Merge 4.15-rc6 into char-misc-next

We want the fixes in here as well.

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

299 files changed, 2862 insertions, 1372 deletions

diff --git a/drivers/acpi/apei/erst.c b/drivers/acpi/apei/erst.c
index 6742f6c68034..9bff853e85f3 100644
--- a/drivers/acpi/apei/erst.c
+++ b/drivers/acpi/apei/erst.c
@@ -1007,7 +1007,7 @@ skip:
         /* The record may be cleared by others, try read next record */
         if (len == -ENOENT)
                 goto skip;
-        else if (len < sizeof(*rcd)) {
+        else if (len < 0 || len < sizeof(*rcd)) {
                 rc = -EIO;
                 goto out;
         }
diff --git a/drivers/acpi/cppc_acpi.c b/drivers/acpi/cppc_acpi.c
index 30e84cc600ae..06ea4749ebd9 100644
--- a/drivers/acpi/cppc_acpi.c
+++ b/drivers/acpi/cppc_acpi.c
@@ -1171,7 +1171,7 @@ int cppc_set_perf(int cpu, struct cppc_perf_ctrls *perf_ctrls)
         struct cpc_desc *cpc_desc = per_cpu(cpc_desc_ptr, cpu);
         struct cpc_register_resource *desired_reg;
         int pcc_ss_id = per_cpu(cpu_pcc_subspace_idx, cpu);
-        struct cppc_pcc_data *pcc_ss_data = pcc_data[pcc_ss_id];
+        struct cppc_pcc_data *pcc_ss_data;
         int ret = 0;
 
         if (!cpc_desc || pcc_ss_id < 0) {
diff --git a/drivers/acpi/device_pm.c b/drivers/acpi/device_pm.c
index e4ffaeec9ec2..a4c8ad98560d 100644
--- a/drivers/acpi/device_pm.c
+++ b/drivers/acpi/device_pm.c
@@ -1138,7 +1138,7 @@ int acpi_subsys_thaw_noirq(struct device *dev)
          * skip all of the subsequent "thaw" callbacks for the device.
          */
         if (dev_pm_smart_suspend_and_suspended(dev)) {
-                dev->power.direct_complete = true;
+                dev_pm_skip_next_resume_phases(dev);
                 return 0;
         }
 
diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
index ff2580e7611d..abeb4df4f22e 100644
--- a/drivers/acpi/nfit/core.c
+++ b/drivers/acpi/nfit/core.c
@@ -1670,6 +1670,11 @@ static int acpi_nfit_add_dimm(struct acpi_nfit_desc *acpi_desc,
                                 dev_name(&adev_dimm->dev));
                 return -ENXIO;
         }
+        /*
+         * Record nfit_mem for the notification path to track back to
+         * the nfit sysfs attributes for this dimm device object.
+         */
+        dev_set_drvdata(&adev_dimm->dev, nfit_mem);
 
         /*
          * Until standardization materializes we need to consider 4
@@ -1752,9 +1757,11 @@ static void shutdown_dimm_notify(void *data)
                         sysfs_put(nfit_mem->flags_attr);
                         nfit_mem->flags_attr = NULL;
                 }
-                if (adev_dimm)
+                if (adev_dimm) {
                         acpi_remove_notify_handler(adev_dimm->handle,
                                         ACPI_DEVICE_NOTIFY, acpi_nvdimm_notify);
+                        dev_set_drvdata(&adev_dimm->dev, NULL);
+                }
         }
         mutex_unlock(&acpi_desc->init_mutex);
 }
diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index a54a0f1f69a9..778caed570c6 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -482,7 +482,8 @@ enum binder_deferred_state {
  * @tsk                   task_struct for group_leader of process
  *                        (invariant after initialized)
  * @files                 files_struct for process
- *                        (invariant after initialized)
+ *                        (protected by @files_lock)
+ * @files_lock            mutex to protect @files
  * @deferred_work_node:   element for binder_deferred_list
  *                        (protected by binder_deferred_lock)
  * @deferred_work:        bitmap of deferred work to perform
@@ -530,6 +531,7 @@ struct binder_proc {
         int pid;
         struct task_struct *tsk;
         struct files_struct *files;
+        struct mutex files_lock;
         struct hlist_node deferred_work_node;
         int deferred_work;
         bool is_dead;
@@ -924,20 +926,26 @@ static void binder_inc_node_tmpref_ilocked(struct binder_node *node);
 
 static int task_get_unused_fd_flags(struct binder_proc *proc, int flags)
 {
-        struct files_struct *files = proc->files;
         unsigned long rlim_cur;
         unsigned long irqs;
+        int ret;
 
-        if (files == NULL)
-                return -ESRCH;
-
-        if (!lock_task_sighand(proc->tsk, &irqs))
-                return -EMFILE;
-
+        mutex_lock(&proc->files_lock);
+        if (proc->files == NULL) {
+                ret = -ESRCH;
+                goto err;
+        }
+        if (!lock_task_sighand(proc->tsk, &irqs)) {
+                ret = -EMFILE;
+                goto err;
+        }
         rlim_cur = task_rlimit(proc->tsk, RLIMIT_NOFILE);
         unlock_task_sighand(proc->tsk, &irqs);
 
-        return __alloc_fd(files, 0, rlim_cur, flags);
+        ret = __alloc_fd(proc->files, 0, rlim_cur, flags);
+err:
+        mutex_unlock(&proc->files_lock);
+        return ret;
 }
 
 /*
@@ -946,8 +954,10 @@ static int task_get_unused_fd_flags(struct binder_proc *proc, int flags)
 static void task_fd_install(
         struct binder_proc *proc, unsigned int fd, struct file *file)
 {
+        mutex_lock(&proc->files_lock);
         if (proc->files)
                 __fd_install(proc->files, fd, file);
+        mutex_unlock(&proc->files_lock);
 }
 
 /*
@@ -957,9 +967,11 @@ static long task_close_fd(struct binder_proc *proc, unsigned int fd)
 {
         int retval;
 
-        if (proc->files == NULL)
-                return -ESRCH;
-
+        mutex_lock(&proc->files_lock);
+        if (proc->files == NULL) {
+                retval = -ESRCH;
+                goto err;
+        }
         retval = __close_fd(proc->files, fd);
         /* can't restart close syscall because file table entry was cleared */
         if (unlikely(retval == -ERESTARTSYS ||
@@ -967,7 +979,8 @@ static long task_close_fd(struct binder_proc *proc, unsigned int fd)
                      retval == -ERESTARTNOHAND ||
                      retval == -ERESTART_RESTARTBLOCK))
                 retval = -EINTR;
-
+err:
+        mutex_unlock(&proc->files_lock);
         return retval;
 }
 
@@ -4690,7 +4703,9 @@ static int binder_mmap(struct file *filp, struct vm_area_struct *vma)
         ret = binder_alloc_mmap_handler(&proc->alloc, vma);
         if (ret)
                 return ret;
+        mutex_lock(&proc->files_lock);
         proc->files = get_files_struct(current);
+        mutex_unlock(&proc->files_lock);
         return 0;
 
 err_bad_arg:
@@ -4714,6 +4729,7 @@ static int binder_open(struct inode *nodp, struct file *filp)
         spin_lock_init(&proc->outer_lock);
         get_task_struct(current->group_leader);
         proc->tsk = current->group_leader;
+        mutex_init(&proc->files_lock);
         INIT_LIST_HEAD(&proc->todo);
         proc->default_priority = task_nice(current);
         binder_dev = container_of(filp->private_data, struct binder_device,
@@ -4966,9 +4982,11 @@ static void binder_deferred_func(struct work_struct *work)
 
                 files = NULL;
                 if (defer & BINDER_DEFERRED_PUT_FILES) {
+                        mutex_lock(&proc->files_lock);
                         files = proc->files;
                         if (files)
                                 proc->files = NULL;
+                        mutex_unlock(&proc->files_lock);
                 }
 
                 if (defer & BINDER_DEFERRED_FLUSH)
diff --git a/drivers/ata/ahci_mtk.c b/drivers/ata/ahci_mtk.c
index 80854f71559a..0ae6971c2a4c 100644
--- a/drivers/ata/ahci_mtk.c
+++ b/drivers/ata/ahci_mtk.c
@@ -1,5 +1,5 @@
 /*
- * MeidaTek AHCI SATA driver
+ * MediaTek AHCI SATA driver
  *
  * Copyright (c) 2017 MediaTek Inc.
  * Author: Ryder Lee <ryder.lee@mediatek.com>
@@ -25,7 +25,7 @@
 #include <linux/reset.h>
 #include "ahci.h"
 
-#define DRV_NAME                "ahci"
+#define DRV_NAME                "ahci-mtk"
 
 #define SYS_CFG                 0x14
 #define SYS_CFG_SATA_MSK        GENMASK(31, 30)
@@ -192,5 +192,5 @@ static struct platform_driver mtk_ahci_driver = {
 };
 module_platform_driver(mtk_ahci_driver);
 
-MODULE_DESCRIPTION("MeidaTek SATA AHCI Driver");
+MODULE_DESCRIPTION("MediaTek SATA AHCI Driver");
 MODULE_LICENSE("GPL v2");
diff --git a/drivers/ata/ahci_qoriq.c b/drivers/ata/ahci_qoriq.c
index b6b0bf76dfc7..2685f28160f7 100644
--- a/drivers/ata/ahci_qoriq.c
+++ b/drivers/ata/ahci_qoriq.c
@@ -35,6 +35,8 @@
 
 /* port register default value */
 #define AHCI_PORT_PHY_1_CFG     0xa003fffe
+#define AHCI_PORT_PHY2_CFG      0x28184d1f
+#define AHCI_PORT_PHY3_CFG      0x0e081509
 #define AHCI_PORT_TRANS_CFG     0x08000029
 #define AHCI_PORT_AXICC_CFG     0x3fffffff
 
@@ -183,6 +185,8 @@ static int ahci_qoriq_phy_init(struct ahci_host_priv *hpriv)
                 writel(readl(qpriv->ecc_addr) | ECC_DIS_ARMV8_CH2,
                                 qpriv->ecc_addr);
                 writel(AHCI_PORT_PHY_1_CFG, reg_base + PORT_PHY1);
+                writel(AHCI_PORT_PHY2_CFG, reg_base + PORT_PHY2);
+                writel(AHCI_PORT_PHY3_CFG, reg_base + PORT_PHY3);
                 writel(AHCI_PORT_TRANS_CFG, reg_base + PORT_TRANS);
                 if (qpriv->is_dmacoherent)
                         writel(AHCI_PORT_AXICC_CFG, reg_base + PORT_AXICC);
@@ -190,6 +194,8 @@ static int ahci_qoriq_phy_init(struct ahci_host_priv *hpriv)
 
         case AHCI_LS2080A:
                 writel(AHCI_PORT_PHY_1_CFG, reg_base + PORT_PHY1);
+                writel(AHCI_PORT_PHY2_CFG, reg_base + PORT_PHY2);
+                writel(AHCI_PORT_PHY3_CFG, reg_base + PORT_PHY3);
                 writel(AHCI_PORT_TRANS_CFG, reg_base + PORT_TRANS);
                 if (qpriv->is_dmacoherent)
                         writel(AHCI_PORT_AXICC_CFG, reg_base + PORT_AXICC);
@@ -201,6 +207,8 @@ static int ahci_qoriq_phy_init(struct ahci_host_priv *hpriv)
                 writel(readl(qpriv->ecc_addr) | ECC_DIS_ARMV8_CH2,
                                 qpriv->ecc_addr);
                 writel(AHCI_PORT_PHY_1_CFG, reg_base + PORT_PHY1);
+                writel(AHCI_PORT_PHY2_CFG, reg_base + PORT_PHY2);
+                writel(AHCI_PORT_PHY3_CFG, reg_base + PORT_PHY3);
                 writel(AHCI_PORT_TRANS_CFG, reg_base + PORT_TRANS);
                 if (qpriv->is_dmacoherent)
                         writel(AHCI_PORT_AXICC_CFG, reg_base + PORT_AXICC);
@@ -212,6 +220,8 @@ static int ahci_qoriq_phy_init(struct ahci_host_priv *hpriv)
                 writel(readl(qpriv->ecc_addr) | ECC_DIS_LS1088A,
                        qpriv->ecc_addr);
                 writel(AHCI_PORT_PHY_1_CFG, reg_base + PORT_PHY1);
+                writel(AHCI_PORT_PHY2_CFG, reg_base + PORT_PHY2);
+                writel(AHCI_PORT_PHY3_CFG, reg_base + PORT_PHY3);
                 writel(AHCI_PORT_TRANS_CFG, reg_base + PORT_TRANS);
                 if (qpriv->is_dmacoherent)
                         writel(AHCI_PORT_AXICC_CFG, reg_base + PORT_AXICC);
@@ -219,6 +229,8 @@ static int ahci_qoriq_phy_init(struct ahci_host_priv *hpriv)
 
         case AHCI_LS2088A:
                 writel(AHCI_PORT_PHY_1_CFG, reg_base + PORT_PHY1);
+                writel(AHCI_PORT_PHY2_CFG, reg_base + PORT_PHY2);
+                writel(AHCI_PORT_PHY3_CFG, reg_base + PORT_PHY3);
                 writel(AHCI_PORT_TRANS_CFG, reg_base + PORT_TRANS);
                 if (qpriv->is_dmacoherent)
                         writel(AHCI_PORT_AXICC_CFG, reg_base + PORT_AXICC);
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 2a882929de4a..8193b38a1cae 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -3082,13 +3082,19 @@ int sata_down_spd_limit(struct ata_link *link, u32 spd_limit)
         bit = fls(mask) - 1;
         mask &= ~(1 << bit);
 
-        /* Mask off all speeds higher than or equal to the current
-         * one.  Force 1.5Gbps if current SPD is not available.
+        /*
+         * Mask off all speeds higher than or equal to the current one.  At
+         * this point, if current SPD is not available and we previously
+         * recorded the link speed from SStatus, the driver has already
+         * masked off the highest bit so mask should already be 1 or 0.
+         * Otherwise, we should not force 1.5Gbps on a link where we have
+         * not previously recorded speed from SStatus.  Just return in this
+         * case.
          */
         if (spd > 1)
                 mask &= (1 << (spd - 1)) - 1;
         else
-                mask &= 1;
+                return -EINVAL;
 
         /* were we already at the bottom? */
         if (!mask)
diff --git a/drivers/ata/pata_pdc2027x.c b/drivers/ata/pata_pdc2027x.c
index ffd8d33c6e0f..6db2e34bd52f 100644
--- a/drivers/ata/pata_pdc2027x.c
+++ b/drivers/ata/pata_pdc2027x.c
@@ -82,7 +82,7 @@ static int pdc2027x_set_mode(struct ata_link *link, struct ata_device **r_failed
  * is issued to the device. However, if the controller clock is 133MHz,
  * the following tables must be used.
  */
-static struct pdc2027x_pio_timing {
+static const struct pdc2027x_pio_timing {
         u8 value0, value1, value2;
 } pdc2027x_pio_timing_tbl[] = {
         { 0xfb, 0x2b, 0xac }, /* PIO mode 0 */
@@ -92,7 +92,7 @@ static struct pdc2027x_pio_timing {
         { 0x23, 0x09, 0x25 }, /* PIO mode 4, IORDY on, Prefetch off */
 };
 
-static struct pdc2027x_mdma_timing {
+static const struct pdc2027x_mdma_timing {
         u8 value0, value1;
 } pdc2027x_mdma_timing_tbl[] = {
         { 0xdf, 0x5f }, /* MDMA mode 0 */
@@ -100,7 +100,7 @@ static struct pdc2027x_mdma_timing {
         { 0x69, 0x25 }, /* MDMA mode 2 */
 };
 
-static struct pdc2027x_udma_timing {
+static const struct pdc2027x_udma_timing {
         u8 value0, value1, value2;
 } pdc2027x_udma_timing_tbl[] = {
         { 0x4a, 0x0f, 0xd5 }, /* UDMA mode 0 */
@@ -649,7 +649,7 @@ static long pdc_detect_pll_input_clock(struct ata_host *host)
  * @host: target ATA host
  * @board_idx: board identifier
  */
-static int pdc_hardware_init(struct ata_host *host, unsigned int board_idx)
+static void pdc_hardware_init(struct ata_host *host, unsigned int board_idx)
 {
         long pll_clock;
 
@@ -665,8 +665,6 @@ static int pdc_hardware_init(struct ata_host *host, unsigned int board_idx)
 
         /* Adjust PLL control register */
         pdc_adjust_pll(host, pll_clock, board_idx);
-
-        return 0;
 }
 
 /**
@@ -753,8 +751,7 @@ static int pdc2027x_init_one(struct pci_dev *pdev,
         //pci_enable_intx(pdev);
 
         /* initialize adapter */
-        if (pdc_hardware_init(host, board_idx) != 0)
-                return -EIO;
+        pdc_hardware_init(host, board_idx);
 
         pci_set_master(pdev);
         return ata_host_activate(host, pdev->irq, ata_bmdma_interrupt,
@@ -778,8 +775,7 @@ static int pdc2027x_reinit_one(struct pci_dev *pdev)
         else
                 board_idx = PDC_UDMA_133;
 
-        if (pdc_hardware_init(host, board_idx))
-                return -EIO;
+        pdc_hardware_init(host, board_idx);
 
         ata_host_resume(host);
         return 0;
diff --git a/drivers/base/cacheinfo.c b/drivers/base/cacheinfo.c
index eb3af2739537..07532d83be0b 100644
--- a/drivers/base/cacheinfo.c
+++ b/drivers/base/cacheinfo.c
@@ -186,6 +186,11 @@ static void cache_associativity(struct cacheinfo *this_leaf)
                 this_leaf->ways_of_associativity = (size / nr_sets) / line_size;
 }
 
+static bool cache_node_is_unified(struct cacheinfo *this_leaf)
+{
+        return of_property_read_bool(this_leaf->of_node, "cache-unified");
+}
+
 static void cache_of_override_properties(unsigned int cpu)
 {
         int index;
@@ -194,6 +199,14 @@ static void cache_of_override_properties(unsigned int cpu)
 
         for (index = 0; index < cache_leaves(cpu); index++) {
                 this_leaf = this_cpu_ci->info_list + index;
+                /*
+                 * init_cache_level must setup the cache level correctly
+                 * overriding the architecturally specified levels, so
+                 * if type is NONE at this stage, it should be unified
+                 */
+                if (this_leaf->type == CACHE_TYPE_NOCACHE &&
+                    cache_node_is_unified(this_leaf))
+                        this_leaf->type = CACHE_TYPE_UNIFIED;
                 cache_size(this_leaf);
                 cache_get_line_size(this_leaf);
                 cache_nr_sets(this_leaf);
diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c
index db2f04415927..08744b572af6 100644
--- a/drivers/base/power/main.c
+++ b/drivers/base/power/main.c
@@ -526,6 +526,21 @@ static void dpm_watchdog_clear(struct dpm_watchdog *wd)
 /*------------------------- Resume routines -------------------------*/
 
 /**
+ * dev_pm_skip_next_resume_phases - Skip next system resume phases for device.
+ * @dev: Target device.
+ *
+ * Make the core skip the "early resume" and "resume" phases for @dev.
+ *
+ * This function can be called by middle-layer code during the "noirq" phase of
+ * system resume if necessary, but not by device drivers.
+ */
+void dev_pm_skip_next_resume_phases(struct device *dev)
+{
+        dev->power.is_late_suspended = false;
+        dev->power.is_suspended = false;
+}
+
+/**
  * device_resume_noirq - Execute a "noirq resume" callback for given device.
  * @dev: Device to handle.
  * @state: PM transition of the system being carried out.
diff --git a/drivers/block/null_blk.c b/drivers/block/null_blk.c
index ccb9975a97fa..ad0477ae820f 100644
--- a/drivers/block/null_blk.c
+++ b/drivers/block/null_blk.c
@@ -35,13 +35,13 @@ static inline u64 mb_per_tick(int mbps)
 struct nullb_cmd {
         struct list_head list;
         struct llist_node ll_list;
-        call_single_data_t csd;
+        struct __call_single_data csd;
         struct request *rq;
         struct bio *bio;
         unsigned int tag;
+        blk_status_t error;
         struct nullb_queue *nq;
         struct hrtimer timer;
-        blk_status_t error;
 };
 
 struct nullb_queue {
diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
index 779869ed32b1..71fad747c0c7 100644
--- a/drivers/char/ipmi/ipmi_si_intf.c
+++ b/drivers/char/ipmi/ipmi_si_intf.c
@@ -199,6 +199,9 @@ struct smi_info {
         /* The timer for this si. */
         struct timer_list   si_timer;
 
+        /* This flag is set, if the timer can be set */
+        bool                timer_can_start;
+
         /* This flag is set, if the timer is running (timer_pending() isn't enough) */
         bool                timer_running;
 
@@ -355,6 +358,8 @@ out:
 
 static void smi_mod_timer(struct smi_info *smi_info, unsigned long new_val)
 {
+        if (!smi_info->timer_can_start)
+                return;
         smi_info->last_timeout_jiffies = jiffies;
         mod_timer(&smi_info->si_timer, new_val);
         smi_info->timer_running = true;
@@ -374,21 +379,18 @@ static void start_new_msg(struct smi_info *smi_info, unsigned char *msg,
         smi_info->handlers->start_transaction(smi_info->si_sm, msg, size);
 }
 
-static void start_check_enables(struct smi_info *smi_info, bool start_timer)
+static void start_check_enables(struct smi_info *smi_info)
 {
         unsigned char msg[2];
 
         msg[0] = (IPMI_NETFN_APP_REQUEST << 2);
         msg[1] = IPMI_GET_BMC_GLOBAL_ENABLES_CMD;
 
-        if (start_timer)
-                start_new_msg(smi_info, msg, 2);
-        else
-                smi_info->handlers->start_transaction(smi_info->si_sm, msg, 2);
+        start_new_msg(smi_info, msg, 2);
         smi_info->si_state = SI_CHECKING_ENABLES;
 }
 
-static void start_clear_flags(struct smi_info *smi_info, bool start_timer)
+static void start_clear_flags(struct smi_info *smi_info)
 {
         unsigned char msg[3];
 
@@ -397,10 +399,7 @@ static void start_clear_flags(struct smi_info *smi_info, bool start_timer)
         msg[1] = IPMI_CLEAR_MSG_FLAGS_CMD;
         msg[2] = WDT_PRE_TIMEOUT_INT;
 
-        if (start_timer)
-                start_new_msg(smi_info, msg, 3);
-        else
-                smi_info->handlers->start_transaction(smi_info->si_sm, msg, 3);
+        start_new_msg(smi_info, msg, 3);
         smi_info->si_state = SI_CLEARING_FLAGS;
 }
 
@@ -435,11 +434,11 @@ static void start_getting_events(struct smi_info *smi_info)
  * Note that we cannot just use disable_irq(), since the interrupt may
  * be shared.
  */
-static inline bool disable_si_irq(struct smi_info *smi_info, bool start_timer)
+static inline bool disable_si_irq(struct smi_info *smi_info)
 {
         if ((smi_info->io.irq) && (!smi_info->interrupt_disabled)) {
                 smi_info->interrupt_disabled = true;
-                start_check_enables(smi_info, start_timer);
+                start_check_enables(smi_info);
                 return true;
         }
         return false;
@@ -449,7 +448,7 @@ static inline bool enable_si_irq(struct smi_info *smi_info)
 {
         if ((smi_info->io.irq) && (smi_info->interrupt_disabled)) {
                 smi_info->interrupt_disabled = false;
-                start_check_enables(smi_info, true);
+                start_check_enables(smi_info);
                 return true;
         }
         return false;
@@ -467,7 +466,7 @@ static struct ipmi_smi_msg *alloc_msg_handle_irq(struct smi_info *smi_info)
 
         msg = ipmi_alloc_smi_msg();
         if (!msg) {
-                if (!disable_si_irq(smi_info, true))
+                if (!disable_si_irq(smi_info))
                         smi_info->si_state = SI_NORMAL;
         } else if (enable_si_irq(smi_info)) {
                 ipmi_free_smi_msg(msg);
@@ -483,7 +482,7 @@ retry:
                 /* Watchdog pre-timeout */
                 smi_inc_stat(smi_info, watchdog_pretimeouts);
 
-                start_clear_flags(smi_info, true);
+                start_clear_flags(smi_info);
                 smi_info->msg_flags &= ~WDT_PRE_TIMEOUT_INT;
                 if (smi_info->intf)
                         ipmi_smi_watchdog_pretimeout(smi_info->intf);
@@ -866,7 +865,7 @@ restart:
                  * disable and messages disabled.
                  */
                 if (smi_info->supports_event_msg_buff || smi_info->io.irq) {
-                        start_check_enables(smi_info, true);
+                        start_check_enables(smi_info);
                 } else {
                         smi_info->curr_msg = alloc_msg_handle_irq(smi_info);
                         if (!smi_info->curr_msg)
@@ -1167,6 +1166,7 @@ static int smi_start_processing(void       *send_info,
 
         /* Set up the timer that drives the interface. */
         timer_setup(&new_smi->si_timer, smi_timeout, 0);
+        new_smi->timer_can_start = true;
         smi_mod_timer(new_smi, jiffies + SI_TIMEOUT_JIFFIES);
 
         /* Try to claim any interrupts. */
@@ -1936,10 +1936,12 @@ static void check_for_broken_irqs(struct smi_info *smi_info)
         check_set_rcv_irq(smi_info);
 }
 
-static inline void wait_for_timer_and_thread(struct smi_info *smi_info)
+static inline void stop_timer_and_thread(struct smi_info *smi_info)
 {
         if (smi_info->thread != NULL)
                 kthread_stop(smi_info->thread);
+
+        smi_info->timer_can_start = false;
         if (smi_info->timer_running)
                 del_timer_sync(&smi_info->si_timer);
 }
@@ -2152,7 +2154,7 @@ static int try_smi_init(struct smi_info *new_smi)
          * Start clearing the flags before we enable interrupts or the
          * timer to avoid racing with the timer.
          */
-        start_clear_flags(new_smi, false);
+        start_clear_flags(new_smi);
 
         /*
          * IRQ is defined to be set when non-zero.  req_events will
@@ -2238,7 +2240,7 @@ out_err_remove_attrs:
         dev_set_drvdata(new_smi->io.dev, NULL);
 
 out_err_stop_timer:
-        wait_for_timer_and_thread(new_smi);
+        stop_timer_and_thread(new_smi);
 
 out_err:
         new_smi->interrupt_disabled = true;
@@ -2388,7 +2390,7 @@ static void cleanup_one_si(struct smi_info *to_clean)
          */
         if (to_clean->io.irq_cleanup)
                 to_clean->io.irq_cleanup(&to_clean->io);
-        wait_for_timer_and_thread(to_clean);
+        stop_timer_and_thread(to_clean);
 
         /*
          * Timeouts are stopped, now make sure the interrupts are off
@@ -2400,7 +2402,7 @@ static void cleanup_one_si(struct smi_info *to_clean)
                 schedule_timeout_uninterruptible(1);
         }
         if (to_clean->handlers)
-                disable_si_irq(to_clean, false);
+                disable_si_irq(to_clean);
         while (to_clean->curr_msg || (to_clean->si_state != SI_NORMAL)) {
                 poll(to_clean);
                 schedule_timeout_uninterruptible(1);
diff --git a/drivers/char/ipmi/ipmi_si_parisc.c b/drivers/char/ipmi/ipmi_si_parisc.c
index 090b073ab441..6b10f0e18a95 100644
--- a/drivers/char/ipmi/ipmi_si_parisc.c
+++ b/drivers/char/ipmi/ipmi_si_parisc.c
@@ -10,6 +10,8 @@ static int __init ipmi_parisc_probe(struct parisc_device *dev)
 {
         struct si_sm_io io;
 
+        memset(&io, 0, sizeof(io));
+
         io.si_type      = SI_KCS;
         io.addr_source  = SI_DEVICETREE;
         io.addr_type    = IPMI_MEM_ADDR_SPACE;
diff --git a/drivers/char/ipmi/ipmi_si_pci.c b/drivers/char/ipmi/ipmi_si_pci.c
index 99771f5cad07..27dd11c49d21 100644
--- a/drivers/char/ipmi/ipmi_si_pci.c
+++ b/drivers/char/ipmi/ipmi_si_pci.c
@@ -103,10 +103,13 @@ static int ipmi_pci_probe(struct pci_dev *pdev,
         io.addr_source_cleanup = ipmi_pci_cleanup;
         io.addr_source_data = pdev;
 
-        if (pci_resource_flags(pdev, 0) & IORESOURCE_IO)
+        if (pci_resource_flags(pdev, 0) & IORESOURCE_IO) {
                 io.addr_type = IPMI_IO_ADDR_SPACE;
-        else
+                io.io_setup = ipmi_si_port_setup;
+        } else {
                 io.addr_type = IPMI_MEM_ADDR_SPACE;
+                io.io_setup = ipmi_si_mem_setup;
+        }
         io.addr_data = pci_resource_start(pdev, 0);
 
         io.regspacing = ipmi_pci_probe_regspacing(&io);
diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
index 647d056df88c..b56c11f51baf 100644
--- a/drivers/clk/clk.c
+++ b/drivers/clk/clk.c
@@ -220,7 +220,8 @@ static bool clk_core_is_enabled(struct clk_core *core)
 
         ret = core->ops->is_enabled(core->hw);
 done:
-        clk_pm_runtime_put(core);
+        if (core->dev)
+                pm_runtime_put(core->dev);
 
         return ret;
 }
@@ -1564,6 +1565,9 @@ static void clk_change_rate(struct clk_core *core)
                 best_parent_rate = core->parent->rate;
         }
 
+        if (clk_pm_runtime_get(core))
+                return;
+
         if (core->flags & CLK_SET_RATE_UNGATE) {
                 unsigned long flags;
 
@@ -1634,6 +1638,8 @@ static void clk_change_rate(struct clk_core *core)
         /* handle the new child who might not be in core->children yet */
         if (core->new_child)
                 clk_change_rate(core->new_child);
+
+        clk_pm_runtime_put(core);
 }
 
 static int clk_core_set_rate_nolock(struct clk_core *core,
diff --git a/drivers/clk/sunxi/clk-sun9i-mmc.c b/drivers/clk/sunxi/clk-sun9i-mmc.c
index a1a634253d6f..f00d8758ba24 100644
--- a/drivers/clk/sunxi/clk-sun9i-mmc.c
+++ b/drivers/clk/sunxi/clk-sun9i-mmc.c
@@ -16,6 +16,7 @@
 
 #include <linux/clk.h>
 #include <linux/clk-provider.h>
+#include <linux/delay.h>
 #include <linux/init.h>
 #include <linux/of.h>
 #include <linux/of_device.h>
@@ -83,9 +84,20 @@ static int sun9i_mmc_reset_deassert(struct reset_controller_dev *rcdev,
         return 0;
 }
 
+static int sun9i_mmc_reset_reset(struct reset_controller_dev *rcdev,
+                                 unsigned long id)
+{
+        sun9i_mmc_reset_assert(rcdev, id);
+        udelay(10);
+        sun9i_mmc_reset_deassert(rcdev, id);
+
+        return 0;
+}
+
 static const struct reset_control_ops sun9i_mmc_reset_ops = {
         .assert         = sun9i_mmc_reset_assert,
         .deassert       = sun9i_mmc_reset_deassert,
+        .reset          = sun9i_mmc_reset_reset,
 };
 
 static int sun9i_a80_mmc_config_clk_probe(struct platform_device *pdev)
diff --git a/drivers/cpufreq/cpufreq_governor.c b/drivers/cpufreq/cpufreq_governor.c
index 58d4f4e1ad6a..ca38229b045a 100644
--- a/drivers/cpufreq/cpufreq_governor.c
+++ b/drivers/cpufreq/cpufreq_governor.c
@@ -22,6 +22,8 @@
 
 #include "cpufreq_governor.h"
 
+#define CPUFREQ_DBS_MIN_SAMPLING_INTERVAL       (2 * TICK_NSEC / NSEC_PER_USEC)
+
 static DEFINE_PER_CPU(struct cpu_dbs_info, cpu_dbs);
 
 static DEFINE_MUTEX(gov_dbs_data_mutex);
@@ -47,11 +49,15 @@ ssize_t store_sampling_rate(struct gov_attr_set *attr_set, const char *buf,
 {
         struct dbs_data *dbs_data = to_dbs_data(attr_set);
         struct policy_dbs_info *policy_dbs;
+        unsigned int sampling_interval;
         int ret;
-        ret = sscanf(buf, "%u", &dbs_data->sampling_rate);
-        if (ret != 1)
+
+        ret = sscanf(buf, "%u", &sampling_interval);
+        if (ret != 1 || sampling_interval < CPUFREQ_DBS_MIN_SAMPLING_INTERVAL)
                 return -EINVAL;
 
+        dbs_data->sampling_rate = sampling_interval;
+
         /*
          * We are operating under dbs_data->mutex and so the list and its
          * entries can't be freed concurrently.
@@ -430,7 +436,14 @@ int cpufreq_dbs_governor_init(struct cpufreq_policy *policy)
         if (ret)
                 goto free_policy_dbs_info;
 
-        dbs_data->sampling_rate = cpufreq_policy_transition_delay_us(policy);
+        /*
+         * The sampling interval should not be less than the transition latency
+         * of the CPU and it also cannot be too small for dbs_update() to work
+         * correctly.
+         */
+        dbs_data->sampling_rate = max_t(unsigned int,
+                                        CPUFREQ_DBS_MIN_SAMPLING_INTERVAL,
+                                        cpufreq_policy_transition_delay_us(policy));
 
         if (!have_governor_per_policy())
                 gov->gdbs_data = dbs_data;
diff --git a/drivers/cpufreq/imx6q-cpufreq.c b/drivers/cpufreq/imx6q-cpufreq.c
index 628fe899cb48..d9b2c2de49c4 100644
--- a/drivers/cpufreq/imx6q-cpufreq.c
+++ b/drivers/cpufreq/imx6q-cpufreq.c
@@ -226,17 +226,18 @@ static void imx6q_opp_check_speed_grading(struct device *dev)
         val >>= OCOTP_CFG3_SPEED_SHIFT;
         val &= 0x3;
 
-        if ((val != OCOTP_CFG3_SPEED_1P2GHZ) &&
-             of_machine_is_compatible("fsl,imx6q"))
-                if (dev_pm_opp_disable(dev, 1200000000))
-                        dev_warn(dev, "failed to disable 1.2GHz OPP\n");
         if (val < OCOTP_CFG3_SPEED_996MHZ)
                 if (dev_pm_opp_disable(dev, 996000000))
                         dev_warn(dev, "failed to disable 996MHz OPP\n");
-        if (of_machine_is_compatible("fsl,imx6q")) {
+
+        if (of_machine_is_compatible("fsl,imx6q") ||
+            of_machine_is_compatible("fsl,imx6qp")) {
                 if (val != OCOTP_CFG3_SPEED_852MHZ)
                         if (dev_pm_opp_disable(dev, 852000000))
                                 dev_warn(dev, "failed to disable 852MHz OPP\n");
+                if (val != OCOTP_CFG3_SPEED_1P2GHZ)
+                        if (dev_pm_opp_disable(dev, 1200000000))
+                                dev_warn(dev, "failed to disable 1.2GHz OPP\n");
         }
         iounmap(base);
 put_node:
diff --git a/drivers/dma/at_hdmac.c b/drivers/dma/at_hdmac.c
index fbab271b3bf9..a861b5b4d443 100644
--- a/drivers/dma/at_hdmac.c
+++ b/drivers/dma/at_hdmac.c
@@ -708,7 +708,7 @@ atc_prep_dma_interleaved(struct dma_chan *chan,
                          unsigned long flags)
 {
         struct at_dma_chan      *atchan = to_at_dma_chan(chan);
-        struct data_chunk       *first = xt->sgl;
+        struct data_chunk       *first;
         struct at_desc          *desc = NULL;
         size_t                  xfer_count;
         unsigned int            dwidth;
@@ -720,6 +720,8 @@ atc_prep_dma_interleaved(struct dma_chan *chan,
         if (unlikely(!xt || xt->numf != 1 || !xt->frame_size))
                 return NULL;
 
+        first = xt->sgl;
+
         dev_info(chan2dev(chan),
                  "%s: src=%pad, dest=%pad, numf=%d, frame_size=%d, flags=0x%lx\n",
                 __func__, &xt->src_start, &xt->dst_start, xt->numf,
diff --git a/drivers/dma/dma-jz4740.c b/drivers/dma/dma-jz4740.c
index d50273fed715..afd5e10f8927 100644
--- a/drivers/dma/dma-jz4740.c
+++ b/drivers/dma/dma-jz4740.c
@@ -555,7 +555,7 @@ static int jz4740_dma_probe(struct platform_device *pdev)
 
         ret = dma_async_device_register(dd);
         if (ret)
-                return ret;
+                goto err_clk;
 
         irq = platform_get_irq(pdev, 0);
         ret = request_irq(irq, jz4740_dma_irq, 0, dev_name(&pdev->dev), dmadev);
@@ -568,6 +568,8 @@ static int jz4740_dma_probe(struct platform_device *pdev)
 
 err_unregister:
         dma_async_device_unregister(dd);
+err_clk:
+        clk_disable_unprepare(dmadev->clk);
         return ret;
 }
 
diff --git a/drivers/dma/dmatest.c b/drivers/dma/dmatest.c
index 47edc7fbf91f..ec5f9d2bc820 100644
--- a/drivers/dma/dmatest.c
+++ b/drivers/dma/dmatest.c
@@ -155,6 +155,12 @@ MODULE_PARM_DESC(run, "Run the test (default: false)");
 #define PATTERN_COUNT_MASK      0x1f
 #define PATTERN_MEMSET_IDX      0x01
 
+/* poor man's completion - we want to use wait_event_freezable() on it */
+struct dmatest_done {
+        bool                    done;
+        wait_queue_head_t       *wait;
+};
+
 struct dmatest_thread {
         struct list_head        node;
         struct dmatest_info     *info;
@@ -165,6 +171,8 @@ struct dmatest_thread {
         u8                      **dsts;
         u8                      **udsts;
         enum dma_transaction_type type;
+        wait_queue_head_t done_wait;
+        struct dmatest_done test_done;
         bool                    done;
 };
 
@@ -342,18 +350,25 @@ static unsigned int dmatest_verify(u8 **bufs, unsigned int start,
         return error_count;
 }
 
-/* poor man's completion - we want to use wait_event_freezable() on it */
-struct dmatest_done {
-        bool                    done;
-        wait_queue_head_t       *wait;
-};
 
 static void dmatest_callback(void *arg)
 {
         struct dmatest_done *done = arg;
-
-        done->done = true;
-        wake_up_all(done->wait);
+        struct dmatest_thread *thread =
+                container_of(arg, struct dmatest_thread, done_wait);
+        if (!thread->done) {
+                done->done = true;
+                wake_up_all(done->wait);
+        } else {
+                /*
+                 * If thread->done, it means that this callback occurred
+                 * after the parent thread has cleaned up. This can
+                 * happen in the case that driver doesn't implement
+                 * the terminate_all() functionality and a dma operation
+                 * did not occur within the timeout period
+                 */
+                WARN(1, "dmatest: Kernel memory may be corrupted!!\n");
+        }
 }
 
 static unsigned int min_odd(unsigned int x, unsigned int y)
@@ -424,9 +439,8 @@ static unsigned long long dmatest_KBs(s64 runtime, unsigned long long len)
  */
 static int dmatest_func(void *data)
 {
-        DECLARE_WAIT_QUEUE_HEAD_ONSTACK(done_wait);
         struct dmatest_thread   *thread = data;
-        struct dmatest_done     done = { .wait = &done_wait };
+        struct dmatest_done     *done = &thread->test_done;
         struct dmatest_info     *info;
         struct dmatest_params   *params;
         struct dma_chan         *chan;
@@ -673,9 +687,9 @@ static int dmatest_func(void *data)
                         continue;
                 }
 
-                done.done = false;
+                done->done = false;
                 tx->callback = dmatest_callback;
-                tx->callback_param = &done;
+                tx->callback_param = done;
                 cookie = tx->tx_submit(tx);
 
                 if (dma_submit_error(cookie)) {
@@ -688,21 +702,12 @@ static int dmatest_func(void *data)
                 }
                 dma_async_issue_pending(chan);
 
-                wait_event_freezable_timeout(done_wait, done.done,
+                wait_event_freezable_timeout(thread->done_wait, done->done,
                                              msecs_to_jiffies(params->timeout));
 
                 status = dma_async_is_tx_complete(chan, cookie, NULL, NULL);
 
-                if (!done.done) {
-                        /*
-                         * We're leaving the timed out dma operation with
-                         * dangling pointer to done_wait.  To make this
-                         * correct, we'll need to allocate wait_done for
-                         * each test iteration and perform "who's gonna
-                         * free it this time?" dancing.  For now, just
-                         * leave it dangling.
-                         */
-                        WARN(1, "dmatest: Kernel stack may be corrupted!!\n");
+                if (!done->done) {
                         dmaengine_unmap_put(um);
                         result("test timed out", total_tests, src_off, dst_off,
                                len, 0);
@@ -789,7 +794,7 @@ err_thread_type:
                 dmatest_KBs(runtime, total_len), ret);
 
         /* terminate all transfers on specified channels */
-        if (ret)
+        if (ret || failed_tests)
                 dmaengine_terminate_all(chan);
 
         thread->done = true;
@@ -849,6 +854,8 @@ static int dmatest_add_threads(struct dmatest_info *info,
                 thread->info = info;
                 thread->chan = dtc->chan;
                 thread->type = type;
+                thread->test_done.wait = &thread->done_wait;
+                init_waitqueue_head(&thread->done_wait);
                 smp_wmb();
                 thread->task = kthread_create(dmatest_func, thread, "%s-%s%u",
                                 dma_chan_name(chan), op, i);
diff --git a/drivers/dma/fsl-edma.c b/drivers/dma/fsl-edma.c
index 6775f2c74e25..c7568869284e 100644
--- a/drivers/dma/fsl-edma.c
+++ b/drivers/dma/fsl-edma.c
@@ -863,11 +863,11 @@ static void fsl_edma_irq_exit(
         }
 }
 
-static void fsl_disable_clocks(struct fsl_edma_engine *fsl_edma)
+static void fsl_disable_clocks(struct fsl_edma_engine *fsl_edma, int nr_clocks)
 {
         int i;
 
-        for (i = 0; i < DMAMUX_NR; i++)
+        for (i = 0; i < nr_clocks; i++)
                 clk_disable_unprepare(fsl_edma->muxclk[i]);
 }
 
@@ -904,25 +904,25 @@ static int fsl_edma_probe(struct platform_device *pdev)
 
                 res = platform_get_resource(pdev, IORESOURCE_MEM, 1 + i);
                 fsl_edma->muxbase[i] = devm_ioremap_resource(&pdev->dev, res);
-                if (IS_ERR(fsl_edma->muxbase[i]))
+                if (IS_ERR(fsl_edma->muxbase[i])) {
+                        /* on error: disable all previously enabled clks */
+                        fsl_disable_clocks(fsl_edma, i);
                         return PTR_ERR(fsl_edma->muxbase[i]);
+                }
 
                 sprintf(clkname, "dmamux%d", i);
                 fsl_edma->muxclk[i] = devm_clk_get(&pdev->dev, clkname);
                 if (IS_ERR(fsl_edma->muxclk[i])) {
                         dev_err(&pdev->dev, "Missing DMAMUX block clock.\n");
+                        /* on error: disable all previously enabled clks */
+                        fsl_disable_clocks(fsl_edma, i);
                         return PTR_ERR(fsl_edma->muxclk[i]);
                 }
 
                 ret = clk_prepare_enable(fsl_edma->muxclk[i]);
-                if (ret) {
-                        /* disable only clks which were enabled on error */
-                        for (; i >= 0; i--)
-                                clk_disable_unprepare(fsl_edma->muxclk[i]);
-
-                        dev_err(&pdev->dev, "DMAMUX clk block failed.\n");
-                        return ret;
-                }
+                if (ret)
+                        /* on error: disable all previously enabled clks */
+                        fsl_disable_clocks(fsl_edma, i);
 
         }
 
@@ -976,7 +976,7 @@ static int fsl_edma_probe(struct platform_device *pdev)
         if (ret) {
                 dev_err(&pdev->dev,
                         "Can't register Freescale eDMA engine. (%d)\n", ret);
-                fsl_disable_clocks(fsl_edma);
+                fsl_disable_clocks(fsl_edma, DMAMUX_NR);
                 return ret;
         }
 
@@ -985,7 +985,7 @@ static int fsl_edma_probe(struct platform_device *pdev)
                 dev_err(&pdev->dev,
                         "Can't register Freescale eDMA of_dma. (%d)\n", ret);
                 dma_async_device_unregister(&fsl_edma->dma_dev);
-                fsl_disable_clocks(fsl_edma);
+                fsl_disable_clocks(fsl_edma, DMAMUX_NR);
                 return ret;
         }
 
@@ -1015,7 +1015,7 @@ static int fsl_edma_remove(struct platform_device *pdev)
         fsl_edma_cleanup_vchan(&fsl_edma->dma_dev);
         of_dma_controller_free(np);
         dma_async_device_unregister(&fsl_edma->dma_dev);
-        fsl_disable_clocks(fsl_edma);
+        fsl_disable_clocks(fsl_edma, DMAMUX_NR);
 
         return 0;
 }
diff --git a/drivers/dma/ioat/init.c b/drivers/dma/ioat/init.c
index 2f31d3d0caa6..7792a9186f9c 100644
--- a/drivers/dma/ioat/init.c
+++ b/drivers/dma/ioat/init.c
@@ -390,7 +390,7 @@ static int ioat_dma_self_test(struct ioatdma_device *ioat_dma)
         if (memcmp(src, dest, IOAT_TEST_SIZE)) {
                 dev_err(dev, "Self-test copy failed compare, disabling\n");
                 err = -ENODEV;
-                goto free_resources;
+                goto unmap_dma;
         }
 
 unmap_dma:
diff --git a/drivers/gpio/gpio-bcm-kona.c b/drivers/gpio/gpio-bcm-kona.c
index dfcf56ee3c61..76861a00bb92 100644
--- a/drivers/gpio/gpio-bcm-kona.c
+++ b/drivers/gpio/gpio-bcm-kona.c
@@ -522,6 +522,7 @@ static struct of_device_id const bcm_kona_gpio_of_match[] = {
  * category than their parents, so it won't report false recursion.
  */
 static struct lock_class_key gpio_lock_class;
+static struct lock_class_key gpio_request_class;
 
 static int bcm_kona_gpio_irq_map(struct irq_domain *d, unsigned int irq,
                                  irq_hw_number_t hwirq)
@@ -531,7 +532,7 @@ static int bcm_kona_gpio_irq_map(struct irq_domain *d, unsigned int irq,
         ret = irq_set_chip_data(irq, d->host_data);
         if (ret < 0)
                 return ret;
-        irq_set_lockdep_class(irq, &gpio_lock_class);
+        irq_set_lockdep_class(irq, &gpio_lock_class, &gpio_request_class);
         irq_set_chip_and_handler(irq, &bcm_gpio_irq_chip, handle_simple_irq);
         irq_set_noprobe(irq);
 
diff --git a/drivers/gpio/gpio-brcmstb.c b/drivers/gpio/gpio-brcmstb.c
index 545d43a587b7..bb4f8cf18bd9 100644
--- a/drivers/gpio/gpio-brcmstb.c
+++ b/drivers/gpio/gpio-brcmstb.c
@@ -327,6 +327,7 @@ static struct brcmstb_gpio_bank *brcmstb_gpio_hwirq_to_bank(
  * category than their parents, so it won't report false recursion.
  */
 static struct lock_class_key brcmstb_gpio_irq_lock_class;
+static struct lock_class_key brcmstb_gpio_irq_request_class;
 
 
 static int brcmstb_gpio_irq_map(struct irq_domain *d, unsigned int irq,
@@ -346,7 +347,8 @@ static int brcmstb_gpio_irq_map(struct irq_domain *d, unsigned int irq,
         ret = irq_set_chip_data(irq, &bank->gc);
         if (ret < 0)
                 return ret;
-        irq_set_lockdep_class(irq, &brcmstb_gpio_irq_lock_class);
+        irq_set_lockdep_class(irq, &brcmstb_gpio_irq_lock_class,
+                              &brcmstb_gpio_irq_request_class);
         irq_set_chip_and_handler(irq, &priv->irq_chip, handle_level_irq);
         irq_set_noprobe(irq);
         return 0;
diff --git a/drivers/gpio/gpio-reg.c b/drivers/gpio/gpio-reg.c
index 23e771dba4c1..e85903eddc68 100644
--- a/drivers/gpio/gpio-reg.c
+++ b/drivers/gpio/gpio-reg.c
@@ -103,8 +103,8 @@ static int gpio_reg_to_irq(struct gpio_chip *gc, unsigned offset)
         struct gpio_reg *r = to_gpio_reg(gc);
         int irq = r->irqs[offset];
 
-        if (irq >= 0 && r->irq.domain)
-                irq = irq_find_mapping(r->irq.domain, irq);
+        if (irq >= 0 && r->irqdomain)
+                irq = irq_find_mapping(r->irqdomain, irq);
 
         return irq;
 }
diff --git a/drivers/gpio/gpio-tegra.c b/drivers/gpio/gpio-tegra.c
index 8db47f671708..02fa8fe2292a 100644
--- a/drivers/gpio/gpio-tegra.c
+++ b/drivers/gpio/gpio-tegra.c
@@ -565,6 +565,7 @@ static const struct dev_pm_ops tegra_gpio_pm_ops = {
  * than their parents, so it won't report false recursion.
  */
 static struct lock_class_key gpio_lock_class;
+static struct lock_class_key gpio_request_class;
 
 static int tegra_gpio_probe(struct platform_device *pdev)
 {
@@ -670,7 +671,8 @@ static int tegra_gpio_probe(struct platform_device *pdev)
 
                 bank = &tgi->bank_info[GPIO_BANK(gpio)];
 
-                irq_set_lockdep_class(irq, &gpio_lock_class);
+                irq_set_lockdep_class(irq, &gpio_lock_class,
+                                      &gpio_request_class);
                 irq_set_chip_data(irq, bank);
                 irq_set_chip_and_handler(irq, &tgi->ic, handle_simple_irq);
         }
diff --git a/drivers/gpio/gpio-xgene-sb.c b/drivers/gpio/gpio-xgene-sb.c
index 2313af82fad3..acd59113e08b 100644
--- a/drivers/gpio/gpio-xgene-sb.c
+++ b/drivers/gpio/gpio-xgene-sb.c
@@ -139,7 +139,7 @@ static int xgene_gpio_sb_to_irq(struct gpio_chip *gc, u32 gpio)
 
 static int xgene_gpio_sb_domain_activate(struct irq_domain *d,
                                          struct irq_data *irq_data,
-                                         bool early)
+                                         bool reserve)
 {
         struct xgene_gpio_sb *priv = d->host_data;
         u32 gpio = HWIRQ_TO_GPIO(priv, irq_data->hwirq);
diff --git a/drivers/gpio/gpiolib-acpi.c b/drivers/gpio/gpiolib-acpi.c
index eb4528c87c0b..d6f3d9ee1350 100644
--- a/drivers/gpio/gpiolib-acpi.c
+++ b/drivers/gpio/gpiolib-acpi.c
@@ -1074,7 +1074,7 @@ void acpi_gpiochip_add(struct gpio_chip *chip)
         }
 
         if (!chip->names)
-                devprop_gpiochip_set_names(chip);
+                devprop_gpiochip_set_names(chip, dev_fwnode(chip->parent));
 
         acpi_gpiochip_request_regions(acpi_gpio);
         acpi_gpiochip_scan_gpios(acpi_gpio);
diff --git a/drivers/gpio/gpiolib-devprop.c b/drivers/gpio/gpiolib-devprop.c
index 27f383bda7d9..f748aa3e77f7 100644
--- a/drivers/gpio/gpiolib-devprop.c
+++ b/drivers/gpio/gpiolib-devprop.c
@@ -19,30 +19,27 @@
 /**
  * devprop_gpiochip_set_names - Set GPIO line names using device properties
  * @chip: GPIO chip whose lines should be named, if possible
+ * @fwnode: Property Node containing the gpio-line-names property
  *
  * Looks for device property "gpio-line-names" and if it exists assigns
  * GPIO line names for the chip. The memory allocated for the assigned
  * names belong to the underlying firmware node and should not be released
  * by the caller.
  */
-void devprop_gpiochip_set_names(struct gpio_chip *chip)
+void devprop_gpiochip_set_names(struct gpio_chip *chip,
+                                const struct fwnode_handle *fwnode)
 {
         struct gpio_device *gdev = chip->gpiodev;
         const char **names;
         int ret, i;
 
-        if (!chip->parent) {
-                dev_warn(&gdev->dev, "GPIO chip parent is NULL\n");
-                return;
-        }
-
-        ret = device_property_read_string_array(chip->parent, "gpio-line-names",
+        ret = fwnode_property_read_string_array(fwnode, "gpio-line-names",
                                                 NULL, 0);
         if (ret < 0)
                 return;
 
         if (ret != gdev->ngpio) {
-                dev_warn(chip->parent,
+                dev_warn(&gdev->dev,
                          "names %d do not match number of GPIOs %d\n", ret,
                          gdev->ngpio);
                 return;
@@ -52,10 +49,10 @@ void devprop_gpiochip_set_names(struct gpio_chip *chip)
         if (!names)
                 return;
 
-        ret = device_property_read_string_array(chip->parent, "gpio-line-names",
+        ret = fwnode_property_read_string_array(fwnode, "gpio-line-names",
                                                 names, gdev->ngpio);
         if (ret < 0) {
-                dev_warn(chip->parent, "failed to read GPIO line names\n");
+                dev_warn(&gdev->dev, "failed to read GPIO line names\n");
                 kfree(names);
                 return;
         }
diff --git a/drivers/gpio/gpiolib-of.c b/drivers/gpio/gpiolib-of.c
index e0d59e61b52f..72a0695d2ac3 100644
--- a/drivers/gpio/gpiolib-of.c
+++ b/drivers/gpio/gpiolib-of.c
@@ -493,7 +493,8 @@ int of_gpiochip_add(struct gpio_chip *chip)
 
         /* If the chip defines names itself, these take precedence */
         if (!chip->names)
-                devprop_gpiochip_set_names(chip);
+                devprop_gpiochip_set_names(chip,
+                                           of_fwnode_handle(chip->of_node));
 
         of_node_get(chip->of_node);
 
diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index aad84a6306c4..44332b793718 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -73,7 +73,8 @@ LIST_HEAD(gpio_devices);
 
 static void gpiochip_free_hogs(struct gpio_chip *chip);
 static int gpiochip_add_irqchip(struct gpio_chip *gpiochip,
-                                struct lock_class_key *key);
+                                struct lock_class_key *lock_key,
+                                struct lock_class_key *request_key);
 static void gpiochip_irqchip_remove(struct gpio_chip *gpiochip);
 static int gpiochip_irqchip_init_valid_mask(struct gpio_chip *gpiochip);
 static void gpiochip_irqchip_free_valid_mask(struct gpio_chip *gpiochip);
@@ -1100,7 +1101,8 @@ static void gpiochip_setup_devs(void)
 }
 
 int gpiochip_add_data_with_key(struct gpio_chip *chip, void *data,
-                               struct lock_class_key *key)
+                               struct lock_class_key *lock_key,
+                               struct lock_class_key *request_key)
 {
         unsigned long   flags;
         int             status = 0;
@@ -1246,7 +1248,7 @@ int gpiochip_add_data_with_key(struct gpio_chip *chip, void *data,
         if (status)
                 goto err_remove_from_list;
 
-        status = gpiochip_add_irqchip(chip, key);
+        status = gpiochip_add_irqchip(chip, lock_key, request_key);
         if (status)
                 goto err_remove_chip;
 
@@ -1632,7 +1634,7 @@ int gpiochip_irq_map(struct irq_domain *d, unsigned int irq,
          * This lock class tells lockdep that GPIO irqs are in a different
          * category than their parents, so it won't report false recursion.
          */
-        irq_set_lockdep_class(irq, chip->irq.lock_key);
+        irq_set_lockdep_class(irq, chip->irq.lock_key, chip->irq.request_key);
         irq_set_chip_and_handler(irq, chip->irq.chip, chip->irq.handler);
         /* Chips that use nested thread handlers have them marked */
         if (chip->irq.threaded)
@@ -1712,10 +1714,12 @@ static int gpiochip_to_irq(struct gpio_chip *chip, unsigned offset)
 /**
  * gpiochip_add_irqchip() - adds an IRQ chip to a GPIO chip
  * @gpiochip: the GPIO chip to add the IRQ chip to
- * @lock_key: lockdep class
+ * @lock_key: lockdep class for IRQ lock
+ * @request_key: lockdep class for IRQ request
  */
 static int gpiochip_add_irqchip(struct gpio_chip *gpiochip,
-                                struct lock_class_key *lock_key)
+                                struct lock_class_key *lock_key,
+                                struct lock_class_key *request_key)
 {
         struct irq_chip *irqchip = gpiochip->irq.chip;
         const struct irq_domain_ops *ops;
@@ -1753,6 +1757,7 @@ static int gpiochip_add_irqchip(struct gpio_chip *gpiochip,
         gpiochip->to_irq = gpiochip_to_irq;
         gpiochip->irq.default_type = type;
         gpiochip->irq.lock_key = lock_key;
+        gpiochip->irq.request_key = request_key;
 
         if (gpiochip->irq.domain_ops)
                 ops = gpiochip->irq.domain_ops;
@@ -1850,7 +1855,8 @@ static void gpiochip_irqchip_remove(struct gpio_chip *gpiochip)
  * @type: the default type for IRQs on this irqchip, pass IRQ_TYPE_NONE
  * to have the core avoid setting up any default type in the hardware.
  * @threaded: whether this irqchip uses a nested thread handler
- * @lock_key: lockdep class
+ * @lock_key: lockdep class for IRQ lock
+ * @request_key: lockdep class for IRQ request
  *
  * This function closely associates a certain irqchip with a certain
  * gpiochip, providing an irq domain to translate the local IRQs to
@@ -1872,7 +1878,8 @@ int gpiochip_irqchip_add_key(struct gpio_chip *gpiochip,
                              irq_flow_handler_t handler,
                              unsigned int type,
                              bool threaded,
-                             struct lock_class_key *lock_key)
+                             struct lock_class_key *lock_key,
+                             struct lock_class_key *request_key)
 {
         struct device_node *of_node;
 
@@ -1913,6 +1920,7 @@ int gpiochip_irqchip_add_key(struct gpio_chip *gpiochip,
         gpiochip->irq.default_type = type;
         gpiochip->to_irq = gpiochip_to_irq;
         gpiochip->irq.lock_key = lock_key;
+        gpiochip->irq.request_key = request_key;
         gpiochip->irq.domain = irq_domain_add_simple(of_node,
                                         gpiochip->ngpio, first_irq,
                                         &gpiochip_domain_ops, gpiochip);
@@ -1940,7 +1948,8 @@ EXPORT_SYMBOL_GPL(gpiochip_irqchip_add_key);
 #else /* CONFIG_GPIOLIB_IRQCHIP */
 
 static inline int gpiochip_add_irqchip(struct gpio_chip *gpiochip,
-                                       struct lock_class_key *key)
+                                       struct lock_class_key *lock_key,
+                                       struct lock_class_key *request_key)
 {
         return 0;
 }
diff --git a/drivers/gpio/gpiolib.h b/drivers/gpio/gpiolib.h
index af48322839c3..6c44d1652139 100644
--- a/drivers/gpio/gpiolib.h
+++ b/drivers/gpio/gpiolib.h
@@ -228,7 +228,8 @@ static inline int gpio_chip_hwgpio(const struct gpio_desc *desc)
         return desc - &desc->gdev->descs[0];
 }
 
-void devprop_gpiochip_set_names(struct gpio_chip *chip);
+void devprop_gpiochip_set_names(struct gpio_chip *chip,
+                                const struct fwnode_handle *fwnode);
 
 /* With descriptor prefix */
 
diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
index da43813d67a4..5aeb5f8816f3 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
@@ -2467,7 +2467,7 @@ static int gfx_v9_0_kiq_kcq_enable(struct amdgpu_device *adev)
                                   PACKET3_MAP_QUEUES_PIPE(ring->pipe) |
                                   PACKET3_MAP_QUEUES_ME((ring->me == 1 ? 0 : 1)) |
                                   PACKET3_MAP_QUEUES_QUEUE_TYPE(0) | /*queue_type: normal compute queue */
-                                  PACKET3_MAP_QUEUES_ALLOC_FORMAT(1) | /* alloc format: all_on_one_pipe */
+                                  PACKET3_MAP_QUEUES_ALLOC_FORMAT(0) | /* alloc format: all_on_one_pipe */
                                   PACKET3_MAP_QUEUES_ENGINE_SEL(0) | /* engine_sel: compute */
                                   PACKET3_MAP_QUEUES_NUM_QUEUES(1)); /* num_queues: must be 1 */
                 amdgpu_ring_write(kiq_ring, PACKET3_MAP_QUEUES_DOORBELL_OFFSET(ring->doorbell_index));
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index f71fe6d2ddda..bb5fa895fb64 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -2336,7 +2336,7 @@ create_stream_for_sink(struct amdgpu_dm_connector *aconnector,
                        const struct dm_connector_state *dm_state)
 {
         struct drm_display_mode *preferred_mode = NULL;
-        const struct drm_connector *drm_connector;
+        struct drm_connector *drm_connector;
         struct dc_stream_state *stream = NULL;
         struct drm_display_mode mode = *drm_mode;
         bool native_mode_found = false;
@@ -2355,11 +2355,13 @@ create_stream_for_sink(struct amdgpu_dm_connector *aconnector,
 
         if (!aconnector->dc_sink) {
                 /*
-                 * Exclude MST from creating fake_sink
-                 * TODO: need to enable MST into fake_sink feature
+                 * Create dc_sink when necessary to MST
+                 * Don't apply fake_sink to MST
                  */
-                if (aconnector->mst_port)
-                        goto stream_create_fail;
+                if (aconnector->mst_port) {
+                        dm_dp_mst_dc_sink_create(drm_connector);
+                        goto mst_dc_sink_create_done;
+                }
 
                 if (create_fake_sink(aconnector))
                         goto stream_create_fail;
@@ -2410,6 +2412,7 @@ create_stream_for_sink(struct amdgpu_dm_connector *aconnector,
 stream_create_fail:
 dm_state_null:
 drm_connector_null:
+mst_dc_sink_create_done:
         return stream;
 }
 
