25 files changed, 155 insertions, 58 deletions
diff --git a/drivers/net/dsa/bcm_sf2_cfp.c b/drivers/net/dsa/bcm_sf2_cfp.c
index e6234d209787..4212bc4a5f31 100644
--- a/drivers/net/dsa/bcm_sf2_cfp.c
+++ b/drivers/net/dsa/bcm_sf2_cfp.c
@@ -886,6 +886,9 @@ static int bcm_sf2_cfp_rule_set(struct dsa_switch *ds, int port,
             fs->m_ext.data[1]))
                return -EINVAL;
+        if (fs->location != RX_CLS_LOC_ANY && fs->location >= CFP_NUM_RULES)
+                return -EINVAL;
        if (fs->location != RX_CLS_LOC_ANY &&
            test_bit(fs->location, priv->cfp.used))
                return -EBUSY;
@@ -974,6 +977,9 @@ static int bcm_sf2_cfp_rule_del(struct bcm_sf2_priv *priv, int port, u32 loc)
        struct cfp_rule *rule;
        int ret;
+        if (loc >= CFP_NUM_RULES)
+                return -EINVAL;
        /* Refuse deleting unused rules, and those that are not unique since
         * that could leave IPv6 rules with one of the chained rule in the
         * table.
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index 526f36dcb204..a0de3c368f4a 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -1625,7 +1625,7 @@ static int bnxt_rx_pkt(struct bnxt *bp, struct bnxt_cp_ring_info *cpr,
                        netdev_warn(bp->dev, "RX buffer error %x\n", rx_err);
                        bnxt_sched_reset(bp, rxr);
                }
-                goto next_rx;
+                goto next_rx_no_len;
        }
        len = le32_to_cpu(rxcmp->rx_cmp_len_flags_type) >> RX_CMP_LEN_SHIFT;
@@ -1706,12 +1706,13 @@ static int bnxt_rx_pkt(struct bnxt *bp, struct bnxt_cp_ring_info *cpr,
        rc = 1;
 next_rx:
-        rxr->rx_prod = NEXT_RX(prod);
-        rxr->rx_next_cons = NEXT_RX(cons);
        cpr->rx_packets += 1;
        cpr->rx_bytes += len;
+next_rx_no_len:
+        rxr->rx_prod = NEXT_RX(prod);
+        rxr->rx_next_cons = NEXT_RX(cons);
 next_rx_no_prod_no_len:
        *raw_cons = tmp_raw_cons;
@@ -5135,10 +5136,10 @@ static void bnxt_hwrm_ring_free(struct bnxt *bp, bool close_path)
        for (i = 0; i < bp->tx_nr_rings; i++) {
                struct bnxt_tx_ring_info *txr = &bp->tx_ring[i];
                struct bnxt_ring_struct *ring = &txr->tx_ring_struct;
-                u32 cmpl_ring_id;
-                cmpl_ring_id = bnxt_cp_ring_for_tx(bp, txr);
                if (ring->fw_ring_id != INVALID_HW_RING_ID) {
+                        u32 cmpl_ring_id = bnxt_cp_ring_for_tx(bp, txr);
                        hwrm_ring_free_send_msg(bp, ring,
                                                RING_FREE_REQ_RING_TYPE_TX,
                                                close_path ? cmpl_ring_id :
@@ -5151,10 +5152,10 @@ static void bnxt_hwrm_ring_free(struct bnxt *bp, bool close_path)
                struct bnxt_rx_ring_info *rxr = &bp->rx_ring[i];
                struct bnxt_ring_struct *ring = &rxr->rx_ring_struct;
                u32 grp_idx = rxr->bnapi->index;
-                u32 cmpl_ring_id;
-                cmpl_ring_id = bnxt_cp_ring_for_rx(bp, rxr);
                if (ring->fw_ring_id != INVALID_HW_RING_ID) {
+                        u32 cmpl_ring_id = bnxt_cp_ring_for_rx(bp, rxr);
                        hwrm_ring_free_send_msg(bp, ring,
                                                RING_FREE_REQ_RING_TYPE_RX,
                                                close_path ? cmpl_ring_id :
@@ -5173,10 +5174,10 @@ static void bnxt_hwrm_ring_free(struct bnxt *bp, bool close_path)
                struct bnxt_rx_ring_info *rxr = &bp->rx_ring[i];
                struct bnxt_ring_struct *ring = &rxr->rx_agg_ring_struct;
                u32 grp_idx = rxr->bnapi->index;
-                u32 cmpl_ring_id;
-                cmpl_ring_id = bnxt_cp_ring_for_rx(bp, rxr);
                if (ring->fw_ring_id != INVALID_HW_RING_ID) {
+                        u32 cmpl_ring_id = bnxt_cp_ring_for_rx(bp, rxr);
                        hwrm_ring_free_send_msg(bp, ring, type,
                                                close_path ? cmpl_ring_id :
                                                INVALID_HW_RING_ID);
@@ -5315,17 +5316,16 @@ __bnxt_hwrm_reserve_pf_rings(struct bnxt *bp, struct hwrm_func_cfg_input *req,
        req->num_tx_rings = cpu_to_le16(tx_rings);
        if (BNXT_NEW_RM(bp)) {
                enables |= rx_rings ? FUNC_CFG_REQ_ENABLES_NUM_RX_RINGS : 0;
+                enables |= stats ? FUNC_CFG_REQ_ENABLES_NUM_STAT_CTXS : 0;
                if (bp->flags & BNXT_FLAG_CHIP_P5) {
                        enables |= cp_rings ? FUNC_CFG_REQ_ENABLES_NUM_MSIX : 0;
                        enables |= tx_rings + ring_grps ?
