termios_ldisc(tty, disc);
+
+        retval = tty_ldisc_open(tty, new_ldisc);
         if (retval < 0) {
                 /* Back to the old one or N_TTY if we can't */
-                if (tty_ldisc_reinit(tty, old_disc) < 0) {
-                        pr_err("tty: TIOCSETD failed, reinitializing N_TTY\n");
-                        if (tty_ldisc_reinit(tty, N_TTY) < 0) {
-                                /* At this point we have tty->ldisc == NULL. */
-                                pr_err("tty: reinitializing N_TTY failed\n");
-                        }
-                }
+                tty_ldisc_put(new_ldisc);
+                tty_ldisc_restore(tty, old_ldisc);
         }
 
-        if (tty->ldisc && tty->ldisc->ops->num != old_disc &&
-            tty->ops->set_ldisc) {
+        if (tty->ldisc->ops->num != old_ldisc->ops->num && tty->ops->set_ldisc) {
                 down_read(&tty->termios_rwsem);
                 tty->ops->set_ldisc(tty);
                 up_read(&tty->termios_rwsem);
         }
 
+        /* At this point we hold a reference to the new ldisc and a
+           reference to the old ldisc, or we hold two references to
+           the old ldisc (if it was restored as part of error cleanup
+           above). In either case, releasing a single reference from
+           the old ldisc is correct. */
+        new_ldisc = old_ldisc;
 out:
         tty_ldisc_unlock(tty);
 
@@ -553,6 +601,7 @@ out:
            already running */
         tty_buffer_restart_work(tty->port);
 err:
+        tty_ldisc_put(new_ldisc);       /* drop the extra reference */
         tty_unlock(tty);
         return retval;
 }
@@ -613,8 +662,10 @@ int tty_ldisc_reinit(struct tty_struct *tty, int disc)
         int retval;
 
         ld = tty_ldisc_get(tty, disc);
-        if (IS_ERR(ld))
+        if (IS_ERR(ld)) {
+                BUG_ON(disc == N_TTY);
                 return PTR_ERR(ld);
+        }
 
         if (tty->ldisc) {
                 tty_ldisc_close(tty, tty->ldisc);
@@ -626,8 +677,10 @@ int tty_ldisc_reinit(struct tty_struct *tty, int disc)
         tty_set_termios_ldisc(tty, disc);
         retval = tty_ldisc_open(tty, tty->ldisc);
         if (retval) {
-                tty_ldisc_put(tty->ldisc);
-                tty->ldisc = NULL;
+                if (!WARN_ON(disc == N_TTY)) {
+                        tty_ldisc_put(tty->ldisc);
+                        tty->ldisc = NULL;
+                }
         }
         return retval;
 }
diff --git a/drivers/usb/gadget/function/f_tcm.c b/drivers/usb/gadget/function/f_tcm.c
index d2351139342f..a82e2bd5ea34 100644
--- a/drivers/usb/gadget/function/f_tcm.c
+++ b/drivers/usb/gadget/function/f_tcm.c
@@ -373,7 +373,7 @@ static void bot_cleanup_old_alt(struct f_uas *fu)
         usb_ep_free_request(fu->ep_in, fu->bot_req_in);
         usb_ep_free_request(fu->ep_out, fu->bot_req_out);
         usb_ep_free_request(fu->ep_out, fu->cmd.req);
-        usb_ep_free_request(fu->ep_out, fu->bot_status.req);
+        usb_ep_free_request(fu->ep_in, fu->bot_status.req);
 
         kfree(fu->cmd.buf);
 
diff --git a/drivers/video/fbdev/efifb.c b/drivers/video/fbdev/efifb.c
index 8c4dc1e1f94f..b827a8113e26 100644
--- a/drivers/video/fbdev/efifb.c
+++ b/drivers/video/fbdev/efifb.c
@@ -10,6 +10,7 @@
 #include <linux/efi.h>
 #include <linux/errno.h>
 #include <linux/fb.h>
+#include <linux/pci.h>
 #include <linux/platform_device.h>
 #include <linux/screen_info.h>
 #include <video/vga.h>
@@ -143,6 +144,8 @@ static struct attribute *efifb_attrs[] = {
 };
 ATTRIBUTE_GROUPS(efifb);
 
+static bool pci_dev_disabled;   /* FB base matches BAR of a disabled device */
+
 static int efifb_probe(struct platform_device *dev)
 {
         struct fb_info *info;
@@ -152,7 +155,7 @@ static int efifb_probe(struct platform_device *dev)
         unsigned int size_total;
         char *option = NULL;
 