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h
index 117521c6a6ed..0230250a1164 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h
@@ -189,6 +189,8 @@ struct amdgpu_dm_connector {
         struct mutex hpd_lock;
 
         bool fake_enable;
+
+        bool mst_connected;
 };
 
 #define to_amdgpu_dm_connector(x) container_of(x, struct amdgpu_dm_connector, base)
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
index f8efb98b1fa7..638c2c2b5cd7 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
@@ -185,6 +185,42 @@ static int dm_connector_update_modes(struct drm_connector *connector,
         return ret;
 }
 
+void dm_dp_mst_dc_sink_create(struct drm_connector *connector)
+{
+        struct amdgpu_dm_connector *aconnector = to_amdgpu_dm_connector(connector);
+        struct edid *edid;
+        struct dc_sink *dc_sink;
+        struct dc_sink_init_data init_params = {
+                        .link = aconnector->dc_link,
+                        .sink_signal = SIGNAL_TYPE_DISPLAY_PORT_MST };
+
+        edid = drm_dp_mst_get_edid(connector, &aconnector->mst_port->mst_mgr, aconnector->port);
+
+        if (!edid) {
+                drm_mode_connector_update_edid_property(
+                        &aconnector->base,
+                        NULL);
+                return;
+        }
+
+        aconnector->edid = edid;
+
+        dc_sink = dc_link_add_remote_sink(
+                aconnector->dc_link,
+                (uint8_t *)aconnector->edid,
+                (aconnector->edid->extensions + 1) * EDID_LENGTH,
+                &init_params);
+
+        dc_sink->priv = aconnector;
+        aconnector->dc_sink = dc_sink;
+
+        amdgpu_dm_add_sink_to_freesync_module(
+                        connector, aconnector->edid);
+
+        drm_mode_connector_update_edid_property(
+                                        &aconnector->base, aconnector->edid);
+}
+
 static int dm_dp_mst_get_modes(struct drm_connector *connector)
 {
         struct amdgpu_dm_connector *aconnector = to_amdgpu_dm_connector(connector);
@@ -311,6 +347,7 @@ dm_dp_add_mst_connector(struct drm_dp_mst_topology_mgr *mgr,
                         drm_mode_connector_set_path_property(connector, pathprop);
 
                         drm_connector_list_iter_end(&conn_iter);
+                        aconnector->mst_connected = true;
                         return &aconnector->base;
                 }
         }
@@ -363,6 +400,8 @@ dm_dp_add_mst_connector(struct drm_dp_mst_topology_mgr *mgr,
          */
         amdgpu_dm_connector_funcs_reset(connector);
 
+        aconnector->mst_connected = true;
+
         DRM_INFO("DM_MST: added connector: %p [id: %d] [master: %p]\n",
                         aconnector, connector->base.id, aconnector->mst_port);
 
@@ -394,6 +433,8 @@ static void dm_dp_destroy_mst_connector(struct drm_dp_mst_topology_mgr *mgr,
         drm_mode_connector_update_edid_property(
                         &aconnector->base,
                         NULL);
+
+        aconnector->mst_connected = false;
 }
 
 static void dm_dp_mst_hotplug(struct drm_dp_mst_topology_mgr *mgr)
@@ -404,10 +445,18 @@ static void dm_dp_mst_hotplug(struct drm_dp_mst_topology_mgr *mgr)
         drm_kms_helper_hotplug_event(dev);
 }
 
+static void dm_dp_mst_link_status_reset(struct drm_connector *connector)
+{
+        mutex_lock(&connector->dev->mode_config.mutex);
+        drm_mode_connector_set_link_status_property(connector, DRM_MODE_LINK_STATUS_BAD);
+        mutex_unlock(&connector->dev->mode_config.mutex);
+}
+
 static void dm_dp_mst_register_connector(struct drm_connector *connector)
 {
         struct drm_device *dev = connector->dev;
         struct amdgpu_device *adev = dev->dev_private;
+        struct amdgpu_dm_connector *aconnector = to_amdgpu_dm_connector(connector);
 
         if (adev->mode_info.rfbdev)
                 drm_fb_helper_add_one_connector(&adev->mode_info.rfbdev->helper, connector);
@@ -416,6 +465,8 @@ static void dm_dp_mst_register_connector(struct drm_connector *connector)
 
         drm_connector_register(connector);
 
+        if (aconnector->mst_connected)
+                dm_dp_mst_link_status_reset(connector);
 }
 
 static const struct drm_dp_mst_topology_cbs dm_mst_cbs = {
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.h b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.h
index 2da851b40042..8cf51da26657 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.h
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.h
@@ -31,5 +31,6 @@ struct amdgpu_dm_connector;
 
 void amdgpu_dm_initialize_dp_connector(struct amdgpu_display_manager *dm,
                                        struct amdgpu_dm_connector *aconnector);
+void dm_dp_mst_dc_sink_create(struct drm_connector *connector);
 
 #endif
diff --git a/drivers/gpu/drm/amd/display/dc/calcs/dcn_calcs.c b/drivers/gpu/drm/amd/display/dc/calcs/dcn_calcs.c
index 3dce35e66b09..b142629a1058 100644
--- a/drivers/gpu/drm/amd/display/dc/calcs/dcn_calcs.c
+++ b/drivers/gpu/drm/amd/display/dc/calcs/dcn_calcs.c
@@ -900,6 +900,15 @@ bool dcn_validate_bandwidth(
                         v->override_vta_ps[input_idx] = pipe->plane_res.scl_data.taps.v_taps;
                         v->override_hta_pschroma[input_idx] = pipe->plane_res.scl_data.taps.h_taps_c;
                         v->override_vta_pschroma[input_idx] = pipe->plane_res.scl_data.taps.v_taps_c;
+                        /*
+                         * Spreadsheet doesn't handle taps_c is one properly,
+                         * need to force Chroma to always be scaled to pass
+                         * bandwidth validation.
+                         */
+                        if (v->override_hta_pschroma[input_idx] == 1)
+                                v->override_hta_pschroma[input_idx] = 2;
+                        if (v->override_vta_pschroma[input_idx] == 1)
+                                v->override_vta_pschroma[input_idx] = 2;
                         v->source_scan[input_idx] = (pipe->plane_state->rotation % 2) ? dcn_bw_vert : dcn_bw_hor;
                 }
                 if (v->is_line_buffer_bpp_fixed == dcn_bw_yes)
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
index e27ed4a45265..42a111b9505d 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
@@ -1801,7 +1801,7 @@ static void disable_link(struct dc_link *link, enum signal_type signal)
                 link->link_enc->funcs->disable_output(link->link_enc, signal, link);
 }
 
-bool dp_active_dongle_validate_timing(
+static bool dp_active_dongle_validate_timing(
                 const struct dc_crtc_timing *timing,
                 const struct dc_dongle_caps *dongle_caps)
 {
@@ -1833,6 +1833,8 @@ bool dp_active_dongle_validate_timing(
         /* Check Color Depth and Pixel Clock */
         if (timing->pixel_encoding == PIXEL_ENCODING_YCBCR420)
                 required_pix_clk /= 2;
+        else if (timing->pixel_encoding == PIXEL_ENCODING_YCBCR422)
+                required_pix_clk = required_pix_clk * 2 / 3;
 
         switch (timing->display_color_depth) {
         case COLOR_DEPTH_666:
diff --git a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
index 07ff8d2faf3f..d844fadcd56f 100644
--- a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
+++ b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
@@ -2866,16 +2866,19 @@ static void dce110_apply_ctx_for_surface(
                 int num_planes,
                 struct dc_state *context)
 {
-        int i, be_idx;
+        int i;
 
         if (num_planes == 0)
                 return;
 
-        be_idx = -1;
         for (i = 0; i < dc->res_pool->pipe_count; i++) {
-                if (stream == context->res_ctx.pipe_ctx[i].stream) {
-                        be_idx = context->res_ctx.pipe_ctx[i].stream_res.tg->inst;
-                        break;
+                struct pipe_ctx *pipe_ctx = &context->res_ctx.pipe_ctx[i];
+                struct pipe_ctx *old_pipe_ctx = &dc->current_state->res_ctx.pipe_ctx[i];
+
+                if (stream == pipe_ctx->stream) {
+                        if (!pipe_ctx->top_pipe &&
+                                (pipe_ctx->plane_state || old_pipe_ctx->plane_state))
+                                dc->hwss.pipe_control_lock(dc, pipe_ctx, true);
                 }
         }
 
@@ -2895,9 +2898,22 @@ static void dce110_apply_ctx_for_surface(
                                         context->stream_count);
 
                 dce110_program_front_end_for_pipe(dc, pipe_ctx);
+
+                dc->hwss.update_plane_addr(dc, pipe_ctx);
+
                 program_surface_visibility(dc, pipe_ctx);
 
         }
+
+        for (i = 0; i < dc->res_pool->pipe_count; i++) {
+                struct pipe_ctx *pipe_ctx = &context->res_ctx.pipe_ctx[i];
+                struct pipe_ctx *old_pipe_ctx = &dc->current_state->res_ctx.pipe_ctx[i];
+
+                if ((stream == pipe_ctx->stream) &&
+                        (!pipe_ctx->top_pipe) &&
+                        (pipe_ctx->plane_state || old_pipe_ctx->plane_state))
+                        dc->hwss.pipe_control_lock(dc, pipe_ctx, false);
+        }
 }
 
 static void dce110_power_down_fe(struct dc *dc, int fe_idx)
diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_dpp.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_dpp.c
index 74e7c82bdc76..a9d55d0dd69e 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_dpp.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_dpp.c
@@ -159,11 +159,10 @@ bool dpp_get_optimal_number_of_taps(
                         scl_data->taps.h_taps = 1;
                 if (IDENTITY_RATIO(scl_data->ratios.vert))
                         scl_data->taps.v_taps = 1;
-                /*
-                 * Spreadsheet doesn't handle taps_c is one properly,
-                 * need to force Chroma to always be scaled to pass
-                 * bandwidth validation.
-                 */
+                if (IDENTITY_RATIO(scl_data->ratios.horz_c))
+                        scl_data->taps.h_taps_c = 1;
+                if (IDENTITY_RATIO(scl_data->ratios.vert_c))
+                        scl_data->taps.v_taps_c = 1;
         }
 
         return true;
diff --git a/drivers/gpu/drm/drm_connector.c b/drivers/gpu/drm/drm_connector.c
index 482014137953..9ae236036e32 100644
--- a/drivers/gpu/drm/drm_connector.c
+++ b/drivers/gpu/drm/drm_connector.c
@@ -152,14 +152,23 @@ static void drm_connector_free(struct kref *kref)
         connector->funcs->destroy(connector);
 }
 
-static void drm_connector_free_work_fn(struct work_struct *work)
+void drm_connector_free_work_fn(struct work_struct *work)
 {
-        struct drm_connector *connector =
-                container_of(work, struct drm_connector, free_work);
-        struct drm_device *dev = connector->dev;
+        struct drm_connector *connector, *n;
+        struct drm_device *dev =
+                container_of(work, struct drm_device, mode_config.connector_free_work);
+        struct drm_mode_config *config = &dev->mode_config;
+        unsigned long flags;
+        struct llist_node *freed;
 
-        drm_mode_object_unregister(dev, &connector->base);
-        connector->funcs->destroy(connector);
+        spin_lock_irqsave(&config->connector_list_lock, flags);
+        freed = llist_del_all(&config->connector_free_list);
+        spin_unlock_irqrestore(&config->connector_list_lock, flags);
+
+        llist_for_each_entry_safe(connector, n, freed, free_node) {
+                drm_mode_object_unregister(dev, &connector->base);
+                connector->funcs->destroy(connector);
+        }
 }
 
 /**
@@ -191,8 +200,6 @@ int drm_connector_init(struct drm_device *dev,
         if (ret)
                 return ret;
 
-        INIT_WORK(&connector->free_work, drm_connector_free_work_fn);
-
         connector->base.properties = &connector->properties;
         connector->dev = dev;
         connector->funcs = funcs;
@@ -547,10 +554,17 @@ EXPORT_SYMBOL(drm_connector_list_iter_begin);
  * actually release the connector when dropping our final reference.
  */
 static void
-drm_connector_put_safe(struct drm_connector *conn)
+__drm_connector_put_safe(struct drm_connector *conn)
 {
-        if (refcount_dec_and_test(&conn->base.refcount.refcount))
-                schedule_work(&conn->free_work);
+        struct drm_mode_config *config = &conn->dev->mode_config;
+
+        lockdep_assert_held(&config->connector_list_lock);
+
+        if (!refcount_dec_and_test(&conn->base.refcount.refcount))
+                return;
+
+        llist_add(&conn->free_node, &config->connector_free_list);
+        schedule_work(&config->connector_free_work);
 }
 
 /**
@@ -582,10 +596,10 @@ drm_connector_list_iter_next(struct drm_connector_list_iter *iter)
 
                 /* loop until it's not a zombie connector */
         } while (!kref_get_unless_zero(&iter->conn->base.refcount));
-        spin_unlock_irqrestore(&config->connector_list_lock, flags);
 
         if (old_conn)
-                drm_connector_put_safe(old_conn);
+                __drm_connector_put_safe(old_conn);
+        spin_unlock_irqrestore(&config->connector_list_lock, flags);
 
         return iter->conn;
 }
@@ -602,9 +616,15 @@ EXPORT_SYMBOL(drm_connector_list_iter_next);
  */
 void drm_connector_list_iter_end(struct drm_connector_list_iter *iter)
 {
+        struct drm_mode_config *config = &iter->dev->mode_config;
+        unsigned long flags;
+
         iter->dev = NULL;
-        if (iter->conn)
-                drm_connector_put_safe(iter->conn);
+        if (iter->conn) {
+                spin_lock_irqsave(&config->connector_list_lock, flags);
+                __drm_connector_put_safe(iter->conn);
+                spin_unlock_irqrestore(&config->connector_list_lock, flags);
+        }
         lock_release(&connector_list_iter_dep_map, 0, _RET_IP_);
 }
 EXPORT_SYMBOL(drm_connector_list_iter_end);
@@ -1231,6 +1251,19 @@ int drm_mode_connector_update_edid_property(struct drm_connector *connector,
         if (edid)
                 size = EDID_LENGTH * (1 + edid->extensions);
 
+        /* Set the display info, using edid if available, otherwise
+         * reseting the values to defaults. This duplicates the work
+         * done in drm_add_edid_modes, but that function is not
+         * consistently called before this one in all drivers and the
+         * computation is cheap enough that it seems better to
+         * duplicate it rather than attempt to ensure some arbitrary
+         * ordering of calls.
+         */
+        if (edid)
+                drm_add_display_info(connector, edid);
+        else
+                drm_reset_display_info(connector);
+
         drm_object_property_set_value(&connector->base,
                                       dev->mode_config.non_desktop_property,
                                       connector->display_info.non_desktop);
diff --git a/drivers/gpu/drm/drm_crtc_internal.h b/drivers/gpu/drm/drm_crtc_internal.h
index 9ebb8841778c..af00f42ba269 100644
--- a/drivers/gpu/drm/drm_crtc_internal.h
+++ b/drivers/gpu/drm/drm_crtc_internal.h
@@ -142,6 +142,7 @@ int drm_mode_connector_set_obj_prop(struct drm_mode_object *obj,
                                     uint64_t value);
 int drm_connector_create_standard_properties(struct drm_device *dev);
 const char *drm_get_connector_force_name(enum drm_connector_force force);
+void drm_connector_free_work_fn(struct work_struct *work);
 
 /* IOCTL */
 int drm_mode_connector_property_set_ioctl(struct drm_device *dev,
diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
index 5dfe14763871..cb487148359a 100644
--- a/drivers/gpu/drm/drm_edid.c
+++ b/drivers/gpu/drm/drm_edid.c
@@ -1731,7 +1731,7 @@ EXPORT_SYMBOL(drm_edid_duplicate);
  *
  * Returns true if @vendor is in @edid, false otherwise
  */
-static bool edid_vendor(struct edid *edid, const char *vendor)
+static bool edid_vendor(const struct edid *edid, const char *vendor)
 {
         char edid_vendor[3];
 
@@ -1749,7 +1749,7 @@ static bool edid_vendor(struct edid *edid, const char *vendor)
  *
  * This tells subsequent routines what fixes they need to apply.
  */
-static u32 edid_get_quirks(struct edid *edid)
+static u32 edid_get_quirks(const struct edid *edid)
 {
         const struct edid_quirk *quirk;
         int i;
@@ -2813,7 +2813,7 @@ add_detailed_modes(struct drm_connector *connector, struct edid *edid,
 /*
  * Search EDID for CEA extension block.
  */
-static u8 *drm_find_edid_extension(struct edid *edid, int ext_id)
+static u8 *drm_find_edid_extension(const struct edid *edid, int ext_id)
 {
         u8 *edid_ext = NULL;
         int i;
@@ -2835,12 +2835,12 @@ static u8 *drm_find_edid_extension(struct edid *edid, int ext_id)
         return edid_ext;
 }
 
-static u8 *drm_find_cea_extension(struct edid *edid)
+static u8 *drm_find_cea_extension(const struct edid *edid)
 {
         return drm_find_edid_extension(edid, CEA_EXT);
 }
 
-static u8 *drm_find_displayid_extension(struct edid *edid)
+static u8 *drm_find_displayid_extension(const struct edid *edid)
 {
         return drm_find_edid_extension(edid, DISPLAYID_EXT);
 }
@@ -4363,7 +4363,7 @@ drm_parse_hdmi_vsdb_video(struct drm_connector *connector, const u8 *db)
 }
 
 static void drm_parse_cea_ext(struct drm_connector *connector,
-                              struct edid *edid)
+                              const struct edid *edid)
 {
         struct drm_display_info *info = &connector->display_info;
         const u8 *edid_ext;
@@ -4397,11 +4397,33 @@ static void drm_parse_cea_ext(struct drm_connector *connector,
         }
 }
 
-static void drm_add_display_info(struct drm_connector *connector,
-                                 struct edid *edid, u32 quirks)
+/* A connector has no EDID information, so we've got no EDID to compute quirks from. Reset
+ * all of the values which would have been set from EDID
+ */
+void
+drm_reset_display_info(struct drm_connector *connector)
 {
         struct drm_display_info *info = &connector->display_info;
 
+        info->width_mm = 0;
+        info->height_mm = 0;
+
+        info->bpc = 0;
+        info->color_formats = 0;
+        info->cea_rev = 0;
+        info->max_tmds_clock = 0;
+        info->dvi_dual = false;
+
+        info->non_desktop = 0;
+}
+EXPORT_SYMBOL_GPL(drm_reset_display_info);
+
+u32 drm_add_display_info(struct drm_connector *connector, const struct edid *edid)
+{
+        struct drm_display_info *info = &connector->display_info;
+
+        u32 quirks = edid_get_quirks(edid);
+
         info->width_mm = edid->width_cm * 10;
         info->height_mm = edid->height_cm * 10;
 
@@ -4414,11 +4436,13 @@ static void drm_add_display_info(struct drm_connector *connector,
 
         info->non_desktop = !!(quirks & EDID_QUIRK_NON_DESKTOP);
 
+        DRM_DEBUG_KMS("non_desktop set to %d\n", info->non_desktop);
+
         if (edid->revision < 3)
-                return;
+                return quirks;
 
         if (!(edid->input & DRM_EDID_INPUT_DIGITAL))
-                return;
+                return quirks;
 
         drm_parse_cea_ext(connector, edid);
 
@@ -4438,7 +4462,7 @@ static void drm_add_display_info(struct drm_connector *connector,
 
         /* Only defined for 1.4 with digital displays */
         if (edid->revision < 4)
-                return;
+                return quirks;
 
         switch (edid->input & DRM_EDID_DIGITAL_DEPTH_MASK) {
         case DRM_EDID_DIGITAL_DEPTH_6:
@@ -4473,7 +4497,9 @@ static void drm_add_display_info(struct drm_connector *connector,
                 info->color_formats |= DRM_COLOR_FORMAT_YCRCB444;
         if (edid->features & DRM_EDID_FEATURE_RGB_YCRCB422)
                 info->color_formats |= DRM_COLOR_FORMAT_YCRCB422;
+        return quirks;
 }
+EXPORT_SYMBOL_GPL(drm_add_display_info);
 
 static int validate_displayid(u8 *displayid, int length, int idx)
 {
@@ -4627,14 +4653,12 @@ int drm_add_edid_modes(struct drm_connector *connector, struct edid *edid)
                 return 0;
         }
 
-        quirks = edid_get_quirks(edid);
-
         /*
          * CEA-861-F adds ycbcr capability map block, for HDMI 2.0 sinks.
          * To avoid multiple parsing of same block, lets parse that map
          * from sink info, before parsing CEA modes.
          */
-        drm_add_display_info(connector, edid, quirks);
+        quirks = drm_add_display_info(connector, edid);
 
         /*
          * EDID spec says modes should be preferred in this order:
diff --git a/drivers/gpu/drm/drm_lease.c b/drivers/gpu/drm/drm_lease.c
index d1eb56a1eff4..1402c0e71b03 100644
--- a/drivers/gpu/drm/drm_lease.c
+++ b/drivers/gpu/drm/drm_lease.c
@@ -220,17 +220,6 @@ static struct drm_master *drm_lease_create(struct drm_master *lessor, struct idr
 
         mutex_lock(&dev->mode_config.idr_mutex);
 
-        /* Insert the new lessee into the tree */
-        id = idr_alloc(&(drm_lease_owner(lessor)->lessee_idr), lessee, 1, 0, GFP_KERNEL);
-        if (id < 0) {
-                error = id;
-                goto out_lessee;
-        }
-
-        lessee->lessee_id = id;
-        lessee->lessor = drm_master_get(lessor);
-        list_add_tail(&lessee->lessee_list, &lessor->lessees);
-
         idr_for_each_entry(leases, entry, object) {
                 error = 0;
                 if (!idr_find(&dev->mode_config.crtc_idr, object))
@@ -246,6 +235,17 @@ static struct drm_master *drm_lease_create(struct drm_master *lessor, struct idr
                 }
         }
 
+        /* Insert the new lessee into the tree */
+        id = idr_alloc(&(drm_lease_owner(lessor)->lessee_idr), lessee, 1, 0, GFP_KERNEL);
+        if (id < 0) {
+                error = id;
+                goto out_lessee;
+        }
+
+        lessee->lessee_id = id;
+        lessee->lessor = drm_master_get(lessor);
+        list_add_tail(&lessee->lessee_list, &lessor->lessees);
+
         /* Move the leases over */
         lessee->leases = *leases;
         DRM_DEBUG_LEASE("new lessee %d %p, lessor %d %p\n", lessee->lessee_id, lessee, lessor->lessee_id, lessor);
@@ -254,10 +254,10 @@ static struct drm_master *drm_lease_create(struct drm_master *lessor, struct idr
         return lessee;
 
 out_lessee:
-        drm_master_put(&lessee);
-
         mutex_unlock(&dev->mode_config.idr_mutex);
 
+        drm_master_put(&lessee);
+
         return ERR_PTR(error);
 }
 
diff --git a/drivers/gpu/drm/drm_mm.c b/drivers/gpu/drm/drm_mm.c
index 61a1c8ea74bc..c3c79ee6119e 100644
--- a/drivers/gpu/drm/drm_mm.c
+++ b/drivers/gpu/drm/drm_mm.c
@@ -575,21 +575,23 @@ EXPORT_SYMBOL(drm_mm_remove_node);
  */
 void drm_mm_replace_node(struct drm_mm_node *old, struct drm_mm_node *new)
 {
+        struct drm_mm *mm = old->mm;
+
         DRM_MM_BUG_ON(!old->allocated);
 
         *new = *old;
 
         list_replace(&old->node_list, &new->node_list);
-        rb_replace_node(&old->rb, &new->rb, &old->mm->interval_tree.rb_root);
+        rb_replace_node_cached(&old->rb, &new->rb, &mm->interval_tree);
 
         if (drm_mm_hole_follows(old)) {
                 list_replace(&old->hole_stack, &new->hole_stack);
                 rb_replace_node(&old->rb_hole_size,
                                 &new->rb_hole_size,
-                                &old->mm->holes_size);
+                                &mm->holes_size);
                 rb_replace_node(&old->rb_hole_addr,
                                 &new->rb_hole_addr,
-                                &old->mm->holes_addr);
+                                &mm->holes_addr);
         }
 
         old->allocated = false;
diff --git a/drivers/gpu/drm/drm_mode_config.c b/drivers/gpu/drm/drm_mode_config.c
index cc78b3d9e5e4..256de7313612 100644
--- a/drivers/gpu/drm/drm_mode_config.c
+++ b/drivers/gpu/drm/drm_mode_config.c
@@ -382,6 +382,9 @@ void drm_mode_config_init(struct drm_device *dev)
         ida_init(&dev->mode_config.connector_ida);
         spin_lock_init(&dev->mode_config.connector_list_lock);
 
+        init_llist_head(&dev->mode_config.connector_free_list);
+        INIT_WORK(&dev->mode_config.connector_free_work, drm_connector_free_work_fn);
+
         drm_mode_create_standard_properties(dev);
 
         /* Just to be sure */
@@ -432,7 +435,7 @@ void drm_mode_config_cleanup(struct drm_device *dev)
         }
         drm_connector_list_iter_end(&conn_iter);
         /* connector_iter drops references in a work item. */
-        flush_scheduled_work();
+        flush_work(&dev->mode_config.connector_free_work);
         if (WARN_ON(!list_empty(&dev->mode_config.connector_list))) {
                 drm_connector_list_iter_begin(dev, &conn_iter);
                 drm_for_each_connector_iter(connector, &conn_iter)
diff --git a/drivers/gpu/drm/drm_plane.c b/drivers/gpu/drm/drm_plane.c
index 37a93cdffb4a..2c90519576a3 100644
--- a/drivers/gpu/drm/drm_plane.c
+++ b/drivers/gpu/drm/drm_plane.c
@@ -558,11 +558,10 @@ int drm_plane_check_pixel_format(const struct drm_plane *plane, u32 format)
 }
 
 /*
- * setplane_internal - setplane handler for internal callers
+ * __setplane_internal - setplane handler for internal callers
  *
- * Note that we assume an extra reference has already been taken on fb.  If the
- * update fails, this reference will be dropped before return; if it succeeds,
- * the previous framebuffer (if any) will be unreferenced instead.
+ * This function will take a reference on the new fb for the plane
+ * on success.
  *
  * src_{x,y,w,h} are provided in 16.16 fixed point format
  */
@@ -630,14 +629,12 @@ static int __setplane_internal(struct drm_plane *plane,
         if (!ret) {
                 plane->crtc = crtc;
                 plane->fb = fb;
-                fb = NULL;
+                drm_framebuffer_get(plane->fb);
         } else {
                 plane->old_fb = NULL;
         }
 
 out:
-        if (fb)
-                drm_framebuffer_put(fb);
         if (plane->old_fb)
                 drm_framebuffer_put(plane->old_fb);
         plane->old_fb = NULL;
@@ -685,6 +682,7 @@ int drm_mode_setplane(struct drm_device *dev, void *data,
         struct drm_plane *plane;
         struct drm_crtc *crtc = NULL;
         struct drm_framebuffer *fb = NULL;
+        int ret;
 
         if (!drm_core_check_feature(dev, DRIVER_MODESET))
                 return -EINVAL;
@@ -717,15 +715,16 @@ int drm_mode_setplane(struct drm_device *dev, void *data,
                 }
         }
 
-        /*
-         * setplane_internal will take care of deref'ing either the old or new
-         * framebuffer depending on success.
-         */
-        return setplane_internal(plane, crtc, fb,
-                                 plane_req->crtc_x, plane_req->crtc_y,
-                                 plane_req->crtc_w, plane_req->crtc_h,
-                                 plane_req->src_x, plane_req->src_y,
-                                 plane_req->src_w, plane_req->src_h);
+        ret = setplane_internal(plane, crtc, fb,
+                                plane_req->crtc_x, plane_req->crtc_y,
+                                plane_req->crtc_w, plane_req->crtc_h,
+                                plane_req->src_x, plane_req->src_y,
+                                plane_req->src_w, plane_req->src_h);
+
+        if (fb)
+                drm_framebuffer_put(fb);
+
+        return ret;
 }
 
 static int drm_mode_cursor_universal(struct drm_crtc *crtc,
@@ -788,13 +787,12 @@ static int drm_mode_cursor_universal(struct drm_crtc *crtc,
                 src_h = fb->height << 16;
         }
 
-        /*
-         * setplane_internal will take care of deref'ing either the old or new
-         * framebuffer depending on success.
-         */
         ret = __setplane_internal(crtc->cursor, crtc, fb,
-                                crtc_x, crtc_y, crtc_w, crtc_h,
-                                0, 0, src_w, src_h, ctx);
+                                  crtc_x, crtc_y, crtc_w, crtc_h,
+                                  0, 0, src_w, src_h, ctx);
+
+        if (fb)
+                drm_framebuffer_put(fb);
 
         /* Update successful; save new cursor position, if necessary */
         if (ret == 0 && req->flags & DRM_MODE_CURSOR_MOVE) {
diff --git a/drivers/gpu/drm/drm_syncobj.c b/drivers/gpu/drm/drm_syncobj.c
index f776fc1cc543..cb4d09c70fd4 100644
--- a/drivers/gpu/drm/drm_syncobj.c
+++ b/drivers/gpu/drm/drm_syncobj.c
@@ -369,40 +369,26 @@ static const struct file_operations drm_syncobj_file_fops = {
         .release = drm_syncobj_file_release,
 };
 
-static int drm_syncobj_alloc_file(struct drm_syncobj *syncobj)
-{
-        struct file *file = anon_inode_getfile("syncobj_file",
-                                               &drm_syncobj_file_fops,
-                                               syncobj, 0);
-        if (IS_ERR(file))
-                return PTR_ERR(file);
-
-        drm_syncobj_get(syncobj);
-        if (cmpxchg(&syncobj->file, NULL, file)) {
-                /* lost the race */
-                fput(file);
-        }
-
-        return 0;
-}
-
 int drm_syncobj_get_fd(struct drm_syncobj *syncobj, int *p_fd)
 {
-        int ret;
+        struct file *file;
         int fd;
 
         fd = get_unused_fd_flags(O_CLOEXEC);
         if (fd < 0)
                 return fd;
 
-        if (!syncobj->file) {
-                ret = drm_syncobj_alloc_file(syncobj);
-                if (ret) {
-                        put_unused_fd(fd);
-                        return ret;
-                }
+        file = anon_inode_getfile("syncobj_file",
+                                  &drm_syncobj_file_fops,
+                                  syncobj, 0);
+        if (IS_ERR(file)) {
+                put_unused_fd(fd);
+                return PTR_ERR(file);
         }
-        fd_install(fd, syncobj->file);
+
+        drm_syncobj_get(syncobj);
+        fd_install(fd, file);
+
         *p_fd = fd;
         return 0;
 }
@@ -422,31 +408,24 @@ static int drm_syncobj_handle_to_fd(struct drm_file *file_private,
         return ret;
 }
 
-static struct drm_syncobj *drm_syncobj_fdget(int fd)
-{
-        struct file *file = fget(fd);
-
-        if (!file)
-                return NULL;
-        if (file->f_op != &drm_syncobj_file_fops)
-                goto err;
-
-        return file->private_data;
-err:
-        fput(file);
-        return NULL;
-};
-
 static int drm_syncobj_fd_to_handle(struct drm_file *file_private,
                                     int fd, u32 *handle)
 {
-        struct drm_syncobj *syncobj = drm_syncobj_fdget(fd);
+        struct drm_syncobj *syncobj;
+        struct file *file;
         int ret;
 
-        if (!syncobj)
+        file = fget(fd);
+        if (!file)
                 return -EINVAL;
 
+        if (file->f_op != &drm_syncobj_file_fops) {
+                fput(file);
+                return -EINVAL;
+        }
+
         /* take a reference to put in the idr */
+        syncobj = file->private_data;
         drm_syncobj_get(syncobj);
 
         idr_preload(GFP_KERNEL);
@@ -455,12 +434,14 @@ static int drm_syncobj_fd_to_handle(struct drm_file *file_private,
         spin_unlock(&file_private->syncobj_table_lock);
         idr_preload_end();
 
-        if (ret < 0) {
-                fput(syncobj->file);
-                return ret;
-        }
-        *handle = ret;
-        return 0;
+        if (ret > 0) {
+                *handle = ret;
+                ret = 0;
+        } else
+                drm_syncobj_put(syncobj);
+
+        fput(file);
+        return ret;
 }
 
 static int drm_syncobj_import_sync_file_fence(struct drm_file *file_private,
diff --git a/drivers/gpu/drm/i915/gvt/display.c b/drivers/gpu/drm/i915/gvt/display.c
index 355120865efd..309f3fa6794a 100644
--- a/drivers/gpu/drm/i915/gvt/display.c
+++ b/drivers/gpu/drm/i915/gvt/display.c
@@ -266,6 +266,8 @@ static void emulate_monitor_status_change(struct intel_vgpu *vgpu)
         /* Clear host CRT status, so guest couldn't detect this host CRT. */
         if (IS_BROADWELL(dev_priv))
                 vgpu_vreg(vgpu, PCH_ADPA) &= ~ADPA_CRT_HOTPLUG_MONITOR_MASK;
+
+        vgpu_vreg(vgpu, PIPECONF(PIPE_A)) |= PIPECONF_ENABLE;
 }
 
 static void clean_virtual_dp_monitor(struct intel_vgpu *vgpu, int port_num)
@@ -282,7 +284,6 @@ static void clean_virtual_dp_monitor(struct intel_vgpu *vgpu, int port_num)
 static int setup_virtual_dp_monitor(struct intel_vgpu *vgpu, int port_num,
                                     int type, unsigned int resolution)
 {
-        struct drm_i915_private *dev_priv = vgpu->gvt->dev_priv;
         struct intel_vgpu_port *port = intel_vgpu_port(vgpu, port_num);
 
         if (WARN_ON(resolution >= GVT_EDID_NUM))
@@ -308,7 +309,7 @@ static int setup_virtual_dp_monitor(struct intel_vgpu *vgpu, int port_num,
         port->type = type;
 
         emulate_monitor_status_change(vgpu);
-        vgpu_vreg(vgpu, PIPECONF(PIPE_A)) |= PIPECONF_ENABLE;
+
         return 0;
 }
 
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index ad4050f7ab3b..18de6569d04a 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -330,17 +330,10 @@ int i915_gem_object_unbind(struct drm_i915_gem_object *obj)
          * must wait for all rendering to complete to the object (as unbinding
          * must anyway), and retire the requests.
          */
-        ret = i915_gem_object_wait(obj,
-                                   I915_WAIT_INTERRUPTIBLE |
-                                   I915_WAIT_LOCKED |
-                                   I915_WAIT_ALL,
-                                   MAX_SCHEDULE_TIMEOUT,
-                                   NULL);
+        ret = i915_gem_object_set_to_cpu_domain(obj, false);
         if (ret)
                 return ret;
 
-        i915_gem_retire_requests(to_i915(obj->base.dev));
-
         while ((vma = list_first_entry_or_null(&obj->vma_list,
                                                struct i915_vma,
                                                obj_link))) {
diff --git a/drivers/gpu/drm/i915/i915_sw_fence.c b/drivers/gpu/drm/i915/i915_sw_fence.c
index e8ca67a129d2..ac236b88c99c 100644
--- a/drivers/gpu/drm/i915/i915_sw_fence.c
+++ b/drivers/gpu/drm/i915/i915_sw_fence.c
@@ -367,6 +367,7 @@ struct i915_sw_dma_fence_cb {
         struct dma_fence *dma;
         struct timer_list timer;
         struct irq_work work;
+        struct rcu_head rcu;
 };
 
 static void timer_i915_sw_fence_wake(struct timer_list *t)
@@ -406,7 +407,7 @@ static void irq_i915_sw_fence_work(struct irq_work *wrk)
         del_timer_sync(&cb->timer);
         dma_fence_put(cb->dma);
 
-        kfree(cb);
+        kfree_rcu(cb, rcu);
 }
 
 int i915_sw_fence_await_dma_fence(struct i915_sw_fence *fence,
diff --git a/drivers/gpu/drm/i915/intel_breadcrumbs.c b/drivers/gpu/drm/i915/intel_breadcrumbs.c
index 5f8b9f1f40f1..bcbc7abe6693 100644
--- a/drivers/gpu/drm/i915/intel_breadcrumbs.c
+++ b/drivers/gpu/drm/i915/intel_breadcrumbs.c
@@ -186,7 +186,7 @@ void intel_engine_disarm_breadcrumbs(struct intel_engine_cs *engine)
         struct intel_wait *wait, *n, *first;
 
         if (!b->irq_armed)
-                return;
+                goto wakeup_signaler;
 
         /* We only disarm the irq when we are idle (all requests completed),
          * so if the bottom-half remains asleep, it missed the request
@@ -208,6 +208,14 @@ void intel_engine_disarm_breadcrumbs(struct intel_engine_cs *engine)
         b->waiters = RB_ROOT;
 
         spin_unlock_irq(&b->rb_lock);
+
+        /*
+         * The signaling thread may be asleep holding a reference to a request,
+         * that had its signaling cancelled prior to being preempted. We need
+         * to kick the signaler, just in case, to release any such reference.
+         */
+wakeup_signaler:
+        wake_up_process(b->signaler);
 }
 
 static bool use_fake_irq(const struct intel_breadcrumbs *b)
@@ -651,23 +659,15 @@ static int intel_breadcrumbs_signaler(void *arg)
                 }
 
                 if (unlikely(do_schedule)) {
-                        DEFINE_WAIT(exec);
-
                         if (kthread_should_park())
                                 kthread_parkme();
 
-                        if (kthread_should_stop()) {
-                                GEM_BUG_ON(request);
+                        if (unlikely(kthread_should_stop())) {
+                                i915_gem_request_put(request);
                                 break;
                         }
 
-                        if (request)
-                                add_wait_queue(&request->execute, &exec);
-
                         schedule();
-
-                        if (request)
-                                remove_wait_queue(&request->execute, &exec);
                 }
                 i915_gem_request_put(request);
         } while (1);
diff --git a/drivers/gpu/drm/i915/intel_ddi.c b/drivers/gpu/drm/i915/intel_ddi.c
index e0843bb99169..58a3755544b2 100644
--- a/drivers/gpu/drm/i915/intel_ddi.c
+++ b/drivers/gpu/drm/i915/intel_ddi.c
@@ -2128,6 +2128,8 @@ static void intel_ddi_clk_select(struct intel_encoder *encoder,
         if (WARN_ON(!pll))
                 return;
 
+         mutex_lock(&dev_priv->dpll_lock);
+
         if (IS_CANNONLAKE(dev_priv)) {
                 /* Configure DPCLKA_CFGCR0 to map the DPLL to the DDI. */
                 val = I915_READ(DPCLKA_CFGCR0);
@@ -2157,6 +2159,8 @@ static void intel_ddi_clk_select(struct intel_encoder *encoder,
         } else if (INTEL_INFO(dev_priv)->gen < 9) {
                 I915_WRITE(PORT_CLK_SEL(port), hsw_pll_to_ddi_pll_sel(pll));
         }
+
+        mutex_unlock(&dev_priv->dpll_lock);
 }
 
 static void intel_ddi_clk_disable(struct intel_encoder *encoder)
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index e8ccf89cb17b..30cf273d57aa 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -9944,11 +9944,10 @@ found:
         }
 
         ret = intel_modeset_setup_plane_state(state, crtc, mode, fb, 0, 0);
+        drm_framebuffer_put(fb);
         if (ret)
                 goto fail;
 
-        drm_framebuffer_put(fb);
-
         ret = drm_atomic_set_mode_for_crtc(&crtc_state->base, mode);
         if (ret)
                 goto fail;
@@ -13195,7 +13194,7 @@ intel_primary_plane_create(struct drm_i915_private *dev_priv, enum pipe pipe)
         primary->frontbuffer_bit = INTEL_FRONTBUFFER_PRIMARY(pipe);
         primary->check_plane = intel_check_primary_plane;
 
-        if (INTEL_GEN(dev_priv) >= 10 || IS_GEMINILAKE(dev_priv)) {
+        if (INTEL_GEN(dev_priv) >= 10) {
                 intel_primary_formats = skl_primary_formats;
                 num_formats = ARRAY_SIZE(skl_primary_formats);
                 modifiers = skl_format_modifiers_ccs;
diff --git a/drivers/gpu/drm/i915/intel_lpe_audio.c b/drivers/gpu/drm/i915/intel_lpe_audio.c
index 3bf65288ffff..5809b29044fc 100644
--- a/drivers/gpu/drm/i915/intel_lpe_audio.c
+++ b/drivers/gpu/drm/i915/intel_lpe_audio.c
@@ -193,7 +193,7 @@ static bool lpe_audio_detect(struct drm_i915_private *dev_priv)
                 };
 
                 if (!pci_dev_present(atom_hdaudio_ids)) {
-                        DRM_INFO("%s\n", "HDaudio controller not detected, using LPE audio instead\n");
+                        DRM_INFO("HDaudio controller not detected, using LPE audio instead\n");
                         lpe_present = true;
                 }
         }
diff --git a/drivers/gpu/drm/nouveau/nouveau_bo.c b/drivers/gpu/drm/nouveau/nouveau_bo.c
index 2615912430cc..435ff8662cfa 100644
--- a/drivers/gpu/drm/nouveau/nouveau_bo.c
+++ b/drivers/gpu/drm/nouveau/nouveau_bo.c
@@ -224,7 +224,7 @@ nouveau_bo_new(struct nouveau_cli *cli, u64 size, int align,
                 /* Determine if we can get a cache-coherent map, forcing
                  * uncached mapping if we can't.
                  */
-                if (mmu->type[drm->ttm.type_host].type & NVIF_MEM_UNCACHED)
+                if (!nouveau_drm_use_coherent_gpu_mapping(drm))
                         nvbo->force_coherent = true;
         }
 
@@ -262,7 +262,8 @@ nouveau_bo_new(struct nouveau_cli *cli, u64 size, int align,
                 if (cli->device.info.family > NV_DEVICE_INFO_V0_CURIE &&
                     (flags & TTM_PL_FLAG_VRAM) && !vmm->page[i].vram)
                         continue;
-                if ((flags & TTM_PL_FLAG_TT  ) && !vmm->page[i].host)
+                if ((flags & TTM_PL_FLAG_TT) &&
+                    (!vmm->page[i].host || vmm->page[i].shift > PAGE_SHIFT))
                         continue;
 
                 /* Select this page size if it's the first that supports
diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c
index 8d4a5be3b913..56fe261b6268 100644
--- a/drivers/gpu/drm/nouveau/nouveau_drm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_drm.c
@@ -152,9 +152,9 @@ nouveau_cli_work_queue(struct nouveau_cli *cli, struct dma_fence *fence,
         work->cli = cli;
         mutex_lock(&cli->lock);
         list_add_tail(&work->head, &cli->worker);
-        mutex_unlock(&cli->lock);
         if (dma_fence_add_callback(fence, &work->cb, nouveau_cli_work_fence))
                 nouveau_cli_work_fence(fence, &work->cb);
+        mutex_unlock(&cli->lock);
 }
 
 static void
diff --git a/drivers/gpu/drm/nouveau/nouveau_drv.h b/drivers/gpu/drm/nouveau/nouveau_drv.h
index 3331e82ae9e7..96f6bd8aee5d 100644
--- a/drivers/gpu/drm/nouveau/nouveau_drv.h
+++ b/drivers/gpu/drm/nouveau/nouveau_drv.h
@@ -157,8 +157,8 @@ struct nouveau_drm {
                 struct nvif_object copy;
                 int mtrr;
                 int type_vram;
-                int type_host;
-                int type_ncoh;
+                int type_host[2];
+                int type_ncoh[2];
         } ttm;
 
         /* GEM interface support */
@@ -217,6 +217,13 @@ nouveau_drm(struct drm_device *dev)
         return dev->dev_private;
 }
 
+static inline bool
+nouveau_drm_use_coherent_gpu_mapping(struct nouveau_drm *drm)
+{
+        struct nvif_mmu *mmu = &drm->client.mmu;
+        return !(mmu->type[drm->ttm.type_host[0]].type & NVIF_MEM_UNCACHED);
+}
+
 int nouveau_pmops_suspend(struct device *);
 int nouveau_pmops_resume(struct device *);
 bool nouveau_pmops_runtime(void);
diff --git a/drivers/gpu/drm/nouveau/nouveau_fbcon.c b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
index c533d8e04afc..be7357bf2246 100644
--- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c
+++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
@@ -429,7 +429,7 @@ nouveau_fbcon_destroy(struct drm_device *dev, struct nouveau_fbdev *fbcon)
         drm_fb_helper_unregister_fbi(&fbcon->helper);
         drm_fb_helper_fini(&fbcon->helper);
 
-        if (nouveau_fb->nvbo) {
+        if (nouveau_fb && nouveau_fb->nvbo) {
                 nouveau_vma_del(&nouveau_fb->vma);
                 nouveau_bo_unmap(nouveau_fb->nvbo);
                 nouveau_bo_unpin(nouveau_fb->nvbo);
diff --git a/drivers/gpu/drm/nouveau/nouveau_mem.c b/drivers/gpu/drm/nouveau/nouveau_mem.c
index 589a9621db76..c002f8968507 100644
--- a/drivers/gpu/drm/nouveau/nouveau_mem.c
+++ b/drivers/gpu/drm/nouveau/nouveau_mem.c
@@ -103,10 +103,10 @@ nouveau_mem_host(struct ttm_mem_reg *reg, struct ttm_dma_tt *tt)
         u8 type;
         int ret;
 
-        if (mmu->type[drm->ttm.type_host].type & NVIF_MEM_UNCACHED)
-                type = drm->ttm.type_ncoh;
+        if (!nouveau_drm_use_coherent_gpu_mapping(drm))
+                type = drm->ttm.type_ncoh[!!mem->kind];
         else
-                type = drm->ttm.type_host;
+                type = drm->ttm.type_host[0];
 
         if (mem->kind && !(mmu->type[type].type & NVIF_MEM_KIND))
                 mem->comp = mem->kind = 0;
diff --git a/drivers/gpu/drm/nouveau/nouveau_ttm.c b/drivers/gpu/drm/nouveau/nouveau_ttm.c
index 08b974b30482..dff51a0ee028 100644
--- a/drivers/gpu/drm/nouveau/nouveau_ttm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_ttm.c
@@ -235,27 +235,46 @@ nouveau_ttm_global_release(struct nouveau_drm *drm)
         drm->ttm.mem_global_ref.release = NULL;
 }
 
-int
-nouveau_ttm_init(struct nouveau_drm *drm)
+static int
+nouveau_ttm_init_host(struct nouveau_drm *drm, u8 kind)
 {
-        struct nvkm_device *device = nvxx_device(&drm->client.device);
-        struct nvkm_pci *pci = device->pci;
         struct nvif_mmu *mmu = &drm->client.mmu;
-        struct drm_device *dev = drm->dev;
-        int typei, ret;
+        int typei;
 
         typei = nvif_mmu_type(mmu, NVIF_MEM_HOST | NVIF_MEM_MAPPABLE |
-                                                   NVIF_MEM_COHERENT);
+                                            kind | NVIF_MEM_COHERENT);
         if (typei < 0)
                 return -ENOSYS;
 
-        drm->ttm.type_host = typei;
+        drm->ttm.type_host[!!kind] = typei;
 
-        typei = nvif_mmu_type(mmu, NVIF_MEM_HOST | NVIF_MEM_MAPPABLE);
+        typei = nvif_mmu_type(mmu, NVIF_MEM_HOST | NVIF_MEM_MAPPABLE | kind);
         if (typei < 0)
                 return -ENOSYS;
 
-        drm->ttm.type_ncoh = typei;
+        drm->ttm.type_ncoh[!!kind] = typei;
+        return 0;
+}
+
+int
+nouveau_ttm_init(struct nouveau_drm *drm)
+{
+        struct nvkm_device *device = nvxx_device(&drm->client.device);
+        struct nvkm_pci *pci = device->pci;
+        struct nvif_mmu *mmu = &drm->client.mmu;
+        struct drm_device *dev = drm->dev;
+        int typei, ret;
+
+        ret = nouveau_ttm_init_host(drm, 0);
+        if (ret)
+                return ret;
+
+        if (drm->client.device.info.family >= NV_DEVICE_INFO_V0_TESLA &&
+            drm->client.device.info.chipset != 0x50) {
+                ret = nouveau_ttm_init_host(drm, NVIF_MEM_KIND);
+                if (ret)
+                        return ret;
+        }
 
         if (drm->client.device.info.platform != NV_DEVICE_INFO_V0_SOC &&
             drm->client.device.info.family >= NV_DEVICE_INFO_V0_TESLA) {
diff --git a/drivers/gpu/drm/nouveau/nouveau_vmm.c b/drivers/gpu/drm/nouveau/nouveau_vmm.c
index 9e2628dd8e4d..f5371d96b003 100644
--- a/drivers/gpu/drm/nouveau/nouveau_vmm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_vmm.c
@@ -67,8 +67,8 @@ nouveau_vma_del(struct nouveau_vma **pvma)
                         nvif_vmm_put(&vma->vmm->vmm, &tmp);
                 }
                 list_del(&vma->head);
-                *pvma = NULL;
                 kfree(*pvma);
+                *pvma = NULL;
         }
 }
 
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c b/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c
index e14643615698..00eeaaffeae5 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c
@@ -2369,7 +2369,7 @@ nv13b_chipset = {
         .imem = gk20a_instmem_new,
         .ltc = gp100_ltc_new,
         .mc = gp10b_mc_new,
-        .mmu = gf100_mmu_new,
+        .mmu = gp10b_mmu_new,
         .secboot = gp10b_secboot_new,
         .pmu = gm20b_pmu_new,
         .timer = gk20a_timer_new,
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/dp.c b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/dp.c
index 972370ed36f0..7c7efa4ea0d0 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/dp.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/dp.c
@@ -36,6 +36,7 @@ nvbios_dp_table(struct nvkm_bios *bios, u8 *ver, u8 *hdr, u8 *cnt, u8 *len)
                         if (data) {
                                 *ver = nvbios_rd08(bios, data + 0x00);
                                 switch (*ver) {
+                                case 0x20:
                                 case 0x21:
                                 case 0x30:
                                 case 0x40:
@@ -63,6 +64,7 @@ nvbios_dpout_entry(struct nvkm_bios *bios, u8 idx,
         if (data && idx < *cnt) {
                 u16 outp = nvbios_rd16(bios, data + *hdr + idx * *len);
                 switch (*ver * !!outp) {
+                case 0x20:
                 case 0x21:
                 case 0x30:
                         *hdr = nvbios_rd08(bios, data + 0x04);
@@ -96,12 +98,16 @@ nvbios_dpout_parse(struct nvkm_bios *bios, u8 idx,
                 info->type = nvbios_rd16(bios, data + 0x00);
                 info->mask = nvbios_rd16(bios, data + 0x02);
                 switch (*ver) {
+                case 0x20:
+                        info->mask |= 0x00c0; /* match any link */
+                        /* fall-through */
                 case 0x21:
                 case 0x30:
                         info->flags     = nvbios_rd08(bios, data + 0x05);
                         info->script[0] = nvbios_rd16(bios, data + 0x06);
                         info->script[1] = nvbios_rd16(bios, data + 0x08);
-                        info->lnkcmp    = nvbios_rd16(bios, data + 0x0a);
+                        if (*len >= 0x0c)
+                                info->lnkcmp    = nvbios_rd16(bios, data + 0x0a);
                         if (*len >= 0x0f) {
                                 info->script[2] = nvbios_rd16(bios, data + 0x0c);
                                 info->script[3] = nvbios_rd16(bios, data + 0x0e);
@@ -170,6 +176,7 @@ nvbios_dpcfg_parse(struct nvkm_bios *bios, u16 outp, u8 idx,
         memset(info, 0x00, sizeof(*info));
         if (data) {
                 switch (*ver) {
+                case 0x20:
                 case 0x21:
                         info->dc    = nvbios_rd08(bios, data + 0x02);
                         info->pe    = nvbios_rd08(bios, data + 0x03);
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/instmem/nv50.c b/drivers/gpu/drm/nouveau/nvkm/subdev/instmem/nv50.c
index 1ba7289684aa..db48a1daca0c 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/instmem/nv50.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/instmem/nv50.c
@@ -249,7 +249,7 @@ nv50_instobj_acquire(struct nvkm_memory *memory)
                         iobj->base.memory.ptrs = &nv50_instobj_fast;
                 else
                         iobj->base.memory.ptrs = &nv50_instobj_slow;
-                refcount_inc(&iobj->maps);
+                refcount_set(&iobj->maps, 1);
         }
 
         mutex_unlock(&imem->subdev.mutex);
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/pci/base.c b/drivers/gpu/drm/nouveau/nvkm/subdev/pci/base.c
index b1b1f3626b96..deb96de54b00 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/pci/base.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/pci/base.c
@@ -136,6 +136,13 @@ nvkm_pci_init(struct nvkm_subdev *subdev)
                 return ret;
 
         pci->irq = pdev->irq;
+
+        /* Ensure MSI interrupts are armed, for the case where there are
+         * already interrupts pending (for whatever reason) at load time.
+         */
+        if (pci->msi)
+                pci->func->msi_rearm(pci);
+
         return ret;
 }
 
diff --git a/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c b/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c
index dda904ec0534..500b6fb3e028 100644
--- a/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c
+++ b/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c
@@ -175,11 +175,31 @@ static void sun4i_hdmi_mode_set(struct drm_encoder *encoder,
         writel(val, hdmi->base + SUN4I_HDMI_VID_TIMING_POL_REG);
 }
 
+static enum drm_mode_status sun4i_hdmi_mode_valid(struct drm_encoder *encoder,
+                                        const struct drm_display_mode *mode)
+{
+        struct sun4i_hdmi *hdmi = drm_encoder_to_sun4i_hdmi(encoder);
+        unsigned long rate = mode->clock * 1000;
+        unsigned long diff = rate / 200; /* +-0.5% allowed by HDMI spec */
+        long rounded_rate;
+
+        /* 165 MHz is the typical max pixelclock frequency for HDMI <= 1.2 */
+        if (rate > 165000000)
+                return MODE_CLOCK_HIGH;
+        rounded_rate = clk_round_rate(hdmi->tmds_clk, rate);
+        if (rounded_rate > 0 &&
+            max_t(unsigned long, rounded_rate, rate) -
+            min_t(unsigned long, rounded_rate, rate) < diff)
+                return MODE_OK;
+        return MODE_NOCLOCK;
+}
+
 static const struct drm_encoder_helper_funcs sun4i_hdmi_helper_funcs = {
         .atomic_check   = sun4i_hdmi_atomic_check,
         .disable        = sun4i_hdmi_disable,
         .enable         = sun4i_hdmi_enable,
         .mode_set       = sun4i_hdmi_mode_set,
+        .mode_valid     = sun4i_hdmi_mode_valid,
 };
 
 static const struct drm_encoder_funcs sun4i_hdmi_funcs = {
diff --git a/drivers/gpu/drm/sun4i/sun4i_tcon.c b/drivers/gpu/drm/sun4i/sun4i_tcon.c
index e122f5b2a395..f4284b51bdca 100644
--- a/drivers/gpu/drm/sun4i/sun4i_tcon.c
+++ b/drivers/gpu/drm/sun4i/sun4i_tcon.c
@@ -724,12 +724,12 @@ static int sun4i_tcon_bind(struct device *dev, struct device *master,
         if (IS_ERR(tcon->crtc)) {
                 dev_err(dev, "Couldn't create our CRTC\n");
                 ret = PTR_ERR(tcon->crtc);
-                goto err_free_clocks;
+                goto err_free_dotclock;
         }
 
         ret = sun4i_rgb_init(drm, tcon);
         if (ret < 0)
-                goto err_free_clocks;
+                goto err_free_dotclock;
 
         if (tcon->quirks->needs_de_be_mux) {
                 /*
diff --git a/drivers/gpu/drm/ttm/ttm_page_alloc.c b/drivers/gpu/drm/ttm/ttm_page_alloc.c
index 44343a2bf55c..b5ba6441489f 100644
--- a/drivers/gpu/drm/ttm/ttm_page_alloc.c
+++ b/drivers/gpu/drm/ttm/ttm_page_alloc.c
@@ -455,6 +455,7 @@ ttm_pool_shrink_scan(struct shrinker *shrink, struct shrink_control *sc)
                 freed += (nr_free_pool - shrink_pages) << pool->order;
                 if (freed >= sc->nr_to_scan)
                         break;
+                shrink_pages <<= pool->order;
         }
         mutex_unlock(&lock);
         return freed;
@@ -543,7 +544,7 @@ static int ttm_alloc_new_pages(struct list_head *pages, gfp_t gfp_flags,
         int r = 0;
         unsigned i, j, cpages;
         unsigned npages = 1 << order;
-        unsigned max_cpages = min(count, (unsigned)NUM_PAGES_TO_ALLOC);
+        unsigned max_cpages = min(count << order, (unsigned)NUM_PAGES_TO_ALLOC);
 
         /* allocate array for page caching change */
         caching_array = kmalloc(max_cpages*sizeof(struct page *), GFP_KERNEL);
diff --git a/drivers/gpu/drm/vc4/vc4_gem.c b/drivers/gpu/drm/vc4/vc4_gem.c
index 6c32c89a83a9..638540943c61 100644
--- a/drivers/gpu/drm/vc4/vc4_gem.c
+++ b/drivers/gpu/drm/vc4/vc4_gem.c
@@ -888,8 +888,10 @@ vc4_complete_exec(struct drm_device *dev, struct vc4_exec_info *exec)
         /* If we got force-completed because of GPU reset rather than
          * through our IRQ handler, signal the fence now.
          */
-        if (exec->fence)
+        if (exec->fence) {
                 dma_fence_signal(exec->fence);
+                dma_fence_put(exec->fence);
+        }
 
         if (exec->bo) {
                 for (i = 0; i < exec->bo_count; i++) {
diff --git a/drivers/gpu/drm/vc4/vc4_irq.c b/drivers/gpu/drm/vc4/vc4_irq.c
index 61b2e5377993..26eddbb62893 100644
--- a/drivers/gpu/drm/vc4/vc4_irq.c
+++ b/drivers/gpu/drm/vc4/vc4_irq.c
@@ -139,6 +139,7 @@ vc4_irq_finish_render_job(struct drm_device *dev)
         list_move_tail(&exec->head, &vc4->job_done_list);
         if (exec->fence) {
                 dma_fence_signal_locked(exec->fence);
+                dma_fence_put(exec->fence);
                 exec->fence = NULL;
         }
         vc4_submit_next_render_job(dev);
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index f3fcb836a1f9..0c3f608131cf 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -551,7 +551,7 @@ static int hid_parser_main(struct hid_parser *parser, struct hid_item *item)
                 ret = hid_add_field(parser, HID_FEATURE_REPORT, data);
                 break;
         default:
-                hid_err(parser->device, "unknown main item tag 0x%x\n", item->tag);
+                hid_warn(parser->device, "unknown main item tag 0x%x\n", item->tag);
                 ret = 0;
         }
 
diff --git a/drivers/hid/hid-cp2112.c b/drivers/hid/hid-cp2112.c
index 68cdc962265b..271f31461da4 100644
--- a/drivers/hid/hid-cp2112.c
+++ b/drivers/hid/hid-cp2112.c
@@ -696,8 +696,16 @@ static int cp2112_xfer(struct i2c_adapter *adap, u16 addr,
                                               (u8 *)&word, 2);
                 break;
         case I2C_SMBUS_I2C_BLOCK_DATA:
-                size = I2C_SMBUS_BLOCK_DATA;
-                /* fallthrough */
+                if (read_write == I2C_SMBUS_READ) {
+                        read_length = data->block[0];
+                        count = cp2112_write_read_req(buf, addr, read_length,
+                                                      command, NULL, 0);
+                } else {
+                        count = cp2112_write_req(buf, addr, command,
+                                                 data->block + 1,
+                                                 data->block[0]);
+                }
+                break;
         case I2C_SMBUS_BLOCK_DATA:
                 if (I2C_SMBUS_READ == read_write) {
                         count = cp2112_write_read_req(buf, addr,
@@ -785,6 +793,9 @@ static int cp2112_xfer(struct i2c_adapter *adap, u16 addr,
         case I2C_SMBUS_WORD_DATA:
                 data->word = le16_to_cpup((__le16 *)buf);
                 break;
+        case I2C_SMBUS_I2C_BLOCK_DATA:
+                memcpy(data->block + 1, buf, read_length);
+                break;
         case I2C_SMBUS_BLOCK_DATA:
                 if (read_length > I2C_SMBUS_BLOCK_MAX) {
                         ret = -EPROTO;
diff --git a/drivers/hid/hid-holtekff.c b/drivers/hid/hid-holtekff.c
index 9325545fc3ae..edc0f64bb584 100644
--- a/drivers/hid/hid-holtekff.c
+++ b/drivers/hid/hid-holtekff.c
@@ -32,10 +32,6 @@
 
