Merge drm-fixes into drm-next.

Nouveau wanted this to avoid some worse conflicts when I merge that.

451 files changed, 5657 insertions, 3968 deletions

diff --git a/drivers/acpi/acpica/psargs.c b/drivers/acpi/acpica/psargs.c
index 305218539df2..d48cbed342c1 100644
--- a/drivers/acpi/acpica/psargs.c
+++ b/drivers/acpi/acpica/psargs.c
@@ -269,8 +269,7 @@ acpi_ps_get_next_namepath(struct acpi_walk_state *walk_state,
          */
         if (ACPI_SUCCESS(status) &&
             possible_method_call && (node->type == ACPI_TYPE_METHOD)) {
-                if (GET_CURRENT_ARG_TYPE(walk_state->arg_types) ==
-                    ARGP_SUPERNAME) {
+                if (walk_state->opcode == AML_UNLOAD_OP) {
                         /*
                          * acpi_ps_get_next_namestring has increased the AML pointer,
                          * so we need to restore the saved AML pointer for method call.
@@ -697,7 +696,7 @@ static union acpi_parse_object *acpi_ps_get_next_field(struct acpi_parse_state
  *
  * PARAMETERS:  walk_state          - Current state
  *              parser_state        - Current parser state object
- *              arg_type            - The parser argument type (ARGP_*)
+ *              arg_type            - The argument type (AML_*_ARG)
  *              return_arg          - Where the next arg is returned
  *
  * RETURN:      Status, and an op object containing the next argument.
@@ -817,9 +816,9 @@ acpi_ps_get_next_arg(struct acpi_walk_state *walk_state,
                                 return_ACPI_STATUS(AE_NO_MEMORY);
                         }
 
-                        /* super_name allows argument to be a method call */
+                        /* To support super_name arg of Unload */
 
-                        if (arg_type == ARGP_SUPERNAME) {
+                        if (walk_state->opcode == AML_UNLOAD_OP) {
                                 status =
                                     acpi_ps_get_next_namepath(walk_state,
                                                               parser_state, arg,
diff --git a/drivers/acpi/nfit.c b/drivers/acpi/nfit.c
index ad6d8c6b777e..35947ac87644 100644
--- a/drivers/acpi/nfit.c
+++ b/drivers/acpi/nfit.c
@@ -469,37 +469,16 @@ static void nfit_mem_find_spa_bdw(struct acpi_nfit_desc *acpi_desc,
         nfit_mem->bdw = NULL;
 }
 
-static int nfit_mem_add(struct acpi_nfit_desc *acpi_desc,
+static void nfit_mem_init_bdw(struct acpi_nfit_desc *acpi_desc,
                 struct nfit_mem *nfit_mem, struct acpi_nfit_system_address *spa)
 {
         u16 dcr = __to_nfit_memdev(nfit_mem)->region_index;
         struct nfit_memdev *nfit_memdev;
         struct nfit_flush *nfit_flush;
-        struct nfit_dcr *nfit_dcr;
         struct nfit_bdw *nfit_bdw;
         struct nfit_idt *nfit_idt;
         u16 idt_idx, range_index;
 
-        list_for_each_entry(nfit_dcr, &acpi_desc->dcrs, list) {
-                if (nfit_dcr->dcr->region_index != dcr)
-                        continue;
-                nfit_mem->dcr = nfit_dcr->dcr;
-                break;
-        }
-
-        if (!nfit_mem->dcr) {
-                dev_dbg(acpi_desc->dev, "SPA %d missing:%s%s\n",
-                                spa->range_index, __to_nfit_memdev(nfit_mem)
-                                ? "" : " MEMDEV", nfit_mem->dcr ? "" : " DCR");
-                return -ENODEV;
-        }
-
-        /*
-         * We've found enough to create an nvdimm, optionally
-         * find an associated BDW
-         */
-        list_add(&nfit_mem->list, &acpi_desc->dimms);
-
         list_for_each_entry(nfit_bdw, &acpi_desc->bdws, list) {
                 if (nfit_bdw->bdw->region_index != dcr)
                         continue;
@@ -508,12 +487,12 @@ static int nfit_mem_add(struct acpi_nfit_desc *acpi_desc,
         }
 
         if (!nfit_mem->bdw)
-                return 0;
+                return;
 
         nfit_mem_find_spa_bdw(acpi_desc, nfit_mem);
 
         if (!nfit_mem->spa_bdw)
-                return 0;
+                return;
 
         range_index = nfit_mem->spa_bdw->range_index;
         list_for_each_entry(nfit_memdev, &acpi_desc->memdevs, list) {
@@ -538,8 +517,6 @@ static int nfit_mem_add(struct acpi_nfit_desc *acpi_desc,
                 }
                 break;
         }
-
-        return 0;
 }
 
 static int nfit_mem_dcr_init(struct acpi_nfit_desc *acpi_desc,
@@ -548,7 +525,6 @@ static int nfit_mem_dcr_init(struct acpi_nfit_desc *acpi_desc,
         struct nfit_mem *nfit_mem, *found;
         struct nfit_memdev *nfit_memdev;
         int type = nfit_spa_type(spa);
-        u16 dcr;
 
         switch (type) {
         case NFIT_SPA_DCR:
@@ -559,14 +535,18 @@ static int nfit_mem_dcr_init(struct acpi_nfit_desc *acpi_desc,
         }
 
         list_for_each_entry(nfit_memdev, &acpi_desc->memdevs, list) {
-                int rc;
+                struct nfit_dcr *nfit_dcr;
+                u32 device_handle;
+                u16 dcr;
 
                 if (nfit_memdev->memdev->range_index != spa->range_index)
                         continue;
                 found = NULL;
                 dcr = nfit_memdev->memdev->region_index;
+                device_handle = nfit_memdev->memdev->device_handle;
                 list_for_each_entry(nfit_mem, &acpi_desc->dimms, list)
-                        if (__to_nfit_memdev(nfit_mem)->region_index == dcr) {
+                        if (__to_nfit_memdev(nfit_mem)->device_handle
+                                        == device_handle) {
                                 found = nfit_mem;
                                 break;
                         }
@@ -579,6 +559,31 @@ static int nfit_mem_dcr_init(struct acpi_nfit_desc *acpi_desc,
                         if (!nfit_mem)
                                 return -ENOMEM;
                         INIT_LIST_HEAD(&nfit_mem->list);
+                        list_add(&nfit_mem->list, &acpi_desc->dimms);
+                }
+
+                list_for_each_entry(nfit_dcr, &acpi_desc->dcrs, list) {
+                        if (nfit_dcr->dcr->region_index != dcr)
+                                continue;
+                        /*
+                         * Record the control region for the dimm.  For
+                         * the ACPI 6.1 case, where there are separate
+                         * control regions for the pmem vs blk
+                         * interfaces, be sure to record the extended
+                         * blk details.
+                         */
+                        if (!nfit_mem->dcr)
+                                nfit_mem->dcr = nfit_dcr->dcr;
+                        else if (nfit_mem->dcr->windows == 0
+                                        && nfit_dcr->dcr->windows)
+                                nfit_mem->dcr = nfit_dcr->dcr;
+                        break;
+                }
+
+                if (dcr && !nfit_mem->dcr) {
+                        dev_err(acpi_desc->dev, "SPA %d missing DCR %d\n",
+                                        spa->range_index, dcr);
+                        return -ENODEV;
                 }
 
                 if (type == NFIT_SPA_DCR) {
@@ -595,6 +600,7 @@ static int nfit_mem_dcr_init(struct acpi_nfit_desc *acpi_desc,
                                 nfit_mem->idt_dcr = nfit_idt->idt;
                                 break;
                         }
+                        nfit_mem_init_bdw(acpi_desc, nfit_mem, spa);
                 } else {
                         /*
                          * A single dimm may belong to multiple SPA-PM
@@ -603,13 +609,6 @@ static int nfit_mem_dcr_init(struct acpi_nfit_desc *acpi_desc,
                          */
                         nfit_mem->memdev_pmem = nfit_memdev->memdev;
                 }
-
-                if (found)
-                        continue;
-
-                rc = nfit_mem_add(acpi_desc, nfit_mem, spa);
-                if (rc)
-                        return rc;
         }
 
         return 0;
@@ -1504,9 +1503,7 @@ static int ars_do_start(struct nvdimm_bus_descriptor *nd_desc,
                 case 1:
                         /* ARS unsupported, but we should never get here */
                         return 0;
-                case 2:
-                        return -EINVAL;
-                case 3:
+                case 6:
                         /* ARS is in progress */
                         msleep(1000);
                         break;
@@ -1517,13 +1514,13 @@ static int ars_do_start(struct nvdimm_bus_descriptor *nd_desc,
 }
 
 static int ars_get_status(struct nvdimm_bus_descriptor *nd_desc,
-                struct nd_cmd_ars_status *cmd)
+                struct nd_cmd_ars_status *cmd, u32 size)
 {
         int rc;
 
         while (1) {
                 rc = nd_desc->ndctl(nd_desc, NULL, ND_CMD_ARS_STATUS, cmd,
-                        sizeof(*cmd));
+                        size);
                 if (rc || cmd->status & 0xffff)
                         return -ENXIO;
 
@@ -1538,6 +1535,8 @@ static int ars_get_status(struct nvdimm_bus_descriptor *nd_desc,
                 case 2:
                         /* No ARS performed for the current boot */
                         return 0;
+                case 3:
+                        /* TODO: error list overflow support */
                 default:
                         return -ENXIO;
                 }
@@ -1581,6 +1580,7 @@ static int acpi_nfit_find_poison(struct acpi_nfit_desc *acpi_desc,
         struct nd_cmd_ars_start *ars_start = NULL;
         struct nd_cmd_ars_cap *ars_cap = NULL;
         u64 start, len, cur, remaining;
+        u32 ars_status_size;
         int rc;
 
         ars_cap = kzalloc(sizeof(*ars_cap), GFP_KERNEL);
@@ -1590,14 +1590,21 @@ static int acpi_nfit_find_poison(struct acpi_nfit_desc *acpi_desc,
         start = ndr_desc->res->start;
         len = ndr_desc->res->end - ndr_desc->res->start + 1;
 
+        /*
+         * If ARS is unimplemented, unsupported, or if the 'Persistent Memory
+         * Scrub' flag in extended status is not set, skip this but continue
+         * initialization
+         */
         rc = ars_get_cap(nd_desc, ars_cap, start, len);
+        if (rc == -ENOTTY) {
+                dev_dbg(acpi_desc->dev,
+                        "Address Range Scrub is not implemented, won't create an error list\n");
+                rc = 0;
+                goto out;
+        }
         if (rc)
                 goto out;
 
-        /*
-         * If ARS is unsupported, or if the 'Persistent Memory Scrub' flag in
-         * extended status is not set, skip this but continue initialization
-         */
         if ((ars_cap->status & 0xffff) ||
                 !(ars_cap->status >> 16 & ND_ARS_PERSISTENT)) {
                 dev_warn(acpi_desc->dev,
@@ -1610,14 +1617,14 @@ static int acpi_nfit_find_poison(struct acpi_nfit_desc *acpi_desc,
          * Check if a full-range ARS has been run. If so, use those results
          * without having to start a new ARS.
          */
-        ars_status = kzalloc(ars_cap->max_ars_out + sizeof(*ars_status),
-                        GFP_KERNEL);
+        ars_status_size = ars_cap->max_ars_out;
+        ars_status = kzalloc(ars_status_size, GFP_KERNEL);
         if (!ars_status) {
                 rc = -ENOMEM;
                 goto out;
         }
 
-        rc = ars_get_status(nd_desc, ars_status);
+        rc = ars_get_status(nd_desc, ars_status, ars_status_size);
         if (rc)
                 goto out;
 
@@ -1647,7 +1654,7 @@ static int acpi_nfit_find_poison(struct acpi_nfit_desc *acpi_desc,
                 if (rc)
                         goto out;
 
-                rc = ars_get_status(nd_desc, ars_status);
+                rc = ars_get_status(nd_desc, ars_status, ars_status_size);
                 if (rc)
                         goto out;
 
diff --git a/drivers/acpi/pci_irq.c b/drivers/acpi/pci_irq.c
index d30184c7f3bc..c8e169e46673 100644
--- a/drivers/acpi/pci_irq.c
+++ b/drivers/acpi/pci_irq.c
@@ -406,7 +406,7 @@ int acpi_pci_irq_enable(struct pci_dev *dev)
                 return 0;
         }
 
-        if (pci_has_managed_irq(dev))
+        if (dev->irq_managed && dev->irq > 0)
                 return 0;
 
         entry = acpi_pci_irq_lookup(dev, pin);
@@ -451,7 +451,8 @@ int acpi_pci_irq_enable(struct pci_dev *dev)
                 kfree(entry);
                 return rc;
         }
-        pci_set_managed_irq(dev, rc);
+        dev->irq = rc;
+        dev->irq_managed = 1;
 
         if (link)
                 snprintf(link_desc, sizeof(link_desc), " -> Link[%s]", link);
@@ -474,9 +475,17 @@ void acpi_pci_irq_disable(struct pci_dev *dev)
         u8 pin;
 
         pin = dev->pin;
-        if (!pin || !pci_has_managed_irq(dev))
+        if (!pin || !dev->irq_managed || dev->irq <= 0)
                 return;
 
+        /* Keep IOAPIC pin configuration when suspending */
+        if (dev->dev.power.is_prepared)
+                return;
+#ifdef  CONFIG_PM
+        if (dev->dev.power.runtime_status == RPM_SUSPENDING)
+                return;
+#endif
+
         entry = acpi_pci_irq_lookup(dev, pin);
         if (!entry)
                 return;
@@ -496,6 +505,6 @@ void acpi_pci_irq_disable(struct pci_dev *dev)
         dev_dbg(&dev->dev, "PCI INT %c disabled\n", pin_name(pin));
         if (gsi >= 0) {
                 acpi_unregister_gsi(gsi);
-                pci_reset_managed_irq(dev);
+                dev->irq_managed = 0;
         }
 }
diff --git a/drivers/acpi/pci_link.c b/drivers/acpi/pci_link.c
index fa2863567eed..ededa909df2f 100644
--- a/drivers/acpi/pci_link.c
+++ b/drivers/acpi/pci_link.c
@@ -4,7 +4,6 @@
  *  Copyright (C) 2001, 2002 Andy Grover <andrew.grover@intel.com>
  *  Copyright (C) 2001, 2002 Paul Diefenbaugh <paul.s.diefenbaugh@intel.com>
  *  Copyright (C) 2002       Dominik Brodowski <devel@brodo.de>
- *  Copyright (c) 2015, The Linux Foundation. All rights reserved.
  *
  * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  *
@@ -438,6 +437,7 @@ static int acpi_pci_link_set(struct acpi_pci_link *link, int irq)
  * enabled system.
  */
 
+#define ACPI_MAX_IRQS           256
 #define ACPI_MAX_ISA_IRQ        16
 
 #define PIRQ_PENALTY_PCI_AVAILABLE      (0)
@@ -447,7 +447,7 @@ static int acpi_pci_link_set(struct acpi_pci_link *link, int irq)
 #define PIRQ_PENALTY_ISA_USED           (16*16*16*16*16)
 #define PIRQ_PENALTY_ISA_ALWAYS         (16*16*16*16*16*16)
 
-static int acpi_irq_isa_penalty[ACPI_MAX_ISA_IRQ] = {
+static int acpi_irq_penalty[ACPI_MAX_IRQS] = {
         PIRQ_PENALTY_ISA_ALWAYS,        /* IRQ0 timer */
         PIRQ_PENALTY_ISA_ALWAYS,        /* IRQ1 keyboard */
         PIRQ_PENALTY_ISA_ALWAYS,        /* IRQ2 cascade */
@@ -464,68 +464,9 @@ static int acpi_irq_isa_penalty[ACPI_MAX_ISA_IRQ] = {
         PIRQ_PENALTY_ISA_USED,          /* IRQ13 fpe, sometimes */
         PIRQ_PENALTY_ISA_USED,          /* IRQ14 ide0 */
         PIRQ_PENALTY_ISA_USED,          /* IRQ15 ide1 */
+        /* >IRQ15 */
 };
 
-struct irq_penalty_info {
-        int irq;
-        int penalty;
-        struct list_head node;
-};
-
-static LIST_HEAD(acpi_irq_penalty_list);
-
-static int acpi_irq_get_penalty(int irq)
-{
-        struct irq_penalty_info *irq_info;
-
-        if (irq < ACPI_MAX_ISA_IRQ)
-                return acpi_irq_isa_penalty[irq];
-
-        list_for_each_entry(irq_info, &acpi_irq_penalty_list, node) {
-                if (irq_info->irq == irq)
-                        return irq_info->penalty;
-        }
-
-        return 0;
-}
-
-static int acpi_irq_set_penalty(int irq, int new_penalty)
-{
-        struct irq_penalty_info *irq_info;
-
-        /* see if this is a ISA IRQ */
-        if (irq < ACPI_MAX_ISA_IRQ) {
-                acpi_irq_isa_penalty[irq] = new_penalty;
-                return 0;
-        }
-
-        /* next, try to locate from the dynamic list */
-        list_for_each_entry(irq_info, &acpi_irq_penalty_list, node) {
-                if (irq_info->irq == irq) {
-                        irq_info->penalty  = new_penalty;
-                        return 0;
-                }
-        }
-
-        /* nope, let's allocate a slot for this IRQ */
-        irq_info = kzalloc(sizeof(*irq_info), GFP_KERNEL);
-        if (!irq_info)
-                return -ENOMEM;
-
-        irq_info->irq = irq;
-        irq_info->penalty = new_penalty;
-        list_add_tail(&irq_info->node, &acpi_irq_penalty_list);
-
-        return 0;
-}
-
-static void acpi_irq_add_penalty(int irq, int penalty)
-{
-        int curpen = acpi_irq_get_penalty(irq);
-
-        acpi_irq_set_penalty(irq, curpen + penalty);
-}
-
 int __init acpi_irq_penalty_init(void)
 {
         struct acpi_pci_link *link;
@@ -546,16 +487,15 @@ int __init acpi_irq_penalty_init(void)
                             link->irq.possible_count;
 
                         for (i = 0; i < link->irq.possible_count; i++) {
-                                if (link->irq.possible[i] < ACPI_MAX_ISA_IRQ) {
-                                        int irqpos = link->irq.possible[i];
-
-                                        acpi_irq_add_penalty(irqpos, penalty);
-                                }
+                                if (link->irq.possible[i] < ACPI_MAX_ISA_IRQ)
+                                        acpi_irq_penalty[link->irq.
+                                                         possible[i]] +=
+                                            penalty;
                         }
 
                 } else if (link->irq.active) {
-                        acpi_irq_add_penalty(link->irq.active,
-                                             PIRQ_PENALTY_PCI_POSSIBLE);
+                        acpi_irq_penalty[link->irq.active] +=
+                            PIRQ_PENALTY_PCI_POSSIBLE;
                 }
         }
 
@@ -607,12 +547,12 @@ static int acpi_pci_link_allocate(struct acpi_pci_link *link)
                  * the use of IRQs 9, 10, 11, and >15.
                  */
                 for (i = (link->irq.possible_count - 1); i >= 0; i--) {
-                        if (acpi_irq_get_penalty(irq) >
-                            acpi_irq_get_penalty(link->irq.possible[i]))
+                        if (acpi_irq_penalty[irq] >
+                            acpi_irq_penalty[link->irq.possible[i]])
                                 irq = link->irq.possible[i];
                 }
         }
-        if (acpi_irq_get_penalty(irq) >= PIRQ_PENALTY_ISA_ALWAYS) {
+        if (acpi_irq_penalty[irq] >= PIRQ_PENALTY_ISA_ALWAYS) {
                 printk(KERN_ERR PREFIX "No IRQ available for %s [%s]. "
                             "Try pci=noacpi or acpi=off\n",
                             acpi_device_name(link->device),
@@ -628,8 +568,7 @@ static int acpi_pci_link_allocate(struct acpi_pci_link *link)
                             acpi_device_bid(link->device));
                 return -ENODEV;
         } else {
-                acpi_irq_add_penalty(link->irq.active, PIRQ_PENALTY_PCI_USING);
-
+                acpi_irq_penalty[link->irq.active] += PIRQ_PENALTY_PCI_USING;
                 printk(KERN_WARNING PREFIX "%s [%s] enabled at IRQ %d\n",
                        acpi_device_name(link->device),
                        acpi_device_bid(link->device), link->irq.active);
@@ -839,7 +778,7 @@ static void acpi_pci_link_remove(struct acpi_device *device)
 }
 
 /*
- * modify penalty from cmdline
+ * modify acpi_irq_penalty[] from cmdline
  */
 static int __init acpi_irq_penalty_update(char *str, int used)
 {
@@ -857,10 +796,13 @@ static int __init acpi_irq_penalty_update(char *str, int used)
                 if (irq < 0)
                         continue;
 
+                if (irq >= ARRAY_SIZE(acpi_irq_penalty))
+                        continue;
+
                 if (used)
-                        acpi_irq_add_penalty(irq, PIRQ_PENALTY_ISA_USED);
+                        acpi_irq_penalty[irq] += PIRQ_PENALTY_ISA_USED;
                 else
-                        acpi_irq_set_penalty(irq, PIRQ_PENALTY_PCI_AVAILABLE);
+                        acpi_irq_penalty[irq] = PIRQ_PENALTY_PCI_AVAILABLE;
 
                 if (retval != 2)        /* no next number */
                         break;
@@ -877,15 +819,18 @@ static int __init acpi_irq_penalty_update(char *str, int used)
  */
 void acpi_penalize_isa_irq(int irq, int active)
 {
-        if (irq >= 0)
-                acpi_irq_add_penalty(irq, active ?
-                        PIRQ_PENALTY_ISA_USED : PIRQ_PENALTY_PCI_USING);
+        if (irq >= 0 && irq < ARRAY_SIZE(acpi_irq_penalty)) {
+                if (active)
+                        acpi_irq_penalty[irq] += PIRQ_PENALTY_ISA_USED;
+                else
+                        acpi_irq_penalty[irq] += PIRQ_PENALTY_PCI_USING;
+        }
 }
 
 bool acpi_isa_irq_available(int irq)
 {
-        return irq >= 0 &&
-                (acpi_irq_get_penalty(irq) < PIRQ_PENALTY_ISA_ALWAYS);
+        return irq >= 0 && (irq >= ARRAY_SIZE(acpi_irq_penalty) ||
+                            acpi_irq_penalty[irq] < PIRQ_PENALTY_ISA_ALWAYS);
 }
 
 /*
@@ -895,18 +840,13 @@ bool acpi_isa_irq_available(int irq)
  */
 void acpi_penalize_sci_irq(int irq, int trigger, int polarity)
 {
-        int penalty;
-
-        if (irq < 0)
-                return;
-
-        if (trigger != ACPI_MADT_TRIGGER_LEVEL ||
-            polarity != ACPI_MADT_POLARITY_ACTIVE_LOW)
-                penalty = PIRQ_PENALTY_ISA_ALWAYS;
-        else
-                penalty = PIRQ_PENALTY_PCI_USING;
-
-        acpi_irq_add_penalty(irq, penalty);
+        if (irq >= 0 && irq < ARRAY_SIZE(acpi_irq_penalty)) {
+                if (trigger != ACPI_MADT_TRIGGER_LEVEL ||
+                    polarity != ACPI_MADT_POLARITY_ACTIVE_LOW)
+                        acpi_irq_penalty[irq] += PIRQ_PENALTY_ISA_ALWAYS;
+                else
+                        acpi_irq_penalty[irq] += PIRQ_PENALTY_PCI_USING;
+        }
 }
 
 /*
diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index a39e85f9efa9..7d00b7a015ea 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -2074,7 +2074,7 @@ static int binder_thread_write(struct binder_proc *proc,
                         if (get_user(cookie, (binder_uintptr_t __user *)ptr))
                                 return -EFAULT;
 
-                        ptr += sizeof(void *);
+                        ptr += sizeof(cookie);
                         list_for_each_entry(w, &proc->delivered_death, entry) {
                                 struct binder_ref_death *tmp_death = container_of(w, struct binder_ref_death, work);
 
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index 594fcabd22cd..146dc0b8ec61 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -264,6 +264,26 @@ static const struct pci_device_id ahci_pci_tbl[] = {
         { PCI_VDEVICE(INTEL, 0x3b2b), board_ahci }, /* PCH RAID */
         { PCI_VDEVICE(INTEL, 0x3b2c), board_ahci }, /* PCH RAID */
         { PCI_VDEVICE(INTEL, 0x3b2f), board_ahci }, /* PCH AHCI */
+        { PCI_VDEVICE(INTEL, 0x19b0), board_ahci }, /* DNV AHCI */
+        { PCI_VDEVICE(INTEL, 0x19b1), board_ahci }, /* DNV AHCI */
+        { PCI_VDEVICE(INTEL, 0x19b2), board_ahci }, /* DNV AHCI */
+        { PCI_VDEVICE(INTEL, 0x19b3), board_ahci }, /* DNV AHCI */
+        { PCI_VDEVICE(INTEL, 0x19b4), board_ahci }, /* DNV AHCI */
+        { PCI_VDEVICE(INTEL, 0x19b5), board_ahci }, /* DNV AHCI */
+        { PCI_VDEVICE(INTEL, 0x19b6), board_ahci }, /* DNV AHCI */
+        { PCI_VDEVICE(INTEL, 0x19b7), board_ahci }, /* DNV AHCI */
+        { PCI_VDEVICE(INTEL, 0x19bE), board_ahci }, /* DNV AHCI */
+        { PCI_VDEVICE(INTEL, 0x19bF), board_ahci }, /* DNV AHCI */
+        { PCI_VDEVICE(INTEL, 0x19c0), board_ahci }, /* DNV AHCI */
+        { PCI_VDEVICE(INTEL, 0x19c1), board_ahci }, /* DNV AHCI */
+        { PCI_VDEVICE(INTEL, 0x19c2), board_ahci }, /* DNV AHCI */
+        { PCI_VDEVICE(INTEL, 0x19c3), board_ahci }, /* DNV AHCI */
+        { PCI_VDEVICE(INTEL, 0x19c4), board_ahci }, /* DNV AHCI */
+        { PCI_VDEVICE(INTEL, 0x19c5), board_ahci }, /* DNV AHCI */
+        { PCI_VDEVICE(INTEL, 0x19c6), board_ahci }, /* DNV AHCI */
+        { PCI_VDEVICE(INTEL, 0x19c7), board_ahci }, /* DNV AHCI */
+        { PCI_VDEVICE(INTEL, 0x19cE), board_ahci }, /* DNV AHCI */
+        { PCI_VDEVICE(INTEL, 0x19cF), board_ahci }, /* DNV AHCI */
         { PCI_VDEVICE(INTEL, 0x1c02), board_ahci }, /* CPT AHCI */
         { PCI_VDEVICE(INTEL, 0x1c03), board_ahci }, /* CPT AHCI */
         { PCI_VDEVICE(INTEL, 0x1c04), board_ahci }, /* CPT RAID */
@@ -347,15 +367,21 @@ static const struct pci_device_id ahci_pci_tbl[] = {
         { PCI_VDEVICE(INTEL, 0xa107), board_ahci }, /* Sunrise Point-H RAID */
         { PCI_VDEVICE(INTEL, 0xa10f), board_ahci }, /* Sunrise Point-H RAID */
         { PCI_VDEVICE(INTEL, 0x2822), board_ahci }, /* Lewisburg RAID*/
+        { PCI_VDEVICE(INTEL, 0x2823), board_ahci }, /* Lewisburg AHCI*/
         { PCI_VDEVICE(INTEL, 0x2826), board_ahci }, /* Lewisburg RAID*/
+        { PCI_VDEVICE(INTEL, 0x2827), board_ahci }, /* Lewisburg RAID*/
         { PCI_VDEVICE(INTEL, 0xa182), board_ahci }, /* Lewisburg AHCI*/
         { PCI_VDEVICE(INTEL, 0xa184), board_ahci }, /* Lewisburg RAID*/
         { PCI_VDEVICE(INTEL, 0xa186), board_ahci }, /* Lewisburg RAID*/
         { PCI_VDEVICE(INTEL, 0xa18e), board_ahci }, /* Lewisburg RAID*/
+        { PCI_VDEVICE(INTEL, 0xa1d2), board_ahci }, /* Lewisburg RAID*/
+        { PCI_VDEVICE(INTEL, 0xa1d6), board_ahci }, /* Lewisburg RAID*/
         { PCI_VDEVICE(INTEL, 0xa202), board_ahci }, /* Lewisburg AHCI*/
         { PCI_VDEVICE(INTEL, 0xa204), board_ahci }, /* Lewisburg RAID*/
         { PCI_VDEVICE(INTEL, 0xa206), board_ahci }, /* Lewisburg RAID*/
         { PCI_VDEVICE(INTEL, 0xa20e), board_ahci }, /* Lewisburg RAID*/
+        { PCI_VDEVICE(INTEL, 0xa252), board_ahci }, /* Lewisburg RAID*/
+        { PCI_VDEVICE(INTEL, 0xa256), board_ahci }, /* Lewisburg RAID*/
 
         /* JMicron 360/1/3/5/6, match class to avoid IDE function */
         { PCI_VENDOR_ID_JMICRON, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID,
@@ -1305,6 +1331,44 @@ static inline void ahci_gtf_filter_workaround(struct ata_host *host)
 {}
 #endif
 
+#ifdef CONFIG_ARM64
+/*
+ * Due to ERRATA#22536, ThunderX needs to handle HOST_IRQ_STAT differently.
+ * Workaround is to make sure all pending IRQs are served before leaving
+ * handler.
+ */
+static irqreturn_t ahci_thunderx_irq_handler(int irq, void *dev_instance)
+{
+        struct ata_host *host = dev_instance;
+        struct ahci_host_priv *hpriv;
+        unsigned int rc = 0;
+        void __iomem *mmio;
+        u32 irq_stat, irq_masked;
+        unsigned int handled = 1;
+
+        VPRINTK("ENTER\n");
+        hpriv = host->private_data;
+        mmio = hpriv->mmio;
+        irq_stat = readl(mmio + HOST_IRQ_STAT);
+        if (!irq_stat)
+                return IRQ_NONE;
+
+        do {
+                irq_masked = irq_stat & hpriv->port_map;
+                spin_lock(&host->lock);
+                rc = ahci_handle_port_intr(host, irq_masked);
+                if (!rc)
+                        handled = 0;
+                writel(irq_stat, mmio + HOST_IRQ_STAT);
+                irq_stat = readl(mmio + HOST_IRQ_STAT);
+                spin_unlock(&host->lock);
+        } while (irq_stat);
+        VPRINTK("EXIT\n");
+
+        return IRQ_RETVAL(handled);
+}
+#endif
+
 /*
  * ahci_init_msix() - optionally enable per-port MSI-X otherwise defer
  * to single msi.
@@ -1540,6 +1604,11 @@ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         if (ahci_broken_devslp(pdev))
                 hpriv->flags |= AHCI_HFLAG_NO_DEVSLP;
 
+#ifdef CONFIG_ARM64
+        if (pdev->vendor == 0x177d && pdev->device == 0xa01c)
+                hpriv->irq_handler = ahci_thunderx_irq_handler;
+#endif
+
         /* save initial config */
         ahci_pci_save_initial_config(pdev, hpriv);
 
diff --git a/drivers/ata/ahci.h b/drivers/ata/ahci.h
index a4faa438889c..167ba7e3b92e 100644
--- a/drivers/ata/ahci.h
+++ b/drivers/ata/ahci.h
@@ -240,8 +240,7 @@ enum {
                                                         error-handling stage) */
         AHCI_HFLAG_NO_DEVSLP            = (1 << 17), /* no device sleep */
         AHCI_HFLAG_NO_FBS               = (1 << 18), /* no FBS */
-        AHCI_HFLAG_EDGE_IRQ             = (1 << 19), /* HOST_IRQ_STAT behaves as
-                                                        Edge Triggered */
+
 #ifdef CONFIG_PCI_MSI
         AHCI_HFLAG_MULTI_MSI            = (1 << 20), /* multiple PCI MSIs */
         AHCI_HFLAG_MULTI_MSIX           = (1 << 21), /* per-port MSI-X */
@@ -250,6 +249,7 @@ enum {
         AHCI_HFLAG_MULTI_MSI            = 0,
         AHCI_HFLAG_MULTI_MSIX           = 0,
 #endif
+        AHCI_HFLAG_WAKE_BEFORE_STOP     = (1 << 22), /* wake before DMA stop */
 
         /* ap->flags bits */
 
@@ -360,6 +360,7 @@ struct ahci_host_priv {
          * be overridden anytime before the host is activated.
          */
         void                    (*start_engine)(struct ata_port *ap);
+        irqreturn_t             (*irq_handler)(int irq, void *dev_instance);
 };
 
 #ifdef CONFIG_PCI_MSI
@@ -423,6 +424,7 @@ int ahci_reset_em(struct ata_host *host);
 void ahci_print_info(struct ata_host *host, const char *scc_s);
 int ahci_host_activate(struct ata_host *host, struct scsi_host_template *sht);
 void ahci_error_handler(struct ata_port *ap);
+u32 ahci_handle_port_intr(struct ata_host *host, u32 irq_masked);
 
 static inline void __iomem *__ahci_port_base(struct ata_host *host,
                                              unsigned int port_no)
diff --git a/drivers/ata/ahci_brcmstb.c b/drivers/ata/ahci_brcmstb.c
index b36cae2fd04b..e87bcec0fd7c 100644
--- a/drivers/ata/ahci_brcmstb.c
+++ b/drivers/ata/ahci_brcmstb.c
@@ -317,6 +317,7 @@ static int brcm_ahci_probe(struct platform_device *pdev)
         if (IS_ERR(hpriv))
                 return PTR_ERR(hpriv);
         hpriv->plat_data = priv;
+        hpriv->flags = AHCI_HFLAG_WAKE_BEFORE_STOP;
 
         brcm_sata_alpm_init(hpriv);
 
diff --git a/drivers/ata/ahci_xgene.c b/drivers/ata/ahci_xgene.c
index e2c6d9e0c5ac..8e3f7faf00d3 100644
--- a/drivers/ata/ahci_xgene.c
+++ b/drivers/ata/ahci_xgene.c
@@ -548,6 +548,88 @@ softreset_retry:
         return rc;
 }
 
+/**
+ * xgene_ahci_handle_broken_edge_irq - Handle the broken irq.
+ * @ata_host: Host that recieved the irq
+ * @irq_masked: HOST_IRQ_STAT value
+ *
+ * For hardware with broken edge trigger latch
+ * the HOST_IRQ_STAT register misses the edge interrupt
+ * when clearing of HOST_IRQ_STAT register and hardware
+ * reporting the PORT_IRQ_STAT register at the
+ * same clock cycle.
+ * As such, the algorithm below outlines the workaround.
+ *
+ * 1. Read HOST_IRQ_STAT register and save the state.
+ * 2. Clear the HOST_IRQ_STAT register.
+ * 3. Read back the HOST_IRQ_STAT register.
+ * 4. If HOST_IRQ_STAT register equals to zero, then
+ *    traverse the rest of port's PORT_IRQ_STAT register
+ *    to check if an interrupt is triggered at that point else
+ *    go to step 6.
+ * 5. If PORT_IRQ_STAT register of rest ports is not equal to zero
+ *    then update the state of HOST_IRQ_STAT saved in step 1.
+ * 6. Handle port interrupts.
+ * 7. Exit
+ */
+static int xgene_ahci_handle_broken_edge_irq(struct ata_host *host,
+                                             u32 irq_masked)
+{
+        struct ahci_host_priv *hpriv = host->private_data;
+        void __iomem *port_mmio;
+        int i;
+
+        if (!readl(hpriv->mmio + HOST_IRQ_STAT)) {
+                for (i = 0; i < host->n_ports; i++) {
+                        if (irq_masked & (1 << i))
+                                continue;
+
+                        port_mmio = ahci_port_base(host->ports[i]);
+                        if (readl(port_mmio + PORT_IRQ_STAT))
+                                irq_masked |= (1 << i);
+                }
+        }
+
+        return ahci_handle_port_intr(host, irq_masked);
+}
+
+static irqreturn_t xgene_ahci_irq_intr(int irq, void *dev_instance)
+{
+        struct ata_host *host = dev_instance;
+        struct ahci_host_priv *hpriv;
+        unsigned int rc = 0;
+        void __iomem *mmio;
+        u32 irq_stat, irq_masked;
+
+        VPRINTK("ENTER\n");
+
+        hpriv = host->private_data;
+        mmio = hpriv->mmio;
+
+        /* sigh.  0xffffffff is a valid return from h/w */
+        irq_stat = readl(mmio + HOST_IRQ_STAT);
+        if (!irq_stat)
+                return IRQ_NONE;
+
+        irq_masked = irq_stat & hpriv->port_map;
+
+        spin_lock(&host->lock);
+
+        /*
+         * HOST_IRQ_STAT behaves as edge triggered latch meaning that
+         * it should be cleared before all the port events are cleared.
+         */
+        writel(irq_stat, mmio + HOST_IRQ_STAT);
+
+        rc = xgene_ahci_handle_broken_edge_irq(host, irq_masked);
+
+        spin_unlock(&host->lock);
+
+        VPRINTK("EXIT\n");
+
+        return IRQ_RETVAL(rc);
+}
+
 static struct ata_port_operations xgene_ahci_v1_ops = {
         .inherits = &ahci_ops,
         .host_stop = xgene_ahci_host_stop,
@@ -779,7 +861,8 @@ skip_clk_phy:
                 hpriv->flags = AHCI_HFLAG_NO_NCQ;
                 break;
         case XGENE_AHCI_V2:
-                hpriv->flags |= AHCI_HFLAG_YES_FBS | AHCI_HFLAG_EDGE_IRQ;
+                hpriv->flags |= AHCI_HFLAG_YES_FBS;
+                hpriv->irq_handler = xgene_ahci_irq_intr;
                 break;
         default:
                 break;
diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
index d61740e78d6d..85ea5142a095 100644
--- a/drivers/ata/libahci.c
+++ b/drivers/ata/libahci.c
@@ -113,6 +113,7 @@ static ssize_t ahci_store_em_buffer(struct device *dev,
                                     const char *buf, size_t size);
 static ssize_t ahci_show_em_supported(struct device *dev,
                                       struct device_attribute *attr, char *buf);
+static irqreturn_t ahci_single_level_irq_intr(int irq, void *dev_instance);
 
 static DEVICE_ATTR(ahci_host_caps, S_IRUGO, ahci_show_host_caps, NULL);
 static DEVICE_ATTR(ahci_host_cap2, S_IRUGO, ahci_show_host_cap2, NULL);
@@ -496,8 +497,8 @@ void ahci_save_initial_config(struct device *dev, struct ahci_host_priv *hpriv)
                 }
         }
 
-        /* fabricate port_map from cap.nr_ports */
-        if (!port_map) {
+        /* fabricate port_map from cap.nr_ports for < AHCI 1.3 */
+        if (!port_map && vers < 0x10300) {
                 port_map = (1 << ahci_nr_ports(cap)) - 1;
                 dev_warn(dev, "forcing PORTS_IMPL to 0x%x\n", port_map);
 
@@ -512,6 +513,9 @@ void ahci_save_initial_config(struct device *dev, struct ahci_host_priv *hpriv)
 
         if (!hpriv->start_engine)
                 hpriv->start_engine = ahci_start_engine;
+
+        if (!hpriv->irq_handler)
+                hpriv->irq_handler = ahci_single_level_irq_intr;
 }
 EXPORT_SYMBOL_GPL(ahci_save_initial_config);
 
@@ -593,8 +597,22 @@ EXPORT_SYMBOL_GPL(ahci_start_engine);
 int ahci_stop_engine(struct ata_port *ap)
 {
         void __iomem *port_mmio = ahci_port_base(ap);
+        struct ahci_host_priv *hpriv = ap->host->private_data;
         u32 tmp;
 
+        /*
+         * On some controllers, stopping a port's DMA engine while the port
+         * is in ALPM state (partial or slumber) results in failures on
+         * subsequent DMA engine starts.  For those controllers, put the
+         * port back in active state before stopping its DMA engine.
+         */
+        if ((hpriv->flags & AHCI_HFLAG_WAKE_BEFORE_STOP) &&
+            (ap->link.lpm_policy > ATA_LPM_MAX_POWER) &&
+            ahci_set_lpm(&ap->link, ATA_LPM_MAX_POWER, ATA_LPM_WAKE_ONLY)) {
+                dev_err(ap->host->dev, "Failed to wake up port before engine stop\n");
+                return -EIO;
+        }
+
         tmp = readl(port_mmio + PORT_CMD);
 
         /* check if the HBA is idle */
@@ -689,6 +707,9 @@ static int ahci_set_lpm(struct ata_link *link, enum ata_lpm_policy policy,
         void __iomem *port_mmio = ahci_port_base(ap);
 
         if (policy != ATA_LPM_MAX_POWER) {
+                /* wakeup flag only applies to the max power policy */
+                hints &= ~ATA_LPM_WAKE_ONLY;
+
                 /*
                  * Disable interrupts on Phy Ready. This keeps us from
                  * getting woken up due to spurious phy ready
@@ -704,7 +725,8 @@ static int ahci_set_lpm(struct ata_link *link, enum ata_lpm_policy policy,
                 u32 cmd = readl(port_mmio + PORT_CMD);
 
                 if (policy == ATA_LPM_MAX_POWER || !(hints & ATA_LPM_HIPM)) {
-                        cmd &= ~(PORT_CMD_ASP | PORT_CMD_ALPE);
+                        if (!(hints & ATA_LPM_WAKE_ONLY))
+                                cmd &= ~(PORT_CMD_ASP | PORT_CMD_ALPE);
                         cmd |= PORT_CMD_ICC_ACTIVE;
 
                         writel(cmd, port_mmio + PORT_CMD);
@@ -712,6 +734,9 @@ static int ahci_set_lpm(struct ata_link *link, enum ata_lpm_policy policy,
 
                         /* wait 10ms to be sure we've come out of LPM state */
                         ata_msleep(ap, 10);
+
+                        if (hints & ATA_LPM_WAKE_ONLY)
+                                return 0;
                 } else {
                         cmd |= PORT_CMD_ALPE;
                         if (policy == ATA_LPM_MIN_POWER)
@@ -1143,8 +1168,7 @@ static void ahci_port_init(struct device *dev, struct ata_port *ap,
 
         /* mark esata ports */
         tmp = readl(port_mmio + PORT_CMD);
-        if ((tmp & PORT_CMD_HPCP) ||
-            ((tmp & PORT_CMD_ESP) && (hpriv->cap & HOST_CAP_SXS)))
+        if ((tmp & PORT_CMD_ESP) && (hpriv->cap & HOST_CAP_SXS))
                 ap->pflags |= ATA_PFLAG_EXTERNAL;
 }
 
@@ -1825,7 +1849,7 @@ static irqreturn_t ahci_multi_irqs_intr_hard(int irq, void *dev_instance)
         return IRQ_HANDLED;
 }
 
-static u32 ahci_handle_port_intr(struct ata_host *host, u32 irq_masked)
+u32 ahci_handle_port_intr(struct ata_host *host, u32 irq_masked)
 {
         unsigned int i, handled = 0;
 
@@ -1851,43 +1875,7 @@ static u32 ahci_handle_port_intr(struct ata_host *host, u32 irq_masked)
 
         return handled;
 }
-
-static irqreturn_t ahci_single_edge_irq_intr(int irq, void *dev_instance)
-{
-        struct ata_host *host = dev_instance;
-        struct ahci_host_priv *hpriv;
-        unsigned int rc = 0;
-        void __iomem *mmio;
-        u32 irq_stat, irq_masked;
-
-        VPRINTK("ENTER\n");
-
-        hpriv = host->private_data;
-        mmio = hpriv->mmio;
-
-        /* sigh.  0xffffffff is a valid return from h/w */
-        irq_stat = readl(mmio + HOST_IRQ_STAT);
-        if (!irq_stat)
-                return IRQ_NONE;
-
-        irq_masked = irq_stat & hpriv->port_map;
-
-        spin_lock(&host->lock);
-
-        /*
-         * HOST_IRQ_STAT behaves as edge triggered latch meaning that
-         * it should be cleared before all the port events are cleared.
-         */
-        writel(irq_stat, mmio + HOST_IRQ_STAT);
-
-        rc = ahci_handle_port_intr(host, irq_masked);
-
-        spin_unlock(&host->lock);
-
-        VPRINTK("EXIT\n");
-
-        return IRQ_RETVAL(rc);
-}
+EXPORT_SYMBOL_GPL(ahci_handle_port_intr);
 
 static irqreturn_t ahci_single_level_irq_intr(int irq, void *dev_instance)
 {
@@ -2514,14 +2502,18 @@ int ahci_host_activate(struct ata_host *host, struct scsi_host_template *sht)
         int irq = hpriv->irq;
         int rc;
 
-        if (hpriv->flags & (AHCI_HFLAG_MULTI_MSI | AHCI_HFLAG_MULTI_MSIX))
+        if (hpriv->flags & (AHCI_HFLAG_MULTI_MSI | AHCI_HFLAG_MULTI_MSIX)) {
+                if (hpriv->irq_handler)
+                        dev_warn(host->dev, "both AHCI_HFLAG_MULTI_MSI flag set \
+                                 and custom irq handler implemented\n");
+
                 rc = ahci_host_activate_multi_irqs(host, sht);
-        else if (hpriv->flags & AHCI_HFLAG_EDGE_IRQ)
-                rc = ata_host_activate(host, irq, ahci_single_edge_irq_intr,
-                                       IRQF_SHARED, sht);
-        else
-                rc = ata_host_activate(host, irq, ahci_single_level_irq_intr,
+        } else {
+                rc = ata_host_activate(host, irq, hpriv->irq_handler,
                                        IRQF_SHARED, sht);
+        }
+
+
         return rc;
 }
 EXPORT_SYMBOL_GPL(ahci_host_activate);
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index cbb74719d2c1..55e257c268dd 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -4125,6 +4125,7 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
         { "SAMSUNG CD-ROM SN-124", "N001",      ATA_HORKAGE_NODMA },
         { "Seagate STT20000A", NULL,            ATA_HORKAGE_NODMA },
         { " 2GB ATA Flash Disk", "ADMA428M",    ATA_HORKAGE_NODMA },
+        { "VRFDFC22048UCHC-TE*", NULL,          ATA_HORKAGE_NODMA },
         /* Odd clown on sil3726/4726 PMPs */
         { "Config  Disk",       NULL,           ATA_HORKAGE_DISABLE },
 
diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index 7e959f90c020..e417e1a1d02c 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -675,19 +675,18 @@ static int ata_ioc32(struct ata_port *ap)
 int ata_sas_scsi_ioctl(struct ata_port *ap, struct scsi_device *scsidev,
                      int cmd, void __user *arg)
 {
-        int val = -EINVAL, rc = -EINVAL;
+        unsigned long val;
+        int rc = -EINVAL;
         unsigned long flags;
 
         switch (cmd) {
-        case ATA_IOC_GET_IO32:
+        case HDIO_GET_32BIT:
                 spin_lock_irqsave(ap->lock, flags);
                 val = ata_ioc32(ap);
                 spin_unlock_irqrestore(ap->lock, flags);
-                if (copy_to_user(arg, &val, 1))
-                        return -EFAULT;
-                return 0;
+                return put_user(val, (unsigned long __user *)arg);
 
-        case ATA_IOC_SET_IO32:
+        case HDIO_SET_32BIT:
                 val = (unsigned long) arg;
                 rc = 0;
                 spin_lock_irqsave(ap->lock, flags);
diff --git a/drivers/ata/libata-sff.c b/drivers/ata/libata-sff.c
index cdf6215a9a22..051b6158d1b7 100644
--- a/drivers/ata/libata-sff.c
+++ b/drivers/ata/libata-sff.c
@@ -997,12 +997,9 @@ static inline int ata_hsm_ok_in_wq(struct ata_port *ap,
 static void ata_hsm_qc_complete(struct ata_queued_cmd *qc, int in_wq)
 {
         struct ata_port *ap = qc->ap;
-        unsigned long flags;
 
         if (ap->ops->error_handler) {
                 if (in_wq) {
-                        spin_lock_irqsave(ap->lock, flags);
-
                         /* EH might have kicked in while host lock is
                          * released.
                          */
@@ -1014,8 +1011,6 @@ static void ata_hsm_qc_complete(struct ata_queued_cmd *qc, int in_wq)
                                 } else
                                         ata_port_freeze(ap);
                         }
-
-                        spin_unlock_irqrestore(ap->lock, flags);
                 } else {
                         if (likely(!(qc->err_mask & AC_ERR_HSM)))
                                 ata_qc_complete(qc);
@@ -1024,10 +1019,8 @@ static void ata_hsm_qc_complete(struct ata_queued_cmd *qc, int in_wq)
                 }
         } else {
                 if (in_wq) {
-                        spin_lock_irqsave(ap->lock, flags);
                         ata_sff_irq_on(ap);
                         ata_qc_complete(qc);
-                        spin_unlock_irqrestore(ap->lock, flags);
                 } else
                         ata_qc_complete(qc);
         }
@@ -1048,9 +1041,10 @@ int ata_sff_hsm_move(struct ata_port *ap, struct ata_queued_cmd *qc,
 {
         struct ata_link *link = qc->dev->link;
         struct ata_eh_info *ehi = &link->eh_info;
-        unsigned long flags = 0;
         int poll_next;
 
+        lockdep_assert_held(ap->lock);
+
         WARN_ON_ONCE((qc->flags & ATA_QCFLAG_ACTIVE) == 0);
 
         /* Make sure ata_sff_qc_issue() does not throw things
@@ -1112,14 +1106,6 @@ fsm_start:
                         }
                 }
 
-                /* Send the CDB (atapi) or the first data block (ata pio out).
-                 * During the state transition, interrupt handler shouldn't
-                 * be invoked before the data transfer is complete and
-                 * hsm_task_state is changed. Hence, the following locking.
-                 */
-                if (in_wq)
-                        spin_lock_irqsave(ap->lock, flags);
-
                 if (qc->tf.protocol == ATA_PROT_PIO) {
                         /* PIO data out protocol.
                          * send first data block.
@@ -1135,9 +1121,6 @@ fsm_start:
                         /* send CDB */
                         atapi_send_cdb(ap, qc);
 
-                if (in_wq)
-                        spin_unlock_irqrestore(ap->lock, flags);
-
                 /* if polling, ata_sff_pio_task() handles the rest.
                  * otherwise, interrupt handler takes over from here.
                  */
@@ -1296,7 +1279,8 @@ fsm_start:
                 break;
         default:
                 poll_next = 0;
-                BUG();
+                WARN(true, "ata%d: SFF host state machine in invalid state %d",
+                     ap->print_id, ap->hsm_task_state);
         }
 
         return poll_next;
@@ -1361,12 +1345,14 @@ static void ata_sff_pio_task(struct work_struct *work)
         u8 status;
         int poll_next;
 
+        spin_lock_irq(ap->lock);
+
         BUG_ON(ap->sff_pio_task_link == NULL);
         /* qc can be NULL if timeout occurred */
         qc = ata_qc_from_tag(ap, link->active_tag);
         if (!qc) {
                 ap->sff_pio_task_link = NULL;
-                return;
+                goto out_unlock;
         }
 
 fsm_start:
@@ -1381,11 +1367,14 @@ fsm_start:
          */
         status = ata_sff_busy_wait(ap, ATA_BUSY, 5);
         if (status & ATA_BUSY) {
+                spin_unlock_irq(ap->lock);
                 ata_msleep(ap, 2);
+                spin_lock_irq(ap->lock);
+
                 status = ata_sff_busy_wait(ap, ATA_BUSY, 10);
                 if (status & ATA_BUSY) {
                         ata_sff_queue_pio_task(link, ATA_SHORT_PAUSE);
-                        return;
+                        goto out_unlock;
                 }
         }
 
@@ -1402,6 +1391,8 @@ fsm_start:
          */
         if (poll_next)
                 goto fsm_start;
+out_unlock:
+        spin_unlock_irq(ap->lock);
 }
 
 /**
diff --git a/drivers/ata/pata_rb532_cf.c b/drivers/ata/pata_rb532_cf.c
index 12fe0f3bb7e9..c8b6a780a290 100644
--- a/drivers/ata/pata_rb532_cf.c
+++ b/drivers/ata/pata_rb532_cf.c
@@ -32,6 +32,8 @@
 #include <linux/libata.h>
 #include <scsi/scsi_host.h>
 
+#include <asm/mach-rc32434/rb.h>
+
 #define DRV_NAME        "pata-rb532-cf"
 #define DRV_VERSION     "0.1.0"
 #define DRV_DESC        "PATA driver for RouterBOARD 532 Compact Flash"
@@ -107,6 +109,7 @@ static int rb532_pata_driver_probe(struct platform_device *pdev)
         int gpio;
         struct resource *res;
         struct ata_host *ah;
+        struct cf_device *pdata;
         struct rb532_cf_info *info;
         int ret;
 
@@ -122,7 +125,13 @@ static int rb532_pata_driver_probe(struct platform_device *pdev)
                 return -ENOENT;
         }
 
-        gpio = irq_to_gpio(irq);
+        pdata = dev_get_platdata(&pdev->dev);
+        if (!pdata) {
+                dev_err(&pdev->dev, "no platform data specified\n");
+                return -EINVAL;
+        }
+
+        gpio = pdata->gpio_pin;
         if (gpio < 0) {
                 dev_err(&pdev->dev, "no GPIO found for irq%d\n", irq);
                 return -ENOENT;
diff --git a/drivers/base/component.c b/drivers/base/component.c
index 89f5cf68d80a..04a1582e80bb 100644
--- a/drivers/base/component.c
+++ b/drivers/base/component.c
@@ -206,6 +206,8 @@ static void component_match_release(struct device *master,
                 if (mc->release)
                         mc->release(master, mc->data);
         }
+
+        kfree(match->compare);
 }
 
 static void devm_component_match_release(struct device *dev, void *res)
@@ -221,14 +223,14 @@ static int component_match_realloc(struct device *dev,
         if (match->alloc == num)
                 return 0;
 
-        new = devm_kmalloc_array(dev, num, sizeof(*new), GFP_KERNEL);
+        new = kmalloc_array(num, sizeof(*new), GFP_KERNEL);
         if (!new)
                 return -ENOMEM;
 
         if (match->compare) {
                 memcpy(new, match->compare, sizeof(*new) *
                                             min(match->num, num));
-                devm_kfree(dev, match->compare);
+                kfree(match->compare);
         }
         match->compare = new;
         match->alloc = num;
@@ -283,6 +285,24 @@ void component_match_add_release(struct device *master,
 }
 EXPORT_SYMBOL(component_match_add_release);
 
+static void free_master(struct master *master)
+{
+        struct component_match *match = master->match;
+        int i;
+
+        list_del(&master->node);
+
+        if (match) {
+                for (i = 0; i < match->num; i++) {
+                        struct component *c = match->compare[i].component;
+                        if (c)
+                                c->master = NULL;
+                }
+        }
+
+        kfree(master);
+}
+
 int component_master_add_with_match(struct device *dev,
         const struct component_master_ops *ops,
         struct component_match *match)
@@ -309,11 +329,9 @@ int component_master_add_with_match(struct device *dev,
 
         ret = try_to_bring_up_master(master, NULL);
 
-        if (ret < 0) {
-                /* Delete off the list if we weren't successful */
-                list_del(&master->node);
-                kfree(master);
-        }
+        if (ret < 0)
+                free_master(master);
+
         mutex_unlock(&component_mutex);
 
         return ret < 0 ? ret : 0;
@@ -324,25 +342,12 @@ void component_master_del(struct device *dev,
         const struct component_master_ops *ops)
 {
         struct master *master;
-        int i;
 
         mutex_lock(&component_mutex);
         master = __master_find(dev, ops);
         if (master) {
-                struct component_match *match = master->match;
-
                 take_down_master(master);
-
-                list_del(&master->node);
-
-                if (match) {
-                        for (i = 0; i < match->num; i++) {
-                                struct component *c = match->compare[i].component;
-                                if (c)
-                                        c->master = NULL;
-                        }
-                }
-                kfree(master);
+                free_master(master);
         }
         mutex_unlock(&component_mutex);
 }
@@ -486,6 +491,8 @@ int component_add(struct device *dev, const struct component_ops *ops)
 
         ret = try_to_bring_up_masters(component);
         if (ret < 0) {
+                if (component->master)
+                        remove_component(component->master, component);
                 list_del(&component->node);
 
                 kfree(component);
diff --git a/drivers/base/property.c b/drivers/base/property.c
index c359351d50f1..a163f2c59aa3 100644
--- a/drivers/base/property.c
+++ b/drivers/base/property.c
@@ -218,7 +218,7 @@ bool fwnode_property_present(struct fwnode_handle *fwnode, const char *propname)
         bool ret;
 
         ret = __fwnode_property_present(fwnode, propname);
-        if (ret == false && fwnode && fwnode->secondary)
+        if (ret == false && fwnode && !IS_ERR_OR_NULL(fwnode->secondary))
                 ret = __fwnode_property_present(fwnode->secondary, propname);
         return ret;
 }
@@ -423,7 +423,7 @@ EXPORT_SYMBOL_GPL(device_property_match_string);
         int _ret_;                                                                      \
         _ret_ = FWNODE_PROP_READ(_fwnode_, _propname_, _type_, _proptype_,              \
                                  _val_, _nval_);                                        \
-        if (_ret_ == -EINVAL && _fwnode_ && _fwnode_->secondary)                        \
+        if (_ret_ == -EINVAL && _fwnode_ && !IS_ERR_OR_NULL(_fwnode_->secondary))       \
                 _ret_ = FWNODE_PROP_READ(_fwnode_->secondary, _propname_, _type_,       \
                                 _proptype_, _val_, _nval_);                             \
         _ret_;                                                                          \
@@ -593,7 +593,7 @@ int fwnode_property_read_string_array(struct fwnode_handle *fwnode,
         int ret;
 
         ret = __fwnode_property_read_string_array(fwnode, propname, val, nval);
-        if (ret == -EINVAL && fwnode && fwnode->secondary)
+        if (ret == -EINVAL && fwnode && !IS_ERR_OR_NULL(fwnode->secondary))
                 ret = __fwnode_property_read_string_array(fwnode->secondary,
                                                           propname, val, nval);
         return ret;
@@ -621,7 +621,7 @@ int fwnode_property_read_string(struct fwnode_handle *fwnode,
         int ret;
 
         ret = __fwnode_property_read_string(fwnode, propname, val);
-        if (ret == -EINVAL && fwnode && fwnode->secondary)
+        if (ret == -EINVAL && fwnode && !IS_ERR_OR_NULL(fwnode->secondary))
                 ret = __fwnode_property_read_string(fwnode->secondary,
                                                     propname, val);
         return ret;
diff --git a/drivers/base/regmap/regmap-mmio.c b/drivers/base/regmap/regmap-mmio.c
index 8812bfb9e3b8..eea51569f0eb 100644
--- a/drivers/base/regmap/regmap-mmio.c
+++ b/drivers/base/regmap/regmap-mmio.c
@@ -133,17 +133,17 @@ static int regmap_mmio_gather_write(void *context,
         while (val_size) {
                 switch (ctx->val_bytes) {
                 case 1:
-                        __raw_writeb(*(u8 *)val, ctx->regs + offset);
+                        writeb(*(u8 *)val, ctx->regs + offset);
                         break;
                 case 2:
-                        __raw_writew(*(u16 *)val, ctx->regs + offset);
+                        writew(*(u16 *)val, ctx->regs + offset);
                         break;
                 case 4:
-                        __raw_writel(*(u32 *)val, ctx->regs + offset);
+                        writel(*(u32 *)val, ctx->regs + offset);
                         break;
 #ifdef CONFIG_64BIT
                 case 8:
-                        __raw_writeq(*(u64 *)val, ctx->regs + offset);
+                        writeq(*(u64 *)val, ctx->regs + offset);
                         break;
 #endif
                 default:
@@ -193,17 +193,17 @@ static int regmap_mmio_read(void *context,
         while (val_size) {
                 switch (ctx->val_bytes) {
                 case 1:
-                        *(u8 *)val = __raw_readb(ctx->regs + offset);
+                        *(u8 *)val = readb(ctx->regs + offset);
                         break;
                 case 2:
-                        *(u16 *)val = __raw_readw(ctx->regs + offset);
+                        *(u16 *)val = readw(ctx->regs + offset);
                         break;
                 case 4:
-                        *(u32 *)val = __raw_readl(ctx->regs + offset);
+                        *(u32 *)val = readl(ctx->regs + offset);
                         break;
 #ifdef CONFIG_64BIT
                 case 8:
-                        *(u64 *)val = __raw_readq(ctx->regs + offset);
+                        *(u64 *)val = readq(ctx->regs + offset);
                         break;
 #endif
                 default:
diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index 9e251201dd48..84708a5f8c52 100644
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -866,7 +866,7 @@ static void set_fdc(int drive)
 }
 
 /* locks the driver */
-static int lock_fdc(int drive, bool interruptible)
+static int lock_fdc(int drive)
 {
         if (WARN(atomic_read(&usage_count) == 0,
                  "Trying to lock fdc while usage count=0\n"))
@@ -2173,7 +2173,7 @@ static int do_format(int drive, struct format_descr *tmp_format_req)
 {
         int ret;
 
-        if (lock_fdc(drive, true))
+        if (lock_fdc(drive))
                 return -EINTR;
 
         set_floppy(drive);
@@ -2960,7 +2960,7 @@ static int user_reset_fdc(int drive, int arg, bool interruptible)
 {
         int ret;
 
-        if (lock_fdc(drive, interruptible))
+        if (lock_fdc(drive))
                 return -EINTR;
 
         if (arg == FD_RESET_ALWAYS)
@@ -3243,7 +3243,7 @@ static int set_geometry(unsigned int cmd, struct floppy_struct *g,
                 if (!capable(CAP_SYS_ADMIN))
                         return -EPERM;
                 mutex_lock(&open_lock);
-                if (lock_fdc(drive, true)) {
+                if (lock_fdc(drive)) {
                         mutex_unlock(&open_lock);
                         return -EINTR;
                 }
@@ -3263,7 +3263,7 @@ static int set_geometry(unsigned int cmd, struct floppy_struct *g,
         } else {
                 int oldStretch;
 
-                if (lock_fdc(drive, true))
+                if (lock_fdc(drive))
                         return -EINTR;
                 if (cmd != FDDEFPRM) {
                         /* notice a disk change immediately, else
@@ -3349,7 +3349,7 @@ static int get_floppy_geometry(int drive, int type, struct floppy_struct **g)
         if (type)
                 *g = &floppy_type[type];
         else {
-                if (lock_fdc(drive, false))
+                if (lock_fdc(drive))
                         return -EINTR;
                 if (poll_drive(false, 0) == -EINTR)
                         return -EINTR;
@@ -3433,7 +3433,7 @@ static int fd_locked_ioctl(struct block_device *bdev, fmode_t mode, unsigned int
                 if (UDRS->fd_ref != 1)
                         /* somebody else has this drive open */
                         return -EBUSY;
-                if (lock_fdc(drive, true))
+                if (lock_fdc(drive))
                         return -EINTR;
 
                 /* do the actual eject. Fails on
@@ -3445,7 +3445,7 @@ static int fd_locked_ioctl(struct block_device *bdev, fmode_t mode, unsigned int
                 process_fd_request();
                 return ret;
         case FDCLRPRM:
-                if (lock_fdc(drive, true))
+                if (lock_fdc(drive))
                         return -EINTR;
                 current_type[drive] = NULL;
                 floppy_sizes[drive] = MAX_DISK_SIZE << 1;
@@ -3467,7 +3467,7 @@ static int fd_locked_ioctl(struct block_device *bdev, fmode_t mode, unsigned int
                 UDP->flags &= ~FTD_MSG;
                 return 0;
         case FDFMTBEG:
-                if (lock_fdc(drive, true))
+                if (lock_fdc(drive))
                         return -EINTR;
                 if (poll_drive(true, FD_RAW_NEED_DISK) == -EINTR)
                         return -EINTR;
@@ -3484,7 +3484,7 @@ static int fd_locked_ioctl(struct block_device *bdev, fmode_t mode, unsigned int
                 return do_format(drive, &inparam.f);
         case FDFMTEND:
         case FDFLUSH:
-                if (lock_fdc(drive, true))
+                if (lock_fdc(drive))
                         return -EINTR;
                 return invalidate_drive(bdev);
         case FDSETEMSGTRESH:
@@ -3507,7 +3507,7 @@ static int fd_locked_ioctl(struct block_device *bdev, fmode_t mode, unsigned int
                 outparam = UDP;
                 break;
         case FDPOLLDRVSTAT:
-                if (lock_fdc(drive, true))
+                if (lock_fdc(drive))
                         return -EINTR;
                 if (poll_drive(true, FD_RAW_NEED_DISK) == -EINTR)
                         return -EINTR;
@@ -3530,7 +3530,7 @@ static int fd_locked_ioctl(struct block_device *bdev, fmode_t mode, unsigned int
         case FDRAWCMD:
                 if (type)
                         return -EINVAL;
-                if (lock_fdc(drive, true))
+                if (lock_fdc(drive))
                         return -EINTR;
                 set_floppy(drive);
                 i = raw_cmd_ioctl(cmd, (void __user *)param);
@@ -3539,7 +3539,7 @@ static int fd_locked_ioctl(struct block_device *bdev, fmode_t mode, unsigned int
                 process_fd_request();
                 return i;
         case FDTWADDLE:
-                if (lock_fdc(drive, true))
+                if (lock_fdc(drive))
                         return -EINTR;
                 twaddle();
                 process_fd_request();
@@ -3663,6 +3663,11 @@ static int floppy_open(struct block_device *bdev, fmode_t mode)
 
         opened_bdev[drive] = bdev;
 
+        if (!(mode & (FMODE_READ|FMODE_WRITE))) {
+                res = -EINVAL;
+                goto out;
+        }
+
         res = -ENXIO;
 
         if (!floppy_track_buffer) {
@@ -3706,21 +3711,20 @@ static int floppy_open(struct block_device *bdev, fmode_t mode)
         if (UFDCS->rawcmd == 1)
                 UFDCS->rawcmd = 2;
 
-        if (!(mode & FMODE_NDELAY)) {
-                if (mode & (FMODE_READ|FMODE_WRITE)) {
-                        UDRS->last_checked = 0;
-                        clear_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags);
-                        check_disk_change(bdev);
-                        if (test_bit(FD_DISK_CHANGED_BIT, &UDRS->flags))
-                                goto out;
-                        if (test_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags))
-                                goto out;
-                }
-                res = -EROFS;
-                if ((mode & FMODE_WRITE) &&
-                    !test_bit(FD_DISK_WRITABLE_BIT, &UDRS->flags))
-                        goto out;
-        }
+        UDRS->last_checked = 0;
+        clear_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags);
+        check_disk_change(bdev);
+        if (test_bit(FD_DISK_CHANGED_BIT, &UDRS->flags))
+                goto out;
+        if (test_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags))
+                goto out;
+
+        res = -EROFS;
+
+        if ((mode & FMODE_WRITE) &&
+                        !test_bit(FD_DISK_WRITABLE_BIT, &UDRS->flags))
+                goto out;
+
         mutex_unlock(&open_lock);
         mutex_unlock(&floppy_mutex);
         return 0;
@@ -3748,7 +3752,8 @@ static unsigned int floppy_check_events(struct gendisk *disk,
                 return DISK_EVENT_MEDIA_CHANGE;
 
         if (time_after(jiffies, UDRS->last_checked + UDP->checkfreq)) {
-                lock_fdc(drive, false);
+                if (lock_fdc(drive))
+                        return -EINTR;
                 poll_drive(false, 0);
                 process_fd_request();
         }
@@ -3847,7 +3852,9 @@ static int floppy_revalidate(struct gendisk *disk)
                          "VFS: revalidate called on non-open device.\n"))
                         return -EFAULT;
 
-                lock_fdc(drive, false);
+                res = lock_fdc(drive);
+                if (res)
+                        return res;
                 cf = (test_bit(FD_DISK_CHANGED_BIT, &UDRS->flags) ||
                       test_bit(FD_VERIFY_BIT, &UDRS->flags));
                 if (!(cf || test_bit(drive, &fake_change) || drive_no_geom(drive))) {
diff --git a/drivers/block/null_blk.c b/drivers/block/null_blk.c
index 8ba1e97d573c..64a7b5971b57 100644
--- a/drivers/block/null_blk.c
+++ b/drivers/block/null_blk.c
@@ -478,7 +478,7 @@ static int null_lnvm_id(struct nvm_dev *dev, struct nvm_id *id)
         id->ver_id = 0x1;
         id->vmnt = 0;
         id->cgrps = 1;
-        id->cap = 0x3;
+        id->cap = 0x2;
         id->dom = 0x1;
 
         id->ppaf.blk_offset = 0;
@@ -707,9 +707,7 @@ static int null_add_dev(void)
         queue_flag_set_unlocked(QUEUE_FLAG_NONROT, nullb->q);
         queue_flag_clear_unlocked(QUEUE_FLAG_ADD_RANDOM, nullb->q);
 
-
         mutex_lock(&lock);
-        list_add_tail(&nullb->list, &nullb_list);
         nullb->index = nullb_indexes++;
         mutex_unlock(&lock);
 
@@ -743,6 +741,10 @@ static int null_add_dev(void)
         strncpy(disk->disk_name, nullb->disk_name, DISK_NAME_LEN);
 
         add_disk(disk);
+
+        mutex_lock(&lock);
+        list_add_tail(&nullb->list, &nullb_list);
+        mutex_unlock(&lock);
 done:
         return 0;
 
diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
index 8a8dc91c39f7..83eb9e6bf8b0 100644
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -1873,6 +1873,43 @@ again:
         return err;
 }
 
+static int negotiate_mq(struct blkfront_info *info)
+{
+        unsigned int backend_max_queues = 0;
+        int err;
+        unsigned int i;
+
+        BUG_ON(info->nr_rings);
+
+        /* Check if backend supports multiple queues. */
+        err = xenbus_scanf(XBT_NIL, info->xbdev->otherend,
+                           "multi-queue-max-queues", "%u", &backend_max_queues);
+        if (err < 0)
+                backend_max_queues = 1;
+
+        info->nr_rings = min(backend_max_queues, xen_blkif_max_queues);
+        /* We need at least one ring. */
+        if (!info->nr_rings)
+                info->nr_rings = 1;
+
+        info->rinfo = kzalloc(sizeof(struct blkfront_ring_info) * info->nr_rings, GFP_KERNEL);
+        if (!info->rinfo) {
+                xenbus_dev_fatal(info->xbdev, -ENOMEM, "allocating ring_info structure");
+                return -ENOMEM;
+        }
+
+        for (i = 0; i < info->nr_rings; i++) {
+                struct blkfront_ring_info *rinfo;
+
+                rinfo = &info->rinfo[i];
+                INIT_LIST_HEAD(&rinfo->indirect_pages);
+                INIT_LIST_HEAD(&rinfo->grants);
+                rinfo->dev_info = info;
+                INIT_WORK(&rinfo->work, blkif_restart_queue);
+                spin_lock_init(&rinfo->ring_lock);
+        }
+        return 0;
+}
 /**
  * Entry point to this code when a new device is created.  Allocate the basic
  * structures and the ring buffer for communication with the backend, and
@@ -1883,9 +1920,7 @@ static int blkfront_probe(struct xenbus_device *dev,
                           const struct xenbus_device_id *id)
 {
         int err, vdevice;
-        unsigned int r_index;
         struct blkfront_info *info;
-        unsigned int backend_max_queues = 0;
 
         /* FIXME: Use dynamic device id if this is not set. */
         err = xenbus_scanf(XBT_NIL, dev->nodename,
@@ -1936,33 +1971,10 @@ static int blkfront_probe(struct xenbus_device *dev,
         }
 
         info->xbdev = dev;
-        /* Check if backend supports multiple queues. */
-        err = xenbus_scanf(XBT_NIL, info->xbdev->otherend,
-                           "multi-queue-max-queues", "%u", &backend_max_queues);
-        if (err < 0)
-                backend_max_queues = 1;
-
-        info->nr_rings = min(backend_max_queues, xen_blkif_max_queues);
-        /* We need at least one ring. */
-        if (!info->nr_rings)
-                info->nr_rings = 1;
-
-        info->rinfo = kzalloc(sizeof(struct blkfront_ring_info) * info->nr_rings, GFP_KERNEL);
-        if (!info->rinfo) {
-                xenbus_dev_fatal(dev, -ENOMEM, "allocating ring_info structure");
+        err = negotiate_mq(info);
+        if (err) {
                 kfree(info);
-                return -ENOMEM;
-        }
-
-        for (r_index = 0; r_index < info->nr_rings; r_index++) {
-                struct blkfront_ring_info *rinfo;
-
-                rinfo = &info->rinfo[r_index];
-                INIT_LIST_HEAD(&rinfo->indirect_pages);
-                INIT_LIST_HEAD(&rinfo->grants);
-                rinfo->dev_info = info;
-                INIT_WORK(&rinfo->work, blkif_restart_queue);
-                spin_lock_init(&rinfo->ring_lock);
+                return err;
         }
 
         mutex_init(&info->mutex);
@@ -2123,12 +2135,16 @@ static int blkif_recover(struct blkfront_info *info)
 static int blkfront_resume(struct xenbus_device *dev)
 {
         struct blkfront_info *info = dev_get_drvdata(&dev->dev);
-        int err;
+        int err = 0;
 
         dev_dbg(&dev->dev, "blkfront_resume: %s\n", dev->nodename);
 
         blkif_free(info, info->connected == BLKIF_STATE_CONNECTED);
 
+        err = negotiate_mq(info);
+        if (err)
+                return err;
+
         err = talk_to_blkback(dev, info);
 
         /*
diff --git a/drivers/char/hpet.c b/drivers/char/hpet.c
index 240b6cf1d97c..be54e5331a45 100644
--- a/drivers/char/hpet.c
+++ b/drivers/char/hpet.c
@@ -42,7 +42,7 @@
 /*
  * The High Precision Event Timer driver.
  * This driver is closely modelled after the rtc.c driver.
- * http://www.intel.com/hardwaredesign/hpetspec_1.pdf
+ * See HPET spec revision 1.
  */
 #define HPET_USER_FREQ  (64)
 #define HPET_DRIFT      (500)
diff --git a/drivers/char/random.c b/drivers/char/random.c
index d0da5d852d41..b583e5336630 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -1819,6 +1819,28 @@ unsigned int get_random_int(void)
 EXPORT_SYMBOL(get_random_int);
 
 /*
+ * Same as get_random_int(), but returns unsigned long.
+ */
+unsigned long get_random_long(void)
+{
+        __u32 *hash;
+        unsigned long ret;
+
+        if (arch_get_random_long(&ret))
+                return ret;
+
+        hash = get_cpu_var(get_random_int_hash);
+
+        hash[0] += current->pid + jiffies + random_get_entropy();
+        md5_transform(hash, random_int_secret);
+        ret = *(unsigned long *)hash;
+        put_cpu_var(get_random_int_hash);
+
+        return ret;
+}
+EXPORT_SYMBOL(get_random_long);
+
+/*
  * randomize_range() returns a start address such that
  *
  *    [...... <range> .....]
diff --git a/drivers/clk/Makefile b/drivers/clk/Makefile
index b038e3666058..bae4be6501df 100644
--- a/drivers/clk/Makefile
+++ b/drivers/clk/Makefile
@@ -43,7 +43,7 @@ obj-$(CONFIG_COMMON_CLK_SI514)		+= clk-si514.o
 obj-$(CONFIG_COMMON_CLK_SI570)          += clk-si570.o
 obj-$(CONFIG_COMMON_CLK_CDCE925)        += clk-cdce925.o
 obj-$(CONFIG_ARCH_STM32)                += clk-stm32f4.o
-obj-$(CONFIG_ARCH_TANGOX)               += clk-tango4.o
+obj-$(CONFIG_ARCH_TANGO)                += clk-tango4.o
 obj-$(CONFIG_CLK_TWL6040)               += clk-twl6040.o
 obj-$(CONFIG_ARCH_U300)                 += clk-u300.o
 obj-$(CONFIG_ARCH_VT8500)               += clk-vt8500.o
diff --git a/drivers/clk/clk-gpio.c b/drivers/clk/clk-gpio.c
index 19fed65587e8..7b09a265d79f 100644
--- a/drivers/clk/clk-gpio.c
+++ b/drivers/clk/clk-gpio.c
@@ -289,7 +289,7 @@ static void __init of_gpio_clk_setup(struct device_node *node,
 
         num_parents = of_clk_get_parent_count(node);
         if (num_parents < 0)
-                return;
+                num_parents = 0;
 
         data = kzalloc(sizeof(*data), GFP_KERNEL);
         if (!data)
diff --git a/drivers/clk/clk-scpi.c b/drivers/clk/clk-scpi.c
index cd0f2726f5e0..89e9ca78bb94 100644
--- a/drivers/clk/clk-scpi.c
+++ b/drivers/clk/clk-scpi.c
@@ -299,7 +299,7 @@ static int scpi_clocks_probe(struct platform_device *pdev)
         /* Add the virtual cpufreq device */
         cpufreq_dev = platform_device_register_simple("scpi-cpufreq",
                                                       -1, NULL, 0);
-        if (!cpufreq_dev)
+        if (IS_ERR(cpufreq_dev))
                 pr_warn("unable to register cpufreq device");
 
         return 0;
diff --git a/drivers/clk/mvebu/dove-divider.c b/drivers/clk/mvebu/dove-divider.c
index d5c5bfa35a5a..3e0b52daa35f 100644
--- a/drivers/clk/mvebu/dove-divider.c
+++ b/drivers/clk/mvebu/dove-divider.c
@@ -247,7 +247,7 @@ static struct clk_onecell_data dove_divider_data = {
 
 void __init dove_divider_clk_init(struct device_node *np)
 {
-        void *base;
+        void __iomem *base;
 
         base = of_iomap(np, 0);
         if (WARN_ON(!base))
diff --git a/drivers/clk/qcom/gcc-apq8084.c b/drivers/clk/qcom/gcc-apq8084.c
index cf73e539e9f6..070037a29ea5 100644
--- a/drivers/clk/qcom/gcc-apq8084.c
+++ b/drivers/clk/qcom/gcc-apq8084.c
@@ -3587,7 +3587,6 @@ static const struct regmap_config gcc_apq8084_regmap_config = {
         .val_bits       = 32,
         .max_register   = 0x1fc0,
         .fast_io        = true,
-        .val_format_endian = REGMAP_ENDIAN_LITTLE,
 };
 
 static const struct qcom_cc_desc gcc_apq8084_desc = {
diff --git a/drivers/clk/qcom/gcc-ipq806x.c b/drivers/clk/qcom/gcc-ipq806x.c
index b692ae881d6a..dd5402bac620 100644
--- a/drivers/clk/qcom/gcc-ipq806x.c
+++ b/drivers/clk/qcom/gcc-ipq806x.c
@@ -3005,7 +3005,6 @@ static const struct regmap_config gcc_ipq806x_regmap_config = {
         .val_bits       = 32,
         .max_register   = 0x3e40,
         .fast_io        = true,
-        .val_format_endian = REGMAP_ENDIAN_LITTLE,
 };
 
 static const struct qcom_cc_desc gcc_ipq806x_desc = {
diff --git a/drivers/clk/qcom/gcc-msm8660.c b/drivers/clk/qcom/gcc-msm8660.c
index f6a2b14dfec4..ad413036f7c7 100644
--- a/drivers/clk/qcom/gcc-msm8660.c
+++ b/drivers/clk/qcom/gcc-msm8660.c
@@ -2702,7 +2702,6 @@ static const struct regmap_config gcc_msm8660_regmap_config = {
         .val_bits       = 32,
         .max_register   = 0x363c,
         .fast_io        = true,
-        .val_format_endian = REGMAP_ENDIAN_LITTLE,
 };
 
 static const struct qcom_cc_desc gcc_msm8660_desc = {
diff --git a/drivers/clk/qcom/gcc-msm8916.c b/drivers/clk/qcom/gcc-msm8916.c
index e3bf09d7d0ef..8cc9b2868b41 100644
--- a/drivers/clk/qcom/gcc-msm8916.c
+++ b/drivers/clk/qcom/gcc-msm8916.c
@@ -3336,7 +3336,6 @@ static const struct regmap_config gcc_msm8916_regmap_config = {
         .val_bits       = 32,
         .max_register   = 0x80000,
         .fast_io        = true,
-        .val_format_endian = REGMAP_ENDIAN_LITTLE,
 };
 
 static const struct qcom_cc_desc gcc_msm8916_desc = {
diff --git a/drivers/clk/qcom/gcc-msm8960.c b/drivers/clk/qcom/gcc-msm8960.c
index f31111e32d44..983dd7dc89a7 100644
--- a/drivers/clk/qcom/gcc-msm8960.c
+++ b/drivers/clk/qcom/gcc-msm8960.c
@@ -3468,7 +3468,6 @@ static const struct regmap_config gcc_msm8960_regmap_config = {
         .val_bits       = 32,
         .max_register   = 0x3660,
         .fast_io        = true,
-        .val_format_endian = REGMAP_ENDIAN_LITTLE,
 };
 
 static const struct regmap_config gcc_apq8064_regmap_config = {
@@ -3477,7 +3476,6 @@ static const struct regmap_config gcc_apq8064_regmap_config = {
         .val_bits       = 32,
         .max_register   = 0x3880,
         .fast_io        = true,
-        .val_format_endian = REGMAP_ENDIAN_LITTLE,
 };
 
 static const struct qcom_cc_desc gcc_msm8960_desc = {
diff --git a/drivers/clk/qcom/gcc-msm8974.c b/drivers/clk/qcom/gcc-msm8974.c
index df164d618e34..335952db309b 100644
--- a/drivers/clk/qcom/gcc-msm8974.c
+++ b/drivers/clk/qcom/gcc-msm8974.c
@@ -2680,7 +2680,6 @@ static const struct regmap_config gcc_msm8974_regmap_config = {
         .val_bits       = 32,
         .max_register   = 0x1fc0,
         .fast_io        = true,
-        .val_format_endian = REGMAP_ENDIAN_LITTLE,
 };
 
 static const struct qcom_cc_desc gcc_msm8974_desc = {
diff --git a/drivers/clk/qcom/lcc-ipq806x.c b/drivers/clk/qcom/lcc-ipq806x.c
index 62e79fadd5f7..db3998e5e2d8 100644
--- a/drivers/clk/qcom/lcc-ipq806x.c
+++ b/drivers/clk/qcom/lcc-ipq806x.c
@@ -419,7 +419,6 @@ static const struct regmap_config lcc_ipq806x_regmap_config = {
         .val_bits       = 32,
         .max_register   = 0xfc,
         .fast_io        = true,
-        .val_format_endian = REGMAP_ENDIAN_LITTLE,
 };
 
 static const struct qcom_cc_desc lcc_ipq806x_desc = {
diff --git a/drivers/clk/qcom/lcc-msm8960.c b/drivers/clk/qcom/lcc-msm8960.c
index bf95bb0ea1b8..4fcf9d1d233c 100644
--- a/drivers/clk/qcom/lcc-msm8960.c
+++ b/drivers/clk/qcom/lcc-msm8960.c
@@ -524,7 +524,6 @@ static const struct regmap_config lcc_msm8960_regmap_config = {
         .val_bits       = 32,
         .max_register   = 0xfc,
         .fast_io        = true,
-        .val_format_endian = REGMAP_ENDIAN_LITTLE,
 };
 
 static const struct qcom_cc_desc lcc_msm8960_desc = {
diff --git a/drivers/clk/qcom/mmcc-apq8084.c b/drivers/clk/qcom/mmcc-apq8084.c
index 1e703fda8a0f..30777f9f1a43 100644
--- a/drivers/clk/qcom/mmcc-apq8084.c
+++ b/drivers/clk/qcom/mmcc-apq8084.c
@@ -3368,7 +3368,6 @@ static const struct regmap_config mmcc_apq8084_regmap_config = {
         .val_bits       = 32,
         .max_register   = 0x5104,
         .fast_io        = true,
-        .val_format_endian = REGMAP_ENDIAN_LITTLE,
 };
 
 static const struct qcom_cc_desc mmcc_apq8084_desc = {
diff --git a/drivers/clk/qcom/mmcc-msm8960.c b/drivers/clk/qcom/mmcc-msm8960.c
index d73a048d3b9d..00e36192a1de 100644
--- a/drivers/clk/qcom/mmcc-msm8960.c
+++ b/drivers/clk/qcom/mmcc-msm8960.c
@@ -3029,7 +3029,6 @@ static const struct regmap_config mmcc_msm8960_regmap_config = {
         .val_bits       = 32,
         .max_register   = 0x334,
         .fast_io        = true,
-        .val_format_endian = REGMAP_ENDIAN_LITTLE,
 };
 
 static const struct regmap_config mmcc_apq8064_regmap_config = {
@@ -3038,7 +3037,6 @@ static const struct regmap_config mmcc_apq8064_regmap_config = {
         .val_bits       = 32,
         .max_register   = 0x350,
         .fast_io        = true,
-        .val_format_endian = REGMAP_ENDIAN_LITTLE,
 };
 
 static const struct qcom_cc_desc mmcc_msm8960_desc = {
diff --git a/drivers/clk/qcom/mmcc-msm8974.c b/drivers/clk/qcom/mmcc-msm8974.c
index bbe28ed93669..9d790bcadf25 100644
--- a/drivers/clk/qcom/mmcc-msm8974.c
+++ b/drivers/clk/qcom/mmcc-msm8974.c
@@ -2594,7 +2594,6 @@ static const struct regmap_config mmcc_msm8974_regmap_config = {
         .val_bits       = 32,
         .max_register   = 0x5104,
         .fast_io        = true,
-        .val_format_endian = REGMAP_ENDIAN_LITTLE,
 };
 
 static const struct qcom_cc_desc mmcc_msm8974_desc = {
diff --git a/drivers/clk/rockchip/clk-rk3036.c b/drivers/clk/rockchip/clk-rk3036.c
index ebce98033fbb..bc7fbac83ab7 100644
--- a/drivers/clk/rockchip/clk-rk3036.c
+++ b/drivers/clk/rockchip/clk-rk3036.c
@@ -133,7 +133,7 @@ PNAME(mux_spdif_p)	= { "spdif_src", "spdif_frac", "xin12m" };
 PNAME(mux_uart0_p)      = { "uart0_src", "uart0_frac", "xin24m" };
 PNAME(mux_uart1_p)      = { "uart1_src", "uart1_frac", "xin24m" };
 PNAME(mux_uart2_p)      = { "uart2_src", "uart2_frac", "xin24m" };
-PNAME(mux_mac_p)        = { "mac_pll_src", "ext_gmac" };
+PNAME(mux_mac_p)        = { "mac_pll_src", "rmii_clkin" };
 PNAME(mux_dclk_p)       = { "dclk_lcdc", "dclk_cru" };
 
 static struct rockchip_pll_clock rk3036_pll_clks[] __initdata = {
@@ -224,16 +224,16 @@ static struct rockchip_clk_branch rk3036_clk_branches[] __initdata = {
                         RK2928_CLKGATE_CON(2), 2, GFLAGS),
 
         COMPOSITE_NODIV(SCLK_TIMER0, "sclk_timer0", mux_timer_p, CLK_IGNORE_UNUSED,
-                        RK2928_CLKSEL_CON(2), 4, 1, DFLAGS,
+                        RK2928_CLKSEL_CON(2), 4, 1, MFLAGS,
                         RK2928_CLKGATE_CON(1), 0, GFLAGS),
         COMPOSITE_NODIV(SCLK_TIMER1, "sclk_timer1", mux_timer_p, CLK_IGNORE_UNUSED,
-                        RK2928_CLKSEL_CON(2), 5, 1, DFLAGS,
+                        RK2928_CLKSEL_CON(2), 5, 1, MFLAGS,
                         RK2928_CLKGATE_CON(1), 1, GFLAGS),
         COMPOSITE_NODIV(SCLK_TIMER2, "sclk_timer2", mux_timer_p, CLK_IGNORE_UNUSED,
-                        RK2928_CLKSEL_CON(2), 6, 1, DFLAGS,
+                        RK2928_CLKSEL_CON(2), 6, 1, MFLAGS,
                         RK2928_CLKGATE_CON(2), 4, GFLAGS),
         COMPOSITE_NODIV(SCLK_TIMER3, "sclk_timer3", mux_timer_p, CLK_IGNORE_UNUSED,
-                        RK2928_CLKSEL_CON(2), 7, 1, DFLAGS,
+                        RK2928_CLKSEL_CON(2), 7, 1, MFLAGS,
                         RK2928_CLKGATE_CON(2), 5, GFLAGS),
 
         MUX(0, "uart_pll_clk", mux_pll_src_apll_dpll_gpll_usb480m_p, 0,
@@ -242,11 +242,11 @@ static struct rockchip_clk_branch rk3036_clk_branches[] __initdata = {
                         RK2928_CLKSEL_CON(13), 0, 7, DFLAGS,
                         RK2928_CLKGATE_CON(1), 8, GFLAGS),
         COMPOSITE_NOMUX(0, "uart1_src", "uart_pll_clk", 0,
-                        RK2928_CLKSEL_CON(13), 0, 7, DFLAGS,
-                        RK2928_CLKGATE_CON(1), 8, GFLAGS),
+                        RK2928_CLKSEL_CON(14), 0, 7, DFLAGS,
+                        RK2928_CLKGATE_CON(1), 10, GFLAGS),
         COMPOSITE_NOMUX(0, "uart2_src", "uart_pll_clk", 0,
-                        RK2928_CLKSEL_CON(13), 0, 7, DFLAGS,
-                        RK2928_CLKGATE_CON(1), 8, GFLAGS),
+                        RK2928_CLKSEL_CON(15), 0, 7, DFLAGS,
+                        RK2928_CLKGATE_CON(1), 12, GFLAGS),
         COMPOSITE_FRACMUX(0, "uart0_frac", "uart0_src", CLK_SET_RATE_PARENT,
                         RK2928_CLKSEL_CON(17), 0,
                         RK2928_CLKGATE_CON(1), 9, GFLAGS,
@@ -279,13 +279,13 @@ static struct rockchip_clk_branch rk3036_clk_branches[] __initdata = {
                         RK2928_CLKGATE_CON(3), 2, GFLAGS),
 
         COMPOSITE_NODIV(0, "sclk_sdmmc_src", mux_mmc_src_p, 0,
-                        RK2928_CLKSEL_CON(12), 8, 2, DFLAGS,
+                        RK2928_CLKSEL_CON(12), 8, 2, MFLAGS,
                         RK2928_CLKGATE_CON(2), 11, GFLAGS),
         DIV(SCLK_SDMMC, "sclk_sdmmc", "sclk_sdmmc_src", 0,
                         RK2928_CLKSEL_CON(11), 0, 7, DFLAGS),
 
         COMPOSITE_NODIV(0, "sclk_sdio_src", mux_mmc_src_p, 0,
-                        RK2928_CLKSEL_CON(12), 10, 2, DFLAGS,
+                        RK2928_CLKSEL_CON(12), 10, 2, MFLAGS,
                         RK2928_CLKGATE_CON(2), 13, GFLAGS),
         DIV(SCLK_SDIO, "sclk_sdio", "sclk_sdio_src", 0,
                         RK2928_CLKSEL_CON(11), 8, 7, DFLAGS),
@@ -344,12 +344,12 @@ static struct rockchip_clk_branch rk3036_clk_branches[] __initdata = {
                         RK2928_CLKGATE_CON(10), 5, GFLAGS),
 
         COMPOSITE_NOGATE(0, "mac_pll_src", mux_pll_src_3plls_p, 0,
-                        RK2928_CLKSEL_CON(21), 0, 2, MFLAGS, 4, 5, DFLAGS),
+                        RK2928_CLKSEL_CON(21), 0, 2, MFLAGS, 9, 5, DFLAGS),
         MUX(SCLK_MACREF, "mac_clk_ref", mux_mac_p, CLK_SET_RATE_PARENT,
                         RK2928_CLKSEL_CON(21), 3, 1, MFLAGS),
 
         COMPOSITE_NOMUX(SCLK_MAC, "mac_clk", "mac_clk_ref", 0,
-                        RK2928_CLKSEL_CON(21), 9, 5, DFLAGS,
+                        RK2928_CLKSEL_CON(21), 4, 5, DFLAGS,
                         RK2928_CLKGATE_CON(2), 6, GFLAGS),
 
         MUX(SCLK_HDMI, "dclk_hdmi", mux_dclk_p, 0,
diff --git a/drivers/clk/rockchip/clk-rk3368.c b/drivers/clk/rockchip/clk-rk3368.c
index be0ede522269..21f3ea909fab 100644
--- a/drivers/clk/rockchip/clk-rk3368.c
+++ b/drivers/clk/rockchip/clk-rk3368.c
@@ -780,13 +780,13 @@ static struct rockchip_clk_branch rk3368_clk_branches[] __initdata = {
         GATE(PCLK_TSADC, "pclk_tsadc", "pclk_peri", 0, RK3368_CLKGATE_CON(20), 0, GFLAGS),
 
         /* pclk_pd_alive gates */
-        GATE(PCLK_TIMER1, "pclk_timer1", "pclk_pd_alive", 0, RK3368_CLKGATE_CON(14), 8, GFLAGS),
-        GATE(PCLK_TIMER0, "pclk_timer0", "pclk_pd_alive", 0, RK3368_CLKGATE_CON(14), 7, GFLAGS),
-        GATE(0, "pclk_alive_niu", "pclk_pd_alive", CLK_IGNORE_UNUSED, RK3368_CLKGATE_CON(14), 12, GFLAGS),
-        GATE(PCLK_GRF, "pclk_grf", "pclk_pd_alive", CLK_IGNORE_UNUSED, RK3368_CLKGATE_CON(14), 11, GFLAGS),
-        GATE(PCLK_GPIO3, "pclk_gpio3", "pclk_pd_alive", 0, RK3368_CLKGATE_CON(14), 3, GFLAGS),
-        GATE(PCLK_GPIO2, "pclk_gpio2", "pclk_pd_alive", 0, RK3368_CLKGATE_CON(14), 2, GFLAGS),
-        GATE(PCLK_GPIO1, "pclk_gpio1", "pclk_pd_alive", 0, RK3368_CLKGATE_CON(14), 1, GFLAGS),
+        GATE(PCLK_TIMER1, "pclk_timer1", "pclk_pd_alive", 0, RK3368_CLKGATE_CON(22), 13, GFLAGS),
+        GATE(PCLK_TIMER0, "pclk_timer0", "pclk_pd_alive", 0, RK3368_CLKGATE_CON(22), 12, GFLAGS),
+        GATE(0, "pclk_alive_niu", "pclk_pd_alive", CLK_IGNORE_UNUSED, RK3368_CLKGATE_CON(22), 9, GFLAGS),
+        GATE(PCLK_GRF, "pclk_grf", "pclk_pd_alive", CLK_IGNORE_UNUSED, RK3368_CLKGATE_CON(22), 8, GFLAGS),
+        GATE(PCLK_GPIO3, "pclk_gpio3", "pclk_pd_alive", 0, RK3368_CLKGATE_CON(22), 3, GFLAGS),
+        GATE(PCLK_GPIO2, "pclk_gpio2", "pclk_pd_alive", 0, RK3368_CLKGATE_CON(22), 2, GFLAGS),
+        GATE(PCLK_GPIO1, "pclk_gpio1", "pclk_pd_alive", 0, RK3368_CLKGATE_CON(22), 1, GFLAGS),
 
         /*
          * pclk_vio gates
@@ -796,12 +796,12 @@ static struct rockchip_clk_branch rk3368_clk_branches[] __initdata = {
         GATE(0, "pclk_dphytx", "hclk_vio", CLK_IGNORE_UNUSED, RK3368_CLKGATE_CON(14), 8, GFLAGS),
 
         /* pclk_pd_pmu gates */
-        GATE(PCLK_PMUGRF, "pclk_pmugrf", "pclk_pd_pmu", CLK_IGNORE_UNUSED, RK3368_CLKGATE_CON(17), 0, GFLAGS),
-        GATE(PCLK_GPIO0, "pclk_gpio0", "pclk_pd_pmu", 0, RK3368_CLKGATE_CON(17), 4, GFLAGS),
-        GATE(PCLK_SGRF, "pclk_sgrf", "pclk_pd_pmu", CLK_IGNORE_UNUSED, RK3368_CLKGATE_CON(17), 3, GFLAGS),
-        GATE(0, "pclk_pmu_noc", "pclk_pd_pmu", CLK_IGNORE_UNUSED, RK3368_CLKGATE_CON(17), 2, GFLAGS),
-        GATE(0, "pclk_intmem1", "pclk_pd_pmu", CLK_IGNORE_UNUSED, RK3368_CLKGATE_CON(17), 1, GFLAGS),
-        GATE(PCLK_PMU, "pclk_pmu", "pclk_pd_pmu", CLK_IGNORE_UNUSED, RK3368_CLKGATE_CON(17), 2, GFLAGS),
+        GATE(PCLK_PMUGRF, "pclk_pmugrf", "pclk_pd_pmu", CLK_IGNORE_UNUSED, RK3368_CLKGATE_CON(23), 5, GFLAGS),
+        GATE(PCLK_GPIO0, "pclk_gpio0", "pclk_pd_pmu", 0, RK3368_CLKGATE_CON(23), 4, GFLAGS),
+        GATE(PCLK_SGRF, "pclk_sgrf", "pclk_pd_pmu", CLK_IGNORE_UNUSED, RK3368_CLKGATE_CON(23), 3, GFLAGS),
+        GATE(0, "pclk_pmu_noc", "pclk_pd_pmu", CLK_IGNORE_UNUSED, RK3368_CLKGATE_CON(23), 2, GFLAGS),
+        GATE(0, "pclk_intmem1", "pclk_pd_pmu", CLK_IGNORE_UNUSED, RK3368_CLKGATE_CON(23), 1, GFLAGS),
+        GATE(PCLK_PMU, "pclk_pmu", "pclk_pd_pmu", CLK_IGNORE_UNUSED, RK3368_CLKGATE_CON(23), 0, GFLAGS),
 
         /* timer gates */
         GATE(0, "sclk_timer15", "xin24m", CLK_IGNORE_UNUSED, RK3368_CLKGATE_CON(24), 11, GFLAGS),
diff --git a/drivers/clk/tegra/clk-emc.c b/drivers/clk/tegra/clk-emc.c
index e1fe8f35d45c..74e7544f861b 100644
--- a/drivers/clk/tegra/clk-emc.c
+++ b/drivers/clk/tegra/clk-emc.c
@@ -450,8 +450,10 @@ static int load_timings_from_dt(struct tegra_clk_emc *tegra,
                 struct emc_timing *timing = tegra->timings + (i++);
 
                 err = load_one_timing_from_dt(tegra, timing, child);
-                if (err)
+                if (err) {
+                        of_node_put(child);
                         return err;
+                }
 
                 timing->ram_code = ram_code;
         }
@@ -499,9 +501,9 @@ struct clk *tegra_clk_register_emc(void __iomem *base, struct device_node *np,
                  * fuses until the apbmisc driver is loaded.
                  */
                 err = load_timings_from_dt(tegra, node, node_ram_code);
+                of_node_put(node);
                 if (err)
                         return ERR_PTR(err);
-                of_node_put(node);
                 break;
         }
 
diff --git a/drivers/clk/tegra/clk-id.h b/drivers/clk/tegra/clk-id.h
index 19ce0738ee76..62ea38187b71 100644
--- a/drivers/clk/tegra/clk-id.h
+++ b/drivers/clk/tegra/clk-id.h
@@ -11,6 +11,7 @@ enum clk_id {
         tegra_clk_afi,
         tegra_clk_amx,
         tegra_clk_amx1,
+        tegra_clk_apb2ape,
         tegra_clk_apbdma,
         tegra_clk_apbif,
         tegra_clk_ape,
diff --git a/drivers/clk/tegra/clk-pll.c b/drivers/clk/tegra/clk-pll.c
index a534bfab30b3..6ac3f843e7ca 100644
--- a/drivers/clk/tegra/clk-pll.c
+++ b/drivers/clk/tegra/clk-pll.c
@@ -86,15 +86,21 @@
 #define PLLE_SS_DISABLE (PLLE_SS_CNTL_BYPASS_SS | PLLE_SS_CNTL_INTERP_RESET |\
                                 PLLE_SS_CNTL_SSC_BYP)
 #define PLLE_SS_MAX_MASK 0x1ff
-#define PLLE_SS_MAX_VAL 0x25
+#define PLLE_SS_MAX_VAL_TEGRA114 0x25
+#define PLLE_SS_MAX_VAL_TEGRA210 0x21
 #define PLLE_SS_INC_MASK (0xff << 16)
 #define PLLE_SS_INC_VAL (0x1 << 16)
 #define PLLE_SS_INCINTRV_MASK (0x3f << 24)
-#define PLLE_SS_INCINTRV_VAL (0x20 << 24)
+#define PLLE_SS_INCINTRV_VAL_TEGRA114 (0x20 << 24)
+#define PLLE_SS_INCINTRV_VAL_TEGRA210 (0x23 << 24)
 #define PLLE_SS_COEFFICIENTS_MASK \
         (PLLE_SS_MAX_MASK | PLLE_SS_INC_MASK | PLLE_SS_INCINTRV_MASK)
-#define PLLE_SS_COEFFICIENTS_VAL \
-        (PLLE_SS_MAX_VAL | PLLE_SS_INC_VAL | PLLE_SS_INCINTRV_VAL)
+#define PLLE_SS_COEFFICIENTS_VAL_TEGRA114 \
+        (PLLE_SS_MAX_VAL_TEGRA114 | PLLE_SS_INC_VAL |\
+         PLLE_SS_INCINTRV_VAL_TEGRA114)
+#define PLLE_SS_COEFFICIENTS_VAL_TEGRA210 \
+        (PLLE_SS_MAX_VAL_TEGRA210 | PLLE_SS_INC_VAL |\
+         PLLE_SS_INCINTRV_VAL_TEGRA210)
 
 #define PLLE_AUX_PLLP_SEL       BIT(2)
 #define PLLE_AUX_USE_LOCKDET    BIT(3)
@@ -880,7 +886,7 @@ static int clk_plle_training(struct tegra_clk_pll *pll)
 static int clk_plle_enable(struct clk_hw *hw)
 {
         struct tegra_clk_pll *pll = to_clk_pll(hw);
-        unsigned long input_rate = clk_get_rate(clk_get_parent(hw->clk));
+        unsigned long input_rate = clk_hw_get_rate(clk_hw_get_parent(hw));
         struct tegra_clk_pll_freq_table sel;
         u32 val;
         int err;
@@ -1378,7 +1384,7 @@ static int clk_plle_tegra114_enable(struct clk_hw *hw)
         u32 val;
         int ret;
         unsigned long flags = 0;
-        unsigned long input_rate = clk_get_rate(clk_get_parent(hw->clk));
+        unsigned long input_rate = clk_hw_get_rate(clk_hw_get_parent(hw));
 
         if (_get_table_rate(hw, &sel, pll->params->fixed_rate, input_rate))
                 return -EINVAL;
@@ -1401,7 +1407,7 @@ static int clk_plle_tegra114_enable(struct clk_hw *hw)
         val |= PLLE_MISC_IDDQ_SW_CTRL;
         val &= ~PLLE_MISC_IDDQ_SW_VALUE;
         val |= PLLE_MISC_PLLE_PTS;
-        val |= PLLE_MISC_VREG_BG_CTRL_MASK | PLLE_MISC_VREG_CTRL_MASK;
+        val &= ~(PLLE_MISC_VREG_BG_CTRL_MASK | PLLE_MISC_VREG_CTRL_MASK);
         pll_writel_misc(val, pll);
         udelay(5);
 
@@ -1428,7 +1434,7 @@ static int clk_plle_tegra114_enable(struct clk_hw *hw)
         val = pll_readl(PLLE_SS_CTRL, pll);
         val &= ~(PLLE_SS_CNTL_CENTER | PLLE_SS_CNTL_INVERT);
         val &= ~PLLE_SS_COEFFICIENTS_MASK;
-        val |= PLLE_SS_COEFFICIENTS_VAL;
+        val |= PLLE_SS_COEFFICIENTS_VAL_TEGRA114;
         pll_writel(val, PLLE_SS_CTRL, pll);
         val &= ~(PLLE_SS_CNTL_SSC_BYP | PLLE_SS_CNTL_BYPASS_SS);
         pll_writel(val, PLLE_SS_CTRL, pll);
@@ -2012,9 +2018,9 @@ static int clk_plle_tegra210_enable(struct clk_hw *hw)
         struct tegra_clk_pll *pll = to_clk_pll(hw);
         struct tegra_clk_pll_freq_table sel;
         u32 val;
-        int ret;
+        int ret = 0;
         unsigned long flags = 0;
-        unsigned long input_rate = clk_get_rate(clk_get_parent(hw->clk));
+        unsigned long input_rate = clk_hw_get_rate(clk_hw_get_parent(hw));
 
         if (_get_table_rate(hw, &sel, pll->params->fixed_rate, input_rate))
                 return -EINVAL;
@@ -2022,22 +2028,20 @@ static int clk_plle_tegra210_enable(struct clk_hw *hw)
         if (pll->lock)
                 spin_lock_irqsave(pll->lock, flags);
 
+        val = pll_readl(pll->params->aux_reg, pll);
+        if (val & PLLE_AUX_SEQ_ENABLE)
+                goto out;
+
         val = pll_readl_base(pll);
         val &= ~BIT(30); /* Disable lock override */
         pll_writel_base(val, pll);
 
-        val = pll_readl(pll->params->aux_reg, pll);
-        val |= PLLE_AUX_ENABLE_SWCTL;
-        val &= ~PLLE_AUX_SEQ_ENABLE;
-        pll_writel(val, pll->params->aux_reg, pll);
-        udelay(1);
-
         val = pll_readl_misc(pll);
         val |= PLLE_MISC_LOCK_ENABLE;
         val |= PLLE_MISC_IDDQ_SW_CTRL;
         val &= ~PLLE_MISC_IDDQ_SW_VALUE;
         val |= PLLE_MISC_PLLE_PTS;
-        val |= PLLE_MISC_VREG_BG_CTRL_MASK | PLLE_MISC_VREG_CTRL_MASK;
+        val &= ~(PLLE_MISC_VREG_BG_CTRL_MASK | PLLE_MISC_VREG_CTRL_MASK);
         pll_writel_misc(val, pll);
         udelay(5);
 
@@ -2067,7 +2071,7 @@ static int clk_plle_tegra210_enable(struct clk_hw *hw)
         val = pll_readl(PLLE_SS_CTRL, pll);
         val &= ~(PLLE_SS_CNTL_CENTER | PLLE_SS_CNTL_INVERT);
         val &= ~PLLE_SS_COEFFICIENTS_MASK;
-        val |= PLLE_SS_COEFFICIENTS_VAL;
+        val |= PLLE_SS_COEFFICIENTS_VAL_TEGRA210;
         pll_writel(val, PLLE_SS_CTRL, pll);
         val &= ~(PLLE_SS_CNTL_SSC_BYP | PLLE_SS_CNTL_BYPASS_SS);
         pll_writel(val, PLLE_SS_CTRL, pll);
@@ -2104,15 +2108,25 @@ static void clk_plle_tegra210_disable(struct clk_hw *hw)
         if (pll->lock)
                 spin_lock_irqsave(pll->lock, flags);
 
+        /* If PLLE HW sequencer is enabled, SW should not disable PLLE */
+        val = pll_readl(pll->params->aux_reg, pll);
+        if (val & PLLE_AUX_SEQ_ENABLE)
+                goto out;
+
         val = pll_readl_base(pll);
         val &= ~PLLE_BASE_ENABLE;
         pll_writel_base(val, pll);
 
+        val = pll_readl(pll->params->aux_reg, pll);
+        val |= PLLE_AUX_ENABLE_SWCTL | PLLE_AUX_SS_SWCTL;
+        pll_writel(val, pll->params->aux_reg, pll);
+
         val = pll_readl_misc(pll);
         val |= PLLE_MISC_IDDQ_SW_CTRL | PLLE_MISC_IDDQ_SW_VALUE;
         pll_writel_misc(val, pll);
         udelay(1);
 
+out:
         if (pll->lock)
                 spin_unlock_irqrestore(pll->lock, flags);
 }
diff --git a/drivers/clk/tegra/clk-tegra-periph.c b/drivers/clk/tegra/clk-tegra-periph.c
index 6ad381a888a6..ea2b9cbf9e70 100644
--- a/drivers/clk/tegra/clk-tegra-periph.c
+++ b/drivers/clk/tegra/clk-tegra-periph.c
@@ -773,7 +773,7 @@ static struct tegra_periph_init_data periph_clks[] = {
         XUSB("xusb_dev_src", mux_clkm_pllp_pllc_pllre, CLK_SOURCE_XUSB_DEV_SRC, 95, TEGRA_PERIPH_ON_APB | TEGRA_PERIPH_NO_RESET, tegra_clk_xusb_dev_src),
         XUSB("xusb_dev_src", mux_clkm_pllp_pllre, CLK_SOURCE_XUSB_DEV_SRC, 95, TEGRA_PERIPH_ON_APB | TEGRA_PERIPH_NO_RESET, tegra_clk_xusb_dev_src_8),
         MUX8("dbgapb", mux_pllp_clkm_2, CLK_SOURCE_DBGAPB, 185, TEGRA_PERIPH_NO_RESET, tegra_clk_dbgapb),
-        MUX8("msenc", mux_pllc2_c_c3_pllp_plla1_clkm, CLK_SOURCE_NVENC, 219, 0, tegra_clk_nvenc),
+        MUX8("nvenc", mux_pllc2_c_c3_pllp_plla1_clkm, CLK_SOURCE_NVENC, 219, 0, tegra_clk_nvenc),
         MUX8("nvdec", mux_pllc2_c_c3_pllp_plla1_clkm, CLK_SOURCE_NVDEC, 194, 0, tegra_clk_nvdec),
         MUX8("nvjpg", mux_pllc2_c_c3_pllp_plla1_clkm, CLK_SOURCE_NVJPG, 195, 0, tegra_clk_nvjpg),
         MUX8("ape", mux_plla_pllc4_out0_pllc_pllc4_out1_pllp_pllc4_out2_clkm, CLK_SOURCE_APE, 198, TEGRA_PERIPH_ON_APB, tegra_clk_ape),
@@ -782,7 +782,7 @@ static struct tegra_periph_init_data periph_clks[] = {
         NODIV("sor1", mux_clkm_sor1_brick_sor1_src, CLK_SOURCE_SOR1, 15, MASK(1), 183, 0, tegra_clk_sor1, &sor1_lock),
         MUX8("sdmmc_legacy", mux_pllp_out3_clkm_pllp_pllc4, CLK_SOURCE_SDMMC_LEGACY, 193, TEGRA_PERIPH_ON_APB | TEGRA_PERIPH_NO_RESET, tegra_clk_sdmmc_legacy),
         MUX8("qspi", mux_pllp_pllc_pllc_out1_pllc4_out2_pllc4_out1_clkm_pllc4_out0, CLK_SOURCE_QSPI, 211, TEGRA_PERIPH_ON_APB, tegra_clk_qspi),
-        MUX("vii2c", mux_pllp_pllc_clkm, CLK_SOURCE_VI_I2C, 208, TEGRA_PERIPH_ON_APB, tegra_clk_vi_i2c),
+        I2C("vii2c", mux_pllp_pllc_clkm, CLK_SOURCE_VI_I2C, 208, tegra_clk_vi_i2c),
         MUX("mipibif", mux_pllp_clkm, CLK_SOURCE_MIPIBIF, 173, TEGRA_PERIPH_ON_APB, tegra_clk_mipibif),
         MUX("uartape", mux_pllp_pllc_clkm, CLK_SOURCE_UARTAPE, 212, TEGRA_PERIPH_ON_APB | TEGRA_PERIPH_NO_RESET, tegra_clk_uartape),
         MUX8("tsecb", mux_pllp_pllc2_c_c3_clkm, CLK_SOURCE_TSECB, 206, 0, tegra_clk_tsecb),
@@ -829,6 +829,7 @@ static struct tegra_periph_init_data gate_clks[] = {
         GATE("xusb_gate", "osc", 143, 0, tegra_clk_xusb_gate, 0),
         GATE("pll_p_out_cpu", "pll_p", 223, 0, tegra_clk_pll_p_out_cpu, 0),
         GATE("pll_p_out_adsp", "pll_p", 187, 0, tegra_clk_pll_p_out_adsp, 0),
+        GATE("apb2ape", "clk_m", 107, 0, tegra_clk_apb2ape, 0),
 };
 
 static struct tegra_periph_init_data div_clks[] = {
diff --git a/drivers/clk/tegra/clk-tegra-super-gen4.c b/drivers/clk/tegra/clk-tegra-super-gen4.c
index 4559a20e3af6..474de0f0c26d 100644
--- a/drivers/clk/tegra/clk-tegra-super-gen4.c
+++ b/drivers/clk/tegra/clk-tegra-super-gen4.c
@@ -67,7 +67,7 @@ static const char *cclk_lp_parents[] = { "clk_m", "pll_c", "clk_32k", "pll_m",
                                          "pll_p", "pll_p_out4", "unused",
                                          "unused", "pll_x", "pll_x_out0" };
 
-const struct tegra_super_gen_info tegra_super_gen_info_gen4 = {
+static const struct tegra_super_gen_info tegra_super_gen_info_gen4 = {
         .gen = gen4,
         .sclk_parents = sclk_parents,
         .cclk_g_parents = cclk_g_parents,
@@ -93,7 +93,7 @@ static const char *cclk_lp_parents_gen5[] = { "clk_m", "unused", "clk_32k", "unu
                                         "unused", "unused", "unused", "unused",
                                         "dfllCPU_out" };
 
-const struct tegra_super_gen_info tegra_super_gen_info_gen5 = {
+static const struct tegra_super_gen_info tegra_super_gen_info_gen5 = {
         .gen = gen5,
         .sclk_parents = sclk_parents_gen5,
         .cclk_g_parents = cclk_g_parents_gen5,
@@ -171,7 +171,7 @@ static void __init tegra_sclk_init(void __iomem *clk_base,
         *dt_clk = clk;
 }
 
-void __init tegra_super_clk_init(void __iomem *clk_base,
+static void __init tegra_super_clk_init(void __iomem *clk_base,
                                 void __iomem *pmc_base,
                                 struct tegra_clk *tegra_clks,
                                 struct tegra_clk_pll_params *params,
diff --git a/drivers/clk/tegra/clk-tegra210.c b/drivers/clk/tegra/clk-tegra210.c
index 58514c44ea83..637041fd53ad 100644
--- a/drivers/clk/tegra/clk-tegra210.c
+++ b/drivers/clk/tegra/clk-tegra210.c
@@ -59,8 +59,8 @@
 #define PLLC3_MISC3 0x50c
 
 #define PLLM_BASE 0x90
-#define PLLM_MISC0 0x9c
 #define PLLM_MISC1 0x98
+#define PLLM_MISC2 0x9c
 #define PLLP_BASE 0xa0
 #define PLLP_MISC0 0xac
 #define PLLP_MISC1 0x680
@@ -99,7 +99,7 @@
 #define PLLC4_MISC0 0x5a8
 #define PLLC4_OUT 0x5e4
 #define PLLMB_BASE 0x5e8
-#define PLLMB_MISC0 0x5ec
+#define PLLMB_MISC1 0x5ec
 #define PLLA1_BASE 0x6a4
 #define PLLA1_MISC0 0x6a8
 #define PLLA1_MISC1 0x6ac
@@ -243,7 +243,8 @@ static unsigned long tegra210_input_freq[] = {
 };
 
 static const char *mux_pllmcp_clkm[] = {
-        "pll_m", "pll_c", "pll_p", "clk_m", "pll_m_ud", "pll_c2", "pll_c3",
+        "pll_m", "pll_c", "pll_p", "clk_m", "pll_m_ud", "pll_mb", "pll_mb",
+        "pll_p",
 };
 #define mux_pllmcp_clkm_idx NULL
 
@@ -367,12 +368,12 @@ static const char *mux_pllmcp_clkm[] = {
 /* PLLMB */
 #define PLLMB_BASE_LOCK                 (1 << 27)
 
-#define PLLMB_MISC0_LOCK_OVERRIDE       (1 << 18)
-#define PLLMB_MISC0_IDDQ                (1 << 17)
-#define PLLMB_MISC0_LOCK_ENABLE         (1 << 16)
+#define PLLMB_MISC1_LOCK_OVERRIDE       (1 << 18)
+#define PLLMB_MISC1_IDDQ                (1 << 17)
+#define PLLMB_MISC1_LOCK_ENABLE         (1 << 16)
 
-#define PLLMB_MISC0_DEFAULT_VALUE       0x00030000
-#define PLLMB_MISC0_WRITE_MASK          0x0007ffff
+#define PLLMB_MISC1_DEFAULT_VALUE       0x00030000
+#define PLLMB_MISC1_WRITE_MASK          0x0007ffff
 
 /* PLLP */
 #define PLLP_BASE_OVERRIDE              (1 << 28)
@@ -457,7 +458,8 @@ static void pllcx_check_defaults(struct tegra_clk_pll_params *params)
                         PLLCX_MISC3_WRITE_MASK);
 }
 
-void tegra210_pllcx_set_defaults(const char *name, struct tegra_clk_pll *pllcx)
+static void tegra210_pllcx_set_defaults(const char *name,
+                                        struct tegra_clk_pll *pllcx)
 {
         pllcx->params->defaults_set = true;
 
@@ -482,22 +484,22 @@ void tegra210_pllcx_set_defaults(const char *name, struct tegra_clk_pll *pllcx)
         udelay(1);
 }
 
-void _pllc_set_defaults(struct tegra_clk_pll *pllcx)
+static void _pllc_set_defaults(struct tegra_clk_pll *pllcx)
 {
         tegra210_pllcx_set_defaults("PLL_C", pllcx);
 }
 
-void _pllc2_set_defaults(struct tegra_clk_pll *pllcx)
+static void _pllc2_set_defaults(struct tegra_clk_pll *pllcx)
 {
         tegra210_pllcx_set_defaults("PLL_C2", pllcx);
 }
 
-void _pllc3_set_defaults(struct tegra_clk_pll *pllcx)
+static void _pllc3_set_defaults(struct tegra_clk_pll *pllcx)
 {
         tegra210_pllcx_set_defaults("PLL_C3", pllcx);
 }
 
-void _plla1_set_defaults(struct tegra_clk_pll *pllcx)
+static void _plla1_set_defaults(struct tegra_clk_pll *pllcx)
 {
         tegra210_pllcx_set_defaults("PLL_A1", pllcx);
 }
@@ -507,7 +509,7 @@ void _plla1_set_defaults(struct tegra_clk_pll *pllcx)
  * PLL with dynamic ramp and fractional SDM. Dynamic ramp is not used.
  * Fractional SDM is allowed to provide exact audio rates.
  */
-void tegra210_plla_set_defaults(struct tegra_clk_pll *plla)
+static void tegra210_plla_set_defaults(struct tegra_clk_pll *plla)
 {
         u32 mask;
         u32 val = readl_relaxed(clk_base + plla->params->base_reg);
@@ -559,7 +561,7 @@ void tegra210_plla_set_defaults(struct tegra_clk_pll *plla)
  * PLLD
  * PLL with fractional SDM.
  */
-void tegra210_plld_set_defaults(struct tegra_clk_pll *plld)
+static void tegra210_plld_set_defaults(struct tegra_clk_pll *plld)
 {
         u32 val;
         u32 mask = 0xffff;
@@ -698,7 +700,7 @@ static void plldss_defaults(const char *pll_name, struct tegra_clk_pll *plldss,
         udelay(1);
 }
 
-void tegra210_plld2_set_defaults(struct tegra_clk_pll *plld2)
+static void tegra210_plld2_set_defaults(struct tegra_clk_pll *plld2)
 {
         plldss_defaults("PLL_D2", plld2, PLLD2_MISC0_DEFAULT_VALUE,
                         PLLD2_MISC1_CFG_DEFAULT_VALUE,
@@ -706,7 +708,7 @@ void tegra210_plld2_set_defaults(struct tegra_clk_pll *plld2)
                         PLLD2_MISC3_CTRL2_DEFAULT_VALUE);
 }
 
-void tegra210_plldp_set_defaults(struct tegra_clk_pll *plldp)
+static void tegra210_plldp_set_defaults(struct tegra_clk_pll *plldp)
 {
         plldss_defaults("PLL_DP", plldp, PLLDP_MISC0_DEFAULT_VALUE,
                         PLLDP_MISC1_CFG_DEFAULT_VALUE,
@@ -719,7 +721,7 @@ void tegra210_plldp_set_defaults(struct tegra_clk_pll *plldp)
  * Base and misc0 layout is the same as PLLD2/PLLDP, but no SDM/SSC support.
  * VCO is exposed to the clock tree via fixed 1/3 and 1/5 dividers.
  */
-void tegra210_pllc4_set_defaults(struct tegra_clk_pll *pllc4)
+static void tegra210_pllc4_set_defaults(struct tegra_clk_pll *pllc4)
 {
         plldss_defaults("PLL_C4", pllc4, PLLC4_MISC0_DEFAULT_VALUE, 0, 0, 0);
 }
@@ -728,7 +730,7 @@ void tegra210_pllc4_set_defaults(struct tegra_clk_pll *pllc4)
  * PLLRE
  * VCO is exposed to the clock tree directly along with post-divider output
  */
-void tegra210_pllre_set_defaults(struct tegra_clk_pll *pllre)
+static void tegra210_pllre_set_defaults(struct tegra_clk_pll *pllre)
 {
         u32 mask;
         u32 val = readl_relaxed(clk_base + pllre->params->base_reg);
@@ -780,13 +782,13 @@ static void pllx_get_dyn_steps(struct clk_hw *hw, u32 *step_a, u32 *step_b)
 {
         unsigned long input_rate;
 
-        if (!IS_ERR_OR_NULL(hw->clk)) {
+        /* cf rate */
+        if (!IS_ERR_OR_NULL(hw->clk))
                 input_rate = clk_hw_get_rate(clk_hw_get_parent(hw));
-                /* cf rate */
-                input_rate /= tegra_pll_get_fixed_mdiv(hw, input_rate);
-        } else {
+        else
                 input_rate = 38400000;
-        }
+
+        input_rate /= tegra_pll_get_fixed_mdiv(hw, input_rate);
 
         switch (input_rate) {
         case 12000000:
@@ -841,7 +843,7 @@ static void pllx_check_defaults(struct tegra_clk_pll *pll)
                         PLLX_MISC5_WRITE_MASK);
 }
 
-void tegra210_pllx_set_defaults(struct tegra_clk_pll *pllx)
+static void tegra210_pllx_set_defaults(struct tegra_clk_pll *pllx)
 {
         u32 val;
         u32 step_a, step_b;
@@ -901,7 +903,7 @@ void tegra210_pllx_set_defaults(struct tegra_clk_pll *pllx)
 }
 
 /* PLLMB */
-void tegra210_pllmb_set_defaults(struct tegra_clk_pll *pllmb)
+static void tegra210_pllmb_set_defaults(struct tegra_clk_pll *pllmb)
 {
         u32 mask, val = readl_relaxed(clk_base + pllmb->params->base_reg);
 
@@ -914,15 +916,15 @@ void tegra210_pllmb_set_defaults(struct tegra_clk_pll *pllmb)
                  * PLL is ON: check if defaults already set, then set those
                  * that can be updated in flight.
                  */
-                val = PLLMB_MISC0_DEFAULT_VALUE & (~PLLMB_MISC0_IDDQ);
-                mask = PLLMB_MISC0_LOCK_ENABLE | PLLMB_MISC0_LOCK_OVERRIDE;
+                val = PLLMB_MISC1_DEFAULT_VALUE & (~PLLMB_MISC1_IDDQ);
+                mask = PLLMB_MISC1_LOCK_ENABLE | PLLMB_MISC1_LOCK_OVERRIDE;
                 _pll_misc_chk_default(clk_base, pllmb->params, 0, val,
-                                ~mask & PLLMB_MISC0_WRITE_MASK);
+                                ~mask & PLLMB_MISC1_WRITE_MASK);
 
                 /* Enable lock detect */
                 val = readl_relaxed(clk_base + pllmb->params->ext_misc_reg[0]);
                 val &= ~mask;
-                val |= PLLMB_MISC0_DEFAULT_VALUE & mask;
+                val |= PLLMB_MISC1_DEFAULT_VALUE & mask;
                 writel_relaxed(val, clk_base + pllmb->params->ext_misc_reg[0]);
                 udelay(1);
 
@@ -930,7 +932,7 @@ void tegra210_pllmb_set_defaults(struct tegra_clk_pll *pllmb)
         }
 
         /* set IDDQ, enable lock detect */
-        writel_relaxed(PLLMB_MISC0_DEFAULT_VALUE,
+        writel_relaxed(PLLMB_MISC1_DEFAULT_VALUE,
                         clk_base + pllmb->params->ext_misc_reg[0]);
         udelay(1);
 }
@@ -960,7 +962,7 @@ static void pllp_check_defaults(struct tegra_clk_pll *pll, bool enabled)
                         ~mask & PLLP_MISC1_WRITE_MASK);
 }
 
-void tegra210_pllp_set_defaults(struct tegra_clk_pll *pllp)
+static void tegra210_pllp_set_defaults(struct tegra_clk_pll *pllp)
 {
         u32 mask;
         u32 val = readl_relaxed(clk_base + pllp->params->base_reg);
@@ -1022,7 +1024,7 @@ static void pllu_check_defaults(struct tegra_clk_pll *pll, bool hw_control)
                         ~mask & PLLU_MISC1_WRITE_MASK);
 }
 
-void tegra210_pllu_set_defaults(struct tegra_clk_pll *pllu)
+static void tegra210_pllu_set_defaults(struct tegra_clk_pll *pllu)
 {
         u32 val = readl_relaxed(clk_base + pllu->params->base_reg);
 
@@ -1212,8 +1214,9 @@ static void tegra210_clk_pll_set_gain(struct tegra_clk_pll_freq_table *cfg)
         cfg->m *= PLL_SDM_COEFF;
 }
 
-unsigned long tegra210_clk_adjust_vco_min(struct tegra_clk_pll_params *params,
-                                          unsigned long parent_rate)
+static unsigned long
+tegra210_clk_adjust_vco_min(struct tegra_clk_pll_params *params,
+                            unsigned long parent_rate)
 {
         unsigned long vco_min = params->vco_min;
 
@@ -1386,7 +1389,7 @@ static struct tegra_clk_pll_params pll_c_params = {
         .mdiv_default = 3,
         .div_nmp = &pllc_nmp,
         .freq_table = pll_cx_freq_table,
-        .flags = TEGRA_PLL_USE_LOCK | TEGRA_PLL_HAS_LOCK_ENABLE,
+        .flags = TEGRA_PLL_USE_LOCK,
         .set_defaults = _pllc_set_defaults,
         .calc_rate = tegra210_pll_fixed_mdiv_cfg,
 };
@@ -1425,7 +1428,7 @@ static struct tegra_clk_pll_params pll_c2_params = {
         .ext_misc_reg[2] = PLLC2_MISC2,
         .ext_misc_reg[3] = PLLC2_MISC3,
         .freq_table = pll_cx_freq_table,
-        .flags = TEGRA_PLL_USE_LOCK | TEGRA_PLL_HAS_LOCK_ENABLE,
+        .flags = TEGRA_PLL_USE_LOCK,
         .set_defaults = _pllc2_set_defaults,
         .calc_rate = tegra210_pll_fixed_mdiv_cfg,
 };
@@ -1455,7 +1458,7 @@ static struct tegra_clk_pll_params pll_c3_params = {
         .ext_misc_reg[2] = PLLC3_MISC2,
         .ext_misc_reg[3] = PLLC3_MISC3,
         .freq_table = pll_cx_freq_table,
-        .flags = TEGRA_PLL_USE_LOCK | TEGRA_PLL_HAS_LOCK_ENABLE,
+        .flags = TEGRA_PLL_USE_LOCK,
         .set_defaults = _pllc3_set_defaults,
         .calc_rate = tegra210_pll_fixed_mdiv_cfg,
 };
@@ -1505,7 +1508,6 @@ static struct tegra_clk_pll_params pll_c4_vco_params = {
         .base_reg = PLLC4_BASE,
         .misc_reg = PLLC4_MISC0,
         .lock_mask = PLL_BASE_LOCK,
-        .lock_enable_bit_idx = PLLSS_MISC_LOCK_ENABLE,
         .lock_delay = 300,
         .max_p = PLL_QLIN_PDIV_MAX,
         .ext_misc_reg[0] = PLLC4_MISC0,
@@ -1517,8 +1519,7 @@ static struct tegra_clk_pll_params pll_c4_vco_params = {
         .div_nmp = &pllss_nmp,
         .freq_table = pll_c4_vco_freq_table,
         .set_defaults = tegra210_pllc4_set_defaults,
-        .flags = TEGRA_PLL_USE_LOCK | TEGRA_PLL_HAS_LOCK_ENABLE |
-                 TEGRA_PLL_VCO_OUT,
+        .flags = TEGRA_PLL_USE_LOCK | TEGRA_PLL_VCO_OUT,
         .calc_rate = tegra210_pll_fixed_mdiv_cfg,
 };
 
