534 files changed, 5654 insertions, 3944 deletions

diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c
index 9706613eecf9..bf64cfa30feb 100644
--- a/drivers/acpi/acpi_lpss.c
+++ b/drivers/acpi/acpi_lpss.c
@@ -879,7 +879,7 @@ static void acpi_lpss_dismiss(struct device *dev)
 #define LPSS_GPIODEF0_DMA_LLP           BIT(13)
 
 static DEFINE_MUTEX(lpss_iosf_mutex);
-static bool lpss_iosf_d3_entered;
+static bool lpss_iosf_d3_entered = true;
 
 static void lpss_iosf_enter_d3_state(void)
 {
diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c
index 292088fcc624..d2e29a19890d 100644
--- a/drivers/acpi/bus.c
+++ b/drivers/acpi/bus.c
@@ -35,11 +35,11 @@
 #include <linux/delay.h>
 #ifdef CONFIG_X86
 #include <asm/mpspec.h>
+#include <linux/dmi.h>
 #endif
 #include <linux/acpi_iort.h>
 #include <linux/pci.h>
 #include <acpi/apei.h>
-#include <linux/dmi.h>
 #include <linux/suspend.h>
 
 #include "internal.h"
@@ -82,10 +82,6 @@ static const struct dmi_system_id dsdt_dmi_table[] __initconst = {
         },
         {}
 };
-#else
-static const struct dmi_system_id dsdt_dmi_table[] __initconst = {
-        {}
-};
 #endif
 
 /* --------------------------------------------------------------------------
@@ -1033,11 +1029,16 @@ void __init acpi_early_init(void)
 
         acpi_permanent_mmap = true;
 
+#ifdef CONFIG_X86
         /*
          * If the machine falls into the DMI check table,
-         * DSDT will be copied to memory
+         * DSDT will be copied to memory.
+         * Note that calling dmi_check_system() here on other architectures
+         * would not be OK because only x86 initializes dmi early enough.
+         * Thankfully only x86 systems need such quirks for now.
          */
         dmi_check_system(dsdt_dmi_table);
+#endif
 
         status = acpi_reallocate_root_table();
         if (ACPI_FAILURE(status)) {
diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c
index 3f3b7b253445..64fd96eada31 100644
--- a/drivers/android/binder_alloc.c
+++ b/drivers/android/binder_alloc.c
@@ -332,6 +332,35 @@ err_no_vma:
         return vma ? -ENOMEM : -ESRCH;
 }
 
+
+static inline void binder_alloc_set_vma(struct binder_alloc *alloc,
+                struct vm_area_struct *vma)
+{
+        if (vma)
+                alloc->vma_vm_mm = vma->vm_mm;
+        /*
+         * If we see alloc->vma is not NULL, buffer data structures set up
+         * completely. Look at smp_rmb side binder_alloc_get_vma.
+         * We also want to guarantee new alloc->vma_vm_mm is always visible
+         * if alloc->vma is set.
+         */
+        smp_wmb();
+        alloc->vma = vma;
+}
+
+static inline struct vm_area_struct *binder_alloc_get_vma(
+                struct binder_alloc *alloc)
+{
+        struct vm_area_struct *vma = NULL;
+
+        if (alloc->vma) {
+                /* Look at description in binder_alloc_set_vma */
+                smp_rmb();
+                vma = alloc->vma;
+        }
+        return vma;
+}
+
 static struct binder_buffer *binder_alloc_new_buf_locked(
                                 struct binder_alloc *alloc,
                                 size_t data_size,
@@ -348,7 +377,7 @@ static struct binder_buffer *binder_alloc_new_buf_locked(
         size_t size, data_offsets_size;
         int ret;
 
-        if (alloc->vma == NULL) {
+        if (!binder_alloc_get_vma(alloc)) {
                 binder_alloc_debug(BINDER_DEBUG_USER_ERROR,
                                    "%d: binder_alloc_buf, no vma\n",
                                    alloc->pid);
@@ -723,9 +752,7 @@ int binder_alloc_mmap_handler(struct binder_alloc *alloc,
         buffer->free = 1;
         binder_insert_free_buffer(alloc, buffer);
         alloc->free_async_space = alloc->buffer_size / 2;
-        barrier();
-        alloc->vma = vma;
-        alloc->vma_vm_mm = vma->vm_mm;
+        binder_alloc_set_vma(alloc, vma);
         mmgrab(alloc->vma_vm_mm);
 
         return 0;
@@ -754,10 +781,10 @@ void binder_alloc_deferred_release(struct binder_alloc *alloc)
         int buffers, page_count;
         struct binder_buffer *buffer;
 
-        BUG_ON(alloc->vma);
-
         buffers = 0;
         mutex_lock(&alloc->mutex);
+        BUG_ON(alloc->vma);
+
         while ((n = rb_first(&alloc->allocated_buffers))) {
                 buffer = rb_entry(n, struct binder_buffer, rb_node);
 
@@ -900,7 +927,7 @@ int binder_alloc_get_allocated_count(struct binder_alloc *alloc)
  */
 void binder_alloc_vma_close(struct binder_alloc *alloc)
 {
-        WRITE_ONCE(alloc->vma, NULL);
+        binder_alloc_set_vma(alloc, NULL);
 }
 
 /**
@@ -935,7 +962,7 @@ enum lru_status binder_alloc_free_page(struct list_head *item,
 
         index = page - alloc->pages;
         page_addr = (uintptr_t)alloc->buffer + index * PAGE_SIZE;
-        vma = alloc->vma;
+        vma = binder_alloc_get_vma(alloc);
         if (vma) {
                 if (!mmget_not_zero(alloc->vma_vm_mm))
                         goto err_mmget;
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 172e32840256..a9dd4ea7467d 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -5359,10 +5359,20 @@ void ata_qc_complete(struct ata_queued_cmd *qc)
  */
 int ata_qc_complete_multiple(struct ata_port *ap, u64 qc_active)
 {
+        u64 done_mask, ap_qc_active = ap->qc_active;
         int nr_done = 0;
-        u64 done_mask;
 
-        done_mask = ap->qc_active ^ qc_active;
+        /*
+         * If the internal tag is set on ap->qc_active, then we care about
+         * bit0 on the passed in qc_active mask. Move that bit up to match
+         * the internal tag.
+         */
+        if (ap_qc_active & (1ULL << ATA_TAG_INTERNAL)) {
+                qc_active |= (qc_active & 0x01) << ATA_TAG_INTERNAL;
+                qc_active ^= qc_active & 0x01;
+        }
+
+        done_mask = ap_qc_active ^ qc_active;
 
         if (unlikely(done_mask & qc_active)) {
                 ata_port_err(ap, "illegal qc_active transition (%08llx->%08llx)\n",
@@ -7394,4 +7404,4 @@ EXPORT_SYMBOL_GPL(ata_cable_unknown);
 EXPORT_SYMBOL_GPL(ata_cable_ignore);
 EXPORT_SYMBOL_GPL(ata_cable_sata);
 EXPORT_SYMBOL_GPL(ata_host_get);
-EXPORT_SYMBOL_GPL(ata_host_put);
\ No newline at end of file
+EXPORT_SYMBOL_GPL(ata_host_put);
diff --git a/drivers/ata/pata_ftide010.c b/drivers/ata/pata_ftide010.c
index 5d4b72e21161..569a4a662dcd 100644
--- a/drivers/ata/pata_ftide010.c
+++ b/drivers/ata/pata_ftide010.c
@@ -256,14 +256,12 @@ static struct ata_port_operations pata_ftide010_port_ops = {
         .qc_issue       = ftide010_qc_issue,
 };
 
-static struct ata_port_info ftide010_port_info[] = {
-        {
-                .flags          = ATA_FLAG_SLAVE_POSS,
-                .mwdma_mask     = ATA_MWDMA2,
-                .udma_mask      = ATA_UDMA6,
-                .pio_mask       = ATA_PIO4,
-                .port_ops       = &pata_ftide010_port_ops,
-        },
+static struct ata_port_info ftide010_port_info = {
+        .flags          = ATA_FLAG_SLAVE_POSS,
+        .mwdma_mask     = ATA_MWDMA2,
+        .udma_mask      = ATA_UDMA6,
+        .pio_mask       = ATA_PIO4,
+        .port_ops       = &pata_ftide010_port_ops,
 };
 
 #if IS_ENABLED(CONFIG_SATA_GEMINI)
@@ -349,6 +347,7 @@ static int pata_ftide010_gemini_cable_detect(struct ata_port *ap)
 }
 
 static int pata_ftide010_gemini_init(struct ftide010 *ftide,
+                                     struct ata_port_info *pi,
                                      bool is_ata1)
 {
         struct device *dev = ftide->dev;
@@ -373,7 +372,13 @@ static int pata_ftide010_gemini_init(struct ftide010 *ftide,
 
         /* Flag port as SATA-capable */
         if (gemini_sata_bridge_enabled(sg, is_ata1))
-                ftide010_port_info[0].flags |= ATA_FLAG_SATA;
+                pi->flags |= ATA_FLAG_SATA;
+
+        /* This device has broken DMA, only PIO works */
+        if (of_machine_is_compatible("itian,sq201")) {
+                pi->mwdma_mask = 0;
+                pi->udma_mask = 0;
+        }
 
         /*
          * We assume that a simple 40-wire cable is used in the PATA mode.
@@ -435,6 +440,7 @@ static int pata_ftide010_gemini_init(struct ftide010 *ftide,
 }
 #else
 static int pata_ftide010_gemini_init(struct ftide010 *ftide,
+                                     struct ata_port_info *pi,
                                      bool is_ata1)
 {
         return -ENOTSUPP;
@@ -446,7 +452,7 @@ static int pata_ftide010_probe(struct platform_device *pdev)
 {
         struct device *dev = &pdev->dev;
         struct device_node *np = dev->of_node;
-        const struct ata_port_info pi = ftide010_port_info[0];
+        struct ata_port_info pi = ftide010_port_info;
         const struct ata_port_info *ppi[] = { &pi, NULL };
         struct ftide010 *ftide;
         struct resource *res;
@@ -490,6 +496,7 @@ static int pata_ftide010_probe(struct platform_device *pdev)
                  * are ATA0. This will also set up the cable types.
                  */
                 ret = pata_ftide010_gemini_init(ftide,
+                                &pi,
                                 (res->start == 0x63400000));
                 if (ret)
                         goto err_dis_clk;
diff --git a/drivers/base/firmware_loader/main.c b/drivers/base/firmware_loader/main.c
index 0943e7065e0e..b3c0498ee433 100644
--- a/drivers/base/firmware_loader/main.c
+++ b/drivers/base/firmware_loader/main.c
@@ -209,21 +209,24 @@ static struct fw_priv *__lookup_fw_priv(const char *fw_name)
 static int alloc_lookup_fw_priv(const char *fw_name,
                                 struct firmware_cache *fwc,
                                 struct fw_priv **fw_priv, void *dbuf,
-                                size_t size)
+                                size_t size, enum fw_opt opt_flags)
 {
         struct fw_priv *tmp;
 
         spin_lock(&fwc->lock);
-        tmp = __lookup_fw_priv(fw_name);
-        if (tmp) {
-                kref_get(&tmp->ref);
-                spin_unlock(&fwc->lock);
-                *fw_priv = tmp;
-                pr_debug("batched request - sharing the same struct fw_priv and lookup for multiple requests\n");
-                return 1;
+        if (!(opt_flags & FW_OPT_NOCACHE)) {
+                tmp = __lookup_fw_priv(fw_name);
+                if (tmp) {
+                        kref_get(&tmp->ref);
+                        spin_unlock(&fwc->lock);
+                        *fw_priv = tmp;
+                        pr_debug("batched request - sharing the same struct fw_priv and lookup for multiple requests\n");
+                        return 1;
+                }
         }
+
         tmp = __allocate_fw_priv(fw_name, fwc, dbuf, size);
-        if (tmp)
+        if (tmp && !(opt_flags & FW_OPT_NOCACHE))
                 list_add(&tmp->list, &fwc->head);
         spin_unlock(&fwc->lock);
 
@@ -493,7 +496,8 @@ int assign_fw(struct firmware *fw, struct device *device,
  */
 static int
 _request_firmware_prepare(struct firmware **firmware_p, const char *name,
-                          struct device *device, void *dbuf, size_t size)
+                          struct device *device, void *dbuf, size_t size,
+                          enum fw_opt opt_flags)
 {
         struct firmware *firmware;
         struct fw_priv *fw_priv;
@@ -511,7 +515,8 @@ _request_firmware_prepare(struct firmware **firmware_p, const char *name,
                 return 0; /* assigned */
         }
 
-        ret = alloc_lookup_fw_priv(name, &fw_cache, &fw_priv, dbuf, size);
+        ret = alloc_lookup_fw_priv(name, &fw_cache, &fw_priv, dbuf, size,
+                                  opt_flags);
 
         /*
          * bind with 'priv' now to avoid warning in failure path
@@ -571,7 +576,8 @@ _request_firmware(const struct firmware **firmware_p, const char *name,
                 goto out;
         }
 
-        ret = _request_firmware_prepare(&fw, name, device, buf, size);
+        ret = _request_firmware_prepare(&fw, name, device, buf, size,
+                                        opt_flags);
         if (ret <= 0) /* error or already assigned */
                 goto out;
 
diff --git a/drivers/base/memory.c b/drivers/base/memory.c
index c8a1cb0b6136..817320c7c4c1 100644
--- a/drivers/base/memory.c
+++ b/drivers/base/memory.c
@@ -417,25 +417,23 @@ static ssize_t show_valid_zones(struct device *dev,
         int nid;
 
         /*
-         * The block contains more than one zone can not be offlined.
-         * This can happen e.g. for ZONE_DMA and ZONE_DMA32
-         */
-        if (!test_pages_in_a_zone(start_pfn, start_pfn + nr_pages, &valid_start_pfn, &valid_end_pfn))
-                return sprintf(buf, "none\n");
-
-        start_pfn = valid_start_pfn;
-        nr_pages = valid_end_pfn - start_pfn;
-
-        /*
          * Check the existing zone. Make sure that we do that only on the
          * online nodes otherwise the page_zone is not reliable
          */
         if (mem->state == MEM_ONLINE) {
+                /*
+                 * The block contains more than one zone can not be offlined.
+                 * This can happen e.g. for ZONE_DMA and ZONE_DMA32
+                 */
+                if (!test_pages_in_a_zone(start_pfn, start_pfn + nr_pages,
+                                          &valid_start_pfn, &valid_end_pfn))
+                        return sprintf(buf, "none\n");
+                start_pfn = valid_start_pfn;
                 strcat(buf, page_zone(pfn_to_page(start_pfn))->name);
                 goto out;
         }
 
-        nid = pfn_to_nid(start_pfn);
+        nid = mem->nid;
         default_zone = zone_for_pfn_range(MMOP_ONLINE_KEEP, nid, start_pfn, nr_pages);
         strcat(buf, default_zone->name);
 
diff --git a/drivers/base/power/clock_ops.c b/drivers/base/power/clock_ops.c
index 8e2e4757adcb..5a42ae4078c2 100644
--- a/drivers/base/power/clock_ops.c
+++ b/drivers/base/power/clock_ops.c
@@ -185,7 +185,7 @@ EXPORT_SYMBOL_GPL(of_pm_clk_add_clk);
 int of_pm_clk_add_clks(struct device *dev)
 {
         struct clk **clks;
-        unsigned int i, count;
+        int i, count;
         int ret;
 
         if (!dev || !dev->of_node)
diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index 48f622728ce6..f2b6f4da1034 100644
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -3467,6 +3467,9 @@ static int fd_locked_ioctl(struct block_device *bdev, fmode_t mode, unsigned int
                                           (struct floppy_struct **)&outparam);
                 if (ret)
                         return ret;
+                memcpy(&inparam.g, outparam,
+                                offsetof(struct floppy_struct, name));
+                outparam = &inparam.g;
                 break;
         case FDMSGON:
                 UDP->flags |= FTD_MSG;
diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index 3863c00372bb..14a51254c3db 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -1239,6 +1239,9 @@ static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *nbd,
         case NBD_SET_SOCK:
                 return nbd_add_socket(nbd, arg, false);
         case NBD_SET_BLKSIZE:
+                if (!arg || !is_power_of_2(arg) || arg < 512 ||
+                    arg > PAGE_SIZE)
+                        return -EINVAL;
                 nbd_size_set(nbd, arg,
                              div_s64(config->bytesize, arg));
                 return 0;
diff --git a/drivers/block/null_blk.h b/drivers/block/null_blk.h
index d81781f22dba..34e0030f0592 100644
--- a/drivers/block/null_blk.h
+++ b/drivers/block/null_blk.h
@@ -87,10 +87,10 @@ struct nullb {
 #ifdef CONFIG_BLK_DEV_ZONED
 int null_zone_init(struct nullb_device *dev);
 void null_zone_exit(struct nullb_device *dev);
-blk_status_t null_zone_report(struct nullb *nullb,
-                                            struct nullb_cmd *cmd);
-void null_zone_write(struct nullb_cmd *cmd);
-void null_zone_reset(struct nullb_cmd *cmd);
+blk_status_t null_zone_report(struct nullb *nullb, struct bio *bio);
+void null_zone_write(struct nullb_cmd *cmd, sector_t sector,
+                        unsigned int nr_sectors);
+void null_zone_reset(struct nullb_cmd *cmd, sector_t sector);
 #else
 static inline int null_zone_init(struct nullb_device *dev)
 {
@@ -98,11 +98,14 @@ static inline int null_zone_init(struct nullb_device *dev)
 }
 static inline void null_zone_exit(struct nullb_device *dev) {}
 static inline blk_status_t null_zone_report(struct nullb *nullb,
-                                            struct nullb_cmd *cmd)
+                                            struct bio *bio)
 {
         return BLK_STS_NOTSUPP;
 }
-static inline void null_zone_write(struct nullb_cmd *cmd) {}
-static inline void null_zone_reset(struct nullb_cmd *cmd) {}
+static inline void null_zone_write(struct nullb_cmd *cmd, sector_t sector,
+                                   unsigned int nr_sectors)
+{
+}
+static inline void null_zone_reset(struct nullb_cmd *cmd, sector_t sector) {}
 #endif /* CONFIG_BLK_DEV_ZONED */
 #endif /* __NULL_BLK_H */
diff --git a/drivers/block/null_blk_main.c b/drivers/block/null_blk_main.c
index 6127e3ff7b4b..093b614d6524 100644
--- a/drivers/block/null_blk_main.c
+++ b/drivers/block/null_blk_main.c
@@ -1157,16 +1157,33 @@ static void null_restart_queue_async(struct nullb *nullb)
         }
 }
 
+static bool cmd_report_zone(struct nullb *nullb, struct nullb_cmd *cmd)
+{
+        struct nullb_device *dev = cmd->nq->dev;
+
+        if (dev->queue_mode == NULL_Q_BIO) {
+                if (bio_op(cmd->bio) == REQ_OP_ZONE_REPORT) {
+                        cmd->error = null_zone_report(nullb, cmd->bio);
+                        return true;
+                }
+        } else {
+                if (req_op(cmd->rq) == REQ_OP_ZONE_REPORT) {
+                        cmd->error = null_zone_report(nullb, cmd->rq->bio);
+                        return true;
+                }
+        }
+
+        return false;
+}
+
 static blk_status_t null_handle_cmd(struct nullb_cmd *cmd)
 {
         struct nullb_device *dev = cmd->nq->dev;
         struct nullb *nullb = dev->nullb;
         int err = 0;
 
-        if (req_op(cmd->rq) == REQ_OP_ZONE_REPORT) {
-                cmd->error = null_zone_report(nullb, cmd);
+        if (cmd_report_zone(nullb, cmd))
                 goto out;
-        }
 
         if (test_bit(NULLB_DEV_FL_THROTTLED, &dev->flags)) {
                 struct request *rq = cmd->rq;
@@ -1234,10 +1251,24 @@ static blk_status_t null_handle_cmd(struct nullb_cmd *cmd)
         cmd->error = errno_to_blk_status(err);
 
         if (!cmd->error && dev->zoned) {
-                if (req_op(cmd->rq) == REQ_OP_WRITE)
-                        null_zone_write(cmd);
-                else if (req_op(cmd->rq) == REQ_OP_ZONE_RESET)
-                        null_zone_reset(cmd);
+                sector_t sector;
+                unsigned int nr_sectors;
+                int op;
+
+                if (dev->queue_mode == NULL_Q_BIO) {
+                        op = bio_op(cmd->bio);
+                        sector = cmd->bio->bi_iter.bi_sector;
+                        nr_sectors = cmd->bio->bi_iter.bi_size >> 9;
+                } else {
+                        op = req_op(cmd->rq);
+                        sector = blk_rq_pos(cmd->rq);
+                        nr_sectors = blk_rq_sectors(cmd->rq);
+                }
+
+                if (op == REQ_OP_WRITE)
+                        null_zone_write(cmd, sector, nr_sectors);
+                else if (op == REQ_OP_ZONE_RESET)
+                        null_zone_reset(cmd, sector);
         }
 out:
         /* Complete IO by inline, softirq or timer */
diff --git a/drivers/block/null_blk_zoned.c b/drivers/block/null_blk_zoned.c
index a979ca00d7be..7c6b86d98700 100644
--- a/drivers/block/null_blk_zoned.c
+++ b/drivers/block/null_blk_zoned.c
@@ -48,8 +48,8 @@ void null_zone_exit(struct nullb_device *dev)
         kvfree(dev->zones);
 }
 
-static void null_zone_fill_rq(struct nullb_device *dev, struct request *rq,
-                              unsigned int zno, unsigned int nr_zones)
+static void null_zone_fill_bio(struct nullb_device *dev, struct bio *bio,
+                               unsigned int zno, unsigned int nr_zones)
 {
         struct blk_zone_report_hdr *hdr = NULL;
         struct bio_vec bvec;
@@ -57,7 +57,7 @@ static void null_zone_fill_rq(struct nullb_device *dev, struct request *rq,
         void *addr;
         unsigned int zones_to_cpy;
 
-        bio_for_each_segment(bvec, rq->bio, iter) {
+        bio_for_each_segment(bvec, bio, iter) {
                 addr = kmap_atomic(bvec.bv_page);
 
                 zones_to_cpy = bvec.bv_len / sizeof(struct blk_zone);
@@ -84,29 +84,24 @@ static void null_zone_fill_rq(struct nullb_device *dev, struct request *rq,
         }
 }
 
-blk_status_t null_zone_report(struct nullb *nullb,
-                                     struct nullb_cmd *cmd)
+blk_status_t null_zone_report(struct nullb *nullb, struct bio *bio)
 {
         struct nullb_device *dev = nullb->dev;
-        struct request *rq = cmd->rq;
-        unsigned int zno = null_zone_no(dev, blk_rq_pos(rq));
+        unsigned int zno = null_zone_no(dev, bio->bi_iter.bi_sector);
         unsigned int nr_zones = dev->nr_zones - zno;
-        unsigned int max_zones = (blk_rq_bytes(rq) /
-                                        sizeof(struct blk_zone)) - 1;
+        unsigned int max_zones;
 
+        max_zones = (bio->bi_iter.bi_size / sizeof(struct blk_zone)) - 1;
         nr_zones = min_t(unsigned int, nr_zones, max_zones);
-
-        null_zone_fill_rq(nullb->dev, rq, zno, nr_zones);
+        null_zone_fill_bio(nullb->dev, bio, zno, nr_zones);
 
         return BLK_STS_OK;
 }
 
-void null_zone_write(struct nullb_cmd *cmd)
+void null_zone_write(struct nullb_cmd *cmd, sector_t sector,
+                     unsigned int nr_sectors)
 {
         struct nullb_device *dev = cmd->nq->dev;
-        struct request *rq = cmd->rq;
-        sector_t sector = blk_rq_pos(rq);
-        unsigned int rq_sectors = blk_rq_sectors(rq);
         unsigned int zno = null_zone_no(dev, sector);
         struct blk_zone *zone = &dev->zones[zno];
 
@@ -118,7 +113,7 @@ void null_zone_write(struct nullb_cmd *cmd)
         case BLK_ZONE_COND_EMPTY:
         case BLK_ZONE_COND_IMP_OPEN:
                 /* Writes must be at the write pointer position */
-                if (blk_rq_pos(rq) != zone->wp) {
+                if (sector != zone->wp) {
                         cmd->error = BLK_STS_IOERR;
                         break;
                 }
@@ -126,7 +121,7 @@ void null_zone_write(struct nullb_cmd *cmd)
                 if (zone->cond == BLK_ZONE_COND_EMPTY)
                         zone->cond = BLK_ZONE_COND_IMP_OPEN;
 
-                zone->wp += rq_sectors;
+                zone->wp += nr_sectors;
                 if (zone->wp == zone->start + zone->len)
                         zone->cond = BLK_ZONE_COND_FULL;
                 break;
@@ -137,11 +132,10 @@ void null_zone_write(struct nullb_cmd *cmd)
         }
 }
 
-void null_zone_reset(struct nullb_cmd *cmd)
+void null_zone_reset(struct nullb_cmd *cmd, sector_t sector)
 {
         struct nullb_device *dev = cmd->nq->dev;
-        struct request *rq = cmd->rq;
-        unsigned int zno = null_zone_no(dev, blk_rq_pos(rq));
+        unsigned int zno = null_zone_no(dev, sector);
         struct blk_zone *zone = &dev->zones[zno];
 
         zone->cond = BLK_ZONE_COND_EMPTY;
diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
index 7915f3b03736..73ed5f3a862d 100644
--- a/drivers/block/rbd.c
+++ b/drivers/block/rbd.c
@@ -4207,11 +4207,13 @@ static ssize_t rbd_parent_show(struct device *dev,
 
                 count += sprintf(&buf[count], "%s"
                             "pool_id %llu\npool_name %s\n"
+                            "pool_ns %s\n"
                             "image_id %s\nimage_name %s\n"
                             "snap_id %llu\nsnap_name %s\n"
                             "overlap %llu\n",
                             !count ? "" : "\n", /* first? */
                             spec->pool_id, spec->pool_name,
+                            spec->pool_ns ?: "",
                             spec->image_id, spec->image_name ?: "(unknown)",
                             spec->snap_id, spec->snap_name,
                             rbd_dev->parent_overlap);
@@ -4584,47 +4586,177 @@ static int rbd_dev_v2_features(struct rbd_device *rbd_dev)
                                                 &rbd_dev->header.features);
 }
 
