684 files changed, 6477 insertions, 4037 deletions

diff --git a/drivers/acpi/acpi_apd.c b/drivers/acpi/acpi_apd.c
index fc6c416f8724..d5999eb41c00 100644
--- a/drivers/acpi/acpi_apd.c
+++ b/drivers/acpi/acpi_apd.c
@@ -180,8 +180,8 @@ static const struct acpi_device_id acpi_apd_device_ids[] = {
         { "APMC0D0F", APD_ADDR(xgene_i2c_desc) },
         { "BRCM900D", APD_ADDR(vulcan_spi_desc) },
         { "CAV900D",  APD_ADDR(vulcan_spi_desc) },
-        { "HISI0A21", APD_ADDR(hip07_i2c_desc) },
-        { "HISI0A22", APD_ADDR(hip08_i2c_desc) },
+        { "HISI02A1", APD_ADDR(hip07_i2c_desc) },
+        { "HISI02A2", APD_ADDR(hip08_i2c_desc) },
 #endif
         { }
 };
diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c
index e51a1e98e62f..f88caf5aab76 100644
--- a/drivers/acpi/acpi_lpss.c
+++ b/drivers/acpi/acpi_lpss.c
@@ -85,6 +85,7 @@ static const struct lpss_device_desc lpss_dma_desc = {
 };
 
 struct lpss_private_data {
+        struct acpi_device *adev;
         void __iomem *mmio_base;
         resource_size_t mmio_size;
         unsigned int fixed_clk_rate;
@@ -155,6 +156,12 @@ static struct pwm_lookup byt_pwm_lookup[] = {
 
 static void byt_pwm_setup(struct lpss_private_data *pdata)
 {
+        struct acpi_device *adev = pdata->adev;
+
+        /* Only call pwm_add_table for the first PWM controller */
+        if (!adev->pnp.unique_id || strcmp(adev->pnp.unique_id, "1"))
+                return;
+
         if (!acpi_dev_present("INT33FD", NULL, -1))
                 pwm_add_table(byt_pwm_lookup, ARRAY_SIZE(byt_pwm_lookup));
 }
@@ -180,6 +187,12 @@ static struct pwm_lookup bsw_pwm_lookup[] = {
 
 static void bsw_pwm_setup(struct lpss_private_data *pdata)
 {
+        struct acpi_device *adev = pdata->adev;
+
+        /* Only call pwm_add_table for the first PWM controller */
+        if (!adev->pnp.unique_id || strcmp(adev->pnp.unique_id, "1"))
+                return;
+
         pwm_add_table(bsw_pwm_lookup, ARRAY_SIZE(bsw_pwm_lookup));
 }
 
@@ -456,6 +469,7 @@ static int acpi_lpss_create_device(struct acpi_device *adev,
                 goto err_out;
         }
 
+        pdata->adev = adev;
         pdata->dev_desc = dev_desc;
 
         if (dev_desc->setup)
diff --git a/drivers/acpi/acpi_watchdog.c b/drivers/acpi/acpi_watchdog.c
index 8c4e0a18460a..bf22c29d2517 100644
--- a/drivers/acpi/acpi_watchdog.c
+++ b/drivers/acpi/acpi_watchdog.c
@@ -86,7 +86,12 @@ void __init acpi_watchdog_init(void)
 
                 found = false;
                 resource_list_for_each_entry(rentry, &resource_list) {
-                        if (resource_contains(rentry->res, &res)) {
+                        if (rentry->res->flags == res.flags &&
+                            resource_overlaps(rentry->res, &res)) {
+                                if (res.start < rentry->res->start)
+                                        rentry->res->start = res.start;
+                                if (res.end > rentry->res->end)
+                                        rentry->res->end = res.end;
                                 found = true;
                                 break;
                         }
diff --git a/drivers/acpi/acpica/nsxfeval.c b/drivers/acpi/acpica/nsxfeval.c
index 538c61677c10..783f4c838aee 100644
--- a/drivers/acpi/acpica/nsxfeval.c
+++ b/drivers/acpi/acpica/nsxfeval.c
@@ -100,9 +100,13 @@ acpi_evaluate_object_typed(acpi_handle handle,
                 free_buffer_on_error = TRUE;
         }
 
-        status = acpi_get_handle(handle, pathname, &target_handle);
-        if (ACPI_FAILURE(status)) {
-                return_ACPI_STATUS(status);
+        if (pathname) {
+                status = acpi_get_handle(handle, pathname, &target_handle);
+                if (ACPI_FAILURE(status)) {
+                        return_ACPI_STATUS(status);
+                }
+        } else {
+                target_handle = handle;
         }
 
         full_pathname = acpi_ns_get_external_pathname(target_handle);
diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
index ddb01e9fa5b2..ae3d6d152633 100644
--- a/drivers/acpi/ec.c
+++ b/drivers/acpi/ec.c
@@ -151,6 +151,10 @@ static bool ec_freeze_events __read_mostly = false;
 module_param(ec_freeze_events, bool, 0644);
 MODULE_PARM_DESC(ec_freeze_events, "Disabling event handling during suspend/resume");
 
+static bool ec_no_wakeup __read_mostly;
+module_param(ec_no_wakeup, bool, 0644);
+MODULE_PARM_DESC(ec_no_wakeup, "Do not wake up from suspend-to-idle");
+
 struct acpi_ec_query_handler {
         struct list_head node;
         acpi_ec_query_func func;
@@ -535,6 +539,14 @@ static void acpi_ec_disable_event(struct acpi_ec *ec)
         spin_unlock_irqrestore(&ec->lock, flags);
         __acpi_ec_flush_event(ec);
 }
+
+void acpi_ec_flush_work(void)
+{
+        if (first_ec)
+                __acpi_ec_flush_event(first_ec);
+
+        flush_scheduled_work();
+}
 #endif /* CONFIG_PM_SLEEP */
 
 static bool acpi_ec_guard_event(struct acpi_ec *ec)
@@ -1729,7 +1741,7 @@ error:
  * functioning ECDT EC first in order to handle the events.
  * https://bugzilla.kernel.org/show_bug.cgi?id=115021
  */
-int __init acpi_ec_ecdt_start(void)
+static int __init acpi_ec_ecdt_start(void)
 {
         acpi_handle handle;
 
@@ -1880,6 +1892,32 @@ static int acpi_ec_suspend(struct device *dev)
         return 0;
 }
 
+static int acpi_ec_suspend_noirq(struct device *dev)
+{
+        struct acpi_ec *ec = acpi_driver_data(to_acpi_device(dev));
+
+        /*
+         * The SCI handler doesn't run at this point, so the GPE can be
+         * masked at the low level without side effects.
+         */
+        if (ec_no_wakeup && test_bit(EC_FLAGS_STARTED, &ec->flags) &&
+            ec->reference_count >= 1)
+                acpi_set_gpe(NULL, ec->gpe, ACPI_GPE_DISABLE);
+
+        return 0;
+}
+
+static int acpi_ec_resume_noirq(struct device *dev)
+{
+        struct acpi_ec *ec = acpi_driver_data(to_acpi_device(dev));
+
+        if (ec_no_wakeup && test_bit(EC_FLAGS_STARTED, &ec->flags) &&
+            ec->reference_count >= 1)
+                acpi_set_gpe(NULL, ec->gpe, ACPI_GPE_ENABLE);
+
+        return 0;
+}
+
 static int acpi_ec_resume(struct device *dev)
 {
         struct acpi_ec *ec =
@@ -1891,6 +1929,7 @@ static int acpi_ec_resume(struct device *dev)
 #endif
 
 static const struct dev_pm_ops acpi_ec_pm = {
+        SET_NOIRQ_SYSTEM_SLEEP_PM_OPS(acpi_ec_suspend_noirq, acpi_ec_resume_noirq)
         SET_SYSTEM_SLEEP_PM_OPS(acpi_ec_suspend, acpi_ec_resume)
 };
 
@@ -1964,20 +2003,17 @@ static inline void acpi_ec_query_exit(void)
 int __init acpi_ec_init(void)
 {
         int result;
+        int ecdt_fail, dsdt_fail;
 
         /* register workqueue for _Qxx evaluations */
         result = acpi_ec_query_init();
         if (result)
-                goto err_exit;
-        /* Now register the driver for the EC */
-        result = acpi_bus_register_driver(&acpi_ec_driver);
-        if (result)
-                goto err_exit;
+                return result;
 
-err_exit:
-        if (result)
-                acpi_ec_query_exit();
-        return result;
+        /* Drivers must be started after acpi_ec_query_init() */
+        ecdt_fail = acpi_ec_ecdt_start();
+        dsdt_fail = acpi_bus_register_driver(&acpi_ec_driver);
+        return ecdt_fail && dsdt_fail ? -ENODEV : 0;
 }
 
 /* EC driver currently not unloadable */
diff --git a/drivers/acpi/internal.h b/drivers/acpi/internal.h
index 9531d3276f65..3f5af4d7a739 100644
--- a/drivers/acpi/internal.h
+++ b/drivers/acpi/internal.h
@@ -185,7 +185,6 @@ typedef int (*acpi_ec_query_func) (void *data);
 int acpi_ec_init(void);
 int acpi_ec_ecdt_probe(void);
 int acpi_ec_dsdt_probe(void);
-int acpi_ec_ecdt_start(void);
 void acpi_ec_block_transactions(void);
 void acpi_ec_unblock_transactions(void);
 int acpi_ec_add_query_handler(struct acpi_ec *ec, u8 query_bit,
@@ -193,6 +192,10 @@ int acpi_ec_add_query_handler(struct acpi_ec *ec, u8 query_bit,
                               void *data);
 void acpi_ec_remove_query_handler(struct acpi_ec *ec, u8 query_bit);
 
+#ifdef CONFIG_PM_SLEEP
+void acpi_ec_flush_work(void);
+#endif
+
 
 /*--------------------------------------------------------------------------
                                   Suspend/Resume
diff --git a/drivers/acpi/numa.c b/drivers/acpi/numa.c
index edb0c79f7c64..917f1cc0fda4 100644
--- a/drivers/acpi/numa.c
+++ b/drivers/acpi/numa.c
@@ -443,7 +443,7 @@ int __init acpi_numa_init(void)
          * So go over all cpu entries in SRAT to get apicid to node mapping.
          */
 
-        /* SRAT: Static Resource Affinity Table */
+        /* SRAT: System Resource Affinity Table */
         if (!acpi_table_parse(ACPI_SIG_SRAT, acpi_parse_srat)) {
                 struct acpi_subtable_proc srat_proc[3];
 
diff --git a/drivers/acpi/property.c b/drivers/acpi/property.c
index 917c789f953d..476a52c60cf3 100644
--- a/drivers/acpi/property.c
+++ b/drivers/acpi/property.c
@@ -1047,7 +1047,7 @@ static struct fwnode_handle *acpi_graph_get_child_prop_value(
         fwnode_for_each_child_node(fwnode, child) {
                 u32 nr;
 
-                if (!fwnode_property_read_u32(fwnode, prop_name, &nr))
+                if (fwnode_property_read_u32(child, prop_name, &nr))
                         continue;
 
                 if (val == nr)
diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
index 33897298f03e..70fd5502c284 100644
--- a/drivers/acpi/scan.c
+++ b/drivers/acpi/scan.c
@@ -2084,7 +2084,6 @@ int __init acpi_scan_init(void)
 
         acpi_gpe_apply_masked_gpes();
         acpi_update_all_gpes();
-        acpi_ec_ecdt_start();
 
         acpi_scan_initialized = true;
 
diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c
index be17664736b2..fa8243c5c062 100644
--- a/drivers/acpi/sleep.c
+++ b/drivers/acpi/sleep.c
@@ -777,11 +777,11 @@ static void acpi_freeze_sync(void)
         /*
          * Process all pending events in case there are any wakeup ones.
          *
-         * The EC driver uses the system workqueue, so that one needs to be
-         * flushed too.
+         * The EC driver uses the system workqueue and an additional special
+         * one, so those need to be flushed too.
          */
+        acpi_ec_flush_work();
         acpi_os_wait_events_complete();
-        flush_scheduled_work();
         s2idle_wakeup = false;
 }
 
diff --git a/drivers/acpi/spcr.c b/drivers/acpi/spcr.c
index 4ac3e06b41d8..98aa8c808a33 100644
--- a/drivers/acpi/spcr.c
+++ b/drivers/acpi/spcr.c
@@ -17,6 +17,16 @@
 #include <linux/serial_core.h>
 
 /*
+ * Erratum 44 for QDF2432v1 and QDF2400v1 SoCs describes the BUSY bit as
+ * occasionally getting stuck as 1. To avoid the potential for a hang, check
+ * TXFE == 0 instead of BUSY == 1. This may not be suitable for all UART
+ * implementations, so only do so if an affected platform is detected in
+ * parse_spcr().
+ */
+bool qdf2400_e44_present;
+EXPORT_SYMBOL(qdf2400_e44_present);
+
+/*
  * Some Qualcomm Datacenter Technologies SoCs have a defective UART BUSY bit.
  * Detect them by examining the OEM fields in the SPCR header, similiar to PCI
  * quirk detection in pci_mcfg.c.
@@ -147,8 +157,30 @@ int __init parse_spcr(bool earlycon)
                 goto done;
         }
 
-        if (qdf2400_erratum_44_present(&table->header))
-                uart = "qdf2400_e44";
+        /*
+         * If the E44 erratum is required, then we need to tell the pl011
+         * driver to implement the work-around.
+         *
+         * The global variable is used by the probe function when it
+         * creates the UARTs, whether or not they're used as a console.
+         *
+         * If the user specifies "traditional" earlycon, the qdf2400_e44
+         * console name matches the EARLYCON_DECLARE() statement, and
+         * SPCR is not used.  Parameter "earlycon" is false.
+         *
+         * If the user specifies "SPCR" earlycon, then we need to update
+         * the console name so that it also says "qdf2400_e44".  Parameter
+         * "earlycon" is true.
+         *
+         * For consistency, if we change the console name, then we do it
+         * for everyone, not just earlycon.
+         */
+        if (qdf2400_erratum_44_present(&table->header)) {
+                qdf2400_e44_present = true;
+                if (earlycon)
+                        uart = "qdf2400_e44";
+        }
+
         if (xgene_8250_erratum_present(table))
                 iotype = "mmio32";
 
diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index f7665c31feca..831cdd7d197d 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -3362,7 +3362,7 @@ static int binder_mmap(struct file *filp, struct vm_area_struct *vma)
         const char *failure_string;
         struct binder_buffer *buffer;
 
-        if (proc->tsk != current)
+        if (proc->tsk != current->group_leader)
                 return -EINVAL;
 
         if ((vma->vm_end - vma->vm_start) > SZ_4M)
diff --git a/drivers/ata/Kconfig b/drivers/ata/Kconfig
index 948fc86980a1..363fc5330c21 100644
--- a/drivers/ata/Kconfig
+++ b/drivers/ata/Kconfig
@@ -215,7 +215,7 @@ config SATA_FSL
 
 config SATA_GEMINI
         tristate "Gemini SATA bridge support"
-        depends on PATA_FTIDE010
+        depends on ARCH_GEMINI || COMPILE_TEST
         default ARCH_GEMINI
         help
           This enabled support for the FTIDE010 to SATA bridge
@@ -613,7 +613,7 @@ config PATA_FTIDE010
         tristate "Faraday Technology FTIDE010 PATA support"
         depends on OF
         depends on ARM
-        default ARCH_GEMINI
+        depends on SATA_GEMINI
         help
           This option enables support for the Faraday FTIDE010
           PATA controller found in the Cortina Gemini SoCs.
diff --git a/drivers/ata/ahci_da850.c b/drivers/ata/ahci_da850.c
index 1a50cd3b4233..9b34dff64536 100644
--- a/drivers/ata/ahci_da850.c
+++ b/drivers/ata/ahci_da850.c
@@ -216,12 +216,16 @@ static int ahci_da850_probe(struct platform_device *pdev)
                 return rc;
 
         res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
-        if (!res)
+        if (!res) {
+                rc = -ENODEV;
                 goto disable_resources;
+        }
 
         pwrdn_reg = devm_ioremap(dev, res->start, resource_size(res));
-        if (!pwrdn_reg)
+        if (!pwrdn_reg) {
+                rc = -ENOMEM;
                 goto disable_resources;
+        }
 
         da850_sata_init(dev, pwrdn_reg, hpriv->mmio, mpy);
 
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 8453f9a4682f..1945a8ea2099 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -2083,7 +2083,7 @@ unsigned int ata_read_log_page(struct ata_device *dev, u8 log,
 retry:
         ata_tf_init(dev, &tf);
         if (dev->dma_mode && ata_id_has_read_log_dma_ext(dev->id) &&
-            !(dev->horkage & ATA_HORKAGE_NO_NCQ_LOG)) {
+            !(dev->horkage & ATA_HORKAGE_NO_DMA_LOG)) {
                 tf.command = ATA_CMD_READ_LOG_DMA_EXT;
                 tf.protocol = ATA_PROT_DMA;
                 dma = true;
@@ -2102,8 +2102,8 @@ retry:
                                      buf, sectors * ATA_SECT_SIZE, 0);
 
         if (err_mask && dma) {
-                dev->horkage |= ATA_HORKAGE_NO_NCQ_LOG;
-                ata_dev_warn(dev, "READ LOG DMA EXT failed, trying unqueued\n");
+                dev->horkage |= ATA_HORKAGE_NO_DMA_LOG;
+                ata_dev_warn(dev, "READ LOG DMA EXT failed, trying PIO\n");
                 goto retry;
         }
 
@@ -2411,6 +2411,9 @@ static void ata_dev_config_trusted(struct ata_device *dev)
         u64 trusted_cap;
         unsigned int err;
 
+        if (!ata_id_has_trusted(dev->id))
+                return;
+
         if (!ata_identify_page_supported(dev, ATA_LOG_SECURITY)) {
                 ata_dev_warn(dev,
                              "Security Log not supported\n");
diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
index b70bcf6d2914..3dbd05532c09 100644
--- a/drivers/ata/libata-eh.c
+++ b/drivers/ata/libata-eh.c
@@ -1434,7 +1434,7 @@ void ata_eh_about_to_do(struct ata_link *link, struct ata_device *dev,
 
 /**
  *      ata_eh_done - EH action complete
-*       @ap: target ATA port
+ *      @link: ATA link for which EH actions are complete
  *      @dev: target ATA dev for per-dev action (can be NULL)
  *      @action: action just completed
  *
@@ -1576,7 +1576,7 @@ unsigned int atapi_eh_tur(struct ata_device *dev, u8 *r_sense_key)
 
 /**
  *      ata_eh_request_sense - perform REQUEST_SENSE_DATA_EXT
- *      @dev: device to perform REQUEST_SENSE_SENSE_DATA_EXT to
+ *      @qc: qc to perform REQUEST_SENSE_SENSE_DATA_EXT to
  *      @cmd: scsi command for which the sense code should be set
  *
  *      Perform REQUEST_SENSE_DATA_EXT after the device reported CHECK
@@ -4175,7 +4175,6 @@ static void ata_eh_handle_port_resume(struct ata_port *ap)
         struct ata_link *link;
         struct ata_device *dev;
         unsigned long flags;
-        int rc = 0;
 
         /* are we resuming? */
         spin_lock_irqsave(ap->lock, flags);
@@ -4202,7 +4201,7 @@ static void ata_eh_handle_port_resume(struct ata_port *ap)
         ata_acpi_set_state(ap, ap->pm_mesg);
 
         if (ap->ops->port_resume)
-                rc = ap->ops->port_resume(ap);
+                ap->ops->port_resume(ap);
 
         /* tell ACPI that we're resuming */
         ata_acpi_on_resume(ap);
diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index d462c5a3a7ef..44ba292f2cd7 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -3030,10 +3030,12 @@ static unsigned int atapi_xlat(struct ata_queued_cmd *qc)
 static struct ata_device *ata_find_dev(struct ata_port *ap, int devno)
 {
         if (!sata_pmp_attached(ap)) {
-                if (likely(devno < ata_link_max_devices(&ap->link)))
+                if (likely(devno >= 0 &&
+                           devno < ata_link_max_devices(&ap->link)))
                         return &ap->link.device[devno];
         } else {
-                if (likely(devno < ap->nr_pmp_links))
+                if (likely(devno >= 0 &&
+                           devno < ap->nr_pmp_links))
                         return &ap->pmp_link[devno].device[0];
         }
 
diff --git a/drivers/ata/sata_rcar.c b/drivers/ata/sata_rcar.c
index ee9844758736..537d11869069 100644
--- a/drivers/ata/sata_rcar.c
+++ b/drivers/ata/sata_rcar.c
@@ -858,6 +858,14 @@ static const struct of_device_id sata_rcar_match[] = {
                 .compatible = "renesas,sata-r8a7795",
                 .data = (void *)RCAR_GEN2_SATA
         },
+        {
+                .compatible = "renesas,rcar-gen2-sata",
+                .data = (void *)RCAR_GEN2_SATA
+        },
+        {
+                .compatible = "renesas,rcar-gen3-sata",
+                .data = (void *)RCAR_GEN2_SATA
+        },
         { },
 };
 MODULE_DEVICE_TABLE(of, sata_rcar_match);
diff --git a/drivers/base/dma-coherent.c b/drivers/base/dma-coherent.c
index 2ae24c28e70c..1c152aed6b82 100644
--- a/drivers/base/dma-coherent.c
+++ b/drivers/base/dma-coherent.c
@@ -25,7 +25,7 @@ static inline struct dma_coherent_mem *dev_get_coherent_memory(struct device *de
 {
         if (dev && dev->dma_mem)
                 return dev->dma_mem;
-        return dma_coherent_default_memory;
+        return NULL;
 }
 
 static inline dma_addr_t dma_get_device_base(struct device *dev,
@@ -165,34 +165,15 @@ void *dma_mark_declared_memory_occupied(struct device *dev,
 }
 EXPORT_SYMBOL(dma_mark_declared_memory_occupied);
 
-/**
- * dma_alloc_from_coherent() - try to allocate memory from the per-device coherent area
- *
- * @dev:        device from which we allocate memory
- * @size:       size of requested memory area
- * @dma_handle: This will be filled with the correct dma handle
- * @ret:        This pointer will be filled with the virtual address
- *              to allocated area.
- *
- * This function should be only called from per-arch dma_alloc_coherent()
- * to support allocation from per-device coherent memory pools.
- *
- * Returns 0 if dma_alloc_coherent should continue with allocating from
- * generic memory areas, or !0 if dma_alloc_coherent should return @ret.
- */
-int dma_alloc_from_coherent(struct device *dev, ssize_t size,
-                                       dma_addr_t *dma_handle, void **ret)
+static void *__dma_alloc_from_coherent(struct dma_coherent_mem *mem,
+                ssize_t size, dma_addr_t *dma_handle)
 {
-        struct dma_coherent_mem *mem = dev_get_coherent_memory(dev);
         int order = get_order(size);
         unsigned long flags;
         int pageno;
         int dma_memory_map;
+        void *ret;
 
-        if (!mem)
-                return 0;
-
-        *ret = NULL;
         spin_lock_irqsave(&mem->spinlock, flags);
 
         if (unlikely(size > (mem->size << PAGE_SHIFT)))
@@ -203,21 +184,50 @@ int dma_alloc_from_coherent(struct device *dev, ssize_t size,
                 goto err;
 
         /*
-         * Memory was found in the per-device area.
+         * Memory was found in the coherent area.
          */
-        *dma_handle = dma_get_device_base(dev, mem) + (pageno << PAGE_SHIFT);
-        *ret = mem->virt_base + (pageno << PAGE_SHIFT);
+        *dma_handle = mem->device_base + (pageno << PAGE_SHIFT);
+        ret = mem->virt_base + (pageno << PAGE_SHIFT);
         dma_memory_map = (mem->flags & DMA_MEMORY_MAP);
         spin_unlock_irqrestore(&mem->spinlock, flags);
         if (dma_memory_map)
-                memset(*ret, 0, size);
+                memset(ret, 0, size);
         else
-                memset_io(*ret, 0, size);
+                memset_io(ret, 0, size);
 
-        return 1;
+        return ret;
 
 err:
         spin_unlock_irqrestore(&mem->spinlock, flags);
+        return NULL;
+}
+
+/**
+ * dma_alloc_from_dev_coherent() - allocate memory from device coherent pool
+ * @dev:        device from which we allocate memory
+ * @size:       size of requested memory area
+ * @dma_handle: This will be filled with the correct dma handle
+ * @ret:        This pointer will be filled with the virtual address
+ *              to allocated area.
+ *
+ * This function should be only called from per-arch dma_alloc_coherent()
+ * to support allocation from per-device coherent memory pools.
+ *
+ * Returns 0 if dma_alloc_coherent should continue with allocating from
+ * generic memory areas, or !0 if dma_alloc_coherent should return @ret.
+ */
+int dma_alloc_from_dev_coherent(struct device *dev, ssize_t size,
+                dma_addr_t *dma_handle, void **ret)
+{
+        struct dma_coherent_mem *mem = dev_get_coherent_memory(dev);
+
+        if (!mem)
+                return 0;
+
+        *ret = __dma_alloc_from_coherent(mem, size, dma_handle);
+        if (*ret)
+                return 1;
+
         /*
          * In the case where the allocation can not be satisfied from the
          * per-device area, try to fall back to generic memory if the
@@ -225,25 +235,20 @@ err:
          */
         return mem->flags & DMA_MEMORY_EXCLUSIVE;
 }
-EXPORT_SYMBOL(dma_alloc_from_coherent);
+EXPORT_SYMBOL(dma_alloc_from_dev_coherent);
 
-/**
- * dma_release_from_coherent() - try to free the memory allocated from per-device coherent memory pool
- * @dev:        device from which the memory was allocated
- * @order:      the order of pages allocated
- * @vaddr:      virtual address of allocated pages
- *
- * This checks whether the memory was allocated from the per-device
- * coherent memory pool and if so, releases that memory.
- *
- * Returns 1 if we correctly released the memory, or 0 if
- * dma_release_coherent() should proceed with releasing memory from
- * generic pools.
- */
-int dma_release_from_coherent(struct device *dev, int order, void *vaddr)
+void *dma_alloc_from_global_coherent(ssize_t size, dma_addr_t *dma_handle)
 {
-        struct dma_coherent_mem *mem = dev_get_coherent_memory(dev);
+        if (!dma_coherent_default_memory)
+                return NULL;
+
+        return __dma_alloc_from_coherent(dma_coherent_default_memory, size,
+                        dma_handle);
+}
 
+static int __dma_release_from_coherent(struct dma_coherent_mem *mem,
+                                       int order, void *vaddr)
+{
         if (mem && vaddr >= mem->virt_base && vaddr <
                    (mem->virt_base + (mem->size << PAGE_SHIFT))) {
                 int page = (vaddr - mem->virt_base) >> PAGE_SHIFT;
@@ -256,28 +261,39 @@ int dma_release_from_coherent(struct device *dev, int order, void *vaddr)
         }
         return 0;
 }
-EXPORT_SYMBOL(dma_release_from_coherent);
 
 /**
- * dma_mmap_from_coherent() - try to mmap the memory allocated from
- * per-device coherent memory pool to userspace
+ * dma_release_from_dev_coherent() - free memory to device coherent memory pool
  * @dev:        device from which the memory was allocated
- * @vma:        vm_area for the userspace memory
- * @vaddr:      cpu address returned by dma_alloc_from_coherent
- * @size:       size of the memory buffer allocated by dma_alloc_from_coherent
- * @ret:        result from remap_pfn_range()
+ * @order:      the order of pages allocated
+ * @vaddr:      virtual address of allocated pages
  *
  * This checks whether the memory was allocated from the per-device
- * coherent memory pool and if so, maps that memory to the provided vma.
+ * coherent memory pool and if so, releases that memory.
  *
- * Returns 1 if we correctly mapped the memory, or 0 if the caller should
- * proceed with mapping memory from generic pools.
+ * Returns 1 if we correctly released the memory, or 0 if the caller should
+ * proceed with releasing memory from generic pools.
  */
-int dma_mmap_from_coherent(struct device *dev, struct vm_area_struct *vma,
-                           void *vaddr, size_t size, int *ret)
+int dma_release_from_dev_coherent(struct device *dev, int order, void *vaddr)
 {
         struct dma_coherent_mem *mem = dev_get_coherent_memory(dev);
 
+        return __dma_release_from_coherent(mem, order, vaddr);
+}
+EXPORT_SYMBOL(dma_release_from_dev_coherent);
+
+int dma_release_from_global_coherent(int order, void *vaddr)
+{
+        if (!dma_coherent_default_memory)
+                return 0;
+
+        return __dma_release_from_coherent(dma_coherent_default_memory, order,
+                        vaddr);
+}
+
+static int __dma_mmap_from_coherent(struct dma_coherent_mem *mem,
+                struct vm_area_struct *vma, void *vaddr, size_t size, int *ret)
+{
         if (mem && vaddr >= mem->virt_base && vaddr + size <=
                    (mem->virt_base + (mem->size << PAGE_SHIFT))) {
                 unsigned long off = vma->vm_pgoff;
@@ -296,7 +312,39 @@ int dma_mmap_from_coherent(struct device *dev, struct vm_area_struct *vma,
         }
         return 0;
 }
-EXPORT_SYMBOL(dma_mmap_from_coherent);
+
+/**
+ * dma_mmap_from_dev_coherent() - mmap memory from the device coherent pool
+ * @dev:        device from which the memory was allocated
+ * @vma:        vm_area for the userspace memory
+ * @vaddr:      cpu address returned by dma_alloc_from_dev_coherent
+ * @size:       size of the memory buffer allocated
+ * @ret:        result from remap_pfn_range()
+ *
+ * This checks whether the memory was allocated from the per-device
+ * coherent memory pool and if so, maps that memory to the provided vma.
+ *
+ * Returns 1 if we correctly mapped the memory, or 0 if the caller should
+ * proceed with mapping memory from generic pools.
+ */
+int dma_mmap_from_dev_coherent(struct device *dev, struct vm_area_struct *vma,
+                           void *vaddr, size_t size, int *ret)
+{
+        struct dma_coherent_mem *mem = dev_get_coherent_memory(dev);
+
+        return __dma_mmap_from_coherent(mem, vma, vaddr, size, ret);
+}
+EXPORT_SYMBOL(dma_mmap_from_dev_coherent);
+
+int dma_mmap_from_global_coherent(struct vm_area_struct *vma, void *vaddr,
+                                   size_t size, int *ret)
+{
+        if (!dma_coherent_default_memory)
+                return 0;
+
+        return __dma_mmap_from_coherent(dma_coherent_default_memory, vma,
+                                        vaddr, size, ret);
+}
 
 /*
  * Support for reserved memory regions defined in device tree
diff --git a/drivers/base/dma-mapping.c b/drivers/base/dma-mapping.c
index 5096755d185e..b555ff9dd8fc 100644
--- a/drivers/base/dma-mapping.c
+++ b/drivers/base/dma-mapping.c
@@ -235,7 +235,7 @@ int dma_common_mmap(struct device *dev, struct vm_area_struct *vma,
 
         vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
 
-        if (dma_mmap_from_coherent(dev, vma, cpu_addr, size, &ret))
+        if (dma_mmap_from_dev_coherent(dev, vma, cpu_addr, size, &ret))
                 return ret;
 
         if (off < count && user_count <= (count - off)) {
diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c
index b9f907eedbf7..bfbe1e154128 100644
--- a/drivers/base/firmware_class.c
+++ b/drivers/base/firmware_class.c
@@ -30,7 +30,6 @@
 #include <linux/syscore_ops.h>
 #include <linux/reboot.h>
 #include <linux/security.h>
-#include <linux/swait.h>
 
 #include <generated/utsrelease.h>
 
@@ -112,13 +111,13 @@ static inline long firmware_loading_timeout(void)
  * state of the firmware loading.
  */
 struct fw_state {
-        struct swait_queue_head wq;
+        struct completion completion;
         enum fw_status status;
 };
 
 static void fw_state_init(struct fw_state *fw_st)
 {
-        init_swait_queue_head(&fw_st->wq);
+        init_completion(&fw_st->completion);
         fw_st->status = FW_STATUS_UNKNOWN;
 }
 
@@ -131,9 +130,7 @@ static int __fw_state_wait_common(struct fw_state *fw_st, long timeout)
 {
         long ret;
 
-        ret = swait_event_interruptible_timeout(fw_st->wq,
-                                __fw_state_is_done(READ_ONCE(fw_st->status)),
-                                timeout);
+        ret = wait_for_completion_killable_timeout(&fw_st->completion, timeout);
         if (ret != 0 && fw_st->status == FW_STATUS_ABORTED)
                 return -ENOENT;
         if (!ret)
@@ -148,35 +145,34 @@ static void __fw_state_set(struct fw_state *fw_st,
         WRITE_ONCE(fw_st->status, status);
 
         if (status == FW_STATUS_DONE || status == FW_STATUS_ABORTED)
-                swake_up(&fw_st->wq);
+                complete_all(&fw_st->completion);
 }
 
 #define fw_state_start(fw_st)                                   \
         __fw_state_set(fw_st, FW_STATUS_LOADING)
 #define fw_state_done(fw_st)                                    \
         __fw_state_set(fw_st, FW_STATUS_DONE)
+#define fw_state_aborted(fw_st)                                 \
+        __fw_state_set(fw_st, FW_STATUS_ABORTED)
 #define fw_state_wait(fw_st)                                    \
         __fw_state_wait_common(fw_st, MAX_SCHEDULE_TIMEOUT)
 
-#ifndef CONFIG_FW_LOADER_USER_HELPER
-
-#define fw_state_is_aborted(fw_st)      false
-
-#else /* CONFIG_FW_LOADER_USER_HELPER */
-
 static int __fw_state_check(struct fw_state *fw_st, enum fw_status status)
 {
         return fw_st->status == status;
 }
 
+#define fw_state_is_aborted(fw_st)                              \
+        __fw_state_check(fw_st, FW_STATUS_ABORTED)
+
+#ifdef CONFIG_FW_LOADER_USER_HELPER
+
 #define fw_state_aborted(fw_st)                                 \
         __fw_state_set(fw_st, FW_STATUS_ABORTED)
 #define fw_state_is_done(fw_st)                                 \
         __fw_state_check(fw_st, FW_STATUS_DONE)
 #define fw_state_is_loading(fw_st)                              \
         __fw_state_check(fw_st, FW_STATUS_LOADING)
-#define fw_state_is_aborted(fw_st)                              \
-        __fw_state_check(fw_st, FW_STATUS_ABORTED)
 #define fw_state_wait_timeout(fw_st, timeout)                   \
         __fw_state_wait_common(fw_st, timeout)
 
@@ -1200,6 +1196,28 @@ _request_firmware_prepare(struct firmware **firmware_p, const char *name,
         return 1; /* need to load */
 }
 
+/*
+ * Batched requests need only one wake, we need to do this step last due to the
+ * fallback mechanism. The buf is protected with kref_get(), and it won't be
+ * released until the last user calls release_firmware().
+ *
+ * Failed batched requests are possible as well, in such cases we just share
+ * the struct firmware_buf and won't release it until all requests are woken
+ * and have gone through this same path.
+ */
+static void fw_abort_batch_reqs(struct firmware *fw)
+{
+        struct firmware_buf *buf;
+
+        /* Loaded directly? */
+        if (!fw || !fw->priv)
+                return;
+
+        buf = fw->priv;
+        if (!fw_state_is_aborted(&buf->fw_st))
+                fw_state_aborted(&buf->fw_st);
+}
+
 /* called from request_firmware() and request_firmware_work_func() */
 static int
 _request_firmware(const struct firmware **firmware_p, const char *name,
@@ -1243,6 +1261,7 @@ _request_firmware(const struct firmware **firmware_p, const char *name,
 
  out:
         if (ret < 0) {
+                fw_abort_batch_reqs(fw);
                 release_firmware(fw);
                 fw = NULL;
         }
diff --git a/drivers/base/power/domain.c b/drivers/base/power/domain.c
index 60303aa28587..e8ca5e2cf1e5 100644
--- a/drivers/base/power/domain.c
+++ b/drivers/base/power/domain.c
@@ -209,6 +209,34 @@ static void genpd_sd_counter_inc(struct generic_pm_domain *genpd)
         smp_mb__after_atomic();
 }
 
+#ifdef CONFIG_DEBUG_FS
+static void genpd_update_accounting(struct generic_pm_domain *genpd)
+{
+        ktime_t delta, now;
+
+        now = ktime_get();
+        delta = ktime_sub(now, genpd->accounting_time);
+
+        /*
+         * If genpd->status is active, it means we are just
+         * out of off and so update the idle time and vice
+         * versa.
+         */
+        if (genpd->status == GPD_STATE_ACTIVE) {
+                int state_idx = genpd->state_idx;
+
+                genpd->states[state_idx].idle_time =
+                        ktime_add(genpd->states[state_idx].idle_time, delta);
+        } else {
+                genpd->on_time = ktime_add(genpd->on_time, delta);
+        }
+
+        genpd->accounting_time = now;
+}
+#else
+static inline void genpd_update_accounting(struct generic_pm_domain *genpd) {}
+#endif
+
 static int _genpd_power_on(struct generic_pm_domain *genpd, bool timed)
 {
         unsigned int state_idx = genpd->state_idx;
@@ -361,6 +389,7 @@ static int genpd_power_off(struct generic_pm_domain *genpd, bool one_dev_on,
         }
 
         genpd->status = GPD_STATE_POWER_OFF;
+        genpd_update_accounting(genpd);
 
         list_for_each_entry(link, &genpd->slave_links, slave_node) {
                 genpd_sd_counter_dec(link->master);
@@ -413,6 +442,8 @@ static int genpd_power_on(struct generic_pm_domain *genpd, unsigned int depth)
                 goto err;
 
         genpd->status = GPD_STATE_ACTIVE;
+        genpd_update_accounting(genpd);
+
         return 0;
 
  err:
@@ -1540,6 +1571,7 @@ int pm_genpd_init(struct generic_pm_domain *genpd,
         genpd->max_off_time_changed = true;
         genpd->provider = NULL;
         genpd->has_provider = false;
+        genpd->accounting_time = ktime_get();
         genpd->domain.ops.runtime_suspend = genpd_runtime_suspend;
         genpd->domain.ops.runtime_resume = genpd_runtime_resume;
         genpd->domain.ops.prepare = pm_genpd_prepare;
@@ -1743,7 +1775,7 @@ static int genpd_add_provider(struct device_node *np, genpd_xlate_t xlate,
         mutex_lock(&of_genpd_mutex);
         list_add(&cp->link, &of_genpd_providers);
         mutex_unlock(&of_genpd_mutex);
-        pr_debug("Added domain provider from %s\n", np->full_name);
+        pr_debug("Added domain provider from %pOF\n", np);
 
         return 0;
 }
@@ -2149,16 +2181,16 @@ static int genpd_parse_state(struct genpd_power_state *genpd_state,
         err = of_property_read_u32(state_node, "entry-latency-us",
                                                 &entry_latency);
         if (err) {
-                pr_debug(" * %s missing entry-latency-us property\n",
-                                                state_node->full_name);
+                pr_debug(" * %pOF missing entry-latency-us property\n",
+                                                state_node);
                 return -EINVAL;
         }
 
         err = of_property_read_u32(state_node, "exit-latency-us",
                                                 &exit_latency);
         if (err) {
-                pr_debug(" * %s missing exit-latency-us property\n",
-                                                state_node->full_name);
+                pr_debug(" * %pOF missing exit-latency-us property\n",
+                                                state_node);
                 return -EINVAL;
         }
 
@@ -2212,8 +2244,8 @@ int of_genpd_parse_idle_states(struct device_node *dn,
                 ret = genpd_parse_state(&st[i++], np);
                 if (ret) {
                         pr_err
-                        ("Parsing idle state node %s failed with err %d\n",
-                                                        np->full_name, ret);
+                        ("Parsing idle state node %pOF failed with err %d\n",
+                                                        np, ret);
                         of_node_put(np);
                         kfree(st);
                         return ret;
@@ -2327,7 +2359,7 @@ exit:
         return 0;
 }
 
-static int pm_genpd_summary_show(struct seq_file *s, void *data)
+static int genpd_summary_show(struct seq_file *s, void *data)
 {
         struct generic_pm_domain *genpd;
         int ret = 0;
@@ -2350,21 +2382,187 @@ static int pm_genpd_summary_show(struct seq_file *s, void *data)
         return ret;
 }
 
-static int pm_genpd_summary_open(struct inode *inode, struct file *file)
+static int genpd_status_show(struct seq_file *s, void *data)
 {
-        return single_open(file, pm_genpd_summary_show, NULL);
+        static const char * const status_lookup[] = {
+                [GPD_STATE_ACTIVE] = "on",
+                [GPD_STATE_POWER_OFF] = "off"
+        };
+
+        struct generic_pm_domain *genpd = s->private;
+        int ret = 0;
+
+        ret = genpd_lock_interruptible(genpd);
+        if (ret)
+                return -ERESTARTSYS;
+
+        if (WARN_ON_ONCE(genpd->status >= ARRAY_SIZE(status_lookup)))
+                goto exit;
+
+        if (genpd->status == GPD_STATE_POWER_OFF)
+                seq_printf(s, "%s-%u\n", status_lookup[genpd->status],
+                        genpd->state_idx);
+        else
+                seq_printf(s, "%s\n", status_lookup[genpd->status]);
+exit:
+        genpd_unlock(genpd);
+        return ret;
 }
 
-static const struct file_operations pm_genpd_summary_fops = {
-        .open = pm_genpd_summary_open,
-        .read = seq_read,
-        .llseek = seq_lseek,
-        .release = single_release,
-};
+static int genpd_sub_domains_show(struct seq_file *s, void *data)
+{
+        struct generic_pm_domain *genpd = s->private;
+        struct gpd_link *link;
+        int ret = 0;
+
+        ret = genpd_lock_interruptible(genpd);
+        if (ret)
+                return -ERESTARTSYS;
+
+        list_for_each_entry(link, &genpd->master_links, master_node)
+                seq_printf(s, "%s\n", link->slave->name);
+
+        genpd_unlock(genpd);
+        return ret;
+}
+
+static int genpd_idle_states_show(struct seq_file *s, void *data)
+{
+        struct generic_pm_domain *genpd = s->private;
+        unsigned int i;
+        int ret = 0;
+
+        ret = genpd_lock_interruptible(genpd);
+        if (ret)
+                return -ERESTARTSYS;
+
+        seq_puts(s, "State          Time Spent(ms)\n");
+
+        for (i = 0; i < genpd->state_count; i++) {
+                ktime_t delta = 0;
+                s64 msecs;
+
+                if ((genpd->status == GPD_STATE_POWER_OFF) &&
+                                (genpd->state_idx == i))
+                        delta = ktime_sub(ktime_get(), genpd->accounting_time);
+
+                msecs = ktime_to_ms(
+                        ktime_add(genpd->states[i].idle_time, delta));
+                seq_printf(s, "S%-13i %lld\n", i, msecs);
+        }
+
+        genpd_unlock(genpd);
+        return ret;
+}
+
+static int genpd_active_time_show(struct seq_file *s, void *data)
+{
+        struct generic_pm_domain *genpd = s->private;
+        ktime_t delta = 0;
+        int ret = 0;
+
+        ret = genpd_lock_interruptible(genpd);
+        if (ret)
+                return -ERESTARTSYS;
+
+        if (genpd->status == GPD_STATE_ACTIVE)
+                delta = ktime_sub(ktime_get(), genpd->accounting_time);
+
+        seq_printf(s, "%lld ms\n", ktime_to_ms(
+                                ktime_add(genpd->on_time, delta)));
+
+        genpd_unlock(genpd);
+        return ret;
+}
+
+static int genpd_total_idle_time_show(struct seq_file *s, void *data)
+{
+        struct generic_pm_domain *genpd = s->private;
+        ktime_t delta = 0, total = 0;
+        unsigned int i;
+        int ret = 0;
+
+        ret = genpd_lock_interruptible(genpd);
+        if (ret)
+                return -ERESTARTSYS;
+
+        for (i = 0; i < genpd->state_count; i++) {
+
+                if ((genpd->status == GPD_STATE_POWER_OFF) &&
+                                (genpd->state_idx == i))
+                        delta = ktime_sub(ktime_get(), genpd->accounting_time);
+
+                total = ktime_add(total, genpd->states[i].idle_time);
+        }
+        total = ktime_add(total, delta);
+
+        seq_printf(s, "%lld ms\n", ktime_to_ms(total));
+
+        genpd_unlock(genpd);
+        return ret;
+}
+
+
+static int genpd_devices_show(struct seq_file *s, void *data)
+{
+        struct generic_pm_domain *genpd = s->private;
+        struct pm_domain_data *pm_data;
+        const char *kobj_path;
+        int ret = 0;
+
+        ret = genpd_lock_interruptible(genpd);
+        if (ret)
+                return -ERESTARTSYS;
+
+        list_for_each_entry(pm_data, &genpd->dev_list, list_node) {
+                kobj_path = kobject_get_path(&pm_data->dev->kobj,
+                                genpd_is_irq_safe(genpd) ?
+                                GFP_ATOMIC : GFP_KERNEL);
+                if (kobj_path == NULL)
+                        continue;
+
+                seq_printf(s, "%s\n", kobj_path);
+                kfree(kobj_path);
+        }
+
+        genpd_unlock(genpd);
+        return ret;
+}
+
+#define define_genpd_open_function(name) \
+static int genpd_##name##_open(struct inode *inode, struct file *file) \
+{ \
+        return single_open(file, genpd_##name##_show, inode->i_private); \
+}
+
+define_genpd_open_function(summary);
+define_genpd_open_function(status);
+define_genpd_open_function(sub_domains);
+define_genpd_open_function(idle_states);
+define_genpd_open_function(active_time);
+define_genpd_open_function(total_idle_time);
+define_genpd_open_function(devices);
+
+#define define_genpd_debugfs_fops(name) \
+static const struct file_operations genpd_##name##_fops = { \
+        .open = genpd_##name##_open, \
+        .read = seq_read, \
+        .llseek = seq_lseek, \
+        .release = single_release, \
+}
+
+define_genpd_debugfs_fops(summary);
+define_genpd_debugfs_fops(status);
+define_genpd_debugfs_fops(sub_domains);
+define_genpd_debugfs_fops(idle_states);
+define_genpd_debugfs_fops(active_time);
+define_genpd_debugfs_fops(total_idle_time);
+define_genpd_debugfs_fops(devices);
 
 static int __init pm_genpd_debug_init(void)
 {
         struct dentry *d;
+        struct generic_pm_domain *genpd;
 
         pm_genpd_debugfs_dir = debugfs_create_dir("pm_genpd", NULL);
 
@@ -2372,10 +2570,29 @@ static int __init pm_genpd_debug_init(void)
                 return -ENOMEM;
 
         d = debugfs_create_file("pm_genpd_summary", S_IRUGO,
-                        pm_genpd_debugfs_dir, NULL, &pm_genpd_summary_fops);
+                        pm_genpd_debugfs_dir, NULL, &genpd_summary_fops);
         if (!d)
                 return -ENOMEM;
 
+        list_for_each_entry(genpd, &gpd_list, gpd_list_node) {
+                d = debugfs_create_dir(genpd->name, pm_genpd_debugfs_dir);
+                if (!d)
+                        return -ENOMEM;
+
+                debugfs_create_file("current_state", 0444,
+                                d, genpd, &genpd_status_fops);
+                debugfs_create_file("sub_domains", 0444,
+                                d, genpd, &genpd_sub_domains_fops);
+                debugfs_create_file("idle_states", 0444,
+                                d, genpd, &genpd_idle_states_fops);
+                debugfs_create_file("active_time", 0444,
+                                d, genpd, &genpd_active_time_fops);
+                debugfs_create_file("total_idle_time", 0444,
+                                d, genpd, &genpd_total_idle_time_fops);
+                debugfs_create_file("devices", 0444,
+                                d, genpd, &genpd_devices_fops);
+        }
+
         return 0;
 }
 late_initcall(pm_genpd_debug_init);
diff --git a/drivers/base/power/opp/of.c b/drivers/base/power/opp/of.c
index 57eec1ca0569..0b718886479b 100644
--- a/drivers/base/power/opp/of.c
+++ b/drivers/base/power/opp/of.c
@@ -248,15 +248,22 @@ void dev_pm_opp_of_remove_table(struct device *dev)
 }
 EXPORT_SYMBOL_GPL(dev_pm_opp_of_remove_table);
 
-/* Returns opp descriptor node for a device, caller must do of_node_put() */
-struct device_node *dev_pm_opp_of_get_opp_desc_node(struct device *dev)
+/* Returns opp descriptor node for a device node, caller must
+ * do of_node_put() */
+static struct device_node *_opp_of_get_opp_desc_node(struct device_node *np)
 {
         /*
          * There should be only ONE phandle present in "operating-points-v2"
          * property.
          */
 
-        return of_parse_phandle(dev->of_node, "operating-points-v2", 0);
+        return of_parse_phandle(np, "operating-points-v2", 0);
+}
+
+/* Returns opp descriptor node for a device, caller must do of_node_put() */
+struct device_node *dev_pm_opp_of_get_opp_desc_node(struct device *dev)
+{
+        return _opp_of_get_opp_desc_node(dev->of_node);
 }
 EXPORT_SYMBOL_GPL(dev_pm_opp_of_get_opp_desc_node);
 
@@ -539,8 +546,12 @@ int dev_pm_opp_of_cpumask_add_table(const struct cpumask *cpumask)
 
                 ret = dev_pm_opp_of_add_table(cpu_dev);
                 if (ret) {
-                        pr_err("%s: couldn't find opp table for cpu:%d, %d\n",
-                               __func__, cpu, ret);
+                        /*
+                         * OPP may get registered dynamically, don't print error
+                         * message here.
+                         */
+                        pr_debug("%s: couldn't find opp table for cpu:%d, %d\n",
+                                 __func__, cpu, ret);
 
                         /* Free all other OPPs */
                         dev_pm_opp_of_cpumask_remove_table(cpumask);
@@ -572,8 +583,7 @@ EXPORT_SYMBOL_GPL(dev_pm_opp_of_cpumask_add_table);
 int dev_pm_opp_of_get_sharing_cpus(struct device *cpu_dev,
                                    struct cpumask *cpumask)
 {
-        struct device_node *np, *tmp_np;
-        struct device *tcpu_dev;
+        struct device_node *np, *tmp_np, *cpu_np;
         int cpu, ret = 0;
 
         /* Get OPP descriptor node */
@@ -593,19 +603,18 @@ int dev_pm_opp_of_get_sharing_cpus(struct device *cpu_dev,
                 if (cpu == cpu_dev->id)
                         continue;
 
-                tcpu_dev = get_cpu_device(cpu);
-                if (!tcpu_dev) {
-                        dev_err(cpu_dev, "%s: failed to get cpu%d device\n",
+                cpu_np = of_get_cpu_node(cpu, NULL);
+                if (!cpu_np) {
+                        dev_err(cpu_dev, "%s: failed to get cpu%d node\n",
                                 __func__, cpu);
-                        ret = -ENODEV;
+                        ret = -ENOENT;
                         goto put_cpu_node;
                 }
 
                 /* Get OPP descriptor node */
-                tmp_np = dev_pm_opp_of_get_opp_desc_node(tcpu_dev);
+                tmp_np = _opp_of_get_opp_desc_node(cpu_np);
                 if (!tmp_np) {
-                        dev_err(tcpu_dev, "%s: Couldn't find opp node.\n",
-                                __func__);
+                        pr_err("%pOF: Couldn't find opp node\n", cpu_np);
                         ret = -ENOENT;
                         goto put_cpu_node;
                 }
diff --git a/drivers/base/power/wakeup.c b/drivers/base/power/wakeup.c
index 144e6d8fafc8..b49efe33099e 100644
--- a/drivers/base/power/wakeup.c
+++ b/drivers/base/power/wakeup.c
@@ -412,15 +412,17 @@ void device_set_wakeup_capable(struct device *dev, bool capable)
         if (!!dev->power.can_wakeup == !!capable)
                 return;
 
+        dev->power.can_wakeup = capable;
         if (device_is_registered(dev) && !list_empty(&dev->power.entry)) {
                 if (capable) {
-                        if (wakeup_sysfs_add(dev))
-                                return;
+                        int ret = wakeup_sysfs_add(dev);
+
+                        if (ret)
+                                dev_info(dev, "Wakeup sysfs attributes not added\n");
                 } else {
                         wakeup_sysfs_remove(dev);
                 }
         }
-        dev->power.can_wakeup = capable;
 }
 EXPORT_SYMBOL_GPL(device_set_wakeup_capable);
 
diff --git a/drivers/block/loop.c b/drivers/block/loop.c
index ef8334949b42..f321b96405f5 100644
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -221,8 +221,7 @@ static void __loop_update_dio(struct loop_device *lo, bool dio)
 }
 
 static int
-figure_loop_size(struct loop_device *lo, loff_t offset, loff_t sizelimit,
-                 loff_t logical_blocksize)
+figure_loop_size(struct loop_device *lo, loff_t offset, loff_t sizelimit)
 {
         loff_t size = get_size(offset, sizelimit, lo->lo_backing_file);
         sector_t x = (sector_t)size;
@@ -234,12 +233,6 @@ figure_loop_size(struct loop_device *lo, loff_t offset, loff_t sizelimit,
                 lo->lo_offset = offset;
         if (lo->lo_sizelimit != sizelimit)
                 lo->lo_sizelimit = sizelimit;
-        if (lo->lo_flags & LO_FLAGS_BLOCKSIZE) {
-                lo->lo_logical_blocksize = logical_blocksize;
-                blk_queue_physical_block_size(lo->lo_queue, lo->lo_blocksize);
-                blk_queue_logical_block_size(lo->lo_queue,
-                                             lo->lo_logical_blocksize);
-        }
         set_capacity(lo->lo_disk, x);
         bd_set_size(bdev, (loff_t)get_capacity(bdev->bd_disk) << 9);
         /* let user-space know about the new size */
@@ -820,7 +813,6 @@ static void loop_config_discard(struct loop_device *lo)
         struct file *file = lo->lo_backing_file;
         struct inode *inode = file->f_mapping->host;
         struct request_queue *q = lo->lo_queue;
-        int lo_bits = 9;
 
         /*
          * We use punch hole to reclaim the free space used by the
@@ -840,11 +832,9 @@ static void loop_config_discard(struct loop_device *lo)
 
         q->limits.discard_granularity = inode->i_sb->s_blocksize;
         q->limits.discard_alignment = 0;
-        if (lo->lo_flags & LO_FLAGS_BLOCKSIZE)
-                lo_bits = blksize_bits(lo->lo_logical_blocksize);
 
-        blk_queue_max_discard_sectors(q, UINT_MAX >> lo_bits);
-        blk_queue_max_write_zeroes_sectors(q, UINT_MAX >> lo_bits);
+        blk_queue_max_discard_sectors(q, UINT_MAX >> 9);
+        blk_queue_max_write_zeroes_sectors(q, UINT_MAX >> 9);
         queue_flag_set_unlocked(QUEUE_FLAG_DISCARD, q);
 }
 
@@ -938,7 +928,6 @@ static int loop_set_fd(struct loop_device *lo, fmode_t mode,
 
         lo->use_dio = false;
         lo->lo_blocksize = lo_blocksize;
-        lo->lo_logical_blocksize = 512;
         lo->lo_device = bdev;
         lo->lo_flags = lo_flags;
         lo->lo_backing_file = file;
@@ -1104,7 +1093,6 @@ loop_set_status(struct loop_device *lo, const struct loop_info64 *info)
         int err;
         struct loop_func_table *xfer;
         kuid_t uid = current_uid();
-        int lo_flags = lo->lo_flags;
 
         if (lo->lo_encrypt_key_size &&
             !uid_eq(lo->lo_key_owner, uid) &&
@@ -1137,26 +1125,9 @@ loop_set_status(struct loop_device *lo, const struct loop_info64 *info)
         if (err)
                 goto exit;
 
-        if (info->lo_flags & LO_FLAGS_BLOCKSIZE) {
-                if (!(lo->lo_flags & LO_FLAGS_BLOCKSIZE))
-                        lo->lo_logical_blocksize = 512;
-                lo->lo_flags |= LO_FLAGS_BLOCKSIZE;
-                if (LO_INFO_BLOCKSIZE(info) != 512 &&
-                    LO_INFO_BLOCKSIZE(info) != 1024 &&
-                    LO_INFO_BLOCKSIZE(info) != 2048 &&
-                    LO_INFO_BLOCKSIZE(info) != 4096)
-                        return -EINVAL;
-                if (LO_INFO_BLOCKSIZE(info) > lo->lo_blocksize)
-                        return -EINVAL;
-        }
-
         if (lo->lo_offset != info->lo_offset ||
-            lo->lo_sizelimit != info->lo_sizelimit ||
-            lo->lo_flags != lo_flags ||
-            ((lo->lo_flags & LO_FLAGS_BLOCKSIZE) &&
-             lo->lo_logical_blocksize != LO_INFO_BLOCKSIZE(info))) {
-                if (figure_loop_size(lo, info->lo_offset, info->lo_sizelimit,
-                                     LO_INFO_BLOCKSIZE(info))) {
+            lo->lo_sizelimit != info->lo_sizelimit) {
+                if (figure_loop_size(lo, info->lo_offset, info->lo_sizelimit)) {
                         err = -EFBIG;
                         goto exit;
                 }
@@ -1348,8 +1319,7 @@ static int loop_set_capacity(struct loop_device *lo)
         if (unlikely(lo->lo_state != Lo_bound))
                 return -ENXIO;
 
-        return figure_loop_size(lo, lo->lo_offset, lo->lo_sizelimit,
-                                lo->lo_logical_blocksize);
+        return figure_loop_size(lo, lo->lo_offset, lo->lo_sizelimit);
 }
 
 static int loop_set_dio(struct loop_device *lo, unsigned long arg)
diff --git a/drivers/block/loop.h b/drivers/block/loop.h
index 2c096b9a17b8..fecd3f97ef8c 100644
--- a/drivers/block/loop.h
+++ b/drivers/block/loop.h
@@ -49,7 +49,6 @@ struct loop_device {
         struct file *   lo_backing_file;
         struct block_device *lo_device;
         unsigned        lo_blocksize;
-        unsigned        lo_logical_blocksize;
         void            *key_data; 
 
         gfp_t           old_gfp_mask;
diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index 87a0a29f6e7e..5bdf923294a5 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -908,7 +908,8 @@ static int nbd_reconnect_socket(struct nbd_device *nbd, unsigned long arg)
                         continue;
                 }
                 sk_set_memalloc(sock->sk);
-                sock->sk->sk_sndtimeo = nbd->tag_set.timeout;
+                if (nbd->tag_set.timeout)
+                        sock->sk->sk_sndtimeo = nbd->tag_set.timeout;
                 atomic_inc(&config->recv_threads);
                 refcount_inc(&nbd->config_refs);
                 old = nsock->sock;
@@ -922,6 +923,8 @@ static int nbd_reconnect_socket(struct nbd_device *nbd, unsigned long arg)
                 mutex_unlock(&nsock->tx_lock);
                 sockfd_put(old);
 
+                clear_bit(NBD_DISCONNECTED, &config->runtime_flags);
+
                 /* We take the tx_mutex in an error path in the recv_work, so we
                  * need to queue_work outside of the tx_mutex.
                  */
@@ -978,11 +981,15 @@ static void send_disconnects(struct nbd_device *nbd)
         int i, ret;
 
         for (i = 0; i < config->num_connections; i++) {
+                struct nbd_sock *nsock = config->socks[i];
+
                 iov_iter_kvec(&from, WRITE | ITER_KVEC, &iov, 1, sizeof(request));
+                mutex_lock(&nsock->tx_lock);
                 ret = sock_xmit(nbd, i, 1, &from, 0, NULL);
                 if (ret <= 0)
                         dev_err(disk_to_dev(nbd->disk),
                                 "Send disconnect failed %d\n", ret);
+                mutex_unlock(&nsock->tx_lock);
         }
 }
 
@@ -991,9 +998,8 @@ static int nbd_disconnect(struct nbd_device *nbd)
         struct nbd_config *config = nbd->config;
 
         dev_info(disk_to_dev(nbd->disk), "NBD_DISCONNECT\n");
-        if (!test_and_set_bit(NBD_DISCONNECT_REQUESTED,
-                              &config->runtime_flags))
-                send_disconnects(nbd);
+        set_bit(NBD_DISCONNECT_REQUESTED, &config->runtime_flags);
+        send_disconnects(nbd);
         return 0;
 }
 
@@ -1074,7 +1080,9 @@ static int nbd_start_device(struct nbd_device *nbd)
                         return -ENOMEM;
                 }
                 sk_set_memalloc(config->socks[i]->sock->sk);
-                config->socks[i]->sock->sk->sk_sndtimeo = nbd->tag_set.timeout;
+                if (nbd->tag_set.timeout)
+                        config->socks[i]->sock->sk->sk_sndtimeo =
+                                nbd->tag_set.timeout;
                 atomic_inc(&config->recv_threads);
                 refcount_inc(&nbd->config_refs);
                 INIT_WORK(&args->work, recv_work);
diff --git a/drivers/block/sunvdc.c b/drivers/block/sunvdc.c
index 6b16ead1da58..ad9749463d4f 100644
--- a/drivers/block/sunvdc.c
+++ b/drivers/block/sunvdc.c
@@ -875,6 +875,56 @@ static void print_version(void)
                 printk(KERN_INFO "%s", version);
 }
 
+struct vdc_check_port_data {
+        int     dev_no;
+        char    *type;
+};
+
+static int vdc_device_probed(struct device *dev, void *arg)
+{
+        struct vio_dev *vdev = to_vio_dev(dev);
+        struct vdc_check_port_data *port_data;
+
+        port_data = (struct vdc_check_port_data *)arg;
+
+        if ((vdev->dev_no == port_data->dev_no) &&
+            (!(strcmp((char *)&vdev->type, port_data->type))) &&
+                dev_get_drvdata(dev)) {
+                /* This device has already been configured
+                 * by vdc_port_probe()
+                 */
+                return 1;
+        } else {
+                return 0;
+        }
+}
+
+/* Determine whether the VIO device is part of an mpgroup
+ * by locating all the virtual-device-port nodes associated
+ * with the parent virtual-device node for the VIO device
+ * and checking whether any of these nodes are vdc-ports
+ * which have already been configured.
+ *
+ * Returns true if this device is part of an mpgroup and has
+ * already been probed.
+ */
+static bool vdc_port_mpgroup_check(struct vio_dev *vdev)
+{
+        struct vdc_check_port_data port_data;
+        struct device *dev;
+
+        port_data.dev_no = vdev->dev_no;
+        port_data.type = (char *)&vdev->type;
+
+        dev = device_find_child(vdev->dev.parent, &port_data,
+                                vdc_device_probed);
+
+        if (dev)
+                return true;
+
+        return false;
+}
+
 static int vdc_port_probe(struct vio_dev *vdev, const struct vio_device_id *id)
 {
         struct mdesc_handle *hp;
@@ -893,6 +943,14 @@ static int vdc_port_probe(struct vio_dev *vdev, const struct vio_device_id *id)
                 goto err_out_release_mdesc;
         }
 
+        /* Check if this device is part of an mpgroup */
+        if (vdc_port_mpgroup_check(vdev)) {
+                printk(KERN_WARNING
+                        "VIO: Ignoring extra vdisk port %s",
+                        dev_name(&vdev->dev));
+                goto err_out_release_mdesc;
+        }
+
         port = kzalloc(sizeof(*port), GFP_KERNEL);
         err = -ENOMEM;
         if (!port) {
@@ -943,6 +1001,9 @@ static int vdc_port_probe(struct vio_dev *vdev, const struct vio_device_id *id)
         if (err)
                 goto err_out_free_tx_ring;
 
+        /* Note that the device driver_data is used to determine
+         * whether the port has been probed.
+         */
         dev_set_drvdata(&vdev->dev, port);
 
         mdesc_release(hp);
diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
index 4e02aa5fdac0..d3d5523862c2 100644
--- a/drivers/block/virtio_blk.c
+++ b/drivers/block/virtio_blk.c
@@ -381,6 +381,7 @@ static void virtblk_config_changed_work(struct work_struct *work)
         struct request_queue *q = vblk->disk->queue;
         char cap_str_2[10], cap_str_10[10];
         char *envp[] = { "RESIZE=1", NULL };
+        unsigned long long nblocks;
         u64 capacity;
 
         /* Host must always specify the capacity. */
@@ -393,16 +394,19 @@ static void virtblk_config_changed_work(struct work_struct *work)
                 capacity = (sector_t)-1;
         }
 
-        string_get_size(capacity, queue_logical_block_size(q),
+        nblocks = DIV_ROUND_UP_ULL(capacity, queue_logical_block_size(q) >> 9);
+
+        string_get_size(nblocks, queue_logical_block_size(q),
                         STRING_UNITS_2, cap_str_2, sizeof(cap_str_2));
-        string_get_size(capacity, queue_logical_block_size(q),
+        string_get_size(nblocks, queue_logical_block_size(q),
                         STRING_UNITS_10, cap_str_10, sizeof(cap_str_10));
 
         dev_notice(&vdev->dev,
-                  "new size: %llu %d-byte logical blocks (%s/%s)\n",
-                  (unsigned long long)capacity,
-                  queue_logical_block_size(q),
-                  cap_str_10, cap_str_2);
+                   "new size: %llu %d-byte logical blocks (%s/%s)\n",
+                   nblocks,
+                   queue_logical_block_size(q),
+                   cap_str_10,
+                   cap_str_2);
 
         set_capacity(vblk->disk, capacity);
         revalidate_disk(vblk->disk);
@@ -541,12 +545,9 @@ virtblk_cache_type_store(struct device *dev, struct device_attribute *attr,
         int i;
 
         BUG_ON(!virtio_has_feature(vblk->vdev, VIRTIO_BLK_F_CONFIG_WCE));
-        for (i = ARRAY_SIZE(virtblk_cache_types); --i >= 0; )
-                if (sysfs_streq(buf, virtblk_cache_types[i]))
-                        break;
-
+        i = sysfs_match_string(virtblk_cache_types, buf);
         if (i < 0)
-                return -EINVAL;
+                return i;
 
         virtio_cwrite8(vdev, offsetof(struct virtio_blk_config, wce), i);
         virtblk_update_cache_mode(vdev);
diff --git a/drivers/block/xen-blkback/xenbus.c b/drivers/block/xen-blkback/xenbus.c
index 792da683e70d..2adb8599be93 100644
--- a/drivers/block/xen-blkback/xenbus.c
+++ b/drivers/block/xen-blkback/xenbus.c
@@ -244,6 +244,7 @@ static int xen_blkif_disconnect(struct xen_blkif *blkif)
 {
         struct pending_req *req, *n;
         unsigned int j, r;
+        bool busy = false;
 
         for (r = 0; r < blkif->nr_rings; r++) {
                 struct xen_blkif_ring *ring = &blkif->rings[r];
@@ -261,8 +262,10 @@ static int xen_blkif_disconnect(struct xen_blkif *blkif)
                  * don't have any discard_io or other_io requests. So, checking
                  * for inflight IO is enough.
                  */
-                if (atomic_read(&ring->inflight) > 0)
-                        return -EBUSY;
+                if (atomic_read(&ring->inflight) > 0) {
+                        busy = true;
+                        continue;
+                }
 
                 if (ring->irq) {
                         unbind_from_irqhandler(ring->irq, ring);
@@ -300,6 +303,9 @@ static int xen_blkif_disconnect(struct xen_blkif *blkif)
                 WARN_ON(i != (XEN_BLKIF_REQS_PER_PAGE * blkif->nr_ring_pages));
                 ring->active = false;
         }
+        if (busy)
+                return -EBUSY;
+
         blkif->nr_ring_pages = 0;
         /*
          * blkif->rings was allocated in connect_ring, so we should free it in
diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
index c852ed3c01d5..2468c28d4771 100644
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -111,7 +111,7 @@ struct blk_shadow {
 };
 
 struct blkif_req {
-        int     error;
+        blk_status_t    error;
 };
 
 static inline struct blkif_req *blkif_req(struct request *rq)
@@ -708,6 +708,7 @@ static int blkif_queue_rw_req(struct request *req, struct blkfront_ring_info *ri
          * existing persistent grants, or if we have to get new grants,
          * as there are not sufficiently many free.
          */
+        bool new_persistent_gnts = false;
         struct scatterlist *sg;
         int num_sg, max_grefs, num_grant;
 
@@ -719,19 +720,21 @@ static int blkif_queue_rw_req(struct request *req, struct blkfront_ring_info *ri
                  */
                 max_grefs += INDIRECT_GREFS(max_grefs);
 
-        /*
-         * We have to reserve 'max_grefs' grants because persistent
-         * grants are shared by all rings.
-         */
-        if (max_grefs > 0)
-                if (gnttab_alloc_grant_references(max_grefs, &setup.gref_head) < 0) {
+        /* Check if we have enough persistent grants to allocate a requests */
+        if (rinfo->persistent_gnts_c < max_grefs) {
+                new_persistent_gnts = true;
+
+                if (gnttab_alloc_grant_references(
+                    max_grefs - rinfo->persistent_gnts_c,
+                    &setup.gref_head) < 0) {
                         gnttab_request_free_callback(
                                 &rinfo->callback,
                                 blkif_restart_queue_callback,
                                 rinfo,
-                                max_grefs);
+                                max_grefs - rinfo->persistent_gnts_c);
                         return 1;
                 }
+        }
 
         /* Fill out a communications ring structure. */
         id = blkif_ring_get_request(rinfo, req, &ring_req);
@@ -832,7 +835,7 @@ static int blkif_queue_rw_req(struct request *req, struct blkfront_ring_info *ri
         if (unlikely(require_extra_req))
                 rinfo->shadow[extra_id].req = *extra_ring_req;
 
-        if (max_grefs > 0)
+        if (new_persistent_gnts)
                 gnttab_free_grant_references(setup.gref_head);
 
         return 0;
@@ -906,8 +909,8 @@ out_err:
         return BLK_STS_IOERR;
 
 out_busy:
-        spin_unlock_irqrestore(&rinfo->ring_lock, flags);
         blk_mq_stop_hw_queue(hctx);
+        spin_unlock_irqrestore(&rinfo->ring_lock, flags);
         return BLK_STS_RESOURCE;
 }
 
@@ -1616,7 +1619,7 @@ static irqreturn_t blkif_interrupt(int irq, void *dev_id)
                         if (unlikely(bret->status == BLKIF_RSP_EOPNOTSUPP)) {
                                 printk(KERN_WARNING "blkfront: %s: %s op failed\n",
                                        info->gd->disk_name, op_name(bret->operation));
-                                blkif_req(req)->error = -EOPNOTSUPP;
+                                blkif_req(req)->error = BLK_STS_NOTSUPP;
                         }
                         if (unlikely(bret->status == BLKIF_RSP_ERROR &&
                                      rinfo->shadow[id].req.u.rw.nr_segments == 0)) {
@@ -2072,9 +2075,9 @@ static int blkfront_resume(struct xenbus_device *dev)
                         /*
                          * Get the bios in the request so we can re-queue them.
                          */
-                        if (req_op(shadow[i].request) == REQ_OP_FLUSH ||
-                            req_op(shadow[i].request) == REQ_OP_DISCARD ||
-                            req_op(shadow[i].request) == REQ_OP_SECURE_ERASE ||
+                        if (req_op(shadow[j].request) == REQ_OP_FLUSH ||
+                            req_op(shadow[j].request) == REQ_OP_DISCARD ||
+                            req_op(shadow[j].request) == REQ_OP_SECURE_ERASE ||
                             shadow[j].request->cmd_flags & REQ_FUA) {
                                 /*
                                  * Flush operations don't contain bios, so
diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
index 856d5dc02451..3b1b6340ba13 100644
--- a/drivers/block/zram/zram_drv.c
+++ b/drivers/block/zram/zram_drv.c
@@ -308,7 +308,7 @@ static ssize_t comp_algorithm_store(struct device *dev,
                 struct device_attribute *attr, const char *buf, size_t len)
 {
         struct zram *zram = dev_to_zram(dev);
-        char compressor[CRYPTO_MAX_ALG_NAME];
+        char compressor[ARRAY_SIZE(zram->compressor)];
         size_t sz;
 
         strlcpy(compressor, buf, sizeof(compressor));
@@ -327,7 +327,7 @@ static ssize_t comp_algorithm_store(struct device *dev,
                 return -EBUSY;
         }
 
-        strlcpy(zram->compressor, compressor, sizeof(compressor));
+        strcpy(zram->compressor, compressor);
         up_write(&zram->init_lock);
         return len;
 }
diff --git a/drivers/bus/uniphier-system-bus.c b/drivers/bus/uniphier-system-bus.c
index 1e6e0269edcc..f76be6bd6eb3 100644
--- a/drivers/bus/uniphier-system-bus.c
+++ b/drivers/bus/uniphier-system-bus.c
@@ -256,10 +256,23 @@ static int uniphier_system_bus_probe(struct platform_device *pdev)
 
         uniphier_system_bus_set_reg(priv);
 
+        platform_set_drvdata(pdev, priv);
+
         /* Now, the bus is configured.  Populate platform_devices below it */
         return of_platform_default_populate(dev->of_node, NULL, dev);
 }
 
+static int __maybe_unused uniphier_system_bus_resume(struct device *dev)
+{
+        uniphier_system_bus_set_reg(dev_get_drvdata(dev));
+
+        return 0;
+}
+
+static const struct dev_pm_ops uniphier_system_bus_pm_ops = {
+        SET_SYSTEM_SLEEP_PM_OPS(NULL, uniphier_system_bus_resume)
+};
+
 static const struct of_device_id uniphier_system_bus_match[] = {
         { .compatible = "socionext,uniphier-system-bus" },
         { /* sentinel */ }
@@ -271,6 +284,7 @@ static struct platform_driver uniphier_system_bus_driver = {
         .driver = {
                 .name   = "uniphier-system-bus",
                 .of_match_table = uniphier_system_bus_match,
+                .pm = &uniphier_system_bus_pm_ops,
         },
 };
 module_platform_driver(uniphier_system_bus_driver);
diff --git a/drivers/char/random.c b/drivers/char/random.c
index afa3ce7d3e72..8ad92707e45f 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -1492,7 +1492,7 @@ static void _warn_unseeded_randomness(const char *func_name, void *caller,
 #ifndef CONFIG_WARN_ALL_UNSEEDED_RANDOM
         print_once = true;
 #endif
-        pr_notice("random: %s called from %pF with crng_init=%d\n",
+        pr_notice("random: %s called from %pS with crng_init=%d\n",
                   func_name, caller, crng_init);
 }
 
diff --git a/drivers/clk/clk-gemini.c b/drivers/clk/clk-gemini.c
index c391a49aaaff..b4cf2f699a21 100644
--- a/drivers/clk/clk-gemini.c
+++ b/drivers/clk/clk-gemini.c
@@ -237,6 +237,18 @@ static int gemini_reset(struct reset_controller_dev *rcdev,
                             BIT(GEMINI_RESET_CPU1) | BIT(id));
 }
 
+static int gemini_reset_assert(struct reset_controller_dev *rcdev,
+                               unsigned long id)
+{
+        return 0;
+}
+
+static int gemini_reset_deassert(struct reset_controller_dev *rcdev,
+                                 unsigned long id)
+{
+        return 0;
+}
+
 static int gemini_reset_status(struct reset_controller_dev *rcdev,
                              unsigned long id)
 {
@@ -253,6 +265,8 @@ static int gemini_reset_status(struct reset_controller_dev *rcdev,
 
 static const struct reset_control_ops gemini_reset_ops = {
         .reset = gemini_reset,
+        .assert = gemini_reset_assert,
+        .deassert = gemini_reset_deassert,
         .status = gemini_reset_status,
 };
 
diff --git a/drivers/clk/keystone/sci-clk.c b/drivers/clk/keystone/sci-clk.c
index 43b0f2f08df2..9cdf9d5050ac 100644
--- a/drivers/clk/keystone/sci-clk.c
+++ b/drivers/clk/keystone/sci-clk.c
@@ -22,6 +22,7 @@
 #include <linux/platform_device.h>
 #include <linux/slab.h>
 #include <linux/soc/ti/ti_sci_protocol.h>
+#include <linux/bsearch.h>
 
 #define SCI_CLK_SSC_ENABLE              BIT(0)
 #define SCI_CLK_ALLOW_FREQ_CHANGE       BIT(1)
@@ -44,6 +45,7 @@ struct sci_clk_data {
  * @dev: Device pointer for the clock provider
  * @clk_data: Clock data
  * @clocks: Clocks array for this device
+ * @num_clocks: Total number of clocks for this provider
  */
 struct sci_clk_provider {
         const struct ti_sci_handle *sci;
@@ -51,6 +53,7 @@ struct sci_clk_provider {
         struct device *dev;
         const struct sci_clk_data *clk_data;
         struct clk_hw **clocks;
+        int num_clocks;
 };
 
 /**
@@ -58,7 +61,6 @@ struct sci_clk_provider {
  * @hw:          Hardware clock cookie for common clock framework
  * @dev_id:      Device index
  * @clk_id:      Clock index
- * @node:        Clocks list link
  * @provider:    Master clock provider
  * @flags:       Flags for the clock
  */
@@ -66,7 +68,6 @@ struct sci_clk {
         struct clk_hw hw;
         u16 dev_id;
         u8 clk_id;
-        struct list_head node;
         struct sci_clk_provider *provider;
         u8 flags;
 };
@@ -367,6 +368,19 @@ err:
         return &sci_clk->hw;
 }
 
+static int _cmp_sci_clk(const void *a, const void *b)
+{
+        const struct sci_clk *ca = a;
+        const struct sci_clk *cb = *(struct sci_clk **)b;
+
+        if (ca->dev_id == cb->dev_id && ca->clk_id == cb->clk_id)
+                return 0;
+        if (ca->dev_id > cb->dev_id ||
+            (ca->dev_id == cb->dev_id && ca->clk_id > cb->clk_id))
+                return 1;
+        return -1;
+}
+
 /**
  * sci_clk_get - Xlate function for getting clock handles
  * @clkspec: device tree clock specifier
@@ -380,29 +394,22 @@ err:
 static struct clk_hw *sci_clk_get(struct of_phandle_args *clkspec, void *data)
 {
         struct sci_clk_provider *provider = data;
-        u16 dev_id;
-        u8 clk_id;
-        const struct sci_clk_data *clks = provider->clk_data;
-        struct clk_hw **clocks = provider->clocks;
+        struct sci_clk **clk;
+        struct sci_clk key;
 
         if (clkspec->args_count != 2)
                 return ERR_PTR(-EINVAL);
 
-        dev_id = clkspec->args[0];
-        clk_id = clkspec->args[1];
+        key.dev_id = clkspec->args[0];
+        key.clk_id = clkspec->args[1];
 
-        while (clks->num_clks) {
-                if (clks->dev == dev_id) {
-                        if (clk_id >= clks->num_clks)
-                                return ERR_PTR(-EINVAL);
-
-                        return clocks[clk_id];
-                }
+        clk = bsearch(&key, provider->clocks, provider->num_clocks,
+                      sizeof(clk), _cmp_sci_clk);
 
-                clks++;
-        }
+        if (!clk)
+                return ERR_PTR(-ENODEV);
 
-        return ERR_PTR(-ENODEV);
+        return &(*clk)->hw;
 }
 
 static int ti_sci_init_clocks(struct sci_clk_provider *p)
@@ -410,18 +417,29 @@ static int ti_sci_init_clocks(struct sci_clk_provider *p)
         const struct sci_clk_data *data = p->clk_data;
         struct clk_hw *hw;
         int i;
+        int num_clks = 0;
 
         while (data->num_clks) {
-                p->clocks = devm_kcalloc(p->dev, data->num_clks,
-                                         sizeof(struct sci_clk),
-                                         GFP_KERNEL);
-                if (!p->clocks)
-                        return -ENOMEM;
+                num_clks += data->num_clks;
+                data++;
+        }
 
+        p->num_clocks = num_clks;
+
+        p->clocks = devm_kcalloc(p->dev, num_clks, sizeof(struct sci_clk),
+                                 GFP_KERNEL);
+        if (!p->clocks)
+                return -ENOMEM;
+
+        num_clks = 0;
+
+        data = p->clk_data;
+
+        while (data->num_clks) {
                 for (i = 0; i < data->num_clks; i++) {
                         hw = _sci_clk_build(p, data->dev, i);
                         if (!IS_ERR(hw)) {
-                                p->clocks[i] = hw;
+                                p->clocks[num_clks++] = hw;
                                 continue;
                         }
 
diff --git a/drivers/clk/meson/clk-mpll.c b/drivers/clk/meson/clk-mpll.c
index 39eab69fe51a..44a5a535ca63 100644
--- a/drivers/clk/meson/clk-mpll.c
+++ b/drivers/clk/meson/clk-mpll.c
@@ -161,6 +161,13 @@ static int mpll_set_rate(struct clk_hw *hw,
         reg = PARM_SET(p->width, p->shift, reg, 1);
         writel(reg, mpll->base + p->reg_off);
 
+        p = &mpll->ssen;
+        if (p->width != 0) {
+                reg = readl(mpll->base + p->reg_off);
+                reg = PARM_SET(p->width, p->shift, reg, 1);
+                writel(reg, mpll->base + p->reg_off);
+        }
+
         p = &mpll->n2;
         reg = readl(mpll->base + p->reg_off);
         reg = PARM_SET(p->width, p->shift, reg, n2);
diff --git a/drivers/clk/meson/clkc.h b/drivers/clk/meson/clkc.h
index d6feafe8bd6c..1629da9b4141 100644
--- a/drivers/clk/meson/clkc.h
+++ b/drivers/clk/meson/clkc.h
@@ -118,6 +118,7 @@ struct meson_clk_mpll {
         struct parm sdm_en;
         struct parm n2;
         struct parm en;
+        struct parm ssen;
         spinlock_t *lock;
 };
 
diff --git a/drivers/clk/meson/gxbb.c b/drivers/clk/meson/gxbb.c
index a897ea45327c..a7ea5f3da89d 100644
--- a/drivers/clk/meson/gxbb.c
+++ b/drivers/clk/meson/gxbb.c
@@ -528,6 +528,11 @@ static struct meson_clk_mpll gxbb_mpll0 = {
                 .shift   = 14,
                 .width   = 1,
         },
+        .ssen = {
+                .reg_off = HHI_MPLL_CNTL,
+                .shift   = 25,
+                .width   = 1,
+        },
         .lock = &clk_lock,
         .hw.init = &(struct clk_init_data){
                 .name = "mpll0",
diff --git a/drivers/clk/meson/meson8b.c b/drivers/clk/meson/meson8b.c
index bb3f1de876b1..6ec512ad2598 100644
--- a/drivers/clk/meson/meson8b.c
+++ b/drivers/clk/meson/meson8b.c
@@ -267,6 +267,11 @@ static struct meson_clk_mpll meson8b_mpll0 = {
                 .shift   = 14,
                 .width   = 1,
         },
+        .ssen = {
+                .reg_off = HHI_MPLL_CNTL,
+                .shift   = 25,
+                .width   = 1,
+        },
         .lock = &clk_lock,
         .hw.init = &(struct clk_init_data){
                 .name = "mpll0",
diff --git a/drivers/clk/samsung/clk-exynos5420.c b/drivers/clk/samsung/clk-exynos5420.c
index 0748a0b333c5..9a6476aa7d81 100644
--- a/drivers/clk/samsung/clk-exynos5420.c
+++ b/drivers/clk/samsung/clk-exynos5420.c
@@ -1283,16 +1283,16 @@ static const struct samsung_pll_rate_table exynos5420_pll2550x_24mhz_tbl[] __ini
 static const struct samsung_pll_rate_table exynos5420_epll_24mhz_tbl[] = {
         PLL_36XX_RATE(600000000U, 100, 2, 1, 0),
         PLL_36XX_RATE(400000000U, 200, 3, 2, 0),
-        PLL_36XX_RATE(393216000U, 197, 3, 2, 25690),
-        PLL_36XX_RATE(361267200U, 301, 5, 2, 3671),
+        PLL_36XX_RATE(393216003U, 197, 3, 2, -25690),
+        PLL_36XX_RATE(361267218U, 301, 5, 2, 3671),
         PLL_36XX_RATE(200000000U, 200, 3, 3, 0),
-        PLL_36XX_RATE(196608000U, 197, 3, 3, -25690),
-        PLL_36XX_RATE(180633600U, 301, 5, 3, 3671),
-        PLL_36XX_RATE(131072000U, 131, 3, 3, 4719),
+        PLL_36XX_RATE(196608001U, 197, 3, 3, -25690),
+        PLL_36XX_RATE(180633609U, 301, 5, 3, 3671),
+        PLL_36XX_RATE(131072006U, 131, 3, 3, 4719),
         PLL_36XX_RATE(100000000U, 200, 3, 4, 0),
-        PLL_36XX_RATE(65536000U, 131, 3, 4, 4719),
-        PLL_36XX_RATE(49152000U, 197, 3, 5, 25690),
-        PLL_36XX_RATE(32768000U, 131, 3, 5, 4719),
+        PLL_36XX_RATE( 65536003U, 131, 3, 4, 4719),
+        PLL_36XX_RATE( 49152000U, 197, 3, 5, -25690),
+        PLL_36XX_RATE( 32768001U, 131, 3, 5, 4719),
 };
 
 static struct samsung_pll_clock exynos5x_plls[nr_plls] __initdata = {
diff --git a/drivers/clk/sunxi-ng/ccu-sun5i.c b/drivers/clk/sunxi-ng/ccu-sun5i.c
index 5372bf8be5e6..31d7ffda9aab 100644
--- a/drivers/clk/sunxi-ng/ccu-sun5i.c
+++ b/drivers/clk/sunxi-ng/ccu-sun5i.c
@@ -184,7 +184,7 @@ static struct ccu_mux cpu_clk = {
                 .hw.init        = CLK_HW_INIT_PARENTS("cpu",
                                                       cpu_parents,
                                                       &ccu_mux_ops,
-                                                      CLK_IS_CRITICAL),
+                                                      CLK_SET_RATE_PARENT | CLK_IS_CRITICAL),
         }
 };
 
diff --git a/drivers/clk/x86/clk-pmc-atom.c b/drivers/clk/x86/clk-pmc-atom.c
index f99abc1106f0..08ef69945ffb 100644
--- a/drivers/clk/x86/clk-pmc-atom.c
+++ b/drivers/clk/x86/clk-pmc-atom.c
@@ -186,6 +186,13 @@ static struct clk_plt *plt_clk_register(struct platform_device *pdev, int id,
         pclk->reg = base + PMC_CLK_CTL_OFFSET + id * PMC_CLK_CTL_SIZE;
         spin_lock_init(&pclk->lock);
 
+        /*
+         * If the clock was already enabled by the firmware mark it as critical
+         * to avoid it being gated by the clock framework if no driver owns it.
+         */
+        if (plt_clk_is_enabled(&pclk->hw))
+                init.flags |= CLK_IS_CRITICAL;
+
         ret = devm_clk_hw_register(&pdev->dev, &pclk->hw);
         if (ret) {
                 pclk = ERR_PTR(ret);
diff --git a/drivers/clocksource/Kconfig b/drivers/clocksource/Kconfig
index fcae5ca6ac92..54a67f8a28eb 100644
--- a/drivers/clocksource/Kconfig
+++ b/drivers/clocksource/Kconfig
@@ -262,7 +262,7 @@ config CLKSRC_LPC32XX
 
 config CLKSRC_PISTACHIO
         bool "Clocksource for Pistachio SoC" if COMPILE_TEST
-        depends on HAS_IOMEM
+        depends on GENERIC_CLOCKEVENTS && HAS_IOMEM
         select TIMER_OF
         help
           Enables the clocksource for the Pistachio SoC.
diff --git a/drivers/clocksource/arm_arch_timer.c b/drivers/clocksource/arm_arch_timer.c
index aae87c4c546e..72bbfccef113 100644
--- a/drivers/clocksource/arm_arch_timer.c
+++ b/drivers/clocksource/arm_arch_timer.c
@@ -1440,7 +1440,7 @@ static int __init arch_timer_mem_acpi_init(int platform_timer_count)
          * While unlikely, it's theoretically possible that none of the frames
          * in a timer expose the combination of feature we want.
          */
-        for (i = i; i < timer_count; i++) {
+        for (i = 0; i < timer_count; i++) {
                 timer = &timers[i];
 
                 frame = arch_timer_mem_find_best_frame(timer);
diff --git a/drivers/clocksource/em_sti.c b/drivers/clocksource/em_sti.c
index bc48cbf6a795..269db74a0658 100644
--- a/drivers/clocksource/em_sti.c
+++ b/drivers/clocksource/em_sti.c
@@ -305,7 +305,7 @@ static int em_sti_probe(struct platform_device *pdev)
         irq = platform_get_irq(pdev, 0);
         if (irq < 0) {
                 dev_err(&pdev->dev, "failed to get irq\n");
-                return -EINVAL;
+                return irq;
         }
 
         /* map memory, let base point to the STI instance */
@@ -314,11 +314,12 @@ static int em_sti_probe(struct platform_device *pdev)
         if (IS_ERR(p->base))
                 return PTR_ERR(p->base);
 
-        if (devm_request_irq(&pdev->dev, irq, em_sti_interrupt,
-                             IRQF_TIMER | IRQF_IRQPOLL | IRQF_NOBALANCING,
-                             dev_name(&pdev->dev), p)) {
+        ret = devm_request_irq(&pdev->dev, irq, em_sti_interrupt,
+                               IRQF_TIMER | IRQF_IRQPOLL | IRQF_NOBALANCING,
+                               dev_name(&pdev->dev), p);
+        if (ret) {
                 dev_err(&pdev->dev, "failed to request low IRQ\n");
-                return -ENOENT;
+                return ret;
         }
 
         /* get hold of clock */
diff --git a/drivers/clocksource/timer-of.c b/drivers/clocksource/timer-of.c
index d509b500a7b5..4d7aef9d9c15 100644
--- a/drivers/clocksource/timer-of.c
+++ b/drivers/clocksource/timer-of.c
@@ -128,9 +128,9 @@ static __init int timer_base_init(struct device_node *np,
         const char *name = of_base->name ? of_base->name : np->full_name;
 
         of_base->base = of_io_request_and_map(np, of_base->index, name);
-        if (!of_base->base) {
+        if (IS_ERR(of_base->base)) {
                 pr_err("Failed to iomap (%s)\n", name);
-                return -ENXIO;
+                return PTR_ERR(of_base->base);
         }
 
         return 0;
diff --git a/drivers/cpufreq/Kconfig.arm b/drivers/cpufreq/Kconfig.arm
index 2011fec2d6ad..bdce4488ded1 100644
--- a/drivers/cpufreq/Kconfig.arm
+++ b/drivers/cpufreq/Kconfig.arm
@@ -71,15 +71,6 @@ config ARM_HIGHBANK_CPUFREQ
 
           If in doubt, say N.
 
-config ARM_DB8500_CPUFREQ
-        tristate "ST-Ericsson DB8500 cpufreq" if COMPILE_TEST && !ARCH_U8500
-        default ARCH_U8500
-        depends on HAS_IOMEM
-        depends on !CPU_THERMAL || THERMAL
-        help
-          This adds the CPUFreq driver for ST-Ericsson Ux500 (DB8500) SoC
-          series.
-
 config ARM_IMX6Q_CPUFREQ
         tristate "Freescale i.MX6 cpufreq support"
         depends on ARCH_MXC
@@ -96,14 +87,13 @@ config ARM_KIRKWOOD_CPUFREQ
           This adds the CPUFreq driver for Marvell Kirkwood
           SoCs.
 
-config ARM_MT8173_CPUFREQ
-        tristate "Mediatek MT8173 CPUFreq support"
+config ARM_MEDIATEK_CPUFREQ
+        tristate "CPU Frequency scaling support for MediaTek SoCs"
         depends on ARCH_MEDIATEK && REGULATOR
-        depends on ARM64 || (ARM_CPU_TOPOLOGY && COMPILE_TEST)
         depends on !CPU_THERMAL || THERMAL
         select PM_OPP
         help
-          This adds the CPUFreq driver support for Mediatek MT8173 SoC.
+          This adds the CPUFreq driver support for MediaTek SoCs.
 
 config ARM_OMAP2PLUS_CPUFREQ
         bool "TI OMAP2+"
@@ -242,6 +232,11 @@ config ARM_STI_CPUFREQ
           this config option if you wish to add CPUFreq support for STi based
           SoCs.
 
+config ARM_TANGO_CPUFREQ
+        bool
+        depends on CPUFREQ_DT && ARCH_TANGO
+        default y
+
 config ARM_TEGRA20_CPUFREQ
         bool "Tegra20 CPUFreq support"
         depends on ARCH_TEGRA
diff --git a/drivers/cpufreq/Makefile b/drivers/cpufreq/Makefile
index ab3a42cd29ef..c7af9b2a255e 100644
--- a/drivers/cpufreq/Makefile
+++ b/drivers/cpufreq/Makefile
@@ -53,12 +53,11 @@ obj-$(CONFIG_ARM_DT_BL_CPUFREQ)		+= arm_big_little_dt.o
 
 obj-$(CONFIG_ARM_BRCMSTB_AVS_CPUFREQ)   += brcmstb-avs-cpufreq.o
 obj-$(CONFIG_ARCH_DAVINCI)              += davinci-cpufreq.o
-obj-$(CONFIG_ARM_DB8500_CPUFREQ)        += dbx500-cpufreq.o
 obj-$(CONFIG_ARM_EXYNOS5440_CPUFREQ)    += exynos5440-cpufreq.o
 obj-$(CONFIG_ARM_HIGHBANK_CPUFREQ)      += highbank-cpufreq.o
 obj-$(CONFIG_ARM_IMX6Q_CPUFREQ)         += imx6q-cpufreq.o
 obj-$(CONFIG_ARM_KIRKWOOD_CPUFREQ)      += kirkwood-cpufreq.o
-obj-$(CONFIG_ARM_MT8173_CPUFREQ)        += mt8173-cpufreq.o
+obj-$(CONFIG_ARM_MEDIATEK_CPUFREQ)      += mediatek-cpufreq.o
 obj-$(CONFIG_ARM_OMAP2PLUS_CPUFREQ)     += omap-cpufreq.o
 obj-$(CONFIG_ARM_PXA2xx_CPUFREQ)        += pxa2xx-cpufreq.o
 obj-$(CONFIG_PXA3xx)                    += pxa3xx-cpufreq.o
@@ -75,6 +74,7 @@ obj-$(CONFIG_ARM_SA1110_CPUFREQ)	+= sa1110-cpufreq.o
 obj-$(CONFIG_ARM_SCPI_CPUFREQ)          += scpi-cpufreq.o
 obj-$(CONFIG_ARM_SPEAR_CPUFREQ)         += spear-cpufreq.o
 obj-$(CONFIG_ARM_STI_CPUFREQ)           += sti-cpufreq.o
+obj-$(CONFIG_ARM_TANGO_CPUFREQ)         += tango-cpufreq.o
 obj-$(CONFIG_ARM_TEGRA20_CPUFREQ)       += tegra20-cpufreq.o
 obj-$(CONFIG_ARM_TEGRA124_CPUFREQ)      += tegra124-cpufreq.o
 obj-$(CONFIG_ARM_TEGRA186_CPUFREQ)      += tegra186-cpufreq.o
diff --git a/drivers/cpufreq/arm_big_little.c b/drivers/cpufreq/arm_big_little.c
index ea6d62547b10..17504129fd77 100644
--- a/drivers/cpufreq/arm_big_little.c
+++ b/drivers/cpufreq/arm_big_little.c
@@ -483,11 +483,8 @@ static int bL_cpufreq_init(struct cpufreq_policy *policy)
                 return ret;
         }
 
-        if (arm_bL_ops->get_transition_latency)
-                policy->cpuinfo.transition_latency =
-                        arm_bL_ops->get_transition_latency(cpu_dev);
-        else
-                policy->cpuinfo.transition_latency = CPUFREQ_ETERNAL;
+        policy->cpuinfo.transition_latency =
+                                arm_bL_ops->get_transition_latency(cpu_dev);
 
         if (is_bL_switching_enabled())
                 per_cpu(cpu_last_req_freq, policy->cpu) = clk_get_cpu_rate(policy->cpu);
@@ -622,7 +619,8 @@ int bL_cpufreq_register(struct cpufreq_arm_bL_ops *ops)
                 return -EBUSY;
         }
 
-        if (!ops || !strlen(ops->name) || !ops->init_opp_table) {
+        if (!ops || !strlen(ops->name) || !ops->init_opp_table ||
+            !ops->get_transition_latency) {
                 pr_err("%s: Invalid arm_bL_ops, exiting\n", __func__);
                 return -ENODEV;
         }
diff --git a/drivers/cpufreq/cppc_cpufreq.c b/drivers/cpufreq/cppc_cpufreq.c
index 10be285c9055..a1c3025f9df7 100644
--- a/drivers/cpufreq/cppc_cpufreq.c
+++ b/drivers/cpufreq/cppc_cpufreq.c
@@ -172,7 +172,6 @@ static int cppc_cpufreq_cpu_init(struct cpufreq_policy *policy)
                 return -EFAULT;
         }
 
-        cpumask_set_cpu(policy->cpu, policy->cpus);
         cpu->cur_policy = policy;
 
         /* Set policy->cur to max now. The governors will adjust later. */
diff --git a/drivers/cpufreq/cpufreq-dt-platdev.c b/drivers/cpufreq/cpufreq-dt-platdev.c
index 1c262923fe58..a020da7940d6 100644
--- a/drivers/cpufreq/cpufreq-dt-platdev.c
+++ b/drivers/cpufreq/cpufreq-dt-platdev.c
@@ -9,11 +9,16 @@
 
 #include <linux/err.h>
 #include <linux/of.h>
+#include <linux/of_device.h>
 #include <linux/platform_device.h>
 
 #include "cpufreq-dt.h"
 
-static const struct of_device_id machines[] __initconst = {
+/*
+ * Machines for which the cpufreq device is *always* created, mostly used for
+ * platforms using "operating-points" (V1) property.
+ */
+static const struct of_device_id whitelist[] __initconst = {
         { .compatible = "allwinner,sun4i-a10", },
         { .compatible = "allwinner,sun5i-a10s", },
         { .compatible = "allwinner,sun5i-a13", },
@@ -22,7 +27,6 @@ static const struct of_device_id machines[] __initconst = {
         { .compatible = "allwinner,sun6i-a31s", },
         { .compatible = "allwinner,sun7i-a20", },
         { .compatible = "allwinner,sun8i-a23", },
-        { .compatible = "allwinner,sun8i-a33", },
         { .compatible = "allwinner,sun8i-a83t", },
         { .compatible = "allwinner,sun8i-h3", },
 
@@ -32,7 +36,6 @@ static const struct of_device_id machines[] __initconst = {
         { .compatible = "arm,integrator-cp", },
 
         { .compatible = "hisilicon,hi3660", },
-        { .compatible = "hisilicon,hi6220", },
 
         { .compatible = "fsl,imx27", },
         { .compatible = "fsl,imx51", },
@@ -46,11 +49,8 @@ static const struct of_device_id machines[] __initconst = {
         { .compatible = "samsung,exynos3250", },
         { .compatible = "samsung,exynos4210", },
         { .compatible = "samsung,exynos4212", },
-        { .compatible = "samsung,exynos4412", },
         { .compatible = "samsung,exynos5250", },
 #ifndef CONFIG_BL_SWITCHER
-        { .compatible = "samsung,exynos5420", },
-        { .compatible = "samsung,exynos5433", },
         { .compatible = "samsung,exynos5800", },
 #endif
 
@@ -67,6 +67,8 @@ static const struct of_device_id machines[] __initconst = {
         { .compatible = "renesas,r8a7792", },
         { .compatible = "renesas,r8a7793", },
         { .compatible = "renesas,r8a7794", },
+        { .compatible = "renesas,r8a7795", },
+        { .compatible = "renesas,r8a7796", },
         { .compatible = "renesas,sh73a0", },
 
         { .compatible = "rockchip,rk2928", },
@@ -76,17 +78,17 @@ static const struct of_device_id machines[] __initconst = {
         { .compatible = "rockchip,rk3188", },
         { .compatible = "rockchip,rk3228", },
         { .compatible = "rockchip,rk3288", },
+        { .compatible = "rockchip,rk3328", },
         { .compatible = "rockchip,rk3366", },
         { .compatible = "rockchip,rk3368", },
         { .compatible = "rockchip,rk3399", },
 
-        { .compatible = "sigma,tango4" },
-
-        { .compatible = "socionext,uniphier-pro5", },
-        { .compatible = "socionext,uniphier-pxs2", },
         { .compatible = "socionext,uniphier-ld6b", },
-        { .compatible = "socionext,uniphier-ld11", },
-        { .compatible = "socionext,uniphier-ld20", },
+
+        { .compatible = "st-ericsson,u8500", },
+        { .compatible = "st-ericsson,u8540", },
+        { .compatible = "st-ericsson,u9500", },
+        { .compatible = "st-ericsson,u9540", },
 
         { .compatible = "ti,omap2", },
         { .compatible = "ti,omap3", },
@@ -94,27 +96,56 @@ static const struct of_device_id machines[] __initconst = {
         { .compatible = "ti,omap5", },
 
         { .compatible = "xlnx,zynq-7000", },
+        { .compatible = "xlnx,zynqmp", },
 
-        { .compatible = "zte,zx296718", },
+        { }
+};
 
+/*
+ * Machines for which the cpufreq device is *not* created, mostly used for
+ * platforms using "operating-points-v2" property.
+ */
+static const struct of_device_id blacklist[] __initconst = {
         { }
 };
 
+static bool __init cpu0_node_has_opp_v2_prop(void)
+{
+        struct device_node *np = of_cpu_device_node_get(0);
+        bool ret = false;
+
+        if (of_get_property(np, "operating-points-v2", NULL))
+                ret = true;
+
+        of_node_put(np);
+        return ret;
+}
+
 static int __init cpufreq_dt_platdev_init(void)
 {
         struct device_node *np = of_find_node_by_path("/");
         const struct of_device_id *match;
+        const void *data = NULL;
 
         if (!np)
                 return -ENODEV;
 
-        match = of_match_node(machines, np);
+        match = of_match_node(whitelist, np);
+        if (match) {
+                data = match->data;
+                goto create_pdev;
+        }
+
+        if (cpu0_node_has_opp_v2_prop() && !of_match_node(blacklist, np))
+                goto create_pdev;
+
         of_node_put(np);
-        if (!match)
-                return -ENODEV;
+        return -ENODEV;
 
+create_pdev:
+        of_node_put(np);
         return PTR_ERR_OR_ZERO(platform_device_register_data(NULL, "cpufreq-dt",
-                               -1, match->data,
+                               -1, data,
                                sizeof(struct cpufreq_dt_platform_data)));
 }
 device_initcall(cpufreq_dt_platdev_init);
diff --git a/drivers/cpufreq/cpufreq-nforce2.c b/drivers/cpufreq/cpufreq-nforce2.c
index 5503d491b016..dbf82f36d270 100644
--- a/drivers/cpufreq/cpufreq-nforce2.c
+++ b/drivers/cpufreq/cpufreq-nforce2.c
@@ -357,7 +357,6 @@ static int nforce2_cpu_init(struct cpufreq_policy *policy)
         /* cpuinfo and default policy values */
         policy->min = policy->cpuinfo.min_freq = min_fsb * fid * 100;
         policy->max = policy->cpuinfo.max_freq = max_fsb * fid * 100;
-        policy->cpuinfo.transition_latency = CPUFREQ_ETERNAL;
 
         return 0;
 }
@@ -369,6 +368,7 @@ static int nforce2_cpu_exit(struct cpufreq_policy *policy)
 
 static struct cpufreq_driver nforce2_driver = {
         .name = "nforce2",
+        .flags = CPUFREQ_NO_AUTO_DYNAMIC_SWITCHING,
         .verify = nforce2_verify,
         .target = nforce2_target,
         .get = nforce2_get,
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index 0c728190e444..ea43b147a7fe 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -524,6 +524,32 @@ unsigned int cpufreq_driver_resolve_freq(struct cpufreq_policy *policy,
 }
 EXPORT_SYMBOL_GPL(cpufreq_driver_resolve_freq);
 
+unsigned int cpufreq_policy_transition_delay_us(struct cpufreq_policy *policy)
+{
+        unsigned int latency;
+
+        if (policy->transition_delay_us)
+                return policy->transition_delay_us;
+
+        latency = policy->cpuinfo.transition_latency / NSEC_PER_USEC;
+        if (latency) {
+                /*
+                 * For platforms that can change the frequency very fast (< 10
+                 * us), the above formula gives a decent transition delay. But
+                 * for platforms where transition_latency is in milliseconds, it
+                 * ends up giving unrealistic values.
+                 *
+                 * Cap the default transition delay to 10 ms, which seems to be
+                 * a reasonable amount of time after which we should reevaluate
+                 * the frequency.
+                 */
+                return min(latency * LATENCY_MULTIPLIER, (unsigned int)10000);
+        }
+
+        return LATENCY_MULTIPLIER;
+}
+EXPORT_SYMBOL_GPL(cpufreq_policy_transition_delay_us);
+
 /*********************************************************************
  *                          SYSFS INTERFACE                          *
  *********************************************************************/
@@ -1989,13 +2015,13 @@ static int cpufreq_init_governor(struct cpufreq_policy *policy)
         if (!policy->governor)
                 return -EINVAL;
 
-        if (policy->governor->max_transition_latency &&
-            policy->cpuinfo.transition_latency >
-            policy->governor->max_transition_latency) {
+        /* Platform doesn't want dynamic frequency switching ? */
+        if (policy->governor->dynamic_switching &&
+            cpufreq_driver->flags & CPUFREQ_NO_AUTO_DYNAMIC_SWITCHING) {
                 struct cpufreq_governor *gov = cpufreq_fallback_governor();
 
                 if (gov) {
-                        pr_warn("%s governor failed, too long transition latency of HW, fallback to %s governor\n",
+                        pr_warn("Can't use %s governor as dynamic switching is disallowed. Fallback to %s governor\n",
                                 policy->governor->name, gov->name);
                         policy->governor = gov;
                 } else {
diff --git a/drivers/cpufreq/cpufreq_conservative.c b/drivers/cpufreq/cpufreq_conservative.c
index 88220ff3e1c2..f20f20a77d4d 100644
--- a/drivers/cpufreq/cpufreq_conservative.c
+++ b/drivers/cpufreq/cpufreq_conservative.c
@@ -246,7 +246,6 @@ gov_show_one_common(sampling_rate);
 gov_show_one_common(sampling_down_factor);
 gov_show_one_common(up_threshold);
 gov_show_one_common(ignore_nice_load);
-gov_show_one_common(min_sampling_rate);
 gov_show_one(cs, down_threshold);
 gov_show_one(cs, freq_step);
 
@@ -254,12 +253,10 @@ gov_attr_rw(sampling_rate);
 gov_attr_rw(sampling_down_factor);
 gov_attr_rw(up_threshold);
 gov_attr_rw(ignore_nice_load);
-gov_attr_ro(min_sampling_rate);
 gov_attr_rw(down_threshold);
 gov_attr_rw(freq_step);
 
 static struct attribute *cs_attributes[] = {
-        &min_sampling_rate.attr,
         &sampling_rate.attr,
         &sampling_down_factor.attr,
         &up_threshold.attr,
@@ -297,10 +294,7 @@ static int cs_init(struct dbs_data *dbs_data)
         dbs_data->up_threshold = DEF_FREQUENCY_UP_THRESHOLD;
         dbs_data->sampling_down_factor = DEF_SAMPLING_DOWN_FACTOR;
         dbs_data->ignore_nice_load = 0;
-
         dbs_data->tuners = tuners;
-        dbs_data->min_sampling_rate = MIN_SAMPLING_RATE_RATIO *
-                jiffies_to_usecs(10);
 
         return 0;
 }
diff --git a/drivers/cpufreq/cpufreq_governor.c b/drivers/cpufreq/cpufreq_governor.c
index ce5f3ec7ce71..58d4f4e1ad6a 100644
--- a/drivers/cpufreq/cpufreq_governor.c
+++ b/drivers/cpufreq/cpufreq_governor.c
@@ -47,14 +47,11 @@ ssize_t store_sampling_rate(struct gov_attr_set *attr_set, const char *buf,
 {
         struct dbs_data *dbs_data = to_dbs_data(attr_set);
         struct policy_dbs_info *policy_dbs;
-        unsigned int rate;
         int ret;
-        ret = sscanf(buf, "%u", &rate);
+        ret = sscanf(buf, "%u", &dbs_data->sampling_rate);
         if (ret != 1)
                 return -EINVAL;
 
-        dbs_data->sampling_rate = max(rate, dbs_data->min_sampling_rate);
-
         /*
          * We are operating under dbs_data->mutex and so the list and its
          * entries can't be freed concurrently.
@@ -395,7 +392,6 @@ int cpufreq_dbs_governor_init(struct cpufreq_policy *policy)
         struct dbs_governor *gov = dbs_governor_of(policy);
         struct dbs_data *dbs_data;
         struct policy_dbs_info *policy_dbs;
-        unsigned int latency;
         int ret = 0;
 
         /* State should be equivalent to EXIT */
@@ -434,16 +430,7 @@ int cpufreq_dbs_governor_init(struct cpufreq_policy *policy)
         if (ret)
                 goto free_policy_dbs_info;
 
-        /* policy latency is in ns. Convert it to us first */
-        latency = policy->cpuinfo.transition_latency / 1000;
-        if (latency == 0)
-                latency = 1;
-
-        /* Bring kernel and HW constraints together */
-        dbs_data->min_sampling_rate = max(dbs_data->min_sampling_rate,
-                                          MIN_LATENCY_MULTIPLIER * latency);
-        dbs_data->sampling_rate = max(dbs_data->min_sampling_rate,
-                                      LATENCY_MULTIPLIER * latency);
+        dbs_data->sampling_rate = cpufreq_policy_transition_delay_us(policy);
 
         if (!have_governor_per_policy())
                 gov->gdbs_data = dbs_data;
diff --git a/drivers/cpufreq/cpufreq_governor.h b/drivers/cpufreq/cpufreq_governor.h
index 0236ec2cd654..8463f5def0f5 100644
--- a/drivers/cpufreq/cpufreq_governor.h
+++ b/drivers/cpufreq/cpufreq_governor.h
@@ -41,7 +41,6 @@ enum {OD_NORMAL_SAMPLE, OD_SUB_SAMPLE};
 struct dbs_data {
         struct gov_attr_set attr_set;
         void *tuners;
-        unsigned int min_sampling_rate;
         unsigned int ignore_nice_load;
         unsigned int sampling_rate;
         unsigned int sampling_down_factor;
@@ -160,7 +159,7 @@ void cpufreq_dbs_governor_limits(struct cpufreq_policy *policy);
 #define CPUFREQ_DBS_GOVERNOR_INITIALIZER(_name_)                        \
         {                                                               \
                 .name = _name_,                                         \
-                .max_transition_latency = TRANSITION_LATENCY_LIMIT,     \
+                .dynamic_switching = true,                              \
                 .owner = THIS_MODULE,                                   \
                 .init = cpufreq_dbs_governor_init,                      \
                 .exit = cpufreq_dbs_governor_exit,                      \
diff --git a/drivers/cpufreq/cpufreq_ondemand.c b/drivers/cpufreq/cpufreq_ondemand.c
index 3937acf7e026..6b423eebfd5d 100644
--- a/drivers/cpufreq/cpufreq_ondemand.c
+++ b/drivers/cpufreq/cpufreq_ondemand.c
@@ -319,7 +319,6 @@ gov_show_one_common(sampling_rate);
 gov_show_one_common(up_threshold);
 gov_show_one_common(sampling_down_factor);
 gov_show_one_common(ignore_nice_load);
-gov_show_one_common(min_sampling_rate);
 gov_show_one_common(io_is_busy);
 gov_show_one(od, powersave_bias);
 
@@ -329,10 +328,8 @@ gov_attr_rw(up_threshold);
 gov_attr_rw(sampling_down_factor);
 gov_attr_rw(ignore_nice_load);
 gov_attr_rw(powersave_bias);
-gov_attr_ro(min_sampling_rate);
 
 static struct attribute *od_attributes[] = {
-        &min_sampling_rate.attr,
         &sampling_rate.attr,
         &up_threshold.attr,
         &sampling_down_factor.attr,
@@ -373,17 +370,8 @@ static int od_init(struct dbs_data *dbs_data)
         if (idle_time != -1ULL) {
                 /* Idle micro accounting is supported. Use finer thresholds */
                 dbs_data->up_threshold = MICRO_FREQUENCY_UP_THRESHOLD;
-                /*
-                 * In nohz/micro accounting case we set the minimum frequency
-                 * not depending on HZ, but fixed (very low).
-                */
-                dbs_data->min_sampling_rate = MICRO_FREQUENCY_MIN_SAMPLE_RATE;
         } else {
                 dbs_data->up_threshold = DEF_FREQUENCY_UP_THRESHOLD;
-
-                /* For correct statistics, we need 10 ticks for each measure */
-                dbs_data->min_sampling_rate = MIN_SAMPLING_RATE_RATIO *
-                        jiffies_to_usecs(10);
         }
 
         dbs_data->sampling_down_factor = DEF_SAMPLING_DOWN_FACTOR;
diff --git a/drivers/cpufreq/dbx500-cpufreq.c b/drivers/cpufreq/dbx500-cpufreq.c
deleted file mode 100644
index 4ee0431579c1..000000000000
--- a/drivers/cpufreq/dbx500-cpufreq.c
+++ /dev/null
@@ -1,103 +0,0 @@
-/*
- * Copyright (C) STMicroelectronics 2009
- * Copyright (C) ST-Ericsson SA 2010-2012
- *
- * License Terms: GNU General Public License v2
- * Author: Sundar Iyer <sundar.iyer@stericsson.com>
- * Author: Martin Persson <martin.persson@stericsson.com>
- * Author: Jonas Aaberg <jonas.aberg@stericsson.com>
- */
-
-#include <linux/module.h>
-#include <linux/kernel.h>
-#include <linux/cpufreq.h>
-#include <linux/cpu_cooling.h>
-#include <linux/delay.h>
-#include <linux/slab.h>
-#include <linux/platform_device.h>
-#include <linux/clk.h>
-
-static struct cpufreq_frequency_table *freq_table;
-static struct clk *armss_clk;
-static struct thermal_cooling_device *cdev;
-
-static int dbx500_cpufreq_target(struct cpufreq_policy *policy,
-                                unsigned int index)
-{
-        /* update armss clk frequency */
-        return clk_set_rate(armss_clk, freq_table[index].frequency * 1000);
-}
-
-static int dbx500_cpufreq_init(struct cpufreq_policy *policy)
-{
-        policy->clk = armss_clk;
-        return cpufreq_generic_init(policy, freq_table, 20 * 1000);
-}
-
-static int dbx500_cpufreq_exit(struct cpufreq_policy *policy)
-{
-        if (!IS_ERR(cdev))
-                cpufreq_cooling_unregister(cdev);
-        return 0;
-}
-
-static void dbx500_cpufreq_ready(struct cpufreq_policy *policy)
-{
-        cdev = cpufreq_cooling_register(policy);
-        if (IS_ERR(cdev))
-                pr_err("Failed to register cooling device %ld\n", PTR_ERR(cdev));
-        else
-                pr_info("Cooling device registered: %s\n", cdev->type);
-}
-
-static struct cpufreq_driver dbx500_cpufreq_driver = {
-        .flags  = CPUFREQ_STICKY | CPUFREQ_CONST_LOOPS |
-                        CPUFREQ_NEED_INITIAL_FREQ_CHECK,
-        .verify = cpufreq_generic_frequency_table_verify,
-        .target_index = dbx500_cpufreq_target,
-        .get    = cpufreq_generic_get,
-        .init   = dbx500_cpufreq_init,
-        .exit  = dbx500_cpufreq_exit,
-        .ready  = dbx500_cpufreq_ready,
-        .name   = "DBX500",
-        .attr   = cpufreq_generic_attr,
-};
-
-static int dbx500_cpufreq_probe(struct platform_device *pdev)
-{
-        struct cpufreq_frequency_table *pos;
-
-        freq_table = dev_get_platdata(&pdev->dev);
-        if (!freq_table) {
-                pr_err("dbx500-cpufreq: Failed to fetch cpufreq table\n");
-                return -ENODEV;
-        }
-
-        armss_clk = clk_get(&pdev->dev, "armss");
-        if (IS_ERR(armss_clk)) {
-                pr_err("dbx500-cpufreq: Failed to get armss clk\n");
-                return PTR_ERR(armss_clk);
-        }
-
-        pr_info("dbx500-cpufreq: Available frequencies:\n");
-        cpufreq_for_each_entry(pos, freq_table)
-                pr_info("  %d Mhz\n", pos->frequency / 1000);
-
-        return cpufreq_register_driver(&dbx500_cpufreq_driver);
-}
-
-static struct platform_driver dbx500_cpufreq_plat_driver = {
-        .driver = {
-                .name = "cpufreq-ux500",
-        },
-        .probe = dbx500_cpufreq_probe,
-};
-
-static int __init dbx500_cpufreq_register(void)
-{
-        return platform_driver_register(&dbx500_cpufreq_plat_driver);
-}
-device_initcall(dbx500_cpufreq_register);
-
-MODULE_LICENSE("GPL v2");
-MODULE_DESCRIPTION("cpufreq driver for DBX500");
diff --git a/drivers/cpufreq/elanfreq.c b/drivers/cpufreq/elanfreq.c
index bfce11cba1df..45e2ca62515e 100644
--- a/drivers/cpufreq/elanfreq.c
+++ b/drivers/cpufreq/elanfreq.c
@@ -165,9 +165,6 @@ static int elanfreq_cpu_init(struct cpufreq_policy *policy)
                 if (pos->frequency > max_freq)
                         pos->frequency = CPUFREQ_ENTRY_INVALID;
 
-        /* cpuinfo and default policy values */
-        policy->cpuinfo.transition_latency = CPUFREQ_ETERNAL;
-
         return cpufreq_table_validate_and_show(policy, elanfreq_table);
 }
 
@@ -196,6 +193,7 @@ __setup("elanfreq=", elanfreq_setup);
 
 static struct cpufreq_driver elanfreq_driver = {
         .get            = elanfreq_get_cpu_frequency,
+        .flags          = CPUFREQ_NO_AUTO_DYNAMIC_SWITCHING,
         .verify         = cpufreq_generic_frequency_table_verify,
         .target_index   = elanfreq_target,
         .init           = elanfreq_cpu_init,
diff --git a/drivers/cpufreq/gx-suspmod.c b/drivers/cpufreq/gx-suspmod.c
index 3488c9c175eb..8f52a06664e3 100644
--- a/drivers/cpufreq/gx-suspmod.c
+++ b/drivers/cpufreq/gx-suspmod.c
@@ -428,7 +428,6 @@ static int cpufreq_gx_cpu_init(struct cpufreq_policy *policy)
         policy->max = maxfreq;
         policy->cpuinfo.min_freq = maxfreq / max_duration;
         policy->cpuinfo.max_freq = maxfreq;
-        policy->cpuinfo.transition_latency = CPUFREQ_ETERNAL;
 
         return 0;
 }
@@ -438,6 +437,7 @@ static int cpufreq_gx_cpu_init(struct cpufreq_policy *policy)
  *   MediaGX/Geode GX initialize cpufreq driver
  */
 static struct cpufreq_driver gx_suspmod_driver = {
+        .flags          = CPUFREQ_NO_AUTO_DYNAMIC_SWITCHING,
         .get            = gx_get_cpuspeed,
         .verify         = cpufreq_gx_verify,
         .target         = cpufreq_gx_target,
diff --git a/drivers/cpufreq/imx6q-cpufreq.c b/drivers/cpufreq/imx6q-cpufreq.c
index b6edd3ccaa55..14466a9b01c0 100644
--- a/drivers/cpufreq/imx6q-cpufreq.c
+++ b/drivers/cpufreq/imx6q-cpufreq.c
@@ -47,6 +47,7 @@ static int imx6q_set_target(struct cpufreq_policy *policy, unsigned int index)
         struct dev_pm_opp *opp;
         unsigned long freq_hz, volt, volt_old;
         unsigned int old_freq, new_freq;
+        bool pll1_sys_temp_enabled = false;
         int ret;
 
         new_freq = freq_table[index].frequency;
@@ -124,6 +125,10 @@ static int imx6q_set_target(struct cpufreq_policy *policy, unsigned int index)
                 if (freq_hz > clk_get_rate(pll2_pfd2_396m_clk)) {
                         clk_set_rate(pll1_sys_clk, new_freq * 1000);
                         clk_set_parent(pll1_sw_clk, pll1_sys_clk);
+                } else {
+                        /* pll1_sys needs to be enabled for divider rate change to work. */
+                        pll1_sys_temp_enabled = true;
+                        clk_prepare_enable(pll1_sys_clk);
                 }
         }
 
@@ -135,6 +140,10 @@ static int imx6q_set_target(struct cpufreq_policy *policy, unsigned int index)
                 return ret;
         }
 
+        /* PLL1 is only needed until after ARM-PODF is set. */
+        if (pll1_sys_temp_enabled)
+                clk_disable_unprepare(pll1_sys_clk);
+
         /* scaling down?  scale voltage after frequency */
         if (new_freq < old_freq) {
                 ret = regulator_set_voltage_tol(arm_reg, volt, 0);
diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
index d299b86a5a00..0c50637e6bda 100644
--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -1613,8 +1613,7 @@ static inline bool intel_pstate_sample(struct cpudata *cpu, u64 time)
 
 static inline int32_t get_avg_frequency(struct cpudata *cpu)
 {
-        return mul_ext_fp(cpu->sample.core_avg_perf,
-                          cpu->pstate.max_pstate_physical * cpu->pstate.scaling);
+        return mul_ext_fp(cpu->sample.core_avg_perf, cpu_khz);
 }
 
 static inline int32_t get_avg_pstate(struct cpudata *cpu)
@@ -1930,13 +1929,6 @@ static int intel_pstate_init_cpu(unsigned int cpunum)
         return 0;
 }
 
-static unsigned int intel_pstate_get(unsigned int cpu_num)
-{
-        struct cpudata *cpu = all_cpu_data[cpu_num];
-
-        return cpu ? get_avg_frequency(cpu) : 0;
-}
-
 static void intel_pstate_set_update_util_hook(unsigned int cpu_num)
 {
         struct cpudata *cpu = all_cpu_data[cpu_num];
@@ -2148,7 +2140,6 @@ static int __intel_pstate_cpu_init(struct cpufreq_policy *policy)
         policy->cpuinfo.max_freq *= cpu->pstate.scaling;
 
         intel_pstate_init_acpi_perf_limits(policy);
-        cpumask_set_cpu(policy->cpu, policy->cpus);
 
         policy->fast_switch_possible = true;
 
@@ -2162,7 +2153,6 @@ static int intel_pstate_cpu_init(struct cpufreq_policy *policy)
         if (ret)
                 return ret;
 
-        policy->cpuinfo.transition_latency = CPUFREQ_ETERNAL;
         if (IS_ENABLED(CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE))
                 policy->policy = CPUFREQ_POLICY_PERFORMANCE;
         else
@@ -2177,7 +2167,6 @@ static struct cpufreq_driver intel_pstate = {
         .setpolicy      = intel_pstate_set_policy,
         .suspend        = intel_pstate_hwp_save_state,
         .resume         = intel_pstate_resume,
-        .get            = intel_pstate_get,
         .init           = intel_pstate_cpu_init,
         .exit           = intel_pstate_cpu_exit,
         .stop_cpu       = intel_pstate_stop_cpu,
diff --git a/drivers/cpufreq/longrun.c b/drivers/cpufreq/longrun.c
index 074971b12635..542aa9adba1a 100644
--- a/drivers/cpufreq/longrun.c
+++ b/drivers/cpufreq/longrun.c
@@ -270,7 +270,6 @@ static int longrun_cpu_init(struct cpufreq_policy *policy)
         /* cpuinfo and default policy values */
         policy->cpuinfo.min_freq = longrun_low_freq;
         policy->cpuinfo.max_freq = longrun_high_freq;
-        policy->cpuinfo.transition_latency = CPUFREQ_ETERNAL;
         longrun_get_policy(policy);
 
         return 0;
diff --git a/drivers/cpufreq/loongson2_cpufreq.c b/drivers/cpufreq/loongson2_cpufreq.c
index 9ac27b22476c..da344696beed 100644
--- a/drivers/cpufreq/loongson2_cpufreq.c
+++ b/drivers/cpufreq/loongson2_cpufreq.c
@@ -114,7 +114,7 @@ static struct cpufreq_driver loongson2_cpufreq_driver = {
         .attr = cpufreq_generic_attr,
 };
 
-static struct platform_device_id platform_device_ids[] = {
+static const struct platform_device_id platform_device_ids[] = {
         {
                 .name = "loongson2_cpufreq",
         },
diff --git a/drivers/cpufreq/mt8173-cpufreq.c b/drivers/cpufreq/mediatek-cpufreq.c
index f9f00fb4bc3a..18c4bd9a5c65 100644
--- a/drivers/cpufreq/mt8173-cpufreq.c
+++ b/drivers/cpufreq/mediatek-cpufreq.c
@@ -507,7 +507,7 @@ static int mtk_cpufreq_exit(struct cpufreq_policy *policy)
         return 0;
 }
 
-static struct cpufreq_driver mt8173_cpufreq_driver = {
+static struct cpufreq_driver mtk_cpufreq_driver = {
         .flags = CPUFREQ_STICKY | CPUFREQ_NEED_INITIAL_FREQ_CHECK |
                  CPUFREQ_HAVE_GOVERNOR_PER_POLICY,
         .verify = cpufreq_generic_frequency_table_verify,
@@ -520,7 +520,7 @@ static struct cpufreq_driver mt8173_cpufreq_driver = {
         .attr = cpufreq_generic_attr,
 };
 
-static int mt8173_cpufreq_probe(struct platform_device *pdev)
+static int mtk_cpufreq_probe(struct platform_device *pdev)
 {
         struct mtk_cpu_dvfs_info *info, *tmp;
         int cpu, ret;
@@ -547,7 +547,7 @@ static int mt8173_cpufreq_probe(struct platform_device *pdev)
                 list_add(&info->list_head, &dvfs_info_list);
         }
 
-        ret = cpufreq_register_driver(&mt8173_cpufreq_driver);
+        ret = cpufreq_register_driver(&mtk_cpufreq_driver);
         if (ret) {
                 dev_err(&pdev->dev, "failed to register mtk cpufreq driver\n");
                 goto release_dvfs_info_list;
@@ -564,15 +564,18 @@ release_dvfs_info_list:
         return ret;
 }
 
-static struct platform_driver mt8173_cpufreq_platdrv = {
+static struct platform_driver mtk_cpufreq_platdrv = {
         .driver = {
-                .name   = "mt8173-cpufreq",
+                .name   = "mtk-cpufreq",
         },
-        .probe          = mt8173_cpufreq_probe,
+        .probe          = mtk_cpufreq_probe,
 };
 
 /* List of machines supported by this driver */
-static const struct of_device_id mt8173_cpufreq_machines[] __initconst = {
+static const struct of_device_id mtk_cpufreq_machines[] __initconst = {
+        { .compatible = "mediatek,mt2701", },
+        { .compatible = "mediatek,mt7622", },
+        { .compatible = "mediatek,mt7623", },
         { .compatible = "mediatek,mt817x", },
         { .compatible = "mediatek,mt8173", },
         { .compatible = "mediatek,mt8176", },
@@ -580,7 +583,7 @@ static const struct of_device_id mt8173_cpufreq_machines[] __initconst = {
         { }
 };
 
-static int __init mt8173_cpufreq_driver_init(void)
+static int __init mtk_cpufreq_driver_init(void)
 {
         struct device_node *np;
         const struct of_device_id *match;
@@ -591,14 +594,14 @@ static int __init mt8173_cpufreq_driver_init(void)
         if (!np)
                 return -ENODEV;
 
-        match = of_match_node(mt8173_cpufreq_machines, np);
+        match = of_match_node(mtk_cpufreq_machines, np);
         of_node_put(np);
         if (!match) {
-                pr_warn("Machine is not compatible with mt8173-cpufreq\n");
+                pr_warn("Machine is not compatible with mtk-cpufreq\n");
                 return -ENODEV;
         }
 
-        err = platform_driver_register(&mt8173_cpufreq_platdrv);
+        err = platform_driver_register(&mtk_cpufreq_platdrv);
         if (err)
                 return err;
 
@@ -608,7 +611,7 @@ static int __init mt8173_cpufreq_driver_init(void)
          * and the device registration codes are put here to handle defer
          * probing.
          */
-        pdev = platform_device_register_simple("mt8173-cpufreq", -1, NULL, 0);
+        pdev = platform_device_register_simple("mtk-cpufreq", -1, NULL, 0);
         if (IS_ERR(pdev)) {
                 pr_err("failed to register mtk-cpufreq platform device\n");
                 return PTR_ERR(pdev);
@@ -616,4 +619,4 @@ static int __init mt8173_cpufreq_driver_init(void)
 
         return 0;
 }
-device_initcall(mt8173_cpufreq_driver_init);
+device_initcall(mtk_cpufreq_driver_init);
diff --git a/drivers/cpufreq/pmac32-cpufreq.c b/drivers/cpufreq/pmac32-cpufreq.c
index ff44016ea031..61ae06ca008e 100644
--- a/drivers/cpufreq/pmac32-cpufreq.c
+++ b/drivers/cpufreq/pmac32-cpufreq.c
@@ -442,7 +442,8 @@ static struct cpufreq_driver pmac_cpufreq_driver = {
         .init           = pmac_cpufreq_cpu_init,
         .suspend        = pmac_cpufreq_suspend,
         .resume         = pmac_cpufreq_resume,
-        .flags          = CPUFREQ_PM_NO_WARN,
+        .flags          = CPUFREQ_PM_NO_WARN |
+                          CPUFREQ_NO_AUTO_DYNAMIC_SWITCHING,
         .attr           = cpufreq_generic_attr,
         .name           = "powermac",
 };
@@ -626,14 +627,16 @@ static int __init pmac_cpufreq_setup(void)
         if (!value)
                 goto out;
         cur_freq = (*value) / 1000;
-        transition_latency = CPUFREQ_ETERNAL;
 
         /*  Check for 7447A based MacRISC3 */
         if (of_machine_is_compatible("MacRISC3") &&
             of_get_property(cpunode, "dynamic-power-step", NULL) &&
             PVR_VER(mfspr(SPRN_PVR)) == 0x8003) {
                 pmac_cpufreq_init_7447A(cpunode);
+
+                /* Allow dynamic switching */
                 transition_latency = 8000000;
+                pmac_cpufreq_driver.flags &= ~CPUFREQ_NO_AUTO_DYNAMIC_SWITCHING;
         /* Check for other MacRISC3 machines */
         } else if (of_machine_is_compatible("PowerBook3,4") ||
                    of_machine_is_compatible("PowerBook3,5") ||
diff --git a/drivers/cpufreq/pmac64-cpufreq.c b/drivers/cpufreq/pmac64-cpufreq.c
index 267e0894c62d..be623dd7b9f2 100644
--- a/drivers/cpufreq/pmac64-cpufreq.c
+++ b/drivers/cpufreq/pmac64-cpufreq.c
@@ -516,7 +516,7 @@ static int __init g5_pm72_cpufreq_init(struct device_node *cpunode)
                 goto bail;
         }
 
-        DBG("cpufreq: i2c clock chip found: %s\n", hwclock->full_name);
+        DBG("cpufreq: i2c clock chip found: %pOF\n", hwclock);
 
         /* Now get all the platform functions */
         pfunc_cpu_getfreq =
diff --git a/drivers/cpufreq/s5pv210-cpufreq.c b/drivers/cpufreq/s5pv210-cpufreq.c
index f82074eea779..5d31c2db12a3 100644
--- a/drivers/cpufreq/s5pv210-cpufreq.c
+++ b/drivers/cpufreq/s5pv210-cpufreq.c
@@ -602,6 +602,7 @@ static int s5pv210_cpufreq_probe(struct platform_device *pdev)
         }
 
         clk_base = of_iomap(np, 0);
+        of_node_put(np);
         if (!clk_base) {
                 pr_err("%s: failed to map clock registers\n", __func__);
                 return -EFAULT;
@@ -612,6 +613,7 @@ static int s5pv210_cpufreq_probe(struct platform_device *pdev)
                 if (id < 0 || id >= ARRAY_SIZE(dmc_base)) {
                         pr_err("%s: failed to get alias of dmc node '%s'\n",
                                 __func__, np->name);
+                        of_node_put(np);
                         return id;
                 }
 
@@ -619,6 +621,7 @@ static int s5pv210_cpufreq_probe(struct platform_device *pdev)
                 if (!dmc_base[id]) {
                         pr_err("%s: failed to map dmc%d registers\n",
                                 __func__, id);
+                        of_node_put(np);
                         return -EFAULT;
                 }
         }
diff --git a/drivers/cpufreq/sa1100-cpufreq.c b/drivers/cpufreq/sa1100-cpufreq.c
index 728eab77e8e0..e2d8a77c36d5 100644
--- a/drivers/cpufreq/sa1100-cpufreq.c
+++ b/drivers/cpufreq/sa1100-cpufreq.c
@@ -197,11 +197,12 @@ static int sa1100_target(struct cpufreq_policy *policy, unsigned int ppcr)
 
 static int __init sa1100_cpu_init(struct cpufreq_policy *policy)
 {
-        return cpufreq_generic_init(policy, sa11x0_freq_table, CPUFREQ_ETERNAL);
+        return cpufreq_generic_init(policy, sa11x0_freq_table, 0);
 }
 
 static struct cpufreq_driver sa1100_driver __refdata = {
-        .flags          = CPUFREQ_STICKY | CPUFREQ_NEED_INITIAL_FREQ_CHECK,
+        .flags          = CPUFREQ_STICKY | CPUFREQ_NEED_INITIAL_FREQ_CHECK |
+                          CPUFREQ_NO_AUTO_DYNAMIC_SWITCHING,
         .verify         = cpufreq_generic_frequency_table_verify,
         .target_index   = sa1100_target,
         .get            = sa11x0_getspeed,
diff --git a/drivers/cpufreq/sa1110-cpufreq.c b/drivers/cpufreq/sa1110-cpufreq.c
index 2bac9b6cfeea..66e5fb088ecc 100644
--- a/drivers/cpufreq/sa1110-cpufreq.c
+++ b/drivers/cpufreq/sa1110-cpufreq.c
@@ -306,13 +306,14 @@ static int sa1110_target(struct cpufreq_policy *policy, unsigned int ppcr)
 
 static int __init sa1110_cpu_init(struct cpufreq_policy *policy)
 {
-        return cpufreq_generic_init(policy, sa11x0_freq_table, CPUFREQ_ETERNAL);
+        return cpufreq_generic_init(policy, sa11x0_freq_table, 0);
 }
 
 /* sa1110_driver needs __refdata because it must remain after init registers
  * it with cpufreq_register_driver() */
 static struct cpufreq_driver sa1110_driver __refdata = {
-        .flags          = CPUFREQ_STICKY | CPUFREQ_NEED_INITIAL_FREQ_CHECK,
+        .flags          = CPUFREQ_STICKY | CPUFREQ_NEED_INITIAL_FREQ_CHECK |
+                          CPUFREQ_NO_AUTO_DYNAMIC_SWITCHING,
         .verify         = cpufreq_generic_frequency_table_verify,
         .target_index   = sa1110_target,
         .get            = sa11x0_getspeed,
diff --git a/drivers/cpufreq/sh-cpufreq.c b/drivers/cpufreq/sh-cpufreq.c
index 719c3d9f07fb..28893d435cf5 100644
--- a/drivers/cpufreq/sh-cpufreq.c
+++ b/drivers/cpufreq/sh-cpufreq.c
@@ -137,8 +137,6 @@ static int sh_cpufreq_cpu_init(struct cpufreq_policy *policy)
                         (clk_round_rate(cpuclk, ~0UL) + 500) / 1000;
         }
 
-        policy->cpuinfo.transition_latency = CPUFREQ_ETERNAL;
-
         dev_info(dev, "CPU Frequencies - Minimum %u.%03u MHz, "
                "Maximum %u.%03u MHz.\n",
                policy->min / 1000, policy->min % 1000,
@@ -159,6 +157,7 @@ static int sh_cpufreq_cpu_exit(struct cpufreq_policy *policy)
 
 static struct cpufreq_driver sh_cpufreq_driver = {
         .name           = "sh",
+        .flags          = CPUFREQ_NO_AUTO_DYNAMIC_SWITCHING,
         .get            = sh_cpufreq_get,
         .target         = sh_cpufreq_target,
         .verify         = sh_cpufreq_verify,
diff --git a/drivers/cpufreq/speedstep-ich.c b/drivers/cpufreq/speedstep-ich.c
index b86953a3ddc4..0412a246a785 100644
--- a/drivers/cpufreq/speedstep-ich.c
+++ b/drivers/cpufreq/speedstep-ich.c
@@ -207,7 +207,7 @@ static unsigned int speedstep_detect_chipset(void)
                  * 8100 which use a pretty old revision of the 82815
                  * host bridge. Abort on these systems.
                  */
-                static struct pci_dev *hostbridge;
+                struct pci_dev *hostbridge;
 
                 hostbridge  = pci_get_subsys(PCI_VENDOR_ID_INTEL,
                               PCI_DEVICE_ID_INTEL_82815_MC,
diff --git a/drivers/cpufreq/speedstep-lib.c b/drivers/cpufreq/speedstep-lib.c
index 1b8062182c81..ccab452a4ef5 100644
--- a/drivers/cpufreq/speedstep-lib.c
+++ b/drivers/cpufreq/speedstep-lib.c
@@ -35,7 +35,7 @@ static int relaxed_check;
 static unsigned int pentium3_get_frequency(enum speedstep_processor processor)
 {
         /* See table 14 of p3_ds.pdf and table 22 of 29834003.pdf */
-        struct {
+        static const struct {
                 unsigned int ratio;     /* Frequency Multiplier (x10) */
                 u8 bitmap;              /* power on configuration bits
                                         [27, 25:22] (in MSR 0x2a) */
@@ -58,7 +58,7 @@ static unsigned int pentium3_get_frequency(enum speedstep_processor processor)
         };
 
         /* PIII(-M) FSB settings: see table b1-b of 24547206.pdf */
-        struct {
+        static const struct {
                 unsigned int value;     /* Front Side Bus speed in MHz */
                 u8 bitmap;              /* power on configuration bits [18: 19]
                                         (in MSR 0x2a) */
diff --git a/drivers/cpufreq/speedstep-smi.c b/drivers/cpufreq/speedstep-smi.c
index 37b30071c220..d23f24ccff38 100644
--- a/drivers/cpufreq/speedstep-smi.c
+++ b/drivers/cpufreq/speedstep-smi.c
@@ -266,7 +266,6 @@ static int speedstep_cpu_init(struct cpufreq_policy *policy)
                         pr_debug("workaround worked.\n");
         }
 
-        policy->cpuinfo.transition_latency = CPUFREQ_ETERNAL;
         return cpufreq_table_validate_and_show(policy, speedstep_freqs);
 }
 
@@ -290,6 +289,7 @@ static int speedstep_resume(struct cpufreq_policy *policy)
 
 static struct cpufreq_driver speedstep_driver = {
         .name           = "speedstep-smi",
+        .flags          = CPUFREQ_NO_AUTO_DYNAMIC_SWITCHING,
         .verify         = cpufreq_generic_frequency_table_verify,
         .target_index   = speedstep_target,
         .init           = speedstep_cpu_init,
diff --git a/drivers/cpufreq/sti-cpufreq.c b/drivers/cpufreq/sti-cpufreq.c
index d2d0430d09d4..47105735df12 100644
--- a/drivers/cpufreq/sti-cpufreq.c
+++ b/drivers/cpufreq/sti-cpufreq.c
@@ -65,8 +65,8 @@ static int sti_cpufreq_fetch_major(void) {
         ret = of_property_read_u32_index(np, "st,syscfg",
                                          MAJOR_ID_INDEX, &major_offset);
         if (ret) {
-                dev_err(dev, "No major number offset provided in %s [%d]\n",
-                        np->full_name, ret);
+                dev_err(dev, "No major number offset provided in %pOF [%d]\n",
+                        np, ret);
                 return ret;
         }
 
@@ -92,8 +92,8 @@ static int sti_cpufreq_fetch_minor(void)
                                          MINOR_ID_INDEX, &minor_offset);
         if (ret) {
                 dev_err(dev,
-                        "No minor number offset provided %s [%d]\n",
-                        np->full_name, ret);
+                        "No minor number offset provided %pOF [%d]\n",
+                        np, ret);
                 return ret;
         }
 
diff --git a/drivers/cpufreq/tango-cpufreq.c b/drivers/cpufreq/tango-cpufreq.c
new file mode 100644
index 000000000000..89a7f860bfe8
--- /dev/null
+++ b/drivers/cpufreq/tango-cpufreq.c
@@ -0,0 +1,38 @@
+#include <linux/of.h>
+#include <linux/cpu.h>
+#include <linux/clk.h>
+#include <linux/pm_opp.h>
+#include <linux/platform_device.h>
+
+static const struct of_device_id machines[] __initconst = {
+        { .compatible = "sigma,tango4" },
+        { /* sentinel */ }
+};
+
+static int __init tango_cpufreq_init(void)
+{
+        struct device *cpu_dev = get_cpu_device(0);
+        unsigned long max_freq;
+        struct clk *cpu_clk;
+        void *res;
+
+        if (!of_match_node(machines, of_root))
+                return -ENODEV;
+
+        cpu_clk = clk_get(cpu_dev, NULL);
+        if (IS_ERR(cpu_clk))
+                return -ENODEV;
+
+        max_freq = clk_get_rate(cpu_clk);
+
+        dev_pm_opp_add(cpu_dev, max_freq / 1, 0);
+        dev_pm_opp_add(cpu_dev, max_freq / 2, 0);
+        dev_pm_opp_add(cpu_dev, max_freq / 3, 0);
+        dev_pm_opp_add(cpu_dev, max_freq / 5, 0);
+        dev_pm_opp_add(cpu_dev, max_freq / 9, 0);
+
+        res = platform_device_register_data(NULL, "cpufreq-dt", -1, NULL, 0);
+
+        return PTR_ERR_OR_ZERO(res);
+}
+device_initcall(tango_cpufreq_init);
diff --git a/drivers/cpufreq/ti-cpufreq.c b/drivers/cpufreq/ti-cpufreq.c
index a7b5658c0460..b29cd3398463 100644
--- a/drivers/cpufreq/ti-cpufreq.c
+++ b/drivers/cpufreq/ti-cpufreq.c
@@ -245,8 +245,6 @@ static int ti_cpufreq_init(void)
         if (ret)
                 goto fail_put_node;
 
-        of_node_put(opp_data->opp_node);
-
         ret = PTR_ERR_OR_ZERO(dev_pm_opp_set_supported_hw(opp_data->cpu_dev,
                                                           version, VERSION_COUNT));
         if (ret) {
@@ -255,6 +253,8 @@ static int ti_cpufreq_init(void)
                 goto fail_put_node;
         }
 
+        of_node_put(opp_data->opp_node);
+
 register_cpufreq_dt:
         platform_device_register_simple("cpufreq-dt", -1, NULL, 0);
 
diff --git a/drivers/cpufreq/unicore2-cpufreq.c b/drivers/cpufreq/unicore2-cpufreq.c
index 6f9dfa80563a..db62d9844751 100644
--- a/drivers/cpufreq/unicore2-cpufreq.c
+++ b/drivers/cpufreq/unicore2-cpufreq.c
@@ -58,13 +58,12 @@ static int __init ucv2_cpu_init(struct cpufreq_policy *policy)
 
         policy->min = policy->cpuinfo.min_freq = 250000;
         policy->max = policy->cpuinfo.max_freq = 1000000;
-        policy->cpuinfo.transition_latency = CPUFREQ_ETERNAL;
         policy->clk = clk_get(NULL, "MAIN_CLK");
         return PTR_ERR_OR_ZERO(policy->clk);
 }
 
 static struct cpufreq_driver ucv2_driver = {
-        .flags          = CPUFREQ_STICKY,
+        .flags          = CPUFREQ_STICKY | CPUFREQ_NO_AUTO_DYNAMIC_SWITCHING,
         .verify         = ucv2_verify_speed,
         .target         = ucv2_target,
         .get            = cpufreq_generic_get,
diff --git a/drivers/cpuidle/cpuidle-powernv.c b/drivers/cpuidle/cpuidle-powernv.c
index 37b0698b7193..42896a67aeae 100644
--- a/drivers/cpuidle/cpuidle-powernv.c
+++ b/drivers/cpuidle/cpuidle-powernv.c
@@ -235,6 +235,7 @@ static inline int validate_dt_prop_sizes(const char *prop1, int prop1_len,
         return -1;
 }
 
+extern u32 pnv_get_supported_cpuidle_states(void);
 static int powernv_add_idle_states(void)
 {
         struct device_node *power_mgt;
@@ -248,6 +249,8 @@ static int powernv_add_idle_states(void)
         const char *names[CPUIDLE_STATE_MAX];
         u32 has_stop_states = 0;
         int i, rc;
+        u32 supported_flags = pnv_get_supported_cpuidle_states();
+
 
         /* Currently we have snooze statically defined */
 
@@ -362,6 +365,13 @@ static int powernv_add_idle_states(void)
         for (i = 0; i < dt_idle_states; i++) {
                 unsigned int exit_latency, target_residency;
                 bool stops_timebase = false;
+
+                /*
+                 * Skip the platform idle state whose flag isn't in
+                 * the supported_cpuidle_states flag mask.
+                 */
+                if ((flags[i] & supported_flags) != flags[i])
+                        continue;
                 /*
                  * If an idle state has exit latency beyond
                  * POWERNV_THRESHOLD_LATENCY_NS then don't use it
diff --git a/drivers/crypto/Kconfig b/drivers/crypto/Kconfig
index 193204dfbf3a..4b75084fabad 100644
--- a/drivers/crypto/Kconfig
+++ b/drivers/crypto/Kconfig
@@ -655,7 +655,7 @@ source "drivers/crypto/virtio/Kconfig"
 config CRYPTO_DEV_BCM_SPU
         tristate "Broadcom symmetric crypto/hash acceleration support"
         depends on ARCH_BCM_IPROC
-        depends on BCM_PDC_MBOX
+        depends on MAILBOX
         default m
         select CRYPTO_DES
         select CRYPTO_MD5
diff --git a/drivers/crypto/bcm/spu2.c b/drivers/crypto/bcm/spu2.c
index ef04c9748317..bf7ac621c591 100644
--- a/drivers/crypto/bcm/spu2.c
+++ b/drivers/crypto/bcm/spu2.c
@@ -302,6 +302,7 @@ spu2_hash_xlate(enum hash_alg hash_alg, enum hash_mode hash_mode,
                 break;
         case HASH_ALG_SHA3_512:
                 *spu2_type = SPU2_HASH_TYPE_SHA3_512;
+                break;
         case HASH_ALG_LAST:
         default:
                 err = -EINVAL;
diff --git a/drivers/crypto/cavium/nitrox/nitrox_main.c b/drivers/crypto/cavium/nitrox/nitrox_main.c
index ae44a464cd2d..9ccefb9b7232 100644
--- a/drivers/crypto/cavium/nitrox/nitrox_main.c
+++ b/drivers/crypto/cavium/nitrox/nitrox_main.c
@@ -18,8 +18,9 @@
 #define SE_GROUP 0
 
 #define DRIVER_VERSION "1.0"
+#define FW_DIR "cavium/"
 /* SE microcode */
-#define SE_FW   "cnn55xx_se.fw"
+#define SE_FW   FW_DIR "cnn55xx_se.fw"
 
 static const char nitrox_driver_name[] = "CNN55XX";
 
diff --git a/drivers/crypto/inside-secure/safexcel.c b/drivers/crypto/inside-secure/safexcel.c
index e7f87ac12685..1fabd4aee81b 100644
--- a/drivers/crypto/inside-secure/safexcel.c
+++ b/drivers/crypto/inside-secure/safexcel.c
@@ -773,7 +773,6 @@ static int safexcel_probe(struct platform_device *pdev)
         struct device *dev = &pdev->dev;
         struct resource *res;
         struct safexcel_crypto_priv *priv;
-        u64 dma_mask;
         int i, ret;
 
         priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
@@ -802,9 +801,7 @@ static int safexcel_probe(struct platform_device *pdev)
                         return -EPROBE_DEFER;
         }
 
-        if (of_property_read_u64(dev->of_node, "dma-mask", &dma_mask))
-                dma_mask = DMA_BIT_MASK(64);
-        ret = dma_set_mask_and_coherent(dev, dma_mask);
+        ret = dma_set_mask_and_coherent(dev, DMA_BIT_MASK(64));
         if (ret)
                 goto err_clk;
 
diff --git a/drivers/crypto/inside-secure/safexcel_hash.c b/drivers/crypto/inside-secure/safexcel_hash.c
index 8527a5899a2f..3f819399cd95 100644
--- a/drivers/crypto/inside-secure/safexcel_hash.c
+++ b/drivers/crypto/inside-secure/safexcel_hash.c
@@ -883,10 +883,7 @@ static int safexcel_hmac_sha1_setkey(struct crypto_ahash *tfm, const u8 *key,
         if (ret)
                 return ret;
 
-        memcpy(ctx->ipad, &istate.state, SHA1_DIGEST_SIZE);
-        memcpy(ctx->opad, &ostate.state, SHA1_DIGEST_SIZE);
-
-        for (i = 0; i < ARRAY_SIZE(istate.state); i++) {
+        for (i = 0; i < SHA1_DIGEST_SIZE / sizeof(u32); i++) {
                 if (ctx->ipad[i] != le32_to_cpu(istate.state[i]) ||
                     ctx->opad[i] != le32_to_cpu(ostate.state[i])) {
                         ctx->base.needs_inv = true;
@@ -894,6 +891,9 @@ static int safexcel_hmac_sha1_setkey(struct crypto_ahash *tfm, const u8 *key,
                 }
         }
 