@@ -1559,15 +1560,15 @@ static struct tegra_clk_pll_params pll_m_params = {
         .vco_min = 800000000,
         .vco_max = 1866000000,
         .base_reg = PLLM_BASE,
-        .misc_reg = PLLM_MISC1,
+        .misc_reg = PLLM_MISC2,
         .lock_mask = PLL_BASE_LOCK,
         .lock_enable_bit_idx = PLLM_MISC_LOCK_ENABLE,
         .lock_delay = 300,
-        .iddq_reg = PLLM_MISC0,
+        .iddq_reg = PLLM_MISC2,
         .iddq_bit_idx = PLLM_IDDQ_BIT,
         .max_p = PLL_QLIN_PDIV_MAX,
-        .ext_misc_reg[0] = PLLM_MISC0,
-        .ext_misc_reg[0] = PLLM_MISC1,
+        .ext_misc_reg[0] = PLLM_MISC2,
+        .ext_misc_reg[1] = PLLM_MISC1,
         .round_p_to_pdiv = pll_qlin_p_to_pdiv,
         .pdiv_tohw = pll_qlin_pdiv_to_hw,
         .div_nmp = &pllm_nmp,
@@ -1586,19 +1587,18 @@ static struct tegra_clk_pll_params pll_mb_params = {
         .vco_min = 800000000,
         .vco_max = 1866000000,
         .base_reg = PLLMB_BASE,
-        .misc_reg = PLLMB_MISC0,
+        .misc_reg = PLLMB_MISC1,
         .lock_mask = PLL_BASE_LOCK,
-        .lock_enable_bit_idx = PLLMB_MISC_LOCK_ENABLE,
         .lock_delay = 300,
-        .iddq_reg = PLLMB_MISC0,
+        .iddq_reg = PLLMB_MISC1,
         .iddq_bit_idx = PLLMB_IDDQ_BIT,
         .max_p = PLL_QLIN_PDIV_MAX,
-        .ext_misc_reg[0] = PLLMB_MISC0,
+        .ext_misc_reg[0] = PLLMB_MISC1,
         .round_p_to_pdiv = pll_qlin_p_to_pdiv,
         .pdiv_tohw = pll_qlin_pdiv_to_hw,
         .div_nmp = &pllm_nmp,
         .freq_table = pll_m_freq_table,
-        .flags = TEGRA_PLL_USE_LOCK | TEGRA_PLL_HAS_LOCK_ENABLE,
+        .flags = TEGRA_PLL_USE_LOCK,
         .set_defaults = tegra210_pllmb_set_defaults,
         .calc_rate = tegra210_pll_fixed_mdiv_cfg,
 };
@@ -1671,7 +1671,6 @@ static struct tegra_clk_pll_params pll_re_vco_params = {
         .base_reg = PLLRE_BASE,
         .misc_reg = PLLRE_MISC0,
         .lock_mask = PLLRE_MISC_LOCK,
-        .lock_enable_bit_idx = PLLRE_MISC_LOCK_ENABLE,
         .lock_delay = 300,
         .max_p = PLL_QLIN_PDIV_MAX,
         .ext_misc_reg[0] = PLLRE_MISC0,
@@ -1681,8 +1680,7 @@ static struct tegra_clk_pll_params pll_re_vco_params = {
         .pdiv_tohw = pll_qlin_pdiv_to_hw,
         .div_nmp = &pllre_nmp,
         .freq_table = pll_re_vco_freq_table,
-        .flags = TEGRA_PLL_USE_LOCK | TEGRA_PLL_LOCK_MISC |
-                 TEGRA_PLL_HAS_LOCK_ENABLE | TEGRA_PLL_VCO_OUT,
+        .flags = TEGRA_PLL_USE_LOCK | TEGRA_PLL_LOCK_MISC | TEGRA_PLL_VCO_OUT,
         .set_defaults = tegra210_pllre_set_defaults,
         .calc_rate = tegra210_pll_fixed_mdiv_cfg,
 };
@@ -1712,7 +1710,6 @@ static struct tegra_clk_pll_params pll_p_params = {
         .base_reg = PLLP_BASE,
         .misc_reg = PLLP_MISC0,
         .lock_mask = PLL_BASE_LOCK,
-        .lock_enable_bit_idx = PLLP_MISC_LOCK_ENABLE,
         .lock_delay = 300,
         .iddq_reg = PLLP_MISC0,
         .iddq_bit_idx = PLLXP_IDDQ_BIT,
@@ -1721,8 +1718,7 @@ static struct tegra_clk_pll_params pll_p_params = {
         .div_nmp = &pllp_nmp,
         .freq_table = pll_p_freq_table,
         .fixed_rate = 408000000,
-        .flags = TEGRA_PLL_FIXED | TEGRA_PLL_USE_LOCK |
-                 TEGRA_PLL_HAS_LOCK_ENABLE | TEGRA_PLL_VCO_OUT,
+        .flags = TEGRA_PLL_FIXED | TEGRA_PLL_USE_LOCK | TEGRA_PLL_VCO_OUT,
         .set_defaults = tegra210_pllp_set_defaults,
         .calc_rate = tegra210_pll_fixed_mdiv_cfg,
 };
@@ -1750,7 +1746,7 @@ static struct tegra_clk_pll_params pll_a1_params = {
         .ext_misc_reg[2] = PLLA1_MISC2,
         .ext_misc_reg[3] = PLLA1_MISC3,
         .freq_table = pll_cx_freq_table,
-        .flags = TEGRA_PLL_USE_LOCK | TEGRA_PLL_HAS_LOCK_ENABLE,
+        .flags = TEGRA_PLL_USE_LOCK,
         .set_defaults = _plla1_set_defaults,
         .calc_rate = tegra210_pll_fixed_mdiv_cfg,
 };
@@ -1787,7 +1783,6 @@ static struct tegra_clk_pll_params pll_a_params = {
         .base_reg = PLLA_BASE,
         .misc_reg = PLLA_MISC0,
         .lock_mask = PLL_BASE_LOCK,
-        .lock_enable_bit_idx = PLLA_MISC_LOCK_ENABLE,
         .lock_delay = 300,
         .round_p_to_pdiv = pll_qlin_p_to_pdiv,
         .pdiv_tohw = pll_qlin_pdiv_to_hw,
@@ -1802,8 +1797,7 @@ static struct tegra_clk_pll_params pll_a_params = {
         .ext_misc_reg[1] = PLLA_MISC1,
         .ext_misc_reg[2] = PLLA_MISC2,
         .freq_table = pll_a_freq_table,
-        .flags = TEGRA_PLL_USE_LOCK | TEGRA_MDIV_NEW |
-                 TEGRA_PLL_HAS_LOCK_ENABLE,
+        .flags = TEGRA_PLL_USE_LOCK | TEGRA_MDIV_NEW,
         .set_defaults = tegra210_plla_set_defaults,
         .calc_rate = tegra210_pll_fixed_mdiv_cfg,
         .set_gain = tegra210_clk_pll_set_gain,
@@ -1836,7 +1830,6 @@ static struct tegra_clk_pll_params pll_d_params = {
         .base_reg = PLLD_BASE,
         .misc_reg = PLLD_MISC0,
         .lock_mask = PLL_BASE_LOCK,
-        .lock_enable_bit_idx = PLLD_MISC_LOCK_ENABLE,
         .lock_delay = 1000,
         .iddq_reg = PLLD_MISC0,
         .iddq_bit_idx = PLLD_IDDQ_BIT,
@@ -1850,7 +1843,7 @@ static struct tegra_clk_pll_params pll_d_params = {
         .ext_misc_reg[0] = PLLD_MISC0,
         .ext_misc_reg[1] = PLLD_MISC1,
         .freq_table = pll_d_freq_table,
-        .flags = TEGRA_PLL_USE_LOCK | TEGRA_PLL_HAS_LOCK_ENABLE,
+        .flags = TEGRA_PLL_USE_LOCK,
         .mdiv_default = 1,
         .set_defaults = tegra210_plld_set_defaults,
         .calc_rate = tegra210_pll_fixed_mdiv_cfg,
@@ -1876,7 +1869,6 @@ static struct tegra_clk_pll_params pll_d2_params = {
         .base_reg = PLLD2_BASE,
         .misc_reg = PLLD2_MISC0,
         .lock_mask = PLL_BASE_LOCK,
-        .lock_enable_bit_idx = PLLSS_MISC_LOCK_ENABLE,
         .lock_delay = 300,
         .iddq_reg = PLLD2_BASE,
         .iddq_bit_idx = PLLSS_IDDQ_BIT,
@@ -1897,7 +1889,7 @@ static struct tegra_clk_pll_params pll_d2_params = {
         .mdiv_default = 1,
         .freq_table = tegra210_pll_d2_freq_table,
         .set_defaults = tegra210_plld2_set_defaults,
-        .flags = TEGRA_PLL_USE_LOCK | TEGRA_PLL_HAS_LOCK_ENABLE,
+        .flags = TEGRA_PLL_USE_LOCK,
         .calc_rate = tegra210_pll_fixed_mdiv_cfg,
         .set_gain = tegra210_clk_pll_set_gain,
         .adjust_vco = tegra210_clk_adjust_vco_min,
@@ -1920,7 +1912,6 @@ static struct tegra_clk_pll_params pll_dp_params = {
         .base_reg = PLLDP_BASE,
         .misc_reg = PLLDP_MISC,
         .lock_mask = PLL_BASE_LOCK,
-        .lock_enable_bit_idx = PLLSS_MISC_LOCK_ENABLE,
         .lock_delay = 300,
         .iddq_reg = PLLDP_BASE,
         .iddq_bit_idx = PLLSS_IDDQ_BIT,
@@ -1941,7 +1932,7 @@ static struct tegra_clk_pll_params pll_dp_params = {
         .mdiv_default = 1,
         .freq_table = pll_dp_freq_table,
         .set_defaults = tegra210_plldp_set_defaults,
-        .flags = TEGRA_PLL_USE_LOCK | TEGRA_PLL_HAS_LOCK_ENABLE,
+        .flags = TEGRA_PLL_USE_LOCK,
         .calc_rate = tegra210_pll_fixed_mdiv_cfg,
         .set_gain = tegra210_clk_pll_set_gain,
         .adjust_vco = tegra210_clk_adjust_vco_min,
@@ -1973,7 +1964,6 @@ static struct tegra_clk_pll_params pll_u_vco_params = {
         .base_reg = PLLU_BASE,
         .misc_reg = PLLU_MISC0,
         .lock_mask = PLL_BASE_LOCK,
-        .lock_enable_bit_idx = PLLU_MISC_LOCK_ENABLE,
         .lock_delay = 1000,
         .iddq_reg = PLLU_MISC0,
         .iddq_bit_idx = PLLU_IDDQ_BIT,
@@ -1983,8 +1973,7 @@ static struct tegra_clk_pll_params pll_u_vco_params = {
         .pdiv_tohw = pll_qlin_pdiv_to_hw,
         .div_nmp = &pllu_nmp,
         .freq_table = pll_u_freq_table,
-        .flags = TEGRA_PLLU | TEGRA_PLL_USE_LOCK | TEGRA_PLL_HAS_LOCK_ENABLE |
-                 TEGRA_PLL_VCO_OUT,
+        .flags = TEGRA_PLLU | TEGRA_PLL_USE_LOCK | TEGRA_PLL_VCO_OUT,
         .set_defaults = tegra210_pllu_set_defaults,
         .calc_rate = tegra210_pll_fixed_mdiv_cfg,
 };
@@ -2218,6 +2207,7 @@ static struct tegra_clk tegra210_clks[tegra_clk_max] __initdata = {
         [tegra_clk_pll_c4_out1] = { .dt_id = TEGRA210_CLK_PLL_C4_OUT1, .present = true },
         [tegra_clk_pll_c4_out2] = { .dt_id = TEGRA210_CLK_PLL_C4_OUT2, .present = true },
         [tegra_clk_pll_c4_out3] = { .dt_id = TEGRA210_CLK_PLL_C4_OUT3, .present = true },
+        [tegra_clk_apb2ape] = { .dt_id = TEGRA210_CLK_APB2APE, .present = true },
 };
 
 static struct tegra_devclk devclks[] __initdata = {
@@ -2519,7 +2509,7 @@ static void __init tegra210_pll_init(void __iomem *clk_base,
 
         /* PLLU_VCO */
         val = readl(clk_base + pll_u_vco_params.base_reg);
-        val &= ~BIT(24); /* disable PLLU_OVERRIDE */
+        val &= ~PLLU_BASE_OVERRIDE; /* disable PLLU_OVERRIDE */
         writel(val, clk_base + pll_u_vco_params.base_reg);
 
         clk = tegra_clk_register_pllre("pll_u_vco", "pll_ref", clk_base, pmc,
@@ -2738,8 +2728,6 @@ static struct tegra_clk_init_table init_table[] __initdata = {
         { TEGRA210_CLK_DFLL_REF, TEGRA210_CLK_PLL_P, 51000000, 1 },
         { TEGRA210_CLK_SBC4, TEGRA210_CLK_PLL_P, 12000000, 1 },
         { TEGRA210_CLK_PLL_RE_VCO, TEGRA210_CLK_CLK_MAX, 672000000, 1 },
-        { TEGRA210_CLK_PLL_U_OUT1, TEGRA210_CLK_CLK_MAX, 48000000, 1 },
-        { TEGRA210_CLK_PLL_U_OUT2, TEGRA210_CLK_CLK_MAX, 60000000, 1 },
         { TEGRA210_CLK_XUSB_GATE, TEGRA210_CLK_CLK_MAX, 0, 1 },
         { TEGRA210_CLK_XUSB_SS_SRC, TEGRA210_CLK_PLL_U_480M, 120000000, 0 },
         { TEGRA210_CLK_XUSB_FS_SRC, TEGRA210_CLK_PLL_U_48M, 48000000, 0 },
diff --git a/drivers/clk/ti/dpll3xxx.c b/drivers/clk/ti/dpll3xxx.c
index 1c300388782b..cc739291a3ce 100644
--- a/drivers/clk/ti/dpll3xxx.c
+++ b/drivers/clk/ti/dpll3xxx.c
@@ -460,7 +460,8 @@ int omap3_noncore_dpll_enable(struct clk_hw *hw)
 
         parent = clk_hw_get_parent(hw);
 
-        if (clk_hw_get_rate(hw) == clk_get_rate(dd->clk_bypass)) {
+        if (clk_hw_get_rate(hw) ==
+            clk_hw_get_rate(__clk_get_hw(dd->clk_bypass))) {
                 WARN_ON(parent != __clk_get_hw(dd->clk_bypass));
                 r = _omap3_noncore_dpll_bypass(clk);
         } else {
diff --git a/drivers/clk/versatile/clk-icst.c b/drivers/clk/versatile/clk-icst.c
index e62f8cb2c9b5..3bca438ecd19 100644
--- a/drivers/clk/versatile/clk-icst.c
+++ b/drivers/clk/versatile/clk-icst.c
@@ -78,6 +78,9 @@ static int vco_set(struct clk_icst *icst, struct icst_vco vco)
         ret = regmap_read(icst->map, icst->vcoreg_off, &val);
         if (ret)
                 return ret;
+
+        /* Mask the 18 bits used by the VCO */
+        val &= ~0x7ffff;
         val |= vco.v | (vco.r << 9) | (vco.s << 16);
 
         /* This magic unlocks the VCO so it can be controlled */
diff --git a/drivers/cpufreq/Kconfig b/drivers/cpufreq/Kconfig
index 659879a56dba..f93511031177 100644
--- a/drivers/cpufreq/Kconfig
+++ b/drivers/cpufreq/Kconfig
@@ -296,6 +296,7 @@ endif
 config QORIQ_CPUFREQ
         tristate "CPU frequency scaling driver for Freescale QorIQ SoCs"
         depends on OF && COMMON_CLK && (PPC_E500MC || ARM)
+        depends on !CPU_THERMAL || THERMAL
         select CLK_QORIQ
         help
           This adds the CPUFreq driver support for Freescale QorIQ SoCs
diff --git a/drivers/cpufreq/Kconfig.arm b/drivers/cpufreq/Kconfig.arm
index 0031069b64c9..14b1f9393b05 100644
--- a/drivers/cpufreq/Kconfig.arm
+++ b/drivers/cpufreq/Kconfig.arm
@@ -84,10 +84,10 @@ config ARM_KIRKWOOD_CPUFREQ
           SoCs.
 
 config ARM_MT8173_CPUFREQ
-        bool "Mediatek MT8173 CPUFreq support"
+        tristate "Mediatek MT8173 CPUFreq support"
         depends on ARCH_MEDIATEK && REGULATOR
         depends on ARM64 || (ARM_CPU_TOPOLOGY && COMPILE_TEST)
-        depends on !CPU_THERMAL || THERMAL=y
+        depends on !CPU_THERMAL || THERMAL
         select PM_OPP
         help
           This adds the CPUFreq driver support for Mediatek MT8173 SoC.
diff --git a/drivers/cpufreq/mt8173-cpufreq.c b/drivers/cpufreq/mt8173-cpufreq.c
index 1efba340456d..2058e6d292ce 100644
--- a/drivers/cpufreq/mt8173-cpufreq.c
+++ b/drivers/cpufreq/mt8173-cpufreq.c
@@ -17,6 +17,7 @@
 #include <linux/cpu_cooling.h>
 #include <linux/cpufreq.h>
 #include <linux/cpumask.h>
+#include <linux/module.h>
 #include <linux/of.h>
 #include <linux/platform_device.h>
 #include <linux/pm_opp.h>
diff --git a/drivers/crypto/atmel-sha.c b/drivers/crypto/atmel-sha.c
index 20de861aa0ea..8bf9914d4d15 100644
--- a/drivers/crypto/atmel-sha.c
+++ b/drivers/crypto/atmel-sha.c
@@ -782,7 +782,7 @@ static void atmel_sha_finish_req(struct ahash_request *req, int err)
         dd->flags &= ~(SHA_FLAGS_BUSY | SHA_FLAGS_FINAL | SHA_FLAGS_CPU |
                         SHA_FLAGS_DMA_READY | SHA_FLAGS_OUTPUT_READY);
 
-        clk_disable_unprepare(dd->iclk);
+        clk_disable(dd->iclk);
 
         if (req->base.complete)
                 req->base.complete(&req->base, err);
@@ -795,7 +795,7 @@ static int atmel_sha_hw_init(struct atmel_sha_dev *dd)
 {
         int err;
 
-        err = clk_prepare_enable(dd->iclk);
+        err = clk_enable(dd->iclk);
         if (err)
                 return err;
 
@@ -822,7 +822,7 @@ static void atmel_sha_hw_version_init(struct atmel_sha_dev *dd)
         dev_info(dd->dev,
                         "version: 0x%x\n", dd->hw_version);
 
-        clk_disable_unprepare(dd->iclk);
+        clk_disable(dd->iclk);
 }
 
 static int atmel_sha_handle_queue(struct atmel_sha_dev *dd,
@@ -1410,6 +1410,10 @@ static int atmel_sha_probe(struct platform_device *pdev)
                 goto res_err;
         }
 
+        err = clk_prepare(sha_dd->iclk);
+        if (err)
+                goto res_err;
+
         atmel_sha_hw_version_init(sha_dd);
 
         atmel_sha_get_cap(sha_dd);
@@ -1421,12 +1425,12 @@ static int atmel_sha_probe(struct platform_device *pdev)
                         if (IS_ERR(pdata)) {
                                 dev_err(&pdev->dev, "platform data not available\n");
                                 err = PTR_ERR(pdata);
-                                goto res_err;
+                                goto iclk_unprepare;
                         }
                 }
                 if (!pdata->dma_slave) {
                         err = -ENXIO;
-                        goto res_err;
+                        goto iclk_unprepare;
                 }
                 err = atmel_sha_dma_init(sha_dd, pdata);
                 if (err)
@@ -1457,6 +1461,8 @@ err_algs:
         if (sha_dd->caps.has_dma)
                 atmel_sha_dma_cleanup(sha_dd);
 err_sha_dma:
+iclk_unprepare:
+        clk_unprepare(sha_dd->iclk);
 res_err:
         tasklet_kill(&sha_dd->done_task);
 sha_dd_err:
@@ -1483,12 +1489,7 @@ static int atmel_sha_remove(struct platform_device *pdev)
         if (sha_dd->caps.has_dma)
                 atmel_sha_dma_cleanup(sha_dd);
 
-        iounmap(sha_dd->io_base);
-
-        clk_put(sha_dd->iclk);
-
-        if (sha_dd->irq >= 0)
-                free_irq(sha_dd->irq, sha_dd);
+        clk_unprepare(sha_dd->iclk);
 
         return 0;
 }
diff --git a/drivers/crypto/marvell/cesa.c b/drivers/crypto/marvell/cesa.c
index 0643e3366e33..c0656e7f37b5 100644
--- a/drivers/crypto/marvell/cesa.c
+++ b/drivers/crypto/marvell/cesa.c
@@ -306,7 +306,7 @@ static int mv_cesa_dev_dma_init(struct mv_cesa_dev *cesa)
                 return -ENOMEM;
 
         dma->padding_pool = dmam_pool_create("cesa_padding", dev, 72, 1, 0);
-        if (!dma->cache_pool)
+        if (!dma->padding_pool)
                 return -ENOMEM;
 
         cesa->dma = dma;
diff --git a/drivers/devfreq/tegra-devfreq.c b/drivers/devfreq/tegra-devfreq.c
index 848b93ee930f..fe9dce0245bf 100644
--- a/drivers/devfreq/tegra-devfreq.c
+++ b/drivers/devfreq/tegra-devfreq.c
@@ -500,6 +500,8 @@ static int tegra_devfreq_target(struct device *dev, unsigned long *freq,
         clk_set_min_rate(tegra->emc_clock, rate);
         clk_set_rate(tegra->emc_clock, 0);
 
+        *freq = rate;
+
         return 0;
 }
 
diff --git a/drivers/dma/at_xdmac.c b/drivers/dma/at_xdmac.c
index 64f5d1bdbb48..8e304b1befc5 100644
--- a/drivers/dma/at_xdmac.c
+++ b/drivers/dma/at_xdmac.c
@@ -176,6 +176,7 @@
 #define AT_XDMAC_MAX_CHAN       0x20
 #define AT_XDMAC_MAX_CSIZE      16      /* 16 data */
 #define AT_XDMAC_MAX_DWIDTH     8       /* 64 bits */
+#define AT_XDMAC_RESIDUE_MAX_RETRIES    5
 
 #define AT_XDMAC_DMA_BUSWIDTHS\
         (BIT(DMA_SLAVE_BUSWIDTH_UNDEFINED) |\
@@ -1395,8 +1396,8 @@ at_xdmac_tx_status(struct dma_chan *chan, dma_cookie_t cookie,
         struct at_xdmac_desc    *desc, *_desc;
         struct list_head        *descs_list;
         enum dma_status         ret;
-        int                     residue;
-        u32                     cur_nda, mask, value;
+        int                     residue, retry;
+        u32                     cur_nda, check_nda, cur_ubc, mask, value;
         u8                      dwidth = 0;
         unsigned long           flags;
 
@@ -1433,7 +1434,42 @@ at_xdmac_tx_status(struct dma_chan *chan, dma_cookie_t cookie,
                         cpu_relax();
         }
 
+        /*
+         * When processing the residue, we need to read two registers but we
+         * can't do it in an atomic way. AT_XDMAC_CNDA is used to find where
+         * we stand in the descriptor list and AT_XDMAC_CUBC is used
+         * to know how many data are remaining for the current descriptor.
+         * Since the dma channel is not paused to not loose data, between the
+         * AT_XDMAC_CNDA and AT_XDMAC_CUBC read, we may have change of
+         * descriptor.
+         * For that reason, after reading AT_XDMAC_CUBC, we check if we are
+         * still using the same descriptor by reading a second time
+         * AT_XDMAC_CNDA. If AT_XDMAC_CNDA has changed, it means we have to
+         * read again AT_XDMAC_CUBC.
+         * Memory barriers are used to ensure the read order of the registers.
+         * A max number of retries is set because unlikely it can never ends if
+         * we are transferring a lot of data with small buffers.
+         */
         cur_nda = at_xdmac_chan_read(atchan, AT_XDMAC_CNDA) & 0xfffffffc;
+        rmb();
+        cur_ubc = at_xdmac_chan_read(atchan, AT_XDMAC_CUBC);
+        for (retry = 0; retry < AT_XDMAC_RESIDUE_MAX_RETRIES; retry++) {
+                rmb();
+                check_nda = at_xdmac_chan_read(atchan, AT_XDMAC_CNDA) & 0xfffffffc;
+
+                if (likely(cur_nda == check_nda))
+                        break;
+
+                cur_nda = check_nda;
+                rmb();
+                cur_ubc = at_xdmac_chan_read(atchan, AT_XDMAC_CUBC);
+        }
+
+        if (unlikely(retry >= AT_XDMAC_RESIDUE_MAX_RETRIES)) {
+                ret = DMA_ERROR;
+                goto spin_unlock;
+        }
+
         /*
          * Remove size of all microblocks already transferred and the current
          * one. Then add the remaining size to transfer of the current
@@ -1446,7 +1482,7 @@ at_xdmac_tx_status(struct dma_chan *chan, dma_cookie_t cookie,
                 if ((desc->lld.mbr_nda & 0xfffffffc) == cur_nda)
                         break;
         }
-        residue += at_xdmac_chan_read(atchan, AT_XDMAC_CUBC) << dwidth;
+        residue += cur_ubc << dwidth;
 
         dma_set_residue(txstate, residue);
 
diff --git a/drivers/dma/dw/core.c b/drivers/dma/dw/core.c
index e893318560db..5ad0ec1f0e29 100644
--- a/drivers/dma/dw/core.c
+++ b/drivers/dma/dw/core.c
@@ -156,7 +156,6 @@ static void dwc_initialize(struct dw_dma_chan *dwc)
 
         /* Enable interrupts */
         channel_set_bit(dw, MASK.XFER, dwc->mask);
-        channel_set_bit(dw, MASK.BLOCK, dwc->mask);
         channel_set_bit(dw, MASK.ERROR, dwc->mask);
 
         dwc->initialized = true;
@@ -588,6 +587,9 @@ static void dwc_handle_cyclic(struct dw_dma *dw, struct dw_dma_chan *dwc,
 
                 spin_unlock_irqrestore(&dwc->lock, flags);
         }
+
+        /* Re-enable interrupts */
+        channel_set_bit(dw, MASK.BLOCK, dwc->mask);
 }
 
 /* ------------------------------------------------------------------------- */
@@ -618,11 +620,8 @@ static void dw_dma_tasklet(unsigned long data)
                         dwc_scan_descriptors(dw, dwc);
         }
 
-        /*
-         * Re-enable interrupts.
-         */
+        /* Re-enable interrupts */
         channel_set_bit(dw, MASK.XFER, dw->all_chan_mask);
-        channel_set_bit(dw, MASK.BLOCK, dw->all_chan_mask);
         channel_set_bit(dw, MASK.ERROR, dw->all_chan_mask);
 }
 
@@ -1261,6 +1260,7 @@ static void dwc_free_chan_resources(struct dma_chan *chan)
 int dw_dma_cyclic_start(struct dma_chan *chan)
 {
         struct dw_dma_chan      *dwc = to_dw_dma_chan(chan);
+        struct dw_dma           *dw = to_dw_dma(chan->device);
         unsigned long           flags;
 
         if (!test_bit(DW_DMA_IS_CYCLIC, &dwc->flags)) {
@@ -1269,7 +1269,12 @@ int dw_dma_cyclic_start(struct dma_chan *chan)
         }
 
         spin_lock_irqsave(&dwc->lock, flags);
+
+        /* Enable interrupts to perform cyclic transfer */
+        channel_set_bit(dw, MASK.BLOCK, dwc->mask);
+
         dwc_dostart(dwc, dwc->cdesc->desc[0]);
+
         spin_unlock_irqrestore(&dwc->lock, flags);
 
         return 0;
diff --git a/drivers/dma/dw/pci.c b/drivers/dma/dw/pci.c
index 4c30fdd092b3..358f9689a3f5 100644
--- a/drivers/dma/dw/pci.c
+++ b/drivers/dma/dw/pci.c
@@ -108,6 +108,10 @@ static const struct pci_device_id dw_pci_id_table[] = {
 
         /* Haswell */
         { PCI_VDEVICE(INTEL, 0x9c60) },
+
+        /* Broadwell */
+        { PCI_VDEVICE(INTEL, 0x9ce0) },
+
         { }
 };
 MODULE_DEVICE_TABLE(pci, dw_pci_id_table);
diff --git a/drivers/dma/edma.c b/drivers/dma/edma.c
index d92d65549406..e3d7fcb69b4c 100644
--- a/drivers/dma/edma.c
+++ b/drivers/dma/edma.c
@@ -113,6 +113,9 @@
 #define GET_NUM_REGN(x)         ((x & 0x300000) >> 20) /* bits 20-21 */
 #define CHMAP_EXIST             BIT(24)
 
+/* CCSTAT register */
+#define EDMA_CCSTAT_ACTV        BIT(4)
+
 /*
  * Max of 20 segments per channel to conserve PaRAM slots
  * Also note that MAX_NR_SG should be atleast the no.of periods
@@ -1680,9 +1683,20 @@ static void edma_issue_pending(struct dma_chan *chan)
         spin_unlock_irqrestore(&echan->vchan.lock, flags);
 }
 
+/*
+ * This limit exists to avoid a possible infinite loop when waiting for proof
+ * that a particular transfer is completed. This limit can be hit if there
+ * are large bursts to/from slow devices or the CPU is never able to catch
+ * the DMA hardware idle. On an AM335x transfering 48 bytes from the UART
+ * RX-FIFO, as many as 55 loops have been seen.
+ */
+#define EDMA_MAX_TR_WAIT_LOOPS 1000
+
 static u32 edma_residue(struct edma_desc *edesc)
 {
         bool dst = edesc->direction == DMA_DEV_TO_MEM;
+        int loop_count = EDMA_MAX_TR_WAIT_LOOPS;
+        struct edma_chan *echan = edesc->echan;
         struct edma_pset *pset = edesc->pset;
         dma_addr_t done, pos;
         int i;
@@ -1691,7 +1705,32 @@ static u32 edma_residue(struct edma_desc *edesc)
          * We always read the dst/src position from the first RamPar
          * pset. That's the one which is active now.
          */
-        pos = edma_get_position(edesc->echan->ecc, edesc->echan->slot[0], dst);
+        pos = edma_get_position(echan->ecc, echan->slot[0], dst);
+
+        /*
+         * "pos" may represent a transfer request that is still being
+         * processed by the EDMACC or EDMATC. We will busy wait until
+         * any one of the situations occurs:
+         *   1. the DMA hardware is idle
+         *   2. a new transfer request is setup
+         *   3. we hit the loop limit
+         */
+        while (edma_read(echan->ecc, EDMA_CCSTAT) & EDMA_CCSTAT_ACTV) {
+                /* check if a new transfer request is setup */
+                if (edma_get_position(echan->ecc,
+                                      echan->slot[0], dst) != pos) {
+                        break;
+                }
+
+                if (!--loop_count) {
+                        dev_dbg_ratelimited(echan->vchan.chan.device->dev,
+                                "%s: timeout waiting for PaRAM update\n",
+                                __func__);
+                        break;
+                }
+
+                cpu_relax();
+        }
 
         /*
          * Cyclic is simple. Just subtract pset[0].addr from pos.
diff --git a/drivers/dma/fsldma.c b/drivers/dma/fsldma.c
index 2209f75fdf05..aac85c30c2cf 100644
--- a/drivers/dma/fsldma.c
+++ b/drivers/dma/fsldma.c
@@ -522,6 +522,8 @@ static dma_cookie_t fsldma_run_tx_complete_actions(struct fsldma_chan *chan,
                         chan_dbg(chan, "LD %p callback\n", desc);
                         txd->callback(txd->callback_param);
                 }
+
+                dma_descriptor_unmap(txd);
         }
 
         /* Run any dependencies */
diff --git a/drivers/dma/ioat/dma.c b/drivers/dma/ioat/dma.c
index 1d5df2ef148b..21539d5c54c3 100644
--- a/drivers/dma/ioat/dma.c
+++ b/drivers/dma/ioat/dma.c
@@ -861,32 +861,42 @@ void ioat_timer_event(unsigned long data)
                         return;
         }
 
+        spin_lock_bh(&ioat_chan->cleanup_lock);
+
+        /* handle the no-actives case */
+        if (!ioat_ring_active(ioat_chan)) {
+                spin_lock_bh(&ioat_chan->prep_lock);
+                check_active(ioat_chan);
+                spin_unlock_bh(&ioat_chan->prep_lock);
+                spin_unlock_bh(&ioat_chan->cleanup_lock);
+                return;
+        }
+
         /* if we haven't made progress and we have already
          * acknowledged a pending completion once, then be more
          * forceful with a restart
          */
-        spin_lock_bh(&ioat_chan->cleanup_lock);
         if (ioat_cleanup_preamble(ioat_chan, &phys_complete))
                 __cleanup(ioat_chan, phys_complete);
         else if (test_bit(IOAT_COMPLETION_ACK, &ioat_chan->state)) {
+                u32 chanerr;
+
+                chanerr = readl(ioat_chan->reg_base + IOAT_CHANERR_OFFSET);
+                dev_warn(to_dev(ioat_chan), "Restarting channel...\n");
+                dev_warn(to_dev(ioat_chan), "CHANSTS: %#Lx CHANERR: %#x\n",
+                         status, chanerr);
+                dev_warn(to_dev(ioat_chan), "Active descriptors: %d\n",
+                         ioat_ring_active(ioat_chan));
+
                 spin_lock_bh(&ioat_chan->prep_lock);
                 ioat_restart_channel(ioat_chan);
                 spin_unlock_bh(&ioat_chan->prep_lock);
                 spin_unlock_bh(&ioat_chan->cleanup_lock);
                 return;
-        } else {
+        } else
                 set_bit(IOAT_COMPLETION_ACK, &ioat_chan->state);
-                mod_timer(&ioat_chan->timer, jiffies + COMPLETION_TIMEOUT);
-        }
-
 
-        if (ioat_ring_active(ioat_chan))
-                mod_timer(&ioat_chan->timer, jiffies + COMPLETION_TIMEOUT);
-        else {
-                spin_lock_bh(&ioat_chan->prep_lock);
-                check_active(ioat_chan);
-                spin_unlock_bh(&ioat_chan->prep_lock);
-        }
+        mod_timer(&ioat_chan->timer, jiffies + COMPLETION_TIMEOUT);
         spin_unlock_bh(&ioat_chan->cleanup_lock);
 }
 
diff --git a/drivers/dma/pxa_dma.c b/drivers/dma/pxa_dma.c
index f2a0310ae771..debca824bed6 100644
--- a/drivers/dma/pxa_dma.c
+++ b/drivers/dma/pxa_dma.c
@@ -583,6 +583,8 @@ static void set_updater_desc(struct pxad_desc_sw *sw_desc,
                 (PXA_DCMD_LENGTH & sizeof(u32));
         if (flags & DMA_PREP_INTERRUPT)
                 updater->dcmd |= PXA_DCMD_ENDIRQEN;
+        if (sw_desc->cyclic)
+                sw_desc->hw_desc[sw_desc->nb_desc - 2]->ddadr = sw_desc->first;
 }
 
 static bool is_desc_completed(struct virt_dma_desc *vd)
@@ -673,6 +675,10 @@ static irqreturn_t pxad_chan_handler(int irq, void *dev_id)
                 dev_dbg(&chan->vc.chan.dev->device,
                         "%s(): checking txd %p[%x]: completed=%d\n",
                         __func__, vd, vd->tx.cookie, is_desc_completed(vd));
+                if (to_pxad_sw_desc(vd)->cyclic) {
+                        vchan_cyclic_callback(vd);
+                        break;
+                }
                 if (is_desc_completed(vd)) {
                         list_del(&vd->node);
                         vchan_cookie_complete(vd);
@@ -1080,7 +1086,7 @@ pxad_prep_dma_cyclic(struct dma_chan *dchan,
                 return NULL;
 
         pxad_get_config(chan, dir, &dcmd, &dsadr, &dtadr);
-        dcmd |= PXA_DCMD_ENDIRQEN | (PXA_DCMD_LENGTH | period_len);
+        dcmd |= PXA_DCMD_ENDIRQEN | (PXA_DCMD_LENGTH & period_len);
         dev_dbg(&chan->vc.chan.dev->device,
                 "%s(): buf_addr=0x%lx len=%zu period=%zu dir=%d flags=%lx\n",
                 __func__, (unsigned long)buf_addr, len, period_len, dir, flags);
diff --git a/drivers/edac/sb_edac.c b/drivers/edac/sb_edac.c
index e438ee5b433f..f5c6b97c8958 100644
--- a/drivers/edac/sb_edac.c
+++ b/drivers/edac/sb_edac.c
@@ -1574,7 +1574,7 @@ static int knl_get_dimm_capacity(struct sbridge_pvt *pvt, u64 *mc_sizes)
                                 for (cha = 0; cha < KNL_MAX_CHAS; cha++) {
                                         if (knl_get_mc_route(target,
                                                 mc_route_reg[cha]) == channel
-                                                && participants[channel]) {
+                                                && !participants[channel]) {
                                                 participant_count++;
                                                 participants[channel] = 1;
                                                 break;
diff --git a/drivers/firmware/efi/efivars.c b/drivers/firmware/efi/efivars.c
index 756eca8c4cf8..10e6774ab2a2 100644
--- a/drivers/firmware/efi/efivars.c
+++ b/drivers/firmware/efi/efivars.c
@@ -221,7 +221,7 @@ sanity_check(struct efi_variable *var, efi_char16_t *name, efi_guid_t vendor,
         }
 
         if ((attributes & ~EFI_VARIABLE_MASK) != 0 ||
-            efivar_validate(name, data, size) == false) {
+            efivar_validate(vendor, name, data, size) == false) {
                 printk(KERN_ERR "efivars: Malformed variable content\n");
                 return -EINVAL;
         }
@@ -447,7 +447,8 @@ static ssize_t efivar_create(struct file *filp, struct kobject *kobj,
         }
 
         if ((attributes & ~EFI_VARIABLE_MASK) != 0 ||
-            efivar_validate(name, data, size) == false) {
+            efivar_validate(new_var->VendorGuid, name, data,
+                            size) == false) {
                 printk(KERN_ERR "efivars: Malformed variable content\n");
                 return -EINVAL;
         }
@@ -540,38 +541,30 @@ static ssize_t efivar_delete(struct file *filp, struct kobject *kobj,
 static int
 efivar_create_sysfs_entry(struct efivar_entry *new_var)
 {
-        int i, short_name_size;
+        int short_name_size;
         char *short_name;
-        unsigned long variable_name_size;
-        efi_char16_t *variable_name;
+        unsigned long utf8_name_size;
+        efi_char16_t *variable_name = new_var->var.VariableName;
         int ret;
 
-        variable_name = new_var->var.VariableName;
-        variable_name_size = ucs2_strlen(variable_name) * sizeof(efi_char16_t);
-
         /*
-         * Length of the variable bytes in ASCII, plus the '-' separator,
+         * Length of the variable bytes in UTF8, plus the '-' separator,
          * plus the GUID, plus trailing NUL
          */
-        short_name_size = variable_name_size / sizeof(efi_char16_t)
-                                + 1 + EFI_VARIABLE_GUID_LEN + 1;
-
-        short_name = kzalloc(short_name_size, GFP_KERNEL);
+        utf8_name_size = ucs2_utf8size(variable_name);
+        short_name_size = utf8_name_size + 1 + EFI_VARIABLE_GUID_LEN + 1;
 
+        short_name = kmalloc(short_name_size, GFP_KERNEL);
         if (!short_name)
                 return -ENOMEM;
 
-        /* Convert Unicode to normal chars (assume top bits are 0),
-           ala UTF-8 */
-        for (i=0; i < (int)(variable_name_size / sizeof(efi_char16_t)); i++) {
-                short_name[i] = variable_name[i] & 0xFF;
-        }
+        ucs2_as_utf8(short_name, variable_name, short_name_size);
+
         /* This is ugly, but necessary to separate one vendor's
            private variables from another's.         */
-
-        *(short_name + strlen(short_name)) = '-';
+        short_name[utf8_name_size] = '-';
         efi_guid_to_str(&new_var->var.VendorGuid,
-                         short_name + strlen(short_name));
+                         short_name + utf8_name_size + 1);
 
         new_var->kobj.kset = efivars_kset;
 
diff --git a/drivers/firmware/efi/vars.c b/drivers/firmware/efi/vars.c
index 70a0fb10517f..7f2ea21c730d 100644
--- a/drivers/firmware/efi/vars.c
+++ b/drivers/firmware/efi/vars.c
@@ -165,67 +165,133 @@ validate_ascii_string(efi_char16_t *var_name, int match, u8 *buffer,
 }
 
 struct variable_validate {
+        efi_guid_t vendor;
         char *name;
         bool (*validate)(efi_char16_t *var_name, int match, u8 *data,
                          unsigned long len);
 };
 
+/*
+ * This is the list of variables we need to validate, as well as the
+ * whitelist for what we think is safe not to default to immutable.
+ *
+ * If it has a validate() method that's not NULL, it'll go into the
+ * validation routine.  If not, it is assumed valid, but still used for
+ * whitelisting.
+ *
+ * Note that it's sorted by {vendor,name}, but globbed names must come after
+ * any other name with the same prefix.
+ */
 static const struct variable_validate variable_validate[] = {
-        { "BootNext", validate_uint16 },
-        { "BootOrder", validate_boot_order },
-        { "DriverOrder", validate_boot_order },
-        { "Boot*", validate_load_option },
-        { "Driver*", validate_load_option },
-        { "ConIn", validate_device_path },
-        { "ConInDev", validate_device_path },
-        { "ConOut", validate_device_path },
-        { "ConOutDev", validate_device_path },
-        { "ErrOut", validate_device_path },
-        { "ErrOutDev", validate_device_path },
-        { "Timeout", validate_uint16 },
-        { "Lang", validate_ascii_string },
-        { "PlatformLang", validate_ascii_string },
-        { "", NULL },
+        { EFI_GLOBAL_VARIABLE_GUID, "BootNext", validate_uint16 },
+        { EFI_GLOBAL_VARIABLE_GUID, "BootOrder", validate_boot_order },
+        { EFI_GLOBAL_VARIABLE_GUID, "Boot*", validate_load_option },
+        { EFI_GLOBAL_VARIABLE_GUID, "DriverOrder", validate_boot_order },
+        { EFI_GLOBAL_VARIABLE_GUID, "Driver*", validate_load_option },
+        { EFI_GLOBAL_VARIABLE_GUID, "ConIn", validate_device_path },
+        { EFI_GLOBAL_VARIABLE_GUID, "ConInDev", validate_device_path },
+        { EFI_GLOBAL_VARIABLE_GUID, "ConOut", validate_device_path },
+        { EFI_GLOBAL_VARIABLE_GUID, "ConOutDev", validate_device_path },
+        { EFI_GLOBAL_VARIABLE_GUID, "ErrOut", validate_device_path },
+        { EFI_GLOBAL_VARIABLE_GUID, "ErrOutDev", validate_device_path },
+        { EFI_GLOBAL_VARIABLE_GUID, "Lang", validate_ascii_string },
+        { EFI_GLOBAL_VARIABLE_GUID, "OsIndications", NULL },
+        { EFI_GLOBAL_VARIABLE_GUID, "PlatformLang", validate_ascii_string },
+        { EFI_GLOBAL_VARIABLE_GUID, "Timeout", validate_uint16 },
+        { LINUX_EFI_CRASH_GUID, "*", NULL },
+        { NULL_GUID, "", NULL },
 };
 
+static bool
+variable_matches(const char *var_name, size_t len, const char *match_name,
+                 int *match)
+{
+        for (*match = 0; ; (*match)++) {
+                char c = match_name[*match];
+                char u = var_name[*match];
+
+                /* Wildcard in the matching name means we've matched */
+                if (c == '*')
+                        return true;
+
+                /* Case sensitive match */
+                if (!c && *match == len)
+                        return true;
+
+                if (c != u)
+                        return false;
+
+                if (!c)
+                        return true;
+        }
+        return true;
+}
+
 bool
-efivar_validate(efi_char16_t *var_name, u8 *data, unsigned long len)
+efivar_validate(efi_guid_t vendor, efi_char16_t *var_name, u8 *data,
+                unsigned long data_size)
 {
         int i;
-        u16 *unicode_name = var_name;
+        unsigned long utf8_size;
+        u8 *utf8_name;
 
-        for (i = 0; variable_validate[i].validate != NULL; i++) {
-                const char *name = variable_validate[i].name;
-                int match;
+        utf8_size = ucs2_utf8size(var_name);
+        utf8_name = kmalloc(utf8_size + 1, GFP_KERNEL);
+        if (!utf8_name)
+                return false;
 
-                for (match = 0; ; match++) {
-                        char c = name[match];
-                        u16 u = unicode_name[match];
+        ucs2_as_utf8(utf8_name, var_name, utf8_size);
+        utf8_name[utf8_size] = '\0';
 
-                        /* All special variables are plain ascii */
-                        if (u > 127)
-                                return true;
+        for (i = 0; variable_validate[i].name[0] != '\0'; i++) {
+                const char *name = variable_validate[i].name;
+                int match = 0;
 
-                        /* Wildcard in the matching name means we've matched */
-                        if (c == '*')
-                                return variable_validate[i].validate(var_name,
-                                                             match, data, len);
+                if (efi_guidcmp(vendor, variable_validate[i].vendor))
+                        continue;
 
-                        /* Case sensitive match */
-                        if (c != u)
+                if (variable_matches(utf8_name, utf8_size+1, name, &match)) {
+                        if (variable_validate[i].validate == NULL)
                                 break;
-
-                        /* Reached the end of the string while matching */
-                        if (!c)
-                                return variable_validate[i].validate(var_name,
-                                                             match, data, len);
+                        kfree(utf8_name);
+                        return variable_validate[i].validate(var_name, match,
+                                                             data, data_size);
                 }
         }
-
+        kfree(utf8_name);
         return true;
 }
 EXPORT_SYMBOL_GPL(efivar_validate);
 
+bool
+efivar_variable_is_removable(efi_guid_t vendor, const char *var_name,
+                             size_t len)
+{
+        int i;
+        bool found = false;
+        int match = 0;
+
+        /*
+         * Check if our variable is in the validated variables list
+         */
+        for (i = 0; variable_validate[i].name[0] != '\0'; i++) {
+                if (efi_guidcmp(variable_validate[i].vendor, vendor))
+                        continue;
+
+                if (variable_matches(var_name, len,
+                                     variable_validate[i].name, &match)) {
+                        found = true;
+                        break;
+                }
+        }
+
+        /*
+         * If it's in our list, it is removable.
+         */
+        return found;
+}
+EXPORT_SYMBOL_GPL(efivar_variable_is_removable);
+
 static efi_status_t
 check_var_size(u32 attributes, unsigned long size)
 {
@@ -852,7 +918,7 @@ int efivar_entry_set_get_size(struct efivar_entry *entry, u32 attributes,
 
         *set = false;
 
-        if (efivar_validate(name, data, *size) == false)
+        if (efivar_validate(*vendor, name, data, *size) == false)
                 return -EINVAL;
 
         /*
diff --git a/drivers/gpio/gpio-altera.c b/drivers/gpio/gpio-altera.c
index 2aeaebd1c6e7..3f87a03abc22 100644
--- a/drivers/gpio/gpio-altera.c
+++ b/drivers/gpio/gpio-altera.c
@@ -312,8 +312,8 @@ static int altera_gpio_probe(struct platform_device *pdev)
                 handle_simple_irq, IRQ_TYPE_NONE);
 
         if (ret) {
-                dev_info(&pdev->dev, "could not add irqchip\n");
-                return ret;
+                dev_err(&pdev->dev, "could not add irqchip\n");
+                goto teardown;
         }
 
         gpiochip_set_chained_irqchip(&altera_gc->mmchip.gc,
@@ -326,6 +326,7 @@ static int altera_gpio_probe(struct platform_device *pdev)
 skip_irq:
         return 0;
 teardown:
+        of_mm_gpiochip_remove(&altera_gc->mmchip);
         pr_err("%s: registration failed with status %d\n",
                 node->full_name, ret);
 
diff --git a/drivers/gpio/gpio-davinci.c b/drivers/gpio/gpio-davinci.c
index ec58f4288649..cd007a67b302 100644
--- a/drivers/gpio/gpio-davinci.c
+++ b/drivers/gpio/gpio-davinci.c
@@ -195,7 +195,7 @@ static int davinci_gpio_of_xlate(struct gpio_chip *gc,
 static int davinci_gpio_probe(struct platform_device *pdev)
 {
         int i, base;
-        unsigned ngpio;
+        unsigned ngpio, nbank;
         struct davinci_gpio_controller *chips;
         struct davinci_gpio_platform_data *pdata;
         struct davinci_gpio_regs __iomem *regs;
@@ -224,8 +224,9 @@ static int davinci_gpio_probe(struct platform_device *pdev)
         if (WARN_ON(ARCH_NR_GPIOS < ngpio))
                 ngpio = ARCH_NR_GPIOS;
 
+        nbank = DIV_ROUND_UP(ngpio, 32);
         chips = devm_kzalloc(dev,
-                             ngpio * sizeof(struct davinci_gpio_controller),
+                             nbank * sizeof(struct davinci_gpio_controller),
                              GFP_KERNEL);
         if (!chips)
                 return -ENOMEM;
@@ -511,7 +512,7 @@ static int davinci_gpio_irq_setup(struct platform_device *pdev)
                         return irq;
                 }
 
-                irq_domain = irq_domain_add_legacy(NULL, ngpio, irq, 0,
+                irq_domain = irq_domain_add_legacy(dev->of_node, ngpio, irq, 0,
                                                         &davinci_gpio_irq_ops,
                                                         chips);
                 if (!irq_domain) {
diff --git a/drivers/gpio/gpio-rcar.c b/drivers/gpio/gpio-rcar.c
index cf41440aff91..d9ab0cd1d205 100644
--- a/drivers/gpio/gpio-rcar.c
+++ b/drivers/gpio/gpio-rcar.c
@@ -196,6 +196,44 @@ static int gpio_rcar_irq_set_wake(struct irq_data *d, unsigned int on)
         return 0;
 }
 
+static void gpio_rcar_irq_bus_lock(struct irq_data *d)
+{
+        struct gpio_chip *gc = irq_data_get_irq_chip_data(d);
+        struct gpio_rcar_priv *p = gpiochip_get_data(gc);
+
+        pm_runtime_get_sync(&p->pdev->dev);
+}
+
+static void gpio_rcar_irq_bus_sync_unlock(struct irq_data *d)
+{
+        struct gpio_chip *gc = irq_data_get_irq_chip_data(d);
+        struct gpio_rcar_priv *p = gpiochip_get_data(gc);
+
+        pm_runtime_put(&p->pdev->dev);
+}
+
+
+static int gpio_rcar_irq_request_resources(struct irq_data *d)
+{
+        struct gpio_chip *gc = irq_data_get_irq_chip_data(d);
+        struct gpio_rcar_priv *p = gpiochip_get_data(gc);
+        int error;
+
+        error = pm_runtime_get_sync(&p->pdev->dev);
+        if (error < 0)
+                return error;
+
+        return 0;
+}
+
+static void gpio_rcar_irq_release_resources(struct irq_data *d)
+{
+        struct gpio_chip *gc = irq_data_get_irq_chip_data(d);
+        struct gpio_rcar_priv *p = gpiochip_get_data(gc);
+
+        pm_runtime_put(&p->pdev->dev);
+}
+
 static irqreturn_t gpio_rcar_irq_handler(int irq, void *dev_id)
 {
         struct gpio_rcar_priv *p = dev_id;
@@ -450,6 +488,10 @@ static int gpio_rcar_probe(struct platform_device *pdev)
         irq_chip->irq_unmask = gpio_rcar_irq_enable;
         irq_chip->irq_set_type = gpio_rcar_irq_set_type;
         irq_chip->irq_set_wake = gpio_rcar_irq_set_wake;
+        irq_chip->irq_bus_lock = gpio_rcar_irq_bus_lock;
+        irq_chip->irq_bus_sync_unlock = gpio_rcar_irq_bus_sync_unlock;
+        irq_chip->irq_request_resources = gpio_rcar_irq_request_resources;
+        irq_chip->irq_release_resources = gpio_rcar_irq_release_resources;
         irq_chip->flags = IRQCHIP_SET_TYPE_MASKED | IRQCHIP_MASK_ON_SUSPEND;
 
         ret = gpiochip_add_data(gpio_chip, p);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu.h b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
index 0c42a85ca5a5..d0489722fc7e 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
@@ -85,6 +85,8 @@ extern int amdgpu_vm_debug;
 extern int amdgpu_sched_jobs;
 extern int amdgpu_sched_hw_submission;
 extern int amdgpu_powerplay;
+extern unsigned amdgpu_pcie_gen_cap;
+extern unsigned amdgpu_pcie_lane_cap;
 
 #define AMDGPU_WAIT_IDLE_TIMEOUT_IN_MS          3000
 #define AMDGPU_MAX_USEC_TIMEOUT                 100000  /* 100 ms */
@@ -127,47 +129,6 @@ extern int amdgpu_powerplay;
 #define AMDGPU_RESET_VCE                        (1 << 13)
 #define AMDGPU_RESET_VCE1                       (1 << 14)
 
-/* CG block flags */
-#define AMDGPU_CG_BLOCK_GFX                     (1 << 0)
-#define AMDGPU_CG_BLOCK_MC                      (1 << 1)
-#define AMDGPU_CG_BLOCK_SDMA                    (1 << 2)
-#define AMDGPU_CG_BLOCK_UVD                     (1 << 3)
-#define AMDGPU_CG_BLOCK_VCE                     (1 << 4)
-#define AMDGPU_CG_BLOCK_HDP                     (1 << 5)
-#define AMDGPU_CG_BLOCK_BIF                     (1 << 6)
-
-/* CG flags */
-#define AMDGPU_CG_SUPPORT_GFX_MGCG              (1 << 0)
-#define AMDGPU_CG_SUPPORT_GFX_MGLS              (1 << 1)
-#define AMDGPU_CG_SUPPORT_GFX_CGCG              (1 << 2)
-#define AMDGPU_CG_SUPPORT_GFX_CGLS              (1 << 3)
-#define AMDGPU_CG_SUPPORT_GFX_CGTS              (1 << 4)
-#define AMDGPU_CG_SUPPORT_GFX_CGTS_LS           (1 << 5)
-#define AMDGPU_CG_SUPPORT_GFX_CP_LS             (1 << 6)
-#define AMDGPU_CG_SUPPORT_GFX_RLC_LS            (1 << 7)
-#define AMDGPU_CG_SUPPORT_MC_LS                 (1 << 8)
-#define AMDGPU_CG_SUPPORT_MC_MGCG               (1 << 9)
-#define AMDGPU_CG_SUPPORT_SDMA_LS               (1 << 10)
-#define AMDGPU_CG_SUPPORT_SDMA_MGCG             (1 << 11)
-#define AMDGPU_CG_SUPPORT_BIF_LS                (1 << 12)
-#define AMDGPU_CG_SUPPORT_UVD_MGCG              (1 << 13)
-#define AMDGPU_CG_SUPPORT_VCE_MGCG              (1 << 14)
-#define AMDGPU_CG_SUPPORT_HDP_LS                (1 << 15)
-#define AMDGPU_CG_SUPPORT_HDP_MGCG              (1 << 16)
-
-/* PG flags */
-#define AMDGPU_PG_SUPPORT_GFX_PG                (1 << 0)
-#define AMDGPU_PG_SUPPORT_GFX_SMG               (1 << 1)
-#define AMDGPU_PG_SUPPORT_GFX_DMG               (1 << 2)
-#define AMDGPU_PG_SUPPORT_UVD                   (1 << 3)
-#define AMDGPU_PG_SUPPORT_VCE                   (1 << 4)
-#define AMDGPU_PG_SUPPORT_CP                    (1 << 5)
-#define AMDGPU_PG_SUPPORT_GDS                   (1 << 6)
-#define AMDGPU_PG_SUPPORT_RLC_SMU_HS            (1 << 7)
-#define AMDGPU_PG_SUPPORT_SDMA                  (1 << 8)
-#define AMDGPU_PG_SUPPORT_ACP                   (1 << 9)
-#define AMDGPU_PG_SUPPORT_SAMU                  (1 << 10)
-
 /* GFX current status */
 #define AMDGPU_GFX_NORMAL_MODE                  0x00000000L
 #define AMDGPU_GFX_SAFE_MODE                    0x00000001L
@@ -592,8 +553,6 @@ struct amdgpu_sa_manager {
         uint32_t                align;
 };
 
-struct amdgpu_sa_bo;
-
 /* sub-allocation buffer */
 struct amdgpu_sa_bo {
         struct list_head                olist;
@@ -2357,6 +2316,7 @@ void amdgpu_ttm_placement_from_domain(struct amdgpu_bo *rbo, u32 domain);
 bool amdgpu_ttm_bo_is_amdgpu_bo(struct ttm_buffer_object *bo);
 int amdgpu_ttm_tt_set_userptr(struct ttm_tt *ttm, uint64_t addr,
                                      uint32_t flags);
+bool amdgpu_ttm_tt_has_userptr(struct ttm_tt *ttm);
 struct mm_struct *amdgpu_ttm_tt_get_usermm(struct ttm_tt *ttm);
 bool amdgpu_ttm_tt_affect_userptr(struct ttm_tt *ttm, unsigned long start,
                                   unsigned long end);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c
index a081dda9fa2f..7a4b101e10c6 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c
@@ -795,6 +795,12 @@ static int amdgpu_cgs_query_system_info(void *cgs_device,
         case CGS_SYSTEM_INFO_PCIE_MLW:
                 sys_info->value = adev->pm.pcie_mlw_mask;
                 break;
+        case CGS_SYSTEM_INFO_CG_FLAGS:
+                sys_info->value = adev->cg_flags;
+                break;
+        case CGS_SYSTEM_INFO_PG_FLAGS:
+                sys_info->value = adev->pg_flags;
+                break;
         default:
                 return -ENODEV;
         }
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
index 89c3dd62ba21..119cdc2c43e7 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
@@ -77,7 +77,7 @@ void amdgpu_connector_hotplug(struct drm_connector *connector)
                         } else if (amdgpu_atombios_dp_needs_link_train(amdgpu_connector)) {
                                 /* Don't try to start link training before we
                                  * have the dpcd */
-                                if (!amdgpu_atombios_dp_get_dpcd(amdgpu_connector))
+                                if (amdgpu_atombios_dp_get_dpcd(amdgpu_connector))
                                         return;
 
                                 /* set it to OFF so that drm_helper_connector_dpms()
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
index db20d2783def..2139da773da6 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -1762,15 +1762,20 @@ int amdgpu_resume_kms(struct drm_device *dev, bool resume, bool fbcon)
         }
 
         /* post card */
-        amdgpu_atom_asic_init(adev->mode_info.atom_context);
+        if (!amdgpu_card_posted(adev))
+                amdgpu_atom_asic_init(adev->mode_info.atom_context);
 
         r = amdgpu_resume(adev);
+        if (r)
+                DRM_ERROR("amdgpu_resume failed (%d).\n", r);
 
         amdgpu_fence_driver_resume(adev);
 
-        r = amdgpu_ib_ring_tests(adev);
-        if (r)
-                DRM_ERROR("ib ring test failed (%d).\n", r);
+        if (resume) {
+                r = amdgpu_ib_ring_tests(adev);
+                if (r)
+                        DRM_ERROR("ib ring test failed (%d).\n", r);
+        }
 
         r = amdgpu_late_init(adev);
         if (r)
@@ -1903,80 +1908,97 @@ retry:
         return r;
 }
 
+#define AMDGPU_DEFAULT_PCIE_GEN_MASK 0x30007  /* gen: chipset 1/2, asic 1/2/3 */
+#define AMDGPU_DEFAULT_PCIE_MLW_MASK 0x2f0000 /* 1/2/4/8/16 lanes */
+
 void amdgpu_get_pcie_info(struct amdgpu_device *adev)
 {
         u32 mask;
         int ret;
 
-        if (pci_is_root_bus(adev->pdev->bus))
-                return;
+        if (amdgpu_pcie_gen_cap)
+                adev->pm.pcie_gen_mask = amdgpu_pcie_gen_cap;
 
-        if (amdgpu_pcie_gen2 == 0)
-                return;
+        if (amdgpu_pcie_lane_cap)
+                adev->pm.pcie_mlw_mask = amdgpu_pcie_lane_cap;
 
-        if (adev->flags & AMD_IS_APU)
+        /* covers APUs as well */
+        if (pci_is_root_bus(adev->pdev->bus)) {
+                if (adev->pm.pcie_gen_mask == 0)
+                        adev->pm.pcie_gen_mask = AMDGPU_DEFAULT_PCIE_GEN_MASK;
+                if (adev->pm.pcie_mlw_mask == 0)
+                        adev->pm.pcie_mlw_mask = AMDGPU_DEFAULT_PCIE_MLW_MASK;
                 return;
+        }
 
-        ret = drm_pcie_get_speed_cap_mask(adev->ddev, &mask);
-        if (!ret) {
-                adev->pm.pcie_gen_mask = (CAIL_ASIC_PCIE_LINK_SPEED_SUPPORT_GEN1 |
-                                          CAIL_ASIC_PCIE_LINK_SPEED_SUPPORT_GEN2 |
-                                          CAIL_ASIC_PCIE_LINK_SPEED_SUPPORT_GEN3);
-
-                if (mask & DRM_PCIE_SPEED_25)
-                        adev->pm.pcie_gen_mask |= CAIL_PCIE_LINK_SPEED_SUPPORT_GEN1;
-                if (mask & DRM_PCIE_SPEED_50)
-                        adev->pm.pcie_gen_mask |= CAIL_PCIE_LINK_SPEED_SUPPORT_GEN2;
-                if (mask & DRM_PCIE_SPEED_80)
-                        adev->pm.pcie_gen_mask |= CAIL_PCIE_LINK_SPEED_SUPPORT_GEN3;
-        }
-        ret = drm_pcie_get_max_link_width(adev->ddev, &mask);
-        if (!ret) {
-                switch (mask) {
-                case 32:
-                        adev->pm.pcie_mlw_mask = (CAIL_PCIE_LINK_WIDTH_SUPPORT_X32 |
-                                                  CAIL_PCIE_LINK_WIDTH_SUPPORT_X16 |
-                                                  CAIL_PCIE_LINK_WIDTH_SUPPORT_X12 |
-                                                  CAIL_PCIE_LINK_WIDTH_SUPPORT_X8 |
-                                                  CAIL_PCIE_LINK_WIDTH_SUPPORT_X4 |
-                                                  CAIL_PCIE_LINK_WIDTH_SUPPORT_X2 |
-                                                  CAIL_PCIE_LINK_WIDTH_SUPPORT_X1);
-                        break;
-                case 16:
-                        adev->pm.pcie_mlw_mask = (CAIL_PCIE_LINK_WIDTH_SUPPORT_X16 |
-                                                  CAIL_PCIE_LINK_WIDTH_SUPPORT_X12 |
-                                                  CAIL_PCIE_LINK_WIDTH_SUPPORT_X8 |
-                                                  CAIL_PCIE_LINK_WIDTH_SUPPORT_X4 |
-                                                  CAIL_PCIE_LINK_WIDTH_SUPPORT_X2 |
-                                                  CAIL_PCIE_LINK_WIDTH_SUPPORT_X1);
-                        break;
-                case 12:
-                        adev->pm.pcie_mlw_mask = (CAIL_PCIE_LINK_WIDTH_SUPPORT_X12 |
-                                                  CAIL_PCIE_LINK_WIDTH_SUPPORT_X8 |
-                                                  CAIL_PCIE_LINK_WIDTH_SUPPORT_X4 |
-                                                  CAIL_PCIE_LINK_WIDTH_SUPPORT_X2 |
-                                                  CAIL_PCIE_LINK_WIDTH_SUPPORT_X1);
-                        break;
-                case 8:
-                        adev->pm.pcie_mlw_mask = (CAIL_PCIE_LINK_WIDTH_SUPPORT_X8 |
-                                                  CAIL_PCIE_LINK_WIDTH_SUPPORT_X4 |
-                                                  CAIL_PCIE_LINK_WIDTH_SUPPORT_X2 |
-                                                  CAIL_PCIE_LINK_WIDTH_SUPPORT_X1);
-                        break;
-                case 4:
-                        adev->pm.pcie_mlw_mask = (CAIL_PCIE_LINK_WIDTH_SUPPORT_X4 |
-                                                  CAIL_PCIE_LINK_WIDTH_SUPPORT_X2 |
-                                                  CAIL_PCIE_LINK_WIDTH_SUPPORT_X1);
-                        break;
-                case 2:
-                        adev->pm.pcie_mlw_mask = (CAIL_PCIE_LINK_WIDTH_SUPPORT_X2 |
-                                                  CAIL_PCIE_LINK_WIDTH_SUPPORT_X1);
-                        break;
-                case 1:
-                        adev->pm.pcie_mlw_mask = CAIL_PCIE_LINK_WIDTH_SUPPORT_X1;
-                        break;
-                default:
-                        break;
+        if (adev->pm.pcie_gen_mask == 0) {
+                ret = drm_pcie_get_speed_cap_mask(adev->ddev, &mask);
+                if (!ret) {
+                        adev->pm.pcie_gen_mask = (CAIL_ASIC_PCIE_LINK_SPEED_SUPPORT_GEN1 |
+                                                  CAIL_ASIC_PCIE_LINK_SPEED_SUPPORT_GEN2 |
+                                                  CAIL_ASIC_PCIE_LINK_SPEED_SUPPORT_GEN3);
+
+                        if (mask & DRM_PCIE_SPEED_25)
+                                adev->pm.pcie_gen_mask |= CAIL_PCIE_LINK_SPEED_SUPPORT_GEN1;
+                        if (mask & DRM_PCIE_SPEED_50)
+                                adev->pm.pcie_gen_mask |= CAIL_PCIE_LINK_SPEED_SUPPORT_GEN2;
+                        if (mask & DRM_PCIE_SPEED_80)
+                                adev->pm.pcie_gen_mask |= CAIL_PCIE_LINK_SPEED_SUPPORT_GEN3;
+                } else {
+                        adev->pm.pcie_gen_mask = AMDGPU_DEFAULT_PCIE_GEN_MASK;
+                }
+        }
+        if (adev->pm.pcie_mlw_mask == 0) {
+                ret = drm_pcie_get_max_link_width(adev->ddev, &mask);
+                if (!ret) {
+                        switch (mask) {
+                        case 32:
+                                adev->pm.pcie_mlw_mask = (CAIL_PCIE_LINK_WIDTH_SUPPORT_X32 |
+                                                          CAIL_PCIE_LINK_WIDTH_SUPPORT_X16 |
+                                                          CAIL_PCIE_LINK_WIDTH_SUPPORT_X12 |
+                                                          CAIL_PCIE_LINK_WIDTH_SUPPORT_X8 |
+                                                          CAIL_PCIE_LINK_WIDTH_SUPPORT_X4 |
+                                                          CAIL_PCIE_LINK_WIDTH_SUPPORT_X2 |
+                                                          CAIL_PCIE_LINK_WIDTH_SUPPORT_X1);
+                                break;
+                        case 16:
+                                adev->pm.pcie_mlw_mask = (CAIL_PCIE_LINK_WIDTH_SUPPORT_X16 |
+                                                          CAIL_PCIE_LINK_WIDTH_SUPPORT_X12 |
+                                                          CAIL_PCIE_LINK_WIDTH_SUPPORT_X8 |
+                                                          CAIL_PCIE_LINK_WIDTH_SUPPORT_X4 |
+                                                          CAIL_PCIE_LINK_WIDTH_SUPPORT_X2 |
+                                                          CAIL_PCIE_LINK_WIDTH_SUPPORT_X1);
+                                break;
+                        case 12:
+                                adev->pm.pcie_mlw_mask = (CAIL_PCIE_LINK_WIDTH_SUPPORT_X12 |
+                                                          CAIL_PCIE_LINK_WIDTH_SUPPORT_X8 |
+                                                          CAIL_PCIE_LINK_WIDTH_SUPPORT_X4 |
+                                                          CAIL_PCIE_LINK_WIDTH_SUPPORT_X2 |
+                                                          CAIL_PCIE_LINK_WIDTH_SUPPORT_X1);
+                                break;
+                        case 8:
+                                adev->pm.pcie_mlw_mask = (CAIL_PCIE_LINK_WIDTH_SUPPORT_X8 |
+                                                          CAIL_PCIE_LINK_WIDTH_SUPPORT_X4 |
+                                                          CAIL_PCIE_LINK_WIDTH_SUPPORT_X2 |
+                                                          CAIL_PCIE_LINK_WIDTH_SUPPORT_X1);
+                                break;
+                        case 4:
+                                adev->pm.pcie_mlw_mask = (CAIL_PCIE_LINK_WIDTH_SUPPORT_X4 |
+                                                          CAIL_PCIE_LINK_WIDTH_SUPPORT_X2 |
+                                                          CAIL_PCIE_LINK_WIDTH_SUPPORT_X1);
+                                break;
+                        case 2:
+                                adev->pm.pcie_mlw_mask = (CAIL_PCIE_LINK_WIDTH_SUPPORT_X2 |
+                                                          CAIL_PCIE_LINK_WIDTH_SUPPORT_X1);
+                                break;
+                        case 1:
+                                adev->pm.pcie_mlw_mask = CAIL_PCIE_LINK_WIDTH_SUPPORT_X1;
+                                break;
+                        default:
+                                break;
+                        }
+                } else {
+                        adev->pm.pcie_mlw_mask = AMDGPU_DEFAULT_PCIE_MLW_MASK;
                 }
         }
 }
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
index 2cb53c24dec0..f0ed974bd4e0 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
@@ -70,8 +70,8 @@ static void amdgpu_flip_work_func(struct work_struct *__work)
 
         struct drm_crtc *crtc = &amdgpuCrtc->base;
         unsigned long flags;
-        unsigned i;
-        int vpos, hpos, stat, min_udelay;
+        unsigned i, repcnt = 4;
+        int vpos, hpos, stat, min_udelay = 0;
         struct drm_vblank_crtc *vblank = &crtc->dev->vblank[work->crtc_id];
 
         if (amdgpu_flip_handle_fence(work, &work->excl))
@@ -97,7 +97,7 @@ static void amdgpu_flip_work_func(struct work_struct *__work)
          * In practice this won't execute very often unless on very fast
          * machines because the time window for this to happen is very small.
          */
-        for (;;) {
+        while (amdgpuCrtc->enabled && --repcnt) {
                 /* GET_DISTANCE_TO_VBLANKSTART returns distance to real vblank
                  * start in hpos, and to the "fudged earlier" vblank start in
                  * vpos.
@@ -113,12 +113,24 @@ static void amdgpu_flip_work_func(struct work_struct *__work)
                         break;
 
                 /* Sleep at least until estimated real start of hw vblank */
-                spin_unlock_irqrestore(&crtc->dev->event_lock, flags);
                 min_udelay = (-hpos + 1) * max(vblank->linedur_ns / 1000, 5);
+                if (min_udelay > vblank->framedur_ns / 2000) {
+                        /* Don't wait ridiculously long - something is wrong */
+                        repcnt = 0;
+                        break;
+                }
+                spin_unlock_irqrestore(&crtc->dev->event_lock, flags);
                 usleep_range(min_udelay, 2 * min_udelay);
                 spin_lock_irqsave(&crtc->dev->event_lock, flags);
         };
 
+        if (!repcnt)
+                DRM_DEBUG_DRIVER("Delay problem on crtc %d: min_udelay %d, "
+                                 "framedur %d, linedur %d, stat %d, vpos %d, "
+                                 "hpos %d\n", work->crtc_id, min_udelay,
+                                 vblank->framedur_ns / 1000,
+                                 vblank->linedur_ns / 1000, stat, vpos, hpos);
+
         /* set the flip status */
         amdgpuCrtc->pflip_status = AMDGPU_FLIP_SUBMITTED;
         spin_unlock_irqrestore(&crtc->dev->event_lock, flags);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
index 01b4fd6115c2..74a2f8a6be1f 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
@@ -80,6 +80,8 @@ int amdgpu_exp_hw_support = 0;
 int amdgpu_sched_jobs = 32;
 int amdgpu_sched_hw_submission = 2;
 int amdgpu_powerplay = -1;
+unsigned amdgpu_pcie_gen_cap = 0;
+unsigned amdgpu_pcie_lane_cap = 0;
 
 MODULE_PARM_DESC(vramlimit, "Restrict VRAM for testing, in megabytes");
 module_param_named(vramlimit, amdgpu_vram_limit, int, 0600);
@@ -158,6 +160,12 @@ MODULE_PARM_DESC(powerplay, "Powerplay component (1 = enable, 0 = disable, -1 =
 module_param_named(powerplay, amdgpu_powerplay, int, 0444);
 #endif
 
+MODULE_PARM_DESC(pcie_gen_cap, "PCIE Gen Caps (0: autodetect (default))");
+module_param_named(pcie_gen_cap, amdgpu_pcie_gen_cap, uint, 0444);
+
+MODULE_PARM_DESC(pcie_lane_cap, "PCIE Lane Caps (0: autodetect (default))");
+module_param_named(pcie_lane_cap, amdgpu_pcie_lane_cap, uint, 0444);
+
 static struct pci_device_id pciidlist[] = {
 #ifdef CONFIG_DRM_AMDGPU_CIK
         /* Kaveri */
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
index 2e26a517f2d6..7a47c45b2131 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
@@ -606,7 +606,8 @@ int amdgpu_gem_va_ioctl(struct drm_device *dev, void *data,
                 break;
         }
         ttm_eu_backoff_reservation(&ticket, &list);
-        if (!r && !(args->flags & AMDGPU_VM_DELAY_UPDATE))
+        if (!r && !(args->flags & AMDGPU_VM_DELAY_UPDATE) &&
+            !amdgpu_vm_debug)
                 amdgpu_gem_va_update_vm(adev, bo_va, args->operation);
 
         drm_gem_object_unreference_unlocked(gobj);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
index d77b2bdbe800..ff9597ce268c 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
@@ -113,6 +113,10 @@ static ssize_t amdgpu_get_dpm_forced_performance_level(struct device *dev,
         struct drm_device *ddev = dev_get_drvdata(dev);
         struct amdgpu_device *adev = ddev->dev_private;
 
+        if  ((adev->flags & AMD_IS_PX) &&
+             (ddev->switch_power_state != DRM_SWITCH_POWER_ON))
+                return snprintf(buf, PAGE_SIZE, "off\n");
+
         if (adev->pp_enabled) {
                 enum amd_dpm_forced_level level;
 
@@ -142,6 +146,11 @@ static ssize_t amdgpu_set_dpm_forced_performance_level(struct device *dev,
         enum amdgpu_dpm_forced_level level;
         int ret = 0;
 
+        /* Can't force performance level when the card is off */
+        if  ((adev->flags & AMD_IS_PX) &&
+             (ddev->switch_power_state != DRM_SWITCH_POWER_ON))
+                return -EINVAL;
+
         if (strncmp("low", buf, strlen("low")) == 0) {
                 level = AMDGPU_DPM_FORCED_LEVEL_LOW;
         } else if (strncmp("high", buf, strlen("high")) == 0) {
@@ -161,6 +170,7 @@ static ssize_t amdgpu_set_dpm_forced_performance_level(struct device *dev,
                 mutex_lock(&adev->pm.mutex);
                 if (adev->pm.dpm.thermal_active) {
                         count = -EINVAL;
+                        mutex_unlock(&adev->pm.mutex);
                         goto fail;
                 }
                 ret = amdgpu_dpm_force_performance_level(adev, level);
@@ -171,8 +181,6 @@ static ssize_t amdgpu_set_dpm_forced_performance_level(struct device *dev,
                 mutex_unlock(&adev->pm.mutex);
         }
 fail:
-        mutex_unlock(&adev->pm.mutex);
-
         return count;
 }
 
@@ -469,8 +477,14 @@ static ssize_t amdgpu_hwmon_show_temp(struct device *dev,
                                       char *buf)
 {
         struct amdgpu_device *adev = dev_get_drvdata(dev);
+        struct drm_device *ddev = adev->ddev;
         int temp;
 
+        /* Can't get temperature when the card is off */
+        if  ((adev->flags & AMD_IS_PX) &&
+             (ddev->switch_power_state != DRM_SWITCH_POWER_ON))
+                return -EINVAL;
+
         if (!adev->pp_enabled && !adev->pm.funcs->get_temperature)
                 temp = 0;
         else
@@ -919,11 +933,6 @@ force:
 
         /* update display watermarks based on new power state */
         amdgpu_display_bandwidth_update(adev);
-        /* update displays */
-        amdgpu_dpm_display_configuration_changed(adev);
-
-        adev->pm.dpm.current_active_crtcs = adev->pm.dpm.new_active_crtcs;
-        adev->pm.dpm.current_active_crtc_count = adev->pm.dpm.new_active_crtc_count;
 
         /* wait for the rings to drain */
         for (i = 0; i < AMDGPU_MAX_RINGS; i++) {
@@ -940,6 +949,12 @@ force:
 
         amdgpu_dpm_post_set_power_state(adev);
 
+        /* update displays */
+        amdgpu_dpm_display_configuration_changed(adev);
+
+        adev->pm.dpm.current_active_crtcs = adev->pm.dpm.new_active_crtcs;
+        adev->pm.dpm.current_active_crtc_count = adev->pm.dpm.new_active_crtc_count;
+
         if (adev->pm.funcs->force_performance_level) {
                 if (adev->pm.dpm.thermal_active) {
                         enum amdgpu_dpm_forced_level level = adev->pm.dpm.forced_level;
@@ -1174,12 +1189,16 @@ static int amdgpu_debugfs_pm_info(struct seq_file *m, void *data)
         struct drm_info_node *node = (struct drm_info_node *) m->private;
         struct drm_device *dev = node->minor->dev;
         struct amdgpu_device *adev = dev->dev_private;
+        struct drm_device *ddev = adev->ddev;
 
         if (!adev->pm.dpm_enabled) {
                 seq_printf(m, "dpm not enabled\n");
                 return 0;
         }
-        if (adev->pp_enabled) {
+        if  ((adev->flags & AMD_IS_PX) &&
+             (ddev->switch_power_state != DRM_SWITCH_POWER_ON)) {
+                seq_printf(m, "PX asic powered off\n");
+        } else if (adev->pp_enabled) {
                 amdgpu_dpm_debugfs_print_current_performance_level(adev, m);
         } else {
                 mutex_lock(&adev->pm.mutex);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_powerplay.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_powerplay.c
index b9d0d55f6b47..3cb6d6c413c7 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_powerplay.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_powerplay.c
@@ -143,8 +143,10 @@ static int amdgpu_pp_late_init(void *handle)
                                         adev->powerplay.pp_handle);
 
 #ifdef CONFIG_DRM_AMD_POWERPLAY
-        if (adev->pp_enabled)
+        if (adev->pp_enabled) {
                 amdgpu_pm_sysfs_init(adev);
+                amdgpu_dpm_dispatch_task(adev, AMD_PP_EVENT_COMPLETE_INIT, NULL, NULL);
+        }
 #endif
         return ret;
 }
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_sa.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_sa.c
index 7d8f8f1e3f7f..2faf03bcda21 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_sa.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_sa.c
@@ -357,12 +357,15 @@ int amdgpu_sa_bo_new(struct amdgpu_sa_manager *sa_manager,
 
                 for (i = 0, count = 0; i < AMDGPU_MAX_RINGS; ++i)
                         if (fences[i])
-                                fences[count++] = fences[i];
+                                fences[count++] = fence_get(fences[i]);
 
                 if (count) {
                         spin_unlock(&sa_manager->wq.lock);
                         t = fence_wait_any_timeout(fences, count, false,
                                                    MAX_SCHEDULE_TIMEOUT);
+                        for (i = 0; i < count; ++i)
+                                fence_put(fences[i]);
+
                         r = (t > 0) ? 0 : t;
                         spin_lock(&sa_manager->wq.lock);
                 } else {
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
index e52fc641edfb..9ccdd189d717 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
@@ -725,7 +725,7 @@ static int amdgpu_ttm_tt_populate(struct ttm_tt *ttm)
                                                        0, PAGE_SIZE,
                                                        PCI_DMA_BIDIRECTIONAL);
                 if (pci_dma_mapping_error(adev->pdev, gtt->ttm.dma_address[i])) {
-                        while (--i) {
+                        while (i--) {
                                 pci_unmap_page(adev->pdev, gtt->ttm.dma_address[i],
                                                PAGE_SIZE, PCI_DMA_BIDIRECTIONAL);
                                 gtt->ttm.dma_address[i] = 0;
diff --git a/drivers/gpu/drm/amd/amdgpu/atombios_dp.c b/drivers/gpu/drm/amd/amdgpu/atombios_dp.c
index 21aacc1f45c1..bf731e9f643e 100644
--- a/drivers/gpu/drm/amd/amdgpu/atombios_dp.c
+++ b/drivers/gpu/drm/amd/amdgpu/atombios_dp.c
@@ -265,15 +265,27 @@ static int amdgpu_atombios_dp_get_dp_link_config(struct drm_connector *connector
         unsigned max_lane_num = drm_dp_max_lane_count(dpcd);
         unsigned lane_num, i, max_pix_clock;
 
-        for (lane_num = 1; lane_num <= max_lane_num; lane_num <<= 1) {
-                for (i = 0; i < ARRAY_SIZE(link_rates) && link_rates[i] <= max_link_rate; i++) {
-                        max_pix_clock = (lane_num * link_rates[i] * 8) / bpp;
+        if (amdgpu_connector_encoder_get_dp_bridge_encoder_id(connector) ==
+            ENCODER_OBJECT_ID_NUTMEG) {
+                for (lane_num = 1; lane_num <= max_lane_num; lane_num <<= 1) {
+                        max_pix_clock = (lane_num * 270000 * 8) / bpp;
                         if (max_pix_clock >= pix_clock) {
                                 *dp_lanes = lane_num;
-                                *dp_rate = link_rates[i];
+                                *dp_rate = 270000;
                                 return 0;
                         }
                 }
+        } else {
+                for (lane_num = 1; lane_num <= max_lane_num; lane_num <<= 1) {
+                        for (i = 0; i < ARRAY_SIZE(link_rates) && link_rates[i] <= max_link_rate; i++) {
+                                max_pix_clock = (lane_num * link_rates[i] * 8) / bpp;
+                                if (max_pix_clock >= pix_clock) {
+                                        *dp_lanes = lane_num;
+                                        *dp_rate = link_rates[i];
+                                        return 0;
+                                }
+                        }
+                }
         }
 
         return -EINVAL;
diff --git a/drivers/gpu/drm/amd/amdgpu/ci_dpm.c b/drivers/gpu/drm/amd/amdgpu/ci_dpm.c
index 8b4731d4e10e..474ca02b0949 100644
--- a/drivers/gpu/drm/amd/amdgpu/ci_dpm.c
+++ b/drivers/gpu/drm/amd/amdgpu/ci_dpm.c
@@ -31,6 +31,7 @@
 #include "ci_dpm.h"
 #include "gfx_v7_0.h"
 #include "atom.h"
+#include "amd_pcie.h"
 #include <linux/seq_file.h>
 
 #include "smu/smu_7_0_1_d.h"
@@ -5835,18 +5836,16 @@ static int ci_dpm_init(struct amdgpu_device *adev)
         u8 frev, crev;
         struct ci_power_info *pi;
         int ret;
-        u32 mask;
 
         pi = kzalloc(sizeof(struct ci_power_info), GFP_KERNEL);
         if (pi == NULL)
                 return -ENOMEM;
         adev->pm.dpm.priv = pi;
 
-        ret = drm_pcie_get_speed_cap_mask(adev->ddev, &mask);
-        if (ret)
-                pi->sys_pcie_mask = 0;
-        else
-                pi->sys_pcie_mask = mask;
+        pi->sys_pcie_mask =
+                (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_MASK) >>
+                CAIL_PCIE_LINK_SPEED_SUPPORT_SHIFT;
+
         pi->force_pcie_gen = AMDGPU_PCIE_GEN_INVALID;
 
         pi->pcie_gen_performance.max = AMDGPU_PCIE_GEN1;
diff --git a/drivers/gpu/drm/amd/amdgpu/cik.c b/drivers/gpu/drm/amd/amdgpu/cik.c
index 6b1f0539ce9d..192ab13e9f05 100644
--- a/drivers/gpu/drm/amd/amdgpu/cik.c
+++ b/drivers/gpu/drm/amd/amdgpu/cik.c
@@ -1462,6 +1462,9 @@ static void cik_program_aspm(struct amdgpu_device *adev)
         if (amdgpu_aspm == 0)
                 return;
 
+        if (pci_is_root_bus(adev->pdev->bus))
+                return;
+
         /* XXX double check APUs */
         if (adev->flags & AMD_IS_APU)
                 return;
@@ -2032,72 +2035,72 @@ static int cik_common_early_init(void *handle)
         switch (adev->asic_type) {
         case CHIP_BONAIRE:
                 adev->cg_flags =
-                        AMDGPU_CG_SUPPORT_GFX_MGCG |
-                        AMDGPU_CG_SUPPORT_GFX_MGLS |
-                        /*AMDGPU_CG_SUPPORT_GFX_CGCG |*/
-                        AMDGPU_CG_SUPPORT_GFX_CGLS |
-                        AMDGPU_CG_SUPPORT_GFX_CGTS |
-                        AMDGPU_CG_SUPPORT_GFX_CGTS_LS |
-                        AMDGPU_CG_SUPPORT_GFX_CP_LS |
-                        AMDGPU_CG_SUPPORT_MC_LS |
-                        AMDGPU_CG_SUPPORT_MC_MGCG |
-                        AMDGPU_CG_SUPPORT_SDMA_MGCG |
-                        AMDGPU_CG_SUPPORT_SDMA_LS |
-                        AMDGPU_CG_SUPPORT_BIF_LS |
-                        AMDGPU_CG_SUPPORT_VCE_MGCG |
-                        AMDGPU_CG_SUPPORT_UVD_MGCG |
-                        AMDGPU_CG_SUPPORT_HDP_LS |
-                        AMDGPU_CG_SUPPORT_HDP_MGCG;
+                        AMD_CG_SUPPORT_GFX_MGCG |
+                        AMD_CG_SUPPORT_GFX_MGLS |
+                        /*AMD_CG_SUPPORT_GFX_CGCG |*/
+                        AMD_CG_SUPPORT_GFX_CGLS |
+                        AMD_CG_SUPPORT_GFX_CGTS |
+                        AMD_CG_SUPPORT_GFX_CGTS_LS |
+                        AMD_CG_SUPPORT_GFX_CP_LS |
+                        AMD_CG_SUPPORT_MC_LS |
+                        AMD_CG_SUPPORT_MC_MGCG |
+                        AMD_CG_SUPPORT_SDMA_MGCG |
+                        AMD_CG_SUPPORT_SDMA_LS |
+                        AMD_CG_SUPPORT_BIF_LS |
+                        AMD_CG_SUPPORT_VCE_MGCG |
+                        AMD_CG_SUPPORT_UVD_MGCG |
+                        AMD_CG_SUPPORT_HDP_LS |
+                        AMD_CG_SUPPORT_HDP_MGCG;
                 adev->pg_flags = 0;
                 adev->external_rev_id = adev->rev_id + 0x14;
                 break;
         case CHIP_HAWAII:
                 adev->cg_flags =
-                        AMDGPU_CG_SUPPORT_GFX_MGCG |
-                        AMDGPU_CG_SUPPORT_GFX_MGLS |
-                        /*AMDGPU_CG_SUPPORT_GFX_CGCG |*/
-                        AMDGPU_CG_SUPPORT_GFX_CGLS |
-                        AMDGPU_CG_SUPPORT_GFX_CGTS |
-                        AMDGPU_CG_SUPPORT_GFX_CP_LS |
-                        AMDGPU_CG_SUPPORT_MC_LS |
-                        AMDGPU_CG_SUPPORT_MC_MGCG |
-                        AMDGPU_CG_SUPPORT_SDMA_MGCG |
-                        AMDGPU_CG_SUPPORT_SDMA_LS |
-                        AMDGPU_CG_SUPPORT_BIF_LS |
-                        AMDGPU_CG_SUPPORT_VCE_MGCG |
-                        AMDGPU_CG_SUPPORT_UVD_MGCG |
-                        AMDGPU_CG_SUPPORT_HDP_LS |
-                        AMDGPU_CG_SUPPORT_HDP_MGCG;
+                        AMD_CG_SUPPORT_GFX_MGCG |
+                        AMD_CG_SUPPORT_GFX_MGLS |
+                        /*AMD_CG_SUPPORT_GFX_CGCG |*/
+                        AMD_CG_SUPPORT_GFX_CGLS |
+                        AMD_CG_SUPPORT_GFX_CGTS |
+                        AMD_CG_SUPPORT_GFX_CP_LS |
+                        AMD_CG_SUPPORT_MC_LS |
+                        AMD_CG_SUPPORT_MC_MGCG |
+                        AMD_CG_SUPPORT_SDMA_MGCG |
+                        AMD_CG_SUPPORT_SDMA_LS |
+                        AMD_CG_SUPPORT_BIF_LS |
+                        AMD_CG_SUPPORT_VCE_MGCG |
+                        AMD_CG_SUPPORT_UVD_MGCG |
+                        AMD_CG_SUPPORT_HDP_LS |
+                        AMD_CG_SUPPORT_HDP_MGCG;
                 adev->pg_flags = 0;
                 adev->external_rev_id = 0x28;
                 break;
         case CHIP_KAVERI:
                 adev->cg_flags =
-                        AMDGPU_CG_SUPPORT_GFX_MGCG |
-                        AMDGPU_CG_SUPPORT_GFX_MGLS |
-                        /*AMDGPU_CG_SUPPORT_GFX_CGCG |*/
-                        AMDGPU_CG_SUPPORT_GFX_CGLS |
-                        AMDGPU_CG_SUPPORT_GFX_CGTS |
-                        AMDGPU_CG_SUPPORT_GFX_CGTS_LS |
-                        AMDGPU_CG_SUPPORT_GFX_CP_LS |
-                        AMDGPU_CG_SUPPORT_SDMA_MGCG |
-                        AMDGPU_CG_SUPPORT_SDMA_LS |
-                        AMDGPU_CG_SUPPORT_BIF_LS |
-                        AMDGPU_CG_SUPPORT_VCE_MGCG |
-                        AMDGPU_CG_SUPPORT_UVD_MGCG |
-                        AMDGPU_CG_SUPPORT_HDP_LS |
-                        AMDGPU_CG_SUPPORT_HDP_MGCG;
+                        AMD_CG_SUPPORT_GFX_MGCG |
+                        AMD_CG_SUPPORT_GFX_MGLS |
+                        /*AMD_CG_SUPPORT_GFX_CGCG |*/
+                        AMD_CG_SUPPORT_GFX_CGLS |
+                        AMD_CG_SUPPORT_GFX_CGTS |
+                        AMD_CG_SUPPORT_GFX_CGTS_LS |
+                        AMD_CG_SUPPORT_GFX_CP_LS |
+                        AMD_CG_SUPPORT_SDMA_MGCG |
+                        AMD_CG_SUPPORT_SDMA_LS |
+                        AMD_CG_SUPPORT_BIF_LS |
+                        AMD_CG_SUPPORT_VCE_MGCG |
+                        AMD_CG_SUPPORT_UVD_MGCG |
+                        AMD_CG_SUPPORT_HDP_LS |
+                        AMD_CG_SUPPORT_HDP_MGCG;
                 adev->pg_flags =
-                        /*AMDGPU_PG_SUPPORT_GFX_PG |
-                          AMDGPU_PG_SUPPORT_GFX_SMG |
-                          AMDGPU_PG_SUPPORT_GFX_DMG |*/
-                        AMDGPU_PG_SUPPORT_UVD |
-                        /*AMDGPU_PG_SUPPORT_VCE |
-                          AMDGPU_PG_SUPPORT_CP |
-                          AMDGPU_PG_SUPPORT_GDS |
-                          AMDGPU_PG_SUPPORT_RLC_SMU_HS |
-                          AMDGPU_PG_SUPPORT_ACP |
-                          AMDGPU_PG_SUPPORT_SAMU |*/
+                        /*AMD_PG_SUPPORT_GFX_PG |
+                          AMD_PG_SUPPORT_GFX_SMG |
+                          AMD_PG_SUPPORT_GFX_DMG |*/
+                        AMD_PG_SUPPORT_UVD |
+                        /*AMD_PG_SUPPORT_VCE |
+                          AMD_PG_SUPPORT_CP |
+                          AMD_PG_SUPPORT_GDS |
+                          AMD_PG_SUPPORT_RLC_SMU_HS |
+                          AMD_PG_SUPPORT_ACP |
+                          AMD_PG_SUPPORT_SAMU |*/
                         0;
                 if (adev->pdev->device == 0x1312 ||
                         adev->pdev->device == 0x1316 ||
@@ -2109,29 +2112,29 @@ static int cik_common_early_init(void *handle)
         case CHIP_KABINI:
         case CHIP_MULLINS:
                 adev->cg_flags =
-                        AMDGPU_CG_SUPPORT_GFX_MGCG |
-                        AMDGPU_CG_SUPPORT_GFX_MGLS |
-                        /*AMDGPU_CG_SUPPORT_GFX_CGCG |*/
-                        AMDGPU_CG_SUPPORT_GFX_CGLS |
-                        AMDGPU_CG_SUPPORT_GFX_CGTS |
-                        AMDGPU_CG_SUPPORT_GFX_CGTS_LS |
-                        AMDGPU_CG_SUPPORT_GFX_CP_LS |
-                        AMDGPU_CG_SUPPORT_SDMA_MGCG |
-                        AMDGPU_CG_SUPPORT_SDMA_LS |
-                        AMDGPU_CG_SUPPORT_BIF_LS |
-                        AMDGPU_CG_SUPPORT_VCE_MGCG |
-                        AMDGPU_CG_SUPPORT_UVD_MGCG |
-                        AMDGPU_CG_SUPPORT_HDP_LS |
-                        AMDGPU_CG_SUPPORT_HDP_MGCG;
+                        AMD_CG_SUPPORT_GFX_MGCG |
+                        AMD_CG_SUPPORT_GFX_MGLS |
+                        /*AMD_CG_SUPPORT_GFX_CGCG |*/
+                        AMD_CG_SUPPORT_GFX_CGLS |
+                        AMD_CG_SUPPORT_GFX_CGTS |
+                        AMD_CG_SUPPORT_GFX_CGTS_LS |
+                        AMD_CG_SUPPORT_GFX_CP_LS |
+                        AMD_CG_SUPPORT_SDMA_MGCG |
+                        AMD_CG_SUPPORT_SDMA_LS |
+                        AMD_CG_SUPPORT_BIF_LS |
+                        AMD_CG_SUPPORT_VCE_MGCG |
+                        AMD_CG_SUPPORT_UVD_MGCG |
+                        AMD_CG_SUPPORT_HDP_LS |
+                        AMD_CG_SUPPORT_HDP_MGCG;
                 adev->pg_flags =
-                        /*AMDGPU_PG_SUPPORT_GFX_PG |
-                          AMDGPU_PG_SUPPORT_GFX_SMG | */
-                        AMDGPU_PG_SUPPORT_UVD |
-                        /*AMDGPU_PG_SUPPORT_VCE |
-                          AMDGPU_PG_SUPPORT_CP |
-                          AMDGPU_PG_SUPPORT_GDS |
-                          AMDGPU_PG_SUPPORT_RLC_SMU_HS |
-                          AMDGPU_PG_SUPPORT_SAMU |*/
+                        /*AMD_PG_SUPPORT_GFX_PG |
+                          AMD_PG_SUPPORT_GFX_SMG | */
+                        AMD_PG_SUPPORT_UVD |
+                        /*AMD_PG_SUPPORT_VCE |
+                          AMD_PG_SUPPORT_CP |
+                          AMD_PG_SUPPORT_GDS |
+                          AMD_PG_SUPPORT_RLC_SMU_HS |
+                          AMD_PG_SUPPORT_SAMU |*/
                         0;
                 if (adev->asic_type == CHIP_KABINI) {
                         if (adev->rev_id == 0)
diff --git a/drivers/gpu/drm/amd/amdgpu/cik_sdma.c b/drivers/gpu/drm/amd/amdgpu/cik_sdma.c
index e4e4b2ac77b7..266db15daf2c 100644
--- a/drivers/gpu/drm/amd/amdgpu/cik_sdma.c
+++ b/drivers/gpu/drm/amd/amdgpu/cik_sdma.c
@@ -856,7 +856,7 @@ static void cik_enable_sdma_mgcg(struct amdgpu_device *adev,
 {
         u32 orig, data;
 
-        if (enable && (adev->cg_flags & AMDGPU_CG_SUPPORT_SDMA_MGCG)) {
+        if (enable && (adev->cg_flags & AMD_CG_SUPPORT_SDMA_MGCG)) {
                 WREG32(mmSDMA0_CLK_CTRL + SDMA0_REGISTER_OFFSET, 0x00000100);
                 WREG32(mmSDMA0_CLK_CTRL + SDMA1_REGISTER_OFFSET, 0x00000100);
         } else {
@@ -877,7 +877,7 @@ static void cik_enable_sdma_mgls(struct amdgpu_device *adev,
 {
         u32 orig, data;
 
-        if (enable && (adev->cg_flags & AMDGPU_CG_SUPPORT_SDMA_LS)) {
+        if (enable && (adev->cg_flags & AMD_CG_SUPPORT_SDMA_LS)) {
                 orig = data = RREG32(mmSDMA0_POWER_CNTL + SDMA0_REGISTER_OFFSET);
                 data |= 0x100;
                 if (orig != data)
diff --git a/drivers/gpu/drm/amd/amdgpu/cz_dpm.c b/drivers/gpu/drm/amd/amdgpu/cz_dpm.c
index 4dd17f2dd905..e7ef2261ff4a 100644
--- a/drivers/gpu/drm/amd/amdgpu/cz_dpm.c
+++ b/drivers/gpu/drm/amd/amdgpu/cz_dpm.c
@@ -445,13 +445,13 @@ static int cz_dpm_init(struct amdgpu_device *adev)
         pi->gfx_pg_threshold = 500;
         pi->caps_fps = true;
         /* uvd */
-        pi->caps_uvd_pg = (adev->pg_flags & AMDGPU_PG_SUPPORT_UVD) ? true : false;
+        pi->caps_uvd_pg = (adev->pg_flags & AMD_PG_SUPPORT_UVD) ? true : false;
         pi->caps_uvd_dpm = true;
         /* vce */
-        pi->caps_vce_pg = (adev->pg_flags & AMDGPU_PG_SUPPORT_VCE) ? true : false;
+        pi->caps_vce_pg = (adev->pg_flags & AMD_PG_SUPPORT_VCE) ? true : false;
         pi->caps_vce_dpm = true;
         /* acp */
-        pi->caps_acp_pg = (adev->pg_flags & AMDGPU_PG_SUPPORT_ACP) ? true : false;
+        pi->caps_acp_pg = (adev->pg_flags & AMD_PG_SUPPORT_ACP) ? true : false;
         pi->caps_acp_dpm = true;
 
         pi->caps_stable_power_state = false;
@@ -2202,8 +2202,7 @@ static void cz_dpm_powergate_vce(struct amdgpu_device *adev, bool gate)
                                                             AMD_PG_STATE_GATE);
 
                                 cz_enable_vce_dpm(adev, false);
-                                /* TODO: to figure out why vce can't be poweroff. */
-                                /* cz_send_msg_to_smc(adev, PPSMC_MSG_VCEPowerOFF); */
+                                cz_send_msg_to_smc(adev, PPSMC_MSG_VCEPowerOFF);
                                 pi->vce_power_gated = true;
                         } else {
                                 cz_send_msg_to_smc(adev, PPSMC_MSG_VCEPowerON);
@@ -2226,10 +2225,8 @@ static void cz_dpm_powergate_vce(struct amdgpu_device *adev, bool gate)
                 }
         } else { /*pi->caps_vce_pg*/
                 cz_update_vce_dpm(adev);
-                cz_enable_vce_dpm(adev, true);
+                cz_enable_vce_dpm(adev, !gate);
         }
-
-        return;
 }
 
 const struct amd_ip_funcs cz_dpm_ip_funcs = {
diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c
index 8fb7ebf3be3e..4411b94775db 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c
@@ -3041,6 +3041,19 @@ static void gfx_v7_0_ring_emit_vm_flush(struct amdgpu_ring *ring,
                                         unsigned vm_id, uint64_t pd_addr)
 {
         int usepfp = (ring->type == AMDGPU_RING_TYPE_GFX);
+        uint32_t seq = ring->fence_drv.sync_seq;
+        uint64_t addr = ring->fence_drv.gpu_addr;
+
+        amdgpu_ring_write(ring, PACKET3(PACKET3_WAIT_REG_MEM, 5));
+        amdgpu_ring_write(ring, (WAIT_REG_MEM_MEM_SPACE(1) | /* memory */
+                                 WAIT_REG_MEM_FUNCTION(3) | /* equal */
+                                 WAIT_REG_MEM_ENGINE(usepfp)));   /* pfp or me */
+        amdgpu_ring_write(ring, addr & 0xfffffffc);
+        amdgpu_ring_write(ring, upper_32_bits(addr) & 0xffffffff);
+        amdgpu_ring_write(ring, seq);
+        amdgpu_ring_write(ring, 0xffffffff);
+        amdgpu_ring_write(ring, 4); /* poll interval */
+
         if (usepfp) {
                 /* synce CE with ME to prevent CE fetch CEIB before context switch done */
                 amdgpu_ring_write(ring, PACKET3(PACKET3_SWITCH_BUFFER, 0));
@@ -3522,7 +3535,7 @@ static void gfx_v7_0_enable_cgcg(struct amdgpu_device *adev, bool enable)
 
         orig = data = RREG32(mmRLC_CGCG_CGLS_CTRL);
 
-        if (enable && (adev->cg_flags & AMDGPU_CG_SUPPORT_GFX_CGCG)) {
+        if (enable && (adev->cg_flags & AMD_CG_SUPPORT_GFX_CGCG)) {
                 gfx_v7_0_enable_gui_idle_interrupt(adev, true);
 
                 tmp = gfx_v7_0_halt_rlc(adev);
@@ -3560,9 +3573,9 @@ static void gfx_v7_0_enable_mgcg(struct amdgpu_device *adev, bool enable)
 {
         u32 data, orig, tmp = 0;
 
-        if (enable && (adev->cg_flags & AMDGPU_CG_SUPPORT_GFX_MGCG)) {
-                if (adev->cg_flags & AMDGPU_CG_SUPPORT_GFX_MGLS) {
-                        if (adev->cg_flags & AMDGPU_CG_SUPPORT_GFX_CP_LS) {
+        if (enable && (adev->cg_flags & AMD_CG_SUPPORT_GFX_MGCG)) {
+                if (adev->cg_flags & AMD_CG_SUPPORT_GFX_MGLS) {
+                        if (adev->cg_flags & AMD_CG_SUPPORT_GFX_CP_LS) {
                                 orig = data = RREG32(mmCP_MEM_SLP_CNTL);
                                 data |= CP_MEM_SLP_CNTL__CP_MEM_LS_EN_MASK;
                                 if (orig != data)
@@ -3589,14 +3602,14 @@ static void gfx_v7_0_enable_mgcg(struct amdgpu_device *adev, bool enable)
 
                 gfx_v7_0_update_rlc(adev, tmp);
 
-                if (adev->cg_flags & AMDGPU_CG_SUPPORT_GFX_CGTS) {
+                if (adev->cg_flags & AMD_CG_SUPPORT_GFX_CGTS) {
                         orig = data = RREG32(mmCGTS_SM_CTRL_REG);
                         data &= ~CGTS_SM_CTRL_REG__SM_MODE_MASK;
                         data |= (0x2 << CGTS_SM_CTRL_REG__SM_MODE__SHIFT);
                         data |= CGTS_SM_CTRL_REG__SM_MODE_ENABLE_MASK;
                         data &= ~CGTS_SM_CTRL_REG__OVERRIDE_MASK;
-                        if ((adev->cg_flags & AMDGPU_CG_SUPPORT_GFX_MGLS) &&
-                            (adev->cg_flags & AMDGPU_CG_SUPPORT_GFX_CGTS_LS))
+                        if ((adev->cg_flags & AMD_CG_SUPPORT_GFX_MGLS) &&
+                            (adev->cg_flags & AMD_CG_SUPPORT_GFX_CGTS_LS))
                                 data &= ~CGTS_SM_CTRL_REG__LS_OVERRIDE_MASK;
                         data &= ~CGTS_SM_CTRL_REG__ON_MONITOR_ADD_MASK;
                         data |= CGTS_SM_CTRL_REG__ON_MONITOR_ADD_EN_MASK;
@@ -3662,7 +3675,7 @@ static void gfx_v7_0_enable_sclk_slowdown_on_pu(struct amdgpu_device *adev,
         u32 data, orig;
 
         orig = data = RREG32(mmRLC_PG_CNTL);
-        if (enable && (adev->pg_flags & AMDGPU_PG_SUPPORT_RLC_SMU_HS))
+        if (enable && (adev->pg_flags & AMD_PG_SUPPORT_RLC_SMU_HS))
                 data |= RLC_PG_CNTL__SMU_CLK_SLOWDOWN_ON_PU_ENABLE_MASK;
         else
                 data &= ~RLC_PG_CNTL__SMU_CLK_SLOWDOWN_ON_PU_ENABLE_MASK;
@@ -3676,7 +3689,7 @@ static void gfx_v7_0_enable_sclk_slowdown_on_pd(struct amdgpu_device *adev,
         u32 data, orig;
 
         orig = data = RREG32(mmRLC_PG_CNTL);
-        if (enable && (adev->pg_flags & AMDGPU_PG_SUPPORT_RLC_SMU_HS))
+        if (enable && (adev->pg_flags & AMD_PG_SUPPORT_RLC_SMU_HS))
                 data |= RLC_PG_CNTL__SMU_CLK_SLOWDOWN_ON_PD_ENABLE_MASK;
         else
                 data &= ~RLC_PG_CNTL__SMU_CLK_SLOWDOWN_ON_PD_ENABLE_MASK;
@@ -3689,7 +3702,7 @@ static void gfx_v7_0_enable_cp_pg(struct amdgpu_device *adev, bool enable)
         u32 data, orig;
 
         orig = data = RREG32(mmRLC_PG_CNTL);
-        if (enable && (adev->pg_flags & AMDGPU_PG_SUPPORT_CP))
+        if (enable && (adev->pg_flags & AMD_PG_SUPPORT_CP))
                 data &= ~0x8000;
         else
                 data |= 0x8000;
@@ -3702,7 +3715,7 @@ static void gfx_v7_0_enable_gds_pg(struct amdgpu_device *adev, bool enable)
         u32 data, orig;
 
         orig = data = RREG32(mmRLC_PG_CNTL);
-        if (enable && (adev->pg_flags & AMDGPU_PG_SUPPORT_GDS))
+        if (enable && (adev->pg_flags & AMD_PG_SUPPORT_GDS))
                 data &= ~0x2000;
         else
                 data |= 0x2000;
@@ -3783,7 +3796,7 @@ static void gfx_v7_0_enable_gfx_cgpg(struct amdgpu_device *adev,
 {
         u32 data, orig;
 
-        if (enable && (adev->pg_flags & AMDGPU_PG_SUPPORT_GFX_PG)) {
+        if (enable && (adev->pg_flags & AMD_PG_SUPPORT_GFX_PG)) {
                 orig = data = RREG32(mmRLC_PG_CNTL);
                 data |= RLC_PG_CNTL__GFX_POWER_GATING_ENABLE_MASK;
                 if (orig != data)
@@ -3846,7 +3859,7 @@ static void gfx_v7_0_enable_gfx_static_mgpg(struct amdgpu_device *adev,
         u32 data, orig;
 
         orig = data = RREG32(mmRLC_PG_CNTL);
-        if (enable && (adev->pg_flags & AMDGPU_PG_SUPPORT_GFX_SMG))
+        if (enable && (adev->pg_flags & AMD_PG_SUPPORT_GFX_SMG))
                 data |= RLC_PG_CNTL__STATIC_PER_CU_PG_ENABLE_MASK;
         else
                 data &= ~RLC_PG_CNTL__STATIC_PER_CU_PG_ENABLE_MASK;
@@ -3860,7 +3873,7 @@ static void gfx_v7_0_enable_gfx_dynamic_mgpg(struct amdgpu_device *adev,
         u32 data, orig;
 
         orig = data = RREG32(mmRLC_PG_CNTL);
-        if (enable && (adev->pg_flags & AMDGPU_PG_SUPPORT_GFX_DMG))
+        if (enable && (adev->pg_flags & AMD_PG_SUPPORT_GFX_DMG))
                 data |= RLC_PG_CNTL__DYN_PER_CU_PG_ENABLE_MASK;
         else
                 data &= ~RLC_PG_CNTL__DYN_PER_CU_PG_ENABLE_MASK;
@@ -4027,15 +4040,15 @@ static void gfx_v7_0_get_csb_buffer(struct amdgpu_device *adev,
 
 static void gfx_v7_0_init_pg(struct amdgpu_device *adev)
 {
-        if (adev->pg_flags & (AMDGPU_PG_SUPPORT_GFX_PG |
-                              AMDGPU_PG_SUPPORT_GFX_SMG |
-                              AMDGPU_PG_SUPPORT_GFX_DMG |
-                              AMDGPU_PG_SUPPORT_CP |
-                              AMDGPU_PG_SUPPORT_GDS |
-                              AMDGPU_PG_SUPPORT_RLC_SMU_HS)) {
+        if (adev->pg_flags & (AMD_PG_SUPPORT_GFX_PG |
+                              AMD_PG_SUPPORT_GFX_SMG |
+                              AMD_PG_SUPPORT_GFX_DMG |
+                              AMD_PG_SUPPORT_CP |
+                              AMD_PG_SUPPORT_GDS |
+                              AMD_PG_SUPPORT_RLC_SMU_HS)) {
                 gfx_v7_0_enable_sclk_slowdown_on_pu(adev, true);
                 gfx_v7_0_enable_sclk_slowdown_on_pd(adev, true);
-                if (adev->pg_flags & AMDGPU_PG_SUPPORT_GFX_PG) {
+                if (adev->pg_flags & AMD_PG_SUPPORT_GFX_PG) {
                         gfx_v7_0_init_gfx_cgpg(adev);
                         gfx_v7_0_enable_cp_pg(adev, true);
                         gfx_v7_0_enable_gds_pg(adev, true);
@@ -4047,14 +4060,14 @@ static void gfx_v7_0_init_pg(struct amdgpu_device *adev)
 
 static void gfx_v7_0_fini_pg(struct amdgpu_device *adev)
 {
-        if (adev->pg_flags & (AMDGPU_PG_SUPPORT_GFX_PG |
-                              AMDGPU_PG_SUPPORT_GFX_SMG |
-                              AMDGPU_PG_SUPPORT_GFX_DMG |
-                              AMDGPU_PG_SUPPORT_CP |
-                              AMDGPU_PG_SUPPORT_GDS |
-                              AMDGPU_PG_SUPPORT_RLC_SMU_HS)) {
+        if (adev->pg_flags & (AMD_PG_SUPPORT_GFX_PG |
+                              AMD_PG_SUPPORT_GFX_SMG |
+                              AMD_PG_SUPPORT_GFX_DMG |
+                              AMD_PG_SUPPORT_CP |
+                              AMD_PG_SUPPORT_GDS |
+                              AMD_PG_SUPPORT_RLC_SMU_HS)) {
                 gfx_v7_0_update_gfx_pg(adev, false);
-                if (adev->pg_flags & AMDGPU_PG_SUPPORT_GFX_PG) {
+                if (adev->pg_flags & AMD_PG_SUPPORT_GFX_PG) {
                         gfx_v7_0_enable_cp_pg(adev, false);
                         gfx_v7_0_enable_gds_pg(adev, false);
                 }
@@ -5089,14 +5102,14 @@ static int gfx_v7_0_set_powergating_state(void *handle,
         if (state == AMD_PG_STATE_GATE)
                 gate = true;
 
-        if (adev->pg_flags & (AMDGPU_PG_SUPPORT_GFX_PG |
-                              AMDGPU_PG_SUPPORT_GFX_SMG |
-                              AMDGPU_PG_SUPPORT_GFX_DMG |
-                              AMDGPU_PG_SUPPORT_CP |
-                              AMDGPU_PG_SUPPORT_GDS |
-                              AMDGPU_PG_SUPPORT_RLC_SMU_HS)) {
+        if (adev->pg_flags & (AMD_PG_SUPPORT_GFX_PG |
+                              AMD_PG_SUPPORT_GFX_SMG |
+                              AMD_PG_SUPPORT_GFX_DMG |
+                              AMD_PG_SUPPORT_CP |
+                              AMD_PG_SUPPORT_GDS |
+                              AMD_PG_SUPPORT_RLC_SMU_HS)) {
                 gfx_v7_0_update_gfx_pg(adev, gate);
-                if (adev->pg_flags & AMDGPU_PG_SUPPORT_GFX_PG) {
+                if (adev->pg_flags & AMD_PG_SUPPORT_GFX_PG) {
                         gfx_v7_0_enable_cp_pg(adev, gate);
                         gfx_v7_0_enable_gds_pg(adev, gate);
                 }
diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
index e37378fe1edc..1b85c001f860 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
@@ -4691,7 +4691,8 @@ static void gfx_v8_0_ring_emit_vm_flush(struct amdgpu_ring *ring,
 
         amdgpu_ring_write(ring, PACKET3(PACKET3_WAIT_REG_MEM, 5));
         amdgpu_ring_write(ring, (WAIT_REG_MEM_MEM_SPACE(1) | /* memory */
-                 WAIT_REG_MEM_FUNCTION(3))); /* equal */
+                                 WAIT_REG_MEM_FUNCTION(3) | /* equal */
+                                 WAIT_REG_MEM_ENGINE(usepfp))); /* pfp or me */
         amdgpu_ring_write(ring, addr & 0xfffffffc);
         amdgpu_ring_write(ring, upper_32_bits(addr) & 0xffffffff);
         amdgpu_ring_write(ring, seq);
@@ -4877,7 +4878,7 @@ static int gfx_v8_0_set_priv_reg_fault_state(struct amdgpu_device *adev,
         case AMDGPU_IRQ_STATE_ENABLE:
                 cp_int_cntl = RREG32(mmCP_INT_CNTL_RING0);
                 cp_int_cntl = REG_SET_FIELD(cp_int_cntl, CP_INT_CNTL_RING0,
-                                            PRIV_REG_INT_ENABLE, 0);
+                                            PRIV_REG_INT_ENABLE, 1);
                 WREG32(mmCP_INT_CNTL_RING0, cp_int_cntl);
                 break;
         default:
diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c
index 68ee66b38e5c..711840a23bd3 100644
--- a/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c
@@ -793,7 +793,7 @@ static void gmc_v7_0_enable_mc_ls(struct amdgpu_device *adev,
 
         for (i = 0; i < ARRAY_SIZE(mc_cg_registers); i++) {
                 orig = data = RREG32(mc_cg_registers[i]);
-                if (enable && (adev->cg_flags & AMDGPU_CG_SUPPORT_MC_LS))
+                if (enable && (adev->cg_flags & AMD_CG_SUPPORT_MC_LS))
                         data |= mc_cg_ls_en[i];
                 else
                         data &= ~mc_cg_ls_en[i];
@@ -810,7 +810,7 @@ static void gmc_v7_0_enable_mc_mgcg(struct amdgpu_device *adev,
 
         for (i = 0; i < ARRAY_SIZE(mc_cg_registers); i++) {
                 orig = data = RREG32(mc_cg_registers[i]);
-                if (enable && (adev->cg_flags & AMDGPU_CG_SUPPORT_MC_MGCG))
+                if (enable && (adev->cg_flags & AMD_CG_SUPPORT_MC_MGCG))
                         data |= mc_cg_en[i];
                 else
                         data &= ~mc_cg_en[i];
@@ -826,7 +826,7 @@ static void gmc_v7_0_enable_bif_mgls(struct amdgpu_device *adev,
 
         orig = data = RREG32_PCIE(ixPCIE_CNTL2);
 
-        if (enable && (adev->cg_flags & AMDGPU_CG_SUPPORT_BIF_LS)) {
+        if (enable && (adev->cg_flags & AMD_CG_SUPPORT_BIF_LS)) {
                 data = REG_SET_FIELD(data, PCIE_CNTL2, SLV_MEM_LS_EN, 1);
                 data = REG_SET_FIELD(data, PCIE_CNTL2, MST_MEM_LS_EN, 1);
                 data = REG_SET_FIELD(data, PCIE_CNTL2, REPLAY_MEM_LS_EN, 1);
@@ -849,7 +849,7 @@ static void gmc_v7_0_enable_hdp_mgcg(struct amdgpu_device *adev,
 
         orig = data = RREG32(mmHDP_HOST_PATH_CNTL);
 
-        if (enable && (adev->cg_flags & AMDGPU_CG_SUPPORT_HDP_MGCG))
+        if (enable && (adev->cg_flags & AMD_CG_SUPPORT_HDP_MGCG))
                 data = REG_SET_FIELD(data, HDP_HOST_PATH_CNTL, CLOCK_GATING_DIS, 0);
         else
                 data = REG_SET_FIELD(data, HDP_HOST_PATH_CNTL, CLOCK_GATING_DIS, 1);
@@ -865,7 +865,7 @@ static void gmc_v7_0_enable_hdp_ls(struct amdgpu_device *adev,
 
         orig = data = RREG32(mmHDP_MEM_POWER_LS);
 
-        if (enable && (adev->cg_flags & AMDGPU_CG_SUPPORT_HDP_LS))
+        if (enable && (adev->cg_flags & AMD_CG_SUPPORT_HDP_LS))
                 data = REG_SET_FIELD(data, HDP_MEM_POWER_LS, LS_ENABLE, 1);
         else
                 data = REG_SET_FIELD(data, HDP_MEM_POWER_LS, LS_ENABLE, 0);
diff --git a/drivers/gpu/drm/amd/amdgpu/kv_dpm.c b/drivers/gpu/drm/amd/amdgpu/kv_dpm.c
index 7e9154c7f1db..654d76723bc3 100644
--- a/drivers/gpu/drm/amd/amdgpu/kv_dpm.c
+++ b/drivers/gpu/drm/amd/amdgpu/kv_dpm.c
@@ -2859,11 +2859,11 @@ static int kv_dpm_init(struct amdgpu_device *adev)
         pi->voltage_drop_t = 0;
         pi->caps_sclk_throttle_low_notification = false;
         pi->caps_fps = false; /* true? */
-        pi->caps_uvd_pg = (adev->pg_flags & AMDGPU_PG_SUPPORT_UVD) ? true : false;
+        pi->caps_uvd_pg = (adev->pg_flags & AMD_PG_SUPPORT_UVD) ? true : false;
         pi->caps_uvd_dpm = true;
-        pi->caps_vce_pg = (adev->pg_flags & AMDGPU_PG_SUPPORT_VCE) ? true : false;
-        pi->caps_samu_pg = (adev->pg_flags & AMDGPU_PG_SUPPORT_SAMU) ? true : false;
-        pi->caps_acp_pg = (adev->pg_flags & AMDGPU_PG_SUPPORT_ACP) ? true : false;
+        pi->caps_vce_pg = (adev->pg_flags & AMD_PG_SUPPORT_VCE) ? true : false;
+        pi->caps_samu_pg = (adev->pg_flags & AMD_PG_SUPPORT_SAMU) ? true : false;
+        pi->caps_acp_pg = (adev->pg_flags & AMD_PG_SUPPORT_ACP) ? true : false;
         pi->caps_stable_p_state = false;
 
         ret = kv_parse_sys_info_table(adev);
diff --git a/drivers/gpu/drm/amd/amdgpu/uvd_v4_2.c b/drivers/gpu/drm/amd/amdgpu/uvd_v4_2.c
index 70ed73fa5156..c606ccb38d8b 100644
--- a/drivers/gpu/drm/amd/amdgpu/uvd_v4_2.c
+++ b/drivers/gpu/drm/amd/amdgpu/uvd_v4_2.c
@@ -588,7 +588,7 @@ static void uvd_v4_2_enable_mgcg(struct amdgpu_device *adev,
 {
         u32 orig, data;
 
-        if (enable && (adev->cg_flags & AMDGPU_CG_SUPPORT_UVD_MGCG)) {
+        if (enable && (adev->cg_flags & AMD_CG_SUPPORT_UVD_MGCG)) {
                 data = RREG32_UVD_CTX(ixUVD_CGC_MEM_CTRL);
                 data = 0xfff;
                 WREG32_UVD_CTX(ixUVD_CGC_MEM_CTRL, data);
@@ -814,6 +814,9 @@ static int uvd_v4_2_set_clockgating_state(void *handle,
         bool gate = false;
         struct amdgpu_device *adev = (struct amdgpu_device *)handle;
 
+        if (!(adev->cg_flags & AMD_CG_SUPPORT_UVD_MGCG))
+                return 0;
+
         if (state == AMD_CG_STATE_GATE)
                 gate = true;
 
@@ -832,7 +835,10 @@ static int uvd_v4_2_set_powergating_state(void *handle,
          * revisit this when there is a cleaner line between
          * the smc and the hw blocks
          */
-         struct amdgpu_device *adev = (struct amdgpu_device *)handle;
+        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
+
+        if (!(adev->pg_flags & AMD_PG_SUPPORT_UVD))
+                return 0;
 
         if (state == AMD_PG_STATE_GATE) {
                 uvd_v4_2_stop(adev);
diff --git a/drivers/gpu/drm/amd/amdgpu/uvd_v5_0.c b/drivers/gpu/drm/amd/amdgpu/uvd_v5_0.c
index 578ffb62fdb2..e3c852d9d79a 100644
--- a/drivers/gpu/drm/amd/amdgpu/uvd_v5_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/uvd_v5_0.c
@@ -757,6 +757,11 @@ static int uvd_v5_0_process_interrupt(struct amdgpu_device *adev,
 static int uvd_v5_0_set_clockgating_state(void *handle,
                                           enum amd_clockgating_state state)
 {
+        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
+
+        if (!(adev->cg_flags & AMD_CG_SUPPORT_UVD_MGCG))
+                return 0;
+
         return 0;
 }
 
@@ -772,6 +777,9 @@ static int uvd_v5_0_set_powergating_state(void *handle,
          */
         struct amdgpu_device *adev = (struct amdgpu_device *)handle;
 
+        if (!(adev->pg_flags & AMD_PG_SUPPORT_UVD))
+                return 0;
+
         if (state == AMD_PG_STATE_GATE) {
                 uvd_v5_0_stop(adev);
                 return 0;
diff --git a/drivers/gpu/drm/amd/amdgpu/uvd_v6_0.c b/drivers/gpu/drm/amd/amdgpu/uvd_v6_0.c
index d4da1f04378c..3375e614ac67 100644
--- a/drivers/gpu/drm/amd/amdgpu/uvd_v6_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/uvd_v6_0.c
@@ -536,7 +536,7 @@ static int uvd_v6_0_start(struct amdgpu_device *adev)
         uvd_v6_0_mc_resume(adev);
 
         /* Set dynamic clock gating in S/W control mode */
-        if (adev->cg_flags & AMDGPU_CG_SUPPORT_UVD_MGCG) {
+        if (adev->cg_flags & AMD_CG_SUPPORT_UVD_MGCG) {
                 if (adev->flags & AMD_IS_APU)
                         cz_set_uvd_clock_gating_branches(adev, false);
                 else
@@ -983,7 +983,7 @@ static int uvd_v6_0_set_clockgating_state(void *handle,
         struct amdgpu_device *adev = (struct amdgpu_device *)handle;
         bool enable = (state == AMD_CG_STATE_GATE) ? true : false;
 
-        if (!(adev->cg_flags & AMDGPU_CG_SUPPORT_UVD_MGCG))
+        if (!(adev->cg_flags & AMD_CG_SUPPORT_UVD_MGCG))
                 return 0;
 
         if (enable) {
@@ -1013,6 +1013,9 @@ static int uvd_v6_0_set_powergating_state(void *handle,
          */
         struct amdgpu_device *adev = (struct amdgpu_device *)handle;
 
+        if (!(adev->pg_flags & AMD_PG_SUPPORT_UVD))
+                return 0;
+
         if (state == AMD_PG_STATE_GATE) {
                 uvd_v6_0_stop(adev);
                 return 0;
diff --git a/drivers/gpu/drm/amd/amdgpu/vce_v2_0.c b/drivers/gpu/drm/amd/amdgpu/vce_v2_0.c
index 9c804f436974..c7e885bcfd41 100644
--- a/drivers/gpu/drm/amd/amdgpu/vce_v2_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/vce_v2_0.c
@@ -373,7 +373,7 @@ static void vce_v2_0_enable_mgcg(struct amdgpu_device *adev, bool enable)
 {
         bool sw_cg = false;
 
-        if (enable && (adev->cg_flags & AMDGPU_CG_SUPPORT_VCE_MGCG)) {
+        if (enable && (adev->cg_flags & AMD_CG_SUPPORT_VCE_MGCG)) {
                 if (sw_cg)
                         vce_v2_0_set_sw_cg(adev, true);
                 else
@@ -608,6 +608,9 @@ static int vce_v2_0_set_powergating_state(void *handle,
          */
         struct amdgpu_device *adev = (struct amdgpu_device *)handle;
 
+        if (!(adev->pg_flags & AMD_PG_SUPPORT_VCE))
+                return 0;
+
         if (state == AMD_PG_STATE_GATE)
                 /* XXX do we need a vce_v2_0_stop()? */
                 return 0;
diff --git a/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c b/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c
index 8f8d479061f8..ce468ee5da2a 100644
--- a/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c
@@ -277,7 +277,7 @@ static int vce_v3_0_start(struct amdgpu_device *adev)
                 WREG32_P(mmVCE_STATUS, 0, ~1);
 
                 /* Set Clock-Gating off */
-                if (adev->cg_flags & AMDGPU_CG_SUPPORT_VCE_MGCG)
+                if (adev->cg_flags & AMD_CG_SUPPORT_VCE_MGCG)
                         vce_v3_0_set_vce_sw_clock_gating(adev, false);
 
                 if (r) {
@@ -676,7 +676,7 @@ static int vce_v3_0_set_clockgating_state(void *handle,
         bool enable = (state == AMD_CG_STATE_GATE) ? true : false;
         int i;
 
-        if (!(adev->cg_flags & AMDGPU_CG_SUPPORT_VCE_MGCG))
+        if (!(adev->cg_flags & AMD_CG_SUPPORT_VCE_MGCG))
                 return 0;
 
         mutex_lock(&adev->grbm_idx_mutex);
@@ -728,6 +728,9 @@ static int vce_v3_0_set_powergating_state(void *handle,
          */
         struct amdgpu_device *adev = (struct amdgpu_device *)handle;
 
+        if (!(adev->pg_flags & AMD_PG_SUPPORT_VCE))
+                return 0;
+
         if (state == AMD_PG_STATE_GATE)
                 /* XXX do we need a vce_v3_0_stop()? */
                 return 0;
diff --git a/drivers/gpu/drm/amd/amdgpu/vi.c b/drivers/gpu/drm/amd/amdgpu/vi.c
index 125003517544..b72cf063df1a 100644
--- a/drivers/gpu/drm/amd/amdgpu/vi.c
+++ b/drivers/gpu/drm/amd/amdgpu/vi.c
@@ -1092,8 +1092,7 @@ static int vi_common_early_init(void *handle)
         case CHIP_STONEY:
                 adev->has_uvd = true;
                 adev->cg_flags = 0;
-                /* Disable UVD pg */
-                adev->pg_flags = /* AMDGPU_PG_SUPPORT_UVD | */AMDGPU_PG_SUPPORT_VCE;
+                adev->pg_flags = 0;
                 adev->external_rev_id = adev->rev_id + 0x1;
                 break;
         default:
diff --git a/drivers/gpu/drm/amd/include/amd_shared.h b/drivers/gpu/drm/amd/include/amd_shared.h
index 15ff8b2c26e7..04e4090666fb 100644
--- a/drivers/gpu/drm/amd/include/amd_shared.h
+++ b/drivers/gpu/drm/amd/include/amd_shared.h
@@ -86,6 +86,38 @@ enum amd_powergating_state {
         AMD_PG_STATE_UNGATE,
 };
 