-                                   FUNC_CFG_REQ_ENABLES_NUM_CMPL_RINGS |
+                                   FUNC_CFG_REQ_ENABLES_NUM_CMPL_RINGS : 0;
-                                   FUNC_CFG_REQ_ENABLES_NUM_STAT_CTXS : 0;
                        enables |= rx_rings ?
                                FUNC_CFG_REQ_ENABLES_NUM_RSSCOS_CTXS : 0;
                } else {
                        enables |= cp_rings ?
-                                   FUNC_CFG_REQ_ENABLES_NUM_CMPL_RINGS |
+                                   FUNC_CFG_REQ_ENABLES_NUM_CMPL_RINGS : 0;
-                                   FUNC_CFG_REQ_ENABLES_NUM_STAT_CTXS : 0;
                        enables |= ring_grps ?
                                   FUNC_CFG_REQ_ENABLES_NUM_HW_RING_GRPS |
                                   FUNC_CFG_REQ_ENABLES_NUM_RSSCOS_CTXS : 0;
@@ -5365,14 +5365,13 @@ __bnxt_hwrm_reserve_vf_rings(struct bnxt *bp,
        enables |= tx_rings ? FUNC_VF_CFG_REQ_ENABLES_NUM_TX_RINGS : 0;
        enables |= rx_rings ? FUNC_VF_CFG_REQ_ENABLES_NUM_RX_RINGS |
                              FUNC_VF_CFG_REQ_ENABLES_NUM_RSSCOS_CTXS : 0;
+        enables |= stats ? FUNC_VF_CFG_REQ_ENABLES_NUM_STAT_CTXS : 0;
        if (bp->flags & BNXT_FLAG_CHIP_P5) {
                enables |= tx_rings + ring_grps ?
-                           FUNC_VF_CFG_REQ_ENABLES_NUM_CMPL_RINGS |
+                           FUNC_VF_CFG_REQ_ENABLES_NUM_CMPL_RINGS : 0;
-                           FUNC_VF_CFG_REQ_ENABLES_NUM_STAT_CTXS : 0;
        } else {
                enables |= cp_rings ?
-                           FUNC_VF_CFG_REQ_ENABLES_NUM_CMPL_RINGS |
+                           FUNC_VF_CFG_REQ_ENABLES_NUM_CMPL_RINGS : 0;
-                           FUNC_VF_CFG_REQ_ENABLES_NUM_STAT_CTXS : 0;
                enables |= ring_grps ?
                           FUNC_VF_CFG_REQ_ENABLES_NUM_HW_RING_GRPS : 0;
        }
@@ -6753,6 +6752,7 @@ static int bnxt_hwrm_port_qstats_ext(struct bnxt *bp)
        struct hwrm_queue_pri2cos_qcfg_input req2 = {0};
        struct hwrm_port_qstats_ext_input req = {0};
        struct bnxt_pf_info *pf = &bp->pf;
+        u32 tx_stat_size;
        int rc;
        if (!(bp->flags & BNXT_FLAG_PORT_STATS_EXT))
@@ -6762,13 +6762,16 @@ static int bnxt_hwrm_port_qstats_ext(struct bnxt *bp)
        req.port_id = cpu_to_le16(pf->port_id);
        req.rx_stat_size = cpu_to_le16(sizeof(struct rx_port_stats_ext));
        req.rx_stat_host_addr = cpu_to_le64(bp->hw_rx_port_stats_ext_map);
-        req.tx_stat_size = cpu_to_le16(sizeof(struct tx_port_stats_ext));
+        tx_stat_size = bp->hw_tx_port_stats_ext ?
+                       sizeof(*bp->hw_tx_port_stats_ext) : 0;
+        req.tx_stat_size = cpu_to_le16(tx_stat_size);
        req.tx_stat_host_addr = cpu_to_le64(bp->hw_tx_port_stats_ext_map);
        mutex_lock(&bp->hwrm_cmd_lock);
        rc = _hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT);
        if (!rc) {
                bp->fw_rx_stats_ext_size = le16_to_cpu(resp->rx_stat_size) / 8;
-                bp->fw_tx_stats_ext_size = le16_to_cpu(resp->tx_stat_size) / 8;
+                bp->fw_tx_stats_ext_size = tx_stat_size ?