 #ifdef CONFIG_HOLTEK_FF
 
-MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Anssi Hannula <anssi.hannula@iki.fi>");
-MODULE_DESCRIPTION("Force feedback support for Holtek On Line Grip based devices");
-
 /*
  * These commands and parameters are currently known:
  *
@@ -223,3 +219,7 @@ static struct hid_driver holtek_driver = {
         .probe = holtek_probe,
 };
 module_hid_driver(holtek_driver);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Anssi Hannula <anssi.hannula@iki.fi>");
+MODULE_DESCRIPTION("Force feedback support for Holtek On Line Grip based devices");
diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c
index 76ed9a216f10..610223f0e945 100644
--- a/drivers/hv/vmbus_drv.c
+++ b/drivers/hv/vmbus_drv.c
@@ -1378,6 +1378,8 @@ void vmbus_device_unregister(struct hv_device *device_obj)
         pr_debug("child device %s unregistered\n",
                 dev_name(&device_obj->device));
 
+        kset_unregister(device_obj->channels_kset);
+
         /*
          * Kick off the process of unregistering the device.
          * This will call vmbus_remove() and eventually vmbus_device_release()
diff --git a/drivers/hwmon/hwmon.c b/drivers/hwmon/hwmon.c
index c9790e2c3440..af5123042990 100644
--- a/drivers/hwmon/hwmon.c
+++ b/drivers/hwmon/hwmon.c
@@ -143,6 +143,7 @@ static int hwmon_thermal_add_sensor(struct device *dev,
                                     struct hwmon_device *hwdev, int index)
 {
         struct hwmon_thermal_data *tdata;
+        struct thermal_zone_device *tzd;
 
         tdata = devm_kzalloc(dev, sizeof(*tdata), GFP_KERNEL);
         if (!tdata)
@@ -151,8 +152,14 @@ static int hwmon_thermal_add_sensor(struct device *dev,
         tdata->hwdev = hwdev;
         tdata->index = index;
 
-        devm_thermal_zone_of_sensor_register(&hwdev->dev, index, tdata,
-                                             &hwmon_thermal_ops);
+        tzd = devm_thermal_zone_of_sensor_register(&hwdev->dev, index, tdata,
+                                                   &hwmon_thermal_ops);
+        /*
+         * If CONFIG_THERMAL_OF is disabled, this returns -ENODEV,
+         * so ignore that error but forward any other error.
+         */
+        if (IS_ERR(tzd) && (PTR_ERR(tzd) != -ENODEV))
+                return PTR_ERR(tzd);
 
         return 0;
 }
@@ -621,14 +628,20 @@ __hwmon_device_register(struct device *dev, const char *name, void *drvdata,
                                 if (!chip->ops->is_visible(drvdata, hwmon_temp,
                                                            hwmon_temp_input, j))
                                         continue;
-                                if (info[i]->config[j] & HWMON_T_INPUT)
-                                        hwmon_thermal_add_sensor(dev, hwdev, j);
+                                if (info[i]->config[j] & HWMON_T_INPUT) {
+                                        err = hwmon_thermal_add_sensor(dev,
+                                                                hwdev, j);
+                                        if (err)
+                                                goto free_device;
+                                }
                         }
                 }
         }
 
         return hdev;
 
+free_device:
+        device_unregister(hdev);
 free_hwmon:
         kfree(hwdev);
 ida_remove:
diff --git a/drivers/hwtracing/stm/ftrace.c b/drivers/hwtracing/stm/ftrace.c
index bd126a7c6da2..7da75644c750 100644
--- a/drivers/hwtracing/stm/ftrace.c
+++ b/drivers/hwtracing/stm/ftrace.c
@@ -42,9 +42,11 @@ static struct stm_ftrace {
  * @len:        length of the data packet
  */
 static void notrace
-stm_ftrace_write(const void *buf, unsigned int len)
+stm_ftrace_write(struct trace_export *export, const void *buf, unsigned int len)
 {
-        stm_source_write(&stm_ftrace.data, STM_FTRACE_CHAN, buf, len);
+        struct stm_ftrace *stm = container_of(export, struct stm_ftrace, ftrace);
+
+        stm_source_write(&stm->data, STM_FTRACE_CHAN, buf, len);
 }
 
 static int stm_ftrace_link(struct stm_source_data *data)
diff --git a/drivers/i2c/busses/i2c-cht-wc.c b/drivers/i2c/busses/i2c-cht-wc.c
index 0d05dadb2dc5..44cffad43701 100644
--- a/drivers/i2c/busses/i2c-cht-wc.c
+++ b/drivers/i2c/busses/i2c-cht-wc.c
@@ -379,7 +379,7 @@ static int cht_wc_i2c_adap_i2c_remove(struct platform_device *pdev)
         return 0;
 }
 
-static struct platform_device_id cht_wc_i2c_adap_id_table[] = {
+static const struct platform_device_id cht_wc_i2c_adap_id_table[] = {
         { .name = "cht_wcove_ext_chgr" },
         {},
 };
diff --git a/drivers/i2c/busses/i2c-piix4.c b/drivers/i2c/busses/i2c-piix4.c
index 174579d32e5f..462948e2c535 100644
--- a/drivers/i2c/busses/i2c-piix4.c
+++ b/drivers/i2c/busses/i2c-piix4.c
@@ -983,7 +983,7 @@ static void piix4_adap_remove(struct i2c_adapter *adap)
 
         if (adapdata->smba) {
                 i2c_del_adapter(adap);
-                if (adapdata->port == (0 << 1)) {
+                if (adapdata->port == (0 << piix4_port_shift_sb800)) {
                         release_region(adapdata->smba, SMBIOSIZE);
                         if (adapdata->sb800_main)
                                 release_region(SB800_PIIX4_SMB_IDX, 2);
diff --git a/drivers/i2c/busses/i2c-stm32.h b/drivers/i2c/busses/i2c-stm32.h
index dab51761f8c5..d4f9cef251ac 100644
--- a/drivers/i2c/busses/i2c-stm32.h
+++ b/drivers/i2c/busses/i2c-stm32.h
@@ -1,10 +1,11 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
  * i2c-stm32.h
  *
  * Copyright (C) M'boumba Cedric Madianga 2017
+ * Copyright (C) STMicroelectronics 2017
  * Author: M'boumba Cedric Madianga <cedric.madianga@gmail.com>
  *
- * License terms:  GNU General Public License (GPL), version 2
  */
 
 #ifndef _I2C_STM32_H
diff --git a/drivers/i2c/busses/i2c-stm32f4.c b/drivers/i2c/busses/i2c-stm32f4.c
index 4ec108496f15..47c8d00de53f 100644
--- a/drivers/i2c/busses/i2c-stm32f4.c
+++ b/drivers/i2c/busses/i2c-stm32f4.c
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
  * Driver for STMicroelectronics STM32 I2C controller
  *
@@ -6,11 +7,11 @@
  * http://www.st.com/resource/en/reference_manual/DM00031020.pdf
  *
  * Copyright (C) M'boumba Cedric Madianga 2016
+ * Copyright (C) STMicroelectronics 2017
  * Author: M'boumba Cedric Madianga <cedric.madianga@gmail.com>
  *
  * This driver is based on i2c-st.c
  *
- * License terms:  GNU General Public License (GPL), version 2
  */
 
 #include <linux/clk.h>
diff --git a/drivers/i2c/busses/i2c-stm32f7.c b/drivers/i2c/busses/i2c-stm32f7.c
index d4a6e9c2e9aa..b445b3bb0bb1 100644
--- a/drivers/i2c/busses/i2c-stm32f7.c
+++ b/drivers/i2c/busses/i2c-stm32f7.c
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
  * Driver for STMicroelectronics STM32F7 I2C controller
  *
@@ -7,11 +8,11 @@
  * http://www.st.com/resource/en/reference_manual/dm00124865.pdf
  *
  * Copyright (C) M'boumba Cedric Madianga 2017
+ * Copyright (C) STMicroelectronics 2017
  * Author: M'boumba Cedric Madianga <cedric.madianga@gmail.com>
  *
  * This driver is based on i2c-stm32f4.c
  *
- * License terms:  GNU General Public License (GPL), version 2
  */
 #include <linux/clk.h>
 #include <linux/delay.h>
diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index f6983357145d..6294a7001d33 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -4458,7 +4458,7 @@ out:
         return skb->len;
 }
 
-static const struct rdma_nl_cbs cma_cb_table[] = {
+static const struct rdma_nl_cbs cma_cb_table[RDMA_NL_RDMA_CM_NUM_OPS] = {
         [RDMA_NL_RDMA_CM_ID_STATS] = { .dump = cma_get_id_stats},
 };
 
diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
index 5e1be4949d5f..30914f3baa5f 100644
--- a/drivers/infiniband/core/device.c
+++ b/drivers/infiniband/core/device.c
@@ -1146,7 +1146,7 @@ struct net_device *ib_get_net_dev_by_params(struct ib_device *dev,
 }
 EXPORT_SYMBOL(ib_get_net_dev_by_params);
 
-static const struct rdma_nl_cbs ibnl_ls_cb_table[] = {
+static const struct rdma_nl_cbs ibnl_ls_cb_table[RDMA_NL_LS_NUM_OPS] = {
         [RDMA_NL_LS_OP_RESOLVE] = {
                 .doit = ib_nl_handle_resolve_resp,
                 .flags = RDMA_NL_ADMIN_PERM,
diff --git a/drivers/infiniband/core/iwcm.c b/drivers/infiniband/core/iwcm.c
index e9e189ec7502..5d676cff41f4 100644
--- a/drivers/infiniband/core/iwcm.c
+++ b/drivers/infiniband/core/iwcm.c
@@ -80,7 +80,7 @@ const char *__attribute_const__ iwcm_reject_msg(int reason)
 }
 EXPORT_SYMBOL(iwcm_reject_msg);
 
-static struct rdma_nl_cbs iwcm_nl_cb_table[] = {
+static struct rdma_nl_cbs iwcm_nl_cb_table[RDMA_NL_IWPM_NUM_OPS] = {
         [RDMA_NL_IWPM_REG_PID] = {.dump = iwpm_register_pid_cb},
         [RDMA_NL_IWPM_ADD_MAPPING] = {.dump = iwpm_add_mapping_cb},
         [RDMA_NL_IWPM_QUERY_MAPPING] = {.dump = iwpm_add_and_query_mapping_cb},
diff --git a/drivers/infiniband/core/nldev.c b/drivers/infiniband/core/nldev.c
index 2fae850a3eff..9a05245a1acf 100644
--- a/drivers/infiniband/core/nldev.c
+++ b/drivers/infiniband/core/nldev.c
@@ -303,7 +303,7 @@ out:	cb->args[0] = idx;
         return skb->len;
 }
 
-static const struct rdma_nl_cbs nldev_cb_table[] = {
+static const struct rdma_nl_cbs nldev_cb_table[RDMA_NLDEV_NUM_OPS] = {
         [RDMA_NLDEV_CMD_GET] = {
                 .doit = nldev_get_doit,
                 .dump = nldev_get_dumpit,
diff --git a/drivers/infiniband/core/security.c b/drivers/infiniband/core/security.c
index a337386652b0..59b2f96d986a 100644
--- a/drivers/infiniband/core/security.c
+++ b/drivers/infiniband/core/security.c
@@ -386,6 +386,9 @@ int ib_open_shared_qp_security(struct ib_qp *qp, struct ib_device *dev)
         if (ret)
                 return ret;
 
+        if (!qp->qp_sec)
+                return 0;
+
         mutex_lock(&real_qp->qp_sec->mutex);
         ret = check_qp_port_pkey_settings(real_qp->qp_sec->ports_pkeys,
                                           qp->qp_sec);
@@ -739,8 +742,11 @@ int ib_mad_enforce_security(struct ib_mad_agent_private *map, u16 pkey_index)
         if (!rdma_protocol_ib(map->agent.device, map->agent.port_num))
                 return 0;
 
-        if (map->agent.qp->qp_type == IB_QPT_SMI && !map->agent.smp_allowed)
-                return -EACCES;
+        if (map->agent.qp->qp_type == IB_QPT_SMI) {
+                if (!map->agent.smp_allowed)
+                        return -EACCES;
+                return 0;
+        }
 
         return ib_security_pkey_access(map->agent.device,
                                        map->agent.port_num,
diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
index 16d55710b116..840b24096690 100644
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -1971,6 +1971,12 @@ static int modify_qp(struct ib_uverbs_file *file,
                 goto release_qp;
         }
 
+        if ((cmd->base.attr_mask & IB_QP_ALT_PATH) &&
+            !rdma_is_port_valid(qp->device, cmd->base.alt_port_num)) {
+                ret = -EINVAL;
+                goto release_qp;
+        }
+
         attr->qp_state            = cmd->base.qp_state;
         attr->cur_qp_state        = cmd->base.cur_qp_state;
         attr->path_mtu            = cmd->base.path_mtu;
@@ -2068,8 +2074,8 @@ int ib_uverbs_ex_modify_qp(struct ib_uverbs_file *file,
                 return -EOPNOTSUPP;
 
         if (ucore->inlen > sizeof(cmd)) {
-                if (ib_is_udata_cleared(ucore, sizeof(cmd),
-                                        ucore->inlen - sizeof(cmd)))
+                if (!ib_is_udata_cleared(ucore, sizeof(cmd),
+                                         ucore->inlen - sizeof(cmd)))
                         return -EOPNOTSUPP;
         }
 
diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c
index 3fb8fb6cc824..e36d27ed4daa 100644
--- a/drivers/infiniband/core/verbs.c
+++ b/drivers/infiniband/core/verbs.c
@@ -1438,7 +1438,8 @@ int ib_close_qp(struct ib_qp *qp)
         spin_unlock_irqrestore(&real_qp->device->event_handler_lock, flags);
 
         atomic_dec(&real_qp->usecnt);
-        ib_close_shared_qp_security(qp->qp_sec);
+        if (qp->qp_sec)
+                ib_close_shared_qp_security(qp->qp_sec);
         kfree(qp);
 
         return 0;
diff --git a/drivers/infiniband/hw/cxgb4/cq.c b/drivers/infiniband/hw/cxgb4/cq.c
index ea55e95cd2c5..6f2b26126c64 100644
--- a/drivers/infiniband/hw/cxgb4/cq.c
+++ b/drivers/infiniband/hw/cxgb4/cq.c
@@ -395,6 +395,11 @@ next_cqe:
 
 static int cqe_completes_wr(struct t4_cqe *cqe, struct t4_wq *wq)
 {
+        if (DRAIN_CQE(cqe)) {
+                WARN_ONCE(1, "Unexpected DRAIN CQE qp id %u!\n", wq->sq.qid);
+                return 0;
+        }
+
         if (CQE_OPCODE(cqe) == FW_RI_TERMINATE)
                 return 0;
 
@@ -489,7 +494,7 @@ static int poll_cq(struct t4_wq *wq, struct t4_cq *cq, struct t4_cqe *cqe,
         /*
          * Special cqe for drain WR completions...
          */
-        if (CQE_OPCODE(hw_cqe) == C4IW_DRAIN_OPCODE) {
+        if (DRAIN_CQE(hw_cqe)) {
                 *cookie = CQE_DRAIN_COOKIE(hw_cqe);
                 *cqe = *hw_cqe;
                 goto skip_cqe;
@@ -566,10 +571,10 @@ static int poll_cq(struct t4_wq *wq, struct t4_cq *cq, struct t4_cqe *cqe,
                         ret = -EAGAIN;
                         goto skip_cqe;
                 }
-                if (unlikely((CQE_WRID_MSN(hw_cqe) != (wq->rq.msn)))) {
+                if (unlikely(!CQE_STATUS(hw_cqe) &&
+                             CQE_WRID_MSN(hw_cqe) != wq->rq.msn)) {
                         t4_set_wq_in_error(wq);
-                        hw_cqe->header |= htonl(CQE_STATUS_V(T4_ERR_MSN));
-                        goto proc_cqe;
+                        hw_cqe->header |= cpu_to_be32(CQE_STATUS_V(T4_ERR_MSN));
                 }
                 goto proc_cqe;
         }
@@ -743,9 +748,6 @@ static int c4iw_poll_cq_one(struct c4iw_cq *chp, struct ib_wc *wc)
                                 c4iw_invalidate_mr(qhp->rhp,
                                                    CQE_WRID_FR_STAG(&cqe));
                         break;
-                case C4IW_DRAIN_OPCODE:
-                        wc->opcode = IB_WC_SEND;
-                        break;
                 default:
                         pr_err("Unexpected opcode %d in the CQE received for QPID=0x%0x\n",
                                CQE_OPCODE(&cqe), CQE_QPID(&cqe));
diff --git a/drivers/infiniband/hw/cxgb4/iw_cxgb4.h b/drivers/infiniband/hw/cxgb4/iw_cxgb4.h
index 470f97a79ebb..65dd3726ca02 100644
--- a/drivers/infiniband/hw/cxgb4/iw_cxgb4.h
+++ b/drivers/infiniband/hw/cxgb4/iw_cxgb4.h
@@ -693,8 +693,6 @@ static inline int to_ib_qp_state(int c4iw_qp_state)
         return IB_QPS_ERR;
 }
 
-#define C4IW_DRAIN_OPCODE FW_RI_SGE_EC_CR_RETURN
-
 static inline u32 c4iw_ib_to_tpt_access(int a)
 {
         return (a & IB_ACCESS_REMOTE_WRITE ? FW_RI_MEM_ACCESS_REM_WRITE : 0) |
diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4/qp.c
index 5ee7fe433136..d5c92fc520d6 100644
--- a/drivers/infiniband/hw/cxgb4/qp.c
+++ b/drivers/infiniband/hw/cxgb4/qp.c
@@ -790,21 +790,57 @@ static int ring_kernel_rq_db(struct c4iw_qp *qhp, u16 inc)
         return 0;
 }
 
-static void complete_sq_drain_wr(struct c4iw_qp *qhp, struct ib_send_wr *wr)
+static int ib_to_fw_opcode(int ib_opcode)
+{
+        int opcode;
+
+        switch (ib_opcode) {
+        case IB_WR_SEND_WITH_INV:
+                opcode = FW_RI_SEND_WITH_INV;
+                break;
+        case IB_WR_SEND:
+                opcode = FW_RI_SEND;
+                break;
+        case IB_WR_RDMA_WRITE:
+                opcode = FW_RI_RDMA_WRITE;
+                break;
+        case IB_WR_RDMA_READ:
+        case IB_WR_RDMA_READ_WITH_INV:
+                opcode = FW_RI_READ_REQ;
+                break;
+        case IB_WR_REG_MR:
+                opcode = FW_RI_FAST_REGISTER;
+                break;
+        case IB_WR_LOCAL_INV:
+                opcode = FW_RI_LOCAL_INV;
+                break;
+        default:
+                opcode = -EINVAL;
+        }
+        return opcode;
+}
+
+static int complete_sq_drain_wr(struct c4iw_qp *qhp, struct ib_send_wr *wr)
 {
         struct t4_cqe cqe = {};
         struct c4iw_cq *schp;
         unsigned long flag;
         struct t4_cq *cq;
+        int opcode;
 
         schp = to_c4iw_cq(qhp->ibqp.send_cq);
         cq = &schp->cq;
 
+        opcode = ib_to_fw_opcode(wr->opcode);
+        if (opcode < 0)
+                return opcode;
+
         cqe.u.drain_cookie = wr->wr_id;
         cqe.header = cpu_to_be32(CQE_STATUS_V(T4_ERR_SWFLUSH) |
-                                 CQE_OPCODE_V(C4IW_DRAIN_OPCODE) |
+                                 CQE_OPCODE_V(opcode) |
                                  CQE_TYPE_V(1) |
                                  CQE_SWCQE_V(1) |
+                                 CQE_DRAIN_V(1) |
                                  CQE_QPID_V(qhp->wq.sq.qid));
 
         spin_lock_irqsave(&schp->lock, flag);
@@ -819,6 +855,23 @@ static void complete_sq_drain_wr(struct c4iw_qp *qhp, struct ib_send_wr *wr)
                                            schp->ibcq.cq_context);
                 spin_unlock_irqrestore(&schp->comp_handler_lock, flag);
         }
+        return 0;
+}
+
+static int complete_sq_drain_wrs(struct c4iw_qp *qhp, struct ib_send_wr *wr,
+                                struct ib_send_wr **bad_wr)
+{
+        int ret = 0;
+
+        while (wr) {
+                ret = complete_sq_drain_wr(qhp, wr);
+                if (ret) {
+                        *bad_wr = wr;
+                        break;
+                }
+                wr = wr->next;
+        }
+        return ret;
 }
 
 static void complete_rq_drain_wr(struct c4iw_qp *qhp, struct ib_recv_wr *wr)
@@ -833,9 +886,10 @@ static void complete_rq_drain_wr(struct c4iw_qp *qhp, struct ib_recv_wr *wr)
 
         cqe.u.drain_cookie = wr->wr_id;
         cqe.header = cpu_to_be32(CQE_STATUS_V(T4_ERR_SWFLUSH) |
-                                 CQE_OPCODE_V(C4IW_DRAIN_OPCODE) |
+                                 CQE_OPCODE_V(FW_RI_SEND) |
                                  CQE_TYPE_V(0) |
                                  CQE_SWCQE_V(1) |
+                                 CQE_DRAIN_V(1) |
                                  CQE_QPID_V(qhp->wq.sq.qid));
 
         spin_lock_irqsave(&rchp->lock, flag);
@@ -852,6 +906,14 @@ static void complete_rq_drain_wr(struct c4iw_qp *qhp, struct ib_recv_wr *wr)
         }
 }
 
+static void complete_rq_drain_wrs(struct c4iw_qp *qhp, struct ib_recv_wr *wr)
+{
+        while (wr) {
+                complete_rq_drain_wr(qhp, wr);
+                wr = wr->next;
+        }
+}
+
 int c4iw_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                    struct ib_send_wr **bad_wr)
 {
@@ -868,9 +930,14 @@ int c4iw_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
 
         qhp = to_c4iw_qp(ibqp);
         spin_lock_irqsave(&qhp->lock, flag);
-        if (t4_wq_in_error(&qhp->wq)) {
+
+        /*
+         * If the qp has been flushed, then just insert a special
+         * drain cqe.
+         */
+        if (qhp->wq.flushed) {
                 spin_unlock_irqrestore(&qhp->lock, flag);
-                complete_sq_drain_wr(qhp, wr);
+                err = complete_sq_drain_wrs(qhp, wr, bad_wr);
                 return err;
         }
         num_wrs = t4_sq_avail(&qhp->wq);
@@ -1011,9 +1078,14 @@ int c4iw_post_receive(struct ib_qp *ibqp, struct ib_recv_wr *wr,
 
         qhp = to_c4iw_qp(ibqp);
         spin_lock_irqsave(&qhp->lock, flag);
-        if (t4_wq_in_error(&qhp->wq)) {
+
+        /*
+         * If the qp has been flushed, then just insert a special
+         * drain cqe.
+         */
+        if (qhp->wq.flushed) {
                 spin_unlock_irqrestore(&qhp->lock, flag);
-                complete_rq_drain_wr(qhp, wr);
+                complete_rq_drain_wrs(qhp, wr);
                 return err;
         }
         num_wrs = t4_rq_avail(&qhp->wq);
@@ -1285,21 +1357,21 @@ static void __flush_qp(struct c4iw_qp *qhp, struct c4iw_cq *rchp,
         spin_unlock_irqrestore(&rchp->lock, flag);
 
         if (schp == rchp) {
-                if (t4_clear_cq_armed(&rchp->cq) &&
-                    (rq_flushed || sq_flushed)) {
+                if ((rq_flushed || sq_flushed) &&
+                    t4_clear_cq_armed(&rchp->cq)) {
                         spin_lock_irqsave(&rchp->comp_handler_lock, flag);
                         (*rchp->ibcq.comp_handler)(&rchp->ibcq,
                                                    rchp->ibcq.cq_context);
                         spin_unlock_irqrestore(&rchp->comp_handler_lock, flag);
                 }
         } else {
-                if (t4_clear_cq_armed(&rchp->cq) && rq_flushed) {
+                if (rq_flushed && t4_clear_cq_armed(&rchp->cq)) {
                         spin_lock_irqsave(&rchp->comp_handler_lock, flag);
                         (*rchp->ibcq.comp_handler)(&rchp->ibcq,
                                                    rchp->ibcq.cq_context);
                         spin_unlock_irqrestore(&rchp->comp_handler_lock, flag);
                 }
-                if (t4_clear_cq_armed(&schp->cq) && sq_flushed) {
+                if (sq_flushed && t4_clear_cq_armed(&schp->cq)) {
                         spin_lock_irqsave(&schp->comp_handler_lock, flag);
                         (*schp->ibcq.comp_handler)(&schp->ibcq,
                                                    schp->ibcq.cq_context);
diff --git a/drivers/infiniband/hw/cxgb4/t4.h b/drivers/infiniband/hw/cxgb4/t4.h
index e9ea94268d51..79e8ee12c391 100644
--- a/drivers/infiniband/hw/cxgb4/t4.h
+++ b/drivers/infiniband/hw/cxgb4/t4.h
@@ -197,6 +197,11 @@ struct t4_cqe {
 #define CQE_SWCQE_G(x)    ((((x) >> CQE_SWCQE_S)) & CQE_SWCQE_M)
 #define CQE_SWCQE_V(x)    ((x)<<CQE_SWCQE_S)
 
+#define CQE_DRAIN_S       10
+#define CQE_DRAIN_M       0x1
+#define CQE_DRAIN_G(x)    ((((x) >> CQE_DRAIN_S)) & CQE_DRAIN_M)
+#define CQE_DRAIN_V(x)    ((x)<<CQE_DRAIN_S)
+
 #define CQE_STATUS_S      5
 #define CQE_STATUS_M      0x1F
 #define CQE_STATUS_G(x)   ((((x) >> CQE_STATUS_S)) & CQE_STATUS_M)
@@ -213,6 +218,7 @@ struct t4_cqe {
 #define CQE_OPCODE_V(x)   ((x)<<CQE_OPCODE_S)
 
 #define SW_CQE(x)         (CQE_SWCQE_G(be32_to_cpu((x)->header)))
+#define DRAIN_CQE(x)      (CQE_DRAIN_G(be32_to_cpu((x)->header)))
 #define CQE_QPID(x)       (CQE_QPID_G(be32_to_cpu((x)->header)))
 #define CQE_TYPE(x)       (CQE_TYPE_G(be32_to_cpu((x)->header)))
 #define SQ_TYPE(x)        (CQE_TYPE((x)))
diff --git a/drivers/infiniband/hw/hfi1/hfi.h b/drivers/infiniband/hw/hfi1/hfi.h
index 4a9b4d7efe63..8ce9118d4a7f 100644
--- a/drivers/infiniband/hw/hfi1/hfi.h
+++ b/drivers/infiniband/hw/hfi1/hfi.h
@@ -1131,7 +1131,6 @@ struct hfi1_devdata {
         u16 pcie_lnkctl;
         u16 pcie_devctl2;
         u32 pci_msix0;
-        u32 pci_lnkctl3;
         u32 pci_tph2;
 
         /*
diff --git a/drivers/infiniband/hw/hfi1/pcie.c b/drivers/infiniband/hw/hfi1/pcie.c
index 09e50fd2a08f..8c7e7a60b715 100644
--- a/drivers/infiniband/hw/hfi1/pcie.c
+++ b/drivers/infiniband/hw/hfi1/pcie.c
@@ -411,15 +411,12 @@ int restore_pci_variables(struct hfi1_devdata *dd)
         if (ret)
                 goto error;
 
-        ret = pci_write_config_dword(dd->pcidev, PCIE_CFG_SPCIE1,
-                                     dd->pci_lnkctl3);
-        if (ret)
-                goto error;
-
-        ret = pci_write_config_dword(dd->pcidev, PCIE_CFG_TPH2, dd->pci_tph2);
-        if (ret)
-                goto error;
-
+        if (pci_find_ext_capability(dd->pcidev, PCI_EXT_CAP_ID_TPH)) {
+                ret = pci_write_config_dword(dd->pcidev, PCIE_CFG_TPH2,
+                                             dd->pci_tph2);
+                if (ret)
+                        goto error;
+        }
         return 0;
 
 error:
@@ -469,15 +466,12 @@ int save_pci_variables(struct hfi1_devdata *dd)
         if (ret)
                 goto error;
 
-        ret = pci_read_config_dword(dd->pcidev, PCIE_CFG_SPCIE1,
-                                    &dd->pci_lnkctl3);
-        if (ret)
-                goto error;
-
-        ret = pci_read_config_dword(dd->pcidev, PCIE_CFG_TPH2, &dd->pci_tph2);
-        if (ret)
-                goto error;
-
+        if (pci_find_ext_capability(dd->pcidev, PCI_EXT_CAP_ID_TPH)) {
+                ret = pci_read_config_dword(dd->pcidev, PCIE_CFG_TPH2,
+                                            &dd->pci_tph2);
+                if (ret)
+                        goto error;
+        }
         return 0;
 
 error:
diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c
index 013049bcdb53..caf490ab24c8 100644
--- a/drivers/infiniband/hw/mlx4/qp.c
+++ b/drivers/infiniband/hw/mlx4/qp.c
@@ -666,6 +666,19 @@ static int set_qp_rss(struct mlx4_ib_dev *dev, struct mlx4_ib_rss *rss_ctx,
                 return (-EOPNOTSUPP);
         }
 
+        if (ucmd->rx_hash_fields_mask & ~(MLX4_IB_RX_HASH_SRC_IPV4      |
+                                          MLX4_IB_RX_HASH_DST_IPV4      |
+                                          MLX4_IB_RX_HASH_SRC_IPV6      |
+                                          MLX4_IB_RX_HASH_DST_IPV6      |
+                                          MLX4_IB_RX_HASH_SRC_PORT_TCP  |
+                                          MLX4_IB_RX_HASH_DST_PORT_TCP  |
+                                          MLX4_IB_RX_HASH_SRC_PORT_UDP  |
+                                          MLX4_IB_RX_HASH_DST_PORT_UDP)) {
+                pr_debug("RX Hash fields_mask has unsupported mask (0x%llx)\n",
+                         ucmd->rx_hash_fields_mask);
+                return (-EOPNOTSUPP);
+        }
+
         if ((ucmd->rx_hash_fields_mask & MLX4_IB_RX_HASH_SRC_IPV4) &&
             (ucmd->rx_hash_fields_mask & MLX4_IB_RX_HASH_DST_IPV4)) {
                 rss_ctx->flags = MLX4_RSS_IPV4;
@@ -691,11 +704,11 @@ static int set_qp_rss(struct mlx4_ib_dev *dev, struct mlx4_ib_rss *rss_ctx,
                         return (-EOPNOTSUPP);
                 }
 
-                if (rss_ctx->flags & MLX4_RSS_IPV4) {
+                if (rss_ctx->flags & MLX4_RSS_IPV4)
                         rss_ctx->flags |= MLX4_RSS_UDP_IPV4;
-                } else if (rss_ctx->flags & MLX4_RSS_IPV6) {
+                if (rss_ctx->flags & MLX4_RSS_IPV6)
                         rss_ctx->flags |= MLX4_RSS_UDP_IPV6;
-                } else {
+                if (!(rss_ctx->flags & (MLX4_RSS_IPV6 | MLX4_RSS_IPV4))) {
                         pr_debug("RX Hash fields_mask is not supported - UDP must be set with IPv4 or IPv6\n");
                         return (-EOPNOTSUPP);
                 }
@@ -707,15 +720,14 @@ static int set_qp_rss(struct mlx4_ib_dev *dev, struct mlx4_ib_rss *rss_ctx,
 
         if ((ucmd->rx_hash_fields_mask & MLX4_IB_RX_HASH_SRC_PORT_TCP) &&
             (ucmd->rx_hash_fields_mask & MLX4_IB_RX_HASH_DST_PORT_TCP)) {
-                if (rss_ctx->flags & MLX4_RSS_IPV4) {
+                if (rss_ctx->flags & MLX4_RSS_IPV4)
                         rss_ctx->flags |= MLX4_RSS_TCP_IPV4;
-                } else if (rss_ctx->flags & MLX4_RSS_IPV6) {
+                if (rss_ctx->flags & MLX4_RSS_IPV6)
                         rss_ctx->flags |= MLX4_RSS_TCP_IPV6;
-                } else {
+                if (!(rss_ctx->flags & (MLX4_RSS_IPV6 | MLX4_RSS_IPV4))) {
                         pr_debug("RX Hash fields_mask is not supported - TCP must be set with IPv4 or IPv6\n");
                         return (-EOPNOTSUPP);
                 }
-
         } else if ((ucmd->rx_hash_fields_mask & MLX4_IB_RX_HASH_SRC_PORT_TCP) ||
                    (ucmd->rx_hash_fields_mask & MLX4_IB_RX_HASH_DST_PORT_TCP)) {
                 pr_debug("RX Hash fields_mask is not supported - both TCP SRC and DST must be set\n");
diff --git a/drivers/infiniband/hw/mlx5/cmd.c b/drivers/infiniband/hw/mlx5/cmd.c
index 470995fa38d2..6f6712f87a73 100644
--- a/drivers/infiniband/hw/mlx5/cmd.c
+++ b/drivers/infiniband/hw/mlx5/cmd.c
@@ -47,17 +47,6 @@ int mlx5_cmd_null_mkey(struct mlx5_core_dev *dev, u32 *null_mkey)
         return err;
 }
 
-int mlx5_cmd_query_cong_counter(struct mlx5_core_dev *dev,
-                                bool reset, void *out, int out_size)
-{
-        u32 in[MLX5_ST_SZ_DW(query_cong_statistics_in)] = { };
-
-        MLX5_SET(query_cong_statistics_in, in, opcode,
-                 MLX5_CMD_OP_QUERY_CONG_STATISTICS);
-        MLX5_SET(query_cong_statistics_in, in, clear, reset);
-        return mlx5_cmd_exec(dev, in, sizeof(in), out, out_size);
-}
-
 int mlx5_cmd_query_cong_params(struct mlx5_core_dev *dev, int cong_point,
                                void *out, int out_size)
 {
diff --git a/drivers/infiniband/hw/mlx5/cmd.h b/drivers/infiniband/hw/mlx5/cmd.h
index af4c24596274..78ffded7cc2c 100644
--- a/drivers/infiniband/hw/mlx5/cmd.h
+++ b/drivers/infiniband/hw/mlx5/cmd.h
@@ -37,8 +37,6 @@
 #include <linux/mlx5/driver.h>
 
 int mlx5_cmd_null_mkey(struct mlx5_core_dev *dev, u32 *null_mkey);
-int mlx5_cmd_query_cong_counter(struct mlx5_core_dev *dev,
-                                bool reset, void *out, int out_size);
 int mlx5_cmd_query_cong_params(struct mlx5_core_dev *dev, int cong_point,
                                void *out, int out_size);
 int mlx5_cmd_modify_cong_params(struct mlx5_core_dev *mdev,
diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
index 543d0a4c8bf3..8ac50de2b242 100644
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -1463,6 +1463,7 @@ static struct ib_ucontext *mlx5_ib_alloc_ucontext(struct ib_device *ibdev,
         }
 
         INIT_LIST_HEAD(&context->vma_private_list);
+        mutex_init(&context->vma_private_list_mutex);
         INIT_LIST_HEAD(&context->db_page_list);
         mutex_init(&context->db_page_mutex);
 
@@ -1624,7 +1625,9 @@ static void  mlx5_ib_vma_close(struct vm_area_struct *area)
          * mlx5_ib_disassociate_ucontext().
          */
         mlx5_ib_vma_priv_data->vma = NULL;
+        mutex_lock(mlx5_ib_vma_priv_data->vma_private_list_mutex);
         list_del(&mlx5_ib_vma_priv_data->list);
+        mutex_unlock(mlx5_ib_vma_priv_data->vma_private_list_mutex);
         kfree(mlx5_ib_vma_priv_data);
 }
 
@@ -1644,10 +1647,13 @@ static int mlx5_ib_set_vma_data(struct vm_area_struct *vma,
                 return -ENOMEM;
 
         vma_prv->vma = vma;
+        vma_prv->vma_private_list_mutex = &ctx->vma_private_list_mutex;
         vma->vm_private_data = vma_prv;
         vma->vm_ops =  &mlx5_ib_vm_ops;
 
+        mutex_lock(&ctx->vma_private_list_mutex);
         list_add(&vma_prv->list, vma_head);
+        mutex_unlock(&ctx->vma_private_list_mutex);
 
         return 0;
 }
@@ -1690,6 +1696,7 @@ static void mlx5_ib_disassociate_ucontext(struct ib_ucontext *ibcontext)
          * mlx5_ib_vma_close.
          */
         down_write(&owning_mm->mmap_sem);
+        mutex_lock(&context->vma_private_list_mutex);
         list_for_each_entry_safe(vma_private, n, &context->vma_private_list,
                                  list) {
                 vma = vma_private->vma;
@@ -1704,6 +1711,7 @@ static void mlx5_ib_disassociate_ucontext(struct ib_ucontext *ibcontext)
                 list_del(&vma_private->list);
                 kfree(vma_private);
         }
+        mutex_unlock(&context->vma_private_list_mutex);
         up_write(&owning_mm->mmap_sem);
         mmput(owning_mm);
         put_task_struct(owning_process);
@@ -3737,34 +3745,6 @@ free:
         return ret;
 }
 
-static int mlx5_ib_query_cong_counters(struct mlx5_ib_dev *dev,
-                                       struct mlx5_ib_port *port,
-                                       struct rdma_hw_stats *stats)
-{
-        int outlen = MLX5_ST_SZ_BYTES(query_cong_statistics_out);
-        void *out;
-        int ret, i;
-        int offset = port->cnts.num_q_counters;
-
-        out = kvzalloc(outlen, GFP_KERNEL);
-        if (!out)
-                return -ENOMEM;
-
-        ret = mlx5_cmd_query_cong_counter(dev->mdev, false, out, outlen);
-        if (ret)
-                goto free;
-
-        for (i = 0; i < port->cnts.num_cong_counters; i++) {
-                stats->value[i + offset] =
-                        be64_to_cpup((__be64 *)(out +
-                                     port->cnts.offsets[i + offset]));
-        }
-
-free:
-        kvfree(out);
-        return ret;
-}
-
 static int mlx5_ib_get_hw_stats(struct ib_device *ibdev,
                                 struct rdma_hw_stats *stats,
                                 u8 port_num, int index)
@@ -3782,7 +3762,12 @@ static int mlx5_ib_get_hw_stats(struct ib_device *ibdev,
         num_counters = port->cnts.num_q_counters;
 
         if (MLX5_CAP_GEN(dev->mdev, cc_query_allowed)) {
-                ret = mlx5_ib_query_cong_counters(dev, port, stats);
+                ret = mlx5_lag_query_cong_counters(dev->mdev,
+                                                   stats->value +
+                                                   port->cnts.num_q_counters,
+                                                   port->cnts.num_cong_counters,
+                                                   port->cnts.offsets +
+                                                   port->cnts.num_q_counters);
                 if (ret)
                         return ret;
                 num_counters += port->cnts.num_cong_counters;
diff --git a/drivers/infiniband/hw/mlx5/mlx5_ib.h b/drivers/infiniband/hw/mlx5/mlx5_ib.h
index 6dd8cac78de2..2c5f3533bbc9 100644
--- a/drivers/infiniband/hw/mlx5/mlx5_ib.h
+++ b/drivers/infiniband/hw/mlx5/mlx5_ib.h
@@ -115,6 +115,8 @@ enum {
 struct mlx5_ib_vma_private_data {
         struct list_head list;
         struct vm_area_struct *vma;
+        /* protect vma_private_list add/del */
+        struct mutex *vma_private_list_mutex;
 };
 
 struct mlx5_ib_ucontext {
@@ -129,6 +131,8 @@ struct mlx5_ib_ucontext {
         /* Transport Domain number */
         u32                     tdn;
         struct list_head        vma_private_list;
+        /* protect vma_private_list add/del */
+        struct mutex            vma_private_list_mutex;
 
         unsigned long           upd_xlt_page;
         /* protect ODP/KSM */
diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c
index ee0ee1f9994b..d109fe8290a7 100644
--- a/drivers/infiniband/hw/mlx5/mr.c
+++ b/drivers/infiniband/hw/mlx5/mr.c
@@ -1637,6 +1637,7 @@ struct ib_mr *mlx5_ib_alloc_mr(struct ib_pd *pd,
         MLX5_SET(mkc, mkc, access_mode, mr->access_mode);
         MLX5_SET(mkc, mkc, umr_en, 1);
 
+        mr->ibmr.device = pd->device;
         err = mlx5_core_create_mkey(dev->mdev, &mr->mmkey, in, inlen);
         if (err)
                 goto err_destroy_psv;
diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma.h b/drivers/infiniband/hw/vmw_pvrdma/pvrdma.h
index 63bc2efc34eb..4f7bd3b6a315 100644
--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma.h
+++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma.h
@@ -94,7 +94,7 @@ struct pvrdma_cq {
         u32 cq_handle;
         bool is_kernel;
         atomic_t refcnt;
-        wait_queue_head_t wait;
+        struct completion free;
 };
 
 struct pvrdma_id_table {
@@ -175,7 +175,7 @@ struct pvrdma_srq {
         u32 srq_handle;
         int npages;
         refcount_t refcnt;
-        wait_queue_head_t wait;
+        struct completion free;
 };
 
 struct pvrdma_qp {
@@ -197,7 +197,7 @@ struct pvrdma_qp {
         bool is_kernel;
         struct mutex mutex; /* QP state mutex. */
         atomic_t refcnt;
-        wait_queue_head_t wait;
+        struct completion free;
 };
 
 struct pvrdma_dev {
diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_cq.c b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_cq.c
index 3562c0c30492..e529622cefad 100644
--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_cq.c
+++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_cq.c
@@ -179,7 +179,7 @@ struct ib_cq *pvrdma_create_cq(struct ib_device *ibdev,
                 pvrdma_page_dir_insert_umem(&cq->pdir, cq->umem, 0);
 
         atomic_set(&cq->refcnt, 1);
-        init_waitqueue_head(&cq->wait);
+        init_completion(&cq->free);
         spin_lock_init(&cq->cq_lock);
 
         memset(cmd, 0, sizeof(*cmd));
@@ -230,8 +230,9 @@ err_cq:
 
 static void pvrdma_free_cq(struct pvrdma_dev *dev, struct pvrdma_cq *cq)
 {
-        atomic_dec(&cq->refcnt);
-        wait_event(cq->wait, !atomic_read(&cq->refcnt));
+        if (atomic_dec_and_test(&cq->refcnt))
+                complete(&cq->free);
+        wait_for_completion(&cq->free);
 
         if (!cq->is_kernel)
                 ib_umem_release(cq->umem);
diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c
index 1f4e18717a00..e92681878c93 100644
--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c
+++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c
@@ -346,9 +346,8 @@ static void pvrdma_qp_event(struct pvrdma_dev *dev, u32 qpn, int type)
                 ibqp->event_handler(&e, ibqp->qp_context);
         }
         if (qp) {
-                atomic_dec(&qp->refcnt);
-                if (atomic_read(&qp->refcnt) == 0)
-                        wake_up(&qp->wait);
+                if (atomic_dec_and_test(&qp->refcnt))
+                        complete(&qp->free);
         }
 }
 
@@ -373,9 +372,8 @@ static void pvrdma_cq_event(struct pvrdma_dev *dev, u32 cqn, int type)
                 ibcq->event_handler(&e, ibcq->cq_context);
         }
         if (cq) {
-                atomic_dec(&cq->refcnt);
-                if (atomic_read(&cq->refcnt) == 0)
-                        wake_up(&cq->wait);
+                if (atomic_dec_and_test(&cq->refcnt))
+                        complete(&cq->free);
         }
 }
 
@@ -404,7 +402,7 @@ static void pvrdma_srq_event(struct pvrdma_dev *dev, u32 srqn, int type)
         }
         if (srq) {
                 if (refcount_dec_and_test(&srq->refcnt))
-                        wake_up(&srq->wait);
+                        complete(&srq->free);
         }
 }
 
@@ -539,9 +537,8 @@ static irqreturn_t pvrdma_intrx_handler(int irq, void *dev_id)
                 if (cq && cq->ibcq.comp_handler)
                         cq->ibcq.comp_handler(&cq->ibcq, cq->ibcq.cq_context);
                 if (cq) {
-                        atomic_dec(&cq->refcnt);
-                        if (atomic_read(&cq->refcnt))
-                                wake_up(&cq->wait);
+                        if (atomic_dec_and_test(&cq->refcnt))
+                                complete(&cq->free);
                 }
                 pvrdma_idx_ring_inc(&ring->cons_head, ring_slots);
         }
diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_qp.c b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_qp.c
index 10420a18d02f..4059308e1454 100644
--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_qp.c
+++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_qp.c
@@ -246,7 +246,7 @@ struct ib_qp *pvrdma_create_qp(struct ib_pd *pd,
                 spin_lock_init(&qp->rq.lock);
                 mutex_init(&qp->mutex);
                 atomic_set(&qp->refcnt, 1);
-                init_waitqueue_head(&qp->wait);
+                init_completion(&qp->free);
 
                 qp->state = IB_QPS_RESET;
 
@@ -428,8 +428,16 @@ static void pvrdma_free_qp(struct pvrdma_qp *qp)
 
         pvrdma_unlock_cqs(scq, rcq, &scq_flags, &rcq_flags);
 
-        atomic_dec(&qp->refcnt);
-        wait_event(qp->wait, !atomic_read(&qp->refcnt));
+        if (atomic_dec_and_test(&qp->refcnt))
+                complete(&qp->free);
+        wait_for_completion(&qp->free);
+
+        if (!qp->is_kernel) {
+                if (qp->rumem)
+                        ib_umem_release(qp->rumem);
+                if (qp->sumem)
+                        ib_umem_release(qp->sumem);
+        }
 
         pvrdma_page_dir_cleanup(dev, &qp->pdir);
 
diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_srq.c b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_srq.c
index 826ccb864596..5acebb1ef631 100644
--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_srq.c
+++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_srq.c
@@ -149,7 +149,7 @@ struct ib_srq *pvrdma_create_srq(struct ib_pd *pd,
 
         spin_lock_init(&srq->lock);
         refcount_set(&srq->refcnt, 1);
-        init_waitqueue_head(&srq->wait);
+        init_completion(&srq->free);
 
         dev_dbg(&dev->pdev->dev,
                 "create shared receive queue from user space\n");
@@ -236,8 +236,9 @@ static void pvrdma_free_srq(struct pvrdma_dev *dev, struct pvrdma_srq *srq)
         dev->srq_tbl[srq->srq_handle] = NULL;
         spin_unlock_irqrestore(&dev->srq_tbl_lock, flags);
 
-        refcount_dec(&srq->refcnt);
-        wait_event(srq->wait, !refcount_read(&srq->refcnt));
+        if (refcount_dec_and_test(&srq->refcnt))
+                complete(&srq->free);
+        wait_for_completion(&srq->free);
 
         /* There is no support for kernel clients, so this is safe. */
         ib_umem_release(srq->umem);
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
index 87f4bd99cdf7..2c13123bfd69 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
@@ -1145,6 +1145,7 @@ static int ipoib_cm_tx_init(struct ipoib_cm_tx *p, u32 qpn,
         noio_flag = memalloc_noio_save();
         p->tx_ring = vzalloc(ipoib_sendq_size * sizeof(*p->tx_ring));
         if (!p->tx_ring) {
+                memalloc_noio_restore(noio_flag);
                 ret = -ENOMEM;
                 goto err_tx;
         }
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
index 3b96cdaf9a83..e6151a29c412 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
@@ -1236,13 +1236,10 @@ static void __ipoib_ib_dev_flush(struct ipoib_dev_priv *priv,
                 ipoib_ib_dev_down(dev);
 
         if (level == IPOIB_FLUSH_HEAVY) {
-                rtnl_lock();
                 if (test_bit(IPOIB_FLAG_INITIALIZED, &priv->flags))
                         ipoib_ib_dev_stop(dev);
 
-                result = ipoib_ib_dev_open(dev);
-                rtnl_unlock();
-                if (result)
+                if (ipoib_ib_dev_open(dev))
                         return;
 
                 if (netif_queue_stopped(dev))
@@ -1282,7 +1279,9 @@ void ipoib_ib_dev_flush_heavy(struct work_struct *work)
         struct ipoib_dev_priv *priv =
                 container_of(work, struct ipoib_dev_priv, flush_heavy);
 
+        rtnl_lock();
         __ipoib_ib_dev_flush(priv, IPOIB_FLUSH_HEAVY, 0);
+        rtnl_unlock();
 }
 
 void ipoib_ib_dev_cleanup(struct net_device *dev)
diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
index 7d5eb004091d..97baf88d9505 100644
--- a/drivers/iommu/amd_iommu.c
+++ b/drivers/iommu/amd_iommu.c
@@ -4184,7 +4184,7 @@ static void amd_ir_update_irte(struct irq_data *irqd, struct amd_iommu *iommu,
                                struct irq_cfg *cfg);
 
 static int irq_remapping_activate(struct irq_domain *domain,
-                                  struct irq_data *irq_data, bool early)
+                                  struct irq_data *irq_data, bool reserve)
 {
         struct amd_ir_data *data = irq_data->chip_data;
         struct irq_2_irte *irte_info = &data->irq_2_irte;
diff --git a/drivers/iommu/intel_irq_remapping.c b/drivers/iommu/intel_irq_remapping.c
index 76a193c7fcfc..66f69af2c219 100644
--- a/drivers/iommu/intel_irq_remapping.c
+++ b/drivers/iommu/intel_irq_remapping.c
@@ -1397,7 +1397,7 @@ static void intel_irq_remapping_free(struct irq_domain *domain,
 }
 
 static int intel_irq_remapping_activate(struct irq_domain *domain,
-                                        struct irq_data *irq_data, bool early)
+                                        struct irq_data *irq_data, bool reserve)
 {
         intel_ir_reconfigure_irte(irq_data, true);
         return 0;
diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index 4039e64cd342..06f025fd5726 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -2303,7 +2303,7 @@ static int its_irq_domain_alloc(struct irq_domain *domain, unsigned int virq,
 }
 
 static int its_irq_domain_activate(struct irq_domain *domain,
-                                   struct irq_data *d, bool early)
+                                   struct irq_data *d, bool reserve)
 {
         struct its_device *its_dev = irq_data_get_irq_chip_data(d);
         u32 event = its_get_event_id(d);
@@ -2818,7 +2818,7 @@ static int its_vpe_irq_domain_alloc(struct irq_domain *domain, unsigned int virq
 }
 
 static int its_vpe_irq_domain_activate(struct irq_domain *domain,
-                                       struct irq_data *d, bool early)
+                                       struct irq_data *d, bool reserve)
 {
         struct its_vpe *vpe = irq_data_get_irq_chip_data(d);
         struct its_node *its;
diff --git a/drivers/irqchip/irq-renesas-intc-irqpin.c b/drivers/irqchip/irq-renesas-intc-irqpin.c
index 06f29cf5018a..cee59fe1321c 100644
--- a/drivers/irqchip/irq-renesas-intc-irqpin.c
+++ b/drivers/irqchip/irq-renesas-intc-irqpin.c
@@ -342,6 +342,9 @@ static irqreturn_t intc_irqpin_shared_irq_handler(int irq, void *dev_id)
  */
 static struct lock_class_key intc_irqpin_irq_lock_class;
 
+/* And this is for the request mutex */
+static struct lock_class_key intc_irqpin_irq_request_class;
+
 static int intc_irqpin_irq_domain_map(struct irq_domain *h, unsigned int virq,
                                       irq_hw_number_t hw)
 {
@@ -352,7 +355,8 @@ static int intc_irqpin_irq_domain_map(struct irq_domain *h, unsigned int virq,
 
         intc_irqpin_dbg(&p->irq[hw], "map");
         irq_set_chip_data(virq, h->host_data);
-        irq_set_lockdep_class(virq, &intc_irqpin_irq_lock_class);
+        irq_set_lockdep_class(virq, &intc_irqpin_irq_lock_class,
+                              &intc_irqpin_irq_request_class);
         irq_set_chip_and_handler(virq, &p->irq_chip, handle_level_irq);
         return 0;
 }
diff --git a/drivers/leds/led-core.c b/drivers/leds/led-core.c
index fd83c7f77a95..f3654fd2eaf3 100644
--- a/drivers/leds/led-core.c
+++ b/drivers/leds/led-core.c
@@ -186,7 +186,7 @@ void led_blink_set(struct led_classdev *led_cdev,
                    unsigned long *delay_on,
                    unsigned long *delay_off)
 {
-        del_timer_sync(&led_cdev->blink_timer);
+        led_stop_software_blink(led_cdev);
 
         clear_bit(LED_BLINK_ONESHOT, &led_cdev->work_flags);
         clear_bit(LED_BLINK_ONESHOT_STOP, &led_cdev->work_flags);
diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c
index b8ac591aaaa7..c546b567f3b5 100644
--- a/drivers/md/dm-bufio.c
+++ b/drivers/md/dm-bufio.c
@@ -1611,7 +1611,8 @@ static unsigned long __scan(struct dm_bufio_client *c, unsigned long nr_to_scan,
         int l;
         struct dm_buffer *b, *tmp;
         unsigned long freed = 0;
-        unsigned long count = nr_to_scan;
+        unsigned long count = c->n_buffers[LIST_CLEAN] +
+                              c->n_buffers[LIST_DIRTY];
         unsigned long retain_target = get_retain_buffers(c);
 
         for (l = 0; l < LIST_SIZE; l++) {
@@ -1647,8 +1648,11 @@ static unsigned long
 dm_bufio_shrink_count(struct shrinker *shrink, struct shrink_control *sc)
 {
         struct dm_bufio_client *c = container_of(shrink, struct dm_bufio_client, shrinker);
+        unsigned long count = READ_ONCE(c->n_buffers[LIST_CLEAN]) +
+                              READ_ONCE(c->n_buffers[LIST_DIRTY]);
+        unsigned long retain_target = get_retain_buffers(c);
 
-        return READ_ONCE(c->n_buffers[LIST_CLEAN]) + READ_ONCE(c->n_buffers[LIST_DIRTY]);
+        return (count < retain_target) ? 0 : (count - retain_target);
 }
 
 /*
diff --git a/drivers/md/dm-cache-target.c b/drivers/md/dm-cache-target.c
index cf23a14f9c6a..47407e43b96a 100644
--- a/drivers/md/dm-cache-target.c
+++ b/drivers/md/dm-cache-target.c
@@ -3472,18 +3472,18 @@ static int __init dm_cache_init(void)
 {
         int r;
 
-        r = dm_register_target(&cache_target);
-        if (r) {
-                DMERR("cache target registration failed: %d", r);
-                return r;
-        }
-
         migration_cache = KMEM_CACHE(dm_cache_migration, 0);
         if (!migration_cache) {
                 dm_unregister_target(&cache_target);
                 return -ENOMEM;
         }
 
+        r = dm_register_target(&cache_target);
+        if (r) {
+                DMERR("cache target registration failed: %d", r);
+                return r;
+        }
+
         return 0;
 }
 
diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
index c8faa2b85842..f7810cc869ac 100644
--- a/drivers/md/dm-mpath.c
+++ b/drivers/md/dm-mpath.c
@@ -458,6 +458,38 @@ do {									\
 } while (0)
 
 /*
+ * Check whether bios must be queued in the device-mapper core rather
+ * than here in the target.
+ *
+ * If MPATHF_QUEUE_IF_NO_PATH and MPATHF_SAVED_QUEUE_IF_NO_PATH hold
+ * the same value then we are not between multipath_presuspend()
+ * and multipath_resume() calls and we have no need to check
+ * for the DMF_NOFLUSH_SUSPENDING flag.
+ */
+static bool __must_push_back(struct multipath *m, unsigned long flags)
+{
+        return ((test_bit(MPATHF_QUEUE_IF_NO_PATH, &flags) !=
+                 test_bit(MPATHF_SAVED_QUEUE_IF_NO_PATH, &flags)) &&
+                dm_noflush_suspending(m->ti));
+}
+
+/*
+ * Following functions use READ_ONCE to get atomic access to
+ * all m->flags to avoid taking spinlock
+ */
+static bool must_push_back_rq(struct multipath *m)
+{
+        unsigned long flags = READ_ONCE(m->flags);
+        return test_bit(MPATHF_QUEUE_IF_NO_PATH, &flags) || __must_push_back(m, flags);
+}
+
+static bool must_push_back_bio(struct multipath *m)
+{
+        unsigned long flags = READ_ONCE(m->flags);
+        return __must_push_back(m, flags);
+}
+
+/*
  * Map cloned requests (request-based multipath)
  */
 static int multipath_clone_and_map(struct dm_target *ti, struct request *rq,
@@ -478,7 +510,7 @@ static int multipath_clone_and_map(struct dm_target *ti, struct request *rq,
                 pgpath = choose_pgpath(m, nr_bytes);
 
         if (!pgpath) {
-                if (test_bit(MPATHF_QUEUE_IF_NO_PATH, &m->flags))
+                if (must_push_back_rq(m))
                         return DM_MAPIO_DELAY_REQUEUE;
                 dm_report_EIO(m);       /* Failed */
                 return DM_MAPIO_KILL;
@@ -553,7 +585,7 @@ static int __multipath_map_bio(struct multipath *m, struct bio *bio, struct dm_m
         }
 
         if (!pgpath) {
-                if (test_bit(MPATHF_QUEUE_IF_NO_PATH, &m->flags))
+                if (must_push_back_bio(m))
                         return DM_MAPIO_REQUEUE;
                 dm_report_EIO(m);
                 return DM_MAPIO_KILL;
@@ -651,8 +683,7 @@ static int queue_if_no_path(struct multipath *m, bool queue_if_no_path,
         assign_bit(MPATHF_SAVED_QUEUE_IF_NO_PATH, &m->flags,
                    (save_old_value && test_bit(MPATHF_QUEUE_IF_NO_PATH, &m->flags)) ||
                    (!save_old_value && queue_if_no_path));
-        assign_bit(MPATHF_QUEUE_IF_NO_PATH, &m->flags,
-                   queue_if_no_path || dm_noflush_suspending(m->ti));
+        assign_bit(MPATHF_QUEUE_IF_NO_PATH, &m->flags, queue_if_no_path);
         spin_unlock_irqrestore(&m->lock, flags);
 
         if (!queue_if_no_path) {
@@ -1486,7 +1517,7 @@ static int multipath_end_io(struct dm_target *ti, struct request *clone,
                         fail_path(pgpath);
 
                 if (atomic_read(&m->nr_valid_paths) == 0 &&
-                    !test_bit(MPATHF_QUEUE_IF_NO_PATH, &m->flags)) {
+                    !must_push_back_rq(m)) {
                         if (error == BLK_STS_IOERR)
                                 dm_report_EIO(m);
                         /* complete with the original error */
@@ -1521,8 +1552,12 @@ static int multipath_end_io_bio(struct dm_target *ti, struct bio *clone,
 
         if (atomic_read(&m->nr_valid_paths) == 0 &&
             !test_bit(MPATHF_QUEUE_IF_NO_PATH, &m->flags)) {
-                dm_report_EIO(m);
-                *error = BLK_STS_IOERR;
+                if (must_push_back_bio(m)) {
+                        r = DM_ENDIO_REQUEUE;
+                } else {
+                        dm_report_EIO(m);
+                        *error = BLK_STS_IOERR;
+                }
                 goto done;
         }
 
@@ -1957,13 +1992,6 @@ static int __init dm_multipath_init(void)
 {
         int r;
 
-        r = dm_register_target(&multipath_target);
-        if (r < 0) {
-                DMERR("request-based register failed %d", r);
-                r = -EINVAL;
-                goto bad_register_target;
-        }
-
         kmultipathd = alloc_workqueue("kmpathd", WQ_MEM_RECLAIM, 0);
         if (!kmultipathd) {
                 DMERR("failed to create workqueue kmpathd");
@@ -1985,13 +2013,20 @@ static int __init dm_multipath_init(void)
                 goto bad_alloc_kmpath_handlerd;
         }
 
+        r = dm_register_target(&multipath_target);
+        if (r < 0) {
+                DMERR("request-based register failed %d", r);
+                r = -EINVAL;
+                goto bad_register_target;
+        }
+
         return 0;
 
+bad_register_target:
+        destroy_workqueue(kmpath_handlerd);
 bad_alloc_kmpath_handlerd:
         destroy_workqueue(kmultipathd);
 bad_alloc_kmultipathd:
-        dm_unregister_target(&multipath_target);
-bad_register_target:
         return r;
 }
 
diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c
index 1113b42e1eda..a0613bd8ed00 100644
--- a/drivers/md/dm-snap.c
+++ b/drivers/md/dm-snap.c
@@ -2411,24 +2411,6 @@ static int __init dm_snapshot_init(void)
                 return r;
         }
 