+struct parent_image_info {
+        u64             pool_id;
+        const char      *pool_ns;
+        const char      *image_id;
+        u64             snap_id;
+
+        bool            has_overlap;
+        u64             overlap;
+};
+
+/*
+ * The caller is responsible for @pii.
+ */
+static int decode_parent_image_spec(void **p, void *end,
+                                    struct parent_image_info *pii)
+{
+        u8 struct_v;
+        u32 struct_len;
+        int ret;
+
+        ret = ceph_start_decoding(p, end, 1, "ParentImageSpec",
+                                  &struct_v, &struct_len);
+        if (ret)
+                return ret;
+
+        ceph_decode_64_safe(p, end, pii->pool_id, e_inval);
+        pii->pool_ns = ceph_extract_encoded_string(p, end, NULL, GFP_KERNEL);
+        if (IS_ERR(pii->pool_ns)) {
+                ret = PTR_ERR(pii->pool_ns);
+                pii->pool_ns = NULL;
+                return ret;
+        }
+        pii->image_id = ceph_extract_encoded_string(p, end, NULL, GFP_KERNEL);
+        if (IS_ERR(pii->image_id)) {
+                ret = PTR_ERR(pii->image_id);
+                pii->image_id = NULL;
+                return ret;
+        }
+        ceph_decode_64_safe(p, end, pii->snap_id, e_inval);
+        return 0;
+
+e_inval:
+        return -EINVAL;
+}
+
+static int __get_parent_info(struct rbd_device *rbd_dev,
+                             struct page *req_page,
+                             struct page *reply_page,
+                             struct parent_image_info *pii)
+{
+        struct ceph_osd_client *osdc = &rbd_dev->rbd_client->client->osdc;
+        size_t reply_len = PAGE_SIZE;
+        void *p, *end;
+        int ret;
+
+        ret = ceph_osdc_call(osdc, &rbd_dev->header_oid, &rbd_dev->header_oloc,
+                             "rbd", "parent_get", CEPH_OSD_FLAG_READ,
+                             req_page, sizeof(u64), reply_page, &reply_len);
+        if (ret)
+                return ret == -EOPNOTSUPP ? 1 : ret;
+
+        p = page_address(reply_page);
+        end = p + reply_len;
+        ret = decode_parent_image_spec(&p, end, pii);
+        if (ret)
+                return ret;
+
+        ret = ceph_osdc_call(osdc, &rbd_dev->header_oid, &rbd_dev->header_oloc,
+                             "rbd", "parent_overlap_get", CEPH_OSD_FLAG_READ,
+                             req_page, sizeof(u64), reply_page, &reply_len);
+        if (ret)
+                return ret;
+
+        p = page_address(reply_page);
+        end = p + reply_len;
+        ceph_decode_8_safe(&p, end, pii->has_overlap, e_inval);
+        if (pii->has_overlap)
+                ceph_decode_64_safe(&p, end, pii->overlap, e_inval);
+
+        return 0;
+
+e_inval:
+        return -EINVAL;
+}
+
+/*
+ * The caller is responsible for @pii.
+ */
+static int __get_parent_info_legacy(struct rbd_device *rbd_dev,
+                                    struct page *req_page,
+                                    struct page *reply_page,
+                                    struct parent_image_info *pii)
+{
+        struct ceph_osd_client *osdc = &rbd_dev->rbd_client->client->osdc;
+        size_t reply_len = PAGE_SIZE;
+        void *p, *end;
+        int ret;
+
+        ret = ceph_osdc_call(osdc, &rbd_dev->header_oid, &rbd_dev->header_oloc,
+                             "rbd", "get_parent", CEPH_OSD_FLAG_READ,
+                             req_page, sizeof(u64), reply_page, &reply_len);
+        if (ret)
+                return ret;
+
+        p = page_address(reply_page);
+        end = p + reply_len;
+        ceph_decode_64_safe(&p, end, pii->pool_id, e_inval);
+        pii->image_id = ceph_extract_encoded_string(&p, end, NULL, GFP_KERNEL);
+        if (IS_ERR(pii->image_id)) {
+                ret = PTR_ERR(pii->image_id);
+                pii->image_id = NULL;
+                return ret;
+        }
+        ceph_decode_64_safe(&p, end, pii->snap_id, e_inval);
+        pii->has_overlap = true;
+        ceph_decode_64_safe(&p, end, pii->overlap, e_inval);
+
+        return 0;
+
+e_inval:
+        return -EINVAL;
+}
+
+static int get_parent_info(struct rbd_device *rbd_dev,
+                           struct parent_image_info *pii)
+{
+        struct page *req_page, *reply_page;
+        void *p;
+        int ret;
+
+        req_page = alloc_page(GFP_KERNEL);
+        if (!req_page)
+                return -ENOMEM;
+
+        reply_page = alloc_page(GFP_KERNEL);
+        if (!reply_page) {
+                __free_page(req_page);
+                return -ENOMEM;
+        }
+
+        p = page_address(req_page);
+        ceph_encode_64(&p, rbd_dev->spec->snap_id);
+        ret = __get_parent_info(rbd_dev, req_page, reply_page, pii);
+        if (ret > 0)
+                ret = __get_parent_info_legacy(rbd_dev, req_page, reply_page,
+                                               pii);
+
+        __free_page(req_page);
+        __free_page(reply_page);
+        return ret;
+}
+
 static int rbd_dev_v2_parent_info(struct rbd_device *rbd_dev)
 {
         struct rbd_spec *parent_spec;
-        size_t size;
-        void *reply_buf = NULL;
-        __le64 snapid;
-        void *p;
-        void *end;
-        u64 pool_id;
-        char *image_id;
-        u64 snap_id;
-        u64 overlap;
+        struct parent_image_info pii = { 0 };
         int ret;
 
         parent_spec = rbd_spec_alloc();
         if (!parent_spec)
                 return -ENOMEM;
 
-        size = sizeof (__le64) +                                /* pool_id */
-                sizeof (__le32) + RBD_IMAGE_ID_LEN_MAX +        /* image_id */
-                sizeof (__le64) +                               /* snap_id */
-                sizeof (__le64);                                /* overlap */
-        reply_buf = kmalloc(size, GFP_KERNEL);
-        if (!reply_buf) {
-                ret = -ENOMEM;
+        ret = get_parent_info(rbd_dev, &pii);
+        if (ret)
                 goto out_err;
-        }
 
-        snapid = cpu_to_le64(rbd_dev->spec->snap_id);
-        ret = rbd_obj_method_sync(rbd_dev, &rbd_dev->header_oid,
-                                  &rbd_dev->header_oloc, "get_parent",
-                                  &snapid, sizeof(snapid), reply_buf, size);
-        dout("%s: rbd_obj_method_sync returned %d\n", __func__, ret);
-        if (ret < 0)
-                goto out_err;
+        dout("%s pool_id %llu pool_ns %s image_id %s snap_id %llu has_overlap %d overlap %llu\n",
+             __func__, pii.pool_id, pii.pool_ns, pii.image_id, pii.snap_id,
+             pii.has_overlap, pii.overlap);
 
-        p = reply_buf;
-        end = reply_buf + ret;
-        ret = -ERANGE;
-        ceph_decode_64_safe(&p, end, pool_id, out_err);
-        if (pool_id == CEPH_NOPOOL) {
+        if (pii.pool_id == CEPH_NOPOOL || !pii.has_overlap) {
                 /*
                  * Either the parent never existed, or we have
                  * record of it but the image got flattened so it no
@@ -4633,6 +4765,10 @@ static int rbd_dev_v2_parent_info(struct rbd_device *rbd_dev)
                  * overlap to 0.  The effect of this is that all new
                  * requests will be treated as if the image had no
                  * parent.
+                 *
+                 * If !pii.has_overlap, the parent image spec is not
+                 * applicable.  It's there to avoid duplication in each
+                 * snapshot record.
                  */
                 if (rbd_dev->parent_overlap) {
                         rbd_dev->parent_overlap = 0;
@@ -4647,51 +4783,36 @@ static int rbd_dev_v2_parent_info(struct rbd_device *rbd_dev)
         /* The ceph file layout needs to fit pool id in 32 bits */
 
         ret = -EIO;
-        if (pool_id > (u64)U32_MAX) {
+        if (pii.pool_id > (u64)U32_MAX) {
                 rbd_warn(NULL, "parent pool id too large (%llu > %u)",
-                        (unsigned long long)pool_id, U32_MAX);
+                        (unsigned long long)pii.pool_id, U32_MAX);
                 goto out_err;
         }
 
-        image_id = ceph_extract_encoded_string(&p, end, NULL, GFP_KERNEL);
-        if (IS_ERR(image_id)) {
-                ret = PTR_ERR(image_id);
-                goto out_err;
-        }
-        ceph_decode_64_safe(&p, end, snap_id, out_err);
-        ceph_decode_64_safe(&p, end, overlap, out_err);
-
         /*
          * The parent won't change (except when the clone is
          * flattened, already handled that).  So we only need to
          * record the parent spec we have not already done so.
          */
         if (!rbd_dev->parent_spec) {
-                parent_spec->pool_id = pool_id;
-                parent_spec->image_id = image_id;
-                parent_spec->snap_id = snap_id;
-
-                /* TODO: support cloning across namespaces */
-                if (rbd_dev->spec->pool_ns) {
-                        parent_spec->pool_ns = kstrdup(rbd_dev->spec->pool_ns,
-                                                       GFP_KERNEL);
-                        if (!parent_spec->pool_ns) {
-                                ret = -ENOMEM;
-                                goto out_err;
-                        }
+                parent_spec->pool_id = pii.pool_id;
+                if (pii.pool_ns && *pii.pool_ns) {
+                        parent_spec->pool_ns = pii.pool_ns;
+                        pii.pool_ns = NULL;
                 }
+                parent_spec->image_id = pii.image_id;
+                pii.image_id = NULL;
+                parent_spec->snap_id = pii.snap_id;
 
                 rbd_dev->parent_spec = parent_spec;
                 parent_spec = NULL;     /* rbd_dev now owns this */
-        } else {
-                kfree(image_id);
         }
 
         /*
          * We always update the parent overlap.  If it's zero we issue
          * a warning, as we will proceed as if there was no parent.
          */
-        if (!overlap) {
+        if (!pii.overlap) {
                 if (parent_spec) {
                         /* refresh, careful to warn just once */
                         if (rbd_dev->parent_overlap)
@@ -4702,14 +4823,14 @@ static int rbd_dev_v2_parent_info(struct rbd_device *rbd_dev)
                         rbd_warn(rbd_dev, "clone is standalone (overlap 0)");
                 }
         }
-        rbd_dev->parent_overlap = overlap;
+        rbd_dev->parent_overlap = pii.overlap;
 
 out:
         ret = 0;
 out_err:
-        kfree(reply_buf);
+        kfree(pii.pool_ns);
+        kfree(pii.image_id);
         rbd_spec_put(parent_spec);
-
         return ret;
 }
 
diff --git a/drivers/block/xen-blkback/blkback.c b/drivers/block/xen-blkback/blkback.c
index b55b245e8052..fd1e19f1a49f 100644
--- a/drivers/block/xen-blkback/blkback.c
+++ b/drivers/block/xen-blkback/blkback.c
@@ -84,6 +84,18 @@ MODULE_PARM_DESC(max_persistent_grants,
                  "Maximum number of grants to map persistently");
 
 /*
+ * How long a persistent grant is allowed to remain allocated without being in
+ * use. The time is in seconds, 0 means indefinitely long.
+ */
+
+static unsigned int xen_blkif_pgrant_timeout = 60;
+module_param_named(persistent_grant_unused_seconds, xen_blkif_pgrant_timeout,
+                   uint, 0644);
+MODULE_PARM_DESC(persistent_grant_unused_seconds,
+                 "Time in seconds an unused persistent grant is allowed to "
+                 "remain allocated. Default is 60, 0 means unlimited.");
+
+/*
  * Maximum number of rings/queues blkback supports, allow as many queues as there
  * are CPUs if user has not specified a value.
  */
@@ -123,6 +135,13 @@ module_param(log_stats, int, 0644);
 /* Number of free pages to remove on each call to gnttab_free_pages */
 #define NUM_BATCH_FREE_PAGES 10
 
+static inline bool persistent_gnt_timeout(struct persistent_gnt *persistent_gnt)
+{
+        return xen_blkif_pgrant_timeout &&
+               (jiffies - persistent_gnt->last_used >=
+                HZ * xen_blkif_pgrant_timeout);
+}
+
 static inline int get_free_page(struct xen_blkif_ring *ring, struct page **page)
 {
         unsigned long flags;
@@ -236,8 +255,7 @@ static int add_persistent_gnt(struct xen_blkif_ring *ring,
                 }
         }
 
-        bitmap_zero(persistent_gnt->flags, PERSISTENT_GNT_FLAGS_SIZE);
-        set_bit(PERSISTENT_GNT_ACTIVE, persistent_gnt->flags);
+        persistent_gnt->active = true;
         /* Add new node and rebalance tree. */
         rb_link_node(&(persistent_gnt->node), parent, new);
         rb_insert_color(&(persistent_gnt->node), &ring->persistent_gnts);
@@ -261,11 +279,11 @@ static struct persistent_gnt *get_persistent_gnt(struct xen_blkif_ring *ring,
                 else if (gref > data->gnt)
                         node = node->rb_right;
                 else {
-                        if(test_bit(PERSISTENT_GNT_ACTIVE, data->flags)) {
+                        if (data->active) {
                                 pr_alert_ratelimited("requesting a grant already in use\n");
                                 return NULL;
                         }
-                        set_bit(PERSISTENT_GNT_ACTIVE, data->flags);
+                        data->active = true;
                         atomic_inc(&ring->persistent_gnt_in_use);
                         return data;
                 }
@@ -276,10 +294,10 @@ static struct persistent_gnt *get_persistent_gnt(struct xen_blkif_ring *ring,
 static void put_persistent_gnt(struct xen_blkif_ring *ring,
                                struct persistent_gnt *persistent_gnt)
 {
-        if(!test_bit(PERSISTENT_GNT_ACTIVE, persistent_gnt->flags))
+        if (!persistent_gnt->active)
                 pr_alert_ratelimited("freeing a grant already unused\n");
-        set_bit(PERSISTENT_GNT_WAS_ACTIVE, persistent_gnt->flags);
-        clear_bit(PERSISTENT_GNT_ACTIVE, persistent_gnt->flags);
+        persistent_gnt->last_used = jiffies;
+        persistent_gnt->active = false;
         atomic_dec(&ring->persistent_gnt_in_use);
 }
 
@@ -371,26 +389,26 @@ static void purge_persistent_gnt(struct xen_blkif_ring *ring)
         struct persistent_gnt *persistent_gnt;
         struct rb_node *n;
         unsigned int num_clean, total;
-        bool scan_used = false, clean_used = false;
+        bool scan_used = false;
         struct rb_root *root;
 
-        if (ring->persistent_gnt_c < xen_blkif_max_pgrants ||
-            (ring->persistent_gnt_c == xen_blkif_max_pgrants &&
-            !ring->blkif->vbd.overflow_max_grants)) {
-                goto out;
-        }
-
         if (work_busy(&ring->persistent_purge_work)) {
                 pr_alert_ratelimited("Scheduled work from previous purge is still busy, cannot purge list\n");
                 goto out;
         }
 
-        num_clean = (xen_blkif_max_pgrants / 100) * LRU_PERCENT_CLEAN;
-        num_clean = ring->persistent_gnt_c - xen_blkif_max_pgrants + num_clean;
-        num_clean = min(ring->persistent_gnt_c, num_clean);
-        if ((num_clean == 0) ||
-            (num_clean > (ring->persistent_gnt_c - atomic_read(&ring->persistent_gnt_in_use))))
-                goto out;
+        if (ring->persistent_gnt_c < xen_blkif_max_pgrants ||
+            (ring->persistent_gnt_c == xen_blkif_max_pgrants &&
+            !ring->blkif->vbd.overflow_max_grants)) {
+                num_clean = 0;
+        } else {
+                num_clean = (xen_blkif_max_pgrants / 100) * LRU_PERCENT_CLEAN;
+                num_clean = ring->persistent_gnt_c - xen_blkif_max_pgrants +
+                            num_clean;
+                num_clean = min(ring->persistent_gnt_c, num_clean);
+                pr_debug("Going to purge at least %u persistent grants\n",
+                         num_clean);
+        }
 
         /*
          * At this point, we can assure that there will be no calls
@@ -401,9 +419,7 @@ static void purge_persistent_gnt(struct xen_blkif_ring *ring)
          * number of grants.
          */
 
-        total = num_clean;
-
-        pr_debug("Going to purge %u persistent grants\n", num_clean);
+        total = 0;
 
         BUG_ON(!list_empty(&ring->persistent_purge_list));
         root = &ring->persistent_gnts;
@@ -412,46 +428,37 @@ purge_list:
                 BUG_ON(persistent_gnt->handle ==
                         BLKBACK_INVALID_HANDLE);
 
-                if (clean_used) {
-                        clear_bit(PERSISTENT_GNT_WAS_ACTIVE, persistent_gnt->flags);
+                if (persistent_gnt->active)
                         continue;
-                }
-
-                if (test_bit(PERSISTENT_GNT_ACTIVE, persistent_gnt->flags))
+                if (!scan_used && !persistent_gnt_timeout(persistent_gnt))
                         continue;
-                if (!scan_used &&
-                    (test_bit(PERSISTENT_GNT_WAS_ACTIVE, persistent_gnt->flags)))
+                if (scan_used && total >= num_clean)
                         continue;
 
                 rb_erase(&persistent_gnt->node, root);
                 list_add(&persistent_gnt->remove_node,
                          &ring->persistent_purge_list);
-                if (--num_clean == 0)
-                        goto finished;
+                total++;
         }
         /*
-         * If we get here it means we also need to start cleaning
+         * Check whether we also need to start cleaning
          * grants that were used since last purge in order to cope
          * with the requested num
          */
-        if (!scan_used && !clean_used) {
-                pr_debug("Still missing %u purged frames\n", num_clean);
+        if (!scan_used && total < num_clean) {
+                pr_debug("Still missing %u purged frames\n", num_clean - total);
                 scan_used = true;
                 goto purge_list;
         }
-finished:
-        if (!clean_used) {
-                pr_debug("Finished scanning for grants to clean, removing used flag\n");
-                clean_used = true;
-                goto purge_list;
-        }
 
-        ring->persistent_gnt_c -= (total - num_clean);
-        ring->blkif->vbd.overflow_max_grants = 0;
+        if (total) {
+                ring->persistent_gnt_c -= total;
+                ring->blkif->vbd.overflow_max_grants = 0;
 
-        /* We can defer this work */
-        schedule_work(&ring->persistent_purge_work);
-        pr_debug("Purged %u/%u\n", (total - num_clean), total);
+                /* We can defer this work */
+                schedule_work(&ring->persistent_purge_work);
+                pr_debug("Purged %u/%u\n", num_clean, total);
+        }
 
 out:
         return;
diff --git a/drivers/block/xen-blkback/common.h b/drivers/block/xen-blkback/common.h
index ecb35fe8ca8d..1d3002d773f7 100644
--- a/drivers/block/xen-blkback/common.h
+++ b/drivers/block/xen-blkback/common.h
@@ -233,16 +233,6 @@ struct xen_vbd {
 
 struct backend_info;
 
-/* Number of available flags */
-#define PERSISTENT_GNT_FLAGS_SIZE       2
-/* This persistent grant is currently in use */
-#define PERSISTENT_GNT_ACTIVE           0
-/*
- * This persistent grant has been used, this flag is set when we remove the
- * PERSISTENT_GNT_ACTIVE, to know that this grant has been used recently.
- */
-#define PERSISTENT_GNT_WAS_ACTIVE       1
-
 /* Number of requests that we can fit in a ring */
 #define XEN_BLKIF_REQS_PER_PAGE         32
 
@@ -250,7 +240,8 @@ struct persistent_gnt {
         struct page *page;
         grant_ref_t gnt;
         grant_handle_t handle;
-        DECLARE_BITMAP(flags, PERSISTENT_GNT_FLAGS_SIZE);
+        unsigned long last_used;
+        bool active;
         struct rb_node node;
         struct list_head remove_node;
 };
@@ -278,7 +269,6 @@ struct xen_blkif_ring {
         wait_queue_head_t       pending_free_wq;
 
         /* Tree to store persistent grants. */
-        spinlock_t              pers_gnts_lock;
         struct rb_root          persistent_gnts;
         unsigned int            persistent_gnt_c;
         atomic_t                persistent_gnt_in_use;
diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
index 8986adab9bf5..a71d817e900d 100644
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -46,6 +46,7 @@
 #include <linux/scatterlist.h>
 #include <linux/bitmap.h>
 #include <linux/list.h>
+#include <linux/workqueue.h>
 
 #include <xen/xen.h>
 #include <xen/xenbus.h>
@@ -121,6 +122,8 @@ static inline struct blkif_req *blkif_req(struct request *rq)
 
 static DEFINE_MUTEX(blkfront_mutex);
 static const struct block_device_operations xlvbd_block_fops;
+static struct delayed_work blkfront_work;
+static LIST_HEAD(info_list);
 
 /*
  * Maximum number of segments in indirect requests, the actual value used by
@@ -216,6 +219,7 @@ struct blkfront_info
         /* Save uncomplete reqs and bios for migration. */
         struct list_head requests;
         struct bio_list bio_list;
+        struct list_head info_list;
 };
 
 static unsigned int nr_minors;
@@ -1759,6 +1763,12 @@ abort_transaction:
         return err;
 }
 
+static void free_info(struct blkfront_info *info)
+{
+        list_del(&info->info_list);
+        kfree(info);
+}
+
 /* Common code used when first setting up, and when resuming. */
 static int talk_to_blkback(struct xenbus_device *dev,
                            struct blkfront_info *info)
@@ -1880,7 +1890,10 @@ again:
  destroy_blkring:
         blkif_free(info, 0);
 
-        kfree(info);
+        mutex_lock(&blkfront_mutex);
+        free_info(info);
+        mutex_unlock(&blkfront_mutex);
+
         dev_set_drvdata(&dev->dev, NULL);
 
         return err;
@@ -1991,6 +2004,10 @@ static int blkfront_probe(struct xenbus_device *dev,
         info->handle = simple_strtoul(strrchr(dev->nodename, '/')+1, NULL, 0);
         dev_set_drvdata(&dev->dev, info);
 
+        mutex_lock(&blkfront_mutex);
+        list_add(&info->info_list, &info_list);
+        mutex_unlock(&blkfront_mutex);
+
         return 0;
 }
 
@@ -2301,6 +2318,12 @@ static void blkfront_gather_backend_features(struct blkfront_info *info)
         if (indirect_segments <= BLKIF_MAX_SEGMENTS_PER_REQUEST)
                 indirect_segments = 0;
         info->max_indirect_segments = indirect_segments;
+
+        if (info->feature_persistent) {
+                mutex_lock(&blkfront_mutex);
+                schedule_delayed_work(&blkfront_work, HZ * 10);
+                mutex_unlock(&blkfront_mutex);
+        }
 }
 
 /*
@@ -2482,7 +2505,9 @@ static int blkfront_remove(struct xenbus_device *xbdev)
         mutex_unlock(&info->mutex);
 
         if (!bdev) {
-                kfree(info);
+                mutex_lock(&blkfront_mutex);
+                free_info(info);
+                mutex_unlock(&blkfront_mutex);
                 return 0;
         }
 
@@ -2502,7 +2527,9 @@ static int blkfront_remove(struct xenbus_device *xbdev)
         if (info && !bdev->bd_openers) {
                 xlvbd_release_gendisk(info);
                 disk->private_data = NULL;
-                kfree(info);
+                mutex_lock(&blkfront_mutex);
+                free_info(info);
+                mutex_unlock(&blkfront_mutex);
         }
 
         mutex_unlock(&bdev->bd_mutex);
@@ -2585,7 +2612,7 @@ static void blkif_release(struct gendisk *disk, fmode_t mode)
                 dev_info(disk_to_dev(bdev->bd_disk), "releasing disk\n");
                 xlvbd_release_gendisk(info);
                 disk->private_data = NULL;
-                kfree(info);
+                free_info(info);
         }
 
 out:
@@ -2618,6 +2645,61 @@ static struct xenbus_driver blkfront_driver = {
         .is_ready = blkfront_is_ready,
 };
 
+static void purge_persistent_grants(struct blkfront_info *info)
+{
+        unsigned int i;
+        unsigned long flags;
+
+        for (i = 0; i < info->nr_rings; i++) {
+                struct blkfront_ring_info *rinfo = &info->rinfo[i];
+                struct grant *gnt_list_entry, *tmp;
+
+                spin_lock_irqsave(&rinfo->ring_lock, flags);
+
+                if (rinfo->persistent_gnts_c == 0) {
+                        spin_unlock_irqrestore(&rinfo->ring_lock, flags);
+                        continue;
+                }
+
+                list_for_each_entry_safe(gnt_list_entry, tmp, &rinfo->grants,
+                                         node) {
+                        if (gnt_list_entry->gref == GRANT_INVALID_REF ||
+                            gnttab_query_foreign_access(gnt_list_entry->gref))
+                                continue;
+
+                        list_del(&gnt_list_entry->node);
+                        gnttab_end_foreign_access(gnt_list_entry->gref, 0, 0UL);
+                        rinfo->persistent_gnts_c--;
+                        __free_page(gnt_list_entry->page);
+                        kfree(gnt_list_entry);
+                }
+
+                spin_unlock_irqrestore(&rinfo->ring_lock, flags);
+        }
+}
+
+static void blkfront_delay_work(struct work_struct *work)
+{
+        struct blkfront_info *info;
+        bool need_schedule_work = false;
+
+        mutex_lock(&blkfront_mutex);
+
+        list_for_each_entry(info, &info_list, info_list) {
+                if (info->feature_persistent) {
+                        need_schedule_work = true;
+                        mutex_lock(&info->mutex);
+                        purge_persistent_grants(info);
+                        mutex_unlock(&info->mutex);
+                }
+        }
+
+        if (need_schedule_work)
+                schedule_delayed_work(&blkfront_work, HZ * 10);
+
+        mutex_unlock(&blkfront_mutex);
+}
+
 static int __init xlblk_init(void)
 {
         int ret;
@@ -2626,6 +2708,15 @@ static int __init xlblk_init(void)
         if (!xen_domain())
                 return -ENODEV;
 
+        if (!xen_has_pv_disk_devices())
+                return -ENODEV;
+
+        if (register_blkdev(XENVBD_MAJOR, DEV_NAME)) {
+                pr_warn("xen_blk: can't get major %d with name %s\n",
+                        XENVBD_MAJOR, DEV_NAME);
+                return -ENODEV;
+        }
+
         if (xen_blkif_max_segments < BLKIF_MAX_SEGMENTS_PER_REQUEST)
                 xen_blkif_max_segments = BLKIF_MAX_SEGMENTS_PER_REQUEST;
 
@@ -2641,14 +2732,7 @@ static int __init xlblk_init(void)
                 xen_blkif_max_queues = nr_cpus;
         }
 
-        if (!xen_has_pv_disk_devices())
-                return -ENODEV;
-
-        if (register_blkdev(XENVBD_MAJOR, DEV_NAME)) {
-                printk(KERN_WARNING "xen_blk: can't get major %d with name %s\n",
-                       XENVBD_MAJOR, DEV_NAME);
-                return -ENODEV;
-        }
+        INIT_DELAYED_WORK(&blkfront_work, blkfront_delay_work);
 
         ret = xenbus_register_frontend(&blkfront_driver);
         if (ret) {
@@ -2663,6 +2747,8 @@ module_init(xlblk_init);
 
 static void __exit xlblk_exit(void)
 {
+        cancel_delayed_work_sync(&blkfront_work);
+
         xenbus_unregister_driver(&blkfront_driver);
         unregister_blkdev(XENVBD_MAJOR, DEV_NAME);
         kfree(minors);
diff --git a/drivers/bluetooth/Kconfig b/drivers/bluetooth/Kconfig
index 2df11cc08a46..845b0314ce3a 100644
--- a/drivers/bluetooth/Kconfig
+++ b/drivers/bluetooth/Kconfig
@@ -200,6 +200,7 @@ config BT_HCIUART_RTL
         depends on BT_HCIUART
         depends on BT_HCIUART_SERDEV
         depends on GPIOLIB
+        depends on ACPI
         select BT_HCIUART_3WIRE
         select BT_RTL
         help
diff --git a/drivers/bluetooth/btmtkuart.c b/drivers/bluetooth/btmtkuart.c
index ed2a5c7cb77f..4593baff2bc9 100644
--- a/drivers/bluetooth/btmtkuart.c
+++ b/drivers/bluetooth/btmtkuart.c
@@ -144,8 +144,10 @@ static int mtk_setup_fw(struct hci_dev *hdev)
         fw_size = fw->size;
 
         /* The size of patch header is 30 bytes, should be skip */
-        if (fw_size < 30)
-                return -EINVAL;
+        if (fw_size < 30) {
+                err = -EINVAL;
+                goto free_fw;
+        }
 
         fw_size -= 30;
         fw_ptr += 30;
@@ -172,8 +174,8 @@ static int mtk_setup_fw(struct hci_dev *hdev)
                 fw_ptr += dlen;
         }
 
+free_fw:
         release_firmware(fw);
-
         return err;
 }
 
diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c
index 963bb0309e25..ea6238ed5c0e 100644
--- a/drivers/bluetooth/hci_ldisc.c
+++ b/drivers/bluetooth/hci_ldisc.c
@@ -543,6 +543,8 @@ static void hci_uart_tty_close(struct tty_struct *tty)
         }
         clear_bit(HCI_UART_PROTO_SET, &hu->flags);
 
+        percpu_free_rwsem(&hu->proto_lock);
+
         kfree(hu);
 }
 
diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c
index c9bac9dc4637..e4fe954e63a9 100644
--- a/drivers/bus/ti-sysc.c
+++ b/drivers/bus/ti-sysc.c
@@ -498,32 +498,29 @@ static int sysc_check_registers(struct sysc *ddata)
 
 /**
  * syc_ioremap - ioremap register space for the interconnect target module
- * @ddata: deviec driver data
+ * @ddata: device driver data
  *
  * Note that the interconnect target module registers can be anywhere
- * within the first child device address space. For example, SGX has
- * them at offset 0x1fc00 in the 32MB module address space. We just
- * what we need around the interconnect target module registers.
+ * within the interconnect target module range. For example, SGX has
+ * them at offset 0x1fc00 in the 32MB module address space. And cpsw
+ * has them at offset 0x1200 in the CPSW_WR child. Usually the
+ * the interconnect target module registers are at the beginning of
+ * the module range though.
  */
 static int sysc_ioremap(struct sysc *ddata)
 {
-        u32 size = 0;
-
-        if (ddata->offsets[SYSC_SYSSTATUS] >= 0)
-                size = ddata->offsets[SYSC_SYSSTATUS];
-        else if (ddata->offsets[SYSC_SYSCONFIG] >= 0)
-                size = ddata->offsets[SYSC_SYSCONFIG];
-        else if (ddata->offsets[SYSC_REVISION] >= 0)
-                size = ddata->offsets[SYSC_REVISION];
-        else
-                return -EINVAL;
+        int size;
 