+/* CG flags */
+#define AMD_CG_SUPPORT_GFX_MGCG                 (1 << 0)
+#define AMD_CG_SUPPORT_GFX_MGLS                 (1 << 1)
+#define AMD_CG_SUPPORT_GFX_CGCG                 (1 << 2)
+#define AMD_CG_SUPPORT_GFX_CGLS                 (1 << 3)
+#define AMD_CG_SUPPORT_GFX_CGTS                 (1 << 4)
+#define AMD_CG_SUPPORT_GFX_CGTS_LS              (1 << 5)
+#define AMD_CG_SUPPORT_GFX_CP_LS                (1 << 6)
+#define AMD_CG_SUPPORT_GFX_RLC_LS               (1 << 7)
+#define AMD_CG_SUPPORT_MC_LS                    (1 << 8)
+#define AMD_CG_SUPPORT_MC_MGCG                  (1 << 9)
+#define AMD_CG_SUPPORT_SDMA_LS                  (1 << 10)
+#define AMD_CG_SUPPORT_SDMA_MGCG                (1 << 11)
+#define AMD_CG_SUPPORT_BIF_LS                   (1 << 12)
+#define AMD_CG_SUPPORT_UVD_MGCG                 (1 << 13)
+#define AMD_CG_SUPPORT_VCE_MGCG                 (1 << 14)
+#define AMD_CG_SUPPORT_HDP_LS                   (1 << 15)
+#define AMD_CG_SUPPORT_HDP_MGCG                 (1 << 16)
+
+/* PG flags */
+#define AMD_PG_SUPPORT_GFX_PG                   (1 << 0)
+#define AMD_PG_SUPPORT_GFX_SMG                  (1 << 1)
+#define AMD_PG_SUPPORT_GFX_DMG                  (1 << 2)
+#define AMD_PG_SUPPORT_UVD                      (1 << 3)
+#define AMD_PG_SUPPORT_VCE                      (1 << 4)
+#define AMD_PG_SUPPORT_CP                       (1 << 5)
+#define AMD_PG_SUPPORT_GDS                      (1 << 6)
+#define AMD_PG_SUPPORT_RLC_SMU_HS               (1 << 7)
+#define AMD_PG_SUPPORT_SDMA                     (1 << 8)
+#define AMD_PG_SUPPORT_ACP                      (1 << 9)
+#define AMD_PG_SUPPORT_SAMU                     (1 << 10)
+
 enum amd_pm_state_type {
         /* not used for dpm */
         POWER_STATE_TYPE_DEFAULT,
diff --git a/drivers/gpu/drm/amd/include/cgs_common.h b/drivers/gpu/drm/amd/include/cgs_common.h
index 713aec954692..aec38fc3834f 100644
--- a/drivers/gpu/drm/amd/include/cgs_common.h
+++ b/drivers/gpu/drm/amd/include/cgs_common.h
@@ -109,6 +109,8 @@ enum cgs_system_info_id {
         CGS_SYSTEM_INFO_ADAPTER_BDF_ID = 1,
         CGS_SYSTEM_INFO_PCIE_GEN_INFO,
         CGS_SYSTEM_INFO_PCIE_MLW,
+        CGS_SYSTEM_INFO_CG_FLAGS,
+        CGS_SYSTEM_INFO_PG_FLAGS,
         CGS_SYSTEM_INFO_ID_MAXIMUM,
 };
 
diff --git a/drivers/gpu/drm/amd/powerplay/amd_powerplay.c b/drivers/gpu/drm/amd/powerplay/amd_powerplay.c
index 0db64231effe..9d2290044708 100644
--- a/drivers/gpu/drm/amd/powerplay/amd_powerplay.c
+++ b/drivers/gpu/drm/amd/powerplay/amd_powerplay.c
@@ -403,8 +403,11 @@ int pp_dpm_dispatch_tasks(void *handle, enum amd_pp_event event_id, void *input,
 
                 data.requested_ui_label = power_state_convert(ps);
                 ret = pem_handle_event(pp_handle->eventmgr, event_id, &data);
+                break;
         }
-        break;
+        case AMD_PP_EVENT_COMPLETE_INIT:
+                ret = pem_handle_event(pp_handle->eventmgr, event_id, &data);
+                break;
         default:
                 break;
         }
diff --git a/drivers/gpu/drm/amd/powerplay/eventmgr/eventactionchains.c b/drivers/gpu/drm/amd/powerplay/eventmgr/eventactionchains.c
index 83be3cf210e0..6b52c78cb404 100644
--- a/drivers/gpu/drm/amd/powerplay/eventmgr/eventactionchains.c
+++ b/drivers/gpu/drm/amd/powerplay/eventmgr/eventactionchains.c
@@ -165,6 +165,7 @@ const struct action_chain resume_action_chain = {
 };
 
 static const pem_event_action *complete_init_event[] = {
+        unblock_adjust_power_state_tasks,
         adjust_power_state_tasks,
         enable_gfx_clock_gating_tasks,
         enable_gfx_voltage_island_power_gating_tasks,
diff --git a/drivers/gpu/drm/amd/powerplay/eventmgr/eventmgr.c b/drivers/gpu/drm/amd/powerplay/eventmgr/eventmgr.c
index 52a3efc97f05..46410e3c7349 100644
--- a/drivers/gpu/drm/amd/powerplay/eventmgr/eventmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/eventmgr/eventmgr.c
@@ -31,7 +31,7 @@
 static int pem_init(struct pp_eventmgr *eventmgr)
 {
         int result = 0;
-        struct pem_event_data event_data;
+        struct pem_event_data event_data = { {0} };
 
         /* Initialize PowerPlay feature info */
         pem_init_feature_info(eventmgr);
@@ -52,7 +52,7 @@ static int pem_init(struct pp_eventmgr *eventmgr)
 
 static void pem_fini(struct pp_eventmgr *eventmgr)
 {
-        struct pem_event_data event_data;
+        struct pem_event_data event_data = { {0} };
 
         pem_uninit_featureInfo(eventmgr);
         pem_unregister_interrupts(eventmgr);
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/cz_clockpowergating.c b/drivers/gpu/drm/amd/powerplay/hwmgr/cz_clockpowergating.c
index ad7700822a1c..ff08ce41bde9 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/cz_clockpowergating.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/cz_clockpowergating.c
@@ -226,7 +226,7 @@ int cz_dpm_powergate_vce(struct pp_hwmgr *hwmgr, bool bgate)
                 }
         } else {
                 cz_dpm_update_vce_dpm(hwmgr);
-                cz_enable_disable_vce_dpm(hwmgr, true);
+                cz_enable_disable_vce_dpm(hwmgr, !bgate);
                 return 0;
         }
 
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/cz_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/cz_hwmgr.c
index ef1daf1251c7..b8d6a82c1be2 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/cz_hwmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/cz_hwmgr.c
@@ -174,6 +174,8 @@ static int cz_initialize_dpm_defaults(struct pp_hwmgr *hwmgr)
 {
         struct cz_hwmgr *cz_hwmgr = (struct cz_hwmgr *)(hwmgr->backend);
         uint32_t i;
+        struct cgs_system_info sys_info = {0};
+        int result;
 
         cz_hwmgr->gfx_ramp_step = 256*25/100;
 
@@ -247,6 +249,22 @@ static int cz_initialize_dpm_defaults(struct pp_hwmgr *hwmgr)
         phm_cap_set(hwmgr->platform_descriptor.platformCaps,
                                    PHM_PlatformCaps_DisableVoltageIsland);
 
+        phm_cap_unset(hwmgr->platform_descriptor.platformCaps,
+                      PHM_PlatformCaps_UVDPowerGating);
+        phm_cap_unset(hwmgr->platform_descriptor.platformCaps,
+                      PHM_PlatformCaps_VCEPowerGating);
+        sys_info.size = sizeof(struct cgs_system_info);
+        sys_info.info_id = CGS_SYSTEM_INFO_PG_FLAGS;
+        result = cgs_query_system_info(hwmgr->device, &sys_info);
+        if (!result) {
+                if (sys_info.value & AMD_PG_SUPPORT_UVD)
+                        phm_cap_set(hwmgr->platform_descriptor.platformCaps,
+                                      PHM_PlatformCaps_UVDPowerGating);
+                if (sys_info.value & AMD_PG_SUPPORT_VCE)
+                        phm_cap_set(hwmgr->platform_descriptor.platformCaps,
+                                      PHM_PlatformCaps_VCEPowerGating);
+        }
+
         return 0;
 }
 
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/tonga_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/tonga_hwmgr.c
index bc83fa35ec46..aec4f8346d9c 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/tonga_hwmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/tonga_hwmgr.c
@@ -4451,6 +4451,7 @@ int tonga_hwmgr_backend_init(struct pp_hwmgr *hwmgr)
         pp_atomctrl_gpio_pin_assignment gpio_pin_assignment;
         struct phm_ppt_v1_information *pptable_info = (struct phm_ppt_v1_information *)(hwmgr->pptable);
         phw_tonga_ulv_parm *ulv;
+        struct cgs_system_info sys_info = {0};
 
         PP_ASSERT_WITH_CODE((NULL != hwmgr),
                 "Invalid Parameter!", return -1;);
@@ -4615,9 +4616,23 @@ int tonga_hwmgr_backend_init(struct pp_hwmgr *hwmgr)
 
         data->vddc_phase_shed_control = 0;
 
-        if (0 == result) {
-                struct cgs_system_info sys_info = {0};
+        phm_cap_unset(hwmgr->platform_descriptor.platformCaps,
+                      PHM_PlatformCaps_UVDPowerGating);
+        phm_cap_unset(hwmgr->platform_descriptor.platformCaps,
+                      PHM_PlatformCaps_VCEPowerGating);
+        sys_info.size = sizeof(struct cgs_system_info);
+        sys_info.info_id = CGS_SYSTEM_INFO_PG_FLAGS;
+        result = cgs_query_system_info(hwmgr->device, &sys_info);
+        if (!result) {
+                if (sys_info.value & AMD_PG_SUPPORT_UVD)
+                        phm_cap_set(hwmgr->platform_descriptor.platformCaps,
+                                      PHM_PlatformCaps_UVDPowerGating);
+                if (sys_info.value & AMD_PG_SUPPORT_VCE)
+                        phm_cap_set(hwmgr->platform_descriptor.platformCaps,
+                                      PHM_PlatformCaps_VCEPowerGating);
+        }
 
+        if (0 == result) {
                 data->is_tlu_enabled = 0;
                 hwmgr->platform_descriptor.hardwareActivityPerformanceLevels =
                         TONGA_MAX_HARDWARE_POWERLEVELS;
diff --git a/drivers/gpu/drm/ast/ast_main.c b/drivers/gpu/drm/ast/ast_main.c
index 9759009d1da3..b1480acbb3c3 100644
--- a/drivers/gpu/drm/ast/ast_main.c
+++ b/drivers/gpu/drm/ast/ast_main.c
@@ -227,7 +227,7 @@ static int ast_get_dram_info(struct drm_device *dev)
         } while (ast_read32(ast, 0x10000) != 0x01);
         data = ast_read32(ast, 0x10004);
 
-        if (data & 0x400)
+        if (data & 0x40)
                 ast->dram_bus_width = 16;
         else
                 ast->dram_bus_width = 32;
diff --git a/drivers/gpu/drm/drm_atomic.c b/drivers/gpu/drm/drm_atomic.c
index 8fb469c4e4b8..092620c6ff32 100644
--- a/drivers/gpu/drm/drm_atomic.c
+++ b/drivers/gpu/drm/drm_atomic.c
@@ -65,8 +65,6 @@ drm_atomic_state_init(struct drm_device *dev, struct drm_atomic_state *state)
          */
         state->allow_modeset = true;
 
-        state->num_connector = ACCESS_ONCE(dev->mode_config.num_connector);
-
         state->crtcs = kcalloc(dev->mode_config.num_crtc,
                                sizeof(*state->crtcs), GFP_KERNEL);
         if (!state->crtcs)
@@ -83,16 +81,6 @@ drm_atomic_state_init(struct drm_device *dev, struct drm_atomic_state *state)
                                       sizeof(*state->plane_states), GFP_KERNEL);
         if (!state->plane_states)
                 goto fail;
-        state->connectors = kcalloc(state->num_connector,
-                                    sizeof(*state->connectors),
-                                    GFP_KERNEL);
-        if (!state->connectors)
-                goto fail;
-        state->connector_states = kcalloc(state->num_connector,
-                                          sizeof(*state->connector_states),
-                                          GFP_KERNEL);
-        if (!state->connector_states)
-                goto fail;
 
         state->dev = dev;
 
@@ -823,19 +811,27 @@ drm_atomic_get_connector_state(struct drm_atomic_state *state,
 
         index = drm_connector_index(connector);
 
-        /*
-         * Construction of atomic state updates can race with a connector
-         * hot-add which might overflow. In this case flip the table and just
-         * restart the entire ioctl - no one is fast enough to livelock a cpu
-         * with physical hotplug events anyway.
-         *
-         * Note that we only grab the indexes once we have the right lock to
-         * prevent hotplug/unplugging of connectors. So removal is no problem,
-         * at most the array is a bit too large.
-         */
         if (index >= state->num_connector) {
-                DRM_DEBUG_ATOMIC("Hot-added connector would overflow state array, restarting\n");
-                return ERR_PTR(-EAGAIN);
+                struct drm_connector **c;
+                struct drm_connector_state **cs;
+                int alloc = max(index + 1, config->num_connector);
+
+                c = krealloc(state->connectors, alloc * sizeof(*state->connectors), GFP_KERNEL);
+                if (!c)
+                        return ERR_PTR(-ENOMEM);
+
+                state->connectors = c;
+                memset(&state->connectors[state->num_connector], 0,
+                       sizeof(*state->connectors) * (alloc - state->num_connector));
+
+                cs = krealloc(state->connector_states, alloc * sizeof(*state->connector_states), GFP_KERNEL);
+                if (!cs)
+                        return ERR_PTR(-ENOMEM);
+
+                state->connector_states = cs;
+                memset(&state->connector_states[state->num_connector], 0,
+                       sizeof(*state->connector_states) * (alloc - state->num_connector));
+                state->num_connector = alloc;
         }
 
         if (state->connector_states[index])
diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c
index 2b430b05f35d..4da4f2a49078 100644
--- a/drivers/gpu/drm/drm_atomic_helper.c
+++ b/drivers/gpu/drm/drm_atomic_helper.c
@@ -1535,7 +1535,7 @@ void drm_atomic_helper_swap_state(struct drm_device *dev,
 {
         int i;
 
-        for (i = 0; i < dev->mode_config.num_connector; i++) {
+        for (i = 0; i < state->num_connector; i++) {
                 struct drm_connector *connector = state->connectors[i];
 
                 if (!connector)
diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
index 65258acddb90..84514001dcef 100644
--- a/drivers/gpu/drm/drm_crtc.c
+++ b/drivers/gpu/drm/drm_crtc.c
@@ -918,12 +918,19 @@ int drm_connector_init(struct drm_device *dev,
         connector->base.properties = &connector->properties;
         connector->dev = dev;
         connector->funcs = funcs;
+
+        connector->connector_id = ida_simple_get(&config->connector_ida, 0, 0, GFP_KERNEL);
+        if (connector->connector_id < 0) {
+                ret = connector->connector_id;
+                goto out_put;
+        }
+
         connector->connector_type = connector_type;
         connector->connector_type_id =
                 ida_simple_get(connector_ida, 1, 0, GFP_KERNEL);
         if (connector->connector_type_id < 0) {
                 ret = connector->connector_type_id;
-                goto out_put;
+                goto out_put_id;
         }
         connector->name =
                 kasprintf(GFP_KERNEL, "%s-%d",
@@ -931,7 +938,7 @@ int drm_connector_init(struct drm_device *dev,
                           connector->connector_type_id);
         if (!connector->name) {
                 ret = -ENOMEM;
-                goto out_put;
+                goto out_put_type_id;
         }
 
         INIT_LIST_HEAD(&connector->probed_modes);
@@ -959,7 +966,12 @@ int drm_connector_init(struct drm_device *dev,
         }
 
         connector->debugfs_entry = NULL;
-
+out_put_type_id:
+        if (ret)
+                ida_remove(connector_ida, connector->connector_type_id);
+out_put_id:
+        if (ret)
+                ida_remove(&config->connector_ida, connector->connector_id);
 out_put:
         if (ret)
                 drm_mode_object_put(dev, &connector->base);
@@ -996,6 +1008,9 @@ void drm_connector_cleanup(struct drm_connector *connector)
         ida_remove(&drm_connector_enum_list[connector->connector_type].ida,
                    connector->connector_type_id);
 
+        ida_remove(&dev->mode_config.connector_ida,
+                   connector->connector_id);
+
         kfree(connector->display_info.bus_formats);
         drm_mode_object_put(dev, &connector->base);
         kfree(connector->name);
@@ -1013,32 +1028,6 @@ void drm_connector_cleanup(struct drm_connector *connector)
 EXPORT_SYMBOL(drm_connector_cleanup);
 
 /**
- * drm_connector_index - find the index of a registered connector
- * @connector: connector to find index for
- *
- * Given a registered connector, return the index of that connector within a DRM
- * device's list of connectors.
- */
-unsigned int drm_connector_index(struct drm_connector *connector)
-{
-        unsigned int index = 0;
-        struct drm_connector *tmp;
-        struct drm_mode_config *config = &connector->dev->mode_config;
-
-        WARN_ON(!drm_modeset_is_locked(&config->connection_mutex));
-
-        drm_for_each_connector(tmp, connector->dev) {
-                if (tmp == connector)
-                        return index;
-
-                index++;
-        }
-
-        BUG();
-}
-EXPORT_SYMBOL(drm_connector_index);
-
-/**
  * drm_connector_register - register a connector
  * @connector: the connector to register
  *
@@ -5838,6 +5827,7 @@ void drm_mode_config_init(struct drm_device *dev)
         INIT_LIST_HEAD(&dev->mode_config.plane_list);
         idr_init(&dev->mode_config.crtc_idr);
         idr_init(&dev->mode_config.tile_idr);
+        ida_init(&dev->mode_config.connector_ida);
 
         drm_modeset_lock_all(dev);
         drm_mode_create_standard_properties(dev);
@@ -5918,6 +5908,7 @@ void drm_mode_config_cleanup(struct drm_device *dev)
                 crtc->funcs->destroy(crtc);
         }
 
+        ida_destroy(&dev->mode_config.connector_ida);
         idr_destroy(&dev->mode_config.tile_idr);
         idr_destroy(&dev->mode_config.crtc_idr);
         drm_modeset_lock_fini(&dev->mode_config.connection_mutex);
diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
index 8ae13de272c4..27fbd79d0daf 100644
--- a/drivers/gpu/drm/drm_dp_mst_topology.c
+++ b/drivers/gpu/drm/drm_dp_mst_topology.c
@@ -1159,11 +1159,13 @@ static void drm_dp_add_port(struct drm_dp_mst_branch *mstb,
                         drm_dp_put_port(port);
                         goto out;
                 }
-
-                drm_mode_connector_set_tile_property(port->connector);
-
+                if (port->port_num >= DP_MST_LOGICAL_PORT_0) {
+                        port->cached_edid = drm_get_edid(port->connector, &port->aux.ddc);
+                        drm_mode_connector_set_tile_property(port->connector);
+                }
                 (*mstb->mgr->cbs->register_connector)(port->connector);
         }
+
 out:
         /* put reference to this port */
         drm_dp_put_port(port);
@@ -1188,8 +1190,8 @@ static void drm_dp_update_port(struct drm_dp_mst_branch *mstb,
         port->ddps = conn_stat->displayport_device_plug_status;
 
         if (old_ddps != port->ddps) {
-                dowork = true;
                 if (port->ddps) {
+                        dowork = true;
                 } else {
                         port->available_pbn = 0;
                 }
@@ -1294,13 +1296,8 @@ static void drm_dp_check_and_send_link_address(struct drm_dp_mst_topology_mgr *m
                 if (port->input)
                         continue;
 
-                if (!port->ddps) {
-                        if (port->cached_edid) {
-                                kfree(port->cached_edid);
-                                port->cached_edid = NULL;
-                        }
+                if (!port->ddps)
                         continue;
-                }
 
                 if (!port->available_pbn)
                         drm_dp_send_enum_path_resources(mgr, mstb, port);
@@ -1311,12 +1308,6 @@ static void drm_dp_check_and_send_link_address(struct drm_dp_mst_topology_mgr *m
                                 drm_dp_check_and_send_link_address(mgr, mstb_child);
                                 drm_dp_put_mst_branch_device(mstb_child);
                         }
-                } else if (port->pdt == DP_PEER_DEVICE_SST_SINK ||
-                        port->pdt == DP_PEER_DEVICE_DP_LEGACY_CONV) {
-                        if (!port->cached_edid) {
-                                port->cached_edid =
-                                        drm_get_edid(port->connector, &port->aux.ddc);
-                        }
                 }
         }
 }
@@ -1336,8 +1327,6 @@ static void drm_dp_mst_link_probe_work(struct work_struct *work)
                 drm_dp_check_and_send_link_address(mgr, mstb);
                 drm_dp_put_mst_branch_device(mstb);
         }
-
-        (*mgr->cbs->hotplug)(mgr);
 }
 
 static bool drm_dp_validate_guid(struct drm_dp_mst_topology_mgr *mgr,
@@ -1597,6 +1586,7 @@ static void drm_dp_send_link_address(struct drm_dp_mst_topology_mgr *mgr,
                         for (i = 0; i < txmsg->reply.u.link_addr.nports; i++) {
                                 drm_dp_add_port(mstb, mgr->dev, &txmsg->reply.u.link_addr.ports[i]);
                         }
+                        (*mgr->cbs->hotplug)(mgr);
                 }
         } else {
                 mstb->link_address_sent = false;
@@ -2293,6 +2283,8 @@ static int drm_dp_mst_handle_up_req(struct drm_dp_mst_topology_mgr *mgr)
                         drm_dp_update_port(mstb, &msg.u.conn_stat);
 
                         DRM_DEBUG_KMS("Got CSN: pn: %d ldps:%d ddps: %d mcs: %d ip: %d pdt: %d\n", msg.u.conn_stat.port_number, msg.u.conn_stat.legacy_device_plug_status, msg.u.conn_stat.displayport_device_plug_status, msg.u.conn_stat.message_capability_status, msg.u.conn_stat.input_port, msg.u.conn_stat.peer_device_type);
+                        (*mgr->cbs->hotplug)(mgr);
+
                 } else if (msg.req_type == DP_RESOURCE_STATUS_NOTIFY) {
                         drm_dp_send_up_ack_reply(mgr, mgr->mst_primary, msg.req_type, seqno, false);
                         if (!mstb)
@@ -2379,6 +2371,10 @@ enum drm_connector_status drm_dp_mst_detect_port(struct drm_connector *connector
 
         case DP_PEER_DEVICE_SST_SINK:
                 status = connector_status_connected;
+                /* for logical ports - cache the EDID */
+                if (port->port_num >= 8 && !port->cached_edid) {
+                        port->cached_edid = drm_get_edid(connector, &port->aux.ddc);
+                }
                 break;
         case DP_PEER_DEVICE_DP_LEGACY_CONV:
                 if (port->ldps)
@@ -2433,7 +2429,10 @@ struct edid *drm_dp_mst_get_edid(struct drm_connector *connector, struct drm_dp_
 
         if (port->cached_edid)
                 edid = drm_edid_duplicate(port->cached_edid);
-
+        else {
+                edid = drm_get_edid(connector, &port->aux.ddc);
+                drm_mode_connector_set_tile_property(connector);
+        }
         port->has_audio = drm_detect_monitor_audio(edid);
         drm_dp_put_port(port);
         return edid;
diff --git a/drivers/gpu/drm/drm_irq.c b/drivers/gpu/drm/drm_irq.c
index 96d03ac38ef7..881c5a6c180c 100644
--- a/drivers/gpu/drm/drm_irq.c
+++ b/drivers/gpu/drm/drm_irq.c
@@ -224,6 +224,64 @@ static void drm_update_vblank_count(struct drm_device *dev, unsigned int pipe,
                 diff = (flags & DRM_CALLED_FROM_VBLIRQ) != 0;
         }
 
+        /*
+         * Within a drm_vblank_pre_modeset - drm_vblank_post_modeset
+         * interval? If so then vblank irqs keep running and it will likely
+         * happen that the hardware vblank counter is not trustworthy as it
+         * might reset at some point in that interval and vblank timestamps
+         * are not trustworthy either in that interval. Iow. this can result
+         * in a bogus diff >> 1 which must be avoided as it would cause
+         * random large forward jumps of the software vblank counter.
+         */
+        if (diff > 1 && (vblank->inmodeset & 0x2)) {
+                DRM_DEBUG_VBL("clamping vblank bump to 1 on crtc %u: diffr=%u"
+                              " due to pre-modeset.\n", pipe, diff);
+                diff = 1;
+        }
+
+        /*
+         * FIMXE: Need to replace this hack with proper seqlocks.
+         *
+         * Restrict the bump of the software vblank counter to a safe maximum
+         * value of +1 whenever there is the possibility that concurrent readers
+         * of vblank timestamps could be active at the moment, as the current
+         * implementation of the timestamp caching and updating is not safe
+         * against concurrent readers for calls to store_vblank() with a bump
+         * of anything but +1. A bump != 1 would very likely return corrupted
+         * timestamps to userspace, because the same slot in the cache could
+         * be concurrently written by store_vblank() and read by one of those
+         * readers without the read-retry logic detecting the collision.
+         *
+         * Concurrent readers can exist when we are called from the
+         * drm_vblank_off() or drm_vblank_on() functions and other non-vblank-
+         * irq callers. However, all those calls to us are happening with the
+         * vbl_lock locked to prevent drm_vblank_get(), so the vblank refcount
+         * can't increase while we are executing. Therefore a zero refcount at
+         * this point is safe for arbitrary counter bumps if we are called
+         * outside vblank irq, a non-zero count is not 100% safe. Unfortunately
+         * we must also accept a refcount of 1, as whenever we are called from
+         * drm_vblank_get() -> drm_vblank_enable() the refcount will be 1 and
+         * we must let that one pass through in order to not lose vblank counts
+         * during vblank irq off - which would completely defeat the whole
+         * point of this routine.
+         *
+         * Whenever we are called from vblank irq, we have to assume concurrent
+         * readers exist or can show up any time during our execution, even if
+         * the refcount is currently zero, as vblank irqs are usually only
+         * enabled due to the presence of readers, and because when we are called
+         * from vblank irq we can't hold the vbl_lock to protect us from sudden
+         * bumps in vblank refcount. Therefore also restrict bumps to +1 when
+         * called from vblank irq.
+         */
+        if ((diff > 1) && (atomic_read(&vblank->refcount) > 1 ||
+            (flags & DRM_CALLED_FROM_VBLIRQ))) {
+                DRM_DEBUG_VBL("clamping vblank bump to 1 on crtc %u: diffr=%u "
+                              "refcount %u, vblirq %u\n", pipe, diff,
+                              atomic_read(&vblank->refcount),
+                              (flags & DRM_CALLED_FROM_VBLIRQ) != 0);
+                diff = 1;
+        }
+
         DRM_DEBUG_VBL("updating vblank count on crtc %u:"
                       " current=%u, diff=%u, hw=%u hw_last=%u\n",
                       pipe, vblank->count, diff, cur_vblank, vblank->last);
@@ -1313,7 +1371,13 @@ void drm_vblank_off(struct drm_device *dev, unsigned int pipe)
         spin_lock_irqsave(&dev->event_lock, irqflags);
 
         spin_lock(&dev->vbl_lock);
-        vblank_disable_and_save(dev, pipe);
+        DRM_DEBUG_VBL("crtc %d, vblank enabled %d, inmodeset %d\n",
+                      pipe, vblank->enabled, vblank->inmodeset);
+
+        /* Avoid redundant vblank disables without previous drm_vblank_on(). */
+        if (drm_core_check_feature(dev, DRIVER_ATOMIC) || !vblank->inmodeset)
+                vblank_disable_and_save(dev, pipe);
+
         wake_up(&vblank->queue);
 
         /*
@@ -1415,6 +1479,9 @@ void drm_vblank_on(struct drm_device *dev, unsigned int pipe)
                 return;
 
         spin_lock_irqsave(&dev->vbl_lock, irqflags);
+        DRM_DEBUG_VBL("crtc %d, vblank enabled %d, inmodeset %d\n",
+                      pipe, vblank->enabled, vblank->inmodeset);
+
         /* Drop our private "prevent drm_vblank_get" refcount */
         if (vblank->inmodeset) {
                 atomic_dec(&vblank->refcount);
@@ -1427,8 +1494,7 @@ void drm_vblank_on(struct drm_device *dev, unsigned int pipe)
          * re-enable interrupts if there are users left, or the
          * user wishes vblank interrupts to be enabled all the time.
          */
-        if (atomic_read(&vblank->refcount) != 0 ||
-            (!dev->vblank_disable_immediate && drm_vblank_offdelay == 0))
+        if (atomic_read(&vblank->refcount) != 0 || drm_vblank_offdelay == 0)
                 WARN_ON(drm_vblank_enable(dev, pipe));
         spin_unlock_irqrestore(&dev->vbl_lock, irqflags);
 }
@@ -1523,6 +1589,7 @@ void drm_vblank_post_modeset(struct drm_device *dev, unsigned int pipe)
         if (vblank->inmodeset) {
                 spin_lock_irqsave(&dev->vbl_lock, irqflags);
                 dev->vblank_disable_allowed = true;
+                drm_reset_vblank_timestamp(dev, pipe);
                 spin_unlock_irqrestore(&dev->vbl_lock, irqflags);
 
                 if (vblank->inmodeset & 0x2)
diff --git a/drivers/gpu/drm/i2c/tda998x_drv.c b/drivers/gpu/drm/i2c/tda998x_drv.c
index b61282d89aa3..f4315bc8d471 100644
--- a/drivers/gpu/drm/i2c/tda998x_drv.c
+++ b/drivers/gpu/drm/i2c/tda998x_drv.c
@@ -1373,8 +1373,16 @@ static void tda998x_connector_destroy(struct drm_connector *connector)
         drm_connector_cleanup(connector);
 }
 
+static int tda998x_connector_dpms(struct drm_connector *connector, int mode)
+{
+        if (drm_core_check_feature(connector->dev, DRIVER_ATOMIC))
+                return drm_atomic_helper_connector_dpms(connector, mode);
+        else
+                return drm_helper_connector_dpms(connector, mode);
+}
+
 static const struct drm_connector_funcs tda998x_connector_funcs = {
-        .dpms = drm_atomic_helper_connector_dpms,
+        .dpms = tda998x_connector_dpms,
         .reset = drm_atomic_helper_connector_reset,
         .fill_modes = drm_helper_probe_single_connector_modes,
         .detect = tda998x_connector_detect,
diff --git a/drivers/gpu/drm/i915/intel_audio.c b/drivers/gpu/drm/i915/intel_audio.c
index 31f6d212fb1b..30f921421b0c 100644
--- a/drivers/gpu/drm/i915/intel_audio.c
+++ b/drivers/gpu/drm/i915/intel_audio.c
@@ -527,6 +527,8 @@ void intel_audio_codec_enable(struct intel_encoder *intel_encoder)
 
         mutex_lock(&dev_priv->av_mutex);
         intel_dig_port->audio_connector = connector;
+        /* referred in audio callbacks */
+        dev_priv->dig_port_map[port] = intel_encoder;
         mutex_unlock(&dev_priv->av_mutex);
 
         if (acomp && acomp->audio_ops && acomp->audio_ops->pin_eld_notify)
@@ -554,6 +556,7 @@ void intel_audio_codec_disable(struct intel_encoder *intel_encoder)
 
         mutex_lock(&dev_priv->av_mutex);
         intel_dig_port->audio_connector = NULL;
+        dev_priv->dig_port_map[port] = NULL;
         mutex_unlock(&dev_priv->av_mutex);
 
         if (acomp && acomp->audio_ops && acomp->audio_ops->pin_eld_notify)
diff --git a/drivers/gpu/drm/i915/intel_ddi.c b/drivers/gpu/drm/i915/intel_ddi.c
index 21a9b83f3bfc..62de9f4bce09 100644
--- a/drivers/gpu/drm/i915/intel_ddi.c
+++ b/drivers/gpu/drm/i915/intel_ddi.c
@@ -3326,7 +3326,6 @@ void intel_ddi_init(struct drm_device *dev, enum port port)
         intel_encoder->get_config = intel_ddi_get_config;
 
         intel_dig_port->port = port;
-        dev_priv->dig_port_map[port] = intel_encoder;
         intel_dig_port->saved_port_bits = I915_READ(DDI_BUF_CTL(port)) &
                                           (DDI_BUF_PORT_REVERSAL |
                                            DDI_A_4_LANES);
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index cbc06596659a..f069a82deb57 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -6043,7 +6043,6 @@ intel_dp_init(struct drm_device *dev,
         }
 
         intel_dig_port->port = port;
-        dev_priv->dig_port_map[port] = intel_encoder;
         intel_dig_port->dp.output_reg = output_reg;
         intel_dig_port->max_lanes = 4;
 
diff --git a/drivers/gpu/drm/i915/intel_hdmi.c b/drivers/gpu/drm/i915/intel_hdmi.c
index 80b44c054087..a0d8daed2470 100644
--- a/drivers/gpu/drm/i915/intel_hdmi.c
+++ b/drivers/gpu/drm/i915/intel_hdmi.c
@@ -2167,7 +2167,6 @@ void intel_hdmi_init_connector(struct intel_digital_port *intel_dig_port,
 void intel_hdmi_init(struct drm_device *dev,
                      i915_reg_t hdmi_reg, enum port port)
 {
-        struct drm_i915_private *dev_priv = dev->dev_private;
         struct intel_digital_port *intel_dig_port;
         struct intel_encoder *intel_encoder;
         struct intel_connector *intel_connector;
@@ -2236,7 +2235,6 @@ void intel_hdmi_init(struct drm_device *dev,
                 intel_encoder->cloneable |= 1 << INTEL_OUTPUT_HDMI;
 
         intel_dig_port->port = port;
-        dev_priv->dig_port_map[port] = intel_encoder;
         intel_dig_port->hdmi.hdmi_reg = hdmi_reg;
         intel_dig_port->dp.output_reg = INVALID_MMIO_REG;
         intel_dig_port->max_lanes = 4;
diff --git a/drivers/gpu/drm/i915/intel_i2c.c b/drivers/gpu/drm/i915/intel_i2c.c
index deb8282c26d8..52fbe530fc9e 100644
--- a/drivers/gpu/drm/i915/intel_i2c.c
+++ b/drivers/gpu/drm/i915/intel_i2c.c
@@ -664,6 +664,12 @@ int intel_setup_gmbus(struct drm_device *dev)
 
                 bus->adapter.algo = &gmbus_algorithm;
 
+                /*
+                 * We wish to retry with bit banging
+                 * after a timed out GMBUS attempt.
+                 */
+                bus->adapter.retries = 1;
+
                 /* By default use a conservative clock rate */
                 bus->reg0 = pin | GMBUS_RATE_100KHZ;
 
diff --git a/drivers/gpu/drm/i915/intel_runtime_pm.c b/drivers/gpu/drm/i915/intel_runtime_pm.c
index 4172e73212cd..6e54d978d9d4 100644
--- a/drivers/gpu/drm/i915/intel_runtime_pm.c
+++ b/drivers/gpu/drm/i915/intel_runtime_pm.c
@@ -2319,15 +2319,15 @@ void intel_power_domains_init_hw(struct drm_i915_private *dev_priv, bool resume)
  */
 void intel_power_domains_suspend(struct drm_i915_private *dev_priv)
 {
-        if (IS_SKYLAKE(dev_priv) || IS_KABYLAKE(dev_priv))
-                skl_display_core_uninit(dev_priv);
-
         /*
          * Even if power well support was disabled we still want to disable
          * power wells while we are system suspended.
          */
         if (!i915.disable_power_well)
                 intel_display_power_put(dev_priv, POWER_DOMAIN_INIT);
+
+        if (IS_SKYLAKE(dev_priv) || IS_KABYLAKE(dev_priv))
+                skl_display_core_uninit(dev_priv);
 }
 
 /**
diff --git a/drivers/gpu/drm/imx/ipuv3-crtc.c b/drivers/gpu/drm/imx/ipuv3-crtc.c
index 4bea0ddb3f3e..dee8e8b3523b 100644
--- a/drivers/gpu/drm/imx/ipuv3-crtc.c
+++ b/drivers/gpu/drm/imx/ipuv3-crtc.c
@@ -84,6 +84,7 @@ static void ipu_fb_enable(struct ipu_crtc *ipu_crtc)
         /* Start DC channel and DI after IDMAC */
         ipu_dc_enable_channel(ipu_crtc->dc);
         ipu_di_enable(ipu_crtc->di);
+        drm_crtc_vblank_on(&ipu_crtc->base);
 
         ipu_crtc->enabled = 1;
 }
@@ -100,6 +101,7 @@ static void ipu_fb_disable(struct ipu_crtc *ipu_crtc)
         ipu_di_disable(ipu_crtc->di);
         ipu_plane_disable(ipu_crtc->plane[0]);
         ipu_dc_disable(ipu);
+        drm_crtc_vblank_off(&ipu_crtc->base);
 
         ipu_crtc->enabled = 0;
 }
diff --git a/drivers/gpu/drm/imx/ipuv3-plane.c b/drivers/gpu/drm/imx/ipuv3-plane.c
index d078373c4233..588827844f30 100644
--- a/drivers/gpu/drm/imx/ipuv3-plane.c
+++ b/drivers/gpu/drm/imx/ipuv3-plane.c
@@ -42,6 +42,7 @@ static const uint32_t ipu_plane_formats[] = {
         DRM_FORMAT_YVYU,
         DRM_FORMAT_YUV420,
         DRM_FORMAT_YVU420,
+        DRM_FORMAT_RGB565,
 };
 
 int ipu_plane_irq(struct ipu_plane *ipu_plane)
diff --git a/drivers/gpu/drm/nouveau/nouveau_bo.c b/drivers/gpu/drm/nouveau/nouveau_bo.c
index 78f520d05de9..e3acc35e3805 100644
--- a/drivers/gpu/drm/nouveau/nouveau_bo.c
+++ b/drivers/gpu/drm/nouveau/nouveau_bo.c
@@ -1520,7 +1520,7 @@ nouveau_ttm_tt_populate(struct ttm_tt *ttm)
                                     DMA_BIDIRECTIONAL);
 
                 if (dma_mapping_error(pdev, addr)) {
-                        while (--i) {
+                        while (i--) {
                                 dma_unmap_page(pdev, ttm_dma->dma_address[i],
                                                PAGE_SIZE, DMA_BIDIRECTIONAL);
                                 ttm_dma->dma_address[i] = 0;
diff --git a/drivers/gpu/drm/nouveau/nouveau_display.c b/drivers/gpu/drm/nouveau/nouveau_display.c
index 24be27d3cd18..20935eb2a09e 100644
--- a/drivers/gpu/drm/nouveau/nouveau_display.c
+++ b/drivers/gpu/drm/nouveau/nouveau_display.c
@@ -635,10 +635,6 @@ nouveau_display_resume(struct drm_device *dev, bool runtime)
                 nv_crtc->lut.depth = 0;
         }
 
-        /* Make sure that drm and hw vblank irqs get resumed if needed. */
-        for (head = 0; head < dev->mode_config.num_crtc; head++)
-                drm_vblank_on(dev, head);
-
         /* This should ensure we don't hit a locking problem when someone
          * wakes us up via a connector.  We should never go into suspend
          * while the display is on anyways.
@@ -648,6 +644,10 @@ nouveau_display_resume(struct drm_device *dev, bool runtime)
 
         drm_helper_resume_force_mode(dev);
 
+        /* Make sure that drm and hw vblank irqs get resumed if needed. */
+        for (head = 0; head < dev->mode_config.num_crtc; head++)
+                drm_vblank_on(dev, head);
+
         list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
                 struct nouveau_crtc *nv_crtc = nouveau_crtc(crtc);
 
diff --git a/drivers/gpu/drm/nouveau/nouveau_platform.c b/drivers/gpu/drm/nouveau/nouveau_platform.c
index 8a70cec59bcd..2dfe58af12e4 100644
--- a/drivers/gpu/drm/nouveau/nouveau_platform.c
+++ b/drivers/gpu/drm/nouveau/nouveau_platform.c
@@ -24,7 +24,7 @@
 static int nouveau_platform_probe(struct platform_device *pdev)
 {
         const struct nvkm_device_tegra_func *func;
-        struct nvkm_device *device;
+        struct nvkm_device *device = NULL;
         struct drm_device *drm;
         int ret;
 
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/device/tegra.c b/drivers/gpu/drm/nouveau/nvkm/engine/device/tegra.c
index 7f8a42721eb2..e7e581d6a8ff 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/device/tegra.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/device/tegra.c
@@ -252,32 +252,40 @@ nvkm_device_tegra_new(const struct nvkm_device_tegra_func *func,
 
         if (!(tdev = kzalloc(sizeof(*tdev), GFP_KERNEL)))
                 return -ENOMEM;
-        *pdevice = &tdev->device;
+
         tdev->func = func;
         tdev->pdev = pdev;
         tdev->irq = -1;
 
         tdev->vdd = devm_regulator_get(&pdev->dev, "vdd");
-        if (IS_ERR(tdev->vdd))
-                return PTR_ERR(tdev->vdd);
+        if (IS_ERR(tdev->vdd)) {
+                ret = PTR_ERR(tdev->vdd);
+                goto free;
+        }
 
         tdev->rst = devm_reset_control_get(&pdev->dev, "gpu");
-        if (IS_ERR(tdev->rst))
-                return PTR_ERR(tdev->rst);
+        if (IS_ERR(tdev->rst)) {
+                ret = PTR_ERR(tdev->rst);
+                goto free;
+        }
 
         tdev->clk = devm_clk_get(&pdev->dev, "gpu");
-        if (IS_ERR(tdev->clk))
-                return PTR_ERR(tdev->clk);
+        if (IS_ERR(tdev->clk)) {
+                ret = PTR_ERR(tdev->clk);
+                goto free;
+        }
 
         tdev->clk_pwr = devm_clk_get(&pdev->dev, "pwr");
-        if (IS_ERR(tdev->clk_pwr))
-                return PTR_ERR(tdev->clk_pwr);
+        if (IS_ERR(tdev->clk_pwr)) {
+                ret = PTR_ERR(tdev->clk_pwr);
+                goto free;
+        }
 
         nvkm_device_tegra_probe_iommu(tdev);
 
         ret = nvkm_device_tegra_power_up(tdev);
         if (ret)
-                return ret;
+                goto remove;
 
         tdev->gpu_speedo = tegra_sku_info.gpu_speedo_value;
         ret = nvkm_device_ctor(&nvkm_device_tegra_func, NULL, &pdev->dev,
@@ -285,9 +293,19 @@ nvkm_device_tegra_new(const struct nvkm_device_tegra_func *func,
                                cfg, dbg, detect, mmio, subdev_mask,
                                &tdev->device);
         if (ret)
-                return ret;
+                goto powerdown;
+
+        *pdevice = &tdev->device;
 
         return 0;
+
+powerdown:
+        nvkm_device_tegra_power_down(tdev);
+remove:
+        nvkm_device_tegra_remove_iommu(tdev);
+free:
+        kfree(tdev);
+        return ret;
 }
 #else
 int
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/dport.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/dport.c
index 74e2f7c6c07e..9688970eca47 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/dport.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/dport.c
@@ -328,6 +328,7 @@ nvkm_dp_train(struct work_struct *w)
                 .outp = outp,
         }, *dp = &_dp;
         u32 datarate = 0;
+        u8  pwr;
         int ret;
 
         if (!outp->base.info.location && disp->func->sor.magic)
@@ -355,6 +356,15 @@ nvkm_dp_train(struct work_struct *w)
         /* disable link interrupt handling during link training */
         nvkm_notify_put(&outp->irq);
 
+        /* ensure sink is not in a low-power state */
+        if (!nvkm_rdaux(outp->aux, DPCD_SC00, &pwr, 1)) {
+                if ((pwr & DPCD_SC00_SET_POWER) != DPCD_SC00_SET_POWER_D0) {
+                        pwr &= ~DPCD_SC00_SET_POWER;
+                        pwr |=  DPCD_SC00_SET_POWER_D0;
+                        nvkm_wraux(outp->aux, DPCD_SC00, &pwr, 1);
+                }
+        }
+
         /* enable down-spreading and execute pre-train script from vbios */
         dp_link_train_init(dp, outp->dpcd[3] & 0x01);
 
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/dport.h b/drivers/gpu/drm/nouveau/nvkm/engine/disp/dport.h
index 9596290329c7..6e10c5e0ef11 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/dport.h
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/dport.h
@@ -71,5 +71,11 @@
 #define DPCD_LS0C_LANE1_POST_CURSOR2                                       0x0c
 #define DPCD_LS0C_LANE0_POST_CURSOR2                                       0x03
 
+/* DPCD Sink Control */
+#define DPCD_SC00                                                       0x00600
+#define DPCD_SC00_SET_POWER                                                0x03
+#define DPCD_SC00_SET_POWER_D0                                             0x01
+#define DPCD_SC00_SET_POWER_D3                                             0x03
+
 void nvkm_dp_train(struct work_struct *);
 #endif
diff --git a/drivers/gpu/drm/qxl/qxl_ioctl.c b/drivers/gpu/drm/qxl/qxl_ioctl.c
index 2ae8577497ca..7c2e78201ead 100644
--- a/drivers/gpu/drm/qxl/qxl_ioctl.c
+++ b/drivers/gpu/drm/qxl/qxl_ioctl.c
@@ -168,7 +168,8 @@ static int qxl_process_single_command(struct qxl_device *qdev,
                        cmd->command_size))
                 return -EFAULT;
 
-        reloc_info = kmalloc(sizeof(struct qxl_reloc_info) * cmd->relocs_num, GFP_KERNEL);
+        reloc_info = kmalloc_array(cmd->relocs_num,
+                                   sizeof(struct qxl_reloc_info), GFP_KERNEL);
         if (!reloc_info)
                 return -ENOMEM;
 
diff --git a/drivers/gpu/drm/qxl/qxl_prime.c b/drivers/gpu/drm/qxl/qxl_prime.c
index 3d031b50a8fd..9f029dda1f07 100644
--- a/drivers/gpu/drm/qxl/qxl_prime.c
+++ b/drivers/gpu/drm/qxl/qxl_prime.c
@@ -68,5 +68,5 @@ int qxl_gem_prime_mmap(struct drm_gem_object *obj,
                        struct vm_area_struct *area)
 {
         WARN_ONCE(1, "not implemented");
-        return ENOSYS;
+        return -ENOSYS;
 }
diff --git a/drivers/gpu/drm/radeon/atombios_dp.c b/drivers/gpu/drm/radeon/atombios_dp.c
index 44ee72e04df9..6af832545bc5 100644
--- a/drivers/gpu/drm/radeon/atombios_dp.c
+++ b/drivers/gpu/drm/radeon/atombios_dp.c
@@ -315,15 +315,27 @@ int radeon_dp_get_dp_link_config(struct drm_connector *connector,
         unsigned max_lane_num = drm_dp_max_lane_count(dpcd);
         unsigned lane_num, i, max_pix_clock;
 
-        for (lane_num = 1; lane_num <= max_lane_num; lane_num <<= 1) {
-                for (i = 0; i < ARRAY_SIZE(link_rates) && link_rates[i] <= max_link_rate; i++) {
-                        max_pix_clock = (lane_num * link_rates[i] * 8) / bpp;
+        if (radeon_connector_encoder_get_dp_bridge_encoder_id(connector) ==
+            ENCODER_OBJECT_ID_NUTMEG) {
+                for (lane_num = 1; lane_num <= max_lane_num; lane_num <<= 1) {
+                        max_pix_clock = (lane_num * 270000 * 8) / bpp;
                         if (max_pix_clock >= pix_clock) {
                                 *dp_lanes = lane_num;
-                                *dp_rate = link_rates[i];
+                                *dp_rate = 270000;
                                 return 0;
                         }
                 }
+        } else {
+                for (lane_num = 1; lane_num <= max_lane_num; lane_num <<= 1) {
+                        for (i = 0; i < ARRAY_SIZE(link_rates) && link_rates[i] <= max_link_rate; i++) {
+                                max_pix_clock = (lane_num * link_rates[i] * 8) / bpp;
+                                if (max_pix_clock >= pix_clock) {
+                                        *dp_lanes = lane_num;
+                                        *dp_rate = link_rates[i];
+                                        return 0;
+                                }
+                        }
+                }
         }
 
         return -EINVAL;
diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
index 902b59cebac5..4197ca1bb1e4 100644
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -1744,7 +1744,6 @@ int radeon_resume_kms(struct drm_device *dev, bool resume, bool fbcon)
         }
 
         drm_kms_helper_poll_enable(dev);
-        drm_helper_hpd_irq_event(dev);
 
         /* set the power state here in case we are a PX system or headless */
         if ((rdev->pm.pm_method == PM_METHOD_DPM) && rdev->pm.dpm_enabled)
diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
index a4674bfd979a..e29096b2fa6b 100644
--- a/drivers/gpu/drm/radeon/radeon_display.c
+++ b/drivers/gpu/drm/radeon/radeon_display.c
@@ -403,7 +403,8 @@ static void radeon_flip_work_func(struct work_struct *__work)
         struct drm_crtc *crtc = &radeon_crtc->base;
         unsigned long flags;
         int r;
-        int vpos, hpos, stat, min_udelay;
+        int vpos, hpos, stat, min_udelay = 0;
+        unsigned repcnt = 4;
         struct drm_vblank_crtc *vblank = &crtc->dev->vblank[work->crtc_id];
 
         down_read(&rdev->exclusive_lock);
@@ -454,7 +455,7 @@ static void radeon_flip_work_func(struct work_struct *__work)
          * In practice this won't execute very often unless on very fast
          * machines because the time window for this to happen is very small.
          */
-        for (;;) {
+        while (radeon_crtc->enabled && --repcnt) {
                 /* GET_DISTANCE_TO_VBLANKSTART returns distance to real vblank
                  * start in hpos, and to the "fudged earlier" vblank start in
                  * vpos.
@@ -470,12 +471,24 @@ static void radeon_flip_work_func(struct work_struct *__work)
                         break;
 
                 /* Sleep at least until estimated real start of hw vblank */
-                spin_unlock_irqrestore(&crtc->dev->event_lock, flags);
                 min_udelay = (-hpos + 1) * max(vblank->linedur_ns / 1000, 5);
+                if (min_udelay > vblank->framedur_ns / 2000) {
+                        /* Don't wait ridiculously long - something is wrong */
+                        repcnt = 0;
+                        break;
+                }
+                spin_unlock_irqrestore(&crtc->dev->event_lock, flags);
                 usleep_range(min_udelay, 2 * min_udelay);
                 spin_lock_irqsave(&crtc->dev->event_lock, flags);
         };
 
+        if (!repcnt)
+                DRM_DEBUG_DRIVER("Delay problem on crtc %d: min_udelay %d, "
+                                 "framedur %d, linedur %d, stat %d, vpos %d, "
+                                 "hpos %d\n", work->crtc_id, min_udelay,
+                                 vblank->framedur_ns / 1000,
+                                 vblank->linedur_ns / 1000, stat, vpos, hpos);
+
         /* do the flip (mmio) */
         radeon_page_flip(rdev, radeon_crtc->crtc_id, work->base);
 
diff --git a/drivers/gpu/drm/radeon/radeon_pm.c b/drivers/gpu/drm/radeon/radeon_pm.c
index 460c8f2989da..7a98823bacd1 100644
--- a/drivers/gpu/drm/radeon/radeon_pm.c
+++ b/drivers/gpu/drm/radeon/radeon_pm.c
@@ -276,8 +276,12 @@ static void radeon_pm_set_clocks(struct radeon_device *rdev)
         if (rdev->irq.installed) {
                 for (i = 0; i < rdev->num_crtc; i++) {
                         if (rdev->pm.active_crtcs & (1 << i)) {
-                                rdev->pm.req_vblank |= (1 << i);
-                                drm_vblank_get(rdev->ddev, i);
+                                /* This can fail if a modeset is in progress */
+                                if (drm_vblank_get(rdev->ddev, i) == 0)
+                                        rdev->pm.req_vblank |= (1 << i);
+                                else
+                                        DRM_DEBUG_DRIVER("crtc %d no vblank, can glitch\n",
+                                                         i);
                         }
                 }
         }
@@ -1078,10 +1082,6 @@ force:
         /* update displays */
         radeon_dpm_display_configuration_changed(rdev);
 
-        rdev->pm.dpm.current_active_crtcs = rdev->pm.dpm.new_active_crtcs;
-        rdev->pm.dpm.current_active_crtc_count = rdev->pm.dpm.new_active_crtc_count;
-        rdev->pm.dpm.single_display = single_display;
-
         /* wait for the rings to drain */
         for (i = 0; i < RADEON_NUM_RINGS; i++) {
                 struct radeon_ring *ring = &rdev->ring[i];
@@ -1097,6 +1097,10 @@ force:
 
         radeon_dpm_post_set_power_state(rdev);
 
+        rdev->pm.dpm.current_active_crtcs = rdev->pm.dpm.new_active_crtcs;
+        rdev->pm.dpm.current_active_crtc_count = rdev->pm.dpm.new_active_crtc_count;
+        rdev->pm.dpm.single_display = single_display;
+
         if (rdev->asic->dpm.force_performance_level) {
                 if (rdev->pm.dpm.thermal_active) {
                         enum radeon_dpm_forced_level level = rdev->pm.dpm.forced_level;
diff --git a/drivers/gpu/drm/radeon/radeon_sa.c b/drivers/gpu/drm/radeon/radeon_sa.c
index c507896aca45..197b157b73d0 100644
--- a/drivers/gpu/drm/radeon/radeon_sa.c
+++ b/drivers/gpu/drm/radeon/radeon_sa.c
@@ -349,8 +349,13 @@ int radeon_sa_bo_new(struct radeon_device *rdev,
                         /* see if we can skip over some allocations */
                 } while (radeon_sa_bo_next_hole(sa_manager, fences, tries));
 
+                for (i = 0; i < RADEON_NUM_RINGS; ++i)
+                        radeon_fence_ref(fences[i]);
+
                 spin_unlock(&sa_manager->wq.lock);
                 r = radeon_fence_wait_any(rdev, fences, false);
+                for (i = 0; i < RADEON_NUM_RINGS; ++i)
+                        radeon_fence_unref(&fences[i]);
                 spin_lock(&sa_manager->wq.lock);
                 /* if we have nothing to wait for block */
                 if (r == -ENOENT) {
diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c
index e34307459e50..e06ac546a90f 100644
--- a/drivers/gpu/drm/radeon/radeon_ttm.c
+++ b/drivers/gpu/drm/radeon/radeon_ttm.c
@@ -758,7 +758,7 @@ static int radeon_ttm_tt_populate(struct ttm_tt *ttm)
                                                        0, PAGE_SIZE,
                                                        PCI_DMA_BIDIRECTIONAL);
                 if (pci_dma_mapping_error(rdev->pdev, gtt->ttm.dma_address[i])) {
-                        while (--i) {
+                        while (i--) {
                                 pci_unmap_page(rdev->pdev, gtt->ttm.dma_address[i],
                                                PAGE_SIZE, PCI_DMA_BIDIRECTIONAL);
                                 gtt->ttm.dma_address[i] = 0;
diff --git a/drivers/gpu/drm/vc4/vc4_bo.c b/drivers/gpu/drm/vc4/vc4_bo.c
index 18dfe3ec9a62..22278bcfc60e 100644
--- a/drivers/gpu/drm/vc4/vc4_bo.c
+++ b/drivers/gpu/drm/vc4/vc4_bo.c
@@ -215,7 +215,7 @@ struct vc4_bo *vc4_bo_create(struct drm_device *dev, size_t unaligned_size,
         struct drm_gem_cma_object *cma_obj;
 
         if (size == 0)
-                return NULL;
+                return ERR_PTR(-EINVAL);
 
         /* First, try to get a vc4_bo from the kernel BO cache. */
         if (from_cache) {
@@ -237,7 +237,7 @@ struct vc4_bo *vc4_bo_create(struct drm_device *dev, size_t unaligned_size,
                 if (IS_ERR(cma_obj)) {
                         DRM_ERROR("Failed to allocate from CMA:\n");
                         vc4_bo_stats_dump(vc4);
-                        return NULL;
+                        return ERR_PTR(-ENOMEM);
                 }
         }
 
@@ -259,8 +259,8 @@ int vc4_dumb_create(struct drm_file *file_priv,
                 args->size = args->pitch * args->height;
 
         bo = vc4_bo_create(dev, args->size, false);
-        if (!bo)
-                return -ENOMEM;
+        if (IS_ERR(bo))
+                return PTR_ERR(bo);
 
         ret = drm_gem_handle_create(file_priv, &bo->base.base, &args->handle);
         drm_gem_object_unreference_unlocked(&bo->base.base);
@@ -443,8 +443,8 @@ int vc4_create_bo_ioctl(struct drm_device *dev, void *data,
          * get zeroed, and that might leak data between users.
          */
         bo = vc4_bo_create(dev, args->size, false);
-        if (!bo)
-                return -ENOMEM;
+        if (IS_ERR(bo))
+                return PTR_ERR(bo);
 
         ret = drm_gem_handle_create(file_priv, &bo->base.base, &args->handle);
         drm_gem_object_unreference_unlocked(&bo->base.base);
@@ -496,8 +496,8 @@ vc4_create_shader_bo_ioctl(struct drm_device *dev, void *data,
         }
 
         bo = vc4_bo_create(dev, args->size, true);
-        if (!bo)
-                return -ENOMEM;
+        if (IS_ERR(bo))
+                return PTR_ERR(bo);
 
         ret = copy_from_user(bo->base.vaddr,
                              (void __user *)(uintptr_t)args->data,
diff --git a/drivers/gpu/drm/vc4/vc4_drv.h b/drivers/gpu/drm/vc4/vc4_drv.h
index 3d1df6b1c4d3..f53fe6cd72be 100644
--- a/drivers/gpu/drm/vc4/vc4_drv.h
+++ b/drivers/gpu/drm/vc4/vc4_drv.h
@@ -91,8 +91,12 @@ struct vc4_dev {
         struct vc4_bo *overflow_mem;
         struct work_struct overflow_mem_work;
 
+        int power_refcount;
+
+        /* Mutex controlling the power refcount. */
+        struct mutex power_lock;
+
         struct {
-                uint32_t last_ct0ca, last_ct1ca;
                 struct timer_list timer;
                 struct work_struct reset_work;
         } hangcheck;
@@ -142,6 +146,7 @@ struct vc4_seqno_cb {
 };
 
 struct vc4_v3d {
+        struct vc4_dev *vc4;
         struct platform_device *pdev;
         void __iomem *regs;
 };
@@ -202,6 +207,11 @@ struct vc4_exec_info {
         /* Sequence number for this bin/render job. */
         uint64_t seqno;
 
+        /* Last current addresses the hardware was processing when the
+         * hangcheck timer checked on us.
+         */
+        uint32_t last_ct0ca, last_ct1ca;
+
         /* Kernel-space copy of the ioctl arguments */
         struct drm_vc4_submit_cl *args;
 
@@ -443,7 +453,6 @@ void vc4_plane_async_set_fb(struct drm_plane *plane,
 extern struct platform_driver vc4_v3d_driver;
 int vc4_v3d_debugfs_ident(struct seq_file *m, void *unused);
 int vc4_v3d_debugfs_regs(struct seq_file *m, void *unused);
-int vc4_v3d_set_power(struct vc4_dev *vc4, bool on);
 
 /* vc4_validate.c */
 int
diff --git a/drivers/gpu/drm/vc4/vc4_gem.c b/drivers/gpu/drm/vc4/vc4_gem.c
index 48ce30a6f4b5..202aa1544acc 100644
--- a/drivers/gpu/drm/vc4/vc4_gem.c
+++ b/drivers/gpu/drm/vc4/vc4_gem.c
@@ -23,6 +23,7 @@
 
 #include <linux/module.h>
 #include <linux/platform_device.h>
+#include <linux/pm_runtime.h>
 #include <linux/device.h>
 #include <linux/io.h>
 
@@ -228,8 +229,16 @@ vc4_reset(struct drm_device *dev)
         struct vc4_dev *vc4 = to_vc4_dev(dev);
 
         DRM_INFO("Resetting GPU.\n");
-        vc4_v3d_set_power(vc4, false);
-        vc4_v3d_set_power(vc4, true);
+
+        mutex_lock(&vc4->power_lock);
+        if (vc4->power_refcount) {
+                /* Power the device off and back on the by dropping the
+                 * reference on runtime PM.
+                 */
+                pm_runtime_put_sync_suspend(&vc4->v3d->pdev->dev);
+                pm_runtime_get_sync(&vc4->v3d->pdev->dev);
+        }
+        mutex_unlock(&vc4->power_lock);
 
         vc4_irq_reset(dev);
 
@@ -257,10 +266,17 @@ vc4_hangcheck_elapsed(unsigned long data)
         struct drm_device *dev = (struct drm_device *)data;
         struct vc4_dev *vc4 = to_vc4_dev(dev);
         uint32_t ct0ca, ct1ca;
+        unsigned long irqflags;
+        struct vc4_exec_info *exec;
+
+        spin_lock_irqsave(&vc4->job_lock, irqflags);
+        exec = vc4_first_job(vc4);
 
         /* If idle, we can stop watching for hangs. */
-        if (list_empty(&vc4->job_list))
+        if (!exec) {
+                spin_unlock_irqrestore(&vc4->job_lock, irqflags);
                 return;
+        }
 
         ct0ca = V3D_READ(V3D_CTNCA(0));
         ct1ca = V3D_READ(V3D_CTNCA(1));
@@ -268,14 +284,16 @@ vc4_hangcheck_elapsed(unsigned long data)
         /* If we've made any progress in execution, rearm the timer
          * and wait.
          */
-        if (ct0ca != vc4->hangcheck.last_ct0ca ||
-            ct1ca != vc4->hangcheck.last_ct1ca) {
-                vc4->hangcheck.last_ct0ca = ct0ca;
-                vc4->hangcheck.last_ct1ca = ct1ca;
+        if (ct0ca != exec->last_ct0ca || ct1ca != exec->last_ct1ca) {
+                exec->last_ct0ca = ct0ca;
+                exec->last_ct1ca = ct1ca;
+                spin_unlock_irqrestore(&vc4->job_lock, irqflags);
                 vc4_queue_hangcheck(dev);
                 return;
         }
 
+        spin_unlock_irqrestore(&vc4->job_lock, irqflags);
+
         /* We've gone too long with no progress, reset.  This has to
          * be done from a work struct, since resetting can sleep and
          * this timer hook isn't allowed to.
@@ -340,12 +358,7 @@ vc4_wait_for_seqno(struct drm_device *dev, uint64_t seqno, uint64_t timeout_ns,
         finish_wait(&vc4->job_wait_queue, &wait);
         trace_vc4_wait_for_seqno_end(dev, seqno);
 
-        if (ret && ret != -ERESTARTSYS) {
-                DRM_ERROR("timeout waiting for render thread idle\n");
-                return ret;
-        }
-
-        return 0;
+        return ret;
 }
 
 static void
@@ -578,9 +591,9 @@ vc4_get_bcl(struct drm_device *dev, struct vc4_exec_info *exec)
         }
 
         bo = vc4_bo_create(dev, exec_size, true);
-        if (!bo) {
+        if (IS_ERR(bo)) {
                 DRM_ERROR("Couldn't allocate BO for binning\n");
-                ret = -ENOMEM;
+                ret = PTR_ERR(bo);
                 goto fail;
         }
         exec->exec_bo = &bo->base;
@@ -617,6 +630,7 @@ fail:
 static void
 vc4_complete_exec(struct drm_device *dev, struct vc4_exec_info *exec)
 {
+        struct vc4_dev *vc4 = to_vc4_dev(dev);
         unsigned i;
 
         /* Need the struct lock for drm_gem_object_unreference(). */
@@ -635,6 +649,11 @@ vc4_complete_exec(struct drm_device *dev, struct vc4_exec_info *exec)
         }
         mutex_unlock(&dev->struct_mutex);
 
+        mutex_lock(&vc4->power_lock);
+        if (--vc4->power_refcount == 0)
+                pm_runtime_put(&vc4->v3d->pdev->dev);
+        mutex_unlock(&vc4->power_lock);
+
         kfree(exec);
 }
 
@@ -746,6 +765,9 @@ vc4_wait_bo_ioctl(struct drm_device *dev, void *data,
         struct drm_gem_object *gem_obj;
         struct vc4_bo *bo;
 
+        if (args->pad != 0)
+                return -EINVAL;
+
         gem_obj = drm_gem_object_lookup(dev, file_priv, args->handle);
         if (!gem_obj) {
                 DRM_ERROR("Failed to look up GEM BO %d\n", args->handle);
@@ -772,7 +794,7 @@ vc4_submit_cl_ioctl(struct drm_device *dev, void *data,
         struct vc4_dev *vc4 = to_vc4_dev(dev);
         struct drm_vc4_submit_cl *args = data;
         struct vc4_exec_info *exec;
-        int ret;
+        int ret = 0;
 
         if ((args->flags & ~VC4_SUBMIT_CL_USE_CLEAR_COLOR) != 0) {
                 DRM_ERROR("Unknown flags: 0x%02x\n", args->flags);
@@ -785,6 +807,15 @@ vc4_submit_cl_ioctl(struct drm_device *dev, void *data,
                 return -ENOMEM;
         }
 
+        mutex_lock(&vc4->power_lock);
+        if (vc4->power_refcount++ == 0)
+                ret = pm_runtime_get_sync(&vc4->v3d->pdev->dev);
+        mutex_unlock(&vc4->power_lock);
+        if (ret < 0) {
+                kfree(exec);
+                return ret;
+        }
+
         exec->args = args;
         INIT_LIST_HEAD(&exec->unref_list);
 
@@ -839,6 +870,8 @@ vc4_gem_init(struct drm_device *dev)
                     (unsigned long)dev);
 
         INIT_WORK(&vc4->job_done_work, vc4_job_done_work);
+
+        mutex_init(&vc4->power_lock);
 }
 
 void
diff --git a/drivers/gpu/drm/vc4/vc4_irq.c b/drivers/gpu/drm/vc4/vc4_irq.c
index b68060e758db..78a21357fb2d 100644
--- a/drivers/gpu/drm/vc4/vc4_irq.c
+++ b/drivers/gpu/drm/vc4/vc4_irq.c
@@ -57,7 +57,7 @@ vc4_overflow_mem_work(struct work_struct *work)
         struct vc4_bo *bo;
 
         bo = vc4_bo_create(dev, 256 * 1024, true);
-        if (!bo) {
+        if (IS_ERR(bo)) {
                 DRM_ERROR("Couldn't allocate binner overflow mem\n");
                 return;
         }
diff --git a/drivers/gpu/drm/vc4/vc4_render_cl.c b/drivers/gpu/drm/vc4/vc4_render_cl.c
index 8a2a312e2c1b..0f12418725e5 100644
--- a/drivers/gpu/drm/vc4/vc4_render_cl.c
+++ b/drivers/gpu/drm/vc4/vc4_render_cl.c
@@ -316,20 +316,11 @@ static int vc4_create_rcl_bo(struct drm_device *dev, struct vc4_exec_info *exec,
         size += xtiles * ytiles * loop_body_size;
 
         setup->rcl = &vc4_bo_create(dev, size, true)->base;
-        if (!setup->rcl)
-                return -ENOMEM;
+        if (IS_ERR(setup->rcl))
+                return PTR_ERR(setup->rcl);
         list_add_tail(&to_vc4_bo(&setup->rcl->base)->unref_head,
                       &exec->unref_list);
 
-        rcl_u8(setup, VC4_PACKET_TILE_RENDERING_MODE_CONFIG);
-        rcl_u32(setup,
-                (setup->color_write ? (setup->color_write->paddr +
-                                       args->color_write.offset) :
-                 0));
-        rcl_u16(setup, args->width);
-        rcl_u16(setup, args->height);
-        rcl_u16(setup, args->color_write.bits);
-
         /* The tile buffer gets cleared when the previous tile is stored.  If
          * the clear values changed between frames, then the tile buffer has
          * stale clear values in it, so we have to do a store in None mode (no
@@ -349,6 +340,15 @@ static int vc4_create_rcl_bo(struct drm_device *dev, struct vc4_exec_info *exec,
                 rcl_u32(setup, 0); /* no address, since we're in None mode */
         }
 
+        rcl_u8(setup, VC4_PACKET_TILE_RENDERING_MODE_CONFIG);
+        rcl_u32(setup,
+                (setup->color_write ? (setup->color_write->paddr +
+                                       args->color_write.offset) :
+                 0));
+        rcl_u16(setup, args->width);
+        rcl_u16(setup, args->height);
+        rcl_u16(setup, args->color_write.bits);
+
         for (y = min_y_tile; y <= max_y_tile; y++) {
                 for (x = min_x_tile; x <= max_x_tile; x++) {
                         bool first = (x == min_x_tile && y == min_y_tile);
diff --git a/drivers/gpu/drm/vc4/vc4_v3d.c b/drivers/gpu/drm/vc4/vc4_v3d.c
index 314ff71db978..31de5d17bc85 100644
--- a/drivers/gpu/drm/vc4/vc4_v3d.c
+++ b/drivers/gpu/drm/vc4/vc4_v3d.c
@@ -17,6 +17,7 @@
  */
 
 #include "linux/component.h"
+#include "linux/pm_runtime.h"
 #include "vc4_drv.h"
 #include "vc4_regs.h"
 
@@ -144,18 +145,6 @@ int vc4_v3d_debugfs_ident(struct seq_file *m, void *unused)
 }
 #endif /* CONFIG_DEBUG_FS */
 
-int
-vc4_v3d_set_power(struct vc4_dev *vc4, bool on)
-{
-        /* XXX: This interface is needed for GPU reset, and the way to
-         * do it is to turn our power domain off and back on.  We
-         * can't just reset from within the driver, because the reset
-         * bits are in the power domain's register area, and get set
-         * during the poweron process.
-         */
-        return 0;
-}
-
 static void vc4_v3d_init_hw(struct drm_device *dev)
 {
         struct vc4_dev *vc4 = to_vc4_dev(dev);
@@ -167,6 +156,29 @@ static void vc4_v3d_init_hw(struct drm_device *dev)
         V3D_WRITE(V3D_VPMBASE, 0);
 }
 
+#ifdef CONFIG_PM
+static int vc4_v3d_runtime_suspend(struct device *dev)
+{
+        struct vc4_v3d *v3d = dev_get_drvdata(dev);
+        struct vc4_dev *vc4 = v3d->vc4;
+
+        vc4_irq_uninstall(vc4->dev);
+
+        return 0;
+}
+
+static int vc4_v3d_runtime_resume(struct device *dev)
+{
+        struct vc4_v3d *v3d = dev_get_drvdata(dev);
+        struct vc4_dev *vc4 = v3d->vc4;
+
+        vc4_v3d_init_hw(vc4->dev);
+        vc4_irq_postinstall(vc4->dev);
+
+        return 0;
+}
+#endif
+
 static int vc4_v3d_bind(struct device *dev, struct device *master, void *data)
 {
         struct platform_device *pdev = to_platform_device(dev);
@@ -179,6 +191,8 @@ static int vc4_v3d_bind(struct device *dev, struct device *master, void *data)
         if (!v3d)
                 return -ENOMEM;
 
+        dev_set_drvdata(dev, v3d);
+
         v3d->pdev = pdev;
 
         v3d->regs = vc4_ioremap_regs(pdev, 0);
@@ -186,6 +200,7 @@ static int vc4_v3d_bind(struct device *dev, struct device *master, void *data)
                 return PTR_ERR(v3d->regs);
 
         vc4->v3d = v3d;
+        v3d->vc4 = vc4;
 
         if (V3D_READ(V3D_IDENT0) != V3D_EXPECTED_IDENT0) {
                 DRM_ERROR("V3D_IDENT0 read 0x%08x instead of 0x%08x\n",
@@ -207,6 +222,8 @@ static int vc4_v3d_bind(struct device *dev, struct device *master, void *data)
                 return ret;
         }
 
+        pm_runtime_enable(dev);
+
         return 0;
 }
 
@@ -216,6 +233,8 @@ static void vc4_v3d_unbind(struct device *dev, struct device *master,
         struct drm_device *drm = dev_get_drvdata(master);
         struct vc4_dev *vc4 = to_vc4_dev(drm);
 
+        pm_runtime_disable(dev);
+
         drm_irq_uninstall(drm);
 
         /* Disable the binner's overflow memory address, so the next
@@ -228,6 +247,10 @@ static void vc4_v3d_unbind(struct device *dev, struct device *master,
         vc4->v3d = NULL;
 }
 
+static const struct dev_pm_ops vc4_v3d_pm_ops = {
+        SET_RUNTIME_PM_OPS(vc4_v3d_runtime_suspend, vc4_v3d_runtime_resume, NULL)
+};
+
 static const struct component_ops vc4_v3d_ops = {
         .bind   = vc4_v3d_bind,
         .unbind = vc4_v3d_unbind,
@@ -255,5 +278,6 @@ struct platform_driver vc4_v3d_driver = {
         .driver = {
                 .name = "vc4_v3d",
                 .of_match_table = vc4_v3d_dt_match,
+                .pm = &vc4_v3d_pm_ops,
         },
 };
diff --git a/drivers/gpu/drm/vc4/vc4_validate.c b/drivers/gpu/drm/vc4/vc4_validate.c
index e26d9f6face3..24c2c746e8f3 100644
--- a/drivers/gpu/drm/vc4/vc4_validate.c
+++ b/drivers/gpu/drm/vc4/vc4_validate.c
@@ -401,8 +401,8 @@ validate_tile_binning_config(VALIDATE_ARGS)
         tile_bo = vc4_bo_create(dev, exec->tile_alloc_offset + tile_alloc_size,
                                 true);
         exec->tile_bo = &tile_bo->base;
-        if (!exec->tile_bo)
-                return -ENOMEM;
+        if (IS_ERR(exec->tile_bo))
+                return PTR_ERR(exec->tile_bo);
         list_add_tail(&tile_bo->unref_head, &exec->unref_list);
 
         /* tile alloc address. */
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c b/drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c
index db082bea8daf..c5a1a08b0449 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c
@@ -563,6 +563,8 @@ static void vmw_sou_connector_destroy(struct drm_connector *connector)
 
 static const struct drm_connector_funcs vmw_sou_connector_funcs = {
         .dpms = vmw_du_connector_dpms,
+        .detect = vmw_du_connector_detect,
+        .fill_modes = vmw_du_connector_fill_modes,
         .set_property = vmw_du_connector_set_property,
         .destroy = vmw_sou_connector_destroy,
 };
diff --git a/drivers/gpu/host1x/bus.c b/drivers/gpu/host1x/bus.c
index da462afcb225..dd2dbb9746ce 100644
--- a/drivers/gpu/host1x/bus.c
+++ b/drivers/gpu/host1x/bus.c
@@ -18,6 +18,7 @@
 #include <linux/host1x.h>
 #include <linux/of.h>
 #include <linux/slab.h>
+#include <linux/of_device.h>
 
 #include "bus.h"
 #include "dev.h"
@@ -394,6 +395,7 @@ static int host1x_device_add(struct host1x *host1x,
         device->dev.coherent_dma_mask = host1x->dev->coherent_dma_mask;
         device->dev.dma_mask = &device->dev.coherent_dma_mask;
         dev_set_name(&device->dev, "%s", driver->driver.name);
+        of_dma_configure(&device->dev, host1x->dev->of_node);
         device->dev.release = host1x_device_release;
         device->dev.bus = &host1x_bus_type;
         device->dev.parent = host1x->dev;
diff --git a/drivers/gpu/host1x/dev.c b/drivers/gpu/host1x/dev.c
index 314bf3718cc7..ff348690df94 100644
--- a/drivers/gpu/host1x/dev.c
+++ b/drivers/gpu/host1x/dev.c
@@ -23,6 +23,7 @@
 #include <linux/of_device.h>
 #include <linux/clk.h>
 #include <linux/io.h>
+#include <linux/dma-mapping.h>
 
 #define CREATE_TRACE_POINTS
 #include <trace/events/host1x.h>
@@ -68,6 +69,7 @@ static const struct host1x_info host1x01_info = {
         .nb_bases       = 8,
         .init           = host1x01_init,
         .sync_offset    = 0x3000,
+        .dma_mask       = DMA_BIT_MASK(32),
 };
 
 static const struct host1x_info host1x02_info = {
@@ -77,6 +79,7 @@ static const struct host1x_info host1x02_info = {
         .nb_bases = 12,
         .init = host1x02_init,
         .sync_offset = 0x3000,
+        .dma_mask = DMA_BIT_MASK(32),
 };
 
 static const struct host1x_info host1x04_info = {
@@ -86,6 +89,7 @@ static const struct host1x_info host1x04_info = {
         .nb_bases = 64,
         .init = host1x04_init,
         .sync_offset = 0x2100,
+        .dma_mask = DMA_BIT_MASK(34),
 };
 
 static const struct host1x_info host1x05_info = {
@@ -95,6 +99,7 @@ static const struct host1x_info host1x05_info = {
         .nb_bases = 64,
         .init = host1x05_init,
         .sync_offset = 0x2100,
+        .dma_mask = DMA_BIT_MASK(34),
 };
 
 static struct of_device_id host1x_of_match[] = {
@@ -148,6 +153,8 @@ static int host1x_probe(struct platform_device *pdev)
         if (IS_ERR(host->regs))
                 return PTR_ERR(host->regs);
 
+        dma_set_mask_and_coherent(host->dev, host->info->dma_mask);
+
         if (host->info->init) {
                 err = host->info->init(host);
                 if (err)
diff --git a/drivers/gpu/host1x/dev.h b/drivers/gpu/host1x/dev.h
index 0b6e8e9629c5..dace124994bb 100644
--- a/drivers/gpu/host1x/dev.h
+++ b/drivers/gpu/host1x/dev.h
@@ -96,6 +96,7 @@ struct host1x_info {
         int     nb_mlocks;              /* host1x: number of mlocks */
         int     (*init)(struct host1x *); /* initialize per SoC ops */
         int     sync_offset;
+        u64     dma_mask;               /* mask of addressable memory */
 };
 
 struct host1x {
diff --git a/drivers/gpu/ipu-v3/ipu-common.c b/drivers/gpu/ipu-v3/ipu-common.c
index f2e13eb8339f..e00db3f510dd 100644
--- a/drivers/gpu/ipu-v3/ipu-common.c
+++ b/drivers/gpu/ipu-v3/ipu-common.c
@@ -1050,6 +1050,17 @@ static int ipu_add_client_devices(struct ipu_soc *ipu, unsigned long ipu_base)
         for (i = 0; i < ARRAY_SIZE(client_reg); i++) {
                 const struct ipu_platform_reg *reg = &client_reg[i];
                 struct platform_device *pdev;
+                struct device_node *of_node;
+
+                /* Associate subdevice with the corresponding port node */
+                of_node = of_graph_get_port_by_id(dev->of_node, i);
+                if (!of_node) {
+                        dev_info(dev,
+                                 "no port@%d node in %s, not using %s%d\n",
+                                 i, dev->of_node->full_name,
+                                 (i / 2) ? "DI" : "CSI", i % 2);
+                        continue;
+                }
 
                 pdev = platform_device_alloc(reg->name, id++);
                 if (!pdev) {
@@ -1057,17 +1068,9 @@ static int ipu_add_client_devices(struct ipu_soc *ipu, unsigned long ipu_base)
                         goto err_register;
                 }
 
+                pdev->dev.of_node = of_node;
                 pdev->dev.parent = dev;
 
-                /* Associate subdevice with the corresponding port node */
-                pdev->dev.of_node = of_graph_get_port_by_id(dev->of_node, i);
-                if (!pdev->dev.of_node) {
-                        dev_err(dev, "missing port@%d node in %s\n", i,
-                                dev->of_node->full_name);
-                        ret = -ENODEV;
-                        goto err_register;
-                }
-
                 ret = platform_device_add_data(pdev, &reg->pdata,
                                                sizeof(reg->pdata));
                 if (!ret)
@@ -1289,10 +1292,6 @@ static int ipu_probe(struct platform_device *pdev)
         ipu->irq_sync = irq_sync;
         ipu->irq_err = irq_err;
 
-        ret = ipu_irq_init(ipu);
-        if (ret)
-                goto out_failed_irq;
-
         ret = device_reset(&pdev->dev);
         if (ret) {
                 dev_err(&pdev->dev, "failed to reset: %d\n", ret);
@@ -1302,6 +1301,10 @@ static int ipu_probe(struct platform_device *pdev)
         if (ret)
                 goto out_failed_reset;
 
+        ret = ipu_irq_init(ipu);
+        if (ret)
+                goto out_failed_irq;
+
         /* Set MCU_T to divide MCU access window into 2 */
         ipu_cm_write(ipu, 0x00400000L | (IPU_MCU_T_DEFAULT << 18),
                         IPU_DISP_GEN);
@@ -1324,9 +1327,9 @@ static int ipu_probe(struct platform_device *pdev)
 failed_add_clients:
         ipu_submodules_exit(ipu);
 failed_submodules_init:
-out_failed_reset:
         ipu_irq_exit(ipu);
 out_failed_irq:
+out_failed_reset:
         clk_disable_unprepare(ipu->clk);
         return ret;
 }
diff --git a/drivers/hwmon/ads1015.c b/drivers/hwmon/ads1015.c
index f155b8380481..2b3105c8aed3 100644
--- a/drivers/hwmon/ads1015.c
+++ b/drivers/hwmon/ads1015.c
@@ -126,7 +126,7 @@ static int ads1015_reg_to_mv(struct i2c_client *client, unsigned int channel,
         struct ads1015_data *data = i2c_get_clientdata(client);
         unsigned int pga = data->channel_data[channel].pga;
         int fullscale = fullscale_table[pga];
-        const unsigned mask = data->id == ads1115 ? 0x7fff : 0x7ff0;
+        const int mask = data->id == ads1115 ? 0x7fff : 0x7ff0;
 
         return DIV_ROUND_CLOSEST(reg * fullscale, mask);
 }
diff --git a/drivers/hwmon/gpio-fan.c b/drivers/hwmon/gpio-fan.c
index 82de3deeb18a..685568b1236d 100644
--- a/drivers/hwmon/gpio-fan.c
+++ b/drivers/hwmon/gpio-fan.c
@@ -406,16 +406,11 @@ static int gpio_fan_get_cur_state(struct thermal_cooling_device *cdev,
                                   unsigned long *state)
 {
         struct gpio_fan_data *fan_data = cdev->devdata;
-        int r;
 
         if (!fan_data)
                 return -EINVAL;
 
-        r = get_fan_speed_index(fan_data);
-        if (r < 0)
-                return r;
-
-        *state = r;
+        *state = fan_data->speed_index;
         return 0;
 }
 
diff --git a/drivers/i2c/busses/i2c-brcmstb.c b/drivers/i2c/busses/i2c-brcmstb.c
index 3711df1d4526..4a45408dd820 100644
--- a/drivers/i2c/busses/i2c-brcmstb.c
+++ b/drivers/i2c/busses/i2c-brcmstb.c
@@ -586,8 +586,7 @@ static int brcmstb_i2c_probe(struct platform_device *pdev)
         if (!dev)
                 return -ENOMEM;
 
-        dev->bsc_regmap = devm_kzalloc(&pdev->dev, sizeof(struct bsc_regs *),
-                                       GFP_KERNEL);
+        dev->bsc_regmap = devm_kzalloc(&pdev->dev, sizeof(*dev->bsc_regmap), GFP_KERNEL);
         if (!dev->bsc_regmap)
                 return -ENOMEM;
 
diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c
index f62d69799a9c..27fa0cb09538 100644
--- a/drivers/i2c/busses/i2c-i801.c
+++ b/drivers/i2c/busses/i2c-i801.c
@@ -1271,6 +1271,8 @@ static int i801_probe(struct pci_dev *dev, const struct pci_device_id *id)
         switch (dev->device) {
         case PCI_DEVICE_ID_INTEL_SUNRISEPOINT_H_SMBUS:
         case PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_SMBUS:
+        case PCI_DEVICE_ID_INTEL_LEWISBURG_SMBUS:
+        case PCI_DEVICE_ID_INTEL_LEWISBURG_SSKU_SMBUS:
         case PCI_DEVICE_ID_INTEL_DNV_SMBUS:
                 priv->features |= FEATURE_I2C_BLOCK_READ;
                 priv->features |= FEATURE_IRQ;
diff --git a/drivers/i2c/busses/i2c-omap.c b/drivers/i2c/busses/i2c-omap.c
index 08d26ba61ed3..13c45296ce5b 100644
--- a/drivers/i2c/busses/i2c-omap.c
+++ b/drivers/i2c/busses/i2c-omap.c
@@ -1450,7 +1450,8 @@ omap_i2c_probe(struct platform_device *pdev)
 
 err_unuse_clocks:
         omap_i2c_write_reg(omap, OMAP_I2C_CON_REG, 0);
-        pm_runtime_put(omap->dev);
+        pm_runtime_dont_use_autosuspend(omap->dev);
+        pm_runtime_put_sync(omap->dev);
         pm_runtime_disable(&pdev->dev);
 err_free_mem:
 
@@ -1468,6 +1469,7 @@ static int omap_i2c_remove(struct platform_device *pdev)
                 return ret;
 
         omap_i2c_write_reg(omap, OMAP_I2C_CON_REG, 0);
+        pm_runtime_dont_use_autosuspend(&pdev->dev);
         pm_runtime_put_sync(&pdev->dev);
         pm_runtime_disable(&pdev->dev);
         return 0;
diff --git a/drivers/i2c/busses/i2c-uniphier-f.c b/drivers/i2c/busses/i2c-uniphier-f.c
index f3e5ff8522f0..213ba55e17c3 100644
--- a/drivers/i2c/busses/i2c-uniphier-f.c
+++ b/drivers/i2c/busses/i2c-uniphier-f.c
@@ -467,7 +467,7 @@ static int uniphier_fi2c_clk_init(struct device *dev,
                 bus_speed = UNIPHIER_FI2C_DEFAULT_SPEED;
 
         if (!bus_speed) {
-                dev_err(dev, "clock-freqyency should not be zero\n");
+                dev_err(dev, "clock-frequency should not be zero\n");
                 return -EINVAL;
         }
 
diff --git a/drivers/i2c/busses/i2c-uniphier.c b/drivers/i2c/busses/i2c-uniphier.c
index 1f4f3f53819c..89eaa8a7e1e0 100644
--- a/drivers/i2c/busses/i2c-uniphier.c
+++ b/drivers/i2c/busses/i2c-uniphier.c
@@ -328,7 +328,7 @@ static int uniphier_i2c_clk_init(struct device *dev,
                 bus_speed = UNIPHIER_I2C_DEFAULT_SPEED;
 
         if (!bus_speed) {
-                dev_err(dev, "clock-freqyency should not be zero\n");
+                dev_err(dev, "clock-frequency should not be zero\n");
                 return -EINVAL;
         }
 
diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
index 00da80e02154..94b80a51ab68 100644
--- a/drivers/infiniband/core/device.c
+++ b/drivers/infiniband/core/device.c
@@ -358,6 +358,7 @@ int ib_register_device(struct ib_device *device,
         ret = device->query_device(device, &device->attrs, &uhw);
         if (ret) {
                 printk(KERN_WARNING "Couldn't query the device attributes\n");
+                ib_cache_cleanup_one(device);
                 goto out;
         }
 
diff --git a/drivers/infiniband/core/sa_query.c b/drivers/infiniband/core/sa_query.c
index f334090bb612..1e37f3515d98 100644
--- a/drivers/infiniband/core/sa_query.c
+++ b/drivers/infiniband/core/sa_query.c
@@ -1071,7 +1071,7 @@ int ib_init_ah_from_path(struct ib_device *device, u8 port_num,
                 }
         }
 
-        if (rec->hop_limit > 1 || use_roce) {
+        if (rec->hop_limit > 0 || use_roce) {
                 ah_attr->ah_flags = IB_AH_GRH;
                 ah_attr->grh.dgid = rec->dgid;
 
diff --git a/drivers/infiniband/core/sysfs.c b/drivers/infiniband/core/sysfs.c
index 3de93517efe4..14606afbfaa8 100644
--- a/drivers/infiniband/core/sysfs.c
+++ b/drivers/infiniband/core/sysfs.c
@@ -336,7 +336,6 @@ static ssize_t _show_port_gid_attr(struct ib_port *p,
         union ib_gid gid;
         struct ib_gid_attr gid_attr = {};
         ssize_t ret;
-        va_list args;
 
         ret = ib_query_gid(p->ibdev, p->port_num, tab_attr->index, &gid,
                            &gid_attr);
@@ -348,7 +347,6 @@ static ssize_t _show_port_gid_attr(struct ib_port *p,
 err:
         if (gid_attr.ndev)
                 dev_put(gid_attr.ndev);
-        va_end(args);
         return ret;
 }
 
@@ -722,12 +720,11 @@ static struct attribute_group *get_counter_table(struct ib_device *dev,
 
         if (get_perf_mad(dev, port_num, IB_PMA_CLASS_PORT_INFO,
                                 &cpi, 40, sizeof(cpi)) >= 0) {
-
-                if (cpi.capability_mask && IB_PMA_CLASS_CAP_EXT_WIDTH)
+                if (cpi.capability_mask & IB_PMA_CLASS_CAP_EXT_WIDTH)
                         /* We have extended counters */
                         return &pma_group_ext;
 
-                if (cpi.capability_mask && IB_PMA_CLASS_CAP_EXT_WIDTH_NOIETF)
+                if (cpi.capability_mask & IB_PMA_CLASS_CAP_EXT_WIDTH_NOIETF)
                         /* But not the IETF ones */
                         return &pma_group_noietf;
         }
diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
index 6ffc9c4e93af..6c6fbff19752 100644
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -1970,7 +1970,8 @@ ssize_t ib_uverbs_create_qp(struct ib_uverbs_file *file,
                    resp_size);
         INIT_UDATA(&uhw, buf + sizeof(cmd),
                    (unsigned long)cmd.response + resp_size,
-                   in_len - sizeof(cmd), out_len - resp_size);
+                   in_len - sizeof(cmd) - sizeof(struct ib_uverbs_cmd_hdr),
+                   out_len - resp_size);
 
         memset(&cmd_ex, 0, sizeof(cmd_ex));
         cmd_ex.user_handle = cmd.user_handle;
@@ -3413,7 +3414,8 @@ ssize_t ib_uverbs_create_srq(struct ib_uverbs_file *file,
 
         INIT_UDATA(&udata, buf + sizeof cmd,
                    (unsigned long) cmd.response + sizeof resp,
-                   in_len - sizeof cmd, out_len - sizeof resp);
+                   in_len - sizeof cmd - sizeof(struct ib_uverbs_cmd_hdr),
+                   out_len - sizeof resp);
 
         ret = __uverbs_create_xsrq(file, ib_dev, &xcmd, &udata);
         if (ret)
@@ -3439,7 +3441,8 @@ ssize_t ib_uverbs_create_xsrq(struct ib_uverbs_file *file,
 
         INIT_UDATA(&udata, buf + sizeof cmd,
                    (unsigned long) cmd.response + sizeof resp,
-                   in_len - sizeof cmd, out_len - sizeof resp);
+                   in_len - sizeof cmd - sizeof(struct ib_uverbs_cmd_hdr),
+                   out_len - sizeof resp);
 
         ret = __uverbs_create_xsrq(file, ib_dev, &cmd, &udata);
         if (ret)
diff --git a/drivers/infiniband/hw/mlx4/mad.c b/drivers/infiniband/hw/mlx4/mad.c
index 26833bfa639b..d68f506c1922 100644
--- a/drivers/infiniband/hw/mlx4/mad.c
+++ b/drivers/infiniband/hw/mlx4/mad.c
@@ -817,17 +817,48 @@ static int ib_process_mad(struct ib_device *ibdev, int mad_flags, u8 port_num,
         return IB_MAD_RESULT_SUCCESS | IB_MAD_RESULT_REPLY;
 }
 
-static void edit_counter(struct mlx4_counter *cnt,
-                                        struct ib_pma_portcounters *pma_cnt)
+static void edit_counter(struct mlx4_counter *cnt, void *counters,
+                         __be16 attr_id)
 {
-        ASSIGN_32BIT_COUNTER(pma_cnt->port_xmit_data,
-                             (be64_to_cpu(cnt->tx_bytes) >> 2));
-        ASSIGN_32BIT_COUNTER(pma_cnt->port_rcv_data,
-                             (be64_to_cpu(cnt->rx_bytes) >> 2));
-        ASSIGN_32BIT_COUNTER(pma_cnt->port_xmit_packets,
-                             be64_to_cpu(cnt->tx_frames));
-        ASSIGN_32BIT_COUNTER(pma_cnt->port_rcv_packets,
-                             be64_to_cpu(cnt->rx_frames));
+        switch (attr_id) {
+        case IB_PMA_PORT_COUNTERS:
+        {
+                struct ib_pma_portcounters *pma_cnt =
+                        (struct ib_pma_portcounters *)counters;
+
+                ASSIGN_32BIT_COUNTER(pma_cnt->port_xmit_data,
+                                     (be64_to_cpu(cnt->tx_bytes) >> 2));
+                ASSIGN_32BIT_COUNTER(pma_cnt->port_rcv_data,
+                                     (be64_to_cpu(cnt->rx_bytes) >> 2));
+                ASSIGN_32BIT_COUNTER(pma_cnt->port_xmit_packets,
+                                     be64_to_cpu(cnt->tx_frames));
+                ASSIGN_32BIT_COUNTER(pma_cnt->port_rcv_packets,
+                                     be64_to_cpu(cnt->rx_frames));
+                break;
+        }
+        case IB_PMA_PORT_COUNTERS_EXT:
+        {
+                struct ib_pma_portcounters_ext *pma_cnt_ext =
+                        (struct ib_pma_portcounters_ext *)counters;
+
+                pma_cnt_ext->port_xmit_data =
+                        cpu_to_be64(be64_to_cpu(cnt->tx_bytes) >> 2);
+                pma_cnt_ext->port_rcv_data =
+                        cpu_to_be64(be64_to_cpu(cnt->rx_bytes) >> 2);
+                pma_cnt_ext->port_xmit_packets = cnt->tx_frames;
+                pma_cnt_ext->port_rcv_packets = cnt->rx_frames;
+                break;
+        }
+        }
+}
+
+static int iboe_process_mad_port_info(void *out_mad)
+{
+        struct ib_class_port_info cpi = {};
+
+        cpi.capability_mask = IB_PMA_CLASS_CAP_EXT_WIDTH;
+        memcpy(out_mad, &cpi, sizeof(cpi));
+        return IB_MAD_RESULT_SUCCESS | IB_MAD_RESULT_REPLY;
 }
 
 static int iboe_process_mad(struct ib_device *ibdev, int mad_flags, u8 port_num,
@@ -842,6 +873,9 @@ static int iboe_process_mad(struct ib_device *ibdev, int mad_flags, u8 port_num,
         if (in_mad->mad_hdr.mgmt_class != IB_MGMT_CLASS_PERF_MGMT)
                 return -EINVAL;
 
+        if (in_mad->mad_hdr.attr_id == IB_PMA_CLASS_PORT_INFO)
+                return iboe_process_mad_port_info((void *)(out_mad->data + 40));
+
         memset(&counter_stats, 0, sizeof(counter_stats));
         mutex_lock(&dev->counters_table[port_num - 1].mutex);
         list_for_each_entry(tmp_counter,
@@ -863,7 +897,8 @@ static int iboe_process_mad(struct ib_device *ibdev, int mad_flags, u8 port_num,
                 switch (counter_stats.counter_mode & 0xf) {
                 case 0:
                         edit_counter(&counter_stats,
-                                     (void *)(out_mad->data + 40));
+                                     (void *)(out_mad->data + 40),
+                                     in_mad->mad_hdr.attr_id);
                         err = IB_MAD_RESULT_SUCCESS | IB_MAD_RESULT_REPLY;
                         break;
                 default:
@@ -894,8 +929,10 @@ int mlx4_ib_process_mad(struct ib_device *ibdev, int mad_flags, u8 port_num,
          */
         if (link == IB_LINK_LAYER_INFINIBAND) {
                 if (mlx4_is_slave(dev->dev) &&
-                    in_mad->mad_hdr.mgmt_class == IB_MGMT_CLASS_PERF_MGMT &&
-                    in_mad->mad_hdr.attr_id == IB_PMA_PORT_COUNTERS)
+                    (in_mad->mad_hdr.mgmt_class == IB_MGMT_CLASS_PERF_MGMT &&
+                     (in_mad->mad_hdr.attr_id == IB_PMA_PORT_COUNTERS ||
+                      in_mad->mad_hdr.attr_id == IB_PMA_PORT_COUNTERS_EXT ||
+                      in_mad->mad_hdr.attr_id == IB_PMA_CLASS_PORT_INFO)))
                         return iboe_process_mad(ibdev, mad_flags, port_num, in_wc,
                                                 in_grh, in_mad, out_mad);
 
diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c
index bc5536f00b6c..fd97534762b8 100644
--- a/drivers/infiniband/hw/mlx4/qp.c
+++ b/drivers/infiniband/hw/mlx4/qp.c
@@ -1681,9 +1681,12 @@ static int __mlx4_ib_modify_qp(struct ib_qp *ibqp,
         }
 
         if (qp->ibqp.uobject)
-                context->usr_page = cpu_to_be32(to_mucontext(ibqp->uobject->context)->uar.index);
+                context->usr_page = cpu_to_be32(
+                        mlx4_to_hw_uar_index(dev->dev,
+                                             to_mucontext(ibqp->uobject->context)->uar.index));
         else
-                context->usr_page = cpu_to_be32(dev->priv_uar.index);
+                context->usr_page = cpu_to_be32(
+                        mlx4_to_hw_uar_index(dev->dev, dev->priv_uar.index));
 
         if (attr_mask & IB_QP_DEST_QPN)
                 context->remote_qpn = cpu_to_be32(attr->dest_qp_num);
diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
index 9116bc3988a6..34cb8e87c7b8 100644
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -270,8 +270,10 @@ static int sq_overhead(enum ib_qp_type qp_type)
                 /* fall through */
         case IB_QPT_RC:
                 size += sizeof(struct mlx5_wqe_ctrl_seg) +
-                        sizeof(struct mlx5_wqe_atomic_seg) +
-                        sizeof(struct mlx5_wqe_raddr_seg);
+                        max(sizeof(struct mlx5_wqe_atomic_seg) +
+                            sizeof(struct mlx5_wqe_raddr_seg),
+                            sizeof(struct mlx5_wqe_umr_ctrl_seg) +
+                            sizeof(struct mlx5_mkey_seg));
                 break;
 
         case IB_QPT_XRC_TGT:
@@ -279,9 +281,9 @@ static int sq_overhead(enum ib_qp_type qp_type)
 
         case IB_QPT_UC:
                 size += sizeof(struct mlx5_wqe_ctrl_seg) +
-                        sizeof(struct mlx5_wqe_raddr_seg) +
-                        sizeof(struct mlx5_wqe_umr_ctrl_seg) +
-                        sizeof(struct mlx5_mkey_seg);
+                        max(sizeof(struct mlx5_wqe_raddr_seg),
+                            sizeof(struct mlx5_wqe_umr_ctrl_seg) +
+                            sizeof(struct mlx5_mkey_seg));
                 break;
 
         case IB_QPT_UD:
diff --git a/drivers/infiniband/hw/mlx5/srq.c b/drivers/infiniband/hw/mlx5/srq.c
index 4659256cd95e..3b2ddd64a371 100644
--- a/drivers/infiniband/hw/mlx5/srq.c
+++ b/drivers/infiniband/hw/mlx5/srq.c
@@ -75,7 +75,8 @@ static void mlx5_ib_srq_event(struct mlx5_core_srq *srq, enum mlx5_event type)
 
 static int create_srq_user(struct ib_pd *pd, struct mlx5_ib_srq *srq,
                            struct mlx5_create_srq_mbox_in **in,
-                           struct ib_udata *udata, int buf_size, int *inlen)
+                           struct ib_udata *udata, int buf_size, int *inlen,
+                           int is_xrc)
 {
         struct mlx5_ib_dev *dev = to_mdev(pd->device);
         struct mlx5_ib_create_srq ucmd = {};
@@ -87,13 +88,8 @@ static int create_srq_user(struct ib_pd *pd, struct mlx5_ib_srq *srq,
         int ncont;
         u32 offset;
         u32 uidx = MLX5_IB_DEFAULT_UIDX;
-        int drv_data = udata->inlen - sizeof(struct ib_uverbs_cmd_hdr);
 
-        if (drv_data < 0)
-                return -EINVAL;
-
-        ucmdlen = (drv_data < sizeof(ucmd)) ?
-                  drv_data : sizeof(ucmd);
+        ucmdlen = min(udata->inlen, sizeof(ucmd));
 
         if (ib_copy_from_udata(&ucmd, udata, ucmdlen)) {
                 mlx5_ib_dbg(dev, "failed copy udata\n");
@@ -103,15 +99,17 @@ static int create_srq_user(struct ib_pd *pd, struct mlx5_ib_srq *srq,
         if (ucmd.reserved0 || ucmd.reserved1)
                 return -EINVAL;
 
-        if (drv_data > sizeof(ucmd) &&
+        if (udata->inlen > sizeof(ucmd) &&
             !ib_is_udata_cleared(udata, sizeof(ucmd),
-                                 drv_data - sizeof(ucmd)))
+                                 udata->inlen - sizeof(ucmd)))
                 return -EINVAL;
 
-        err = get_srq_user_index(to_mucontext(pd->uobject->context),
-                                 &ucmd, udata->inlen, &uidx);
-        if (err)
-                return err;
+        if (is_xrc) {
+                err = get_srq_user_index(to_mucontext(pd->uobject->context),
+                                         &ucmd, udata->inlen, &uidx);
+                if (err)
+                        return err;
+        }
 
         srq->wq_sig = !!(ucmd.flags & MLX5_SRQ_FLAG_SIGNATURE);
 
@@ -151,7 +149,8 @@ static int create_srq_user(struct ib_pd *pd, struct mlx5_ib_srq *srq,
         (*in)->ctx.log_pg_sz = page_shift - MLX5_ADAPTER_PAGE_SHIFT;
         (*in)->ctx.pgoff_cqn = cpu_to_be32(offset << 26);
 
-        if (MLX5_CAP_GEN(dev->mdev, cqe_version) == MLX5_CQE_VERSION_V1) {
+        if ((MLX5_CAP_GEN(dev->mdev, cqe_version) == MLX5_CQE_VERSION_V1) &&
+             is_xrc){
                 xsrqc = MLX5_ADDR_OF(create_xrc_srq_in, *in,
                                      xrc_srq_context_entry);
                 MLX5_SET(xrc_srqc, xsrqc, user_index, uidx);
@@ -170,7 +169,7 @@ err_umem:
 
 static int create_srq_kernel(struct mlx5_ib_dev *dev, struct mlx5_ib_srq *srq,
                              struct mlx5_create_srq_mbox_in **in, int buf_size,
-                             int *inlen)
+                             int *inlen, int is_xrc)
 {
         int err;
         int i;
@@ -224,7 +223,8 @@ static int create_srq_kernel(struct mlx5_ib_dev *dev, struct mlx5_ib_srq *srq,
 
         (*in)->ctx.log_pg_sz = page_shift - MLX5_ADAPTER_PAGE_SHIFT;
 
-        if (MLX5_CAP_GEN(dev->mdev, cqe_version) == MLX5_CQE_VERSION_V1) {
+        if ((MLX5_CAP_GEN(dev->mdev, cqe_version) == MLX5_CQE_VERSION_V1) &&
+             is_xrc){
                 xsrqc = MLX5_ADDR_OF(create_xrc_srq_in, *in,
                                      xrc_srq_context_entry);
                 /* 0xffffff means we ask to work with cqe version 0 */
@@ -302,10 +302,14 @@ struct ib_srq *mlx5_ib_create_srq(struct ib_pd *pd,
                     desc_size, init_attr->attr.max_wr, srq->msrq.max, srq->msrq.max_gs,
                     srq->msrq.max_avail_gather);
 
+        is_xrc = (init_attr->srq_type == IB_SRQT_XRC);
+
         if (pd->uobject)
-                err = create_srq_user(pd, srq, &in, udata, buf_size, &inlen);
+                err = create_srq_user(pd, srq, &in, udata, buf_size, &inlen,
+                                      is_xrc);
         else
-                err = create_srq_kernel(dev, srq, &in, buf_size, &inlen);
+                err = create_srq_kernel(dev, srq, &in, buf_size, &inlen,
+                                        is_xrc);
 
         if (err) {
                 mlx5_ib_warn(dev, "create srq %s failed, err %d\n",
@@ -313,7 +317,6 @@ struct ib_srq *mlx5_ib_create_srq(struct ib_pd *pd,
                 goto err_srq;
         }
 
-        is_xrc = (init_attr->srq_type == IB_SRQT_XRC);
         in->ctx.state_log_sz = ilog2(srq->msrq.max);
         flgs = ((srq->msrq.wqe_shift - 4) | (is_xrc << 5) | (srq->wq_sig << 7)) << 24;
         xrcdn = 0;
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma.h b/drivers/infiniband/hw/ocrdma/ocrdma.h
index 040bb8b5cb15..12503f15fbd6 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma.h
+++ b/drivers/infiniband/hw/ocrdma/ocrdma.h
@@ -323,9 +323,6 @@ struct ocrdma_cq {
                          */
         u32 max_hw_cqe;
         bool phase_change;
-        bool deferred_arm, deferred_sol;
-        bool first_arm;
-
         spinlock_t cq_lock ____cacheline_aligned; /* provide synchronization
                                                    * to cq polling
                                                    */
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_main.c b/drivers/infiniband/hw/ocrdma/ocrdma_main.c
index 573849354cb9..f38743018cb4 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_main.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_main.c
@@ -228,6 +228,11 @@ static int ocrdma_alloc_resources(struct ocrdma_dev *dev)
 
         ocrdma_alloc_pd_pool(dev);
 
+        if (!ocrdma_alloc_stats_resources(dev)) {
+                pr_err("%s: stats resource allocation failed\n", __func__);
+                goto alloc_err;
+        }
+
         spin_lock_init(&dev->av_tbl.lock);
         spin_lock_init(&dev->flush_q_lock);
         return 0;
@@ -238,6 +243,7 @@ alloc_err:
 
 static void ocrdma_free_resources(struct ocrdma_dev *dev)
 {
+        ocrdma_release_stats_resources(dev);
         kfree(dev->stag_arr);
         kfree(dev->qp_tbl);
         kfree(dev->cq_tbl);
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_stats.c b/drivers/infiniband/hw/ocrdma/ocrdma_stats.c
index 86c303a620c1..255f774080a4 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_stats.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_stats.c
@@ -64,10 +64,11 @@ static int ocrdma_add_stat(char *start, char *pcur,
         return cpy_len;
 }
 
-static bool ocrdma_alloc_stats_mem(struct ocrdma_dev *dev)
+bool ocrdma_alloc_stats_resources(struct ocrdma_dev *dev)
 {
         struct stats_mem *mem = &dev->stats_mem;
 
+        mutex_init(&dev->stats_lock);
         /* Alloc mbox command mem*/
         mem->size = max_t(u32, sizeof(struct ocrdma_rdma_stats_req),
                         sizeof(struct ocrdma_rdma_stats_resp));
@@ -91,13 +92,14 @@ static bool ocrdma_alloc_stats_mem(struct ocrdma_dev *dev)
         return true;
 }
 
-static void ocrdma_release_stats_mem(struct ocrdma_dev *dev)
+void ocrdma_release_stats_resources(struct ocrdma_dev *dev)
 {
         struct stats_mem *mem = &dev->stats_mem;
 
         if (mem->va)
                 dma_free_coherent(&dev->nic_info.pdev->dev, mem->size,
                                   mem->va, mem->pa);
+        mem->va = NULL;
         kfree(mem->debugfs_mem);
 }
 
@@ -838,15 +840,9 @@ void ocrdma_add_port_stats(struct ocrdma_dev *dev)
                                 &dev->reset_stats, &ocrdma_dbg_ops))
                 goto err;
 
-        /* Now create dma_mem for stats mbx command */
-        if (!ocrdma_alloc_stats_mem(dev))
-                goto err;
-
-        mutex_init(&dev->stats_lock);
 
         return;
 err:
-        ocrdma_release_stats_mem(dev);
         debugfs_remove_recursive(dev->dir);
         dev->dir = NULL;
 }
@@ -855,9 +851,7 @@ void ocrdma_rem_port_stats(struct ocrdma_dev *dev)
 {
         if (!dev->dir)
                 return;
-        debugfs_remove(dev->dir);
-        mutex_destroy(&dev->stats_lock);
-        ocrdma_release_stats_mem(dev);
+        debugfs_remove_recursive(dev->dir);
 }
 
 void ocrdma_init_debugfs(void)
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_stats.h b/drivers/infiniband/hw/ocrdma/ocrdma_stats.h
index c9e58d04c7b8..bba1fec4f11f 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_stats.h
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_stats.h
@@ -65,6 +65,8 @@ enum OCRDMA_STATS_TYPE {
 
 void ocrdma_rem_debugfs(void);
 void ocrdma_init_debugfs(void);
+bool ocrdma_alloc_stats_resources(struct ocrdma_dev *dev);
+void ocrdma_release_stats_resources(struct ocrdma_dev *dev);
 void ocrdma_rem_port_stats(struct ocrdma_dev *dev);
 void ocrdma_add_port_stats(struct ocrdma_dev *dev);
 int ocrdma_pma_counters(struct ocrdma_dev *dev,
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
index d4c687b548d8..12420e4ecf3d 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
@@ -125,8 +125,8 @@ int ocrdma_query_device(struct ib_device *ibdev, struct ib_device_attr *attr,
                                         IB_DEVICE_SYS_IMAGE_GUID |
                                         IB_DEVICE_LOCAL_DMA_LKEY |
                                         IB_DEVICE_MEM_MGT_EXTENSIONS;
-        attr->max_sge = min(dev->attr.max_send_sge, dev->attr.max_srq_sge);
-        attr->max_sge_rd = 0;
+        attr->max_sge = dev->attr.max_send_sge;
+        attr->max_sge_rd = attr->max_sge;
         attr->max_cq = dev->attr.max_cq;
         attr->max_cqe = dev->attr.max_cqe;
         attr->max_mr = dev->attr.max_mr;
@@ -1094,7 +1094,6 @@ struct ib_cq *ocrdma_create_cq(struct ib_device *ibdev,
         spin_lock_init(&cq->comp_handler_lock);
         INIT_LIST_HEAD(&cq->sq_head);
         INIT_LIST_HEAD(&cq->rq_head);
-        cq->first_arm = true;
 
         if (ib_ctx) {
                 uctx = get_ocrdma_ucontext(ib_ctx);
@@ -2726,8 +2725,7 @@ static int ocrdma_update_ud_rcqe(struct ib_wc *ibwc, struct ocrdma_cqe *cqe)
                 OCRDMA_CQE_UD_STATUS_MASK) >> OCRDMA_CQE_UD_STATUS_SHIFT;
         ibwc->src_qp = le32_to_cpu(cqe->flags_status_srcqpn) &
                                                 OCRDMA_CQE_SRCQP_MASK;
-        ibwc->pkey_index = le32_to_cpu(cqe->ud.rxlen_pkey) &
-                                                OCRDMA_CQE_PKEY_MASK;
+        ibwc->pkey_index = 0;
         ibwc->wc_flags = IB_WC_GRH;
         ibwc->byte_len = (le32_to_cpu(cqe->ud.rxlen_pkey) >>
                                         OCRDMA_CQE_UD_XFER_LEN_SHIFT);
@@ -2911,12 +2909,9 @@ expand_cqe:
         }
 stop_cqe:
         cq->getp = cur_getp;
-        if (cq->deferred_arm || polled_hw_cqes) {
-                ocrdma_ring_cq_db(dev, cq->id, cq->deferred_arm,
-                                  cq->deferred_sol, polled_hw_cqes);
-                cq->deferred_arm = false;
-                cq->deferred_sol = false;
-        }
+
+        if (polled_hw_cqes)
+                ocrdma_ring_cq_db(dev, cq->id, false, false, polled_hw_cqes);
 
         return i;
 }
@@ -3000,13 +2995,7 @@ int ocrdma_arm_cq(struct ib_cq *ibcq, enum ib_cq_notify_flags cq_flags)
         if (cq_flags & IB_CQ_SOLICITED)
                 sol_needed = true;
 
-        if (cq->first_arm) {
-                ocrdma_ring_cq_db(dev, cq_id, arm_needed, sol_needed, 0);
-                cq->first_arm = false;
-        }
-
-        cq->deferred_arm = true;
-        cq->deferred_sol = sol_needed;
+        ocrdma_ring_cq_db(dev, cq_id, arm_needed, sol_needed, 0);
         spin_unlock_irqrestore(&cq->cq_lock, flags);
 
         return 0;
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
index 5ea0c14070d1..fa9c42ff1fb0 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
@@ -245,8 +245,6 @@ static void ipoib_ib_handle_rx_wc(struct net_device *dev, struct ib_wc *wc)
         skb_reset_mac_header(skb);
         skb_pull(skb, IPOIB_ENCAP_LEN);
 
-        skb->truesize = SKB_TRUESIZE(skb->len);
-
         ++dev->stats.rx_packets;
         dev->stats.rx_bytes += skb->len;
 
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
index 050dfa175d16..25889311b1e9 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
@@ -456,7 +456,10 @@ out_locked:
         return status;
 }
 
-static void ipoib_mcast_join(struct net_device *dev, struct ipoib_mcast *mcast)
+/*
+ * Caller must hold 'priv->lock'
+ */
+static int ipoib_mcast_join(struct net_device *dev, struct ipoib_mcast *mcast)
 {
         struct ipoib_dev_priv *priv = netdev_priv(dev);
         struct ib_sa_multicast *multicast;
@@ -466,6 +469,10 @@ static void ipoib_mcast_join(struct net_device *dev, struct ipoib_mcast *mcast)
         ib_sa_comp_mask comp_mask;
         int ret = 0;
 
+        if (!priv->broadcast ||
+            !test_bit(IPOIB_FLAG_OPER_UP, &priv->flags))
+                return -EINVAL;
+
         ipoib_dbg_mcast(priv, "joining MGID %pI6\n", mcast->mcmember.mgid.raw);
 
         rec.mgid     = mcast->mcmember.mgid;
@@ -525,20 +532,23 @@ static void ipoib_mcast_join(struct net_device *dev, struct ipoib_mcast *mcast)
                         rec.join_state = 4;
 #endif
         }
+        spin_unlock_irq(&priv->lock);
 
         multicast = ib_sa_join_multicast(&ipoib_sa_client, priv->ca, priv->port,
                                          &rec, comp_mask, GFP_KERNEL,
                                          ipoib_mcast_join_complete, mcast);
+        spin_lock_irq(&priv->lock);
         if (IS_ERR(multicast)) {
                 ret = PTR_ERR(multicast);
                 ipoib_warn(priv, "ib_sa_join_multicast failed, status %d\n", ret);
-                spin_lock_irq(&priv->lock);
                 /* Requeue this join task with a backoff delay */
                 __ipoib_mcast_schedule_join_thread(priv, mcast, 1);
                 clear_bit(IPOIB_MCAST_FLAG_BUSY, &mcast->flags);
                 spin_unlock_irq(&priv->lock);
                 complete(&mcast->done);
+                spin_lock_irq(&priv->lock);
         }
+        return 0;
 }
 
 void ipoib_mcast_join_task(struct work_struct *work)
@@ -620,9 +630,10 @@ void ipoib_mcast_join_task(struct work_struct *work)
                                 /* Found the next unjoined group */
                                 init_completion(&mcast->done);
                                 set_bit(IPOIB_MCAST_FLAG_BUSY, &mcast->flags);
-                                spin_unlock_irq(&priv->lock);
-                                ipoib_mcast_join(dev, mcast);
-                                spin_lock_irq(&priv->lock);
+                                if (ipoib_mcast_join(dev, mcast)) {
+                                        spin_unlock_irq(&priv->lock);
+                                        return;
+                                }
                         } else if (!delay_until ||
                                  time_before(mcast->delay_until, delay_until))
                                 delay_until = mcast->delay_until;
@@ -641,10 +652,9 @@ out:
         if (mcast) {
                 init_completion(&mcast->done);
                 set_bit(IPOIB_MCAST_FLAG_BUSY, &mcast->flags);
+                ipoib_mcast_join(dev, mcast);
         }
         spin_unlock_irq(&priv->lock);
-        if (mcast)
-                ipoib_mcast_join(dev, mcast);
 }
 
 int ipoib_mcast_start_thread(struct net_device *dev)
diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
index 6727954ab74b..e8a84d12b7ff 100644
--- a/drivers/input/joystick/xpad.c
+++ b/drivers/input/joystick/xpad.c
@@ -1207,7 +1207,6 @@ static void xpad_led_disconnect(struct usb_xpad *xpad)
 #else
 static int xpad_led_probe(struct usb_xpad *xpad) { return 0; }
 static void xpad_led_disconnect(struct usb_xpad *xpad) { }
-static void xpad_identify_controller(struct usb_xpad *xpad) { }
 #endif
 
 static int xpad_start_input(struct usb_xpad *xpad)
diff --git a/drivers/input/keyboard/adp5589-keys.c b/drivers/input/keyboard/adp5589-keys.c
index 4d446d5085aa..c01a1d648f9f 100644
--- a/drivers/input/keyboard/adp5589-keys.c
+++ b/drivers/input/keyboard/adp5589-keys.c
@@ -235,7 +235,7 @@ struct adp5589_kpad {
         unsigned short gpimapsize;
         unsigned extend_cfg;
         bool is_adp5585;
-        bool adp5585_support_row5;
+        bool support_row5;
 #ifdef CONFIG_GPIOLIB
         unsigned char gpiomap[ADP5589_MAXGPIO];
         bool export_gpio;
@@ -485,7 +485,7 @@ static int adp5589_build_gpiomap(struct adp5589_kpad *kpad,
         if (kpad->extend_cfg & C4_EXTEND_CFG)
                 pin_used[kpad->var->c4_extend_cfg] = true;
 
-        if (!kpad->adp5585_support_row5)
+        if (!kpad->support_row5)
                 pin_used[5] = true;
 
         for (i = 0; i < kpad->var->maxgpio; i++)
@@ -884,12 +884,13 @@ static int adp5589_probe(struct i2c_client *client,
 
         switch (id->driver_data) {
         case ADP5585_02:
-                kpad->adp5585_support_row5 = true;
+                kpad->support_row5 = true;
         case ADP5585_01:
                 kpad->is_adp5585 = true;
                 kpad->var = &const_adp5585;
                 break;
         case ADP5589:
+                kpad->support_row5 = true;
                 kpad->var = &const_adp5589;
                 break;
         }
diff --git a/drivers/input/keyboard/cap11xx.c b/drivers/input/keyboard/cap11xx.c
index 378db10001df..4401be225d64 100644
--- a/drivers/input/keyboard/cap11xx.c
+++ b/drivers/input/keyboard/cap11xx.c
@@ -304,8 +304,10 @@ static int cap11xx_init_leds(struct device *dev,
                 led->cdev.brightness = LED_OFF;
 
                 error = of_property_read_u32(child, "reg", &reg);
-                if (error != 0 || reg >= num_leds)
+                if (error != 0 || reg >= num_leds) {
+                        of_node_put(child);
                         return -EINVAL;
+                }
 
                 led->reg = reg;
                 led->priv = priv;
@@ -313,8 +315,10 @@ static int cap11xx_init_leds(struct device *dev,
                 INIT_WORK(&led->work, cap11xx_led_work);
 
                 error = devm_led_classdev_register(dev, &led->cdev);
-                if (error)
+                if (error) {
+                        of_node_put(child);
                         return error;
+                }
 
                 priv->num_leds++;
                 led++;
diff --git a/drivers/input/misc/Kconfig b/drivers/input/misc/Kconfig
index d6d16fa78281..1f2337abcf2f 100644
--- a/drivers/input/misc/Kconfig
+++ b/drivers/input/misc/Kconfig
@@ -733,7 +733,7 @@ config INPUT_XEN_KBDDEV_FRONTEND
           module will be called xen-kbdfront.
 
 config INPUT_SIRFSOC_ONKEY
-        bool "CSR SiRFSoC power on/off/suspend key support"
+        tristate "CSR SiRFSoC power on/off/suspend key support"
         depends on ARCH_SIRF && OF
         default y
         help
diff --git a/drivers/input/misc/sirfsoc-onkey.c b/drivers/input/misc/sirfsoc-onkey.c
index 9d5b89befe6f..ed7237f19539 100644
--- a/drivers/input/misc/sirfsoc-onkey.c
+++ b/drivers/input/misc/sirfsoc-onkey.c
@@ -101,7 +101,7 @@ static void sirfsoc_pwrc_close(struct input_dev *input)
 static const struct of_device_id sirfsoc_pwrc_of_match[] = {
         { .compatible = "sirf,prima2-pwrc" },
         {},
-}
+};
 MODULE_DEVICE_TABLE(of, sirfsoc_pwrc_of_match);
 
 static int sirfsoc_pwrc_probe(struct platform_device *pdev)
diff --git a/drivers/input/mouse/vmmouse.c b/drivers/input/mouse/vmmouse.c
index e272f06258ce..a3f0f5a47490 100644
--- a/drivers/input/mouse/vmmouse.c
+++ b/drivers/input/mouse/vmmouse.c
@@ -458,8 +458,6 @@ int vmmouse_init(struct psmouse *psmouse)
         priv->abs_dev = abs_dev;
         psmouse->private = priv;
 
-        input_set_capability(rel_dev, EV_REL, REL_WHEEL);
-
         /* Set up and register absolute device */
         snprintf(priv->phys, sizeof(priv->phys), "%s/input1",
                  psmouse->ps2dev.serio->phys);
@@ -475,10 +473,6 @@ int vmmouse_init(struct psmouse *psmouse)
         abs_dev->id.version = psmouse->model;
         abs_dev->dev.parent = &psmouse->ps2dev.serio->dev;
 
-        error = input_register_device(priv->abs_dev);
-        if (error)
-                goto init_fail;
-
         /* Set absolute device capabilities */
         input_set_capability(abs_dev, EV_KEY, BTN_LEFT);
         input_set_capability(abs_dev, EV_KEY, BTN_RIGHT);
@@ -488,6 +482,13 @@ int vmmouse_init(struct psmouse *psmouse)
         input_set_abs_params(abs_dev, ABS_X, 0, VMMOUSE_MAX_X, 0, 0);
         input_set_abs_params(abs_dev, ABS_Y, 0, VMMOUSE_MAX_Y, 0, 0);
 
+        error = input_register_device(priv->abs_dev);
+        if (error)
+                goto init_fail;
+
+        /* Add wheel capability to the relative device */
+        input_set_capability(rel_dev, EV_REL, REL_WHEEL);
+
         psmouse->protocol_handler = vmmouse_process_byte;
         psmouse->disconnect = vmmouse_disconnect;
         psmouse->reconnect = vmmouse_reconnect;
diff --git a/drivers/input/serio/serio.c b/drivers/input/serio/serio.c
index 8f828975ab10..1ca7f551e2da 100644
--- a/drivers/input/serio/serio.c
+++ b/drivers/input/serio/serio.c
@@ -134,7 +134,7 @@ static void serio_find_driver(struct serio *serio)
         int error;
 
         error = device_attach(&serio->dev);
-        if (error < 0)
+        if (error < 0 && error != -EPROBE_DEFER)
                 dev_warn(&serio->dev,
                          "device_attach() failed for %s (%s), error: %d\n",
                          serio->phys, serio->name, error);
diff --git a/drivers/input/touchscreen/colibri-vf50-ts.c b/drivers/input/touchscreen/colibri-vf50-ts.c
index 5d4903a402cc..69828d015d45 100644
--- a/drivers/input/touchscreen/colibri-vf50-ts.c
+++ b/drivers/input/touchscreen/colibri-vf50-ts.c
@@ -21,6 +21,7 @@
 #include <linux/interrupt.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
+#include <linux/of.h>
 #include <linux/pinctrl/consumer.h>
 #include <linux/platform_device.h>
 #include <linux/slab.h>
diff --git a/drivers/input/touchscreen/edt-ft5x06.c b/drivers/input/touchscreen/edt-ft5x06.c
index 0b0f8c17f3f7..23fbe382da8b 100644
--- a/drivers/input/touchscreen/edt-ft5x06.c
+++ b/drivers/input/touchscreen/edt-ft5x06.c
@@ -822,16 +822,22 @@ static void edt_ft5x06_ts_get_defaults(struct device *dev,
         int error;
 
         error = device_property_read_u32(dev, "threshold", &val);
-        if (!error)
-                reg_addr->reg_threshold = val;
+        if (!error) {
+                edt_ft5x06_register_write(tsdata, reg_addr->reg_threshold, val);
+                tsdata->threshold = val;
+        }
 
         error = device_property_read_u32(dev, "gain", &val);
-        if (!error)
-                reg_addr->reg_gain = val;
+        if (!error) {
+                edt_ft5x06_register_write(tsdata, reg_addr->reg_gain, val);
+                tsdata->gain = val;
+        }
 
         error = device_property_read_u32(dev, "offset", &val);
-        if (!error)
-                reg_addr->reg_offset = val;
+        if (!error) {
+                edt_ft5x06_register_write(tsdata, reg_addr->reg_offset, val);
+                tsdata->offset = val;
+        }
 }
 
 static void
diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
index e5e223938eec..374c129219ef 100644
--- a/drivers/iommu/amd_iommu.c
+++ b/drivers/iommu/amd_iommu.c
@@ -114,6 +114,7 @@ struct kmem_cache *amd_iommu_irq_cache;
 
 static void update_domain(struct protection_domain *domain);
 static int protection_domain_init(struct protection_domain *domain);
+static void detach_device(struct device *dev);
 
 /*
  * For dynamic growth the aperture size is split into ranges of 128MB of
@@ -384,6 +385,9 @@ static void iommu_uninit_device(struct device *dev)
         if (!dev_data)
                 return;
 
+        if (dev_data->domain)
+                detach_device(dev);
+
         iommu_device_unlink(amd_iommu_rlookup_table[dev_data->devid]->iommu_dev,
                             dev);
 
diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c
index 013bdfff2d4d..bf4959f4225b 100644
--- a/drivers/iommu/amd_iommu_init.c
+++ b/drivers/iommu/amd_iommu_init.c
@@ -228,6 +228,10 @@ static int amd_iommu_enable_interrupts(void);
 static int __init iommu_go_to_state(enum iommu_init_state state);
 static void init_device_table_dma(void);
 
+static int iommu_pc_get_set_reg_val(struct amd_iommu *iommu,
+                                    u8 bank, u8 cntr, u8 fxn,
+                                    u64 *value, bool is_write);
+
 static inline void update_last_devid(u16 devid)
 {
         if (devid > amd_iommu_last_bdf)
@@ -1016,6 +1020,34 @@ static void amd_iommu_erratum_746_workaround(struct amd_iommu *iommu)
 }
 
 /*
+ * Family15h Model 30h-3fh (IOMMU Mishandles ATS Write Permission)
+ * Workaround:
+ *     BIOS should enable ATS write permission check by setting
+ *     L2_DEBUG_3[AtsIgnoreIWDis](D0F2xF4_x47[0]) = 1b
+ */
+static void amd_iommu_ats_write_check_workaround(struct amd_iommu *iommu)
+{
+        u32 value;
+
+        if ((boot_cpu_data.x86 != 0x15) ||
+            (boot_cpu_data.x86_model < 0x30) ||
+            (boot_cpu_data.x86_model > 0x3f))
+                return;
+
+        /* Test L2_DEBUG_3[AtsIgnoreIWDis] == 1 */
+        value = iommu_read_l2(iommu, 0x47);
+
+        if (value & BIT(0))
+                return;
+
+        /* Set L2_DEBUG_3[AtsIgnoreIWDis] = 1 */
+        iommu_write_l2(iommu, 0x47, value | BIT(0));
+
+        pr_info("AMD-Vi: Applying ATS write check workaround for IOMMU at %s\n",
+                dev_name(&iommu->dev->dev));
+}
+
+/*
  * This function clues the initialization function for one IOMMU
  * together and also allocates the command buffer and programs the
  * hardware. It does NOT enable the IOMMU. This is done afterwards.
@@ -1142,8 +1174,8 @@ static void init_iommu_perf_ctr(struct amd_iommu *iommu)
         amd_iommu_pc_present = true;
 
         /* Check if the performance counters can be written to */
-        if ((0 != amd_iommu_pc_get_set_reg_val(0, 0, 0, 0, &val, true)) ||
-            (0 != amd_iommu_pc_get_set_reg_val(0, 0, 0, 0, &val2, false)) ||
+        if ((0 != iommu_pc_get_set_reg_val(iommu, 0, 0, 0, &val, true)) ||
+            (0 != iommu_pc_get_set_reg_val(iommu, 0, 0, 0, &val2, false)) ||
             (val != val2)) {
                 pr_err("AMD-Vi: Unable to write to IOMMU perf counter.\n");
                 amd_iommu_pc_present = false;
@@ -1284,6 +1316,7 @@ static int iommu_init_pci(struct amd_iommu *iommu)
         }
 
         amd_iommu_erratum_746_workaround(iommu);
+        amd_iommu_ats_write_check_workaround(iommu);
 
         iommu->iommu_dev = iommu_device_create(&iommu->dev->dev, iommu,
                                                amd_iommu_groups, "ivhd%d",
@@ -2283,22 +2316,15 @@ u8 amd_iommu_pc_get_max_counters(u16 devid)
 }
 EXPORT_SYMBOL(amd_iommu_pc_get_max_counters);
 
-int amd_iommu_pc_get_set_reg_val(u16 devid, u8 bank, u8 cntr, u8 fxn,
+static int iommu_pc_get_set_reg_val(struct amd_iommu *iommu,
+                                    u8 bank, u8 cntr, u8 fxn,
                                     u64 *value, bool is_write)
 {
-        struct amd_iommu *iommu;
         u32 offset;
         u32 max_offset_lim;
 