-        r = dm_register_target(&snapshot_target);
-        if (r < 0) {
-                DMERR("snapshot target register failed %d", r);
-                goto bad_register_snapshot_target;
-        }
-
-        r = dm_register_target(&origin_target);
-        if (r < 0) {
-                DMERR("Origin target register failed %d", r);
-                goto bad_register_origin_target;
-        }
-
-        r = dm_register_target(&merge_target);
-        if (r < 0) {
-                DMERR("Merge target register failed %d", r);
-                goto bad_register_merge_target;
-        }
-
         r = init_origin_hash();
         if (r) {
                 DMERR("init_origin_hash failed.");
@@ -2449,19 +2431,37 @@ static int __init dm_snapshot_init(void)
                 goto bad_pending_cache;
         }
 
+        r = dm_register_target(&snapshot_target);
+        if (r < 0) {
+                DMERR("snapshot target register failed %d", r);
+                goto bad_register_snapshot_target;
+        }
+
+        r = dm_register_target(&origin_target);
+        if (r < 0) {
+                DMERR("Origin target register failed %d", r);
+                goto bad_register_origin_target;
+        }
+
+        r = dm_register_target(&merge_target);
+        if (r < 0) {
+                DMERR("Merge target register failed %d", r);
+                goto bad_register_merge_target;
+        }
+
         return 0;
 
-bad_pending_cache:
-        kmem_cache_destroy(exception_cache);
-bad_exception_cache:
-        exit_origin_hash();
-bad_origin_hash:
-        dm_unregister_target(&merge_target);
 bad_register_merge_target:
         dm_unregister_target(&origin_target);
 bad_register_origin_target:
         dm_unregister_target(&snapshot_target);
 bad_register_snapshot_target:
+        kmem_cache_destroy(pending_cache);
+bad_pending_cache:
+        kmem_cache_destroy(exception_cache);
+bad_exception_cache:
+        exit_origin_hash();
+bad_origin_hash:
         dm_exception_store_exit();
 
         return r;
diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
index 88130b5d95f9..aaffd0c0ee9a 100644
--- a/drivers/md/dm-table.c
+++ b/drivers/md/dm-table.c
@@ -453,14 +453,15 @@ int dm_get_device(struct dm_target *ti, const char *path, fmode_t mode,
 
                 refcount_set(&dd->count, 1);
                 list_add(&dd->list, &t->devices);
+                goto out;
 
         } else if (dd->dm_dev->mode != (mode | dd->dm_dev->mode)) {
                 r = upgrade_mode(dd, mode, t->md);
                 if (r)
                         return r;
-                refcount_inc(&dd->count);
         }
-
+        refcount_inc(&dd->count);
+out:
         *result = dd->dm_dev;
         return 0;
 }
diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
index 89e5dff9b4cf..f91d771fff4b 100644
--- a/drivers/md/dm-thin.c
+++ b/drivers/md/dm-thin.c
@@ -4355,30 +4355,28 @@ static struct target_type thin_target = {
 
 static int __init dm_thin_init(void)
 {
-        int r;
+        int r = -ENOMEM;
 
         pool_table_init();
 
+        _new_mapping_cache = KMEM_CACHE(dm_thin_new_mapping, 0);
+        if (!_new_mapping_cache)
+                return r;
+
         r = dm_register_target(&thin_target);
         if (r)
-                return r;
+                goto bad_new_mapping_cache;
 
         r = dm_register_target(&pool_target);
         if (r)
-                goto bad_pool_target;
-
-        r = -ENOMEM;
-
-        _new_mapping_cache = KMEM_CACHE(dm_thin_new_mapping, 0);
-        if (!_new_mapping_cache)
-                goto bad_new_mapping_cache;
+                goto bad_thin_target;
 
         return 0;
 
-bad_new_mapping_cache:
-        dm_unregister_target(&pool_target);
-bad_pool_target:
+bad_thin_target:
         dm_unregister_target(&thin_target);
+bad_new_mapping_cache:
+        kmem_cache_destroy(_new_mapping_cache);
 
         return r;
 }
diff --git a/drivers/mfd/arizona-irq.c b/drivers/mfd/arizona-irq.c
index 09cf3699e354..a307832d7e45 100644
--- a/drivers/mfd/arizona-irq.c
+++ b/drivers/mfd/arizona-irq.c
@@ -184,6 +184,7 @@ static struct irq_chip arizona_irq_chip = {
 };
 
 static struct lock_class_key arizona_irq_lock_class;
+static struct lock_class_key arizona_irq_request_class;
 
 static int arizona_irq_map(struct irq_domain *h, unsigned int virq,
                               irq_hw_number_t hw)
@@ -191,7 +192,8 @@ static int arizona_irq_map(struct irq_domain *h, unsigned int virq,
         struct arizona *data = h->host_data;
 
         irq_set_chip_data(virq, data);
-        irq_set_lockdep_class(virq, &arizona_irq_lock_class);
+        irq_set_lockdep_class(virq, &arizona_irq_lock_class,
+                &arizona_irq_request_class);
         irq_set_chip_and_handler(virq, &arizona_irq_chip, handle_simple_irq);
         irq_set_nested_thread(virq, 1);
         irq_set_noprobe(virq);
diff --git a/drivers/mfd/cros_ec_spi.c b/drivers/mfd/cros_ec_spi.c
index c9714072e224..59c82cdcf48d 100644
--- a/drivers/mfd/cros_ec_spi.c
+++ b/drivers/mfd/cros_ec_spi.c
@@ -377,6 +377,7 @@ static int cros_ec_pkt_xfer_spi(struct cros_ec_device *ec_dev,
         u8 *ptr;
         u8 *rx_buf;
         u8 sum;
+        u8 rx_byte;
         int ret = 0, final_ret;
 
         len = cros_ec_prepare_tx(ec_dev, ec_msg);
@@ -421,25 +422,22 @@ static int cros_ec_pkt_xfer_spi(struct cros_ec_device *ec_dev,
         if (!ret) {
                 /* Verify that EC can process command */
                 for (i = 0; i < len; i++) {
-                        switch (rx_buf[i]) {
-                        case EC_SPI_PAST_END:
-                        case EC_SPI_RX_BAD_DATA:
-                        case EC_SPI_NOT_READY:
-                                ret = -EAGAIN;
-                                ec_msg->result = EC_RES_IN_PROGRESS;
-                        default:
+                        rx_byte = rx_buf[i];
+                        if (rx_byte == EC_SPI_PAST_END  ||
+                            rx_byte == EC_SPI_RX_BAD_DATA ||
+                            rx_byte == EC_SPI_NOT_READY) {
+                                ret = -EREMOTEIO;
                                 break;
                         }
-                        if (ret)
-                                break;
                 }
-                if (!ret)
-                        ret = cros_ec_spi_receive_packet(ec_dev,
-                                        ec_msg->insize + sizeof(*response));
-        } else {
-                dev_err(ec_dev->dev, "spi transfer failed: %d\n", ret);
         }
 
+        if (!ret)
+                ret = cros_ec_spi_receive_packet(ec_dev,
+                                ec_msg->insize + sizeof(*response));
+        else
+                dev_err(ec_dev->dev, "spi transfer failed: %d\n", ret);
+
         final_ret = terminate_request(ec_dev);
 
         spi_bus_unlock(ec_spi->spi->master);
@@ -508,6 +506,7 @@ static int cros_ec_cmd_xfer_spi(struct cros_ec_device *ec_dev,
         int i, len;
         u8 *ptr;
         u8 *rx_buf;
+        u8 rx_byte;
         int sum;
         int ret = 0, final_ret;
 
@@ -544,25 +543,22 @@ static int cros_ec_cmd_xfer_spi(struct cros_ec_device *ec_dev,
         if (!ret) {
                 /* Verify that EC can process command */
                 for (i = 0; i < len; i++) {
-                        switch (rx_buf[i]) {
-                        case EC_SPI_PAST_END:
-                        case EC_SPI_RX_BAD_DATA:
-                        case EC_SPI_NOT_READY:
-                                ret = -EAGAIN;
-                                ec_msg->result = EC_RES_IN_PROGRESS;
-                        default:
+                        rx_byte = rx_buf[i];
+                        if (rx_byte == EC_SPI_PAST_END  ||
+                            rx_byte == EC_SPI_RX_BAD_DATA ||
+                            rx_byte == EC_SPI_NOT_READY) {
+                                ret = -EREMOTEIO;
                                 break;
                         }
-                        if (ret)
-                                break;
                 }
-                if (!ret)
-                        ret = cros_ec_spi_receive_response(ec_dev,
-                                        ec_msg->insize + EC_MSG_TX_PROTO_BYTES);
-        } else {
-                dev_err(ec_dev->dev, "spi transfer failed: %d\n", ret);
         }
 
+        if (!ret)
+                ret = cros_ec_spi_receive_response(ec_dev,
+                                ec_msg->insize + EC_MSG_TX_PROTO_BYTES);
+        else
+                dev_err(ec_dev->dev, "spi transfer failed: %d\n", ret);
+
         final_ret = terminate_request(ec_dev);
 
         spi_bus_unlock(ec_spi->spi->master);
@@ -667,6 +663,7 @@ static int cros_ec_spi_probe(struct spi_device *spi)
                            sizeof(struct ec_response_get_protocol_info);
         ec_dev->dout_size = sizeof(struct ec_host_request);
 
+        ec_spi->last_transfer_ns = ktime_get_ns();
 
         err = cros_ec_register(ec_dev);
         if (err) {
diff --git a/drivers/mfd/twl4030-audio.c b/drivers/mfd/twl4030-audio.c
index da16bf45fab4..dc94ffc6321a 100644
--- a/drivers/mfd/twl4030-audio.c
+++ b/drivers/mfd/twl4030-audio.c
@@ -159,13 +159,18 @@ unsigned int twl4030_audio_get_mclk(void)
 EXPORT_SYMBOL_GPL(twl4030_audio_get_mclk);
 
 static bool twl4030_audio_has_codec(struct twl4030_audio_data *pdata,
-                              struct device_node *node)
+                              struct device_node *parent)
 {
+        struct device_node *node;
+
         if (pdata && pdata->codec)
                 return true;
 
-        if (of_find_node_by_name(node, "codec"))
+        node = of_get_child_by_name(parent, "codec");
+        if (node) {
+                of_node_put(node);
                 return true;
+        }
 
         return false;
 }
diff --git a/drivers/mfd/twl6040.c b/drivers/mfd/twl6040.c
index d66502d36ba0..dd19f17a1b63 100644
--- a/drivers/mfd/twl6040.c
+++ b/drivers/mfd/twl6040.c
@@ -97,12 +97,16 @@ static struct reg_sequence twl6040_patch[] = {
 };
 
 
-static bool twl6040_has_vibra(struct device_node *node)
+static bool twl6040_has_vibra(struct device_node *parent)
 {
-#ifdef CONFIG_OF
-        if (of_find_node_by_name(node, "vibra"))
+        struct device_node *node;
+
+        node = of_get_child_by_name(parent, "vibra");
+        if (node) {
+                of_node_put(node);
                 return true;
-#endif
+        }
+
         return false;
 }
 
diff --git a/drivers/misc/eeprom/at24.c b/drivers/misc/eeprom/at24.c
index 305a7a464d09..4d63ac8a82e0 100644
--- a/drivers/misc/eeprom/at24.c
+++ b/drivers/misc/eeprom/at24.c
@@ -562,7 +562,7 @@ static ssize_t at24_eeprom_write_i2c(struct at24_data *at24, const char *buf,
 static int at24_read(void *priv, unsigned int off, void *val, size_t count)
 {
         struct at24_data *at24 = priv;
-        struct i2c_client *client;
+        struct device *dev = &at24->client[0]->dev;
         char *buf = val;
         int ret;
 
@@ -572,11 +572,9 @@ static int at24_read(void *priv, unsigned int off, void *val, size_t count)
         if (off + count > at24->chip.byte_len)
                 return -EINVAL;
 
-        client = at24_translate_offset(at24, &off);
-
-        ret = pm_runtime_get_sync(&client->dev);
+        ret = pm_runtime_get_sync(dev);
         if (ret < 0) {
-                pm_runtime_put_noidle(&client->dev);
+                pm_runtime_put_noidle(dev);
                 return ret;
         }
 
@@ -592,7 +590,7 @@ static int at24_read(void *priv, unsigned int off, void *val, size_t count)
                 status = at24->read_func(at24, buf, off, count);
                 if (status < 0) {
                         mutex_unlock(&at24->lock);
-                        pm_runtime_put(&client->dev);
+                        pm_runtime_put(dev);
                         return status;
                 }
                 buf += status;
@@ -602,7 +600,7 @@ static int at24_read(void *priv, unsigned int off, void *val, size_t count)
 
         mutex_unlock(&at24->lock);
 
-        pm_runtime_put(&client->dev);
+        pm_runtime_put(dev);
 
         return 0;
 }
@@ -610,7 +608,7 @@ static int at24_read(void *priv, unsigned int off, void *val, size_t count)
 static int at24_write(void *priv, unsigned int off, void *val, size_t count)
 {
         struct at24_data *at24 = priv;
-        struct i2c_client *client;
+        struct device *dev = &at24->client[0]->dev;
         char *buf = val;
         int ret;
 
@@ -620,11 +618,9 @@ static int at24_write(void *priv, unsigned int off, void *val, size_t count)
         if (off + count > at24->chip.byte_len)
                 return -EINVAL;
 
-        client = at24_translate_offset(at24, &off);
-
-        ret = pm_runtime_get_sync(&client->dev);
+        ret = pm_runtime_get_sync(dev);
         if (ret < 0) {
-                pm_runtime_put_noidle(&client->dev);
+                pm_runtime_put_noidle(dev);
                 return ret;
         }
 
@@ -640,7 +636,7 @@ static int at24_write(void *priv, unsigned int off, void *val, size_t count)
                 status = at24->write_func(at24, buf, off, count);
                 if (status < 0) {
                         mutex_unlock(&at24->lock);
-                        pm_runtime_put(&client->dev);
+                        pm_runtime_put(dev);
                         return status;
                 }
                 buf += status;
@@ -650,7 +646,7 @@ static int at24_write(void *priv, unsigned int off, void *val, size_t count)
 
         mutex_unlock(&at24->lock);
 
-        pm_runtime_put(&client->dev);
+        pm_runtime_put(dev);
 
         return 0;
 }
@@ -880,7 +876,7 @@ static int at24_probe(struct i2c_client *client, const struct i2c_device_id *id)
         at24->nvmem_config.reg_read = at24_read;
         at24->nvmem_config.reg_write = at24_write;
         at24->nvmem_config.priv = at24;
-        at24->nvmem_config.stride = 4;
+        at24->nvmem_config.stride = 1;
         at24->nvmem_config.word_size = 1;
         at24->nvmem_config.size = chip.byte_len;
 
diff --git a/drivers/misc/pti.c b/drivers/misc/pti.c
index eda38cbe8530..41f2a9f6851d 100644
--- a/drivers/misc/pti.c
+++ b/drivers/misc/pti.c
@@ -32,7 +32,7 @@
 #include <linux/pci.h>
 #include <linux/mutex.h>
 #include <linux/miscdevice.h>
-#include <linux/pti.h>
+#include <linux/intel-pti.h>
 #include <linux/slab.h>
 #include <linux/uaccess.h>
 
diff --git a/drivers/mmc/core/card.h b/drivers/mmc/core/card.h
index f06cd91964ce..79a5b985ccf5 100644
--- a/drivers/mmc/core/card.h
+++ b/drivers/mmc/core/card.h
@@ -75,9 +75,11 @@ struct mmc_fixup {
 #define EXT_CSD_REV_ANY (-1u)
 
 #define CID_MANFID_SANDISK      0x2
+#define CID_MANFID_ATP          0x9
 #define CID_MANFID_TOSHIBA      0x11
 #define CID_MANFID_MICRON       0x13
 #define CID_MANFID_SAMSUNG      0x15
+#define CID_MANFID_APACER       0x27
 #define CID_MANFID_KINGSTON     0x70
 #define CID_MANFID_HYNIX        0x90
 
diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c
index d209fb466979..208a762b87ef 100644
--- a/drivers/mmc/core/mmc.c
+++ b/drivers/mmc/core/mmc.c
@@ -1290,7 +1290,7 @@ out_err:
 
 static void mmc_select_driver_type(struct mmc_card *card)
 {
-        int card_drv_type, drive_strength, drv_type;
+        int card_drv_type, drive_strength, drv_type = 0;
         int fixed_drv_type = card->host->fixed_drv_type;
 
         card_drv_type = card->ext_csd.raw_driver_strength |
diff --git a/drivers/mmc/core/quirks.h b/drivers/mmc/core/quirks.h
index f664e9cbc9f8..75d317623852 100644
--- a/drivers/mmc/core/quirks.h
+++ b/drivers/mmc/core/quirks.h
@@ -53,6 +53,14 @@ static const struct mmc_fixup mmc_blk_fixups[] = {
                   MMC_QUIRK_BLK_NO_CMD23),
 
         /*
+         * Some SD cards lockup while using CMD23 multiblock transfers.
+         */
+        MMC_FIXUP("AF SD", CID_MANFID_ATP, CID_OEMID_ANY, add_quirk_sd,
+                  MMC_QUIRK_BLK_NO_CMD23),
+        MMC_FIXUP("APUSD", CID_MANFID_APACER, 0x5048, add_quirk_sd,
+                  MMC_QUIRK_BLK_NO_CMD23),
+
+        /*
          * Some MMC cards need longer data read timeout than indicated in CSD.
          */
         MMC_FIXUP(CID_NAME_ANY, CID_MANFID_MICRON, 0x200, add_quirk_mmc,
diff --git a/drivers/mtd/mtdcore.c b/drivers/mtd/mtdcore.c
index f80e911b8843..73b605577447 100644
--- a/drivers/mtd/mtdcore.c
+++ b/drivers/mtd/mtdcore.c
@@ -1114,7 +1114,7 @@ static int mtd_check_oob_ops(struct mtd_info *mtd, loff_t offs,
         if (!ops->oobbuf)
                 ops->ooblen = 0;
 
-        if (offs < 0 || offs + ops->len >= mtd->size)
+        if (offs < 0 || offs + ops->len > mtd->size)
                 return -EINVAL;
 
         if (ops->ooblen) {
diff --git a/drivers/mtd/nand/brcmnand/brcmnand.c b/drivers/mtd/nand/brcmnand/brcmnand.c
index e0eb51d8c012..dd56a671ea42 100644
--- a/drivers/mtd/nand/brcmnand/brcmnand.c
+++ b/drivers/mtd/nand/brcmnand/brcmnand.c
@@ -1763,7 +1763,7 @@ try_dmaread:
                         err = brcmstb_nand_verify_erased_page(mtd, chip, buf,
                                                               addr);
                         /* erased page bitflips corrected */
-                        if (err > 0)
+                        if (err >= 0)
                                 return err;
                 }
 
diff --git a/drivers/mtd/nand/gpio.c b/drivers/mtd/nand/gpio.c
index 484f7fbc3f7d..a8bde6665c24 100644
--- a/drivers/mtd/nand/gpio.c
+++ b/drivers/mtd/nand/gpio.c
@@ -253,9 +253,9 @@ static int gpio_nand_probe(struct platform_device *pdev)
                 goto out_ce;
         }
 
-        gpiomtd->nwp = devm_gpiod_get(dev, "ale", GPIOD_OUT_LOW);
-        if (IS_ERR(gpiomtd->nwp)) {
-                ret = PTR_ERR(gpiomtd->nwp);
+        gpiomtd->ale = devm_gpiod_get(dev, "ale", GPIOD_OUT_LOW);
+        if (IS_ERR(gpiomtd->ale)) {
+                ret = PTR_ERR(gpiomtd->ale);
                 goto out_ce;
         }
 
diff --git a/drivers/mtd/nand/gpmi-nand/gpmi-nand.c b/drivers/mtd/nand/gpmi-nand/gpmi-nand.c
index 50f8d4a1b983..d4d824ef64e9 100644
--- a/drivers/mtd/nand/gpmi-nand/gpmi-nand.c
+++ b/drivers/mtd/nand/gpmi-nand/gpmi-nand.c
@@ -1067,9 +1067,6 @@ static int gpmi_ecc_read_page(struct mtd_info *mtd, struct nand_chip *chip,
                 return ret;
         }
 
-        /* handle the block mark swapping */
-        block_mark_swapping(this, payload_virt, auxiliary_virt);
-
         /* Loop over status bytes, accumulating ECC status. */
         status = auxiliary_virt + nfc_geo->auxiliary_status_offset;
 
@@ -1158,6 +1155,9 @@ static int gpmi_ecc_read_page(struct mtd_info *mtd, struct nand_chip *chip,
                 max_bitflips = max_t(unsigned int, max_bitflips, *status);
         }
 
+        /* handle the block mark swapping */
+        block_mark_swapping(this, buf, auxiliary_virt);
+
         if (oob_required) {
                 /*
                  * It's time to deliver the OOB bytes. See gpmi_ecc_read_oob()
diff --git a/drivers/net/dsa/mv88e6xxx/port.c b/drivers/net/dsa/mv88e6xxx/port.c
index a7801f6668a5..6315774d72b3 100644
--- a/drivers/net/dsa/mv88e6xxx/port.c
+++ b/drivers/net/dsa/mv88e6xxx/port.c
@@ -338,6 +338,7 @@ int mv88e6390x_port_set_cmode(struct mv88e6xxx_chip *chip, int port,
                 cmode = MV88E6XXX_PORT_STS_CMODE_2500BASEX;
                 break;
         case PHY_INTERFACE_MODE_XGMII:
+        case PHY_INTERFACE_MODE_XAUI:
                 cmode = MV88E6XXX_PORT_STS_CMODE_XAUI;
                 break;
         case PHY_INTERFACE_MODE_RXAUI:
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h b/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h
index 57e796870595..105fdb958cef 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h
@@ -50,7 +50,7 @@
 #define AQ_CFG_PCI_FUNC_MSIX_IRQS   9U
 #define AQ_CFG_PCI_FUNC_PORTS       2U
 
-#define AQ_CFG_SERVICE_TIMER_INTERVAL    (2 * HZ)
+#define AQ_CFG_SERVICE_TIMER_INTERVAL    (1 * HZ)
 #define AQ_CFG_POLLING_TIMER_INTERVAL   ((unsigned int)(2 * HZ))
 
 #define AQ_CFG_SKB_FRAGS_MAX   32U
@@ -80,6 +80,7 @@
 #define AQ_CFG_DRV_VERSION      __stringify(NIC_MAJOR_DRIVER_VERSION)"."\
                                 __stringify(NIC_MINOR_DRIVER_VERSION)"."\
                                 __stringify(NIC_BUILD_DRIVER_VERSION)"."\
-                                __stringify(NIC_REVISION_DRIVER_VERSION)
+                                __stringify(NIC_REVISION_DRIVER_VERSION) \
+                                AQ_CFG_DRV_VERSION_SUFFIX
 
 #endif /* AQ_CFG_H */
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ethtool.c b/drivers/net/ethernet/aquantia/atlantic/aq_ethtool.c
index 70efb7467bf3..f2d8063a2cef 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_ethtool.c
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_ethtool.c
@@ -66,14 +66,14 @@ static const char aq_ethtool_stat_names[][ETH_GSTRING_LEN] = {
         "OutUCast",
         "OutMCast",
         "OutBCast",
-        "InUCastOctects",
-        "OutUCastOctects",
-        "InMCastOctects",
-        "OutMCastOctects",
-        "InBCastOctects",
-        "OutBCastOctects",
-        "InOctects",
-        "OutOctects",
+        "InUCastOctets",
+        "OutUCastOctets",
+        "InMCastOctets",
+        "OutMCastOctets",
+        "InBCastOctets",
+        "OutBCastOctets",
+        "InOctets",
+        "OutOctets",
         "InPacketsDma",
         "OutPacketsDma",
         "InOctetsDma",
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_hw.h b/drivers/net/ethernet/aquantia/atlantic/aq_hw.h
index 0207927dc8a6..b3825de6cdfb 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_hw.h
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_hw.h
@@ -46,6 +46,28 @@ struct aq_hw_link_status_s {
         unsigned int mbps;
 };
 
+struct aq_stats_s {
+        u64 uprc;
+        u64 mprc;
+        u64 bprc;
+        u64 erpt;
+        u64 uptc;
+        u64 mptc;
+        u64 bptc;
+        u64 erpr;
+        u64 mbtc;
+        u64 bbtc;
+        u64 mbrc;
+        u64 bbrc;
+        u64 ubrc;
+        u64 ubtc;
+        u64 dpc;
+        u64 dma_pkt_rc;
+        u64 dma_pkt_tc;
+        u64 dma_oct_rc;
+        u64 dma_oct_tc;
+};
+
 #define AQ_HW_IRQ_INVALID 0U
 #define AQ_HW_IRQ_LEGACY  1U
 #define AQ_HW_IRQ_MSI     2U
@@ -85,7 +107,9 @@ struct aq_hw_ops {
         void (*destroy)(struct aq_hw_s *self);
 
         int (*get_hw_caps)(struct aq_hw_s *self,
-                           struct aq_hw_caps_s *aq_hw_caps);
+                           struct aq_hw_caps_s *aq_hw_caps,
+                           unsigned short device,
+                           unsigned short subsystem_device);
 
         int (*hw_ring_tx_xmit)(struct aq_hw_s *self, struct aq_ring_s *aq_ring,
                                unsigned int frags);
@@ -164,8 +188,7 @@ struct aq_hw_ops {
 
         int (*hw_update_stats)(struct aq_hw_s *self);
 
-        int (*hw_get_hw_stats)(struct aq_hw_s *self, u64 *data,
-                               unsigned int *p_count);
+        struct aq_stats_s *(*hw_get_hw_stats)(struct aq_hw_s *self);
 
         int (*hw_get_fw_version)(struct aq_hw_s *self, u32 *fw_version);
 
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
index 78dfb2ab78ce..75a894a9251c 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
@@ -37,6 +37,8 @@ static unsigned int aq_itr_rx;
 module_param_named(aq_itr_rx, aq_itr_rx, uint, 0644);
 MODULE_PARM_DESC(aq_itr_rx, "RX interrupt throttle rate");
 
+static void aq_nic_update_ndev_stats(struct aq_nic_s *self);
+
 static void aq_nic_rss_init(struct aq_nic_s *self, unsigned int num_rss_queues)
 {
         struct aq_nic_cfg_s *cfg = &self->aq_nic_cfg;
@@ -166,11 +168,8 @@ static int aq_nic_update_link_status(struct aq_nic_s *self)
 static void aq_nic_service_timer_cb(struct timer_list *t)
 {
         struct aq_nic_s *self = from_timer(self, t, service_timer);
-        struct net_device *ndev = aq_nic_get_ndev(self);
+        int ctimer = AQ_CFG_SERVICE_TIMER_INTERVAL;
         int err = 0;
-        unsigned int i = 0U;
-        struct aq_ring_stats_rx_s stats_rx;
-        struct aq_ring_stats_tx_s stats_tx;
 
         if (aq_utils_obj_test(&self->header.flags, AQ_NIC_FLAGS_IS_NOT_READY))
                 goto err_exit;
@@ -182,23 +181,14 @@ static void aq_nic_service_timer_cb(struct timer_list *t)
         if (self->aq_hw_ops.hw_update_stats)
                 self->aq_hw_ops.hw_update_stats(self->aq_hw);
 
-        memset(&stats_rx, 0U, sizeof(struct aq_ring_stats_rx_s));
-        memset(&stats_tx, 0U, sizeof(struct aq_ring_stats_tx_s));
-        for (i = AQ_DIMOF(self->aq_vec); i--;) {
-                if (self->aq_vec[i])
-                        aq_vec_add_stats(self->aq_vec[i], &stats_rx, &stats_tx);
-        }
+        aq_nic_update_ndev_stats(self);
 
-        ndev->stats.rx_packets = stats_rx.packets;
-        ndev->stats.rx_bytes = stats_rx.bytes;
-        ndev->stats.rx_errors = stats_rx.errors;
-        ndev->stats.tx_packets = stats_tx.packets;
-        ndev->stats.tx_bytes = stats_tx.bytes;
-        ndev->stats.tx_errors = stats_tx.errors;
+        /* If no link - use faster timer rate to detect link up asap */
+        if (!netif_carrier_ok(self->ndev))
+                ctimer = max(ctimer / 2, 1);
 
 err_exit:
-        mod_timer(&self->service_timer,
-                  jiffies + AQ_CFG_SERVICE_TIMER_INTERVAL);
+        mod_timer(&self->service_timer, jiffies + ctimer);
 }
 
 static void aq_nic_polling_timer_cb(struct timer_list *t)
@@ -222,7 +212,7 @@ static struct net_device *aq_nic_ndev_alloc(void)
 
 struct aq_nic_s *aq_nic_alloc_cold(const struct net_device_ops *ndev_ops,
                                    const struct ethtool_ops *et_ops,
-                                   struct device *dev,
+                                   struct pci_dev *pdev,
                                    struct aq_pci_func_s *aq_pci_func,
                                    unsigned int port,
                                    const struct aq_hw_ops *aq_hw_ops)
@@ -242,7 +232,7 @@ struct aq_nic_s *aq_nic_alloc_cold(const struct net_device_ops *ndev_ops,
         ndev->netdev_ops = ndev_ops;
         ndev->ethtool_ops = et_ops;
 
-        SET_NETDEV_DEV(ndev, dev);
+        SET_NETDEV_DEV(ndev, &pdev->dev);
 
         ndev->if_port = port;
         self->ndev = ndev;
@@ -254,7 +244,8 @@ struct aq_nic_s *aq_nic_alloc_cold(const struct net_device_ops *ndev_ops,
 
         self->aq_hw = self->aq_hw_ops.create(aq_pci_func, self->port,
                                                 &self->aq_hw_ops);
-        err = self->aq_hw_ops.get_hw_caps(self->aq_hw, &self->aq_hw_caps);
+        err = self->aq_hw_ops.get_hw_caps(self->aq_hw, &self->aq_hw_caps,
+                                          pdev->device, pdev->subsystem_device);
         if (err < 0)
                 goto err_exit;
 
@@ -749,16 +740,40 @@ int aq_nic_get_regs_count(struct aq_nic_s *self)
 
 void aq_nic_get_stats(struct aq_nic_s *self, u64 *data)
 {
-        struct aq_vec_s *aq_vec = NULL;
         unsigned int i = 0U;
         unsigned int count = 0U;
-        int err = 0;
+        struct aq_vec_s *aq_vec = NULL;
+        struct aq_stats_s *stats = self->aq_hw_ops.hw_get_hw_stats(self->aq_hw);
 
-        err = self->aq_hw_ops.hw_get_hw_stats(self->aq_hw, data, &count);
-        if (err < 0)
+        if (!stats)
                 goto err_exit;
 
-        data += count;
+        data[i] = stats->uprc + stats->mprc + stats->bprc;
+        data[++i] = stats->uprc;
+        data[++i] = stats->mprc;
+        data[++i] = stats->bprc;
+        data[++i] = stats->erpt;
+        data[++i] = stats->uptc + stats->mptc + stats->bptc;
+        data[++i] = stats->uptc;
+        data[++i] = stats->mptc;
+        data[++i] = stats->bptc;
+        data[++i] = stats->ubrc;
+        data[++i] = stats->ubtc;
+        data[++i] = stats->mbrc;
+        data[++i] = stats->mbtc;
+        data[++i] = stats->bbrc;
+        data[++i] = stats->bbtc;
+        data[++i] = stats->ubrc + stats->mbrc + stats->bbrc;
+        data[++i] = stats->ubtc + stats->mbtc + stats->bbtc;
+        data[++i] = stats->dma_pkt_rc;
+        data[++i] = stats->dma_pkt_tc;
+        data[++i] = stats->dma_oct_rc;
+        data[++i] = stats->dma_oct_tc;
+        data[++i] = stats->dpc;
+
+        i++;
+
+        data += i;
         count = 0U;
 
         for (i = 0U, aq_vec = self->aq_vec[0];
@@ -768,7 +783,20 @@ void aq_nic_get_stats(struct aq_nic_s *self, u64 *data)
         }
 
 err_exit:;
-        (void)err;
+}
+
+static void aq_nic_update_ndev_stats(struct aq_nic_s *self)
+{
+        struct net_device *ndev = self->ndev;
+        struct aq_stats_s *stats = self->aq_hw_ops.hw_get_hw_stats(self->aq_hw);
+
+        ndev->stats.rx_packets = stats->uprc + stats->mprc + stats->bprc;
+        ndev->stats.rx_bytes = stats->ubrc + stats->mbrc + stats->bbrc;
+        ndev->stats.rx_errors = stats->erpr;
+        ndev->stats.tx_packets = stats->uptc + stats->mptc + stats->bptc;
+        ndev->stats.tx_bytes = stats->ubtc + stats->mbtc + stats->bbtc;
+        ndev->stats.tx_errors = stats->erpt;
+        ndev->stats.multicast = stats->mprc;
 }
 
 void aq_nic_get_link_ksettings(struct aq_nic_s *self,
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_nic.h b/drivers/net/ethernet/aquantia/atlantic/aq_nic.h
index 4309983acdd6..3c9f8db03d5f 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.h
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.h
@@ -71,7 +71,7 @@ struct aq_nic_cfg_s {
 
 struct aq_nic_s *aq_nic_alloc_cold(const struct net_device_ops *ndev_ops,
                                    const struct ethtool_ops *et_ops,
-                                   struct device *dev,
+                                   struct pci_dev *pdev,
                                    struct aq_pci_func_s *aq_pci_func,
                                    unsigned int port,
                                    const struct aq_hw_ops *aq_hw_ops);
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c b/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c
index cadaa646c89f..58c29d04b186 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c
@@ -51,7 +51,8 @@ struct aq_pci_func_s *aq_pci_func_alloc(struct aq_hw_ops *aq_hw_ops,
         pci_set_drvdata(pdev, self);
         self->pdev = pdev;
 
-        err = aq_hw_ops->get_hw_caps(NULL, &self->aq_hw_caps);
+        err = aq_hw_ops->get_hw_caps(NULL, &self->aq_hw_caps, pdev->device,
+                                     pdev->subsystem_device);
         if (err < 0)
                 goto err_exit;
 
@@ -59,7 +60,7 @@ struct aq_pci_func_s *aq_pci_func_alloc(struct aq_hw_ops *aq_hw_ops,
 
         for (port = 0; port < self->ports; ++port) {
                 struct aq_nic_s *aq_nic = aq_nic_alloc_cold(ndev_ops, eth_ops,
-                                                            &pdev->dev, self,
+                                                            pdev, self,
                                                             port, aq_hw_ops);
 
                 if (!aq_nic) {
diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c
index 07b3c49a16a4..f18dce14c93c 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c
@@ -18,9 +18,20 @@
 #include "hw_atl_a0_internal.h"
 
 static int hw_atl_a0_get_hw_caps(struct aq_hw_s *self,
-                                 struct aq_hw_caps_s *aq_hw_caps)
+                                 struct aq_hw_caps_s *aq_hw_caps,
+                                 unsigned short device,
+                                 unsigned short subsystem_device)
 {
         memcpy(aq_hw_caps, &hw_atl_a0_hw_caps_, sizeof(*aq_hw_caps));
+
+        if (device == HW_ATL_DEVICE_ID_D108 && subsystem_device == 0x0001)
+                aq_hw_caps->link_speed_msk &= ~HW_ATL_A0_RATE_10G;
+
+        if (device == HW_ATL_DEVICE_ID_D109 && subsystem_device == 0x0001) {
+                aq_hw_caps->link_speed_msk &= ~HW_ATL_A0_RATE_10G;
+                aq_hw_caps->link_speed_msk &= ~HW_ATL_A0_RATE_5G;
+        }
+
         return 0;
 }
 
@@ -333,6 +344,10 @@ static int hw_atl_a0_hw_init(struct aq_hw_s *self,
         hw_atl_a0_hw_rss_set(self, &aq_nic_cfg->aq_rss);
         hw_atl_a0_hw_rss_hash_set(self, &aq_nic_cfg->aq_rss);
 
+        /* Reset link status and read out initial hardware counters */
+        self->aq_link_status.mbps = 0;
+        hw_atl_utils_update_stats(self);
+
         err = aq_hw_err_from_flags(self);
         if (err < 0)
                 goto err_exit;
diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
index ec68c20efcbd..e4a22ce7bf09 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
@@ -16,11 +16,23 @@
 #include "hw_atl_utils.h"
 #include "hw_atl_llh.h"
 #include "hw_atl_b0_internal.h"
+#include "hw_atl_llh_internal.h"
 
 static int hw_atl_b0_get_hw_caps(struct aq_hw_s *self,
-                                 struct aq_hw_caps_s *aq_hw_caps)
+                                 struct aq_hw_caps_s *aq_hw_caps,
+                                 unsigned short device,
+                                 unsigned short subsystem_device)
 {
         memcpy(aq_hw_caps, &hw_atl_b0_hw_caps_, sizeof(*aq_hw_caps));
+
+        if (device == HW_ATL_DEVICE_ID_D108 && subsystem_device == 0x0001)
+                aq_hw_caps->link_speed_msk &= ~HW_ATL_B0_RATE_10G;
+
+        if (device == HW_ATL_DEVICE_ID_D109 && subsystem_device == 0x0001) {
+                aq_hw_caps->link_speed_msk &= ~HW_ATL_B0_RATE_10G;
+                aq_hw_caps->link_speed_msk &= ~HW_ATL_B0_RATE_5G;
+        }
+
         return 0;
 }
 
@@ -357,6 +369,7 @@ static int hw_atl_b0_hw_init(struct aq_hw_s *self,
         };
 
         int err = 0;
+        u32 val;
 
         self->aq_nic_cfg = aq_nic_cfg;
 
@@ -374,6 +387,20 @@ static int hw_atl_b0_hw_init(struct aq_hw_s *self,
         hw_atl_b0_hw_rss_set(self, &aq_nic_cfg->aq_rss);
         hw_atl_b0_hw_rss_hash_set(self, &aq_nic_cfg->aq_rss);
 
+        /* Force limit MRRS on RDM/TDM to 2K */
+        val = aq_hw_read_reg(self, pci_reg_control6_adr);
+        aq_hw_write_reg(self, pci_reg_control6_adr, (val & ~0x707) | 0x404);
+
+        /* TX DMA total request limit. B0 hardware is not capable to
+         * handle more than (8K-MRRS) incoming DMA data.
+         * Value 24 in 256byte units
+         */
+        aq_hw_write_reg(self, tx_dma_total_req_limit_adr, 24);
+
+        /* Reset link status and read out initial hardware counters */
+        self->aq_link_status.mbps = 0;
+        hw_atl_utils_update_stats(self);
+
         err = aq_hw_err_from_flags(self);
         if (err < 0)
                 goto err_exit;
diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh_internal.h b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh_internal.h
index 5527fc0e5942..93450ec930e8 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh_internal.h
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh_internal.h
@@ -2343,6 +2343,9 @@
 #define tx_dma_desc_base_addrmsw_adr(descriptor) \
                         (0x00007c04u + (descriptor) * 0x40)
 
+/* tx dma total request limit */
+#define tx_dma_total_req_limit_adr 0x00007b20u
+
 /* tx interrupt moderation control register definitions
  * Preprocessor definitions for TX Interrupt Moderation Control Register
  * Base Address: 0x00008980
@@ -2369,6 +2372,9 @@
 /* default value of bitfield reg_res_dsbl */
 #define pci_reg_res_dsbl_default 0x1
 
+/* PCI core control register */
+#define pci_reg_control6_adr 0x1014u
+
 /* global microprocessor scratch pad definitions */
 #define glb_cpu_scratch_scp_adr(scratch_scp) (0x00000300u + (scratch_scp) * 0x4)
 
diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c
index 1fe016fc4bc7..f2ce12ed4218 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c
@@ -503,73 +503,43 @@ int hw_atl_utils_update_stats(struct aq_hw_s *self)
         struct hw_atl_s *hw_self = PHAL_ATLANTIC;
         struct hw_aq_atl_utils_mbox mbox;
 
-        if (!self->aq_link_status.mbps)
-                return 0;
-
         hw_atl_utils_mpi_read_stats(self, &mbox);
 
 #define AQ_SDELTA(_N_) (hw_self->curr_stats._N_ += \
                         mbox.stats._N_ - hw_self->last_stats._N_)
-
-        AQ_SDELTA(uprc);
-        AQ_SDELTA(mprc);
-        AQ_SDELTA(bprc);
-        AQ_SDELTA(erpt);
-
-        AQ_SDELTA(uptc);
-        AQ_SDELTA(mptc);
-        AQ_SDELTA(bptc);
-        AQ_SDELTA(erpr);
-
-        AQ_SDELTA(ubrc);
-        AQ_SDELTA(ubtc);
-        AQ_SDELTA(mbrc);
-        AQ_SDELTA(mbtc);
-        AQ_SDELTA(bbrc);
-        AQ_SDELTA(bbtc);
-        AQ_SDELTA(dpc);
-
+        if (self->aq_link_status.mbps) {
+                AQ_SDELTA(uprc);
+                AQ_SDELTA(mprc);
+                AQ_SDELTA(bprc);
+                AQ_SDELTA(erpt);
+
+                AQ_SDELTA(uptc);
+                AQ_SDELTA(mptc);
+                AQ_SDELTA(bptc);
+                AQ_SDELTA(erpr);
+
+                AQ_SDELTA(ubrc);
+                AQ_SDELTA(ubtc);
+                AQ_SDELTA(mbrc);
+                AQ_SDELTA(mbtc);
+                AQ_SDELTA(bbrc);
+                AQ_SDELTA(bbtc);
+                AQ_SDELTA(dpc);
+        }
 #undef AQ_SDELTA
+        hw_self->curr_stats.dma_pkt_rc = stats_rx_dma_good_pkt_counterlsw_get(self);
+        hw_self->curr_stats.dma_pkt_tc = stats_tx_dma_good_pkt_counterlsw_get(self);
+        hw_self->curr_stats.dma_oct_rc = stats_rx_dma_good_octet_counterlsw_get(self);
+        hw_self->curr_stats.dma_oct_tc = stats_tx_dma_good_octet_counterlsw_get(self);
 
         memcpy(&hw_self->last_stats, &mbox.stats, sizeof(mbox.stats));
 
         return 0;
 }
 
-int hw_atl_utils_get_hw_stats(struct aq_hw_s *self,
-                              u64 *data, unsigned int *p_count)
+struct aq_stats_s *hw_atl_utils_get_hw_stats(struct aq_hw_s *self)
 {
-        struct hw_atl_s *hw_self = PHAL_ATLANTIC;
-        struct hw_atl_stats_s *stats = &hw_self->curr_stats;
-        int i = 0;
-
-        data[i] = stats->uprc + stats->mprc + stats->bprc;
-        data[++i] = stats->uprc;
-        data[++i] = stats->mprc;
-        data[++i] = stats->bprc;
-        data[++i] = stats->erpt;
-        data[++i] = stats->uptc + stats->mptc + stats->bptc;
-        data[++i] = stats->uptc;
-        data[++i] = stats->mptc;
-        data[++i] = stats->bptc;
-        data[++i] = stats->ubrc;
-        data[++i] = stats->ubtc;
-        data[++i] = stats->mbrc;
-        data[++i] = stats->mbtc;
-        data[++i] = stats->bbrc;
-        data[++i] = stats->bbtc;
-        data[++i] = stats->ubrc + stats->mbrc + stats->bbrc;
-        data[++i] = stats->ubtc + stats->mbtc + stats->bbtc;
-        data[++i] = stats_rx_dma_good_pkt_counterlsw_get(self);
-        data[++i] = stats_tx_dma_good_pkt_counterlsw_get(self);
-        data[++i] = stats_rx_dma_good_octet_counterlsw_get(self);
-        data[++i] = stats_tx_dma_good_octet_counterlsw_get(self);
-        data[++i] = stats->dpc;
-
-        if (p_count)
-                *p_count = ++i;
-
-        return 0;
+        return &PHAL_ATLANTIC->curr_stats;
 }
 
 static const u32 hw_atl_utils_hw_mac_regs[] = {
diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.h b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.h
index c99cc690e425..21aeca6908d3 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.h
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.h
@@ -129,7 +129,7 @@ struct __packed hw_aq_atl_utils_mbox {
 struct __packed hw_atl_s {
         struct aq_hw_s base;
         struct hw_atl_stats_s last_stats;
-        struct hw_atl_stats_s curr_stats;
+        struct aq_stats_s curr_stats;
         u64 speed;
         unsigned int chip_features;
         u32 fw_ver_actual;
@@ -207,8 +207,6 @@ int hw_atl_utils_get_fw_version(struct aq_hw_s *self, u32 *fw_version);
 
 int hw_atl_utils_update_stats(struct aq_hw_s *self);
 
-int hw_atl_utils_get_hw_stats(struct aq_hw_s *self,
-                              u64 *data,
-                              unsigned int *p_count);
+struct aq_stats_s *hw_atl_utils_get_hw_stats(struct aq_hw_s *self);
 
 #endif /* HW_ATL_UTILS_H */
diff --git a/drivers/net/ethernet/aquantia/atlantic/ver.h b/drivers/net/ethernet/aquantia/atlantic/ver.h
index 0de858d215c2..9009f2651e70 100644
--- a/drivers/net/ethernet/aquantia/atlantic/ver.h
+++ b/drivers/net/ethernet/aquantia/atlantic/ver.h
@@ -11,8 +11,10 @@
 #define VER_H
 
 #define NIC_MAJOR_DRIVER_VERSION           1
-#define NIC_MINOR_DRIVER_VERSION           5
-#define NIC_BUILD_DRIVER_VERSION           345
+#define NIC_MINOR_DRIVER_VERSION           6
+#define NIC_BUILD_DRIVER_VERSION           13
 #define NIC_REVISION_DRIVER_VERSION        0
 
+#define AQ_CFG_DRV_VERSION_SUFFIX "-kern"
+
 #endif /* VER_H */
diff --git a/drivers/net/ethernet/arc/emac.h b/drivers/net/ethernet/arc/emac.h
index 3c63b16d485f..d9efbc8d783b 100644
--- a/drivers/net/ethernet/arc/emac.h
+++ b/drivers/net/ethernet/arc/emac.h
@@ -159,6 +159,8 @@ struct arc_emac_priv {
         unsigned int link;
         unsigned int duplex;
         unsigned int speed;
+
+        unsigned int rx_missed_errors;
 };
 
 /**
diff --git a/drivers/net/ethernet/arc/emac_main.c b/drivers/net/ethernet/arc/emac_main.c
index 3241af1ce718..bd277b0dc615 100644
--- a/drivers/net/ethernet/arc/emac_main.c
+++ b/drivers/net/ethernet/arc/emac_main.c
@@ -26,6 +26,8 @@
 
 #include "emac.h"
 
+static void arc_emac_restart(struct net_device *ndev);
+
 /**
  * arc_emac_tx_avail - Return the number of available slots in the tx ring.
  * @priv: Pointer to ARC EMAC private data structure.
@@ -210,39 +212,48 @@ static int arc_emac_rx(struct net_device *ndev, int budget)
                         continue;
                 }
 
-                pktlen = info & LEN_MASK;
-                stats->rx_packets++;
-                stats->rx_bytes += pktlen;
-                skb = rx_buff->skb;
-                skb_put(skb, pktlen);
-                skb->dev = ndev;
-                skb->protocol = eth_type_trans(skb, ndev);
-
-                dma_unmap_single(&ndev->dev, dma_unmap_addr(rx_buff, addr),
-                                 dma_unmap_len(rx_buff, len), DMA_FROM_DEVICE);
-
-                /* Prepare the BD for next cycle */
-                rx_buff->skb = netdev_alloc_skb_ip_align(ndev,
-                                                         EMAC_BUFFER_SIZE);
-                if (unlikely(!rx_buff->skb)) {
+                /* Prepare the BD for next cycle. netif_receive_skb()
+                 * only if new skb was allocated and mapped to avoid holes
+                 * in the RX fifo.
+                 */
+                skb = netdev_alloc_skb_ip_align(ndev, EMAC_BUFFER_SIZE);
+                if (unlikely(!skb)) {
+                        if (net_ratelimit())
+                                netdev_err(ndev, "cannot allocate skb\n");
+                        /* Return ownership to EMAC */
+                        rxbd->info = cpu_to_le32(FOR_EMAC | EMAC_BUFFER_SIZE);
                         stats->rx_errors++;
-                        /* Because receive_skb is below, increment rx_dropped */
                         stats->rx_dropped++;
                         continue;
                 }
 
-                /* receive_skb only if new skb was allocated to avoid holes */
-                netif_receive_skb(skb);
-
-                addr = dma_map_single(&ndev->dev, (void *)rx_buff->skb->data,
+                addr = dma_map_single(&ndev->dev, (void *)skb->data,
                                       EMAC_BUFFER_SIZE, DMA_FROM_DEVICE);
                 if (dma_mapping_error(&ndev->dev, addr)) {
                         if (net_ratelimit())
-                                netdev_err(ndev, "cannot dma map\n");
-                        dev_kfree_skb(rx_buff->skb);
+                                netdev_err(ndev, "cannot map dma buffer\n");
+                        dev_kfree_skb(skb);
+                        /* Return ownership to EMAC */
+                        rxbd->info = cpu_to_le32(FOR_EMAC | EMAC_BUFFER_SIZE);
                         stats->rx_errors++;
+                        stats->rx_dropped++;
                         continue;
                 }
+
+                /* unmap previosly mapped skb */
+                dma_unmap_single(&ndev->dev, dma_unmap_addr(rx_buff, addr),
+                                 dma_unmap_len(rx_buff, len), DMA_FROM_DEVICE);
+
+                pktlen = info & LEN_MASK;
+                stats->rx_packets++;
+                stats->rx_bytes += pktlen;
+                skb_put(rx_buff->skb, pktlen);
+                rx_buff->skb->dev = ndev;
+                rx_buff->skb->protocol = eth_type_trans(rx_buff->skb, ndev);
+
+                netif_receive_skb(rx_buff->skb);
+
+                rx_buff->skb = skb;
                 dma_unmap_addr_set(rx_buff, addr, addr);
                 dma_unmap_len_set(rx_buff, len, EMAC_BUFFER_SIZE);
 
@@ -259,6 +270,53 @@ static int arc_emac_rx(struct net_device *ndev, int budget)
 }
 
 /**
+ * arc_emac_rx_miss_handle - handle R_MISS register
+ * @ndev:       Pointer to the net_device structure.
+ */
+static void arc_emac_rx_miss_handle(struct net_device *ndev)
+{
+        struct arc_emac_priv *priv = netdev_priv(ndev);
+        struct net_device_stats *stats = &ndev->stats;
+        unsigned int miss;
+
+        miss = arc_reg_get(priv, R_MISS);
+        if (miss) {
+                stats->rx_errors += miss;
+                stats->rx_missed_errors += miss;
+                priv->rx_missed_errors += miss;
+        }
+}
+
+/**
+ * arc_emac_rx_stall_check - check RX stall
+ * @ndev:       Pointer to the net_device structure.
+ * @budget:     How many BDs requested to process on 1 call.
+ * @work_done:  How many BDs processed
+ *
+ * Under certain conditions EMAC stop reception of incoming packets and
+ * continuously increment R_MISS register instead of saving data into
+ * provided buffer. This function detect that condition and restart
+ * EMAC.
+ */
+static void arc_emac_rx_stall_check(struct net_device *ndev,
+                                    int budget, unsigned int work_done)
+{
+        struct arc_emac_priv *priv = netdev_priv(ndev);
+        struct arc_emac_bd *rxbd;
+
+        if (work_done)
+                priv->rx_missed_errors = 0;
+
+        if (priv->rx_missed_errors && budget) {
+                rxbd = &priv->rxbd[priv->last_rx_bd];
+                if (le32_to_cpu(rxbd->info) & FOR_EMAC) {
+                        arc_emac_restart(ndev);
+                        priv->rx_missed_errors = 0;
+                }
+        }
+}
+
+/**
  * arc_emac_poll - NAPI poll handler.
  * @napi:       Pointer to napi_struct structure.
  * @budget:     How many BDs to process on 1 call.
@@ -272,6 +330,7 @@ static int arc_emac_poll(struct napi_struct *napi, int budget)
         unsigned int work_done;
 
         arc_emac_tx_clean(ndev);
+        arc_emac_rx_miss_handle(ndev);
 
         work_done = arc_emac_rx(ndev, budget);
         if (work_done < budget) {
@@ -279,6 +338,8 @@ static int arc_emac_poll(struct napi_struct *napi, int budget)
                 arc_reg_or(priv, R_ENABLE, RXINT_MASK | TXINT_MASK);
         }
 
+        arc_emac_rx_stall_check(ndev, budget, work_done);
+
         return work_done;
 }
 
@@ -320,6 +381,8 @@ static irqreturn_t arc_emac_intr(int irq, void *dev_instance)
                 if (status & MSER_MASK) {
                         stats->rx_missed_errors += 0x100;
                         stats->rx_errors += 0x100;
+                        priv->rx_missed_errors += 0x100;
+                        napi_schedule(&priv->napi);
                 }
 
                 if (status & RXCR_MASK) {
@@ -732,6 +795,63 @@ static int arc_emac_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
 }
 
 
+/**
+ * arc_emac_restart - Restart EMAC
+ * @ndev:       Pointer to net_device structure.
+ *
+ * This function do hardware reset of EMAC in order to restore
+ * network packets reception.
+ */
+static void arc_emac_restart(struct net_device *ndev)
+{
+        struct arc_emac_priv *priv = netdev_priv(ndev);
+        struct net_device_stats *stats = &ndev->stats;
+        int i;
+
+        if (net_ratelimit())
+                netdev_warn(ndev, "restarting stalled EMAC\n");
+
+        netif_stop_queue(ndev);
+
+        /* Disable interrupts */
+        arc_reg_clr(priv, R_ENABLE, RXINT_MASK | TXINT_MASK | ERR_MASK);
+
+        /* Disable EMAC */
+        arc_reg_clr(priv, R_CTRL, EN_MASK);
+
+        /* Return the sk_buff to system */
+        arc_free_tx_queue(ndev);
+
+        /* Clean Tx BD's */
+        priv->txbd_curr = 0;
+        priv->txbd_dirty = 0;
+        memset(priv->txbd, 0, TX_RING_SZ);
+
+        for (i = 0; i < RX_BD_NUM; i++) {
+                struct arc_emac_bd *rxbd = &priv->rxbd[i];
+                unsigned int info = le32_to_cpu(rxbd->info);
+
+                if (!(info & FOR_EMAC)) {
+                        stats->rx_errors++;
+                        stats->rx_dropped++;
+                }
+                /* Return ownership to EMAC */
+                rxbd->info = cpu_to_le32(FOR_EMAC | EMAC_BUFFER_SIZE);
+        }
+        priv->last_rx_bd = 0;
+
+        /* Make sure info is visible to EMAC before enable */
+        wmb();
+
+        /* Enable interrupts */
+        arc_reg_set(priv, R_ENABLE, RXINT_MASK | TXINT_MASK | ERR_MASK);
+
+        /* Enable EMAC */
+        arc_reg_or(priv, R_CTRL, EN_MASK);
+
+        netif_start_queue(ndev);
+}
+
 static const struct net_device_ops arc_emac_netdev_ops = {
         .ndo_open               = arc_emac_open,
         .ndo_stop               = arc_emac_stop,
diff --git a/drivers/net/ethernet/arc/emac_rockchip.c b/drivers/net/ethernet/arc/emac_rockchip.c
index c6163874e4e7..16f9bee992fe 100644
--- a/drivers/net/ethernet/arc/emac_rockchip.c
+++ b/drivers/net/ethernet/arc/emac_rockchip.c
@@ -199,9 +199,11 @@ static int emac_rockchip_probe(struct platform_device *pdev)
 
         /* RMII interface needs always a rate of 50MHz */
         err = clk_set_rate(priv->refclk, 50000000);
-        if (err)
+        if (err) {
                 dev_err(dev,
                         "failed to change reference clock rate (%d)\n", err);
+                goto out_regulator_disable;
+        }
 
         if (priv->soc_data->need_div_macclk) {
                 priv->macclk = devm_clk_get(dev, "macclk");
@@ -230,12 +232,14 @@ static int emac_rockchip_probe(struct platform_device *pdev)
         err = arc_emac_probe(ndev, interface);
         if (err) {
                 dev_err(dev, "failed to probe arc emac (%d)\n", err);
-                goto out_regulator_disable;
+                goto out_clk_disable_macclk;
         }
 
         return 0;
+
 out_clk_disable_macclk:
-        clk_disable_unprepare(priv->macclk);
+        if (priv->soc_data->need_div_macclk)
+                clk_disable_unprepare(priv->macclk);
 out_regulator_disable:
         if (priv->regulator)
                 regulator_disable(priv->regulator);
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
index 4c739d5355d2..8ae269ec17a1 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -3030,7 +3030,7 @@ int bnx2x_nic_unload(struct bnx2x *bp, int unload_mode, bool keep_link)
 
         del_timer_sync(&bp->timer);
 
-        if (IS_PF(bp)) {
+        if (IS_PF(bp) && !BP_NOMCP(bp)) {
                 /* Set ALWAYS_ALIVE bit in shmem */
                 bp->fw_drv_pulse_wr_seq |= DRV_PULSE_ALWAYS_ALIVE;
                 bnx2x_drv_pulse(bp);
@@ -3116,7 +3116,7 @@ int bnx2x_nic_unload(struct bnx2x *bp, int unload_mode, bool keep_link)
         bp->cnic_loaded = false;
 
         /* Clear driver version indication in shmem */
-        if (IS_PF(bp))
+        if (IS_PF(bp) && !BP_NOMCP(bp))
                 bnx2x_update_mng_version(bp);
 
         /* Check if there are pending parity attentions. If there are - set
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index 91e2a7560b48..ddd5d3ebd201 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -9578,6 +9578,15 @@ static int bnx2x_init_shmem(struct bnx2x *bp)
 
         do {
                 bp->common.shmem_base = REG_RD(bp, MISC_REG_SHARED_MEM_ADDR);
+
+                /* If we read all 0xFFs, means we are in PCI error state and
+                 * should bail out to avoid crashes on adapter's FW reads.
+                 */
+                if (bp->common.shmem_base == 0xFFFFFFFF) {
+                        bp->flags |= NO_MCP_FLAG;
+                        return -ENODEV;
+                }
+
                 if (bp->common.shmem_base) {
                         val = SHMEM_RD(bp, validity_map[BP_PORT(bp)]);
                         if (val & SHR_MEM_VALIDITY_MB)
@@ -14320,7 +14329,10 @@ static pci_ers_result_t bnx2x_io_slot_reset(struct pci_dev *pdev)
                 BNX2X_ERR("IO slot reset --> driver unload\n");
 
                 /* MCP should have been reset; Need to wait for validity */
-                bnx2x_init_shmem(bp);
+                if (bnx2x_init_shmem(bp)) {
+                        rtnl_unlock();
+                        return PCI_ERS_RESULT_DISCONNECT;
+                }
 
                 if (IS_PF(bp) && SHMEM2_HAS(bp, drv_capabilities_flag)) {
                         u32 v;
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index de51c2177d03..8995cfefbfcf 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -4,11 +4,13 @@
  * Copyright (C) 2001, 2002, 2003, 2004 David S. Miller (davem@redhat.com)
  * Copyright (C) 2001, 2002, 2003 Jeff Garzik (jgarzik@pobox.com)
  * Copyright (C) 2004 Sun Microsystems Inc.
- * Copyright (C) 2005-2014 Broadcom Corporation.
+ * Copyright (C) 2005-2016 Broadcom Corporation.
+ * Copyright (C) 2016-2017 Broadcom Limited.
  *
  * Firmware is:
  *      Derived from proprietary unpublished source code,
- *      Copyright (C) 2000-2003 Broadcom Corporation.
+ *      Copyright (C) 2000-2016 Broadcom Corporation.
+ *      Copyright (C) 2016-2017 Broadcom Ltd.
  *
  *      Permission is hereby granted for the distribution of this firmware
  *      data in hexadecimal or equivalent format, provided this copyright
@@ -10052,6 +10054,16 @@ static int tg3_reset_hw(struct tg3 *tp, bool reset_phy)
 
         tw32(GRC_MODE, tp->grc_mode | val);
 
+        /* On one of the AMD platform, MRRS is restricted to 4000 because of
+         * south bridge limitation. As a workaround, Driver is setting MRRS
+         * to 2048 instead of default 4096.
+         */
+        if (tp->pdev->subsystem_vendor == PCI_VENDOR_ID_DELL &&
+            tp->pdev->subsystem_device == TG3PCI_SUBDEVICE_ID_DELL_5762) {
+                val = tr32(TG3PCI_DEV_STATUS_CTRL) & ~MAX_READ_REQ_MASK;
+                tw32(TG3PCI_DEV_STATUS_CTRL, val | MAX_READ_REQ_SIZE_2048);
+        }
+
         /* Setup the timer prescalar register.  Clock is always 66Mhz. */
         val = tr32(GRC_MISC_CFG);
         val &= ~0xff;
@@ -14225,7 +14237,10 @@ static int tg3_change_mtu(struct net_device *dev, int new_mtu)
         /* Reset PHY, otherwise the read DMA engine will be in a mode that
          * breaks all requests to 256 bytes.
          */
-        if (tg3_asic_rev(tp) == ASIC_REV_57766)
+        if (tg3_asic_rev(tp) == ASIC_REV_57766 ||
+            tg3_asic_rev(tp) == ASIC_REV_5717 ||
+            tg3_asic_rev(tp) == ASIC_REV_5719 ||
+            tg3_asic_rev(tp) == ASIC_REV_5720)
                 reset_phy = true;
 
         err = tg3_restart_hw(tp, reset_phy);
diff --git a/drivers/net/ethernet/broadcom/tg3.h b/drivers/net/ethernet/broadcom/tg3.h
index c2d02d02d1e6..1f0271fa7c74 100644
--- a/drivers/net/ethernet/broadcom/tg3.h
+++ b/drivers/net/ethernet/broadcom/tg3.h
@@ -5,7 +5,8 @@
  * Copyright (C) 2001, 2002, 2003, 2004 David S. Miller (davem@redhat.com)
  * Copyright (C) 2001 Jeff Garzik (jgarzik@pobox.com)
  * Copyright (C) 2004 Sun Microsystems Inc.
- * Copyright (C) 2007-2014 Broadcom Corporation.
+ * Copyright (C) 2007-2016 Broadcom Corporation.
+ * Copyright (C) 2016-2017 Broadcom Limited.
  */
 