+                        le16_to_cpu(resp->tx_stat_size) / 8 : 0;
        } else {
                bp->fw_rx_stats_ext_size = 0;
                bp->fw_tx_stats_ext_size = 0;
@@ -8961,8 +8964,15 @@ static int bnxt_cfg_rx_mode(struct bnxt *bp)
 skip_uc:
        rc = bnxt_hwrm_cfa_l2_set_rx_mask(bp, 0);
+        if (rc && vnic->mc_list_count) {
+                netdev_info(bp->dev, "Failed setting MC filters rc: %d, turning on ALL_MCAST mode\n",
+                            rc);
+                vnic->rx_mask |= CFA_L2_SET_RX_MASK_REQ_MASK_ALL_MCAST;
+                vnic->mc_list_count = 0;
+                rc = bnxt_hwrm_cfa_l2_set_rx_mask(bp, 0);
+        }
        if (rc)
-                netdev_err(bp->dev, "HWRM cfa l2 rx mask failure rc: %x\n",
+                netdev_err(bp->dev, "HWRM cfa l2 rx mask failure rc: %d\n",
                           rc);
        return rc;
@@ -10699,6 +10709,7 @@ init_err_cleanup_tc:
        bnxt_clear_int_mode(bp);
 init_err_pci_clean:
+        bnxt_free_hwrm_short_cmd_req(bp);
        bnxt_free_hwrm_resources(bp);
        bnxt_free_ctx_mem(bp);
        kfree(bp->ctx);
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c
index 062a600fa5a7..21428537e231 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c
@@ -333,6 +333,9 @@ static int stm32mp1_parse_data(struct stm32_dwmac *dwmac,
         */
        dwmac->irq_pwr_wakeup = platform_get_irq_byname(pdev,
                                                        "stm32_pwr_wakeup");
+        if (dwmac->irq_pwr_wakeup == -EPROBE_DEFER)
+                return -EPROBE_DEFER;
        if (!dwmac->clk_eth_ck && dwmac->irq_pwr_wakeup >= 0) {
                err = device_init_wakeup(&pdev->dev, true);
                if (err) {
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c
index cc1e887e47b5..26db6aa002d1 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c
@@ -160,7 +160,7 @@ static const struct dmi_system_id quark_pci_dmi[] = {
                .driver_data = (void *)&galileo_stmmac_dmi_data,
        },
        /*
-         * There are 2 types of SIMATIC IOT2000: IOT20202 and IOT2040.
+         * There are 2 types of SIMATIC IOT2000: IOT2020 and IOT2040.
         * The asset tag "6ES7647-0AA00-0YA2" is only for IOT2020 which
         * has only one pci network device while other asset tags are
         * for IOT2040 which has two.
diff --git a/drivers/net/ieee802154/mcr20a.c b/drivers/net/ieee802154/mcr20a.c
index c589f5ae75bb..8bb53ec8d9cf 100644
--- a/drivers/net/ieee802154/mcr20a.c
+++ b/drivers/net/ieee802154/mcr20a.c
@@ -533,6 +533,8 @@ mcr20a_start(struct ieee802154_hw *hw)
        dev_dbg(printdev(lp), "no slotted operation\n");
        ret = regmap_update_bits(lp->regmap_dar, DAR_PHY_CTRL1,
                                 DAR_PHY_CTRL1_SLOTTED, 0x0);
+        if (ret < 0)
+                return ret;
        /* enable irq */
        enable_irq(lp->spi->irq);
@@ -540,11 +542,15 @@ mcr20a_start(struct ieee802154_hw *hw)
        /* Unmask SEQ interrupt */
        ret = regmap_update_bits(lp->regmap_dar, DAR_PHY_CTRL2,
                                 DAR_PHY_CTRL2_SEQMSK, 0x0);
+        if (ret < 0)
+                return ret;
        /* Start the RX sequence */
        dev_dbg(printdev(lp), "start the RX sequence\n");
        ret = regmap_update_bits(lp->regmap_dar, DAR_PHY_CTRL1,
                                 DAR_PHY_CTRL1_XCVSEQ_MASK, MCR20A_XCVSEQ_RX);
+        if (ret < 0)
+                return ret;
        return 0;
 }
diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c
index a7e8c8113d97..a7796134e3be 100644
--- a/drivers/net/phy/marvell.c
+++ b/drivers/net/phy/marvell.c
@@ -1597,9 +1597,10 @@ static int marvell_get_sset_count(struct phy_device *phydev)
 static void marvell_get_strings(struct phy_device *phydev, u8 *data)
 {
+        int count = marvell_get_sset_count(phydev);