-        if (screen_info.orig_video_isVGA != VIDEO_TYPE_EFI)
+        if (screen_info.orig_video_isVGA != VIDEO_TYPE_EFI || pci_dev_disabled)
                 return -ENODEV;
 
         if (fb_get_options("efifb", &option))
@@ -360,3 +363,64 @@ static struct platform_driver efifb_driver = {
 };
 
 builtin_platform_driver(efifb_driver);
+
+#if defined(CONFIG_PCI) && !defined(CONFIG_X86)
+
+static bool pci_bar_found;      /* did we find a BAR matching the efifb base? */
+
+static void claim_efifb_bar(struct pci_dev *dev, int idx)
+{
+        u16 word;
+
+        pci_bar_found = true;
+
+        pci_read_config_word(dev, PCI_COMMAND, &word);
+        if (!(word & PCI_COMMAND_MEMORY)) {
+                pci_dev_disabled = true;
+                dev_err(&dev->dev,
+                        "BAR %d: assigned to efifb but device is disabled!\n",
+                        idx);
+                return;
+        }
+
+        if (pci_claim_resource(dev, idx)) {
+                pci_dev_disabled = true;
+                dev_err(&dev->dev,
+                        "BAR %d: failed to claim resource for efifb!\n", idx);
+                return;
+        }
+
+        dev_info(&dev->dev, "BAR %d: assigned to efifb\n", idx);
+}
+
+static void efifb_fixup_resources(struct pci_dev *dev)
+{
+        u64 base = screen_info.lfb_base;
+        u64 size = screen_info.lfb_size;
+        int i;
+
+        if (pci_bar_found || screen_info.orig_video_isVGA != VIDEO_TYPE_EFI)
+                return;
+
+        if (screen_info.capabilities & VIDEO_CAPABILITY_64BIT_BASE)
+                base |= (u64)screen_info.ext_lfb_base << 32;
+
+        if (!base)
+                return;
+
+        for (i = 0; i < PCI_STD_RESOURCE_END; i++) {
+                struct resource *res = &dev->resource[i];
+
+                if (!(res->flags & IORESOURCE_MEM))
+                        continue;
+
+                if (res->start <= base && res->end >= base + size - 1) {
+                        claim_efifb_bar(dev, i);
+                        break;
+                }
+        }
+}
+DECLARE_PCI_FIXUP_CLASS_HEADER(PCI_ANY_ID, PCI_ANY_ID, PCI_BASE_CLASS_DISPLAY,
+                               16, efifb_fixup_resources);
+
+#endif
diff --git a/drivers/video/fbdev/omap/omapfb_main.c b/drivers/video/fbdev/omap/omapfb_main.c
index 1abba07b84b3..f4cbfb3b8a09 100644
--- a/drivers/video/fbdev/omap/omapfb_main.c
+++ b/drivers/video/fbdev/omap/omapfb_main.c
@@ -1608,19 +1608,6 @@ static int omapfb_find_ctrl(struct omapfb_device *fbdev)
         return 0;
 }
 
-static void check_required_callbacks(struct omapfb_device *fbdev)
-{
-#define _C(x) (fbdev->ctrl->x != NULL)
-#define _P(x) (fbdev->panel->x != NULL)
-        BUG_ON(fbdev->ctrl == NULL || fbdev->panel == NULL);
-        BUG_ON(!(_C(init) && _C(cleanup) && _C(get_caps) &&
-                 _C(set_update_mode) && _C(setup_plane) && _C(enable_plane) &&
-                 _P(init) && _P(cleanup) && _P(enable) && _P(disable) &&
-                 _P(get_caps)));
-#undef _P
-#undef _C
-}
-
 /*
  * Called by LDM binding to probe and attach a new device.
  * Initialization sequence:
@@ -1705,8 +1692,6 @@ static int omapfb_do_probe(struct platform_device *pdev,
                 omapfb_ops.fb_mmap = omapfb_mmap;
         init_state++;
 
-        check_required_callbacks(fbdev);
-
         r = planes_init(fbdev);
         if (r)
                 goto cleanup;
diff --git a/drivers/video/fbdev/ssd1307fb.c b/drivers/video/fbdev/ssd1307fb.c
index bd017b57c47f..f599520374dd 100644
--- a/drivers/video/fbdev/ssd1307fb.c
+++ b/drivers/video/fbdev/ssd1307fb.c
@@ -578,10 +578,14 @@ static int ssd1307fb_probe(struct i2c_client *client,
 
         par->vbat_reg = devm_regulator_get_optional(&client->dev, "vbat");
         if (IS_ERR(par->vbat_reg)) {
-                dev_err(&client->dev, "failed to get VBAT regulator: %ld\n",
-                        PTR_ERR(par->vbat_reg));
                 ret = PTR_ERR(par->vbat_reg);
-                goto fb_alloc_error;
+                if (ret == -ENODEV) {
+                        par->vbat_reg = NULL;
+                } else {
+                        dev_err(&client->dev, "failed to get VBAT regulator: %d\n",
+                                ret);
+                        goto fb_alloc_error;
+                }
         }
 
         if (of_property_read_u32(node, "solomon,width", &par->width))
@@ -668,10 +672,13 @@ static int ssd1307fb_probe(struct i2c_client *client,
                 udelay(4);
         }
 