+        memcpy(ctx->ipad, &istate.state, SHA1_DIGEST_SIZE);
+        memcpy(ctx->opad, &ostate.state, SHA1_DIGEST_SIZE);
+
         return 0;
 }
 
diff --git a/drivers/crypto/ixp4xx_crypto.c b/drivers/crypto/ixp4xx_crypto.c
index 427cbe012729..dadc4a808df5 100644
--- a/drivers/crypto/ixp4xx_crypto.c
+++ b/drivers/crypto/ixp4xx_crypto.c
@@ -1073,7 +1073,7 @@ static int aead_perform(struct aead_request *req, int encrypt,
                 req_ctx->hmac_virt = dma_pool_alloc(buffer_pool, flags,
                                 &crypt->icv_rev_aes);
                 if (unlikely(!req_ctx->hmac_virt))
-                        goto free_buf_src;
+                        goto free_buf_dst;
                 if (!encrypt) {
                         scatterwalk_map_and_copy(req_ctx->hmac_virt,
                                 req->src, cryptlen, authsize, 0);
@@ -1088,10 +1088,10 @@ static int aead_perform(struct aead_request *req, int encrypt,
         BUG_ON(qmgr_stat_overflow(SEND_QID));
         return -EINPROGRESS;
 
-free_buf_src:
-        free_buf_chain(dev, req_ctx->src, crypt->src_buf);
 free_buf_dst:
         free_buf_chain(dev, req_ctx->dst, crypt->dst_buf);
+free_buf_src:
+        free_buf_chain(dev, req_ctx->src, crypt->src_buf);
         crypt->ctl_flags = CTL_FLAG_UNUSED;
         return -ENOMEM;
 }
diff --git a/drivers/dax/super.c b/drivers/dax/super.c
index ce9e563e6e1d..938eb4868f7f 100644
--- a/drivers/dax/super.c
+++ b/drivers/dax/super.c
@@ -278,6 +278,12 @@ void dax_write_cache(struct dax_device *dax_dev, bool wc)
 }
 EXPORT_SYMBOL_GPL(dax_write_cache);
 
+bool dax_write_cache_enabled(struct dax_device *dax_dev)
+{
+        return test_bit(DAXDEV_WRITE_CACHE, &dax_dev->flags);
+}
+EXPORT_SYMBOL_GPL(dax_write_cache_enabled);
+
 bool dax_alive(struct dax_device *dax_dev)
 {
         lockdep_assert_held(&dax_srcu);
diff --git a/drivers/dma-buf/sync_file.c b/drivers/dma-buf/sync_file.c
index d7e219d2669d..66fb40d0ebdb 100644
--- a/drivers/dma-buf/sync_file.c
+++ b/drivers/dma-buf/sync_file.c
@@ -304,7 +304,7 @@ static int sync_file_release(struct inode *inode, struct file *file)
 {
         struct sync_file *sync_file = file->private_data;
 
-        if (test_bit(POLL_ENABLED, &sync_file->fence->flags))
+        if (test_bit(POLL_ENABLED, &sync_file->flags))
                 dma_fence_remove_callback(sync_file->fence, &sync_file->cb);
         dma_fence_put(sync_file->fence);
         kfree(sync_file);
@@ -318,7 +318,8 @@ static unsigned int sync_file_poll(struct file *file, poll_table *wait)
 
         poll_wait(file, &sync_file->wq, wait);
 
-        if (!test_and_set_bit(POLL_ENABLED, &sync_file->fence->flags)) {
+        if (list_empty(&sync_file->cb.node) &&
+            !test_and_set_bit(POLL_ENABLED, &sync_file->flags)) {
                 if (dma_fence_add_callback(sync_file->fence, &sync_file->cb,
                                            fence_check_cb_func) < 0)
                         wake_up_all(&sync_file->wq);
diff --git a/drivers/dma/tegra210-adma.c b/drivers/dma/tegra210-adma.c
index b10cbaa82ff5..b26256f23d67 100644
--- a/drivers/dma/tegra210-adma.c
+++ b/drivers/dma/tegra210-adma.c
@@ -717,8 +717,8 @@ static int tegra_adma_probe(struct platform_device *pdev)
                 tdc->chan_addr = tdma->base_addr + ADMA_CH_REG_OFFSET(i);
 
                 tdc->irq = of_irq_get(pdev->dev.of_node, i);
-                if (tdc->irq < 0) {
-                        ret = tdc->irq;
+                if (tdc->irq <= 0) {
+                        ret = tdc->irq ?: -ENXIO;
                         goto irq_dispose;
                 }
 
diff --git a/drivers/gpio/Kconfig b/drivers/gpio/Kconfig
index f235eae04c16..461d6fc3688b 100644
--- a/drivers/gpio/Kconfig
+++ b/drivers/gpio/Kconfig
@@ -504,6 +504,7 @@ config GPIO_XGENE_SB
         depends on ARCH_XGENE && OF_GPIO
         select GPIO_GENERIC
         select GPIOLIB_IRQCHIP
+        select IRQ_DOMAIN_HIERARCHY
         help
           This driver supports the GPIO block within the APM X-Gene
           Standby Domain. Say yes here to enable the GPIO functionality.
diff --git a/drivers/gpio/gpio-exar.c b/drivers/gpio/gpio-exar.c
index fb8d304cfa17..0ecd2369c2ca 100644
--- a/drivers/gpio/gpio-exar.c
+++ b/drivers/gpio/gpio-exar.c
@@ -132,7 +132,7 @@ static int gpio_exar_probe(struct platform_device *pdev)
         if (!p)
                 return -ENOMEM;
 
-        ret = device_property_read_u32(&pdev->dev, "linux,first-pin",
+        ret = device_property_read_u32(&pdev->dev, "exar,first-pin",
                                        &first_pin);
         if (ret)
                 return ret;
diff --git a/drivers/gpio/gpio-lp87565.c b/drivers/gpio/gpio-lp87565.c
index 6313c50bb91b..a121c8f10610 100644
--- a/drivers/gpio/gpio-lp87565.c
+++ b/drivers/gpio/gpio-lp87565.c
@@ -26,6 +26,27 @@ struct lp87565_gpio {
         struct regmap *map;
 };
 
+static int lp87565_gpio_get(struct gpio_chip *chip, unsigned int offset)
+{
+        struct lp87565_gpio *gpio = gpiochip_get_data(chip);
+        int ret, val;
+
+        ret = regmap_read(gpio->map, LP87565_REG_GPIO_IN, &val);
+        if (ret < 0)
+                return ret;
+
+        return !!(val & BIT(offset));
+}
+
+static void lp87565_gpio_set(struct gpio_chip *chip, unsigned int offset,
+                             int value)
+{
+        struct lp87565_gpio *gpio = gpiochip_get_data(chip);
+
+        regmap_update_bits(gpio->map, LP87565_REG_GPIO_OUT,
+                           BIT(offset), value ? BIT(offset) : 0);
+}
+
 static int lp87565_gpio_get_direction(struct gpio_chip *chip,
                                       unsigned int offset)
 {
@@ -54,30 +75,11 @@ static int lp87565_gpio_direction_output(struct gpio_chip *chip,
 {
         struct lp87565_gpio *gpio = gpiochip_get_data(chip);
 
+        lp87565_gpio_set(chip, offset, value);
+
         return regmap_update_bits(gpio->map,
                                   LP87565_REG_GPIO_CONFIG,
-                                  BIT(offset), !value ? BIT(offset) : 0);
-}
-
-static int lp87565_gpio_get(struct gpio_chip *chip, unsigned int offset)
-{
-        struct lp87565_gpio *gpio = gpiochip_get_data(chip);
-        int ret, val;
-
-        ret = regmap_read(gpio->map, LP87565_REG_GPIO_IN, &val);
-        if (ret < 0)
-                return ret;
-
-        return !!(val & BIT(offset));
-}
-
-static void lp87565_gpio_set(struct gpio_chip *chip, unsigned int offset,
-                             int value)
-{
-        struct lp87565_gpio *gpio = gpiochip_get_data(chip);
-
-        regmap_update_bits(gpio->map, LP87565_REG_GPIO_OUT,
-                           BIT(offset), value ? BIT(offset) : 0);
+                                  BIT(offset), BIT(offset));
 }
 
 static int lp87565_gpio_request(struct gpio_chip *gc, unsigned int offset)
diff --git a/drivers/gpio/gpio-mvebu.c b/drivers/gpio/gpio-mvebu.c
index e338c3743562..45c65f805fd6 100644
--- a/drivers/gpio/gpio-mvebu.c
+++ b/drivers/gpio/gpio-mvebu.c
@@ -557,7 +557,7 @@ static void mvebu_gpio_irq_handler(struct irq_desc *desc)
         edge_cause = mvebu_gpio_read_edge_cause(mvchip);
         edge_mask  = mvebu_gpio_read_edge_mask(mvchip);
 
-        cause = (data_in ^ level_mask) | (edge_cause & edge_mask);
+        cause = (data_in & level_mask) | (edge_cause & edge_mask);
 
         for (i = 0; i < mvchip->chip.ngpio; i++) {
                 int irq;
diff --git a/drivers/gpio/gpio-mxc.c b/drivers/gpio/gpio-mxc.c
index 3abea3f0b307..92692251ade1 100644
--- a/drivers/gpio/gpio-mxc.c
+++ b/drivers/gpio/gpio-mxc.c
@@ -424,6 +424,9 @@ static int mxc_gpio_probe(struct platform_device *pdev)
                 return PTR_ERR(port->base);
 
         port->irq_high = platform_get_irq(pdev, 1);
+        if (port->irq_high < 0)
+                port->irq_high = 0;
+
         port->irq = platform_get_irq(pdev, 0);
         if (port->irq < 0)
                 return port->irq;
diff --git a/drivers/gpio/gpio-tegra.c b/drivers/gpio/gpio-tegra.c
index 88529d3c06c9..506c6a67c5fc 100644
--- a/drivers/gpio/gpio-tegra.c
+++ b/drivers/gpio/gpio-tegra.c
@@ -360,7 +360,7 @@ static void tegra_gpio_irq_handler(struct irq_desc *desc)
 {
         int port;
         int pin;
-        int unmasked = 0;
+        bool unmasked = false;
         int gpio;
         u32 lvl;
         unsigned long sta;
@@ -384,8 +384,8 @@ static void tegra_gpio_irq_handler(struct irq_desc *desc)
                          * before executing the handler so that we don't
                          * miss edges
                          */
-                        if (lvl & (0x100 << pin)) {
-                                unmasked = 1;
+                        if (!unmasked && lvl & (0x100 << pin)) {
+                                unmasked = true;
                                 chained_irq_exit(chip, desc);
                         }
 
diff --git a/drivers/gpio/gpiolib-sysfs.c b/drivers/gpio/gpiolib-sysfs.c
index 16fe9742597b..fc80add5fedb 100644
--- a/drivers/gpio/gpiolib-sysfs.c
+++ b/drivers/gpio/gpiolib-sysfs.c
@@ -2,6 +2,7 @@
 #include <linux/mutex.h>
 #include <linux/device.h>
 #include <linux/sysfs.h>
+#include <linux/gpio.h>
 #include <linux/gpio/consumer.h>
 #include <linux/gpio/driver.h>
 #include <linux/interrupt.h>
@@ -432,6 +433,11 @@ static struct attribute *gpiochip_attrs[] = {
 };
 ATTRIBUTE_GROUPS(gpiochip);
 
+static struct gpio_desc *gpio_to_valid_desc(int gpio)
+{
+        return gpio_is_valid(gpio) ? gpio_to_desc(gpio) : NULL;
+}
+
 /*
  * /sys/class/gpio/export ... write-only
  *      integer N ... number of GPIO to export (full access)
@@ -450,7 +456,7 @@ static ssize_t export_store(struct class *class,
         if (status < 0)
                 goto done;
 
-        desc = gpio_to_desc(gpio);
+        desc = gpio_to_valid_desc(gpio);
         /* reject invalid GPIOs */
         if (!desc) {
                 pr_warn("%s: invalid GPIO %ld\n", __func__, gpio);
@@ -493,7 +499,7 @@ static ssize_t unexport_store(struct class *class,
         if (status < 0)
                 goto done;
 
-        desc = gpio_to_desc(gpio);
+        desc = gpio_to_valid_desc(gpio);
         /* reject bogus commands (gpio_unexport ignores them) */
         if (!desc) {
                 pr_warn("%s: invalid GPIO %ld\n", __func__, gpio);
diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index 9568708a550b..cd003b74512f 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -704,24 +704,23 @@ static irqreturn_t lineevent_irq_thread(int irq, void *p)
 {
         struct lineevent_state *le = p;
         struct gpioevent_data ge;
-        int ret;
+        int ret, level;
 
         ge.timestamp = ktime_get_real_ns();
+        level = gpiod_get_value_cansleep(le->desc);
 
         if (le->eflags & GPIOEVENT_REQUEST_RISING_EDGE
             && le->eflags & GPIOEVENT_REQUEST_FALLING_EDGE) {
-                int level = gpiod_get_value_cansleep(le->desc);
-
                 if (level)
                         /* Emit low-to-high event */
                         ge.id = GPIOEVENT_EVENT_RISING_EDGE;
                 else
                         /* Emit high-to-low event */
                         ge.id = GPIOEVENT_EVENT_FALLING_EDGE;
-        } else if (le->eflags & GPIOEVENT_REQUEST_RISING_EDGE) {
+        } else if (le->eflags & GPIOEVENT_REQUEST_RISING_EDGE && level) {
                 /* Emit low-to-high event */
                 ge.id = GPIOEVENT_EVENT_RISING_EDGE;
-        } else if (le->eflags & GPIOEVENT_REQUEST_FALLING_EDGE) {
+        } else if (le->eflags & GPIOEVENT_REQUEST_FALLING_EDGE && !level) {
                 /* Emit high-to-low event */
                 ge.id = GPIOEVENT_EVENT_FALLING_EDGE;
         } else {
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c
index f621ee115c98..5e771bc11b00 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c
@@ -198,12 +198,16 @@ amdgpu_bo_list_get(struct amdgpu_fpriv *fpriv, int id)
         result = idr_find(&fpriv->bo_list_handles, id);
 
         if (result) {
-                if (kref_get_unless_zero(&result->refcount))
+                if (kref_get_unless_zero(&result->refcount)) {
+                        rcu_read_unlock();
                         mutex_lock(&result->lock);
-                else
+                } else {
+                        rcu_read_unlock();
                         result = NULL;
+                }
+        } else {
+                rcu_read_unlock();
         }
-        rcu_read_unlock();
 
         return result;
 }
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_mn.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_mn.c
index 38f739fb727b..e1cde6b80027 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_mn.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_mn.c
@@ -147,36 +147,6 @@ static void amdgpu_mn_invalidate_node(struct amdgpu_mn_node *node,
 }
 
 /**
- * amdgpu_mn_invalidate_page - callback to notify about mm change
- *
- * @mn: our notifier
- * @mn: the mm this callback is about
- * @address: address of invalidate page
- *
- * Invalidation of a single page. Blocks for all BOs mapping it
- * and unmap them by move them into system domain again.
- */
-static void amdgpu_mn_invalidate_page(struct mmu_notifier *mn,
-                                      struct mm_struct *mm,
-                                      unsigned long address)
-{
-        struct amdgpu_mn *rmn = container_of(mn, struct amdgpu_mn, mn);
-        struct interval_tree_node *it;
-
-        mutex_lock(&rmn->lock);
-
-        it = interval_tree_iter_first(&rmn->objects, address, address);
-        if (it) {
-                struct amdgpu_mn_node *node;
-
-                node = container_of(it, struct amdgpu_mn_node, it);
-                amdgpu_mn_invalidate_node(node, address, address);
-        }
-
-        mutex_unlock(&rmn->lock);
-}
-
-/**
  * amdgpu_mn_invalidate_range_start - callback to notify about mm change
  *
  * @mn: our notifier
@@ -215,7 +185,6 @@ static void amdgpu_mn_invalidate_range_start(struct mmu_notifier *mn,
 
 static const struct mmu_notifier_ops amdgpu_mn_ops = {
         .release = amdgpu_mn_release,
-        .invalidate_page = amdgpu_mn_invalidate_page,
         .invalidate_range_start = amdgpu_mn_invalidate_range_start,
 };
 
@@ -359,7 +328,7 @@ void amdgpu_mn_unregister(struct amdgpu_bo *bo)
         head = bo->mn_list.next;
 
         bo->mn = NULL;
-        list_del(&bo->mn_list);
+        list_del_init(&bo->mn_list);
 
         if (list_empty(head)) {
                 struct amdgpu_mn_node *node;
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_sync.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_sync.c
index a6899180b265..c586f44312f9 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_sync.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_sync.c
@@ -244,6 +244,12 @@ struct dma_fence *amdgpu_sync_peek_fence(struct amdgpu_sync *sync,
                 struct dma_fence *f = e->fence;
                 struct amd_sched_fence *s_fence = to_amd_sched_fence(f);
 
+                if (dma_fence_is_signaled(f)) {
+                        hash_del(&e->node);
+                        dma_fence_put(f);
+                        kmem_cache_free(amdgpu_sync_slab, e);
+                        continue;
+                }
                 if (ring && s_fence) {
                         /* For fences from the same ring it is sufficient
                          * when they are scheduled.
@@ -256,13 +262,6 @@ struct dma_fence *amdgpu_sync_peek_fence(struct amdgpu_sync *sync,
                         }
                 }
 
-                if (dma_fence_is_signaled(f)) {
-                        hash_del(&e->node);
-                        dma_fence_put(f);
-                        kmem_cache_free(amdgpu_sync_slab, e);
-                        continue;
-                }
-
                 return f;
         }
 
diff --git a/drivers/gpu/drm/amd/amdgpu/clearstate_gfx9.h b/drivers/gpu/drm/amd/amdgpu/clearstate_gfx9.h
index 18fd01f3e4b2..003a131bad47 100644
--- a/drivers/gpu/drm/amd/amdgpu/clearstate_gfx9.h
+++ b/drivers/gpu/drm/amd/amdgpu/clearstate_gfx9.h
@@ -1,24 +1,25 @@
-
 /*
-***************************************************************************************************
-*
-*  Trade secret of Advanced Micro Devices, Inc.
-*  Copyright (c) 2010 Advanced Micro Devices, Inc. (unpublished)
-*
-*  All rights reserved.  This notice is intended as a precaution against inadvertent publication and
-*  does not imply publication or any waiver of confidentiality.  The year included in the foregoing
-*  notice is the year of creation of the work.
-*
-***************************************************************************************************
-*/
-/**
-***************************************************************************************************
-* @brief gfx9 Clearstate Definitions
-***************************************************************************************************
-*
-*   Do not edit! This is a machine-generated file!
-*
-*/
+ * Copyright 2017 Advanced Micro Devices, Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ *
+ */
 
 static const unsigned int gfx9_SECT_CONTEXT_def_1[] =
 {
diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
index 3a0b69b09ed6..c9b9c88231aa 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
@@ -1475,21 +1475,23 @@ static void gfx_v9_0_tiling_mode_table_init(struct amdgpu_device *adev)
 
 static void gfx_v9_0_select_se_sh(struct amdgpu_device *adev, u32 se_num, u32 sh_num, u32 instance)
 {
-        u32 data = REG_SET_FIELD(0, GRBM_GFX_INDEX, INSTANCE_BROADCAST_WRITES, 1);
+        u32 data;
 
-        if ((se_num == 0xffffffff) && (sh_num == 0xffffffff)) {
-                data = REG_SET_FIELD(data, GRBM_GFX_INDEX, SH_BROADCAST_WRITES, 1);
-                data = REG_SET_FIELD(data, GRBM_GFX_INDEX, SE_BROADCAST_WRITES, 1);
-        } else if (se_num == 0xffffffff) {
-                data = REG_SET_FIELD(data, GRBM_GFX_INDEX, SH_INDEX, sh_num);
+        if (instance == 0xffffffff)
+                data = REG_SET_FIELD(0, GRBM_GFX_INDEX, INSTANCE_BROADCAST_WRITES, 1);
+        else
+                data = REG_SET_FIELD(0, GRBM_GFX_INDEX, INSTANCE_INDEX, instance);
+
+        if (se_num == 0xffffffff)
                 data = REG_SET_FIELD(data, GRBM_GFX_INDEX, SE_BROADCAST_WRITES, 1);
-        } else if (sh_num == 0xffffffff) {
-                data = REG_SET_FIELD(data, GRBM_GFX_INDEX, SH_BROADCAST_WRITES, 1);
+        else
                 data = REG_SET_FIELD(data, GRBM_GFX_INDEX, SE_INDEX, se_num);
-        } else {
+
+        if (sh_num == 0xffffffff)
+                data = REG_SET_FIELD(data, GRBM_GFX_INDEX, SH_BROADCAST_WRITES, 1);
+        else
                 data = REG_SET_FIELD(data, GRBM_GFX_INDEX, SH_INDEX, sh_num);
-                data = REG_SET_FIELD(data, GRBM_GFX_INDEX, SE_INDEX, se_num);
-        }
+
         WREG32_SOC15(GC, 0, mmGRBM_GFX_INDEX, data);
 }
 
diff --git a/drivers/gpu/drm/amd/amdgpu/si.c b/drivers/gpu/drm/amd/amdgpu/si.c
index f45fb0f022b3..4267fa417997 100644
--- a/drivers/gpu/drm/amd/amdgpu/si.c
+++ b/drivers/gpu/drm/amd/amdgpu/si.c
@@ -1385,6 +1385,7 @@ static void si_init_golden_registers(struct amdgpu_device *adev)
                 amdgpu_program_register_sequence(adev,
                                                  pitcairn_mgcg_cgcg_init,
                                                  (const u32)ARRAY_SIZE(pitcairn_mgcg_cgcg_init));
+                break;
         case CHIP_VERDE:
                 amdgpu_program_register_sequence(adev,
                                                  verde_golden_registers,
@@ -1409,6 +1410,7 @@ static void si_init_golden_registers(struct amdgpu_device *adev)
                 amdgpu_program_register_sequence(adev,
                                                  oland_mgcg_cgcg_init,
                                                  (const u32)ARRAY_SIZE(oland_mgcg_cgcg_init));
+                break;
         case CHIP_HAINAN:
                 amdgpu_program_register_sequence(adev,
                                                  hainan_golden_registers,
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c
index d6f097f44b6c..197174e562d2 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c
@@ -2128,15 +2128,9 @@ static int vega10_populate_avfs_parameters(struct pp_hwmgr *hwmgr)
                         pp_table->AvfsGbCksOff.m2_shift = 12;
                         pp_table->AvfsGbCksOff.b_shift = 0;
 
-                        for (i = 0; i < dep_table->count; i++) {
-                                if (dep_table->entries[i].sclk_offset == 0)
-                                        pp_table->StaticVoltageOffsetVid[i] = 248;
-                                else
-                                        pp_table->StaticVoltageOffsetVid[i] =
-                                                (uint8_t)(dep_table->entries[i].sclk_offset *
-                                                                VOLTAGE_VID_OFFSET_SCALE2 /
-                                                                VOLTAGE_VID_OFFSET_SCALE1);
-                        }
+                        for (i = 0; i < dep_table->count; i++)
+                                pp_table->StaticVoltageOffsetVid[i] =
+                                                convert_to_vid((uint8_t)(dep_table->entries[i].sclk_offset));
 
                         if ((PPREGKEY_VEGA10QUADRATICEQUATION_DFLT !=
                                         data->disp_clk_quad_eqn_a) &&
diff --git a/drivers/gpu/drm/bridge/sil-sii8620.c b/drivers/gpu/drm/bridge/sil-sii8620.c
index 2d51a2269fc6..5131bfb94f06 100644
--- a/drivers/gpu/drm/bridge/sil-sii8620.c
+++ b/drivers/gpu/drm/bridge/sil-sii8620.c
@@ -597,9 +597,9 @@ static void sii8620_mt_read_devcap(struct sii8620 *ctx, bool xdevcap)
 static void sii8620_mt_read_devcap_reg_recv(struct sii8620 *ctx,
                 struct sii8620_mt_msg *msg)
 {
-        u8 reg = msg->reg[0] & 0x7f;
+        u8 reg = msg->reg[1] & 0x7f;
 
-        if (msg->reg[0] & 0x80)
+        if (msg->reg[1] & 0x80)
                 ctx->xdevcap[reg] = msg->ret;
         else
                 ctx->devcap[reg] = msg->ret;
diff --git a/drivers/gpu/drm/bridge/tc358767.c b/drivers/gpu/drm/bridge/tc358767.c
index 5c26488e7a2d..0529e500c534 100644
--- a/drivers/gpu/drm/bridge/tc358767.c
+++ b/drivers/gpu/drm/bridge/tc358767.c
@@ -1255,7 +1255,7 @@ static int tc_probe(struct i2c_client *client, const struct i2c_device_id *id)
 
         /* port@2 is the output port */
         ret = drm_of_find_panel_or_bridge(dev->of_node, 2, 0, &tc->panel, NULL);
-        if (ret)
+        if (ret && ret != -ENODEV)
                 return ret;
 
         /* Shut down GPIO is optional */
diff --git a/drivers/gpu/drm/drm_atomic.c b/drivers/gpu/drm/drm_atomic.c
index c0f336d23f9c..aed25c4183bb 100644
--- a/drivers/gpu/drm/drm_atomic.c
+++ b/drivers/gpu/drm/drm_atomic.c
@@ -1655,6 +1655,9 @@ int drm_atomic_check_only(struct drm_atomic_state *state)
         if (config->funcs->atomic_check)
                 ret = config->funcs->atomic_check(state->dev, state);
 
+        if (ret)
+                return ret;
+
         if (!state->allow_modeset) {
                 for_each_new_crtc_in_state(state, crtc, crtc_state, i) {
                         if (drm_atomic_crtc_needs_modeset(crtc_state)) {
@@ -1665,7 +1668,7 @@ int drm_atomic_check_only(struct drm_atomic_state *state)
                 }
         }
 
-        return ret;
+        return 0;
 }
 EXPORT_SYMBOL(drm_atomic_check_only);
 
@@ -2167,10 +2170,10 @@ int drm_mode_atomic_ioctl(struct drm_device *dev,
         struct drm_atomic_state *state;
         struct drm_modeset_acquire_ctx ctx;
         struct drm_plane *plane;
-        struct drm_out_fence_state *fence_state = NULL;
+        struct drm_out_fence_state *fence_state;
         unsigned plane_mask;
         int ret = 0;
-        unsigned int i, j, num_fences = 0;
+        unsigned int i, j, num_fences;
 
         /* disallow for drivers not supporting atomic: */
         if (!drm_core_check_feature(dev, DRIVER_ATOMIC))
@@ -2211,6 +2214,8 @@ retry:
         plane_mask = 0;
         copied_objs = 0;
         copied_props = 0;
+        fence_state = NULL;
+        num_fences = 0;
 
         for (i = 0; i < arg->count_objs; i++) {
                 uint32_t obj_id, count_props;
diff --git a/drivers/gpu/drm/drm_dp_helper.c b/drivers/gpu/drm/drm_dp_helper.c
index 213fb837e1c4..08af8d6b844b 100644
--- a/drivers/gpu/drm/drm_dp_helper.c
+++ b/drivers/gpu/drm/drm_dp_helper.c
@@ -544,7 +544,7 @@ void drm_dp_downstream_debug(struct seq_file *m,
                                  DP_DETAILED_CAP_INFO_AVAILABLE;
         int clk;
         int bpc;
-        char id[6];
+        char id[7];
         int len;
         uint8_t rev[2];
         int type = port_cap[0] & DP_DS_PORT_TYPE_MASK;
@@ -583,6 +583,7 @@ void drm_dp_downstream_debug(struct seq_file *m,
                 seq_puts(m, "\t\tType: N/A\n");
         }
 
+        memset(id, 0, sizeof(id));
         drm_dp_downstream_id(aux, id);
         seq_printf(m, "\t\tID: %s\n", id);
 
@@ -591,7 +592,7 @@ void drm_dp_downstream_debug(struct seq_file *m,
                 seq_printf(m, "\t\tHW: %d.%d\n",
                            (rev[0] & 0xf0) >> 4, rev[0] & 0xf);
 
-        len = drm_dp_dpcd_read(aux, DP_BRANCH_SW_REV, &rev, 2);
+        len = drm_dp_dpcd_read(aux, DP_BRANCH_SW_REV, rev, 2);
         if (len > 0)
                 seq_printf(m, "\t\tSW: %d.%d\n", rev[0], rev[1]);
 
diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
index 8dc11064253d..cdaac37907b1 100644
--- a/drivers/gpu/drm/drm_gem.c
+++ b/drivers/gpu/drm/drm_gem.c
@@ -255,13 +255,13 @@ drm_gem_object_release_handle(int id, void *ptr, void *data)
         struct drm_gem_object *obj = ptr;
         struct drm_device *dev = obj->dev;
 
+        if (dev->driver->gem_close_object)
+                dev->driver->gem_close_object(obj, file_priv);
+
         if (drm_core_check_feature(dev, DRIVER_PRIME))
                 drm_gem_remove_prime_handles(obj, file_priv);
         drm_vma_node_revoke(&obj->vma_node, file_priv);
 
-        if (dev->driver->gem_close_object)
-                dev->driver->gem_close_object(obj, file_priv);
-
         drm_gem_object_handle_put_unlocked(obj);
 
         return 0;
diff --git a/drivers/gpu/drm/drm_plane.c b/drivers/gpu/drm/drm_plane.c
index 5dc8c4350602..e40c12fabbde 100644
--- a/drivers/gpu/drm/drm_plane.c
+++ b/drivers/gpu/drm/drm_plane.c
@@ -601,6 +601,7 @@ int drm_mode_setplane(struct drm_device *dev, void *data,
 
                 crtc = drm_crtc_find(dev, plane_req->crtc_id);
                 if (!crtc) {
+                        drm_framebuffer_put(fb);
                         DRM_DEBUG_KMS("Unknown crtc ID %d\n",
                                       plane_req->crtc_id);
                         return -ENOENT;
diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c b/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c
index 5bd93169dac2..6463fc2c736f 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c
@@ -270,8 +270,8 @@ static int submit_reloc(struct etnaviv_gem_submit *submit, void *stream,
                 if (ret)
                         return ret;
 
-                if (r->reloc_offset >= bo->obj->base.size - sizeof(*ptr)) {
-                        DRM_ERROR("relocation %u outside object", i);
+                if (r->reloc_offset > bo->obj->base.size - sizeof(*ptr)) {
+                        DRM_ERROR("relocation %u outside object\n", i);
                         return -EINVAL;
                 }
 
diff --git a/drivers/gpu/drm/exynos/Kconfig b/drivers/gpu/drm/exynos/Kconfig
index 1d185347c64c..305dc3d4ff77 100644
--- a/drivers/gpu/drm/exynos/Kconfig
+++ b/drivers/gpu/drm/exynos/Kconfig
@@ -75,6 +75,7 @@ config DRM_EXYNOS_DP
 config DRM_EXYNOS_HDMI
         bool "HDMI"
         depends on DRM_EXYNOS_MIXER || DRM_EXYNOS5433_DECON
+        select CEC_CORE if CEC_NOTIFIER
         help
           Choose this option if you want to use Exynos HDMI for DRM.
 
diff --git a/drivers/gpu/drm/exynos/exynos_drm_drv.c b/drivers/gpu/drm/exynos/exynos_drm_drv.c
index 35a8dfc93836..242bd50faa26 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_drv.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_drv.c
@@ -453,7 +453,6 @@ static int exynos_drm_platform_probe(struct platform_device *pdev)
         struct component_match *match;
 
         pdev->dev.coherent_dma_mask = DMA_BIT_MASK(32);
-        exynos_drm_driver.num_ioctls = ARRAY_SIZE(exynos_ioctls);
 
         match = exynos_drm_match_add(&pdev->dev);
         if (IS_ERR(match))
diff --git a/drivers/gpu/drm/exynos/exynos_drm_dsi.c b/drivers/gpu/drm/exynos/exynos_drm_dsi.c
index a11b79596e2f..b6a46d9a016e 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_dsi.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_dsi.c
@@ -1651,8 +1651,6 @@ static int exynos_dsi_parse_dt(struct exynos_dsi *dsi)
                 return ret;
 
         dsi->bridge_node = of_graph_get_remote_node(node, DSI_PORT_IN, 0);
-        if (!dsi->bridge_node)
-                return -EINVAL;
 
         return 0;
 }
@@ -1687,9 +1685,11 @@ static int exynos_dsi_bind(struct device *dev, struct device *master,
                 return ret;
         }
 
-        bridge = of_drm_find_bridge(dsi->bridge_node);
-        if (bridge)
-                drm_bridge_attach(encoder, bridge, NULL);
+        if (dsi->bridge_node) {
+                bridge = of_drm_find_bridge(dsi->bridge_node);
+                if (bridge)
+                        drm_bridge_attach(encoder, bridge, NULL);
+        }
 
         return mipi_dsi_host_register(&dsi->dsi_host);
 }
diff --git a/drivers/gpu/drm/exynos/exynos_drm_fb.c b/drivers/gpu/drm/exynos/exynos_drm_fb.c
index d48fd7c918f8..73217c281c9a 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fb.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_fb.c
@@ -145,13 +145,19 @@ static struct drm_framebuffer *
 exynos_user_fb_create(struct drm_device *dev, struct drm_file *file_priv,
                       const struct drm_mode_fb_cmd2 *mode_cmd)
 {
+        const struct drm_format_info *info = drm_get_format_info(dev, mode_cmd);
         struct exynos_drm_gem *exynos_gem[MAX_FB_BUFFER];
         struct drm_gem_object *obj;
         struct drm_framebuffer *fb;
         int i;
         int ret;
 
-        for (i = 0; i < drm_format_num_planes(mode_cmd->pixel_format); i++) {
+        for (i = 0; i < info->num_planes; i++) {
+                unsigned int height = (i == 0) ? mode_cmd->height :
+                                     DIV_ROUND_UP(mode_cmd->height, info->vsub);
+                unsigned long size = height * mode_cmd->pitches[i] +
+                                     mode_cmd->offsets[i];
+
                 obj = drm_gem_object_lookup(file_priv, mode_cmd->handles[i]);
                 if (!obj) {
                         DRM_ERROR("failed to lookup gem object\n");
@@ -160,6 +166,12 @@ exynos_user_fb_create(struct drm_device *dev, struct drm_file *file_priv,
                 }
 
                 exynos_gem[i] = to_exynos_gem(obj);
+
+                if (size > exynos_gem[i]->size) {
+                        i++;
+                        ret = -EINVAL;
+                        goto err;
+                }
         }
 
         fb = exynos_drm_framebuffer_init(dev, mode_cmd, exynos_gem, i);
diff --git a/drivers/gpu/drm/exynos/exynos_drm_mic.c b/drivers/gpu/drm/exynos/exynos_drm_mic.c
index e45720543a45..16bbee897e0d 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_mic.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_mic.c
@@ -340,16 +340,10 @@ static int exynos_mic_bind(struct device *dev, struct device *master,
                            void *data)
 {
         struct exynos_mic *mic = dev_get_drvdata(dev);
-        int ret;
 
-        mic->bridge.funcs = &mic_bridge_funcs;
-        mic->bridge.of_node = dev->of_node;
         mic->bridge.driver_private = mic;
-        ret = drm_bridge_add(&mic->bridge);
-        if (ret)
-                DRM_ERROR("mic: Failed to add MIC to the global bridge list\n");
 
-        return ret;
+        return 0;
 }
 
 static void exynos_mic_unbind(struct device *dev, struct device *master,
@@ -365,8 +359,6 @@ static void exynos_mic_unbind(struct device *dev, struct device *master,
 
 already_disabled:
         mutex_unlock(&mic_mutex);
-
-        drm_bridge_remove(&mic->bridge);
 }
 
 static const struct component_ops exynos_mic_component_ops = {
@@ -461,6 +453,15 @@ static int exynos_mic_probe(struct platform_device *pdev)
 
         platform_set_drvdata(pdev, mic);
 
+        mic->bridge.funcs = &mic_bridge_funcs;
+        mic->bridge.of_node = dev->of_node;
+
+        ret = drm_bridge_add(&mic->bridge);
+        if (ret) {
+                DRM_ERROR("mic: Failed to add MIC to the global bridge list\n");
+                return ret;
+        }
+
         pm_runtime_enable(dev);
 
         ret = component_add(dev, &exynos_mic_component_ops);
@@ -479,8 +480,13 @@ err:
 
 static int exynos_mic_remove(struct platform_device *pdev)
 {
+        struct exynos_mic *mic = platform_get_drvdata(pdev);
+
         component_del(&pdev->dev, &exynos_mic_component_ops);
         pm_runtime_disable(&pdev->dev);
+
+        drm_bridge_remove(&mic->bridge);
+
         return 0;
 }
 
diff --git a/drivers/gpu/drm/exynos/exynos_hdmi.c b/drivers/gpu/drm/exynos/exynos_hdmi.c
index 06bfbe400cf1..d3b69d66736f 100644
--- a/drivers/gpu/drm/exynos/exynos_hdmi.c
+++ b/drivers/gpu/drm/exynos/exynos_hdmi.c
@@ -1501,8 +1501,6 @@ static void hdmi_disable(struct drm_encoder *encoder)
          */
         cancel_delayed_work(&hdata->hotplug_work);
         cec_notifier_set_phys_addr(hdata->notifier, CEC_PHYS_ADDR_INVALID);
-
-        hdmiphy_disable(hdata);
 }
 
 static const struct drm_encoder_helper_funcs exynos_hdmi_encoder_helper_funcs = {
@@ -1676,7 +1674,7 @@ static int hdmi_resources_init(struct hdmi_context *hdata)
         return hdmi_bridge_init(hdata);
 }
 
-static struct of_device_id hdmi_match_types[] = {
+static const struct of_device_id hdmi_match_types[] = {
         {
                 .compatible = "samsung,exynos4210-hdmi",
                 .data = &exynos4210_hdmi_driver_data,
@@ -1934,8 +1932,7 @@ static int hdmi_remove(struct platform_device *pdev)
         return 0;
 }
 
-#ifdef CONFIG_PM
-static int exynos_hdmi_suspend(struct device *dev)
+static int __maybe_unused exynos_hdmi_suspend(struct device *dev)
 {
         struct hdmi_context *hdata = dev_get_drvdata(dev);
 
@@ -1944,7 +1941,7 @@ static int exynos_hdmi_suspend(struct device *dev)
         return 0;
 }
 
-static int exynos_hdmi_resume(struct device *dev)
+static int __maybe_unused exynos_hdmi_resume(struct device *dev)
 {
         struct hdmi_context *hdata = dev_get_drvdata(dev);
         int ret;
@@ -1955,7 +1952,6 @@ static int exynos_hdmi_resume(struct device *dev)
 
         return 0;
 }
-#endif
 
 static const struct dev_pm_ops exynos_hdmi_pm_ops = {
         SET_RUNTIME_PM_OPS(exynos_hdmi_suspend, exynos_hdmi_resume, NULL)
diff --git a/drivers/gpu/drm/exynos/exynos_mixer.c b/drivers/gpu/drm/exynos/exynos_mixer.c
index 6bed4f3ffcd6..a998a8dd783c 100644
--- a/drivers/gpu/drm/exynos/exynos_mixer.c
+++ b/drivers/gpu/drm/exynos/exynos_mixer.c
@@ -1094,28 +1094,28 @@ static const struct exynos_drm_crtc_ops mixer_crtc_ops = {
         .atomic_check           = mixer_atomic_check,
 };
 
-static struct mixer_drv_data exynos5420_mxr_drv_data = {
+static const struct mixer_drv_data exynos5420_mxr_drv_data = {
         .version = MXR_VER_128_0_0_184,
         .is_vp_enabled = 0,
 };
 
-static struct mixer_drv_data exynos5250_mxr_drv_data = {
+static const struct mixer_drv_data exynos5250_mxr_drv_data = {
         .version = MXR_VER_16_0_33_0,
         .is_vp_enabled = 0,
 };
 
-static struct mixer_drv_data exynos4212_mxr_drv_data = {
+static const struct mixer_drv_data exynos4212_mxr_drv_data = {
         .version = MXR_VER_0_0_0_16,
         .is_vp_enabled = 1,
 };
 
-static struct mixer_drv_data exynos4210_mxr_drv_data = {
+static const struct mixer_drv_data exynos4210_mxr_drv_data = {
         .version = MXR_VER_0_0_0_16,
         .is_vp_enabled = 1,
         .has_sclk = 1,
 };
 
-static struct of_device_id mixer_match_types[] = {
+static const struct of_device_id mixer_match_types[] = {
         {
                 .compatible = "samsung,exynos4210-mixer",
                 .data   = &exynos4210_mxr_drv_data,
diff --git a/drivers/gpu/drm/i915/gvt/cmd_parser.c b/drivers/gpu/drm/i915/gvt/cmd_parser.c
index 713848c36349..e556a46cd4c2 100644
--- a/drivers/gpu/drm/i915/gvt/cmd_parser.c
+++ b/drivers/gpu/drm/i915/gvt/cmd_parser.c
@@ -2714,7 +2714,7 @@ static int shadow_indirect_ctx(struct intel_shadow_wa_ctx *wa_ctx)
 unmap_src:
         i915_gem_object_unpin_map(obj);
 put_obj:
-        i915_gem_object_put(wa_ctx->indirect_ctx.obj);
+        i915_gem_object_put(obj);
         return ret;
 }
 
diff --git a/drivers/gpu/drm/i915/gvt/display.c b/drivers/gpu/drm/i915/gvt/display.c
index 2deb05f618fb..7cb0818a13de 100644
--- a/drivers/gpu/drm/i915/gvt/display.c
+++ b/drivers/gpu/drm/i915/gvt/display.c
@@ -323,27 +323,27 @@ void intel_gvt_check_vblank_emulation(struct intel_gvt *gvt)
 {
         struct intel_gvt_irq *irq = &gvt->irq;
         struct intel_vgpu *vgpu;
-        bool have_enabled_pipe = false;
         int pipe, id;
 
         if (WARN_ON(!mutex_is_locked(&gvt->lock)))
                 return;
 
-        hrtimer_cancel(&irq->vblank_timer.timer);
-
         for_each_active_vgpu(gvt, vgpu, id) {
                 for (pipe = 0; pipe < I915_MAX_PIPES; pipe++) {
-                        have_enabled_pipe =
-                                pipe_is_enabled(vgpu, pipe);
-                        if (have_enabled_pipe)
-                                break;
+                        if (pipe_is_enabled(vgpu, pipe))
+                                goto out;
                 }
         }
 
-        if (have_enabled_pipe)
-                hrtimer_start(&irq->vblank_timer.timer,
-                        ktime_add_ns(ktime_get(), irq->vblank_timer.period),
-                        HRTIMER_MODE_ABS);
+        /* all the pipes are disabled */
+        hrtimer_cancel(&irq->vblank_timer.timer);
+        return;
+
+out:
+        hrtimer_start(&irq->vblank_timer.timer,
+                ktime_add_ns(ktime_get(), irq->vblank_timer.period),
+                HRTIMER_MODE_ABS);
+
 }
 
 static void emulate_vblank_on_pipe(struct intel_vgpu *vgpu, int pipe)
diff --git a/drivers/gpu/drm/i915/gvt/execlist.c b/drivers/gpu/drm/i915/gvt/execlist.c
index 700050556242..1648887d3f55 100644
--- a/drivers/gpu/drm/i915/gvt/execlist.c
+++ b/drivers/gpu/drm/i915/gvt/execlist.c
@@ -46,6 +46,8 @@
 #define same_context(a, b) (((a)->context_id == (b)->context_id) && \
                 ((a)->lrca == (b)->lrca))
 
+static void clean_workloads(struct intel_vgpu *vgpu, unsigned long engine_mask);
+
 static int context_switch_events[] = {
         [RCS] = RCS_AS_CONTEXT_SWITCH,
         [BCS] = BCS_AS_CONTEXT_SWITCH,
@@ -499,10 +501,10 @@ static void release_shadow_wa_ctx(struct intel_shadow_wa_ctx *wa_ctx)
 static int complete_execlist_workload(struct intel_vgpu_workload *workload)
 {
         struct intel_vgpu *vgpu = workload->vgpu;
-        struct intel_vgpu_execlist *execlist =
-                &vgpu->execlist[workload->ring_id];
+        int ring_id = workload->ring_id;
+        struct intel_vgpu_execlist *execlist = &vgpu->execlist[ring_id];
         struct intel_vgpu_workload *next_workload;
-        struct list_head *next = workload_q_head(vgpu, workload->ring_id)->next;
+        struct list_head *next = workload_q_head(vgpu, ring_id)->next;
         bool lite_restore = false;
         int ret;
 
@@ -512,10 +514,25 @@ static int complete_execlist_workload(struct intel_vgpu_workload *workload)
         release_shadow_batch_buffer(workload);
         release_shadow_wa_ctx(&workload->wa_ctx);
 
-        if (workload->status || vgpu->resetting)
+        if (workload->status || (vgpu->resetting_eng & ENGINE_MASK(ring_id))) {
+                /* if workload->status is not successful means HW GPU
+                 * has occurred GPU hang or something wrong with i915/GVT,
+                 * and GVT won't inject context switch interrupt to guest.
+                 * So this error is a vGPU hang actually to the guest.
+                 * According to this we should emunlate a vGPU hang. If
+                 * there are pending workloads which are already submitted
+                 * from guest, we should clean them up like HW GPU does.
+                 *
+                 * if it is in middle of engine resetting, the pending
+                 * workloads won't be submitted to HW GPU and will be
+                 * cleaned up during the resetting process later, so doing
+                 * the workload clean up here doesn't have any impact.
+                 **/
+                clean_workloads(vgpu, ENGINE_MASK(ring_id));
                 goto out;
+        }
 
-        if (!list_empty(workload_q_head(vgpu, workload->ring_id))) {
+        if (!list_empty(workload_q_head(vgpu, ring_id))) {
                 struct execlist_ctx_descriptor_format *this_desc, *next_desc;
 
                 next_workload = container_of(next,
diff --git a/drivers/gpu/drm/i915/gvt/firmware.c b/drivers/gpu/drm/i915/gvt/firmware.c
index 5dad9298b2d5..a26c1705430e 100644
--- a/drivers/gpu/drm/i915/gvt/firmware.c
+++ b/drivers/gpu/drm/i915/gvt/firmware.c
@@ -72,11 +72,13 @@ static int expose_firmware_sysfs(struct intel_gvt *gvt)
         struct intel_gvt_device_info *info = &gvt->device_info;
         struct pci_dev *pdev = gvt->dev_priv->drm.pdev;
         struct intel_gvt_mmio_info *e;
+        struct gvt_mmio_block *block = gvt->mmio.mmio_block;
+        int num = gvt->mmio.num_mmio_block;
         struct gvt_firmware_header *h;
         void *firmware;
         void *p;
         unsigned long size, crc32_start;
-        int i;
+        int i, j;
         int ret;
 
         size = sizeof(*h) + info->mmio_size + info->cfg_space_size;
@@ -105,6 +107,13 @@ static int expose_firmware_sysfs(struct intel_gvt *gvt)
         hash_for_each(gvt->mmio.mmio_info_table, i, e, node)
                 *(u32 *)(p + e->offset) = I915_READ_NOTRACE(_MMIO(e->offset));
 
+        for (i = 0; i < num; i++, block++) {
+                for (j = 0; j < block->size; j += 4)
+                        *(u32 *)(p + INTEL_GVT_MMIO_OFFSET(block->offset) + j) =
+                                I915_READ_NOTRACE(_MMIO(INTEL_GVT_MMIO_OFFSET(
+                                                        block->offset) + j));
+        }
+
         memcpy(gvt->firmware.mmio, p, info->mmio_size);
 
         crc32_start = offsetof(struct gvt_firmware_header, crc32) + 4;
diff --git a/drivers/gpu/drm/i915/gvt/gvt.h b/drivers/gpu/drm/i915/gvt/gvt.h
index 3a74e79eac2f..2964a4d01a66 100644
--- a/drivers/gpu/drm/i915/gvt/gvt.h
+++ b/drivers/gpu/drm/i915/gvt/gvt.h
@@ -149,7 +149,7 @@ struct intel_vgpu {
         bool active;
         bool pv_notified;
         bool failsafe;
-        bool resetting;
+        unsigned int resetting_eng;
         void *sched_data;
         struct vgpu_sched_ctl sched_ctl;
 
@@ -195,6 +195,15 @@ struct intel_gvt_fence {
         unsigned long vgpu_allocated_fence_num;
 };
 
+/* Special MMIO blocks. */
+struct gvt_mmio_block {
+        unsigned int device;
+        i915_reg_t   offset;
+        unsigned int size;
+        gvt_mmio_func read;
+        gvt_mmio_func write;
+};
+
 #define INTEL_GVT_MMIO_HASH_BITS 11
 
 struct intel_gvt_mmio {
@@ -214,6 +223,9 @@ struct intel_gvt_mmio {
 /* This reg could be accessed by unaligned address */
 #define F_UNALIGN       (1 << 6)
 
+        struct gvt_mmio_block *mmio_block;
+        unsigned int num_mmio_block;
+
         DECLARE_HASHTABLE(mmio_info_table, INTEL_GVT_MMIO_HASH_BITS);
         unsigned int num_tracked_mmio;
 };
diff --git a/drivers/gpu/drm/i915/gvt/handlers.c b/drivers/gpu/drm/i915/gvt/handlers.c
index 17febe830ff6..feed9921b3b3 100644
--- a/drivers/gpu/drm/i915/gvt/handlers.c
+++ b/drivers/gpu/drm/i915/gvt/handlers.c
@@ -2857,31 +2857,15 @@ static int init_skl_mmio_info(struct intel_gvt *gvt)
         return 0;
 }
 
-/* Special MMIO blocks. */
-static struct gvt_mmio_block {
-        unsigned int device;
-        i915_reg_t   offset;
-        unsigned int size;
-        gvt_mmio_func read;
-        gvt_mmio_func write;
-} gvt_mmio_blocks[] = {
-        {D_SKL_PLUS, _MMIO(CSR_MMIO_START_RANGE), 0x3000, NULL, NULL},
-        {D_ALL, _MMIO(MCHBAR_MIRROR_BASE_SNB), 0x40000, NULL, NULL},
-        {D_ALL, _MMIO(VGT_PVINFO_PAGE), VGT_PVINFO_SIZE,
-                pvinfo_mmio_read, pvinfo_mmio_write},
-        {D_ALL, LGC_PALETTE(PIPE_A, 0), 1024, NULL, NULL},
-        {D_ALL, LGC_PALETTE(PIPE_B, 0), 1024, NULL, NULL},
-        {D_ALL, LGC_PALETTE(PIPE_C, 0), 1024, NULL, NULL},
-};
-
 static struct gvt_mmio_block *find_mmio_block(struct intel_gvt *gvt,
                                               unsigned int offset)
 {
         unsigned long device = intel_gvt_get_device_type(gvt);
-        struct gvt_mmio_block *block = gvt_mmio_blocks;
+        struct gvt_mmio_block *block = gvt->mmio.mmio_block;
+        int num = gvt->mmio.num_mmio_block;
         int i;
 
-        for (i = 0; i < ARRAY_SIZE(gvt_mmio_blocks); i++, block++) {
+        for (i = 0; i < num; i++, block++) {
                 if (!(device & block->device))
                         continue;
                 if (offset >= INTEL_GVT_MMIO_OFFSET(block->offset) &&
@@ -2912,6 +2896,17 @@ void intel_gvt_clean_mmio_info(struct intel_gvt *gvt)
         gvt->mmio.mmio_attribute = NULL;
 }
 
+/* Special MMIO blocks. */
+static struct gvt_mmio_block mmio_blocks[] = {
+        {D_SKL_PLUS, _MMIO(CSR_MMIO_START_RANGE), 0x3000, NULL, NULL},
+        {D_ALL, _MMIO(MCHBAR_MIRROR_BASE_SNB), 0x40000, NULL, NULL},
+        {D_ALL, _MMIO(VGT_PVINFO_PAGE), VGT_PVINFO_SIZE,
+                pvinfo_mmio_read, pvinfo_mmio_write},
+        {D_ALL, LGC_PALETTE(PIPE_A, 0), 1024, NULL, NULL},
+        {D_ALL, LGC_PALETTE(PIPE_B, 0), 1024, NULL, NULL},
+        {D_ALL, LGC_PALETTE(PIPE_C, 0), 1024, NULL, NULL},
+};
+
 /**
  * intel_gvt_setup_mmio_info - setup MMIO information table for GVT device
  * @gvt: GVT device
@@ -2951,6 +2946,9 @@ int intel_gvt_setup_mmio_info(struct intel_gvt *gvt)
                         goto err;
         }
 
+        gvt->mmio.mmio_block = mmio_blocks;
+        gvt->mmio.num_mmio_block = ARRAY_SIZE(mmio_blocks);
+
         gvt_dbg_mmio("traced %u virtual mmio registers\n",
                      gvt->mmio.num_tracked_mmio);
         return 0;
@@ -3030,7 +3028,7 @@ int intel_vgpu_mmio_reg_rw(struct intel_vgpu *vgpu, unsigned int offset,
         gvt_mmio_func func;
         int ret;
 
-        if (WARN_ON(bytes > 4))
+        if (WARN_ON(bytes > 8))
                 return -EINVAL;
 
         /*
diff --git a/drivers/gpu/drm/i915/gvt/scheduler.c b/drivers/gpu/drm/i915/gvt/scheduler.c
index 4f7057d62d88..22e08eb2d0b7 100644
--- a/drivers/gpu/drm/i915/gvt/scheduler.c
+++ b/drivers/gpu/drm/i915/gvt/scheduler.c
@@ -432,7 +432,8 @@ static void complete_current_workload(struct intel_gvt *gvt, int ring_id)
 
                 i915_gem_request_put(fetch_and_zero(&workload->req));
 
-                if (!workload->status && !vgpu->resetting) {
+                if (!workload->status && !(vgpu->resetting_eng &
+                                           ENGINE_MASK(ring_id))) {
                         update_guest_context(workload);
 
                         for_each_set_bit(event, workload->pending_events,
diff --git a/drivers/gpu/drm/i915/gvt/vgpu.c b/drivers/gpu/drm/i915/gvt/vgpu.c
index 90c14e6e3ea0..3deadcbd5a24 100644
--- a/drivers/gpu/drm/i915/gvt/vgpu.c
+++ b/drivers/gpu/drm/i915/gvt/vgpu.c
@@ -480,11 +480,13 @@ void intel_gvt_reset_vgpu_locked(struct intel_vgpu *vgpu, bool dmlr,
 {
         struct intel_gvt *gvt = vgpu->gvt;
         struct intel_gvt_workload_scheduler *scheduler = &gvt->scheduler;
+        unsigned int resetting_eng = dmlr ? ALL_ENGINES : engine_mask;
 
         gvt_dbg_core("------------------------------------------\n");
         gvt_dbg_core("resseting vgpu%d, dmlr %d, engine_mask %08x\n",
                      vgpu->id, dmlr, engine_mask);
-        vgpu->resetting = true;
+
+        vgpu->resetting_eng = resetting_eng;
 
         intel_vgpu_stop_schedule(vgpu);
         /*
@@ -497,7 +499,7 @@ void intel_gvt_reset_vgpu_locked(struct intel_vgpu *vgpu, bool dmlr,
                 mutex_lock(&gvt->lock);
         }
 
-        intel_vgpu_reset_execlist(vgpu, dmlr ? ALL_ENGINES : engine_mask);
+        intel_vgpu_reset_execlist(vgpu, resetting_eng);
 
         /* full GPU reset or device model level reset */
         if (engine_mask == ALL_ENGINES || dmlr) {
@@ -520,7 +522,7 @@ void intel_gvt_reset_vgpu_locked(struct intel_vgpu *vgpu, bool dmlr,
                 }
         }
 
-        vgpu->resetting = false;
+        vgpu->resetting_eng = 0;
         gvt_dbg_core("reset vgpu%d done\n", vgpu->id);
         gvt_dbg_core("------------------------------------------\n");
 }
diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
index 00d8967c8512..d1bd53b73738 100644
--- a/drivers/gpu/drm/i915/i915_debugfs.c
+++ b/drivers/gpu/drm/i915/i915_debugfs.c
@@ -4580,7 +4580,7 @@ static void gen9_sseu_device_status(struct drm_i915_private *dev_priv,
 
                 sseu->slice_mask |= BIT(s);
 
-                if (IS_GEN9_BC(dev_priv))
+                if (IS_GEN9_BC(dev_priv) || IS_CANNONLAKE(dev_priv))
                         sseu->subslice_mask =
                                 INTEL_INFO(dev_priv)->sseu.subslice_mask;
 
diff --git a/drivers/gpu/drm/i915/i915_gem_clflush.c b/drivers/gpu/drm/i915/i915_gem_clflush.c
index 152f16c11878..348b29a845c9 100644
--- a/drivers/gpu/drm/i915/i915_gem_clflush.c
+++ b/drivers/gpu/drm/i915/i915_gem_clflush.c
@@ -114,7 +114,7 @@ i915_clflush_notify(struct i915_sw_fence *fence,
         return NOTIFY_DONE;
 }
 
-void i915_gem_clflush_object(struct drm_i915_gem_object *obj,
+bool i915_gem_clflush_object(struct drm_i915_gem_object *obj,
                              unsigned int flags)
 {
         struct clflush *clflush;
@@ -128,7 +128,7 @@ void i915_gem_clflush_object(struct drm_i915_gem_object *obj,
          */
         if (!i915_gem_object_has_struct_page(obj)) {
                 obj->cache_dirty = false;
-                return;
+                return false;
         }
 
         /* If the GPU is snooping the contents of the CPU cache,
@@ -140,7 +140,7 @@ void i915_gem_clflush_object(struct drm_i915_gem_object *obj,
          * tracking.
          */
         if (!(flags & I915_CLFLUSH_FORCE) && obj->cache_coherent)
-                return;
+                return false;
 
         trace_i915_gem_object_clflush(obj);
 
@@ -179,4 +179,5 @@ void i915_gem_clflush_object(struct drm_i915_gem_object *obj,
         }
 
         obj->cache_dirty = false;
+        return true;
 }
diff --git a/drivers/gpu/drm/i915/i915_gem_clflush.h b/drivers/gpu/drm/i915/i915_gem_clflush.h
index 2455a7820937..f390247561b3 100644
--- a/drivers/gpu/drm/i915/i915_gem_clflush.h
+++ b/drivers/gpu/drm/i915/i915_gem_clflush.h
@@ -28,7 +28,7 @@
 struct drm_i915_private;
 struct drm_i915_gem_object;
 
-void i915_gem_clflush_object(struct drm_i915_gem_object *obj,
+bool i915_gem_clflush_object(struct drm_i915_gem_object *obj,
                              unsigned int flags);
 #define I915_CLFLUSH_FORCE BIT(0)
 #define I915_CLFLUSH_SYNC BIT(1)
diff --git a/drivers/gpu/drm/i915/i915_gem_context.c b/drivers/gpu/drm/i915/i915_gem_context.c
index 39ed58a21fc1..e1e971ee2ed5 100644
--- a/drivers/gpu/drm/i915/i915_gem_context.c
+++ b/drivers/gpu/drm/i915/i915_gem_context.c
@@ -688,19 +688,19 @@ static inline bool skip_rcs_switch(struct i915_hw_ppgtt *ppgtt,
 }
 
 static bool
-needs_pd_load_pre(struct i915_hw_ppgtt *ppgtt,
-                  struct intel_engine_cs *engine,
-                  struct i915_gem_context *to)
+needs_pd_load_pre(struct i915_hw_ppgtt *ppgtt, struct intel_engine_cs *engine)
 {
+        struct i915_gem_context *from = engine->legacy_active_context;
+
         if (!ppgtt)
                 return false;
 
         /* Always load the ppgtt on first use */
-        if (!engine->legacy_active_context)
+        if (!from)
                 return true;
 
         /* Same context without new entries, skip */
-        if (engine->legacy_active_context == to &&
+        if ((!from->ppgtt || from->ppgtt == ppgtt) &&
             !(intel_engine_flag(engine) & ppgtt->pd_dirty_rings))
                 return false;
 
@@ -744,7 +744,7 @@ static int do_rcs_switch(struct drm_i915_gem_request *req)
         if (skip_rcs_switch(ppgtt, engine, to))
                 return 0;
 
-        if (needs_pd_load_pre(ppgtt, engine, to)) {
+        if (needs_pd_load_pre(ppgtt, engine)) {
                 /* Older GENs and non render rings still want the load first,
                  * "PP_DCLV followed by PP_DIR_BASE register through Load
                  * Register Immediate commands in Ring Buffer before submitting
@@ -841,7 +841,7 @@ int i915_switch_context(struct drm_i915_gem_request *req)
                 struct i915_hw_ppgtt *ppgtt =
                         to->ppgtt ?: req->i915->mm.aliasing_ppgtt;
 
-                if (needs_pd_load_pre(ppgtt, engine, to)) {
+                if (needs_pd_load_pre(ppgtt, engine)) {
                         int ret;
 
                         trace_switch_mm(engine, to);
@@ -852,6 +852,7 @@ int i915_switch_context(struct drm_i915_gem_request *req)
                         ppgtt->pd_dirty_rings &= ~intel_engine_flag(engine);
                 }
 
+                engine->legacy_active_context = to;
                 return 0;
         }
 
diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
index 054b2e54cdaf..e9503f6d1100 100644
--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
@@ -560,9 +560,6 @@ static int eb_reserve_vma(const struct i915_execbuffer *eb,
                 eb->args->flags |= __EXEC_HAS_RELOC;
         }
 
-        entry->flags |= __EXEC_OBJECT_HAS_PIN;
-        GEM_BUG_ON(eb_vma_misplaced(entry, vma));
-
         if (unlikely(entry->flags & EXEC_OBJECT_NEEDS_FENCE)) {
                 err = i915_vma_get_fence(vma);
                 if (unlikely(err)) {
@@ -574,6 +571,9 @@ static int eb_reserve_vma(const struct i915_execbuffer *eb,
                         entry->flags |= __EXEC_OBJECT_HAS_FENCE;
         }
 
+        entry->flags |= __EXEC_OBJECT_HAS_PIN;
+        GEM_BUG_ON(eb_vma_misplaced(entry, vma));
+
         return 0;
 }
 
@@ -1458,7 +1458,7 @@ static int eb_relocate_vma(struct i915_execbuffer *eb, struct i915_vma *vma)
          * to read. However, if the array is not writable the user loses
          * the updated relocation values.
          */
-        if (unlikely(!access_ok(VERIFY_READ, urelocs, remain*sizeof(urelocs))))
+        if (unlikely(!access_ok(VERIFY_READ, urelocs, remain*sizeof(*urelocs))))
                 return -EFAULT;
 
         do {
@@ -1775,7 +1775,7 @@ out:
                 }
         }
 
-        return err ?: have_copy;
+        return err;
 }
 
 static int eb_relocate(struct i915_execbuffer *eb)
@@ -1825,7 +1825,7 @@ static int eb_move_to_gpu(struct i915_execbuffer *eb)
         int err;
 
         for (i = 0; i < count; i++) {
-                const struct drm_i915_gem_exec_object2 *entry = &eb->exec[i];
+                struct drm_i915_gem_exec_object2 *entry = &eb->exec[i];
                 struct i915_vma *vma = exec_to_vma(entry);
                 struct drm_i915_gem_object *obj = vma->obj;
 
@@ -1841,12 +1841,14 @@ static int eb_move_to_gpu(struct i915_execbuffer *eb)
                         eb->request->capture_list = capture;
                 }
 
+                if (unlikely(obj->cache_dirty && !obj->cache_coherent)) {
+                        if (i915_gem_clflush_object(obj, 0))
+                                entry->flags &= ~EXEC_OBJECT_ASYNC;
+                }
+
                 if (entry->flags & EXEC_OBJECT_ASYNC)
                         goto skip_flushes;
 
-                if (unlikely(obj->cache_dirty && !obj->cache_coherent))
-                        i915_gem_clflush_object(obj, 0);
-
                 err = i915_gem_request_await_object
                         (eb->request, obj, entry->flags & EXEC_OBJECT_WRITE);
                 if (err)
@@ -2209,7 +2211,7 @@ i915_gem_do_execbuffer(struct drm_device *dev,
                 goto err_unlock;
 
         err = eb_relocate(&eb);
-        if (err)
+        if (err) {
                 /*
                  * If the user expects the execobject.offset and
                  * reloc.presumed_offset to be an exact match,
@@ -2218,8 +2220,8 @@ i915_gem_do_execbuffer(struct drm_device *dev,
                  * relocation.
                  */
                 args->flags &= ~__EXEC_HAS_RELOC;
-        if (err < 0)
                 goto err_vma;
+        }
 
         if (unlikely(eb.batch->exec_entry->flags & EXEC_OBJECT_WRITE)) {
                 DRM_DEBUG("Attempting to use self-modifying batch buffer\n");
diff --git a/drivers/gpu/drm/i915/i915_gem_render_state.c b/drivers/gpu/drm/i915/i915_gem_render_state.c
index 7032c542a9b1..4dd4c2159a92 100644
--- a/drivers/gpu/drm/i915/i915_gem_render_state.c
+++ b/drivers/gpu/drm/i915/i915_gem_render_state.c
@@ -242,6 +242,10 @@ int i915_gem_render_state_emit(struct drm_i915_gem_request *req)
                         goto err_unpin;
         }
 
+        ret = req->engine->emit_flush(req, EMIT_INVALIDATE);
+        if (ret)
+                goto err_unpin;
+
         ret = req->engine->emit_bb_start(req,
                                          so->batch_offset, so->batch_size,
                                          I915_DISPATCH_SECURE);
diff --git a/drivers/gpu/drm/i915/i915_gem_shrinker.c b/drivers/gpu/drm/i915/i915_gem_shrinker.c
index 1032f98add11..77fb39808131 100644
--- a/drivers/gpu/drm/i915/i915_gem_shrinker.c
+++ b/drivers/gpu/drm/i915/i915_gem_shrinker.c
@@ -43,16 +43,21 @@ static bool shrinker_lock(struct drm_i915_private *dev_priv, bool *unlock)
                 return true;
 
         case MUTEX_TRYLOCK_FAILED:
+                *unlock = false;
+                preempt_disable();
                 do {
                         cpu_relax();
                         if (mutex_trylock(&dev_priv->drm.struct_mutex)) {
-        case MUTEX_TRYLOCK_SUCCESS:
                                 *unlock = true;
-                                return true;
+                                break;
                         }
                 } while (!need_resched());
+                preempt_enable();
+                return *unlock;
 
-                return false;
+        case MUTEX_TRYLOCK_SUCCESS:
+                *unlock = true;
+                return true;
         }
 
         BUG();
diff --git a/drivers/gpu/drm/i915/i915_perf.c b/drivers/gpu/drm/i915/i915_perf.c
index 9cd22f83b0cf..f33d90226704 100644
--- a/drivers/gpu/drm/i915/i915_perf.c
+++ b/drivers/gpu/drm/i915/i915_perf.c
@@ -1601,11 +1601,11 @@ static int gen8_emit_oa_config(struct drm_i915_gem_request *req)
         u32 *cs;
         int i;
 
-        cs = intel_ring_begin(req, n_flex_regs * 2 + 4);
+        cs = intel_ring_begin(req, ARRAY_SIZE(flex_mmio) * 2 + 4);
         if (IS_ERR(cs))
                 return PTR_ERR(cs);
 
-        *cs++ = MI_LOAD_REGISTER_IMM(n_flex_regs + 1);
+        *cs++ = MI_LOAD_REGISTER_IMM(ARRAY_SIZE(flex_mmio) + 1);
 
         *cs++ = i915_mmio_reg_offset(GEN8_OACTXCONTROL);
         *cs++ = (dev_priv->perf.oa.period_exponent << GEN8_OA_TIMER_PERIOD_SHIFT) |
diff --git a/drivers/gpu/drm/i915/i915_vma.h b/drivers/gpu/drm/i915/i915_vma.h
index 4a673fc1a432..20cf272c97b1 100644
--- a/drivers/gpu/drm/i915/i915_vma.h
+++ b/drivers/gpu/drm/i915/i915_vma.h
@@ -284,12 +284,12 @@ static inline void __i915_vma_pin(struct i915_vma *vma)
 
 static inline void __i915_vma_unpin(struct i915_vma *vma)
 {
-        GEM_BUG_ON(!i915_vma_is_pinned(vma));
         vma->flags--;
 }
 
 static inline void i915_vma_unpin(struct i915_vma *vma)
 {
+        GEM_BUG_ON(!i915_vma_is_pinned(vma));
         GEM_BUG_ON(!drm_mm_node_allocated(&vma->node));
         __i915_vma_unpin(vma);
 }
diff --git a/drivers/gpu/drm/i915/intel_bios.c b/drivers/gpu/drm/i915/intel_bios.c
index 639d45c1dd2e..7ea7fd1e8856 100644
--- a/drivers/gpu/drm/i915/intel_bios.c
+++ b/drivers/gpu/drm/i915/intel_bios.c
@@ -1120,8 +1120,8 @@ static void parse_ddi_port(struct drm_i915_private *dev_priv, enum port port,
         bool is_dvi, is_hdmi, is_dp, is_edp, is_crt;
         uint8_t aux_channel, ddc_pin;
         /* Each DDI port can have more than one value on the "DVO Port" field,
-         * so look for all the possible values for each port and abort if more
-         * than one is found. */
+         * so look for all the possible values for each port.
+         */
         int dvo_ports[][3] = {
                 {DVO_PORT_HDMIA, DVO_PORT_DPA, -1},
                 {DVO_PORT_HDMIB, DVO_PORT_DPB, -1},
@@ -1130,7 +1130,10 @@ static void parse_ddi_port(struct drm_i915_private *dev_priv, enum port port,
                 {DVO_PORT_CRT, DVO_PORT_HDMIE, DVO_PORT_DPE},
         };
 
-        /* Find the child device to use, abort if more than one found. */
+        /*
+         * Find the first child device to reference the port, report if more
+         * than one found.
+         */
         for (i = 0; i < dev_priv->vbt.child_dev_num; i++) {
                 it = dev_priv->vbt.child_dev + i;
 
@@ -1140,11 +1143,11 @@ static void parse_ddi_port(struct drm_i915_private *dev_priv, enum port port,
 
                         if (it->common.dvo_port == dvo_ports[port][j]) {
                                 if (child) {
-                                        DRM_DEBUG_KMS("More than one child device for port %c in VBT.\n",
+                                        DRM_DEBUG_KMS("More than one child device for port %c in VBT, using the first.\n",
                                                       port_name(port));
-                                        return;
+                                } else {
+                                        child = it;
                                 }
-                                child = it;
                         }
                 }
         }
diff --git a/drivers/gpu/drm/i915/intel_color.c b/drivers/gpu/drm/i915/intel_color.c
index 306c6b06b330..17c4ae7e4e7c 100644
--- a/drivers/gpu/drm/i915/intel_color.c
+++ b/drivers/gpu/drm/i915/intel_color.c
@@ -398,6 +398,7 @@ static void bdw_load_gamma_lut(struct drm_crtc_state *state, u32 offset)
                 }
 
                 /* Program the max register to clamp values > 1.0. */
+                i = lut_size - 1;
                 I915_WRITE(PREC_PAL_GC_MAX(pipe, 0),
                            drm_color_lut_extract(lut[i].red, 16));
                 I915_WRITE(PREC_PAL_GC_MAX(pipe, 1),
diff --git a/drivers/gpu/drm/i915/intel_ddi.c b/drivers/gpu/drm/i915/intel_ddi.c
index 80e96f1f49d2..d3b3252a8742 100644
--- a/drivers/gpu/drm/i915/intel_ddi.c
+++ b/drivers/gpu/drm/i915/intel_ddi.c
@@ -1762,7 +1762,7 @@ cnl_get_buf_trans_edp(struct drm_i915_private *dev_priv,
         if (dev_priv->vbt.edp.low_vswing) {
                 if (voltage == VOLTAGE_INFO_0_85V) {
                         *n_entries = ARRAY_SIZE(cnl_ddi_translations_edp_0_85V);
-                        return cnl_ddi_translations_dp_0_85V;
+                        return cnl_ddi_translations_edp_0_85V;
                 } else if (voltage == VOLTAGE_INFO_0_95V) {
                         *n_entries = ARRAY_SIZE(cnl_ddi_translations_edp_0_95V);
                         return cnl_ddi_translations_edp_0_95V;
@@ -1896,8 +1896,8 @@ static void cnl_ddi_vswing_sequence(struct intel_encoder *encoder, u32 level)
                 val = I915_READ(CNL_PORT_TX_DW4_LN(port, ln));
                 val &= ~LOADGEN_SELECT;
 
-                if (((rate < 600000) && (width == 4) && (ln >= 1))  ||
-                    ((rate < 600000) && (width < 4) && ((ln == 1) || (ln == 2)))) {
+                if ((rate <= 600000 && width == 4 && ln >= 1)  ||
+                    (rate <= 600000 && width < 4 && (ln == 1 || ln == 2))) {
                         val |= LOADGEN_SELECT;
                 }
                 I915_WRITE(CNL_PORT_TX_DW4_LN(port, ln), val);
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index dec9e58545a1..cc484b56eeaa 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -3427,26 +3427,6 @@ static void intel_complete_page_flips(struct drm_i915_private *dev_priv)
                 intel_finish_page_flip_cs(dev_priv, crtc->pipe);
 }
 
-static void intel_update_primary_planes(struct drm_device *dev)
-{
-        struct drm_crtc *crtc;
-
-        for_each_crtc(dev, crtc) {
-                struct intel_plane *plane = to_intel_plane(crtc->primary);
-                struct intel_plane_state *plane_state =
-                        to_intel_plane_state(plane->base.state);
-
-                if (plane_state->base.visible) {
-                        trace_intel_update_plane(&plane->base,
-                                                 to_intel_crtc(crtc));
-
-                        plane->update_plane(plane,
-                                            to_intel_crtc_state(crtc->state),
-                                            plane_state);
-                }
-        }
-}
-
 static int
 __intel_display_resume(struct drm_device *dev,
                        struct drm_atomic_state *state,
@@ -3499,6 +3479,19 @@ void intel_prepare_reset(struct drm_i915_private *dev_priv)
         struct drm_atomic_state *state;
         int ret;
 
+
+        /* reset doesn't touch the display */
+        if (!i915.force_reset_modeset_test &&
+            !gpu_reset_clobbers_display(dev_priv))
+                return;
+
+        /* We have a modeset vs reset deadlock, defensively unbreak it.
+         *
+         * FIXME: We can do a _lot_ better, this is just a first iteration.
+         */
+        i915_gem_set_wedged(dev_priv);
+        DRM_DEBUG_DRIVER("Wedging GPU to avoid deadlocks with pending modeset updates\n");
+
         /*
          * Need mode_config.mutex so that we don't
          * trample ongoing ->detect() and whatnot.
@@ -3512,12 +3505,6 @@ void intel_prepare_reset(struct drm_i915_private *dev_priv)
 
                 drm_modeset_backoff(ctx);
         }
-
-        /* reset doesn't touch the display, but flips might get nuked anyway, */
-        if (!i915.force_reset_modeset_test &&
-            !gpu_reset_clobbers_display(dev_priv))
-                return;
-
         /*
          * Disabling the crtcs gracefully seems nicer. Also the
          * g33 docs say we should at least disable all the planes.
@@ -3547,6 +3534,14 @@ void intel_finish_reset(struct drm_i915_private *dev_priv)
         struct drm_atomic_state *state = dev_priv->modeset_restore_state;
         int ret;
 
+        /* reset doesn't touch the display */
+        if (!i915.force_reset_modeset_test &&
+            !gpu_reset_clobbers_display(dev_priv))
+                return;
+
+        if (!state)
+                goto unlock;
+
         /*
          * Flips in the rings will be nuked by the reset,
          * so complete all pending flips so that user space
@@ -3558,22 +3553,10 @@ void intel_finish_reset(struct drm_i915_private *dev_priv)
 
         /* reset doesn't touch the display */
         if (!gpu_reset_clobbers_display(dev_priv)) {
-                if (!state) {
-                        /*
-                         * Flips in the rings have been nuked by the reset,
-                         * so update the base address of all primary
-                         * planes to the the last fb to make sure we're
-                         * showing the correct fb after a reset.
-                         *
-                         * FIXME: Atomic will make this obsolete since we won't schedule
-                         * CS-based flips (which might get lost in gpu resets) any more.
-                         */
-                        intel_update_primary_planes(dev);
-                } else {
-                        ret = __intel_display_resume(dev, state, ctx);
+                /* for testing only restore the display */
+                ret = __intel_display_resume(dev, state, ctx);
                         if (ret)
                                 DRM_ERROR("Restoring old state failed with %i\n", ret);
-                }
         } else {
                 /*
                  * The display has been reset as well,
@@ -3597,8 +3580,8 @@ void intel_finish_reset(struct drm_i915_private *dev_priv)
                 intel_hpd_init(dev_priv);
         }
 
-        if (state)
-                drm_atomic_state_put(state);
+        drm_atomic_state_put(state);
+unlock:
         drm_modeset_drop_locks(ctx);
         drm_modeset_acquire_fini(ctx);
         mutex_unlock(&dev->mode_config.mutex);
@@ -9117,6 +9100,13 @@ static bool haswell_get_pipe_config(struct intel_crtc *crtc,
         u64 power_domain_mask;
         bool active;
 
+        if (INTEL_GEN(dev_priv) >= 9) {
+                intel_crtc_init_scalers(crtc, pipe_config);
+
+                pipe_config->scaler_state.scaler_id = -1;
+                pipe_config->scaler_state.scaler_users &= ~(1 << SKL_CRTC_INDEX);
+        }
+
         power_domain = POWER_DOMAIN_PIPE(crtc->pipe);
         if (!intel_display_power_get_if_enabled(dev_priv, power_domain))
                 return false;
@@ -9145,13 +9135,6 @@ static bool haswell_get_pipe_config(struct intel_crtc *crtc,
         pipe_config->gamma_mode =
                 I915_READ(GAMMA_MODE(crtc->pipe)) & GAMMA_MODE_MODE_MASK;
 
-        if (INTEL_GEN(dev_priv) >= 9) {
-                intel_crtc_init_scalers(crtc, pipe_config);
-
-                pipe_config->scaler_state.scaler_id = -1;
-                pipe_config->scaler_state.scaler_users &= ~(1 << SKL_CRTC_INDEX);
-        }
-
         power_domain = POWER_DOMAIN_PIPE_PANEL_FITTER(crtc->pipe);
         if (intel_display_power_get_if_enabled(dev_priv, power_domain)) {
                 power_domain_mask |= BIT_ULL(power_domain);
@@ -9540,7 +9523,16 @@ static void i9xx_update_cursor(struct intel_plane *plane,
          * On some platforms writing CURCNTR first will also
          * cause CURPOS to be armed by the CURBASE write.
          * Without the CURCNTR write the CURPOS write would
-         * arm itself.
+         * arm itself. Thus we always start the full update
+         * with a CURCNTR write.
+         *
+         * On other platforms CURPOS always requires the
+         * CURBASE write to arm the update. Additonally
+         * a write to any of the cursor register will cancel
+         * an already armed cursor update. Thus leaving out
+         * the CURBASE write after CURPOS could lead to a
+         * cursor that doesn't appear to move, or even change
+         * shape. Thus we always write CURBASE.
          *
          * CURCNTR and CUR_FBC_CTL are always
          * armed by the CURBASE write only.
@@ -9559,6 +9551,7 @@ static void i9xx_update_cursor(struct intel_plane *plane,
                 plane->cursor.cntl = cntl;
         } else {
                 I915_WRITE_FW(CURPOS(pipe), pos);
+                I915_WRITE_FW(CURBASE(pipe), base);
         }
 
         POSTING_READ_FW(CURBASE(pipe));
diff --git a/drivers/gpu/drm/i915/intel_dsi_dcs_backlight.c b/drivers/gpu/drm/i915/intel_dsi_dcs_backlight.c
index 6e09ceb71500..150a156f3b1e 100644
--- a/drivers/gpu/drm/i915/intel_dsi_dcs_backlight.c
+++ b/drivers/gpu/drm/i915/intel_dsi_dcs_backlight.c
@@ -46,7 +46,7 @@ static u32 dcs_get_backlight(struct intel_connector *connector)
         struct intel_encoder *encoder = connector->encoder;
         struct intel_dsi *intel_dsi = enc_to_intel_dsi(&encoder->base);
         struct mipi_dsi_device *dsi_device;
-        u8 data;
+        u8 data = 0;
         enum port port;
 
         /* FIXME: Need to take care of 16 bit brightness level */
diff --git a/drivers/gpu/drm/i915/intel_dsi_vbt.c b/drivers/gpu/drm/i915/intel_dsi_vbt.c
index 7158c7ce9c09..91c07b0c8db9 100644
--- a/drivers/gpu/drm/i915/intel_dsi_vbt.c
+++ b/drivers/gpu/drm/i915/intel_dsi_vbt.c
@@ -306,7 +306,7 @@ static void bxt_exec_gpio(struct drm_i915_private *dev_priv,
 
         if (!gpio_desc) {
                 gpio_desc = devm_gpiod_get_index(dev_priv->drm.dev,
-                                                 "panel", gpio_index,
+                                                 NULL, gpio_index,
                                                  value ? GPIOD_OUT_LOW :
                                                  GPIOD_OUT_HIGH);
 
diff --git a/drivers/gpu/drm/i915/intel_gvt.c b/drivers/gpu/drm/i915/intel_gvt.c
index 52d5b82790d9..c17ed0e62b67 100644
--- a/drivers/gpu/drm/i915/intel_gvt.c
+++ b/drivers/gpu/drm/i915/intel_gvt.c
@@ -45,7 +45,7 @@ static bool is_supported_device(struct drm_i915_private *dev_priv)
                 return true;
         if (IS_SKYLAKE(dev_priv))
                 return true;
-        if (IS_KABYLAKE(dev_priv) && INTEL_DEVID(dev_priv) == 0x591D)
+        if (IS_KABYLAKE(dev_priv))
                 return true;
         return false;
 }
diff --git a/drivers/gpu/drm/i915/intel_lrc.c b/drivers/gpu/drm/i915/intel_lrc.c
index 7404cf2aac28..2afa4daa88e8 100644
--- a/drivers/gpu/drm/i915/intel_lrc.c
+++ b/drivers/gpu/drm/i915/intel_lrc.c
@@ -1221,6 +1221,14 @@ static int intel_init_workaround_bb(struct intel_engine_cs *engine)
         return ret;
 }
 
+static u8 gtiir[] = {
+        [RCS] = 0,
+        [BCS] = 0,
+        [VCS] = 1,
+        [VCS2] = 1,
+        [VECS] = 3,
+};
+
 static int gen8_init_common_ring(struct intel_engine_cs *engine)
 {
         struct drm_i915_private *dev_priv = engine->i915;
@@ -1245,9 +1253,22 @@ static int gen8_init_common_ring(struct intel_engine_cs *engine)
 
         DRM_DEBUG_DRIVER("Execlists enabled for %s\n", engine->name);
 
-        /* After a GPU reset, we may have requests to replay */
+        GEM_BUG_ON(engine->id >= ARRAY_SIZE(gtiir));
+
+        /*
+         * Clear any pending interrupt state.
+         *
+         * We do it twice out of paranoia that some of the IIR are double
+         * buffered, and if we only reset it once there may still be
+         * an interrupt pending.
+         */
+        I915_WRITE(GEN8_GT_IIR(gtiir[engine->id]),
+                   GT_CONTEXT_SWITCH_INTERRUPT << engine->irq_shift);
+        I915_WRITE(GEN8_GT_IIR(gtiir[engine->id]),
+                   GT_CONTEXT_SWITCH_INTERRUPT << engine->irq_shift);
         clear_bit(ENGINE_IRQ_EXECLIST, &engine->irq_posted);
 
+        /* After a GPU reset, we may have requests to replay */
         submit = false;
         for (n = 0; n < ARRAY_SIZE(engine->execlist_port); n++) {
                 if (!port_isset(&port[n]))
diff --git a/drivers/gpu/drm/i915/intel_lrc.h b/drivers/gpu/drm/i915/intel_lrc.h
index 52b3a1fd4059..57ef5833c427 100644
--- a/drivers/gpu/drm/i915/intel_lrc.h
+++ b/drivers/gpu/drm/i915/intel_lrc.h
@@ -63,7 +63,6 @@ enum {
 };
 
 /* Logical Rings */
-void intel_logical_ring_stop(struct intel_engine_cs *engine);
 void intel_logical_ring_cleanup(struct intel_engine_cs *engine);
 int logical_render_ring_init(struct intel_engine_cs *engine);
 int logical_xcs_ring_init(struct intel_engine_cs *engine);
diff --git a/drivers/gpu/drm/i915/intel_lspcon.c b/drivers/gpu/drm/i915/intel_lspcon.c
index 5abef482eacf..beb9baaf2f2e 100644
--- a/drivers/gpu/drm/i915/intel_lspcon.c
+++ b/drivers/gpu/drm/i915/intel_lspcon.c
@@ -210,8 +210,8 @@ bool lspcon_init(struct intel_digital_port *intel_dig_port)
         struct drm_device *dev = intel_dig_port->base.base.dev;
         struct drm_i915_private *dev_priv = to_i915(dev);
 
-        if (!IS_GEN9(dev_priv)) {
-                DRM_ERROR("LSPCON is supported on GEN9 only\n");
+        if (!HAS_LSPCON(dev_priv)) {
+                DRM_ERROR("LSPCON is not supported on this platform\n");
                 return false;
         }
 
diff --git a/drivers/gpu/drm/i915/intel_panel.c b/drivers/gpu/drm/i915/intel_panel.c
index 96c2cbd81869..593349be8b9d 100644
--- a/drivers/gpu/drm/i915/intel_panel.c
+++ b/drivers/gpu/drm/i915/intel_panel.c
@@ -469,7 +469,7 @@ static u32 intel_panel_compute_brightness(struct intel_connector *connector,
 
         if (i915.invert_brightness > 0 ||
             dev_priv->quirks & QUIRK_INVERT_BRIGHTNESS) {
-                return panel->backlight.max - val;
+                return panel->backlight.max - val + panel->backlight.min;
         }
 
         return val;
diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index 48ea0fca1f72..40b224b44d1b 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -4463,8 +4463,8 @@ static int skl_compute_plane_wm(const struct drm_i915_private *dev_priv,
                 if ((cpp * cstate->base.adjusted_mode.crtc_htotal / 512 < 1) &&
                     (plane_bytes_per_line / 512 < 1))
                         selected_result = method2;
-                else if ((ddb_allocation && ddb_allocation /
-                        fixed_16_16_to_u32_round_up(plane_blocks_per_line)) >= 1)
+                else if (ddb_allocation >=
+                         fixed_16_16_to_u32_round_up(plane_blocks_per_line))
                         selected_result = min_fixed_16_16(method1, method2);
                 else if (latency >= linetime_us)
                         selected_result = min_fixed_16_16(method1, method2);
diff --git a/drivers/gpu/drm/i915/selftests/mock_gem_device.c b/drivers/gpu/drm/i915/selftests/mock_gem_device.c
index 627e2aa09766..8cdec455cf7d 100644
--- a/drivers/gpu/drm/i915/selftests/mock_gem_device.c
+++ b/drivers/gpu/drm/i915/selftests/mock_gem_device.c
@@ -206,7 +206,7 @@ struct drm_i915_private *mock_gem_device(void)
         mkwrite_device_info(i915)->ring_mask = BIT(0);
         i915->engine[RCS] = mock_engine(i915, "mock");
         if (!i915->engine[RCS])
-                goto err_dependencies;
+                goto err_priorities;
 
         i915->kernel_context = mock_context(i915, NULL);
         if (!i915->kernel_context)
diff --git a/drivers/gpu/drm/imx/ipuv3-plane.c b/drivers/gpu/drm/imx/ipuv3-plane.c
index 6276bb834b4f..d3845989a29d 100644
--- a/drivers/gpu/drm/imx/ipuv3-plane.c
+++ b/drivers/gpu/drm/imx/ipuv3-plane.c
@@ -545,15 +545,13 @@ static void ipu_plane_atomic_update(struct drm_plane *plane,
                 return;
         }
 
+        ics = ipu_drm_fourcc_to_colorspace(fb->format->format);
         switch (ipu_plane->dp_flow) {
         case IPU_DP_FLOW_SYNC_BG:
-                ipu_dp_setup_channel(ipu_plane->dp,
-                                        IPUV3_COLORSPACE_RGB,
-                                        IPUV3_COLORSPACE_RGB);
+                ipu_dp_setup_channel(ipu_plane->dp, ics, IPUV3_COLORSPACE_RGB);
                 ipu_dp_set_global_alpha(ipu_plane->dp, true, 0, true);
                 break;
         case IPU_DP_FLOW_SYNC_FG:
-                ics = ipu_drm_fourcc_to_colorspace(state->fb->format->format);
                 ipu_dp_setup_channel(ipu_plane->dp, ics,
                                         IPUV3_COLORSPACE_UNKNOWN);
                 /* Enable local alpha on partial plane */
diff --git a/drivers/gpu/drm/msm/Kconfig b/drivers/gpu/drm/msm/Kconfig
index b638d192ce5e..99d39b2aefa6 100644
--- a/drivers/gpu/drm/msm/Kconfig
+++ b/drivers/gpu/drm/msm/Kconfig
@@ -5,7 +5,7 @@ config DRM_MSM
         depends on ARCH_QCOM || (ARM && COMPILE_TEST)
         depends on OF && COMMON_CLK
         depends on MMU
-        select QCOM_MDT_LOADER
+        select QCOM_MDT_LOADER if ARCH_QCOM
         select REGULATOR
         select DRM_KMS_HELPER
         select DRM_PANEL
diff --git a/drivers/gpu/drm/msm/adreno/a5xx_gpu.c b/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
index b4b54f1c24bc..f9eae03aa1dc 100644
--- a/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
+++ b/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
@@ -15,7 +15,7 @@
 #include <linux/cpumask.h>
 #include <linux/qcom_scm.h>
 #include <linux/dma-mapping.h>
-#include <linux/of_reserved_mem.h>
+#include <linux/of_address.h>
 #include <linux/soc/qcom/mdt_loader.h>
 #include "msm_gem.h"
 #include "msm_mmu.h"
@@ -26,16 +26,34 @@ static void a5xx_dump(struct msm_gpu *gpu);
 
 #define GPU_PAS_ID 13
 
-#if IS_ENABLED(CONFIG_QCOM_MDT_LOADER)
-
 static int zap_shader_load_mdt(struct device *dev, const char *fwname)
 {
         const struct firmware *fw;
+        struct device_node *np;
+        struct resource r;
         phys_addr_t mem_phys;
         ssize_t mem_size;
         void *mem_region = NULL;
         int ret;
 
+        if (!IS_ENABLED(CONFIG_ARCH_QCOM))
+                return -EINVAL;
+
+        np = of_get_child_by_name(dev->of_node, "zap-shader");
+        if (!np)
+                return -ENODEV;
+
+        np = of_parse_phandle(np, "memory-region", 0);
+        if (!np)
+                return -EINVAL;
+
+        ret = of_address_to_resource(np, 0, &r);
+        if (ret)
+                return ret;
+
+        mem_phys = r.start;
+        mem_size = resource_size(&r);
+
         /* Request the MDT file for the firmware */
         ret = request_firmware(&fw, fwname, dev);
         if (ret) {
@@ -51,7 +69,7 @@ static int zap_shader_load_mdt(struct device *dev, const char *fwname)
         }
 
         /* Allocate memory for the firmware image */
-        mem_region = dmam_alloc_coherent(dev, mem_size, &mem_phys, GFP_KERNEL);
+        mem_region = memremap(mem_phys, mem_size,  MEMREMAP_WC);
         if (!mem_region) {
                 ret = -ENOMEM;
                 goto out;
@@ -69,16 +87,13 @@ static int zap_shader_load_mdt(struct device *dev, const char *fwname)
                 DRM_DEV_ERROR(dev, "Unable to authorize the image\n");
 
 out:
+        if (mem_region)
+                memunmap(mem_region);
+
         release_firmware(fw);
 
         return ret;
 }
-#else
-static int zap_shader_load_mdt(struct device *dev, const char *fwname)
-{
-        return -ENODEV;
-}
-#endif
 
 static void a5xx_submit(struct msm_gpu *gpu, struct msm_gem_submit *submit,
         struct msm_file_private *ctx)
@@ -117,12 +132,10 @@ static void a5xx_submit(struct msm_gpu *gpu, struct msm_gem_submit *submit,
         gpu->funcs->flush(gpu);
 }
 
-struct a5xx_hwcg {
+static const struct {
         u32 offset;
         u32 value;
-};
-
-static const struct a5xx_hwcg a530_hwcg[] = {
+} a5xx_hwcg[] = {
         {REG_A5XX_RBBM_CLOCK_CNTL_SP0, 0x02222222},
         {REG_A5XX_RBBM_CLOCK_CNTL_SP1, 0x02222222},
         {REG_A5XX_RBBM_CLOCK_CNTL_SP2, 0x02222222},
@@ -217,38 +230,16 @@ static const struct a5xx_hwcg a530_hwcg[] = {
         {REG_A5XX_RBBM_CLOCK_DELAY_VFD, 0x00002222}
 };
 
-static const struct {
-        int (*test)(struct adreno_gpu *gpu);
-        const struct a5xx_hwcg *regs;
-        unsigned int count;
-} a5xx_hwcg_regs[] = {
-        { adreno_is_a530, a530_hwcg, ARRAY_SIZE(a530_hwcg), },
-};
-
-static void _a5xx_enable_hwcg(struct msm_gpu *gpu,
-                const struct a5xx_hwcg *regs, unsigned int count)
+void a5xx_set_hwcg(struct msm_gpu *gpu, bool state)
 {
         unsigned int i;
 
-        for (i = 0; i < count; i++)
-                gpu_write(gpu, regs[i].offset, regs[i].value);
+        for (i = 0; i < ARRAY_SIZE(a5xx_hwcg); i++)
+                gpu_write(gpu, a5xx_hwcg[i].offset,
+                        state ? a5xx_hwcg[i].value : 0);
 
-        gpu_write(gpu, REG_A5XX_RBBM_CLOCK_CNTL, 0xAAA8AA00);
-        gpu_write(gpu, REG_A5XX_RBBM_ISDB_CNT, 0x182);
-}
-
-static void a5xx_enable_hwcg(struct msm_gpu *gpu)
-{
-        struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
-        unsigned int i;
-
-        for (i = 0; i < ARRAY_SIZE(a5xx_hwcg_regs); i++) {
-                if (a5xx_hwcg_regs[i].test(adreno_gpu)) {
-                        _a5xx_enable_hwcg(gpu, a5xx_hwcg_regs[i].regs,
-                                a5xx_hwcg_regs[i].count);
-                        return;
-                }
-        }
+        gpu_write(gpu, REG_A5XX_RBBM_CLOCK_CNTL, state ? 0xAAA8AA00 : 0);
+        gpu_write(gpu, REG_A5XX_RBBM_ISDB_CNT, state ? 0x182 : 0x180);
 }
 
 static int a5xx_me_init(struct msm_gpu *gpu)
@@ -377,45 +368,6 @@ static int a5xx_zap_shader_resume(struct msm_gpu *gpu)
         return ret;
 }
 
-/* Set up a child device to "own" the zap shader */
-static int a5xx_zap_shader_dev_init(struct device *parent, struct device *dev)
-{
-        struct device_node *node;
-        int ret;
-
-        if (dev->parent)
-                return 0;
-
-        /* Find the sub-node for the zap shader */
-        node = of_get_child_by_name(parent->of_node, "zap-shader");
-        if (!node) {
-                DRM_DEV_ERROR(parent, "zap-shader not found in device tree\n");
-                return -ENODEV;
-        }
-
-        dev->parent = parent;
-        dev->of_node = node;
-        dev_set_name(dev, "adreno_zap_shader");
-
-        ret = device_register(dev);
-        if (ret) {
-                DRM_DEV_ERROR(parent, "Couldn't register zap shader device\n");
-                goto out;
-        }
-
-        ret = of_reserved_mem_device_init(dev);
-        if (ret) {
-                DRM_DEV_ERROR(parent, "Unable to set up the reserved memory\n");
-                device_unregister(dev);
-        }
-
-out:
-        if (ret)
-                dev->parent = NULL;
-
-        return ret;
-}
-
 static int a5xx_zap_shader_init(struct msm_gpu *gpu)
 {
         static bool loaded;
@@ -444,11 +396,7 @@ static int a5xx_zap_shader_init(struct msm_gpu *gpu)
                 return -ENODEV;
         }
 
-        ret = a5xx_zap_shader_dev_init(&pdev->dev, &a5xx_gpu->zap_dev);
-
-        if (!ret)
-                ret = zap_shader_load_mdt(&a5xx_gpu->zap_dev,
-                        adreno_gpu->info->zapfw);
+        ret = zap_shader_load_mdt(&pdev->dev, adreno_gpu->info->zapfw);
 
         loaded = !ret;
 
@@ -545,7 +493,7 @@ static int a5xx_hw_init(struct msm_gpu *gpu)
         gpu_write(gpu, REG_A5XX_RBBM_AHB_CNTL1, 0xA6FFFFFF);
 
         /* Enable HWCG */
-        a5xx_enable_hwcg(gpu);
+        a5xx_set_hwcg(gpu, true);
 
         gpu_write(gpu, REG_A5XX_RBBM_AHB_CNTL2, 0x0000003F);
 
@@ -691,9 +639,6 @@ static void a5xx_destroy(struct msm_gpu *gpu)
 
         DBG("%s", gpu->name);
 
-        if (a5xx_gpu->zap_dev.parent)
-                device_unregister(&a5xx_gpu->zap_dev);
-
         if (a5xx_gpu->pm4_bo) {
                 if (a5xx_gpu->pm4_iova)
                         msm_gem_put_iova(a5xx_gpu->pm4_bo, gpu->aspace);
@@ -920,31 +865,30 @@ static const u32 a5xx_registers[] = {
         0x0000, 0x0002, 0x0004, 0x0020, 0x0022, 0x0026, 0x0029, 0x002B,
         0x002E, 0x0035, 0x0038, 0x0042, 0x0044, 0x0044, 0x0047, 0x0095,
         0x0097, 0x00BB, 0x03A0, 0x0464, 0x0469, 0x046F, 0x04D2, 0x04D3,
-        0x04E0, 0x0533, 0x0540, 0x0555, 0xF400, 0xF400, 0xF800, 0xF807,
-        0x0800, 0x081A, 0x081F, 0x0841, 0x0860, 0x0860, 0x0880, 0x08A0,
-        0x0B00, 0x0B12, 0x0B15, 0x0B28, 0x0B78, 0x0B7F, 0x0BB0, 0x0BBD,
-        0x0BC0, 0x0BC6, 0x0BD0, 0x0C53, 0x0C60, 0x0C61, 0x0C80, 0x0C82,
-        0x0C84, 0x0C85, 0x0C90, 0x0C98, 0x0CA0, 0x0CA0, 0x0CB0, 0x0CB2,
-        0x2180, 0x2185, 0x2580, 0x2585, 0x0CC1, 0x0CC1, 0x0CC4, 0x0CC7,
-        0x0CCC, 0x0CCC, 0x0CD0, 0x0CD8, 0x0CE0, 0x0CE5, 0x0CE8, 0x0CE8,
-        0x0CEC, 0x0CF1, 0x0CFB, 0x0D0E, 0x2100, 0x211E, 0x2140, 0x2145,
-        0x2500, 0x251E, 0x2540, 0x2545, 0x0D10, 0x0D17, 0x0D20, 0x0D23,
-        0x0D30, 0x0D30, 0x20C0, 0x20C0, 0x24C0, 0x24C0, 0x0E40, 0x0E43,
-        0x0E4A, 0x0E4A, 0x0E50, 0x0E57, 0x0E60, 0x0E7C, 0x0E80, 0x0E8E,
-        0x0E90, 0x0E96, 0x0EA0, 0x0EA8, 0x0EB0, 0x0EB2, 0xE140, 0xE147,
-        0xE150, 0xE187, 0xE1A0, 0xE1A9, 0xE1B0, 0xE1B6, 0xE1C0, 0xE1C7,
-        0xE1D0, 0xE1D1, 0xE200, 0xE201, 0xE210, 0xE21C, 0xE240, 0xE268,
-        0xE000, 0xE006, 0xE010, 0xE09A, 0xE0A0, 0xE0A4, 0xE0AA, 0xE0EB,
-        0xE100, 0xE105, 0xE380, 0xE38F, 0xE3B0, 0xE3B0, 0xE400, 0xE405,
-        0xE408, 0xE4E9, 0xE4F0, 0xE4F0, 0xE280, 0xE280, 0xE282, 0xE2A3,
-        0xE2A5, 0xE2C2, 0xE940, 0xE947, 0xE950, 0xE987, 0xE9A0, 0xE9A9,
-        0xE9B0, 0xE9B6, 0xE9C0, 0xE9C7, 0xE9D0, 0xE9D1, 0xEA00, 0xEA01,
-        0xEA10, 0xEA1C, 0xEA40, 0xEA68, 0xE800, 0xE806, 0xE810, 0xE89A,
-        0xE8A0, 0xE8A4, 0xE8AA, 0xE8EB, 0xE900, 0xE905, 0xEB80, 0xEB8F,
-        0xEBB0, 0xEBB0, 0xEC00, 0xEC05, 0xEC08, 0xECE9, 0xECF0, 0xECF0,
-        0xEA80, 0xEA80, 0xEA82, 0xEAA3, 0xEAA5, 0xEAC2, 0xA800, 0xA8FF,
-        0xAC60, 0xAC60, 0xB000, 0xB97F, 0xB9A0, 0xB9BF,
-        ~0
+        0x04E0, 0x0533, 0x0540, 0x0555, 0x0800, 0x081A, 0x081F, 0x0841,
+        0x0860, 0x0860, 0x0880, 0x08A0, 0x0B00, 0x0B12, 0x0B15, 0x0B28,
+        0x0B78, 0x0B7F, 0x0BB0, 0x0BBD, 0x0BC0, 0x0BC6, 0x0BD0, 0x0C53,
+        0x0C60, 0x0C61, 0x0C80, 0x0C82, 0x0C84, 0x0C85, 0x0C90, 0x0C98,
+        0x0CA0, 0x0CA0, 0x0CB0, 0x0CB2, 0x2180, 0x2185, 0x2580, 0x2585,
+        0x0CC1, 0x0CC1, 0x0CC4, 0x0CC7, 0x0CCC, 0x0CCC, 0x0CD0, 0x0CD8,
+        0x0CE0, 0x0CE5, 0x0CE8, 0x0CE8, 0x0CEC, 0x0CF1, 0x0CFB, 0x0D0E,
+        0x2100, 0x211E, 0x2140, 0x2145, 0x2500, 0x251E, 0x2540, 0x2545,
+        0x0D10, 0x0D17, 0x0D20, 0x0D23, 0x0D30, 0x0D30, 0x20C0, 0x20C0,
+        0x24C0, 0x24C0, 0x0E40, 0x0E43, 0x0E4A, 0x0E4A, 0x0E50, 0x0E57,
+        0x0E60, 0x0E7C, 0x0E80, 0x0E8E, 0x0E90, 0x0E96, 0x0EA0, 0x0EA8,
+        0x0EB0, 0x0EB2, 0xE140, 0xE147, 0xE150, 0xE187, 0xE1A0, 0xE1A9,
+        0xE1B0, 0xE1B6, 0xE1C0, 0xE1C7, 0xE1D0, 0xE1D1, 0xE200, 0xE201,
+        0xE210, 0xE21C, 0xE240, 0xE268, 0xE000, 0xE006, 0xE010, 0xE09A,
+        0xE0A0, 0xE0A4, 0xE0AA, 0xE0EB, 0xE100, 0xE105, 0xE380, 0xE38F,
+        0xE3B0, 0xE3B0, 0xE400, 0xE405, 0xE408, 0xE4E9, 0xE4F0, 0xE4F0,
+        0xE280, 0xE280, 0xE282, 0xE2A3, 0xE2A5, 0xE2C2, 0xE940, 0xE947,
+        0xE950, 0xE987, 0xE9A0, 0xE9A9, 0xE9B0, 0xE9B6, 0xE9C0, 0xE9C7,
+        0xE9D0, 0xE9D1, 0xEA00, 0xEA01, 0xEA10, 0xEA1C, 0xEA40, 0xEA68,
+        0xE800, 0xE806, 0xE810, 0xE89A, 0xE8A0, 0xE8A4, 0xE8AA, 0xE8EB,
+        0xE900, 0xE905, 0xEB80, 0xEB8F, 0xEBB0, 0xEBB0, 0xEC00, 0xEC05,
+        0xEC08, 0xECE9, 0xECF0, 0xECF0, 0xEA80, 0xEA80, 0xEA82, 0xEAA3,
+        0xEAA5, 0xEAC2, 0xA800, 0xA8FF, 0xAC60, 0xAC60, 0xB000, 0xB97F,
+        0xB9A0, 0xB9BF, ~0
 };
 
 static void a5xx_dump(struct msm_gpu *gpu)
@@ -1020,7 +964,14 @@ static void a5xx_show(struct msm_gpu *gpu, struct seq_file *m)
 {
         seq_printf(m, "status:   %08x\n",
                         gpu_read(gpu, REG_A5XX_RBBM_STATUS));
+
+        /*
+         * Temporarily disable hardware clock gating before going into
+         * adreno_show to avoid issues while reading the registers
+         */
+        a5xx_set_hwcg(gpu, false);
         adreno_show(gpu, m);
+        a5xx_set_hwcg(gpu, true);
 }
 #endif
 
diff --git a/drivers/gpu/drm/msm/adreno/a5xx_gpu.h b/drivers/gpu/drm/msm/adreno/a5xx_gpu.h
index 6638bc85645d..1137092241d5 100644
--- a/drivers/gpu/drm/msm/adreno/a5xx_gpu.h
+++ b/drivers/gpu/drm/msm/adreno/a5xx_gpu.h
@@ -36,8 +36,6 @@ struct a5xx_gpu {
         uint32_t gpmu_dwords;
 
         uint32_t lm_leakage;
-
-        struct device zap_dev;
 };
 
 #define to_a5xx_gpu(x) container_of(x, struct a5xx_gpu, base)
@@ -59,5 +57,6 @@ static inline int spin_usecs(struct msm_gpu *gpu, uint32_t usecs,
 }
 
 bool a5xx_idle(struct msm_gpu *gpu);
+void a5xx_set_hwcg(struct msm_gpu *gpu, bool state);
 
 #endif /* __A5XX_GPU_H__ */
diff --git a/drivers/gpu/drm/msm/adreno/adreno_gpu.c b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
index f1ab2703674a..7414c6bbd582 100644
--- a/drivers/gpu/drm/msm/adreno/adreno_gpu.c
+++ b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
@@ -48,8 +48,15 @@ int adreno_get_param(struct msm_gpu *gpu, uint32_t param, uint64_t *value)
                 *value = adreno_gpu->base.fast_rate;
                 return 0;
         case MSM_PARAM_TIMESTAMP:
-                if (adreno_gpu->funcs->get_timestamp)
-                        return adreno_gpu->funcs->get_timestamp(gpu, value);
+                if (adreno_gpu->funcs->get_timestamp) {
+                        int ret;
+
+                        pm_runtime_get_sync(&gpu->pdev->dev);
+                        ret = adreno_gpu->funcs->get_timestamp(gpu, value);
+                        pm_runtime_put_autosuspend(&gpu->pdev->dev);
+
+                        return ret;
+                }
                 return -EINVAL;
         default:
                 DBG("%s: invalid param: %u", gpu->name, param);
diff --git a/drivers/gpu/drm/msm/dsi/dsi_host.c b/drivers/gpu/drm/msm/dsi/dsi_host.c
index 9e9c5696bc03..c7b612c3d771 100644
--- a/drivers/gpu/drm/msm/dsi/dsi_host.c
+++ b/drivers/gpu/drm/msm/dsi/dsi_host.c
@@ -2137,6 +2137,13 @@ void msm_dsi_host_get_phy_clk_req(struct mipi_dsi_host *host,
         struct msm_dsi_phy_clk_request *clk_req)
 {
         struct msm_dsi_host *msm_host = to_msm_dsi_host(host);
+        int ret;
+
+        ret = dsi_calc_clk_rate(msm_host);
+        if (ret) {
+                pr_err("%s: unable to calc clk rate, %d\n", __func__, ret);
+                return;
+        }
 
         clk_req->bitclk_rate = msm_host->byte_clk_rate * 8;
         clk_req->escclk_rate = msm_host->esc_clk_rate;
@@ -2280,7 +2287,6 @@ int msm_dsi_host_set_display_mode(struct mipi_dsi_host *host,
                                         struct drm_display_mode *mode)
 {
         struct msm_dsi_host *msm_host = to_msm_dsi_host(host);
-        int ret;
 
         if (msm_host->mode) {
                 drm_mode_destroy(msm_host->dev, msm_host->mode);
@@ -2293,12 +2299,6 @@ int msm_dsi_host_set_display_mode(struct mipi_dsi_host *host,
                 return -ENOMEM;
         }
 
-        ret = dsi_calc_clk_rate(msm_host);
-        if (ret) {
-                pr_err("%s: unable to calc clk rate, %d\n", __func__, ret);
-                return ret;
-        }
-
         return 0;
 }
 
diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_crtc.c b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_crtc.c
index cb5415d6c04b..735a87a699fa 100644
--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_crtc.c
+++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_crtc.c
@@ -221,8 +221,8 @@ static void blend_setup(struct drm_crtc *crtc)
         struct mdp5_ctl *ctl = mdp5_cstate->ctl;
         uint32_t blend_op, fg_alpha, bg_alpha, ctl_blend_flags = 0;
         unsigned long flags;
-        enum mdp5_pipe stage[STAGE_MAX + 1][MAX_PIPE_STAGE] = { SSPP_NONE };
-        enum mdp5_pipe r_stage[STAGE_MAX + 1][MAX_PIPE_STAGE] = { SSPP_NONE };
+        enum mdp5_pipe stage[STAGE_MAX + 1][MAX_PIPE_STAGE] = { { SSPP_NONE } };
+        enum mdp5_pipe r_stage[STAGE_MAX + 1][MAX_PIPE_STAGE] = { { SSPP_NONE } };
         int i, plane_cnt = 0;
         bool bg_alpha_enabled = false;
         u32 mixer_op_mode = 0;
@@ -753,6 +753,7 @@ static int mdp5_crtc_cursor_set(struct drm_crtc *crtc,
         if (!handle) {
                 DBG("Cursor off");
                 cursor_enable = false;
+                mdp5_enable(mdp5_kms);
                 goto set_cursor;
         }
 
@@ -776,6 +777,8 @@ static int mdp5_crtc_cursor_set(struct drm_crtc *crtc,
 
         get_roi(crtc, &roi_w, &roi_h);
 
+        mdp5_enable(mdp5_kms);
+
         mdp5_write(mdp5_kms, REG_MDP5_LM_CURSOR_STRIDE(lm), stride);
         mdp5_write(mdp5_kms, REG_MDP5_LM_CURSOR_FORMAT(lm),
                         MDP5_LM_CURSOR_FORMAT_FORMAT(CURSOR_FMT_ARGB8888));
@@ -804,6 +807,7 @@ set_cursor:
         crtc_flush(crtc, flush_mask);
 
 end:
+        mdp5_disable(mdp5_kms);
         if (old_bo) {
                 drm_flip_work_queue(&mdp5_crtc->unref_cursor_work, old_bo);
                 /* enable vblank to complete cursor work: */
@@ -836,6 +840,8 @@ static int mdp5_crtc_cursor_move(struct drm_crtc *crtc, int x, int y)
 
         get_roi(crtc, &roi_w, &roi_h);
 
+        mdp5_enable(mdp5_kms);
+
         spin_lock_irqsave(&mdp5_crtc->cursor.lock, flags);
         mdp5_write(mdp5_kms, REG_MDP5_LM_CURSOR_SIZE(lm),
                         MDP5_LM_CURSOR_SIZE_ROI_H(roi_h) |
@@ -847,6 +853,8 @@ static int mdp5_crtc_cursor_move(struct drm_crtc *crtc, int x, int y)
 
         crtc_flush(crtc, flush_mask);
 
+        mdp5_disable(mdp5_kms);
+
         return 0;
 }
 
diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_encoder.c b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_encoder.c
index 97f3294fbfc6..70bef51245af 100644
--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_encoder.c
+++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_encoder.c
@@ -299,7 +299,7 @@ static void mdp5_encoder_enable(struct drm_encoder *encoder)
         struct mdp5_interface *intf = mdp5_encoder->intf;
 
         if (intf->mode == MDP5_INTF_DSI_MODE_COMMAND)
-                mdp5_cmd_encoder_disable(encoder);
+                mdp5_cmd_encoder_enable(encoder);
         else
                 mdp5_vid_encoder_enable(encoder);
 }
diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.c b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.c
index 5d13fa5381ee..1c603aef3c59 100644
--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.c
+++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.c
@@ -502,7 +502,7 @@ static int get_clk(struct platform_device *pdev, struct clk **clkp,
                 const char *name, bool mandatory)
 {
         struct device *dev = &pdev->dev;
-        struct clk *clk = devm_clk_get(dev, name);
+        struct clk *clk = msm_clk_get(pdev, name);
         if (IS_ERR(clk) && mandatory) {
                 dev_err(dev, "failed to get %s (%ld)\n", name, PTR_ERR(clk));
                 return PTR_ERR(clk);
@@ -887,21 +887,21 @@ static int mdp5_init(struct platform_device *pdev, struct drm_device *dev)
         }
 
         /* mandatory clocks: */
-        ret = get_clk(pdev, &mdp5_kms->axi_clk, "bus_clk", true);
+        ret = get_clk(pdev, &mdp5_kms->axi_clk, "bus", true);
         if (ret)
                 goto fail;
-        ret = get_clk(pdev, &mdp5_kms->ahb_clk, "iface_clk", true);
+        ret = get_clk(pdev, &mdp5_kms->ahb_clk, "iface", true);
         if (ret)
                 goto fail;
-        ret = get_clk(pdev, &mdp5_kms->core_clk, "core_clk", true);
+        ret = get_clk(pdev, &mdp5_kms->core_clk, "core", true);
         if (ret)
                 goto fail;
-        ret = get_clk(pdev, &mdp5_kms->vsync_clk, "vsync_clk", true);
+        ret = get_clk(pdev, &mdp5_kms->vsync_clk, "vsync", true);
         if (ret)
                 goto fail;
 
         /* optional clocks: */
-        get_clk(pdev, &mdp5_kms->lut_clk, "lut_clk", false);
+        get_clk(pdev, &mdp5_kms->lut_clk, "lut", false);
 
         /* we need to set a default rate before enabling.  Set a safe
          * rate first, then figure out hw revision, and then set a
diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_plane.c b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_plane.c
index fe3a4de1a433..61f39c86dd09 100644
--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_plane.c
+++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_plane.c
@@ -890,8 +890,8 @@ static int mdp5_plane_mode_set(struct drm_plane *plane,
         struct mdp5_hw_pipe *right_hwpipe;
         const struct mdp_format *format;
         uint32_t nplanes, config = 0;
-        struct phase_step step = { 0 };
-        struct pixel_ext pe = { 0 };
+        struct phase_step step = { { 0 } };
+        struct pixel_ext pe = { { 0 } };
         uint32_t hdecm = 0, vdecm = 0;
         uint32_t pix_format;
         unsigned int rotation;
diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c
index 65f35544c1ec..a0c60e738db8 100644
--- a/drivers/gpu/drm/msm/msm_gem.c
+++ b/drivers/gpu/drm/msm/msm_gem.c
@@ -383,8 +383,10 @@ int msm_gem_get_iova(struct drm_gem_object *obj,
                 struct page **pages;
 
                 vma = add_vma(obj, aspace);
-                if (IS_ERR(vma))
-                        return PTR_ERR(vma);
+                if (IS_ERR(vma)) {
+                        ret = PTR_ERR(vma);
+                        goto unlock;
+                }
 
                 pages = get_pages(obj);
                 if (IS_ERR(pages)) {
@@ -405,7 +407,7 @@ int msm_gem_get_iova(struct drm_gem_object *obj,
 
 fail:
         del_vma(vma);
-
+unlock:
         mutex_unlock(&msm_obj->lock);
         return ret;
 }
@@ -928,8 +930,12 @@ static struct drm_gem_object *_msm_gem_new(struct drm_device *dev,
         if (use_vram) {
                 struct msm_gem_vma *vma;
                 struct page **pages;
+                struct msm_gem_object *msm_obj = to_msm_bo(obj);
+
+                mutex_lock(&msm_obj->lock);
 
                 vma = add_vma(obj, NULL);
+                mutex_unlock(&msm_obj->lock);
                 if (IS_ERR(vma)) {
                         ret = PTR_ERR(vma);
                         goto fail;
diff --git a/drivers/gpu/drm/msm/msm_gem_submit.c b/drivers/gpu/drm/msm/msm_gem_submit.c
index 6bfca7470141..8a75c0bd8a78 100644
--- a/drivers/gpu/drm/msm/msm_gem_submit.c
+++ b/drivers/gpu/drm/msm/msm_gem_submit.c
@@ -34,8 +34,8 @@ static struct msm_gem_submit *submit_create(struct drm_device *dev,
                 struct msm_gpu *gpu, uint32_t nr_bos, uint32_t nr_cmds)
 {
         struct msm_gem_submit *submit;
-        uint64_t sz = sizeof(*submit) + (nr_bos * sizeof(submit->bos[0])) +
-                (nr_cmds * sizeof(submit->cmd[0]));
+        uint64_t sz = sizeof(*submit) + ((u64)nr_bos * sizeof(submit->bos[0])) +
+                ((u64)nr_cmds * sizeof(submit->cmd[0]));
 
         if (sz > SIZE_MAX)
                 return NULL;
@@ -451,7 +451,7 @@ int msm_ioctl_gem_submit(struct drm_device *dev, void *data,
         if (ret)
                 goto out;
 
-        if (!(args->fence & MSM_SUBMIT_NO_IMPLICIT)) {
+        if (!(args->flags & MSM_SUBMIT_NO_IMPLICIT)) {
                 ret = submit_fence_sync(submit);
                 if (ret)
                         goto out;
diff --git a/drivers/gpu/drm/msm/msm_gem_vma.c b/drivers/gpu/drm/msm/msm_gem_vma.c
index c36321bc8714..d34e331554f3 100644
--- a/drivers/gpu/drm/msm/msm_gem_vma.c
+++ b/drivers/gpu/drm/msm/msm_gem_vma.c
@@ -42,7 +42,7 @@ void
 msm_gem_unmap_vma(struct msm_gem_address_space *aspace,
                 struct msm_gem_vma *vma, struct sg_table *sgt)
 {
-        if (!vma->iova)
+        if (!aspace || !vma->iova)
                 return;
 
         if (aspace->mmu) {
diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.c b/drivers/gpu/drm/nouveau/nouveau_connector.c
index 147b22163f9f..dab78c660dd6 100644
--- a/drivers/gpu/drm/nouveau/nouveau_connector.c
+++ b/drivers/gpu/drm/nouveau/nouveau_connector.c
@@ -1158,8 +1158,6 @@ nouveau_connector_aux_xfer(struct drm_dp_aux *obj, struct drm_dp_aux_msg *msg)
                 return -ENODEV;
         if (WARN_ON(msg->size > 16))
                 return -E2BIG;
-        if (msg->size == 0)
-                return msg->size;
 
         ret = nvkm_i2c_aux_acquire(aux);
         if (ret)
diff --git a/drivers/gpu/drm/nouveau/nouveau_display.c b/drivers/gpu/drm/nouveau/nouveau_display.c
index 8d1df5678eaa..f362c9fa8b3b 100644
--- a/drivers/gpu/drm/nouveau/nouveau_display.c
+++ b/drivers/gpu/drm/nouveau/nouveau_display.c
@@ -409,7 +409,6 @@ nouveau_display_fini(struct drm_device *dev, bool suspend)
         struct nouveau_display *disp = nouveau_display(dev);
         struct nouveau_drm *drm = nouveau_drm(dev);
         struct drm_connector *connector;
-        struct drm_crtc *crtc;
 
         if (!suspend) {
                 if (drm_drv_uses_atomic_modeset(dev))
@@ -418,10 +417,6 @@ nouveau_display_fini(struct drm_device *dev, bool suspend)
                         drm_crtc_force_disable_all(dev);
         }
 
-        /* Make sure that drm and hw vblank irqs get properly disabled. */
-        drm_for_each_crtc(crtc, dev)
-                drm_crtc_vblank_off(crtc);
-
         /* disable flip completion events */
         nvif_notify_put(&drm->flip);
 
diff --git a/drivers/gpu/drm/nouveau/nv50_display.c b/drivers/gpu/drm/nouveau/nv50_display.c
index e3132a2ce34d..2bc0dc985214 100644
--- a/drivers/gpu/drm/nouveau/nv50_display.c
+++ b/drivers/gpu/drm/nouveau/nv50_display.c
@@ -3674,15 +3674,24 @@ nv50_sor_create(struct drm_connector *connector, struct dcb_output *dcbe)
         drm_mode_connector_attach_encoder(connector, encoder);
 
         if (dcbe->type == DCB_OUTPUT_DP) {
+                struct nv50_disp *disp = nv50_disp(encoder->dev);
                 struct nvkm_i2c_aux *aux =
                         nvkm_i2c_aux_find(i2c, dcbe->i2c_index);
                 if (aux) {
-                        nv_encoder->i2c = &nv_connector->aux.ddc;
+                        if (disp->disp->oclass < GF110_DISP) {
+                                /* HW has no support for address-only
+                                 * transactions, so we're required to
+                                 * use custom I2C-over-AUX code.
+                                 */
+                                nv_encoder->i2c = &aux->i2c;
+                        } else {
+                                nv_encoder->i2c = &nv_connector->aux.ddc;
+                        }
                         nv_encoder->aux = aux;
                 }
 
                 /*TODO: Use DP Info Table to check for support. */
-                if (nv50_disp(encoder->dev)->disp->oclass >= GF110_DISP) {
+                if (disp->disp->oclass >= GF110_DISP) {
                         ret = nv50_mstm_new(nv_encoder, &nv_connector->aux, 16,
                                             nv_connector->base.base.id,
                                             &nv_encoder->dp.mstm);
@@ -3931,6 +3940,8 @@ nv50_disp_atomic_commit_tail(struct drm_atomic_state *state)
 
                 NV_ATOMIC(drm, "%s: clr %04x (set %04x)\n", crtc->name,
                           asyh->clr.mask, asyh->set.mask);
+                if (crtc_state->active && !asyh->state.active)
+                        drm_crtc_vblank_off(crtc);
 
                 if (asyh->clr.mask) {
                         nv50_head_flush_clr(head, asyh, atom->flush_disable);
@@ -4016,11 +4027,13 @@ nv50_disp_atomic_commit_tail(struct drm_atomic_state *state)
                         nv50_head_flush_set(head, asyh);
                         interlock_core = 1;
                 }
-        }
 
-        for_each_crtc_in_state(state, crtc, crtc_state, i) {
-                if (crtc->state->event)
-                        drm_crtc_vblank_get(crtc);
+                if (asyh->state.active) {
+                        if (!crtc_state->active)
+                                drm_crtc_vblank_on(crtc);
+                        if (asyh->state.event)
+                                drm_crtc_vblank_get(crtc);
+                }
         }
 
         /* Update plane(s). */
@@ -4067,12 +4080,14 @@ nv50_disp_atomic_commit_tail(struct drm_atomic_state *state)
                 if (crtc->state->event) {
                         unsigned long flags;
                         /* Get correct count/ts if racing with vblank irq */
-                        drm_accurate_vblank_count(crtc);
+                        if (crtc->state->active)
+                                drm_accurate_vblank_count(crtc);
                         spin_lock_irqsave(&crtc->dev->event_lock, flags);
                         drm_crtc_send_vblank_event(crtc, crtc->state->event);
                         spin_unlock_irqrestore(&crtc->dev->event_lock, flags);
                         crtc->state->event = NULL;
-                        drm_crtc_vblank_put(crtc);
+                        if (crtc->state->active)
+                                drm_crtc_vblank_put(crtc);
                 }
         }
 
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/base.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/base.c
index c7c84d34d97e..88582af8bd89 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/base.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/base.c
@@ -267,6 +267,8 @@ nvkm_disp_oneinit(struct nvkm_engine *engine)
         /* Create output path objects for each VBIOS display path. */
         i = -1;
         while ((data = dcb_outp_parse(bios, ++i, &ver, &hdr, &dcbE))) {
+                if (ver < 0x40) /* No support for chipsets prior to NV50. */
+                        break;
                 if (dcbE.type == DCB_OUTPUT_UNUSED)
                         continue;
                 if (dcbE.type == DCB_OUTPUT_EOL)
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/ior.h b/drivers/gpu/drm/nouveau/nvkm/engine/disp/ior.h
index a24312fb0228..a1e8bf48b778 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/ior.h
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/ior.h
@@ -22,6 +22,7 @@ struct nvkm_ior {
                 unsigned proto_evo:4;
                 enum nvkm_ior_proto {
                         CRT,
+                        TV,
                         TMDS,
                         LVDS,
                         DP,
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/nv50.h b/drivers/gpu/drm/nouveau/nvkm/engine/disp/nv50.h
index 19c635663399..6ea19466f436 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/nv50.h
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/nv50.h
@@ -22,7 +22,7 @@ struct nv50_disp {
                 u8 type[3];
         } pior;
 
-        struct nv50_disp_chan *chan[17];
+        struct nv50_disp_chan *chan[21];
 };
 
 void nv50_disp_super_1(struct nv50_disp *);
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.c
index 85aff85394ac..be9e7f8c3b23 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.c
@@ -62,6 +62,7 @@ nvkm_outp_xlat(struct nvkm_outp *outp, enum nvkm_ior_type *type)
         case 0:
                 switch (outp->info.type) {
                 case DCB_OUTPUT_ANALOG: *type = DAC; return  CRT;
+                case DCB_OUTPUT_TV    : *type = DAC; return   TV;
                 case DCB_OUTPUT_TMDS  : *type = SOR; return TMDS;
                 case DCB_OUTPUT_LVDS  : *type = SOR; return LVDS;
                 case DCB_OUTPUT_DP    : *type = SOR; return   DP;
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/bar/gf100.c b/drivers/gpu/drm/nouveau/nvkm/subdev/bar/gf100.c
index c794b2c2d21e..6d8f21290aa2 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/bar/gf100.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/bar/gf100.c
@@ -129,7 +129,7 @@ gf100_bar_init(struct nvkm_bar *base)
 
         if (bar->bar[0].mem) {
                 addr = nvkm_memory_addr(bar->bar[0].mem) >> 12;
-                nvkm_wr32(device, 0x001714, 0xc0000000 | addr);
+                nvkm_wr32(device, 0x001714, 0x80000000 | addr);
         }
 
         return 0;
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/Kbuild b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/Kbuild
index 48f01e40b8fc..b768e66a472b 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/Kbuild
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/Kbuild
@@ -25,6 +25,7 @@ nvkm-y += nvkm/subdev/i2c/bit.o
 
 nvkm-y += nvkm/subdev/i2c/aux.o
 nvkm-y += nvkm/subdev/i2c/auxg94.o
+nvkm-y += nvkm/subdev/i2c/auxgf119.o
 nvkm-y += nvkm/subdev/i2c/auxgm200.o
 
 nvkm-y += nvkm/subdev/i2c/anx9805.o
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/aux.c b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/aux.c
index d172e42dd228..4c1f547da463 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/aux.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/aux.c
@@ -117,6 +117,10 @@ int
 nvkm_i2c_aux_xfer(struct nvkm_i2c_aux *aux, bool retry, u8 type,
                   u32 addr, u8 *data, u8 *size)
 {
+        if (!*size && !aux->func->address_only) {
+                AUX_ERR(aux, "address-only transaction dropped");
+                return -ENOSYS;
+        }
         return aux->func->xfer(aux, retry, type, addr, data, size);
 }
 
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/aux.h b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/aux.h
index 27a4a39c87f0..9587ab456d9e 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/aux.h
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/aux.h
@@ -3,6 +3,7 @@
 #include "pad.h"
 
 struct nvkm_i2c_aux_func {
+        bool address_only;
         int  (*xfer)(struct nvkm_i2c_aux *, bool retry, u8 type,
                      u32 addr, u8 *data, u8 *size);
         int  (*lnk_ctl)(struct nvkm_i2c_aux *, int link_nr, int link_bw,
@@ -17,7 +18,12 @@ void nvkm_i2c_aux_del(struct nvkm_i2c_aux **);
 int nvkm_i2c_aux_xfer(struct nvkm_i2c_aux *, bool retry, u8 type,
                       u32 addr, u8 *data, u8 *size);
 
+int g94_i2c_aux_new_(const struct nvkm_i2c_aux_func *, struct nvkm_i2c_pad *,
+                     int, u8, struct nvkm_i2c_aux **);
+
 int g94_i2c_aux_new(struct nvkm_i2c_pad *, int, u8, struct nvkm_i2c_aux **);
+int g94_i2c_aux_xfer(struct nvkm_i2c_aux *, bool, u8, u32, u8 *, u8 *);
+int gf119_i2c_aux_new(struct nvkm_i2c_pad *, int, u8, struct nvkm_i2c_aux **);
 int gm200_i2c_aux_new(struct nvkm_i2c_pad *, int, u8, struct nvkm_i2c_aux **);
 
 #define AUX_MSG(b,l,f,a...) do {                                               \
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxg94.c b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxg94.c
index ab8cb196c34e..c8ab1b5741a3 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxg94.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxg94.c
@@ -72,7 +72,7 @@ g94_i2c_aux_init(struct g94_i2c_aux *aux)
         return 0;
 }
 
-static int
+int
 g94_i2c_aux_xfer(struct nvkm_i2c_aux *obj, bool retry,
                  u8 type, u32 addr, u8 *data, u8 *size)
 {
@@ -105,9 +105,9 @@ g94_i2c_aux_xfer(struct nvkm_i2c_aux *obj, bool retry,
         }
 
         ctrl  = nvkm_rd32(device, 0x00e4e4 + base);
-        ctrl &= ~0x0001f0ff;
+        ctrl &= ~0x0001f1ff;
         ctrl |= type << 12;
-        ctrl |= *size - 1;
+        ctrl |= (*size ? (*size - 1) : 0x00000100);
         nvkm_wr32(device, 0x00e4e0 + base, addr);
 
         /* (maybe) retry transaction a number of times on failure... */
@@ -160,14 +160,10 @@ out:
         return ret < 0 ? ret : (stat & 0x000f0000) >> 16;
 }
 
-static const struct nvkm_i2c_aux_func
-g94_i2c_aux_func = {
-        .xfer = g94_i2c_aux_xfer,
-};
-
 int
-g94_i2c_aux_new(struct nvkm_i2c_pad *pad, int index, u8 drive,
-                struct nvkm_i2c_aux **paux)
+g94_i2c_aux_new_(const struct nvkm_i2c_aux_func *func,
+                 struct nvkm_i2c_pad *pad, int index, u8 drive,
+                 struct nvkm_i2c_aux **paux)
 {
         struct g94_i2c_aux *aux;
 
@@ -175,8 +171,20 @@ g94_i2c_aux_new(struct nvkm_i2c_pad *pad, int index, u8 drive,
                 return -ENOMEM;
         *paux = &aux->base;
 
-        nvkm_i2c_aux_ctor(&g94_i2c_aux_func, pad, index, &aux->base);
+        nvkm_i2c_aux_ctor(func, pad, index, &aux->base);
         aux->ch = drive;
         aux->base.intr = 1 << aux->ch;
         return 0;
 }
+
+static const struct nvkm_i2c_aux_func
+g94_i2c_aux = {
+        .xfer = g94_i2c_aux_xfer,
+};
+
+int
+g94_i2c_aux_new(struct nvkm_i2c_pad *pad, int index, u8 drive,
+                struct nvkm_i2c_aux **paux)
+{
+        return g94_i2c_aux_new_(&g94_i2c_aux, pad, index, drive, paux);
+}
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxgf119.c b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxgf119.c
new file mode 100644
index 000000000000..dab40cd8fe3a
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxgf119.c
@@ -0,0 +1,35 @@
+/*
+ * Copyright 2017 Red Hat Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ */
+#include "aux.h"
+
+static const struct nvkm_i2c_aux_func
+gf119_i2c_aux = {
+        .address_only = true,
+        .xfer = g94_i2c_aux_xfer,
+};
+
+int
+gf119_i2c_aux_new(struct nvkm_i2c_pad *pad, int index, u8 drive,
+                  struct nvkm_i2c_aux **paux)
+{
+        return g94_i2c_aux_new_(&gf119_i2c_aux, pad, index, drive, paux);
+}
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxgm200.c b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxgm200.c
index ee091fa79628..7ef60895f43a 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxgm200.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxgm200.c
@@ -105,9 +105,9 @@ gm200_i2c_aux_xfer(struct nvkm_i2c_aux *obj, bool retry,
         }
 
         ctrl  = nvkm_rd32(device, 0x00d954 + base);
-        ctrl &= ~0x0001f0ff;
+        ctrl &= ~0x0001f1ff;
         ctrl |= type << 12;
-        ctrl |= *size - 1;
+        ctrl |= (*size ? (*size - 1) : 0x00000100);
         nvkm_wr32(device, 0x00d950 + base, addr);
 
         /* (maybe) retry transaction a number of times on failure... */
@@ -162,6 +162,7 @@ out:
 
 static const struct nvkm_i2c_aux_func
 gm200_i2c_aux_func = {
+        .address_only = true,
         .xfer = gm200_i2c_aux_xfer,
 };
 
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/padgf119.c b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/padgf119.c
index d53212f1aa52..3bc4d0310076 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/padgf119.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/padgf119.c
@@ -28,7 +28,7 @@
 static const struct nvkm_i2c_pad_func
 gf119_i2c_pad_s_func = {
         .bus_new_4 = gf119_i2c_bus_new,
-        .aux_new_6 = g94_i2c_aux_new,
+        .aux_new_6 = gf119_i2c_aux_new,
         .mode = g94_i2c_pad_mode,
 };
 
@@ -41,7 +41,7 @@ gf119_i2c_pad_s_new(struct nvkm_i2c *i2c, int id, struct nvkm_i2c_pad **ppad)
 static const struct nvkm_i2c_pad_func
 gf119_i2c_pad_x_func = {
         .bus_new_4 = gf119_i2c_bus_new,
-        .aux_new_6 = g94_i2c_aux_new,
+        .aux_new_6 = gf119_i2c_aux_new,
 };
 
 int
diff --git a/drivers/gpu/drm/rockchip/Kconfig b/drivers/gpu/drm/rockchip/Kconfig
index 50c41c0a50ef..dcc539ba85d6 100644
--- a/drivers/gpu/drm/rockchip/Kconfig
+++ b/drivers/gpu/drm/rockchip/Kconfig
@@ -5,6 +5,10 @@ config DRM_ROCKCHIP
         select DRM_KMS_HELPER
         select DRM_PANEL
         select VIDEOMODE_HELPERS
+        select DRM_ANALOGIX_DP if ROCKCHIP_ANALOGIX_DP
+        select DRM_DW_HDMI if ROCKCHIP_DW_HDMI
+        select DRM_MIPI_DSI if ROCKCHIP_DW_MIPI_DSI
+        select SND_SOC_HDMI_CODEC if ROCKCHIP_CDN_DP && SND_SOC
         help
           Choose this option if you have a Rockchip soc chipset.
           This driver provides kernel mode setting and buffer
@@ -12,10 +16,10 @@ config DRM_ROCKCHIP
           2D or 3D acceleration; acceleration is performed by other
           IP found on the SoC.
 