 #ifndef _T3_H
@@ -96,6 +97,7 @@
 #define TG3PCI_SUBDEVICE_ID_DELL_JAGUAR         0x0106
 #define TG3PCI_SUBDEVICE_ID_DELL_MERLOT         0x0109
 #define TG3PCI_SUBDEVICE_ID_DELL_SLIM_MERLOT    0x010a
+#define TG3PCI_SUBDEVICE_ID_DELL_5762           0x07f0
 #define TG3PCI_SUBVENDOR_ID_COMPAQ              PCI_VENDOR_ID_COMPAQ
 #define TG3PCI_SUBDEVICE_ID_COMPAQ_BANSHEE      0x007c
 #define TG3PCI_SUBDEVICE_ID_COMPAQ_BANSHEE_2    0x009a
@@ -281,6 +283,9 @@
 #define TG3PCI_STD_RING_PROD_IDX        0x00000098 /* 64-bit */
 #define TG3PCI_RCV_RET_RING_CON_IDX     0x000000a0 /* 64-bit */
 /* 0xa8 --> 0xb8 unused */
+#define TG3PCI_DEV_STATUS_CTRL          0x000000b4
+#define  MAX_READ_REQ_SIZE_2048          0x00004000
+#define  MAX_READ_REQ_MASK               0x00007000
 #define TG3PCI_DUAL_MAC_CTRL            0x000000b8
 #define  DUAL_MAC_CTRL_CH_MASK           0x00000003
 #define  DUAL_MAC_CTRL_ID                0x00000004
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index 610573855213..8184d2fca9be 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -818,6 +818,12 @@ static void fec_enet_bd_init(struct net_device *dev)
                 for (i = 0; i < txq->bd.ring_size; i++) {
                         /* Initialize the BD for every fragment in the page. */
                         bdp->cbd_sc = cpu_to_fec16(0);
+                        if (bdp->cbd_bufaddr &&
+                            !IS_TSO_HEADER(txq, fec32_to_cpu(bdp->cbd_bufaddr)))
+                                dma_unmap_single(&fep->pdev->dev,
+                                                 fec32_to_cpu(bdp->cbd_bufaddr),
+                                                 fec16_to_cpu(bdp->cbd_datlen),
+                                                 DMA_TO_DEVICE);
                         if (txq->tx_skbuff[i]) {
                                 dev_kfree_skb_any(txq->tx_skbuff[i]);
                                 txq->tx_skbuff[i] = NULL;
diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
index bc93b69cfd1e..a539263cd79c 100644
--- a/drivers/net/ethernet/marvell/mvneta.c
+++ b/drivers/net/ethernet/marvell/mvneta.c
@@ -1214,6 +1214,10 @@ static void mvneta_port_disable(struct mvneta_port *pp)
         val &= ~MVNETA_GMAC0_PORT_ENABLE;
         mvreg_write(pp, MVNETA_GMAC_CTRL_0, val);
 
+        pp->link = 0;
+        pp->duplex = -1;
+        pp->speed = 0;
+
         udelay(200);
 }
 
@@ -1958,9 +1962,9 @@ static int mvneta_rx_swbm(struct mvneta_port *pp, int rx_todo,
 
                 if (!mvneta_rxq_desc_is_first_last(rx_status) ||
                     (rx_status & MVNETA_RXD_ERR_SUMMARY)) {
+                        mvneta_rx_error(pp, rx_desc);
 err_drop_frame:
                         dev->stats.rx_errors++;
-                        mvneta_rx_error(pp, rx_desc);
                         /* leave the descriptor untouched */
                         continue;
                 }
@@ -3011,7 +3015,7 @@ static void mvneta_cleanup_rxqs(struct mvneta_port *pp)
 {
         int queue;
 
-        for (queue = 0; queue < txq_number; queue++)
+        for (queue = 0; queue < rxq_number; queue++)
                 mvneta_rxq_deinit(pp, &pp->rxqs[queue]);
 }
 
diff --git a/drivers/net/ethernet/marvell/skge.c b/drivers/net/ethernet/marvell/skge.c
index 6e423f098a60..31efc47c847e 100644
--- a/drivers/net/ethernet/marvell/skge.c
+++ b/drivers/net/ethernet/marvell/skge.c
@@ -4081,7 +4081,6 @@ static void skge_remove(struct pci_dev *pdev)
         if (hw->ports > 1) {
                 skge_write32(hw, B0_IMSK, 0);
                 skge_read32(hw, B0_IMSK);
-                free_irq(pdev->irq, hw);
         }
         spin_unlock_irq(&hw->hw_lock);
 
diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
index 54adfd967858..fc67e35b253e 100644
--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
@@ -1961,11 +1961,12 @@ static int mtk_hw_init(struct mtk_eth *eth)
         /* set GE2 TUNE */
         regmap_write(eth->pctl, GPIO_BIAS_CTRL, 0x0);
 
-        /* GE1, Force 1000M/FD, FC ON */
-        mtk_w32(eth, MAC_MCR_FIXED_LINK, MTK_MAC_MCR(0));
-
-        /* GE2, Force 1000M/FD, FC ON */
-        mtk_w32(eth, MAC_MCR_FIXED_LINK, MTK_MAC_MCR(1));
+        /* Set linkdown as the default for each GMAC. Its own MCR would be set
+         * up with the more appropriate value when mtk_phy_link_adjust call is
+         * being invoked.
+         */
+        for (i = 0; i < MTK_MAC_COUNT; i++)
+                mtk_w32(eth, 0, MTK_MAC_MCR(i));
 
         /* Indicates CDM to parse the MTK special tag from CPU
          * which also is working out for untag packets.
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_port.c b/drivers/net/ethernet/mellanox/mlx4/en_port.c
index e0eb695318e6..1fa4849a6f56 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_port.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_port.c
@@ -188,7 +188,7 @@ int mlx4_en_DUMP_ETH_STATS(struct mlx4_en_dev *mdev, u8 port, u8 reset)
         struct net_device *dev = mdev->pndev[port];
         struct mlx4_en_priv *priv = netdev_priv(dev);
         struct net_device_stats *stats = &dev->stats;
-        struct mlx4_cmd_mailbox *mailbox;
+        struct mlx4_cmd_mailbox *mailbox, *mailbox_priority;
         u64 in_mod = reset << 8 | port;
         int err;
         int i, counter_index;
@@ -198,6 +198,13 @@ int mlx4_en_DUMP_ETH_STATS(struct mlx4_en_dev *mdev, u8 port, u8 reset)
         mailbox = mlx4_alloc_cmd_mailbox(mdev->dev);
         if (IS_ERR(mailbox))
                 return PTR_ERR(mailbox);
+
+        mailbox_priority = mlx4_alloc_cmd_mailbox(mdev->dev);
+        if (IS_ERR(mailbox_priority)) {
+                mlx4_free_cmd_mailbox(mdev->dev, mailbox);
+                return PTR_ERR(mailbox_priority);
+        }
+
         err = mlx4_cmd_box(mdev->dev, 0, mailbox->dma, in_mod, 0,
                            MLX4_CMD_DUMP_ETH_STATS, MLX4_CMD_TIME_CLASS_B,
                            MLX4_CMD_NATIVE);
@@ -206,6 +213,28 @@ int mlx4_en_DUMP_ETH_STATS(struct mlx4_en_dev *mdev, u8 port, u8 reset)
 
         mlx4_en_stats = mailbox->buf;
 
+        memset(&tmp_counter_stats, 0, sizeof(tmp_counter_stats));
+        counter_index = mlx4_get_default_counter_index(mdev->dev, port);
+        err = mlx4_get_counter_stats(mdev->dev, counter_index,
+                                     &tmp_counter_stats, reset);
+
+        /* 0xffs indicates invalid value */
+        memset(mailbox_priority->buf, 0xff,
+               sizeof(*flowstats) * MLX4_NUM_PRIORITIES);
+
+        if (mdev->dev->caps.flags2 & MLX4_DEV_CAP_FLAG2_FLOWSTATS_EN) {
+                memset(mailbox_priority->buf, 0,
+                       sizeof(*flowstats) * MLX4_NUM_PRIORITIES);
+                err = mlx4_cmd_box(mdev->dev, 0, mailbox_priority->dma,
+                                   in_mod | MLX4_DUMP_ETH_STATS_FLOW_CONTROL,
+                                   0, MLX4_CMD_DUMP_ETH_STATS,
+                                   MLX4_CMD_TIME_CLASS_B, MLX4_CMD_NATIVE);
+                if (err)
+                        goto out;
+        }
+
+        flowstats = mailbox_priority->buf;
+
         spin_lock_bh(&priv->stats_lock);
 
         mlx4_en_fold_software_stats(dev);
@@ -345,31 +374,6 @@ int mlx4_en_DUMP_ETH_STATS(struct mlx4_en_dev *mdev, u8 port, u8 reset)
         priv->pkstats.tx_prio[8][0] = be64_to_cpu(mlx4_en_stats->TTOT_novlan);
         priv->pkstats.tx_prio[8][1] = be64_to_cpu(mlx4_en_stats->TOCT_novlan);
 
-        spin_unlock_bh(&priv->stats_lock);
-
-        memset(&tmp_counter_stats, 0, sizeof(tmp_counter_stats));
-        counter_index = mlx4_get_default_counter_index(mdev->dev, port);
-        err = mlx4_get_counter_stats(mdev->dev, counter_index,
-                                     &tmp_counter_stats, reset);
-
-        /* 0xffs indicates invalid value */
-        memset(mailbox->buf, 0xff, sizeof(*flowstats) * MLX4_NUM_PRIORITIES);
-
-        if (mdev->dev->caps.flags2 & MLX4_DEV_CAP_FLAG2_FLOWSTATS_EN) {
-                memset(mailbox->buf, 0,
-                       sizeof(*flowstats) * MLX4_NUM_PRIORITIES);
-                err = mlx4_cmd_box(mdev->dev, 0, mailbox->dma,
-                                   in_mod | MLX4_DUMP_ETH_STATS_FLOW_CONTROL,
-                                   0, MLX4_CMD_DUMP_ETH_STATS,
-                                   MLX4_CMD_TIME_CLASS_B, MLX4_CMD_NATIVE);
-                if (err)
-                        goto out;
-        }
-
-        flowstats = mailbox->buf;
-
-        spin_lock_bh(&priv->stats_lock);
-
         if (tmp_counter_stats.counter_mode == 0) {
                 priv->pf_stats.rx_bytes   = be64_to_cpu(tmp_counter_stats.rx_bytes);
                 priv->pf_stats.tx_bytes   = be64_to_cpu(tmp_counter_stats.tx_bytes);
@@ -410,6 +414,7 @@ int mlx4_en_DUMP_ETH_STATS(struct mlx4_en_dev *mdev, u8 port, u8 reset)
 
 out:
         mlx4_free_cmd_mailbox(mdev->dev, mailbox);
+        mlx4_free_cmd_mailbox(mdev->dev, mailbox_priority);
         return err;
 }
 
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_selftest.c b/drivers/net/ethernet/mellanox/mlx4/en_selftest.c
index 88699b181946..946d9db7c8c2 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_selftest.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_selftest.c
@@ -185,7 +185,7 @@ void mlx4_en_ex_selftest(struct net_device *dev, u32 *flags, u64 *buf)
                 if (priv->mdev->dev->caps.flags &
                                         MLX4_DEV_CAP_FLAG_UC_LOOPBACK) {
                         buf[3] = mlx4_en_test_registers(priv);
-                        if (priv->port_up)
+                        if (priv->port_up && dev->mtu >= MLX4_SELFTEST_LB_MIN_MTU)
                                 buf[4] = mlx4_en_test_loopback(priv);
                 }
 
diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
index 1856e279a7e0..2b72677eccd4 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
@@ -153,6 +153,9 @@
 #define SMALL_PACKET_SIZE      (256 - NET_IP_ALIGN)
 #define HEADER_COPY_SIZE       (128 - NET_IP_ALIGN)
 #define MLX4_LOOPBACK_TEST_PAYLOAD (HEADER_COPY_SIZE - ETH_HLEN)
+#define PREAMBLE_LEN           8
+#define MLX4_SELFTEST_LB_MIN_MTU (MLX4_LOOPBACK_TEST_PAYLOAD + NET_IP_ALIGN + \
+                                  ETH_HLEN + PREAMBLE_LEN)
 
 #define MLX4_EN_MIN_MTU         46
 /* VLAN_HLEN is added twice,to support skb vlan tagged with multiple
diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
index 04304dd894c6..606a0e0beeae 100644
--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
+++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
@@ -611,7 +611,6 @@ int mlx4_init_resource_tracker(struct mlx4_dev *dev)
                                                 MLX4_MAX_PORTS;
                                 else
                                         res_alloc->guaranteed[t] = 0;
-                                res_alloc->res_free -= res_alloc->guaranteed[t];
                                 break;
                         default:
                                 break;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
index 1fffdebbc9e8..e9a1fbcc4adf 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
@@ -362,7 +362,7 @@ static int mlx5_internal_err_ret_value(struct mlx5_core_dev *dev, u16 op,
         case MLX5_CMD_OP_QUERY_VPORT_COUNTER:
         case MLX5_CMD_OP_ALLOC_Q_COUNTER:
         case MLX5_CMD_OP_QUERY_Q_COUNTER:
-        case MLX5_CMD_OP_SET_RATE_LIMIT:
+        case MLX5_CMD_OP_SET_PP_RATE_LIMIT:
         case MLX5_CMD_OP_QUERY_RATE_LIMIT:
         case MLX5_CMD_OP_CREATE_SCHEDULING_ELEMENT:
         case MLX5_CMD_OP_QUERY_SCHEDULING_ELEMENT:
@@ -505,7 +505,7 @@ const char *mlx5_command_str(int command)
         MLX5_COMMAND_STR_CASE(ALLOC_Q_COUNTER);
         MLX5_COMMAND_STR_CASE(DEALLOC_Q_COUNTER);
         MLX5_COMMAND_STR_CASE(QUERY_Q_COUNTER);
-        MLX5_COMMAND_STR_CASE(SET_RATE_LIMIT);
+        MLX5_COMMAND_STR_CASE(SET_PP_RATE_LIMIT);
         MLX5_COMMAND_STR_CASE(QUERY_RATE_LIMIT);
         MLX5_COMMAND_STR_CASE(CREATE_SCHEDULING_ELEMENT);
         MLX5_COMMAND_STR_CASE(DESTROY_SCHEDULING_ELEMENT);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h
index c0872b3284cb..543060c305a0 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h
@@ -82,6 +82,9 @@
         max_t(u32, MLX5_MPWRQ_MIN_LOG_STRIDE_SZ(mdev), req)
 #define MLX5_MPWRQ_DEF_LOG_STRIDE_SZ(mdev)       MLX5_MPWRQ_LOG_STRIDE_SZ(mdev, 6)
 #define MLX5_MPWRQ_CQE_CMPRS_LOG_STRIDE_SZ(mdev) MLX5_MPWRQ_LOG_STRIDE_SZ(mdev, 8)
+#define MLX5E_MPWQE_STRIDE_SZ(mdev, cqe_cmprs) \
+        (cqe_cmprs ? MLX5_MPWRQ_CQE_CMPRS_LOG_STRIDE_SZ(mdev) : \
+        MLX5_MPWRQ_DEF_LOG_STRIDE_SZ(mdev))
 
 #define MLX5_MPWRQ_LOG_WQE_SZ                   18
 #define MLX5_MPWRQ_WQE_PAGE_ORDER  (MLX5_MPWRQ_LOG_WQE_SZ - PAGE_SHIFT > 0 ? \
@@ -590,6 +593,7 @@ struct mlx5e_channel {
         struct mlx5_core_dev      *mdev;
         struct hwtstamp_config    *tstamp;
         int                        ix;
+        int                        cpu;
 };
 
 struct mlx5e_channels {
@@ -935,8 +939,9 @@ void mlx5e_set_tx_cq_mode_params(struct mlx5e_params *params,
                                  u8 cq_period_mode);
 void mlx5e_set_rx_cq_mode_params(struct mlx5e_params *params,
                                  u8 cq_period_mode);
-void mlx5e_set_rq_type_params(struct mlx5_core_dev *mdev,
-                              struct mlx5e_params *params, u8 rq_type);
+void mlx5e_init_rq_type_params(struct mlx5_core_dev *mdev,
+                               struct mlx5e_params *params,
+                               u8 rq_type);
 
 static inline bool mlx5e_tunnel_inner_ft_supported(struct mlx5_core_dev *mdev)
 {
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
index c6d90b6dd80e..9bcf38f4123b 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
@@ -274,6 +274,7 @@ int mlx5e_dcbnl_ieee_setets_core(struct mlx5e_priv *priv, struct ieee_ets *ets)
 static int mlx5e_dbcnl_validate_ets(struct net_device *netdev,
                                     struct ieee_ets *ets)
 {
+        bool have_ets_tc = false;
         int bw_sum = 0;
         int i;
 
@@ -288,11 +289,14 @@ static int mlx5e_dbcnl_validate_ets(struct net_device *netdev,
         }
 
         /* Validate Bandwidth Sum */
-        for (i = 0; i < IEEE_8021QAZ_MAX_TCS; i++)
-                if (ets->tc_tsa[i] == IEEE_8021QAZ_TSA_ETS)
+        for (i = 0; i < IEEE_8021QAZ_MAX_TCS; i++) {
+                if (ets->tc_tsa[i] == IEEE_8021QAZ_TSA_ETS) {
+                        have_ets_tc = true;
                         bw_sum += ets->tc_tx_bw[i];
+                }
+        }
 
-        if (bw_sum != 0 && bw_sum != 100) {
+        if (have_ets_tc && bw_sum != 100) {
                 netdev_err(netdev,
                            "Failed to validate ETS: BW sum is illegal\n");
                 return -EINVAL;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
index 23425f028405..8f05efa5c829 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
@@ -1523,8 +1523,10 @@ int mlx5e_modify_rx_cqe_compression_locked(struct mlx5e_priv *priv, bool new_val
         new_channels.params = priv->channels.params;
         MLX5E_SET_PFLAG(&new_channels.params, MLX5E_PFLAG_RX_CQE_COMPRESS, new_val);
 
-        mlx5e_set_rq_type_params(priv->mdev, &new_channels.params,
-                                 new_channels.params.rq_wq_type);
+        new_channels.params.mpwqe_log_stride_sz =
+                MLX5E_MPWQE_STRIDE_SZ(priv->mdev, new_val);
+        new_channels.params.mpwqe_log_num_strides =
+                MLX5_MPWRQ_LOG_WQE_SZ - new_channels.params.mpwqe_log_stride_sz;
 
         if (!test_bit(MLX5E_STATE_OPENED, &priv->state)) {
                 priv->channels.params = new_channels.params;
@@ -1536,6 +1538,10 @@ int mlx5e_modify_rx_cqe_compression_locked(struct mlx5e_priv *priv, bool new_val
                 return err;
 
         mlx5e_switch_priv_channels(priv, &new_channels, NULL);
+        mlx5e_dbg(DRV, priv, "MLX5E: RxCqeCmprss was turned %s\n",
+                  MLX5E_GET_PFLAG(&priv->channels.params,
+                                  MLX5E_PFLAG_RX_CQE_COMPRESS) ? "ON" : "OFF");
+
         return 0;
 }
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index d2b057a3e512..d9d8227f195f 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -71,11 +71,6 @@ struct mlx5e_channel_param {
         struct mlx5e_cq_param      icosq_cq;
 };
 
-static int mlx5e_get_node(struct mlx5e_priv *priv, int ix)
-{
-        return pci_irq_get_node(priv->mdev->pdev, MLX5_EQ_VEC_COMP_BASE + ix);
-}
-
 static bool mlx5e_check_fragmented_striding_rq_cap(struct mlx5_core_dev *mdev)
 {
         return MLX5_CAP_GEN(mdev, striding_rq) &&
@@ -83,8 +78,8 @@ static bool mlx5e_check_fragmented_striding_rq_cap(struct mlx5_core_dev *mdev)
                 MLX5_CAP_ETH(mdev, reg_umr_sq);
 }
 
-void mlx5e_set_rq_type_params(struct mlx5_core_dev *mdev,
-                              struct mlx5e_params *params, u8 rq_type)
+void mlx5e_init_rq_type_params(struct mlx5_core_dev *mdev,
+                               struct mlx5e_params *params, u8 rq_type)
 {
         params->rq_wq_type = rq_type;
         params->lro_wqe_sz = MLX5E_PARAMS_DEFAULT_LRO_WQE_SZ;
@@ -93,10 +88,8 @@ void mlx5e_set_rq_type_params(struct mlx5_core_dev *mdev,
                 params->log_rq_size = is_kdump_kernel() ?
                         MLX5E_PARAMS_MINIMUM_LOG_RQ_SIZE_MPW :
                         MLX5E_PARAMS_DEFAULT_LOG_RQ_SIZE_MPW;
-                params->mpwqe_log_stride_sz =
-                        MLX5E_GET_PFLAG(params, MLX5E_PFLAG_RX_CQE_COMPRESS) ?
-                        MLX5_MPWRQ_CQE_CMPRS_LOG_STRIDE_SZ(mdev) :
-                        MLX5_MPWRQ_DEF_LOG_STRIDE_SZ(mdev);
+                params->mpwqe_log_stride_sz = MLX5E_MPWQE_STRIDE_SZ(mdev,
+                        MLX5E_GET_PFLAG(params, MLX5E_PFLAG_RX_CQE_COMPRESS));
                 params->mpwqe_log_num_strides = MLX5_MPWRQ_LOG_WQE_SZ -
                         params->mpwqe_log_stride_sz;
                 break;
@@ -120,13 +113,14 @@ void mlx5e_set_rq_type_params(struct mlx5_core_dev *mdev,
                        MLX5E_GET_PFLAG(params, MLX5E_PFLAG_RX_CQE_COMPRESS));
 }
 
-static void mlx5e_set_rq_params(struct mlx5_core_dev *mdev, struct mlx5e_params *params)
+static void mlx5e_set_rq_params(struct mlx5_core_dev *mdev,
+                                struct mlx5e_params *params)
 {
         u8 rq_type = mlx5e_check_fragmented_striding_rq_cap(mdev) &&
                     !params->xdp_prog && !MLX5_IPSEC_DEV(mdev) ?
                     MLX5_WQ_TYPE_LINKED_LIST_STRIDING_RQ :
                     MLX5_WQ_TYPE_LINKED_LIST;
-        mlx5e_set_rq_type_params(mdev, params, rq_type);
+        mlx5e_init_rq_type_params(mdev, params, rq_type);
 }
 
 static void mlx5e_update_carrier(struct mlx5e_priv *priv)
@@ -444,17 +438,16 @@ static int mlx5e_rq_alloc_mpwqe_info(struct mlx5e_rq *rq,
         int wq_sz = mlx5_wq_ll_get_size(&rq->wq);
         int mtt_sz = mlx5e_get_wqe_mtt_sz();
         int mtt_alloc = mtt_sz + MLX5_UMR_ALIGN - 1;
-        int node = mlx5e_get_node(c->priv, c->ix);
         int i;
 
         rq->mpwqe.info = kzalloc_node(wq_sz * sizeof(*rq->mpwqe.info),
-                                        GFP_KERNEL, node);
+                                      GFP_KERNEL, cpu_to_node(c->cpu));
         if (!rq->mpwqe.info)
                 goto err_out;
 
         /* We allocate more than mtt_sz as we will align the pointer */
-        rq->mpwqe.mtt_no_align = kzalloc_node(mtt_alloc * wq_sz,
-                                        GFP_KERNEL, node);
+        rq->mpwqe.mtt_no_align = kzalloc_node(mtt_alloc * wq_sz, GFP_KERNEL,
+                                        cpu_to_node(c->cpu));
         if (unlikely(!rq->mpwqe.mtt_no_align))
                 goto err_free_wqe_info;
 
@@ -562,7 +555,7 @@ static int mlx5e_alloc_rq(struct mlx5e_channel *c,
         int err;
         int i;
 
-        rqp->wq.db_numa_node = mlx5e_get_node(c->priv, c->ix);
+        rqp->wq.db_numa_node = cpu_to_node(c->cpu);
 
         err = mlx5_wq_ll_create(mdev, &rqp->wq, rqc_wq, &rq->wq,
                                 &rq->wq_ctrl);
@@ -629,8 +622,7 @@ static int mlx5e_alloc_rq(struct mlx5e_channel *c,
         default: /* MLX5_WQ_TYPE_LINKED_LIST */
                 rq->wqe.frag_info =
                         kzalloc_node(wq_sz * sizeof(*rq->wqe.frag_info),
-                                     GFP_KERNEL,
-                                     mlx5e_get_node(c->priv, c->ix));
+                                     GFP_KERNEL, cpu_to_node(c->cpu));
                 if (!rq->wqe.frag_info) {
                         err = -ENOMEM;
                         goto err_rq_wq_destroy;
@@ -1000,13 +992,13 @@ static int mlx5e_alloc_xdpsq(struct mlx5e_channel *c,
         sq->uar_map   = mdev->mlx5e_res.bfreg.map;
         sq->min_inline_mode = params->tx_min_inline_mode;
 
-        param->wq.db_numa_node = mlx5e_get_node(c->priv, c->ix);
+        param->wq.db_numa_node = cpu_to_node(c->cpu);
         err = mlx5_wq_cyc_create(mdev, &param->wq, sqc_wq, &sq->wq, &sq->wq_ctrl);
         if (err)
                 return err;
         sq->wq.db = &sq->wq.db[MLX5_SND_DBR];
 
-        err = mlx5e_alloc_xdpsq_db(sq, mlx5e_get_node(c->priv, c->ix));
+        err = mlx5e_alloc_xdpsq_db(sq, cpu_to_node(c->cpu));
         if (err)
                 goto err_sq_wq_destroy;
 
@@ -1053,13 +1045,13 @@ static int mlx5e_alloc_icosq(struct mlx5e_channel *c,
         sq->channel   = c;
         sq->uar_map   = mdev->mlx5e_res.bfreg.map;
 
-        param->wq.db_numa_node = mlx5e_get_node(c->priv, c->ix);
+        param->wq.db_numa_node = cpu_to_node(c->cpu);
         err = mlx5_wq_cyc_create(mdev, &param->wq, sqc_wq, &sq->wq, &sq->wq_ctrl);
         if (err)
                 return err;
         sq->wq.db = &sq->wq.db[MLX5_SND_DBR];
 
-        err = mlx5e_alloc_icosq_db(sq, mlx5e_get_node(c->priv, c->ix));
+        err = mlx5e_alloc_icosq_db(sq, cpu_to_node(c->cpu));
         if (err)
                 goto err_sq_wq_destroy;
 
@@ -1126,13 +1118,13 @@ static int mlx5e_alloc_txqsq(struct mlx5e_channel *c,
         if (MLX5_IPSEC_DEV(c->priv->mdev))
                 set_bit(MLX5E_SQ_STATE_IPSEC, &sq->state);
 
-        param->wq.db_numa_node = mlx5e_get_node(c->priv, c->ix);
+        param->wq.db_numa_node = cpu_to_node(c->cpu);
         err = mlx5_wq_cyc_create(mdev, &param->wq, sqc_wq, &sq->wq, &sq->wq_ctrl);
         if (err)
                 return err;
         sq->wq.db    = &sq->wq.db[MLX5_SND_DBR];
 
-        err = mlx5e_alloc_txqsq_db(sq, mlx5e_get_node(c->priv, c->ix));
+        err = mlx5e_alloc_txqsq_db(sq, cpu_to_node(c->cpu));
         if (err)
                 goto err_sq_wq_destroy;
 
@@ -1504,8 +1496,8 @@ static int mlx5e_alloc_cq(struct mlx5e_channel *c,
         struct mlx5_core_dev *mdev = c->priv->mdev;
         int err;
 
-        param->wq.buf_numa_node = mlx5e_get_node(c->priv, c->ix);
-        param->wq.db_numa_node  = mlx5e_get_node(c->priv, c->ix);
+        param->wq.buf_numa_node = cpu_to_node(c->cpu);
+        param->wq.db_numa_node  = cpu_to_node(c->cpu);
         param->eq_ix   = c->ix;
 
         err = mlx5e_alloc_cq_common(mdev, param, cq);
@@ -1604,6 +1596,11 @@ static void mlx5e_close_cq(struct mlx5e_cq *cq)
         mlx5e_free_cq(cq);
 }
 
+static int mlx5e_get_cpu(struct mlx5e_priv *priv, int ix)
+{
+        return cpumask_first(priv->mdev->priv.irq_info[ix].mask);
+}
+
 static int mlx5e_open_tx_cqs(struct mlx5e_channel *c,
                              struct mlx5e_params *params,
                              struct mlx5e_channel_param *cparam)
@@ -1752,12 +1749,13 @@ static int mlx5e_open_channel(struct mlx5e_priv *priv, int ix,
 {
         struct mlx5e_cq_moder icocq_moder = {0, 0};
         struct net_device *netdev = priv->netdev;
+        int cpu = mlx5e_get_cpu(priv, ix);
         struct mlx5e_channel *c;
         unsigned int irq;
         int err;
         int eqn;
 
-        c = kzalloc_node(sizeof(*c), GFP_KERNEL, mlx5e_get_node(priv, ix));
+        c = kzalloc_node(sizeof(*c), GFP_KERNEL, cpu_to_node(cpu));
         if (!c)
                 return -ENOMEM;
 
@@ -1765,6 +1763,7 @@ static int mlx5e_open_channel(struct mlx5e_priv *priv, int ix,
         c->mdev     = priv->mdev;
         c->tstamp   = &priv->tstamp;
         c->ix       = ix;
+        c->cpu      = cpu;
         c->pdev     = &priv->mdev->pdev->dev;
         c->netdev   = priv->netdev;
         c->mkey_be  = cpu_to_be32(priv->mdev->mlx5e_res.mkey.key);
@@ -1853,8 +1852,7 @@ static void mlx5e_activate_channel(struct mlx5e_channel *c)
         for (tc = 0; tc < c->num_tc; tc++)
                 mlx5e_activate_txqsq(&c->sq[tc]);
         mlx5e_activate_rq(&c->rq);
-        netif_set_xps_queue(c->netdev,
-                mlx5_get_vector_affinity(c->priv->mdev, c->ix), c->ix);
+        netif_set_xps_queue(c->netdev, get_cpu_mask(c->cpu), c->ix);
 }
 
 static void mlx5e_deactivate_channel(struct mlx5e_channel *c)
@@ -3679,6 +3677,7 @@ static netdev_features_t mlx5e_tunnel_features_check(struct mlx5e_priv *priv,
                                                      struct sk_buff *skb,
                                                      netdev_features_t features)
 {
+        unsigned int offset = 0;
         struct udphdr *udph;
         u8 proto;
         u16 port;
@@ -3688,7 +3687,7 @@ static netdev_features_t mlx5e_tunnel_features_check(struct mlx5e_priv *priv,
                 proto = ip_hdr(skb)->protocol;
                 break;
         case htons(ETH_P_IPV6):
-                proto = ipv6_hdr(skb)->nexthdr;
+                proto = ipv6_find_hdr(skb, &offset, -1, NULL, NULL);
                 break;
         default:
                 goto out;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eq.c b/drivers/net/ethernet/mellanox/mlx5/core/eq.c
index 60771865c99c..e7e7cef2bde4 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eq.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eq.c
@@ -466,7 +466,7 @@ static irqreturn_t mlx5_eq_int(int irq, void *eq_ptr)
                         break;
                 case MLX5_EVENT_TYPE_CQ_ERROR:
                         cqn = be32_to_cpu(eqe->data.cq_err.cqn) & 0xffffff;
-                        mlx5_core_warn(dev, "CQ error on CQN 0x%x, syndrom 0x%x\n",
+                        mlx5_core_warn(dev, "CQ error on CQN 0x%x, syndrome 0x%x\n",
                                        cqn, eqe->data.cq_err.syndrome);
                         mlx5_cq_event(dev, cqn, eqe->type);
                         break;
@@ -775,7 +775,7 @@ err1:
         return err;
 }
 
-int mlx5_stop_eqs(struct mlx5_core_dev *dev)
+void mlx5_stop_eqs(struct mlx5_core_dev *dev)
 {
         struct mlx5_eq_table *table = &dev->priv.eq_table;
         int err;
@@ -784,22 +784,26 @@ int mlx5_stop_eqs(struct mlx5_core_dev *dev)
         if (MLX5_CAP_GEN(dev, pg)) {
                 err = mlx5_destroy_unmap_eq(dev, &table->pfault_eq);
                 if (err)
-                        return err;
+                        mlx5_core_err(dev, "failed to destroy page fault eq, err(%d)\n",
+                                      err);
         }
 #endif
 
         err = mlx5_destroy_unmap_eq(dev, &table->pages_eq);
         if (err)
-                return err;
+                mlx5_core_err(dev, "failed to destroy pages eq, err(%d)\n",
+                              err);
 
-        mlx5_destroy_unmap_eq(dev, &table->async_eq);
+        err = mlx5_destroy_unmap_eq(dev, &table->async_eq);
+        if (err)
+                mlx5_core_err(dev, "failed to destroy async eq, err(%d)\n",
+                              err);
         mlx5_cmd_use_polling(dev);
 
         err = mlx5_destroy_unmap_eq(dev, &table->cmd_eq);
         if (err)
-                mlx5_cmd_use_events(dev);
-
-        return err;
+                mlx5_core_err(dev, "failed to destroy command eq, err(%d)\n",
+                              err);
 }
 
 int mlx5_core_eq_query(struct mlx5_core_dev *dev, struct mlx5_eq *eq,
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fpga/sdk.c b/drivers/net/ethernet/mellanox/mlx5/core/fpga/sdk.c
index 3c11d6e2160a..14962969c5ba 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fpga/sdk.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fpga/sdk.c
@@ -66,6 +66,9 @@ static int mlx5_fpga_mem_read_i2c(struct mlx5_fpga_device *fdev, size_t size,
         u8 actual_size;
         int err;
 
+        if (!size)
+                return -EINVAL;
+
         if (!fdev->mdev)
                 return -ENOTCONN;
 
@@ -95,6 +98,9 @@ static int mlx5_fpga_mem_write_i2c(struct mlx5_fpga_device *fdev, size_t size,
         u8 actual_size;
         int err;
 
+        if (!size)
+                return -EINVAL;
+
         if (!fdev->mdev)
                 return -ENOTCONN;
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
index c70fd663a633..dfaad9ecb2b8 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
@@ -174,6 +174,8 @@ static void del_hw_fte(struct fs_node *node);
 static void del_sw_flow_table(struct fs_node *node);
 static void del_sw_flow_group(struct fs_node *node);
 static void del_sw_fte(struct fs_node *node);
+static void del_sw_prio(struct fs_node *node);
+static void del_sw_ns(struct fs_node *node);
 /* Delete rule (destination) is special case that 
  * requires to lock the FTE for all the deletion process.
  */
@@ -408,6 +410,16 @@ static inline struct mlx5_core_dev *get_dev(struct fs_node *node)
         return NULL;
 }
 
+static void del_sw_ns(struct fs_node *node)
+{
+        kfree(node);
+}
+
+static void del_sw_prio(struct fs_node *node)
+{
+        kfree(node);
+}
+
 static void del_hw_flow_table(struct fs_node *node)
 {
         struct mlx5_flow_table *ft;
@@ -2064,7 +2076,7 @@ static struct fs_prio *fs_create_prio(struct mlx5_flow_namespace *ns,
                 return ERR_PTR(-ENOMEM);
 
         fs_prio->node.type = FS_TYPE_PRIO;
-        tree_init_node(&fs_prio->node, NULL, NULL);
+        tree_init_node(&fs_prio->node, NULL, del_sw_prio);
         tree_add_node(&fs_prio->node, &ns->node);
         fs_prio->num_levels = num_levels;
         fs_prio->prio = prio;
@@ -2090,7 +2102,7 @@ static struct mlx5_flow_namespace *fs_create_namespace(struct fs_prio *prio)
                 return ERR_PTR(-ENOMEM);
 
         fs_init_namespace(ns);
-        tree_init_node(&ns->node, NULL, NULL);
+        tree_init_node(&ns->node, NULL, del_sw_ns);
         tree_add_node(&ns->node, &prio->node);
         list_add_tail(&ns->node.list, &prio->node.children);
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/health.c b/drivers/net/ethernet/mellanox/mlx5/core/health.c
index 1a0e797ad001..21d29f7936f6 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/health.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/health.c
@@ -241,7 +241,7 @@ static void print_health_info(struct mlx5_core_dev *dev)
         u32 fw;
         int i;
 
-        /* If the syndrom is 0, the device is OK and no need to print buffer */
+        /* If the syndrome is 0, the device is OK and no need to print buffer */
         if (!ioread8(&h->synd))
                 return;
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c
index d2a66dc4adc6..8812d7208e8f 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c
@@ -57,7 +57,7 @@ static void mlx5i_build_nic_params(struct mlx5_core_dev *mdev,
                                    struct mlx5e_params *params)
 {
         /* Override RQ params as IPoIB supports only LINKED LIST RQ for now */
-        mlx5e_set_rq_type_params(mdev, params, MLX5_WQ_TYPE_LINKED_LIST);
+        mlx5e_init_rq_type_params(mdev, params, MLX5_WQ_TYPE_LINKED_LIST);
 
         /* RQ size in ipoib by default is 512 */
         params->log_rq_size = is_kdump_kernel() ?
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lag.c b/drivers/net/ethernet/mellanox/mlx5/core/lag.c
index f26f97fe4666..582b2f18010a 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/lag.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/lag.c
@@ -137,6 +137,17 @@ int mlx5_cmd_destroy_vport_lag(struct mlx5_core_dev *dev)
 }
 EXPORT_SYMBOL(mlx5_cmd_destroy_vport_lag);
 
+static int mlx5_cmd_query_cong_counter(struct mlx5_core_dev *dev,
+                                       bool reset, void *out, int out_size)
+{
+        u32 in[MLX5_ST_SZ_DW(query_cong_statistics_in)] = { };
+
+        MLX5_SET(query_cong_statistics_in, in, opcode,
+                 MLX5_CMD_OP_QUERY_CONG_STATISTICS);
+        MLX5_SET(query_cong_statistics_in, in, clear, reset);
+        return mlx5_cmd_exec(dev, in, sizeof(in), out, out_size);
+}
+
 static struct mlx5_lag *mlx5_lag_dev_get(struct mlx5_core_dev *dev)
 {
         return dev->priv.lag;
@@ -633,3 +644,48 @@ bool mlx5_lag_intf_add(struct mlx5_interface *intf, struct mlx5_priv *priv)
         /* If bonded, we do not add an IB device for PF1. */
         return false;
 }
+
+int mlx5_lag_query_cong_counters(struct mlx5_core_dev *dev,
+                                 u64 *values,
+                                 int num_counters,
+                                 size_t *offsets)
+{
+        int outlen = MLX5_ST_SZ_BYTES(query_cong_statistics_out);
+        struct mlx5_core_dev *mdev[MLX5_MAX_PORTS];
+        struct mlx5_lag *ldev;
+        int num_ports;
+        int ret, i, j;
+        void *out;
+
+        out = kvzalloc(outlen, GFP_KERNEL);
+        if (!out)
+                return -ENOMEM;
+
+        memset(values, 0, sizeof(*values) * num_counters);
+
+        mutex_lock(&lag_mutex);
+        ldev = mlx5_lag_dev_get(dev);
+        if (ldev && mlx5_lag_is_bonded(ldev)) {
+                num_ports = MLX5_MAX_PORTS;
+                mdev[0] = ldev->pf[0].dev;
+                mdev[1] = ldev->pf[1].dev;
+        } else {
+                num_ports = 1;
+                mdev[0] = dev;
+        }
+
+        for (i = 0; i < num_ports; ++i) {
+                ret = mlx5_cmd_query_cong_counter(mdev[i], false, out, outlen);
+                if (ret)
+                        goto unlock;
+
+                for (j = 0; j < num_counters; ++j)
+                        values[j] += be64_to_cpup((__be64 *)(out + offsets[j]));
+        }
+
+unlock:
+        mutex_unlock(&lag_mutex);
+        kvfree(out);
+        return ret;
+}
+EXPORT_SYMBOL(mlx5_lag_query_cong_counters);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
index 5f323442cc5a..8a89c7e8cd63 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
@@ -317,9 +317,6 @@ static int mlx5_alloc_irq_vectors(struct mlx5_core_dev *dev)
 {
         struct mlx5_priv *priv = &dev->priv;
         struct mlx5_eq_table *table = &priv->eq_table;
-        struct irq_affinity irqdesc = {
-                .pre_vectors = MLX5_EQ_VEC_COMP_BASE,
-        };
         int num_eqs = 1 << MLX5_CAP_GEN(dev, log_max_eq);
         int nvec;
 
@@ -333,10 +330,9 @@ static int mlx5_alloc_irq_vectors(struct mlx5_core_dev *dev)
         if (!priv->irq_info)
                 goto err_free_msix;
 
-        nvec = pci_alloc_irq_vectors_affinity(dev->pdev,
+        nvec = pci_alloc_irq_vectors(dev->pdev,
                         MLX5_EQ_VEC_COMP_BASE + 1, nvec,
-                        PCI_IRQ_MSIX | PCI_IRQ_AFFINITY,
-                        &irqdesc);
+                        PCI_IRQ_MSIX);
         if (nvec < 0)
                 return nvec;
 
@@ -622,6 +618,63 @@ u64 mlx5_read_internal_timer(struct mlx5_core_dev *dev)
         return (u64)timer_l | (u64)timer_h1 << 32;
 }
 
+static int mlx5_irq_set_affinity_hint(struct mlx5_core_dev *mdev, int i)
+{
+        struct mlx5_priv *priv  = &mdev->priv;
+        int irq = pci_irq_vector(mdev->pdev, MLX5_EQ_VEC_COMP_BASE + i);
+
+        if (!zalloc_cpumask_var(&priv->irq_info[i].mask, GFP_KERNEL)) {
+                mlx5_core_warn(mdev, "zalloc_cpumask_var failed");
+                return -ENOMEM;
+        }
+
+        cpumask_set_cpu(cpumask_local_spread(i, priv->numa_node),
+                        priv->irq_info[i].mask);
+
+        if (IS_ENABLED(CONFIG_SMP) &&
+            irq_set_affinity_hint(irq, priv->irq_info[i].mask))
+                mlx5_core_warn(mdev, "irq_set_affinity_hint failed, irq 0x%.4x", irq);
+
+        return 0;
+}
+
+static void mlx5_irq_clear_affinity_hint(struct mlx5_core_dev *mdev, int i)
+{
+        struct mlx5_priv *priv  = &mdev->priv;
+        int irq = pci_irq_vector(mdev->pdev, MLX5_EQ_VEC_COMP_BASE + i);
+
+        irq_set_affinity_hint(irq, NULL);
+        free_cpumask_var(priv->irq_info[i].mask);
+}
+
+static int mlx5_irq_set_affinity_hints(struct mlx5_core_dev *mdev)
+{
+        int err;
+        int i;
+
+        for (i = 0; i < mdev->priv.eq_table.num_comp_vectors; i++) {
+                err = mlx5_irq_set_affinity_hint(mdev, i);
+                if (err)
+                        goto err_out;
+        }
+
+        return 0;
+
+err_out:
+        for (i--; i >= 0; i--)
+                mlx5_irq_clear_affinity_hint(mdev, i);
+
+        return err;
+}
+
+static void mlx5_irq_clear_affinity_hints(struct mlx5_core_dev *mdev)
+{
+        int i;
+
+        for (i = 0; i < mdev->priv.eq_table.num_comp_vectors; i++)
+                mlx5_irq_clear_affinity_hint(mdev, i);
+}
+
 int mlx5_vector2eqn(struct mlx5_core_dev *dev, int vector, int *eqn,
                     unsigned int *irqn)
 {
@@ -1097,6 +1150,12 @@ static int mlx5_load_one(struct mlx5_core_dev *dev, struct mlx5_priv *priv,
                 goto err_stop_eqs;
         }
 
+        err = mlx5_irq_set_affinity_hints(dev);
+        if (err) {
+                dev_err(&pdev->dev, "Failed to alloc affinity hint cpumask\n");
+                goto err_affinity_hints;
+        }
+
         err = mlx5_init_fs(dev);
         if (err) {
                 dev_err(&pdev->dev, "Failed to init flow steering\n");
@@ -1154,6 +1213,9 @@ err_sriov:
         mlx5_cleanup_fs(dev);
 
 err_fs:
+        mlx5_irq_clear_affinity_hints(dev);
+
+err_affinity_hints:
         free_comp_eqs(dev);
 
 err_stop_eqs:
@@ -1222,6 +1284,7 @@ static int mlx5_unload_one(struct mlx5_core_dev *dev, struct mlx5_priv *priv,
 
         mlx5_sriov_detach(dev);
         mlx5_cleanup_fs(dev);
+        mlx5_irq_clear_affinity_hints(dev);
         free_comp_eqs(dev);
         mlx5_stop_eqs(dev);
         mlx5_put_uars_page(dev, priv->uar);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/qp.c b/drivers/net/ethernet/mellanox/mlx5/core/qp.c
index db9e665ab104..889130edb715 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/qp.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/qp.c
@@ -213,8 +213,8 @@ int mlx5_core_create_qp(struct mlx5_core_dev *dev,
 err_cmd:
         memset(din, 0, sizeof(din));
         memset(dout, 0, sizeof(dout));
-        MLX5_SET(destroy_qp_in, in, opcode, MLX5_CMD_OP_DESTROY_QP);
-        MLX5_SET(destroy_qp_in, in, qpn, qp->qpn);
+        MLX5_SET(destroy_qp_in, din, opcode, MLX5_CMD_OP_DESTROY_QP);
+        MLX5_SET(destroy_qp_in, din, qpn, qp->qpn);
         mlx5_cmd_exec(dev, din, sizeof(din), dout, sizeof(dout));
         return err;
 }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/rl.c b/drivers/net/ethernet/mellanox/mlx5/core/rl.c
index e651e4c02867..d3c33e9eea72 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/rl.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/rl.c
@@ -125,16 +125,16 @@ static struct mlx5_rl_entry *find_rl_entry(struct mlx5_rl_table *table,
         return ret_entry;
 }
 
-static int mlx5_set_rate_limit_cmd(struct mlx5_core_dev *dev,
+static int mlx5_set_pp_rate_limit_cmd(struct mlx5_core_dev *dev,
                                    u32 rate, u16 index)
 {
-        u32 in[MLX5_ST_SZ_DW(set_rate_limit_in)]   = {0};
-        u32 out[MLX5_ST_SZ_DW(set_rate_limit_out)] = {0};
+        u32 in[MLX5_ST_SZ_DW(set_pp_rate_limit_in)]   = {0};
+        u32 out[MLX5_ST_SZ_DW(set_pp_rate_limit_out)] = {0};
 
-        MLX5_SET(set_rate_limit_in, in, opcode,
-                 MLX5_CMD_OP_SET_RATE_LIMIT);
-        MLX5_SET(set_rate_limit_in, in, rate_limit_index, index);
-        MLX5_SET(set_rate_limit_in, in, rate_limit, rate);
+        MLX5_SET(set_pp_rate_limit_in, in, opcode,
+                 MLX5_CMD_OP_SET_PP_RATE_LIMIT);
+        MLX5_SET(set_pp_rate_limit_in, in, rate_limit_index, index);
+        MLX5_SET(set_pp_rate_limit_in, in, rate_limit, rate);
         return mlx5_cmd_exec(dev, in, sizeof(in), out, sizeof(out));
 }
 
@@ -173,7 +173,7 @@ int mlx5_rl_add_rate(struct mlx5_core_dev *dev, u32 rate, u16 *index)
                 entry->refcount++;
         } else {
                 /* new rate limit */
-                err = mlx5_set_rate_limit_cmd(dev, rate, entry->index);
+                err = mlx5_set_pp_rate_limit_cmd(dev, rate, entry->index);
                 if (err) {
                         mlx5_core_err(dev, "Failed configuring rate: %u (%d)\n",
                                       rate, err);
@@ -209,7 +209,7 @@ void mlx5_rl_remove_rate(struct mlx5_core_dev *dev, u32 rate)
         entry->refcount--;
         if (!entry->refcount) {
                 /* need to remove rate */
-                mlx5_set_rate_limit_cmd(dev, 0, entry->index);
+                mlx5_set_pp_rate_limit_cmd(dev, 0, entry->index);
                 entry->rate = 0;
         }
 
@@ -262,8 +262,8 @@ void mlx5_cleanup_rl_table(struct mlx5_core_dev *dev)
         /* Clear all configured rates */
         for (i = 0; i < table->max_size; i++)
                 if (table->rl_entry[i].rate)
-                        mlx5_set_rate_limit_cmd(dev, 0,
-                                                table->rl_entry[i].index);
+                        mlx5_set_pp_rate_limit_cmd(dev, 0,
+                                                   table->rl_entry[i].index);
 
         kfree(dev->priv.rl_table.rl_entry);
 }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/vxlan.c b/drivers/net/ethernet/mellanox/mlx5/core/vxlan.c
index 07a9ba6cfc70..2f74953e4561 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/vxlan.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/vxlan.c
@@ -71,9 +71,9 @@ struct mlx5e_vxlan *mlx5e_vxlan_lookup_port(struct mlx5e_priv *priv, u16 port)
         struct mlx5e_vxlan_db *vxlan_db = &priv->vxlan;
         struct mlx5e_vxlan *vxlan;
 
-        spin_lock(&vxlan_db->lock);
+        spin_lock_bh(&vxlan_db->lock);
         vxlan = radix_tree_lookup(&vxlan_db->tree, port);
-        spin_unlock(&vxlan_db->lock);
+        spin_unlock_bh(&vxlan_db->lock);
 
         return vxlan;
 }
@@ -88,8 +88,12 @@ static void mlx5e_vxlan_add_port(struct work_struct *work)
         struct mlx5e_vxlan *vxlan;
         int err;
 
-        if (mlx5e_vxlan_lookup_port(priv, port))
+        mutex_lock(&priv->state_lock);
+        vxlan = mlx5e_vxlan_lookup_port(priv, port);
+        if (vxlan) {
+                atomic_inc(&vxlan->refcount);
                 goto free_work;
+        }
 
         if (mlx5e_vxlan_core_add_port_cmd(priv->mdev, port))
                 goto free_work;
@@ -99,10 +103,11 @@ static void mlx5e_vxlan_add_port(struct work_struct *work)
                 goto err_delete_port;
 
         vxlan->udp_port = port;
+        atomic_set(&vxlan->refcount, 1);
 
-        spin_lock_irq(&vxlan_db->lock);
+        spin_lock_bh(&vxlan_db->lock);
         err = radix_tree_insert(&vxlan_db->tree, vxlan->udp_port, vxlan);
-        spin_unlock_irq(&vxlan_db->lock);
+        spin_unlock_bh(&vxlan_db->lock);
         if (err)
                 goto err_free;
 
@@ -113,35 +118,39 @@ err_free:
 err_delete_port:
         mlx5e_vxlan_core_del_port_cmd(priv->mdev, port);
 free_work:
+        mutex_unlock(&priv->state_lock);
         kfree(vxlan_work);
 }
 
-static void __mlx5e_vxlan_core_del_port(struct mlx5e_priv *priv, u16 port)
+static void mlx5e_vxlan_del_port(struct work_struct *work)
 {
+        struct mlx5e_vxlan_work *vxlan_work =
+                container_of(work, struct mlx5e_vxlan_work, work);
+        struct mlx5e_priv *priv         = vxlan_work->priv;
         struct mlx5e_vxlan_db *vxlan_db = &priv->vxlan;
+        u16 port = vxlan_work->port;
         struct mlx5e_vxlan *vxlan;
+        bool remove = false;
 
-        spin_lock_irq(&vxlan_db->lock);
-        vxlan = radix_tree_delete(&vxlan_db->tree, port);
-        spin_unlock_irq(&vxlan_db->lock);
-
+        mutex_lock(&priv->state_lock);
+        spin_lock_bh(&vxlan_db->lock);
+        vxlan = radix_tree_lookup(&vxlan_db->tree, port);
         if (!vxlan)
-                return;
-
-        mlx5e_vxlan_core_del_port_cmd(priv->mdev, vxlan->udp_port);
-
-        kfree(vxlan);
-}
+                goto out_unlock;
 
-static void mlx5e_vxlan_del_port(struct work_struct *work)
-{
-        struct mlx5e_vxlan_work *vxlan_work =
-                container_of(work, struct mlx5e_vxlan_work, work);
-        struct mlx5e_priv *priv = vxlan_work->priv;
-        u16 port = vxlan_work->port;
+        if (atomic_dec_and_test(&vxlan->refcount)) {
+                radix_tree_delete(&vxlan_db->tree, port);
+                remove = true;
+        }
 
-        __mlx5e_vxlan_core_del_port(priv, port);
+out_unlock:
+        spin_unlock_bh(&vxlan_db->lock);
 
+        if (remove) {
+                mlx5e_vxlan_core_del_port_cmd(priv->mdev, port);
+                kfree(vxlan);
+        }
+        mutex_unlock(&priv->state_lock);
         kfree(vxlan_work);
 }
 
@@ -171,12 +180,11 @@ void mlx5e_vxlan_cleanup(struct mlx5e_priv *priv)
         struct mlx5e_vxlan *vxlan;
         unsigned int port = 0;
 
-        spin_lock_irq(&vxlan_db->lock);
+        /* Lockless since we are the only radix-tree consumers, wq is disabled */
         while (radix_tree_gang_lookup(&vxlan_db->tree, (void **)&vxlan, port, 1)) {
                 port = vxlan->udp_port;
-                spin_unlock_irq(&vxlan_db->lock);
-                __mlx5e_vxlan_core_del_port(priv, (u16)port);
-                spin_lock_irq(&vxlan_db->lock);
+                radix_tree_delete(&vxlan_db->tree, port);
+                mlx5e_vxlan_core_del_port_cmd(priv->mdev, port);
+                kfree(vxlan);
         }
-        spin_unlock_irq(&vxlan_db->lock);
 }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/vxlan.h b/drivers/net/ethernet/mellanox/mlx5/core/vxlan.h
index 5def12c048e3..5ef6ae7d568a 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/vxlan.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/vxlan.h
@@ -36,6 +36,7 @@
 #include "en.h"
 
 struct mlx5e_vxlan {
+        atomic_t refcount;
         u16 udp_port;
 };
 
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
index 2d0897b7d860..9bd8d28de152 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
@@ -4300,6 +4300,7 @@ static int mlxsw_sp_port_stp_set(struct mlxsw_sp_port *mlxsw_sp_port,
 
 static int mlxsw_sp_port_ovs_join(struct mlxsw_sp_port *mlxsw_sp_port)
 {
+        u16 vid = 1;
         int err;
 
         err = mlxsw_sp_port_vp_mode_set(mlxsw_sp_port, true);
@@ -4312,8 +4313,19 @@ static int mlxsw_sp_port_ovs_join(struct mlxsw_sp_port *mlxsw_sp_port)
                                      true, false);
         if (err)
                 goto err_port_vlan_set;
+
+        for (; vid <= VLAN_N_VID - 1; vid++) {
+                err = mlxsw_sp_port_vid_learning_set(mlxsw_sp_port,
+                                                     vid, false);
+                if (err)
+                        goto err_vid_learning_set;
+        }
+
         return 0;
 
+err_vid_learning_set:
+        for (vid--; vid >= 1; vid--)
+                mlxsw_sp_port_vid_learning_set(mlxsw_sp_port, vid, true);
 err_port_vlan_set:
         mlxsw_sp_port_stp_set(mlxsw_sp_port, false);
 err_port_stp_set:
@@ -4323,6 +4335,12 @@ err_port_stp_set:
 
 static void mlxsw_sp_port_ovs_leave(struct mlxsw_sp_port *mlxsw_sp_port)
 {
+        u16 vid;
+
+        for (vid = VLAN_N_VID - 1; vid >= 1; vid--)
+                mlxsw_sp_port_vid_learning_set(mlxsw_sp_port,
+                                               vid, true);
+
         mlxsw_sp_port_vlan_set(mlxsw_sp_port, 2, VLAN_N_VID - 1,
                                false, false);
         mlxsw_sp_port_stp_set(mlxsw_sp_port, false);
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
index 72ef4f8025f0..be657b8533f0 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
@@ -2436,25 +2436,16 @@ static void mlxsw_sp_neigh_fini(struct mlxsw_sp *mlxsw_sp)
         rhashtable_destroy(&mlxsw_sp->router->neigh_ht);
 }
 
-static int mlxsw_sp_neigh_rif_flush(struct mlxsw_sp *mlxsw_sp,
-                                    const struct mlxsw_sp_rif *rif)
-{
-        char rauht_pl[MLXSW_REG_RAUHT_LEN];
-
-        mlxsw_reg_rauht_pack(rauht_pl, MLXSW_REG_RAUHT_OP_WRITE_DELETE_ALL,
-                             rif->rif_index, rif->addr);
-        return mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(rauht), rauht_pl);
-}
-
 static void mlxsw_sp_neigh_rif_gone_sync(struct mlxsw_sp *mlxsw_sp,
                                          struct mlxsw_sp_rif *rif)
 {
         struct mlxsw_sp_neigh_entry *neigh_entry, *tmp;
 
-        mlxsw_sp_neigh_rif_flush(mlxsw_sp, rif);
         list_for_each_entry_safe(neigh_entry, tmp, &rif->neigh_list,
-                                 rif_list_node)
+                                 rif_list_node) {
+                mlxsw_sp_neigh_entry_update(mlxsw_sp, neigh_entry, false);
                 mlxsw_sp_neigh_entry_destroy(mlxsw_sp, neigh_entry);
+        }
 }
 
 enum mlxsw_sp_nexthop_type {
diff --git a/drivers/net/ethernet/netronome/nfp/bpf/main.c b/drivers/net/ethernet/netronome/nfp/bpf/main.c
index e379b78e86ef..13190aa09faf 100644
--- a/drivers/net/ethernet/netronome/nfp/bpf/main.c
+++ b/drivers/net/ethernet/netronome/nfp/bpf/main.c
@@ -82,10 +82,33 @@ static const char *nfp_bpf_extra_cap(struct nfp_app *app, struct nfp_net *nn)
         return nfp_net_ebpf_capable(nn) ? "BPF" : "";
 }
 
+static int
+nfp_bpf_vnic_alloc(struct nfp_app *app, struct nfp_net *nn, unsigned int id)
+{
+        int err;
+
+        nn->app_priv = kzalloc(sizeof(struct nfp_bpf_vnic), GFP_KERNEL);
+        if (!nn->app_priv)
+                return -ENOMEM;
+
+        err = nfp_app_nic_vnic_alloc(app, nn, id);
+        if (err)
+                goto err_free_priv;
+
+        return 0;
+err_free_priv:
+        kfree(nn->app_priv);
+        return err;
+}
+
 static void nfp_bpf_vnic_free(struct nfp_app *app, struct nfp_net *nn)
 {
+        struct nfp_bpf_vnic *bv = nn->app_priv;
+
         if (nn->dp.bpf_offload_xdp)
                 nfp_bpf_xdp_offload(app, nn, NULL);
+        WARN_ON(bv->tc_prog);
+        kfree(bv);
 }
 
 static int nfp_bpf_setup_tc_block_cb(enum tc_setup_type type,
@@ -93,6 +116,9 @@ static int nfp_bpf_setup_tc_block_cb(enum tc_setup_type type,
 {
         struct tc_cls_bpf_offload *cls_bpf = type_data;
         struct nfp_net *nn = cb_priv;
+        struct bpf_prog *oldprog;
+        struct nfp_bpf_vnic *bv;
+        int err;
 
         if (type != TC_SETUP_CLSBPF ||
             !tc_can_offload(nn->dp.netdev) ||
@@ -100,8 +126,6 @@ static int nfp_bpf_setup_tc_block_cb(enum tc_setup_type type,
             cls_bpf->common.protocol != htons(ETH_P_ALL) ||
             cls_bpf->common.chain_index)
                 return -EOPNOTSUPP;
-        if (nn->dp.bpf_offload_xdp)
-                return -EBUSY;
 
         /* Only support TC direct action */
         if (!cls_bpf->exts_integrated ||
@@ -110,16 +134,25 @@ static int nfp_bpf_setup_tc_block_cb(enum tc_setup_type type,
                 return -EOPNOTSUPP;
         }
 