-        /* Make sure the IOMMU PC resource is available */
-        if (!amd_iommu_pc_present)
-                return -ENODEV;
-
-        /* Locate the iommu associated with the device ID */
-        iommu = amd_iommu_rlookup_table[devid];
-
         /* Check for valid iommu and pc register indexing */
-        if (WARN_ON((iommu == NULL) || (fxn > 0x28) || (fxn & 7)))
+        if (WARN_ON((fxn > 0x28) || (fxn & 7)))
                 return -ENODEV;
 
         offset = (u32)(((0x40|bank) << 12) | (cntr << 8) | fxn);
@@ -2322,3 +2348,16 @@ int amd_iommu_pc_get_set_reg_val(u16 devid, u8 bank, u8 cntr, u8 fxn,
         return 0;
 }
 EXPORT_SYMBOL(amd_iommu_pc_get_set_reg_val);
+
+int amd_iommu_pc_get_set_reg_val(u16 devid, u8 bank, u8 cntr, u8 fxn,
+                                    u64 *value, bool is_write)
+{
+        struct amd_iommu *iommu = amd_iommu_rlookup_table[devid];
+
+        /* Make sure the IOMMU PC resource is available */
+        if (!amd_iommu_pc_present || iommu == NULL)
+                return -ENODEV;
+
+        return iommu_pc_get_set_reg_val(iommu, bank, cntr, fxn,
+                                        value, is_write);
+}
diff --git a/drivers/iommu/dmar.c b/drivers/iommu/dmar.c
index 62a400c5ba06..8ffd7568fc91 100644
--- a/drivers/iommu/dmar.c
+++ b/drivers/iommu/dmar.c
@@ -329,7 +329,8 @@ static int dmar_pci_bus_notifier(struct notifier_block *nb,
         /* Only care about add/remove events for physical functions */
         if (pdev->is_virtfn)
                 return NOTIFY_DONE;
-        if (action != BUS_NOTIFY_ADD_DEVICE && action != BUS_NOTIFY_DEL_DEVICE)
+        if (action != BUS_NOTIFY_ADD_DEVICE &&
+            action != BUS_NOTIFY_REMOVED_DEVICE)
                 return NOTIFY_DONE;
 
         info = dmar_alloc_pci_notify_info(pdev, action);
@@ -339,7 +340,7 @@ static int dmar_pci_bus_notifier(struct notifier_block *nb,
         down_write(&dmar_global_lock);
         if (action == BUS_NOTIFY_ADD_DEVICE)
                 dmar_pci_bus_add_dev(info);
-        else if (action == BUS_NOTIFY_DEL_DEVICE)
+        else if (action == BUS_NOTIFY_REMOVED_DEVICE)
                 dmar_pci_bus_del_dev(info);
         up_write(&dmar_global_lock);
 
@@ -1353,7 +1354,7 @@ void dmar_disable_qi(struct intel_iommu *iommu)
 
         raw_spin_lock_irqsave(&iommu->register_lock, flags);
 
-        sts =  dmar_readq(iommu->reg + DMAR_GSTS_REG);
+        sts =  readl(iommu->reg + DMAR_GSTS_REG);
         if (!(sts & DMA_GSTS_QIES))
                 goto end;
 
diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index 986a53e3eb96..a2e1b7f14df2 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -4367,7 +4367,7 @@ int dmar_iommu_notify_scope_dev(struct dmar_pci_notify_info *info)
                                 rmrru->devices_cnt);
                         if(ret < 0)
                                 return ret;
-                } else if (info->event == BUS_NOTIFY_DEL_DEVICE) {
+                } else if (info->event == BUS_NOTIFY_REMOVED_DEVICE) {
                         dmar_remove_dev_scope(info, rmrr->segment,
                                 rmrru->devices, rmrru->devices_cnt);
                 }
@@ -4387,7 +4387,7 @@ int dmar_iommu_notify_scope_dev(struct dmar_pci_notify_info *info)
                                 break;
                         else if(ret < 0)
                                 return ret;
-                } else if (info->event == BUS_NOTIFY_DEL_DEVICE) {
+                } else if (info->event == BUS_NOTIFY_REMOVED_DEVICE) {
                         if (dmar_remove_dev_scope(info, atsr->segment,
                                         atsru->devices, atsru->devices_cnt))
                                 break;
diff --git a/drivers/iommu/intel-svm.c b/drivers/iommu/intel-svm.c
index 50464833d0b8..d9939fa9b588 100644
--- a/drivers/iommu/intel-svm.c
+++ b/drivers/iommu/intel-svm.c
@@ -249,12 +249,30 @@ static void intel_flush_pasid_dev(struct intel_svm *svm, struct intel_svm_dev *s
 static void intel_mm_release(struct mmu_notifier *mn, struct mm_struct *mm)
 {
         struct intel_svm *svm = container_of(mn, struct intel_svm, notifier);
+        struct intel_svm_dev *sdev;
 
+        /* This might end up being called from exit_mmap(), *before* the page
+         * tables are cleared. And __mmu_notifier_release() will delete us from
+         * the list of notifiers so that our invalidate_range() callback doesn't
+         * get called when the page tables are cleared. So we need to protect
+         * against hardware accessing those page tables.
+         *
+         * We do it by clearing the entry in the PASID table and then flushing
+         * the IOTLB and the PASID table caches. This might upset hardware;
+         * perhaps we'll want to point the PASID to a dummy PGD (like the zero
+         * page) so that we end up taking a fault that the hardware really
+         * *has* to handle gracefully without affecting other processes.
+         */
         svm->iommu->pasid_table[svm->pasid].val = 0;
+        wmb();
+
+        rcu_read_lock();
+        list_for_each_entry_rcu(sdev, &svm->devs, list) {
+                intel_flush_pasid_dev(svm, sdev, svm->pasid);
+                intel_flush_svm_range_dev(svm, sdev, 0, -1, 0, !svm->mm);
+        }
+        rcu_read_unlock();
 
-        /* There's no need to do any flush because we can't get here if there
-         * are any devices left anyway. */
-        WARN_ON(!list_empty(&svm->devs));
 }
 
 static const struct mmu_notifier_ops intel_mmuops = {
@@ -379,7 +397,6 @@ int intel_svm_bind_mm(struct device *dev, int *pasid, int flags, struct svm_dev_
                                 goto out;
                         }
                         iommu->pasid_table[svm->pasid].val = (u64)__pa(mm->pgd) | 1;
-                        mm = NULL;
                 } else
                         iommu->pasid_table[svm->pasid].val = (u64)__pa(init_mm.pgd) | 1 | (1ULL << 11);
                 wmb();
@@ -442,11 +459,11 @@ int intel_svm_unbind_mm(struct device *dev, int pasid)
                                 kfree_rcu(sdev, rcu);
 
                                 if (list_empty(&svm->devs)) {
-                                        mmu_notifier_unregister(&svm->notifier, svm->mm);
 
                                         idr_remove(&svm->iommu->pasid_idr, svm->pasid);
                                         if (svm->mm)
-                                                mmput(svm->mm);
+                                                mmu_notifier_unregister(&svm->notifier, svm->mm);
+
                                         /* We mandate that no page faults may be outstanding
                                          * for the PASID when intel_svm_unbind_mm() is called.
                                          * If that is not obeyed, subtle errors will happen.
@@ -507,6 +524,10 @@ static irqreturn_t prq_event_thread(int irq, void *d)
         struct intel_svm *svm = NULL;
         int head, tail, handled = 0;
 
+        /* Clear PPR bit before reading head/tail registers, to
+         * ensure that we get a new interrupt if needed. */
+        writel(DMA_PRS_PPR, iommu->reg + DMAR_PRS_REG);
+
         tail = dmar_readq(iommu->reg + DMAR_PQT_REG) & PRQ_RING_MASK;
         head = dmar_readq(iommu->reg + DMAR_PQH_REG) & PRQ_RING_MASK;
         while (head != tail) {
@@ -551,6 +572,9 @@ static irqreturn_t prq_event_thread(int irq, void *d)
                  * any faults on kernel addresses. */
                 if (!svm->mm)
                         goto bad_req;
+                /* If the mm is already defunct, don't handle faults. */
+                if (!atomic_inc_not_zero(&svm->mm->mm_users))
+                        goto bad_req;
                 down_read(&svm->mm->mmap_sem);
                 vma = find_extend_vma(svm->mm, address);
                 if (!vma || address < vma->vm_start)
@@ -567,6 +591,7 @@ static irqreturn_t prq_event_thread(int irq, void *d)
                 result = QI_RESP_SUCCESS;
         invalid:
                 up_read(&svm->mm->mmap_sem);
+                mmput(svm->mm);
         bad_req:
                 /* Accounting for major/minor faults? */
                 rcu_read_lock();
diff --git a/drivers/iommu/intel_irq_remapping.c b/drivers/iommu/intel_irq_remapping.c
index c12ba4516df2..ac596928f6b4 100644
--- a/drivers/iommu/intel_irq_remapping.c
+++ b/drivers/iommu/intel_irq_remapping.c
@@ -629,7 +629,7 @@ static void iommu_disable_irq_remapping(struct intel_iommu *iommu)
 
         raw_spin_lock_irqsave(&iommu->register_lock, flags);
 
-        sts = dmar_readq(iommu->reg + DMAR_GSTS_REG);
+        sts = readl(iommu->reg + DMAR_GSTS_REG);
         if (!(sts & DMA_GSTS_IRES))
                 goto end;
 
diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index 3447549fcc93..43dfd15c1dd2 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -66,7 +66,10 @@ struct its_node {
         unsigned long           phys_base;
         struct its_cmd_block    *cmd_base;
         struct its_cmd_block    *cmd_write;
-        void                    *tables[GITS_BASER_NR_REGS];
+        struct {
+                void            *base;
+                u32             order;
+        } tables[GITS_BASER_NR_REGS];
         struct its_collection   *collections;
         struct list_head        its_device_list;
         u64                     flags;
@@ -75,6 +78,9 @@ struct its_node {
 
 #define ITS_ITT_ALIGN           SZ_256
 
+/* Convert page order to size in bytes */
+#define PAGE_ORDER_TO_SIZE(o)   (PAGE_SIZE << (o))
+
 struct event_lpi_map {
         unsigned long           *lpi_map;
         u16                     *col_map;
@@ -597,11 +603,6 @@ static void its_unmask_irq(struct irq_data *d)
         lpi_set_config(d, true);
 }
 
-static void its_eoi_irq(struct irq_data *d)
-{
-        gic_write_eoir(d->hwirq);
-}
-
 static int its_set_affinity(struct irq_data *d, const struct cpumask *mask_val,
                             bool force)
 {
@@ -638,7 +639,7 @@ static struct irq_chip its_irq_chip = {
         .name                   = "ITS",
         .irq_mask               = its_mask_irq,
         .irq_unmask             = its_unmask_irq,
-        .irq_eoi                = its_eoi_irq,
+        .irq_eoi                = irq_chip_eoi_parent,
         .irq_set_affinity       = its_set_affinity,
         .irq_compose_msi_msg    = its_irq_compose_msi_msg,
 };
@@ -807,9 +808,10 @@ static void its_free_tables(struct its_node *its)
         int i;
 
         for (i = 0; i < GITS_BASER_NR_REGS; i++) {
-                if (its->tables[i]) {
-                        free_page((unsigned long)its->tables[i]);
-                        its->tables[i] = NULL;
+                if (its->tables[i].base) {
+                        free_pages((unsigned long)its->tables[i].base,
+                                   its->tables[i].order);
+                        its->tables[i].base = NULL;
                 }
         }
 }
@@ -842,7 +844,6 @@ static int its_alloc_tables(const char *node_name, struct its_node *its)
                 u64 type = GITS_BASER_TYPE(val);
                 u64 entry_size = GITS_BASER_ENTRY_SIZE(val);
                 int order = get_order(psz);
-                int alloc_size;
                 int alloc_pages;
                 u64 tmp;
                 void *base;
@@ -874,9 +875,8 @@ static int its_alloc_tables(const char *node_name, struct its_node *its)
                         }
                 }
 
-                alloc_size = (1 << order) * PAGE_SIZE;
 retry_alloc_baser:
-                alloc_pages = (alloc_size / psz);
+                alloc_pages = (PAGE_ORDER_TO_SIZE(order) / psz);
                 if (alloc_pages > GITS_BASER_PAGES_MAX) {
                         alloc_pages = GITS_BASER_PAGES_MAX;
                         order = get_order(GITS_BASER_PAGES_MAX * psz);
@@ -890,7 +890,8 @@ retry_alloc_baser:
                         goto out_free;
                 }
 
-                its->tables[i] = base;
+                its->tables[i].base = base;
+                its->tables[i].order = order;
 
 retry_baser:
                 val = (virt_to_phys(base)                                |
@@ -928,7 +929,7 @@ retry_baser:
                         shr = tmp & GITS_BASER_SHAREABILITY_MASK;
                         if (!shr) {
                                 cache = GITS_BASER_nC;
-                                __flush_dcache_area(base, alloc_size);
+                                __flush_dcache_area(base, PAGE_ORDER_TO_SIZE(order));
                         }
                         goto retry_baser;
                 }
@@ -940,7 +941,7 @@ retry_baser:
                          * something is horribly wrong...
                          */
                         free_pages((unsigned long)base, order);
-                        its->tables[i] = NULL;
+                        its->tables[i].base = NULL;
 
                         switch (psz) {
                         case SZ_16K:
@@ -961,7 +962,7 @@ retry_baser:
                 }
 
                 pr_info("ITS: allocated %d %s @%lx (psz %dK, shr %d)\n",
-                        (int)(alloc_size / entry_size),
+                        (int)(PAGE_ORDER_TO_SIZE(order) / entry_size),
                         its_base_type_string[type],
                         (unsigned long)virt_to_phys(base),
                         psz / SZ_1K, (int)shr >> GITS_BASER_SHAREABILITY_SHIFT);
diff --git a/drivers/irqchip/irq-gic.c b/drivers/irqchip/irq-gic.c
index 911758c056c1..8f9ebf714e2b 100644
--- a/drivers/irqchip/irq-gic.c
+++ b/drivers/irqchip/irq-gic.c
@@ -384,9 +384,6 @@ static struct irq_chip gic_chip = {
         .irq_unmask             = gic_unmask_irq,
         .irq_eoi                = gic_eoi_irq,
         .irq_set_type           = gic_set_type,
-#ifdef CONFIG_SMP
-        .irq_set_affinity       = gic_set_affinity,
-#endif
         .irq_get_irqchip_state  = gic_irq_get_irqchip_state,
         .irq_set_irqchip_state  = gic_irq_set_irqchip_state,
         .flags                  = IRQCHIP_SET_TYPE_MASKED |
@@ -400,9 +397,6 @@ static struct irq_chip gic_eoimode1_chip = {
         .irq_unmask             = gic_unmask_irq,
         .irq_eoi                = gic_eoimode1_eoi_irq,
         .irq_set_type           = gic_set_type,
-#ifdef CONFIG_SMP
-        .irq_set_affinity       = gic_set_affinity,
-#endif
         .irq_get_irqchip_state  = gic_irq_get_irqchip_state,
         .irq_set_irqchip_state  = gic_irq_set_irqchip_state,
         .irq_set_vcpu_affinity  = gic_irq_set_vcpu_affinity,
@@ -443,7 +437,7 @@ static void gic_cpu_if_up(struct gic_chip_data *gic)
         u32 bypass = 0;
         u32 mode = 0;
 
-        if (static_key_true(&supports_deactivate))
+        if (gic == &gic_data[0] && static_key_true(&supports_deactivate))
                 mode = GIC_CPU_CTRL_EOImodeNS;
 
         /*
@@ -1039,6 +1033,11 @@ static void __init __gic_init_bases(unsigned int gic_nr, int irq_start,
                 gic->chip.name = kasprintf(GFP_KERNEL, "GIC-%d", gic_nr);
         }
 
+#ifdef CONFIG_SMP
+        if (gic_nr == 0)
+                gic->chip.irq_set_affinity = gic_set_affinity;
+#endif
+
 #ifdef CONFIG_GIC_NON_BANKED
         if (percpu_offset) { /* Frankein-GIC without banked registers... */
                 unsigned int cpu;
diff --git a/drivers/irqchip/irq-sun4i.c b/drivers/irqchip/irq-sun4i.c
index 0704362f4c82..376b28074e0d 100644
--- a/drivers/irqchip/irq-sun4i.c
+++ b/drivers/irqchip/irq-sun4i.c
@@ -22,7 +22,6 @@
 #include <linux/of_irq.h>
 
 #include <asm/exception.h>
-#include <asm/mach/irq.h>
 
 #define SUN4I_IRQ_VECTOR_REG            0x00
 #define SUN4I_IRQ_PROTECTION_REG        0x08
diff --git a/drivers/isdn/gigaset/ser-gigaset.c b/drivers/isdn/gigaset/ser-gigaset.c
index 2a506fe0c8a4..d1f8ab915b15 100644
--- a/drivers/isdn/gigaset/ser-gigaset.c
+++ b/drivers/isdn/gigaset/ser-gigaset.c
@@ -373,13 +373,7 @@ static void gigaset_freecshw(struct cardstate *cs)
 
 static void gigaset_device_release(struct device *dev)
 {
-        struct cardstate *cs = dev_get_drvdata(dev);
-
-        if (!cs)
-                return;
-        dev_set_drvdata(dev, NULL);
-        kfree(cs->hw.ser);
-        cs->hw.ser = NULL;
+        kfree(container_of(dev, struct ser_cardstate, dev.dev));
 }
 
 /*
@@ -408,7 +402,6 @@ static int gigaset_initcshw(struct cardstate *cs)
                 cs->hw.ser = NULL;
                 return rc;
         }
-        dev_set_drvdata(&cs->hw.ser->dev.dev, cs);
 
         tasklet_init(&cs->write_tasklet,
                      gigaset_modem_fill, (unsigned long) cs);
diff --git a/drivers/isdn/hardware/mISDN/netjet.c b/drivers/isdn/hardware/mISDN/netjet.c
index 8e2944784e00..afde4edef9ae 100644
--- a/drivers/isdn/hardware/mISDN/netjet.c
+++ b/drivers/isdn/hardware/mISDN/netjet.c
@@ -392,7 +392,7 @@ read_dma(struct tiger_ch *bc, u32 idx, int cnt)
         }
         stat = bchannel_get_rxbuf(&bc->bch, cnt);
         /* only transparent use the count here, HDLC overun is detected later */
-        if (stat == ENOMEM) {
+        if (stat == -ENOMEM) {
                 pr_warning("%s.B%d: No memory for %d bytes\n",
                            card->name, bc->bch.nr, cnt);
                 return;
diff --git a/drivers/lightnvm/core.c b/drivers/lightnvm/core.c
index 33224cb91c5b..9f6acd5d1d2e 100644
--- a/drivers/lightnvm/core.c
+++ b/drivers/lightnvm/core.c
@@ -572,11 +572,13 @@ int nvm_register(struct request_queue *q, char *disk_name,
                 }
         }
 
-        ret = nvm_get_sysblock(dev, &dev->sb);
-        if (!ret)
-                pr_err("nvm: device not initialized.\n");
-        else if (ret < 0)
-                pr_err("nvm: err (%d) on device initialization\n", ret);
+        if (dev->identity.cap & NVM_ID_DCAP_BBLKMGMT) {
+                ret = nvm_get_sysblock(dev, &dev->sb);
+                if (!ret)
+                        pr_err("nvm: device not initialized.\n");
+                else if (ret < 0)
+                        pr_err("nvm: err (%d) on device initialization\n", ret);
+        }
 
         /* register device with a supported media manager */
         down_write(&nvm_lock);
@@ -1055,9 +1057,11 @@ static long __nvm_ioctl_dev_init(struct nvm_ioctl_dev_init *init)
         strncpy(info.mmtype, init->mmtype, NVM_MMTYPE_LEN);
         info.fs_ppa.ppa = -1;
 
-        ret = nvm_init_sysblock(dev, &info);
-        if (ret)
-                return ret;
+        if (dev->identity.cap & NVM_ID_DCAP_BBLKMGMT) {
+                ret = nvm_init_sysblock(dev, &info);
+                if (ret)
+                        return ret;
+        }
 
         memcpy(&dev->sb, &info, sizeof(struct nvm_sb_info));
 
@@ -1117,7 +1121,10 @@ static long nvm_ioctl_dev_factory(struct file *file, void __user *arg)
                 dev->mt = NULL;
         }
 
-        return nvm_dev_factory(dev, fact.flags);
+        if (dev->identity.cap & NVM_ID_DCAP_BBLKMGMT)
+                return nvm_dev_factory(dev, fact.flags);
+
+        return 0;
 }
 
 static long nvm_ctl_ioctl(struct file *file, uint cmd, unsigned long arg)
diff --git a/drivers/lightnvm/rrpc.c b/drivers/lightnvm/rrpc.c
index d8c75958ced3..307db1ea22de 100644
--- a/drivers/lightnvm/rrpc.c
+++ b/drivers/lightnvm/rrpc.c
@@ -300,8 +300,10 @@ static int rrpc_move_valid_pages(struct rrpc *rrpc, struct rrpc_block *rblk)
         }
 
         page = mempool_alloc(rrpc->page_pool, GFP_NOIO);
-        if (!page)
+        if (!page) {
+                bio_put(bio);
                 return -ENOMEM;
+        }
 
         while ((slot = find_first_zero_bit(rblk->invalid_pages,
                                             nr_pgs_per_blk)) < nr_pgs_per_blk) {
diff --git a/drivers/lightnvm/rrpc.h b/drivers/lightnvm/rrpc.h
index ef13ac7700c8..f7b37336353f 100644
--- a/drivers/lightnvm/rrpc.h
+++ b/drivers/lightnvm/rrpc.h
@@ -174,8 +174,7 @@ static inline sector_t rrpc_get_sector(sector_t laddr)
 static inline int request_intersects(struct rrpc_inflight_rq *r,
                                 sector_t laddr_start, sector_t laddr_end)
 {
-        return (laddr_end >= r->l_start && laddr_end <= r->l_end) &&
-                (laddr_start >= r->l_start && laddr_start <= r->l_end);
+        return (laddr_end >= r->l_start) && (laddr_start <= r->l_end);
 }
 
 static int __rrpc_lock_laddr(struct rrpc *rrpc, sector_t laddr,
@@ -184,6 +183,8 @@ static int __rrpc_lock_laddr(struct rrpc *rrpc, sector_t laddr,
         sector_t laddr_end = laddr + pages - 1;
         struct rrpc_inflight_rq *rtmp;
 
+        WARN_ON(irqs_disabled());
+
         spin_lock_irq(&rrpc->inflights.lock);
         list_for_each_entry(rtmp, &rrpc->inflights.reqs, list) {
                 if (unlikely(request_intersects(rtmp, laddr, laddr_end))) {
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index 5df40480228b..dd834927bc66 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -1191,6 +1191,8 @@ static void dm_unprep_request(struct request *rq)
 
         if (clone)
                 free_rq_clone(clone);
+        else if (!tio->md->queue->mq_ops)
+                free_rq_tio(tio);
 }
 
 /*
diff --git a/drivers/media/i2c/adv7604.c b/drivers/media/i2c/adv7604.c
index d35e0ba8b269..befb07df036d 100644
--- a/drivers/media/i2c/adv7604.c
+++ b/drivers/media/i2c/adv7604.c
@@ -1946,10 +1946,9 @@ static int adv76xx_isr(struct v4l2_subdev *sd, u32 status, bool *handled)
         }
 
         /* tx 5v detect */
-        tx_5v = io_read(sd, 0x70) & info->cable_det_mask;
+        tx_5v = irq_reg_0x70 & info->cable_det_mask;
         if (tx_5v) {
                 v4l2_dbg(1, debug, sd, "%s: tx_5v: 0x%x\n", __func__, tx_5v);
-                io_write(sd, 0x71, tx_5v);
                 adv76xx_s_detect_tx_5v_ctrl(sd);
                 if (handled)
                         *handled = true;
diff --git a/drivers/media/media-device.c b/drivers/media/media-device.c
index 5ebb3cd31345..711c3674a5d9 100644
--- a/drivers/media/media-device.c
+++ b/drivers/media/media-device.c
@@ -20,6 +20,9 @@
  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
+/* We need to access legacy defines from linux/media.h */
+#define __NEED_MEDIA_LEGACY_API
+
 #include <linux/compat.h>
 #include <linux/export.h>
 #include <linux/idr.h>
@@ -119,6 +122,26 @@ static long media_device_enum_entities(struct media_device *mdev,
         u_ent.group_id = 0;             /* Unused */
         u_ent.pads = ent->num_pads;
         u_ent.links = ent->num_links - ent->num_backlinks;
+
+        /*
+         * Workaround for a bug at media-ctl <= v1.10 that makes it to
+         * do the wrong thing if the entity function doesn't belong to
+         * either MEDIA_ENT_F_OLD_BASE or MEDIA_ENT_F_OLD_SUBDEV_BASE
+         * Ranges.
+         *
+         * Non-subdevices are expected to be at the MEDIA_ENT_F_OLD_BASE,
+         * or, otherwise, will be silently ignored by media-ctl when
+         * printing the graphviz diagram. So, map them into the devnode
+         * old range.
+         */
+        if (ent->function < MEDIA_ENT_F_OLD_BASE ||
+            ent->function > MEDIA_ENT_T_DEVNODE_UNKNOWN) {
+                if (is_media_entity_v4l2_subdev(ent))
+                        u_ent.type = MEDIA_ENT_F_V4L2_SUBDEV_UNKNOWN;
+                else if (ent->function != MEDIA_ENT_F_IO_V4L)
+                        u_ent.type = MEDIA_ENT_T_DEVNODE_UNKNOWN;
+        }
+
         memcpy(&u_ent.raw, &ent->info, sizeof(ent->info));
         if (copy_to_user(uent, &u_ent, sizeof(u_ent)))
                 return -EFAULT;
diff --git a/drivers/mfd/db8500-prcmu.c b/drivers/mfd/db8500-prcmu.c
index e6e4bacb09ee..12099b09a9a7 100644
--- a/drivers/mfd/db8500-prcmu.c
+++ b/drivers/mfd/db8500-prcmu.c
@@ -2048,6 +2048,7 @@ int db8500_prcmu_config_hotmon(u8 low, u8 high)
 
         return 0;
 }
+EXPORT_SYMBOL_GPL(db8500_prcmu_config_hotmon);
 
 static int config_hot_period(u16 val)
 {
@@ -2074,11 +2075,13 @@ int db8500_prcmu_start_temp_sense(u16 cycles32k)
 
         return config_hot_period(cycles32k);
 }
+EXPORT_SYMBOL_GPL(db8500_prcmu_start_temp_sense);
 
 int db8500_prcmu_stop_temp_sense(void)
 {
         return config_hot_period(0xFFFF);
 }
+EXPORT_SYMBOL_GPL(db8500_prcmu_stop_temp_sense);
 
 static int prcmu_a9wdog(u8 cmd, u8 d0, u8 d1, u8 d2, u8 d3)
 {
diff --git a/drivers/misc/cxl/pci.c b/drivers/misc/cxl/pci.c
index 4c1903f781fc..0c6c17a1c59e 100644
--- a/drivers/misc/cxl/pci.c
+++ b/drivers/misc/cxl/pci.c
@@ -415,7 +415,7 @@ static int cxl_setup_psl_timebase(struct cxl *adapter, struct pci_dev *dev)
                 delta = mftb() - psl_tb;
                 if (delta < 0)
                         delta = -delta;
-        } while (cputime_to_usecs(delta) > 16);
+        } while (tb_to_ns(delta) > 16000);
 
         return 0;
 }
diff --git a/drivers/misc/mei/main.c b/drivers/misc/mei/main.c
index 677d0362f334..80f9afcb1382 100644
--- a/drivers/misc/mei/main.c
+++ b/drivers/misc/mei/main.c
@@ -458,7 +458,11 @@ static int mei_ioctl_client_notify_request(struct file *file, u32 request)
 {
         struct mei_cl *cl = file->private_data;
 
-        return mei_cl_notify_request(cl, file, request);
+        if (request != MEI_HBM_NOTIFICATION_START &&
+            request != MEI_HBM_NOTIFICATION_STOP)
+                return -EINVAL;
+
+        return mei_cl_notify_request(cl, file, (u8)request);
 }
 
 /**
diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c
index 5914263090fc..fe207e542032 100644
--- a/drivers/mmc/card/block.c
+++ b/drivers/mmc/card/block.c
@@ -47,13 +47,10 @@
 #include "queue.h"
 
 MODULE_ALIAS("mmc:block");
-
-#ifdef KERNEL
 #ifdef MODULE_PARAM_PREFIX
 #undef MODULE_PARAM_PREFIX
 #endif
 #define MODULE_PARAM_PREFIX "mmcblk."
-#endif
 
 #define INAND_CMD38_ARG_EXT_CSD  113
 #define INAND_CMD38_ARG_ERASE    0x00
@@ -655,8 +652,10 @@ static int mmc_blk_ioctl_multi_cmd(struct block_device *bdev,
         }
 
         md = mmc_blk_get(bdev->bd_disk);
-        if (!md)
+        if (!md) {
+                err = -EINVAL;
                 goto cmd_err;
+        }
 
         card = md->queue.card;
         if (IS_ERR(card)) {
diff --git a/drivers/mmc/host/mmc_spi.c b/drivers/mmc/host/mmc_spi.c
index 1c1b45ef3faf..3446097a43c0 100644
--- a/drivers/mmc/host/mmc_spi.c
+++ b/drivers/mmc/host/mmc_spi.c
@@ -925,6 +925,10 @@ mmc_spi_data_do(struct mmc_spi_host *host, struct mmc_command *cmd,
 
                         dma_addr = dma_map_page(dma_dev, sg_page(sg), 0,
                                                 PAGE_SIZE, dir);
+                        if (dma_mapping_error(dma_dev, dma_addr)) {
+                                data->error = -EFAULT;
+                                break;
+                        }
                         if (direction == DMA_TO_DEVICE)
                                 t->tx_dma = dma_addr + sg->offset;
                         else
@@ -1393,10 +1397,12 @@ static int mmc_spi_probe(struct spi_device *spi)
                 host->dma_dev = dev;
                 host->ones_dma = dma_map_single(dev, ones,
                                 MMC_SPI_BLOCKSIZE, DMA_TO_DEVICE);
+                if (dma_mapping_error(dev, host->ones_dma))
+                        goto fail_ones_dma;
                 host->data_dma = dma_map_single(dev, host->data,
                                 sizeof(*host->data), DMA_BIDIRECTIONAL);
-
-                /* REVISIT in theory those map operations can fail... */
+                if (dma_mapping_error(dev, host->data_dma))
+                        goto fail_data_dma;
 
                 dma_sync_single_for_cpu(host->dma_dev,
                                 host->data_dma, sizeof(*host->data),
@@ -1462,6 +1468,11 @@ fail_glue_init:
         if (host->dma_dev)
                 dma_unmap_single(host->dma_dev, host->data_dma,
                                 sizeof(*host->data), DMA_BIDIRECTIONAL);
+fail_data_dma:
+        if (host->dma_dev)
+                dma_unmap_single(host->dma_dev, host->ones_dma,
+                                MMC_SPI_BLOCKSIZE, DMA_TO_DEVICE);
+fail_ones_dma:
         kfree(host->data);
 
 fail_nobuf1:
diff --git a/drivers/mmc/host/omap_hsmmc.c b/drivers/mmc/host/omap_hsmmc.c
index b6639ea0bf18..f6e4d9718035 100644
--- a/drivers/mmc/host/omap_hsmmc.c
+++ b/drivers/mmc/host/omap_hsmmc.c
@@ -2232,6 +2232,7 @@ err_irq:
                 dma_release_channel(host->tx_chan);
         if (host->rx_chan)
                 dma_release_channel(host->rx_chan);
+        pm_runtime_dont_use_autosuspend(host->dev);
         pm_runtime_put_sync(host->dev);
         pm_runtime_disable(host->dev);
         if (host->dbclk)
@@ -2253,6 +2254,7 @@ static int omap_hsmmc_remove(struct platform_device *pdev)
         dma_release_channel(host->tx_chan);
         dma_release_channel(host->rx_chan);
 
+        pm_runtime_dont_use_autosuspend(host->dev);
         pm_runtime_put_sync(host->dev);
         pm_runtime_disable(host->dev);
         device_init_wakeup(&pdev->dev, false);
diff --git a/drivers/mmc/host/pxamci.c b/drivers/mmc/host/pxamci.c
index ce08896b9d69..da824772bbb4 100644
--- a/drivers/mmc/host/pxamci.c
+++ b/drivers/mmc/host/pxamci.c
@@ -86,7 +86,7 @@ struct pxamci_host {
 static inline void pxamci_init_ocr(struct pxamci_host *host)
 {
 #ifdef CONFIG_REGULATOR
-        host->vcc = regulator_get_optional(mmc_dev(host->mmc), "vmmc");
+        host->vcc = devm_regulator_get_optional(mmc_dev(host->mmc), "vmmc");
 
         if (IS_ERR(host->vcc))
                 host->vcc = NULL;
@@ -654,12 +654,8 @@ static int pxamci_probe(struct platform_device *pdev)
 
         r = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         irq = platform_get_irq(pdev, 0);
-        if (!r || irq < 0)
-                return -ENXIO;
-
-        r = request_mem_region(r->start, SZ_4K, DRIVER_NAME);
-        if (!r)
-                return -EBUSY;
+        if (irq < 0)
+                return irq;
 
         mmc = mmc_alloc_host(sizeof(struct pxamci_host), &pdev->dev);
         if (!mmc) {
@@ -695,7 +691,7 @@ static int pxamci_probe(struct platform_device *pdev)
         host->pdata = pdev->dev.platform_data;
         host->clkrt = CLKRT_OFF;
 
-        host->clk = clk_get(&pdev->dev, NULL);
+        host->clk = devm_clk_get(&pdev->dev, NULL);
         if (IS_ERR(host->clk)) {
                 ret = PTR_ERR(host->clk);
                 host->clk = NULL;
@@ -727,9 +723,9 @@ static int pxamci_probe(struct platform_device *pdev)
         host->irq = irq;
         host->imask = MMC_I_MASK_ALL;
 
-        host->base = ioremap(r->start, SZ_4K);
-        if (!host->base) {
-                ret = -ENOMEM;
+        host->base = devm_ioremap_resource(&pdev->dev, r);
+        if (IS_ERR(host->base)) {
+                ret = PTR_ERR(host->base);
                 goto out;
         }
 
@@ -742,7 +738,8 @@ static int pxamci_probe(struct platform_device *pdev)
         writel(64, host->base + MMC_RESTO);
         writel(host->imask, host->base + MMC_I_MASK);
 
-        ret = request_irq(host->irq, pxamci_irq, 0, DRIVER_NAME, host);
+        ret = devm_request_irq(&pdev->dev, host->irq, pxamci_irq, 0,
+                               DRIVER_NAME, host);
         if (ret)
                 goto out;
 
@@ -804,7 +801,7 @@ static int pxamci_probe(struct platform_device *pdev)
                 dev_err(&pdev->dev, "Failed requesting gpio_ro %d\n", gpio_ro);
                 goto out;
         } else {
-                mmc->caps |= host->pdata->gpio_card_ro_invert ?
+                mmc->caps2 |= host->pdata->gpio_card_ro_invert ?
                         0 : MMC_CAP2_RO_ACTIVE_HIGH;
         }
 
@@ -833,14 +830,9 @@ out:
                         dma_release_channel(host->dma_chan_rx);
                 if (host->dma_chan_tx)
                         dma_release_channel(host->dma_chan_tx);
-                if (host->base)
-                        iounmap(host->base);
-                if (host->clk)
-                        clk_put(host->clk);
         }
         if (mmc)
                 mmc_free_host(mmc);
-        release_resource(r);
         return ret;
 }
 
@@ -859,9 +851,6 @@ static int pxamci_remove(struct platform_device *pdev)
                         gpio_ro = host->pdata->gpio_card_ro;
                         gpio_power = host->pdata->gpio_power;
                 }
-                if (host->vcc)
-                        regulator_put(host->vcc);
-
                 if (host->pdata && host->pdata->exit)
                         host->pdata->exit(&pdev->dev, mmc);
 
@@ -870,16 +859,10 @@ static int pxamci_remove(struct platform_device *pdev)
                        END_CMD_RES|PRG_DONE|DATA_TRAN_DONE,
                        host->base + MMC_I_MASK);
 
-                free_irq(host->irq, host);
                 dmaengine_terminate_all(host->dma_chan_rx);
                 dmaengine_terminate_all(host->dma_chan_tx);
                 dma_release_channel(host->dma_chan_rx);
                 dma_release_channel(host->dma_chan_tx);
-                iounmap(host->base);
-
-                clk_put(host->clk);
-
-                release_resource(host->res);
 
                 mmc_free_host(mmc);
         }
diff --git a/drivers/mmc/host/sdhci-acpi.c b/drivers/mmc/host/sdhci-acpi.c
index f6047fc94062..a5cda926d38e 100644
--- a/drivers/mmc/host/sdhci-acpi.c
+++ b/drivers/mmc/host/sdhci-acpi.c
@@ -146,6 +146,33 @@ static const struct sdhci_acpi_chip sdhci_acpi_chip_int = {
         .ops = &sdhci_acpi_ops_int,
 };
 
+static int bxt_get_cd(struct mmc_host *mmc)
+{
+        int gpio_cd = mmc_gpio_get_cd(mmc);
+        struct sdhci_host *host = mmc_priv(mmc);
+        unsigned long flags;
+        int ret = 0;
+
+        if (!gpio_cd)
+                return 0;
+
+        pm_runtime_get_sync(mmc->parent);
+
+        spin_lock_irqsave(&host->lock, flags);
+
+        if (host->flags & SDHCI_DEVICE_DEAD)
+                goto out;
+
+        ret = !!(sdhci_readl(host, SDHCI_PRESENT_STATE) & SDHCI_CARD_PRESENT);
+out:
+        spin_unlock_irqrestore(&host->lock, flags);
+
+        pm_runtime_mark_last_busy(mmc->parent);
+        pm_runtime_put_autosuspend(mmc->parent);
+
+        return ret;
+}
+
 static int sdhci_acpi_emmc_probe_slot(struct platform_device *pdev,
                                       const char *hid, const char *uid)
 {
@@ -196,6 +223,9 @@ static int sdhci_acpi_sd_probe_slot(struct platform_device *pdev,
 
         /* Platform specific code during sd probe slot goes here */
 
+        if (hid && !strcmp(hid, "80865ACA"))
+                host->mmc_host_ops.get_cd = bxt_get_cd;
+
         return 0;
 }
 
diff --git a/drivers/mmc/host/sdhci-of-at91.c b/drivers/mmc/host/sdhci-of-at91.c
index 7e7d8f0c9438..9cb86fb25976 100644
--- a/drivers/mmc/host/sdhci-of-at91.c
+++ b/drivers/mmc/host/sdhci-of-at91.c
@@ -217,6 +217,7 @@ static int sdhci_at91_probe(struct platform_device *pdev)
 pm_runtime_disable:
         pm_runtime_disable(&pdev->dev);
         pm_runtime_set_suspended(&pdev->dev);
+        pm_runtime_put_noidle(&pdev->dev);
 clocks_disable_unprepare:
         clk_disable_unprepare(priv->gck);
         clk_disable_unprepare(priv->mainck);
diff --git a/drivers/mmc/host/sdhci-pci-core.c b/drivers/mmc/host/sdhci-pci-core.c
index cc851b065d0a..df3b8eced8c4 100644
--- a/drivers/mmc/host/sdhci-pci-core.c
+++ b/drivers/mmc/host/sdhci-pci-core.c
@@ -330,6 +330,33 @@ static void spt_read_drive_strength(struct sdhci_host *host)
         sdhci_pci_spt_drive_strength = 0x10 | ((val >> 12) & 0xf);
 }
 
+static int bxt_get_cd(struct mmc_host *mmc)
+{
+        int gpio_cd = mmc_gpio_get_cd(mmc);
+        struct sdhci_host *host = mmc_priv(mmc);
+        unsigned long flags;
+        int ret = 0;
+
+        if (!gpio_cd)
+                return 0;
+
+        pm_runtime_get_sync(mmc->parent);
+
+        spin_lock_irqsave(&host->lock, flags);
+
+        if (host->flags & SDHCI_DEVICE_DEAD)
+                goto out;
+
+        ret = !!(sdhci_readl(host, SDHCI_PRESENT_STATE) & SDHCI_CARD_PRESENT);
+out:
+        spin_unlock_irqrestore(&host->lock, flags);
+
+        pm_runtime_mark_last_busy(mmc->parent);
+        pm_runtime_put_autosuspend(mmc->parent);
+
+        return ret;
+}
+
 static int byt_emmc_probe_slot(struct sdhci_pci_slot *slot)
 {
         slot->host->mmc->caps |= MMC_CAP_8_BIT_DATA | MMC_CAP_NONREMOVABLE |
@@ -362,6 +389,10 @@ static int byt_sd_probe_slot(struct sdhci_pci_slot *slot)
         slot->cd_con_id = NULL;
         slot->cd_idx = 0;
         slot->cd_override_level = true;
+        if (slot->chip->pdev->device == PCI_DEVICE_ID_INTEL_BXT_SD ||
+            slot->chip->pdev->device == PCI_DEVICE_ID_INTEL_APL_SD)
+                slot->host->mmc_host_ops.get_cd = bxt_get_cd;
+
         return 0;
 }
 
diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
index d622435d1bcc..add9fdfd1d8f 100644
--- a/drivers/mmc/host/sdhci.c
+++ b/drivers/mmc/host/sdhci.c
@@ -1360,7 +1360,7 @@ static void sdhci_request(struct mmc_host *mmc, struct mmc_request *mrq)
         sdhci_runtime_pm_get(host);
 
         /* Firstly check card presence */
-        present = sdhci_do_get_cd(host);
+        present = mmc->ops->get_cd(mmc);
 
         spin_lock_irqsave(&host->lock, flags);
 
@@ -2849,6 +2849,8 @@ struct sdhci_host *sdhci_alloc_host(struct device *dev,
 
         host = mmc_priv(mmc);
         host->mmc = mmc;
+        host->mmc_host_ops = sdhci_ops;
+        mmc->ops = &host->mmc_host_ops;
 
         return host;
 }
@@ -3037,7 +3039,6 @@ int sdhci_add_host(struct sdhci_host *host)
         /*
          * Set host parameters.
          */
-        mmc->ops = &sdhci_ops;
         max_clk = host->max_clk;
 
         if (host->ops->get_min_clock)
diff --git a/drivers/mmc/host/sdhci.h b/drivers/mmc/host/sdhci.h
index 7654ae5d2b4e..0115e9907bf8 100644
--- a/drivers/mmc/host/sdhci.h
+++ b/drivers/mmc/host/sdhci.h
@@ -430,6 +430,7 @@ struct sdhci_host {
 
         /* Internal data */
         struct mmc_host *mmc;   /* MMC structure */
+        struct mmc_host_ops mmc_host_ops;       /* MMC host ops */
         u64 dma_mask;           /* custom DMA mask */
 
 #if defined(CONFIG_LEDS_CLASS) || defined(CONFIG_LEDS_CLASS_MODULE)
diff --git a/drivers/mmc/host/sh_mmcif.c b/drivers/mmc/host/sh_mmcif.c
index 1ca8a1359cbc..6234eab38ff3 100644
--- a/drivers/mmc/host/sh_mmcif.c
+++ b/drivers/mmc/host/sh_mmcif.c
@@ -445,7 +445,7 @@ static void sh_mmcif_request_dma(struct sh_mmcif_host *host)
                                                         pdata->slave_id_rx);
         } else {
                 host->chan_tx = dma_request_slave_channel(dev, "tx");
-                host->chan_tx = dma_request_slave_channel(dev, "rx");
+                host->chan_rx = dma_request_slave_channel(dev, "rx");
         }
         dev_dbg(dev, "%s: got channel TX %p RX %p\n", __func__, host->chan_tx,
                 host->chan_rx);
diff --git a/drivers/mtd/ubi/upd.c b/drivers/mtd/ubi/upd.c
index 2a1b6e037e1a..0134ba32a057 100644
--- a/drivers/mtd/ubi/upd.c
+++ b/drivers/mtd/ubi/upd.c
@@ -193,7 +193,7 @@ int ubi_start_leb_change(struct ubi_device *ubi, struct ubi_volume *vol,
         vol->changing_leb = 1;
         vol->ch_lnum = req->lnum;
 
-        vol->upd_buf = vmalloc(req->bytes);
+        vol->upd_buf = vmalloc(ALIGN((int)req->bytes, ubi->min_io_size));
         if (!vol->upd_buf)
                 return -ENOMEM;
 
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 56b560558884..b7f1a9919033 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -214,6 +214,8 @@ static void bond_uninit(struct net_device *bond_dev);
 static struct rtnl_link_stats64 *bond_get_stats(struct net_device *bond_dev,
                                                 struct rtnl_link_stats64 *stats);
 static void bond_slave_arr_handler(struct work_struct *work);
+static bool bond_time_in_interval(struct bonding *bond, unsigned long last_act,
+                                  int mod);
 
 /*---------------------------- General routines -----------------------------*/
 
@@ -2127,6 +2129,7 @@ static void bond_miimon_commit(struct bonding *bond)
                         continue;
 
                 case BOND_LINK_UP:
+                        bond_update_speed_duplex(slave);
                         bond_set_slave_link_state(slave, BOND_LINK_UP,
                                                   BOND_SLAVE_NOTIFY_NOW);
                         slave->last_link_up = jiffies;
@@ -2459,7 +2462,7 @@ int bond_arp_rcv(const struct sk_buff *skb, struct bonding *bond,
                  struct slave *slave)
 {
         struct arphdr *arp = (struct arphdr *)skb->data;
-        struct slave *curr_active_slave;
+        struct slave *curr_active_slave, *curr_arp_slave;
         unsigned char *arp_ptr;
         __be32 sip, tip;
         int alen, is_arp = skb->protocol == __cpu_to_be16(ETH_P_ARP);
@@ -2506,26 +2509,41 @@ int bond_arp_rcv(const struct sk_buff *skb, struct bonding *bond,
                      &sip, &tip);
 
         curr_active_slave = rcu_dereference(bond->curr_active_slave);
+        curr_arp_slave = rcu_dereference(bond->current_arp_slave);
 
-        /* Backup slaves won't see the ARP reply, but do come through
-         * here for each ARP probe (so we swap the sip/tip to validate
-         * the probe).  In a "redundant switch, common router" type of
-         * configuration, the ARP probe will (hopefully) travel from
-         * the active, through one switch, the router, then the other
-         * switch before reaching the backup.
+        /* We 'trust' the received ARP enough to validate it if:
+         *
+         * (a) the slave receiving the ARP is active (which includes the
+         * current ARP slave, if any), or
+         *
+         * (b) the receiving slave isn't active, but there is a currently
+         * active slave and it received valid arp reply(s) after it became
+         * the currently active slave, or
+         *
+         * (c) there is an ARP slave that sent an ARP during the prior ARP
+         * interval, and we receive an ARP reply on any slave.  We accept
+         * these because switch FDB update delays may deliver the ARP
+         * reply to a slave other than the sender of the ARP request.
          *
-         * We 'trust' the arp requests if there is an active slave and
-         * it received valid arp reply(s) after it became active. This
-         * is done to avoid endless looping when we can't reach the
+         * Note: for (b), backup slaves are receiving the broadcast ARP
+         * request, not a reply.  This request passes from the sending
+         * slave through the L2 switch(es) to the receiving slave.  Since
+         * this is checking the request, sip/tip are swapped for
+         * validation.
+         *
+         * This is done to avoid endless looping when we can't reach the
          * arp_ip_target and fool ourselves with our own arp requests.
          */
-
         if (bond_is_active_slave(slave))
                 bond_validate_arp(bond, slave, sip, tip);
         else if (curr_active_slave &&
                  time_after(slave_last_rx(bond, curr_active_slave),
                             curr_active_slave->last_link_up))
                 bond_validate_arp(bond, slave, tip, sip);
+        else if (curr_arp_slave && (arp->ar_op == htons(ARPOP_REPLY)) &&
+                 bond_time_in_interval(bond,
+                                       dev_trans_start(curr_arp_slave->dev), 1))
+                bond_validate_arp(bond, slave, sip, tip);
 
 out_unlock:
         if (arp != (struct arphdr *)skb->data)
diff --git a/drivers/net/can/spi/mcp251x.c b/drivers/net/can/spi/mcp251x.c
index 575790e8a75a..74a7dfecee27 100644
--- a/drivers/net/can/spi/mcp251x.c
+++ b/drivers/net/can/spi/mcp251x.c
@@ -843,7 +843,7 @@ static irqreturn_t mcp251x_can_ist(int irq, void *dev_id)
                 if (clear_intf)
                         mcp251x_write_bits(spi, CANINTF, clear_intf, 0x00);
 
-                if (eflag)
+                if (eflag & (EFLG_RX0OVR | EFLG_RX1OVR))
                         mcp251x_write_bits(spi, EFLG, eflag, 0x00);
 
                 /* Update can state */
diff --git a/drivers/net/can/usb/ems_usb.c b/drivers/net/can/usb/ems_usb.c
index fc5b75675cd8..eb7192fab593 100644
--- a/drivers/net/can/usb/ems_usb.c
+++ b/drivers/net/can/usb/ems_usb.c
@@ -117,6 +117,9 @@ MODULE_LICENSE("GPL v2");
  */
 #define EMS_USB_ARM7_CLOCK 8000000
 
+#define CPC_TX_QUEUE_TRIGGER_LOW        25
+#define CPC_TX_QUEUE_TRIGGER_HIGH       35
+
 /*
  * CAN-Message representation in a CPC_MSG. Message object type is
  * CPC_MSG_TYPE_CAN_FRAME or CPC_MSG_TYPE_RTR_FRAME or
@@ -278,6 +281,11 @@ static void ems_usb_read_interrupt_callback(struct urb *urb)
         switch (urb->status) {
         case 0:
                 dev->free_slots = dev->intr_in_buffer[1];
+                if(dev->free_slots > CPC_TX_QUEUE_TRIGGER_HIGH){
+                        if (netif_queue_stopped(netdev)){
+                                netif_wake_queue(netdev);
+                        }
+                }
                 break;
 
         case -ECONNRESET: /* unlink */
@@ -526,8 +534,6 @@ static void ems_usb_write_bulk_callback(struct urb *urb)
         /* Release context */
         context->echo_index = MAX_TX_URBS;
 
-        if (netif_queue_stopped(netdev))
-                netif_wake_queue(netdev);
 }
 
 /*
@@ -587,7 +593,7 @@ static int ems_usb_start(struct ems_usb *dev)
         int err, i;
 
         dev->intr_in_buffer[0] = 0;
-        dev->free_slots = 15; /* initial size */
+        dev->free_slots = 50; /* initial size */
 
         for (i = 0; i < MAX_RX_URBS; i++) {
                 struct urb *urb = NULL;
@@ -835,7 +841,7 @@ static netdev_tx_t ems_usb_start_xmit(struct sk_buff *skb, struct net_device *ne
 
                 /* Slow down tx path */
                 if (atomic_read(&dev->active_tx_urbs) >= MAX_TX_URBS ||
-                    dev->free_slots < 5) {
+                    dev->free_slots < CPC_TX_QUEUE_TRIGGER_LOW) {
                         netif_stop_queue(netdev);
                 }
         }
diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c
index 5eee62badf45..cbc99d5649af 100644
--- a/drivers/net/can/usb/gs_usb.c
+++ b/drivers/net/can/usb/gs_usb.c
@@ -826,9 +826,8 @@ static struct gs_can *gs_make_candev(unsigned int channel, struct usb_interface
 static void gs_destroy_candev(struct gs_can *dev)
 {
         unregister_candev(dev->netdev);
-        free_candev(dev->netdev);
         usb_kill_anchored_urbs(&dev->tx_submitted);
-        kfree(dev);
+        free_candev(dev->netdev);
 }
 
 static int gs_usb_probe(struct usb_interface *intf, const struct usb_device_id *id)
@@ -913,12 +912,15 @@ static int gs_usb_probe(struct usb_interface *intf, const struct usb_device_id *
         for (i = 0; i < icount; i++) {
                 dev->canch[i] = gs_make_candev(i, intf);
                 if (IS_ERR_OR_NULL(dev->canch[i])) {
+                        /* save error code to return later */
+                        rc = PTR_ERR(dev->canch[i]);
+
                         /* on failure destroy previously created candevs */
                         icount = i;
-                        for (i = 0; i < icount; i++) {
+                        for (i = 0; i < icount; i++)
                                 gs_destroy_candev(dev->canch[i]);
-                                dev->canch[i] = NULL;
-                        }
+
+                        usb_kill_anchored_urbs(&dev->rx_submitted);
                         kfree(dev);
                         return rc;
                 }
@@ -939,16 +941,12 @@ static void gs_usb_disconnect(struct usb_interface *intf)
                 return;
         }
 
-        for (i = 0; i < GS_MAX_INTF; i++) {
-                struct gs_can *can = dev->canch[i];
-
-                if (!can)
-                        continue;
-
-                gs_destroy_candev(can);
-        }
+        for (i = 0; i < GS_MAX_INTF; i++)
+                if (dev->canch[i])
+                        gs_destroy_candev(dev->canch[i]);
 
         usb_kill_anchored_urbs(&dev->rx_submitted);
+        kfree(dev);
 }
 
 static const struct usb_device_id gs_usb_table[] = {
diff --git a/drivers/net/dsa/mv88e6352.c b/drivers/net/dsa/mv88e6352.c
index cc6c54553418..a47f52f44b0d 100644
--- a/drivers/net/dsa/mv88e6352.c
+++ b/drivers/net/dsa/mv88e6352.c
@@ -25,6 +25,7 @@
 static const struct mv88e6xxx_switch_id mv88e6352_table[] = {
         { PORT_SWITCH_ID_6172, "Marvell 88E6172" },
         { PORT_SWITCH_ID_6176, "Marvell 88E6176" },
+        { PORT_SWITCH_ID_6240, "Marvell 88E6240" },
         { PORT_SWITCH_ID_6320, "Marvell 88E6320" },
         { PORT_SWITCH_ID_6320_A1, "Marvell 88E6320 (A1)" },
         { PORT_SWITCH_ID_6320_A2, "Marvell 88e6320 (A2)" },
diff --git a/drivers/net/dsa/mv88e6xxx.c b/drivers/net/dsa/mv88e6xxx.c
index cf34681af4f6..512c8c0be1b4 100644
--- a/drivers/net/dsa/mv88e6xxx.c
+++ b/drivers/net/dsa/mv88e6xxx.c
@@ -1555,7 +1555,7 @@ static int _mv88e6xxx_port_vlan_del(struct dsa_switch *ds, int port, u16 vid)
 
         if (vlan.vid != vid || !vlan.valid ||
             vlan.data[port] == GLOBAL_VTU_DATA_MEMBER_TAG_NON_MEMBER)
-                return -ENOENT;
+                return -EOPNOTSUPP;
 
         vlan.data[port] = GLOBAL_VTU_DATA_MEMBER_TAG_NON_MEMBER;
 
@@ -1582,6 +1582,7 @@ int mv88e6xxx_port_vlan_del(struct dsa_switch *ds, int port,
                             const struct switchdev_obj_port_vlan *vlan)
 {
         struct mv88e6xxx_priv_state *ps = ds_to_priv(ds);
+        const u16 defpvid = 4000 + ds->index * DSA_MAX_PORTS + port;
         u16 pvid, vid;
         int err = 0;
 
@@ -1597,7 +1598,8 @@ int mv88e6xxx_port_vlan_del(struct dsa_switch *ds, int port,
                         goto unlock;
 
                 if (vid == pvid) {
-                        err = _mv88e6xxx_port_pvid_set(ds, port, 0);
+                        /* restore reserved VLAN ID */
+                        err = _mv88e6xxx_port_pvid_set(ds, port, defpvid);
                         if (err)
                                 goto unlock;
                 }
@@ -1889,26 +1891,20 @@ unlock:
 
 int mv88e6xxx_port_bridge_join(struct dsa_switch *ds, int port, u32 members)
 {
-        struct mv88e6xxx_priv_state *ps = ds_to_priv(ds);
-        const u16 pvid = 4000 + ds->index * DSA_MAX_PORTS + port;
-        int err;
-
-        /* The port joined a bridge, so leave its reserved VLAN */
-        mutex_lock(&ps->smi_mutex);
-        err = _mv88e6xxx_port_vlan_del(ds, port, pvid);
-        if (!err)
-                err = _mv88e6xxx_port_pvid_set(ds, port, 0);
-        mutex_unlock(&ps->smi_mutex);
-        return err;
+        return 0;
 }
 
 int mv88e6xxx_port_bridge_leave(struct dsa_switch *ds, int port, u32 members)
 {
+        return 0;
+}
+
+static int mv88e6xxx_setup_port_default_vlan(struct dsa_switch *ds, int port)
+{
         struct mv88e6xxx_priv_state *ps = ds_to_priv(ds);
         const u16 pvid = 4000 + ds->index * DSA_MAX_PORTS + port;
         int err;
 
-        /* The port left the bridge, so join its reserved VLAN */
         mutex_lock(&ps->smi_mutex);
         err = _mv88e6xxx_port_vlan_add(ds, port, pvid, true);
         if (!err)
@@ -2192,8 +2188,7 @@ int mv88e6xxx_setup_ports(struct dsa_switch *ds)
                 if (dsa_is_cpu_port(ds, i) || dsa_is_dsa_port(ds, i))
                         continue;
 
-                /* setup the unbridged state */
-                ret = mv88e6xxx_port_bridge_leave(ds, i, 0);
+                ret = mv88e6xxx_setup_port_default_vlan(ds, i);
                 if (ret < 0)
                         return ret;
         }
diff --git a/drivers/net/ethernet/3com/3c59x.c b/drivers/net/ethernet/3com/3c59x.c
index 79e1a0282163..17b2126075e0 100644
--- a/drivers/net/ethernet/3com/3c59x.c
+++ b/drivers/net/ethernet/3com/3c59x.c
@@ -2461,7 +2461,7 @@ boomerang_interrupt(int irq, void *dev_id)
                                         int i;
                                         pci_unmap_single(VORTEX_PCI(vp),
                                                         le32_to_cpu(vp->tx_ring[entry].frag[0].addr),
-                                                        le32_to_cpu(vp->tx_ring[entry].frag[0].length),
+                                                        le32_to_cpu(vp->tx_ring[entry].frag[0].length)&0xFFF,
                                                         PCI_DMA_TODEVICE);
 
                                         for (i=1; i<=skb_shinfo(skb)->nr_frags; i++)
diff --git a/drivers/net/ethernet/8390/pcnet_cs.c b/drivers/net/ethernet/8390/pcnet_cs.c
index 2777289a26c0..2f79d29f17f2 100644
--- a/drivers/net/ethernet/8390/pcnet_cs.c
+++ b/drivers/net/ethernet/8390/pcnet_cs.c
@@ -1501,6 +1501,7 @@ static const struct pcmcia_device_id pcnet_ids[] = {
         PCMCIA_DEVICE_MANF_CARD(0x026f, 0x030a),
         PCMCIA_DEVICE_MANF_CARD(0x0274, 0x1103),
         PCMCIA_DEVICE_MANF_CARD(0x0274, 0x1121),
+        PCMCIA_DEVICE_MANF_CARD(0xc001, 0x0009),
         PCMCIA_DEVICE_PROD_ID12("2408LAN", "Ethernet", 0x352fff7f, 0x00b2e941),
         PCMCIA_DEVICE_PROD_ID1234("Socket", "CF 10/100 Ethernet Card", "Revision B", "05/11/06", 0xb38bcc2e, 0x4de88352, 0xeaca6c8d, 0x7e57c22e),
         PCMCIA_DEVICE_PROD_ID123("Cardwell", "PCMCIA", "ETHERNET", 0x9533672e, 0x281f1c5d, 0x3ff7175b),
diff --git a/drivers/net/ethernet/agere/et131x.c b/drivers/net/ethernet/agere/et131x.c
index 3f3bcbea15bd..0907ab6ff309 100644
--- a/drivers/net/ethernet/agere/et131x.c
+++ b/drivers/net/ethernet/agere/et131x.c
@@ -2380,7 +2380,7 @@ static int et131x_tx_dma_memory_alloc(struct et131x_adapter *adapter)
                                                     sizeof(u32),
                                                     &tx_ring->tx_status_pa,
                                                     GFP_KERNEL);
-        if (!tx_ring->tx_status_pa) {
+        if (!tx_ring->tx_status) {
                 dev_err(&adapter->pdev->dev,
                         "Cannot alloc memory for Tx status block\n");
                 return -ENOMEM;
diff --git a/drivers/net/ethernet/altera/altera_tse_main.c b/drivers/net/ethernet/altera/altera_tse_main.c
index 17472851674f..f749e4d389eb 100644
--- a/drivers/net/ethernet/altera/altera_tse_main.c
+++ b/drivers/net/ethernet/altera/altera_tse_main.c
@@ -193,7 +193,6 @@ static void altera_tse_mdio_destroy(struct net_device *dev)
                             priv->mdio->id);
 
         mdiobus_unregister(priv->mdio);
-        kfree(priv->mdio->irq);
         mdiobus_free(priv->mdio);
         priv->mdio = NULL;
 }
diff --git a/drivers/net/ethernet/amd/am79c961a.c b/drivers/net/ethernet/amd/am79c961a.c
index 87e727b921dc..fcdf5dda448f 100644
--- a/drivers/net/ethernet/amd/am79c961a.c
+++ b/drivers/net/ethernet/amd/am79c961a.c
@@ -50,8 +50,8 @@ static const char version[] =
 static void write_rreg(u_long base, u_int reg, u_int val)
 {
         asm volatile(
-        "str%?h %1, [%2]        @ NET_RAP\n\t"
-        "str%?h %0, [%2, #-4]   @ NET_RDP"
+        "strh   %1, [%2]        @ NET_RAP\n\t"
+        "strh   %0, [%2, #-4]   @ NET_RDP"
         :
         : "r" (val), "r" (reg), "r" (ISAIO_BASE + 0x0464));
 }
@@ -60,8 +60,8 @@ static inline unsigned short read_rreg(u_long base_addr, u_int reg)
 {
         unsigned short v;
         asm volatile(
-        "str%?h %1, [%2]        @ NET_RAP\n\t"
-        "ldr%?h %0, [%2, #-4]   @ NET_RDP"
+        "strh   %1, [%2]        @ NET_RAP\n\t"
+        "ldrh   %0, [%2, #-4]   @ NET_RDP"
         : "=r" (v)
         : "r" (reg), "r" (ISAIO_BASE + 0x0464));
         return v;
@@ -70,8 +70,8 @@ static inline unsigned short read_rreg(u_long base_addr, u_int reg)
 static inline void write_ireg(u_long base, u_int reg, u_int val)
 {
         asm volatile(
-        "str%?h %1, [%2]        @ NET_RAP\n\t"
-        "str%?h %0, [%2, #8]    @ NET_IDP"
+        "strh   %1, [%2]        @ NET_RAP\n\t"
+        "strh   %0, [%2, #8]    @ NET_IDP"
         :
         : "r" (val), "r" (reg), "r" (ISAIO_BASE + 0x0464));
 }
@@ -80,8 +80,8 @@ static inline unsigned short read_ireg(u_long base_addr, u_int reg)
 {
         u_short v;
         asm volatile(
-        "str%?h %1, [%2]        @ NAT_RAP\n\t"
-        "ldr%?h %0, [%2, #8]    @ NET_IDP\n\t"
+        "strh   %1, [%2]        @ NAT_RAP\n\t"
+        "ldrh   %0, [%2, #8]    @ NET_IDP\n\t"
         : "=r" (v)
         : "r" (reg), "r" (ISAIO_BASE + 0x0464));
         return v;
@@ -96,7 +96,7 @@ am_writebuffer(struct net_device *dev, u_int offset, unsigned char *buf, unsigne
         offset = ISAMEM_BASE + (offset << 1);
         length = (length + 1) & ~1;
         if ((int)buf & 2) {
-                asm volatile("str%?h    %2, [%0], #4"
+                asm volatile("strh      %2, [%0], #4"
                  : "=&r" (offset) : "0" (offset), "r" (buf[0] | (buf[1] << 8)));
                 buf += 2;
                 length -= 2;
@@ -104,20 +104,20 @@ am_writebuffer(struct net_device *dev, u_int offset, unsigned char *buf, unsigne
         while (length > 8) {
                 register unsigned int tmp asm("r2"), tmp2 asm("r3");
                 asm volatile(
-                        "ldm%?ia        %0!, {%1, %2}"
+                        "ldmia  %0!, {%1, %2}"
                         : "+r" (buf), "=&r" (tmp), "=&r" (tmp2));
                 length -= 8;
                 asm volatile(
-                        "str%?h %1, [%0], #4\n\t"
-                        "mov%?  %1, %1, lsr #16\n\t"
-                        "str%?h %1, [%0], #4\n\t"
-                        "str%?h %2, [%0], #4\n\t"
-                        "mov%?  %2, %2, lsr #16\n\t"
-                        "str%?h %2, [%0], #4"
+                        "strh   %1, [%0], #4\n\t"
+                        "mov    %1, %1, lsr #16\n\t"
+                        "strh   %1, [%0], #4\n\t"
+                        "strh   %2, [%0], #4\n\t"
+                        "mov    %2, %2, lsr #16\n\t"
+                        "strh   %2, [%0], #4"
                 : "+r" (offset), "=&r" (tmp), "=&r" (tmp2));
         }
         while (length > 0) {
-                asm volatile("str%?h    %2, [%0], #4"
+                asm volatile("strh      %2, [%0], #4"
                  : "=&r" (offset) : "0" (offset), "r" (buf[0] | (buf[1] << 8)));
                 buf += 2;
                 length -= 2;
@@ -132,23 +132,23 @@ am_readbuffer(struct net_device *dev, u_int offset, unsigned char *buf, unsigned
         if ((int)buf & 2) {
                 unsigned int tmp;
                 asm volatile(
-                        "ldr%?h %2, [%0], #4\n\t"
-                        "str%?b %2, [%1], #1\n\t"
-                        "mov%?  %2, %2, lsr #8\n\t"
-                        "str%?b %2, [%1], #1"
+                        "ldrh   %2, [%0], #4\n\t"
+                        "strb   %2, [%1], #1\n\t"
+                        "mov    %2, %2, lsr #8\n\t"
+                        "strb   %2, [%1], #1"
                 : "=&r" (offset), "=&r" (buf), "=r" (tmp): "0" (offset), "1" (buf));
                 length -= 2;
         }
         while (length > 8) {
                 register unsigned int tmp asm("r2"), tmp2 asm("r3"), tmp3;
                 asm volatile(
-                        "ldr%?h %2, [%0], #4\n\t"
-                        "ldr%?h %4, [%0], #4\n\t"
-                        "ldr%?h %3, [%0], #4\n\t"
-                        "orr%?  %2, %2, %4, lsl #16\n\t"
-                        "ldr%?h %4, [%0], #4\n\t"
-                        "orr%?  %3, %3, %4, lsl #16\n\t"
-                        "stm%?ia        %1!, {%2, %3}"
+                        "ldrh   %2, [%0], #4\n\t"
+                        "ldrh   %4, [%0], #4\n\t"
+                        "ldrh   %3, [%0], #4\n\t"
+                        "orr    %2, %2, %4, lsl #16\n\t"
+                        "ldrh   %4, [%0], #4\n\t"
+                        "orr    %3, %3, %4, lsl #16\n\t"
+                        "stmia  %1!, {%2, %3}"
                 : "=&r" (offset), "=&r" (buf), "=r" (tmp), "=r" (tmp2), "=r" (tmp3)
                 : "0" (offset), "1" (buf));
                 length -= 8;
@@ -156,10 +156,10 @@ am_readbuffer(struct net_device *dev, u_int offset, unsigned char *buf, unsigned
         while (length > 0) {
                 unsigned int tmp;
                 asm volatile(
-                        "ldr%?h %2, [%0], #4\n\t"
-                        "str%?b %2, [%1], #1\n\t"
-                        "mov%?  %2, %2, lsr #8\n\t"
-                        "str%?b %2, [%1], #1"
+                        "ldrh   %2, [%0], #4\n\t"
+                        "strb   %2, [%1], #1\n\t"
+                        "mov    %2, %2, lsr #8\n\t"
+                        "strb   %2, [%1], #1"
                 : "=&r" (offset), "=&r" (buf), "=r" (tmp) : "0" (offset), "1" (buf));
                 length -= 2;
         }
diff --git a/drivers/net/ethernet/amd/lance.c b/drivers/net/ethernet/amd/lance.c
index 256f590f6bb1..3a7ebfdda57d 100644
--- a/drivers/net/ethernet/amd/lance.c
+++ b/drivers/net/ethernet/amd/lance.c
@@ -547,8 +547,8 @@ static int __init lance_probe1(struct net_device *dev, int ioaddr, int irq, int
         /* Make certain the data structures used by the LANCE are aligned and DMAble. */
 
         lp = kzalloc(sizeof(*lp), GFP_DMA | GFP_KERNEL);
-        if(lp==NULL)
-                return -ENODEV;
+        if (!lp)
+                return -ENOMEM;
         if (lance_debug > 6) printk(" (#0x%05lx)", (unsigned long)lp);
         dev->ml_priv = lp;
         lp->name = chipname;
diff --git a/drivers/net/ethernet/arc/emac_main.c b/drivers/net/ethernet/arc/emac_main.c
index abe1eabc0171..6446af1403f7 100644
--- a/drivers/net/ethernet/arc/emac_main.c
+++ b/drivers/net/ethernet/arc/emac_main.c
@@ -163,7 +163,7 @@ static void arc_emac_tx_clean(struct net_device *ndev)
                 struct sk_buff *skb = tx_buff->skb;
                 unsigned int info = le32_to_cpu(txbd->info);
 
-                if ((info & FOR_EMAC) || !txbd->data)
+                if ((info & FOR_EMAC) || !txbd->data || !skb)
                         break;
 
                 if (unlikely(info & (DROP | DEFR | LTCL | UFLO))) {
@@ -191,6 +191,7 @@ static void arc_emac_tx_clean(struct net_device *ndev)
 
                 txbd->data = 0;
                 txbd->info = 0;
+                tx_buff->skb = NULL;
 
                 *txbd_dirty = (*txbd_dirty + 1) % TX_BD_NUM;
         }
@@ -446,6 +447,9 @@ static int arc_emac_open(struct net_device *ndev)
                 *last_rx_bd = (*last_rx_bd + 1) % RX_BD_NUM;
         }
 
+        priv->txbd_curr = 0;
+        priv->txbd_dirty = 0;
+
         /* Clean Tx BD's */
         memset(priv->txbd, 0, TX_RING_SZ);
 
@@ -514,6 +518,64 @@ static void arc_emac_set_rx_mode(struct net_device *ndev)
 }
 
 /**
+ * arc_free_tx_queue - free skb from tx queue
+ * @ndev:       Pointer to the network device.
+ *
+ * This function must be called while EMAC disable
+ */
+static void arc_free_tx_queue(struct net_device *ndev)
+{
+        struct arc_emac_priv *priv = netdev_priv(ndev);
+        unsigned int i;
+
+        for (i = 0; i < TX_BD_NUM; i++) {
+                struct arc_emac_bd *txbd = &priv->txbd[i];
+                struct buffer_state *tx_buff = &priv->tx_buff[i];
+
+                if (tx_buff->skb) {
+                        dma_unmap_single(&ndev->dev, dma_unmap_addr(tx_buff, addr),
+                                         dma_unmap_len(tx_buff, len), DMA_TO_DEVICE);
+
+                        /* return the sk_buff to system */
+                        dev_kfree_skb_irq(tx_buff->skb);
+                }
+
+                txbd->info = 0;
+                txbd->data = 0;
+                tx_buff->skb = NULL;
+        }
+}
+
+/**
+ * arc_free_rx_queue - free skb from rx queue
+ * @ndev:       Pointer to the network device.
+ *
+ * This function must be called while EMAC disable
+ */
+static void arc_free_rx_queue(struct net_device *ndev)
+{
+        struct arc_emac_priv *priv = netdev_priv(ndev);
+        unsigned int i;
+
+        for (i = 0; i < RX_BD_NUM; i++) {
+                struct arc_emac_bd *rxbd = &priv->rxbd[i];
+                struct buffer_state *rx_buff = &priv->rx_buff[i];
+
+                if (rx_buff->skb) {
+                        dma_unmap_single(&ndev->dev, dma_unmap_addr(rx_buff, addr),
+                                        dma_unmap_len(rx_buff, len), DMA_FROM_DEVICE);
+
+                        /* return the sk_buff to system */
+                        dev_kfree_skb_irq(rx_buff->skb);
+                }
+
+                rxbd->info = 0;
+                rxbd->data = 0;
+                rx_buff->skb = NULL;
+        }
+}
+
+/**
  * arc_emac_stop - Close the network device.
  * @ndev:       Pointer to the network device.
  *
@@ -534,6 +596,10 @@ static int arc_emac_stop(struct net_device *ndev)
         /* Disable EMAC */
         arc_reg_clr(priv, R_CTRL, EN_MASK);
 
+        /* Return the sk_buff to system */
+        arc_free_tx_queue(ndev);
+        arc_free_rx_queue(ndev);
+
         return 0;
 }
 
@@ -610,7 +676,6 @@ static int arc_emac_tx(struct sk_buff *skb, struct net_device *ndev)
         dma_unmap_addr_set(&priv->tx_buff[*txbd_curr], addr, addr);
         dma_unmap_len_set(&priv->tx_buff[*txbd_curr], len, len);
 
-        priv->tx_buff[*txbd_curr].skb = skb;
         priv->txbd[*txbd_curr].data = cpu_to_le32(addr);
 
         /* Make sure pointer to data buffer is set */
@@ -620,6 +685,11 @@ static int arc_emac_tx(struct sk_buff *skb, struct net_device *ndev)
 
         *info = cpu_to_le32(FOR_EMAC | FIRST_OR_LAST_MASK | len);
 
+        /* Make sure info word is set */
+        wmb();
+
+        priv->tx_buff[*txbd_curr].skb = skb;
+
         /* Increment index to point to the next BD */
         *txbd_curr = (*txbd_curr + 1) % TX_BD_NUM;
 
diff --git a/drivers/net/ethernet/aurora/nb8800.c b/drivers/net/ethernet/aurora/nb8800.c
index f71ab2647a3b..08a23e6b60e9 100644
--- a/drivers/net/ethernet/aurora/nb8800.c
+++ b/drivers/net/ethernet/aurora/nb8800.c
@@ -1460,7 +1460,19 @@ static int nb8800_probe(struct platform_device *pdev)
                 goto err_disable_clk;
         }
 
-        priv->phy_node = of_parse_phandle(pdev->dev.of_node, "phy-handle", 0);
+        if (of_phy_is_fixed_link(pdev->dev.of_node)) {
+                ret = of_phy_register_fixed_link(pdev->dev.of_node);
+                if (ret < 0) {
+                        dev_err(&pdev->dev, "bad fixed-link spec\n");
+                        goto err_free_bus;
+                }
+                priv->phy_node = of_node_get(pdev->dev.of_node);
+        }
+
+        if (!priv->phy_node)
+                priv->phy_node = of_parse_phandle(pdev->dev.of_node,
+                                                  "phy-handle", 0);
+
         if (!priv->phy_node) {
                 dev_err(&pdev->dev, "no PHY specified\n");
                 ret = -ENODEV;
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_hsi.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_hsi.h
index 27aa0802d87d..91874d24fd56 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_hsi.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_hsi.h
@@ -4896,9 +4896,9 @@ struct c2s_pri_trans_table_entry {
  * cfc delete event data
  */
 struct cfc_del_event_data {
-        u32 cid;
-        u32 reserved0;
-        u32 reserved1;
+        __le32 cid;
+        __le32 reserved0;
+        __le32 reserved1;
 };
 
 
@@ -5114,15 +5114,9 @@ struct vf_pf_channel_zone_trigger {
  * zone that triggers the in-bound interrupt
  */
 struct trigger_vf_zone {
-#if defined(__BIG_ENDIAN)
-        u16 reserved1;
-        u8 reserved0;
-        struct vf_pf_channel_zone_trigger vf_pf_channel;
-#elif defined(__LITTLE_ENDIAN)
         struct vf_pf_channel_zone_trigger vf_pf_channel;
         u8 reserved0;
         u16 reserved1;
-#endif
         u32 reserved2;
 };
 
@@ -5207,9 +5201,9 @@ struct e2_integ_data {
  * set mac event data
  */
 struct eth_event_data {
-        u32 echo;
-        u32 reserved0;
-        u32 reserved1;
+        __le32 echo;
+        __le32 reserved0;
+        __le32 reserved1;
 };
 
 
@@ -5219,9 +5213,9 @@ struct eth_event_data {
 struct vf_pf_event_data {
         u8 vf_id;
         u8 reserved0;
-        u16 reserved1;
-        u32 msg_addr_lo;
-        u32 msg_addr_hi;
+        __le16 reserved1;
+        __le32 msg_addr_lo;
+        __le32 msg_addr_hi;
 };
 
 /*
@@ -5230,9 +5224,9 @@ struct vf_pf_event_data {
 struct vf_flr_event_data {
         u8 vf_id;
         u8 reserved0;
-        u16 reserved1;
-        u32 reserved2;
-        u32 reserved3;
+        __le16 reserved1;
+        __le32 reserved2;
+        __le32 reserved3;
 };
 
 /*
@@ -5241,9 +5235,9 @@ struct vf_flr_event_data {
 struct malicious_vf_event_data {
         u8 vf_id;
         u8 err_id;
-        u16 reserved1;
-        u32 reserved2;
-        u32 reserved3;
+        __le16 reserved1;
+        __le32 reserved2;
+        __le32 reserved3;
 };
 
 /*
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
index d946bba43726..1fb80100e5e7 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
@@ -6185,26 +6185,80 @@ static int bnx2x_format_ver(u32 num, u8 *str, u16 *len)
                 shift -= 4;
                 digit = ((num & mask) >> shift);
                 if (digit == 0 && remove_leading_zeros) {
-                        mask = mask >> 4;
-                        continue;
-                } else if (digit < 0xa)
-                        *str_ptr = digit + '0';
-                else
-                        *str_ptr = digit - 0xa + 'a';
-                remove_leading_zeros = 0;
-                str_ptr++;
-                (*len)--;
+                        *str_ptr = '0';
+                } else {
+                        if (digit < 0xa)
+                                *str_ptr = digit + '0';
+                        else
+                                *str_ptr = digit - 0xa + 'a';
+
+                        remove_leading_zeros = 0;
+                        str_ptr++;
+                        (*len)--;
+                }
                 mask = mask >> 4;
                 if (shift == 4*4) {
+                        if (remove_leading_zeros) {
+                                str_ptr++;
+                                (*len)--;
+                        }
                         *str_ptr = '.';
                         str_ptr++;
                         (*len)--;
                         remove_leading_zeros = 1;
                 }
         }
+        if (remove_leading_zeros)
+                (*len)--;
         return 0;
 }
 
+static int bnx2x_3_seq_format_ver(u32 num, u8 *str, u16 *len)
+{
+        u8 *str_ptr = str;
+        u32 mask = 0x00f00000;
+        u8 shift = 8*3;
+        u8 digit;
+        u8 remove_leading_zeros = 1;
+
+        if (*len < 10) {
+                /* Need more than 10chars for this format */
+                *str_ptr = '\0';
+                (*len)--;
+                return -EINVAL;
+        }
+
+        while (shift > 0) {
+                shift -= 4;
+                digit = ((num & mask) >> shift);
+                if (digit == 0 && remove_leading_zeros) {
+                        *str_ptr = '0';
+                } else {
+                        if (digit < 0xa)
+                                *str_ptr = digit + '0';
+                        else
+                                *str_ptr = digit - 0xa + 'a';
+
+                        remove_leading_zeros = 0;
+                        str_ptr++;
+                        (*len)--;
+                }
+                mask = mask >> 4;
+                if ((shift == 4*4) || (shift == 4*2)) {
+                        if (remove_leading_zeros) {
+                                str_ptr++;
+                                (*len)--;
+                        }
+                        *str_ptr = '.';
+                        str_ptr++;
+                        (*len)--;
+                        remove_leading_zeros = 1;
+                }
+        }
+        if (remove_leading_zeros)
+                (*len)--;
+        return 0;
+}
 
 static int bnx2x_null_format_ver(u32 spirom_ver, u8 *str, u16 *len)
 {
@@ -9677,8 +9731,9 @@ static void bnx2x_save_848xx_spirom_version(struct bnx2x_phy *phy,
 
         if (bnx2x_is_8483x_8485x(phy)) {
                 bnx2x_cl45_read(bp, phy, MDIO_CTL_DEVAD, 0x400f, &fw_ver1);
-                bnx2x_save_spirom_version(bp, port, fw_ver1 & 0xfff,
-                                phy->ver_addr);
+                if (phy->type != PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM84858)
+                        fw_ver1 &= 0xfff;
+                bnx2x_save_spirom_version(bp, port, fw_ver1, phy->ver_addr);
         } else {
                 /* For 32-bit registers in 848xx, access via MDIO2ARM i/f. */
                 /* (1) set reg 0xc200_0014(SPI_BRIDGE_CTRL_2) to 0x03000000 */
@@ -9732,16 +9787,32 @@ static void bnx2x_save_848xx_spirom_version(struct bnx2x_phy *phy,
 static void bnx2x_848xx_set_led(struct bnx2x *bp,
                                 struct bnx2x_phy *phy)
 {
-        u16 val, offset, i;
+        u16 val, led3_blink_rate, offset, i;
         static struct bnx2x_reg_set reg_set[] = {
                 {MDIO_PMA_DEVAD, MDIO_PMA_REG_8481_LED1_MASK, 0x0080},
                 {MDIO_PMA_DEVAD, MDIO_PMA_REG_8481_LED2_MASK, 0x0018},
                 {MDIO_PMA_DEVAD, MDIO_PMA_REG_8481_LED3_MASK, 0x0006},
-                {MDIO_PMA_DEVAD, MDIO_PMA_REG_8481_LED3_BLINK, 0x0000},
                 {MDIO_PMA_DEVAD, MDIO_PMA_REG_84823_CTL_SLOW_CLK_CNT_HIGH,
                         MDIO_PMA_REG_84823_BLINK_RATE_VAL_15P9HZ},
                 {MDIO_AN_DEVAD, 0xFFFB, 0xFFFD}
         };
+
+        if (phy->type == PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM84858) {
+                /* Set LED5 source */
+                bnx2x_cl45_write(bp, phy,
+                                 MDIO_PMA_DEVAD,
+                                 MDIO_PMA_REG_8481_LED5_MASK,
+                                 0x90);
+                led3_blink_rate = 0x000f;
+        } else {
+                led3_blink_rate = 0x0000;
+        }
+        /* Set LED3 BLINK */
+        bnx2x_cl45_write(bp, phy,
+                         MDIO_PMA_DEVAD,
+                         MDIO_PMA_REG_8481_LED3_BLINK,
+                         led3_blink_rate);
+
         /* PHYC_CTL_LED_CTL */
         bnx2x_cl45_read(bp, phy,
                         MDIO_PMA_DEVAD,
@@ -9749,6 +9820,9 @@ static void bnx2x_848xx_set_led(struct bnx2x *bp,
         val &= 0xFE00;
         val |= 0x0092;
 
+        if (phy->type == PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM84858)
+                val |= 2 << 12; /* LED5 ON based on source */
+
         bnx2x_cl45_write(bp, phy,
                          MDIO_PMA_DEVAD,
                          MDIO_PMA_REG_8481_LINK_SIGNAL, val);
@@ -9762,10 +9836,17 @@ static void bnx2x_848xx_set_led(struct bnx2x *bp,
         else
                 offset = MDIO_PMA_REG_84823_CTL_LED_CTL_1;
 
-        /* stretch_en for LED3*/
+        if (phy->type == PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM84858)
+                val = MDIO_PMA_REG_84858_ALLOW_GPHY_ACT |
+                      MDIO_PMA_REG_84823_LED3_STRETCH_EN;
+        else
+                val = MDIO_PMA_REG_84823_LED3_STRETCH_EN;
+
+        /* stretch_en for LEDs */
         bnx2x_cl45_read_or_write(bp, phy,
-                                 MDIO_PMA_DEVAD, offset,
-                                 MDIO_PMA_REG_84823_LED3_STRETCH_EN);
+                                 MDIO_PMA_DEVAD,
+                                 offset,
+                                 val);
 }
 
 static void bnx2x_848xx_specific_func(struct bnx2x_phy *phy,
@@ -9775,7 +9856,7 @@ static void bnx2x_848xx_specific_func(struct bnx2x_phy *phy,
         struct bnx2x *bp = params->bp;
         switch (action) {
         case PHY_INIT:
-                if (!bnx2x_is_8483x_8485x(phy)) {
+                if (bnx2x_is_8483x_8485x(phy)) {
                         /* Save spirom version */
                         bnx2x_save_848xx_spirom_version(phy, bp, params->port);
                 }
@@ -10036,15 +10117,20 @@ static int bnx2x_84858_cmd_hdlr(struct bnx2x_phy *phy,
 
 static int bnx2x_84833_cmd_hdlr(struct bnx2x_phy *phy,
                                 struct link_params *params, u16 fw_cmd,
-                                u16 cmd_args[], int argc)
+                                u16 cmd_args[], int argc, int process)
 {
         int idx;
         u16 val;
         struct bnx2x *bp = params->bp;
-        /* Write CMD_OPEN_OVERRIDE to STATUS reg */
-        bnx2x_cl45_write(bp, phy, MDIO_CTL_DEVAD,
-                        MDIO_848xx_CMD_HDLR_STATUS,
-                        PHY84833_STATUS_CMD_OPEN_OVERRIDE);
+        int rc = 0;
+
+        if (process == PHY84833_MB_PROCESS2) {
+                /* Write CMD_OPEN_OVERRIDE to STATUS reg */
+                bnx2x_cl45_write(bp, phy, MDIO_CTL_DEVAD,
+                                 MDIO_848xx_CMD_HDLR_STATUS,
+                                 PHY84833_STATUS_CMD_OPEN_OVERRIDE);
+        }
+
         for (idx = 0; idx < PHY848xx_CMDHDLR_WAIT; idx++) {
                 bnx2x_cl45_read(bp, phy, MDIO_CTL_DEVAD,
                                 MDIO_848xx_CMD_HDLR_STATUS, &val);
@@ -10054,15 +10140,27 @@ static int bnx2x_84833_cmd_hdlr(struct bnx2x_phy *phy,
         }
         if (idx >= PHY848xx_CMDHDLR_WAIT) {
                 DP(NETIF_MSG_LINK, "FW cmd: FW not ready.\n");
+                /* if the status is CMD_COMPLETE_PASS or CMD_COMPLETE_ERROR
+                 * clear the status to CMD_CLEAR_COMPLETE
+                 */
+                if (val == PHY84833_STATUS_CMD_COMPLETE_PASS ||
+                    val == PHY84833_STATUS_CMD_COMPLETE_ERROR) {
+                        bnx2x_cl45_write(bp, phy, MDIO_CTL_DEVAD,
+                                         MDIO_848xx_CMD_HDLR_STATUS,
+                                         PHY84833_STATUS_CMD_CLEAR_COMPLETE);
+                }
                 return -EINVAL;
         }
-
-        /* Prepare argument(s) and issue command */
-        for (idx = 0; idx < argc; idx++) {
-                bnx2x_cl45_write(bp, phy, MDIO_CTL_DEVAD,
-                                MDIO_848xx_CMD_HDLR_DATA1 + idx,
-                                cmd_args[idx]);
+        if (process == PHY84833_MB_PROCESS1 ||
+            process == PHY84833_MB_PROCESS2) {
+                /* Prepare argument(s) */
+                for (idx = 0; idx < argc; idx++) {
+                        bnx2x_cl45_write(bp, phy, MDIO_CTL_DEVAD,
+                                         MDIO_848xx_CMD_HDLR_DATA1 + idx,
+                                         cmd_args[idx]);
+                }
         }
+
         bnx2x_cl45_write(bp, phy, MDIO_CTL_DEVAD,
                         MDIO_848xx_CMD_HDLR_COMMAND, fw_cmd);
         for (idx = 0; idx < PHY848xx_CMDHDLR_WAIT; idx++) {
@@ -10076,24 +10174,30 @@ static int bnx2x_84833_cmd_hdlr(struct bnx2x_phy *phy,
         if ((idx >= PHY848xx_CMDHDLR_WAIT) ||
             (val == PHY84833_STATUS_CMD_COMPLETE_ERROR)) {
                 DP(NETIF_MSG_LINK, "FW cmd failed.\n");
-                return -EINVAL;
+                rc = -EINVAL;
         }
-        /* Gather returning data */
-        for (idx = 0; idx < argc; idx++) {
-                bnx2x_cl45_read(bp, phy, MDIO_CTL_DEVAD,
-                                MDIO_848xx_CMD_HDLR_DATA1 + idx,
-                                &cmd_args[idx]);
+        if (process == PHY84833_MB_PROCESS3 && rc == 0) {
+                /* Gather returning data */
+                for (idx = 0; idx < argc; idx++) {
+                        bnx2x_cl45_read(bp, phy, MDIO_CTL_DEVAD,
+                                        MDIO_848xx_CMD_HDLR_DATA1 + idx,
+                                        &cmd_args[idx]);
+                }
         }
-        bnx2x_cl45_write(bp, phy, MDIO_CTL_DEVAD,
-                        MDIO_848xx_CMD_HDLR_STATUS,
-                        PHY84833_STATUS_CMD_CLEAR_COMPLETE);
-        return 0;
+        if (val == PHY84833_STATUS_CMD_COMPLETE_ERROR ||
+            val == PHY84833_STATUS_CMD_COMPLETE_PASS) {
+                bnx2x_cl45_write(bp, phy, MDIO_CTL_DEVAD,
+                                 MDIO_848xx_CMD_HDLR_STATUS,
+                                 PHY84833_STATUS_CMD_CLEAR_COMPLETE);
+        }
+        return rc;
 }
 
 static int bnx2x_848xx_cmd_hdlr(struct bnx2x_phy *phy,
                                 struct link_params *params,
                                 u16 fw_cmd,
-                                u16 cmd_args[], int argc)
+                                           u16 cmd_args[], int argc,
+                                           int process)
 {
         struct bnx2x *bp = params->bp;
 
@@ -10106,7 +10210,7 @@ static int bnx2x_848xx_cmd_hdlr(struct bnx2x_phy *phy,
                                             argc);
         } else {
                 return bnx2x_84833_cmd_hdlr(phy, params, fw_cmd, cmd_args,
-                                            argc);
+                                            argc, process);
         }
 }
 
@@ -10133,7 +10237,7 @@ static int bnx2x_848xx_pair_swap_cfg(struct bnx2x_phy *phy,
 
         status = bnx2x_848xx_cmd_hdlr(phy, params,
                                       PHY848xx_CMD_SET_PAIR_SWAP, data,
-                                      PHY848xx_CMDHDLR_MAX_ARGS);
+                                      2, PHY84833_MB_PROCESS2);
         if (status == 0)
                 DP(NETIF_MSG_LINK, "Pairswap OK, val=0x%x\n", data[1]);
 
@@ -10222,8 +10326,8 @@ static int bnx2x_8483x_disable_eee(struct bnx2x_phy *phy,
         DP(NETIF_MSG_LINK, "Don't Advertise 10GBase-T EEE\n");
 
         /* Prevent Phy from working in EEE and advertising it */
-        rc = bnx2x_848xx_cmd_hdlr(phy, params,
-                                  PHY848xx_CMD_SET_EEE_MODE, &cmd_args, 1);
+        rc = bnx2x_848xx_cmd_hdlr(phy, params, PHY848xx_CMD_SET_EEE_MODE,
+                                  &cmd_args, 1, PHY84833_MB_PROCESS1);
         if (rc) {
                 DP(NETIF_MSG_LINK, "EEE disable failed.\n");
                 return rc;
@@ -10240,8 +10344,8 @@ static int bnx2x_8483x_enable_eee(struct bnx2x_phy *phy,
         struct bnx2x *bp = params->bp;
         u16 cmd_args = 1;
 
-        rc = bnx2x_848xx_cmd_hdlr(phy, params,
-                                  PHY848xx_CMD_SET_EEE_MODE, &cmd_args, 1);
+        rc = bnx2x_848xx_cmd_hdlr(phy, params, PHY848xx_CMD_SET_EEE_MODE,
+                                  &cmd_args, 1, PHY84833_MB_PROCESS1);
         if (rc) {
                 DP(NETIF_MSG_LINK, "EEE enable failed.\n");
                 return rc;
@@ -10362,7 +10466,7 @@ static int bnx2x_848x3_config_init(struct bnx2x_phy *phy,
                 cmd_args[3] = PHY84833_CONSTANT_LATENCY;
                 rc = bnx2x_848xx_cmd_hdlr(phy, params,
                                           PHY848xx_CMD_SET_EEE_MODE, cmd_args,
-                                          PHY848xx_CMDHDLR_MAX_ARGS);
+                                          4, PHY84833_MB_PROCESS1);
                 if (rc)
                         DP(NETIF_MSG_LINK, "Cfg AutogrEEEn failed.\n");
         }
@@ -10416,6 +10520,32 @@ static int bnx2x_848x3_config_init(struct bnx2x_phy *phy,
                 vars->eee_status &= ~SHMEM_EEE_SUPPORTED_MASK;
         }
 
+        if (phy->type == PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM84833) {
+                /* Additional settings for jumbo packets in 1000BASE-T mode */
+                /* Allow rx extended length */
+                bnx2x_cl45_read(bp, phy, MDIO_AN_DEVAD,
+                                MDIO_AN_REG_8481_AUX_CTRL, &val);
+                val |= 0x4000;
+                bnx2x_cl45_write(bp, phy, MDIO_AN_DEVAD,
+                                 MDIO_AN_REG_8481_AUX_CTRL, val);
+                /* TX FIFO Elasticity LSB */
+                bnx2x_cl45_read(bp, phy, MDIO_AN_DEVAD,
+                                MDIO_AN_REG_8481_1G_100T_EXT_CTRL, &val);
+                val |= 0x1;
+                bnx2x_cl45_write(bp, phy, MDIO_AN_DEVAD,
+                                 MDIO_AN_REG_8481_1G_100T_EXT_CTRL, val);
+                /* TX FIFO Elasticity MSB */
+                /* Enable expansion register 0x46 (Pattern Generator status) */
+                bnx2x_cl45_write(bp, phy, MDIO_AN_DEVAD,
+                                 MDIO_AN_REG_8481_EXPANSION_REG_ACCESS, 0xf46);
+
+                bnx2x_cl45_read(bp, phy, MDIO_AN_DEVAD,
+                                MDIO_AN_REG_8481_EXPANSION_REG_RD_RW, &val);
+                val |= 0x4000;
+                bnx2x_cl45_write(bp, phy, MDIO_AN_DEVAD,
+                                 MDIO_AN_REG_8481_EXPANSION_REG_RD_RW, val);
+        }
+
         if (bnx2x_is_8483x_8485x(phy)) {
                 /* Bring PHY out of super isolate mode as the final step. */
                 bnx2x_cl45_read_and_write(bp, phy,
@@ -10555,6 +10685,17 @@ static u8 bnx2x_848xx_read_status(struct bnx2x_phy *phy,
         return link_up;
 }
 
+static int bnx2x_8485x_format_ver(u32 raw_ver, u8 *str, u16 *len)
+{
+        int status = 0;
+        u32 num;
+
+        num = ((raw_ver & 0xF80) >> 7) << 16 | ((raw_ver & 0x7F) << 8) |
+              ((raw_ver & 0xF000) >> 12);
+        status = bnx2x_3_seq_format_ver(num, str, len);
+        return status;
+}
+
 static int bnx2x_848xx_format_ver(u32 raw_ver, u8 *str, u16 *len)
 {
         int status = 0;
@@ -10651,10 +10792,25 @@ static void bnx2x_848xx_set_link_led(struct bnx2x_phy *phy,
                                         0x0);
 
                 } else {
+                        /* LED 1 OFF */
                         bnx2x_cl45_write(bp, phy,
                                          MDIO_PMA_DEVAD,
                                          MDIO_PMA_REG_8481_LED1_MASK,
                                          0x0);
+
+                        if (phy->type ==
+                                PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM84858) {
+                                /* LED 2 OFF */
+                                bnx2x_cl45_write(bp, phy,
+                                                 MDIO_PMA_DEVAD,
+                                                 MDIO_PMA_REG_8481_LED2_MASK,
+                                                 0x0);
+                                /* LED 3 OFF */
+                                bnx2x_cl45_write(bp, phy,
+                                                 MDIO_PMA_DEVAD,
+                                                 MDIO_PMA_REG_8481_LED3_MASK,
+                                                 0x0);
+                        }
                 }
                 break;
         case LED_MODE_FRONT_PANEL_OFF:
@@ -10713,6 +10869,19 @@ static void bnx2x_848xx_set_link_led(struct bnx2x_phy *phy,
                                                  MDIO_PMA_REG_8481_SIGNAL_MASK,
                                                  0x0);
                         }
+                        if (phy->type ==
+                                PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM84858) {
+                                /* LED 2 OFF */
+                                bnx2x_cl45_write(bp, phy,
+                                                 MDIO_PMA_DEVAD,
+                                                 MDIO_PMA_REG_8481_LED2_MASK,
+                                                 0x0);
+                                /* LED 3 OFF */
+                                bnx2x_cl45_write(bp, phy,
+                                                 MDIO_PMA_DEVAD,
+                                                 MDIO_PMA_REG_8481_LED3_MASK,
+                                                 0x0);
+                        }
                 }
                 break;
         case LED_MODE_ON:
@@ -10776,6 +10945,25 @@ static void bnx2x_848xx_set_link_led(struct bnx2x_phy *phy,
                                                 params->port*4,
                                                 NIG_MASK_MI_INT);
                                 }
+                        }
+                        if (phy->type ==
+                            PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM84858) {
+                                /* Tell LED3 to constant on */
+                                bnx2x_cl45_read(bp, phy,
+                                                MDIO_PMA_DEVAD,
+                                                MDIO_PMA_REG_8481_LINK_SIGNAL,
+                                                &val);
+                                val &= ~(7<<6);
+                                val |= (2<<6);  /* A83B[8:6]= 2 */
+                                bnx2x_cl45_write(bp, phy,
+                                                 MDIO_PMA_DEVAD,
+                                                 MDIO_PMA_REG_8481_LINK_SIGNAL,
+                                                 val);
+                                bnx2x_cl45_write(bp, phy,
+                                                 MDIO_PMA_DEVAD,
+                                                 MDIO_PMA_REG_8481_LED3_MASK,
+                                                 0x20);
+                        } else {
                                 bnx2x_cl45_write(bp, phy,
                                                  MDIO_PMA_DEVAD,
                                                  MDIO_PMA_REG_8481_SIGNAL_MASK,
@@ -10854,6 +11042,17 @@ static void bnx2x_848xx_set_link_led(struct bnx2x_phy *phy,
                                          MDIO_PMA_REG_8481_LINK_SIGNAL,
                                          val);
                         if (phy->type ==
+                            PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM84858) {
+                                bnx2x_cl45_write(bp, phy,
+                                                 MDIO_PMA_DEVAD,
+                                                 MDIO_PMA_REG_8481_LED2_MASK,
+                                                 0x18);
+                                bnx2x_cl45_write(bp, phy,
+                                                 MDIO_PMA_DEVAD,
+                                                 MDIO_PMA_REG_8481_LED3_MASK,
+                                                 0x06);
+                        }
+                        if (phy->type ==
                             PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM84834) {
                                 /* Restore LED4 source to external link,
                                  * and re-enable interrupts.
@@ -11982,7 +12181,7 @@ static const struct bnx2x_phy phy_84858 = {
         .read_status    = (read_status_t)bnx2x_848xx_read_status,
         .link_reset     = (link_reset_t)bnx2x_848x3_link_reset,
         .config_loopback = (config_loopback_t)NULL,
-        .format_fw_ver  = (format_fw_ver_t)bnx2x_848xx_format_ver,
+        .format_fw_ver  = (format_fw_ver_t)bnx2x_8485x_format_ver,
         .hw_reset       = (hw_reset_t)bnx2x_84833_hw_reset_phy,
         .set_link_led   = (set_link_led_t)bnx2x_848xx_set_link_led,
         .phy_specific_func = (phy_specific_func_t)bnx2x_848xx_specific_func
@@ -13807,8 +14006,10 @@ void bnx2x_period_func(struct link_params *params, struct link_vars *vars)
         if (CHIP_IS_E3(bp)) {
                 struct bnx2x_phy *phy = &params->phy[INT_PHY];
                 bnx2x_set_aer_mmd(params, phy);
-                if ((phy->supported & SUPPORTED_20000baseKR2_Full) &&
-                    (phy->speed_cap_mask & PORT_HW_CFG_SPEED_CAPABILITY_D0_20G))
+                if (((phy->req_line_speed == SPEED_AUTO_NEG) &&
+                     (phy->speed_cap_mask &
+                      PORT_HW_CFG_SPEED_CAPABILITY_D0_20G)) ||
+                    (phy->req_line_speed == SPEED_20000))
                         bnx2x_check_kr2_wa(params, vars, phy);
                 bnx2x_check_over_curr(params, vars);
                 if (vars->rx_tx_asic_rst)
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index 6c4e3a69976f..2bf9c871144f 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -5280,14 +5280,14 @@ static void bnx2x_handle_classification_eqe(struct bnx2x *bp,
 {
         unsigned long ramrod_flags = 0;
         int rc = 0;
-        u32 cid = elem->message.data.eth_event.echo & BNX2X_SWCID_MASK;
+        u32 echo = le32_to_cpu(elem->message.data.eth_event.echo);
+        u32 cid = echo & BNX2X_SWCID_MASK;
         struct bnx2x_vlan_mac_obj *vlan_mac_obj;
 
         /* Always push next commands out, don't wait here */
         __set_bit(RAMROD_CONT, &ramrod_flags);
 
-        switch (le32_to_cpu((__force __le32)elem->message.data.eth_event.echo)
-                            >> BNX2X_SWCID_SHIFT) {
+        switch (echo >> BNX2X_SWCID_SHIFT) {
         case BNX2X_FILTER_MAC_PENDING:
                 DP(BNX2X_MSG_SP, "Got SETUP_MAC completions\n");
                 if (CNIC_LOADED(bp) && (cid == BNX2X_ISCSI_ETH_CID(bp)))
@@ -5308,8 +5308,7 @@ static void bnx2x_handle_classification_eqe(struct bnx2x *bp,
                 bnx2x_handle_mcast_eqe(bp);
                 return;
         default:
-                BNX2X_ERR("Unsupported classification command: %d\n",
-                          elem->message.data.eth_event.echo);
+                BNX2X_ERR("Unsupported classification command: 0x%x\n", echo);
                 return;
         }
 
@@ -5478,9 +5477,6 @@ static void bnx2x_eq_int(struct bnx2x *bp)
                         goto next_spqe;
                 }
 
-                /* elem CID originates from FW; actually LE */
-                cid = SW_CID((__force __le32)
-                             elem->message.data.cfc_del_event.cid);
                 opcode = elem->message.opcode;
 
                 /* handle eq element */
@@ -5503,6 +5499,10 @@ static void bnx2x_eq_int(struct bnx2x *bp)
                          * we may want to verify here that the bp state is
                          * HALTING
                          */
+
+                        /* elem CID originates from FW; actually LE */
+                        cid = SW_CID(elem->message.data.cfc_del_event.cid);
+
                         DP(BNX2X_MSG_SP,
                            "got delete ramrod for MULTI[%d]\n", cid);
 
@@ -5596,10 +5596,8 @@ static void bnx2x_eq_int(struct bnx2x *bp)
                       BNX2X_STATE_OPENING_WAIT4_PORT):
                 case (EVENT_RING_OPCODE_RSS_UPDATE_RULES |
                       BNX2X_STATE_CLOSING_WAIT4_HALT):
-                        cid = elem->message.data.eth_event.echo &
-                                BNX2X_SWCID_MASK;
                         DP(BNX2X_MSG_SP, "got RSS_UPDATE ramrod. CID %d\n",
-                           cid);
+                           SW_CID(elem->message.data.eth_event.echo));
                         rss_raw->clear_pending(rss_raw);
                         break;
 
@@ -5684,7 +5682,7 @@ static void bnx2x_sp_task(struct work_struct *work)
                 if (status & BNX2X_DEF_SB_IDX) {
                         struct bnx2x_fastpath *fp = bnx2x_fcoe_fp(bp);
 
-                if (FCOE_INIT(bp) &&
+                        if (FCOE_INIT(bp) &&
                             (bnx2x_has_rx_work(fp) || bnx2x_has_tx_work(fp))) {
                                 /* Prevent local bottom-halves from running as
                                  * we are going to change the local NAPI list.
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_reg.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_reg.h
index 4dead49bd5cb..a43dea259b12 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_reg.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_reg.h
@@ -7296,6 +7296,8 @@ Theotherbitsarereservedandshouldbezero*/
 #define MDIO_PMA_REG_84823_CTL_LED_CTL_1                        0xa8e3
 #define MDIO_PMA_REG_84833_CTL_LED_CTL_1                        0xa8ec
 #define MDIO_PMA_REG_84823_LED3_STRETCH_EN                      0x0080
+/* BCM84858 only */
+#define MDIO_PMA_REG_84858_ALLOW_GPHY_ACT                       0x8000
 
 /* BCM84833 only */
 #define MDIO_84833_TOP_CFG_FW_REV                       0x400f
@@ -7337,6 +7339,10 @@ Theotherbitsarereservedandshouldbezero*/
 #define PHY84833_STATUS_CMD_NOT_OPEN_FOR_CMDS           0x0040
 #define PHY84833_STATUS_CMD_CLEAR_COMPLETE              0x0080
 #define PHY84833_STATUS_CMD_OPEN_OVERRIDE               0xa5a5
+/* Mailbox Process */
+#define PHY84833_MB_PROCESS1                            1
+#define PHY84833_MB_PROCESS2                            2
+#define PHY84833_MB_PROCESS3                            3
 
 /* Mailbox status set used by 84858 only */
 #define PHY84858_STATUS_CMD_RECEIVED                    0x0001
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
index 9d027348cd09..632daff117d3 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
@@ -1672,11 +1672,12 @@ void bnx2x_vf_handle_classification_eqe(struct bnx2x *bp,
 {
         unsigned long ramrod_flags = 0;
         int rc = 0;
+        u32 echo = le32_to_cpu(elem->message.data.eth_event.echo);
 
         /* Always push next commands out, don't wait here */
         set_bit(RAMROD_CONT, &ramrod_flags);
 
-        switch (elem->message.data.eth_event.echo >> BNX2X_SWCID_SHIFT) {
+        switch (echo >> BNX2X_SWCID_SHIFT) {
         case BNX2X_FILTER_MAC_PENDING:
                 rc = vfq->mac_obj.complete(bp, &vfq->mac_obj, elem,
                                            &ramrod_flags);
@@ -1686,8 +1687,7 @@ void bnx2x_vf_handle_classification_eqe(struct bnx2x *bp,
                                             &ramrod_flags);
                 break;
         default:
-                BNX2X_ERR("Unsupported classification command: %d\n",
-                          elem->message.data.eth_event.echo);
+                BNX2X_ERR("Unsupported classification command: 0x%x\n", echo);
                 return;
         }
         if (rc < 0)
@@ -1747,16 +1747,14 @@ int bnx2x_iov_eq_sp_event(struct bnx2x *bp, union event_ring_elem *elem)
 
         switch (opcode) {
         case EVENT_RING_OPCODE_CFC_DEL:
-                cid = SW_CID((__force __le32)
-                             elem->message.data.cfc_del_event.cid);
+                cid = SW_CID(elem->message.data.cfc_del_event.cid);
                 DP(BNX2X_MSG_IOV, "checking cfc-del comp cid=%d\n", cid);
                 break;
         case EVENT_RING_OPCODE_CLASSIFICATION_RULES:
         case EVENT_RING_OPCODE_MULTICAST_RULES:
         case EVENT_RING_OPCODE_FILTERS_RULES:
         case EVENT_RING_OPCODE_RSS_UPDATE_RULES:
-                cid = (elem->message.data.eth_event.echo &
-                       BNX2X_SWCID_MASK);
+                cid = SW_CID(elem->message.data.eth_event.echo);
                 DP(BNX2X_MSG_IOV, "checking filtering comp cid=%d\n", cid);
                 break;
         case EVENT_RING_OPCODE_VF_FLR:
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c
index 1374e5394a79..bfae300cf25f 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c
@@ -2187,8 +2187,10 @@ void bnx2x_vf_mbx_schedule(struct bnx2x *bp,
 
         /* Update VFDB with current message and schedule its handling */
         mutex_lock(&BP_VFDB(bp)->event_mutex);
-        BP_VF_MBX(bp, vf_idx)->vf_addr_hi = vfpf_event->msg_addr_hi;
-        BP_VF_MBX(bp, vf_idx)->vf_addr_lo = vfpf_event->msg_addr_lo;
+        BP_VF_MBX(bp, vf_idx)->vf_addr_hi =
+                le32_to_cpu(vfpf_event->msg_addr_hi);
+        BP_VF_MBX(bp, vf_idx)->vf_addr_lo =
+                le32_to_cpu(vfpf_event->msg_addr_lo);
         BP_VFDB(bp)->event_occur |= (1ULL << vf_idx);
         mutex_unlock(&BP_VFDB(bp)->event_mutex);
 
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index 5dc89e527e7d..82f191382989 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -69,7 +69,7 @@ MODULE_VERSION(DRV_MODULE_VERSION);
 #define BNXT_RX_DMA_OFFSET NET_SKB_PAD
 #define BNXT_RX_COPY_THRESH 256
 
-#define BNXT_TX_PUSH_THRESH 92
+#define BNXT_TX_PUSH_THRESH 164
 
 enum board_idx {
         BCM57301,
@@ -223,11 +223,12 @@ static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev)
         }
 
         if (free_size == bp->tx_ring_size && length <= bp->tx_push_thresh) {
-                struct tx_push_bd *push = txr->tx_push;
-                struct tx_bd *tx_push = &push->txbd1;
-                struct tx_bd_ext *tx_push1 = &push->txbd2;
-                void *pdata = tx_push1 + 1;
-                int j;
+                struct tx_push_buffer *tx_push_buf = txr->tx_push;
+                struct tx_push_bd *tx_push = &tx_push_buf->push_bd;
+                struct tx_bd_ext *tx_push1 = &tx_push->txbd2;
+                void *pdata = tx_push_buf->data;
+                u64 *end;
+                int j, push_len;
 
                 /* Set COAL_NOW to be ready quickly for the next push */
                 tx_push->tx_bd_len_flags_type =
@@ -247,6 +248,10 @@ static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 tx_push1->tx_bd_cfa_meta = cpu_to_le32(vlan_tag_flags);
                 tx_push1->tx_bd_cfa_action = cpu_to_le32(cfa_action);
 
+                end = pdata + length;
+                end = PTR_ALIGN(end, 8) - 1;
+                *end = 0;
+
                 skb_copy_from_linear_data(skb, pdata, len);
                 pdata += len;
                 for (j = 0; j < last_frag; j++) {
@@ -261,22 +266,29 @@ static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev)
                         pdata += skb_frag_size(frag);
                 }
 
-                memcpy(txbd, tx_push, sizeof(*txbd));
+                txbd->tx_bd_len_flags_type = tx_push->tx_bd_len_flags_type;
+                txbd->tx_bd_haddr = txr->data_mapping;
                 prod = NEXT_TX(prod);
                 txbd = &txr->tx_desc_ring[TX_RING(prod)][TX_IDX(prod)];
                 memcpy(txbd, tx_push1, sizeof(*txbd));
                 prod = NEXT_TX(prod);
-                push->doorbell =
+                tx_push->doorbell =
                         cpu_to_le32(DB_KEY_TX_PUSH | DB_LONG_TX_PUSH | prod);
                 txr->tx_prod = prod;
 
                 netdev_tx_sent_queue(txq, skb->len);
 
-                __iowrite64_copy(txr->tx_doorbell, push,
-                                 (length + sizeof(*push) + 8) / 8);
+                push_len = (length + sizeof(*tx_push) + 7) / 8;
+                if (push_len > 16) {
+                        __iowrite64_copy(txr->tx_doorbell, tx_push_buf, 16);
+                        __iowrite64_copy(txr->tx_doorbell + 4, tx_push_buf + 1,
+                                         push_len - 16);
+                } else {
+                        __iowrite64_copy(txr->tx_doorbell, tx_push_buf,
+                                         push_len);
+                }
 
                 tx_buf->is_push = 1;
-
                 goto tx_done;
         }
 
@@ -1753,7 +1765,7 @@ static int bnxt_alloc_tx_rings(struct bnxt *bp)
                 push_size  = L1_CACHE_ALIGN(sizeof(struct tx_push_bd) +
                                         bp->tx_push_thresh);
 
-                if (push_size > 128) {
+                if (push_size > 256) {
                         push_size = 0;
                         bp->tx_push_thresh = 0;
                 }
@@ -1772,7 +1784,6 @@ static int bnxt_alloc_tx_rings(struct bnxt *bp)
                         return rc;
 
                 if (bp->tx_push_size) {
-                        struct tx_bd *txbd;
                         dma_addr_t mapping;
 
                         /* One pre-allocated DMA buffer to backup
@@ -1786,13 +1797,11 @@ static int bnxt_alloc_tx_rings(struct bnxt *bp)
                         if (!txr->tx_push)
                                 return -ENOMEM;
 
-                        txbd = &txr->tx_push->txbd1;
-
                         mapping = txr->tx_push_mapping +
                                 sizeof(struct tx_push_bd);
-                        txbd->tx_bd_haddr = cpu_to_le64(mapping);
+                        txr->data_mapping = cpu_to_le64(mapping);
 
-                        memset(txbd + 1, 0, sizeof(struct tx_bd_ext));
+                        memset(txr->tx_push, 0, sizeof(struct tx_push_bd));
                 }
                 ring->queue_id = bp->q_info[j].queue_id;
                 if (i % bp->tx_nr_rings_per_tc == (bp->tx_nr_rings_per_tc - 1))
@@ -4546,20 +4555,18 @@ static int bnxt_update_phy_setting(struct bnxt *bp)
         if (!(link_info->autoneg & BNXT_AUTONEG_FLOW_CTRL) &&
             link_info->force_pause_setting != link_info->req_flow_ctrl)
                 update_pause = true;
-        if (link_info->req_duplex != link_info->duplex_setting)
-                update_link = true;
         if (!(link_info->autoneg & BNXT_AUTONEG_SPEED)) {
                 if (BNXT_AUTO_MODE(link_info->auto_mode))
                         update_link = true;
                 if (link_info->req_link_speed != link_info->force_link_speed)
                         update_link = true;
+                if (link_info->req_duplex != link_info->duplex_setting)
+                        update_link = true;
         } else {
                 if (link_info->auto_mode == BNXT_LINK_AUTO_NONE)
                         update_link = true;
                 if (link_info->advertising != link_info->auto_link_speeds)
                         update_link = true;
-                if (link_info->req_link_speed != link_info->auto_link_speed)
-                        update_link = true;
         }
 
         if (update_link)
@@ -4636,7 +4643,7 @@ static int __bnxt_open_nic(struct bnxt *bp, bool irq_re_init, bool link_re_init)
         if (link_re_init) {
                 rc = bnxt_update_phy_setting(bp);
                 if (rc)
-                        goto open_err;
+                        netdev_warn(bp->dev, "failed to update phy settings\n");
         }
 
         if (irq_re_init) {
@@ -4654,6 +4661,7 @@ static int __bnxt_open_nic(struct bnxt *bp, bool irq_re_init, bool link_re_init)
         /* Enable TX queues */
         bnxt_tx_enable(bp);
         mod_timer(&bp->timer, jiffies + bp->current_interval);
+        bnxt_update_link(bp, true);
 
         return 0;
 
@@ -5670,22 +5678,16 @@ static int bnxt_probe_phy(struct bnxt *bp)
         }
 
         /*initialize the ethool setting copy with NVM settings */
-        if (BNXT_AUTO_MODE(link_info->auto_mode))
-                link_info->autoneg |= BNXT_AUTONEG_SPEED;
-
-        if (link_info->auto_pause_setting & BNXT_LINK_PAUSE_BOTH) {
-                if (link_info->auto_pause_setting == BNXT_LINK_PAUSE_BOTH)
-                        link_info->autoneg |= BNXT_AUTONEG_FLOW_CTRL;
+        if (BNXT_AUTO_MODE(link_info->auto_mode)) {
+                link_info->autoneg = BNXT_AUTONEG_SPEED |
+                                     BNXT_AUTONEG_FLOW_CTRL;
+                link_info->advertising = link_info->auto_link_speeds;
                 link_info->req_flow_ctrl = link_info->auto_pause_setting;
-        } else if (link_info->force_pause_setting & BNXT_LINK_PAUSE_BOTH) {
+        } else {
+                link_info->req_link_speed = link_info->force_link_speed;
+                link_info->req_duplex = link_info->duplex_setting;
                 link_info->req_flow_ctrl = link_info->force_pause_setting;
         }
-        link_info->req_duplex = link_info->duplex_setting;
-        if (link_info->autoneg & BNXT_AUTONEG_SPEED)
-                link_info->req_link_speed = link_info->auto_link_speed;
-        else
-                link_info->req_link_speed = link_info->force_link_speed;
-        link_info->advertising = link_info->auto_link_speeds;
         snprintf(phy_ver, PHY_VER_STR_LEN, " ph %d.%d.%d",
                  link_info->phy_ver[0],
                  link_info->phy_ver[1],
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
index 8af3ca8efcef..2be51b332652 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
@@ -411,8 +411,8 @@ struct rx_tpa_end_cmp_ext {
 
 #define BNXT_NUM_TESTS(bp)      0
 
-#define BNXT_DEFAULT_RX_RING_SIZE       1023
-#define BNXT_DEFAULT_TX_RING_SIZE       512
+#define BNXT_DEFAULT_RX_RING_SIZE       511
+#define BNXT_DEFAULT_TX_RING_SIZE       511
 
 #define MAX_TPA         64
 
@@ -523,10 +523,16 @@ struct bnxt_ring_struct {
 
 struct tx_push_bd {
         __le32                  doorbell;
-        struct tx_bd            txbd1;
+        __le32                  tx_bd_len_flags_type;
+        u32                     tx_bd_opaque;
         struct tx_bd_ext        txbd2;
 };
 
+struct tx_push_buffer {
+        struct tx_push_bd       push_bd;
+        u32                     data[25];
+};
+
 struct bnxt_tx_ring_info {
         struct bnxt_napi        *bnapi;
         u16                     tx_prod;
@@ -538,8 +544,9 @@ struct bnxt_tx_ring_info {
 
         dma_addr_t              tx_desc_mapping[MAX_TX_PAGES];
 
-        struct tx_push_bd       *tx_push;
+        struct tx_push_buffer   *tx_push;
         dma_addr_t              tx_push_mapping;
+        __le64                  data_mapping;
 
 #define BNXT_DEV_STATE_CLOSING  0x1
         u32                     dev_state;
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
index 922b898e7a32..3238817dfd5f 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
@@ -486,15 +486,8 @@ static u32 bnxt_fw_to_ethtool_support_spds(struct bnxt_link_info *link_info)
                 speed_mask |= SUPPORTED_2500baseX_Full;
         if (fw_speeds & BNXT_LINK_SPEED_MSK_10GB)
                 speed_mask |= SUPPORTED_10000baseT_Full;
-        /* TODO: support 25GB, 50GB with different cable type */
-        if (fw_speeds & BNXT_LINK_SPEED_MSK_20GB)
-                speed_mask |= SUPPORTED_20000baseMLD2_Full |
-                        SUPPORTED_20000baseKR2_Full;
         if (fw_speeds & BNXT_LINK_SPEED_MSK_40GB)
-                speed_mask |= SUPPORTED_40000baseKR4_Full |
-                        SUPPORTED_40000baseCR4_Full |
-                        SUPPORTED_40000baseSR4_Full |
-                        SUPPORTED_40000baseLR4_Full;
+                speed_mask |= SUPPORTED_40000baseCR4_Full;
 
         return speed_mask;
 }
@@ -514,15 +507,8 @@ static u32 bnxt_fw_to_ethtool_advertised_spds(struct bnxt_link_info *link_info)
                 speed_mask |= ADVERTISED_2500baseX_Full;
         if (fw_speeds & BNXT_LINK_SPEED_MSK_10GB)
                 speed_mask |= ADVERTISED_10000baseT_Full;
-        /* TODO: how to advertise 20, 25, 40, 50GB with different cable type ?*/
-        if (fw_speeds & BNXT_LINK_SPEED_MSK_20GB)
-                speed_mask |= ADVERTISED_20000baseMLD2_Full |
-                              ADVERTISED_20000baseKR2_Full;
         if (fw_speeds & BNXT_LINK_SPEED_MSK_40GB)
-                speed_mask |= ADVERTISED_40000baseKR4_Full |
-                              ADVERTISED_40000baseCR4_Full |
-                              ADVERTISED_40000baseSR4_Full |
-                              ADVERTISED_40000baseLR4_Full;
+                speed_mask |= ADVERTISED_40000baseCR4_Full;
         return speed_mask;
 }
 
@@ -557,11 +543,12 @@ static int bnxt_get_settings(struct net_device *dev, struct ethtool_cmd *cmd)
         u16 ethtool_speed;
 
         cmd->supported = bnxt_fw_to_ethtool_support_spds(link_info);
+        cmd->supported |= SUPPORTED_Pause | SUPPORTED_Asym_Pause;
 
         if (link_info->auto_link_speeds)
                 cmd->supported |= SUPPORTED_Autoneg;
 
-        if (BNXT_AUTO_MODE(link_info->auto_mode)) {
+        if (link_info->autoneg) {
                 cmd->advertising =
                         bnxt_fw_to_ethtool_advertised_spds(link_info);
                 cmd->advertising |= ADVERTISED_Autoneg;
@@ -570,28 +557,16 @@ static int bnxt_get_settings(struct net_device *dev, struct ethtool_cmd *cmd)
                 cmd->autoneg = AUTONEG_DISABLE;
                 cmd->advertising = 0;
         }
-        if (link_info->auto_pause_setting & BNXT_LINK_PAUSE_BOTH) {
+        if (link_info->autoneg & BNXT_AUTONEG_FLOW_CTRL) {
                 if ((link_info->auto_pause_setting & BNXT_LINK_PAUSE_BOTH) ==
                     BNXT_LINK_PAUSE_BOTH) {
                         cmd->advertising |= ADVERTISED_Pause;
-                        cmd->supported |= SUPPORTED_Pause;
                 } else {
                         cmd->advertising |= ADVERTISED_Asym_Pause;
-                        cmd->supported |= SUPPORTED_Asym_Pause;
                         if (link_info->auto_pause_setting &
                             BNXT_LINK_PAUSE_RX)
                                 cmd->advertising |= ADVERTISED_Pause;
                 }
-        } else if (link_info->force_pause_setting & BNXT_LINK_PAUSE_BOTH) {
-                if ((link_info->force_pause_setting & BNXT_LINK_PAUSE_BOTH) ==
-                    BNXT_LINK_PAUSE_BOTH) {
-                        cmd->supported |= SUPPORTED_Pause;
-                } else {
-                        cmd->supported |= SUPPORTED_Asym_Pause;
-                        if (link_info->force_pause_setting &
-                            BNXT_LINK_PAUSE_RX)
-                                cmd->supported |= SUPPORTED_Pause;
-                }
         }
 
         cmd->port = PORT_NONE;
@@ -670,6 +645,9 @@ static u16 bnxt_get_fw_auto_link_speeds(u32 advertising)
         if (advertising & ADVERTISED_10000baseT_Full)
                 fw_speed_mask |= BNXT_LINK_SPEED_MSK_10GB;
 
+        if (advertising & ADVERTISED_40000baseCR4_Full)
+                fw_speed_mask |= BNXT_LINK_SPEED_MSK_40GB;
+
         return fw_speed_mask;
 }
 
@@ -729,7 +707,7 @@ static int bnxt_set_settings(struct net_device *dev, struct ethtool_cmd *cmd)
                 speed = ethtool_cmd_speed(cmd);
                 link_info->req_link_speed = bnxt_get_fw_speed(dev, speed);
                 link_info->req_duplex = BNXT_LINK_DUPLEX_FULL;
-                link_info->autoneg &= ~BNXT_AUTONEG_SPEED;
+                link_info->autoneg = 0;
                 link_info->advertising = 0;
         }
 
@@ -748,8 +726,7 @@ static void bnxt_get_pauseparam(struct net_device *dev,
 
         if (BNXT_VF(bp))
                 return;
-        epause->autoneg = !!(link_info->auto_pause_setting &
-                             BNXT_LINK_PAUSE_BOTH);
+        epause->autoneg = !!(link_info->autoneg & BNXT_AUTONEG_FLOW_CTRL);
         epause->rx_pause = ((link_info->pause & BNXT_LINK_PAUSE_RX) != 0);
         epause->tx_pause = ((link_info->pause & BNXT_LINK_PAUSE_TX) != 0);
 }
@@ -765,6 +742,9 @@ static int bnxt_set_pauseparam(struct net_device *dev,
                 return rc;
 
         if (epause->autoneg) {
+                if (!(link_info->autoneg & BNXT_AUTONEG_SPEED))
+                        return -EINVAL;
+
                 link_info->autoneg |= BNXT_AUTONEG_FLOW_CTRL;
                 link_info->req_flow_ctrl |= BNXT_LINK_PAUSE_BOTH;
         } else {
diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
index b15a60d787c7..d7e01a74e927 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
@@ -2445,8 +2445,7 @@ static void bcmgenet_irq_task(struct work_struct *work)
         }
 
         /* Link UP/DOWN event */
-        if ((priv->hw_params->flags & GENET_HAS_MDIO_INTR) &&
-            (priv->irq0_stat & UMAC_IRQ_LINK_EVENT)) {
+        if (priv->irq0_stat & UMAC_IRQ_LINK_EVENT) {
                 phy_mac_interrupt(priv->phydev,
                                   !!(priv->irq0_stat & UMAC_IRQ_LINK_UP));
                 priv->irq0_stat &= ~UMAC_IRQ_LINK_EVENT;
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index 49eea8981332..3010080cfeee 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -7831,6 +7831,14 @@ static int tigon3_dma_hwbug_workaround(struct tg3_napi *tnapi,
         return ret;
 }
 
+static bool tg3_tso_bug_gso_check(struct tg3_napi *tnapi, struct sk_buff *skb)
+{
+        /* Check if we will never have enough descriptors,
+         * as gso_segs can be more than current ring size
+         */
+        return skb_shinfo(skb)->gso_segs < tnapi->tx_pending / 3;
+}
+
 static netdev_tx_t tg3_start_xmit(struct sk_buff *, struct net_device *);
 
 /* Use GSO to workaround all TSO packets that meet HW bug conditions
@@ -7934,14 +7942,19 @@ static netdev_tx_t tg3_start_xmit(struct sk_buff *skb, struct net_device *dev)
                  * vlan encapsulated.
                  */
                 if (skb->protocol == htons(ETH_P_8021Q) ||
-                    skb->protocol == htons(ETH_P_8021AD))
-                        return tg3_tso_bug(tp, tnapi, txq, skb);
+                    skb->protocol == htons(ETH_P_8021AD)) {
+                        if (tg3_tso_bug_gso_check(tnapi, skb))
+                                return tg3_tso_bug(tp, tnapi, txq, skb);
+                        goto drop;
+                }
 
                 if (!skb_is_gso_v6(skb)) {
                         if (unlikely((ETH_HLEN + hdr_len) > 80) &&
-                            tg3_flag(tp, TSO_BUG))
-                                return tg3_tso_bug(tp, tnapi, txq, skb);
-
+                            tg3_flag(tp, TSO_BUG)) {
+                                if (tg3_tso_bug_gso_check(tnapi, skb))
+                                        return tg3_tso_bug(tp, tnapi, txq, skb);
+                                goto drop;
+                        }
                         ip_csum = iph->check;
                         ip_tot_len = iph->tot_len;
                         iph->check = 0;
@@ -8073,7 +8086,7 @@ static netdev_tx_t tg3_start_xmit(struct sk_buff *skb, struct net_device *dev)
         if (would_hit_hwbug) {
                 tg3_tx_skb_unmap(tnapi, tnapi->tx_prod, i);
 
-                if (mss) {
+                if (mss && tg3_tso_bug_gso_check(tnapi, skb)) {
                         /* If it's a TSO packet, do GSO instead of
                          * allocating and copying to a large linear SKB
                          */
diff --git a/drivers/net/ethernet/brocade/bna/bna_tx_rx.c b/drivers/net/ethernet/brocade/bna/bna_tx_rx.c
index 04b0d16b210e..95bc470ae441 100644
--- a/drivers/net/ethernet/brocade/bna/bna_tx_rx.c
+++ b/drivers/net/ethernet/brocade/bna/bna_tx_rx.c
@@ -987,7 +987,7 @@ bna_rxf_ucast_cfg_apply(struct bna_rxf *rxf)
         if (!list_empty(&rxf->ucast_pending_add_q)) {
                 mac = list_first_entry(&rxf->ucast_pending_add_q,
                                        struct bna_mac, qe);
-                list_add_tail(&mac->qe, &rxf->ucast_active_q);
+                list_move_tail(&mac->qe, &rxf->ucast_active_q);
                 bna_bfi_ucast_req(rxf, mac, BFI_ENET_H2I_MAC_UCAST_ADD_REQ);
                 return 1;
         }
diff --git a/drivers/net/ethernet/cavium/liquidio/lio_main.c b/drivers/net/ethernet/cavium/liquidio/lio_main.c
index 872765527081..34d269cd5579 100644
--- a/drivers/net/ethernet/cavium/liquidio/lio_main.c
+++ b/drivers/net/ethernet/cavium/liquidio/lio_main.c
@@ -1683,7 +1683,7 @@ static int octeon_setup_droq(struct octeon_device *oct, int q_no, int num_descs,
         dev_dbg(&oct->pci_dev->dev, "Creating Droq: %d\n", q_no);
         /* droq creation and local register settings. */
         ret_val = octeon_create_droq(oct, q_no, num_descs, desc_size, app_ctx);
-        if (ret_val == -1)
+        if (ret_val < 0)
                 return ret_val;
 
         if (ret_val == 1) {
@@ -2524,7 +2524,7 @@ static void handle_timestamp(struct octeon_device *oct,
 
         octeon_swap_8B_data(&resp->timestamp, 1);
 