-        ret = regulator_enable(par->vbat_reg);
-        if (ret) {
-                dev_err(&client->dev, "failed to enable VBAT: %d\n", ret);
-                goto reset_oled_error;
+        if (par->vbat_reg) {
+                ret = regulator_enable(par->vbat_reg);
+                if (ret) {
+                        dev_err(&client->dev, "failed to enable VBAT: %d\n",
+                                ret);
+                        goto reset_oled_error;
+                }
         }
 
         ret = ssd1307fb_init(par);
@@ -710,7 +717,8 @@ panel_init_error:
                 pwm_put(par->pwm);
         };
 regulator_enable_error:
-        regulator_disable(par->vbat_reg);
+        if (par->vbat_reg)
+                regulator_disable(par->vbat_reg);
 reset_oled_error:
         fb_deferred_io_cleanup(info);
 fb_alloc_error:
diff --git a/drivers/video/fbdev/xen-fbfront.c b/drivers/video/fbdev/xen-fbfront.c
index d0115a7af0a9..3ee309c50b2d 100644
--- a/drivers/video/fbdev/xen-fbfront.c
+++ b/drivers/video/fbdev/xen-fbfront.c
@@ -643,7 +643,6 @@ static void xenfb_backend_changed(struct xenbus_device *dev,
                 break;
 
         case XenbusStateInitWait:
-InitWait:
                 xenbus_switch_state(dev, XenbusStateConnected);
                 break;
 
@@ -654,7 +653,8 @@ InitWait:
                  * get Connected twice here.
                  */
                 if (dev->state != XenbusStateConnected)
-                        goto InitWait; /* no InitWait seen yet, fudge it */
+                        /* no InitWait seen yet, fudge it */
+                        xenbus_switch_state(dev, XenbusStateConnected);
 
                 if (xenbus_read_unsigned(info->xbdev->otherend,
                                          "request-update", 0))
diff --git a/drivers/virtio/virtio.c b/drivers/virtio/virtio.c
index 400d70b69379..48230a5e12f2 100644
--- a/drivers/virtio/virtio.c
+++ b/drivers/virtio/virtio.c
@@ -232,6 +232,12 @@ static int virtio_dev_probe(struct device *_d)
                 if (device_features & (1ULL << i))
                         __virtio_set_bit(dev, i);
 
+        if (drv->validate) {
+                err = drv->validate(dev);
+                if (err)
+                        goto err;
+        }
+
         err = virtio_finalize_features(dev);
         if (err)
                 goto err;
diff --git a/drivers/virtio/virtio_pci_common.c b/drivers/virtio/virtio_pci_common.c
index 590534910dc6..698d5d06fa03 100644
--- a/drivers/virtio/virtio_pci_common.c
+++ b/drivers/virtio/virtio_pci_common.c
@@ -33,8 +33,10 @@ void vp_synchronize_vectors(struct virtio_device *vdev)
         struct virtio_pci_device *vp_dev = to_vp_device(vdev);
         int i;
 
-        synchronize_irq(pci_irq_vector(vp_dev->pci_dev, 0));
-        for (i = 1; i < vp_dev->msix_vectors; i++)
+        if (vp_dev->intx_enabled)
+                synchronize_irq(vp_dev->pci_dev->irq);
+
+        for (i = 0; i < vp_dev->msix_vectors; ++i)
                 synchronize_irq(pci_irq_vector(vp_dev->pci_dev, i));
 }
 
@@ -60,13 +62,16 @@ static irqreturn_t vp_config_changed(int irq, void *opaque)
 static irqreturn_t vp_vring_interrupt(int irq, void *opaque)
 {
         struct virtio_pci_device *vp_dev = opaque;
+        struct virtio_pci_vq_info *info;
         irqreturn_t ret = IRQ_NONE;
-        struct virtqueue *vq;
+        unsigned long flags;
 
-        list_for_each_entry(vq, &vp_dev->vdev.vqs, list) {
-                if (vq->callback && vring_interrupt(irq, vq) == IRQ_HANDLED)
+        spin_lock_irqsave(&vp_dev->lock, flags);
+        list_for_each_entry(info, &vp_dev->virtqueues, node) {
+                if (vring_interrupt(irq, info->vq) == IRQ_HANDLED)
                         ret = IRQ_HANDLED;
         }
+        spin_unlock_irqrestore(&vp_dev->lock, flags);
 
         return ret;
 }
@@ -97,186 +102,244 @@ static irqreturn_t vp_interrupt(int irq, void *opaque)
         return vp_vring_interrupt(irq, opaque);
 }
 
-static void vp_remove_vqs(struct virtio_device *vdev)
+static int vp_request_msix_vectors(struct virtio_device *vdev, int nvectors,
+                                   bool per_vq_vectors, struct irq_affinity *desc)
 {
         struct virtio_pci_device *vp_dev = to_vp_device(vdev);
-        struct virtqueue *vq, *n;
+        const char *name = dev_name(&vp_dev->vdev.dev);
+        unsigned i, v;
+        int err = -ENOMEM;
 
-        list_for_each_entry_safe(vq, n, &vdev->vqs, list) {
-                if (vp_dev->msix_vector_map) {
-                        int v = vp_dev->msix_vector_map[vq->index];
+        vp_dev->msix_vectors = nvectors;
 