-        size &= 0xfff00;
-        size += SZ_256;
+        size = max3(ddata->offsets[SYSC_REVISION],
+                    ddata->offsets[SYSC_SYSCONFIG],
+                    ddata->offsets[SYSC_SYSSTATUS]);
+
+        if (size < 0 || (size + sizeof(u32)) > ddata->module_size)
+                return -EINVAL;
 
         ddata->module_va = devm_ioremap(ddata->dev,
                                         ddata->module_pa,
-                                        size);
+                                        size + sizeof(u32));
         if (!ddata->module_va)
                 return -EIO;
 
@@ -1224,10 +1221,10 @@ static int sysc_child_suspend_noirq(struct device *dev)
         if (!pm_runtime_status_suspended(dev)) {
                 error = pm_generic_runtime_suspend(dev);
                 if (error) {
-                        dev_err(dev, "%s error at %i: %i\n",
-                                __func__, __LINE__, error);
+                        dev_warn(dev, "%s busy at %i: %i\n",
+                                 __func__, __LINE__, error);
 
-                        return error;
+                        return 0;
                 }
 
                 error = sysc_runtime_suspend(ddata->dev);
diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c
index 113fc6edb2b0..a5d5a96479bf 100644
--- a/drivers/cdrom/cdrom.c
+++ b/drivers/cdrom/cdrom.c
@@ -2546,7 +2546,7 @@ static int cdrom_ioctl_drive_status(struct cdrom_device_info *cdi,
         if (!CDROM_CAN(CDC_SELECT_DISC) ||
             (arg == CDSL_CURRENT || arg == CDSL_NONE))
                 return cdi->ops->drive_status(cdi, CDSL_CURRENT);
-        if (((int)arg >= cdi->capacity))
+        if (arg >= cdi->capacity)
                 return -EINVAL;
         return cdrom_slot_status(cdi, arg);
 }
diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig
index ce277ee0a28a..40728491f37b 100644
--- a/drivers/char/Kconfig
+++ b/drivers/char/Kconfig
@@ -566,5 +566,5 @@ config RANDOM_TRUST_CPU
         that CPU manufacturer (perhaps with the insistence or mandate
         of a Nation State's intelligence or law enforcement agencies)
         has not installed a hidden back door to compromise the CPU's
-        random number generation facilities.
-
+        random number generation facilities. This can also be configured
+        at boot with "random.trust_cpu=on/off".
diff --git a/drivers/char/ipmi/ipmi_bt_sm.c b/drivers/char/ipmi/ipmi_bt_sm.c
index a3397664f800..97d6856c9c0f 100644
--- a/drivers/char/ipmi/ipmi_bt_sm.c
+++ b/drivers/char/ipmi/ipmi_bt_sm.c
@@ -59,8 +59,6 @@ enum bt_states {
         BT_STATE_RESET3,
         BT_STATE_RESTART,
         BT_STATE_PRINTME,
-        BT_STATE_CAPABILITIES_BEGIN,
-        BT_STATE_CAPABILITIES_END,
         BT_STATE_LONG_BUSY      /* BT doesn't get hosed :-) */
 };
 
@@ -86,7 +84,6 @@ struct si_sm_data {
         int             error_retries;  /* end of "common" fields */
         int             nonzero_status; /* hung BMCs stay all 0 */
         enum bt_states  complete;       /* to divert the state machine */
-        int             BT_CAP_outreqs;
         long            BT_CAP_req2rsp;
         int             BT_CAP_retries; /* Recommended retries */
 };
@@ -137,8 +134,6 @@ static char *state2txt(unsigned char state)
         case BT_STATE_RESET3:           return("RESET3");
         case BT_STATE_RESTART:          return("RESTART");
         case BT_STATE_LONG_BUSY:        return("LONG_BUSY");
-        case BT_STATE_CAPABILITIES_BEGIN: return("CAP_BEGIN");
-        case BT_STATE_CAPABILITIES_END: return("CAP_END");
         }
         return("BAD STATE");
 }
@@ -185,7 +180,6 @@ static unsigned int bt_init_data(struct si_sm_data *bt, struct si_sm_io *io)
         bt->complete = BT_STATE_IDLE;   /* end here */
         bt->BT_CAP_req2rsp = BT_NORMAL_TIMEOUT * USEC_PER_SEC;
         bt->BT_CAP_retries = BT_NORMAL_RETRY_LIMIT;
-        /* BT_CAP_outreqs == zero is a flag to read BT Capabilities */
         return 3; /* We claim 3 bytes of space; ought to check SPMI table */
 }
 
@@ -451,7 +445,7 @@ static enum si_sm_result error_recovery(struct si_sm_data *bt,
 
 static enum si_sm_result bt_event(struct si_sm_data *bt, long time)
 {
-        unsigned char status, BT_CAP[8];
+        unsigned char status;
         static enum bt_states last_printed = BT_STATE_PRINTME;
         int i;
 
@@ -504,12 +498,6 @@ static enum si_sm_result bt_event(struct si_sm_data *bt, long time)
                 if (status & BT_H_BUSY)         /* clear a leftover H_BUSY */
                         BT_CONTROL(BT_H_BUSY);
 
-                bt->timeout = bt->BT_CAP_req2rsp;
-
-                /* Read BT capabilities if it hasn't been done yet */
-                if (!bt->BT_CAP_outreqs)
-                        BT_STATE_CHANGE(BT_STATE_CAPABILITIES_BEGIN,
-                                        SI_SM_CALL_WITHOUT_DELAY);
                 BT_SI_SM_RETURN(SI_SM_IDLE);
 
         case BT_STATE_XACTION_START:
@@ -614,37 +602,6 @@ static enum si_sm_result bt_event(struct si_sm_data *bt, long time)
                 BT_STATE_CHANGE(BT_STATE_XACTION_START,
                                 SI_SM_CALL_WITH_DELAY);
 
-        /*
-         * Get BT Capabilities, using timing of upper level state machine.
-         * Set outreqs to prevent infinite loop on timeout.
-         */
-        case BT_STATE_CAPABILITIES_BEGIN:
-                bt->BT_CAP_outreqs = 1;
-                {
-                        unsigned char GetBT_CAP[] = { 0x18, 0x36 };
-                        bt->state = BT_STATE_IDLE;
-                        bt_start_transaction(bt, GetBT_CAP, sizeof(GetBT_CAP));
-                }
-                bt->complete = BT_STATE_CAPABILITIES_END;
-                BT_STATE_CHANGE(BT_STATE_XACTION_START,
-                                SI_SM_CALL_WITH_DELAY);
-
-        case BT_STATE_CAPABILITIES_END:
-                i = bt_get_result(bt, BT_CAP, sizeof(BT_CAP));
-                bt_init_data(bt, bt->io);
-                if ((i == 8) && !BT_CAP[2]) {
-                        bt->BT_CAP_outreqs = BT_CAP[3];
-                        bt->BT_CAP_req2rsp = BT_CAP[6] * USEC_PER_SEC;
-                        bt->BT_CAP_retries = BT_CAP[7];
-                } else
-                        printk(KERN_WARNING "IPMI BT: using default values\n");
-                if (!bt->BT_CAP_outreqs)
-                        bt->BT_CAP_outreqs = 1;
-                printk(KERN_WARNING "IPMI BT: req2rsp=%ld secs retries=%d\n",
-                        bt->BT_CAP_req2rsp / USEC_PER_SEC, bt->BT_CAP_retries);
-                bt->timeout = bt->BT_CAP_req2rsp;
-                return SI_SM_CALL_WITHOUT_DELAY;
-
         default:        /* should never occur */
                 return error_recovery(bt,
                                       status,
@@ -655,6 +612,11 @@ static enum si_sm_result bt_event(struct si_sm_data *bt, long time)
 
 static int bt_detect(struct si_sm_data *bt)
 {
+        unsigned char GetBT_CAP[] = { 0x18, 0x36 };
+        unsigned char BT_CAP[8];
+        enum si_sm_result smi_result;
+        int rv;
+
         /*
          * It's impossible for the BT status and interrupt registers to be
          * all 1's, (assuming a properly functioning, self-initialized BMC)
@@ -665,6 +627,48 @@ static int bt_detect(struct si_sm_data *bt)
         if ((BT_STATUS == 0xFF) && (BT_INTMASK_R == 0xFF))
                 return 1;
         reset_flags(bt);
+
+        /*
+         * Try getting the BT capabilities here.
+         */
+        rv = bt_start_transaction(bt, GetBT_CAP, sizeof(GetBT_CAP));
+        if (rv) {
+                dev_warn(bt->io->dev,
+                         "Can't start capabilities transaction: %d\n", rv);
+                goto out_no_bt_cap;
+        }
+
+        smi_result = SI_SM_CALL_WITHOUT_DELAY;
+        for (;;) {
+                if (smi_result == SI_SM_CALL_WITH_DELAY ||
+                    smi_result == SI_SM_CALL_WITH_TICK_DELAY) {
+                        schedule_timeout_uninterruptible(1);
+                        smi_result = bt_event(bt, jiffies_to_usecs(1));
+                } else if (smi_result == SI_SM_CALL_WITHOUT_DELAY) {
+                        smi_result = bt_event(bt, 0);
+                } else
+                        break;
+        }
+
+        rv = bt_get_result(bt, BT_CAP, sizeof(BT_CAP));
+        bt_init_data(bt, bt->io);
+        if (rv < 8) {
+                dev_warn(bt->io->dev, "bt cap response too short: %d\n", rv);
+                goto out_no_bt_cap;
+        }
+
+        if (BT_CAP[2]) {
+                dev_warn(bt->io->dev, "Error fetching bt cap: %x\n", BT_CAP[2]);
+out_no_bt_cap:
+                dev_warn(bt->io->dev, "using default values\n");
+        } else {
+                bt->BT_CAP_req2rsp = BT_CAP[6] * USEC_PER_SEC;
+                bt->BT_CAP_retries = BT_CAP[7];
+        }
+
+        dev_info(bt->io->dev, "req2rsp=%ld secs retries=%d\n",
+                 bt->BT_CAP_req2rsp / USEC_PER_SEC, bt->BT_CAP_retries);
+
         return 0;
 }
 
diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
index 51832b8a2c62..7fc9612070a1 100644
--- a/drivers/char/ipmi/ipmi_msghandler.c
+++ b/drivers/char/ipmi/ipmi_msghandler.c
@@ -3381,39 +3381,45 @@ int ipmi_register_smi(const struct ipmi_smi_handlers *handlers,
 
         rv = handlers->start_processing(send_info, intf);
         if (rv)
-                goto out;
+                goto out_err;
 
         rv = __bmc_get_device_id(intf, NULL, &id, NULL, NULL, i);
         if (rv) {
                 dev_err(si_dev, "Unable to get the device id: %d\n", rv);
-                goto out;
+                goto out_err_started;
         }
 
         mutex_lock(&intf->bmc_reg_mutex);
         rv = __scan_channels(intf, &id);
         mutex_unlock(&intf->bmc_reg_mutex);
+        if (rv)
+                goto out_err_bmc_reg;
 
- out:
-        if (rv) {
-                ipmi_bmc_unregister(intf);
-                list_del_rcu(&intf->link);
-                mutex_unlock(&ipmi_interfaces_mutex);
-                synchronize_srcu(&ipmi_interfaces_srcu);
-                cleanup_srcu_struct(&intf->users_srcu);
-                kref_put(&intf->refcount, intf_free);
-        } else {
-                /*
-                 * Keep memory order straight for RCU readers.  Make
-                 * sure everything else is committed to memory before
-                 * setting intf_num to mark the interface valid.
-                 */
-                smp_wmb();
-                intf->intf_num = i;
-                mutex_unlock(&ipmi_interfaces_mutex);
+        /*
+         * Keep memory order straight for RCU readers.  Make
+         * sure everything else is committed to memory before
+         * setting intf_num to mark the interface valid.
+         */
+        smp_wmb();
+        intf->intf_num = i;
+        mutex_unlock(&ipmi_interfaces_mutex);
 
-                /* After this point the interface is legal to use. */
-                call_smi_watchers(i, intf->si_dev);
-        }
+        /* After this point the interface is legal to use. */
+        call_smi_watchers(i, intf->si_dev);
+
+        return 0;
+
+ out_err_bmc_reg:
+        ipmi_bmc_unregister(intf);
+ out_err_started:
+        if (intf->handlers->shutdown)
+                intf->handlers->shutdown(intf->send_info);
+ out_err:
+        list_del_rcu(&intf->link);
+        mutex_unlock(&ipmi_interfaces_mutex);
+        synchronize_srcu(&ipmi_interfaces_srcu);
+        cleanup_srcu_struct(&intf->users_srcu);
+        kref_put(&intf->refcount, intf_free);
 
         return rv;
 }
@@ -3504,7 +3510,8 @@ void ipmi_unregister_smi(struct ipmi_smi *intf)
         }
         srcu_read_unlock(&intf->users_srcu, index);
 
-        intf->handlers->shutdown(intf->send_info);
+        if (intf->handlers->shutdown)
+                intf->handlers->shutdown(intf->send_info);
 
         cleanup_smi_msgs(intf);
 
diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
index 90ec010bffbd..5faa917df1b6 100644
--- a/drivers/char/ipmi/ipmi_si_intf.c
+++ b/drivers/char/ipmi/ipmi_si_intf.c
@@ -2083,18 +2083,9 @@ static int try_smi_init(struct smi_info *new_smi)
                  si_to_str[new_smi->io.si_type]);
 
         WARN_ON(new_smi->io.dev->init_name != NULL);
-        kfree(init_name);
-
-        return 0;
-
-out_err:
-        if (new_smi->intf) {
-                ipmi_unregister_smi(new_smi->intf);
-                new_smi->intf = NULL;
-        }
 
+ out_err:
         kfree(init_name);
-
         return rv;
 }
 
@@ -2227,6 +2218,8 @@ static void shutdown_smi(void *send_info)
 
         kfree(smi_info->si_sm);
         smi_info->si_sm = NULL;
+
+        smi_info->intf = NULL;
 }
 
 /*
@@ -2240,10 +2233,8 @@ static void cleanup_one_si(struct smi_info *smi_info)
 
         list_del(&smi_info->link);
 
-        if (smi_info->intf) {
+        if (smi_info->intf)
                 ipmi_unregister_smi(smi_info->intf);
-                smi_info->intf = NULL;
-        }
 
         if (smi_info->pdev) {
                 if (smi_info->pdev_registered)
diff --git a/drivers/char/ipmi/ipmi_ssif.c b/drivers/char/ipmi/ipmi_ssif.c
index 18e4650c233b..29e67a80fb20 100644
--- a/drivers/char/ipmi/ipmi_ssif.c
+++ b/drivers/char/ipmi/ipmi_ssif.c
@@ -181,6 +181,8 @@ struct ssif_addr_info {
         struct device *dev;
         struct i2c_client *client;
 
+        struct i2c_client *added_client;
+
         struct mutex clients_mutex;
         struct list_head clients;
 
@@ -1214,18 +1216,11 @@ static void shutdown_ssif(void *send_info)
                 complete(&ssif_info->wake_thread);
                 kthread_stop(ssif_info->thread);
         }
-
-        /*
-         * No message can be outstanding now, we have removed the
-         * upper layer and it permitted us to do so.
-         */
-        kfree(ssif_info);
 }
 
 static int ssif_remove(struct i2c_client *client)
 {
         struct ssif_info *ssif_info = i2c_get_clientdata(client);
-        struct ipmi_smi *intf;
         struct ssif_addr_info *addr_info;
 
         if (!ssif_info)
@@ -1235,9 +1230,7 @@ static int ssif_remove(struct i2c_client *client)
          * After this point, we won't deliver anything asychronously
          * to the message handler.  We can unregister ourself.
          */
-        intf = ssif_info->intf;
-        ssif_info->intf = NULL;
-        ipmi_unregister_smi(intf);
+        ipmi_unregister_smi(ssif_info->intf);
 
         list_for_each_entry(addr_info, &ssif_infos, link) {
                 if (addr_info->client == client) {
@@ -1246,6 +1239,8 @@ static int ssif_remove(struct i2c_client *client)
                 }
         }
 
+        kfree(ssif_info);
+
         return 0;
 }
 
@@ -1648,15 +1643,9 @@ static int ssif_probe(struct i2c_client *client, const struct i2c_device_id *id)
 
  out:
         if (rv) {
-                /*
-                 * Note that if addr_info->client is assigned, we
-                 * leave it.  The i2c client hangs around even if we
-                 * return a failure here, and the failure here is not
-                 * propagated back to the i2c code.  This seems to be
-                 * design intent, strange as it may be.  But if we
-                 * don't leave it, ssif_platform_remove will not remove
-                 * the client like it should.
-                 */
+                if (addr_info)
+                        addr_info->client = NULL;
+
                 dev_err(&client->dev, "Unable to start IPMI SSIF: %d\n", rv);
                 kfree(ssif_info);
         }
@@ -1676,7 +1665,8 @@ static int ssif_adapter_handler(struct device *adev, void *opaque)
         if (adev->type != &i2c_adapter_type)
                 return 0;
 
-        i2c_new_device(to_i2c_adapter(adev), &addr_info->binfo);
+        addr_info->added_client = i2c_new_device(to_i2c_adapter(adev),
+                                                 &addr_info->binfo);
 
         if (!addr_info->adapter_name)
                 return 1; /* Only try the first I2C adapter by default. */
@@ -1849,7 +1839,7 @@ static int ssif_platform_remove(struct platform_device *dev)
                 return 0;
 
         mutex_lock(&ssif_infos_mutex);
-        i2c_unregister_device(addr_info->client);
+        i2c_unregister_device(addr_info->added_client);
 
         list_del(&addr_info->link);
         kfree(addr_info);
diff --git a/drivers/char/ipmi/kcs_bmc.c b/drivers/char/ipmi/kcs_bmc.c
index bb882ab161fe..e6124bd548df 100644
--- a/drivers/char/ipmi/kcs_bmc.c
+++ b/drivers/char/ipmi/kcs_bmc.c
@@ -16,6 +16,8 @@
 
 #include "kcs_bmc.h"
 
+#define DEVICE_NAME "ipmi-kcs"
+
 #define KCS_MSG_BUFSIZ    1000
 
 #define KCS_ZERO_DATA     0
@@ -429,8 +431,6 @@ struct kcs_bmc *kcs_bmc_alloc(struct device *dev, int sizeof_priv, u32 channel)
         if (!kcs_bmc)
                 return NULL;
 
-        dev_set_name(dev, "ipmi-kcs%u", channel);
-
         spin_lock_init(&kcs_bmc->lock);
         kcs_bmc->channel = channel;
 
@@ -444,7 +444,8 @@ struct kcs_bmc *kcs_bmc_alloc(struct device *dev, int sizeof_priv, u32 channel)
                 return NULL;
 
         kcs_bmc->miscdev.minor = MISC_DYNAMIC_MINOR;
-        kcs_bmc->miscdev.name = dev_name(dev);
+        kcs_bmc->miscdev.name = devm_kasprintf(dev, GFP_KERNEL, "%s%u",
+                                               DEVICE_NAME, channel);
         kcs_bmc->miscdev.fops = &kcs_bmc_fops;
 
         return kcs_bmc;
diff --git a/drivers/char/random.c b/drivers/char/random.c
index bf5f99fc36f1..c75b6cdf0053 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -779,6 +779,13 @@ static struct crng_state **crng_node_pool __read_mostly;
 
 static void invalidate_batched_entropy(void);
 
+static bool trust_cpu __ro_after_init = IS_ENABLED(CONFIG_RANDOM_TRUST_CPU);
+static int __init parse_trust_cpu(char *arg)
+{
+        return kstrtobool(arg, &trust_cpu);
+}
+early_param("random.trust_cpu", parse_trust_cpu);
+
 static void crng_initialize(struct crng_state *crng)
 {
         int             i;
@@ -799,12 +806,10 @@ static void crng_initialize(struct crng_state *crng)
                 }
                 crng->state[i] ^= rv;
         }
-#ifdef CONFIG_RANDOM_TRUST_CPU
-        if (arch_init) {
+        if (trust_cpu && arch_init) {
                 crng_init = 2;
                 pr_notice("random: crng done (trusting CPU's manufacturer)\n");
         }
-#endif
         crng->init_time = jiffies - CRNG_RESEED_INTERVAL - 1;
 }
 
diff --git a/drivers/clk/clk-npcm7xx.c b/drivers/clk/clk-npcm7xx.c
index 740af90a9508..c5edf8f2fd19 100644
--- a/drivers/clk/clk-npcm7xx.c
+++ b/drivers/clk/clk-npcm7xx.c
@@ -558,8 +558,8 @@ static void __init npcm7xx_clk_init(struct device_node *clk_np)
         if (!clk_base)
                 goto npcm7xx_init_error;
 
-        npcm7xx_clk_data = kzalloc(sizeof(*npcm7xx_clk_data->hws) *
-                NPCM7XX_NUM_CLOCKS + sizeof(npcm7xx_clk_data), GFP_KERNEL);
+        npcm7xx_clk_data = kzalloc(struct_size(npcm7xx_clk_data, hws,
+                                   NPCM7XX_NUM_CLOCKS), GFP_KERNEL);
         if (!npcm7xx_clk_data)
                 goto npcm7xx_init_np_err;
 
diff --git a/drivers/clk/x86/clk-pmc-atom.c b/drivers/clk/x86/clk-pmc-atom.c
index 08ef69945ffb..d977193842df 100644
--- a/drivers/clk/x86/clk-pmc-atom.c
+++ b/drivers/clk/x86/clk-pmc-atom.c
@@ -55,6 +55,7 @@ struct clk_plt_data {
         u8 nparents;
         struct clk_plt *clks[PMC_CLK_NUM];
         struct clk_lookup *mclk_lookup;
+        struct clk_lookup *ether_clk_lookup;
 };
 
 /* Return an index in parent table */
@@ -186,13 +187,6 @@ static struct clk_plt *plt_clk_register(struct platform_device *pdev, int id,
         pclk->reg = base + PMC_CLK_CTL_OFFSET + id * PMC_CLK_CTL_SIZE;
         spin_lock_init(&pclk->lock);
 
-        /*
-         * If the clock was already enabled by the firmware mark it as critical
-         * to avoid it being gated by the clock framework if no driver owns it.
-         */
-        if (plt_clk_is_enabled(&pclk->hw))
-                init.flags |= CLK_IS_CRITICAL;
-
         ret = devm_clk_hw_register(&pdev->dev, &pclk->hw);
         if (ret) {
                 pclk = ERR_PTR(ret);
@@ -351,11 +345,20 @@ static int plt_clk_probe(struct platform_device *pdev)
                 goto err_unreg_clk_plt;
         }
 
+        data->ether_clk_lookup = clkdev_hw_create(&data->clks[4]->hw,
+                                                  "ether_clk", NULL);
+        if (!data->ether_clk_lookup) {
+                err = -ENOMEM;
+                goto err_drop_mclk;
+        }
+
         plt_clk_free_parent_names_loop(parent_names, data->nparents);
 
         platform_set_drvdata(pdev, data);
         return 0;
 
+err_drop_mclk:
+        clkdev_drop(data->mclk_lookup);
 err_unreg_clk_plt:
         plt_clk_unregister_loop(data, i);
         plt_clk_unregister_parents(data);
@@ -369,6 +372,7 @@ static int plt_clk_remove(struct platform_device *pdev)
 
         data = platform_get_drvdata(pdev);
 
+        clkdev_drop(data->ether_clk_lookup);
         clkdev_drop(data->mclk_lookup);
         plt_clk_unregister_loop(data, PMC_CLK_NUM);
         plt_clk_unregister_parents(data);
diff --git a/drivers/clk/x86/clk-st.c b/drivers/clk/x86/clk-st.c
index fb62f3938008..3a0996f2d556 100644
--- a/drivers/clk/x86/clk-st.c
+++ b/drivers/clk/x86/clk-st.c
@@ -46,7 +46,7 @@ static int st_clk_probe(struct platform_device *pdev)
                 clk_oscout1_parents, ARRAY_SIZE(clk_oscout1_parents),
                 0, st_data->base + CLKDRVSTR2, OSCOUT1CLK25MHZ, 3, 0, NULL);
 
-        clk_set_parent(hws[ST_CLK_MUX]->clk, hws[ST_CLK_25M]->clk);
+        clk_set_parent(hws[ST_CLK_MUX]->clk, hws[ST_CLK_48M]->clk);
 
         hws[ST_CLK_GATE] = clk_hw_register_gate(NULL, "oscout1", "oscout1_mux",
                 0, st_data->base + MISCCLKCNTL1, OSCCLKENB,
diff --git a/drivers/cpuidle/governors/menu.c b/drivers/cpuidle/governors/menu.c
index 110483f0e3fb..e26a40971b26 100644
--- a/drivers/cpuidle/governors/menu.c
+++ b/drivers/cpuidle/governors/menu.c
@@ -379,9 +379,20 @@ static int menu_select(struct cpuidle_driver *drv, struct cpuidle_device *dev,
                 if (idx == -1)
                         idx = i; /* first enabled state */
                 if (s->target_residency > data->predicted_us) {
-                        if (!tick_nohz_tick_stopped())
+                        if (data->predicted_us < TICK_USEC)
                                 break;
 
+                        if (!tick_nohz_tick_stopped()) {
+                                /*
+                                 * If the state selected so far is shallow,
+                                 * waking up early won't hurt, so retain the
+                                 * tick in that case and let the governor run
+                                 * again in the next iteration of the loop.
+                                 */
+                                expected_interval = drv->states[idx].target_residency;
+                                break;
+                        }
+
                         /*
                          * If the state selected so far is shallow and this
                          * state's target residency matches the time till the
diff --git a/drivers/crypto/caam/caamalg_qi.c b/drivers/crypto/caam/caamalg_qi.c
index 6e61cc93c2b0..d7aa7d7ff102 100644
--- a/drivers/crypto/caam/caamalg_qi.c
+++ b/drivers/crypto/caam/caamalg_qi.c
@@ -679,10 +679,8 @@ static int xts_ablkcipher_setkey(struct crypto_ablkcipher *ablkcipher,
         int ret = 0;
 
         if (keylen != 2 * AES_MIN_KEY_SIZE  && keylen != 2 * AES_MAX_KEY_SIZE) {
-                crypto_ablkcipher_set_flags(ablkcipher,
-                                            CRYPTO_TFM_RES_BAD_KEY_LEN);
                 dev_err(jrdev, "key size mismatch\n");
-                return -EINVAL;
+                goto badkey;
         }
 
         ctx->cdata.keylen = keylen;
@@ -715,7 +713,7 @@ static int xts_ablkcipher_setkey(struct crypto_ablkcipher *ablkcipher,
         return ret;
 badkey:
         crypto_ablkcipher_set_flags(ablkcipher, CRYPTO_TFM_RES_BAD_KEY_LEN);
-        return 0;
+        return -EINVAL;
 }
 
 /*
diff --git a/drivers/crypto/caam/caampkc.c b/drivers/crypto/caam/caampkc.c
index 578ea63a3109..f26d62e5533a 100644
--- a/drivers/crypto/caam/caampkc.c
+++ b/drivers/crypto/caam/caampkc.c
@@ -71,8 +71,8 @@ static void rsa_priv_f2_unmap(struct device *dev, struct rsa_edesc *edesc,
         dma_unmap_single(dev, pdb->d_dma, key->d_sz, DMA_TO_DEVICE);
         dma_unmap_single(dev, pdb->p_dma, p_sz, DMA_TO_DEVICE);
         dma_unmap_single(dev, pdb->q_dma, q_sz, DMA_TO_DEVICE);
-        dma_unmap_single(dev, pdb->tmp1_dma, p_sz, DMA_TO_DEVICE);
-        dma_unmap_single(dev, pdb->tmp2_dma, q_sz, DMA_TO_DEVICE);
+        dma_unmap_single(dev, pdb->tmp1_dma, p_sz, DMA_BIDIRECTIONAL);
+        dma_unmap_single(dev, pdb->tmp2_dma, q_sz, DMA_BIDIRECTIONAL);
 }
 
 static void rsa_priv_f3_unmap(struct device *dev, struct rsa_edesc *edesc,
@@ -90,8 +90,8 @@ static void rsa_priv_f3_unmap(struct device *dev, struct rsa_edesc *edesc,
         dma_unmap_single(dev, pdb->dp_dma, p_sz, DMA_TO_DEVICE);
         dma_unmap_single(dev, pdb->dq_dma, q_sz, DMA_TO_DEVICE);
         dma_unmap_single(dev, pdb->c_dma, p_sz, DMA_TO_DEVICE);
-        dma_unmap_single(dev, pdb->tmp1_dma, p_sz, DMA_TO_DEVICE);
-        dma_unmap_single(dev, pdb->tmp2_dma, q_sz, DMA_TO_DEVICE);
+        dma_unmap_single(dev, pdb->tmp1_dma, p_sz, DMA_BIDIRECTIONAL);
+        dma_unmap_single(dev, pdb->tmp2_dma, q_sz, DMA_BIDIRECTIONAL);
 }
 