        int i;
-        for (i = 0; i < ARRAY_SIZE(marvell_hw_stats); i++) {
+        for (i = 0; i < count; i++) {
                strlcpy(data + i * ETH_GSTRING_LEN,
                        marvell_hw_stats[i].string, ETH_GSTRING_LEN);
        }
@@ -1627,9 +1628,10 @@ static u64 marvell_get_stat(struct phy_device *phydev, int i)
 static void marvell_get_stats(struct phy_device *phydev,
                              struct ethtool_stats *stats, u64 *data)
 {
+        int count = marvell_get_sset_count(phydev);
        int i;
-        for (i = 0; i < ARRAY_SIZE(marvell_hw_stats); i++)
+        for (i = 0; i < count; i++)
                data[i] = marvell_get_stat(phydev, i);
 }
diff --git a/drivers/net/slip/slhc.c b/drivers/net/slip/slhc.c
index f4e93f5fc204..ea90db3c7705 100644
--- a/drivers/net/slip/slhc.c
+++ b/drivers/net/slip/slhc.c
@@ -153,7 +153,7 @@ out_fail:
 void
 slhc_free(struct slcompress *comp)
 {
-        if ( comp == NULLSLCOMPR )
+        if ( IS_ERR_OR_NULL(comp) )
                return;
        if ( comp->tstate != NULLSLSTATE )
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 18c4e5d17b05..5c3ac97519b7 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -1131,9 +1131,16 @@ static const struct usb_device_id products[] = {
        {QMI_FIXED_INTF(0x0846, 0x68d3, 8)},    /* Netgear Aircard 779S */
        {QMI_FIXED_INTF(0x12d1, 0x140c, 1)},    /* Huawei E173 */
        {QMI_FIXED_INTF(0x12d1, 0x14ac, 1)},    /* Huawei E1820 */
+        {QMI_FIXED_INTF(0x1435, 0x0918, 3)},    /* Wistron NeWeb D16Q1 */
+        {QMI_FIXED_INTF(0x1435, 0x0918, 4)},    /* Wistron NeWeb D16Q1 */
+        {QMI_FIXED_INTF(0x1435, 0x0918, 5)},    /* Wistron NeWeb D16Q1 */
+        {QMI_FIXED_INTF(0x1435, 0x3185, 4)},    /* Wistron NeWeb M18Q5 */
+        {QMI_FIXED_INTF(0x1435, 0xd111, 4)},    /* M9615A DM11-1 D51QC */
        {QMI_FIXED_INTF(0x1435, 0xd181, 3)},    /* Wistron NeWeb D18Q1 */
        {QMI_FIXED_INTF(0x1435, 0xd181, 4)},    /* Wistron NeWeb D18Q1 */
        {QMI_FIXED_INTF(0x1435, 0xd181, 5)},    /* Wistron NeWeb D18Q1 */
+        {QMI_FIXED_INTF(0x1435, 0xd182, 4)},    /* Wistron NeWeb D18 */
+        {QMI_FIXED_INTF(0x1435, 0xd182, 5)},    /* Wistron NeWeb D18 */
        {QMI_FIXED_INTF(0x1435, 0xd191, 4)},    /* Wistron NeWeb D19Q1 */
        {QMI_QUIRK_SET_DTR(0x1508, 0x1001, 4)}, /* Fibocom NL668 series */
        {QMI_FIXED_INTF(0x16d8, 0x6003, 0)},    /* CMOTech 6003 */
@@ -1189,6 +1196,7 @@ static const struct usb_device_id products[] = {
        {QMI_FIXED_INTF(0x19d2, 0x0265, 4)},    /* ONDA MT8205 4G LTE */
        {QMI_FIXED_INTF(0x19d2, 0x0284, 4)},    /* ZTE MF880 */
        {QMI_FIXED_INTF(0x19d2, 0x0326, 4)},    /* ZTE MF821D */
+        {QMI_FIXED_INTF(0x19d2, 0x0396, 3)},    /* ZTE ZM8620 */
        {QMI_FIXED_INTF(0x19d2, 0x0412, 4)},    /* Telewell TW-LTE 4G */
        {QMI_FIXED_INTF(0x19d2, 0x1008, 4)},    /* ZTE (Vodafone) K3570-Z */
        {QMI_FIXED_INTF(0x19d2, 0x1010, 4)},    /* ZTE (Vodafone) K3571-Z */
@@ -1209,7 +1217,9 @@ static const struct usb_device_id products[] = {
        {QMI_FIXED_INTF(0x19d2, 0x1425, 2)},
        {QMI_FIXED_INTF(0x19d2, 0x1426, 2)},    /* ZTE MF91 */
        {QMI_FIXED_INTF(0x19d2, 0x1428, 2)},    /* Telewell TW-LTE 4G v2 */
+        {QMI_FIXED_INTF(0x19d2, 0x1432, 3)},    /* ZTE ME3620 */
        {QMI_FIXED_INTF(0x19d2, 0x2002, 4)},    /* ZTE (Vodafone) K3765-Z */
+        {QMI_FIXED_INTF(0x2001, 0x7e16, 3)},    /* D-Link DWM-221 */
        {QMI_FIXED_INTF(0x2001, 0x7e19, 4)},    /* D-Link DWM-221 B1 */
        {QMI_FIXED_INTF(0x2001, 0x7e35, 4)},    /* D-Link DWM-222 */
        {QMI_FIXED_INTF(0x2020, 0x2031, 4)},    /* Olicard 600 */
diff --git a/drivers/net/wireless/ath/ath10k/ce.c b/drivers/net/wireless/ath/ath10k/ce.c
index 24b983edb357..eca87f7c5b6c 100644
--- a/drivers/net/wireless/ath/ath10k/ce.c