-                        if (v != VIRTIO_MSI_NO_VECTOR)
-                                free_irq(pci_irq_vector(vp_dev->pci_dev, v),
-                                        vq);
-                }
-                vp_dev->del_vq(vq);
+        vp_dev->msix_names = kmalloc(nvectors * sizeof *vp_dev->msix_names,
+                                     GFP_KERNEL);
+        if (!vp_dev->msix_names)
+                goto error;
+        vp_dev->msix_affinity_masks
+                = kzalloc(nvectors * sizeof *vp_dev->msix_affinity_masks,
+                          GFP_KERNEL);
+        if (!vp_dev->msix_affinity_masks)
+                goto error;
+        for (i = 0; i < nvectors; ++i)
+                if (!alloc_cpumask_var(&vp_dev->msix_affinity_masks[i],
+                                        GFP_KERNEL))
+                        goto error;
+
+        err = pci_alloc_irq_vectors_affinity(vp_dev->pci_dev, nvectors,
+                                             nvectors, PCI_IRQ_MSIX |
+                                             (desc ? PCI_IRQ_AFFINITY : 0),
+                                             desc);
+        if (err < 0)
+                goto error;
+        vp_dev->msix_enabled = 1;
+
+        /* Set the vector used for configuration */
+        v = vp_dev->msix_used_vectors;
+        snprintf(vp_dev->msix_names[v], sizeof *vp_dev->msix_names,
+                 "%s-config", name);
+        err = request_irq(pci_irq_vector(vp_dev->pci_dev, v),
+                          vp_config_changed, 0, vp_dev->msix_names[v],
+                          vp_dev);
+        if (err)
+                goto error;
+        ++vp_dev->msix_used_vectors;
+
+        v = vp_dev->config_vector(vp_dev, v);
+        /* Verify we had enough resources to assign the vector */
+        if (v == VIRTIO_MSI_NO_VECTOR) {
+                err = -EBUSY;
+                goto error;
         }
+
+        if (!per_vq_vectors) {
+                /* Shared vector for all VQs */
+                v = vp_dev->msix_used_vectors;
+                snprintf(vp_dev->msix_names[v], sizeof *vp_dev->msix_names,
+                         "%s-virtqueues", name);
+                err = request_irq(pci_irq_vector(vp_dev->pci_dev, v),
+                                  vp_vring_interrupt, 0, vp_dev->msix_names[v],
+                                  vp_dev);
+                if (err)
+                        goto error;
+                ++vp_dev->msix_used_vectors;
+        }
+        return 0;
+error:
+        return err;
+}
+
+static struct virtqueue *vp_setup_vq(struct virtio_device *vdev, unsigned index,
+                                     void (*callback)(struct virtqueue *vq),
+                                     const char *name,
+                                     u16 msix_vec)
+{
+        struct virtio_pci_device *vp_dev = to_vp_device(vdev);
+        struct virtio_pci_vq_info *info = kmalloc(sizeof *info, GFP_KERNEL);
+        struct virtqueue *vq;
+        unsigned long flags;
+
+        /* fill out our structure that represents an active queue */
+        if (!info)
+                return ERR_PTR(-ENOMEM);
+
+        vq = vp_dev->setup_vq(vp_dev, info, index, callback, name,
+                              msix_vec);
+        if (IS_ERR(vq))
+                goto out_info;
+
+        info->vq = vq;
+        if (callback) {
+                spin_lock_irqsave(&vp_dev->lock, flags);
+                list_add(&info->node, &vp_dev->virtqueues);
+                spin_unlock_irqrestore(&vp_dev->lock, flags);
+        } else {
+                INIT_LIST_HEAD(&info->node);
+        }
+
+        vp_dev->vqs[index] = info;
+        return vq;
+
+out_info:
+        kfree(info);
+        return vq;
+}
+
+static void vp_del_vq(struct virtqueue *vq)
+{
+        struct virtio_pci_device *vp_dev = to_vp_device(vq->vdev);
+        struct virtio_pci_vq_info *info = vp_dev->vqs[vq->index];
+        unsigned long flags;
+
+        spin_lock_irqsave(&vp_dev->lock, flags);
+        list_del(&info->node);
+        spin_unlock_irqrestore(&vp_dev->lock, flags);
+
+        vp_dev->del_vq(info);
+        kfree(info);
 }
 
 /* the config->del_vqs() implementation */
 void vp_del_vqs(struct virtio_device *vdev)
 {
         struct virtio_pci_device *vp_dev = to_vp_device(vdev);
+        struct virtqueue *vq, *n;
         int i;
 
-        if (WARN_ON_ONCE(list_empty_careful(&vdev->vqs)))
-                return;
+        list_for_each_entry_safe(vq, n, &vdev->vqs, list) {
+                if (vp_dev->per_vq_vectors) {
+                        int v = vp_dev->vqs[vq->index]->msix_vector;
 
-        vp_remove_vqs(vdev);
+                        if (v != VIRTIO_MSI_NO_VECTOR) {
+                                int irq = pci_irq_vector(vp_dev->pci_dev, v);
+
+                                irq_set_affinity_hint(irq, NULL);
+                                free_irq(irq, vq);
+                        }
+                }
+                vp_del_vq(vq);
+        }
+        vp_dev->per_vq_vectors = false;
+
+        if (vp_dev->intx_enabled) {
+                free_irq(vp_dev->pci_dev->irq, vp_dev);
+                vp_dev->intx_enabled = 0;
+        }
 