 /* RSA Job Completion handler */
@@ -417,13 +417,13 @@ static int set_rsa_priv_f2_pdb(struct akcipher_request *req,
                 goto unmap_p;
         }
 
-        pdb->tmp1_dma = dma_map_single(dev, key->tmp1, p_sz, DMA_TO_DEVICE);
+        pdb->tmp1_dma = dma_map_single(dev, key->tmp1, p_sz, DMA_BIDIRECTIONAL);
         if (dma_mapping_error(dev, pdb->tmp1_dma)) {
                 dev_err(dev, "Unable to map RSA tmp1 memory\n");
                 goto unmap_q;
         }
 
-        pdb->tmp2_dma = dma_map_single(dev, key->tmp2, q_sz, DMA_TO_DEVICE);
+        pdb->tmp2_dma = dma_map_single(dev, key->tmp2, q_sz, DMA_BIDIRECTIONAL);
         if (dma_mapping_error(dev, pdb->tmp2_dma)) {
                 dev_err(dev, "Unable to map RSA tmp2 memory\n");
                 goto unmap_tmp1;
@@ -451,7 +451,7 @@ static int set_rsa_priv_f2_pdb(struct akcipher_request *req,
         return 0;
 
 unmap_tmp1:
-        dma_unmap_single(dev, pdb->tmp1_dma, p_sz, DMA_TO_DEVICE);
+        dma_unmap_single(dev, pdb->tmp1_dma, p_sz, DMA_BIDIRECTIONAL);
 unmap_q:
         dma_unmap_single(dev, pdb->q_dma, q_sz, DMA_TO_DEVICE);
 unmap_p:
@@ -504,13 +504,13 @@ static int set_rsa_priv_f3_pdb(struct akcipher_request *req,
                 goto unmap_dq;
         }
 
-        pdb->tmp1_dma = dma_map_single(dev, key->tmp1, p_sz, DMA_TO_DEVICE);
+        pdb->tmp1_dma = dma_map_single(dev, key->tmp1, p_sz, DMA_BIDIRECTIONAL);
         if (dma_mapping_error(dev, pdb->tmp1_dma)) {
                 dev_err(dev, "Unable to map RSA tmp1 memory\n");
                 goto unmap_qinv;
         }
 
-        pdb->tmp2_dma = dma_map_single(dev, key->tmp2, q_sz, DMA_TO_DEVICE);
+        pdb->tmp2_dma = dma_map_single(dev, key->tmp2, q_sz, DMA_BIDIRECTIONAL);
         if (dma_mapping_error(dev, pdb->tmp2_dma)) {
                 dev_err(dev, "Unable to map RSA tmp2 memory\n");
                 goto unmap_tmp1;
@@ -538,7 +538,7 @@ static int set_rsa_priv_f3_pdb(struct akcipher_request *req,
         return 0;
 
 unmap_tmp1:
-        dma_unmap_single(dev, pdb->tmp1_dma, p_sz, DMA_TO_DEVICE);
+        dma_unmap_single(dev, pdb->tmp1_dma, p_sz, DMA_BIDIRECTIONAL);
 unmap_qinv:
         dma_unmap_single(dev, pdb->c_dma, p_sz, DMA_TO_DEVICE);
 unmap_dq:
diff --git a/drivers/crypto/caam/jr.c b/drivers/crypto/caam/jr.c
index f4f258075b89..acdd72016ffe 100644
--- a/drivers/crypto/caam/jr.c
+++ b/drivers/crypto/caam/jr.c
@@ -190,7 +190,8 @@ static void caam_jr_dequeue(unsigned long devarg)
                 BUG_ON(CIRC_CNT(head, tail + i, JOBR_DEPTH) <= 0);
 
                 /* Unmap just-run descriptor so we can post-process */
-                dma_unmap_single(dev, jrp->outring[hw_idx].desc,
+                dma_unmap_single(dev,
+                                 caam_dma_to_cpu(jrp->outring[hw_idx].desc),
                                  jrp->entinfo[sw_idx].desc_size,
                                  DMA_TO_DEVICE);
 
diff --git a/drivers/crypto/cavium/nitrox/nitrox_dev.h b/drivers/crypto/cavium/nitrox/nitrox_dev.h
index 9a476bb6d4c7..af596455b420 100644
--- a/drivers/crypto/cavium/nitrox/nitrox_dev.h
+++ b/drivers/crypto/cavium/nitrox/nitrox_dev.h
@@ -35,6 +35,7 @@ struct nitrox_cmdq {
         /* requests in backlog queues */
         atomic_t backlog_count;
 
+        int write_idx;
         /* command size 32B/64B */
         u8 instr_size;
         u8 qno;
@@ -87,7 +88,7 @@ struct nitrox_bh {
         struct bh_data *slc;
 };
 
-/* NITROX-5 driver state */
+/* NITROX-V driver state */
 #define NITROX_UCODE_LOADED     0
 #define NITROX_READY            1
 
diff --git a/drivers/crypto/cavium/nitrox/nitrox_lib.c b/drivers/crypto/cavium/nitrox/nitrox_lib.c
index ebe267379ac9..4d31df07777f 100644
--- a/drivers/crypto/cavium/nitrox/nitrox_lib.c
+++ b/drivers/crypto/cavium/nitrox/nitrox_lib.c
@@ -36,6 +36,7 @@ static int cmdq_common_init(struct nitrox_cmdq *cmdq)
         cmdq->head = PTR_ALIGN(cmdq->head_unaligned, PKT_IN_ALIGN);
         cmdq->dma = PTR_ALIGN(cmdq->dma_unaligned, PKT_IN_ALIGN);
         cmdq->qsize = (qsize + PKT_IN_ALIGN);
+        cmdq->write_idx = 0;
 
         spin_lock_init(&cmdq->response_lock);
         spin_lock_init(&cmdq->cmdq_lock);
diff --git a/drivers/crypto/cavium/nitrox/nitrox_reqmgr.c b/drivers/crypto/cavium/nitrox/nitrox_reqmgr.c
index deaefd532aaa..4a362fc22f62 100644
--- a/drivers/crypto/cavium/nitrox/nitrox_reqmgr.c
+++ b/drivers/crypto/cavium/nitrox/nitrox_reqmgr.c
@@ -42,6 +42,16 @@
  *   Invalid flag options in AES-CCM IV.
  */
 
+static inline int incr_index(int index, int count, int max)
+{
+        if ((index + count) >= max)
+                index = index + count - max;
+        else
+                index += count;
+
+        return index;
+}
+
 /**
  * dma_free_sglist - unmap and free the sg lists.
  * @ndev: N5 device
@@ -426,30 +436,29 @@ static void post_se_instr(struct nitrox_softreq *sr,
                           struct nitrox_cmdq *cmdq)
 {
         struct nitrox_device *ndev = sr->ndev;
-        union nps_pkt_in_instr_baoff_dbell pkt_in_baoff_dbell;
-        u64 offset;
+        int idx;
         u8 *ent;
 
         spin_lock_bh(&cmdq->cmdq_lock);
 
-        /* get the next write offset */
-        offset = NPS_PKT_IN_INSTR_BAOFF_DBELLX(cmdq->qno);
-        pkt_in_baoff_dbell.value = nitrox_read_csr(ndev, offset);
+        idx = cmdq->write_idx;
         /* copy the instruction */
-        ent = cmdq->head + pkt_in_baoff_dbell.s.aoff;
+        ent = cmdq->head + (idx * cmdq->instr_size);
         memcpy(ent, &sr->instr, cmdq->instr_size);
-        /* flush the command queue updates */
-        dma_wmb();
 
-        sr->tstamp = jiffies;
         atomic_set(&sr->status, REQ_POSTED);
         response_list_add(sr, cmdq);
+        sr->tstamp = jiffies;
+        /* flush the command queue updates */
+        dma_wmb();
 
         /* Ring doorbell with count 1 */
         writeq(1, cmdq->dbell_csr_addr);
         /* orders the doorbell rings */
         mmiowb();
 
+        cmdq->write_idx = incr_index(idx, 1, ndev->qlen);
+
         spin_unlock_bh(&cmdq->cmdq_lock);
 }
 
@@ -459,6 +468,9 @@ static int post_backlog_cmds(struct nitrox_cmdq *cmdq)
         struct nitrox_softreq *sr, *tmp;
         int ret = 0;
 
+        if (!atomic_read(&cmdq->backlog_count))
+                return 0;
+
         spin_lock_bh(&cmdq->backlog_lock);
 
         list_for_each_entry_safe(sr, tmp, &cmdq->backlog_head, backlog) {
@@ -466,7 +478,7 @@ static int post_backlog_cmds(struct nitrox_cmdq *cmdq)
 
                 /* submit until space available */
                 if (unlikely(cmdq_full(cmdq, ndev->qlen))) {
-                        ret = -EBUSY;
+                        ret = -ENOSPC;
                         break;
                 }
                 /* delete from backlog list */
@@ -491,23 +503,20 @@ static int nitrox_enqueue_request(struct nitrox_softreq *sr)
 {
         struct nitrox_cmdq *cmdq = sr->cmdq;
         struct nitrox_device *ndev = sr->ndev;
-        int ret = -EBUSY;
+
+        /* try to post backlog requests */
+        post_backlog_cmds(cmdq);
 
         if (unlikely(cmdq_full(cmdq, ndev->qlen))) {
                 if (!(sr->flags & CRYPTO_TFM_REQ_MAY_BACKLOG))
-                        return -EAGAIN;
-
+                        return -ENOSPC;
+                /* add to backlog list */
                 backlog_list_add(sr, cmdq);
-        } else {
-                ret = post_backlog_cmds(cmdq);
-                if (ret) {
-                        backlog_list_add(sr, cmdq);
-                        return ret;
-                }
-                post_se_instr(sr, cmdq);
-                ret = -EINPROGRESS;
+                return -EBUSY;
         }
-        return ret;
+        post_se_instr(sr, cmdq);
+
+        return -EINPROGRESS;
 }
 
 /**
@@ -624,11 +633,9 @@ int nitrox_process_se_request(struct nitrox_device *ndev,
          */
         sr->instr.fdata[0] = *((u64 *)&req->gph);
         sr->instr.fdata[1] = 0;
-        /* flush the soft_req changes before posting the cmd */
-        wmb();
 
         ret = nitrox_enqueue_request(sr);
-        if (ret == -EAGAIN)
+        if (ret == -ENOSPC)
                 goto send_fail;
 
         return ret;
diff --git a/drivers/crypto/ccp/psp-dev.c b/drivers/crypto/ccp/psp-dev.c
index 218739b961fe..72790d88236d 100644
--- a/drivers/crypto/ccp/psp-dev.c
+++ b/drivers/crypto/ccp/psp-dev.c
@@ -38,6 +38,17 @@ static DEFINE_MUTEX(sev_cmd_mutex);
 static struct sev_misc_dev *misc_dev;
 static struct psp_device *psp_master;
 
+static int psp_cmd_timeout = 100;
+module_param(psp_cmd_timeout, int, 0644);
+MODULE_PARM_DESC(psp_cmd_timeout, " default timeout value, in seconds, for PSP commands");
+
+static int psp_probe_timeout = 5;
+module_param(psp_probe_timeout, int, 0644);
+MODULE_PARM_DESC(psp_probe_timeout, " default timeout value, in seconds, during PSP device probe");
+
+static bool psp_dead;
+static int psp_timeout;
+
 static struct psp_device *psp_alloc_struct(struct sp_device *sp)
 {
         struct device *dev = sp->dev;
@@ -82,10 +93,19 @@ done:
         return IRQ_HANDLED;
 }
 
-static void sev_wait_cmd_ioc(struct psp_device *psp, unsigned int *reg)
+static int sev_wait_cmd_ioc(struct psp_device *psp,
+                            unsigned int *reg, unsigned int timeout)
 {
-        wait_event(psp->sev_int_queue, psp->sev_int_rcvd);
+        int ret;
+
+        ret = wait_event_timeout(psp->sev_int_queue,
+                        psp->sev_int_rcvd, timeout * HZ);
+        if (!ret)
+                return -ETIMEDOUT;
+
         *reg = ioread32(psp->io_regs + psp->vdata->cmdresp_reg);
+
+        return 0;
 }
 
 static int sev_cmd_buffer_len(int cmd)
@@ -133,12 +153,15 @@ static int __sev_do_cmd_locked(int cmd, void *data, int *psp_ret)
         if (!psp)
                 return -ENODEV;
 
+        if (psp_dead)
+                return -EBUSY;
+
         /* Get the physical address of the command buffer */
         phys_lsb = data ? lower_32_bits(__psp_pa(data)) : 0;
         phys_msb = data ? upper_32_bits(__psp_pa(data)) : 0;
 
-        dev_dbg(psp->dev, "sev command id %#x buffer 0x%08x%08x\n",
-                cmd, phys_msb, phys_lsb);
+        dev_dbg(psp->dev, "sev command id %#x buffer 0x%08x%08x timeout %us\n",
+                cmd, phys_msb, phys_lsb, psp_timeout);
 
         print_hex_dump_debug("(in):  ", DUMP_PREFIX_OFFSET, 16, 2, data,
                              sev_cmd_buffer_len(cmd), false);
@@ -154,7 +177,18 @@ static int __sev_do_cmd_locked(int cmd, void *data, int *psp_ret)
         iowrite32(reg, psp->io_regs + psp->vdata->cmdresp_reg);
 
         /* wait for command completion */
-        sev_wait_cmd_ioc(psp, &reg);
+        ret = sev_wait_cmd_ioc(psp, &reg, psp_timeout);
+        if (ret) {
+                if (psp_ret)
+                        *psp_ret = 0;
+
+                dev_err(psp->dev, "sev command %#x timed out, disabling PSP \n", cmd);
+                psp_dead = true;
+
+                return ret;
+        }
+
+        psp_timeout = psp_cmd_timeout;
 
         if (psp_ret)
                 *psp_ret = reg & PSP_CMDRESP_ERR_MASK;
@@ -888,6 +922,8 @@ void psp_pci_init(void)
 
         psp_master = sp->psp_data;
 
+        psp_timeout = psp_probe_timeout;
+
         if (sev_get_api_version())
                 goto err;
 
diff --git a/drivers/crypto/chelsio/chtls/chtls.h b/drivers/crypto/chelsio/chtls/chtls.h
index a53a0e6ba024..7725b6ee14ef 100644
--- a/drivers/crypto/chelsio/chtls/chtls.h
+++ b/drivers/crypto/chelsio/chtls/chtls.h
@@ -96,6 +96,10 @@ enum csk_flags {
         CSK_CONN_INLINE,        /* Connection on HW */
 };
 
+enum chtls_cdev_state {
+        CHTLS_CDEV_STATE_UP = 1
+};
+
 struct listen_ctx {
         struct sock *lsk;
         struct chtls_dev *cdev;
@@ -146,6 +150,7 @@ struct chtls_dev {
         unsigned int send_page_order;
         int max_host_sndbuf;
         struct key_map kmap;
+        unsigned int cdev_state;
 };
 
 struct chtls_hws {
diff --git a/drivers/crypto/chelsio/chtls/chtls_main.c b/drivers/crypto/chelsio/chtls/chtls_main.c
index 9b07f9165658..f59b044ebd25 100644
--- a/drivers/crypto/chelsio/chtls/chtls_main.c
+++ b/drivers/crypto/chelsio/chtls/chtls_main.c
@@ -160,6 +160,7 @@ static void chtls_register_dev(struct chtls_dev *cdev)
         tlsdev->hash = chtls_create_hash;
         tlsdev->unhash = chtls_destroy_hash;
         tls_register_device(&cdev->tlsdev);
+        cdev->cdev_state = CHTLS_CDEV_STATE_UP;
 }
 
 static void chtls_unregister_dev(struct chtls_dev *cdev)
@@ -281,8 +282,10 @@ static void chtls_free_all_uld(void)
         struct chtls_dev *cdev, *tmp;
 
         mutex_lock(&cdev_mutex);
-        list_for_each_entry_safe(cdev, tmp, &cdev_list, list)
-                chtls_free_uld(cdev);
+        list_for_each_entry_safe(cdev, tmp, &cdev_list, list) {
+                if (cdev->cdev_state == CHTLS_CDEV_STATE_UP)
+                        chtls_free_uld(cdev);
+        }
         mutex_unlock(&cdev_mutex);
 }
 
diff --git a/drivers/crypto/vmx/aes_cbc.c b/drivers/crypto/vmx/aes_cbc.c
index 5285ece4f33a..b71895871be3 100644
--- a/drivers/crypto/vmx/aes_cbc.c
+++ b/drivers/crypto/vmx/aes_cbc.c
@@ -107,24 +107,23 @@ static int p8_aes_cbc_encrypt(struct blkcipher_desc *desc,
                 ret = crypto_skcipher_encrypt(req);
                 skcipher_request_zero(req);
         } else {
-                preempt_disable();
-                pagefault_disable();
-                enable_kernel_vsx();
-
                 blkcipher_walk_init(&walk, dst, src, nbytes);
                 ret = blkcipher_walk_virt(desc, &walk);
                 while ((nbytes = walk.nbytes)) {
+                        preempt_disable();
+                        pagefault_disable();
+                        enable_kernel_vsx();
                         aes_p8_cbc_encrypt(walk.src.virt.addr,
                                            walk.dst.virt.addr,
                                            nbytes & AES_BLOCK_MASK,
                                            &ctx->enc_key, walk.iv, 1);
+                        disable_kernel_vsx();
+                        pagefault_enable();
+                        preempt_enable();
+
                         nbytes &= AES_BLOCK_SIZE - 1;
                         ret = blkcipher_walk_done(desc, &walk, nbytes);
                 }
-
-                disable_kernel_vsx();
-                pagefault_enable();
-                preempt_enable();
         }
 
         return ret;
@@ -147,24 +146,23 @@ static int p8_aes_cbc_decrypt(struct blkcipher_desc *desc,
                 ret = crypto_skcipher_decrypt(req);
                 skcipher_request_zero(req);
         } else {
-                preempt_disable();
-                pagefault_disable();
-                enable_kernel_vsx();
-
                 blkcipher_walk_init(&walk, dst, src, nbytes);
                 ret = blkcipher_walk_virt(desc, &walk);
                 while ((nbytes = walk.nbytes)) {
+                        preempt_disable();
+                        pagefault_disable();
+                        enable_kernel_vsx();
                         aes_p8_cbc_encrypt(walk.src.virt.addr,
                                            walk.dst.virt.addr,
                                            nbytes & AES_BLOCK_MASK,
                                            &ctx->dec_key, walk.iv, 0);
+                        disable_kernel_vsx();
+                        pagefault_enable();
+                        preempt_enable();
+
                         nbytes &= AES_BLOCK_SIZE - 1;
                         ret = blkcipher_walk_done(desc, &walk, nbytes);
                 }
-
-                disable_kernel_vsx();
-                pagefault_enable();
-                preempt_enable();
         }
 
         return ret;
diff --git a/drivers/crypto/vmx/aes_xts.c b/drivers/crypto/vmx/aes_xts.c
index 8bd9aff0f55f..e9954a7d4694 100644
--- a/drivers/crypto/vmx/aes_xts.c
+++ b/drivers/crypto/vmx/aes_xts.c
@@ -116,32 +116,39 @@ static int p8_aes_xts_crypt(struct blkcipher_desc *desc,
                 ret = enc? crypto_skcipher_encrypt(req) : crypto_skcipher_decrypt(req);
                 skcipher_request_zero(req);
         } else {
+                blkcipher_walk_init(&walk, dst, src, nbytes);
+
+                ret = blkcipher_walk_virt(desc, &walk);
+
                 preempt_disable();
                 pagefault_disable();
                 enable_kernel_vsx();
 
-                blkcipher_walk_init(&walk, dst, src, nbytes);
-
-                ret = blkcipher_walk_virt(desc, &walk);
                 iv = walk.iv;
                 memset(tweak, 0, AES_BLOCK_SIZE);
                 aes_p8_encrypt(iv, tweak, &ctx->tweak_key);
 
+                disable_kernel_vsx();
+                pagefault_enable();
+                preempt_enable();
+
                 while ((nbytes = walk.nbytes)) {
+                        preempt_disable();
+                        pagefault_disable();
+                        enable_kernel_vsx();
                         if (enc)
                                 aes_p8_xts_encrypt(walk.src.virt.addr, walk.dst.virt.addr,
                                                 nbytes & AES_BLOCK_MASK, &ctx->enc_key, NULL, tweak);
                         else
                                 aes_p8_xts_decrypt(walk.src.virt.addr, walk.dst.virt.addr,
                                                 nbytes & AES_BLOCK_MASK, &ctx->dec_key, NULL, tweak);
+                        disable_kernel_vsx();
+                        pagefault_enable();
+                        preempt_enable();
 
                         nbytes &= AES_BLOCK_SIZE - 1;
                         ret = blkcipher_walk_done(desc, &walk, nbytes);
                 }
-
-                disable_kernel_vsx();
-                pagefault_enable();
-                preempt_enable();
         }
         return ret;
 }
diff --git a/drivers/dax/device.c b/drivers/dax/device.c
index 6fd46083e629..bbe4d72ca105 100644
--- a/drivers/dax/device.c
+++ b/drivers/dax/device.c
@@ -392,7 +392,8 @@ static vm_fault_t dev_dax_huge_fault(struct vm_fault *vmf,
 {
         struct file *filp = vmf->vma->vm_file;
         unsigned long fault_size;
-        int rc, id;
+        vm_fault_t rc = VM_FAULT_SIGBUS;
+        int id;
         pfn_t pfn;
         struct dev_dax *dev_dax = filp->private_data;
 
diff --git a/drivers/dma/mic_x100_dma.c b/drivers/dma/mic_x100_dma.c
index b76cb17d879c..adfd316db1a8 100644
--- a/drivers/dma/mic_x100_dma.c
+++ b/drivers/dma/mic_x100_dma.c
@@ -639,7 +639,7 @@ static struct mic_dma_device *mic_dma_dev_reg(struct mbus_device *mbdev,
         int ret;
         struct device *dev = &mbdev->dev;
 
-        mic_dma_dev = kzalloc(sizeof(*mic_dma_dev), GFP_KERNEL);
+        mic_dma_dev = devm_kzalloc(dev, sizeof(*mic_dma_dev), GFP_KERNEL);
         if (!mic_dma_dev) {
                 ret = -ENOMEM;
                 goto alloc_error;
@@ -664,7 +664,6 @@ static struct mic_dma_device *mic_dma_dev_reg(struct mbus_device *mbdev,
 reg_error:
         mic_dma_uninit(mic_dma_dev);
 init_error:
-        kfree(mic_dma_dev);
         mic_dma_dev = NULL;
 alloc_error:
         dev_err(dev, "Error at %s %d ret=%d\n", __func__, __LINE__, ret);
@@ -674,7 +673,6 @@ alloc_error:
 static void mic_dma_dev_unreg(struct mic_dma_device *mic_dma_dev)
 {
         mic_dma_uninit(mic_dma_dev);
-        kfree(mic_dma_dev);
 }
 
 /* DEBUGFS CODE */
diff --git a/drivers/firmware/arm_scmi/perf.c b/drivers/firmware/arm_scmi/perf.c
index 721e6c57beae..64342944d917 100644
--- a/drivers/firmware/arm_scmi/perf.c
+++ b/drivers/firmware/arm_scmi/perf.c
@@ -166,7 +166,13 @@ scmi_perf_domain_attributes_get(const struct scmi_handle *handle, u32 domain,
                                         le32_to_cpu(attr->sustained_freq_khz);
                 dom_info->sustained_perf_level =
                                         le32_to_cpu(attr->sustained_perf_level);
-                dom_info->mult_factor = (dom_info->sustained_freq_khz * 1000) /
+                if (!dom_info->sustained_freq_khz ||
+                    !dom_info->sustained_perf_level)
+                        /* CPUFreq converts to kHz, hence default 1000 */
+                        dom_info->mult_factor = 1000;
+                else
+                        dom_info->mult_factor =
+                                        (dom_info->sustained_freq_khz * 1000) /
                                         dom_info->sustained_perf_level;
                 memcpy(dom_info->name, attr->name, SCMI_MAX_STR_SIZE);
         }
diff --git a/drivers/firmware/efi/Kconfig b/drivers/firmware/efi/Kconfig
index d8e159feb573..89110dfc7127 100644
--- a/drivers/firmware/efi/Kconfig
+++ b/drivers/firmware/efi/Kconfig
@@ -90,14 +90,17 @@ config EFI_ARMSTUB
 config EFI_ARMSTUB_DTB_LOADER
         bool "Enable the DTB loader"
         depends on EFI_ARMSTUB
+        default y
         help
           Select this config option to add support for the dtb= command
           line parameter, allowing a device tree blob to be loaded into
           memory from the EFI System Partition by the stub.
 