+if DRM_ROCKCHIP
+
 config ROCKCHIP_ANALOGIX_DP
         bool "Rockchip specific extensions for Analogix DP driver"
-        depends on DRM_ROCKCHIP
-        select DRM_ANALOGIX_DP
         help
           This selects support for Rockchip SoC specific extensions
           for the Analogix Core DP driver. If you want to enable DP
@@ -23,9 +27,7 @@ config ROCKCHIP_ANALOGIX_DP
 
 config ROCKCHIP_CDN_DP
         bool "Rockchip cdn DP"
-        depends on DRM_ROCKCHIP
-        depends on EXTCON
-        select SND_SOC_HDMI_CODEC if SND_SOC
+        depends on EXTCON=y || (EXTCON=m && DRM_ROCKCHIP=m)
         help
           This selects support for Rockchip SoC specific extensions
           for the cdn DP driver. If you want to enable Dp on
@@ -34,8 +36,6 @@ config ROCKCHIP_CDN_DP
 
 config ROCKCHIP_DW_HDMI
         bool "Rockchip specific extensions for Synopsys DW HDMI"
-        depends on DRM_ROCKCHIP
-        select DRM_DW_HDMI
         help
           This selects support for Rockchip SoC specific extensions
           for the Synopsys DesignWare HDMI driver. If you want to
@@ -44,8 +44,6 @@ config ROCKCHIP_DW_HDMI
 
 config ROCKCHIP_DW_MIPI_DSI
         bool "Rockchip specific extensions for Synopsys DW MIPI DSI"
-        depends on DRM_ROCKCHIP
-        select DRM_MIPI_DSI
         help
          This selects support for Rockchip SoC specific extensions
          for the Synopsys DesignWare HDMI driver. If you want to
@@ -54,8 +52,9 @@ config ROCKCHIP_DW_MIPI_DSI
 
 config ROCKCHIP_INNO_HDMI
         bool "Rockchip specific extensions for Innosilicon HDMI"
-        depends on DRM_ROCKCHIP
         help
           This selects support for Rockchip SoC specific extensions
           for the Innosilicon HDMI driver. If you want to enable
           HDMI on RK3036 based SoC, you should select this option.
+
+endif
diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_drv.c b/drivers/gpu/drm/rockchip/rockchip_drm_drv.c
index c6b1b7f3a2a3..c16bc0a7115b 100644
--- a/drivers/gpu/drm/rockchip/rockchip_drm_drv.c
+++ b/drivers/gpu/drm/rockchip/rockchip_drm_drv.c
@@ -275,11 +275,15 @@ static void rockchip_drm_fb_resume(struct drm_device *drm)
 static int rockchip_drm_sys_suspend(struct device *dev)
 {
         struct drm_device *drm = dev_get_drvdata(dev);
-        struct rockchip_drm_private *priv = drm->dev_private;
+        struct rockchip_drm_private *priv;
+
+        if (!drm)
+                return 0;
 
         drm_kms_helper_poll_disable(drm);
         rockchip_drm_fb_suspend(drm);
 
+        priv = drm->dev_private;
         priv->state = drm_atomic_helper_suspend(drm);
         if (IS_ERR(priv->state)) {
                 rockchip_drm_fb_resume(drm);
@@ -293,8 +297,12 @@ static int rockchip_drm_sys_suspend(struct device *dev)
 static int rockchip_drm_sys_resume(struct device *dev)
 {
         struct drm_device *drm = dev_get_drvdata(dev);
-        struct rockchip_drm_private *priv = drm->dev_private;
+        struct rockchip_drm_private *priv;
+
+        if (!drm)
+                return 0;
 
+        priv = drm->dev_private;
         drm_atomic_helper_resume(drm, priv->state);
         rockchip_drm_fb_resume(drm);
         drm_kms_helper_poll_enable(drm);
diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
index 5d450332c2fd..2900f1410d95 100644
--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
+++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
@@ -500,7 +500,7 @@ static void vop_line_flag_irq_disable(struct vop *vop)
 static int vop_enable(struct drm_crtc *crtc)
 {
         struct vop *vop = to_vop(crtc);
-        int ret;
+        int ret, i;
 
         ret = pm_runtime_get_sync(vop->dev);
         if (ret < 0) {
@@ -533,6 +533,20 @@ static int vop_enable(struct drm_crtc *crtc)
         }
 
         memcpy(vop->regs, vop->regsbak, vop->len);
+        /*
+         * We need to make sure that all windows are disabled before we
+         * enable the crtc. Otherwise we might try to scan from a destroyed
+         * buffer later.
+         */
+        for (i = 0; i < vop->data->win_size; i++) {
+                struct vop_win *vop_win = &vop->win[i];
+                const struct vop_win_data *win = vop_win->data;
+
+                spin_lock(&vop->reg_lock);
+                VOP_WIN_SET(vop, win, enable, 0);
+                spin_unlock(&vop->reg_lock);
+        }
+
         vop_cfg_done(vop);
 
         /*
@@ -566,28 +580,11 @@ err_put_pm_runtime:
 static void vop_crtc_disable(struct drm_crtc *crtc)
 {
         struct vop *vop = to_vop(crtc);
-        int i;
 
         WARN_ON(vop->event);
 
         rockchip_drm_psr_deactivate(&vop->crtc);
 
-        /*
-         * We need to make sure that all windows are disabled before we
-         * disable that crtc. Otherwise we might try to scan from a destroyed
-         * buffer later.
-         */
-        for (i = 0; i < vop->data->win_size; i++) {
-                struct vop_win *vop_win = &vop->win[i];
-                const struct vop_win_data *win = vop_win->data;
-
-                spin_lock(&vop->reg_lock);
-                VOP_WIN_SET(vop, win, enable, 0);
-                spin_unlock(&vop->reg_lock);
-        }
-
-        vop_cfg_done(vop);
-
         drm_crtc_vblank_off(crtc);
 
         /*
@@ -682,8 +679,10 @@ static int vop_plane_atomic_check(struct drm_plane *plane,
          * Src.x1 can be odd when do clip, but yuv plane start point
          * need align with 2 pixel.
          */
-        if (is_yuv_support(fb->format->format) && ((state->src.x1 >> 16) % 2))
+        if (is_yuv_support(fb->format->format) && ((state->src.x1 >> 16) % 2)) {
+                DRM_ERROR("Invalid Source: Yuv format not support odd xpos\n");
                 return -EINVAL;
+        }
 
         return 0;
 }
@@ -764,7 +763,7 @@ static void vop_plane_atomic_update(struct drm_plane *plane,
         spin_lock(&vop->reg_lock);
 
         VOP_WIN_SET(vop, win, format, format);
-        VOP_WIN_SET(vop, win, yrgb_vir, fb->pitches[0] >> 2);
+        VOP_WIN_SET(vop, win, yrgb_vir, DIV_ROUND_UP(fb->pitches[0], 4));
         VOP_WIN_SET(vop, win, yrgb_mst, dma_addr);
         if (is_yuv_support(fb->format->format)) {
                 int hsub = drm_format_horz_chroma_subsampling(fb->format->format);
@@ -778,7 +777,7 @@ static void vop_plane_atomic_update(struct drm_plane *plane,
                 offset += (src->y1 >> 16) * fb->pitches[1] / vsub;
 
                 dma_addr = rk_uv_obj->dma_addr + offset + fb->offsets[1];
-                VOP_WIN_SET(vop, win, uv_vir, fb->pitches[1] >> 2);
+                VOP_WIN_SET(vop, win, uv_vir, DIV_ROUND_UP(fb->pitches[1], 4));
                 VOP_WIN_SET(vop, win, uv_mst, dma_addr);
         }
 
diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop.h b/drivers/gpu/drm/rockchip/rockchip_drm_vop.h
index 9979fd0c2282..27eefbfcf3d0 100644
--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop.h
+++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop.h
@@ -282,6 +282,9 @@ static inline uint16_t scl_get_bili_dn_vskip(int src_h, int dst_h,
 
         act_height = (src_h + vskiplines - 1) / vskiplines;
 
+        if (act_height == dst_h)
+                return GET_SCL_FT_BILI_DN(src_h, dst_h) / vskiplines;
+
         return GET_SCL_FT_BILI_DN(act_height, dst_h);
 }
 
diff --git a/drivers/gpu/drm/stm/Kconfig b/drivers/gpu/drm/stm/Kconfig
index 2c4817fb0890..8fe5b184b4e8 100644
--- a/drivers/gpu/drm/stm/Kconfig
+++ b/drivers/gpu/drm/stm/Kconfig
@@ -7,7 +7,6 @@ config DRM_STM
         select DRM_PANEL
         select VIDEOMODE_HELPERS
         select FB_PROVIDE_GET_FB_UNMAPPED_AREA
-        default y
 
         help
           Enable support for the on-chip display controller on
diff --git a/drivers/gpu/drm/sun4i/sun4i_drv.c b/drivers/gpu/drm/sun4i/sun4i_drv.c
index abc7d8fe06b4..a45a627283a1 100644
--- a/drivers/gpu/drm/sun4i/sun4i_drv.c
+++ b/drivers/gpu/drm/sun4i/sun4i_drv.c
@@ -25,12 +25,20 @@
 #include "sun4i_framebuffer.h"
 #include "sun4i_tcon.h"
 
+static void sun4i_drv_lastclose(struct drm_device *dev)
+{
+        struct sun4i_drv *drv = dev->dev_private;
+
+        drm_fbdev_cma_restore_mode(drv->fbdev);
+}
+
 DEFINE_DRM_GEM_CMA_FOPS(sun4i_drv_fops);
 
 static struct drm_driver sun4i_drv_driver = {
         .driver_features        = DRIVER_GEM | DRIVER_MODESET | DRIVER_PRIME | DRIVER_ATOMIC,
 
         /* Generic Operations */
+        .lastclose              = sun4i_drv_lastclose,
         .fops                   = &sun4i_drv_fops,
         .name                   = "sun4i-drm",
         .desc                   = "Allwinner sun4i Display Engine",
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_buffer.c b/drivers/gpu/drm/vmwgfx/vmwgfx_buffer.c
index 35bf781e418e..c7056322211c 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_buffer.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_buffer.c
@@ -30,49 +30,49 @@
 #include <drm/ttm/ttm_placement.h>
 #include <drm/ttm/ttm_page_alloc.h>
 
-static struct ttm_place vram_placement_flags = {
+static const struct ttm_place vram_placement_flags = {
         .fpfn = 0,
         .lpfn = 0,
         .flags = TTM_PL_FLAG_VRAM | TTM_PL_FLAG_CACHED
 };
 
-static struct ttm_place vram_ne_placement_flags = {
+static const struct ttm_place vram_ne_placement_flags = {
         .fpfn = 0,
         .lpfn = 0,
         .flags = TTM_PL_FLAG_VRAM | TTM_PL_FLAG_CACHED | TTM_PL_FLAG_NO_EVICT
 };
 
-static struct ttm_place sys_placement_flags = {
+static const struct ttm_place sys_placement_flags = {
         .fpfn = 0,
         .lpfn = 0,
         .flags = TTM_PL_FLAG_SYSTEM | TTM_PL_FLAG_CACHED
 };
 
-static struct ttm_place sys_ne_placement_flags = {
+static const struct ttm_place sys_ne_placement_flags = {
         .fpfn = 0,
         .lpfn = 0,
         .flags = TTM_PL_FLAG_SYSTEM | TTM_PL_FLAG_CACHED | TTM_PL_FLAG_NO_EVICT
 };
 
-static struct ttm_place gmr_placement_flags = {
+static const struct ttm_place gmr_placement_flags = {
         .fpfn = 0,
         .lpfn = 0,
         .flags = VMW_PL_FLAG_GMR | TTM_PL_FLAG_CACHED
 };
 
-static struct ttm_place gmr_ne_placement_flags = {
+static const struct ttm_place gmr_ne_placement_flags = {
         .fpfn = 0,
         .lpfn = 0,
         .flags = VMW_PL_FLAG_GMR | TTM_PL_FLAG_CACHED | TTM_PL_FLAG_NO_EVICT
 };
 
-static struct ttm_place mob_placement_flags = {
+static const struct ttm_place mob_placement_flags = {
         .fpfn = 0,
         .lpfn = 0,
         .flags = VMW_PL_FLAG_MOB | TTM_PL_FLAG_CACHED
 };
 
-static struct ttm_place mob_ne_placement_flags = {
+static const struct ttm_place mob_ne_placement_flags = {
         .fpfn = 0,
         .lpfn = 0,
         .flags = VMW_PL_FLAG_MOB | TTM_PL_FLAG_CACHED | TTM_PL_FLAG_NO_EVICT
@@ -85,7 +85,7 @@ struct ttm_placement vmw_vram_placement = {
         .busy_placement = &vram_placement_flags
 };
 
-static struct ttm_place vram_gmr_placement_flags[] = {
+static const struct ttm_place vram_gmr_placement_flags[] = {
         {
                 .fpfn = 0,
                 .lpfn = 0,
@@ -97,7 +97,7 @@ static struct ttm_place vram_gmr_placement_flags[] = {
         }
 };
 
-static struct ttm_place gmr_vram_placement_flags[] = {
+static const struct ttm_place gmr_vram_placement_flags[] = {
         {
                 .fpfn = 0,
                 .lpfn = 0,
@@ -116,7 +116,7 @@ struct ttm_placement vmw_vram_gmr_placement = {
         .busy_placement = &gmr_placement_flags
 };
 
-static struct ttm_place vram_gmr_ne_placement_flags[] = {
+static const struct ttm_place vram_gmr_ne_placement_flags[] = {
         {
                 .fpfn = 0,
                 .lpfn = 0,
@@ -165,7 +165,7 @@ struct ttm_placement vmw_sys_ne_placement = {
         .busy_placement = &sys_ne_placement_flags
 };
 
-static struct ttm_place evictable_placement_flags[] = {
+static const struct ttm_place evictable_placement_flags[] = {
         {
                 .fpfn = 0,
                 .lpfn = 0,
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf.c
index 99a7f4ab7d97..86178796de6c 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf.c
@@ -779,8 +779,8 @@ static int vmw_cmdbuf_space_pool(struct vmw_cmdbuf_man *man,
         if (ret)
                 return ret;
 
-        header->cb_header = dma_pool_alloc(man->headers, GFP_KERNEL,
-                                           &header->handle);
+        header->cb_header = dma_pool_zalloc(man->headers, GFP_KERNEL,
+                                            &header->handle);
         if (!header->cb_header) {
                 ret = -ENOMEM;
                 goto out_no_cb_header;
@@ -790,7 +790,6 @@ static int vmw_cmdbuf_space_pool(struct vmw_cmdbuf_man *man,
         cb_hdr = header->cb_header;
         offset = header->node.start << PAGE_SHIFT;
         header->cmd = man->map + offset;
-        memset(cb_hdr, 0, sizeof(*cb_hdr));
         if (man->using_mob) {
                 cb_hdr->flags = SVGA_CB_FLAG_MOB;
                 cb_hdr->ptr.mob.mobid = man->cmd_space->mem.start;
@@ -827,8 +826,8 @@ static int vmw_cmdbuf_space_inline(struct vmw_cmdbuf_man *man,
         if (WARN_ON_ONCE(size > VMW_CMDBUF_INLINE_SIZE))
                 return -ENOMEM;
 
-        dheader = dma_pool_alloc(man->dheaders, GFP_KERNEL,
-                                 &header->handle);
+        dheader = dma_pool_zalloc(man->dheaders, GFP_KERNEL,
+                                  &header->handle);
         if (!dheader)
                 return -ENOMEM;
 
@@ -837,7 +836,6 @@ static int vmw_cmdbuf_space_inline(struct vmw_cmdbuf_man *man,
         cb_hdr = &dheader->cb_header;
         header->cb_header = cb_hdr;
         header->cmd = dheader->cmd;
-        memset(dheader, 0, sizeof(*dheader));
         cb_hdr->status = SVGA_CB_STATUS_NONE;
         cb_hdr->flags = SVGA_CB_FLAG_NONE;
         cb_hdr->ptr.pa = (u64)header->handle +
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c b/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c
index 1f013d45c9e9..36c7b6c839c0 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c
@@ -205,7 +205,7 @@ int vmw_cmdbuf_res_add(struct vmw_cmdbuf_res_manager *man,
         int ret;
 
         cres = kzalloc(sizeof(*cres), GFP_KERNEL);
-        if (unlikely(cres == NULL))
+        if (unlikely(!cres))
                 return -ENOMEM;
 
         cres->hash.key = user_key | (res_type << 24);
@@ -291,7 +291,7 @@ vmw_cmdbuf_res_man_create(struct vmw_private *dev_priv)
         int ret;
 
         man = kzalloc(sizeof(*man), GFP_KERNEL);
-        if (man == NULL)
+        if (!man)
                 return ERR_PTR(-ENOMEM);
 
         man->dev_priv = dev_priv;
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_context.c b/drivers/gpu/drm/vmwgfx/vmwgfx_context.c
index bcc6d4136c87..4212b3e673bc 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_context.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_context.c
@@ -210,8 +210,8 @@ static int vmw_gb_context_init(struct vmw_private *dev_priv,
                 for (i = 0; i < SVGA_COTABLE_DX10_MAX; ++i) {
                         uctx->cotables[i] = vmw_cotable_alloc(dev_priv,
                                                               &uctx->res, i);
-                        if (unlikely(uctx->cotables[i] == NULL)) {
-                                ret = -ENOMEM;
+                        if (unlikely(IS_ERR(uctx->cotables[i]))) {
+                                ret = PTR_ERR(uctx->cotables[i]);
                                 goto out_cotables;
                         }
                 }
@@ -777,7 +777,7 @@ static int vmw_context_define(struct drm_device *dev, void *data,
         }
 
         ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
-        if (unlikely(ctx == NULL)) {
+        if (unlikely(!ctx)) {
                 ttm_mem_global_free(vmw_mem_glob(dev_priv),
                                     vmw_user_context_size);
                 ret = -ENOMEM;
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_cotable.c b/drivers/gpu/drm/vmwgfx/vmwgfx_cotable.c
index 6c026d75c180..d87861bbe971 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_cotable.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_cotable.c
@@ -584,7 +584,7 @@ struct vmw_resource *vmw_cotable_alloc(struct vmw_private *dev_priv,
                 return ERR_PTR(ret);
 
         vcotbl = kzalloc(sizeof(*vcotbl), GFP_KERNEL);
-        if (unlikely(vcotbl == NULL)) {
+        if (unlikely(!vcotbl)) {
                 ret = -ENOMEM;
                 goto out_no_alloc;
         }
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
index 4a641555b960..4436d53ae16c 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
@@ -227,7 +227,7 @@ static const struct drm_ioctl_desc vmw_ioctls[] = {
                       DRM_AUTH | DRM_RENDER_ALLOW),
 };
 
-static struct pci_device_id vmw_pci_id_list[] = {
+static const struct pci_device_id vmw_pci_id_list[] = {
         {0x15ad, 0x0405, PCI_ANY_ID, PCI_ANY_ID, 0, 0, VMWGFX_CHIP_SVGAII},
         {0, 0, 0}
 };
@@ -630,7 +630,7 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
         char host_log[100] = {0};
 
         dev_priv = kzalloc(sizeof(*dev_priv), GFP_KERNEL);
-        if (unlikely(dev_priv == NULL)) {
+        if (unlikely(!dev_priv)) {
                 DRM_ERROR("Failed allocating a device private struct.\n");
                 return -ENOMEM;
         }
@@ -1035,7 +1035,7 @@ static int vmw_driver_open(struct drm_device *dev, struct drm_file *file_priv)
         int ret = -ENOMEM;
 
         vmw_fp = kzalloc(sizeof(*vmw_fp), GFP_KERNEL);
-        if (unlikely(vmw_fp == NULL))
+        if (unlikely(!vmw_fp))
                 return ret;
 
         vmw_fp->tfile = ttm_object_file_init(dev_priv->tdev, 10);
@@ -1196,7 +1196,7 @@ static int vmw_master_create(struct drm_device *dev,
         struct vmw_master *vmaster;
 
         vmaster = kzalloc(sizeof(*vmaster), GFP_KERNEL);
-        if (unlikely(vmaster == NULL))
+        if (unlikely(!vmaster))
                 return -ENOMEM;
 
         vmw_master_init(vmaster);
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
index c7b53d987f06..2cfb3c93f42a 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
@@ -264,7 +264,7 @@ static int vmw_resource_val_add(struct vmw_sw_context *sw_context,
         }
 
         node = kzalloc(sizeof(*node), GFP_KERNEL);
-        if (unlikely(node == NULL)) {
+        if (unlikely(!node)) {
                 DRM_ERROR("Failed to allocate a resource validation "
                           "entry.\n");
                 return -ENOMEM;
@@ -452,7 +452,7 @@ static int vmw_resource_relocation_add(struct list_head *list,
         struct vmw_resource_relocation *rel;
 
         rel = kmalloc(sizeof(*rel), GFP_KERNEL);
-        if (unlikely(rel == NULL)) {
+        if (unlikely(!rel)) {
                 DRM_ERROR("Failed to allocate a resource relocation.\n");
                 return -ENOMEM;
         }
@@ -519,7 +519,7 @@ static int vmw_cmd_invalid(struct vmw_private *dev_priv,
                            struct vmw_sw_context *sw_context,
                            SVGA3dCmdHeader *header)
 {
-        return capable(CAP_SYS_ADMIN) ? : -EINVAL;
+        return -EINVAL;
 }
 
 static int vmw_cmd_ok(struct vmw_private *dev_priv,
@@ -2584,7 +2584,7 @@ static int vmw_cmd_dx_set_vertex_buffers(struct vmw_private *dev_priv,
 
 /**
  * vmw_cmd_dx_ia_set_vertex_buffers - Validate an
- * SVGA_3D_CMD_DX_IA_SET_VERTEX_BUFFERS command.
+ * SVGA_3D_CMD_DX_IA_SET_INDEX_BUFFER command.
  *
  * @dev_priv: Pointer to a device private struct.
  * @sw_context: The software context being used for this batch.
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
index 6b2708b4eafe..b8bc5bc7de7e 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
@@ -284,7 +284,7 @@ struct vmw_fence_manager *vmw_fence_manager_init(struct vmw_private *dev_priv)
 {
         struct vmw_fence_manager *fman = kzalloc(sizeof(*fman), GFP_KERNEL);
 
-        if (unlikely(fman == NULL))
+        if (unlikely(!fman))
                 return NULL;
 
         fman->dev_priv = dev_priv;
@@ -541,7 +541,7 @@ int vmw_fence_create(struct vmw_fence_manager *fman,
         int ret;
 
         fence = kzalloc(sizeof(*fence), GFP_KERNEL);
-        if (unlikely(fence == NULL))
+        if (unlikely(!fence))
                 return -ENOMEM;
 
         ret = vmw_fence_obj_init(fman, fence, seqno,
@@ -606,7 +606,7 @@ int vmw_user_fence_create(struct drm_file *file_priv,
                 return ret;
 
         ufence = kzalloc(sizeof(*ufence), GFP_KERNEL);
-        if (unlikely(ufence == NULL)) {
+        if (unlikely(!ufence)) {
                 ret = -ENOMEM;
                 goto out_no_object;
         }
@@ -966,7 +966,7 @@ int vmw_event_fence_action_queue(struct drm_file *file_priv,
         struct vmw_fence_manager *fman = fman_from_fence(fence);
 
         eaction = kzalloc(sizeof(*eaction), GFP_KERNEL);
-        if (unlikely(eaction == NULL))
+        if (unlikely(!eaction))
                 return -ENOMEM;
 
         eaction->event = event;
@@ -1002,7 +1002,7 @@ static int vmw_event_fence_action_create(struct drm_file *file_priv,
         int ret;
 
         event = kzalloc(sizeof(*event), GFP_KERNEL);
-        if (unlikely(event == NULL)) {
+        if (unlikely(!event)) {
                 DRM_ERROR("Failed to allocate an event.\n");
                 ret = -ENOMEM;
                 goto out_no_space;
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_gmrid_manager.c b/drivers/gpu/drm/vmwgfx/vmwgfx_gmrid_manager.c
index c1900f4390a4..d2b03d4a3c86 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_gmrid_manager.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_gmrid_manager.c
@@ -121,7 +121,7 @@ static int vmw_gmrid_man_init(struct ttm_mem_type_manager *man,
         struct vmwgfx_gmrid_man *gman =
                 kzalloc(sizeof(*gman), GFP_KERNEL);
 
-        if (unlikely(gman == NULL))
+        if (unlikely(!gman))
                 return -ENOMEM;
 
         spin_lock_init(&gman->lock);
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
index 3d94ea67a825..625ba24f143f 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
@@ -384,6 +384,12 @@ vmw_du_cursor_plane_atomic_update(struct drm_plane *plane,
 
         hotspot_x = du->hotspot_x;
         hotspot_y = du->hotspot_y;
+
+        if (plane->fb) {
+                hotspot_x += plane->fb->hot_x;
+                hotspot_y += plane->fb->hot_y;
+        }
+
         du->cursor_surface = vps->surf;
         du->cursor_dmabuf = vps->dmabuf;
 
@@ -411,6 +417,9 @@ vmw_du_cursor_plane_atomic_update(struct drm_plane *plane,
                 vmw_cursor_update_position(dev_priv, true,
                                            du->cursor_x + hotspot_x,
                                            du->cursor_y + hotspot_y);
+
+                du->core_hotspot_x = hotspot_x - du->hotspot_x;
+                du->core_hotspot_y = hotspot_y - du->hotspot_y;
         } else {
                 DRM_ERROR("Failed to update cursor image\n");
         }
@@ -1558,10 +1567,34 @@ vmw_kms_atomic_check_modeset(struct drm_device *dev,
 }
 
 
+/**
+ * vmw_kms_atomic_commit - Perform an atomic state commit
+ *
+ * @dev: DRM device
+ * @state: the driver state object
+ * @nonblock: Whether nonblocking behaviour is requested
+ *
+ * This is a simple wrapper around drm_atomic_helper_commit() for
+ * us to clear the nonblocking value.
+ *
+ * Nonblocking commits currently cause synchronization issues
+ * for vmwgfx.
+ *
+ * RETURNS
+ * Zero for success or negative error code on failure.
+ */
+int vmw_kms_atomic_commit(struct drm_device *dev,
+                          struct drm_atomic_state *state,
+                          bool nonblock)
+{
+        return drm_atomic_helper_commit(dev, state, false);
+}
+
+
 static const struct drm_mode_config_funcs vmw_kms_funcs = {
         .fb_create = vmw_kms_fb_create,
         .atomic_check = vmw_kms_atomic_check_modeset,
-        .atomic_commit = drm_atomic_helper_commit,
+        .atomic_commit = vmw_kms_atomic_commit,
 };
 
 static int vmw_kms_generic_present(struct vmw_private *dev_priv,
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_mob.c b/drivers/gpu/drm/vmwgfx/vmwgfx_mob.c
index 941bcfd131ff..b17f08fc50d3 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_mob.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_mob.c
@@ -320,14 +320,14 @@ int vmw_otables_setup(struct vmw_private *dev_priv)
 
         if (dev_priv->has_dx) {
                 *otables = kmemdup(dx_tables, sizeof(dx_tables), GFP_KERNEL);
-                if (*otables == NULL)
+                if (!(*otables))
                         return -ENOMEM;
 
                 dev_priv->otable_batch.num_otables = ARRAY_SIZE(dx_tables);
         } else {
                 *otables = kmemdup(pre_dx_tables, sizeof(pre_dx_tables),
                                    GFP_KERNEL);
-                if (*otables == NULL)
+                if (!(*otables))
                         return -ENOMEM;
 
                 dev_priv->otable_batch.num_otables = ARRAY_SIZE(pre_dx_tables);
@@ -407,7 +407,7 @@ struct vmw_mob *vmw_mob_create(unsigned long data_pages)
 {
         struct vmw_mob *mob = kzalloc(sizeof(*mob), GFP_KERNEL);
 
-        if (unlikely(mob == NULL))
+        if (unlikely(!mob))
                 return NULL;
 
         mob->num_pages = vmw_mob_calculate_pt_pages(data_pages);
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c b/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
index 6063c9636d4a..97000996b8dc 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
@@ -244,7 +244,7 @@ static int vmw_recv_msg(struct rpc_channel *channel, void **msg,
 
                 reply_len = ebx;
                 reply     = kzalloc(reply_len + 1, GFP_KERNEL);
-                if (reply == NULL) {
+                if (!reply) {
                         DRM_ERROR("Cannot allocate memory for reply\n");
                         return -ENOMEM;
                 }
@@ -340,7 +340,7 @@ int vmw_host_get_guestinfo(const char *guest_info_param,
 
         msg_len = strlen(guest_info_param) + strlen("info-get ") + 1;
         msg = kzalloc(msg_len, GFP_KERNEL);
-        if (msg == NULL) {
+        if (!msg) {
                 DRM_ERROR("Cannot allocate memory to get %s", guest_info_param);
                 return -ENOMEM;
         }
@@ -400,7 +400,7 @@ int vmw_host_log(const char *log)
 
         msg_len = strlen(log) + strlen("log ") + 1;
         msg = kzalloc(msg_len, GFP_KERNEL);
-        if (msg == NULL) {
+        if (!msg) {
                 DRM_ERROR("Cannot allocate memory for log message\n");
                 return -ENOMEM;
         }
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
index 7d591f653dfa..a96f90f017d1 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
@@ -446,7 +446,7 @@ int vmw_user_dmabuf_alloc(struct vmw_private *dev_priv,
         int ret;
 
         user_bo = kzalloc(sizeof(*user_bo), GFP_KERNEL);
-        if (unlikely(user_bo == NULL)) {
+        if (unlikely(!user_bo)) {
                 DRM_ERROR("Failed to allocate a buffer.\n");
                 return -ENOMEM;
         }
@@ -836,7 +836,7 @@ static int vmw_resource_buf_alloc(struct vmw_resource *res,
         }
 
         backup = kzalloc(sizeof(*backup), GFP_KERNEL);
-        if (unlikely(backup == NULL))
+        if (unlikely(!backup))
                 return -ENOMEM;
 
         ret = vmw_dmabuf_init(res->dev_priv, backup, res->backup_size,
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_shader.c b/drivers/gpu/drm/vmwgfx/vmwgfx_shader.c
index 68f135c5b0d8..9b832f136813 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_shader.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_shader.c
@@ -751,7 +751,7 @@ static int vmw_user_shader_alloc(struct vmw_private *dev_priv,
         }
 
         ushader = kzalloc(sizeof(*ushader), GFP_KERNEL);
-        if (unlikely(ushader == NULL)) {
+        if (unlikely(!ushader)) {
                 ttm_mem_global_free(vmw_mem_glob(dev_priv),
                                     vmw_user_shader_size);
                 ret = -ENOMEM;
@@ -821,7 +821,7 @@ static struct vmw_resource *vmw_shader_alloc(struct vmw_private *dev_priv,
         }
 
         shader = kzalloc(sizeof(*shader), GFP_KERNEL);
-        if (unlikely(shader == NULL)) {
+        if (unlikely(!shader)) {
                 ttm_mem_global_free(vmw_mem_glob(dev_priv),
                                     vmw_shader_size);
                 ret = -ENOMEM;
@@ -981,7 +981,7 @@ int vmw_compat_shader_add(struct vmw_private *dev_priv,
 
         /* Allocate and pin a DMA buffer */
         buf = kzalloc(sizeof(*buf), GFP_KERNEL);
-        if (unlikely(buf == NULL))
+        if (unlikely(!buf))
                 return -ENOMEM;
 
         ret = vmw_dmabuf_init(dev_priv, buf, size, &vmw_sys_ne_placement,
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c b/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c
index 50be1f034f9e..5284e8d2f7ba 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c
@@ -1640,8 +1640,8 @@ int vmw_kms_stdu_init_display(struct vmw_private *dev_priv)
                  * something arbitrarily large and we will reject any layout
                  * that doesn't fit prim_bb_mem later
                  */
-                dev->mode_config.max_width = 16384;
-                dev->mode_config.max_height = 16384;
+                dev->mode_config.max_width = 8192;
+                dev->mode_config.max_height = 8192;
         }
 
         vmw_kms_create_implicit_placement_property(dev_priv, false);
diff --git a/drivers/gpu/host1x/dev.c b/drivers/gpu/host1x/dev.c
index 2c58a390123a..778272514164 100644
--- a/drivers/gpu/host1x/dev.c
+++ b/drivers/gpu/host1x/dev.c
@@ -186,8 +186,13 @@ static int host1x_probe(struct platform_device *pdev)
                         return -ENOMEM;
 
                 err = iommu_attach_device(host->domain, &pdev->dev);
-                if (err)
+                if (err == -ENODEV) {
+                        iommu_domain_free(host->domain);
+                        host->domain = NULL;
+                        goto skip_iommu;
+                } else if (err) {
                         goto fail_free_domain;
+                }
 
                 geometry = &host->domain->geometry;
 
@@ -198,6 +203,7 @@ static int host1x_probe(struct platform_device *pdev)
                 host->iova_end = geometry->aperture_end;
         }
 
+skip_iommu:
         err = host1x_channel_list_init(&host->channel_list,
                                        host->info->nb_channels);
         if (err) {
diff --git a/drivers/gpu/ipu-v3/Kconfig b/drivers/gpu/ipu-v3/Kconfig
index 08766c6e7856..87a20b3dcf7a 100644
--- a/drivers/gpu/ipu-v3/Kconfig
+++ b/drivers/gpu/ipu-v3/Kconfig
@@ -1,6 +1,7 @@
 config IMX_IPUV3_CORE
         tristate "IPUv3 core support"
         depends on SOC_IMX5 || SOC_IMX6Q || ARCH_MULTIPLATFORM
+        depends on DRM || !DRM # if DRM=m, this can't be 'y'
         select GENERIC_IRQ_CHIP
         help
           Choose this if you have a i.MX5/6 system and want to use the Image
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 6fd01a692197..9017dcc14502 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -2216,6 +2216,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
 #if IS_ENABLED(CONFIG_HID_ORTEK)
         { HID_USB_DEVICE(USB_VENDOR_ID_ORTEK, USB_DEVICE_ID_ORTEK_PKB1700) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ORTEK, USB_DEVICE_ID_ORTEK_WKB2000) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_ORTEK, USB_DEVICE_ID_ORTEK_IHOME_IMAC_A210S) },
         { HID_USB_DEVICE(USB_VENDOR_ID_SKYCABLE, USB_DEVICE_ID_SKYCABLE_WIRELESS_PRESENTER) },
 #endif
 #if IS_ENABLED(CONFIG_HID_PANTHERLORD)
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 3d911bfd91cf..c9ba4c6db74c 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -824,6 +824,7 @@
 #define USB_VENDOR_ID_ORTEK             0x05a4
 #define USB_DEVICE_ID_ORTEK_PKB1700     0x1700
 #define USB_DEVICE_ID_ORTEK_WKB2000     0x2000
+#define USB_DEVICE_ID_ORTEK_IHOME_IMAC_A210S    0x8003
 
 #define USB_VENDOR_ID_PLANTRONICS       0x047f
 
diff --git a/drivers/hid/hid-ortek.c b/drivers/hid/hid-ortek.c
index 6620f15fec22..8783a064cdcf 100644
--- a/drivers/hid/hid-ortek.c
+++ b/drivers/hid/hid-ortek.c
@@ -5,6 +5,7 @@
  *
  *    Ortek PKB-1700
  *    Ortek WKB-2000
+ *    iHome IMAC-A210S
  *    Skycable wireless presenter
  *
  *  Copyright (c) 2010 Johnathon Harris <jmharris@gmail.com>
@@ -28,10 +29,10 @@ static __u8 *ortek_report_fixup(struct hid_device *hdev, __u8 *rdesc,
                 unsigned int *rsize)
 {
         if (*rsize >= 56 && rdesc[54] == 0x25 && rdesc[55] == 0x01) {
-                hid_info(hdev, "Fixing up logical minimum in report descriptor (Ortek)\n");
+                hid_info(hdev, "Fixing up logical maximum in report descriptor (Ortek)\n");
                 rdesc[55] = 0x92;
         } else if (*rsize >= 54 && rdesc[52] == 0x25 && rdesc[53] == 0x01) {
-                hid_info(hdev, "Fixing up logical minimum in report descriptor (Skycable)\n");
+                hid_info(hdev, "Fixing up logical maximum in report descriptor (Skycable)\n");
                 rdesc[53] = 0x65;
         }
         return rdesc;
@@ -40,6 +41,7 @@ static __u8 *ortek_report_fixup(struct hid_device *hdev, __u8 *rdesc,
 static const struct hid_device_id ortek_devices[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_ORTEK, USB_DEVICE_ID_ORTEK_PKB1700) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ORTEK, USB_DEVICE_ID_ORTEK_WKB2000) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_ORTEK, USB_DEVICE_ID_ORTEK_IHOME_IMAC_A210S) },
         { HID_USB_DEVICE(USB_VENDOR_ID_SKYCABLE, USB_DEVICE_ID_SKYCABLE_WIRELESS_PRESENTER) },
         { }
 };
diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c
index 76013eb5cb7f..c008847e0b20 100644
--- a/drivers/hid/usbhid/hid-core.c
+++ b/drivers/hid/usbhid/hid-core.c
@@ -680,18 +680,21 @@ static int usbhid_open(struct hid_device *hid)
         struct usbhid_device *usbhid = hid->driver_data;
         int res;
 
+        set_bit(HID_OPENED, &usbhid->iofl);
+
         if (hid->quirks & HID_QUIRK_ALWAYS_POLL)
                 return 0;
 
         res = usb_autopm_get_interface(usbhid->intf);
         /* the device must be awake to reliably request remote wakeup */
-        if (res < 0)
+        if (res < 0) {
+                clear_bit(HID_OPENED, &usbhid->iofl);
                 return -EIO;
+        }
 
         usbhid->intf->needs_remote_wakeup = 1;
 
         set_bit(HID_RESUME_RUNNING, &usbhid->iofl);
-        set_bit(HID_OPENED, &usbhid->iofl);
         set_bit(HID_IN_POLLING, &usbhid->iofl);
 
         res = hid_start_in(hid);
@@ -727,19 +730,20 @@ static void usbhid_close(struct hid_device *hid)
 {
         struct usbhid_device *usbhid = hid->driver_data;
 
-        if (hid->quirks & HID_QUIRK_ALWAYS_POLL)
-                return;
-
         /*
          * Make sure we don't restart data acquisition due to
          * a resumption we no longer care about by avoiding racing
          * with hid_start_in().
          */
         spin_lock_irq(&usbhid->lock);
-        clear_bit(HID_IN_POLLING, &usbhid->iofl);
         clear_bit(HID_OPENED, &usbhid->iofl);
+        if (!(hid->quirks & HID_QUIRK_ALWAYS_POLL))
+                clear_bit(HID_IN_POLLING, &usbhid->iofl);
         spin_unlock_irq(&usbhid->lock);
 
+        if (hid->quirks & HID_QUIRK_ALWAYS_POLL)
+                return;
+
         hid_cancel_delayed_stuff(usbhid);
         usb_kill_urb(usbhid->urbin);
         usbhid->intf->needs_remote_wakeup = 0;
diff --git a/drivers/i2c/busses/Kconfig b/drivers/i2c/busses/Kconfig
index 1006b230b236..65fa29591d21 100644
--- a/drivers/i2c/busses/Kconfig
+++ b/drivers/i2c/busses/Kconfig
@@ -983,7 +983,7 @@ config I2C_UNIPHIER_F
 
 config I2C_VERSATILE
         tristate "ARM Versatile/Realview I2C bus support"
-        depends on ARCH_VERSATILE || ARCH_REALVIEW || ARCH_VEXPRESS || COMPILE_TEST
+        depends on ARCH_MPS2 || ARCH_VERSATILE || ARCH_REALVIEW || ARCH_VEXPRESS || COMPILE_TEST
         select I2C_ALGOBIT
         help
           Say yes if you want to support the I2C serial bus on ARMs Versatile
diff --git a/drivers/i2c/busses/i2c-aspeed.c b/drivers/i2c/busses/i2c-aspeed.c
index f19348328a71..6fdf9231c23c 100644
--- a/drivers/i2c/busses/i2c-aspeed.c
+++ b/drivers/i2c/busses/i2c-aspeed.c
@@ -410,10 +410,11 @@ static bool aspeed_i2c_master_irq(struct aspeed_i2c_bus *bus)
         }
 
         /* We are in an invalid state; reset bus to a known state. */
-        if (!bus->msgs && bus->master_state != ASPEED_I2C_MASTER_STOP) {
+        if (!bus->msgs) {
                 dev_err(bus->dev, "bus in unknown state");
                 bus->cmd_err = -EIO;
-                aspeed_i2c_do_stop(bus);
+                if (bus->master_state != ASPEED_I2C_MASTER_STOP)
+                        aspeed_i2c_do_stop(bus);
                 goto out_no_complete;
         }
         msg = &bus->msgs[bus->msgs_index];
diff --git a/drivers/i2c/busses/i2c-designware-platdrv.c b/drivers/i2c/busses/i2c-designware-platdrv.c
index 2ea6d0d25a01..2b98a173136f 100644
--- a/drivers/i2c/busses/i2c-designware-platdrv.c
+++ b/drivers/i2c/busses/i2c-designware-platdrv.c
@@ -198,8 +198,7 @@ static void i2c_dw_configure_slave(struct dw_i2c_dev *dev)
         dev->functionality = I2C_FUNC_SLAVE | DW_IC_DEFAULT_FUNCTIONALITY;
 
         dev->slave_cfg = DW_IC_CON_RX_FIFO_FULL_HLD_CTRL |
-                         DW_IC_CON_RESTART_EN | DW_IC_CON_STOP_DET_IFADDRESSED |
-                         DW_IC_CON_SPEED_FAST;
+                         DW_IC_CON_RESTART_EN | DW_IC_CON_STOP_DET_IFADDRESSED;
 
         dev->mode = DW_IC_SLAVE;
 
@@ -257,7 +256,8 @@ static int dw_i2c_plat_probe(struct platform_device *pdev)
         struct dw_i2c_dev *dev;
         u32 acpi_speed, ht = 0;
         struct resource *mem;
-        int irq, ret;
+        int i, irq, ret;
+        const int supported_speeds[] = { 0, 100000, 400000, 1000000, 3400000 };
 
         irq = platform_get_irq(pdev, 0);
         if (irq < 0)
@@ -299,6 +299,16 @@ static int dw_i2c_plat_probe(struct platform_device *pdev)
 
         acpi_speed = i2c_acpi_find_bus_speed(&pdev->dev);
         /*
+         * Some DSTDs use a non standard speed, round down to the lowest
+         * standard speed.
+         */
+        for (i = 1; i < ARRAY_SIZE(supported_speeds); i++) {
+                if (acpi_speed < supported_speeds[i])
+                        break;
+        }
+        acpi_speed = supported_speeds[i - 1];
+
+        /*
          * Find bus speed from the "clock-frequency" device property, ACPI
          * or by using fast mode if neither is set.
          */
@@ -319,7 +329,8 @@ static int dw_i2c_plat_probe(struct platform_device *pdev)
         if (dev->clk_freq != 100000 && dev->clk_freq != 400000
             && dev->clk_freq != 1000000 && dev->clk_freq != 3400000) {
                 dev_err(&pdev->dev,
-                        "Only 100kHz, 400kHz, 1MHz and 3.4MHz supported");
+                        "%d Hz is unsupported, only 100kHz, 400kHz, 1MHz and 3.4MHz are supported\n",
+                        dev->clk_freq);
                 ret = -EINVAL;
                 goto exit_reset;
         }
@@ -426,7 +437,7 @@ static void dw_i2c_plat_complete(struct device *dev)
 #endif
 
 #ifdef CONFIG_PM
-static int dw_i2c_plat_suspend(struct device *dev)
+static int dw_i2c_plat_runtime_suspend(struct device *dev)
 {
         struct platform_device *pdev = to_platform_device(dev);
         struct dw_i2c_dev *i_dev = platform_get_drvdata(pdev);
@@ -448,11 +459,21 @@ static int dw_i2c_plat_resume(struct device *dev)
         return 0;
 }
 
+#ifdef CONFIG_PM_SLEEP
+static int dw_i2c_plat_suspend(struct device *dev)
+{
+        pm_runtime_resume(dev);
+        return dw_i2c_plat_runtime_suspend(dev);
+}
+#endif
+
 static const struct dev_pm_ops dw_i2c_dev_pm_ops = {
         .prepare = dw_i2c_plat_prepare,
         .complete = dw_i2c_plat_complete,
         SET_SYSTEM_SLEEP_PM_OPS(dw_i2c_plat_suspend, dw_i2c_plat_resume)
-        SET_RUNTIME_PM_OPS(dw_i2c_plat_suspend, dw_i2c_plat_resume, NULL)
+        SET_RUNTIME_PM_OPS(dw_i2c_plat_runtime_suspend,
+                           dw_i2c_plat_resume,
+                           NULL)
 };
 
 #define DW_I2C_DEV_PMOPS (&dw_i2c_dev_pm_ops)
diff --git a/drivers/i2c/busses/i2c-designware-slave.c b/drivers/i2c/busses/i2c-designware-slave.c
index 0548c7ea578c..78d8fb73927d 100644
--- a/drivers/i2c/busses/i2c-designware-slave.c
+++ b/drivers/i2c/busses/i2c-designware-slave.c
@@ -177,6 +177,8 @@ static int i2c_dw_reg_slave(struct i2c_client *slave)
                 return -EBUSY;
         if (slave->flags & I2C_CLIENT_TEN)
                 return -EAFNOSUPPORT;
+        pm_runtime_get_sync(dev->dev);
+
         /*
          * Set slave address in the IC_SAR register,
          * the address to which the DW_apb_i2c responds.
@@ -205,6 +207,7 @@ static int i2c_dw_unreg_slave(struct i2c_client *slave)
         dev->disable_int(dev);
         dev->disable(dev);
         dev->slave = NULL;
+        pm_runtime_put(dev->dev);
 
         return 0;
 }
@@ -272,7 +275,7 @@ static int i2c_dw_irq_handler_slave(struct dw_i2c_dev *dev)
         slave_activity = ((dw_readl(dev, DW_IC_STATUS) &
                 DW_IC_STATUS_SLAVE_ACTIVITY) >> 6);
 
-        if (!enabled || !(raw_stat & ~DW_IC_INTR_ACTIVITY))
+        if (!enabled || !(raw_stat & ~DW_IC_INTR_ACTIVITY) || !dev->slave)
                 return 0;
 
         dev_dbg(dev->dev,
@@ -382,7 +385,6 @@ int i2c_dw_probe_slave(struct dw_i2c_dev *dev)
         ret = i2c_add_numbered_adapter(adap);
         if (ret)
                 dev_err(dev->dev, "failure adding adapter: %d\n", ret);
-        pm_runtime_put_noidle(dev->dev);
 
         return ret;
 }
diff --git a/drivers/i2c/busses/i2c-ismt.c b/drivers/i2c/busses/i2c-ismt.c
index e98e44e584a4..22ffcb73c185 100644
--- a/drivers/i2c/busses/i2c-ismt.c
+++ b/drivers/i2c/busses/i2c-ismt.c
@@ -341,8 +341,10 @@ static int ismt_process_desc(const struct ismt_desc *desc,
                         break;
                 case I2C_SMBUS_BLOCK_DATA:
                 case I2C_SMBUS_I2C_BLOCK_DATA:
-                        memcpy(&data->block[1], dma_buffer, desc->rxbytes);
-                        data->block[0] = desc->rxbytes;
+                        if (desc->rxbytes != dma_buffer[0] + 1)
+                                return -EMSGSIZE;
+
+                        memcpy(data->block, dma_buffer, desc->rxbytes);
                         break;
                 }
                 return 0;
diff --git a/drivers/i2c/busses/i2c-simtec.c b/drivers/i2c/busses/i2c-simtec.c
index b4685bb9b5d7..adca51a99487 100644
--- a/drivers/i2c/busses/i2c-simtec.c
+++ b/drivers/i2c/busses/i2c-simtec.c
@@ -127,8 +127,7 @@ static int simtec_i2c_probe(struct platform_device *dev)
         iounmap(pd->reg);
 
  err_res:
-        release_resource(pd->ioarea);
-        kfree(pd->ioarea);
+        release_mem_region(pd->ioarea->start, size);
 
  err:
         kfree(pd);
@@ -142,8 +141,7 @@ static int simtec_i2c_remove(struct platform_device *dev)
         i2c_del_adapter(&pd->adap);
 
         iounmap(pd->reg);
-        release_resource(pd->ioarea);
-        kfree(pd->ioarea);
+        release_mem_region(pd->ioarea->start, resource_size(pd->ioarea));
         kfree(pd);
 
         return 0;
diff --git a/drivers/i2c/i2c-core-acpi.c b/drivers/i2c/i2c-core-acpi.c
index 4842ec3a5451..a9126b3cda61 100644
--- a/drivers/i2c/i2c-core-acpi.c
+++ b/drivers/i2c/i2c-core-acpi.c
@@ -230,6 +230,16 @@ void i2c_acpi_register_devices(struct i2c_adapter *adap)
                 dev_warn(&adap->dev, "failed to enumerate I2C slaves\n");
 }
 
+const struct acpi_device_id *
+i2c_acpi_match_device(const struct acpi_device_id *matches,
+                      struct i2c_client *client)
+{
+        if (!(client && matches))
+                return NULL;
+
+        return acpi_match_device(matches, &client->dev);
+}
+
 static acpi_status i2c_acpi_lookup_speed(acpi_handle handle, u32 level,
                                            void *data, void **return_value)
 {
@@ -289,7 +299,7 @@ u32 i2c_acpi_find_bus_speed(struct device *dev)
 }
 EXPORT_SYMBOL_GPL(i2c_acpi_find_bus_speed);
 
-static int i2c_acpi_match_adapter(struct device *dev, void *data)
+static int i2c_acpi_find_match_adapter(struct device *dev, void *data)
 {
         struct i2c_adapter *adapter = i2c_verify_adapter(dev);
 
@@ -299,7 +309,7 @@ static int i2c_acpi_match_adapter(struct device *dev, void *data)
         return ACPI_HANDLE(dev) == (acpi_handle)data;
 }
 
-static int i2c_acpi_match_device(struct device *dev, void *data)
+static int i2c_acpi_find_match_device(struct device *dev, void *data)
 {
         return ACPI_COMPANION(dev) == data;
 }
@@ -309,7 +319,7 @@ static struct i2c_adapter *i2c_acpi_find_adapter_by_handle(acpi_handle handle)
         struct device *dev;
 
         dev = bus_find_device(&i2c_bus_type, NULL, handle,
-                              i2c_acpi_match_adapter);
+                              i2c_acpi_find_match_adapter);
         return dev ? i2c_verify_adapter(dev) : NULL;
 }
 
@@ -317,7 +327,8 @@ static struct i2c_client *i2c_acpi_find_client_by_adev(struct acpi_device *adev)
 {
         struct device *dev;
 
-        dev = bus_find_device(&i2c_bus_type, NULL, adev, i2c_acpi_match_device);
+        dev = bus_find_device(&i2c_bus_type, NULL, adev,
+                              i2c_acpi_find_match_device);
         return dev ? i2c_verify_client(dev) : NULL;
 }
 
diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c
index c89dac7fd2e7..56e46581b84b 100644
--- a/drivers/i2c/i2c-core-base.c
+++ b/drivers/i2c/i2c-core-base.c
@@ -353,10 +353,11 @@ static int i2c_device_probe(struct device *dev)
         }
 
         /*
-         * An I2C ID table is not mandatory, if and only if, a suitable Device
-         * Tree match table entry is supplied for the probing device.
+         * An I2C ID table is not mandatory, if and only if, a suitable OF
+         * or ACPI ID table is supplied for the probing device.
          */
         if (!driver->id_table &&
+            !i2c_acpi_match_device(dev->driver->acpi_match_table, client) &&
             !i2c_of_match_device(dev->driver->of_match_table, client))
                 return -ENODEV;
 
diff --git a/drivers/i2c/i2c-core.h b/drivers/i2c/i2c-core.h
index 3b63f5e5b89c..3d3d9bf02101 100644
--- a/drivers/i2c/i2c-core.h
+++ b/drivers/i2c/i2c-core.h
@@ -31,9 +31,18 @@ int i2c_check_addr_validity(unsigned addr, unsigned short flags);
 int i2c_check_7bit_addr_validity_strict(unsigned short addr);
 
 #ifdef CONFIG_ACPI
+const struct acpi_device_id *
+i2c_acpi_match_device(const struct acpi_device_id *matches,
+                      struct i2c_client *client);
 void i2c_acpi_register_devices(struct i2c_adapter *adap);
 #else /* CONFIG_ACPI */
 static inline void i2c_acpi_register_devices(struct i2c_adapter *adap) { }
+static inline const struct acpi_device_id *
+i2c_acpi_match_device(const struct acpi_device_id *matches,
+                      struct i2c_client *client)
+{
+        return NULL;
+}
 #endif /* CONFIG_ACPI */
 extern struct notifier_block i2c_acpi_notifier;
 
diff --git a/drivers/i2c/muxes/Kconfig b/drivers/i2c/muxes/Kconfig
index 2c64d0e0740f..17121329bb79 100644
--- a/drivers/i2c/muxes/Kconfig
+++ b/drivers/i2c/muxes/Kconfig
@@ -83,7 +83,7 @@ config I2C_MUX_PINCTRL
           different sets of pins at run-time.
 
           This driver can also be built as a module. If so, the module will be
-          called pinctrl-i2cmux.
+          called i2c-mux-pinctrl.
 
 config I2C_MUX_REG
         tristate "Register-based I2C multiplexer"
diff --git a/drivers/iio/accel/bmc150-accel-core.c b/drivers/iio/accel/bmc150-accel-core.c
index 6b5d3be283c4..807299dd45eb 100644
--- a/drivers/iio/accel/bmc150-accel-core.c
+++ b/drivers/iio/accel/bmc150-accel-core.c
@@ -193,7 +193,6 @@ struct bmc150_accel_data {
         struct regmap *regmap;
         int irq;
         struct bmc150_accel_interrupt interrupts[BMC150_ACCEL_INTERRUPTS];
-        atomic_t active_intr;
         struct bmc150_accel_trigger triggers[BMC150_ACCEL_TRIGGERS];
         struct mutex mutex;
         u8 fifo_mode, watermark;
@@ -493,11 +492,6 @@ static int bmc150_accel_set_interrupt(struct bmc150_accel_data *data, int i,
                 goto out_fix_power_state;
         }
 
-        if (state)
-                atomic_inc(&data->active_intr);
-        else
-                atomic_dec(&data->active_intr);
-
         return 0;
 
 out_fix_power_state:
@@ -1710,8 +1704,7 @@ static int bmc150_accel_resume(struct device *dev)
         struct bmc150_accel_data *data = iio_priv(indio_dev);
 
         mutex_lock(&data->mutex);
-        if (atomic_read(&data->active_intr))
-                bmc150_accel_set_mode(data, BMC150_ACCEL_SLEEP_MODE_NORMAL, 0);
+        bmc150_accel_set_mode(data, BMC150_ACCEL_SLEEP_MODE_NORMAL, 0);
         bmc150_accel_fifo_set_mode(data);
         mutex_unlock(&data->mutex);
 
diff --git a/drivers/iio/accel/st_accel_core.c b/drivers/iio/accel/st_accel_core.c
index 07d1489cd457..e44f62bf9caa 100644
--- a/drivers/iio/accel/st_accel_core.c
+++ b/drivers/iio/accel/st_accel_core.c
@@ -166,6 +166,10 @@ static const struct st_sensor_settings st_accel_sensors_settings[] = {
                         .mask_ihl = 0x02,
                         .addr_stat_drdy = ST_SENSORS_DEFAULT_STAT_ADDR,
                 },
+                .sim = {
+                        .addr = 0x23,
+                        .value = BIT(0),
+                },
                 .multi_read_bit = true,
                 .bootime = 2,
         },
@@ -234,6 +238,10 @@ static const struct st_sensor_settings st_accel_sensors_settings[] = {
                         .mask_od = 0x40,
                         .addr_stat_drdy = ST_SENSORS_DEFAULT_STAT_ADDR,
                 },
+                .sim = {
+                        .addr = 0x23,
+                        .value = BIT(0),
+                },
                 .multi_read_bit = true,
                 .bootime = 2,
         },
@@ -316,6 +324,10 @@ static const struct st_sensor_settings st_accel_sensors_settings[] = {
                                 .en_mask = 0x08,
                         },
                 },
+                .sim = {
+                        .addr = 0x24,
+                        .value = BIT(0),
+                },
                 .multi_read_bit = false,
                 .bootime = 2,
         },
@@ -379,6 +391,10 @@ static const struct st_sensor_settings st_accel_sensors_settings[] = {
                         .mask_int1 = 0x04,
                         .addr_stat_drdy = ST_SENSORS_DEFAULT_STAT_ADDR,
                 },
+                .sim = {
+                        .addr = 0x21,
+                        .value = BIT(1),
+                },
                 .multi_read_bit = true,
                 .bootime = 2, /* guess */
         },
@@ -437,6 +453,10 @@ static const struct st_sensor_settings st_accel_sensors_settings[] = {
                         .mask_od = 0x40,
                         .addr_stat_drdy = ST_SENSORS_DEFAULT_STAT_ADDR,
                 },
+                .sim = {
+                        .addr = 0x21,
+                        .value = BIT(7),
+                },
                 .multi_read_bit = false,
                 .bootime = 2, /* guess */
         },
@@ -499,6 +519,10 @@ static const struct st_sensor_settings st_accel_sensors_settings[] = {
                         .addr_ihl = 0x22,
                         .mask_ihl = 0x80,
                 },
+                .sim = {
+                        .addr = 0x23,
+                        .value = BIT(0),
+                },
                 .multi_read_bit = true,
                 .bootime = 2,
         },
@@ -547,6 +571,10 @@ static const struct st_sensor_settings st_accel_sensors_settings[] = {
                         .mask_int1 = 0x04,
                         .addr_stat_drdy = ST_SENSORS_DEFAULT_STAT_ADDR,
                 },
+                .sim = {
+                        .addr = 0x21,
+                        .value = BIT(1),
+                },
                 .multi_read_bit = false,
                 .bootime = 2,
         },
@@ -614,6 +642,10 @@ static const struct st_sensor_settings st_accel_sensors_settings[] = {
                         .mask_ihl = 0x02,
                         .addr_stat_drdy = ST_SENSORS_DEFAULT_STAT_ADDR,
                 },
+                .sim = {
+                        .addr = 0x23,
+                        .value = BIT(0),
+                },
                 .multi_read_bit = true,
                 .bootime = 2,
         },
diff --git a/drivers/iio/adc/aspeed_adc.c b/drivers/iio/adc/aspeed_adc.c
index e0ea411a0b2d..c02b23d675cb 100644
--- a/drivers/iio/adc/aspeed_adc.c
+++ b/drivers/iio/adc/aspeed_adc.c
@@ -22,6 +22,7 @@
 
 #include <linux/iio/iio.h>
 #include <linux/iio/driver.h>
+#include <linux/iopoll.h>
 
 #define ASPEED_RESOLUTION_BITS          10
 #define ASPEED_CLOCKS_PER_SAMPLE        12
@@ -38,11 +39,17 @@
 
 #define ASPEED_ENGINE_ENABLE            BIT(0)
 
+#define ASPEED_ADC_CTRL_INIT_RDY        BIT(8)
+
+#define ASPEED_ADC_INIT_POLLING_TIME    500
+#define ASPEED_ADC_INIT_TIMEOUT         500000
+
 struct aspeed_adc_model_data {
         const char *model_name;
         unsigned int min_sampling_rate; // Hz
         unsigned int max_sampling_rate; // Hz
         unsigned int vref_voltage;      // mV
+        bool wait_init_sequence;
 };
 
 struct aspeed_adc_data {
@@ -211,6 +218,24 @@ static int aspeed_adc_probe(struct platform_device *pdev)
                 goto scaler_error;
         }
 
+        model_data = of_device_get_match_data(&pdev->dev);
+
+        if (model_data->wait_init_sequence) {
+                /* Enable engine in normal mode. */
+                writel(ASPEED_OPERATION_MODE_NORMAL | ASPEED_ENGINE_ENABLE,
+                       data->base + ASPEED_REG_ENGINE_CONTROL);
+
+                /* Wait for initial sequence complete. */
+                ret = readl_poll_timeout(data->base + ASPEED_REG_ENGINE_CONTROL,
+                                         adc_engine_control_reg_val,
+                                         adc_engine_control_reg_val &
+                                         ASPEED_ADC_CTRL_INIT_RDY,
+                                         ASPEED_ADC_INIT_POLLING_TIME,
+                                         ASPEED_ADC_INIT_TIMEOUT);
+                if (ret)
+                        goto scaler_error;
+        }
+
         /* Start all channels in normal mode. */
         ret = clk_prepare_enable(data->clk_scaler->clk);
         if (ret)
@@ -274,6 +299,7 @@ static const struct aspeed_adc_model_data ast2500_model_data = {
         .vref_voltage = 1800, // mV
         .min_sampling_rate = 1,
         .max_sampling_rate = 1000000,
+        .wait_init_sequence = true,
 };
 
 static const struct of_device_id aspeed_adc_matches[] = {
diff --git a/drivers/iio/adc/axp288_adc.c b/drivers/iio/adc/axp288_adc.c
index 64799ad7ebad..462a99c13e7a 100644
--- a/drivers/iio/adc/axp288_adc.c
+++ b/drivers/iio/adc/axp288_adc.c
@@ -28,6 +28,8 @@
 #include <linux/iio/driver.h>
 
 #define AXP288_ADC_EN_MASK              0xF1
+#define AXP288_ADC_TS_PIN_GPADC         0xF2
+#define AXP288_ADC_TS_PIN_ON            0xF3
 
 enum axp288_adc_id {
         AXP288_ADC_TS,
@@ -121,6 +123,26 @@ static int axp288_adc_read_channel(int *val, unsigned long address,
         return IIO_VAL_INT;
 }
 
+static int axp288_adc_set_ts(struct regmap *regmap, unsigned int mode,
+                                unsigned long address)
+{
+        int ret;
+
+        /* channels other than GPADC do not need to switch TS pin */
+        if (address != AXP288_GP_ADC_H)
+                return 0;
+
+        ret = regmap_write(regmap, AXP288_ADC_TS_PIN_CTRL, mode);
+        if (ret)
+                return ret;
+
+        /* When switching to the GPADC pin give things some time to settle */
+        if (mode == AXP288_ADC_TS_PIN_GPADC)
+                usleep_range(6000, 10000);
+
+        return 0;
+}
+
 static int axp288_adc_read_raw(struct iio_dev *indio_dev,
                         struct iio_chan_spec const *chan,
                         int *val, int *val2, long mask)
@@ -131,7 +153,16 @@ static int axp288_adc_read_raw(struct iio_dev *indio_dev,
         mutex_lock(&indio_dev->mlock);
         switch (mask) {
         case IIO_CHAN_INFO_RAW:
+                if (axp288_adc_set_ts(info->regmap, AXP288_ADC_TS_PIN_GPADC,
+                                        chan->address)) {
+                        dev_err(&indio_dev->dev, "GPADC mode\n");
+                        ret = -EINVAL;
+                        break;
+                }
                 ret = axp288_adc_read_channel(val, chan->address, info->regmap);
+                if (axp288_adc_set_ts(info->regmap, AXP288_ADC_TS_PIN_ON,
+                                                chan->address))
+                        dev_err(&indio_dev->dev, "TS pin restore\n");
                 break;
         default:
                 ret = -EINVAL;
@@ -141,6 +172,15 @@ static int axp288_adc_read_raw(struct iio_dev *indio_dev,
         return ret;
 }
 
+static int axp288_adc_set_state(struct regmap *regmap)
+{
+        /* ADC should be always enabled for internal FG to function */
+        if (regmap_write(regmap, AXP288_ADC_TS_PIN_CTRL, AXP288_ADC_TS_PIN_ON))
+                return -EIO;
+
+        return regmap_write(regmap, AXP20X_ADC_EN1, AXP288_ADC_EN_MASK);
+}
+
 static const struct iio_info axp288_adc_iio_info = {
         .read_raw = &axp288_adc_read_raw,
         .driver_module = THIS_MODULE,
@@ -169,7 +209,7 @@ static int axp288_adc_probe(struct platform_device *pdev)
          * Set ADC to enabled state at all time, including system suspend.
          * otherwise internal fuel gauge functionality may be affected.
          */
-        ret = regmap_write(info->regmap, AXP20X_ADC_EN1, AXP288_ADC_EN_MASK);
+        ret = axp288_adc_set_state(axp20x->regmap);
         if (ret) {
                 dev_err(&pdev->dev, "unable to enable ADC device\n");
                 return ret;
diff --git a/drivers/iio/adc/ina2xx-adc.c b/drivers/iio/adc/ina2xx-adc.c
index 232c0b80d658..c3f86138cb55 100644
--- a/drivers/iio/adc/ina2xx-adc.c
+++ b/drivers/iio/adc/ina2xx-adc.c
@@ -644,7 +644,7 @@ static int ina2xx_capture_thread(void *data)
 {
         struct iio_dev *indio_dev = data;
         struct ina2xx_chip_info *chip = iio_priv(indio_dev);
-        unsigned int sampling_us = SAMPLING_PERIOD(chip);
+        int sampling_us = SAMPLING_PERIOD(chip);
         int buffer_us;
 
         /*
diff --git a/drivers/iio/adc/stm32-adc-core.c b/drivers/iio/adc/stm32-adc-core.c
index e09233b03c05..609676384f5e 100644
--- a/drivers/iio/adc/stm32-adc-core.c
+++ b/drivers/iio/adc/stm32-adc-core.c
@@ -64,7 +64,7 @@
 #define STM32H7_CKMODE_MASK             GENMASK(17, 16)
 
 /* STM32 H7 maximum analog clock rate (from datasheet) */
-#define STM32H7_ADC_MAX_CLK_RATE        72000000
+#define STM32H7_ADC_MAX_CLK_RATE        36000000
 
 /**
  * stm32_adc_common_regs - stm32 common registers, compatible dependent data
@@ -148,14 +148,14 @@ static int stm32f4_adc_clk_sel(struct platform_device *pdev,
                 return -EINVAL;
         }
 
-        priv->common.rate = rate;
+        priv->common.rate = rate / stm32f4_pclk_div[i];
         val = readl_relaxed(priv->common.base + STM32F4_ADC_CCR);
         val &= ~STM32F4_ADC_ADCPRE_MASK;
         val |= i << STM32F4_ADC_ADCPRE_SHIFT;
         writel_relaxed(val, priv->common.base + STM32F4_ADC_CCR);
 
         dev_dbg(&pdev->dev, "Using analog clock source at %ld kHz\n",
-                rate / (stm32f4_pclk_div[i] * 1000));
+                priv->common.rate / 1000);
 
         return 0;
 }
@@ -250,7 +250,7 @@ static int stm32h7_adc_clk_sel(struct platform_device *pdev,
 
 out:
         /* rate used later by each ADC instance to control BOOST mode */
-        priv->common.rate = rate;
+        priv->common.rate = rate / div;
 
         /* Set common clock mode and prescaler */
         val = readl_relaxed(priv->common.base + STM32H7_ADC_CCR);
@@ -260,7 +260,7 @@ out:
         writel_relaxed(val, priv->common.base + STM32H7_ADC_CCR);
 
         dev_dbg(&pdev->dev, "Using %s clock/%d source at %ld kHz\n",
-                ckmode ? "bus" : "adc", div, rate / (div * 1000));
+                ckmode ? "bus" : "adc", div, priv->common.rate / 1000);
 
         return 0;
 }
diff --git a/drivers/iio/adc/sun4i-gpadc-iio.c b/drivers/iio/adc/sun4i-gpadc-iio.c
index 81d4c39e414a..137f577d9432 100644
--- a/drivers/iio/adc/sun4i-gpadc-iio.c
+++ b/drivers/iio/adc/sun4i-gpadc-iio.c
@@ -256,6 +256,7 @@ static int sun4i_gpadc_read(struct iio_dev *indio_dev, int channel, int *val,
 
 err:
         pm_runtime_put_autosuspend(indio_dev->dev.parent);
+        disable_irq(irq);
         mutex_unlock(&info->mutex);
 
         return ret;
@@ -365,7 +366,6 @@ static irqreturn_t sun4i_gpadc_temp_data_irq_handler(int irq, void *dev_id)
                 complete(&info->completion);
 
 out:
-        disable_irq_nosync(info->temp_data_irq);
         return IRQ_HANDLED;
 }
 
@@ -380,7 +380,6 @@ static irqreturn_t sun4i_gpadc_fifo_data_irq_handler(int irq, void *dev_id)
                 complete(&info->completion);
 
 out:
-        disable_irq_nosync(info->fifo_data_irq);
         return IRQ_HANDLED;
 }
 
diff --git a/drivers/iio/adc/vf610_adc.c b/drivers/iio/adc/vf610_adc.c
index 01fc76f7d660..c168e0db329a 100644
--- a/drivers/iio/adc/vf610_adc.c
+++ b/drivers/iio/adc/vf610_adc.c
@@ -77,7 +77,7 @@
 #define VF610_ADC_ADSTS_MASK            0x300
 #define VF610_ADC_ADLPC_EN              0x80
 #define VF610_ADC_ADHSC_EN              0x400
-#define VF610_ADC_REFSEL_VALT           0x100
+#define VF610_ADC_REFSEL_VALT           0x800
 #define VF610_ADC_REFSEL_VBG            0x1000
 #define VF610_ADC_ADTRG_HARD            0x2000
 #define VF610_ADC_AVGS_8                0x4000
diff --git a/drivers/iio/common/hid-sensors/hid-sensor-trigger.c b/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
index 16ade0a0327b..0e4b379ada45 100644
--- a/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
+++ b/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
@@ -111,8 +111,6 @@ static int _hid_sensor_power_state(struct hid_sensor_common *st, bool state)
         s32 poll_value = 0;
 
         if (state) {
-                if (!atomic_read(&st->user_requested_state))
-                        return 0;
                 if (sensor_hub_device_open(st->hsdev))
                         return -EIO;
 
@@ -161,6 +159,9 @@ static int _hid_sensor_power_state(struct hid_sensor_common *st, bool state)
                                        &report_val);
         }
 
+        pr_debug("HID_SENSOR %s set power_state %d report_state %d\n",
+                 st->pdev->name, state_val, report_val);
+
         sensor_hub_get_feature(st->hsdev, st->power_state.report_id,
                                st->power_state.index,
                                sizeof(state_val), &state_val);
@@ -182,6 +183,7 @@ int hid_sensor_power_state(struct hid_sensor_common *st, bool state)
                 ret = pm_runtime_get_sync(&st->pdev->dev);
         else {
                 pm_runtime_mark_last_busy(&st->pdev->dev);
+                pm_runtime_use_autosuspend(&st->pdev->dev);
                 ret = pm_runtime_put_autosuspend(&st->pdev->dev);
         }
         if (ret < 0) {
@@ -285,8 +287,6 @@ int hid_sensor_setup_trigger(struct iio_dev *indio_dev, const char *name,
         /* Default to 3 seconds, but can be changed from sysfs */
         pm_runtime_set_autosuspend_delay(&attrb->pdev->dev,
                                          3000);
-        pm_runtime_use_autosuspend(&attrb->pdev->dev);
-
         return ret;
 error_unreg_trigger:
         iio_trigger_unregister(trig);
diff --git a/drivers/iio/common/st_sensors/st_sensors_core.c b/drivers/iio/common/st_sensors/st_sensors_core.c
index 79c8c7cd70d5..6e6a1ecc99dd 100644
--- a/drivers/iio/common/st_sensors/st_sensors_core.c
+++ b/drivers/iio/common/st_sensors/st_sensors_core.c
@@ -550,6 +550,31 @@ out:
 }
 EXPORT_SYMBOL(st_sensors_read_info_raw);
 
+static int st_sensors_init_interface_mode(struct iio_dev *indio_dev,
+                        const struct st_sensor_settings *sensor_settings)
+{
+        struct st_sensor_data *sdata = iio_priv(indio_dev);
+        struct device_node *np = sdata->dev->of_node;
+        struct st_sensors_platform_data *pdata;
+
+        pdata = (struct st_sensors_platform_data *)sdata->dev->platform_data;
+        if (((np && of_property_read_bool(np, "spi-3wire")) ||
+             (pdata && pdata->spi_3wire)) && sensor_settings->sim.addr) {
+                int err;
+
+                err = sdata->tf->write_byte(&sdata->tb, sdata->dev,
+                                            sensor_settings->sim.addr,
+                                            sensor_settings->sim.value);
+                if (err < 0) {
+                        dev_err(&indio_dev->dev,
+                                "failed to init interface mode\n");
+                        return err;
+                }
+        }
+
+        return 0;
+}
+
 int st_sensors_check_device_support(struct iio_dev *indio_dev,
                         int num_sensors_list,
                         const struct st_sensor_settings *sensor_settings)
@@ -574,6 +599,10 @@ int st_sensors_check_device_support(struct iio_dev *indio_dev,
                 return -ENODEV;
         }
 
+        err = st_sensors_init_interface_mode(indio_dev, &sensor_settings[i]);
+        if (err < 0)
+                return err;
+
         if (sensor_settings[i].wai_addr) {
                 err = sdata->tf->read_byte(&sdata->tb, sdata->dev,
                                            sensor_settings[i].wai_addr, &wai);
diff --git a/drivers/iio/imu/adis16480.c b/drivers/iio/imu/adis16480.c
index 8cf84d3488b2..12898424d838 100644
--- a/drivers/iio/imu/adis16480.c
+++ b/drivers/iio/imu/adis16480.c
@@ -696,7 +696,7 @@ static const struct adis16480_chip_info adis16480_chip_info[] = {
                 .gyro_max_val = IIO_RAD_TO_DEGREE(22500),
                 .gyro_max_scale = 450,
                 .accel_max_val = IIO_M_S_2_TO_G(12500),
-                .accel_max_scale = 5,
+                .accel_max_scale = 10,
         },
         [ADIS16485] = {
                 .channels = adis16485_channels,
diff --git a/drivers/iio/light/tsl2563.c b/drivers/iio/light/tsl2563.c
index e7d4ea75e007..7599693f7fe9 100644
--- a/drivers/iio/light/tsl2563.c
+++ b/drivers/iio/light/tsl2563.c
@@ -626,7 +626,7 @@ static irqreturn_t tsl2563_event_handler(int irq, void *private)
         struct tsl2563_chip *chip = iio_priv(dev_info);
 
         iio_push_event(dev_info,
-                       IIO_UNMOD_EVENT_CODE(IIO_LIGHT,
+                       IIO_UNMOD_EVENT_CODE(IIO_INTENSITY,
                                             0,
                                             IIO_EV_TYPE_THRESH,
                                             IIO_EV_DIR_EITHER),
diff --git a/drivers/iio/magnetometer/st_magn_core.c b/drivers/iio/magnetometer/st_magn_core.c
index 8e1b0861fbe4..c38563699984 100644
--- a/drivers/iio/magnetometer/st_magn_core.c
+++ b/drivers/iio/magnetometer/st_magn_core.c
@@ -356,9 +356,7 @@ static const struct st_sensor_settings st_magn_sensors_settings[] = {
                 .drdy_irq = {
                         .addr = 0x62,
                         .mask_int1 = 0x01,
-                        .addr_ihl = 0x63,
-                        .mask_ihl = 0x04,
-                        .addr_stat_drdy = ST_SENSORS_DEFAULT_STAT_ADDR,
+                        .addr_stat_drdy = 0x67,
                 },
                 .multi_read_bit = false,
                 .bootime = 2,
diff --git a/drivers/iio/pressure/bmp280-core.c b/drivers/iio/pressure/bmp280-core.c
index d82b788374b6..0d2ea3ee371b 100644
--- a/drivers/iio/pressure/bmp280-core.c
+++ b/drivers/iio/pressure/bmp280-core.c
@@ -282,6 +282,11 @@ static int bmp280_read_temp(struct bmp280_data *data,
         }
 
         adc_temp = be32_to_cpu(tmp) >> 12;
+        if (adc_temp == BMP280_TEMP_SKIPPED) {
+                /* reading was skipped */
+                dev_err(data->dev, "reading temperature skipped\n");
+                return -EIO;
+        }
         comp_temp = bmp280_compensate_temp(data, adc_temp);
 
         /*
@@ -317,6 +322,11 @@ static int bmp280_read_press(struct bmp280_data *data,
         }
 
         adc_press = be32_to_cpu(tmp) >> 12;
+        if (adc_press == BMP280_PRESS_SKIPPED) {
+                /* reading was skipped */
+                dev_err(data->dev, "reading pressure skipped\n");
+                return -EIO;
+        }
         comp_press = bmp280_compensate_press(data, adc_press);
 
         *val = comp_press;
@@ -345,6 +355,11 @@ static int bmp280_read_humid(struct bmp280_data *data, int *val, int *val2)
         }
 
         adc_humidity = be16_to_cpu(tmp);
+        if (adc_humidity == BMP280_HUMIDITY_SKIPPED) {
+                /* reading was skipped */
+                dev_err(data->dev, "reading humidity skipped\n");
+                return -EIO;
+        }
         comp_humidity = bmp280_compensate_humidity(data, adc_humidity);
 
         *val = comp_humidity;
@@ -597,14 +612,20 @@ static const struct bmp280_chip_info bmp280_chip_info = {
 
 static int bme280_chip_config(struct bmp280_data *data)
 {
-        int ret = bmp280_chip_config(data);
+        int ret;
         u8 osrs = BMP280_OSRS_HUMIDITIY_X(data->oversampling_humid + 1);
 
+        /*
+         * Oversampling of humidity must be set before oversampling of
+         * temperature/pressure is set to become effective.
+         */
+        ret = regmap_update_bits(data->regmap, BMP280_REG_CTRL_HUMIDITY,
+                                  BMP280_OSRS_HUMIDITY_MASK, osrs);
+
         if (ret < 0)
                 return ret;
 
-        return regmap_update_bits(data->regmap, BMP280_REG_CTRL_HUMIDITY,
-                                  BMP280_OSRS_HUMIDITY_MASK, osrs);
+        return bmp280_chip_config(data);
 }
 
 static const struct bmp280_chip_info bme280_chip_info = {
diff --git a/drivers/iio/pressure/bmp280.h b/drivers/iio/pressure/bmp280.h
index 2c770e13be0e..61347438b779 100644
--- a/drivers/iio/pressure/bmp280.h
+++ b/drivers/iio/pressure/bmp280.h
@@ -96,6 +96,11 @@
 #define BME280_CHIP_ID                  0x60
 #define BMP280_SOFT_RESET_VAL           0xB6
 
+/* BMP280 register skipped special values */
+#define BMP280_TEMP_SKIPPED             0x80000
+#define BMP280_PRESS_SKIPPED            0x80000
+#define BMP280_HUMIDITY_SKIPPED         0x8000
+
 /* Regmap configurations */
 extern const struct regmap_config bmp180_regmap_config;
 extern const struct regmap_config bmp280_regmap_config;
diff --git a/drivers/iio/pressure/st_pressure_core.c b/drivers/iio/pressure/st_pressure_core.c
index aa61ec15c139..f1bce05ffa13 100644
--- a/drivers/iio/pressure/st_pressure_core.c
+++ b/drivers/iio/pressure/st_pressure_core.c
@@ -456,7 +456,7 @@ static const struct st_sensor_settings st_press_sensors_settings[] = {
                         .mask_od = 0x40,
                         .addr_stat_drdy = ST_SENSORS_DEFAULT_STAT_ADDR,
                 },
-                .multi_read_bit = true,
+                .multi_read_bit = false,
                 .bootime = 2,
         },
 };
diff --git a/drivers/iio/trigger/stm32-timer-trigger.c b/drivers/iio/trigger/stm32-timer-trigger.c
index d22bc56dd9fc..25ad6abfee22 100644
--- a/drivers/iio/trigger/stm32-timer-trigger.c
+++ b/drivers/iio/trigger/stm32-timer-trigger.c
@@ -366,34 +366,32 @@ static int stm32_counter_read_raw(struct iio_dev *indio_dev,
                                   int *val, int *val2, long mask)
 {
         struct stm32_timer_trigger *priv = iio_priv(indio_dev);
+        u32 dat;
 
         switch (mask) {
         case IIO_CHAN_INFO_RAW:
-        {
-                u32 cnt;
-
-                regmap_read(priv->regmap, TIM_CNT, &cnt);
-                *val = cnt;
+                regmap_read(priv->regmap, TIM_CNT, &dat);
+                *val = dat;
+                return IIO_VAL_INT;
 
+        case IIO_CHAN_INFO_ENABLE:
+                regmap_read(priv->regmap, TIM_CR1, &dat);
+                *val = (dat & TIM_CR1_CEN) ? 1 : 0;
                 return IIO_VAL_INT;
-        }
-        case IIO_CHAN_INFO_SCALE:
-        {
-                u32 smcr;
 
-                regmap_read(priv->regmap, TIM_SMCR, &smcr);
-                smcr &= TIM_SMCR_SMS;
+        case IIO_CHAN_INFO_SCALE:
+                regmap_read(priv->regmap, TIM_SMCR, &dat);
+                dat &= TIM_SMCR_SMS;
 
                 *val = 1;
                 *val2 = 0;
 
                 /* in quadrature case scale = 0.25 */
-                if (smcr == 3)
+                if (dat == 3)
                         *val2 = 2;
 
                 return IIO_VAL_FRACTIONAL_LOG2;
         }
-        }
 
         return -EINVAL;
 }
@@ -403,15 +401,31 @@ static int stm32_counter_write_raw(struct iio_dev *indio_dev,
                                    int val, int val2, long mask)
 {
         struct stm32_timer_trigger *priv = iio_priv(indio_dev);
+        u32 dat;
 
         switch (mask) {
         case IIO_CHAN_INFO_RAW:
-                regmap_write(priv->regmap, TIM_CNT, val);
+                return regmap_write(priv->regmap, TIM_CNT, val);
 
-                return IIO_VAL_INT;
         case IIO_CHAN_INFO_SCALE:
                 /* fixed scale */
                 return -EINVAL;
+
+        case IIO_CHAN_INFO_ENABLE:
+                if (val) {
+                        regmap_read(priv->regmap, TIM_CR1, &dat);
+                        if (!(dat & TIM_CR1_CEN))
+                                clk_enable(priv->clk);
+                        regmap_update_bits(priv->regmap, TIM_CR1, TIM_CR1_CEN,
+                                           TIM_CR1_CEN);
+                } else {
+                        regmap_read(priv->regmap, TIM_CR1, &dat);
+                        regmap_update_bits(priv->regmap, TIM_CR1, TIM_CR1_CEN,
+                                           0);
+                        if (dat & TIM_CR1_CEN)
+                                clk_disable(priv->clk);
+                }
+                return 0;
         }
 
         return -EINVAL;
@@ -471,7 +485,7 @@ static int stm32_get_trigger_mode(struct iio_dev *indio_dev,
 
         regmap_read(priv->regmap, TIM_SMCR, &smcr);
 
-        return smcr == TIM_SMCR_SMS ? 0 : -EINVAL;
+        return (smcr & TIM_SMCR_SMS) == TIM_SMCR_SMS ? 0 : -EINVAL;
 }
 
 static const struct iio_enum stm32_trigger_mode_enum = {
@@ -507,9 +521,19 @@ static int stm32_set_enable_mode(struct iio_dev *indio_dev,
 {
         struct stm32_timer_trigger *priv = iio_priv(indio_dev);
         int sms = stm32_enable_mode2sms(mode);
+        u32 val;
 
         if (sms < 0)
                 return sms;
+        /*
+         * Triggered mode sets CEN bit automatically by hardware. So, first
+         * enable counter clock, so it can use it. Keeps it in sync with CEN.
+         */
+        if (sms == 6) {
+                regmap_read(priv->regmap, TIM_CR1, &val);
+                if (!(val & TIM_CR1_CEN))
+                        clk_enable(priv->clk);
+        }
 
         regmap_update_bits(priv->regmap, TIM_SMCR, TIM_SMCR_SMS, sms);
 
@@ -571,11 +595,14 @@ static int stm32_get_quadrature_mode(struct iio_dev *indio_dev,
 {
         struct stm32_timer_trigger *priv = iio_priv(indio_dev);
         u32 smcr;
+        int mode;
 
         regmap_read(priv->regmap, TIM_SMCR, &smcr);
-        smcr &= TIM_SMCR_SMS;
+        mode = (smcr & TIM_SMCR_SMS) - 1;
+        if ((mode < 0) || (mode > ARRAY_SIZE(stm32_quadrature_modes)))
+                return -EINVAL;
 
-        return smcr - 1;
+        return mode;
 }
 
 static const struct iio_enum stm32_quadrature_mode_enum = {
@@ -592,13 +619,20 @@ static const char *const stm32_count_direction_states[] = {
 
 static int stm32_set_count_direction(struct iio_dev *indio_dev,
                                      const struct iio_chan_spec *chan,
-                                     unsigned int mode)
+                                     unsigned int dir)
 {
         struct stm32_timer_trigger *priv = iio_priv(indio_dev);
+        u32 val;
+        int mode;
 
-        regmap_update_bits(priv->regmap, TIM_CR1, TIM_CR1_DIR, mode);
+        /* In encoder mode, direction is RO (given by TI1/TI2 signals) */
+        regmap_read(priv->regmap, TIM_SMCR, &val);
+        mode = (val & TIM_SMCR_SMS) - 1;
+        if ((mode >= 0) || (mode < ARRAY_SIZE(stm32_quadrature_modes)))
+                return -EBUSY;
 
-        return 0;
+        return regmap_update_bits(priv->regmap, TIM_CR1, TIM_CR1_DIR,
+                                  dir ? TIM_CR1_DIR : 0);
 }
 
 static int stm32_get_count_direction(struct iio_dev *indio_dev,
@@ -609,7 +643,7 @@ static int stm32_get_count_direction(struct iio_dev *indio_dev,
 
         regmap_read(priv->regmap, TIM_CR1, &cr1);
 
-        return (cr1 & TIM_CR1_DIR);
+        return ((cr1 & TIM_CR1_DIR) ? 1 : 0);
 }
 
 static const struct iio_enum stm32_count_direction_enum = {
@@ -672,7 +706,9 @@ static const struct iio_chan_spec_ext_info stm32_trigger_count_info[] = {
 static const struct iio_chan_spec stm32_trigger_channel = {
         .type = IIO_COUNT,
         .channel = 0,
-        .info_mask_separate = BIT(IIO_CHAN_INFO_RAW) | BIT(IIO_CHAN_INFO_SCALE),
+        .info_mask_separate = BIT(IIO_CHAN_INFO_RAW) |
+                              BIT(IIO_CHAN_INFO_ENABLE) |
+                              BIT(IIO_CHAN_INFO_SCALE),
         .ext_info = stm32_trigger_count_info,
         .indexed = 1
 };
diff --git a/drivers/infiniband/core/addr.c b/drivers/infiniband/core/addr.c
index 01236cef7bfb..437522ca97b4 100644
--- a/drivers/infiniband/core/addr.c
+++ b/drivers/infiniband/core/addr.c
@@ -61,6 +61,7 @@ struct addr_req {
         void (*callback)(int status, struct sockaddr *src_addr,
                          struct rdma_dev_addr *addr, void *context);
         unsigned long timeout;
+        struct delayed_work work;
         int status;
         u32 seq;
 };
@@ -295,7 +296,7 @@ int rdma_translate_ip(const struct sockaddr *addr,
 }
 EXPORT_SYMBOL(rdma_translate_ip);
 
-static void set_timeout(unsigned long time)
+static void set_timeout(struct delayed_work *delayed_work, unsigned long time)
 {
         unsigned long delay;
 
@@ -303,7 +304,7 @@ static void set_timeout(unsigned long time)
         if ((long)delay < 0)
                 delay = 0;
 
-        mod_delayed_work(addr_wq, &work, delay);
+        mod_delayed_work(addr_wq, delayed_work, delay);
 }
 
 static void queue_req(struct addr_req *req)
@@ -318,8 +319,7 @@ static void queue_req(struct addr_req *req)
 
         list_add(&req->list, &temp_req->list);
 
-        if (req_list.next == &req->list)
-                set_timeout(req->timeout);
+        set_timeout(&req->work, req->timeout);
         mutex_unlock(&lock);
 }
 
@@ -574,6 +574,37 @@ static int addr_resolve(struct sockaddr *src_in,
         return ret;
 }
 
+static void process_one_req(struct work_struct *_work)
+{
+        struct addr_req *req;
+        struct sockaddr *src_in, *dst_in;
+
+        mutex_lock(&lock);
+        req = container_of(_work, struct addr_req, work.work);
+
+        if (req->status == -ENODATA) {
+                src_in = (struct sockaddr *)&req->src_addr;
+                dst_in = (struct sockaddr *)&req->dst_addr;
+                req->status = addr_resolve(src_in, dst_in, req->addr,
+                                           true, req->seq);
+                if (req->status && time_after_eq(jiffies, req->timeout)) {
+                        req->status = -ETIMEDOUT;
+                } else if (req->status == -ENODATA) {
+                        /* requeue the work for retrying again */
+                        set_timeout(&req->work, req->timeout);
+                        mutex_unlock(&lock);
+                        return;
+                }
+        }
+        list_del(&req->list);
+        mutex_unlock(&lock);
+
+        req->callback(req->status, (struct sockaddr *)&req->src_addr,
+                req->addr, req->context);
+        put_client(req->client);
+        kfree(req);
+}
+
 static void process_req(struct work_struct *work)
 {
         struct addr_req *req, *temp_req;
@@ -591,20 +622,23 @@ static void process_req(struct work_struct *work)
                                                    true, req->seq);
                         if (req->status && time_after_eq(jiffies, req->timeout))
                                 req->status = -ETIMEDOUT;
-                        else if (req->status == -ENODATA)
+                        else if (req->status == -ENODATA) {
+                                set_timeout(&req->work, req->timeout);
                                 continue;
+                        }
                 }
                 list_move_tail(&req->list, &done_list);
         }
 
-        if (!list_empty(&req_list)) {
-                req = list_entry(req_list.next, struct addr_req, list);
-                set_timeout(req->timeout);
-        }
         mutex_unlock(&lock);
 
         list_for_each_entry_safe(req, temp_req, &done_list, list) {
                 list_del(&req->list);
+                /* It is safe to cancel other work items from this work item
+                 * because at a time there can be only one work item running
+                 * with this single threaded work queue.
+                 */
+                cancel_delayed_work(&req->work);
                 req->callback(req->status, (struct sockaddr *) &req->src_addr,
                         req->addr, req->context);
                 put_client(req->client);
@@ -647,6 +681,7 @@ int rdma_resolve_ip(struct rdma_addr_client *client,
         req->context = context;
         req->client = client;
         atomic_inc(&client->refcount);
+        INIT_DELAYED_WORK(&req->work, process_one_req);
         req->seq = (u32)atomic_inc_return(&ib_nl_addr_request_seq);
 
         req->status = addr_resolve(src_in, dst_in, addr, true, req->seq);
@@ -701,7 +736,7 @@ void rdma_addr_cancel(struct rdma_dev_addr *addr)
                         req->status = -ECANCELED;
                         req->timeout = jiffies;
                         list_move(&req->list, &req_list);
-                        set_timeout(req->timeout);
+                        set_timeout(&req->work, req->timeout);
                         break;
                 }
         }
@@ -807,9 +842,8 @@ static int netevent_callback(struct notifier_block *self, unsigned long event,
         if (event == NETEVENT_NEIGH_UPDATE) {
                 struct neighbour *neigh = ctx;
 
-                if (neigh->nud_state & NUD_VALID) {
-                        set_timeout(jiffies);
-                }
+                if (neigh->nud_state & NUD_VALID)
+                        set_timeout(&work, jiffies);
         }
         return 0;
 }
@@ -820,7 +854,7 @@ static struct notifier_block nb = {
 
 int addr_init(void)
 {
-        addr_wq = alloc_workqueue("ib_addr", WQ_MEM_RECLAIM, 0);
+        addr_wq = alloc_ordered_workqueue("ib_addr", WQ_MEM_RECLAIM);
         if (!addr_wq)
                 return -ENOMEM;
 
diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
index a5dfab6adf49..221468f77128 100644
--- a/drivers/infiniband/core/device.c
+++ b/drivers/infiniband/core/device.c
@@ -537,10 +537,11 @@ void ib_unregister_device(struct ib_device *device)
         }
         up_read(&lists_rwsem);
 
-        mutex_unlock(&device_mutex);
-
         ib_device_unregister_rdmacg(device);
         ib_device_unregister_sysfs(device);
+
+        mutex_unlock(&device_mutex);
+
         ib_cache_cleanup_one(device);
 
         ib_security_destroy_port_pkey_list(device);
diff --git a/drivers/infiniband/core/umem_odp.c b/drivers/infiniband/core/umem_odp.c
index 8c4ec564e495..55e8f5ed8b3c 100644
--- a/drivers/infiniband/core/umem_odp.c
+++ b/drivers/infiniband/core/umem_odp.c
@@ -166,24 +166,6 @@ static int invalidate_page_trampoline(struct ib_umem *item, u64 start,
         return 0;
 }
 
-static void ib_umem_notifier_invalidate_page(struct mmu_notifier *mn,
-                                             struct mm_struct *mm,
-                                             unsigned long address)
-{
-        struct ib_ucontext *context = container_of(mn, struct ib_ucontext, mn);
-
-        if (!context->invalidate_range)
-                return;
-
-        ib_ucontext_notifier_start_account(context);
-        down_read(&context->umem_rwsem);
-        rbt_ib_umem_for_each_in_range(&context->umem_tree, address,
-                                      address + PAGE_SIZE,
-                                      invalidate_page_trampoline, NULL);
-        up_read(&context->umem_rwsem);
-        ib_ucontext_notifier_end_account(context);
-}
-
 static int invalidate_range_start_trampoline(struct ib_umem *item, u64 start,
                                              u64 end, void *cookie)
 {
@@ -237,7 +219,6 @@ static void ib_umem_notifier_invalidate_range_end(struct mmu_notifier *mn,
 
 static const struct mmu_notifier_ops ib_umem_notifiers = {
         .release                    = ib_umem_notifier_release,
-        .invalidate_page            = ib_umem_notifier_invalidate_page,
         .invalidate_range_start     = ib_umem_notifier_invalidate_range_start,
         .invalidate_range_end       = ib_umem_notifier_invalidate_range_end,
 };
diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
index 2c98533a0203..739bd69ef1d4 100644
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -1015,7 +1015,7 @@ static struct ib_ucq_object *create_cq(struct ib_uverbs_file *file,
         cq->uobject       = &obj->uobject;
         cq->comp_handler  = ib_uverbs_comp_handler;
         cq->event_handler = ib_uverbs_cq_event_handler;
-        cq->cq_context    = &ev_file->ev_queue;
+        cq->cq_context    = ev_file ? &ev_file->ev_queue : NULL;
         atomic_set(&cq->usecnt, 0);
 
         obj->uobject.object = cq;
@@ -1153,7 +1153,7 @@ ssize_t ib_uverbs_resize_cq(struct ib_uverbs_file *file,
                             int out_len)
 {
         struct ib_uverbs_resize_cq      cmd;
-        struct ib_uverbs_resize_cq_resp resp;
+        struct ib_uverbs_resize_cq_resp resp = {};
         struct ib_udata                 udata;
         struct ib_cq                    *cq;
         int                             ret = -EINVAL;
@@ -1522,6 +1522,7 @@ static int create_qp(struct ib_uverbs_file *file,
                 qp->qp_type       = attr.qp_type;
                 atomic_set(&qp->usecnt, 0);
                 atomic_inc(&pd->usecnt);
+                qp->port = 0;
                 if (attr.send_cq)
                         atomic_inc(&attr.send_cq->usecnt);
                 if (attr.recv_cq)
@@ -1962,8 +1963,9 @@ static int modify_qp(struct ib_uverbs_file *file,
         attr->alt_timeout         = cmd->base.alt_timeout;
         attr->rate_limit          = cmd->rate_limit;
 
-        attr->ah_attr.type = rdma_ah_find_type(qp->device,
-                                               cmd->base.dest.port_num);
+        if (cmd->base.attr_mask & IB_QP_AV)
+                attr->ah_attr.type = rdma_ah_find_type(qp->device,
+                                                       cmd->base.dest.port_num);
         if (cmd->base.dest.is_global) {
                 rdma_ah_set_grh(&attr->ah_attr, NULL,
                                 cmd->base.dest.flow_label,
@@ -1981,8 +1983,9 @@ static int modify_qp(struct ib_uverbs_file *file,
         rdma_ah_set_port_num(&attr->ah_attr,
                              cmd->base.dest.port_num);
 
-        attr->alt_ah_attr.type = rdma_ah_find_type(qp->device,
-                                                   cmd->base.dest.port_num);
+        if (cmd->base.attr_mask & IB_QP_ALT_PATH)
+                attr->alt_ah_attr.type =
+                        rdma_ah_find_type(qp->device, cmd->base.dest.port_num);
         if (cmd->base.alt_dest.is_global) {
                 rdma_ah_set_grh(&attr->alt_ah_attr, NULL,
                                 cmd->base.alt_dest.flow_label,
diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
index 3d2609608f58..5e530d2bee44 100644
--- a/drivers/infiniband/core/uverbs_main.c
+++ b/drivers/infiniband/core/uverbs_main.c
@@ -250,6 +250,7 @@ void ib_uverbs_release_file(struct kref *ref)
         if (atomic_dec_and_test(&file->device->refcount))
                 ib_uverbs_comp_dev(file->device);
 
+        kobject_put(&file->device->kobj);
         kfree(file);
 }
 
@@ -917,7 +918,6 @@ err:
 static int ib_uverbs_close(struct inode *inode, struct file *filp)
 {
         struct ib_uverbs_file *file = filp->private_data;
-        struct ib_uverbs_device *dev = file->device;
 
         mutex_lock(&file->cleanup_mutex);
         if (file->ucontext) {
@@ -939,7 +939,6 @@ static int ib_uverbs_close(struct inode *inode, struct file *filp)
                          ib_uverbs_release_async_event_file);
 
         kref_put(&file->ref, ib_uverbs_release_file);
-        kobject_put(&dev->kobj);
 
         return 0;
 }
@@ -1154,7 +1153,6 @@ static void ib_uverbs_free_hw_resources(struct ib_uverbs_device *uverbs_dev,
                 kref_get(&file->ref);
                 mutex_unlock(&uverbs_dev->lists_mutex);
 
-                ib_uverbs_event_handler(&file->event_handler, &event);
 
                 mutex_lock(&file->cleanup_mutex);
                 ucontext = file->ucontext;
@@ -1171,6 +1169,7 @@ static void ib_uverbs_free_hw_resources(struct ib_uverbs_device *uverbs_dev,
                          * for example due to freeing the resources
                          * (e.g mmput).
                          */
+                        ib_uverbs_event_handler(&file->event_handler, &event);
                         ib_dev->disassociate_ucontext(ucontext);
                         mutex_lock(&file->cleanup_mutex);
                         ib_uverbs_cleanup_ucontext(file, ucontext, true);
diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c
index fb98ed67d5bc..b456e3ca1876 100644
--- a/drivers/infiniband/core/verbs.c
+++ b/drivers/infiniband/core/verbs.c
@@ -838,6 +838,7 @@ struct ib_qp *ib_create_qp(struct ib_pd *pd,
         spin_lock_init(&qp->mr_lock);
         INIT_LIST_HEAD(&qp->rdma_mrs);
         INIT_LIST_HEAD(&qp->sig_mrs);
+        qp->port = 0;
 
         if (qp_init_attr->qp_type == IB_QPT_XRC_TGT)
                 return ib_create_xrc_qp(qp, qp_init_attr);
@@ -895,7 +896,6 @@ static const struct {
 } qp_state_table[IB_QPS_ERR + 1][IB_QPS_ERR + 1] = {
         [IB_QPS_RESET] = {
                 [IB_QPS_RESET] = { .valid = 1 },
-                [IB_QPS_ERR] =   { .valid = 1 },
                 [IB_QPS_INIT]  = {
                         .valid = 1,
                         .req_param = {
@@ -1298,7 +1298,11 @@ int ib_modify_qp_with_udata(struct ib_qp *qp, struct ib_qp_attr *attr,
                 if (ret)
                         return ret;
         }
-        return ib_security_modify_qp(qp, attr, attr_mask, udata);
+        ret = ib_security_modify_qp(qp, attr, attr_mask, udata);
+        if (!ret && (attr_mask & IB_QP_PORT))
+                qp->port = attr->port_num;
+
+        return ret;
 }
 EXPORT_SYMBOL(ib_modify_qp_with_udata);
 
diff --git a/drivers/infiniband/hw/cxgb4/mem.c b/drivers/infiniband/hw/cxgb4/mem.c
index 5332f06b99ba..c2fba76becd4 100644
--- a/drivers/infiniband/hw/cxgb4/mem.c
+++ b/drivers/infiniband/hw/cxgb4/mem.c
@@ -661,7 +661,7 @@ struct ib_mr *c4iw_alloc_mr(struct ib_pd *pd,
         rhp = php->rhp;
 
         if (mr_type != IB_MR_TYPE_MEM_REG ||
-            max_num_sg > t4_max_fr_depth(&rhp->rdev.lldi.ulptx_memwrite_dsgl &&
+            max_num_sg > t4_max_fr_depth(rhp->rdev.lldi.ulptx_memwrite_dsgl &&
                                          use_dsgl))
                 return ERR_PTR(-EINVAL);
 
diff --git a/drivers/infiniband/hw/hfi1/mmu_rb.c b/drivers/infiniband/hw/hfi1/mmu_rb.c
index ccbf52c8ff6f..e4b56a0dd6d0 100644
--- a/drivers/infiniband/hw/hfi1/mmu_rb.c
+++ b/drivers/infiniband/hw/hfi1/mmu_rb.c
@@ -67,8 +67,6 @@ struct mmu_rb_handler {
 
 static unsigned long mmu_node_start(struct mmu_rb_node *);
 static unsigned long mmu_node_last(struct mmu_rb_node *);
-static inline void mmu_notifier_page(struct mmu_notifier *, struct mm_struct *,
-                                     unsigned long);
 static inline void mmu_notifier_range_start(struct mmu_notifier *,
                                             struct mm_struct *,
                                             unsigned long, unsigned long);
@@ -82,7 +80,6 @@ static void do_remove(struct mmu_rb_handler *handler,
 static void handle_remove(struct work_struct *work);
 
 static const struct mmu_notifier_ops mn_opts = {
-        .invalidate_page = mmu_notifier_page,
         .invalidate_range_start = mmu_notifier_range_start,
 };
 
@@ -285,12 +282,6 @@ void hfi1_mmu_rb_remove(struct mmu_rb_handler *handler,
         handler->ops->remove(handler->ops_arg, node);
 }
 
-static inline void mmu_notifier_page(struct mmu_notifier *mn,
-                                     struct mm_struct *mm, unsigned long addr)
-{
-        mmu_notifier_mem_invalidate(mn, mm, addr, addr + PAGE_SIZE);
-}
-
 static inline void mmu_notifier_range_start(struct mmu_notifier *mn,
                                             struct mm_struct *mm,
                                             unsigned long start,
diff --git a/drivers/infiniband/hw/hns/hns_roce_ah.c b/drivers/infiniband/hw/hns/hns_roce_ah.c
index f78a733a63ec..d545302b8ef8 100644
--- a/drivers/infiniband/hw/hns/hns_roce_ah.c
+++ b/drivers/infiniband/hw/hns/hns_roce_ah.c
@@ -64,8 +64,10 @@ struct ib_ah *hns_roce_create_ah(struct ib_pd *ibpd,
         } else {
                 u8 *dmac = rdma_ah_retrieve_dmac(ah_attr);
 
-                if (!dmac)
+                if (!dmac) {
+                        kfree(ah);
                         return ERR_PTR(-EINVAL);
+                }
                 memcpy(ah->av.mac, dmac, ETH_ALEN);
         }
 
diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v1.c b/drivers/infiniband/hw/hns/hns_roce_hw_v1.c
index 23fad6d96944..2540b65e242c 100644
--- a/drivers/infiniband/hw/hns/hns_roce_hw_v1.c
+++ b/drivers/infiniband/hw/hns/hns_roce_hw_v1.c
@@ -733,7 +733,7 @@ static int hns_roce_v1_rsv_lp_qp(struct hns_roce_dev *hr_dev)
                         continue;
 
                 free_mr->mr_free_qp[i] = hns_roce_v1_create_lp_qp(hr_dev, pd);
-                if (IS_ERR(free_mr->mr_free_qp[i])) {
+                if (!free_mr->mr_free_qp[i]) {
                         dev_err(dev, "Create loop qp failed!\n");
                         goto create_lp_qp_failed;
                 }
diff --git a/drivers/infiniband/hw/i40iw/i40iw_ctrl.c b/drivers/infiniband/hw/i40iw/i40iw_ctrl.c
index 9ec1ae9a82c9..a49ff2eb6fb3 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_ctrl.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_ctrl.c
@@ -130,20 +130,32 @@ static enum i40iw_status_code i40iw_sc_parse_fpm_commit_buf(
         u64 base = 0;
         u32 i, j;
         u32 k = 0;
-        u32 low;
 
         /* copy base values in obj_info */
-        for (i = I40IW_HMC_IW_QP, j = 0;
-                        i <= I40IW_HMC_IW_PBLE; i++, j += 8) {
+        for (i = I40IW_HMC_IW_QP, j = 0; i <= I40IW_HMC_IW_PBLE; i++, j += 8) {
+                if ((i == I40IW_HMC_IW_SRQ) ||
+                        (i == I40IW_HMC_IW_FSIMC) ||
+                        (i == I40IW_HMC_IW_FSIAV)) {
+                        info[i].base = 0;
+                        info[i].cnt = 0;
+                        continue;
+                }
                 get_64bit_val(buf, j, &temp);
                 info[i].base = RS_64_1(temp, 32) * 512;
                 if (info[i].base > base) {
                         base = info[i].base;
                         k = i;
                 }
-                low = (u32)(temp);
-                if (low)
-                        info[i].cnt = low;
+                if (i == I40IW_HMC_IW_APBVT_ENTRY) {
+                        info[i].cnt = 1;
+                        continue;
+                }
+                if (i == I40IW_HMC_IW_QP)
+                        info[i].cnt = (u32)RS_64(temp, I40IW_QUERY_FPM_MAX_QPS);
+                else if (i == I40IW_HMC_IW_CQ)
+                        info[i].cnt = (u32)RS_64(temp, I40IW_QUERY_FPM_MAX_CQS);
+                else
+                        info[i].cnt = (u32)(temp);
         }
         size = info[k].cnt * info[k].size + info[k].base;
         if (size & 0x1FFFFF)
@@ -155,6 +167,31 @@ static enum i40iw_status_code i40iw_sc_parse_fpm_commit_buf(
 }
 
 /**
+ * i40iw_sc_decode_fpm_query() - Decode a 64 bit value into max count and size
+ * @buf: ptr to fpm query buffer
+ * @buf_idx: index into buf
+ * @info: ptr to i40iw_hmc_obj_info struct
+ * @rsrc_idx: resource index into info
+ *
+ * Decode a 64 bit value from fpm query buffer into max count and size
+ */
+static u64 i40iw_sc_decode_fpm_query(u64 *buf,
+                                            u32 buf_idx,
+                                            struct i40iw_hmc_obj_info *obj_info,
+                                            u32 rsrc_idx)
+{
+        u64 temp;
+        u32 size;
+
+        get_64bit_val(buf, buf_idx, &temp);
+        obj_info[rsrc_idx].max_cnt = (u32)temp;
+        size = (u32)RS_64_1(temp, 32);
+        obj_info[rsrc_idx].size = LS_64_1(1, size);
+
+        return temp;
+}
+
+/**
  * i40iw_sc_parse_fpm_query_buf() - parses fpm query buffer
  * @buf: ptr to fpm query buffer
  * @info: ptr to i40iw_hmc_obj_info struct
@@ -168,9 +205,9 @@ static enum i40iw_status_code i40iw_sc_parse_fpm_query_buf(
                                 struct i40iw_hmc_info *hmc_info,
                                 struct i40iw_hmc_fpm_misc *hmc_fpm_misc)
 {
-        u64 temp;
         struct i40iw_hmc_obj_info *obj_info;
-        u32 i, j, size;
+        u64 temp;
+        u32 size;
         u16 max_pe_sds;
 
         obj_info = hmc_info->hmc_obj;
@@ -185,41 +222,52 @@ static enum i40iw_status_code i40iw_sc_parse_fpm_query_buf(
         hmc_fpm_misc->max_sds = max_pe_sds;
         hmc_info->sd_table.sd_cnt = max_pe_sds + hmc_info->first_sd_index;
 
-        for (i = I40IW_HMC_IW_QP, j = 8;
-             i <= I40IW_HMC_IW_ARP; i++, j += 8) {
-                get_64bit_val(buf, j, &temp);
-                if (i == I40IW_HMC_IW_QP)
-                        obj_info[i].max_cnt = (u32)RS_64(temp, I40IW_QUERY_FPM_MAX_QPS);
-                else if (i == I40IW_HMC_IW_CQ)
-                        obj_info[i].max_cnt = (u32)RS_64(temp, I40IW_QUERY_FPM_MAX_CQS);
-                else
-                        obj_info[i].max_cnt = (u32)temp;
+        get_64bit_val(buf, 8, &temp);
+        obj_info[I40IW_HMC_IW_QP].max_cnt = (u32)RS_64(temp, I40IW_QUERY_FPM_MAX_QPS);
+        size = (u32)RS_64_1(temp, 32);
+        obj_info[I40IW_HMC_IW_QP].size = LS_64_1(1, size);
 
-                size = (u32)RS_64_1(temp, 32);
-                obj_info[i].size = ((u64)1 << size);
-        }
-        for (i = I40IW_HMC_IW_MR, j = 48;
-                        i <= I40IW_HMC_IW_PBLE; i++, j += 8) {
-                get_64bit_val(buf, j, &temp);
-                obj_info[i].max_cnt = (u32)temp;
-                size = (u32)RS_64_1(temp, 32);
-                obj_info[i].size = LS_64_1(1, size);
-        }
+        get_64bit_val(buf, 16, &temp);
+        obj_info[I40IW_HMC_IW_CQ].max_cnt = (u32)RS_64(temp, I40IW_QUERY_FPM_MAX_CQS);
+        size = (u32)RS_64_1(temp, 32);
+        obj_info[I40IW_HMC_IW_CQ].size = LS_64_1(1, size);
+
+        i40iw_sc_decode_fpm_query(buf, 32, obj_info, I40IW_HMC_IW_HTE);
+        i40iw_sc_decode_fpm_query(buf, 40, obj_info, I40IW_HMC_IW_ARP);
+
+        obj_info[I40IW_HMC_IW_APBVT_ENTRY].size = 8192;
+        obj_info[I40IW_HMC_IW_APBVT_ENTRY].max_cnt = 1;
+
+        i40iw_sc_decode_fpm_query(buf, 48, obj_info, I40IW_HMC_IW_MR);
+        i40iw_sc_decode_fpm_query(buf, 56, obj_info, I40IW_HMC_IW_XF);
 
-        get_64bit_val(buf, 120, &temp);
-        hmc_fpm_misc->max_ceqs = (u8)RS_64(temp, I40IW_QUERY_FPM_MAX_CEQS);
-        get_64bit_val(buf, 120, &temp);
-        hmc_fpm_misc->ht_multiplier = RS_64(temp, I40IW_QUERY_FPM_HTMULTIPLIER);
-        get_64bit_val(buf, 120, &temp);
-        hmc_fpm_misc->timer_bucket = RS_64(temp, I40IW_QUERY_FPM_TIMERBUCKET);
         get_64bit_val(buf, 64, &temp);
+        obj_info[I40IW_HMC_IW_XFFL].max_cnt = (u32)temp;
+        obj_info[I40IW_HMC_IW_XFFL].size = 4;
         hmc_fpm_misc->xf_block_size = RS_64(temp, I40IW_QUERY_FPM_XFBLOCKSIZE);
         if (!hmc_fpm_misc->xf_block_size)
                 return I40IW_ERR_INVALID_SIZE;
+
+        i40iw_sc_decode_fpm_query(buf, 72, obj_info, I40IW_HMC_IW_Q1);
+
         get_64bit_val(buf, 80, &temp);
+        obj_info[I40IW_HMC_IW_Q1FL].max_cnt = (u32)temp;
+        obj_info[I40IW_HMC_IW_Q1FL].size = 4;
         hmc_fpm_misc->q1_block_size = RS_64(temp, I40IW_QUERY_FPM_Q1BLOCKSIZE);
         if (!hmc_fpm_misc->q1_block_size)
                 return I40IW_ERR_INVALID_SIZE;
+
+        i40iw_sc_decode_fpm_query(buf, 88, obj_info, I40IW_HMC_IW_TIMER);
+
+        get_64bit_val(buf, 112, &temp);
+        obj_info[I40IW_HMC_IW_PBLE].max_cnt = (u32)temp;
+        obj_info[I40IW_HMC_IW_PBLE].size = 8;
+
+        get_64bit_val(buf, 120, &temp);
+        hmc_fpm_misc->max_ceqs = (u8)RS_64(temp, I40IW_QUERY_FPM_MAX_CEQS);
+        hmc_fpm_misc->ht_multiplier = RS_64(temp, I40IW_QUERY_FPM_HTMULTIPLIER);
+        hmc_fpm_misc->timer_bucket = RS_64(temp, I40IW_QUERY_FPM_TIMERBUCKET);
+
         return 0;
 }
 
@@ -3392,13 +3440,6 @@ enum i40iw_status_code i40iw_sc_init_iw_hmc(struct i40iw_sc_dev *dev, u8 hmc_fn_
                 hmc_info->sd_table.sd_entry = virt_mem.va;
         }
 
-        /* fill size of objects which are fixed */
-        hmc_info->hmc_obj[I40IW_HMC_IW_XFFL].size = 4;
-        hmc_info->hmc_obj[I40IW_HMC_IW_Q1FL].size = 4;
-        hmc_info->hmc_obj[I40IW_HMC_IW_PBLE].size = 8;
-        hmc_info->hmc_obj[I40IW_HMC_IW_APBVT_ENTRY].size = 8192;
-        hmc_info->hmc_obj[I40IW_HMC_IW_APBVT_ENTRY].max_cnt = 1;
-
         return ret_code;
 }
 
@@ -4840,7 +4881,7 @@ void i40iw_vsi_stats_free(struct i40iw_sc_vsi *vsi)
 {
         u8 fcn_id = vsi->fcn_id;
 
-        if ((vsi->stats_fcn_id_alloc) && (fcn_id != I40IW_INVALID_FCN_ID))
+        if (vsi->stats_fcn_id_alloc && fcn_id < I40IW_MAX_STATS_COUNT)
                 vsi->dev->fcn_id_array[fcn_id] = false;
         i40iw_hw_stats_stop_timer(vsi);
 }
diff --git a/drivers/infiniband/hw/i40iw/i40iw_d.h b/drivers/infiniband/hw/i40iw/i40iw_d.h
index a39ac12b6a7e..2ebaadbed379 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_d.h
+++ b/drivers/infiniband/hw/i40iw/i40iw_d.h
@@ -1507,8 +1507,8 @@ enum {
         I40IW_CQ0_ALIGNMENT_MASK =              (256 - 1),
         I40IW_HOST_CTX_ALIGNMENT_MASK =         (4 - 1),
         I40IW_SHADOWAREA_MASK =                 (128 - 1),
-        I40IW_FPM_QUERY_BUF_ALIGNMENT_MASK =    0,
-        I40IW_FPM_COMMIT_BUF_ALIGNMENT_MASK =   0
+        I40IW_FPM_QUERY_BUF_ALIGNMENT_MASK =    (4 - 1),
+        I40IW_FPM_COMMIT_BUF_ALIGNMENT_MASK =   (4 - 1)
 };
 
 enum i40iw_alignment {
diff --git a/drivers/infiniband/hw/i40iw/i40iw_puda.c b/drivers/infiniband/hw/i40iw/i40iw_puda.c
index 71050c5d29a0..7f5583d83622 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_puda.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_puda.c
@@ -685,7 +685,7 @@ static enum i40iw_status_code i40iw_puda_cq_create(struct i40iw_puda_rsrc *rsrc)
         cqsize = rsrc->cq_size * (sizeof(struct i40iw_cqe));
         tsize = cqsize + sizeof(struct i40iw_cq_shadow_area);
         ret = i40iw_allocate_dma_mem(dev->hw, &rsrc->cqmem, tsize,
-                                     I40IW_CQ0_ALIGNMENT_MASK);
+                                     I40IW_CQ0_ALIGNMENT);
         if (ret)
                 return ret;
 
diff --git a/drivers/infiniband/hw/i40iw/i40iw_status.h b/drivers/infiniband/hw/i40iw/i40iw_status.h
index 91c421762f06..f7013f11d808 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_status.h
+++ b/drivers/infiniband/hw/i40iw/i40iw_status.h
@@ -62,7 +62,7 @@ enum i40iw_status_code {
         I40IW_ERR_INVALID_ALIGNMENT = -23,
         I40IW_ERR_FLUSHED_QUEUE = -24,
         I40IW_ERR_INVALID_PUSH_PAGE_INDEX = -25,
-        I40IW_ERR_INVALID_IMM_DATA_SIZE = -26,
+        I40IW_ERR_INVALID_INLINE_DATA_SIZE = -26,
         I40IW_ERR_TIMEOUT = -27,
         I40IW_ERR_OPCODE_MISMATCH = -28,
         I40IW_ERR_CQP_COMPL_ERROR = -29,
diff --git a/drivers/infiniband/hw/i40iw/i40iw_uk.c b/drivers/infiniband/hw/i40iw/i40iw_uk.c
index b0d3a0e8a9b5..1060725d18bc 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_uk.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_uk.c
@@ -435,7 +435,7 @@ static enum i40iw_status_code i40iw_inline_rdma_write(struct i40iw_qp_uk *qp,
 
         op_info = &info->op.inline_rdma_write;
         if (op_info->len > I40IW_MAX_INLINE_DATA_SIZE)
-                return I40IW_ERR_INVALID_IMM_DATA_SIZE;
+                return I40IW_ERR_INVALID_INLINE_DATA_SIZE;
 
         ret_code = i40iw_inline_data_size_to_wqesize(op_info->len, &wqe_size);
         if (ret_code)
@@ -511,7 +511,7 @@ static enum i40iw_status_code i40iw_inline_send(struct i40iw_qp_uk *qp,
 
         op_info = &info->op.inline_send;
         if (op_info->len > I40IW_MAX_INLINE_DATA_SIZE)
-                return I40IW_ERR_INVALID_IMM_DATA_SIZE;
+                return I40IW_ERR_INVALID_INLINE_DATA_SIZE;
 
         ret_code = i40iw_inline_data_size_to_wqesize(op_info->len, &wqe_size);
         if (ret_code)
@@ -784,7 +784,7 @@ static enum i40iw_status_code i40iw_cq_poll_completion(struct i40iw_cq_uk *cq,
         get_64bit_val(cqe, 0, &qword0);
         get_64bit_val(cqe, 16, &qword2);
 
-        info->tcp_seq_num = (u8)RS_64(qword0, I40IWCQ_TCPSEQNUM);
+        info->tcp_seq_num = (u32)RS_64(qword0, I40IWCQ_TCPSEQNUM);
 
         info->qp_id = (u32)RS_64(qword2, I40IWCQ_QPID);
 
@@ -1187,7 +1187,7 @@ enum i40iw_status_code i40iw_inline_data_size_to_wqesize(u32 data_size,
                                                          u8 *wqe_size)
 {
         if (data_size > I40IW_MAX_INLINE_DATA_SIZE)
-                return I40IW_ERR_INVALID_IMM_DATA_SIZE;
+                return I40IW_ERR_INVALID_INLINE_DATA_SIZE;
 
         if (data_size <= 16)
                 *wqe_size = I40IW_QP_WQE_MIN_SIZE;
diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
index a7f2e60085c4..f7fcde1ff0aa 100644
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -1085,6 +1085,12 @@ static int mlx5_ib_modify_port(struct ib_device *ibdev, u8 port, int mask,
         bool is_ib = (mlx5_ib_port_link_layer(ibdev, port) ==
                       IB_LINK_LAYER_INFINIBAND);
 
+        /* CM layer calls ib_modify_port() regardless of the link layer. For
+         * Ethernet ports, qkey violation and Port capabilities are meaningless.
+         */
+        if (!is_ib)
+                return 0;
+
         if (MLX5_CAP_GEN(dev->mdev, ib_virt) && is_ib) {
                 change_mask = props->clr_port_cap_mask | props->set_port_cap_mask;
                 value = ~props->clr_port_cap_mask | props->set_port_cap_mask;
diff --git a/drivers/infiniband/hw/mlx5/odp.c b/drivers/infiniband/hw/mlx5/odp.c
index ae0746754008..3d701c7a4c91 100644
--- a/drivers/infiniband/hw/mlx5/odp.c
+++ b/drivers/infiniband/hw/mlx5/odp.c
@@ -939,7 +939,7 @@ static int mlx5_ib_mr_initiator_pfault_handler(
 
         if (qp->ibqp.qp_type != IB_QPT_RC) {
                 av = *wqe;
-                if (av->dqp_dct & be32_to_cpu(MLX5_WQE_AV_EXT))
+                if (av->dqp_dct & cpu_to_be32(MLX5_EXTENDED_UD_AV))
                         *wqe += sizeof(struct mlx5_av);
                 else
                         *wqe += sizeof(struct mlx5_base_av);
diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
index 0889ff367c86..f58f8f5f3ebe 100644
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -1238,6 +1238,7 @@ static int create_raw_packet_qp(struct mlx5_ib_dev *dev, struct mlx5_ib_qp *qp,
                         goto err_destroy_tis;
 
                 sq->base.container_mibqp = qp;
+                sq->base.mqp.event = mlx5_ib_qp_event;
         }
 
         if (qp->rq.wqe_cnt) {
diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_cq.c b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_cq.c
index 69bda611d313..90aa326fd7c0 100644
--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_cq.c
+++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_cq.c
@@ -65,13 +65,28 @@ int pvrdma_req_notify_cq(struct ib_cq *ibcq,
         struct pvrdma_dev *dev = to_vdev(ibcq->device);
         struct pvrdma_cq *cq = to_vcq(ibcq);
         u32 val = cq->cq_handle;
+        unsigned long flags;
+        int has_data = 0;
 
         val |= (notify_flags & IB_CQ_SOLICITED_MASK) == IB_CQ_SOLICITED ?
                 PVRDMA_UAR_CQ_ARM_SOL : PVRDMA_UAR_CQ_ARM;
 
+        spin_lock_irqsave(&cq->cq_lock, flags);
+
         pvrdma_write_uar_cq(dev, val);
 
-        return 0;
+        if (notify_flags & IB_CQ_REPORT_MISSED_EVENTS) {
+                unsigned int head;
+
+                has_data = pvrdma_idx_ring_has_data(&cq->ring_state->rx,
+                                                    cq->ibcq.cqe, &head);
+                if (unlikely(has_data == PVRDMA_INVALID_IDX))
+                        dev_err(&dev->pdev->dev, "CQ ring state invalid\n");
+        }
+
+        spin_unlock_irqrestore(&cq->cq_lock, flags);
+
+        return has_data;
 }
 
 /**
diff --git a/drivers/infiniband/ulp/ipoib/ipoib.h b/drivers/infiniband/ulp/ipoib/ipoib.h
index ff50a7bd66d8..7ac25059c40f 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib.h
+++ b/drivers/infiniband/ulp/ipoib/ipoib.h
@@ -336,6 +336,7 @@ struct ipoib_dev_priv {
         unsigned long flags;
 
         struct rw_semaphore vlan_rwsem;
+        struct mutex mcast_mutex;
 
         struct rb_root  path_tree;
         struct list_head path_list;
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
index f87d104837dc..d69410c2ed97 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
@@ -511,7 +511,6 @@ static int ipoib_cm_rx_handler(struct ib_cm_id *cm_id,
         case IB_CM_REQ_RECEIVED:
                 return ipoib_cm_req_handler(cm_id, event);
         case IB_CM_DREQ_RECEIVED:
-                p = cm_id->context;
                 ib_send_cm_drep(cm_id, NULL, 0);
                 /* Fall through */
         case IB_CM_REJ_RECEIVED:
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ethtool.c b/drivers/infiniband/ulp/ipoib/ipoib_ethtool.c
index 7871379342f4..184a22f48027 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_ethtool.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_ethtool.c
@@ -52,7 +52,8 @@ static const struct ipoib_stats ipoib_gstrings_stats[] = {
         IPOIB_NETDEV_STAT(tx_bytes),
         IPOIB_NETDEV_STAT(tx_errors),
         IPOIB_NETDEV_STAT(rx_dropped),
-        IPOIB_NETDEV_STAT(tx_dropped)
+        IPOIB_NETDEV_STAT(tx_dropped),
+        IPOIB_NETDEV_STAT(multicast),
 };
 
 #define IPOIB_GLOBAL_STATS_LEN  ARRAY_SIZE(ipoib_gstrings_stats)
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
index 57a9655e844d..2e075377242e 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
@@ -256,6 +256,8 @@ static void ipoib_ib_handle_rx_wc(struct net_device *dev, struct ib_wc *wc)
 
         ++dev->stats.rx_packets;
         dev->stats.rx_bytes += skb->len;
+        if (skb->pkt_type == PACKET_MULTICAST)
+                dev->stats.multicast++;
 
         skb->dev = dev;
         if ((dev->features & NETIF_F_RXCSUM) &&
@@ -709,6 +711,27 @@ static int recvs_pending(struct net_device *dev)
         return pending;
 }
 
+static void check_qp_movement_and_print(struct ipoib_dev_priv *priv,
+                                        struct ib_qp *qp,
+                                        enum ib_qp_state new_state)
+{
+        struct ib_qp_attr qp_attr;
+        struct ib_qp_init_attr query_init_attr;
+        int ret;
+
+        ret = ib_query_qp(qp, &qp_attr, IB_QP_STATE, &query_init_attr);
+        if (ret) {
+                ipoib_warn(priv, "%s: Failed to query QP\n", __func__);
+                return;
+        }
+        /* print according to the new-state and the previous state.*/
+        if (new_state == IB_QPS_ERR && qp_attr.qp_state == IB_QPS_RESET)
+                ipoib_dbg(priv, "Failed modify QP, IB_QPS_RESET to IB_QPS_ERR, acceptable\n");
+        else
+                ipoib_warn(priv, "Failed to modify QP to state: %d from state: %d\n",
+                           new_state, qp_attr.qp_state);
+}
+
 int ipoib_ib_dev_stop_default(struct net_device *dev)
 {
         struct ipoib_dev_priv *priv = ipoib_priv(dev);
@@ -728,7 +751,7 @@ int ipoib_ib_dev_stop_default(struct net_device *dev)
          */
         qp_attr.qp_state = IB_QPS_ERR;
         if (ib_modify_qp(priv->qp, &qp_attr, IB_QP_STATE))
-                ipoib_warn(priv, "Failed to modify QP to ERROR state\n");
+                check_qp_movement_and_print(priv, priv->qp, IB_QPS_ERR);
 
         /* Wait for all sends and receives to complete */
         begin = jiffies;
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index 4ce315c92b48..6c77df34869d 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -1560,6 +1560,7 @@ static void ipoib_flush_neighs(struct ipoib_dev_priv *priv)
         int i, wait_flushed = 0;
 
         init_completion(&priv->ntbl.flushed);
+        set_bit(IPOIB_NEIGH_TBL_FLUSH, &priv->flags);
 
         spin_lock_irqsave(&priv->lock, flags);
 
@@ -1604,7 +1605,6 @@ static void ipoib_neigh_hash_uninit(struct net_device *dev)
 
         ipoib_dbg(priv, "ipoib_neigh_hash_uninit\n");
         init_completion(&priv->ntbl.deleted);
-        set_bit(IPOIB_NEIGH_TBL_FLUSH, &priv->flags);
 
         /* Stop GC if called at init fail need to cancel work */
         stopped = test_and_set_bit(IPOIB_STOP_NEIGH_GC, &priv->flags);
@@ -1847,6 +1847,7 @@ static const struct net_device_ops ipoib_netdev_ops_vf = {
         .ndo_tx_timeout          = ipoib_timeout,
         .ndo_set_rx_mode         = ipoib_set_mcast_list,
         .ndo_get_iflink          = ipoib_get_iflink,
+        .ndo_get_stats64         = ipoib_get_stats,
 };
 
 void ipoib_setup_common(struct net_device *dev)
@@ -1877,6 +1878,7 @@ static void ipoib_build_priv(struct net_device *dev)
         priv->dev = dev;
         spin_lock_init(&priv->lock);
         init_rwsem(&priv->vlan_rwsem);
+        mutex_init(&priv->mcast_mutex);
 
         INIT_LIST_HEAD(&priv->path_list);
         INIT_LIST_HEAD(&priv->child_intfs);
@@ -2173,14 +2175,14 @@ static struct net_device *ipoib_add_port(const char *format,
         priv->dev->dev_id = port - 1;
 
         result = ib_query_port(hca, port, &attr);
-        if (!result)
-                priv->max_ib_mtu = ib_mtu_enum_to_int(attr.max_mtu);
-        else {
+        if (result) {
                 printk(KERN_WARNING "%s: ib_query_port %d failed\n",
                        hca->name, port);
                 goto device_init_failed;
         }
 
+        priv->max_ib_mtu = ib_mtu_enum_to_int(attr.max_mtu);
+
         /* MTU will be reset when mcast join happens */
         priv->dev->mtu  = IPOIB_UD_MTU(priv->max_ib_mtu);
         priv->mcast_mtu  = priv->admin_mtu = priv->dev->mtu;
@@ -2211,12 +2213,14 @@ static struct net_device *ipoib_add_port(const char *format,
                 printk(KERN_WARNING "%s: ib_query_gid port %d failed (ret = %d)\n",
                        hca->name, port, result);
                 goto device_init_failed;
-        } else
-                memcpy(priv->dev->dev_addr + 4, priv->local_gid.raw, sizeof (union ib_gid));
+        }
+
+        memcpy(priv->dev->dev_addr + 4, priv->local_gid.raw,
+               sizeof(union ib_gid));
         set_bit(IPOIB_FLAG_DEV_ADDR_SET, &priv->flags);
 
         result = ipoib_dev_init(priv->dev, hca, port);
-        if (result < 0) {
+        if (result) {
                 printk(KERN_WARNING "%s: failed to initialize port %d (ret = %d)\n",
                        hca->name, port, result);
                 goto device_init_failed;
@@ -2365,6 +2369,7 @@ static int __init ipoib_init_module(void)
         ipoib_sendq_size = max3(ipoib_sendq_size, 2 * MAX_SEND_CQE, IPOIB_MIN_QUEUE_SIZE);
 #ifdef CONFIG_INFINIBAND_IPOIB_CM
         ipoib_max_conn_qp = min(ipoib_max_conn_qp, IPOIB_CM_MAX_CONN_QP);
+        ipoib_max_conn_qp = max(ipoib_max_conn_qp, 0);
 #endif
 
         /*
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
index 057f58e6afca..93e149efc1f5 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
@@ -684,15 +684,10 @@ void ipoib_mcast_start_thread(struct net_device *dev)
 int ipoib_mcast_stop_thread(struct net_device *dev)
 {
         struct ipoib_dev_priv *priv = ipoib_priv(dev);
-        unsigned long flags;
 
         ipoib_dbg_mcast(priv, "stopping multicast thread\n");
 
-        spin_lock_irqsave(&priv->lock, flags);
-        cancel_delayed_work(&priv->mcast_task);
-        spin_unlock_irqrestore(&priv->lock, flags);
-
-        flush_workqueue(priv->wq);
+        cancel_delayed_work_sync(&priv->mcast_task);
 
         return 0;
 }
@@ -748,6 +743,14 @@ void ipoib_mcast_remove_list(struct list_head *remove_list)
 {
         struct ipoib_mcast *mcast, *tmcast;
 
+        /*
+         * make sure the in-flight joins have finished before we attempt
+         * to leave
+         */
+        list_for_each_entry_safe(mcast, tmcast, remove_list, list)
+                if (test_bit(IPOIB_MCAST_FLAG_BUSY, &mcast->flags))
+                        wait_for_completion(&mcast->done);
+
         list_for_each_entry_safe(mcast, tmcast, remove_list, list) {
                 ipoib_mcast_leave(mcast->dev, mcast);
                 ipoib_mcast_free(mcast);
@@ -838,6 +841,7 @@ void ipoib_mcast_dev_flush(struct net_device *dev)
         struct ipoib_mcast *mcast, *tmcast;
         unsigned long flags;
 
+        mutex_lock(&priv->mcast_mutex);
         ipoib_dbg_mcast(priv, "flushing multicast list\n");
 
         spin_lock_irqsave(&priv->lock, flags);
@@ -856,15 +860,8 @@ void ipoib_mcast_dev_flush(struct net_device *dev)
 
         spin_unlock_irqrestore(&priv->lock, flags);
 
-        /*
-         * make sure the in-flight joins have finished before we attempt
-         * to leave
-         */
-        list_for_each_entry_safe(mcast, tmcast, &remove_list, list)
-                if (test_bit(IPOIB_MCAST_FLAG_BUSY, &mcast->flags))
-                        wait_for_completion(&mcast->done);
-
         ipoib_mcast_remove_list(&remove_list);
+        mutex_unlock(&priv->mcast_mutex);
 }
 
 static int ipoib_mcast_addr_is_valid(const u8 *addr, const u8 *broadcast)
@@ -982,14 +979,6 @@ void ipoib_mcast_restart_task(struct work_struct *work)
         netif_addr_unlock(dev);
         local_irq_restore(flags);
 
-        /*
-         * make sure the in-flight joins have finished before we attempt
-         * to leave
-         */
-        list_for_each_entry_safe(mcast, tmcast, &remove_list, list)
-                if (test_bit(IPOIB_MCAST_FLAG_BUSY, &mcast->flags))
-                        wait_for_completion(&mcast->done);
-
         ipoib_mcast_remove_list(&remove_list);
 
         /*
diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
index 298a6ba51411..ca0e19ae7a90 100644
--- a/drivers/input/joystick/xpad.c
+++ b/drivers/input/joystick/xpad.c
@@ -476,10 +476,21 @@ static const u8 xboxone_hori_init[] = {
 };
 
 /*
- * A rumble packet is required for some PowerA pads to start
+ * A specific rumble packet is required for some PowerA pads to start
  * sending input reports. One of those pads is (0x24c6:0x543a).
  */
-static const u8 xboxone_zerorumble_init[] = {
+static const u8 xboxone_rumblebegin_init[] = {
+        0x09, 0x00, 0x00, 0x09, 0x00, 0x0F, 0x00, 0x00,
+        0x1D, 0x1D, 0xFF, 0x00, 0x00
+};
+
+/*
+ * A rumble packet with zero FF intensity will immediately
+ * terminate the rumbling required to init PowerA pads.
+ * This should happen fast enough that the motors don't
+ * spin up to enough speed to actually vibrate the gamepad.
+ */
+static const u8 xboxone_rumbleend_init[] = {
         0x09, 0x00, 0x00, 0x09, 0x00, 0x0F, 0x00, 0x00,
         0x00, 0x00, 0x00, 0x00, 0x00
 };
@@ -494,9 +505,12 @@ static const struct xboxone_init_packet xboxone_init_packets[] = {
         XBOXONE_INIT_PKT(0x0e6f, 0x0165, xboxone_hori_init),
         XBOXONE_INIT_PKT(0x0f0d, 0x0067, xboxone_hori_init),
         XBOXONE_INIT_PKT(0x0000, 0x0000, xboxone_fw2015_init),
-        XBOXONE_INIT_PKT(0x24c6, 0x541a, xboxone_zerorumble_init),
-        XBOXONE_INIT_PKT(0x24c6, 0x542a, xboxone_zerorumble_init),
-        XBOXONE_INIT_PKT(0x24c6, 0x543a, xboxone_zerorumble_init),
+        XBOXONE_INIT_PKT(0x24c6, 0x541a, xboxone_rumblebegin_init),
+        XBOXONE_INIT_PKT(0x24c6, 0x542a, xboxone_rumblebegin_init),
+        XBOXONE_INIT_PKT(0x24c6, 0x543a, xboxone_rumblebegin_init),
+        XBOXONE_INIT_PKT(0x24c6, 0x541a, xboxone_rumbleend_init),
+        XBOXONE_INIT_PKT(0x24c6, 0x542a, xboxone_rumbleend_init),
+        XBOXONE_INIT_PKT(0x24c6, 0x543a, xboxone_rumbleend_init),
 };
 
 struct xpad_output_packet {
diff --git a/drivers/input/misc/soc_button_array.c b/drivers/input/misc/soc_button_array.c
index f600f3a7a3c6..23520df7650f 100644
--- a/drivers/input/misc/soc_button_array.c
+++ b/drivers/input/misc/soc_button_array.c
@@ -331,7 +331,7 @@ static int soc_button_probe(struct platform_device *pdev)
         error = gpiod_count(dev, NULL);
         if (error < 0) {
                 dev_dbg(dev, "no GPIO attached, ignoring...\n");
-                return error;
+                return -ENODEV;
         }
 
         priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
diff --git a/drivers/input/mouse/alps.c b/drivers/input/mouse/alps.c
index 262d1057c1da..850b00e3ad8e 100644
--- a/drivers/input/mouse/alps.c
+++ b/drivers/input/mouse/alps.c
@@ -1215,14 +1215,24 @@ static int alps_decode_ss4_v2(struct alps_fields *f,
 
         case SS4_PACKET_ID_TWO:
                 if (priv->flags & ALPS_BUTTONPAD) {
-                        f->mt[0].x = SS4_BTL_MF_X_V2(p, 0);
+                        if (IS_SS4PLUS_DEV(priv->dev_id)) {
+                                f->mt[0].x = SS4_PLUS_BTL_MF_X_V2(p, 0);
+                                f->mt[1].x = SS4_PLUS_BTL_MF_X_V2(p, 1);
+                        } else {
+                                f->mt[0].x = SS4_BTL_MF_X_V2(p, 0);
+                                f->mt[1].x = SS4_BTL_MF_X_V2(p, 1);
+                        }
                         f->mt[0].y = SS4_BTL_MF_Y_V2(p, 0);
-                        f->mt[1].x = SS4_BTL_MF_X_V2(p, 1);
                         f->mt[1].y = SS4_BTL_MF_Y_V2(p, 1);
                 } else {
-                        f->mt[0].x = SS4_STD_MF_X_V2(p, 0);
+                        if (IS_SS4PLUS_DEV(priv->dev_id)) {
+                                f->mt[0].x = SS4_PLUS_STD_MF_X_V2(p, 0);
+                                f->mt[1].x = SS4_PLUS_STD_MF_X_V2(p, 1);
+                        } else {
+                                f->mt[0].x = SS4_STD_MF_X_V2(p, 0);
+                                f->mt[1].x = SS4_STD_MF_X_V2(p, 1);
+                        }
                         f->mt[0].y = SS4_STD_MF_Y_V2(p, 0);
-                        f->mt[1].x = SS4_STD_MF_X_V2(p, 1);
                         f->mt[1].y = SS4_STD_MF_Y_V2(p, 1);
                 }
                 f->pressure = SS4_MF_Z_V2(p, 0) ? 0x30 : 0;
@@ -1239,16 +1249,27 @@ static int alps_decode_ss4_v2(struct alps_fields *f,
 
         case SS4_PACKET_ID_MULTI:
                 if (priv->flags & ALPS_BUTTONPAD) {
-                        f->mt[2].x = SS4_BTL_MF_X_V2(p, 0);
+                        if (IS_SS4PLUS_DEV(priv->dev_id)) {
+                                f->mt[0].x = SS4_PLUS_BTL_MF_X_V2(p, 0);
+                                f->mt[1].x = SS4_PLUS_BTL_MF_X_V2(p, 1);
+                        } else {
+                                f->mt[2].x = SS4_BTL_MF_X_V2(p, 0);
+                                f->mt[3].x = SS4_BTL_MF_X_V2(p, 1);
+                        }
+
                         f->mt[2].y = SS4_BTL_MF_Y_V2(p, 0);
-                        f->mt[3].x = SS4_BTL_MF_X_V2(p, 1);
                         f->mt[3].y = SS4_BTL_MF_Y_V2(p, 1);
                         no_data_x = SS4_MFPACKET_NO_AX_BL;
                         no_data_y = SS4_MFPACKET_NO_AY_BL;
                 } else {
-                        f->mt[2].x = SS4_STD_MF_X_V2(p, 0);
+                        if (IS_SS4PLUS_DEV(priv->dev_id)) {
+                                f->mt[0].x = SS4_PLUS_STD_MF_X_V2(p, 0);
+                                f->mt[1].x = SS4_PLUS_STD_MF_X_V2(p, 1);
+                        } else {
+                                f->mt[0].x = SS4_STD_MF_X_V2(p, 0);
+                                f->mt[1].x = SS4_STD_MF_X_V2(p, 1);
+                        }
                         f->mt[2].y = SS4_STD_MF_Y_V2(p, 0);
-                        f->mt[3].x = SS4_STD_MF_X_V2(p, 1);
                         f->mt[3].y = SS4_STD_MF_Y_V2(p, 1);
                         no_data_x = SS4_MFPACKET_NO_AX;
                         no_data_y = SS4_MFPACKET_NO_AY;
@@ -2541,8 +2562,8 @@ static int alps_set_defaults_ss4_v2(struct psmouse *psmouse,
 
         memset(otp, 0, sizeof(otp));
 
-        if (alps_get_otp_values_ss4_v2(psmouse, 0, &otp[0][0]) ||
-            alps_get_otp_values_ss4_v2(psmouse, 1, &otp[1][0]))
+        if (alps_get_otp_values_ss4_v2(psmouse, 1, &otp[1][0]) ||
+            alps_get_otp_values_ss4_v2(psmouse, 0, &otp[0][0]))
                 return -1;
 
         alps_update_device_area_ss4_v2(otp, priv);
diff --git a/drivers/input/mouse/alps.h b/drivers/input/mouse/alps.h
index ed2d6879fa52..c80a7c76cb76 100644
--- a/drivers/input/mouse/alps.h
+++ b/drivers/input/mouse/alps.h
@@ -100,6 +100,10 @@ enum SS4_PACKET_ID {
                                  ((_b[1 + _i * 3]  << 5) & 0x1F00)      \
                                 )
 
+#define SS4_PLUS_STD_MF_X_V2(_b, _i) (((_b[0 + (_i) * 3] << 4) & 0x0070) | \
+                                 ((_b[1 + (_i) * 3]  << 4) & 0x0F80)    \
+                                )
+
 #define SS4_STD_MF_Y_V2(_b, _i) (((_b[1 + (_i) * 3] << 3) & 0x0010) |   \
                                  ((_b[2 + (_i) * 3] << 5) & 0x01E0) |   \
                                  ((_b[2 + (_i) * 3] << 4) & 0x0E00)     \
@@ -109,6 +113,10 @@ enum SS4_PACKET_ID {
                                  ((_b[0 + (_i) * 3] >> 3) & 0x0010)     \
                                 )
 
+#define SS4_PLUS_BTL_MF_X_V2(_b, _i) (SS4_PLUS_STD_MF_X_V2(_b, _i) |    \
+                                 ((_b[0 + (_i) * 3] >> 4) & 0x0008)     \
+                                )
+
 #define SS4_BTL_MF_Y_V2(_b, _i) (SS4_STD_MF_Y_V2(_b, _i) | \
                                  ((_b[0 + (_i) * 3] >> 3) & 0x0008)     \
                                 )
diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c
index 3b616cb7c67f..cfbc8ba4c96c 100644
--- a/drivers/input/mouse/elan_i2c_core.c
+++ b/drivers/input/mouse/elan_i2c_core.c
@@ -1247,7 +1247,12 @@ static const struct acpi_device_id elan_acpi_id[] = {
         { "ELAN0000", 0 },
         { "ELAN0100", 0 },
         { "ELAN0600", 0 },
+        { "ELAN0602", 0 },
         { "ELAN0605", 0 },
+        { "ELAN0608", 0 },
+        { "ELAN0605", 0 },
+        { "ELAN0609", 0 },
+        { "ELAN060B", 0 },
         { "ELAN1000", 0 },
         { }
 };
diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
index 16c30460ef04..5af0b7d200bc 100644
--- a/drivers/input/mouse/synaptics.c
+++ b/drivers/input/mouse/synaptics.c
@@ -535,16 +535,17 @@ static void synaptics_apply_quirks(struct psmouse *psmouse,
         }
 }
 
+static bool synaptics_has_agm(struct synaptics_data *priv)
+{
+        return (SYN_CAP_ADV_GESTURE(priv->info.ext_cap_0c) ||
+                SYN_CAP_IMAGE_SENSOR(priv->info.ext_cap_0c));
+}
+
 static int synaptics_set_advanced_gesture_mode(struct psmouse *psmouse)
 {
         static u8 param = 0xc8;
-        struct synaptics_data *priv = psmouse->private;
         int error;
 
-        if (!(SYN_CAP_ADV_GESTURE(priv->info.ext_cap_0c) ||
-              SYN_CAP_IMAGE_SENSOR(priv->info.ext_cap_0c)))
-                return 0;
-
         error = psmouse_sliced_command(psmouse, SYN_QUE_MODEL);
         if (error)
                 return error;
@@ -553,9 +554,6 @@ static int synaptics_set_advanced_gesture_mode(struct psmouse *psmouse)
         if (error)
                 return error;
 
-        /* Advanced gesture mode also sends multi finger data */
-        priv->info.capabilities |= BIT(1);
-
         return 0;
 }
 
@@ -578,7 +576,7 @@ static int synaptics_set_mode(struct psmouse *psmouse)
         if (error)
                 return error;
 
-        if (priv->absolute_mode) {
+        if (priv->absolute_mode && synaptics_has_agm(priv)) {
                 error = synaptics_set_advanced_gesture_mode(psmouse);
                 if (error) {
                         psmouse_err(psmouse,
@@ -766,9 +764,7 @@ static int synaptics_parse_hw_state(const u8 buf[],
                          ((buf[0] & 0x04) >> 1) |
                          ((buf[3] & 0x04) >> 2));
 
-                if ((SYN_CAP_ADV_GESTURE(priv->info.ext_cap_0c) ||
-                        SYN_CAP_IMAGE_SENSOR(priv->info.ext_cap_0c)) &&
-                    hw->w == 2) {
+                if (synaptics_has_agm(priv) && hw->w == 2) {
                         synaptics_parse_agm(buf, priv, hw);
                         return 1;
                 }
@@ -1033,6 +1029,15 @@ static void synaptics_image_sensor_process(struct psmouse *psmouse,
         synaptics_report_mt_data(psmouse, sgm, num_fingers);
 }
 
+static bool synaptics_has_multifinger(struct synaptics_data *priv)
+{
+        if (SYN_CAP_MULTIFINGER(priv->info.capabilities))
+                return true;
+
+        /* Advanced gesture mode also sends multi finger data */
+        return synaptics_has_agm(priv);
+}
+
 /*
  *  called for each full received packet from the touchpad
  */
@@ -1079,7 +1084,7 @@ static void synaptics_process_packet(struct psmouse *psmouse)
                 if (SYN_CAP_EXTENDED(info->capabilities)) {
                         switch (hw.w) {
                         case 0 ... 1:
-                                if (SYN_CAP_MULTIFINGER(info->capabilities))
+                                if (synaptics_has_multifinger(priv))
                                         num_fingers = hw.w + 2;
                                 break;
                         case 2:
@@ -1123,7 +1128,7 @@ static void synaptics_process_packet(struct psmouse *psmouse)
                 input_report_abs(dev, ABS_TOOL_WIDTH, finger_width);
 
         input_report_key(dev, BTN_TOOL_FINGER, num_fingers == 1);
-        if (SYN_CAP_MULTIFINGER(info->capabilities)) {
+        if (synaptics_has_multifinger(priv)) {
                 input_report_key(dev, BTN_TOOL_DOUBLETAP, num_fingers == 2);
                 input_report_key(dev, BTN_TOOL_TRIPLETAP, num_fingers == 3);
         }
@@ -1283,7 +1288,7 @@ static void set_input_params(struct psmouse *psmouse,
         __set_bit(BTN_TOUCH, dev->keybit);
         __set_bit(BTN_TOOL_FINGER, dev->keybit);
 
-        if (SYN_CAP_MULTIFINGER(info->capabilities)) {
+        if (synaptics_has_multifinger(priv)) {
                 __set_bit(BTN_TOOL_DOUBLETAP, dev->keybit);
                 __set_bit(BTN_TOOL_TRIPLETAP, dev->keybit);
         }
diff --git a/drivers/input/mouse/trackpoint.c b/drivers/input/mouse/trackpoint.c
index 922ea02edcc3..0871010f18d5 100644
--- a/drivers/input/mouse/trackpoint.c
+++ b/drivers/input/mouse/trackpoint.c
@@ -265,7 +265,8 @@ static int trackpoint_start_protocol(struct psmouse *psmouse, unsigned char *fir
         if (ps2_command(&psmouse->ps2dev, param, MAKE_PS2_CMD(0, 2, TP_READ_ID)))
                 return -1;
 
-        if (param[0] != TP_MAGIC_IDENT)
+        /* add new TP ID. */
+        if (!(param[0] & TP_MAGIC_IDENT))
                 return -1;
 
         if (firmware_id)
@@ -380,8 +381,8 @@ int trackpoint_detect(struct psmouse *psmouse, bool set_properties)
                 return 0;
 
         if (trackpoint_read(ps2dev, TP_EXT_BTN, &button_info)) {
-                psmouse_warn(psmouse, "failed to get extended button data\n");
-                button_info = 0;
+                psmouse_warn(psmouse, "failed to get extended button data, assuming 3 buttons\n");
+                button_info = 0x33;
         }
 
         psmouse->private = kzalloc(sizeof(struct trackpoint_data), GFP_KERNEL);
diff --git a/drivers/input/mouse/trackpoint.h b/drivers/input/mouse/trackpoint.h
index 5617ed3a7d7a..88055755f82e 100644
--- a/drivers/input/mouse/trackpoint.h
+++ b/drivers/input/mouse/trackpoint.h
@@ -21,8 +21,9 @@
 #define TP_COMMAND              0xE2    /* Commands start with this */
 
 #define TP_READ_ID              0xE1    /* Sent for device identification */
-#define TP_MAGIC_IDENT          0x01    /* Sent after a TP_READ_ID followed */
+#define TP_MAGIC_IDENT          0x03    /* Sent after a TP_READ_ID followed */
                                         /* by the firmware ID */
+                                        /* Firmware ID includes 0x1, 0x2, 0x3 */
 
 
 /*
diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
index 688e77576e5a..354cbd6392cd 100644
--- a/drivers/iommu/amd_iommu.c
+++ b/drivers/iommu/amd_iommu.c
@@ -4452,6 +4452,7 @@ static int amd_ir_set_vcpu_affinity(struct irq_data *data, void *vcpu_info)
                 /* Setting */
                 irte->hi.fields.ga_root_ptr = (pi_data->base >> 12);
                 irte->hi.fields.vector = vcpu_pi_info->vector;
+                irte->lo.fields_vapic.ga_log_intr = 1;
                 irte->lo.fields_vapic.guest_mode = 1;
                 irte->lo.fields_vapic.ga_tag = pi_data->ga_tag;
 
diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c
index 5cc597b383c7..372303700566 100644
--- a/drivers/iommu/amd_iommu_init.c
+++ b/drivers/iommu/amd_iommu_init.c
@@ -2440,11 +2440,11 @@ static int __init state_next(void)
                 break;
         case IOMMU_ACPI_FINISHED:
                 early_enable_iommus();
-                register_syscore_ops(&amd_iommu_syscore_ops);
                 x86_platform.iommu_shutdown = disable_iommus;
                 init_state = IOMMU_ENABLED;
                 break;
         case IOMMU_ENABLED:
+                register_syscore_ops(&amd_iommu_syscore_ops);
                 ret = amd_iommu_init_pci();
                 init_state = ret ? IOMMU_INIT_ERROR : IOMMU_PCI_INIT;
                 enable_iommus_v2();
diff --git a/drivers/iommu/amd_iommu_types.h b/drivers/iommu/amd_iommu_types.h
index 294a409e283b..d6b873b57054 100644
--- a/drivers/iommu/amd_iommu_types.h
+++ b/drivers/iommu/amd_iommu_types.h
@@ -574,7 +574,9 @@ struct amd_iommu {
 
 static inline struct amd_iommu *dev_to_amd_iommu(struct device *dev)
 {
-        return container_of(dev, struct amd_iommu, iommu.dev);
+        struct iommu_device *iommu = dev_to_iommu_device(dev);
+
+        return container_of(iommu, struct amd_iommu, iommu);
 }
 
 #define ACPIHID_UID_LEN 256
diff --git a/drivers/iommu/amd_iommu_v2.c b/drivers/iommu/amd_iommu_v2.c
index 6629c472eafd..dccf5b76eff2 100644
--- a/drivers/iommu/amd_iommu_v2.c
+++ b/drivers/iommu/amd_iommu_v2.c
@@ -391,13 +391,6 @@ static int mn_clear_flush_young(struct mmu_notifier *mn,
         return 0;
 }
 
-static void mn_invalidate_page(struct mmu_notifier *mn,
-                               struct mm_struct *mm,
-                               unsigned long address)
-{
-        __mn_flush_page(mn, address);
-}
-
 static void mn_invalidate_range(struct mmu_notifier *mn,
                                 struct mm_struct *mm,
                                 unsigned long start, unsigned long end)
@@ -436,7 +429,6 @@ static void mn_release(struct mmu_notifier *mn, struct mm_struct *mm)
 static const struct mmu_notifier_ops iommu_mn = {
         .release                = mn_release,
         .clear_flush_young      = mn_clear_flush_young,
-        .invalidate_page        = mn_invalidate_page,
         .invalidate_range       = mn_invalidate_range,
 };
 
diff --git a/drivers/iommu/arm-smmu.c b/drivers/iommu/arm-smmu.c
index bc89b4d6c043..2d80fa8a0634 100644
--- a/drivers/iommu/arm-smmu.c
+++ b/drivers/iommu/arm-smmu.c
@@ -400,6 +400,8 @@ struct arm_smmu_device {
 
         u32                             cavium_id_base; /* Specific to Cavium */
 
+        spinlock_t                      global_sync_lock;
+
         /* IOMMU core code handle */
         struct iommu_device             iommu;
 };
@@ -436,7 +438,7 @@ struct arm_smmu_domain {
         struct arm_smmu_cfg             cfg;
         enum arm_smmu_domain_stage      stage;
         struct mutex                    init_mutex; /* Protects smmu pointer */
-        spinlock_t                      cb_lock; /* Serialises ATS1* ops */
+        spinlock_t                      cb_lock; /* Serialises ATS1* ops and TLB syncs */
         struct iommu_domain             domain;
 };
 
@@ -602,9 +604,12 @@ static void __arm_smmu_tlb_sync(struct arm_smmu_device *smmu,
 static void arm_smmu_tlb_sync_global(struct arm_smmu_device *smmu)
 {
         void __iomem *base = ARM_SMMU_GR0(smmu);
+        unsigned long flags;
 
+        spin_lock_irqsave(&smmu->global_sync_lock, flags);
         __arm_smmu_tlb_sync(smmu, base + ARM_SMMU_GR0_sTLBGSYNC,
                             base + ARM_SMMU_GR0_sTLBGSTATUS);
+        spin_unlock_irqrestore(&smmu->global_sync_lock, flags);
 }
 
 static void arm_smmu_tlb_sync_context(void *cookie)
@@ -612,9 +617,12 @@ static void arm_smmu_tlb_sync_context(void *cookie)
         struct arm_smmu_domain *smmu_domain = cookie;
         struct arm_smmu_device *smmu = smmu_domain->smmu;
         void __iomem *base = ARM_SMMU_CB(smmu, smmu_domain->cfg.cbndx);
+        unsigned long flags;
 
+        spin_lock_irqsave(&smmu_domain->cb_lock, flags);
         __arm_smmu_tlb_sync(smmu, base + ARM_SMMU_CB_TLBSYNC,
                             base + ARM_SMMU_CB_TLBSTATUS);
+        spin_unlock_irqrestore(&smmu_domain->cb_lock, flags);
 }
 
 static void arm_smmu_tlb_sync_vmid(void *cookie)
@@ -1511,6 +1519,12 @@ static int arm_smmu_add_device(struct device *dev)
 
         if (using_legacy_binding) {
                 ret = arm_smmu_register_legacy_master(dev, &smmu);
+
+                /*
+                 * If dev->iommu_fwspec is initally NULL, arm_smmu_register_legacy_master()
+                 * will allocate/initialise a new one. Thus we need to update fwspec for
+                 * later use.
+                 */
                 fwspec = dev->iommu_fwspec;
                 if (ret)
                         goto out_free;
@@ -1550,15 +1564,15 @@ static int arm_smmu_add_device(struct device *dev)
 
         ret = arm_smmu_master_alloc_smes(dev);
         if (ret)
-                goto out_free;
+                goto out_cfg_free;
 
         iommu_device_link(&smmu->iommu, dev);
 
         return 0;
 
+out_cfg_free:
+        kfree(cfg);
 out_free:
-        if (fwspec)
-                kfree(fwspec->iommu_priv);
         iommu_fwspec_free(dev);
         return ret;
 }
@@ -1925,6 +1939,7 @@ static int arm_smmu_device_cfg_probe(struct arm_smmu_device *smmu)
 
         smmu->num_mapping_groups = size;
         mutex_init(&smmu->stream_map_mutex);
+        spin_lock_init(&smmu->global_sync_lock);
 
         if (smmu->version < ARM_SMMU_V2 || !(id & ID0_PTFS_NO_AARCH32)) {
                 smmu->features |= ARM_SMMU_FEAT_FMT_AARCH32_L;
diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index 687f18f65cea..3e8636f1220e 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -4736,7 +4736,9 @@ static void intel_disable_iommus(void)
 
 static inline struct intel_iommu *dev_to_intel_iommu(struct device *dev)
 {
-        return container_of(dev, struct intel_iommu, iommu.dev);
+        struct iommu_device *iommu_dev = dev_to_iommu_device(dev);
+
+        return container_of(iommu_dev, struct intel_iommu, iommu);
 }
 
 static ssize_t intel_iommu_show_version(struct device *dev,
diff --git a/drivers/iommu/intel-svm.c b/drivers/iommu/intel-svm.c
index f167c0d84ebf..f620dccec8ee 100644
--- a/drivers/iommu/intel-svm.c
+++ b/drivers/iommu/intel-svm.c
@@ -223,14 +223,6 @@ static void intel_change_pte(struct mmu_notifier *mn, struct mm_struct *mm,
         intel_flush_svm_range(svm, address, 1, 1, 0);
 }
 
-static void intel_invalidate_page(struct mmu_notifier *mn, struct mm_struct *mm,
-                                  unsigned long address)
-{
-        struct intel_svm *svm = container_of(mn, struct intel_svm, notifier);
-
-        intel_flush_svm_range(svm, address, 1, 1, 0);
-}
-
 /* Pages have been freed at this point */
 static void intel_invalidate_range(struct mmu_notifier *mn,
                                    struct mm_struct *mm,
@@ -285,7 +277,6 @@ static void intel_mm_release(struct mmu_notifier *mn, struct mm_struct *mm)
 static const struct mmu_notifier_ops intel_mmuops = {
         .release = intel_mm_release,
         .change_pte = intel_change_pte,
-        .invalidate_page = intel_invalidate_page,
         .invalidate_range = intel_invalidate_range,
 };
 
diff --git a/drivers/iommu/io-pgtable-arm-v7s.c b/drivers/iommu/io-pgtable-arm-v7s.c
index af330f513653..d665d0dc16e8 100644
--- a/drivers/iommu/io-pgtable-arm-v7s.c
+++ b/drivers/iommu/io-pgtable-arm-v7s.c
@@ -479,6 +479,9 @@ static int arm_v7s_map(struct io_pgtable_ops *ops, unsigned long iova,
         if (!(prot & (IOMMU_READ | IOMMU_WRITE)))
                 return 0;
 
+        if (WARN_ON(upper_32_bits(iova) || upper_32_bits(paddr)))
+                return -ERANGE;
+
         ret = __arm_v7s_map(data, iova, paddr, size, prot, 1, data->pgd);
         /*
          * Synchronise all PTE updates for the new mapping before there's
@@ -659,6 +662,9 @@ static int arm_v7s_unmap(struct io_pgtable_ops *ops, unsigned long iova,
         struct arm_v7s_io_pgtable *data = io_pgtable_ops_to_data(ops);
         size_t unmapped;
 
+        if (WARN_ON(upper_32_bits(iova)))
+                return 0;
+
         unmapped = __arm_v7s_unmap(data, iova, size, 1, data->pgd);
         if (unmapped)
                 io_pgtable_tlb_sync(&data->iop);
diff --git a/drivers/iommu/io-pgtable-arm.c b/drivers/iommu/io-pgtable-arm.c
index b182039862c5..e8018a308868 100644
--- a/drivers/iommu/io-pgtable-arm.c
+++ b/drivers/iommu/io-pgtable-arm.c
@@ -452,6 +452,10 @@ static int arm_lpae_map(struct io_pgtable_ops *ops, unsigned long iova,
         if (!(iommu_prot & (IOMMU_READ | IOMMU_WRITE)))
                 return 0;
 
+        if (WARN_ON(iova >= (1ULL << data->iop.cfg.ias) ||
+                    paddr >= (1ULL << data->iop.cfg.oas)))
+                return -ERANGE;
+
         prot = arm_lpae_prot_to_pte(data, iommu_prot);
         ret = __arm_lpae_map(data, iova, paddr, size, prot, lvl, ptep);
         /*
@@ -610,6 +614,9 @@ static int arm_lpae_unmap(struct io_pgtable_ops *ops, unsigned long iova,
         arm_lpae_iopte *ptep = data->pgd;
         int lvl = ARM_LPAE_START_LVL(data);
 
+        if (WARN_ON(iova >= (1ULL << data->iop.cfg.ias)))
+                return 0;
+
         unmapped = __arm_lpae_unmap(data, iova, size, lvl, ptep);
         if (unmapped)
                 io_pgtable_tlb_sync(&data->iop);
diff --git a/drivers/iommu/io-pgtable.h b/drivers/iommu/io-pgtable.h
index 524263a7ae6f..a3e667077b14 100644
--- a/drivers/iommu/io-pgtable.h
+++ b/drivers/iommu/io-pgtable.h
@@ -158,14 +158,12 @@ void free_io_pgtable_ops(struct io_pgtable_ops *ops);
  * @fmt:    The page table format.
  * @cookie: An opaque token provided by the IOMMU driver and passed back to
  *          any callback routines.
- * @tlb_sync_pending: Private flag for optimising out redundant syncs.
  * @cfg:    A copy of the page table configuration.
  * @ops:    The page table operations in use for this set of page tables.
  */
 struct io_pgtable {
         enum io_pgtable_fmt     fmt;
         void                    *cookie;
-        bool                    tlb_sync_pending;
         struct io_pgtable_cfg   cfg;
         struct io_pgtable_ops   ops;
 };
@@ -175,22 +173,17 @@ struct io_pgtable {
 static inline void io_pgtable_tlb_flush_all(struct io_pgtable *iop)
 {
         iop->cfg.tlb->tlb_flush_all(iop->cookie);
-        iop->tlb_sync_pending = true;
 }
 
 static inline void io_pgtable_tlb_add_flush(struct io_pgtable *iop,
                 unsigned long iova, size_t size, size_t granule, bool leaf)
 {
         iop->cfg.tlb->tlb_add_flush(iova, size, granule, leaf, iop->cookie);
-        iop->tlb_sync_pending = true;
 }
 
 static inline void io_pgtable_tlb_sync(struct io_pgtable *iop)
 {
-        if (iop->tlb_sync_pending) {
-                iop->cfg.tlb->tlb_sync(iop->cookie);
-                iop->tlb_sync_pending = false;
-        }
+        iop->cfg.tlb->tlb_sync(iop->cookie);
 }
 