-        switch (cls_bpf->command) {
-        case TC_CLSBPF_REPLACE:
-                return nfp_net_bpf_offload(nn, cls_bpf->prog, true);
-        case TC_CLSBPF_ADD:
-                return nfp_net_bpf_offload(nn, cls_bpf->prog, false);
-        case TC_CLSBPF_DESTROY:
-                return nfp_net_bpf_offload(nn, NULL, true);
-        default:
+        if (cls_bpf->command != TC_CLSBPF_OFFLOAD)
                 return -EOPNOTSUPP;
+
+        bv = nn->app_priv;
+        oldprog = cls_bpf->oldprog;
+
+        /* Don't remove if oldprog doesn't match driver's state */
+        if (bv->tc_prog != oldprog) {
+                oldprog = NULL;
+                if (!cls_bpf->prog)
+                        return 0;
         }
+
+        err = nfp_net_bpf_offload(nn, cls_bpf->prog, oldprog);
+        if (err)
+                return err;
+
+        bv->tc_prog = cls_bpf->prog;
+        return 0;
 }
 
 static int nfp_bpf_setup_tc_block(struct net_device *netdev,
@@ -167,7 +200,7 @@ const struct nfp_app_type app_bpf = {
 
         .extra_cap      = nfp_bpf_extra_cap,
 
-        .vnic_alloc     = nfp_app_nic_vnic_alloc,
+        .vnic_alloc     = nfp_bpf_vnic_alloc,
         .vnic_free      = nfp_bpf_vnic_free,
 
         .setup_tc       = nfp_bpf_setup_tc,
diff --git a/drivers/net/ethernet/netronome/nfp/bpf/main.h b/drivers/net/ethernet/netronome/nfp/bpf/main.h
index 082a15f6dfb5..57b6043177a3 100644
--- a/drivers/net/ethernet/netronome/nfp/bpf/main.h
+++ b/drivers/net/ethernet/netronome/nfp/bpf/main.h
@@ -172,6 +172,14 @@ struct nfp_prog {
         struct list_head insns;
 };
 
+/**
+ * struct nfp_bpf_vnic - per-vNIC BPF priv structure
+ * @tc_prog:    currently loaded cls_bpf program
+ */
+struct nfp_bpf_vnic {
+        struct bpf_prog *tc_prog;
+};
+
 int nfp_bpf_jit(struct nfp_prog *prog);
 
 extern const struct bpf_ext_analyzer_ops nfp_bpf_analyzer_ops;
diff --git a/drivers/net/ethernet/qualcomm/emac/emac-phy.c b/drivers/net/ethernet/qualcomm/emac/emac-phy.c
index 18461fcb9815..53dbf1e163a8 100644
--- a/drivers/net/ethernet/qualcomm/emac/emac-phy.c
+++ b/drivers/net/ethernet/qualcomm/emac/emac-phy.c
@@ -47,6 +47,7 @@
 #define MDIO_CLK_25_28                                               7
 
 #define MDIO_WAIT_TIMES                                           1000
+#define MDIO_STATUS_DELAY_TIME                                       1
 
 static int emac_mdio_read(struct mii_bus *bus, int addr, int regnum)
 {
@@ -65,7 +66,7 @@ static int emac_mdio_read(struct mii_bus *bus, int addr, int regnum)
 
         if (readl_poll_timeout(adpt->base + EMAC_MDIO_CTRL, reg,
                                !(reg & (MDIO_START | MDIO_BUSY)),
-                               100, MDIO_WAIT_TIMES * 100))
+                               MDIO_STATUS_DELAY_TIME, MDIO_WAIT_TIMES * 100))
                 return -EIO;
 
         return (reg >> MDIO_DATA_SHFT) & MDIO_DATA_BMSK;
@@ -88,8 +89,8 @@ static int emac_mdio_write(struct mii_bus *bus, int addr, int regnum, u16 val)
         writel(reg, adpt->base + EMAC_MDIO_CTRL);
 
         if (readl_poll_timeout(adpt->base + EMAC_MDIO_CTRL, reg,
-                               !(reg & (MDIO_START | MDIO_BUSY)), 100,
-                               MDIO_WAIT_TIMES * 100))
+                               !(reg & (MDIO_START | MDIO_BUSY)),
+                               MDIO_STATUS_DELAY_TIME, MDIO_WAIT_TIMES * 100))
                 return -EIO;
 
         return 0;
diff --git a/drivers/net/ethernet/qualcomm/emac/emac.c b/drivers/net/ethernet/qualcomm/emac/emac.c
index 70c92b649b29..38c924bdd32e 100644
--- a/drivers/net/ethernet/qualcomm/emac/emac.c
+++ b/drivers/net/ethernet/qualcomm/emac/emac.c
@@ -253,18 +253,18 @@ static int emac_open(struct net_device *netdev)
                 return ret;
         }
 
-        ret = emac_mac_up(adpt);
+        ret = adpt->phy.open(adpt);
         if (ret) {
                 emac_mac_rx_tx_rings_free_all(adpt);
                 free_irq(irq->irq, irq);
                 return ret;
         }
 
-        ret = adpt->phy.open(adpt);
+        ret = emac_mac_up(adpt);
         if (ret) {
-                emac_mac_down(adpt);
                 emac_mac_rx_tx_rings_free_all(adpt);
                 free_irq(irq->irq, irq);
+                adpt->phy.close(adpt);
                 return ret;
         }
 
diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c
index 2b962d349f5f..009780df664b 100644
--- a/drivers/net/ethernet/renesas/ravb_main.c
+++ b/drivers/net/ethernet/renesas/ravb_main.c
@@ -2308,32 +2308,9 @@ static int __maybe_unused ravb_resume(struct device *dev)
         struct ravb_private *priv = netdev_priv(ndev);
         int ret = 0;
 
-        if (priv->wol_enabled) {
-                /* Reduce the usecount of the clock to zero and then
-                 * restore it to its original value. This is done to force
-                 * the clock to be re-enabled which is a workaround
-                 * for renesas-cpg-mssr driver which do not enable clocks
-                 * when resuming from PSCI suspend/resume.
-                 *
-                 * Without this workaround the driver fails to communicate
-                 * with the hardware if WoL was enabled when the system
-                 * entered PSCI suspend. This is due to that if WoL is enabled
-                 * we explicitly keep the clock from being turned off when
-                 * suspending, but in PSCI sleep power is cut so the clock
-                 * is disabled anyhow, the clock driver is not aware of this
-                 * so the clock is not turned back on when resuming.
-                 *
-                 * TODO: once the renesas-cpg-mssr suspend/resume is working
-                 *       this clock dance should be removed.
-                 */
-                clk_disable(priv->clk);
-                clk_disable(priv->clk);
-                clk_enable(priv->clk);
-                clk_enable(priv->clk);
-
-                /* Set reset mode to rearm the WoL logic */
+        /* If WoL is enabled set reset mode to rearm the WoL logic */
+        if (priv->wol_enabled)
                 ravb_write(ndev, CCC_OPC_RESET, CCC);
-        }
 
         /* All register have been reset to default values.
          * Restore all registers which where setup at probe time and
diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
index db72d13cebb9..75323000c364 100644
--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -1892,6 +1892,16 @@ static int sh_eth_phy_init(struct net_device *ndev)
                 return PTR_ERR(phydev);
         }
 
+        /* mask with MAC supported features */
+        if (mdp->cd->register_type != SH_ETH_REG_GIGABIT) {
+                int err = phy_set_max_speed(phydev, SPEED_100);
+                if (err) {
+                        netdev_err(ndev, "failed to limit PHY to 100 Mbit/s\n");
+                        phy_disconnect(phydev);
+                        return err;
+                }
+        }
+
         phy_attached_info(phydev);
 
         return 0;
diff --git a/drivers/net/ethernet/stmicro/stmmac/common.h b/drivers/net/ethernet/stmicro/stmmac/common.h
index e1e5ac053760..ce2ea2d491ac 100644
--- a/drivers/net/ethernet/stmicro/stmmac/common.h
+++ b/drivers/net/ethernet/stmicro/stmmac/common.h
@@ -409,7 +409,7 @@ struct stmmac_desc_ops {
         /* get timestamp value */
          u64(*get_timestamp) (void *desc, u32 ats);
         /* get rx timestamp status */
-        int (*get_rx_timestamp_status) (void *desc, u32 ats);
+        int (*get_rx_timestamp_status)(void *desc, void *next_desc, u32 ats);
         /* Display ring */
         void (*display_ring)(void *head, unsigned int size, bool rx);
         /* set MSS via context descriptor */
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c
index 4b286e27c4ca..7e089bf906b4 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c
@@ -258,7 +258,8 @@ static int dwmac4_rx_check_timestamp(void *desc)
         return ret;
 }
 
-static int dwmac4_wrback_get_rx_timestamp_status(void *desc, u32 ats)
+static int dwmac4_wrback_get_rx_timestamp_status(void *desc, void *next_desc,
+                                                 u32 ats)
 {
         struct dma_desc *p = (struct dma_desc *)desc;
         int ret = -EINVAL;
@@ -270,7 +271,7 @@ static int dwmac4_wrback_get_rx_timestamp_status(void *desc, u32 ats)
 
                         /* Check if timestamp is OK from context descriptor */
                         do {
-                                ret = dwmac4_rx_check_timestamp(desc);
+                                ret = dwmac4_rx_check_timestamp(next_desc);
                                 if (ret < 0)
                                         goto exit;
                                 i++;
diff --git a/drivers/net/ethernet/stmicro/stmmac/enh_desc.c b/drivers/net/ethernet/stmicro/stmmac/enh_desc.c
index 7546b3664113..2a828a312814 100644
--- a/drivers/net/ethernet/stmicro/stmmac/enh_desc.c
+++ b/drivers/net/ethernet/stmicro/stmmac/enh_desc.c
@@ -400,7 +400,8 @@ static u64 enh_desc_get_timestamp(void *desc, u32 ats)
         return ns;
 }
 
-static int enh_desc_get_rx_timestamp_status(void *desc, u32 ats)
+static int enh_desc_get_rx_timestamp_status(void *desc, void *next_desc,
+                                            u32 ats)
 {
         if (ats) {
                 struct dma_extended_desc *p = (struct dma_extended_desc *)desc;
diff --git a/drivers/net/ethernet/stmicro/stmmac/norm_desc.c b/drivers/net/ethernet/stmicro/stmmac/norm_desc.c
index f817f8f36569..db4cee57bb24 100644
--- a/drivers/net/ethernet/stmicro/stmmac/norm_desc.c
+++ b/drivers/net/ethernet/stmicro/stmmac/norm_desc.c
@@ -265,7 +265,7 @@ static u64 ndesc_get_timestamp(void *desc, u32 ats)
         return ns;
 }
 
-static int ndesc_get_rx_timestamp_status(void *desc, u32 ats)
+static int ndesc_get_rx_timestamp_status(void *desc, void *next_desc, u32 ats)
 {
         struct dma_desc *p = (struct dma_desc *)desc;
 
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c
index 721b61655261..08c19ebd5306 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c
@@ -34,6 +34,7 @@ static u32 stmmac_config_sub_second_increment(void __iomem *ioaddr,
 {
         u32 value = readl(ioaddr + PTP_TCR);
         unsigned long data;
+        u32 reg_value;
 
         /* For GMAC3.x, 4.x versions, convert the ptp_clock to nano second
          *      formula = (1/ptp_clock) * 1000000000
@@ -50,10 +51,11 @@ static u32 stmmac_config_sub_second_increment(void __iomem *ioaddr,
 
         data &= PTP_SSIR_SSINC_MASK;
 
+        reg_value = data;
         if (gmac4)
-                data = data << GMAC4_PTP_SSIR_SSINC_SHIFT;
+                reg_value <<= GMAC4_PTP_SSIR_SSINC_SHIFT;
 
-        writel(data, ioaddr + PTP_SSIR);
+        writel(reg_value, ioaddr + PTP_SSIR);
 
         return data;
 }
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index d7250539d0bd..337d53d12e94 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -482,7 +482,7 @@ static void stmmac_get_rx_hwtstamp(struct stmmac_priv *priv, struct dma_desc *p,
                 desc = np;
 
         /* Check if timestamp is available */
-        if (priv->hw->desc->get_rx_timestamp_status(desc, priv->adv_ts)) {
+        if (priv->hw->desc->get_rx_timestamp_status(p, np, priv->adv_ts)) {
                 ns = priv->hw->desc->get_timestamp(desc, priv->adv_ts);
                 netdev_dbg(priv->dev, "get valid RX hw timestamp %llu\n", ns);
                 shhwtstamp = skb_hwtstamps(skb);
diff --git a/drivers/net/hippi/rrunner.c b/drivers/net/hippi/rrunner.c
index 8483f03d5a41..1ab97d99b9ba 100644
--- a/drivers/net/hippi/rrunner.c
+++ b/drivers/net/hippi/rrunner.c
@@ -1379,8 +1379,8 @@ static int rr_close(struct net_device *dev)
                             rrpriv->info_dma);
         rrpriv->info = NULL;
 
-        free_irq(pdev->irq, dev);
         spin_unlock_irqrestore(&rrpriv->lock, flags);
+        free_irq(pdev->irq, dev);
 
         return 0;
 }
diff --git a/drivers/net/phy/at803x.c b/drivers/net/phy/at803x.c
index 5f93e6add563..e911e4990b20 100644
--- a/drivers/net/phy/at803x.c
+++ b/drivers/net/phy/at803x.c
@@ -239,14 +239,10 @@ static int at803x_resume(struct phy_device *phydev)
 {
         int value;
 
-        mutex_lock(&phydev->lock);
-
         value = phy_read(phydev, MII_BMCR);
         value &= ~(BMCR_PDOWN | BMCR_ISOLATE);
         phy_write(phydev, MII_BMCR, value);
 
-        mutex_unlock(&phydev->lock);
-
         return 0;
 }
 
diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c
index 4d02b27df044..82104edca393 100644
--- a/drivers/net/phy/marvell.c
+++ b/drivers/net/phy/marvell.c
@@ -637,6 +637,10 @@ static int m88e1510_config_aneg(struct phy_device *phydev)
         if (err < 0)
                 goto error;
 
+        /* Do not touch the fiber page if we're in copper->sgmii mode */
+        if (phydev->interface == PHY_INTERFACE_MODE_SGMII)
+                return 0;
+
         /* Then the fiber link */
         err = marvell_set_page(phydev, MII_MARVELL_FIBER_PAGE);
         if (err < 0)
@@ -875,6 +879,8 @@ static int m88e1510_config_init(struct phy_device *phydev)
 
         /* SGMII-to-Copper mode initialization */
         if (phydev->interface == PHY_INTERFACE_MODE_SGMII) {
+                u32 pause;
+
                 /* Select page 18 */
                 err = marvell_set_page(phydev, 18);
                 if (err < 0)
@@ -898,6 +904,16 @@ static int m88e1510_config_init(struct phy_device *phydev)
                 err = marvell_set_page(phydev, MII_MARVELL_COPPER_PAGE);
                 if (err < 0)
                         return err;
+
+                /* There appears to be a bug in the 88e1512 when used in
+                 * SGMII to copper mode, where the AN advertisment register
+                 * clears the pause bits each time a negotiation occurs.
+                 * This means we can never be truely sure what was advertised,
+                 * so disable Pause support.
+                 */
+                pause = SUPPORTED_Pause | SUPPORTED_Asym_Pause;
+                phydev->supported &= ~pause;
+                phydev->advertising &= ~pause;
         }
 
         return m88e1121_config_init(phydev);
@@ -2069,7 +2085,7 @@ static struct phy_driver marvell_drivers[] = {
                 .flags = PHY_HAS_INTERRUPT,
                 .probe = marvell_probe,
                 .config_init = &m88e1145_config_init,
-                .config_aneg = &marvell_config_aneg,
+                .config_aneg = &m88e1101_config_aneg,
                 .read_status = &genphy_read_status,
                 .ack_interrupt = &marvell_ack_interrupt,
                 .config_intr = &marvell_config_intr,
diff --git a/drivers/net/phy/mdio-xgene.c b/drivers/net/phy/mdio-xgene.c
index bfd3090fb055..07c6048200c6 100644
--- a/drivers/net/phy/mdio-xgene.c
+++ b/drivers/net/phy/mdio-xgene.c
@@ -194,8 +194,11 @@ static int xgene_mdio_reset(struct xgene_mdio_pdata *pdata)
         }
 
         ret = xgene_enet_ecc_init(pdata);
-        if (ret)
+        if (ret) {
+                if (pdata->dev->of_node)
+                        clk_disable_unprepare(pdata->clk);
                 return ret;
+        }
         xgene_gmac_reset(pdata);
 
         return 0;
@@ -388,8 +391,10 @@ static int xgene_mdio_probe(struct platform_device *pdev)
                 return ret;
 
         mdio_bus = mdiobus_alloc();
-        if (!mdio_bus)
-                return -ENOMEM;
+        if (!mdio_bus) {
+                ret = -ENOMEM;
+                goto out_clk;
+        }
 
         mdio_bus->name = "APM X-Gene MDIO bus";
 
@@ -418,7 +423,7 @@ static int xgene_mdio_probe(struct platform_device *pdev)
                 mdio_bus->phy_mask = ~0;
                 ret = mdiobus_register(mdio_bus);
                 if (ret)
-                        goto out;
+                        goto out_mdiobus;
 
                 acpi_walk_namespace(ACPI_TYPE_DEVICE, ACPI_HANDLE(dev), 1,
                                     acpi_register_phy, NULL, mdio_bus, NULL);
@@ -426,16 +431,20 @@ static int xgene_mdio_probe(struct platform_device *pdev)
         }
 
         if (ret)
-                goto out;
+                goto out_mdiobus;
 
         pdata->mdio_bus = mdio_bus;
         xgene_mdio_status = true;
 
         return 0;
 
-out:
+out_mdiobus:
         mdiobus_free(mdio_bus);
 
+out_clk:
+        if (dev->of_node)
+                clk_disable_unprepare(pdata->clk);
+
         return ret;
 }
 
diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c
index 2df7b62c1a36..54d00a1d2bef 100644
--- a/drivers/net/phy/mdio_bus.c
+++ b/drivers/net/phy/mdio_bus.c
@@ -270,6 +270,7 @@ static void of_mdiobus_link_mdiodev(struct mii_bus *bus,
 
                 if (addr == mdiodev->addr) {
                         dev->of_node = child;
+                        dev->fwnode = of_fwnode_handle(child);
                         return;
                 }
         }
diff --git a/drivers/net/phy/meson-gxl.c b/drivers/net/phy/meson-gxl.c
index 1ea69b7585d9..842eb871a6e3 100644
--- a/drivers/net/phy/meson-gxl.c
+++ b/drivers/net/phy/meson-gxl.c
@@ -22,6 +22,7 @@
 #include <linux/ethtool.h>
 #include <linux/phy.h>
 #include <linux/netdevice.h>
+#include <linux/bitfield.h>
 
 static int meson_gxl_config_init(struct phy_device *phydev)
 {
@@ -50,6 +51,77 @@ static int meson_gxl_config_init(struct phy_device *phydev)
         return 0;
 }
 
+/* This function is provided to cope with the possible failures of this phy
+ * during aneg process. When aneg fails, the PHY reports that aneg is done
+ * but the value found in MII_LPA is wrong:
+ *  - Early failures: MII_LPA is just 0x0001. if MII_EXPANSION reports that
+ *    the link partner (LP) supports aneg but the LP never acked our base
+ *    code word, it is likely that we never sent it to begin with.
+ *  - Late failures: MII_LPA is filled with a value which seems to make sense
+ *    but it actually is not what the LP is advertising. It seems that we
+ *    can detect this using a magic bit in the WOL bank (reg 12 - bit 12).
+ *    If this particular bit is not set when aneg is reported being done,
+ *    it means MII_LPA is likely to be wrong.
+ *
+ * In both case, forcing a restart of the aneg process solve the problem.
+ * When this failure happens, the first retry is usually successful but,
+ * in some cases, it may take up to 6 retries to get a decent result
+ */
+static int meson_gxl_read_status(struct phy_device *phydev)
+{
+        int ret, wol, lpa, exp;
+
+        if (phydev->autoneg == AUTONEG_ENABLE) {
+                ret = genphy_aneg_done(phydev);
+                if (ret < 0)
+                        return ret;
+                else if (!ret)
+                        goto read_status_continue;
+
+                /* Need to access WOL bank, make sure the access is open */
+                ret = phy_write(phydev, 0x14, 0x0000);
+                if (ret)
+                        return ret;
+                ret = phy_write(phydev, 0x14, 0x0400);
+                if (ret)
+                        return ret;
+                ret = phy_write(phydev, 0x14, 0x0000);
+                if (ret)
+                        return ret;
+                ret = phy_write(phydev, 0x14, 0x0400);
+                if (ret)
+                        return ret;
+
+                /* Request LPI_STATUS WOL register */
+                ret = phy_write(phydev, 0x14, 0x8D80);
+                if (ret)
+                        return ret;
+
+                /* Read LPI_STATUS value */
+                wol = phy_read(phydev, 0x15);
+                if (wol < 0)
+                        return wol;
+
+                lpa = phy_read(phydev, MII_LPA);
+                if (lpa < 0)
+                        return lpa;
+
+                exp = phy_read(phydev, MII_EXPANSION);
+                if (exp < 0)
+                        return exp;
+
+                if (!(wol & BIT(12)) ||
+                    ((exp & EXPANSION_NWAY) && !(lpa & LPA_LPACK))) {
+                        /* Looks like aneg failed after all */
+                        phydev_dbg(phydev, "LPA corruption - aneg restart\n");
+                        return genphy_restart_aneg(phydev);
+                }
+        }
+
+read_status_continue:
+        return genphy_read_status(phydev);
+}
+
 static struct phy_driver meson_gxl_phy[] = {
         {
                 .phy_id         = 0x01814400,
@@ -60,7 +132,7 @@ static struct phy_driver meson_gxl_phy[] = {
                 .config_init    = meson_gxl_config_init,
                 .config_aneg    = genphy_config_aneg,
                 .aneg_done      = genphy_aneg_done,
-                .read_status    = genphy_read_status,
+                .read_status    = meson_gxl_read_status,
                 .suspend        = genphy_suspend,
                 .resume         = genphy_resume,
         },
diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c
index ab4614113403..422ff6333c52 100644
--- a/drivers/net/phy/micrel.c
+++ b/drivers/net/phy/micrel.c
@@ -624,6 +624,7 @@ static int ksz9031_read_status(struct phy_device *phydev)
                 phydev->link = 0;
                 if (phydev->drv->config_intr && phy_interrupt_is_valid(phydev))
                         phydev->drv->config_intr(phydev);
+                return genphy_config_aneg(phydev);
         }
 
         return 0;
diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
index 2b1e67bc1e73..ed10d1fc8f59 100644
--- a/drivers/net/phy/phy.c
+++ b/drivers/net/phy/phy.c
@@ -828,7 +828,6 @@ EXPORT_SYMBOL(phy_stop);
  */
 void phy_start(struct phy_device *phydev)
 {
-        bool do_resume = false;
         int err = 0;
 
         mutex_lock(&phydev->lock);
@@ -841,6 +840,9 @@ void phy_start(struct phy_device *phydev)
                 phydev->state = PHY_UP;
                 break;
         case PHY_HALTED:
+                /* if phy was suspended, bring the physical link up again */
+                phy_resume(phydev);
+
                 /* make sure interrupts are re-enabled for the PHY */
                 if (phydev->irq != PHY_POLL) {
                         err = phy_enable_interrupts(phydev);
@@ -849,17 +851,12 @@ void phy_start(struct phy_device *phydev)
                 }
 
                 phydev->state = PHY_RESUMING;
-                do_resume = true;
                 break;
         default:
                 break;
         }
         mutex_unlock(&phydev->lock);
 
-        /* if phy was suspended, bring the physical link up again */
-        if (do_resume)
-                phy_resume(phydev);
-
         phy_trigger_machine(phydev, true);
 }
 EXPORT_SYMBOL(phy_start);
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index 67f25ac29025..b15b31ca2618 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -135,7 +135,9 @@ static int mdio_bus_phy_resume(struct device *dev)
         if (!mdio_bus_phy_may_suspend(phydev))
                 goto no_resume;
 
+        mutex_lock(&phydev->lock);
         ret = phy_resume(phydev);
+        mutex_unlock(&phydev->lock);
         if (ret < 0)
                 return ret;
 
@@ -1026,7 +1028,9 @@ int phy_attach_direct(struct net_device *dev, struct phy_device *phydev,
         if (err)
                 goto error;
 
+        mutex_lock(&phydev->lock);
         phy_resume(phydev);
+        mutex_unlock(&phydev->lock);
         phy_led_triggers_register(phydev);
 
         return err;
@@ -1157,6 +1161,8 @@ int phy_resume(struct phy_device *phydev)
         struct phy_driver *phydrv = to_phy_driver(phydev->mdio.dev.driver);
         int ret = 0;
 
+        WARN_ON(!mutex_is_locked(&phydev->lock));
+
         if (phydev->drv && phydrv->resume)
                 ret = phydrv->resume(phydev);
 
@@ -1639,13 +1645,9 @@ int genphy_resume(struct phy_device *phydev)
 {
         int value;
 
-        mutex_lock(&phydev->lock);
-
         value = phy_read(phydev, MII_BMCR);
         phy_write(phydev, MII_BMCR, value & ~BMCR_PDOWN);
 
-        mutex_unlock(&phydev->lock);
-
         return 0;
 }
 EXPORT_SYMBOL(genphy_resume);
diff --git a/drivers/net/phy/phylink.c b/drivers/net/phy/phylink.c
index 5dc9668dde34..827f3f92560e 100644
--- a/drivers/net/phy/phylink.c
+++ b/drivers/net/phy/phylink.c
@@ -526,6 +526,7 @@ struct phylink *phylink_create(struct net_device *ndev, struct device_node *np,
         pl->link_config.pause = MLO_PAUSE_AN;
         pl->link_config.speed = SPEED_UNKNOWN;
         pl->link_config.duplex = DUPLEX_UNKNOWN;
+        pl->link_config.an_enabled = true;
         pl->ops = ops;
         __set_bit(PHYLINK_DISABLE_STOPPED, &pl->phylink_disable_state);
 
@@ -951,6 +952,7 @@ int phylink_ethtool_ksettings_set(struct phylink *pl,
         mutex_lock(&pl->state_mutex);
         /* Configure the MAC to match the new settings */
         linkmode_copy(pl->link_config.advertising, our_kset.link_modes.advertising);
+        pl->link_config.interface = config.interface;
         pl->link_config.speed = our_kset.base.speed;
         pl->link_config.duplex = our_kset.base.duplex;
         pl->link_config.an_enabled = our_kset.base.autoneg != AUTONEG_DISABLE;
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 304ec6555cd8..3000ddd1c7e2 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -1204,12 +1204,14 @@ static const struct usb_device_id products[] = {
         {QMI_FIXED_INTF(0x1199, 0x9079, 10)},   /* Sierra Wireless EM74xx */
         {QMI_FIXED_INTF(0x1199, 0x907b, 8)},    /* Sierra Wireless EM74xx */
         {QMI_FIXED_INTF(0x1199, 0x907b, 10)},   /* Sierra Wireless EM74xx */
+        {QMI_FIXED_INTF(0x1199, 0x9091, 8)},    /* Sierra Wireless EM7565 */
         {QMI_FIXED_INTF(0x1bbb, 0x011e, 4)},    /* Telekom Speedstick LTE II (Alcatel One Touch L100V LTE) */
         {QMI_FIXED_INTF(0x1bbb, 0x0203, 2)},    /* Alcatel L800MA */
         {QMI_FIXED_INTF(0x2357, 0x0201, 4)},    /* TP-LINK HSUPA Modem MA180 */
         {QMI_FIXED_INTF(0x2357, 0x9000, 4)},    /* TP-LINK MA260 */
         {QMI_QUIRK_SET_DTR(0x1bc7, 0x1040, 2)}, /* Telit LE922A */
         {QMI_FIXED_INTF(0x1bc7, 0x1100, 3)},    /* Telit ME910 */
+        {QMI_FIXED_INTF(0x1bc7, 0x1101, 3)},    /* Telit ME910 dual modem */
         {QMI_FIXED_INTF(0x1bc7, 0x1200, 5)},    /* Telit LE920 */
         {QMI_QUIRK_SET_DTR(0x1bc7, 0x1201, 2)}, /* Telit LE920, LE920A4 */
         {QMI_FIXED_INTF(0x1c9e, 0x9801, 3)},    /* Telewell TW-3G HSPA+ */
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index 19b9cc51079e..31f4b7911ef8 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -2155,6 +2155,13 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
                 }
 
                 ndst = &rt->dst;
+                if (skb_dst(skb)) {
+                        int mtu = dst_mtu(ndst) - VXLAN_HEADROOM;
+
+                        skb_dst(skb)->ops->update_pmtu(skb_dst(skb), NULL,
+                                                       skb, mtu);
+                }
+
                 tos = ip_tunnel_ecn_encap(tos, old_iph, skb);
                 ttl = ttl ? : ip4_dst_hoplimit(&rt->dst);
                 err = vxlan_build_skb(skb, ndst, sizeof(struct iphdr),
@@ -2190,6 +2197,13 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
                                 goto out_unlock;
                 }
 
+                if (skb_dst(skb)) {
+                        int mtu = dst_mtu(ndst) - VXLAN6_HEADROOM;
+
+                        skb_dst(skb)->ops->update_pmtu(skb_dst(skb), NULL,
+                                                       skb, mtu);
+                }
+
                 tos = ip_tunnel_ecn_encap(tos, old_iph, skb);
                 ttl = ttl ? : ip6_dst_hoplimit(ndst);
                 skb_scrub_packet(skb, xnet);
@@ -3103,6 +3117,11 @@ static void vxlan_config_apply(struct net_device *dev,
 
                 max_mtu = lowerdev->mtu - (use_ipv6 ? VXLAN6_HEADROOM :
                                            VXLAN_HEADROOM);
+                if (max_mtu < ETH_MIN_MTU)
+                        max_mtu = ETH_MIN_MTU;
+
+                if (!changelink && !conf->mtu)
+                        dev->mtu = max_mtu;
         }
 
         if (dev->mtu > max_mtu)
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index 10b075a46b26..e8189c07b41f 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -684,6 +684,7 @@ static void hwsim_send_nullfunc(struct mac80211_hwsim_data *data, u8 *mac,
         hdr = skb_put(skb, sizeof(*hdr) - ETH_ALEN);
         hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_DATA |
                                          IEEE80211_STYPE_NULLFUNC |
+                                         IEEE80211_FCTL_TODS |
                                          (ps ? IEEE80211_FCTL_PM : 0));
         hdr->duration_id = cpu_to_le16(0);
         memcpy(hdr->addr1, vp->bssid, ETH_ALEN);
@@ -3215,7 +3216,7 @@ static int hwsim_get_radio_nl(struct sk_buff *msg, struct genl_info *info)
                 if (!net_eq(wiphy_net(data->hw->wiphy), genl_info_net(info)))
                         continue;
 
-                skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
+                skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
                 if (!skb) {
                         res = -ENOMEM;
                         goto out_err;
diff --git a/drivers/nvdimm/btt.c b/drivers/nvdimm/btt.c
index e949e3302af4..c586bcdb5190 100644
--- a/drivers/nvdimm/btt.c
+++ b/drivers/nvdimm/btt.c
@@ -211,12 +211,12 @@ static int btt_map_read(struct arena_info *arena, u32 lba, u32 *mapping,
         return ret;
 }
 
-static int btt_log_read_pair(struct arena_info *arena, u32 lane,
-                        struct log_entry *ent)
+static int btt_log_group_read(struct arena_info *arena, u32 lane,
+                        struct log_group *log)
 {
         return arena_read_bytes(arena,
-                        arena->logoff + (2 * lane * LOG_ENT_SIZE), ent,
-                        2 * LOG_ENT_SIZE, 0);
+                        arena->logoff + (lane * LOG_GRP_SIZE), log,
+                        LOG_GRP_SIZE, 0);
 }
 
 static struct dentry *debugfs_root;
@@ -256,6 +256,8 @@ static void arena_debugfs_init(struct arena_info *a, struct dentry *parent,
         debugfs_create_x64("logoff", S_IRUGO, d, &a->logoff);
         debugfs_create_x64("info2off", S_IRUGO, d, &a->info2off);
         debugfs_create_x32("flags", S_IRUGO, d, &a->flags);
+        debugfs_create_u32("log_index_0", S_IRUGO, d, &a->log_index[0]);
+        debugfs_create_u32("log_index_1", S_IRUGO, d, &a->log_index[1]);
 }
 
 static void btt_debugfs_init(struct btt *btt)
@@ -274,6 +276,11 @@ static void btt_debugfs_init(struct btt *btt)
         }
 }
 
+static u32 log_seq(struct log_group *log, int log_idx)
+{
+        return le32_to_cpu(log->ent[log_idx].seq);
+}
+
 /*
  * This function accepts two log entries, and uses the
  * sequence number to find the 'older' entry.
@@ -283,8 +290,10 @@ static void btt_debugfs_init(struct btt *btt)
  *
  * TODO The logic feels a bit kludge-y. make it better..
  */
-static int btt_log_get_old(struct log_entry *ent)
+static int btt_log_get_old(struct arena_info *a, struct log_group *log)
 {
+        int idx0 = a->log_index[0];
+        int idx1 = a->log_index[1];
         int old;
 
         /*
@@ -292,23 +301,23 @@ static int btt_log_get_old(struct log_entry *ent)
          * the next time, the following logic works out to put this
          * (next) entry into [1]
          */
-        if (ent[0].seq == 0) {
-                ent[0].seq = cpu_to_le32(1);
+        if (log_seq(log, idx0) == 0) {
+                log->ent[idx0].seq = cpu_to_le32(1);
                 return 0;
         }
 
-        if (ent[0].seq == ent[1].seq)
+        if (log_seq(log, idx0) == log_seq(log, idx1))
                 return -EINVAL;
-        if (le32_to_cpu(ent[0].seq) + le32_to_cpu(ent[1].seq) > 5)
+        if (log_seq(log, idx0) + log_seq(log, idx1) > 5)
                 return -EINVAL;
 
-        if (le32_to_cpu(ent[0].seq) < le32_to_cpu(ent[1].seq)) {
-                if (le32_to_cpu(ent[1].seq) - le32_to_cpu(ent[0].seq) == 1)
+        if (log_seq(log, idx0) < log_seq(log, idx1)) {
+                if ((log_seq(log, idx1) - log_seq(log, idx0)) == 1)
                         old = 0;
                 else
                         old = 1;
         } else {
-                if (le32_to_cpu(ent[0].seq) - le32_to_cpu(ent[1].seq) == 1)
+                if ((log_seq(log, idx0) - log_seq(log, idx1)) == 1)
                         old = 1;
                 else
                         old = 0;
@@ -328,17 +337,18 @@ static int btt_log_read(struct arena_info *arena, u32 lane,
 {
         int ret;
         int old_ent, ret_ent;
-        struct log_entry log[2];
+        struct log_group log;
 
-        ret = btt_log_read_pair(arena, lane, log);
+        ret = btt_log_group_read(arena, lane, &log);
         if (ret)
                 return -EIO;
 
-        old_ent = btt_log_get_old(log);
+        old_ent = btt_log_get_old(arena, &log);
         if (old_ent < 0 || old_ent > 1) {
                 dev_err(to_dev(arena),
                                 "log corruption (%d): lane %d seq [%d, %d]\n",
-                        old_ent, lane, log[0].seq, log[1].seq);
+                                old_ent, lane, log.ent[arena->log_index[0]].seq,
+                                log.ent[arena->log_index[1]].seq);
                 /* TODO set error state? */
                 return -EIO;
         }
@@ -346,7 +356,7 @@ static int btt_log_read(struct arena_info *arena, u32 lane,
         ret_ent = (old_flag ? old_ent : (1 - old_ent));
 
         if (ent != NULL)
-                memcpy(ent, &log[ret_ent], LOG_ENT_SIZE);
+                memcpy(ent, &log.ent[arena->log_index[ret_ent]], LOG_ENT_SIZE);
 
         return ret_ent;
 }
@@ -360,17 +370,13 @@ static int __btt_log_write(struct arena_info *arena, u32 lane,
                         u32 sub, struct log_entry *ent, unsigned long flags)
 {
         int ret;
-        /*
-         * Ignore the padding in log_entry for calculating log_half.
-         * The entry is 'committed' when we write the sequence number,
-         * and we want to ensure that that is the last thing written.
-         * We don't bother writing the padding as that would be extra
-         * media wear and write amplification
-         */
-        unsigned int log_half = (LOG_ENT_SIZE - 2 * sizeof(u64)) / 2;
-        u64 ns_off = arena->logoff + (((2 * lane) + sub) * LOG_ENT_SIZE);
+        u32 group_slot = arena->log_index[sub];
+        unsigned int log_half = LOG_ENT_SIZE / 2;
         void *src = ent;
+        u64 ns_off;
 
+        ns_off = arena->logoff + (lane * LOG_GRP_SIZE) +
+                (group_slot * LOG_ENT_SIZE);
         /* split the 16B write into atomic, durable halves */
         ret = arena_write_bytes(arena, ns_off, src, log_half, flags);
         if (ret)
@@ -453,7 +459,7 @@ static int btt_log_init(struct arena_info *arena)
 {
         size_t logsize = arena->info2off - arena->logoff;
         size_t chunk_size = SZ_4K, offset = 0;
-        struct log_entry log;
+        struct log_entry ent;
         void *zerobuf;
         int ret;
         u32 i;
@@ -485,11 +491,11 @@ static int btt_log_init(struct arena_info *arena)
         }
 
         for (i = 0; i < arena->nfree; i++) {
-                log.lba = cpu_to_le32(i);
-                log.old_map = cpu_to_le32(arena->external_nlba + i);
-                log.new_map = cpu_to_le32(arena->external_nlba + i);
-                log.seq = cpu_to_le32(LOG_SEQ_INIT);
-                ret = __btt_log_write(arena, i, 0, &log, 0);
+                ent.lba = cpu_to_le32(i);
+                ent.old_map = cpu_to_le32(arena->external_nlba + i);
+                ent.new_map = cpu_to_le32(arena->external_nlba + i);
+                ent.seq = cpu_to_le32(LOG_SEQ_INIT);
+                ret = __btt_log_write(arena, i, 0, &ent, 0);
                 if (ret)
                         goto free;
         }
@@ -594,6 +600,123 @@ static int btt_freelist_init(struct arena_info *arena)
         return 0;
 }
 
+static bool ent_is_padding(struct log_entry *ent)
+{
+        return (ent->lba == 0) && (ent->old_map == 0) && (ent->new_map == 0)
+                && (ent->seq == 0);
+}
+
+/*
+ * Detecting valid log indices: We read a log group (see the comments in btt.h
+ * for a description of a 'log_group' and its 'slots'), and iterate over its
+ * four slots. We expect that a padding slot will be all-zeroes, and use this
+ * to detect a padding slot vs. an actual entry.
+ *
+ * If a log_group is in the initial state, i.e. hasn't been used since the
+ * creation of this BTT layout, it will have three of the four slots with
+ * zeroes. We skip over these log_groups for the detection of log_index. If
+ * all log_groups are in the initial state (i.e. the BTT has never been
+ * written to), it is safe to assume the 'new format' of log entries in slots
+ * (0, 1).
+ */
+static int log_set_indices(struct arena_info *arena)
+{
+        bool idx_set = false, initial_state = true;
+        int ret, log_index[2] = {-1, -1};
+        u32 i, j, next_idx = 0;
+        struct log_group log;
+        u32 pad_count = 0;
+
+        for (i = 0; i < arena->nfree; i++) {
+                ret = btt_log_group_read(arena, i, &log);
+                if (ret < 0)
+                        return ret;
+
+                for (j = 0; j < 4; j++) {
+                        if (!idx_set) {
+                                if (ent_is_padding(&log.ent[j])) {
+                                        pad_count++;
+                                        continue;
+                                } else {
+                                        /* Skip if index has been recorded */
+                                        if ((next_idx == 1) &&
+                                                (j == log_index[0]))
+                                                continue;
+                                        /* valid entry, record index */
+                                        log_index[next_idx] = j;
+                                        next_idx++;
+                                }
+                                if (next_idx == 2) {
+                                        /* two valid entries found */
+                                        idx_set = true;
+                                } else if (next_idx > 2) {
+                                        /* too many valid indices */
+                                        return -ENXIO;
+                                }
+                        } else {
+                                /*
+                                 * once the indices have been set, just verify
+                                 * that all subsequent log groups are either in
+                                 * their initial state or follow the same
+                                 * indices.
+                                 */
+                                if (j == log_index[0]) {
+                                        /* entry must be 'valid' */
+                                        if (ent_is_padding(&log.ent[j]))
+                                                return -ENXIO;
+                                } else if (j == log_index[1]) {
+                                        ;
+                                        /*
+                                         * log_index[1] can be padding if the
+                                         * lane never got used and it is still
+                                         * in the initial state (three 'padding'
+                                         * entries)
+                                         */
+                                } else {
+                                        /* entry must be invalid (padding) */
+                                        if (!ent_is_padding(&log.ent[j]))
+                                                return -ENXIO;
+                                }
+                        }
+                }
+                /*
+                 * If any of the log_groups have more than one valid,
+                 * non-padding entry, then the we are no longer in the
+                 * initial_state
+                 */
+                if (pad_count < 3)
+                        initial_state = false;
+                pad_count = 0;
+        }
+
+        if (!initial_state && !idx_set)
+                return -ENXIO;
+
+        /*
+         * If all the entries in the log were in the initial state,
+         * assume new padding scheme
+         */
+        if (initial_state)
+                log_index[1] = 1;
+
+        /*
+         * Only allow the known permutations of log/padding indices,
+         * i.e. (0, 1), and (0, 2)
+         */
+        if ((log_index[0] == 0) && ((log_index[1] == 1) || (log_index[1] == 2)))
+                ; /* known index possibilities */
+        else {
+                dev_err(to_dev(arena), "Found an unknown padding scheme\n");
+                return -ENXIO;
+        }
+
+        arena->log_index[0] = log_index[0];
+        arena->log_index[1] = log_index[1];
+        dev_dbg(to_dev(arena), "log_index_0 = %d\n", log_index[0]);
+        dev_dbg(to_dev(arena), "log_index_1 = %d\n", log_index[1]);
+        return 0;
+}
+
 static int btt_rtt_init(struct arena_info *arena)
 {
         arena->rtt = kcalloc(arena->nfree, sizeof(u32), GFP_KERNEL);
@@ -650,8 +773,7 @@ static struct arena_info *alloc_arena(struct btt *btt, size_t size,
         available -= 2 * BTT_PG_SIZE;
 
         /* The log takes a fixed amount of space based on nfree */
-        logsize = roundup(2 * arena->nfree * sizeof(struct log_entry),
-                                BTT_PG_SIZE);
+        logsize = roundup(arena->nfree * LOG_GRP_SIZE, BTT_PG_SIZE);
         available -= logsize;
 
         /* Calculate optimal split between map and data area */
@@ -668,6 +790,10 @@ static struct arena_info *alloc_arena(struct btt *btt, size_t size,
         arena->mapoff = arena->dataoff + datasize;
         arena->logoff = arena->mapoff + mapsize;
         arena->info2off = arena->logoff + logsize;
+
+        /* Default log indices are (0,1) */
+        arena->log_index[0] = 0;
+        arena->log_index[1] = 1;
         return arena;
 }
 
@@ -758,6 +884,13 @@ static int discover_arenas(struct btt *btt)
                 arena->external_lba_start = cur_nlba;
                 parse_arena_meta(arena, super, cur_off);
 
+                ret = log_set_indices(arena);
+                if (ret) {
+                        dev_err(to_dev(arena),
+                                "Unable to deduce log/padding indices\n");
+                        goto out;
+                }
+
                 mutex_init(&arena->err_lock);
                 ret = btt_freelist_init(arena);
                 if (ret)
diff --git a/drivers/nvdimm/btt.h b/drivers/nvdimm/btt.h
index 578c2057524d..db3cb6d4d0d4 100644
--- a/drivers/nvdimm/btt.h
+++ b/drivers/nvdimm/btt.h
@@ -27,6 +27,7 @@
 #define MAP_ERR_MASK (1 << MAP_ERR_SHIFT)
 #define MAP_LBA_MASK (~((1 << MAP_TRIM_SHIFT) | (1 << MAP_ERR_SHIFT)))
 #define MAP_ENT_NORMAL 0xC0000000
+#define LOG_GRP_SIZE sizeof(struct log_group)
 #define LOG_ENT_SIZE sizeof(struct log_entry)
 #define ARENA_MIN_SIZE (1UL << 24)      /* 16 MB */
 #define ARENA_MAX_SIZE (1ULL << 39)     /* 512 GB */
@@ -50,12 +51,52 @@ enum btt_init_state {
         INIT_READY
 };
 
+/*
+ * A log group represents one log 'lane', and consists of four log entries.
+ * Two of the four entries are valid entries, and the remaining two are
+ * padding. Due to an old bug in the padding location, we need to perform a
+ * test to determine the padding scheme being used, and use that scheme
+ * thereafter.
+ *
+ * In kernels prior to 4.15, 'log group' would have actual log entries at
+ * indices (0, 2) and padding at indices (1, 3), where as the correct/updated
+ * format has log entries at indices (0, 1) and padding at indices (2, 3).
+ *
+ * Old (pre 4.15) format:
+ * +-----------------+-----------------+
+ * |      ent[0]     |      ent[1]     |
+ * |       16B       |       16B       |
+ * | lba/old/new/seq |       pad       |
+ * +-----------------------------------+
+ * |      ent[2]     |      ent[3]     |
+ * |       16B       |       16B       |
+ * | lba/old/new/seq |       pad       |
+ * +-----------------+-----------------+
+ *
+ * New format:
+ * +-----------------+-----------------+
+ * |      ent[0]     |      ent[1]     |
+ * |       16B       |       16B       |
+ * | lba/old/new/seq | lba/old/new/seq |
+ * +-----------------------------------+
+ * |      ent[2]     |      ent[3]     |
+ * |       16B       |       16B       |
+ * |       pad       |       pad       |
+ * +-----------------+-----------------+
+ *
+ * We detect during start-up which format is in use, and set
+ * arena->log_index[(0, 1)] with the detected format.
+ */
+
 struct log_entry {
         __le32 lba;
         __le32 old_map;
         __le32 new_map;
         __le32 seq;
-        __le64 padding[2];
+};
+
+struct log_group {
+        struct log_entry ent[4];
 };
 
 struct btt_sb {
@@ -125,6 +166,8 @@ struct aligned_lock {
  * @list:               List head for list of arenas
  * @debugfs_dir:        Debugfs dentry
  * @flags:              Arena flags - may signify error states.
+ * @err_lock:           Mutex for synchronizing error clearing.
+ * @log_index:          Indices of the valid log entries in a log_group
  *
  * arena_info is a per-arena handle. Once an arena is narrowed down for an
  * IO, this struct is passed around for the duration of the IO.
@@ -157,6 +200,7 @@ struct arena_info {
         /* Arena flags */
         u32 flags;
         struct mutex err_lock;
+        int log_index[2];
 };
 
 /**
@@ -176,6 +220,7 @@ struct arena_info {
  * @init_lock:          Mutex used for the BTT initialization
  * @init_state:         Flag describing the initialization state for the BTT
  * @num_arenas:         Number of arenas in the BTT instance
+ * @phys_bb:            Pointer to the namespace's badblocks structure
  */
 struct btt {
         struct gendisk *btt_disk;
diff --git a/drivers/nvdimm/pfn_devs.c b/drivers/nvdimm/pfn_devs.c
index 65cc171c721d..2adada1a5855 100644
--- a/drivers/nvdimm/pfn_devs.c
+++ b/drivers/nvdimm/pfn_devs.c
@@ -364,9 +364,9 @@ struct device *nd_pfn_create(struct nd_region *nd_region)
 int nd_pfn_validate(struct nd_pfn *nd_pfn, const char *sig)
 {
         u64 checksum, offset;
-        unsigned long align;
         enum nd_pfn_mode mode;
         struct nd_namespace_io *nsio;
+        unsigned long align, start_pad;
         struct nd_pfn_sb *pfn_sb = nd_pfn->pfn_sb;
         struct nd_namespace_common *ndns = nd_pfn->ndns;
         const u8 *parent_uuid = nd_dev_to_uuid(&ndns->dev);
@@ -410,6 +410,7 @@ int nd_pfn_validate(struct nd_pfn *nd_pfn, const char *sig)
 
         align = le32_to_cpu(pfn_sb->align);
         offset = le64_to_cpu(pfn_sb->dataoff);
+        start_pad = le32_to_cpu(pfn_sb->start_pad);
         if (align == 0)
                 align = 1UL << ilog2(offset);
         mode = le32_to_cpu(pfn_sb->mode);
@@ -468,7 +469,7 @@ int nd_pfn_validate(struct nd_pfn *nd_pfn, const char *sig)
                 return -EBUSY;
         }
 
-        if ((align && !IS_ALIGNED(offset, align))
+        if ((align && !IS_ALIGNED(nsio->res.start + offset + start_pad, align))
                         || !IS_ALIGNED(offset, PAGE_SIZE)) {
                 dev_err(&nd_pfn->dev,
                                 "bad offset: %#llx dax disabled align: %#lx\n",
@@ -582,6 +583,12 @@ static struct vmem_altmap *__nvdimm_setup_pfn(struct nd_pfn *nd_pfn,
         return altmap;
 }
 
+static u64 phys_pmem_align_down(struct nd_pfn *nd_pfn, u64 phys)
+{
+        return min_t(u64, PHYS_SECTION_ALIGN_DOWN(phys),
+                        ALIGN_DOWN(phys, nd_pfn->align));
+}
+
 static int nd_pfn_init(struct nd_pfn *nd_pfn)
 {
         u32 dax_label_reserve = is_nd_dax(&nd_pfn->dev) ? SZ_128K : 0;
@@ -637,13 +644,16 @@ static int nd_pfn_init(struct nd_pfn *nd_pfn)
         start = nsio->res.start;
         size = PHYS_SECTION_ALIGN_UP(start + size) - start;
         if (region_intersects(start, size, IORESOURCE_SYSTEM_RAM,
-                                IORES_DESC_NONE) == REGION_MIXED) {
+                                IORES_DESC_NONE) == REGION_MIXED
+                        || !IS_ALIGNED(start + resource_size(&nsio->res),
+                                nd_pfn->align)) {
                 size = resource_size(&nsio->res);
-                end_trunc = start + size - PHYS_SECTION_ALIGN_DOWN(start + size);
+                end_trunc = start + size - phys_pmem_align_down(nd_pfn,
+                                start + size);
         }
 
         if (start_pad + end_trunc)
-                dev_info(&nd_pfn->dev, "%s section collision, truncate %d bytes\n",
+                dev_info(&nd_pfn->dev, "%s alignment collision, truncate %d bytes\n",
                                 dev_name(&ndns->dev), start_pad + end_trunc);
 
         /*
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index f837d666cbd4..1e46e60b8f10 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -1287,7 +1287,7 @@ static void nvme_config_discard(struct nvme_ctrl *ctrl,
         BUILD_BUG_ON(PAGE_SIZE / sizeof(struct nvme_dsm_range) <
                         NVME_DSM_MAX_RANGES);
 
-        queue->limits.discard_alignment = size;
+        queue->limits.discard_alignment = 0;
         queue->limits.discard_granularity = size;
 
         blk_queue_max_discard_sectors(queue, UINT_MAX);
@@ -1705,7 +1705,8 @@ static void nvme_set_queue_limits(struct nvme_ctrl *ctrl,
                 blk_queue_max_hw_sectors(q, ctrl->max_hw_sectors);
                 blk_queue_max_segments(q, min_t(u32, max_segments, USHRT_MAX));
         }
-        if (ctrl->quirks & NVME_QUIRK_STRIPE_SIZE)
+        if ((ctrl->quirks & NVME_QUIRK_STRIPE_SIZE) &&
+            is_power_of_2(ctrl->max_hw_sectors))
                 blk_queue_chunk_sectors(q, ctrl->max_hw_sectors);
         blk_queue_virt_boundary(q, ctrl->page_size - 1);
         if (ctrl->vwc & NVME_CTRL_VWC_PRESENT)
@@ -2869,7 +2870,6 @@ static void nvme_alloc_ns(struct nvme_ctrl *ctrl, unsigned nsid)
 
         blk_queue_logical_block_size(ns->queue, 1 << ns->lba_shift);
         nvme_set_queue_limits(ctrl, ns->queue);
-        nvme_setup_streams_ns(ctrl, ns);
 
         id = nvme_identify_ns(ctrl, nsid);
         if (!id)
@@ -2880,6 +2880,7 @@ static void nvme_alloc_ns(struct nvme_ctrl *ctrl, unsigned nsid)
 
         if (nvme_init_ns_head(ns, nsid, id, &new))
                 goto out_free_id;
+        nvme_setup_streams_ns(ctrl, ns);
         
 #ifdef CONFIG_NVME_MULTIPATH
         /*
@@ -2965,8 +2966,6 @@ static void nvme_ns_remove(struct nvme_ns *ns)
                 return;
 
         if (ns->disk && ns->disk->flags & GENHD_FL_UP) {
-                if (blk_get_integrity(ns->disk))
-                        blk_integrity_unregister(ns->disk);
                 nvme_mpath_remove_disk_links(ns);
                 sysfs_remove_group(&disk_to_dev(ns->disk)->kobj,
                                         &nvme_ns_id_attr_group);
@@ -2974,6 +2973,8 @@ static void nvme_ns_remove(struct nvme_ns *ns)
                         nvme_nvm_unregister_sysfs(ns);
                 del_gendisk(ns->disk);
                 blk_cleanup_queue(ns->queue);
+                if (blk_get_integrity(ns->disk))
+                        blk_integrity_unregister(ns->disk);
         }
 
         mutex_lock(&ns->ctrl->subsys->lock);
diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
index 0a8af4daef89..794e66e4aa20 100644
--- a/drivers/nvme/host/fc.c
+++ b/drivers/nvme/host/fc.c
@@ -3221,7 +3221,6 @@ nvme_fc_init_ctrl(struct device *dev, struct nvmf_ctrl_options *opts,
 
                 /* initiate nvme ctrl ref counting teardown */
                 nvme_uninit_ctrl(&ctrl->ctrl);
-                nvme_put_ctrl(&ctrl->ctrl);
 
                 /* Remove core ctrl ref. */
                 nvme_put_ctrl(&ctrl->ctrl);
diff --git a/drivers/nvmem/meson-mx-efuse.c b/drivers/nvmem/meson-mx-efuse.c
index a346b4923550..41d3a3c1104e 100644
--- a/drivers/nvmem/meson-mx-efuse.c
+++ b/drivers/nvmem/meson-mx-efuse.c
@@ -156,8 +156,8 @@ static int meson_mx_efuse_read(void *context, unsigned int offset,
                                  MESON_MX_EFUSE_CNTL1_AUTO_RD_ENABLE,
                                  MESON_MX_EFUSE_CNTL1_AUTO_RD_ENABLE);
 
-        for (i = offset; i < offset + bytes; i += efuse->config.word_size) {
-                addr = i / efuse->config.word_size;
+        for (i = 0; i < bytes; i += efuse->config.word_size) {
+                addr = (offset + i) / efuse->config.word_size;
 
                 err = meson_mx_efuse_read_addr(efuse, addr, &tmp);
                 if (err)
diff --git a/drivers/of/of_mdio.c b/drivers/of/of_mdio.c
index 98258583abb0..3481e69738b5 100644
--- a/drivers/of/of_mdio.c
+++ b/drivers/of/of_mdio.c
@@ -81,6 +81,7 @@ static int of_mdiobus_register_phy(struct mii_bus *mdio,
          * can be looked up later */
         of_node_get(child);
         phy->mdio.dev.of_node = child;
+        phy->mdio.dev.fwnode = of_fwnode_handle(child);
 
         /* All data is now stored in the phy struct;
          * register it */
@@ -111,6 +112,7 @@ static int of_mdiobus_register_device(struct mii_bus *mdio,
          */
         of_node_get(child);
         mdiodev->dev.of_node = child;
+        mdiodev->dev.fwnode = of_fwnode_handle(child);
 
         /* All data is now stored in the mdiodev struct; register it. */
         rc = mdio_device_register(mdiodev);
@@ -206,6 +208,7 @@ int of_mdiobus_register(struct mii_bus *mdio, struct device_node *np)
         mdio->phy_mask = ~0;
 
         mdio->dev.of_node = np;
+        mdio->dev.fwnode = of_fwnode_handle(np);
 
         /* Get bus level PHY reset GPIO details */
         mdio->reset_delay_us = DEFAULT_GPIO_RESET_DELAY;
diff --git a/drivers/parisc/lba_pci.c b/drivers/parisc/lba_pci.c
index a25fed52f7e9..41b740aed3a3 100644
--- a/drivers/parisc/lba_pci.c
+++ b/drivers/parisc/lba_pci.c
@@ -1692,3 +1692,36 @@ void lba_set_iregs(struct parisc_device *lba, u32 ibase, u32 imask)
         iounmap(base_addr);
 }
 
+
+/*
+ * The design of the Diva management card in rp34x0 machines (rp3410, rp3440)
+ * seems rushed, so that many built-in components simply don't work.
+ * The following quirks disable the serial AUX port and the built-in ATI RV100
+ * Radeon 7000 graphics card which both don't have any external connectors and
+ * thus are useless, and even worse, e.g. the AUX port occupies ttyS0 and as
+ * such makes those machines the only PARISC machines on which we can't use
+ * ttyS0 as boot console.
+ */
+static void quirk_diva_ati_card(struct pci_dev *dev)
+{
+        if (dev->subsystem_vendor != PCI_VENDOR_ID_HP ||
+            dev->subsystem_device != 0x1292)
+                return;
+
+        dev_info(&dev->dev, "Hiding Diva built-in ATI card");
+        dev->device = 0;
+}
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_RADEON_QY,
+        quirk_diva_ati_card);
+
+static void quirk_diva_aux_disable(struct pci_dev *dev)
+{
+        if (dev->subsystem_vendor != PCI_VENDOR_ID_HP ||
+            dev->subsystem_device != 0x1291)
+                return;
+
+        dev_info(&dev->dev, "Hiding Diva built-in AUX serial device");
+        dev->device = 0;
+}
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_DIVA_AUX,
+        quirk_diva_aux_disable);
diff --git a/drivers/pci/host/pci-hyperv.c b/drivers/pci/host/pci-hyperv.c
index 04dac6a42c9f..6b8d060d07de 100644
--- a/drivers/pci/host/pci-hyperv.c
+++ b/drivers/pci/host/pci-hyperv.c
@@ -985,9 +985,7 @@ static u32 hv_compose_msi_req_v1(
         int_pkt->wslot.slot = slot;
         int_pkt->int_desc.vector = vector;
         int_pkt->int_desc.vector_count = 1;
-        int_pkt->int_desc.delivery_mode =
-                (apic->irq_delivery_mode == dest_LowestPrio) ?
-                        dest_LowestPrio : dest_Fixed;
+        int_pkt->int_desc.delivery_mode = dest_Fixed;
 
         /*
          * Create MSI w/ dummy vCPU set, overwritten by subsequent retarget in
@@ -1008,9 +1006,7 @@ static u32 hv_compose_msi_req_v2(
         int_pkt->wslot.slot = slot;
         int_pkt->int_desc.vector = vector;
         int_pkt->int_desc.vector_count = 1;
-        int_pkt->int_desc.delivery_mode =
-                (apic->irq_delivery_mode == dest_LowestPrio) ?
-                        dest_LowestPrio : dest_Fixed;
+        int_pkt->int_desc.delivery_mode = dest_Fixed;
 
         /*
          * Create MSI w/ dummy vCPU set targeting just one vCPU, overwritten
diff --git a/drivers/pci/host/pcie-rcar.c b/drivers/pci/host/pcie-rcar.c
index 12796eccb2be..52ab3cb0a0bf 100644
--- a/drivers/pci/host/pcie-rcar.c
+++ b/drivers/pci/host/pcie-rcar.c
@@ -1128,12 +1128,12 @@ static int rcar_pcie_probe(struct platform_device *pdev)
         err = rcar_pcie_get_resources(pcie);
         if (err < 0) {
                 dev_err(dev, "failed to request resources: %d\n", err);
-                goto err_free_bridge;
+                goto err_free_resource_list;
         }
 
         err = rcar_pcie_parse_map_dma_ranges(pcie, dev->of_node);
         if (err)
-                goto err_free_bridge;
+                goto err_free_resource_list;
 
         pm_runtime_enable(dev);
         err = pm_runtime_get_sync(dev);
@@ -1176,9 +1176,9 @@ err_pm_put:
 err_pm_disable:
         pm_runtime_disable(dev);
 
-err_free_bridge:
-        pci_free_host_bridge(bridge);
+err_free_resource_list:
         pci_free_resource_list(&pcie->resources);
+        pci_free_host_bridge(bridge);
 
         return err;
 }
diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c
index 7f47bb72bf30..14fd865a5120 100644
--- a/drivers/pci/pci-driver.c
+++ b/drivers/pci/pci-driver.c
@@ -999,7 +999,7 @@ static int pci_pm_thaw_noirq(struct device *dev)
          * the subsequent "thaw" callbacks for the device.
          */
         if (dev_pm_smart_suspend_and_suspended(dev)) {
-                dev->power.direct_complete = true;
+                dev_pm_skip_next_resume_phases(dev);
                 return 0;
         }
 
@@ -1012,7 +1012,12 @@ static int pci_pm_thaw_noirq(struct device *dev)
         if (pci_has_legacy_pm_support(pci_dev))
                 return pci_legacy_resume_early(dev);
 