-        if (vp_dev->pci_dev->msix_enabled) {
-                for (i = 0; i < vp_dev->msix_vectors; i++)
+        for (i = 0; i < vp_dev->msix_used_vectors; ++i)
+                free_irq(pci_irq_vector(vp_dev->pci_dev, i), vp_dev);
+
+        for (i = 0; i < vp_dev->msix_vectors; i++)
+                if (vp_dev->msix_affinity_masks[i])
                         free_cpumask_var(vp_dev->msix_affinity_masks[i]);
 
+        if (vp_dev->msix_enabled) {
                 /* Disable the vector used for configuration */
                 vp_dev->config_vector(vp_dev, VIRTIO_MSI_NO_VECTOR);
 
-                kfree(vp_dev->msix_affinity_masks);
-                kfree(vp_dev->msix_names);
-                kfree(vp_dev->msix_vector_map);
+                pci_free_irq_vectors(vp_dev->pci_dev);
+                vp_dev->msix_enabled = 0;
         }
 
-        free_irq(pci_irq_vector(vp_dev->pci_dev, 0), vp_dev);
-        pci_free_irq_vectors(vp_dev->pci_dev);
+        vp_dev->msix_vectors = 0;
+        vp_dev->msix_used_vectors = 0;
+        kfree(vp_dev->msix_names);
+        vp_dev->msix_names = NULL;
+        kfree(vp_dev->msix_affinity_masks);
+        vp_dev->msix_affinity_masks = NULL;
+        kfree(vp_dev->vqs);
+        vp_dev->vqs = NULL;
 }
 
 static int vp_find_vqs_msix(struct virtio_device *vdev, unsigned nvqs,
                 struct virtqueue *vqs[], vq_callback_t *callbacks[],
-                const char * const names[], struct irq_affinity *desc)
+                const char * const names[], bool per_vq_vectors,
+                struct irq_affinity *desc)
 {
         struct virtio_pci_device *vp_dev = to_vp_device(vdev);
-        const char *name = dev_name(&vp_dev->vdev.dev);
-        int i, j, err = -ENOMEM, allocated_vectors, nvectors;
-        unsigned flags = PCI_IRQ_MSIX;
-        bool shared = false;
         u16 msix_vec;
+        int i, err, nvectors, allocated_vectors;
 
-        if (desc) {
-                flags |= PCI_IRQ_AFFINITY;
-                desc->pre_vectors++; /* virtio config vector */
-        }
-
-        nvectors = 1;
-        for (i = 0; i < nvqs; i++)
-                if (callbacks[i])
-                        nvectors++;
-
-        /* Try one vector per queue first. */
-        err = pci_alloc_irq_vectors_affinity(vp_dev->pci_dev, nvectors,
-                        nvectors, flags, desc);
-        if (err < 0) {
-                /* Fallback to one vector for config, one shared for queues. */
-                shared = true;
-                err = pci_alloc_irq_vectors(vp_dev->pci_dev, 2, 2,
-                                PCI_IRQ_MSIX);
-                if (err < 0)
-                        return err;
-        }
-        if (err < 0)
-                return err;
-
-        vp_dev->msix_vectors = nvectors;
-        vp_dev->msix_names = kmalloc_array(nvectors,
-                        sizeof(*vp_dev->msix_names), GFP_KERNEL);
-        if (!vp_dev->msix_names)
-                goto out_free_irq_vectors;
-
-        vp_dev->msix_affinity_masks = kcalloc(nvectors,
-                        sizeof(*vp_dev->msix_affinity_masks), GFP_KERNEL);
-        if (!vp_dev->msix_affinity_masks)
-                goto out_free_msix_names;
+        vp_dev->vqs = kcalloc(nvqs, sizeof(*vp_dev->vqs), GFP_KERNEL);
+        if (!vp_dev->vqs)
+                return -ENOMEM;
 
-        for (i = 0; i < nvectors; ++i) {
-                if (!alloc_cpumask_var(&vp_dev->msix_affinity_masks[i],
-                                GFP_KERNEL))
-                        goto out_free_msix_affinity_masks;
+        if (per_vq_vectors) {
+                /* Best option: one for change interrupt, one per vq. */
+                nvectors = 1;
+                for (i = 0; i < nvqs; ++i)
+                        if (callbacks[i])
+                                ++nvectors;
+        } else {
+                /* Second best: one for change, shared for all vqs. */
+                nvectors = 2;
         }
 
-        /* Set the vector used for configuration */
-        snprintf(vp_dev->msix_names[0], sizeof(*vp_dev->msix_names),
-                 "%s-config", name);
-        err = request_irq(pci_irq_vector(vp_dev->pci_dev, 0), vp_config_changed,
-                        0, vp_dev->msix_names[0], vp_dev);
+        err = vp_request_msix_vectors(vdev, nvectors, per_vq_vectors,
+                                      per_vq_vectors ? desc : NULL);
         if (err)
-                goto out_free_msix_affinity_masks;
+                goto error_find;
 