 /**
diff --git a/drivers/iommu/iommu-sysfs.c b/drivers/iommu/iommu-sysfs.c
index c58351ed61c1..36d1a7ce7fc4 100644
--- a/drivers/iommu/iommu-sysfs.c
+++ b/drivers/iommu/iommu-sysfs.c
@@ -62,32 +62,40 @@ int iommu_device_sysfs_add(struct iommu_device *iommu,
         va_list vargs;
         int ret;
 
-        device_initialize(&iommu->dev);
+        iommu->dev = kzalloc(sizeof(*iommu->dev), GFP_KERNEL);
+        if (!iommu->dev)
+                return -ENOMEM;
 
-        iommu->dev.class = &iommu_class;
-        iommu->dev.parent = parent;
-        iommu->dev.groups = groups;
+        device_initialize(iommu->dev);
+
+        iommu->dev->class = &iommu_class;
+        iommu->dev->parent = parent;
+        iommu->dev->groups = groups;
 
         va_start(vargs, fmt);
-        ret = kobject_set_name_vargs(&iommu->dev.kobj, fmt, vargs);
+        ret = kobject_set_name_vargs(&iommu->dev->kobj, fmt, vargs);
         va_end(vargs);
         if (ret)
                 goto error;
 
-        ret = device_add(&iommu->dev);
+        ret = device_add(iommu->dev);
         if (ret)
                 goto error;
 
+        dev_set_drvdata(iommu->dev, iommu);
+
         return 0;
 
 error:
-        put_device(&iommu->dev);
+        put_device(iommu->dev);
         return ret;
 }
 
 void iommu_device_sysfs_remove(struct iommu_device *iommu)
 {
-        device_unregister(&iommu->dev);
+        dev_set_drvdata(iommu->dev, NULL);
+        device_unregister(iommu->dev);
+        iommu->dev = NULL;
 }
 /*
  * IOMMU drivers can indicate a device is managed by a given IOMMU using
@@ -102,14 +110,14 @@ int iommu_device_link(struct iommu_device *iommu, struct device *link)
         if (!iommu || IS_ERR(iommu))
                 return -ENODEV;
 
-        ret = sysfs_add_link_to_group(&iommu->dev.kobj, "devices",
+        ret = sysfs_add_link_to_group(&iommu->dev->kobj, "devices",
                                       &link->kobj, dev_name(link));
         if (ret)
                 return ret;
 
-        ret = sysfs_create_link_nowarn(&link->kobj, &iommu->dev.kobj, "iommu");
+        ret = sysfs_create_link_nowarn(&link->kobj, &iommu->dev->kobj, "iommu");
         if (ret)
-                sysfs_remove_link_from_group(&iommu->dev.kobj, "devices",
+                sysfs_remove_link_from_group(&iommu->dev->kobj, "devices",
                                              dev_name(link));
 
         return ret;
@@ -121,5 +129,5 @@ void iommu_device_unlink(struct iommu_device *iommu, struct device *link)
                 return;
 
         sysfs_remove_link(&link->kobj, "iommu");
-        sysfs_remove_link_from_group(&iommu->dev.kobj, "devices", dev_name(link));
+        sysfs_remove_link_from_group(&iommu->dev->kobj, "devices", dev_name(link));
 }
diff --git a/drivers/iommu/mtk_iommu.c b/drivers/iommu/mtk_iommu.c
index 5d14cd15198d..91c6d367ab35 100644
--- a/drivers/iommu/mtk_iommu.c
+++ b/drivers/iommu/mtk_iommu.c
@@ -129,6 +129,7 @@ static void mtk_iommu_tlb_add_flush_nosync(unsigned long iova, size_t size,
         writel_relaxed(iova, data->base + REG_MMU_INVLD_START_A);
         writel_relaxed(iova + size - 1, data->base + REG_MMU_INVLD_END_A);
         writel_relaxed(F_MMU_INV_RANGE, data->base + REG_MMU_INVALIDATE);
+        data->tlb_flush_active = true;
 }
 
 static void mtk_iommu_tlb_sync(void *cookie)
@@ -137,6 +138,10 @@ static void mtk_iommu_tlb_sync(void *cookie)
         int ret;
         u32 tmp;
 
+        /* Avoid timing out if there's nothing to wait for */
+        if (!data->tlb_flush_active)
+                return;
+
         ret = readl_poll_timeout_atomic(data->base + REG_MMU_CPE_DONE, tmp,
                                         tmp != 0, 10, 100000);
         if (ret) {
@@ -146,6 +151,7 @@ static void mtk_iommu_tlb_sync(void *cookie)
         }
         /* Clear the CPE status */
         writel_relaxed(0, data->base + REG_MMU_CPE_DONE);
+        data->tlb_flush_active = false;
 }
 
 static const struct iommu_gather_ops mtk_iommu_gather_ops = {
diff --git a/drivers/iommu/mtk_iommu.h b/drivers/iommu/mtk_iommu.h
index 2a28eadeea0e..c06cc91b5d9a 100644
--- a/drivers/iommu/mtk_iommu.h
+++ b/drivers/iommu/mtk_iommu.h
@@ -47,6 +47,7 @@ struct mtk_iommu_data {
         struct iommu_group              *m4u_group;
         struct mtk_smi_iommu            smi_imu;      /* SMI larb iommu info */
         bool                            enable_4GB;
+        bool                            tlb_flush_active;
 
         struct iommu_device             iommu;
 };
diff --git a/drivers/irqchip/irq-atmel-aic-common.c b/drivers/irqchip/irq-atmel-aic-common.c
index 28b26c80f4cf..072bd227b6c6 100644
--- a/drivers/irqchip/irq-atmel-aic-common.c
+++ b/drivers/irqchip/irq-atmel-aic-common.c
@@ -137,14 +137,14 @@ static void __init aic_common_ext_irq_of_init(struct irq_domain *domain)
 #define AT91_RTC_IMR           0x28
 #define AT91_RTC_IRQ_MASK      0x1f
 
-void __init aic_common_rtc_irq_fixup(struct device_node *root)
+void __init aic_common_rtc_irq_fixup(void)
 {
         struct device_node *np;
         void __iomem *regs;
 
-        np = of_find_compatible_node(root, NULL, "atmel,at91rm9200-rtc");
+        np = of_find_compatible_node(NULL, NULL, "atmel,at91rm9200-rtc");
         if (!np)
-                np = of_find_compatible_node(root, NULL,
+                np = of_find_compatible_node(NULL, NULL,
                                              "atmel,at91sam9x5-rtc");
 
         if (!np)
@@ -165,7 +165,7 @@ void __init aic_common_rtc_irq_fixup(struct device_node *root)
 #define AT91_RTT_ALMIEN         (1 << 16)               /* Alarm Interrupt Enable */
 #define AT91_RTT_RTTINCIEN      (1 << 17)               /* Real Time Timer Increment Interrupt Enable */
 
-void __init aic_common_rtt_irq_fixup(struct device_node *root)
+void __init aic_common_rtt_irq_fixup(void)
 {
         struct device_node *np;
         void __iomem *regs;
@@ -196,11 +196,10 @@ static void __init aic_common_irq_fixup(const struct of_device_id *matches)
                 return;
 
         match = of_match_node(matches, root);
-        of_node_put(root);
 
         if (match) {
-                void (*fixup)(struct device_node *) = match->data;
-                fixup(root);
+                void (*fixup)(void) = match->data;
+                fixup();
         }
 
         of_node_put(root);
diff --git a/drivers/irqchip/irq-atmel-aic-common.h b/drivers/irqchip/irq-atmel-aic-common.h
index af60376d50de..242e62c1851e 100644
--- a/drivers/irqchip/irq-atmel-aic-common.h
+++ b/drivers/irqchip/irq-atmel-aic-common.h
@@ -33,8 +33,8 @@ struct irq_domain *__init aic_common_of_init(struct device_node *node,
                                              const char *name, int nirqs,
                                              const struct of_device_id *matches);
 
-void __init aic_common_rtc_irq_fixup(struct device_node *root);
+void __init aic_common_rtc_irq_fixup(void);
 
-void __init aic_common_rtt_irq_fixup(struct device_node *root);
+void __init aic_common_rtt_irq_fixup(void);
 
 #endif /* __IRQ_ATMEL_AIC_COMMON_H */
diff --git a/drivers/irqchip/irq-atmel-aic.c b/drivers/irqchip/irq-atmel-aic.c
index 37f952dd9fc9..bb1ad451392f 100644
--- a/drivers/irqchip/irq-atmel-aic.c
+++ b/drivers/irqchip/irq-atmel-aic.c
@@ -209,20 +209,20 @@ static const struct irq_domain_ops aic_irq_ops = {
         .xlate  = aic_irq_domain_xlate,
 };
 
-static void __init at91rm9200_aic_irq_fixup(struct device_node *root)
+static void __init at91rm9200_aic_irq_fixup(void)
 {
-        aic_common_rtc_irq_fixup(root);
+        aic_common_rtc_irq_fixup();
 }
 
-static void __init at91sam9260_aic_irq_fixup(struct device_node *root)
+static void __init at91sam9260_aic_irq_fixup(void)
 {
-        aic_common_rtt_irq_fixup(root);
+        aic_common_rtt_irq_fixup();
 }
 
-static void __init at91sam9g45_aic_irq_fixup(struct device_node *root)
+static void __init at91sam9g45_aic_irq_fixup(void)
 {
-        aic_common_rtc_irq_fixup(root);
-        aic_common_rtt_irq_fixup(root);
+        aic_common_rtc_irq_fixup();
+        aic_common_rtt_irq_fixup();
 }
 
 static const struct of_device_id aic_irq_fixups[] __initconst = {
diff --git a/drivers/irqchip/irq-atmel-aic5.c b/drivers/irqchip/irq-atmel-aic5.c
index c04ee9a23d09..6acad2ea0fb3 100644
--- a/drivers/irqchip/irq-atmel-aic5.c
+++ b/drivers/irqchip/irq-atmel-aic5.c
@@ -305,9 +305,9 @@ static const struct irq_domain_ops aic5_irq_ops = {
         .xlate  = aic5_irq_domain_xlate,
 };
 
-static void __init sama5d3_aic_irq_fixup(struct device_node *root)
+static void __init sama5d3_aic_irq_fixup(void)
 {
-        aic_common_rtc_irq_fixup(root);
+        aic_common_rtc_irq_fixup();
 }
 
 static const struct of_device_id aic5_irq_fixups[] __initconst = {
diff --git a/drivers/irqchip/irq-brcmstb-l2.c b/drivers/irqchip/irq-brcmstb-l2.c
index bddf169c4b37..b009b916a292 100644
--- a/drivers/irqchip/irq-brcmstb-l2.c
+++ b/drivers/irqchip/irq-brcmstb-l2.c
@@ -189,6 +189,7 @@ static int __init brcmstb_l2_intc_of_init(struct device_node *np,
 
         ct->chip.irq_suspend = brcmstb_l2_intc_suspend;
         ct->chip.irq_resume = brcmstb_l2_intc_resume;
+        ct->chip.irq_pm_shutdown = brcmstb_l2_intc_suspend;
 
         if (data->can_wake) {
                 /* This IRQ chip can wake the system, set all child interrupts
diff --git a/drivers/irqchip/irq-gic-v3-its-platform-msi.c b/drivers/irqchip/irq-gic-v3-its-platform-msi.c
index 249240d9a425..833a90fe33ae 100644
--- a/drivers/irqchip/irq-gic-v3-its-platform-msi.c
+++ b/drivers/irqchip/irq-gic-v3-its-platform-msi.c
@@ -43,6 +43,7 @@ static int of_pmsi_get_dev_id(struct irq_domain *domain, struct device *dev,
                         *dev_id = args.args[0];
                         break;
                 }
+                index++;
         } while (!ret);
 
         return ret;
diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index 68932873eebc..284738add89b 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -1835,7 +1835,7 @@ static int __init its_of_probe(struct device_node *node)
 
 #define ACPI_GICV3_ITS_MEM_SIZE (SZ_128K)
 
-#if defined(CONFIG_ACPI_NUMA) && (ACPI_CA_VERSION >= 0x20170531)
+#ifdef CONFIG_ACPI_NUMA
 struct its_srat_map {
         /* numa node id */
         u32     numa_node;
@@ -1843,7 +1843,7 @@ struct its_srat_map {
         u32     its_id;
 };
 
-static struct its_srat_map its_srat_maps[MAX_NUMNODES] __initdata;
+static struct its_srat_map *its_srat_maps __initdata;
 static int its_in_srat __initdata;
 
 static int __init acpi_get_its_numa_node(u32 its_id)
@@ -1857,6 +1857,12 @@ static int __init acpi_get_its_numa_node(u32 its_id)
         return NUMA_NO_NODE;
 }
 
+static int __init gic_acpi_match_srat_its(struct acpi_subtable_header *header,
+                                          const unsigned long end)
+{
+        return 0;
+}
+
 static int __init gic_acpi_parse_srat_its(struct acpi_subtable_header *header,
                          const unsigned long end)
 {
@@ -1873,12 +1879,6 @@ static int __init gic_acpi_parse_srat_its(struct acpi_subtable_header *header,
                 return -EINVAL;
         }
 
-        if (its_in_srat >= MAX_NUMNODES) {
-                pr_err("SRAT: ITS affinity exceeding max count[%d]\n",
-                                MAX_NUMNODES);
-                return -EINVAL;
-        }
-
         node = acpi_map_pxm_to_node(its_affinity->proximity_domain);
 
         if (node == NUMA_NO_NODE || node >= MAX_NUMNODES) {
@@ -1897,14 +1897,37 @@ static int __init gic_acpi_parse_srat_its(struct acpi_subtable_header *header,
 
 static void __init acpi_table_parse_srat_its(void)
 {
+        int count;
+
+        count = acpi_table_parse_entries(ACPI_SIG_SRAT,
+                        sizeof(struct acpi_table_srat),
+                        ACPI_SRAT_TYPE_GIC_ITS_AFFINITY,
+                        gic_acpi_match_srat_its, 0);
+        if (count <= 0)
+                return;
+
+        its_srat_maps = kmalloc(count * sizeof(struct its_srat_map),
+                                GFP_KERNEL);
+        if (!its_srat_maps) {
+                pr_warn("SRAT: Failed to allocate memory for its_srat_maps!\n");
+                return;
+        }
+
         acpi_table_parse_entries(ACPI_SIG_SRAT,
                         sizeof(struct acpi_table_srat),
                         ACPI_SRAT_TYPE_GIC_ITS_AFFINITY,
                         gic_acpi_parse_srat_its, 0);
 }
+
+/* free the its_srat_maps after ITS probing */
+static void __init acpi_its_srat_maps_free(void)
+{
+        kfree(its_srat_maps);
+}
 #else
 static void __init acpi_table_parse_srat_its(void)      { }
 static int __init acpi_get_its_numa_node(u32 its_id) { return NUMA_NO_NODE; }
+static void __init acpi_its_srat_maps_free(void) { }
 #endif
 
 static int __init gic_acpi_parse_madt_its(struct acpi_subtable_header *header,
@@ -1951,6 +1974,7 @@ static void __init its_acpi_probe(void)
         acpi_table_parse_srat_its();
         acpi_table_parse_madt(ACPI_MADT_TYPE_GENERIC_TRANSLATOR,
                               gic_acpi_parse_madt_its, 0);
+        acpi_its_srat_maps_free();
 }
 #else
 static void __init its_acpi_probe(void) { }
diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c
index dbffb7ab6203..984c3ecfd22c 100644
--- a/drivers/irqchip/irq-gic-v3.c
+++ b/drivers/irqchip/irq-gic-v3.c
@@ -353,6 +353,8 @@ static asmlinkage void __exception_irq_entry gic_handle_irq(struct pt_regs *regs
 
                         if (static_key_true(&supports_deactivate))
                                 gic_write_eoir(irqnr);
+                        else
+                                isb();
 
                         err = handle_domain_irq(gic_data.domain, irqnr, regs);
                         if (err) {
@@ -640,11 +642,16 @@ static void gic_smp_init(void)
 static int gic_set_affinity(struct irq_data *d, const struct cpumask *mask_val,
                             bool force)
 {
-        unsigned int cpu = cpumask_any_and(mask_val, cpu_online_mask);
+        unsigned int cpu;
         void __iomem *reg;
         int enabled;
         u64 val;
 
+        if (force)
+                cpu = cpumask_first(mask_val);
+        else
+                cpu = cpumask_any_and(mask_val, cpu_online_mask);
+
         if (cpu >= nr_cpu_ids)
                 return -EINVAL;
 
@@ -831,8 +838,11 @@ static int gic_irq_domain_alloc(struct irq_domain *domain, unsigned int virq,
         if (ret)
                 return ret;
 
-        for (i = 0; i < nr_irqs; i++)
-                gic_irq_domain_map(domain, virq + i, hwirq + i);
+        for (i = 0; i < nr_irqs; i++) {
+                ret = gic_irq_domain_map(domain, virq + i, hwirq + i);
+                if (ret)
+                        return ret;
+        }
 
         return 0;
 }
diff --git a/drivers/irqchip/irq-gic.c b/drivers/irqchip/irq-gic.c
index 1b1df4f770bd..d3e7c43718b8 100644
--- a/drivers/irqchip/irq-gic.c
+++ b/drivers/irqchip/irq-gic.c
@@ -361,6 +361,7 @@ static void __exception_irq_entry gic_handle_irq(struct pt_regs *regs)
                 if (likely(irqnr > 15 && irqnr < 1020)) {
                         if (static_key_true(&supports_deactivate))
                                 writel_relaxed(irqstat, cpu_base + GIC_CPU_EOI);
+                        isb();
                         handle_domain_irq(gic->domain, irqnr, regs);
                         continue;
                 }
@@ -401,10 +402,12 @@ static void gic_handle_cascade_irq(struct irq_desc *desc)
                 goto out;
 
         cascade_irq = irq_find_mapping(chip_data->domain, gic_irq);
-        if (unlikely(gic_irq < 32 || gic_irq > 1020))
+        if (unlikely(gic_irq < 32 || gic_irq > 1020)) {
                 handle_bad_irq(desc);
-        else
+        } else {
+                isb();
                 generic_handle_irq(cascade_irq);
+        }
 
  out:
         chained_irq_exit(chip, desc);
@@ -1027,8 +1030,11 @@ static int gic_irq_domain_alloc(struct irq_domain *domain, unsigned int virq,
         if (ret)
                 return ret;
 
-        for (i = 0; i < nr_irqs; i++)
-                gic_irq_domain_map(domain, virq + i, hwirq + i);
+        for (i = 0; i < nr_irqs; i++) {
+                ret = gic_irq_domain_map(domain, virq + i, hwirq + i);
+                if (ret)
+                        return ret;
+        }
 
         return 0;
 }
diff --git a/drivers/irqchip/irq-mips-gic.c b/drivers/irqchip/irq-mips-gic.c
index 6ab1d3afec02..48ee1bad473f 100644
--- a/drivers/irqchip/irq-mips-gic.c
+++ b/drivers/irqchip/irq-mips-gic.c
@@ -1020,8 +1020,11 @@ static int __init gic_of_init(struct device_node *node,
                 gic_len = resource_size(&res);
         }
 
-        if (mips_cm_present())
+        if (mips_cm_present()) {
                 write_gcr_gic_base(gic_base | CM_GCR_GIC_BASE_GICEN_MSK);
+                /* Ensure GIC region is enabled before trying to access it */
+                __sync();
+        }
         gic_present = true;
 
         __gic_init(gic_base, gic_len, cpu_vec, 0, node);
diff --git a/drivers/isdn/hysdn/hysdn_proclog.c b/drivers/isdn/hysdn/hysdn_proclog.c
index 7b5fd8fb1761..aaca0b3d662e 100644
--- a/drivers/isdn/hysdn/hysdn_proclog.c
+++ b/drivers/isdn/hysdn/hysdn_proclog.c
@@ -44,7 +44,6 @@ struct procdata {
         char log_name[15];      /* log filename */
         struct log_data *log_head, *log_tail;   /* head and tail for queue */
         int if_used;            /* open count for interface */
-        int volatile del_lock;  /* lock for delete operations */
         unsigned char logtmp[LOG_MAX_LINELEN];
         wait_queue_head_t rd_queue;
 };
@@ -102,7 +101,6 @@ put_log_buffer(hysdn_card *card, char *cp)
 {
         struct log_data *ib;
         struct procdata *pd = card->proclog;
-        int i;
         unsigned long flags;
 
         if (!pd)
@@ -126,21 +124,21 @@ put_log_buffer(hysdn_card *card, char *cp)
         else
                 pd->log_tail->next = ib;        /* follows existing messages */
         pd->log_tail = ib;      /* new tail */
-        i = pd->del_lock++;     /* get lock state */
-        spin_unlock_irqrestore(&card->hysdn_lock, flags);
 
         /* delete old entrys */
-        if (!i)
-                while (pd->log_head->next) {
-                        if ((pd->log_head->usage_cnt <= 0) &&
-                            (pd->log_head->next->usage_cnt <= 0)) {
-                                ib = pd->log_head;
-                                pd->log_head = pd->log_head->next;
-                                kfree(ib);
-                        } else
-                                break;
-                }               /* pd->log_head->next */
-        pd->del_lock--;         /* release lock level */
+        while (pd->log_head->next) {
+                if ((pd->log_head->usage_cnt <= 0) &&
+                    (pd->log_head->next->usage_cnt <= 0)) {
+                        ib = pd->log_head;
+                        pd->log_head = pd->log_head->next;
+                        kfree(ib);
+                } else {
+                        break;
+                }
+        }               /* pd->log_head->next */
+
+        spin_unlock_irqrestore(&card->hysdn_lock, flags);
+
         wake_up_interruptible(&(pd->rd_queue));         /* announce new entry */
 }                               /* put_log_buffer */
 
diff --git a/drivers/isdn/i4l/isdn_common.c b/drivers/isdn/i4l/isdn_common.c
index 89b09c51ab7c..38a5bb764c7b 100644
--- a/drivers/isdn/i4l/isdn_common.c
+++ b/drivers/isdn/i4l/isdn_common.c
@@ -1376,6 +1376,7 @@ isdn_ioctl(struct file *file, uint cmd, ulong arg)
                         if (arg) {
                                 if (copy_from_user(bname, argp, sizeof(bname) - 1))
                                         return -EFAULT;
+                                bname[sizeof(bname)-1] = 0;
                         } else
                                 return -EINVAL;
                         ret = mutex_lock_interruptible(&dev->mtx);
diff --git a/drivers/isdn/i4l/isdn_net.c b/drivers/isdn/i4l/isdn_net.c
index c151c6daa67e..f63a110b7bcb 100644
--- a/drivers/isdn/i4l/isdn_net.c
+++ b/drivers/isdn/i4l/isdn_net.c
@@ -2611,10 +2611,9 @@ isdn_net_newslave(char *parm)
         char newname[10];
 
         if (p) {
-                /* Slave-Name MUST not be empty */
-                if (!strlen(p + 1))
+                /* Slave-Name MUST not be empty or overflow 'newname' */
+                if (strscpy(newname, p + 1, sizeof(newname)) <= 0)
                         return NULL;
-                strcpy(newname, p + 1);
                 *p = 0;
                 /* Master must already exist */
                 if (!(n = isdn_net_findif(parm)))
diff --git a/drivers/isdn/mISDN/fsm.c b/drivers/isdn/mISDN/fsm.c
index 78fc5d5e9051..92e6570b1143 100644
--- a/drivers/isdn/mISDN/fsm.c
+++ b/drivers/isdn/mISDN/fsm.c
@@ -26,7 +26,7 @@
 
 #define FSM_TIMER_DEBUG 0
 
-void
+int
 mISDN_FsmNew(struct Fsm *fsm,
              struct FsmNode *fnlist, int fncount)
 {
@@ -34,6 +34,8 @@ mISDN_FsmNew(struct Fsm *fsm,
 
         fsm->jumpmatrix = kzalloc(sizeof(FSMFNPTR) * fsm->state_count *
                                   fsm->event_count, GFP_KERNEL);
+        if (fsm->jumpmatrix == NULL)
+                return -ENOMEM;
 
         for (i = 0; i < fncount; i++)
                 if ((fnlist[i].state >= fsm->state_count) ||
@@ -45,6 +47,7 @@ mISDN_FsmNew(struct Fsm *fsm,
                 } else
                         fsm->jumpmatrix[fsm->state_count * fnlist[i].event +
                                         fnlist[i].state] = (FSMFNPTR) fnlist[i].routine;
+        return 0;
 }
 EXPORT_SYMBOL(mISDN_FsmNew);
 
diff --git a/drivers/isdn/mISDN/fsm.h b/drivers/isdn/mISDN/fsm.h
index 928f5be192c1..e1def8490221 100644
--- a/drivers/isdn/mISDN/fsm.h
+++ b/drivers/isdn/mISDN/fsm.h
@@ -55,7 +55,7 @@ struct FsmTimer {
         void *arg;
 };
 
-extern void mISDN_FsmNew(struct Fsm *, struct FsmNode *, int);
+extern int mISDN_FsmNew(struct Fsm *, struct FsmNode *, int);
 extern void mISDN_FsmFree(struct Fsm *);
 extern int mISDN_FsmEvent(struct FsmInst *, int , void *);
 extern void mISDN_FsmChangeState(struct FsmInst *, int);
diff --git a/drivers/isdn/mISDN/layer1.c b/drivers/isdn/mISDN/layer1.c
index bebc57b72138..3192b0eb3944 100644
--- a/drivers/isdn/mISDN/layer1.c
+++ b/drivers/isdn/mISDN/layer1.c
@@ -414,8 +414,7 @@ l1_init(u_int *deb)
         l1fsm_s.event_count = L1_EVENT_COUNT;
         l1fsm_s.strEvent = strL1Event;
         l1fsm_s.strState = strL1SState;
-        mISDN_FsmNew(&l1fsm_s, L1SFnList, ARRAY_SIZE(L1SFnList));
-        return 0;
+        return mISDN_FsmNew(&l1fsm_s, L1SFnList, ARRAY_SIZE(L1SFnList));
 }
 
 void
diff --git a/drivers/isdn/mISDN/layer2.c b/drivers/isdn/mISDN/layer2.c
index 7243a6746f8b..9ff0903a0e89 100644
--- a/drivers/isdn/mISDN/layer2.c
+++ b/drivers/isdn/mISDN/layer2.c
@@ -2247,15 +2247,26 @@ static struct Bprotocol X75SLP = {
 int
 Isdnl2_Init(u_int *deb)
 {
+        int res;
         debug = deb;
         mISDN_register_Bprotocol(&X75SLP);
         l2fsm.state_count = L2_STATE_COUNT;
         l2fsm.event_count = L2_EVENT_COUNT;
         l2fsm.strEvent = strL2Event;
         l2fsm.strState = strL2State;
-        mISDN_FsmNew(&l2fsm, L2FnList, ARRAY_SIZE(L2FnList));
-        TEIInit(deb);
+        res = mISDN_FsmNew(&l2fsm, L2FnList, ARRAY_SIZE(L2FnList));
+        if (res)
+                goto error;
+        res = TEIInit(deb);
+        if (res)
+                goto error_fsm;
         return 0;
+
+error_fsm:
+        mISDN_FsmFree(&l2fsm);
+error:
+        mISDN_unregister_Bprotocol(&X75SLP);
+        return res;
 }
 
 void
diff --git a/drivers/isdn/mISDN/tei.c b/drivers/isdn/mISDN/tei.c
index 908127efccf8..12d9e5f4beb1 100644
--- a/drivers/isdn/mISDN/tei.c
+++ b/drivers/isdn/mISDN/tei.c
@@ -1387,23 +1387,37 @@ create_teimanager(struct mISDNdevice *dev)
 
 int TEIInit(u_int *deb)
 {
+        int res;
         debug = deb;
         teifsmu.state_count = TEI_STATE_COUNT;
         teifsmu.event_count = TEI_EVENT_COUNT;
         teifsmu.strEvent = strTeiEvent;
         teifsmu.strState = strTeiState;
-        mISDN_FsmNew(&teifsmu, TeiFnListUser, ARRAY_SIZE(TeiFnListUser));
+        res = mISDN_FsmNew(&teifsmu, TeiFnListUser, ARRAY_SIZE(TeiFnListUser));
+        if (res)
+                goto error;
         teifsmn.state_count = TEI_STATE_COUNT;
         teifsmn.event_count = TEI_EVENT_COUNT;
         teifsmn.strEvent = strTeiEvent;
         teifsmn.strState = strTeiState;
-        mISDN_FsmNew(&teifsmn, TeiFnListNet, ARRAY_SIZE(TeiFnListNet));
+        res = mISDN_FsmNew(&teifsmn, TeiFnListNet, ARRAY_SIZE(TeiFnListNet));
+        if (res)
+                goto error_smn;
         deactfsm.state_count =  DEACT_STATE_COUNT;
         deactfsm.event_count = DEACT_EVENT_COUNT;
         deactfsm.strEvent = strDeactEvent;
         deactfsm.strState = strDeactState;
-        mISDN_FsmNew(&deactfsm, DeactFnList, ARRAY_SIZE(DeactFnList));
+        res = mISDN_FsmNew(&deactfsm, DeactFnList, ARRAY_SIZE(DeactFnList));
+        if (res)
+                goto error_deact;
         return 0;
+
+error_deact:
+        mISDN_FsmFree(&teifsmn);
+error_smn:
+        mISDN_FsmFree(&teifsmu);
+error:
+        return res;
 }
 
 void TEIFree(void)
diff --git a/drivers/lightnvm/pblk-rb.c b/drivers/lightnvm/pblk-rb.c
index 5ecc154f6831..9bc32578a766 100644
--- a/drivers/lightnvm/pblk-rb.c
+++ b/drivers/lightnvm/pblk-rb.c
@@ -657,7 +657,7 @@ try:
  * be directed to disk.
  */
 int pblk_rb_copy_to_bio(struct pblk_rb *rb, struct bio *bio, sector_t lba,
-                        struct ppa_addr ppa, int bio_iter)
+                        struct ppa_addr ppa, int bio_iter, bool advanced_bio)
 {
         struct pblk *pblk = container_of(rb, struct pblk, rwb);
         struct pblk_rb_entry *entry;
@@ -694,7 +694,7 @@ int pblk_rb_copy_to_bio(struct pblk_rb *rb, struct bio *bio, sector_t lba,
          * filled with data from the cache). If part of the data resides on the
          * media, we will read later on
          */
-        if (unlikely(!bio->bi_iter.bi_idx))
+        if (unlikely(!advanced_bio))
                 bio_advance(bio, bio_iter * PBLK_EXPOSED_PAGE_SIZE);
 
         data = bio_data(bio);
diff --git a/drivers/lightnvm/pblk-read.c b/drivers/lightnvm/pblk-read.c
index 4e5c48f3de62..d682e89e6493 100644
--- a/drivers/lightnvm/pblk-read.c
+++ b/drivers/lightnvm/pblk-read.c
@@ -26,7 +26,7 @@
  */
 static int pblk_read_from_cache(struct pblk *pblk, struct bio *bio,
                                 sector_t lba, struct ppa_addr ppa,
-                                int bio_iter)
+                                int bio_iter, bool advanced_bio)
 {
 #ifdef CONFIG_NVM_DEBUG
         /* Callers must ensure that the ppa points to a cache address */
@@ -34,7 +34,8 @@ static int pblk_read_from_cache(struct pblk *pblk, struct bio *bio,
         BUG_ON(!pblk_addr_in_cache(ppa));
 #endif
 
-        return pblk_rb_copy_to_bio(&pblk->rwb, bio, lba, ppa, bio_iter);
+        return pblk_rb_copy_to_bio(&pblk->rwb, bio, lba, ppa,
+                                                bio_iter, advanced_bio);
 }
 
 static void pblk_read_ppalist_rq(struct pblk *pblk, struct nvm_rq *rqd,
@@ -44,7 +45,7 @@ static void pblk_read_ppalist_rq(struct pblk *pblk, struct nvm_rq *rqd,
         struct ppa_addr ppas[PBLK_MAX_REQ_ADDRS];
         sector_t blba = pblk_get_lba(bio);
         int nr_secs = rqd->nr_ppas;
-        int advanced_bio = 0;
+        bool advanced_bio = false;
         int i, j = 0;
 
         /* logic error: lba out-of-bounds. Ignore read request */
@@ -62,19 +63,26 @@ static void pblk_read_ppalist_rq(struct pblk *pblk, struct nvm_rq *rqd,
 retry:
                 if (pblk_ppa_empty(p)) {
                         WARN_ON(test_and_set_bit(i, read_bitmap));
-                        continue;
+
+                        if (unlikely(!advanced_bio)) {
+                                bio_advance(bio, (i) * PBLK_EXPOSED_PAGE_SIZE);
+                                advanced_bio = true;
+                        }
+
+                        goto next;
                 }
 
                 /* Try to read from write buffer. The address is later checked
                  * on the write buffer to prevent retrieving overwritten data.
                  */
                 if (pblk_addr_in_cache(p)) {
-                        if (!pblk_read_from_cache(pblk, bio, lba, p, i)) {
+                        if (!pblk_read_from_cache(pblk, bio, lba, p, i,
+                                                                advanced_bio)) {
                                 pblk_lookup_l2p_seq(pblk, &p, lba, 1);
                                 goto retry;
                         }
                         WARN_ON(test_and_set_bit(i, read_bitmap));
-                        advanced_bio = 1;
+                        advanced_bio = true;
 #ifdef CONFIG_NVM_DEBUG
                         atomic_long_inc(&pblk->cache_reads);
 #endif
@@ -83,6 +91,7 @@ retry:
                         rqd->ppa_list[j++] = p;
                 }
 
+next:
                 if (advanced_bio)
                         bio_advance(bio, PBLK_EXPOSED_PAGE_SIZE);
         }
@@ -282,7 +291,7 @@ retry:
          * write buffer to prevent retrieving overwritten data.
          */
         if (pblk_addr_in_cache(ppa)) {
-                if (!pblk_read_from_cache(pblk, bio, lba, ppa, 0)) {
+                if (!pblk_read_from_cache(pblk, bio, lba, ppa, 0, 1)) {
                         pblk_lookup_l2p_seq(pblk, &ppa, lba, 1);
                         goto retry;
                 }
diff --git a/drivers/lightnvm/pblk.h b/drivers/lightnvm/pblk.h
index 0c5692cc2f60..67e623bd5c2d 100644
--- a/drivers/lightnvm/pblk.h
+++ b/drivers/lightnvm/pblk.h
@@ -670,7 +670,7 @@ unsigned int pblk_rb_read_to_bio_list(struct pblk_rb *rb, struct bio *bio,
                                       struct list_head *list,
                                       unsigned int max);
 int pblk_rb_copy_to_bio(struct pblk_rb *rb, struct bio *bio, sector_t lba,
-                        struct ppa_addr ppa, int bio_iter);
+                        struct ppa_addr ppa, int bio_iter, bool advanced_bio);
 unsigned int pblk_rb_read_commit(struct pblk_rb *rb, unsigned int entries);
 
 unsigned int pblk_rb_sync_init(struct pblk_rb *rb, unsigned long *flags);
diff --git a/drivers/mailbox/pcc.c b/drivers/mailbox/pcc.c
index ac91fd0d62c6..cbca5e51b975 100644
--- a/drivers/mailbox/pcc.c
+++ b/drivers/mailbox/pcc.c
@@ -92,7 +92,7 @@ static struct mbox_controller pcc_mbox_ctrl = {};
  */
 static struct mbox_chan *get_pcc_channel(int id)
 {
-        if (id < 0 || id > pcc_mbox_ctrl.num_chans)
+        if (id < 0 || id >= pcc_mbox_ctrl.num_chans)
                 return ERR_PTR(-ENOENT);
 
         return &pcc_mbox_channels[id];
diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c
index 850ff6c67994..44f4a8ac95bd 100644
--- a/drivers/md/dm-bufio.c
+++ b/drivers/md/dm-bufio.c
@@ -1258,8 +1258,7 @@ EXPORT_SYMBOL_GPL(dm_bufio_write_dirty_buffers_async);
  */
 int dm_bufio_write_dirty_buffers(struct dm_bufio_client *c)
 {
-        blk_status_t a;
-        int f;
+        int a, f;
         unsigned long buffers_processed = 0;
         struct dm_buffer *b, *tmp;
 
diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c
index 1b224aa9cf15..3acce09bba35 100644
--- a/drivers/md/dm-integrity.c
+++ b/drivers/md/dm-integrity.c
@@ -1587,16 +1587,18 @@ retry:
         if (likely(ic->mode == 'J')) {
                 if (dio->write) {
                         unsigned next_entry, i, pos;
-                        unsigned ws, we;
+                        unsigned ws, we, range_sectors;
 
-                        dio->range.n_sectors = min(dio->range.n_sectors, ic->free_sectors);
+                        dio->range.n_sectors = min(dio->range.n_sectors,
+                                                   ic->free_sectors << ic->sb->log2_sectors_per_block);
                         if (unlikely(!dio->range.n_sectors))
                                 goto sleep;
-                        ic->free_sectors -= dio->range.n_sectors;
+                        range_sectors = dio->range.n_sectors >> ic->sb->log2_sectors_per_block;
+                        ic->free_sectors -= range_sectors;
                         journal_section = ic->free_section;
                         journal_entry = ic->free_section_entry;
 
-                        next_entry = ic->free_section_entry + dio->range.n_sectors;
+                        next_entry = ic->free_section_entry + range_sectors;
                         ic->free_section_entry = next_entry % ic->journal_section_entries;
                         ic->free_section += next_entry / ic->journal_section_entries;
                         ic->n_uncommitted_sections += next_entry / ic->journal_section_entries;
@@ -1727,6 +1729,8 @@ static void pad_uncommitted(struct dm_integrity_c *ic)
                 wraparound_section(ic, &ic->free_section);
                 ic->n_uncommitted_sections++;
         }
+        WARN_ON(ic->journal_sections * ic->journal_section_entries !=
+                (ic->n_uncommitted_sections + ic->n_committed_sections) * ic->journal_section_entries + ic->free_sectors);
 }
 
 static void integrity_commit(struct work_struct *w)
@@ -1821,6 +1825,9 @@ static void do_journal_write(struct dm_integrity_c *ic, unsigned write_start,
 {
         unsigned i, j, n;
         struct journal_completion comp;
+        struct blk_plug plug;
+
+        blk_start_plug(&plug);
 
         comp.ic = ic;
         comp.in_flight = (atomic_t)ATOMIC_INIT(1);
@@ -1945,6 +1952,8 @@ skip_io:
 
         dm_bufio_write_dirty_buffers_async(ic->bufio);
 
+        blk_finish_plug(&plug);
+
         complete_journal_op(&comp);
         wait_for_completion_io(&comp.comp);
 
@@ -3019,6 +3028,11 @@ static int dm_integrity_ctr(struct dm_target *ti, unsigned argc, char **argv)
                 ti->error = "Block size doesn't match the information in superblock";
                 goto bad;
         }
+        if (!le32_to_cpu(ic->sb->journal_sections)) {
+                r = -EINVAL;
+                ti->error = "Corrupted superblock, journal_sections is 0";
+                goto bad;
+        }
         /* make sure that ti->max_io_len doesn't overflow */
         if (ic->sb->log2_interleave_sectors < MIN_LOG2_INTERLEAVE_SECTORS ||
             ic->sb->log2_interleave_sectors > MAX_LOG2_INTERLEAVE_SECTORS) {
diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
index 0e8ab5bb3575..d24e4b05f5da 100644
--- a/drivers/md/dm-mpath.c
+++ b/drivers/md/dm-mpath.c
@@ -504,7 +504,6 @@ static int multipath_clone_and_map(struct dm_target *ti, struct request *rq,
                 if (queue_dying) {
                         atomic_inc(&m->pg_init_in_progress);
                         activate_or_offline_path(pgpath);
-                        return DM_MAPIO_REQUEUE;
                 }
                 return DM_MAPIO_DELAY_REQUEUE;
         }
@@ -1458,7 +1457,6 @@ static int noretry_error(blk_status_t error)
         case BLK_STS_TARGET:
         case BLK_STS_NEXUS:
         case BLK_STS_MEDIUM:
-        case BLK_STS_RESOURCE:
                 return 1;
         }
 
diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c
index 2e10c2f13a34..5bfe285ea9d1 100644
--- a/drivers/md/dm-raid.c
+++ b/drivers/md/dm-raid.c
@@ -208,6 +208,7 @@ struct raid_dev {
 #define RT_FLAG_RS_BITMAP_LOADED        2
 #define RT_FLAG_UPDATE_SBS              3
 #define RT_FLAG_RESHAPE_RS              4
+#define RT_FLAG_RS_SUSPENDED            5
 
 /* Array elements of 64 bit needed for rebuild/failed disk bits */
 #define DISKS_ARRAY_ELEMS ((MAX_RAID_DEVICES + (sizeof(uint64_t) * 8 - 1)) / sizeof(uint64_t) / 8)
@@ -564,9 +565,10 @@ static const char *raid10_md_layout_to_format(int layout)
         if (__raid10_near_copies(layout) > 1)
                 return "near";
 
-        WARN_ON(__raid10_far_copies(layout) < 2);
+        if (__raid10_far_copies(layout) > 1)
+                return "far";
 
-        return "far";
+        return "unknown";
 }
 
 /* Return md raid10 algorithm for @name */
@@ -2540,11 +2542,6 @@ static int analyse_superblocks(struct dm_target *ti, struct raid_set *rs)
         if (!freshest)
                 return 0;
 
-        if (validate_raid_redundancy(rs)) {
-                rs->ti->error = "Insufficient redundancy to activate array";
-                return -EINVAL;
-        }
-
         /*
          * Validation of the freshest device provides the source of
          * validation for the remaining devices.
@@ -2553,6 +2550,11 @@ static int analyse_superblocks(struct dm_target *ti, struct raid_set *rs)
         if (super_validate(rs, freshest))
                 return -EINVAL;
 
+        if (validate_raid_redundancy(rs)) {
+                rs->ti->error = "Insufficient redundancy to activate array";
+                return -EINVAL;
+        }
+
         rdev_for_each(rdev, mddev)
                 if (!test_bit(Journal, &rdev->flags) &&
                     rdev != freshest &&
@@ -3168,6 +3170,7 @@ static int raid_ctr(struct dm_target *ti, unsigned int argc, char **argv)
         }
 
         mddev_suspend(&rs->md);
+        set_bit(RT_FLAG_RS_SUSPENDED, &rs->runtime_flags);
 
         /* Try to adjust the raid4/5/6 stripe cache size to the stripe size */
         if (rs_is_raid456(rs)) {
@@ -3625,7 +3628,7 @@ static void raid_postsuspend(struct dm_target *ti)
 {
         struct raid_set *rs = ti->private;
 
-        if (!rs->md.suspended)
+        if (!test_and_set_bit(RT_FLAG_RS_SUSPENDED, &rs->runtime_flags))
                 mddev_suspend(&rs->md);
 
         rs->md.ro = 1;
@@ -3759,7 +3762,7 @@ static int rs_start_reshape(struct raid_set *rs)
                 return r;
 
         /* Need to be resumed to be able to start reshape, recovery is frozen until raid_resume() though */
-        if (mddev->suspended)
+        if (test_and_clear_bit(RT_FLAG_RS_SUSPENDED, &rs->runtime_flags))
                 mddev_resume(mddev);
 
         /*
@@ -3786,8 +3789,8 @@ static int rs_start_reshape(struct raid_set *rs)
         }
 
         /* Suspend because a resume will happen in raid_resume() */
-        if (!mddev->suspended)
-                mddev_suspend(mddev);
+        set_bit(RT_FLAG_RS_SUSPENDED, &rs->runtime_flags);
+        mddev_suspend(mddev);
 
         /*
          * Now reshape got set up, update superblocks to
@@ -3883,13 +3886,13 @@ static void raid_resume(struct dm_target *ti)
         if (!(rs->ctr_flags & RESUME_STAY_FROZEN_FLAGS))
                 clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
 
-        if (mddev->suspended)
+        if (test_and_clear_bit(RT_FLAG_RS_SUSPENDED, &rs->runtime_flags))
                 mddev_resume(mddev);
 }
 
 static struct target_type raid_target = {
         .name = "raid",
-        .version = {1, 11, 1},
+        .version = {1, 12, 1},
         .module = THIS_MODULE,
         .ctr = raid_ctr,
         .dtr = raid_dtr,
diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
index a39bcd9b982a..28a4071cdf85 100644
--- a/drivers/md/dm-table.c
+++ b/drivers/md/dm-table.c
@@ -20,6 +20,7 @@
 #include <linux/atomic.h>
 #include <linux/blk-mq.h>
 #include <linux/mount.h>
+#include <linux/dax.h>
 
 #define DM_MSG_PREFIX "table"
 
@@ -1630,6 +1631,37 @@ static bool dm_table_supports_flush(struct dm_table *t, unsigned long flush)
         return false;
 }
 
+static int device_dax_write_cache_enabled(struct dm_target *ti,
+                                          struct dm_dev *dev, sector_t start,
+                                          sector_t len, void *data)
+{
+        struct dax_device *dax_dev = dev->dax_dev;
+
+        if (!dax_dev)
+                return false;
+
+        if (dax_write_cache_enabled(dax_dev))
+                return true;
+        return false;
+}
+
+static int dm_table_supports_dax_write_cache(struct dm_table *t)
+{
+        struct dm_target *ti;
+        unsigned i;
+
+        for (i = 0; i < dm_table_get_num_targets(t); i++) {
+                ti = dm_table_get_target(t, i);
+
+                if (ti->type->iterate_devices &&
+                    ti->type->iterate_devices(ti,
+                                device_dax_write_cache_enabled, NULL))
+                        return true;
+        }
+
+        return false;
+}
+
 static int device_is_nonrot(struct dm_target *ti, struct dm_dev *dev,
                             sector_t start, sector_t len, void *data)
 {
@@ -1785,6 +1817,9 @@ void dm_table_set_restrictions(struct dm_table *t, struct request_queue *q,
         }
         blk_queue_write_cache(q, wc, fua);
 
+        if (dm_table_supports_dax_write_cache(t))
+                dax_write_cache(t->md->dax_dev, true);
+
         /* Ensure that all underlying devices are non-rotational. */
         if (dm_table_all_devices_attribute(t, device_is_nonrot))
                 queue_flag_set_unlocked(QUEUE_FLAG_NONROT, q);
diff --git a/drivers/md/dm-verity-fec.c b/drivers/md/dm-verity-fec.c
index 504ba3fa328b..e13f90832b6b 100644
--- a/drivers/md/dm-verity-fec.c
+++ b/drivers/md/dm-verity-fec.c
@@ -308,19 +308,14 @@ static int fec_alloc_bufs(struct dm_verity *v, struct dm_verity_fec_io *fio)
 {
         unsigned n;
 
-        if (!fio->rs) {
-                fio->rs = mempool_alloc(v->fec->rs_pool, 0);
-                if (unlikely(!fio->rs)) {
-                        DMERR("failed to allocate RS");
-                        return -ENOMEM;
-                }
-        }
+        if (!fio->rs)
+                fio->rs = mempool_alloc(v->fec->rs_pool, GFP_NOIO);
 
         fec_for_each_prealloc_buffer(n) {
                 if (fio->bufs[n])
                         continue;
 
-                fio->bufs[n] = mempool_alloc(v->fec->prealloc_pool, GFP_NOIO);
+                fio->bufs[n] = mempool_alloc(v->fec->prealloc_pool, GFP_NOWAIT);
                 if (unlikely(!fio->bufs[n])) {
                         DMERR("failed to allocate FEC buffer");
                         return -ENOMEM;
@@ -332,22 +327,16 @@ static int fec_alloc_bufs(struct dm_verity *v, struct dm_verity_fec_io *fio)
                 if (fio->bufs[n])
                         continue;
 
-                fio->bufs[n] = mempool_alloc(v->fec->extra_pool, GFP_NOIO);
+                fio->bufs[n] = mempool_alloc(v->fec->extra_pool, GFP_NOWAIT);
                 /* we can manage with even one buffer if necessary */
                 if (unlikely(!fio->bufs[n]))
                         break;
         }
         fio->nbufs = n;
 
-        if (!fio->output) {
+        if (!fio->output)
                 fio->output = mempool_alloc(v->fec->output_pool, GFP_NOIO);
 
-                if (!fio->output) {
-                        DMERR("failed to allocate FEC page");
-                        return -ENOMEM;
-                }
-        }
-
         return 0;
 }
 
diff --git a/drivers/md/dm-zoned-metadata.c b/drivers/md/dm-zoned-metadata.c
index 884ff7c170a0..a4fa2ada6883 100644
--- a/drivers/md/dm-zoned-metadata.c
+++ b/drivers/md/dm-zoned-metadata.c
@@ -624,7 +624,7 @@ static int dmz_write_sb(struct dmz_metadata *zmd, unsigned int set)
 
         ret = dmz_rdwr_block(zmd, REQ_OP_WRITE, block, mblk->page);
         if (ret == 0)
-                ret = blkdev_issue_flush(zmd->dev->bdev, GFP_KERNEL, NULL);
+                ret = blkdev_issue_flush(zmd->dev->bdev, GFP_NOIO, NULL);
 
         return ret;
 }
@@ -658,7 +658,7 @@ static int dmz_write_dirty_mblocks(struct dmz_metadata *zmd,
 
         /* Flush drive cache (this will also sync data) */
         if (ret == 0)
-                ret = blkdev_issue_flush(zmd->dev->bdev, GFP_KERNEL, NULL);
+                ret = blkdev_issue_flush(zmd->dev->bdev, GFP_NOIO, NULL);
 
         return ret;
 }
@@ -722,7 +722,7 @@ int dmz_flush_metadata(struct dmz_metadata *zmd)
 
         /* If there are no dirty metadata blocks, just flush the device cache */
         if (list_empty(&write_list)) {
-                ret = blkdev_issue_flush(zmd->dev->bdev, GFP_KERNEL, NULL);
+                ret = blkdev_issue_flush(zmd->dev->bdev, GFP_NOIO, NULL);
                 goto out;
         }
 
@@ -927,7 +927,7 @@ static int dmz_recover_mblocks(struct dmz_metadata *zmd, unsigned int dst_set)
                         (zmd->nr_meta_zones << zmd->dev->zone_nr_blocks_shift);
         }
 
-        page = alloc_page(GFP_KERNEL);
+        page = alloc_page(GFP_NOIO);
         if (!page)
                 return -ENOMEM;
 
@@ -1183,7 +1183,7 @@ static int dmz_update_zone(struct dmz_metadata *zmd, struct dm_zone *zone)
 
         /* Get zone information from disk */
         ret = blkdev_report_zones(zmd->dev->bdev, dmz_start_sect(zmd, zone),
-                                  &blkz, &nr_blkz, GFP_KERNEL);
+                                  &blkz, &nr_blkz, GFP_NOIO);
         if (ret) {
                 dmz_dev_err(zmd->dev, "Get zone %u report failed",
                             dmz_id(zmd, zone));
@@ -1257,7 +1257,7 @@ static int dmz_reset_zone(struct dmz_metadata *zmd, struct dm_zone *zone)
 
                 ret = blkdev_reset_zones(dev->bdev,
                                          dmz_start_sect(zmd, zone),
-                                         dev->zone_nr_sectors, GFP_KERNEL);
+                                         dev->zone_nr_sectors, GFP_NOIO);
                 if (ret) {
                         dmz_dev_err(dev, "Reset zone %u failed %d",
                                     dmz_id(zmd, zone), ret);
diff --git a/drivers/md/dm-zoned-reclaim.c b/drivers/md/dm-zoned-reclaim.c
index 05c0a126f5c8..44a119e12f1a 100644
--- a/drivers/md/dm-zoned-reclaim.c
+++ b/drivers/md/dm-zoned-reclaim.c
@@ -75,7 +75,7 @@ static int dmz_reclaim_align_wp(struct dmz_reclaim *zrc, struct dm_zone *zone,
         nr_blocks = block - wp_block;
         ret = blkdev_issue_zeroout(zrc->dev->bdev,
                                    dmz_start_sect(zmd, zone) + dmz_blk2sect(wp_block),
-                                   dmz_blk2sect(nr_blocks), GFP_NOFS, false);
+                                   dmz_blk2sect(nr_blocks), GFP_NOIO, 0);
         if (ret) {
                 dmz_dev_err(zrc->dev,
                             "Align zone %u wp %llu to %llu (wp+%u) blocks failed %d",
diff --git a/drivers/md/dm-zoned-target.c b/drivers/md/dm-zoned-target.c
index 2b538fa817f4..b08bbbd4d902 100644
--- a/drivers/md/dm-zoned-target.c
+++ b/drivers/md/dm-zoned-target.c
@@ -541,7 +541,7 @@ static void dmz_queue_chunk_work(struct dmz_target *dmz, struct bio *bio)
                 int ret;
 
                 /* Create a new chunk work */
-                cw = kmalloc(sizeof(struct dm_chunk_work), GFP_NOFS);
+                cw = kmalloc(sizeof(struct dm_chunk_work), GFP_NOIO);
                 if (!cw)
                         goto out;
 
@@ -588,7 +588,7 @@ static int dmz_map(struct dm_target *ti, struct bio *bio)
 
         bio->bi_bdev = dev->bdev;
 
-        if (!nr_sectors && (bio_op(bio) != REQ_OP_FLUSH) && (bio_op(bio) != REQ_OP_WRITE))
+        if (!nr_sectors && bio_op(bio) != REQ_OP_WRITE)
                 return DM_MAPIO_REMAPPED;
 
         /* The BIO should be block aligned */
@@ -603,7 +603,7 @@ static int dmz_map(struct dm_target *ti, struct bio *bio)
         bioctx->status = BLK_STS_OK;
 
         /* Set the BIO pending in the flush list */
-        if (bio_op(bio) == REQ_OP_FLUSH || (!nr_sectors && bio_op(bio) == REQ_OP_WRITE)) {
+        if (!nr_sectors && bio_op(bio) == REQ_OP_WRITE) {
                 spin_lock(&dmz->flush_lock);
                 bio_list_add(&dmz->flush_list, bio);
                 spin_unlock(&dmz->flush_lock);
@@ -785,7 +785,7 @@ static int dmz_ctr(struct dm_target *ti, unsigned int argc, char **argv)
 
         /* Chunk BIO work */
         mutex_init(&dmz->chunk_lock);
-        INIT_RADIX_TREE(&dmz->chunk_rxtree, GFP_NOFS);
+        INIT_RADIX_TREE(&dmz->chunk_rxtree, GFP_KERNEL);
         dmz->chunk_wq = alloc_workqueue("dmz_cwq_%s", WQ_MEM_RECLAIM | WQ_UNBOUND,
                                         0, dev->name);
         if (!dmz->chunk_wq) {
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index 2edbcc2d7d3f..d669fddd9290 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -27,16 +27,6 @@
 
 #define DM_MSG_PREFIX "core"
 
-#ifdef CONFIG_PRINTK
-/*
- * ratelimit state to be used in DMXXX_LIMIT().
- */
-DEFINE_RATELIMIT_STATE(dm_ratelimit_state,
-                       DEFAULT_RATELIMIT_INTERVAL,
-                       DEFAULT_RATELIMIT_BURST);
-EXPORT_SYMBOL(dm_ratelimit_state);
-#endif
-
 /*
  * Cookies are numeric values sent with CHANGE and REMOVE
  * uevents while resuming, removing or renaming the device.
@@ -1523,7 +1513,7 @@ static void __split_and_process_bio(struct mapped_device *md,
         }
 
         /* drop the extra reference count */
-        dec_pending(ci.io, error);
+        dec_pending(ci.io, errno_to_blk_status(error));
 }
 /*-----------------------------------------------------------------
  * CRUD END
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 8cdca0296749..b01e458d31e9 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -2287,7 +2287,7 @@ static void export_array(struct mddev *mddev)
 
 static bool set_in_sync(struct mddev *mddev)
 {
-        WARN_ON_ONCE(!spin_is_locked(&mddev->lock));
+        WARN_ON_ONCE(NR_CPUS != 1 && !spin_is_locked(&mddev->lock));
         if (!mddev->in_sync) {
                 mddev->sync_checkers++;
                 spin_unlock(&mddev->lock);
@@ -7996,7 +7996,7 @@ bool md_write_start(struct mddev *mddev, struct bio *bi)
         if (mddev->safemode == 1)
                 mddev->safemode = 0;
         /* sync_checkers is always 0 when writes_pending is in per-cpu mode */
-        if (mddev->in_sync || !mddev->sync_checkers) {
+        if (mddev->in_sync || mddev->sync_checkers) {
                 spin_lock(&mddev->lock);
                 if (mddev->in_sync) {
                         mddev->in_sync = 0;
@@ -8656,6 +8656,9 @@ void md_check_recovery(struct mddev *mddev)
         if (mddev_trylock(mddev)) {
                 int spares = 0;
 
+                if (!mddev->external && mddev->safemode == 1)
+                        mddev->safemode = 0;
+
                 if (mddev->ro) {
                         struct md_rdev *rdev;
                         if (!mddev->external && mddev->in_sync)
diff --git a/drivers/md/md.h b/drivers/md/md.h
index b50eb4ac1b82..09db03455801 100644
--- a/drivers/md/md.h
+++ b/drivers/md/md.h
@@ -731,58 +731,4 @@ static inline void mddev_check_write_zeroes(struct mddev *mddev, struct bio *bio
             !bdev_get_queue(bio->bi_bdev)->limits.max_write_zeroes_sectors)
                 mddev->queue->limits.max_write_zeroes_sectors = 0;
 }
-
-/* Maximum size of each resync request */
-#define RESYNC_BLOCK_SIZE (64*1024)
-#define RESYNC_PAGES ((RESYNC_BLOCK_SIZE + PAGE_SIZE-1) / PAGE_SIZE)
-
-/* for managing resync I/O pages */
-struct resync_pages {
-        unsigned        idx;    /* for get/put page from the pool */
-        void            *raid_bio;
-        struct page     *pages[RESYNC_PAGES];
-};
-
-static inline int resync_alloc_pages(struct resync_pages *rp,
-                                     gfp_t gfp_flags)
-{
-        int i;
-
-        for (i = 0; i < RESYNC_PAGES; i++) {
-                rp->pages[i] = alloc_page(gfp_flags);
-                if (!rp->pages[i])
-                        goto out_free;
-        }
-
-        return 0;
-
-out_free:
-        while (--i >= 0)
-                put_page(rp->pages[i]);
-        return -ENOMEM;
-}
-
-static inline void resync_free_pages(struct resync_pages *rp)
-{
-        int i;
-
-        for (i = 0; i < RESYNC_PAGES; i++)
-                put_page(rp->pages[i]);
-}
-
-static inline void resync_get_all_pages(struct resync_pages *rp)
-{
-        int i;
-
-        for (i = 0; i < RESYNC_PAGES; i++)
-                get_page(rp->pages[i]);
-}
-
-static inline struct page *resync_fetch_page(struct resync_pages *rp,
-                                             unsigned idx)
-{
-        if (WARN_ON_ONCE(idx >= RESYNC_PAGES))
-                return NULL;
-        return rp->pages[idx];
-}
 #endif /* _MD_MD_H */
diff --git a/drivers/md/raid1-10.c b/drivers/md/raid1-10.c
new file mode 100644
index 000000000000..9f2670b45f31
--- /dev/null
+++ b/drivers/md/raid1-10.c
@@ -0,0 +1,81 @@
+/* Maximum size of each resync request */
+#define RESYNC_BLOCK_SIZE (64*1024)
+#define RESYNC_PAGES ((RESYNC_BLOCK_SIZE + PAGE_SIZE-1) / PAGE_SIZE)
+
+/* for managing resync I/O pages */
+struct resync_pages {
+        void            *raid_bio;
+        struct page     *pages[RESYNC_PAGES];
+};
+
+static inline int resync_alloc_pages(struct resync_pages *rp,
+                                     gfp_t gfp_flags)
+{
+        int i;
+
+        for (i = 0; i < RESYNC_PAGES; i++) {
+                rp->pages[i] = alloc_page(gfp_flags);
+                if (!rp->pages[i])
+                        goto out_free;
+        }
+
+        return 0;
+
+out_free:
+        while (--i >= 0)
+                put_page(rp->pages[i]);
+        return -ENOMEM;
+}
+
+static inline void resync_free_pages(struct resync_pages *rp)
+{
+        int i;
+
+        for (i = 0; i < RESYNC_PAGES; i++)
+                put_page(rp->pages[i]);
+}
+
+static inline void resync_get_all_pages(struct resync_pages *rp)
+{
+        int i;
+
+        for (i = 0; i < RESYNC_PAGES; i++)
+                get_page(rp->pages[i]);
+}
+
+static inline struct page *resync_fetch_page(struct resync_pages *rp,
+                                             unsigned idx)
+{
+        if (WARN_ON_ONCE(idx >= RESYNC_PAGES))
+                return NULL;
+        return rp->pages[idx];
+}
+
+/*
+ * 'strct resync_pages' stores actual pages used for doing the resync
+ *  IO, and it is per-bio, so make .bi_private points to it.
+ */
+static inline struct resync_pages *get_resync_pages(struct bio *bio)
+{
+        return bio->bi_private;
+}
+
+/* generally called after bio_reset() for reseting bvec */
+static void md_bio_reset_resync_pages(struct bio *bio, struct resync_pages *rp,
+                               int size)
+{
+        int idx = 0;
+
+        /* initialize bvec table again */
+        do {
+                struct page *page = resync_fetch_page(rp, idx);
+                int len = min_t(int, size, PAGE_SIZE);
+
+                /*
+                 * won't fail because the vec table is big
+                 * enough to hold all these pages
+                 */
+                bio_add_page(bio, page, len, 0);
+                size -= len;
+        } while (idx++ < RESYNC_PAGES && size > 0);
+}
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index 3febfc8391fb..f50958ded9f0 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -81,14 +81,7 @@ static void lower_barrier(struct r1conf *conf, sector_t sector_nr);
 #define raid1_log(md, fmt, args...)                             \
         do { if ((md)->queue) blk_add_trace_msg((md)->queue, "raid1 " fmt, ##args); } while (0)
 
-/*
- * 'strct resync_pages' stores actual pages used for doing the resync
- *  IO, and it is per-bio, so make .bi_private points to it.
- */
-static inline struct resync_pages *get_resync_pages(struct bio *bio)
-{
-        return bio->bi_private;
-}
+#include "raid1-10.c"
 
 /*
  * for resync bio, r1bio pointer can be retrieved from the per-bio
@@ -170,7 +163,6 @@ static void * r1buf_pool_alloc(gfp_t gfp_flags, void *data)
                         resync_get_all_pages(rp);
                 }
 
-                rp->idx = 0;
                 rp->raid_bio = r1_bio;
                 bio->bi_private = rp;
         }
@@ -492,10 +484,6 @@ static void raid1_end_write_request(struct bio *bio)
         }
 
         if (behind) {
-                /* we release behind master bio when all write are done */
-                if (r1_bio->behind_master_bio == bio)
-                        to_put = NULL;
-
                 if (test_bit(WriteMostly, &rdev->flags))
                         atomic_dec(&r1_bio->behind_remaining);
 
@@ -802,8 +790,7 @@ static void flush_bio_list(struct r1conf *conf, struct bio *bio)
                 bio->bi_next = NULL;
                 bio->bi_bdev = rdev->bdev;
                 if (test_bit(Faulty, &rdev->flags)) {
-                        bio->bi_status = BLK_STS_IOERR;
-                        bio_endio(bio);
+                        bio_io_error(bio);
                 } else if (unlikely((bio_op(bio) == REQ_OP_DISCARD) &&
                                     !blk_queue_discard(bdev_get_queue(bio->bi_bdev))))
                         /* Just ignore it */
@@ -1088,7 +1075,7 @@ static void unfreeze_array(struct r1conf *conf)
         wake_up(&conf->wait_barrier);
 }
 
-static struct bio *alloc_behind_master_bio(struct r1bio *r1_bio,
+static void alloc_behind_master_bio(struct r1bio *r1_bio,
                                            struct bio *bio)
 {
         int size = bio->bi_iter.bi_size;
@@ -1098,11 +1085,13 @@ static struct bio *alloc_behind_master_bio(struct r1bio *r1_bio,
 
         behind_bio = bio_alloc_mddev(GFP_NOIO, vcnt, r1_bio->mddev);
         if (!behind_bio)
-                goto fail;
+                return;
 
         /* discard op, we don't support writezero/writesame yet */
-        if (!bio_has_data(bio))
+        if (!bio_has_data(bio)) {
+                behind_bio->bi_iter.bi_size = size;
                 goto skip_copy;
+        }
 
         while (i < vcnt && size) {
                 struct page *page;
@@ -1123,14 +1112,13 @@ skip_copy:
         r1_bio->behind_master_bio = behind_bio;;
         set_bit(R1BIO_BehindIO, &r1_bio->state);
 
-        return behind_bio;
+        return;
 
 free_pages:
         pr_debug("%dB behind alloc failed, doing sync I/O\n",
                  bio->bi_iter.bi_size);
         bio_free_pages(behind_bio);
-fail:
-        return behind_bio;
+        bio_put(behind_bio);
 }
 
 struct raid1_plug_cb {
@@ -1483,7 +1471,7 @@ static void raid1_write_request(struct mddev *mddev, struct bio *bio,
                             (atomic_read(&bitmap->behind_writes)
                              < mddev->bitmap_info.max_write_behind) &&
                             !waitqueue_active(&bitmap->behind_wait)) {
-                                mbio = alloc_behind_master_bio(r1_bio, bio);
+                                alloc_behind_master_bio(r1_bio, bio);
                         }
 
                         bitmap_startwrite(bitmap, r1_bio->sector,
@@ -1493,14 +1481,11 @@ static void raid1_write_request(struct mddev *mddev, struct bio *bio,
                         first_clone = 0;
                 }
 
-                if (!mbio) {
-                        if (r1_bio->behind_master_bio)
-                                mbio = bio_clone_fast(r1_bio->behind_master_bio,
-                                                      GFP_NOIO,
-                                                      mddev->bio_set);
-                        else
-                                mbio = bio_clone_fast(bio, GFP_NOIO, mddev->bio_set);
-                }
+                if (r1_bio->behind_master_bio)
+                        mbio = bio_clone_fast(r1_bio->behind_master_bio,
+                                              GFP_NOIO, mddev->bio_set);
+                else
+                        mbio = bio_clone_fast(bio, GFP_NOIO, mddev->bio_set);
 
                 if (r1_bio->behind_master_bio) {
                         if (test_bit(WriteMostly, &conf->mirrors[i].rdev->flags))
@@ -2086,10 +2071,7 @@ static void process_checks(struct r1bio *r1_bio)
         /* Fix variable parts of all bios */
         vcnt = (r1_bio->sectors + PAGE_SIZE / 512 - 1) >> (PAGE_SHIFT - 9);
         for (i = 0; i < conf->raid_disks * 2; i++) {
-                int j;
-                int size;
                 blk_status_t status;
-                struct bio_vec *bi;
                 struct bio *b = r1_bio->bios[i];
                 struct resync_pages *rp = get_resync_pages(b);
                 if (b->bi_end_io != end_sync_read)
@@ -2098,8 +2080,6 @@ static void process_checks(struct r1bio *r1_bio)
                 status = b->bi_status;
                 bio_reset(b);
                 b->bi_status = status;
-                b->bi_vcnt = vcnt;
-                b->bi_iter.bi_size = r1_bio->sectors << 9;
                 b->bi_iter.bi_sector = r1_bio->sector +
                         conf->mirrors[i].rdev->data_offset;
                 b->bi_bdev = conf->mirrors[i].rdev->bdev;
@@ -2107,15 +2087,8 @@ static void process_checks(struct r1bio *r1_bio)
                 rp->raid_bio = r1_bio;
                 b->bi_private = rp;
 
-                size = b->bi_iter.bi_size;
-                bio_for_each_segment_all(bi, b, j) {
-                        bi->bv_offset = 0;
-                        if (size > PAGE_SIZE)
-                                bi->bv_len = PAGE_SIZE;
-                        else
-                                bi->bv_len = size;
-                        size -= PAGE_SIZE;
-                }
+                /* initialize bvec table again */
+                md_bio_reset_resync_pages(b, rp, r1_bio->sectors << 9);
         }
         for (primary = 0; primary < conf->raid_disks * 2; primary++)
                 if (r1_bio->bios[primary]->bi_end_io == end_sync_read &&
@@ -2366,8 +2339,6 @@ static int narrow_write_error(struct r1bio *r1_bio, int i)
                         wbio = bio_clone_fast(r1_bio->behind_master_bio,
                                               GFP_NOIO,
                                               mddev->bio_set);
-                        /* We really need a _all clone */
-                        wbio->bi_iter = (struct bvec_iter){ 0 };
                 } else {
                         wbio = bio_clone_fast(r1_bio->master_bio, GFP_NOIO,
                                               mddev->bio_set);
@@ -2619,6 +2590,7 @@ static sector_t raid1_sync_request(struct mddev *mddev, sector_t sector_nr,
         int good_sectors = RESYNC_SECTORS;
         int min_bad = 0; /* number of sectors that are bad in all devices */
         int idx = sector_to_idx(sector_nr);
+        int page_idx = 0;
 
         if (!conf->r1buf_pool)
                 if (init_resync(conf))
@@ -2846,7 +2818,7 @@ static sector_t raid1_sync_request(struct mddev *mddev, sector_t sector_nr,
                         bio = r1_bio->bios[i];
                         rp = get_resync_pages(bio);
                         if (bio->bi_end_io) {
-                                page = resync_fetch_page(rp, rp->idx++);
+                                page = resync_fetch_page(rp, page_idx);
 
                                 /*
                                  * won't fail because the vec table is big
@@ -2858,7 +2830,7 @@ static sector_t raid1_sync_request(struct mddev *mddev, sector_t sector_nr,
                 nr_sectors += len>>9;
                 sector_nr += len>>9;
                 sync_blocks -= (len>>9);
-        } while (get_resync_pages(r1_bio->bios[disk]->bi_private)->idx < RESYNC_PAGES);
+        } while (++page_idx < RESYNC_PAGES);
 
         r1_bio->sectors = nr_sectors;
 
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 5026e7ad51d3..f55d4cc085f6 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -110,14 +110,7 @@ static void end_reshape(struct r10conf *conf);
 #define raid10_log(md, fmt, args...)                            \
         do { if ((md)->queue) blk_add_trace_msg((md)->queue, "raid10 " fmt, ##args); } while (0)
 
-/*
- * 'strct resync_pages' stores actual pages used for doing the resync
- *  IO, and it is per-bio, so make .bi_private points to it.
- */
-static inline struct resync_pages *get_resync_pages(struct bio *bio)
-{
-        return bio->bi_private;
-}
+#include "raid1-10.c"
 
 /*
  * for resync bio, r10bio pointer can be retrieved from the per-bio
@@ -221,7 +214,6 @@ static void * r10buf_pool_alloc(gfp_t gfp_flags, void *data)
                         resync_get_all_pages(rp);
                 }
 
-                rp->idx = 0;
                 rp->raid_bio = r10_bio;
                 bio->bi_private = rp;
                 if (rbio) {
@@ -913,8 +905,7 @@ static void flush_pending_writes(struct r10conf *conf)
                         bio->bi_next = NULL;
                         bio->bi_bdev = rdev->bdev;
                         if (test_bit(Faulty, &rdev->flags)) {
-                                bio->bi_status = BLK_STS_IOERR;
-                                bio_endio(bio);
+                                bio_io_error(bio);
                         } else if (unlikely((bio_op(bio) ==  REQ_OP_DISCARD) &&
                                             !blk_queue_discard(bdev_get_queue(bio->bi_bdev))))
                                 /* Just ignore it */
@@ -1098,8 +1089,7 @@ static void raid10_unplug(struct blk_plug_cb *cb, bool from_schedule)
                 bio->bi_next = NULL;
                 bio->bi_bdev = rdev->bdev;
                 if (test_bit(Faulty, &rdev->flags)) {
-                        bio->bi_status = BLK_STS_IOERR;
-                        bio_endio(bio);
+                        bio_io_error(bio);
                 } else if (unlikely((bio_op(bio) ==  REQ_OP_DISCARD) &&
                                     !blk_queue_discard(bdev_get_queue(bio->bi_bdev))))
                         /* Just ignore it */
@@ -2087,8 +2077,8 @@ static void sync_request_write(struct mddev *mddev, struct r10bio *r10_bio)
                 rp = get_resync_pages(tbio);
                 bio_reset(tbio);
 
-                tbio->bi_vcnt = vcnt;
-                tbio->bi_iter.bi_size = fbio->bi_iter.bi_size;
+                md_bio_reset_resync_pages(tbio, rp, fbio->bi_iter.bi_size);
+
                 rp->raid_bio = r10_bio;
                 tbio->bi_private = rp;
                 tbio->bi_iter.bi_sector = r10_bio->devs[i].addr;
@@ -2853,6 +2843,7 @@ static sector_t raid10_sync_request(struct mddev *mddev, sector_t sector_nr,
         sector_t sectors_skipped = 0;
         int chunks_skipped = 0;
         sector_t chunk_mask = conf->geo.chunk_mask;
+        int page_idx = 0;
 
         if (!conf->r10buf_pool)
                 if (init_resync(conf))
@@ -3355,7 +3346,7 @@ static sector_t raid10_sync_request(struct mddev *mddev, sector_t sector_nr,
                         break;
                 for (bio= biolist ; bio ; bio=bio->bi_next) {
                         struct resync_pages *rp = get_resync_pages(bio);
-                        page = resync_fetch_page(rp, rp->idx++);
+                        page = resync_fetch_page(rp, page_idx);
                         /*
                          * won't fail because the vec table is big enough
                          * to hold all these pages
@@ -3364,7 +3355,7 @@ static sector_t raid10_sync_request(struct mddev *mddev, sector_t sector_nr,
                 }
                 nr_sectors += len>>9;
                 sector_nr += len>>9;
-        } while (get_resync_pages(biolist)->idx < RESYNC_PAGES);
+        } while (++page_idx < RESYNC_PAGES);
         r10_bio->sectors = nr_sectors;
 
         while (biolist) {
diff --git a/drivers/md/raid5-cache.c b/drivers/md/raid5-cache.c
index bfa1e907c472..2dcbafa8e66c 100644
--- a/drivers/md/raid5-cache.c
+++ b/drivers/md/raid5-cache.c
@@ -236,9 +236,10 @@ struct r5l_io_unit {
         bool need_split_bio;
         struct bio *split_bio;
 
-        unsigned int has_flush:1;      /* include flush request */
-        unsigned int has_fua:1;        /* include fua request */
-        unsigned int has_null_flush:1; /* include empty flush request */
+        unsigned int has_flush:1;               /* include flush request */
+        unsigned int has_fua:1;                 /* include fua request */
+        unsigned int has_null_flush:1;          /* include null flush request */
+        unsigned int has_flush_payload:1;       /* include flush payload  */
         /*
          * io isn't sent yet, flush/fua request can only be submitted till it's
          * the first IO in running_ios list
@@ -571,6 +572,8 @@ static void r5l_log_endio(struct bio *bio)
         struct r5l_io_unit *io_deferred;
         struct r5l_log *log = io->log;
         unsigned long flags;
+        bool has_null_flush;
+        bool has_flush_payload;
 
         if (bio->bi_status)
                 md_error(log->rdev->mddev, log->rdev);
@@ -580,6 +583,16 @@ static void r5l_log_endio(struct bio *bio)
 
         spin_lock_irqsave(&log->io_list_lock, flags);
         __r5l_set_io_unit_state(io, IO_UNIT_IO_END);
+
+        /*
+         * if the io doesn't not have null_flush or flush payload,
+         * it is not safe to access it after releasing io_list_lock.
+         * Therefore, it is necessary to check the condition with
+         * the lock held.
+         */
+        has_null_flush = io->has_null_flush;
+        has_flush_payload = io->has_flush_payload;
+
         if (log->need_cache_flush && !list_empty(&io->stripe_list))
                 r5l_move_to_end_ios(log);
         else
@@ -600,19 +613,23 @@ static void r5l_log_endio(struct bio *bio)
         if (log->need_cache_flush)
                 md_wakeup_thread(log->rdev->mddev->thread);
 
-        if (io->has_null_flush) {
+        /* finish flush only io_unit and PAYLOAD_FLUSH only io_unit */
+        if (has_null_flush) {
                 struct bio *bi;
 
                 WARN_ON(bio_list_empty(&io->flush_barriers));
                 while ((bi = bio_list_pop(&io->flush_barriers)) != NULL) {
                         bio_endio(bi);
-                        atomic_dec(&io->pending_stripe);
+                        if (atomic_dec_and_test(&io->pending_stripe)) {
+                                __r5l_stripe_write_finished(io);
+                                return;
+                        }
                 }
         }
-
-        /* finish flush only io_unit and PAYLOAD_FLUSH only io_unit */
-        if (atomic_read(&io->pending_stripe) == 0)
-                __r5l_stripe_write_finished(io);
+        /* decrease pending_stripe for flush payload */
+        if (has_flush_payload)
+                if (atomic_dec_and_test(&io->pending_stripe))
+                        __r5l_stripe_write_finished(io);
 }
 
 static void r5l_do_submit_io(struct r5l_log *log, struct r5l_io_unit *io)
@@ -881,6 +898,11 @@ static void r5l_append_flush_payload(struct r5l_log *log, sector_t sect)
         payload->size = cpu_to_le32(sizeof(__le64));
         payload->flush_stripes[0] = cpu_to_le64(sect);
         io->meta_offset += meta_size;
+        /* multiple flush payloads count as one pending_stripe */
+        if (!io->has_flush_payload) {
+                io->has_flush_payload = 1;
+                atomic_inc(&io->pending_stripe);
+        }
         mutex_unlock(&log->io_mutex);
 }
 
@@ -2540,23 +2562,32 @@ static ssize_t r5c_journal_mode_show(struct mddev *mddev, char *page)
  */
 int r5c_journal_mode_set(struct mddev *mddev, int mode)
 {
-        struct r5conf *conf = mddev->private;
-        struct r5l_log *log = conf->log;
-
-        if (!log)
-                return -ENODEV;
+        struct r5conf *conf;
+        int err;
 
         if (mode < R5C_JOURNAL_MODE_WRITE_THROUGH ||
             mode > R5C_JOURNAL_MODE_WRITE_BACK)
                 return -EINVAL;
 
+        err = mddev_lock(mddev);
+        if (err)
+                return err;
+        conf = mddev->private;
+        if (!conf || !conf->log) {
+                mddev_unlock(mddev);
+                return -ENODEV;
+        }
+
         if (raid5_calc_degraded(conf) > 0 &&
-            mode == R5C_JOURNAL_MODE_WRITE_BACK)
+            mode == R5C_JOURNAL_MODE_WRITE_BACK) {
+                mddev_unlock(mddev);
                 return -EINVAL;
+        }
 
         mddev_suspend(mddev);
         conf->log->r5c_journal_mode = mode;
         mddev_resume(mddev);
+        mddev_unlock(mddev);
 
         pr_debug("md/raid:%s: setting r5c cache mode to %d: %s\n",
                  mdname(mddev), mode, r5c_journal_mode_str[mode]);
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index aeeb8d6854e2..0fc2748aaf95 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -3381,9 +3381,8 @@ handle_failed_stripe(struct r5conf *conf, struct stripe_head *sh,
                         sh->dev[i].sector + STRIPE_SECTORS) {
                         struct bio *nextbi = r5_next_bio(bi, sh->dev[i].sector);
 
-                        bi->bi_status = BLK_STS_IOERR;
                         md_write_end(conf->mddev);
-                        bio_endio(bi);
+                        bio_io_error(bi);
                         bi = nextbi;
                 }
                 if (bitmap_end)
@@ -3403,9 +3402,8 @@ handle_failed_stripe(struct r5conf *conf, struct stripe_head *sh,
                        sh->dev[i].sector + STRIPE_SECTORS) {
                         struct bio *bi2 = r5_next_bio(bi, sh->dev[i].sector);
 
-                        bi->bi_status = BLK_STS_IOERR;
                         md_write_end(conf->mddev);
-                        bio_endio(bi);
+                        bio_io_error(bi);
                         bi = bi2;
                 }
 
@@ -3429,8 +3427,7 @@ handle_failed_stripe(struct r5conf *conf, struct stripe_head *sh,
                                 struct bio *nextbi =
                                         r5_next_bio(bi, sh->dev[i].sector);
 
-                                bi->bi_status = BLK_STS_IOERR;
-                                bio_endio(bi);
+                                bio_io_error(bi);
                                 bi = nextbi;
                         }
                 }
@@ -6237,6 +6234,8 @@ static void raid5_do_work(struct work_struct *work)
         pr_debug("%d stripes handled\n", handled);
 
         spin_unlock_irq(&conf->device_lock);
+
+        async_tx_issue_pending_all();
         blk_finish_plug(&plug);
 
         pr_debug("--- raid5worker inactive\n");
diff --git a/drivers/media/cec/cec-adap.c b/drivers/media/cec/cec-adap.c
index bf45977b2823..d596b601ff42 100644
--- a/drivers/media/cec/cec-adap.c
+++ b/drivers/media/cec/cec-adap.c
@@ -559,7 +559,7 @@ EXPORT_SYMBOL_GPL(cec_transmit_done);
 
 void cec_transmit_attempt_done(struct cec_adapter *adap, u8 status)
 {
-        switch (status) {
+        switch (status & ~CEC_TX_STATUS_MAX_RETRIES) {
         case CEC_TX_STATUS_OK:
                 cec_transmit_done(adap, status, 0, 0, 0, 0);
                 return;
diff --git a/drivers/media/cec/cec-notifier.c b/drivers/media/cec/cec-notifier.c
index 74dc1c32080e..08b619d0ea1e 100644
--- a/drivers/media/cec/cec-notifier.c
+++ b/drivers/media/cec/cec-notifier.c
@@ -87,6 +87,9 @@ EXPORT_SYMBOL_GPL(cec_notifier_put);
 
 void cec_notifier_set_phys_addr(struct cec_notifier *n, u16 pa)
 {
+        if (n == NULL)
+                return;
+
         mutex_lock(&n->lock);
         n->phys_addr = pa;
         if (n->callback)
@@ -100,6 +103,9 @@ void cec_notifier_set_phys_addr_from_edid(struct cec_notifier *n,
 {
         u16 pa = CEC_PHYS_ADDR_INVALID;
 
+        if (n == NULL)
+                return;
+
         if (edid && edid->extensions)
                 pa = cec_get_edid_phys_addr((const u8 *)edid,
                                 EDID_LENGTH * (edid->extensions + 1), NULL);
diff --git a/drivers/media/dvb-core/dvb_ca_en50221.c b/drivers/media/dvb-core/dvb_ca_en50221.c
index af694f2066a2..17970cdd55fa 100644
--- a/drivers/media/dvb-core/dvb_ca_en50221.c
+++ b/drivers/media/dvb-core/dvb_ca_en50221.c
@@ -349,7 +349,8 @@ static int dvb_ca_en50221_link_init(struct dvb_ca_private *ca, int slot)
         /* read the buffer size from the CAM */
         if ((ret = ca->pub->write_cam_control(ca->pub, slot, CTRLIF_COMMAND, IRQEN | CMDREG_SR)) != 0)
                 return ret;
-        if ((ret = dvb_ca_en50221_wait_if_status(ca, slot, STATUSREG_DA, HZ / 10)) != 0)
+        ret = dvb_ca_en50221_wait_if_status(ca, slot, STATUSREG_DA, HZ);
+        if (ret != 0)
                 return ret;
         if ((ret = dvb_ca_en50221_read_data(ca, slot, buf, 2)) != 2)
                 return -EIO;
@@ -644,72 +645,101 @@ static int dvb_ca_en50221_read_data(struct dvb_ca_private *ca, int slot,
                 }
                 buf_free = dvb_ringbuffer_free(&ca->slot_info[slot].rx_buffer);
 
-                if (buf_free < (ca->slot_info[slot].link_buf_size + DVB_RINGBUFFER_PKTHDRSIZE)) {
+                if (buf_free < (ca->slot_info[slot].link_buf_size +
+                                DVB_RINGBUFFER_PKTHDRSIZE)) {
                         status = -EAGAIN;
                         goto exit;
                 }
         }
 
-        /* check if there is data available */
-        if ((status = ca->pub->read_cam_control(ca->pub, slot, CTRLIF_STATUS)) < 0)
-                goto exit;
-        if (!(status & STATUSREG_DA)) {
-                /* no data */
-                status = 0;
-                goto exit;
-        }
-
-        /* read the amount of data */
-        if ((status = ca->pub->read_cam_control(ca->pub, slot, CTRLIF_SIZE_HIGH)) < 0)
-                goto exit;
-        bytes_read = status << 8;
-        if ((status = ca->pub->read_cam_control(ca->pub, slot, CTRLIF_SIZE_LOW)) < 0)
-                goto exit;
-        bytes_read |= status;
+        if (ca->pub->read_data &&
+            (ca->slot_info[slot].slot_state != DVB_CA_SLOTSTATE_LINKINIT)) {
+                if (ebuf == NULL)
+                        status = ca->pub->read_data(ca->pub, slot, buf,
+                                                    sizeof(buf));
+                else
+                        status = ca->pub->read_data(ca->pub, slot, buf, ecount);
+                if (status < 0)
+                        return status;
+                bytes_read =  status;
+                if (status == 0)
+                        goto exit;
+        } else {
 
-        /* check it will fit */
-        if (ebuf == NULL) {
-                if (bytes_read > ca->slot_info[slot].link_buf_size) {
-                        pr_err("dvb_ca adapter %d: CAM tried to send a buffer larger than the link buffer size (%i > %i)!\n",
-                               ca->dvbdev->adapter->num, bytes_read,
-                               ca->slot_info[slot].link_buf_size);
-                        ca->slot_info[slot].slot_state = DVB_CA_SLOTSTATE_LINKINIT;
-                        status = -EIO;
+                /* check if there is data available */
+                status = ca->pub->read_cam_control(ca->pub, slot,
+                                                   CTRLIF_STATUS);
+                if (status < 0)
                         goto exit;
-                }
-                if (bytes_read < 2) {
-                        pr_err("dvb_ca adapter %d: CAM sent a buffer that was less than 2 bytes!\n",
-                               ca->dvbdev->adapter->num);
-                        ca->slot_info[slot].slot_state = DVB_CA_SLOTSTATE_LINKINIT;
-                        status = -EIO;
+                if (!(status & STATUSREG_DA)) {
+                        /* no data */
+                        status = 0;
                         goto exit;
                 }
-        } else {
-                if (bytes_read > ecount) {
-                        pr_err("dvb_ca adapter %d: CAM tried to send a buffer larger than the ecount size!\n",
-                               ca->dvbdev->adapter->num);
-                        status = -EIO;
+
+                /* read the amount of data */
+                status = ca->pub->read_cam_control(ca->pub, slot,
+                                                   CTRLIF_SIZE_HIGH);
+                if (status < 0)
+                        goto exit;
+                bytes_read = status << 8;
+                status = ca->pub->read_cam_control(ca->pub, slot,
+                                                   CTRLIF_SIZE_LOW);
+                if (status < 0)
                         goto exit;
+                bytes_read |= status;
+
+                /* check it will fit */
+                if (ebuf == NULL) {
+                        if (bytes_read > ca->slot_info[slot].link_buf_size) {
+                                pr_err("dvb_ca adapter %d: CAM tried to send a buffer larger than the link buffer size (%i > %i)!\n",
+                                       ca->dvbdev->adapter->num, bytes_read,
+                                       ca->slot_info[slot].link_buf_size);
+                                ca->slot_info[slot].slot_state =
+                                                     DVB_CA_SLOTSTATE_LINKINIT;
+                                status = -EIO;
+                                goto exit;
+                        }
+                        if (bytes_read < 2) {
+                                pr_err("dvb_ca adapter %d: CAM sent a buffer that was less than 2 bytes!\n",
+                                       ca->dvbdev->adapter->num);
+                                ca->slot_info[slot].slot_state =
+                                                     DVB_CA_SLOTSTATE_LINKINIT;
+                                status = -EIO;
+                                goto exit;
+                        }
+                } else {
+                        if (bytes_read > ecount) {
+                                pr_err("dvb_ca adapter %d: CAM tried to send a buffer larger than the ecount size!\n",
+                                       ca->dvbdev->adapter->num);
+                                status = -EIO;
+                                goto exit;
+                        }
                 }
-        }
 
-        /* fill the buffer */
-        for (i = 0; i < bytes_read; i++) {
-                /* read byte and check */
-                if ((status = ca->pub->read_cam_control(ca->pub, slot, CTRLIF_DATA)) < 0)
-                        goto exit;
+                /* fill the buffer */
+                for (i = 0; i < bytes_read; i++) {
+                        /* read byte and check */
+                        status = ca->pub->read_cam_control(ca->pub, slot,
+                                                           CTRLIF_DATA);
+                        if (status < 0)
+                                goto exit;
 
-                /* OK, store it in the buffer */
-                buf[i] = status;
-        }
+                        /* OK, store it in the buffer */
+                        buf[i] = status;
+                }
 
-        /* check for read error (RE should now be 0) */
-        if ((status = ca->pub->read_cam_control(ca->pub, slot, CTRLIF_STATUS)) < 0)
-                goto exit;
-        if (status & STATUSREG_RE) {
-                ca->slot_info[slot].slot_state = DVB_CA_SLOTSTATE_LINKINIT;
-                status = -EIO;
-                goto exit;
+                /* check for read error (RE should now be 0) */
+                status = ca->pub->read_cam_control(ca->pub, slot,
+                                                   CTRLIF_STATUS);
+                if (status < 0)
+                        goto exit;
+                if (status & STATUSREG_RE) {
+                        ca->slot_info[slot].slot_state =
+                                                     DVB_CA_SLOTSTATE_LINKINIT;
+                        status = -EIO;
+                        goto exit;
+                }
         }
 
         /* OK, add it to the receive buffer, or copy into external buffer if supplied */
@@ -762,6 +792,10 @@ static int dvb_ca_en50221_write_data(struct dvb_ca_private *ca, int slot,
         if (bytes_write > ca->slot_info[slot].link_buf_size)
                 return -EINVAL;
 
+        if (ca->pub->write_data &&
+            (ca->slot_info[slot].slot_state != DVB_CA_SLOTSTATE_LINKINIT))
+                return ca->pub->write_data(ca->pub, slot, buf, bytes_write);
+
         /* it is possible we are dealing with a single buffer implementation,
            thus if there is data available for read or if there is even a read
            already in progress, we do nothing but awake the kernel thread to
@@ -1176,7 +1210,8 @@ static int dvb_ca_en50221_thread(void *data)
 
                                         pr_err("dvb_ca adapter %d: DVB CAM link initialisation failed :(\n",
                                                ca->dvbdev->adapter->num);
-                                        ca->slot_info[slot].slot_state = DVB_CA_SLOTSTATE_INVALID;
+                                        ca->slot_info[slot].slot_state =
+                                                DVB_CA_SLOTSTATE_UNINITIALISED;
                                         dvb_ca_en50221_thread_update_delay(ca);
                                         break;
                                 }
diff --git a/drivers/media/dvb-core/dvb_ca_en50221.h b/drivers/media/dvb-core/dvb_ca_en50221.h
index 1e4bbbd34d91..82617bac0875 100644
--- a/drivers/media/dvb-core/dvb_ca_en50221.h
+++ b/drivers/media/dvb-core/dvb_ca_en50221.h
@@ -41,6 +41,8 @@
  * @write_attribute_mem: function for writing attribute memory on the CAM
  * @read_cam_control:   function for reading the control interface on the CAM
  * @write_cam_control:  function for reading the control interface on the CAM
+ * @read_data:          function for reading data (block mode)
+ * @write_data:         function for writing data (block mode)
  * @slot_reset:         function to reset the CAM slot
  * @slot_shutdown:      function to shutdown a CAM slot
  * @slot_ts_enable:     function to enable the Transport Stream on a CAM slot
@@ -66,6 +68,11 @@ struct dvb_ca_en50221 {
         int (*write_cam_control)(struct dvb_ca_en50221 *ca,
                                  int slot, u8 address, u8 value);
 
+        int (*read_data)(struct dvb_ca_en50221 *ca,
+                                int slot, u8 *ebuf, int ecount);
+        int (*write_data)(struct dvb_ca_en50221 *ca,
+                                int slot, u8 *ebuf, int ecount);
+
         int (*slot_reset)(struct dvb_ca_en50221 *ca, int slot);
         int (*slot_shutdown)(struct dvb_ca_en50221 *ca, int slot);
         int (*slot_ts_enable)(struct dvb_ca_en50221 *ca, int slot);
diff --git a/drivers/media/dvb-frontends/cxd2841er.c b/drivers/media/dvb-frontends/cxd2841er.c
index 08f67d60a7d9..12bff778c97f 100644
--- a/drivers/media/dvb-frontends/cxd2841er.c
+++ b/drivers/media/dvb-frontends/cxd2841er.c
@@ -3279,7 +3279,10 @@ static int cxd2841er_get_frontend(struct dvb_frontend *fe,
         else if (priv->state == STATE_ACTIVE_TC)
                 cxd2841er_read_status_tc(fe, &status);
 
-        cxd2841er_read_signal_strength(fe);
+        if (priv->state == STATE_ACTIVE_TC || priv->state == STATE_ACTIVE_S)
+                cxd2841er_read_signal_strength(fe);
+        else
+                p->strength.stat[0].scale = FE_SCALE_NOT_AVAILABLE;
 
         if (status & FE_HAS_LOCK) {
                 cxd2841er_read_snr(fe);
diff --git a/drivers/media/dvb-frontends/drx39xyj/drx_driver.h b/drivers/media/dvb-frontends/drx39xyj/drx_driver.h
index 4442e478db72..cd69e187ba7a 100644
--- a/drivers/media/dvb-frontends/drx39xyj/drx_driver.h
+++ b/drivers/media/dvb-frontends/drx39xyj/drx_driver.h
@@ -307,7 +307,7 @@ int drxbsp_tuner_default_i2c_write_read(struct tuner_instance *tuner,
 * \def DRX_UNKNOWN
 * \brief Generic UNKNOWN value for DRX enumerated types.
 *
-* Used to indicate that the parameter value is unknown or not yet initalized.
+* Used to indicate that the parameter value is unknown or not yet initialized.
 */
 #ifndef DRX_UNKNOWN
 #define DRX_UNKNOWN (254)
@@ -450,19 +450,6 @@ MACROS
                         ((u8)((((u16)x)>>8)&0xFF))
 
 /**
-* \brief Macro to sign extend signed 9 bit value to signed  16 bit value
-*/
-#define DRX_S9TOS16(x) ((((u16)x)&0x100) ? ((s16)((u16)(x)|0xFF00)) : (x))
-
-/**
-* \brief Macro to sign extend signed 9 bit value to signed  16 bit value
-*/
-#define DRX_S24TODRXFREQ(x) ((((u32) x) & 0x00800000UL) ? \
-                                 ((s32) \
-                                    (((u32) x) | 0xFF000000)) : \
-                                 ((s32) x))
-
-/**
 * \brief Macro to convert 16 bit register value to a s32
 */
 #define DRX_U16TODRXFREQ(x)   ((x & 0x8000) ? \
diff --git a/drivers/media/dvb-frontends/lnbh25.c b/drivers/media/dvb-frontends/lnbh25.c
index ef3021e964be..cb486e879fdd 100644
--- a/drivers/media/dvb-frontends/lnbh25.c
+++ b/drivers/media/dvb-frontends/lnbh25.c
@@ -76,8 +76,8 @@ static int lnbh25_read_vmon(struct lnbh25_priv *priv)
                         return ret;
                 }
         }
-        print_hex_dump_bytes("lnbh25_read_vmon: ",
-                DUMP_PREFIX_OFFSET, status, sizeof(status));
+        dev_dbg(&priv->i2c->dev, "%s(): %*ph\n",
+                __func__, (int) sizeof(status), status);
         if ((status[0] & (LNBH25_STATUS_OFL | LNBH25_STATUS_VMON)) != 0) {
                 dev_err(&priv->i2c->dev,
                         "%s(): voltage in failure state, status reg 0x%x\n",
@@ -178,7 +178,7 @@ struct dvb_frontend *lnbh25_attach(struct dvb_frontend *fe,
         fe->ops.release_sec = lnbh25_release;
         fe->ops.set_voltage = lnbh25_set_voltage;
 
-        dev_err(&i2c->dev, "%s(): attached at I2C addr 0x%02x\n",
+        dev_info(&i2c->dev, "%s(): attached at I2C addr 0x%02x\n",
                 __func__, priv->i2c_address);
         return fe;
 }
diff --git a/drivers/media/dvb-frontends/stv0367.c b/drivers/media/dvb-frontends/stv0367.c
index e726c2e00460..8ac0f598978d 100644
--- a/drivers/media/dvb-frontends/stv0367.c
+++ b/drivers/media/dvb-frontends/stv0367.c
@@ -25,6 +25,8 @@
 #include <linux/slab.h>
 #include <linux/i2c.h>
 
+#include "dvb_math.h"
+
 #include "stv0367.h"
 #include "stv0367_defs.h"
 #include "stv0367_regs.h"
@@ -1437,7 +1439,7 @@ static int stv0367ter_get_frontend(struct dvb_frontend *fe,
         return 0;
 }
 
-static int stv0367ter_read_snr(struct dvb_frontend *fe, u16 *snr)
+static u32 stv0367ter_snr_readreg(struct dvb_frontend *fe)
 {
         struct stv0367_state *state = fe->demodulator_priv;
         u32 snru32 = 0;
@@ -1453,10 +1455,16 @@ static int stv0367ter_read_snr(struct dvb_frontend *fe, u16 *snr)
 
                 cpt++;
         }
-
         snru32 /= 10;/*average on 10 values*/
 
-        *snr = snru32 / 1000;
+        return snru32;
+}
+
+static int stv0367ter_read_snr(struct dvb_frontend *fe, u16 *snr)
+{
+        u32 snrval = stv0367ter_snr_readreg(fe);
+
+        *snr = snrval / 1000;
 
         return 0;
 }
@@ -1501,7 +1509,8 @@ static int stv0367ter_read_status(struct dvb_frontend *fe,
         *status = 0;
 
         if (stv0367_readbits(state, F367TER_LK)) {
-                *status |= FE_HAS_LOCK;
+                *status = FE_HAS_SIGNAL | FE_HAS_CARRIER | FE_HAS_VITERBI
+                          | FE_HAS_SYNC | FE_HAS_LOCK;
                 dprintk("%s: stv0367 has locked\n", __func__);
         }
 
@@ -2149,6 +2158,18 @@ static int stv0367cab_read_status(struct dvb_frontend *fe,
 
         *status = 0;
 
+        if (state->cab_state->state > FE_CAB_NOSIGNAL)
+                *status |= FE_HAS_SIGNAL;
+
+        if (state->cab_state->state > FE_CAB_NOCARRIER)
+                *status |= FE_HAS_CARRIER;
+
+        if (state->cab_state->state >= FE_CAB_DEMODOK)
+                *status |= FE_HAS_VITERBI;
+
+        if (state->cab_state->state >= FE_CAB_DATAOK)
+                *status |= FE_HAS_SYNC;
+
         if (stv0367_readbits(state, (state->cab_state->qamfec_status_reg ?
                 state->cab_state->qamfec_status_reg : F367CAB_QAMFEC_LOCK))) {
                 *status |= FE_HAS_LOCK;
@@ -2702,51 +2723,61 @@ static int stv0367cab_read_strength(struct dvb_frontend *fe, u16 *strength)
         return 0;
 }
 
-static int stv0367cab_read_snr(struct dvb_frontend *fe, u16 *snr)
+static int stv0367cab_snr_power(struct dvb_frontend *fe)
 {
         struct stv0367_state *state = fe->demodulator_priv;
-        u32 noisepercentage;
         enum stv0367cab_mod QAMSize;
-        u32 regval = 0, temp = 0;
-        int power, i;
 
         QAMSize = stv0367_readbits(state, F367CAB_QAM_MODE);
         switch (QAMSize) {
         case FE_CAB_MOD_QAM4:
-                power = 21904;
-                break;
+                return 21904;
         case FE_CAB_MOD_QAM16:
-                power = 20480;
-                break;
+                return 20480;
         case FE_CAB_MOD_QAM32:
-                power = 23040;
-                break;
+                return 23040;
         case FE_CAB_MOD_QAM64:
-                power = 21504;
-                break;
+                return 21504;
         case FE_CAB_MOD_QAM128:
-                power = 23616;
-                break;
+                return 23616;
         case FE_CAB_MOD_QAM256:
-                power = 21760;
-                break;
-        case FE_CAB_MOD_QAM512:
-                power = 1;
-                break;
+                return 21760;
         case FE_CAB_MOD_QAM1024:
-                power = 21280;
-                break;
+                return 21280;
         default:
-                power = 1;
                 break;
         }
 
+        return 1;
+}
+
+static int stv0367cab_snr_readreg(struct dvb_frontend *fe, int avgdiv)
+{
+        struct stv0367_state *state = fe->demodulator_priv;
+        u32 regval = 0;
+        int i;
+
         for (i = 0; i < 10; i++) {
                 regval += (stv0367_readbits(state, F367CAB_SNR_LO)
                         + 256 * stv0367_readbits(state, F367CAB_SNR_HI));
         }
 
-        regval /= 10; /*for average over 10 times in for loop above*/
+        if (avgdiv)
+                regval /= 10;
+
+        return regval;
+}
+
+static int stv0367cab_read_snr(struct dvb_frontend *fe, u16 *snr)
+{
+        struct stv0367_state *state = fe->demodulator_priv;
+        u32 noisepercentage;
+        u32 regval = 0, temp = 0;
+        int power;
+
+        power = stv0367cab_snr_power(fe);
+        regval = stv0367cab_snr_readreg(fe, 1);
+
         if (regval != 0) {
                 temp = power
                         * (1 << (3 + stv0367_readbits(state, F367CAB_SNR_PER)));
@@ -2980,21 +3011,117 @@ static int stv0367ddb_set_frontend(struct dvb_frontend *fe)
         return -EINVAL;
 }
 
+static void stv0367ddb_read_signal_strength(struct dvb_frontend *fe)
+{
+        struct stv0367_state *state = fe->demodulator_priv;
+        struct dtv_frontend_properties *p = &fe->dtv_property_cache;
+        s32 signalstrength;
+
+        switch (state->activedemod) {
+        case demod_cab:
+                signalstrength = stv0367cab_get_rf_lvl(state) * 1000;
+                break;
+        default:
+                p->strength.stat[0].scale = FE_SCALE_NOT_AVAILABLE;
+                return;
+        }
+
+        p->strength.stat[0].scale = FE_SCALE_DECIBEL;
+        p->strength.stat[0].uvalue = signalstrength;
+}
+
+static void stv0367ddb_read_snr(struct dvb_frontend *fe)
+{
+        struct stv0367_state *state = fe->demodulator_priv;
+        struct dtv_frontend_properties *p = &fe->dtv_property_cache;
+        int cab_pwr;
+        u32 regval, tmpval, snrval = 0;
+
+        switch (state->activedemod) {
+        case demod_ter:
+                snrval = stv0367ter_snr_readreg(fe);
+                break;
+        case demod_cab:
+                cab_pwr = stv0367cab_snr_power(fe);
+                regval = stv0367cab_snr_readreg(fe, 0);
+
+                /* prevent division by zero */
+                if (!regval) {
+                        snrval = 0;
+                        break;
+                }
+
+                tmpval = (cab_pwr * 320) / regval;
+                snrval = ((tmpval != 0) ? (intlog2(tmpval) / 5581) : 0);
+                break;
+        default:
+                p->cnr.stat[0].scale = FE_SCALE_NOT_AVAILABLE;
+                return;
+        }
+
+        p->cnr.stat[0].scale = FE_SCALE_DECIBEL;
+        p->cnr.stat[0].uvalue = snrval;
+}
+
+static void stv0367ddb_read_ucblocks(struct dvb_frontend *fe)
+{
+        struct stv0367_state *state = fe->demodulator_priv;
+        struct dtv_frontend_properties *p = &fe->dtv_property_cache;
+        u32 ucblocks = 0;
+
+        switch (state->activedemod) {
+        case demod_ter:
+                stv0367ter_read_ucblocks(fe, &ucblocks);
+                break;
+        case demod_cab:
+                stv0367cab_read_ucblcks(fe, &ucblocks);
+                break;
+        default:
+                p->block_error.stat[0].scale = FE_SCALE_NOT_AVAILABLE;
+                return;
+        }
+
+        p->block_error.stat[0].scale = FE_SCALE_COUNTER;
+        p->block_error.stat[0].uvalue = ucblocks;
+}
+
 static int stv0367ddb_read_status(struct dvb_frontend *fe,
                                   enum fe_status *status)
 {
         struct stv0367_state *state = fe->demodulator_priv;
+        struct dtv_frontend_properties *p = &fe->dtv_property_cache;
+        int ret;
 
         switch (state->activedemod) {
         case demod_ter:
-                return stv0367ter_read_status(fe, status);
+                ret = stv0367ter_read_status(fe, status);
+                break;
         case demod_cab:
-                return stv0367cab_read_status(fe, status);
-        default:
+                ret = stv0367cab_read_status(fe, status);
                 break;
+        default:
+                return 0;
         }
 
-        return -EINVAL;
+        /* stop and report on *_read_status failure */
+        if (ret)
+                return ret;
+
+        stv0367ddb_read_signal_strength(fe);
+
+        /* read carrier/noise when a carrier is detected */
+        if (*status & FE_HAS_CARRIER)
+                stv0367ddb_read_snr(fe);
+        else
+                p->cnr.stat[0].scale = FE_SCALE_NOT_AVAILABLE;
+
+        /* read uncorrected blocks on FE_HAS_LOCK */
+        if (*status & FE_HAS_LOCK)
+                stv0367ddb_read_ucblocks(fe);
+        else
+                p->block_error.stat[0].scale = FE_SCALE_NOT_AVAILABLE;
+
+        return 0;
 }
 
 static int stv0367ddb_get_frontend(struct dvb_frontend *fe,
@@ -3035,6 +3162,7 @@ static int stv0367ddb_sleep(struct dvb_frontend *fe)
 static int stv0367ddb_init(struct stv0367_state *state)
 {
         struct stv0367ter_state *ter_state = state->ter_state;
+        struct dtv_frontend_properties *p = &state->fe.dtv_property_cache;
 
         stv0367_writereg(state, R367TER_TOPCTRL, 0x10);
 
@@ -3109,6 +3237,13 @@ static int stv0367ddb_init(struct stv0367_state *state)
         ter_state->first_lock = 0;
         ter_state->unlock_counter = 2;
 
+        p->strength.len = 1;
+        p->strength.stat[0].scale = FE_SCALE_NOT_AVAILABLE;
+        p->cnr.len = 1;
+        p->cnr.stat[0].scale = FE_SCALE_NOT_AVAILABLE;
+        p->block_error.len = 1;
+        p->block_error.stat[0].scale = FE_SCALE_NOT_AVAILABLE;
+
         return 0;
 }
 
@@ -3126,15 +3261,12 @@ static const struct dvb_frontend_ops stv0367ddb_ops = {
                         0x400 |/* FE_CAN_QAM_4 */
                         FE_CAN_QAM_16 | FE_CAN_QAM_32  |
                         FE_CAN_QAM_64 | FE_CAN_QAM_128 |
-                        FE_CAN_QAM_256 | FE_CAN_FEC_AUTO |
+                        FE_CAN_QAM_256 | FE_CAN_QAM_AUTO |
                         /* DVB-T */
-                        FE_CAN_FEC_1_2 | FE_CAN_FEC_2_3 |
-                        FE_CAN_FEC_3_4 | FE_CAN_FEC_5_6 | FE_CAN_FEC_7_8 |
-                        FE_CAN_FEC_AUTO |
-                        FE_CAN_QPSK | FE_CAN_QAM_16 | FE_CAN_QAM_64 |
-                        FE_CAN_QAM_128 | FE_CAN_QAM_256 | FE_CAN_QAM_AUTO |
-                        FE_CAN_TRANSMISSION_MODE_AUTO | FE_CAN_RECOVER |
-                        FE_CAN_INVERSION_AUTO |
+                        FE_CAN_FEC_1_2 | FE_CAN_FEC_2_3 | FE_CAN_FEC_3_4 |
+                        FE_CAN_FEC_5_6 | FE_CAN_FEC_7_8 | FE_CAN_FEC_AUTO |
+                        FE_CAN_QPSK | FE_CAN_TRANSMISSION_MODE_AUTO |
+                        FE_CAN_RECOVER | FE_CAN_INVERSION_AUTO |
                         FE_CAN_MUTE_TS
         },
         .release = stv0367_release,
diff --git a/drivers/media/i2c/et8ek8/et8ek8_driver.c b/drivers/media/i2c/et8ek8/et8ek8_driver.c
index 6e313d5243a0..f39f5179dd95 100644
--- a/drivers/media/i2c/et8ek8/et8ek8_driver.c
+++ b/drivers/media/i2c/et8ek8/et8ek8_driver.c
@@ -1496,7 +1496,6 @@ MODULE_DEVICE_TABLE(i2c, et8ek8_id_table);
 static const struct dev_pm_ops et8ek8_pm_ops = {
         SET_SYSTEM_SLEEP_PM_OPS(et8ek8_suspend, et8ek8_resume)
 };
-MODULE_DEVICE_TABLE(of, et8ek8_of_table);
 
 static struct i2c_driver et8ek8_i2c_driver = {
         .driver         = {
diff --git a/drivers/media/i2c/tvp5150.c b/drivers/media/i2c/tvp5150.c
index 9da4bf4f2c7a..7b79a7498751 100644
--- a/drivers/media/i2c/tvp5150.c
+++ b/drivers/media/i2c/tvp5150.c
@@ -659,7 +659,7 @@ static int tvp5150_set_vbi(struct v4l2_subdev *sd,
         struct tvp5150 *decoder = to_tvp5150(sd);
         v4l2_std_id std = decoder->norm;
         u8 reg;
-        int pos=0;
+        int pos = 0;
 
         if (std == V4L2_STD_ALL) {
                 dev_err(sd->dev, "VBI can't be configured without knowing number of lines\n");
@@ -669,33 +669,30 @@ static int tvp5150_set_vbi(struct v4l2_subdev *sd,
                 line += 3;
         }
 
-        if (line<6||line>27)
+        if (line < 6 || line > 27)
                 return 0;
 
-        while (regs->reg != (u16)-1 ) {
+        while (regs->reg != (u16)-1) {
                 if ((type & regs->type.vbi_type) &&
-                    (line>=regs->type.ini_line) &&
-                    (line<=regs->type.end_line)) {
-                        type=regs->type.vbi_type;
+                    (line >= regs->type.ini_line) &&
+                    (line <= regs->type.end_line))
                         break;
-                }
 
                 regs++;
                 pos++;
         }
+
         if (regs->reg == (u16)-1)
                 return 0;
 
-        type=pos | (flags & 0xf0);
-        reg=((line-6)<<1)+TVP5150_LINE_MODE_INI;
+        type = pos | (flags & 0xf0);
+        reg = ((line - 6) << 1) + TVP5150_LINE_MODE_INI;
 
-        if (fields&1) {
+        if (fields & 1)
                 tvp5150_write(sd, reg, type);
-        }
 
-        if (fields&2) {
-                tvp5150_write(sd, reg+1, type);
-        }
+        if (fields & 2)
+                tvp5150_write(sd, reg + 1, type);
 
         return type;
 }
diff --git a/drivers/media/pci/ddbridge/ddbridge-core.c b/drivers/media/pci/ddbridge/ddbridge-core.c
index 9420479bee9a..cd1723e79a07 100644
--- a/drivers/media/pci/ddbridge/ddbridge-core.c
+++ b/drivers/media/pci/ddbridge/ddbridge-core.c
@@ -17,6 +17,8 @@
  * http://www.gnu.org/copyleft/gpl.html
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/interrupt.h>
@@ -114,6 +116,19 @@ static int i2c_write_reg(struct i2c_adapter *adap, u8 adr,
         return i2c_write(adap, adr, msg, 2);
 }
 
+static inline u32 safe_ddbreadl(struct ddb *dev, u32 adr)
+{
+        u32 val = ddbreadl(adr);
+
+        /* (ddb)readl returns (uint)-1 (all bits set) on failure, catch that */
+        if (val == ~0) {
+                dev_err(&dev->pdev->dev, "ddbreadl failure, adr=%08x\n", adr);
+                return 0;
+        }
+
+        return val;
+}
+
 static int ddb_i2c_cmd(struct ddb_i2c *i2c, u32 adr, u32 cmd)
 {
         struct ddb *dev = i2c->dev;
@@ -124,10 +139,10 @@ static int ddb_i2c_cmd(struct ddb_i2c *i2c, u32 adr, u32 cmd)
         ddbwritel((adr << 9) | cmd, i2c->regs + I2C_COMMAND);
         stat = wait_event_timeout(i2c->wq, i2c->done == 1, HZ);
         if (stat == 0) {
-                printk(KERN_ERR "I2C timeout\n");
+                dev_err(&dev->pdev->dev, "I2C timeout\n");
                 { /* MSI debugging*/
                         u32 istat = ddbreadl(INTERRUPT_STATUS);
-                        printk(KERN_ERR "IRS %08x\n", istat);
+                        dev_err(&dev->pdev->dev, "IRS %08x\n", istat);
                         ddbwritel(istat, INTERRUPT_ACK);
                 }
                 return -EIO;
@@ -533,7 +548,7 @@ static u32 ddb_input_avail(struct ddb_input *input)
         off = (stat & 0x7ff) << 7;
 
         if (ctrl & 4) {
-                printk(KERN_ERR "IA %d %d %08x\n", idx, off, ctrl);
+                dev_err(&dev->pdev->dev, "IA %d %d %08x\n", idx, off, ctrl);
                 ddbwritel(input->stat, DMA_BUFFER_ACK(input->nr));
                 return 0;
         }
@@ -611,6 +626,7 @@ static int demod_attach_drxk(struct ddb_input *input)
         struct i2c_adapter *i2c = &input->port->i2c->adap;
         struct dvb_frontend *fe;
         struct drxk_config config;
+        struct device *dev = &input->port->dev->pdev->dev;
 
         memset(&config, 0, sizeof(config));
         config.microcode_name = "drxk_a3.mc";
@@ -619,7 +635,7 @@ static int demod_attach_drxk(struct ddb_input *input)
 
         fe = input->fe = dvb_attach(drxk_attach, &config, i2c);
         if (!input->fe) {
-                printk(KERN_ERR "No DRXK found!\n");
+                dev_err(dev, "No DRXK found!\n");
                 return -ENODEV;
         }
         fe->sec_priv = input;
@@ -632,12 +648,13 @@ static int tuner_attach_tda18271(struct ddb_input *input)
 {
         struct i2c_adapter *i2c = &input->port->i2c->adap;
         struct dvb_frontend *fe;
+        struct device *dev = &input->port->dev->pdev->dev;
 
         if (input->fe->ops.i2c_gate_ctrl)
                 input->fe->ops.i2c_gate_ctrl(input->fe, 1);
         fe = dvb_attach(tda18271c2dd_attach, input->fe, i2c, 0x60);
         if (!fe) {
-                printk(KERN_ERR "No TDA18271 found!\n");
+                dev_err(dev, "No TDA18271 found!\n");
                 return -ENODEV;
         }
         if (input->fe->ops.i2c_gate_ctrl)
@@ -670,13 +687,14 @@ static struct stv0367_config ddb_stv0367_config[] = {
 static int demod_attach_stv0367(struct ddb_input *input)
 {
         struct i2c_adapter *i2c = &input->port->i2c->adap;
+        struct device *dev = &input->port->dev->pdev->dev;
 
         /* attach frontend */
         input->fe = dvb_attach(stv0367ddb_attach,
                 &ddb_stv0367_config[(input->nr & 1)], i2c);
 
         if (!input->fe) {
-                printk(KERN_ERR "stv0367ddb_attach failed (not found?)\n");
+                dev_err(dev, "stv0367ddb_attach failed (not found?)\n");
                 return -ENODEV;
         }
 
@@ -690,17 +708,19 @@ static int demod_attach_stv0367(struct ddb_input *input)
 static int tuner_tda18212_ping(struct ddb_input *input, unsigned short adr)
 {
         struct i2c_adapter *adapter = &input->port->i2c->adap;
+        struct device *dev = &input->port->dev->pdev->dev;
+
         u8 tda_id[2];
         u8 subaddr = 0x00;
 
-        printk(KERN_DEBUG "stv0367-tda18212 tuner ping\n");
+        dev_dbg(dev, "stv0367-tda18212 tuner ping\n");
         if (input->fe->ops.i2c_gate_ctrl)
                 input->fe->ops.i2c_gate_ctrl(input->fe, 1);
 
         if (i2c_read_regs(adapter, adr, subaddr, tda_id, sizeof(tda_id)) < 0)
-                printk(KERN_DEBUG "tda18212 ping 1 fail\n");
+                dev_dbg(dev, "tda18212 ping 1 fail\n");
         if (i2c_read_regs(adapter, adr, subaddr, tda_id, sizeof(tda_id)) < 0)
-                printk(KERN_DEBUG "tda18212 ping 2 fail\n");
+                dev_warn(dev, "tda18212 ping failed, expect problems\n");
 
         if (input->fe->ops.i2c_gate_ctrl)
                 input->fe->ops.i2c_gate_ctrl(input->fe, 0);
@@ -711,6 +731,7 @@ static int tuner_tda18212_ping(struct ddb_input *input, unsigned short adr)
 static int demod_attach_cxd28xx(struct ddb_input *input, int par, int osc24)
 {
         struct i2c_adapter *i2c = &input->port->i2c->adap;
+        struct device *dev = &input->port->dev->pdev->dev;
         struct cxd2841er_config cfg;
 
         /* the cxd2841er driver expects 8bit/shifted I2C addresses */
@@ -728,7 +749,7 @@ static int demod_attach_cxd28xx(struct ddb_input *input, int par, int osc24)
         input->fe = dvb_attach(cxd2841er_attach_t_c, &cfg, i2c);
 
         if (!input->fe) {
-                printk(KERN_ERR "No Sony CXD28xx found!\n");
+                dev_err(dev, "No Sony CXD28xx found!\n");
                 return -ENODEV;
         }
 
@@ -742,6 +763,7 @@ static int demod_attach_cxd28xx(struct ddb_input *input, int par, int osc24)
 static int tuner_attach_tda18212(struct ddb_input *input, u32 porttype)
 {
         struct i2c_adapter *adapter = &input->port->i2c->adap;
+        struct device *dev = &input->port->dev->pdev->dev;
         struct i2c_client *client;
         struct tda18212_config config = {
                 .fe = input->fe,
@@ -786,7 +808,7 @@ static int tuner_attach_tda18212(struct ddb_input *input, u32 porttype)
 
         return 0;
 err:
-        printk(KERN_INFO "TDA18212 tuner not found. Device is not fully operational.\n");
+        dev_warn(dev, "TDA18212 tuner not found. Device is not fully operational.\n");
         return -ENODEV;
 }
 
@@ -847,19 +869,20 @@ static struct stv6110x_config stv6110b = {
 static int demod_attach_stv0900(struct ddb_input *input, int type)
 {
         struct i2c_adapter *i2c = &input->port->i2c->adap;
+        struct device *dev = &input->port->dev->pdev->dev;
         struct stv090x_config *feconf = type ? &stv0900_aa : &stv0900;
 
         input->fe = dvb_attach(stv090x_attach, feconf, i2c,
                                (input->nr & 1) ? STV090x_DEMODULATOR_1
                                : STV090x_DEMODULATOR_0);
         if (!input->fe) {
-                printk(KERN_ERR "No STV0900 found!\n");
+                dev_err(dev, "No STV0900 found!\n");
                 return -ENODEV;
         }
         if (!dvb_attach(lnbh24_attach, input->fe, i2c, 0,
                         0, (input->nr & 1) ?
                         (0x09 - type) : (0x0b - type))) {
-                printk(KERN_ERR "No LNBH24 found!\n");
+                dev_err(dev, "No LNBH24 found!\n");
                 return -ENODEV;
         }
         return 0;
@@ -868,6 +891,7 @@ static int demod_attach_stv0900(struct ddb_input *input, int type)
 static int tuner_attach_stv6110(struct ddb_input *input, int type)
 {
         struct i2c_adapter *i2c = &input->port->i2c->adap;
+        struct device *dev = &input->port->dev->pdev->dev;
         struct stv090x_config *feconf = type ? &stv0900_aa : &stv0900;
         struct stv6110x_config *tunerconf = (input->nr & 1) ?
                 &stv6110b : &stv6110a;
@@ -875,10 +899,10 @@ static int tuner_attach_stv6110(struct ddb_input *input, int type)
 
         ctl = dvb_attach(stv6110x_attach, input->fe, tunerconf, i2c);
         if (!ctl) {
-                printk(KERN_ERR "No STV6110X found!\n");
+                dev_err(dev, "No STV6110X found!\n");
                 return -ENODEV;
         }
-        printk(KERN_INFO "attach tuner input %d adr %02x\n",
+        dev_info(dev, "attach tuner input %d adr %02x\n",
                          input->nr, tunerconf->addr);
 
         feconf->tuner_init          = ctl->tuner_init;
@@ -1009,13 +1033,14 @@ static int dvb_input_attach(struct ddb_input *input)
         struct ddb_port *port = input->port;
         struct dvb_adapter *adap = &input->adap;
         struct dvb_demux *dvbdemux = &input->demux;
+        struct device *dev = &input->port->dev->pdev->dev;
         int sony_osc24 = 0, sony_tspar = 0;
 
         ret = dvb_register_adapter(adap, "DDBridge", THIS_MODULE,
                                    &input->port->dev->pdev->dev,
                                    adapter_nr);
         if (ret < 0) {
-                printk(KERN_ERR "ddbridge: Could not register adapter.Check if you enabled enough adapters in dvb-core!\n");
+                dev_err(dev, "Could not register adapter. Check if you enabled enough adapters in dvb-core!\n");
                 return ret;
         }
         input->attached = 1;
@@ -1241,9 +1266,9 @@ static void input_tasklet(unsigned long data)
 
         if (input->port->class == DDB_PORT_TUNER) {
                 if (4&ddbreadl(DMA_BUFFER_CONTROL(input->nr)))
-                        printk(KERN_ERR "Overflow input %d\n", input->nr);
+                        dev_err(&dev->pdev->dev, "Overflow input %d\n", input->nr);
                 while (input->cbuf != ((input->stat >> 11) & 0x1f)
-                       || (4&ddbreadl(DMA_BUFFER_CONTROL(input->nr)))) {
+                       || (4 & safe_ddbreadl(dev, DMA_BUFFER_CONTROL(input->nr)))) {
                         dvb_dmx_swfilter_packets(&input->demux,
                                                  input->vbuf[input->cbuf],
                                                  input->dma_buf_size / 188);
@@ -1280,6 +1305,7 @@ static struct cxd2099_cfg cxd_cfg = {
         .adr     =  0x40,
         .polarity = 1,
         .clock_mode = 1,
+        .max_i2c = 512,
 };
 
 static int ddb_ci_attach(struct ddb_port *port)
@@ -1310,6 +1336,7 @@ static int ddb_ci_attach(struct ddb_port *port)
 
 static int ddb_port_attach(struct ddb_port *port)
 {
+        struct device *dev = &port->dev->pdev->dev;
         int ret = 0;
 
         switch (port->class) {
@@ -1326,7 +1353,7 @@ static int ddb_port_attach(struct ddb_port *port)
                 break;
         }
         if (ret < 0)
-                printk(KERN_ERR "port_attach on port %d failed\n", port->nr);
+                dev_err(dev, "port_attach on port %d failed\n", port->nr);
         return ret;
 }
 
@@ -1377,6 +1404,7 @@ static void ddb_ports_detach(struct ddb *dev)
 static int init_xo2(struct ddb_port *port)
 {
         struct i2c_adapter *i2c = &port->i2c->adap;
+        struct device *dev = &port->dev->pdev->dev;
         u8 val, data[2];
         int res;
 
@@ -1385,7 +1413,7 @@ static int init_xo2(struct ddb_port *port)
                 return res;
 
         if (data[0] != 0x01)  {
-                pr_info("Port %d: invalid XO2\n", port->nr);
+                dev_info(dev, "Port %d: invalid XO2\n", port->nr);
                 return -1;
         }
 
@@ -1511,7 +1539,7 @@ static void ddb_port_probe(struct ddb_port *port)
                 port->class = DDB_PORT_CI;
                 ddbwritel(I2C_SPEED_400, port->i2c->regs + I2C_TIMING);
         } else if (port_has_xo2(port, &xo2_type, &xo2_id)) {
-                printk(KERN_INFO "Port %d (TAB %d): XO2 type: %d, id: %d\n",
+                dev_dbg(&dev->pdev->dev, "Port %d (TAB %d): XO2 type: %d, id: %d\n",
                         port->nr, port->nr+1, xo2_type, xo2_id);
 
                 ddbwritel(I2C_SPEED_400, port->i2c->regs + I2C_TIMING);
@@ -1556,10 +1584,10 @@ static void ddb_port_probe(struct ddb_port *port)
                         }
                         break;
                 case DDB_XO2_TYPE_CI:
-                        printk(KERN_INFO "DuoFlex CI modules not supported\n");
+                        dev_info(&dev->pdev->dev, "DuoFlex CI modules not supported\n");
                         break;
                 default:
-                        printk(KERN_INFO "Unknown XO2 DuoFlex module\n");
+                        dev_info(&dev->pdev->dev, "Unknown XO2 DuoFlex module\n");
                         break;
                 }
         } else if (port_has_cxd28xx(port, &cxd_id)) {
@@ -1611,7 +1639,7 @@ static void ddb_port_probe(struct ddb_port *port)
                 ddbwritel(I2C_SPEED_100, port->i2c->regs + I2C_TIMING);
         }
 
-        printk(KERN_INFO "Port %d (TAB %d): %s\n",
+        dev_info(&dev->pdev->dev, "Port %d (TAB %d): %s\n",
                          port->nr, port->nr+1, modname);
 }
 
@@ -1765,7 +1793,7 @@ static int flashio(struct ddb *dev, u8 *wbuf, u32 wlen, u8 *rbuf, u32 rlen)
                 wbuf += 4;
                 wlen -= 4;
                 ddbwritel(data, SPI_DATA);
-                while (ddbreadl(SPI_CONTROL) & 0x0004)
+                while (safe_ddbreadl(dev, SPI_CONTROL) & 0x0004)
                         ;
         }
 
@@ -1785,7 +1813,7 @@ static int flashio(struct ddb *dev, u8 *wbuf, u32 wlen, u8 *rbuf, u32 rlen)
         if (shift)
                 data <<= shift;
         ddbwritel(data, SPI_DATA);
-        while (ddbreadl(SPI_CONTROL) & 0x0004)
+        while (safe_ddbreadl(dev, SPI_CONTROL) & 0x0004)
                 ;
 
         if (!rlen) {
@@ -1797,7 +1825,7 @@ static int flashio(struct ddb *dev, u8 *wbuf, u32 wlen, u8 *rbuf, u32 rlen)
 
         while (rlen > 4) {
                 ddbwritel(0xffffffff, SPI_DATA);
-                while (ddbreadl(SPI_CONTROL) & 0x0004)
+                while (safe_ddbreadl(dev, SPI_CONTROL) & 0x0004)
                         ;
                 data = ddbreadl(SPI_DATA);
                 *(u32 *) rbuf = swab32(data);
@@ -1806,7 +1834,7 @@ static int flashio(struct ddb *dev, u8 *wbuf, u32 wlen, u8 *rbuf, u32 rlen)
         }
         ddbwritel(0x0003 | ((rlen << (8 + 3)) & 0x1F00), SPI_CONTROL);
         ddbwritel(0xffffffff, SPI_DATA);
-        while (ddbreadl(SPI_CONTROL) & 0x0004)
+        while (safe_ddbreadl(dev, SPI_CONTROL) & 0x0004)
                 ;
 
         data = ddbreadl(SPI_DATA);
@@ -1993,7 +2021,7 @@ static int ddb_probe(struct pci_dev *pdev, const struct pci_device_id *id)
         dev->pdev = pdev;
         pci_set_drvdata(pdev, dev);
         dev->info = (struct ddb_info *) id->driver_data;
-        printk(KERN_INFO "DDBridge driver detected: %s\n", dev->info->name);
+        dev_info(&pdev->dev, "Detected %s\n", dev->info->name);
 
         dev->regs = ioremap(pci_resource_start(dev->pdev, 0),
                             pci_resource_len(dev->pdev, 0));
@@ -2001,13 +2029,13 @@ static int ddb_probe(struct pci_dev *pdev, const struct pci_device_id *id)
                 stat = -ENOMEM;
                 goto fail;
         }
-        printk(KERN_INFO "HW %08x FW %08x\n", ddbreadl(0), ddbreadl(4));
+        dev_info(&pdev->dev, "HW %08x FW %08x\n", ddbreadl(0), ddbreadl(4));
 
 #ifdef CONFIG_PCI_MSI
         if (pci_msi_enabled())
                 stat = pci_enable_msi(dev->pdev);
         if (stat) {
-                printk(KERN_INFO ": MSI not available.\n");
+                dev_info(&pdev->dev, "MSI not available.\n");
         } else {
                 irq_flag = 0;
                 dev->msi = 1;
@@ -2040,7 +2068,7 @@ static int ddb_probe(struct pci_dev *pdev, const struct pci_device_id *id)
                 goto fail1;
         ddb_ports_init(dev);
         if (ddb_buffers_alloc(dev) < 0) {
-                printk(KERN_INFO ": Could not allocate buffer memory\n");
+                dev_err(&pdev->dev, "Could not allocate buffer memory\n");
                 goto fail2;
         }
         if (ddb_ports_attach(dev) < 0)
@@ -2050,19 +2078,19 @@ static int ddb_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 
 fail3:
         ddb_ports_detach(dev);
-        printk(KERN_ERR "fail3\n");
+        dev_err(&pdev->dev, "fail3\n");
         ddb_ports_release(dev);
 fail2:
-        printk(KERN_ERR "fail2\n");
+        dev_err(&pdev->dev, "fail2\n");
         ddb_buffers_free(dev);
 fail1:
-        printk(KERN_ERR "fail1\n");
+        dev_err(&pdev->dev, "fail1\n");
         if (dev->msi)
                 pci_disable_msi(dev->pdev);
         if (stat == 0)
                 free_irq(dev->pdev->irq, dev);
 fail:
-        printk(KERN_ERR "fail\n");
+        dev_err(&pdev->dev, "fail\n");
         ddb_unmap(dev);
         pci_set_drvdata(pdev, NULL);
         pci_disable_device(pdev);
@@ -2242,7 +2270,7 @@ static __init int module_init_ddbridge(void)
 {
         int ret;
 
-        printk(KERN_INFO "Digital Devices PCIE bridge driver, Copyright (C) 2010-11 Digital Devices GmbH\n");
+        pr_info("Digital Devices PCIE bridge driver, Copyright (C) 2010-11 Digital Devices GmbH\n");
 
         ret = ddb_class_create();
         if (ret < 0)
diff --git a/drivers/media/pci/ngene/ngene-core.c b/drivers/media/pci/ngene/ngene-core.c
index ce69e648b663..8c92cb7f7e72 100644
--- a/drivers/media/pci/ngene/ngene-core.c
+++ b/drivers/media/pci/ngene/ngene-core.c
@@ -336,9 +336,9 @@ int ngene_command(struct ngene *dev, struct ngene_command *com)
 {
         int result;
 
-        down(&dev->cmd_mutex);
+        mutex_lock(&dev->cmd_mutex);
         result = ngene_command_mutex(dev, com);
-        up(&dev->cmd_mutex);
+        mutex_unlock(&dev->cmd_mutex);
         return result;
 }
 
@@ -560,7 +560,6 @@ static int ngene_command_stream_control(struct ngene *dev, u8 stream,
         u16 BsSPI = ((stream & 1) ? 0x9800 : 0x9700);
         u16 BsSDO = 0x9B00;
 
-        down(&dev->stream_mutex);
         memset(&com, 0, sizeof(com));
         com.cmd.hdr.Opcode = CMD_CONTROL;
         com.cmd.hdr.Length = sizeof(struct FW_STREAM_CONTROL) - 2;
@@ -586,17 +585,13 @@ static int ngene_command_stream_control(struct ngene *dev, u8 stream,
                         chan->State = KSSTATE_ACQUIRE;
                         chan->HWState = HWSTATE_STOP;
                         spin_unlock_irq(&chan->state_lock);
-                        if (ngene_command(dev, &com) < 0) {
-                                up(&dev->stream_mutex);
+                        if (ngene_command(dev, &com) < 0)
                                 return -1;
-                        }
                         /* clear_buffers(chan); */
                         flush_buffers(chan);
-                        up(&dev->stream_mutex);
                         return 0;
                 }
                 spin_unlock_irq(&chan->state_lock);
-                up(&dev->stream_mutex);
                 return 0;
         }
 
@@ -692,11 +687,9 @@ static int ngene_command_stream_control(struct ngene *dev, u8 stream,
                 chan->HWState = HWSTATE_STARTUP;
         spin_unlock_irq(&chan->state_lock);
 
-        if (ngene_command(dev, &com) < 0) {
-                up(&dev->stream_mutex);
+        if (ngene_command(dev, &com) < 0)
                 return -1;
-        }
-        up(&dev->stream_mutex);
+
         return 0;
 }
 
@@ -750,8 +743,11 @@ void set_transfer(struct ngene_channel *chan, int state)
                 /* else printk(KERN_INFO DEVICE_NAME ": lock=%08x\n",
                            ngreadl(0x9310)); */
 
+        mutex_lock(&dev->stream_mutex);
         ret = ngene_command_stream_control(dev, chan->number,
                                            control, mode, flags);
+        mutex_unlock(&dev->stream_mutex);
+
         if (!ret)
                 chan->running = state;
         else
@@ -1283,7 +1279,7 @@ static int ngene_load_firm(struct ngene *dev)
 
 static void ngene_stop(struct ngene *dev)
 {
-        down(&dev->cmd_mutex);
+        mutex_destroy(&dev->cmd_mutex);
         i2c_del_adapter(&(dev->channel[0].i2c_adapter));
         i2c_del_adapter(&(dev->channel[1].i2c_adapter));
         ngwritel(0, NGENE_INT_ENABLE);
@@ -1346,10 +1342,10 @@ static int ngene_start(struct ngene *dev)
         init_waitqueue_head(&dev->cmd_wq);
         init_waitqueue_head(&dev->tx_wq);
         init_waitqueue_head(&dev->rx_wq);
-        sema_init(&dev->cmd_mutex, 1);
-        sema_init(&dev->stream_mutex, 1);
+        mutex_init(&dev->cmd_mutex);
+        mutex_init(&dev->stream_mutex);
         sema_init(&dev->pll_mutex, 1);
-        sema_init(&dev->i2c_switch_mutex, 1);
+        mutex_init(&dev->i2c_switch_mutex);
         spin_lock_init(&dev->cmd_lock);
         for (i = 0; i < MAX_STREAM; i++)
                 spin_lock_init(&dev->channel[i].state_lock);
@@ -1606,10 +1602,10 @@ static void ngene_unlink(struct ngene *dev)
         com.in_len = 3;
         com.out_len = 1;
 
-        down(&dev->cmd_mutex);
+        mutex_lock(&dev->cmd_mutex);
         ngwritel(0, NGENE_INT_ENABLE);
         ngene_command_mutex(dev, &com);
-        up(&dev->cmd_mutex);
+        mutex_unlock(&dev->cmd_mutex);
 }
 
 void ngene_shutdown(struct pci_dev *pdev)
diff --git a/drivers/media/pci/ngene/ngene-i2c.c b/drivers/media/pci/ngene/ngene-i2c.c
index cf39fcf54adf..fbf36353c701 100644
--- a/drivers/media/pci/ngene/ngene-i2c.c
+++ b/drivers/media/pci/ngene/ngene-i2c.c
@@ -118,7 +118,7 @@ static int ngene_i2c_master_xfer(struct i2c_adapter *adapter,
                 (struct ngene_channel *)i2c_get_adapdata(adapter);
         struct ngene *dev = chan->dev;
 
-        down(&dev->i2c_switch_mutex);
+        mutex_lock(&dev->i2c_switch_mutex);
         ngene_i2c_set_bus(dev, chan->number);
 
         if (num == 2 && msg[1].flags & I2C_M_RD && !(msg[0].flags & I2C_M_RD))
@@ -136,11 +136,11 @@ static int ngene_i2c_master_xfer(struct i2c_adapter *adapter,
                                             msg[0].buf, msg[0].len, 0))
                         goto done;
 
-        up(&dev->i2c_switch_mutex);
+        mutex_unlock(&dev->i2c_switch_mutex);
         return -EIO;
 
 done:
-        up(&dev->i2c_switch_mutex);
+        mutex_unlock(&dev->i2c_switch_mutex);
         return num;
 }
 
diff --git a/drivers/media/pci/ngene/ngene.h b/drivers/media/pci/ngene/ngene.h
index 10d8f74c4f0a..7c7cd217333d 100644
--- a/drivers/media/pci/ngene/ngene.h
+++ b/drivers/media/pci/ngene/ngene.h
@@ -762,10 +762,10 @@ struct ngene {
 
         wait_queue_head_t     cmd_wq;
         int                   cmd_done;
-        struct semaphore      cmd_mutex;
-        struct semaphore      stream_mutex;
+        struct mutex          cmd_mutex;
+        struct mutex          stream_mutex;
         struct semaphore      pll_mutex;
-        struct semaphore      i2c_switch_mutex;
+        struct mutex          i2c_switch_mutex;
         int                   i2c_current_channel;
         int                   i2c_current_bus;
         spinlock_t            cmd_lock;
diff --git a/drivers/media/pci/tw5864/tw5864-video.c b/drivers/media/pci/tw5864/tw5864-video.c
index 2a044be729da..e7bd2b8484e3 100644
--- a/drivers/media/pci/tw5864/tw5864-video.c
+++ b/drivers/media/pci/tw5864/tw5864-video.c
@@ -545,6 +545,7 @@ static int tw5864_fmt_vid_cap(struct file *file, void *priv,
         switch (input->std) {
         default:
                 WARN_ON_ONCE(1);
+                return -EINVAL;
         case STD_NTSC:
                 f->fmt.pix.height = 480;
                 break;
diff --git a/drivers/media/platform/Kconfig b/drivers/media/platform/Kconfig
index 1313cd533436..fb1fa0b82077 100644
--- a/drivers/media/platform/Kconfig
+++ b/drivers/media/platform/Kconfig
@@ -475,8 +475,8 @@ config VIDEO_QCOM_VENUS
         tristate "Qualcomm Venus V4L2 encoder/decoder driver"
         depends on VIDEO_DEV && VIDEO_V4L2 && HAS_DMA
         depends on (ARCH_QCOM && IOMMU_DMA) || COMPILE_TEST
-        select QCOM_MDT_LOADER if (ARM || ARM64)
-        select QCOM_SCM if (ARM || ARM64)
+        select QCOM_MDT_LOADER if ARCH_QCOM
+        select QCOM_SCM if ARCH_QCOM
         select VIDEOBUF2_DMA_SG
         select V4L2_MEM2MEM_DEV
         ---help---
diff --git a/drivers/media/platform/coda/coda-bit.c b/drivers/media/platform/coda/coda-bit.c
index 25cbf9e5ac5a..bba1eb43b5d8 100644
--- a/drivers/media/platform/coda/coda-bit.c
+++ b/drivers/media/platform/coda/coda-bit.c
@@ -393,8 +393,8 @@ static int coda_alloc_framebuffers(struct coda_ctx *ctx,
         int ret;
         int i;
 
-        if (ctx->codec && (ctx->codec->src_fourcc == V4L2_PIX_FMT_H264 ||
-             ctx->codec->dst_fourcc == V4L2_PIX_FMT_H264)) {
+        if (ctx->codec->src_fourcc == V4L2_PIX_FMT_H264 ||
+            ctx->codec->dst_fourcc == V4L2_PIX_FMT_H264) {
                 width = round_up(q_data->width, 16);
                 height = round_up(q_data->height, 16);
         } else {
@@ -2198,7 +2198,7 @@ static void coda_finish_decode(struct coda_ctx *ctx)
         ctx->display_idx = display_idx;
 }
 
-static void coda_error_decode(struct coda_ctx *ctx)
+static void coda_decode_timeout(struct coda_ctx *ctx)
 {
         struct vb2_v4l2_buffer *dst_buf;
 
@@ -2223,7 +2223,7 @@ const struct coda_context_ops coda_bit_decode_ops = {
         .start_streaming = coda_start_decoding,
         .prepare_run = coda_prepare_decode,
         .finish_run = coda_finish_decode,
-        .error_run = coda_error_decode,
+        .run_timeout = coda_decode_timeout,
         .seq_end_work = coda_seq_end_work,
         .release = coda_bit_release,
 };
diff --git a/drivers/media/platform/coda/coda-common.c b/drivers/media/platform/coda/coda-common.c
index f92cc7df58fb..829c7895a98a 100644
--- a/drivers/media/platform/coda/coda-common.c
+++ b/drivers/media/platform/coda/coda-common.c
@@ -1164,8 +1164,8 @@ static void coda_pic_run_work(struct work_struct *work)
 
                 coda_hw_reset(ctx);
 
-                if (ctx->ops->error_run)
-                        ctx->ops->error_run(ctx);
+                if (ctx->ops->run_timeout)
+                        ctx->ops->run_timeout(ctx);
         } else if (!ctx->aborting) {
                 ctx->ops->finish_run(ctx);
         }
diff --git a/drivers/media/platform/coda/coda.h b/drivers/media/platform/coda/coda.h
index 40fe22f0d757..c5f504d8cf67 100644
--- a/drivers/media/platform/coda/coda.h
+++ b/drivers/media/platform/coda/coda.h
@@ -183,7 +183,7 @@ struct coda_context_ops {
         int (*start_streaming)(struct coda_ctx *ctx);
         int (*prepare_run)(struct coda_ctx *ctx);
         void (*finish_run)(struct coda_ctx *ctx);
-        void (*error_run)(struct coda_ctx *ctx);
+        void (*run_timeout)(struct coda_ctx *ctx);
         void (*seq_end_work)(struct work_struct *work);
         void (*release)(struct coda_ctx *ctx);
 };
diff --git a/drivers/media/platform/davinci/ccdc_hw_device.h b/drivers/media/platform/davinci/ccdc_hw_device.h
index 8f6688a7a111..f1b521045d64 100644
--- a/drivers/media/platform/davinci/ccdc_hw_device.h
+++ b/drivers/media/platform/davinci/ccdc_hw_device.h
@@ -42,16 +42,6 @@ struct ccdc_hw_ops {
         int (*set_hw_if_params) (struct vpfe_hw_if_param *param);
         /* get interface parameters */
         int (*get_hw_if_params) (struct vpfe_hw_if_param *param);
-        /*
-         * Pointer to function to set parameters. Used
-         * for implementing VPFE_S_CCDC_PARAMS
-         */
-        int (*set_params) (void *params);
-        /*
-         * Pointer to function to get parameter. Used
-         * for implementing VPFE_G_CCDC_PARAMS
-         */
-        int (*get_params) (void *params);
         /* Pointer to function to configure ccdc */
         int (*configure) (void);
 
diff --git a/drivers/media/platform/davinci/dm355_ccdc.c b/drivers/media/platform/davinci/dm355_ccdc.c
index 73db166dc338..6d492dc4c3a9 100644
--- a/drivers/media/platform/davinci/dm355_ccdc.c
+++ b/drivers/media/platform/davinci/dm355_ccdc.c
@@ -17,12 +17,7 @@
  * This module is for configuring DM355 CCD controller of VPFE to capture
  * Raw yuv or Bayer RGB data from a decoder. CCDC has several modules
  * such as Defect Pixel Correction, Color Space Conversion etc to
- * pre-process the Bayer RGB data, before writing it to SDRAM. This
- * module also allows application to configure individual
- * module parameters through VPFE_CMD_S_CCDC_RAW_PARAMS IOCTL.
- * To do so, application include dm355_ccdc.h and vpfe_capture.h header
- * files. The setparams() API is called by vpfe_capture driver
- * to configure module parameters
+ * pre-process the Bayer RGB data, before writing it to SDRAM.
  *
  * TODO: 1) Raw bayer parameter settings and bayer capture
  *       2) Split module parameter structure to module specific ioctl structs
@@ -260,90 +255,6 @@ static void ccdc_setwin(struct v4l2_rect *image_win,
         dev_dbg(ccdc_cfg.dev, "\nEnd of ccdc_setwin...");
 }
 
-static int validate_ccdc_param(struct ccdc_config_params_raw *ccdcparam)
-{
-        if (ccdcparam->datasft < CCDC_DATA_NO_SHIFT ||
-            ccdcparam->datasft > CCDC_DATA_SHIFT_6BIT) {
-                dev_dbg(ccdc_cfg.dev, "Invalid value of data shift\n");
-                return -EINVAL;
-        }
-
-        if (ccdcparam->mfilt1 < CCDC_NO_MEDIAN_FILTER1 ||
-            ccdcparam->mfilt1 > CCDC_MEDIAN_FILTER1) {
-                dev_dbg(ccdc_cfg.dev, "Invalid value of median filter1\n");
-                return -EINVAL;
-        }
-
-        if (ccdcparam->mfilt2 < CCDC_NO_MEDIAN_FILTER2 ||
-            ccdcparam->mfilt2 > CCDC_MEDIAN_FILTER2) {
-                dev_dbg(ccdc_cfg.dev, "Invalid value of median filter2\n");
-                return -EINVAL;
-        }
-
-        if ((ccdcparam->med_filt_thres < 0) ||
-           (ccdcparam->med_filt_thres > CCDC_MED_FILT_THRESH)) {
-                dev_dbg(ccdc_cfg.dev,
-                        "Invalid value of median filter threshold\n");
-                return -EINVAL;
-        }
-
-        if (ccdcparam->data_sz < CCDC_DATA_16BITS ||
-            ccdcparam->data_sz > CCDC_DATA_8BITS) {
-                dev_dbg(ccdc_cfg.dev, "Invalid value of data size\n");
-                return -EINVAL;
-        }
-
-        if (ccdcparam->alaw.enable) {
-                if (ccdcparam->alaw.gamma_wd < CCDC_GAMMA_BITS_13_4 ||
-                    ccdcparam->alaw.gamma_wd > CCDC_GAMMA_BITS_09_0) {
-                        dev_dbg(ccdc_cfg.dev, "Invalid value of ALAW\n");
-                        return -EINVAL;
-                }
-        }
-
-        if (ccdcparam->blk_clamp.b_clamp_enable) {
-                if (ccdcparam->blk_clamp.sample_pixel < CCDC_SAMPLE_1PIXELS ||
-                    ccdcparam->blk_clamp.sample_pixel > CCDC_SAMPLE_16PIXELS) {
-                        dev_dbg(ccdc_cfg.dev,
-                                "Invalid value of sample pixel\n");
-                        return -EINVAL;
-                }
-                if (ccdcparam->blk_clamp.sample_ln < CCDC_SAMPLE_1LINES ||
-                    ccdcparam->blk_clamp.sample_ln > CCDC_SAMPLE_16LINES) {
-                        dev_dbg(ccdc_cfg.dev,
-                                "Invalid value of sample lines\n");
-                        return -EINVAL;
-                }
-        }
-        return 0;
-}
-
-/* Parameter operations */
-static int ccdc_set_params(void __user *params)
-{
-        struct ccdc_config_params_raw ccdc_raw_params;
-        int x;
-
-        /* only raw module parameters can be set through the IOCTL */
-        if (ccdc_cfg.if_type != VPFE_RAW_BAYER)
-                return -EINVAL;
-
-        x = copy_from_user(&ccdc_raw_params, params, sizeof(ccdc_raw_params));
-        if (x) {
-                dev_dbg(ccdc_cfg.dev, "ccdc_set_params: error in copying ccdcparams, %d\n",
-                        x);
-                return -EFAULT;
-        }
-
-        if (!validate_ccdc_param(&ccdc_raw_params)) {
-                memcpy(&ccdc_cfg.bayer.config_params,
-                        &ccdc_raw_params,
-                        sizeof(ccdc_raw_params));
-                return 0;
-        }
-        return -EINVAL;
-}
-
 /* This function will configure CCDC for YCbCr video capture */
 static void ccdc_config_ycbcr(void)
 {
@@ -939,7 +850,6 @@ static struct ccdc_hw_device ccdc_hw_dev = {
                 .enable = ccdc_enable,
                 .enable_out_to_sdram = ccdc_enable_output_to_sdram,
                 .set_hw_if_params = ccdc_set_hw_if_params,
-                .set_params = ccdc_set_params,
                 .configure = ccdc_configure,
                 .set_buftype = ccdc_set_buftype,
                 .get_buftype = ccdc_get_buftype,
diff --git a/drivers/media/platform/davinci/dm644x_ccdc.c b/drivers/media/platform/davinci/dm644x_ccdc.c
index 740fbc7a8c14..3b2d8a9317b8 100644
--- a/drivers/media/platform/davinci/dm644x_ccdc.c
+++ b/drivers/media/platform/davinci/dm644x_ccdc.c
@@ -17,13 +17,9 @@
  * This module is for configuring CCD controller of DM6446 VPFE to capture
  * Raw yuv or Bayer RGB data from a decoder. CCDC has several modules
  * such as Defect Pixel Correction, Color Space Conversion etc to
- * pre-process the Raw Bayer RGB data, before writing it to SDRAM. This
- * module also allows application to configure individual
- * module parameters through VPFE_CMD_S_CCDC_RAW_PARAMS IOCTL.
- * To do so, application includes dm644x_ccdc.h and vpfe_capture.h header
- * files.  The setparams() API is called by vpfe_capture driver
- * to configure module parameters. This file is named DM644x so that other
- * variants such DM6443 may be supported using the same module.
+ * pre-process the Raw Bayer RGB data, before writing it to SDRAM.
+ * This file is named DM644x so that other variants such DM6443
+ * may be supported using the same module.
  *
  * TODO: Test Raw bayer parameter settings and bayer capture
  *       Split module parameter structure to module specific ioctl structs
@@ -216,96 +212,8 @@ static void ccdc_readregs(void)
         dev_notice(ccdc_cfg.dev, "\nReading 0x%x to VERT_LINES...\n", val);
 }
 