-          The device tree is typically provided by the platform or by
-          the bootloader, so this option is mostly for development
-          purposes only.
+          If the device tree is provided by the platform or by
+          the bootloader this option may not be needed.
+          But, for various development reasons and to maintain existing
+          functionality for bootloaders that do not have such support
+          this option is necessary.
 
 config EFI_BOOTLOADER_CONTROL
         tristate "EFI Bootloader Control"
diff --git a/drivers/fpga/dfl-fme-pr.c b/drivers/fpga/dfl-fme-pr.c
index fc9fd2d0482f..0b840531ef33 100644
--- a/drivers/fpga/dfl-fme-pr.c
+++ b/drivers/fpga/dfl-fme-pr.c
@@ -420,7 +420,7 @@ static int pr_mgmt_init(struct platform_device *pdev,
                 /* Create region for each port */
                 fme_region = dfl_fme_create_region(pdata, mgr,
                                                    fme_br->br, i);
-                if (!fme_region) {
+                if (IS_ERR(fme_region)) {
                         ret = PTR_ERR(fme_region);
                         goto destroy_region;
                 }
diff --git a/drivers/gpio/gpio-adp5588.c b/drivers/gpio/gpio-adp5588.c
index 3530ccd17e04..da9781a2ef4a 100644
--- a/drivers/gpio/gpio-adp5588.c
+++ b/drivers/gpio/gpio-adp5588.c
@@ -41,6 +41,8 @@ struct adp5588_gpio {
         uint8_t int_en[3];
         uint8_t irq_mask[3];
         uint8_t irq_stat[3];
+        uint8_t int_input_en[3];
+        uint8_t int_lvl_cached[3];
 };
 
 static int adp5588_gpio_read(struct i2c_client *client, u8 reg)
@@ -173,12 +175,28 @@ static void adp5588_irq_bus_sync_unlock(struct irq_data *d)
         struct adp5588_gpio *dev = irq_data_get_irq_chip_data(d);
         int i;
 
-        for (i = 0; i <= ADP5588_BANK(ADP5588_MAXGPIO); i++)
+        for (i = 0; i <= ADP5588_BANK(ADP5588_MAXGPIO); i++) {
+                if (dev->int_input_en[i]) {
+                        mutex_lock(&dev->lock);
+                        dev->dir[i] &= ~dev->int_input_en[i];
+                        dev->int_input_en[i] = 0;
+                        adp5588_gpio_write(dev->client, GPIO_DIR1 + i,
+                                           dev->dir[i]);
+                        mutex_unlock(&dev->lock);
+                }
+
+                if (dev->int_lvl_cached[i] != dev->int_lvl[i]) {
+                        dev->int_lvl_cached[i] = dev->int_lvl[i];
+                        adp5588_gpio_write(dev->client, GPIO_INT_LVL1 + i,
+                                           dev->int_lvl[i]);
+                }
+
                 if (dev->int_en[i] ^ dev->irq_mask[i]) {
                         dev->int_en[i] = dev->irq_mask[i];
                         adp5588_gpio_write(dev->client, GPIO_INT_EN1 + i,
                                            dev->int_en[i]);
                 }
+        }
 
         mutex_unlock(&dev->irq_lock);
 }
@@ -221,9 +239,7 @@ static int adp5588_irq_set_type(struct irq_data *d, unsigned int type)
         else
                 return -EINVAL;
 
-        adp5588_gpio_direction_input(&dev->gpio_chip, gpio);
-        adp5588_gpio_write(dev->client, GPIO_INT_LVL1 + bank,
-                           dev->int_lvl[bank]);
+        dev->int_input_en[bank] |= bit;
 
         return 0;
 }
diff --git a/drivers/gpio/gpio-dwapb.c b/drivers/gpio/gpio-dwapb.c
index 28da700f5f52..044888fd96a1 100644
--- a/drivers/gpio/gpio-dwapb.c
+++ b/drivers/gpio/gpio-dwapb.c
@@ -728,6 +728,7 @@ static int dwapb_gpio_probe(struct platform_device *pdev)
 out_unregister:
         dwapb_gpio_unregister(gpio);
         dwapb_irq_teardown(gpio);
+        clk_disable_unprepare(gpio->clk);
 
         return err;
 }
diff --git a/drivers/gpio/gpiolib-acpi.c b/drivers/gpio/gpiolib-acpi.c
index c48ed9d89ff5..8b9d7e42c600 100644
--- a/drivers/gpio/gpiolib-acpi.c
+++ b/drivers/gpio/gpiolib-acpi.c
@@ -25,7 +25,6 @@
 
 struct acpi_gpio_event {
         struct list_head node;
-        struct list_head initial_sync_list;
         acpi_handle handle;
         unsigned int pin;
         unsigned int irq;
@@ -49,10 +48,19 @@ struct acpi_gpio_chip {
         struct mutex conn_lock;
         struct gpio_chip *chip;
         struct list_head events;
+        struct list_head deferred_req_irqs_list_entry;
 };
 
-static LIST_HEAD(acpi_gpio_initial_sync_list);
-static DEFINE_MUTEX(acpi_gpio_initial_sync_list_lock);
+/*
+ * For gpiochips which call acpi_gpiochip_request_interrupts() before late_init
+ * (so builtin drivers) we register the ACPI GpioInt event handlers from a
+ * late_initcall_sync handler, so that other builtin drivers can register their
+ * OpRegions before the event handlers can run.  This list contains gpiochips
+ * for which the acpi_gpiochip_request_interrupts() has been deferred.
+ */
+static DEFINE_MUTEX(acpi_gpio_deferred_req_irqs_lock);
+static LIST_HEAD(acpi_gpio_deferred_req_irqs_list);
+static bool acpi_gpio_deferred_req_irqs_done;
 
 static int acpi_gpiochip_find(struct gpio_chip *gc, void *data)
 {
@@ -89,21 +97,6 @@ static struct gpio_desc *acpi_get_gpiod(char *path, int pin)
         return gpiochip_get_desc(chip, pin);
 }
 
-static void acpi_gpio_add_to_initial_sync_list(struct acpi_gpio_event *event)
-{
-        mutex_lock(&acpi_gpio_initial_sync_list_lock);
-        list_add(&event->initial_sync_list, &acpi_gpio_initial_sync_list);
-        mutex_unlock(&acpi_gpio_initial_sync_list_lock);
-}
-
-static void acpi_gpio_del_from_initial_sync_list(struct acpi_gpio_event *event)
-{
-        mutex_lock(&acpi_gpio_initial_sync_list_lock);
-        if (!list_empty(&event->initial_sync_list))
-                list_del_init(&event->initial_sync_list);
-        mutex_unlock(&acpi_gpio_initial_sync_list_lock);
-}
-
 static irqreturn_t acpi_gpio_irq_handler(int irq, void *data)
 {
         struct acpi_gpio_event *event = data;
@@ -186,7 +179,7 @@ static acpi_status acpi_gpiochip_request_interrupt(struct acpi_resource *ares,
 
         gpiod_direction_input(desc);
 
-        value = gpiod_get_value(desc);
+        value = gpiod_get_value_cansleep(desc);
 
         ret = gpiochip_lock_as_irq(chip, pin);
         if (ret) {
@@ -229,7 +222,6 @@ static acpi_status acpi_gpiochip_request_interrupt(struct acpi_resource *ares,
         event->irq = irq;
         event->pin = pin;
         event->desc = desc;
-        INIT_LIST_HEAD(&event->initial_sync_list);
 
         ret = request_threaded_irq(event->irq, NULL, handler, irqflags,
                                    "ACPI:Event", event);
@@ -251,10 +243,9 @@ static acpi_status acpi_gpiochip_request_interrupt(struct acpi_resource *ares,
          * may refer to OperationRegions from other (builtin) drivers which
          * may be probed after us.
          */
-        if (handler == acpi_gpio_irq_handler &&
-            (((irqflags & IRQF_TRIGGER_RISING) && value == 1) ||
-             ((irqflags & IRQF_TRIGGER_FALLING) && value == 0)))
-                acpi_gpio_add_to_initial_sync_list(event);
+        if (((irqflags & IRQF_TRIGGER_RISING) && value == 1) ||
+            ((irqflags & IRQF_TRIGGER_FALLING) && value == 0))
+                handler(event->irq, event);
 
         return AE_OK;
 
@@ -283,6 +274,7 @@ void acpi_gpiochip_request_interrupts(struct gpio_chip *chip)
         struct acpi_gpio_chip *acpi_gpio;
         acpi_handle handle;
         acpi_status status;
+        bool defer;
 
         if (!chip->parent || !chip->to_irq)
                 return;
@@ -295,6 +287,16 @@ void acpi_gpiochip_request_interrupts(struct gpio_chip *chip)
         if (ACPI_FAILURE(status))
                 return;
 
+        mutex_lock(&acpi_gpio_deferred_req_irqs_lock);
+        defer = !acpi_gpio_deferred_req_irqs_done;
+        if (defer)
+                list_add(&acpi_gpio->deferred_req_irqs_list_entry,
+                         &acpi_gpio_deferred_req_irqs_list);
+        mutex_unlock(&acpi_gpio_deferred_req_irqs_lock);
+
+        if (defer)
+                return;
+
         acpi_walk_resources(handle, "_AEI",
                             acpi_gpiochip_request_interrupt, acpi_gpio);
 }
@@ -325,11 +327,14 @@ void acpi_gpiochip_free_interrupts(struct gpio_chip *chip)
         if (ACPI_FAILURE(status))
                 return;
 
+        mutex_lock(&acpi_gpio_deferred_req_irqs_lock);
+        if (!list_empty(&acpi_gpio->deferred_req_irqs_list_entry))
+                list_del_init(&acpi_gpio->deferred_req_irqs_list_entry);
+        mutex_unlock(&acpi_gpio_deferred_req_irqs_lock);
+
         list_for_each_entry_safe_reverse(event, ep, &acpi_gpio->events, node) {
                 struct gpio_desc *desc;
 
-                acpi_gpio_del_from_initial_sync_list(event);
-
                 if (irqd_is_wakeup_set(irq_get_irq_data(event->irq)))
                         disable_irq_wake(event->irq);
 
@@ -1052,6 +1057,7 @@ void acpi_gpiochip_add(struct gpio_chip *chip)
 
         acpi_gpio->chip = chip;
         INIT_LIST_HEAD(&acpi_gpio->events);
+        INIT_LIST_HEAD(&acpi_gpio->deferred_req_irqs_list_entry);
 
         status = acpi_attach_data(handle, acpi_gpio_chip_dh, acpi_gpio);
         if (ACPI_FAILURE(status)) {
@@ -1198,20 +1204,28 @@ bool acpi_can_fallback_to_crs(struct acpi_device *adev, const char *con_id)
         return con_id == NULL;
 }
 
-/* Sync the initial state of handlers after all builtin drivers have probed */
-static int acpi_gpio_initial_sync(void)
+/* Run deferred acpi_gpiochip_request_interrupts() */
+static int acpi_gpio_handle_deferred_request_interrupts(void)
 {
-        struct acpi_gpio_event *event, *ep;
+        struct acpi_gpio_chip *acpi_gpio, *tmp;
+
+        mutex_lock(&acpi_gpio_deferred_req_irqs_lock);
+        list_for_each_entry_safe(acpi_gpio, tmp,
+                                 &acpi_gpio_deferred_req_irqs_list,
+                                 deferred_req_irqs_list_entry) {
+                acpi_handle handle;
 
-        mutex_lock(&acpi_gpio_initial_sync_list_lock);
-        list_for_each_entry_safe(event, ep, &acpi_gpio_initial_sync_list,
-                                 initial_sync_list) {
-                acpi_evaluate_object(event->handle, NULL, NULL, NULL);
-                list_del_init(&event->initial_sync_list);
+                handle = ACPI_HANDLE(acpi_gpio->chip->parent);
+                acpi_walk_resources(handle, "_AEI",
+                                    acpi_gpiochip_request_interrupt, acpi_gpio);
+
+                list_del_init(&acpi_gpio->deferred_req_irqs_list_entry);
         }
-        mutex_unlock(&acpi_gpio_initial_sync_list_lock);
+
+        acpi_gpio_deferred_req_irqs_done = true;
+        mutex_unlock(&acpi_gpio_deferred_req_irqs_lock);
 
         return 0;
 }
 /* We must use _sync so that this runs after the first deferred_probe run */
-late_initcall_sync(acpi_gpio_initial_sync);
+late_initcall_sync(acpi_gpio_handle_deferred_request_interrupts);
diff --git a/drivers/gpio/gpiolib-of.c b/drivers/gpio/gpiolib-of.c
index a4f1157d6aa0..d4e7a09598fa 100644
--- a/drivers/gpio/gpiolib-of.c
+++ b/drivers/gpio/gpiolib-of.c
@@ -31,6 +31,7 @@ static int of_gpiochip_match_node_and_xlate(struct gpio_chip *chip, void *data)
         struct of_phandle_args *gpiospec = data;
 
         return chip->gpiodev->dev.of_node == gpiospec->np &&
+                                chip->of_xlate &&
                                 chip->of_xlate(chip, gpiospec, NULL) >= 0;
 }
 
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c
index f8bbbb3a9504..0c791e35acf0 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c
@@ -272,7 +272,7 @@ void amdgpu_amdkfd_gpu_reset(struct kgd_dev *kgd)
 
 int alloc_gtt_mem(struct kgd_dev *kgd, size_t size,
                         void **mem_obj, uint64_t *gpu_addr,
-                        void **cpu_ptr)
+                        void **cpu_ptr, bool mqd_gfx9)
 {
         struct amdgpu_device *adev = (struct amdgpu_device *)kgd;
         struct amdgpu_bo *bo = NULL;
@@ -287,6 +287,10 @@ int alloc_gtt_mem(struct kgd_dev *kgd, size_t size,
         bp.flags = AMDGPU_GEM_CREATE_CPU_GTT_USWC;
         bp.type = ttm_bo_type_kernel;
         bp.resv = NULL;
+
+        if (mqd_gfx9)
+                bp.flags |= AMDGPU_GEM_CREATE_MQD_GFX9;
+
         r = amdgpu_bo_create(adev, &bp, &bo);
         if (r) {
                 dev_err(adev->dev,
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h
index 2f379c183ed2..cc9aeab5468c 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h
@@ -136,7 +136,7 @@ void amdgpu_amdkfd_gpu_reset(struct kgd_dev *kgd);
 /* Shared API */
 int alloc_gtt_mem(struct kgd_dev *kgd, size_t size,
                         void **mem_obj, uint64_t *gpu_addr,
-                        void **cpu_ptr);
+                        void **cpu_ptr, bool mqd_gfx9);
 void free_gtt_mem(struct kgd_dev *kgd, void *mem_obj);
 void get_local_mem_info(struct kgd_dev *kgd,
                         struct kfd_local_mem_info *mem_info);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v7.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v7.c
index ea3f698aef5e..9803b91f3e77 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v7.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v7.c
@@ -685,7 +685,7 @@ static int kgd_hqd_sdma_destroy(struct kgd_dev *kgd, void *mqd,
 
         while (true) {
                 temp = RREG32(sdma_base_addr + mmSDMA0_RLC0_CONTEXT_STATUS);
-                if (temp & SDMA0_STATUS_REG__RB_CMD_IDLE__SHIFT)
+                if (temp & SDMA0_RLC0_CONTEXT_STATUS__IDLE_MASK)
                         break;
                 if (time_after(jiffies, end_jiffies))
                         return -ETIME;
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c
index 693ec5ea4950..8816c697b205 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c
@@ -367,12 +367,14 @@ static int amdgpu_cgs_get_firmware_info(struct cgs_device *cgs_device,
                                 break;
                         case CHIP_POLARIS10:
                                 if (type == CGS_UCODE_ID_SMU) {
-                                        if ((adev->pdev->device == 0x67df) &&
-                                            ((adev->pdev->revision == 0xe0) ||
-                                             (adev->pdev->revision == 0xe3) ||
-                                             (adev->pdev->revision == 0xe4) ||
-                                             (adev->pdev->revision == 0xe5) ||
-                                             (adev->pdev->revision == 0xe7) ||
+                                        if (((adev->pdev->device == 0x67df) &&
+                                             ((adev->pdev->revision == 0xe0) ||
+                                              (adev->pdev->revision == 0xe3) ||
+                                              (adev->pdev->revision == 0xe4) ||
+                                              (adev->pdev->revision == 0xe5) ||
+                                              (adev->pdev->revision == 0xe7) ||
+                                              (adev->pdev->revision == 0xef))) ||
+                                            ((adev->pdev->device == 0x6fdf) &&
                                              (adev->pdev->revision == 0xef))) {
                                                 info->is_kicker = true;
                                                 strcpy(fw_name, "amdgpu/polaris10_k_smc.bin");
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
index 502b94fb116a..b31d121a876b 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
@@ -39,6 +39,7 @@ static int amdgpu_cs_user_fence_chunk(struct amdgpu_cs_parser *p,
 {
         struct drm_gem_object *gobj;
         unsigned long size;
+        int r;
 
         gobj = drm_gem_object_lookup(p->filp, data->handle);
         if (gobj == NULL)
@@ -50,20 +51,26 @@ static int amdgpu_cs_user_fence_chunk(struct amdgpu_cs_parser *p,
         p->uf_entry.tv.shared = true;
         p->uf_entry.user_pages = NULL;
 
-        size = amdgpu_bo_size(p->uf_entry.robj);
-        if (size != PAGE_SIZE || (data->offset + 8) > size)
-                return -EINVAL;
-
-        *offset = data->offset;
-
         drm_gem_object_put_unlocked(gobj);
 
+        size = amdgpu_bo_size(p->uf_entry.robj);
+        if (size != PAGE_SIZE || (data->offset + 8) > size) {
+                r = -EINVAL;
+                goto error_unref;
+        }
+
         if (amdgpu_ttm_tt_get_usermm(p->uf_entry.robj->tbo.ttm)) {
-                amdgpu_bo_unref(&p->uf_entry.robj);
-                return -EINVAL;
+                r = -EINVAL;
+                goto error_unref;
         }
 
+        *offset = data->offset;
+
         return 0;
+
+error_unref:
+        amdgpu_bo_unref(&p->uf_entry.robj);
+        return r;
 }
 
 static int amdgpu_cs_bo_handles_chunk(struct amdgpu_cs_parser *p,
@@ -1012,13 +1019,9 @@ static int amdgpu_cs_ib_fill(struct amdgpu_device *adev,
                 if (r)
                         return r;
 
-                if (chunk_ib->flags & AMDGPU_IB_FLAG_PREAMBLE) {
-                        parser->job->preamble_status |= AMDGPU_PREAMBLE_IB_PRESENT;
-                        if (!parser->ctx->preamble_presented) {
-                                parser->job->preamble_status |= AMDGPU_PREAMBLE_IB_PRESENT_FIRST;
-                                parser->ctx->preamble_presented = true;
-                        }
-                }
+                if (chunk_ib->flags & AMDGPU_IB_FLAG_PREAMBLE)
+                        parser->job->preamble_status |=
+                                AMDGPU_PREAMBLE_IB_PRESENT;
 
                 if (parser->ring && parser->ring != ring)
                         return -EINVAL;
@@ -1207,26 +1210,24 @@ static int amdgpu_cs_submit(struct amdgpu_cs_parser *p,
 
         int r;
 
+        job = p->job;
+        p->job = NULL;
+
+        r = drm_sched_job_init(&job->base, entity, p->filp);
+        if (r)
+                goto error_unlock;
+
+        /* No memory allocation is allowed while holding the mn lock */
         amdgpu_mn_lock(p->mn);
         amdgpu_bo_list_for_each_userptr_entry(e, p->bo_list) {
                 struct amdgpu_bo *bo = e->robj;
 
                 if (amdgpu_ttm_tt_userptr_needs_pages(bo->tbo.ttm)) {
-                        amdgpu_mn_unlock(p->mn);
-                        return -ERESTARTSYS;
+                        r = -ERESTARTSYS;
+                        goto error_abort;
                 }
         }
 
-        job = p->job;
-        p->job = NULL;
-
-        r = drm_sched_job_init(&job->base, entity, p->filp);
-        if (r) {
-                amdgpu_job_free(job);
-                amdgpu_mn_unlock(p->mn);
-                return r;
-        }
-
         job->owner = p->filp;
         p->fence = dma_fence_get(&job->base.s_fence->finished);
 
@@ -1241,6 +1242,12 @@ static int amdgpu_cs_submit(struct amdgpu_cs_parser *p,
 
         amdgpu_cs_post_dependencies(p);
 
+        if ((job->preamble_status & AMDGPU_PREAMBLE_IB_PRESENT) &&
+            !p->ctx->preamble_presented) {
+                job->preamble_status |= AMDGPU_PREAMBLE_IB_PRESENT_FIRST;
+                p->ctx->preamble_presented = true;
+        }
+
         cs->out.handle = seq;
         job->uf_sequence = seq;
 
@@ -1258,6 +1265,15 @@ static int amdgpu_cs_submit(struct amdgpu_cs_parser *p,
         amdgpu_mn_unlock(p->mn);
 
         return 0;
+
+error_abort:
+        dma_fence_put(&job->base.s_fence->finished);
+        job->base.s_fence = NULL;
+        amdgpu_mn_unlock(p->mn);
+
+error_unlock:
+        amdgpu_job_free(job);
+        return r;
 }
 
 int amdgpu_cs_ioctl(struct drm_device *dev, void *data, struct drm_file *filp)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
index 8ab5ccbc14ac..39bf2ce548c6 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -2063,6 +2063,7 @@ static int amdgpu_device_ip_reinit_early_sriov(struct amdgpu_device *adev)
         static enum amd_ip_block_type ip_order[] = {
                 AMD_IP_BLOCK_TYPE_GMC,
                 AMD_IP_BLOCK_TYPE_COMMON,
+                AMD_IP_BLOCK_TYPE_PSP,
                 AMD_IP_BLOCK_TYPE_IH,
         };
 
@@ -2093,7 +2094,6 @@ static int amdgpu_device_ip_reinit_late_sriov(struct amdgpu_device *adev)
 
         static enum amd_ip_block_type ip_order[] = {
                 AMD_IP_BLOCK_TYPE_SMC,
-                AMD_IP_BLOCK_TYPE_PSP,
                 AMD_IP_BLOCK_TYPE_DCE,
                 AMD_IP_BLOCK_TYPE_GFX,
                 AMD_IP_BLOCK_TYPE_SDMA,
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
index 8843a06360fa..0f41d8647376 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
@@ -740,6 +740,7 @@ static const struct pci_device_id pciidlist[] = {
         {0x1002, 0x67CA, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS10},
         {0x1002, 0x67CC, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS10},
         {0x1002, 0x67CF, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS10},
+        {0x1002, 0x6FDF, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS10},
         /* Polaris12 */
         {0x1002, 0x6980, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS12},
         {0x1002, 0x6981, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS12},
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c
index 5518e623fed2..51b5e977ca88 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c
@@ -164,8 +164,10 @@ int amdgpu_ib_schedule(struct amdgpu_ring *ring, unsigned num_ibs,
                 return r;
         }
 
+        need_ctx_switch = ring->current_ctx != fence_ctx;
         if (ring->funcs->emit_pipeline_sync && job &&
             ((tmp = amdgpu_sync_get_fence(&job->sched_sync, NULL)) ||
+             (amdgpu_sriov_vf(adev) && need_ctx_switch) ||
              amdgpu_vm_need_pipeline_sync(ring, job))) {
                 need_pipe_sync = true;
                 dma_fence_put(tmp);
@@ -196,7 +198,6 @@ int amdgpu_ib_schedule(struct amdgpu_ring *ring, unsigned num_ibs,
         }
 
         skip_preamble = ring->current_ctx == fence_ctx;
-        need_ctx_switch = ring->current_ctx != fence_ctx;
         if (job && ring->funcs->emit_cntxcntl) {
                 if (need_ctx_switch)
                         status |= AMDGPU_HAVE_CTX_SWITCH;
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
index 8f98629fbe59..7b4e657a95c7 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
@@ -1932,14 +1932,6 @@ void amdgpu_pm_compute_clocks(struct amdgpu_device *adev)
                         amdgpu_fence_wait_empty(ring);
         }
 
-        mutex_lock(&adev->pm.mutex);
-        /* update battery/ac status */
-        if (power_supply_is_system_supplied() > 0)
-                adev->pm.ac_power = true;
-        else
-                adev->pm.ac_power = false;
-        mutex_unlock(&adev->pm.mutex);
-
         if (adev->powerplay.pp_funcs->dispatch_tasks) {
                 if (!amdgpu_device_has_dc_support(adev)) {
                         mutex_lock(&adev->pm.mutex);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
index ece0ac703e27..b17771dd5ce7 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
@@ -172,6 +172,7 @@ static void amdgpu_vm_bo_base_init(struct amdgpu_vm_bo_base *base,
          * is validated on next vm use to avoid fault.
          * */
         list_move_tail(&base->vm_status, &vm->evicted);
+        base->moved = true;
 }
 
 /**
@@ -369,7 +370,6 @@ static int amdgpu_vm_clear_bo(struct amdgpu_device *adev,
         uint64_t addr;
         int r;
 
-        addr = amdgpu_bo_gpu_offset(bo);
         entries = amdgpu_bo_size(bo) / 8;
 
         if (pte_support_ats) {
@@ -401,6 +401,7 @@ static int amdgpu_vm_clear_bo(struct amdgpu_device *adev,
         if (r)
                 goto error;
 
+        addr = amdgpu_bo_gpu_offset(bo);
         if (ats_entries) {
                 uint64_t ats_value;
 
@@ -2483,28 +2484,52 @@ static uint32_t amdgpu_vm_get_block_size(uint64_t vm_size)
  * amdgpu_vm_adjust_size - adjust vm size, block size and fragment size
  *
  * @adev: amdgpu_device pointer
- * @vm_size: the default vm size if it's set auto
+ * @min_vm_size: the minimum vm size in GB if it's set auto
  * @fragment_size_default: Default PTE fragment size
  * @max_level: max VMPT level
  * @max_bits: max address space size in bits
  *
  */
-void amdgpu_vm_adjust_size(struct amdgpu_device *adev, uint32_t vm_size,
+void amdgpu_vm_adjust_size(struct amdgpu_device *adev, uint32_t min_vm_size,
                            uint32_t fragment_size_default, unsigned max_level,
                            unsigned max_bits)
 {
+        unsigned int max_size = 1 << (max_bits - 30);
+        unsigned int vm_size;
         uint64_t tmp;
 
         /* adjust vm size first */
         if (amdgpu_vm_size != -1) {
-                unsigned max_size = 1 << (max_bits - 30);
-
                 vm_size = amdgpu_vm_size;
                 if (vm_size > max_size) {
                         dev_warn(adev->dev, "VM size (%d) too large, max is %u GB\n",
                                  amdgpu_vm_size, max_size);
                         vm_size = max_size;
                 }
+        } else {
+                struct sysinfo si;
+                unsigned int phys_ram_gb;
+
+                /* Optimal VM size depends on the amount of physical
+                 * RAM available. Underlying requirements and
+                 * assumptions:
+                 *
+                 *  - Need to map system memory and VRAM from all GPUs
+                 *     - VRAM from other GPUs not known here
+                 *     - Assume VRAM <= system memory
+                 *  - On GFX8 and older, VM space can be segmented for
+                 *    different MTYPEs
+                 *  - Need to allow room for fragmentation, guard pages etc.
+                 *
+                 * This adds up to a rough guess of system memory x3.
+                 * Round up to power of two to maximize the available
+                 * VM size with the given page table size.
+                 */
+                si_meminfo(&si);
+                phys_ram_gb = ((uint64_t)si.totalram * si.mem_unit +
+                               (1 << 30) - 1) >> 30;
+                vm_size = roundup_pow_of_two(
+                        min(max(phys_ram_gb * 3, min_vm_size), max_size));
         }
 
         adev->vm_manager.max_pfn = (uint64_t)vm_size << 18;
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h
index 67a15d439ac0..9fa9df0c5e7f 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h
@@ -321,7 +321,7 @@ struct amdgpu_bo_va_mapping *amdgpu_vm_bo_lookup_mapping(struct amdgpu_vm *vm,
 void amdgpu_vm_bo_trace_cs(struct amdgpu_vm *vm, struct ww_acquire_ctx *ticket);
 void amdgpu_vm_bo_rmv(struct amdgpu_device *adev,
                       struct amdgpu_bo_va *bo_va);
-void amdgpu_vm_adjust_size(struct amdgpu_device *adev, uint32_t vm_size,
+void amdgpu_vm_adjust_size(struct amdgpu_device *adev, uint32_t min_vm_size,
                            uint32_t fragment_size_default, unsigned max_level,
                            unsigned max_bits);
 int amdgpu_vm_ioctl(struct drm_device *dev, void *data, struct drm_file *filp);
diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
index 5cd45210113f..5a9534a82d40 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
@@ -5664,6 +5664,11 @@ static int gfx_v8_0_set_powergating_state(void *handle,
         if (amdgpu_sriov_vf(adev))
                 return 0;
 
+        if (adev->pg_flags & (AMD_PG_SUPPORT_GFX_SMG |
+                                AMD_PG_SUPPORT_RLC_SMU_HS |
+                                AMD_PG_SUPPORT_CP |
+                                AMD_PG_SUPPORT_GFX_DMG))
+                adev->gfx.rlc.funcs->enter_safe_mode(adev);
         switch (adev->asic_type) {
         case CHIP_CARRIZO:
         case CHIP_STONEY:
@@ -5713,7 +5718,11 @@ static int gfx_v8_0_set_powergating_state(void *handle,
         default:
                 break;
         }
-
+        if (adev->pg_flags & (AMD_PG_SUPPORT_GFX_SMG |
+                                AMD_PG_SUPPORT_RLC_SMU_HS |
+                                AMD_PG_SUPPORT_CP |
+                                AMD_PG_SUPPORT_GFX_DMG))
+                adev->gfx.rlc.funcs->exit_safe_mode(adev);
         return 0;
 }
 
diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c
index 75317f283c69..ad151fefa41f 100644
--- a/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c
@@ -632,12 +632,6 @@ static void gmc_v6_0_gart_disable(struct amdgpu_device *adev)
         amdgpu_gart_table_vram_unpin(adev);
 }
 
-static void gmc_v6_0_gart_fini(struct amdgpu_device *adev)
-{
-        amdgpu_gart_table_vram_free(adev);
-        amdgpu_gart_fini(adev);
-}
-
 static void gmc_v6_0_vm_decode_fault(struct amdgpu_device *adev,
                                      u32 status, u32 addr, u32 mc_client)
 {
@@ -935,8 +929,9 @@ static int gmc_v6_0_sw_fini(void *handle)
 
         amdgpu_gem_force_release(adev);
         amdgpu_vm_manager_fini(adev);
-        gmc_v6_0_gart_fini(adev);
+        amdgpu_gart_table_vram_free(adev);
         amdgpu_bo_fini(adev);
+        amdgpu_gart_fini(adev);
         release_firmware(adev->gmc.fw);
         adev->gmc.fw = NULL;
 
diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c
index 36dc367c4b45..f8d8a3a73e42 100644
--- a/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c
@@ -747,19 +747,6 @@ static void gmc_v7_0_gart_disable(struct amdgpu_device *adev)
 }
 