-        if (unlikely((skb_shinfo(skb)->tx_flags | SKBTX_IN_PROGRESS) != 0)) {
+        if (unlikely((skb_shinfo(skb)->tx_flags & SKBTX_IN_PROGRESS) != 0)) {
                 struct skb_shared_hwtstamps ts;
                 u64 ns = resp->timestamp;
 
diff --git a/drivers/net/ethernet/cavium/liquidio/octeon_droq.c b/drivers/net/ethernet/cavium/liquidio/octeon_droq.c
index 4dba86eaa045..174072b3740b 100644
--- a/drivers/net/ethernet/cavium/liquidio/octeon_droq.c
+++ b/drivers/net/ethernet/cavium/liquidio/octeon_droq.c
@@ -983,5 +983,5 @@ int octeon_create_droq(struct octeon_device *oct,
 
 create_droq_fail:
         octeon_delete_droq(oct, q_no);
-        return -1;
+        return -ENOMEM;
 }
diff --git a/drivers/net/ethernet/cavium/thunder/nic.h b/drivers/net/ethernet/cavium/thunder/nic.h
index 688828865c48..34e9acea8747 100644
--- a/drivers/net/ethernet/cavium/thunder/nic.h
+++ b/drivers/net/ethernet/cavium/thunder/nic.h
@@ -116,6 +116,15 @@
 #define NIC_PF_INTR_ID_MBOX0            8
 #define NIC_PF_INTR_ID_MBOX1            9
 
+/* Minimum FIFO level before all packets for the CQ are dropped
+ *
+ * This value ensures that once a packet has been "accepted"
+ * for reception it will not get dropped due to non-availability
+ * of CQ descriptor. An errata in HW mandates this value to be
+ * atleast 0x100.
+ */
+#define NICPF_CQM_MIN_DROP_LEVEL       0x100
+
 /* Global timer for CQ timer thresh interrupts
  * Calculated for SCLK of 700Mhz
  * value written should be a 1/16th of what is expected
diff --git a/drivers/net/ethernet/cavium/thunder/nic_main.c b/drivers/net/ethernet/cavium/thunder/nic_main.c
index 4dded90076c8..95f17f8cadac 100644
--- a/drivers/net/ethernet/cavium/thunder/nic_main.c
+++ b/drivers/net/ethernet/cavium/thunder/nic_main.c
@@ -304,6 +304,7 @@ static void nic_set_lmac_vf_mapping(struct nicpf *nic)
 static void nic_init_hw(struct nicpf *nic)
 {
         int i;
+        u64 cqm_cfg;
 
         /* Enable NIC HW block */
         nic_reg_write(nic, NIC_PF_CFG, 0x3);
@@ -340,6 +341,11 @@ static void nic_init_hw(struct nicpf *nic)
         /* Enable VLAN ethertype matching and stripping */
         nic_reg_write(nic, NIC_PF_RX_ETYPE_0_7,
                       (2 << 19) | (ETYPE_ALG_VLAN_STRIP << 16) | ETH_P_8021Q);
+
+        /* Check if HW expected value is higher (could be in future chips) */
+        cqm_cfg = nic_reg_read(nic, NIC_PF_CQM_CFG);
+        if (cqm_cfg < NICPF_CQM_MIN_DROP_LEVEL)
+                nic_reg_write(nic, NIC_PF_CQM_CFG, NICPF_CQM_MIN_DROP_LEVEL);
 }
 
 /* Channel parse index configuration */
diff --git a/drivers/net/ethernet/cavium/thunder/nic_reg.h b/drivers/net/ethernet/cavium/thunder/nic_reg.h
index dd536be20193..afb10e326b4f 100644
--- a/drivers/net/ethernet/cavium/thunder/nic_reg.h
+++ b/drivers/net/ethernet/cavium/thunder/nic_reg.h
@@ -21,7 +21,7 @@
 #define   NIC_PF_TCP_TIMER                      (0x0060)
 #define   NIC_PF_BP_CFG                         (0x0080)
 #define   NIC_PF_RRM_CFG                        (0x0088)
-#define   NIC_PF_CQM_CF                         (0x00A0)
+#define   NIC_PF_CQM_CFG                        (0x00A0)
 #define   NIC_PF_CNM_CF                         (0x00A8)
 #define   NIC_PF_CNM_STATUS                     (0x00B0)
 #define   NIC_PF_CQ_AVG_CFG                     (0x00C0)
diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_main.c b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
index c24cb2a86a42..a009bc30dc4d 100644
--- a/drivers/net/ethernet/cavium/thunder/nicvf_main.c
+++ b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
@@ -574,8 +574,7 @@ static inline void nicvf_set_rxhash(struct net_device *netdev,
 
 static void nicvf_rcv_pkt_handler(struct net_device *netdev,
                                   struct napi_struct *napi,
-                                  struct cmp_queue *cq,
-                                  struct cqe_rx_t *cqe_rx, int cqe_type)
+                                  struct cqe_rx_t *cqe_rx)
 {
         struct sk_buff *skb;
         struct nicvf *nic = netdev_priv(netdev);
@@ -591,7 +590,7 @@ static void nicvf_rcv_pkt_handler(struct net_device *netdev,
         }
 
         /* Check for errors */
-        err = nicvf_check_cqe_rx_errs(nic, cq, cqe_rx);
+        err = nicvf_check_cqe_rx_errs(nic, cqe_rx);
         if (err && !cqe_rx->rb_cnt)
                 return;
 
@@ -682,8 +681,7 @@ loop:
                            cq_idx, cq_desc->cqe_type);
                 switch (cq_desc->cqe_type) {
                 case CQE_TYPE_RX:
-                        nicvf_rcv_pkt_handler(netdev, napi, cq,
-                                              cq_desc, CQE_TYPE_RX);
+                        nicvf_rcv_pkt_handler(netdev, napi, cq_desc);
                         work_done++;
                 break;
                 case CQE_TYPE_SEND:
@@ -1125,7 +1123,6 @@ int nicvf_stop(struct net_device *netdev)
 
         /* Clear multiqset info */
         nic->pnicvf = nic;
-        nic->sqs_count = 0;
 
         return 0;
 }
@@ -1354,6 +1351,9 @@ void nicvf_update_stats(struct nicvf *nic)
         drv_stats->tx_frames_ok = stats->tx_ucast_frames_ok +
                                   stats->tx_bcast_frames_ok +
                                   stats->tx_mcast_frames_ok;
+        drv_stats->rx_frames_ok = stats->rx_ucast_frames +
+                                  stats->rx_bcast_frames +
+                                  stats->rx_mcast_frames;
         drv_stats->rx_drops = stats->rx_drop_red +
                               stats->rx_drop_overrun;
         drv_stats->tx_drops = stats->tx_drops;
@@ -1538,6 +1538,9 @@ static int nicvf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 
         nicvf_send_vf_struct(nic);
 
+        if (!pass1_silicon(nic->pdev))
+                nic->hw_tso = true;
+
         /* Check if this VF is in QS only mode */
         if (nic->sqs_mode)
                 return 0;
@@ -1557,9 +1560,6 @@ static int nicvf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 
         netdev->vlan_features = NETIF_F_SG | NETIF_F_IP_CSUM | NETIF_F_TSO;
 
-        if (!pass1_silicon(nic->pdev))
-                nic->hw_tso = true;
-
         netdev->netdev_ops = &nicvf_netdev_ops;
         netdev->watchdog_timeo = NICVF_TX_TIMEOUT;
 
diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_queues.c b/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
index d0d1b5490061..767347b1f631 100644
--- a/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
+++ b/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
@@ -1329,16 +1329,12 @@ void nicvf_update_sq_stats(struct nicvf *nic, int sq_idx)
 }
 
 /* Check for errors in the receive cmp.queue entry */
-int nicvf_check_cqe_rx_errs(struct nicvf *nic,
-                            struct cmp_queue *cq, struct cqe_rx_t *cqe_rx)
+int nicvf_check_cqe_rx_errs(struct nicvf *nic, struct cqe_rx_t *cqe_rx)
 {
         struct nicvf_hw_stats *stats = &nic->hw_stats;
-        struct nicvf_drv_stats *drv_stats = &nic->drv_stats;
 
-        if (!cqe_rx->err_level && !cqe_rx->err_opcode) {
-                drv_stats->rx_frames_ok++;
+        if (!cqe_rx->err_level && !cqe_rx->err_opcode)
                 return 0;
-        }
 
         if (netif_msg_rx_err(nic))
                 netdev_err(nic->netdev,
diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_queues.h b/drivers/net/ethernet/cavium/thunder/nicvf_queues.h
index c5030a7f213a..6673e1133523 100644
--- a/drivers/net/ethernet/cavium/thunder/nicvf_queues.h
+++ b/drivers/net/ethernet/cavium/thunder/nicvf_queues.h
@@ -338,8 +338,7 @@ u64  nicvf_queue_reg_read(struct nicvf *nic,
 /* Stats */
 void nicvf_update_rq_stats(struct nicvf *nic, int rq_idx);
 void nicvf_update_sq_stats(struct nicvf *nic, int sq_idx);
-int nicvf_check_cqe_rx_errs(struct nicvf *nic,
-                            struct cmp_queue *cq, struct cqe_rx_t *cqe_rx);
+int nicvf_check_cqe_rx_errs(struct nicvf *nic, struct cqe_rx_t *cqe_rx);
 int nicvf_check_cqe_tx_errs(struct nicvf *nic,
                             struct cmp_queue *cq, struct cqe_send_t *cqe_tx);
 #endif /* NICVF_QUEUES_H */
diff --git a/drivers/net/ethernet/chelsio/cxgb3/t3_hw.c b/drivers/net/ethernet/chelsio/cxgb3/t3_hw.c
index ee04caa6c4d8..a89721fad633 100644
--- a/drivers/net/ethernet/chelsio/cxgb3/t3_hw.c
+++ b/drivers/net/ethernet/chelsio/cxgb3/t3_hw.c
@@ -681,6 +681,24 @@ int t3_seeprom_wp(struct adapter *adapter, int enable)
         return t3_seeprom_write(adapter, EEPROM_STAT_ADDR, enable ? 0xc : 0);
 }
 
+static int vpdstrtouint(char *s, int len, unsigned int base, unsigned int *val)
+{
+        char tok[len + 1];
+
+        memcpy(tok, s, len);
+        tok[len] = 0;
+        return kstrtouint(strim(tok), base, val);
+}
+
+static int vpdstrtou16(char *s, int len, unsigned int base, u16 *val)
+{
+        char tok[len + 1];
+
+        memcpy(tok, s, len);
+        tok[len] = 0;
+        return kstrtou16(strim(tok), base, val);
+}
+
 /**
  *      get_vpd_params - read VPD parameters from VPD EEPROM
  *      @adapter: adapter to read
@@ -709,19 +727,19 @@ static int get_vpd_params(struct adapter *adapter, struct vpd_params *p)
                         return ret;
         }
 
-        ret = kstrtouint(vpd.cclk_data, 10, &p->cclk);
+        ret = vpdstrtouint(vpd.cclk_data, vpd.cclk_len, 10, &p->cclk);
         if (ret)
                 return ret;
-        ret = kstrtouint(vpd.mclk_data, 10, &p->mclk);
+        ret = vpdstrtouint(vpd.mclk_data, vpd.mclk_len, 10, &p->mclk);
         if (ret)
                 return ret;
-        ret = kstrtouint(vpd.uclk_data, 10, &p->uclk);
+        ret = vpdstrtouint(vpd.uclk_data, vpd.uclk_len, 10, &p->uclk);
         if (ret)
                 return ret;
-        ret = kstrtouint(vpd.mdc_data, 10, &p->mdc);
+        ret = vpdstrtouint(vpd.mdc_data, vpd.mdc_len, 10, &p->mdc);
         if (ret)
                 return ret;
-        ret = kstrtouint(vpd.mt_data, 10, &p->mem_timing);
+        ret = vpdstrtouint(vpd.mt_data, vpd.mt_len, 10, &p->mem_timing);
         if (ret)
                 return ret;
         memcpy(p->sn, vpd.sn_data, SERNUM_LEN);
@@ -733,10 +751,12 @@ static int get_vpd_params(struct adapter *adapter, struct vpd_params *p)
         } else {
                 p->port_type[0] = hex_to_bin(vpd.port0_data[0]);
                 p->port_type[1] = hex_to_bin(vpd.port1_data[0]);
-                ret = kstrtou16(vpd.xaui0cfg_data, 16, &p->xauicfg[0]);
+                ret = vpdstrtou16(vpd.xaui0cfg_data, vpd.xaui0cfg_len, 16,
+                                  &p->xauicfg[0]);
                 if (ret)
                         return ret;
-                ret = kstrtou16(vpd.xaui1cfg_data, 16, &p->xauicfg[1]);
+                ret = vpdstrtou16(vpd.xaui1cfg_data, vpd.xaui1cfg_len, 16,
+                                  &p->xauicfg[1]);
                 if (ret)
                         return ret;
         }
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_pci_id_tbl.h b/drivers/net/ethernet/chelsio/cxgb4/t4_pci_id_tbl.h
index a8dda635456d..06bc2d2e7a73 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4_pci_id_tbl.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_pci_id_tbl.h
@@ -165,6 +165,7 @@ CH_PCI_DEVICE_ID_TABLE_DEFINE_BEGIN
         CH_PCI_ID_TABLE_FENTRY(0x5098), /* Custom 2x40G QSFP */
         CH_PCI_ID_TABLE_FENTRY(0x5099), /* Custom 2x40G QSFP */
         CH_PCI_ID_TABLE_FENTRY(0x509a), /* Custom T520-CR */
+        CH_PCI_ID_TABLE_FENTRY(0x509b), /* Custom T540-CR LOM */
 
         /* T6 adapters:
          */
diff --git a/drivers/net/ethernet/cisco/enic/enic.h b/drivers/net/ethernet/cisco/enic/enic.h
index 1671fa3332c2..7ba6d530b0c0 100644
--- a/drivers/net/ethernet/cisco/enic/enic.h
+++ b/drivers/net/ethernet/cisco/enic/enic.h
@@ -33,7 +33,7 @@
 
 #define DRV_NAME                "enic"
 #define DRV_DESCRIPTION         "Cisco VIC Ethernet NIC Driver"
-#define DRV_VERSION             "2.3.0.12"
+#define DRV_VERSION             "2.3.0.20"
 #define DRV_COPYRIGHT           "Copyright 2008-2013 Cisco Systems, Inc"
 
 #define ENIC_BARS_MAX           6
diff --git a/drivers/net/ethernet/cisco/enic/vnic_dev.c b/drivers/net/ethernet/cisco/enic/vnic_dev.c
index 1ffd1050860b..1fdf5fe12a95 100644
--- a/drivers/net/ethernet/cisco/enic/vnic_dev.c
+++ b/drivers/net/ethernet/cisco/enic/vnic_dev.c
@@ -298,7 +298,8 @@ static int _vnic_dev_cmd2(struct vnic_dev *vdev, enum vnic_devcmd_cmd cmd,
                           int wait)
 {
         struct devcmd2_controller *dc2c = vdev->devcmd2;
-        struct devcmd2_result *result = dc2c->result + dc2c->next_result;
+        struct devcmd2_result *result;
+        u8 color;
         unsigned int i;
         int delay, err;
         u32 fetch_index, new_posted;
@@ -336,13 +337,17 @@ static int _vnic_dev_cmd2(struct vnic_dev *vdev, enum vnic_devcmd_cmd cmd,
         if (dc2c->cmd_ring[posted].flags & DEVCMD2_FNORESULT)
                 return 0;
 
+        result = dc2c->result + dc2c->next_result;
+        color = dc2c->color;
+
+        dc2c->next_result++;
+        if (dc2c->next_result == dc2c->result_size) {
+                dc2c->next_result = 0;
+                dc2c->color = dc2c->color ? 0 : 1;
+        }
+
         for (delay = 0; delay < wait; delay++) {
-                if (result->color == dc2c->color) {
-                        dc2c->next_result++;
-                        if (dc2c->next_result == dc2c->result_size) {
-                                dc2c->next_result = 0;
-                                dc2c->color = dc2c->color ? 0 : 1;
-                        }
+                if (result->color == color) {
                         if (result->error) {
                                 err = result->error;
                                 if (err != ERR_ECMDUNKNOWN ||
diff --git a/drivers/net/ethernet/davicom/dm9000.c b/drivers/net/ethernet/davicom/dm9000.c
index cf94b72dbacd..48d91941408d 100644
--- a/drivers/net/ethernet/davicom/dm9000.c
+++ b/drivers/net/ethernet/davicom/dm9000.c
@@ -128,7 +128,6 @@ struct board_info {
         struct resource *data_res;
         struct resource *addr_req;   /* resources requested */
         struct resource *data_req;
-        struct resource *irq_res;
 
         int              irq_wake;
 
@@ -1300,22 +1299,16 @@ static int
 dm9000_open(struct net_device *dev)
 {
         struct board_info *db = netdev_priv(dev);
-        unsigned long irqflags = db->irq_res->flags & IRQF_TRIGGER_MASK;
 
         if (netif_msg_ifup(db))
                 dev_dbg(db->dev, "enabling %s\n", dev->name);
 
-        /* If there is no IRQ type specified, default to something that
-         * may work, and tell the user that this is a problem */
-
-        if (irqflags == IRQF_TRIGGER_NONE)
-                irqflags = irq_get_trigger_type(dev->irq);
-
-        if (irqflags == IRQF_TRIGGER_NONE)
+        /* If there is no IRQ type specified, tell the user that this is a
+         * problem
+         */
+        if (irq_get_trigger_type(dev->irq) == IRQF_TRIGGER_NONE)
                 dev_warn(db->dev, "WARNING: no IRQ resource flags set.\n");
 
-        irqflags |= IRQF_SHARED;
-
         /* GPIO0 on pre-activate PHY, Reg 1F is not set by reset */
         iow(db, DM9000_GPR, 0); /* REG_1F bit0 activate phyxcer */
         mdelay(1); /* delay needs by DM9000B */
@@ -1323,7 +1316,8 @@ dm9000_open(struct net_device *dev)
         /* Initialize DM9000 board */
         dm9000_init_dm9000(dev);
 
-        if (request_irq(dev->irq, dm9000_interrupt, irqflags, dev->name, dev))
+        if (request_irq(dev->irq, dm9000_interrupt, IRQF_SHARED,
+                        dev->name, dev))
                 return -EAGAIN;
         /* Now that we have an interrupt handler hooked up we can unmask
          * our interrupts
@@ -1500,15 +1494,22 @@ dm9000_probe(struct platform_device *pdev)
 
         db->addr_res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         db->data_res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
-        db->irq_res  = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
 
-        if (db->addr_res == NULL || db->data_res == NULL ||
-            db->irq_res == NULL) {
-                dev_err(db->dev, "insufficient resources\n");
+        if (!db->addr_res || !db->data_res) {
+                dev_err(db->dev, "insufficient resources addr=%p data=%p\n",
+                        db->addr_res, db->data_res);
                 ret = -ENOENT;
                 goto out;
         }
 
+        ndev->irq = platform_get_irq(pdev, 0);
+        if (ndev->irq < 0) {
+                dev_err(db->dev, "interrupt resource unavailable: %d\n",
+                        ndev->irq);
+                ret = ndev->irq;
+                goto out;
+        }
+
         db->irq_wake = platform_get_irq(pdev, 1);
         if (db->irq_wake >= 0) {
                 dev_dbg(db->dev, "wakeup irq %d\n", db->irq_wake);
@@ -1570,7 +1571,6 @@ dm9000_probe(struct platform_device *pdev)
 
         /* fill in parameters for net-dev structure */
         ndev->base_addr = (unsigned long)db->io_addr;
-        ndev->irq       = db->irq_res->start;
 
         /* ensure at least we have a default set of IO routines */
         dm9000_set_io(db, iosize);
diff --git a/drivers/net/ethernet/emulex/benet/be.h b/drivers/net/ethernet/emulex/benet/be.h
index cf837831304b..f9751294ece7 100644
--- a/drivers/net/ethernet/emulex/benet/be.h
+++ b/drivers/net/ethernet/emulex/benet/be.h
@@ -531,6 +531,7 @@ struct be_adapter {
 
         struct delayed_work be_err_detection_work;
         u8 err_flags;
+        bool pcicfg_mapped;     /* pcicfg obtained via pci_iomap() */
         u32 flags;
         u32 cmd_privileges;
         /* Ethtool knobs and info */
diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.h b/drivers/net/ethernet/emulex/benet/be_cmds.h
index 241819b36ca7..6d9a8d78e8ad 100644
--- a/drivers/net/ethernet/emulex/benet/be_cmds.h
+++ b/drivers/net/ethernet/emulex/benet/be_cmds.h
@@ -622,10 +622,13 @@ enum be_if_flags {
                                          BE_IF_FLAGS_VLAN_PROMISCUOUS |\
                                          BE_IF_FLAGS_MCAST_PROMISCUOUS)
 
-#define BE_IF_EN_FLAGS  (BE_IF_FLAGS_BROADCAST | BE_IF_FLAGS_PASS_L3L4_ERRORS |\
-                        BE_IF_FLAGS_MULTICAST | BE_IF_FLAGS_UNTAGGED)
+#define BE_IF_FILT_FLAGS_BASIC (BE_IF_FLAGS_BROADCAST | \
+                                BE_IF_FLAGS_PASS_L3L4_ERRORS | \
+                                BE_IF_FLAGS_UNTAGGED)
 
-#define BE_IF_ALL_FILT_FLAGS    (BE_IF_EN_FLAGS | BE_IF_FLAGS_ALL_PROMISCUOUS)
+#define BE_IF_ALL_FILT_FLAGS    (BE_IF_FILT_FLAGS_BASIC | \
+                                 BE_IF_FLAGS_MULTICAST | \
+                                 BE_IF_FLAGS_ALL_PROMISCUOUS)
 
 /* An RX interface is an object with one or more MAC addresses and
  * filtering capabilities. */
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index f99de3657ce3..d1cf1274fc2f 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -125,6 +125,11 @@ static const char * const ue_status_hi_desc[] = {
         "Unknown"
 };
 
+#define BE_VF_IF_EN_FLAGS       (BE_IF_FLAGS_UNTAGGED | \
+                                 BE_IF_FLAGS_BROADCAST | \
+                                 BE_IF_FLAGS_MULTICAST | \
+                                 BE_IF_FLAGS_PASS_L3L4_ERRORS)
+
 static void be_queue_free(struct be_adapter *adapter, struct be_queue_info *q)
 {
         struct be_dma_mem *mem = &q->dma_mem;
@@ -3537,7 +3542,7 @@ static int be_enable_if_filters(struct be_adapter *adapter)
 {
         int status;
 
-        status = be_cmd_rx_filter(adapter, BE_IF_EN_FLAGS, ON);
+        status = be_cmd_rx_filter(adapter, BE_IF_FILT_FLAGS_BASIC, ON);
         if (status)
                 return status;
 
@@ -3857,8 +3862,7 @@ static int be_vfs_if_create(struct be_adapter *adapter)
         int status;
 
         /* If a FW profile exists, then cap_flags are updated */
-        cap_flags = BE_IF_FLAGS_UNTAGGED | BE_IF_FLAGS_BROADCAST |
-                    BE_IF_FLAGS_MULTICAST | BE_IF_FLAGS_PASS_L3L4_ERRORS;
+        cap_flags = BE_VF_IF_EN_FLAGS;
 
         for_all_vfs(adapter, vf_cfg, vf) {
                 if (!BE3_chip(adapter)) {
@@ -3874,10 +3878,8 @@ static int be_vfs_if_create(struct be_adapter *adapter)
                         }
                 }
 
-                en_flags = cap_flags & (BE_IF_FLAGS_UNTAGGED |
-                                        BE_IF_FLAGS_BROADCAST |
-                                        BE_IF_FLAGS_MULTICAST |
-                                        BE_IF_FLAGS_PASS_L3L4_ERRORS);
+                /* PF should enable IF flags during proxy if_create call */
+                en_flags = cap_flags & BE_VF_IF_EN_FLAGS;
                 status = be_cmd_if_create(adapter, cap_flags, en_flags,
                                           &vf_cfg->if_handle, vf + 1);
                 if (status)
@@ -4968,6 +4970,8 @@ static void be_unmap_pci_bars(struct be_adapter *adapter)
                 pci_iounmap(adapter->pdev, adapter->csr);
         if (adapter->db)
                 pci_iounmap(adapter->pdev, adapter->db);
+        if (adapter->pcicfg && adapter->pcicfg_mapped)
+                pci_iounmap(adapter->pdev, adapter->pcicfg);
 }
 
 static int db_bar(struct be_adapter *adapter)
@@ -5019,8 +5023,10 @@ static int be_map_pci_bars(struct be_adapter *adapter)
                         if (!addr)
                                 goto pci_map_err;
                         adapter->pcicfg = addr;
+                        adapter->pcicfg_mapped = true;
                 } else {
                         adapter->pcicfg = adapter->db + SRIOV_VF_PCICFG_OFFSET;
+                        adapter->pcicfg_mapped = false;
                 }
         }
 
diff --git a/drivers/net/ethernet/ethoc.c b/drivers/net/ethernet/ethoc.c
index 62fa136554ac..41b010645100 100644
--- a/drivers/net/ethernet/ethoc.c
+++ b/drivers/net/ethernet/ethoc.c
@@ -1265,7 +1265,6 @@ static int ethoc_remove(struct platform_device *pdev)
 
                 if (priv->mdio) {
                         mdiobus_unregister(priv->mdio);
-                        kfree(priv->mdio->irq);
                         mdiobus_free(priv->mdio);
                 }
                 if (priv->clk)
diff --git a/drivers/net/ethernet/freescale/fman/fman.c b/drivers/net/ethernet/freescale/fman/fman.c
index 623aa1c8ebc6..79a210aaf0bb 100644
--- a/drivers/net/ethernet/freescale/fman/fman.c
+++ b/drivers/net/ethernet/freescale/fman/fman.c
@@ -2791,6 +2791,8 @@ static struct fman *read_dts_node(struct platform_device *of_dev)
                 goto fman_free;
         }
 
+        fman->dev = &of_dev->dev;
+
         return fman;
 
 fman_node_put:
@@ -2845,8 +2847,6 @@ static int fman_probe(struct platform_device *of_dev)
 
         dev_set_drvdata(dev, fman);
 
-        fman->dev = dev;
-
         dev_dbg(dev, "FMan%d probed\n", fman->dts_params.id);
 
         return 0;
diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c
index 2aa7b401cc3b..b9ecf197ad11 100644
--- a/drivers/net/ethernet/freescale/gianfar.c
+++ b/drivers/net/ethernet/freescale/gianfar.c
@@ -1111,8 +1111,10 @@ static void __gfar_detect_errata_85xx(struct gfar_private *priv)
 
         if ((SVR_SOC_VER(svr) == SVR_8548) && (SVR_REV(svr) == 0x20))
                 priv->errata |= GFAR_ERRATA_12;
+        /* P2020/P1010 Rev 1; MPC8548 Rev 2 */
         if (((SVR_SOC_VER(svr) == SVR_P2020) && (SVR_REV(svr) < 0x20)) ||
-            ((SVR_SOC_VER(svr) == SVR_P2010) && (SVR_REV(svr) < 0x20)))
+            ((SVR_SOC_VER(svr) == SVR_P2010) && (SVR_REV(svr) < 0x20)) ||
+            ((SVR_SOC_VER(svr) == SVR_8548) && (SVR_REV(svr) < 0x31)))
                 priv->errata |= GFAR_ERRATA_76; /* aka eTSEC 20 */
 }
 #endif
diff --git a/drivers/net/ethernet/fujitsu/fmvj18x_cs.c b/drivers/net/ethernet/fujitsu/fmvj18x_cs.c
index a7139f588ad2..678f5018d0be 100644
--- a/drivers/net/ethernet/fujitsu/fmvj18x_cs.c
+++ b/drivers/net/ethernet/fujitsu/fmvj18x_cs.c
@@ -469,8 +469,8 @@ static int fmvj18x_config(struct pcmcia_device *link)
                     goto failed;
             }
             /* Read MACID from CIS */
-            for (i = 5; i < 11; i++)
-                    dev->dev_addr[i] = buf[i];
+            for (i = 0; i < 6; i++)
+                    dev->dev_addr[i] = buf[i + 5];
             kfree(buf);
         } else {
             if (pcmcia_get_mac_from_cis(link, dev))
diff --git a/drivers/net/ethernet/hisilicon/Kconfig b/drivers/net/ethernet/hisilicon/Kconfig
index 74beb1867230..4ccc032633c4 100644
--- a/drivers/net/ethernet/hisilicon/Kconfig
+++ b/drivers/net/ethernet/hisilicon/Kconfig
@@ -25,6 +25,7 @@ config HIX5HD2_GMAC
 
 config HIP04_ETH
         tristate "HISILICON P04 Ethernet support"
+        depends on HAS_IOMEM    # For MFD_SYSCON
         select MARVELL_PHY
         select MFD_SYSCON
         select HNS_MDIO
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c b/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c
index a0070d0e740d..d4f92ed322d6 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c
@@ -675,8 +675,12 @@ static int hns_ae_config_loopback(struct hnae_handle *handle,
 {
         int ret;
         struct hnae_vf_cb *vf_cb = hns_ae_get_vf_cb(handle);
+        struct hns_mac_cb *mac_cb = hns_get_mac_cb(handle);
 
         switch (loop) {
+        case MAC_INTERNALLOOP_PHY:
+                ret = 0;
+                break;
         case MAC_INTERNALLOOP_SERDES:
                 ret = hns_mac_config_sds_loopback(vf_cb->mac_cb, en);
                 break;
@@ -686,6 +690,10 @@ static int hns_ae_config_loopback(struct hnae_handle *handle,
         default:
                 ret = -EINVAL;
         }
+
+        if (!ret)
+                hns_dsaf_set_inner_lb(mac_cb->dsaf_dev, mac_cb->mac_id, en);
+
         return ret;
 }
 
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
index 9439f04962e1..38fc5be3870c 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
@@ -230,6 +230,30 @@ static void hns_dsaf_mix_def_qid_cfg(struct dsaf_device *dsaf_dev)
         }
 }
 
+static void hns_dsaf_inner_qid_cfg(struct dsaf_device *dsaf_dev)
+{
+        u16 max_q_per_vf, max_vfn;
+        u32 q_id, q_num_per_port;
+        u32 mac_id;
+
+        if (AE_IS_VER1(dsaf_dev->dsaf_ver))
+                return;
+
+        hns_rcb_get_queue_mode(dsaf_dev->dsaf_mode,
+                               HNS_DSAF_COMM_SERVICE_NW_IDX,
+                               &max_vfn, &max_q_per_vf);
+        q_num_per_port = max_vfn * max_q_per_vf;
+
+        for (mac_id = 0, q_id = 0; mac_id < DSAF_SERVICE_NW_NUM; mac_id++) {
+                dsaf_set_dev_field(dsaf_dev,
+                                   DSAFV2_SERDES_LBK_0_REG + 4 * mac_id,
+                                   DSAFV2_SERDES_LBK_QID_M,
+                                   DSAFV2_SERDES_LBK_QID_S,
+                                   q_id);
+                q_id += q_num_per_port;
+        }
+}
+
 /**
  * hns_dsaf_sw_port_type_cfg - cfg sw type
  * @dsaf_id: dsa fabric id
@@ -691,6 +715,16 @@ void hns_dsaf_set_promisc_mode(struct dsaf_device *dsaf_dev, u32 en)
         dsaf_set_dev_bit(dsaf_dev, DSAF_CFG_0_REG, DSAF_CFG_MIX_MODE_S, !!en);
 }
 
+void hns_dsaf_set_inner_lb(struct dsaf_device *dsaf_dev, u32 mac_id, u32 en)
+{
+        if (AE_IS_VER1(dsaf_dev->dsaf_ver) ||
+            dsaf_dev->mac_cb[mac_id].mac_type == HNAE_PORT_DEBUG)
+                return;
+
+        dsaf_set_dev_bit(dsaf_dev, DSAFV2_SERDES_LBK_0_REG + 4 * mac_id,
+                         DSAFV2_SERDES_LBK_EN_B, !!en);
+}
+
 /**
  * hns_dsaf_tbl_stat_en - tbl
  * @dsaf_id: dsa fabric id
@@ -1022,6 +1056,9 @@ static void hns_dsaf_comm_init(struct dsaf_device *dsaf_dev)
         /* set promisc def queue id */
         hns_dsaf_mix_def_qid_cfg(dsaf_dev);
 
+        /* set inner loopback queue id */
+        hns_dsaf_inner_qid_cfg(dsaf_dev);
+
         /* in non switch mode, set all port to access mode */
         hns_dsaf_sw_port_type_cfg(dsaf_dev, DSAF_SW_PORT_TYPE_NON_VLAN);
 
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.h b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.h
index 40205b910f80..5fea226efaf3 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.h
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.h
@@ -417,5 +417,6 @@ void hns_dsaf_get_strings(int stringset, u8 *data, int port);
 void hns_dsaf_get_regs(struct dsaf_device *ddev, u32 port, void *data);
 int hns_dsaf_get_regs_count(void);
 void hns_dsaf_set_promisc_mode(struct dsaf_device *dsaf_dev, u32 en);
+void hns_dsaf_set_inner_lb(struct dsaf_device *dsaf_dev, u32 mac_id, u32 en);
 
 #endif /* __HNS_DSAF_MAIN_H__ */
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h
index f0c4f9b09d5b..60d695daa471 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h
@@ -134,6 +134,7 @@
 #define DSAF_XGE_INT_STS_0_REG          0x1C0
 #define DSAF_PPE_INT_STS_0_REG          0x1E0
 #define DSAF_ROCEE_INT_STS_0_REG        0x200
+#define DSAFV2_SERDES_LBK_0_REG         0x220
 #define DSAF_PPE_QID_CFG_0_REG          0x300
 #define DSAF_SW_PORT_TYPE_0_REG         0x320
 #define DSAF_STP_PORT_TYPE_0_REG        0x340
@@ -857,6 +858,10 @@
 #define PPEV2_CFG_RSS_TBL_4N3_S 24
 #define PPEV2_CFG_RSS_TBL_4N3_M (((1UL << 5) - 1) << PPEV2_CFG_RSS_TBL_4N3_S)
 
+#define DSAFV2_SERDES_LBK_EN_B  8
+#define DSAFV2_SERDES_LBK_QID_S 0
+#define DSAFV2_SERDES_LBK_QID_M (((1UL << 8) - 1) << DSAFV2_SERDES_LBK_QID_S)
+
 #define PPE_CNT_CLR_CE_B        0
 #define PPE_CNT_CLR_SNAP_EN_B   1
 
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c b/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c
index 3df22840fcd1..3c4a3bc31a89 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c
@@ -295,8 +295,10 @@ static int __lb_setup(struct net_device *ndev,
 
         switch (loop) {
         case MAC_INTERNALLOOP_PHY:
-                if ((phy_dev) && (!phy_dev->is_c45))
+                if ((phy_dev) && (!phy_dev->is_c45)) {
                         ret = hns_nic_config_phy_loopback(phy_dev, 0x1);
+                        ret |= h->dev->ops->set_loopback(h, loop, 0x1);
+                }
                 break;
         case MAC_INTERNALLOOP_MAC:
                 if ((h->dev->ops->set_loopback) &&
@@ -376,6 +378,7 @@ static void __lb_other_process(struct hns_nic_ring_data *ring_data,
                                struct sk_buff *skb)
 {
         struct net_device *ndev;
+        struct hns_nic_priv *priv;
         struct hnae_ring *ring;
         struct netdev_queue *dev_queue;
         struct sk_buff *new_skb;
@@ -385,8 +388,17 @@ static void __lb_other_process(struct hns_nic_ring_data *ring_data,
         char buff[33]; /* 32B data and the last character '\0' */
 
         if (!ring_data) { /* Just for doing create frame*/
+                ndev = skb->dev;
+                priv = netdev_priv(ndev);
+
                 frame_size = skb->len;
                 memset(skb->data, 0xFF, frame_size);
+                if ((!AE_IS_VER1(priv->enet_ver)) &&
+                    (priv->ae_handle->port_type == HNAE_PORT_SERVICE)) {
+                        memcpy(skb->data, ndev->dev_addr, 6);
+                        skb->data[5] += 0x1f;
+                }
+
                 frame_size &= ~1ul;
                 memset(&skb->data[frame_size / 2], 0xAA, frame_size / 2 - 1);
                 memset(&skb->data[frame_size / 2 + 10], 0xBE,
@@ -486,6 +498,7 @@ static int __lb_run_test(struct net_device *ndev,
 
         /* place data into test skb */
         (void)skb_put(skb, size);
+        skb->dev = ndev;
         __lb_other_process(NULL, skb);
         skb->queue_mapping = NIC_LB_TEST_RING_ID;
 
diff --git a/drivers/net/ethernet/ibm/ibmveth.c b/drivers/net/ethernet/ibm/ibmveth.c
index 335417b4756b..ebe60719e489 100644
--- a/drivers/net/ethernet/ibm/ibmveth.c
+++ b/drivers/net/ethernet/ibm/ibmveth.c
@@ -1166,7 +1166,10 @@ map_failed:
         if (!firmware_has_feature(FW_FEATURE_CMO))
                 netdev_err(netdev, "tx: unable to map xmit buffer\n");
         adapter->tx_map_failed++;
-        skb_linearize(skb);
+        if (skb_linearize(skb)) {
+                netdev->stats.tx_dropped++;
+                goto out;
+        }
         force_bounce = 1;
         goto retry_bounce;
 }
diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
index 7d6570843723..6e9e16eee5d0 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.c
+++ b/drivers/net/ethernet/ibm/ibmvnic.c
@@ -1348,44 +1348,44 @@ static void init_sub_crqs(struct ibmvnic_adapter *adapter, int retry)
         crq.request_capability.cmd = REQUEST_CAPABILITY;
 
         crq.request_capability.capability = cpu_to_be16(REQ_TX_QUEUES);
-        crq.request_capability.number = cpu_to_be32(adapter->req_tx_queues);
+        crq.request_capability.number = cpu_to_be64(adapter->req_tx_queues);
         ibmvnic_send_crq(adapter, &crq);
 
         crq.request_capability.capability = cpu_to_be16(REQ_RX_QUEUES);
-        crq.request_capability.number = cpu_to_be32(adapter->req_rx_queues);
+        crq.request_capability.number = cpu_to_be64(adapter->req_rx_queues);
         ibmvnic_send_crq(adapter, &crq);
 
         crq.request_capability.capability = cpu_to_be16(REQ_RX_ADD_QUEUES);
-        crq.request_capability.number = cpu_to_be32(adapter->req_rx_add_queues);
+        crq.request_capability.number = cpu_to_be64(adapter->req_rx_add_queues);
         ibmvnic_send_crq(adapter, &crq);
 
         crq.request_capability.capability =
             cpu_to_be16(REQ_TX_ENTRIES_PER_SUBCRQ);
         crq.request_capability.number =
-            cpu_to_be32(adapter->req_tx_entries_per_subcrq);
+            cpu_to_be64(adapter->req_tx_entries_per_subcrq);
         ibmvnic_send_crq(adapter, &crq);
 
         crq.request_capability.capability =
             cpu_to_be16(REQ_RX_ADD_ENTRIES_PER_SUBCRQ);
         crq.request_capability.number =
-            cpu_to_be32(adapter->req_rx_add_entries_per_subcrq);
+            cpu_to_be64(adapter->req_rx_add_entries_per_subcrq);
         ibmvnic_send_crq(adapter, &crq);
 
         crq.request_capability.capability = cpu_to_be16(REQ_MTU);
-        crq.request_capability.number = cpu_to_be32(adapter->req_mtu);
+        crq.request_capability.number = cpu_to_be64(adapter->req_mtu);
         ibmvnic_send_crq(adapter, &crq);
 
         if (adapter->netdev->flags & IFF_PROMISC) {
                 if (adapter->promisc_supported) {
                         crq.request_capability.capability =
                             cpu_to_be16(PROMISC_REQUESTED);
-                        crq.request_capability.number = cpu_to_be32(1);
+                        crq.request_capability.number = cpu_to_be64(1);
                         ibmvnic_send_crq(adapter, &crq);
                 }
         } else {
                 crq.request_capability.capability =
                     cpu_to_be16(PROMISC_REQUESTED);
-                crq.request_capability.number = cpu_to_be32(0);
+                crq.request_capability.number = cpu_to_be64(0);
                 ibmvnic_send_crq(adapter, &crq);
         }
 
@@ -2312,93 +2312,93 @@ static void handle_query_cap_rsp(union ibmvnic_crq *crq,
         switch (be16_to_cpu(crq->query_capability.capability)) {
         case MIN_TX_QUEUES:
                 adapter->min_tx_queues =
-                    be32_to_cpu(crq->query_capability.number);
+                    be64_to_cpu(crq->query_capability.number);
                 netdev_dbg(netdev, "min_tx_queues = %lld\n",
                            adapter->min_tx_queues);
                 break;
         case MIN_RX_QUEUES:
                 adapter->min_rx_queues =
-                    be32_to_cpu(crq->query_capability.number);
+                    be64_to_cpu(crq->query_capability.number);
                 netdev_dbg(netdev, "min_rx_queues = %lld\n",
                            adapter->min_rx_queues);
                 break;
         case MIN_RX_ADD_QUEUES:
                 adapter->min_rx_add_queues =
-                    be32_to_cpu(crq->query_capability.number);
+                    be64_to_cpu(crq->query_capability.number);
                 netdev_dbg(netdev, "min_rx_add_queues = %lld\n",
                            adapter->min_rx_add_queues);
                 break;
         case MAX_TX_QUEUES:
                 adapter->max_tx_queues =
-                    be32_to_cpu(crq->query_capability.number);
+                    be64_to_cpu(crq->query_capability.number);
                 netdev_dbg(netdev, "max_tx_queues = %lld\n",
                            adapter->max_tx_queues);
                 break;
         case MAX_RX_QUEUES:
                 adapter->max_rx_queues =
-                    be32_to_cpu(crq->query_capability.number);
+                    be64_to_cpu(crq->query_capability.number);
                 netdev_dbg(netdev, "max_rx_queues = %lld\n",
                            adapter->max_rx_queues);
                 break;
         case MAX_RX_ADD_QUEUES:
                 adapter->max_rx_add_queues =
-                    be32_to_cpu(crq->query_capability.number);
+                    be64_to_cpu(crq->query_capability.number);
                 netdev_dbg(netdev, "max_rx_add_queues = %lld\n",
                            adapter->max_rx_add_queues);
                 break;
         case MIN_TX_ENTRIES_PER_SUBCRQ:
                 adapter->min_tx_entries_per_subcrq =
-                    be32_to_cpu(crq->query_capability.number);
+                    be64_to_cpu(crq->query_capability.number);
                 netdev_dbg(netdev, "min_tx_entries_per_subcrq = %lld\n",
                            adapter->min_tx_entries_per_subcrq);
                 break;
         case MIN_RX_ADD_ENTRIES_PER_SUBCRQ:
                 adapter->min_rx_add_entries_per_subcrq =
-                    be32_to_cpu(crq->query_capability.number);
+                    be64_to_cpu(crq->query_capability.number);
                 netdev_dbg(netdev, "min_rx_add_entrs_per_subcrq = %lld\n",
                            adapter->min_rx_add_entries_per_subcrq);
                 break;
         case MAX_TX_ENTRIES_PER_SUBCRQ:
                 adapter->max_tx_entries_per_subcrq =
-                    be32_to_cpu(crq->query_capability.number);
+                    be64_to_cpu(crq->query_capability.number);
                 netdev_dbg(netdev, "max_tx_entries_per_subcrq = %lld\n",
                            adapter->max_tx_entries_per_subcrq);
                 break;
         case MAX_RX_ADD_ENTRIES_PER_SUBCRQ:
                 adapter->max_rx_add_entries_per_subcrq =
-                    be32_to_cpu(crq->query_capability.number);
+                    be64_to_cpu(crq->query_capability.number);
                 netdev_dbg(netdev, "max_rx_add_entrs_per_subcrq = %lld\n",
                            adapter->max_rx_add_entries_per_subcrq);
                 break;
         case TCP_IP_OFFLOAD:
                 adapter->tcp_ip_offload =
-                    be32_to_cpu(crq->query_capability.number);
+                    be64_to_cpu(crq->query_capability.number);
                 netdev_dbg(netdev, "tcp_ip_offload = %lld\n",
                            adapter->tcp_ip_offload);
                 break;
         case PROMISC_SUPPORTED:
                 adapter->promisc_supported =
-                    be32_to_cpu(crq->query_capability.number);
+                    be64_to_cpu(crq->query_capability.number);
                 netdev_dbg(netdev, "promisc_supported = %lld\n",
                            adapter->promisc_supported);
                 break;
         case MIN_MTU:
-                adapter->min_mtu = be32_to_cpu(crq->query_capability.number);
+                adapter->min_mtu = be64_to_cpu(crq->query_capability.number);
                 netdev_dbg(netdev, "min_mtu = %lld\n", adapter->min_mtu);
                 break;
         case MAX_MTU:
-                adapter->max_mtu = be32_to_cpu(crq->query_capability.number);
+                adapter->max_mtu = be64_to_cpu(crq->query_capability.number);
                 netdev_dbg(netdev, "max_mtu = %lld\n", adapter->max_mtu);
                 break;
         case MAX_MULTICAST_FILTERS:
                 adapter->max_multicast_filters =
-                    be32_to_cpu(crq->query_capability.number);
+                    be64_to_cpu(crq->query_capability.number);
                 netdev_dbg(netdev, "max_multicast_filters = %lld\n",
                            adapter->max_multicast_filters);
                 break;
         case VLAN_HEADER_INSERTION:
                 adapter->vlan_header_insertion =
-                    be32_to_cpu(crq->query_capability.number);
+                    be64_to_cpu(crq->query_capability.number);
                 if (adapter->vlan_header_insertion)
                         netdev->features |= NETIF_F_HW_VLAN_STAG_TX;
                 netdev_dbg(netdev, "vlan_header_insertion = %lld\n",
@@ -2406,43 +2406,43 @@ static void handle_query_cap_rsp(union ibmvnic_crq *crq,
                 break;
         case MAX_TX_SG_ENTRIES:
                 adapter->max_tx_sg_entries =
-                    be32_to_cpu(crq->query_capability.number);
+                    be64_to_cpu(crq->query_capability.number);
                 netdev_dbg(netdev, "max_tx_sg_entries = %lld\n",
                            adapter->max_tx_sg_entries);
                 break;
         case RX_SG_SUPPORTED:
                 adapter->rx_sg_supported =
-                    be32_to_cpu(crq->query_capability.number);
+                    be64_to_cpu(crq->query_capability.number);
                 netdev_dbg(netdev, "rx_sg_supported = %lld\n",
                            adapter->rx_sg_supported);
                 break;
         case OPT_TX_COMP_SUB_QUEUES:
                 adapter->opt_tx_comp_sub_queues =
-                    be32_to_cpu(crq->query_capability.number);
+                    be64_to_cpu(crq->query_capability.number);
                 netdev_dbg(netdev, "opt_tx_comp_sub_queues = %lld\n",
                            adapter->opt_tx_comp_sub_queues);
                 break;
         case OPT_RX_COMP_QUEUES:
                 adapter->opt_rx_comp_queues =
-                    be32_to_cpu(crq->query_capability.number);
+                    be64_to_cpu(crq->query_capability.number);
                 netdev_dbg(netdev, "opt_rx_comp_queues = %lld\n",
                            adapter->opt_rx_comp_queues);
                 break;
         case OPT_RX_BUFADD_Q_PER_RX_COMP_Q:
                 adapter->opt_rx_bufadd_q_per_rx_comp_q =
-                    be32_to_cpu(crq->query_capability.number);
+                    be64_to_cpu(crq->query_capability.number);
                 netdev_dbg(netdev, "opt_rx_bufadd_q_per_rx_comp_q = %lld\n",
                            adapter->opt_rx_bufadd_q_per_rx_comp_q);
                 break;
         case OPT_TX_ENTRIES_PER_SUBCRQ:
                 adapter->opt_tx_entries_per_subcrq =
-                    be32_to_cpu(crq->query_capability.number);
+                    be64_to_cpu(crq->query_capability.number);
                 netdev_dbg(netdev, "opt_tx_entries_per_subcrq = %lld\n",
                            adapter->opt_tx_entries_per_subcrq);
                 break;
         case OPT_RXBA_ENTRIES_PER_SUBCRQ:
                 adapter->opt_rxba_entries_per_subcrq =
-                    be32_to_cpu(crq->query_capability.number);
+                    be64_to_cpu(crq->query_capability.number);
                 netdev_dbg(netdev, "opt_rxba_entries_per_subcrq = %lld\n",
                            adapter->opt_rxba_entries_per_subcrq);
                 break;
diff --git a/drivers/net/ethernet/ibm/ibmvnic.h b/drivers/net/ethernet/ibm/ibmvnic.h
index 1242925ad34c..1a9993cc79b5 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.h
+++ b/drivers/net/ethernet/ibm/ibmvnic.h
@@ -319,10 +319,8 @@ struct ibmvnic_capability {
         u8 first;
         u8 cmd;
         __be16 capability; /* one of ibmvnic_capabilities */
+        __be64 number;
         struct ibmvnic_rc rc;
-        __be32 number; /*FIX: should be __be64, but I'm getting the least
-                        * significant word first
-                        */
 } __packed __aligned(8);
 
 struct ibmvnic_login {
diff --git a/drivers/net/ethernet/jme.c b/drivers/net/ethernet/jme.c
index b1de7afd4116..3ddf657bc10b 100644
--- a/drivers/net/ethernet/jme.c
+++ b/drivers/net/ethernet/jme.c
@@ -270,11 +270,17 @@ jme_reset_mac_processor(struct jme_adapter *jme)
 }
 
 static inline void
-jme_clear_pm(struct jme_adapter *jme)
+jme_clear_pm_enable_wol(struct jme_adapter *jme)
 {
         jwrite32(jme, JME_PMCS, PMCS_STMASK | jme->reg_pmcs);
 }
 
+static inline void
+jme_clear_pm_disable_wol(struct jme_adapter *jme)
+{
+        jwrite32(jme, JME_PMCS, PMCS_STMASK);
+}
+
 static int
 jme_reload_eeprom(struct jme_adapter *jme)
 {
@@ -1853,7 +1859,7 @@ jme_open(struct net_device *netdev)
         struct jme_adapter *jme = netdev_priv(netdev);
         int rc;
 
-        jme_clear_pm(jme);
+        jme_clear_pm_disable_wol(jme);
         JME_NAPI_ENABLE(jme);
 
         tasklet_init(&jme->linkch_task, jme_link_change_tasklet,
@@ -1925,11 +1931,11 @@ jme_wait_link(struct jme_adapter *jme)
 static void
 jme_powersave_phy(struct jme_adapter *jme)
 {
-        if (jme->reg_pmcs) {
+        if (jme->reg_pmcs && device_may_wakeup(&jme->pdev->dev)) {
                 jme_set_100m_half(jme);
                 if (jme->reg_pmcs & (PMCS_LFEN | PMCS_LREN))
                         jme_wait_link(jme);
-                jme_clear_pm(jme);
+                jme_clear_pm_enable_wol(jme);
         } else {
                 jme_phy_off(jme);
         }
@@ -2646,9 +2652,6 @@ jme_set_wol(struct net_device *netdev,
         if (wol->wolopts & WAKE_MAGIC)
                 jme->reg_pmcs |= PMCS_MFEN;
 
-        jwrite32(jme, JME_PMCS, jme->reg_pmcs);
-        device_set_wakeup_enable(&jme->pdev->dev, !!(jme->reg_pmcs));
-
         return 0;
 }
 
@@ -3172,8 +3175,8 @@ jme_init_one(struct pci_dev *pdev,
         jme->mii_if.mdio_read = jme_mdio_read;
         jme->mii_if.mdio_write = jme_mdio_write;
 
-        jme_clear_pm(jme);
-        device_set_wakeup_enable(&pdev->dev, true);
+        jme_clear_pm_disable_wol(jme);
+        device_init_wakeup(&pdev->dev, true);
 
         jme_set_phyfifo_5level(jme);
         jme->pcirev = pdev->revision;
@@ -3304,7 +3307,7 @@ jme_resume(struct device *dev)
         if (!netif_running(netdev))
                 return 0;
 
-        jme_clear_pm(jme);
+        jme_clear_pm_disable_wol(jme);
         jme_phy_on(jme);
         if (test_bit(JME_FLAG_SSET, &jme->flags))
                 jme_set_settings(netdev, &jme->old_ecmd);
@@ -3312,13 +3315,14 @@ jme_resume(struct device *dev)
                 jme_reset_phy_processor(jme);
         jme_phy_calibration(jme);
         jme_phy_setEA(jme);
-        jme_start_irq(jme);
         netif_device_attach(netdev);
 
         atomic_inc(&jme->link_changing);
 
         jme_reset_link(jme);
 
+        jme_start_irq(jme);
+
         return 0;
 }
 
diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
index 662c2ee268c7..b0ae69f84493 100644
--- a/drivers/net/ethernet/marvell/mvneta.c
+++ b/drivers/net/ethernet/marvell/mvneta.c
@@ -370,6 +370,11 @@ struct mvneta_port {
         struct net_device *dev;
         struct notifier_block cpu_notifier;
         int rxq_def;
+        /* Protect the access to the percpu interrupt registers,
+         * ensuring that the configuration remains coherent.
+         */
+        spinlock_t lock;
+        bool is_stopped;
 
         /* Core clock */
         struct clk *clk;
@@ -1038,6 +1043,43 @@ static void mvneta_set_autoneg(struct mvneta_port *pp, int enable)
         }
 }
 
+static void mvneta_percpu_unmask_interrupt(void *arg)
+{
+        struct mvneta_port *pp = arg;
+
+        /* All the queue are unmasked, but actually only the ones
+         * mapped to this CPU will be unmasked
+         */
+        mvreg_write(pp, MVNETA_INTR_NEW_MASK,
+                    MVNETA_RX_INTR_MASK_ALL |
+                    MVNETA_TX_INTR_MASK_ALL |
+                    MVNETA_MISCINTR_INTR_MASK);
+}
+
+static void mvneta_percpu_mask_interrupt(void *arg)
+{
+        struct mvneta_port *pp = arg;
+
+        /* All the queue are masked, but actually only the ones
+         * mapped to this CPU will be masked
+         */
+        mvreg_write(pp, MVNETA_INTR_NEW_MASK, 0);
+        mvreg_write(pp, MVNETA_INTR_OLD_MASK, 0);
+        mvreg_write(pp, MVNETA_INTR_MISC_MASK, 0);
+}
+
+static void mvneta_percpu_clear_intr_cause(void *arg)
+{
+        struct mvneta_port *pp = arg;
+
+        /* All the queue are cleared, but actually only the ones
+         * mapped to this CPU will be cleared
+         */
+        mvreg_write(pp, MVNETA_INTR_NEW_CAUSE, 0);
+        mvreg_write(pp, MVNETA_INTR_MISC_CAUSE, 0);
+        mvreg_write(pp, MVNETA_INTR_OLD_CAUSE, 0);
+}
+
 /* This method sets defaults to the NETA port:
  *      Clears interrupt Cause and Mask registers.
  *      Clears all MAC tables.
@@ -1055,14 +1097,10 @@ static void mvneta_defaults_set(struct mvneta_port *pp)
         int max_cpu = num_present_cpus();
 
         /* Clear all Cause registers */
-        mvreg_write(pp, MVNETA_INTR_NEW_CAUSE, 0);
-        mvreg_write(pp, MVNETA_INTR_OLD_CAUSE, 0);
-        mvreg_write(pp, MVNETA_INTR_MISC_CAUSE, 0);
+        on_each_cpu(mvneta_percpu_clear_intr_cause, pp, true);
 
         /* Mask all interrupts */
-        mvreg_write(pp, MVNETA_INTR_NEW_MASK, 0);
-        mvreg_write(pp, MVNETA_INTR_OLD_MASK, 0);
-        mvreg_write(pp, MVNETA_INTR_MISC_MASK, 0);
+        on_each_cpu(mvneta_percpu_mask_interrupt, pp, true);
         mvreg_write(pp, MVNETA_INTR_ENABLE, 0);
 
         /* Enable MBUS Retry bit16 */
@@ -2528,34 +2566,9 @@ static int mvneta_setup_txqs(struct mvneta_port *pp)
         return 0;
 }
 
-static void mvneta_percpu_unmask_interrupt(void *arg)
-{
-        struct mvneta_port *pp = arg;
-
-        /* All the queue are unmasked, but actually only the ones
-         * maped to this CPU will be unmasked
-         */
-        mvreg_write(pp, MVNETA_INTR_NEW_MASK,
-                    MVNETA_RX_INTR_MASK_ALL |
-                    MVNETA_TX_INTR_MASK_ALL |
-                    MVNETA_MISCINTR_INTR_MASK);
-}
-
-static void mvneta_percpu_mask_interrupt(void *arg)
-{
-        struct mvneta_port *pp = arg;
-
-        /* All the queue are masked, but actually only the ones
-         * maped to this CPU will be masked
-         */
-        mvreg_write(pp, MVNETA_INTR_NEW_MASK, 0);
-        mvreg_write(pp, MVNETA_INTR_OLD_MASK, 0);
-        mvreg_write(pp, MVNETA_INTR_MISC_MASK, 0);
-}
-
 static void mvneta_start_dev(struct mvneta_port *pp)
 {
-        unsigned int cpu;
+        int cpu;
 
         mvneta_max_rx_size_set(pp, pp->pkt_size);
         mvneta_txq_max_tx_size_set(pp, pp->pkt_size);
@@ -2564,16 +2577,15 @@ static void mvneta_start_dev(struct mvneta_port *pp)
         mvneta_port_enable(pp);
 
         /* Enable polling on the port */
-        for_each_present_cpu(cpu) {
+        for_each_online_cpu(cpu) {
                 struct mvneta_pcpu_port *port = per_cpu_ptr(pp->ports, cpu);
 
                 napi_enable(&port->napi);
         }
 
         /* Unmask interrupts. It has to be done from each CPU */
-        for_each_online_cpu(cpu)
-                smp_call_function_single(cpu, mvneta_percpu_unmask_interrupt,
-                                         pp, true);
+        on_each_cpu(mvneta_percpu_unmask_interrupt, pp, true);
+
         mvreg_write(pp, MVNETA_INTR_MISC_MASK,
                     MVNETA_CAUSE_PHY_STATUS_CHANGE |
                     MVNETA_CAUSE_LINK_CHANGE |
@@ -2589,7 +2601,7 @@ static void mvneta_stop_dev(struct mvneta_port *pp)
 
         phy_stop(pp->phy_dev);
 
-        for_each_present_cpu(cpu) {
+        for_each_online_cpu(cpu) {
                 struct mvneta_pcpu_port *port = per_cpu_ptr(pp->ports, cpu);
 
                 napi_disable(&port->napi);
@@ -2604,13 +2616,10 @@ static void mvneta_stop_dev(struct mvneta_port *pp)
         mvneta_port_disable(pp);
 
         /* Clear all ethernet port interrupts */
-        mvreg_write(pp, MVNETA_INTR_MISC_CAUSE, 0);
-        mvreg_write(pp, MVNETA_INTR_OLD_CAUSE, 0);
+        on_each_cpu(mvneta_percpu_clear_intr_cause, pp, true);
 
         /* Mask all ethernet port interrupts */
-        mvreg_write(pp, MVNETA_INTR_NEW_MASK, 0);
-        mvreg_write(pp, MVNETA_INTR_OLD_MASK, 0);
-        mvreg_write(pp, MVNETA_INTR_MISC_MASK, 0);
+        on_each_cpu(mvneta_percpu_mask_interrupt, pp, true);
 
         mvneta_tx_reset(pp);
         mvneta_rx_reset(pp);
@@ -2847,11 +2856,20 @@ static void mvneta_percpu_disable(void *arg)
         disable_percpu_irq(pp->dev->irq);
 }
 
+/* Electing a CPU must be done in an atomic way: it should be done
+ * after or before the removal/insertion of a CPU and this function is
+ * not reentrant.
+ */
 static void mvneta_percpu_elect(struct mvneta_port *pp)
 {
-        int online_cpu_idx, max_cpu, cpu, i = 0;
+        int elected_cpu = 0, max_cpu, cpu, i = 0;
+
+        /* Use the cpu associated to the rxq when it is online, in all
+         * the other cases, use the cpu 0 which can't be offline.
+         */
+        if (cpu_online(pp->rxq_def))
+                elected_cpu = pp->rxq_def;
 
-        online_cpu_idx = pp->rxq_def % num_online_cpus();
         max_cpu = num_present_cpus();
 
         for_each_online_cpu(cpu) {
@@ -2862,7 +2880,7 @@ static void mvneta_percpu_elect(struct mvneta_port *pp)
                         if ((rxq % max_cpu) == cpu)
                                 rxq_map |= MVNETA_CPU_RXQ_ACCESS(rxq);
 
-                if (i == online_cpu_idx)
+                if (cpu == elected_cpu)
                         /* Map the default receive queue queue to the
                          * elected CPU
                          */
@@ -2873,7 +2891,7 @@ static void mvneta_percpu_elect(struct mvneta_port *pp)
                  * the CPU bound to the default RX queue
                  */
                 if (txq_number == 1)
-                        txq_map = (i == online_cpu_idx) ?
+                        txq_map = (cpu == elected_cpu) ?
                                 MVNETA_CPU_TXQ_ACCESS(1) : 0;
                 else
                         txq_map = mvreg_read(pp, MVNETA_CPU_MAP(cpu)) &
@@ -2902,6 +2920,14 @@ static int mvneta_percpu_notifier(struct notifier_block *nfb,
         switch (action) {
         case CPU_ONLINE:
         case CPU_ONLINE_FROZEN:
+                spin_lock(&pp->lock);
+                /* Configuring the driver for a new CPU while the
+                 * driver is stopping is racy, so just avoid it.
+                 */
+                if (pp->is_stopped) {
+                        spin_unlock(&pp->lock);
+                        break;
+                }
                 netif_tx_stop_all_queues(pp->dev);
 
                 /* We have to synchronise on tha napi of each CPU
@@ -2917,9 +2943,7 @@ static int mvneta_percpu_notifier(struct notifier_block *nfb,
                 }
 
                 /* Mask all ethernet port interrupts */
-                mvreg_write(pp, MVNETA_INTR_NEW_MASK, 0);
-                mvreg_write(pp, MVNETA_INTR_OLD_MASK, 0);
-                mvreg_write(pp, MVNETA_INTR_MISC_MASK, 0);
+                on_each_cpu(mvneta_percpu_mask_interrupt, pp, true);
                 napi_enable(&port->napi);
 
 
@@ -2934,27 +2958,25 @@ static int mvneta_percpu_notifier(struct notifier_block *nfb,
                  */
                 mvneta_percpu_elect(pp);
 
-                /* Unmask all ethernet port interrupts, as this
-                 * notifier is called for each CPU then the CPU to
-                 * Queue mapping is applied
-                 */
-                mvreg_write(pp, MVNETA_INTR_NEW_MASK,
-                        MVNETA_RX_INTR_MASK(rxq_number) |
-                        MVNETA_TX_INTR_MASK(txq_number) |
-                        MVNETA_MISCINTR_INTR_MASK);
+                /* Unmask all ethernet port interrupts */
+                on_each_cpu(mvneta_percpu_unmask_interrupt, pp, true);
                 mvreg_write(pp, MVNETA_INTR_MISC_MASK,
                         MVNETA_CAUSE_PHY_STATUS_CHANGE |
                         MVNETA_CAUSE_LINK_CHANGE |
                         MVNETA_CAUSE_PSC_SYNC_CHANGE);
                 netif_tx_start_all_queues(pp->dev);
+                spin_unlock(&pp->lock);
                 break;
         case CPU_DOWN_PREPARE:
         case CPU_DOWN_PREPARE_FROZEN:
                 netif_tx_stop_all_queues(pp->dev);
+                /* Thanks to this lock we are sure that any pending
+                 * cpu election is done
+                 */
+                spin_lock(&pp->lock);
                 /* Mask all ethernet port interrupts */
-                mvreg_write(pp, MVNETA_INTR_NEW_MASK, 0);
-                mvreg_write(pp, MVNETA_INTR_OLD_MASK, 0);
-                mvreg_write(pp, MVNETA_INTR_MISC_MASK, 0);
+                on_each_cpu(mvneta_percpu_mask_interrupt, pp, true);
+                spin_unlock(&pp->lock);
 
                 napi_synchronize(&port->napi);
                 napi_disable(&port->napi);
@@ -2968,12 +2990,11 @@ static int mvneta_percpu_notifier(struct notifier_block *nfb,
         case CPU_DEAD:
         case CPU_DEAD_FROZEN:
                 /* Check if a new CPU must be elected now this on is down */
+                spin_lock(&pp->lock);
                 mvneta_percpu_elect(pp);
+                spin_unlock(&pp->lock);
                 /* Unmask all ethernet port interrupts */
-                mvreg_write(pp, MVNETA_INTR_NEW_MASK,
-                        MVNETA_RX_INTR_MASK(rxq_number) |
-                        MVNETA_TX_INTR_MASK(txq_number) |
-                        MVNETA_MISCINTR_INTR_MASK);
+                on_each_cpu(mvneta_percpu_unmask_interrupt, pp, true);
                 mvreg_write(pp, MVNETA_INTR_MISC_MASK,
                         MVNETA_CAUSE_PHY_STATUS_CHANGE |
                         MVNETA_CAUSE_LINK_CHANGE |
@@ -2988,7 +3009,7 @@ static int mvneta_percpu_notifier(struct notifier_block *nfb,
 static int mvneta_open(struct net_device *dev)
 {
         struct mvneta_port *pp = netdev_priv(dev);
-        int ret, cpu;
+        int ret;
 
         pp->pkt_size = MVNETA_RX_PKT_SIZE(pp->dev->mtu);
         pp->frag_size = SKB_DATA_ALIGN(MVNETA_RX_BUF_SIZE(pp->pkt_size)) +
@@ -3010,22 +3031,12 @@ static int mvneta_open(struct net_device *dev)
                 goto err_cleanup_txqs;
         }
 
-        /* Even though the documentation says that request_percpu_irq
-         * doesn't enable the interrupts automatically, it actually
-         * does so on the local CPU.
-         *
-         * Make sure it's disabled.
-         */
-        mvneta_percpu_disable(pp);
-
         /* Enable per-CPU interrupt on all the CPU to handle our RX
          * queue interrupts
          */
-        for_each_online_cpu(cpu)
-                smp_call_function_single(cpu, mvneta_percpu_enable,
-                                         pp, true);
-
+        on_each_cpu(mvneta_percpu_enable, pp, true);
 
+        pp->is_stopped = false;
         /* Register a CPU notifier to handle the case where our CPU
          * might be taken offline.
          */
@@ -3057,13 +3068,20 @@ err_cleanup_rxqs:
 static int mvneta_stop(struct net_device *dev)
 {
         struct mvneta_port *pp = netdev_priv(dev);
-        int cpu;
 
+        /* Inform that we are stopping so we don't want to setup the
+         * driver for new CPUs in the notifiers
+         */
+        spin_lock(&pp->lock);
+        pp->is_stopped = true;
         mvneta_stop_dev(pp);
         mvneta_mdio_remove(pp);
         unregister_cpu_notifier(&pp->cpu_notifier);
-        for_each_present_cpu(cpu)
-                smp_call_function_single(cpu, mvneta_percpu_disable, pp, true);
+        /* Now that the notifier are unregistered, we can release le
+         * lock
+         */
+        spin_unlock(&pp->lock);
+        on_each_cpu(mvneta_percpu_disable, pp, true);
         free_percpu_irq(dev->irq, pp->ports);
         mvneta_cleanup_rxqs(pp);
         mvneta_cleanup_txqs(pp);
@@ -3312,9 +3330,7 @@ static int  mvneta_config_rss(struct mvneta_port *pp)
 
         netif_tx_stop_all_queues(pp->dev);
 
-        for_each_online_cpu(cpu)
-                smp_call_function_single(cpu, mvneta_percpu_mask_interrupt,
-                                         pp, true);
+        on_each_cpu(mvneta_percpu_mask_interrupt, pp, true);
 
         /* We have to synchronise on the napi of each CPU */
         for_each_online_cpu(cpu) {
@@ -3335,7 +3351,9 @@ static int  mvneta_config_rss(struct mvneta_port *pp)
         mvreg_write(pp, MVNETA_PORT_CONFIG, val);
 
         /* Update the elected CPU matching the new rxq_def */
+        spin_lock(&pp->lock);
         mvneta_percpu_elect(pp);
+        spin_unlock(&pp->lock);
 
         /* We have to synchronise on the napi of each CPU */
         for_each_online_cpu(cpu) {
diff --git a/drivers/net/ethernet/marvell/mvpp2.c b/drivers/net/ethernet/marvell/mvpp2.c
index a4beccf1fd46..c797971aefab 100644
--- a/drivers/net/ethernet/marvell/mvpp2.c
+++ b/drivers/net/ethernet/marvell/mvpp2.c
@@ -3061,7 +3061,7 @@ static int mvpp2_prs_mac_da_accept(struct mvpp2 *priv, int port,
 
                 pe = kzalloc(sizeof(*pe), GFP_KERNEL);
                 if (!pe)
-                        return -1;
+                        return -ENOMEM;
                 mvpp2_prs_tcam_lu_set(pe, MVPP2_PRS_LU_MAC);
                 pe->index = tid;
 
@@ -3077,7 +3077,7 @@ static int mvpp2_prs_mac_da_accept(struct mvpp2 *priv, int port,
         if (pmap == 0) {
                 if (add) {
                         kfree(pe);
-                        return -1;
+                        return -EINVAL;
                 }
                 mvpp2_prs_hw_inv(priv, pe->index);
                 priv->prs_shadow[pe->index].valid = false;
diff --git a/drivers/net/ethernet/mellanox/mlx4/catas.c b/drivers/net/ethernet/mellanox/mlx4/catas.c
index 715de8affcc9..c7e939945259 100644
--- a/drivers/net/ethernet/mellanox/mlx4/catas.c
+++ b/drivers/net/ethernet/mellanox/mlx4/catas.c
@@ -182,10 +182,17 @@ void mlx4_enter_error_state(struct mlx4_dev_persistent *persist)
                 err = mlx4_reset_slave(dev);
         else
                 err = mlx4_reset_master(dev);
-        BUG_ON(err != 0);
 
+        if (!err) {
+                mlx4_err(dev, "device was reset successfully\n");
+        } else {
+                /* EEH could have disabled the PCI channel during reset. That's
+                 * recoverable and the PCI error flow will handle it.
+                 */
+                if (!pci_channel_offline(dev->persist->pdev))
+                        BUG_ON(1);
+        }
         dev->persist->state |= MLX4_DEVICE_STATE_INTERNAL_ERROR;
-        mlx4_err(dev, "device was reset successfully\n");
         mutex_unlock(&persist->device_state_mutex);
 
         /* At that step HW was already reset, now notify clients */
diff --git a/drivers/net/ethernet/mellanox/mlx4/cmd.c b/drivers/net/ethernet/mellanox/mlx4/cmd.c
index d48d5793407d..e94ca1c3fc7c 100644
--- a/drivers/net/ethernet/mellanox/mlx4/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx4/cmd.c
@@ -2429,7 +2429,7 @@ err_thread:
         flush_workqueue(priv->mfunc.master.comm_wq);
         destroy_workqueue(priv->mfunc.master.comm_wq);
 err_slaves:
-        while (--i) {
+        while (i--) {
                 for (port = 1; port <= MLX4_MAX_PORTS; port++)
                         kfree(priv->mfunc.master.slave_state[i].vlan_filter[port]);
         }
diff --git a/drivers/net/ethernet/mellanox/mlx4/cq.c b/drivers/net/ethernet/mellanox/mlx4/cq.c
index 3348e646db70..a849da92f857 100644
--- a/drivers/net/ethernet/mellanox/mlx4/cq.c
+++ b/drivers/net/ethernet/mellanox/mlx4/cq.c
@@ -318,7 +318,9 @@ int mlx4_cq_alloc(struct mlx4_dev *dev, int nent,
         if (timestamp_en)
                 cq_context->flags  |= cpu_to_be32(1 << 19);
 
-        cq_context->logsize_usrpage = cpu_to_be32((ilog2(nent) << 24) | uar->index);
+        cq_context->logsize_usrpage =
+                cpu_to_be32((ilog2(nent) << 24) |
+                            mlx4_to_hw_uar_index(dev, uar->index));
         cq_context->comp_eqn        = priv->eq_table.eq[MLX4_CQ_TO_EQ_VECTOR(vector)].eqn;
         cq_context->log_page_size   = mtt->page_shift - MLX4_ICM_PAGE_SHIFT;
 
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_clock.c b/drivers/net/ethernet/mellanox/mlx4/en_clock.c
index 038f9ce391e6..1494997c4f7e 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_clock.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_clock.c
@@ -236,6 +236,24 @@ static const struct ptp_clock_info mlx4_en_ptp_clock_info = {
         .enable         = mlx4_en_phc_enable,
 };
 
+#define MLX4_EN_WRAP_AROUND_SEC 10ULL
+
+/* This function calculates the max shift that enables the user range
+ * of MLX4_EN_WRAP_AROUND_SEC values in the cycles register.
+ */
+static u32 freq_to_shift(u16 freq)
+{
+        u32 freq_khz = freq * 1000;
+        u64 max_val_cycles = freq_khz * 1000 * MLX4_EN_WRAP_AROUND_SEC;
+        u64 max_val_cycles_rounded = is_power_of_2(max_val_cycles + 1) ?
+                max_val_cycles : roundup_pow_of_two(max_val_cycles) - 1;
+        /* calculate max possible multiplier in order to fit in 64bit */
+        u64 max_mul = div_u64(0xffffffffffffffffULL, max_val_cycles_rounded);
+
+        /* This comes from the reverse of clocksource_khz2mult */
+        return ilog2(div_u64(max_mul * freq_khz, 1000000));
+}
+
 void mlx4_en_init_timestamp(struct mlx4_en_dev *mdev)
 {
         struct mlx4_dev *dev = mdev->dev;
@@ -254,12 +272,7 @@ void mlx4_en_init_timestamp(struct mlx4_en_dev *mdev)
         memset(&mdev->cycles, 0, sizeof(mdev->cycles));
         mdev->cycles.read = mlx4_en_read_clock;
         mdev->cycles.mask = CLOCKSOURCE_MASK(48);
-        /* Using shift to make calculation more accurate. Since current HW
-         * clock frequency is 427 MHz, and cycles are given using a 48 bits
-         * register, the biggest shift when calculating using u64, is 14
-         * (max_cycles * multiplier < 2^64)
-         */
-        mdev->cycles.shift = 14;
+        mdev->cycles.shift = freq_to_shift(dev->caps.hca_core_clock);
         mdev->cycles.mult =
                 clocksource_khz2mult(1000 * dev->caps.hca_core_clock, mdev->cycles.shift);
         mdev->nominal_c_mult = mdev->cycles.mult;
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
index 0c7e3f69a73b..21e2c0960271 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
@@ -2245,7 +2245,7 @@ static int mlx4_en_set_vf_mac(struct net_device *dev, int queue, u8 *mac)
         struct mlx4_en_dev *mdev = en_priv->mdev;
         u64 mac_u64 = mlx4_mac_to_u64(mac);
 
-        if (!is_valid_ether_addr(mac))
+        if (is_multicast_ether_addr(mac))
                 return -EINVAL;
 
         return mlx4_set_vf_mac(mdev->dev, en_priv->port, queue, mac_u64);
@@ -2344,8 +2344,6 @@ out:
         /* set offloads */
         priv->dev->hw_enc_features |= NETIF_F_IP_CSUM | NETIF_F_RXCSUM |
                                       NETIF_F_TSO | NETIF_F_GSO_UDP_TUNNEL;
-        priv->dev->hw_features |= NETIF_F_GSO_UDP_TUNNEL;
-        priv->dev->features    |= NETIF_F_GSO_UDP_TUNNEL;
 }
 
 static void mlx4_en_del_vxlan_offloads(struct work_struct *work)
@@ -2356,8 +2354,6 @@ static void mlx4_en_del_vxlan_offloads(struct work_struct *work)
         /* unset offloads */
         priv->dev->hw_enc_features &= ~(NETIF_F_IP_CSUM | NETIF_F_RXCSUM |
                                       NETIF_F_TSO | NETIF_F_GSO_UDP_TUNNEL);
-        priv->dev->hw_features &= ~NETIF_F_GSO_UDP_TUNNEL;
-        priv->dev->features    &= ~NETIF_F_GSO_UDP_TUNNEL;
 
         ret = mlx4_SET_PORT_VXLAN(priv->mdev->dev, priv->port,
                                   VXLAN_STEER_BY_OUTER_MAC, 0);
@@ -2980,6 +2976,11 @@ int mlx4_en_init_netdev(struct mlx4_en_dev *mdev, int port,
                 priv->rss_hash_fn = ETH_RSS_HASH_TOP;
         }
 
+        if (mdev->dev->caps.tunnel_offload_mode == MLX4_TUNNEL_OFFLOAD_MODE_VXLAN) {
+                dev->hw_features |= NETIF_F_GSO_UDP_TUNNEL;
+                dev->features    |= NETIF_F_GSO_UDP_TUNNEL;
+        }
+
         mdev->pndev[port] = dev;
         mdev->upper[port] = NULL;
 
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_port.c b/drivers/net/ethernet/mellanox/mlx4/en_port.c
index ee99e67187f5..3904b5fc0b7c 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_port.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_port.c
@@ -238,11 +238,11 @@ int mlx4_en_DUMP_ETH_STATS(struct mlx4_en_dev *mdev, u8 port, u8 reset)
         stats->collisions = 0;
         stats->rx_dropped = be32_to_cpu(mlx4_en_stats->RDROP);
         stats->rx_length_errors = be32_to_cpu(mlx4_en_stats->RdropLength);
-        stats->rx_over_errors = be32_to_cpu(mlx4_en_stats->RdropOvflw);
+        stats->rx_over_errors = 0;
         stats->rx_crc_errors = be32_to_cpu(mlx4_en_stats->RCRC);
         stats->rx_frame_errors = 0;
         stats->rx_fifo_errors = be32_to_cpu(mlx4_en_stats->RdropOvflw);
-        stats->rx_missed_errors = be32_to_cpu(mlx4_en_stats->RdropOvflw);
+        stats->rx_missed_errors = 0;
         stats->tx_aborted_errors = 0;
         stats->tx_carrier_errors = 0;
         stats->tx_fifo_errors = 0;
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_resources.c b/drivers/net/ethernet/mellanox/mlx4/en_resources.c
index 12aab5a659d3..02e925d6f734 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_resources.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_resources.c
@@ -58,7 +58,8 @@ void mlx4_en_fill_qp_context(struct mlx4_en_priv *priv, int size, int stride,
         } else {
                 context->sq_size_stride = ilog2(TXBB_SIZE) - 4;
         }
-        context->usr_page = cpu_to_be32(mdev->priv_uar.index);
+        context->usr_page = cpu_to_be32(mlx4_to_hw_uar_index(mdev->dev,
+                                        mdev->priv_uar.index));
         context->local_qpn = cpu_to_be32(qpn);
         context->pri_path.ackto = 1 & 0x07;
         context->pri_path.sched_queue = 0x83 | (priv->port - 1) << 6;
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_tx.c b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
index 4421bf5463f6..e0946ab22010 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_tx.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
@@ -213,7 +213,9 @@ int mlx4_en_activate_tx_ring(struct mlx4_en_priv *priv,
         mlx4_en_fill_qp_context(priv, ring->size, ring->stride, 1, 0, ring->qpn,
                                 ring->cqn, user_prio, &ring->context);
         if (ring->bf_alloced)
-                ring->context.usr_page = cpu_to_be32(ring->bf.uar->index);
+                ring->context.usr_page =
+                        cpu_to_be32(mlx4_to_hw_uar_index(mdev->dev,
+                                                         ring->bf.uar->index));
 
         err = mlx4_qp_to_ready(mdev->dev, &ring->wqres.mtt, &ring->context,
                                &ring->qp, &ring->qp_state);
diff --git a/drivers/net/ethernet/mellanox/mlx4/eq.c b/drivers/net/ethernet/mellanox/mlx4/eq.c
index 4696053165f8..f613977455e0 100644
--- a/drivers/net/ethernet/mellanox/mlx4/eq.c
+++ b/drivers/net/ethernet/mellanox/mlx4/eq.c
@@ -940,9 +940,10 @@ static void __iomem *mlx4_get_eq_uar(struct mlx4_dev *dev, struct mlx4_eq *eq)
 
         if (!priv->eq_table.uar_map[index]) {
                 priv->eq_table.uar_map[index] =
-                        ioremap(pci_resource_start(dev->persist->pdev, 2) +
-                                ((eq->eqn / 4) << PAGE_SHIFT),
-                                PAGE_SIZE);
+                        ioremap(
+                                pci_resource_start(dev->persist->pdev, 2) +
+                                ((eq->eqn / 4) << (dev->uar_page_shift)),
+                                (1 << (dev->uar_page_shift)));
                 if (!priv->eq_table.uar_map[index]) {
                         mlx4_err(dev, "Couldn't map EQ doorbell for EQN 0x%06x\n",
                                  eq->eqn);
diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
index f1b6d219e445..f8674ae62752 100644
--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -168,6 +168,20 @@ struct mlx4_port_config {
 
 static atomic_t pf_loading = ATOMIC_INIT(0);
 
+static inline void mlx4_set_num_reserved_uars(struct mlx4_dev *dev,
+                                              struct mlx4_dev_cap *dev_cap)
+{
+        /* The reserved_uars is calculated by system page size unit.
+         * Therefore, adjustment is added when the uar page size is less
+         * than the system page size
+         */
+        dev->caps.reserved_uars =
+                max_t(int,
+                      mlx4_get_num_reserved_uar(dev),
+                      dev_cap->reserved_uars /
+                        (1 << (PAGE_SHIFT - dev->uar_page_shift)));
+}
+
 int mlx4_check_port_params(struct mlx4_dev *dev,
                            enum mlx4_port_type *port_type)
 {
@@ -386,8 +400,6 @@ static int mlx4_dev_cap(struct mlx4_dev *dev, struct mlx4_dev_cap *dev_cap)
         dev->caps.reserved_mtts      = dev_cap->reserved_mtts;
         dev->caps.reserved_mrws      = dev_cap->reserved_mrws;
 
-        /* The first 128 UARs are used for EQ doorbells */
-        dev->caps.reserved_uars      = max_t(int, 128, dev_cap->reserved_uars);
         dev->caps.reserved_pds       = dev_cap->reserved_pds;
         dev->caps.reserved_xrcds     = (dev->caps.flags & MLX4_DEV_CAP_FLAG_XRC) ?
                                         dev_cap->reserved_xrcds : 0;
@@ -405,6 +417,15 @@ static int mlx4_dev_cap(struct mlx4_dev *dev, struct mlx4_dev_cap *dev_cap)
         dev->caps.max_gso_sz         = dev_cap->max_gso_sz;
         dev->caps.max_rss_tbl_sz     = dev_cap->max_rss_tbl_sz;
 
+        /* Save uar page shift */
+        if (!mlx4_is_slave(dev)) {
+                /* Virtual PCI function needs to determine UAR page size from
+                 * firmware. Only master PCI function can set the uar page size
+                 */
+                dev->uar_page_shift = DEFAULT_UAR_PAGE_SHIFT;
+                mlx4_set_num_reserved_uars(dev, dev_cap);
+        }
+
         if (dev->caps.flags2 & MLX4_DEV_CAP_FLAG2_PHV_EN) {
                 struct mlx4_init_hca_param hca_param;
 
@@ -815,16 +836,25 @@ static int mlx4_slave_cap(struct mlx4_dev *dev)
                 return -ENODEV;
         }
 
-        /* slave gets uar page size from QUERY_HCA fw command */
-        dev->caps.uar_page_size = 1 << (hca_param.uar_page_sz + 12);
+        /* Set uar_page_shift for VF */
+        dev->uar_page_shift = hca_param.uar_page_sz + 12;
 
-        /* TODO: relax this assumption */
-        if (dev->caps.uar_page_size != PAGE_SIZE) {
-                mlx4_err(dev, "UAR size:%d != kernel PAGE_SIZE of %ld\n",
-                         dev->caps.uar_page_size, PAGE_SIZE);
-                return -ENODEV;
+        /* Make sure the master uar page size is valid */
+        if (dev->uar_page_shift > PAGE_SHIFT) {
+                mlx4_err(dev,
+                         "Invalid configuration: uar page size is larger than system page size\n");
+                return  -ENODEV;
         }
 
+        /* Set reserved_uars based on the uar_page_shift */
+        mlx4_set_num_reserved_uars(dev, &dev_cap);
+
+        /* Although uar page size in FW differs from system page size,
+         * upper software layers (mlx4_ib, mlx4_en and part of mlx4_core)
+         * still works with assumption that uar page size == system page size
+         */
+        dev->caps.uar_page_size = PAGE_SIZE;
+
         memset(&func_cap, 0, sizeof(func_cap));
         err = mlx4_QUERY_FUNC_CAP(dev, 0, &func_cap);
         if (err) {
@@ -1226,6 +1256,7 @@ err_set_port:
 static int mlx4_mf_bond(struct mlx4_dev *dev)
 {
         int err = 0;
+        int nvfs;
         struct mlx4_slaves_pport slaves_port1;
         struct mlx4_slaves_pport slaves_port2;
         DECLARE_BITMAP(slaves_port_1_2, MLX4_MFUNC_MAX);
@@ -1242,11 +1273,18 @@ static int mlx4_mf_bond(struct mlx4_dev *dev)
                 return -EINVAL;
         }
 
+        /* number of virtual functions is number of total functions minus one
+         * physical function for each port.
+         */
+        nvfs = bitmap_weight(slaves_port1.slaves, dev->persist->num_vfs + 1) +
+                bitmap_weight(slaves_port2.slaves, dev->persist->num_vfs + 1) - 2;
+
         /* limit on maximum allowed VFs */
-        if ((bitmap_weight(slaves_port1.slaves, dev->persist->num_vfs + 1) +
-            bitmap_weight(slaves_port2.slaves, dev->persist->num_vfs + 1)) >
-            MAX_MF_BOND_ALLOWED_SLAVES)
+        if (nvfs > MAX_MF_BOND_ALLOWED_SLAVES) {
+                mlx4_warn(dev, "HA mode is not supported for %d VFs (max %d are allowed)\n",
+                          nvfs, MAX_MF_BOND_ALLOWED_SLAVES);
                 return -EINVAL;
+        }
 
         if (dev->caps.steering_mode != MLX4_STEERING_MODE_DEVICE_MANAGED) {
                 mlx4_warn(dev, "HA mode unsupported for NON DMFS steering\n");
@@ -2179,8 +2217,12 @@ static int mlx4_init_hca(struct mlx4_dev *dev)
 
                 dev->caps.max_fmr_maps = (1 << (32 - ilog2(dev->caps.num_mpts))) - 1;
 
-                init_hca.log_uar_sz = ilog2(dev->caps.num_uars);
-                init_hca.uar_page_sz = PAGE_SHIFT - 12;
+                /* Always set UAR page size 4KB, set log_uar_sz accordingly */
+                init_hca.log_uar_sz = ilog2(dev->caps.num_uars) +
+                                      PAGE_SHIFT -
+                                      DEFAULT_UAR_PAGE_SHIFT;
+                init_hca.uar_page_sz = DEFAULT_UAR_PAGE_SHIFT - 12;
+
                 init_hca.mw_enabled = 0;
                 if (dev->caps.flags & MLX4_DEV_CAP_FLAG_MEM_WINDOW ||
                     dev->caps.bmme_flags & MLX4_BMME_FLAG_TYPE_2_WIN)
diff --git a/drivers/net/ethernet/mellanox/mlx4/pd.c b/drivers/net/ethernet/mellanox/mlx4/pd.c
index 609c59dc854e..b3cc3ab63799 100644
--- a/drivers/net/ethernet/mellanox/mlx4/pd.c
+++ b/drivers/net/ethernet/mellanox/mlx4/pd.c
@@ -269,9 +269,15 @@ EXPORT_SYMBOL_GPL(mlx4_bf_free);
 
 int mlx4_init_uar_table(struct mlx4_dev *dev)
 {
-        if (dev->caps.num_uars <= 128) {
-                mlx4_err(dev, "Only %d UAR pages (need more than 128)\n",
-                         dev->caps.num_uars);
+        int num_reserved_uar = mlx4_get_num_reserved_uar(dev);
+
+        mlx4_dbg(dev, "uar_page_shift = %d", dev->uar_page_shift);
+        mlx4_dbg(dev, "Effective reserved_uars=%d", dev->caps.reserved_uars);
+
+        if (dev->caps.num_uars <= num_reserved_uar) {
+                mlx4_err(
+                        dev, "Only %d UAR pages (need more than %d)\n",
+                        dev->caps.num_uars, num_reserved_uar);
                 mlx4_err(dev, "Increase firmware log2_uar_bar_megabytes?\n");
                 return -ENODEV;
         }
diff --git a/drivers/net/ethernet/mellanox/mlx4/port.c b/drivers/net/ethernet/mellanox/mlx4/port.c
index 787b7bb54d52..211c65087997 100644
--- a/drivers/net/ethernet/mellanox/mlx4/port.c
+++ b/drivers/net/ethernet/mellanox/mlx4/port.c
@@ -193,10 +193,10 @@ int __mlx4_register_mac(struct mlx4_dev *dev, u8 port, u64 mac)
         if (need_mf_bond) {
                 if (port == 1) {
                         mutex_lock(&table->mutex);
-                        mutex_lock(&dup_table->mutex);
+                        mutex_lock_nested(&dup_table->mutex, SINGLE_DEPTH_NESTING);
                 } else {
                         mutex_lock(&dup_table->mutex);
-                        mutex_lock(&table->mutex);
+                        mutex_lock_nested(&table->mutex, SINGLE_DEPTH_NESTING);
                 }
         } else {
                 mutex_lock(&table->mutex);
@@ -389,10 +389,10 @@ void __mlx4_unregister_mac(struct mlx4_dev *dev, u8 port, u64 mac)
         if (dup) {
                 if (port == 1) {
                         mutex_lock(&table->mutex);
-                        mutex_lock(&dup_table->mutex);
+                        mutex_lock_nested(&dup_table->mutex, SINGLE_DEPTH_NESTING);
                 } else {
                         mutex_lock(&dup_table->mutex);
-                        mutex_lock(&table->mutex);
+                        mutex_lock_nested(&table->mutex, SINGLE_DEPTH_NESTING);
                 }
         } else {
                 mutex_lock(&table->mutex);
@@ -479,10 +479,10 @@ int __mlx4_replace_mac(struct mlx4_dev *dev, u8 port, int qpn, u64 new_mac)
         if (dup) {
                 if (port == 1) {
                         mutex_lock(&table->mutex);
-                        mutex_lock(&dup_table->mutex);
+                        mutex_lock_nested(&dup_table->mutex, SINGLE_DEPTH_NESTING);
                 } else {
                         mutex_lock(&dup_table->mutex);
-                        mutex_lock(&table->mutex);
+                        mutex_lock_nested(&table->mutex, SINGLE_DEPTH_NESTING);
                 }
         } else {
                 mutex_lock(&table->mutex);
@@ -588,10 +588,10 @@ int __mlx4_register_vlan(struct mlx4_dev *dev, u8 port, u16 vlan,
         if (need_mf_bond) {
                 if (port == 1) {
                         mutex_lock(&table->mutex);
-                        mutex_lock(&dup_table->mutex);
+                        mutex_lock_nested(&dup_table->mutex, SINGLE_DEPTH_NESTING);
                 } else {
                         mutex_lock(&dup_table->mutex);
-                        mutex_lock(&table->mutex);
+                        mutex_lock_nested(&table->mutex, SINGLE_DEPTH_NESTING);
                 }
         } else {
                 mutex_lock(&table->mutex);
@@ -764,10 +764,10 @@ void __mlx4_unregister_vlan(struct mlx4_dev *dev, u8 port, u16 vlan)
         if (dup) {
                 if (port == 1) {
                         mutex_lock(&table->mutex);
-                        mutex_lock(&dup_table->mutex);
+                        mutex_lock_nested(&dup_table->mutex, SINGLE_DEPTH_NESTING);
                 } else {
                         mutex_lock(&dup_table->mutex);
-                        mutex_lock(&table->mutex);
+                        mutex_lock_nested(&table->mutex, SINGLE_DEPTH_NESTING);
                 }
         } else {
                 mutex_lock(&table->mutex);
diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
index b46dbe29ef6c..25ce1b030a00 100644
--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
+++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
@@ -915,11 +915,13 @@ static int handle_existing_counter(struct mlx4_dev *dev, u8 slave, int port,
 
         spin_lock_irq(mlx4_tlock(dev));
         r = find_res(dev, counter_index, RES_COUNTER);
-        if (!r || r->owner != slave)
+        if (!r || r->owner != slave) {
                 ret = -EINVAL;
-        counter = container_of(r, struct res_counter, com);
-        if (!counter->port)
-                counter->port = port;
+        } else {
+                counter = container_of(r, struct res_counter, com);
+                if (!counter->port)
+                        counter->port = port;
+        }
 
         spin_unlock_irq(mlx4_tlock(dev));
         return ret;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h
index aac071a7e830..5b1753233c5d 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h
@@ -223,6 +223,7 @@ struct mlx5e_pport_stats {
 
 static const char rq_stats_strings[][ETH_GSTRING_LEN] = {
         "packets",
+        "bytes",
         "csum_none",
         "csum_sw",
         "lro_packets",
@@ -232,16 +233,18 @@ static const char rq_stats_strings[][ETH_GSTRING_LEN] = {
 
 struct mlx5e_rq_stats {
         u64 packets;
+        u64 bytes;
         u64 csum_none;
         u64 csum_sw;
         u64 lro_packets;
         u64 lro_bytes;
         u64 wqe_err;
-#define NUM_RQ_STATS 6
+#define NUM_RQ_STATS 7
 };
 
 static const char sq_stats_strings[][ETH_GSTRING_LEN] = {
         "packets",
+        "bytes",
         "tso_packets",
         "tso_bytes",
         "csum_offload_none",
@@ -253,6 +256,7 @@ static const char sq_stats_strings[][ETH_GSTRING_LEN] = {
 
 struct mlx5e_sq_stats {
         u64 packets;
+        u64 bytes;
         u64 tso_packets;
         u64 tso_bytes;
         u64 csum_offload_none;
@@ -260,7 +264,7 @@ struct mlx5e_sq_stats {
         u64 wake;
         u64 dropped;
         u64 nop;
-#define NUM_SQ_STATS 8
+#define NUM_SQ_STATS 9
 };
 
 struct mlx5e_stats {
@@ -304,14 +308,9 @@ enum {
         MLX5E_RQ_STATE_POST_WQES_ENABLE,
 };
 
-enum cq_flags {
-        MLX5E_CQ_HAS_CQES = 1,
-};
-
 struct mlx5e_cq {
         /* data path - accessed per cqe */
         struct mlx5_cqwq           wq;
-        unsigned long              flags;
 
         /* data path - accessed per napi poll */
         struct napi_struct        *napi;
@@ -452,6 +451,8 @@ enum mlx5e_traffic_types {
         MLX5E_NUM_TT,
 };
 
+#define IS_HASHING_TT(tt) (tt != MLX5E_TT_ANY)
+
 enum mlx5e_rqt_ix {
         MLX5E_INDIRECTION_RQT,
         MLX5E_SINGLE_RQ_RQT,
@@ -618,9 +619,12 @@ void mlx5e_enable_vlan_filter(struct mlx5e_priv *priv);
 void mlx5e_disable_vlan_filter(struct mlx5e_priv *priv);
 
 int mlx5e_redirect_rqt(struct mlx5e_priv *priv, enum mlx5e_rqt_ix rqt_ix);
+void mlx5e_build_tir_ctx_hash(void *tirc, struct mlx5e_priv *priv);
 
 int mlx5e_open_locked(struct net_device *netdev);
 int mlx5e_close_locked(struct net_device *netdev);
+void mlx5e_build_default_indir_rqt(u32 *indirection_rqt, int len,
+                                   int num_channels);
 
 static inline void mlx5e_tx_notify_hw(struct mlx5e_sq *sq,
                                       struct mlx5e_tx_wqe *wqe, int bf_sz)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_clock.c b/drivers/net/ethernet/mellanox/mlx5/core/en_clock.c
index be6543570b2b..2018eebe1531 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_clock.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_clock.c
@@ -62,10 +62,11 @@ static void mlx5e_timestamp_overflow(struct work_struct *work)
         struct delayed_work *dwork = to_delayed_work(work);
         struct mlx5e_tstamp *tstamp = container_of(dwork, struct mlx5e_tstamp,
                                                    overflow_work);
+        unsigned long flags;
 
-        write_lock(&tstamp->lock);
+        write_lock_irqsave(&tstamp->lock, flags);
         timecounter_read(&tstamp->clock);
-        write_unlock(&tstamp->lock);
+        write_unlock_irqrestore(&tstamp->lock, flags);
         schedule_delayed_work(&tstamp->overflow_work, tstamp->overflow_period);
 }
 
@@ -136,10 +137,11 @@ static int mlx5e_ptp_settime(struct ptp_clock_info *ptp,
         struct mlx5e_tstamp *tstamp = container_of(ptp, struct mlx5e_tstamp,
                                                    ptp_info);
         u64 ns = timespec64_to_ns(ts);
+        unsigned long flags;
 
-        write_lock(&tstamp->lock);
+        write_lock_irqsave(&tstamp->lock, flags);
         timecounter_init(&tstamp->clock, &tstamp->cycles, ns);
-        write_unlock(&tstamp->lock);
+        write_unlock_irqrestore(&tstamp->lock, flags);
 
         return 0;
 }
@@ -150,10 +152,11 @@ static int mlx5e_ptp_gettime(struct ptp_clock_info *ptp,
         struct mlx5e_tstamp *tstamp = container_of(ptp, struct mlx5e_tstamp,
                                                    ptp_info);
         u64 ns;
+        unsigned long flags;
 
-        write_lock(&tstamp->lock);
+        write_lock_irqsave(&tstamp->lock, flags);
         ns = timecounter_read(&tstamp->clock);
-        write_unlock(&tstamp->lock);
+        write_unlock_irqrestore(&tstamp->lock, flags);
 
         *ts = ns_to_timespec64(ns);
 
@@ -164,10 +167,11 @@ static int mlx5e_ptp_adjtime(struct ptp_clock_info *ptp, s64 delta)
 {
         struct mlx5e_tstamp *tstamp = container_of(ptp, struct mlx5e_tstamp,
                                                    ptp_info);
+        unsigned long flags;
 
-        write_lock(&tstamp->lock);
+        write_lock_irqsave(&tstamp->lock, flags);
         timecounter_adjtime(&tstamp->clock, delta);
-        write_unlock(&tstamp->lock);
+        write_unlock_irqrestore(&tstamp->lock, flags);
 
         return 0;
 }
@@ -176,6 +180,7 @@ static int mlx5e_ptp_adjfreq(struct ptp_clock_info *ptp, s32 delta)
 {
         u64 adj;
         u32 diff;
+        unsigned long flags;
         int neg_adj = 0;
         struct mlx5e_tstamp *tstamp = container_of(ptp, struct mlx5e_tstamp,
                                                   ptp_info);
@@ -189,11 +194,11 @@ static int mlx5e_ptp_adjfreq(struct ptp_clock_info *ptp, s32 delta)
         adj *= delta;
         diff = div_u64(adj, 1000000000ULL);
 
-        write_lock(&tstamp->lock);
+        write_lock_irqsave(&tstamp->lock, flags);
         timecounter_read(&tstamp->clock);
         tstamp->cycles.mult = neg_adj ? tstamp->nominal_c_mult - diff :
                                         tstamp->nominal_c_mult + diff;
-        write_unlock(&tstamp->lock);
+        write_unlock_irqrestore(&tstamp->lock, flags);
 
         return 0;
 }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
index 65624ac65b4c..5abeb00fceb8 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
@@ -385,6 +385,8 @@ static int mlx5e_set_channels(struct net_device *dev,
                 mlx5e_close_locked(dev);
 
         priv->params.num_channels = count;
+        mlx5e_build_default_indir_rqt(priv->params.indirection_rqt,
+                                      MLX5E_INDIR_RQT_SIZE, count);
 
         if (was_opened)
                 err = mlx5e_open_locked(dev);
@@ -703,18 +705,36 @@ static int mlx5e_get_rxfh(struct net_device *netdev, u32 *indir, u8 *key,
         return 0;
 }
 
+static void mlx5e_modify_tirs_hash(struct mlx5e_priv *priv, void *in, int inlen)
+{
+        struct mlx5_core_dev *mdev = priv->mdev;
+        void *tirc = MLX5_ADDR_OF(modify_tir_in, in, ctx);
+        int i;
+
+        MLX5_SET(modify_tir_in, in, bitmask.hash, 1);
+        mlx5e_build_tir_ctx_hash(tirc, priv);
+
+        for (i = 0; i < MLX5E_NUM_TT; i++)
+                if (IS_HASHING_TT(i))
+                        mlx5_core_modify_tir(mdev, priv->tirn[i], in, inlen);
+}
+
 static int mlx5e_set_rxfh(struct net_device *dev, const u32 *indir,
                           const u8 *key, const u8 hfunc)
 {
         struct mlx5e_priv *priv = netdev_priv(dev);
-        bool close_open;
-        int err = 0;
+        int inlen = MLX5_ST_SZ_BYTES(modify_tir_in);
+        void *in;
 
         if ((hfunc != ETH_RSS_HASH_NO_CHANGE) &&
             (hfunc != ETH_RSS_HASH_XOR) &&
             (hfunc != ETH_RSS_HASH_TOP))
                 return -EINVAL;
 
+        in = mlx5_vzalloc(inlen);
+        if (!in)
+                return -ENOMEM;
+
         mutex_lock(&priv->state_lock);
 
         if (indir) {
@@ -723,11 +743,6 @@ static int mlx5e_set_rxfh(struct net_device *dev, const u32 *indir,
                 mlx5e_redirect_rqt(priv, MLX5E_INDIRECTION_RQT);
         }
 
-        close_open = (key || (hfunc != ETH_RSS_HASH_NO_CHANGE)) &&
-                     test_bit(MLX5E_STATE_OPENED, &priv->state);
-        if (close_open)
-                mlx5e_close_locked(dev);
-
         if (key)
                 memcpy(priv->params.toeplitz_hash_key, key,
                        sizeof(priv->params.toeplitz_hash_key));
@@ -735,12 +750,13 @@ static int mlx5e_set_rxfh(struct net_device *dev, const u32 *indir,
         if (hfunc != ETH_RSS_HASH_NO_CHANGE)
                 priv->params.rss_hfunc = hfunc;
 
-        if (close_open)
-                err = mlx5e_open_locked(priv->netdev);
+        mlx5e_modify_tirs_hash(priv, in, inlen);
 
         mutex_unlock(&priv->state_lock);
 
-        return err;
+        kvfree(in);
+
+        return 0;
 }
 
 static int mlx5e_get_rxnfc(struct net_device *netdev,
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index 6a3e430f1062..402994bf7e16 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -141,6 +141,10 @@ void mlx5e_update_stats(struct mlx5e_priv *priv)
                 return;
 
         /* Collect firts the SW counters and then HW for consistency */
+        s->rx_packets           = 0;
+        s->rx_bytes             = 0;
+        s->tx_packets           = 0;
+        s->tx_bytes             = 0;
         s->tso_packets          = 0;
         s->tso_bytes            = 0;
         s->tx_queue_stopped     = 0;
@@ -155,6 +159,8 @@ void mlx5e_update_stats(struct mlx5e_priv *priv)
         for (i = 0; i < priv->params.num_channels; i++) {
                 rq_stats = &priv->channel[i]->rq.stats;
 
+                s->rx_packets   += rq_stats->packets;
+                s->rx_bytes     += rq_stats->bytes;
                 s->lro_packets  += rq_stats->lro_packets;
                 s->lro_bytes    += rq_stats->lro_bytes;
                 s->rx_csum_none += rq_stats->csum_none;
@@ -164,6 +170,8 @@ void mlx5e_update_stats(struct mlx5e_priv *priv)
                 for (j = 0; j < priv->params.num_tc; j++) {
                         sq_stats = &priv->channel[i]->sq[j].stats;
 
+                        s->tx_packets           += sq_stats->packets;
+                        s->tx_bytes             += sq_stats->bytes;
                         s->tso_packets          += sq_stats->tso_packets;
                         s->tso_bytes            += sq_stats->tso_bytes;
                         s->tx_queue_stopped     += sq_stats->stopped;
@@ -225,23 +233,6 @@ void mlx5e_update_stats(struct mlx5e_priv *priv)
         s->tx_broadcast_bytes   =
                 MLX5_GET_CTR(out, transmitted_eth_broadcast.octets);
 
-        s->rx_packets =
-                s->rx_unicast_packets +
-                s->rx_multicast_packets +
-                s->rx_broadcast_packets;
-        s->rx_bytes =
-                s->rx_unicast_bytes +
-                s->rx_multicast_bytes +
-                s->rx_broadcast_bytes;
-        s->tx_packets =
-                s->tx_unicast_packets +
-                s->tx_multicast_packets +
-                s->tx_broadcast_packets;
-        s->tx_bytes =
-                s->tx_unicast_bytes +
-                s->tx_multicast_bytes +
-                s->tx_broadcast_bytes;
-
         /* Update calculated offload counters */
         s->tx_csum_offload = s->tx_packets - tx_offload_none;
         s->rx_csum_good    = s->rx_packets - s->rx_csum_none -
@@ -1199,7 +1190,6 @@ static void mlx5e_fill_indir_rqt_rqns(struct mlx5e_priv *priv, void *rqtc)
                         ix = mlx5e_bits_invert(i, MLX5E_LOG_INDIR_RQT_SIZE);
 
                 ix = priv->params.indirection_rqt[ix];
-                ix = ix % priv->params.num_channels;
                 MLX5_SET(rqtc, rqtc, rq_num[i],
                          test_bit(MLX5E_STATE_OPENED, &priv->state) ?
                          priv->channel[ix]->rq.rqn :
@@ -1317,7 +1307,22 @@ static void mlx5e_build_tir_ctx_lro(void *tirc, struct mlx5e_priv *priv)
                               lro_timer_supported_periods[2]));
 }
 
-static int mlx5e_modify_tir_lro(struct mlx5e_priv *priv, int tt)
+void mlx5e_build_tir_ctx_hash(void *tirc, struct mlx5e_priv *priv)
+{
+        MLX5_SET(tirc, tirc, rx_hash_fn,
+                 mlx5e_rx_hash_fn(priv->params.rss_hfunc));
+        if (priv->params.rss_hfunc == ETH_RSS_HASH_TOP) {
+                void *rss_key = MLX5_ADDR_OF(tirc, tirc,
+                                             rx_hash_toeplitz_key);
+                size_t len = MLX5_FLD_SZ_BYTES(tirc,
+                                               rx_hash_toeplitz_key);
+
+                MLX5_SET(tirc, tirc, rx_hash_symmetric, 1);
+                memcpy(rss_key, priv->params.toeplitz_hash_key, len);
+        }
+}
+
+static int mlx5e_modify_tirs_lro(struct mlx5e_priv *priv)
 {
         struct mlx5_core_dev *mdev = priv->mdev;
 
@@ -1325,6 +1330,7 @@ static int mlx5e_modify_tir_lro(struct mlx5e_priv *priv, int tt)
         void *tirc;
         int inlen;
         int err;
+        int tt;
 
         inlen = MLX5_ST_SZ_BYTES(modify_tir_in);
         in = mlx5_vzalloc(inlen);
@@ -1336,7 +1342,11 @@ static int mlx5e_modify_tir_lro(struct mlx5e_priv *priv, int tt)
 
         mlx5e_build_tir_ctx_lro(tirc, priv);
 
-        err = mlx5_core_modify_tir(mdev, priv->tirn[tt], in, inlen);
+        for (tt = 0; tt < MLX5E_NUM_TT; tt++) {
+                err = mlx5_core_modify_tir(mdev, priv->tirn[tt], in, inlen);
+                if (err)
+                        break;
+        }
 
         kvfree(in);
 
@@ -1672,17 +1682,7 @@ static void mlx5e_build_tir_ctx(struct mlx5e_priv *priv, u32 *tirc, int tt)
         default:
                 MLX5_SET(tirc, tirc, indirect_table,
                          priv->rqtn[MLX5E_INDIRECTION_RQT]);
-                MLX5_SET(tirc, tirc, rx_hash_fn,
-                         mlx5e_rx_hash_fn(priv->params.rss_hfunc));
-                if (priv->params.rss_hfunc == ETH_RSS_HASH_TOP) {
-                        void *rss_key = MLX5_ADDR_OF(tirc, tirc,
-                                                     rx_hash_toeplitz_key);
-                        size_t len = MLX5_FLD_SZ_BYTES(tirc,
-                                                       rx_hash_toeplitz_key);
-
-                        MLX5_SET(tirc, tirc, rx_hash_symmetric, 1);
-                        memcpy(rss_key, priv->params.toeplitz_hash_key, len);
-                }
+                mlx5e_build_tir_ctx_hash(tirc, priv);
                 break;
         }
 
@@ -1885,8 +1885,10 @@ static int mlx5e_set_features(struct net_device *netdev,
                         mlx5e_close_locked(priv->netdev);
 
                 priv->params.lro_en = !!(features & NETIF_F_LRO);
-                mlx5e_modify_tir_lro(priv, MLX5E_TT_IPV4_TCP);
-                mlx5e_modify_tir_lro(priv, MLX5E_TT_IPV6_TCP);
+                err = mlx5e_modify_tirs_lro(priv);
+                if (err)
+                        mlx5_core_warn(priv->mdev, "lro modify failed, %d\n",
+                                       err);
 
                 if (was_opened)
                         err = mlx5e_open_locked(priv->netdev);
@@ -2024,18 +2026,37 @@ static int mlx5e_get_vf_stats(struct net_device *dev,
                                             vf_stats);
 }
 
-static struct net_device_ops mlx5e_netdev_ops = {
+static const struct net_device_ops mlx5e_netdev_ops_basic = {
+        .ndo_open                = mlx5e_open,
+        .ndo_stop                = mlx5e_close,
+        .ndo_start_xmit          = mlx5e_xmit,
+        .ndo_get_stats64         = mlx5e_get_stats,
+        .ndo_set_rx_mode         = mlx5e_set_rx_mode,
+        .ndo_set_mac_address     = mlx5e_set_mac,
+        .ndo_vlan_rx_add_vid     = mlx5e_vlan_rx_add_vid,
+        .ndo_vlan_rx_kill_vid    = mlx5e_vlan_rx_kill_vid,
+        .ndo_set_features        = mlx5e_set_features,
+        .ndo_change_mtu          = mlx5e_change_mtu,
+        .ndo_do_ioctl            = mlx5e_ioctl,
+};
+
+static const struct net_device_ops mlx5e_netdev_ops_sriov = {
         .ndo_open                = mlx5e_open,
         .ndo_stop                = mlx5e_close,
         .ndo_start_xmit          = mlx5e_xmit,
         .ndo_get_stats64         = mlx5e_get_stats,
         .ndo_set_rx_mode         = mlx5e_set_rx_mode,
         .ndo_set_mac_address     = mlx5e_set_mac,
-        .ndo_vlan_rx_add_vid     = mlx5e_vlan_rx_add_vid,
-        .ndo_vlan_rx_kill_vid    = mlx5e_vlan_rx_kill_vid,
+        .ndo_vlan_rx_add_vid     = mlx5e_vlan_rx_add_vid,
+        .ndo_vlan_rx_kill_vid    = mlx5e_vlan_rx_kill_vid,
         .ndo_set_features        = mlx5e_set_features,
-        .ndo_change_mtu          = mlx5e_change_mtu,
-        .ndo_do_ioctl            = mlx5e_ioctl,
+        .ndo_change_mtu          = mlx5e_change_mtu,
+        .ndo_do_ioctl            = mlx5e_ioctl,
+        .ndo_set_vf_mac          = mlx5e_set_vf_mac,
+        .ndo_set_vf_vlan         = mlx5e_set_vf_vlan,
+        .ndo_get_vf_config       = mlx5e_get_vf_config,
+        .ndo_set_vf_link_state   = mlx5e_set_vf_link_state,
+        .ndo_get_vf_stats        = mlx5e_get_vf_stats,
 };
 
 static int mlx5e_check_required_hca_cap(struct mlx5_core_dev *mdev)
@@ -2070,12 +2091,20 @@ u16 mlx5e_get_max_inline_cap(struct mlx5_core_dev *mdev)
                2 /*sizeof(mlx5e_tx_wqe.inline_hdr_start)*/;
 }
 
+void mlx5e_build_default_indir_rqt(u32 *indirection_rqt, int len,
+                                   int num_channels)
+{
+        int i;
+
+        for (i = 0; i < len; i++)
+                indirection_rqt[i] = i % num_channels;
+}
+
 static void mlx5e_build_netdev_priv(struct mlx5_core_dev *mdev,
                                     struct net_device *netdev,
                                     int num_channels)
 {
         struct mlx5e_priv *priv = netdev_priv(netdev);
-        int i;
 
         priv->params.log_sq_size           =
                 MLX5E_PARAMS_DEFAULT_LOG_SQ_SIZE;
@@ -2099,8 +2128,8 @@ static void mlx5e_build_netdev_priv(struct mlx5_core_dev *mdev,
         netdev_rss_key_fill(priv->params.toeplitz_hash_key,
                             sizeof(priv->params.toeplitz_hash_key));
 
-        for (i = 0; i < MLX5E_INDIR_RQT_SIZE; i++)
-                priv->params.indirection_rqt[i] = i % num_channels;
+        mlx5e_build_default_indir_rqt(priv->params.indirection_rqt,
+                                      MLX5E_INDIR_RQT_SIZE, num_channels);
 
         priv->params.lro_wqe_sz            =
                 MLX5E_PARAMS_DEFAULT_LRO_WQE_SZ;
@@ -2137,18 +2166,11 @@ static void mlx5e_build_netdev(struct net_device *netdev)
 
         SET_NETDEV_DEV(netdev, &mdev->pdev->dev);
 
-        if (priv->params.num_tc > 1)
-                mlx5e_netdev_ops.ndo_select_queue = mlx5e_select_queue;
-
-        if (MLX5_CAP_GEN(mdev, vport_group_manager)) {
-                mlx5e_netdev_ops.ndo_set_vf_mac = mlx5e_set_vf_mac;
-                mlx5e_netdev_ops.ndo_set_vf_vlan = mlx5e_set_vf_vlan;
-                mlx5e_netdev_ops.ndo_get_vf_config = mlx5e_get_vf_config;
-                mlx5e_netdev_ops.ndo_set_vf_link_state = mlx5e_set_vf_link_state;
-                mlx5e_netdev_ops.ndo_get_vf_stats = mlx5e_get_vf_stats;
-        }
+        if (MLX5_CAP_GEN(mdev, vport_group_manager))
+                netdev->netdev_ops = &mlx5e_netdev_ops_sriov;
+        else
+                netdev->netdev_ops = &mlx5e_netdev_ops_basic;
 
-        netdev->netdev_ops        = &mlx5e_netdev_ops;
         netdev->watchdog_timeo    = 15 * HZ;
 
         netdev->ethtool_ops       = &mlx5e_ethtool_ops;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
index dd959d929aad..59658b9d05d1 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
@@ -230,10 +230,6 @@ int mlx5e_poll_rx_cq(struct mlx5e_cq *cq, int budget)
         struct mlx5e_rq *rq = container_of(cq, struct mlx5e_rq, cq);
         int work_done;
 
-        /* avoid accessing cq (dma coherent memory) if not needed */
-        if (!test_and_clear_bit(MLX5E_CQ_HAS_CQES, &cq->flags))
-                return 0;
-
         for (work_done = 0; work_done < budget; work_done++) {
                 struct mlx5e_rx_wqe *wqe;
                 struct mlx5_cqe64 *cqe;
@@ -267,6 +263,7 @@ int mlx5e_poll_rx_cq(struct mlx5e_cq *cq, int budget)
 
                 mlx5e_build_rx_skb(cqe, rq, skb);
                 rq->stats.packets++;
+                rq->stats.bytes += be32_to_cpu(cqe->byte_cnt);
                 napi_gro_receive(cq->napi, skb);
 
 wq_ll_pop:
@@ -279,8 +276,5 @@ wq_ll_pop:
         /* ensure cq space is freed before enabling more cqes */
         wmb();
 
-        if (work_done == budget)
-                set_bit(MLX5E_CQ_HAS_CQES, &cq->flags);
-
         return work_done;
 }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
index 2c3fba0fff54..bb4eeeb007de 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
@@ -179,6 +179,7 @@ static netdev_tx_t mlx5e_sq_xmit(struct mlx5e_sq *sq, struct sk_buff *skb)
         unsigned int skb_len = skb->len;
         u8  opcode = MLX5_OPCODE_SEND;
         dma_addr_t dma_addr = 0;
+        unsigned int num_bytes;
         bool bf = false;
         u16 headlen;
         u16 ds_cnt;
@@ -204,8 +205,7 @@ static netdev_tx_t mlx5e_sq_xmit(struct mlx5e_sq *sq, struct sk_buff *skb)
                 opcode       = MLX5_OPCODE_LSO;
                 ihs          = skb_transport_offset(skb) + tcp_hdrlen(skb);
                 payload_len  = skb->len - ihs;
-                wi->num_bytes = skb->len +
-                                (skb_shinfo(skb)->gso_segs - 1) * ihs;
+                num_bytes = skb->len + (skb_shinfo(skb)->gso_segs - 1) * ihs;
                 sq->stats.tso_packets++;
                 sq->stats.tso_bytes += payload_len;
         } else {
@@ -213,9 +213,11 @@ static netdev_tx_t mlx5e_sq_xmit(struct mlx5e_sq *sq, struct sk_buff *skb)
                      !skb->xmit_more &&
                      !skb_shinfo(skb)->nr_frags;
                 ihs = mlx5e_get_inline_hdr_size(sq, skb, bf);
-                wi->num_bytes = max_t(unsigned int, skb->len, ETH_ZLEN);
+                num_bytes = max_t(unsigned int, skb->len, ETH_ZLEN);
         }
 
+        wi->num_bytes = num_bytes;
+
         if (skb_vlan_tag_present(skb)) {
                 mlx5e_insert_vlan(eseg->inline_hdr_start, skb, ihs, &skb_data,
                                   &skb_len);
@@ -307,6 +309,7 @@ static netdev_tx_t mlx5e_sq_xmit(struct mlx5e_sq *sq, struct sk_buff *skb)
         sq->bf_budget = bf ? sq->bf_budget - 1 : 0;
 
         sq->stats.packets++;
+        sq->stats.bytes += num_bytes;
         return NETDEV_TX_OK;
 
 dma_unmap_wqe_err:
@@ -335,10 +338,6 @@ bool mlx5e_poll_tx_cq(struct mlx5e_cq *cq)
         u16 sqcc;
         int i;
 
-        /* avoid accessing cq (dma coherent memory) if not needed */
-        if (!test_and_clear_bit(MLX5E_CQ_HAS_CQES, &cq->flags))
-                return false;
-
         sq = container_of(cq, struct mlx5e_sq, cq);
 
         npkts = 0;
@@ -422,10 +421,6 @@ bool mlx5e_poll_tx_cq(struct mlx5e_cq *cq)
                                 netif_tx_wake_queue(sq->txq);
                                 sq->stats.wake++;
         }
-        if (i == MLX5E_TX_CQ_POLL_BUDGET) {
-                set_bit(MLX5E_CQ_HAS_CQES, &cq->flags);
-                return true;
-        }
 
-        return false;
+        return (i == MLX5E_TX_CQ_POLL_BUDGET);
 }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_txrx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_txrx.c
index 4ac8d716dbdd..66d51a77609e 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_txrx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_txrx.c
@@ -88,7 +88,6 @@ void mlx5e_completion_event(struct mlx5_core_cq *mcq)
 {
         struct mlx5e_cq *cq = container_of(mcq, struct mlx5e_cq, mcq);
 
-        set_bit(MLX5E_CQ_HAS_CQES, &cq->flags);
         set_bit(MLX5E_CHANNEL_NAPI_SCHED, &cq->channel->flags);
         barrier();
         napi_schedule(cq->napi);
diff --git a/drivers/net/ethernet/mellanox/mlxsw/pci.c b/drivers/net/ethernet/mellanox/mlxsw/pci.c
index c071077aafbd..7992c553c1f5 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/pci.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/pci.c
@@ -215,7 +215,7 @@ mlxsw_pci_queue_elem_info_producer_get(struct mlxsw_pci_queue *q)
 {
         int index = q->producer_counter & (q->count - 1);
 
-        if ((q->producer_counter - q->consumer_counter) == q->count)
+        if ((u16) (q->producer_counter - q->consumer_counter) == q->count)
                 return NULL;
         return mlxsw_pci_queue_elem_info_get(q, index);
 }
diff --git a/drivers/net/ethernet/mellanox/mlxsw/port.h b/drivers/net/ethernet/mellanox/mlxsw/port.h
index 726f5435b32f..ae65b9940aed 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/port.h
+++ b/drivers/net/ethernet/mellanox/mlxsw/port.h
@@ -49,7 +49,7 @@
 #define MLXSW_PORT_MID                  0xd000
 
 #define MLXSW_PORT_MAX_PHY_PORTS        0x40
-#define MLXSW_PORT_MAX_PORTS            MLXSW_PORT_MAX_PHY_PORTS
+#define MLXSW_PORT_MAX_PORTS            (MLXSW_PORT_MAX_PHY_PORTS + 1)
 
 #define MLXSW_PORT_DEVID_BITS_OFFSET    10
 #define MLXSW_PORT_PHY_BITS_OFFSET      4
diff --git a/drivers/net/ethernet/mellanox/mlxsw/reg.h b/drivers/net/ethernet/mellanox/mlxsw/reg.h
index bb77e2207804..ffe4c0305733 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/reg.h
+++ b/drivers/net/ethernet/mellanox/mlxsw/reg.h
@@ -873,6 +873,62 @@ static inline void mlxsw_reg_spvm_pack(char *payload, u8 local_port,
         }
 }
 
+/* SPAFT - Switch Port Acceptable Frame Types
+ * ------------------------------------------
+ * The Switch Port Acceptable Frame Types register configures the frame
+ * admittance of the port.
+ */
+#define MLXSW_REG_SPAFT_ID 0x2010
+#define MLXSW_REG_SPAFT_LEN 0x08
+
+static const struct mlxsw_reg_info mlxsw_reg_spaft = {
+        .id = MLXSW_REG_SPAFT_ID,
+        .len = MLXSW_REG_SPAFT_LEN,
+};
+
+/* reg_spaft_local_port
+ * Local port number.
+ * Access: Index
+ *
+ * Note: CPU port is not supported (all tag types are allowed).
+ */
+MLXSW_ITEM32(reg, spaft, local_port, 0x00, 16, 8);
+
+/* reg_spaft_sub_port
+ * Virtual port within the physical port.
+ * Should be set to 0 when virtual ports are not enabled on the port.
+ * Access: RW
+ */
+MLXSW_ITEM32(reg, spaft, sub_port, 0x00, 8, 8);
+
+/* reg_spaft_allow_untagged
+ * When set, untagged frames on the ingress are allowed (default).
+ * Access: RW
+ */
+MLXSW_ITEM32(reg, spaft, allow_untagged, 0x04, 31, 1);
+
+/* reg_spaft_allow_prio_tagged
+ * When set, priority tagged frames on the ingress are allowed (default).
+ * Access: RW
+ */
+MLXSW_ITEM32(reg, spaft, allow_prio_tagged, 0x04, 30, 1);
+
+/* reg_spaft_allow_tagged
+ * When set, tagged frames on the ingress are allowed (default).
+ * Access: RW
+ */
+MLXSW_ITEM32(reg, spaft, allow_tagged, 0x04, 29, 1);
+
+static inline void mlxsw_reg_spaft_pack(char *payload, u8 local_port,
+                                        bool allow_untagged)
+{
+        MLXSW_REG_ZERO(spaft, payload);
+        mlxsw_reg_spaft_local_port_set(payload, local_port);
+        mlxsw_reg_spaft_allow_untagged_set(payload, allow_untagged);
+        mlxsw_reg_spaft_allow_prio_tagged_set(payload, true);
+        mlxsw_reg_spaft_allow_tagged_set(payload, true);
+}
+
 /* SFGC - Switch Flooding Group Configuration
  * ------------------------------------------
  * The following register controls the association of flooding tables and MIDs
@@ -3203,6 +3259,8 @@ static inline const char *mlxsw_reg_id_str(u16 reg_id)
                 return "SPVID";
         case MLXSW_REG_SPVM_ID:
                 return "SPVM";
+        case MLXSW_REG_SPAFT_ID:
+                return "SPAFT";
         case MLXSW_REG_SFGC_ID:
                 return "SFGC";
         case MLXSW_REG_SFTR_ID:
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
index 217856bdd400..a94daa8c346c 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
@@ -2123,6 +2123,8 @@ static int mlxsw_sp_port_bridge_leave(struct mlxsw_sp_port *mlxsw_sp_port,
         if (flush_fdb && mlxsw_sp_port_fdb_flush(mlxsw_sp_port))
                 netdev_err(mlxsw_sp_port->dev, "Failed to flush FDB\n");
 
+        mlxsw_sp_port_pvid_set(mlxsw_sp_port, 1);
+
         mlxsw_sp_port->learning = 0;
         mlxsw_sp_port->learning_sync = 0;
         mlxsw_sp_port->uc_flood = 0;
@@ -2356,9 +2358,7 @@ static int mlxsw_sp_port_lag_leave(struct mlxsw_sp_port *mlxsw_sp_port,
         if (mlxsw_sp_port->bridged) {
                 mlxsw_sp_port_active_vlans_del(mlxsw_sp_port);
                 mlxsw_sp_port_bridge_leave(mlxsw_sp_port, false);
-
-                if (lag->ref_count == 1)
-                        mlxsw_sp_master_bridge_dec(mlxsw_sp, NULL);
+                mlxsw_sp_master_bridge_dec(mlxsw_sp, NULL);
         }
 
         if (lag->ref_count == 1) {
@@ -2746,6 +2746,13 @@ static int mlxsw_sp_vport_bridge_leave(struct mlxsw_sp_port *mlxsw_sp_vport,
                 goto err_vport_flood_set;
         }
 
+        err = mlxsw_sp_port_stp_state_set(mlxsw_sp_vport, vid,
+                                          MLXSW_REG_SPMS_STATE_FORWARDING);
+        if (err) {
+                netdev_err(dev, "Failed to set STP state\n");
+                goto err_port_stp_state_set;
+        }
+
         if (flush_fdb && mlxsw_sp_vport_fdb_flush(mlxsw_sp_vport))
                 netdev_err(dev, "Failed to flush FDB\n");
 
@@ -2763,6 +2770,7 @@ static int mlxsw_sp_vport_bridge_leave(struct mlxsw_sp_port *mlxsw_sp_vport,
 
         return 0;
 
+err_port_stp_state_set:
 err_vport_flood_set:
 err_port_vid_learning_set:
 err_port_vid_to_fid_validate:
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.h b/drivers/net/ethernet/mellanox/mlxsw/spectrum.h
index 7f42eb1c320e..3b89ed2f3c76 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.h
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.h
@@ -254,5 +254,6 @@ int mlxsw_sp_port_kill_vid(struct net_device *dev,
 int mlxsw_sp_vport_flood_set(struct mlxsw_sp_port *mlxsw_sp_vport, u16 vfid,
                              bool set, bool only_uc);
 void mlxsw_sp_port_active_vlans_del(struct mlxsw_sp_port *mlxsw_sp_port);
+int mlxsw_sp_port_pvid_set(struct mlxsw_sp_port *mlxsw_sp_port, u16 vid);
 
 #endif
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
index e492ca2cdecd..7b56098acc58 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
@@ -370,7 +370,8 @@ static int mlxsw_sp_port_attr_set(struct net_device *dev,
         return err;
 }
 
-static int mlxsw_sp_port_pvid_set(struct mlxsw_sp_port *mlxsw_sp_port, u16 vid)
+static int __mlxsw_sp_port_pvid_set(struct mlxsw_sp_port *mlxsw_sp_port,
+                                    u16 vid)
 {
         struct mlxsw_sp *mlxsw_sp = mlxsw_sp_port->mlxsw_sp;
         char spvid_pl[MLXSW_REG_SPVID_LEN];
@@ -379,6 +380,53 @@ static int mlxsw_sp_port_pvid_set(struct mlxsw_sp_port *mlxsw_sp_port, u16 vid)
         return mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(spvid), spvid_pl);
 }
 