-static int validate_ccdc_param(struct ccdc_config_params_raw *ccdcparam)
-{
-        if (ccdcparam->alaw.enable) {
-                u8 max_gamma = ccdc_gamma_width_max_bit(ccdcparam->alaw.gamma_wd);
-                u8 max_data = ccdc_data_size_max_bit(ccdcparam->data_sz);
-
-                if ((ccdcparam->alaw.gamma_wd > CCDC_GAMMA_BITS_09_0) ||
-                    (ccdcparam->alaw.gamma_wd < CCDC_GAMMA_BITS_15_6) ||
-                    (max_gamma > max_data)) {
-                        dev_dbg(ccdc_cfg.dev, "\nInvalid data line select");
-                        return -1;
-                }
-        }
-        return 0;
-}
-
-static int ccdc_update_raw_params(struct ccdc_config_params_raw *raw_params)
-{
-        struct ccdc_config_params_raw *config_params =
-                                &ccdc_cfg.bayer.config_params;
-        unsigned int *fpc_virtaddr = NULL;
-        unsigned int *fpc_physaddr = NULL;
-
-        memcpy(config_params, raw_params, sizeof(*raw_params));
-        /*
-         * allocate memory for fault pixel table and copy the user
-         * values to the table
-         */
-        if (!config_params->fault_pxl.enable)
-                return 0;
-
-        fpc_physaddr = (unsigned int *)config_params->fault_pxl.fpc_table_addr;
-        fpc_virtaddr = (unsigned int *)phys_to_virt(
-                                (unsigned long)fpc_physaddr);
-        /*
-         * Allocate memory for FPC table if current
-         * FPC table buffer is not big enough to
-         * accommodate FPC Number requested
-         */
-        if (raw_params->fault_pxl.fp_num != config_params->fault_pxl.fp_num) {
-                if (fpc_physaddr != NULL) {
-                        free_pages((unsigned long)fpc_virtaddr,
-                                   get_order
-                                   (config_params->fault_pxl.fp_num *
-                                   FP_NUM_BYTES));
-                }
-
-                /* Allocate memory for FPC table */
-                fpc_virtaddr =
-                        (unsigned int *)__get_free_pages(GFP_KERNEL | GFP_DMA,
-                                                         get_order(raw_params->
-                                                         fault_pxl.fp_num *
-                                                         FP_NUM_BYTES));
-
-                if (fpc_virtaddr == NULL) {
-                        dev_dbg(ccdc_cfg.dev,
-                                "\nUnable to allocate memory for FPC");
-                        return -EFAULT;
-                }
-                fpc_physaddr =
-                    (unsigned int *)virt_to_phys((void *)fpc_virtaddr);
-        }
-
-        /* Copy number of fault pixels and FPC table */
-        config_params->fault_pxl.fp_num = raw_params->fault_pxl.fp_num;
-        if (copy_from_user(fpc_virtaddr,
-                        (void __user *)raw_params->fault_pxl.fpc_table_addr,
-                        config_params->fault_pxl.fp_num * FP_NUM_BYTES)) {
-                dev_dbg(ccdc_cfg.dev, "\n copy_from_user failed");
-                return -EFAULT;
-        }
-        config_params->fault_pxl.fpc_table_addr = (unsigned long)fpc_physaddr;
-        return 0;
-}
-
 static int ccdc_close(struct device *dev)
 {
-        struct ccdc_config_params_raw *config_params =
-                                &ccdc_cfg.bayer.config_params;
-        unsigned int *fpc_physaddr = NULL, *fpc_virtaddr = NULL;
-
-        fpc_physaddr = (unsigned int *)config_params->fault_pxl.fpc_table_addr;
-
-        if (fpc_physaddr != NULL) {
-                fpc_virtaddr = (unsigned int *)
-                    phys_to_virt((unsigned long)fpc_physaddr);
-                free_pages((unsigned long)fpc_virtaddr,
-                           get_order(config_params->fault_pxl.fp_num *
-                           FP_NUM_BYTES));
-        }
         return 0;
 }
 
@@ -339,29 +247,6 @@ static void ccdc_sbl_reset(void)
         vpss_clear_wbl_overflow(VPSS_PCR_CCDC_WBL_O);
 }
 
-/* Parameter operations */
-static int ccdc_set_params(void __user *params)
-{
-        struct ccdc_config_params_raw ccdc_raw_params;
-        int x;
-
-        if (ccdc_cfg.if_type != VPFE_RAW_BAYER)
-                return -EINVAL;
-
-        x = copy_from_user(&ccdc_raw_params, params, sizeof(ccdc_raw_params));
-        if (x) {
-                dev_dbg(ccdc_cfg.dev, "ccdc_set_params: error in copyingccdc params, %d\n",
-                        x);
-                return -EFAULT;
-        }
-
-        if (!validate_ccdc_param(&ccdc_raw_params)) {
-                if (!ccdc_update_raw_params(&ccdc_raw_params))
-                        return 0;
-        }
-        return -EINVAL;
-}
-
 /*
  * ccdc_config_ycbcr()
  * This function will configure CCDC for YCbCr video capture
@@ -489,32 +374,6 @@ static void ccdc_config_black_compense(struct ccdc_black_compensation *bcomp)
         regw(val, CCDC_BLKCMP);
 }
 
-static void ccdc_config_fpc(struct ccdc_fault_pixel *fpc)
-{
-        u32 val;
-
-        /* Initially disable FPC */
-        val = CCDC_FPC_DISABLE;
-        regw(val, CCDC_FPC);
-
-        if (!fpc->enable)
-                return;
-
-        /* Configure Fault pixel if needed */
-        regw(fpc->fpc_table_addr, CCDC_FPC_ADDR);
-        dev_dbg(ccdc_cfg.dev, "\nWriting 0x%lx to FPC_ADDR...\n",
-                       (fpc->fpc_table_addr));
-        /* Write the FPC params with FPC disable */
-        val = fpc->fp_num & CCDC_FPC_FPC_NUM_MASK;
-        regw(val, CCDC_FPC);
-
-        dev_dbg(ccdc_cfg.dev, "\nWriting 0x%x to FPC...\n", val);
-        /* read the FPC register */
-        val = regr(CCDC_FPC) | CCDC_FPC_ENABLE;
-        regw(val, CCDC_FPC);
-        dev_dbg(ccdc_cfg.dev, "\nWriting 0x%x to FPC...\n", val);
-}
-
 /*
  * ccdc_config_raw()
  * This function will configure CCDC for Raw capture mode
@@ -569,9 +428,6 @@ static void ccdc_config_raw(void)
         /* Configure Black level compensation */
         ccdc_config_black_compense(&config_params->blk_comp);
 
-        /* Configure Fault Pixel Correction */
-        ccdc_config_fpc(&config_params->fault_pxl);
-
         /* If data size is 8 bit then pack the data */
         if ((config_params->data_sz == CCDC_DATA_8BITS) ||
              config_params->alaw.enable)
@@ -929,7 +785,6 @@ static struct ccdc_hw_device ccdc_hw_dev = {
                 .reset = ccdc_sbl_reset,
                 .enable = ccdc_enable,
                 .set_hw_if_params = ccdc_set_hw_if_params,
-                .set_params = ccdc_set_params,
                 .configure = ccdc_configure,
                 .set_buftype = ccdc_set_buftype,
                 .get_buftype = ccdc_get_buftype,
diff --git a/drivers/media/platform/davinci/vpfe_capture.c b/drivers/media/platform/davinci/vpfe_capture.c
index e3fe3e0635aa..b1bf4a7e8eb7 100644
--- a/drivers/media/platform/davinci/vpfe_capture.c
+++ b/drivers/media/platform/davinci/vpfe_capture.c
@@ -281,45 +281,6 @@ void vpfe_unregister_ccdc_device(struct ccdc_hw_device *dev)
 EXPORT_SYMBOL(vpfe_unregister_ccdc_device);
 
 /*
- * vpfe_get_ccdc_image_format - Get image parameters based on CCDC settings
- */
-static int vpfe_get_ccdc_image_format(struct vpfe_device *vpfe_dev,
-                                 struct v4l2_format *f)
-{
-        struct v4l2_rect image_win;
-        enum ccdc_buftype buf_type;
-        enum ccdc_frmfmt frm_fmt;
-
-        memset(f, 0, sizeof(*f));
-        f->type = V4L2_BUF_TYPE_VIDEO_OUTPUT;
-        ccdc_dev->hw_ops.get_image_window(&image_win);
-        f->fmt.pix.width = image_win.width;
-        f->fmt.pix.height = image_win.height;
-        f->fmt.pix.bytesperline = ccdc_dev->hw_ops.get_line_length();
-        f->fmt.pix.sizeimage = f->fmt.pix.bytesperline *
-                                f->fmt.pix.height;
-        buf_type = ccdc_dev->hw_ops.get_buftype();
-        f->fmt.pix.pixelformat = ccdc_dev->hw_ops.get_pixel_format();
-        frm_fmt = ccdc_dev->hw_ops.get_frame_format();
-        if (frm_fmt == CCDC_FRMFMT_PROGRESSIVE)
-                f->fmt.pix.field = V4L2_FIELD_NONE;
-        else if (frm_fmt == CCDC_FRMFMT_INTERLACED) {
-                if (buf_type == CCDC_BUFTYPE_FLD_INTERLEAVED)
-                        f->fmt.pix.field = V4L2_FIELD_INTERLACED;
-                else if (buf_type == CCDC_BUFTYPE_FLD_SEPARATED)
-                        f->fmt.pix.field = V4L2_FIELD_SEQ_TB;
-                else {
-                        v4l2_err(&vpfe_dev->v4l2_dev, "Invalid buf_type\n");
-                        return -EINVAL;
-                }
-        } else {
-                v4l2_err(&vpfe_dev->v4l2_dev, "Invalid frm_fmt\n");
-                return -EINVAL;
-        }
-        return 0;
-}
-
-/*
  * vpfe_config_ccdc_image_format()
  * For a pix format, configure ccdc to setup the capture
  */
@@ -1697,59 +1658,6 @@ unlock_out:
         return ret;
 }
 
-
-static long vpfe_param_handler(struct file *file, void *priv,
-                bool valid_prio, unsigned int cmd, void *param)
-{
-        struct vpfe_device *vpfe_dev = video_drvdata(file);
-        int ret;
-
-        v4l2_dbg(2, debug, &vpfe_dev->v4l2_dev, "vpfe_param_handler\n");
-
-        if (vpfe_dev->started) {
-                /* only allowed if streaming is not started */
-                v4l2_dbg(1, debug, &vpfe_dev->v4l2_dev,
-                        "device already started\n");
-                return -EBUSY;
-        }
-
-        ret = mutex_lock_interruptible(&vpfe_dev->lock);
-        if (ret)
-                return ret;
-
-        switch (cmd) {
-        case VPFE_CMD_S_CCDC_RAW_PARAMS:
-                v4l2_warn(&vpfe_dev->v4l2_dev,
-                          "VPFE_CMD_S_CCDC_RAW_PARAMS: experimental ioctl\n");
-                if (ccdc_dev->hw_ops.set_params) {
-                        ret = ccdc_dev->hw_ops.set_params(param);
-                        if (ret) {
-                                v4l2_dbg(1, debug, &vpfe_dev->v4l2_dev,
-                                        "Error setting parameters in CCDC\n");
-                                goto unlock_out;
-                        }
-                        ret = vpfe_get_ccdc_image_format(vpfe_dev,
-                                                         &vpfe_dev->fmt);
-                        if (ret < 0) {
-                                v4l2_dbg(1, debug, &vpfe_dev->v4l2_dev,
-                                        "Invalid image format at CCDC\n");
-                                goto unlock_out;
-                        }
-                } else {
-                        ret = -EINVAL;
-                        v4l2_dbg(1, debug, &vpfe_dev->v4l2_dev,
-                                "VPFE_CMD_S_CCDC_RAW_PARAMS not supported\n");
-                }
-                break;
-        default:
-                ret = -ENOTTY;
-        }
-unlock_out:
-        mutex_unlock(&vpfe_dev->lock);
-        return ret;
-}
-
-
 /* vpfe capture ioctl operations */
 static const struct v4l2_ioctl_ops vpfe_ioctl_ops = {
         .vidioc_querycap         = vpfe_querycap,
@@ -1772,7 +1680,6 @@ static const struct v4l2_ioctl_ops vpfe_ioctl_ops = {
         .vidioc_cropcap          = vpfe_cropcap,
         .vidioc_g_selection      = vpfe_g_selection,
         .vidioc_s_selection      = vpfe_s_selection,
-        .vidioc_default          = vpfe_param_handler,
 };
 
 static struct vpfe_device *vpfe_initialize(void)
diff --git a/drivers/media/platform/davinci/vpif_capture.c b/drivers/media/platform/davinci/vpif_capture.c
index d78580f9e431..4be6554c56c5 100644
--- a/drivers/media/platform/davinci/vpif_capture.c
+++ b/drivers/media/platform/davinci/vpif_capture.c
@@ -1719,7 +1719,6 @@ vpif_unregister:
  */
 static int vpif_remove(struct platform_device *device)
 {
-        struct common_obj *common;
         struct channel_obj *ch;
         int i;
 
@@ -1730,7 +1729,6 @@ static int vpif_remove(struct platform_device *device)
         for (i = 0; i < VPIF_CAPTURE_MAX_DEVICES; i++) {
                 /* Get the pointer to the channel object */
                 ch = vpif_obj.dev[i];
-                common = &ch->common[VPIF_VIDEO_INDEX];
                 /* Unregister video device */
                 video_unregister_device(&ch->video_dev);
                 kfree(vpif_obj.dev[i]);
diff --git a/drivers/media/platform/davinci/vpif_display.c b/drivers/media/platform/davinci/vpif_display.c
index b5ac6ce626b3..bf982bf86542 100644
--- a/drivers/media/platform/davinci/vpif_display.c
+++ b/drivers/media/platform/davinci/vpif_display.c
@@ -1339,7 +1339,6 @@ vpif_unregister:
  */
 static int vpif_remove(struct platform_device *device)
 {
-        struct common_obj *common;
         struct channel_obj *ch;
         int i;
 
@@ -1350,7 +1349,6 @@ static int vpif_remove(struct platform_device *device)
         for (i = 0; i < VPIF_DISPLAY_MAX_DEVICES; i++) {
                 /* Get the pointer to the channel object */
                 ch = vpif_obj.dev[i];
-                common = &ch->common[VPIF_VIDEO_INDEX];
                 /* Unregister video device */
                 video_unregister_device(&ch->video_dev);
                 kfree(vpif_obj.dev[i]);
diff --git a/drivers/media/platform/omap/omap_vout_vrfb.c b/drivers/media/platform/omap/omap_vout_vrfb.c
index 92c4e1826356..45a553d4f5b2 100644
--- a/drivers/media/platform/omap/omap_vout_vrfb.c
+++ b/drivers/media/platform/omap/omap_vout_vrfb.c
@@ -16,7 +16,6 @@
 #include <media/videobuf-dma-contig.h>
 #include <media/v4l2-device.h>
 
-#include <linux/omap-dma.h>
 #include <video/omapvrfb.h>
 
 #include "omap_voutdef.h"
@@ -63,7 +62,7 @@ static int omap_vout_allocate_vrfb_buffers(struct omap_vout_device *vout,
 /*
  * Wakes up the application once the DMA transfer to VRFB space is completed.
  */
-static void omap_vout_vrfb_dma_tx_callback(int lch, u16 ch_status, void *data)
+static void omap_vout_vrfb_dma_tx_callback(void *data)
 {
         struct vid_vrfb_dma *t = (struct vid_vrfb_dma *) data;
 
@@ -94,6 +93,7 @@ int omap_vout_setup_vrfb_bufs(struct platform_device *pdev, int vid_num,
         int ret = 0, i, j;
         struct omap_vout_device *vout;
         struct video_device *vfd;
+        dma_cap_mask_t mask;
         int image_width, image_height;
         int vrfb_num_bufs = VRFB_NUM_BUFS;
         struct v4l2_device *v4l2_dev = platform_get_drvdata(pdev);
@@ -131,18 +131,27 @@ int omap_vout_setup_vrfb_bufs(struct platform_device *pdev, int vid_num,
         /*
          * Request and Initialize DMA, for DMA based VRFB transfer
          */
-        vout->vrfb_dma_tx.dev_id = OMAP_DMA_NO_DEVICE;
-        vout->vrfb_dma_tx.dma_ch = -1;
-        vout->vrfb_dma_tx.req_status = DMA_CHAN_ALLOTED;
-        ret = omap_request_dma(vout->vrfb_dma_tx.dev_id, "VRFB DMA TX",
-                        omap_vout_vrfb_dma_tx_callback,
-                        (void *) &vout->vrfb_dma_tx, &vout->vrfb_dma_tx.dma_ch);
-        if (ret < 0) {
+        dma_cap_zero(mask);
+        dma_cap_set(DMA_INTERLEAVE, mask);
+        vout->vrfb_dma_tx.chan = dma_request_chan_by_mask(&mask);
+        if (IS_ERR(vout->vrfb_dma_tx.chan)) {
                 vout->vrfb_dma_tx.req_status = DMA_CHAN_NOT_ALLOTED;
+        } else {
+                size_t xt_size = sizeof(struct dma_interleaved_template) +
+                                 sizeof(struct data_chunk);
+
+                vout->vrfb_dma_tx.xt = kzalloc(xt_size, GFP_KERNEL);
+                if (!vout->vrfb_dma_tx.xt) {
+                        dma_release_channel(vout->vrfb_dma_tx.chan);
+                        vout->vrfb_dma_tx.req_status = DMA_CHAN_NOT_ALLOTED;
+                }
+        }
+
+        if (vout->vrfb_dma_tx.req_status == DMA_CHAN_NOT_ALLOTED)
                 dev_info(&pdev->dev,
                          ": failed to allocate DMA Channel for video%d\n",
                          vfd->minor);
-        }
+
         init_waitqueue_head(&vout->vrfb_dma_tx.wait);
 
         /* statically allocated the VRFB buffer is done through
@@ -177,7 +186,9 @@ void omap_vout_release_vrfb(struct omap_vout_device *vout)
 
         if (vout->vrfb_dma_tx.req_status == DMA_CHAN_ALLOTED) {
                 vout->vrfb_dma_tx.req_status = DMA_CHAN_NOT_ALLOTED;
-                omap_free_dma(vout->vrfb_dma_tx.dma_ch);
+                kfree(vout->vrfb_dma_tx.xt);
+                dmaengine_terminate_sync(vout->vrfb_dma_tx.chan);
+                dma_release_channel(vout->vrfb_dma_tx.chan);
         }
 }
 
@@ -219,70 +230,84 @@ int omap_vout_vrfb_buffer_setup(struct omap_vout_device *vout,
 }
 
 int omap_vout_prepare_vrfb(struct omap_vout_device *vout,
-                                struct videobuf_buffer *vb)
+                           struct videobuf_buffer *vb)
 {
-        dma_addr_t dmabuf;
-        struct vid_vrfb_dma *tx;
+        struct dma_async_tx_descriptor *tx;
+        enum dma_ctrl_flags flags;
+        struct dma_chan *chan = vout->vrfb_dma_tx.chan;
+        struct dma_device *dmadev = chan->device;
+        struct dma_interleaved_template *xt = vout->vrfb_dma_tx.xt;
+        dma_cookie_t cookie;
+        enum dma_status status;
         enum dss_rotation rotation;
-        u32 dest_frame_index = 0, src_element_index = 0;
-        u32 dest_element_index = 0, src_frame_index = 0;
-        u32 elem_count = 0, frame_count = 0, pixsize = 2;
+        size_t dst_icg;
+        u32 pixsize;
 
         if (!is_rotation_enabled(vout))
                 return 0;
 
-        dmabuf = vout->buf_phy_addr[vb->i];
         /* If rotation is enabled, copy input buffer into VRFB
          * memory space using DMA. We are copying input buffer
          * into VRFB memory space of desired angle and DSS will
          * read image VRFB memory for 0 degree angle
          */
+
         pixsize = vout->bpp * vout->vrfb_bpp;
-        /*
-         * DMA transfer in double index mode
-         */
+        dst_icg = ((MAX_PIXELS_PER_LINE * pixsize) -
+                  (vout->pix.width * vout->bpp)) + 1;
+
+        xt->src_start = vout->buf_phy_addr[vb->i];
+        xt->dst_start = vout->vrfb_context[vb->i].paddr[0];
+
+        xt->numf = vout->pix.height;
+        xt->frame_size = 1;
+        xt->sgl[0].size = vout->pix.width * vout->bpp;
+        xt->sgl[0].icg = dst_icg;
+
+        xt->dir = DMA_MEM_TO_MEM;
+        xt->src_sgl = false;
+        xt->src_inc = true;
+        xt->dst_sgl = true;
+        xt->dst_inc = true;
+
+        tx = dmadev->device_prep_interleaved_dma(chan, xt, flags);
+        if (tx == NULL) {
+                pr_err("%s: DMA interleaved prep error\n", __func__);
+                return -EINVAL;
+        }
 
-        /* Frame index */
-        dest_frame_index = ((MAX_PIXELS_PER_LINE * pixsize) -
-                        (vout->pix.width * vout->bpp)) + 1;
-
-        /* Source and destination parameters */
-        src_element_index = 0;
-        src_frame_index = 0;
-        dest_element_index = 1;
-        /* Number of elements per frame */
-        elem_count = vout->pix.width * vout->bpp;
-        frame_count = vout->pix.height;
-        tx = &vout->vrfb_dma_tx;
-        tx->tx_status = 0;
-        omap_set_dma_transfer_params(tx->dma_ch, OMAP_DMA_DATA_TYPE_S32,
-                        (elem_count / 4), frame_count, OMAP_DMA_SYNC_ELEMENT,
-                        tx->dev_id, 0x0);
-        /* src_port required only for OMAP1 */
-        omap_set_dma_src_params(tx->dma_ch, 0, OMAP_DMA_AMODE_POST_INC,
-                        dmabuf, src_element_index, src_frame_index);
-        /*set dma source burst mode for VRFB */
-        omap_set_dma_src_burst_mode(tx->dma_ch, OMAP_DMA_DATA_BURST_16);
-        rotation = calc_rotation(vout);
+        tx->callback = omap_vout_vrfb_dma_tx_callback;
+        tx->callback_param = &vout->vrfb_dma_tx;
+
+        cookie = dmaengine_submit(tx);
+        if (dma_submit_error(cookie)) {
+                pr_err("%s: dmaengine_submit failed (%d)\n", __func__, cookie);
+                return -EINVAL;
+        }
 
-        /* dest_port required only for OMAP1 */
-        omap_set_dma_dest_params(tx->dma_ch, 0, OMAP_DMA_AMODE_DOUBLE_IDX,
-                        vout->vrfb_context[vb->i].paddr[0], dest_element_index,
-                        dest_frame_index);
-        /*set dma dest burst mode for VRFB */
-        omap_set_dma_dest_burst_mode(tx->dma_ch, OMAP_DMA_DATA_BURST_16);
-        omap_dma_set_global_params(DMA_DEFAULT_ARB_RATE, 0x20, 0);
+        vout->vrfb_dma_tx.tx_status = 0;
+        dma_async_issue_pending(chan);
 
-        omap_start_dma(tx->dma_ch);
-        wait_event_interruptible_timeout(tx->wait, tx->tx_status == 1,
+        wait_event_interruptible_timeout(vout->vrfb_dma_tx.wait,
+                                         vout->vrfb_dma_tx.tx_status == 1,
                                          VRFB_TX_TIMEOUT);
 
-        if (tx->tx_status == 0) {
-                omap_stop_dma(tx->dma_ch);
+        status = dma_async_is_tx_complete(chan, cookie, NULL, NULL);
+
+        if (vout->vrfb_dma_tx.tx_status == 0) {
+                pr_err("%s: Timeout while waiting for DMA\n", __func__);
+                dmaengine_terminate_sync(chan);
+                return -EINVAL;
+        } else if (status != DMA_COMPLETE) {
+                pr_err("%s: DMA completion %s status\n", __func__,
+                       status == DMA_ERROR ? "error" : "busy");
+                dmaengine_terminate_sync(chan);
                 return -EINVAL;
         }
+
         /* Store buffers physical address into an array. Addresses
          * from this array will be used to configure DSS */
+        rotation = calc_rotation(vout);
         vout->queued_buf_addr[vb->i] = (u8 *)
                 vout->vrfb_context[vb->i].paddr[rotation];
         return 0;
diff --git a/drivers/media/platform/omap/omap_voutdef.h b/drivers/media/platform/omap/omap_voutdef.h
index 80c79fabdf95..56b630b1c8b4 100644
--- a/drivers/media/platform/omap/omap_voutdef.h
+++ b/drivers/media/platform/omap/omap_voutdef.h
@@ -14,6 +14,7 @@
 #include <media/v4l2-ctrls.h>
 #include <video/omapfb_dss.h>
 #include <video/omapvrfb.h>
+#include <linux/dmaengine.h>
 
 #define YUYV_BPP        2
 #define RGB565_BPP      2
@@ -81,8 +82,9 @@ enum vout_rotaion_type {
  * for VRFB hidden buffer
  */
 struct vid_vrfb_dma {
-        int dev_id;
-        int dma_ch;
+        struct dma_chan *chan;
+        struct dma_interleaved_template *xt;
+
         int req_status;
         int tx_status;
         wait_queue_head_t wait;
diff --git a/drivers/media/platform/qcom/venus/core.c b/drivers/media/platform/qcom/venus/core.c
index 776d2bae6979..41eef376eb2d 100644
--- a/drivers/media/platform/qcom/venus/core.c
+++ b/drivers/media/platform/qcom/venus/core.c
@@ -76,7 +76,7 @@ static void venus_sys_error_handler(struct work_struct *work)
         hfi_core_deinit(core, true);
         hfi_destroy(core);
         mutex_lock(&core->lock);
-        venus_shutdown(&core->dev_fw);
+        venus_shutdown(core->dev);
 
         pm_runtime_put_sync(core->dev);
 
@@ -84,7 +84,7 @@ static void venus_sys_error_handler(struct work_struct *work)
 
         pm_runtime_get_sync(core->dev);
 
-        ret |= venus_boot(core->dev, &core->dev_fw, core->res->fwname);
+        ret |= venus_boot(core->dev, core->res->fwname);
 
         ret |= hfi_core_resume(core, true);
 
@@ -137,7 +137,7 @@ static int venus_clks_enable(struct venus_core *core)
 
         return 0;
 err:
-        while (--i)
+        while (i--)
                 clk_disable_unprepare(core->clks[i]);
 
         return ret;
@@ -207,7 +207,7 @@ static int venus_probe(struct platform_device *pdev)
         if (ret < 0)
                 goto err_runtime_disable;
 
-        ret = venus_boot(dev, &core->dev_fw, core->res->fwname);
+        ret = venus_boot(dev, core->res->fwname);
         if (ret)
                 goto err_runtime_disable;
 
@@ -238,7 +238,7 @@ err_dev_unregister:
 err_core_deinit:
         hfi_core_deinit(core, false);
 err_venus_shutdown:
-        venus_shutdown(&core->dev_fw);
+        venus_shutdown(dev);
 err_runtime_disable:
         pm_runtime_set_suspended(dev);
         pm_runtime_disable(dev);
@@ -259,7 +259,7 @@ static int venus_remove(struct platform_device *pdev)
         WARN_ON(ret);
 
         hfi_destroy(core);
-        venus_shutdown(&core->dev_fw);
+        venus_shutdown(dev);
         of_platform_depopulate(dev);
 
         pm_runtime_put_sync(dev);
@@ -270,8 +270,7 @@ static int venus_remove(struct platform_device *pdev)
         return ret;
 }
 
-#ifdef CONFIG_PM
-static int venus_runtime_suspend(struct device *dev)
+static __maybe_unused int venus_runtime_suspend(struct device *dev)
 {
         struct venus_core *core = dev_get_drvdata(dev);
         int ret;
@@ -283,7 +282,7 @@ static int venus_runtime_suspend(struct device *dev)
         return ret;
 }
 
-static int venus_runtime_resume(struct device *dev)
+static __maybe_unused int venus_runtime_resume(struct device *dev)
 {
         struct venus_core *core = dev_get_drvdata(dev);
         int ret;
@@ -302,7 +301,6 @@ err_clks_disable:
         venus_clks_disable(core);
         return ret;
 }
-#endif
 
 static const struct dev_pm_ops venus_pm_ops = {
         SET_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend,
diff --git a/drivers/media/platform/qcom/venus/core.h b/drivers/media/platform/qcom/venus/core.h
index e542700eee32..cba092bcb76d 100644
--- a/drivers/media/platform/qcom/venus/core.h
+++ b/drivers/media/platform/qcom/venus/core.h
@@ -101,7 +101,6 @@ struct venus_core {
         struct device *dev;
         struct device *dev_dec;
         struct device *dev_enc;
-        struct device dev_fw;
         struct mutex lock;
         struct list_head instances;
         atomic_t insts_count;
diff --git a/drivers/media/platform/qcom/venus/firmware.c b/drivers/media/platform/qcom/venus/firmware.c
index 1b1a4f355918..521d4b36c090 100644
--- a/drivers/media/platform/qcom/venus/firmware.c
+++ b/drivers/media/platform/qcom/venus/firmware.c
@@ -12,97 +12,87 @@
  *
  */
 
-#include <linux/dma-mapping.h>
+#include <linux/device.h>
 #include <linux/firmware.h>
 #include <linux/kernel.h>
+#include <linux/io.h>
 #include <linux/of.h>
-#include <linux/of_reserved_mem.h>
-#include <linux/slab.h>
+#include <linux/of_address.h>
 #include <linux/qcom_scm.h>
+#include <linux/sizes.h>
 #include <linux/soc/qcom/mdt_loader.h>
 
 #include "firmware.h"
 
 #define VENUS_PAS_ID                    9
-#define VENUS_FW_MEM_SIZE               SZ_8M
+#define VENUS_FW_MEM_SIZE               (6 * SZ_1M)
 
-static void device_release_dummy(struct device *dev)
-{
-        of_reserved_mem_device_release(dev);
-}
-
-int venus_boot(struct device *parent, struct device *fw_dev, const char *fwname)
+int venus_boot(struct device *dev, const char *fwname)
 {
         const struct firmware *mdt;
+        struct device_node *node;
         phys_addr_t mem_phys;
+        struct resource r;
         ssize_t fw_size;
         size_t mem_size;
         void *mem_va;
         int ret;
 
-        if (!qcom_scm_is_available())
+        if (!IS_ENABLED(CONFIG_QCOM_MDT_LOADER) || !qcom_scm_is_available())
                 return -EPROBE_DEFER;
 
-        fw_dev->parent = parent;
-        fw_dev->release = device_release_dummy;
+        node = of_parse_phandle(dev->of_node, "memory-region", 0);
+        if (!node) {
+                dev_err(dev, "no memory-region specified\n");
+                return -EINVAL;
+        }
 
-        ret = dev_set_name(fw_dev, "%s:%s", dev_name(parent), "firmware");
+        ret = of_address_to_resource(node, 0, &r);
         if (ret)
                 return ret;
 
-        ret = device_register(fw_dev);
-        if (ret < 0)
-                return ret;
+        mem_phys = r.start;
+        mem_size = resource_size(&r);
 
-        ret = of_reserved_mem_device_init_by_idx(fw_dev, parent->of_node, 0);
-        if (ret)
-                goto err_unreg_device;
+        if (mem_size < VENUS_FW_MEM_SIZE)
+                return -EINVAL;
 
-        mem_size = VENUS_FW_MEM_SIZE;
-
-        mem_va = dmam_alloc_coherent(fw_dev, mem_size, &mem_phys, GFP_KERNEL);
+        mem_va = memremap(r.start, mem_size, MEMREMAP_WC);
         if (!mem_va) {
-                ret = -ENOMEM;
-                goto err_unreg_device;
+                dev_err(dev, "unable to map memory region: %pa+%zx\n",
+                        &r.start, mem_size);
+                return -ENOMEM;
         }
 
-        ret = request_firmware(&mdt, fwname, fw_dev);
+        ret = request_firmware(&mdt, fwname, dev);
         if (ret < 0)
-                goto err_unreg_device;
+                goto err_unmap;
 
         fw_size = qcom_mdt_get_size(mdt);
         if (fw_size < 0) {
                 ret = fw_size;
                 release_firmware(mdt);
-                goto err_unreg_device;
+                goto err_unmap;
         }
 
-        ret = qcom_mdt_load(fw_dev, mdt, fwname, VENUS_PAS_ID, mem_va, mem_phys,
+        ret = qcom_mdt_load(dev, mdt, fwname, VENUS_PAS_ID, mem_va, mem_phys,
                             mem_size);
 
         release_firmware(mdt);
 
         if (ret)
-                goto err_unreg_device;
+                goto err_unmap;
 
         ret = qcom_scm_pas_auth_and_reset(VENUS_PAS_ID);
         if (ret)
-                goto err_unreg_device;
-
-        return 0;
+                goto err_unmap;
 
-err_unreg_device:
-        device_unregister(fw_dev);
+err_unmap:
+        memunmap(mem_va);
         return ret;
 }
 
-int venus_shutdown(struct device *fw_dev)
+int venus_shutdown(struct device *dev)
 {
-        int ret;
-
-        ret = qcom_scm_pas_shutdown(VENUS_PAS_ID);
-        device_unregister(fw_dev);
-        memset(fw_dev, 0, sizeof(*fw_dev));
-
-        return ret;
+        return qcom_scm_pas_shutdown(VENUS_PAS_ID);
 }
diff --git a/drivers/media/platform/qcom/venus/firmware.h b/drivers/media/platform/qcom/venus/firmware.h
index f81a98979798..428efb56d339 100644
--- a/drivers/media/platform/qcom/venus/firmware.h
+++ b/drivers/media/platform/qcom/venus/firmware.h
@@ -16,8 +16,7 @@
 
 struct device;
 
-int venus_boot(struct device *parent, struct device *fw_dev,
-               const char *fwname);
-int venus_shutdown(struct device *fw_dev);
+int venus_boot(struct device *dev, const char *fwname);
+int venus_shutdown(struct device *dev);
 
 #endif
diff --git a/drivers/media/platform/qcom/venus/hfi_msgs.c b/drivers/media/platform/qcom/venus/hfi_msgs.c
index f8841713e417..a681ae5381d6 100644
--- a/drivers/media/platform/qcom/venus/hfi_msgs.c
+++ b/drivers/media/platform/qcom/venus/hfi_msgs.c
@@ -239,11 +239,12 @@ static void hfi_sys_init_done(struct venus_core *core, struct venus_inst *inst,
                         break;
                 }
 
-                if (!error) {
-                        rem_bytes -= read_bytes;
-                        data += read_bytes;
-                        num_properties--;
-                }
+                if (error)
+                        break;
+
+                rem_bytes -= read_bytes;
+                data += read_bytes;
+                num_properties--;
         }
 
 err_no_prop:
diff --git a/drivers/media/platform/sti/bdisp/bdisp-debug.c b/drivers/media/platform/sti/bdisp/bdisp-debug.c
index 7af66860d624..2cc289e4dea1 100644
--- a/drivers/media/platform/sti/bdisp/bdisp-debug.c
+++ b/drivers/media/platform/sti/bdisp/bdisp-debug.c
@@ -104,7 +104,7 @@ static void bdisp_dbg_dump_ins(struct seq_file *s, u32 val)
         if (val & BLT_INS_IRQ)
                 seq_puts(s, "IRQ - ");
 
-        seq_puts(s, "\n");
+        seq_putc(s, '\n');
 }
 
 static void bdisp_dbg_dump_tty(struct seq_file *s, u32 val)
@@ -153,7 +153,7 @@ static void bdisp_dbg_dump_tty(struct seq_file *s, u32 val)
         if (val & BLT_TTY_BIG_END)
                 seq_puts(s, "BigEndian - ");
 
-        seq_puts(s, "\n");
+        seq_putc(s, '\n');
 }
 
 static void bdisp_dbg_dump_xy(struct seq_file *s, u32 val, char *name)
@@ -230,7 +230,7 @@ static void bdisp_dbg_dump_sty(struct seq_file *s,
                 seq_puts(s, "BigEndian - ");
 
 done:
-        seq_puts(s, "\n");
+        seq_putc(s, '\n');
 }
 
 static void bdisp_dbg_dump_fctl(struct seq_file *s, u32 val)
@@ -247,7 +247,7 @@ static void bdisp_dbg_dump_fctl(struct seq_file *s, u32 val)
         else if ((val & BLT_FCTL_HV_SCALE) == BLT_FCTL_HV_SAMPLE)
                 seq_puts(s, "Sample Chroma");
 
-        seq_puts(s, "\n");
+        seq_putc(s, '\n');
 }
 
 static void bdisp_dbg_dump_rsf(struct seq_file *s, u32 val, char *name)
@@ -266,7 +266,7 @@ static void bdisp_dbg_dump_rsf(struct seq_file *s, u32 val, char *name)
         seq_printf(s, "V: %d(6.10) / scale~%dx0.1", inc, 1024 * 10 / inc);
 
 done:
-        seq_puts(s, "\n");
+        seq_putc(s, '\n');
 }
 
 static void bdisp_dbg_dump_rzi(struct seq_file *s, u32 val, char *name)
@@ -281,7 +281,7 @@ static void bdisp_dbg_dump_rzi(struct seq_file *s, u32 val, char *name)
         seq_printf(s, "V: init=%d repeat=%d", val & 0x3FF, (val >> 12) & 7);
 
 done:
-        seq_puts(s, "\n");
+        seq_putc(s, '\n');
 }
 
 static void bdisp_dbg_dump_ivmx(struct seq_file *s,
@@ -293,7 +293,7 @@ static void bdisp_dbg_dump_ivmx(struct seq_file *s,
         seq_printf(s, "IVMX3\t0x%08X\t", c3);
 
         if (!c0 && !c1 && !c2 && !c3) {
-                seq_puts(s, "\n");
+                seq_putc(s, '\n');
                 return;
         }
 
diff --git a/drivers/media/platform/vimc/vimc-capture.c b/drivers/media/platform/vimc/vimc-capture.c
index 14cb32e21130..88a1e5670c72 100644
--- a/drivers/media/platform/vimc/vimc-capture.c
+++ b/drivers/media/platform/vimc/vimc-capture.c
@@ -517,21 +517,22 @@ static int vimc_cap_remove(struct platform_device *pdev)
         return 0;
 }
 
+static const struct platform_device_id vimc_cap_driver_ids[] = {
+        {
+                .name           = VIMC_CAP_DRV_NAME,
+        },
+        { }
+};
+
 static struct platform_driver vimc_cap_pdrv = {
         .probe          = vimc_cap_probe,
         .remove         = vimc_cap_remove,
+        .id_table       = vimc_cap_driver_ids,
         .driver         = {
                 .name   = VIMC_CAP_DRV_NAME,
         },
 };
 
-static const struct platform_device_id vimc_cap_driver_ids[] = {
-        {
-                .name           = VIMC_CAP_DRV_NAME,
-        },
-        { }
-};
-
 module_platform_driver(vimc_cap_pdrv);
 
 MODULE_DEVICE_TABLE(platform, vimc_cap_driver_ids);
diff --git a/drivers/media/platform/vimc/vimc-debayer.c b/drivers/media/platform/vimc/vimc-debayer.c
index 35b15bd4d61d..033a131f67af 100644
--- a/drivers/media/platform/vimc/vimc-debayer.c
+++ b/drivers/media/platform/vimc/vimc-debayer.c
@@ -577,21 +577,22 @@ static int vimc_deb_remove(struct platform_device *pdev)
         return 0;
 }
 
+static const struct platform_device_id vimc_deb_driver_ids[] = {
+        {
+                .name           = VIMC_DEB_DRV_NAME,
+        },
+        { }
+};
+
 static struct platform_driver vimc_deb_pdrv = {
         .probe          = vimc_deb_probe,
         .remove         = vimc_deb_remove,
+        .id_table       = vimc_deb_driver_ids,
         .driver         = {
                 .name   = VIMC_DEB_DRV_NAME,
         },
 };
 
-static const struct platform_device_id vimc_deb_driver_ids[] = {
-        {
-                .name           = VIMC_DEB_DRV_NAME,
-        },
-        { }
-};
-
 module_platform_driver(vimc_deb_pdrv);
 
 MODULE_DEVICE_TABLE(platform, vimc_deb_driver_ids);
diff --git a/drivers/media/platform/vimc/vimc-scaler.c b/drivers/media/platform/vimc/vimc-scaler.c
index fe77505d2679..0a3e086e12f3 100644
--- a/drivers/media/platform/vimc/vimc-scaler.c
+++ b/drivers/media/platform/vimc/vimc-scaler.c
@@ -431,21 +431,22 @@ static int vimc_sca_remove(struct platform_device *pdev)
         return 0;
 }
 
+static const struct platform_device_id vimc_sca_driver_ids[] = {
+        {
+                .name           = VIMC_SCA_DRV_NAME,
+        },
+        { }
+};
+
 static struct platform_driver vimc_sca_pdrv = {
         .probe          = vimc_sca_probe,
         .remove         = vimc_sca_remove,
+        .id_table       = vimc_sca_driver_ids,
         .driver         = {
                 .name   = VIMC_SCA_DRV_NAME,
         },
 };
 
-static const struct platform_device_id vimc_sca_driver_ids[] = {
-        {
-                .name           = VIMC_SCA_DRV_NAME,
-        },
-        { }
-};
-
 module_platform_driver(vimc_sca_pdrv);
 
 MODULE_DEVICE_TABLE(platform, vimc_sca_driver_ids);
diff --git a/drivers/media/platform/vimc/vimc-sensor.c b/drivers/media/platform/vimc/vimc-sensor.c
index ebdbbe8c05ed..615c2b18dcfc 100644
--- a/drivers/media/platform/vimc/vimc-sensor.c
+++ b/drivers/media/platform/vimc/vimc-sensor.c
@@ -365,21 +365,22 @@ static int vimc_sen_remove(struct platform_device *pdev)
         return 0;
 }
 
+static const struct platform_device_id vimc_sen_driver_ids[] = {
+        {
+                .name           = VIMC_SEN_DRV_NAME,
+        },
+        { }
+};
+
 static struct platform_driver vimc_sen_pdrv = {
         .probe          = vimc_sen_probe,
         .remove         = vimc_sen_remove,
+        .id_table       = vimc_sen_driver_ids,
         .driver         = {
                 .name   = VIMC_SEN_DRV_NAME,
         },
 };
 
-static const struct platform_device_id vimc_sen_driver_ids[] = {
-        {
-                .name           = VIMC_SEN_DRV_NAME,
-        },
-        { }
-};
-
 module_platform_driver(vimc_sen_pdrv);
 
 MODULE_DEVICE_TABLE(platform, vimc_sen_driver_ids);
diff --git a/drivers/media/radio/radio-wl1273.c b/drivers/media/radio/radio-wl1273.c
index 7240223dc15a..17e82a9a0109 100644
--- a/drivers/media/radio/radio-wl1273.c
+++ b/drivers/media/radio/radio-wl1273.c
@@ -610,10 +610,21 @@ static int wl1273_fm_start(struct wl1273_device *radio, int new_mode)
                         }
                 }
 
-                if (radio->rds_on)
+                if (radio->rds_on) {
                         r = core->write(core, WL1273_RDS_DATA_ENB, 1);
-                else
+                        if (r) {
+                                dev_err(dev, "%s: RDS_DATA_ENB ON fails\n",
+                                        __func__);
+                                goto fail;
+                        }
+                } else {
                         r = core->write(core, WL1273_RDS_DATA_ENB, 0);
+                        if (r) {
+                                dev_err(dev, "%s: RDS_DATA_ENB OFF fails\n",
+                                        __func__);
+                                goto fail;
+                        }
+                }
         } else {
                 dev_warn(dev, "%s: Illegal mode.\n", __func__);
         }
diff --git a/drivers/media/rc/ir-lirc-codec.c b/drivers/media/rc/ir-lirc-codec.c
index a30af91710fe..d2223c04e9ad 100644
--- a/drivers/media/rc/ir-lirc-codec.c
+++ b/drivers/media/rc/ir-lirc-codec.c
@@ -266,7 +266,7 @@ static long ir_lirc_ioctl(struct file *filep, unsigned int cmd,
                 if (!dev->rx_resolution)
                         return -ENOTTY;
 
-                val = dev->rx_resolution;
+                val = dev->rx_resolution / 1000;
                 break;
 
         case LIRC_SET_WIDEBAND_RECEIVER:
diff --git a/drivers/media/tuners/fc0011.c b/drivers/media/tuners/fc0011.c
index 192b1c7740df..145407dee3db 100644
--- a/drivers/media/tuners/fc0011.c
+++ b/drivers/media/tuners/fc0011.c
@@ -342,6 +342,7 @@ static int fc0011_set_params(struct dvb_frontend *fe)
         switch (vco_sel) {
         default:
                 WARN_ON(1);
+                return -EINVAL;
         case 0:
                 if (vco_cal < 8) {
                         regs[FC11_REG_VCOSEL] &= ~(FC11_VCOSEL_1 | FC11_VCOSEL_2);
diff --git a/drivers/media/tuners/mxl5005s.c b/drivers/media/tuners/mxl5005s.c
index 353744fee053..dd59c2c0e4a5 100644
--- a/drivers/media/tuners/mxl5005s.c
+++ b/drivers/media/tuners/mxl5005s.c
@@ -2737,8 +2737,6 @@ static u16 MXL_TuneRF(struct dvb_frontend *fe, u32 RF_Freq)
                 status += MXL_ControlWrite(fe, TG_LO_DIVVAL,    0x0);
                 status += MXL_ControlWrite(fe, TG_LO_SELVAL,    0x7);
                 divider_val = 2 ;
-                Fmax = FmaxBin ;
-                Fmin = FminBin ;
         }
 
         /* TG_DIV_VAL */
diff --git a/drivers/media/usb/au0828/au0828-input.c b/drivers/media/usb/au0828/au0828-input.c
index 9ec919c68482..9d82ec0a4b64 100644
--- a/drivers/media/usb/au0828/au0828-input.c
+++ b/drivers/media/usb/au0828/au0828-input.c
@@ -351,7 +351,7 @@ int au0828_rc_register(struct au0828_dev *dev)
         if (err)
                 goto error;
 
-        pr_info("Remote controller %s initalized\n", ir->name);
+        pr_info("Remote controller %s initialized\n", ir->name);
 
         return 0;
 
diff --git a/drivers/media/usb/dvb-usb-v2/lmedm04.c b/drivers/media/usb/dvb-usb-v2/lmedm04.c
index 594360a63c18..a91fdad8f8d4 100644
--- a/drivers/media/usb/dvb-usb-v2/lmedm04.c
+++ b/drivers/media/usb/dvb-usb-v2/lmedm04.c
@@ -207,15 +207,13 @@ static int lme2510_stream_restart(struct dvb_usb_device *d)
         struct lme2510_state *st = d->priv;
         u8 all_pids[] = LME_ALL_PIDS;
         u8 stream_on[] = LME_ST_ON_W;
-        int ret;
         u8 rbuff[1];
         if (st->pid_off)
-                ret = lme2510_usb_talk(d, all_pids, sizeof(all_pids),
-                        rbuff, sizeof(rbuff));
+                lme2510_usb_talk(d, all_pids, sizeof(all_pids),
+                                 rbuff, sizeof(rbuff));
         /*Restart Stream Command*/
-        ret = lme2510_usb_talk(d, stream_on, sizeof(stream_on),
-                        rbuff, sizeof(rbuff));
-        return ret;
+        return lme2510_usb_talk(d, stream_on, sizeof(stream_on),
+                                rbuff, sizeof(rbuff));
 }
 
 static int lme2510_enable_pid(struct dvb_usb_device *d, u8 index, u16 pid_out)
diff --git a/drivers/media/usb/dvb-usb/dib0700_core.c b/drivers/media/usb/dvb-usb/dib0700_core.c
index 08acdd32e412..bea1b4764a66 100644
--- a/drivers/media/usb/dvb-usb/dib0700_core.c
+++ b/drivers/media/usb/dvb-usb/dib0700_core.c
@@ -215,13 +215,14 @@ static int dib0700_i2c_xfer_new(struct i2c_adapter *adap, struct i2c_msg *msg,
                                                  USB_CTRL_GET_TIMEOUT);
                         if (result < 0) {
                                 deb_info("i2c read error (status = %d)\n", result);
-                                break;
+                                goto unlock;
                         }
 
                         if (msg[i].len > sizeof(st->buf)) {
                                 deb_info("buffer too small to fit %d bytes\n",
                                          msg[i].len);
-                                return -EIO;
+                                result = -EIO;
+                                goto unlock;
                         }
 
                         memcpy(msg[i].buf, st->buf, msg[i].len);
@@ -233,8 +234,8 @@ static int dib0700_i2c_xfer_new(struct i2c_adapter *adap, struct i2c_msg *msg,
                         /* Write request */
                         if (mutex_lock_interruptible(&d->usb_mutex) < 0) {
                                 err("could not acquire lock");
-                                mutex_unlock(&d->i2c_mutex);
-                                return -EINTR;
+                                result = -EINTR;
+                                goto unlock;
                         }
                         st->buf[0] = REQUEST_NEW_I2C_WRITE;
                         st->buf[1] = msg[i].addr << 1;
@@ -247,7 +248,9 @@ static int dib0700_i2c_xfer_new(struct i2c_adapter *adap, struct i2c_msg *msg,
                         if (msg[i].len > sizeof(st->buf) - 4) {
                                 deb_info("i2c message to big: %d\n",
                                          msg[i].len);
-                                return -EIO;
+                                mutex_unlock(&d->usb_mutex);
+                                result = -EIO;
+                                goto unlock;
                         }
 
                         /* The Actual i2c payload */
@@ -269,8 +272,11 @@ static int dib0700_i2c_xfer_new(struct i2c_adapter *adap, struct i2c_msg *msg,
                         }
                 }
         }
+        result = i;
+
+unlock:
         mutex_unlock(&d->i2c_mutex);
-        return i;
+        return result;
 }
 
 /*
@@ -281,7 +287,7 @@ static int dib0700_i2c_xfer_legacy(struct i2c_adapter *adap,
 {
         struct dvb_usb_device *d = i2c_get_adapdata(adap);
         struct dib0700_state *st = d->priv;
-        int i,len;
+        int i, len, result;
 
         if (mutex_lock_interruptible(&d->i2c_mutex) < 0)
                 return -EINTR;
@@ -298,7 +304,8 @@ static int dib0700_i2c_xfer_legacy(struct i2c_adapter *adap,
                 if (msg[i].len > sizeof(st->buf) - 2) {
                         deb_info("i2c xfer to big: %d\n",
                                 msg[i].len);
-                        return -EIO;
+                        result = -EIO;
+                        goto unlock;
                 }
                 memcpy(&st->buf[2], msg[i].buf, msg[i].len);
 
@@ -313,13 +320,15 @@ static int dib0700_i2c_xfer_legacy(struct i2c_adapter *adap,
                         if (len <= 0) {
                                 deb_info("I2C read failed on address 0x%02x\n",
                                                 msg[i].addr);
-                                break;
+                                result = -EIO;
+                                goto unlock;
                         }
 
                         if (msg[i + 1].len > sizeof(st->buf)) {
                                 deb_info("i2c xfer buffer to small for %d\n",
                                         msg[i].len);
-                                return -EIO;
+                                result = -EIO;
+                                goto unlock;
                         }
                         memcpy(msg[i + 1].buf, st->buf, msg[i + 1].len);
 
@@ -328,14 +337,17 @@ static int dib0700_i2c_xfer_legacy(struct i2c_adapter *adap,
                         i++;
                 } else {
                         st->buf[0] = REQUEST_I2C_WRITE;
-                        if (dib0700_ctrl_wr(d, st->buf, msg[i].len + 2) < 0)
-                                break;
+                        result = dib0700_ctrl_wr(d, st->buf, msg[i].len + 2);
+                        if (result < 0)
+                                goto unlock;
                 }
         }
+        result = i;
+unlock:
         mutex_unlock(&d->usb_mutex);
         mutex_unlock(&d->i2c_mutex);
 
-        return i;
+        return result;
 }
 
 static int dib0700_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg *msg,
diff --git a/drivers/media/usb/em28xx/em28xx-cards.c b/drivers/media/usb/em28xx/em28xx-cards.c
index 146341aeb782..4c57fd7929cb 100644
--- a/drivers/media/usb/em28xx/em28xx-cards.c
+++ b/drivers/media/usb/em28xx/em28xx-cards.c
@@ -1193,6 +1193,22 @@ struct em28xx_board em28xx_boards[] = {
                 .i2c_speed    = EM28XX_I2C_CLK_WAIT_ENABLE |
                                 EM28XX_I2C_FREQ_400_KHZ,
         },
+        [EM2884_BOARD_TERRATEC_H6] = {
+                .name         = "Terratec Cinergy H6 rev. 2",
+                .has_dvb      = 1,
+                .ir_codes     = RC_MAP_NEC_TERRATEC_CINERGY_XS,
+#if 0
+                .tuner_type   = TUNER_PHILIPS_TDA8290,
+                .tuner_addr   = 0x41,
+                .dvb_gpio     = terratec_h5_digital, /* FIXME: probably wrong */
+                .tuner_gpio   = terratec_h5_gpio,
+#else
+                .tuner_type   = TUNER_ABSENT,
+#endif
+                .def_i2c_bus  = 1,
+                .i2c_speed    = EM28XX_I2C_CLK_WAIT_ENABLE |
+                                EM28XX_I2C_FREQ_400_KHZ,
+        },
         [EM2884_BOARD_HAUPPAUGE_WINTV_HVR_930C] = {
                 .name         = "Hauppauge WinTV HVR 930C",
                 .has_dvb      = 1,
@@ -2496,6 +2512,8 @@ struct usb_device_id em28xx_id_table[] = {
                         .driver_info = EM2884_BOARD_TERRATEC_H5 },
         { USB_DEVICE(0x0ccd, 0x10b6),   /* H5 Rev. 3 */
                         .driver_info = EM2884_BOARD_TERRATEC_H5 },
+        { USB_DEVICE(0x0ccd, 0x10b2),   /* H6 */
+                        .driver_info = EM2884_BOARD_TERRATEC_H6 },
         { USB_DEVICE(0x0ccd, 0x0084),
                         .driver_info = EM2860_BOARD_TERRATEC_AV350 },
         { USB_DEVICE(0x0ccd, 0x0096),
diff --git a/drivers/media/usb/em28xx/em28xx-dvb.c b/drivers/media/usb/em28xx/em28xx-dvb.c
index 82edd37f0d73..4a7db623fe29 100644
--- a/drivers/media/usb/em28xx/em28xx-dvb.c
+++ b/drivers/media/usb/em28xx/em28xx-dvb.c
@@ -1522,6 +1522,7 @@ static int em28xx_dvb_init(struct em28xx *dev)
                 break;
         case EM2884_BOARD_ELGATO_EYETV_HYBRID_2008:
         case EM2884_BOARD_CINERGY_HTC_STICK:
+        case EM2884_BOARD_TERRATEC_H6:
                 terratec_htc_stick_init(dev);
 
                 /* attach demodulator */
diff --git a/drivers/media/usb/em28xx/em28xx-i2c.c b/drivers/media/usb/em28xx/em28xx-i2c.c
index 8c472d5adb50..60b195c157b8 100644
--- a/drivers/media/usb/em28xx/em28xx-i2c.c
+++ b/drivers/media/usb/em28xx/em28xx-i2c.c
@@ -982,8 +982,6 @@ int em28xx_i2c_register(struct em28xx *dev, unsigned bus,
                         dev_err(&dev->intf->dev,
                                 "%s: em28xx_i2_eeprom failed! retval [%d]\n",
                                 __func__, retval);
-
-                        return retval;
                 }
         }
 
diff --git a/drivers/media/usb/em28xx/em28xx-input.c b/drivers/media/usb/em28xx/em28xx-input.c
index eba75736e654..ca9673917ad5 100644
--- a/drivers/media/usb/em28xx/em28xx-input.c
+++ b/drivers/media/usb/em28xx/em28xx-input.c
@@ -821,7 +821,7 @@ static int em28xx_ir_init(struct em28xx *dev)
         if (err)
                 goto error;
 
-        dev_info(&dev->intf->dev, "Input extension successfully initalized\n");
+        dev_info(&dev->intf->dev, "Input extension successfully initialized\n");
 
         return 0;
 
diff --git a/drivers/media/usb/em28xx/em28xx.h b/drivers/media/usb/em28xx/em28xx.h
index e8d97d5ec161..88084f24f033 100644
--- a/drivers/media/usb/em28xx/em28xx.h
+++ b/drivers/media/usb/em28xx/em28xx.h
@@ -148,6 +148,7 @@
 #define EM28178_BOARD_PLEX_PX_BCUD                98
 #define EM28174_BOARD_HAUPPAUGE_WINTV_DUALHD_DVB  99
 #define EM28174_BOARD_HAUPPAUGE_WINTV_DUALHD_01595 100
+#define EM2884_BOARD_TERRATEC_H6                  101
 
 /* Limits minimum and default number of buffers */
 #define EM28XX_MIN_BUF 4
diff --git a/drivers/media/usb/pulse8-cec/pulse8-cec.c b/drivers/media/usb/pulse8-cec/pulse8-cec.c
index c843070f24c1..f9ed9c950247 100644
--- a/drivers/media/usb/pulse8-cec/pulse8-cec.c
+++ b/drivers/media/usb/pulse8-cec/pulse8-cec.c
@@ -51,7 +51,7 @@ MODULE_DESCRIPTION("Pulse Eight HDMI CEC driver");
 MODULE_LICENSE("GPL");
 
 static int debug;
-static int persistent_config = 1;
+static int persistent_config;
 module_param(debug, int, 0644);
 module_param(persistent_config, int, 0644);
 MODULE_PARM_DESC(debug, "debug level (0-1)");
diff --git a/drivers/media/usb/rainshadow-cec/rainshadow-cec.c b/drivers/media/usb/rainshadow-cec/rainshadow-cec.c
index f203699e9c1b..65692576690f 100644
--- a/drivers/media/usb/rainshadow-cec/rainshadow-cec.c
+++ b/drivers/media/usb/rainshadow-cec/rainshadow-cec.c
@@ -116,21 +116,19 @@ static void rain_irq_work_handler(struct work_struct *work)
 
         while (true) {
                 unsigned long flags;
-                bool exit_loop = false;
                 char data;
 
                 spin_lock_irqsave(&rain->buf_lock, flags);
-                if (rain->buf_len) {
-                        data = rain->buf[rain->buf_rd_idx];
-                        rain->buf_len--;
-                        rain->buf_rd_idx = (rain->buf_rd_idx + 1) & 0xff;
-                } else {
-                        exit_loop = true;
+                if (!rain->buf_len) {
+                        spin_unlock_irqrestore(&rain->buf_lock, flags);
+                        break;
                 }
-                spin_unlock_irqrestore(&rain->buf_lock, flags);
 
-                if (exit_loop)
-                        break;
+                data = rain->buf[rain->buf_rd_idx];
+                rain->buf_len--;
+                rain->buf_rd_idx = (rain->buf_rd_idx + 1) & 0xff;
+
+                spin_unlock_irqrestore(&rain->buf_lock, flags);
 
                 if (!rain->cmd_started && data != '?')
                         continue;
diff --git a/drivers/media/usb/stkwebcam/stk-sensor.c b/drivers/media/usb/stkwebcam/stk-sensor.c
index 985af9933c7e..c1d4505f84ea 100644
--- a/drivers/media/usb/stkwebcam/stk-sensor.c
+++ b/drivers/media/usb/stkwebcam/stk-sensor.c
@@ -41,6 +41,8 @@
 
 /* It seems the i2c bus is controlled with these registers */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include "stk-webcam.h"
 
 #define STK_IIC_BASE            (0x0200)
@@ -239,8 +241,8 @@ static int stk_sensor_outb(struct stk_camera *dev, u8 reg, u8 val)
         } while (tmpval == 0 && i < MAX_RETRIES);
         if (tmpval != STK_IIC_STAT_TX_OK) {
                 if (tmpval)
-                        STK_ERROR("stk_sensor_outb failed, status=0x%02x\n",
-                                tmpval);
+                        pr_err("stk_sensor_outb failed, status=0x%02x\n",
+                               tmpval);
                 return 1;
         } else
                 return 0;
@@ -262,8 +264,8 @@ static int stk_sensor_inb(struct stk_camera *dev, u8 reg, u8 *val)
         } while (tmpval == 0 && i < MAX_RETRIES);
         if (tmpval != STK_IIC_STAT_RX_OK) {
                 if (tmpval)
-                        STK_ERROR("stk_sensor_inb failed, status=0x%02x\n",
-                                tmpval);
+                        pr_err("stk_sensor_inb failed, status=0x%02x\n",
+                               tmpval);
                 return 1;
         }
 
@@ -366,29 +368,29 @@ int stk_sensor_init(struct stk_camera *dev)
         if (stk_camera_write_reg(dev, STK_IIC_ENABLE, STK_IIC_ENABLE_YES)
                 || stk_camera_write_reg(dev, STK_IIC_ADDR, SENSOR_ADDRESS)
                 || stk_sensor_outb(dev, REG_COM7, COM7_RESET)) {
-                STK_ERROR("Sensor resetting failed\n");
+                pr_err("Sensor resetting failed\n");
                 return -ENODEV;
         }
         msleep(10);
         /* Read the manufacturer ID: ov = 0x7FA2 */
         if (stk_sensor_inb(dev, REG_MIDH, &idh)
             || stk_sensor_inb(dev, REG_MIDL, &idl)) {
-                STK_ERROR("Strange error reading sensor ID\n");
+                pr_err("Strange error reading sensor ID\n");
                 return -ENODEV;
         }
         if (idh != 0x7f || idl != 0xa2) {
-                STK_ERROR("Huh? you don't have a sensor from ovt\n");
+                pr_err("Huh? you don't have a sensor from ovt\n");
                 return -ENODEV;
         }
         if (stk_sensor_inb(dev, REG_PID, &idh)
             || stk_sensor_inb(dev, REG_VER, &idl)) {
-                STK_ERROR("Could not read sensor model\n");
+                pr_err("Could not read sensor model\n");
                 return -ENODEV;
         }
         stk_sensor_write_regvals(dev, ov_initvals);
         msleep(10);
-        STK_INFO("OmniVision sensor detected, id %02X%02X at address %x\n",
-                 idh, idl, SENSOR_ADDRESS);
+        pr_info("OmniVision sensor detected, id %02X%02X at address %x\n",
+                idh, idl, SENSOR_ADDRESS);
         return 0;
 }
 
@@ -520,7 +522,8 @@ int stk_sensor_configure(struct stk_camera *dev)
         case MODE_SXGA: com7 = COM7_FMT_SXGA;
                 dummylines = 0;
                 break;
-        default: STK_ERROR("Unsupported mode %d\n", dev->vsettings.mode);
+        default:
+                pr_err("Unsupported mode %d\n", dev->vsettings.mode);
                 return -EFAULT;
         }
         switch (dev->vsettings.palette) {
@@ -544,7 +547,8 @@ int stk_sensor_configure(struct stk_camera *dev)
                 com7 |= COM7_PBAYER;
                 rv = ov_fmt_bayer;
                 break;
-        default: STK_ERROR("Unsupported colorspace\n");
+        default:
+                pr_err("Unsupported colorspace\n");
                 return -EFAULT;
         }
         /*FIXME sometimes the sensor go to a bad state
@@ -564,7 +568,7 @@ int stk_sensor_configure(struct stk_camera *dev)
         switch (dev->vsettings.mode) {
         case MODE_VGA:
                 if (stk_sensor_set_hw(dev, 302, 1582, 6, 486))
-                        STK_ERROR("stk_sensor_set_hw failed (VGA)\n");
+                        pr_err("stk_sensor_set_hw failed (VGA)\n");
                 break;
         case MODE_SXGA:
         case MODE_CIF:
@@ -572,7 +576,7 @@ int stk_sensor_configure(struct stk_camera *dev)
         case MODE_QCIF:
                 /*FIXME These settings seem ignored by the sensor
                 if (stk_sensor_set_hw(dev, 220, 1500, 10, 1034))
-                        STK_ERROR("stk_sensor_set_hw failed (SXGA)\n");
+                        pr_err("stk_sensor_set_hw failed (SXGA)\n");
                 */
                 break;
         }
diff --git a/drivers/media/usb/stkwebcam/stk-webcam.c b/drivers/media/usb/stkwebcam/stk-webcam.c
index 6e7fc36b658f..90d4a08cda31 100644
--- a/drivers/media/usb/stkwebcam/stk-webcam.c
+++ b/drivers/media/usb/stkwebcam/stk-webcam.c
@@ -18,6 +18,8 @@
  * GNU General Public License for more details.
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/kernel.h>
@@ -175,15 +177,15 @@ static int stk_start_stream(struct stk_camera *dev)
         if (!is_present(dev))
                 return -ENODEV;
         if (!is_memallocd(dev) || !is_initialised(dev)) {
-                STK_ERROR("FIXME: Buffers are not allocated\n");
+                pr_err("FIXME: Buffers are not allocated\n");
                 return -EFAULT;
         }
         ret = usb_set_interface(dev->udev, 0, 5);
 
         if (ret < 0)
-                STK_ERROR("usb_set_interface failed !\n");
+                pr_err("usb_set_interface failed !\n");
         if (stk_sensor_wakeup(dev))
-                STK_ERROR("error awaking the sensor\n");
+                pr_err("error awaking the sensor\n");
 
         stk_camera_read_reg(dev, 0x0116, &value_116);
         stk_camera_read_reg(dev, 0x0117, &value_117);
@@ -224,9 +226,9 @@ static int stk_stop_stream(struct stk_camera *dev)
                 unset_streaming(dev);
 
                 if (usb_set_interface(dev->udev, 0, 0))
-                        STK_ERROR("usb_set_interface failed !\n");
+                        pr_err("usb_set_interface failed !\n");
                 if (stk_sensor_sleep(dev))
-                        STK_ERROR("error suspending the sensor\n");
+                        pr_err("error suspending the sensor\n");
         }
         return 0;
 }
@@ -313,7 +315,7 @@ static void stk_isoc_handler(struct urb *urb)
         dev = (struct stk_camera *) urb->context;
 
         if (dev == NULL) {
-                STK_ERROR("isoc_handler called with NULL device !\n");
+                pr_err("isoc_handler called with NULL device !\n");
                 return;
         }
 
@@ -326,14 +328,13 @@ static void stk_isoc_handler(struct urb *urb)
         spin_lock_irqsave(&dev->spinlock, flags);
 
         if (urb->status != -EINPROGRESS && urb->status != 0) {
-                STK_ERROR("isoc_handler: urb->status == %d\n", urb->status);
+                pr_err("isoc_handler: urb->status == %d\n", urb->status);
                 goto resubmit;
         }
 
         if (list_empty(&dev->sio_avail)) {
                 /*FIXME Stop streaming after a while */
-                (void) (printk_ratelimit() &&
-                STK_ERROR("isoc_handler without available buffer!\n"));
+                pr_err_ratelimited("isoc_handler without available buffer!\n");
                 goto resubmit;
         }
         fb = list_first_entry(&dev->sio_avail,
@@ -343,8 +344,8 @@ static void stk_isoc_handler(struct urb *urb)
         for (i = 0; i < urb->number_of_packets; i++) {
                 if (urb->iso_frame_desc[i].status != 0) {
                         if (urb->iso_frame_desc[i].status != -EXDEV)
-                                STK_ERROR("Frame %d has error %d\n", i,
-                                        urb->iso_frame_desc[i].status);
+                                pr_err("Frame %d has error %d\n",
+                                       i, urb->iso_frame_desc[i].status);
                         continue;
                 }
                 framelen = urb->iso_frame_desc[i].actual_length;
@@ -368,9 +369,8 @@ static void stk_isoc_handler(struct urb *urb)
                         /* This marks a new frame */
                         if (fb->v4lbuf.bytesused != 0
                                 && fb->v4lbuf.bytesused != dev->frame_size) {
-                                (void) (printk_ratelimit() &&
-                                STK_ERROR("frame %d, bytesused=%d, skipping\n",
-                                        i, fb->v4lbuf.bytesused));
+                                pr_err_ratelimited("frame %d, bytesused=%d, skipping\n",
+                                                   i, fb->v4lbuf.bytesused);
                                 fb->v4lbuf.bytesused = 0;
                                 fill = fb->buffer;
                         } else if (fb->v4lbuf.bytesused == dev->frame_size) {
@@ -395,8 +395,7 @@ static void stk_isoc_handler(struct urb *urb)
 
                 /* Our buffer is full !!! */
                 if (framelen + fb->v4lbuf.bytesused > dev->frame_size) {
-                        (void) (printk_ratelimit() &&
-                        STK_ERROR("Frame buffer overflow, lost sync\n"));
+                        pr_err_ratelimited("Frame buffer overflow, lost sync\n");
                         /*FIXME Do something here? */
                         continue;
                 }
@@ -414,8 +413,8 @@ resubmit:
         urb->dev = dev->udev;
         ret = usb_submit_urb(urb, GFP_ATOMIC);
         if (ret != 0) {
-                STK_ERROR("Error (%d) re-submitting urb in stk_isoc_handler.\n",
-                        ret);
+                pr_err("Error (%d) re-submitting urb in stk_isoc_handler\n",
+                       ret);
         }
 }
 
@@ -433,32 +432,31 @@ static int stk_prepare_iso(struct stk_camera *dev)
         udev = dev->udev;
 
         if (dev->isobufs)
-                STK_ERROR("isobufs already allocated. Bad\n");
+                pr_err("isobufs already allocated. Bad\n");
         else
                 dev->isobufs = kcalloc(MAX_ISO_BUFS, sizeof(*dev->isobufs),
                                        GFP_KERNEL);
         if (dev->isobufs == NULL) {
-                STK_ERROR("Unable to allocate iso buffers\n");
+                pr_err("Unable to allocate iso buffers\n");
                 return -ENOMEM;
         }
         for (i = 0; i < MAX_ISO_BUFS; i++) {
                 if (dev->isobufs[i].data == NULL) {
                         kbuf = kzalloc(ISO_BUFFER_SIZE, GFP_KERNEL);
                         if (kbuf == NULL) {
-                                STK_ERROR("Failed to allocate iso buffer %d\n",
-                                        i);
+                                pr_err("Failed to allocate iso buffer %d\n", i);
                                 goto isobufs_out;
                         }
                         dev->isobufs[i].data = kbuf;
                 } else
-                        STK_ERROR("isobuf data already allocated\n");
+                        pr_err("isobuf data already allocated\n");
                 if (dev->isobufs[i].urb == NULL) {
                         urb = usb_alloc_urb(ISO_FRAMES_PER_DESC, GFP_KERNEL);
                         if (urb == NULL)
                                 goto isobufs_out;
                         dev->isobufs[i].urb = urb;
                 } else {
-                        STK_ERROR("Killing URB\n");
+                        pr_err("Killing URB\n");
                         usb_kill_urb(dev->isobufs[i].urb);
                         urb = dev->isobufs[i].urb;
                 }
@@ -567,7 +565,7 @@ static int stk_prepare_sio_buffers(struct stk_camera *dev, unsigned n_sbufs)
 {
         int i;
         if (dev->sio_bufs != NULL)
-                STK_ERROR("sio_bufs already allocated\n");
+                pr_err("sio_bufs already allocated\n");
         else {
                 dev->sio_bufs = kzalloc(n_sbufs * sizeof(struct stk_sio_buffer),
                                 GFP_KERNEL);
@@ -690,7 +688,7 @@ static ssize_t stk_read(struct file *fp, char __user *buf,
         spin_lock_irqsave(&dev->spinlock, flags);
         if (list_empty(&dev->sio_full)) {
                 spin_unlock_irqrestore(&dev->spinlock, flags);
-                STK_ERROR("BUG: No siobufs ready\n");
+                pr_err("BUG: No siobufs ready\n");
                 return 0;
         }
         sbuf = list_first_entry(&dev->sio_full, struct stk_sio_buffer, list);
@@ -907,7 +905,7 @@ static int stk_vidioc_g_fmt_vid_cap(struct file *filp,
                         stk_sizes[i].m != dev->vsettings.mode; i++)
                 ;
         if (i == ARRAY_SIZE(stk_sizes)) {
-                STK_ERROR("ERROR: mode invalid\n");
+                pr_err("ERROR: mode invalid\n");
                 return -EINVAL;
         }
         pix_format->width = stk_sizes[i].w;
@@ -985,7 +983,7 @@ static int stk_setup_format(struct stk_camera *dev)
                         stk_sizes[i].m != dev->vsettings.mode)
                 i++;
         if (i == ARRAY_SIZE(stk_sizes)) {
-                STK_ERROR("Something is broken in %s\n", __func__);
+                pr_err("Something is broken in %s\n", __func__);
                 return -EFAULT;
         }
         /* This registers controls some timings, not sure of what. */
@@ -1241,7 +1239,7 @@ static void stk_v4l_dev_release(struct video_device *vd)
         struct stk_camera *dev = vdev_to_camera(vd);
 
         if (dev->sio_bufs != NULL || dev->isobufs != NULL)
-                STK_ERROR("We are leaking memory\n");
+                pr_err("We are leaking memory\n");
         usb_put_intf(dev->interface);
         kfree(dev);
 }
@@ -1264,10 +1262,10 @@ static int stk_register_video_device(struct stk_camera *dev)
         video_set_drvdata(&dev->vdev, dev);
         err = video_register_device(&dev->vdev, VFL_TYPE_GRABBER, -1);
         if (err)
-                STK_ERROR("v4l registration failed\n");
+                pr_err("v4l registration failed\n");
         else
-                STK_INFO("Syntek USB2.0 Camera is now controlling device %s\n",
-                         video_device_node_name(&dev->vdev));
+                pr_info("Syntek USB2.0 Camera is now controlling device %s\n",
+                        video_device_node_name(&dev->vdev));
         return err;
 }
 
@@ -1288,7 +1286,7 @@ static int stk_camera_probe(struct usb_interface *interface,
 
         dev = kzalloc(sizeof(struct stk_camera), GFP_KERNEL);
         if (dev == NULL) {
-                STK_ERROR("Out of memory !\n");
+                pr_err("Out of memory !\n");
                 return -ENOMEM;
         }
         err = v4l2_device_register(&interface->dev, &dev->v4l2_dev);
@@ -1352,7 +1350,7 @@ static int stk_camera_probe(struct usb_interface *interface,
                 }
         }
         if (!dev->isoc_ep) {
-                STK_ERROR("Could not find isoc-in endpoint");
+                pr_err("Could not find isoc-in endpoint\n");
                 err = -ENODEV;
                 goto error;
         }
@@ -1387,8 +1385,8 @@ static void stk_camera_disconnect(struct usb_interface *interface)
 
         wake_up_interruptible(&dev->wait_frame);
 
-        STK_INFO("Syntek USB2.0 Camera release resources device %s\n",
-                 video_device_node_name(&dev->vdev));
+        pr_info("Syntek USB2.0 Camera release resources device %s\n",
+                video_device_node_name(&dev->vdev));
 
         video_unregister_device(&dev->vdev);
         v4l2_ctrl_handler_free(&dev->hdl);
diff --git a/drivers/media/usb/stkwebcam/stk-webcam.h b/drivers/media/usb/stkwebcam/stk-webcam.h
index 0284120ce246..5cecbdc97573 100644
--- a/drivers/media/usb/stkwebcam/stk-webcam.h
+++ b/drivers/media/usb/stkwebcam/stk-webcam.h
@@ -31,12 +31,6 @@
 #define ISO_MAX_FRAME_SIZE      3 * 1024
 #define ISO_BUFFER_SIZE         (ISO_FRAMES_PER_DESC * ISO_MAX_FRAME_SIZE)
 
-
-#define PREFIX                          "stkwebcam: "
-#define STK_INFO(str, args...)          printk(KERN_INFO PREFIX str, ##args)
-#define STK_ERROR(str, args...)         printk(KERN_ERR PREFIX str, ##args)
-#define STK_WARNING(str, args...)       printk(KERN_WARNING PREFIX str, ##args)
-
 struct stk_iso_buf {
         void *data;
         int length;
diff --git a/drivers/media/v4l2-core/tuner-core.c b/drivers/media/v4l2-core/tuner-core.c
index e48b7c032c95..8db45dfc271b 100644
--- a/drivers/media/v4l2-core/tuner-core.c
+++ b/drivers/media/v4l2-core/tuner-core.c
@@ -43,8 +43,6 @@
 
 #define UNSET (-1U)
 
-#define PREFIX (t->i2c->dev.driver->name)
-
 /*
  * Driver modprobe parameters
  */
diff --git a/drivers/memory/atmel-ebi.c b/drivers/memory/atmel-ebi.c
index 99e644cda4d1..ebf69ff48ae2 100644
--- a/drivers/memory/atmel-ebi.c
+++ b/drivers/memory/atmel-ebi.c
@@ -72,7 +72,7 @@ struct atmel_smc_timing_xlate {
         { .name = nm, .converter = atmel_smc_cs_conf_set_pulse, .shift = pos}
 
 #define ATMEL_SMC_CYCLE_XLATE(nm, pos)  \
-        { .name = nm, .converter = atmel_smc_cs_conf_set_setup, .shift = pos}
+        { .name = nm, .converter = atmel_smc_cs_conf_set_cycle, .shift = pos}
 
 static void at91sam9_ebi_get_config(struct atmel_ebi_dev *ebid,
                                     struct atmel_ebi_dev_config *conf)
@@ -120,12 +120,14 @@ static int atmel_ebi_xslate_smc_timings(struct atmel_ebi_dev *ebid,
         if (!ret) {
                 required = true;
                 ncycles = DIV_ROUND_UP(val, clk_period_ns);
-                if (ncycles > ATMEL_SMC_MODE_TDF_MAX ||
-                    ncycles < ATMEL_SMC_MODE_TDF_MIN) {
+                if (ncycles > ATMEL_SMC_MODE_TDF_MAX) {
                         ret = -EINVAL;
                         goto out;
                 }
 
+                if (ncycles < ATMEL_SMC_MODE_TDF_MIN)
+                        ncycles = ATMEL_SMC_MODE_TDF_MIN;
+
                 smcconf->mode |= ATMEL_SMC_MODE_TDF(ncycles);
         }
 
@@ -263,7 +265,7 @@ static int atmel_ebi_xslate_smc_config(struct atmel_ebi_dev *ebid,
         }
 
         ret = atmel_ebi_xslate_smc_timings(ebid, np, &conf->smcconf);
-        if (ret)
+        if (ret < 0)
                 return -EINVAL;
 
         if ((ret > 0 && !required) || (!ret && required)) {
diff --git a/drivers/mfd/atmel-smc.c b/drivers/mfd/atmel-smc.c
index 954cf0f66a31..20cc0ea470fa 100644
--- a/drivers/mfd/atmel-smc.c
+++ b/drivers/mfd/atmel-smc.c
@@ -206,7 +206,7 @@ EXPORT_SYMBOL_GPL(atmel_smc_cs_conf_set_pulse);
  *           parameter
  *
  * This function encodes the @ncycles value as described in the datasheet
- * (section "SMC Pulse Register"), and then stores the result in the
+ * (section "SMC Cycle Register"), and then stores the result in the
  * @conf->setup field at @shift position.
  *
  * Returns -EINVAL if @shift is invalid, -ERANGE if @ncycles does not fit in
diff --git a/drivers/mfd/da9062-core.c b/drivers/mfd/da9062-core.c
index fbe0f245ce8e..fe1811523e4a 100644
--- a/drivers/mfd/da9062-core.c
+++ b/drivers/mfd/da9062-core.c
@@ -645,6 +645,9 @@ static const struct regmap_range da9062_aa_readable_ranges[] = {
                 .range_min = DA9062AA_VLDO1_B,
                 .range_max = DA9062AA_VLDO4_B,
         }, {
+                .range_min = DA9062AA_BBAT_CONT,
+                .range_max = DA9062AA_BBAT_CONT,
+        }, {
                 .range_min = DA9062AA_INTERFACE,
                 .range_max = DA9062AA_CONFIG_E,
         }, {
@@ -721,6 +724,9 @@ static const struct regmap_range da9062_aa_writeable_ranges[] = {
                 .range_min = DA9062AA_VLDO1_B,
                 .range_max = DA9062AA_VLDO4_B,
         }, {
+                .range_min = DA9062AA_BBAT_CONT,
+                .range_max = DA9062AA_BBAT_CONT,
+        }, {
                 .range_min = DA9062AA_GP_ID_0,
                 .range_max = DA9062AA_GP_ID_19,
         },
diff --git a/drivers/mfd/db8500-prcmu.c b/drivers/mfd/db8500-prcmu.c
index 5c739ac752e8..5970b8def548 100644
--- a/drivers/mfd/db8500-prcmu.c
+++ b/drivers/mfd/db8500-prcmu.c
@@ -33,7 +33,6 @@
 #include <linux/mfd/abx500/ab8500.h>
 #include <linux/regulator/db8500-prcmu.h>
 #include <linux/regulator/machine.h>
-#include <linux/cpufreq.h>
 #include <linux/platform_data/ux500_wdt.h>
 #include <linux/platform_data/db8500_thermal.h>
 #include "dbx500-prcmu-regs.h"
@@ -1692,32 +1691,27 @@ static long round_clock_rate(u8 clock, unsigned long rate)
         return rounded_rate;
 }
 
-/* CPU FREQ table, may be changed due to if MAX_OPP is supported. */
-static struct cpufreq_frequency_table db8500_cpufreq_table[] = {
-        { .frequency = 200000, .driver_data = ARM_EXTCLK,},
-        { .frequency = 400000, .driver_data = ARM_50_OPP,},
-        { .frequency = 800000, .driver_data = ARM_100_OPP,},
-        { .frequency = CPUFREQ_TABLE_END,}, /* To be used for MAX_OPP. */
-        { .frequency = CPUFREQ_TABLE_END,},
+static const unsigned long armss_freqs[] = {
+        200000000,
+        400000000,
+        800000000,
+        998400000
 };
 
 static long round_armss_rate(unsigned long rate)
 {
-        struct cpufreq_frequency_table *pos;
-        long freq = 0;
-
-        /* cpufreq table frequencies is in KHz. */
-        rate = rate / 1000;
+        unsigned long freq = 0;
+        int i;
 
         /* Find the corresponding arm opp from the cpufreq table. */
-        cpufreq_for_each_entry(pos, db8500_cpufreq_table) {
-                freq = pos->frequency;
-                if (freq == rate)
+        for (i = 0; i < ARRAY_SIZE(armss_freqs); i++) {
+                freq = armss_freqs[i];
+                if (rate <= freq)
                         break;
         }
 
         /* Return the last valid value, even if a match was not found. */
-        return freq * 1000;
+        return freq;
 }
 
 #define MIN_PLL_VCO_RATE 600000000ULL
@@ -1854,21 +1848,23 @@ static void set_clock_rate(u8 clock, unsigned long rate)
 
 static int set_armss_rate(unsigned long rate)
 {
-        struct cpufreq_frequency_table *pos;
-
-        /* cpufreq table frequencies is in KHz. */
-        rate = rate / 1000;
+        unsigned long freq;
+        u8 opps[] = { ARM_EXTCLK, ARM_50_OPP, ARM_100_OPP, ARM_MAX_OPP };
+        int i;
 
         /* Find the corresponding arm opp from the cpufreq table. */
-        cpufreq_for_each_entry(pos, db8500_cpufreq_table)
-                if (pos->frequency == rate)
+        for (i = 0; i < ARRAY_SIZE(armss_freqs); i++) {
+                freq = armss_freqs[i];
+                if (rate == freq)
                         break;
+        }
 
-        if (pos->frequency != rate)
+        if (rate != freq)
                 return -EINVAL;
 
         /* Set the new arm opp. */
-        return db8500_prcmu_set_arm_opp(pos->driver_data);
+        pr_debug("SET ARM OPP 0x%02x\n", opps[i]);
+        return db8500_prcmu_set_arm_opp(opps[i]);
 }
 
 static int set_plldsi_rate(unsigned long rate)
@@ -3049,12 +3045,6 @@ static const struct mfd_cell db8500_prcmu_devs[] = {
                 .pdata_size = sizeof(db8500_regulators),
         },
         {
-                .name = "cpufreq-ux500",
-                .of_compatible = "stericsson,cpufreq-ux500",
-                .platform_data = &db8500_cpufreq_table,
-                .pdata_size = sizeof(db8500_cpufreq_table),
-        },
-        {
                 .name = "cpuidle-dbx500",
                 .of_compatible = "stericsson,cpuidle-dbx500",
         },
@@ -3067,14 +3057,6 @@ static const struct mfd_cell db8500_prcmu_devs[] = {
         },
 };
 
-static void db8500_prcmu_update_cpufreq(void)
-{
-        if (prcmu_has_arm_maxopp()) {
-                db8500_cpufreq_table[3].frequency = 1000000;
-                db8500_cpufreq_table[3].driver_data = ARM_MAX_OPP;
-        }
-}
-
 static int db8500_prcmu_register_ab8500(struct device *parent)
 {
         struct device_node *np;
@@ -3160,8 +3142,6 @@ static int db8500_prcmu_probe(struct platform_device *pdev)
 
         prcmu_config_esram0_deep_sleep(ESRAM0_DEEP_SLEEP_STATE_RET);
 
-        db8500_prcmu_update_cpufreq();
-
         err = mfd_add_devices(&pdev->dev, 0, common_prcmu_devs,
                               ARRAY_SIZE(common_prcmu_devs), NULL, 0, db8500_irq_domain);
         if (err) {
diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c
index 8621a198a2ce..bac33311f55a 100644
--- a/drivers/misc/mei/pci-me.c
+++ b/drivers/misc/mei/pci-me.c
@@ -216,6 +216,12 @@ static int mei_me_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         pci_set_drvdata(pdev, dev);
 
         /*
+         * MEI requires to resume from runtime suspend mode
+         * in order to perform link reset flow upon system suspend.
+         */
+        pdev->dev_flags |= PCI_DEV_FLAGS_NEEDS_RESUME;
+
+        /*
         * For not wake-able HW runtime pm framework
         * can't be used on pci device level.
         * Use domain runtime pm callbacks instead.
diff --git a/drivers/misc/mei/pci-txe.c b/drivers/misc/mei/pci-txe.c
index f811cd524468..e38a5f144373 100644
--- a/drivers/misc/mei/pci-txe.c
+++ b/drivers/misc/mei/pci-txe.c
@@ -138,6 +138,12 @@ static int mei_txe_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         pci_set_drvdata(pdev, dev);
 
         /*
+         * MEI requires to resume from runtime suspend mode
+         * in order to perform link reset flow upon system suspend.
+         */
+        pdev->dev_flags |= PCI_DEV_FLAGS_NEEDS_RESUME;
+
+        /*
         * For not wake-able HW runtime pm framework
         * can't be used on pci device level.
         * Use domain runtime pm callbacks instead.
diff --git a/drivers/misc/mic/scif/scif_dma.c b/drivers/misc/mic/scif/scif_dma.c
index 64d5760d069a..63d6246d6dff 100644
--- a/drivers/misc/mic/scif/scif_dma.c
+++ b/drivers/misc/mic/scif/scif_dma.c
@@ -200,16 +200,6 @@ static void scif_mmu_notifier_release(struct mmu_notifier *mn,
         schedule_work(&scif_info.misc_work);
 }
 
-static void scif_mmu_notifier_invalidate_page(struct mmu_notifier *mn,
-                                              struct mm_struct *mm,
-                                              unsigned long address)
-{
-        struct scif_mmu_notif   *mmn;
-
-        mmn = container_of(mn, struct scif_mmu_notif, ep_mmu_notifier);
-        scif_rma_destroy_tcw(mmn, address, PAGE_SIZE);
-}
-
 static void scif_mmu_notifier_invalidate_range_start(struct mmu_notifier *mn,
                                                      struct mm_struct *mm,
                                                      unsigned long start,
@@ -235,7 +225,6 @@ static void scif_mmu_notifier_invalidate_range_end(struct mmu_notifier *mn,
 static const struct mmu_notifier_ops scif_mmu_notifier_ops = {
         .release = scif_mmu_notifier_release,
         .clear_flush_young = NULL,
-        .invalidate_page = scif_mmu_notifier_invalidate_page,
         .invalidate_range_start = scif_mmu_notifier_invalidate_range_start,
         .invalidate_range_end = scif_mmu_notifier_invalidate_range_end};
 
diff --git a/drivers/misc/sgi-gru/grutlbpurge.c b/drivers/misc/sgi-gru/grutlbpurge.c
index e936d43895d2..9918eda0e05f 100644
--- a/drivers/misc/sgi-gru/grutlbpurge.c
+++ b/drivers/misc/sgi-gru/grutlbpurge.c
@@ -247,17 +247,6 @@ static void gru_invalidate_range_end(struct mmu_notifier *mn,
         gru_dbg(grudev, "gms %p, start 0x%lx, end 0x%lx\n", gms, start, end);
 }
 
-static void gru_invalidate_page(struct mmu_notifier *mn, struct mm_struct *mm,
-                                unsigned long address)
-{
-        struct gru_mm_struct *gms = container_of(mn, struct gru_mm_struct,
-                                                 ms_notifier);
-
-        STAT(mmu_invalidate_page);
-        gru_flush_tlb_range(gms, address, PAGE_SIZE);
-        gru_dbg(grudev, "gms %p, address 0x%lx\n", gms, address);
-}
-
 static void gru_release(struct mmu_notifier *mn, struct mm_struct *mm)
 {
         struct gru_mm_struct *gms = container_of(mn, struct gru_mm_struct,
@@ -269,7 +258,6 @@ static void gru_release(struct mmu_notifier *mn, struct mm_struct *mm)
 
 
 static const struct mmu_notifier_ops gru_mmuops = {
-        .invalidate_page        = gru_invalidate_page,
         .invalidate_range_start = gru_invalidate_range_start,
         .invalidate_range_end   = gru_invalidate_range_end,
         .release                = gru_release,
diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
index 8ac59dc80f23..8bd7aba811e9 100644
--- a/drivers/mmc/core/block.c
+++ b/drivers/mmc/core/block.c
@@ -1213,7 +1213,7 @@ static void mmc_blk_issue_drv_op(struct mmc_queue *mq, struct request *req)
                 break;
         }
         mq_rq->drv_op_result = ret;
-        blk_end_request_all(req, ret);
+        blk_end_request_all(req, ret ? BLK_STS_IOERR : BLK_STS_OK);
 }
 
 static void mmc_blk_issue_discard_rq(struct mmc_queue *mq, struct request *req)
@@ -1371,12 +1371,46 @@ static inline void mmc_apply_rel_rw(struct mmc_blk_request *brq,
          R1_CC_ERROR |          /* Card controller error */             \
          R1_ERROR)              /* General/unknown error */
 
-static bool mmc_blk_has_cmd_err(struct mmc_command *cmd)
+static void mmc_blk_eval_resp_error(struct mmc_blk_request *brq)
 {
-        if (!cmd->error && cmd->resp[0] & CMD_ERRORS)
-                cmd->error = -EIO;
+        u32 val;
+
+        /*
+         * Per the SD specification(physical layer version 4.10)[1],
+         * section 4.3.3, it explicitly states that "When the last
+         * block of user area is read using CMD18, the host should
+         * ignore OUT_OF_RANGE error that may occur even the sequence
+         * is correct". And JESD84-B51 for eMMC also has a similar
+         * statement on section 6.8.3.
+         *
+         * Multiple block read/write could be done by either predefined
+         * method, namely CMD23, or open-ending mode. For open-ending mode,
+         * we should ignore the OUT_OF_RANGE error as it's normal behaviour.
+         *
+         * However the spec[1] doesn't tell us whether we should also
+         * ignore that for predefined method. But per the spec[1], section
+         * 4.15 Set Block Count Command, it says"If illegal block count
+         * is set, out of range error will be indicated during read/write
+         * operation (For example, data transfer is stopped at user area
+         * boundary)." In another word, we could expect a out of range error
+         * in the response for the following CMD18/25. And if argument of
+         * CMD23 + the argument of CMD18/25 exceed the max number of blocks,
+         * we could also expect to get a -ETIMEDOUT or any error number from
+         * the host drivers due to missing data response(for write)/data(for
+         * read), as the cards will stop the data transfer by itself per the
+         * spec. So we only need to check R1_OUT_OF_RANGE for open-ending mode.
+         */
 
-        return cmd->error;
+        if (!brq->stop.error) {
+                bool oor_with_open_end;
+                /* If there is no error yet, check R1 response */
+
+                val = brq->stop.resp[0] & CMD_ERRORS;
+                oor_with_open_end = val & R1_OUT_OF_RANGE && !brq->mrq.sbc;
+
+                if (val && !oor_with_open_end)
+                        brq->stop.error = -EIO;
+        }
 }
 
 static enum mmc_blk_status mmc_blk_err_check(struct mmc_card *card,
@@ -1400,8 +1434,11 @@ static enum mmc_blk_status mmc_blk_err_check(struct mmc_card *card,
          * stop.error indicates a problem with the stop command.  Data
          * may have been transferred, or may still be transferring.
          */
-        if (brq->sbc.error || brq->cmd.error || mmc_blk_has_cmd_err(&brq->stop) ||
-            brq->data.error) {
+
+        mmc_blk_eval_resp_error(brq);
+
+        if (brq->sbc.error || brq->cmd.error ||
+            brq->stop.error || brq->data.error) {
                 switch (mmc_blk_cmd_recovery(card, req, brq, &ecc_err, &gen_err)) {
                 case ERR_RETRY:
                         return MMC_BLK_RETRY;
@@ -1681,9 +1718,9 @@ static bool mmc_blk_rw_cmd_err(struct mmc_blk_data *md, struct mmc_card *card,
                 if (err)
                         req_pending = old_req_pending;
                 else
-                        req_pending = blk_end_request(req, 0, blocks << 9);
+                        req_pending = blk_end_request(req, BLK_STS_OK, blocks << 9);
         } else {
-                req_pending = blk_end_request(req, 0, brq->data.bytes_xfered);
+                req_pending = blk_end_request(req, BLK_STS_OK, brq->data.bytes_xfered);
         }
         return req_pending;
 }
@@ -2170,6 +2207,9 @@ static void mmc_blk_remove_req(struct mmc_blk_data *md)
                  * from being accepted.
                  */
                 card = md->queue.card;
+                spin_lock_irq(md->queue.queue->queue_lock);
+                queue_flag_set(QUEUE_FLAG_BYPASS, md->queue.queue);
+                spin_unlock_irq(md->queue.queue->queue_lock);
                 blk_set_queue_dying(md->queue.queue);
                 mmc_cleanup_queue(&md->queue);
                 if (md->disk->flags & GENHD_FL_UP) {
diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c
index 4ffea14b7eb6..2bae69e39544 100644
--- a/drivers/mmc/core/mmc.c
+++ b/drivers/mmc/core/mmc.c
@@ -1289,7 +1289,7 @@ out_err:
 static int mmc_select_hs400es(struct mmc_card *card)
 {
         struct mmc_host *host = card->host;
-        int err = 0;
+        int err = -EINVAL;
         u8 val;
 
         if (!(host->caps & MMC_CAP_8_BIT_DATA)) {
diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c
index a9dfb26972f2..250dc6ec4c82 100644
--- a/drivers/mmc/host/dw_mmc.c
+++ b/drivers/mmc/host/dw_mmc.c
@@ -2957,7 +2957,7 @@ static struct dw_mci_board *dw_mci_parse_dt(struct dw_mci *host)
         }
 
         /* find out number of slots supported */
-        if (device_property_read_u32(dev, "num-slots", &pdata->num_slots))
+        if (!device_property_read_u32(dev, "num-slots", &pdata->num_slots))
                 dev_info(dev, "'num-slots' was deprecated.\n");
 
         if (device_property_read_u32(dev, "fifo-depth", &pdata->fifo_depth))
diff --git a/drivers/mmc/host/omap_hsmmc.c b/drivers/mmc/host/omap_hsmmc.c
index 7c12f3715676..2ab4788d021f 100644
--- a/drivers/mmc/host/omap_hsmmc.c
+++ b/drivers/mmc/host/omap_hsmmc.c
@@ -356,9 +356,6 @@ static int omap_hsmmc_set_power(struct omap_hsmmc_host *host, int power_on,
         struct mmc_host *mmc = host->mmc;
         int ret = 0;
 
-        if (mmc_pdata(host)->set_power)
-                return mmc_pdata(host)->set_power(host->dev, power_on, vdd);
-
         /*
          * If we don't see a Vcc regulator, assume it's a fixed
          * voltage always-on regulator.
@@ -366,9 +363,6 @@ static int omap_hsmmc_set_power(struct omap_hsmmc_host *host, int power_on,
         if (IS_ERR(mmc->supply.vmmc))
                 return 0;
 
-        if (mmc_pdata(host)->before_set_reg)
-                mmc_pdata(host)->before_set_reg(host->dev, power_on, vdd);
-
         ret = omap_hsmmc_set_pbias(host, false, 0);
         if (ret)
                 return ret;
@@ -400,9 +394,6 @@ static int omap_hsmmc_set_power(struct omap_hsmmc_host *host, int power_on,
                         return ret;
         }
 
-        if (mmc_pdata(host)->after_set_reg)
-                mmc_pdata(host)->after_set_reg(host->dev, power_on, vdd);
-
         return 0;
 
 err_set_voltage:
@@ -469,8 +460,6 @@ static int omap_hsmmc_reg_get(struct omap_hsmmc_host *host)
         int ret;
         struct mmc_host *mmc = host->mmc;
 
-        if (mmc_pdata(host)->set_power)
-                return 0;
 
         ret = mmc_regulator_get_supply(mmc);
         if (ret == -EPROBE_DEFER)
@@ -2097,7 +2086,7 @@ static int omap_hsmmc_probe(struct platform_device *pdev)
         mmc->max_seg_size = mmc->max_req_size;
 
         mmc->caps |= MMC_CAP_MMC_HIGHSPEED | MMC_CAP_SD_HIGHSPEED |
-                     MMC_CAP_WAIT_WHILE_BUSY | MMC_CAP_ERASE;
+                     MMC_CAP_WAIT_WHILE_BUSY | MMC_CAP_ERASE | MMC_CAP_CMD23;
 
         mmc->caps |= mmc_pdata(host)->caps;
         if (mmc->caps & MMC_CAP_8_BIT_DATA)
diff --git a/drivers/mmc/host/sdhci-of-at91.c b/drivers/mmc/host/sdhci-of-at91.c
index 7611fd679f1a..1485530c3592 100644
--- a/drivers/mmc/host/sdhci-of-at91.c
+++ b/drivers/mmc/host/sdhci-of-at91.c
@@ -31,6 +31,7 @@
 
 #define SDMMC_MC1R      0x204
 #define         SDMMC_MC1R_DDR          BIT(3)
+#define         SDMMC_MC1R_FCD          BIT(7)
 #define SDMMC_CACR      0x230
 #define         SDMMC_CACR_CAPWREN      BIT(0)
 #define         SDMMC_CACR_KEY          (0x46 << 8)
@@ -43,6 +44,15 @@ struct sdhci_at91_priv {
         struct clk *mainck;
 };
 
+static void sdhci_at91_set_force_card_detect(struct sdhci_host *host)
+{
+        u8 mc1r;
+
+        mc1r = readb(host->ioaddr + SDMMC_MC1R);
+        mc1r |= SDMMC_MC1R_FCD;
+        writeb(mc1r, host->ioaddr + SDMMC_MC1R);
+}
+
 static void sdhci_at91_set_clock(struct sdhci_host *host, unsigned int clock)
 {
         u16 clk;
@@ -110,10 +120,18 @@ void sdhci_at91_set_uhs_signaling(struct sdhci_host *host, unsigned int timing)
         sdhci_set_uhs_signaling(host, timing);
 }
 
+static void sdhci_at91_reset(struct sdhci_host *host, u8 mask)
+{
+        sdhci_reset(host, mask);
+
+        if (host->mmc->caps & MMC_CAP_NONREMOVABLE)
+                sdhci_at91_set_force_card_detect(host);
+}
+
 static const struct sdhci_ops sdhci_at91_sama5d2_ops = {
         .set_clock              = sdhci_at91_set_clock,
         .set_bus_width          = sdhci_set_bus_width,
-        .reset                  = sdhci_reset,
+        .reset                  = sdhci_at91_reset,
         .set_uhs_signaling      = sdhci_at91_set_uhs_signaling,
         .set_power              = sdhci_at91_set_power,
 };
@@ -324,6 +342,21 @@ static int sdhci_at91_probe(struct platform_device *pdev)
                 host->quirks &= ~SDHCI_QUIRK_BROKEN_CARD_DETECTION;
         }
 
+        /*
+         * If the device attached to the MMC bus is not removable, it is safer
+         * to set the Force Card Detect bit. People often don't connect the
+         * card detect signal and use this pin for another purpose. If the card
+         * detect pin is not muxed to SDHCI controller, a default value is
+         * used. This value can be different from a SoC revision to another
+         * one. Problems come when this default value is not card present. To
+         * avoid this case, if the device is non removable then the card
+         * detection procedure using the SDMCC_CD signal is bypassed.
+         * This bit is reset when a software reset for all command is performed
+         * so we need to implement our own reset function to set back this bit.
+         */
+        if (host->mmc->caps & MMC_CAP_NONREMOVABLE)
+                sdhci_at91_set_force_card_detect(host);
+
         pm_runtime_put_autosuspend(&pdev->dev);
 
         return 0;
diff --git a/drivers/mmc/host/sdhci-xenon.c b/drivers/mmc/host/sdhci-xenon.c
index bc1781bb070b..c580af05b033 100644
--- a/drivers/mmc/host/sdhci-xenon.c
+++ b/drivers/mmc/host/sdhci-xenon.c
@@ -210,8 +210,27 @@ static void xenon_set_uhs_signaling(struct sdhci_host *host,
         sdhci_writew(host, ctrl_2, SDHCI_HOST_CONTROL2);
 }
 
+static void xenon_set_power(struct sdhci_host *host, unsigned char mode,
+                unsigned short vdd)
+{
+        struct mmc_host *mmc = host->mmc;
+        u8 pwr = host->pwr;
+
+        sdhci_set_power_noreg(host, mode, vdd);
+
+        if (host->pwr == pwr)
+                return;
+
+        if (host->pwr == 0)
+                vdd = 0;
+
+        if (!IS_ERR(mmc->supply.vmmc))
+                mmc_regulator_set_ocr(mmc, mmc->supply.vmmc, vdd);
+}
+
 static const struct sdhci_ops sdhci_xenon_ops = {
         .set_clock              = sdhci_set_clock,
+        .set_power              = xenon_set_power,
         .set_bus_width          = sdhci_set_bus_width,
         .reset                  = xenon_reset,
         .set_uhs_signaling      = xenon_set_uhs_signaling,
diff --git a/drivers/mmc/host/sunxi-mmc.c b/drivers/mmc/host/sunxi-mmc.c
index d6fa2214aaae..0fb4e4c119e1 100644
--- a/drivers/mmc/host/sunxi-mmc.c
+++ b/drivers/mmc/host/sunxi-mmc.c
@@ -793,8 +793,12 @@ static int sunxi_mmc_clk_set_rate(struct sunxi_mmc_host *host,
         }
         mmc_writel(host, REG_CLKCR, rval);
 
-        if (host->cfg->needs_new_timings)
-                mmc_writel(host, REG_SD_NTSR, SDXC_2X_TIMING_MODE);
+        if (host->cfg->needs_new_timings) {
+                /* Don't touch the delay bits */
+                rval = mmc_readl(host, REG_SD_NTSR);
+                rval |= SDXC_2X_TIMING_MODE;
+                mmc_writel(host, REG_SD_NTSR, rval);
+        }
 
         ret = sunxi_mmc_clk_set_phase(host, ios, rate);
         if (ret)
diff --git a/drivers/mtd/mtd_blkdevs.c b/drivers/mtd/mtd_blkdevs.c
index f336a9b85576..9ec8f033ac5f 100644
--- a/drivers/mtd/mtd_blkdevs.c
+++ b/drivers/mtd/mtd_blkdevs.c
@@ -113,6 +113,7 @@ static blk_status_t do_blktrans_request(struct mtd_blktrans_ops *tr,
                 for (; nsect > 0; nsect--, block++, buf += tr->blksize)
                         if (tr->writesect(dev, block, buf))
                                 return BLK_STS_IOERR;
+                return BLK_STS_OK;
         default:
                 return BLK_STS_IOERR;
         }
diff --git a/drivers/mtd/nand/atmel/nand-controller.c b/drivers/mtd/nand/atmel/nand-controller.c
index d922a88e407f..ceec21bd30c4 100644
--- a/drivers/mtd/nand/atmel/nand-controller.c
+++ b/drivers/mtd/nand/atmel/nand-controller.c
@@ -1201,7 +1201,7 @@ static int atmel_smc_nand_prepare_smcconf(struct atmel_nand *nand,
          * tRC < 30ns implies EDO mode. This controller does not support this
          * mode.
          */
-        if (conf->timings.sdr.tRC_min < 30)
+        if (conf->timings.sdr.tRC_min < 30000)
                 return -ENOTSUPP;
 
         atmel_smc_cs_conf_init(smcconf);
@@ -1364,7 +1364,18 @@ static int atmel_smc_nand_prepare_smcconf(struct atmel_nand *nand,
         ret = atmel_smc_cs_conf_set_timing(smcconf,
                                            ATMEL_HSMC_TIMINGS_TADL_SHIFT,
                                            ncycles);
-        if (ret)
+        /*
+         * Version 4 of the ONFI spec mandates that tADL be at least 400
+         * nanoseconds, but, depending on the master clock rate, 400 ns may not
+         * fit in the tADL field of the SMC reg. We need to relax the check and
+         * accept the -ERANGE return code.
+         *
+         * Note that previous versions of the ONFI spec had a lower tADL_min
+         * (100 or 200 ns). It's not clear why this timing constraint got
+         * increased but it seems most NANDs are fine with values lower than
+         * 400ns, so we should be safe.
+         */
+        if (ret && ret != -ERANGE)
                 return ret;
 
         ncycles = DIV_ROUND_UP(conf->timings.sdr.tAR_min, mckperiodps);
diff --git a/drivers/mtd/nand/atmel/pmecc.c b/drivers/mtd/nand/atmel/pmecc.c
index 55a8ee5306ea..8c210a5776bc 100644
--- a/drivers/mtd/nand/atmel/pmecc.c
+++ b/drivers/mtd/nand/atmel/pmecc.c
@@ -945,6 +945,7 @@ struct atmel_pmecc *devm_atmel_pmecc_get(struct device *userdev)
                  */
                 struct platform_device *pdev = to_platform_device(userdev);
                 const struct atmel_pmecc_caps *caps;
+                const struct of_device_id *match;
 
                 /* No PMECC engine available. */
                 if (!of_property_read_bool(userdev->of_node,
@@ -953,21 +954,11 @@ struct atmel_pmecc *devm_atmel_pmecc_get(struct device *userdev)
 
                 caps = &at91sam9g45_caps;
 
-                /*
-                 * Try to find the NFC subnode and extract the associated caps
-                 * from there.
-                 */
-                np = of_find_compatible_node(userdev->of_node, NULL,
-                                             "atmel,sama5d3-nfc");
-                if (np) {
-                        const struct of_device_id *match;
-
-                        match = of_match_node(atmel_pmecc_legacy_match, np);
-                        if (match && match->data)
-                                caps = match->data;
-
-                        of_node_put(np);
-                }
+                /* Find the caps associated to the NAND dev node. */
+                match = of_match_node(atmel_pmecc_legacy_match,
+                                      userdev->of_node);
+                if (match && match->data)
+                        caps = match->data;
 
                 pmecc = atmel_pmecc_create(pdev, caps, 1, 2);
         }
diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c
index 5fa5ddc94834..c6c18b82f8f4 100644
--- a/drivers/mtd/nand/nand_base.c
+++ b/drivers/mtd/nand/nand_base.c
@@ -65,8 +65,14 @@ static int nand_ooblayout_ecc_sp(struct mtd_info *mtd, int section,
 
         if (!section) {
                 oobregion->offset = 0;
-                oobregion->length = 4;
+                if (mtd->oobsize == 16)
+                        oobregion->length = 4;
+                else
+                        oobregion->length = 3;
         } else {
+                if (mtd->oobsize == 8)
+                        return -ERANGE;
+
                 oobregion->offset = 6;
                 oobregion->length = ecc->total - 4;
         }
@@ -1125,7 +1131,9 @@ static int nand_setup_data_interface(struct nand_chip *chip, int chipnr)
          * Ensure the timing mode has been changed on the chip side
          * before changing timings on the controller side.
          */
-        if (chip->onfi_version) {
+        if (chip->onfi_version &&
+            (le16_to_cpu(chip->onfi_params.opt_cmd) &
+             ONFI_OPT_CMD_SET_GET_FEATURES)) {
                 u8 tmode_param[ONFI_SUBFEATURE_PARAM_LEN] = {
                         chip->onfi_timing_mode_default,
                 };
@@ -2741,7 +2749,6 @@ static int nand_write_page_syndrome(struct mtd_info *mtd,
  * @buf: the data to write
  * @oob_required: must write chip->oob_poi to OOB
  * @page: page number to write
- * @cached: cached programming
  * @raw: use _raw version of write_page
  */
 static int nand_write_page(struct mtd_info *mtd, struct nand_chip *chip,
diff --git a/drivers/mtd/nand/nand_timings.c b/drivers/mtd/nand/nand_timings.c
index f06312df3669..7e36d7d13c26 100644
--- a/drivers/mtd/nand/nand_timings.c
+++ b/drivers/mtd/nand/nand_timings.c
@@ -311,9 +311,9 @@ int onfi_init_data_interface(struct nand_chip *chip,
                 struct nand_sdr_timings *timings = &iface->timings.sdr;
 
                 /* microseconds -> picoseconds */
-                timings->tPROG_max = 1000000UL * le16_to_cpu(params->t_prog);
-                timings->tBERS_max = 1000000UL * le16_to_cpu(params->t_bers);
-                timings->tR_max = 1000000UL * le16_to_cpu(params->t_r);
+                timings->tPROG_max = 1000000ULL * le16_to_cpu(params->t_prog);
+                timings->tBERS_max = 1000000ULL * le16_to_cpu(params->t_bers);
+                timings->tR_max = 1000000ULL * le16_to_cpu(params->t_r);
 
                 /* nanoseconds -> picoseconds */
                 timings->tCCS_min = 1000UL * le16_to_cpu(params->t_ccs);
diff --git a/drivers/mtd/nand/nandsim.c b/drivers/mtd/nand/nandsim.c
index 03a0d057bf2f..e4211c3cc49b 100644
--- a/drivers/mtd/nand/nandsim.c
+++ b/drivers/mtd/nand/nandsim.c
@@ -2373,6 +2373,7 @@ static int __init ns_init_module(void)
         return 0;
 
 err_exit:
+        nandsim_debugfs_remove(nand);
         free_nandsim(nand);
         nand_release(nsmtd);
         for (i = 0;i < ARRAY_SIZE(nand->partitions); ++i)
diff --git a/drivers/mtd/nand/sunxi_nand.c b/drivers/mtd/nand/sunxi_nand.c
index d0b6f8f9f297..6abd142b1324 100644
--- a/drivers/mtd/nand/sunxi_nand.c
+++ b/drivers/mtd/nand/sunxi_nand.c
@@ -1728,6 +1728,10 @@ static int sunxi_nfc_setup_data_interface(struct mtd_info *mtd, int csline,
          */
         chip->clk_rate = NSEC_PER_SEC / min_clk_period;
         real_clk_rate = clk_round_rate(nfc->mod_clk, chip->clk_rate);
+        if (real_clk_rate <= 0) {
+                dev_err(nfc->dev, "Unable to round clk %lu\n", chip->clk_rate);
+                return -EINVAL;
+        }
 
         /*
          * ONFI specification 3.1, paragraph 4.15.2 dictates that EDO data
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 181839d6fbea..fc63992ab0e0 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1569,7 +1569,8 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
         new_slave->delay = 0;
         new_slave->link_failure_count = 0;
 
-        if (bond_update_speed_duplex(new_slave))
+        if (bond_update_speed_duplex(new_slave) &&
+            bond_needs_speed_duplex(bond))
                 new_slave->link = BOND_LINK_DOWN;
 
         new_slave->last_rx = jiffies -
@@ -2050,6 +2051,7 @@ static int bond_miimon_inspect(struct bonding *bond)
                                 continue;
 
                         bond_propose_link_state(slave, BOND_LINK_FAIL);
+                        commit++;
                         slave->delay = bond->params.downdelay;
                         if (slave->delay) {
                                 netdev_info(bond->dev, "link status down for %sinterface %s, disabling it in %d ms\n",
@@ -2088,6 +2090,7 @@ static int bond_miimon_inspect(struct bonding *bond)
                                 continue;
 
                         bond_propose_link_state(slave, BOND_LINK_BACK);
+                        commit++;
                         slave->delay = bond->params.updelay;
 
                         if (slave->delay) {
@@ -2138,11 +2141,13 @@ static void bond_miimon_commit(struct bonding *bond)
                         continue;
 
                 case BOND_LINK_UP:
-                        if (bond_update_speed_duplex(slave)) {
+                        if (bond_update_speed_duplex(slave) &&
+                            bond_needs_speed_duplex(bond)) {
                                 slave->link = BOND_LINK_DOWN;
-                                netdev_warn(bond->dev,
-                                            "failed to get link speed/duplex for %s\n",
-                                            slave->dev->name);
+                                if (net_ratelimit())
+                                        netdev_warn(bond->dev,
+                                                    "failed to get link speed/duplex for %s\n",
+                                                    slave->dev->name);
                                 continue;
                         }
                         bond_set_slave_link_state(slave, BOND_LINK_UP,
diff --git a/drivers/net/dsa/bcm_sf2.c b/drivers/net/dsa/bcm_sf2.c
index 648f91b58d1e..9b6ce7c3f6c3 100644
--- a/drivers/net/dsa/bcm_sf2.c
+++ b/drivers/net/dsa/bcm_sf2.c
@@ -1048,6 +1048,7 @@ struct bcm_sf2_of_data {
         u32 type;
         const u16 *reg_offsets;
         unsigned int core_reg_align;
+        unsigned int num_cfp_rules;
 };
 
 /* Register offsets for the SWITCH_REG_* block */
@@ -1071,6 +1072,7 @@ static const struct bcm_sf2_of_data bcm_sf2_7445_data = {
         .type           = BCM7445_DEVICE_ID,
         .core_reg_align = 0,
         .reg_offsets    = bcm_sf2_7445_reg_offsets,
+        .num_cfp_rules  = 256,
 };
 
 static const u16 bcm_sf2_7278_reg_offsets[] = {
@@ -1093,6 +1095,7 @@ static const struct bcm_sf2_of_data bcm_sf2_7278_data = {
         .type           = BCM7278_DEVICE_ID,
         .core_reg_align = 1,
         .reg_offsets    = bcm_sf2_7278_reg_offsets,
+        .num_cfp_rules  = 128,
 };
 
 static const struct of_device_id bcm_sf2_of_match[] = {
@@ -1149,6 +1152,7 @@ static int bcm_sf2_sw_probe(struct platform_device *pdev)
         priv->type = data->type;
         priv->reg_offsets = data->reg_offsets;
         priv->core_reg_align = data->core_reg_align;
+        priv->num_cfp_rules = data->num_cfp_rules;
 
         /* Auto-detection using standard registers will not work, so
          * provide an indication of what kind of device we are for
diff --git a/drivers/net/dsa/bcm_sf2.h b/drivers/net/dsa/bcm_sf2.h
index 7d3030e04f11..7f9125eef3df 100644
--- a/drivers/net/dsa/bcm_sf2.h
+++ b/drivers/net/dsa/bcm_sf2.h
@@ -72,6 +72,7 @@ struct bcm_sf2_priv {
         u32                             type;
         const u16                       *reg_offsets;
         unsigned int                    core_reg_align;
+        unsigned int                    num_cfp_rules;
 
         /* spinlock protecting access to the indirect registers */
         spinlock_t                      indir_lock;
diff --git a/drivers/net/dsa/bcm_sf2_cfp.c b/drivers/net/dsa/bcm_sf2_cfp.c
index 2fb32d67065f..8a1da7e67707 100644
--- a/drivers/net/dsa/bcm_sf2_cfp.c
+++ b/drivers/net/dsa/bcm_sf2_cfp.c
@@ -98,7 +98,7 @@ static inline void bcm_sf2_cfp_rule_addr_set(struct bcm_sf2_priv *priv,
 {
         u32 reg;
 
-        WARN_ON(addr >= CFP_NUM_RULES);
+        WARN_ON(addr >= priv->num_cfp_rules);
 
         reg = core_readl(priv, CORE_CFP_ACC);
         reg &= ~(XCESS_ADDR_MASK << XCESS_ADDR_SHIFT);
@@ -109,7 +109,7 @@ static inline void bcm_sf2_cfp_rule_addr_set(struct bcm_sf2_priv *priv,
 static inline unsigned int bcm_sf2_cfp_rule_size(struct bcm_sf2_priv *priv)
 {
         /* Entry #0 is reserved */
-        return CFP_NUM_RULES - 1;
+        return priv->num_cfp_rules - 1;
 }
 
 static int bcm_sf2_cfp_rule_set(struct dsa_switch *ds, int port,
@@ -523,7 +523,7 @@ static int bcm_sf2_cfp_rule_get_all(struct bcm_sf2_priv *priv,
                 if (!(reg & OP_STR_DONE))
                         break;
 
-        } while (index < CFP_NUM_RULES);
+        } while (index < priv->num_cfp_rules);
 
         /* Put the TCAM size here */
         nfc->data = bcm_sf2_cfp_rule_size(priv);
@@ -544,7 +544,7 @@ int bcm_sf2_get_rxnfc(struct dsa_switch *ds, int port,
         case ETHTOOL_GRXCLSRLCNT:
                 /* Subtract the default, unusable rule */
                 nfc->rule_cnt = bitmap_weight(priv->cfp.used,
-                                              CFP_NUM_RULES) - 1;
+                                              priv->num_cfp_rules) - 1;
                 /* We support specifying rule locations */
                 nfc->data |= RX_CLS_LOC_SPECIAL;
                 break;
diff --git a/drivers/net/dsa/mt7530.c b/drivers/net/dsa/mt7530.c
index 1e46418a3b74..264b281eb86b 100644
--- a/drivers/net/dsa/mt7530.c
+++ b/drivers/net/dsa/mt7530.c
@@ -625,6 +625,44 @@ static void mt7530_adjust_link(struct dsa_switch *ds, int port,
                  * all finished.
                  */
                 mt7623_pad_clk_setup(ds);
+        } else {
+                u16 lcl_adv = 0, rmt_adv = 0;
+                u8 flowctrl;
+                u32 mcr = PMCR_USERP_LINK | PMCR_FORCE_MODE;
+
+                switch (phydev->speed) {
+                case SPEED_1000:
+                        mcr |= PMCR_FORCE_SPEED_1000;
+                        break;
+                case SPEED_100:
+                        mcr |= PMCR_FORCE_SPEED_100;
+                        break;
+                };
+
+                if (phydev->link)
+                        mcr |= PMCR_FORCE_LNK;
+
+                if (phydev->duplex) {
+                        mcr |= PMCR_FORCE_FDX;
+
+                        if (phydev->pause)
+                                rmt_adv = LPA_PAUSE_CAP;
+                        if (phydev->asym_pause)
+                                rmt_adv |= LPA_PAUSE_ASYM;
+
+                        if (phydev->advertising & ADVERTISED_Pause)
+                                lcl_adv |= ADVERTISE_PAUSE_CAP;
+                        if (phydev->advertising & ADVERTISED_Asym_Pause)
+                                lcl_adv |= ADVERTISE_PAUSE_ASYM;
+
+                        flowctrl = mii_resolve_flowctrl_fdx(lcl_adv, rmt_adv);
+
+                        if (flowctrl & FLOW_CTRL_TX)
+                                mcr |= PMCR_TX_FC_EN;
+                        if (flowctrl & FLOW_CTRL_RX)
+                                mcr |= PMCR_RX_FC_EN;
+                }
+                mt7530_write(priv, MT7530_PMCR_P(port), mcr);
         }
 }
 
diff --git a/drivers/net/dsa/mt7530.h b/drivers/net/dsa/mt7530.h
index b83d76b99802..74db9822eb40 100644
--- a/drivers/net/dsa/mt7530.h
+++ b/drivers/net/dsa/mt7530.h
@@ -151,6 +151,7 @@ enum mt7530_stp_state {
 #define  PMCR_TX_FC_EN                  BIT(5)
 #define  PMCR_RX_FC_EN                  BIT(4)
 #define  PMCR_FORCE_SPEED_1000          BIT(3)
+#define  PMCR_FORCE_SPEED_100           BIT(2)
 #define  PMCR_FORCE_FDX                 BIT(1)
 #define  PMCR_FORCE_LNK                 BIT(0)
 #define  PMCR_COMMON_LINK               (PMCR_IFG_XMIT(1) | PMCR_MAC_MODE | \
diff --git a/drivers/net/ethernet/apm/xgene/xgene_enet_main.c b/drivers/net/ethernet/apm/xgene/xgene_enet_main.c
index 86058a9f3417..6e253d913fe2 100644
--- a/drivers/net/ethernet/apm/xgene/xgene_enet_main.c
+++ b/drivers/net/ethernet/apm/xgene/xgene_enet_main.c
@@ -1661,21 +1661,21 @@ static int xgene_enet_get_irqs(struct xgene_enet_pdata *pdata)
         return 0;
 }
 
-static int xgene_enet_check_phy_handle(struct xgene_enet_pdata *pdata)
+static void xgene_enet_check_phy_handle(struct xgene_enet_pdata *pdata)
 {
         int ret;
 
         if (pdata->phy_mode == PHY_INTERFACE_MODE_XGMII)
-                return 0;
+                return;
 
         if (!IS_ENABLED(CONFIG_MDIO_XGENE))
-                return 0;
+                return;
 
         ret = xgene_enet_phy_connect(pdata->ndev);
         if (!ret)
                 pdata->mdio_driver = true;
 
-        return 0;
+        return;
 }
 
 static void xgene_enet_gpiod_get(struct xgene_enet_pdata *pdata)
@@ -1779,15 +1779,11 @@ static int xgene_enet_get_resources(struct xgene_enet_pdata *pdata)
         if (ret)
                 return ret;
 
-        ret = xgene_enet_check_phy_handle(pdata);
-        if (ret)
-                return ret;
-
         xgene_enet_gpiod_get(pdata);
 
-        if (pdata->phy_mode != PHY_INTERFACE_MODE_SGMII) {
-                pdata->clk = devm_clk_get(&pdev->dev, NULL);
-                if (IS_ERR(pdata->clk)) {
+        pdata->clk = devm_clk_get(&pdev->dev, NULL);
+        if (IS_ERR(pdata->clk)) {
+                if (pdata->phy_mode != PHY_INTERFACE_MODE_SGMII) {
                         /* Abort if the clock is defined but couldn't be
                          * retrived. Always abort if the clock is missing on
                          * DT system as the driver can't cope with this case.
@@ -2097,9 +2093,11 @@ static int xgene_enet_probe(struct platform_device *pdev)
                 goto err;
         }
 
+        xgene_enet_check_phy_handle(pdata);
+
         ret = xgene_enet_init_hw(pdata);
         if (ret)
-                goto err;
+                goto err2;
 
         link_state = pdata->mac_ops->link_state;
         if (pdata->phy_mode == PHY_INTERFACE_MODE_XGMII) {
@@ -2117,29 +2115,30 @@ static int xgene_enet_probe(struct platform_device *pdev)
         spin_lock_init(&pdata->stats_lock);
         ret = xgene_extd_stats_init(pdata);
         if (ret)
-                goto err2;
+                goto err1;
 
         xgene_enet_napi_add(pdata);
         ret = register_netdev(ndev);
         if (ret) {
                 netdev_err(ndev, "Failed to register netdev\n");
-                goto err2;
+                goto err1;
         }
 
         return 0;
 
-err2:
+err1:
         /*
          * If necessary, free_netdev() will call netif_napi_del() and undo
          * the effects of xgene_enet_napi_add()'s calls to netif_napi_add().
          */
 
+        xgene_enet_delete_desc_rings(pdata);
+
+err2:
         if (pdata->mdio_driver)
                 xgene_enet_phy_disconnect(pdata);
         else if (phy_interface_mode_is_rgmii(pdata->phy_mode))
                 xgene_enet_mdio_remove(pdata);
-err1:
-        xgene_enet_delete_desc_rings(pdata);
 err:
         free_netdev(ndev);
         return ret;
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_hw.h b/drivers/net/ethernet/aquantia/atlantic/aq_hw.h
index fce0fd3f23ff..bf9b3f020e10 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_hw.h
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_hw.h
@@ -105,8 +105,7 @@ struct aq_hw_ops {
 
         int (*hw_set_mac_address)(struct aq_hw_s *self, u8 *mac_addr);
 
-        int (*hw_get_link_status)(struct aq_hw_s *self,
-                                  struct aq_hw_link_status_s *link_status);
+        int (*hw_get_link_status)(struct aq_hw_s *self);
 
         int (*hw_set_link_speed)(struct aq_hw_s *self, u32 speed);
 
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
index 9ee1c5016784..6ac9e2602d6d 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
@@ -103,6 +103,8 @@ int aq_nic_cfg_start(struct aq_nic_s *self)
         else
                 cfg->vecs = 1U;
 
+        cfg->num_rss_queues = min(cfg->vecs, AQ_CFG_NUM_RSS_QUEUES_DEF);
+
         cfg->irq_type = aq_pci_func_get_irq_type(self->aq_pci_func);
 
         if ((cfg->irq_type == AQ_HW_IRQ_LEGACY) ||
@@ -123,33 +125,30 @@ static void aq_nic_service_timer_cb(unsigned long param)
         struct net_device *ndev = aq_nic_get_ndev(self);
         int err = 0;
         unsigned int i = 0U;
-        struct aq_hw_link_status_s link_status;
         struct aq_ring_stats_rx_s stats_rx;
         struct aq_ring_stats_tx_s stats_tx;
 
         if (aq_utils_obj_test(&self->header.flags, AQ_NIC_FLAGS_IS_NOT_READY))
                 goto err_exit;
 
-        err = self->aq_hw_ops.hw_get_link_status(self->aq_hw, &link_status);
+        err = self->aq_hw_ops.hw_get_link_status(self->aq_hw);
         if (err < 0)
                 goto err_exit;
 
-        self->aq_hw_ops.hw_interrupt_moderation_set(self->aq_hw,
-                            self->aq_nic_cfg.is_interrupt_moderation);
-
-        if (memcmp(&link_status, &self->link_status, sizeof(link_status))) {
-                if (link_status.mbps) {
-                        aq_utils_obj_set(&self->header.flags,
-                                         AQ_NIC_FLAG_STARTED);
-                        aq_utils_obj_clear(&self->header.flags,
-                                           AQ_NIC_LINK_DOWN);
-                        netif_carrier_on(self->ndev);
-                } else {
-                        netif_carrier_off(self->ndev);
-                        aq_utils_obj_set(&self->header.flags, AQ_NIC_LINK_DOWN);
-                }
+        self->link_status = self->aq_hw->aq_link_status;
 
-                self->link_status = link_status;
+        self->aq_hw_ops.hw_interrupt_moderation_set(self->aq_hw,
+                    self->aq_nic_cfg.is_interrupt_moderation);
+
+        if (self->link_status.mbps) {
+                aq_utils_obj_set(&self->header.flags,
+                                 AQ_NIC_FLAG_STARTED);
+                aq_utils_obj_clear(&self->header.flags,
+                                   AQ_NIC_LINK_DOWN);
+                netif_carrier_on(self->ndev);
+        } else {
+                netif_carrier_off(self->ndev);
+                aq_utils_obj_set(&self->header.flags, AQ_NIC_LINK_DOWN);
         }
 
         memset(&stats_rx, 0U, sizeof(struct aq_ring_stats_rx_s));
@@ -597,14 +596,11 @@ exit:
 }
 
 int aq_nic_xmit(struct aq_nic_s *self, struct sk_buff *skb)
-__releases(&ring->lock)
-__acquires(&ring->lock)
 {
         struct aq_ring_s *ring = NULL;
         unsigned int frags = 0U;
         unsigned int vec = skb->queue_mapping % self->aq_nic_cfg.vecs;
         unsigned int tc = 0U;
-        unsigned int trys = AQ_CFG_LOCK_TRYS;
         int err = NETDEV_TX_OK;
         bool is_nic_in_bad_state;
 
@@ -628,36 +624,21 @@ __acquires(&ring->lock)
                 goto err_exit;
         }
 
-        do {
-                if (spin_trylock(&ring->header.lock)) {
-                        frags = aq_nic_map_skb(self, skb, ring);
-
-                        if (likely(frags)) {
-                                err = self->aq_hw_ops.hw_ring_tx_xmit(
-                                                                self->aq_hw,
-                                                                ring, frags);
-                                if (err >= 0) {
-                                        if (aq_ring_avail_dx(ring) <
-                                            AQ_CFG_SKB_FRAGS_MAX + 1)
-                                                aq_nic_ndev_queue_stop(
-                                                                self,
-                                                                ring->idx);
-
-                                        ++ring->stats.tx.packets;
-                                        ring->stats.tx.bytes += skb->len;
-                                }
-                        } else {
-                                err = NETDEV_TX_BUSY;
-                        }
+        frags = aq_nic_map_skb(self, skb, ring);
 
-                        spin_unlock(&ring->header.lock);
-                        break;
-                }
-        } while (--trys);
+        if (likely(frags)) {
+                err = self->aq_hw_ops.hw_ring_tx_xmit(self->aq_hw,
+                                                      ring,
+                                                      frags);
+                if (err >= 0) {
+                        if (aq_ring_avail_dx(ring) < AQ_CFG_SKB_FRAGS_MAX + 1)
+                                aq_nic_ndev_queue_stop(self, ring->idx);
 
-        if (!trys) {
+                        ++ring->stats.tx.packets;
+                        ring->stats.tx.bytes += skb->len;
+                }
+        } else {
                 err = NETDEV_TX_BUSY;
-                goto err_exit;
         }
 
 err_exit:
@@ -688,11 +669,26 @@ int aq_nic_set_multicast_list(struct aq_nic_s *self, struct net_device *ndev)
         netdev_for_each_mc_addr(ha, ndev) {
                 ether_addr_copy(self->mc_list.ar[i++], ha->addr);
                 ++self->mc_list.count;
+
+                if (i >= AQ_CFG_MULTICAST_ADDRESS_MAX)
+                        break;
         }
 
-        return self->aq_hw_ops.hw_multicast_list_set(self->aq_hw,
+        if (i >= AQ_CFG_MULTICAST_ADDRESS_MAX) {
+                /* Number of filters is too big: atlantic does not support this.
+                 * Force all multi filter to support this.
+                 * With this we disable all UC filters and setup "all pass"
+                 * multicast mask
+                 */
+                self->packet_filter |= IFF_ALLMULTI;
+                self->aq_hw->aq_nic_cfg->mc_list_count = 0;
+                return self->aq_hw_ops.hw_packet_filter_set(self->aq_hw,
+                                                        self->packet_filter);
+        } else {
+                return self->aq_hw_ops.hw_multicast_list_set(self->aq_hw,
                                                     self->mc_list.ar,
                                                     self->mc_list.count);
+        }
 }
 
 int aq_nic_set_mtu(struct aq_nic_s *self, int new_mtu)
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
index 9a0817938eca..ec5579fb8268 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
@@ -101,7 +101,6 @@ int aq_ring_init(struct aq_ring_s *self)
         self->hw_head = 0;
         self->sw_head = 0;
         self->sw_tail = 0;
-        spin_lock_init(&self->header.lock);
         return 0;
 }
 
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_utils.h b/drivers/net/ethernet/aquantia/atlantic/aq_utils.h
index f6012b34abe6..e12bcdfb874a 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_utils.h
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_utils.h
@@ -17,7 +17,6 @@
 #define AQ_DIMOF(_ARY_)  ARRAY_SIZE(_ARY_)
 
 struct aq_obj_s {
-        spinlock_t lock; /* spinlock for nic/rings processing */
         atomic_t flags;
 };
 
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_vec.c b/drivers/net/ethernet/aquantia/atlantic/aq_vec.c
index ad5b4d4dac7f..fee446af748f 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_vec.c
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_vec.c
@@ -34,8 +34,6 @@ struct aq_vec_s {
 #define AQ_VEC_RX_ID 1
 
 static int aq_vec_poll(struct napi_struct *napi, int budget)
-__releases(&self->lock)
-__acquires(&self->lock)
 {
         struct aq_vec_s *self = container_of(napi, struct aq_vec_s, napi);
         struct aq_ring_s *ring = NULL;
@@ -47,7 +45,7 @@ __acquires(&self->lock)
 
         if (!self) {
                 err = -EINVAL;
-        } else if (spin_trylock(&self->header.lock)) {
+        } else {
                 for (i = 0U, ring = self->ring[0];
                         self->tx_rings > i; ++i, ring = self->ring[i]) {
                         if (self->aq_hw_ops->hw_ring_tx_head_update) {
@@ -105,11 +103,8 @@ __acquires(&self->lock)
                         self->aq_hw_ops->hw_irq_enable(self->aq_hw,
                                         1U << self->aq_ring_param.vec_idx);
                 }
-
-err_exit:
-                spin_unlock(&self->header.lock);
         }
-
+err_exit:
         return work_done;
 }
 
@@ -185,8 +180,6 @@ int aq_vec_init(struct aq_vec_s *self, struct aq_hw_ops *aq_hw_ops,
         self->aq_hw_ops = aq_hw_ops;
         self->aq_hw = aq_hw;
 
-        spin_lock_init(&self->header.lock);
-
         for (i = 0U, ring = self->ring[0];
                 self->tx_rings > i; ++i, ring = self->ring[i]) {
                 err = aq_ring_init(&ring[AQ_VEC_TX_ID]);
diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c
index faeb4935ef3e..c5a02df7a48b 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c
@@ -629,6 +629,12 @@ static int hw_atl_a0_hw_ring_rx_receive(struct aq_hw_s *self,
                                 buff->is_udp_cso = (is_err & 0x10U) ? 0 : 1;
                         else if (0x0U == (pkt_type & 0x1CU))
                                 buff->is_tcp_cso = (is_err & 0x10U) ? 0 : 1;
+
+                        /* Checksum offload workaround for small packets */
+                        if (rxd_wb->pkt_len <= 60) {
+                                buff->is_ip_cso = 0U;
+                                buff->is_cso_err = 0U;
+                        }
                 }
 
                 is_err &= ~0x18U;
diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
index 1bceb7358e5c..21784cc39dab 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
@@ -645,6 +645,12 @@ static int hw_atl_b0_hw_ring_rx_receive(struct aq_hw_s *self,
                                 buff->is_udp_cso = buff->is_cso_err ? 0U : 1U;
                         else if (0x0U == (pkt_type & 0x1CU))
                                 buff->is_tcp_cso = buff->is_cso_err ? 0U : 1U;
+
+                        /* Checksum offload workaround for small packets */
+                        if (rxd_wb->pkt_len <= 60) {
+                                buff->is_ip_cso = 0U;
+                                buff->is_cso_err = 0U;
+                        }
                 }
 
                 is_err &= ~0x18U;
diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c
index 8d6d8f5804da..4f5ec9a0fbfb 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c
@@ -141,6 +141,12 @@ static int hw_atl_utils_init_ucp(struct aq_hw_s *self,
 
         err = hw_atl_utils_ver_match(aq_hw_caps->fw_ver_expected,
                                      aq_hw_read_reg(self, 0x18U));
+
+        if (err < 0)
+                pr_err("%s: Bad FW version detected: expected=%x, actual=%x\n",
+                       AQ_CFG_DRV_NAME,
+                       aq_hw_caps->fw_ver_expected,
+                       aq_hw_read_reg(self, 0x18U));
         return err;
 }
 
@@ -313,11 +319,11 @@ void hw_atl_utils_mpi_set(struct aq_hw_s *self,
 err_exit:;
 }
 
-int hw_atl_utils_mpi_get_link_status(struct aq_hw_s *self,
-                                     struct aq_hw_link_status_s *link_status)
+int hw_atl_utils_mpi_get_link_status(struct aq_hw_s *self)
 {
         u32 cp0x036C = aq_hw_read_reg(self, HW_ATL_MPI_STATE_ADR);
         u32 link_speed_mask = cp0x036C >> HW_ATL_MPI_SPEED_SHIFT;
+        struct aq_hw_link_status_s *link_status = &self->aq_link_status;
 
         if (!link_speed_mask) {
                 link_status->mbps = 0U;
diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.h b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.h
index a66aee51ab5b..e0360a6b2202 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.h
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.h
@@ -180,8 +180,7 @@ void hw_atl_utils_mpi_set(struct aq_hw_s *self,
 int hw_atl_utils_mpi_set_speed(struct aq_hw_s *self, u32 speed,
                                enum hal_atl_utils_fw_state_e state);
 
-int hw_atl_utils_mpi_get_link_status(struct aq_hw_s *self,
-                                     struct aq_hw_link_status_s *link_status);
+int hw_atl_utils_mpi_get_link_status(struct aq_hw_s *self);
 
 int hw_atl_utils_get_mac_permanent(struct aq_hw_s *self,
                                    struct aq_hw_caps_s *aq_hw_caps,
diff --git a/drivers/net/ethernet/aurora/nb8800.c b/drivers/net/ethernet/aurora/nb8800.c
index 041cfb7952f8..e94159507847 100644
--- a/drivers/net/ethernet/aurora/nb8800.c
+++ b/drivers/net/ethernet/aurora/nb8800.c
@@ -609,7 +609,7 @@ static void nb8800_mac_config(struct net_device *dev)
                 mac_mode |= HALF_DUPLEX;
 
         if (gigabit) {
-                if (priv->phy_mode == PHY_INTERFACE_MODE_RGMII)
+                if (phy_interface_is_rgmii(dev->phydev))
                         mac_mode |= RGMII_MODE;
 
                 mac_mode |= GMAC_MODE;
@@ -1268,11 +1268,10 @@ static int nb8800_tangox_init(struct net_device *dev)
                 break;
 
         case PHY_INTERFACE_MODE_RGMII:
-                pad_mode = PAD_MODE_RGMII;
-                break;
-
+        case PHY_INTERFACE_MODE_RGMII_ID:
+        case PHY_INTERFACE_MODE_RGMII_RXID:
         case PHY_INTERFACE_MODE_RGMII_TXID:
-                pad_mode = PAD_MODE_RGMII | PAD_MODE_GTX_CLK_DELAY;
+                pad_mode = PAD_MODE_RGMII;
                 break;
 
         default:
diff --git a/drivers/net/ethernet/broadcom/b44.c b/drivers/net/ethernet/broadcom/b44.c
index f411936b744c..a1125d10c825 100644
--- a/drivers/net/ethernet/broadcom/b44.c
+++ b/drivers/net/ethernet/broadcom/b44.c
@@ -2368,6 +2368,7 @@ static int b44_init_one(struct ssb_device *sdev,
         bp->msg_enable = netif_msg_init(b44_debug, B44_DEF_MSG_ENABLE);
 
         spin_lock_init(&bp->lock);
+        u64_stats_init(&bp->hw_stats.syncp);
 
         bp->rx_pending = B44_DEF_RX_RING_PENDING;
         bp->tx_pending = B44_DEF_TX_RING_PENDING;
diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
index 5333601f855f..c28fa5a8734c 100644
--- a/drivers/net/ethernet/broadcom/bcmsysport.c
+++ b/drivers/net/ethernet/broadcom/bcmsysport.c
@@ -449,6 +449,10 @@ static void bcm_sysport_get_stats(struct net_device *dev,
                         p = (char *)&dev->stats;
                 else
                         p = (char *)priv;
+
+                if (priv->is_lite && !bcm_sysport_lite_stat_valid(s->type))
+                        continue;
+
                 p += s->stat_offset;
                 data[j] = *(unsigned long *)p;
                 j++;
@@ -593,7 +597,7 @@ static int bcm_sysport_set_coalesce(struct net_device *dev,
 
 static void bcm_sysport_free_cb(struct bcm_sysport_cb *cb)
 {
-        dev_kfree_skb_any(cb->skb);
+        dev_consume_skb_any(cb->skb);
         cb->skb = NULL;
         dma_unmap_addr_set(cb, dma_addr, 0);
 }
@@ -1342,6 +1346,8 @@ static int bcm_sysport_init_tx_ring(struct bcm_sysport_priv *priv,
 
         ring->cbs = kcalloc(size, sizeof(struct bcm_sysport_cb), GFP_KERNEL);
         if (!ring->cbs) {
+                dma_free_coherent(kdev, sizeof(struct dma_desc),
+                                  ring->desc_cpu, ring->desc_dma);
                 netif_err(priv, hw, priv->netdev, "CB allocation failed\n");
                 return -ENOMEM;
         }
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index e7c8539cbddf..f20b3d2a4c23 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -4647,7 +4647,6 @@ static int bnxt_hwrm_func_qcaps(struct bnxt *bp)
                 pf->port_id = le16_to_cpu(resp->port_id);
                 bp->dev->dev_port = pf->port_id;
                 memcpy(pf->mac_addr, resp->mac_address, ETH_ALEN);
-                memcpy(bp->dev->dev_addr, pf->mac_addr, ETH_ALEN);
                 pf->max_rsscos_ctxs = le16_to_cpu(resp->max_rsscos_ctx);
                 pf->max_cp_rings = le16_to_cpu(resp->max_cmpl_rings);
                 pf->max_tx_rings = le16_to_cpu(resp->max_tx_rings);
@@ -4687,16 +4686,6 @@ static int bnxt_hwrm_func_qcaps(struct bnxt *bp)
                 vf->max_stat_ctxs = le16_to_cpu(resp->max_stat_ctx);
 
                 memcpy(vf->mac_addr, resp->mac_address, ETH_ALEN);
-                mutex_unlock(&bp->hwrm_cmd_lock);
-
-                if (is_valid_ether_addr(vf->mac_addr)) {
-                        /* overwrite netdev dev_adr with admin VF MAC */
-                        memcpy(bp->dev->dev_addr, vf->mac_addr, ETH_ALEN);
-                } else {
-                        eth_hw_addr_random(bp->dev);
-                        rc = bnxt_approve_mac(bp, bp->dev->dev_addr);
-                }
-                return rc;
 #endif
         }
 
@@ -7152,6 +7141,7 @@ int bnxt_setup_mq_tc(struct net_device *dev, u8 tc)
                 bp->tx_nr_rings = bp->tx_nr_rings_per_tc;
                 netdev_reset_tc(dev);
         }
+        bp->tx_nr_rings += bp->tx_nr_rings_xdp;
         bp->cp_nr_rings = sh ? max_t(int, bp->tx_nr_rings, bp->rx_nr_rings) :
                                bp->tx_nr_rings + bp->rx_nr_rings;
         bp->num_stat_ctxs = bp->cp_nr_rings;
@@ -7661,6 +7651,28 @@ void bnxt_restore_pf_fw_resources(struct bnxt *bp)
         bnxt_subtract_ulp_resources(bp, BNXT_ROCE_ULP);
 }
 
+static int bnxt_init_mac_addr(struct bnxt *bp)
+{
+        int rc = 0;
+
+        if (BNXT_PF(bp)) {
+                memcpy(bp->dev->dev_addr, bp->pf.mac_addr, ETH_ALEN);
+        } else {
+#ifdef CONFIG_BNXT_SRIOV
+                struct bnxt_vf_info *vf = &bp->vf;
+
+                if (is_valid_ether_addr(vf->mac_addr)) {
+                        /* overwrite netdev dev_adr with admin VF MAC */
+                        memcpy(bp->dev->dev_addr, vf->mac_addr, ETH_ALEN);
+                } else {
+                        eth_hw_addr_random(bp->dev);
+                        rc = bnxt_approve_mac(bp, bp->dev->dev_addr);
+                }
+#endif
+        }
+        return rc;
+}
+
 static void bnxt_parse_log_pcie_link(struct bnxt *bp)
 {
         enum pcie_link_width width = PCIE_LNK_WIDTH_UNKNOWN;
@@ -7789,7 +7801,12 @@ static int bnxt_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
                 rc = -1;
                 goto init_err_pci_clean;
         }
-
+        rc = bnxt_init_mac_addr(bp);
+        if (rc) {
+                dev_err(&pdev->dev, "Unable to initialize mac address.\n");
+                rc = -EADDRNOTAVAIL;
+                goto init_err_pci_clean;
+        }
         rc = bnxt_hwrm_queue_qportcfg(bp);
         if (rc) {
                 netdev_err(bp->dev, "hwrm query qportcfg failure rc: %x\n",
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c
index 77da75a55c02..997e10e8b863 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c
@@ -84,6 +84,8 @@ static int bnxt_unregister_dev(struct bnxt_en_dev *edev, int ulp_id)
 
                 max_stat_ctxs = bnxt_get_max_func_stat_ctxs(bp);
                 bnxt_set_max_func_stat_ctxs(bp, max_stat_ctxs + 1);
+                if (ulp->msix_requested)
+                        edev->en_ops->bnxt_free_msix(edev, ulp_id);
         }
         if (ulp->max_async_event_id)
                 bnxt_hwrm_func_rgtr_async_events(bp, NULL, 0);
diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
index 7b0b399aaedd..fea3f9a5fb2d 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
@@ -1360,7 +1360,7 @@ static unsigned int __bcmgenet_tx_reclaim(struct net_device *dev,
                 if (skb) {
                         pkts_compl++;
                         bytes_compl += GENET_CB(skb)->bytes_sent;
-                        dev_kfree_skb_any(skb);
+                        dev_consume_skb_any(skb);
                 }
 
                 txbds_processed++;
@@ -1875,7 +1875,7 @@ static int bcmgenet_alloc_rx_buffers(struct bcmgenet_priv *priv,
                 cb = ring->cbs + i;
                 skb = bcmgenet_rx_refill(priv, cb);
                 if (skb)
-                        dev_kfree_skb_any(skb);
+                        dev_consume_skb_any(skb);
                 if (!cb->skb)
                         return -ENOMEM;
         }
@@ -1894,7 +1894,7 @@ static void bcmgenet_free_rx_buffers(struct bcmgenet_priv *priv)
 
                 skb = bcmgenet_free_rx_cb(&priv->pdev->dev, cb);
                 if (skb)
-                        dev_kfree_skb_any(skb);
+                        dev_consume_skb_any(skb);
         }
 }
 
@@ -3669,7 +3669,7 @@ static int bcmgenet_resume(struct device *d)
 
         phy_init_hw(priv->phydev);
         /* Speed settings must be restored */
-        bcmgenet_mii_config(priv->dev);
+        bcmgenet_mii_config(priv->dev, false);
 
         /* disable ethernet MAC while updating its registers */
         umac_enable_set(priv, CMD_TX_EN | CMD_RX_EN, false);
diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.h b/drivers/net/ethernet/broadcom/genet/bcmgenet.h
index b9344de669f8..3a34fdba5301 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.h
+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.h
@@ -698,7 +698,7 @@ GENET_IO_MACRO(rbuf, GENET_RBUF_OFF);
 
 /* MDIO routines */
 int bcmgenet_mii_init(struct net_device *dev);
-int bcmgenet_mii_config(struct net_device *dev);
+int bcmgenet_mii_config(struct net_device *dev, bool init);
 int bcmgenet_mii_probe(struct net_device *dev);
 void bcmgenet_mii_exit(struct net_device *dev);
 void bcmgenet_mii_reset(struct net_device *dev);
diff --git a/drivers/net/ethernet/broadcom/genet/bcmmii.c b/drivers/net/ethernet/broadcom/genet/bcmmii.c
index 071fcbd14e6a..30cb97b4a1d7 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmmii.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmmii.c
@@ -238,7 +238,7 @@ static void bcmgenet_moca_phy_setup(struct bcmgenet_priv *priv)
                                           bcmgenet_fixed_phy_link_update);
 }
 
-int bcmgenet_mii_config(struct net_device *dev)
+int bcmgenet_mii_config(struct net_device *dev, bool init)
 {
         struct bcmgenet_priv *priv = netdev_priv(dev);
         struct phy_device *phydev = priv->phydev;
@@ -327,7 +327,8 @@ int bcmgenet_mii_config(struct net_device *dev)
                 bcmgenet_ext_writel(priv, reg, EXT_RGMII_OOB_CTRL);
         }
 