+++ b/drivers/net/wireless/ath/ath10k/ce.c
@@ -1855,7 +1855,7 @@ void ath10k_ce_dump_registers(struct ath10k *ar,
        struct ath10k_ce_crash_data ce_data;
        u32 addr, id;
-        lockdep_assert_held(&ar->data_lock);
+        lockdep_assert_held(&ar->dump_mutex);
        ath10k_err(ar, "Copy Engine register dump:\n");
diff --git a/drivers/net/wireless/ath/ath10k/core.c b/drivers/net/wireless/ath/ath10k/core.c
index 835b8de92d55..aff585658fc0 100644
--- a/drivers/net/wireless/ath/ath10k/core.c
+++ b/drivers/net/wireless/ath/ath10k/core.c
@@ -3119,6 +3119,7 @@ struct ath10k *ath10k_core_create(size_t priv_size, struct device *dev,
                goto err_free_wq;
        mutex_init(&ar->conf_mutex);
+        mutex_init(&ar->dump_mutex);
        spin_lock_init(&ar->data_lock);
        INIT_LIST_HEAD(&ar->peers);
diff --git a/drivers/net/wireless/ath/ath10k/core.h b/drivers/net/wireless/ath/ath10k/core.h
index e08a17b01e03..e35aae5146f1 100644
--- a/drivers/net/wireless/ath/ath10k/core.h
+++ b/drivers/net/wireless/ath/ath10k/core.h
@@ -1063,6 +1063,9 @@ struct ath10k {
        /* prevents concurrent FW reconfiguration */
        struct mutex conf_mutex;
+        /* protects coredump data */
+        struct mutex dump_mutex;
        /* protects shared structure data */
        spinlock_t data_lock;
diff --git a/drivers/net/wireless/ath/ath10k/coredump.c b/drivers/net/wireless/ath/ath10k/coredump.c
index 33838d9c1cb6..45a355fb62b9 100644
--- a/drivers/net/wireless/ath/ath10k/coredump.c
+++ b/drivers/net/wireless/ath/ath10k/coredump.c
@@ -1102,7 +1102,7 @@ struct ath10k_fw_crash_data *ath10k_coredump_new(struct ath10k *ar)
 {
        struct ath10k_fw_crash_data *crash_data = ar->coredump.fw_crash_data;
-        lockdep_assert_held(&ar->data_lock);
+        lockdep_assert_held(&ar->dump_mutex);
        if (ath10k_coredump_mask == 0)
                /* coredump disabled */
@@ -1146,7 +1146,7 @@ static struct ath10k_dump_file_data *ath10k_coredump_build(struct ath10k *ar)
        if (!buf)
                return NULL;
-        spin_lock_bh(&ar->data_lock);
+        mutex_lock(&ar->dump_mutex);
        dump_data = (struct ath10k_dump_file_data *)(buf);
        strlcpy(dump_data->df_magic, "ATH10K-FW-DUMP",
@@ -1213,7 +1213,7 @@ static struct ath10k_dump_file_data *ath10k_coredump_build(struct ath10k *ar)
                sofar += sizeof(*dump_tlv) + crash_data->ramdump_buf_len;
        }
-        spin_unlock_bh(&ar->data_lock);
+        mutex_unlock(&ar->dump_mutex);
        return dump_data;
 }
diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
index 41e89db244d2..9c703d287333 100644
--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -5774,7 +5774,7 @@ static void ath10k_bss_info_changed(struct ieee80211_hw *hw,
        }
        if (changed & BSS_CHANGED_MCAST_RATE &&
-            !WARN_ON(ath10k_mac_vif_chan(arvif->vif, &def))) {
+            !ath10k_mac_vif_chan(arvif->vif, &def)) {
                band = def.chan->band;
                rateidx = vif->bss_conf.mcast_rate[band] - 1;
@@ -5812,7 +5812,7 @@ static void ath10k_bss_info_changed(struct ieee80211_hw *hw,
        }
        if (changed & BSS_CHANGED_BASIC_RATES) {
-                if (WARN_ON(ath10k_mac_vif_chan(vif, &def))) {
+                if (ath10k_mac_vif_chan(vif, &def)) {
                        mutex_unlock(&ar->conf_mutex);
                        return;
                }
diff --git a/drivers/net/wireless/ath/ath10k/pci.c b/drivers/net/wireless/ath/ath10k/pci.c
index 271f92c24d44..2c27f407a851 100644
--- a/drivers/net/wireless/ath/ath10k/pci.c
+++ b/drivers/net/wireless/ath/ath10k/pci.c
@@ -1441,7 +1441,7 @@ static void ath10k_pci_dump_registers(struct ath10k *ar,
        __le32 reg_dump_values[REG_DUMP_COUNT_QCA988X] = {};
        int i, ret;
-        lockdep_assert_held(&ar->data_lock);
+        lockdep_assert_held(&ar->dump_mutex);