+static int mlxsw_sp_port_allow_untagged_set(struct mlxsw_sp_port *mlxsw_sp_port,
+                                            bool allow)
+{
+        struct mlxsw_sp *mlxsw_sp = mlxsw_sp_port->mlxsw_sp;
+        char spaft_pl[MLXSW_REG_SPAFT_LEN];
+
+        mlxsw_reg_spaft_pack(spaft_pl, mlxsw_sp_port->local_port, allow);
+        return mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(spaft), spaft_pl);
+}
+
+int mlxsw_sp_port_pvid_set(struct mlxsw_sp_port *mlxsw_sp_port, u16 vid)
+{
+        struct net_device *dev = mlxsw_sp_port->dev;
+        int err;
+
+        if (!vid) {
+                err = mlxsw_sp_port_allow_untagged_set(mlxsw_sp_port, false);
+                if (err) {
+                        netdev_err(dev, "Failed to disallow untagged traffic\n");
+                        return err;
+                }
+        } else {
+                err = __mlxsw_sp_port_pvid_set(mlxsw_sp_port, vid);
+                if (err) {
+                        netdev_err(dev, "Failed to set PVID\n");
+                        return err;
+                }
+
+                /* Only allow if not already allowed. */
+                if (!mlxsw_sp_port->pvid) {
+                        err = mlxsw_sp_port_allow_untagged_set(mlxsw_sp_port,
+                                                               true);
+                        if (err) {
+                                netdev_err(dev, "Failed to allow untagged traffic\n");
+                                goto err_port_allow_untagged_set;
+                        }
+                }
+        }
+
+        mlxsw_sp_port->pvid = vid;
+        return 0;
+
+err_port_allow_untagged_set:
+        __mlxsw_sp_port_pvid_set(mlxsw_sp_port, mlxsw_sp_port->pvid);
+        return err;
+}
+
 static int mlxsw_sp_fid_create(struct mlxsw_sp *mlxsw_sp, u16 fid)
 {
         char sfmr_pl[MLXSW_REG_SFMR_LEN];
@@ -540,7 +588,12 @@ static int __mlxsw_sp_port_vlans_add(struct mlxsw_sp_port *mlxsw_sp_port,
                         netdev_err(dev, "Unable to add PVID %d\n", vid_begin);
                         goto err_port_pvid_set;
                 }
-                mlxsw_sp_port->pvid = vid_begin;
+        } else if (!flag_pvid && old_pvid >= vid_begin && old_pvid <= vid_end) {
+                err = mlxsw_sp_port_pvid_set(mlxsw_sp_port, 0);
+                if (err) {
+                        netdev_err(dev, "Unable to del PVID\n");
+                        goto err_port_pvid_set;
+                }
         }
 
         /* Changing activity bits only if HW operation succeded */
@@ -892,20 +945,18 @@ static int __mlxsw_sp_port_vlans_del(struct mlxsw_sp_port *mlxsw_sp_port,
                 return err;
         }
 
+        if (init)
+                goto out;
+
         pvid = mlxsw_sp_port->pvid;
-        if (pvid >= vid_begin && pvid <= vid_end && pvid != 1) {
-                /* Default VLAN is always 1 */
-                err = mlxsw_sp_port_pvid_set(mlxsw_sp_port, 1);
+        if (pvid >= vid_begin && pvid <= vid_end) {
+                err = mlxsw_sp_port_pvid_set(mlxsw_sp_port, 0);
                 if (err) {
                         netdev_err(dev, "Unable to del PVID %d\n", pvid);
                         return err;
                 }
-                mlxsw_sp_port->pvid = 1;
         }
 
-        if (init)
-                goto out;
-
         err = __mlxsw_sp_port_flood_set(mlxsw_sp_port, vid_begin, vid_end,
                                         false, false);
         if (err) {
diff --git a/drivers/net/ethernet/moxa/moxart_ether.c b/drivers/net/ethernet/moxa/moxart_ether.c
index 00cfd95ca59d..3e67f451f2ab 100644
--- a/drivers/net/ethernet/moxa/moxart_ether.c
+++ b/drivers/net/ethernet/moxa/moxart_ether.c
@@ -474,9 +474,9 @@ static int moxart_mac_probe(struct platform_device *pdev)
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         ndev->base_addr = res->start;
         priv->base = devm_ioremap_resource(p_dev, res);
-        ret = IS_ERR(priv->base);
-        if (ret) {
+        if (IS_ERR(priv->base)) {
                 dev_err(p_dev, "devm_ioremap_resource failed\n");
+                ret = PTR_ERR(priv->base);
                 goto init_fail;
         }
 
diff --git a/drivers/net/ethernet/qualcomm/qca_spi.c b/drivers/net/ethernet/qualcomm/qca_spi.c
index 689a4a5c8dcf..1ef03939d25f 100644
--- a/drivers/net/ethernet/qualcomm/qca_spi.c
+++ b/drivers/net/ethernet/qualcomm/qca_spi.c
@@ -811,7 +811,7 @@ qcaspi_netdev_setup(struct net_device *dev)
         dev->netdev_ops = &qcaspi_netdev_ops;
         qcaspi_set_ethtool_ops(dev);
         dev->watchdog_timeo = QCASPI_TX_TIMEOUT;
-        dev->flags = IFF_MULTICAST;
+        dev->priv_flags &= ~IFF_TX_SKB_SHARING;
         dev->tx_queue_len = 100;
 
         qca = netdev_priv(dev);
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index 17d5571d0432..dd2cf3738b73 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -4933,8 +4933,6 @@ static void rtl_init_rxcfg(struct rtl8169_private *tp)
                 RTL_W32(RxConfig, RX128_INT_EN | RX_MULTI_EN | RX_DMA_BURST);
                 break;
         case RTL_GIGA_MAC_VER_40:
-                RTL_W32(RxConfig, RX128_INT_EN | RX_MULTI_EN | RX_DMA_BURST | RX_EARLY_OFF);
-                break;
         case RTL_GIGA_MAC_VER_41:
         case RTL_GIGA_MAC_VER_42:
         case RTL_GIGA_MAC_VER_43:
@@ -4943,8 +4941,6 @@ static void rtl_init_rxcfg(struct rtl8169_private *tp)
         case RTL_GIGA_MAC_VER_46:
         case RTL_GIGA_MAC_VER_47:
         case RTL_GIGA_MAC_VER_48:
-                RTL_W32(RxConfig, RX128_INT_EN | RX_DMA_BURST | RX_EARLY_OFF);
-                break;
         case RTL_GIGA_MAC_VER_49:
         case RTL_GIGA_MAC_VER_50:
         case RTL_GIGA_MAC_VER_51:
@@ -6137,28 +6133,28 @@ static void rtl_hw_start_8168h_1(struct rtl8169_private *tp)
                 sw_cnt_1ms_ini = 16000000/rg_saw_cnt;
                 sw_cnt_1ms_ini &= 0x0fff;
                 data = r8168_mac_ocp_read(tp, 0xd412);
-                data &= 0x0fff;
+                data &= ~0x0fff;
                 data |= sw_cnt_1ms_ini;
                 r8168_mac_ocp_write(tp, 0xd412, data);
         }
 
         data = r8168_mac_ocp_read(tp, 0xe056);
-        data &= 0xf0;
-        data |= 0x07;
+        data &= ~0xf0;
+        data |= 0x70;
         r8168_mac_ocp_write(tp, 0xe056, data);
 
         data = r8168_mac_ocp_read(tp, 0xe052);
-        data &= 0x8008;
-        data |= 0x6000;
+        data &= ~0x6000;
+        data |= 0x8008;
         r8168_mac_ocp_write(tp, 0xe052, data);
 
         data = r8168_mac_ocp_read(tp, 0xe0d6);
-        data &= 0x01ff;
+        data &= ~0x01ff;
         data |= 0x017f;
         r8168_mac_ocp_write(tp, 0xe0d6, data);
 
         data = r8168_mac_ocp_read(tp, 0xd420);
-        data &= 0x0fff;
+        data &= ~0x0fff;
         data |= 0x047f;
         r8168_mac_ocp_write(tp, 0xd420, data);
 
@@ -7730,10 +7726,13 @@ rtl8169_get_stats64(struct net_device *dev, struct rtnl_link_stats64 *stats)
 {
         struct rtl8169_private *tp = netdev_priv(dev);
         void __iomem *ioaddr = tp->mmio_addr;
+        struct pci_dev *pdev = tp->pci_dev;
         struct rtl8169_counters *counters = tp->counters;
         unsigned int start;
 
-        if (netif_running(dev))
+        pm_runtime_get_noresume(&pdev->dev);
+
+        if (netif_running(dev) && pm_runtime_active(&pdev->dev))
                 rtl8169_rx_missed(dev, ioaddr);
 
         do {
@@ -7761,7 +7760,8 @@ rtl8169_get_stats64(struct net_device *dev, struct rtnl_link_stats64 *stats)
          * Fetch additonal counter values missing in stats collected by driver
          * from tally counters.
          */
-        rtl8169_update_counters(dev);
+        if (pm_runtime_active(&pdev->dev))
+                rtl8169_update_counters(dev);
 
         /*
          * Subtract values fetched during initalization.
@@ -7774,6 +7774,8 @@ rtl8169_get_stats64(struct net_device *dev, struct rtnl_link_stats64 *stats)
         stats->tx_aborted_errors = le16_to_cpu(counters->tx_aborted) -
                 le16_to_cpu(tp->tc_offset.tx_aborted);
 
+        pm_runtime_put_noidle(&pdev->dev);
+
         return stats;
 }
 
@@ -7853,6 +7855,10 @@ static int rtl8169_runtime_suspend(struct device *device)
 
         rtl8169_net_suspend(dev);
 
+        /* Update counters before going runtime suspend */
+        rtl8169_rx_missed(dev, tp->mmio_addr);
+        rtl8169_update_counters(dev);
+
         return 0;
 }
 
diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c
index ac43ed914fcf..86449c357168 100644
--- a/drivers/net/ethernet/renesas/ravb_main.c
+++ b/drivers/net/ethernet/renesas/ravb_main.c
@@ -1139,7 +1139,8 @@ static int ravb_set_ringparam(struct net_device *ndev,
         if (netif_running(ndev)) {
                 netif_device_detach(ndev);
                 /* Stop PTP Clock driver */
-                ravb_ptp_stop(ndev);
+                if (priv->chip_id == RCAR_GEN2)
+                        ravb_ptp_stop(ndev);
                 /* Wait for DMA stopping */
                 error = ravb_stop_dma(ndev);
                 if (error) {
@@ -1170,7 +1171,8 @@ static int ravb_set_ringparam(struct net_device *ndev,
                 ravb_emac_init(ndev);
 
                 /* Initialise PTP Clock driver */
-                ravb_ptp_init(ndev, priv->pdev);
+                if (priv->chip_id == RCAR_GEN2)
+                        ravb_ptp_init(ndev, priv->pdev);
 
                 netif_device_attach(ndev);
         }
@@ -1298,7 +1300,8 @@ static void ravb_tx_timeout_work(struct work_struct *work)
         netif_tx_stop_all_queues(ndev);
 
         /* Stop PTP Clock driver */
-        ravb_ptp_stop(ndev);
+        if (priv->chip_id == RCAR_GEN2)
+                ravb_ptp_stop(ndev);
 
         /* Wait for DMA stopping */
         ravb_stop_dma(ndev);
@@ -1311,7 +1314,8 @@ static void ravb_tx_timeout_work(struct work_struct *work)
         ravb_emac_init(ndev);
 
         /* Initialise PTP Clock driver */
-        ravb_ptp_init(ndev, priv->pdev);
+        if (priv->chip_id == RCAR_GEN2)
+                ravb_ptp_init(ndev, priv->pdev);
 
         netif_tx_start_all_queues(ndev);
 }
@@ -1718,7 +1722,6 @@ static int ravb_set_gti(struct net_device *ndev)
 static int ravb_probe(struct platform_device *pdev)
 {
         struct device_node *np = pdev->dev.of_node;
-        const struct of_device_id *match;
         struct ravb_private *priv;
         enum ravb_chip_id chip_id;
         struct net_device *ndev;
@@ -1750,8 +1753,7 @@ static int ravb_probe(struct platform_device *pdev)
         ndev->base_addr = res->start;
         ndev->dma = -1;
 
-        match = of_match_device(of_match_ptr(ravb_match_table), &pdev->dev);
-        chip_id = (enum ravb_chip_id)match->data;
+        chip_id = (enum ravb_chip_id)of_device_get_match_data(&pdev->dev);
 
         if (chip_id == RCAR_GEN3)
                 irq = platform_get_irq_byname(pdev, "ch22");
@@ -1814,10 +1816,6 @@ static int ravb_probe(struct platform_device *pdev)
                            CCC_OPC_CONFIG | CCC_GAC | CCC_CSEL_HPB, CCC);
         }
 
-        /* Set CSEL value */
-        ravb_write(ndev, (ravb_read(ndev, CCC) & ~CCC_CSEL) | CCC_CSEL_HPB,
-                   CCC);
-
         /* Set GTI value */
         error = ravb_set_gti(ndev);
         if (error)
diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
index dfa9e59c9442..738449992876 100644
--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -3061,15 +3061,11 @@ static int sh_eth_drv_probe(struct platform_device *pdev)
         mdp->ether_link_active_low = pd->ether_link_active_low;
 
         /* set cpu data */
-        if (id) {
+        if (id)
                 mdp->cd = (struct sh_eth_cpu_data *)id->driver_data;
-        } else  {
-                const struct of_device_id *match;
+        else
+                mdp->cd = (struct sh_eth_cpu_data *)of_device_get_match_data(&pdev->dev);
 
-                match = of_match_device(of_match_ptr(sh_eth_match_table),
-                                        &pdev->dev);
-                mdp->cd = (struct sh_eth_cpu_data *)match->data;
-        }
         mdp->reg_offset = sh_eth_get_register_offset(mdp->cd->register_type);
         if (!mdp->reg_offset) {
                 dev_err(&pdev->dev, "Unknown register type (%d)\n",
diff --git a/drivers/net/ethernet/smsc/smc91x.c b/drivers/net/ethernet/smsc/smc91x.c
index 0e2fc1a844ab..db7db8ac4ca3 100644
--- a/drivers/net/ethernet/smsc/smc91x.c
+++ b/drivers/net/ethernet/smsc/smc91x.c
@@ -2342,8 +2342,8 @@ static int smc_drv_probe(struct platform_device *pdev)
         }
 
         ndev->irq = platform_get_irq(pdev, 0);
-        if (ndev->irq <= 0) {
-                ret = -ENODEV;
+        if (ndev->irq < 0) {
+                ret = ndev->irq;
                 goto out_release_io;
         }
         /*
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c
index 0faf16336035..efb54f356a67 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c
@@ -199,21 +199,12 @@ int stmmac_mdio_register(struct net_device *ndev)
         struct stmmac_priv *priv = netdev_priv(ndev);
         struct stmmac_mdio_bus_data *mdio_bus_data = priv->plat->mdio_bus_data;
         int addr, found;
-        struct device_node *mdio_node = NULL;
-        struct device_node *child_node = NULL;
+        struct device_node *mdio_node = priv->plat->mdio_node;
 
         if (!mdio_bus_data)
                 return 0;
 
         if (IS_ENABLED(CONFIG_OF)) {
-                for_each_child_of_node(priv->device->of_node, child_node) {
-                        if (of_device_is_compatible(child_node,
-                                                    "snps,dwmac-mdio")) {
-                                mdio_node = child_node;
-                                break;
-                        }
-                }
-
                 if (mdio_node) {
                         netdev_dbg(ndev, "FOUND MDIO subnode\n");
                 } else {
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
index 6a52fa18cbf2..4514ba73d961 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
@@ -110,6 +110,7 @@ stmmac_probe_config_dt(struct platform_device *pdev, const char **mac)
         struct device_node *np = pdev->dev.of_node;
         struct plat_stmmacenet_data *plat;
         struct stmmac_dma_cfg *dma_cfg;
+        struct device_node *child_node = NULL;
 
         plat = devm_kzalloc(&pdev->dev, sizeof(*plat), GFP_KERNEL);
         if (!plat)
@@ -140,13 +141,19 @@ stmmac_probe_config_dt(struct platform_device *pdev, const char **mac)
                 plat->phy_node = of_node_get(np);
         }
 
+        for_each_child_of_node(np, child_node)
+                if (of_device_is_compatible(child_node, "snps,dwmac-mdio")) {
+                        plat->mdio_node = child_node;
+                        break;
+                }
+
         /* "snps,phy-addr" is not a standard property. Mark it as deprecated
          * and warn of its use. Remove this when phy node support is added.
          */
         if (of_property_read_u32(np, "snps,phy-addr", &plat->phy_addr) == 0)
                 dev_warn(&pdev->dev, "snps,phy-addr property is deprecated\n");
 
-        if ((plat->phy_node && !of_phy_is_fixed_link(np)) || plat->phy_bus_name)
+        if ((plat->phy_node && !of_phy_is_fixed_link(np)) || !plat->mdio_node)
                 plat->mdio_bus_data = NULL;
         else
                 plat->mdio_bus_data =
diff --git a/drivers/net/ethernet/synopsys/dwc_eth_qos.c b/drivers/net/ethernet/synopsys/dwc_eth_qos.c
index 70814b7386b3..af11ed1e0bcc 100644
--- a/drivers/net/ethernet/synopsys/dwc_eth_qos.c
+++ b/drivers/net/ethernet/synopsys/dwc_eth_qos.c
@@ -426,7 +426,7 @@
 #define DWC_MMC_RXOCTETCOUNT_GB          0x0784
 #define DWC_MMC_RXPACKETCOUNT_GB         0x0780
 
-static int debug = 3;
+static int debug = -1;
 module_param(debug, int, 0);
 MODULE_PARM_DESC(debug, "DWC_eth_qos debug level (0=none,...,16=all)");
 
@@ -650,6 +650,11 @@ struct net_local {
         u32 mmc_tx_counters_mask;
 
         struct dwceqos_flowcontrol flowcontrol;
+
+        /* Tracks the intermediate state of phy started but hardware
+         * init not finished yet.
+         */
+        bool phy_defer;
 };
 
 static void dwceqos_read_mmc_counters(struct net_local *lp, u32 rx_mask,
@@ -901,6 +906,9 @@ static void dwceqos_adjust_link(struct net_device *ndev)
         struct phy_device *phydev = lp->phy_dev;
         int status_change = 0;
 
+        if (lp->phy_defer)
+                return;
+
         if (phydev->link) {
                 if ((lp->speed != phydev->speed) ||
                     (lp->duplex != phydev->duplex)) {
@@ -1113,7 +1121,7 @@ static int dwceqos_descriptor_init(struct net_local *lp)
         /* Allocate DMA descriptors */
         size = DWCEQOS_RX_DCNT * sizeof(struct dwceqos_dma_desc);
         lp->rx_descs = dma_alloc_coherent(lp->ndev->dev.parent, size,
-                        &lp->rx_descs_addr, 0);
+                        &lp->rx_descs_addr, GFP_KERNEL);
         if (!lp->rx_descs)
                 goto err_out;
         lp->rx_descs_tail_addr = lp->rx_descs_addr +
@@ -1121,7 +1129,7 @@ static int dwceqos_descriptor_init(struct net_local *lp)
 
         size = DWCEQOS_TX_DCNT * sizeof(struct dwceqos_dma_desc);
         lp->tx_descs = dma_alloc_coherent(lp->ndev->dev.parent, size,
-                        &lp->tx_descs_addr, 0);
+                        &lp->tx_descs_addr, GFP_KERNEL);
         if (!lp->tx_descs)
                 goto err_out;
         lp->tx_descs_tail_addr = lp->tx_descs_addr +
@@ -1635,6 +1643,12 @@ static void dwceqos_init_hw(struct net_local *lp)
         regval = dwceqos_read(lp, REG_DWCEQOS_MAC_CFG);
         dwceqos_write(lp, REG_DWCEQOS_MAC_CFG,
                       regval | DWCEQOS_MAC_CFG_TE | DWCEQOS_MAC_CFG_RE);
+
+        lp->phy_defer = false;
+        mutex_lock(&lp->phy_dev->lock);
+        phy_read_status(lp->phy_dev);
+        dwceqos_adjust_link(lp->ndev);
+        mutex_unlock(&lp->phy_dev->lock);
 }
 
 static void dwceqos_tx_reclaim(unsigned long data)
@@ -1880,9 +1894,13 @@ static int dwceqos_open(struct net_device *ndev)
         }
         netdev_reset_queue(ndev);
 
-        napi_enable(&lp->napi);
+        /* The dwceqos reset state machine requires all phy clocks to complete,
+         * hence the unusual init order with phy_start first.
+         */
+        lp->phy_defer = true;
         phy_start(lp->phy_dev);
         dwceqos_init_hw(lp);
+        napi_enable(&lp->napi);
 
         netif_start_queue(ndev);
         tasklet_enable(&lp->tx_bdreclaim_tasklet);
@@ -1915,18 +1933,19 @@ static int dwceqos_stop(struct net_device *ndev)
 {
         struct net_local *lp = netdev_priv(ndev);
 
-        phy_stop(lp->phy_dev);
-
         tasklet_disable(&lp->tx_bdreclaim_tasklet);
-        netif_stop_queue(ndev);
         napi_disable(&lp->napi);
 
-        dwceqos_drain_dma(lp);
+        /* Stop all tx before we drain the tx dma. */
+        netif_tx_lock_bh(lp->ndev);
+        netif_stop_queue(ndev);
+        netif_tx_unlock_bh(lp->ndev);
 
-        netif_tx_lock(lp->ndev);
+        dwceqos_drain_dma(lp);
         dwceqos_reset_hw(lp);
+        phy_stop(lp->phy_dev);
+
         dwceqos_descriptor_free(lp);
-        netif_tx_unlock(lp->ndev);
 
         return 0;
 }
@@ -2178,12 +2197,10 @@ static int dwceqos_start_xmit(struct sk_buff *skb, struct net_device *ndev)
                 ((trans.initial_descriptor + trans.nr_descriptors) %
                  DWCEQOS_TX_DCNT));
 
-        dwceqos_tx_finalize(skb, lp, &trans);
-
-        netdev_sent_queue(ndev, skb->len);
-
         spin_lock_bh(&lp->tx_lock);
         lp->tx_free -= trans.nr_descriptors;
+        dwceqos_tx_finalize(skb, lp, &trans);
+        netdev_sent_queue(ndev, skb->len);
         spin_unlock_bh(&lp->tx_lock);
 
         ndev->trans_start = jiffies;
diff --git a/drivers/net/ethernet/ti/cpsw-phy-sel.c b/drivers/net/ethernet/ti/cpsw-phy-sel.c
index e9cc61e1ec74..c3e85acfdc70 100644
--- a/drivers/net/ethernet/ti/cpsw-phy-sel.c
+++ b/drivers/net/ethernet/ti/cpsw-phy-sel.c
@@ -63,8 +63,12 @@ static void cpsw_gmii_sel_am3352(struct cpsw_phy_sel_priv *priv,
                 mode = AM33XX_GMII_SEL_MODE_RGMII;
                 break;
 
-        case PHY_INTERFACE_MODE_MII:
         default:
+                dev_warn(priv->dev,
+                         "Unsupported PHY mode: \"%s\". Defaulting to MII.\n",
+                        phy_modes(phy_mode));
+                /* fallthrough */
+        case PHY_INTERFACE_MODE_MII:
                 mode = AM33XX_GMII_SEL_MODE_MII;
                 break;
         };
@@ -106,8 +110,12 @@ static void cpsw_gmii_sel_dra7xx(struct cpsw_phy_sel_priv *priv,
                 mode = AM33XX_GMII_SEL_MODE_RGMII;
                 break;
 
-        case PHY_INTERFACE_MODE_MII:
         default:
+                dev_warn(priv->dev,
+                         "Unsupported PHY mode: \"%s\". Defaulting to MII.\n",
+                        phy_modes(phy_mode));
+                /* fallthrough */
+        case PHY_INTERFACE_MODE_MII:
                 mode = AM33XX_GMII_SEL_MODE_MII;
                 break;
         };
diff --git a/drivers/net/ethernet/ti/netcp_core.c b/drivers/net/ethernet/ti/netcp_core.c
index c61d66d38634..029841f98c32 100644
--- a/drivers/net/ethernet/ti/netcp_core.c
+++ b/drivers/net/ethernet/ti/netcp_core.c
@@ -117,21 +117,17 @@ static void get_pkt_info(dma_addr_t *buff, u32 *buff_len, dma_addr_t *ndesc,
         *ndesc = le32_to_cpu(desc->next_desc);
 }
 
-static void get_pad_info(u32 *pad0, u32 *pad1, u32 *pad2, struct knav_dma_desc *desc)
+static u32 get_sw_data(int index, struct knav_dma_desc *desc)
 {
-        *pad0 = le32_to_cpu(desc->pad[0]);
-        *pad1 = le32_to_cpu(desc->pad[1]);
-        *pad2 = le32_to_cpu(desc->pad[2]);
+        /* No Endian conversion needed as this data is untouched by hw */
+        return desc->sw_data[index];
 }
 
-static void get_pad_ptr(void **padptr, struct knav_dma_desc *desc)
-{
-        u64 pad64;
-
-        pad64 = le32_to_cpu(desc->pad[0]) +
-                ((u64)le32_to_cpu(desc->pad[1]) << 32);
-        *padptr = (void *)(uintptr_t)pad64;
-}
+/* use these macros to get sw data */
+#define GET_SW_DATA0(desc) get_sw_data(0, desc)
+#define GET_SW_DATA1(desc) get_sw_data(1, desc)
+#define GET_SW_DATA2(desc) get_sw_data(2, desc)
+#define GET_SW_DATA3(desc) get_sw_data(3, desc)
 
 static void get_org_pkt_info(dma_addr_t *buff, u32 *buff_len,
                              struct knav_dma_desc *desc)
@@ -163,13 +159,18 @@ static void set_desc_info(u32 desc_info, u32 pkt_info,
         desc->packet_info = cpu_to_le32(pkt_info);
 }
 
-static void set_pad_info(u32 pad0, u32 pad1, u32 pad2, struct knav_dma_desc *desc)
+static void set_sw_data(int index, u32 data, struct knav_dma_desc *desc)
 {
-        desc->pad[0] = cpu_to_le32(pad0);
-        desc->pad[1] = cpu_to_le32(pad1);
-        desc->pad[2] = cpu_to_le32(pad1);
+        /* No Endian conversion needed as this data is untouched by hw */
+        desc->sw_data[index] = data;
 }
 
+/* use these macros to set sw data */
+#define SET_SW_DATA0(data, desc) set_sw_data(0, data, desc)
+#define SET_SW_DATA1(data, desc) set_sw_data(1, data, desc)
+#define SET_SW_DATA2(data, desc) set_sw_data(2, data, desc)
+#define SET_SW_DATA3(data, desc) set_sw_data(3, data, desc)
+
 static void set_org_pkt_info(dma_addr_t buff, u32 buff_len,
                              struct knav_dma_desc *desc)
 {
@@ -581,7 +582,6 @@ static void netcp_free_rx_desc_chain(struct netcp_intf *netcp,
         dma_addr_t dma_desc, dma_buf;
         unsigned int buf_len, dma_sz = sizeof(*ndesc);
         void *buf_ptr;
-        u32 pad[2];
         u32 tmp;
 
         get_words(&dma_desc, 1, &desc->next_desc);
@@ -593,14 +593,20 @@ static void netcp_free_rx_desc_chain(struct netcp_intf *netcp,
                         break;
                 }
                 get_pkt_info(&dma_buf, &tmp, &dma_desc, ndesc);
-                get_pad_ptr(&buf_ptr, ndesc);
+                /* warning!!!! We are retrieving the virtual ptr in the sw_data
+                 * field as a 32bit value. Will not work on 64bit machines
+                 */
+                buf_ptr = (void *)GET_SW_DATA0(ndesc);
+                buf_len = (int)GET_SW_DATA1(desc);
                 dma_unmap_page(netcp->dev, dma_buf, PAGE_SIZE, DMA_FROM_DEVICE);
                 __free_page(buf_ptr);
                 knav_pool_desc_put(netcp->rx_pool, desc);
         }
-
-        get_pad_info(&pad[0], &pad[1], &buf_len, desc);
-        buf_ptr = (void *)(uintptr_t)(pad[0] + ((u64)pad[1] << 32));
+        /* warning!!!! We are retrieving the virtual ptr in the sw_data
+         * field as a 32bit value. Will not work on 64bit machines
+         */
+        buf_ptr = (void *)GET_SW_DATA0(desc);
+        buf_len = (int)GET_SW_DATA1(desc);
 
         if (buf_ptr)
                 netcp_frag_free(buf_len <= PAGE_SIZE, buf_ptr);
@@ -639,7 +645,6 @@ static int netcp_process_one_rx_packet(struct netcp_intf *netcp)
         dma_addr_t dma_desc, dma_buff;
         struct netcp_packet p_info;
         struct sk_buff *skb;
-        u32 pad[2];
         void *org_buf_ptr;
 
         dma_desc = knav_queue_pop(netcp->rx_queue, &dma_sz);
@@ -653,8 +658,11 @@ static int netcp_process_one_rx_packet(struct netcp_intf *netcp)
         }
 
         get_pkt_info(&dma_buff, &buf_len, &dma_desc, desc);
-        get_pad_info(&pad[0], &pad[1], &org_buf_len, desc);
-        org_buf_ptr = (void *)(uintptr_t)(pad[0] + ((u64)pad[1] << 32));
+        /* warning!!!! We are retrieving the virtual ptr in the sw_data
+         * field as a 32bit value. Will not work on 64bit machines
+         */
+        org_buf_ptr = (void *)GET_SW_DATA0(desc);
+        org_buf_len = (int)GET_SW_DATA1(desc);
 
         if (unlikely(!org_buf_ptr)) {
                 dev_err(netcp->ndev_dev, "NULL bufptr in desc\n");
@@ -679,7 +687,6 @@ static int netcp_process_one_rx_packet(struct netcp_intf *netcp)
         /* Fill in the page fragment list */
         while (dma_desc) {
                 struct page *page;
-                void *ptr;
 
                 ndesc = knav_pool_desc_unmap(netcp->rx_pool, dma_desc, dma_sz);
                 if (unlikely(!ndesc)) {
@@ -688,8 +695,10 @@ static int netcp_process_one_rx_packet(struct netcp_intf *netcp)
                 }
 
                 get_pkt_info(&dma_buff, &buf_len, &dma_desc, ndesc);
-                get_pad_ptr(&ptr, ndesc);
-                page = ptr;
+                /* warning!!!! We are retrieving the virtual ptr in the sw_data
+                 * field as a 32bit value. Will not work on 64bit machines
+                 */
+                page = (struct page *)GET_SW_DATA0(desc);
 
                 if (likely(dma_buff && buf_len && page)) {
                         dma_unmap_page(netcp->dev, dma_buff, PAGE_SIZE,
@@ -777,7 +786,10 @@ static void netcp_free_rx_buf(struct netcp_intf *netcp, int fdq)
                 }
 
                 get_org_pkt_info(&dma, &buf_len, desc);
-                get_pad_ptr(&buf_ptr, desc);
+                /* warning!!!! We are retrieving the virtual ptr in the sw_data
+                 * field as a 32bit value. Will not work on 64bit machines
+                 */
+                buf_ptr = (void *)GET_SW_DATA0(desc);
 
                 if (unlikely(!dma)) {
                         dev_err(netcp->ndev_dev, "NULL orig_buff in desc\n");
@@ -829,7 +841,7 @@ static int netcp_allocate_rx_buf(struct netcp_intf *netcp, int fdq)
         struct page *page;
         dma_addr_t dma;
         void *bufptr;
-        u32 pad[3];
+        u32 sw_data[2];
 
         /* Allocate descriptor */
         hwdesc = knav_pool_desc_get(netcp->rx_pool);
@@ -846,7 +858,7 @@ static int netcp_allocate_rx_buf(struct netcp_intf *netcp, int fdq)
                                 SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
 
                 bufptr = netdev_alloc_frag(primary_buf_len);
-                pad[2] = primary_buf_len;
+                sw_data[1] = primary_buf_len;
 
                 if (unlikely(!bufptr)) {
                         dev_warn_ratelimited(netcp->ndev_dev,
@@ -858,9 +870,10 @@ static int netcp_allocate_rx_buf(struct netcp_intf *netcp, int fdq)
                 if (unlikely(dma_mapping_error(netcp->dev, dma)))
                         goto fail;
 
-                pad[0] = lower_32_bits((uintptr_t)bufptr);
-                pad[1] = upper_32_bits((uintptr_t)bufptr);
-
+                /* warning!!!! We are saving the virtual ptr in the sw_data
+                 * field as a 32bit value. Will not work on 64bit machines
+                 */
+                sw_data[0] = (u32)bufptr;
         } else {
                 /* Allocate a secondary receive queue entry */
                 page = alloc_page(GFP_ATOMIC | GFP_DMA | __GFP_COLD);
@@ -870,9 +883,11 @@ static int netcp_allocate_rx_buf(struct netcp_intf *netcp, int fdq)
                 }
                 buf_len = PAGE_SIZE;
                 dma = dma_map_page(netcp->dev, page, 0, buf_len, DMA_TO_DEVICE);
-                pad[0] = lower_32_bits(dma);
-                pad[1] = upper_32_bits(dma);
-                pad[2] = 0;
+                /* warning!!!! We are saving the virtual ptr in the sw_data
+                 * field as a 32bit value. Will not work on 64bit machines
+                 */
+                sw_data[0] = (u32)page;
+                sw_data[1] = 0;
         }
 
         desc_info =  KNAV_DMA_DESC_PS_INFO_IN_DESC;
@@ -882,7 +897,8 @@ static int netcp_allocate_rx_buf(struct netcp_intf *netcp, int fdq)
         pkt_info |= (netcp->rx_queue_id & KNAV_DMA_DESC_RETQ_MASK) <<
                     KNAV_DMA_DESC_RETQ_SHIFT;
         set_org_pkt_info(dma, buf_len, hwdesc);
-        set_pad_info(pad[0], pad[1], pad[2], hwdesc);
+        SET_SW_DATA0(sw_data[0], hwdesc);
+        SET_SW_DATA1(sw_data[1], hwdesc);
         set_desc_info(desc_info, pkt_info, hwdesc);
 
         /* Push to FDQs */
@@ -971,7 +987,6 @@ static int netcp_process_tx_compl_packets(struct netcp_intf *netcp,
                                           unsigned int budget)
 {
         struct knav_dma_desc *desc;
-        void *ptr;
         struct sk_buff *skb;
         unsigned int dma_sz;
         dma_addr_t dma;
@@ -988,8 +1003,10 @@ static int netcp_process_tx_compl_packets(struct netcp_intf *netcp,
                         continue;
                 }
 
-                get_pad_ptr(&ptr, desc);
-                skb = ptr;
+                /* warning!!!! We are retrieving the virtual ptr in the sw_data
+                 * field as a 32bit value. Will not work on 64bit machines
+                 */
+                skb = (struct sk_buff *)GET_SW_DATA0(desc);
                 netcp_free_tx_desc_chain(netcp, desc, dma_sz);
                 if (!skb) {
                         dev_err(netcp->ndev_dev, "No skb in Tx desc\n");
@@ -1194,10 +1211,10 @@ static int netcp_tx_submit_skb(struct netcp_intf *netcp,
         }
 
         set_words(&tmp, 1, &desc->packet_info);
-        tmp = lower_32_bits((uintptr_t)&skb);
-        set_words(&tmp, 1, &desc->pad[0]);
-        tmp = upper_32_bits((uintptr_t)&skb);
-        set_words(&tmp, 1, &desc->pad[1]);
+        /* warning!!!! We are saving the virtual ptr in the sw_data
+         * field as a 32bit value. Will not work on 64bit machines
+         */
+        SET_SW_DATA0((u32)skb, desc);
 
         if (tx_pipe->flags & SWITCH_TO_PORT_IN_TAGINFO) {
                 tmp = tx_pipe->switch_to_port;
diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c
index 0b14ac3b8d11..0bf7edd99573 100644
--- a/drivers/net/geneve.c
+++ b/drivers/net/geneve.c
@@ -1039,6 +1039,34 @@ static netdev_tx_t geneve_xmit(struct sk_buff *skb, struct net_device *dev)
         return geneve_xmit_skb(skb, dev, info);
 }
 
+static int __geneve_change_mtu(struct net_device *dev, int new_mtu, bool strict)
+{
+        /* The max_mtu calculation does not take account of GENEVE
+         * options, to avoid excluding potentially valid
+         * configurations.
+         */
+        int max_mtu = IP_MAX_MTU - GENEVE_BASE_HLEN - sizeof(struct iphdr)
+                - dev->hard_header_len;
+
+        if (new_mtu < 68)
+                return -EINVAL;
+
+        if (new_mtu > max_mtu) {
+                if (strict)
+                        return -EINVAL;
+
+                new_mtu = max_mtu;
+        }
+
+        dev->mtu = new_mtu;
+        return 0;
+}
+
+static int geneve_change_mtu(struct net_device *dev, int new_mtu)
+{
+        return __geneve_change_mtu(dev, new_mtu, true);
+}
+
 static int geneve_fill_metadata_dst(struct net_device *dev, struct sk_buff *skb)
 {
         struct ip_tunnel_info *info = skb_tunnel_info(skb);
@@ -1083,7 +1111,7 @@ static const struct net_device_ops geneve_netdev_ops = {
         .ndo_stop               = geneve_stop,
         .ndo_start_xmit         = geneve_xmit,
         .ndo_get_stats64        = ip_tunnel_get_stats64,
-        .ndo_change_mtu         = eth_change_mtu,
+        .ndo_change_mtu         = geneve_change_mtu,
         .ndo_validate_addr      = eth_validate_addr,
         .ndo_set_mac_address    = eth_mac_addr,
         .ndo_fill_metadata_dst  = geneve_fill_metadata_dst,
@@ -1150,6 +1178,7 @@ static void geneve_setup(struct net_device *dev)
         dev->hw_features |= NETIF_F_GSO_SOFTWARE;
 
         netif_keep_dst(dev);
+        dev->priv_flags &= ~IFF_TX_SKB_SHARING;
         dev->priv_flags |= IFF_LIVE_ADDR_CHANGE | IFF_NO_QUEUE;
         eth_hw_addr_random(dev);
 }
@@ -1441,12 +1470,23 @@ struct net_device *geneve_dev_create_fb(struct net *net, const char *name,
                 return dev;
 
         err = geneve_configure(net, dev, &geneve_remote_unspec,
-                               0, 0, 0, htons(dst_port), true, 0);
-        if (err) {
-                free_netdev(dev);
-                return ERR_PTR(err);
-        }
+                               0, 0, 0, htons(dst_port), true,
+                               GENEVE_F_UDP_ZERO_CSUM6_RX);
+        if (err)
+                goto err;
+
+        /* openvswitch users expect packet sizes to be unrestricted,
+         * so set the largest MTU we can.
+         */
+        err = __geneve_change_mtu(dev, IP_MAX_MTU, false);
+        if (err)
+                goto err;
+
         return dev;
+
+ err:
+        free_netdev(dev);
+        return ERR_PTR(err);
 }
 EXPORT_SYMBOL_GPL(geneve_dev_create_fb);
 
diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index 1d3a66563bac..98e34fee45c7 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -1089,6 +1089,9 @@ static int netvsc_probe(struct hv_device *dev,
         net->ethtool_ops = &ethtool_ops;
         SET_NETDEV_DEV(net, &dev->device);
 
+        /* We always need headroom for rndis header */
+        net->needed_headroom = RNDIS_AND_PPI_SIZE;
+
         /* Notify the netvsc driver of the new device */
         memset(&device_info, 0, sizeof(device_info));
         device_info.ring_size = ring_size;
diff --git a/drivers/net/phy/bcm7xxx.c b/drivers/net/phy/bcm7xxx.c
index bf241a3ec5e5..db507e3bcab9 100644
--- a/drivers/net/phy/bcm7xxx.c
+++ b/drivers/net/phy/bcm7xxx.c
@@ -250,10 +250,6 @@ static int bcm7xxx_config_init(struct phy_device *phydev)
         phy_write(phydev, MII_BCM7XXX_AUX_MODE, MII_BCM7XX_64CLK_MDIO);
         phy_read(phydev, MII_BCM7XXX_AUX_MODE);
 
-        /* Workaround only required for 100Mbits/sec capable PHYs */
-        if (phydev->supported & PHY_GBIT_FEATURES)
-                return 0;
-
         /* set shadow mode 2 */
         ret = phy_set_clr_bits(phydev, MII_BCM7XXX_TEST,
                         MII_BCM7XXX_SHD_MODE_2, MII_BCM7XXX_SHD_MODE_2);
@@ -270,7 +266,7 @@ static int bcm7xxx_config_init(struct phy_device *phydev)
         phy_write(phydev, MII_BCM7XXX_100TX_FALSE_CAR, 0x7555);
 
         /* reset shadow mode 2 */
-        ret = phy_set_clr_bits(phydev, MII_BCM7XXX_TEST, MII_BCM7XXX_SHD_MODE_2, 0);
+        ret = phy_set_clr_bits(phydev, MII_BCM7XXX_TEST, 0, MII_BCM7XXX_SHD_MODE_2);
         if (ret < 0)
                 return ret;
 
@@ -307,11 +303,6 @@ static int bcm7xxx_suspend(struct phy_device *phydev)
         return 0;
 }
 
-static int bcm7xxx_dummy_config_init(struct phy_device *phydev)
-{
-        return 0;
-}
-
 #define BCM7XXX_28NM_GPHY(_oui, _name)                                  \
 {                                                                       \
         .phy_id         = (_oui),                                       \
@@ -337,7 +328,7 @@ static struct phy_driver bcm7xxx_driver[] = {
         .phy_id         = PHY_ID_BCM7425,
         .phy_id_mask    = 0xfffffff0,
         .name           = "Broadcom BCM7425",
-        .features       = PHY_GBIT_FEATURES |
+        .features       = PHY_BASIC_FEATURES |
                           SUPPORTED_Pause | SUPPORTED_Asym_Pause,
         .flags          = PHY_IS_INTERNAL,
         .config_init    = bcm7xxx_config_init,
@@ -349,7 +340,7 @@ static struct phy_driver bcm7xxx_driver[] = {
         .phy_id         = PHY_ID_BCM7429,
         .phy_id_mask    = 0xfffffff0,
         .name           = "Broadcom BCM7429",
-        .features       = PHY_GBIT_FEATURES |
+        .features       = PHY_BASIC_FEATURES |
                           SUPPORTED_Pause | SUPPORTED_Asym_Pause,
         .flags          = PHY_IS_INTERNAL,
         .config_init    = bcm7xxx_config_init,
@@ -361,7 +352,7 @@ static struct phy_driver bcm7xxx_driver[] = {
         .phy_id         = PHY_ID_BCM7435,
         .phy_id_mask    = 0xfffffff0,
         .name           = "Broadcom BCM7435",
-        .features       = PHY_GBIT_FEATURES |
+        .features       = PHY_BASIC_FEATURES |
                           SUPPORTED_Pause | SUPPORTED_Asym_Pause,
         .flags          = PHY_IS_INTERNAL,
         .config_init    = bcm7xxx_config_init,
@@ -369,30 +360,6 @@ static struct phy_driver bcm7xxx_driver[] = {
         .read_status    = genphy_read_status,
         .suspend        = bcm7xxx_suspend,
         .resume         = bcm7xxx_config_init,
-}, {
-        .phy_id         = PHY_BCM_OUI_4,
-        .phy_id_mask    = 0xffff0000,
-        .name           = "Broadcom BCM7XXX 40nm",
-        .features       = PHY_GBIT_FEATURES |
-                          SUPPORTED_Pause | SUPPORTED_Asym_Pause,
-        .flags          = PHY_IS_INTERNAL,
-        .config_init    = bcm7xxx_config_init,
-        .config_aneg    = genphy_config_aneg,
-        .read_status    = genphy_read_status,
-        .suspend        = bcm7xxx_suspend,
-        .resume         = bcm7xxx_config_init,
-}, {
-        .phy_id         = PHY_BCM_OUI_5,
-        .phy_id_mask    = 0xffffff00,
-        .name           = "Broadcom BCM7XXX 65nm",
-        .features       = PHY_BASIC_FEATURES |
-                          SUPPORTED_Pause | SUPPORTED_Asym_Pause,
-        .flags          = PHY_IS_INTERNAL,
-        .config_init    = bcm7xxx_dummy_config_init,
-        .config_aneg    = genphy_config_aneg,
-        .read_status    = genphy_read_status,
-        .suspend        = bcm7xxx_suspend,
-        .resume         = bcm7xxx_config_init,
 } };
 
 static struct mdio_device_id __maybe_unused bcm7xxx_tbl[] = {
@@ -404,8 +371,6 @@ static struct mdio_device_id __maybe_unused bcm7xxx_tbl[] = {
         { PHY_ID_BCM7439, 0xfffffff0, },
         { PHY_ID_BCM7435, 0xfffffff0, },
         { PHY_ID_BCM7445, 0xfffffff0, },
-        { PHY_BCM_OUI_4, 0xffff0000 },
-        { PHY_BCM_OUI_5, 0xffffff00 },
         { }
 };
 
diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c
index e3eb96443c97..ab1d0fcaf1d9 100644
--- a/drivers/net/phy/marvell.c
+++ b/drivers/net/phy/marvell.c
@@ -446,6 +446,12 @@ static int m88e1510_config_aneg(struct phy_device *phydev)
         if (err < 0)
                 return err;
 
+        return 0;
+}
+
+static int marvell_config_init(struct phy_device *phydev)
+{
+        /* Set registers from marvell,reg-init DT property */
         return marvell_of_reg_init(phydev);
 }
 
@@ -495,7 +501,7 @@ static int m88e1116r_config_init(struct phy_device *phydev)
 
         mdelay(500);
 
-        return 0;
+        return marvell_config_init(phydev);
 }
 
 static int m88e3016_config_init(struct phy_device *phydev)
@@ -514,7 +520,7 @@ static int m88e3016_config_init(struct phy_device *phydev)
         if (reg < 0)
                 return reg;
 
-        return 0;
+        return marvell_config_init(phydev);
 }
 
 static int m88e1111_config_init(struct phy_device *phydev)
@@ -1078,6 +1084,7 @@ static struct phy_driver marvell_drivers[] = {
                 .features = PHY_GBIT_FEATURES,
                 .probe = marvell_probe,
                 .flags = PHY_HAS_INTERRUPT,
+                .config_init = &marvell_config_init,
                 .config_aneg = &marvell_config_aneg,
                 .read_status = &genphy_read_status,
                 .ack_interrupt = &marvell_ack_interrupt,
@@ -1149,6 +1156,7 @@ static struct phy_driver marvell_drivers[] = {
                 .features = PHY_GBIT_FEATURES,
                 .flags = PHY_HAS_INTERRUPT,
                 .probe = marvell_probe,
+                .config_init = &marvell_config_init,
                 .config_aneg = &m88e1121_config_aneg,
                 .read_status = &marvell_read_status,
                 .ack_interrupt = &marvell_ack_interrupt,
@@ -1167,6 +1175,7 @@ static struct phy_driver marvell_drivers[] = {
                 .features = PHY_GBIT_FEATURES,
                 .flags = PHY_HAS_INTERRUPT,
                 .probe = marvell_probe,
+                .config_init = &marvell_config_init,
                 .config_aneg = &m88e1318_config_aneg,
                 .read_status = &marvell_read_status,
                 .ack_interrupt = &marvell_ack_interrupt,
@@ -1259,6 +1268,7 @@ static struct phy_driver marvell_drivers[] = {
                 .features = PHY_GBIT_FEATURES,
                 .flags = PHY_HAS_INTERRUPT,
                 .probe = marvell_probe,
+                .config_init = &marvell_config_init,
                 .config_aneg = &m88e1510_config_aneg,
                 .read_status = &marvell_read_status,
                 .ack_interrupt = &marvell_ack_interrupt,
@@ -1277,6 +1287,7 @@ static struct phy_driver marvell_drivers[] = {
                 .features = PHY_GBIT_FEATURES,
                 .flags = PHY_HAS_INTERRUPT,
                 .probe = marvell_probe,
+                .config_init = &marvell_config_init,
                 .config_aneg = &m88e1510_config_aneg,
                 .read_status = &marvell_read_status,
                 .ack_interrupt = &marvell_ack_interrupt,
diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c
index 03833dbfca67..dc85f7095e51 100644
--- a/drivers/net/phy/micrel.c
+++ b/drivers/net/phy/micrel.c
@@ -297,6 +297,17 @@ static int kszphy_config_init(struct phy_device *phydev)
         if (priv->led_mode >= 0)
                 kszphy_setup_led(phydev, type->led_mode_reg, priv->led_mode);
 
+        if (phy_interrupt_is_valid(phydev)) {
+                int ctl = phy_read(phydev, MII_BMCR);
+
+                if (ctl < 0)
+                        return ctl;
+
+                ret = phy_write(phydev, MII_BMCR, ctl & ~BMCR_ANENABLE);
+                if (ret < 0)
+                        return ret;
+        }
+
         return 0;
 }
 
@@ -635,6 +646,21 @@ static void kszphy_get_stats(struct phy_device *phydev,
                 data[i] = kszphy_get_stat(phydev, i);
 }
 
+static int kszphy_resume(struct phy_device *phydev)
+{
+        int value;
+
+        mutex_lock(&phydev->lock);
+
+        value = phy_read(phydev, MII_BMCR);
+        phy_write(phydev, MII_BMCR, value & ~BMCR_PDOWN);
+
+        kszphy_config_intr(phydev);
+        mutex_unlock(&phydev->lock);
+
+        return 0;
+}
+
 static int kszphy_probe(struct phy_device *phydev)
 {
         const struct kszphy_type *type = phydev->drv->driver_data;
@@ -844,7 +870,7 @@ static struct phy_driver ksphy_driver[] = {
         .get_strings    = kszphy_get_strings,
         .get_stats      = kszphy_get_stats,
         .suspend        = genphy_suspend,
-        .resume         = genphy_resume,
+        .resume         = kszphy_resume,
 }, {
         .phy_id         = PHY_ID_KSZ8061,
         .name           = "Micrel KSZ8061",
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index bad3f005faee..e551f3a89cfd 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -1410,7 +1410,7 @@ int genphy_config_init(struct phy_device *phydev)
 
         features = (SUPPORTED_TP | SUPPORTED_MII
                         | SUPPORTED_AUI | SUPPORTED_FIBRE |
-                        SUPPORTED_BNC);
+                        SUPPORTED_BNC | SUPPORTED_Pause | SUPPORTED_Asym_Pause);
 
         /* Do we support autonegotiation? */
         val = phy_read(phydev, MII_BMSR);
diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
index fc8ad001bc94..d61da9ece3ba 100644
--- a/drivers/net/ppp/ppp_generic.c
+++ b/drivers/net/ppp/ppp_generic.c
@@ -443,9 +443,14 @@ static ssize_t ppp_read(struct file *file, char __user *buf,
                          * network traffic (demand mode).
                          */
                         struct ppp *ppp = PF_TO_PPP(pf);
+
+                        ppp_recv_lock(ppp);
                         if (ppp->n_channels == 0 &&
-                            (ppp->flags & SC_LOOP_TRAFFIC) == 0)
+                            (ppp->flags & SC_LOOP_TRAFFIC) == 0) {
+                                ppp_recv_unlock(ppp);
                                 break;
+                        }
+                        ppp_recv_unlock(ppp);
                 }
                 ret = -EAGAIN;
                 if (file->f_flags & O_NONBLOCK)
@@ -532,9 +537,12 @@ static unsigned int ppp_poll(struct file *file, poll_table *wait)
         else if (pf->kind == INTERFACE) {
                 /* see comment in ppp_read */
                 struct ppp *ppp = PF_TO_PPP(pf);
+
+                ppp_recv_lock(ppp);
                 if (ppp->n_channels == 0 &&
                     (ppp->flags & SC_LOOP_TRAFFIC) == 0)
                         mask |= POLLIN | POLLRDNORM;
+                ppp_recv_unlock(ppp);
         }
 
         return mask;
@@ -2808,6 +2816,7 @@ static struct ppp *ppp_create_interface(struct net *net, int unit,
 
 out2:
         mutex_unlock(&pn->all_ppp_mutex);
+        rtnl_unlock();
         free_netdev(dev);
 out1:
         *retp = ret;
diff --git a/drivers/net/ppp/pppoe.c b/drivers/net/ppp/pppoe.c
index f3c63022eb3c..4ddae8118c85 100644
--- a/drivers/net/ppp/pppoe.c
+++ b/drivers/net/ppp/pppoe.c
@@ -395,6 +395,8 @@ static int pppoe_rcv_core(struct sock *sk, struct sk_buff *skb)
 
                 if (!__pppoe_xmit(sk_pppox(relay_po), skb))
                         goto abort_put;
+
+                sock_put(sk_pppox(relay_po));
         } else {
                 if (sock_queue_rcv_skb(sk, skb))
                         goto abort_kfree;
diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig
index 7f83504dfa69..cdde59089f72 100644
--- a/drivers/net/usb/Kconfig
+++ b/drivers/net/usb/Kconfig
@@ -395,6 +395,10 @@ config USB_NET_RNDIS_HOST
           The protocol specification is incomplete, and is controlled by
           (and for) Microsoft; it isn't an "Open" ecosystem or market.
 
+config USB_NET_CDC_SUBSET_ENABLE
+        tristate
+        depends on USB_NET_CDC_SUBSET
+
 config USB_NET_CDC_SUBSET
         tristate "Simple USB Network Links (CDC Ethernet subset)"
         depends on USB_USBNET
@@ -413,6 +417,7 @@ config USB_NET_CDC_SUBSET
 config USB_ALI_M5632
         bool "ALi M5632 based 'USB 2.0 Data Link' cables"
         depends on USB_NET_CDC_SUBSET
+        select USB_NET_CDC_SUBSET_ENABLE
         help
           Choose this option if you're using a host-to-host cable
           based on this design, which supports USB 2.0 high speed.
@@ -420,6 +425,7 @@ config USB_ALI_M5632
 config USB_AN2720
         bool "AnchorChips 2720 based cables (Xircom PGUNET, ...)"
         depends on USB_NET_CDC_SUBSET
+        select USB_NET_CDC_SUBSET_ENABLE
         help
           Choose this option if you're using a host-to-host cable
           based on this design.  Note that AnchorChips is now a
@@ -428,6 +434,7 @@ config USB_AN2720
 config USB_BELKIN
         bool "eTEK based host-to-host cables (Advance, Belkin, ...)"
         depends on USB_NET_CDC_SUBSET
+        select USB_NET_CDC_SUBSET_ENABLE
         default y
         help
           Choose this option if you're using a host-to-host cable
@@ -437,6 +444,7 @@ config USB_BELKIN
 config USB_ARMLINUX
         bool "Embedded ARM Linux links (iPaq, ...)"
         depends on USB_NET_CDC_SUBSET
+        select USB_NET_CDC_SUBSET_ENABLE
         default y
         help
           Choose this option to support the "usb-eth" networking driver
@@ -454,6 +462,7 @@ config USB_ARMLINUX
 config USB_EPSON2888
         bool "Epson 2888 based firmware (DEVELOPMENT)"
         depends on USB_NET_CDC_SUBSET
+        select USB_NET_CDC_SUBSET_ENABLE
         help
           Choose this option to support the usb networking links used
           by some sample firmware from Epson.
@@ -461,6 +470,7 @@ config USB_EPSON2888
 config USB_KC2190
         bool "KT Technology KC2190 based cables (InstaNet)"
         depends on USB_NET_CDC_SUBSET
+        select USB_NET_CDC_SUBSET_ENABLE
         help
           Choose this option if you're using a host-to-host cable
           with one of these chips.
diff --git a/drivers/net/usb/Makefile b/drivers/net/usb/Makefile
index b5f04068dbe4..37fb46aee341 100644
--- a/drivers/net/usb/Makefile
+++ b/drivers/net/usb/Makefile
@@ -23,7 +23,7 @@ obj-$(CONFIG_USB_NET_GL620A)	+= gl620a.o
 obj-$(CONFIG_USB_NET_NET1080)   += net1080.o
 obj-$(CONFIG_USB_NET_PLUSB)     += plusb.o
 obj-$(CONFIG_USB_NET_RNDIS_HOST)        += rndis_host.o
-obj-$(CONFIG_USB_NET_CDC_SUBSET)        += cdc_subset.o
+obj-$(CONFIG_USB_NET_CDC_SUBSET_ENABLE) += cdc_subset.o
 obj-$(CONFIG_USB_NET_ZAURUS)    += zaurus.o
 obj-$(CONFIG_USB_NET_MCS7830)   += mcs7830.o
 obj-$(CONFIG_USB_USBNET)        += usbnet.o
diff --git a/drivers/net/usb/ax88172a.c b/drivers/net/usb/ax88172a.c
index 224e7d82de6d..cf77f2dffa69 100644
--- a/drivers/net/usb/ax88172a.c
+++ b/drivers/net/usb/ax88172a.c
@@ -134,7 +134,6 @@ static void ax88172a_remove_mdio(struct usbnet *dev)
 
         netdev_info(dev->net, "deregistering mdio bus %s\n", priv->mdio->id);
         mdiobus_unregister(priv->mdio);
-        kfree(priv->mdio->irq);
         mdiobus_free(priv->mdio);
 }
 
diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
index dc0212c3cc28..86ba30ba35e8 100644
--- a/drivers/net/usb/cdc_ncm.c
+++ b/drivers/net/usb/cdc_ncm.c
@@ -837,7 +837,11 @@ int cdc_ncm_bind_common(struct usbnet *dev, struct usb_interface *intf, u8 data_
 
         iface_no = ctx->data->cur_altsetting->desc.bInterfaceNumber;
 
-        /* reset data interface */
+        /* Reset data interface. Some devices will not reset properly
+         * unless they are configured first.  Toggle the altsetting to
+         * force a reset
+         */
+        usb_set_interface(dev->udev, iface_no, data_altsetting);
         temp = usb_set_interface(dev->udev, iface_no, 0);
         if (temp) {
                 dev_dbg(&intf->dev, "set interface failed\n");
@@ -984,8 +988,6 @@ EXPORT_SYMBOL_GPL(cdc_ncm_select_altsetting);
 
 static int cdc_ncm_bind(struct usbnet *dev, struct usb_interface *intf)
 {
-        int ret;
-
         /* MBIM backwards compatible function? */
         if (cdc_ncm_select_altsetting(intf) != CDC_NCM_COMM_ALTSETTING_NCM)
                 return -ENODEV;
@@ -994,16 +996,7 @@ static int cdc_ncm_bind(struct usbnet *dev, struct usb_interface *intf)
          * Additionally, generic NCM devices are assumed to accept arbitrarily
          * placed NDP.
          */
-        ret = cdc_ncm_bind_common(dev, intf, CDC_NCM_DATA_ALTSETTING_NCM, 0);
-
-        /*
-         * We should get an event when network connection is "connected" or
-         * "disconnected". Set network connection in "disconnected" state
-         * (carrier is OFF) during attach, so the IP network stack does not
-         * start IPv6 negotiation and more.
-         */
-        usbnet_link_change(dev, 0, 0);
-        return ret;
+        return cdc_ncm_bind_common(dev, intf, CDC_NCM_DATA_ALTSETTING_NCM, 0);
 }
 
 static void cdc_ncm_align_tail(struct sk_buff *skb, size_t modulus, size_t remainder, size_t max)
@@ -1586,7 +1579,8 @@ static void cdc_ncm_status(struct usbnet *dev, struct urb *urb)
 
 static const struct driver_info cdc_ncm_info = {
         .description = "CDC NCM",
-        .flags = FLAG_POINTTOPOINT | FLAG_NO_SETINT | FLAG_MULTI_PACKET,
+        .flags = FLAG_POINTTOPOINT | FLAG_NO_SETINT | FLAG_MULTI_PACKET
+                        | FLAG_LINK_INTR,
         .bind = cdc_ncm_bind,
         .unbind = cdc_ncm_unbind,
         .manage_power = usbnet_manage_power,
@@ -1599,7 +1593,7 @@ static const struct driver_info cdc_ncm_info = {
 static const struct driver_info wwan_info = {
         .description = "Mobile Broadband Network Device",
         .flags = FLAG_POINTTOPOINT | FLAG_NO_SETINT | FLAG_MULTI_PACKET
-                        | FLAG_WWAN,
+                        | FLAG_LINK_INTR | FLAG_WWAN,
         .bind = cdc_ncm_bind,
         .unbind = cdc_ncm_unbind,
         .manage_power = usbnet_manage_power,
@@ -1612,7 +1606,7 @@ static const struct driver_info wwan_info = {
 static const struct driver_info wwan_noarp_info = {
         .description = "Mobile Broadband Network Device (NO ARP)",
         .flags = FLAG_POINTTOPOINT | FLAG_NO_SETINT | FLAG_MULTI_PACKET
-                        | FLAG_WWAN | FLAG_NOARP,
+                        | FLAG_LINK_INTR | FLAG_WWAN | FLAG_NOARP,
         .bind = cdc_ncm_bind,
         .unbind = cdc_ncm_unbind,
         .manage_power = usbnet_manage_power,
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 23e9880791fc..a3a4ccf7cf52 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -637,6 +637,7 @@ static const struct usb_device_id products[] = {
 
         /* 3. Combined interface devices matching on interface number */
         {QMI_FIXED_INTF(0x0408, 0xea42, 4)},    /* Yota / Megafon M100-1 */
+        {QMI_FIXED_INTF(0x05c6, 0x6001, 3)},    /* 4G LTE usb-modem U901 */
         {QMI_FIXED_INTF(0x05c6, 0x7000, 0)},
         {QMI_FIXED_INTF(0x05c6, 0x7001, 1)},
         {QMI_FIXED_INTF(0x05c6, 0x7002, 1)},
@@ -860,8 +861,10 @@ static const struct usb_device_id products[] = {
         {QMI_FIXED_INTF(0x1199, 0x9056, 8)},    /* Sierra Wireless Modem */
         {QMI_FIXED_INTF(0x1199, 0x9057, 8)},
         {QMI_FIXED_INTF(0x1199, 0x9061, 8)},    /* Sierra Wireless Modem */
-        {QMI_FIXED_INTF(0x1199, 0x9071, 8)},    /* Sierra Wireless MC74xx/EM74xx */
-        {QMI_FIXED_INTF(0x1199, 0x9071, 10)},   /* Sierra Wireless MC74xx/EM74xx */
+        {QMI_FIXED_INTF(0x1199, 0x9071, 8)},    /* Sierra Wireless MC74xx */
+        {QMI_FIXED_INTF(0x1199, 0x9071, 10)},   /* Sierra Wireless MC74xx */
+        {QMI_FIXED_INTF(0x1199, 0x9079, 8)},    /* Sierra Wireless EM74xx */
+        {QMI_FIXED_INTF(0x1199, 0x9079, 10)},   /* Sierra Wireless EM74xx */
         {QMI_FIXED_INTF(0x1bbb, 0x011e, 4)},    /* Telekom Speedstick LTE II (Alcatel One Touch L100V LTE) */
         {QMI_FIXED_INTF(0x1bbb, 0x0203, 2)},    /* Alcatel L800MA */
         {QMI_FIXED_INTF(0x2357, 0x0201, 4)},    /* TP-LINK HSUPA Modem MA180 */
@@ -884,6 +887,7 @@ static const struct usb_device_id products[] = {
         {QMI_FIXED_INTF(0x413c, 0x81a8, 8)},    /* Dell Wireless 5808 Gobi(TM) 4G LTE Mobile Broadband Card */
         {QMI_FIXED_INTF(0x413c, 0x81a9, 8)},    /* Dell Wireless 5808e Gobi(TM) 4G LTE Mobile Broadband Card */
         {QMI_FIXED_INTF(0x413c, 0x81b1, 8)},    /* Dell Wireless 5809e Gobi(TM) 4G LTE Mobile Broadband Card */
+        {QMI_FIXED_INTF(0x413c, 0x81b3, 8)},    /* Dell Wireless 5809e Gobi(TM) 4G LTE Mobile Broadband Card (rev3) */
         {QMI_FIXED_INTF(0x03f0, 0x4e1d, 8)},    /* HP lt4111 LTE/EV-DO/HSPA+ Gobi 4G Module */
         {QMI_FIXED_INTF(0x22de, 0x9061, 3)},    /* WeTelecom WPD-600N */
         {QMI_FIXED_INTF(0x1e0e, 0x9001, 5)},    /* SIMCom 7230E */
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index 0b0ba7ef14e4..10798128c03f 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -1769,6 +1769,13 @@ out3:
         if (info->unbind)
                 info->unbind (dev, udev);
 out1:
+        /* subdrivers must undo all they did in bind() if they
+         * fail it, but we may fail later and a deferred kevent
+         * may trigger an error resubmitting itself and, worse,
+         * schedule a timer. So we kill it all just in case.
+         */
+        cancel_work_sync(&dev->kevent);
+        del_timer_sync(&dev->delay);
         free_netdev(net);
 out:
         return status;
diff --git a/drivers/net/vmxnet3/vmxnet3_defs.h b/drivers/net/vmxnet3/vmxnet3_defs.h
index 221a53025fd0..72ba8ae7f09a 100644
--- a/drivers/net/vmxnet3/vmxnet3_defs.h
+++ b/drivers/net/vmxnet3/vmxnet3_defs.h
@@ -377,7 +377,7 @@ union Vmxnet3_GenericDesc {
 #define VMXNET3_TX_RING_MAX_SIZE   4096
 #define VMXNET3_TC_RING_MAX_SIZE   4096
 #define VMXNET3_RX_RING_MAX_SIZE   4096
-#define VMXNET3_RX_RING2_MAX_SIZE  2048
+#define VMXNET3_RX_RING2_MAX_SIZE  4096
 #define VMXNET3_RC_RING_MAX_SIZE   8192
 
 /* a list of reasons for queue stop */
diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
index 0cbf520cea77..fc895d0e85d9 100644
--- a/drivers/net/vmxnet3/vmxnet3_drv.c
+++ b/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -814,7 +814,7 @@ vmxnet3_tq_init_all(struct vmxnet3_adapter *adapter)
 
 
 /*
- *    parse and copy relevant protocol headers:
+ *    parse relevant protocol headers:
  *      For a tso pkt, relevant headers are L2/3/4 including options
  *      For a pkt requesting csum offloading, they are L2/3 and may include L4
  *      if it's a TCP/UDP pkt
@@ -827,15 +827,14 @@ vmxnet3_tq_init_all(struct vmxnet3_adapter *adapter)
  * Other effects:
  *    1. related *ctx fields are updated.
  *    2. ctx->copy_size is # of bytes copied
- *    3. the portion copied is guaranteed to be in the linear part
+ *    3. the portion to be copied is guaranteed to be in the linear part
  *
  */
 static int
-vmxnet3_parse_and_copy_hdr(struct sk_buff *skb, struct vmxnet3_tx_queue *tq,
-                           struct vmxnet3_tx_ctx *ctx,
-                           struct vmxnet3_adapter *adapter)
+vmxnet3_parse_hdr(struct sk_buff *skb, struct vmxnet3_tx_queue *tq,
+                  struct vmxnet3_tx_ctx *ctx,
+                  struct vmxnet3_adapter *adapter)
 {
-        struct Vmxnet3_TxDataDesc *tdd;
         u8 protocol = 0;
 
         if (ctx->mss) { /* TSO */
@@ -892,16 +891,34 @@ vmxnet3_parse_and_copy_hdr(struct sk_buff *skb, struct vmxnet3_tx_queue *tq,
                 return 0;
         }
 
+        return 1;
+err:
+        return -1;
+}
+
+/*
+ *    copy relevant protocol headers to the transmit ring:
+ *      For a tso pkt, relevant headers are L2/3/4 including options
+ *      For a pkt requesting csum offloading, they are L2/3 and may include L4
+ *      if it's a TCP/UDP pkt
+ *
+ *
+ *    Note that this requires that vmxnet3_parse_hdr be called first to set the
+ *      appropriate bits in ctx first
+ */
+static void
+vmxnet3_copy_hdr(struct sk_buff *skb, struct vmxnet3_tx_queue *tq,
+                 struct vmxnet3_tx_ctx *ctx,
+                 struct vmxnet3_adapter *adapter)
+{
+        struct Vmxnet3_TxDataDesc *tdd;
+
         tdd = tq->data_ring.base + tq->tx_ring.next2fill;
 
         memcpy(tdd->data, skb->data, ctx->copy_size);
         netdev_dbg(adapter->netdev,
                 "copy %u bytes to dataRing[%u]\n",
                 ctx->copy_size, tq->tx_ring.next2fill);
-        return 1;
-
-err:
-        return -1;
 }
 
 
@@ -998,22 +1015,7 @@ vmxnet3_tq_xmit(struct sk_buff *skb, struct vmxnet3_tx_queue *tq,
                 }
         }
 
-        spin_lock_irqsave(&tq->tx_lock, flags);
-
-        if (count > vmxnet3_cmd_ring_desc_avail(&tq->tx_ring)) {
-                tq->stats.tx_ring_full++;
-                netdev_dbg(adapter->netdev,
-                        "tx queue stopped on %s, next2comp %u"
-                        " next2fill %u\n", adapter->netdev->name,
-                        tq->tx_ring.next2comp, tq->tx_ring.next2fill);
-
-                vmxnet3_tq_stop(tq, adapter);
-                spin_unlock_irqrestore(&tq->tx_lock, flags);
-                return NETDEV_TX_BUSY;
-        }
-
-
-        ret = vmxnet3_parse_and_copy_hdr(skb, tq, &ctx, adapter);
+        ret = vmxnet3_parse_hdr(skb, tq, &ctx, adapter);
         if (ret >= 0) {
                 BUG_ON(ret <= 0 && ctx.copy_size != 0);
                 /* hdrs parsed, check against other limits */
@@ -1033,9 +1035,26 @@ vmxnet3_tq_xmit(struct sk_buff *skb, struct vmxnet3_tx_queue *tq,
                 }
         } else {
                 tq->stats.drop_hdr_inspect_err++;
-                goto unlock_drop_pkt;
+                goto drop_pkt;
         }
 
+        spin_lock_irqsave(&tq->tx_lock, flags);
+
+        if (count > vmxnet3_cmd_ring_desc_avail(&tq->tx_ring)) {
+                tq->stats.tx_ring_full++;
+                netdev_dbg(adapter->netdev,
+                        "tx queue stopped on %s, next2comp %u"
+                        " next2fill %u\n", adapter->netdev->name,
+                        tq->tx_ring.next2comp, tq->tx_ring.next2fill);
+
+                vmxnet3_tq_stop(tq, adapter);
+                spin_unlock_irqrestore(&tq->tx_lock, flags);
+                return NETDEV_TX_BUSY;
+        }
+
+
+        vmxnet3_copy_hdr(skb, tq, &ctx, adapter);
+
         /* fill tx descs related to addr & len */
         if (vmxnet3_map_pkt(skb, &ctx, tq, adapter->pdev, adapter))
                 goto unlock_drop_pkt;
diff --git a/drivers/net/vmxnet3/vmxnet3_int.h b/drivers/net/vmxnet3/vmxnet3_int.h
index bdb8a6c0f8aa..729c344e6774 100644
--- a/drivers/net/vmxnet3/vmxnet3_int.h
+++ b/drivers/net/vmxnet3/vmxnet3_int.h
@@ -69,10 +69,10 @@
 /*
  * Version numbers
  */
-#define VMXNET3_DRIVER_VERSION_STRING   "1.4.5.0-k"
+#define VMXNET3_DRIVER_VERSION_STRING   "1.4.6.0-k"
 
 /* a 32-bit int, each byte encode a verion number in VMXNET3_DRIVER_VERSION */
-#define VMXNET3_DRIVER_VERSION_NUM      0x01040500
+#define VMXNET3_DRIVER_VERSION_NUM      0x01040600
 
 #if defined(CONFIG_PCI_MSI)
         /* RSS only makes sense if MSI-X is supported. */
diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c
index 66addb7a7911..bdcf617a9d52 100644
--- a/drivers/net/vrf.c
+++ b/drivers/net/vrf.c
@@ -104,20 +104,23 @@ static struct dst_ops vrf_dst_ops = {
 #if IS_ENABLED(CONFIG_IPV6)
 static bool check_ipv6_frame(const struct sk_buff *skb)
 {
-        const struct ipv6hdr *ipv6h = (struct ipv6hdr *)skb->data;
-        size_t hlen = sizeof(*ipv6h);
+        const struct ipv6hdr *ipv6h;
+        struct ipv6hdr _ipv6h;
         bool rc = true;
 
-        if (skb->len < hlen)
+        ipv6h = skb_header_pointer(skb, 0, sizeof(_ipv6h), &_ipv6h);
+        if (!ipv6h)
                 goto out;
 
         if (ipv6h->nexthdr == NEXTHDR_ICMP) {
                 const struct icmp6hdr *icmph;
+                struct icmp6hdr _icmph;
 
-                if (skb->len < hlen + sizeof(*icmph))
+                icmph = skb_header_pointer(skb, sizeof(_ipv6h),
+                                           sizeof(_icmph), &_icmph);
+                if (!icmph)
                         goto out;
 
-                icmph = (struct icmp6hdr *)(skb->data + sizeof(*ipv6h));
                 switch (icmph->icmp6_type) {
                 case NDISC_ROUTER_SOLICITATION:
                 case NDISC_ROUTER_ADVERTISEMENT:
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index 65439188c582..1c32bd104797 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -931,8 +931,10 @@ static int vxlan_fdb_dump(struct sk_buff *skb, struct netlink_callback *cb,
                                                      cb->nlh->nlmsg_seq,
                                                      RTM_NEWNEIGH,
                                                      NLM_F_MULTI, rd);
-                                if (err < 0)
+                                if (err < 0) {
+                                        cb->args[1] = err;
                                         goto out;
+                                }
 skip:
                                 ++idx;
                         }
@@ -1306,8 +1308,10 @@ static int vxlan_udp_encap_recv(struct sock *sk, struct sk_buff *skb)
                 gbp = (struct vxlanhdr_gbp *)vxh;
                 md->gbp = ntohs(gbp->policy_id);
 
-                if (tun_dst)
+                if (tun_dst) {
                         tun_dst->u.tun_info.key.tun_flags |= TUNNEL_VXLAN_OPT;
+                        tun_dst->u.tun_info.options_len = sizeof(*md);
+                }
 
                 if (gbp->dont_learn)
                         md->gbp |= VXLAN_GBP_DONT_LEARN;
@@ -2171,9 +2175,11 @@ static netdev_tx_t vxlan_xmit(struct sk_buff *skb, struct net_device *dev)
 #endif
         }
 
-        if (vxlan->flags & VXLAN_F_COLLECT_METADATA &&
-            info && info->mode & IP_TUNNEL_INFO_TX) {
-                vxlan_xmit_one(skb, dev, NULL, false);
+        if (vxlan->flags & VXLAN_F_COLLECT_METADATA) {
+                if (info && info->mode & IP_TUNNEL_INFO_TX)
+                        vxlan_xmit_one(skb, dev, NULL, false);
+                else
+                        kfree_skb(skb);
                 return NETDEV_TX_OK;
         }
 
@@ -2367,29 +2373,43 @@ static void vxlan_set_multicast_list(struct net_device *dev)
 {
 }
 
-static int vxlan_change_mtu(struct net_device *dev, int new_mtu)
+static int __vxlan_change_mtu(struct net_device *dev,
+                              struct net_device *lowerdev,
+                              struct vxlan_rdst *dst, int new_mtu, bool strict)
 {
-        struct vxlan_dev *vxlan = netdev_priv(dev);
-        struct vxlan_rdst *dst = &vxlan->default_dst;
-        struct net_device *lowerdev;
-        int max_mtu;
+        int max_mtu = IP_MAX_MTU;
 
-        lowerdev = __dev_get_by_index(vxlan->net, dst->remote_ifindex);
-        if (lowerdev == NULL)
-                return eth_change_mtu(dev, new_mtu);
+        if (lowerdev)
+                max_mtu = lowerdev->mtu;
 
         if (dst->remote_ip.sa.sa_family == AF_INET6)
-                max_mtu = lowerdev->mtu - VXLAN6_HEADROOM;
+                max_mtu -= VXLAN6_HEADROOM;
         else
-                max_mtu = lowerdev->mtu - VXLAN_HEADROOM;
+                max_mtu -= VXLAN_HEADROOM;
 
-        if (new_mtu < 68 || new_mtu > max_mtu)
+        if (new_mtu < 68)
                 return -EINVAL;
 
+        if (new_mtu > max_mtu) {
+                if (strict)
+                        return -EINVAL;
+
+                new_mtu = max_mtu;
+        }
+
         dev->mtu = new_mtu;
         return 0;
 }
 
+static int vxlan_change_mtu(struct net_device *dev, int new_mtu)
+{
+        struct vxlan_dev *vxlan = netdev_priv(dev);
+        struct vxlan_rdst *dst = &vxlan->default_dst;
+        struct net_device *lowerdev = __dev_get_by_index(vxlan->net,
+                                                         dst->remote_ifindex);
+        return __vxlan_change_mtu(dev, lowerdev, dst, new_mtu, true);
+}
+
 static int egress_ipv4_tun_info(struct net_device *dev, struct sk_buff *skb,
                                 struct ip_tunnel_info *info,
                                 __be16 sport, __be16 dport)
@@ -2523,6 +2543,7 @@ static void vxlan_setup(struct net_device *dev)
         dev->hw_features |= NETIF_F_GSO_SOFTWARE;
         dev->hw_features |= NETIF_F_HW_VLAN_CTAG_TX | NETIF_F_HW_VLAN_STAG_TX;
         netif_keep_dst(dev);
+        dev->priv_flags &= ~IFF_TX_SKB_SHARING;
         dev->priv_flags |= IFF_LIVE_ADDR_CHANGE | IFF_NO_QUEUE;
 
         INIT_LIST_HEAD(&vxlan->next);
@@ -2765,6 +2786,7 @@ static int vxlan_dev_configure(struct net *src_net, struct net_device *dev,
         int err;
         bool use_ipv6 = false;
         __be16 default_port = vxlan->cfg.dst_port;
+        struct net_device *lowerdev = NULL;
 
         vxlan->net = src_net;
 
@@ -2785,9 +2807,7 @@ static int vxlan_dev_configure(struct net *src_net, struct net_device *dev,
         }
 
         if (conf->remote_ifindex) {
-                struct net_device *lowerdev
-                         = __dev_get_by_index(src_net, conf->remote_ifindex);
-
+                lowerdev = __dev_get_by_index(src_net, conf->remote_ifindex);
                 dst->remote_ifindex = conf->remote_ifindex;
 
                 if (!lowerdev) {
@@ -2811,6 +2831,12 @@ static int vxlan_dev_configure(struct net *src_net, struct net_device *dev,
                 needed_headroom = lowerdev->hard_header_len;
         }
 
+        if (conf->mtu) {
+                err = __vxlan_change_mtu(dev, lowerdev, dst, conf->mtu, false);
+                if (err)
+                        return err;
+        }
+
         if (use_ipv6 || conf->flags & VXLAN_F_COLLECT_METADATA)
                 needed_headroom += VXLAN6_HEADROOM;
         else
diff --git a/drivers/net/wan/dscc4.c b/drivers/net/wan/dscc4.c
index 7a72407208b1..629225980463 100644
--- a/drivers/net/wan/dscc4.c
+++ b/drivers/net/wan/dscc4.c
@@ -1626,7 +1626,7 @@ try:
                 if (state & Xpr) {
                         void __iomem *scc_addr;
                         unsigned long ring;
-                        int i;
+                        unsigned int i;
 
                         /*
                          * - the busy condition happens (sometimes);
diff --git a/drivers/net/wireless/intel/iwlwifi/Kconfig b/drivers/net/wireless/intel/iwlwifi/Kconfig
index 866067789330..7438fbeef744 100644
--- a/drivers/net/wireless/intel/iwlwifi/Kconfig
+++ b/drivers/net/wireless/intel/iwlwifi/Kconfig
@@ -53,7 +53,6 @@ config IWLWIFI_LEDS
 
 config IWLDVM
         tristate "Intel Wireless WiFi DVM Firmware support"
-        depends on m
         help
           This is the driver that supports the DVM firmware. The list
           of the devices that use this firmware is available here:
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-8000.c b/drivers/net/wireless/intel/iwlwifi/iwl-8000.c
index c84a0299d43e..bce9b3420a13 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-8000.c
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-8000.c
@@ -7,6 +7,7 @@
  *
  * Copyright(c) 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2014 - 2015 Intel Mobile Communications GmbH
+ * Copyright(c) 2016 Intel Deutschland GmbH
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -70,12 +71,15 @@
 
 /* Highest firmware API version supported */
 #define IWL8000_UCODE_API_MAX   20
+#define IWL8265_UCODE_API_MAX   20
 
 /* Oldest version we won't warn about */
 #define IWL8000_UCODE_API_OK    13
+#define IWL8265_UCODE_API_OK    20
 
 /* Lowest firmware API version supported */
 #define IWL8000_UCODE_API_MIN   13
+#define IWL8265_UCODE_API_MIN   20
 
 /* NVM versions */
 #define IWL8000_NVM_VERSION             0x0a1d
@@ -93,6 +97,10 @@
 #define IWL8000_MODULE_FIRMWARE(api) \
         IWL8000_FW_PRE "-" __stringify(api) ".ucode"
 
+#define IWL8265_FW_PRE "iwlwifi-8265-"
+#define IWL8265_MODULE_FIRMWARE(api) \
+        IWL8265_FW_PRE __stringify(api) ".ucode"
+
 #define NVM_HW_SECTION_NUM_FAMILY_8000          10
 #define DEFAULT_NVM_FILE_FAMILY_8000B           "nvmData-8000B"
 #define DEFAULT_NVM_FILE_FAMILY_8000C           "nvmData-8000C"
@@ -144,10 +152,7 @@ static const struct iwl_tt_params iwl8000_tt_params = {
         .support_tx_backoff = true,
 };
 
-#define IWL_DEVICE_8000                                                 \
-        .ucode_api_max = IWL8000_UCODE_API_MAX,                         \
-        .ucode_api_ok = IWL8000_UCODE_API_OK,                           \
-        .ucode_api_min = IWL8000_UCODE_API_MIN,                         \
+#define IWL_DEVICE_8000_COMMON                                          \
         .device_family = IWL_DEVICE_FAMILY_8000,                        \
         .max_inst_size = IWL60_RTC_INST_SIZE,                           \
         .max_data_size = IWL60_RTC_DATA_SIZE,                           \
@@ -167,10 +172,28 @@ static const struct iwl_tt_params iwl8000_tt_params = {
         .thermal_params = &iwl8000_tt_params,                           \
         .apmg_not_supported = true
 
+#define IWL_DEVICE_8000                                                 \
+        IWL_DEVICE_8000_COMMON,                                         \
+        .ucode_api_max = IWL8000_UCODE_API_MAX,                         \
+        .ucode_api_ok = IWL8000_UCODE_API_OK,                           \
+        .ucode_api_min = IWL8000_UCODE_API_MIN                          \
+
+#define IWL_DEVICE_8260                                                 \
+        IWL_DEVICE_8000_COMMON,                                         \
+        .ucode_api_max = IWL8000_UCODE_API_MAX,                         \
+        .ucode_api_ok = IWL8000_UCODE_API_OK,                           \
+        .ucode_api_min = IWL8000_UCODE_API_MIN                          \
+
+#define IWL_DEVICE_8265                                                 \
+        IWL_DEVICE_8000_COMMON,                                         \
+        .ucode_api_max = IWL8265_UCODE_API_MAX,                         \
+        .ucode_api_ok = IWL8265_UCODE_API_OK,                           \
+        .ucode_api_min = IWL8265_UCODE_API_MIN                          \
+
 const struct iwl_cfg iwl8260_2n_cfg = {
         .name = "Intel(R) Dual Band Wireless N 8260",
         .fw_name_pre = IWL8000_FW_PRE,
-        IWL_DEVICE_8000,
+        IWL_DEVICE_8260,
         .ht_params = &iwl8000_ht_params,
         .nvm_ver = IWL8000_NVM_VERSION,
         .nvm_calib_ver = IWL8000_TX_POWER_VERSION,
@@ -179,7 +202,7 @@ const struct iwl_cfg iwl8260_2n_cfg = {
 const struct iwl_cfg iwl8260_2ac_cfg = {
         .name = "Intel(R) Dual Band Wireless AC 8260",
         .fw_name_pre = IWL8000_FW_PRE,
-        IWL_DEVICE_8000,
+        IWL_DEVICE_8260,
         .ht_params = &iwl8000_ht_params,
         .nvm_ver = IWL8000_NVM_VERSION,
         .nvm_calib_ver = IWL8000_TX_POWER_VERSION,
@@ -188,8 +211,8 @@ const struct iwl_cfg iwl8260_2ac_cfg = {
 
 const struct iwl_cfg iwl8265_2ac_cfg = {
         .name = "Intel(R) Dual Band Wireless AC 8265",
-        .fw_name_pre = IWL8000_FW_PRE,
-        IWL_DEVICE_8000,
+        .fw_name_pre = IWL8265_FW_PRE,
+        IWL_DEVICE_8265,
         .ht_params = &iwl8000_ht_params,
         .nvm_ver = IWL8000_NVM_VERSION,
         .nvm_calib_ver = IWL8000_TX_POWER_VERSION,
@@ -209,7 +232,7 @@ const struct iwl_cfg iwl4165_2ac_cfg = {
 const struct iwl_cfg iwl8260_2ac_sdio_cfg = {
         .name = "Intel(R) Dual Band Wireless-AC 8260",
         .fw_name_pre = IWL8000_FW_PRE,
-        IWL_DEVICE_8000,
+        IWL_DEVICE_8260,
         .ht_params = &iwl8000_ht_params,
         .nvm_ver = IWL8000_NVM_VERSION,
         .nvm_calib_ver = IWL8000_TX_POWER_VERSION,
@@ -236,3 +259,4 @@ const struct iwl_cfg iwl4165_2ac_sdio_cfg = {
 };
 
 MODULE_FIRMWARE(IWL8000_MODULE_FIRMWARE(IWL8000_UCODE_API_OK));
+MODULE_FIRMWARE(IWL8265_MODULE_FIRMWARE(IWL8265_UCODE_API_OK));
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
index 7acb49075683..ab4c2a0470b2 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
@@ -243,8 +243,10 @@ static int iwl_request_firmware(struct iwl_drv *drv, bool first)
         if (drv->trans->cfg->device_family == IWL_DEVICE_FAMILY_8000) {
                 char rev_step = 'A' + CSR_HW_REV_STEP(drv->trans->hw_rev);
 
-                snprintf(drv->firmware_name, sizeof(drv->firmware_name),
-                         "%s%c-%s.ucode", name_pre, rev_step, tag);
+                if (rev_step != 'A')
+                        snprintf(drv->firmware_name,
+                                 sizeof(drv->firmware_name), "%s%c-%s.ucode",
+                                 name_pre, rev_step, tag);
         }
 
         IWL_DEBUG_INFO(drv, "attempting to load firmware %s'%s'\n",
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
index 4ed5180c547b..0ccc697fef76 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
@@ -107,7 +107,7 @@ static int iwl_send_tx_ant_cfg(struct iwl_mvm *mvm, u8 valid_tx_ant)
                                     sizeof(tx_ant_cmd), &tx_ant_cmd);
 }
 
-static void iwl_free_fw_paging(struct iwl_mvm *mvm)
+void iwl_free_fw_paging(struct iwl_mvm *mvm)
 {
         int i;
 
@@ -127,6 +127,8 @@ static void iwl_free_fw_paging(struct iwl_mvm *mvm)
                              get_order(mvm->fw_paging_db[i].fw_paging_size));
         }
         kfree(mvm->trans->paging_download_buf);
+        mvm->trans->paging_download_buf = NULL;
+
         memset(mvm->fw_paging_db, 0, sizeof(mvm->fw_paging_db));
 }
 
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
index 5f3ac8cccf49..ff7c6df9f941 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
@@ -1225,6 +1225,9 @@ void iwl_mvm_rx_umac_scan_complete_notif(struct iwl_mvm *mvm,
 void iwl_mvm_rx_umac_scan_iter_complete_notif(struct iwl_mvm *mvm,
                                               struct iwl_rx_cmd_buffer *rxb);
 
+/* Paging */
+void iwl_free_fw_paging(struct iwl_mvm *mvm);
+
 /* MVM debugfs */
 #ifdef CONFIG_IWLWIFI_DEBUGFS
 int iwl_mvm_dbgfs_register(struct iwl_mvm *mvm, struct dentry *dbgfs_dir);
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
index 89ea70deeb84..e80be9a59520 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
@@ -684,6 +684,8 @@ static void iwl_op_mode_mvm_stop(struct iwl_op_mode *op_mode)
         for (i = 0; i < NVM_MAX_NUM_SECTIONS; i++)
                 kfree(mvm->nvm_sections[i].data);
 
+        iwl_free_fw_paging(mvm);
+
         iwl_mvm_tof_clean(mvm);
 
         ieee80211_free_hw(mvm->hw);
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
index 9a15642f80dd..ea1e177c2ea1 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
@@ -1298,6 +1298,10 @@ int iwl_mvm_sched_scan_start(struct iwl_mvm *mvm,
                 return -EBUSY;
         }
 
+        /* we don't support "match all" in the firmware */
+        if (!req->n_match_sets)
+                return -EOPNOTSUPP;
+
         ret = iwl_mvm_check_running_scans(mvm, type);
         if (ret)
                 return ret;
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
index 0914ec2fd574..a040edc55057 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
@@ -423,6 +423,15 @@ int iwl_mvm_tx_skb_non_sta(struct iwl_mvm *mvm, struct sk_buff *skb)
                 return -1;
         }
 
+        /*
+         * Increase the pending frames counter, so that later when a reply comes
+         * in and the counter is decreased - we don't start getting negative
+         * values.
+         * Note that we don't need to make sure it isn't agg'd, since we're
+         * TXing non-sta
+         */
+        atomic_inc(&mvm->pending_frames[sta_id]);
+
         return 0;
 }
 
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/internal.h b/drivers/net/wireless/intel/iwlwifi/pcie/internal.h
index cc3888e2700d..73c95594eabe 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/internal.h
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/internal.h
@@ -490,6 +490,15 @@ static inline void iwl_enable_interrupts(struct iwl_trans *trans)
         iwl_write32(trans, CSR_INT_MASK, trans_pcie->inta_mask);
 }
 
+static inline void iwl_enable_fw_load_int(struct iwl_trans *trans)
+{
+        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
+
+        IWL_DEBUG_ISR(trans, "Enabling FW load interrupt\n");
+        trans_pcie->inta_mask = CSR_INT_BIT_FH_TX;
+        iwl_write32(trans, CSR_INT_MASK, trans_pcie->inta_mask);
+}
+
 static inline void iwl_enable_rfkill_int(struct iwl_trans *trans)
 {
         struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
index ccafbd8cf4b3..152cf9ad9566 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
@@ -1438,9 +1438,11 @@ irqreturn_t iwl_pcie_irq_handler(int irq, void *dev_id)
                          inta & ~trans_pcie->inta_mask);
         }
 
-        /* Re-enable all interrupts */
-        /* only Re-enable if disabled by irq */
-        if (test_bit(STATUS_INT_ENABLED, &trans->status))
+        /* we are loading the firmware, enable FH_TX interrupt only */
+        if (handled & CSR_INT_BIT_FH_TX)
+                iwl_enable_fw_load_int(trans);
+        /* only Re-enable all interrupt if disabled by irq */
+        else if (test_bit(STATUS_INT_ENABLED, &trans->status))
                 iwl_enable_interrupts(trans);
         /* Re-enable RF_KILL if it occurred */
         else if (handled & CSR_INT_BIT_RF_KILL)
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
index d60a467a983c..5a854c609477 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
@@ -1021,82 +1021,6 @@ static int iwl_pcie_load_given_ucode_8000(struct iwl_trans *trans,
                                                &first_ucode_section);
 }
 
-static int iwl_trans_pcie_start_fw(struct iwl_trans *trans,
-                                   const struct fw_img *fw, bool run_in_rfkill)
-{
-        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
-        bool hw_rfkill;
-        int ret;
-
-        mutex_lock(&trans_pcie->mutex);
-
-        /* Someone called stop_device, don't try to start_fw */
-        if (trans_pcie->is_down) {
-                IWL_WARN(trans,
-                         "Can't start_fw since the HW hasn't been started\n");
-                ret = EIO;
-                goto out;
-        }
-
-        /* This may fail if AMT took ownership of the device */
-        if (iwl_pcie_prepare_card_hw(trans)) {
-                IWL_WARN(trans, "Exit HW not ready\n");
-                ret = -EIO;
-                goto out;
-        }
-
-        iwl_enable_rfkill_int(trans);
-
-        /* If platform's RF_KILL switch is NOT set to KILL */
-        hw_rfkill = iwl_is_rfkill_set(trans);
-        if (hw_rfkill)
-                set_bit(STATUS_RFKILL, &trans->status);
-        else
-                clear_bit(STATUS_RFKILL, &trans->status);
-        iwl_trans_pcie_rf_kill(trans, hw_rfkill);
-        if (hw_rfkill && !run_in_rfkill) {
-                ret = -ERFKILL;
-                goto out;
-        }
-
-        iwl_write32(trans, CSR_INT, 0xFFFFFFFF);
-
-        ret = iwl_pcie_nic_init(trans);
-        if (ret) {
-                IWL_ERR(trans, "Unable to init nic\n");
-                goto out;
-        }
-
-        /* make sure rfkill handshake bits are cleared */
-        iwl_write32(trans, CSR_UCODE_DRV_GP1_CLR, CSR_UCODE_SW_BIT_RFKILL);
-        iwl_write32(trans, CSR_UCODE_DRV_GP1_CLR,
-                    CSR_UCODE_DRV_GP1_BIT_CMD_BLOCKED);
-
-        /* clear (again), then enable host interrupts */
-        iwl_write32(trans, CSR_INT, 0xFFFFFFFF);
-        iwl_enable_interrupts(trans);
-
-        /* really make sure rfkill handshake bits are cleared */
-        iwl_write32(trans, CSR_UCODE_DRV_GP1_CLR, CSR_UCODE_SW_BIT_RFKILL);
-        iwl_write32(trans, CSR_UCODE_DRV_GP1_CLR, CSR_UCODE_SW_BIT_RFKILL);
-
-        /* Load the given image to the HW */
-        if (trans->cfg->device_family == IWL_DEVICE_FAMILY_8000)
-                ret = iwl_pcie_load_given_ucode_8000(trans, fw);
-        else
-                ret = iwl_pcie_load_given_ucode(trans, fw);
-
-out:
-        mutex_unlock(&trans_pcie->mutex);
-        return ret;
-}
-
-static void iwl_trans_pcie_fw_alive(struct iwl_trans *trans, u32 scd_addr)
-{
-        iwl_pcie_reset_ict(trans);
-        iwl_pcie_tx_start(trans, scd_addr);
-}
-
 static void _iwl_trans_pcie_stop_device(struct iwl_trans *trans, bool low_power)
 {
         struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
@@ -1127,7 +1051,8 @@ static void _iwl_trans_pcie_stop_device(struct iwl_trans *trans, bool low_power)
          * already dead.
          */
         if (test_and_clear_bit(STATUS_DEVICE_ENABLED, &trans->status)) {
-                IWL_DEBUG_INFO(trans, "DEVICE_ENABLED bit was set and is now cleared\n");
+                IWL_DEBUG_INFO(trans,
+                               "DEVICE_ENABLED bit was set and is now cleared\n");
                 iwl_pcie_tx_stop(trans);
                 iwl_pcie_rx_stop(trans);
 
@@ -1161,7 +1086,6 @@ static void _iwl_trans_pcie_stop_device(struct iwl_trans *trans, bool low_power)
         iwl_disable_interrupts(trans);
         spin_unlock(&trans_pcie->irq_lock);
 
-
         /* clear all status bits */
         clear_bit(STATUS_SYNC_HCMD_ACTIVE, &trans->status);
         clear_bit(STATUS_INT_ENABLED, &trans->status);
@@ -1194,10 +1118,116 @@ static void _iwl_trans_pcie_stop_device(struct iwl_trans *trans, bool low_power)
         if (hw_rfkill != was_hw_rfkill)
                 iwl_trans_pcie_rf_kill(trans, hw_rfkill);
 
-        /* re-take ownership to prevent other users from stealing the deivce */
+        /* re-take ownership to prevent other users from stealing the device */
         iwl_pcie_prepare_card_hw(trans);
 }
 
+static int iwl_trans_pcie_start_fw(struct iwl_trans *trans,
+                                   const struct fw_img *fw, bool run_in_rfkill)
+{
+        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
+        bool hw_rfkill;
+        int ret;
+
+        /* This may fail if AMT took ownership of the device */
+        if (iwl_pcie_prepare_card_hw(trans)) {
+                IWL_WARN(trans, "Exit HW not ready\n");
+                ret = -EIO;
+                goto out;
+        }
+
+        iwl_enable_rfkill_int(trans);
+
+        iwl_write32(trans, CSR_INT, 0xFFFFFFFF);
+
+        /*
+         * We enabled the RF-Kill interrupt and the handler may very
+         * well be running. Disable the interrupts to make sure no other
+         * interrupt can be fired.
+         */
+        iwl_disable_interrupts(trans);
+
+        /* Make sure it finished running */
+        synchronize_irq(trans_pcie->pci_dev->irq);
+
+        mutex_lock(&trans_pcie->mutex);
+
+        /* If platform's RF_KILL switch is NOT set to KILL */
+        hw_rfkill = iwl_is_rfkill_set(trans);
+        if (hw_rfkill)
+                set_bit(STATUS_RFKILL, &trans->status);
+        else
+                clear_bit(STATUS_RFKILL, &trans->status);
+        iwl_trans_pcie_rf_kill(trans, hw_rfkill);
+        if (hw_rfkill && !run_in_rfkill) {
+                ret = -ERFKILL;
+                goto out;
+        }
+
+        /* Someone called stop_device, don't try to start_fw */
+        if (trans_pcie->is_down) {
+                IWL_WARN(trans,
+                         "Can't start_fw since the HW hasn't been started\n");
+                ret = -EIO;
+                goto out;
+        }
+
+        /* make sure rfkill handshake bits are cleared */
+        iwl_write32(trans, CSR_UCODE_DRV_GP1_CLR, CSR_UCODE_SW_BIT_RFKILL);
+        iwl_write32(trans, CSR_UCODE_DRV_GP1_CLR,
+                    CSR_UCODE_DRV_GP1_BIT_CMD_BLOCKED);
+
+        /* clear (again), then enable host interrupts */
+        iwl_write32(trans, CSR_INT, 0xFFFFFFFF);
+
+        ret = iwl_pcie_nic_init(trans);
+        if (ret) {
+                IWL_ERR(trans, "Unable to init nic\n");
+                goto out;
+        }
+
+        /*
+         * Now, we load the firmware and don't want to be interrupted, even
+         * by the RF-Kill interrupt (hence mask all the interrupt besides the
+         * FH_TX interrupt which is needed to load the firmware). If the
+         * RF-Kill switch is toggled, we will find out after having loaded
+         * the firmware and return the proper value to the caller.
+         */
+        iwl_enable_fw_load_int(trans);
+
+        /* really make sure rfkill handshake bits are cleared */
+        iwl_write32(trans, CSR_UCODE_DRV_GP1_CLR, CSR_UCODE_SW_BIT_RFKILL);
+        iwl_write32(trans, CSR_UCODE_DRV_GP1_CLR, CSR_UCODE_SW_BIT_RFKILL);
+
+        /* Load the given image to the HW */
+        if (trans->cfg->device_family == IWL_DEVICE_FAMILY_8000)
+                ret = iwl_pcie_load_given_ucode_8000(trans, fw);
+        else
+                ret = iwl_pcie_load_given_ucode(trans, fw);
+        iwl_enable_interrupts(trans);
+
+        /* re-check RF-Kill state since we may have missed the interrupt */
+        hw_rfkill = iwl_is_rfkill_set(trans);
+        if (hw_rfkill)
+                set_bit(STATUS_RFKILL, &trans->status);
+        else
+                clear_bit(STATUS_RFKILL, &trans->status);
+
+        iwl_trans_pcie_rf_kill(trans, hw_rfkill);
+        if (hw_rfkill && !run_in_rfkill)
+                ret = -ERFKILL;
+
+out:
+        mutex_unlock(&trans_pcie->mutex);
+        return ret;
+}
+
+static void iwl_trans_pcie_fw_alive(struct iwl_trans *trans, u32 scd_addr)
+{
+        iwl_pcie_reset_ict(trans);
+        iwl_pcie_tx_start(trans, scd_addr);
+}
+
 static void iwl_trans_pcie_stop_device(struct iwl_trans *trans, bool low_power)
 {
         struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
diff --git a/drivers/net/wireless/realtek/rtlwifi/rc.c b/drivers/net/wireless/realtek/rtlwifi/rc.c
index 74c14ce28238..28f7010e7108 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rc.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rc.c
@@ -138,6 +138,11 @@ static void _rtl_rc_rate_set_series(struct rtl_priv *rtlpriv,
                     ((wireless_mode == WIRELESS_MODE_N_5G) ||
                      (wireless_mode == WIRELESS_MODE_N_24G)))
                         rate->flags |= IEEE80211_TX_RC_MCS;
+                if (sta && sta->vht_cap.vht_supported &&
+                    (wireless_mode == WIRELESS_MODE_AC_5G ||
+                     wireless_mode == WIRELESS_MODE_AC_24G ||
+                     wireless_mode == WIRELESS_MODE_AC_ONLY))
+                        rate->flags |= IEEE80211_TX_RC_VHT_MCS;
         }
 }
 
diff --git a/drivers/net/wireless/ti/wlcore/io.c b/drivers/net/wireless/ti/wlcore/io.c
index 9ac118e727e9..564ca750c5ee 100644
--- a/drivers/net/wireless/ti/wlcore/io.c
+++ b/drivers/net/wireless/ti/wlcore/io.c
@@ -175,14 +175,14 @@ int wlcore_set_partition(struct wl1271 *wl,
         if (ret < 0)
                 goto out;
 
+        /* We don't need the size of the last partition, as it is
+         * automatically calculated based on the total memory size and
+         * the sizes of the previous partitions.
+         */
         ret = wlcore_raw_write32(wl, HW_PART3_START_ADDR, p->mem3.start);
         if (ret < 0)
                 goto out;
 
-        ret = wlcore_raw_write32(wl, HW_PART3_SIZE_ADDR, p->mem3.size);
-        if (ret < 0)
-                goto out;
-
 out:
         return ret;
 }
diff --git a/drivers/net/wireless/ti/wlcore/io.h b/drivers/net/wireless/ti/wlcore/io.h
index 6c257b54f415..10cf3747694d 100644
--- a/drivers/net/wireless/ti/wlcore/io.h
+++ b/drivers/net/wireless/ti/wlcore/io.h
@@ -36,8 +36,8 @@
 #define HW_PART1_START_ADDR             (HW_PARTITION_REGISTERS_ADDR + 12)
 #define HW_PART2_SIZE_ADDR              (HW_PARTITION_REGISTERS_ADDR + 16)
 #define HW_PART2_START_ADDR             (HW_PARTITION_REGISTERS_ADDR + 20)
-#define HW_PART3_SIZE_ADDR              (HW_PARTITION_REGISTERS_ADDR + 24)
-#define HW_PART3_START_ADDR             (HW_PARTITION_REGISTERS_ADDR + 28)
+#define HW_PART3_START_ADDR             (HW_PARTITION_REGISTERS_ADDR + 24)
+
 #define HW_ACCESS_REGISTER_SIZE         4
 
 #define HW_ACCESS_PRAM_MAX_RANGE        0x3c000
diff --git a/drivers/nvdimm/bus.c b/drivers/nvdimm/bus.c
index 7e2c43f701bc..5d28e9405f32 100644
--- a/drivers/nvdimm/bus.c
+++ b/drivers/nvdimm/bus.c
@@ -382,18 +382,18 @@ static const struct nd_cmd_desc __nd_cmd_bus_descs[] = {
         [ND_CMD_ARS_CAP] = {
                 .in_num = 2,
                 .in_sizes = { 8, 8, },
-                .out_num = 2,
-                .out_sizes = { 4, 4, },
+                .out_num = 4,
+                .out_sizes = { 4, 4, 4, 4, },
         },
         [ND_CMD_ARS_START] = {
-                .in_num = 4,
-                .in_sizes = { 8, 8, 2, 6, },
-                .out_num = 1,
-                .out_sizes = { 4, },
+                .in_num = 5,
+                .in_sizes = { 8, 8, 2, 1, 5, },
+                .out_num = 2,
+                .out_sizes = { 4, 4, },
         },
         [ND_CMD_ARS_STATUS] = {
-                .out_num = 2,
-                .out_sizes = { 4, UINT_MAX, },
+                .out_num = 3,
+                .out_sizes = { 4, 4, UINT_MAX, },
         },
 };
 
@@ -442,8 +442,8 @@ u32 nd_cmd_out_size(struct nvdimm *nvdimm, int cmd,
                 return in_field[1];
         else if (nvdimm && cmd == ND_CMD_VENDOR && idx == 2)
                 return out_field[1];
-        else if (!nvdimm && cmd == ND_CMD_ARS_STATUS && idx == 1)
-                return ND_CMD_ARS_STATUS_MAX;
+        else if (!nvdimm && cmd == ND_CMD_ARS_STATUS && idx == 2)
+                return out_field[1] - 8;
 
         return UINT_MAX;
 }
diff --git a/drivers/nvdimm/pmem.c b/drivers/nvdimm/pmem.c
index 7edf31671dab..8d0b54670184 100644
--- a/drivers/nvdimm/pmem.c
+++ b/drivers/nvdimm/pmem.c
@@ -41,7 +41,7 @@ struct pmem_device {
         phys_addr_t             phys_addr;
         /* when non-zero this device is hosting a 'pfn' instance */
         phys_addr_t             data_offset;
-        unsigned long           pfn_flags;
+        u64                     pfn_flags;
         void __pmem             *virt_addr;
         size_t                  size;
         struct badblocks        bb;
diff --git a/drivers/nvme/host/Kconfig b/drivers/nvme/host/Kconfig
index 5d6237391dcd..b586d84f2518 100644
--- a/drivers/nvme/host/Kconfig
+++ b/drivers/nvme/host/Kconfig
@@ -17,5 +17,6 @@ config BLK_DEV_NVME_SCSI
           and block devices nodes, as well a a translation for a small
           number of selected SCSI commands to NVMe commands to the NVMe
           driver.  If you don't know what this means you probably want
-          to say N here, and if you know what it means you probably
-          want to say N as well.
+          to say N here, unless you run a distro that abuses the SCSI
+          emulation to provide stable device names for mount by id, like
+          some OpenSuSE and SLES versions.
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index c5bf001af559..03c46412fff4 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -55,8 +55,9 @@ static void nvme_free_ns(struct kref *kref)
         ns->disk->private_data = NULL;
         spin_unlock(&dev_list_lock);
 
-        nvme_put_ctrl(ns->ctrl);
         put_disk(ns->disk);
+        ida_simple_remove(&ns->ctrl->ns_ida, ns->instance);
+        nvme_put_ctrl(ns->ctrl);
         kfree(ns);
 }
 
@@ -183,7 +184,7 @@ int __nvme_submit_user_cmd(struct request_queue *q, struct nvme_command *cmd,
                         goto out_unmap;
                 }
 
-                if (meta_buffer) {
+                if (meta_buffer && meta_len) {
                         struct bio_integrity_payload *bip;
 
                         meta = kmalloc(meta_len, GFP_KERNEL);
@@ -373,6 +374,8 @@ static int nvme_submit_io(struct nvme_ns *ns, struct nvme_user_io __user *uio)
 
         if (copy_from_user(&io, uio, sizeof(io)))
                 return -EFAULT;
+        if (io.flags)
+                return -EINVAL;
 
         switch (io.opcode) {
         case nvme_cmd_write:
@@ -424,6 +427,8 @@ static int nvme_user_cmd(struct nvme_ctrl *ctrl, struct nvme_ns *ns,
                 return -EACCES;
         if (copy_from_user(&cmd, ucmd, sizeof(cmd)))
                 return -EFAULT;
+        if (cmd.flags)
+                return -EINVAL;
 
         memset(&c, 0, sizeof(c));
         c.common.opcode = cmd.opcode;
@@ -556,6 +561,10 @@ static int nvme_revalidate_disk(struct gendisk *disk)
         u16 old_ms;
         unsigned short bs;
 
+        if (test_bit(NVME_NS_DEAD, &ns->flags)) {
+                set_capacity(disk, 0);
+                return -ENODEV;
+        }
         if (nvme_identify_ns(ns->ctrl, ns->ns_id, &id)) {
                 dev_warn(ns->ctrl->dev, "%s: Identify failure nvme%dn%d\n",
                                 __func__, ns->ctrl->instance, ns->ns_id);
@@ -831,6 +840,23 @@ int nvme_shutdown_ctrl(struct nvme_ctrl *ctrl)
         return ret;
 }
 
+static void nvme_set_queue_limits(struct nvme_ctrl *ctrl,
+                struct request_queue *q)
+{
+        if (ctrl->max_hw_sectors) {
+                u32 max_segments =
+                        (ctrl->max_hw_sectors / (ctrl->page_size >> 9)) + 1;
+
+                blk_queue_max_hw_sectors(q, ctrl->max_hw_sectors);
+                blk_queue_max_segments(q, min_t(u32, max_segments, USHRT_MAX));
+        }
+        if (ctrl->stripe_size)
+                blk_queue_chunk_sectors(q, ctrl->stripe_size >> 9);
+        if (ctrl->vwc & NVME_CTRL_VWC_PRESENT)
+                blk_queue_flush(q, REQ_FLUSH | REQ_FUA);
+        blk_queue_virt_boundary(q, ctrl->page_size - 1);
+}
+
 /*
  * Initialize the cached copies of the Identify data and various controller
  * register in our nvme_ctrl structure.  This should be called as soon as
@@ -888,6 +914,8 @@ int nvme_init_identify(struct nvme_ctrl *ctrl)
                 }
         }
 
+        nvme_set_queue_limits(ctrl, ctrl->admin_q);
+
         kfree(id);
         return 0;
 }
@@ -1118,10 +1146,13 @@ static void nvme_alloc_ns(struct nvme_ctrl *ctrl, unsigned nsid)
         if (!ns)
                 return;
 
+        ns->instance = ida_simple_get(&ctrl->ns_ida, 1, 0, GFP_KERNEL);
+        if (ns->instance < 0)
+                goto out_free_ns;
+
         ns->queue = blk_mq_init_queue(ctrl->tagset);
         if (IS_ERR(ns->queue))
-                goto out_free_ns;
-        queue_flag_set_unlocked(QUEUE_FLAG_NOMERGES, ns->queue);
+                goto out_release_instance;
         queue_flag_set_unlocked(QUEUE_FLAG_NONROT, ns->queue);
         ns->queue->queuedata = ns;
         ns->ctrl = ctrl;
@@ -1135,17 +1166,9 @@ static void nvme_alloc_ns(struct nvme_ctrl *ctrl, unsigned nsid)
         ns->disk = disk;
         ns->lba_shift = 9; /* set to a default value for 512 until disk is validated */
 
+
         blk_queue_logical_block_size(ns->queue, 1 << ns->lba_shift);
-        if (ctrl->max_hw_sectors) {
-                blk_queue_max_hw_sectors(ns->queue, ctrl->max_hw_sectors);
-                blk_queue_max_segments(ns->queue,
-                        (ctrl->max_hw_sectors / (ctrl->page_size >> 9)) + 1);
-        }
-        if (ctrl->stripe_size)
-                blk_queue_chunk_sectors(ns->queue, ctrl->stripe_size >> 9);
-        if (ctrl->vwc & NVME_CTRL_VWC_PRESENT)
-                blk_queue_flush(ns->queue, REQ_FLUSH | REQ_FUA);
-        blk_queue_virt_boundary(ns->queue, ctrl->page_size - 1);
+        nvme_set_queue_limits(ctrl, ns->queue);
 
         disk->major = nvme_major;
         disk->first_minor = 0;
@@ -1154,7 +1177,7 @@ static void nvme_alloc_ns(struct nvme_ctrl *ctrl, unsigned nsid)
         disk->queue = ns->queue;
         disk->driverfs_dev = ctrl->device;
         disk->flags = GENHD_FL_EXT_DEVT;
-        sprintf(disk->disk_name, "nvme%dn%d", ctrl->instance, nsid);
+        sprintf(disk->disk_name, "nvme%dn%d", ctrl->instance, ns->instance);
 
         if (nvme_revalidate_disk(ns->disk))
                 goto out_free_disk;
@@ -1174,40 +1197,29 @@ static void nvme_alloc_ns(struct nvme_ctrl *ctrl, unsigned nsid)
         kfree(disk);
  out_free_queue:
         blk_cleanup_queue(ns->queue);
+ out_release_instance:
+        ida_simple_remove(&ctrl->ns_ida, ns->instance);
  out_free_ns:
         kfree(ns);
 }
 
 static void nvme_ns_remove(struct nvme_ns *ns)
 {
-        bool kill = nvme_io_incapable(ns->ctrl) &&
-                        !blk_queue_dying(ns->queue);
-
-        lockdep_assert_held(&ns->ctrl->namespaces_mutex);
-
-        if (kill) {
-                blk_set_queue_dying(ns->queue);
+        if (test_and_set_bit(NVME_NS_REMOVING, &ns->flags))
+                return;
 
-                /*
-                 * The controller was shutdown first if we got here through
-                 * device removal. The shutdown may requeue outstanding
-                 * requests. These need to be aborted immediately so
-                 * del_gendisk doesn't block indefinitely for their completion.
-                 */
-                blk_mq_abort_requeue_list(ns->queue);
-        }
         if (ns->disk->flags & GENHD_FL_UP) {
                 if (blk_get_integrity(ns->disk))
                         blk_integrity_unregister(ns->disk);
                 sysfs_remove_group(&disk_to_dev(ns->disk)->kobj,
                                         &nvme_ns_attr_group);
                 del_gendisk(ns->disk);
-        }
-        if (kill || !blk_queue_dying(ns->queue)) {
                 blk_mq_abort_requeue_list(ns->queue);
                 blk_cleanup_queue(ns->queue);
         }
+        mutex_lock(&ns->ctrl->namespaces_mutex);
         list_del_init(&ns->list);
+        mutex_unlock(&ns->ctrl->namespaces_mutex);
         nvme_put_ns(ns);
 }
 
@@ -1301,10 +1313,8 @@ void nvme_remove_namespaces(struct nvme_ctrl *ctrl)
 {
         struct nvme_ns *ns, *next;
 
-        mutex_lock(&ctrl->namespaces_mutex);
         list_for_each_entry_safe(ns, next, &ctrl->namespaces, list)
                 nvme_ns_remove(ns);
-        mutex_unlock(&ctrl->namespaces_mutex);
 }
 
 static DEFINE_IDA(nvme_instance_ida);
@@ -1351,6 +1361,7 @@ static void nvme_free_ctrl(struct kref *kref)
 
         put_device(ctrl->device);
         nvme_release_instance(ctrl);
+        ida_destroy(&ctrl->ns_ida);
 
         ctrl->ops->free_ctrl(ctrl);
 }
@@ -1391,6 +1402,7 @@ int nvme_init_ctrl(struct nvme_ctrl *ctrl, struct device *dev,
         }
         get_device(ctrl->device);
         dev_set_drvdata(ctrl->device, ctrl);
+        ida_init(&ctrl->ns_ida);
 
         spin_lock(&dev_list_lock);
         list_add_tail(&ctrl->node, &nvme_ctrl_list);
@@ -1403,6 +1415,38 @@ out:
         return ret;
 }
 
+/**
+ * nvme_kill_queues(): Ends all namespace queues
+ * @ctrl: the dead controller that needs to end
+ *
+ * Call this function when the driver determines it is unable to get the
+ * controller in a state capable of servicing IO.
+ */
+void nvme_kill_queues(struct nvme_ctrl *ctrl)
+{
+        struct nvme_ns *ns;
+
+        mutex_lock(&ctrl->namespaces_mutex);
+        list_for_each_entry(ns, &ctrl->namespaces, list) {
+                if (!kref_get_unless_zero(&ns->kref))
+                        continue;
+
+                /*
+                 * Revalidating a dead namespace sets capacity to 0. This will
+                 * end buffered writers dirtying pages that can't be synced.
+                 */
+                if (!test_and_set_bit(NVME_NS_DEAD, &ns->flags))
+                        revalidate_disk(ns->disk);
+
+                blk_set_queue_dying(ns->queue);
+                blk_mq_abort_requeue_list(ns->queue);
+                blk_mq_start_stopped_hw_queues(ns->queue, true);
+
+                nvme_put_ns(ns);
+        }
+        mutex_unlock(&ctrl->namespaces_mutex);
+}
+
 void nvme_stop_queues(struct nvme_ctrl *ctrl)
 {
         struct nvme_ns *ns;
diff --git a/drivers/nvme/host/lightnvm.c b/drivers/nvme/host/lightnvm.c
index 5cd3725e2fa4..6bb15e4926dc 100644
--- a/drivers/nvme/host/lightnvm.c
+++ b/drivers/nvme/host/lightnvm.c
@@ -146,9 +146,10 @@ struct nvme_nvm_command {
         };
 };
 
+#define NVME_NVM_LP_MLC_PAIRS 886
 struct nvme_nvm_lp_mlc {
         __u16                   num_pairs;
-        __u8                    pairs[886];
+        __u8                    pairs[NVME_NVM_LP_MLC_PAIRS];
 };
 
 struct nvme_nvm_lp_tbl {
@@ -282,9 +283,14 @@ static int init_grps(struct nvm_id *nvm_id, struct nvme_nvm_id *nvme_nvm_id)
                         memcpy(dst->lptbl.id, src->lptbl.id, 8);
                         dst->lptbl.mlc.num_pairs =
                                         le16_to_cpu(src->lptbl.mlc.num_pairs);
-                        /* 4 bits per pair */
+
+                        if (dst->lptbl.mlc.num_pairs > NVME_NVM_LP_MLC_PAIRS) {
+                                pr_err("nvm: number of MLC pairs not supported\n");
+                                return -EINVAL;
+                        }
+
                         memcpy(dst->lptbl.mlc.pairs, src->lptbl.mlc.pairs,
-                                                dst->lptbl.mlc.num_pairs >> 1);
+                                                dst->lptbl.mlc.num_pairs);
                 }
         }
 
diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h
index 4fb5bb737868..fb15ba5f5d19 100644
--- a/drivers/nvme/host/nvme.h
+++ b/drivers/nvme/host/nvme.h
@@ -72,6 +72,7 @@ struct nvme_ctrl {
         struct mutex namespaces_mutex;
         struct device *device;  /* char device */
         struct list_head node;
+        struct ida ns_ida;
 
         char name[12];
         char serial[20];
@@ -102,6 +103,7 @@ struct nvme_ns {
         struct request_queue *queue;
         struct gendisk *disk;
         struct kref kref;
+        int instance;
 
         u8 eui[8];
         u8 uuid[16];
@@ -112,6 +114,11 @@ struct nvme_ns {
         bool ext;
         u8 pi_type;
         int type;
+        unsigned long flags;
+
+#define NVME_NS_REMOVING 0
+#define NVME_NS_DEAD     1
+
         u64 mode_select_num_blocks;
         u32 mode_select_block_len;
 };
@@ -139,9 +146,9 @@ static inline bool nvme_io_incapable(struct nvme_ctrl *ctrl)
         u32 val = 0;
 
         if (ctrl->ops->io_incapable(ctrl))
-                return false;
+                return true;
         if (ctrl->ops->reg_read32(ctrl, NVME_REG_CSTS, &val))
-                return false;
+                return true;
         return val & NVME_CSTS_CFS;
 }
 
@@ -240,6 +247,7 @@ void nvme_remove_namespaces(struct nvme_ctrl *ctrl);
 
 void nvme_stop_queues(struct nvme_ctrl *ctrl);
 void nvme_start_queues(struct nvme_ctrl *ctrl);
+void nvme_kill_queues(struct nvme_ctrl *ctrl);
 
 struct request *nvme_alloc_request(struct request_queue *q,
                 struct nvme_command *cmd, unsigned int flags);
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index 72ef8322d32a..680f5780750c 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -86,7 +86,6 @@ struct nvme_queue;
 
 static int nvme_reset(struct nvme_dev *dev);
 static void nvme_process_cq(struct nvme_queue *nvmeq);
-static void nvme_remove_dead_ctrl(struct nvme_dev *dev);
 static void nvme_dev_disable(struct nvme_dev *dev, bool shutdown);
 
 /*
@@ -120,6 +119,7 @@ struct nvme_dev {
         unsigned long flags;
 
 #define NVME_CTRL_RESETTING    0
+#define NVME_CTRL_REMOVING     1
 
         struct nvme_ctrl ctrl;
         struct completion ioq_wait;
@@ -286,6 +286,17 @@ static int nvme_init_request(void *data, struct request *req,
         return 0;
 }
 
+static void nvme_queue_scan(struct nvme_dev *dev)
+{
+        /*
+         * Do not queue new scan work when a controller is reset during
+         * removal.
+         */
+        if (test_bit(NVME_CTRL_REMOVING, &dev->flags))
+                return;
+        queue_work(nvme_workq, &dev->scan_work);
+}
+
 static void nvme_complete_async_event(struct nvme_dev *dev,
                 struct nvme_completion *cqe)
 {
@@ -300,7 +311,7 @@ static void nvme_complete_async_event(struct nvme_dev *dev,
         switch (result & 0xff07) {
         case NVME_AER_NOTICE_NS_CHANGED:
                 dev_info(dev->dev, "rescanning\n");
-                queue_work(nvme_workq, &dev->scan_work);
+                nvme_queue_scan(dev);
         default:
                 dev_warn(dev->dev, "async event result %08x\n", result);
         }
@@ -678,6 +689,14 @@ static int nvme_queue_rq(struct blk_mq_hw_ctx *hctx,
         blk_mq_start_request(req);
 
         spin_lock_irq(&nvmeq->q_lock);
+        if (unlikely(nvmeq->cq_vector < 0)) {
+                if (ns && !test_bit(NVME_NS_DEAD, &ns->flags))
+                        ret = BLK_MQ_RQ_QUEUE_BUSY;
+                else
+                        ret = BLK_MQ_RQ_QUEUE_ERROR;
+                spin_unlock_irq(&nvmeq->q_lock);
+                goto out;
+        }
         __nvme_submit_cmd(nvmeq, &cmnd);
         nvme_process_cq(nvmeq);
         spin_unlock_irq(&nvmeq->q_lock);
@@ -999,7 +1018,7 @@ static void nvme_cancel_queue_ios(struct request *req, void *data, bool reserved
         if (!blk_mq_request_started(req))
                 return;
 
-        dev_warn(nvmeq->q_dmadev,
+        dev_dbg_ratelimited(nvmeq->q_dmadev,
                  "Cancelling I/O %d QID %d\n", req->tag, nvmeq->qid);
 
         status = NVME_SC_ABORT_REQ;
@@ -1245,6 +1264,12 @@ static struct blk_mq_ops nvme_mq_ops = {
 static void nvme_dev_remove_admin(struct nvme_dev *dev)
 {
         if (dev->ctrl.admin_q && !blk_queue_dying(dev->ctrl.admin_q)) {
+                /*
+                 * If the controller was reset during removal, it's possible
+                 * user requests may be waiting on a stopped queue. Start the
+                 * queue to flush these to completion.
+                 */
+                blk_mq_start_stopped_hw_queues(dev->ctrl.admin_q, true);
                 blk_cleanup_queue(dev->ctrl.admin_q);
                 blk_mq_free_tag_set(&dev->admin_tagset);
         }
@@ -1685,14 +1710,14 @@ static int nvme_dev_add(struct nvme_dev *dev)
                         return 0;
                 dev->ctrl.tagset = &dev->tagset;
         }
-        queue_work(nvme_workq, &dev->scan_work);
+        nvme_queue_scan(dev);
         return 0;
 }
 
-static int nvme_dev_map(struct nvme_dev *dev)
+static int nvme_pci_enable(struct nvme_dev *dev)
 {
         u64 cap;
-        int bars, result = -ENOMEM;
+        int result = -ENOMEM;
         struct pci_dev *pdev = to_pci_dev(dev->dev);
 
         if (pci_enable_device_mem(pdev))
@@ -1700,24 +1725,14 @@ static int nvme_dev_map(struct nvme_dev *dev)
 
         dev->entry[0].vector = pdev->irq;
         pci_set_master(pdev);
-        bars = pci_select_bars(pdev, IORESOURCE_MEM);
-        if (!bars)
-                goto disable_pci;
-
-        if (pci_request_selected_regions(pdev, bars, "nvme"))
-                goto disable_pci;
 
         if (dma_set_mask_and_coherent(dev->dev, DMA_BIT_MASK(64)) &&
             dma_set_mask_and_coherent(dev->dev, DMA_BIT_MASK(32)))
                 goto disable;
 
-        dev->bar = ioremap(pci_resource_start(pdev, 0), 8192);
-        if (!dev->bar)
-                goto disable;
-
         if (readl(dev->bar + NVME_REG_CSTS) == -1) {
                 result = -ENODEV;
-                goto unmap;
+                goto disable;
         }
 
         /*
@@ -1727,7 +1742,7 @@ static int nvme_dev_map(struct nvme_dev *dev)
         if (!pdev->irq) {
                 result = pci_enable_msix(pdev, dev->entry, 1);
                 if (result < 0)
-                        goto unmap;
+                        goto disable;
         }
 
         cap = lo_hi_readq(dev->bar + NVME_REG_CAP);
@@ -1754,18 +1769,20 @@ static int nvme_dev_map(struct nvme_dev *dev)
         pci_save_state(pdev);
         return 0;
 
- unmap:
-        iounmap(dev->bar);
-        dev->bar = NULL;
  disable:
-        pci_release_regions(pdev);
- disable_pci:
         pci_disable_device(pdev);
         return result;
 }
 
 static void nvme_dev_unmap(struct nvme_dev *dev)
 {
+        if (dev->bar)
+                iounmap(dev->bar);
+        pci_release_regions(to_pci_dev(dev->dev));
+}
+
+static void nvme_pci_disable(struct nvme_dev *dev)
+{
         struct pci_dev *pdev = to_pci_dev(dev->dev);
 
         if (pdev->msi_enabled)
@@ -1773,12 +1790,6 @@ static void nvme_dev_unmap(struct nvme_dev *dev)
         else if (pdev->msix_enabled)
                 pci_disable_msix(pdev);
 
-        if (dev->bar) {
-                iounmap(dev->bar);
-                dev->bar = NULL;
-                pci_release_regions(pdev);
-        }
-
         if (pci_is_enabled(pdev)) {
                 pci_disable_pcie_error_reporting(pdev);
                 pci_disable_device(pdev);
@@ -1837,7 +1848,7 @@ static void nvme_dev_disable(struct nvme_dev *dev, bool shutdown)
         nvme_dev_list_remove(dev);
 
         mutex_lock(&dev->shutdown_lock);
-        if (dev->bar) {
+        if (pci_is_enabled(to_pci_dev(dev->dev))) {
                 nvme_stop_queues(&dev->ctrl);
                 csts = readl(dev->bar + NVME_REG_CSTS);
         }
@@ -1850,7 +1861,7 @@ static void nvme_dev_disable(struct nvme_dev *dev, bool shutdown)
                 nvme_disable_io_queues(dev);
                 nvme_disable_admin_queue(dev, shutdown);
         }
-        nvme_dev_unmap(dev);
+        nvme_pci_disable(dev);
 
         for (i = dev->queue_count - 1; i >= 0; i--)
                 nvme_clear_queue(dev->queues[i]);
@@ -1894,10 +1905,20 @@ static void nvme_pci_free_ctrl(struct nvme_ctrl *ctrl)
         kfree(dev);
 }
 
+static void nvme_remove_dead_ctrl(struct nvme_dev *dev, int status)
+{
+        dev_warn(dev->dev, "Removing after probe failure status: %d\n", status);
+
+        kref_get(&dev->ctrl.kref);
+        nvme_dev_disable(dev, false);
+        if (!schedule_work(&dev->remove_work))
+                nvme_put_ctrl(&dev->ctrl);
+}
+
 static void nvme_reset_work(struct work_struct *work)
 {
         struct nvme_dev *dev = container_of(work, struct nvme_dev, reset_work);
-        int result;
+        int result = -ENODEV;
 
         if (WARN_ON(test_bit(NVME_CTRL_RESETTING, &dev->flags)))
                 goto out;
@@ -1906,37 +1927,37 @@ static void nvme_reset_work(struct work_struct *work)
          * If we're called to reset a live controller first shut it down before
          * moving on.
          */
-        if (dev->bar)
+        if (dev->ctrl.ctrl_config & NVME_CC_ENABLE)
                 nvme_dev_disable(dev, false);
 
         set_bit(NVME_CTRL_RESETTING, &dev->flags);
 
-        result = nvme_dev_map(dev);
+        result = nvme_pci_enable(dev);
         if (result)
                 goto out;
 
         result = nvme_configure_admin_queue(dev);
         if (result)
-                goto unmap;
+                goto out;
 
         nvme_init_queue(dev->queues[0], 0);
         result = nvme_alloc_admin_tags(dev);
         if (result)
-                goto disable;
+                goto out;
 
         result = nvme_init_identify(&dev->ctrl);
         if (result)
-                goto free_tags;
+                goto out;
 
         result = nvme_setup_io_queues(dev);
         if (result)
-                goto free_tags;
+                goto out;
 
         dev->ctrl.event_limit = NVME_NR_AEN_COMMANDS;
 
         result = nvme_dev_list_add(dev);
         if (result)
-                goto remove;
+                goto out;
 
         /*
          * Keep the controller around but remove all namespaces if we don't have
@@ -1953,19 +1974,8 @@ static void nvme_reset_work(struct work_struct *work)
         clear_bit(NVME_CTRL_RESETTING, &dev->flags);
         return;
 
- remove:
-        nvme_dev_list_remove(dev);
- free_tags:
-        nvme_dev_remove_admin(dev);
-        blk_put_queue(dev->ctrl.admin_q);
-        dev->ctrl.admin_q = NULL;
-        dev->queues[0]->tags = NULL;
- disable:
-        nvme_disable_admin_queue(dev, false);
- unmap:
-        nvme_dev_unmap(dev);
  out:
-        nvme_remove_dead_ctrl(dev);
+        nvme_remove_dead_ctrl(dev, result);
 }
 
 static void nvme_remove_dead_ctrl_work(struct work_struct *work)
@@ -1973,19 +1983,12 @@ static void nvme_remove_dead_ctrl_work(struct work_struct *work)
         struct nvme_dev *dev = container_of(work, struct nvme_dev, remove_work);
         struct pci_dev *pdev = to_pci_dev(dev->dev);
 