-        dev_info_once(kdev, "configuring instance for %s\n", phy_name);
+        if (init)
+                dev_info(kdev, "configuring instance for %s\n", phy_name);
 
         return 0;
 }
@@ -375,7 +376,7 @@ int bcmgenet_mii_probe(struct net_device *dev)
          * PHY speed which is needed for bcmgenet_mii_config() to configure
          * things appropriately.
          */
-        ret = bcmgenet_mii_config(dev);
+        ret = bcmgenet_mii_config(dev, true);
         if (ret) {
                 phy_disconnect(priv->phydev);
                 return ret;
diff --git a/drivers/net/ethernet/cavium/thunder/thunder_bgx.c b/drivers/net/ethernet/cavium/thunder/thunder_bgx.c
index 79112563a25a..5e5c4d7796b8 100644
--- a/drivers/net/ethernet/cavium/thunder/thunder_bgx.c
+++ b/drivers/net/ethernet/cavium/thunder/thunder_bgx.c
@@ -292,11 +292,30 @@ static void bgx_sgmii_change_link_state(struct lmac *lmac)
         u64 cmr_cfg;
         u64 port_cfg = 0;
         u64 misc_ctl = 0;
+        bool tx_en, rx_en;
 
         cmr_cfg = bgx_reg_read(bgx, lmac->lmacid, BGX_CMRX_CFG);
-        cmr_cfg &= ~CMR_EN;
+        tx_en = cmr_cfg & CMR_PKT_TX_EN;
+        rx_en = cmr_cfg & CMR_PKT_RX_EN;
+        cmr_cfg &= ~(CMR_PKT_RX_EN | CMR_PKT_TX_EN);
         bgx_reg_write(bgx, lmac->lmacid, BGX_CMRX_CFG, cmr_cfg);
 
+        /* Wait for BGX RX to be idle */
+        if (bgx_poll_reg(bgx, lmac->lmacid, BGX_GMP_GMI_PRTX_CFG,
+                         GMI_PORT_CFG_RX_IDLE, false)) {
+                dev_err(&bgx->pdev->dev, "BGX%d LMAC%d GMI RX not idle\n",
+                        bgx->bgx_id, lmac->lmacid);
+                return;
+        }
+
+        /* Wait for BGX TX to be idle */
+        if (bgx_poll_reg(bgx, lmac->lmacid, BGX_GMP_GMI_PRTX_CFG,
+                         GMI_PORT_CFG_TX_IDLE, false)) {
+                dev_err(&bgx->pdev->dev, "BGX%d LMAC%d GMI TX not idle\n",
+                        bgx->bgx_id, lmac->lmacid);
+                return;
+        }
+
         port_cfg = bgx_reg_read(bgx, lmac->lmacid, BGX_GMP_GMI_PRTX_CFG);
         misc_ctl = bgx_reg_read(bgx, lmac->lmacid, BGX_GMP_PCS_MISCX_CTL);
 
@@ -347,10 +366,8 @@ static void bgx_sgmii_change_link_state(struct lmac *lmac)
         bgx_reg_write(bgx, lmac->lmacid, BGX_GMP_PCS_MISCX_CTL, misc_ctl);
         bgx_reg_write(bgx, lmac->lmacid, BGX_GMP_GMI_PRTX_CFG, port_cfg);
 
-        port_cfg = bgx_reg_read(bgx, lmac->lmacid, BGX_GMP_GMI_PRTX_CFG);
-
-        /* Re-enable lmac */
-        cmr_cfg |= CMR_EN;
+        /* Restore CMR config settings */
+        cmr_cfg |= (rx_en ? CMR_PKT_RX_EN : 0) | (tx_en ? CMR_PKT_TX_EN : 0);
         bgx_reg_write(bgx, lmac->lmacid, BGX_CMRX_CFG, cmr_cfg);
 
         if (bgx->is_rgx && (cmr_cfg & (CMR_PKT_RX_EN | CMR_PKT_TX_EN)))
diff --git a/drivers/net/ethernet/cavium/thunder/thunder_bgx.h b/drivers/net/ethernet/cavium/thunder/thunder_bgx.h
index 6b7fe6fdd13b..23acdc5ab896 100644
--- a/drivers/net/ethernet/cavium/thunder/thunder_bgx.h
+++ b/drivers/net/ethernet/cavium/thunder/thunder_bgx.h
@@ -170,6 +170,8 @@
 #define  GMI_PORT_CFG_DUPLEX                    BIT_ULL(2)
 #define  GMI_PORT_CFG_SLOT_TIME                 BIT_ULL(3)
 #define  GMI_PORT_CFG_SPEED_MSB                 BIT_ULL(8)
+#define  GMI_PORT_CFG_RX_IDLE                   BIT_ULL(12)
+#define  GMI_PORT_CFG_TX_IDLE                   BIT_ULL(13)
 #define BGX_GMP_GMI_RXX_JABBER          0x38038
 #define BGX_GMP_GMI_TXX_THRESH          0x38210
 #define BGX_GMP_GMI_TXX_APPEND          0x38218
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h b/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
index ef4be781fd05..09ea62ee96d3 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
@@ -529,6 +529,7 @@ enum {                                 /* adapter flags */
         USING_SOFT_PARAMS  = (1 << 6),
         MASTER_PF          = (1 << 7),
         FW_OFLD_CONN       = (1 << 9),
+        ROOT_NO_RELAXED_ORDERING = (1 << 10),
 };
 
 enum {
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index e403fa18f1b1..33bb8678833a 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -4654,11 +4654,6 @@ static void print_port_info(const struct net_device *dev)
                     dev->name, adap->params.vpd.id, adap->name, buf);
 }
 
-static void enable_pcie_relaxed_ordering(struct pci_dev *dev)
-{
-        pcie_capability_set_word(dev, PCI_EXP_DEVCTL, PCI_EXP_DEVCTL_RELAX_EN);
-}
-
 /*
  * Free the following resources:
  * - memory used for tables
@@ -4908,7 +4903,6 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         }
 
         pci_enable_pcie_error_reporting(pdev);
-        enable_pcie_relaxed_ordering(pdev);
         pci_set_master(pdev);
         pci_save_state(pdev);
 
@@ -4947,6 +4941,23 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         adapter->msg_enable = DFLT_MSG_ENABLE;
         memset(adapter->chan_map, 0xff, sizeof(adapter->chan_map));
 
+        /* If possible, we use PCIe Relaxed Ordering Attribute to deliver
+         * Ingress Packet Data to Free List Buffers in order to allow for
+         * chipset performance optimizations between the Root Complex and
+         * Memory Controllers.  (Messages to the associated Ingress Queue
+         * notifying new Packet Placement in the Free Lists Buffers will be
+         * send without the Relaxed Ordering Attribute thus guaranteeing that
+         * all preceding PCIe Transaction Layer Packets will be processed
+         * first.)  But some Root Complexes have various issues with Upstream
+         * Transaction Layer Packets with the Relaxed Ordering Attribute set.
+         * The PCIe devices which under the Root Complexes will be cleared the
+         * Relaxed Ordering bit in the configuration space, So we check our
+         * PCIe configuration space to see if it's flagged with advice against
+         * using Relaxed Ordering.
+         */
+        if (!pcie_relaxed_ordering_enabled(pdev))
+                adapter->flags |= ROOT_NO_RELAXED_ORDERING;
+
         spin_lock_init(&adapter->stats_lock);
         spin_lock_init(&adapter->tid_release_lock);
         spin_lock_init(&adapter->win0_lock);
diff --git a/drivers/net/ethernet/chelsio/cxgb4/sge.c b/drivers/net/ethernet/chelsio/cxgb4/sge.c
index ede12209f20b..4ef68f69b58c 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/sge.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/sge.c
@@ -2719,6 +2719,7 @@ int t4_sge_alloc_rxq(struct adapter *adap, struct sge_rspq *iq, bool fwevtq,
         struct fw_iq_cmd c;
         struct sge *s = &adap->sge;
         struct port_info *pi = netdev_priv(dev);
+        int relaxed = !(adap->flags & ROOT_NO_RELAXED_ORDERING);
 
         /* Size needs to be multiple of 16, including status entry. */
         iq->size = roundup(iq->size, 16);
@@ -2772,8 +2773,8 @@ int t4_sge_alloc_rxq(struct adapter *adap, struct sge_rspq *iq, bool fwevtq,
 
                 flsz = fl->size / 8 + s->stat_len / sizeof(struct tx_desc);
                 c.iqns_to_fl0congen |= htonl(FW_IQ_CMD_FL0PACKEN_F |
-                                             FW_IQ_CMD_FL0FETCHRO_F |
-                                             FW_IQ_CMD_FL0DATARO_F |
+                                             FW_IQ_CMD_FL0FETCHRO_V(relaxed) |
+                                             FW_IQ_CMD_FL0DATARO_V(relaxed) |
                                              FW_IQ_CMD_FL0PADEN_F);
                 if (cong >= 0)
                         c.iqns_to_fl0congen |=
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
index 82bf7aac6cdb..0293b41171a5 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
@@ -369,12 +369,12 @@ int t4_wr_mbox_meat_timeout(struct adapter *adap, int mbox, const void *cmd,
                 list_del(&entry.list);
                 spin_unlock(&adap->mbox_lock);
                 ret = (v == MBOX_OWNER_FW) ? -EBUSY : -ETIMEDOUT;
-                t4_record_mbox(adap, cmd, MBOX_LEN, access, ret);
+                t4_record_mbox(adap, cmd, size, access, ret);
                 return ret;
         }
 
         /* Copy in the new mailbox command and send it on its way ... */
-        t4_record_mbox(adap, cmd, MBOX_LEN, access, 0);
+        t4_record_mbox(adap, cmd, size, access, 0);
         for (i = 0; i < size; i += 8)
                 t4_write_reg64(adap, data_reg + i, be64_to_cpu(*p++));
 
@@ -426,7 +426,7 @@ int t4_wr_mbox_meat_timeout(struct adapter *adap, int mbox, const void *cmd,
         }
 
         ret = (pcie_fw & PCIE_FW_ERR_F) ? -ENXIO : -ETIMEDOUT;
-        t4_record_mbox(adap, cmd, MBOX_LEN, access, ret);
+        t4_record_mbox(adap, cmd, size, access, ret);
         dev_err(adap->pdev_dev, "command %#x in mailbox %d timed out\n",
                 *(const u8 *)cmd, mbox);
         t4_report_fw_error(adap);
diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/adapter.h b/drivers/net/ethernet/chelsio/cxgb4vf/adapter.h
index 109bc630408b..08c6ddb84a04 100644
--- a/drivers/net/ethernet/chelsio/cxgb4vf/adapter.h
+++ b/drivers/net/ethernet/chelsio/cxgb4vf/adapter.h
@@ -408,6 +408,7 @@ enum { /* adapter flags */
         USING_MSI          = (1UL << 1),
         USING_MSIX         = (1UL << 2),
         QUEUES_BOUND       = (1UL << 3),
+        ROOT_NO_RELAXED_ORDERING = (1UL << 4),
 };
 
 /*
diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c b/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c
index ac7a150c54e9..2b85b874fd0d 100644
--- a/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c
@@ -2888,6 +2888,24 @@ static int cxgb4vf_pci_probe(struct pci_dev *pdev,
          */
         adapter->name = pci_name(pdev);
         adapter->msg_enable = DFLT_MSG_ENABLE;
+
+        /* If possible, we use PCIe Relaxed Ordering Attribute to deliver
+         * Ingress Packet Data to Free List Buffers in order to allow for
+         * chipset performance optimizations between the Root Complex and
+         * Memory Controllers.  (Messages to the associated Ingress Queue
+         * notifying new Packet Placement in the Free Lists Buffers will be
+         * send without the Relaxed Ordering Attribute thus guaranteeing that
+         * all preceding PCIe Transaction Layer Packets will be processed
+         * first.)  But some Root Complexes have various issues with Upstream
+         * Transaction Layer Packets with the Relaxed Ordering Attribute set.
+         * The PCIe devices which under the Root Complexes will be cleared the
+         * Relaxed Ordering bit in the configuration space, So we check our
+         * PCIe configuration space to see if it's flagged with advice against
+         * using Relaxed Ordering.
+         */
+        if (!pcie_relaxed_ordering_enabled(pdev))
+                adapter->flags |= ROOT_NO_RELAXED_ORDERING;
+
         err = adap_init0(adapter);
         if (err)
                 goto err_unmap_bar;
diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/sge.c b/drivers/net/ethernet/chelsio/cxgb4vf/sge.c
index e37dde2ba97f..05498e7f2840 100644
--- a/drivers/net/ethernet/chelsio/cxgb4vf/sge.c
+++ b/drivers/net/ethernet/chelsio/cxgb4vf/sge.c
@@ -2205,6 +2205,7 @@ int t4vf_sge_alloc_rxq(struct adapter *adapter, struct sge_rspq *rspq,
         struct port_info *pi = netdev_priv(dev);
         struct fw_iq_cmd cmd, rpl;
         int ret, iqandst, flsz = 0;
+        int relaxed = !(adapter->flags & ROOT_NO_RELAXED_ORDERING);
 
         /*
          * If we're using MSI interrupts and we're not initializing the
@@ -2300,6 +2301,8 @@ int t4vf_sge_alloc_rxq(struct adapter *adapter, struct sge_rspq *rspq,
                         cpu_to_be32(
                                 FW_IQ_CMD_FL0HOSTFCMODE_V(SGE_HOSTFCMODE_NONE) |
                                 FW_IQ_CMD_FL0PACKEN_F |
+                                FW_IQ_CMD_FL0FETCHRO_V(relaxed) |
+                                FW_IQ_CMD_FL0DATARO_V(relaxed) |
                                 FW_IQ_CMD_FL0PADEN_F);
 
                 /* In T6, for egress queue type FL there is internal overhead
diff --git a/drivers/net/ethernet/faraday/ftgmac100.c b/drivers/net/ethernet/faraday/ftgmac100.c
index 95bf5e89cfd1..59da7ac3c108 100644
--- a/drivers/net/ethernet/faraday/ftgmac100.c
+++ b/drivers/net/ethernet/faraday/ftgmac100.c
@@ -125,7 +125,7 @@ static int ftgmac100_reset_mac(struct ftgmac100 *priv, u32 maccr)
         iowrite32(maccr, priv->base + FTGMAC100_OFFSET_MACCR);
         iowrite32(maccr | FTGMAC100_MACCR_SW_RST,
                   priv->base + FTGMAC100_OFFSET_MACCR);
-        for (i = 0; i < 50; i++) {
+        for (i = 0; i < 200; i++) {
                 unsigned int maccr;
 
                 maccr = ioread32(priv->base + FTGMAC100_OFFSET_MACCR);
@@ -392,7 +392,7 @@ static int ftgmac100_alloc_rx_buf(struct ftgmac100 *priv, unsigned int entry,
         struct net_device *netdev = priv->netdev;
         struct sk_buff *skb;
         dma_addr_t map;
-        int err;
+        int err = 0;
 
         skb = netdev_alloc_skb_ip_align(netdev, RX_BUF_SIZE);
         if (unlikely(!skb)) {
@@ -428,7 +428,7 @@ static int ftgmac100_alloc_rx_buf(struct ftgmac100 *priv, unsigned int entry,
         else
                 rxdes->rxdes0 = 0;
 
-        return 0;
+        return err;
 }
 
 static unsigned int ftgmac100_next_rx_pointer(struct ftgmac100 *priv,
@@ -1682,6 +1682,7 @@ static int ftgmac100_setup_mdio(struct net_device *netdev)
         priv->mii_bus->name = "ftgmac100_mdio";
         snprintf(priv->mii_bus->id, MII_BUS_ID_SIZE, "%s-%d",
                  pdev->name, pdev->id);
+        priv->mii_bus->parent = priv->dev;
         priv->mii_bus->priv = priv->netdev;
         priv->mii_bus->read = ftgmac100_mdiobus_read;
         priv->mii_bus->write = ftgmac100_mdiobus_write;
@@ -1862,7 +1863,6 @@ err_setup_mdio:
 err_ioremap:
         release_resource(priv->res);
 err_req_mem:
-        netif_napi_del(&priv->napi);
         free_netdev(netdev);
 err_alloc_etherdev:
         return err;
diff --git a/drivers/net/ethernet/freescale/fman/mac.c b/drivers/net/ethernet/freescale/fman/mac.c
index 6e67d22fd0d5..1c7da16ad0ff 100644
--- a/drivers/net/ethernet/freescale/fman/mac.c
+++ b/drivers/net/ethernet/freescale/fman/mac.c
@@ -623,6 +623,8 @@ static struct platform_device *dpaa_eth_add_device(int fman_id,
                 goto no_mem;
         }
 
+        pdev->dev.of_node = node;
+        pdev->dev.parent = priv->dev;
         set_dma_ops(&pdev->dev, get_dma_ops(priv->dev));
 
         ret = platform_device_add_data(pdev, &data, sizeof(data));
diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
index a3e694679635..c45e8e3b82d3 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.c
+++ b/drivers/net/ethernet/ibm/ibmvnic.c
@@ -111,6 +111,7 @@ static void send_request_map(struct ibmvnic_adapter *, dma_addr_t, __be32, u8);
 static void send_request_unmap(struct ibmvnic_adapter *, u8);
 static void send_login(struct ibmvnic_adapter *adapter);
 static void send_cap_queries(struct ibmvnic_adapter *adapter);
+static int init_sub_crqs(struct ibmvnic_adapter *);
 static int init_sub_crq_irqs(struct ibmvnic_adapter *adapter);
 static int ibmvnic_init(struct ibmvnic_adapter *);
 static void release_crq_queue(struct ibmvnic_adapter *);
@@ -651,6 +652,7 @@ static int ibmvnic_login(struct net_device *netdev)
         struct ibmvnic_adapter *adapter = netdev_priv(netdev);
         unsigned long timeout = msecs_to_jiffies(30000);
         struct device *dev = &adapter->vdev->dev;
+        int rc;
 
         do {
                 if (adapter->renegotiate) {
@@ -664,6 +666,18 @@ static int ibmvnic_login(struct net_device *netdev)
                                 dev_err(dev, "Capabilities query timeout\n");
                                 return -1;
                         }
+                        rc = init_sub_crqs(adapter);
+                        if (rc) {
+                                dev_err(dev,
+                                        "Initialization of SCRQ's failed\n");
+                                return -1;
+                        }
+                        rc = init_sub_crq_irqs(adapter);
+                        if (rc) {
+                                dev_err(dev,
+                                        "Initialization of SCRQ's irqs failed\n");
+                                return -1;
+                        }
                 }
 
                 reinit_completion(&adapter->init_done);
@@ -3004,7 +3018,6 @@ static void handle_request_cap_rsp(union ibmvnic_crq *crq,
                          *req_value,
                          (long int)be64_to_cpu(crq->request_capability_rsp.
                                                number), name);
-                release_sub_crqs(adapter);
                 *req_value = be64_to_cpu(crq->request_capability_rsp.number);
                 ibmvnic_send_req_caps(adapter, 1);
                 return;
diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.c b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
index b936febc315a..2194960d5855 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
@@ -1113,6 +1113,8 @@ int i40e_setup_tx_descriptors(struct i40e_ring *tx_ring)
         if (!tx_ring->tx_bi)
                 goto err;
 
+        u64_stats_init(&tx_ring->syncp);
+
         /* round up to nearest 4K */
         tx_ring->size = tx_ring->count * sizeof(struct i40e_tx_desc);
         /* add u32 for head writeback, align after this takes care of
diff --git a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
index 084c53582793..032f8ac06357 100644
--- a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
+++ b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
@@ -2988,6 +2988,8 @@ int ixgbevf_setup_tx_resources(struct ixgbevf_ring *tx_ring)
         if (!tx_ring->tx_buffer_info)
                 goto err;
 
+        u64_stats_init(&tx_ring->syncp);
+
         /* round up to nearest 4K */
         tx_ring->size = tx_ring->count * sizeof(union ixgbe_adv_tx_desc);
         tx_ring->size = ALIGN(tx_ring->size, 4096);
@@ -3046,6 +3048,8 @@ int ixgbevf_setup_rx_resources(struct ixgbevf_ring *rx_ring)
         if (!rx_ring->rx_buffer_info)
                 goto err;
 
+        u64_stats_init(&rx_ring->syncp);
+
         /* Round up to nearest 4K */
         rx_ring->size = rx_ring->count * sizeof(union ixgbe_adv_rx_desc);
         rx_ring->size = ALIGN(rx_ring->size, 4096);
diff --git a/drivers/net/ethernet/marvell/mv643xx_eth.c b/drivers/net/ethernet/marvell/mv643xx_eth.c
index 5794d98d946f..9c94ea9b2b80 100644
--- a/drivers/net/ethernet/marvell/mv643xx_eth.c
+++ b/drivers/net/ethernet/marvell/mv643xx_eth.c
@@ -2734,7 +2734,7 @@ static int mv643xx_eth_shared_of_add_port(struct platform_device *pdev,
         ppd.shared = pdev;
 
         memset(&res, 0, sizeof(res));
-        if (!of_irq_to_resource(pnp, 0, &res)) {
+        if (of_irq_to_resource(pnp, 0, &res) <= 0) {
                 dev_err(&pdev->dev, "missing interrupt on %s\n", pnp->name);
                 return -EINVAL;
         }
diff --git a/drivers/net/ethernet/marvell/mvpp2.c b/drivers/net/ethernet/marvell/mvpp2.c
index 48d21c1e09f2..4d598ca8503a 100644
--- a/drivers/net/ethernet/marvell/mvpp2.c
+++ b/drivers/net/ethernet/marvell/mvpp2.c
@@ -6504,7 +6504,7 @@ static int mvpp2_port_probe(struct platform_device *pdev,
         struct resource *res;
         const char *dt_mac_addr;
         const char *mac_from;
-        char hw_mac_addr[ETH_ALEN];
+        char hw_mac_addr[ETH_ALEN] = {0};
         u32 id;
         int features;
         int phy_mode;
diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
index b3d0c2e6347a..e588a0cdb074 100644
--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
@@ -22,6 +22,7 @@
 #include <linux/if_vlan.h>
 #include <linux/reset.h>
 #include <linux/tcp.h>
+#include <linux/interrupt.h>
 
 #include "mtk_eth_soc.h"
 
@@ -947,6 +948,10 @@ static int mtk_poll_rx(struct napi_struct *napi, int budget,
                       RX_DMA_FPORT_MASK;
                 mac--;
 
+                if (unlikely(mac < 0 || mac >= MTK_MAC_COUNT ||
+                             !eth->netdev[mac]))
+                        goto release_desc;
+
                 netdev = eth->netdev[mac];
 
                 if (unlikely(test_bit(MTK_RESETTING, &eth->state)))
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
index c751a1d434ad..3d4e4a5d00d1 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
@@ -223,6 +223,7 @@ static void mlx4_en_get_wol(struct net_device *netdev,
                             struct ethtool_wolinfo *wol)
 {
         struct mlx4_en_priv *priv = netdev_priv(netdev);
+        struct mlx4_caps *caps = &priv->mdev->dev->caps;
         int err = 0;
         u64 config = 0;
         u64 mask;
@@ -235,24 +236,24 @@ static void mlx4_en_get_wol(struct net_device *netdev,
         mask = (priv->port == 1) ? MLX4_DEV_CAP_FLAG_WOL_PORT1 :
                 MLX4_DEV_CAP_FLAG_WOL_PORT2;
 
-        if (!(priv->mdev->dev->caps.flags & mask)) {
+        if (!(caps->flags & mask)) {
                 wol->supported = 0;
                 wol->wolopts = 0;
                 return;
         }
 
+        if (caps->wol_port[priv->port])
+                wol->supported = WAKE_MAGIC;
+        else
+                wol->supported = 0;
+
         err = mlx4_wol_read(priv->mdev->dev, &config, priv->port);
         if (err) {
                 en_err(priv, "Failed to get WoL information\n");
                 return;
         }
 
-        if (config & MLX4_EN_WOL_MAGIC)
-                wol->supported = WAKE_MAGIC;
-        else
-                wol->supported = 0;
-
-        if (config & MLX4_EN_WOL_ENABLED)
+        if ((config & MLX4_EN_WOL_ENABLED) && (config & MLX4_EN_WOL_MAGIC))
                 wol->wolopts = WAKE_MAGIC;
         else
                 wol->wolopts = 0;
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_rx.c b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
index 436f7689a032..bf1638044a7a 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_rx.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
@@ -574,16 +574,21 @@ static inline __wsum get_fixed_vlan_csum(__wsum hw_checksum,
  * header, the HW adds it. To address that, we are subtracting the pseudo
  * header checksum from the checksum value provided by the HW.
  */
-static void get_fixed_ipv4_csum(__wsum hw_checksum, struct sk_buff *skb,
-                                struct iphdr *iph)
+static int get_fixed_ipv4_csum(__wsum hw_checksum, struct sk_buff *skb,
+                               struct iphdr *iph)
 {
         __u16 length_for_csum = 0;
         __wsum csum_pseudo_header = 0;
+        __u8 ipproto = iph->protocol;
+
+        if (unlikely(ipproto == IPPROTO_SCTP))
+                return -1;
 
         length_for_csum = (be16_to_cpu(iph->tot_len) - (iph->ihl << 2));
         csum_pseudo_header = csum_tcpudp_nofold(iph->saddr, iph->daddr,
-                                                length_for_csum, iph->protocol, 0);
+                                                length_for_csum, ipproto, 0);
         skb->csum = csum_sub(hw_checksum, csum_pseudo_header);
+        return 0;
 }
 
 #if IS_ENABLED(CONFIG_IPV6)
@@ -594,17 +599,20 @@ static void get_fixed_ipv4_csum(__wsum hw_checksum, struct sk_buff *skb,
 static int get_fixed_ipv6_csum(__wsum hw_checksum, struct sk_buff *skb,
                                struct ipv6hdr *ipv6h)
 {
+        __u8 nexthdr = ipv6h->nexthdr;
         __wsum csum_pseudo_hdr = 0;
 
-        if (unlikely(ipv6h->nexthdr == IPPROTO_FRAGMENT ||
-                     ipv6h->nexthdr == IPPROTO_HOPOPTS))
+        if (unlikely(nexthdr == IPPROTO_FRAGMENT ||
+                     nexthdr == IPPROTO_HOPOPTS ||
+                     nexthdr == IPPROTO_SCTP))
                 return -1;
-        hw_checksum = csum_add(hw_checksum, (__force __wsum)htons(ipv6h->nexthdr));
+        hw_checksum = csum_add(hw_checksum, (__force __wsum)htons(nexthdr));
 
         csum_pseudo_hdr = csum_partial(&ipv6h->saddr,
                                        sizeof(ipv6h->saddr) + sizeof(ipv6h->daddr), 0);
         csum_pseudo_hdr = csum_add(csum_pseudo_hdr, (__force __wsum)ipv6h->payload_len);
-        csum_pseudo_hdr = csum_add(csum_pseudo_hdr, (__force __wsum)ntohs(ipv6h->nexthdr));
+        csum_pseudo_hdr = csum_add(csum_pseudo_hdr,
+                                   (__force __wsum)htons(nexthdr));
 
         skb->csum = csum_sub(hw_checksum, csum_pseudo_hdr);
         skb->csum = csum_add(skb->csum, csum_partial(ipv6h, sizeof(struct ipv6hdr), 0));
@@ -627,11 +635,10 @@ static int check_csum(struct mlx4_cqe *cqe, struct sk_buff *skb, void *va,
         }
 
         if (cqe->status & cpu_to_be16(MLX4_CQE_STATUS_IPV4))
-                get_fixed_ipv4_csum(hw_checksum, skb, hdr);
+                return get_fixed_ipv4_csum(hw_checksum, skb, hdr);
 #if IS_ENABLED(CONFIG_IPV6)
-        else if (cqe->status & cpu_to_be16(MLX4_CQE_STATUS_IPV6))
-                if (unlikely(get_fixed_ipv6_csum(hw_checksum, skb, hdr)))
-                        return -1;
+        if (cqe->status & cpu_to_be16(MLX4_CQE_STATUS_IPV6))
+                return get_fixed_ipv6_csum(hw_checksum, skb, hdr);
 #endif
         return 0;
 }
diff --git a/drivers/net/ethernet/mellanox/mlx4/fw.c b/drivers/net/ethernet/mellanox/mlx4/fw.c
index 37e84a59e751..041c0ed65929 100644
--- a/drivers/net/ethernet/mellanox/mlx4/fw.c
+++ b/drivers/net/ethernet/mellanox/mlx4/fw.c
@@ -159,8 +159,9 @@ static void dump_dev_cap_flags2(struct mlx4_dev *dev, u64 flags)
                 [32] = "Loopback source checks support",
                 [33] = "RoCEv2 support",
                 [34] = "DMFS Sniffer support (UC & MC)",
-                [35] = "QinQ VST mode support",
-                [36] = "sl to vl mapping table change event support"
+                [35] = "Diag counters per port",
+                [36] = "QinQ VST mode support",
+                [37] = "sl to vl mapping table change event support",
         };
         int i;
 
@@ -764,6 +765,7 @@ int mlx4_QUERY_DEV_CAP(struct mlx4_dev *dev, struct mlx4_dev_cap *dev_cap)
 #define QUERY_DEV_CAP_CQ_TS_SUPPORT_OFFSET      0x3e
 #define QUERY_DEV_CAP_MAX_PKEY_OFFSET           0x3f
 #define QUERY_DEV_CAP_EXT_FLAGS_OFFSET          0x40
+#define QUERY_DEV_CAP_WOL_OFFSET                0x43
 #define QUERY_DEV_CAP_FLAGS_OFFSET              0x44
 #define QUERY_DEV_CAP_RSVD_UAR_OFFSET           0x48
 #define QUERY_DEV_CAP_UAR_SZ_OFFSET             0x49
@@ -920,6 +922,9 @@ int mlx4_QUERY_DEV_CAP(struct mlx4_dev *dev, struct mlx4_dev_cap *dev_cap)
         MLX4_GET(ext_flags, outbox, QUERY_DEV_CAP_EXT_FLAGS_OFFSET);
         MLX4_GET(flags, outbox, QUERY_DEV_CAP_FLAGS_OFFSET);
         dev_cap->flags = flags | (u64)ext_flags << 32;
+        MLX4_GET(field, outbox, QUERY_DEV_CAP_WOL_OFFSET);
+        dev_cap->wol_port[1] = !!(field & 0x20);
+        dev_cap->wol_port[2] = !!(field & 0x40);
         MLX4_GET(field, outbox, QUERY_DEV_CAP_RSVD_UAR_OFFSET);
         dev_cap->reserved_uars = field >> 4;
         MLX4_GET(field, outbox, QUERY_DEV_CAP_UAR_SZ_OFFSET);
diff --git a/drivers/net/ethernet/mellanox/mlx4/fw.h b/drivers/net/ethernet/mellanox/mlx4/fw.h
index 5343a0599253..b52ba01aa486 100644
--- a/drivers/net/ethernet/mellanox/mlx4/fw.h
+++ b/drivers/net/ethernet/mellanox/mlx4/fw.h
@@ -129,6 +129,7 @@ struct mlx4_dev_cap {
         u32 dmfs_high_rate_qpn_range;
         struct mlx4_rate_limit_caps rl_caps;
         struct mlx4_port_cap port_cap[MLX4_MAX_PORTS + 1];
+        bool wol_port[MLX4_MAX_PORTS + 1];
 };
 
 struct mlx4_func_cap {
diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
index a27c9c13a36e..5fe5cdc51357 100644
--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -424,13 +424,15 @@ static int mlx4_dev_cap(struct mlx4_dev *dev, struct mlx4_dev_cap *dev_cap)
         dev->caps.stat_rate_support  = dev_cap->stat_rate_support;
         dev->caps.max_gso_sz         = dev_cap->max_gso_sz;
         dev->caps.max_rss_tbl_sz     = dev_cap->max_rss_tbl_sz;
+        dev->caps.wol_port[1]          = dev_cap->wol_port[1];
+        dev->caps.wol_port[2]          = dev_cap->wol_port[2];
 
         /* Save uar page shift */
         if (!mlx4_is_slave(dev)) {
                 /* Virtual PCI function needs to determine UAR page size from
                  * firmware. Only master PCI function can set the uar page size
                  */
-                if (enable_4k_uar)
+                if (enable_4k_uar || !dev->persist->num_vfs)
                         dev->uar_page_shift = DEFAULT_UAR_PAGE_SHIFT;
                 else
                         dev->uar_page_shift = PAGE_SHIFT;
@@ -2275,7 +2277,7 @@ static int mlx4_init_hca(struct mlx4_dev *dev)
 
                 dev->caps.max_fmr_maps = (1 << (32 - ilog2(dev->caps.num_mpts))) - 1;
 
-                if (enable_4k_uar) {
+                if (enable_4k_uar || !dev->persist->num_vfs) {
                         init_hca.log_uar_sz = ilog2(dev->caps.num_uars) +
                                                     PAGE_SHIFT - DEFAULT_UAR_PAGE_SHIFT;
                         init_hca.uar_page_sz = DEFAULT_UAR_PAGE_SHIFT - 12;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
index f5a2c605749f..31cbe5e86a01 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
@@ -786,6 +786,10 @@ static void cb_timeout_handler(struct work_struct *work)
         mlx5_cmd_comp_handler(dev, 1UL << ent->idx, true);
 }
 
+static void free_msg(struct mlx5_core_dev *dev, struct mlx5_cmd_msg *msg);
+static void mlx5_free_cmd_msg(struct mlx5_core_dev *dev,
+                              struct mlx5_cmd_msg *msg);
+
 static void cmd_work_handler(struct work_struct *work)
 {
         struct mlx5_cmd_work_ent *ent = container_of(work, struct mlx5_cmd_work_ent, work);
@@ -796,17 +800,28 @@ static void cmd_work_handler(struct work_struct *work)
         struct semaphore *sem;
         unsigned long flags;
         bool poll_cmd = ent->polling;
+        int alloc_ret;
 
 
         sem = ent->page_queue ? &cmd->pages_sem : &cmd->sem;
         down(sem);
         if (!ent->page_queue) {
-                ent->idx = alloc_ent(cmd);
-                if (ent->idx < 0) {
+                alloc_ret = alloc_ent(cmd);
+                if (alloc_ret < 0) {
                         mlx5_core_err(dev, "failed to allocate command entry\n");
+                        if (ent->callback) {
+                                ent->callback(-EAGAIN, ent->context);
+                                mlx5_free_cmd_msg(dev, ent->out);
+                                free_msg(dev, ent->in);
+                                free_cmd(ent);
+                        } else {
+                                ent->ret = -EAGAIN;
+                                complete(&ent->done);
+                        }
                         up(sem);
                         return;
                 }
+                ent->idx = alloc_ret;
         } else {
                 ent->idx = cmd->max_reg_cmds;
                 spin_lock_irqsave(&cmd->alloc_lock, flags);
@@ -967,7 +982,7 @@ static int mlx5_cmd_invoke(struct mlx5_core_dev *dev, struct mlx5_cmd_msg *in,
 
         err = wait_func(dev, ent);
         if (err == -ETIMEDOUT)
-                goto out_free;
+                goto out;
 
         ds = ent->ts2 - ent->ts1;
         op = MLX5_GET(mbox_in, in->first.data, opcode);
@@ -1430,6 +1445,7 @@ void mlx5_cmd_comp_handler(struct mlx5_core_dev *dev, u64 vec, bool forced)
                                         mlx5_core_err(dev, "Command completion arrived after timeout (entry idx = %d).\n",
                                                       ent->idx);
                                         free_ent(cmd, ent->idx);
+                                        free_cmd(ent);
                                 }
                                 continue;
                         }
@@ -1488,7 +1504,8 @@ void mlx5_cmd_comp_handler(struct mlx5_core_dev *dev, u64 vec, bool forced)
                                 free_msg(dev, ent->in);
 
                                 err = err ? err : ent->status;
-                                free_cmd(ent);
+                                if (!forced)
+                                        free_cmd(ent);
                                 callback(err, context);
                         } else {
                                 complete(&ent->done);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h
index e1b7ddfecd01..2f26fb34d741 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h
@@ -263,9 +263,18 @@ struct mlx5e_dcbx {
 
         /* The only setting that cannot be read from FW */
         u8                         tc_tsa[IEEE_8021QAZ_MAX_TCS];
+        u8                         cap;
 };
 #endif
 
+#define MAX_PIN_NUM     8
+struct mlx5e_pps {
+        u8                         pin_caps[MAX_PIN_NUM];
+        struct work_struct         out_work;
+        u64                        start[MAX_PIN_NUM];
+        u8                         enabled;
+};
+
 struct mlx5e_tstamp {
         rwlock_t                   lock;
         struct cyclecounter        cycles;
@@ -277,7 +286,7 @@ struct mlx5e_tstamp {
         struct mlx5_core_dev      *mdev;
         struct ptp_clock          *ptp;
         struct ptp_clock_info      ptp_info;
-        u8                        *pps_pin_caps;
+        struct mlx5e_pps           pps_info;
 };
 
 enum {
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_clock.c b/drivers/net/ethernet/mellanox/mlx5/core/en_clock.c
index 66f432385dbb..84dd63e74041 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_clock.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_clock.c
@@ -53,6 +53,15 @@ enum {
         MLX5E_EVENT_MODE_ONCE_TILL_ARM  = 0x2,
 };
 
+enum {
+        MLX5E_MTPPS_FS_ENABLE                   = BIT(0x0),
+        MLX5E_MTPPS_FS_PATTERN                  = BIT(0x2),
+        MLX5E_MTPPS_FS_PIN_MODE                 = BIT(0x3),
+        MLX5E_MTPPS_FS_TIME_STAMP               = BIT(0x4),
+        MLX5E_MTPPS_FS_OUT_PULSE_DURATION       = BIT(0x5),
+        MLX5E_MTPPS_FS_ENH_OUT_PER_ADJ          = BIT(0x7),
+};
+
 void mlx5e_fill_hwstamp(struct mlx5e_tstamp *tstamp, u64 timestamp,
                         struct skb_shared_hwtstamps *hwts)
 {
@@ -73,17 +82,46 @@ static u64 mlx5e_read_internal_timer(const struct cyclecounter *cc)
         return mlx5_read_internal_timer(tstamp->mdev) & cc->mask;
 }
 
+static void mlx5e_pps_out(struct work_struct *work)
+{
+        struct mlx5e_pps *pps_info = container_of(work, struct mlx5e_pps,
+                                                  out_work);
+        struct mlx5e_tstamp *tstamp = container_of(pps_info, struct mlx5e_tstamp,
+                                                   pps_info);
+        u32 in[MLX5_ST_SZ_DW(mtpps_reg)] = {0};
+        unsigned long flags;
+        int i;
+
+        for (i = 0; i < tstamp->ptp_info.n_pins; i++) {
+                u64 tstart;
+
+                write_lock_irqsave(&tstamp->lock, flags);
+                tstart = tstamp->pps_info.start[i];
+                tstamp->pps_info.start[i] = 0;
+                write_unlock_irqrestore(&tstamp->lock, flags);
+                if (!tstart)
+                        continue;
+
+                MLX5_SET(mtpps_reg, in, pin, i);
+                MLX5_SET64(mtpps_reg, in, time_stamp, tstart);
+                MLX5_SET(mtpps_reg, in, field_select, MLX5E_MTPPS_FS_TIME_STAMP);
+                mlx5_set_mtpps(tstamp->mdev, in, sizeof(in));
+        }
+}
+
 static void mlx5e_timestamp_overflow(struct work_struct *work)
 {
         struct delayed_work *dwork = to_delayed_work(work);
         struct mlx5e_tstamp *tstamp = container_of(dwork, struct mlx5e_tstamp,
                                                    overflow_work);
+        struct mlx5e_priv *priv = container_of(tstamp, struct mlx5e_priv, tstamp);
         unsigned long flags;
 
         write_lock_irqsave(&tstamp->lock, flags);
         timecounter_read(&tstamp->clock);
         write_unlock_irqrestore(&tstamp->lock, flags);
-        schedule_delayed_work(&tstamp->overflow_work, tstamp->overflow_period);
+        queue_delayed_work(priv->wq, &tstamp->overflow_work,
+                           msecs_to_jiffies(tstamp->overflow_period * 1000));
 }
 
 int mlx5e_hwstamp_set(struct mlx5e_priv *priv, struct ifreq *ifr)
@@ -213,18 +251,6 @@ static int mlx5e_ptp_adjfreq(struct ptp_clock_info *ptp, s32 delta)
         int neg_adj = 0;
         struct mlx5e_tstamp *tstamp = container_of(ptp, struct mlx5e_tstamp,
                                                   ptp_info);
-        struct mlx5e_priv *priv =
-                container_of(tstamp, struct mlx5e_priv, tstamp);
-
-        if (MLX5_CAP_GEN(priv->mdev, pps_modify)) {
-                u32 in[MLX5_ST_SZ_DW(mtpps_reg)] = {0};
-
-                /* For future use need to add a loop for finding all 1PPS out pins */
-                MLX5_SET(mtpps_reg, in, pin_mode, MLX5E_PIN_MODE_OUT);
-                MLX5_SET(mtpps_reg, in, out_periodic_adjustment, delta & 0xFFFF);
-
-                mlx5_set_mtpps(priv->mdev, in, sizeof(in));
-        }
 
         if (delta < 0) {
                 neg_adj = 1;
@@ -253,12 +279,13 @@ static int mlx5e_extts_configure(struct ptp_clock_info *ptp,
         struct mlx5e_priv *priv =
                 container_of(tstamp, struct mlx5e_priv, tstamp);
         u32 in[MLX5_ST_SZ_DW(mtpps_reg)] = {0};
+        u32 field_select = 0;
+        u8 pin_mode = 0;
         u8 pattern = 0;
         int pin = -1;
         int err = 0;
 
-        if (!MLX5_CAP_GEN(priv->mdev, pps) ||
-            !MLX5_CAP_GEN(priv->mdev, pps_modify))
+        if (!MLX5_PPS_CAP(priv->mdev))
                 return -EOPNOTSUPP;
 
         if (rq->extts.index >= tstamp->ptp_info.n_pins)
@@ -268,15 +295,21 @@ static int mlx5e_extts_configure(struct ptp_clock_info *ptp,
                 pin = ptp_find_pin(tstamp->ptp, PTP_PF_EXTTS, rq->extts.index);
                 if (pin < 0)
                         return -EBUSY;
+                pin_mode = MLX5E_PIN_MODE_IN;
+                pattern = !!(rq->extts.flags & PTP_FALLING_EDGE);
+                field_select = MLX5E_MTPPS_FS_PIN_MODE |
+                               MLX5E_MTPPS_FS_PATTERN |
+                               MLX5E_MTPPS_FS_ENABLE;
+        } else {
+                pin = rq->extts.index;
+                field_select = MLX5E_MTPPS_FS_ENABLE;
         }
 
-        if (rq->extts.flags & PTP_FALLING_EDGE)
-                pattern = 1;
-
         MLX5_SET(mtpps_reg, in, pin, pin);
-        MLX5_SET(mtpps_reg, in, pin_mode, MLX5E_PIN_MODE_IN);
+        MLX5_SET(mtpps_reg, in, pin_mode, pin_mode);
         MLX5_SET(mtpps_reg, in, pattern, pattern);
         MLX5_SET(mtpps_reg, in, enable, on);
+        MLX5_SET(mtpps_reg, in, field_select, field_select);
 
         err = mlx5_set_mtpps(priv->mdev, in, sizeof(in));
         if (err)
@@ -295,14 +328,18 @@ static int mlx5e_perout_configure(struct ptp_clock_info *ptp,
         struct mlx5e_priv *priv =
                 container_of(tstamp, struct mlx5e_priv, tstamp);
         u32 in[MLX5_ST_SZ_DW(mtpps_reg)] = {0};
-        u64 nsec_now, nsec_delta, time_stamp;
+        u64 nsec_now, nsec_delta, time_stamp = 0;
         u64 cycles_now, cycles_delta;
         struct timespec64 ts;
         unsigned long flags;
+        u32 field_select = 0;
+        u8 pin_mode = 0;
+        u8 pattern = 0;
         int pin = -1;
+        int err = 0;
         s64 ns;
 
-        if (!MLX5_CAP_GEN(priv->mdev, pps_modify))
+        if (!MLX5_PPS_CAP(priv->mdev))
                 return -EOPNOTSUPP;
 
         if (rq->perout.index >= tstamp->ptp_info.n_pins)
@@ -313,32 +350,60 @@ static int mlx5e_perout_configure(struct ptp_clock_info *ptp,
                                    rq->perout.index);
                 if (pin < 0)
                         return -EBUSY;
-        }
 
-        ts.tv_sec = rq->perout.period.sec;
-        ts.tv_nsec = rq->perout.period.nsec;
-        ns = timespec64_to_ns(&ts);
-        if (on)
+                pin_mode = MLX5E_PIN_MODE_OUT;
+                pattern = MLX5E_OUT_PATTERN_PERIODIC;
+                ts.tv_sec = rq->perout.period.sec;
+                ts.tv_nsec = rq->perout.period.nsec;
+                ns = timespec64_to_ns(&ts);
+
                 if ((ns >> 1) != 500000000LL)
                         return -EINVAL;
-        ts.tv_sec = rq->perout.start.sec;
-        ts.tv_nsec = rq->perout.start.nsec;
-        ns = timespec64_to_ns(&ts);
-        cycles_now = mlx5_read_internal_timer(tstamp->mdev);
-        write_lock_irqsave(&tstamp->lock, flags);
-        nsec_now = timecounter_cyc2time(&tstamp->clock, cycles_now);
-        nsec_delta = ns - nsec_now;
-        cycles_delta = div64_u64(nsec_delta << tstamp->cycles.shift,
-                                 tstamp->cycles.mult);
-        write_unlock_irqrestore(&tstamp->lock, flags);
-        time_stamp = cycles_now + cycles_delta;
+
+                ts.tv_sec = rq->perout.start.sec;
+                ts.tv_nsec = rq->perout.start.nsec;
+                ns = timespec64_to_ns(&ts);
+                cycles_now = mlx5_read_internal_timer(tstamp->mdev);
+                write_lock_irqsave(&tstamp->lock, flags);
+                nsec_now = timecounter_cyc2time(&tstamp->clock, cycles_now);
+                nsec_delta = ns - nsec_now;
+                cycles_delta = div64_u64(nsec_delta << tstamp->cycles.shift,
+                                         tstamp->cycles.mult);
+                write_unlock_irqrestore(&tstamp->lock, flags);
+                time_stamp = cycles_now + cycles_delta;
+                field_select = MLX5E_MTPPS_FS_PIN_MODE |
+                               MLX5E_MTPPS_FS_PATTERN |
+                               MLX5E_MTPPS_FS_ENABLE |
+                               MLX5E_MTPPS_FS_TIME_STAMP;
+        } else {
+                pin = rq->perout.index;
+                field_select = MLX5E_MTPPS_FS_ENABLE;
+        }
+
         MLX5_SET(mtpps_reg, in, pin, pin);
-        MLX5_SET(mtpps_reg, in, pin_mode, MLX5E_PIN_MODE_OUT);
-        MLX5_SET(mtpps_reg, in, pattern, MLX5E_OUT_PATTERN_PERIODIC);
+        MLX5_SET(mtpps_reg, in, pin_mode, pin_mode);
+        MLX5_SET(mtpps_reg, in, pattern, pattern);
         MLX5_SET(mtpps_reg, in, enable, on);
         MLX5_SET64(mtpps_reg, in, time_stamp, time_stamp);
+        MLX5_SET(mtpps_reg, in, field_select, field_select);
+
+        err = mlx5_set_mtpps(priv->mdev, in, sizeof(in));
+        if (err)
+                return err;
 
-        return mlx5_set_mtpps(priv->mdev, in, sizeof(in));
+        return mlx5_set_mtppse(priv->mdev, pin, 0,
+                               MLX5E_EVENT_MODE_REPETETIVE & on);
+}
+
+static int mlx5e_pps_configure(struct ptp_clock_info *ptp,
+                               struct ptp_clock_request *rq,
+                               int on)
+{
+        struct mlx5e_tstamp *tstamp =
+                container_of(ptp, struct mlx5e_tstamp, ptp_info);
+
+        tstamp->pps_info.enabled = !!on;
+        return 0;
 }
 
 static int mlx5e_ptp_enable(struct ptp_clock_info *ptp,
@@ -350,6 +415,8 @@ static int mlx5e_ptp_enable(struct ptp_clock_info *ptp,
                 return mlx5e_extts_configure(ptp, rq, on);
         case PTP_CLK_REQ_PEROUT:
                 return mlx5e_perout_configure(ptp, rq, on);
+        case PTP_CLK_REQ_PPS:
+                return mlx5e_pps_configure(ptp, rq, on);
         default:
                 return -EOPNOTSUPP;
         }
@@ -395,6 +462,7 @@ static int mlx5e_init_pin_config(struct mlx5e_tstamp *tstamp)
                 return -ENOMEM;
         tstamp->ptp_info.enable = mlx5e_ptp_enable;
         tstamp->ptp_info.verify = mlx5e_ptp_verify;
+        tstamp->ptp_info.pps = 1;
 
         for (i = 0; i < tstamp->ptp_info.n_pins; i++) {
                 snprintf(tstamp->ptp_info.pin_config[i].name,
@@ -422,22 +490,56 @@ static void mlx5e_get_pps_caps(struct mlx5e_priv *priv,
         tstamp->ptp_info.n_per_out = MLX5_GET(mtpps_reg, out,
                                               cap_max_num_of_pps_out_pins);
 
-        tstamp->pps_pin_caps[0] = MLX5_GET(mtpps_reg, out, cap_pin_0_mode);
-        tstamp->pps_pin_caps[1] = MLX5_GET(mtpps_reg, out, cap_pin_1_mode);
-        tstamp->pps_pin_caps[2] = MLX5_GET(mtpps_reg, out, cap_pin_2_mode);
-        tstamp->pps_pin_caps[3] = MLX5_GET(mtpps_reg, out, cap_pin_3_mode);
-        tstamp->pps_pin_caps[4] = MLX5_GET(mtpps_reg, out, cap_pin_4_mode);
-        tstamp->pps_pin_caps[5] = MLX5_GET(mtpps_reg, out, cap_pin_5_mode);
-        tstamp->pps_pin_caps[6] = MLX5_GET(mtpps_reg, out, cap_pin_6_mode);
-        tstamp->pps_pin_caps[7] = MLX5_GET(mtpps_reg, out, cap_pin_7_mode);
+        tstamp->pps_info.pin_caps[0] = MLX5_GET(mtpps_reg, out, cap_pin_0_mode);
+        tstamp->pps_info.pin_caps[1] = MLX5_GET(mtpps_reg, out, cap_pin_1_mode);
+        tstamp->pps_info.pin_caps[2] = MLX5_GET(mtpps_reg, out, cap_pin_2_mode);
+        tstamp->pps_info.pin_caps[3] = MLX5_GET(mtpps_reg, out, cap_pin_3_mode);
+        tstamp->pps_info.pin_caps[4] = MLX5_GET(mtpps_reg, out, cap_pin_4_mode);
+        tstamp->pps_info.pin_caps[5] = MLX5_GET(mtpps_reg, out, cap_pin_5_mode);
+        tstamp->pps_info.pin_caps[6] = MLX5_GET(mtpps_reg, out, cap_pin_6_mode);
+        tstamp->pps_info.pin_caps[7] = MLX5_GET(mtpps_reg, out, cap_pin_7_mode);
 }
 
 void mlx5e_pps_event_handler(struct mlx5e_priv *priv,
                              struct ptp_clock_event *event)
 {
+        struct net_device *netdev = priv->netdev;
         struct mlx5e_tstamp *tstamp = &priv->tstamp;
+        struct timespec64 ts;
+        u64 nsec_now, nsec_delta;
+        u64 cycles_now, cycles_delta;
+        int pin = event->index;
+        s64 ns;
+        unsigned long flags;
 
-        ptp_clock_event(tstamp->ptp, event);
+        switch (tstamp->ptp_info.pin_config[pin].func) {
+        case PTP_PF_EXTTS:
+                if (tstamp->pps_info.enabled) {
+                        event->type = PTP_CLOCK_PPSUSR;
+                        event->pps_times.ts_real = ns_to_timespec64(event->timestamp);
+                } else {
+                        event->type = PTP_CLOCK_EXTTS;
+                }
+                ptp_clock_event(tstamp->ptp, event);
+                break;
+        case PTP_PF_PEROUT:
+                mlx5e_ptp_gettime(&tstamp->ptp_info, &ts);
+                cycles_now = mlx5_read_internal_timer(tstamp->mdev);
+                ts.tv_sec += 1;
+                ts.tv_nsec = 0;
+                ns = timespec64_to_ns(&ts);
+                write_lock_irqsave(&tstamp->lock, flags);
+                nsec_now = timecounter_cyc2time(&tstamp->clock, cycles_now);
+                nsec_delta = ns - nsec_now;
+                cycles_delta = div64_u64(nsec_delta << tstamp->cycles.shift,
+                                         tstamp->cycles.mult);
+                tstamp->pps_info.start[pin] = cycles_now + cycles_delta;
+                queue_work(priv->wq, &tstamp->pps_info.out_work);
+                write_unlock_irqrestore(&tstamp->lock, flags);
+                break;
+        default:
+                netdev_err(netdev, "%s: Unhandled event\n", __func__);
+        }
 }
 
 void mlx5e_timestamp_init(struct mlx5e_priv *priv)
@@ -473,9 +575,10 @@ void mlx5e_timestamp_init(struct mlx5e_priv *priv)
         do_div(ns, NSEC_PER_SEC / 2 / HZ);
         tstamp->overflow_period = ns;
 
+        INIT_WORK(&tstamp->pps_info.out_work, mlx5e_pps_out);
         INIT_DELAYED_WORK(&tstamp->overflow_work, mlx5e_timestamp_overflow);
         if (tstamp->overflow_period)
-                schedule_delayed_work(&tstamp->overflow_work, 0);
+                queue_delayed_work(priv->wq, &tstamp->overflow_work, 0);
         else
                 mlx5_core_warn(priv->mdev, "invalid overflow period, overflow_work is not scheduled\n");
 
@@ -484,16 +587,10 @@ void mlx5e_timestamp_init(struct mlx5e_priv *priv)
         snprintf(tstamp->ptp_info.name, 16, "mlx5 ptp");
 
         /* Initialize 1PPS data structures */
-#define MAX_PIN_NUM     8
-        tstamp->pps_pin_caps = kzalloc(sizeof(u8) * MAX_PIN_NUM, GFP_KERNEL);
-        if (tstamp->pps_pin_caps) {
-                if (MLX5_CAP_GEN(priv->mdev, pps))
-                        mlx5e_get_pps_caps(priv, tstamp);
-                if (tstamp->ptp_info.n_pins)
-                        mlx5e_init_pin_config(tstamp);
-        } else {
-                mlx5_core_warn(priv->mdev, "1PPS initialization failed\n");
-        }
+        if (MLX5_PPS_CAP(priv->mdev))
+                mlx5e_get_pps_caps(priv, tstamp);
+        if (tstamp->ptp_info.n_pins)
+                mlx5e_init_pin_config(tstamp);
 
         tstamp->ptp = ptp_clock_register(&tstamp->ptp_info,
                                          &priv->mdev->pdev->dev);
@@ -516,8 +613,7 @@ void mlx5e_timestamp_cleanup(struct mlx5e_priv *priv)
                 priv->tstamp.ptp = NULL;
         }
 
-        kfree(tstamp->pps_pin_caps);
-        kfree(tstamp->ptp_info.pin_config);
-
+        cancel_work_sync(&tstamp->pps_info.out_work);
         cancel_delayed_work_sync(&tstamp->overflow_work);
+        kfree(tstamp->ptp_info.pin_config);
 }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
index 2eb54d36e16e..c1d384fca4dc 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
@@ -288,13 +288,8 @@ static int mlx5e_dcbnl_ieee_setpfc(struct net_device *dev,
 static u8 mlx5e_dcbnl_getdcbx(struct net_device *dev)
 {
         struct mlx5e_priv *priv = netdev_priv(dev);
-        struct mlx5e_dcbx *dcbx = &priv->dcbx;
-        u8 mode = DCB_CAP_DCBX_VER_IEEE | DCB_CAP_DCBX_VER_CEE;
-
-        if (dcbx->mode == MLX5E_DCBX_PARAM_VER_OPER_HOST)
-                mode |= DCB_CAP_DCBX_HOST;
 
-        return mode;
+        return priv->dcbx.cap;
 }
 
 static u8 mlx5e_dcbnl_setdcbx(struct net_device *dev, u8 mode)
@@ -312,6 +307,7 @@ static u8 mlx5e_dcbnl_setdcbx(struct net_device *dev, u8 mode)
                 /* set dcbx to fw controlled */
                 if (!mlx5e_dcbnl_set_dcbx_mode(priv, MLX5E_DCBX_PARAM_VER_OPER_AUTO)) {
                         dcbx->mode = MLX5E_DCBX_PARAM_VER_OPER_AUTO;
+                        dcbx->cap &= ~DCB_CAP_DCBX_HOST;
                         return 0;
                 }
 
@@ -324,6 +320,8 @@ static u8 mlx5e_dcbnl_setdcbx(struct net_device *dev, u8 mode)
         if (mlx5e_dcbnl_switch_to_host_mode(netdev_priv(dev)))
                 return 1;
 
+        dcbx->cap = mode;
+
         return 0;
 }
 
@@ -628,9 +626,9 @@ static u8 mlx5e_dcbnl_getcap(struct net_device *netdev,
                 *cap = false;
                 break;
         case DCB_CAP_ATTR_DCBX:
-                *cap = (DCB_CAP_DCBX_LLD_MANAGED |
-                        DCB_CAP_DCBX_VER_CEE |
-                        DCB_CAP_DCBX_STATIC);
+                *cap = priv->dcbx.cap |
+                       DCB_CAP_DCBX_VER_CEE |
+                       DCB_CAP_DCBX_VER_IEEE;
                 break;
         default:
                 *cap = 0;
@@ -754,8 +752,16 @@ void mlx5e_dcbnl_initialize(struct mlx5e_priv *priv)
 {
         struct mlx5e_dcbx *dcbx = &priv->dcbx;
 
+        if (!MLX5_CAP_GEN(priv->mdev, qos))
+                return;
+
         if (MLX5_CAP_GEN(priv->mdev, dcbx))
                 mlx5e_dcbnl_query_dcbx_mode(priv, &dcbx->mode);
 
+        priv->dcbx.cap = DCB_CAP_DCBX_VER_CEE |
+                         DCB_CAP_DCBX_VER_IEEE;
+        if (priv->dcbx.mode == MLX5E_DCBX_PARAM_VER_OPER_HOST)
+                priv->dcbx.cap |= DCB_CAP_DCBX_HOST;
+
         mlx5e_ets_init(priv);
 }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
index 917fade5f5d5..f5594014715b 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
@@ -641,8 +641,10 @@ int mlx5e_ethtool_set_channels(struct mlx5e_priv *priv,
 
         new_channels.params = priv->channels.params;
         new_channels.params.num_channels = count;
-        mlx5e_build_default_indir_rqt(priv->mdev, new_channels.params.indirection_rqt,
-                                      MLX5E_INDIR_RQT_SIZE, count);
+        if (!netif_is_rxfh_configured(priv->netdev))
+                mlx5e_build_default_indir_rqt(priv->mdev,
+                                              new_channels.params.indirection_rqt,
+                                              MLX5E_INDIR_RQT_SIZE, count);
 
         if (!test_bit(MLX5E_STATE_OPENED, &priv->state)) {
                 priv->channels.params = new_channels.params;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_fs_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_fs_ethtool.c
index bdd82c9b3992..eafc59280ada 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_fs_ethtool.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_fs_ethtool.c
@@ -276,7 +276,7 @@ static void add_rule_to_list(struct mlx5e_priv *priv,
 
 static bool outer_header_zero(u32 *match_criteria)
 {
-        int size = MLX5_ST_SZ_BYTES(fte_match_param);
+        int size = MLX5_FLD_SZ_BYTES(fte_match_param, outer_headers);
         char *outer_headers_c = MLX5_ADDR_OF(fte_match_param, match_criteria,
                                              outer_headers);
 
@@ -320,7 +320,7 @@ add_ethtool_flow_rule(struct mlx5e_priv *priv,
 
         spec->match_criteria_enable = (!outer_header_zero(spec->match_criteria));
         flow_act.flow_tag = MLX5_FS_DEFAULT_FLOW_TAG;
-        rule = mlx5_add_flow_rules(ft, spec, &flow_act, dst, 1);
+        rule = mlx5_add_flow_rules(ft, spec, &flow_act, dst, dst ? 1 : 0);
         if (IS_ERR(rule)) {
                 err = PTR_ERR(rule);
                 netdev_err(priv->netdev, "%s: failed to add ethtool steering rule: %d\n",
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index 1eac5003084f..6ad7f07e7861 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -377,7 +377,6 @@ static void mlx5e_async_event(struct mlx5_core_dev *mdev, void *vpriv,
                 break;
         case MLX5_DEV_EVENT_PPS:
                 eqe = (struct mlx5_eqe *)param;
-                ptp_event.type = PTP_CLOCK_EXTTS;
                 ptp_event.index = eqe->data.pps.pin;
                 ptp_event.timestamp =
                         timecounter_cyc2time(&priv->tstamp.clock,
@@ -1970,6 +1969,7 @@ static void mlx5e_build_rx_cq_param(struct mlx5e_priv *priv,
         }
 
         mlx5e_build_common_cq_param(priv, param);
+        param->cq_period_mode = params->rx_cq_period_mode;
 }
 
 static void mlx5e_build_tx_cq_param(struct mlx5e_priv *priv,
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
index 325b2c8c1c6d..7344433259fc 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
@@ -222,13 +222,13 @@ static inline int mlx5e_page_alloc_mapped(struct mlx5e_rq *rq,
         if (unlikely(!page))
                 return -ENOMEM;
 
-        dma_info->page = page;
         dma_info->addr = dma_map_page(rq->pdev, page, 0,
                                       RQ_PAGE_SIZE(rq), rq->buff.map_dir);
         if (unlikely(dma_mapping_error(rq->pdev, dma_info->addr))) {
                 put_page(page);
                 return -ENOMEM;
         }
+        dma_info->page = page;
 
         return 0;
 }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
index 3c536f560dd2..7f282e8f4e7f 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
@@ -1443,12 +1443,10 @@ static int mlx5e_route_lookup_ipv6(struct mlx5e_priv *priv,
         struct mlx5_eswitch *esw = priv->mdev->priv.eswitch;
         int ret;
 
-        dst = ip6_route_output(dev_net(mirred_dev), NULL, fl6);
-        ret = dst->error;
-        if (ret) {
-                dst_release(dst);
+        ret = ipv6_stub->ipv6_dst_lookup(dev_net(mirred_dev), NULL, &dst,
+                                         fl6);
+        if (ret < 0)
                 return ret;
-        }
 
         *out_ttl = ip6_dst_hoplimit(dst);
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
index aaa0f4ebba9a..31353e5c3c78 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
@@ -128,10 +128,10 @@ static inline int mlx5e_skb_l3_header_offset(struct sk_buff *skb)
                 return mlx5e_skb_l2_header_offset(skb);
 }
 
-static inline unsigned int mlx5e_calc_min_inline(enum mlx5_inline_modes mode,
-                                                 struct sk_buff *skb)
+static inline u16 mlx5e_calc_min_inline(enum mlx5_inline_modes mode,
+                                        struct sk_buff *skb)
 {
-        int hlen;
+        u16 hlen;
 
         switch (mode) {
         case MLX5_INLINE_MODE_NONE:
@@ -140,19 +140,22 @@ static inline unsigned int mlx5e_calc_min_inline(enum mlx5_inline_modes mode,
                 hlen = eth_get_headlen(skb->data, skb_headlen(skb));
                 if (hlen == ETH_HLEN && !skb_vlan_tag_present(skb))
                         hlen += VLAN_HLEN;
-                return hlen;
+                break;
         case MLX5_INLINE_MODE_IP:
                 /* When transport header is set to zero, it means no transport
                  * header. When transport header is set to 0xff's, it means
                  * transport header wasn't set.
                  */
-                if (skb_transport_offset(skb))
-                        return mlx5e_skb_l3_header_offset(skb);
+                if (skb_transport_offset(skb)) {
+                        hlen = mlx5e_skb_l3_header_offset(skb);
+                        break;
+                }
                 /* fall through */
         case MLX5_INLINE_MODE_L2:
         default:
-                return mlx5e_skb_l2_header_offset(skb);
+                hlen = mlx5e_skb_l2_header_offset(skb);
         }
+        return min_t(u16, hlen, skb->len);
 }
 
 static inline void mlx5e_tx_skb_pull_inline(unsigned char **skb_data,
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eq.c b/drivers/net/ethernet/mellanox/mlx5/core/eq.c
index af51a5d2b912..52b9a64cd3a2 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eq.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eq.c
@@ -698,7 +698,7 @@ int mlx5_start_eqs(struct mlx5_core_dev *dev)
         else
                 mlx5_core_dbg(dev, "port_module_event is not set\n");
 
-        if (MLX5_CAP_GEN(dev, pps))
+        if (MLX5_PPS_CAP(dev))
                 async_event_mask |= (1ull << MLX5_EVENT_TYPE_PPS_EVENT);
 
         if (MLX5_CAP_GEN(dev, fpga))
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
index 89bfda419efe..8b18cc9ec026 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
@@ -1668,7 +1668,8 @@ void mlx5_eswitch_disable_sriov(struct mlx5_eswitch *esw)
         int i;
 
         if (!esw || !MLX5_CAP_GEN(esw->dev, vport_group_manager) ||
-            MLX5_CAP_GEN(esw->dev, port_type) != MLX5_CAP_PORT_TYPE_ETH)
+            MLX5_CAP_GEN(esw->dev, port_type) != MLX5_CAP_PORT_TYPE_ETH ||
+            esw->mode == SRIOV_NONE)
                 return;
 
         esw_info(esw->dev, "disable SRIOV: active vports(%d) mode(%d)\n",
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
index 95b64025ce36..5bc0593bd76e 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
@@ -815,7 +815,7 @@ void esw_offloads_cleanup(struct mlx5_eswitch *esw, int nvports)
         struct mlx5_eswitch_rep *rep;
         int vport;
 
-        for (vport = 0; vport < nvports; vport++) {
+        for (vport = nvports - 1; vport >= 0; vport--) {
                 rep = &esw->offloads.vport_reps[vport];
                 if (!rep->valid)
                         continue;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c
index 1ee5bce85901..85298051a3e4 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c
@@ -178,8 +178,6 @@ out:
 
 static void mlx5i_destroy_underlay_qp(struct mlx5_core_dev *mdev, struct mlx5_core_qp *qp)
 {
-        mlx5_fs_remove_rx_underlay_qpn(mdev, qp->qpn);
-
         mlx5_core_destroy_qp(mdev, qp);
 }
 
@@ -194,8 +192,6 @@ static int mlx5i_init_tx(struct mlx5e_priv *priv)
                 return err;
         }
 
-        mlx5_fs_add_rx_underlay_qpn(priv->mdev, ipriv->qp.qpn);
-
         err = mlx5e_create_tis(priv->mdev, 0 /* tc */, ipriv->qp.qpn, &priv->tisn[0]);
         if (err) {
                 mlx5_core_warn(priv->mdev, "create tis failed, %d\n", err);
@@ -253,6 +249,7 @@ static void mlx5i_destroy_flow_steering(struct mlx5e_priv *priv)
 
 static int mlx5i_init_rx(struct mlx5e_priv *priv)
 {
+        struct mlx5i_priv *ipriv  = priv->ppriv;
         int err;
 
         err = mlx5e_create_indirect_rqt(priv);
@@ -271,12 +268,18 @@ static int mlx5i_init_rx(struct mlx5e_priv *priv)
         if (err)
                 goto err_destroy_indirect_tirs;
 
-        err = mlx5i_create_flow_steering(priv);
+        err = mlx5_fs_add_rx_underlay_qpn(priv->mdev, ipriv->qp.qpn);
         if (err)
                 goto err_destroy_direct_tirs;
 
+        err = mlx5i_create_flow_steering(priv);
+        if (err)
+                goto err_remove_rx_underlay_qpn;
+
         return 0;
 
+err_remove_rx_underlay_qpn:
+        mlx5_fs_remove_rx_underlay_qpn(priv->mdev, ipriv->qp.qpn);
 err_destroy_direct_tirs:
         mlx5e_destroy_direct_tirs(priv);
 err_destroy_indirect_tirs:
@@ -290,6 +293,9 @@ err_destroy_indirect_rqts:
 
 static void mlx5i_cleanup_rx(struct mlx5e_priv *priv)
 {
+        struct mlx5i_priv *ipriv  = priv->ppriv;
+
+        mlx5_fs_remove_rx_underlay_qpn(priv->mdev, ipriv->qp.qpn);
         mlx5i_destroy_flow_steering(priv);
         mlx5e_destroy_direct_tirs(priv);
         mlx5e_destroy_indirect_tirs(priv);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lag.c b/drivers/net/ethernet/mellanox/mlx5/core/lag.c
index a3a836bdcfd2..f26f97fe4666 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/lag.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/lag.c
@@ -162,22 +162,17 @@ static bool mlx5_lag_is_bonded(struct mlx5_lag *ldev)
 static void mlx5_infer_tx_affinity_mapping(struct lag_tracker *tracker,
                                            u8 *port1, u8 *port2)
 {
-        if (tracker->tx_type == NETDEV_LAG_TX_TYPE_ACTIVEBACKUP) {
-                if (tracker->netdev_state[0].tx_enabled) {
-                        *port1 = 1;
-                        *port2 = 1;
-                } else {
-                        *port1 = 2;
-                        *port2 = 2;
-                }
-        } else {
-                *port1 = 1;
-                *port2 = 2;
-                if (!tracker->netdev_state[0].link_up)
-                        *port1 = 2;
-                else if (!tracker->netdev_state[1].link_up)
-                        *port2 = 1;
+        *port1 = 1;
+        *port2 = 2;
+        if (!tracker->netdev_state[0].tx_enabled ||
+            !tracker->netdev_state[0].link_up) {
+                *port1 = 2;
+                return;
         }
+
+        if (!tracker->netdev_state[1].tx_enabled ||
+            !tracker->netdev_state[1].link_up)
+                *port2 = 1;
 }
 
 static void mlx5_activate_lag(struct mlx5_lag *ldev,
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
index c065132b956d..16885827367b 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
@@ -1186,7 +1186,6 @@ static int mlx5_load_one(struct mlx5_core_dev *dev, struct mlx5_priv *priv,
                 }
         }
 
-        clear_bit(MLX5_INTERFACE_STATE_DOWN, &dev->intf_state);
         set_bit(MLX5_INTERFACE_STATE_UP, &dev->intf_state);
 out:
         mutex_unlock(&dev->intf_state_mutex);
@@ -1261,7 +1260,7 @@ static int mlx5_unload_one(struct mlx5_core_dev *dev, struct mlx5_priv *priv,
                 mlx5_drain_health_recovery(dev);
 
         mutex_lock(&dev->intf_state_mutex);
-        if (test_bit(MLX5_INTERFACE_STATE_DOWN, &dev->intf_state)) {
+        if (!test_bit(MLX5_INTERFACE_STATE_UP, &dev->intf_state)) {
                 dev_warn(&dev->pdev->dev, "%s: interface is down, NOP\n",
                          __func__);
                 if (cleanup)
@@ -1270,7 +1269,6 @@ static int mlx5_unload_one(struct mlx5_core_dev *dev, struct mlx5_priv *priv,
         }
 
         clear_bit(MLX5_INTERFACE_STATE_UP, &dev->intf_state);
-        set_bit(MLX5_INTERFACE_STATE_DOWN, &dev->intf_state);
 
         if (mlx5_device_registered(dev))
                 mlx5_detach_device(dev);
@@ -1565,8 +1563,6 @@ static void shutdown(struct pci_dev *pdev)
         int err;
 
         dev_info(&pdev->dev, "Shutdown was called\n");
-        /* Notify mlx5 clients that the kernel is being shut down */
-        set_bit(MLX5_INTERFACE_STATE_SHUTDOWN, &dev->intf_state);
         err = mlx5_try_fast_unload(dev);
         if (err)
                 mlx5_unload_one(dev, priv, false);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h b/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h
index 6a3d6bef7dd4..6a263e8d883a 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h
@@ -154,6 +154,11 @@ int mlx5_set_mtpps(struct mlx5_core_dev *mdev, u32 *mtpps, u32 mtpps_size);
 int mlx5_query_mtppse(struct mlx5_core_dev *mdev, u8 pin, u8 *arm, u8 *mode);
 int mlx5_set_mtppse(struct mlx5_core_dev *mdev, u8 pin, u8 arm, u8 mode);
 
+#define MLX5_PPS_CAP(mdev) (MLX5_CAP_GEN((mdev), pps) &&                \
+                            MLX5_CAP_GEN((mdev), pps_modify) &&         \
+                            MLX5_CAP_MCAM_FEATURE((mdev), mtpps_fs) &&  \
+                            MLX5_CAP_MCAM_FEATURE((mdev), mtpps_enh_out_per_adj))
+
 int mlx5_firmware_flash(struct mlx5_core_dev *dev, const struct firmware *fw);
 
 void mlx5e_init(void);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/sriov.c b/drivers/net/ethernet/mellanox/mlx5/core/sriov.c
index bcdf7779c48d..bf99d40e30b4 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/sriov.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/sriov.c
@@ -88,7 +88,11 @@ static void mlx5_device_disable_sriov(struct mlx5_core_dev *dev)
         int vf;
 
         if (!sriov->enabled_vfs)
+#ifdef CONFIG_MLX5_CORE_EN
+                goto disable_sriov_resources;
+#else
                 return;
+#endif
 
         for (vf = 0; vf < sriov->num_vfs; vf++) {
                 if (!sriov->vfs_ctx[vf].enabled)
@@ -103,6 +107,7 @@ static void mlx5_device_disable_sriov(struct mlx5_core_dev *dev)
         }
 
 #ifdef CONFIG_MLX5_CORE_EN
+disable_sriov_resources:
         mlx5_eswitch_disable_sriov(dev->priv.eswitch);
 #endif
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/srq.c b/drivers/net/ethernet/mellanox/mlx5/core/srq.c
index f774de6f5fcb..520f6382dfde 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/srq.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/srq.c
@@ -201,13 +201,13 @@ static int destroy_srq_cmd(struct mlx5_core_dev *dev,
 static int arm_srq_cmd(struct mlx5_core_dev *dev, struct mlx5_core_srq *srq,
                        u16 lwm, int is_srq)
 {
-        /* arm_srq structs missing using identical xrc ones */
-        u32 srq_in[MLX5_ST_SZ_DW(arm_xrc_srq_in)] = {0};
-        u32 srq_out[MLX5_ST_SZ_DW(arm_xrc_srq_out)] = {0};
+        u32 srq_in[MLX5_ST_SZ_DW(arm_rq_in)] = {0};
+        u32 srq_out[MLX5_ST_SZ_DW(arm_rq_out)] = {0};
 
-        MLX5_SET(arm_xrc_srq_in, srq_in, opcode,   MLX5_CMD_OP_ARM_XRC_SRQ);
-        MLX5_SET(arm_xrc_srq_in, srq_in, xrc_srqn, srq->srqn);
-        MLX5_SET(arm_xrc_srq_in, srq_in, lwm,      lwm);
+        MLX5_SET(arm_rq_in, srq_in, opcode, MLX5_CMD_OP_ARM_RQ);
+        MLX5_SET(arm_rq_in, srq_in, op_mod, MLX5_ARM_RQ_IN_OP_MOD_SRQ);
+        MLX5_SET(arm_rq_in, srq_in, srq_number, srq->srqn);
+        MLX5_SET(arm_rq_in, srq_in, lwm,      lwm);
 
         return  mlx5_cmd_exec(dev, srq_in, sizeof(srq_in),
                               srq_out, sizeof(srq_out));
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
index 60bf8f27cc00..c6a3e61b53bd 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
@@ -4139,6 +4139,8 @@ static int mlxsw_sp_netdevice_port_upper_event(struct net_device *lower_dev,
                         return -EINVAL;
                 if (!info->linking)
                         break;
+                if (netdev_has_any_upper_dev(upper_dev))
+                        return -EINVAL;
                 if (netif_is_lag_master(upper_dev) &&
                     !mlxsw_sp_master_lag_check(mlxsw_sp, upper_dev,
                                                info->upper_info))
@@ -4258,6 +4260,10 @@ static int mlxsw_sp_netdevice_port_vlan_event(struct net_device *vlan_dev,
                 upper_dev = info->upper_dev;
                 if (!netif_is_bridge_master(upper_dev))
                         return -EINVAL;
+                if (!info->linking)
+                        break;
+                if (netdev_has_any_upper_dev(upper_dev))
+                        return -EINVAL;
                 break;
         case NETDEV_CHANGEUPPER:
                 upper_dev = info->upper_dev;
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
index 383fef5a8e24..4b2e0fd7d51e 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
@@ -1512,6 +1512,10 @@ mlxsw_sp_nexthop_group_mac_update(struct mlxsw_sp *mlxsw_sp,
 static int mlxsw_sp_fib_entry_update(struct mlxsw_sp *mlxsw_sp,
                                      struct mlxsw_sp_fib_entry *fib_entry);
 
+static bool
+mlxsw_sp_fib_node_entry_is_first(const struct mlxsw_sp_fib_node *fib_node,
+                                 const struct mlxsw_sp_fib_entry *fib_entry);
+
 static int
 mlxsw_sp_nexthop_fib_entries_update(struct mlxsw_sp *mlxsw_sp,
                                     struct mlxsw_sp_nexthop_group *nh_grp)
@@ -1520,6 +1524,9 @@ mlxsw_sp_nexthop_fib_entries_update(struct mlxsw_sp *mlxsw_sp,
         int err;
 
         list_for_each_entry(fib_entry, &nh_grp->fib_list, nexthop_group_node) {
+                if (!mlxsw_sp_fib_node_entry_is_first(fib_entry->fib_node,
+                                                      fib_entry))
+                        continue;
                 err = mlxsw_sp_fib_entry_update(mlxsw_sp, fib_entry);
                 if (err)
                         return err;
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
index 656b2d3f1bee..d39ffbfcc436 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
@@ -626,8 +626,8 @@ static int mlxsw_sp_port_attr_br_flags_set(struct mlxsw_sp_port *mlxsw_sp_port,
 
         bridge_port = mlxsw_sp_bridge_port_find(mlxsw_sp_port->mlxsw_sp->bridge,
                                                 orig_dev);
-        if (WARN_ON(!bridge_port))
-                return -EINVAL;
+        if (!bridge_port)
+                return 0;
 
         err = mlxsw_sp_bridge_port_flood_table_set(mlxsw_sp_port, bridge_port,
                                                    MLXSW_SP_FLOOD_TYPE_UC,
@@ -705,21 +705,28 @@ static int mlxsw_sp_port_attr_mc_router_set(struct mlxsw_sp_port *mlxsw_sp_port,
                                             bool is_port_mc_router)
 {
         struct mlxsw_sp_bridge_port *bridge_port;
+        int err;
 
         if (switchdev_trans_ph_prepare(trans))
                 return 0;
 
         bridge_port = mlxsw_sp_bridge_port_find(mlxsw_sp_port->mlxsw_sp->bridge,
                                                 orig_dev);
-        if (WARN_ON(!bridge_port))
-                return -EINVAL;
+        if (!bridge_port)
+                return 0;
 
         if (!bridge_port->bridge_device->multicast_enabled)
-                return 0;
+                goto out;
 
-        return mlxsw_sp_bridge_port_flood_table_set(mlxsw_sp_port, bridge_port,
-                                                    MLXSW_SP_FLOOD_TYPE_MC,
-                                                    is_port_mc_router);
+        err = mlxsw_sp_bridge_port_flood_table_set(mlxsw_sp_port, bridge_port,
+                                                   MLXSW_SP_FLOOD_TYPE_MC,
+                                                   is_port_mc_router);
+        if (err)
+                return err;
+
+out:
+        bridge_port->mrouter = is_port_mc_router;
+        return 0;
 }
 
 static int mlxsw_sp_port_mc_disabled_set(struct mlxsw_sp_port *mlxsw_sp_port,
@@ -1283,15 +1290,15 @@ static int mlxsw_sp_port_mdb_add(struct mlxsw_sp_port *mlxsw_sp_port,
                 return 0;
 
         bridge_port = mlxsw_sp_bridge_port_find(mlxsw_sp->bridge, orig_dev);
-        if (WARN_ON(!bridge_port))
-                return -EINVAL;
+        if (!bridge_port)
+                return 0;
 
         bridge_device = bridge_port->bridge_device;
         mlxsw_sp_port_vlan = mlxsw_sp_port_vlan_find_by_bridge(mlxsw_sp_port,
                                                                bridge_device,
                                                                mdb->vid);
-        if (WARN_ON(!mlxsw_sp_port_vlan))
-                return -EINVAL;
+        if (!mlxsw_sp_port_vlan)
+                return 0;
 
         fid_index = mlxsw_sp_fid_index(mlxsw_sp_port_vlan->fid);
 
@@ -1407,15 +1414,15 @@ static int mlxsw_sp_port_mdb_del(struct mlxsw_sp_port *mlxsw_sp_port,
         int err = 0;
 
         bridge_port = mlxsw_sp_bridge_port_find(mlxsw_sp->bridge, orig_dev);
-        if (WARN_ON(!bridge_port))
-                return -EINVAL;
+        if (!bridge_port)
+                return 0;
 
         bridge_device = bridge_port->bridge_device;
         mlxsw_sp_port_vlan = mlxsw_sp_port_vlan_find_by_bridge(mlxsw_sp_port,
                                                                bridge_device,
                                                                mdb->vid);
-        if (WARN_ON(!mlxsw_sp_port_vlan))
-                return -EINVAL;
+        if (!mlxsw_sp_port_vlan)
+                return 0;
 
         fid_index = mlxsw_sp_fid_index(mlxsw_sp_port_vlan->fid);
 
@@ -1974,6 +1981,17 @@ static void mlxsw_sp_fdb_fini(struct mlxsw_sp *mlxsw_sp)
 
 }
 
+static void mlxsw_sp_mids_fini(struct mlxsw_sp *mlxsw_sp)
+{
+        struct mlxsw_sp_mid *mid, *tmp;
+
+        list_for_each_entry_safe(mid, tmp, &mlxsw_sp->bridge->mids_list, list) {
+                list_del(&mid->list);
+                clear_bit(mid->mid, mlxsw_sp->bridge->mids_bitmap);
+                kfree(mid);
+        }
+}
+
 int mlxsw_sp_switchdev_init(struct mlxsw_sp *mlxsw_sp)
 {
         struct mlxsw_sp_bridge *bridge;
@@ -1996,7 +2014,7 @@ int mlxsw_sp_switchdev_init(struct mlxsw_sp *mlxsw_sp)
 void mlxsw_sp_switchdev_fini(struct mlxsw_sp *mlxsw_sp)
 {
         mlxsw_sp_fdb_fini(mlxsw_sp);
-        WARN_ON(!list_empty(&mlxsw_sp->bridge->mids_list));
+        mlxsw_sp_mids_fini(mlxsw_sp);
         WARN_ON(!list_empty(&mlxsw_sp->bridge->bridges_list));
         kfree(mlxsw_sp->bridge);
 }
diff --git a/drivers/net/ethernet/netronome/nfp/flower/cmsg.c b/drivers/net/ethernet/netronome/nfp/flower/cmsg.c
index dd7fa9cf225f..b0837b58c3a1 100644
--- a/drivers/net/ethernet/netronome/nfp/flower/cmsg.c
+++ b/drivers/net/ethernet/netronome/nfp/flower/cmsg.c
@@ -115,14 +115,10 @@ nfp_flower_cmsg_portmod_rx(struct nfp_app *app, struct sk_buff *skb)
                 return;
         }
 
-        if (link) {
+        if (link)
                 netif_carrier_on(netdev);
-                rtnl_lock();
-                dev_set_mtu(netdev, be16_to_cpu(msg->mtu));
-                rtnl_unlock();
-        } else {
+        else
                 netif_carrier_off(netdev);
-        }
         rcu_read_unlock();
 }
 
diff --git a/drivers/net/ethernet/netronome/nfp/flower/match.c b/drivers/net/ethernet/netronome/nfp/flower/match.c
index 0e08404480ef..d25b5038c3a2 100644
--- a/drivers/net/ethernet/netronome/nfp/flower/match.c
+++ b/drivers/net/ethernet/netronome/nfp/flower/match.c
@@ -42,33 +42,29 @@ nfp_flower_compile_meta_tci(struct nfp_flower_meta_two *frame,
                             struct tc_cls_flower_offload *flow, u8 key_type,
                             bool mask_version)
 {
+        struct fl_flow_key *target = mask_version ? flow->mask : flow->key;
         struct flow_dissector_key_vlan *flow_vlan;
         u16 tmp_tci;
 
+        memset(frame, 0, sizeof(struct nfp_flower_meta_two));
         /* Populate the metadata frame. */
         frame->nfp_flow_key_layer = key_type;
         frame->mask_id = ~0;
 
-        if (mask_version) {
-                frame->tci = cpu_to_be16(~0);
-                return;
-        }
-
-        flow_vlan = skb_flow_dissector_target(flow->dissector,
-                                              FLOW_DISSECTOR_KEY_VLAN,
-                                              flow->key);
-
-        /* Populate the tci field. */
-        if (!flow_vlan->vlan_id) {
-                tmp_tci = 0;
-        } else {
-                tmp_tci = FIELD_PREP(NFP_FLOWER_MASK_VLAN_PRIO,
-                                     flow_vlan->vlan_priority) |
-                          FIELD_PREP(NFP_FLOWER_MASK_VLAN_VID,
-                                     flow_vlan->vlan_id) |
-                          NFP_FLOWER_MASK_VLAN_CFI;
+        if (dissector_uses_key(flow->dissector, FLOW_DISSECTOR_KEY_VLAN)) {
+                flow_vlan = skb_flow_dissector_target(flow->dissector,
+                                                      FLOW_DISSECTOR_KEY_VLAN,
+                                                      target);
+                /* Populate the tci field. */
+                if (flow_vlan->vlan_id) {
+                        tmp_tci = FIELD_PREP(NFP_FLOWER_MASK_VLAN_PRIO,
+                                             flow_vlan->vlan_priority) |
+                                  FIELD_PREP(NFP_FLOWER_MASK_VLAN_VID,
+                                             flow_vlan->vlan_id) |
+                                  NFP_FLOWER_MASK_VLAN_CFI;
+                        frame->tci = cpu_to_be16(tmp_tci);
+                }
         }
-        frame->tci = cpu_to_be16(tmp_tci);
 }
 
 static void
@@ -99,17 +95,18 @@ nfp_flower_compile_mac(struct nfp_flower_mac_mpls *frame,
                        bool mask_version)
 {
         struct fl_flow_key *target = mask_version ? flow->mask : flow->key;
-        struct flow_dissector_key_eth_addrs *flow_mac;
-
-        flow_mac = skb_flow_dissector_target(flow->dissector,
-                                             FLOW_DISSECTOR_KEY_ETH_ADDRS,
-                                             target);
+        struct flow_dissector_key_eth_addrs *addr;
 
         memset(frame, 0, sizeof(struct nfp_flower_mac_mpls));
 
-        /* Populate mac frame. */
-        ether_addr_copy(frame->mac_dst, &flow_mac->dst[0]);
-        ether_addr_copy(frame->mac_src, &flow_mac->src[0]);
+        if (dissector_uses_key(flow->dissector, FLOW_DISSECTOR_KEY_ETH_ADDRS)) {
+                addr = skb_flow_dissector_target(flow->dissector,
+                                                 FLOW_DISSECTOR_KEY_ETH_ADDRS,
+                                                 target);
+                /* Populate mac frame. */
+                ether_addr_copy(frame->mac_dst, &addr->dst[0]);
+                ether_addr_copy(frame->mac_src, &addr->src[0]);
+        }
 
         if (mask_version)
                 frame->mpls_lse = cpu_to_be32(~0);
@@ -121,14 +118,17 @@ nfp_flower_compile_tport(struct nfp_flower_tp_ports *frame,
                          bool mask_version)
 {
         struct fl_flow_key *target = mask_version ? flow->mask : flow->key;
-        struct flow_dissector_key_ports *flow_tp;
+        struct flow_dissector_key_ports *tp;
 
-        flow_tp = skb_flow_dissector_target(flow->dissector,
-                                            FLOW_DISSECTOR_KEY_PORTS,
-                                            target);
+        memset(frame, 0, sizeof(struct nfp_flower_tp_ports));
 
-        frame->port_src = flow_tp->src;
-        frame->port_dst = flow_tp->dst;
+        if (dissector_uses_key(flow->dissector, FLOW_DISSECTOR_KEY_PORTS)) {
+                tp = skb_flow_dissector_target(flow->dissector,
+                                               FLOW_DISSECTOR_KEY_PORTS,
+                                               target);
+                frame->port_src = tp->src;
+                frame->port_dst = tp->dst;
+        }
 }
 
 static void
@@ -137,25 +137,27 @@ nfp_flower_compile_ipv4(struct nfp_flower_ipv4 *frame,
                         bool mask_version)
 {
         struct fl_flow_key *target = mask_version ? flow->mask : flow->key;
-        struct flow_dissector_key_ipv4_addrs *flow_ipv4;
-        struct flow_dissector_key_basic *flow_basic;
-
-        flow_ipv4 = skb_flow_dissector_target(flow->dissector,
-                                              FLOW_DISSECTOR_KEY_IPV4_ADDRS,
-                                              target);
-
-        flow_basic = skb_flow_dissector_target(flow->dissector,
-                                               FLOW_DISSECTOR_KEY_BASIC,
-                                               target);
+        struct flow_dissector_key_ipv4_addrs *addr;
+        struct flow_dissector_key_basic *basic;
 
-        /* Populate IPv4 frame. */
-        frame->reserved = 0;
-        frame->ipv4_src = flow_ipv4->src;
-        frame->ipv4_dst = flow_ipv4->dst;
-        frame->proto = flow_basic->ip_proto;
         /* Wildcard TOS/TTL for now. */
-        frame->tos = 0;
-        frame->ttl = 0;
+        memset(frame, 0, sizeof(struct nfp_flower_ipv4));
+
+        if (dissector_uses_key(flow->dissector,
+                               FLOW_DISSECTOR_KEY_IPV4_ADDRS)) {
+                addr = skb_flow_dissector_target(flow->dissector,
+                                                 FLOW_DISSECTOR_KEY_IPV4_ADDRS,
+                                                 target);
+                frame->ipv4_src = addr->src;
+                frame->ipv4_dst = addr->dst;
+        }
+
+        if (dissector_uses_key(flow->dissector, FLOW_DISSECTOR_KEY_BASIC)) {
+                basic = skb_flow_dissector_target(flow->dissector,
+                                                  FLOW_DISSECTOR_KEY_BASIC,
+                                                  target);
+                frame->proto = basic->ip_proto;
+        }
 }
 
 static void
@@ -164,26 +166,27 @@ nfp_flower_compile_ipv6(struct nfp_flower_ipv6 *frame,
                         bool mask_version)
 {
         struct fl_flow_key *target = mask_version ? flow->mask : flow->key;
-        struct flow_dissector_key_ipv6_addrs *flow_ipv6;
-        struct flow_dissector_key_basic *flow_basic;
-
-        flow_ipv6 = skb_flow_dissector_target(flow->dissector,
-                                              FLOW_DISSECTOR_KEY_IPV6_ADDRS,
-                                              target);
+        struct flow_dissector_key_ipv6_addrs *addr;
+        struct flow_dissector_key_basic *basic;
 
-        flow_basic = skb_flow_dissector_target(flow->dissector,
-                                               FLOW_DISSECTOR_KEY_BASIC,
-                                               target);
-
-        /* Populate IPv6 frame. */
-        frame->reserved = 0;
-        frame->ipv6_src = flow_ipv6->src;
-        frame->ipv6_dst = flow_ipv6->dst;
-        frame->proto = flow_basic->ip_proto;
         /* Wildcard LABEL/TOS/TTL for now. */
-        frame->ipv6_flow_label_exthdr = 0;
-        frame->tos = 0;
-        frame->ttl = 0;
+        memset(frame, 0, sizeof(struct nfp_flower_ipv6));
+
+        if (dissector_uses_key(flow->dissector,
+                               FLOW_DISSECTOR_KEY_IPV6_ADDRS)) {
+                addr = skb_flow_dissector_target(flow->dissector,
+                                                 FLOW_DISSECTOR_KEY_IPV6_ADDRS,
+                                                 target);
+                frame->ipv6_src = addr->src;
+                frame->ipv6_dst = addr->dst;
+        }
+
+        if (dissector_uses_key(flow->dissector, FLOW_DISSECTOR_KEY_BASIC)) {
+                basic = skb_flow_dissector_target(flow->dissector,
+                                                  FLOW_DISSECTOR_KEY_BASIC,
+                                                  target);
+                frame->proto = basic->ip_proto;
+        }
 }
 
 int nfp_flower_compile_flow_match(struct tc_cls_flower_offload *flow,
diff --git a/drivers/net/ethernet/netronome/nfp/flower/offload.c b/drivers/net/ethernet/netronome/nfp/flower/offload.c
index 4ad10bd5e139..74a96d6bb05c 100644
--- a/drivers/net/ethernet/netronome/nfp/flower/offload.c
+++ b/drivers/net/ethernet/netronome/nfp/flower/offload.c
@@ -105,43 +105,62 @@ static int
 nfp_flower_calculate_key_layers(struct nfp_fl_key_ls *ret_key_ls,
                                 struct tc_cls_flower_offload *flow)
 {
-        struct flow_dissector_key_control *mask_enc_ctl;
-        struct flow_dissector_key_basic *mask_basic;
-        struct flow_dissector_key_basic *key_basic;
+        struct flow_dissector_key_basic *mask_basic = NULL;
+        struct flow_dissector_key_basic *key_basic = NULL;
+        struct flow_dissector_key_ip *mask_ip = NULL;
         u32 key_layer_two;
         u8 key_layer;
         int key_size;
 
-        mask_enc_ctl = skb_flow_dissector_target(flow->dissector,
-                                                 FLOW_DISSECTOR_KEY_ENC_CONTROL,
-                                                 flow->mask);
+        if (dissector_uses_key(flow->dissector,
+                               FLOW_DISSECTOR_KEY_ENC_CONTROL)) {
+                struct flow_dissector_key_control *mask_enc_ctl =
+                        skb_flow_dissector_target(flow->dissector,
+                                                  FLOW_DISSECTOR_KEY_ENC_CONTROL,
+                                                  flow->mask);
+                /* We are expecting a tunnel. For now we ignore offloading. */
+                if (mask_enc_ctl->addr_type)
+                        return -EOPNOTSUPP;
+        }
 
-        mask_basic = skb_flow_dissector_target(flow->dissector,
-                                               FLOW_DISSECTOR_KEY_BASIC,
-                                               flow->mask);
+        if (dissector_uses_key(flow->dissector, FLOW_DISSECTOR_KEY_BASIC)) {
+                mask_basic = skb_flow_dissector_target(flow->dissector,
+                                                       FLOW_DISSECTOR_KEY_BASIC,
+                                                       flow->mask);
+
+                key_basic = skb_flow_dissector_target(flow->dissector,
+                                                      FLOW_DISSECTOR_KEY_BASIC,
+                                                      flow->key);
+        }
+
+        if (dissector_uses_key(flow->dissector, FLOW_DISSECTOR_KEY_IP))
+                mask_ip = skb_flow_dissector_target(flow->dissector,
+                                                    FLOW_DISSECTOR_KEY_IP,
+                                                    flow->mask);
 
-        key_basic = skb_flow_dissector_target(flow->dissector,
-                                              FLOW_DISSECTOR_KEY_BASIC,
-                                              flow->key);
         key_layer_two = 0;
         key_layer = NFP_FLOWER_LAYER_PORT | NFP_FLOWER_LAYER_MAC;
         key_size = sizeof(struct nfp_flower_meta_one) +
                    sizeof(struct nfp_flower_in_port) +
                    sizeof(struct nfp_flower_mac_mpls);
 
-        /* We are expecting a tunnel. For now we ignore offloading. */
-        if (mask_enc_ctl->addr_type)
-                return -EOPNOTSUPP;
-
-        if (mask_basic->n_proto) {
+        if (mask_basic && mask_basic->n_proto) {
                 /* Ethernet type is present in the key. */
                 switch (key_basic->n_proto) {
                 case cpu_to_be16(ETH_P_IP):
+                        if (mask_ip && mask_ip->tos)
+                                return -EOPNOTSUPP;
+                        if (mask_ip && mask_ip->ttl)
+                                return -EOPNOTSUPP;
                         key_layer |= NFP_FLOWER_LAYER_IPV4;
                         key_size += sizeof(struct nfp_flower_ipv4);
                         break;
 
                 case cpu_to_be16(ETH_P_IPV6):
+                        if (mask_ip && mask_ip->tos)
+                                return -EOPNOTSUPP;
+                        if (mask_ip && mask_ip->ttl)
+                                return -EOPNOTSUPP;
                         key_layer |= NFP_FLOWER_LAYER_IPV6;
                         key_size += sizeof(struct nfp_flower_ipv6);
                         break;
@@ -152,6 +171,11 @@ nfp_flower_calculate_key_layers(struct nfp_fl_key_ls *ret_key_ls,
                 case cpu_to_be16(ETH_P_ARP):
                         return -EOPNOTSUPP;
 
+                /* Currently we do not offload MPLS. */
+                case cpu_to_be16(ETH_P_MPLS_UC):
+                case cpu_to_be16(ETH_P_MPLS_MC):
+                        return -EOPNOTSUPP;
+
                 /* Will be included in layer 2. */
                 case cpu_to_be16(ETH_P_8021Q):
                         break;
@@ -166,7 +190,7 @@ nfp_flower_calculate_key_layers(struct nfp_fl_key_ls *ret_key_ls,
                 }
         }
 
-        if (mask_basic->ip_proto) {
+        if (mask_basic && mask_basic->ip_proto) {
                 /* Ethernet type is present in the key. */
                 switch (key_basic->ip_proto) {
                 case IPPROTO_TCP:
diff --git a/drivers/net/ethernet/netronome/nfp/nfp_main.c b/drivers/net/ethernet/netronome/nfp/nfp_main.c
index d67969d3e484..3f199db2002e 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_main.c
+++ b/drivers/net/ethernet/netronome/nfp/nfp_main.c
@@ -98,21 +98,20 @@ static int nfp_pcie_sriov_enable(struct pci_dev *pdev, int num_vfs)
         struct nfp_pf *pf = pci_get_drvdata(pdev);
         int err;
 
-        mutex_lock(&pf->lock);
-
         if (num_vfs > pf->limit_vfs) {
                 nfp_info(pf->cpp, "Firmware limits number of VFs to %u\n",
                          pf->limit_vfs);
-                err = -EINVAL;
-                goto err_unlock;
+                return -EINVAL;
         }
 
         err = pci_enable_sriov(pdev, num_vfs);
         if (err) {
                 dev_warn(&pdev->dev, "Failed to enable PCI SR-IOV: %d\n", err);
-                goto err_unlock;
+                return err;
         }
 
+        mutex_lock(&pf->lock);
+
         err = nfp_app_sriov_enable(pf->app, num_vfs);
         if (err) {
                 dev_warn(&pdev->dev,
@@ -129,9 +128,8 @@ static int nfp_pcie_sriov_enable(struct pci_dev *pdev, int num_vfs)
         return num_vfs;
 
 err_sriov_disable:
-        pci_disable_sriov(pdev);
-err_unlock:
         mutex_unlock(&pf->lock);
+        pci_disable_sriov(pdev);
         return err;
 #endif
         return 0;
@@ -158,10 +156,10 @@ static int nfp_pcie_sriov_disable(struct pci_dev *pdev)
 
         pf->num_vfs = 0;
 
+        mutex_unlock(&pf->lock);
+
         pci_disable_sriov(pdev);
         dev_dbg(&pdev->dev, "Removed VFs.\n");
-
-        mutex_unlock(&pf->lock);
 #endif
         return 0;
 }
diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
index 18750ff0ede6..66a09e490cf5 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
+++ b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
@@ -513,6 +513,7 @@ nfp_net_tx_ring_init(struct nfp_net_tx_ring *tx_ring,
         tx_ring->idx = idx;
         tx_ring->r_vec = r_vec;
         tx_ring->is_xdp = is_xdp;
+        u64_stats_init(&tx_ring->r_vec->tx_sync);
 
         tx_ring->qcidx = tx_ring->idx * nn->stride_tx;
         tx_ring->qcp_q = nn->tx_bar + NFP_QCP_QUEUE_OFF(tx_ring->qcidx);
@@ -532,6 +533,7 @@ nfp_net_rx_ring_init(struct nfp_net_rx_ring *rx_ring,
 
         rx_ring->idx = idx;
         rx_ring->r_vec = r_vec;
+        u64_stats_init(&rx_ring->r_vec->rx_sync);
 
         rx_ring->fl_qcidx = rx_ring->idx * nn->stride_rx;
         rx_ring->qcp_fl = nn->rx_bar + NFP_QCP_QUEUE_OFF(rx_ring->fl_qcidx);
@@ -893,6 +895,8 @@ static int nfp_net_tx(struct sk_buff *skb, struct net_device *netdev)
 
         netdev_tx_sent_queue(nd_q, txbuf->real_len);
 
+        skb_tx_timestamp(skb);
+
         tx_ring->wr_p += nr_frags + 1;
         if (nfp_net_tx_ring_should_stop(tx_ring))
                 nfp_net_tx_ring_stop(nd_q, tx_ring);
@@ -901,13 +905,10 @@ static int nfp_net_tx(struct sk_buff *skb, struct net_device *netdev)
         if (!skb->xmit_more || netif_xmit_stopped(nd_q))
                 nfp_net_tx_xmit_more_flush(tx_ring);
 
-        skb_tx_timestamp(skb);
-
         return NETDEV_TX_OK;
 
 err_unmap:
-        --f;
-        while (f >= 0) {
+        while (--f >= 0) {
                 frag = &skb_shinfo(skb)->frags[f];
                 dma_unmap_page(dp->dev, tx_ring->txbufs[wr_idx].dma_addr,
                                skb_frag_size(frag), DMA_TO_DEVICE);
@@ -1750,6 +1751,10 @@ static int nfp_net_rx(struct nfp_net_rx_ring *rx_ring, int budget)
                         continue;
                 }
 
+                nfp_net_dma_unmap_rx(dp, rxbuf->dma_addr);
+
+                nfp_net_rx_give_one(dp, rx_ring, new_frag, new_dma_addr);
+
                 if (likely(!meta.portid)) {
                         netdev = dp->netdev;
                 } else {
@@ -1758,16 +1763,12 @@ static int nfp_net_rx(struct nfp_net_rx_ring *rx_ring, int budget)
                         nn = netdev_priv(dp->netdev);
                         netdev = nfp_app_repr_get(nn->app, meta.portid);
                         if (unlikely(!netdev)) {
-                                nfp_net_rx_drop(dp, r_vec, rx_ring, rxbuf, skb);
+                                nfp_net_rx_drop(dp, r_vec, rx_ring, NULL, skb);
                                 continue;
                         }
                         nfp_repr_inc_rx_stats(netdev, pkt_len);
                 }
 
-                nfp_net_dma_unmap_rx(dp, rxbuf->dma_addr);
-
-                nfp_net_rx_give_one(dp, rx_ring, new_frag, new_dma_addr);
-
                 skb_reserve(skb, pkt_off);
                 skb_put(skb, pkt_len);
 
diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_main.c b/drivers/net/ethernet/netronome/nfp/nfp_net_main.c
index 5797dbf2b507..34b985384d26 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_net_main.c
+++ b/drivers/net/ethernet/netronome/nfp/nfp_net_main.c
@@ -456,13 +456,9 @@ static int nfp_net_pf_app_start(struct nfp_pf *pf)
 {
         int err;
 
-        err = nfp_net_pf_app_start_ctrl(pf);
-        if (err)
-                return err;
-
         err = nfp_app_start(pf->app, pf->ctrl_vnic);
         if (err)
-                goto err_ctrl_stop;
+                return err;
 
         if (pf->num_vfs) {
                 err = nfp_app_sriov_enable(pf->app, pf->num_vfs);
@@ -474,8 +470,6 @@ static int nfp_net_pf_app_start(struct nfp_pf *pf)
 
 err_app_stop:
         nfp_app_stop(pf->app);
-err_ctrl_stop:
-        nfp_net_pf_app_stop_ctrl(pf);
         return err;
 }
 
@@ -484,7 +478,6 @@ static void nfp_net_pf_app_stop(struct nfp_pf *pf)
         if (pf->num_vfs)
                 nfp_app_sriov_disable(pf->app);
         nfp_app_stop(pf->app);
-        nfp_net_pf_app_stop_ctrl(pf);
 }
 
 static void nfp_net_pci_unmap_mem(struct nfp_pf *pf)
@@ -559,7 +552,7 @@ err_unmap_ctrl:
 
 static void nfp_net_pci_remove_finish(struct nfp_pf *pf)
 {
-        nfp_net_pf_app_stop(pf);
+        nfp_net_pf_app_stop_ctrl(pf);
         /* stop app first, to avoid double free of ctrl vNIC's ddir */
         nfp_net_debugfs_dir_clean(&pf->ddir);
 
@@ -690,6 +683,7 @@ int nfp_net_pci_probe(struct nfp_pf *pf)
 {
         struct nfp_net_fw_version fw_ver;
         u8 __iomem *ctrl_bar, *qc_bar;
+        struct nfp_net *nn;
         int stride;
         int err;
 
@@ -766,7 +760,7 @@ int nfp_net_pci_probe(struct nfp_pf *pf)
         if (err)
                 goto err_free_vnics;
 
-        err = nfp_net_pf_app_start(pf);
+        err = nfp_net_pf_app_start_ctrl(pf);
         if (err)
                 goto err_free_irqs;
 
@@ -774,12 +768,20 @@ int nfp_net_pci_probe(struct nfp_pf *pf)
         if (err)
                 goto err_stop_app;
 
+        err = nfp_net_pf_app_start(pf);
+        if (err)
+                goto err_clean_vnics;
+
         mutex_unlock(&pf->lock);
 
         return 0;
 
+err_clean_vnics:
+        list_for_each_entry(nn, &pf->vnics, vnic_list)
+                if (nfp_net_is_data_vnic(nn))
+                        nfp_net_pf_clean_vnic(pf, nn);
 err_stop_app:
-        nfp_net_pf_app_stop(pf);
+        nfp_net_pf_app_stop_ctrl(pf);
 err_free_irqs:
         nfp_net_pf_free_irqs(pf);
 err_free_vnics:
@@ -803,6 +805,8 @@ void nfp_net_pci_remove(struct nfp_pf *pf)
         if (list_empty(&pf->vnics))
                 goto out;
 
+        nfp_net_pf_app_stop(pf);
+
         list_for_each_entry(nn, &pf->vnics, vnic_list)
                 if (nfp_net_is_data_vnic(nn))
                         nfp_net_pf_clean_vnic(pf, nn);
diff --git a/drivers/net/ethernet/qlogic/netxen/netxen_nic_hw.c b/drivers/net/ethernet/qlogic/netxen/netxen_nic_hw.c
index 66ff15d08bad..0a66389c06c2 100644
--- a/drivers/net/ethernet/qlogic/netxen/netxen_nic_hw.c
+++ b/drivers/net/ethernet/qlogic/netxen/netxen_nic_hw.c
@@ -2311,7 +2311,7 @@ netxen_md_rdqueue(struct netxen_adapter *adapter,
                                  loop_cnt++) {
                 NX_WR_DUMP_REG(select_addr, adapter->ahw.pci_base0, queue_id);
                 read_addr = queueEntry->read_addr;
-                for (k = 0; k < read_cnt; k--) {
+                for (k = 0; k < read_cnt; k++) {
                         NX_RD_DUMP_REG(read_addr, adapter->ahw.pci_base0,
                                                         &read_value);
                         *data_buff++ = read_value;
diff --git a/drivers/net/ethernet/qlogic/qed/qed_mcp.c b/drivers/net/ethernet/qlogic/qed/qed_mcp.c
index 9da91045d167..3eb241657368 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_mcp.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_mcp.c
@@ -253,7 +253,7 @@ int qed_mcp_cmd_init(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt)
         size = MFW_DRV_MSG_MAX_DWORDS(p_info->mfw_mb_length) * sizeof(u32);
         p_info->mfw_mb_cur = kzalloc(size, GFP_KERNEL);
         p_info->mfw_mb_shadow = kzalloc(size, GFP_KERNEL);
-        if (!p_info->mfw_mb_shadow || !p_info->mfw_mb_addr)
+        if (!p_info->mfw_mb_cur || !p_info->mfw_mb_shadow)
                 goto err;
 
         return 0;
diff --git a/drivers/net/ethernet/qlogic/qlge/qlge_dbg.c b/drivers/net/ethernet/qlogic/qlge/qlge_dbg.c
index 28ea0af89aef..e3223f2fe2ff 100644
--- a/drivers/net/ethernet/qlogic/qlge/qlge_dbg.c
+++ b/drivers/net/ethernet/qlogic/qlge/qlge_dbg.c
@@ -724,7 +724,7 @@ static void ql_build_coredump_seg_header(
         seg_hdr->cookie = MPI_COREDUMP_COOKIE;
         seg_hdr->segNum = seg_number;
         seg_hdr->segSize = seg_size;
-        memcpy(seg_hdr->description, desc, (sizeof(seg_hdr->description)) - 1);
+        strncpy(seg_hdr->description, desc, (sizeof(seg_hdr->description)) - 1);
 }
 
 /*
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index bd07a15d3b7c..e03fcf914690 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -6863,8 +6863,7 @@ static void rtl8169_tx_clear_range(struct rtl8169_private *tp, u32 start,
                         rtl8169_unmap_tx_skb(&tp->pci_dev->dev, tx_skb,
                                              tp->TxDescArray + entry);
                         if (skb) {
-                                tp->dev->stats.tx_dropped++;
-                                dev_kfree_skb_any(skb);
+                                dev_consume_skb_any(skb);
                                 tx_skb->skb = NULL;
                         }
                 }
@@ -7319,7 +7318,7 @@ static void rtl_tx(struct net_device *dev, struct rtl8169_private *tp)
                         tp->tx_stats.packets++;
                         tp->tx_stats.bytes += tx_skb->skb->len;
                         u64_stats_update_end(&tp->tx_stats.syncp);
-                        dev_kfree_skb_any(tx_skb->skb);
+                        dev_consume_skb_any(tx_skb->skb);
                         tx_skb->skb = NULL;
                 }
                 dirty_tx++;
diff --git a/drivers/net/ethernet/samsung/sxgbe/sxgbe_platform.c b/drivers/net/ethernet/samsung/sxgbe/sxgbe_platform.c
index 73427e29df2a..fbd00cb0cb7d 100644
--- a/drivers/net/ethernet/samsung/sxgbe/sxgbe_platform.c
+++ b/drivers/net/ethernet/samsung/sxgbe/sxgbe_platform.c
@@ -47,6 +47,8 @@ static int sxgbe_probe_config_dt(struct platform_device *pdev,
         plat->mdio_bus_data = devm_kzalloc(&pdev->dev,
                                            sizeof(*plat->mdio_bus_data),
                                            GFP_KERNEL);
+        if (!plat->mdio_bus_data)
+                return -ENOMEM;
 
         dma_cfg = devm_kzalloc(&pdev->dev, sizeof(*dma_cfg), GFP_KERNEL);
         if (!dma_cfg)
diff --git a/drivers/net/ethernet/sfc/mcdi_port.c b/drivers/net/ethernet/sfc/mcdi_port.c
index c905971c5f3a..990a63d7fcb7 100644
--- a/drivers/net/ethernet/sfc/mcdi_port.c
+++ b/drivers/net/ethernet/sfc/mcdi_port.c
@@ -938,7 +938,6 @@ enum efx_stats_action {
 static int efx_mcdi_mac_stats(struct efx_nic *efx,
                               enum efx_stats_action action, int clear)
 {
-        struct efx_ef10_nic_data *nic_data = efx->nic_data;
         MCDI_DECLARE_BUF(inbuf, MC_CMD_MAC_STATS_IN_LEN);
         int rc;
         int change = action == EFX_STATS_PULL ? 0 : 1;
@@ -960,7 +959,12 @@ static int efx_mcdi_mac_stats(struct efx_nic *efx,
                               MAC_STATS_IN_PERIODIC_NOEVENT, 1,
                               MAC_STATS_IN_PERIOD_MS, period);
         MCDI_SET_DWORD(inbuf, MAC_STATS_IN_DMA_LEN, dma_len);
-        MCDI_SET_DWORD(inbuf, MAC_STATS_IN_PORT_ID, nic_data->vport_id);
+
+        if (efx_nic_rev(efx) >= EFX_REV_HUNT_A0) {
+                struct efx_ef10_nic_data *nic_data = efx->nic_data;
+
+                MCDI_SET_DWORD(inbuf, MAC_STATS_IN_PORT_ID, nic_data->vport_id);
+        }
 
         rc = efx_mcdi_rpc_quiet(efx, MC_CMD_MAC_STATS, inbuf, sizeof(inbuf),
                                 NULL, 0, NULL);
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c
index 17d4bbaeb65c..6e359572b9f0 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c
@@ -269,7 +269,10 @@ static int socfpga_dwmac_set_phy_mode(struct socfpga_dwmac *dwmac)
         ctrl &= ~(SYSMGR_EMACGRP_CTRL_PHYSEL_MASK << reg_shift);
         ctrl |= val << reg_shift;
 
-        if (dwmac->f2h_ptp_ref_clk) {
+        if (dwmac->f2h_ptp_ref_clk ||
+            phymode == PHY_INTERFACE_MODE_MII ||
+            phymode == PHY_INTERFACE_MODE_GMII ||
+            phymode == PHY_INTERFACE_MODE_SGMII) {
                 ctrl |= SYSMGR_EMACGRP_CTRL_PTP_REF_CLK_MASK << (reg_shift / 2);
                 regmap_read(sys_mgr_base_addr, SYSMGR_FPGAGRP_MODULE_REG,
                             &module);
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
index fffd6d5fc907..39c2122a4f26 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
@@ -979,14 +979,6 @@ static int sun8i_dwmac_probe(struct platform_device *pdev)
 }
 
 static const struct of_device_id sun8i_dwmac_match[] = {
-        { .compatible = "allwinner,sun8i-h3-emac",
-                .data = &emac_variant_h3 },
-        { .compatible = "allwinner,sun8i-v3s-emac",
-                .data = &emac_variant_v3s },
-        { .compatible = "allwinner,sun8i-a83t-emac",
-                .data = &emac_variant_a83t },
-        { .compatible = "allwinner,sun50i-a64-emac",
-                .data = &emac_variant_a64 },
         { }
 };
 MODULE_DEVICE_TABLE(of, sun8i_dwmac_match);
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac1000_dma.c b/drivers/net/ethernet/stmicro/stmmac/dwmac1000_dma.c
index 22cf6353ba04..7ecf549c7f1c 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac1000_dma.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac1000_dma.c
@@ -205,7 +205,7 @@ static void dwmac1000_dump_dma_regs(void __iomem *ioaddr, u32 *reg_space)
 {
         int i;
 
-        for (i = 0; i < 23; i++)
+        for (i = 0; i < NUM_DWMAC1000_DMA_REGS; i++)
                 if ((i < 12) || (i > 17))
                         reg_space[DMA_BUS_MODE / 4 + i] =
                                 readl(ioaddr + DMA_BUS_MODE + i * 4);
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac100_dma.c b/drivers/net/ethernet/stmicro/stmmac/dwmac100_dma.c
index eef2f222ce9a..6502b9aa3bf5 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac100_dma.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac100_dma.c
@@ -70,7 +70,7 @@ static void dwmac100_dump_dma_regs(void __iomem *ioaddr, u32 *reg_space)
 {
         int i;
 
-        for (i = 0; i < 9; i++)
+        for (i = 0; i < NUM_DWMAC100_DMA_REGS; i++)
                 reg_space[DMA_BUS_MODE / 4 + i] =
                         readl(ioaddr + DMA_BUS_MODE + i * 4);
 
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac_dma.h b/drivers/net/ethernet/stmicro/stmmac/dwmac_dma.h
index 9091df86723a..adc54006f884 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac_dma.h
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac_dma.h
@@ -136,6 +136,9 @@
 #define DMA_STATUS_TI   0x00000001      /* Transmit Interrupt */
 #define DMA_CONTROL_FTF         0x00100000      /* Flush transmit FIFO */
 
+#define NUM_DWMAC100_DMA_REGS   9
+#define NUM_DWMAC1000_DMA_REGS  23
+
 void dwmac_enable_dma_transmission(void __iomem *ioaddr);
 void dwmac_enable_dma_irq(void __iomem *ioaddr, u32 chan);
 void dwmac_disable_dma_irq(void __iomem *ioaddr, u32 chan);
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c
index babb39c646ff..af30b4857c3b 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c
@@ -33,6 +33,8 @@
 #define MAC100_ETHTOOL_NAME     "st_mac100"
 #define GMAC_ETHTOOL_NAME       "st_gmac"
 
+#define ETHTOOL_DMA_OFFSET      55
+
 struct stmmac_stats {
         char stat_string[ETH_GSTRING_LEN];
         int sizeof_stat;
@@ -442,6 +444,9 @@ static void stmmac_ethtool_gregs(struct net_device *dev,
 
         priv->hw->mac->dump_regs(priv->hw, reg_space);
         priv->hw->dma->dump_regs(priv->ioaddr, reg_space);
+        /* Copy DMA registers to where ethtool expects them */
+        memcpy(&reg_space[ETHTOOL_DMA_OFFSET], &reg_space[DMA_BUS_MODE / 4],
+               NUM_DWMAC1000_DMA_REGS * 4);
 }
 
 static void
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c
index db157a47000c..72ec711fcba2 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c
@@ -204,6 +204,7 @@ int stmmac_mdio_register(struct net_device *ndev)
         struct stmmac_priv *priv = netdev_priv(ndev);
         struct stmmac_mdio_bus_data *mdio_bus_data = priv->plat->mdio_bus_data;
         struct device_node *mdio_node = priv->plat->mdio_node;
+        struct device *dev = ndev->dev.parent;
         int addr, found;
 
         if (!mdio_bus_data)
@@ -237,7 +238,7 @@ int stmmac_mdio_register(struct net_device *ndev)
         else
                 err = mdiobus_register(new_bus);
         if (err != 0) {
-                netdev_err(ndev, "Cannot register the MDIO bus\n");
+                dev_err(dev, "Cannot register the MDIO bus\n");
                 goto bus_register_fail;
         }
 
@@ -285,14 +286,12 @@ int stmmac_mdio_register(struct net_device *ndev)
                         irq_str = irq_num;
                         break;
                 }
-                netdev_info(ndev, "PHY ID %08x at %d IRQ %s (%s)%s\n",
-                            phydev->phy_id, addr, irq_str, phydev_name(phydev),
-                            act ? " active" : "");
+                phy_attached_info(phydev);
                 found = 1;
         }
 
         if (!found && !mdio_node) {
-                netdev_warn(ndev, "No PHY found\n");
+                dev_warn(dev, "No PHY found\n");
                 mdiobus_unregister(new_bus);
                 mdiobus_free(new_bus);
                 return -ENODEV;
diff --git a/drivers/net/ethernet/sun/sunhme.h b/drivers/net/ethernet/sun/sunhme.h
index 3af540adb3c5..fca1bca7f69d 100644
--- a/drivers/net/ethernet/sun/sunhme.h
+++ b/drivers/net/ethernet/sun/sunhme.h
@@ -13,9 +13,9 @@
 /* Happy Meal global registers. */
 #define GREG_SWRESET    0x000UL /* Software Reset  */
 #define GREG_CFG        0x004UL /* Config Register */
-#define GREG_STAT       0x108UL /* Status          */
-#define GREG_IMASK      0x10cUL /* Interrupt Mask  */
-#define GREG_REG_SIZE   0x110UL
+#define GREG_STAT       0x100UL /* Status          */
+#define GREG_IMASK      0x104UL /* Interrupt Mask  */
+#define GREG_REG_SIZE   0x108UL
 
 /* Global reset register. */
 #define GREG_RESET_ETX         0x01
diff --git a/drivers/net/ethernet/ti/cpsw-common.c b/drivers/net/ethernet/ti/cpsw-common.c
index 56ba411421f0..38d1cc557c11 100644
--- a/drivers/net/ethernet/ti/cpsw-common.c
+++ b/drivers/net/ethernet/ti/cpsw-common.c
@@ -96,7 +96,7 @@ int ti_cm_get_macid(struct device *dev, int slave, u8 *mac_addr)
         if (of_machine_is_compatible("ti,dra7"))
                 return davinci_emac_3517_get_macid(dev, 0x514, slave, mac_addr);
 
-        dev_err(dev, "incompatible machine/device type for reading mac address\n");
+        dev_info(dev, "incompatible machine/device type for reading mac address\n");
         return -ENOENT;
 }
 EXPORT_SYMBOL_GPL(ti_cm_get_macid);
diff --git a/drivers/net/ethernet/ti/cpts.c b/drivers/net/ethernet/ti/cpts.c
index 32279d21c836..c2121d214f08 100644
--- a/drivers/net/ethernet/ti/cpts.c
+++ b/drivers/net/ethernet/ti/cpts.c
@@ -31,9 +31,18 @@
 
 #include "cpts.h"
 
+#define CPTS_SKB_TX_WORK_TIMEOUT 1 /* jiffies */
+
+struct cpts_skb_cb_data {
+        unsigned long tmo;
+};
+
 #define cpts_read32(c, r)       readl_relaxed(&c->reg->r)
 #define cpts_write32(c, v, r)   writel_relaxed(v, &c->reg->r)
 
+static int cpts_match(struct sk_buff *skb, unsigned int ptp_class,
+                      u16 ts_seqid, u8 ts_msgtype);
+
 static int event_expired(struct cpts_event *event)
 {
         return time_after(jiffies, event->tmo);
@@ -77,6 +86,47 @@ static int cpts_purge_events(struct cpts *cpts)
         return removed ? 0 : -1;
 }
 
+static bool cpts_match_tx_ts(struct cpts *cpts, struct cpts_event *event)
+{
+        struct sk_buff *skb, *tmp;
+        u16 seqid;
+        u8 mtype;
+        bool found = false;
+
+        mtype = (event->high >> MESSAGE_TYPE_SHIFT) & MESSAGE_TYPE_MASK;
+        seqid = (event->high >> SEQUENCE_ID_SHIFT) & SEQUENCE_ID_MASK;
+
+        /* no need to grab txq.lock as access is always done under cpts->lock */
+        skb_queue_walk_safe(&cpts->txq, skb, tmp) {
+                struct skb_shared_hwtstamps ssh;
+                unsigned int class = ptp_classify_raw(skb);
+                struct cpts_skb_cb_data *skb_cb =
+                                        (struct cpts_skb_cb_data *)skb->cb;
+
+                if (cpts_match(skb, class, seqid, mtype)) {
+                        u64 ns = timecounter_cyc2time(&cpts->tc, event->low);
+
+                        memset(&ssh, 0, sizeof(ssh));
+                        ssh.hwtstamp = ns_to_ktime(ns);
+                        skb_tstamp_tx(skb, &ssh);
+                        found = true;
+                        __skb_unlink(skb, &cpts->txq);
+                        dev_consume_skb_any(skb);
+                        dev_dbg(cpts->dev, "match tx timestamp mtype %u seqid %04x\n",
+                                mtype, seqid);
+                } else if (time_after(jiffies, skb_cb->tmo)) {
+                        /* timeout any expired skbs over 1s */
+                        dev_dbg(cpts->dev,
+                                "expiring tx timestamp mtype %u seqid %04x\n",
+                                mtype, seqid);
+                        __skb_unlink(skb, &cpts->txq);
+                        dev_consume_skb_any(skb);
+                }
+        }
+
+        return found;
+}
+
 /*
  * Returns zero if matching event type was found.
  */
@@ -101,9 +151,15 @@ static int cpts_fifo_read(struct cpts *cpts, int match)
                 event->low = lo;
                 type = event_type(event);
                 switch (type) {
+                case CPTS_EV_TX:
+                        if (cpts_match_tx_ts(cpts, event)) {
+                                /* if the new event matches an existing skb,
+                                 * then don't queue it
+                                 */
+                                break;
+                        }
                 case CPTS_EV_PUSH:
                 case CPTS_EV_RX:
-                case CPTS_EV_TX:
                         list_del_init(&event->list);
                         list_add_tail(&event->list, &cpts->events);
                         break;
@@ -224,6 +280,24 @@ static int cpts_ptp_enable(struct ptp_clock_info *ptp,
         return -EOPNOTSUPP;
 }
 
+static long cpts_overflow_check(struct ptp_clock_info *ptp)
+{
+        struct cpts *cpts = container_of(ptp, struct cpts, info);
+        unsigned long delay = cpts->ov_check_period;
+        struct timespec64 ts;
+        unsigned long flags;
+
+        spin_lock_irqsave(&cpts->lock, flags);
+        ts = ns_to_timespec64(timecounter_read(&cpts->tc));
+
+        if (!skb_queue_empty(&cpts->txq))
+                delay = CPTS_SKB_TX_WORK_TIMEOUT;
+        spin_unlock_irqrestore(&cpts->lock, flags);
+
+        pr_debug("cpts overflow check at %lld.%09lu\n", ts.tv_sec, ts.tv_nsec);
+        return (long)delay;
+}
+
 static struct ptp_clock_info cpts_info = {
         .owner          = THIS_MODULE,
         .name           = "CTPS timer",
@@ -236,18 +310,9 @@ static struct ptp_clock_info cpts_info = {
         .gettime64      = cpts_ptp_gettime,
         .settime64      = cpts_ptp_settime,
         .enable         = cpts_ptp_enable,
+        .do_aux_work    = cpts_overflow_check,
 };
 
-static void cpts_overflow_check(struct work_struct *work)
-{
-        struct timespec64 ts;
-        struct cpts *cpts = container_of(work, struct cpts, overflow_work.work);
-
-        cpts_ptp_gettime(&cpts->info, &ts);
-        pr_debug("cpts overflow check at %lld.%09lu\n", ts.tv_sec, ts.tv_nsec);
-        schedule_delayed_work(&cpts->overflow_work, cpts->ov_check_period);
-}
-
 static int cpts_match(struct sk_buff *skb, unsigned int ptp_class,
                       u16 ts_seqid, u8 ts_msgtype)
 {
@@ -299,7 +364,7 @@ static u64 cpts_find_ts(struct cpts *cpts, struct sk_buff *skb, int ev_type)
                 return 0;
 
         spin_lock_irqsave(&cpts->lock, flags);
-        cpts_fifo_read(cpts, CPTS_EV_PUSH);
+        cpts_fifo_read(cpts, -1);
         list_for_each_safe(this, next, &cpts->events) {
                 event = list_entry(this, struct cpts_event, list);
                 if (event_expired(event)) {
@@ -317,6 +382,19 @@ static u64 cpts_find_ts(struct cpts *cpts, struct sk_buff *skb, int ev_type)
                         break;
                 }
         }
+
+        if (ev_type == CPTS_EV_TX && !ns) {
+                struct cpts_skb_cb_data *skb_cb =
+                                (struct cpts_skb_cb_data *)skb->cb;
+                /* Not found, add frame to queue for processing later.
+                 * The periodic FIFO check will handle this.
+                 */
+                skb_get(skb);
+                /* get the timestamp for timeouts */
+                skb_cb->tmo = jiffies + msecs_to_jiffies(100);
+                __skb_queue_tail(&cpts->txq, skb);
+                ptp_schedule_worker(cpts->clock, 0);
+        }
         spin_unlock_irqrestore(&cpts->lock, flags);
 
         return ns;
@@ -358,6 +436,7 @@ int cpts_register(struct cpts *cpts)
 {
         int err, i;
 
+        skb_queue_head_init(&cpts->txq);
         INIT_LIST_HEAD(&cpts->events);
         INIT_LIST_HEAD(&cpts->pool);
         for (i = 0; i < CPTS_MAX_EVENTS; i++)
@@ -378,7 +457,7 @@ int cpts_register(struct cpts *cpts)
         }
         cpts->phc_index = ptp_clock_index(cpts->clock);
 
-        schedule_delayed_work(&cpts->overflow_work, cpts->ov_check_period);
+        ptp_schedule_worker(cpts->clock, cpts->ov_check_period);
         return 0;
 
 err_ptp:
@@ -392,14 +471,15 @@ void cpts_unregister(struct cpts *cpts)
         if (WARN_ON(!cpts->clock))
                 return;
 
-        cancel_delayed_work_sync(&cpts->overflow_work);
-
         ptp_clock_unregister(cpts->clock);
         cpts->clock = NULL;
 
         cpts_write32(cpts, 0, int_enable);
         cpts_write32(cpts, 0, control);
 
+        /* Drop all packet */
+        skb_queue_purge(&cpts->txq);
+
         clk_disable(cpts->refclk);
 }
 EXPORT_SYMBOL_GPL(cpts_unregister);
@@ -476,7 +556,6 @@ struct cpts *cpts_create(struct device *dev, void __iomem *regs,
         cpts->dev = dev;
         cpts->reg = (struct cpsw_cpts __iomem *)regs;
         spin_lock_init(&cpts->lock);
-        INIT_DELAYED_WORK(&cpts->overflow_work, cpts_overflow_check);
 
         ret = cpts_of_parse(cpts, node);
         if (ret)
diff --git a/drivers/net/ethernet/ti/cpts.h b/drivers/net/ethernet/ti/cpts.h
index 01ea82ba9cdc..73d73faf0f38 100644
--- a/drivers/net/ethernet/ti/cpts.h
+++ b/drivers/net/ethernet/ti/cpts.h
@@ -119,13 +119,13 @@ struct cpts {
         u32 cc_mult; /* for the nominal frequency */
         struct cyclecounter cc;
         struct timecounter tc;
-        struct delayed_work overflow_work;
         int phc_index;
         struct clk *refclk;
         struct list_head events;
         struct list_head pool;
         struct cpts_event pool_data[CPTS_MAX_EVENTS];
         unsigned long ov_check_period;
+        struct sk_buff_head txq;
 };
 
 void cpts_rx_timestamp(struct cpts *cpts, struct sk_buff *skb);
diff --git a/drivers/net/ethernet/toshiba/tc35815.c b/drivers/net/ethernet/toshiba/tc35815.c
index d9db8a06afd2..cce9c9ed46aa 100644
--- a/drivers/net/ethernet/toshiba/tc35815.c
+++ b/drivers/net/ethernet/toshiba/tc35815.c
@@ -1338,7 +1338,7 @@ static int tc35815_send_packet(struct sk_buff *skb, struct net_device *dev)
 static void tc35815_fatal_error_interrupt(struct net_device *dev, u32 status)
 {
         static int count;
-        printk(KERN_WARNING "%s: Fatal Error Intterrupt (%#x):",
+        printk(KERN_WARNING "%s: Fatal Error Interrupt (%#x):",
                dev->name, status);
         if (status & Int_IntPCI)
                 printk(" IntPCI");
diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c
index de8156c6b292..2bbda71818ad 100644
--- a/drivers/net/geneve.c
+++ b/drivers/net/geneve.c
@@ -1091,7 +1091,7 @@ static int geneve_validate(struct nlattr *tb[], struct nlattr *data[],
         if (data[IFLA_GENEVE_ID]) {
                 __u32 vni =  nla_get_u32(data[IFLA_GENEVE_ID]);
 
-                if (vni >= GENEVE_VID_MASK)
+                if (vni >= GENEVE_N_VID)
                         return -ERANGE;
         }
 
diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c
index 1542e837fdfa..f38e32a7ec9c 100644
--- a/drivers/net/gtp.c
+++ b/drivers/net/gtp.c
@@ -364,7 +364,7 @@ static int gtp_dev_init(struct net_device *dev)
 
         gtp->dev = dev;
 
-        dev->tstats = alloc_percpu(struct pcpu_sw_netstats);
+        dev->tstats = netdev_alloc_pcpu_stats(struct pcpu_sw_netstats);
         if (!dev->tstats)
                 return -ENOMEM;
 
diff --git a/drivers/net/hyperv/hyperv_net.h b/drivers/net/hyperv/hyperv_net.h
index d6c25580f8dd..12cc64bfcff8 100644
--- a/drivers/net/hyperv/hyperv_net.h
+++ b/drivers/net/hyperv/hyperv_net.h
@@ -765,7 +765,8 @@ struct netvsc_device {
         u32 max_chn;
         u32 num_chn;
 
-        refcount_t sc_offered;
+        atomic_t open_chn;
+        wait_queue_head_t subchan_open;
 
         struct rndis_device *extension;
 
diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c
index 0a9167dd72fb..d18c3326a1f7 100644
--- a/drivers/net/hyperv/netvsc.c
+++ b/drivers/net/hyperv/netvsc.c
@@ -78,6 +78,7 @@ static struct netvsc_device *alloc_net_device(void)
         net_device->max_pkt = RNDIS_MAX_PKT_DEFAULT;
         net_device->pkt_align = RNDIS_PKT_ALIGN_DEFAULT;
         init_completion(&net_device->channel_init_wait);
+        init_waitqueue_head(&net_device->subchan_open);
 
         return net_device;
 }
@@ -1302,6 +1303,8 @@ int netvsc_device_add(struct hv_device *device,
                 struct netvsc_channel *nvchan = &net_device->chan_table[i];
 
                 nvchan->channel = device->channel;
+                u64_stats_init(&nvchan->tx_stats.syncp);
+                u64_stats_init(&nvchan->rx_stats.syncp);
         }
 
         /* Enable NAPI handler before init callbacks */
diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index 63c98bbbc596..d91cbc6c3ca4 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -315,14 +315,34 @@ static u32 init_page_array(void *hdr, u32 len, struct sk_buff *skb,
         return slots_used;
 }
 
-/* Estimate number of page buffers neede to transmit
- * Need at most 2 for RNDIS header plus skb body and fragments.
- */
-static unsigned int netvsc_get_slots(const struct sk_buff *skb)
+static int count_skb_frag_slots(struct sk_buff *skb)
 {
-        return PFN_UP(offset_in_page(skb->data) + skb_headlen(skb))
-                + skb_shinfo(skb)->nr_frags
-                + 2;
+        int i, frags = skb_shinfo(skb)->nr_frags;
+        int pages = 0;
+
+        for (i = 0; i < frags; i++) {
+                skb_frag_t *frag = skb_shinfo(skb)->frags + i;
+                unsigned long size = skb_frag_size(frag);
+                unsigned long offset = frag->page_offset;
+
+                /* Skip unused frames from start of page */
+                offset &= ~PAGE_MASK;
+                pages += PFN_UP(offset + size);
+        }
+        return pages;
+}
+
+static int netvsc_get_slots(struct sk_buff *skb)
+{
+        char *data = skb->data;
+        unsigned int offset = offset_in_page(data);
+        unsigned int len = skb_headlen(skb);
+        int slots;
+        int frag_slots;
+
+        slots = DIV_ROUND_UP(offset + len, PAGE_SIZE);
+        frag_slots = count_skb_frag_slots(skb);
+        return slots + frag_slots;
 }
 
 static u32 net_checksum_info(struct sk_buff *skb)
@@ -360,18 +380,21 @@ static int netvsc_start_xmit(struct sk_buff *skb, struct net_device *net)
         struct hv_page_buffer page_buf[MAX_PAGE_BUFFER_COUNT];
         struct hv_page_buffer *pb = page_buf;
 
-        /* We can only transmit MAX_PAGE_BUFFER_COUNT number
+        /* We will atmost need two pages to describe the rndis
+         * header. We can only transmit MAX_PAGE_BUFFER_COUNT number
          * of pages in a single packet. If skb is scattered around
          * more pages we try linearizing it.
          */
-        num_data_pgs = netvsc_get_slots(skb);
+
+        num_data_pgs = netvsc_get_slots(skb) + 2;
+
         if (unlikely(num_data_pgs > MAX_PAGE_BUFFER_COUNT)) {
                 ++net_device_ctx->eth_stats.tx_scattered;
 
                 if (skb_linearize(skb))
                         goto no_memory;
 
-                num_data_pgs = netvsc_get_slots(skb);
+                num_data_pgs = netvsc_get_slots(skb) + 2;
                 if (num_data_pgs > MAX_PAGE_BUFFER_COUNT) {
                         ++net_device_ctx->eth_stats.tx_too_big;
                         goto drop;
@@ -1246,7 +1269,12 @@ static void netvsc_link_change(struct work_struct *w)
         bool notify = false, reschedule = false;
         unsigned long flags, next_reconfig, delay;
 
-        rtnl_lock();
+        /* if changes are happening, comeback later */
+        if (!rtnl_trylock()) {
+                schedule_delayed_work(&ndev_ctx->dwork, LINKCHANGE_INT);
+                return;
+        }
+
         net_device = rtnl_dereference(ndev_ctx->nvdev);
         if (!net_device)
                 goto out_unlock;
diff --git a/drivers/net/hyperv/rndis_filter.c b/drivers/net/hyperv/rndis_filter.c
index 85c00e1c52b6..d6308ffda53e 100644
--- a/drivers/net/hyperv/rndis_filter.c
+++ b/drivers/net/hyperv/rndis_filter.c
@@ -1048,8 +1048,8 @@ static void netvsc_sc_open(struct vmbus_channel *new_sc)
         else
                 netif_napi_del(&nvchan->napi);
 
-        if (refcount_dec_and_test(&nvscdev->sc_offered))
-                complete(&nvscdev->channel_init_wait);
+        atomic_inc(&nvscdev->open_chn);
+        wake_up(&nvscdev->subchan_open);
 }
 
 int rndis_filter_device_add(struct hv_device *dev,
@@ -1090,8 +1090,6 @@ int rndis_filter_device_add(struct hv_device *dev,
         net_device->max_chn = 1;
         net_device->num_chn = 1;
 
-        refcount_set(&net_device->sc_offered, 0);
-
         net_device->extension = rndis_device;
         rndis_device->ndev = net;
 
@@ -1221,11 +1219,11 @@ int rndis_filter_device_add(struct hv_device *dev,
                 rndis_device->ind_table[i] = ethtool_rxfh_indir_default(i,
                                                         net_device->num_chn);
 
+        atomic_set(&net_device->open_chn, 1);
         num_rss_qs = net_device->num_chn - 1;
         if (num_rss_qs == 0)
                 return 0;
 
-        refcount_set(&net_device->sc_offered, num_rss_qs);
         vmbus_set_sc_create_callback(dev->channel, netvsc_sc_open);
 
         init_packet = &net_device->channel_init_pkt;
@@ -1242,15 +1240,19 @@ int rndis_filter_device_add(struct hv_device *dev,
         if (ret)
                 goto out;
 
+        wait_for_completion(&net_device->channel_init_wait);
         if (init_packet->msg.v5_msg.subchn_comp.status != NVSP_STAT_SUCCESS) {
                 ret = -ENODEV;
                 goto out;
         }
-        wait_for_completion(&net_device->channel_init_wait);
 
         net_device->num_chn = 1 +
                 init_packet->msg.v5_msg.subchn_comp.num_subchannels;
 
+        /* wait for all sub channels to open */
+        wait_event(net_device->subchan_open,
+                   atomic_read(&net_device->open_chn) == net_device->num_chn);
+
         /* ignore failues from setting rss parameters, still have channels */
         rndis_filter_set_rss_param(rndis_device, netvsc_hash_key,
                                    net_device->num_chn);
diff --git a/drivers/net/ipvlan/ipvlan_main.c b/drivers/net/ipvlan/ipvlan_main.c
index f37e3c1fd4e7..8dab74a81303 100644
--- a/drivers/net/ipvlan/ipvlan_main.c
+++ b/drivers/net/ipvlan/ipvlan_main.c
@@ -192,7 +192,7 @@ static int ipvlan_init(struct net_device *dev)
 
         netdev_lockdep_set_classes(dev);
 
-        ipvlan->pcpu_stats = alloc_percpu(struct ipvl_pcpu_stats);
+        ipvlan->pcpu_stats = netdev_alloc_pcpu_stats(struct ipvl_pcpu_stats);
         if (!ipvlan->pcpu_stats)
                 return -ENOMEM;
 
diff --git a/drivers/net/irda/mcs7780.c b/drivers/net/irda/mcs7780.c
index 6f6ed75b63c9..765de3bedb88 100644
--- a/drivers/net/irda/mcs7780.c
+++ b/drivers/net/irda/mcs7780.c
@@ -141,9 +141,19 @@ static int mcs_set_reg(struct mcs_cb *mcs, __u16 reg, __u16 val)
 static int mcs_get_reg(struct mcs_cb *mcs, __u16 reg, __u16 * val)
 {
         struct usb_device *dev = mcs->usbdev;
-        int ret = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), MCS_RDREQ,
-                                  MCS_RD_RTYPE, 0, reg, val, 2,
-                                  msecs_to_jiffies(MCS_CTRL_TIMEOUT));
+        void *dmabuf;
+        int ret;
+
+        dmabuf = kmalloc(sizeof(__u16), GFP_KERNEL);
+        if (!dmabuf)
+                return -ENOMEM;
+
+        ret = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), MCS_RDREQ,
+                              MCS_RD_RTYPE, 0, reg, dmabuf, 2,
+                              msecs_to_jiffies(MCS_CTRL_TIMEOUT));
+
+        memcpy(val, dmabuf, sizeof(__u16));
+        kfree(dmabuf);
 
         return ret;
 }
diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c
index 5e1ab1160856..98e4deaa3a6a 100644
--- a/drivers/net/macsec.c
+++ b/drivers/net/macsec.c
@@ -3521,6 +3521,7 @@ module_init(macsec_init);
 module_exit(macsec_exit);
 
 MODULE_ALIAS_RTNL_LINK("macsec");
+MODULE_ALIAS_GENL_FAMILY("macsec");
 
 MODULE_DESCRIPTION("MACsec IEEE 802.1AE");
 MODULE_LICENSE("GPL v2");
diff --git a/drivers/net/phy/Kconfig b/drivers/net/phy/Kconfig
index 2dda72004a7d..928fd892f167 100644
--- a/drivers/net/phy/Kconfig
+++ b/drivers/net/phy/Kconfig
@@ -7,7 +7,16 @@ menuconfig MDIO_DEVICE
         help
            MDIO devices and driver infrastructure code.
 