-        /* Verify we had enough resources to assign the vector */
-        if (vp_dev->config_vector(vp_dev, 0) == VIRTIO_MSI_NO_VECTOR) {
-                err = -EBUSY;
-                goto out_free_config_irq;
-        }
-
-        vp_dev->msix_vector_map = kmalloc_array(nvqs,
-                        sizeof(*vp_dev->msix_vector_map), GFP_KERNEL);
-        if (!vp_dev->msix_vector_map)
-                goto out_disable_config_irq;
-
-        allocated_vectors = j = 1; /* vector 0 is the config interrupt */
+        vp_dev->per_vq_vectors = per_vq_vectors;
+        allocated_vectors = vp_dev->msix_used_vectors;
         for (i = 0; i < nvqs; ++i) {
                 if (!names[i]) {
                         vqs[i] = NULL;
                         continue;
                 }
 
-                if (callbacks[i])
-                        msix_vec = allocated_vectors;
-                else
+                if (!callbacks[i])
                         msix_vec = VIRTIO_MSI_NO_VECTOR;
-
-                vqs[i] = vp_dev->setup_vq(vp_dev, i, callbacks[i], names[i],
-                                msix_vec);
+                else if (vp_dev->per_vq_vectors)
+                        msix_vec = allocated_vectors++;
+                else
+                        msix_vec = VP_MSIX_VQ_VECTOR;
+                vqs[i] = vp_setup_vq(vdev, i, callbacks[i], names[i],
+                                     msix_vec);
                 if (IS_ERR(vqs[i])) {
                         err = PTR_ERR(vqs[i]);
-                        goto out_remove_vqs;
+                        goto error_find;
                 }
 
-                if (msix_vec == VIRTIO_MSI_NO_VECTOR) {
-                        vp_dev->msix_vector_map[i] = VIRTIO_MSI_NO_VECTOR;
+                if (!vp_dev->per_vq_vectors || msix_vec == VIRTIO_MSI_NO_VECTOR)
                         continue;
-                }
 
-                snprintf(vp_dev->msix_names[j],
-                         sizeof(*vp_dev->msix_names), "%s-%s",
+                /* allocate per-vq irq if available and necessary */
+                snprintf(vp_dev->msix_names[msix_vec],
+                         sizeof *vp_dev->msix_names,
+                         "%s-%s",
                          dev_name(&vp_dev->vdev.dev), names[i]);
                 err = request_irq(pci_irq_vector(vp_dev->pci_dev, msix_vec),
-                                  vring_interrupt, IRQF_SHARED,
-                                  vp_dev->msix_names[j], vqs[i]);
-                if (err) {
-                        /* don't free this irq on error */
-                        vp_dev->msix_vector_map[i] = VIRTIO_MSI_NO_VECTOR;
-                        goto out_remove_vqs;
-                }
-                vp_dev->msix_vector_map[i] = msix_vec;
-                j++;
-
-                /*
-                 * Use a different vector for each queue if they are available,
-                 * else share the same vector for all VQs.
-                 */
-                if (!shared)
-                        allocated_vectors++;
+                                  vring_interrupt, 0,
+                                  vp_dev->msix_names[msix_vec],
+                                  vqs[i]);
+                if (err)
+                        goto error_find;
         }
-
         return 0;
 
-out_remove_vqs:
-        vp_remove_vqs(vdev);
-        kfree(vp_dev->msix_vector_map);
-out_disable_config_irq:
-        vp_dev->config_vector(vp_dev, VIRTIO_MSI_NO_VECTOR);
-out_free_config_irq:
-        free_irq(pci_irq_vector(vp_dev->pci_dev, 0), vp_dev);
-out_free_msix_affinity_masks:
-        for (i = 0; i < nvectors; i++) {
-                if (vp_dev->msix_affinity_masks[i])
-                        free_cpumask_var(vp_dev->msix_affinity_masks[i]);
-        }
-        kfree(vp_dev->msix_affinity_masks);
-out_free_msix_names:
-        kfree(vp_dev->msix_names);
-out_free_irq_vectors:
-        pci_free_irq_vectors(vp_dev->pci_dev);
+error_find:
+        vp_del_vqs(vdev);
         return err;
 }
 
@@ -287,29 +350,33 @@ static int vp_find_vqs_intx(struct virtio_device *vdev, unsigned nvqs,
         struct virtio_pci_device *vp_dev = to_vp_device(vdev);
         int i, err;
 
+        vp_dev->vqs = kcalloc(nvqs, sizeof(*vp_dev->vqs), GFP_KERNEL);
+        if (!vp_dev->vqs)
+                return -ENOMEM;
+
         err = request_irq(vp_dev->pci_dev->irq, vp_interrupt, IRQF_SHARED,
                         dev_name(&vdev->dev), vp_dev);
         if (err)
-                return err;
+                goto out_del_vqs;
 
+        vp_dev->intx_enabled = 1;
+        vp_dev->per_vq_vectors = false;
         for (i = 0; i < nvqs; ++i) {
                 if (!names[i]) {
                         vqs[i] = NULL;
                         continue;
                 }
-                vqs[i] = vp_dev->setup_vq(vp_dev, i, callbacks[i], names[i],
-                                VIRTIO_MSI_NO_VECTOR);
+                vqs[i] = vp_setup_vq(vdev, i, callbacks[i], names[i],
+                                     VIRTIO_MSI_NO_VECTOR);
                 if (IS_ERR(vqs[i])) {
                         err = PTR_ERR(vqs[i]);
-                        goto out_remove_vqs;
+                        goto out_del_vqs;
                 }
         }
 
         return 0;
-
-out_remove_vqs:
-        vp_remove_vqs(vdev);
-        free_irq(pci_irq_vector(vp_dev->pci_dev, 0), vp_dev);
+out_del_vqs:
+        vp_del_vqs(vdev);
         return err;
 }
 