+        nvme_kill_queues(&dev->ctrl);
         if (pci_get_drvdata(pdev))
                 pci_stop_and_remove_bus_device_locked(pdev);
         nvme_put_ctrl(&dev->ctrl);
 }
 
-static void nvme_remove_dead_ctrl(struct nvme_dev *dev)
-{
-        dev_warn(dev->dev, "Removing after probe failure\n");
-        kref_get(&dev->ctrl.kref);
-        if (!schedule_work(&dev->remove_work))
-                nvme_put_ctrl(&dev->ctrl);
-}
-
 static int nvme_reset(struct nvme_dev *dev)
 {
         if (!dev->ctrl.admin_q || blk_queue_dying(dev->ctrl.admin_q))
@@ -2037,6 +2040,27 @@ static const struct nvme_ctrl_ops nvme_pci_ctrl_ops = {
         .free_ctrl              = nvme_pci_free_ctrl,
 };
 
+static int nvme_dev_map(struct nvme_dev *dev)
+{
+        int bars;
+        struct pci_dev *pdev = to_pci_dev(dev->dev);
+
+        bars = pci_select_bars(pdev, IORESOURCE_MEM);
+        if (!bars)
+                return -ENODEV;
+        if (pci_request_selected_regions(pdev, bars, "nvme"))
+                return -ENODEV;
+
+        dev->bar = ioremap(pci_resource_start(pdev, 0), 8192);
+        if (!dev->bar)
+                goto release;
+
+       return 0;
+  release:
+       pci_release_regions(pdev);
+       return -ENODEV;
+}
+
 static int nvme_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 {
         int node, result = -ENOMEM;
@@ -2061,6 +2085,10 @@ static int nvme_probe(struct pci_dev *pdev, const struct pci_device_id *id)
         dev->dev = get_device(&pdev->dev);
         pci_set_drvdata(pdev, dev);
 
+        result = nvme_dev_map(dev);
+        if (result)
+                goto free;
+
         INIT_LIST_HEAD(&dev->node);
         INIT_WORK(&dev->scan_work, nvme_dev_scan);
         INIT_WORK(&dev->reset_work, nvme_reset_work);
@@ -2084,6 +2112,7 @@ static int nvme_probe(struct pci_dev *pdev, const struct pci_device_id *id)
         nvme_release_prp_pools(dev);
  put_pci:
         put_device(dev->dev);
+        nvme_dev_unmap(dev);
  free:
         kfree(dev->queues);
         kfree(dev->entry);
@@ -2107,24 +2136,27 @@ static void nvme_shutdown(struct pci_dev *pdev)
         nvme_dev_disable(dev, true);
 }
 
+/*
+ * The driver's remove may be called on a device in a partially initialized
+ * state. This function must not have any dependencies on the device state in
+ * order to proceed.
+ */
 static void nvme_remove(struct pci_dev *pdev)
 {
         struct nvme_dev *dev = pci_get_drvdata(pdev);
 
-        spin_lock(&dev_list_lock);
-        list_del_init(&dev->node);
-        spin_unlock(&dev_list_lock);
-
+        set_bit(NVME_CTRL_REMOVING, &dev->flags);
         pci_set_drvdata(pdev, NULL);
-        flush_work(&dev->reset_work);
         flush_work(&dev->scan_work);
         nvme_remove_namespaces(&dev->ctrl);
         nvme_uninit_ctrl(&dev->ctrl);
         nvme_dev_disable(dev, true);
+        flush_work(&dev->reset_work);
         nvme_dev_remove_admin(dev);
         nvme_free_queues(dev, 0);
         nvme_release_cmb(dev);
         nvme_release_prp_pools(dev);
+        nvme_dev_unmap(dev);
         nvme_put_ctrl(&dev->ctrl);
 }
 
diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c
index 6fd4e5a5ef4a..9d11d9837312 100644
--- a/drivers/nvmem/core.c
+++ b/drivers/nvmem/core.c
@@ -70,6 +70,9 @@ static ssize_t bin_attr_nvmem_read(struct file *filp, struct kobject *kobj,
         if (pos >= nvmem->size)
                 return 0;
 
+        if (count < nvmem->word_size)
+                return -EINVAL;
+
         if (pos + count > nvmem->size)
                 count = nvmem->size - pos;
 
@@ -95,6 +98,9 @@ static ssize_t bin_attr_nvmem_write(struct file *filp, struct kobject *kobj,
         if (pos >= nvmem->size)
                 return 0;
 
+        if (count < nvmem->word_size)
+                return -EINVAL;
+
         if (pos + count > nvmem->size)
                 count = nvmem->size - pos;
 
diff --git a/drivers/nvmem/qfprom.c b/drivers/nvmem/qfprom.c
index afb67e7eeee4..3829e5fbf8c3 100644
--- a/drivers/nvmem/qfprom.c
+++ b/drivers/nvmem/qfprom.c
@@ -21,6 +21,7 @@ static struct regmap_config qfprom_regmap_config = {
         .reg_bits = 32,
         .val_bits = 8,
         .reg_stride = 1,
+        .val_format_endian = REGMAP_ENDIAN_LITTLE,
 };
 
 static struct nvmem_config econfig = {
diff --git a/drivers/of/irq.c b/drivers/of/irq.c
index 7ee21ae305ae..e7bfc175b8e1 100644
--- a/drivers/of/irq.c
+++ b/drivers/of/irq.c
@@ -635,6 +635,13 @@ static u32 __of_msi_map_rid(struct device *dev, struct device_node **np,
                 msi_base = be32_to_cpup(msi_map + 2);
                 rid_len = be32_to_cpup(msi_map + 3);
 
+                if (rid_base & ~map_mask) {
+                        dev_err(parent_dev,
+                                "Invalid msi-map translation - msi-map-mask (0x%x) ignores rid-base (0x%x)\n",
+                                map_mask, rid_base);
+                        return rid_out;
+                }
+
                 msi_controller_node = of_find_node_by_phandle(phandle);
 
                 matched = (masked_rid >= rid_base &&
@@ -654,7 +661,7 @@ static u32 __of_msi_map_rid(struct device *dev, struct device_node **np,
         if (!matched)
                 return rid_out;
 
-        rid_out = masked_rid + msi_base;
+        rid_out = masked_rid - rid_base + msi_base;
         dev_dbg(dev,
                 "msi-map at: %s, using mask %08x, rid-base: %08x, msi-base: %08x, length: %08x, rid: %08x -> %08x\n",
                 dev_name(parent_dev), map_mask, rid_base, msi_base,
diff --git a/drivers/of/of_mdio.c b/drivers/of/of_mdio.c
index 5648317d355f..365dc7e83ab4 100644
--- a/drivers/of/of_mdio.c
+++ b/drivers/of/of_mdio.c
@@ -154,6 +154,7 @@ static const struct of_device_id whitelist_phys[] = {
         { .compatible = "marvell,88E1111", },
         { .compatible = "marvell,88e1116", },
         { .compatible = "marvell,88e1118", },
+        { .compatible = "marvell,88e1145", },
         { .compatible = "marvell,88e1149r", },
         { .compatible = "marvell,88e1310", },
         { .compatible = "marvell,88E1510", },
@@ -304,6 +305,7 @@ EXPORT_SYMBOL(of_phy_find_device);
  * @dev: pointer to net_device claiming the phy
  * @phy_np: Pointer to device tree node for the PHY
  * @hndlr: Link state callback for the network device
+ * @flags: flags to pass to the PHY
  * @iface: PHY data interface type
  *
  * If successful, returns a pointer to the phy_device with the embedded
diff --git a/drivers/pci/host/Kconfig b/drivers/pci/host/Kconfig
index 75a605426538..d1cdd9c992ac 100644
--- a/drivers/pci/host/Kconfig
+++ b/drivers/pci/host/Kconfig
@@ -14,6 +14,7 @@ config PCI_DRA7XX
 config PCI_MVEBU
         bool "Marvell EBU PCIe controller"
         depends on ARCH_MVEBU || ARCH_DOVE
+        depends on ARM
         depends on OF
 
 config PCIE_DW
diff --git a/drivers/pci/host/pci-keystone-dw.c b/drivers/pci/host/pci-keystone-dw.c
index ed34c9520a02..6153853ca9c3 100644
--- a/drivers/pci/host/pci-keystone-dw.c
+++ b/drivers/pci/host/pci-keystone-dw.c
@@ -58,11 +58,6 @@
 
 #define to_keystone_pcie(x)     container_of(x, struct keystone_pcie, pp)
 
-static inline struct pcie_port *sys_to_pcie(struct pci_sys_data *sys)
-{
-        return sys->private_data;
-}
-
 static inline void update_reg_offset_bit_pos(u32 offset, u32 *reg_offset,
                                              u32 *bit_pos)
 {
@@ -108,7 +103,7 @@ static void ks_dw_pcie_msi_irq_ack(struct irq_data *d)
         struct pcie_port *pp;
 
         msi = irq_data_get_msi_desc(d);
-        pp = sys_to_pcie(msi_desc_to_pci_sysdata(msi));
+        pp = (struct pcie_port *) msi_desc_to_pci_sysdata(msi);
         ks_pcie = to_keystone_pcie(pp);
         offset = d->irq - irq_linear_revmap(pp->irq_domain, 0);
         update_reg_offset_bit_pos(offset, &reg_offset, &bit_pos);
@@ -146,7 +141,7 @@ static void ks_dw_pcie_msi_irq_mask(struct irq_data *d)
         u32 offset;
 
         msi = irq_data_get_msi_desc(d);
-        pp = sys_to_pcie(msi_desc_to_pci_sysdata(msi));
+        pp = (struct pcie_port *) msi_desc_to_pci_sysdata(msi);
         ks_pcie = to_keystone_pcie(pp);
         offset = d->irq - irq_linear_revmap(pp->irq_domain, 0);
 
@@ -167,7 +162,7 @@ static void ks_dw_pcie_msi_irq_unmask(struct irq_data *d)
         u32 offset;
 
         msi = irq_data_get_msi_desc(d);
-        pp = sys_to_pcie(msi_desc_to_pci_sysdata(msi));
+        pp = (struct pcie_port *) msi_desc_to_pci_sysdata(msi);
         ks_pcie = to_keystone_pcie(pp);
         offset = d->irq - irq_linear_revmap(pp->irq_domain, 0);
 
diff --git a/drivers/pci/host/pci-layerscape.c b/drivers/pci/host/pci-layerscape.c
index 3923bed93c7e..f39961bcf7aa 100644
--- a/drivers/pci/host/pci-layerscape.c
+++ b/drivers/pci/host/pci-layerscape.c
@@ -77,6 +77,16 @@ static void ls_pcie_fix_class(struct ls_pcie *pcie)
         iowrite16(PCI_CLASS_BRIDGE_PCI, pcie->dbi + PCI_CLASS_DEVICE);
 }
 
+/* Drop MSG TLP except for Vendor MSG */
+static void ls_pcie_drop_msg_tlp(struct ls_pcie *pcie)
+{
+        u32 val;
+
+        val = ioread32(pcie->dbi + PCIE_STRFMR1);
+        val &= 0xDFFFFFFF;
+        iowrite32(val, pcie->dbi + PCIE_STRFMR1);
+}
+
 static int ls1021_pcie_link_up(struct pcie_port *pp)
 {
         u32 state;
@@ -97,7 +107,7 @@ static int ls1021_pcie_link_up(struct pcie_port *pp)
 static void ls1021_pcie_host_init(struct pcie_port *pp)
 {
         struct ls_pcie *pcie = to_ls_pcie(pp);
-        u32 val, index[2];
+        u32 index[2];
 
         pcie->scfg = syscon_regmap_lookup_by_phandle(pp->dev->of_node,
                                                      "fsl,pcie-scfg");
@@ -116,13 +126,7 @@ static void ls1021_pcie_host_init(struct pcie_port *pp)
 
         dw_pcie_setup_rc(pp);
 
-        /*
-         * LS1021A Workaround for internal TKT228622
-         * to fix the INTx hang issue
-         */
-        val = ioread32(pcie->dbi + PCIE_STRFMR1);
-        val &= 0xffff;
-        iowrite32(val, pcie->dbi + PCIE_STRFMR1);
+        ls_pcie_drop_msg_tlp(pcie);
 }
 
 static int ls_pcie_link_up(struct pcie_port *pp)
@@ -147,6 +151,7 @@ static void ls_pcie_host_init(struct pcie_port *pp)
         iowrite32(1, pcie->dbi + PCIE_DBI_RO_WR_EN);
         ls_pcie_fix_class(pcie);
         ls_pcie_clear_multifunction(pcie);
+        ls_pcie_drop_msg_tlp(pcie);
         iowrite32(0, pcie->dbi + PCIE_DBI_RO_WR_EN);
 }
 
diff --git a/drivers/pci/host/pcie-iproc.c b/drivers/pci/host/pcie-iproc.c
index 5816bceddb65..a576aeeb22da 100644
--- a/drivers/pci/host/pcie-iproc.c
+++ b/drivers/pci/host/pcie-iproc.c
@@ -64,7 +64,6 @@
 #define OARR_SIZE_CFG                BIT(OARR_SIZE_CFG_SHIFT)
 
 #define MAX_NUM_OB_WINDOWS           2
-#define MAX_NUM_PAXC_PF              4
 
 #define IPROC_PCIE_REG_INVALID 0xffff
 
@@ -170,20 +169,6 @@ static inline void iproc_pcie_ob_write(struct iproc_pcie *pcie,
         writel(val, pcie->base + offset + (window * 8));
 }
 
-static inline bool iproc_pcie_device_is_valid(struct iproc_pcie *pcie,
-                                              unsigned int slot,
-                                              unsigned int fn)
-{
-        if (slot > 0)
-                return false;
-
-        /* PAXC can only support limited number of functions */
-        if (pcie->type == IPROC_PCIE_PAXC && fn >= MAX_NUM_PAXC_PF)
-                return false;
-
-        return true;
-}
-
 /**
  * Note access to the configuration registers are protected at the higher layer
  * by 'pci_lock' in drivers/pci/access.c
@@ -199,11 +184,11 @@ static void __iomem *iproc_pcie_map_cfg_bus(struct pci_bus *bus,
         u32 val;
         u16 offset;
 
-        if (!iproc_pcie_device_is_valid(pcie, slot, fn))
-                return NULL;
-
         /* root complex access */
         if (busno == 0) {
+                if (slot > 0 || fn > 0)
+                        return NULL;
+
                 iproc_pcie_write_reg(pcie, IPROC_PCIE_CFG_IND_ADDR,
                                      where & CFG_IND_ADDR_MASK);
                 offset = iproc_pcie_reg_offset(pcie, IPROC_PCIE_CFG_IND_DATA);
@@ -213,6 +198,14 @@ static void __iomem *iproc_pcie_map_cfg_bus(struct pci_bus *bus,
                         return (pcie->base + offset);
         }
 
+        /*
+         * PAXC is connected to an internally emulated EP within the SoC.  It
+         * allows only one device.
+         */
+        if (pcie->type == IPROC_PCIE_PAXC)
+                if (slot > 0)
+                        return NULL;
+
         /* EP device access */
         val = (busno << CFG_ADDR_BUS_NUM_SHIFT) |
                 (slot << CFG_ADDR_DEV_NUM_SHIFT) |
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index 602eb4223510..f89db3af0607 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -4772,8 +4772,10 @@ int pci_get_new_domain_nr(void)
 void pci_bus_assign_domain_nr(struct pci_bus *bus, struct device *parent)
 {
         static int use_dt_domains = -1;
-        int domain = of_get_pci_domain_nr(parent->of_node);
+        int domain = -1;
 
+        if (parent)
+                domain = of_get_pci_domain_nr(parent->of_node);
         /*
          * Check DT domain and use_dt_domains values.
          *
diff --git a/drivers/pci/pcie/aer/aerdrv.c b/drivers/pci/pcie/aer/aerdrv.c
index 0bf82a20a0fb..48d21e0edd56 100644
--- a/drivers/pci/pcie/aer/aerdrv.c
+++ b/drivers/pci/pcie/aer/aerdrv.c
@@ -262,7 +262,6 @@ static struct aer_rpc *aer_alloc_rpc(struct pcie_device *dev)
         rpc->rpd = dev;
         INIT_WORK(&rpc->dpc_handler, aer_isr);
         mutex_init(&rpc->rpc_mutex);
-        init_waitqueue_head(&rpc->wait_release);
 
         /* Use PCIe bus function to store rpc into PCIe device */
         set_service_data(dev, rpc);
@@ -285,8 +284,7 @@ static void aer_remove(struct pcie_device *dev)
                 if (rpc->isr)
                         free_irq(dev->irq, dev);
 
-                wait_event(rpc->wait_release, rpc->prod_idx == rpc->cons_idx);
-
+                flush_work(&rpc->dpc_handler);
                 aer_disable_rootport(rpc);
                 kfree(rpc);
                 set_service_data(dev, NULL);
diff --git a/drivers/pci/pcie/aer/aerdrv.h b/drivers/pci/pcie/aer/aerdrv.h
index 84420b7c9456..945c939a86c5 100644
--- a/drivers/pci/pcie/aer/aerdrv.h
+++ b/drivers/pci/pcie/aer/aerdrv.h
@@ -72,7 +72,6 @@ struct aer_rpc {
                                          * recovery on the same
                                          * root port hierarchy
                                          */
-        wait_queue_head_t wait_release;
 };
 
 struct aer_broadcast_data {
diff --git a/drivers/pci/pcie/aer/aerdrv_core.c b/drivers/pci/pcie/aer/aerdrv_core.c
index 712392504ed9..521e39c1b66d 100644
--- a/drivers/pci/pcie/aer/aerdrv_core.c
+++ b/drivers/pci/pcie/aer/aerdrv_core.c
@@ -811,8 +811,6 @@ void aer_isr(struct work_struct *work)
         while (get_e_source(rpc, &e_src))
                 aer_isr_one_error(p_device, &e_src);
         mutex_unlock(&rpc->rpc_mutex);
-
-        wake_up(&rpc->wait_release);
 }
 
 /**
diff --git a/drivers/pci/xen-pcifront.c b/drivers/pci/xen-pcifront.c
index c777b97207d5..5f70fee59a94 100644
--- a/drivers/pci/xen-pcifront.c
+++ b/drivers/pci/xen-pcifront.c
@@ -53,7 +53,7 @@ struct pcifront_device {
 };
 
 struct pcifront_sd {
-        int domain;
+        struct pci_sysdata sd;
         struct pcifront_device *pdev;
 };
 
@@ -67,7 +67,9 @@ static inline void pcifront_init_sd(struct pcifront_sd *sd,
                                     unsigned int domain, unsigned int bus,
                                     struct pcifront_device *pdev)
 {
-        sd->domain = domain;
+        /* Because we do not expose that information via XenBus. */
+        sd->sd.node = first_online_node;
+        sd->sd.domain = domain;
         sd->pdev = pdev;
 }
 
@@ -468,8 +470,8 @@ static int pcifront_scan_root(struct pcifront_device *pdev,
         dev_info(&pdev->xdev->dev, "Creating PCI Frontend Bus %04x:%02x\n",
                  domain, bus);
 
-        bus_entry = kmalloc(sizeof(*bus_entry), GFP_KERNEL);
-        sd = kmalloc(sizeof(*sd), GFP_KERNEL);
+        bus_entry = kzalloc(sizeof(*bus_entry), GFP_KERNEL);
+        sd = kzalloc(sizeof(*sd), GFP_KERNEL);
         if (!bus_entry || !sd) {
                 err = -ENOMEM;
                 goto err_out;
diff --git a/drivers/phy/Kconfig b/drivers/phy/Kconfig
index e7e117d5dbbe..0124d17bd9fe 100644
--- a/drivers/phy/Kconfig
+++ b/drivers/phy/Kconfig
@@ -224,6 +224,7 @@ config PHY_MT65XX_USB3
 
 config PHY_HI6220_USB
         tristate "hi6220 USB PHY support"
+        depends on (ARCH_HISI && ARM64) || COMPILE_TEST
         select GENERIC_PHY
         select MFD_SYSCON
         help
diff --git a/drivers/phy/phy-core.c b/drivers/phy/phy-core.c
index 8c7f27db6ad3..e7e574dc667a 100644
--- a/drivers/phy/phy-core.c
+++ b/drivers/phy/phy-core.c
@@ -275,20 +275,21 @@ EXPORT_SYMBOL_GPL(phy_exit);
 
 int phy_power_on(struct phy *phy)
 {
-        int ret;
+        int ret = 0;
 
         if (!phy)
-                return 0;
+                goto out;
 
         if (phy->pwr) {
                 ret = regulator_enable(phy->pwr);
                 if (ret)
-                        return ret;
+                        goto out;
         }
 
         ret = phy_pm_runtime_get_sync(phy);
         if (ret < 0 && ret != -ENOTSUPP)
-                return ret;
+                goto err_pm_sync;
+
         ret = 0; /* Override possible ret == -ENOTSUPP */
 
         mutex_lock(&phy->mutex);
@@ -296,19 +297,20 @@ int phy_power_on(struct phy *phy)
                 ret = phy->ops->power_on(phy);
                 if (ret < 0) {
                         dev_err(&phy->dev, "phy poweron failed --> %d\n", ret);
-                        goto out;
+                        goto err_pwr_on;
                 }
         }
         ++phy->power_count;
         mutex_unlock(&phy->mutex);
         return 0;
 
-out:
+err_pwr_on:
         mutex_unlock(&phy->mutex);
         phy_pm_runtime_put_sync(phy);
+err_pm_sync:
         if (phy->pwr)
                 regulator_disable(phy->pwr);
-
+out:
         return ret;
 }
 EXPORT_SYMBOL_GPL(phy_power_on);
diff --git a/drivers/phy/phy-twl4030-usb.c b/drivers/phy/phy-twl4030-usb.c
index 4a3fc6e59f8e..840f3eae428b 100644
--- a/drivers/phy/phy-twl4030-usb.c
+++ b/drivers/phy/phy-twl4030-usb.c
@@ -715,6 +715,7 @@ static int twl4030_usb_probe(struct platform_device *pdev)
         pm_runtime_use_autosuspend(&pdev->dev);
         pm_runtime_set_autosuspend_delay(&pdev->dev, 2000);
         pm_runtime_enable(&pdev->dev);
+        pm_runtime_get_sync(&pdev->dev);
 
         /* Our job is to use irqs and status from the power module
          * to keep the transceiver disabled when nothing's connected.
@@ -750,6 +751,7 @@ static int twl4030_usb_remove(struct platform_device *pdev)
         struct twl4030_usb *twl = platform_get_drvdata(pdev);
         int val;
 
+        usb_remove_phy(&twl->phy);
         pm_runtime_get_sync(twl->dev);
         cancel_delayed_work(&twl->id_workaround_work);
         device_remove_file(twl->dev, &dev_attr_vbus);
@@ -757,6 +759,13 @@ static int twl4030_usb_remove(struct platform_device *pdev)
         /* set transceiver mode to power on defaults */
         twl4030_usb_set_mode(twl, -1);
 
+        /* idle ulpi before powering off */
+        if (cable_present(twl->linkstat))
+                pm_runtime_put_noidle(twl->dev);
+        pm_runtime_mark_last_busy(twl->dev);
+        pm_runtime_put_sync_suspend(twl->dev);
+        pm_runtime_disable(twl->dev);
+
         /* autogate 60MHz ULPI clock,
          * clear dpll clock request for i2c access,
          * disable 32KHz
@@ -771,11 +780,6 @@ static int twl4030_usb_remove(struct platform_device *pdev)
         /* disable complete OTG block */
         twl4030_usb_clear_bits(twl, POWER_CTRL, POWER_CTRL_OTG_ENAB);
 
-        if (cable_present(twl->linkstat))
-                pm_runtime_put_noidle(twl->dev);
-        pm_runtime_mark_last_busy(twl->dev);
-        pm_runtime_put(twl->dev);
-
         return 0;
 }
 
diff --git a/drivers/pinctrl/mediatek/pinctrl-mtk-common.c b/drivers/pinctrl/mediatek/pinctrl-mtk-common.c
index 16d48a4ed225..e96e86d2e745 100644
--- a/drivers/pinctrl/mediatek/pinctrl-mtk-common.c
+++ b/drivers/pinctrl/mediatek/pinctrl-mtk-common.c
@@ -347,6 +347,7 @@ static int mtk_pconf_parse_conf(struct pinctrl_dev *pctldev,
                 ret = mtk_pconf_set_pull_select(pctl, pin, true, false, arg);
                 break;
         case PIN_CONFIG_INPUT_ENABLE:
+                mtk_pmx_gpio_set_direction(pctldev, NULL, pin, true);
                 ret = mtk_pconf_set_ies_smt(pctl, pin, arg, param);
                 break;
         case PIN_CONFIG_OUTPUT:
@@ -354,6 +355,7 @@ static int mtk_pconf_parse_conf(struct pinctrl_dev *pctldev,
                 ret = mtk_pmx_gpio_set_direction(pctldev, NULL, pin, false);
                 break;
         case PIN_CONFIG_INPUT_SCHMITT_ENABLE:
+                mtk_pmx_gpio_set_direction(pctldev, NULL, pin, true);
                 ret = mtk_pconf_set_ies_smt(pctl, pin, arg, param);
                 break;
         case PIN_CONFIG_DRIVE_STRENGTH:
diff --git a/drivers/pinctrl/mvebu/pinctrl-mvebu.c b/drivers/pinctrl/mvebu/pinctrl-mvebu.c
index e4d473811bb3..3ef798fac81b 100644
--- a/drivers/pinctrl/mvebu/pinctrl-mvebu.c
+++ b/drivers/pinctrl/mvebu/pinctrl-mvebu.c
@@ -666,16 +666,19 @@ int mvebu_pinctrl_probe(struct platform_device *pdev)
                 struct mvebu_mpp_ctrl_setting *set = &mode->settings[0];
                 struct mvebu_pinctrl_group *grp;
                 unsigned num_settings;
+                unsigned supp_settings;
 
-                for (num_settings = 0; ; set++) {
+                for (num_settings = 0, supp_settings = 0; ; set++) {
                         if (!set->name)
                                 break;
 
+                        num_settings++;
+
                         /* skip unsupported settings for this variant */
                         if (pctl->variant && !(pctl->variant & set->variant))
                                 continue;
 
-                        num_settings++;
+                        supp_settings++;
 
                         /* find gpio/gpo/gpi settings */
                         if (strcmp(set->name, "gpio") == 0)
@@ -688,7 +691,7 @@ int mvebu_pinctrl_probe(struct platform_device *pdev)
                 }
 
                 /* skip modes with no settings for this variant */
-                if (!num_settings)
+                if (!supp_settings)
                         continue;
 
                 grp = mvebu_pinctrl_find_group_by_pid(pctl, mode->pid);
diff --git a/drivers/pinctrl/nomadik/pinctrl-abx500.c b/drivers/pinctrl/nomadik/pinctrl-abx500.c
index 085e60106ec2..1f7469c9857d 100644
--- a/drivers/pinctrl/nomadik/pinctrl-abx500.c
+++ b/drivers/pinctrl/nomadik/pinctrl-abx500.c
@@ -191,6 +191,7 @@ static void abx500_gpio_set(struct gpio_chip *chip, unsigned offset, int val)
                 dev_err(pct->dev, "%s write failed (%d)\n", __func__, ret);
 }
 
+#ifdef CONFIG_DEBUG_FS
 static int abx500_get_pull_updown(struct abx500_pinctrl *pct, int offset,
                                   enum abx500_gpio_pull_updown *pull_updown)
 {
@@ -226,6 +227,7 @@ out:
 
         return ret;
 }
+#endif
 
 static int abx500_set_pull_updown(struct abx500_pinctrl *pct,
                                   int offset, enum abx500_gpio_pull_updown val)
@@ -468,6 +470,7 @@ out:
         return ret;
 }
 
+#ifdef CONFIG_DEBUG_FS
 static int abx500_get_mode(struct pinctrl_dev *pctldev, struct gpio_chip *chip,
                           unsigned gpio)
 {
@@ -553,8 +556,6 @@ out:
         return ret;
 }
 
-#ifdef CONFIG_DEBUG_FS
-
 #include <linux/seq_file.h>
 
 static void abx500_gpio_dbg_show_one(struct seq_file *s,
diff --git a/drivers/pinctrl/pxa/pinctrl-pxa2xx.c b/drivers/pinctrl/pxa/pinctrl-pxa2xx.c
index d90e205cf809..216f227c6009 100644
--- a/drivers/pinctrl/pxa/pinctrl-pxa2xx.c
+++ b/drivers/pinctrl/pxa/pinctrl-pxa2xx.c
@@ -426,6 +426,7 @@ int pxa2xx_pinctrl_init(struct platform_device *pdev,
 
         return 0;
 }
+EXPORT_SYMBOL(pxa2xx_pinctrl_init);
 
 int pxa2xx_pinctrl_exit(struct platform_device *pdev)
 {
diff --git a/drivers/pinctrl/samsung/pinctrl-samsung.c b/drivers/pinctrl/samsung/pinctrl-samsung.c
index f67b1e958589..5cc97f85db02 100644
--- a/drivers/pinctrl/samsung/pinctrl-samsung.c
+++ b/drivers/pinctrl/samsung/pinctrl-samsung.c
@@ -514,25 +514,35 @@ static const struct pinconf_ops samsung_pinconf_ops = {
         .pin_config_group_set   = samsung_pinconf_group_set,
 };
 
-/* gpiolib gpio_set callback function */
-static void samsung_gpio_set(struct gpio_chip *gc, unsigned offset, int value)
+/*
+ * The samsung_gpio_set_vlaue() should be called with "bank->slock" held
+ * to avoid race condition.
+ */
+static void samsung_gpio_set_value(struct gpio_chip *gc,
+                                          unsigned offset, int value)
 {
         struct samsung_pin_bank *bank = gpiochip_get_data(gc);
         const struct samsung_pin_bank_type *type = bank->type;
-        unsigned long flags;
         void __iomem *reg;
         u32 data;
 
         reg = bank->drvdata->virt_base + bank->pctl_offset;
 
-        spin_lock_irqsave(&bank->slock, flags);
-
         data = readl(reg + type->reg_offset[PINCFG_TYPE_DAT]);
         data &= ~(1 << offset);
         if (value)
                 data |= 1 << offset;
         writel(data, reg + type->reg_offset[PINCFG_TYPE_DAT]);
+}
+
+/* gpiolib gpio_set callback function */
+static void samsung_gpio_set(struct gpio_chip *gc, unsigned offset, int value)
+{
+        struct samsung_pin_bank *bank = gpiochip_get_data(gc);
+        unsigned long flags;
 
+        spin_lock_irqsave(&bank->slock, flags);
+        samsung_gpio_set_value(gc, offset, value);
         spin_unlock_irqrestore(&bank->slock, flags);
 }
 
@@ -553,6 +563,8 @@ static int samsung_gpio_get(struct gpio_chip *gc, unsigned offset)
 }
 
 /*
+ * The samsung_gpio_set_direction() should be called with "bank->slock" held
+ * to avoid race condition.
  * The calls to gpio_direction_output() and gpio_direction_input()
  * leads to this function call.
  */
@@ -564,7 +576,6 @@ static int samsung_gpio_set_direction(struct gpio_chip *gc,
         struct samsung_pinctrl_drv_data *drvdata;
         void __iomem *reg;
         u32 data, mask, shift;
-        unsigned long flags;
 
         bank = gpiochip_get_data(gc);
         type = bank->type;
@@ -581,31 +592,42 @@ static int samsung_gpio_set_direction(struct gpio_chip *gc,
                 reg += 4;
         }
 
-        spin_lock_irqsave(&bank->slock, flags);
-
         data = readl(reg);
         data &= ~(mask << shift);
         if (!input)
                 data |= FUNC_OUTPUT << shift;
         writel(data, reg);
 
-        spin_unlock_irqrestore(&bank->slock, flags);
-
         return 0;
 }
 
 /* gpiolib gpio_direction_input callback function. */
 static int samsung_gpio_direction_input(struct gpio_chip *gc, unsigned offset)
 {
-        return samsung_gpio_set_direction(gc, offset, true);
+        struct samsung_pin_bank *bank = gpiochip_get_data(gc);
+        unsigned long flags;
+        int ret;
+
+        spin_lock_irqsave(&bank->slock, flags);
+        ret = samsung_gpio_set_direction(gc, offset, true);
+        spin_unlock_irqrestore(&bank->slock, flags);
+        return ret;
 }
 
 /* gpiolib gpio_direction_output callback function. */
 static int samsung_gpio_direction_output(struct gpio_chip *gc, unsigned offset,
                                                         int value)
 {
-        samsung_gpio_set(gc, offset, value);
-        return samsung_gpio_set_direction(gc, offset, false);
+        struct samsung_pin_bank *bank = gpiochip_get_data(gc);
+        unsigned long flags;
+        int ret;
+
+        spin_lock_irqsave(&bank->slock, flags);
+        samsung_gpio_set_value(gc, offset, value);
+        ret = samsung_gpio_set_direction(gc, offset, false);
+        spin_unlock_irqrestore(&bank->slock, flags);
+
+        return ret;
 }
 
 /*
diff --git a/drivers/pinctrl/sunxi/pinctrl-sun8i-h3.c b/drivers/pinctrl/sunxi/pinctrl-sun8i-h3.c
index 77d4cf047cee..11760bbe9d51 100644
--- a/drivers/pinctrl/sunxi/pinctrl-sun8i-h3.c
+++ b/drivers/pinctrl/sunxi/pinctrl-sun8i-h3.c
@@ -492,6 +492,7 @@ static const struct sunxi_pinctrl_desc sun8i_h3_pinctrl_data = {
         .pins = sun8i_h3_pins,
         .npins = ARRAY_SIZE(sun8i_h3_pins),
         .irq_banks = 2,
+        .irq_read_needs_mux = true
 };
 
 static int sun8i_h3_pinctrl_probe(struct platform_device *pdev)
diff --git a/drivers/platform/x86/intel-hid.c b/drivers/platform/x86/intel-hid.c
index 20f0ad9bb9f3..e20f23e04c24 100644
--- a/drivers/platform/x86/intel-hid.c
+++ b/drivers/platform/x86/intel-hid.c
@@ -41,8 +41,7 @@ static const struct key_entry intel_hid_keymap[] = {
         { KE_KEY, 4, { KEY_HOME } },
         { KE_KEY, 5, { KEY_END } },
         { KE_KEY, 6, { KEY_PAGEUP } },
-        { KE_KEY, 4, { KEY_PAGEDOWN } },
-        { KE_KEY, 4, { KEY_HOME } },
+        { KE_KEY, 7, { KEY_PAGEDOWN } },
         { KE_KEY, 8, { KEY_RFKILL } },
         { KE_KEY, 9, { KEY_POWER } },
         { KE_KEY, 11, { KEY_SLEEP } },
diff --git a/drivers/platform/x86/intel_scu_ipcutil.c b/drivers/platform/x86/intel_scu_ipcutil.c
index 02bc5a6343c3..aa454241489c 100644
--- a/drivers/platform/x86/intel_scu_ipcutil.c
+++ b/drivers/platform/x86/intel_scu_ipcutil.c
@@ -49,7 +49,7 @@ struct scu_ipc_data {
 
 static int scu_reg_access(u32 cmd, struct scu_ipc_data  *data)
 {
-        int count = data->count;
+        unsigned int count = data->count;
 
         if (count == 0 || count == 3 || count > 4)
                 return -EINVAL;
diff --git a/drivers/power/bq27xxx_battery_i2c.c b/drivers/power/bq27xxx_battery_i2c.c
index 9429e66be096..8eafc6f0df88 100644
--- a/drivers/power/bq27xxx_battery_i2c.c
+++ b/drivers/power/bq27xxx_battery_i2c.c
@@ -21,6 +21,9 @@
 
 #include <linux/power/bq27xxx_battery.h>
 
+static DEFINE_IDR(battery_id);
+static DEFINE_MUTEX(battery_mutex);
+
 static irqreturn_t bq27xxx_battery_irq_handler_thread(int irq, void *data)
 {
         struct bq27xxx_device_info *di = data;
@@ -70,19 +73,33 @@ static int bq27xxx_battery_i2c_probe(struct i2c_client *client,
 {
         struct bq27xxx_device_info *di;
         int ret;
+        char *name;
+        int num;
+
+        /* Get new ID for the new battery device */
+        mutex_lock(&battery_mutex);
+        num = idr_alloc(&battery_id, client, 0, 0, GFP_KERNEL);
+        mutex_unlock(&battery_mutex);
+        if (num < 0)
+                return num;
+
+        name = devm_kasprintf(&client->dev, GFP_KERNEL, "%s-%d", id->name, num);
+        if (!name)
+                goto err_mem;
 
         di = devm_kzalloc(&client->dev, sizeof(*di), GFP_KERNEL);
         if (!di)
-                return -ENOMEM;
+                goto err_mem;
 
+        di->id = num;
         di->dev = &client->dev;
         di->chip = id->driver_data;
-        di->name = id->name;
+        di->name = name;
         di->bus.read = bq27xxx_battery_i2c_read;
 
         ret = bq27xxx_battery_setup(di);
         if (ret)
-                return ret;
+                goto err_failed;
 
         /* Schedule a polling after about 1 min */
         schedule_delayed_work(&di->work, 60 * HZ);
@@ -103,6 +120,16 @@ static int bq27xxx_battery_i2c_probe(struct i2c_client *client,
         }
 
         return 0;
+
+err_mem:
+        ret = -ENOMEM;
+
+err_failed:
+        mutex_lock(&battery_mutex);
+        idr_remove(&battery_id, num);
+        mutex_unlock(&battery_mutex);
+
+        return ret;
 }
 
 static int bq27xxx_battery_i2c_remove(struct i2c_client *client)
@@ -111,6 +138,10 @@ static int bq27xxx_battery_i2c_remove(struct i2c_client *client)
 
         bq27xxx_battery_teardown(di);
 
+        mutex_lock(&battery_mutex);
+        idr_remove(&battery_id, di->id);
+        mutex_unlock(&battery_mutex);
+
         return 0;
 }
 
diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
index 41605dac8309..c78db05e75b1 100644
--- a/drivers/s390/block/dasd.c
+++ b/drivers/s390/block/dasd.c
@@ -3035,6 +3035,7 @@ static void dasd_setup_queue(struct dasd_block *block)
                 max = block->base->discipline->max_blocks << block->s2b_shift;
         }
         queue_flag_set_unlocked(QUEUE_FLAG_NONROT, block->request_queue);
+        block->request_queue->limits.max_dev_sectors = max;
         blk_queue_logical_block_size(block->request_queue,
                                      block->bp_block);
         blk_queue_max_hw_sectors(block->request_queue, max);
diff --git a/drivers/s390/block/dasd_alias.c b/drivers/s390/block/dasd_alias.c
index 184b1dbeb554..286782c60da4 100644
--- a/drivers/s390/block/dasd_alias.c
+++ b/drivers/s390/block/dasd_alias.c
@@ -264,8 +264,10 @@ void dasd_alias_disconnect_device_from_lcu(struct dasd_device *device)
                 spin_unlock_irqrestore(&lcu->lock, flags);
                 cancel_work_sync(&lcu->suc_data.worker);
                 spin_lock_irqsave(&lcu->lock, flags);
-                if (device == lcu->suc_data.device)
+                if (device == lcu->suc_data.device) {
+                        dasd_put_device(device);
                         lcu->suc_data.device = NULL;
+                }
         }
         was_pending = 0;
         if (device == lcu->ruac_data.device) {
@@ -273,8 +275,10 @@ void dasd_alias_disconnect_device_from_lcu(struct dasd_device *device)
                 was_pending = 1;
                 cancel_delayed_work_sync(&lcu->ruac_data.dwork);
                 spin_lock_irqsave(&lcu->lock, flags);
-                if (device == lcu->ruac_data.device)
+                if (device == lcu->ruac_data.device) {
+                        dasd_put_device(device);
                         lcu->ruac_data.device = NULL;
+                }
         }
         private->lcu = NULL;
         spin_unlock_irqrestore(&lcu->lock, flags);
@@ -549,8 +553,10 @@ static void lcu_update_work(struct work_struct *work)
         if ((rc && (rc != -EOPNOTSUPP)) || (lcu->flags & NEED_UAC_UPDATE)) {
                 DBF_DEV_EVENT(DBF_WARNING, device, "could not update"
                             " alias data in lcu (rc = %d), retry later", rc);
-                schedule_delayed_work(&lcu->ruac_data.dwork, 30*HZ);
+                if (!schedule_delayed_work(&lcu->ruac_data.dwork, 30*HZ))
+                        dasd_put_device(device);
         } else {
+                dasd_put_device(device);
                 lcu->ruac_data.device = NULL;
                 lcu->flags &= ~UPDATE_PENDING;
         }
@@ -593,8 +599,10 @@ static int _schedule_lcu_update(struct alias_lcu *lcu,
          */
         if (!usedev)
                 return -EINVAL;
+        dasd_get_device(usedev);
         lcu->ruac_data.device = usedev;
-        schedule_delayed_work(&lcu->ruac_data.dwork, 0);
+        if (!schedule_delayed_work(&lcu->ruac_data.dwork, 0))
+                dasd_put_device(usedev);
         return 0;
 }
 
@@ -723,7 +731,7 @@ static int reset_summary_unit_check(struct alias_lcu *lcu,
         ASCEBC((char *) &cqr->magic, 4);
         ccw = cqr->cpaddr;
         ccw->cmd_code = DASD_ECKD_CCW_RSCK;
-        ccw->flags = 0 ;
+        ccw->flags = CCW_FLAG_SLI;
         ccw->count = 16;
         ccw->cda = (__u32)(addr_t) cqr->data;
         ((char *)cqr->data)[0] = reason;
@@ -930,6 +938,7 @@ static void summary_unit_check_handling_work(struct work_struct *work)
         /* 3. read new alias configuration */
         _schedule_lcu_update(lcu, device);
         lcu->suc_data.device = NULL;
+        dasd_put_device(device);
         spin_unlock_irqrestore(&lcu->lock, flags);
 }
 
@@ -989,6 +998,8 @@ void dasd_alias_handle_summary_unit_check(struct dasd_device *device,
         }
         lcu->suc_data.reason = reason;
         lcu->suc_data.device = device;
+        dasd_get_device(device);
         spin_unlock(&lcu->lock);
-        schedule_work(&lcu->suc_data.worker);
+        if (!schedule_work(&lcu->suc_data.worker))
+                dasd_put_device(device);
 };
diff --git a/drivers/s390/block/dasd_diag.c b/drivers/s390/block/dasd_diag.c
index cb61f300f8b5..277b5c8c825c 100644
--- a/drivers/s390/block/dasd_diag.c
+++ b/drivers/s390/block/dasd_diag.c
@@ -67,7 +67,7 @@ static const u8 DASD_DIAG_CMS1[] = { 0xc3, 0xd4, 0xe2, 0xf1 };/* EBCDIC CMS1 */
  * and function code cmd.
  * In case of an exception return 3. Otherwise return result of bitwise OR of
  * resulting condition code and DIAG return code. */
-static inline int dia250(void *iob, int cmd)
+static inline int __dia250(void *iob, int cmd)
 {
         register unsigned long reg2 asm ("2") = (unsigned long) iob;
         typedef union {
@@ -77,7 +77,6 @@ static inline int dia250(void *iob, int cmd)
         int rc;
 
         rc = 3;
-        diag_stat_inc(DIAG_STAT_X250);
         asm volatile(
                 "       diag    2,%2,0x250\n"
                 "0:     ipm     %0\n"
@@ -91,6 +90,12 @@ static inline int dia250(void *iob, int cmd)
         return rc;
 }
 
+static inline int dia250(void *iob, int cmd)
+{
+        diag_stat_inc(DIAG_STAT_X250);
+        return __dia250(iob, cmd);
+}
+
 /* Initialize block I/O to DIAG device using the specified blocksize and
  * block offset. On success, return zero and set end_block to contain the
  * number of blocks on the device minus the specified offset. Return non-zero
diff --git a/drivers/scsi/device_handler/scsi_dh_rdac.c b/drivers/scsi/device_handler/scsi_dh_rdac.c
index 361358134315..93880ed6291c 100644
--- a/drivers/scsi/device_handler/scsi_dh_rdac.c
+++ b/drivers/scsi/device_handler/scsi_dh_rdac.c
@@ -562,7 +562,7 @@ static int mode_select_handle_sense(struct scsi_device *sdev,
                         /*
                          * Command Lock contention
                          */
-                        err = SCSI_DH_RETRY;
+                        err = SCSI_DH_IMM_RETRY;
                 break;
         default:
                 break;
@@ -612,6 +612,8 @@ retry:
                 err = mode_select_handle_sense(sdev, h->sense);
                 if (err == SCSI_DH_RETRY && retry_cnt--)
                         goto retry;
+                if (err == SCSI_DH_IMM_RETRY)
+                        goto retry;
         }
         if (err == SCSI_DH_OK) {
                 h->state = RDAC_STATE_ACTIVE;
diff --git a/drivers/scsi/hisi_sas/Kconfig b/drivers/scsi/hisi_sas/Kconfig
index b67661836c9f..d1dd1616f983 100644
--- a/drivers/scsi/hisi_sas/Kconfig
+++ b/drivers/scsi/hisi_sas/Kconfig
@@ -1,6 +1,6 @@
 config SCSI_HISI_SAS
         tristate "HiSilicon SAS"
-        depends on HAS_DMA
+        depends on HAS_DMA && HAS_IOMEM
         depends on ARM64 || COMPILE_TEST
         select SCSI_SAS_LIBSAS
         select BLK_DEV_INTEGRITY
diff --git a/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c
index 057fdeb720ac..eea24d7531cf 100644
--- a/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c
+++ b/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c
@@ -1289,13 +1289,10 @@ static int slot_complete_v1_hw(struct hisi_hba *hisi_hba,
                 goto out;
         }
 
-        if (cmplt_hdr_data & CMPLT_HDR_ERR_RCRD_XFRD_MSK) {
-                if (!(cmplt_hdr_data & CMPLT_HDR_CMD_CMPLT_MSK) ||
-                    !(cmplt_hdr_data & CMPLT_HDR_RSPNS_XFRD_MSK))
-                        ts->stat = SAS_DATA_OVERRUN;
-                else
-                        slot_err_v1_hw(hisi_hba, task, slot);
+        if (cmplt_hdr_data & CMPLT_HDR_ERR_RCRD_XFRD_MSK &&
+                !(cmplt_hdr_data & CMPLT_HDR_RSPNS_XFRD_MSK)) {
 
+                slot_err_v1_hw(hisi_hba, task, slot);
                 goto out;
         }
 
diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c
index 3b3e0998fa6e..d6a691e27d33 100644
--- a/drivers/scsi/ipr.c
+++ b/drivers/scsi/ipr.c
@@ -4002,6 +4002,7 @@ static ssize_t ipr_store_update_fw(struct device *dev,
         struct ipr_sglist *sglist;
         char fname[100];
         char *src;
+        char *endline;
         int result, dnld_size;
 
         if (!capable(CAP_SYS_ADMIN))
@@ -4009,6 +4010,10 @@ static ssize_t ipr_store_update_fw(struct device *dev,
 
         snprintf(fname, sizeof(fname), "%s", buf);
 
+        endline = strchr(fname, '\n');
+        if (endline)
+                *endline = '\0';
+
         if (request_firmware(&fw_entry, fname, &ioa_cfg->pdev->dev)) {
                 dev_err(&ioa_cfg->pdev->dev, "Firmware file %s not found\n", fname);
                 return -EIO;
diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
index 52a87657c7dd..692a7570b5e1 100644
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -2204,7 +2204,7 @@ qla2x00_init_rings(scsi_qla_host_t *vha)
         /* Clear outstanding commands array. */
         for (que = 0; que < ha->max_req_queues; que++) {
                 req = ha->req_q_map[que];
-                if (!req)
+                if (!req || !test_bit(que, ha->req_qid_map))
                         continue;
                 req->out_ptr = (void *)(req->ring + req->length);
                 *req->out_ptr = 0;
@@ -2221,7 +2221,7 @@ qla2x00_init_rings(scsi_qla_host_t *vha)
 
         for (que = 0; que < ha->max_rsp_queues; que++) {
                 rsp = ha->rsp_q_map[que];
-                if (!rsp)
+                if (!rsp || !test_bit(que, ha->rsp_qid_map))
                         continue;
                 rsp->in_ptr = (void *)(rsp->ring + rsp->length);
                 *rsp->in_ptr = 0;
@@ -4981,7 +4981,7 @@ qla25xx_init_queues(struct qla_hw_data *ha)
 
         for (i = 1; i < ha->max_rsp_queues; i++) {
                 rsp = ha->rsp_q_map[i];
-                if (rsp) {
+                if (rsp && test_bit(i, ha->rsp_qid_map)) {
                         rsp->options &= ~BIT_0;
                         ret = qla25xx_init_rsp_que(base_vha, rsp);
                         if (ret != QLA_SUCCESS)
@@ -4996,8 +4996,8 @@ qla25xx_init_queues(struct qla_hw_data *ha)
         }
         for (i = 1; i < ha->max_req_queues; i++) {
                 req = ha->req_q_map[i];
-                if (req) {
-                /* Clear outstanding commands array. */
+                if (req && test_bit(i, ha->req_qid_map)) {
+                        /* Clear outstanding commands array. */
                         req->options &= ~BIT_0;
                         ret = qla25xx_init_req_que(base_vha, req);
                         if (ret != QLA_SUCCESS)
diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
index d4d65eb0e9b4..4af95479a9db 100644
--- a/drivers/scsi/qla2xxx/qla_isr.c
+++ b/drivers/scsi/qla2xxx/qla_isr.c
@@ -3063,9 +3063,9 @@ qla24xx_enable_msix(struct qla_hw_data *ha, struct rsp_que *rsp)
                     "MSI-X: Failed to enable support "
                     "-- %d/%d\n Retry with %d vectors.\n",
                     ha->msix_count, ret, ret);
+                ha->msix_count = ret;
+                ha->max_rsp_queues = ha->msix_count - 1;
         }
-        ha->msix_count = ret;
-        ha->max_rsp_queues = ha->msix_count - 1;
         ha->msix_entries = kzalloc(sizeof(struct qla_msix_entry) *
                                 ha->msix_count, GFP_KERNEL);
         if (!ha->msix_entries) {
diff --git a/drivers/scsi/qla2xxx/qla_mid.c b/drivers/scsi/qla2xxx/qla_mid.c
index c5dd594f6c31..cf7ba52bae66 100644
--- a/drivers/scsi/qla2xxx/qla_mid.c
+++ b/drivers/scsi/qla2xxx/qla_mid.c
@@ -600,7 +600,7 @@ qla25xx_delete_queues(struct scsi_qla_host *vha)
         /* Delete request queues */
         for (cnt = 1; cnt < ha->max_req_queues; cnt++) {
                 req = ha->req_q_map[cnt];
-                if (req) {
+                if (req && test_bit(cnt, ha->req_qid_map)) {
                         ret = qla25xx_delete_req_que(vha, req);
                         if (ret != QLA_SUCCESS) {
                                 ql_log(ql_log_warn, vha, 0x00ea,
@@ -614,7 +614,7 @@ qla25xx_delete_queues(struct scsi_qla_host *vha)
         /* Delete response queues */
         for (cnt = 1; cnt < ha->max_rsp_queues; cnt++) {
                 rsp = ha->rsp_q_map[cnt];
-                if (rsp) {
+                if (rsp && test_bit(cnt, ha->rsp_qid_map)) {
                         ret = qla25xx_delete_rsp_que(vha, rsp);
                         if (ret != QLA_SUCCESS) {
                                 ql_log(ql_log_warn, vha, 0x00eb,
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index f1788db43195..f6c7ce35b542 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -409,6 +409,9 @@ static void qla2x00_free_queues(struct qla_hw_data *ha)
         int cnt;
 
         for (cnt = 0; cnt < ha->max_req_queues; cnt++) {
+                if (!test_bit(cnt, ha->req_qid_map))
+                        continue;
+
                 req = ha->req_q_map[cnt];
                 qla2x00_free_req_que(ha, req);
         }
@@ -416,6 +419,9 @@ static void qla2x00_free_queues(struct qla_hw_data *ha)
         ha->req_q_map = NULL;
 
         for (cnt = 0; cnt < ha->max_rsp_queues; cnt++) {
+                if (!test_bit(cnt, ha->rsp_qid_map))
+                        continue;
+
                 rsp = ha->rsp_q_map[cnt];
                 qla2x00_free_rsp_que(ha, rsp);
         }
diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
index 8075a4cdb45c..ee967becd257 100644
--- a/drivers/scsi/qla2xxx/qla_target.c
+++ b/drivers/scsi/qla2xxx/qla_target.c
@@ -105,7 +105,7 @@ static void qlt_response_pkt(struct scsi_qla_host *ha, response_t *pkt);
 static int qlt_issue_task_mgmt(struct qla_tgt_sess *sess, uint32_t lun,
         int fn, void *iocb, int flags);
 static void qlt_send_term_exchange(struct scsi_qla_host *ha, struct qla_tgt_cmd
-        *cmd, struct atio_from_isp *atio, int ha_locked);
+        *cmd, struct atio_from_isp *atio, int ha_locked, int ul_abort);
 static void qlt_reject_free_srr_imm(struct scsi_qla_host *ha,
         struct qla_tgt_srr_imm *imm, int ha_lock);
 static void qlt_abort_cmd_on_host_reset(struct scsi_qla_host *vha,
@@ -1756,7 +1756,7 @@ void qlt_xmit_tm_rsp(struct qla_tgt_mgmt_cmd *mcmd)
                 qlt_send_notify_ack(vha, &mcmd->orig_iocb.imm_ntfy,
                     0, 0, 0, 0, 0, 0);
         else {
-                if (mcmd->se_cmd.se_tmr_req->function == TMR_ABORT_TASK)
+                if (mcmd->orig_iocb.atio.u.raw.entry_type == ABTS_RECV_24XX)
                         qlt_24xx_send_abts_resp(vha, &mcmd->orig_iocb.abts,
                             mcmd->fc_tm_rsp, false);
                 else
@@ -2665,7 +2665,7 @@ int qlt_xmit_response(struct qla_tgt_cmd *cmd, int xmit_type,
                         /* no need to terminate. FW already freed exchange. */
                         qlt_abort_cmd_on_host_reset(cmd->vha, cmd);
                 else
-                        qlt_send_term_exchange(vha, cmd, &cmd->atio, 1);
+                        qlt_send_term_exchange(vha, cmd, &cmd->atio, 1, 0);
                 spin_unlock_irqrestore(&ha->hardware_lock, flags);
                 return 0;
         }
@@ -3173,7 +3173,8 @@ static int __qlt_send_term_exchange(struct scsi_qla_host *vha,
 }
 
 static void qlt_send_term_exchange(struct scsi_qla_host *vha,
-        struct qla_tgt_cmd *cmd, struct atio_from_isp *atio, int ha_locked)
+        struct qla_tgt_cmd *cmd, struct atio_from_isp *atio, int ha_locked,
+        int ul_abort)
 {
         unsigned long flags = 0;
         int rc;
@@ -3193,8 +3194,7 @@ static void qlt_send_term_exchange(struct scsi_qla_host *vha,
                 qlt_alloc_qfull_cmd(vha, atio, 0, 0);
 
 done:
-        if (cmd && (!cmd->aborted ||
-            !cmd->cmd_sent_to_fw)) {
+        if (cmd && !ul_abort && !cmd->aborted) {
                 if (cmd->sg_mapped)
                         qlt_unmap_sg(vha, cmd);
                 vha->hw->tgt.tgt_ops->free_cmd(cmd);
@@ -3253,21 +3253,38 @@ static void qlt_chk_exch_leak_thresh_hold(struct scsi_qla_host *vha)
 
 }
 
-void qlt_abort_cmd(struct qla_tgt_cmd *cmd)
+int qlt_abort_cmd(struct qla_tgt_cmd *cmd)
 {
         struct qla_tgt *tgt = cmd->tgt;
         struct scsi_qla_host *vha = tgt->vha;
         struct se_cmd *se_cmd = &cmd->se_cmd;
+        unsigned long flags;
 
         ql_dbg(ql_dbg_tgt_mgt, vha, 0xf014,
             "qla_target(%d): terminating exchange for aborted cmd=%p "
             "(se_cmd=%p, tag=%llu)", vha->vp_idx, cmd, &cmd->se_cmd,
             se_cmd->tag);
 
+        spin_lock_irqsave(&cmd->cmd_lock, flags);
+        if (cmd->aborted) {
+                spin_unlock_irqrestore(&cmd->cmd_lock, flags);
+                /*
+                 * It's normal to see 2 calls in this path:
+                 *  1) XFER Rdy completion + CMD_T_ABORT
+                 *  2) TCM TMR - drain_state_list
+                 */
+                ql_dbg(ql_dbg_tgt_mgt, vha, 0xffff,
+                        "multiple abort. %p transport_state %x, t_state %x,"
+                        " se_cmd_flags %x \n", cmd, cmd->se_cmd.transport_state,
+                        cmd->se_cmd.t_state,cmd->se_cmd.se_cmd_flags);
+                return EIO;
+        }
         cmd->aborted = 1;
         cmd->cmd_flags |= BIT_6;
+        spin_unlock_irqrestore(&cmd->cmd_lock, flags);
 
-        qlt_send_term_exchange(vha, cmd, &cmd->atio, 0);
+        qlt_send_term_exchange(vha, cmd, &cmd->atio, 0, 1);
+        return 0;
 }
 EXPORT_SYMBOL(qlt_abort_cmd);
 
@@ -3282,6 +3299,9 @@ void qlt_free_cmd(struct qla_tgt_cmd *cmd)
 
         BUG_ON(cmd->cmd_in_wq);
 
+        if (cmd->sg_mapped)
+                qlt_unmap_sg(cmd->vha, cmd);
+
         if (!cmd->q_full)
                 qlt_decr_num_pend_cmds(cmd->vha);
 
@@ -3399,7 +3419,7 @@ static int qlt_term_ctio_exchange(struct scsi_qla_host *vha, void *ctio,
                 term = 1;
 
         if (term)
-                qlt_send_term_exchange(vha, cmd, &cmd->atio, 1);
+                qlt_send_term_exchange(vha, cmd, &cmd->atio, 1, 0);
 
         return term;
 }
@@ -3580,12 +3600,13 @@ static void qlt_do_ctio_completion(struct scsi_qla_host *vha, uint32_t handle,
                 case CTIO_PORT_LOGGED_OUT:
                 case CTIO_PORT_UNAVAILABLE:
                 {
-                        int logged_out = (status & 0xFFFF);
+                        int logged_out =
+                                (status & 0xFFFF) == CTIO_PORT_LOGGED_OUT;
+
                         ql_dbg(ql_dbg_tgt_mgt, vha, 0xf059,
                             "qla_target(%d): CTIO with %s status %x "
                             "received (state %x, se_cmd %p)\n", vha->vp_idx,
-                            (logged_out == CTIO_PORT_LOGGED_OUT) ?
-                            "PORT LOGGED OUT" : "PORT UNAVAILABLE",
+                            logged_out ? "PORT LOGGED OUT" : "PORT UNAVAILABLE",
                             status, cmd->state, se_cmd);
 
                         if (logged_out && cmd->sess) {
@@ -3754,6 +3775,7 @@ static void __qlt_do_work(struct qla_tgt_cmd *cmd)
                 goto out_term;
         }
 
+        spin_lock_init(&cmd->cmd_lock);
         cdb = &atio->u.isp24.fcp_cmnd.cdb[0];
         cmd->se_cmd.tag = atio->u.isp24.exchange_addr;
         cmd->unpacked_lun = scsilun_to_int(
@@ -3796,7 +3818,7 @@ out_term:
          */
         cmd->cmd_flags |= BIT_2;
         spin_lock_irqsave(&ha->hardware_lock, flags);
-        qlt_send_term_exchange(vha, NULL, &cmd->atio, 1);
+        qlt_send_term_exchange(vha, NULL, &cmd->atio, 1, 0);
 
         qlt_decr_num_pend_cmds(vha);
         percpu_ida_free(&sess->se_sess->sess_tag_pool, cmd->se_cmd.map_tag);
@@ -3918,7 +3940,7 @@ static void qlt_create_sess_from_atio(struct work_struct *work)
 
 out_term:
         spin_lock_irqsave(&ha->hardware_lock, flags);
-        qlt_send_term_exchange(vha, NULL, &op->atio, 1);
+        qlt_send_term_exchange(vha, NULL, &op->atio, 1, 0);
         spin_unlock_irqrestore(&ha->hardware_lock, flags);
         kfree(op);
 
@@ -3982,7 +4004,8 @@ static int qlt_handle_cmd_for_atio(struct scsi_qla_host *vha,
 
         cmd->cmd_in_wq = 1;
         cmd->cmd_flags |= BIT_0;
-        cmd->se_cmd.cpuid = -1;
+        cmd->se_cmd.cpuid = ha->msix_count ?
+                ha->tgt.rspq_vector_cpuid : WORK_CPU_UNBOUND;
 
         spin_lock(&vha->cmd_list_lock);
         list_add_tail(&cmd->cmd_list, &vha->qla_cmd_list);
@@ -3990,7 +4013,6 @@ static int qlt_handle_cmd_for_atio(struct scsi_qla_host *vha,
 
         INIT_WORK(&cmd->work, qlt_do_work);
         if (ha->msix_count) {
-                cmd->se_cmd.cpuid = ha->tgt.rspq_vector_cpuid;
                 if (cmd->atio.u.isp24.fcp_cmnd.rddata)
                         queue_work_on(smp_processor_id(), qla_tgt_wq,
                             &cmd->work);
@@ -4771,7 +4793,7 @@ out_reject:
                 dump_stack();
         } else {
                 cmd->cmd_flags |= BIT_9;
-                qlt_send_term_exchange(vha, cmd, &cmd->atio, 1);
+                qlt_send_term_exchange(vha, cmd, &cmd->atio, 1, 0);
         }
         spin_unlock_irqrestore(&ha->hardware_lock, flags);
 }
@@ -4950,7 +4972,7 @@ static void qlt_prepare_srr_imm(struct scsi_qla_host *vha,
                                     sctio, sctio->srr_id);
                                 list_del(&sctio->srr_list_entry);
                                 qlt_send_term_exchange(vha, sctio->cmd,
-                                    &sctio->cmd->atio, 1);
+                                    &sctio->cmd->atio, 1, 0);
                                 kfree(sctio);
                         }
                 }
@@ -5123,7 +5145,7 @@ static int __qlt_send_busy(struct scsi_qla_host *vha,
             atio->u.isp24.fcp_hdr.s_id);
         spin_unlock_irqrestore(&ha->tgt.sess_lock, flags);
         if (!sess) {
-                qlt_send_term_exchange(vha, NULL, atio, 1);
+                qlt_send_term_exchange(vha, NULL, atio, 1, 0);
                 return 0;
         }
         /* Sending marker isn't necessary, since we called from ISR */
@@ -5406,7 +5428,7 @@ static void qlt_24xx_atio_pkt(struct scsi_qla_host *vha,
 #if 1 /* With TERM EXCHANGE some FC cards refuse to boot */
                                 qlt_send_busy(vha, atio, SAM_STAT_BUSY);
 #else
-                                qlt_send_term_exchange(vha, NULL, atio, 1);
+                                qlt_send_term_exchange(vha, NULL, atio, 1, 0);
 #endif
 
                                 if (!ha_locked)
@@ -5523,7 +5545,7 @@ static void qlt_response_pkt(struct scsi_qla_host *vha, response_t *pkt)
 #if 1 /* With TERM EXCHANGE some FC cards refuse to boot */
                                 qlt_send_busy(vha, atio, 0);
 #else
-                                qlt_send_term_exchange(vha, NULL, atio, 1);
+                                qlt_send_term_exchange(vha, NULL, atio, 1, 0);
 #endif
                         } else {
                                 if (tgt->tgt_stop) {
@@ -5532,7 +5554,7 @@ static void qlt_response_pkt(struct scsi_qla_host *vha, response_t *pkt)
                                             "command to target, sending TERM "
                                             "EXCHANGE for rsp\n");
                                         qlt_send_term_exchange(vha, NULL,
-                                            atio, 1);
+                                            atio, 1, 0);
                                 } else {
                                         ql_dbg(ql_dbg_tgt, vha, 0xe060,
                                             "qla_target(%d): Unable to send "
@@ -5960,7 +5982,7 @@ static void qlt_tmr_work(struct qla_tgt *tgt,
         return;
 
 out_term:
-        qlt_send_term_exchange(vha, NULL, &prm->tm_iocb2, 0);
+        qlt_send_term_exchange(vha, NULL, &prm->tm_iocb2, 1, 0);
         if (sess)
                 ha->tgt.tgt_ops->put_sess(sess);
         spin_unlock_irqrestore(&ha->tgt.sess_lock, flags);
diff --git a/drivers/scsi/qla2xxx/qla_target.h b/drivers/scsi/qla2xxx/qla_target.h
index 71b2865ba3c8..22a6a767fe07 100644
--- a/drivers/scsi/qla2xxx/qla_target.h
+++ b/drivers/scsi/qla2xxx/qla_target.h
@@ -943,6 +943,36 @@ struct qla_tgt_sess {
         qlt_plogi_ack_t *plogi_link[QLT_PLOGI_LINK_MAX];
 };
 
+typedef enum {
+        /*
+         * BIT_0 - Atio Arrival / schedule to work
+         * BIT_1 - qlt_do_work
+         * BIT_2 - qlt_do work failed
+         * BIT_3 - xfer rdy/tcm_qla2xxx_write_pending
+         * BIT_4 - read respond/tcm_qla2xx_queue_data_in
+         * BIT_5 - status respond / tcm_qla2xx_queue_status
+         * BIT_6 - tcm request to abort/Term exchange.
+         *      pre_xmit_response->qlt_send_term_exchange
+         * BIT_7 - SRR received (qlt_handle_srr->qlt_xmit_response)
+         * BIT_8 - SRR received (qlt_handle_srr->qlt_rdy_to_xfer)
+         * BIT_9 - SRR received (qla_handle_srr->qlt_send_term_exchange)
+         * BIT_10 - Data in - hanlde_data->tcm_qla2xxx_handle_data
+
+         * BIT_12 - good completion - qlt_ctio_do_completion -->free_cmd
+         * BIT_13 - Bad completion -
+         *      qlt_ctio_do_completion --> qlt_term_ctio_exchange
+         * BIT_14 - Back end data received/sent.
+         * BIT_15 - SRR prepare ctio
+         * BIT_16 - complete free
+         * BIT_17 - flush - qlt_abort_cmd_on_host_reset
+         * BIT_18 - completion w/abort status
+         * BIT_19 - completion w/unknown status
+         * BIT_20 - tcm_qla2xxx_free_cmd
+         */
+        CMD_FLAG_DATA_WORK = BIT_11,
+        CMD_FLAG_DATA_WORK_FREE = BIT_21,
+} cmd_flags_t;
+
 struct qla_tgt_cmd {
         struct se_cmd se_cmd;
         struct qla_tgt_sess *sess;
@@ -952,6 +982,7 @@ struct qla_tgt_cmd {
         /* Sense buffer that will be mapped into outgoing status */
         unsigned char sense_buffer[TRANSPORT_SENSE_BUFFER];
 
+        spinlock_t cmd_lock;
         /* to save extra sess dereferences */
         unsigned int conf_compl_supported:1;
         unsigned int sg_mapped:1;
@@ -986,30 +1017,8 @@ struct qla_tgt_cmd {
 
         uint64_t jiffies_at_alloc;
         uint64_t jiffies_at_free;
-        /* BIT_0 - Atio Arrival / schedule to work
-         * BIT_1 - qlt_do_work
-         * BIT_2 - qlt_do work failed
-         * BIT_3 - xfer rdy/tcm_qla2xxx_write_pending
-         * BIT_4 - read respond/tcm_qla2xx_queue_data_in
-         * BIT_5 - status respond / tcm_qla2xx_queue_status
-         * BIT_6 - tcm request to abort/Term exchange.
-         *      pre_xmit_response->qlt_send_term_exchange
-         * BIT_7 - SRR received (qlt_handle_srr->qlt_xmit_response)
-         * BIT_8 - SRR received (qlt_handle_srr->qlt_rdy_to_xfer)
-         * BIT_9 - SRR received (qla_handle_srr->qlt_send_term_exchange)
-         * BIT_10 - Data in - hanlde_data->tcm_qla2xxx_handle_data
-         * BIT_11 - Data actually going to TCM : tcm_qla2xx_handle_data_work
-         * BIT_12 - good completion - qlt_ctio_do_completion -->free_cmd
-         * BIT_13 - Bad completion -
-         *      qlt_ctio_do_completion --> qlt_term_ctio_exchange
-         * BIT_14 - Back end data received/sent.
-         * BIT_15 - SRR prepare ctio
-         * BIT_16 - complete free
-         * BIT_17 - flush - qlt_abort_cmd_on_host_reset
-         * BIT_18 - completion w/abort status
-         * BIT_19 - completion w/unknown status
-         */
-        uint32_t cmd_flags;
+
+        cmd_flags_t cmd_flags;
 };
 
 struct qla_tgt_sess_work_param {
@@ -1148,7 +1157,7 @@ static inline void sid_to_portid(const uint8_t *s_id, port_id_t *p)
 extern void qlt_response_pkt_all_vps(struct scsi_qla_host *, response_t *);
 extern int qlt_rdy_to_xfer(struct qla_tgt_cmd *);
 extern int qlt_xmit_response(struct qla_tgt_cmd *, int, uint8_t);
-extern void qlt_abort_cmd(struct qla_tgt_cmd *);
+extern int qlt_abort_cmd(struct qla_tgt_cmd *);
 extern void qlt_xmit_tm_rsp(struct qla_tgt_mgmt_cmd *);
 extern void qlt_free_mcmd(struct qla_tgt_mgmt_cmd *);
 extern void qlt_free_cmd(struct qla_tgt_cmd *cmd);
diff --git a/drivers/scsi/qla2xxx/qla_tmpl.c b/drivers/scsi/qla2xxx/qla_tmpl.c
index ddbe2e7ac14d..c3e622524604 100644
--- a/drivers/scsi/qla2xxx/qla_tmpl.c
+++ b/drivers/scsi/qla2xxx/qla_tmpl.c
@@ -395,6 +395,10 @@ qla27xx_fwdt_entry_t263(struct scsi_qla_host *vha,
         if (ent->t263.queue_type == T263_QUEUE_TYPE_REQ) {
                 for (i = 0; i < vha->hw->max_req_queues; i++) {
                         struct req_que *req = vha->hw->req_q_map[i];
+
+                        if (!test_bit(i, vha->hw->req_qid_map))
+                                continue;
+
                         if (req || !buf) {
                                 length = req ?
                                     req->length : REQUEST_ENTRY_CNT_24XX;
@@ -408,6 +412,10 @@ qla27xx_fwdt_entry_t263(struct scsi_qla_host *vha,
         } else if (ent->t263.queue_type == T263_QUEUE_TYPE_RSP) {
                 for (i = 0; i < vha->hw->max_rsp_queues; i++) {
                         struct rsp_que *rsp = vha->hw->rsp_q_map[i];
+
+                        if (!test_bit(i, vha->hw->rsp_qid_map))
+                                continue;
+
                         if (rsp || !buf) {
                                 length = rsp ?
                                     rsp->length : RESPONSE_ENTRY_CNT_MQ;
@@ -634,6 +642,10 @@ qla27xx_fwdt_entry_t274(struct scsi_qla_host *vha,
         if (ent->t274.queue_type == T274_QUEUE_TYPE_REQ_SHAD) {
                 for (i = 0; i < vha->hw->max_req_queues; i++) {
                         struct req_que *req = vha->hw->req_q_map[i];
+
+                        if (!test_bit(i, vha->hw->req_qid_map))
+                                continue;
+
                         if (req || !buf) {
                                 qla27xx_insert16(i, buf, len);
                                 qla27xx_insert16(1, buf, len);
@@ -645,6 +657,10 @@ qla27xx_fwdt_entry_t274(struct scsi_qla_host *vha,
         } else if (ent->t274.queue_type == T274_QUEUE_TYPE_RSP_SHAD) {
                 for (i = 0; i < vha->hw->max_rsp_queues; i++) {
                         struct rsp_que *rsp = vha->hw->rsp_q_map[i];
+
+                        if (!test_bit(i, vha->hw->rsp_qid_map))
+                                continue;
+
                         if (rsp || !buf) {
                                 qla27xx_insert16(i, buf, len);
                                 qla27xx_insert16(1, buf, len);
diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.c b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
index faf0a126627f..1808a01cfb7e 100644
--- a/drivers/scsi/qla2xxx/tcm_qla2xxx.c
+++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
@@ -298,6 +298,10 @@ static void tcm_qla2xxx_free_cmd(struct qla_tgt_cmd *cmd)
 {
         cmd->vha->tgt_counters.core_qla_free_cmd++;
         cmd->cmd_in_wq = 1;
+
+        BUG_ON(cmd->cmd_flags & BIT_20);
+        cmd->cmd_flags |= BIT_20;
+
         INIT_WORK(&cmd->work, tcm_qla2xxx_complete_free);
         queue_work_on(smp_processor_id(), tcm_qla2xxx_free_wq, &cmd->work);
 }
@@ -374,6 +378,20 @@ static int tcm_qla2xxx_write_pending(struct se_cmd *se_cmd)
 {
         struct qla_tgt_cmd *cmd = container_of(se_cmd,
                                 struct qla_tgt_cmd, se_cmd);
+
+        if (cmd->aborted) {
+                /* Cmd can loop during Q-full.  tcm_qla2xxx_aborted_task
+                 * can get ahead of this cmd. tcm_qla2xxx_aborted_task
+                 * already kick start the free.
+                 */
+                pr_debug("write_pending aborted cmd[%p] refcount %d "
+                        "transport_state %x, t_state %x, se_cmd_flags %x\n",
+                        cmd,cmd->se_cmd.cmd_kref.refcount.counter,
+                        cmd->se_cmd.transport_state,
+                        cmd->se_cmd.t_state,
+                        cmd->se_cmd.se_cmd_flags);
+                return 0;
+        }
         cmd->cmd_flags |= BIT_3;
         cmd->bufflen = se_cmd->data_length;
         cmd->dma_data_direction = target_reverse_dma_direction(se_cmd);
@@ -405,7 +423,7 @@ static int tcm_qla2xxx_write_pending_status(struct se_cmd *se_cmd)
             se_cmd->t_state == TRANSPORT_COMPLETE_QF_WP) {
                 spin_unlock_irqrestore(&se_cmd->t_state_lock, flags);
                 wait_for_completion_timeout(&se_cmd->t_transport_stop_comp,
-                                            3 * HZ);
+                                                50);
                 return 0;
         }
         spin_unlock_irqrestore(&se_cmd->t_state_lock, flags);
@@ -444,6 +462,9 @@ static int tcm_qla2xxx_handle_cmd(scsi_qla_host_t *vha, struct qla_tgt_cmd *cmd,
         if (bidi)
                 flags |= TARGET_SCF_BIDI_OP;
 
+        if (se_cmd->cpuid != WORK_CPU_UNBOUND)
+                flags |= TARGET_SCF_USE_CPUID;
+
         sess = cmd->sess;
         if (!sess) {
                 pr_err("Unable to locate struct qla_tgt_sess from qla_tgt_cmd\n");
@@ -465,13 +486,25 @@ static int tcm_qla2xxx_handle_cmd(scsi_qla_host_t *vha, struct qla_tgt_cmd *cmd,
 static void tcm_qla2xxx_handle_data_work(struct work_struct *work)
 {
         struct qla_tgt_cmd *cmd = container_of(work, struct qla_tgt_cmd, work);
+        unsigned long flags;
 
         /*
          * Ensure that the complete FCP WRITE payload has been received.
          * Otherwise return an exception via CHECK_CONDITION status.
          */
         cmd->cmd_in_wq = 0;
-        cmd->cmd_flags |= BIT_11;
+
+        spin_lock_irqsave(&cmd->cmd_lock, flags);
+        cmd->cmd_flags |= CMD_FLAG_DATA_WORK;
+        if (cmd->aborted) {
+                cmd->cmd_flags |= CMD_FLAG_DATA_WORK_FREE;
+                spin_unlock_irqrestore(&cmd->cmd_lock, flags);
+
+                tcm_qla2xxx_free_cmd(cmd);
+                return;
+        }
+        spin_unlock_irqrestore(&cmd->cmd_lock, flags);
+
         cmd->vha->tgt_counters.qla_core_ret_ctio++;
         if (!cmd->write_data_transferred) {
                 /*
@@ -546,6 +579,20 @@ static int tcm_qla2xxx_queue_data_in(struct se_cmd *se_cmd)
         struct qla_tgt_cmd *cmd = container_of(se_cmd,
                                 struct qla_tgt_cmd, se_cmd);
 
+        if (cmd->aborted) {
+                /* Cmd can loop during Q-full.  tcm_qla2xxx_aborted_task
+                 * can get ahead of this cmd. tcm_qla2xxx_aborted_task
+                 * already kick start the free.
+                 */
+                pr_debug("queue_data_in aborted cmd[%p] refcount %d "
+                        "transport_state %x, t_state %x, se_cmd_flags %x\n",
+                        cmd,cmd->se_cmd.cmd_kref.refcount.counter,
+                        cmd->se_cmd.transport_state,
+                        cmd->se_cmd.t_state,
+                        cmd->se_cmd.se_cmd_flags);
+                return 0;
+        }
+
         cmd->cmd_flags |= BIT_4;
         cmd->bufflen = se_cmd->data_length;
         cmd->dma_data_direction = target_reverse_dma_direction(se_cmd);
@@ -637,11 +684,34 @@ static void tcm_qla2xxx_queue_tm_rsp(struct se_cmd *se_cmd)
         qlt_xmit_tm_rsp(mcmd);
 }
 
+
+#define DATA_WORK_NOT_FREE(_flags) \
+        (( _flags & (CMD_FLAG_DATA_WORK|CMD_FLAG_DATA_WORK_FREE)) == \
+         CMD_FLAG_DATA_WORK)
 static void tcm_qla2xxx_aborted_task(struct se_cmd *se_cmd)
 {
         struct qla_tgt_cmd *cmd = container_of(se_cmd,
                                 struct qla_tgt_cmd, se_cmd);
-        qlt_abort_cmd(cmd);
+        unsigned long flags;
+
+        if (qlt_abort_cmd(cmd))
+                return;
+
+        spin_lock_irqsave(&cmd->cmd_lock, flags);
+        if ((cmd->state == QLA_TGT_STATE_NEW)||
+                ((cmd->state == QLA_TGT_STATE_DATA_IN) &&
+                 DATA_WORK_NOT_FREE(cmd->cmd_flags)) ) {
+
+                cmd->cmd_flags |= CMD_FLAG_DATA_WORK_FREE;
+                spin_unlock_irqrestore(&cmd->cmd_lock, flags);
+                /* Cmd have not reached firmware.
+                 * Use this trigger to free it. */
+                tcm_qla2xxx_free_cmd(cmd);
+                return;
+        }
+        spin_unlock_irqrestore(&cmd->cmd_lock, flags);
+        return;
+
 }
 
 static void tcm_qla2xxx_clear_sess_lookup(struct tcm_qla2xxx_lport *,
diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c
index 47b9d13f97b8..bbfbfd9e5aa3 100644
--- a/drivers/scsi/scsi_devinfo.c
+++ b/drivers/scsi/scsi_devinfo.c
@@ -205,6 +205,8 @@ static struct {
         {"Intel", "Multi-Flex", NULL, BLIST_NO_RSOC},
         {"iRiver", "iFP Mass Driver", NULL, BLIST_NOT_LOCKABLE | BLIST_INQUIRY_36},
         {"LASOUND", "CDX7405", "3.10", BLIST_MAX5LUN | BLIST_SINGLELUN},
+        {"Marvell", "Console", NULL, BLIST_SKIP_VPD_PAGES},
+        {"Marvell", "91xx Config", "1.01", BLIST_SKIP_VPD_PAGES},
         {"MATSHITA", "PD-1", NULL, BLIST_FORCELUN | BLIST_SINGLELUN},
         {"MATSHITA", "DMC-LC5", NULL, BLIST_NOT_LOCKABLE | BLIST_INQUIRY_36},
         {"MATSHITA", "DMC-LC40", NULL, BLIST_NOT_LOCKABLE | BLIST_INQUIRY_36},
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index fa6b2c4eb7a2..8c6e31874171 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -1344,6 +1344,7 @@ scsi_prep_return(struct request_queue *q, struct request *req, int ret)
 
         switch (ret) {
         case BLKPREP_KILL:
+        case BLKPREP_INVALID:
                 req->errors = DID_NO_CONNECT << 16;
                 /* release the command and kill it */
                 if (req->special) {
diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
index 4f18a851e2c7..00bc7218a7f8 100644
--- a/drivers/scsi/scsi_sysfs.c
+++ b/drivers/scsi/scsi_sysfs.c
@@ -1272,16 +1272,18 @@ static void __scsi_remove_target(struct scsi_target *starget)
 void scsi_remove_target(struct device *dev)
 {
         struct Scsi_Host *shost = dev_to_shost(dev->parent);
-        struct scsi_target *starget;
+        struct scsi_target *starget, *last_target = NULL;
         unsigned long flags;
 
 restart:
         spin_lock_irqsave(shost->host_lock, flags);
         list_for_each_entry(starget, &shost->__targets, siblings) {
-                if (starget->state == STARGET_DEL)
+                if (starget->state == STARGET_DEL ||
+                    starget == last_target)
                         continue;
                 if (starget->dev.parent == dev || &starget->dev == dev) {
                         kref_get(&starget->reap_ref);
+                        last_target = starget;
                         spin_unlock_irqrestore(shost->host_lock, flags);
                         __scsi_remove_target(starget);
                         scsi_target_reap(starget);
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index bb669d32ccd0..d749da765df1 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -761,7 +761,7 @@ static int sd_setup_discard_cmnd(struct scsi_cmnd *cmd)
                 break;
 
         default:
-                ret = BLKPREP_KILL;
+                ret = BLKPREP_INVALID;
                 goto out;
         }
 
@@ -839,7 +839,7 @@ static int sd_setup_write_same_cmnd(struct scsi_cmnd *cmd)
         int ret;
 
         if (sdkp->device->no_write_same)
-                return BLKPREP_KILL;
+                return BLKPREP_INVALID;
 
         BUG_ON(bio_offset(bio) || bio_iovec(bio).bv_len != sdp->sector_size);
 
diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c
index 55627d097873..292c04eec9ad 100644
--- a/drivers/scsi/storvsc_drv.c
+++ b/drivers/scsi/storvsc_drv.c
@@ -42,6 +42,7 @@
 #include <scsi/scsi_devinfo.h>
 #include <scsi/scsi_dbg.h>
 #include <scsi/scsi_transport_fc.h>
+#include <scsi/scsi_transport.h>
 
 /*
  * All wire protocol details (storage protocol between the guest and the host)
@@ -477,19 +478,18 @@ struct hv_host_device {
 struct storvsc_scan_work {
         struct work_struct work;
         struct Scsi_Host *host;
-        uint lun;
+        u8 lun;
+        u8 tgt_id;
 };
 
 static void storvsc_device_scan(struct work_struct *work)
 {
         struct storvsc_scan_work *wrk;
-        uint lun;
         struct scsi_device *sdev;
 
         wrk = container_of(work, struct storvsc_scan_work, work);
-        lun = wrk->lun;
 
-        sdev = scsi_device_lookup(wrk->host, 0, 0, lun);
+        sdev = scsi_device_lookup(wrk->host, 0, wrk->tgt_id, wrk->lun);
         if (!sdev)
                 goto done;
         scsi_rescan_device(&sdev->sdev_gendev);
@@ -540,7 +540,7 @@ static void storvsc_remove_lun(struct work_struct *work)
         if (!scsi_host_get(wrk->host))
                 goto done;
 
-        sdev = scsi_device_lookup(wrk->host, 0, 0, wrk->lun);
+        sdev = scsi_device_lookup(wrk->host, 0, wrk->tgt_id, wrk->lun);
 
         if (sdev) {
                 scsi_remove_device(sdev);
@@ -940,6 +940,7 @@ static void storvsc_handle_error(struct vmscsi_request *vm_srb,
 
         wrk->host = host;
         wrk->lun = vm_srb->lun;
+        wrk->tgt_id = vm_srb->target_id;
         INIT_WORK(&wrk->work, process_err_fn);
         schedule_work(&wrk->work);
 }
@@ -1770,6 +1771,11 @@ static int __init storvsc_drv_init(void)
         fc_transport_template = fc_attach_transport(&fc_transport_functions);
         if (!fc_transport_template)
                 return -ENODEV;
+
+        /*
+         * Install Hyper-V specific timeout handler.
+         */
+        fc_transport_template->eh_timed_out = storvsc_eh_timed_out;
 #endif
 
         ret = vmbus_driver_register(&storvsc_drv);
diff --git a/drivers/sh/pm_runtime.c b/drivers/sh/pm_runtime.c
index 91a003011acf..a9bac3bf20de 100644
--- a/drivers/sh/pm_runtime.c
+++ b/drivers/sh/pm_runtime.c
@@ -34,7 +34,7 @@ static struct pm_clk_notifier_block platform_bus_notifier = {
 
 static int __init sh_pm_runtime_init(void)
 {
-        if (IS_ENABLED(CONFIG_ARCH_SHMOBILE)) {
+        if (IS_ENABLED(CONFIG_OF) && IS_ENABLED(CONFIG_ARCH_SHMOBILE)) {
                 if (!of_find_compatible_node(NULL, NULL,
                                              "renesas,cpg-mstp-clocks"))
                         return 0;
diff --git a/drivers/spi/spi-atmel.c b/drivers/spi/spi-atmel.c
index aebad36391c9..8feac599e9ab 100644
--- a/drivers/spi/spi-atmel.c
+++ b/drivers/spi/spi-atmel.c
@@ -1571,6 +1571,7 @@ static int atmel_spi_probe(struct platform_device *pdev)
 
         as->use_cs_gpios = true;
         if (atmel_spi_is_v2(as) &&
+            pdev->dev.of_node &&
             !of_get_property(pdev->dev.of_node, "cs-gpios", NULL)) {
                 as->use_cs_gpios = false;
                 master->num_chipselect = 4;
diff --git a/drivers/spi/spi-bcm2835aux.c b/drivers/spi/spi-bcm2835aux.c
index 7de6f8472a81..ecc73c0a97cf 100644
--- a/drivers/spi/spi-bcm2835aux.c
+++ b/drivers/spi/spi-bcm2835aux.c
@@ -73,8 +73,8 @@
 
 /* Bitfields in CNTL1 */
 #define BCM2835_AUX_SPI_CNTL1_CSHIGH    0x00000700
-#define BCM2835_AUX_SPI_CNTL1_IDLE      0x00000080
-#define BCM2835_AUX_SPI_CNTL1_TXEMPTY   0x00000040
+#define BCM2835_AUX_SPI_CNTL1_TXEMPTY   0x00000080
+#define BCM2835_AUX_SPI_CNTL1_IDLE      0x00000040
 #define BCM2835_AUX_SPI_CNTL1_MSBF_IN   0x00000002
 #define BCM2835_AUX_SPI_CNTL1_KEEP_IN   0x00000001
 
diff --git a/drivers/spi/spi-fsl-espi.c b/drivers/spi/spi-fsl-espi.c
index 7fd6a4c009d2..7cb0c1921495 100644
--- a/drivers/spi/spi-fsl-espi.c
+++ b/drivers/spi/spi-fsl-espi.c
@@ -84,7 +84,7 @@ struct fsl_espi_transfer {
 /* SPCOM register values */
 #define SPCOM_CS(x)             ((x) << 30)
 #define SPCOM_TRANLEN(x)        ((x) << 0)
-#define SPCOM_TRANLEN_MAX       0xFFFF  /* Max transaction length */
+#define SPCOM_TRANLEN_MAX       0x10000 /* Max transaction length */
 
 #define AUTOSUSPEND_TIMEOUT 2000
 
@@ -233,7 +233,7 @@ static int fsl_espi_bufs(struct spi_device *spi, struct spi_transfer *t)
         reinit_completion(&mpc8xxx_spi->done);
 
         /* Set SPCOM[CS] and SPCOM[TRANLEN] field */
-        if ((t->len - 1) > SPCOM_TRANLEN_MAX) {
+        if (t->len > SPCOM_TRANLEN_MAX) {
                 dev_err(mpc8xxx_spi->dev, "Transaction length (%d)"
                                 " beyond the SPCOM[TRANLEN] field\n", t->len);
                 return -EINVAL;
diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c
index d98c33cb64f9..c688efa95e29 100644
--- a/drivers/spi/spi-imx.c
+++ b/drivers/spi/spi-imx.c
@@ -204,8 +204,8 @@ static bool spi_imx_can_dma(struct spi_master *master, struct spi_device *spi,
 {
         struct spi_imx_data *spi_imx = spi_master_get_devdata(master);
 
-        if (spi_imx->dma_is_inited &&
-            transfer->len > spi_imx->wml * sizeof(u32))
+        if (spi_imx->dma_is_inited && transfer->len >= spi_imx->wml &&
+            (transfer->len % spi_imx->wml) == 0)
                 return true;
         return false;
 }
@@ -919,8 +919,6 @@ static int spi_imx_dma_transfer(struct spi_imx_data *spi_imx,
         struct dma_async_tx_descriptor *desc_tx = NULL, *desc_rx = NULL;
         int ret;
         unsigned long timeout;
-        u32 dma;
-        int left;
         struct spi_master *master = spi_imx->bitbang.master;
         struct sg_table *tx = &transfer->tx_sg, *rx = &transfer->rx_sg;
 
@@ -929,7 +927,7 @@ static int spi_imx_dma_transfer(struct spi_imx_data *spi_imx,
                                         tx->sgl, tx->nents, DMA_MEM_TO_DEV,
                                         DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
                 if (!desc_tx)
-                        goto no_dma;
+                        goto tx_nodma;
 
                 desc_tx->callback = spi_imx_dma_tx_callback;
                 desc_tx->callback_param = (void *)spi_imx;
@@ -941,7 +939,7 @@ static int spi_imx_dma_transfer(struct spi_imx_data *spi_imx,
                                         rx->sgl, rx->nents, DMA_DEV_TO_MEM,
                                         DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
                 if (!desc_rx)
-                        goto no_dma;
+                        goto rx_nodma;
 
                 desc_rx->callback = spi_imx_dma_rx_callback;
                 desc_rx->callback_param = (void *)spi_imx;
@@ -954,13 +952,6 @@ static int spi_imx_dma_transfer(struct spi_imx_data *spi_imx,
         /* Trigger the cspi module. */
         spi_imx->dma_finished = 0;
 
-        dma = readl(spi_imx->base + MX51_ECSPI_DMA);
-        dma = dma & (~MX51_ECSPI_DMA_RXT_WML_MASK);
-        /* Change RX_DMA_LENGTH trigger dma fetch tail data */
-        left = transfer->len % spi_imx->wml;
-        if (left)
-                writel(dma | (left << MX51_ECSPI_DMA_RXT_WML_OFFSET),
-                                spi_imx->base + MX51_ECSPI_DMA);
         /*
          * Set these order to avoid potential RX overflow. The overflow may
          * happen if we enable SPI HW before starting RX DMA due to rescheduling
@@ -992,10 +983,6 @@ static int spi_imx_dma_transfer(struct spi_imx_data *spi_imx,
                         spi_imx->devtype_data->reset(spi_imx);
                         dmaengine_terminate_all(master->dma_rx);
                 }
-                dma &= ~MX51_ECSPI_DMA_RXT_WML_MASK;
-                writel(dma |
-                       spi_imx->wml << MX51_ECSPI_DMA_RXT_WML_OFFSET,
-                       spi_imx->base + MX51_ECSPI_DMA);
         }
 
         spi_imx->dma_finished = 1;
@@ -1008,7 +995,9 @@ static int spi_imx_dma_transfer(struct spi_imx_data *spi_imx,
 
         return ret;
 
-no_dma:
+rx_nodma:
+        dmaengine_terminate_all(master->dma_tx);
+tx_nodma:
         pr_warn_once("%s %s: DMA not available, falling back to PIO\n",
                      dev_driver_string(&master->dev),
                      dev_name(&master->dev));
diff --git a/drivers/spi/spi-loopback-test.c b/drivers/spi/spi-loopback-test.c
index 894616f687b0..cf4bb36bee25 100644
--- a/drivers/spi/spi-loopback-test.c
+++ b/drivers/spi/spi-loopback-test.c
@@ -761,6 +761,7 @@ static int spi_test_run_iter(struct spi_device *spi,
                 test.iterate_transfer_mask = 1;
 
         /* count number of transfers with tx/rx_buf != NULL */
+        rx_count = tx_count = 0;
         for (i = 0; i < test.transfer_count; i++) {
                 if (test.transfers[i].tx_buf)
                         tx_count++;
diff --git a/drivers/spi/spi-omap2-mcspi.c b/drivers/spi/spi-omap2-mcspi.c
index 7273820275e9..0caa3c8bef46 100644
--- a/drivers/spi/spi-omap2-mcspi.c
+++ b/drivers/spi/spi-omap2-mcspi.c
@@ -1490,6 +1490,8 @@ static int omap2_mcspi_probe(struct platform_device *pdev)
         return status;
 
 disable_pm:
+        pm_runtime_dont_use_autosuspend(&pdev->dev);
+        pm_runtime_put_sync(&pdev->dev);
         pm_runtime_disable(&pdev->dev);
 free_master:
         spi_master_put(master);
@@ -1501,6 +1503,7 @@ static int omap2_mcspi_remove(struct platform_device *pdev)
         struct spi_master *master = platform_get_drvdata(pdev);
         struct omap2_mcspi *mcspi = spi_master_get_devdata(master);
 
+        pm_runtime_dont_use_autosuspend(mcspi->dev);
         pm_runtime_put_sync(mcspi->dev);
         pm_runtime_disable(&pdev->dev);
 
diff --git a/drivers/spi/spi-rockchip.c b/drivers/spi/spi-rockchip.c
index 79a8bc4f6cec..7cb1b2d710c1 100644
--- a/drivers/spi/spi-rockchip.c
+++ b/drivers/spi/spi-rockchip.c
@@ -749,6 +749,7 @@ static int rockchip_spi_probe(struct platform_device *pdev)
         return 0;
 
 err_register_master:
+        pm_runtime_disable(&pdev->dev);
         if (rs->dma_tx.ch)
                 dma_release_channel(rs->dma_tx.ch);
         if (rs->dma_rx.ch)
@@ -778,6 +779,8 @@ static int rockchip_spi_remove(struct platform_device *pdev)
         if (rs->dma_rx.ch)
                 dma_release_channel(rs->dma_rx.ch);
 
+        spi_master_put(master);
+
         return 0;
 }
 
diff --git a/drivers/ssb/Kconfig b/drivers/ssb/Kconfig
index 0c675861623f..d8e4219c2324 100644
--- a/drivers/ssb/Kconfig
+++ b/drivers/ssb/Kconfig
@@ -83,6 +83,7 @@ config SSB_SDIOHOST
 config SSB_HOST_SOC
         bool "Support for SSB bus on SoC"
         depends on SSB && BCM47XX_NVRAM
+        select SSB_SPROM
         help
           Host interface for a SSB directly mapped into memory. This is
           for some Broadcom SoCs from the BCM47xx and BCM53xx lines.
diff --git a/drivers/target/target_core_configfs.c b/drivers/target/target_core_configfs.c
index 3327c49674d3..713c63d9681b 100644
--- a/drivers/target/target_core_configfs.c
+++ b/drivers/target/target_core_configfs.c
@@ -898,7 +898,7 @@ static ssize_t unmap_zeroes_data_store(struct config_item *item,
         da->unmap_zeroes_data = flag;
         pr_debug("dev[%p]: SE Device Thin Provisioning LBPRZ bit: %d\n",
                  da->da_dev, flag);
-        return 0;
+        return count;
 }
 
 /*
diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c
index cacd97a8cbd0..da457e25717a 100644
--- a/drivers/target/target_core_device.c
+++ b/drivers/target/target_core_device.c
@@ -828,6 +828,50 @@ struct se_device *target_alloc_device(struct se_hba *hba, const char *name)
         return dev;
 }
 
+/*
+ * Check if the underlying struct block_device request_queue supports
+ * the QUEUE_FLAG_DISCARD bit for UNMAP/WRITE_SAME in SCSI + TRIM
+ * in ATA and we need to set TPE=1
+ */
+bool target_configure_unmap_from_queue(struct se_dev_attrib *attrib,
+                                       struct request_queue *q, int block_size)
+{
+        if (!blk_queue_discard(q))
+                return false;
+
+        attrib->max_unmap_lba_count = (q->limits.max_discard_sectors << 9) /
+                                                                block_size;
+        /*
+         * Currently hardcoded to 1 in Linux/SCSI code..
+         */
+        attrib->max_unmap_block_desc_count = 1;
+        attrib->unmap_granularity = q->limits.discard_granularity / block_size;
+        attrib->unmap_granularity_alignment = q->limits.discard_alignment /
+                                                                block_size;
+        attrib->unmap_zeroes_data = q->limits.discard_zeroes_data;
+        return true;
+}
+EXPORT_SYMBOL(target_configure_unmap_from_queue);
+
+/*
+ * Convert from blocksize advertised to the initiator to the 512 byte
+ * units unconditionally used by the Linux block layer.
+ */
+sector_t target_to_linux_sector(struct se_device *dev, sector_t lb)
+{
+        switch (dev->dev_attrib.block_size) {
+        case 4096:
+                return lb << 3;
+        case 2048:
+                return lb << 2;
+        case 1024:
+                return lb << 1;
+        default:
+                return lb;
+        }
+}
+EXPORT_SYMBOL(target_to_linux_sector);
+
 int target_configure_device(struct se_device *dev)
 {
         struct se_hba *hba = dev->se_hba;
diff --git a/drivers/target/target_core_file.c b/drivers/target/target_core_file.c
index e3195700211a..75f0f08b2a34 100644
--- a/drivers/target/target_core_file.c
+++ b/drivers/target/target_core_file.c
@@ -160,25 +160,11 @@ static int fd_configure_device(struct se_device *dev)
                         " block_device blocks: %llu logical_block_size: %d\n",
                         dev_size, div_u64(dev_size, fd_dev->fd_block_size),
                         fd_dev->fd_block_size);
-                /*
-                 * Check if the underlying struct block_device request_queue supports
-                 * the QUEUE_FLAG_DISCARD bit for UNMAP/WRITE_SAME in SCSI + TRIM
-                 * in ATA and we need to set TPE=1
-                 */
-                if (blk_queue_discard(q)) {
-                        dev->dev_attrib.max_unmap_lba_count =
-                                q->limits.max_discard_sectors;
-                        /*
-                         * Currently hardcoded to 1 in Linux/SCSI code..
-                         */
-                        dev->dev_attrib.max_unmap_block_desc_count = 1;
-                        dev->dev_attrib.unmap_granularity =
-                                q->limits.discard_granularity >> 9;
-                        dev->dev_attrib.unmap_granularity_alignment =
-                                q->limits.discard_alignment;
+
+                if (target_configure_unmap_from_queue(&dev->dev_attrib, q,
+                                                      fd_dev->fd_block_size))
                         pr_debug("IFILE: BLOCK Discard support available,"
-                                        " disabled by default\n");
-                }
+                                 " disabled by default\n");
                 /*
                  * Enable write same emulation for IBLOCK and use 0xFFFF as
                  * the smaller WRITE_SAME(10) only has a two-byte block count.
@@ -490,9 +476,12 @@ fd_execute_unmap(struct se_cmd *cmd, sector_t lba, sector_t nolb)
         if (S_ISBLK(inode->i_mode)) {
                 /* The backend is block device, use discard */
                 struct block_device *bdev = inode->i_bdev;
+                struct se_device *dev = cmd->se_dev;
 
-                ret = blkdev_issue_discard(bdev, lba,
-                                nolb, GFP_KERNEL, 0);
+                ret = blkdev_issue_discard(bdev,
+                                           target_to_linux_sector(dev, lba),
+                                           target_to_linux_sector(dev,  nolb),
+                                           GFP_KERNEL, 0);
                 if (ret < 0) {
                         pr_warn("FILEIO: blkdev_issue_discard() failed: %d\n",
                                 ret);
diff --git a/drivers/target/target_core_iblock.c b/drivers/target/target_core_iblock.c
index 5a2899f9f50b..abe4eb997a84 100644
--- a/drivers/target/target_core_iblock.c
+++ b/drivers/target/target_core_iblock.c
@@ -121,29 +121,11 @@ static int iblock_configure_device(struct se_device *dev)
         dev->dev_attrib.hw_max_sectors = queue_max_hw_sectors(q);
         dev->dev_attrib.hw_queue_depth = q->nr_requests;
 
-        /*
-         * Check if the underlying struct block_device request_queue supports
-         * the QUEUE_FLAG_DISCARD bit for UNMAP/WRITE_SAME in SCSI + TRIM
-         * in ATA and we need to set TPE=1
-         */
-        if (blk_queue_discard(q)) {
-                dev->dev_attrib.max_unmap_lba_count =
-                                q->limits.max_discard_sectors;
-
-                /*
-                 * Currently hardcoded to 1 in Linux/SCSI code..
-                 */
-                dev->dev_attrib.max_unmap_block_desc_count = 1;
-                dev->dev_attrib.unmap_granularity =
-                                q->limits.discard_granularity >> 9;
-                dev->dev_attrib.unmap_granularity_alignment =
-                                q->limits.discard_alignment;
-                dev->dev_attrib.unmap_zeroes_data =
-                                q->limits.discard_zeroes_data;
-
+        if (target_configure_unmap_from_queue(&dev->dev_attrib, q,
+                                              dev->dev_attrib.hw_block_size))
                 pr_debug("IBLOCK: BLOCK Discard support available,"
-                                " disabled by default\n");
-        }
+                         " disabled by default\n");
+
         /*
          * Enable write same emulation for IBLOCK and use 0xFFFF as
          * the smaller WRITE_SAME(10) only has a two-byte block count.
@@ -415,9 +397,13 @@ static sense_reason_t
 iblock_execute_unmap(struct se_cmd *cmd, sector_t lba, sector_t nolb)
 {
         struct block_device *bdev = IBLOCK_DEV(cmd->se_dev)->ibd_bd;
+        struct se_device *dev = cmd->se_dev;
         int ret;
 
-        ret = blkdev_issue_discard(bdev, lba, nolb, GFP_KERNEL, 0);
+        ret = blkdev_issue_discard(bdev,
+                                   target_to_linux_sector(dev, lba),
+                                   target_to_linux_sector(dev,  nolb),
+                                   GFP_KERNEL, 0);
         if (ret < 0) {
                 pr_err("blkdev_issue_discard() failed: %d\n", ret);
                 return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
@@ -433,8 +419,10 @@ iblock_execute_write_same(struct se_cmd *cmd)
         struct scatterlist *sg;
         struct bio *bio;
         struct bio_list list;
-        sector_t block_lba = cmd->t_task_lba;
-        sector_t sectors = sbc_get_write_same_sectors(cmd);
+        struct se_device *dev = cmd->se_dev;
+        sector_t block_lba = target_to_linux_sector(dev, cmd->t_task_lba);
+        sector_t sectors = target_to_linux_sector(dev,
+                                        sbc_get_write_same_sectors(cmd));
 
         if (cmd->prot_op) {
                 pr_err("WRITE_SAME: Protection information with IBLOCK"
@@ -648,12 +636,12 @@ iblock_execute_rw(struct se_cmd *cmd, struct scatterlist *sgl, u32 sgl_nents,
                   enum dma_data_direction data_direction)
 {
         struct se_device *dev = cmd->se_dev;
+        sector_t block_lba = target_to_linux_sector(dev, cmd->t_task_lba);
         struct iblock_req *ibr;
         struct bio *bio, *bio_start;
         struct bio_list list;
         struct scatterlist *sg;
         u32 sg_num = sgl_nents;
-        sector_t block_lba;
         unsigned bio_cnt;
         int rw = 0;
         int i;
@@ -679,24 +667,6 @@ iblock_execute_rw(struct se_cmd *cmd, struct scatterlist *sgl, u32 sgl_nents,
                 rw = READ;
         }
 
-        /*
-         * Convert the blocksize advertised to the initiator to the 512 byte
-         * units unconditionally used by the Linux block layer.
-         */
-        if (dev->dev_attrib.block_size == 4096)
-                block_lba = (cmd->t_task_lba << 3);
-        else if (dev->dev_attrib.block_size == 2048)
-                block_lba = (cmd->t_task_lba << 2);
-        else if (dev->dev_attrib.block_size == 1024)
-                block_lba = (cmd->t_task_lba << 1);
-        else if (dev->dev_attrib.block_size == 512)
-                block_lba = cmd->t_task_lba;
-        else {
-                pr_err("Unsupported SCSI -> BLOCK LBA conversion:"
-                                " %u\n", dev->dev_attrib.block_size);
-                return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
-        }
-
         ibr = kzalloc(sizeof(struct iblock_req), GFP_KERNEL);
         if (!ibr)
                 goto fail;
diff --git a/drivers/target/target_core_internal.h b/drivers/target/target_core_internal.h
index dae0750c2032..db4412fe6b8a 100644
--- a/drivers/target/target_core_internal.h
+++ b/drivers/target/target_core_internal.h
@@ -141,7 +141,6 @@ void	transport_dump_vpd_proto_id(struct t10_vpd *, unsigned char *, int);
 int     transport_dump_vpd_assoc(struct t10_vpd *, unsigned char *, int);
 int     transport_dump_vpd_ident_type(struct t10_vpd *, unsigned char *, int);
 int     transport_dump_vpd_ident(struct t10_vpd *, unsigned char *, int);
-bool    target_stop_cmd(struct se_cmd *cmd, unsigned long *flags);
 void    transport_clear_lun_ref(struct se_lun *);
 void    transport_send_task_abort(struct se_cmd *);
 sense_reason_t  target_cmd_size_check(struct se_cmd *cmd, unsigned int size);
diff --git a/drivers/target/target_core_tmr.c b/drivers/target/target_core_tmr.c
index fcdcb117c60d..82a663ba9800 100644
--- a/drivers/target/target_core_tmr.c
+++ b/drivers/target/target_core_tmr.c
@@ -68,23 +68,25 @@ void core_tmr_release_req(struct se_tmr_req *tmr)
 
         if (dev) {
                 spin_lock_irqsave(&dev->se_tmr_lock, flags);
-                list_del(&tmr->tmr_list);
+                list_del_init(&tmr->tmr_list);
                 spin_unlock_irqrestore(&dev->se_tmr_lock, flags);
         }
 
         kfree(tmr);
 }
 
-static void core_tmr_handle_tas_abort(
-        struct se_node_acl *tmr_nacl,
-        struct se_cmd *cmd,
-        int tas)
+static void core_tmr_handle_tas_abort(struct se_cmd *cmd, int tas)
 {
-        bool remove = true;
+        unsigned long flags;
+        bool remove = true, send_tas;
         /*
          * TASK ABORTED status (TAS) bit support
          */
-        if ((tmr_nacl && (tmr_nacl != cmd->se_sess->se_node_acl)) && tas) {
+        spin_lock_irqsave(&cmd->t_state_lock, flags);
+        send_tas = (cmd->transport_state & CMD_T_TAS);
+        spin_unlock_irqrestore(&cmd->t_state_lock, flags);
+
+        if (send_tas) {
                 remove = false;
                 transport_send_task_abort(cmd);
         }
@@ -107,6 +109,46 @@ static int target_check_cdb_and_preempt(struct list_head *list,
         return 1;
 }
 
+static bool __target_check_io_state(struct se_cmd *se_cmd,
+                                    struct se_session *tmr_sess, int tas)
+{
+        struct se_session *sess = se_cmd->se_sess;
+
+        assert_spin_locked(&sess->sess_cmd_lock);
+        WARN_ON_ONCE(!irqs_disabled());
+        /*
+         * If command already reached CMD_T_COMPLETE state within
+         * target_complete_cmd() or CMD_T_FABRIC_STOP due to shutdown,
+         * this se_cmd has been passed to fabric driver and will
+         * not be aborted.
+         *
+         * Otherwise, obtain a local se_cmd->cmd_kref now for TMR
+         * ABORT_TASK + LUN_RESET for CMD_T_ABORTED processing as
+         * long as se_cmd->cmd_kref is still active unless zero.
+         */
+        spin_lock(&se_cmd->t_state_lock);
+        if (se_cmd->transport_state & (CMD_T_COMPLETE | CMD_T_FABRIC_STOP)) {
+                pr_debug("Attempted to abort io tag: %llu already complete or"
+                        " fabric stop, skipping\n", se_cmd->tag);
+                spin_unlock(&se_cmd->t_state_lock);
+                return false;
+        }
+        if (sess->sess_tearing_down || se_cmd->cmd_wait_set) {
+                pr_debug("Attempted to abort io tag: %llu already shutdown,"
+                        " skipping\n", se_cmd->tag);
+                spin_unlock(&se_cmd->t_state_lock);
+                return false;
+        }
+        se_cmd->transport_state |= CMD_T_ABORTED;
+
+        if ((tmr_sess != se_cmd->se_sess) && tas)
+                se_cmd->transport_state |= CMD_T_TAS;
+
+        spin_unlock(&se_cmd->t_state_lock);
+
+        return kref_get_unless_zero(&se_cmd->cmd_kref);
+}
+
 void core_tmr_abort_task(
         struct se_device *dev,
         struct se_tmr_req *tmr,
@@ -130,34 +172,22 @@ void core_tmr_abort_task(
                 if (tmr->ref_task_tag != ref_tag)
                         continue;
 
-                if (!kref_get_unless_zero(&se_cmd->cmd_kref))
-                        continue;
-
                 printk("ABORT_TASK: Found referenced %s task_tag: %llu\n",
                         se_cmd->se_tfo->get_fabric_name(), ref_tag);
 
-                spin_lock(&se_cmd->t_state_lock);
-                if (se_cmd->transport_state & CMD_T_COMPLETE) {
-                        printk("ABORT_TASK: ref_tag: %llu already complete,"
-                               " skipping\n", ref_tag);
-                        spin_unlock(&se_cmd->t_state_lock);
+                if (!__target_check_io_state(se_cmd, se_sess, 0)) {
                         spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags);
-
                         target_put_sess_cmd(se_cmd);
-
                         goto out;
                 }
-                se_cmd->transport_state |= CMD_T_ABORTED;
-                spin_unlock(&se_cmd->t_state_lock);
-
                 list_del_init(&se_cmd->se_cmd_list);
                 spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags);
 
                 cancel_work_sync(&se_cmd->work);
                 transport_wait_for_tasks(se_cmd);
 
-                target_put_sess_cmd(se_cmd);
                 transport_cmd_finish_abort(se_cmd, true);
+                target_put_sess_cmd(se_cmd);
 
                 printk("ABORT_TASK: Sending TMR_FUNCTION_COMPLETE for"
                                 " ref_tag: %llu\n", ref_tag);
@@ -178,9 +208,11 @@ static void core_tmr_drain_tmr_list(
         struct list_head *preempt_and_abort_list)
 {
         LIST_HEAD(drain_tmr_list);
+        struct se_session *sess;
         struct se_tmr_req *tmr_p, *tmr_pp;
         struct se_cmd *cmd;
         unsigned long flags;
+        bool rc;
         /*
          * Release all pending and outgoing TMRs aside from the received
          * LUN_RESET tmr..
@@ -206,17 +238,39 @@ static void core_tmr_drain_tmr_list(
                 if (target_check_cdb_and_preempt(preempt_and_abort_list, cmd))
                         continue;
 
+                sess = cmd->se_sess;
+                if (WARN_ON_ONCE(!sess))
+                        continue;
+
+                spin_lock(&sess->sess_cmd_lock);
                 spin_lock(&cmd->t_state_lock);
-                if (!(cmd->transport_state & CMD_T_ACTIVE)) {
+                if (!(cmd->transport_state & CMD_T_ACTIVE) ||
+                     (cmd->transport_state & CMD_T_FABRIC_STOP)) {
                         spin_unlock(&cmd->t_state_lock);
+                        spin_unlock(&sess->sess_cmd_lock);
                         continue;
                 }
                 if (cmd->t_state == TRANSPORT_ISTATE_PROCESSING) {
                         spin_unlock(&cmd->t_state_lock);
+                        spin_unlock(&sess->sess_cmd_lock);
                         continue;
                 }
+                if (sess->sess_tearing_down || cmd->cmd_wait_set) {
+                        spin_unlock(&cmd->t_state_lock);
+                        spin_unlock(&sess->sess_cmd_lock);
+                        continue;
+                }
+                cmd->transport_state |= CMD_T_ABORTED;
                 spin_unlock(&cmd->t_state_lock);
 
+                rc = kref_get_unless_zero(&cmd->cmd_kref);
+                if (!rc) {
+                        printk("LUN_RESET TMR: non-zero kref_get_unless_zero\n");
+                        spin_unlock(&sess->sess_cmd_lock);
+                        continue;
+                }
+                spin_unlock(&sess->sess_cmd_lock);
+
                 list_move_tail(&tmr_p->tmr_list, &drain_tmr_list);
         }
         spin_unlock_irqrestore(&dev->se_tmr_lock, flags);
@@ -230,20 +284,26 @@ static void core_tmr_drain_tmr_list(
                         (preempt_and_abort_list) ? "Preempt" : "", tmr_p,
                         tmr_p->function, tmr_p->response, cmd->t_state);
 
+                cancel_work_sync(&cmd->work);
+                transport_wait_for_tasks(cmd);
+
                 transport_cmd_finish_abort(cmd, 1);
+                target_put_sess_cmd(cmd);
         }
 }
 
 static void core_tmr_drain_state_list(
         struct se_device *dev,
         struct se_cmd *prout_cmd,
-        struct se_node_acl *tmr_nacl,
+        struct se_session *tmr_sess,
         int tas,
         struct list_head *preempt_and_abort_list)
 {
         LIST_HEAD(drain_task_list);
+        struct se_session *sess;
         struct se_cmd *cmd, *next;
         unsigned long flags;
+        int rc;
 
         /*
          * Complete outstanding commands with TASK_ABORTED SAM status.
@@ -282,6 +342,16 @@ static void core_tmr_drain_state_list(
                 if (prout_cmd == cmd)
                         continue;
 
+                sess = cmd->se_sess;
+                if (WARN_ON_ONCE(!sess))
+                        continue;
+
+                spin_lock(&sess->sess_cmd_lock);
+                rc = __target_check_io_state(cmd, tmr_sess, tas);
+                spin_unlock(&sess->sess_cmd_lock);
+                if (!rc)
+                        continue;
+
                 list_move_tail(&cmd->state_list, &drain_task_list);
                 cmd->state_active = false;
         }
@@ -289,7 +359,7 @@ static void core_tmr_drain_state_list(
 
         while (!list_empty(&drain_task_list)) {
                 cmd = list_entry(drain_task_list.next, struct se_cmd, state_list);
-                list_del(&cmd->state_list);
+                list_del_init(&cmd->state_list);
 
                 pr_debug("LUN_RESET: %s cmd: %p"
                         " ITT/CmdSN: 0x%08llx/0x%08x, i_state: %d, t_state: %d"
@@ -313,16 +383,11 @@ static void core_tmr_drain_state_list(
                  * loop above, but we do it down here given that
                  * cancel_work_sync may block.
                  */
-                if (cmd->t_state == TRANSPORT_COMPLETE)
-                        cancel_work_sync(&cmd->work);
-
-                spin_lock_irqsave(&cmd->t_state_lock, flags);
-                target_stop_cmd(cmd, &flags);
-
-                cmd->transport_state |= CMD_T_ABORTED;
-                spin_unlock_irqrestore(&cmd->t_state_lock, flags);
+                cancel_work_sync(&cmd->work);
+                transport_wait_for_tasks(cmd);
 
-                core_tmr_handle_tas_abort(tmr_nacl, cmd, tas);
+                core_tmr_handle_tas_abort(cmd, tas);
+                target_put_sess_cmd(cmd);
         }
 }
 
@@ -334,6 +399,7 @@ int core_tmr_lun_reset(
 {
         struct se_node_acl *tmr_nacl = NULL;
         struct se_portal_group *tmr_tpg = NULL;
+        struct se_session *tmr_sess = NULL;
         int tas;
         /*
          * TASK_ABORTED status bit, this is configurable via ConfigFS
@@ -352,8 +418,9 @@ int core_tmr_lun_reset(
          * or struct se_device passthrough..
          */
         if (tmr && tmr->task_cmd && tmr->task_cmd->se_sess) {
-                tmr_nacl = tmr->task_cmd->se_sess->se_node_acl;
-                tmr_tpg = tmr->task_cmd->se_sess->se_tpg;
+                tmr_sess = tmr->task_cmd->se_sess;
+                tmr_nacl = tmr_sess->se_node_acl;
+                tmr_tpg = tmr_sess->se_tpg;
                 if (tmr_nacl && tmr_tpg) {
                         pr_debug("LUN_RESET: TMR caller fabric: %s"
                                 " initiator port %s\n",
@@ -366,7 +433,7 @@ int core_tmr_lun_reset(
                 dev->transport->name, tas);
 
         core_tmr_drain_tmr_list(dev, tmr, preempt_and_abort_list);
-        core_tmr_drain_state_list(dev, prout_cmd, tmr_nacl, tas,
+        core_tmr_drain_state_list(dev, prout_cmd, tmr_sess, tas,
                                 preempt_and_abort_list);
 
         /*
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index 9f3608e10f25..867bc6d0a68a 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -534,9 +534,6 @@ void transport_deregister_session(struct se_session *se_sess)
 }
 EXPORT_SYMBOL(transport_deregister_session);
 
-/*
- * Called with cmd->t_state_lock held.
- */
 static void target_remove_from_state_list(struct se_cmd *cmd)
 {
         struct se_device *dev = cmd->se_dev;
@@ -561,10 +558,6 @@ static int transport_cmd_check_stop(struct se_cmd *cmd, bool remove_from_lists,
 {
         unsigned long flags;
 
-        spin_lock_irqsave(&cmd->t_state_lock, flags);
-        if (write_pending)
-                cmd->t_state = TRANSPORT_WRITE_PENDING;
-
         if (remove_from_lists) {
                 target_remove_from_state_list(cmd);
 
@@ -574,6 +567,10 @@ static int transport_cmd_check_stop(struct se_cmd *cmd, bool remove_from_lists,
                 cmd->se_lun = NULL;
         }
 
+        spin_lock_irqsave(&cmd->t_state_lock, flags);
+        if (write_pending)
+                cmd->t_state = TRANSPORT_WRITE_PENDING;
+
         /*
          * Determine if frontend context caller is requesting the stopping of
          * this command for frontend exceptions.
@@ -627,6 +624,8 @@ static void transport_lun_remove_cmd(struct se_cmd *cmd)
 
 void transport_cmd_finish_abort(struct se_cmd *cmd, int remove)
 {
+        bool ack_kref = (cmd->se_cmd_flags & SCF_ACK_KREF);
+
         if (cmd->se_cmd_flags & SCF_SE_LUN_CMD)
                 transport_lun_remove_cmd(cmd);
         /*
@@ -638,7 +637,7 @@ void transport_cmd_finish_abort(struct se_cmd *cmd, int remove)
 
         if (transport_cmd_check_stop_to_fabric(cmd))
                 return;
-        if (remove)
+        if (remove && ack_kref)
                 transport_put_cmd(cmd);
 }
 
@@ -694,19 +693,10 @@ void target_complete_cmd(struct se_cmd *cmd, u8 scsi_status)
         }
 
         /*
-         * See if we are waiting to complete for an exception condition.
-         */
-        if (cmd->transport_state & CMD_T_REQUEST_STOP) {
-                spin_unlock_irqrestore(&cmd->t_state_lock, flags);
-                complete(&cmd->task_stop_comp);
-                return;
-        }
-
-        /*
          * Check for case where an explicit ABORT_TASK has been received
          * and transport_wait_for_tasks() will be waiting for completion..
          */
-        if (cmd->transport_state & CMD_T_ABORTED &&
+        if (cmd->transport_state & CMD_T_ABORTED ||
             cmd->transport_state & CMD_T_STOP) {
                 spin_unlock_irqrestore(&cmd->t_state_lock, flags);
                 complete_all(&cmd->t_transport_stop_comp);
@@ -721,10 +711,10 @@ void target_complete_cmd(struct se_cmd *cmd, u8 scsi_status)
         cmd->transport_state |= (CMD_T_COMPLETE | CMD_T_ACTIVE);
         spin_unlock_irqrestore(&cmd->t_state_lock, flags);
 
-        if (cmd->cpuid == -1)
-                queue_work(target_completion_wq, &cmd->work);
-        else
+        if (cmd->se_cmd_flags & SCF_USE_CPUID)
                 queue_work_on(cmd->cpuid, target_completion_wq, &cmd->work);
+        else
+                queue_work(target_completion_wq, &cmd->work);
 }
 EXPORT_SYMBOL(target_complete_cmd);
 
@@ -1203,7 +1193,6 @@ void transport_init_se_cmd(
         INIT_LIST_HEAD(&cmd->state_list);
         init_completion(&cmd->t_transport_stop_comp);
         init_completion(&cmd->cmd_wait_comp);
-        init_completion(&cmd->task_stop_comp);
         spin_lock_init(&cmd->t_state_lock);
         kref_init(&cmd->cmd_kref);
         cmd->transport_state = CMD_T_DEV_ACTIVE;
@@ -1437,6 +1426,12 @@ int target_submit_cmd_map_sgls(struct se_cmd *se_cmd, struct se_session *se_sess
          */
         transport_init_se_cmd(se_cmd, se_tpg->se_tpg_tfo, se_sess,
                                 data_length, data_dir, task_attr, sense);
+
+        if (flags & TARGET_SCF_USE_CPUID)
+                se_cmd->se_cmd_flags |= SCF_USE_CPUID;
+        else
+                se_cmd->cpuid = WORK_CPU_UNBOUND;
+
         if (flags & TARGET_SCF_UNKNOWN_SIZE)
                 se_cmd->unknown_data_length = 1;
         /*
@@ -1635,33 +1630,6 @@ int target_submit_tmr(struct se_cmd *se_cmd, struct se_session *se_sess,
 EXPORT_SYMBOL(target_submit_tmr);
 
 /*
- * If the cmd is active, request it to be stopped and sleep until it
- * has completed.
- */
-bool target_stop_cmd(struct se_cmd *cmd, unsigned long *flags)
-        __releases(&cmd->t_state_lock)
-        __acquires(&cmd->t_state_lock)
-{
-        bool was_active = false;
-
-        if (cmd->transport_state & CMD_T_BUSY) {
-                cmd->transport_state |= CMD_T_REQUEST_STOP;
-                spin_unlock_irqrestore(&cmd->t_state_lock, *flags);
-
-                pr_debug("cmd %p waiting to complete\n", cmd);
-                wait_for_completion(&cmd->task_stop_comp);
-                pr_debug("cmd %p stopped successfully\n", cmd);
-
-                spin_lock_irqsave(&cmd->t_state_lock, *flags);
-                cmd->transport_state &= ~CMD_T_REQUEST_STOP;
-                cmd->transport_state &= ~CMD_T_BUSY;
-                was_active = true;
-        }
-
-        return was_active;
-}
-
-/*
  * Handle SAM-esque emulation for generic transport request failures.
  */
 void transport_generic_request_failure(struct se_cmd *cmd,
@@ -1859,19 +1827,21 @@ static bool target_handle_task_attr(struct se_cmd *cmd)
         return true;
 }
 
+static int __transport_check_aborted_status(struct se_cmd *, int);
+
 void target_execute_cmd(struct se_cmd *cmd)
 {
         /*
-         * If the received CDB has aleady been aborted stop processing it here.
-         */
-        if (transport_check_aborted_status(cmd, 1))
-                return;
-
-        /*
          * Determine if frontend context caller is requesting the stopping of
          * this command for frontend exceptions.
+         *
+         * If the received CDB has aleady been aborted stop processing it here.
          */
         spin_lock_irq(&cmd->t_state_lock);
+        if (__transport_check_aborted_status(cmd, 1)) {
+                spin_unlock_irq(&cmd->t_state_lock);
+                return;
+        }
         if (cmd->transport_state & CMD_T_STOP) {
                 pr_debug("%s:%d CMD_T_STOP for ITT: 0x%08llx\n",
                         __func__, __LINE__, cmd->tag);
@@ -2222,20 +2192,14 @@ static inline void transport_free_pages(struct se_cmd *cmd)
 }
 
 /**
- * transport_release_cmd - free a command
- * @cmd:       command to free
+ * transport_put_cmd - release a reference to a command
+ * @cmd:       command to release
  *
- * This routine unconditionally frees a command, and reference counting
- * or list removal must be done in the caller.
+ * This routine releases our reference to the command and frees it if possible.
  */
-static int transport_release_cmd(struct se_cmd *cmd)
+static int transport_put_cmd(struct se_cmd *cmd)
 {
         BUG_ON(!cmd->se_tfo);
-
-        if (cmd->se_cmd_flags & SCF_SCSI_TMR_CDB)
-                core_tmr_release_req(cmd->se_tmr_req);
-        if (cmd->t_task_cdb != cmd->__t_task_cdb)
-                kfree(cmd->t_task_cdb);
         /*
          * If this cmd has been setup with target_get_sess_cmd(), drop
          * the kref and call ->release_cmd() in kref callback.
@@ -2243,18 +2207,6 @@ static int transport_release_cmd(struct se_cmd *cmd)
         return target_put_sess_cmd(cmd);
 }
 
-/**
- * transport_put_cmd - release a reference to a command
- * @cmd:       command to release
- *
- * This routine releases our reference to the command and frees it if possible.
- */
-static int transport_put_cmd(struct se_cmd *cmd)
-{
-        transport_free_pages(cmd);
-        return transport_release_cmd(cmd);
-}
-
 void *transport_kmap_data_sg(struct se_cmd *cmd)
 {
         struct scatterlist *sg = cmd->t_data_sg;
@@ -2450,34 +2402,58 @@ static void transport_write_pending_qf(struct se_cmd *cmd)
         }
 }
 
-int transport_generic_free_cmd(struct se_cmd *cmd, int wait_for_tasks)
+static bool
+__transport_wait_for_tasks(struct se_cmd *, bool, bool *, bool *,
+                           unsigned long *flags);
+
+static void target_wait_free_cmd(struct se_cmd *cmd, bool *aborted, bool *tas)
 {
         unsigned long flags;
+
+        spin_lock_irqsave(&cmd->t_state_lock, flags);
+        __transport_wait_for_tasks(cmd, true, aborted, tas, &flags);
+        spin_unlock_irqrestore(&cmd->t_state_lock, flags);
+}
+
+int transport_generic_free_cmd(struct se_cmd *cmd, int wait_for_tasks)
+{
         int ret = 0;
+        bool aborted = false, tas = false;
 
         if (!(cmd->se_cmd_flags & SCF_SE_LUN_CMD)) {
                 if (wait_for_tasks && (cmd->se_cmd_flags & SCF_SCSI_TMR_CDB))
-                         transport_wait_for_tasks(cmd);
+                        target_wait_free_cmd(cmd, &aborted, &tas);
 
-                ret = transport_release_cmd(cmd);
+                if (!aborted || tas)
+                        ret = transport_put_cmd(cmd);
         } else {
                 if (wait_for_tasks)
-                        transport_wait_for_tasks(cmd);
+                        target_wait_free_cmd(cmd, &aborted, &tas);
                 /*
                  * Handle WRITE failure case where transport_generic_new_cmd()
                  * has already added se_cmd to state_list, but fabric has
                  * failed command before I/O submission.
                  */
-                if (cmd->state_active) {
-                        spin_lock_irqsave(&cmd->t_state_lock, flags);
+                if (cmd->state_active)
                         target_remove_from_state_list(cmd);
-                        spin_unlock_irqrestore(&cmd->t_state_lock, flags);
-                }
 
                 if (cmd->se_lun)
                         transport_lun_remove_cmd(cmd);
 
-                ret = transport_put_cmd(cmd);
+                if (!aborted || tas)
+                        ret = transport_put_cmd(cmd);
+        }
+        /*
+         * If the task has been internally aborted due to TMR ABORT_TASK
+         * or LUN_RESET, target_core_tmr.c is responsible for performing
+         * the remaining calls to target_put_sess_cmd(), and not the
+         * callers of this function.
+         */
+        if (aborted) {
+                pr_debug("Detected CMD_T_ABORTED for ITT: %llu\n", cmd->tag);
+                wait_for_completion(&cmd->cmd_wait_comp);
+                cmd->se_tfo->release_cmd(cmd);
+                ret = 1;
         }
         return ret;
 }
@@ -2517,26 +2493,46 @@ out:
 }
 EXPORT_SYMBOL(target_get_sess_cmd);
 
+static void target_free_cmd_mem(struct se_cmd *cmd)
+{
+        transport_free_pages(cmd);
+
+        if (cmd->se_cmd_flags & SCF_SCSI_TMR_CDB)
+                core_tmr_release_req(cmd->se_tmr_req);
+        if (cmd->t_task_cdb != cmd->__t_task_cdb)
+                kfree(cmd->t_task_cdb);
+}
+
 static void target_release_cmd_kref(struct kref *kref)
 {
         struct se_cmd *se_cmd = container_of(kref, struct se_cmd, cmd_kref);
         struct se_session *se_sess = se_cmd->se_sess;
         unsigned long flags;
+        bool fabric_stop;
 
         spin_lock_irqsave(&se_sess->sess_cmd_lock, flags);
         if (list_empty(&se_cmd->se_cmd_list)) {
                 spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags);
+                target_free_cmd_mem(se_cmd);
                 se_cmd->se_tfo->release_cmd(se_cmd);
                 return;
         }
-        if (se_sess->sess_tearing_down && se_cmd->cmd_wait_set) {
+
+        spin_lock(&se_cmd->t_state_lock);
+        fabric_stop = (se_cmd->transport_state & CMD_T_FABRIC_STOP);
+        spin_unlock(&se_cmd->t_state_lock);
+
+        if (se_cmd->cmd_wait_set || fabric_stop) {
+                list_del_init(&se_cmd->se_cmd_list);
                 spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags);
+                target_free_cmd_mem(se_cmd);
                 complete(&se_cmd->cmd_wait_comp);
                 return;
         }
-        list_del(&se_cmd->se_cmd_list);
+        list_del_init(&se_cmd->se_cmd_list);
         spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags);
 