        ret = ath10k_pci_diag_read_hi(ar, &reg_dump_values[0],
                                      hi_failure_state,
@@ -1656,7 +1656,7 @@ static void ath10k_pci_dump_memory(struct ath10k *ar,
        int ret, i;
        u8 *buf;
-        lockdep_assert_held(&ar->data_lock);
+        lockdep_assert_held(&ar->dump_mutex);
        if (!crash_data)
                return;
@@ -1734,14 +1734,19 @@ static void ath10k_pci_dump_memory(struct ath10k *ar,
        }
 }
-static void ath10k_pci_fw_crashed_dump(struct ath10k *ar)
+static void ath10k_pci_fw_dump_work(struct work_struct *work)
 {
+        struct ath10k_pci *ar_pci = container_of(work, struct ath10k_pci,
+                                                 dump_work);
        struct ath10k_fw_crash_data *crash_data;
+        struct ath10k *ar = ar_pci->ar;
        char guid[UUID_STRING_LEN + 1];
-        spin_lock_bh(&ar->data_lock);
+        mutex_lock(&ar->dump_mutex);
+        spin_lock_bh(&ar->data_lock);
        ar->stats.fw_crash_counter++;
+        spin_unlock_bh(&ar->data_lock);
        crash_data = ath10k_coredump_new(ar);
@@ -1756,11 +1761,18 @@ static void ath10k_pci_fw_crashed_dump(struct ath10k *ar)
        ath10k_ce_dump_registers(ar, crash_data);
        ath10k_pci_dump_memory(ar, crash_data);
-        spin_unlock_bh(&ar->data_lock);
+        mutex_unlock(&ar->dump_mutex);
        queue_work(ar->workqueue, &ar->restart_work);
 }
+static void ath10k_pci_fw_crashed_dump(struct ath10k *ar)
+{
+        struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
+        queue_work(ar->workqueue, &ar_pci->dump_work);
+}
 void ath10k_pci_hif_send_complete_check(struct ath10k *ar, u8 pipe,
                                        int force)
 {
@@ -3442,6 +3454,8 @@ int ath10k_pci_setup_resource(struct ath10k *ar)
        spin_lock_init(&ar_pci->ps_lock);
        mutex_init(&ar_pci->ce_diag_mutex);
+        INIT_WORK(&ar_pci->dump_work, ath10k_pci_fw_dump_work);
        timer_setup(&ar_pci->rx_post_retry, ath10k_pci_rx_replenish_retry, 0);
        if (QCA_REV_6174(ar) || QCA_REV_9377(ar))
diff --git a/drivers/net/wireless/ath/ath10k/pci.h b/drivers/net/wireless/ath/ath10k/pci.h
index 3773c79f322f..4455ed6c5275 100644
--- a/drivers/net/wireless/ath/ath10k/pci.h
+++ b/drivers/net/wireless/ath/ath10k/pci.h
@@ -121,6 +121,8 @@ struct ath10k_pci {
        /* For protecting ce_diag */
        struct mutex ce_diag_mutex;
+        struct work_struct dump_work;
        struct ath10k_ce ce;
        struct timer_list rx_post_retry;
diff --git a/drivers/net/wireless/intel/iwlwifi/cfg/22000.c b/drivers/net/wireless/intel/iwlwifi/cfg/22000.c
index fc915ecfb06e..17b34f6e4515 100644
--- a/drivers/net/wireless/intel/iwlwifi/cfg/22000.c
+++ b/drivers/net/wireless/intel/iwlwifi/cfg/22000.c
@@ -207,7 +207,7 @@ static const struct iwl_ht_params iwl_22000_ht_params = {
 #define IWL_DEVICE_AX210                                                \
        IWL_DEVICE_AX200_COMMON,                                        \
        .device_family = IWL_DEVICE_FAMILY_AX210,                       \
-        .base_params = &iwl_22000_base_params,                          \
+        .base_params = &iwl_22560_base_params,                          \
        .csr = &iwl_csr_v1,                                             \
        .min_txq_size = 128,                                            \
        .gp2_reg_addr = 0xd02c68,                                       \
diff --git a/drivers/net/wireless/intel/iwlwifi/cfg/5000.c b/drivers/net/wireless/intel/iwlwifi/cfg/5000.c
index 575a7022d045..3846064d51a5 100644
--- a/drivers/net/wireless/intel/iwlwifi/cfg/5000.c
+++ b/drivers/net/wireless/intel/iwlwifi/cfg/5000.c
@@ -1,7 +1,7 @@
 /******************************************************************************
 *
 * Copyright(c) 2007 - 2014 Intel Corporation. All rights reserved.