@@ -320,9 +387,15 @@ int vp_find_vqs(struct virtio_device *vdev, unsigned nvqs,
 {
         int err;
 
-        err = vp_find_vqs_msix(vdev, nvqs, vqs, callbacks, names, desc);
+        /* Try MSI-X with one vector per queue. */
+        err = vp_find_vqs_msix(vdev, nvqs, vqs, callbacks, names, true, desc);
         if (!err)
                 return 0;
+        /* Fallback: MSI-X with one vector for config, one shared for queues. */
+        err = vp_find_vqs_msix(vdev, nvqs, vqs, callbacks, names, false, desc);
+        if (!err)
+                return 0;
+        /* Finally fall back to regular interrupts. */
         return vp_find_vqs_intx(vdev, nvqs, vqs, callbacks, names);
 }
 
@@ -342,15 +415,16 @@ int vp_set_vq_affinity(struct virtqueue *vq, int cpu)
 {
         struct virtio_device *vdev = vq->vdev;
         struct virtio_pci_device *vp_dev = to_vp_device(vdev);
+        struct virtio_pci_vq_info *info = vp_dev->vqs[vq->index];
+        struct cpumask *mask;
+        unsigned int irq;
 
         if (!vq->callback)
                 return -EINVAL;
 
-        if (vp_dev->pci_dev->msix_enabled) {
-                int vec = vp_dev->msix_vector_map[vq->index];
-                struct cpumask *mask = vp_dev->msix_affinity_masks[vec];
-                unsigned int irq = pci_irq_vector(vp_dev->pci_dev, vec);
-
+        if (vp_dev->msix_enabled) {
+                mask = vp_dev->msix_affinity_masks[info->msix_vector];
+                irq = pci_irq_vector(vp_dev->pci_dev, info->msix_vector);
                 if (cpu == -1)
                         irq_set_affinity_hint(irq, NULL);
                 else {
@@ -365,12 +439,13 @@ int vp_set_vq_affinity(struct virtqueue *vq, int cpu)
 const struct cpumask *vp_get_vq_affinity(struct virtio_device *vdev, int index)
 {
         struct virtio_pci_device *vp_dev = to_vp_device(vdev);
-        unsigned int *map = vp_dev->msix_vector_map;
 
-        if (!map || map[index] == VIRTIO_MSI_NO_VECTOR)
+        if (!vp_dev->per_vq_vectors ||
+            vp_dev->vqs[index]->msix_vector == VIRTIO_MSI_NO_VECTOR)
                 return NULL;
 
-        return pci_irq_get_affinity(vp_dev->pci_dev, map[index]);
+        return pci_irq_get_affinity(vp_dev->pci_dev,
+                                    vp_dev->vqs[index]->msix_vector);
 }
 
 #ifdef CONFIG_PM_SLEEP
@@ -441,6 +516,8 @@ static int virtio_pci_probe(struct pci_dev *pci_dev,
         vp_dev->vdev.dev.parent = &pci_dev->dev;
         vp_dev->vdev.dev.release = virtio_pci_release_dev;
         vp_dev->pci_dev = pci_dev;
+        INIT_LIST_HEAD(&vp_dev->virtqueues);
+        spin_lock_init(&vp_dev->lock);
 
         /* enable the device */
         rc = pci_enable_device(pci_dev);
diff --git a/drivers/virtio/virtio_pci_common.h b/drivers/virtio/virtio_pci_common.h
index ac8c9d788964..e96334aec1e0 100644
--- a/drivers/virtio/virtio_pci_common.h
+++ b/drivers/virtio/virtio_pci_common.h
@@ -31,6 +31,17 @@
 #include <linux/highmem.h>
 #include <linux/spinlock.h>
 
+struct virtio_pci_vq_info {
+        /* the actual virtqueue */
+        struct virtqueue *vq;
+
+        /* the list node for the virtqueues list */
+        struct list_head node;
+
+        /* MSI-X vector (or none) */
+        unsigned msix_vector;
+};
+
 /* Our device structure */
 struct virtio_pci_device {
         struct virtio_device vdev;
@@ -64,25 +75,47 @@ struct virtio_pci_device {
         /* the IO mapping for the PCI config space */
         void __iomem *ioaddr;
 