-if MDIO_DEVICE
+config MDIO_BUS
+        tristate
+        default m if PHYLIB=m
+        default MDIO_DEVICE
+        help
+          This internal symbol is used for link time dependencies and it
+          reflects whether the mdio_bus/mdio_device code is built as a
+          loadable module or built-in.
+
+if MDIO_BUS
 
 config MDIO_BCM_IPROC
         tristate "Broadcom iProc MDIO bus controller"
@@ -28,7 +37,6 @@ config MDIO_BCM_UNIMAC
 
 config MDIO_BITBANG
         tristate "Bitbanged MDIO buses"
-        depends on !(MDIO_DEVICE=y && PHYLIB=m)
         help
           This module implements the MDIO bus protocol in software,
           for use by low level drivers that export the ability to
@@ -127,7 +135,6 @@ config MDIO_THUNDER
         tristate "ThunderX SOCs MDIO buses"
         depends on 64BIT
         depends on PCI
-        depends on !(MDIO_DEVICE=y && PHYLIB=m)
         select MDIO_CAVIUM
         help
           This driver supports the MDIO interfaces found on Cavium
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index 1790f7fec125..2f742ae5b92e 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -864,15 +864,17 @@ EXPORT_SYMBOL(phy_attached_info);
 #define ATTACHED_FMT "attached PHY driver [%s] (mii_bus:phy_addr=%s, irq=%d)"
 void phy_attached_print(struct phy_device *phydev, const char *fmt, ...)
 {
+        const char *drv_name = phydev->drv ? phydev->drv->name : "unbound";
+
         if (!fmt) {
                 dev_info(&phydev->mdio.dev, ATTACHED_FMT "\n",
-                         phydev->drv->name, phydev_name(phydev),
+                         drv_name, phydev_name(phydev),
                          phydev->irq);
         } else {
                 va_list ap;
 
                 dev_info(&phydev->mdio.dev, ATTACHED_FMT,
-                         phydev->drv->name, phydev_name(phydev),
+                         drv_name, phydev_name(phydev),
                          phydev->irq);
 
                 va_start(ap, fmt);
diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
index bd4303944e44..a404552555d4 100644
--- a/drivers/net/ppp/ppp_generic.c
+++ b/drivers/net/ppp/ppp_generic.c
@@ -1915,21 +1915,23 @@ static void __ppp_channel_push(struct channel *pch)
         spin_unlock(&pch->downl);
         /* see if there is anything from the attached unit to be sent */
         if (skb_queue_empty(&pch->file.xq)) {
-                read_lock(&pch->upl);
                 ppp = pch->ppp;
                 if (ppp)
-                        ppp_xmit_process(ppp);
-                read_unlock(&pch->upl);
+                        __ppp_xmit_process(ppp);
         }
 }
 
 static void ppp_channel_push(struct channel *pch)
 {
-        local_bh_disable();
-
-        __ppp_channel_push(pch);
-
-        local_bh_enable();
+        read_lock_bh(&pch->upl);
+        if (pch->ppp) {
+                (*this_cpu_ptr(pch->ppp->xmit_recursion))++;
+                __ppp_channel_push(pch);
+                (*this_cpu_ptr(pch->ppp->xmit_recursion))--;
+        } else {
+                __ppp_channel_push(pch);
+        }
+        read_unlock_bh(&pch->upl);
 }
 
 /*
diff --git a/drivers/net/ppp/pptp.c b/drivers/net/ppp/pptp.c
index eac499c58aa7..6dde9a0cfe76 100644
--- a/drivers/net/ppp/pptp.c
+++ b/drivers/net/ppp/pptp.c
@@ -131,7 +131,6 @@ static void del_chan(struct pppox_sock *sock)
         clear_bit(sock->proto.pptp.src_addr.call_id, callid_bitmap);
         RCU_INIT_POINTER(callid_sock[sock->proto.pptp.src_addr.call_id], NULL);
         spin_unlock(&chan_lock);
-        synchronize_rcu();
 }
 
 static int pptp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
@@ -520,6 +519,7 @@ static int pptp_release(struct socket *sock)
 
         po = pppox_sk(sk);
         del_chan(po);
+        synchronize_rcu();
 
         pppox_unbind_sock(sk);
         sk->sk_state = PPPOX_DEAD;
diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
index 464570409796..ae53e899259f 100644
--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -60,11 +60,11 @@ static struct team_port *team_port_get_rtnl(const struct net_device *dev)
 static int __set_port_dev_addr(struct net_device *port_dev,
                                const unsigned char *dev_addr)
 {
-        struct sockaddr addr;
+        struct sockaddr_storage addr;
 
-        memcpy(addr.sa_data, dev_addr, port_dev->addr_len);
-        addr.sa_family = port_dev->type;
-        return dev_set_mac_address(port_dev, &addr);
+        memcpy(addr.__data, dev_addr, port_dev->addr_len);
+        addr.ss_family = port_dev->type;
+        return dev_set_mac_address(port_dev, (struct sockaddr *)&addr);
 }
 
 static int team_port_set_orig_dev_addr(struct team_port *port)
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 3d4c24572ecd..0a2c0a42283f 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1879,6 +1879,9 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
 
 err_detach:
         tun_detach_all(dev);
+        /* register_netdevice() already called tun_free_netdev() */
+        goto err_free_dev;
+
 err_free_flow:
         tun_flow_uninit(tun);
         security_tun_dev_free_security(tun->security);
@@ -2598,8 +2601,16 @@ static int __init tun_init(void)
                 goto err_misc;
         }
 
-        register_netdevice_notifier(&tun_notifier_block);
+        ret = register_netdevice_notifier(&tun_notifier_block);
+        if (ret) {
+                pr_err("Can't register netdevice notifier\n");
+                goto err_notifier;
+        }
+
         return  0;
+
+err_notifier:
+        misc_deregister(&tun_miscdev);
 err_misc:
         rtnl_link_unregister(&tun_link_ops);
 err_linkops:
diff --git a/drivers/net/usb/asix.h b/drivers/net/usb/asix.h
index d1092421aaa7..9a4171b90947 100644
--- a/drivers/net/usb/asix.h
+++ b/drivers/net/usb/asix.h
@@ -209,6 +209,7 @@ void asix_write_cmd_async(struct usbnet *dev, u8 cmd, u16 value,
 int asix_rx_fixup_internal(struct usbnet *dev, struct sk_buff *skb,
                            struct asix_rx_fixup_info *rx);
 int asix_rx_fixup_common(struct usbnet *dev, struct sk_buff *skb);
+void asix_rx_fixup_common_free(struct asix_common_private *dp);
 
 struct sk_buff *asix_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
                               gfp_t flags);
diff --git a/drivers/net/usb/asix_common.c b/drivers/net/usb/asix_common.c
index 7847436c441e..522d2900cd1d 100644
--- a/drivers/net/usb/asix_common.c
+++ b/drivers/net/usb/asix_common.c
@@ -75,6 +75,27 @@ void asix_write_cmd_async(struct usbnet *dev, u8 cmd, u16 value, u16 index,
                                value, index, data, size);
 }
 
+static void reset_asix_rx_fixup_info(struct asix_rx_fixup_info *rx)
+{
+        /* Reset the variables that have a lifetime outside of
+         * asix_rx_fixup_internal() so that future processing starts from a
+         * known set of initial conditions.
+         */
+
+        if (rx->ax_skb) {
+                /* Discard any incomplete Ethernet frame in the netdev buffer */
+                kfree_skb(rx->ax_skb);
+                rx->ax_skb = NULL;
+        }
+
+        /* Assume the Data header 32-bit word is at the start of the current
+         * or next URB socket buffer so reset all the state variables.
+         */
+        rx->remaining = 0;
+        rx->split_head = false;
+        rx->header = 0;
+}
+
 int asix_rx_fixup_internal(struct usbnet *dev, struct sk_buff *skb,
                            struct asix_rx_fixup_info *rx)
 {
@@ -99,15 +120,7 @@ int asix_rx_fixup_internal(struct usbnet *dev, struct sk_buff *skb,
                 if (size != ((~rx->header >> 16) & 0x7ff)) {
                         netdev_err(dev->net, "asix_rx_fixup() Data Header synchronisation was lost, remaining %d\n",
                                    rx->remaining);
-                        if (rx->ax_skb) {
-                                kfree_skb(rx->ax_skb);
-                                rx->ax_skb = NULL;
-                                /* Discard the incomplete netdev Ethernet frame
-                                 * and assume the Data header is at the start of
-                                 * the current URB socket buffer.
-                                 */
-                        }
-                        rx->remaining = 0;
+                        reset_asix_rx_fixup_info(rx);
                 }
         }
 
@@ -139,11 +152,13 @@ int asix_rx_fixup_internal(struct usbnet *dev, struct sk_buff *skb,
                         if (size != ((~rx->header >> 16) & 0x7ff)) {
                                 netdev_err(dev->net, "asix_rx_fixup() Bad Header Length 0x%x, offset %d\n",
                                            rx->header, offset);
+                                reset_asix_rx_fixup_info(rx);
                                 return 0;
                         }
                         if (size > dev->net->mtu + ETH_HLEN + VLAN_HLEN) {
                                 netdev_dbg(dev->net, "asix_rx_fixup() Bad RX Length %d\n",
                                            size);
+                                reset_asix_rx_fixup_info(rx);
                                 return 0;
                         }
 
@@ -168,8 +183,10 @@ int asix_rx_fixup_internal(struct usbnet *dev, struct sk_buff *skb,
                 if (rx->ax_skb) {
                         skb_put_data(rx->ax_skb, skb->data + offset,
                                      copy_length);
-                        if (!rx->remaining)
+                        if (!rx->remaining) {
                                 usbnet_skb_return(dev, rx->ax_skb);
+                                rx->ax_skb = NULL;
+                        }
                 }
 
                 offset += (copy_length + 1) & 0xfffe;
@@ -178,6 +195,7 @@ int asix_rx_fixup_internal(struct usbnet *dev, struct sk_buff *skb,
         if (skb->len != offset) {
                 netdev_err(dev->net, "asix_rx_fixup() Bad SKB Length %d, %d\n",
                            skb->len, offset);
+                reset_asix_rx_fixup_info(rx);
                 return 0;
         }
 
@@ -192,6 +210,21 @@ int asix_rx_fixup_common(struct usbnet *dev, struct sk_buff *skb)
         return asix_rx_fixup_internal(dev, skb, rx);
 }
 
+void asix_rx_fixup_common_free(struct asix_common_private *dp)
+{
+        struct asix_rx_fixup_info *rx;
+
+        if (!dp)
+                return;
+
+        rx = &dp->rx_fixup_info;
+
+        if (rx->ax_skb) {
+                kfree_skb(rx->ax_skb);
+                rx->ax_skb = NULL;
+        }
+}
+
 struct sk_buff *asix_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
                               gfp_t flags)
 {
diff --git a/drivers/net/usb/asix_devices.c b/drivers/net/usb/asix_devices.c
index a3aa0a27dfe5..b2ff88e69a81 100644
--- a/drivers/net/usb/asix_devices.c
+++ b/drivers/net/usb/asix_devices.c
@@ -764,6 +764,7 @@ static int ax88772_bind(struct usbnet *dev, struct usb_interface *intf)
 
 static void ax88772_unbind(struct usbnet *dev, struct usb_interface *intf)
 {
+        asix_rx_fixup_common_free(dev->driver_priv);
         kfree(dev->driver_priv);
 }
 
diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
index 8f572b9f3625..9c80e80c5493 100644
--- a/drivers/net/usb/cdc_ncm.c
+++ b/drivers/net/usb/cdc_ncm.c
@@ -1758,6 +1758,13 @@ static const struct usb_device_id cdc_devs[] = {
           .driver_info = (unsigned long)&wwan_noarp_info,
         },
 
+        /* u-blox TOBY-L4 */
+        { USB_DEVICE_AND_INTERFACE_INFO(0x1546, 0x1010,
+                USB_CLASS_COMM,
+                USB_CDC_SUBCLASS_NCM, USB_CDC_PROTO_NONE),
+          .driver_info = (unsigned long)&wwan_info,
+        },
+
         /* Generic CDC-NCM devices */
         { USB_INTERFACE_INFO(USB_CLASS_COMM,
                 USB_CDC_SUBCLASS_NCM, USB_CDC_PROTO_NONE),
diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
index 5833f7e2a127..b99a7fb09f8e 100644
--- a/drivers/net/usb/lan78xx.c
+++ b/drivers/net/usb/lan78xx.c
@@ -2367,9 +2367,6 @@ static int lan78xx_reset(struct lan78xx_net *dev)
         /* Init LTM */
         lan78xx_init_ltm(dev);
 
-        dev->net->hard_header_len += TX_OVERHEAD;
-        dev->hard_mtu = dev->net->mtu + dev->net->hard_header_len;
-
         if (dev->udev->speed == USB_SPEED_SUPER) {
                 buf = DEFAULT_BURST_CAP_SIZE / SS_USB_PKT_SIZE;
                 dev->rx_urb_size = DEFAULT_BURST_CAP_SIZE;
@@ -2855,16 +2852,19 @@ static int lan78xx_bind(struct lan78xx_net *dev, struct usb_interface *intf)
                 return ret;
         }
 
+        dev->net->hard_header_len += TX_OVERHEAD;
+        dev->hard_mtu = dev->net->mtu + dev->net->hard_header_len;
+
         /* Init all registers */
         ret = lan78xx_reset(dev);
 
-        lan78xx_mdio_init(dev);
+        ret = lan78xx_mdio_init(dev);
 
         dev->net->flags |= IFF_MULTICAST;
 
         pdata->wol = WAKE_MAGIC;
 
-        return 0;
+        return ret;
 }
 
 static void lan78xx_unbind(struct lan78xx_net *dev, struct usb_interface *intf)
@@ -3525,11 +3525,11 @@ static int lan78xx_probe(struct usb_interface *intf,
         udev = interface_to_usbdev(intf);
         udev = usb_get_dev(udev);
 
-        ret = -ENOMEM;
         netdev = alloc_etherdev(sizeof(struct lan78xx_net));
         if (!netdev) {
-                        dev_err(&intf->dev, "Error: OOM\n");
-                        goto out1;
+                dev_err(&intf->dev, "Error: OOM\n");
+                ret = -ENOMEM;
+                goto out1;
         }
 
         /* netdev_printk() needs this */
@@ -3610,7 +3610,7 @@ static int lan78xx_probe(struct usb_interface *intf,
         ret = register_netdev(netdev);
         if (ret != 0) {
                 netif_err(dev, probe, netdev, "couldn't register the device\n");
-                goto out2;
+                goto out3;
         }
 
         usb_set_intfdata(intf, dev);
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 5894e3c9468f..8c3733608271 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -1175,6 +1175,7 @@ static const struct usb_device_id products[] = {
         {QMI_FIXED_INTF(0x19d2, 0x1428, 2)},    /* Telewell TW-LTE 4G v2 */
         {QMI_FIXED_INTF(0x19d2, 0x2002, 4)},    /* ZTE (Vodafone) K3765-Z */
         {QMI_FIXED_INTF(0x2001, 0x7e19, 4)},    /* D-Link DWM-221 B1 */
+        {QMI_FIXED_INTF(0x2001, 0x7e35, 4)},    /* D-Link DWM-222 */
         {QMI_FIXED_INTF(0x0f3d, 0x68a2, 8)},    /* Sierra Wireless MC7700 */
         {QMI_FIXED_INTF(0x114f, 0x68a2, 8)},    /* Sierra Wireless MC7750 */
         {QMI_FIXED_INTF(0x1199, 0x68a2, 8)},    /* Sierra Wireless MC7710 in QMI mode */
@@ -1340,10 +1341,14 @@ static int qmi_wwan_probe(struct usb_interface *intf,
 static void qmi_wwan_disconnect(struct usb_interface *intf)
 {
         struct usbnet *dev = usb_get_intfdata(intf);
-        struct qmi_wwan_state *info = (void *)&dev->data;
+        struct qmi_wwan_state *info;
         struct list_head *iter;
         struct net_device *ldev;
 
+        /* called twice if separate control and data intf */
+        if (!dev)
+                return;
+        info = (void *)&dev->data;
         if (info->flags & QMI_WWAN_FLAG_MUX) {
                 if (!rtnl_trylock()) {
                         restart_syscall();
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 99a26a9efec1..b06169ea60dc 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -889,21 +889,20 @@ static int add_recvbuf_mergeable(struct virtnet_info *vi,
 
         buf = (char *)page_address(alloc_frag->page) + alloc_frag->offset;
         buf += headroom; /* advance address leaving hole at front of pkt */
-        ctx = (void *)(unsigned long)len;
         get_page(alloc_frag->page);
         alloc_frag->offset += len + headroom;
         hole = alloc_frag->size - alloc_frag->offset;
         if (hole < len + headroom) {
                 /* To avoid internal fragmentation, if there is very likely not
                  * enough space for another buffer, add the remaining space to
-                 * the current buffer. This extra space is not included in
-                 * the truesize stored in ctx.
+                 * the current buffer.
                  */
                 len += hole;
                 alloc_frag->offset += hole;
         }
 
         sg_init_one(rq->sg, buf, len);
+        ctx = (void *)(unsigned long)len;
         err = virtqueue_add_inbuf_ctx(rq->vq, rq->sg, 1, buf, ctx, gfp);
         if (err < 0)
                 put_page(virt_to_head_page(buf));
@@ -1059,7 +1058,7 @@ static void free_old_xmit_skbs(struct send_queue *sq)
                 bytes += skb->len;
                 packets++;
 
-                dev_kfree_skb_any(skb);
+                dev_consume_skb_any(skb);
         }
 
         /* Avoid overhead when no packets have been processed
@@ -2743,9 +2742,9 @@ module_init(virtio_net_driver_init);
 
 static __exit void virtio_net_driver_exit(void)
 {
+        unregister_virtio_driver(&virtio_net_driver);
         cpuhp_remove_multi_state(CPUHP_VIRT_NET_DEAD);
         cpuhp_remove_multi_state(virtionet_online);
-        unregister_virtio_driver(&virtio_net_driver);
 }
 module_exit(virtio_net_driver_exit);
 
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index 96aa7e6cf214..e17baac70f43 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -623,6 +623,7 @@ static struct sk_buff **vxlan_gro_receive(struct sock *sk,
 
 out:
         skb_gro_remcsum_cleanup(skb, &grc);
+        skb->remcsum_offload = 0;
         NAPI_GRO_CB(skb)->flush |= flush;
 
         return pp;
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
index 2153e8062b4c..5cc3a07dda9e 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
@@ -214,7 +214,7 @@ static netdev_tx_t brcmf_netdev_start_xmit(struct sk_buff *skb,
 
         /* Make sure there's enough writeable headroom */
         if (skb_headroom(skb) < drvr->hdrlen || skb_header_cloned(skb)) {
-                head_delta = drvr->hdrlen - skb_headroom(skb);
+                head_delta = max_t(int, drvr->hdrlen - skb_headroom(skb), 0);
 
                 brcmf_dbg(INFO, "%s: insufficient headroom (%d)\n",
                           brcmf_ifname(ifp), head_delta);
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
index d21258d277ce..f1b60740e020 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
@@ -159,8 +159,10 @@ void brcmf_feat_attach(struct brcmf_pub *drvr)
 
         brcmf_feat_firmware_capabilities(ifp);
         memset(&gscan_cfg, 0, sizeof(gscan_cfg));
-        brcmf_feat_iovar_data_set(ifp, BRCMF_FEAT_GSCAN, "pfn_gscan_cfg",
-                                  &gscan_cfg, sizeof(gscan_cfg));
+        if (drvr->bus_if->chip != BRCM_CC_43430_CHIP_ID)
+                brcmf_feat_iovar_data_set(ifp, BRCMF_FEAT_GSCAN,
+                                          "pfn_gscan_cfg",
+                                          &gscan_cfg, sizeof(gscan_cfg));
         brcmf_feat_iovar_int_get(ifp, BRCMF_FEAT_PNO, "pfn");
         if (drvr->bus_if->wowl_supported)
                 brcmf_feat_iovar_int_get(ifp, BRCMF_FEAT_WOWL, "wowl");
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
index fbcbb4325936..f3556122c6ac 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
@@ -2053,12 +2053,13 @@ static int brcmf_sdio_txpkt_hdalign(struct brcmf_sdio *bus, struct sk_buff *pkt)
                                 atomic_inc(&stats->pktcow_failed);
                                 return -ENOMEM;
                         }
+                        head_pad = 0;
                 }
                 skb_push(pkt, head_pad);
                 dat_buf = (u8 *)(pkt->data);
         }
         memset(dat_buf, 0, head_pad + bus->tx_hdrlen);
-        return 0;
+        return head_pad;
 }
 
 /**
@@ -4174,11 +4175,6 @@ struct brcmf_sdio *brcmf_sdio_probe(struct brcmf_sdio_dev *sdiodev)
                 goto fail;
         }
 
-        /* allocate scatter-gather table. sg support
-         * will be disabled upon allocation failure.
-         */
-        brcmf_sdiod_sgtable_alloc(bus->sdiodev);
-
         /* Query the F2 block size, set roundup accordingly */
         bus->blocksize = bus->sdiodev->func[2]->cur_blksize;
         bus->roundup = min(max_roundup, bus->blocksize);
diff --git a/drivers/net/wireless/intel/iwlwifi/cfg/9000.c b/drivers/net/wireless/intel/iwlwifi/cfg/9000.c
index b4ecd1fe1374..97208ce19f92 100644
--- a/drivers/net/wireless/intel/iwlwifi/cfg/9000.c
+++ b/drivers/net/wireless/intel/iwlwifi/cfg/9000.c
@@ -154,7 +154,7 @@ static const struct iwl_tt_params iwl9000_tt_params = {
 const struct iwl_cfg iwl9160_2ac_cfg = {
         .name = "Intel(R) Dual Band Wireless AC 9160",
         .fw_name_pre = IWL9260A_FW_PRE,
-        .fw_name_pre_next_step = IWL9260B_FW_PRE,
+        .fw_name_pre_b_or_c_step = IWL9260B_FW_PRE,
         IWL_DEVICE_9000,
         .ht_params = &iwl9000_ht_params,
         .nvm_ver = IWL9000_NVM_VERSION,
@@ -165,7 +165,7 @@ const struct iwl_cfg iwl9160_2ac_cfg = {
 const struct iwl_cfg iwl9260_2ac_cfg = {
         .name = "Intel(R) Dual Band Wireless AC 9260",
         .fw_name_pre = IWL9260A_FW_PRE,
-        .fw_name_pre_next_step = IWL9260B_FW_PRE,
+        .fw_name_pre_b_or_c_step = IWL9260B_FW_PRE,
         IWL_DEVICE_9000,
         .ht_params = &iwl9000_ht_params,
         .nvm_ver = IWL9000_NVM_VERSION,
@@ -176,7 +176,7 @@ const struct iwl_cfg iwl9260_2ac_cfg = {
 const struct iwl_cfg iwl9270_2ac_cfg = {
         .name = "Intel(R) Dual Band Wireless AC 9270",
         .fw_name_pre = IWL9260A_FW_PRE,
-        .fw_name_pre_next_step = IWL9260B_FW_PRE,
+        .fw_name_pre_b_or_c_step = IWL9260B_FW_PRE,
         IWL_DEVICE_9000,
         .ht_params = &iwl9000_ht_params,
         .nvm_ver = IWL9000_NVM_VERSION,
@@ -186,8 +186,8 @@ const struct iwl_cfg iwl9270_2ac_cfg = {
 
 const struct iwl_cfg iwl9460_2ac_cfg = {
         .name = "Intel(R) Dual Band Wireless AC 9460",
-        .fw_name_pre = IWL9000_FW_PRE,
-        .fw_name_pre_rf_next_step = IWL9000RFB_FW_PRE,
+        .fw_name_pre = IWL9260A_FW_PRE,
+        .fw_name_pre_b_or_c_step = IWL9260B_FW_PRE,
         IWL_DEVICE_9000,
         .ht_params = &iwl9000_ht_params,
         .nvm_ver = IWL9000_NVM_VERSION,
@@ -198,8 +198,8 @@ const struct iwl_cfg iwl9460_2ac_cfg = {
 
 const struct iwl_cfg iwl9560_2ac_cfg = {
         .name = "Intel(R) Dual Band Wireless AC 9560",
-        .fw_name_pre = IWL9000_FW_PRE,
-        .fw_name_pre_rf_next_step = IWL9000RFB_FW_PRE,
+        .fw_name_pre = IWL9260A_FW_PRE,
+        .fw_name_pre_b_or_c_step = IWL9260B_FW_PRE,
         IWL_DEVICE_9000,
         .ht_params = &iwl9000_ht_params,
         .nvm_ver = IWL9000_NVM_VERSION,
diff --git a/drivers/net/wireless/intel/iwlwifi/dvm/tx.c b/drivers/net/wireless/intel/iwlwifi/dvm/tx.c
index adaa2f0097cc..fb40ddfced99 100644
--- a/drivers/net/wireless/intel/iwlwifi/dvm/tx.c
+++ b/drivers/net/wireless/intel/iwlwifi/dvm/tx.c
@@ -1189,11 +1189,11 @@ void iwlagn_rx_reply_tx(struct iwl_priv *priv, struct iwl_rx_cmd_buffer *rxb)
                                 next_reclaimed;
                         IWL_DEBUG_TX_REPLY(priv, "Next reclaimed packet:%d\n",
                                                   next_reclaimed);
+                        iwlagn_check_ratid_empty(priv, sta_id, tid);
                 }
 
                 iwl_trans_reclaim(priv->trans, txq_id, ssn, &skbs);
 
-                iwlagn_check_ratid_empty(priv, sta_id, tid);
                 freed = 0;
 
                 /* process frames */
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/file.h b/drivers/net/wireless/intel/iwlwifi/fw/file.h
index 0fa8c473f1e2..c73a6438ce8f 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/file.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/file.h
@@ -328,6 +328,7 @@ typedef unsigned int __bitwise iwl_ucode_tlv_capa_t;
  * @IWL_UCODE_TLV_CAPA_TX_POWER_ACK: reduced TX power API has larger
  *      command size (command version 4) that supports toggling ACK TX
  *      power reduction.
+ * @IWL_UCODE_TLV_CAPA_MLME_OFFLOAD: supports MLME offload
  *
  * @NUM_IWL_UCODE_TLV_CAPA: number of bits used
  */
@@ -373,6 +374,7 @@ enum iwl_ucode_tlv_capa {
         IWL_UCODE_TLV_CAPA_EXTEND_SHARED_MEM_CFG        = (__force iwl_ucode_tlv_capa_t)80,
         IWL_UCODE_TLV_CAPA_LQM_SUPPORT                  = (__force iwl_ucode_tlv_capa_t)81,
         IWL_UCODE_TLV_CAPA_TX_POWER_ACK                 = (__force iwl_ucode_tlv_capa_t)84,
+        IWL_UCODE_TLV_CAPA_MLME_OFFLOAD                 = (__force iwl_ucode_tlv_capa_t)96,
 
         NUM_IWL_UCODE_TLV_CAPA
 #ifdef __CHECKER__
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-config.h b/drivers/net/wireless/intel/iwlwifi/iwl-config.h
index c52623cb7c2a..d19c74827fbb 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-config.h
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-config.h
@@ -276,10 +276,10 @@ struct iwl_pwr_tx_backoff {
  * @fw_name_pre: Firmware filename prefix. The api version and extension
  *      (.ucode) will be added to filename before loading from disk. The
  *      filename is constructed as fw_name_pre<api>.ucode.
- * @fw_name_pre_next_step: same as @fw_name_pre, only for next step
+ * @fw_name_pre_b_or_c_step: same as @fw_name_pre, only for b or c steps
  *      (if supported)
- * @fw_name_pre_rf_next_step: same as @fw_name_pre_next_step, only for rf next
- *      step. Supported only in integrated solutions.
+ * @fw_name_pre_rf_next_step: same as @fw_name_pre_b_or_c_step, only for rf
+ *      next step. Supported only in integrated solutions.
  * @ucode_api_max: Highest version of uCode API supported by driver.
  * @ucode_api_min: Lowest version of uCode API supported by driver.
  * @max_inst_size: The maximal length of the fw inst section
@@ -330,7 +330,7 @@ struct iwl_cfg {
         /* params specific to an individual device within a device family */
         const char *name;
         const char *fw_name_pre;
-        const char *fw_name_pre_next_step;
+        const char *fw_name_pre_b_or_c_step;
         const char *fw_name_pre_rf_next_step;
         /* params not likely to change within a device family */
         const struct iwl_base_params *base_params;
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-devtrace.h b/drivers/net/wireless/intel/iwlwifi/iwl-devtrace.h
index 545d14b0bc92..f5c1127253cb 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-devtrace.h
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-devtrace.h
@@ -55,8 +55,8 @@ static inline bool iwl_trace_data(struct sk_buff *skb)
         /* also account for the RFC 1042 header, of course */
         offs += 6;
 
-        return skb->len > offs + 2 &&
-               *(__be16 *)(skb->data + offs) == cpu_to_be16(ETH_P_PAE);
+        return skb->len <= offs + 2 ||
+                *(__be16 *)(skb->data + offs) != cpu_to_be16(ETH_P_PAE);
 }
 
 static inline size_t iwl_rx_trace_len(const struct iwl_trans *trans,
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
index 6fdb5921e17f..4e0f86fe0a6f 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
@@ -216,8 +216,9 @@ static int iwl_request_firmware(struct iwl_drv *drv, bool first)
         const char *fw_pre_name;
 
         if (drv->trans->cfg->device_family == IWL_DEVICE_FAMILY_9000 &&
-            CSR_HW_REV_STEP(drv->trans->hw_rev) == SILICON_B_STEP)
-                fw_pre_name = cfg->fw_name_pre_next_step;
+            (CSR_HW_REV_STEP(drv->trans->hw_rev) == SILICON_B_STEP ||
+             CSR_HW_REV_STEP(drv->trans->hw_rev) == SILICON_C_STEP))
+                fw_pre_name = cfg->fw_name_pre_b_or_c_step;
         else if (drv->trans->cfg->integrated &&
                  CSR_HW_RFID_STEP(drv->trans->hw_rf_id) == SILICON_B_STEP &&
                  cfg->fw_name_pre_rf_next_step)
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
index 5c08f4d40f6a..3ee6767392b6 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
@@ -785,7 +785,8 @@ iwl_parse_nvm_mcc_info(struct device *dev, const struct iwl_cfg *cfg,
                        int num_of_ch, __le32 *channels, u16 fw_mcc)
 {
         int ch_idx;
-        u16 ch_flags, prev_ch_flags = 0;
+        u16 ch_flags;
+        u32 reg_rule_flags, prev_reg_rule_flags = 0;
         const u8 *nvm_chan = cfg->ext_nvm ?
                              iwl_ext_nvm_channels : iwl_nvm_channels;
         struct ieee80211_regdomain *regd;
@@ -834,8 +835,11 @@ iwl_parse_nvm_mcc_info(struct device *dev, const struct iwl_cfg *cfg,
                         continue;
                 }
 
+                reg_rule_flags = iwl_nvm_get_regdom_bw_flags(nvm_chan, ch_idx,
+                                                             ch_flags, cfg);
+
                 /* we can't continue the same rule */
-                if (ch_idx == 0 || prev_ch_flags != ch_flags ||
+                if (ch_idx == 0 || prev_reg_rule_flags != reg_rule_flags ||
                     center_freq - prev_center_freq > 20) {
                         valid_rules++;
                         new_rule = true;
@@ -854,18 +858,17 @@ iwl_parse_nvm_mcc_info(struct device *dev, const struct iwl_cfg *cfg,
                 rule->power_rule.max_eirp =
                         DBM_TO_MBM(IWL_DEFAULT_MAX_TX_POWER);
 
-                rule->flags = iwl_nvm_get_regdom_bw_flags(nvm_chan, ch_idx,
-                                                          ch_flags, cfg);
+                rule->flags = reg_rule_flags;
 
                 /* rely on auto-calculation to merge BW of contiguous chans */
                 rule->flags |= NL80211_RRF_AUTO_BW;
                 rule->freq_range.max_bandwidth_khz = 0;
 
-                prev_ch_flags = ch_flags;
                 prev_center_freq = center_freq;
+                prev_reg_rule_flags = reg_rule_flags;
 
                 IWL_DEBUG_DEV(dev, IWL_DL_LAR,
-                              "Ch. %d [%sGHz] %s%s%s%s%s%s%s%s%s(0x%02x): Ad-Hoc %ssupported\n",
+                              "Ch. %d [%sGHz] %s%s%s%s%s%s%s%s%s(0x%02x) reg_flags 0x%x: %s\n",
                               center_freq,
                               band == NL80211_BAND_5GHZ ? "5.2" : "2.4",
                               CHECK_AND_PRINT_I(VALID),
@@ -877,10 +880,10 @@ iwl_parse_nvm_mcc_info(struct device *dev, const struct iwl_cfg *cfg,
                               CHECK_AND_PRINT_I(160MHZ),
                               CHECK_AND_PRINT_I(INDOOR_ONLY),
                               CHECK_AND_PRINT_I(GO_CONCURRENT),
-                              ch_flags,
+                              ch_flags, reg_rule_flags,
                               ((ch_flags & NVM_CHANNEL_ACTIVE) &&
                                !(ch_flags & NVM_CHANNEL_RADAR))
-                                         ? "" : "not ");
+                                         ? "Ad-Hoc" : "");
         }
 
         regd->n_reg_rules = valid_rules;
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
index 79e7a7a285dc..82863e9273eb 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
@@ -1275,8 +1275,10 @@ static int iwl_mvm_sar_get_wgds_table(struct iwl_mvm *mvm)
 
                         entry = &wifi_pkg->package.elements[idx++];
                         if ((entry->type != ACPI_TYPE_INTEGER) ||
-                            (entry->integer.value > U8_MAX))
-                                return -EINVAL;
+                            (entry->integer.value > U8_MAX)) {
+                                ret = -EINVAL;
+                                goto out_free;
+                        }
 
                         mvm->geo_profiles[i].values[j] = entry->integer.value;
                 }
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
index bcde1ba0f1c8..ce901be5fba8 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
@@ -1084,7 +1084,13 @@ int __iwl_mvm_mac_start(struct iwl_mvm *mvm)
 
         lockdep_assert_held(&mvm->mutex);
 
-        if (test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status)) {
+        if (test_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED, &mvm->status)) {
+                /*
+                 * Now convert the HW_RESTART_REQUESTED flag to IN_HW_RESTART
+                 * so later code will - from now on - see that we're doing it.
+                 */
+                set_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status);
+                clear_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED, &mvm->status);
                 /* Clean up some internal and mac80211 state on restart */
                 iwl_mvm_restart_cleanup(mvm);
         } else {
@@ -2591,8 +2597,18 @@ static void iwl_mvm_purge_deferred_tx_frames(struct iwl_mvm *mvm,
         spin_lock_bh(&mvm_sta->lock);
         for (i = 0; i <= IWL_MAX_TID_COUNT; i++) {
                 tid_data = &mvm_sta->tid_data[i];
-                while ((skb = __skb_dequeue(&tid_data->deferred_tx_frames)))
+
+                while ((skb = __skb_dequeue(&tid_data->deferred_tx_frames))) {
+                        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+
+                        /*
+                         * The first deferred frame should've stopped the MAC
+                         * queues, so we should never get a second deferred
+                         * frame for the RA/TID.
+                         */
+                        iwl_mvm_start_mac_queues(mvm, info->hw_queue);
                         ieee80211_free_txskb(mvm->hw, skb);
+                }
         }
         spin_unlock_bh(&mvm_sta->lock);
 }
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
index eaacfaf37206..ddd8719f27b8 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
@@ -1090,6 +1090,7 @@ struct iwl_mvm {
  * @IWL_MVM_STATUS_HW_RFKILL: HW RF-kill is asserted
  * @IWL_MVM_STATUS_HW_CTKILL: CT-kill is active
  * @IWL_MVM_STATUS_ROC_RUNNING: remain-on-channel is running
+ * @IWL_MVM_STATUS_HW_RESTART_REQUESTED: HW restart was requested
  * @IWL_MVM_STATUS_IN_HW_RESTART: HW restart is active
  * @IWL_MVM_STATUS_IN_D0I3: NIC is in D0i3
  * @IWL_MVM_STATUS_ROC_AUX_RUNNING: AUX remain-on-channel is running
@@ -1101,6 +1102,7 @@ enum iwl_mvm_status {
         IWL_MVM_STATUS_HW_RFKILL,
         IWL_MVM_STATUS_HW_CTKILL,
         IWL_MVM_STATUS_ROC_RUNNING,
+        IWL_MVM_STATUS_HW_RESTART_REQUESTED,
         IWL_MVM_STATUS_IN_HW_RESTART,
         IWL_MVM_STATUS_IN_D0I3,
         IWL_MVM_STATUS_ROC_AUX_RUNNING,
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
index 4d1188b8736a..9c175d5e9d67 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
@@ -1235,9 +1235,8 @@ void iwl_mvm_nic_restart(struct iwl_mvm *mvm, bool fw_error)
          */
         if (!mvm->fw_restart && fw_error) {
                 iwl_mvm_fw_dbg_collect_desc(mvm, &iwl_mvm_dump_desc_assert,
-                                            NULL);
-        } else if (test_and_set_bit(IWL_MVM_STATUS_IN_HW_RESTART,
-                                    &mvm->status)) {
+                                        NULL);
+        } else if (test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status)) {
                 struct iwl_mvm_reprobe *reprobe;
 
                 IWL_ERR(mvm,
@@ -1268,6 +1267,7 @@ void iwl_mvm_nic_restart(struct iwl_mvm *mvm, bool fw_error)
 
                 if (fw_error && mvm->fw_restart > 0)
                         mvm->fw_restart--;
+                set_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED, &mvm->status);
                 ieee80211_restart_hw(mvm->hw);
         }
 }
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
index 65beca3a457a..8999a1199d60 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
@@ -1291,7 +1291,7 @@ void iwl_mvm_rs_tx_status(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
          * first index into rate scale table.
          */
         if (info->flags & IEEE80211_TX_STAT_AMPDU) {
-                rs_collect_tpc_data(mvm, lq_sta, curr_tbl, lq_rate.index,
+                rs_collect_tpc_data(mvm, lq_sta, curr_tbl, tx_resp_rate.index,
                                     info->status.ampdu_len,
                                     info->status.ampdu_ack_len,
                                     reduced_txp);
@@ -1312,7 +1312,7 @@ void iwl_mvm_rs_tx_status(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
                 if (info->status.ampdu_ack_len == 0)
                         info->status.ampdu_len = 1;
 
-                rs_collect_tlc_data(mvm, lq_sta, curr_tbl, lq_rate.index,
+                rs_collect_tlc_data(mvm, lq_sta, curr_tbl, tx_resp_rate.index,
                                     info->status.ampdu_len,
                                     info->status.ampdu_ack_len);
 
@@ -1348,11 +1348,11 @@ void iwl_mvm_rs_tx_status(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
                                 continue;
 
                         rs_collect_tpc_data(mvm, lq_sta, tmp_tbl,
-                                            lq_rate.index, 1,
+                                            tx_resp_rate.index, 1,
                                             i < retries ? 0 : legacy_success,
                                             reduced_txp);
                         rs_collect_tlc_data(mvm, lq_sta, tmp_tbl,
-                                            lq_rate.index, 1,
+                                            tx_resp_rate.index, 1,
                                             i < retries ? 0 : legacy_success);
                 }
 
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
index f3e608196369..71c8b800ffa9 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
@@ -636,9 +636,9 @@ static bool iwl_mvm_reorder(struct iwl_mvm *mvm,
 
         baid_data = rcu_dereference(mvm->baid_map[baid]);
         if (!baid_data) {
-                WARN(!(reorder & IWL_RX_MPDU_REORDER_BA_OLD_SN),
-                     "Received baid %d, but no data exists for this BAID\n",
-                     baid);
+                IWL_DEBUG_RX(mvm,
+                             "Got valid BAID but no baid allocated, bypass the re-ordering buffer. Baid %d reorder 0x%x\n",
+                              baid, reorder);
                 return false;
         }
 
@@ -759,7 +759,9 @@ static void iwl_mvm_agg_rx_received(struct iwl_mvm *mvm,
 
         data = rcu_dereference(mvm->baid_map[baid]);
         if (!data) {
-                WARN_ON(!(reorder_data & IWL_RX_MPDU_REORDER_BA_OLD_SN));
+                IWL_DEBUG_RX(mvm,
+                             "Got valid BAID but no baid allocated, bypass the re-ordering buffer. Baid %d reorder 0x%x\n",
+                              baid, reorder_data);
                 goto out;
         }
 
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
index 4df5f13fcdae..027ee5e72172 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
@@ -121,7 +121,8 @@ int iwl_mvm_sta_send_to_fw(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
                 .mac_id_n_color = cpu_to_le32(mvm_sta->mac_id_n_color),
                 .add_modify = update ? 1 : 0,
                 .station_flags_msk = cpu_to_le32(STA_FLG_FAT_EN_MSK |
-                                                 STA_FLG_MIMO_EN_MSK),
+                                                 STA_FLG_MIMO_EN_MSK |
+                                                 STA_FLG_RTS_MIMO_PROT),
                 .tid_disable_tx = cpu_to_le16(mvm_sta->tid_disable_agg),
         };
         int ret;
@@ -277,9 +278,21 @@ static void iwl_mvm_rx_agg_session_expired(unsigned long data)
 
         /* Timer expired */
         sta = rcu_dereference(ba_data->mvm->fw_id_to_mac_id[ba_data->sta_id]);
+
+        /*
+         * sta should be valid unless the following happens:
+         * The firmware asserts which triggers a reconfig flow, but
+         * the reconfig fails before we set the pointer to sta into
+         * the fw_id_to_mac_id pointer table. Mac80211 can't stop
+         * A-MDPU and hence the timer continues to run. Then, the
+         * timer expires and sta is NULL.
+         */
+        if (!sta)
+                goto unlock;
+
         mvm_sta = iwl_mvm_sta_from_mac80211(sta);
-        ieee80211_stop_rx_ba_session_offl(mvm_sta->vif,
-                                          sta->addr, ba_data->tid);
+        ieee80211_rx_ba_timer_expired(mvm_sta->vif,
+                                      sta->addr, ba_data->tid);
 unlock:
         rcu_read_unlock();
 }
@@ -2015,7 +2028,8 @@ int iwl_mvm_send_add_bcast_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
                                                 IWL_MAX_TID_COUNT,
                                                 wdg_timeout);
 
-                if (vif->type == NL80211_IFTYPE_AP)
+                if (vif->type == NL80211_IFTYPE_AP ||
+                    vif->type == NL80211_IFTYPE_ADHOC)
                         mvm->probe_queue = queue;
                 else if (vif->type == NL80211_IFTYPE_P2P_DEVICE)
                         mvm->p2p_dev_queue = queue;
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
index 60360ed73f26..5fcc9dd6be56 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
@@ -185,8 +185,14 @@ static u16 iwl_mvm_tx_csum(struct iwl_mvm *mvm, struct sk_buff *skb,
         else
                 udp_hdr(skb)->check = 0;
 
-        /* mac header len should include IV, size is in words */
-        if (info->control.hw_key)
+        /*
+         * mac header len should include IV, size is in words unless
+         * the IV is added by the firmware like in WEP.
+         * In new Tx API, the IV is always added by the firmware.
+         */
+        if (!iwl_mvm_has_new_tx_api(mvm) && info->control.hw_key &&
+            info->control.hw_key->cipher != WLAN_CIPHER_SUITE_WEP40 &&
+            info->control.hw_key->cipher != WLAN_CIPHER_SUITE_WEP104)
                 mh_len += info->control.hw_key->iv_len;
         mh_len /= 2;
         offload_assist |= mh_len << TX_CMD_OFFLD_MH_SIZE;
@@ -1815,6 +1821,8 @@ void iwl_mvm_rx_ba_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb)
         struct iwl_mvm_tid_data *tid_data;
         struct iwl_mvm_sta *mvmsta;
 
+        ba_info.flags = IEEE80211_TX_STAT_AMPDU;
+
         if (iwl_mvm_has_new_tx_api(mvm)) {
                 struct iwl_mvm_compressed_ba_notif *ba_res =
                         (void *)pkt->data;
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
index f16c1bb9bf94..84f4ba01e14f 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
@@ -510,9 +510,17 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
 
 /* 9000 Series */
         {IWL_PCI_DEVICE(0x271B, 0x0010, iwl9160_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x271B, 0x0014, iwl9160_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x271B, 0x0210, iwl9160_2ac_cfg)},
         {IWL_PCI_DEVICE(0x2526, 0x0000, iwl9260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x2526, 0x0010, iwl9260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x0014, iwl9260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0xA014, iwl9260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x4010, iwl9260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x0210, iwl9260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x0214, iwl9260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x2526, 0x1410, iwl9270_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x1610, iwl9270_2ac_cfg)},
         {IWL_PCI_DEVICE(0x9DF0, 0x0A10, iwl9460_2ac_cfg)},
         {IWL_PCI_DEVICE(0x9DF0, 0x0010, iwl9460_2ac_cfg)},
         {IWL_PCI_DEVICE(0x9DF0, 0x0210, iwl9460_2ac_cfg)},
@@ -527,10 +535,22 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
         {IWL_PCI_DEVICE(0x9DF0, 0x2A10, iwl9460_2ac_cfg)},
         {IWL_PCI_DEVICE(0x30DC, 0x0060, iwl9460_2ac_cfg)},
         {IWL_PCI_DEVICE(0x2526, 0x0060, iwl9460_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x0260, iwl9460_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x0064, iwl9460_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x00A4, iwl9460_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x40A4, iwl9460_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x02A4, iwl9460_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x00A0, iwl9460_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x02A0, iwl9460_2ac_cfg)},
         {IWL_PCI_DEVICE(0x9DF0, 0x0060, iwl9460_2ac_cfg)},
         {IWL_PCI_DEVICE(0xA370, 0x0060, iwl9460_2ac_cfg)},
         {IWL_PCI_DEVICE(0x31DC, 0x0060, iwl9460_2ac_cfg)},
         {IWL_PCI_DEVICE(0x2526, 0x0030, iwl9560_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x4030, iwl9560_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x0230, iwl9560_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x0234, iwl9560_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x0238, iwl9560_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x023C, iwl9560_2ac_cfg)},
         {IWL_PCI_DEVICE(0x9DF0, 0x0030, iwl9560_2ac_cfg)},
         {IWL_PCI_DEVICE(0xA370, 0x0030, iwl9560_2ac_cfg)},
         {IWL_PCI_DEVICE(0x31DC, 0x0030, iwl9560_2ac_cfg)},
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/internal.h b/drivers/net/wireless/intel/iwlwifi/pcie/internal.h
index fa315d84e98e..a1ea9ef97ed9 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/internal.h
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/internal.h
@@ -787,6 +787,8 @@ int iwl_pci_fw_enter_d0i3(struct iwl_trans *trans);
 
 void iwl_pcie_enable_rx_wake(struct iwl_trans *trans, bool enable);
 
+void iwl_pcie_rx_allocator_work(struct work_struct *data);
+
 /* common functions that are used by gen2 transport */
 void iwl_pcie_apm_config(struct iwl_trans *trans);
 int iwl_pcie_prepare_card_hw(struct iwl_trans *trans);
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
index 351c4423125a..942736d3fa75 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
@@ -597,7 +597,7 @@ static void iwl_pcie_rx_allocator_get(struct iwl_trans *trans,
         rxq->free_count += RX_CLAIM_REQ_ALLOC;
 }
 
-static void iwl_pcie_rx_allocator_work(struct work_struct *data)
+void iwl_pcie_rx_allocator_work(struct work_struct *data)
 {
         struct iwl_rb_allocator *rba_p =
                 container_of(data, struct iwl_rb_allocator, rx_alloc);
@@ -900,10 +900,6 @@ static int _iwl_pcie_rx_init(struct iwl_trans *trans)
                         return err;
         }
         def_rxq = trans_pcie->rxq;
-        if (!rba->alloc_wq)
-                rba->alloc_wq = alloc_workqueue("rb_allocator",
-                                                WQ_HIGHPRI | WQ_UNBOUND, 1);
-        INIT_WORK(&rba->rx_alloc, iwl_pcie_rx_allocator_work);
 
         spin_lock(&rba->lock);
         atomic_set(&rba->req_pending, 0);
@@ -1017,10 +1013,6 @@ void iwl_pcie_rx_free(struct iwl_trans *trans)
         }
 
         cancel_work_sync(&rba->rx_alloc);
-        if (rba->alloc_wq) {
-                destroy_workqueue(rba->alloc_wq);
-                rba->alloc_wq = NULL;
-        }
 
         iwl_pcie_free_rbs_pool(trans);
 
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
index 92b3a55d0fbc..3927bbf04f72 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
@@ -1786,6 +1786,11 @@ void iwl_trans_pcie_free(struct iwl_trans *trans)
                 iwl_pcie_tx_free(trans);
         iwl_pcie_rx_free(trans);
 
+        if (trans_pcie->rba.alloc_wq) {
+                destroy_workqueue(trans_pcie->rba.alloc_wq);
+                trans_pcie->rba.alloc_wq = NULL;
+        }
+
         if (trans_pcie->msix_enabled) {
                 for (i = 0; i < trans_pcie->alloc_vecs; i++) {
                         irq_set_affinity_hint(
@@ -3150,7 +3155,8 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
         init_waitqueue_head(&trans_pcie->d0i3_waitq);
 
         if (trans_pcie->msix_enabled) {
-                if (iwl_pcie_init_msix_handler(pdev, trans_pcie))
+                ret = iwl_pcie_init_msix_handler(pdev, trans_pcie);
+                if (ret)
                         goto out_no_pci;
          } else {
                 ret = iwl_pcie_alloc_ict(trans);
@@ -3168,6 +3174,10 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
                 trans_pcie->inta_mask = CSR_INI_SET_MASK;
          }
 
+        trans_pcie->rba.alloc_wq = alloc_workqueue("rb_allocator",
+                                                   WQ_HIGHPRI | WQ_UNBOUND, 1);
+        INIT_WORK(&trans_pcie->rba.rx_alloc, iwl_pcie_rx_allocator_work);
+
 #ifdef CONFIG_IWLWIFI_PCIE_RTPM
         trans->runtime_pm_mode = IWL_PLAT_PM_MODE_D0I3;
 #else
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/tx.c b/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
index de50418adae5..034bdb4a0b06 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
@@ -298,6 +298,9 @@ void iwl_pcie_txq_check_wrptrs(struct iwl_trans *trans)
         for (i = 0; i < trans->cfg->base_params->num_of_queues; i++) {
                 struct iwl_txq *txq = trans_pcie->txq[i];
 
+                if (!test_bit(i, trans_pcie->queue_used))
+                        continue;
+
                 spin_lock_bh(&txq->lock);
                 if (txq->need_update) {
                         iwl_pcie_txq_inc_wr_ptr(trans, txq);
diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c
index 2a7ad5ffe997..cd5dc6dcb19f 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c
@@ -846,9 +846,6 @@ static bool _rtl8723be_init_mac(struct ieee80211_hw *hw)
                 return false;
         }
 
-        if (rtlpriv->cfg->ops->get_btc_status())
-                rtlpriv->btcoexist.btc_ops->btc_power_on_setting(rtlpriv);
-
         bytetmp = rtl_read_byte(rtlpriv, REG_MULTI_FUNC_CTRL);
         rtl_write_byte(rtlpriv, REG_MULTI_FUNC_CTRL, bytetmp | BIT(3));
 
diff --git a/drivers/net/wireless/realtek/rtlwifi/wifi.h b/drivers/net/wireless/realtek/rtlwifi/wifi.h
index fb1ebb01133f..70723e67b7d7 100644
--- a/drivers/net/wireless/realtek/rtlwifi/wifi.h
+++ b/drivers/net/wireless/realtek/rtlwifi/wifi.h
@@ -2547,7 +2547,6 @@ struct bt_coexist_info {
 struct rtl_btc_ops {
         void (*btc_init_variables) (struct rtl_priv *rtlpriv);
         void (*btc_init_hal_vars) (struct rtl_priv *rtlpriv);
-        void (*btc_power_on_setting)(struct rtl_priv *rtlpriv);
         void (*btc_init_hw_config) (struct rtl_priv *rtlpriv);
         void (*btc_ips_notify) (struct rtl_priv *rtlpriv, u8 type);
         void (*btc_lps_notify)(struct rtl_priv *rtlpriv, u8 type);
diff --git a/drivers/net/wireless/ti/wl1251/main.c b/drivers/net/wireless/ti/wl1251/main.c
index 08f0477f78d9..9915d83a4a30 100644
--- a/drivers/net/wireless/ti/wl1251/main.c
+++ b/drivers/net/wireless/ti/wl1251/main.c
@@ -1571,6 +1571,7 @@ struct ieee80211_hw *wl1251_alloc_hw(void)
 
         wl->state = WL1251_STATE_OFF;
         mutex_init(&wl->mutex);
+        spin_lock_init(&wl->wl_lock);
 
         wl->tx_mgmt_frm_rate = DEFAULT_HW_GEN_TX_RATE;
         wl->tx_mgmt_frm_mod = DEFAULT_HW_GEN_MODULATION_TYPE;
diff --git a/drivers/ntb/ntb_transport.c b/drivers/ntb/ntb_transport.c
index 9a03c5871efe..f58d8e305323 100644
--- a/drivers/ntb/ntb_transport.c
+++ b/drivers/ntb/ntb_transport.c
@@ -924,10 +924,8 @@ out1:
                 ntb_free_mw(nt, i);
 
         /* if there's an actual failure, we should just bail */
-        if (rc < 0) {
-                ntb_link_disable(ndev);
+        if (rc < 0)
                 return;
-        }
 
 out:
         if (ntb_link_is_up(ndev, NULL, NULL) == 1)
@@ -1059,7 +1057,7 @@ static int ntb_transport_probe(struct ntb_client *self, struct ntb_dev *ndev)
         int node;
         int rc, i;
 
-        mw_count = ntb_mw_count(ndev, PIDX);
+        mw_count = ntb_peer_mw_count(ndev);
 
         if (!ndev->ops->mw_set_trans) {
                 dev_err(&ndev->dev, "Inbound MW based NTB API is required\n");
diff --git a/drivers/ntb/test/ntb_tool.c b/drivers/ntb/test/ntb_tool.c
index f002bf48a08d..a69815c45ce6 100644
--- a/drivers/ntb/test/ntb_tool.c
+++ b/drivers/ntb/test/ntb_tool.c
@@ -959,7 +959,7 @@ static int tool_probe(struct ntb_client *self, struct ntb_dev *ntb)
         tc->ntb = ntb;
         init_waitqueue_head(&tc->link_wq);
 
-        tc->mw_count = min(ntb_mw_count(tc->ntb, PIDX), MAX_MWS);
+        tc->mw_count = min(ntb_peer_mw_count(tc->ntb), MAX_MWS);
         for (i = 0; i < tc->mw_count; i++) {
                 rc = tool_init_mw(tc, i);
                 if (rc)
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index 3b77cfe5aa1e..37046ac2c441 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -336,7 +336,7 @@ static int nvme_get_stream_params(struct nvme_ctrl *ctrl,
 
         c.directive.opcode = nvme_admin_directive_recv;
         c.directive.nsid = cpu_to_le32(nsid);
-        c.directive.numd = cpu_to_le32(sizeof(*s));
+        c.directive.numd = cpu_to_le32((sizeof(*s) >> 2) - 1);
         c.directive.doper = NVME_DIR_RCV_ST_OP_PARAM;
         c.directive.dtype = NVME_DIR_STREAMS;
 
@@ -1509,7 +1509,7 @@ static void nvme_set_queue_limits(struct nvme_ctrl *ctrl,
         blk_queue_write_cache(q, vwc, vwc);
 }
 
-static void nvme_configure_apst(struct nvme_ctrl *ctrl)
+static int nvme_configure_apst(struct nvme_ctrl *ctrl)
 {
         /*
          * APST (Autonomous Power State Transition) lets us program a
@@ -1538,16 +1538,16 @@ static void nvme_configure_apst(struct nvme_ctrl *ctrl)
          * then don't do anything.
          */
         if (!ctrl->apsta)
-                return;
+                return 0;
 
         if (ctrl->npss > 31) {
                 dev_warn(ctrl->device, "NPSS is invalid; not using APST\n");
-                return;
+                return 0;
         }
 
         table = kzalloc(sizeof(*table), GFP_KERNEL);
         if (!table)
-                return;
+                return 0;
 
         if (!ctrl->apst_enabled || ctrl->ps_max_latency_us == 0) {
                 /* Turn off APST. */
@@ -1629,6 +1629,7 @@ static void nvme_configure_apst(struct nvme_ctrl *ctrl)
                 dev_err(ctrl->device, "failed to set APST feature (%d)\n", ret);
 
         kfree(table);
+        return ret;
 }
 
 static void nvme_set_latency_tolerance(struct device *dev, s32 val)
@@ -1835,13 +1836,16 @@ int nvme_init_identify(struct nvme_ctrl *ctrl)
                  * In fabrics we need to verify the cntlid matches the
                  * admin connect
                  */
-                if (ctrl->cntlid != le16_to_cpu(id->cntlid))
+                if (ctrl->cntlid != le16_to_cpu(id->cntlid)) {
                         ret = -EINVAL;
+                        goto out_free;
+                }
 
                 if (!ctrl->opts->discovery_nqn && !ctrl->kas) {
                         dev_err(ctrl->device,
                                 "keep-alive support is mandatory for fabrics\n");
                         ret = -EINVAL;
+                        goto out_free;
                 }
         } else {
                 ctrl->cntlid = le16_to_cpu(id->cntlid);
@@ -1856,11 +1860,20 @@ int nvme_init_identify(struct nvme_ctrl *ctrl)
         else if (!ctrl->apst_enabled && prev_apst_enabled)
                 dev_pm_qos_hide_latency_tolerance(ctrl->device);
 
-        nvme_configure_apst(ctrl);
-        nvme_configure_directives(ctrl);
+        ret = nvme_configure_apst(ctrl);
+        if (ret < 0)
+                return ret;
+
+        ret = nvme_configure_directives(ctrl);
+        if (ret < 0)
+                return ret;
 
         ctrl->identified = true;
 
+        return 0;
+
+out_free:
+        kfree(id);
         return ret;
 }
 EXPORT_SYMBOL_GPL(nvme_init_identify);
@@ -1995,15 +2008,20 @@ static ssize_t wwid_show(struct device *dev, struct device_attribute *attr,
         int serial_len = sizeof(ctrl->serial);
         int model_len = sizeof(ctrl->model);
 
+        if (!uuid_is_null(&ns->uuid))
+                return sprintf(buf, "uuid.%pU\n", &ns->uuid);
+
         if (memchr_inv(ns->nguid, 0, sizeof(ns->nguid)))
                 return sprintf(buf, "eui.%16phN\n", ns->nguid);
 
         if (memchr_inv(ns->eui, 0, sizeof(ns->eui)))
                 return sprintf(buf, "eui.%8phN\n", ns->eui);
 
-        while (ctrl->serial[serial_len - 1] == ' ')
+        while (serial_len > 0 && (ctrl->serial[serial_len - 1] == ' ' ||
+                                  ctrl->serial[serial_len - 1] == '\0'))
                 serial_len--;
-        while (ctrl->model[model_len - 1] == ' ')
+        while (model_len > 0 && (ctrl->model[model_len - 1] == ' ' ||
+                                 ctrl->model[model_len - 1] == '\0'))
                 model_len--;
 
         return sprintf(buf, "nvme.%04x-%*phN-%*phN-%08x\n", ctrl->vid,
@@ -2709,7 +2727,8 @@ void nvme_kill_queues(struct nvme_ctrl *ctrl)
         mutex_lock(&ctrl->namespaces_mutex);
 
         /* Forcibly unquiesce queues to avoid blocking dispatch */
-        blk_mq_unquiesce_queue(ctrl->admin_q);
+        if (ctrl->admin_q)
+                blk_mq_unquiesce_queue(ctrl->admin_q);
 
         list_for_each_entry(ns, &ctrl->namespaces, list) {
                 /*
diff --git a/drivers/nvme/host/fabrics.c b/drivers/nvme/host/fabrics.c
index 2e582a240943..5f5cd306f76d 100644
--- a/drivers/nvme/host/fabrics.c
+++ b/drivers/nvme/host/fabrics.c
@@ -794,7 +794,8 @@ static int nvmf_check_allowed_opts(struct nvmf_ctrl_options *opts,
                 int i;
 
                 for (i = 0; i < ARRAY_SIZE(opt_tokens); i++) {
-                        if (opt_tokens[i].token & ~allowed_opts) {
+                        if ((opt_tokens[i].token & opts->mask) &&
+                            (opt_tokens[i].token & ~allowed_opts)) {
                                 pr_warn("invalid parameter '%s'\n",
                                         opt_tokens[i].pattern);
                         }
diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
index d666ada39a9b..5c2a08ef08ba 100644
--- a/drivers/nvme/host/fc.c
+++ b/drivers/nvme/host/fc.c
@@ -1888,7 +1888,7 @@ nvme_fc_start_fcp_op(struct nvme_fc_ctrl *ctrl, struct nvme_fc_queue *queue,
          * the target device is present
          */
         if (ctrl->rport->remoteport.port_state != FC_OBJSTATE_ONLINE)
-                return BLK_STS_IOERR;
+                goto busy;
 
         if (!nvme_fc_ctrl_get(ctrl))
                 return BLK_STS_IOERR;
@@ -1958,22 +1958,25 @@ nvme_fc_start_fcp_op(struct nvme_fc_ctrl *ctrl, struct nvme_fc_queue *queue,
                                         queue->lldd_handle, &op->fcp_req);
 
         if (ret) {
-                if (op->rq)                     /* normal request */
+                if (!(op->flags & FCOP_FLAGS_AEN))
                         nvme_fc_unmap_data(ctrl, op->rq, op);
-                /* else - aen. no cleanup needed */
 
                 nvme_fc_ctrl_put(ctrl);
 
-                if (ret != -EBUSY)
+                if (ctrl->rport->remoteport.port_state == FC_OBJSTATE_ONLINE &&
+                                ret != -EBUSY)
                         return BLK_STS_IOERR;
 
-                if (op->rq)
-                        blk_mq_delay_run_hw_queue(queue->hctx, NVMEFC_QUEUE_DELAY);
-
-                return BLK_STS_RESOURCE;
+                goto busy;
         }
 
         return BLK_STS_OK;
+
+busy:
+        if (!(op->flags & FCOP_FLAGS_AEN) && queue->hctx)
+                blk_mq_delay_run_hw_queue(queue->hctx, NVMEFC_QUEUE_DELAY);
+
+        return BLK_STS_RESOURCE;
 }
 
 static blk_status_t
@@ -2802,66 +2805,70 @@ out_fail:
         return ERR_PTR(ret);
 }
 
-enum {
-        FCT_TRADDR_ERR          = 0,
-        FCT_TRADDR_WWNN         = 1 << 0,
-        FCT_TRADDR_WWPN         = 1 << 1,
-};
 
 struct nvmet_fc_traddr {
         u64     nn;
         u64     pn;
 };
 
-static const match_table_t traddr_opt_tokens = {
-        { FCT_TRADDR_WWNN,      "nn-%s"         },
-        { FCT_TRADDR_WWPN,      "pn-%s"         },
-        { FCT_TRADDR_ERR,       NULL            }
-};
-
 static int
-nvme_fc_parse_address(struct nvmet_fc_traddr *traddr, char *buf)
+__nvme_fc_parse_u64(substring_t *sstr, u64 *val)
 {
-        substring_t args[MAX_OPT_ARGS];
-        char *options, *o, *p;
-        int token, ret = 0;
         u64 token64;
 
-        options = o = kstrdup(buf, GFP_KERNEL);
-        if (!options)
-                return -ENOMEM;
+        if (match_u64(sstr, &token64))
+                return -EINVAL;
+        *val = token64;
 
-        while ((p = strsep(&o, ":\n")) != NULL) {
-                if (!*p)
-                        continue;
+        return 0;
+}
 
-                token = match_token(p, traddr_opt_tokens, args);
-                switch (token) {
-                case FCT_TRADDR_WWNN:
-                        if (match_u64(args, &token64)) {
-                                ret = -EINVAL;
-                                goto out;
-                        }
-                        traddr->nn = token64;
-                        break;
-                case FCT_TRADDR_WWPN:
-                        if (match_u64(args, &token64)) {
-                                ret = -EINVAL;
-                                goto out;
-                        }
-                        traddr->pn = token64;
-                        break;
-                default:
-                        pr_warn("unknown traddr token or missing value '%s'\n",
-                                        p);
-                        ret = -EINVAL;
-                        goto out;
-                }
-        }
+/*
+ * This routine validates and extracts the WWN's from the TRADDR string.
+ * As kernel parsers need the 0x to determine number base, universally
+ * build string to parse with 0x prefix before parsing name strings.
+ */
+static int
+nvme_fc_parse_traddr(struct nvmet_fc_traddr *traddr, char *buf, size_t blen)
+{
+        char name[2 + NVME_FC_TRADDR_HEXNAMELEN + 1];
+        substring_t wwn = { name, &name[sizeof(name)-1] };
+        int nnoffset, pnoffset;
+
+        /* validate it string one of the 2 allowed formats */
+        if (strnlen(buf, blen) == NVME_FC_TRADDR_MAXLENGTH &&
+                        !strncmp(buf, "nn-0x", NVME_FC_TRADDR_OXNNLEN) &&
+                        !strncmp(&buf[NVME_FC_TRADDR_MAX_PN_OFFSET],
+                                "pn-0x", NVME_FC_TRADDR_OXNNLEN)) {
+                nnoffset = NVME_FC_TRADDR_OXNNLEN;
+                pnoffset = NVME_FC_TRADDR_MAX_PN_OFFSET +
+                                                NVME_FC_TRADDR_OXNNLEN;
+        } else if ((strnlen(buf, blen) == NVME_FC_TRADDR_MINLENGTH &&
+                        !strncmp(buf, "nn-", NVME_FC_TRADDR_NNLEN) &&
+                        !strncmp(&buf[NVME_FC_TRADDR_MIN_PN_OFFSET],
+                                "pn-", NVME_FC_TRADDR_NNLEN))) {
+                nnoffset = NVME_FC_TRADDR_NNLEN;
+                pnoffset = NVME_FC_TRADDR_MIN_PN_OFFSET + NVME_FC_TRADDR_NNLEN;
+        } else
+                goto out_einval;
 
-out:
-        kfree(options);
-        return ret;
+        name[0] = '0';
+        name[1] = 'x';
+        name[2 + NVME_FC_TRADDR_HEXNAMELEN] = 0;
+
+        memcpy(&name[2], &buf[nnoffset], NVME_FC_TRADDR_HEXNAMELEN);
+        if (__nvme_fc_parse_u64(&wwn, &traddr->nn))
+                goto out_einval;
+
+        memcpy(&name[2], &buf[pnoffset], NVME_FC_TRADDR_HEXNAMELEN);
+        if (__nvme_fc_parse_u64(&wwn, &traddr->pn))
+                goto out_einval;
+
+        return 0;
+
+out_einval:
+        pr_warn("%s: bad traddr string\n", __func__);
+        return -EINVAL;
 }
 
 static struct nvme_ctrl *
@@ -2875,11 +2882,11 @@ nvme_fc_create_ctrl(struct device *dev, struct nvmf_ctrl_options *opts)
         unsigned long flags;
         int ret;
 
-        ret = nvme_fc_parse_address(&raddr, opts->traddr);
+        ret = nvme_fc_parse_traddr(&raddr, opts->traddr, NVMF_TRADDR_SIZE);
         if (ret || !raddr.nn || !raddr.pn)
                 return ERR_PTR(-EINVAL);
 
-        ret = nvme_fc_parse_address(&laddr, opts->host_traddr);
+        ret = nvme_fc_parse_traddr(&laddr, opts->host_traddr, NVMF_TRADDR_SIZE);
         if (ret || !laddr.nn || !laddr.pn)
                 return ERR_PTR(-EINVAL);
 
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index 8569ee771269..ea892e732268 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -109,6 +109,7 @@ struct nvme_dev {
         /* host memory buffer support: */
         u64 host_mem_size;
         u32 nr_host_mem_descs;
+        dma_addr_t host_mem_descs_dma;
         struct nvme_host_mem_buf_desc *host_mem_descs;
         void **host_mem_desc_bufs;
 };
@@ -801,6 +802,7 @@ static inline void nvme_handle_cqe(struct nvme_queue *nvmeq,
                 return;
         }
 
+        nvmeq->cqe_seen = 1;
         req = blk_mq_tag_to_rq(*nvmeq->tags, cqe->command_id);
         nvme_end_request(req, cqe->status, cqe->result);
 }
@@ -830,10 +832,8 @@ static void nvme_process_cq(struct nvme_queue *nvmeq)
                 consumed++;
         }
 
-        if (consumed) {
+        if (consumed)
                 nvme_ring_cq_doorbell(nvmeq);
-                nvmeq->cqe_seen = 1;
-        }
 }
 
 static irqreturn_t nvme_irq(int irq, void *data)
@@ -1558,26 +1558,18 @@ static inline void nvme_release_cmb(struct nvme_dev *dev)
         if (dev->cmb) {
                 iounmap(dev->cmb);
                 dev->cmb = NULL;
-                if (dev->cmbsz) {
-                        sysfs_remove_file_from_group(&dev->ctrl.device->kobj,
-                                                     &dev_attr_cmb.attr, NULL);
-                        dev->cmbsz = 0;
-                }
+                sysfs_remove_file_from_group(&dev->ctrl.device->kobj,
+                                             &dev_attr_cmb.attr, NULL);
+                dev->cmbsz = 0;
         }
 }
 
 static int nvme_set_host_mem(struct nvme_dev *dev, u32 bits)
 {
-        size_t len = dev->nr_host_mem_descs * sizeof(*dev->host_mem_descs);
+        u64 dma_addr = dev->host_mem_descs_dma;
         struct nvme_command c;
-        u64 dma_addr;
         int ret;
 
-        dma_addr = dma_map_single(dev->dev, dev->host_mem_descs, len,
-                        DMA_TO_DEVICE);
-        if (dma_mapping_error(dev->dev, dma_addr))
-                return -ENOMEM;
-
         memset(&c, 0, sizeof(c));
         c.features.opcode       = nvme_admin_set_features;
         c.features.fid          = cpu_to_le32(NVME_FEAT_HOST_MEM_BUF);
@@ -1594,7 +1586,6 @@ static int nvme_set_host_mem(struct nvme_dev *dev, u32 bits)
                          "failed to set host mem (err %d, flags %#x).\n",
                          ret, bits);
         }
-        dma_unmap_single(dev->dev, dma_addr, len, DMA_TO_DEVICE);
         return ret;
 }
 
@@ -1612,14 +1603,17 @@ static void nvme_free_host_mem(struct nvme_dev *dev)
 
         kfree(dev->host_mem_desc_bufs);
         dev->host_mem_desc_bufs = NULL;
-        kfree(dev->host_mem_descs);
+        dma_free_coherent(dev->dev,
+                        dev->nr_host_mem_descs * sizeof(*dev->host_mem_descs),
+                        dev->host_mem_descs, dev->host_mem_descs_dma);
         dev->host_mem_descs = NULL;
 }
 
 static int nvme_alloc_host_mem(struct nvme_dev *dev, u64 min, u64 preferred)
 {
         struct nvme_host_mem_buf_desc *descs;
-        u32 chunk_size, max_entries;
+        u32 chunk_size, max_entries, len;
+        dma_addr_t descs_dma;
         int i = 0;
         void **bufs;
         u64 size = 0, tmp;
@@ -1630,7 +1624,8 @@ retry:
         tmp = (preferred + chunk_size - 1);
         do_div(tmp, chunk_size);
         max_entries = tmp;
-        descs = kcalloc(max_entries, sizeof(*descs), GFP_KERNEL);
+        descs = dma_zalloc_coherent(dev->dev, max_entries * sizeof(*descs),
+                        &descs_dma, GFP_KERNEL);
         if (!descs)
                 goto out;
 
@@ -1638,10 +1633,10 @@ retry:
         if (!bufs)
                 goto out_free_descs;
 
-        for (size = 0; size < preferred; size += chunk_size) {
-                u32 len = min_t(u64, chunk_size, preferred - size);
+        for (size = 0; size < preferred; size += len) {
                 dma_addr_t dma_addr;
 
+                len = min_t(u64, chunk_size, preferred - size);
                 bufs[i] = dma_alloc_attrs(dev->dev, len, &dma_addr, GFP_KERNEL,
                                 DMA_ATTR_NO_KERNEL_MAPPING | DMA_ATTR_NO_WARN);
                 if (!bufs[i])
@@ -1664,6 +1659,7 @@ retry:
         dev->nr_host_mem_descs = i;
         dev->host_mem_size = size;
         dev->host_mem_descs = descs;
+        dev->host_mem_descs_dma = descs_dma;
         dev->host_mem_desc_bufs = bufs;
         return 0;
 
@@ -1677,7 +1673,8 @@ out_free_bufs:
 
         kfree(bufs);
 out_free_descs:
-        kfree(descs);
+        dma_free_coherent(dev->dev, max_entries * sizeof(*descs), descs,
+                        descs_dma);
 out:
         /* try a smaller chunk size if we failed early */
         if (chunk_size >= PAGE_SIZE * 2 && (i == 0 || size < min)) {
@@ -1953,16 +1950,14 @@ static int nvme_pci_enable(struct nvme_dev *dev)
 
         /*
          * CMBs can currently only exist on >=1.2 PCIe devices. We only
-         * populate sysfs if a CMB is implemented. Note that we add the
-         * CMB attribute to the nvme_ctrl kobj which removes the need to remove
-         * it on exit. Since nvme_dev_attrs_group has no name we can pass
-         * NULL as final argument to sysfs_add_file_to_group.
+         * populate sysfs if a CMB is implemented. Since nvme_dev_attrs_group
+         * has no name we can pass NULL as final argument to
+         * sysfs_add_file_to_group.
          */
 
         if (readl(dev->bar + NVME_REG_VS) >= NVME_VS(1, 2, 0)) {
                 dev->cmb = nvme_map_cmb(dev);
-
-                if (dev->cmbsz) {
+                if (dev->cmb) {
                         if (sysfs_add_file_to_group(&dev->ctrl.device->kobj,
                                                     &dev_attr_cmb.attr, NULL))
                                 dev_warn(dev->ctrl.device,
diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
index da04df1af231..a03299d77922 100644
--- a/drivers/nvme/host/rdma.c
+++ b/drivers/nvme/host/rdma.c
@@ -920,7 +920,11 @@ static int nvme_rdma_map_sg_fr(struct nvme_rdma_queue *queue,
         struct nvme_keyed_sgl_desc *sg = &c->common.dptr.ksgl;
         int nr;
 
-        nr = ib_map_mr_sg(req->mr, req->sg_table.sgl, count, NULL, PAGE_SIZE);
+        /*
+         * Align the MR to a 4K page size to match the ctrl page size and
+         * the block virtual boundary.
+         */
+        nr = ib_map_mr_sg(req->mr, req->sg_table.sgl, count, NULL, SZ_4K);
         if (nr < count) {
                 if (nr < 0)
                         return nr;
@@ -1583,7 +1587,7 @@ static int nvme_rdma_configure_admin_queue(struct nvme_rdma_ctrl *ctrl)
                 goto out_cleanup_queue;
 
         ctrl->ctrl.max_hw_sectors =
-                (ctrl->max_fr_pages - 1) << (PAGE_SHIFT - 9);
+                (ctrl->max_fr_pages - 1) << (ilog2(SZ_4K) - 9);
 
         error = nvme_init_identify(&ctrl->ctrl);
         if (error)
diff --git a/drivers/nvme/target/admin-cmd.c b/drivers/nvme/target/admin-cmd.c
index 2d7a98ab53fb..a53bb6635b83 100644
--- a/drivers/nvme/target/admin-cmd.c
+++ b/drivers/nvme/target/admin-cmd.c
@@ -199,12 +199,6 @@ static void nvmet_execute_identify_ctrl(struct nvmet_req *req)
         copy_and_pad(id->mn, sizeof(id->mn), model, sizeof(model) - 1);
         copy_and_pad(id->fr, sizeof(id->fr), UTS_RELEASE, strlen(UTS_RELEASE));
 
-        memset(id->mn, ' ', sizeof(id->mn));
-        strncpy((char *)id->mn, "Linux", sizeof(id->mn));
-
-        memset(id->fr, ' ', sizeof(id->fr));
-        strncpy((char *)id->fr, UTS_RELEASE, sizeof(id->fr));
-
         id->rab = 6;
 
         /*
diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c
index d5801c150b1c..309c84aa7595 100644
--- a/drivers/nvme/target/fc.c
+++ b/drivers/nvme/target/fc.c
@@ -114,6 +114,11 @@ struct nvmet_fc_tgtport {
         struct kref                     ref;
 };
 
+struct nvmet_fc_defer_fcp_req {
+        struct list_head                req_list;
+        struct nvmefc_tgt_fcp_req       *fcp_req;
+};
+
 struct nvmet_fc_tgt_queue {
         bool                            ninetypercent;
         u16                             qid;
@@ -132,6 +137,8 @@ struct nvmet_fc_tgt_queue {
         struct nvmet_fc_tgt_assoc       *assoc;
         struct nvmet_fc_fcp_iod         *fod;           /* array of fcp_iods */
         struct list_head                fod_list;
+        struct list_head                pending_cmd_list;
+        struct list_head                avail_defer_list;
         struct workqueue_struct         *work_q;
         struct kref                     ref;
 } __aligned(sizeof(unsigned long long));
@@ -223,6 +230,8 @@ static void nvmet_fc_tgt_q_put(struct nvmet_fc_tgt_queue *queue);
 static int nvmet_fc_tgt_q_get(struct nvmet_fc_tgt_queue *queue);
 static void nvmet_fc_tgtport_put(struct nvmet_fc_tgtport *tgtport);
 static int nvmet_fc_tgtport_get(struct nvmet_fc_tgtport *tgtport);
+static void nvmet_fc_handle_fcp_rqst(struct nvmet_fc_tgtport *tgtport,
+                                        struct nvmet_fc_fcp_iod *fod);
 
 
 /* *********************** FC-NVME DMA Handling **************************** */
@@ -385,7 +394,7 @@ nvmet_fc_free_ls_iodlist(struct nvmet_fc_tgtport *tgtport)
 static struct nvmet_fc_ls_iod *
 nvmet_fc_alloc_ls_iod(struct nvmet_fc_tgtport *tgtport)
 {
-        static struct nvmet_fc_ls_iod *iod;
+        struct nvmet_fc_ls_iod *iod;
         unsigned long flags;
 
         spin_lock_irqsave(&tgtport->lock, flags);
@@ -462,10 +471,10 @@ nvmet_fc_destroy_fcp_iodlist(struct nvmet_fc_tgtport *tgtport,
 static struct nvmet_fc_fcp_iod *
 nvmet_fc_alloc_fcp_iod(struct nvmet_fc_tgt_queue *queue)
 {
-        static struct nvmet_fc_fcp_iod *fod;
-        unsigned long flags;
+        struct nvmet_fc_fcp_iod *fod;
+
+        lockdep_assert_held(&queue->qlock);
 
-        spin_lock_irqsave(&queue->qlock, flags);
         fod = list_first_entry_or_null(&queue->fod_list,
                                         struct nvmet_fc_fcp_iod, fcp_list);
         if (fod) {
@@ -477,17 +486,37 @@ nvmet_fc_alloc_fcp_iod(struct nvmet_fc_tgt_queue *queue)
                  * will "inherit" that reference.
                  */
         }
-        spin_unlock_irqrestore(&queue->qlock, flags);
         return fod;
 }
 
 
 static void
+nvmet_fc_queue_fcp_req(struct nvmet_fc_tgtport *tgtport,
+                       struct nvmet_fc_tgt_queue *queue,
+                       struct nvmefc_tgt_fcp_req *fcpreq)
+{
+        struct nvmet_fc_fcp_iod *fod = fcpreq->nvmet_fc_private;
+
+        /*
+         * put all admin cmds on hw queue id 0. All io commands go to
+         * the respective hw queue based on a modulo basis
+         */
+        fcpreq->hwqid = queue->qid ?
+                        ((queue->qid - 1) % tgtport->ops->max_hw_queues) : 0;
+
+        if (tgtport->ops->target_features & NVMET_FCTGTFEAT_CMD_IN_ISR)
+                queue_work_on(queue->cpu, queue->work_q, &fod->work);
+        else
+                nvmet_fc_handle_fcp_rqst(tgtport, fod);
+}
+
+static void
 nvmet_fc_free_fcp_iod(struct nvmet_fc_tgt_queue *queue,
                         struct nvmet_fc_fcp_iod *fod)
 {
         struct nvmefc_tgt_fcp_req *fcpreq = fod->fcpreq;
         struct nvmet_fc_tgtport *tgtport = fod->tgtport;
+        struct nvmet_fc_defer_fcp_req *deferfcp;
         unsigned long flags;
 
         fc_dma_sync_single_for_cpu(tgtport->dev, fod->rspdma,
@@ -495,21 +524,56 @@ nvmet_fc_free_fcp_iod(struct nvmet_fc_tgt_queue *queue,
 
         fcpreq->nvmet_fc_private = NULL;
 
-        spin_lock_irqsave(&queue->qlock, flags);
-        list_add_tail(&fod->fcp_list, &fod->queue->fod_list);
         fod->active = false;
         fod->abort = false;
         fod->aborted = false;
         fod->writedataactive = false;
         fod->fcpreq = NULL;
+
+        tgtport->ops->fcp_req_release(&tgtport->fc_target_port, fcpreq);
+
+        spin_lock_irqsave(&queue->qlock, flags);
+        deferfcp = list_first_entry_or_null(&queue->pending_cmd_list,
+                                struct nvmet_fc_defer_fcp_req, req_list);
+        if (!deferfcp) {
+                list_add_tail(&fod->fcp_list, &fod->queue->fod_list);
+                spin_unlock_irqrestore(&queue->qlock, flags);
+
+                /* Release reference taken at queue lookup and fod allocation */
+                nvmet_fc_tgt_q_put(queue);
+                return;
+        }
+
+        /* Re-use the fod for the next pending cmd that was deferred */
+        list_del(&deferfcp->req_list);
+
+        fcpreq = deferfcp->fcp_req;
+
+        /* deferfcp can be reused for another IO at a later date */
+        list_add_tail(&deferfcp->req_list, &queue->avail_defer_list);
+
         spin_unlock_irqrestore(&queue->qlock, flags);
 
+        /* Save NVME CMD IO in fod */
+        memcpy(&fod->cmdiubuf, fcpreq->rspaddr, fcpreq->rsplen);
+
+        /* Setup new fcpreq to be processed */
+        fcpreq->rspaddr = NULL;
+        fcpreq->rsplen  = 0;
+        fcpreq->nvmet_fc_private = fod;
+        fod->fcpreq = fcpreq;
+        fod->active = true;
+
+        /* inform LLDD IO is now being processed */
+        tgtport->ops->defer_rcv(&tgtport->fc_target_port, fcpreq);
+
+        /* Submit deferred IO for processing */
+        nvmet_fc_queue_fcp_req(tgtport, queue, fcpreq);
+
         /*
-         * release the reference taken at queue lookup and fod allocation
+         * Leave the queue lookup get reference taken when
+         * fod was originally allocated.
          */
-        nvmet_fc_tgt_q_put(queue);
-
-        tgtport->ops->fcp_req_release(&tgtport->fc_target_port, fcpreq);
 }
 
 static int
@@ -569,6 +633,8 @@ nvmet_fc_alloc_target_queue(struct nvmet_fc_tgt_assoc *assoc,
         queue->port = assoc->tgtport->port;
         queue->cpu = nvmet_fc_queue_to_cpu(assoc->tgtport, qid);
         INIT_LIST_HEAD(&queue->fod_list);
+        INIT_LIST_HEAD(&queue->avail_defer_list);
+        INIT_LIST_HEAD(&queue->pending_cmd_list);
         atomic_set(&queue->connected, 0);
         atomic_set(&queue->sqtail, 0);
         atomic_set(&queue->rsn, 1);
@@ -638,6 +704,7 @@ nvmet_fc_delete_target_queue(struct nvmet_fc_tgt_queue *queue)
 {
         struct nvmet_fc_tgtport *tgtport = queue->assoc->tgtport;
         struct nvmet_fc_fcp_iod *fod = queue->fod;
+        struct nvmet_fc_defer_fcp_req *deferfcp, *tempptr;
         unsigned long flags;
         int i, writedataactive;
         bool disconnect;
@@ -666,6 +733,36 @@ nvmet_fc_delete_target_queue(struct nvmet_fc_tgt_queue *queue)
                         }
                 }
         }
+
+        /* Cleanup defer'ed IOs in queue */
+        list_for_each_entry_safe(deferfcp, tempptr, &queue->avail_defer_list,
+                                req_list) {
+                list_del(&deferfcp->req_list);
+                kfree(deferfcp);
+        }
+
+        for (;;) {
+                deferfcp = list_first_entry_or_null(&queue->pending_cmd_list,
+                                struct nvmet_fc_defer_fcp_req, req_list);
+                if (!deferfcp)
+                        break;
+
+                list_del(&deferfcp->req_list);
+                spin_unlock_irqrestore(&queue->qlock, flags);
+
+                tgtport->ops->defer_rcv(&tgtport->fc_target_port,
+                                deferfcp->fcp_req);
+
+                tgtport->ops->fcp_abort(&tgtport->fc_target_port,
+                                deferfcp->fcp_req);
+
+                tgtport->ops->fcp_req_release(&tgtport->fc_target_port,
+                                deferfcp->fcp_req);
+
+                kfree(deferfcp);
+
+                spin_lock_irqsave(&queue->qlock, flags);
+        }
         spin_unlock_irqrestore(&queue->qlock, flags);
 
         flush_workqueue(queue->work_q);
@@ -2172,11 +2269,38 @@ nvmet_fc_handle_fcp_rqst_work(struct work_struct *work)
  * Pass a FC-NVME FCP CMD IU received from the FC link to the nvmet-fc
  * layer for processing.
  *
- * The nvmet-fc layer will copy cmd payload to an internal structure for
- * processing.  As such, upon completion of the routine, the LLDD may
- * immediately free/reuse the CMD IU buffer passed in the call.
+ * The nvmet_fc layer allocates a local job structure (struct
+ * nvmet_fc_fcp_iod) from the queue for the io and copies the
+ * CMD IU buffer to the job structure. As such, on a successful
+ * completion (returns 0), the LLDD may immediately free/reuse
+ * the CMD IU buffer passed in the call.
+ *
+ * However, in some circumstances, due to the packetized nature of FC
+ * and the api of the FC LLDD which may issue a hw command to send the
+ * response, but the LLDD may not get the hw completion for that command
+ * and upcall the nvmet_fc layer before a new command may be
+ * asynchronously received - its possible for a command to be received
+ * before the LLDD and nvmet_fc have recycled the job structure. It gives
+ * the appearance of more commands received than fits in the sq.
+ * To alleviate this scenario, a temporary queue is maintained in the
+ * transport for pending LLDD requests waiting for a queue job structure.
+ * In these "overrun" cases, a temporary queue element is allocated
+ * the LLDD request and CMD iu buffer information remembered, and the
+ * routine returns a -EOVERFLOW status. Subsequently, when a queue job
+ * structure is freed, it is immediately reallocated for anything on the
+ * pending request list. The LLDDs defer_rcv() callback is called,
+ * informing the LLDD that it may reuse the CMD IU buffer, and the io
+ * is then started normally with the transport.
  *
- * If this routine returns error, the lldd should abort the exchange.
+ * The LLDD, when receiving an -EOVERFLOW completion status, is to treat
+ * the completion as successful but must not reuse the CMD IU buffer
+ * until the LLDD's defer_rcv() callback has been called for the
+ * corresponding struct nvmefc_tgt_fcp_req pointer.
+ *
+ * If there is any other condition in which an error occurs, the
+ * transport will return a non-zero status indicating the error.
+ * In all cases other than -EOVERFLOW, the transport has not accepted the
+ * request and the LLDD should abort the exchange.
  *
  * @target_port: pointer to the (registered) target port the FCP CMD IU
  *              was received on.
@@ -2194,6 +2318,8 @@ nvmet_fc_rcv_fcp_req(struct nvmet_fc_target_port *target_port,
         struct nvme_fc_cmd_iu *cmdiu = cmdiubuf;
         struct nvmet_fc_tgt_queue *queue;
         struct nvmet_fc_fcp_iod *fod;
+        struct nvmet_fc_defer_fcp_req *deferfcp;
+        unsigned long flags;
 
         /* validate iu, so the connection id can be used to find the queue */
         if ((cmdiubuf_len != sizeof(*cmdiu)) ||
@@ -2214,29 +2340,60 @@ nvmet_fc_rcv_fcp_req(struct nvmet_fc_target_port *target_port,
          * when the fod is freed.
          */
 
+        spin_lock_irqsave(&queue->qlock, flags);
+
         fod = nvmet_fc_alloc_fcp_iod(queue);
-        if (!fod) {
+        if (fod) {
+                spin_unlock_irqrestore(&queue->qlock, flags);
+
+                fcpreq->nvmet_fc_private = fod;
+                fod->fcpreq = fcpreq;
+
+                memcpy(&fod->cmdiubuf, cmdiubuf, cmdiubuf_len);
+
+                nvmet_fc_queue_fcp_req(tgtport, queue, fcpreq);
+
+                return 0;
+        }
+
+        if (!tgtport->ops->defer_rcv) {
+                spin_unlock_irqrestore(&queue->qlock, flags);
                 /* release the queue lookup reference */
                 nvmet_fc_tgt_q_put(queue);
                 return -ENOENT;
         }
 
-        fcpreq->nvmet_fc_private = fod;
-        fod->fcpreq = fcpreq;
-        /*
-         * put all admin cmds on hw queue id 0. All io commands go to
-         * the respective hw queue based on a modulo basis
-         */
-        fcpreq->hwqid = queue->qid ?
-                        ((queue->qid - 1) % tgtport->ops->max_hw_queues) : 0;
-        memcpy(&fod->cmdiubuf, cmdiubuf, cmdiubuf_len);
+        deferfcp = list_first_entry_or_null(&queue->avail_defer_list,
+                        struct nvmet_fc_defer_fcp_req, req_list);
+        if (deferfcp) {
+                /* Just re-use one that was previously allocated */
+                list_del(&deferfcp->req_list);
+        } else {
+                spin_unlock_irqrestore(&queue->qlock, flags);
 
-        if (tgtport->ops->target_features & NVMET_FCTGTFEAT_CMD_IN_ISR)
-                queue_work_on(queue->cpu, queue->work_q, &fod->work);
-        else
-                nvmet_fc_handle_fcp_rqst(tgtport, fod);
+                /* Now we need to dynamically allocate one */
+                deferfcp = kmalloc(sizeof(*deferfcp), GFP_KERNEL);
+                if (!deferfcp) {
+                        /* release the queue lookup reference */
+                        nvmet_fc_tgt_q_put(queue);
+                        return -ENOMEM;
+                }
+                spin_lock_irqsave(&queue->qlock, flags);
+        }
 
-        return 0;
+        /* For now, use rspaddr / rsplen to save payload information */
+        fcpreq->rspaddr = cmdiubuf;
+        fcpreq->rsplen  = cmdiubuf_len;
+        deferfcp->fcp_req = fcpreq;
+
+        /* defer processing till a fod becomes available */
+        list_add_tail(&deferfcp->req_list, &queue->pending_cmd_list);
+
+        /* NOTE: the queue lookup reference is still valid */
+
+        spin_unlock_irqrestore(&queue->qlock, flags);
+
+        return -EOVERFLOW;
 }
 EXPORT_SYMBOL_GPL(nvmet_fc_rcv_fcp_req);
 
@@ -2293,66 +2450,70 @@ nvmet_fc_rcv_fcp_abort(struct nvmet_fc_target_port *target_port,
 }
 EXPORT_SYMBOL_GPL(nvmet_fc_rcv_fcp_abort);
 
-enum {
-        FCT_TRADDR_ERR          = 0,
-        FCT_TRADDR_WWNN         = 1 << 0,
-        FCT_TRADDR_WWPN         = 1 << 1,
-};
 
 struct nvmet_fc_traddr {
         u64     nn;
         u64     pn;
 };
 
-static const match_table_t traddr_opt_tokens = {
-        { FCT_TRADDR_WWNN,      "nn-%s"         },
-        { FCT_TRADDR_WWPN,      "pn-%s"         },
-        { FCT_TRADDR_ERR,       NULL            }
-};
-
 static int
-nvmet_fc_parse_traddr(struct nvmet_fc_traddr *traddr, char *buf)
+__nvme_fc_parse_u64(substring_t *sstr, u64 *val)
 {
-        substring_t args[MAX_OPT_ARGS];
-        char *options, *o, *p;
-        int token, ret = 0;
         u64 token64;
 
-        options = o = kstrdup(buf, GFP_KERNEL);
-        if (!options)
-                return -ENOMEM;
+        if (match_u64(sstr, &token64))
+                return -EINVAL;
+        *val = token64;
 
-        while ((p = strsep(&o, ":\n")) != NULL) {
-                if (!*p)
-                        continue;
+        return 0;
+}
 
-                token = match_token(p, traddr_opt_tokens, args);
-                switch (token) {
-                case FCT_TRADDR_WWNN:
-                        if (match_u64(args, &token64)) {
-                                ret = -EINVAL;
-                                goto out;
-                        }
-                        traddr->nn = token64;
-                        break;
-                case FCT_TRADDR_WWPN:
-                        if (match_u64(args, &token64)) {
-                                ret = -EINVAL;
-                                goto out;
-                        }
-                        traddr->pn = token64;
-                        break;
-                default:
-                        pr_warn("unknown traddr token or missing value '%s'\n",
-                                        p);
-                        ret = -EINVAL;
-                        goto out;
-                }
-        }
+/*
+ * This routine validates and extracts the WWN's from the TRADDR string.
+ * As kernel parsers need the 0x to determine number base, universally
+ * build string to parse with 0x prefix before parsing name strings.
+ */
+static int
+nvme_fc_parse_traddr(struct nvmet_fc_traddr *traddr, char *buf, size_t blen)
+{
+        char name[2 + NVME_FC_TRADDR_HEXNAMELEN + 1];
+        substring_t wwn = { name, &name[sizeof(name)-1] };
+        int nnoffset, pnoffset;
+
+        /* validate it string one of the 2 allowed formats */
+        if (strnlen(buf, blen) == NVME_FC_TRADDR_MAXLENGTH &&
+                        !strncmp(buf, "nn-0x", NVME_FC_TRADDR_OXNNLEN) &&
+                        !strncmp(&buf[NVME_FC_TRADDR_MAX_PN_OFFSET],
+                                "pn-0x", NVME_FC_TRADDR_OXNNLEN)) {
+                nnoffset = NVME_FC_TRADDR_OXNNLEN;
+                pnoffset = NVME_FC_TRADDR_MAX_PN_OFFSET +
+                                                NVME_FC_TRADDR_OXNNLEN;
+        } else if ((strnlen(buf, blen) == NVME_FC_TRADDR_MINLENGTH &&
+                        !strncmp(buf, "nn-", NVME_FC_TRADDR_NNLEN) &&
+                        !strncmp(&buf[NVME_FC_TRADDR_MIN_PN_OFFSET],
+                                "pn-", NVME_FC_TRADDR_NNLEN))) {
+                nnoffset = NVME_FC_TRADDR_NNLEN;
+                pnoffset = NVME_FC_TRADDR_MIN_PN_OFFSET + NVME_FC_TRADDR_NNLEN;
+        } else
+                goto out_einval;
+
+        name[0] = '0';
+        name[1] = 'x';
+        name[2 + NVME_FC_TRADDR_HEXNAMELEN] = 0;
+
+        memcpy(&name[2], &buf[nnoffset], NVME_FC_TRADDR_HEXNAMELEN);
+        if (__nvme_fc_parse_u64(&wwn, &traddr->nn))
+                goto out_einval;
+
+        memcpy(&name[2], &buf[pnoffset], NVME_FC_TRADDR_HEXNAMELEN);
+        if (__nvme_fc_parse_u64(&wwn, &traddr->pn))
+                goto out_einval;
 
-out:
-        kfree(options);
-        return ret;
+        return 0;
+
+out_einval:
+        pr_warn("%s: bad traddr string\n", __func__);
+        return -EINVAL;
 }
 
 static int
@@ -2370,7 +2531,8 @@ nvmet_fc_add_port(struct nvmet_port *port)
 
         /* map the traddr address info to a target port */
 
-        ret = nvmet_fc_parse_traddr(&traddr, port->disc_addr.traddr);
+        ret = nvme_fc_parse_traddr(&traddr, port->disc_addr.traddr,
+                        sizeof(port->disc_addr.traddr));
         if (ret)
                 return ret;
 
diff --git a/drivers/of/device.c b/drivers/of/device.c
index 28c38c756f92..e0a28ea341fe 100644
--- a/drivers/of/device.c
+++ b/drivers/of/device.c
@@ -89,6 +89,7 @@ int of_dma_configure(struct device *dev, struct device_node *np)
         bool coherent;
         unsigned long offset;
         const struct iommu_ops *iommu;
+        u64 mask;
 
         /*
          * Set default coherent_dma_mask to 32 bit.  Drivers are expected to
@@ -134,10 +135,9 @@ int of_dma_configure(struct device *dev, struct device_node *np)
          * Limit coherent and dma mask based on size and default mask
          * set by the driver.
          */
-        dev->coherent_dma_mask = min(dev->coherent_dma_mask,
-                                     DMA_BIT_MASK(ilog2(dma_addr + size)));
-        *dev->dma_mask = min((*dev->dma_mask),
-                             DMA_BIT_MASK(ilog2(dma_addr + size)));
+        mask = DMA_BIT_MASK(ilog2(dma_addr + size - 1) + 1);
+        dev->coherent_dma_mask &= mask;
+        *dev->dma_mask &= mask;
 
         coherent = of_dma_is_coherent(np);
         dev_dbg(dev, "device is%sdma coherent\n",
diff --git a/drivers/of/irq.c b/drivers/of/irq.c
index 6ce72aa65425..ab21c846eb27 100644
--- a/drivers/of/irq.c
+++ b/drivers/of/irq.c
@@ -476,7 +476,7 @@ int of_irq_to_resource_table(struct device_node *dev, struct resource *res,
         int i;
 
         for (i = 0; i < nr_irqs; i++, res++)
-                if (!of_irq_to_resource(dev, i, res))
+                if (of_irq_to_resource(dev, i, res) <= 0)
                         break;
 
         return i;
diff --git a/drivers/of/property.c b/drivers/of/property.c
index eda50b4be934..067f9fab7b77 100644
--- a/drivers/of/property.c
+++ b/drivers/of/property.c
@@ -708,6 +708,15 @@ struct device_node *of_graph_get_port_parent(struct device_node *node)
 {
         unsigned int depth;
 
+        if (!node)
+                return NULL;
+
+        /*
+         * Preserve usecount for passed in node as of_get_next_parent()
+         * will do of_node_put() on it.
+         */
+        of_node_get(node);
+
         /* Walk 3 levels up only if there is 'ports' node. */
         for (depth = 3; depth && node; depth--) {
                 node = of_get_next_parent(node);
@@ -728,12 +737,16 @@ EXPORT_SYMBOL(of_graph_get_port_parent);
 struct device_node *of_graph_get_remote_port_parent(
                                const struct device_node *node)
 {
-        struct device_node *np;
+        struct device_node *np, *pp;
 
         /* Get remote endpoint node. */
         np = of_graph_get_remote_endpoint(node);
 
-        return of_graph_get_port_parent(np);
+        pp = of_graph_get_port_parent(np);
+
+        of_node_put(np);
+
+        return pp;
 }
 EXPORT_SYMBOL(of_graph_get_remote_port_parent);
 
diff --git a/drivers/parisc/dino.c b/drivers/parisc/dino.c
index 5c63b920b471..ed92c1254cff 100644
--- a/drivers/parisc/dino.c
+++ b/drivers/parisc/dino.c
@@ -956,7 +956,7 @@ static int __init dino_probe(struct parisc_device *dev)
 
         dino_dev->hba.dev = dev;
         dino_dev->hba.base_addr = ioremap_nocache(hpa, 4096);
-        dino_dev->hba.lmmio_space_offset = 0;   /* CPU addrs == bus addrs */
+        dino_dev->hba.lmmio_space_offset = PCI_F_EXTEND;
         spin_lock_init(&dino_dev->dinosaur_pen);
         dino_dev->hba.iommu = ccio_get_iommu(dev);
 
diff --git a/drivers/parisc/pdc_stable.c b/drivers/parisc/pdc_stable.c
index 055f83fddc18..b1ff46fe4547 100644
--- a/drivers/parisc/pdc_stable.c
+++ b/drivers/parisc/pdc_stable.c
@@ -333,11 +333,11 @@ pdcspath_hwpath_write(struct pdcspath_entry *entry, const char *buf, size_t coun
         
         /* Update the symlink to the real device */
         sysfs_remove_link(&entry->kobj, "device");
+        write_unlock(&entry->rw_lock);
+
         ret = sysfs_create_link(&entry->kobj, &entry->dev->kobj, "device");
         WARN_ON(ret);
 
-        write_unlock(&entry->rw_lock);
-        
         printk(KERN_INFO PDCS_PREFIX ": changed \"%s\" path to \"%s\"\n",
                 entry->name, buf);
         
@@ -954,7 +954,7 @@ static struct attribute *pdcs_subsys_attrs[] = {
         NULL,
 };
 
-static struct attribute_group pdcs_attr_group = {
+static const struct attribute_group pdcs_attr_group = {
         .attrs = pdcs_subsys_attrs,
 };
 
@@ -998,6 +998,7 @@ pdcs_register_pathentries(void)
                 /* kobject is now registered */
                 write_lock(&entry->rw_lock);
                 entry->ready = 2;
+                write_unlock(&entry->rw_lock);
                 
                 /* Add a nice symlink to the real device */
                 if (entry->dev) {
@@ -1005,7 +1006,6 @@ pdcs_register_pathentries(void)
                         WARN_ON(err);
                 }
 
-                write_unlock(&entry->rw_lock);
                 kobject_uevent(&entry->kobj, KOBJ_ADD);
         }
         
diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
index 253d92409bb3..2225afc1cbbb 100644
--- a/drivers/pci/msi.c
+++ b/drivers/pci/msi.c
@@ -538,12 +538,9 @@ msi_setup_entry(struct pci_dev *dev, int nvec, const struct irq_affinity *affd)
         struct msi_desc *entry;
         u16 control;
 
-        if (affd) {
+        if (affd)
                 masks = irq_create_affinity_masks(nvec, affd);
-                if (!masks)
-                        dev_err(&dev->dev, "can't allocate MSI affinity masks for %d vectors\n",
-                                nvec);
-        }
+
 
         /* MSI Entry Initialization */
         entry = alloc_msi_entry(&dev->dev, nvec, masks);
@@ -679,12 +676,8 @@ static int msix_setup_entries(struct pci_dev *dev, void __iomem *base,
         struct msi_desc *entry;
         int ret, i;
 
-        if (affd) {
+        if (affd)
                 masks = irq_create_affinity_masks(nvec, affd);
-                if (!masks)
-                        dev_err(&dev->dev, "can't allocate MSI-X affinity masks for %d vectors\n",
-                                nvec);
-        }
 
         for (i = 0, curmsk = masks; i < nvec; i++) {
                 entry = alloc_msi_entry(&dev->dev, 1, curmsk);
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index af0cc3456dc1..fdf65a6c13f6 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -514,7 +514,7 @@ EXPORT_SYMBOL(pci_find_resource);
  */
 struct pci_dev *pci_find_pcie_root_port(struct pci_dev *dev)
 {
-        struct pci_dev *bridge, *highest_pcie_bridge = NULL;
+        struct pci_dev *bridge, *highest_pcie_bridge = dev;
 
         bridge = pci_upstream_bridge(dev);
         while (bridge && pci_is_pcie(bridge)) {
@@ -4260,6 +4260,41 @@ int pci_reset_function(struct pci_dev *dev)
 EXPORT_SYMBOL_GPL(pci_reset_function);
 
 /**
+ * pci_reset_function_locked - quiesce and reset a PCI device function
+ * @dev: PCI device to reset
+ *
+ * Some devices allow an individual function to be reset without affecting
+ * other functions in the same device.  The PCI device must be responsive
+ * to PCI config space in order to use this function.
+ *
+ * This function does not just reset the PCI portion of a device, but
+ * clears all the state associated with the device.  This function differs
+ * from __pci_reset_function() in that it saves and restores device state
+ * over the reset.  It also differs from pci_reset_function() in that it
+ * requires the PCI device lock to be held.
+ *
+ * Returns 0 if the device function was successfully reset or negative if the
+ * device doesn't support resetting a single function.
+ */
+int pci_reset_function_locked(struct pci_dev *dev)
+{
+        int rc;
+
+        rc = pci_probe_reset_function(dev);
+        if (rc)
+                return rc;
+
+        pci_dev_save_and_disable(dev);
+
+        rc = __pci_reset_function_locked(dev);
+
+        pci_dev_restore(dev);
+
+        return rc;
+}
+EXPORT_SYMBOL_GPL(pci_reset_function_locked);
+
+/**
  * pci_try_reset_function - quiesce and reset a PCI device function
  * @dev: PCI device to reset
  *
diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
index c31310db0404..e6a917b4acd3 100644
--- a/drivers/pci/probe.c
+++ b/drivers/pci/probe.c
@@ -1762,6 +1762,48 @@ static void pci_configure_extended_tags(struct pci_dev *dev)
                                          PCI_EXP_DEVCTL_EXT_TAG);
 }
 
+/**
+ * pcie_relaxed_ordering_enabled - Probe for PCIe relaxed ordering enable
+ * @dev: PCI device to query
+ *
+ * Returns true if the device has enabled relaxed ordering attribute.
+ */
+bool pcie_relaxed_ordering_enabled(struct pci_dev *dev)
+{
+        u16 v;
+
+        pcie_capability_read_word(dev, PCI_EXP_DEVCTL, &v);
+
+        return !!(v & PCI_EXP_DEVCTL_RELAX_EN);
+}
+EXPORT_SYMBOL(pcie_relaxed_ordering_enabled);
+
+static void pci_configure_relaxed_ordering(struct pci_dev *dev)
+{
+        struct pci_dev *root;
+
+        /* PCI_EXP_DEVICE_RELAX_EN is RsvdP in VFs */
+        if (dev->is_virtfn)
+                return;
+
+        if (!pcie_relaxed_ordering_enabled(dev))
+                return;
+
+        /*
+         * For now, we only deal with Relaxed Ordering issues with Root
+         * Ports. Peer-to-Peer DMA is another can of worms.
+         */
+        root = pci_find_pcie_root_port(dev);
+        if (!root)
+                return;
+
+        if (root->dev_flags & PCI_DEV_FLAGS_NO_RELAXED_ORDERING) {
+                pcie_capability_clear_word(dev, PCI_EXP_DEVCTL,
+                                           PCI_EXP_DEVCTL_RELAX_EN);
+                dev_info(&dev->dev, "Disable Relaxed Ordering because the Root Port didn't support it\n");
+        }
+}
+
 static void pci_configure_device(struct pci_dev *dev)
 {
         struct hotplug_params hpp;
@@ -1769,6 +1811,7 @@ static void pci_configure_device(struct pci_dev *dev)
 
         pci_configure_mps(dev);
         pci_configure_extended_tags(dev);
+        pci_configure_relaxed_ordering(dev);
 
         memset(&hpp, 0, sizeof(hpp));
         ret = pci_get_hp_params(dev, &hpp);
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index 6967c6b4cf6b..140760403f36 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -4016,6 +4016,95 @@ DECLARE_PCI_FIXUP_CLASS_EARLY(0x1797, 0x6869, PCI_CLASS_NOT_DEFINED, 8,
                               quirk_tw686x_class);
 
 /*
+ * Some devices have problems with Transaction Layer Packets with the Relaxed
+ * Ordering Attribute set.  Such devices should mark themselves and other
+ * Device Drivers should check before sending TLPs with RO set.
+ */
+static void quirk_relaxedordering_disable(struct pci_dev *dev)
+{
+        dev->dev_flags |= PCI_DEV_FLAGS_NO_RELAXED_ORDERING;
+        dev_info(&dev->dev, "Disable Relaxed Ordering Attributes to avoid PCIe Completion erratum\n");
+}
+
+/*
+ * Intel Xeon processors based on Broadwell/Haswell microarchitecture Root
+ * Complex has a Flow Control Credit issue which can cause performance
+ * problems with Upstream Transaction Layer Packets with Relaxed Ordering set.
+ */
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f01, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f02, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f03, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f04, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f05, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f06, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f07, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f08, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f09, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f0a, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f0b, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f0c, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f0d, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f0e, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f01, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f02, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f03, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f04, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f05, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f06, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f07, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f08, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f09, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f0a, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f0b, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f0c, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f0d, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f0e, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+
+/*
+ * The AMD ARM A1100 (AKA "SEATTLE") SoC has a bug in its PCIe Root Complex
+ * where Upstream Transaction Layer Packets with the Relaxed Ordering
+ * Attribute clear are allowed to bypass earlier TLPs with Relaxed Ordering
+ * set.  This is a violation of the PCIe 3.0 Transaction Ordering Rules
+ * outlined in Section 2.4.1 (PCI Express(r) Base Specification Revision 3.0
+ * November 10, 2010).  As a result, on this platform we can't use Relaxed
+ * Ordering for Upstream TLPs.
+ */
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_AMD, 0x1a00, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_AMD, 0x1a01, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_AMD, 0x1a02, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+
+/*
  * Per PCIe r3.0, sec 2.2.9, "Completion headers must supply the same
  * values for the Attribute as were supplied in the header of the
  * corresponding Request, except as explicitly allowed when IDO is used."
diff --git a/drivers/perf/arm_pmu.c b/drivers/perf/arm_pmu.c
index dc459eb1246b..1c5e0f333779 100644
--- a/drivers/perf/arm_pmu.c
+++ b/drivers/perf/arm_pmu.c
@@ -569,22 +569,41 @@ int armpmu_request_irq(struct arm_pmu *armpmu, int cpu)
                 if (irq != other_irq) {
                         pr_warn("mismatched PPIs detected.\n");
                         err = -EINVAL;
+                        goto err_out;
                 }
         } else {
-                err = request_irq(irq, handler,
-                                  IRQF_NOBALANCING | IRQF_NO_THREAD, "arm-pmu",
+                struct arm_pmu_platdata *platdata = armpmu_get_platdata(armpmu);
+                unsigned long irq_flags;
+
+                err = irq_force_affinity(irq, cpumask_of(cpu));
+
+                if (err && num_possible_cpus() > 1) {
+                        pr_warn("unable to set irq affinity (irq=%d, cpu=%u)\n",
+                                irq, cpu);
+                        goto err_out;
+                }
+
+                if (platdata && platdata->irq_flags) {
+                        irq_flags = platdata->irq_flags;
+                } else {
+                        irq_flags = IRQF_PERCPU |
+                                    IRQF_NOBALANCING |
+                                    IRQF_NO_THREAD;
+                }
+
+                err = request_irq(irq, handler, irq_flags, "arm-pmu",
                                   per_cpu_ptr(&hw_events->percpu_pmu, cpu));
         }
 
-        if (err) {
-                pr_err("unable to request IRQ%d for ARM PMU counters\n",
-                        irq);
-                return err;
-        }
+        if (err)
+                goto err_out;
 
         cpumask_set_cpu(cpu, &armpmu->active_irqs);
-
         return 0;
+
+err_out:
+        pr_err("unable to request IRQ%d for ARM PMU counters\n", irq);
+        return err;
 }
 
 int armpmu_request_irqs(struct arm_pmu *armpmu)
@@ -628,12 +647,6 @@ static int arm_perf_starting_cpu(unsigned int cpu, struct hlist_node *node)
                         enable_percpu_irq(irq, IRQ_TYPE_NONE);
                         return 0;
                 }
-
-                if (irq_force_affinity(irq, cpumask_of(cpu)) &&
-                    num_possible_cpus() > 1) {
-                        pr_warn("unable to set irq affinity (irq=%d, cpu=%u)\n",
-                                irq, cpu);
-                }
         }
 
         return 0;
diff --git a/drivers/perf/arm_pmu_platform.c b/drivers/perf/arm_pmu_platform.c
index 69255f53057a..4eafa7a42e52 100644
--- a/drivers/perf/arm_pmu_platform.c
+++ b/drivers/perf/arm_pmu_platform.c
@@ -131,8 +131,8 @@ static int pmu_parse_irqs(struct arm_pmu *pmu)
         }
 
         if (!pmu_has_irq_affinity(pdev->dev.of_node)) {
-                pr_warn("no interrupt-affinity property for %s, guessing.\n",
-                        of_node_full_name(pdev->dev.of_node));
+                pr_warn("no interrupt-affinity property for %pOF, guessing.\n",
+                        pdev->dev.of_node);
         }
 
         /*
@@ -211,7 +211,7 @@ int arm_pmu_device_probe(struct platform_device *pdev,
         }
 
         if (ret) {
-                pr_info("%s: failed to probe PMU!\n", of_node_full_name(node));
+                pr_info("%pOF: failed to probe PMU!\n", node);
                 goto out_free;
         }
 
@@ -228,8 +228,7 @@ int arm_pmu_device_probe(struct platform_device *pdev,
 out_free_irqs:
         armpmu_free_irqs(pmu);
 out_free:
-        pr_info("%s: failed to register PMU devices!\n",
-                of_node_full_name(node));
+        pr_info("%pOF: failed to register PMU devices!\n", node);
         armpmu_free(pmu);
         return ret;
 }
diff --git a/drivers/perf/qcom_l2_pmu.c b/drivers/perf/qcom_l2_pmu.c
index c259848228b4..b242cce10468 100644
--- a/drivers/perf/qcom_l2_pmu.c
+++ b/drivers/perf/qcom_l2_pmu.c
@@ -546,6 +546,7 @@ static int l2_cache_event_init(struct perf_event *event)
         }
 
         if ((event != event->group_leader) &&
+            !is_software_event(event->group_leader) &&
             (L2_EVT_GROUP(event->group_leader->attr.config) ==
              L2_EVT_GROUP(event->attr.config))) {
                 dev_dbg_ratelimited(&l2cache_pmu->pdev->dev,
@@ -558,6 +559,7 @@ static int l2_cache_event_init(struct perf_event *event)
         list_for_each_entry(sibling, &event->group_leader->sibling_list,
                             group_entry) {
                 if ((sibling != event) &&
+                    !is_software_event(sibling) &&
                     (L2_EVT_GROUP(sibling->attr.config) ==
                      L2_EVT_GROUP(event->attr.config))) {
                         dev_dbg_ratelimited(&l2cache_pmu->pdev->dev,
diff --git a/drivers/phy/broadcom/Kconfig b/drivers/phy/broadcom/Kconfig
index 37371b89b14f..64fc59c3ae6d 100644
--- a/drivers/phy/broadcom/Kconfig
+++ b/drivers/phy/broadcom/Kconfig
@@ -30,8 +30,8 @@ config PHY_BCM_NS_USB3
         tristate "Broadcom Northstar USB 3.0 PHY Driver"
         depends on ARCH_BCM_IPROC || COMPILE_TEST
         depends on HAS_IOMEM && OF
+        depends on MDIO_BUS
         select GENERIC_PHY
-        select MDIO_DEVICE
         help
           Enable this to support Broadcom USB 3.0 PHY connected to the USB
           controller on Northstar family.
diff --git a/drivers/pinctrl/intel/pinctrl-cherryview.c b/drivers/pinctrl/intel/pinctrl-cherryview.c
index 20f1b4493994..04e929fd0ffe 100644
--- a/drivers/pinctrl/intel/pinctrl-cherryview.c
+++ b/drivers/pinctrl/intel/pinctrl-cherryview.c
@@ -1548,6 +1548,13 @@ static const struct dmi_system_id chv_no_valid_mask[] = {
                 },
         },
         {
+                .ident = "HP Chromebook 11 G5 (Setzer)",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "HP"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Setzer"),
+                },
+        },
+        {
                 .ident = "Acer Chromebook R11 (Cyan)",
                 .matches = {
                         DMI_MATCH(DMI_SYS_VENDOR, "GOOGLE"),
diff --git a/drivers/pinctrl/intel/pinctrl-merrifield.c b/drivers/pinctrl/intel/pinctrl-merrifield.c
index 4d4ef42a39b5..86c4b3fab7b0 100644
--- a/drivers/pinctrl/intel/pinctrl-merrifield.c
+++ b/drivers/pinctrl/intel/pinctrl-merrifield.c
@@ -343,9 +343,9 @@ static const struct pinctrl_pin_desc mrfld_pins[] = {
 
 static const unsigned int mrfld_sdio_pins[] = { 50, 51, 52, 53, 54, 55, 56 };
 static const unsigned int mrfld_spi5_pins[] = { 90, 91, 92, 93, 94, 95, 96 };
-static const unsigned int mrfld_uart0_pins[] = { 124, 125, 126, 127 };
-static const unsigned int mrfld_uart1_pins[] = { 128, 129, 130, 131 };
-static const unsigned int mrfld_uart2_pins[] = { 132, 133, 134, 135 };
+static const unsigned int mrfld_uart0_pins[] = { 115, 116, 117, 118 };
+static const unsigned int mrfld_uart1_pins[] = { 119, 120, 121, 122 };
+static const unsigned int mrfld_uart2_pins[] = { 123, 124, 125, 126 };
 static const unsigned int mrfld_pwm0_pins[] = { 144 };
 static const unsigned int mrfld_pwm1_pins[] = { 145 };
 static const unsigned int mrfld_pwm2_pins[] = { 132 };
diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c
index f024e25787fc..0c6d7812d6fd 100644
--- a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c
+++ b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c
@@ -37,7 +37,7 @@
 #define IRQ_STATUS      0x10
 #define IRQ_WKUP        0x18
 
-#define NB_FUNCS 2
+#define NB_FUNCS 3
 #define GPIO_PER_REG    32
 
 /**
@@ -126,6 +126,16 @@ struct armada_37xx_pinctrl {
                 .funcs = {_func1, "gpio"}       \
         }
 
+#define PIN_GRP_GPIO_3(_name, _start, _nr, _mask, _v1, _v2, _v3, _f1, _f2) \
+        {                                       \
+                .name = _name,                  \
+                .start_pin = _start,            \
+                .npins = _nr,                   \
+                .reg_mask = _mask,              \
+                .val = {_v1, _v2, _v3}, \
+                .funcs = {_f1, _f2, "gpio"}     \
+        }
+
 #define PIN_GRP_EXTRA(_name, _start, _nr, _mask, _v1, _v2, _start2, _nr2, \
                       _f1, _f2)                         \
         {                                               \
@@ -171,12 +181,13 @@ static struct armada_37xx_pin_group armada_37xx_sb_groups[] = {
         PIN_GRP_GPIO("usb32_drvvbus0", 0, 1, BIT(0), "drvbus"),
         PIN_GRP_GPIO("usb2_drvvbus1", 1, 1, BIT(1), "drvbus"),
         PIN_GRP_GPIO("sdio_sb", 24, 6, BIT(2), "sdio"),
-        PIN_GRP_EXTRA("rgmii", 6, 12, BIT(3), 0, BIT(3), 23, 1, "mii", "gpio"),
+        PIN_GRP_GPIO("rgmii", 6, 12, BIT(3), "mii"),
         PIN_GRP_GPIO("pcie1", 3, 2, BIT(4), "pcie"),
         PIN_GRP_GPIO("ptp", 20, 3, BIT(5), "ptp"),
         PIN_GRP("ptp_clk", 21, 1, BIT(6), "ptp", "mii"),
         PIN_GRP("ptp_trig", 22, 1, BIT(7), "ptp", "mii"),
-        PIN_GRP("mii_col", 23, 1, BIT(8), "mii", "mii_err"),
+        PIN_GRP_GPIO_3("mii_col", 23, 1, BIT(8) | BIT(14), 0, BIT(8), BIT(14),
+                       "mii", "mii_err"),
 };
 
 const struct armada_37xx_pin_data armada_37xx_pin_nb = {
@@ -187,7 +198,7 @@ const struct armada_37xx_pin_data armada_37xx_pin_nb = {
 };
 
 const struct armada_37xx_pin_data armada_37xx_pin_sb = {
-        .nr_pins = 29,
+        .nr_pins = 30,
         .name = "GPIO2",
         .groups = armada_37xx_sb_groups,
         .ngroups = ARRAY_SIZE(armada_37xx_sb_groups),
@@ -208,7 +219,7 @@ static int armada_37xx_get_func_reg(struct armada_37xx_pin_group *grp,
 {
         int f;
 
-        for (f = 0; f < NB_FUNCS; f++)
+        for (f = 0; (f < NB_FUNCS) && grp->funcs[f]; f++)
                 if (!strcmp(grp->funcs[f], func))
                         return f;
 
@@ -795,7 +806,7 @@ static int armada_37xx_fill_group(struct armada_37xx_pinctrl *info)
                 for (j = 0; j < grp->extra_npins; j++)
                         grp->pins[i+j] = grp->extra_pin + j;
 
-                for (f = 0; f < NB_FUNCS; f++) {
+                for (f = 0; (f < NB_FUNCS) && grp->funcs[f]; f++) {
                         int ret;
                         /* check for unique functions and count groups */
                         ret = armada_37xx_add_function(info->funcs, &funcsize,
@@ -847,7 +858,7 @@ static int armada_37xx_fill_func(struct armada_37xx_pinctrl *info)
                         struct armada_37xx_pin_group *gp = &info->groups[g];
                         int f;
 
-                        for (f = 0; f < NB_FUNCS; f++) {
+                        for (f = 0; (f < NB_FUNCS) && gp->funcs[f]; f++) {
                                 if (strcmp(gp->funcs[f], name) == 0) {
                                         *groups = gp->name;
                                         groups++;
diff --git a/drivers/pinctrl/stm32/Kconfig b/drivers/pinctrl/stm32/Kconfig
index 3b8026fca057..7e1fe39a56a5 100644
--- a/drivers/pinctrl/stm32/Kconfig
+++ b/drivers/pinctrl/stm32/Kconfig
@@ -6,29 +6,30 @@ config PINCTRL_STM32
         select PINMUX
         select GENERIC_PINCONF
         select GPIOLIB
+        select IRQ_DOMAIN_HIERARCHY
         select MFD_SYSCON
 
 config PINCTRL_STM32F429
         bool "STMicroelectronics STM32F429 pin control" if COMPILE_TEST && !MACH_STM32F429
-        depends on OF && IRQ_DOMAIN_HIERARCHY
+        depends on OF
         default MACH_STM32F429
         select PINCTRL_STM32
 
 config PINCTRL_STM32F469
         bool "STMicroelectronics STM32F469 pin control" if COMPILE_TEST && !MACH_STM32F469
-        depends on OF && IRQ_DOMAIN_HIERARCHY
+        depends on OF
         default MACH_STM32F469
         select PINCTRL_STM32
 
 config PINCTRL_STM32F746
         bool "STMicroelectronics STM32F746 pin control" if COMPILE_TEST && !MACH_STM32F746
-        depends on OF && IRQ_DOMAIN_HIERARCHY
+        depends on OF
         default MACH_STM32F746
         select PINCTRL_STM32
 
 config PINCTRL_STM32H743
         bool "STMicroelectronics STM32H743 pin control" if COMPILE_TEST && !MACH_STM32H743
-        depends on OF && IRQ_DOMAIN_HIERARCHY
+        depends on OF
         default MACH_STM32H743
         select PINCTRL_STM32
 endif
diff --git a/drivers/pinctrl/sunxi/pinctrl-sun4i-a10.c b/drivers/pinctrl/sunxi/pinctrl-sun4i-a10.c
index 159580c04b14..47a392bc73c8 100644
--- a/drivers/pinctrl/sunxi/pinctrl-sun4i-a10.c
+++ b/drivers/pinctrl/sunxi/pinctrl-sun4i-a10.c
@@ -918,6 +918,7 @@ static const struct sunxi_desc_pin sun4i_a10_pins[] = {
                   SUNXI_FUNCTION_VARIANT(0x3, "emac",   /* ETXD1 */
                                          PINCTRL_SUN7I_A20),
                   SUNXI_FUNCTION(0x4, "keypad"),        /* IN6 */
+                  SUNXI_FUNCTION(0x5, "sim"),           /* DET */
                   SUNXI_FUNCTION_IRQ(0x6, 16),          /* EINT16 */
                   SUNXI_FUNCTION(0x7, "csi1")),         /* D16 */
         SUNXI_PIN(SUNXI_PINCTRL_PIN(H, 17),
diff --git a/drivers/pinctrl/uniphier/pinctrl-uniphier-pro4.c b/drivers/pinctrl/uniphier/pinctrl-uniphier-pro4.c
index a433a306a2d0..c75e094b2d90 100644
--- a/drivers/pinctrl/uniphier/pinctrl-uniphier-pro4.c
+++ b/drivers/pinctrl/uniphier/pinctrl-uniphier-pro4.c
@@ -1084,7 +1084,7 @@ static const unsigned usb1_pins[] = {182, 183};
 static const int usb1_muxvals[] = {0, 0};
 static const unsigned usb2_pins[] = {184, 185};
 static const int usb2_muxvals[] = {0, 0};
-static const unsigned usb3_pins[] = {186, 187};
+static const unsigned usb3_pins[] = {187, 188};
 static const int usb3_muxvals[] = {0, 0};
 static const unsigned port_range0_pins[] = {
         300, 301, 302, 303, 304, 305, 306, 307,         /* PORT0x */
diff --git a/drivers/pinctrl/zte/pinctrl-zx.c b/drivers/pinctrl/zte/pinctrl-zx.c
index 787e3967bd5c..f828ee340a98 100644
--- a/drivers/pinctrl/zte/pinctrl-zx.c
+++ b/drivers/pinctrl/zte/pinctrl-zx.c
@@ -64,10 +64,8 @@ static int zx_set_mux(struct pinctrl_dev *pctldev, unsigned int func_selector,
         struct zx_pinctrl_soc_info *info = zpctl->info;
         const struct pinctrl_pin_desc *pindesc = info->pins + group_selector;
         struct zx_pin_data *data = pindesc->drv_data;
-        struct zx_mux_desc *mux = data->muxes;
-        u32 mask = (1 << data->width) - 1;
-        u32 offset = data->offset;
-        u32 bitpos = data->bitpos;
+        struct zx_mux_desc *mux;
+        u32 mask, offset, bitpos;
         struct function_desc *func;
         unsigned long flags;
         u32 val, mval;
@@ -76,6 +74,11 @@ static int zx_set_mux(struct pinctrl_dev *pctldev, unsigned int func_selector,
         if (!data)
                 return -EINVAL;
 
+        mux = data->muxes;
+        mask = (1 << data->width) - 1;
+        offset = data->offset;
+        bitpos = data->bitpos;
+
         func = pinmux_generic_get_function(pctldev, func_selector);
         if (!func)
                 return -EINVAL;
diff --git a/drivers/platform/x86/Kconfig b/drivers/platform/x86/Kconfig
index b04860703740..80b87954f6dd 100644
--- a/drivers/platform/x86/Kconfig
+++ b/drivers/platform/x86/Kconfig
@@ -675,6 +675,7 @@ config PEAQ_WMI
         tristate "PEAQ 2-in-1 WMI hotkey driver"
         depends on ACPI_WMI
         depends on INPUT
+        select INPUT_POLLDEV
         help
          Say Y here if you want to support WMI-based hotkeys on PEAQ 2-in-1s.
 
diff --git a/drivers/platform/x86/dell-wmi.c b/drivers/platform/x86/dell-wmi.c
index f8978464df31..dad8f4afa17c 100644
--- a/drivers/platform/x86/dell-wmi.c
+++ b/drivers/platform/x86/dell-wmi.c
@@ -626,7 +626,7 @@ static void dell_wmi_input_destroy(struct wmi_device *wdev)
  * WMI Interface Version     8       4    <version>
  * WMI buffer length        12       4    4096
  */
-static int __init dell_wmi_check_descriptor_buffer(void)
+static int dell_wmi_check_descriptor_buffer(void)
 {
         struct acpi_buffer out = { ACPI_ALLOCATE_BUFFER, NULL };
         union acpi_object *obj;
@@ -717,9 +717,15 @@ static int dell_wmi_events_set_enabled(bool enable)
 
 static int dell_wmi_probe(struct wmi_device *wdev)
 {
+        int err;
+
         struct dell_wmi_priv *priv = devm_kzalloc(
                 &wdev->dev, sizeof(struct dell_wmi_priv), GFP_KERNEL);
 
+        err = dell_wmi_check_descriptor_buffer();
+        if (err)
+                return err;
+
         dev_set_drvdata(&wdev->dev, priv);
 
         return dell_wmi_input_setup(wdev);
@@ -749,10 +755,6 @@ static int __init dell_wmi_init(void)
 {
         int err;
 
-        err = dell_wmi_check_descriptor_buffer();
-        if (err)
-                return err;
-
         dmi_check_system(dell_wmi_smbios_list);
 
         if (wmi_requires_smbios_request) {
diff --git a/drivers/platform/x86/intel-vbtn.c b/drivers/platform/x86/intel-vbtn.c
index 61f106377661..480926786cb8 100644
--- a/drivers/platform/x86/intel-vbtn.c
+++ b/drivers/platform/x86/intel-vbtn.c
@@ -36,8 +36,8 @@ static const struct acpi_device_id intel_vbtn_ids[] = {
 
 /* In theory, these are HID usages. */
 static const struct key_entry intel_vbtn_keymap[] = {
-        { KE_IGNORE, 0xC0, { KEY_POWER } },     /* power key press */
-        { KE_KEY, 0xC1, { KEY_POWER } },        /* power key release */
+        { KE_KEY, 0xC0, { KEY_POWER } },        /* power key press */
+        { KE_IGNORE, 0xC1, { KEY_POWER } },     /* power key release */
         { KE_KEY, 0xC4, { KEY_VOLUMEUP } },             /* volume-up key press */
         { KE_IGNORE, 0xC5, { KEY_VOLUMEUP } },          /* volume-up key release */
         { KE_KEY, 0xC6, { KEY_VOLUMEDOWN } },           /* volume-down key press */
diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c
index 1a764e311e11..e32ba575e8d9 100644
--- a/drivers/platform/x86/wmi.c
+++ b/drivers/platform/x86/wmi.c
@@ -1252,12 +1252,12 @@ static int __init acpi_wmi_init(void)
 
         return 0;
 
-err_unreg_class:
-        class_unregister(&wmi_bus_class);
-
 err_unreg_bus:
         bus_unregister(&wmi_bus_type);
 
+err_unreg_class:
+        class_unregister(&wmi_bus_class);
+
         return error;
 }
 
diff --git a/drivers/power/avs/rockchip-io-domain.c b/drivers/power/avs/rockchip-io-domain.c
index 031a34372191..75f63e38a8d1 100644
--- a/drivers/power/avs/rockchip-io-domain.c
+++ b/drivers/power/avs/rockchip-io-domain.c
@@ -349,6 +349,36 @@ static const struct rockchip_iodomain_soc_data soc_data_rk3399_pmu = {
         .init = rk3399_pmu_iodomain_init,
 };
 
+static const struct rockchip_iodomain_soc_data soc_data_rv1108 = {
+        .grf_offset = 0x404,
+        .supply_names = {
+                NULL,
+                NULL,
+                NULL,
+                NULL,
+                NULL,
+                NULL,
+                NULL,
+                NULL,
+                NULL,
+                NULL,
+                NULL,
+                "vccio1",
+                "vccio2",
+                "vccio3",
+                "vccio5",
+                "vccio6",
+        },
+
+};
+
+static const struct rockchip_iodomain_soc_data soc_data_rv1108_pmu = {
+        .grf_offset = 0x104,
+        .supply_names = {
+                "pmu",
+        },
+};
+
 static const struct of_device_id rockchip_iodomain_match[] = {
         {
                 .compatible = "rockchip,rk3188-io-voltage-domain",
@@ -382,6 +412,14 @@ static const struct of_device_id rockchip_iodomain_match[] = {
                 .compatible = "rockchip,rk3399-pmu-io-voltage-domain",
                 .data = (void *)&soc_data_rk3399_pmu
         },
+        {
+                .compatible = "rockchip,rv1108-io-voltage-domain",
+                .data = (void *)&soc_data_rv1108
+        },
+        {
+                .compatible = "rockchip,rv1108-pmu-io-voltage-domain",
+                .data = (void *)&soc_data_rv1108_pmu
+        },
         { /* sentinel */ },
 };
 MODULE_DEVICE_TABLE(of, rockchip_iodomain_match);
diff --git a/drivers/ptp/ptp_clock.c b/drivers/ptp/ptp_clock.c
index b77435783ef3..7eacc1c4b3b1 100644
--- a/drivers/ptp/ptp_clock.c
+++ b/drivers/ptp/ptp_clock.c
@@ -28,6 +28,7 @@
 #include <linux/slab.h>
 #include <linux/syscalls.h>
 #include <linux/uaccess.h>
+#include <uapi/linux/sched/types.h>
 
 #include "ptp_private.h"
 
@@ -184,6 +185,19 @@ static void delete_ptp_clock(struct posix_clock *pc)
         kfree(ptp);
 }
 
+static void ptp_aux_kworker(struct kthread_work *work)
+{
+        struct ptp_clock *ptp = container_of(work, struct ptp_clock,
+                                             aux_work.work);
+        struct ptp_clock_info *info = ptp->info;
+        long delay;
+
+        delay = info->do_aux_work(info);
+
+        if (delay >= 0)
+                kthread_queue_delayed_work(ptp->kworker, &ptp->aux_work, delay);
+}
+
 /* public interface */
 
 struct ptp_clock *ptp_clock_register(struct ptp_clock_info *info,
@@ -217,6 +231,20 @@ struct ptp_clock *ptp_clock_register(struct ptp_clock_info *info,
         mutex_init(&ptp->pincfg_mux);
         init_waitqueue_head(&ptp->tsev_wq);
 
+        if (ptp->info->do_aux_work) {
+                char *worker_name = kasprintf(GFP_KERNEL, "ptp%d", ptp->index);
+
+                kthread_init_delayed_work(&ptp->aux_work, ptp_aux_kworker);
+                ptp->kworker = kthread_create_worker(0, worker_name ?
+                                                     worker_name : info->name);
+                kfree(worker_name);
+                if (IS_ERR(ptp->kworker)) {
+                        err = PTR_ERR(ptp->kworker);
+                        pr_err("failed to create ptp aux_worker %d\n", err);
+                        goto kworker_err;
+                }
+        }
+
         err = ptp_populate_pin_groups(ptp);
         if (err)
                 goto no_pin_groups;
@@ -259,6 +287,9 @@ no_pps:
 no_device:
         ptp_cleanup_pin_groups(ptp);
 no_pin_groups:
+        if (ptp->kworker)
+                kthread_destroy_worker(ptp->kworker);
+kworker_err:
         mutex_destroy(&ptp->tsevq_mux);
         mutex_destroy(&ptp->pincfg_mux);
         ida_simple_remove(&ptp_clocks_map, index);
@@ -274,6 +305,11 @@ int ptp_clock_unregister(struct ptp_clock *ptp)
         ptp->defunct = 1;
         wake_up_interruptible(&ptp->tsev_wq);
 
+        if (ptp->kworker) {
+                kthread_cancel_delayed_work_sync(&ptp->aux_work);
+                kthread_destroy_worker(ptp->kworker);
+        }
+
         /* Release the clock's resources. */
         if (ptp->pps_source)
                 pps_unregister_source(ptp->pps_source);
@@ -339,6 +375,12 @@ int ptp_find_pin(struct ptp_clock *ptp,
 }
 EXPORT_SYMBOL(ptp_find_pin);
 
+int ptp_schedule_worker(struct ptp_clock *ptp, unsigned long delay)
+{
+        return kthread_mod_delayed_work(ptp->kworker, &ptp->aux_work, delay);
+}
+EXPORT_SYMBOL(ptp_schedule_worker);
+
 /* module operations */
 
 static void __exit ptp_exit(void)
diff --git a/drivers/ptp/ptp_private.h b/drivers/ptp/ptp_private.h
index d95888974d0c..b86f1bfecd6f 100644
--- a/drivers/ptp/ptp_private.h
+++ b/drivers/ptp/ptp_private.h
@@ -22,6 +22,7 @@
 
 #include <linux/cdev.h>
 #include <linux/device.h>
+#include <linux/kthread.h>
 #include <linux/mutex.h>
 #include <linux/posix-clock.h>
 #include <linux/ptp_clock.h>
@@ -56,6 +57,8 @@ struct ptp_clock {
         struct attribute_group pin_attr_group;
         /* 1st entry is a pointer to the real group, 2nd is NULL terminator */
         const struct attribute_group *pin_attr_groups[2];
+        struct kthread_worker *kworker;
+        struct kthread_delayed_work aux_work;
 };
 
 /*
diff --git a/drivers/rtc/rtc-ds1307.c b/drivers/rtc/rtc-ds1307.c
index 4fac49e55d47..4b43aa62fbc7 100644
--- a/drivers/rtc/rtc-ds1307.c
+++ b/drivers/rtc/rtc-ds1307.c
@@ -1301,7 +1301,6 @@ static void ds1307_clks_register(struct ds1307 *ds1307)
 static const struct regmap_config regmap_config = {
         .reg_bits = 8,
         .val_bits = 8,
-        .max_register = 0x12,
 };
 
 static int ds1307_probe(struct i2c_client *client,
diff --git a/drivers/s390/cio/chp.c b/drivers/s390/cio/chp.c
index 7e0d4f724dda..432fc40990bd 100644
--- a/drivers/s390/cio/chp.c
+++ b/drivers/s390/cio/chp.c
@@ -559,6 +559,7 @@ static void chp_process_crw(struct crw *crw0, struct crw *crw1,
         chpid.id = crw0->rsid;
         switch (crw0->erc) {
         case CRW_ERC_IPARM: /* Path has come. */
+        case CRW_ERC_INIT:
                 if (!chp_is_registered(chpid))
                         chp_new(chpid);
                 chsc_chp_online(chpid);
diff --git a/drivers/s390/cio/vfio_ccw_cp.c b/drivers/s390/cio/vfio_ccw_cp.c
index ba6ac83a6c25..5ccfdc80d0ec 100644
--- a/drivers/s390/cio/vfio_ccw_cp.c
+++ b/drivers/s390/cio/vfio_ccw_cp.c
@@ -481,7 +481,7 @@ static int ccwchain_fetch_tic(struct ccwchain *chain,
                 ccw_tail = ccw_head + (iter->ch_len - 1) * sizeof(struct ccw1);
 
                 if ((ccw_head <= ccw->cda) && (ccw->cda <= ccw_tail)) {
-                        ccw->cda = (__u32) (addr_t) (iter->ch_ccw +
+                        ccw->cda = (__u32) (addr_t) (((char *)iter->ch_ccw) +
                                                      (ccw->cda - ccw_head));
                         return 0;
                 }
diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c
index 8975cd321390..d42e758518ed 100644
--- a/drivers/s390/net/qeth_l3_main.c
+++ b/drivers/s390/net/qeth_l3_main.c
@@ -2512,7 +2512,7 @@ static void qeth_l3_fill_header(struct qeth_card *card, struct qeth_hdr *hdr,
                 struct rtable *rt = (struct rtable *) dst;
                 __be32 *pkey = &ip_hdr(skb)->daddr;
 
-                if (rt->rt_gateway)
+                if (rt && rt->rt_gateway)
                         pkey = &rt->rt_gateway;
 
                 /* IPv4 */
@@ -2523,7 +2523,7 @@ static void qeth_l3_fill_header(struct qeth_card *card, struct qeth_hdr *hdr,
                 struct rt6_info *rt = (struct rt6_info *) dst;
                 struct in6_addr *pkey = &ipv6_hdr(skb)->daddr;
 
-                if (!ipv6_addr_any(&rt->rt6i_gateway))
+                if (rt && !ipv6_addr_any(&rt->rt6i_gateway))
                         pkey = &rt->rt6i_gateway;
 
                 /* IPv6 */
diff --git a/drivers/sbus/char/display7seg.c b/drivers/sbus/char/display7seg.c
index 04efed171c88..f32765d3cbd8 100644
--- a/drivers/sbus/char/display7seg.c
+++ b/drivers/sbus/char/display7seg.c
@@ -212,8 +212,8 @@ static int d7s_probe(struct platform_device *op)
 
         writeb(regs,  p->regs);
 
-        printk(KERN_INFO PFX "7-Segment Display%s at [%s:0x%llx] %s\n",
-               op->dev.of_node->full_name,
+        printk(KERN_INFO PFX "7-Segment Display%pOF at [%s:0x%llx] %s\n",
+               op->dev.of_node,
                (regs & D7S_FLIP) ? " (FLIPPED)" : "",
                op->resource[0].start,
                sol_compat ? "in sol_compat mode" : "");
diff --git a/drivers/sbus/char/flash.c b/drivers/sbus/char/flash.c
index 216f923161d1..a610b8d3d11f 100644
--- a/drivers/sbus/char/flash.c
+++ b/drivers/sbus/char/flash.c
@@ -181,8 +181,8 @@ static int flash_probe(struct platform_device *op)
         }
         flash.busy = 0;
 
-        printk(KERN_INFO "%s: OBP Flash, RD %lx[%lx] WR %lx[%lx]\n",
-               op->dev.of_node->full_name,
+        printk(KERN_INFO "%pOF: OBP Flash, RD %lx[%lx] WR %lx[%lx]\n",
+               op->dev.of_node,
                flash.read_base, flash.read_size,
                flash.write_base, flash.write_size);
 
diff --git a/drivers/sbus/char/uctrl.c b/drivers/sbus/char/uctrl.c
index 57696fc0b482..0a5013350acd 100644
--- a/drivers/sbus/char/uctrl.c
+++ b/drivers/sbus/char/uctrl.c
@@ -379,8 +379,8 @@ static int uctrl_probe(struct platform_device *op)
         }
 
         sbus_writel(UCTRL_INTR_RXNE_REQ|UCTRL_INTR_RXNE_MSK, &p->regs->uctrl_intr);
-        printk(KERN_INFO "%s: uctrl regs[0x%p] (irq %d)\n",
-               op->dev.of_node->full_name, p->regs, p->irq);
+        printk(KERN_INFO "%pOF: uctrl regs[0x%p] (irq %d)\n",
+               op->dev.of_node, p->regs, p->irq);
         uctrl_get_event_status(p);
         uctrl_get_external_status(p);
 
diff --git a/drivers/scsi/Kconfig b/drivers/scsi/Kconfig
index d384f4f86c26..d145e0d90227 100644
--- a/drivers/scsi/Kconfig
+++ b/drivers/scsi/Kconfig
@@ -47,6 +47,17 @@ config SCSI_NETLINK
         default n
         depends on NET
 
+config SCSI_MQ_DEFAULT
+        bool "SCSI: use blk-mq I/O path by default"
+        depends on SCSI
+        ---help---
+          This option enables the new blk-mq based I/O path for SCSI
+          devices by default.  With the option the scsi_mod.use_blk_mq
+          module/boot option defaults to Y, without it to N, but it can
+          still be overridden either way.
+
+          If unsure say N.
+
 config SCSI_PROC_FS
         bool "legacy /proc/scsi/ support"
         depends on SCSI && PROC_FS
@@ -1230,6 +1241,8 @@ config SCSI_LPFC
         tristate "Emulex LightPulse Fibre Channel Support"
         depends on PCI && SCSI
         depends on SCSI_FC_ATTRS
+        depends on NVME_TARGET_FC || NVME_TARGET_FC=n
+        depends on NVME_FC || NVME_FC=n
         select CRC_T10DIF
         ---help---
           This lpfc driver supports the Emulex LightPulse
diff --git a/drivers/scsi/aacraid/aachba.c b/drivers/scsi/aacraid/aachba.c
index 707ee2f5954d..a1a2c71e1626 100644
--- a/drivers/scsi/aacraid/aachba.c
+++ b/drivers/scsi/aacraid/aachba.c
@@ -549,7 +549,9 @@ static void get_container_name_callback(void *context, struct fib * fibptr)
         if ((le32_to_cpu(get_name_reply->status) == CT_OK)
          && (get_name_reply->data[0] != '\0')) {
                 char *sp = get_name_reply->data;
-                sp[sizeof(((struct aac_get_name_resp *)NULL)->data)] = '\0';
+                int data_size = FIELD_SIZEOF(struct aac_get_name_resp, data);
+
+                sp[data_size - 1] = '\0';
                 while (*sp == ' ')
                         ++sp;
                 if (*sp) {
@@ -579,12 +581,15 @@ static void get_container_name_callback(void *context, struct fib * fibptr)
 static int aac_get_container_name(struct scsi_cmnd * scsicmd)
 {
         int status;
+        int data_size;
         struct aac_get_name *dinfo;
         struct fib * cmd_fibcontext;
         struct aac_dev * dev;
 
         dev = (struct aac_dev *)scsicmd->device->host->hostdata;
 
+        data_size = FIELD_SIZEOF(struct aac_get_name_resp, data);
+
         cmd_fibcontext = aac_fib_alloc_tag(dev, scsicmd);
 
         aac_fib_init(cmd_fibcontext);
@@ -593,7 +598,7 @@ static int aac_get_container_name(struct scsi_cmnd * scsicmd)
         dinfo->command = cpu_to_le32(VM_ContainerConfig);
         dinfo->type = cpu_to_le32(CT_READ_NAME);
         dinfo->cid = cpu_to_le32(scmd_id(scsicmd));
-        dinfo->count = cpu_to_le32(sizeof(((struct aac_get_name_resp *)NULL)->data));
+        dinfo->count = cpu_to_le32(data_size - 1);
 
         status = aac_fib_send(ContainerCommand,
                   cmd_fibcontext,
@@ -3198,10 +3203,11 @@ static int query_disk(struct aac_dev *dev, void __user *arg)
                 return -EBUSY;
         if (copy_from_user(&qd, arg, sizeof (struct aac_query_disk)))
                 return -EFAULT;
-        if (qd.cnum == -1)
+        if (qd.cnum == -1) {
+                if (qd.id < 0 || qd.id >= dev->maximum_num_containers)
+                        return -EINVAL;
                 qd.cnum = qd.id;
-        else if ((qd.bus == -1) && (qd.id == -1) && (qd.lun == -1))
-        {
+        } else if ((qd.bus == -1) && (qd.id == -1) && (qd.lun == -1)) {
                 if (qd.cnum < 0 || qd.cnum >= dev->maximum_num_containers)
                         return -EINVAL;
                 qd.instance = dev->scsi_host_ptr->host_no;
diff --git a/drivers/scsi/aacraid/aacraid.h b/drivers/scsi/aacraid/aacraid.h
index d31a9bc2ba69..ee2667e20e42 100644
--- a/drivers/scsi/aacraid/aacraid.h
+++ b/drivers/scsi/aacraid/aacraid.h
@@ -2274,7 +2274,7 @@ struct aac_get_name_resp {
         __le32          parm3;
         __le32          parm4;
         __le32          parm5;
-        u8              data[16];
+        u8              data[17];
 };
 
 #define CT_CID_TO_32BITS_UID 165
diff --git a/drivers/scsi/aic7xxx/Makefile b/drivers/scsi/aic7xxx/Makefile
index 741d81861d17..07b60a780c06 100644
--- a/drivers/scsi/aic7xxx/Makefile
+++ b/drivers/scsi/aic7xxx/Makefile
@@ -55,9 +55,9 @@ aicasm-7xxx-opts-$(CONFIG_AIC7XXX_REG_PRETTY_PRINT) := \
 
 ifeq ($(CONFIG_AIC7XXX_BUILD_FIRMWARE),y)
 $(obj)/aic7xxx_seq.h: $(src)/aic7xxx.seq $(src)/aic7xxx.reg $(obj)/aicasm/aicasm
-        $(obj)/aicasm/aicasm -I$(src) -r $(obj)/aic7xxx_reg.h \
+        $(obj)/aicasm/aicasm -I$(srctree)/$(src) -r $(obj)/aic7xxx_reg.h \
                               $(aicasm-7xxx-opts-y) -o $(obj)/aic7xxx_seq.h \
-                              $(src)/aic7xxx.seq
+                              $(srctree)/$(src)/aic7xxx.seq
 
 $(aic7xxx-gen-y): $(obj)/aic7xxx_seq.h
 else
@@ -72,14 +72,14 @@ aicasm-79xx-opts-$(CONFIG_AIC79XX_REG_PRETTY_PRINT) := \
 
 ifeq ($(CONFIG_AIC79XX_BUILD_FIRMWARE),y)
 $(obj)/aic79xx_seq.h: $(src)/aic79xx.seq $(src)/aic79xx.reg $(obj)/aicasm/aicasm
-        $(obj)/aicasm/aicasm -I$(src) -r $(obj)/aic79xx_reg.h \
+        $(obj)/aicasm/aicasm -I$(srctree)/$(src) -r $(obj)/aic79xx_reg.h \
                               $(aicasm-79xx-opts-y) -o $(obj)/aic79xx_seq.h \
-                              $(src)/aic79xx.seq
+                              $(srctree)/$(src)/aic79xx.seq
 
 $(aic79xx-gen-y): $(obj)/aic79xx_seq.h
 else
 $(obj)/aic79xx_reg_print.c: $(src)/aic79xx_reg_print.c_shipped
 endif
 
-$(obj)/aicasm/aicasm: $(src)/aicasm/*.[chyl]
-        $(MAKE) -C $(src)/aicasm
+$(obj)/aicasm/aicasm: $(srctree)/$(src)/aicasm/*.[chyl]
+        $(MAKE) -C $(srctree)/$(src)/aicasm OUTDIR=$(shell pwd)/$(obj)/aicasm/
diff --git a/drivers/scsi/aic7xxx/aicasm/Makefile b/drivers/scsi/aic7xxx/aicasm/Makefile
index b98c5c1056c3..45e2d49c1fff 100644
--- a/drivers/scsi/aic7xxx/aicasm/Makefile
+++ b/drivers/scsi/aic7xxx/aicasm/Makefile
@@ -1,19 +1,21 @@
 PROG=   aicasm
 
+OUTDIR ?= ./
+
 .SUFFIXES= .l .y .c .h
 
 CSRCS=  aicasm.c aicasm_symbol.c
 YSRCS=  aicasm_gram.y aicasm_macro_gram.y
 LSRCS=  aicasm_scan.l aicasm_macro_scan.l
 
-GENHDRS=        aicdb.h $(YSRCS:.y=.h)
-GENSRCS=        $(YSRCS:.y=.c) $(LSRCS:.l=.c)
+GENHDRS=        $(addprefix ${OUTDIR}/,aicdb.h $(YSRCS:.y=.h))
+GENSRCS=        $(addprefix ${OUTDIR}/,$(YSRCS:.y=.c) $(LSRCS:.l=.c))
 
 SRCS=   ${CSRCS} ${GENSRCS}
 LIBS=   -ldb
 clean-files:= ${GENSRCS} ${GENHDRS} $(YSRCS:.y=.output) $(PROG)
 # Override default kernel CFLAGS.  This is a userland app.
-AICASM_CFLAGS:= -I/usr/include -I.
+AICASM_CFLAGS:= -I/usr/include -I. -I$(OUTDIR)
 LEX= flex
 YACC= bison
 YFLAGS= -d
@@ -32,22 +34,25 @@ YFLAGS+= -t -v
 LFLAGS= -d
 endif
 
-$(PROG):  ${GENHDRS} $(SRCS)
-        $(AICASM_CC) $(AICASM_CFLAGS) $(SRCS) -o $(PROG) $(LIBS)
+$(PROG):  $(OUTDIR) ${GENHDRS} $(SRCS)
+        $(AICASM_CC) $(AICASM_CFLAGS) $(SRCS) -o $(OUTDIR)/$(PROG) $(LIBS)
+
+$(OUTDIR):
+        mkdir -p $(OUTDIR)
 
-aicdb.h:
+$(OUTDIR)/aicdb.h:
         @if [ -e "/usr/include/db4/db_185.h" ]; then            \
-                echo "#include <db4/db_185.h>" > aicdb.h;       \
+                echo "#include <db4/db_185.h>" > $@;    \
          elif [ -e "/usr/include/db3/db_185.h" ]; then          \
-                echo "#include <db3/db_185.h>" > aicdb.h;       \
+                echo "#include <db3/db_185.h>" > $@;    \
          elif [ -e "/usr/include/db2/db_185.h" ]; then          \
-                echo "#include <db2/db_185.h>" > aicdb.h;       \
+                echo "#include <db2/db_185.h>" > $@;    \
          elif [ -e "/usr/include/db1/db_185.h" ]; then          \
-                echo "#include <db1/db_185.h>" > aicdb.h;       \
+                echo "#include <db1/db_185.h>" > $@;    \
          elif [ -e "/usr/include/db/db_185.h" ]; then           \
-                echo "#include <db/db_185.h>" > aicdb.h;        \
+                echo "#include <db/db_185.h>" > $@;     \
          elif [ -e "/usr/include/db_185.h" ]; then              \
-                echo "#include <db_185.h>" > aicdb.h;           \
+                echo "#include <db_185.h>" > $@;                \
          else                                                   \
                 echo "*** Install db development libraries";    \
          fi
@@ -58,23 +63,23 @@ clean:
 # Create a dependency chain in generated files
 # to avoid concurrent invocations of the single
 # rule that builds them all.
-aicasm_gram.c: aicasm_gram.h
-aicasm_gram.c aicasm_gram.h: aicasm_gram.y
+$(OUTDIR)/aicasm_gram.c: $(OUTDIR)/aicasm_gram.h
+$(OUTDIR)/aicasm_gram.c $(OUTDIR)/aicasm_gram.h: aicasm_gram.y
         $(YACC) $(YFLAGS) -b $(<:.y=) $<
-        mv $(<:.y=).tab.c $(<:.y=.c)
-        mv $(<:.y=).tab.h $(<:.y=.h)
+        mv $(<:.y=).tab.c $(OUTDIR)/$(<:.y=.c)
+        mv $(<:.y=).tab.h $(OUTDIR)/$(<:.y=.h)
 
 # Create a dependency chain in generated files
 # to avoid concurrent invocations of the single
 # rule that builds them all.
-aicasm_macro_gram.c: aicasm_macro_gram.h
-aicasm_macro_gram.c aicasm_macro_gram.h: aicasm_macro_gram.y
+$(OUTDIR)/aicasm_macro_gram.c: $(OUTDIR)/aicasm_macro_gram.h
+$(OUTDIR)/aicasm_macro_gram.c $(OUTDIR)/aicasm_macro_gram.h: aicasm_macro_gram.y
         $(YACC) $(YFLAGS) -b $(<:.y=) -p mm $<
-        mv $(<:.y=).tab.c $(<:.y=.c)
-        mv $(<:.y=).tab.h $(<:.y=.h)
+        mv $(<:.y=).tab.c $(OUTDIR)/$(<:.y=.c)
+        mv $(<:.y=).tab.h $(OUTDIR)/$(<:.y=.h)
 
-aicasm_scan.c: aicasm_scan.l
-        $(LEX) $(LFLAGS) -o$@ $<
+$(OUTDIR)/aicasm_scan.c: aicasm_scan.l
+        $(LEX) $(LFLAGS) -o $@ $<
 
-aicasm_macro_scan.c: aicasm_macro_scan.l
-        $(LEX) $(LFLAGS) -Pmm -o$@ $<
+$(OUTDIR)/aicasm_macro_scan.c: aicasm_macro_scan.l
+        $(LEX) $(LFLAGS) -Pmm -o $@ $<
diff --git a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
index 7dfe709a7138..6844ba361616 100644
--- a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
+++ b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
@@ -2624,12 +2624,11 @@ static struct fcoe_transport bnx2fc_transport = {
 };
 
 /**
- * bnx2fc_percpu_thread_create - Create a receive thread for an
- *                               online CPU
+ * bnx2fc_cpu_online - Create a receive thread for an  online CPU
  *
  * @cpu: cpu index for the online cpu
  */
-static void bnx2fc_percpu_thread_create(unsigned int cpu)
+static int bnx2fc_cpu_online(unsigned int cpu)
 {
         struct bnx2fc_percpu_s *p;
         struct task_struct *thread;
@@ -2639,15 +2638,17 @@ static void bnx2fc_percpu_thread_create(unsigned int cpu)
         thread = kthread_create_on_node(bnx2fc_percpu_io_thread,
                                         (void *)p, cpu_to_node(cpu),
                                         "bnx2fc_thread/%d", cpu);
+        if (IS_ERR(thread))
+                return PTR_ERR(thread);
+
         /* bind thread to the cpu */
-        if (likely(!IS_ERR(thread))) {
-                kthread_bind(thread, cpu);
-                p->iothread = thread;
-                wake_up_process(thread);
-        }
+        kthread_bind(thread, cpu);
+        p->iothread = thread;
+        wake_up_process(thread);
+        return 0;
 }
 
-static void bnx2fc_percpu_thread_destroy(unsigned int cpu)
+static int bnx2fc_cpu_offline(unsigned int cpu)
 {
         struct bnx2fc_percpu_s *p;
         struct task_struct *thread;
@@ -2661,7 +2662,6 @@ static void bnx2fc_percpu_thread_destroy(unsigned int cpu)
         thread = p->iothread;
         p->iothread = NULL;
 
-
         /* Free all work in the list */
         list_for_each_entry_safe(work, tmp, &p->work_list, list) {
                 list_del_init(&work->list);
@@ -2673,20 +2673,6 @@ static void bnx2fc_percpu_thread_destroy(unsigned int cpu)
 
         if (thread)
                 kthread_stop(thread);
-}
-
-
-static int bnx2fc_cpu_online(unsigned int cpu)
-{
-        printk(PFX "CPU %x online: Create Rx thread\n", cpu);
-        bnx2fc_percpu_thread_create(cpu);
-        return 0;
-}
-
-static int bnx2fc_cpu_dead(unsigned int cpu)
-{
-        printk(PFX "CPU %x offline: Remove Rx thread\n", cpu);
-        bnx2fc_percpu_thread_destroy(cpu);
         return 0;
 }
 