- * Copyright(c) 2018 Intel Corporation
+ * Copyright(c) 2018 - 2019 Intel Corporation
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of version 2 of the GNU General Public License as
@@ -136,6 +136,7 @@ const struct iwl_cfg iwl5350_agn_cfg = {
        .ht_params = &iwl5000_ht_params,
        .led_mode = IWL_LED_BLINK,
        .internal_wimax_coex = true,
+        .csr = &iwl_csr_v1,
 };
 #define IWL_DEVICE_5150                                         \
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/file.h b/drivers/net/wireless/intel/iwlwifi/fw/file.h
index abfdcabdcbf7..cd622af90077 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/file.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/file.h
@@ -93,7 +93,7 @@ struct iwl_ucode_header {
        } u;
 };
-#define IWL_UCODE_INI_TLV_GROUP BIT(24)
+#define IWL_UCODE_INI_TLV_GROUP 0x1000000
 /*
 * new TLV uCode file layout
@@ -148,11 +148,14 @@ enum iwl_ucode_tlv_type {
        IWL_UCODE_TLV_UMAC_DEBUG_ADDRS  = 54,
        IWL_UCODE_TLV_LMAC_DEBUG_ADDRS  = 55,
        IWL_UCODE_TLV_FW_RECOVERY_INFO  = 57,
-        IWL_UCODE_TLV_TYPE_BUFFER_ALLOCATION    = IWL_UCODE_INI_TLV_GROUP | 0x1,
-        IWL_UCODE_TLV_TYPE_HCMD                 = IWL_UCODE_INI_TLV_GROUP | 0x2,
+        IWL_UCODE_TLV_TYPE_BUFFER_ALLOCATION    = IWL_UCODE_INI_TLV_GROUP + 0x1,
-        IWL_UCODE_TLV_TYPE_REGIONS              = IWL_UCODE_INI_TLV_GROUP | 0x3,
+        IWL_UCODE_TLV_DEBUG_BASE = IWL_UCODE_TLV_TYPE_BUFFER_ALLOCATION,
-        IWL_UCODE_TLV_TYPE_TRIGGERS             = IWL_UCODE_INI_TLV_GROUP | 0x4,
+        IWL_UCODE_TLV_TYPE_HCMD                 = IWL_UCODE_INI_TLV_GROUP + 0x2,
-        IWL_UCODE_TLV_TYPE_DEBUG_FLOW           = IWL_UCODE_INI_TLV_GROUP | 0x5,
+        IWL_UCODE_TLV_TYPE_REGIONS              = IWL_UCODE_INI_TLV_GROUP + 0x3,
+        IWL_UCODE_TLV_TYPE_TRIGGERS             = IWL_UCODE_INI_TLV_GROUP + 0x4,
+        IWL_UCODE_TLV_TYPE_DEBUG_FLOW           = IWL_UCODE_INI_TLV_GROUP + 0x5,
+        IWL_UCODE_TLV_DEBUG_MAX = IWL_UCODE_TLV_TYPE_DEBUG_FLOW,
        /* TLVs 0x1000-0x2000 are for internal driver usage */
        IWL_UCODE_TLV_FW_DBG_DUMP_LST   = 0x1000,
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c b/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c
index 9107302cc444..0e8664375298 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c
@@ -129,7 +129,8 @@ void iwl_alloc_dbg_tlv(struct iwl_trans *trans, size_t len, const u8 *data,
                len -= ALIGN(tlv_len, 4);
                data += sizeof(*tlv) + ALIGN(tlv_len, 4);
-                if (!(tlv_type & IWL_UCODE_INI_TLV_GROUP))
+                if (tlv_type < IWL_UCODE_TLV_DEBUG_BASE ||
+                    tlv_type > IWL_UCODE_TLV_DEBUG_MAX)
                        continue;
                hdr = (void *)&tlv->data[0];
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/debugfs-vif.c b/drivers/net/wireless/intel/iwlwifi/mvm/debugfs-vif.c
index 9bf2407c9b4b..f043eefabb4e 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/debugfs-vif.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/debugfs-vif.c
@@ -773,6 +773,11 @@ void iwl_mvm_vif_dbgfs_register(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
                return;
        mvmvif->dbgfs_dir = debugfs_create_dir("iwlmvm", dbgfs_dir);
+        if (IS_ERR_OR_NULL(mvmvif->dbgfs_dir)) {
+                IWL_ERR(mvm, "Failed to create debugfs directory under %pd\n",
+                        dbgfs_dir);
+                return;
+        }
        if (iwlmvm_mod_params.power_scheme != IWL_POWER_SCHEME_CAM &&
            ((vif->type == NL80211_IFTYPE_STATION && !vif->p2p) ||
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
index 00a47f6f1d81..ab68b5d53ec9 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
@@ -1121,7 +1121,9 @@ int iwl_mvm_up(struct iwl_mvm *mvm)
        ret = iwl_mvm_load_rt_fw(mvm);
        if (ret) {
                IWL_ERR(mvm, "Failed to start RT ucode: %d\n", ret);
-                iwl_fw_dbg_error_collect(&mvm->fwrt, FW_DBG_TRIGGER_DRIVER);
+                if (ret != -ERFKILL)
+                        iwl_fw_dbg_error_collect(&mvm->fwrt,
+                                                 FW_DBG_TRIGGER_DRIVER);
                goto error;
        }
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
index 55d399899d1c..8da9e5572fcf 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
@@ -834,7 +834,7 @@ iwl_op_mode_mvm_start(struct iwl_trans *trans, const struct iwl_cfg *cfg,
        mutex_lock(&mvm->mutex);
        iwl_mvm_ref(mvm, IWL_MVM_REF_INIT_UCODE);
        err = iwl_run_init_mvm_ucode(mvm, true);
-        if (err)
+        if (err && err != -ERFKILL)
                iwl_fw_dbg_error_collect(&mvm->fwrt, FW_DBG_TRIGGER_DRIVER);
        if (!iwlmvm_mod_params.init_dbg || !err)
                iwl_mvm_stop_device(mvm);
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
index 0b1b208de767..1824566d08fc 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
@@ -169,9 +169,9 @@ static inline int iwl_mvm_check_pn(struct iwl_mvm *mvm, struct sk_buff *skb,
 }
 /* iwl_mvm_create_skb Adds the rxb to a new skb */
-static void iwl_mvm_create_skb(struct sk_buff *skb, struct ieee80211_hdr *hdr,
+static int iwl_mvm_create_skb(struct iwl_mvm *mvm, struct sk_buff *skb,
-                               u16 len, u8 crypt_len,
+                              struct ieee80211_hdr *hdr, u16 len, u8 crypt_len,
-                               struct iwl_rx_cmd_buffer *rxb)
+                              struct iwl_rx_cmd_buffer *rxb)
 {
        struct iwl_rx_packet *pkt = rxb_addr(rxb);
        struct iwl_rx_mpdu_desc *desc = (void *)pkt->data;
@@ -204,6 +204,20 @@ static void iwl_mvm_create_skb(struct sk_buff *skb, struct ieee80211_hdr *hdr,
         * present before copying packet data.