 /**
- * gmc_v7_0_gart_fini - vm fini callback
- *
- * @adev: amdgpu_device pointer
- *
- * Tears down the driver GART/VM setup (CIK).
- */
-static void gmc_v7_0_gart_fini(struct amdgpu_device *adev)
-{
-        amdgpu_gart_table_vram_free(adev);
-        amdgpu_gart_fini(adev);
-}
-
-/**
  * gmc_v7_0_vm_decode_fault - print human readable fault info
  *
  * @adev: amdgpu_device pointer
@@ -1095,8 +1082,9 @@ static int gmc_v7_0_sw_fini(void *handle)
         amdgpu_gem_force_release(adev);
         amdgpu_vm_manager_fini(adev);
         kfree(adev->gmc.vm_fault_info);
-        gmc_v7_0_gart_fini(adev);
+        amdgpu_gart_table_vram_free(adev);
         amdgpu_bo_fini(adev);
+        amdgpu_gart_fini(adev);
         release_firmware(adev->gmc.fw);
         adev->gmc.fw = NULL;
 
diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c
index 70fc97b59b4f..9333109b210d 100644
--- a/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c
@@ -969,19 +969,6 @@ static void gmc_v8_0_gart_disable(struct amdgpu_device *adev)
 }
 
 /**
- * gmc_v8_0_gart_fini - vm fini callback
- *
- * @adev: amdgpu_device pointer
- *
- * Tears down the driver GART/VM setup (CIK).
- */
-static void gmc_v8_0_gart_fini(struct amdgpu_device *adev)
-{
-        amdgpu_gart_table_vram_free(adev);
-        amdgpu_gart_fini(adev);
-}
-
-/**
  * gmc_v8_0_vm_decode_fault - print human readable fault info
  *
  * @adev: amdgpu_device pointer
@@ -1199,8 +1186,9 @@ static int gmc_v8_0_sw_fini(void *handle)
         amdgpu_gem_force_release(adev);
         amdgpu_vm_manager_fini(adev);
         kfree(adev->gmc.vm_fault_info);
-        gmc_v8_0_gart_fini(adev);
+        amdgpu_gart_table_vram_free(adev);
         amdgpu_bo_fini(adev);
+        amdgpu_gart_fini(adev);
         release_firmware(adev->gmc.fw);
         adev->gmc.fw = NULL;
 
diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
index 399a5db27649..72f8018fa2a8 100644
--- a/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
@@ -942,26 +942,12 @@ static int gmc_v9_0_sw_init(void *handle)
         return 0;
 }
 
-/**
- * gmc_v9_0_gart_fini - vm fini callback
- *
- * @adev: amdgpu_device pointer
- *
- * Tears down the driver GART/VM setup (CIK).
- */
-static void gmc_v9_0_gart_fini(struct amdgpu_device *adev)
-{
-        amdgpu_gart_table_vram_free(adev);
-        amdgpu_gart_fini(adev);
-}
-
 static int gmc_v9_0_sw_fini(void *handle)
 {
         struct amdgpu_device *adev = (struct amdgpu_device *)handle;
 
         amdgpu_gem_force_release(adev);
         amdgpu_vm_manager_fini(adev);
-        gmc_v9_0_gart_fini(adev);
 
         /*
         * TODO:
@@ -974,7 +960,9 @@ static int gmc_v9_0_sw_fini(void *handle)
         */
         amdgpu_bo_free_kernel(&adev->stolen_vga_memory, NULL, NULL);
 
+        amdgpu_gart_table_vram_free(adev);
         amdgpu_bo_fini(adev);
+        amdgpu_gart_fini(adev);
 
         return 0;
 }
diff --git a/drivers/gpu/drm/amd/amdgpu/kv_dpm.c b/drivers/gpu/drm/amd/amdgpu/kv_dpm.c
index 3f57f6463dc8..cb79a93c2eb7 100644
--- a/drivers/gpu/drm/amd/amdgpu/kv_dpm.c
+++ b/drivers/gpu/drm/amd/amdgpu/kv_dpm.c
@@ -65,8 +65,6 @@ static int kv_set_thermal_temperature_range(struct amdgpu_device *adev,
                                             int min_temp, int max_temp);
 static int kv_init_fps_limits(struct amdgpu_device *adev);
 
-static void kv_dpm_powergate_uvd(void *handle, bool gate);
-static void kv_dpm_powergate_vce(struct amdgpu_device *adev, bool gate);
 static void kv_dpm_powergate_samu(struct amdgpu_device *adev, bool gate);
 static void kv_dpm_powergate_acp(struct amdgpu_device *adev, bool gate);
 
@@ -1354,8 +1352,6 @@ static int kv_dpm_enable(struct amdgpu_device *adev)
                 return ret;
         }
 
-        kv_update_current_ps(adev, adev->pm.dpm.boot_ps);
-
         if (adev->irq.installed &&
             amdgpu_is_internal_thermal_sensor(adev->pm.int_thermal_type)) {
                 ret = kv_set_thermal_temperature_range(adev, KV_TEMP_RANGE_MIN, KV_TEMP_RANGE_MAX);
@@ -1374,6 +1370,8 @@ static int kv_dpm_enable(struct amdgpu_device *adev)
 
 static void kv_dpm_disable(struct amdgpu_device *adev)
 {
+        struct kv_power_info *pi = kv_get_pi(adev);
+
         amdgpu_irq_put(adev, &adev->pm.dpm.thermal.irq,
                        AMDGPU_THERMAL_IRQ_LOW_TO_HIGH);
         amdgpu_irq_put(adev, &adev->pm.dpm.thermal.irq,
@@ -1387,8 +1385,10 @@ static void kv_dpm_disable(struct amdgpu_device *adev)
         /* powerup blocks */
         kv_dpm_powergate_acp(adev, false);
         kv_dpm_powergate_samu(adev, false);
-        kv_dpm_powergate_vce(adev, false);
-        kv_dpm_powergate_uvd(adev, false);
+        if (pi->caps_vce_pg) /* power on the VCE block */
+                amdgpu_kv_notify_message_to_smu(adev, PPSMC_MSG_VCEPowerON);
+        if (pi->caps_uvd_pg) /* power on the UVD block */
+                amdgpu_kv_notify_message_to_smu(adev, PPSMC_MSG_UVDPowerON);
 
         kv_enable_smc_cac(adev, false);
         kv_enable_didt(adev, false);
@@ -1551,7 +1551,6 @@ static int kv_update_vce_dpm(struct amdgpu_device *adev,
         int ret;
 
         if (amdgpu_new_state->evclk > 0 && amdgpu_current_state->evclk == 0) {
-                kv_dpm_powergate_vce(adev, false);
                 if (pi->caps_stable_p_state)
                         pi->vce_boot_level = table->count - 1;
                 else
@@ -1573,7 +1572,6 @@ static int kv_update_vce_dpm(struct amdgpu_device *adev,
                 kv_enable_vce_dpm(adev, true);
         } else if (amdgpu_new_state->evclk == 0 && amdgpu_current_state->evclk > 0) {
                 kv_enable_vce_dpm(adev, false);
-                kv_dpm_powergate_vce(adev, true);
         }
 
         return 0;
@@ -1702,24 +1700,32 @@ static void kv_dpm_powergate_uvd(void *handle, bool gate)
         }
 }
 
-static void kv_dpm_powergate_vce(struct amdgpu_device *adev, bool gate)
+static void kv_dpm_powergate_vce(void *handle, bool gate)
 {
+        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
         struct kv_power_info *pi = kv_get_pi(adev);
-
-        if (pi->vce_power_gated == gate)
-                return;
+        int ret;
 
         pi->vce_power_gated = gate;
 
-        if (!pi->caps_vce_pg)
-                return;
-
-        if (gate)
-                amdgpu_kv_notify_message_to_smu(adev, PPSMC_MSG_VCEPowerOFF);
-        else
-                amdgpu_kv_notify_message_to_smu(adev, PPSMC_MSG_VCEPowerON);
+        if (gate) {
+                /* stop the VCE block */
+                ret = amdgpu_device_ip_set_powergating_state(adev, AMD_IP_BLOCK_TYPE_VCE,
+                                                             AMD_PG_STATE_GATE);
+                kv_enable_vce_dpm(adev, false);
+                if (pi->caps_vce_pg) /* power off the VCE block */
+                        amdgpu_kv_notify_message_to_smu(adev, PPSMC_MSG_VCEPowerOFF);
+        } else {
+                if (pi->caps_vce_pg) /* power on the VCE block */
+                        amdgpu_kv_notify_message_to_smu(adev, PPSMC_MSG_VCEPowerON);
+                kv_enable_vce_dpm(adev, true);
+                /* re-init the VCE block */
+                ret = amdgpu_device_ip_set_powergating_state(adev, AMD_IP_BLOCK_TYPE_VCE,
+                                                             AMD_PG_STATE_UNGATE);
+        }
 }
 
+
 static void kv_dpm_powergate_samu(struct amdgpu_device *adev, bool gate)
 {
         struct kv_power_info *pi = kv_get_pi(adev);
@@ -3061,7 +3067,7 @@ static int kv_dpm_hw_init(void *handle)
         else
                 adev->pm.dpm_enabled = true;
         mutex_unlock(&adev->pm.mutex);
-
+        amdgpu_pm_compute_clocks(adev);
         return ret;
 }
 
@@ -3313,6 +3319,9 @@ static int kv_set_powergating_by_smu(void *handle,
         case AMD_IP_BLOCK_TYPE_UVD:
                 kv_dpm_powergate_uvd(handle, gate);
                 break;
+        case AMD_IP_BLOCK_TYPE_VCE:
+                kv_dpm_powergate_vce(handle, gate);
+                break;
         default:
                 break;
         }
diff --git a/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c b/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c
index e7ca4623cfb9..7c3b634d8d5f 100644
--- a/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c
@@ -70,6 +70,7 @@ static const struct soc15_reg_golden golden_settings_sdma_4[] = {
         SOC15_REG_GOLDEN_VALUE(SDMA0, 0, mmSDMA0_RLC1_IB_CNTL, 0x800f0100, 0x00000100),
         SOC15_REG_GOLDEN_VALUE(SDMA0, 0, mmSDMA0_RLC1_RB_WPTR_POLL_CNTL, 0x0000fff0, 0x00403000),
         SOC15_REG_GOLDEN_VALUE(SDMA0, 0, mmSDMA0_UTCL1_PAGE, 0x000003ff, 0x000003c0),
+        SOC15_REG_GOLDEN_VALUE(SDMA0, 0, mmSDMA0_UTCL1_WATERMK, 0xfc000000, 0x00000000),
         SOC15_REG_GOLDEN_VALUE(SDMA1, 0, mmSDMA1_CHICKEN_BITS, 0xfe931f07, 0x02831f07),
         SOC15_REG_GOLDEN_VALUE(SDMA1, 0, mmSDMA1_CLK_CTRL, 0xffffffff, 0x3f000100),
         SOC15_REG_GOLDEN_VALUE(SDMA1, 0, mmSDMA1_GFX_IB_CNTL, 0x800f0100, 0x00000100),
@@ -81,7 +82,8 @@ static const struct soc15_reg_golden golden_settings_sdma_4[] = {
         SOC15_REG_GOLDEN_VALUE(SDMA1, 0, mmSDMA1_RLC0_RB_WPTR_POLL_CNTL, 0x0000fff0, 0x00403000),
         SOC15_REG_GOLDEN_VALUE(SDMA1, 0, mmSDMA1_RLC1_IB_CNTL, 0x800f0100, 0x00000100),
         SOC15_REG_GOLDEN_VALUE(SDMA1, 0, mmSDMA1_RLC1_RB_WPTR_POLL_CNTL, 0x0000fff0, 0x00403000),
-        SOC15_REG_GOLDEN_VALUE(SDMA1, 0, mmSDMA1_UTCL1_PAGE, 0x000003ff, 0x000003c0)
+        SOC15_REG_GOLDEN_VALUE(SDMA1, 0, mmSDMA1_UTCL1_PAGE, 0x000003ff, 0x000003c0),
+        SOC15_REG_GOLDEN_VALUE(SDMA1, 0, mmSDMA1_UTCL1_WATERMK, 0xfc000000, 0x00000000)
 };
 
 static const struct soc15_reg_golden golden_settings_sdma_vg10[] = {
@@ -109,7 +111,8 @@ static const struct soc15_reg_golden golden_settings_sdma_4_1[] =
         SOC15_REG_GOLDEN_VALUE(SDMA0, 0, mmSDMA0_RLC0_RB_WPTR_POLL_CNTL, 0xfffffff7, 0x00403000),
         SOC15_REG_GOLDEN_VALUE(SDMA0, 0, mmSDMA0_RLC1_IB_CNTL, 0x800f0111, 0x00000100),
         SOC15_REG_GOLDEN_VALUE(SDMA0, 0, mmSDMA0_RLC1_RB_WPTR_POLL_CNTL, 0xfffffff7, 0x00403000),
-        SOC15_REG_GOLDEN_VALUE(SDMA0, 0, mmSDMA0_UTCL1_PAGE, 0x000003ff, 0x000003c0)
+        SOC15_REG_GOLDEN_VALUE(SDMA0, 0, mmSDMA0_UTCL1_PAGE, 0x000003ff, 0x000003c0),
+        SOC15_REG_GOLDEN_VALUE(SDMA0, 0, mmSDMA0_UTCL1_WATERMK, 0xfc000000, 0x00000000)
 };
 
 static const struct soc15_reg_golden golden_settings_sdma_4_2[] =
diff --git a/drivers/gpu/drm/amd/amdgpu/si_dpm.c b/drivers/gpu/drm/amd/amdgpu/si_dpm.c
index db327b412562..1de96995e690 100644
--- a/drivers/gpu/drm/amd/amdgpu/si_dpm.c
+++ b/drivers/gpu/drm/amd/amdgpu/si_dpm.c
@@ -6887,7 +6887,6 @@ static int si_dpm_enable(struct amdgpu_device *adev)
 
         si_enable_auto_throttle_source(adev, AMDGPU_DPM_AUTO_THROTTLE_SRC_THERMAL, true);
         si_thermal_start_thermal_controller(adev);
-        ni_update_current_ps(adev, boot_ps);
 
         return 0;
 }
@@ -7763,7 +7762,7 @@ static int si_dpm_hw_init(void *handle)
         else
                 adev->pm.dpm_enabled = true;
         mutex_unlock(&adev->pm.mutex);
-
+        amdgpu_pm_compute_clocks(adev);
         return ret;
 }
 
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device.c b/drivers/gpu/drm/amd/amdkfd/kfd_device.c
index 1b048715ab8a..29ac74f40dce 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_device.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_device.c
@@ -457,7 +457,8 @@ bool kgd2kfd_device_init(struct kfd_dev *kfd,
 
         if (kfd->kfd2kgd->init_gtt_mem_allocation(
                         kfd->kgd, size, &kfd->gtt_mem,
-                        &kfd->gtt_start_gpu_addr, &kfd->gtt_start_cpu_ptr)){
+                        &kfd->gtt_start_gpu_addr, &kfd->gtt_start_cpu_ptr,
+                        false)) {
                 dev_err(kfd_device, "Could not allocate %d bytes\n", size);
                 goto out;
         }
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_iommu.c b/drivers/gpu/drm/amd/amdkfd/kfd_iommu.c
index 7a61f38c09e6..01494752c36a 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_iommu.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_iommu.c
@@ -62,9 +62,20 @@ int kfd_iommu_device_init(struct kfd_dev *kfd)
         struct amd_iommu_device_info iommu_info;
         unsigned int pasid_limit;
         int err;
+        struct kfd_topology_device *top_dev;
 
-        if (!kfd->device_info->needs_iommu_device)
+        top_dev = kfd_topology_device_by_id(kfd->id);
+
+        /*
+         * Overwrite ATS capability according to needs_iommu_device to fix
+         * potential missing corresponding bit in CRAT of BIOS.
+         */
+        if (!kfd->device_info->needs_iommu_device) {
+                top_dev->node_props.capability &= ~HSA_CAP_ATS_PRESENT;
                 return 0;
+        }
+
+        top_dev->node_props.capability |= HSA_CAP_ATS_PRESENT;
 
         iommu_info.flags = 0;
         err = amd_iommu_device_info(kfd->pdev, &iommu_info);
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c
index f5fc3675f21e..0cedb37cf513 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c
@@ -88,7 +88,7 @@ static int init_mqd(struct mqd_manager *mm, void **mqd,
                                 ALIGN(sizeof(struct v9_mqd), PAGE_SIZE),
                         &((*mqd_mem_obj)->gtt_mem),
                         &((*mqd_mem_obj)->gpu_addr),
-                        (void *)&((*mqd_mem_obj)->cpu_ptr));
+                        (void *)&((*mqd_mem_obj)->cpu_ptr), true);
         } else
                 retval = kfd_gtt_sa_allocate(mm->dev, sizeof(struct v9_mqd),
                                 mqd_mem_obj);
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
index f971710f1c91..92b285ca73aa 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
@@ -806,6 +806,7 @@ int kfd_topology_add_device(struct kfd_dev *gpu);
 int kfd_topology_remove_device(struct kfd_dev *gpu);
 struct kfd_topology_device *kfd_topology_device_by_proximity_domain(
                                                 uint32_t proximity_domain);
+struct kfd_topology_device *kfd_topology_device_by_id(uint32_t gpu_id);
 struct kfd_dev *kfd_device_by_id(uint32_t gpu_id);
 struct kfd_dev *kfd_device_by_pci_dev(const struct pci_dev *pdev);
 int kfd_topology_enum_kfd_devices(uint8_t idx, struct kfd_dev **kdev);
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
index bc95d4dfee2e..80f5db4ef75f 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
@@ -63,22 +63,33 @@ struct kfd_topology_device *kfd_topology_device_by_proximity_domain(
         return device;
 }
 
-struct kfd_dev *kfd_device_by_id(uint32_t gpu_id)
+struct kfd_topology_device *kfd_topology_device_by_id(uint32_t gpu_id)
 {
-        struct kfd_topology_device *top_dev;
-        struct kfd_dev *device = NULL;
+        struct kfd_topology_device *top_dev = NULL;
+        struct kfd_topology_device *ret = NULL;
 
         down_read(&topology_lock);
 
         list_for_each_entry(top_dev, &topology_device_list, list)
                 if (top_dev->gpu_id == gpu_id) {
-                        device = top_dev->gpu;
+                        ret = top_dev;
                         break;
                 }
 
         up_read(&topology_lock);
 
-        return device;
+        return ret;
+}
+
+struct kfd_dev *kfd_device_by_id(uint32_t gpu_id)
+{
+        struct kfd_topology_device *top_dev;
+
+        top_dev = kfd_topology_device_by_id(gpu_id);
+        if (!top_dev)
+                return NULL;
+
+        return top_dev->gpu;
 }
 
 struct kfd_dev *kfd_device_by_pci_dev(const struct pci_dev *pdev)
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_pp_smu.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_pp_smu.c
index fbe878ae1e8c..4ba0003a9d32 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_pp_smu.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_pp_smu.c
@@ -480,12 +480,20 @@ void pp_rv_set_display_requirement(struct pp_smu *pp,
 {
         struct dc_context *ctx = pp->ctx;
         struct amdgpu_device *adev = ctx->driver_context;
+        void *pp_handle = adev->powerplay.pp_handle;
         const struct amd_pm_funcs *pp_funcs = adev->powerplay.pp_funcs;
+        struct pp_display_clock_request clock = {0};
 
-        if (!pp_funcs || !pp_funcs->display_configuration_changed)
+        if (!pp_funcs || !pp_funcs->display_clock_voltage_request)
                 return;
 
-        amdgpu_dpm_display_configuration_changed(adev);
+        clock.clock_type = amd_pp_dcf_clock;
+        clock.clock_freq_in_khz = req->hard_min_dcefclk_khz;
+        pp_funcs->display_clock_voltage_request(pp_handle, &clock);
+
+        clock.clock_type = amd_pp_f_clock;
+        clock.clock_freq_in_khz = req->hard_min_fclk_khz;
+        pp_funcs->display_clock_voltage_request(pp_handle, &clock);
 }
 
 void pp_rv_set_wm_ranges(struct pp_smu *pp,
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
index 567867915d32..37eaf72ace54 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
@@ -754,8 +754,12 @@ bool dc_link_detect(struct dc_link *link, enum dc_detect_reason reason)
                          * fail-safe mode
                          */
                         if (dc_is_hdmi_signal(link->connector_signal) ||
-                            dc_is_dvi_signal(link->connector_signal))
+                            dc_is_dvi_signal(link->connector_signal)) {
+                                if (prev_sink != NULL)
+                                        dc_sink_release(prev_sink);
+
                                 return false;
+                        }
                 default:
                         break;
                 }
diff --git a/drivers/gpu/drm/amd/include/kgd_kfd_interface.h b/drivers/gpu/drm/amd/include/kgd_kfd_interface.h
index 14391b06080c..43b82e14007e 100644
--- a/drivers/gpu/drm/amd/include/kgd_kfd_interface.h
+++ b/drivers/gpu/drm/amd/include/kgd_kfd_interface.h
@@ -292,7 +292,7 @@ struct tile_config {
 struct kfd2kgd_calls {
         int (*init_gtt_mem_allocation)(struct kgd_dev *kgd, size_t size,
                                         void **mem_obj, uint64_t *gpu_addr,
-                                        void **cpu_ptr);
+                                        void **cpu_ptr, bool mqd_gfx9);
 
         void (*free_gtt_mem)(struct kgd_dev *kgd, void *mem_obj);
 
diff --git a/drivers/gpu/drm/drm_atomic.c b/drivers/gpu/drm/drm_atomic.c
index 3eb061e11e2e..018fcdb353d2 100644
--- a/drivers/gpu/drm/drm_atomic.c
+++ b/drivers/gpu/drm/drm_atomic.c
@@ -2067,7 +2067,7 @@ static void __drm_state_dump(struct drm_device *dev, struct drm_printer *p,
         struct drm_connector *connector;
         struct drm_connector_list_iter conn_iter;
 
-        if (!drm_core_check_feature(dev, DRIVER_ATOMIC))
+        if (!drm_drv_uses_atomic_modeset(dev))
                 return;
 
         list_for_each_entry(plane, &config->plane_list, head) {
diff --git a/drivers/gpu/drm/drm_debugfs.c b/drivers/gpu/drm/drm_debugfs.c
index 6f28fe58f169..373bd4c2b698 100644
--- a/drivers/gpu/drm/drm_debugfs.c
+++ b/drivers/gpu/drm/drm_debugfs.c
@@ -151,7 +151,7 @@ int drm_debugfs_init(struct drm_minor *minor, int minor_id,
                 return ret;
         }
 
-        if (drm_core_check_feature(dev, DRIVER_ATOMIC)) {
+        if (drm_drv_uses_atomic_modeset(dev)) {
                 ret = drm_atomic_debugfs_init(minor);
                 if (ret) {
                         DRM_ERROR("Failed to create atomic debugfs files\n");
diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
index 4b0dd20bccb8..16ec93b75dbf 100644
--- a/drivers/gpu/drm/drm_fb_helper.c
+++ b/drivers/gpu/drm/drm_fb_helper.c
@@ -2370,7 +2370,6 @@ static int drm_pick_crtcs(struct drm_fb_helper *fb_helper,
 {
         int c, o;
         struct drm_connector *connector;
-        const struct drm_connector_helper_funcs *connector_funcs;
         int my_score, best_score, score;
         struct drm_fb_helper_crtc **crtcs, *crtc;
         struct drm_fb_helper_connector *fb_helper_conn;
@@ -2399,8 +2398,6 @@ static int drm_pick_crtcs(struct drm_fb_helper *fb_helper,
         if (drm_has_preferred_mode(fb_helper_conn, width, height))
                 my_score++;
 
-        connector_funcs = connector->helper_private;
-
         /*
          * select a crtc for this connector and then attempt to configure
          * remaining connectors
diff --git a/drivers/gpu/drm/i915/gvt/dmabuf.c b/drivers/gpu/drm/i915/gvt/dmabuf.c
index 6e3f56684f4e..51ed99a37803 100644
--- a/drivers/gpu/drm/i915/gvt/dmabuf.c
+++ b/drivers/gpu/drm/i915/gvt/dmabuf.c
@@ -170,20 +170,22 @@ static struct drm_i915_gem_object *vgpu_create_gem(struct drm_device *dev,
                 unsigned int tiling_mode = 0;
                 unsigned int stride = 0;
 
-                switch (info->drm_format_mod << 10) {
-                case PLANE_CTL_TILED_LINEAR:
+                switch (info->drm_format_mod) {
+                case DRM_FORMAT_MOD_LINEAR:
                         tiling_mode = I915_TILING_NONE;
                         break;
-                case PLANE_CTL_TILED_X:
+                case I915_FORMAT_MOD_X_TILED:
                         tiling_mode = I915_TILING_X;
                         stride = info->stride;
                         break;
-                case PLANE_CTL_TILED_Y:
+                case I915_FORMAT_MOD_Y_TILED:
+                case I915_FORMAT_MOD_Yf_TILED:
                         tiling_mode = I915_TILING_Y;
                         stride = info->stride;
                         break;
                 default:
-                        gvt_dbg_core("not supported tiling mode\n");
+                        gvt_dbg_core("invalid drm_format_mod %llx for tiling\n",
+                                     info->drm_format_mod);
                 }
                 obj->tiling_and_stride = tiling_mode | stride;
         } else {
@@ -222,9 +224,26 @@ static int vgpu_get_plane_info(struct drm_device *dev,
                 info->height = p.height;
                 info->stride = p.stride;
                 info->drm_format = p.drm_format;
-                info->drm_format_mod = p.tiled;
+
+                switch (p.tiled) {
+                case PLANE_CTL_TILED_LINEAR:
+                        info->drm_format_mod = DRM_FORMAT_MOD_LINEAR;
+                        break;
+                case PLANE_CTL_TILED_X:
+                        info->drm_format_mod = I915_FORMAT_MOD_X_TILED;
+                        break;
+                case PLANE_CTL_TILED_Y:
+                        info->drm_format_mod = I915_FORMAT_MOD_Y_TILED;
+                        break;
+                case PLANE_CTL_TILED_YF:
+                        info->drm_format_mod = I915_FORMAT_MOD_Yf_TILED;
+                        break;
+                default:
+                        gvt_vgpu_err("invalid tiling mode: %x\n", p.tiled);
+                }
+
                 info->size = (((p.stride * p.height * p.bpp) / 8) +
-                                (PAGE_SIZE - 1)) >> PAGE_SHIFT;
+                              (PAGE_SIZE - 1)) >> PAGE_SHIFT;
         } else if (plane_id == DRM_PLANE_TYPE_CURSOR) {
                 ret = intel_vgpu_decode_cursor_plane(vgpu, &c);
                 if (ret)
diff --git a/drivers/gpu/drm/i915/gvt/fb_decoder.c b/drivers/gpu/drm/i915/gvt/fb_decoder.c
index face664be3e8..481896fb712a 100644
--- a/drivers/gpu/drm/i915/gvt/fb_decoder.c
+++ b/drivers/gpu/drm/i915/gvt/fb_decoder.c
@@ -220,8 +220,7 @@ int intel_vgpu_decode_primary_plane(struct intel_vgpu *vgpu,
         if (IS_SKYLAKE(dev_priv)
                 || IS_KABYLAKE(dev_priv)
                 || IS_BROXTON(dev_priv)) {
-                plane->tiled = (val & PLANE_CTL_TILED_MASK) >>
-                _PLANE_CTL_TILED_SHIFT;
+                plane->tiled = val & PLANE_CTL_TILED_MASK;
                 fmt = skl_format_to_drm(
                         val & PLANE_CTL_FORMAT_MASK,
                         val & PLANE_CTL_ORDER_RGBX,
@@ -260,7 +259,7 @@ int intel_vgpu_decode_primary_plane(struct intel_vgpu *vgpu,
                 return  -EINVAL;
         }
 
-        plane->stride = intel_vgpu_get_stride(vgpu, pipe, (plane->tiled << 10),
+        plane->stride = intel_vgpu_get_stride(vgpu, pipe, plane->tiled,
                 (IS_SKYLAKE(dev_priv)
                 || IS_KABYLAKE(dev_priv)
                 || IS_BROXTON(dev_priv)) ?
diff --git a/drivers/gpu/drm/i915/gvt/fb_decoder.h b/drivers/gpu/drm/i915/gvt/fb_decoder.h
index cb055f3c81a2..60c155085029 100644
--- a/drivers/gpu/drm/i915/gvt/fb_decoder.h
+++ b/drivers/gpu/drm/i915/gvt/fb_decoder.h
@@ -101,7 +101,7 @@ struct intel_gvt;
 /* color space conversion and gamma correction are not included */
 struct intel_vgpu_primary_plane_format {
         u8      enabled;        /* plane is enabled */
-        u8      tiled;          /* X-tiled */
+        u32     tiled;          /* tiling mode: linear, X-tiled, Y tiled, etc */
         u8      bpp;            /* bits per pixel */
         u32     hw_format;      /* format field in the PRI_CTL register */
         u32     drm_format;     /* format in DRM definition */
diff --git a/drivers/gpu/drm/i915/gvt/handlers.c b/drivers/gpu/drm/i915/gvt/handlers.c
index 7a58ca555197..94c1089ecf59 100644
--- a/drivers/gpu/drm/i915/gvt/handlers.c
+++ b/drivers/gpu/drm/i915/gvt/handlers.c
@@ -1296,6 +1296,19 @@ static int power_well_ctl_mmio_write(struct intel_vgpu *vgpu,
         return 0;
 }
 