+        /* a list of queues so we can dispatch IRQs */
+        spinlock_t lock;
+        struct list_head virtqueues;
+
+        /* array of all queues for house-keeping */
+        struct virtio_pci_vq_info **vqs;
+
+        /* MSI-X support */
+        int msix_enabled;
+        int intx_enabled;
         cpumask_var_t *msix_affinity_masks;
         /* Name strings for interrupts. This size should be enough,
          * and I'm too lazy to allocate each name separately. */
         char (*msix_names)[256];
-        /* Total Number of MSI-X vectors (including per-VQ ones). */
-        int msix_vectors;
-        /* Map of per-VQ MSI-X vectors, may be NULL */
-        unsigned *msix_vector_map;
+        /* Number of available vectors */
+        unsigned msix_vectors;
+        /* Vectors allocated, excluding per-vq vectors if any */
+        unsigned msix_used_vectors;
+
+        /* Whether we have vector per vq */
+        bool per_vq_vectors;
 
         struct virtqueue *(*setup_vq)(struct virtio_pci_device *vp_dev,
+                                      struct virtio_pci_vq_info *info,
                                       unsigned idx,
                                       void (*callback)(struct virtqueue *vq),
                                       const char *name,
                                       u16 msix_vec);
-        void (*del_vq)(struct virtqueue *vq);
+        void (*del_vq)(struct virtio_pci_vq_info *info);
 
         u16 (*config_vector)(struct virtio_pci_device *vp_dev, u16 vector);
 };
 
+/* Constants for MSI-X */
+/* Use first vector for configuration changes, second and the rest for
+ * virtqueues Thus, we need at least 2 vectors for MSI. */
+enum {
+        VP_MSIX_CONFIG_VECTOR = 0,
+        VP_MSIX_VQ_VECTOR = 1,
+};
+
 /* Convert a generic virtio device to our structure */
 static struct virtio_pci_device *to_vp_device(struct virtio_device *vdev)
 {
diff --git a/drivers/virtio/virtio_pci_legacy.c b/drivers/virtio/virtio_pci_legacy.c
index f7362c5fe18a..4bfa48fb1324 100644
--- a/drivers/virtio/virtio_pci_legacy.c
+++ b/drivers/virtio/virtio_pci_legacy.c
@@ -112,6 +112,7 @@ static u16 vp_config_vector(struct virtio_pci_device *vp_dev, u16 vector)
 }
 
 static struct virtqueue *setup_vq(struct virtio_pci_device *vp_dev,
+                                  struct virtio_pci_vq_info *info,
                                   unsigned index,
                                   void (*callback)(struct virtqueue *vq),
                                   const char *name,
@@ -129,6 +130,8 @@ static struct virtqueue *setup_vq(struct virtio_pci_device *vp_dev,
         if (!num || ioread32(vp_dev->ioaddr + VIRTIO_PCI_QUEUE_PFN))
                 return ERR_PTR(-ENOENT);
 
+        info->msix_vector = msix_vec;
+
         /* create the vring */
         vq = vring_create_virtqueue(index, num,
                                     VIRTIO_PCI_VRING_ALIGN, &vp_dev->vdev,
@@ -159,13 +162,14 @@ out_deactivate:
         return ERR_PTR(err);
 }
 
-static void del_vq(struct virtqueue *vq)
+static void del_vq(struct virtio_pci_vq_info *info)
 {
+        struct virtqueue *vq = info->vq;
         struct virtio_pci_device *vp_dev = to_vp_device(vq->vdev);
 
         iowrite16(vq->index, vp_dev->ioaddr + VIRTIO_PCI_QUEUE_SEL);
 
-        if (vp_dev->pci_dev->msix_enabled) {
+        if (vp_dev->msix_enabled) {
                 iowrite16(VIRTIO_MSI_NO_VECTOR,
                           vp_dev->ioaddr + VIRTIO_MSI_QUEUE_VECTOR);
                 /* Flush the write out to device */
diff --git a/drivers/virtio/virtio_pci_modern.c b/drivers/virtio/virtio_pci_modern.c
index 7bc3004b840e..8978f109d2d7 100644
--- a/drivers/virtio/virtio_pci_modern.c
+++ b/drivers/virtio/virtio_pci_modern.c
@@ -293,6 +293,7 @@ static u16 vp_config_vector(struct virtio_pci_device *vp_dev, u16 vector)
 }
 
 static struct virtqueue *setup_vq(struct virtio_pci_device *vp_dev,
+                                  struct virtio_pci_vq_info *info,
                                   unsigned index,
                                   void (*callback)(struct virtqueue *vq),
                                   const char *name,
@@ -322,6 +323,8 @@ static struct virtqueue *setup_vq(struct virtio_pci_device *vp_dev,
         /* get offset of notification word for this vq */
         off = vp_ioread16(&cfg->queue_notify_off);
 
+        info->msix_vector = msix_vec;
+
         /* create the vring */
         vq = vring_create_virtqueue(index, num,
                                     SMP_CACHE_BYTES, &vp_dev->vdev,
@@ -405,13 +408,14 @@ static int vp_modern_find_vqs(struct virtio_device *vdev, unsigned nvqs,
         return 0;
 }
 
-static void del_vq(struct virtqueue *vq)
+static void del_vq(struct virtio_pci_vq_info *info)
 {
+        struct virtqueue *vq = info->vq;
         struct virtio_pci_device *vp_dev = to_vp_device(vq->vdev);
 
         vp_iowrite16(vq->index, &vp_dev->common->queue_select);
 
-        if (vp_dev->pci_dev->msix_enabled) {
+        if (vp_dev->msix_enabled) {
                 vp_iowrite16(VIRTIO_MSI_NO_VECTOR,
                              &vp_dev->common->queue_msix_vector);
                 /* Flush the write out to device */