-        pci_update_current_state(pci_dev, PCI_D0);
+        /*
+         * pci_restore_state() requires the device to be in D0 (because of MSI
+         * restoration among other things), so force it into D0 in case the
+         * driver's "freeze" callbacks put it into a low-power state directly.
+         */
+        pci_set_power_state(pci_dev, PCI_D0);
         pci_restore_state(pci_dev);
 
         if (drv && drv->pm && drv->pm->thaw_noirq)
diff --git a/drivers/phy/motorola/phy-cpcap-usb.c b/drivers/phy/motorola/phy-cpcap-usb.c
index accaaaccb662..6601ad0dfb3a 100644
--- a/drivers/phy/motorola/phy-cpcap-usb.c
+++ b/drivers/phy/motorola/phy-cpcap-usb.c
@@ -310,7 +310,7 @@ static int cpcap_usb_init_irq(struct platform_device *pdev,
         int irq, error;
 
         irq = platform_get_irq_byname(pdev, name);
-        if (!irq)
+        if (irq < 0)
                 return -ENODEV;
 
         error = devm_request_threaded_irq(ddata->dev, irq, NULL,
diff --git a/drivers/phy/renesas/Kconfig b/drivers/phy/renesas/Kconfig
index cb09245e9b4c..c845facacb06 100644
--- a/drivers/phy/renesas/Kconfig
+++ b/drivers/phy/renesas/Kconfig
@@ -12,7 +12,9 @@ config PHY_RCAR_GEN3_USB2
         tristate "Renesas R-Car generation 3 USB 2.0 PHY driver"
         depends on ARCH_RENESAS
         depends on EXTCON
+        depends on USB_SUPPORT
         select GENERIC_PHY
+        select USB_COMMON
         help
           Support for USB 2.0 PHY found on Renesas R-Car generation 3 SoCs.
 
diff --git a/drivers/phy/rockchip/phy-rockchip-typec.c b/drivers/phy/rockchip/phy-rockchip-typec.c
index ee85fa0ca4b0..7492c8978217 100644
--- a/drivers/phy/rockchip/phy-rockchip-typec.c
+++ b/drivers/phy/rockchip/phy-rockchip-typec.c
@@ -1137,6 +1137,7 @@ static int rockchip_typec_phy_probe(struct platform_device *pdev)
                 if (IS_ERR(phy)) {
                         dev_err(dev, "failed to create phy: %s\n",
                                 child_np->name);
+                        pm_runtime_disable(dev);
                         return PTR_ERR(phy);
                 }
 
@@ -1146,6 +1147,7 @@ static int rockchip_typec_phy_probe(struct platform_device *pdev)
         phy_provider = devm_of_phy_provider_register(dev, of_phy_simple_xlate);
         if (IS_ERR(phy_provider)) {
                 dev_err(dev, "Failed to register phy provider\n");
+                pm_runtime_disable(dev);
                 return PTR_ERR(phy_provider);
         }
 
diff --git a/drivers/phy/tegra/xusb.c b/drivers/phy/tegra/xusb.c
index 4307bf0013e1..63e916d4d069 100644
--- a/drivers/phy/tegra/xusb.c
+++ b/drivers/phy/tegra/xusb.c
@@ -75,14 +75,14 @@ MODULE_DEVICE_TABLE(of, tegra_xusb_padctl_of_match);
 static struct device_node *
 tegra_xusb_find_pad_node(struct tegra_xusb_padctl *padctl, const char *name)
 {
-        /*
-         * of_find_node_by_name() drops a reference, so make sure to grab one.
-         */
-        struct device_node *np = of_node_get(padctl->dev->of_node);
+        struct device_node *pads, *np;
+
+        pads = of_get_child_by_name(padctl->dev->of_node, "pads");
+        if (!pads)
+                return NULL;
 
-        np = of_find_node_by_name(np, "pads");
-        if (np)
-                np = of_find_node_by_name(np, name);
+        np = of_get_child_by_name(pads, name);
+        of_node_put(pads);
 
         return np;
 }
@@ -90,16 +90,16 @@ tegra_xusb_find_pad_node(struct tegra_xusb_padctl *padctl, const char *name)
 static struct device_node *
 tegra_xusb_pad_find_phy_node(struct tegra_xusb_pad *pad, unsigned int index)
 {
-        /*
-         * of_find_node_by_name() drops a reference, so make sure to grab one.
-         */
-        struct device_node *np = of_node_get(pad->dev.of_node);
+        struct device_node *np, *lanes;
 
-        np = of_find_node_by_name(np, "lanes");
-        if (!np)
+        lanes = of_get_child_by_name(pad->dev.of_node, "lanes");
+        if (!lanes)
                 return NULL;
 
-        return of_find_node_by_name(np, pad->soc->lanes[index].name);
+        np = of_get_child_by_name(lanes, pad->soc->lanes[index].name);
+        of_node_put(lanes);
+
+        return np;
 }
 
 static int
@@ -195,7 +195,7 @@ int tegra_xusb_pad_register(struct tegra_xusb_pad *pad,
         unsigned int i;
         int err;
 
-        children = of_find_node_by_name(pad->dev.of_node, "lanes");
+        children = of_get_child_by_name(pad->dev.of_node, "lanes");
         if (!children)
                 return -ENODEV;
 
@@ -444,21 +444,21 @@ static struct device_node *
 tegra_xusb_find_port_node(struct tegra_xusb_padctl *padctl, const char *type,
                           unsigned int index)
 {
-        /*
-         * of_find_node_by_name() drops a reference, so make sure to grab one.
-         */
-        struct device_node *np = of_node_get(padctl->dev->of_node);
+        struct device_node *ports, *np;
+        char *name;
 
-        np = of_find_node_by_name(np, "ports");
-        if (np) {
-                char *name;
+        ports = of_get_child_by_name(padctl->dev->of_node, "ports");
+        if (!ports)
+                return NULL;
 
-                name = kasprintf(GFP_KERNEL, "%s-%u", type, index);
-                if (!name)
-                        return ERR_PTR(-ENOMEM);
-                np = of_find_node_by_name(np, name);
-                kfree(name);
+        name = kasprintf(GFP_KERNEL, "%s-%u", type, index);
+        if (!name) {
+                of_node_put(ports);
+                return ERR_PTR(-ENOMEM);
         }
+        np = of_get_child_by_name(ports, name);
+        kfree(name);
+        of_node_put(ports);
 
         return np;
 }
@@ -847,7 +847,7 @@ static void tegra_xusb_remove_ports(struct tegra_xusb_padctl *padctl)
 
 static int tegra_xusb_padctl_probe(struct platform_device *pdev)
 {
-        struct device_node *np = of_node_get(pdev->dev.of_node);
+        struct device_node *np = pdev->dev.of_node;
         const struct tegra_xusb_padctl_soc *soc;
         struct tegra_xusb_padctl *padctl;
         const struct of_device_id *match;
@@ -855,7 +855,7 @@ static int tegra_xusb_padctl_probe(struct platform_device *pdev)
         int err;
 
         /* for backwards compatibility with old device trees */
-        np = of_find_node_by_name(np, "pads");
+        np = of_get_child_by_name(np, "pads");
         if (!np) {
                 dev_warn(&pdev->dev, "deprecated DT, using legacy driver\n");
                 return tegra_xusb_padctl_legacy_probe(pdev);
diff --git a/drivers/pinctrl/intel/pinctrl-cherryview.c b/drivers/pinctrl/intel/pinctrl-cherryview.c
index bdedb6325c72..4471fd94e1fe 100644
--- a/drivers/pinctrl/intel/pinctrl-cherryview.c
+++ b/drivers/pinctrl/intel/pinctrl-cherryview.c
@@ -1620,6 +1620,22 @@ static int chv_gpio_probe(struct chv_pinctrl *pctrl, int irq)
                         clear_bit(i, chip->irq.valid_mask);
         }
 
+        /*
+         * The same set of machines in chv_no_valid_mask[] have incorrectly
+         * configured GPIOs that generate spurious interrupts so we use
+         * this same list to apply another quirk for them.
+         *
+         * See also https://bugzilla.kernel.org/show_bug.cgi?id=197953.
+         */
+        if (!need_valid_mask) {
+                /*
+                 * Mask all interrupts the community is able to generate
+                 * but leave the ones that can only generate GPEs unmasked.
+                 */
+                chv_writel(GENMASK(31, pctrl->community->nirqs),
+                           pctrl->regs + CHV_INTMASK);
+        }
+
         /* Clear all interrupts */
         chv_writel(0xffff, pctrl->regs + CHV_INTSTAT);
 
diff --git a/drivers/pinctrl/pinctrl-single.c b/drivers/pinctrl/pinctrl-single.c
index e6cd8de793e2..3501491e5bfc 100644
--- a/drivers/pinctrl/pinctrl-single.c
+++ b/drivers/pinctrl/pinctrl-single.c
@@ -222,6 +222,9 @@ static enum pin_config_param pcs_bias[] = {
  */
 static struct lock_class_key pcs_lock_class;
 
+/* Class for the IRQ request mutex */
+static struct lock_class_key pcs_request_class;
+
 /*
  * REVISIT: Reads and writes could eventually use regmap or something
  * generic. But at least on omaps, some mux registers are performance
@@ -1486,7 +1489,7 @@ static int pcs_irqdomain_map(struct irq_domain *d, unsigned int irq,
         irq_set_chip_data(irq, pcs_soc);
         irq_set_chip_and_handler(irq, &pcs->chip,
                                  handle_level_irq);
-        irq_set_lockdep_class(irq, &pcs_lock_class);
+        irq_set_lockdep_class(irq, &pcs_lock_class, &pcs_request_class);
         irq_set_noprobe(irq);
 
         return 0;
diff --git a/drivers/pinctrl/stm32/pinctrl-stm32.c b/drivers/pinctrl/stm32/pinctrl-stm32.c
index a276c61be217..e62ab087bfd8 100644
--- a/drivers/pinctrl/stm32/pinctrl-stm32.c
+++ b/drivers/pinctrl/stm32/pinctrl-stm32.c
@@ -290,7 +290,7 @@ static int stm32_gpio_domain_translate(struct irq_domain *d,
 }
 
 static int stm32_gpio_domain_activate(struct irq_domain *d,
-                                      struct irq_data *irq_data, bool early)
+                                      struct irq_data *irq_data, bool reserve)
 {
         struct stm32_gpio_bank *bank = d->host_data;
         struct stm32_pinctrl *pctl = dev_get_drvdata(bank->gpio_chip.parent);
diff --git a/drivers/platform/x86/asus-wireless.c b/drivers/platform/x86/asus-wireless.c
index f3796164329e..d4aeac3477f5 100644
--- a/drivers/platform/x86/asus-wireless.c
+++ b/drivers/platform/x86/asus-wireless.c
@@ -118,6 +118,7 @@ static void asus_wireless_notify(struct acpi_device *adev, u32 event)
                 return;
         }
         input_report_key(data->idev, KEY_RFKILL, 1);
+        input_sync(data->idev);
         input_report_key(data->idev, KEY_RFKILL, 0);
         input_sync(data->idev);
 }
diff --git a/drivers/platform/x86/dell-laptop.c b/drivers/platform/x86/dell-laptop.c
index bf897b1832b1..cd4725e7e0b5 100644
--- a/drivers/platform/x86/dell-laptop.c
+++ b/drivers/platform/x86/dell-laptop.c
@@ -37,6 +37,7 @@
 
 struct quirk_entry {
         u8 touchpad_led;
+        u8 kbd_led_levels_off_1;
 
         int needs_kbd_timeouts;
         /*
@@ -67,6 +68,10 @@ static struct quirk_entry quirk_dell_xps13_9333 = {
         .kbd_timeouts = { 0, 5, 15, 60, 5 * 60, 15 * 60, -1 },
 };
 
+static struct quirk_entry quirk_dell_latitude_e6410 = {
+        .kbd_led_levels_off_1 = 1,
+};
+
 static struct platform_driver platform_driver = {
         .driver = {
                 .name = "dell-laptop",
@@ -269,6 +274,15 @@ static const struct dmi_system_id dell_quirks[] __initconst = {
                 },
                 .driver_data = &quirk_dell_xps13_9333,
         },
+        {
+                .callback = dmi_matched,
+                .ident = "Dell Latitude E6410",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Latitude E6410"),
+                },
+                .driver_data = &quirk_dell_latitude_e6410,
+        },
         { }
 };
 
@@ -1149,6 +1163,9 @@ static int kbd_get_info(struct kbd_info *info)
         units = (buffer->output[2] >> 8) & 0xFF;
         info->levels = (buffer->output[2] >> 16) & 0xFF;
 
+        if (quirks && quirks->kbd_led_levels_off_1 && info->levels)
+                info->levels--;
+
         if (units & BIT(0))
                 info->seconds = (buffer->output[3] >> 0) & 0xFF;
         if (units & BIT(1))
diff --git a/drivers/platform/x86/dell-wmi.c b/drivers/platform/x86/dell-wmi.c
index 39d2f4518483..fb25b20df316 100644
--- a/drivers/platform/x86/dell-wmi.c
+++ b/drivers/platform/x86/dell-wmi.c
@@ -639,6 +639,8 @@ static int dell_wmi_events_set_enabled(bool enable)
         int ret;
 
         buffer = kzalloc(sizeof(struct calling_interface_buffer), GFP_KERNEL);
+        if (!buffer)
+                return -ENOMEM;
         buffer->cmd_class = CLASS_INFO;
         buffer->cmd_select = SELECT_APP_REGISTRATION;
         buffer->input[0] = 0x10000;
diff --git a/drivers/s390/net/qeth_core.h b/drivers/s390/net/qeth_core.h
index 15015a24f8ad..badf42acbf95 100644
--- a/drivers/s390/net/qeth_core.h
+++ b/drivers/s390/net/qeth_core.h
@@ -565,9 +565,9 @@ enum qeth_cq {
 };
 
 struct qeth_ipato {
-        int enabled;
-        int invert4;
-        int invert6;
+        bool enabled;
+        bool invert4;
+        bool invert6;
         struct list_head entries;
 };
 
diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
index 430e3214f7e2..3614df68830f 100644
--- a/drivers/s390/net/qeth_core_main.c
+++ b/drivers/s390/net/qeth_core_main.c
@@ -1480,9 +1480,9 @@ static int qeth_setup_card(struct qeth_card *card)
         qeth_set_intial_options(card);
         /* IP address takeover */
         INIT_LIST_HEAD(&card->ipato.entries);
-        card->ipato.enabled = 0;
-        card->ipato.invert4 = 0;
-        card->ipato.invert6 = 0;
+        card->ipato.enabled = false;
+        card->ipato.invert4 = false;
+        card->ipato.invert6 = false;
         /* init QDIO stuff */
         qeth_init_qdio_info(card);
         INIT_DELAYED_WORK(&card->buffer_reclaim_work, qeth_buffer_reclaim_work);
@@ -5386,6 +5386,13 @@ out:
 }
 EXPORT_SYMBOL_GPL(qeth_poll);
 
+static int qeth_setassparms_inspect_rc(struct qeth_ipa_cmd *cmd)
+{
+        if (!cmd->hdr.return_code)
+                cmd->hdr.return_code = cmd->data.setassparms.hdr.return_code;
+        return cmd->hdr.return_code;
+}
+
 int qeth_setassparms_cb(struct qeth_card *card,
                         struct qeth_reply *reply, unsigned long data)
 {
@@ -6242,7 +6249,7 @@ static int qeth_ipa_checksum_run_cmd_cb(struct qeth_card *card,
                                 (struct qeth_checksum_cmd *)reply->param;
 
         QETH_CARD_TEXT(card, 4, "chkdoccb");
-        if (cmd->hdr.return_code)
+        if (qeth_setassparms_inspect_rc(cmd))
                 return 0;
 
         memset(chksum_cb, 0, sizeof(*chksum_cb));
diff --git a/drivers/s390/net/qeth_l3.h b/drivers/s390/net/qeth_l3.h
index 194ae9b577cc..e5833837b799 100644
--- a/drivers/s390/net/qeth_l3.h
+++ b/drivers/s390/net/qeth_l3.h
@@ -82,7 +82,7 @@ void qeth_l3_del_vipa(struct qeth_card *, enum qeth_prot_versions, const u8 *);
 int qeth_l3_add_rxip(struct qeth_card *, enum qeth_prot_versions, const u8 *);
 void qeth_l3_del_rxip(struct qeth_card *card, enum qeth_prot_versions,
                         const u8 *);
-int qeth_l3_is_addr_covered_by_ipato(struct qeth_card *, struct qeth_ipaddr *);
+void qeth_l3_update_ipato(struct qeth_card *card);
 struct qeth_ipaddr *qeth_l3_get_addr_buffer(enum qeth_prot_versions);
 int qeth_l3_add_ip(struct qeth_card *, struct qeth_ipaddr *);
 int qeth_l3_delete_ip(struct qeth_card *, struct qeth_ipaddr *);
diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c
index 6a73894b0cb5..ef0961e18686 100644
--- a/drivers/s390/net/qeth_l3_main.c
+++ b/drivers/s390/net/qeth_l3_main.c
@@ -164,8 +164,8 @@ static void qeth_l3_convert_addr_to_bits(u8 *addr, u8 *bits, int len)
         }
 }
 
-int qeth_l3_is_addr_covered_by_ipato(struct qeth_card *card,
-                                                struct qeth_ipaddr *addr)
+static bool qeth_l3_is_addr_covered_by_ipato(struct qeth_card *card,
+                                             struct qeth_ipaddr *addr)
 {
         struct qeth_ipato_entry *ipatoe;
         u8 addr_bits[128] = {0, };
@@ -174,6 +174,8 @@ int qeth_l3_is_addr_covered_by_ipato(struct qeth_card *card,
 
         if (!card->ipato.enabled)
                 return 0;
+        if (addr->type != QETH_IP_TYPE_NORMAL)
+                return 0;
 
         qeth_l3_convert_addr_to_bits((u8 *) &addr->u, addr_bits,
                                   (addr->proto == QETH_PROT_IPV4)? 4:16);
@@ -290,8 +292,7 @@ int qeth_l3_add_ip(struct qeth_card *card, struct qeth_ipaddr *tmp_addr)
                 memcpy(addr, tmp_addr, sizeof(struct qeth_ipaddr));
                 addr->ref_counter = 1;
 
-                if (addr->type == QETH_IP_TYPE_NORMAL  &&
-                                qeth_l3_is_addr_covered_by_ipato(card, addr)) {
+                if (qeth_l3_is_addr_covered_by_ipato(card, addr)) {
                         QETH_CARD_TEXT(card, 2, "tkovaddr");
                         addr->set_flags |= QETH_IPA_SETIP_TAKEOVER_FLAG;
                 }
@@ -605,6 +606,27 @@ int qeth_l3_setrouting_v6(struct qeth_card *card)
 /*
  * IP address takeover related functions
  */
+
+/**
+ * qeth_l3_update_ipato() - Update 'takeover' property, for all NORMAL IPs.
+ *
+ * Caller must hold ip_lock.
+ */
+void qeth_l3_update_ipato(struct qeth_card *card)
+{
+        struct qeth_ipaddr *addr;
+        unsigned int i;
+
+        hash_for_each(card->ip_htable, i, addr, hnode) {
+                if (addr->type != QETH_IP_TYPE_NORMAL)
+                        continue;
+                if (qeth_l3_is_addr_covered_by_ipato(card, addr))
+                        addr->set_flags |= QETH_IPA_SETIP_TAKEOVER_FLAG;
+                else
+                        addr->set_flags &= ~QETH_IPA_SETIP_TAKEOVER_FLAG;
+        }
+}
+
 static void qeth_l3_clear_ipato_list(struct qeth_card *card)
 {
         struct qeth_ipato_entry *ipatoe, *tmp;
@@ -616,6 +638,7 @@ static void qeth_l3_clear_ipato_list(struct qeth_card *card)
                 kfree(ipatoe);
         }
 
+        qeth_l3_update_ipato(card);
         spin_unlock_bh(&card->ip_lock);
 }
 
@@ -640,8 +663,10 @@ int qeth_l3_add_ipato_entry(struct qeth_card *card,
                 }
         }
 
-        if (!rc)
+        if (!rc) {
                 list_add_tail(&new->entry, &card->ipato.entries);
+                qeth_l3_update_ipato(card);
+        }
 
         spin_unlock_bh(&card->ip_lock);
 
@@ -664,6 +689,7 @@ void qeth_l3_del_ipato_entry(struct qeth_card *card,
                             (proto == QETH_PROT_IPV4)? 4:16) &&
                     (ipatoe->mask_bits == mask_bits)) {
                         list_del(&ipatoe->entry);
+                        qeth_l3_update_ipato(card);
                         kfree(ipatoe);
                 }
         }
diff --git a/drivers/s390/net/qeth_l3_sys.c b/drivers/s390/net/qeth_l3_sys.c
index bd12fdf678be..6ea2b528a64e 100644
--- a/drivers/s390/net/qeth_l3_sys.c
+++ b/drivers/s390/net/qeth_l3_sys.c
@@ -370,8 +370,8 @@ static ssize_t qeth_l3_dev_ipato_enable_store(struct device *dev,
                 struct device_attribute *attr, const char *buf, size_t count)
 {
         struct qeth_card *card = dev_get_drvdata(dev);
-        struct qeth_ipaddr *addr;
-        int i, rc = 0;
+        bool enable;
+        int rc = 0;
 
         if (!card)
                 return -EINVAL;
@@ -384,25 +384,18 @@ static ssize_t qeth_l3_dev_ipato_enable_store(struct device *dev,
         }
 
         if (sysfs_streq(buf, "toggle")) {
-                card->ipato.enabled = (card->ipato.enabled)? 0 : 1;
-        } else if (sysfs_streq(buf, "1")) {
-                card->ipato.enabled = 1;
-                hash_for_each(card->ip_htable, i, addr, hnode) {
-                                if ((addr->type == QETH_IP_TYPE_NORMAL) &&
-                                qeth_l3_is_addr_covered_by_ipato(card, addr))
-                                        addr->set_flags |=
-                                        QETH_IPA_SETIP_TAKEOVER_FLAG;
-                        }
-        } else if (sysfs_streq(buf, "0")) {
-                card->ipato.enabled = 0;
-                hash_for_each(card->ip_htable, i, addr, hnode) {
-                        if (addr->set_flags &
-                        QETH_IPA_SETIP_TAKEOVER_FLAG)
-                                addr->set_flags &=
-                                ~QETH_IPA_SETIP_TAKEOVER_FLAG;
-                        }
-        } else
+                enable = !card->ipato.enabled;
+        } else if (kstrtobool(buf, &enable)) {
                 rc = -EINVAL;
+                goto out;
+        }
+
+        if (card->ipato.enabled != enable) {
+                card->ipato.enabled = enable;
+                spin_lock_bh(&card->ip_lock);
+                qeth_l3_update_ipato(card);
+                spin_unlock_bh(&card->ip_lock);
+        }
 out:
         mutex_unlock(&card->conf_mutex);
         return rc ? rc : count;
@@ -428,20 +421,27 @@ static ssize_t qeth_l3_dev_ipato_invert4_store(struct device *dev,
                                 const char *buf, size_t count)
 {
         struct qeth_card *card = dev_get_drvdata(dev);
+        bool invert;
         int rc = 0;
 
         if (!card)
                 return -EINVAL;
 
         mutex_lock(&card->conf_mutex);
-        if (sysfs_streq(buf, "toggle"))
-                card->ipato.invert4 = (card->ipato.invert4)? 0 : 1;
-        else if (sysfs_streq(buf, "1"))
-                card->ipato.invert4 = 1;
-        else if (sysfs_streq(buf, "0"))
-                card->ipato.invert4 = 0;
-        else
+        if (sysfs_streq(buf, "toggle")) {
+                invert = !card->ipato.invert4;
+        } else if (kstrtobool(buf, &invert)) {
                 rc = -EINVAL;
+                goto out;
+        }
+
+        if (card->ipato.invert4 != invert) {
+                card->ipato.invert4 = invert;
+                spin_lock_bh(&card->ip_lock);
+                qeth_l3_update_ipato(card);
+                spin_unlock_bh(&card->ip_lock);
+        }
+out:
         mutex_unlock(&card->conf_mutex);
         return rc ? rc : count;
 }
@@ -607,20 +607,27 @@ static ssize_t qeth_l3_dev_ipato_invert6_store(struct device *dev,
                 struct device_attribute *attr, const char *buf, size_t count)
 {
         struct qeth_card *card = dev_get_drvdata(dev);
+        bool invert;
         int rc = 0;
 
         if (!card)
                 return -EINVAL;
 
         mutex_lock(&card->conf_mutex);
-        if (sysfs_streq(buf, "toggle"))
-                card->ipato.invert6 = (card->ipato.invert6)? 0 : 1;
-        else if (sysfs_streq(buf, "1"))
-                card->ipato.invert6 = 1;
-        else if (sysfs_streq(buf, "0"))
-                card->ipato.invert6 = 0;
-        else
+        if (sysfs_streq(buf, "toggle")) {
+                invert = !card->ipato.invert6;
+        } else if (kstrtobool(buf, &invert)) {
                 rc = -EINVAL;
+                goto out;
+        }
+
+        if (card->ipato.invert6 != invert) {
+                card->ipato.invert6 = invert;
+                spin_lock_bh(&card->ip_lock);
+                qeth_l3_update_ipato(card);
+                spin_unlock_bh(&card->ip_lock);
+        }
+out:
         mutex_unlock(&card->conf_mutex);
         return rc ? rc : count;
 }
diff --git a/drivers/scsi/aacraid/aacraid.h b/drivers/scsi/aacraid/aacraid.h
index 6e3d81969a77..d52265416da2 100644
--- a/drivers/scsi/aacraid/aacraid.h
+++ b/drivers/scsi/aacraid/aacraid.h
@@ -1725,6 +1725,7 @@ struct aac_dev
 #define FIB_CONTEXT_FLAG_NATIVE_HBA             (0x00000010)
 #define FIB_CONTEXT_FLAG_NATIVE_HBA_TMF (0x00000020)
 #define FIB_CONTEXT_FLAG_SCSI_CMD       (0x00000040)
+#define FIB_CONTEXT_FLAG_EH_RESET       (0x00000080)
 
 /*
  *      Define the command values
diff --git a/drivers/scsi/aacraid/commsup.c b/drivers/scsi/aacraid/commsup.c
index bec9f3193f60..80a8cb26cdea 100644
--- a/drivers/scsi/aacraid/commsup.c
+++ b/drivers/scsi/aacraid/commsup.c
@@ -2482,8 +2482,8 @@ int aac_command_thread(void *data)
                         /* Synchronize our watches */
                         if (((NSEC_PER_SEC - (NSEC_PER_SEC / HZ)) > now.tv_nsec)
                          && (now.tv_nsec > (NSEC_PER_SEC / HZ)))
-                                difference = (((NSEC_PER_SEC - now.tv_nsec) * HZ)
-                                  + NSEC_PER_SEC / 2) / NSEC_PER_SEC;
+                                difference = HZ + HZ / 2 -
+                                             now.tv_nsec / (NSEC_PER_SEC / HZ);
                         else {
                                 if (now.tv_nsec > NSEC_PER_SEC / 2)
                                         ++now.tv_sec;
@@ -2507,6 +2507,10 @@ int aac_command_thread(void *data)
                 if (kthread_should_stop())
                         break;
 
+                /*
+                 * we probably want usleep_range() here instead of the
+                 * jiffies computation
+                 */
                 schedule_timeout(difference);
 
                 if (kthread_should_stop())
diff --git a/drivers/scsi/aacraid/linit.c b/drivers/scsi/aacraid/linit.c
index bdf127aaab41..d55332de08f9 100644
--- a/drivers/scsi/aacraid/linit.c
+++ b/drivers/scsi/aacraid/linit.c
@@ -1037,7 +1037,7 @@ static int aac_eh_bus_reset(struct scsi_cmnd* cmd)
                         info = &aac->hba_map[bus][cid];
                         if (bus >= AAC_MAX_BUSES || cid >= AAC_MAX_TARGETS ||
                             info->devtype != AAC_DEVTYPE_NATIVE_RAW) {
-                                fib->flags |= FIB_CONTEXT_FLAG_TIMED_OUT;
+                                fib->flags |= FIB_CONTEXT_FLAG_EH_RESET;
                                 cmd->SCp.phase = AAC_OWNER_ERROR_HANDLER;
                         }
                 }
diff --git a/drivers/scsi/bfa/bfad_bsg.c b/drivers/scsi/bfa/bfad_bsg.c
index 72ca2a2e08e2..b2fa195adc7a 100644
--- a/drivers/scsi/bfa/bfad_bsg.c
+++ b/drivers/scsi/bfa/bfad_bsg.c
@@ -3135,7 +3135,8 @@ bfad_im_bsg_vendor_request(struct bsg_job *job)
         struct fc_bsg_request *bsg_request = job->request;
         struct fc_bsg_reply *bsg_reply = job->reply;
         uint32_t vendor_cmd = bsg_request->rqst_data.h_vendor.vendor_cmd[0];
-        struct bfad_im_port_s *im_port = shost_priv(fc_bsg_to_shost(job));
+        struct Scsi_Host *shost = fc_bsg_to_shost(job);
+        struct bfad_im_port_s *im_port = bfad_get_im_port(shost);
         struct bfad_s *bfad = im_port->bfad;
         void *payload_kbuf;
         int rc = -EINVAL;
@@ -3350,7 +3351,8 @@ int
 bfad_im_bsg_els_ct_request(struct bsg_job *job)
 {
         struct bfa_bsg_data *bsg_data;
-        struct bfad_im_port_s *im_port = shost_priv(fc_bsg_to_shost(job));
+        struct Scsi_Host *shost = fc_bsg_to_shost(job);
+        struct bfad_im_port_s *im_port = bfad_get_im_port(shost);
         struct bfad_s *bfad = im_port->bfad;
         bfa_bsg_fcpt_t *bsg_fcpt;
         struct bfad_fcxp    *drv_fcxp;
diff --git a/drivers/scsi/bfa/bfad_im.c b/drivers/scsi/bfa/bfad_im.c
index 24e657a4ec80..c05d6e91e4bd 100644
--- a/drivers/scsi/bfa/bfad_im.c
+++ b/drivers/scsi/bfa/bfad_im.c
@@ -546,6 +546,7 @@ int
 bfad_im_scsi_host_alloc(struct bfad_s *bfad, struct bfad_im_port_s *im_port,
                         struct device *dev)
 {
+        struct bfad_im_port_pointer *im_portp;
         int error = 1;
 
         mutex_lock(&bfad_mutex);
@@ -564,7 +565,8 @@ bfad_im_scsi_host_alloc(struct bfad_s *bfad, struct bfad_im_port_s *im_port,
                 goto out_free_idr;
         }
 
-        im_port->shost->hostdata[0] = (unsigned long)im_port;
+        im_portp = shost_priv(im_port->shost);
+        im_portp->p = im_port;
         im_port->shost->unique_id = im_port->idr_id;
         im_port->shost->this_id = -1;
         im_port->shost->max_id = MAX_FCP_TARGET;
@@ -748,7 +750,7 @@ bfad_scsi_host_alloc(struct bfad_im_port_s *im_port, struct bfad_s *bfad)
 
         sht->sg_tablesize = bfad->cfg_data.io_max_sge;
 
-        return scsi_host_alloc(sht, sizeof(unsigned long));
+        return scsi_host_alloc(sht, sizeof(struct bfad_im_port_pointer));
 }
 
 void
diff --git a/drivers/scsi/bfa/bfad_im.h b/drivers/scsi/bfa/bfad_im.h
index c81ec2a77ef5..06ce4ba2b7bc 100644
--- a/drivers/scsi/bfa/bfad_im.h
+++ b/drivers/scsi/bfa/bfad_im.h
@@ -69,6 +69,16 @@ struct bfad_im_port_s {
         struct fc_vport *fc_vport;
 };
 
+struct bfad_im_port_pointer {
+        struct bfad_im_port_s *p;
+};
+
+static inline struct bfad_im_port_s *bfad_get_im_port(struct Scsi_Host *host)
+{
+        struct bfad_im_port_pointer *im_portp = shost_priv(host);
+        return im_portp->p;
+}
+
 enum bfad_itnim_state {
         ITNIM_STATE_NONE,
         ITNIM_STATE_ONLINE,
diff --git a/drivers/scsi/libfc/fc_lport.c b/drivers/scsi/libfc/fc_lport.c
index 5da46052e179..21be672679fb 100644
--- a/drivers/scsi/libfc/fc_lport.c
+++ b/drivers/scsi/libfc/fc_lport.c
@@ -904,10 +904,14 @@ static void fc_lport_recv_els_req(struct fc_lport *lport,
                 case ELS_FLOGI:
                         if (!lport->point_to_multipoint)
                                 fc_lport_recv_flogi_req(lport, fp);
+                        else
+                                fc_rport_recv_req(lport, fp);
                         break;
                 case ELS_LOGO:
                         if (fc_frame_sid(fp) == FC_FID_FLOGI)
                                 fc_lport_recv_logo_req(lport, fp);
+                        else
+                                fc_rport_recv_req(lport, fp);
                         break;
                 case ELS_RSCN:
                         lport->tt.disc_recv_req(lport, fp);
diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c
index ca1566237ae7..3183d63de4da 100644
--- a/drivers/scsi/libsas/sas_expander.c
+++ b/drivers/scsi/libsas/sas_expander.c
@@ -2145,7 +2145,7 @@ void sas_smp_handler(struct bsg_job *job, struct Scsi_Host *shost,
                 struct sas_rphy *rphy)
 {
         struct domain_device *dev;
-        unsigned int reslen = 0;
+        unsigned int rcvlen = 0;
         int ret = -EINVAL;
 
         /* no rphy means no smp target support (ie aic94xx host) */
@@ -2179,12 +2179,12 @@ void sas_smp_handler(struct bsg_job *job, struct Scsi_Host *shost,
 
         ret = smp_execute_task_sg(dev, job->request_payload.sg_list,
                         job->reply_payload.sg_list);
-        if (ret > 0) {
-                /* positive number is the untransferred residual */
-                reslen = ret;
+        if (ret >= 0) {
+                /* bsg_job_done() requires the length received  */
+                rcvlen = job->reply_payload.payload_len - ret;
                 ret = 0;
         }
 
 out:
-        bsg_job_done(job, ret, reslen);
+        bsg_job_done(job, ret, rcvlen);
 }
diff --git a/drivers/scsi/lpfc/lpfc_mem.c b/drivers/scsi/lpfc/lpfc_mem.c
index 56faeb049b4a..87c08ff37ddd 100644
--- a/drivers/scsi/lpfc/lpfc_mem.c
+++ b/drivers/scsi/lpfc/lpfc_mem.c
@@ -753,12 +753,12 @@ lpfc_rq_buf_free(struct lpfc_hba *phba, struct lpfc_dmabuf *mp)
         drqe.address_hi = putPaddrHigh(rqb_entry->dbuf.phys);
         rc = lpfc_sli4_rq_put(rqb_entry->hrq, rqb_entry->drq, &hrqe, &drqe);
         if (rc < 0) {
-                (rqbp->rqb_free_buffer)(phba, rqb_entry);
                 lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
                                 "6409 Cannot post to RQ %d: %x %x\n",
                                 rqb_entry->hrq->queue_id,
                                 rqb_entry->hrq->host_index,
                                 rqb_entry->hrq->hba_index);
+                (rqbp->rqb_free_buffer)(phba, rqb_entry);
         } else {
                 list_add_tail(&rqb_entry->hbuf.list, &rqbp->rqb_buffer_list);
                 rqbp->buffer_count++;
diff --git a/drivers/scsi/osd/osd_initiator.c b/drivers/scsi/osd/osd_initiator.c
index a4f28b7e4c65..e18877177f1b 100644
--- a/drivers/scsi/osd/osd_initiator.c
+++ b/drivers/scsi/osd/osd_initiator.c
@@ -1576,7 +1576,9 @@ static struct request *_make_request(struct request_queue *q, bool has_write,
                 return req;
 
         for_each_bio(bio) {
-                ret = blk_rq_append_bio(req, bio);
+                struct bio *bounce_bio = bio;
+
+                ret = blk_rq_append_bio(req, &bounce_bio);
                 if (ret)
                         return ERR_PTR(ret);
         }
diff --git a/drivers/scsi/scsi_debugfs.c b/drivers/scsi/scsi_debugfs.c
index 01f08c03f2c1..c3765d29fd3f 100644
--- a/drivers/scsi/scsi_debugfs.c
+++ b/drivers/scsi/scsi_debugfs.c
@@ -8,9 +8,11 @@ void scsi_show_rq(struct seq_file *m, struct request *rq)
 {
         struct scsi_cmnd *cmd = container_of(scsi_req(rq), typeof(*cmd), req);
         int msecs = jiffies_to_msecs(jiffies - cmd->jiffies_at_alloc);
-        char buf[80];
+        const u8 *const cdb = READ_ONCE(cmd->cmnd);
+        char buf[80] = "(?)";
 
-        __scsi_format_command(buf, sizeof(buf), cmd->cmnd, cmd->cmd_len);
+        if (cdb)
+                __scsi_format_command(buf, sizeof(buf), cdb, cmd->cmd_len);
         seq_printf(m, ", .cmd=%s, .retries=%d, allocated %d.%03d s ago", buf,
                    cmd->retries, msecs / 1000, msecs % 1000);
 }
diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c
index 78d4aa8df675..dfb8da83fa50 100644
--- a/drivers/scsi/scsi_devinfo.c
+++ b/drivers/scsi/scsi_devinfo.c
@@ -34,7 +34,6 @@ struct scsi_dev_info_list_table {
 };
 
 
-static const char spaces[] = "                "; /* 16 of them */
 static blist_flags_t scsi_default_dev_flags;
 static LIST_HEAD(scsi_dev_info_list);
 static char scsi_dev_flags[256];
@@ -298,20 +297,13 @@ static void scsi_strcpy_devinfo(char *name, char *to, size_t to_length,
         size_t from_length;
 
         from_length = strlen(from);
-        strncpy(to, from, min(to_length, from_length));
-        if (from_length < to_length) {
-                if (compatible) {
-                        /*
-                         * NUL terminate the string if it is short.
-                         */
-                        to[from_length] = '\0';
-                } else {
-                        /*
-                         * space pad the string if it is short.
-                         */
-                        strncpy(&to[from_length], spaces,
-                                to_length - from_length);
-                }
+        /* This zero-pads the destination */
+        strncpy(to, from, to_length);
+        if (from_length < to_length && !compatible) {
+                /*
+                 * space pad the string if it is short.
+                 */
+                memset(&to[from_length], ' ', to_length - from_length);
         }
         if (from_length > to_length)
                  printk(KERN_WARNING "%s: %s string '%s' is too long\n",
@@ -382,10 +374,8 @@ int scsi_dev_info_list_add_keyed(int compatible, char *vendor, char *model,
                             model, compatible);
 
         if (strflags)
-                devinfo->flags = simple_strtoul(strflags, NULL, 0);
-        else
-                devinfo->flags = flags;
-
+                flags = (__force blist_flags_t)simple_strtoul(strflags, NULL, 0);
+        devinfo->flags = flags;
         devinfo->compatible = compatible;
 
         if (compatible)
@@ -458,7 +448,8 @@ static struct scsi_dev_info_list *scsi_dev_info_list_find(const char *vendor,
                         /*
                          * vendor strings must be an exact match
                          */
-                        if (vmax != strlen(devinfo->vendor) ||
+                        if (vmax != strnlen(devinfo->vendor,
+                                            sizeof(devinfo->vendor)) ||
                             memcmp(devinfo->vendor, vskip, vmax))
                                 continue;
 
@@ -466,7 +457,7 @@ static struct scsi_dev_info_list *scsi_dev_info_list_find(const char *vendor,
                          * @model specifies the full string, and
                          * must be larger or equal to devinfo->model
                          */
-                        mlen = strlen(devinfo->model);
+                        mlen = strnlen(devinfo->model, sizeof(devinfo->model));
                         if (mmax < mlen || memcmp(devinfo->model, mskip, mlen))
                                 continue;
                         return devinfo;
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index 00742c50cd44..d9ca1dfab154 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -1967,6 +1967,8 @@ static bool scsi_mq_get_budget(struct blk_mq_hw_ctx *hctx)
 out_put_device:
         put_device(&sdev->sdev_gendev);
 out:
+        if (atomic_read(&sdev->device_busy) == 0 && !scsi_device_blocked(sdev))
+                blk_mq_delay_run_hw_queue(hctx, SCSI_QUEUE_DELAY);
         return false;
 }
 
diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
index be5e919db0e8..0880d975eed3 100644
--- a/drivers/scsi/scsi_scan.c
+++ b/drivers/scsi/scsi_scan.c
@@ -770,7 +770,7 @@ static int scsi_probe_lun(struct scsi_device *sdev, unsigned char *inq_result,
  *     SCSI_SCAN_LUN_PRESENT: a new scsi_device was allocated and initialized
  **/
 static int scsi_add_lun(struct scsi_device *sdev, unsigned char *inq_result,
-                int *bflags, int async)
+                blist_flags_t *bflags, int async)
 {
         int ret;
 
@@ -1049,14 +1049,15 @@ static unsigned char *scsi_inq_str(unsigned char *buf, unsigned char *inq,
  *   - SCSI_SCAN_LUN_PRESENT: a new scsi_device was allocated and initialized
  **/
 static int scsi_probe_and_add_lun(struct scsi_target *starget,
-                                  u64 lun, int *bflagsp,
+                                  u64 lun, blist_flags_t *bflagsp,
                                   struct scsi_device **sdevp,
                                   enum scsi_scan_mode rescan,
                                   void *hostdata)
 {
         struct scsi_device *sdev;
         unsigned char *result;
-        int bflags, res = SCSI_SCAN_NO_RESPONSE, result_len = 256;
+        blist_flags_t bflags;
+        int res = SCSI_SCAN_NO_RESPONSE, result_len = 256;
         struct Scsi_Host *shost = dev_to_shost(starget->dev.parent);
 
         /*
@@ -1201,7 +1202,7 @@ static int scsi_probe_and_add_lun(struct scsi_target *starget,
  *     Modifies sdevscan->lun.
  **/
 static void scsi_sequential_lun_scan(struct scsi_target *starget,
-                                     int bflags, int scsi_level,
+                                     blist_flags_t bflags, int scsi_level,
                                      enum scsi_scan_mode rescan)
 {
         uint max_dev_lun;
@@ -1292,7 +1293,7 @@ static void scsi_sequential_lun_scan(struct scsi_target *starget,
  *     0: scan completed (or no memory, so further scanning is futile)
  *     1: could not scan with REPORT LUN
  **/
-static int scsi_report_lun_scan(struct scsi_target *starget, int bflags,
+static int scsi_report_lun_scan(struct scsi_target *starget, blist_flags_t bflags,
                                 enum scsi_scan_mode rescan)
 {
         unsigned char scsi_cmd[MAX_COMMAND_SIZE];
@@ -1538,7 +1539,7 @@ static void __scsi_scan_target(struct device *parent, unsigned int channel,
                 unsigned int id, u64 lun, enum scsi_scan_mode rescan)
 {
         struct Scsi_Host *shost = dev_to_shost(parent);
-        int bflags = 0;
+        blist_flags_t bflags = 0;
         int res;
         struct scsi_target *starget;
 
diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
index 50e7d7e4a861..26ce17178401 100644
--- a/drivers/scsi/scsi_sysfs.c
+++ b/drivers/scsi/scsi_sysfs.c
@@ -967,7 +967,8 @@ sdev_show_wwid(struct device *dev, struct device_attribute *attr,
 }
 static DEVICE_ATTR(wwid, S_IRUGO, sdev_show_wwid, NULL);
 
-#define BLIST_FLAG_NAME(name) [ilog2(BLIST_##name)] = #name
+#define BLIST_FLAG_NAME(name)                                   \
+        [ilog2((__force unsigned int)BLIST_##name)] = #name
 static const char *const sdev_bflags_name[] = {
 #include "scsi_devinfo_tbl.c"
 };
@@ -984,7 +985,7 @@ sdev_show_blacklist(struct device *dev, struct device_attribute *attr,
         for (i = 0; i < sizeof(sdev->sdev_bflags) * BITS_PER_BYTE; i++) {
                 const char *name = NULL;
 
-                if (!(sdev->sdev_bflags & BIT(i)))
+                if (!(sdev->sdev_bflags & (__force blist_flags_t)BIT(i)))
                         continue;
                 if (i < ARRAY_SIZE(sdev_bflags_name) && sdev_bflags_name[i])
                         name = sdev_bflags_name[i];
@@ -1414,7 +1415,10 @@ static void __scsi_remove_target(struct scsi_target *starget)
                  * check.
                  */
                 if (sdev->channel != starget->channel ||
-                    sdev->id != starget->id ||
+                    sdev->id != starget->id)
+                        continue;
+                if (sdev->sdev_state == SDEV_DEL ||
+                    sdev->sdev_state == SDEV_CANCEL ||
                     !get_device(&sdev->sdev_gendev))
                         continue;
                 spin_unlock_irqrestore(shost->host_lock, flags);
diff --git a/drivers/scsi/scsi_transport_spi.c b/drivers/scsi/scsi_transport_spi.c
index d0219e36080c..10ebb213ddb3 100644
--- a/drivers/scsi/scsi_transport_spi.c
+++ b/drivers/scsi/scsi_transport_spi.c
@@ -50,14 +50,14 @@
 
 /* Our blacklist flags */
 enum {
-        SPI_BLIST_NOIUS = 0x1,
+        SPI_BLIST_NOIUS = (__force blist_flags_t)0x1,
 };
 
 /* blacklist table, modelled on scsi_devinfo.c */
 static struct {
         char *vendor;
         char *model;
-        unsigned flags;
+        blist_flags_t flags;
 } spi_static_device_list[] __initdata = {
         {"HP", "Ultrium 3-SCSI", SPI_BLIST_NOIUS },
         {"IBM", "ULTRIUM-TD3", SPI_BLIST_NOIUS },
@@ -221,9 +221,11 @@ static int spi_device_configure(struct transport_container *tc,
 {
         struct scsi_device *sdev = to_scsi_device(dev);
         struct scsi_target *starget = sdev->sdev_target;
-        unsigned bflags = scsi_get_device_flags_keyed(sdev, &sdev->inquiry[8],
-                                                      &sdev->inquiry[16],
-                                                      SCSI_DEVINFO_SPI);
+        blist_flags_t bflags;
+
+        bflags = scsi_get_device_flags_keyed(sdev, &sdev->inquiry[8],
+                                             &sdev->inquiry[16],
+                                             SCSI_DEVINFO_SPI);
 
         /* Populate the target capability fields with the values
          * gleaned from the device inquiry */
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index 24fe68522716..a028ab3322a9 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -1312,6 +1312,7 @@ static int sd_init_command(struct scsi_cmnd *cmd)
 static void sd_uninit_command(struct scsi_cmnd *SCpnt)
 {
         struct request *rq = SCpnt->request;
+        u8 *cmnd;
 
         if (SCpnt->flags & SCMD_ZONE_WRITE_LOCK)
                 sd_zbc_write_unlock_zone(SCpnt);
@@ -1320,9 +1321,10 @@ static void sd_uninit_command(struct scsi_cmnd *SCpnt)
                 __free_page(rq->special_vec.bv_page);
 
         if (SCpnt->cmnd != scsi_req(rq)->cmd) {
-                mempool_free(SCpnt->cmnd, sd_cdb_pool);
+                cmnd = SCpnt->cmnd;
                 SCpnt->cmnd = NULL;
                 SCpnt->cmd_len = 0;
+                mempool_free(cmnd, sd_cdb_pool);
         }
 }
 
diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c
index 1b06cf0375dc..3b3d1d050cac 100644
--- a/drivers/scsi/storvsc_drv.c
+++ b/drivers/scsi/storvsc_drv.c
@@ -953,10 +953,11 @@ static void storvsc_handle_error(struct vmscsi_request *vm_srb,
                 case TEST_UNIT_READY:
                         break;
                 default:
-                        set_host_byte(scmnd, DID_TARGET_FAILURE);
+                        set_host_byte(scmnd, DID_ERROR);
                 }
                 break;
         case SRB_STATUS_INVALID_LUN:
+                set_host_byte(scmnd, DID_NO_CONNECT);
                 do_work = true;
                 process_err_fn = storvsc_remove_lun;
                 break;
diff --git a/drivers/spi/spi-armada-3700.c b/drivers/spi/spi-armada-3700.c
index 77fe55ce790c..d65345312527 100644
--- a/drivers/spi/spi-armada-3700.c
+++ b/drivers/spi/spi-armada-3700.c
@@ -79,6 +79,7 @@
 #define A3700_SPI_BYTE_LEN              BIT(5)
 #define A3700_SPI_CLK_PRESCALE          BIT(0)
 #define A3700_SPI_CLK_PRESCALE_MASK     (0x1f)
+#define A3700_SPI_CLK_EVEN_OFFS         (0x10)
 
 #define A3700_SPI_WFIFO_THRS_BIT        28
 #define A3700_SPI_RFIFO_THRS_BIT        24
@@ -220,6 +221,13 @@ static void a3700_spi_clock_set(struct a3700_spi *a3700_spi,
 
         prescale = DIV_ROUND_UP(clk_get_rate(a3700_spi->clk), speed_hz);
 
+        /* For prescaler values over 15, we can only set it by steps of 2.
+         * Starting from A3700_SPI_CLK_EVEN_OFFS, we set values from 0 up to
+         * 30. We only use this range from 16 to 30.
+         */
+        if (prescale > 15)
+                prescale = A3700_SPI_CLK_EVEN_OFFS + DIV_ROUND_UP(prescale, 2);
+
         val = spireg_read(a3700_spi, A3700_SPI_IF_CFG_REG);
         val = val & ~A3700_SPI_CLK_PRESCALE_MASK;
 
diff --git a/drivers/spi/spi-atmel.c b/drivers/spi/spi-atmel.c
index f95da364c283..669470971023 100644
--- a/drivers/spi/spi-atmel.c
+++ b/drivers/spi/spi-atmel.c
@@ -1661,12 +1661,12 @@ static int atmel_spi_remove(struct platform_device *pdev)
         pm_runtime_get_sync(&pdev->dev);
 
         /* reset the hardware and block queue progress */
-        spin_lock_irq(&as->lock);
         if (as->use_dma) {
                 atmel_spi_stop_dma(master);
                 atmel_spi_release_dma(master);
         }
 
+        spin_lock_irq(&as->lock);
         spi_writel(as, CR, SPI_BIT(SWRST));
         spi_writel(as, CR, SPI_BIT(SWRST)); /* AT91SAM9263 Rev B workaround */
         spi_readl(as, SR);
diff --git a/drivers/spi/spi-rspi.c b/drivers/spi/spi-rspi.c
index 2ce875764ca6..0835a8d88fb8 100644
--- a/drivers/spi/spi-rspi.c
+++ b/drivers/spi/spi-rspi.c
@@ -377,8 +377,8 @@ static int qspi_set_config_register(struct rspi_data *rspi, int access_size)
         /* Sets SPCMD */
         rspi_write16(rspi, rspi->spcmd, RSPI_SPCMD0);
 
-        /* Enables SPI function in master mode */
-        rspi_write8(rspi, SPCR_SPE | SPCR_MSTR, RSPI_SPCR);
+        /* Sets RSPI mode */
+        rspi_write8(rspi, SPCR_MSTR, RSPI_SPCR);
 
         return 0;
 }
diff --git a/drivers/spi/spi-sun4i.c b/drivers/spi/spi-sun4i.c
index c5cd635c28f3..41410031f8e9 100644
--- a/drivers/spi/spi-sun4i.c
+++ b/drivers/spi/spi-sun4i.c
@@ -525,7 +525,7 @@ err_free_master:
 
 static int sun4i_spi_remove(struct platform_device *pdev)
 {
-        pm_runtime_disable(&pdev->dev);
+        pm_runtime_force_suspend(&pdev->dev);
 
         return 0;
 }
diff --git a/drivers/spi/spi-xilinx.c b/drivers/spi/spi-xilinx.c
index bc7100b93dfc..e0b9fe1d0e37 100644
--- a/drivers/spi/spi-xilinx.c
+++ b/drivers/spi/spi-xilinx.c
@@ -271,6 +271,7 @@ static int xilinx_spi_txrx_bufs(struct spi_device *spi, struct spi_transfer *t)
         while (remaining_words) {
                 int n_words, tx_words, rx_words;
                 u32 sr;
+                int stalled;
 
                 n_words = min(remaining_words, xspi->buffer_size);
 
@@ -299,7 +300,17 @@ static int xilinx_spi_txrx_bufs(struct spi_device *spi, struct spi_transfer *t)
 
                 /* Read out all the data from the Rx FIFO */
                 rx_words = n_words;
+                stalled = 10;
                 while (rx_words) {
+                        if (rx_words == n_words && !(stalled--) &&
+                            !(sr & XSPI_SR_TX_EMPTY_MASK) &&
+                            (sr & XSPI_SR_RX_EMPTY_MASK)) {
+                                dev_err(&spi->dev,
+                                        "Detected stall. Check C_SPI_MODE and C_SPI_MEMORY\n");
+                                xspi_init_hw(xspi);
+                                return -EIO;
+                        }
+
                         if ((sr & XSPI_SR_TX_EMPTY_MASK) && (rx_words > 1)) {
                                 xilinx_spi_rx(xspi);
                                 rx_words--;
diff --git a/drivers/staging/android/ion/Kconfig b/drivers/staging/android/ion/Kconfig
index a517b2d29f1b..8f6494158d3d 100644
--- a/drivers/staging/android/ion/Kconfig
+++ b/drivers/staging/android/ion/Kconfig
@@ -37,7 +37,7 @@ config ION_CHUNK_HEAP
 
 config ION_CMA_HEAP
         bool "Ion CMA heap support"
-        depends on ION && CMA
+        depends on ION && DMA_CMA
         help
           Choose this option to enable CMA heaps with Ion. This heap is backed
           by the Contiguous Memory Allocator (CMA). If your system has these
diff --git a/drivers/staging/android/ion/ion.c b/drivers/staging/android/ion/ion.c
index a7d9b0e98572..f480885e346b 100644
--- a/drivers/staging/android/ion/ion.c
+++ b/drivers/staging/android/ion/ion.c
@@ -346,7 +346,7 @@ static int ion_dma_buf_begin_cpu_access(struct dma_buf *dmabuf,
         mutex_lock(&buffer->lock);
         list_for_each_entry(a, &buffer->attachments, list) {
                 dma_sync_sg_for_cpu(a->dev, a->table->sgl, a->table->nents,
-                                    DMA_BIDIRECTIONAL);
+                                    direction);
         }
         mutex_unlock(&buffer->lock);
 
@@ -368,7 +368,7 @@ static int ion_dma_buf_end_cpu_access(struct dma_buf *dmabuf,
         mutex_lock(&buffer->lock);
         list_for_each_entry(a, &buffer->attachments, list) {
                 dma_sync_sg_for_device(a->dev, a->table->sgl, a->table->nents,
-                                       DMA_BIDIRECTIONAL);
+                                       direction);
         }
         mutex_unlock(&buffer->lock);
 
diff --git a/drivers/staging/android/ion/ion_cma_heap.c b/drivers/staging/android/ion/ion_cma_heap.c
index dd5545d9990a..86196ffd2faf 100644
--- a/drivers/staging/android/ion/ion_cma_heap.c
+++ b/drivers/staging/android/ion/ion_cma_heap.c
@@ -39,9 +39,15 @@ static int ion_cma_allocate(struct ion_heap *heap, struct ion_buffer *buffer,
         struct ion_cma_heap *cma_heap = to_cma_heap(heap);
         struct sg_table *table;
         struct page *pages;
+        unsigned long size = PAGE_ALIGN(len);
+        unsigned long nr_pages = size >> PAGE_SHIFT;
+        unsigned long align = get_order(size);
         int ret;
 
-        pages = cma_alloc(cma_heap->cma, len, 0, GFP_KERNEL);
+        if (align > CONFIG_CMA_ALIGNMENT)
+                align = CONFIG_CMA_ALIGNMENT;
+
+        pages = cma_alloc(cma_heap->cma, nr_pages, align, GFP_KERNEL);
         if (!pages)
                 return -ENOMEM;
 
@@ -53,7 +59,7 @@ static int ion_cma_allocate(struct ion_heap *heap, struct ion_buffer *buffer,
         if (ret)
                 goto free_mem;
 
-        sg_set_page(table->sgl, pages, len, 0);
+        sg_set_page(table->sgl, pages, size, 0);
 
         buffer->priv_virt = pages;
         buffer->sg_table = table;
@@ -62,7 +68,7 @@ static int ion_cma_allocate(struct ion_heap *heap, struct ion_buffer *buffer,
 free_mem:
         kfree(table);
 err:
-        cma_release(cma_heap->cma, pages, buffer->size);
+        cma_release(cma_heap->cma, pages, nr_pages);
         return -ENOMEM;
 }
 
@@ -70,9 +76,10 @@ static void ion_cma_free(struct ion_buffer *buffer)
 {
         struct ion_cma_heap *cma_heap = to_cma_heap(buffer->heap);
         struct page *pages = buffer->priv_virt;
+        unsigned long nr_pages = PAGE_ALIGN(buffer->size) >> PAGE_SHIFT;
 
         /* release memory */
-        cma_release(cma_heap->cma, pages, buffer->size);
+        cma_release(cma_heap->cma, pages, nr_pages);
         /* release sg table */
         sg_free_table(buffer->sg_table);
         kfree(buffer->sg_table);
diff --git a/drivers/staging/ccree/ssi_hash.c b/drivers/staging/ccree/ssi_hash.c
index 1799d3f26a9e..2035835b62dc 100644
--- a/drivers/staging/ccree/ssi_hash.c
+++ b/drivers/staging/ccree/ssi_hash.c
@@ -1769,7 +1769,7 @@ static int ssi_ahash_import(struct ahash_request *req, const void *in)
         struct device *dev = drvdata_to_dev(ctx->drvdata);
         struct ahash_req_ctx *state = ahash_request_ctx(req);
         u32 tmp;
-        int rc;
+        int rc = 0;
 
         memcpy(&tmp, in, sizeof(u32));
         if (tmp != CC_EXPORT_MAGIC) {
diff --git a/drivers/staging/lustre/lnet/klnds/socklnd/socklnd.c b/drivers/staging/lustre/lnet/klnds/socklnd/socklnd.c
index 986c2a40d978..8267119ccc8e 100644
--- a/drivers/staging/lustre/lnet/klnds/socklnd/socklnd.c
+++ b/drivers/staging/lustre/lnet/klnds/socklnd/socklnd.c
@@ -487,21 +487,18 @@ ksocknal_add_peer(struct lnet_ni *ni, struct lnet_process_id id, __u32 ipaddr,
                               ksocknal_nid2peerlist(id.nid));
         }
 
-        route2 = NULL;
         list_for_each_entry(route2, &peer->ksnp_routes, ksnr_list) {
-                if (route2->ksnr_ipaddr == ipaddr)
-                        break;
-
-                route2 = NULL;
-        }
-        if (!route2) {
-                ksocknal_add_route_locked(peer, route);
-                route->ksnr_share_count++;
-        } else {
-                ksocknal_route_decref(route);
-                route2->ksnr_share_count++;
+                if (route2->ksnr_ipaddr == ipaddr) {
+                        /* Route already exists, use the old one */
+                        ksocknal_route_decref(route);
+                        route2->ksnr_share_count++;
+                        goto out;
+                }
         }
-
+        /* Route doesn't already exist, add the new one */
+        ksocknal_add_route_locked(peer, route);
+        route->ksnr_share_count++;
+out:
         write_unlock_bh(&ksocknal_data.ksnd_global_lock);
 
         return 0;
diff --git a/drivers/staging/pi433/rf69.c b/drivers/staging/pi433/rf69.c
index e69a2153c999..12c9df9cddde 100644
--- a/drivers/staging/pi433/rf69.c
+++ b/drivers/staging/pi433/rf69.c
@@ -102,7 +102,7 @@ enum modulation rf69_get_modulation(struct spi_device *spi)
 
         currentValue = READ_REG(REG_DATAMODUL);
 
-        switch (currentValue & MASK_DATAMODUL_MODULATION_TYPE >> 3) { // TODO improvement: change 3 to define
+        switch (currentValue & MASK_DATAMODUL_MODULATION_TYPE) {
         case DATAMODUL_MODULATION_TYPE_OOK: return OOK;
         case DATAMODUL_MODULATION_TYPE_FSK: return FSK;
         default:                            return undefined;
diff --git a/drivers/target/target_core_pscsi.c b/drivers/target/target_core_pscsi.c
index 7c69b4a9694d..0d99b242e82e 100644
--- a/drivers/target/target_core_pscsi.c
+++ b/drivers/target/target_core_pscsi.c
@@ -920,7 +920,7 @@ pscsi_map_sg(struct se_cmd *cmd, struct scatterlist *sgl, u32 sgl_nents,
                                         " %d i: %d bio: %p, allocating another"
                                         " bio\n", bio->bi_vcnt, i, bio);
 
-                                rc = blk_rq_append_bio(req, bio);
+                                rc = blk_rq_append_bio(req, &bio);
                                 if (rc) {
                                         pr_err("pSCSI: failed to append bio\n");
                                         goto fail;
@@ -938,7 +938,7 @@ pscsi_map_sg(struct se_cmd *cmd, struct scatterlist *sgl, u32 sgl_nents,
         }
 
         if (bio) {
-                rc = blk_rq_append_bio(req, bio);
+                rc = blk_rq_append_bio(req, &bio);
                 if (rc) {
                         pr_err("pSCSI: failed to append bio\n");
                         goto fail;
diff --git a/drivers/thunderbolt/nhi.c b/drivers/thunderbolt/nhi.c
index 419a7a90bce0..f45bcbc63738 100644
--- a/drivers/thunderbolt/nhi.c
+++ b/drivers/thunderbolt/nhi.c
@@ -339,7 +339,7 @@ static void __ring_interrupt(struct tb_ring *ring)
                 return;
 
         if (ring->start_poll) {
-                __ring_interrupt_mask(ring, false);
+                __ring_interrupt_mask(ring, true);
                 ring->start_poll(ring->poll_data);
         } else {
                 schedule_work(&ring->work);
diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
index 427e0d5d8f13..539b49adb6af 100644
--- a/drivers/tty/n_tty.c
+++ b/drivers/tty/n_tty.c
@@ -1762,7 +1762,7 @@ static void n_tty_set_termios(struct tty_struct *tty, struct ktermios *old)
 {
         struct n_tty_data *ldata = tty->disc_data;
 