@@ -2761,30 +2747,16 @@ static int __init bnx2fc_mod_init(void)
                 spin_lock_init(&p->fp_work_lock);
         }
 
-        get_online_cpus();
-
-        for_each_online_cpu(cpu)
-                bnx2fc_percpu_thread_create(cpu);
-
-        rc = cpuhp_setup_state_nocalls(CPUHP_AP_ONLINE_DYN,
-                                       "scsi/bnx2fc:online",
-                                       bnx2fc_cpu_online, NULL);
+        rc = cpuhp_setup_state(CPUHP_AP_ONLINE_DYN, "scsi/bnx2fc:online",
+                               bnx2fc_cpu_online, bnx2fc_cpu_offline);
         if (rc < 0)
-                goto stop_threads;
+                goto stop_thread;
         bnx2fc_online_state = rc;
 
-        cpuhp_setup_state_nocalls(CPUHP_SCSI_BNX2FC_DEAD, "scsi/bnx2fc:dead",
-                                  NULL, bnx2fc_cpu_dead);
-        put_online_cpus();
-
         cnic_register_driver(CNIC_ULP_FCOE, &bnx2fc_cnic_cb);
-
         return 0;
 
-stop_threads:
-        for_each_online_cpu(cpu)
-                bnx2fc_percpu_thread_destroy(cpu);
-        put_online_cpus();
+stop_thread:
         kthread_stop(l2_thread);
 free_wq:
         destroy_workqueue(bnx2fc_wq);
@@ -2803,7 +2775,6 @@ static void __exit bnx2fc_mod_exit(void)
         struct fcoe_percpu_s *bg;
         struct task_struct *l2_thread;
         struct sk_buff *skb;
-        unsigned int cpu = 0;
 
         /*
          * NOTE: Since cnic calls register_driver routine rtnl_lock,
@@ -2844,16 +2815,7 @@ static void __exit bnx2fc_mod_exit(void)
         if (l2_thread)
                 kthread_stop(l2_thread);
 
-        get_online_cpus();
-        /* Destroy per cpu threads */
-        for_each_online_cpu(cpu) {
-                bnx2fc_percpu_thread_destroy(cpu);
-        }
-
-        cpuhp_remove_state_nocalls(bnx2fc_online_state);
-        cpuhp_remove_state_nocalls(CPUHP_SCSI_BNX2FC_DEAD);
-
-        put_online_cpus();
+        cpuhp_remove_state(bnx2fc_online_state);
 
         destroy_workqueue(bnx2fc_wq);
         /*
diff --git a/drivers/scsi/bnx2fc/bnx2fc_hwi.c b/drivers/scsi/bnx2fc/bnx2fc_hwi.c
index 913c750205ce..26de61d65a4d 100644
--- a/drivers/scsi/bnx2fc/bnx2fc_hwi.c
+++ b/drivers/scsi/bnx2fc/bnx2fc_hwi.c
@@ -1008,6 +1008,28 @@ static struct bnx2fc_work *bnx2fc_alloc_work(struct bnx2fc_rport *tgt, u16 wqe)
         return work;
 }
 
+/* Pending work request completion */
+static void bnx2fc_pending_work(struct bnx2fc_rport *tgt, unsigned int wqe)
+{
+        unsigned int cpu = wqe % num_possible_cpus();
+        struct bnx2fc_percpu_s *fps;
+        struct bnx2fc_work *work;
+
+        fps = &per_cpu(bnx2fc_percpu, cpu);
+        spin_lock_bh(&fps->fp_work_lock);
+        if (fps->iothread) {
+                work = bnx2fc_alloc_work(tgt, wqe);
+                if (work) {
+                        list_add_tail(&work->list, &fps->work_list);
+                        wake_up_process(fps->iothread);
+                        spin_unlock_bh(&fps->fp_work_lock);
+                        return;
+                }
+        }
+        spin_unlock_bh(&fps->fp_work_lock);
+        bnx2fc_process_cq_compl(tgt, wqe);
+}
+
 int bnx2fc_process_new_cqes(struct bnx2fc_rport *tgt)
 {
         struct fcoe_cqe *cq;
@@ -1042,28 +1064,7 @@ int bnx2fc_process_new_cqes(struct bnx2fc_rport *tgt)
                         /* Unsolicited event notification */
                         bnx2fc_process_unsol_compl(tgt, wqe);
                 } else {
-                        /* Pending work request completion */
-                        struct bnx2fc_work *work = NULL;
-                        struct bnx2fc_percpu_s *fps = NULL;
-                        unsigned int cpu = wqe % num_possible_cpus();
-
-                        fps = &per_cpu(bnx2fc_percpu, cpu);
-                        spin_lock_bh(&fps->fp_work_lock);
-                        if (unlikely(!fps->iothread))
-                                goto unlock;
-
-                        work = bnx2fc_alloc_work(tgt, wqe);
-                        if (work)
-                                list_add_tail(&work->list,
-                                              &fps->work_list);
-unlock:
-                        spin_unlock_bh(&fps->fp_work_lock);
-
-                        /* Pending work request completion */
-                        if (fps->iothread && work)
-                                wake_up_process(fps->iothread);
-                        else
-                                bnx2fc_process_cq_compl(tgt, wqe);
+                        bnx2fc_pending_work(tgt, wqe);
                         num_free_sqes++;
                 }
                 cqe++;
diff --git a/drivers/scsi/bnx2i/bnx2i_init.c b/drivers/scsi/bnx2i/bnx2i_init.c
index 86afc002814c..4ebcda8d9500 100644
--- a/drivers/scsi/bnx2i/bnx2i_init.c
+++ b/drivers/scsi/bnx2i/bnx2i_init.c
@@ -404,12 +404,11 @@ int bnx2i_get_stats(void *handle)
 
 
 /**
- * bnx2i_percpu_thread_create - Create a receive thread for an
- *                              online CPU
+ * bnx2i_cpu_online - Create a receive thread for an online CPU
  *
  * @cpu:        cpu index for the online cpu
  */
-static void bnx2i_percpu_thread_create(unsigned int cpu)
+static int bnx2i_cpu_online(unsigned int cpu)
 {
         struct bnx2i_percpu_s *p;
         struct task_struct *thread;
@@ -419,16 +418,17 @@ static void bnx2i_percpu_thread_create(unsigned int cpu)
         thread = kthread_create_on_node(bnx2i_percpu_io_thread, (void *)p,
                                         cpu_to_node(cpu),
                                         "bnx2i_thread/%d", cpu);
+        if (IS_ERR(thread))
+                return PTR_ERR(thread);
+
         /* bind thread to the cpu */
-        if (likely(!IS_ERR(thread))) {
-                kthread_bind(thread, cpu);
-                p->iothread = thread;
-                wake_up_process(thread);
-        }
+        kthread_bind(thread, cpu);
+        p->iothread = thread;
+        wake_up_process(thread);
+        return 0;
 }
 
-
-static void bnx2i_percpu_thread_destroy(unsigned int cpu)
+static int bnx2i_cpu_offline(unsigned int cpu)
 {
         struct bnx2i_percpu_s *p;
         struct task_struct *thread;
@@ -451,19 +451,6 @@ static void bnx2i_percpu_thread_destroy(unsigned int cpu)
         spin_unlock_bh(&p->p_work_lock);
         if (thread)
                 kthread_stop(thread);
-}
-
-static int bnx2i_cpu_online(unsigned int cpu)
-{
-        pr_info("bnx2i: CPU %x online: Create Rx thread\n", cpu);
-        bnx2i_percpu_thread_create(cpu);
-        return 0;
-}
-
-static int bnx2i_cpu_dead(unsigned int cpu)
-{
-        pr_info("CPU %x offline: Remove Rx thread\n", cpu);
-        bnx2i_percpu_thread_destroy(cpu);
         return 0;
 }
 
@@ -511,27 +498,14 @@ static int __init bnx2i_mod_init(void)
                 p->iothread = NULL;
         }
 
-        get_online_cpus();
-
-        for_each_online_cpu(cpu)
-                bnx2i_percpu_thread_create(cpu);
-
-        err = cpuhp_setup_state_nocalls(CPUHP_AP_ONLINE_DYN,
-                                       "scsi/bnx2i:online",
-                                       bnx2i_cpu_online, NULL);
+        err = cpuhp_setup_state(CPUHP_AP_ONLINE_DYN, "scsi/bnx2i:online",
+                                bnx2i_cpu_online, bnx2i_cpu_offline);
         if (err < 0)
-                goto remove_threads;
+                goto unreg_driver;
         bnx2i_online_state = err;
-
-        cpuhp_setup_state_nocalls(CPUHP_SCSI_BNX2I_DEAD, "scsi/bnx2i:dead",
-                                  NULL, bnx2i_cpu_dead);
-        put_online_cpus();
         return 0;
 
-remove_threads:
-        for_each_online_cpu(cpu)
-                bnx2i_percpu_thread_destroy(cpu);
-        put_online_cpus();
+unreg_driver:
         cnic_unregister_driver(CNIC_ULP_ISCSI);
 unreg_xport:
         iscsi_unregister_transport(&bnx2i_iscsi_transport);
@@ -551,7 +525,6 @@ out:
 static void __exit bnx2i_mod_exit(void)
 {
         struct bnx2i_hba *hba;
-        unsigned cpu = 0;
 
         mutex_lock(&bnx2i_dev_lock);
         while (!list_empty(&adapter_list)) {
@@ -569,14 +542,7 @@ static void __exit bnx2i_mod_exit(void)
         }
         mutex_unlock(&bnx2i_dev_lock);
 
-        get_online_cpus();
-
-        for_each_online_cpu(cpu)
-                bnx2i_percpu_thread_destroy(cpu);
-
-        cpuhp_remove_state_nocalls(bnx2i_online_state);
-        cpuhp_remove_state_nocalls(CPUHP_SCSI_BNX2I_DEAD);
-        put_online_cpus();
+        cpuhp_remove_state(bnx2i_online_state);
 
         iscsi_unregister_transport(&bnx2i_iscsi_transport);
         cnic_unregister_driver(CNIC_ULP_ISCSI);
diff --git a/drivers/scsi/csiostor/csio_hw.c b/drivers/scsi/csiostor/csio_hw.c
index 2029ad225121..5be0086142ca 100644
--- a/drivers/scsi/csiostor/csio_hw.c
+++ b/drivers/scsi/csiostor/csio_hw.c
@@ -3845,8 +3845,10 @@ csio_hw_start(struct csio_hw *hw)
 
         if (csio_is_hw_ready(hw))
                 return 0;
-        else
+        else if (csio_match_state(hw, csio_hws_uninit))
                 return -EINVAL;
+        else
+                return -ENODEV;
 }
 
 int
diff --git a/drivers/scsi/csiostor/csio_init.c b/drivers/scsi/csiostor/csio_init.c
index ea0c31086cc6..dcd074169aa9 100644
--- a/drivers/scsi/csiostor/csio_init.c
+++ b/drivers/scsi/csiostor/csio_init.c
@@ -969,10 +969,14 @@ static int csio_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
 
         pci_set_drvdata(pdev, hw);
 
-        if (csio_hw_start(hw) != 0) {
-                dev_err(&pdev->dev,
-                        "Failed to start FW, continuing in debug mode.\n");
-                return 0;
+        rv = csio_hw_start(hw);
+        if (rv) {
+                if (rv == -EINVAL) {
+                        dev_err(&pdev->dev,
+                                "Failed to start FW, continuing in debug mode.\n");
+                        return 0;
+                }
+                goto err_lnode_exit;
         }
 
         sprintf(hw->fwrev_str, "%u.%u.%u.%u\n",
diff --git a/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c b/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c
index a69a9ac836f5..1d02cf9fe06c 100644
--- a/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c
+++ b/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c
@@ -1635,6 +1635,9 @@ static int init_act_open(struct cxgbi_sock *csk)
                 goto rel_resource;
         }
 
+        if (!(n->nud_state & NUD_VALID))
+                neigh_event_send(n, NULL);
+
         csk->atid = cxgb4_alloc_atid(lldi->tids, csk);
         if (csk->atid < 0) {
                 pr_err("%s, NO atid available.\n", ndev->name);
diff --git a/drivers/scsi/cxgbi/libcxgbi.c b/drivers/scsi/cxgbi/libcxgbi.c
index e4c83b7c96a8..1a4cfa562a60 100644
--- a/drivers/scsi/cxgbi/libcxgbi.c
+++ b/drivers/scsi/cxgbi/libcxgbi.c
@@ -2128,6 +2128,13 @@ void cxgbi_cleanup_task(struct iscsi_task *task)
         struct iscsi_tcp_task *tcp_task = task->dd_data;
         struct cxgbi_task_data *tdata = iscsi_task_cxgbi_data(task);
 
+        if (!tcp_task || !tdata || (tcp_task->dd_data != tdata)) {
+                pr_info("task 0x%p,0x%p, tcp_task 0x%p, tdata 0x%p/0x%p.\n",
+                        task, task->sc, tcp_task,
+                        tcp_task ? tcp_task->dd_data : NULL, tdata);
+                return;
+        }
+
         log_debug(1 << CXGBI_DBG_ISCSI,
                 "task 0x%p, skb 0x%p, itt 0x%x.\n",
                 task, tdata->skb, task->hdr_itt);
diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
index 8914eab84337..4f7cdb28bd38 100644
--- a/drivers/scsi/hpsa.c
+++ b/drivers/scsi/hpsa.c
@@ -938,7 +938,7 @@ static struct scsi_host_template hpsa_driver_template = {
 #endif
         .sdev_attrs = hpsa_sdev_attrs,
         .shost_attrs = hpsa_shost_attrs,
-        .max_sectors = 8192,
+        .max_sectors = 1024,
         .no_write_same = 1,
 };
 
diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c
index b0c68d24db01..f838bd73befa 100644
--- a/drivers/scsi/ipr.c
+++ b/drivers/scsi/ipr.c
@@ -3351,6 +3351,16 @@ static void ipr_worker_thread(struct work_struct *work)
                 return;
         }
 
+        if (ioa_cfg->scsi_unblock) {
+                ioa_cfg->scsi_unblock = 0;
+                ioa_cfg->scsi_blocked = 0;
+                spin_unlock_irqrestore(ioa_cfg->host->host_lock, lock_flags);
+                scsi_unblock_requests(ioa_cfg->host);
+                spin_lock_irqsave(ioa_cfg->host->host_lock, lock_flags);
+                if (ioa_cfg->scsi_blocked)
+                        scsi_block_requests(ioa_cfg->host);
+        }
+
         if (!ioa_cfg->scan_enabled) {
                 spin_unlock_irqrestore(ioa_cfg->host->host_lock, lock_flags);
                 return;
@@ -4935,6 +4945,7 @@ static int ipr_slave_configure(struct scsi_device *sdev)
                 }
                 if (ipr_is_vset_device(res)) {
                         sdev->scsi_level = SCSI_SPC_3;
+                        sdev->no_report_opcodes = 1;
                         blk_queue_rq_timeout(sdev->request_queue,
                                              IPR_VSET_RW_TIMEOUT);
                         blk_queue_max_hw_sectors(sdev->request_queue, IPR_VSET_MAX_SECTORS);
@@ -7211,9 +7222,8 @@ static int ipr_ioa_bringdown_done(struct ipr_cmnd *ipr_cmd)
         ENTER;
         if (!ioa_cfg->hrrq[IPR_INIT_HRRQ].removing_ioa) {
                 ipr_trace;
-                spin_unlock_irq(ioa_cfg->host->host_lock);
-                scsi_unblock_requests(ioa_cfg->host);
-                spin_lock_irq(ioa_cfg->host->host_lock);
+                ioa_cfg->scsi_unblock = 1;
+                schedule_work(&ioa_cfg->work_q);
         }
 
         ioa_cfg->in_reset_reload = 0;
@@ -7287,13 +7297,7 @@ static int ipr_ioa_reset_done(struct ipr_cmnd *ipr_cmd)
         list_add_tail(&ipr_cmd->queue, &ipr_cmd->hrrq->hrrq_free_q);
         wake_up_all(&ioa_cfg->reset_wait_q);
 
-        spin_unlock(ioa_cfg->host->host_lock);
-        scsi_unblock_requests(ioa_cfg->host);
-        spin_lock(ioa_cfg->host->host_lock);
-
-        if (!ioa_cfg->hrrq[IPR_INIT_HRRQ].allow_cmds)
-                scsi_block_requests(ioa_cfg->host);
-
+        ioa_cfg->scsi_unblock = 1;
         schedule_work(&ioa_cfg->work_q);
         LEAVE;
         return IPR_RC_JOB_RETURN;
@@ -9249,8 +9253,11 @@ static void _ipr_initiate_ioa_reset(struct ipr_ioa_cfg *ioa_cfg,
                 spin_unlock(&ioa_cfg->hrrq[i]._lock);
         }
         wmb();
-        if (!ioa_cfg->hrrq[IPR_INIT_HRRQ].removing_ioa)
+        if (!ioa_cfg->hrrq[IPR_INIT_HRRQ].removing_ioa) {
+                ioa_cfg->scsi_unblock = 0;
+                ioa_cfg->scsi_blocked = 1;
                 scsi_block_requests(ioa_cfg->host);
+        }
 
         ipr_cmd = ipr_get_free_ipr_cmnd(ioa_cfg);
         ioa_cfg->reset_cmd = ipr_cmd;
@@ -9306,9 +9313,8 @@ static void ipr_initiate_ioa_reset(struct ipr_ioa_cfg *ioa_cfg,
                         wake_up_all(&ioa_cfg->reset_wait_q);
 
                         if (!ioa_cfg->hrrq[IPR_INIT_HRRQ].removing_ioa) {
-                                spin_unlock_irq(ioa_cfg->host->host_lock);
-                                scsi_unblock_requests(ioa_cfg->host);
-                                spin_lock_irq(ioa_cfg->host->host_lock);
+                                ioa_cfg->scsi_unblock = 1;
+                                schedule_work(&ioa_cfg->work_q);
                         }
                         return;
                 } else {
diff --git a/drivers/scsi/ipr.h b/drivers/scsi/ipr.h
index e98a87a65335..c7f0e9e3cd7d 100644
--- a/drivers/scsi/ipr.h
+++ b/drivers/scsi/ipr.h
@@ -1488,6 +1488,8 @@ struct ipr_ioa_cfg {
         u8 cfg_locked:1;
         u8 clear_isr:1;
         u8 probe_done:1;
+        u8 scsi_unblock:1;
+        u8 scsi_blocked:1;
 
         u8 revid;
 
diff --git a/drivers/scsi/lpfc/lpfc_attr.c b/drivers/scsi/lpfc/lpfc_attr.c
index 4ed48ed38e79..7ee1a94c0b33 100644
--- a/drivers/scsi/lpfc/lpfc_attr.c
+++ b/drivers/scsi/lpfc/lpfc_attr.c
@@ -205,8 +205,10 @@ lpfc_nvme_info_show(struct device *dev, struct device_attribute *attr,
                                 atomic_read(&tgtp->xmt_ls_rsp_error));
 
                 len += snprintf(buf+len, PAGE_SIZE-len,
-                                "FCP: Rcv %08x Release %08x Drop %08x\n",
+                                "FCP: Rcv %08x Defer %08x Release %08x "
+                                "Drop %08x\n",
                                 atomic_read(&tgtp->rcv_fcp_cmd_in),
+                                atomic_read(&tgtp->rcv_fcp_cmd_defer),
                                 atomic_read(&tgtp->xmt_fcp_release),
                                 atomic_read(&tgtp->rcv_fcp_cmd_drop));
 
diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c
index 5cc8b0f7d885..744f3f395b64 100644
--- a/drivers/scsi/lpfc/lpfc_debugfs.c
+++ b/drivers/scsi/lpfc/lpfc_debugfs.c
@@ -782,8 +782,11 @@ lpfc_debugfs_nvmestat_data(struct lpfc_vport *vport, char *buf, int size)
                                 atomic_read(&tgtp->xmt_ls_rsp_error));
 
                 len += snprintf(buf + len, size - len,
-                                "FCP: Rcv %08x Drop %08x\n",
+                                "FCP: Rcv %08x Defer %08x Release %08x "
+                                "Drop %08x\n",
                                 atomic_read(&tgtp->rcv_fcp_cmd_in),
+                                atomic_read(&tgtp->rcv_fcp_cmd_defer),
+                                atomic_read(&tgtp->xmt_fcp_release),
                                 atomic_read(&tgtp->rcv_fcp_cmd_drop));
 
                 if (atomic_read(&tgtp->rcv_fcp_cmd_in) !=
diff --git a/drivers/scsi/lpfc/lpfc_nvmet.c b/drivers/scsi/lpfc/lpfc_nvmet.c
index fbeec344c6cc..bbbd0f84160d 100644
--- a/drivers/scsi/lpfc/lpfc_nvmet.c
+++ b/drivers/scsi/lpfc/lpfc_nvmet.c
@@ -841,12 +841,31 @@ lpfc_nvmet_xmt_fcp_release(struct nvmet_fc_target_port *tgtport,
         lpfc_nvmet_ctxbuf_post(phba, ctxp->ctxbuf);
 }
 
+static void
+lpfc_nvmet_defer_rcv(struct nvmet_fc_target_port *tgtport,
+                     struct nvmefc_tgt_fcp_req *rsp)
+{
+        struct lpfc_nvmet_tgtport *tgtp;
+        struct lpfc_nvmet_rcv_ctx *ctxp =
+                container_of(rsp, struct lpfc_nvmet_rcv_ctx, ctx.fcp_req);
+        struct rqb_dmabuf *nvmebuf = ctxp->rqb_buffer;
+        struct lpfc_hba *phba = ctxp->phba;
+
+        lpfc_nvmeio_data(phba, "NVMET DEFERRCV: xri x%x sz %d CPU %02x\n",
+                         ctxp->oxid, ctxp->size, smp_processor_id());
+
+        tgtp = phba->targetport->private;
+        atomic_inc(&tgtp->rcv_fcp_cmd_defer);
+        lpfc_rq_buf_free(phba, &nvmebuf->hbuf); /* repost */
+}
+
 static struct nvmet_fc_target_template lpfc_tgttemplate = {
         .targetport_delete = lpfc_nvmet_targetport_delete,
         .xmt_ls_rsp     = lpfc_nvmet_xmt_ls_rsp,
         .fcp_op         = lpfc_nvmet_xmt_fcp_op,
         .fcp_abort      = lpfc_nvmet_xmt_fcp_abort,
         .fcp_req_release = lpfc_nvmet_xmt_fcp_release,
+        .defer_rcv      = lpfc_nvmet_defer_rcv,
 
         .max_hw_queues  = 1,
         .max_sgl_segments = LPFC_NVMET_DEFAULT_SEGS,
@@ -1504,6 +1523,17 @@ lpfc_nvmet_unsol_fcp_buffer(struct lpfc_hba *phba,
                 return;
         }
 
+        /* Processing of FCP command is deferred */
+        if (rc == -EOVERFLOW) {
+                lpfc_nvmeio_data(phba,
+                                 "NVMET RCV BUSY: xri x%x sz %d from %06x\n",
+                                 oxid, size, sid);
+                /* defer reposting rcv buffer till .defer_rcv callback */
+                ctxp->rqb_buffer = nvmebuf;
+                atomic_inc(&tgtp->rcv_fcp_cmd_out);
+                return;
+        }
+
         atomic_inc(&tgtp->rcv_fcp_cmd_drop);
         lpfc_printf_log(phba, KERN_ERR, LOG_NVME_IOERR,
                         "6159 FCP Drop IO x%x: err x%x: x%x x%x x%x\n",
diff --git a/drivers/scsi/lpfc/lpfc_nvmet.h b/drivers/scsi/lpfc/lpfc_nvmet.h
index e675ef17be08..48a76788b003 100644
--- a/drivers/scsi/lpfc/lpfc_nvmet.h
+++ b/drivers/scsi/lpfc/lpfc_nvmet.h
@@ -49,6 +49,7 @@ struct lpfc_nvmet_tgtport {
         atomic_t rcv_fcp_cmd_in;
         atomic_t rcv_fcp_cmd_out;
         atomic_t rcv_fcp_cmd_drop;
+        atomic_t rcv_fcp_cmd_defer;
         atomic_t xmt_fcp_release;
 
         /* Stats counters - lpfc_nvmet_xmt_fcp_op */
diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
index 316c3df0c3fd..71c4746341ea 100644
--- a/drivers/scsi/megaraid/megaraid_sas_base.c
+++ b/drivers/scsi/megaraid/megaraid_sas_base.c
@@ -6228,8 +6228,8 @@ static int megasas_probe_one(struct pci_dev *pdev,
 fail_start_aen:
 fail_io_attach:
         megasas_mgmt_info.count--;
-        megasas_mgmt_info.instance[megasas_mgmt_info.max_index] = NULL;
         megasas_mgmt_info.max_index--;
+        megasas_mgmt_info.instance[megasas_mgmt_info.max_index] = NULL;
 
         instance->instancet->disable_intr(instance);
         megasas_destroy_irqs(instance);
diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.c b/drivers/scsi/megaraid/megaraid_sas_fusion.c
index f990ab4d45e1..985510628f56 100644
--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c
+++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c
@@ -425,7 +425,7 @@ static int megasas_create_sg_sense_fusion(struct megasas_instance *instance)
 int
 megasas_alloc_cmdlist_fusion(struct megasas_instance *instance)
 {
-        u32 max_mpt_cmd, i;
+        u32 max_mpt_cmd, i, j;
         struct fusion_context *fusion;
 
         fusion = instance->ctrl_context;
@@ -450,11 +450,15 @@ megasas_alloc_cmdlist_fusion(struct megasas_instance *instance)
                 fusion->cmd_list[i] = kzalloc(sizeof(struct megasas_cmd_fusion),
                                               GFP_KERNEL);
                 if (!fusion->cmd_list[i]) {
+                        for (j = 0; j < i; j++)
+                                kfree(fusion->cmd_list[j]);
+                        kfree(fusion->cmd_list);
                         dev_err(&instance->pdev->dev,
                                 "Failed from %s %d\n",  __func__, __LINE__);
                         return -ENOMEM;
                 }
         }
+
         return 0;
 }
 int
diff --git a/drivers/scsi/qedf/qedf.h b/drivers/scsi/qedf/qedf.h
index 4d038926a455..351f06dfc5a0 100644
--- a/drivers/scsi/qedf/qedf.h
+++ b/drivers/scsi/qedf/qedf.h
@@ -528,7 +528,8 @@ struct fip_vlan {
 #define QEDF_WRITE                    (1 << 0)
 #define MAX_FIBRE_LUNS                  0xffffffff
 
-#define QEDF_MAX_NUM_CQS                8
+#define MIN_NUM_CPUS_MSIX(x)    min_t(u32, x->dev_info.num_cqs, \
+                                        num_online_cpus())
 
 /*
  * PCI function probe defines
diff --git a/drivers/scsi/qedf/qedf_els.c b/drivers/scsi/qedf/qedf_els.c
index eb07f1de8afa..59c18ca4cda9 100644
--- a/drivers/scsi/qedf/qedf_els.c
+++ b/drivers/scsi/qedf/qedf_els.c
@@ -489,7 +489,7 @@ static void qedf_srr_compl(struct qedf_els_cb_arg *cb_arg)
 
         /* If a SRR times out, simply free resources */
         if (srr_req->event == QEDF_IOREQ_EV_ELS_TMO)
-                goto out_free;
+                goto out_put;
 
         /* Normalize response data into struct fc_frame */
         mp_req = &(srr_req->mp_req);
@@ -501,7 +501,7 @@ static void qedf_srr_compl(struct qedf_els_cb_arg *cb_arg)
         if (!fp) {
                 QEDF_ERR(&(qedf->dbg_ctx),
                     "fc_frame_alloc failure.\n");
-                goto out_free;
+                goto out_put;
         }
 
         /* Copy frame header from firmware into fp */
@@ -526,9 +526,10 @@ static void qedf_srr_compl(struct qedf_els_cb_arg *cb_arg)
         }
 
         fc_frame_free(fp);
-out_free:
+out_put:
         /* Put reference for original command since SRR completed */
         kref_put(&orig_io_req->refcount, qedf_release_cmd);
+out_free:
         kfree(cb_arg);
 }
 
@@ -780,7 +781,7 @@ static void qedf_rec_compl(struct qedf_els_cb_arg *cb_arg)
 
         /* If a REC times out, free resources */
         if (rec_req->event == QEDF_IOREQ_EV_ELS_TMO)
-                goto out_free;
+                goto out_put;
 
         /* Normalize response data into struct fc_frame */
         mp_req = &(rec_req->mp_req);
@@ -792,7 +793,7 @@ static void qedf_rec_compl(struct qedf_els_cb_arg *cb_arg)
         if (!fp) {
                 QEDF_ERR(&(qedf->dbg_ctx),
                     "fc_frame_alloc failure.\n");
-                goto out_free;
+                goto out_put;
         }
 
         /* Copy frame header from firmware into fp */
@@ -884,9 +885,10 @@ static void qedf_rec_compl(struct qedf_els_cb_arg *cb_arg)
 
 out_free_frame:
         fc_frame_free(fp);
-out_free:
+out_put:
         /* Put reference for original command since REC completed */
         kref_put(&orig_io_req->refcount, qedf_release_cmd);
+out_free:
         kfree(cb_arg);
 }
 
diff --git a/drivers/scsi/qedf/qedf_main.c b/drivers/scsi/qedf/qedf_main.c
index 7786c97e033f..1d13c9ca517d 100644
--- a/drivers/scsi/qedf/qedf_main.c
+++ b/drivers/scsi/qedf/qedf_main.c
@@ -2760,11 +2760,9 @@ static int qedf_set_fcoe_pf_param(struct qedf_ctx *qedf)
          * we allocation is the minimum off:
          *
          * Number of CPUs
-         * Number of MSI-X vectors
-         * Max number allocated in hardware (QEDF_MAX_NUM_CQS)
+         * Number allocated by qed for our PCI function
          */
-        qedf->num_queues = min((unsigned int)QEDF_MAX_NUM_CQS,
-            num_online_cpus());
+        qedf->num_queues = MIN_NUM_CPUS_MSIX(qedf);
 
         QEDF_INFO(&(qedf->dbg_ctx), QEDF_LOG_DISC, "Number of CQs is %d.\n",
                    qedf->num_queues);
@@ -2962,6 +2960,13 @@ static int __qedf_probe(struct pci_dev *pdev, int mode)
                 goto err1;
         }
 
+        /* Learn information crucial for qedf to progress */
+        rc = qed_ops->fill_dev_info(qedf->cdev, &qedf->dev_info);
+        if (rc) {
+                QEDF_ERR(&(qedf->dbg_ctx), "Failed to dev info.\n");
+                goto err1;
+        }
+
         /* queue allocation code should come here
          * order should be
          *      slowpath_start
@@ -2977,13 +2982,6 @@ static int __qedf_probe(struct pci_dev *pdev, int mode)
         }
         qed_ops->common->update_pf_params(qedf->cdev, &qedf->pf_params);
 
-        /* Learn information crucial for qedf to progress */
-        rc = qed_ops->fill_dev_info(qedf->cdev, &qedf->dev_info);
-        if (rc) {
-                QEDF_ERR(&(qedf->dbg_ctx), "Failed to dev info.\n");
-                goto err1;
-        }
-
         /* Record BDQ producer doorbell addresses */
         qedf->bdq_primary_prod = qedf->dev_info.primary_dbq_rq_addr;
         qedf->bdq_secondary_prod = qedf->dev_info.secondary_bdq_rq_addr;
diff --git a/drivers/scsi/qedi/Kconfig b/drivers/scsi/qedi/Kconfig
index 21331453db7b..2ff753ce6e27 100644
--- a/drivers/scsi/qedi/Kconfig
+++ b/drivers/scsi/qedi/Kconfig
@@ -5,6 +5,7 @@ config QEDI
         select SCSI_ISCSI_ATTRS
         select QED_LL2
         select QED_ISCSI
+        select ISCSI_BOOT_SYSFS
         ---help---
         This driver supports iSCSI offload for the QLogic FastLinQ
         41000 Series Converged Network Adapters.
diff --git a/drivers/scsi/qedi/qedi_iscsi.c b/drivers/scsi/qedi/qedi_iscsi.c
index 80edd28b635f..37da9a8b43b1 100644
--- a/drivers/scsi/qedi/qedi_iscsi.c
+++ b/drivers/scsi/qedi/qedi_iscsi.c
@@ -824,7 +824,7 @@ qedi_ep_connect(struct Scsi_Host *shost, struct sockaddr *dst_addr,
         u32 iscsi_cid = QEDI_CID_RESERVED;
         u16 len = 0;
         char *buf = NULL;
-        int ret;
+        int ret, tmp;
 
         if (!shost) {
                 ret = -ENXIO;
@@ -940,10 +940,10 @@ qedi_ep_connect(struct Scsi_Host *shost, struct sockaddr *dst_addr,
 
 ep_rel_conn:
         qedi->ep_tbl[iscsi_cid] = NULL;
-        ret = qedi_ops->release_conn(qedi->cdev, qedi_ep->handle);
-        if (ret)
+        tmp = qedi_ops->release_conn(qedi->cdev, qedi_ep->handle);
+        if (tmp)
                 QEDI_WARN(&qedi->dbg_ctx, "release_conn returned %d\n",
-                          ret);
+                          tmp);
 ep_free_sq:
         qedi_free_sq(qedi, qedi_ep);
 ep_conn_exit:
diff --git a/drivers/scsi/qla2xxx/qla_tmpl.c b/drivers/scsi/qla2xxx/qla_tmpl.c
index 33142610882f..b18646d6057f 100644
--- a/drivers/scsi/qla2xxx/qla_tmpl.c
+++ b/drivers/scsi/qla2xxx/qla_tmpl.c
@@ -401,9 +401,6 @@ qla27xx_fwdt_entry_t263(struct scsi_qla_host *vha,
                 for (i = 0; i < vha->hw->max_req_queues; i++) {
                         struct req_que *req = vha->hw->req_q_map[i];
 
-                        if (!test_bit(i, vha->hw->req_qid_map))
-                                continue;
-
                         if (req || !buf) {
                                 length = req ?
                                     req->length : REQUEST_ENTRY_CNT_24XX;
@@ -418,9 +415,6 @@ qla27xx_fwdt_entry_t263(struct scsi_qla_host *vha,
                 for (i = 0; i < vha->hw->max_rsp_queues; i++) {
                         struct rsp_que *rsp = vha->hw->rsp_q_map[i];
 
-                        if (!test_bit(i, vha->hw->rsp_qid_map))
-                                continue;
-
                         if (rsp || !buf) {
                                 length = rsp ?
                                     rsp->length : RESPONSE_ENTRY_CNT_MQ;
@@ -660,9 +654,6 @@ qla27xx_fwdt_entry_t274(struct scsi_qla_host *vha,
                 for (i = 0; i < vha->hw->max_req_queues; i++) {
                         struct req_que *req = vha->hw->req_q_map[i];
 
-                        if (!test_bit(i, vha->hw->req_qid_map))
-                                continue;
-
                         if (req || !buf) {
                                 qla27xx_insert16(i, buf, len);
                                 qla27xx_insert16(1, buf, len);
@@ -675,9 +666,6 @@ qla27xx_fwdt_entry_t274(struct scsi_qla_host *vha,
                 for (i = 0; i < vha->hw->max_rsp_queues; i++) {
                         struct rsp_que *rsp = vha->hw->rsp_q_map[i];
 
-                        if (!test_bit(i, vha->hw->rsp_qid_map))
-                                continue;
-
                         if (rsp || !buf) {
                                 qla27xx_insert16(i, buf, len);
                                 qla27xx_insert16(1, buf, len);
diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.c b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
index b20da0d27ad7..3f82ea1b72dc 100644
--- a/drivers/scsi/qla2xxx/tcm_qla2xxx.c
+++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
@@ -500,7 +500,6 @@ static int tcm_qla2xxx_handle_cmd(scsi_qla_host_t *vha, struct qla_tgt_cmd *cmd,
 static void tcm_qla2xxx_handle_data_work(struct work_struct *work)
 {
         struct qla_tgt_cmd *cmd = container_of(work, struct qla_tgt_cmd, work);
-        unsigned long flags;
 
         /*
          * Ensure that the complete FCP WRITE payload has been received.
@@ -508,17 +507,6 @@ static void tcm_qla2xxx_handle_data_work(struct work_struct *work)
          */
         cmd->cmd_in_wq = 0;
 
-        spin_lock_irqsave(&cmd->cmd_lock, flags);
-        cmd->data_work = 1;
-        if (cmd->aborted) {
-                cmd->data_work_free = 1;
-                spin_unlock_irqrestore(&cmd->cmd_lock, flags);
-
-                tcm_qla2xxx_free_cmd(cmd);
-                return;
-        }
-        spin_unlock_irqrestore(&cmd->cmd_lock, flags);
-
         cmd->qpair->tgt_counters.qla_core_ret_ctio++;
         if (!cmd->write_data_transferred) {
                 /*
@@ -765,31 +753,13 @@ static void tcm_qla2xxx_queue_tm_rsp(struct se_cmd *se_cmd)
         qlt_xmit_tm_rsp(mcmd);
 }
 
-#define DATA_WORK_NOT_FREE(_cmd) (_cmd->data_work && !_cmd->data_work_free)
 static void tcm_qla2xxx_aborted_task(struct se_cmd *se_cmd)
 {
         struct qla_tgt_cmd *cmd = container_of(se_cmd,
                                 struct qla_tgt_cmd, se_cmd);
-        unsigned long flags;
 
         if (qlt_abort_cmd(cmd))
                 return;
-
-        spin_lock_irqsave(&cmd->cmd_lock, flags);
-        if ((cmd->state == QLA_TGT_STATE_NEW)||
-            ((cmd->state == QLA_TGT_STATE_DATA_IN) &&
-                DATA_WORK_NOT_FREE(cmd))) {
-                cmd->data_work_free = 1;
-                spin_unlock_irqrestore(&cmd->cmd_lock, flags);
-                /*
-                 * cmd has not reached fw, Use this trigger to free it.
-                 */
-                tcm_qla2xxx_free_cmd(cmd);
-                return;
-        }
-        spin_unlock_irqrestore(&cmd->cmd_lock, flags);
-        return;
-
 }
 
 static void tcm_qla2xxx_clear_sess_lookup(struct tcm_qla2xxx_lport *,
diff --git a/drivers/scsi/scsi.c b/drivers/scsi/scsi.c
index 3d38c6d463b8..1bf274e3b2b6 100644
--- a/drivers/scsi/scsi.c
+++ b/drivers/scsi/scsi.c
@@ -800,7 +800,11 @@ MODULE_LICENSE("GPL");
 module_param(scsi_logging_level, int, S_IRUGO|S_IWUSR);
 MODULE_PARM_DESC(scsi_logging_level, "a bit mask of logging levels");
 
+#ifdef CONFIG_SCSI_MQ_DEFAULT
 bool scsi_use_blk_mq = true;
+#else
+bool scsi_use_blk_mq = false;
+#endif
 module_param_named(use_blk_mq, scsi_use_blk_mq, bool, S_IWUSR | S_IRUGO);
 
 static int __init init_scsi(void)
diff --git a/drivers/scsi/scsi_transport_fc.c b/drivers/scsi/scsi_transport_fc.c
index 7e24aa30c3b0..892fbd9800d9 100644
--- a/drivers/scsi/scsi_transport_fc.c
+++ b/drivers/scsi/scsi_transport_fc.c
@@ -1286,7 +1286,7 @@ store_fc_vport_delete(struct device *dev, struct device_attribute *attr,
         unsigned long flags;
 
         spin_lock_irqsave(shost->host_lock, flags);
-        if (vport->flags & (FC_VPORT_DEL | FC_VPORT_CREATING)) {
+        if (vport->flags & (FC_VPORT_DEL | FC_VPORT_CREATING | FC_VPORT_DELETING)) {
                 spin_unlock_irqrestore(shost->host_lock, flags);
                 return -EBUSY;
         }
@@ -2430,8 +2430,10 @@ fc_remove_host(struct Scsi_Host *shost)
         spin_lock_irqsave(shost->host_lock, flags);
 
         /* Remove any vports */
-        list_for_each_entry_safe(vport, next_vport, &fc_host->vports, peers)
+        list_for_each_entry_safe(vport, next_vport, &fc_host->vports, peers) {
+                vport->flags |= FC_VPORT_DELETING;
                 fc_queue_work(shost, &vport->vport_delete_work);
+        }
 
         /* Remove any remote ports */
         list_for_each_entry_safe(rport, next_rport,
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index bea36adeee17..e2647f2d4430 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -1277,6 +1277,9 @@ static void sd_uninit_command(struct scsi_cmnd *SCpnt)
 {
         struct request *rq = SCpnt->request;
 
+        if (SCpnt->flags & SCMD_ZONE_WRITE_LOCK)
+                sd_zbc_write_unlock_zone(SCpnt);
+
         if (rq->rq_flags & RQF_SPECIAL_PAYLOAD)
                 __free_page(rq->special_vec.bv_page);
 
diff --git a/drivers/scsi/sd_zbc.c b/drivers/scsi/sd_zbc.c
index 96855df9f49d..8aa54779aac1 100644
--- a/drivers/scsi/sd_zbc.c
+++ b/drivers/scsi/sd_zbc.c
@@ -294,6 +294,9 @@ int sd_zbc_write_lock_zone(struct scsi_cmnd *cmd)
             test_and_set_bit(zno, sdkp->zones_wlock))
                 return BLKPREP_DEFER;
 
+        WARN_ON_ONCE(cmd->flags & SCMD_ZONE_WRITE_LOCK);
+        cmd->flags |= SCMD_ZONE_WRITE_LOCK;
+
         return BLKPREP_OK;
 }
 
@@ -302,9 +305,10 @@ void sd_zbc_write_unlock_zone(struct scsi_cmnd *cmd)
         struct request *rq = cmd->request;
         struct scsi_disk *sdkp = scsi_disk(rq->rq_disk);
 
-        if (sdkp->zones_wlock) {
+        if (sdkp->zones_wlock && cmd->flags & SCMD_ZONE_WRITE_LOCK) {
                 unsigned int zno = sd_zbc_zone_no(sdkp, blk_rq_pos(rq));
                 WARN_ON_ONCE(!test_bit(zno, sdkp->zones_wlock));
+                cmd->flags &= ~SCMD_ZONE_WRITE_LOCK;
                 clear_bit_unlock(zno, sdkp->zones_wlock);
                 smp_mb__after_atomic();
         }
@@ -335,9 +339,6 @@ void sd_zbc_complete(struct scsi_cmnd *cmd,
         case REQ_OP_WRITE_ZEROES:
         case REQ_OP_WRITE_SAME:
 
-                /* Unlock the zone */
-                sd_zbc_write_unlock_zone(cmd);
-
                 if (result &&
                     sshdr->sense_key == ILLEGAL_REQUEST &&
                     sshdr->asc == 0x21)
diff --git a/drivers/scsi/ses.c b/drivers/scsi/ses.c
index f1cdf32d7514..8927f9f54ad9 100644
--- a/drivers/scsi/ses.c
+++ b/drivers/scsi/ses.c
@@ -99,7 +99,7 @@ static int ses_recv_diag(struct scsi_device *sdev, int page_code,
 
         ret =  scsi_execute_req(sdev, cmd, DMA_FROM_DEVICE, buf, bufflen,
                                 NULL, SES_TIMEOUT, SES_RETRIES, NULL);
-        if (unlikely(!ret))
+        if (unlikely(ret))
                 return ret;
 
         recv_page_code = ((unsigned char *)buf)[0];
diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
index 1e82d4128a84..84e782d8e7c3 100644
--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -751,32 +751,6 @@ sg_new_write(Sg_fd *sfp, struct file *file, const char __user *buf,
         return count;
 }
 
-static bool sg_is_valid_dxfer(sg_io_hdr_t *hp)
-{
-        switch (hp->dxfer_direction) {
-        case SG_DXFER_NONE:
-                if (hp->dxferp || hp->dxfer_len > 0)
-                        return false;
-                return true;
-        case SG_DXFER_FROM_DEV:
-                if (hp->dxfer_len < 0)
-                        return false;
-                return true;
-        case SG_DXFER_TO_DEV:
-        case SG_DXFER_TO_FROM_DEV:
-                if (!hp->dxferp || hp->dxfer_len == 0)
-                        return false;
-                return true;
-        case SG_DXFER_UNKNOWN:
-                if ((!hp->dxferp && hp->dxfer_len) ||
-                    (hp->dxferp && hp->dxfer_len == 0))
-                        return false;
-                return true;
-        default:
-                return false;
-        }
-}
-
 static int
 sg_common_write(Sg_fd * sfp, Sg_request * srp,
                 unsigned char *cmnd, int timeout, int blocking)
@@ -797,7 +771,7 @@ sg_common_write(Sg_fd * sfp, Sg_request * srp,
                         "sg_common_write:  scsi opcode=0x%02x, cmd_size=%d\n",
                         (int) cmnd[0], (int) hp->cmd_len));
 
-        if (!sg_is_valid_dxfer(hp))
+        if (hp->dxfer_len >= SZ_256M)
                 return -EINVAL;
 
         k = sg_start_req(srp, cmnd);
@@ -1047,7 +1021,7 @@ sg_ioctl(struct file *filp, unsigned int cmd_in, unsigned long arg)
                         read_lock_irqsave(&sfp->rq_list_lock, iflags);
                         val = 0;
                         list_for_each_entry(srp, &sfp->rq_list, entry) {
-                                if (val > SG_MAX_QUEUE)
+                                if (val >= SG_MAX_QUEUE)
                                         break;
                                 memset(&rinfo[val], 0, SZ_SG_REQ_INFO);
                                 rinfo[val].req_state = srp->done + 1;
diff --git a/drivers/scsi/smartpqi/smartpqi.h b/drivers/scsi/smartpqi/smartpqi.h
index 07ec8a8877de..e164ffade38a 100644
--- a/drivers/scsi/smartpqi/smartpqi.h
+++ b/drivers/scsi/smartpqi/smartpqi.h
@@ -690,7 +690,7 @@ struct pqi_config_table_heartbeat {
 
 #define PQI_MAX_OUTSTANDING_REQUESTS            ((u32)~0)
 #define PQI_MAX_OUTSTANDING_REQUESTS_KDUMP      32
-#define PQI_MAX_TRANSFER_SIZE                   (4 * 1024U * 1024U)
+#define PQI_MAX_TRANSFER_SIZE                   (1024U * 1024U)
 #define PQI_MAX_TRANSFER_SIZE_KDUMP             (512 * 1024U)
 
 #define RAID_MAP_MAX_ENTRIES            1024
diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c
index 8e5013d9cad4..94e402ed30f6 100644
--- a/drivers/scsi/st.c
+++ b/drivers/scsi/st.c
@@ -4299,11 +4299,11 @@ static int st_probe(struct device *dev)
         kref_init(&tpnt->kref);
         tpnt->disk = disk;
         disk->private_data = &tpnt->driver;
-        disk->queue = SDp->request_queue;
         /* SCSI tape doesn't register this gendisk via add_disk().  Manually
          * take queue reference that release_disk() expects. */
-        if (!blk_get_queue(disk->queue))
+        if (!blk_get_queue(SDp->request_queue))
                 goto out_put_disk;
+        disk->queue = SDp->request_queue;
         tpnt->driver = &st_template;
 
         tpnt->device = SDp;
diff --git a/drivers/soc/imx/gpcv2.c b/drivers/soc/imx/gpcv2.c
index 3039072911a5..afc7ecc3c187 100644
--- a/drivers/soc/imx/gpcv2.c
+++ b/drivers/soc/imx/gpcv2.c
@@ -200,16 +200,11 @@ static int imx7_pgc_domain_probe(struct platform_device *pdev)
 
         domain->dev = &pdev->dev;
 
-        ret = pm_genpd_init(&domain->genpd, NULL, true);
-        if (ret) {
-                dev_err(domain->dev, "Failed to init power domain\n");
-                return ret;
-        }
-
         domain->regulator = devm_regulator_get_optional(domain->dev, "power");
         if (IS_ERR(domain->regulator)) {
                 if (PTR_ERR(domain->regulator) != -ENODEV) {
-                        dev_err(domain->dev, "Failed to get domain's regulator\n");
+                        if (PTR_ERR(domain->regulator) != -EPROBE_DEFER)
+                                dev_err(domain->dev, "Failed to get domain's regulator\n");
                         return PTR_ERR(domain->regulator);
                 }
         } else {
@@ -217,6 +212,12 @@ static int imx7_pgc_domain_probe(struct platform_device *pdev)
                                       domain->voltage, domain->voltage);
         }
 
+        ret = pm_genpd_init(&domain->genpd, NULL, true);
+        if (ret) {
+                dev_err(domain->dev, "Failed to init power domain\n");
+                return ret;
+        }
+
         ret = of_genpd_add_provider_simple(domain->dev->of_node,
                                            &domain->genpd);
         if (ret) {
diff --git a/drivers/soc/ti/knav_qmss_queue.c b/drivers/soc/ti/knav_qmss_queue.c
index 279e7c5551dd..39225de9d7f1 100644
--- a/drivers/soc/ti/knav_qmss_queue.c
+++ b/drivers/soc/ti/knav_qmss_queue.c
@@ -745,6 +745,9 @@ void *knav_pool_create(const char *name,
         bool slot_found;
         int ret;
 
+        if (!kdev)
+                return ERR_PTR(-EPROBE_DEFER);
+
         if (!kdev->dev)
                 return ERR_PTR(-ENODEV);
 
diff --git a/drivers/soc/ti/ti_sci_pm_domains.c b/drivers/soc/ti/ti_sci_pm_domains.c
index b0b283810e72..de31b9389e2e 100644
--- a/drivers/soc/ti/ti_sci_pm_domains.c
+++ b/drivers/soc/ti/ti_sci_pm_domains.c
@@ -176,6 +176,8 @@ static int ti_sci_pm_domain_probe(struct platform_device *pdev)
 
         ti_sci_pd->dev = dev;
 
+        ti_sci_pd->pd.name = "ti_sci_pd";
+
         ti_sci_pd->pd.attach_dev = ti_sci_pd_attach_dev;
         ti_sci_pd->pd.detach_dev = ti_sci_pd_detach_dev;
 
diff --git a/drivers/soc/zte/Kconfig b/drivers/soc/zte/Kconfig
index 20bde38ce2f9..e9d750c510cd 100644
--- a/drivers/soc/zte/Kconfig
+++ b/drivers/soc/zte/Kconfig
@@ -2,6 +2,7 @@
 # ZTE SoC drivers
 #
 menuconfig SOC_ZTE
+        depends on ARCH_ZX || COMPILE_TEST
         bool "ZTE SoC driver support"
 
 if SOC_ZTE
diff --git a/drivers/staging/comedi/comedi_fops.c b/drivers/staging/comedi/comedi_fops.c
index ca11be21f64b..34ca7823255d 100644
--- a/drivers/staging/comedi/comedi_fops.c
+++ b/drivers/staging/comedi/comedi_fops.c
@@ -2396,6 +2396,7 @@ static ssize_t comedi_write(struct file *file, const char __user *buf,
                         continue;
                 }
 
+                set_current_state(TASK_RUNNING);
                 wp = async->buf_write_ptr;
                 n1 = min(n, async->prealloc_bufsz - wp);
                 n2 = n - n1;
@@ -2528,6 +2529,8 @@ static ssize_t comedi_read(struct file *file, char __user *buf, size_t nbytes,
                         }
                         continue;
                 }
+
+                set_current_state(TASK_RUNNING);
                 rp = async->buf_read_ptr;
                 n1 = min(n, async->prealloc_bufsz - rp);
                 n2 = n - n1;
diff --git a/drivers/staging/fsl-mc/bus/fsl-mc-allocator.c b/drivers/staging/fsl-mc/bus/fsl-mc-allocator.c
index b37a6f48225f..8ea3920400a0 100644
--- a/drivers/staging/fsl-mc/bus/fsl-mc-allocator.c
+++ b/drivers/staging/fsl-mc/bus/fsl-mc-allocator.c
@@ -16,9 +16,9 @@
 
 static bool __must_check fsl_mc_is_allocatable(const char *obj_type)
 {
-        return strcmp(obj_type, "dpbp") ||
-               strcmp(obj_type, "dpmcp") ||
-               strcmp(obj_type, "dpcon");
+        return strcmp(obj_type, "dpbp") == 0 ||
+               strcmp(obj_type, "dpmcp") == 0 ||
+               strcmp(obj_type, "dpcon") == 0;
 }
 
 /**
diff --git a/drivers/staging/iio/resolver/ad2s1210.c b/drivers/staging/iio/resolver/ad2s1210.c
index a6a8393d6664..3e00df74b18c 100644
--- a/drivers/staging/iio/resolver/ad2s1210.c
+++ b/drivers/staging/iio/resolver/ad2s1210.c
@@ -472,7 +472,7 @@ static int ad2s1210_read_raw(struct iio_dev *indio_dev,
                              long m)
 {
         struct ad2s1210_state *st = iio_priv(indio_dev);
-        bool negative;
+        u16 negative;
         int ret = 0;
         u16 pos;
         s16 vel;
diff --git a/drivers/staging/media/atomisp/i2c/ap1302.h b/drivers/staging/media/atomisp/i2c/ap1302.h
index 9341232c580d..4d0b181a9671 100644
--- a/drivers/staging/media/atomisp/i2c/ap1302.h
+++ b/drivers/staging/media/atomisp/i2c/ap1302.h
@@ -158,8 +158,8 @@ struct ap1302_res_struct {
 };
 
 struct ap1302_context_res {
-        s32 res_num;
-        s32 cur_res;
+        u32 res_num;
+        u32 cur_res;
         struct ap1302_res_struct *res_table;
 };
 
diff --git a/drivers/staging/media/atomisp/i2c/gc0310.h b/drivers/staging/media/atomisp/i2c/gc0310.h
index f31eb277f542..7d8a0aeecb6c 100644
--- a/drivers/staging/media/atomisp/i2c/gc0310.h
+++ b/drivers/staging/media/atomisp/i2c/gc0310.h
@@ -454,6 +454,6 @@ struct gc0310_resolution gc0310_res_video[] = {
 #define N_RES_VIDEO (ARRAY_SIZE(gc0310_res_video))
 
 static struct gc0310_resolution *gc0310_res = gc0310_res_preview;
-static int N_RES = N_RES_PREVIEW;
+static unsigned long N_RES = N_RES_PREVIEW;
 #endif
 
diff --git a/drivers/staging/media/atomisp/i2c/gc2235.h b/drivers/staging/media/atomisp/i2c/gc2235.h
index ccbc757045a5..7c3d994180cc 100644
--- a/drivers/staging/media/atomisp/i2c/gc2235.h
+++ b/drivers/staging/media/atomisp/i2c/gc2235.h
@@ -668,5 +668,5 @@ struct gc2235_resolution gc2235_res_video[] = {
 #define N_RES_VIDEO (ARRAY_SIZE(gc2235_res_video))
 
 static struct gc2235_resolution *gc2235_res = gc2235_res_preview;
-static int N_RES = N_RES_PREVIEW;
+static unsigned long N_RES = N_RES_PREVIEW;
 #endif
diff --git a/drivers/staging/media/atomisp/i2c/imx/imx.h b/drivers/staging/media/atomisp/i2c/imx/imx.h
index 36b3f3a5a41f..41b4133ca995 100644
--- a/drivers/staging/media/atomisp/i2c/imx/imx.h
+++ b/drivers/staging/media/atomisp/i2c/imx/imx.h
@@ -480,7 +480,7 @@ struct imx_device {
         struct imx_vcm *vcm_driver;
         struct imx_otp *otp_driver;
         const struct imx_resolution *curr_res_table;
-        int entries_curr_table;
+        unsigned long entries_curr_table;
         const struct firmware *fw;
         struct imx_reg_addr *reg_addr;
         const struct imx_reg *param_hold;
diff --git a/drivers/staging/media/atomisp/i2c/ov2680.h b/drivers/staging/media/atomisp/i2c/ov2680.h
index 944fe8e3bcbf..ab8907e6c9ef 100644
--- a/drivers/staging/media/atomisp/i2c/ov2680.h
+++ b/drivers/staging/media/atomisp/i2c/ov2680.h
@@ -934,7 +934,6 @@ static struct ov2680_resolution ov2680_res_video[] = {
 #define N_RES_VIDEO (ARRAY_SIZE(ov2680_res_video))
 
 static struct ov2680_resolution *ov2680_res = ov2680_res_preview;
-static int N_RES = N_RES_PREVIEW;
-
+static unsigned long N_RES = N_RES_PREVIEW;
 
 #endif
diff --git a/drivers/staging/media/atomisp/i2c/ov2722.h b/drivers/staging/media/atomisp/i2c/ov2722.h
index b0d40965d89e..73ecb1679718 100644
--- a/drivers/staging/media/atomisp/i2c/ov2722.h
+++ b/drivers/staging/media/atomisp/i2c/ov2722.h
@@ -1263,5 +1263,5 @@ struct ov2722_resolution ov2722_res_video[] = {
 #define N_RES_VIDEO (ARRAY_SIZE(ov2722_res_video))
 
 static struct ov2722_resolution *ov2722_res = ov2722_res_preview;
-static int N_RES = N_RES_PREVIEW;
+static unsigned long N_RES = N_RES_PREVIEW;
 #endif
diff --git a/drivers/staging/media/atomisp/i2c/ov5693/ov5693.h b/drivers/staging/media/atomisp/i2c/ov5693/ov5693.h
index d88ac1777d86..8c2e6794463b 100644
--- a/drivers/staging/media/atomisp/i2c/ov5693/ov5693.h
+++ b/drivers/staging/media/atomisp/i2c/ov5693/ov5693.h
@@ -1377,5 +1377,5 @@ struct ov5693_resolution ov5693_res_video[] = {
 #define N_RES_VIDEO (ARRAY_SIZE(ov5693_res_video))
 
 static struct ov5693_resolution *ov5693_res = ov5693_res_preview;
-static int N_RES = N_RES_PREVIEW;
+static unsigned long N_RES = N_RES_PREVIEW;
 #endif
diff --git a/drivers/staging/media/atomisp/i2c/ov8858.h b/drivers/staging/media/atomisp/i2c/ov8858.h
index 9be6a0e63861..d3fde200c013 100644
--- a/drivers/staging/media/atomisp/i2c/ov8858.h
+++ b/drivers/staging/media/atomisp/i2c/ov8858.h
@@ -266,7 +266,7 @@ struct ov8858_device {
         const struct ov8858_reg *regs;
         struct ov8858_vcm *vcm_driver;
         const struct ov8858_resolution *curr_res_table;
-        int entries_curr_table;
+        unsigned long entries_curr_table;
 
         struct v4l2_ctrl_handler ctrl_handler;
         struct v4l2_ctrl *run_mode;
diff --git a/drivers/staging/media/atomisp/i2c/ov8858_btns.h b/drivers/staging/media/atomisp/i2c/ov8858_btns.h
index 09e3cdc1a394..f9a3cf8fbf1a 100644
--- a/drivers/staging/media/atomisp/i2c/ov8858_btns.h
+++ b/drivers/staging/media/atomisp/i2c/ov8858_btns.h
@@ -266,7 +266,7 @@ struct ov8858_device {
         const struct ov8858_reg *regs;
         struct ov8858_vcm *vcm_driver;
         const struct ov8858_resolution *curr_res_table;
-        int entries_curr_table;
+        unsigned long entries_curr_table;
 
         struct v4l2_ctrl_handler ctrl_handler;
         struct v4l2_ctrl *run_mode;
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/Makefile b/drivers/staging/media/atomisp/pci/atomisp2/Makefile
index 726eaa293c55..2bd98f0667ec 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/Makefile
+++ b/drivers/staging/media/atomisp/pci/atomisp2/Makefile
@@ -354,7 +354,9 @@ ccflags-y += $(INCLUDES) $(DEFINES) -fno-common
 
 # HACK! While this driver is in bad shape, don't enable several warnings
 #       that would be otherwise enabled with W=1
-ccflags-y += -Wno-unused-const-variable -Wno-missing-prototypes \
-             -Wno-unused-but-set-variable -Wno-missing-declarations \
-             -Wno-suggest-attribute=format -Wno-missing-prototypes \
-             -Wno-implicit-fallthrough
+ccflags-y += $(call cc-disable-warning, implicit-fallthrough)
+ccflags-y += $(call cc-disable-warning, missing-prototypes)
+ccflags-y += $(call cc-disable-warning, missing-declarations)
+ccflags-y += $(call cc-disable-warning, suggest-attribute=format)
+ccflags-y += $(call cc-disable-warning, unused-const-variable)
+ccflags-y += $(call cc-disable-warning, unused-but-set-variable)
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/atomisp_internal.h b/drivers/staging/media/atomisp/pci/atomisp2/atomisp_internal.h
index d3667132851b..c8e0c4fe3717 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/atomisp_internal.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/atomisp_internal.h
@@ -275,7 +275,7 @@ struct atomisp_device {
          */
         struct mutex streamoff_mutex;
 
-        int input_cnt;
+        unsigned int input_cnt;
         struct atomisp_input_subdev inputs[ATOM_ISP_MAX_INPUTS];
         struct v4l2_subdev *flash;
         struct v4l2_subdev *motor;
diff --git a/drivers/staging/media/cxd2099/cxd2099.c b/drivers/staging/media/cxd2099/cxd2099.c
index 370ecb959543..f28916ea69f1 100644
--- a/drivers/staging/media/cxd2099/cxd2099.c
+++ b/drivers/staging/media/cxd2099/cxd2099.c
@@ -1,7 +1,7 @@
 /*
  * cxd2099.c: Driver for the CXD2099AR Common Interface Controller
  *
- * Copyright (C) 2010-2011 Digital Devices GmbH
+ * Copyright (C) 2010-2013 Digital Devices GmbH
  *
  *
  * This program is free software; you can redistribute it and/or
@@ -33,7 +33,10 @@
 
 #include "cxd2099.h"
 
-#define MAX_BUFFER_SIZE 248
+/* comment this line to deactivate the cxd2099ar buffer mode */
+#define BUFFER_MODE 1
+
+static int read_data(struct dvb_ca_en50221 *ca, int slot, u8 *ebuf, int ecount);
 
 struct cxd {
         struct dvb_ca_en50221 en;
@@ -48,6 +51,7 @@ struct cxd {
         int    mode;
         int    ready;
         int    dr;
+        int    write_busy;
         int    slot_stat;
 
         u8     amem[1024];
@@ -55,6 +59,9 @@ struct cxd {
 
         int    cammode;
         struct mutex lock;
+
+        u8     rbuf[1028];
+        u8     wbuf[1028];
 };
 
 static int i2c_write_reg(struct i2c_adapter *adapter, u8 adr,
@@ -73,7 +80,7 @@ static int i2c_write_reg(struct i2c_adapter *adapter, u8 adr,
 }
 
 static int i2c_write(struct i2c_adapter *adapter, u8 adr,
-                     u8 *data, u8 len)
+                     u8 *data, u16 len)
 {
         struct i2c_msg msg = {.addr = adr, .flags = 0, .buf = data, .len = len};
 
@@ -100,12 +107,12 @@ static int i2c_read_reg(struct i2c_adapter *adapter, u8 adr,
 }
 
 static int i2c_read(struct i2c_adapter *adapter, u8 adr,
-                    u8 reg, u8 *data, u8 n)
+                    u8 reg, u8 *data, u16 n)
 {
         struct i2c_msg msgs[2] = {{.addr = adr, .flags = 0,
-                                 .buf = &reg, .len = 1},
-                                {.addr = adr, .flags = I2C_M_RD,
-                                 .buf = data, .len = n} };
+                                   .buf = &reg, .len = 1},
+                                  {.addr = adr, .flags = I2C_M_RD,
+                                   .buf = data, .len = n} };
 
         if (i2c_transfer(adapter, msgs, 2) != 2) {
                 dev_err(&adapter->dev, "error in i2c_read\n");
@@ -114,14 +121,26 @@ static int i2c_read(struct i2c_adapter *adapter, u8 adr,
         return 0;
 }
 
-static int read_block(struct cxd *ci, u8 adr, u8 *data, u8 n)
+static int read_block(struct cxd *ci, u8 adr, u8 *data, u16 n)
 {
-        int status;
+        int status = 0;
 
-        status = i2c_write_reg(ci->i2c, ci->cfg.adr, 0, adr);
+        if (ci->lastaddress != adr)
+                status = i2c_write_reg(ci->i2c, ci->cfg.adr, 0, adr);
         if (!status) {
                 ci->lastaddress = adr;
-                status = i2c_read(ci->i2c, ci->cfg.adr, 1, data, n);
+
+                while (n) {
+                        int len = n;
+
+                        if (ci->cfg.max_i2c && (len > ci->cfg.max_i2c))
+                                len = ci->cfg.max_i2c;
+                        status = i2c_read(ci->i2c, ci->cfg.adr, 1, data, len);
+                        if (status)
+                                return status;
+                        data += len;
+                        n -= len;
+                }
         }
         return status;
 }
@@ -182,16 +201,16 @@ static int write_io(struct cxd *ci, u16 address, u8 val)
 
 static int write_regm(struct cxd *ci, u8 reg, u8 val, u8 mask)
 {
-        int status;
+        int status = 0;
 
-        status = i2c_write_reg(ci->i2c, ci->cfg.adr, 0, reg);
+        if (ci->lastaddress != reg)
+                status = i2c_write_reg(ci->i2c, ci->cfg.adr, 0, reg);
         if (!status && reg >= 6 && reg <= 8 && mask != 0xff)
                 status = i2c_read_reg(ci->i2c, ci->cfg.adr, 1, &ci->regs[reg]);
+        ci->lastaddress = reg;
         ci->regs[reg] = (ci->regs[reg] & (~mask)) | val;
-        if (!status) {
-                ci->lastaddress = reg;
+        if (!status)
                 status = i2c_write_reg(ci->i2c, ci->cfg.adr, 1, ci->regs[reg]);
-        }
         if (reg == 0x20)
                 ci->regs[reg] &= 0x7f;
         return status;
@@ -203,16 +222,29 @@ static int write_reg(struct cxd *ci, u8 reg, u8 val)
 }
 
 #ifdef BUFFER_MODE
-static int write_block(struct cxd *ci, u8 adr, u8 *data, int n)
+static int write_block(struct cxd *ci, u8 adr, u8 *data, u16 n)
 {
-        int status;
-        u8 buf[256] = {1};
-
-        status = i2c_write_reg(ci->i2c, ci->cfg.adr, 0, adr);
-        if (!status) {
-                ci->lastaddress = adr;
-                memcpy(buf + 1, data, n);
-                status = i2c_write(ci->i2c, ci->cfg.adr, buf, n + 1);
+        int status = 0;
+        u8 *buf = ci->wbuf;
+
+        if (ci->lastaddress != adr)
+                status = i2c_write_reg(ci->i2c, ci->cfg.adr, 0, adr);
+        if (status)
+                return status;
+
+        ci->lastaddress = adr;
+        buf[0] = 1;
+        while (n) {
+                int len = n;
+
+                if (ci->cfg.max_i2c && (len + 1 > ci->cfg.max_i2c))
+                        len = ci->cfg.max_i2c - 1;
+                memcpy(buf + 1, data, len);
+                status = i2c_write(ci->i2c, ci->cfg.adr, buf, len + 1);
+                if (status)
+                        return status;
+                n -= len;
+                data += len;
         }
         return status;
 }
@@ -238,6 +270,8 @@ static void set_mode(struct cxd *ci, int mode)
 
 static void cam_mode(struct cxd *ci, int mode)
 {
+        u8 dummy;
+
         if (mode == ci->cammode)
                 return;
 
@@ -246,16 +280,15 @@ static void cam_mode(struct cxd *ci, int mode)
                 write_regm(ci, 0x20, 0x80, 0x80);
                 break;
         case 0x01:
-#ifdef BUFFER_MODE
                 if (!ci->en.read_data)
                         return;
+                ci->write_busy = 0;
                 dev_info(&ci->i2c->dev, "enable cam buffer mode\n");
-                /* write_reg(ci, 0x0d, 0x00); */
-                /* write_reg(ci, 0x0e, 0x01); */
+                write_reg(ci, 0x0d, 0x00);
+                write_reg(ci, 0x0e, 0x01);
                 write_regm(ci, 0x08, 0x40, 0x40);
-                /* read_reg(ci, 0x12, &dummy); */
+                read_reg(ci, 0x12, &dummy);
                 write_regm(ci, 0x08, 0x80, 0x80);
-#endif
                 break;
         default:
                 break;
@@ -325,7 +358,10 @@ static int init(struct cxd *ci)
                 if (status < 0)
                         break;
 
-                if (ci->cfg.clock_mode) {
+                if (ci->cfg.clock_mode == 2) {
+                        /* bitrate*2^13/ 72000 */
+                        u32 reg = ((ci->cfg.bitrate << 13) + 71999) / 72000;
+
                         if (ci->cfg.polarity) {
                                 status = write_reg(ci, 0x09, 0x6f);
                                 if (status < 0)
@@ -335,6 +371,25 @@ static int init(struct cxd *ci)
                                 if (status < 0)
                                         break;
                         }
+                        status = write_reg(ci, 0x20, 0x08);
+                        if (status < 0)
+                                break;
+                        status = write_reg(ci, 0x21, (reg >> 8) & 0xff);
+                        if (status < 0)
+                                break;
+                        status = write_reg(ci, 0x22, reg & 0xff);
+                        if (status < 0)
+                                break;
+                } else if (ci->cfg.clock_mode == 1) {
+                        if (ci->cfg.polarity) {
+                                status = write_reg(ci, 0x09, 0x6f); /* D */
+                                if (status < 0)
+                                        break;
+                        } else {
+                                status = write_reg(ci, 0x09, 0x6d);
+                                if (status < 0)
+                                        break;
+                        }
                         status = write_reg(ci, 0x20, 0x68);
                         if (status < 0)
                                 break;
@@ -346,7 +401,7 @@ static int init(struct cxd *ci)
                                 break;
                 } else {
                         if (ci->cfg.polarity) {
-                                status = write_reg(ci, 0x09, 0x4f);
+                                status = write_reg(ci, 0x09, 0x4f); /* C */
                                 if (status < 0)
                                         break;
                         } else {
@@ -354,7 +409,6 @@ static int init(struct cxd *ci)
                                 if (status < 0)
                                         break;
                         }
-
                         status = write_reg(ci, 0x20, 0x28);
                         if (status < 0)
                                 break;
@@ -401,7 +455,6 @@ static int read_attribute_mem(struct dvb_ca_en50221 *ca,
         set_mode(ci, 1);
         read_pccard(ci, address, &val, 1);
         mutex_unlock(&ci->lock);
-        /* printk(KERN_INFO "%02x:%02x\n", address,val); */
         return val;
 }
 
@@ -446,6 +499,9 @@ static int slot_reset(struct dvb_ca_en50221 *ca, int slot)
 {
         struct cxd *ci = ca->data;
 
+        if (ci->cammode)
+                read_data(ca, slot, ci->rbuf, 0);
+
         mutex_lock(&ci->lock);
         cam_mode(ci, 0);
         write_reg(ci, 0x00, 0x21);
@@ -465,7 +521,6 @@ static int slot_reset(struct dvb_ca_en50221 *ca, int slot)
                 }
         }
         mutex_unlock(&ci->lock);
-        /* msleep(500); */
         return 0;
 }
 
@@ -474,11 +529,19 @@ static int slot_shutdown(struct dvb_ca_en50221 *ca, int slot)
         struct cxd *ci = ca->data;
 
         dev_info(&ci->i2c->dev, "%s\n", __func__);
+        if (ci->cammode)
+                read_data(ca, slot, ci->rbuf, 0);
         mutex_lock(&ci->lock);
+        write_reg(ci, 0x00, 0x21);
+        write_reg(ci, 0x06, 0x1F);
+        msleep(300);
+
         write_regm(ci, 0x09, 0x08, 0x08);
         write_regm(ci, 0x20, 0x80, 0x80); /* Reset CAM Mode */
         write_regm(ci, 0x06, 0x07, 0x07); /* Clear IO Mode */
+
         ci->mode = -1;
+        ci->write_busy = 0;
         mutex_unlock(&ci->lock);
         return 0;
 }
@@ -490,9 +553,7 @@ static int slot_ts_enable(struct dvb_ca_en50221 *ca, int slot)
         mutex_lock(&ci->lock);
         write_regm(ci, 0x09, 0x00, 0x08);
         set_mode(ci, 0);
-#ifdef BUFFER_MODE
         cam_mode(ci, 1);
-#endif
         mutex_unlock(&ci->lock);
         return 0;
 }
@@ -506,12 +567,10 @@ static int campoll(struct cxd *ci)
                 return 0;
         write_reg(ci, 0x05, istat);
 
-        if (istat & 0x40) {
+        if (istat & 0x40)
                 ci->dr = 1;
-                dev_info(&ci->i2c->dev, "DR\n");
-        }
         if (istat & 0x20)
-                dev_info(&ci->i2c->dev, "WC\n");
+                ci->write_busy = 0;
 
         if (istat & 2) {
                 u8 slotstat;
@@ -519,7 +578,8 @@ static int campoll(struct cxd *ci)
                 read_reg(ci, 0x01, &slotstat);
                 if (!(2 & slotstat)) {
                         if (!ci->slot_stat) {
-                                ci->slot_stat = DVB_CA_EN50221_POLL_CAM_PRESENT;
+                                ci->slot_stat |=
+                                              DVB_CA_EN50221_POLL_CAM_PRESENT;
                                 write_regm(ci, 0x03, 0x08, 0x08);
                         }
 
@@ -531,8 +591,8 @@ static int campoll(struct cxd *ci)
                                 ci->ready = 0;
                         }
                 }
-                if (istat & 8 &&
-                    ci->slot_stat == DVB_CA_EN50221_POLL_CAM_PRESENT) {
+                if ((istat & 8) &&
+                    (ci->slot_stat == DVB_CA_EN50221_POLL_CAM_PRESENT)) {
                         ci->ready = 1;
                         ci->slot_stat |= DVB_CA_EN50221_POLL_CAM_READY;
                 }
@@ -553,7 +613,6 @@ static int poll_slot_status(struct dvb_ca_en50221 *ca, int slot, int open)
         return ci->slot_stat;
 }
 
-#ifdef BUFFER_MODE
 static int read_data(struct dvb_ca_en50221 *ca, int slot, u8 *ebuf, int ecount)
 {
         struct cxd *ci = ca->data;
@@ -564,30 +623,38 @@ static int read_data(struct dvb_ca_en50221 *ca, int slot, u8 *ebuf, int ecount)
         campoll(ci);
         mutex_unlock(&ci->lock);
 
-        dev_info(&ci->i2c->dev, "%s\n", __func__);
         if (!ci->dr)
                 return 0;
 
         mutex_lock(&ci->lock);
         read_reg(ci, 0x0f, &msb);
         read_reg(ci, 0x10, &lsb);
-        len = (msb << 8) | lsb;
+        len = ((u16)msb << 8) | lsb;
+        if (len > ecount || len < 2) {
+                /* read it anyway or cxd may hang */
+                read_block(ci, 0x12, ci->rbuf, len);
+                mutex_unlock(&ci->lock);
+                return -EIO;
+        }
         read_block(ci, 0x12, ebuf, len);
         ci->dr = 0;
         mutex_unlock(&ci->lock);
-
         return len;
 }
 
+#ifdef BUFFER_MODE
+
 static int write_data(struct dvb_ca_en50221 *ca, int slot, u8 *ebuf, int ecount)
 {
         struct cxd *ci = ca->data;
 
+        if (ci->write_busy)
+                return -EAGAIN;
         mutex_lock(&ci->lock);
-        dev_info(&ci->i2c->dev, "%s %d\n", __func__, ecount);
         write_reg(ci, 0x0d, ecount >> 8);
         write_reg(ci, 0x0e, ecount & 0xff);
         write_block(ci, 0x11, ebuf, ecount);
+        ci->write_busy = 1;
         mutex_unlock(&ci->lock);
         return ecount;
 }
diff --git a/drivers/staging/media/cxd2099/cxd2099.h b/drivers/staging/media/cxd2099/cxd2099.h
index 0eb607c5b423..f4b29b1d6eb8 100644
--- a/drivers/staging/media/cxd2099/cxd2099.h
+++ b/drivers/staging/media/cxd2099/cxd2099.h
@@ -30,8 +30,10 @@
 struct cxd2099_cfg {
         u32 bitrate;
         u8  adr;
-        u8  polarity:1;
-        u8  clock_mode:1;
+        u8  polarity;
+        u8  clock_mode;
+
+        u32 max_i2c;
 };
 
 #if defined(CONFIG_DVB_CXD2099) || \
diff --git a/drivers/staging/rtl8188eu/os_dep/usb_intf.c b/drivers/staging/rtl8188eu/os_dep/usb_intf.c
index d283341cfe43..56cd4e5e51b2 100644
--- a/drivers/staging/rtl8188eu/os_dep/usb_intf.c
+++ b/drivers/staging/rtl8188eu/os_dep/usb_intf.c
@@ -45,6 +45,7 @@ static struct usb_device_id rtw_usb_id_tbl[] = {
         {USB_DEVICE(0x2001, 0x3311)}, /* DLink GO-USB-N150 REV B1 */
         {USB_DEVICE(0x2357, 0x010c)}, /* TP-Link TL-WN722N v2 */
         {USB_DEVICE(0x0df6, 0x0076)}, /* Sitecom N150 v2 */
+        {USB_DEVICE(USB_VENDER_ID_REALTEK, 0xffef)}, /* Rosewill RNX-N150NUB */
         {}      /* Terminating entry */
 };
 
diff --git a/drivers/target/iscsi/cxgbit/cxgbit_cm.c b/drivers/target/iscsi/cxgbit/cxgbit_cm.c
index e583dd8a418b..d4fa41be80f9 100644
--- a/drivers/target/iscsi/cxgbit/cxgbit_cm.c
+++ b/drivers/target/iscsi/cxgbit/cxgbit_cm.c
@@ -1510,11 +1510,13 @@ cxgbit_pass_open_rpl(struct cxgbit_device *cdev, struct sk_buff *skb)
 
         if (!cnp) {
                 pr_info("%s stid %d lookup failure\n", __func__, stid);
-                return;
+                goto rel_skb;
         }
 
         cxgbit_wake_up(&cnp->com.wr_wait, __func__, rpl->status);
         cxgbit_put_cnp(cnp);
+rel_skb:
+        __kfree_skb(skb);
 }
 
 static void
@@ -1530,11 +1532,13 @@ cxgbit_close_listsrv_rpl(struct cxgbit_device *cdev, struct sk_buff *skb)
 
         if (!cnp) {
                 pr_info("%s stid %d lookup failure\n", __func__, stid);
-                return;
+                goto rel_skb;
         }
 
         cxgbit_wake_up(&cnp->com.wr_wait, __func__, rpl->status);
         cxgbit_put_cnp(cnp);
+rel_skb:
+        __kfree_skb(skb);
 }
 
 static void
@@ -1819,12 +1823,16 @@ static void cxgbit_set_tcb_rpl(struct cxgbit_device *cdev, struct sk_buff *skb)
         struct tid_info *t = lldi->tids;
 
         csk = lookup_tid(t, tid);
-        if (unlikely(!csk))
+        if (unlikely(!csk)) {
                 pr_err("can't find connection for tid %u.\n", tid);
-        else
+                goto rel_skb;
+        } else {
                 cxgbit_wake_up(&csk->com.wr_wait, __func__, rpl->status);
+        }
 
         cxgbit_put_csk(csk);
+rel_skb:
+        __kfree_skb(skb);
 }
 
 static void cxgbit_rx_data(struct cxgbit_device *cdev, struct sk_buff *skb)
diff --git a/drivers/target/iscsi/cxgbit/cxgbit_target.c b/drivers/target/iscsi/cxgbit/cxgbit_target.c
index dda13f1af38e..514986b57c2d 100644
--- a/drivers/target/iscsi/cxgbit/cxgbit_target.c
+++ b/drivers/target/iscsi/cxgbit/cxgbit_target.c
@@ -827,7 +827,7 @@ cxgbit_put_login_tx(struct iscsi_conn *conn, struct iscsi_login *login,
 
 static void
 cxgbit_skb_copy_to_sg(struct sk_buff *skb, struct scatterlist *sg,
-                      unsigned int nents)
+                      unsigned int nents, u32 skip)
 {
         struct skb_seq_state st;
         const u8 *buf;
@@ -846,7 +846,7 @@ cxgbit_skb_copy_to_sg(struct sk_buff *skb, struct scatterlist *sg,
                 }
 
                 consumed += sg_pcopy_from_buffer(sg, nents, (void *)buf,
-                                                 buf_len, consumed);
+                                                 buf_len, skip + consumed);
         }
 }
 
@@ -912,7 +912,7 @@ cxgbit_handle_immediate_data(struct iscsi_cmd *cmd, struct iscsi_scsi_req *hdr,
                 struct scatterlist *sg = &cmd->se_cmd.t_data_sg[0];
                 u32 sg_nents = max(1UL, DIV_ROUND_UP(pdu_cb->dlen, PAGE_SIZE));
 
-                cxgbit_skb_copy_to_sg(csk->skb, sg, sg_nents);
+                cxgbit_skb_copy_to_sg(csk->skb, sg, sg_nents, 0);
         }
 
         cmd->write_data_done += pdu_cb->dlen;
@@ -1069,11 +1069,13 @@ static int cxgbit_handle_iscsi_dataout(struct cxgbit_sock *csk)
                   cmd->se_cmd.data_length);
 
         if (!(pdu_cb->flags & PDUCBF_RX_DATA_DDPD)) {
+                u32 skip = data_offset % PAGE_SIZE;
+
                 sg_off = data_offset / PAGE_SIZE;
                 sg_start = &cmd->se_cmd.t_data_sg[sg_off];
-                sg_nents = max(1UL, DIV_ROUND_UP(data_len, PAGE_SIZE));
+                sg_nents = max(1UL, DIV_ROUND_UP(skip + data_len, PAGE_SIZE));
 
-                cxgbit_skb_copy_to_sg(csk->skb, sg_start, sg_nents);
+                cxgbit_skb_copy_to_sg(csk->skb, sg_start, sg_nents, skip);
         }
 
 check_payload:
diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
index 74e4975dd1b1..5001261f5d69 100644
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -418,6 +418,7 @@ int iscsit_reset_np_thread(
                 return 0;
         }
         np->np_thread_state = ISCSI_NP_THREAD_RESET;
+        atomic_inc(&np->np_reset_count);
 
         if (np->np_thread) {
                 spin_unlock_bh(&np->np_thread_lock);
@@ -2167,6 +2168,7 @@ iscsit_setup_text_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
         cmd->cmd_sn             = be32_to_cpu(hdr->cmdsn);
         cmd->exp_stat_sn        = be32_to_cpu(hdr->exp_statsn);
         cmd->data_direction     = DMA_NONE;
+        kfree(cmd->text_in_ptr);
         cmd->text_in_ptr        = NULL;
 
         return 0;
@@ -3487,9 +3489,9 @@ iscsit_build_text_rsp(struct iscsi_cmd *cmd, struct iscsi_conn *conn,
                 return text_length;
 
         if (completed) {
-                hdr->flags |= ISCSI_FLAG_CMD_FINAL;
+                hdr->flags = ISCSI_FLAG_CMD_FINAL;
         } else {
-                hdr->flags |= ISCSI_FLAG_TEXT_CONTINUE;
+                hdr->flags = ISCSI_FLAG_TEXT_CONTINUE;
                 cmd->read_data_done += text_length;
                 if (cmd->targ_xfer_tag == 0xFFFFFFFF)
                         cmd->targ_xfer_tag = session_get_next_ttt(conn->sess);
diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c
index e9bdc8b86e7d..dc13afbd4c88 100644
--- a/drivers/target/iscsi/iscsi_target_login.c
+++ b/drivers/target/iscsi/iscsi_target_login.c
@@ -1243,9 +1243,11 @@ static int __iscsi_target_login_thread(struct iscsi_np *np)
         flush_signals(current);
 
         spin_lock_bh(&np->np_thread_lock);
-        if (np->np_thread_state == ISCSI_NP_THREAD_RESET) {
+        if (atomic_dec_if_positive(&np->np_reset_count) >= 0) {
                 np->np_thread_state = ISCSI_NP_THREAD_ACTIVE;
+                spin_unlock_bh(&np->np_thread_lock);
                 complete(&np->np_restart_comp);
+                return 1;
         } else if (np->np_thread_state == ISCSI_NP_THREAD_SHUTDOWN) {
                 spin_unlock_bh(&np->np_thread_lock);
                 goto exit;
@@ -1278,7 +1280,8 @@ static int __iscsi_target_login_thread(struct iscsi_np *np)
                 goto exit;
         } else if (rc < 0) {
                 spin_lock_bh(&np->np_thread_lock);
-                if (np->np_thread_state == ISCSI_NP_THREAD_RESET) {
+                if (atomic_dec_if_positive(&np->np_reset_count) >= 0) {
+                        np->np_thread_state = ISCSI_NP_THREAD_ACTIVE;
                         spin_unlock_bh(&np->np_thread_lock);
                         complete(&np->np_restart_comp);
                         iscsit_put_transport(conn->conn_transport);
diff --git a/drivers/target/target_core_tpg.c b/drivers/target/target_core_tpg.c
index 36913734c6bc..02e8a5d86658 100644
--- a/drivers/target/target_core_tpg.c
+++ b/drivers/target/target_core_tpg.c
@@ -364,7 +364,7 @@ void core_tpg_del_initiator_node_acl(struct se_node_acl *acl)
         mutex_lock(&tpg->acl_node_mutex);
         if (acl->dynamic_node_acl)
                 acl->dynamic_node_acl = 0;
-        list_del(&acl->acl_list);
+        list_del_init(&acl->acl_list);
         mutex_unlock(&tpg->acl_node_mutex);
 
         target_shutdown_sessions(acl);
@@ -548,7 +548,7 @@ int core_tpg_deregister(struct se_portal_group *se_tpg)
          * in transport_deregister_session().
          */
         list_for_each_entry_safe(nacl, nacl_tmp, &node_list, acl_list) {
-                list_del(&nacl->acl_list);
+                list_del_init(&nacl->acl_list);
 
                 core_tpg_wait_for_nacl_pr_ref(nacl);
                 core_free_device_list_for_node(nacl, se_tpg);
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index 97fed9a298bd..836d552b0385 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -466,7 +466,7 @@ static void target_complete_nacl(struct kref *kref)
         }
 
         mutex_lock(&se_tpg->acl_node_mutex);
-        list_del(&nacl->acl_list);
+        list_del_init(&nacl->acl_list);
         mutex_unlock(&se_tpg->acl_node_mutex);
 
         core_tpg_wait_for_nacl_pr_ref(nacl);
@@ -538,7 +538,7 @@ void transport_free_session(struct se_session *se_sess)
                         spin_unlock_irqrestore(&se_nacl->nacl_sess_lock, flags);
 
                         if (se_nacl->dynamic_stop)
-                                list_del(&se_nacl->acl_list);
+                                list_del_init(&se_nacl->acl_list);
                 }
                 mutex_unlock(&se_tpg->acl_node_mutex);
 
diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c
index 80ee130f8253..942d094269fb 100644
--- a/drivers/target/target_core_user.c
+++ b/drivers/target/target_core_user.c
@@ -563,8 +563,6 @@ static int scatter_data_area(struct tcmu_dev *udev,
                                         block_remaining);
                         to_offset = get_block_offset_user(udev, dbi,
                                         block_remaining);
-                        offset = DATA_BLOCK_SIZE - block_remaining;
-                        to += offset;
 
                         if (*iov_cnt != 0 &&
                             to_offset == iov_tail(*iov)) {
@@ -575,8 +573,10 @@ static int scatter_data_area(struct tcmu_dev *udev,
                                 (*iov)->iov_len = copy_bytes;
                         }
                         if (copy_data) {
-                                memcpy(to, from + sg->length - sg_remaining,
-                                        copy_bytes);
+                                offset = DATA_BLOCK_SIZE - block_remaining;
+                                memcpy(to + offset,
+                                       from + sg->length - sg_remaining,
+                                       copy_bytes);
                                 tcmu_flush_dcache_range(to, copy_bytes);
                         }
                         sg_remaining -= copy_bytes;
@@ -637,9 +637,8 @@ static void gather_data_area(struct tcmu_dev *udev, struct tcmu_cmd *cmd,
                         copy_bytes = min_t(size_t, sg_remaining,
                                         block_remaining);
                         offset = DATA_BLOCK_SIZE - block_remaining;
-                        from += offset;
                         tcmu_flush_dcache_range(from, copy_bytes);
-                        memcpy(to + sg->length - sg_remaining, from,
+                        memcpy(to + sg->length - sg_remaining, from + offset,
                                         copy_bytes);
 
                         sg_remaining -= copy_bytes;
@@ -1433,6 +1432,8 @@ static int tcmu_update_uio_info(struct tcmu_dev *udev)
         if (udev->dev_config[0])
                 snprintf(str + used, size - used, "/%s", udev->dev_config);
 
+        /* If the old string exists, free it */
+        kfree(info->name);
         info->name = str;
 
         return 0;
diff --git a/drivers/thunderbolt/eeprom.c b/drivers/thunderbolt/eeprom.c
index 308b6e17c88a..fe2f00ceafc5 100644
--- a/drivers/thunderbolt/eeprom.c
+++ b/drivers/thunderbolt/eeprom.c
@@ -333,6 +333,15 @@ static int tb_drom_parse_entry_port(struct tb_switch *sw,
         int res;
         enum tb_port_type type;
 
+        /*
+         * Some DROMs list more ports than the controller actually has
+         * so we skip those but allow the parser to continue.
+         */
+        if (header->index > sw->config.max_port_number) {
+                dev_info_once(&sw->dev, "ignoring unnecessary extra entries in DROM\n");
+                return 0;
+        }
+
         port = &sw->ports[header->index];
         port->disabled = header->port_disabled;
         if (port->disabled)
diff --git a/drivers/thunderbolt/icm.c b/drivers/thunderbolt/icm.c
index 8ee340290219..bdaac1ff00a5 100644
--- a/drivers/thunderbolt/icm.c
+++ b/drivers/thunderbolt/icm.c
@@ -904,7 +904,14 @@ static int icm_driver_ready(struct tb *tb)
 
 static int icm_suspend(struct tb *tb)
 {
-        return nhi_mailbox_cmd(tb->nhi, NHI_MAILBOX_SAVE_DEVS, 0);
+        int ret;
+
+        ret = nhi_mailbox_cmd(tb->nhi, NHI_MAILBOX_SAVE_DEVS, 0);
+        if (ret)
+                tb_info(tb, "Ignoring mailbox command error (%d) in %s\n",
+                        ret, __func__);
+
+        return 0;
 }
 
 /*
diff --git a/drivers/thunderbolt/switch.c b/drivers/thunderbolt/switch.c
index 40219a706309..e9391bbd4036 100644
--- a/drivers/thunderbolt/switch.c
+++ b/drivers/thunderbolt/switch.c
@@ -30,7 +30,7 @@ static DEFINE_IDA(nvm_ida);
 
 struct nvm_auth_status {
         struct list_head list;
-        uuid_be uuid;
+        uuid_t uuid;
         u32 status;
 };
 
@@ -47,7 +47,7 @@ static struct nvm_auth_status *__nvm_get_auth_status(const struct tb_switch *sw)
         struct nvm_auth_status *st;
 
         list_for_each_entry(st, &nvm_auth_status_cache, list) {
-                if (!uuid_be_cmp(st->uuid, *sw->uuid))
+                if (uuid_equal(&st->uuid, sw->uuid))
                         return st;
         }
 
@@ -1461,7 +1461,7 @@ struct tb_sw_lookup {
         struct tb *tb;
         u8 link;
         u8 depth;
-        const uuid_be *uuid;
+        const uuid_t *uuid;
 };
 
 static int tb_switch_match(struct device *dev, void *data)
@@ -1518,7 +1518,7 @@ struct tb_switch *tb_switch_find_by_link_depth(struct tb *tb, u8 link, u8 depth)
  * Returned switch has reference count increased so the caller needs to
  * call tb_switch_put() when done with the switch.
  */
-struct tb_switch *tb_switch_find_by_uuid(struct tb *tb, const uuid_be *uuid)
+struct tb_switch *tb_switch_find_by_uuid(struct tb *tb, const uuid_t *uuid)
 {
         struct tb_sw_lookup lookup;
         struct device *dev;
diff --git a/drivers/thunderbolt/tb.h b/drivers/thunderbolt/tb.h
index 3d9f64676e58..e0deee4f1eb0 100644
--- a/drivers/thunderbolt/tb.h
+++ b/drivers/thunderbolt/tb.h
@@ -101,7 +101,7 @@ struct tb_switch {
         struct tb_dma_port *dma_port;
         struct tb *tb;
         u64 uid;
-        uuid_be *uuid;
+        uuid_t *uuid;
         u16 vendor;
         u16 device;
         const char *vendor_name;
@@ -407,7 +407,7 @@ void tb_sw_set_unplugged(struct tb_switch *sw);
 struct tb_switch *get_switch_at_route(struct tb_switch *sw, u64 route);
 struct tb_switch *tb_switch_find_by_link_depth(struct tb *tb, u8 link,
                                                u8 depth);
-struct tb_switch *tb_switch_find_by_uuid(struct tb *tb, const uuid_be *uuid);
+struct tb_switch *tb_switch_find_by_uuid(struct tb *tb, const uuid_t *uuid);
 
 static inline unsigned int tb_switch_phy_port_from_link(unsigned int link)
 {
diff --git a/drivers/thunderbolt/tb_msgs.h b/drivers/thunderbolt/tb_msgs.h
index 85b6d33c0919..de6441e4a060 100644
--- a/drivers/thunderbolt/tb_msgs.h
+++ b/drivers/thunderbolt/tb_msgs.h
@@ -179,7 +179,7 @@ struct icm_fr_pkg_get_topology_response {
 
 struct icm_fr_event_device_connected {
         struct icm_pkg_header hdr;
-        uuid_be ep_uuid;
+        uuid_t ep_uuid;
         u8 connection_key;
         u8 connection_id;
         u16 link_info;
@@ -193,7 +193,7 @@ struct icm_fr_event_device_connected {
 
 struct icm_fr_pkg_approve_device {
         struct icm_pkg_header hdr;
-        uuid_be ep_uuid;
+        uuid_t ep_uuid;
         u8 connection_key;
         u8 connection_id;
         u16 reserved;
@@ -207,7 +207,7 @@ struct icm_fr_event_device_disconnected {
 
 struct icm_fr_pkg_add_device_key {
         struct icm_pkg_header hdr;
-        uuid_be ep_uuid;
+        uuid_t ep_uuid;
         u8 connection_key;
         u8 connection_id;
         u16 reserved;
@@ -216,7 +216,7 @@ struct icm_fr_pkg_add_device_key {
 
 struct icm_fr_pkg_add_device_key_response {
         struct icm_pkg_header hdr;
-        uuid_be ep_uuid;
+        uuid_t ep_uuid;
         u8 connection_key;
         u8 connection_id;
         u16 reserved;
@@ -224,7 +224,7 @@ struct icm_fr_pkg_add_device_key_response {
 
 struct icm_fr_pkg_challenge_device {
         struct icm_pkg_header hdr;
-        uuid_be ep_uuid;
+        uuid_t ep_uuid;
         u8 connection_key;
         u8 connection_id;
         u16 reserved;
@@ -233,7 +233,7 @@ struct icm_fr_pkg_challenge_device {
 
 struct icm_fr_pkg_challenge_device_response {
         struct icm_pkg_header hdr;
-        uuid_be ep_uuid;
+        uuid_t ep_uuid;
         u8 connection_key;
         u8 connection_id;
         u16 reserved;
diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c
index 284749fb0f6b..a6d5164c33a9 100644
--- a/drivers/tty/pty.c
+++ b/drivers/tty/pty.c
@@ -69,13 +69,8 @@ static void pty_close(struct tty_struct *tty, struct file *filp)
 #ifdef CONFIG_UNIX98_PTYS
                 if (tty->driver == ptm_driver) {
                         mutex_lock(&devpts_mutex);
-                        if (tty->link->driver_data) {
-                                struct path *path = tty->link->driver_data;
-
-                                devpts_pty_kill(path->dentry);
-                                path_put(path);
-                                kfree(path);
-                        }
+                        if (tty->link->driver_data)
+                                devpts_pty_kill(tty->link->driver_data);
                         mutex_unlock(&devpts_mutex);
                 }
 #endif
@@ -607,25 +602,24 @@ static inline void legacy_pty_init(void) { }
 static struct cdev ptmx_cdev;
 
 /**
- *      pty_open_peer - open the peer of a pty
- *      @tty: the peer of the pty being opened
+ *      ptm_open_peer - open the peer of a pty
+ *      @master: the open struct file of the ptmx device node
+ *      @tty: the master of the pty being opened
+ *      @flags: the flags for open
  *
- *      Open the cached dentry in tty->link, providing a safe way for userspace
- *      to get the slave end of a pty (where they have the master fd and cannot
- *      access or trust the mount namespace /dev/pts was mounted inside).
+ *      Provide a race free way for userspace to open the slave end of a pty
+ *      (where they have the master fd and cannot access or trust the mount
+ *      namespace /dev/pts was mounted inside).
  */
-static struct file *pty_open_peer(struct tty_struct *tty, int flags)
-{
-        if (tty->driver->subtype != PTY_TYPE_MASTER)
-                return ERR_PTR(-EIO);
-        return dentry_open(tty->link->driver_data, flags, current_cred());
-}
-
-static int pty_get_peer(struct tty_struct *tty, int flags)
+int ptm_open_peer(struct file *master, struct tty_struct *tty, int flags)
 {
         int fd = -1;
-        struct file *filp = NULL;
+        struct file *filp;
         int retval = -EINVAL;
+        struct path path;
+
+        if (tty->driver != ptm_driver)
+                return -EIO;
 
         fd = get_unused_fd_flags(0);
         if (fd < 0) {
@@ -633,7 +627,16 @@ static int pty_get_peer(struct tty_struct *tty, int flags)
                 goto err;
         }
 
-        filp = pty_open_peer(tty, flags);
+        /* Compute the slave's path */
+        path.mnt = devpts_mntget(master, tty->driver_data);
+        if (IS_ERR(path.mnt)) {
+                retval = PTR_ERR(path.mnt);
+                goto err_put;
+        }
+        path.dentry = tty->link->driver_data;
+
+        filp = dentry_open(&path, flags, current_cred());
+        mntput(path.mnt);
         if (IS_ERR(filp)) {
                 retval = PTR_ERR(filp);
                 goto err_put;
@@ -662,8 +665,6 @@ static int pty_unix98_ioctl(struct tty_struct *tty,
                 return pty_get_pktmode(tty, (int __user *)arg);
         case TIOCGPTN: /* Get PT Number */
                 return put_user(tty->index, (unsigned int __user *)arg);
-        case TIOCGPTPEER: /* Open the other end */
-                return pty_get_peer(tty, (int) arg);
         case TIOCSIG:    /* Send signal to other side of pty */
                 return pty_signal(tty, (int) arg);
         }
@@ -791,7 +792,6 @@ static int ptmx_open(struct inode *inode, struct file *filp)
 {
         struct pts_fs_info *fsi;
         struct tty_struct *tty;
-        struct path *pts_path;
         struct dentry *dentry;
         int retval;
         int index;
@@ -845,26 +845,16 @@ static int ptmx_open(struct inode *inode, struct file *filp)
                 retval = PTR_ERR(dentry);
                 goto err_release;
         }
-        /* We need to cache a fake path for TIOCGPTPEER. */
-        pts_path = kmalloc(sizeof(struct path), GFP_KERNEL);
-        if (!pts_path)
-                goto err_release;
-        pts_path->mnt = filp->f_path.mnt;
-        pts_path->dentry = dentry;
-        path_get(pts_path);
-        tty->link->driver_data = pts_path;
+        tty->link->driver_data = dentry;
 
         retval = ptm_driver->ops->open(tty, filp);
         if (retval)
-                goto err_path_put;
+                goto err_release;
 
         tty_debug_hangup(tty, "opening (count=%d)\n", tty->count);
 
         tty_unlock(tty);
         return 0;
-err_path_put:
-        path_put(pts_path);
-        kfree(pts_path);
 err_release:
         tty_unlock(tty);
         // This will also put-ref the fsi
diff --git a/drivers/tty/serial/8250/8250_core.c b/drivers/tty/serial/8250/8250_core.c
index b5def356af63..1aab3010fbfa 100644
--- a/drivers/tty/serial/8250/8250_core.c
+++ b/drivers/tty/serial/8250/8250_core.c
@@ -1043,13 +1043,24 @@ int serial8250_register_8250_port(struct uart_8250_port *up)
                 if (up->dl_write)
                         uart->dl_write = up->dl_write;
 
-                if (serial8250_isa_config != NULL)
-                        serial8250_isa_config(0, &uart->port,
-                                        &uart->capabilities);
+                if (uart->port.type != PORT_8250_CIR) {
+                        if (serial8250_isa_config != NULL)
+                                serial8250_isa_config(0, &uart->port,
+                                                &uart->capabilities);
+
+                        ret = uart_add_one_port(&serial8250_reg,
+                                                &uart->port);
+                        if (ret == 0)
+                                ret = uart->port.line;
+                } else {
+                        dev_info(uart->port.dev,
+                                "skipping CIR port at 0x%lx / 0x%llx, IRQ %d\n",
+                                uart->port.iobase,
+                                (unsigned long long)uart->port.mapbase,
+                                uart->port.irq);
 
-                ret = uart_add_one_port(&serial8250_reg, &uart->port);
-                if (ret == 0)
-                        ret = uart->port.line;
+                        ret = 0;
+                }
         }
         mutex_unlock(&serial_mutex);
 
diff --git a/drivers/tty/serial/8250/8250_exar.c b/drivers/tty/serial/8250/8250_exar.c
index b5c98e5bf524..c6360fbdf808 100644
--- a/drivers/tty/serial/8250/8250_exar.c
+++ b/drivers/tty/serial/8250/8250_exar.c
@@ -261,7 +261,7 @@ __xr17v35x_register_gpio(struct pci_dev *pcidev,
 }
 
 static const struct property_entry exar_gpio_properties[] = {
-        PROPERTY_ENTRY_U32("linux,first-pin", 0),
+        PROPERTY_ENTRY_U32("exar,first-pin", 0),
         PROPERTY_ENTRY_U32("ngpios", 16),
         { }
 };
@@ -326,7 +326,7 @@ static int iot2040_rs485_config(struct uart_port *port,
 }
 
 static const struct property_entry iot2040_gpio_properties[] = {
-        PROPERTY_ENTRY_U32("linux,first-pin", 10),
+        PROPERTY_ENTRY_U32("exar,first-pin", 10),
         PROPERTY_ENTRY_U32("ngpios", 1),
         { }
 };
diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c
index 8a857bb34fbb..1888d168a41c 100644
--- a/drivers/tty/serial/amba-pl011.c
+++ b/drivers/tty/serial/amba-pl011.c
@@ -142,15 +142,7 @@ static struct vendor_data vendor_sbsa = {
         .fixed_options          = true,
 };
 
-/*
- * Erratum 44 for QDF2432v1 and QDF2400v1 SoCs describes the BUSY bit as
- * occasionally getting stuck as 1. To avoid the potential for a hang, check
- * TXFE == 0 instead of BUSY == 1. This may not be suitable for all UART
- * implementations, so only do so if an affected platform is detected in
- * parse_spcr().
- */
-static bool qdf2400_e44_present = false;
-
+#ifdef CONFIG_ACPI_SPCR_TABLE
 static struct vendor_data vendor_qdt_qdf2400_e44 = {
         .reg_offset             = pl011_std_offsets,
         .fr_busy                = UART011_FR_TXFE,
@@ -165,6 +157,7 @@ static struct vendor_data vendor_qdt_qdf2400_e44 = {
         .always_enabled         = true,
         .fixed_options          = true,
 };
+#endif
 
 static u16 pl011_st_offsets[REG_ARRAY_SIZE] = {
         [REG_DR] = UART01x_DR,
@@ -2375,12 +2368,14 @@ static int __init pl011_console_match(struct console *co, char *name, int idx,
         resource_size_t addr;
         int i;
 
-        if (strcmp(name, "qdf2400_e44") == 0) {
-                pr_info_once("UART: Working around QDF2400 SoC erratum 44");
-                qdf2400_e44_present = true;
-        } else if (strcmp(name, "pl011") != 0) {
+        /*
+         * Systems affected by the Qualcomm Technologies QDF2400 E44 erratum
+         * have a distinct console name, so make sure we check for that.
+         * The actual implementation of the erratum occurs in the probe
+         * function.
+         */
+        if ((strcmp(name, "qdf2400_e44") != 0) && (strcmp(name, "pl011") != 0))
                 return -ENODEV;
-        }
 
         if (uart_parse_earlycon(options, &iotype, &addr, &options))
                 return -ENODEV;
@@ -2734,11 +2729,17 @@ static int sbsa_uart_probe(struct platform_device *pdev)
         }
         uap->port.irq   = ret;
 
-        uap->reg_offset = vendor_sbsa.reg_offset;
-        uap->vendor     = qdf2400_e44_present ?
-                                        &vendor_qdt_qdf2400_e44 : &vendor_sbsa;
+#ifdef CONFIG_ACPI_SPCR_TABLE
+        if (qdf2400_e44_present) {
+                dev_info(&pdev->dev, "working around QDF2400 SoC erratum 44\n");
+                uap->vendor = &vendor_qdt_qdf2400_e44;
+        } else
+#endif
+                uap->vendor = &vendor_sbsa;
+
+        uap->reg_offset = uap->vendor->reg_offset;
         uap->fifosize   = 32;
-        uap->port.iotype = vendor_sbsa.access_32b ? UPIO_MEM32 : UPIO_MEM;
+        uap->port.iotype = uap->vendor->access_32b ? UPIO_MEM32 : UPIO_MEM;
         uap->port.ops   = &sbsa_uart_pops;
         uap->fixed_baud = baudrate;
 
diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
index 974b13d24401..10c4038c0e8d 100644
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -2518,6 +2518,9 @@ long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
         case TIOCSSERIAL:
                 tty_warn_deprecated_flags(p);
                 break;
+        case TIOCGPTPEER:
+                /* Special because the struct file is needed */
+                return ptm_open_peer(file, tty, (int)arg);
         default:
                 retval = tty_jobctrl_ioctl(tty, real_tty, file, cmd, arg);
                 if (retval != -ENOIOCTLCMD)
diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
index ab1bb3b538ac..7f277b092b5b 100644
--- a/drivers/usb/core/hcd.c
+++ b/drivers/usb/core/hcd.c
@@ -1888,7 +1888,7 @@ void usb_hcd_flush_endpoint(struct usb_device *udev,
         /* No more submits can occur */
         spin_lock_irq(&hcd_urb_list_lock);
 rescan:
-        list_for_each_entry (urb, &ep->urb_list, urb_list) {
+        list_for_each_entry_reverse(urb, &ep->urb_list, urb_list) {
                 int     is_in;
 
                 if (urb->unlinked)
@@ -2485,6 +2485,8 @@ void usb_hc_died (struct usb_hcd *hcd)
         }
         if (usb_hcd_is_primary_hcd(hcd) && hcd->shared_hcd) {
                 hcd = hcd->shared_hcd;
+                clear_bit(HCD_FLAG_RH_RUNNING, &hcd->flags);
+                set_bit(HCD_FLAG_DEAD, &hcd->flags);
                 if (hcd->rh_registered) {
                         clear_bit(HCD_FLAG_POLL_RH, &hcd->flags);
 
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 6e6797d145dd..822f8c50e423 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -4725,7 +4725,8 @@ hub_power_remaining(struct usb_hub *hub)
 static void hub_port_connect(struct usb_hub *hub, int port1, u16 portstatus,
                 u16 portchange)
 {
-        int status, i;
+        int status = -ENODEV;
+        int i;
         unsigned unit_load;
         struct usb_device *hdev = hub->hdev;
         struct usb_hcd *hcd = bus_to_hcd(hdev->bus);
@@ -4929,9 +4930,10 @@ loop:
 
 done:
         hub_port_disable(hub, port1, 1);
-        if (hcd->driver->relinquish_port && !hub->hdev->parent)
-                hcd->driver->relinquish_port(hcd, port1);
-
+        if (hcd->driver->relinquish_port && !hub->hdev->parent) {
+                if (status != -ENOTCONN && status != -ENODEV)
+                        hcd->driver->relinquish_port(hcd, port1);
+        }
 }
 
 /* Handle physical or logical connection change events.
diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index 3116edfcdc18..574da2b4529c 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -150,6 +150,9 @@ static const struct usb_device_id usb_quirk_list[] = {
         /* appletouch */
         { USB_DEVICE(0x05ac, 0x021a), .driver_info = USB_QUIRK_RESET_RESUME },
 
+        /* Genesys Logic hub, internally used by Moshi USB to Ethernet Adapter */
+        { USB_DEVICE(0x05e3, 0x0616), .driver_info = USB_QUIRK_NO_LPM },
+
         /* Avision AV600U */
         { USB_DEVICE(0x0638, 0x0a13), .driver_info =
           USB_QUIRK_STRING_FETCH_255 },
@@ -249,6 +252,7 @@ static const struct usb_device_id usb_amd_resume_quirk_list[] = {
         { USB_DEVICE(0x093a, 0x2500), .driver_info = USB_QUIRK_RESET_RESUME },
         { USB_DEVICE(0x093a, 0x2510), .driver_info = USB_QUIRK_RESET_RESUME },
         { USB_DEVICE(0x093a, 0x2521), .driver_info = USB_QUIRK_RESET_RESUME },
+        { USB_DEVICE(0x03f0, 0x2b4a), .driver_info = USB_QUIRK_RESET_RESUME },
 
         /* Logitech Optical Mouse M90/M100 */
         { USB_DEVICE(0x046d, 0xc05a), .driver_info = USB_QUIRK_RESET_RESUME },
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 6b299c7b7656..f064f1549333 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -896,9 +896,40 @@ static void __dwc3_prepare_one_trb(struct dwc3_ep *dep, struct dwc3_trb *trb,
                 if (!node) {
                         trb->ctrl = DWC3_TRBCTL_ISOCHRONOUS_FIRST;
 
+                        /*
+                         * USB Specification 2.0 Section 5.9.2 states that: "If
+                         * there is only a single transaction in the microframe,
+                         * only a DATA0 data packet PID is used.  If there are
+                         * two transactions per microframe, DATA1 is used for
+                         * the first transaction data packet and DATA0 is used
+                         * for the second transaction data packet.  If there are
+                         * three transactions per microframe, DATA2 is used for
+                         * the first transaction data packet, DATA1 is used for
+                         * the second, and DATA0 is used for the third."
+                         *
+                         * IOW, we should satisfy the following cases:
+                         *
+                         * 1) length <= maxpacket
+                         *      - DATA0
+                         *
+                         * 2) maxpacket < length <= (2 * maxpacket)
+                         *      - DATA1, DATA0
+                         *
+                         * 3) (2 * maxpacket) < length <= (3 * maxpacket)
+                         *      - DATA2, DATA1, DATA0
+                         */
                         if (speed == USB_SPEED_HIGH) {
                                 struct usb_ep *ep = &dep->endpoint;
-                                trb->size |= DWC3_TRB_SIZE_PCM1(ep->mult - 1);
+                                unsigned int mult = ep->mult - 1;
+                                unsigned int maxp = usb_endpoint_maxp(ep->desc);
+
+                                if (length <= (2 * maxp))
+                                        mult--;
+
+                                if (length <= maxp)
+                                        mult--;
+
+                                trb->size |= DWC3_TRB_SIZE_PCM1(mult);
                         }
                 } else {
                         trb->ctrl = DWC3_TRBCTL_ISOCHRONOUS;
diff --git a/drivers/usb/gadget/udc/renesas_usb3.c b/drivers/usb/gadget/udc/renesas_usb3.c
index 62dc9c7798e7..e1de8fe599a3 100644
--- a/drivers/usb/gadget/udc/renesas_usb3.c
+++ b/drivers/usb/gadget/udc/renesas_usb3.c
@@ -838,21 +838,32 @@ static struct renesas_usb3_request *usb3_get_request(struct renesas_usb3_ep
         return usb3_req;
 }
 
-static void usb3_request_done(struct renesas_usb3_ep *usb3_ep,
-                              struct renesas_usb3_request *usb3_req, int status)
+static void __usb3_request_done(struct renesas_usb3_ep *usb3_ep,
+                                struct renesas_usb3_request *usb3_req,
+                                int status)
 {
         struct renesas_usb3 *usb3 = usb3_ep_to_usb3(usb3_ep);
-        unsigned long flags;
 
         dev_dbg(usb3_to_dev(usb3), "giveback: ep%2d, %u, %u, %d\n",
                 usb3_ep->num, usb3_req->req.length, usb3_req->req.actual,
                 status);
         usb3_req->req.status = status;
-        spin_lock_irqsave(&usb3->lock, flags);
         usb3_ep->started = false;
         list_del_init(&usb3_req->queue);
-        spin_unlock_irqrestore(&usb3->lock, flags);
+        spin_unlock(&usb3->lock);
         usb_gadget_giveback_request(&usb3_ep->ep, &usb3_req->req);
+        spin_lock(&usb3->lock);
+}
+
+static void usb3_request_done(struct renesas_usb3_ep *usb3_ep,
+                              struct renesas_usb3_request *usb3_req, int status)
+{
+        struct renesas_usb3 *usb3 = usb3_ep_to_usb3(usb3_ep);
+        unsigned long flags;
+
+        spin_lock_irqsave(&usb3->lock, flags);
+        __usb3_request_done(usb3_ep, usb3_req, status);
+        spin_unlock_irqrestore(&usb3->lock, flags);
 }
 
 static void usb3_irq_epc_pipe0_status_end(struct renesas_usb3 *usb3)
diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
index c8989c62a262..c8f38649f749 100644
--- a/drivers/usb/host/pci-quirks.c
+++ b/drivers/usb/host/pci-quirks.c
@@ -98,6 +98,7 @@ enum amd_chipset_gen {
         AMD_CHIPSET_HUDSON2,
         AMD_CHIPSET_BOLTON,
         AMD_CHIPSET_YANGTZE,
+        AMD_CHIPSET_TAISHAN,
         AMD_CHIPSET_UNKNOWN,
 };
 
@@ -141,6 +142,11 @@ static int amd_chipset_sb_type_init(struct amd_chipset_info *pinfo)
                         pinfo->sb_type.gen = AMD_CHIPSET_SB700;
                 else if (rev >= 0x40 && rev <= 0x4f)
                         pinfo->sb_type.gen = AMD_CHIPSET_SB800;
+        }
+        pinfo->smbus_dev = pci_get_device(PCI_VENDOR_ID_AMD,
+                                          0x145c, NULL);
+        if (pinfo->smbus_dev) {
+                pinfo->sb_type.gen = AMD_CHIPSET_TAISHAN;
         } else {
                 pinfo->smbus_dev = pci_get_device(PCI_VENDOR_ID_AMD,
                                 PCI_DEVICE_ID_AMD_HUDSON2_SMBUS, NULL);
@@ -260,11 +266,12 @@ int usb_hcd_amd_remote_wakeup_quirk(struct pci_dev *pdev)
 {
         /* Make sure amd chipset type has already been initialized */
         usb_amd_find_chipset_info();
-        if (amd_chipset.sb_type.gen != AMD_CHIPSET_YANGTZE)
-                return 0;
-
-        dev_dbg(&pdev->dev, "QUIRK: Enable AMD remote wakeup fix\n");
-        return 1;
+        if (amd_chipset.sb_type.gen == AMD_CHIPSET_YANGTZE ||
+            amd_chipset.sb_type.gen == AMD_CHIPSET_TAISHAN) {
+                dev_dbg(&pdev->dev, "QUIRK: Enable AMD remote wakeup fix\n");
+                return 1;
+        }
+        return 0;
 }
 EXPORT_SYMBOL_GPL(usb_hcd_amd_remote_wakeup_quirk);
 
@@ -1150,3 +1157,23 @@ static void quirk_usb_early_handoff(struct pci_dev *pdev)
 }
 DECLARE_PCI_FIXUP_CLASS_FINAL(PCI_ANY_ID, PCI_ANY_ID,
                         PCI_CLASS_SERIAL_USB, 8, quirk_usb_early_handoff);
+
+bool usb_xhci_needs_pci_reset(struct pci_dev *pdev)
+{
+        /*
+         * Our dear uPD72020{1,2} friend only partially resets when
+         * asked to via the XHCI interface, and may end up doing DMA
+         * at the wrong addresses, as it keeps the top 32bit of some
+         * addresses from its previous programming under obscure
+         * circumstances.
+         * Give it a good wack at probe time. Unfortunately, this
+         * needs to happen before we've had a chance to discover any
+         * quirk, or the system will be in a rather bad state.
+         */
+        if (pdev->vendor == PCI_VENDOR_ID_RENESAS &&
+            (pdev->device == 0x0014 || pdev->device == 0x0015))
+                return true;
+
+        return false;
+}
+EXPORT_SYMBOL_GPL(usb_xhci_needs_pci_reset);
diff --git a/drivers/usb/host/pci-quirks.h b/drivers/usb/host/pci-quirks.h
index 655994480198..5582cbafecd4 100644
--- a/drivers/usb/host/pci-quirks.h
+++ b/drivers/usb/host/pci-quirks.h
@@ -15,6 +15,7 @@ void usb_asmedia_modifyflowcontrol(struct pci_dev *pdev);
 void usb_enable_intel_xhci_ports(struct pci_dev *xhci_pdev);
 void usb_disable_xhci_ports(struct pci_dev *xhci_pdev);
 void sb800_prefetch(struct device *dev, int on);
+bool usb_xhci_needs_pci_reset(struct pci_dev *pdev);
 #else
 struct pci_dev;
 static inline void usb_amd_quirk_pll_disable(void) {}
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index 5b0fa553c8bc..8071c8fdd15e 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -284,6 +284,13 @@ static int xhci_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)
 
         driver = (struct hc_driver *)id->driver_data;
 
+        /* For some HW implementation, a XHCI reset is just not enough... */
+        if (usb_xhci_needs_pci_reset(dev)) {
+                dev_info(&dev->dev, "Resetting\n");
+                if (pci_reset_function_locked(dev))
+                        dev_warn(&dev->dev, "Reset failed");
+        }
+
         /* Prevent runtime suspending between USB-2 and USB-3 initialization */
         pm_runtime_get_noresume(&dev->dev);
 
diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c
index 76decb8011eb..3344ffd5bb13 100644
--- a/drivers/usb/musb/musb_host.c
+++ b/drivers/usb/musb/musb_host.c
@@ -139,6 +139,7 @@ static void musb_h_tx_flush_fifo(struct musb_hw_ep *ep)
                                 "Could not flush host TX%d fifo: csr: %04x\n",
                                 ep->epnum, csr))
                         return;
+                mdelay(1);
         }
 }
 
diff --git a/drivers/usb/phy/phy-msm-usb.c b/drivers/usb/phy/phy-msm-usb.c
index 8fb86a5f458e..3d0dd2f97415 100644
--- a/drivers/usb/phy/phy-msm-usb.c
+++ b/drivers/usb/phy/phy-msm-usb.c
@@ -197,6 +197,7 @@ struct msm_otg {
         struct regulator *v3p3;
         struct regulator *v1p8;
         struct regulator *vddcx;
+        struct regulator_bulk_data supplies[3];
 
         struct reset_control *phy_rst;
         struct reset_control *link_rst;
@@ -1731,7 +1732,6 @@ static int msm_otg_reboot_notify(struct notifier_block *this,
 
 static int msm_otg_probe(struct platform_device *pdev)
 {
-        struct regulator_bulk_data regs[3];
         int ret = 0;
         struct device_node *np = pdev->dev.of_node;
         struct msm_otg_platform_data *pdata;
@@ -1817,17 +1817,18 @@ static int msm_otg_probe(struct platform_device *pdev)
                 return motg->irq;
         }
 
-        regs[0].supply = "vddcx";
-        regs[1].supply = "v3p3";
-        regs[2].supply = "v1p8";
+        motg->supplies[0].supply = "vddcx";
+        motg->supplies[1].supply = "v3p3";
+        motg->supplies[2].supply = "v1p8";
 
-        ret = devm_regulator_bulk_get(motg->phy.dev, ARRAY_SIZE(regs), regs);
+        ret = devm_regulator_bulk_get(motg->phy.dev, ARRAY_SIZE(motg->supplies),
+                                      motg->supplies);
         if (ret)
                 return ret;
 
-        motg->vddcx = regs[0].consumer;
-        motg->v3p3  = regs[1].consumer;
-        motg->v1p8  = regs[2].consumer;
+        motg->vddcx = motg->supplies[0].consumer;
+        motg->v3p3  = motg->supplies[1].consumer;
+        motg->v1p8  = motg->supplies[2].consumer;
 
         clk_set_rate(motg->clk, 60000000);
 
diff --git a/drivers/usb/renesas_usbhs/mod_gadget.c b/drivers/usb/renesas_usbhs/mod_gadget.c
index 93fba9033b00..2c8161bcf5b5 100644
--- a/drivers/usb/renesas_usbhs/mod_gadget.c
+++ b/drivers/usb/renesas_usbhs/mod_gadget.c
@@ -639,14 +639,11 @@ static int usbhsg_ep_disable(struct usb_ep *ep)
         struct usbhsg_uep *uep = usbhsg_ep_to_uep(ep);
         struct usbhs_pipe *pipe;
         unsigned long flags;
-        int ret = 0;
 
         spin_lock_irqsave(&uep->lock, flags);
         pipe = usbhsg_uep_to_pipe(uep);
-        if (!pipe) {
-                ret = -EINVAL;
+        if (!pipe)
                 goto out;
-        }
 
         usbhsg_pipe_disable(uep);
         usbhs_pipe_free(pipe);
diff --git a/drivers/usb/renesas_usbhs/rcar3.c b/drivers/usb/renesas_usbhs/rcar3.c
index d544b331c9f2..02b67abfc2a1 100644
--- a/drivers/usb/renesas_usbhs/rcar3.c
+++ b/drivers/usb/renesas_usbhs/rcar3.c
@@ -20,9 +20,13 @@
 /* Low Power Status register (LPSTS) */
 #define LPSTS_SUSPM     0x4000
 
-/* USB General control register 2 (UGCTRL2), bit[31:6] should be 0 */
+/*
+ * USB General control register 2 (UGCTRL2)
+ * Remarks: bit[31:11] and bit[9:6] should be 0
+ */
 #define UGCTRL2_RESERVED_3      0x00000001      /* bit[3:0] should be B'0001 */
 #define UGCTRL2_USB0SEL_OTG     0x00000030
+#define UGCTRL2_VBUSSEL         0x00000400
 
 static void usbhs_write32(struct usbhs_priv *priv, u32 reg, u32 data)
 {
@@ -34,7 +38,8 @@ static int usbhs_rcar3_power_ctrl(struct platform_device *pdev,
 {
         struct usbhs_priv *priv = usbhs_pdev_to_priv(pdev);
 
-        usbhs_write32(priv, UGCTRL2, UGCTRL2_RESERVED_3 | UGCTRL2_USB0SEL_OTG);
+        usbhs_write32(priv, UGCTRL2, UGCTRL2_RESERVED_3 | UGCTRL2_USB0SEL_OTG |
+                      UGCTRL2_VBUSSEL);
 
         if (enable) {
                 usbhs_bset(priv, LPSTS, LPSTS_SUSPM, LPSTS_SUSPM);
diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
index f64e914a8985..2d945c9f975c 100644
--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
@@ -142,6 +142,7 @@ static const struct usb_device_id id_table[] = {
         { USB_DEVICE(0x10C4, 0x8998) }, /* KCF Technologies PRN */
         { USB_DEVICE(0x10C4, 0x8A2A) }, /* HubZ dual ZigBee and Z-Wave dongle */
         { USB_DEVICE(0x10C4, 0x8A5E) }, /* CEL EM3588 ZigBee USB Stick Long Range */
+        { USB_DEVICE(0x10C4, 0x8B34) }, /* Qivicon ZigBee USB Radio Stick */
         { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */
         { USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */
         { USB_DEVICE(0x10C4, 0xEA70) }, /* Silicon Labs factory default */
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index ebe51f11105d..fe123153b1a5 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -2025,6 +2025,8 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7d04, 0xff) },                   /* D-Link DWM-158 */
         { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7e19, 0xff),                     /* D-Link DWM-221 B1 */
           .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+        { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7e35, 0xff),                     /* D-Link DWM-222 */
+          .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
         { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */
         { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */
         { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x7e11, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/A3 */
diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
index c9ebefd8f35f..a585b477415d 100644
--- a/drivers/usb/serial/pl2303.c
+++ b/drivers/usb/serial/pl2303.c
@@ -52,6 +52,8 @@ static const struct usb_device_id id_table[] = {
         { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID_RSAQ5) },
         { USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_ID),
                 .driver_info = PL2303_QUIRK_ENDPOINT_HACK },
+        { USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_UC485),
+                .driver_info = PL2303_QUIRK_ENDPOINT_HACK },
         { USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_ID2) },
         { USB_DEVICE(ATEN_VENDOR_ID2, ATEN_PRODUCT_ID) },
         { USB_DEVICE(ELCOM_VENDOR_ID, ELCOM_PRODUCT_ID) },
diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h
index 09d9be88209e..3b5a15d1dc0d 100644
--- a/drivers/usb/serial/pl2303.h
+++ b/drivers/usb/serial/pl2303.h
@@ -27,6 +27,7 @@
 #define ATEN_VENDOR_ID          0x0557
 #define ATEN_VENDOR_ID2         0x0547
 #define ATEN_PRODUCT_ID         0x2008
+#define ATEN_PRODUCT_UC485      0x2021
 #define ATEN_PRODUCT_ID2        0x2118
 
 #define IODATA_VENDOR_ID        0x04bb
diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h
index cbea9f329e71..cde115359793 100644
--- a/drivers/usb/storage/unusual_uas.h
+++ b/drivers/usb/storage/unusual_uas.h
@@ -124,9 +124,9 @@ UNUSUAL_DEV(0x0bc2, 0xab2a, 0x0000, 0x9999,
 /* Reported-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> */
 UNUSUAL_DEV(0x13fd, 0x3940, 0x0000, 0x9999,
                 "Initio Corporation",
-                "",
+                "INIC-3069",
                 USB_SC_DEVICE, USB_PR_DEVICE, NULL,
-                US_FL_NO_ATA_1X),
+                US_FL_NO_ATA_1X | US_FL_IGNORE_RESIDUE),
 
 /* Reported-by: Tom Arild Naess <tanaess@gmail.com> */
 UNUSUAL_DEV(0x152d, 0x0539, 0x0000, 0x9999,
diff --git a/drivers/usb/storage/usb.c b/drivers/usb/storage/usb.c
index 06615934fed1..0dceb9fa3a06 100644
--- a/drivers/usb/storage/usb.c
+++ b/drivers/usb/storage/usb.c
@@ -315,6 +315,7 @@ static int usb_stor_control_thread(void * __us)
 {
         struct us_data *us = (struct us_data *)__us;
         struct Scsi_Host *host = us_to_host(us);
+        struct scsi_cmnd *srb;
 
         for (;;) {
                 usb_stor_dbg(us, "*** thread sleeping\n");
@@ -330,6 +331,7 @@ static int usb_stor_control_thread(void * __us)
                 scsi_lock(host);
 
                 /* When we are called with no command pending, we're done */
+                srb = us->srb;
                 if (us->srb == NULL) {
                         scsi_unlock(host);
                         mutex_unlock(&us->dev_mutex);
@@ -398,14 +400,11 @@ static int usb_stor_control_thread(void * __us)
                 /* lock access to the state */
                 scsi_lock(host);
 
-                /* indicate that the command is done */
-                if (us->srb->result != DID_ABORT << 16) {
-                        usb_stor_dbg(us, "scsi cmd done, result=0x%x\n",
-                                     us->srb->result);
-                        us->srb->scsi_done(us->srb);
-                } else {
+                /* was the command aborted? */
+                if (us->srb->result == DID_ABORT << 16) {
 SkipForAbort:
                         usb_stor_dbg(us, "scsi command aborted\n");
+                        srb = NULL;     /* Don't call srb->scsi_done() */
                 }
 
                 /*
@@ -429,6 +428,13 @@ SkipForAbort:
 
                 /* unlock the device pointers */
                 mutex_unlock(&us->dev_mutex);
+
+                /* now that the locks are released, notify the SCSI core */
+                if (srb) {
+                        usb_stor_dbg(us, "scsi cmd done, result=0x%x\n",
+                                        srb->result);
+                        srb->scsi_done(srb);
+                }
         } /* for (;;) */
 
         /* Wait until we are told to stop */
diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
index 063c1ce6fa42..f041b1a6cf66 100644
--- a/drivers/vfio/pci/vfio_pci.c
+++ b/drivers/vfio/pci/vfio_pci.c
@@ -226,7 +226,14 @@ static int vfio_pci_enable(struct vfio_pci_device *vdev)
         if (ret)
                 return ret;
 
-        vdev->reset_works = (pci_reset_function(pdev) == 0);
+        /* If reset fails because of the device lock, fail this path entirely */
+        ret = pci_try_reset_function(pdev);
+        if (ret == -EAGAIN) {
+                pci_disable_device(pdev);
+                return ret;
+        }
+
+        vdev->reset_works = !ret;
         pci_save_state(pdev);
         vdev->pci_saved_state = pci_store_saved_state(pdev);
         if (!vdev->pci_saved_state)
diff --git a/drivers/vfio/pci/vfio_pci_config.c b/drivers/vfio/pci/vfio_pci_config.c
index 330a57024cbc..5628fe114347 100644
--- a/drivers/vfio/pci/vfio_pci_config.c
+++ b/drivers/vfio/pci/vfio_pci_config.c
@@ -839,7 +839,7 @@ static int vfio_exp_config_write(struct vfio_pci_device *vdev, int pos,
 /* Permissions for PCI Express capability */
 static int __init init_pci_cap_exp_perm(struct perm_bits *perm)
 {
-        /* Alloc larger of two possible sizes */
+        /* Alloc largest of possible sizes */
         if (alloc_perm_bits(perm, PCI_CAP_EXP_ENDPOINT_SIZEOF_V2))
                 return -ENOMEM;
 
@@ -1243,11 +1243,16 @@ static int vfio_cap_len(struct vfio_pci_device *vdev, u8 cap, u8 pos)
                         vdev->extended_caps = (dword != 0);
                 }
 
-                /* length based on version */
-                if ((pcie_caps_reg(pdev) & PCI_EXP_FLAGS_VERS) == 1)
+                /* length based on version and type */
+                if ((pcie_caps_reg(pdev) & PCI_EXP_FLAGS_VERS) == 1) {
+                        if (pci_pcie_type(pdev) == PCI_EXP_TYPE_RC_END)
+                                return 0xc; /* "All Devices" only, no link */
                         return PCI_CAP_EXP_ENDPOINT_SIZEOF_V1;
-                else
+                } else {
+                        if (pci_pcie_type(pdev) == PCI_EXP_TYPE_RC_END)
+                                return 0x2c; /* No link */
                         return PCI_CAP_EXP_ENDPOINT_SIZEOF_V2;
+                }
         case PCI_CAP_ID_HT:
                 ret = pci_read_config_byte(pdev, pos + 3, &byte);
                 if (ret)
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index e4613a3c362d..9cb3f722dce1 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -308,7 +308,6 @@ static void vhost_vq_reset(struct vhost_dev *dev,
         vq->avail = NULL;
         vq->used = NULL;
         vq->last_avail_idx = 0;
-        vq->last_used_event = 0;
         vq->avail_idx = 0;
         vq->last_used_idx = 0;
         vq->signalled_used = 0;
@@ -1402,7 +1401,7 @@ long vhost_vring_ioctl(struct vhost_dev *d, int ioctl, void __user *argp)
                         r = -EINVAL;
                         break;
                 }
-                vq->last_avail_idx = vq->last_used_event = s.num;
+                vq->last_avail_idx = s.num;
                 /* Forget the cached index value. */
                 vq->avail_idx = vq->last_avail_idx;
                 break;
@@ -2241,6 +2240,10 @@ static bool vhost_notify(struct vhost_dev *dev, struct vhost_virtqueue *vq)
         __u16 old, new;
         __virtio16 event;
         bool v;
+        /* Flush out used index updates. This is paired
+         * with the barrier that the Guest executes when enabling
+         * interrupts. */
+        smp_mb();
 
         if (vhost_has_feature(vq, VIRTIO_F_NOTIFY_ON_EMPTY) &&
             unlikely(vq->avail_idx == vq->last_avail_idx))
@@ -2248,10 +2251,6 @@ static bool vhost_notify(struct vhost_dev *dev, struct vhost_virtqueue *vq)
 
         if (!vhost_has_feature(vq, VIRTIO_RING_F_EVENT_IDX)) {
                 __virtio16 flags;
-                /* Flush out used index updates. This is paired
-                 * with the barrier that the Guest executes when enabling
-                 * interrupts. */
-                smp_mb();
                 if (vhost_get_avail(vq, flags, &vq->avail->flags)) {
                         vq_err(vq, "Failed to get flags");
                         return true;
@@ -2266,26 +2265,11 @@ static bool vhost_notify(struct vhost_dev *dev, struct vhost_virtqueue *vq)
         if (unlikely(!v))
                 return true;
 
-        /* We're sure if the following conditions are met, there's no
-         * need to notify guest:
-         * 1) cached used event is ahead of new
-         * 2) old to new updating does not cross cached used event. */
-        if (vring_need_event(vq->last_used_event, new + vq->num, new) &&
-            !vring_need_event(vq->last_used_event, new, old))
-                return false;
-
-        /* Flush out used index updates. This is paired
-         * with the barrier that the Guest executes when enabling
-         * interrupts. */
-        smp_mb();
-
         if (vhost_get_avail(vq, event, vhost_used_event(vq))) {
                 vq_err(vq, "Failed to get used event idx");
                 return true;
         }
-        vq->last_used_event = vhost16_to_cpu(vq, event);
-
-        return vring_need_event(vq->last_used_event, new, old);
+        return vring_need_event(vhost16_to_cpu(vq, event), new, old);
 }
 
 /* This actually signals the guest, using eventfd. */
diff --git a/drivers/vhost/vhost.h b/drivers/vhost/vhost.h
index f72095868b93..bb7c29b8b9fc 100644
--- a/drivers/vhost/vhost.h
+++ b/drivers/vhost/vhost.h
@@ -115,9 +115,6 @@ struct vhost_virtqueue {
         /* Last index we used. */
         u16 last_used_idx;
 
-        /* Last used evet we've seen */
-        u16 last_used_event;
-
         /* Used flags */
         u16 used_flags;
 
diff --git a/drivers/video/fbdev/efifb.c b/drivers/video/fbdev/efifb.c
index ff01bed7112f..1e784adb89b1 100644
--- a/drivers/video/fbdev/efifb.c
+++ b/drivers/video/fbdev/efifb.c
@@ -17,6 +17,7 @@
 #include <asm/efi.h>
 
 static bool request_mem_succeeded = false;
+static bool nowc = false;
 
 static struct fb_var_screeninfo efifb_defined = {
         .activate               = FB_ACTIVATE_NOW,
@@ -99,6 +100,8 @@ static int efifb_setup(char *options)
                                 screen_info.lfb_height = simple_strtoul(this_opt+7, NULL, 0);
                         else if (!strncmp(this_opt, "width:", 6))
                                 screen_info.lfb_width = simple_strtoul(this_opt+6, NULL, 0);
+                        else if (!strcmp(this_opt, "nowc"))
+                                nowc = true;
                 }
         }
 
@@ -255,7 +258,10 @@ static int efifb_probe(struct platform_device *dev)
         info->apertures->ranges[0].base = efifb_fix.smem_start;
         info->apertures->ranges[0].size = size_remap;
 
-        info->screen_base = ioremap_wc(efifb_fix.smem_start, efifb_fix.smem_len);
+        if (nowc)
+                info->screen_base = ioremap(efifb_fix.smem_start, efifb_fix.smem_len);
+        else
+                info->screen_base = ioremap_wc(efifb_fix.smem_start, efifb_fix.smem_len);
         if (!info->screen_base) {
                 pr_err("efifb: abort, cannot ioremap video memory 0x%x @ 0x%lx\n",
                         efifb_fix.smem_len, efifb_fix.smem_start);
diff --git a/drivers/video/fbdev/imxfb.c b/drivers/video/fbdev/imxfb.c
index c166e0725be5..ba82f97fb42b 100644
--- a/drivers/video/fbdev/imxfb.c
+++ b/drivers/video/fbdev/imxfb.c
@@ -1073,20 +1073,16 @@ static int imxfb_remove(struct platform_device *pdev)
         imxfb_disable_controller(fbi);
 
         unregister_framebuffer(info);
-
+        fb_dealloc_cmap(&info->cmap);
         pdata = dev_get_platdata(&pdev->dev);
         if (pdata && pdata->exit)
                 pdata->exit(fbi->pdev);
-
-        fb_dealloc_cmap(&info->cmap);
-        kfree(info->pseudo_palette);
-        framebuffer_release(info);
-
         dma_free_wc(&pdev->dev, fbi->map_size, info->screen_base,
                     fbi->map_dma);
-
         iounmap(fbi->regs);
         release_mem_region(res->start, resource_size(res));
+        kfree(info->pseudo_palette);
+        framebuffer_release(info);
 
         return 0;
 }
diff --git a/drivers/video/fbdev/omap2/omapfb/dss/core.c b/drivers/video/fbdev/omap2/omapfb/dss/core.c
index eecf695c16f4..09e5bb013d28 100644
--- a/drivers/video/fbdev/omap2/omapfb/dss/core.c
+++ b/drivers/video/fbdev/omap2/omapfb/dss/core.c
@@ -193,7 +193,6 @@ static struct notifier_block omap_dss_pm_notif_block = {
 
 static int __init omap_dss_probe(struct platform_device *pdev)
 {
-        struct omap_dss_board_info *pdata = pdev->dev.platform_data;
         int r;
 
         core.pdev = pdev;
diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c
index 22caf808bfab..f0b3a0b9d42f 100644
--- a/drivers/virtio/virtio_balloon.c
+++ b/drivers/virtio/virtio_balloon.c
@@ -104,12 +104,6 @@ static u32 page_to_balloon_pfn(struct page *page)
         return pfn * VIRTIO_BALLOON_PAGES_PER_PAGE;
 }
 
-static struct page *balloon_pfn_to_page(u32 pfn)
-{
-        BUG_ON(pfn % VIRTIO_BALLOON_PAGES_PER_PAGE);
-        return pfn_to_page(pfn / VIRTIO_BALLOON_PAGES_PER_PAGE);
-}
-
 static void balloon_ack(struct virtqueue *vq)
 {
         struct virtio_balloon *vb = vq->vdev->priv;
@@ -138,8 +132,10 @@ static void set_page_pfns(struct virtio_balloon *vb,
 {
         unsigned int i;
 
-        /* Set balloon pfns pointing at this page.
-         * Note that the first pfn points at start of the page. */
+        /*
+         * Set balloon pfns pointing at this page.
+         * Note that the first pfn points at start of the page.
+         */
         for (i = 0; i < VIRTIO_BALLOON_PAGES_PER_PAGE; i++)
                 pfns[i] = cpu_to_virtio32(vb->vdev,
                                           page_to_balloon_pfn(page) + i);
@@ -182,18 +178,16 @@ static unsigned fill_balloon(struct virtio_balloon *vb, size_t num)
         return num_allocated_pages;
 }
 
-static void release_pages_balloon(struct virtio_balloon *vb)
+static void release_pages_balloon(struct virtio_balloon *vb,
+                                 struct list_head *pages)
 {
-        unsigned int i;
-        struct page *page;
+        struct page *page, *next;
 
-        /* Find pfns pointing at start of each page, get pages and free them. */
-        for (i = 0; i < vb->num_pfns; i += VIRTIO_BALLOON_PAGES_PER_PAGE) {
-                page = balloon_pfn_to_page(virtio32_to_cpu(vb->vdev,
-                                                           vb->pfns[i]));
+        list_for_each_entry_safe(page, next, pages, lru) {
                 if (!virtio_has_feature(vb->vdev,
                                         VIRTIO_BALLOON_F_DEFLATE_ON_OOM))
                         adjust_managed_page_count(page, 1);
+                list_del(&page->lru);
                 put_page(page); /* balloon reference */
         }
 }
@@ -203,6 +197,7 @@ static unsigned leak_balloon(struct virtio_balloon *vb, size_t num)
         unsigned num_freed_pages;
         struct page *page;
         struct balloon_dev_info *vb_dev_info = &vb->vb_dev_info;
+        LIST_HEAD(pages);
 
         /* We can only do one array worth at a time. */
         num = min(num, ARRAY_SIZE(vb->pfns));
@@ -216,6 +211,7 @@ static unsigned leak_balloon(struct virtio_balloon *vb, size_t num)
                 if (!page)
                         break;
                 set_page_pfns(vb, vb->pfns + vb->num_pfns, page);
+                list_add(&page->lru, &pages);
                 vb->num_pages -= VIRTIO_BALLOON_PAGES_PER_PAGE;
         }
 
@@ -227,7 +223,7 @@ static unsigned leak_balloon(struct virtio_balloon *vb, size_t num)
          */
         if (vb->num_pfns != 0)
                 tell_host(vb, vb->deflate_vq);
-        release_pages_balloon(vb);
+        release_pages_balloon(vb, &pages);
         mutex_unlock(&vb->balloon_lock);
         return num_freed_pages;
 }
diff --git a/drivers/virtio/virtio_pci_common.c b/drivers/virtio/virtio_pci_common.c
index 007a4f366086..1c4797e53f68 100644
--- a/drivers/virtio/virtio_pci_common.c
+++ b/drivers/virtio/virtio_pci_common.c
@@ -107,6 +107,7 @@ static int vp_request_msix_vectors(struct virtio_device *vdev, int nvectors,
 {
         struct virtio_pci_device *vp_dev = to_vp_device(vdev);
         const char *name = dev_name(&vp_dev->vdev.dev);
+        unsigned flags = PCI_IRQ_MSIX;
         unsigned i, v;
         int err = -ENOMEM;
 
@@ -126,10 +127,13 @@ static int vp_request_msix_vectors(struct virtio_device *vdev, int nvectors,
                                         GFP_KERNEL))
                         goto error;
 
+        if (desc) {
+                flags |= PCI_IRQ_AFFINITY;
+                desc->pre_vectors++; /* virtio config vector */
+        }
+
         err = pci_alloc_irq_vectors_affinity(vp_dev->pci_dev, nvectors,
-                                             nvectors, PCI_IRQ_MSIX |
-                                             (desc ? PCI_IRQ_AFFINITY : 0),
-                                             desc);
+                                             nvectors, flags, desc);
         if (err < 0)
                 goto error;
         vp_dev->msix_enabled = 1;
diff --git a/drivers/xen/Makefile b/drivers/xen/Makefile
index 8feab810aed9..7f188b8d0c67 100644
--- a/drivers/xen/Makefile
+++ b/drivers/xen/Makefile
@@ -7,9 +7,6 @@ obj-y	+= xenbus/
 nostackp := $(call cc-option, -fno-stack-protector)
 CFLAGS_features.o                       := $(nostackp)
 
-CFLAGS_efi.o                            += -fshort-wchar
-LDFLAGS                                 += $(call ld-option, --no-wchar-size-warning)
-
 dom0-$(CONFIG_ARM64) += arm-device.o
 dom0-$(CONFIG_PCI) += pci.o
 dom0-$(CONFIG_USB_SUPPORT) += dbgp.o
diff --git a/drivers/xen/biomerge.c b/drivers/xen/biomerge.c
index 4da69dbf7dca..1bdd02a6d6ac 100644
--- a/drivers/xen/biomerge.c
+++ b/drivers/xen/biomerge.c
@@ -10,8 +10,7 @@ bool xen_biovec_phys_mergeable(const struct bio_vec *vec1,
         unsigned long bfn1 = pfn_to_bfn(page_to_pfn(vec1->bv_page));
         unsigned long bfn2 = pfn_to_bfn(page_to_pfn(vec2->bv_page));
 
-        return __BIOVEC_PHYS_MERGEABLE(vec1, vec2) &&
-                ((bfn1 == bfn2) || ((bfn1+1) == bfn2));
+        return bfn1 + PFN_DOWN(vec1->bv_offset + vec1->bv_len) == bfn2;
 #else
         /*
          * XXX: Add support for merging bio_vec when using different page
diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c
index b241bfa529ce..2d43118077e4 100644
--- a/drivers/xen/events/events_base.c
+++ b/drivers/xen/events/events_base.c
@@ -343,14 +343,6 @@ static void bind_evtchn_to_cpu(unsigned int chn, unsigned int cpu)
         info->cpu = cpu;
 }
 
-static void xen_evtchn_mask_all(void)
-{
-        unsigned int evtchn;
-
-        for (evtchn = 0; evtchn < xen_evtchn_nr_channels(); evtchn++)
-                mask_evtchn(evtchn);
-}
-
 /**
  * notify_remote_via_irq - send event to remote end of event channel via irq
  * @irq: irq of event channel to send event to
@@ -582,7 +574,7 @@ static void shutdown_pirq(struct irq_data *data)
 
 static void enable_pirq(struct irq_data *data)
 {
-        startup_pirq(data);
+        enable_dynirq(data);
 }
 
 static void disable_pirq(struct irq_data *data)
@@ -1573,7 +1565,6 @@ void xen_irq_resume(void)
         struct irq_info *info;
 
         /* New event-channel space is not 'live' yet. */
-        xen_evtchn_mask_all();
         xen_evtchn_resume();
 
         /* No IRQ <-> event-channel mappings. */
@@ -1681,6 +1672,7 @@ module_param(fifo_events, bool, 0);
 void __init xen_init_IRQ(void)
 {
         int ret = -EINVAL;
+        unsigned int evtchn;
 
         if (fifo_events)
                 ret = xen_evtchn_fifo_init();
@@ -1692,7 +1684,8 @@ void __init xen_init_IRQ(void)
         BUG_ON(!evtchn_to_irq);
 
         /* No event channels are 'live' right now. */
-        xen_evtchn_mask_all();
+        for (evtchn = 0; evtchn < xen_evtchn_nr_channels(); evtchn++)
+                mask_evtchn(evtchn);
 
         pirq_needs_eoi = pirq_needs_eoi_flag;
 
diff --git a/drivers/xen/gntdev.c b/drivers/xen/gntdev.c
index f3bf8f4e2d6c..82360594fa8e 100644
--- a/drivers/xen/gntdev.c
+++ b/drivers/xen/gntdev.c
@@ -484,13 +484,6 @@ static void mn_invl_range_start(struct mmu_notifier *mn,
         mutex_unlock(&priv->lock);
 }
 
-static void mn_invl_page(struct mmu_notifier *mn,
-                         struct mm_struct *mm,
-                         unsigned long address)
-{
-        mn_invl_range_start(mn, mm, address, address + PAGE_SIZE);
-}
-
 static void mn_release(struct mmu_notifier *mn,
                        struct mm_struct *mm)
 {
@@ -522,7 +515,6 @@ static void mn_release(struct mmu_notifier *mn,
 
 static const struct mmu_notifier_ops gntdev_mmu_ops = {
         .release                = mn_release,
-        .invalidate_page        = mn_invl_page,
         .invalidate_range_start = mn_invl_range_start,
 };
 
diff --git a/drivers/xen/xen-selfballoon.c b/drivers/xen/xen-selfballoon.c
index 66620713242a..a67e955cacd1 100644
--- a/drivers/xen/xen-selfballoon.c
+++ b/drivers/xen/xen-selfballoon.c
@@ -151,8 +151,8 @@ static unsigned long frontswap_inertia_counter;
 static void frontswap_selfshrink(void)
 {
         static unsigned long cur_frontswap_pages;
-        static unsigned long last_frontswap_pages;
-        static unsigned long tgt_frontswap_pages;
+        unsigned long last_frontswap_pages;
+        unsigned long tgt_frontswap_pages;
 
         last_frontswap_pages = cur_frontswap_pages;
         cur_frontswap_pages = frontswap_curr_pages();
diff --git a/drivers/xen/xenbus/xenbus_xs.c b/drivers/xen/xenbus/xenbus_xs.c
index e46080214955..3e59590c7254 100644
--- a/drivers/xen/xenbus/xenbus_xs.c
+++ b/drivers/xen/xenbus/xenbus_xs.c
@@ -857,6 +857,8 @@ static int xenwatch_thread(void *unused)
         struct list_head *ent;
         struct xs_watch_event *event;
 
+        xenwatch_pid = current->pid;
+
         for (;;) {
                 wait_event_interruptible(watch_events_waitq,
                                          !list_empty(&watch_events));
@@ -925,7 +927,6 @@ int xs_init(void)
         task = kthread_run(xenwatch_thread, NULL, "xenwatch");
         if (IS_ERR(task))
                 return PTR_ERR(task);
-        xenwatch_pid = task->pid;
 
         /* shutdown watches for kexec boot */
         xs_reset_watches();
diff --git a/drivers/xen/xenfs/super.c b/drivers/xen/xenfs/super.c
index 967f069385d0..71ddfb4cf61c 100644
--- a/drivers/xen/xenfs/super.c
+++ b/drivers/xen/xenfs/super.c
@@ -87,7 +87,6 @@ static int __init xenfs_init(void)
         if (xen_domain())
                 return register_filesystem(&xenfs_type);
 
-        pr_info("not registering filesystem on non-xen platform\n");
         return 0;
 }