         */
        hdrlen += crypt_len;
+        if (WARN_ONCE(headlen < hdrlen,
+                      "invalid packet lengths (hdrlen=%d, len=%d, crypt_len=%d)\n",
+                      hdrlen, len, crypt_len)) {
+                /*
+                 * We warn and trace because we want to be able to see
+                 * it in trace-cmd as well.
+                 */
+                IWL_DEBUG_RX(mvm,
+                             "invalid packet lengths (hdrlen=%d, len=%d, crypt_len=%d)\n",
+                             hdrlen, len, crypt_len);
+                return -EINVAL;
+        }
        skb_put_data(skb, hdr, hdrlen);
        skb_put_data(skb, (u8 *)hdr + hdrlen + pad_len, headlen - hdrlen);
@@ -216,6 +230,8 @@ static void iwl_mvm_create_skb(struct sk_buff *skb, struct ieee80211_hdr *hdr,
                skb_add_rx_frag(skb, 0, rxb_steal_page(rxb), offset,
                                fraglen, rxb->truesize);
        }
+        return 0;
 }
 static void iwl_mvm_add_rtap_sniffer_config(struct iwl_mvm *mvm,
@@ -1671,7 +1687,11 @@ void iwl_mvm_rx_mpdu_mq(struct iwl_mvm *mvm, struct napi_struct *napi,
                        rx_status->boottime_ns = ktime_get_boot_ns();
        }
-        iwl_mvm_create_skb(skb, hdr, len, crypt_len, rxb);
+        if (iwl_mvm_create_skb(mvm, skb, hdr, len, crypt_len, rxb)) {
+                kfree_skb(skb);
+                goto out;
+        }
        if (!iwl_mvm_reorder(mvm, napi, queue, sta, skb, desc))
                iwl_mvm_pass_packet_to_mac80211(mvm, napi, skb, queue,
                                                sta, csi);
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
index c5baaae8d38e..cccb8bbd7ea7 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
@@ -3654,20 +3654,27 @@ out_no_pci:
 void iwl_trans_pcie_sync_nmi(struct iwl_trans *trans)
 {
+        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
        unsigned long timeout = jiffies + IWL_TRANS_NMI_TIMEOUT;
+        u32 inta_addr, sw_err_bit;
+        if (trans_pcie->msix_enabled) {
+                inta_addr = CSR_MSIX_HW_INT_CAUSES_AD;
+                sw_err_bit = MSIX_HW_INT_CAUSES_REG_SW_ERR;
+        } else {
+                inta_addr = CSR_INT;
+                sw_err_bit = CSR_INT_BIT_SW_ERR;
+        }
        iwl_disable_interrupts(trans);
        iwl_force_nmi(trans);
        while (time_after(timeout, jiffies)) {
-                u32 inta_hw = iwl_read32(trans,
+                u32 inta_hw = iwl_read32(trans, inta_addr);
-                                         CSR_MSIX_HW_INT_CAUSES_AD);
                /* Error detected by uCode */
-                if (inta_hw & MSIX_HW_INT_CAUSES_REG_SW_ERR) {
+                if (inta_hw & sw_err_bit) {
                        /* Clear causes register */
-                        iwl_write32(trans, CSR_MSIX_HW_INT_CAUSES_AD,
+                        iwl_write32(trans, inta_addr, inta_hw & sw_err_bit);
-                                    inta_hw &
-                                    MSIX_HW_INT_CAUSES_REG_SW_ERR);
                        break;
                }
diff --git a/drivers/net/wireless/marvell/mwifiex/sdio.c b/drivers/net/wireless/marvell/mwifiex/sdio.c
index a85648342d15..d5a70340a945 100644
--- a/drivers/net/wireless/marvell/mwifiex/sdio.c
+++ b/drivers/net/wireless/marvell/mwifiex/sdio.c
@@ -181,7 +181,7 @@ static int mwifiex_sdio_resume(struct device *dev)
        adapter = card->adapter;
-        if (test_bit(MWIFIEX_IS_SUSPENDED, &adapter->work_flags)) {
+        if (!test_bit(MWIFIEX_IS_SUSPENDED, &adapter->work_flags)) {
                mwifiex_dbg(adapter, WARN,
                            "device already resumed\n");
                return 0;