-        if (!old || (old->c_lflag ^ tty->termios.c_lflag) & ICANON) {
+        if (!old || (old->c_lflag ^ tty->termios.c_lflag) & (ICANON | EXTPROC)) {
                 bitmap_zero(ldata->read_flags, N_TTY_BUF_SIZE);
                 ldata->line_start = ldata->read_tail;
                 if (!L_ICANON(tty) || !read_cnt(ldata)) {
@@ -2425,7 +2425,7 @@ static int n_tty_ioctl(struct tty_struct *tty, struct file *file,
                 return put_user(tty_chars_in_buffer(tty), (int __user *) arg);
         case TIOCINQ:
                 down_write(&tty->termios_rwsem);
-                if (L_ICANON(tty))
+                if (L_ICANON(tty) && !L_EXTPROC(tty))
                         retval = inq_canon(ldata);
                 else
                         retval = read_cnt(ldata);
diff --git a/drivers/usb/chipidea/ci_hdrc_msm.c b/drivers/usb/chipidea/ci_hdrc_msm.c
index 3593ce0ec641..880009987460 100644
--- a/drivers/usb/chipidea/ci_hdrc_msm.c
+++ b/drivers/usb/chipidea/ci_hdrc_msm.c
@@ -247,7 +247,7 @@ static int ci_hdrc_msm_probe(struct platform_device *pdev)
         if (ret)
                 goto err_mux;
 
-        ulpi_node = of_find_node_by_name(of_node_get(pdev->dev.of_node), "ulpi");
+        ulpi_node = of_get_child_by_name(pdev->dev.of_node, "ulpi");
         if (ulpi_node) {
                 phy_node = of_get_next_available_child(ulpi_node, NULL);
                 ci->hsic = of_device_is_compatible(phy_node, "qcom,usb-hsic-phy");
diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
index 55b198ba629b..c821b4b9647e 100644
--- a/drivers/usb/core/config.c
+++ b/drivers/usb/core/config.c
@@ -555,6 +555,9 @@ static int usb_parse_configuration(struct usb_device *dev, int cfgidx,
         unsigned iad_num = 0;
 
         memcpy(&config->desc, buffer, USB_DT_CONFIG_SIZE);
+        nintf = nintf_orig = config->desc.bNumInterfaces;
+        config->desc.bNumInterfaces = 0;        // Adjusted later
+
         if (config->desc.bDescriptorType != USB_DT_CONFIG ||
             config->desc.bLength < USB_DT_CONFIG_SIZE ||
             config->desc.bLength > size) {
@@ -568,7 +571,6 @@ static int usb_parse_configuration(struct usb_device *dev, int cfgidx,
         buffer += config->desc.bLength;
         size -= config->desc.bLength;
 
-        nintf = nintf_orig = config->desc.bNumInterfaces;
         if (nintf > USB_MAXINTERFACES) {
                 dev_warn(ddev, "config %d has too many interfaces: %d, "
                     "using maximum allowed: %d\n",
@@ -1005,7 +1007,7 @@ int usb_get_bos_descriptor(struct usb_device *dev)
                 case USB_SSP_CAP_TYPE:
                         ssp_cap = (struct usb_ssp_cap_descriptor *)buffer;
                         ssac = (le32_to_cpu(ssp_cap->bmAttributes) &
-                                USB_SSP_SUBLINK_SPEED_ATTRIBS) + 1;
+                                USB_SSP_SUBLINK_SPEED_ATTRIBS);
                         if (length >= USB_DT_USB_SSP_CAP_SIZE(ssac))
                                 dev->bos->ssp_cap = ssp_cap;
                         break;
diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index a10b346b9777..4024926c1d68 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -52,10 +52,11 @@ static const struct usb_device_id usb_quirk_list[] = {
         /* Microsoft LifeCam-VX700 v2.0 */
         { USB_DEVICE(0x045e, 0x0770), .driver_info = USB_QUIRK_RESET_RESUME },
 
-        /* Logitech HD Pro Webcams C920, C920-C and C930e */
+        /* Logitech HD Pro Webcams C920, C920-C, C925e and C930e */
         { USB_DEVICE(0x046d, 0x082d), .driver_info = USB_QUIRK_DELAY_INIT },
         { USB_DEVICE(0x046d, 0x0841), .driver_info = USB_QUIRK_DELAY_INIT },
         { USB_DEVICE(0x046d, 0x0843), .driver_info = USB_QUIRK_DELAY_INIT },
+        { USB_DEVICE(0x046d, 0x085b), .driver_info = USB_QUIRK_DELAY_INIT },
 
         /* Logitech ConferenceCam CC3000e */
         { USB_DEVICE(0x046d, 0x0847), .driver_info = USB_QUIRK_DELAY_INIT },
@@ -149,6 +150,9 @@ static const struct usb_device_id usb_quirk_list[] = {
         /* Genesys Logic hub, internally used by KY-688 USB 3.1 Type-C Hub */
         { USB_DEVICE(0x05e3, 0x0612), .driver_info = USB_QUIRK_NO_LPM },
 
+        /* ELSA MicroLink 56K */
+        { USB_DEVICE(0x05cc, 0x2267), .driver_info = USB_QUIRK_RESET_RESUME },
+
         /* Genesys Logic hub, internally used by Moshi USB to Ethernet Adapter */
         { USB_DEVICE(0x05e3, 0x0616), .driver_info = USB_QUIRK_NO_LPM },
 
diff --git a/drivers/usb/dwc2/core.h b/drivers/usb/dwc2/core.h
index f66c94130cac..31749c79045f 100644
--- a/drivers/usb/dwc2/core.h
+++ b/drivers/usb/dwc2/core.h
@@ -537,6 +537,7 @@ struct dwc2_core_params {
  *                       2 - Internal DMA
  * @power_optimized     Are power optimizations enabled?
  * @num_dev_ep          Number of device endpoints available
+ * @num_dev_in_eps      Number of device IN endpoints available
  * @num_dev_perio_in_ep Number of device periodic IN endpoints
  *                      available
  * @dev_token_q_depth   Device Mode IN Token Sequence Learning Queue
@@ -565,6 +566,7 @@ struct dwc2_core_params {
  *                       2 - 8 or 16 bits
  * @snpsid:             Value from SNPSID register
  * @dev_ep_dirs:        Direction of device endpoints (GHWCFG1)
+ * @g_tx_fifo_size[]    Power-on values of TxFIFO sizes
  */
 struct dwc2_hw_params {
         unsigned op_mode:3;
@@ -586,12 +588,14 @@ struct dwc2_hw_params {
         unsigned fs_phy_type:2;
         unsigned i2c_enable:1;
         unsigned num_dev_ep:4;
+        unsigned num_dev_in_eps : 4;
         unsigned num_dev_perio_in_ep:4;
         unsigned total_fifo_size:16;
         unsigned power_optimized:1;
         unsigned utmi_phy_data_width:2;
         u32 snpsid;
         u32 dev_ep_dirs;
+        u32 g_tx_fifo_size[MAX_EPS_CHANNELS];
 };
 
 /* Size of control and EP0 buffers */
diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
index 88529d092503..e4c3ce0de5de 100644
--- a/drivers/usb/dwc2/gadget.c
+++ b/drivers/usb/dwc2/gadget.c
@@ -195,55 +195,18 @@ int dwc2_hsotg_tx_fifo_count(struct dwc2_hsotg *hsotg)
 {
         if (hsotg->hw_params.en_multiple_tx_fifo)
                 /* In dedicated FIFO mode we need count of IN EPs */
-                return (dwc2_readl(hsotg->regs + GHWCFG4)  &
-                        GHWCFG4_NUM_IN_EPS_MASK) >> GHWCFG4_NUM_IN_EPS_SHIFT;
+                return hsotg->hw_params.num_dev_in_eps;
         else
                 /* In shared FIFO mode we need count of Periodic IN EPs */
                 return hsotg->hw_params.num_dev_perio_in_ep;
 }
 
 /**
- * dwc2_hsotg_ep_info_size - return Endpoint Info Control block size in DWORDs
- */
-static int dwc2_hsotg_ep_info_size(struct dwc2_hsotg *hsotg)
-{
-        int val = 0;
-        int i;
-        u32 ep_dirs;
-
-        /*
-         * Don't need additional space for ep info control registers in
-         * slave mode.
-         */
-        if (!using_dma(hsotg)) {
-                dev_dbg(hsotg->dev, "Buffer DMA ep info size 0\n");
-                return 0;
-        }
-
-        /*
-         * Buffer DMA mode - 1 location per endpoit
-         * Descriptor DMA mode - 4 locations per endpoint
-         */
-        ep_dirs = hsotg->hw_params.dev_ep_dirs;
-
-        for (i = 0; i <= hsotg->hw_params.num_dev_ep; i++) {
-                val += ep_dirs & 3 ? 1 : 2;
-                ep_dirs >>= 2;
-        }
-
-        if (using_desc_dma(hsotg))
-                val = val * 4;
-
-        return val;
-}
-
-/**
  * dwc2_hsotg_tx_fifo_total_depth - return total FIFO depth available for
  * device mode TX FIFOs
  */
 int dwc2_hsotg_tx_fifo_total_depth(struct dwc2_hsotg *hsotg)
 {
-        int ep_info_size;
         int addr;
         int tx_addr_max;
         u32 np_tx_fifo_size;
@@ -252,8 +215,7 @@ int dwc2_hsotg_tx_fifo_total_depth(struct dwc2_hsotg *hsotg)
                                 hsotg->params.g_np_tx_fifo_size);
 
         /* Get Endpoint Info Control block size in DWORDs. */
-        ep_info_size = dwc2_hsotg_ep_info_size(hsotg);
-        tx_addr_max = hsotg->hw_params.total_fifo_size - ep_info_size;
+        tx_addr_max = hsotg->hw_params.total_fifo_size;
 
         addr = hsotg->params.g_rx_fifo_size + np_tx_fifo_size;
         if (tx_addr_max <= addr)
diff --git a/drivers/usb/dwc2/params.c b/drivers/usb/dwc2/params.c
index ef73af6e03a9..03fd20f0b496 100644
--- a/drivers/usb/dwc2/params.c
+++ b/drivers/usb/dwc2/params.c
@@ -484,8 +484,7 @@ static void dwc2_check_param_tx_fifo_sizes(struct dwc2_hsotg *hsotg)
         }
 
         for (fifo = 1; fifo <= fifo_count; fifo++) {
-                dptxfszn = (dwc2_readl(hsotg->regs + DPTXFSIZN(fifo)) &
-                        FIFOSIZE_DEPTH_MASK) >> FIFOSIZE_DEPTH_SHIFT;
+                dptxfszn = hsotg->hw_params.g_tx_fifo_size[fifo];
 
                 if (hsotg->params.g_tx_fifo_size[fifo] < min ||
                     hsotg->params.g_tx_fifo_size[fifo] >  dptxfszn) {
@@ -609,6 +608,7 @@ static void dwc2_get_dev_hwparams(struct dwc2_hsotg *hsotg)
         struct dwc2_hw_params *hw = &hsotg->hw_params;
         bool forced;
         u32 gnptxfsiz;
+        int fifo, fifo_count;
 
         if (hsotg->dr_mode == USB_DR_MODE_HOST)
                 return;
@@ -617,6 +617,14 @@ static void dwc2_get_dev_hwparams(struct dwc2_hsotg *hsotg)
 
         gnptxfsiz = dwc2_readl(hsotg->regs + GNPTXFSIZ);
 
+        fifo_count = dwc2_hsotg_tx_fifo_count(hsotg);
+
+        for (fifo = 1; fifo <= fifo_count; fifo++) {
+                hw->g_tx_fifo_size[fifo] =
+                        (dwc2_readl(hsotg->regs + DPTXFSIZN(fifo)) &
+                         FIFOSIZE_DEPTH_MASK) >> FIFOSIZE_DEPTH_SHIFT;
+        }
+
         if (forced)
                 dwc2_clear_force_mode(hsotg);
 
@@ -661,14 +669,6 @@ int dwc2_get_hwparams(struct dwc2_hsotg *hsotg)
         hwcfg4 = dwc2_readl(hsotg->regs + GHWCFG4);
         grxfsiz = dwc2_readl(hsotg->regs + GRXFSIZ);
 
-        /*
-         * Host specific hardware parameters. Reading these parameters
-         * requires the controller to be in host mode. The mode will
-         * be forced, if necessary, to read these values.
-         */
-        dwc2_get_host_hwparams(hsotg);
-        dwc2_get_dev_hwparams(hsotg);
-
         /* hwcfg1 */
         hw->dev_ep_dirs = hwcfg1;
 
@@ -711,6 +711,8 @@ int dwc2_get_hwparams(struct dwc2_hsotg *hsotg)
         hw->en_multiple_tx_fifo = !!(hwcfg4 & GHWCFG4_DED_FIFO_EN);
         hw->num_dev_perio_in_ep = (hwcfg4 & GHWCFG4_NUM_DEV_PERIO_IN_EP_MASK) >>
                                   GHWCFG4_NUM_DEV_PERIO_IN_EP_SHIFT;
+        hw->num_dev_in_eps = (hwcfg4 & GHWCFG4_NUM_IN_EPS_MASK) >>
+                             GHWCFG4_NUM_IN_EPS_SHIFT;
         hw->dma_desc_enable = !!(hwcfg4 & GHWCFG4_DESC_DMA);
         hw->power_optimized = !!(hwcfg4 & GHWCFG4_POWER_OPTIMIZ);
         hw->utmi_phy_data_width = (hwcfg4 & GHWCFG4_UTMI_PHY_DATA_WIDTH_MASK) >>
@@ -719,6 +721,13 @@ int dwc2_get_hwparams(struct dwc2_hsotg *hsotg)
         /* fifo sizes */
         hw->rx_fifo_size = (grxfsiz & GRXFSIZ_DEPTH_MASK) >>
                                 GRXFSIZ_DEPTH_SHIFT;
+        /*
+         * Host specific hardware parameters. Reading these parameters
+         * requires the controller to be in host mode. The mode will
+         * be forced, if necessary, to read these values.
+         */
+        dwc2_get_host_hwparams(hsotg);
+        dwc2_get_dev_hwparams(hsotg);
 
         return 0;
 }
diff --git a/drivers/usb/dwc3/dwc3-of-simple.c b/drivers/usb/dwc3/dwc3-of-simple.c
index c4a4d7bd2766..7ae0eefc7cc7 100644
--- a/drivers/usb/dwc3/dwc3-of-simple.c
+++ b/drivers/usb/dwc3/dwc3-of-simple.c
@@ -51,8 +51,10 @@ static int dwc3_of_simple_clk_init(struct dwc3_of_simple *simple, int count)
 
                 clk = of_clk_get(np, i);
                 if (IS_ERR(clk)) {
-                        while (--i >= 0)
+                        while (--i >= 0) {
+                                clk_disable_unprepare(simple->clks[i]);
                                 clk_put(simple->clks[i]);
+                        }
                         return PTR_ERR(clk);
                 }
 
@@ -203,6 +205,7 @@ static struct platform_driver dwc3_of_simple_driver = {
         .driver         = {
                 .name   = "dwc3-of-simple",
                 .of_match_table = of_dwc3_simple_match,
+                .pm     = &dwc3_of_simple_dev_pm_ops,
         },
 };
 
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 981fd986cf82..639dd1b163a0 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -259,7 +259,7 @@ int dwc3_send_gadget_ep_cmd(struct dwc3_ep *dep, unsigned cmd,
 {
         const struct usb_endpoint_descriptor *desc = dep->endpoint.desc;
         struct dwc3             *dwc = dep->dwc;
-        u32                     timeout = 500;
+        u32                     timeout = 1000;
         u32                     reg;
 
         int                     cmd_status = 0;
@@ -912,7 +912,7 @@ static void __dwc3_prepare_one_trb(struct dwc3_ep *dep, struct dwc3_trb *trb,
                          */
                         if (speed == USB_SPEED_HIGH) {
                                 struct usb_ep *ep = &dep->endpoint;
-                                unsigned int mult = ep->mult - 1;
+                                unsigned int mult = 2;
                                 unsigned int maxp = usb_endpoint_maxp(ep->desc);
 
                                 if (length <= (2 * maxp))
diff --git a/drivers/usb/gadget/Kconfig b/drivers/usb/gadget/Kconfig
index 0a19a76645ad..31cce7805eb2 100644
--- a/drivers/usb/gadget/Kconfig
+++ b/drivers/usb/gadget/Kconfig
@@ -508,8 +508,8 @@ choice
           controller, and the relevant drivers for each function declared
           by the device.
 
-endchoice
-
 source "drivers/usb/gadget/legacy/Kconfig"
 
+endchoice
+
 endif # USB_GADGET
diff --git a/drivers/usb/gadget/legacy/Kconfig b/drivers/usb/gadget/legacy/Kconfig
index 9570bbeced4f..784bf86dad4f 100644
--- a/drivers/usb/gadget/legacy/Kconfig
+++ b/drivers/usb/gadget/legacy/Kconfig
@@ -13,14 +13,6 @@
 # both kinds of controller can also support "USB On-the-Go" (CONFIG_USB_OTG).
 #
 
-menuconfig USB_GADGET_LEGACY
-        bool "Legacy USB Gadget Support"
-        help
-           Legacy USB gadgets are USB gadgets that do not use the USB gadget
-           configfs interface.
-
-if USB_GADGET_LEGACY
-
 config USB_ZERO
         tristate "Gadget Zero (DEVELOPMENT)"
         select USB_LIBCOMPOSITE
@@ -487,7 +479,7 @@ endif
 # or video class gadget drivers), or specific hardware, here.
 config USB_G_WEBCAM
         tristate "USB Webcam Gadget"
-        depends on VIDEO_DEV
+        depends on VIDEO_V4L2
         select USB_LIBCOMPOSITE
         select VIDEOBUF2_VMALLOC
         select USB_F_UVC
@@ -498,5 +490,3 @@ config USB_G_WEBCAM
 
           Say "y" to link the driver statically, or "m" to build a
           dynamically linked module called "g_webcam".
-
-endif
diff --git a/drivers/usb/host/xhci-debugfs.c b/drivers/usb/host/xhci-debugfs.c
index 4f7895dbcf88..e26e685d8a57 100644
--- a/drivers/usb/host/xhci-debugfs.c
+++ b/drivers/usb/host/xhci-debugfs.c
@@ -162,7 +162,7 @@ static void xhci_debugfs_extcap_regset(struct xhci_hcd *xhci, int cap_id,
 static int xhci_ring_enqueue_show(struct seq_file *s, void *unused)
 {
         dma_addr_t              dma;
-        struct xhci_ring        *ring = s->private;
+        struct xhci_ring        *ring = *(struct xhci_ring **)s->private;
 
         dma = xhci_trb_virt_to_dma(ring->enq_seg, ring->enqueue);
         seq_printf(s, "%pad\n", &dma);
@@ -173,7 +173,7 @@ static int xhci_ring_enqueue_show(struct seq_file *s, void *unused)
 static int xhci_ring_dequeue_show(struct seq_file *s, void *unused)
 {
         dma_addr_t              dma;
-        struct xhci_ring        *ring = s->private;
+        struct xhci_ring        *ring = *(struct xhci_ring **)s->private;
 
         dma = xhci_trb_virt_to_dma(ring->deq_seg, ring->dequeue);
         seq_printf(s, "%pad\n", &dma);
@@ -183,7 +183,7 @@ static int xhci_ring_dequeue_show(struct seq_file *s, void *unused)
 
 static int xhci_ring_cycle_show(struct seq_file *s, void *unused)
 {
-        struct xhci_ring        *ring = s->private;
+        struct xhci_ring        *ring = *(struct xhci_ring **)s->private;
 
         seq_printf(s, "%d\n", ring->cycle_state);
 
@@ -346,7 +346,7 @@ static void xhci_debugfs_create_files(struct xhci_hcd *xhci,
 }
 
 static struct dentry *xhci_debugfs_create_ring_dir(struct xhci_hcd *xhci,
-                                                   struct xhci_ring *ring,
+                                                   struct xhci_ring **ring,
                                                    const char *name,
                                                    struct dentry *parent)
 {
@@ -387,7 +387,7 @@ void xhci_debugfs_create_endpoint(struct xhci_hcd *xhci,
 
         snprintf(epriv->name, sizeof(epriv->name), "ep%02d", ep_index);
         epriv->root = xhci_debugfs_create_ring_dir(xhci,
-                                                   dev->eps[ep_index].new_ring,
+                                                   &dev->eps[ep_index].new_ring,
                                                    epriv->name,
                                                    spriv->root);
         spriv->eps[ep_index] = epriv;
@@ -423,7 +423,7 @@ void xhci_debugfs_create_slot(struct xhci_hcd *xhci, int slot_id)
         priv->dev = dev;
         dev->debugfs_private = priv;
 
-        xhci_debugfs_create_ring_dir(xhci, dev->eps[0].ring,
+        xhci_debugfs_create_ring_dir(xhci, &dev->eps[0].ring,
                                      "ep00", priv->root);
 
         xhci_debugfs_create_context_files(xhci, priv->root, slot_id);
@@ -488,11 +488,11 @@ void xhci_debugfs_init(struct xhci_hcd *xhci)
                                    ARRAY_SIZE(xhci_extcap_dbc),
                                    "reg-ext-dbc");
 
-        xhci_debugfs_create_ring_dir(xhci, xhci->cmd_ring,
+        xhci_debugfs_create_ring_dir(xhci, &xhci->cmd_ring,
                                      "command-ring",
                                      xhci->debugfs_root);
 
-        xhci_debugfs_create_ring_dir(xhci, xhci->event_ring,
+        xhci_debugfs_create_ring_dir(xhci, &xhci->event_ring,
                                      "event-ring",
                                      xhci->debugfs_root);
 
diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
index 15f7d422885f..3a29b32a3bd0 100644
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -971,10 +971,9 @@ int xhci_alloc_virt_device(struct xhci_hcd *xhci, int slot_id,
                 return 0;
         }
 
-        xhci->devs[slot_id] = kzalloc(sizeof(*xhci->devs[slot_id]), flags);
-        if (!xhci->devs[slot_id])
+        dev = kzalloc(sizeof(*dev), flags);
+        if (!dev)
                 return 0;
-        dev = xhci->devs[slot_id];
 
         /* Allocate the (output) device context that will be used in the HC. */
         dev->out_ctx = xhci_alloc_container_ctx(xhci, XHCI_CTX_TYPE_DEVICE, flags);
@@ -1015,9 +1014,17 @@ int xhci_alloc_virt_device(struct xhci_hcd *xhci, int slot_id,
 
         trace_xhci_alloc_virt_device(dev);
 
+        xhci->devs[slot_id] = dev;
+
         return 1;
 fail:
-        xhci_free_virt_device(xhci, slot_id);
+
+        if (dev->in_ctx)
+                xhci_free_container_ctx(xhci, dev->in_ctx);
+        if (dev->out_ctx)
+                xhci_free_container_ctx(xhci, dev->out_ctx);
+        kfree(dev);
+
         return 0;
 }
 
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index 7ef1274ef7f7..1aad89b8aba0 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -178,6 +178,9 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
                 xhci->quirks |= XHCI_BROKEN_STREAMS;
         }
         if (pdev->vendor == PCI_VENDOR_ID_RENESAS &&
+                        pdev->device == 0x0014)
+                xhci->quirks |= XHCI_TRUST_TX_LENGTH;
+        if (pdev->vendor == PCI_VENDOR_ID_RENESAS &&
                         pdev->device == 0x0015)
                 xhci->quirks |= XHCI_RESET_ON_RESUME;
         if (pdev->vendor == PCI_VENDOR_ID_VIA)
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 6eb87c6e4d24..c5cbc685c691 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -3112,7 +3112,7 @@ static u32 xhci_td_remainder(struct xhci_hcd *xhci, int transferred,
 {
         u32 maxp, total_packet_count;
 
-        /* MTK xHCI is mostly 0.97 but contains some features from 1.0 */
+        /* MTK xHCI 0.96 contains some features from 1.0 */
         if (xhci->hci_version < 0x100 && !(xhci->quirks & XHCI_MTK_HOST))
                 return ((td_total_len - transferred) >> 10);
 
@@ -3121,8 +3121,8 @@ static u32 xhci_td_remainder(struct xhci_hcd *xhci, int transferred,
             trb_buff_len == td_total_len)
                 return 0;
 
-        /* for MTK xHCI, TD size doesn't include this TRB */
-        if (xhci->quirks & XHCI_MTK_HOST)
+        /* for MTK xHCI 0.96, TD size include this TRB, but not in 1.x */
+        if ((xhci->quirks & XHCI_MTK_HOST) && (xhci->hci_version < 0x100))
                 trb_buff_len = 0;
 
         maxp = usb_endpoint_maxp(&urb->ep->desc);
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 2424d3020ca3..da6dbe3ebd8b 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -3525,8 +3525,6 @@ static void xhci_free_dev(struct usb_hcd *hcd, struct usb_device *udev)
         struct xhci_slot_ctx *slot_ctx;
         int i, ret;
 
-        xhci_debugfs_remove_slot(xhci, udev->slot_id);
-
 #ifndef CONFIG_USB_DEFAULT_PERSIST
         /*
          * We called pm_runtime_get_noresume when the device was attached.
@@ -3555,8 +3553,10 @@ static void xhci_free_dev(struct usb_hcd *hcd, struct usb_device *udev)
         }
 
         ret = xhci_disable_slot(xhci, udev->slot_id);
-        if (ret)
+        if (ret) {
+                xhci_debugfs_remove_slot(xhci, udev->slot_id);
                 xhci_free_virt_device(xhci, udev->slot_id);
+        }
 }
 
 int xhci_disable_slot(struct xhci_hcd *xhci, u32 slot_id)
diff --git a/drivers/usb/musb/da8xx.c b/drivers/usb/musb/da8xx.c
index 0397606a211b..6c036de63272 100644
--- a/drivers/usb/musb/da8xx.c
+++ b/drivers/usb/musb/da8xx.c
@@ -284,7 +284,15 @@ static irqreturn_t da8xx_musb_interrupt(int irq, void *hci)
                         musb->xceiv->otg->state = OTG_STATE_A_WAIT_VRISE;
                         portstate(musb->port1_status |= USB_PORT_STAT_POWER);
                         del_timer(&musb->dev_timer);
-                } else {
+                } else if (!(musb->int_usb & MUSB_INTR_BABBLE)) {
+                        /*
+                         * When babble condition happens, drvvbus interrupt
+                         * is also generated. Ignore this drvvbus interrupt
+                         * and let babble interrupt handler recovers the
+                         * controller; otherwise, the host-mode flag is lost
+                         * due to the MUSB_DEV_MODE() call below and babble
+                         * recovery logic will not be called.
+                         */
                         musb->is_active = 0;
                         MUSB_DEV_MODE(musb);
                         otg->default_a = 0;
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 1aba9105b369..fc68952c994a 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -1013,6 +1013,7 @@ static const struct usb_device_id id_table_combined[] = {
                 .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
         { USB_DEVICE(CYPRESS_VID, CYPRESS_WICED_BT_USB_PID) },
         { USB_DEVICE(CYPRESS_VID, CYPRESS_WICED_WL_USB_PID) },
+        { USB_DEVICE(AIRBUS_DS_VID, AIRBUS_DS_P8GR) },
         { }                                     /* Terminating entry */
 };
 
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index 4faa09fe308c..8b4ecd2bd297 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -915,6 +915,12 @@
 #define ICPDAS_I7563U_PID               0x0105
 
 /*
+ * Airbus Defence and Space
+ */
+#define AIRBUS_DS_VID                   0x1e8e  /* Vendor ID */
+#define AIRBUS_DS_P8GR                  0x6001  /* Tetra P8GR */
+
+/*
  * RT Systems programming cables for various ham radios
  */
 #define RTSYSTEMS_VID           0x2100  /* Vendor ID */
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 3b3513874cfd..b6320e3be429 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -233,6 +233,8 @@ static void option_instat_callback(struct urb *urb);
 /* These Quectel products use Qualcomm's vendor ID */
 #define QUECTEL_PRODUCT_UC20                    0x9003
 #define QUECTEL_PRODUCT_UC15                    0x9090
+/* These Yuga products use Qualcomm's vendor ID */
+#define YUGA_PRODUCT_CLM920_NC5                 0x9625
 
 #define QUECTEL_VENDOR_ID                       0x2c7c
 /* These Quectel products use Quectel's vendor ID */
@@ -280,6 +282,7 @@ static void option_instat_callback(struct urb *urb);
 #define TELIT_PRODUCT_LE922_USBCFG3             0x1043
 #define TELIT_PRODUCT_LE922_USBCFG5             0x1045
 #define TELIT_PRODUCT_ME910                     0x1100
+#define TELIT_PRODUCT_ME910_DUAL_MODEM          0x1101
 #define TELIT_PRODUCT_LE920                     0x1200
 #define TELIT_PRODUCT_LE910                     0x1201
 #define TELIT_PRODUCT_LE910_USBCFG4             0x1206
@@ -645,6 +648,11 @@ static const struct option_blacklist_info telit_me910_blacklist = {
         .reserved = BIT(1) | BIT(3),
 };
 
+static const struct option_blacklist_info telit_me910_dual_modem_blacklist = {
+        .sendsetup = BIT(0),
+        .reserved = BIT(3),
+};
+
 static const struct option_blacklist_info telit_le910_blacklist = {
         .sendsetup = BIT(0),
         .reserved = BIT(1) | BIT(2),
@@ -674,6 +682,10 @@ static const struct option_blacklist_info cinterion_rmnet2_blacklist = {
         .reserved = BIT(4) | BIT(5),
 };
 
+static const struct option_blacklist_info yuga_clm920_nc5_blacklist = {
+        .reserved = BIT(1) | BIT(4),
+};
+
 static const struct usb_device_id option_ids[] = {
         { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COLT) },
         { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_RICOLA) },
@@ -1178,6 +1190,9 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE(QUALCOMM_VENDOR_ID, QUECTEL_PRODUCT_UC15)},
         { USB_DEVICE(QUALCOMM_VENDOR_ID, QUECTEL_PRODUCT_UC20),
           .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+        /* Yuga products use Qualcomm vendor ID */
+        { USB_DEVICE(QUALCOMM_VENDOR_ID, YUGA_PRODUCT_CLM920_NC5),
+          .driver_info = (kernel_ulong_t)&yuga_clm920_nc5_blacklist },
         /* Quectel products using Quectel vendor ID */
         { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC21),
           .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
@@ -1244,6 +1259,8 @@ static const struct usb_device_id option_ids[] = {
                 .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg0 },
         { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910),
                 .driver_info = (kernel_ulong_t)&telit_me910_blacklist },
+        { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910_DUAL_MODEM),
+                .driver_info = (kernel_ulong_t)&telit_me910_dual_modem_blacklist },
         { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910),
                 .driver_info = (kernel_ulong_t)&telit_le910_blacklist },
         { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910_USBCFG4),
diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
index e3892541a489..613f91add03d 100644
--- a/drivers/usb/serial/qcserial.c
+++ b/drivers/usb/serial/qcserial.c
@@ -162,6 +162,8 @@ static const struct usb_device_id id_table[] = {
         {DEVICE_SWI(0x1199, 0x9079)},   /* Sierra Wireless EM74xx */
         {DEVICE_SWI(0x1199, 0x907a)},   /* Sierra Wireless EM74xx QDL */
         {DEVICE_SWI(0x1199, 0x907b)},   /* Sierra Wireless EM74xx */
+        {DEVICE_SWI(0x1199, 0x9090)},   /* Sierra Wireless EM7565 QDL */
+        {DEVICE_SWI(0x1199, 0x9091)},   /* Sierra Wireless EM7565 */
         {DEVICE_SWI(0x413c, 0x81a2)},   /* Dell Wireless 5806 Gobi(TM) 4G LTE Mobile Broadband Card */
         {DEVICE_SWI(0x413c, 0x81a3)},   /* Dell Wireless 5570 HSPA+ (42Mbps) Mobile Broadband Card */
         {DEVICE_SWI(0x413c, 0x81a4)},   /* Dell Wireless 5570e HSPA+ (42Mbps) Mobile Broadband Card */
@@ -342,6 +344,7 @@ static int qcprobe(struct usb_serial *serial, const struct usb_device_id *id)
                         break;
                 case 2:
                         dev_dbg(dev, "NMEA GPS interface found\n");
+                        sendsetup = true;
                         break;
                 case 3:
                         dev_dbg(dev, "Modem port found\n");
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index 2968046e7c05..f72d045ee9ef 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -2100,6 +2100,13 @@ UNUSUAL_DEV(  0x152d, 0x0567, 0x0114, 0x0116,
                 USB_SC_DEVICE, USB_PR_DEVICE, NULL,
                 US_FL_BROKEN_FUA ),
 
+/* Reported by David Kozub <zub@linux.fjfi.cvut.cz> */
+UNUSUAL_DEV(0x152d, 0x0578, 0x0000, 0x9999,
+                "JMicron",
+                "JMS567",
+                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+                US_FL_BROKEN_FUA),
+
 /*
  * Reported by Alexandre Oliva <oliva@lsd.ic.unicamp.br>
  * JMicron responds to USN and several other SCSI ioctls with a
diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h
index d520374a824e..e6127fb21c12 100644
--- a/drivers/usb/storage/unusual_uas.h
+++ b/drivers/usb/storage/unusual_uas.h
@@ -129,6 +129,13 @@ UNUSUAL_DEV(0x152d, 0x0567, 0x0000, 0x9999,
                 USB_SC_DEVICE, USB_PR_DEVICE, NULL,
                 US_FL_BROKEN_FUA | US_FL_NO_REPORT_OPCODES),
 
+/* Reported-by: David Kozub <zub@linux.fjfi.cvut.cz> */
+UNUSUAL_DEV(0x152d, 0x0578, 0x0000, 0x9999,
+                "JMicron",
+                "JMS567",
+                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+                US_FL_BROKEN_FUA),
+
 /* Reported-by: Hans de Goede <hdegoede@redhat.com> */
 UNUSUAL_DEV(0x2109, 0x0711, 0x0000, 0x9999,
                 "VIA",
diff --git a/drivers/usb/usbip/stub_dev.c b/drivers/usb/usbip/stub_dev.c
index a3df8ee82faf..e31a6f204397 100644
--- a/drivers/usb/usbip/stub_dev.c
+++ b/drivers/usb/usbip/stub_dev.c
@@ -149,8 +149,7 @@ static void stub_shutdown_connection(struct usbip_device *ud)
          * step 1?
          */
         if (ud->tcp_socket) {
-                dev_dbg(&sdev->udev->dev, "shutdown tcp_socket %p\n",
-                        ud->tcp_socket);
+                dev_dbg(&sdev->udev->dev, "shutdown sockfd %d\n", ud->sockfd);
                 kernel_sock_shutdown(ud->tcp_socket, SHUT_RDWR);
         }
 
diff --git a/drivers/usb/usbip/stub_main.c b/drivers/usb/usbip/stub_main.c
index 4f48b306713f..c31c8402a0c5 100644
--- a/drivers/usb/usbip/stub_main.c
+++ b/drivers/usb/usbip/stub_main.c
@@ -237,11 +237,12 @@ void stub_device_cleanup_urbs(struct stub_device *sdev)
         struct stub_priv *priv;
         struct urb *urb;
 
-        dev_dbg(&sdev->udev->dev, "free sdev %p\n", sdev);
+        dev_dbg(&sdev->udev->dev, "Stub device cleaning up urbs\n");
 
         while ((priv = stub_priv_pop(sdev))) {
                 urb = priv->urb;
-                dev_dbg(&sdev->udev->dev, "free urb %p\n", urb);
+                dev_dbg(&sdev->udev->dev, "free urb seqnum %lu\n",
+                        priv->seqnum);
                 usb_kill_urb(urb);
 
                 kmem_cache_free(stub_priv_cache, priv);
diff --git a/drivers/usb/usbip/stub_rx.c b/drivers/usb/usbip/stub_rx.c
index 536e037f541f..6c5a59313999 100644
--- a/drivers/usb/usbip/stub_rx.c
+++ b/drivers/usb/usbip/stub_rx.c
@@ -211,9 +211,6 @@ static int stub_recv_cmd_unlink(struct stub_device *sdev,
                 if (priv->seqnum != pdu->u.cmd_unlink.seqnum)
                         continue;
 
-                dev_info(&priv->urb->dev->dev, "unlink urb %p\n",
-                         priv->urb);
-
                 /*
                  * This matched urb is not completed yet (i.e., be in
                  * flight in usb hcd hardware/driver). Now we are
@@ -252,8 +249,8 @@ static int stub_recv_cmd_unlink(struct stub_device *sdev,
                 ret = usb_unlink_urb(priv->urb);
                 if (ret != -EINPROGRESS)
                         dev_err(&priv->urb->dev->dev,
-                                "failed to unlink a urb %p, ret %d\n",
-                                priv->urb, ret);
+                                "failed to unlink a urb # %lu, ret %d\n",
+                                priv->seqnum, ret);
 
                 return 0;
         }
@@ -322,23 +319,26 @@ static struct stub_priv *stub_priv_alloc(struct stub_device *sdev,
         return priv;
 }
 
-static int get_pipe(struct stub_device *sdev, int epnum, int dir)
+static int get_pipe(struct stub_device *sdev, struct usbip_header *pdu)
 {
         struct usb_device *udev = sdev->udev;
         struct usb_host_endpoint *ep;
         struct usb_endpoint_descriptor *epd = NULL;
+        int epnum = pdu->base.ep;
+        int dir = pdu->base.direction;
+
+        if (epnum < 0 || epnum > 15)
+                goto err_ret;
 
         if (dir == USBIP_DIR_IN)
                 ep = udev->ep_in[epnum & 0x7f];
         else
                 ep = udev->ep_out[epnum & 0x7f];
-        if (!ep) {
-                dev_err(&sdev->udev->dev, "no such endpoint?, %d\n",
-                        epnum);
-                BUG();
-        }
+        if (!ep)
+                goto err_ret;
 
         epd = &ep->desc;
+
         if (usb_endpoint_xfer_control(epd)) {
                 if (dir == USBIP_DIR_OUT)
                         return usb_sndctrlpipe(udev, epnum);
@@ -361,15 +361,31 @@ static int get_pipe(struct stub_device *sdev, int epnum, int dir)
         }
 
         if (usb_endpoint_xfer_isoc(epd)) {
+                /* validate packet size and number of packets */
+                unsigned int maxp, packets, bytes;
+
+                maxp = usb_endpoint_maxp(epd);
+                maxp *= usb_endpoint_maxp_mult(epd);
+                bytes = pdu->u.cmd_submit.transfer_buffer_length;
+                packets = DIV_ROUND_UP(bytes, maxp);
+
+                if (pdu->u.cmd_submit.number_of_packets < 0 ||
+                    pdu->u.cmd_submit.number_of_packets > packets) {
+                        dev_err(&sdev->udev->dev,
+                                "CMD_SUBMIT: isoc invalid num packets %d\n",
+                                pdu->u.cmd_submit.number_of_packets);
+                        return -1;
+                }
                 if (dir == USBIP_DIR_OUT)
                         return usb_sndisocpipe(udev, epnum);
                 else
                         return usb_rcvisocpipe(udev, epnum);
         }
 
+err_ret:
         /* NOT REACHED */
-        dev_err(&sdev->udev->dev, "get pipe, epnum %d\n", epnum);
-        return 0;
+        dev_err(&sdev->udev->dev, "CMD_SUBMIT: invalid epnum %d\n", epnum);
+        return -1;
 }
 
 static void masking_bogus_flags(struct urb *urb)
@@ -433,7 +449,10 @@ static void stub_recv_cmd_submit(struct stub_device *sdev,
         struct stub_priv *priv;
         struct usbip_device *ud = &sdev->ud;
         struct usb_device *udev = sdev->udev;
-        int pipe = get_pipe(sdev, pdu->base.ep, pdu->base.direction);
+        int pipe = get_pipe(sdev, pdu);
+
+        if (pipe == -1)
+                return;
 
         priv = stub_priv_alloc(sdev, pdu);
         if (!priv)
diff --git a/drivers/usb/usbip/stub_tx.c b/drivers/usb/usbip/stub_tx.c
index b18bce96c212..f0ec41a50cbc 100644
--- a/drivers/usb/usbip/stub_tx.c
+++ b/drivers/usb/usbip/stub_tx.c
@@ -88,7 +88,7 @@ void stub_complete(struct urb *urb)
         /* link a urb to the queue of tx. */
         spin_lock_irqsave(&sdev->priv_lock, flags);
         if (sdev->ud.tcp_socket == NULL) {
-                usbip_dbg_stub_tx("ignore urb for closed connection %p", urb);
+                usbip_dbg_stub_tx("ignore urb for closed connection\n");
                 /* It will be freed in stub_device_cleanup_urbs(). */
         } else if (priv->unlinking) {
                 stub_enqueue_ret_unlink(sdev, priv->seqnum, urb->status);
@@ -167,6 +167,13 @@ static int stub_send_ret_submit(struct stub_device *sdev)
                 memset(&pdu_header, 0, sizeof(pdu_header));
                 memset(&msg, 0, sizeof(msg));
 
+                if (urb->actual_length > 0 && !urb->transfer_buffer) {
+                        dev_err(&sdev->udev->dev,
+                                "urb: actual_length %d transfer_buffer null\n",
+                                urb->actual_length);
+                        return -1;
+                }
+
                 if (usb_pipetype(urb->pipe) == PIPE_ISOCHRONOUS)
                         iovnum = 2 + urb->number_of_packets;
                 else
@@ -183,8 +190,8 @@ static int stub_send_ret_submit(struct stub_device *sdev)
 
                 /* 1. setup usbip_header */
                 setup_ret_submit_pdu(&pdu_header, urb);
-                usbip_dbg_stub_tx("setup txdata seqnum: %d urb: %p\n",
-                                  pdu_header.base.seqnum, urb);
+                usbip_dbg_stub_tx("setup txdata seqnum: %d\n",
+                                  pdu_header.base.seqnum);
                 usbip_header_correct_endian(&pdu_header, 1);
 
                 iov[iovnum].iov_base = &pdu_header;
diff --git a/drivers/usb/usbip/usbip_common.c b/drivers/usb/usbip/usbip_common.c
index f7978933b402..7b219d9109b4 100644
--- a/drivers/usb/usbip/usbip_common.c
+++ b/drivers/usb/usbip/usbip_common.c
@@ -317,26 +317,20 @@ int usbip_recv(struct socket *sock, void *buf, int size)
         struct msghdr msg = {.msg_flags = MSG_NOSIGNAL};
         int total = 0;
 
+        if (!sock || !buf || !size)
+                return -EINVAL;
+
         iov_iter_kvec(&msg.msg_iter, READ|ITER_KVEC, &iov, 1, size);
 
         usbip_dbg_xmit("enter\n");
 
-        if (!sock || !buf || !size) {
-                pr_err("invalid arg, sock %p buff %p size %d\n", sock, buf,
-                       size);
-                return -EINVAL;
-        }
-
         do {
-                int sz = msg_data_left(&msg);
+                msg_data_left(&msg);
                 sock->sk->sk_allocation = GFP_NOIO;
 
                 result = sock_recvmsg(sock, &msg, MSG_WAITALL);
-                if (result <= 0) {
-                        pr_debug("receive sock %p buf %p size %u ret %d total %d\n",
-                                 sock, buf + total, sz, result, total);
+                if (result <= 0)
                         goto err;
-                }
 
                 total += result;
         } while (msg_data_left(&msg));
diff --git a/drivers/usb/usbip/usbip_common.h b/drivers/usb/usbip/usbip_common.h
index e5de35c8c505..473fb8a87289 100644
--- a/drivers/usb/usbip/usbip_common.h
+++ b/drivers/usb/usbip/usbip_common.h
@@ -256,6 +256,7 @@ struct usbip_device {
         /* lock for status */
         spinlock_t lock;
 
+        int sockfd;
         struct socket *tcp_socket;
 
         struct task_struct *tcp_rx;
diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c
index 6b3278c4b72a..c3e1008aa491 100644
--- a/drivers/usb/usbip/vhci_hcd.c
+++ b/drivers/usb/usbip/vhci_hcd.c
@@ -656,9 +656,6 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag
         struct vhci_device *vdev;
         unsigned long flags;
 
-        usbip_dbg_vhci_hc("enter, usb_hcd %p urb %p mem_flags %d\n",
-                          hcd, urb, mem_flags);
-
         if (portnum > VHCI_HC_PORTS) {
                 pr_err("invalid port number %d\n", portnum);
                 return -ENODEV;
@@ -822,8 +819,6 @@ static int vhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
         struct vhci_device *vdev;
         unsigned long flags;
 
-        pr_info("dequeue a urb %p\n", urb);
-
         spin_lock_irqsave(&vhci->lock, flags);
 
         priv = urb->hcpriv;
@@ -851,7 +846,6 @@ static int vhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
                 /* tcp connection is closed */
                 spin_lock(&vdev->priv_lock);
 
-                pr_info("device %p seems to be disconnected\n", vdev);
                 list_del(&priv->list);
                 kfree(priv);
                 urb->hcpriv = NULL;
@@ -863,8 +857,6 @@ static int vhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
                  * vhci_rx will receive RET_UNLINK and give back the URB.
                  * Otherwise, we give back it here.
                  */
-                pr_info("gives back urb %p\n", urb);
-
                 usb_hcd_unlink_urb_from_ep(hcd, urb);
 
                 spin_unlock_irqrestore(&vhci->lock, flags);
@@ -892,8 +884,6 @@ static int vhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
 
                 unlink->unlink_seqnum = priv->seqnum;
 
-                pr_info("device %p seems to be still connected\n", vdev);
-
                 /* send cmd_unlink and try to cancel the pending URB in the
                  * peer */
                 list_add_tail(&unlink->list, &vdev->unlink_tx);
@@ -975,7 +965,7 @@ static void vhci_shutdown_connection(struct usbip_device *ud)
 
         /* need this? see stub_dev.c */
         if (ud->tcp_socket) {
-                pr_debug("shutdown tcp_socket %p\n", ud->tcp_socket);
+                pr_debug("shutdown tcp_socket %d\n", ud->sockfd);
                 kernel_sock_shutdown(ud->tcp_socket, SHUT_RDWR);
         }
 
diff --git a/drivers/usb/usbip/vhci_rx.c b/drivers/usb/usbip/vhci_rx.c
index 90577e8b2282..112ebb90d8c9 100644
--- a/drivers/usb/usbip/vhci_rx.c
+++ b/drivers/usb/usbip/vhci_rx.c
@@ -23,24 +23,23 @@ struct urb *pickup_urb_and_free_priv(struct vhci_device *vdev, __u32 seqnum)
                 urb = priv->urb;
                 status = urb->status;
 
-                usbip_dbg_vhci_rx("find urb %p vurb %p seqnum %u\n",
-                                urb, priv, seqnum);
+                usbip_dbg_vhci_rx("find urb seqnum %u\n", seqnum);
 
                 switch (status) {
                 case -ENOENT:
                         /* fall through */
                 case -ECONNRESET:
-                        dev_info(&urb->dev->dev,
-                                 "urb %p was unlinked %ssynchronuously.\n", urb,
-                                 status == -ENOENT ? "" : "a");
+                        dev_dbg(&urb->dev->dev,
+                                 "urb seq# %u was unlinked %ssynchronuously\n",
+                                 seqnum, status == -ENOENT ? "" : "a");
                         break;
                 case -EINPROGRESS:
                         /* no info output */
                         break;
                 default:
-                        dev_info(&urb->dev->dev,
-                                 "urb %p may be in a error, status %d\n", urb,
-                                 status);
+                        dev_dbg(&urb->dev->dev,
+                                 "urb seq# %u may be in a error, status %d\n",
+                                 seqnum, status);
                 }
 
                 list_del(&priv->list);
@@ -67,8 +66,8 @@ static void vhci_recv_ret_submit(struct vhci_device *vdev,
         spin_unlock_irqrestore(&vdev->priv_lock, flags);
 
         if (!urb) {
-                pr_err("cannot find a urb of seqnum %u\n", pdu->base.seqnum);
-                pr_info("max seqnum %d\n",
+                pr_err("cannot find a urb of seqnum %u max seqnum %d\n",
+                        pdu->base.seqnum,
                         atomic_read(&vhci_hcd->seqnum));
                 usbip_event_add(ud, VDEV_EVENT_ERROR_TCP);
                 return;
@@ -91,7 +90,7 @@ static void vhci_recv_ret_submit(struct vhci_device *vdev,
         if (usbip_dbg_flag_vhci_rx)
                 usbip_dump_urb(urb);
 
-        usbip_dbg_vhci_rx("now giveback urb %p\n", urb);
+        usbip_dbg_vhci_rx("now giveback urb %u\n", pdu->base.seqnum);
 
         spin_lock_irqsave(&vhci->lock, flags);
         usb_hcd_unlink_urb_from_ep(vhci_hcd_to_hcd(vhci_hcd), urb);
@@ -158,7 +157,7 @@ static void vhci_recv_ret_unlink(struct vhci_device *vdev,
                 pr_info("the urb (seqnum %d) was already given back\n",
                         pdu->base.seqnum);
         } else {
-                usbip_dbg_vhci_rx("now giveback urb %p\n", urb);
+                usbip_dbg_vhci_rx("now giveback urb %d\n", pdu->base.seqnum);
 
                 /* If unlink is successful, status is -ECONNRESET */
                 urb->status = pdu->u.ret_unlink.status;
diff --git a/drivers/usb/usbip/vhci_sysfs.c b/drivers/usb/usbip/vhci_sysfs.c
index e78f7472cac4..091f76b7196d 100644
--- a/drivers/usb/usbip/vhci_sysfs.c
+++ b/drivers/usb/usbip/vhci_sysfs.c
@@ -17,15 +17,20 @@
 
 /*
  * output example:
- * hub port sta spd dev      socket           local_busid
- * hs  0000 004 000 00000000         c5a7bb80 1-2.3
+ * hub port sta spd dev       sockfd    local_busid
+ * hs  0000 004 000 00000000  3         1-2.3
  * ................................................
- * ss  0008 004 000 00000000         d8cee980 2-3.4
+ * ss  0008 004 000 00000000  4         2-3.4
  * ................................................
  *
- * IP address can be retrieved from a socket pointer address by looking
- * up /proc/net/{tcp,tcp6}. Also, a userland program may remember a
- * port number and its peer IP address.
+ * Output includes socket fd instead of socket pointer address to avoid
+ * leaking kernel memory address in:
+ *      /sys/devices/platform/vhci_hcd.0/status and in debug output.
+ * The socket pointer address is not used at the moment and it was made
+ * visible as a convenient way to find IP address from socket pointer
+ * address by looking up /proc/net/{tcp,tcp6}. As this opens a security
+ * hole, the change is made to use sockfd instead.
+ *
  */
 static void port_show_vhci(char **out, int hub, int port, struct vhci_device *vdev)
 {
@@ -39,8 +44,8 @@ static void port_show_vhci(char **out, int hub, int port, struct vhci_device *vd
         if (vdev->ud.status == VDEV_ST_USED) {
                 *out += sprintf(*out, "%03u %08x ",
                                       vdev->speed, vdev->devid);
-                *out += sprintf(*out, "%16p %s",
-                                      vdev->ud.tcp_socket,
+                *out += sprintf(*out, "%u %s",
+                                      vdev->ud.sockfd,
                                       dev_name(&vdev->udev->dev));
 
         } else {
@@ -160,7 +165,8 @@ static ssize_t nports_show(struct device *dev, struct device_attribute *attr,
         char *s = out;
 
         /*
-         * Half the ports are for SPEED_HIGH and half for SPEED_SUPER, thus the * 2.
+         * Half the ports are for SPEED_HIGH and half for SPEED_SUPER,
+         * thus the * 2.
          */
         out += sprintf(out, "%d\n", VHCI_PORTS * vhci_num_controllers);
         return out - s;
@@ -366,6 +372,7 @@ static ssize_t store_attach(struct device *dev, struct device_attribute *attr,
 
         vdev->devid         = devid;
         vdev->speed         = speed;
+        vdev->ud.sockfd     = sockfd;
         vdev->ud.tcp_socket = socket;
         vdev->ud.status     = VDEV_ST_NOTASSIGNED;
 
diff --git a/drivers/usb/usbip/vhci_tx.c b/drivers/usb/usbip/vhci_tx.c
index d625a2ff4b71..9aed15a358b7 100644
--- a/drivers/usb/usbip/vhci_tx.c
+++ b/drivers/usb/usbip/vhci_tx.c
@@ -69,7 +69,8 @@ static int vhci_send_cmd_submit(struct vhci_device *vdev)
                 memset(&msg, 0, sizeof(msg));
                 memset(&iov, 0, sizeof(iov));
 
-                usbip_dbg_vhci_tx("setup txdata urb %p\n", urb);
+                usbip_dbg_vhci_tx("setup txdata urb seqnum %lu\n",
+                                  priv->seqnum);
 
                 /* 1. setup usbip_header */
                 setup_cmd_submit_pdu(&pdu_header, urb);
diff --git a/drivers/virtio/virtio_mmio.c b/drivers/virtio/virtio_mmio.c
index a9192fe4f345..c92131edfaba 100644
--- a/drivers/virtio/virtio_mmio.c
+++ b/drivers/virtio/virtio_mmio.c
@@ -522,10 +522,8 @@ static int virtio_mmio_probe(struct platform_device *pdev)
                 return -EBUSY;
 
         vm_dev = devm_kzalloc(&pdev->dev, sizeof(*vm_dev), GFP_KERNEL);
-        if (!vm_dev) {
-                rc = -ENOMEM;
-                goto free_mem;
-        }
+        if (!vm_dev)
+                return -ENOMEM;
 
         vm_dev->vdev.dev.parent = &pdev->dev;
         vm_dev->vdev.dev.release = virtio_mmio_release_dev;
@@ -535,17 +533,14 @@ static int virtio_mmio_probe(struct platform_device *pdev)
         spin_lock_init(&vm_dev->lock);
 
         vm_dev->base = devm_ioremap(&pdev->dev, mem->start, resource_size(mem));
-        if (vm_dev->base == NULL) {
-                rc = -EFAULT;
-                goto free_vmdev;
-        }
+        if (vm_dev->base == NULL)
+                return -EFAULT;
 
         /* Check magic value */
         magic = readl(vm_dev->base + VIRTIO_MMIO_MAGIC_VALUE);
         if (magic != ('v' | 'i' << 8 | 'r' << 16 | 't' << 24)) {
                 dev_warn(&pdev->dev, "Wrong magic value 0x%08lx!\n", magic);
-                rc = -ENODEV;
-                goto unmap;
+                return -ENODEV;
         }
 
         /* Check device version */
@@ -553,8 +548,7 @@ static int virtio_mmio_probe(struct platform_device *pdev)
         if (vm_dev->version < 1 || vm_dev->version > 2) {
                 dev_err(&pdev->dev, "Version %ld not supported!\n",
                                 vm_dev->version);
-                rc = -ENXIO;
-                goto unmap;
+                return -ENXIO;
         }
 
         vm_dev->vdev.id.device = readl(vm_dev->base + VIRTIO_MMIO_DEVICE_ID);
@@ -563,8 +557,7 @@ static int virtio_mmio_probe(struct platform_device *pdev)
                  * virtio-mmio device with an ID 0 is a (dummy) placeholder
                  * with no function. End probing now with no error reported.
                  */
-                rc = -ENODEV;
-                goto unmap;
+                return -ENODEV;
         }
         vm_dev->vdev.id.vendor = readl(vm_dev->base + VIRTIO_MMIO_VENDOR_ID);
 
@@ -590,33 +583,15 @@ static int virtio_mmio_probe(struct platform_device *pdev)
         platform_set_drvdata(pdev, vm_dev);
 
         rc = register_virtio_device(&vm_dev->vdev);
-        if (rc) {
-                iounmap(vm_dev->base);
-                devm_release_mem_region(&pdev->dev, mem->start,
-                                        resource_size(mem));
+        if (rc)
                 put_device(&vm_dev->vdev.dev);
-        }
-        return rc;
-unmap:
-        iounmap(vm_dev->base);
-free_mem:
-        devm_release_mem_region(&pdev->dev, mem->start,
-                        resource_size(mem));
-free_vmdev:
-        devm_kfree(&pdev->dev, vm_dev);
+
         return rc;
 }
 
 static int virtio_mmio_remove(struct platform_device *pdev)
 {
         struct virtio_mmio_device *vm_dev = platform_get_drvdata(pdev);
-        struct resource *mem;
-
-        iounmap(vm_dev->base);
-        mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-        if (mem)
-                devm_release_mem_region(&pdev->dev, mem->start,
-                        resource_size(mem));
         unregister_virtio_device(&vm_dev->vdev);
 
         return 0;
diff --git a/drivers/xen/Kconfig b/drivers/xen/Kconfig
index d8dd54678ab7..e5d0c28372ea 100644
--- a/drivers/xen/Kconfig
+++ b/drivers/xen/Kconfig
@@ -269,7 +269,7 @@ config XEN_ACPI_HOTPLUG_CPU
 
 config XEN_ACPI_PROCESSOR
         tristate "Xen ACPI processor"
-        depends on XEN && X86 && ACPI_PROCESSOR && CPU_FREQ
+        depends on XEN && XEN_DOM0 && X86 && ACPI_PROCESSOR && CPU_FREQ
         default m
         help
           This ACPI processor uploads Power Management information to the Xen
diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c
index f77e499afddd..065f0b607373 100644
--- a/drivers/xen/balloon.c
+++ b/drivers/xen/balloon.c
@@ -257,10 +257,25 @@ static void release_memory_resource(struct resource *resource)
         kfree(resource);
 }
 
+/*
+ * Host memory not allocated to dom0. We can use this range for hotplug-based
+ * ballooning.
+ *
+ * It's a type-less resource. Setting IORESOURCE_MEM will make resource
+ * management algorithms (arch_remove_reservations()) look into guest e820,
+ * which we don't want.
+ */
+static struct resource hostmem_resource = {
+        .name   = "Host RAM",
+};
+
+void __attribute__((weak)) __init arch_xen_balloon_init(struct resource *res)
+{}
+
 static struct resource *additional_memory_resource(phys_addr_t size)
 {
-        struct resource *res;
-        int ret;
+        struct resource *res, *res_hostmem;
+        int ret = -ENOMEM;
 
         res = kzalloc(sizeof(*res), GFP_KERNEL);
         if (!res)
@@ -269,13 +284,42 @@ static struct resource *additional_memory_resource(phys_addr_t size)
         res->name = "System RAM";
         res->flags = IORESOURCE_SYSTEM_RAM | IORESOURCE_BUSY;
 
-        ret = allocate_resource(&iomem_resource, res,
-                                size, 0, -1,
-                                PAGES_PER_SECTION * PAGE_SIZE, NULL, NULL);
-        if (ret < 0) {
-                pr_err("Cannot allocate new System RAM resource\n");
-                kfree(res);
-                return NULL;
+        res_hostmem = kzalloc(sizeof(*res), GFP_KERNEL);
+        if (res_hostmem) {
+                /* Try to grab a range from hostmem */
+                res_hostmem->name = "Host memory";
+                ret = allocate_resource(&hostmem_resource, res_hostmem,
+                                        size, 0, -1,
+                                        PAGES_PER_SECTION * PAGE_SIZE, NULL, NULL);
+        }
+
+        if (!ret) {
+                /*
+                 * Insert this resource into iomem. Because hostmem_resource
+                 * tracks portion of guest e820 marked as UNUSABLE noone else
+                 * should try to use it.
+                 */
+                res->start = res_hostmem->start;
+                res->end = res_hostmem->end;
+                ret = insert_resource(&iomem_resource, res);
+                if (ret < 0) {
+                        pr_err("Can't insert iomem_resource [%llx - %llx]\n",
+                                res->start, res->end);
+                        release_memory_resource(res_hostmem);
+                        res_hostmem = NULL;
+                        res->start = res->end = 0;
+                }
+        }
+
+        if (ret) {
+                ret = allocate_resource(&iomem_resource, res,
+                                        size, 0, -1,
+                                        PAGES_PER_SECTION * PAGE_SIZE, NULL, NULL);
+                if (ret < 0) {
+                        pr_err("Cannot allocate new System RAM resource\n");
+                        kfree(res);
+                        return NULL;
+                }
         }
 
 #ifdef CONFIG_SPARSEMEM
@@ -287,6 +331,7 @@ static struct resource *additional_memory_resource(phys_addr_t size)
                         pr_err("New System RAM resource outside addressable RAM (%lu > %lu)\n",
                                pfn, limit);
                         release_memory_resource(res);
+                        release_memory_resource(res_hostmem);
                         return NULL;
                 }
         }
@@ -765,6 +810,8 @@ static int __init balloon_init(void)
         set_online_page_callback(&xen_online_page);
         register_memory_notifier(&xen_memory_nb);
         register_sysctl_table(xen_root);
+
+        arch_xen_balloon_init(&hostmem_resource);
 #endif
 
 #ifdef CONFIG_XEN_PV