+static int gen9_dbuf_ctl_mmio_write(struct intel_vgpu *vgpu,
+                unsigned int offset, void *p_data, unsigned int bytes)
+{
+        write_vreg(vgpu, offset, p_data, bytes);
+
+        if (vgpu_vreg(vgpu, offset) & DBUF_POWER_REQUEST)
+                vgpu_vreg(vgpu, offset) |= DBUF_POWER_STATE;
+        else
+                vgpu_vreg(vgpu, offset) &= ~DBUF_POWER_STATE;
+
+        return 0;
+}
+
 static int fpga_dbg_mmio_write(struct intel_vgpu *vgpu,
         unsigned int offset, void *p_data, unsigned int bytes)
 {
@@ -1525,9 +1538,15 @@ static int bxt_phy_ctl_family_write(struct intel_vgpu *vgpu,
         u32 v = *(u32 *)p_data;
         u32 data = v & COMMON_RESET_DIS ? BXT_PHY_LANE_ENABLED : 0;
 
-        vgpu_vreg(vgpu, _BXT_PHY_CTL_DDI_A) = data;
-        vgpu_vreg(vgpu, _BXT_PHY_CTL_DDI_B) = data;
-        vgpu_vreg(vgpu, _BXT_PHY_CTL_DDI_C) = data;
+        switch (offset) {
+        case _PHY_CTL_FAMILY_EDP:
+                vgpu_vreg(vgpu, _BXT_PHY_CTL_DDI_A) = data;
+                break;
+        case _PHY_CTL_FAMILY_DDI:
+                vgpu_vreg(vgpu, _BXT_PHY_CTL_DDI_B) = data;
+                vgpu_vreg(vgpu, _BXT_PHY_CTL_DDI_C) = data;
+                break;
+        }
 
         vgpu_vreg(vgpu, offset) = v;
 
@@ -2812,6 +2831,8 @@ static int init_skl_mmio_info(struct intel_gvt *gvt)
         MMIO_DH(HSW_PWR_WELL_CTL_DRIVER(SKL_DISP_PW_MISC_IO), D_SKL_PLUS, NULL,
                 skl_power_well_ctl_write);
 
+        MMIO_DH(DBUF_CTL, D_SKL_PLUS, NULL, gen9_dbuf_ctl_mmio_write);
+
         MMIO_D(_MMIO(0xa210), D_SKL_PLUS);
         MMIO_D(GEN9_MEDIA_PG_IDLE_HYSTERESIS, D_SKL_PLUS);
         MMIO_D(GEN9_RENDER_PG_IDLE_HYSTERESIS, D_SKL_PLUS);
@@ -2987,8 +3008,6 @@ static int init_skl_mmio_info(struct intel_gvt *gvt)
                 NULL, gen9_trtte_write);
         MMIO_DH(_MMIO(0x4dfc), D_SKL_PLUS, NULL, gen9_trtt_chicken_write);
 
-        MMIO_D(_MMIO(0x45008), D_SKL_PLUS);
-
         MMIO_D(_MMIO(0x46430), D_SKL_PLUS);
 
         MMIO_D(_MMIO(0x46520), D_SKL_PLUS);
@@ -3025,7 +3044,9 @@ static int init_skl_mmio_info(struct intel_gvt *gvt)
         MMIO_D(_MMIO(0x44500), D_SKL_PLUS);
         MMIO_DFH(GEN9_CSFE_CHICKEN1_RCS, D_SKL_PLUS, F_CMD_ACCESS, NULL, NULL);
         MMIO_DFH(GEN8_HDC_CHICKEN1, D_SKL_PLUS, F_MODE_MASK | F_CMD_ACCESS,
-                NULL, NULL);
+                 NULL, NULL);
+        MMIO_DFH(GEN9_WM_CHICKEN3, D_SKL_PLUS, F_MODE_MASK | F_CMD_ACCESS,
+                 NULL, NULL);
 
         MMIO_D(_MMIO(0x4ab8), D_KBL);
         MMIO_D(_MMIO(0x2248), D_KBL | D_SKL);
@@ -3189,6 +3210,7 @@ static int init_bxt_mmio_info(struct intel_gvt *gvt)
         MMIO_D(BXT_DSI_PLL_ENABLE, D_BXT);
 
         MMIO_D(GEN9_CLKGATE_DIS_0, D_BXT);
+        MMIO_D(GEN9_CLKGATE_DIS_4, D_BXT);
 
         MMIO_D(HSW_TVIDEO_DIP_GCP(TRANSCODER_A), D_BXT);
         MMIO_D(HSW_TVIDEO_DIP_GCP(TRANSCODER_B), D_BXT);
diff --git a/drivers/gpu/drm/i915/gvt/kvmgt.c b/drivers/gpu/drm/i915/gvt/kvmgt.c
index a45f46d8537f..9ad89e38f6c0 100644
--- a/drivers/gpu/drm/i915/gvt/kvmgt.c
+++ b/drivers/gpu/drm/i915/gvt/kvmgt.c
@@ -32,6 +32,7 @@
 #include <linux/device.h>
 #include <linux/mm.h>
 #include <linux/mmu_context.h>
+#include <linux/sched/mm.h>
 #include <linux/types.h>
 #include <linux/list.h>
 #include <linux/rbtree.h>
@@ -1792,16 +1793,21 @@ static int kvmgt_rw_gpa(unsigned long handle, unsigned long gpa,
         info = (struct kvmgt_guest_info *)handle;
         kvm = info->kvm;
 
-        if (kthread)
+        if (kthread) {
+                if (!mmget_not_zero(kvm->mm))
+                        return -EFAULT;
                 use_mm(kvm->mm);
+        }
 
         idx = srcu_read_lock(&kvm->srcu);
         ret = write ? kvm_write_guest(kvm, gpa, buf, len) :
                       kvm_read_guest(kvm, gpa, buf, len);
         srcu_read_unlock(&kvm->srcu, idx);
 
-        if (kthread)
+        if (kthread) {
                 unuse_mm(kvm->mm);
+                mmput(kvm->mm);
+        }
 
         return ret;
 }
@@ -1827,6 +1833,8 @@ static bool kvmgt_is_valid_gfn(unsigned long handle, unsigned long gfn)
 {
         struct kvmgt_guest_info *info;
         struct kvm *kvm;
+        int idx;
+        bool ret;
 
         if (!handle_valid(handle))
                 return false;
@@ -1834,8 +1842,11 @@ static bool kvmgt_is_valid_gfn(unsigned long handle, unsigned long gfn)
         info = (struct kvmgt_guest_info *)handle;
         kvm = info->kvm;
 
-        return kvm_is_visible_gfn(kvm, gfn);
+        idx = srcu_read_lock(&kvm->srcu);
+        ret = kvm_is_visible_gfn(kvm, gfn);
+        srcu_read_unlock(&kvm->srcu, idx);
 
+        return ret;
 }
 
 struct intel_gvt_mpt kvmgt_mpt = {
diff --git a/drivers/gpu/drm/i915/gvt/mmio.c b/drivers/gpu/drm/i915/gvt/mmio.c
index 994366035364..9bb9a85c992c 100644
--- a/drivers/gpu/drm/i915/gvt/mmio.c
+++ b/drivers/gpu/drm/i915/gvt/mmio.c
@@ -244,6 +244,34 @@ void intel_vgpu_reset_mmio(struct intel_vgpu *vgpu, bool dmlr)
 
                 /* set the bit 0:2(Core C-State ) to C0 */
                 vgpu_vreg_t(vgpu, GEN6_GT_CORE_STATUS) = 0;
+
+                if (IS_BROXTON(vgpu->gvt->dev_priv)) {
+                        vgpu_vreg_t(vgpu, BXT_P_CR_GT_DISP_PWRON) &=
+                                    ~(BIT(0) | BIT(1));
+                        vgpu_vreg_t(vgpu, BXT_PORT_CL1CM_DW0(DPIO_PHY0)) &=
+                                    ~PHY_POWER_GOOD;
+                        vgpu_vreg_t(vgpu, BXT_PORT_CL1CM_DW0(DPIO_PHY1)) &=
+                                    ~PHY_POWER_GOOD;
+                        vgpu_vreg_t(vgpu, BXT_PHY_CTL_FAMILY(DPIO_PHY0)) &=
+                                    ~BIT(30);
+                        vgpu_vreg_t(vgpu, BXT_PHY_CTL_FAMILY(DPIO_PHY1)) &=
+                                    ~BIT(30);
+                        vgpu_vreg_t(vgpu, BXT_PHY_CTL(PORT_A)) &=
+                                    ~BXT_PHY_LANE_ENABLED;
+                        vgpu_vreg_t(vgpu, BXT_PHY_CTL(PORT_A)) |=
+                                    BXT_PHY_CMNLANE_POWERDOWN_ACK |
+                                    BXT_PHY_LANE_POWERDOWN_ACK;
+                        vgpu_vreg_t(vgpu, BXT_PHY_CTL(PORT_B)) &=
+                                    ~BXT_PHY_LANE_ENABLED;
+                        vgpu_vreg_t(vgpu, BXT_PHY_CTL(PORT_B)) |=
+                                    BXT_PHY_CMNLANE_POWERDOWN_ACK |
+                                    BXT_PHY_LANE_POWERDOWN_ACK;
+                        vgpu_vreg_t(vgpu, BXT_PHY_CTL(PORT_C)) &=
+                                    ~BXT_PHY_LANE_ENABLED;
+                        vgpu_vreg_t(vgpu, BXT_PHY_CTL(PORT_C)) |=
+                                    BXT_PHY_CMNLANE_POWERDOWN_ACK |
+                                    BXT_PHY_LANE_POWERDOWN_ACK;
+                }
         } else {
 #define GVT_GEN8_MMIO_RESET_OFFSET              (0x44200)
                 /* only reset the engine related, so starting with 0x44200
diff --git a/drivers/gpu/drm/i915/gvt/mmio_context.c b/drivers/gpu/drm/i915/gvt/mmio_context.c
index 42e1e6bdcc2c..e872f4847fbe 100644
--- a/drivers/gpu/drm/i915/gvt/mmio_context.c
+++ b/drivers/gpu/drm/i915/gvt/mmio_context.c
@@ -562,11 +562,9 @@ void intel_gvt_switch_mmio(struct intel_vgpu *pre,
          * performace for batch mmio read/write, so we need
          * handle forcewake mannually.
          */
-        intel_runtime_pm_get(dev_priv);
         intel_uncore_forcewake_get(dev_priv, FORCEWAKE_ALL);
         switch_mmio(pre, next, ring_id);
         intel_uncore_forcewake_put(dev_priv, FORCEWAKE_ALL);
-        intel_runtime_pm_put(dev_priv);
 }
 
 /**
diff --git a/drivers/gpu/drm/i915/gvt/opregion.c b/drivers/gpu/drm/i915/gvt/opregion.c
index fa75a2eead90..b0d3a43ccd03 100644
--- a/drivers/gpu/drm/i915/gvt/opregion.c
+++ b/drivers/gpu/drm/i915/gvt/opregion.c
@@ -42,8 +42,6 @@
 #define DEVICE_TYPE_EFP3   0x20
 #define DEVICE_TYPE_EFP4   0x10
 
-#define DEV_SIZE        38
-
 struct opregion_header {
         u8 signature[16];
         u32 size;
@@ -63,6 +61,10 @@ struct bdb_data_header {
         u16 size; /* data size */
 } __packed;
 
+/* For supporting windows guest with opregion, here hardcode the emulated
+ * bdb header version as '186', and the corresponding child_device_config
+ * length should be '33' but not '38'.
+ */
 struct efp_child_device_config {
         u16 handle;
         u16 device_type;
@@ -109,12 +111,6 @@ struct efp_child_device_config {
         u8 mipi_bridge_type; /* 171 */
         u16 device_class_ext;
         u8 dvo_function;
-        u8 dp_usb_type_c:1; /* 195 */
-        u8 skip6:7;
-        u8 dp_usb_type_c_2x_gpio_index; /* 195 */
-        u16 dp_usb_type_c_2x_gpio_pin; /* 195 */
-        u8 iboost_dp:4; /* 196 */
-        u8 iboost_hdmi:4; /* 196 */
 } __packed;
 
 struct vbt {
@@ -155,7 +151,7 @@ static void virt_vbt_generation(struct vbt *v)
         v->header.bdb_offset = offsetof(struct vbt, bdb_header);
 
         strcpy(&v->bdb_header.signature[0], "BIOS_DATA_BLOCK");
-        v->bdb_header.version = 186; /* child_dev_size = 38 */
+        v->bdb_header.version = 186; /* child_dev_size = 33 */
         v->bdb_header.header_size = sizeof(v->bdb_header);
 
         v->bdb_header.bdb_size = sizeof(struct vbt) - sizeof(struct vbt_header)
@@ -169,11 +165,13 @@ static void virt_vbt_generation(struct vbt *v)
 
         /* child device */
         num_child = 4; /* each port has one child */
+        v->general_definitions.child_dev_size =
+                sizeof(struct efp_child_device_config);
         v->general_definitions_header.id = BDB_GENERAL_DEFINITIONS;
         /* size will include child devices */
         v->general_definitions_header.size =
-                sizeof(struct bdb_general_definitions) + num_child * DEV_SIZE;
-        v->general_definitions.child_dev_size = DEV_SIZE;
+                sizeof(struct bdb_general_definitions) +
+                        num_child * v->general_definitions.child_dev_size;
 
         /* portA */
         v->child0.handle = DEVICE_TYPE_EFP1;
diff --git a/drivers/gpu/drm/i915/gvt/sched_policy.c b/drivers/gpu/drm/i915/gvt/sched_policy.c
index 09d7bb72b4ff..c32e7d5e8629 100644
--- a/drivers/gpu/drm/i915/gvt/sched_policy.c
+++ b/drivers/gpu/drm/i915/gvt/sched_policy.c
@@ -47,11 +47,15 @@ static bool vgpu_has_pending_workload(struct intel_vgpu *vgpu)
         return false;
 }
 
+/* We give 2 seconds higher prio for vGPU during start */
+#define GVT_SCHED_VGPU_PRI_TIME  2
+
 struct vgpu_sched_data {
         struct list_head lru_list;
         struct intel_vgpu *vgpu;
         bool active;
-
+        bool pri_sched;
+        ktime_t pri_time;
         ktime_t sched_in_time;
         ktime_t sched_time;
         ktime_t left_ts;
@@ -183,6 +187,14 @@ static struct intel_vgpu *find_busy_vgpu(struct gvt_sched_data *sched_data)
                 if (!vgpu_has_pending_workload(vgpu_data->vgpu))
                         continue;
 
+                if (vgpu_data->pri_sched) {
+                        if (ktime_before(ktime_get(), vgpu_data->pri_time)) {
+                                vgpu = vgpu_data->vgpu;
+                                break;
+                        } else
+                                vgpu_data->pri_sched = false;
+                }
+
                 /* Return the vGPU only if it has time slice left */
                 if (vgpu_data->left_ts > 0) {
                         vgpu = vgpu_data->vgpu;
@@ -202,6 +214,7 @@ static void tbs_sched_func(struct gvt_sched_data *sched_data)
         struct intel_gvt_workload_scheduler *scheduler = &gvt->scheduler;
         struct vgpu_sched_data *vgpu_data;
         struct intel_vgpu *vgpu = NULL;
+
         /* no active vgpu or has already had a target */
         if (list_empty(&sched_data->lru_runq_head) || scheduler->next_vgpu)
                 goto out;
@@ -209,12 +222,13 @@ static void tbs_sched_func(struct gvt_sched_data *sched_data)
         vgpu = find_busy_vgpu(sched_data);
         if (vgpu) {
                 scheduler->next_vgpu = vgpu;
-
-                /* Move the last used vGPU to the tail of lru_list */
                 vgpu_data = vgpu->sched_data;
-                list_del_init(&vgpu_data->lru_list);
-                list_add_tail(&vgpu_data->lru_list,
-                                &sched_data->lru_runq_head);
+                if (!vgpu_data->pri_sched) {
+                        /* Move the last used vGPU to the tail of lru_list */
+                        list_del_init(&vgpu_data->lru_list);
+                        list_add_tail(&vgpu_data->lru_list,
+                                      &sched_data->lru_runq_head);
+                }
         } else {
                 scheduler->next_vgpu = gvt->idle_vgpu;
         }
@@ -328,11 +342,17 @@ static void tbs_sched_start_schedule(struct intel_vgpu *vgpu)
 {
         struct gvt_sched_data *sched_data = vgpu->gvt->scheduler.sched_data;
         struct vgpu_sched_data *vgpu_data = vgpu->sched_data;
+        ktime_t now;
 
         if (!list_empty(&vgpu_data->lru_list))
                 return;
 
-        list_add_tail(&vgpu_data->lru_list, &sched_data->lru_runq_head);
+        now = ktime_get();
+        vgpu_data->pri_time = ktime_add(now,
+                                        ktime_set(GVT_SCHED_VGPU_PRI_TIME, 0));
+        vgpu_data->pri_sched = true;
+
+        list_add(&vgpu_data->lru_list, &sched_data->lru_runq_head);
 
         if (!hrtimer_active(&sched_data->timer))
                 hrtimer_start(&sched_data->timer, ktime_add_ns(ktime_get(),
@@ -426,6 +446,7 @@ void intel_vgpu_stop_schedule(struct intel_vgpu *vgpu)
                 &vgpu->gvt->scheduler;
         int ring_id;
         struct vgpu_sched_data *vgpu_data = vgpu->sched_data;
+        struct drm_i915_private *dev_priv = vgpu->gvt->dev_priv;
 
         if (!vgpu_data->active)
                 return;
@@ -444,6 +465,7 @@ void intel_vgpu_stop_schedule(struct intel_vgpu *vgpu)
                 scheduler->current_vgpu = NULL;
         }
 
+        intel_runtime_pm_get(dev_priv);
         spin_lock_bh(&scheduler->mmio_context_lock);
         for (ring_id = 0; ring_id < I915_NUM_ENGINES; ring_id++) {
                 if (scheduler->engine_owner[ring_id] == vgpu) {
@@ -452,5 +474,6 @@ void intel_vgpu_stop_schedule(struct intel_vgpu *vgpu)
                 }
         }
         spin_unlock_bh(&scheduler->mmio_context_lock);
+        intel_runtime_pm_put(dev_priv);
         mutex_unlock(&vgpu->gvt->sched_lock);
 }
diff --git a/drivers/gpu/drm/i915/gvt/vgpu.c b/drivers/gpu/drm/i915/gvt/vgpu.c
index a4e8e3cf74fd..c628be05fbfe 100644
--- a/drivers/gpu/drm/i915/gvt/vgpu.c
+++ b/drivers/gpu/drm/i915/gvt/vgpu.c
@@ -281,6 +281,7 @@ void intel_gvt_destroy_vgpu(struct intel_vgpu *vgpu)
         intel_vgpu_clean_submission(vgpu);
         intel_vgpu_clean_display(vgpu);
         intel_vgpu_clean_opregion(vgpu);
+        intel_vgpu_reset_ggtt(vgpu, true);
         intel_vgpu_clean_gtt(vgpu);
         intel_gvt_hypervisor_detach_vgpu(vgpu);
         intel_vgpu_free_resource(vgpu);
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index 08ec7446282e..9e63cd47b60f 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -10422,7 +10422,7 @@ enum skl_power_gate {
                                                            _ICL_DSC0_PICTURE_PARAMETER_SET_4_PB, \
                                                            _ICL_DSC0_PICTURE_PARAMETER_SET_4_PC)
 #define ICL_DSC1_PICTURE_PARAMETER_SET_4(pipe)  _MMIO_PIPE((pipe) - PIPE_B, \
-                                                           _ICL_DSC0_PICTURE_PARAMETER_SET_4_PB, \
+                                                           _ICL_DSC1_PICTURE_PARAMETER_SET_4_PB, \
                                                            _ICL_DSC1_PICTURE_PARAMETER_SET_4_PC)
 #define  DSC_INITIAL_DEC_DELAY(dec_delay)       ((dec_delay) << 16)
 #define  DSC_INITIAL_XMIT_DELAY(xmit_delay)     ((xmit_delay) << 0)
@@ -10437,7 +10437,7 @@ enum skl_power_gate {
                                                            _ICL_DSC0_PICTURE_PARAMETER_SET_5_PB, \
                                                            _ICL_DSC0_PICTURE_PARAMETER_SET_5_PC)
 #define ICL_DSC1_PICTURE_PARAMETER_SET_5(pipe)  _MMIO_PIPE((pipe) - PIPE_B, \
-                                                           _ICL_DSC1_PICTURE_PARAMETER_SET_5_PC, \
+                                                           _ICL_DSC1_PICTURE_PARAMETER_SET_5_PB, \
                                                            _ICL_DSC1_PICTURE_PARAMETER_SET_5_PC)
 #define  DSC_SCALE_DEC_INTINT(scale_dec)        ((scale_dec) << 16)
 #define  DSC_SCALE_INC_INT(scale_inc)           ((scale_inc) << 0)
diff --git a/drivers/gpu/drm/i915/i915_vma.c b/drivers/gpu/drm/i915/i915_vma.c
index 11d834f94220..98358b4b36de 100644
--- a/drivers/gpu/drm/i915/i915_vma.c
+++ b/drivers/gpu/drm/i915/i915_vma.c
@@ -199,7 +199,6 @@ vma_create(struct drm_i915_gem_object *obj,
                 vma->flags |= I915_VMA_GGTT;
                 list_add(&vma->obj_link, &obj->vma_list);
         } else {
-                i915_ppgtt_get(i915_vm_to_ppgtt(vm));
                 list_add_tail(&vma->obj_link, &obj->vma_list);
         }
 
@@ -807,9 +806,6 @@ static void __i915_vma_destroy(struct i915_vma *vma)
         if (vma->obj)
                 rb_erase(&vma->obj_node, &vma->obj->vma_tree);
 
-        if (!i915_vma_is_ggtt(vma))
-                i915_ppgtt_put(i915_vm_to_ppgtt(vma->vm));
-
         rbtree_postorder_for_each_entry_safe(iter, n, &vma->active, node) {
                 GEM_BUG_ON(i915_gem_active_isset(&iter->base));
                 kfree(iter);
diff --git a/drivers/gpu/drm/i915/intel_audio.c b/drivers/gpu/drm/i915/intel_audio.c
index b725835b47ef..769f3f586661 100644
--- a/drivers/gpu/drm/i915/intel_audio.c
+++ b/drivers/gpu/drm/i915/intel_audio.c
@@ -962,9 +962,6 @@ void i915_audio_component_init(struct drm_i915_private *dev_priv)
 {
         int ret;
 
-        if (INTEL_INFO(dev_priv)->num_pipes == 0)
-                return;
-
         ret = component_add(dev_priv->drm.dev, &i915_audio_component_bind_ops);
         if (ret < 0) {
                 DRM_ERROR("failed to add audio component (%d)\n", ret);
diff --git a/drivers/gpu/drm/i915/intel_ddi.c b/drivers/gpu/drm/i915/intel_ddi.c
index 8761513f3532..c9af34861d9e 100644
--- a/drivers/gpu/drm/i915/intel_ddi.c
+++ b/drivers/gpu/drm/i915/intel_ddi.c
@@ -2708,7 +2708,8 @@ static void intel_ddi_pre_enable_dp(struct intel_encoder *encoder,
         if (port != PORT_A || INTEL_GEN(dev_priv) >= 9)
                 intel_dp_stop_link_train(intel_dp);
 
-        intel_ddi_enable_pipe_clock(crtc_state);
+        if (!is_mst)
+                intel_ddi_enable_pipe_clock(crtc_state);
 }
 
 static void intel_ddi_pre_enable_hdmi(struct intel_encoder *encoder,
@@ -2810,14 +2811,14 @@ static void intel_ddi_post_disable_dp(struct intel_encoder *encoder,
         bool is_mst = intel_crtc_has_type(old_crtc_state,
                                           INTEL_OUTPUT_DP_MST);
 
-        intel_ddi_disable_pipe_clock(old_crtc_state);
-
-        /*
-         * Power down sink before disabling the port, otherwise we end
-         * up getting interrupts from the sink on detecting link loss.
-         */
-        if (!is_mst)
+        if (!is_mst) {
+                intel_ddi_disable_pipe_clock(old_crtc_state);
+                /*
+                 * Power down sink before disabling the port, otherwise we end
+                 * up getting interrupts from the sink on detecting link loss.
+                 */
                 intel_dp_sink_dpms(intel_dp, DRM_MODE_DPMS_OFF);
+        }
 
         intel_disable_ddi_buf(encoder);
 
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index ed3fa1c8a983..d2951096bca0 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -2988,6 +2988,7 @@ static int skl_check_main_surface(const struct intel_crtc_state *crtc_state,
         int w = drm_rect_width(&plane_state->base.src) >> 16;
         int h = drm_rect_height(&plane_state->base.src) >> 16;
         int dst_x = plane_state->base.dst.x1;
+        int dst_w = drm_rect_width(&plane_state->base.dst);
         int pipe_src_w = crtc_state->pipe_src_w;
         int max_width = skl_max_plane_width(fb, 0, rotation);
         int max_height = 4096;
@@ -3009,10 +3010,10 @@ static int skl_check_main_surface(const struct intel_crtc_state *crtc_state,
          * screen may cause FIFO underflow and display corruption.
          */
         if ((IS_GEMINILAKE(dev_priv) || IS_CANNONLAKE(dev_priv)) &&
-            (dst_x + w < 4 || dst_x > pipe_src_w - 4)) {
+            (dst_x + dst_w < 4 || dst_x > pipe_src_w - 4)) {
                 DRM_DEBUG_KMS("requested plane X %s position %d invalid (valid range %d-%d)\n",
-                              dst_x + w < 4 ? "end" : "start",
-                              dst_x + w < 4 ? dst_x + w : dst_x,
+                              dst_x + dst_w < 4 ? "end" : "start",
+                              dst_x + dst_w < 4 ? dst_x + dst_w : dst_x,
                               4, pipe_src_w - 4);
                 return -ERANGE;
         }
@@ -5078,10 +5079,14 @@ void hsw_disable_ips(const struct intel_crtc_state *crtc_state)
                 mutex_lock(&dev_priv->pcu_lock);
                 WARN_ON(sandybridge_pcode_write(dev_priv, DISPLAY_IPS_CONTROL, 0));
                 mutex_unlock(&dev_priv->pcu_lock);
-                /* wait for pcode to finish disabling IPS, which may take up to 42ms */
+                /*
+                 * Wait for PCODE to finish disabling IPS. The BSpec specified
+                 * 42ms timeout value leads to occasional timeouts so use 100ms
+                 * instead.
+                 */
                 if (intel_wait_for_register(dev_priv,
                                             IPS_CTL, IPS_ENABLE, 0,
-                                            42))
+                                            100))
                         DRM_ERROR("Timed out waiting for IPS disable\n");
         } else {
                 I915_WRITE(IPS_CTL, 0);
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index cd0f649b57a5..1193202766a2 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -4160,18 +4160,6 @@ intel_dp_needs_link_retrain(struct intel_dp *intel_dp)
         return !drm_dp_channel_eq_ok(link_status, intel_dp->lane_count);
 }
 
-/*
- * If display is now connected check links status,
- * there has been known issues of link loss triggering
- * long pulse.
- *
- * Some sinks (eg. ASUS PB287Q) seem to perform some
- * weird HPD ping pong during modesets. So we can apparently
- * end up with HPD going low during a modeset, and then
- * going back up soon after. And once that happens we must
- * retrain the link to get a picture. That's in case no
- * userspace component reacted to intermittent HPD dip.
- */
 int intel_dp_retrain_link(struct intel_encoder *encoder,
                           struct drm_modeset_acquire_ctx *ctx)
 {
@@ -4661,7 +4649,8 @@ intel_dp_unset_edid(struct intel_dp *intel_dp)
 }
 
 static int
-intel_dp_long_pulse(struct intel_connector *connector)
+intel_dp_long_pulse(struct intel_connector *connector,
+                    struct drm_modeset_acquire_ctx *ctx)
 {
         struct drm_i915_private *dev_priv = to_i915(connector->base.dev);
         struct intel_dp *intel_dp = intel_attached_dp(&connector->base);
@@ -4720,6 +4709,22 @@ intel_dp_long_pulse(struct intel_connector *connector)
                  */
                 status = connector_status_disconnected;
                 goto out;
+        } else {
+                /*
+                 * If display is now connected check links status,
+                 * there has been known issues of link loss triggering
+                 * long pulse.
+                 *
+                 * Some sinks (eg. ASUS PB287Q) seem to perform some
+                 * weird HPD ping pong during modesets. So we can apparently
+                 * end up with HPD going low during a modeset, and then
+                 * going back up soon after. And once that happens we must
+                 * retrain the link to get a picture. That's in case no
+                 * userspace component reacted to intermittent HPD dip.
+                 */
+                struct intel_encoder *encoder = &dp_to_dig_port(intel_dp)->base;
+
+                intel_dp_retrain_link(encoder, ctx);
         }
 