+        target_free_cmd_mem(se_cmd);
         se_cmd->se_tfo->release_cmd(se_cmd);
 }
 
@@ -2548,6 +2544,7 @@ int target_put_sess_cmd(struct se_cmd *se_cmd)
         struct se_session *se_sess = se_cmd->se_sess;
 
         if (!se_sess) {
+                target_free_cmd_mem(se_cmd);
                 se_cmd->se_tfo->release_cmd(se_cmd);
                 return 1;
         }
@@ -2564,6 +2561,7 @@ void target_sess_cmd_list_set_waiting(struct se_session *se_sess)
 {
         struct se_cmd *se_cmd;
         unsigned long flags;
+        int rc;
 
         spin_lock_irqsave(&se_sess->sess_cmd_lock, flags);
         if (se_sess->sess_tearing_down) {
@@ -2573,8 +2571,15 @@ void target_sess_cmd_list_set_waiting(struct se_session *se_sess)
         se_sess->sess_tearing_down = 1;
         list_splice_init(&se_sess->sess_cmd_list, &se_sess->sess_wait_list);
 
-        list_for_each_entry(se_cmd, &se_sess->sess_wait_list, se_cmd_list)
-                se_cmd->cmd_wait_set = 1;
+        list_for_each_entry(se_cmd, &se_sess->sess_wait_list, se_cmd_list) {
+                rc = kref_get_unless_zero(&se_cmd->cmd_kref);
+                if (rc) {
+                        se_cmd->cmd_wait_set = 1;
+                        spin_lock(&se_cmd->t_state_lock);
+                        se_cmd->transport_state |= CMD_T_FABRIC_STOP;
+                        spin_unlock(&se_cmd->t_state_lock);
+                }
+        }
 
         spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags);
 }
@@ -2587,15 +2592,25 @@ void target_wait_for_sess_cmds(struct se_session *se_sess)
 {
         struct se_cmd *se_cmd, *tmp_cmd;
         unsigned long flags;
+        bool tas;
 
         list_for_each_entry_safe(se_cmd, tmp_cmd,
                                 &se_sess->sess_wait_list, se_cmd_list) {
-                list_del(&se_cmd->se_cmd_list);
+                list_del_init(&se_cmd->se_cmd_list);
 
                 pr_debug("Waiting for se_cmd: %p t_state: %d, fabric state:"
                         " %d\n", se_cmd, se_cmd->t_state,
                         se_cmd->se_tfo->get_cmd_state(se_cmd));
 
+                spin_lock_irqsave(&se_cmd->t_state_lock, flags);
+                tas = (se_cmd->transport_state & CMD_T_TAS);
+                spin_unlock_irqrestore(&se_cmd->t_state_lock, flags);
+
+                if (!target_put_sess_cmd(se_cmd)) {
+                        if (tas)
+                                target_put_sess_cmd(se_cmd);
+                }
+
                 wait_for_completion(&se_cmd->cmd_wait_comp);
                 pr_debug("After cmd_wait_comp: se_cmd: %p t_state: %d"
                         " fabric state: %d\n", se_cmd, se_cmd->t_state,
@@ -2617,53 +2632,75 @@ void transport_clear_lun_ref(struct se_lun *lun)
         wait_for_completion(&lun->lun_ref_comp);
 }
 
-/**
- * transport_wait_for_tasks - wait for completion to occur
- * @cmd:        command to wait
- *
- * Called from frontend fabric context to wait for storage engine
- * to pause and/or release frontend generated struct se_cmd.
- */
-bool transport_wait_for_tasks(struct se_cmd *cmd)
+static bool
+__transport_wait_for_tasks(struct se_cmd *cmd, bool fabric_stop,
+                           bool *aborted, bool *tas, unsigned long *flags)
+        __releases(&cmd->t_state_lock)
+        __acquires(&cmd->t_state_lock)
 {
-        unsigned long flags;
 
-        spin_lock_irqsave(&cmd->t_state_lock, flags);
+        assert_spin_locked(&cmd->t_state_lock);
+        WARN_ON_ONCE(!irqs_disabled());
+
+        if (fabric_stop)
+                cmd->transport_state |= CMD_T_FABRIC_STOP;
+
+        if (cmd->transport_state & CMD_T_ABORTED)
+                *aborted = true;
+
+        if (cmd->transport_state & CMD_T_TAS)
+                *tas = true;
+
         if (!(cmd->se_cmd_flags & SCF_SE_LUN_CMD) &&
-            !(cmd->se_cmd_flags & SCF_SCSI_TMR_CDB)) {
-                spin_unlock_irqrestore(&cmd->t_state_lock, flags);
+            !(cmd->se_cmd_flags & SCF_SCSI_TMR_CDB))
                 return false;
-        }
 
         if (!(cmd->se_cmd_flags & SCF_SUPPORTED_SAM_OPCODE) &&
-            !(cmd->se_cmd_flags & SCF_SCSI_TMR_CDB)) {
-                spin_unlock_irqrestore(&cmd->t_state_lock, flags);
+            !(cmd->se_cmd_flags & SCF_SCSI_TMR_CDB))
                 return false;
-        }
 
-        if (!(cmd->transport_state & CMD_T_ACTIVE)) {
-                spin_unlock_irqrestore(&cmd->t_state_lock, flags);
+        if (!(cmd->transport_state & CMD_T_ACTIVE))
+                return false;
+
+        if (fabric_stop && *aborted)
                 return false;
-        }
 
         cmd->transport_state |= CMD_T_STOP;
 
-        pr_debug("wait_for_tasks: Stopping %p ITT: 0x%08llx i_state: %d, t_state: %d, CMD_T_STOP\n",
-                cmd, cmd->tag, cmd->se_tfo->get_cmd_state(cmd), cmd->t_state);
+        pr_debug("wait_for_tasks: Stopping %p ITT: 0x%08llx i_state: %d,"
+                 " t_state: %d, CMD_T_STOP\n", cmd, cmd->tag,
+                 cmd->se_tfo->get_cmd_state(cmd), cmd->t_state);
 
-        spin_unlock_irqrestore(&cmd->t_state_lock, flags);
+        spin_unlock_irqrestore(&cmd->t_state_lock, *flags);
 
         wait_for_completion(&cmd->t_transport_stop_comp);
 
-        spin_lock_irqsave(&cmd->t_state_lock, flags);
+        spin_lock_irqsave(&cmd->t_state_lock, *flags);
         cmd->transport_state &= ~(CMD_T_ACTIVE | CMD_T_STOP);
 
-        pr_debug("wait_for_tasks: Stopped wait_for_completion(&cmd->t_transport_stop_comp) for ITT: 0x%08llx\n",
-                cmd->tag);
+        pr_debug("wait_for_tasks: Stopped wait_for_completion(&cmd->"
+                 "t_transport_stop_comp) for ITT: 0x%08llx\n", cmd->tag);
 
+        return true;
+}
+
+/**
+ * transport_wait_for_tasks - wait for completion to occur
+ * @cmd:        command to wait
+ *
+ * Called from frontend fabric context to wait for storage engine
+ * to pause and/or release frontend generated struct se_cmd.
+ */
+bool transport_wait_for_tasks(struct se_cmd *cmd)
+{
+        unsigned long flags;
+        bool ret, aborted = false, tas = false;
+
+        spin_lock_irqsave(&cmd->t_state_lock, flags);
+        ret = __transport_wait_for_tasks(cmd, false, &aborted, &tas, &flags);
         spin_unlock_irqrestore(&cmd->t_state_lock, flags);
 
-        return true;
+        return ret;
 }
 EXPORT_SYMBOL(transport_wait_for_tasks);
 
@@ -2845,28 +2882,49 @@ transport_send_check_condition_and_sense(struct se_cmd *cmd,
 }
 EXPORT_SYMBOL(transport_send_check_condition_and_sense);
 
-int transport_check_aborted_status(struct se_cmd *cmd, int send_status)
+static int __transport_check_aborted_status(struct se_cmd *cmd, int send_status)
+        __releases(&cmd->t_state_lock)
+        __acquires(&cmd->t_state_lock)
 {
+        assert_spin_locked(&cmd->t_state_lock);
+        WARN_ON_ONCE(!irqs_disabled());
+
         if (!(cmd->transport_state & CMD_T_ABORTED))
                 return 0;
-
         /*
          * If cmd has been aborted but either no status is to be sent or it has
          * already been sent, just return
          */
-        if (!send_status || !(cmd->se_cmd_flags & SCF_SEND_DELAYED_TAS))
+        if (!send_status || !(cmd->se_cmd_flags & SCF_SEND_DELAYED_TAS)) {
+                if (send_status)
+                        cmd->se_cmd_flags |= SCF_SEND_DELAYED_TAS;
                 return 1;
+        }
 
-        pr_debug("Sending delayed SAM_STAT_TASK_ABORTED status for CDB: 0x%02x ITT: 0x%08llx\n",
-                 cmd->t_task_cdb[0], cmd->tag);
+        pr_debug("Sending delayed SAM_STAT_TASK_ABORTED status for CDB:"
+                " 0x%02x ITT: 0x%08llx\n", cmd->t_task_cdb[0], cmd->tag);
 
         cmd->se_cmd_flags &= ~SCF_SEND_DELAYED_TAS;
         cmd->scsi_status = SAM_STAT_TASK_ABORTED;
         trace_target_cmd_complete(cmd);
+
+        spin_unlock_irq(&cmd->t_state_lock);
         cmd->se_tfo->queue_status(cmd);
+        spin_lock_irq(&cmd->t_state_lock);
 
         return 1;
 }
+
+int transport_check_aborted_status(struct se_cmd *cmd, int send_status)
+{
+        int ret;
+
+        spin_lock_irq(&cmd->t_state_lock);
+        ret = __transport_check_aborted_status(cmd, send_status);
+        spin_unlock_irq(&cmd->t_state_lock);
+
+        return ret;
+}
 EXPORT_SYMBOL(transport_check_aborted_status);
 
 void transport_send_task_abort(struct se_cmd *cmd)
@@ -2888,11 +2946,17 @@ void transport_send_task_abort(struct se_cmd *cmd)
          */
         if (cmd->data_direction == DMA_TO_DEVICE) {
                 if (cmd->se_tfo->write_pending_status(cmd) != 0) {
-                        cmd->transport_state |= CMD_T_ABORTED;
+                        spin_lock_irqsave(&cmd->t_state_lock, flags);
+                        if (cmd->se_cmd_flags & SCF_SEND_DELAYED_TAS) {
+                                spin_unlock_irqrestore(&cmd->t_state_lock, flags);
+                                goto send_abort;
+                        }
                         cmd->se_cmd_flags |= SCF_SEND_DELAYED_TAS;
+                        spin_unlock_irqrestore(&cmd->t_state_lock, flags);
                         return;
                 }
         }
+send_abort:
         cmd->scsi_status = SAM_STAT_TASK_ABORTED;
 
         transport_lun_remove_cmd(cmd);
@@ -2909,8 +2973,17 @@ static void target_tmr_work(struct work_struct *work)
         struct se_cmd *cmd = container_of(work, struct se_cmd, work);
         struct se_device *dev = cmd->se_dev;
         struct se_tmr_req *tmr = cmd->se_tmr_req;
+        unsigned long flags;
         int ret;
 
+        spin_lock_irqsave(&cmd->t_state_lock, flags);
+        if (cmd->transport_state & CMD_T_ABORTED) {
+                tmr->response = TMR_FUNCTION_REJECTED;
+                spin_unlock_irqrestore(&cmd->t_state_lock, flags);
+                goto check_stop;
+        }
+        spin_unlock_irqrestore(&cmd->t_state_lock, flags);
+
         switch (tmr->function) {
         case TMR_ABORT_TASK:
                 core_tmr_abort_task(dev, tmr, cmd->se_sess);
@@ -2943,9 +3016,17 @@ static void target_tmr_work(struct work_struct *work)
                 break;
         }
 
+        spin_lock_irqsave(&cmd->t_state_lock, flags);
+        if (cmd->transport_state & CMD_T_ABORTED) {
+                spin_unlock_irqrestore(&cmd->t_state_lock, flags);
+                goto check_stop;
+        }
         cmd->t_state = TRANSPORT_ISTATE_PROCESSING;
+        spin_unlock_irqrestore(&cmd->t_state_lock, flags);
+
         cmd->se_tfo->queue_tm_rsp(cmd);
 
+check_stop:
         transport_cmd_check_stop_to_fabric(cmd);
 }
 
diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c
index dd600e5ead71..94f5154ac788 100644
--- a/drivers/target/target_core_user.c
+++ b/drivers/target/target_core_user.c
@@ -903,7 +903,7 @@ static int tcmu_configure_device(struct se_device *dev)
         info->version = __stringify(TCMU_MAILBOX_VERSION);
 
         info->mem[0].name = "tcm-user command & data buffer";
-        info->mem[0].addr = (phys_addr_t) udev->mb_addr;
+        info->mem[0].addr = (phys_addr_t)(uintptr_t)udev->mb_addr;
         info->mem[0].size = TCMU_RING_SIZE;
         info->mem[0].memtype = UIO_MEM_VIRTUAL;
 
diff --git a/drivers/thermal/Kconfig b/drivers/thermal/Kconfig
index 8cc4ac64a91c..7c92c09be213 100644
--- a/drivers/thermal/Kconfig
+++ b/drivers/thermal/Kconfig
@@ -195,7 +195,7 @@ config IMX_THERMAL
           passive trip is crossed.
 
 config SPEAR_THERMAL
-        bool "SPEAr thermal sensor driver"
+        tristate "SPEAr thermal sensor driver"
         depends on PLAT_SPEAR || COMPILE_TEST
         depends on OF
         help
@@ -237,8 +237,8 @@ config DOVE_THERMAL
           framework.
 
 config DB8500_THERMAL
-        bool "DB8500 thermal management"
-        depends on ARCH_U8500
+        tristate "DB8500 thermal management"
+        depends on MFD_DB8500_PRCMU
         default y
         help
           Adds DB8500 thermal management implementation according to the thermal
diff --git a/drivers/thermal/cpu_cooling.c b/drivers/thermal/cpu_cooling.c
index e3fbc5a5d88f..6ceac4f2d4b2 100644
--- a/drivers/thermal/cpu_cooling.c
+++ b/drivers/thermal/cpu_cooling.c
@@ -377,26 +377,28 @@ static u32 cpu_power_to_freq(struct cpufreq_cooling_device *cpufreq_device,
  * get_load() - get load for a cpu since last updated
  * @cpufreq_device:     &struct cpufreq_cooling_device for this cpu
  * @cpu:        cpu number
+ * @cpu_idx:    index of the cpu in cpufreq_device->allowed_cpus
  *
  * Return: The average load of cpu @cpu in percentage since this
  * function was last called.
  */
-static u32 get_load(struct cpufreq_cooling_device *cpufreq_device, int cpu)
+static u32 get_load(struct cpufreq_cooling_device *cpufreq_device, int cpu,
+                    int cpu_idx)
 {
         u32 load;
         u64 now, now_idle, delta_time, delta_idle;
 
         now_idle = get_cpu_idle_time(cpu, &now, 0);
-        delta_idle = now_idle - cpufreq_device->time_in_idle[cpu];
-        delta_time = now - cpufreq_device->time_in_idle_timestamp[cpu];
+        delta_idle = now_idle - cpufreq_device->time_in_idle[cpu_idx];
+        delta_time = now - cpufreq_device->time_in_idle_timestamp[cpu_idx];
 
         if (delta_time <= delta_idle)
                 load = 0;
         else
                 load = div64_u64(100 * (delta_time - delta_idle), delta_time);
 
-        cpufreq_device->time_in_idle[cpu] = now_idle;
-        cpufreq_device->time_in_idle_timestamp[cpu] = now;
+        cpufreq_device->time_in_idle[cpu_idx] = now_idle;
+        cpufreq_device->time_in_idle_timestamp[cpu_idx] = now;
 
         return load;
 }
@@ -598,7 +600,7 @@ static int cpufreq_get_requested_power(struct thermal_cooling_device *cdev,
                 u32 load;
 
                 if (cpu_online(cpu))
-                        load = get_load(cpufreq_device, cpu);
+                        load = get_load(cpufreq_device, cpu, i);
                 else
                         load = 0;
 
diff --git a/drivers/thermal/of-thermal.c b/drivers/thermal/of-thermal.c
index be4eedcb839a..9043f8f91852 100644
--- a/drivers/thermal/of-thermal.c
+++ b/drivers/thermal/of-thermal.c
@@ -475,14 +475,10 @@ thermal_zone_of_sensor_register(struct device *dev, int sensor_id, void *data,
 
         sensor_np = of_node_get(dev->of_node);
 
-        for_each_child_of_node(np, child) {
+        for_each_available_child_of_node(np, child) {
                 struct of_phandle_args sensor_specs;
                 int ret, id;
 
-                /* Check whether child is enabled or not */
-                if (!of_device_is_available(child))
-                        continue;
-
                 /* For now, thermal framework supports only 1 sensor per zone */
                 ret = of_parse_phandle_with_args(child, "thermal-sensors",
                                                  "#thermal-sensor-cells",
@@ -881,16 +877,12 @@ int __init of_parse_thermal_zones(void)
                 return 0; /* Run successfully on systems without thermal DT */
         }
 
-        for_each_child_of_node(np, child) {
+        for_each_available_child_of_node(np, child) {
                 struct thermal_zone_device *zone;
                 struct thermal_zone_params *tzp;
                 int i, mask = 0;
                 u32 prop;
 
-                /* Check whether child is enabled or not */
-                if (!of_device_is_available(child))
-                        continue;
-
                 tz = thermal_of_build_thermal_zone(child);
                 if (IS_ERR(tz)) {
                         pr_err("failed to build thermal zone %s: %ld\n",
@@ -968,13 +960,9 @@ void of_thermal_destroy_zones(void)
                 return;
         }
 
-        for_each_child_of_node(np, child) {
+        for_each_available_child_of_node(np, child) {
                 struct thermal_zone_device *zone;
 
-                /* Check whether child is enabled or not */
-                if (!of_device_is_available(child))
-                        continue;
-
                 zone = thermal_zone_get_zone_by_name(child->name);
                 if (IS_ERR(zone))
                         continue;
diff --git a/drivers/thermal/rcar_thermal.c b/drivers/thermal/rcar_thermal.c
index 44b9c485157d..0e735acea33a 100644
--- a/drivers/thermal/rcar_thermal.c
+++ b/drivers/thermal/rcar_thermal.c
@@ -23,6 +23,7 @@
 #include <linux/interrupt.h>
 #include <linux/io.h>
 #include <linux/module.h>
+#include <linux/of_device.h>
 #include <linux/platform_device.h>
 #include <linux/pm_runtime.h>
 #include <linux/reboot.h>
@@ -75,8 +76,10 @@ struct rcar_thermal_priv {
 #define rcar_has_irq_support(priv)      ((priv)->common->base)
 #define rcar_id_to_shift(priv)          ((priv)->id * 8)
 
+#define USE_OF_THERMAL  1
 static const struct of_device_id rcar_thermal_dt_ids[] = {
         { .compatible = "renesas,rcar-thermal", },
+        { .compatible = "renesas,rcar-gen2-thermal", .data = (void *)USE_OF_THERMAL },
         {},
 };
 MODULE_DEVICE_TABLE(of, rcar_thermal_dt_ids);
@@ -200,9 +203,9 @@ err_out_unlock:
         return ret;
 }
 
-static int rcar_thermal_get_temp(struct thermal_zone_device *zone, int *temp)
+static int rcar_thermal_get_current_temp(struct rcar_thermal_priv *priv,
+                                         int *temp)
 {
-        struct rcar_thermal_priv *priv = rcar_zone_to_priv(zone);
         int tmp;
         int ret;
 
@@ -226,6 +229,20 @@ static int rcar_thermal_get_temp(struct thermal_zone_device *zone, int *temp)
         return 0;
 }
 
+static int rcar_thermal_of_get_temp(void *data, int *temp)
+{
+        struct rcar_thermal_priv *priv = data;
+
+        return rcar_thermal_get_current_temp(priv, temp);
+}
+
+static int rcar_thermal_get_temp(struct thermal_zone_device *zone, int *temp)
+{
+        struct rcar_thermal_priv *priv = rcar_zone_to_priv(zone);
+
+        return rcar_thermal_get_current_temp(priv, temp);
+}
+
 static int rcar_thermal_get_trip_type(struct thermal_zone_device *zone,
                                       int trip, enum thermal_trip_type *type)
 {
@@ -282,6 +299,10 @@ static int rcar_thermal_notify(struct thermal_zone_device *zone,
         return 0;
 }
 
+static const struct thermal_zone_of_device_ops rcar_thermal_zone_of_ops = {
+        .get_temp       = rcar_thermal_of_get_temp,
+};
+
 static struct thermal_zone_device_ops rcar_thermal_zone_ops = {
         .get_temp       = rcar_thermal_get_temp,
         .get_trip_type  = rcar_thermal_get_trip_type,
@@ -318,14 +339,20 @@ static void rcar_thermal_work(struct work_struct *work)
 
         priv = container_of(work, struct rcar_thermal_priv, work.work);
 
-        rcar_thermal_get_temp(priv->zone, &cctemp);
+        ret = rcar_thermal_get_current_temp(priv, &cctemp);
+        if (ret < 0)
+                return;
+
         ret = rcar_thermal_update_temp(priv);
         if (ret < 0)
                 return;
 
         rcar_thermal_irq_enable(priv);
 
-        rcar_thermal_get_temp(priv->zone, &nctemp);
+        ret = rcar_thermal_get_current_temp(priv, &nctemp);
+        if (ret < 0)
+                return;
+
         if (nctemp != cctemp)
                 thermal_zone_device_update(priv->zone);
 }
@@ -403,6 +430,8 @@ static int rcar_thermal_probe(struct platform_device *pdev)
         struct rcar_thermal_priv *priv;
         struct device *dev = &pdev->dev;
         struct resource *res, *irq;
+        const struct of_device_id *of_id = of_match_device(rcar_thermal_dt_ids, dev);
+        unsigned long of_data = (unsigned long)of_id->data;
         int mres = 0;
         int i;
         int ret = -ENODEV;
@@ -463,7 +492,13 @@ static int rcar_thermal_probe(struct platform_device *pdev)
                 if (ret < 0)
                         goto error_unregister;
 
-                priv->zone = thermal_zone_device_register("rcar_thermal",
+                if (of_data == USE_OF_THERMAL)
+                        priv->zone = thermal_zone_of_sensor_register(
+                                                dev, i, priv,
+                                                &rcar_thermal_zone_of_ops);
+                else
+                        priv->zone = thermal_zone_device_register(
+                                                "rcar_thermal",
                                                 1, 0, priv,
                                                 &rcar_thermal_zone_ops, NULL, 0,
                                                 idle);
diff --git a/drivers/thermal/spear_thermal.c b/drivers/thermal/spear_thermal.c
index 534dd9136662..81b35aace9de 100644
--- a/drivers/thermal/spear_thermal.c
+++ b/drivers/thermal/spear_thermal.c
@@ -54,8 +54,7 @@ static struct thermal_zone_device_ops ops = {
         .get_temp = thermal_get_temp,
 };
 
-#ifdef CONFIG_PM
-static int spear_thermal_suspend(struct device *dev)
+static int __maybe_unused spear_thermal_suspend(struct device *dev)
 {
         struct platform_device *pdev = to_platform_device(dev);
         struct thermal_zone_device *spear_thermal = platform_get_drvdata(pdev);
@@ -72,7 +71,7 @@ static int spear_thermal_suspend(struct device *dev)
         return 0;
 }
 
-static int spear_thermal_resume(struct device *dev)
+static int __maybe_unused spear_thermal_resume(struct device *dev)
 {
         struct platform_device *pdev = to_platform_device(dev);
         struct thermal_zone_device *spear_thermal = platform_get_drvdata(pdev);
@@ -94,7 +93,6 @@ static int spear_thermal_resume(struct device *dev)
 
         return 0;
 }
-#endif
 
 static SIMPLE_DEV_PM_OPS(spear_thermal_pm_ops, spear_thermal_suspend,
                 spear_thermal_resume);
diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c
index b3110040164a..2348fa613707 100644
--- a/drivers/tty/pty.c
+++ b/drivers/tty/pty.c
@@ -681,7 +681,14 @@ static void pty_unix98_remove(struct tty_driver *driver, struct tty_struct *tty)
 /* this is called once with whichever end is closed last */
 static void pty_unix98_shutdown(struct tty_struct *tty)
 {
-        devpts_kill_index(tty->driver_data, tty->index);
+        struct inode *ptmx_inode;
+
+        if (tty->driver->subtype == PTY_TYPE_MASTER)
+                ptmx_inode = tty->driver_data;
+        else
+                ptmx_inode = tty->link->driver_data;
+        devpts_kill_index(ptmx_inode, tty->index);
+        devpts_del_ref(ptmx_inode);
 }
 
 static const struct tty_operations ptm_unix98_ops = {
@@ -773,6 +780,18 @@ static int ptmx_open(struct inode *inode, struct file *filp)
         set_bit(TTY_PTY_LOCK, &tty->flags); /* LOCK THE SLAVE */
         tty->driver_data = inode;
 
+        /*
+         * In the case where all references to ptmx inode are dropped and we
+         * still have /dev/tty opened pointing to the master/slave pair (ptmx
+         * is closed/released before /dev/tty), we must make sure that the inode
+         * is still valid when we call the final pty_unix98_shutdown, thus we
+         * hold an additional reference to the ptmx inode. For the same /dev/tty
+         * last close case, we also need to make sure the super_block isn't
+         * destroyed (devpts instance unmounted), before /dev/tty is closed and
+         * on its release devpts_kill_index is called.
+         */
+        devpts_add_ref(inode);
+
         tty_add_file(tty, filp);
 
         slave_inode = devpts_pty_new(inode,
diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c
index e71ec78fc11e..7cd6f9a90542 100644
--- a/drivers/tty/serial/8250/8250_pci.c
+++ b/drivers/tty/serial/8250/8250_pci.c
@@ -1941,6 +1941,7 @@ pci_wch_ch38x_setup(struct serial_private *priv,
 #define PCIE_VENDOR_ID_WCH              0x1c00
 #define PCIE_DEVICE_ID_WCH_CH382_2S1P   0x3250
 #define PCIE_DEVICE_ID_WCH_CH384_4S     0x3470
+#define PCIE_DEVICE_ID_WCH_CH382_2S     0x3253
 
 #define PCI_VENDOR_ID_PERICOM                   0x12D8
 #define PCI_DEVICE_ID_PERICOM_PI7C9X7951        0x7951
@@ -2637,6 +2638,14 @@ static struct pci_serial_quirk pci_serial_quirks[] __refdata = {
                 .subdevice      = PCI_ANY_ID,
                 .setup          = pci_wch_ch353_setup,
         },
+        /* WCH CH382 2S card (16850 clone) */
+        {
+                .vendor         = PCIE_VENDOR_ID_WCH,
+                .device         = PCIE_DEVICE_ID_WCH_CH382_2S,
+                .subvendor      = PCI_ANY_ID,
+                .subdevice      = PCI_ANY_ID,
+                .setup          = pci_wch_ch38x_setup,
+        },
         /* WCH CH382 2S1P card (16850 clone) */
         {
                 .vendor         = PCIE_VENDOR_ID_WCH,
@@ -2955,6 +2964,7 @@ enum pci_board_num_t {
         pbn_fintek_4,
         pbn_fintek_8,
         pbn_fintek_12,
+        pbn_wch382_2,
         pbn_wch384_4,
         pbn_pericom_PI7C9X7951,
         pbn_pericom_PI7C9X7952,
@@ -3775,6 +3785,13 @@ static struct pciserial_board pci_boards[] = {
                 .base_baud      = 115200,
                 .first_offset   = 0x40,
         },
+        [pbn_wch382_2] = {
+                .flags          = FL_BASE0,
+                .num_ports      = 2,
+                .base_baud      = 115200,
+                .uart_offset    = 8,
+                .first_offset   = 0xC0,
+        },
         [pbn_wch384_4] = {
                 .flags          = FL_BASE0,
                 .num_ports      = 4,
@@ -5574,6 +5591,10 @@ static struct pci_device_id serial_pci_tbl[] = {
                 PCI_ANY_ID, PCI_ANY_ID,
                 0, 0, pbn_b0_bt_2_115200 },
 
+        {       PCIE_VENDOR_ID_WCH, PCIE_DEVICE_ID_WCH_CH382_2S,
+                PCI_ANY_ID, PCI_ANY_ID,
+                0, 0, pbn_wch382_2 },
+
         {       PCIE_VENDOR_ID_WCH, PCIE_DEVICE_ID_WCH_CH384_4S,
                 PCI_ANY_ID, PCI_ANY_ID,
                 0, 0, pbn_wch384_4 },
diff --git a/drivers/tty/serial/omap-serial.c b/drivers/tty/serial/omap-serial.c
index b645f9228ed7..fa49eb1e2fa2 100644
--- a/drivers/tty/serial/omap-serial.c
+++ b/drivers/tty/serial/omap-serial.c
@@ -1165,7 +1165,7 @@ serial_omap_type(struct uart_port *port)
 
 #define BOTH_EMPTY (UART_LSR_TEMT | UART_LSR_THRE)
 
-static void wait_for_xmitr(struct uart_omap_port *up)
+static void __maybe_unused wait_for_xmitr(struct uart_omap_port *up)
 {
         unsigned int status, tmout = 10000;
 
@@ -1343,7 +1343,7 @@ static inline void serial_omap_add_console_port(struct uart_omap_port *up)
 
 /* Enable or disable the rs485 support */
 static int
-serial_omap_config_rs485(struct uart_port *port, struct serial_rs485 *rs485conf)
+serial_omap_config_rs485(struct uart_port *port, struct serial_rs485 *rs485)
 {
         struct uart_omap_port *up = to_uart_omap_port(port);
         unsigned int mode;
@@ -1356,8 +1356,12 @@ serial_omap_config_rs485(struct uart_port *port, struct serial_rs485 *rs485conf)
         up->ier = 0;
         serial_out(up, UART_IER, 0);
 
+        /* Clamp the delays to [0, 100ms] */
+        rs485->delay_rts_before_send = min(rs485->delay_rts_before_send, 100U);
+        rs485->delay_rts_after_send  = min(rs485->delay_rts_after_send, 100U);
+
         /* store new config */
-        port->rs485 = *rs485conf;
+        port->rs485 = *rs485;
 
         /*
          * Just as a precaution, only allow rs485
diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
index 5cec01c75691..a7eacef1bd22 100644
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -2066,13 +2066,12 @@ retry_open:
                 if (tty) {
                         mutex_unlock(&tty_mutex);
                         retval = tty_lock_interruptible(tty);
+                        tty_kref_put(tty);  /* drop kref from tty_driver_lookup_tty() */
                         if (retval) {
                                 if (retval == -EINTR)
                                         retval = -ERESTARTSYS;
                                 goto err_unref;
                         }
-                        /* safe to drop the kref from tty_driver_lookup_tty() */
-                        tty_kref_put(tty);
                         retval = tty_reopen(tty);
                         if (retval < 0) {
                                 tty_unlock(tty);
diff --git a/drivers/tty/tty_mutex.c b/drivers/tty/tty_mutex.c
index d2f3c4cd697f..dfa9ec03fa8e 100644
--- a/drivers/tty/tty_mutex.c
+++ b/drivers/tty/tty_mutex.c
@@ -21,10 +21,15 @@ EXPORT_SYMBOL(tty_lock);
 
 int tty_lock_interruptible(struct tty_struct *tty)
 {
+        int ret;
+
         if (WARN(tty->magic != TTY_MAGIC, "L Bad %p\n", tty))
                 return -EIO;
         tty_kref_get(tty);
-        return mutex_lock_interruptible(&tty->legacy_mutex);
+        ret = mutex_lock_interruptible(&tty->legacy_mutex);
+        if (ret)
+                tty_kref_put(tty);
+        return ret;
 }
 
 void __lockfunc tty_unlock(struct tty_struct *tty)
diff --git a/drivers/usb/chipidea/ci_hdrc_pci.c b/drivers/usb/chipidea/ci_hdrc_pci.c
index b59195edf636..b635ab67490d 100644
--- a/drivers/usb/chipidea/ci_hdrc_pci.c
+++ b/drivers/usb/chipidea/ci_hdrc_pci.c
@@ -85,8 +85,8 @@ static int ci_hdrc_pci_probe(struct pci_dev *pdev,
 
         /* register a nop PHY */
         ci->phy = usb_phy_generic_register();
-        if (!ci->phy)
-                return -ENOMEM;
+        if (IS_ERR(ci->phy))
+                return PTR_ERR(ci->phy);
 
         memset(res, 0, sizeof(res));
         res[0].start    = pci_resource_start(pdev, 0);
diff --git a/drivers/usb/chipidea/debug.c b/drivers/usb/chipidea/debug.c
index a4f7db2e18dd..df47110bad2d 100644
--- a/drivers/usb/chipidea/debug.c
+++ b/drivers/usb/chipidea/debug.c
@@ -100,6 +100,9 @@ static ssize_t ci_port_test_write(struct file *file, const char __user *ubuf,
         if (sscanf(buf, "%u", &mode) != 1)
                 return -EINVAL;
 
+        if (mode > 255)
+                return -EBADRQC;
+
         pm_runtime_get_sync(ci->dev);
         spin_lock_irqsave(&ci->lock, flags);
         ret = hw_port_test_set(ci, mode);
diff --git a/drivers/usb/chipidea/otg.c b/drivers/usb/chipidea/otg.c
index 45f86da1d6d3..03b6743461d1 100644
--- a/drivers/usb/chipidea/otg.c
+++ b/drivers/usb/chipidea/otg.c
@@ -158,7 +158,7 @@ static void ci_otg_work(struct work_struct *work)
 int ci_hdrc_otg_init(struct ci_hdrc *ci)
 {
         INIT_WORK(&ci->work, ci_otg_work);
-        ci->wq = create_singlethread_workqueue("ci_otg");
+        ci->wq = create_freezable_workqueue("ci_otg");
         if (!ci->wq) {
                 dev_err(ci->dev, "can't create workqueue\n");
                 return -ENODEV;
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 350dcd9af5d8..51b436918f78 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -5401,6 +5401,7 @@ static int usb_reset_and_verify_device(struct usb_device *udev)
         }
 
         bos = udev->bos;
+        udev->bos = NULL;
 
         for (i = 0; i < SET_CONFIG_TRIES; ++i) {
 
@@ -5493,11 +5494,8 @@ done:
         usb_set_usb2_hardware_lpm(udev, 1);
         usb_unlocked_enable_lpm(udev);
         usb_enable_ltm(udev);
-        /* release the new BOS descriptor allocated  by hub_port_init() */
-        if (udev->bos != bos) {
-                usb_release_bos_descriptor(udev);
-                udev->bos = bos;
-        }
+        usb_release_bos_descriptor(udev);
+        udev->bos = bos;
         return 0;
 
 re_enumerate:
diff --git a/drivers/usb/dwc2/Kconfig b/drivers/usb/dwc2/Kconfig
index fd95ba6ec317..f0decc0d69b5 100644
--- a/drivers/usb/dwc2/Kconfig
+++ b/drivers/usb/dwc2/Kconfig
@@ -1,5 +1,6 @@
 config USB_DWC2
         tristate "DesignWare USB2 DRD Core Support"
+        depends on HAS_DMA
         depends on USB || USB_GADGET
         help
           Say Y here if your system has a Dual Role Hi-Speed USB
diff --git a/drivers/usb/dwc2/core.c b/drivers/usb/dwc2/core.c
index e991d55914db..46c4ba75dc2a 100644
--- a/drivers/usb/dwc2/core.c
+++ b/drivers/usb/dwc2/core.c
@@ -619,6 +619,12 @@ void dwc2_force_dr_mode(struct dwc2_hsotg *hsotg)
                          __func__, hsotg->dr_mode);
                 break;
         }
+
+        /*
+         * NOTE: This is required for some rockchip soc based
+         * platforms.
+         */
+        msleep(50);
 }
 
 /*
diff --git a/drivers/usb/dwc2/hcd_ddma.c b/drivers/usb/dwc2/hcd_ddma.c
index 36606fc33c0d..a41274aa52ad 100644
--- a/drivers/usb/dwc2/hcd_ddma.c
+++ b/drivers/usb/dwc2/hcd_ddma.c
@@ -1174,14 +1174,11 @@ static int dwc2_process_non_isoc_desc(struct dwc2_hsotg *hsotg,
         failed = dwc2_update_non_isoc_urb_state_ddma(hsotg, chan, qtd, dma_desc,
                                                      halt_status, n_bytes,
                                                      xfer_done);
-        if (*xfer_done && urb->status != -EINPROGRESS)
-                failed = 1;
-
-        if (failed) {
+        if (failed || (*xfer_done && urb->status != -EINPROGRESS)) {
                 dwc2_host_complete(hsotg, qtd, urb->status);
                 dwc2_hcd_qtd_unlink_and_free(hsotg, qtd, qh);
-                dev_vdbg(hsotg->dev, "failed=%1x xfer_done=%1x status=%08x\n",
-                         failed, *xfer_done, urb->status);
+                dev_vdbg(hsotg->dev, "failed=%1x xfer_done=%1x\n",
+                         failed, *xfer_done);
                 return failed;
         }
 
@@ -1236,21 +1233,23 @@ static void dwc2_complete_non_isoc_xfer_ddma(struct dwc2_hsotg *hsotg,
 
         list_for_each_safe(qtd_item, qtd_tmp, &qh->qtd_list) {
                 int i;
+                int qtd_desc_count;
 
                 qtd = list_entry(qtd_item, struct dwc2_qtd, qtd_list_entry);
                 xfer_done = 0;
+                qtd_desc_count = qtd->n_desc;
 
-                for (i = 0; i < qtd->n_desc; i++) {
+                for (i = 0; i < qtd_desc_count; i++) {
                         if (dwc2_process_non_isoc_desc(hsotg, chan, chnum, qtd,
                                                        desc_num, halt_status,
-                                                       &xfer_done)) {
-                                qtd = NULL;
-                                break;
-                        }
+                                                       &xfer_done))
+                                goto stop_scan;
+
                         desc_num++;
                 }
         }
 
+stop_scan:
         if (qh->ep_type != USB_ENDPOINT_XFER_CONTROL) {
                 /*
                  * Resetting the data toggle for bulk and interrupt endpoints
@@ -1258,7 +1257,7 @@ static void dwc2_complete_non_isoc_xfer_ddma(struct dwc2_hsotg *hsotg,
                  */
                 if (halt_status == DWC2_HC_XFER_STALL)
                         qh->data_toggle = DWC2_HC_PID_DATA0;
-                else if (qtd)
+                else
                         dwc2_hcd_save_data_toggle(hsotg, chan, chnum, qtd);
         }
 
diff --git a/drivers/usb/dwc2/hcd_intr.c b/drivers/usb/dwc2/hcd_intr.c
index f8253803a050..cadba8b13c48 100644
--- a/drivers/usb/dwc2/hcd_intr.c
+++ b/drivers/usb/dwc2/hcd_intr.c
@@ -525,11 +525,19 @@ void dwc2_hcd_save_data_toggle(struct dwc2_hsotg *hsotg,
         u32 pid = (hctsiz & TSIZ_SC_MC_PID_MASK) >> TSIZ_SC_MC_PID_SHIFT;
 
         if (chan->ep_type != USB_ENDPOINT_XFER_CONTROL) {
+                if (WARN(!chan || !chan->qh,
+                         "chan->qh must be specified for non-control eps\n"))
+                        return;
+
                 if (pid == TSIZ_SC_MC_PID_DATA0)
                         chan->qh->data_toggle = DWC2_HC_PID_DATA0;
                 else
                         chan->qh->data_toggle = DWC2_HC_PID_DATA1;
         } else {
+                if (WARN(!qtd,
+                         "qtd must be specified for control eps\n"))
+                        return;
+
                 if (pid == TSIZ_SC_MC_PID_DATA0)
                         qtd->data_toggle = DWC2_HC_PID_DATA0;
                 else
diff --git a/drivers/usb/dwc3/core.h b/drivers/usb/dwc3/core.h
index 29130682e547..e4f8b90d9627 100644
--- a/drivers/usb/dwc3/core.h
+++ b/drivers/usb/dwc3/core.h
@@ -856,7 +856,6 @@ struct dwc3 {
         unsigned                pullups_connected:1;
         unsigned                resize_fifos:1;
         unsigned                setup_packet_pending:1;
-        unsigned                start_config_issued:1;
         unsigned                three_stage_setup:1;
         unsigned                usb3_lpm_capable:1;
 
diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c
index 3a9354abcb68..8d6b75c2f53b 100644
--- a/drivers/usb/dwc3/ep0.c
+++ b/drivers/usb/dwc3/ep0.c
@@ -555,7 +555,6 @@ static int dwc3_ep0_set_config(struct dwc3 *dwc, struct usb_ctrlrequest *ctrl)
         int ret;
         u32 reg;
 
-        dwc->start_config_issued = false;
         cfg = le16_to_cpu(ctrl->wValue);
 
         switch (state) {
@@ -737,10 +736,6 @@ static int dwc3_ep0_std_request(struct dwc3 *dwc, struct usb_ctrlrequest *ctrl)
                 dwc3_trace(trace_dwc3_ep0, "USB_REQ_SET_ISOCH_DELAY");
                 ret = dwc3_ep0_set_isoch_delay(dwc, ctrl);
                 break;
-        case USB_REQ_SET_INTERFACE:
-                dwc3_trace(trace_dwc3_ep0, "USB_REQ_SET_INTERFACE");
-                dwc->start_config_issued = false;
-                /* Fall through */
         default:
                 dwc3_trace(trace_dwc3_ep0, "Forwarding to gadget driver");
                 ret = dwc3_ep0_delegate_req(dwc, ctrl);
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 7d1dd82a95ac..2363bad45af8 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -385,24 +385,66 @@ static void dwc3_free_trb_pool(struct dwc3_ep *dep)
         dep->trb_pool_dma = 0;
 }
 
+static int dwc3_gadget_set_xfer_resource(struct dwc3 *dwc, struct dwc3_ep *dep);
+
+/**
+ * dwc3_gadget_start_config - Configure EP resources
+ * @dwc: pointer to our controller context structure
+ * @dep: endpoint that is being enabled
+ *
+ * The assignment of transfer resources cannot perfectly follow the
+ * data book due to the fact that the controller driver does not have
+ * all knowledge of the configuration in advance. It is given this
+ * information piecemeal by the composite gadget framework after every
+ * SET_CONFIGURATION and SET_INTERFACE. Trying to follow the databook
+ * programming model in this scenario can cause errors. For two
+ * reasons:
+ *
+ * 1) The databook says to do DEPSTARTCFG for every SET_CONFIGURATION
+ * and SET_INTERFACE (8.1.5). This is incorrect in the scenario of
+ * multiple interfaces.
+ *
+ * 2) The databook does not mention doing more DEPXFERCFG for new
+ * endpoint on alt setting (8.1.6).
+ *
+ * The following simplified method is used instead:
+ *
+ * All hardware endpoints can be assigned a transfer resource and this
+ * setting will stay persistent until either a core reset or
+ * hibernation. So whenever we do a DEPSTARTCFG(0) we can go ahead and
+ * do DEPXFERCFG for every hardware endpoint as well. We are
+ * guaranteed that there are as many transfer resources as endpoints.
+ *
+ * This function is called for each endpoint when it is being enabled
+ * but is triggered only when called for EP0-out, which always happens
+ * first, and which should only happen in one of the above conditions.
+ */
 static int dwc3_gadget_start_config(struct dwc3 *dwc, struct dwc3_ep *dep)
 {
         struct dwc3_gadget_ep_cmd_params params;
         u32                     cmd;
+        int                     i;
+        int                     ret;
+
+        if (dep->number)
+                return 0;
 
         memset(&params, 0x00, sizeof(params));
+        cmd = DWC3_DEPCMD_DEPSTARTCFG;
 
-        if (dep->number != 1) {
-                cmd = DWC3_DEPCMD_DEPSTARTCFG;
-                /* XferRscIdx == 0 for ep0 and 2 for the remaining */
-                if (dep->number > 1) {
-                        if (dwc->start_config_issued)
-                                return 0;
-                        dwc->start_config_issued = true;
-                        cmd |= DWC3_DEPCMD_PARAM(2);
-                }
+        ret = dwc3_send_gadget_ep_cmd(dwc, 0, cmd, &params);
+        if (ret)
+                return ret;
 
-                return dwc3_send_gadget_ep_cmd(dwc, 0, cmd, &params);
+        for (i = 0; i < DWC3_ENDPOINTS_NUM; i++) {
+                struct dwc3_ep *dep = dwc->eps[i];
+
+                if (!dep)
+                        continue;
+
+                ret = dwc3_gadget_set_xfer_resource(dwc, dep);
+                if (ret)
+                        return ret;
         }
 
         return 0;
@@ -516,10 +558,6 @@ static int __dwc3_gadget_ep_enable(struct dwc3_ep *dep,
                 struct dwc3_trb *trb_st_hw;
                 struct dwc3_trb *trb_link;
 
-                ret = dwc3_gadget_set_xfer_resource(dwc, dep);
-                if (ret)
-                        return ret;
-
                 dep->endpoint.desc = desc;
                 dep->comp_desc = comp_desc;
                 dep->type = usb_endpoint_type(desc);
@@ -1636,8 +1674,6 @@ static int dwc3_gadget_start(struct usb_gadget *g,
         }
         dwc3_writel(dwc->regs, DWC3_DCFG, reg);
 
-        dwc->start_config_issued = false;
-
         /* Start with SuperSpeed Default */
         dwc3_gadget_ep0_desc.wMaxPacketSize = cpu_to_le16(512);
 
@@ -2237,7 +2273,6 @@ static void dwc3_gadget_disconnect_interrupt(struct dwc3 *dwc)
         dwc3_writel(dwc->regs, DWC3_DCTL, reg);
 
         dwc3_disconnect_gadget(dwc);
-        dwc->start_config_issued = false;
 
         dwc->gadget.speed = USB_SPEED_UNKNOWN;
         dwc->setup_packet_pending = false;
@@ -2288,7 +2323,6 @@ static void dwc3_gadget_reset_interrupt(struct dwc3 *dwc)
 
         dwc3_stop_active_transfers(dwc);
         dwc3_clear_stall_all_ep(dwc);
-        dwc->start_config_issued = false;
 
         /* Reset device address to zero */
         reg = dwc3_readl(dwc->regs, DWC3_DCFG);
diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
index 7e179f81d05c..87fb0fd6aaab 100644
--- a/drivers/usb/gadget/legacy/inode.c
+++ b/drivers/usb/gadget/legacy/inode.c
@@ -130,7 +130,8 @@ struct dev_data {
                                         setup_can_stall : 1,
                                         setup_out_ready : 1,
                                         setup_out_error : 1,
-                                        setup_abort : 1;
+                                        setup_abort : 1,
+                                        gadget_registered : 1;
         unsigned                        setup_wLength;
 
         /* the rest is basically write-once */
@@ -1179,7 +1180,8 @@ dev_release (struct inode *inode, struct file *fd)
 
         /* closing ep0 === shutdown all */
 
-        usb_gadget_unregister_driver (&gadgetfs_driver);
+        if (dev->gadget_registered)
+                usb_gadget_unregister_driver (&gadgetfs_driver);
 
         /* at this point "good" hardware has disconnected the
          * device from USB; the host won't see it any more.
@@ -1847,6 +1849,7 @@ dev_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
                  * kick in after the ep0 descriptor is closed.
                  */
                 value = len;
+                dev->gadget_registered = true;
         }
         return value;
 
diff --git a/drivers/usb/gadget/udc/fsl_qe_udc.c b/drivers/usb/gadget/udc/fsl_qe_udc.c
index 53c0692f1b09..93d28cb00b76 100644
--- a/drivers/usb/gadget/udc/fsl_qe_udc.c
+++ b/drivers/usb/gadget/udc/fsl_qe_udc.c
@@ -2340,7 +2340,7 @@ static struct qe_udc *qe_udc_config(struct platform_device *ofdev)
 {
         struct qe_udc *udc;
         struct device_node *np = ofdev->dev.of_node;
-        unsigned int tmp_addr = 0;
+        unsigned long tmp_addr = 0;
         struct usb_device_para __iomem *usbpram;
         unsigned int i;
         u64 size;
diff --git a/drivers/usb/gadget/udc/net2280.h b/drivers/usb/gadget/udc/net2280.h
index 4dff60d34f73..0d32052bf16f 100644
--- a/drivers/usb/gadget/udc/net2280.h
+++ b/drivers/usb/gadget/udc/net2280.h
@@ -369,9 +369,20 @@ static inline void set_max_speed(struct net2280_ep *ep, u32 max)
         static const u32 ep_enhanced[9] = { 0x10, 0x60, 0x30, 0x80,
                                           0x50, 0x20, 0x70, 0x40, 0x90 };
 
-        if (ep->dev->enhanced_mode)
+        if (ep->dev->enhanced_mode) {
                 reg = ep_enhanced[ep->num];
-        else{
+                switch (ep->dev->gadget.speed) {
+                case USB_SPEED_SUPER:
+                        reg += 2;
+                        break;
+                case USB_SPEED_FULL:
+                        reg += 1;
+                        break;
+                case USB_SPEED_HIGH:
+                default:
+                        break;
+                }
+        } else {
                 reg = (ep->num + 1) * 0x10;
                 if (ep->dev->gadget.speed != USB_SPEED_HIGH)
                         reg += 1;
diff --git a/drivers/usb/gadget/udc/udc-core.c b/drivers/usb/gadget/udc/udc-core.c
index fd73a3ea07c2..b86a6f03592e 100644
--- a/drivers/usb/gadget/udc/udc-core.c
+++ b/drivers/usb/gadget/udc/udc-core.c
@@ -413,9 +413,10 @@ int usb_add_gadget_udc_release(struct device *parent, struct usb_gadget *gadget,
                 if (!driver->udc_name || strcmp(driver->udc_name,
                                                 dev_name(&udc->dev)) == 0) {
                         ret = udc_bind_to_driver(udc, driver);
+                        if (ret != -EPROBE_DEFER)
+                                list_del(&driver->pending);
                         if (ret)
                                 goto err4;
-                        list_del(&driver->pending);
                         break;
                 }
         }
diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c
index 795a45b1b25b..58487a473521 100644
--- a/drivers/usb/musb/musb_host.c
+++ b/drivers/usb/musb/musb_host.c
@@ -662,7 +662,7 @@ static int musb_tx_dma_set_mode_mentor(struct dma_controller *dma,
                 csr &= ~(MUSB_TXCSR_AUTOSET | MUSB_TXCSR_DMAMODE);
                 csr |= MUSB_TXCSR_DMAENAB; /* against programmer's guide */
         }
-        channel->desired_mode = mode;
+        channel->desired_mode = *mode;
         musb_writew(epio, MUSB_TXCSR, csr);
 
         return 0;
@@ -2003,10 +2003,8 @@ void musb_host_rx(struct musb *musb, u8 epnum)
                                 qh->offset,
                                 urb->transfer_buffer_length);
 
-                        done = musb_rx_dma_in_inventra_cppi41(c, hw_ep, qh,
-                                                              urb, xfer_len,
-                                                              iso_err);
-                        if (done)
+                        if (musb_rx_dma_in_inventra_cppi41(c, hw_ep, qh, urb,
+                                                           xfer_len, iso_err))
                                 goto finish;
                         else
                                 dev_err(musb->controller, "error: rx_dma failed\n");
diff --git a/drivers/usb/phy/phy-msm-usb.c b/drivers/usb/phy/phy-msm-usb.c
index 970a30e155cb..72b387d592c2 100644
--- a/drivers/usb/phy/phy-msm-usb.c
+++ b/drivers/usb/phy/phy-msm-usb.c
@@ -757,14 +757,8 @@ static int msm_otg_set_host(struct usb_otg *otg, struct usb_bus *host)
         otg->host = host;
         dev_dbg(otg->usb_phy->dev, "host driver registered w/ tranceiver\n");
 
-        /*
-         * Kick the state machine work, if peripheral is not supported
-         * or peripheral is already registered with us.
-         */
-        if (motg->pdata->mode == USB_DR_MODE_HOST || otg->gadget) {
-                pm_runtime_get_sync(otg->usb_phy->dev);
-                schedule_work(&motg->sm_work);
-        }
+        pm_runtime_get_sync(otg->usb_phy->dev);
+        schedule_work(&motg->sm_work);
 
         return 0;
 }
@@ -827,14 +821,8 @@ static int msm_otg_set_peripheral(struct usb_otg *otg,
         dev_dbg(otg->usb_phy->dev,
                 "peripheral driver registered w/ tranceiver\n");
 
-        /*
-         * Kick the state machine work, if host is not supported
-         * or host is already registered with us.
-         */
-        if (motg->pdata->mode == USB_DR_MODE_PERIPHERAL || otg->host) {
-                pm_runtime_get_sync(otg->usb_phy->dev);
-                schedule_work(&motg->sm_work);
-        }
+        pm_runtime_get_sync(otg->usb_phy->dev);
+        schedule_work(&motg->sm_work);
 
         return 0;
 }
diff --git a/drivers/usb/serial/Kconfig b/drivers/usb/serial/Kconfig
index f612dda9c977..56ecb8b5115d 100644
--- a/drivers/usb/serial/Kconfig
+++ b/drivers/usb/serial/Kconfig
@@ -475,22 +475,6 @@ config USB_SERIAL_MOS7840
           To compile this driver as a module, choose M here: the
           module will be called mos7840.  If unsure, choose N.
 
-config USB_SERIAL_MXUPORT11
-        tristate "USB Moxa UPORT 11x0 Serial Driver"
-        ---help---
-          Say Y here if you want to use a MOXA UPort 11x0 Serial hub.
-
-          This driver supports:
-
-          - UPort 1110  : 1 port RS-232 USB to Serial Hub.
-          - UPort 1130  : 1 port RS-422/485 USB to Serial Hub.
-          - UPort 1130I : 1 port RS-422/485 USB to Serial Hub with Isolation.
-          - UPort 1150  : 1 port RS-232/422/485 USB to Serial Hub.
-          - UPort 1150I : 1 port RS-232/422/485 USB to Serial Hub with Isolation.
-
-          To compile this driver as a module, choose M here: the
-          module will be called mxu11x0.
-
 config USB_SERIAL_MXUPORT
         tristate "USB Moxa UPORT Serial Driver"
         ---help---
diff --git a/drivers/usb/serial/Makefile b/drivers/usb/serial/Makefile
index f3fa5e53702d..349d9df0895f 100644
--- a/drivers/usb/serial/Makefile
+++ b/drivers/usb/serial/Makefile
@@ -38,7 +38,6 @@ obj-$(CONFIG_USB_SERIAL_METRO)			+= metro-usb.o
 obj-$(CONFIG_USB_SERIAL_MOS7720)                += mos7720.o
 obj-$(CONFIG_USB_SERIAL_MOS7840)                += mos7840.o
 obj-$(CONFIG_USB_SERIAL_MXUPORT)                += mxuport.o
-obj-$(CONFIG_USB_SERIAL_MXUPORT11)              += mxu11x0.o
 obj-$(CONFIG_USB_SERIAL_NAVMAN)                 += navman.o
 obj-$(CONFIG_USB_SERIAL_OMNINET)                += omninet.o
 obj-$(CONFIG_USB_SERIAL_OPTICON)                += opticon.o
diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
index 987813b8a7f9..73a366de5102 100644
--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
@@ -163,6 +163,9 @@ static const struct usb_device_id id_table[] = {
         { USB_DEVICE(0x1843, 0x0200) }, /* Vaisala USB Instrument Cable */
         { USB_DEVICE(0x18EF, 0xE00F) }, /* ELV USB-I2C-Interface */
         { USB_DEVICE(0x18EF, 0xE025) }, /* ELV Marble Sound Board 1 */
+        { USB_DEVICE(0x1901, 0x0190) }, /* GE B850 CP2105 Recorder interface */
+        { USB_DEVICE(0x1901, 0x0193) }, /* GE B650 CP2104 PMC interface */
+        { USB_DEVICE(0x19CF, 0x3000) }, /* Parrot NMEA GPS Flight Recorder */
         { USB_DEVICE(0x1ADB, 0x0001) }, /* Schweitzer Engineering C662 Cable */
         { USB_DEVICE(0x1B1C, 0x1C00) }, /* Corsair USB Dongle */
         { USB_DEVICE(0x1BA4, 0x0002) }, /* Silicon Labs 358x factory default */
diff --git a/drivers/usb/serial/mxu11x0.c b/drivers/usb/serial/mxu11x0.c
deleted file mode 100644
index 619607323bfd..000000000000
--- a/drivers/usb/serial/mxu11x0.c
+++ /dev/null
@@ -1,1006 +0,0 @@
-/*
- * USB Moxa UPORT 11x0 Serial Driver
- *
- * Copyright (C) 2007 MOXA Technologies Co., Ltd.
- * Copyright (C) 2015 Mathieu Othacehe <m.othacehe@gmail.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- *
- * Supports the following Moxa USB to serial converters:
- *  UPort 1110,  1 port RS-232 USB to Serial Hub.
- *  UPort 1130,  1 port RS-422/485 USB to Serial Hub.
- *  UPort 1130I, 1 port RS-422/485 USB to Serial Hub with isolation
- *    protection.
- *  UPort 1150,  1 port RS-232/422/485 USB to Serial Hub.
- *  UPort 1150I, 1 port RS-232/422/485 USB to Serial Hub with isolation
- *  protection.
- */
-
-#include <linux/kernel.h>
-#include <linux/module.h>
-#include <linux/firmware.h>
-#include <linux/jiffies.h>
-#include <linux/serial.h>
-#include <linux/serial_reg.h>
-#include <linux/slab.h>
-#include <linux/spinlock.h>
-#include <linux/mutex.h>
-#include <linux/tty.h>
-#include <linux/tty_driver.h>
-#include <linux/tty_flip.h>
-#include <linux/uaccess.h>
-#include <linux/usb.h>
-#include <linux/usb/serial.h>
-
-/* Vendor and product ids */
-#define MXU1_VENDOR_ID                          0x110a
-#define MXU1_1110_PRODUCT_ID                    0x1110
-#define MXU1_1130_PRODUCT_ID                    0x1130
-#define MXU1_1150_PRODUCT_ID                    0x1150
-#define MXU1_1151_PRODUCT_ID                    0x1151
-#define MXU1_1131_PRODUCT_ID                    0x1131
-
-/* Commands */
-#define MXU1_GET_VERSION                        0x01
-#define MXU1_GET_PORT_STATUS                    0x02
-#define MXU1_GET_PORT_DEV_INFO                  0x03
-#define MXU1_GET_CONFIG                         0x04
-#define MXU1_SET_CONFIG                         0x05
-#define MXU1_OPEN_PORT                          0x06
-#define MXU1_CLOSE_PORT                         0x07
-#define MXU1_START_PORT                         0x08
-#define MXU1_STOP_PORT                          0x09
-#define MXU1_TEST_PORT                          0x0A
-#define MXU1_PURGE_PORT                         0x0B
-#define MXU1_RESET_EXT_DEVICE                   0x0C
-#define MXU1_GET_OUTQUEUE                       0x0D
-#define MXU1_WRITE_DATA                         0x80
-#define MXU1_READ_DATA                          0x81
-#define MXU1_REQ_TYPE_CLASS                     0x82
-
-/* Module identifiers */
-#define MXU1_I2C_PORT                           0x01
-#define MXU1_IEEE1284_PORT                      0x02
-#define MXU1_UART1_PORT                         0x03
-#define MXU1_UART2_PORT                         0x04
-#define MXU1_RAM_PORT                           0x05
-
-/* Modem status */
-#define MXU1_MSR_DELTA_CTS                      0x01
-#define MXU1_MSR_DELTA_DSR                      0x02
-#define MXU1_MSR_DELTA_RI                       0x04
-#define MXU1_MSR_DELTA_CD                       0x08
-#define MXU1_MSR_CTS                            0x10
-#define MXU1_MSR_DSR                            0x20
-#define MXU1_MSR_RI                             0x40
-#define MXU1_MSR_CD                             0x80
-#define MXU1_MSR_DELTA_MASK                     0x0F
-#define MXU1_MSR_MASK                           0xF0
-
-/* Line status */
-#define MXU1_LSR_OVERRUN_ERROR                  0x01
-#define MXU1_LSR_PARITY_ERROR                   0x02
-#define MXU1_LSR_FRAMING_ERROR                  0x04
-#define MXU1_LSR_BREAK                          0x08
-#define MXU1_LSR_ERROR                          0x0F
-#define MXU1_LSR_RX_FULL                        0x10
-#define MXU1_LSR_TX_EMPTY                       0x20
-
-/* Modem control */
-#define MXU1_MCR_LOOP                           0x04
-#define MXU1_MCR_DTR                            0x10
-#define MXU1_MCR_RTS                            0x20
-
-/* Mask settings */
-#define MXU1_UART_ENABLE_RTS_IN                 0x0001
-#define MXU1_UART_DISABLE_RTS                   0x0002
-#define MXU1_UART_ENABLE_PARITY_CHECKING        0x0008
-#define MXU1_UART_ENABLE_DSR_OUT                0x0010
-#define MXU1_UART_ENABLE_CTS_OUT                0x0020
-#define MXU1_UART_ENABLE_X_OUT                  0x0040
-#define MXU1_UART_ENABLE_XA_OUT                 0x0080
-#define MXU1_UART_ENABLE_X_IN                   0x0100
-#define MXU1_UART_ENABLE_DTR_IN                 0x0800
-#define MXU1_UART_DISABLE_DTR                   0x1000
-#define MXU1_UART_ENABLE_MS_INTS                0x2000
-#define MXU1_UART_ENABLE_AUTO_START_DMA         0x4000
-#define MXU1_UART_SEND_BREAK_SIGNAL             0x8000
-
-/* Parity */
-#define MXU1_UART_NO_PARITY                     0x00
-#define MXU1_UART_ODD_PARITY                    0x01
-#define MXU1_UART_EVEN_PARITY                   0x02
-#define MXU1_UART_MARK_PARITY                   0x03
-#define MXU1_UART_SPACE_PARITY                  0x04
-
-/* Stop bits */
-#define MXU1_UART_1_STOP_BITS                   0x00
-#define MXU1_UART_1_5_STOP_BITS                 0x01
-#define MXU1_UART_2_STOP_BITS                   0x02
-
-/* Bits per character */
-#define MXU1_UART_5_DATA_BITS                   0x00
-#define MXU1_UART_6_DATA_BITS                   0x01
-#define MXU1_UART_7_DATA_BITS                   0x02
-#define MXU1_UART_8_DATA_BITS                   0x03
-
-/* Operation modes */
-#define MXU1_UART_232                           0x00
-#define MXU1_UART_485_RECEIVER_DISABLED         0x01
-#define MXU1_UART_485_RECEIVER_ENABLED          0x02
-
-/* Pipe transfer mode and timeout */
-#define MXU1_PIPE_MODE_CONTINUOUS               0x01
-#define MXU1_PIPE_MODE_MASK                     0x03
-#define MXU1_PIPE_TIMEOUT_MASK                  0x7C
-#define MXU1_PIPE_TIMEOUT_ENABLE                0x80
-
-/* Config struct */
-struct mxu1_uart_config {
-        __be16  wBaudRate;
-        __be16  wFlags;
-        u8      bDataBits;
-        u8      bParity;
-        u8      bStopBits;
-        char    cXon;
-        char    cXoff;
-        u8      bUartMode;
-} __packed;
-
-/* Purge modes */
-#define MXU1_PURGE_OUTPUT                       0x00
-#define MXU1_PURGE_INPUT                        0x80
-
-/* Read/Write data */
-#define MXU1_RW_DATA_ADDR_SFR                   0x10
-#define MXU1_RW_DATA_ADDR_IDATA                 0x20
-#define MXU1_RW_DATA_ADDR_XDATA                 0x30
-#define MXU1_RW_DATA_ADDR_CODE                  0x40
-#define MXU1_RW_DATA_ADDR_GPIO                  0x50
-#define MXU1_RW_DATA_ADDR_I2C                   0x60
-#define MXU1_RW_DATA_ADDR_FLASH                 0x70
-#define MXU1_RW_DATA_ADDR_DSP                   0x80
-
-#define MXU1_RW_DATA_UNSPECIFIED                0x00
-#define MXU1_RW_DATA_BYTE                       0x01
-#define MXU1_RW_DATA_WORD                       0x02
-#define MXU1_RW_DATA_DOUBLE_WORD                0x04
-
-struct mxu1_write_data_bytes {
-        u8      bAddrType;
-        u8      bDataType;
-        u8      bDataCounter;
-        __be16  wBaseAddrHi;
-        __be16  wBaseAddrLo;
-        u8      bData[0];
-} __packed;
-
-/* Interrupt codes */
-#define MXU1_CODE_HARDWARE_ERROR                0xFF
-#define MXU1_CODE_DATA_ERROR                    0x03
-#define MXU1_CODE_MODEM_STATUS                  0x04
-
-static inline int mxu1_get_func_from_code(unsigned char code)
-{
-        return code & 0x0f;
-}
-
-/* Download firmware max packet size */
-#define MXU1_DOWNLOAD_MAX_PACKET_SIZE           64
-
-/* Firmware image header */
-struct mxu1_firmware_header {
-        __le16 wLength;
-        u8 bCheckSum;
-} __packed;
-
-#define MXU1_UART_BASE_ADDR         0xFFA0
-#define MXU1_UART_OFFSET_MCR        0x0004
-
-#define MXU1_BAUD_BASE              923077
-
-#define MXU1_TRANSFER_TIMEOUT       2
-#define MXU1_DOWNLOAD_TIMEOUT       1000
-#define MXU1_DEFAULT_CLOSING_WAIT   4000 /* in .01 secs */
-
-struct mxu1_port {
-        u8 msr;
-        u8 mcr;
-        u8 uart_mode;
-        spinlock_t spinlock; /* Protects msr */
-        struct mutex mutex; /* Protects mcr */
-        bool send_break;
-};
-
-struct mxu1_device {
-        u16 mxd_model;
-};
-
-static const struct usb_device_id mxu1_idtable[] = {
-        { USB_DEVICE(MXU1_VENDOR_ID, MXU1_1110_PRODUCT_ID) },
-        { USB_DEVICE(MXU1_VENDOR_ID, MXU1_1130_PRODUCT_ID) },
-        { USB_DEVICE(MXU1_VENDOR_ID, MXU1_1150_PRODUCT_ID) },
-        { USB_DEVICE(MXU1_VENDOR_ID, MXU1_1151_PRODUCT_ID) },
-        { USB_DEVICE(MXU1_VENDOR_ID, MXU1_1131_PRODUCT_ID) },
-        { }
-};
-
-MODULE_DEVICE_TABLE(usb, mxu1_idtable);
-
-/* Write the given buffer out to the control pipe.  */
-static int mxu1_send_ctrl_data_urb(struct usb_serial *serial,
-                                   u8 request,
-                                   u16 value, u16 index,
-                                   void *data, size_t size)
-{
-        int status;
-
-        status = usb_control_msg(serial->dev,
-                                 usb_sndctrlpipe(serial->dev, 0),
-                                 request,
-                                 (USB_DIR_OUT | USB_TYPE_VENDOR |
-                                  USB_RECIP_DEVICE), value, index,
-                                 data, size,
-                                 USB_CTRL_SET_TIMEOUT);
-        if (status < 0) {
-                dev_err(&serial->interface->dev,
-                        "%s - usb_control_msg failed: %d\n",
-                        __func__, status);
-                return status;
-        }
-
-        if (status != size) {
-                dev_err(&serial->interface->dev,
-                        "%s - short write (%d / %zd)\n",
-                        __func__, status, size);
-                return -EIO;
-        }
-
-        return 0;
-}
-
-/* Send a vendor request without any data */
-static int mxu1_send_ctrl_urb(struct usb_serial *serial,
-                              u8 request, u16 value, u16 index)
-{
-        return mxu1_send_ctrl_data_urb(serial, request, value, index,
-                                       NULL, 0);
-}
-
-static int mxu1_download_firmware(struct usb_serial *serial,
-                                  const struct firmware *fw_p)
-{
-        int status = 0;
-        int buffer_size;
-        int pos;
-        int len;
-        int done;
-        u8 cs = 0;
-        u8 *buffer;
-        struct usb_device *dev = serial->dev;
-        struct mxu1_firmware_header *header;
-        unsigned int pipe;
-
-        pipe = usb_sndbulkpipe(dev, serial->port[0]->bulk_out_endpointAddress);
-
-        buffer_size = fw_p->size + sizeof(*header);
-        buffer = kmalloc(buffer_size, GFP_KERNEL);
-        if (!buffer)
-                return -ENOMEM;
-
-        memcpy(buffer, fw_p->data, fw_p->size);
-        memset(buffer + fw_p->size, 0xff, buffer_size - fw_p->size);
-
-        for (pos = sizeof(*header); pos < buffer_size; pos++)
-                cs = (u8)(cs + buffer[pos]);
-
-        header = (struct mxu1_firmware_header *)buffer;
-        header->wLength = cpu_to_le16(buffer_size - sizeof(*header));
-        header->bCheckSum = cs;
-
-        dev_dbg(&dev->dev, "%s - downloading firmware\n", __func__);
-
-        for (pos = 0; pos < buffer_size; pos += done) {
-                len = min(buffer_size - pos, MXU1_DOWNLOAD_MAX_PACKET_SIZE);
-
-                status = usb_bulk_msg(dev, pipe, buffer + pos, len, &done,
-                                MXU1_DOWNLOAD_TIMEOUT);
-                if (status)
-                        break;
-        }
-
-        kfree(buffer);
-
-        if (status) {
-                dev_err(&dev->dev, "failed to download firmware: %d\n", status);
-                return status;
-        }
-
-        msleep_interruptible(100);
-        usb_reset_device(dev);
-
-        dev_dbg(&dev->dev, "%s - download successful\n", __func__);
-
-        return 0;
-}
-
-static int mxu1_port_probe(struct usb_serial_port *port)
-{
-        struct mxu1_port *mxport;
-        struct mxu1_device *mxdev;
-
-        if (!port->interrupt_in_urb) {
-                dev_err(&port->dev, "no interrupt urb\n");
-                return -ENODEV;
-        }
-
-        mxport = kzalloc(sizeof(struct mxu1_port), GFP_KERNEL);
-        if (!mxport)
-                return -ENOMEM;
-
-        spin_lock_init(&mxport->spinlock);
-        mutex_init(&mxport->mutex);
-
-        mxdev = usb_get_serial_data(port->serial);
-
-        switch (mxdev->mxd_model) {
-        case MXU1_1110_PRODUCT_ID:
-        case MXU1_1150_PRODUCT_ID:
-        case MXU1_1151_PRODUCT_ID:
-                mxport->uart_mode = MXU1_UART_232;
-                break;
-        case MXU1_1130_PRODUCT_ID:
-        case MXU1_1131_PRODUCT_ID:
-                mxport->uart_mode = MXU1_UART_485_RECEIVER_DISABLED;
-                break;
-        }
-
-        usb_set_serial_port_data(port, mxport);
-
-        port->port.closing_wait =
-                        msecs_to_jiffies(MXU1_DEFAULT_CLOSING_WAIT * 10);
-        port->port.drain_delay = 1;
-
-        return 0;
-}
-
-static int mxu1_port_remove(struct usb_serial_port *port)
-{
-        struct mxu1_port *mxport;
-
-        mxport = usb_get_serial_port_data(port);
-        kfree(mxport);
-
-        return 0;
-}
-
-static int mxu1_startup(struct usb_serial *serial)
-{
-        struct mxu1_device *mxdev;
-        struct usb_device *dev = serial->dev;
-        struct usb_host_interface *cur_altsetting;
-        char fw_name[32];
-        const struct firmware *fw_p = NULL;
-        int err;
-
-        dev_dbg(&serial->interface->dev, "%s - product 0x%04X, num configurations %d, configuration value %d\n",
-                __func__, le16_to_cpu(dev->descriptor.idProduct),
-                dev->descriptor.bNumConfigurations,
-                dev->actconfig->desc.bConfigurationValue);
-
-        /* create device structure */
-        mxdev = kzalloc(sizeof(struct mxu1_device), GFP_KERNEL);
-        if (!mxdev)
-                return -ENOMEM;
-
-        usb_set_serial_data(serial, mxdev);
-
-        mxdev->mxd_model = le16_to_cpu(dev->descriptor.idProduct);
-
-        cur_altsetting = serial->interface->cur_altsetting;
-
-        /* if we have only 1 configuration, download firmware */
-        if (cur_altsetting->desc.bNumEndpoints == 1) {
-
-                snprintf(fw_name,
-                         sizeof(fw_name),
-                         "moxa/moxa-%04x.fw",
-                         mxdev->mxd_model);
-
-                err = request_firmware(&fw_p, fw_name, &serial->interface->dev);
-                if (err) {
-                        dev_err(&serial->interface->dev, "failed to request firmware: %d\n",
-                                err);
-                        goto err_free_mxdev;
-                }
-
-                err = mxu1_download_firmware(serial, fw_p);
-                if (err)
-                        goto err_release_firmware;
-
-                /* device is being reset */
-                err = -ENODEV;
-                goto err_release_firmware;
-        }
-
-        return 0;
-
-err_release_firmware:
-        release_firmware(fw_p);
-err_free_mxdev:
-        kfree(mxdev);
-
-        return err;
-}
-
-static void mxu1_release(struct usb_serial *serial)
-{
-        struct mxu1_device *mxdev;
-
-        mxdev = usb_get_serial_data(serial);
-        kfree(mxdev);
-}
-
-static int mxu1_write_byte(struct usb_serial_port *port, u32 addr,
-                           u8 mask, u8 byte)
-{
-        int status;
-        size_t size;
-        struct mxu1_write_data_bytes *data;
-
-        dev_dbg(&port->dev, "%s - addr 0x%08X, mask 0x%02X, byte 0x%02X\n",
-                __func__, addr, mask, byte);
-
-        size = sizeof(struct mxu1_write_data_bytes) + 2;
-        data = kzalloc(size, GFP_KERNEL);
-        if (!data)
-                return -ENOMEM;
-
-        data->bAddrType = MXU1_RW_DATA_ADDR_XDATA;
-        data->bDataType = MXU1_RW_DATA_BYTE;
-        data->bDataCounter = 1;
-        data->wBaseAddrHi = cpu_to_be16(addr >> 16);
-        data->wBaseAddrLo = cpu_to_be16(addr);
-        data->bData[0] = mask;
-        data->bData[1] = byte;
-
-        status = mxu1_send_ctrl_data_urb(port->serial, MXU1_WRITE_DATA, 0,
-                                         MXU1_RAM_PORT, data, size);
-        if (status < 0)
-                dev_err(&port->dev, "%s - failed: %d\n", __func__, status);
-
-        kfree(data);
-
-        return status;
-}
-
-static int mxu1_set_mcr(struct usb_serial_port *port, unsigned int mcr)
-{
-        int status;
-
-        status = mxu1_write_byte(port,
-                                 MXU1_UART_BASE_ADDR + MXU1_UART_OFFSET_MCR,
-                                 MXU1_MCR_RTS | MXU1_MCR_DTR | MXU1_MCR_LOOP,
-                                 mcr);
-        return status;
-}
-
-static void mxu1_set_termios(struct tty_struct *tty,
-                             struct usb_serial_port *port,
-                             struct ktermios *old_termios)
-{
-        struct mxu1_port *mxport = usb_get_serial_port_data(port);
-        struct mxu1_uart_config *config;
-        tcflag_t cflag, iflag;
-        speed_t baud;
-        int status;
-        unsigned int mcr;
-
-        cflag = tty->termios.c_cflag;
-        iflag = tty->termios.c_iflag;
-
-        if (old_termios &&
-            !tty_termios_hw_change(&tty->termios, old_termios) &&
-            tty->termios.c_iflag == old_termios->c_iflag) {
-                dev_dbg(&port->dev, "%s - nothing to change\n", __func__);
-                return;
-        }
-
-        dev_dbg(&port->dev,
-                "%s - cflag 0x%08x, iflag 0x%08x\n", __func__, cflag, iflag);
-
-        if (old_termios) {
-                dev_dbg(&port->dev, "%s - old cflag 0x%08x, old iflag 0x%08x\n",
-                        __func__,
-                        old_termios->c_cflag,
-                        old_termios->c_iflag);
-        }
-
-        config = kzalloc(sizeof(*config), GFP_KERNEL);
-        if (!config)
-                return;
-
-        /* these flags must be set */
-        config->wFlags |= MXU1_UART_ENABLE_MS_INTS;
-        config->wFlags |= MXU1_UART_ENABLE_AUTO_START_DMA;
-        if (mxport->send_break)
-                config->wFlags |= MXU1_UART_SEND_BREAK_SIGNAL;
-        config->bUartMode = mxport->uart_mode;
-
-        switch (C_CSIZE(tty)) {
-        case CS5:
-                config->bDataBits = MXU1_UART_5_DATA_BITS;
-                break;
-        case CS6:
-                config->bDataBits = MXU1_UART_6_DATA_BITS;
-                break;
-        case CS7:
-                config->bDataBits = MXU1_UART_7_DATA_BITS;
-                break;
-        default:
-        case CS8:
-                config->bDataBits = MXU1_UART_8_DATA_BITS;
-                break;
-        }
-
-        if (C_PARENB(tty)) {
-                config->wFlags |= MXU1_UART_ENABLE_PARITY_CHECKING;
-                if (C_CMSPAR(tty)) {
-                        if (C_PARODD(tty))
-                                config->bParity = MXU1_UART_MARK_PARITY;
-                        else
-                                config->bParity = MXU1_UART_SPACE_PARITY;
-                } else {
-                        if (C_PARODD(tty))
-                                config->bParity = MXU1_UART_ODD_PARITY;
-                        else
-                                config->bParity = MXU1_UART_EVEN_PARITY;
-                }
-        } else {
-                config->bParity = MXU1_UART_NO_PARITY;
-        }
-
-        if (C_CSTOPB(tty))
-                config->bStopBits = MXU1_UART_2_STOP_BITS;
-        else
-                config->bStopBits = MXU1_UART_1_STOP_BITS;
-
-        if (C_CRTSCTS(tty)) {
-                /* RTS flow control must be off to drop RTS for baud rate B0 */
-                if (C_BAUD(tty) != B0)
-                        config->wFlags |= MXU1_UART_ENABLE_RTS_IN;
-                config->wFlags |= MXU1_UART_ENABLE_CTS_OUT;
-        }
-
-        if (I_IXOFF(tty) || I_IXON(tty)) {
-                config->cXon  = START_CHAR(tty);
-                config->cXoff = STOP_CHAR(tty);
-
-                if (I_IXOFF(tty))
-                        config->wFlags |= MXU1_UART_ENABLE_X_IN;
-
-                if (I_IXON(tty))
-                        config->wFlags |= MXU1_UART_ENABLE_X_OUT;
-        }
-
-        baud = tty_get_baud_rate(tty);
-        if (!baud)
-                baud = 9600;
-        config->wBaudRate = MXU1_BAUD_BASE / baud;
-
-        dev_dbg(&port->dev, "%s - BaudRate=%d, wBaudRate=%d, wFlags=0x%04X, bDataBits=%d, bParity=%d, bStopBits=%d, cXon=%d, cXoff=%d, bUartMode=%d\n",
-                __func__, baud, config->wBaudRate, config->wFlags,
-                config->bDataBits, config->bParity, config->bStopBits,
-                config->cXon, config->cXoff, config->bUartMode);
-
-        cpu_to_be16s(&config->wBaudRate);
-        cpu_to_be16s(&config->wFlags);
-
-        status = mxu1_send_ctrl_data_urb(port->serial, MXU1_SET_CONFIG, 0,
-                                         MXU1_UART1_PORT, config,
-                                         sizeof(*config));
-        if (status)
-                dev_err(&port->dev, "cannot set config: %d\n", status);
-
-        mutex_lock(&mxport->mutex);
-        mcr = mxport->mcr;
-
-        if (C_BAUD(tty) == B0)
-                mcr &= ~(MXU1_MCR_DTR | MXU1_MCR_RTS);
-        else if (old_termios && (old_termios->c_cflag & CBAUD) == B0)
-                mcr |= MXU1_MCR_DTR | MXU1_MCR_RTS;
-
-        status = mxu1_set_mcr(port, mcr);
-        if (status)
-                dev_err(&port->dev, "cannot set modem control: %d\n", status);
-        else
-                mxport->mcr = mcr;
-
-        mutex_unlock(&mxport->mutex);
-
-        kfree(config);
-}
-
-static int mxu1_get_serial_info(struct usb_serial_port *port,
-                                struct serial_struct __user *ret_arg)
-{
-        struct serial_struct ret_serial;
-        unsigned cwait;
-
-        if (!ret_arg)
-                return -EFAULT;
-
-        cwait = port->port.closing_wait;
-        if (cwait != ASYNC_CLOSING_WAIT_NONE)
-                cwait = jiffies_to_msecs(cwait) / 10;
-
-        memset(&ret_serial, 0, sizeof(ret_serial));
-
-        ret_serial.type = PORT_16550A;
-        ret_serial.line = port->minor;
-        ret_serial.port = 0;
-        ret_serial.xmit_fifo_size = port->bulk_out_size;
-        ret_serial.baud_base = MXU1_BAUD_BASE;
-        ret_serial.close_delay = 5*HZ;
-        ret_serial.closing_wait = cwait;
-
-        if (copy_to_user(ret_arg, &ret_serial, sizeof(*ret_arg)))
-                return -EFAULT;
-
-        return 0;
-}
-
-
-static int mxu1_set_serial_info(struct usb_serial_port *port,
-                                struct serial_struct __user *new_arg)
-{
-        struct serial_struct new_serial;
-        unsigned cwait;
-
-        if (copy_from_user(&new_serial, new_arg, sizeof(new_serial)))
-                return -EFAULT;
-
-        cwait = new_serial.closing_wait;
-        if (cwait != ASYNC_CLOSING_WAIT_NONE)
-                cwait = msecs_to_jiffies(10 * new_serial.closing_wait);
-
-        port->port.closing_wait = cwait;
-
-        return 0;
-}
-
-static int mxu1_ioctl(struct tty_struct *tty,
-                      unsigned int cmd, unsigned long arg)
-{
-        struct usb_serial_port *port = tty->driver_data;
-
-        switch (cmd) {
-        case TIOCGSERIAL:
-                return mxu1_get_serial_info(port,
-                                            (struct serial_struct __user *)arg);
-        case TIOCSSERIAL:
-                return mxu1_set_serial_info(port,
-                                            (struct serial_struct __user *)arg);
-        }
-
-        return -ENOIOCTLCMD;
-}
-
-static int mxu1_tiocmget(struct tty_struct *tty)
-{
-        struct usb_serial_port *port = tty->driver_data;
-        struct mxu1_port *mxport = usb_get_serial_port_data(port);
-        unsigned int result;
-        unsigned int msr;
-        unsigned int mcr;
-        unsigned long flags;
-
-        mutex_lock(&mxport->mutex);
-        spin_lock_irqsave(&mxport->spinlock, flags);
-
-        msr = mxport->msr;
-        mcr = mxport->mcr;
-
-        spin_unlock_irqrestore(&mxport->spinlock, flags);
-        mutex_unlock(&mxport->mutex);
-
-        result = ((mcr & MXU1_MCR_DTR)  ? TIOCM_DTR     : 0) |
-                 ((mcr & MXU1_MCR_RTS)  ? TIOCM_RTS     : 0) |
-                 ((mcr & MXU1_MCR_LOOP) ? TIOCM_LOOP    : 0) |
-                 ((msr & MXU1_MSR_CTS)  ? TIOCM_CTS     : 0) |
-                 ((msr & MXU1_MSR_CD)   ? TIOCM_CAR     : 0) |
-                 ((msr & MXU1_MSR_RI)   ? TIOCM_RI      : 0) |
-                 ((msr & MXU1_MSR_DSR)  ? TIOCM_DSR     : 0);
-
-        dev_dbg(&port->dev, "%s - 0x%04X\n", __func__, result);
-
-        return result;
-}
-
-static int mxu1_tiocmset(struct tty_struct *tty,
-                         unsigned int set, unsigned int clear)
-{
-        struct usb_serial_port *port = tty->driver_data;
-        struct mxu1_port *mxport = usb_get_serial_port_data(port);
-        int err;
-        unsigned int mcr;
-
-        mutex_lock(&mxport->mutex);
-        mcr = mxport->mcr;
-
-        if (set & TIOCM_RTS)
-                mcr |= MXU1_MCR_RTS;
-        if (set & TIOCM_DTR)
-                mcr |= MXU1_MCR_DTR;
-        if (set & TIOCM_LOOP)
-                mcr |= MXU1_MCR_LOOP;
-
-        if (clear & TIOCM_RTS)
-                mcr &= ~MXU1_MCR_RTS;
-        if (clear & TIOCM_DTR)
-                mcr &= ~MXU1_MCR_DTR;
-        if (clear & TIOCM_LOOP)
-                mcr &= ~MXU1_MCR_LOOP;
-
-        err = mxu1_set_mcr(port, mcr);
-        if (!err)
-                mxport->mcr = mcr;
-
-        mutex_unlock(&mxport->mutex);
-
-        return err;
-}
-
-static void mxu1_break(struct tty_struct *tty, int break_state)
-{
-        struct usb_serial_port *port = tty->driver_data;
-        struct mxu1_port *mxport = usb_get_serial_port_data(port);
-
-        if (break_state == -1)
-                mxport->send_break = true;
-        else
-                mxport->send_break = false;
-
-        mxu1_set_termios(tty, port, NULL);
-}
-
-static int mxu1_open(struct tty_struct *tty, struct usb_serial_port *port)
-{
-        struct mxu1_port *mxport = usb_get_serial_port_data(port);
-        struct usb_serial *serial = port->serial;
-        int status;
-        u16 open_settings;
-
-        open_settings = (MXU1_PIPE_MODE_CONTINUOUS |
-                         MXU1_PIPE_TIMEOUT_ENABLE |
-                         (MXU1_TRANSFER_TIMEOUT << 2));
-
-        mxport->msr = 0;
-
-        status = usb_submit_urb(port->interrupt_in_urb, GFP_KERNEL);
-        if (status) {
-                dev_err(&port->dev, "failed to submit interrupt urb: %d\n",
-                        status);
-                return status;
-        }
-
-        if (tty)
-                mxu1_set_termios(tty, port, NULL);
-
-        status = mxu1_send_ctrl_urb(serial, MXU1_OPEN_PORT,
-                                    open_settings, MXU1_UART1_PORT);
-        if (status) {
-                dev_err(&port->dev, "cannot send open command: %d\n", status);
-                goto unlink_int_urb;
-        }
-
-        status = mxu1_send_ctrl_urb(serial, MXU1_START_PORT,
-                                    0, MXU1_UART1_PORT);
-        if (status) {
-                dev_err(&port->dev, "cannot send start command: %d\n", status);
-                goto unlink_int_urb;
-        }
-
-        status = mxu1_send_ctrl_urb(serial, MXU1_PURGE_PORT,
-                                    MXU1_PURGE_INPUT, MXU1_UART1_PORT);
-        if (status) {
-                dev_err(&port->dev, "cannot clear input buffers: %d\n",
-                        status);
-
-                goto unlink_int_urb;
-        }
-
-        status = mxu1_send_ctrl_urb(serial, MXU1_PURGE_PORT,
-                                    MXU1_PURGE_OUTPUT, MXU1_UART1_PORT);
-        if (status) {
-                dev_err(&port->dev, "cannot clear output buffers: %d\n",
-                        status);
-
-                goto unlink_int_urb;
-        }
-
-        /*
-         * reset the data toggle on the bulk endpoints to work around bug in
-         * host controllers where things get out of sync some times
-         */
-        usb_clear_halt(serial->dev, port->write_urb->pipe);
-        usb_clear_halt(serial->dev, port->read_urb->pipe);
-
-        if (tty)
-                mxu1_set_termios(tty, port, NULL);
-
-        status = mxu1_send_ctrl_urb(serial, MXU1_OPEN_PORT,
-                                    open_settings, MXU1_UART1_PORT);
-        if (status) {
-                dev_err(&port->dev, "cannot send open command: %d\n", status);
-                goto unlink_int_urb;
-        }
-
-        status = mxu1_send_ctrl_urb(serial, MXU1_START_PORT,
-                                    0, MXU1_UART1_PORT);
-        if (status) {
-                dev_err(&port->dev, "cannot send start command: %d\n", status);
-                goto unlink_int_urb;
-        }
-
-        status = usb_serial_generic_open(tty, port);
-        if (status)
-                goto unlink_int_urb;
-
-        return 0;
-
-unlink_int_urb:
-        usb_kill_urb(port->interrupt_in_urb);
-
-        return status;
-}
-
-static void mxu1_close(struct usb_serial_port *port)
-{
-        int status;
-
-        usb_serial_generic_close(port);
-        usb_kill_urb(port->interrupt_in_urb);
-
-        status = mxu1_send_ctrl_urb(port->serial, MXU1_CLOSE_PORT,
-                                    0, MXU1_UART1_PORT);
-        if (status) {
-                dev_err(&port->dev, "failed to send close port command: %d\n",
-                        status);
-        }
-}
-
-static void mxu1_handle_new_msr(struct usb_serial_port *port, u8 msr)
-{
-        struct mxu1_port *mxport = usb_get_serial_port_data(port);
-        struct async_icount *icount;
-        unsigned long flags;
-
-        dev_dbg(&port->dev, "%s - msr 0x%02X\n", __func__, msr);
-
-        spin_lock_irqsave(&mxport->spinlock, flags);
-        mxport->msr = msr & MXU1_MSR_MASK;
-        spin_unlock_irqrestore(&mxport->spinlock, flags);
-
-        if (msr & MXU1_MSR_DELTA_MASK) {
-                icount = &port->icount;
-                if (msr & MXU1_MSR_DELTA_CTS)
-                        icount->cts++;
-                if (msr & MXU1_MSR_DELTA_DSR)
-                        icount->dsr++;
-                if (msr & MXU1_MSR_DELTA_CD)
-                        icount->dcd++;
-                if (msr & MXU1_MSR_DELTA_RI)
-                        icount->rng++;
-
-                wake_up_interruptible(&port->port.delta_msr_wait);
-        }
-}
-
-static void mxu1_interrupt_callback(struct urb *urb)
-{
-        struct usb_serial_port *port = urb->context;
-        unsigned char *data = urb->transfer_buffer;
-        int length = urb->actual_length;
-        int function;
-        int status;
-        u8 msr;
-
-        switch (urb->status) {
-        case 0:
-                break;
-        case -ECONNRESET:
-        case -ENOENT:
-        case -ESHUTDOWN:
-                dev_dbg(&port->dev, "%s - urb shutting down: %d\n",
-                        __func__, urb->status);
-                return;
-        default:
-                dev_dbg(&port->dev, "%s - nonzero urb status: %d\n",
-                        __func__, urb->status);
-                goto exit;
-        }
-
-        if (length != 2) {
-                dev_dbg(&port->dev, "%s - bad packet size: %d\n",
-                        __func__, length);
-                goto exit;
-        }
-
-        if (data[0] == MXU1_CODE_HARDWARE_ERROR) {
-                dev_err(&port->dev, "hardware error: %d\n", data[1]);
-                goto exit;
-        }
-
-        function = mxu1_get_func_from_code(data[0]);
-
-        dev_dbg(&port->dev, "%s - function %d, data 0x%02X\n",
-                 __func__, function, data[1]);
-
-        switch (function) {
-        case MXU1_CODE_DATA_ERROR:
-                dev_dbg(&port->dev, "%s - DATA ERROR, data 0x%02X\n",
-                         __func__, data[1]);
-                break;
-
-        case MXU1_CODE_MODEM_STATUS:
-                msr = data[1];
-                mxu1_handle_new_msr(port, msr);
-                break;
-
-        default:
-                dev_err(&port->dev, "unknown interrupt code: 0x%02X\n",
-                        data[1]);
-                break;
-        }
-
-exit:
-        status = usb_submit_urb(urb, GFP_ATOMIC);
-        if (status) {
-                dev_err(&port->dev, "resubmit interrupt urb failed: %d\n",
-                        status);
-        }
-}
-
-static struct usb_serial_driver mxu11x0_device = {
-        .driver = {
-                .owner          = THIS_MODULE,
-                .name           = "mxu11x0",
-        },
-        .description            = "MOXA UPort 11x0",
-        .id_table               = mxu1_idtable,
-        .num_ports              = 1,
-        .port_probe             = mxu1_port_probe,
-        .port_remove            = mxu1_port_remove,
-        .attach                 = mxu1_startup,
-        .release                = mxu1_release,
-        .open                   = mxu1_open,
-        .close                  = mxu1_close,
-        .ioctl                  = mxu1_ioctl,
-        .set_termios            = mxu1_set_termios,
-        .tiocmget               = mxu1_tiocmget,
-        .tiocmset               = mxu1_tiocmset,
-        .tiocmiwait             = usb_serial_generic_tiocmiwait,
-        .get_icount             = usb_serial_generic_get_icount,
-        .break_ctl              = mxu1_break,
-        .read_int_callback      = mxu1_interrupt_callback,
-};
-
-static struct usb_serial_driver *const serial_drivers[] = {
-        &mxu11x0_device, NULL
-};
-
-module_usb_serial_driver(serial_drivers, mxu1_idtable);
-
-MODULE_AUTHOR("Mathieu Othacehe <m.othacehe@gmail.com>");
-MODULE_DESCRIPTION("MOXA UPort 11x0 USB to Serial Hub Driver");
-MODULE_LICENSE("GPL");
-MODULE_FIRMWARE("moxa/moxa-1110.fw");
-MODULE_FIRMWARE("moxa/moxa-1130.fw");
-MODULE_FIRMWARE("moxa/moxa-1131.fw");
-MODULE_FIRMWARE("moxa/moxa-1150.fw");
-MODULE_FIRMWARE("moxa/moxa-1151.fw");
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index db86e512e0fc..348e19834b83 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -270,6 +270,7 @@ static void option_instat_callback(struct urb *urb);
 #define TELIT_PRODUCT_UE910_V2                  0x1012
 #define TELIT_PRODUCT_LE922_USBCFG0             0x1042
 #define TELIT_PRODUCT_LE922_USBCFG3             0x1043
+#define TELIT_PRODUCT_LE922_USBCFG5             0x1045
 #define TELIT_PRODUCT_LE920                     0x1200
 #define TELIT_PRODUCT_LE910                     0x1201
 
@@ -315,6 +316,7 @@ static void option_instat_callback(struct urb *urb);
 #define TOSHIBA_PRODUCT_G450                    0x0d45
 
 #define ALINK_VENDOR_ID                         0x1e0e
+#define SIMCOM_PRODUCT_SIM7100E                 0x9001 /* Yes, ALINK_VENDOR_ID */
 #define ALINK_PRODUCT_PH300                     0x9100
 #define ALINK_PRODUCT_3GU                       0x9200
 
@@ -607,6 +609,10 @@ static const struct option_blacklist_info zte_1255_blacklist = {
         .reserved = BIT(3) | BIT(4),
 };
 
+static const struct option_blacklist_info simcom_sim7100e_blacklist = {
+        .reserved = BIT(5) | BIT(6),
+};
+
 static const struct option_blacklist_info telit_le910_blacklist = {
         .sendsetup = BIT(0),
         .reserved = BIT(1) | BIT(2),
@@ -1122,9 +1128,13 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE(KYOCERA_VENDOR_ID, KYOCERA_PRODUCT_KPC650) },
         { USB_DEVICE(KYOCERA_VENDOR_ID, KYOCERA_PRODUCT_KPC680) },
         { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6000)}, /* ZTE AC8700 */
+        { USB_DEVICE_AND_INTERFACE_INFO(QUALCOMM_VENDOR_ID, 0x6001, 0xff, 0xff, 0xff), /* 4G LTE usb-modem U901 */
+          .driver_info = (kernel_ulong_t)&net_intf3_blacklist },
         { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6613)}, /* Onda H600/ZTE MF330 */
         { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x0023)}, /* ONYX 3G device */
         { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9000)}, /* SIMCom SIM5218 */
+        { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9003), /* Quectel UC20 */
+          .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
         { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6001) },
         { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CMU_300) },
         { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6003),
@@ -1176,6 +1186,8 @@ static const struct usb_device_id option_ids[] = {
                 .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg0 },
         { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG3),
                 .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 },
+        { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG5, 0xff),
+                .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg0 },
         { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910),
                 .driver_info = (kernel_ulong_t)&telit_le910_blacklist },
         { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920),
@@ -1645,6 +1657,8 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE(ALINK_VENDOR_ID, 0x9000) },
         { USB_DEVICE(ALINK_VENDOR_ID, ALINK_PRODUCT_PH300) },
         { USB_DEVICE_AND_INTERFACE_INFO(ALINK_VENDOR_ID, ALINK_PRODUCT_3GU, 0xff, 0xff, 0xff) },
+        { USB_DEVICE(ALINK_VENDOR_ID, SIMCOM_PRODUCT_SIM7100E),
+          .driver_info = (kernel_ulong_t)&simcom_sim7100e_blacklist },
         { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X060S_X200),
           .driver_info = (kernel_ulong_t)&alcatel_x200_blacklist
         },
diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
index 9919d2a9faf2..1bc6089b9008 100644
--- a/drivers/usb/serial/qcserial.c
+++ b/drivers/usb/serial/qcserial.c
@@ -157,14 +157,17 @@ static const struct usb_device_id id_table[] = {
         {DEVICE_SWI(0x1199, 0x9056)},   /* Sierra Wireless Modem */
         {DEVICE_SWI(0x1199, 0x9060)},   /* Sierra Wireless Modem */
         {DEVICE_SWI(0x1199, 0x9061)},   /* Sierra Wireless Modem */
-        {DEVICE_SWI(0x1199, 0x9070)},   /* Sierra Wireless MC74xx/EM74xx */
-        {DEVICE_SWI(0x1199, 0x9071)},   /* Sierra Wireless MC74xx/EM74xx */
+        {DEVICE_SWI(0x1199, 0x9070)},   /* Sierra Wireless MC74xx */
+        {DEVICE_SWI(0x1199, 0x9071)},   /* Sierra Wireless MC74xx */
+        {DEVICE_SWI(0x1199, 0x9078)},   /* Sierra Wireless EM74xx */
+        {DEVICE_SWI(0x1199, 0x9079)},   /* Sierra Wireless EM74xx */
         {DEVICE_SWI(0x413c, 0x81a2)},   /* Dell Wireless 5806 Gobi(TM) 4G LTE Mobile Broadband Card */
         {DEVICE_SWI(0x413c, 0x81a3)},   /* Dell Wireless 5570 HSPA+ (42Mbps) Mobile Broadband Card */
         {DEVICE_SWI(0x413c, 0x81a4)},   /* Dell Wireless 5570e HSPA+ (42Mbps) Mobile Broadband Card */
         {DEVICE_SWI(0x413c, 0x81a8)},   /* Dell Wireless 5808 Gobi(TM) 4G LTE Mobile Broadband Card */
         {DEVICE_SWI(0x413c, 0x81a9)},   /* Dell Wireless 5808e Gobi(TM) 4G LTE Mobile Broadband Card */
         {DEVICE_SWI(0x413c, 0x81b1)},   /* Dell Wireless 5809e Gobi(TM) 4G LTE Mobile Broadband Card */
+        {DEVICE_SWI(0x413c, 0x81b3)},   /* Dell Wireless 5809e Gobi(TM) 4G LTE Mobile Broadband Card (rev3) */
 
         /* Huawei devices */
         {DEVICE_HWI(0x03f0, 0x581d)},   /* HP lt4112 LTE/HSPA+ Gobi 4G Modem (Huawei me906e) */
diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
index 2760a7ba3f30..8c80a48e3233 100644
--- a/drivers/vfio/pci/vfio_pci.c
+++ b/drivers/vfio/pci/vfio_pci.c
@@ -446,7 +446,8 @@ static long vfio_pci_ioctl(void *device_data,
                 info.num_regions = VFIO_PCI_NUM_REGIONS;
                 info.num_irqs = VFIO_PCI_NUM_IRQS;
 
-                return copy_to_user((void __user *)arg, &info, minsz);
+                return copy_to_user((void __user *)arg, &info, minsz) ?
+                        -EFAULT : 0;
 
         } else if (cmd == VFIO_DEVICE_GET_REGION_INFO) {
                 struct pci_dev *pdev = vdev->pdev;
@@ -520,7 +521,8 @@ static long vfio_pci_ioctl(void *device_data,
                         return -EINVAL;
                 }
 
-                return copy_to_user((void __user *)arg, &info, minsz);
+                return copy_to_user((void __user *)arg, &info, minsz) ?
+                        -EFAULT : 0;
 
         } else if (cmd == VFIO_DEVICE_GET_IRQ_INFO) {
                 struct vfio_irq_info info;
@@ -555,7 +557,8 @@ static long vfio_pci_ioctl(void *device_data,
                 else
                         info.flags |= VFIO_IRQ_INFO_NORESIZE;
 
-                return copy_to_user((void __user *)arg, &info, minsz);
+                return copy_to_user((void __user *)arg, &info, minsz) ?
+                        -EFAULT : 0;
 
         } else if (cmd == VFIO_DEVICE_SET_IRQS) {
                 struct vfio_irq_set hdr;
diff --git a/drivers/vfio/platform/vfio_platform_common.c b/drivers/vfio/platform/vfio_platform_common.c
index 418cdd9ba3f4..e65b142d3422 100644
--- a/drivers/vfio/platform/vfio_platform_common.c
+++ b/drivers/vfio/platform/vfio_platform_common.c
@@ -219,7 +219,8 @@ static long vfio_platform_ioctl(void *device_data,
                 info.num_regions = vdev->num_regions;
                 info.num_irqs = vdev->num_irqs;
 
-                return copy_to_user((void __user *)arg, &info, minsz);
+                return copy_to_user((void __user *)arg, &info, minsz) ?
+                        -EFAULT : 0;
 
         } else if (cmd == VFIO_DEVICE_GET_REGION_INFO) {
                 struct vfio_region_info info;
@@ -240,7 +241,8 @@ static long vfio_platform_ioctl(void *device_data,
                 info.size = vdev->regions[info.index].size;
                 info.flags = vdev->regions[info.index].flags;
 
-                return copy_to_user((void __user *)arg, &info, minsz);
+                return copy_to_user((void __user *)arg, &info, minsz) ?
+                        -EFAULT : 0;
 
         } else if (cmd == VFIO_DEVICE_GET_IRQ_INFO) {
                 struct vfio_irq_info info;
@@ -259,7 +261,8 @@ static long vfio_platform_ioctl(void *device_data,
                 info.flags = vdev->irqs[info.index].flags;
                 info.count = vdev->irqs[info.index].count;
 
-                return copy_to_user((void __user *)arg, &info, minsz);
+                return copy_to_user((void __user *)arg, &info, minsz) ?
+                        -EFAULT : 0;
 
         } else if (cmd == VFIO_DEVICE_SET_IRQS) {
                 struct vfio_irq_set hdr;
diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c
index 6f1ea3dddbad..75b24e93cedb 100644
--- a/drivers/vfio/vfio_iommu_type1.c
+++ b/drivers/vfio/vfio_iommu_type1.c
@@ -999,7 +999,8 @@ static long vfio_iommu_type1_ioctl(void *iommu_data,
 
                 info.iova_pgsizes = vfio_pgsize_bitmap(iommu);
 
-                return copy_to_user((void __user *)arg, &info, minsz);
+                return copy_to_user((void __user *)arg, &info, minsz) ?
+                        -EFAULT : 0;
 
         } else if (cmd == VFIO_IOMMU_MAP_DMA) {
                 struct vfio_iommu_type1_dma_map map;
@@ -1032,7 +1033,8 @@ static long vfio_iommu_type1_ioctl(void *iommu_data,
                 if (ret)
                         return ret;
 
-                return copy_to_user((void __user *)arg, &unmap, minsz);
+                return copy_to_user((void __user *)arg, &unmap, minsz) ?
+                        -EFAULT : 0;
         }
 
         return -ENOTTY;
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index ad2146a9ab2d..236553e81027 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -1156,6 +1156,8 @@ int vhost_init_used(struct vhost_virtqueue *vq)
 {
         __virtio16 last_used_idx;
         int r;
+        bool is_le = vq->is_le;
+
         if (!vq->private_data) {
                 vq->is_le = virtio_legacy_is_little_endian();
                 return 0;
@@ -1165,15 +1167,20 @@ int vhost_init_used(struct vhost_virtqueue *vq)
 
         r = vhost_update_used_flags(vq);
         if (r)
-                return r;
+                goto err;
         vq->signalled_used_valid = false;
-        if (!access_ok(VERIFY_READ, &vq->used->idx, sizeof vq->used->idx))
-                return -EFAULT;
+        if (!access_ok(VERIFY_READ, &vq->used->idx, sizeof vq->used->idx)) {
+                r = -EFAULT;
+                goto err;
+        }
         r = __get_user(last_used_idx, &vq->used->idx);
         if (r)
-                return r;
+                goto err;
         vq->last_used_idx = vhost16_to_cpu(vq, last_used_idx);
         return 0;
+err:
+        vq->is_le = is_le;
+        return r;
 }
 EXPORT_SYMBOL_GPL(vhost_init_used);
 
diff --git a/drivers/video/console/fbcon.c b/drivers/video/console/fbcon.c
index 92f394927f24..6e92917ba77a 100644
--- a/drivers/video/console/fbcon.c
+++ b/drivers/video/console/fbcon.c
@@ -709,6 +709,7 @@ static int con2fb_acquire_newinfo(struct vc_data *vc, struct fb_info *info,
         }
 
         if (!err) {
+                ops->cur_blink_jiffies = HZ / 5;
                 info->fbcon_par = ops;
 
                 if (vc)
@@ -956,6 +957,7 @@ static const char *fbcon_startup(void)
         ops->currcon = -1;
         ops->graphics = 1;
         ops->cur_rotate = -1;
+        ops->cur_blink_jiffies = HZ / 5;
         info->fbcon_par = ops;
         p->con_rotate = initial_rotation;
         set_blitting_type(vc, info);
diff --git a/drivers/video/fbdev/da8xx-fb.c b/drivers/video/fbdev/da8xx-fb.c
index 0081725c6b5b..6b2a06d09f2b 100644
--- a/drivers/video/fbdev/da8xx-fb.c
+++ b/drivers/video/fbdev/da8xx-fb.c
@@ -152,7 +152,7 @@ static void lcdc_write(unsigned int val, unsigned int addr)
 
 struct da8xx_fb_par {
         struct device           *dev;
-        resource_size_t p_palette_base;
+        dma_addr_t              p_palette_base;
         unsigned char *v_palette_base;
         dma_addr_t              vram_phys;
         unsigned long           vram_size;
@@ -1428,7 +1428,7 @@ static int fb_probe(struct platform_device *device)
 
         par->vram_virt = dma_alloc_coherent(NULL,
                                             par->vram_size,
-                                            (resource_size_t *) &par->vram_phys,
+                                            &par->vram_phys,
                                             GFP_KERNEL | GFP_DMA);
         if (!par->vram_virt) {
                 dev_err(&device->dev,
@@ -1448,7 +1448,7 @@ static int fb_probe(struct platform_device *device)
 
         /* allocate palette buffer */
         par->v_palette_base = dma_zalloc_coherent(NULL, PALETTE_SIZE,
-                                                  (resource_size_t *)&par->p_palette_base,
+                                                  &par->p_palette_base,
                                                   GFP_KERNEL | GFP_DMA);
         if (!par->v_palette_base) {
                 dev_err(&device->dev,
diff --git a/drivers/video/fbdev/exynos/s6e8ax0.c b/drivers/video/fbdev/exynos/s6e8ax0.c
index 95873f26e39c..de2f3e793786 100644
--- a/drivers/video/fbdev/exynos/s6e8ax0.c
+++ b/drivers/video/fbdev/exynos/s6e8ax0.c
@@ -829,8 +829,7 @@ static int s6e8ax0_probe(struct mipi_dsim_lcd_device *dsim_dev)
         return 0;
 }
 
-#ifdef CONFIG_PM
-static int s6e8ax0_suspend(struct mipi_dsim_lcd_device *dsim_dev)
+static int __maybe_unused s6e8ax0_suspend(struct mipi_dsim_lcd_device *dsim_dev)
 {
         struct s6e8ax0 *lcd = dev_get_drvdata(&dsim_dev->dev);
 
@@ -843,7 +842,7 @@ static int s6e8ax0_suspend(struct mipi_dsim_lcd_device *dsim_dev)
         return 0;
 }
 
-static int s6e8ax0_resume(struct mipi_dsim_lcd_device *dsim_dev)
+static int __maybe_unused s6e8ax0_resume(struct mipi_dsim_lcd_device *dsim_dev)
 {
         struct s6e8ax0 *lcd = dev_get_drvdata(&dsim_dev->dev);
 
@@ -855,10 +854,6 @@ static int s6e8ax0_resume(struct mipi_dsim_lcd_device *dsim_dev)
 
         return 0;
 }
-#else
-#define s6e8ax0_suspend         NULL
-#define s6e8ax0_resume          NULL
-#endif
 
 static struct mipi_dsim_lcd_driver s6e8ax0_dsim_ddi_driver = {
         .name = "s6e8ax0",
@@ -867,8 +862,8 @@ static struct mipi_dsim_lcd_driver s6e8ax0_dsim_ddi_driver = {
         .power_on = s6e8ax0_power_on,
         .set_sequence = s6e8ax0_set_sequence,
         .probe = s6e8ax0_probe,
-        .suspend = s6e8ax0_suspend,
-        .resume = s6e8ax0_resume,
+        .suspend = IS_ENABLED(CONFIG_PM) ? s6e8ax0_suspend : NULL,
+        .resume = IS_ENABLED(CONFIG_PM) ? s6e8ax0_resume : NULL,
 };
 
 static int s6e8ax0_init(void)
diff --git a/drivers/video/fbdev/imxfb.c b/drivers/video/fbdev/imxfb.c
index cee88603efc9..bb2f1e866020 100644
--- a/drivers/video/fbdev/imxfb.c
+++ b/drivers/video/fbdev/imxfb.c
@@ -902,6 +902,21 @@ static int imxfb_probe(struct platform_device *pdev)
                 goto failed_getclock;
         }
 
+        /*
+         * The LCDC controller does not have an enable bit. The
+         * controller starts directly when the clocks are enabled.
+         * If the clocks are enabled when the controller is not yet
+         * programmed with proper register values (enabled at the
+         * bootloader, for example) then it just goes into some undefined
+         * state.
+         * To avoid this issue, let's enable and disable LCDC IPG clock
+         * so that we force some kind of 'reset' to the LCDC block.
+         */
+        ret = clk_prepare_enable(fbi->clk_ipg);
+        if (ret)
+                goto failed_getclock;
+        clk_disable_unprepare(fbi->clk_ipg);
+
         fbi->clk_ahb = devm_clk_get(&pdev->dev, "ahb");
         if (IS_ERR(fbi->clk_ahb)) {
                 ret = PTR_ERR(fbi->clk_ahb);
diff --git a/drivers/video/fbdev/mmp/hw/mmp_ctrl.c b/drivers/video/fbdev/mmp/hw/mmp_ctrl.c
index de54a4748065..b6f83d5df9fd 100644
--- a/drivers/video/fbdev/mmp/hw/mmp_ctrl.c
+++ b/drivers/video/fbdev/mmp/hw/mmp_ctrl.c
@@ -503,8 +503,7 @@ static int mmphw_probe(struct platform_device *pdev)
         ctrl->reg_base = devm_ioremap_nocache(ctrl->dev,
                         res->start, resource_size(res));
         if (ctrl->reg_base == NULL) {
-                dev_err(ctrl->dev, "%s: res %x - %x map failed\n", __func__,
-                        res->start, res->end);
+                dev_err(ctrl->dev, "%s: res %pR map failed\n", __func__, res);
                 ret = -ENOMEM;
                 goto failed;
         }
diff --git a/drivers/video/fbdev/ocfb.c b/drivers/video/fbdev/ocfb.c
index c9293aea8ec3..a970edc2a6f8 100644
--- a/drivers/video/fbdev/ocfb.c
+++ b/drivers/video/fbdev/ocfb.c
@@ -123,11 +123,11 @@ static int ocfb_setupfb(struct ocfb_dev *fbdev)
 
         /* Horizontal timings */
         ocfb_writereg(fbdev, OCFB_HTIM, (var->hsync_len - 1) << 24 |
-                      (var->right_margin - 1) << 16 | (var->xres - 1));
+                      (var->left_margin - 1) << 16 | (var->xres - 1));
 
         /* Vertical timings */
         ocfb_writereg(fbdev, OCFB_VTIM, (var->vsync_len - 1) << 24 |
-                      (var->lower_margin - 1) << 16 | (var->yres - 1));
+                      (var->upper_margin - 1) << 16 | (var->yres - 1));
 
         /* Total length of frame */
         hlen = var->left_margin + var->right_margin + var->hsync_len +
diff --git a/drivers/virtio/virtio_pci_modern.c b/drivers/virtio/virtio_pci_modern.c
index c0c11fad4611..7760fc1a2218 100644
--- a/drivers/virtio/virtio_pci_modern.c
+++ b/drivers/virtio/virtio_pci_modern.c
@@ -679,7 +679,7 @@ int virtio_pci_modern_probe(struct virtio_pci_device *vp_dev)
 
         pci_read_config_dword(pci_dev,
                               notify + offsetof(struct virtio_pci_notify_cap,
-                                                cap.length),
+                                                cap.offset),
                               &notify_offset);
 
         /* We don't know how many VQs we'll map, ahead of the time.
diff --git a/drivers/watchdog/Kconfig b/drivers/watchdog/Kconfig
index 0f6d8515ba4f..80825a7e8e48 100644
--- a/drivers/watchdog/Kconfig
+++ b/drivers/watchdog/Kconfig
@@ -1569,6 +1569,17 @@ config WATCHDOG_RIO
           machines.  The watchdog timeout period is normally one minute but
           can be changed with a boot-time parameter.
 
+config WATCHDOG_SUN4V
+        tristate "Sun4v Watchdog support"
+        select WATCHDOG_CORE
+        depends on SPARC64
+        help
+          Say Y here to support the hypervisor watchdog capability embedded
+          in the SPARC sun4v architecture.
+
+          To compile this driver as a module, choose M here. The module will
+          be called sun4v_wdt.
+
 # XTENSA Architecture
 
 # Xen Architecture
diff --git a/drivers/watchdog/Makefile b/drivers/watchdog/Makefile
index f566753256ab..f6a6a387c6c7 100644
--- a/drivers/watchdog/Makefile
+++ b/drivers/watchdog/Makefile
@@ -179,6 +179,7 @@ obj-$(CONFIG_SH_WDT) += shwdt.o
 
 obj-$(CONFIG_WATCHDOG_RIO)              += riowd.o
 obj-$(CONFIG_WATCHDOG_CP1XXX)           += cpwd.o
+obj-$(CONFIG_WATCHDOG_SUN4V)            += sun4v_wdt.o
 
 # XTENSA Architecture
 
diff --git a/drivers/watchdog/sun4v_wdt.c b/drivers/watchdog/sun4v_wdt.c
new file mode 100644
index 000000000000..1467fe50a76f
--- /dev/null
+++ b/drivers/watchdog/sun4v_wdt.c
@@ -0,0 +1,191 @@
+/*
+ *      sun4v watchdog timer
+ *      (c) Copyright 2016 Oracle Corporation
+ *
+ *      Implement a simple watchdog driver using the built-in sun4v hypervisor
+ *      watchdog support. If time expires, the hypervisor stops or bounces
+ *      the guest domain.
+ *
+ *      This program is free software; you can redistribute it and/or
+ *      modify it under the terms of the GNU General Public License
+ *      as published by the Free Software Foundation; either version
+ *      2 of the License, or (at your option) any later version.
+ */
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include <linux/errno.h>
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/moduleparam.h>
+#include <linux/watchdog.h>
+#include <asm/hypervisor.h>
+#include <asm/mdesc.h>
+
+#define WDT_TIMEOUT                     60
+#define WDT_MAX_TIMEOUT                 31536000
+#define WDT_MIN_TIMEOUT                 1
+#define WDT_DEFAULT_RESOLUTION_MS       1000    /* 1 second */
+
+static unsigned int timeout;
+module_param(timeout, uint, 0);
+MODULE_PARM_DESC(timeout, "Watchdog timeout in seconds (default="
+        __MODULE_STRING(WDT_TIMEOUT) ")");
+
+static bool nowayout = WATCHDOG_NOWAYOUT;
+module_param(nowayout, bool, S_IRUGO);
+MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default="
+        __MODULE_STRING(WATCHDOG_NOWAYOUT) ")");
+
+static int sun4v_wdt_stop(struct watchdog_device *wdd)
+{
+        sun4v_mach_set_watchdog(0, NULL);
+
+        return 0;
+}
+
+static int sun4v_wdt_ping(struct watchdog_device *wdd)
+{
+        int hverr;
+
+        /*
+         * HV watchdog timer will round up the timeout
+         * passed in to the nearest multiple of the
+         * watchdog resolution in milliseconds.
+         */
+        hverr = sun4v_mach_set_watchdog(wdd->timeout * 1000, NULL);
+        if (hverr == HV_EINVAL)
+                return -EINVAL;
+
+        return 0;
+}
+
+static int sun4v_wdt_set_timeout(struct watchdog_device *wdd,
+                                 unsigned int timeout)
+{
+        wdd->timeout = timeout;
+
+        return 0;
+}
+
+static const struct watchdog_info sun4v_wdt_ident = {
+        .options =      WDIOF_SETTIMEOUT |
+                        WDIOF_MAGICCLOSE |
+                        WDIOF_KEEPALIVEPING,
+        .identity =     "sun4v hypervisor watchdog",
+        .firmware_version = 0,
+};
+
+static struct watchdog_ops sun4v_wdt_ops = {
+        .owner =        THIS_MODULE,
+        .start =        sun4v_wdt_ping,
+        .stop =         sun4v_wdt_stop,
+        .ping =         sun4v_wdt_ping,
+        .set_timeout =  sun4v_wdt_set_timeout,
+};
+
+static struct watchdog_device wdd = {
+        .info = &sun4v_wdt_ident,
+        .ops = &sun4v_wdt_ops,
+        .min_timeout = WDT_MIN_TIMEOUT,
+        .max_timeout = WDT_MAX_TIMEOUT,
+        .timeout = WDT_TIMEOUT,
+};
+
+static int __init sun4v_wdt_init(void)
+{
+        struct mdesc_handle *handle;
+        u64 node;
+        const u64 *value;
+        int err = 0;
+        unsigned long major = 1, minor = 1;
+
+        /*
+         * There are 2 properties that can be set from the control
+         * domain for the watchdog.
+         * watchdog-resolution
+         * watchdog-max-timeout
+         *
+         * We can expect a handle to be returned otherwise something
+         * serious is wrong. Correct to return -ENODEV here.
+         */
+
+        handle = mdesc_grab();
+        if (!handle)
+                return -ENODEV;
+
+        node = mdesc_node_by_name(handle, MDESC_NODE_NULL, "platform");
+        err = -ENODEV;
+        if (node == MDESC_NODE_NULL)
+                goto out_release;
+
+        /*
+         * This is a safe way to validate if we are on the right
+         * platform.
+         */
+        if (sun4v_hvapi_register(HV_GRP_CORE, major, &minor))
+                goto out_hv_unreg;
+
+        /* Allow value of watchdog-resolution up to 1s (default) */
+        value = mdesc_get_property(handle, node, "watchdog-resolution", NULL);
+        err = -EINVAL;
+        if (value) {
+                if (*value == 0 ||
+                    *value > WDT_DEFAULT_RESOLUTION_MS)
+                        goto out_hv_unreg;
+        }
+
+        value = mdesc_get_property(handle, node, "watchdog-max-timeout", NULL);
+        if (value) {
+                /*
+                 * If the property value (in ms) is smaller than
+                 * min_timeout, return -EINVAL.
+                 */
+                if (*value < wdd.min_timeout * 1000)
+                        goto out_hv_unreg;
+
+                /*
+                 * If the property value is smaller than
+                 * default max_timeout  then set watchdog max_timeout to
+                 * the value of the property in seconds.
+                 */
+                if (*value < wdd.max_timeout * 1000)
+                        wdd.max_timeout = *value  / 1000;
+        }
+
+        watchdog_init_timeout(&wdd, timeout, NULL);
+
+        watchdog_set_nowayout(&wdd, nowayout);
+
+        err = watchdog_register_device(&wdd);
+        if (err)
+                goto out_hv_unreg;
+
+        pr_info("initialized (timeout=%ds, nowayout=%d)\n",
+                 wdd.timeout, nowayout);
+
+        mdesc_release(handle);
+
+        return 0;
+
+out_hv_unreg:
+        sun4v_hvapi_unregister(HV_GRP_CORE);
+
+out_release:
+        mdesc_release(handle);
+        return err;
+}
+
+static void __exit sun4v_wdt_exit(void)
+{
+        sun4v_hvapi_unregister(HV_GRP_CORE);
+        watchdog_unregister_device(&wdd);
+}
+
+module_init(sun4v_wdt_init);
+module_exit(sun4v_wdt_exit);
+
+MODULE_AUTHOR("Wim Coekaerts <wim.coekaerts@oracle.com>");
+MODULE_DESCRIPTION("sun4v watchdog driver");
+MODULE_LICENSE("GPL");
diff --git a/drivers/xen/xen-pciback/pciback_ops.c b/drivers/xen/xen-pciback/pciback_ops.c
index 73dafdc494aa..fb0221434f81 100644
--- a/drivers/xen/xen-pciback/pciback_ops.c
+++ b/drivers/xen/xen-pciback/pciback_ops.c
@@ -227,8 +227,9 @@ int xen_pcibk_enable_msix(struct xen_pcibk_device *pdev,
         /*
          * PCI_COMMAND_MEMORY must be enabled, otherwise we may not be able
          * to access the BARs where the MSI-X entries reside.
+         * But VF devices are unique in which the PF needs to be checked.
          */
-        pci_read_config_word(dev, PCI_COMMAND, &cmd);
+        pci_read_config_word(pci_physfn(dev), PCI_COMMAND, &cmd);
         if (dev->msi_enabled || !(cmd & PCI_COMMAND_MEMORY))
                 return -ENXIO;
 
@@ -332,6 +333,9 @@ void xen_pcibk_do_op(struct work_struct *data)
         struct xen_pcibk_dev_data *dev_data = NULL;
         struct xen_pci_op *op = &pdev->op;
         int test_intx = 0;
+#ifdef CONFIG_PCI_MSI
+        unsigned int nr = 0;
+#endif
 
         *op = pdev->sh_info->op;
         barrier();
@@ -360,6 +364,7 @@ void xen_pcibk_do_op(struct work_struct *data)
                         op->err = xen_pcibk_disable_msi(pdev, dev, op);
                         break;
                 case XEN_PCI_OP_enable_msix:
+                        nr = op->value;
                         op->err = xen_pcibk_enable_msix(pdev, dev, op);
                         break;
                 case XEN_PCI_OP_disable_msix:
@@ -382,7 +387,7 @@ void xen_pcibk_do_op(struct work_struct *data)
         if (op->cmd == XEN_PCI_OP_enable_msix && op->err == 0) {
                 unsigned int i;
 
-                for (i = 0; i < op->value; i++)
+                for (i = 0; i < nr; i++)
                         pdev->sh_info->op.msix_entries[i].vector =
                                 op->msix_entries[i].vector;
         }
diff --git a/drivers/xen/xen-scsiback.c b/drivers/xen/xen-scsiback.c
index ad4eb1024d1f..c46ee189466f 100644
--- a/drivers/xen/xen-scsiback.c
+++ b/drivers/xen/xen-scsiback.c
@@ -849,15 +849,31 @@ static int scsiback_map(struct vscsibk_info *info)
 }
 
 /*
+  Check for a translation entry being present
+*/
+static struct v2p_entry *scsiback_chk_translation_entry(
+        struct vscsibk_info *info, struct ids_tuple *v)
+{
+        struct list_head *head = &(info->v2p_entry_lists);
+        struct v2p_entry *entry;
+
+        list_for_each_entry(entry, head, l)
+                if ((entry->v.chn == v->chn) &&
+                    (entry->v.tgt == v->tgt) &&
+                    (entry->v.lun == v->lun))
+                        return entry;
+
+        return NULL;
+}
+
+/*
   Add a new translation entry
 */
 static int scsiback_add_translation_entry(struct vscsibk_info *info,
                                           char *phy, struct ids_tuple *v)
 {
         int err = 0;
-        struct v2p_entry *entry;
         struct v2p_entry *new;
-        struct list_head *head = &(info->v2p_entry_lists);
         unsigned long flags;
         char *lunp;
         unsigned long long unpacked_lun;
@@ -917,15 +933,10 @@ static int scsiback_add_translation_entry(struct vscsibk_info *info,
         spin_lock_irqsave(&info->v2p_lock, flags);
 
         /* Check double assignment to identical virtual ID */
-        list_for_each_entry(entry, head, l) {
-                if ((entry->v.chn == v->chn) &&
-                    (entry->v.tgt == v->tgt) &&
-                    (entry->v.lun == v->lun)) {
-                        pr_warn("Virtual ID is already used. Assignment was not performed.\n");
-                        err = -EEXIST;
-                        goto out;
-                }
-
+        if (scsiback_chk_translation_entry(info, v)) {
+                pr_warn("Virtual ID is already used. Assignment was not performed.\n");
+                err = -EEXIST;
+                goto out;
         }
 
         /* Create a new translation entry and add to the list */
@@ -933,18 +944,18 @@ static int scsiback_add_translation_entry(struct vscsibk_info *info,
         new->v = *v;
         new->tpg = tpg;
         new->lun = unpacked_lun;
-        list_add_tail(&new->l, head);
+        list_add_tail(&new->l, &info->v2p_entry_lists);
 
 out:
         spin_unlock_irqrestore(&info->v2p_lock, flags);
 
 out_free:
-        mutex_lock(&tpg->tv_tpg_mutex);
-        tpg->tv_tpg_fe_count--;
-        mutex_unlock(&tpg->tv_tpg_mutex);
-
-        if (err)
+        if (err) {
+                mutex_lock(&tpg->tv_tpg_mutex);
+                tpg->tv_tpg_fe_count--;
+                mutex_unlock(&tpg->tv_tpg_mutex);
                 kfree(new);
+        }
 
         return err;
 }
@@ -956,39 +967,40 @@ static void __scsiback_del_translation_entry(struct v2p_entry *entry)
 }
 
 /*
-  Delete the translation entry specfied
+  Delete the translation entry specified
 */
 static int scsiback_del_translation_entry(struct vscsibk_info *info,
                                           struct ids_tuple *v)
 {
         struct v2p_entry *entry;
-        struct list_head *head = &(info->v2p_entry_lists);
         unsigned long flags;
+        int ret = 0;
 
         spin_lock_irqsave(&info->v2p_lock, flags);
         /* Find out the translation entry specified */
-        list_for_each_entry(entry, head, l) {
-                if ((entry->v.chn == v->chn) &&
-                    (entry->v.tgt == v->tgt) &&
-                    (entry->v.lun == v->lun)) {
-                        goto found;
-                }
-        }
-
-        spin_unlock_irqrestore(&info->v2p_lock, flags);
-        return 1;
-
-found:
-        /* Delete the translation entry specfied */
-        __scsiback_del_translation_entry(entry);
+        entry = scsiback_chk_translation_entry(info, v);
+        if (entry)
+                __scsiback_del_translation_entry(entry);
+        else
+                ret = -ENOENT;
 
         spin_unlock_irqrestore(&info->v2p_lock, flags);
-        return 0;
+        return ret;
 }
 
 static void scsiback_do_add_lun(struct vscsibk_info *info, const char *state,
                                 char *phy, struct ids_tuple *vir, int try)
 {
+        struct v2p_entry *entry;
+        unsigned long flags;
+
+        if (try) {
+                spin_lock_irqsave(&info->v2p_lock, flags);
+                entry = scsiback_chk_translation_entry(info, vir);
+                spin_unlock_irqrestore(&info->v2p_lock, flags);
+                if (entry)
+                        return;
+        }
         if (!scsiback_add_translation_entry(info, phy, vir)) {
                 if (xenbus_printf(XBT_NIL, info->dev->nodename, state,
                                   "%d", XenbusStateInitialised)) {
diff --git a/drivers/xen/xenbus/xenbus_dev_frontend.c b/drivers/xen/xenbus/xenbus_dev_frontend.c
index 9433e46518c8..912b64edb42b 100644
--- a/drivers/xen/xenbus/xenbus_dev_frontend.c
+++ b/drivers/xen/xenbus/xenbus_dev_frontend.c
@@ -188,6 +188,8 @@ static int queue_reply(struct list_head *queue, const void *data, size_t len)
 
         if (len == 0)
                 return 0;
+        if (len > XENSTORE_PAYLOAD_MAX)
+                return -EINVAL;
 
         rb = kmalloc(sizeof(*rb) + len, GFP_KERNEL);
         if (rb == NULL)