         /*
@@ -4781,7 +4786,7 @@ intel_dp_detect(struct drm_connector *connector,
                                 return ret;
                 }
 
-                status = intel_dp_long_pulse(intel_dp->attached_connector);
+                status = intel_dp_long_pulse(intel_dp->attached_connector, ctx);
         }
 
         intel_dp->detect_done = false;
diff --git a/drivers/gpu/drm/i915/intel_dp_mst.c b/drivers/gpu/drm/i915/intel_dp_mst.c
index 7e3e01607643..4ecd65375603 100644
--- a/drivers/gpu/drm/i915/intel_dp_mst.c
+++ b/drivers/gpu/drm/i915/intel_dp_mst.c
@@ -166,6 +166,8 @@ static void intel_mst_post_disable_dp(struct intel_encoder *encoder,
         struct intel_connector *connector =
                 to_intel_connector(old_conn_state->connector);
 
+        intel_ddi_disable_pipe_clock(old_crtc_state);
+
         /* this can fail */
         drm_dp_check_act_status(&intel_dp->mst_mgr);
         /* and this can also fail */
@@ -252,6 +254,8 @@ static void intel_mst_pre_enable_dp(struct intel_encoder *encoder,
         I915_WRITE(DP_TP_STATUS(port), temp);
 
         ret = drm_dp_update_payload_part1(&intel_dp->mst_mgr);
+
+        intel_ddi_enable_pipe_clock(pipe_config);
 }
 
 static void intel_mst_enable_dp(struct intel_encoder *encoder,
diff --git a/drivers/gpu/drm/i915/intel_hdmi.c b/drivers/gpu/drm/i915/intel_hdmi.c
index a9076402dcb0..192972a7d287 100644
--- a/drivers/gpu/drm/i915/intel_hdmi.c
+++ b/drivers/gpu/drm/i915/intel_hdmi.c
@@ -943,8 +943,12 @@ static int intel_hdmi_hdcp_write(struct intel_digital_port *intel_dig_port,
 
         ret = i2c_transfer(adapter, &msg, 1);
         if (ret == 1)
-                return 0;
-        return ret >= 0 ? -EIO : ret;
+                ret = 0;
+        else if (ret >= 0)
+                ret = -EIO;
+
+        kfree(write_buf);
+        return ret;
 }
 
 static
diff --git a/drivers/gpu/drm/i915/intel_lspcon.c b/drivers/gpu/drm/i915/intel_lspcon.c
index 5dae16ccd9f1..3e085c5f2b81 100644
--- a/drivers/gpu/drm/i915/intel_lspcon.c
+++ b/drivers/gpu/drm/i915/intel_lspcon.c
@@ -74,7 +74,7 @@ static enum drm_lspcon_mode lspcon_wait_mode(struct intel_lspcon *lspcon,
         DRM_DEBUG_KMS("Waiting for LSPCON mode %s to settle\n",
                       lspcon_mode_name(mode));
 
-        wait_for((current_mode = lspcon_get_current_mode(lspcon)) == mode, 100);
+        wait_for((current_mode = lspcon_get_current_mode(lspcon)) == mode, 400);
         if (current_mode != mode)
                 DRM_ERROR("LSPCON mode hasn't settled\n");
 
diff --git a/drivers/gpu/drm/i915/intel_overlay.c b/drivers/gpu/drm/i915/intel_overlay.c
index c2f10d899329..443dfaefd7a6 100644
--- a/drivers/gpu/drm/i915/intel_overlay.c
+++ b/drivers/gpu/drm/i915/intel_overlay.c
@@ -181,8 +181,9 @@ struct intel_overlay {
         u32 brightness, contrast, saturation;
         u32 old_xscale, old_yscale;
         /* register access */
-        u32 flip_addr;
         struct drm_i915_gem_object *reg_bo;
+        struct overlay_registers __iomem *regs;
+        u32 flip_addr;
         /* flip handling */
         struct i915_gem_active last_flip;
 };
@@ -210,29 +211,6 @@ static void i830_overlay_clock_gating(struct drm_i915_private *dev_priv,
                                   PCI_DEVFN(0, 0), I830_CLOCK_GATE, val);
 }
 
-static struct overlay_registers __iomem *
-intel_overlay_map_regs(struct intel_overlay *overlay)
-{
-        struct drm_i915_private *dev_priv = overlay->i915;
-        struct overlay_registers __iomem *regs;
-
-        if (OVERLAY_NEEDS_PHYSICAL(dev_priv))
-                regs = (struct overlay_registers __iomem *)overlay->reg_bo->phys_handle->vaddr;
-        else
-                regs = io_mapping_map_wc(&dev_priv->ggtt.iomap,
-                                         overlay->flip_addr,
-                                         PAGE_SIZE);
-
-        return regs;
-}
-
-static void intel_overlay_unmap_regs(struct intel_overlay *overlay,
-                                     struct overlay_registers __iomem *regs)
-{
-        if (!OVERLAY_NEEDS_PHYSICAL(overlay->i915))
-                io_mapping_unmap(regs);
-}
-
 static void intel_overlay_submit_request(struct intel_overlay *overlay,
                                          struct i915_request *rq,
                                          i915_gem_retire_fn retire)
@@ -784,13 +762,13 @@ static int intel_overlay_do_put_image(struct intel_overlay *overlay,
                                       struct drm_i915_gem_object *new_bo,
                                       struct put_image_params *params)
 {
-        int ret, tmp_width;
-        struct overlay_registers __iomem *regs;
-        bool scale_changed = false;
+        struct overlay_registers __iomem *regs = overlay->regs;
         struct drm_i915_private *dev_priv = overlay->i915;
         u32 swidth, swidthsw, sheight, ostride;
         enum pipe pipe = overlay->crtc->pipe;
+        bool scale_changed = false;
         struct i915_vma *vma;
+        int ret, tmp_width;
 
         lockdep_assert_held(&dev_priv->drm.struct_mutex);
         WARN_ON(!drm_modeset_is_locked(&dev_priv->drm.mode_config.connection_mutex));
@@ -815,30 +793,19 @@ static int intel_overlay_do_put_image(struct intel_overlay *overlay,
 
         if (!overlay->active) {
                 u32 oconfig;
-                regs = intel_overlay_map_regs(overlay);
-                if (!regs) {
-                        ret = -ENOMEM;
-                        goto out_unpin;
-                }
+
                 oconfig = OCONF_CC_OUT_8BIT;
                 if (IS_GEN4(dev_priv))
                         oconfig |= OCONF_CSC_MODE_BT709;
                 oconfig |= pipe == 0 ?
                         OCONF_PIPE_A : OCONF_PIPE_B;
                 iowrite32(oconfig, &regs->OCONFIG);
-                intel_overlay_unmap_regs(overlay, regs);
 
                 ret = intel_overlay_on(overlay);
                 if (ret != 0)
                         goto out_unpin;
         }
 
-        regs = intel_overlay_map_regs(overlay);
-        if (!regs) {
-                ret = -ENOMEM;
-                goto out_unpin;
-        }
-
         iowrite32((params->dst_y << 16) | params->dst_x, &regs->DWINPOS);
         iowrite32((params->dst_h << 16) | params->dst_w, &regs->DWINSZ);
 
@@ -882,8 +849,6 @@ static int intel_overlay_do_put_image(struct intel_overlay *overlay,
 
         iowrite32(overlay_cmd_reg(params), &regs->OCMD);
 
-        intel_overlay_unmap_regs(overlay, regs);
-
         ret = intel_overlay_continue(overlay, vma, scale_changed);
         if (ret)
                 goto out_unpin;
@@ -901,7 +866,6 @@ out_pin_section:
 int intel_overlay_switch_off(struct intel_overlay *overlay)
 {
         struct drm_i915_private *dev_priv = overlay->i915;
-        struct overlay_registers __iomem *regs;
         int ret;
 
         lockdep_assert_held(&dev_priv->drm.struct_mutex);
@@ -918,9 +882,7 @@ int intel_overlay_switch_off(struct intel_overlay *overlay)
         if (ret != 0)
                 return ret;
 
-        regs = intel_overlay_map_regs(overlay);
-        iowrite32(0, &regs->OCMD);
-        intel_overlay_unmap_regs(overlay, regs);
+        iowrite32(0, &overlay->regs->OCMD);
 
         return intel_overlay_off(overlay);
 }
@@ -1305,7 +1267,6 @@ int intel_overlay_attrs_ioctl(struct drm_device *dev, void *data,
         struct drm_intel_overlay_attrs *attrs = data;
         struct drm_i915_private *dev_priv = to_i915(dev);
         struct intel_overlay *overlay;
-        struct overlay_registers __iomem *regs;
         int ret;
 
         overlay = dev_priv->overlay;
@@ -1345,15 +1306,7 @@ int intel_overlay_attrs_ioctl(struct drm_device *dev, void *data,
                 overlay->contrast   = attrs->contrast;
                 overlay->saturation = attrs->saturation;
 
-                regs = intel_overlay_map_regs(overlay);
-                if (!regs) {
-                        ret = -ENOMEM;
-                        goto out_unlock;
-                }
-
-                update_reg_attrs(overlay, regs);
-
-                intel_overlay_unmap_regs(overlay, regs);
+                update_reg_attrs(overlay, overlay->regs);
 
                 if (attrs->flags & I915_OVERLAY_UPDATE_GAMMA) {
                         if (IS_GEN2(dev_priv))
@@ -1386,12 +1339,47 @@ out_unlock:
         return ret;
 }
 
+static int get_registers(struct intel_overlay *overlay, bool use_phys)
+{
+        struct drm_i915_gem_object *obj;
+        struct i915_vma *vma;
+        int err;
+
+        obj = i915_gem_object_create_stolen(overlay->i915, PAGE_SIZE);
+        if (obj == NULL)
+                obj = i915_gem_object_create_internal(overlay->i915, PAGE_SIZE);
+        if (IS_ERR(obj))
+                return PTR_ERR(obj);
+
+        vma = i915_gem_object_ggtt_pin(obj, NULL, 0, 0, PIN_MAPPABLE);
+        if (IS_ERR(vma)) {
+                err = PTR_ERR(vma);
+                goto err_put_bo;
+        }
+
+        if (use_phys)
+                overlay->flip_addr = sg_dma_address(obj->mm.pages->sgl);
+        else
+                overlay->flip_addr = i915_ggtt_offset(vma);
+        overlay->regs = i915_vma_pin_iomap(vma);
+        i915_vma_unpin(vma);
+
+        if (IS_ERR(overlay->regs)) {
+                err = PTR_ERR(overlay->regs);
+                goto err_put_bo;
+        }
+
+        overlay->reg_bo = obj;
+        return 0;
+
+err_put_bo:
+        i915_gem_object_put(obj);
+        return err;
+}
+
 void intel_setup_overlay(struct drm_i915_private *dev_priv)
 {
         struct intel_overlay *overlay;
-        struct drm_i915_gem_object *reg_bo;
-        struct overlay_registers __iomem *regs;
-        struct i915_vma *vma = NULL;
         int ret;
 
         if (!HAS_OVERLAY(dev_priv))
@@ -1401,46 +1389,8 @@ void intel_setup_overlay(struct drm_i915_private *dev_priv)
         if (!overlay)
                 return;
 
-        mutex_lock(&dev_priv->drm.struct_mutex);
-        if (WARN_ON(dev_priv->overlay))
-                goto out_free;
-
         overlay->i915 = dev_priv;
 
-        reg_bo = NULL;
-        if (!OVERLAY_NEEDS_PHYSICAL(dev_priv))
-                reg_bo = i915_gem_object_create_stolen(dev_priv, PAGE_SIZE);
-        if (reg_bo == NULL)
-                reg_bo = i915_gem_object_create(dev_priv, PAGE_SIZE);
-        if (IS_ERR(reg_bo))
-                goto out_free;
-        overlay->reg_bo = reg_bo;
-
-        if (OVERLAY_NEEDS_PHYSICAL(dev_priv)) {
-                ret = i915_gem_object_attach_phys(reg_bo, PAGE_SIZE);
-                if (ret) {
-                        DRM_ERROR("failed to attach phys overlay regs\n");
-                        goto out_free_bo;
-                }
-                overlay->flip_addr = reg_bo->phys_handle->busaddr;
-        } else {
-                vma = i915_gem_object_ggtt_pin(reg_bo, NULL,
-                                               0, PAGE_SIZE, PIN_MAPPABLE);
-                if (IS_ERR(vma)) {
-                        DRM_ERROR("failed to pin overlay register bo\n");
-                        ret = PTR_ERR(vma);
-                        goto out_free_bo;
-                }
-                overlay->flip_addr = i915_ggtt_offset(vma);
-
-                ret = i915_gem_object_set_to_gtt_domain(reg_bo, true);
-                if (ret) {
-                        DRM_ERROR("failed to move overlay register bo into the GTT\n");
-                        goto out_unpin_bo;
-                }
-        }
-
-        /* init all values */
         overlay->color_key = 0x0101fe;
         overlay->color_key_enabled = true;
         overlay->brightness = -19;
@@ -1449,44 +1399,51 @@ void intel_setup_overlay(struct drm_i915_private *dev_priv)
 
         init_request_active(&overlay->last_flip, NULL);
 
-        regs = intel_overlay_map_regs(overlay);
-        if (!regs)
-                goto out_unpin_bo;
+        mutex_lock(&dev_priv->drm.struct_mutex);
+
+        ret = get_registers(overlay, OVERLAY_NEEDS_PHYSICAL(dev_priv));
+        if (ret)
+                goto out_free;
+
+        ret = i915_gem_object_set_to_gtt_domain(overlay->reg_bo, true);
+        if (ret)
+                goto out_reg_bo;
 
-        memset_io(regs, 0, sizeof(struct overlay_registers));
-        update_polyphase_filter(regs);
-        update_reg_attrs(overlay, regs);
+        mutex_unlock(&dev_priv->drm.struct_mutex);
 
-        intel_overlay_unmap_regs(overlay, regs);
+        memset_io(overlay->regs, 0, sizeof(struct overlay_registers));
+        update_polyphase_filter(overlay->regs);
+        update_reg_attrs(overlay, overlay->regs);
 
         dev_priv->overlay = overlay;
-        mutex_unlock(&dev_priv->drm.struct_mutex);
-        DRM_INFO("initialized overlay support\n");
+        DRM_INFO("Initialized overlay support.\n");
         return;
 
-out_unpin_bo:
-        if (vma)
-                i915_vma_unpin(vma);
-out_free_bo:
-        i915_gem_object_put(reg_bo);
+out_reg_bo:
+        i915_gem_object_put(overlay->reg_bo);
 out_free:
         mutex_unlock(&dev_priv->drm.struct_mutex);
         kfree(overlay);
-        return;
 }
 
 void intel_cleanup_overlay(struct drm_i915_private *dev_priv)
 {
-        if (!dev_priv->overlay)
+        struct intel_overlay *overlay;
+
+        overlay = fetch_and_zero(&dev_priv->overlay);
+        if (!overlay)
                 return;
 
-        /* The bo's should be free'd by the generic code already.
+        /*
+         * The bo's should be free'd by the generic code already.
          * Furthermore modesetting teardown happens beforehand so the
-         * hardware should be off already */
-        WARN_ON(dev_priv->overlay->active);
+         * hardware should be off already.
+         */
+        WARN_ON(overlay->active);
+
+        i915_gem_object_put(overlay->reg_bo);
 
-        i915_gem_object_put(dev_priv->overlay->reg_bo);
-        kfree(dev_priv->overlay);
+        kfree(overlay);
 }
 
 #if IS_ENABLED(CONFIG_DRM_I915_CAPTURE_ERROR)
@@ -1498,37 +1455,11 @@ struct intel_overlay_error_state {
         u32 isr;
 };
 
-static struct overlay_registers __iomem *
-intel_overlay_map_regs_atomic(struct intel_overlay *overlay)
-{
-        struct drm_i915_private *dev_priv = overlay->i915;
-        struct overlay_registers __iomem *regs;
-
-        if (OVERLAY_NEEDS_PHYSICAL(dev_priv))
-                /* Cast to make sparse happy, but it's wc memory anyway, so
-                 * equivalent to the wc io mapping on X86. */
-                regs = (struct overlay_registers __iomem *)
-                        overlay->reg_bo->phys_handle->vaddr;
-        else
-                regs = io_mapping_map_atomic_wc(&dev_priv->ggtt.iomap,
-                                                overlay->flip_addr);
-
-        return regs;
-}
-
-static void intel_overlay_unmap_regs_atomic(struct intel_overlay *overlay,
-                                        struct overlay_registers __iomem *regs)
-{
-        if (!OVERLAY_NEEDS_PHYSICAL(overlay->i915))
-                io_mapping_unmap_atomic(regs);
-}
-
 struct intel_overlay_error_state *
 intel_overlay_capture_error_state(struct drm_i915_private *dev_priv)
 {
         struct intel_overlay *overlay = dev_priv->overlay;
         struct intel_overlay_error_state *error;
-        struct overlay_registers __iomem *regs;
 
         if (!overlay || !overlay->active)
                 return NULL;
@@ -1541,18 +1472,9 @@ intel_overlay_capture_error_state(struct drm_i915_private *dev_priv)
         error->isr = I915_READ(ISR);
         error->base = overlay->flip_addr;
 
-        regs = intel_overlay_map_regs_atomic(overlay);
-        if (!regs)
-                goto err;
-
-        memcpy_fromio(&error->regs, regs, sizeof(struct overlay_registers));
-        intel_overlay_unmap_regs_atomic(overlay, regs);
+        memcpy_fromio(&error->regs, overlay->regs, sizeof(error->regs));
 
         return error;
-
-err:
-        kfree(error);
-        return NULL;
 }
 
 void
diff --git a/drivers/gpu/drm/mediatek/mtk_disp_ovl.c b/drivers/gpu/drm/mediatek/mtk_disp_ovl.c
index 978782a77629..28d191192945 100644
--- a/drivers/gpu/drm/mediatek/mtk_disp_ovl.c
+++ b/drivers/gpu/drm/mediatek/mtk_disp_ovl.c
@@ -132,6 +132,11 @@ static void mtk_ovl_config(struct mtk_ddp_comp *comp, unsigned int w,
         writel(0x0, comp->regs + DISP_REG_OVL_RST);
 }
 
+static unsigned int mtk_ovl_layer_nr(struct mtk_ddp_comp *comp)
+{
+        return 4;
+}
+
 static void mtk_ovl_layer_on(struct mtk_ddp_comp *comp, unsigned int idx)
 {
         unsigned int reg;
@@ -157,6 +162,11 @@ static void mtk_ovl_layer_off(struct mtk_ddp_comp *comp, unsigned int idx)
 
 static unsigned int ovl_fmt_convert(struct mtk_disp_ovl *ovl, unsigned int fmt)
 {
+        /* The return value in switch "MEM_MODE_INPUT_FORMAT_XXX"
+         * is defined in mediatek HW data sheet.
+         * The alphabet order in XXX is no relation to data
+         * arrangement in memory.
+         */
         switch (fmt) {
         default:
         case DRM_FORMAT_RGB565:
@@ -221,6 +231,7 @@ static const struct mtk_ddp_comp_funcs mtk_disp_ovl_funcs = {
         .stop = mtk_ovl_stop,
         .enable_vblank = mtk_ovl_enable_vblank,
         .disable_vblank = mtk_ovl_disable_vblank,
+        .layer_nr = mtk_ovl_layer_nr,
         .layer_on = mtk_ovl_layer_on,
         .layer_off = mtk_ovl_layer_off,
         .layer_config = mtk_ovl_layer_config,
diff --git a/drivers/gpu/drm/mediatek/mtk_disp_rdma.c b/drivers/gpu/drm/mediatek/mtk_disp_rdma.c
index 585943c81e1f..b0a5cffe345a 100644
--- a/drivers/gpu/drm/mediatek/mtk_disp_rdma.c
+++ b/drivers/gpu/drm/mediatek/mtk_disp_rdma.c
@@ -31,14 +31,31 @@
 #define RDMA_REG_UPDATE_INT                             BIT(0)
 #define DISP_REG_RDMA_GLOBAL_CON                0x0010
 #define RDMA_ENGINE_EN                                  BIT(0)
+#define RDMA_MODE_MEMORY                                BIT(1)
 #define DISP_REG_RDMA_SIZE_CON_0                0x0014
+#define RDMA_MATRIX_ENABLE                              BIT(17)
+#define RDMA_MATRIX_INT_MTX_SEL                         GENMASK(23, 20)
+#define RDMA_MATRIX_INT_MTX_BT601_to_RGB                (6 << 20)
 #define DISP_REG_RDMA_SIZE_CON_1                0x0018
 #define DISP_REG_RDMA_TARGET_LINE               0x001c
+#define DISP_RDMA_MEM_CON                       0x0024
+#define MEM_MODE_INPUT_FORMAT_RGB565                    (0x000 << 4)
+#define MEM_MODE_INPUT_FORMAT_RGB888                    (0x001 << 4)
+#define MEM_MODE_INPUT_FORMAT_RGBA8888                  (0x002 << 4)
+#define MEM_MODE_INPUT_FORMAT_ARGB8888                  (0x003 << 4)
+#define MEM_MODE_INPUT_FORMAT_UYVY                      (0x004 << 4)
+#define MEM_MODE_INPUT_FORMAT_YUYV                      (0x005 << 4)
+#define MEM_MODE_INPUT_SWAP                             BIT(8)
+#define DISP_RDMA_MEM_SRC_PITCH                 0x002c
+#define DISP_RDMA_MEM_GMC_SETTING_0             0x0030
 #define DISP_REG_RDMA_FIFO_CON                  0x0040
 #define RDMA_FIFO_UNDERFLOW_EN                          BIT(31)
 #define RDMA_FIFO_PSEUDO_SIZE(bytes)                    (((bytes) / 16) << 16)
 #define RDMA_OUTPUT_VALID_FIFO_THRESHOLD(bytes)         ((bytes) / 16)
 #define RDMA_FIFO_SIZE(rdma)                    ((rdma)->data->fifo_size)
+#define DISP_RDMA_MEM_START_ADDR                0x0f00
+
+#define RDMA_MEM_GMC                            0x40402020
 
 struct mtk_disp_rdma_data {
         unsigned int fifo_size;
@@ -138,12 +155,87 @@ static void mtk_rdma_config(struct mtk_ddp_comp *comp, unsigned int width,
         writel(reg, comp->regs + DISP_REG_RDMA_FIFO_CON);
 }
 
+static unsigned int rdma_fmt_convert(struct mtk_disp_rdma *rdma,
+                                     unsigned int fmt)
+{
+        /* The return value in switch "MEM_MODE_INPUT_FORMAT_XXX"
+         * is defined in mediatek HW data sheet.
+         * The alphabet order in XXX is no relation to data
+         * arrangement in memory.
+         */
+        switch (fmt) {
+        default:
+        case DRM_FORMAT_RGB565:
+                return MEM_MODE_INPUT_FORMAT_RGB565;
+        case DRM_FORMAT_BGR565:
+                return MEM_MODE_INPUT_FORMAT_RGB565 | MEM_MODE_INPUT_SWAP;
+        case DRM_FORMAT_RGB888:
+                return MEM_MODE_INPUT_FORMAT_RGB888;
+        case DRM_FORMAT_BGR888:
+                return MEM_MODE_INPUT_FORMAT_RGB888 | MEM_MODE_INPUT_SWAP;
+        case DRM_FORMAT_RGBX8888:
+        case DRM_FORMAT_RGBA8888:
+                return MEM_MODE_INPUT_FORMAT_ARGB8888;
+        case DRM_FORMAT_BGRX8888:
+        case DRM_FORMAT_BGRA8888:
+                return MEM_MODE_INPUT_FORMAT_ARGB8888 | MEM_MODE_INPUT_SWAP;
+        case DRM_FORMAT_XRGB8888:
+        case DRM_FORMAT_ARGB8888:
+                return MEM_MODE_INPUT_FORMAT_RGBA8888;
+        case DRM_FORMAT_XBGR8888:
+        case DRM_FORMAT_ABGR8888:
+                return MEM_MODE_INPUT_FORMAT_RGBA8888 | MEM_MODE_INPUT_SWAP;
+        case DRM_FORMAT_UYVY:
+                return MEM_MODE_INPUT_FORMAT_UYVY;
+        case DRM_FORMAT_YUYV:
+                return MEM_MODE_INPUT_FORMAT_YUYV;
+        }
+}
+
+static unsigned int mtk_rdma_layer_nr(struct mtk_ddp_comp *comp)
+{
+        return 1;
+}
+
+static void mtk_rdma_layer_config(struct mtk_ddp_comp *comp, unsigned int idx,
+                                  struct mtk_plane_state *state)
+{
+        struct mtk_disp_rdma *rdma = comp_to_rdma(comp);
+        struct mtk_plane_pending_state *pending = &state->pending;
+        unsigned int addr = pending->addr;
+        unsigned int pitch = pending->pitch & 0xffff;
+        unsigned int fmt = pending->format;
+        unsigned int con;
+
+        con = rdma_fmt_convert(rdma, fmt);
+        writel_relaxed(con, comp->regs + DISP_RDMA_MEM_CON);
+
+        if (fmt == DRM_FORMAT_UYVY || fmt == DRM_FORMAT_YUYV) {
+                rdma_update_bits(comp, DISP_REG_RDMA_SIZE_CON_0,
+                                 RDMA_MATRIX_ENABLE, RDMA_MATRIX_ENABLE);
+                rdma_update_bits(comp, DISP_REG_RDMA_SIZE_CON_0,
+                                 RDMA_MATRIX_INT_MTX_SEL,
+                                 RDMA_MATRIX_INT_MTX_BT601_to_RGB);
+        } else {
+                rdma_update_bits(comp, DISP_REG_RDMA_SIZE_CON_0,
+                                 RDMA_MATRIX_ENABLE, 0);
+        }
+
+        writel_relaxed(addr, comp->regs + DISP_RDMA_MEM_START_ADDR);
+        writel_relaxed(pitch, comp->regs + DISP_RDMA_MEM_SRC_PITCH);
+        writel(RDMA_MEM_GMC, comp->regs + DISP_RDMA_MEM_GMC_SETTING_0);
+        rdma_update_bits(comp, DISP_REG_RDMA_GLOBAL_CON,
+                         RDMA_MODE_MEMORY, RDMA_MODE_MEMORY);
+}
+
 static const struct mtk_ddp_comp_funcs mtk_disp_rdma_funcs = {
         .config = mtk_rdma_config,
         .start = mtk_rdma_start,
         .stop = mtk_rdma_stop,
         .enable_vblank = mtk_rdma_enable_vblank,
         .disable_vblank = mtk_rdma_disable_vblank,
+        .layer_nr = mtk_rdma_layer_nr,
+        .layer_config = mtk_rdma_layer_config,
 };
 
 static int mtk_disp_rdma_bind(struct device *dev, struct device *master,
diff --git a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
index 2d6aa150a9ff..0b976dfd04df 100644
--- a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
+++ b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
@@ -45,7 +45,8 @@ struct mtk_drm_crtc {
         bool                            pending_needs_vblank;
         struct drm_pending_vblank_event *event;
 
-        struct drm_plane                planes[OVL_LAYER_NR];
+        struct drm_plane                *planes;
+        unsigned int                    layer_nr;
         bool                            pending_planes;
 
         void __iomem                    *config_regs;
@@ -171,9 +172,9 @@ static void mtk_drm_crtc_mode_set_nofb(struct drm_crtc *crtc)
 static int mtk_drm_crtc_enable_vblank(struct drm_crtc *crtc)
 {
         struct mtk_drm_crtc *mtk_crtc = to_mtk_crtc(crtc);
-        struct mtk_ddp_comp *ovl = mtk_crtc->ddp_comp[0];
+        struct mtk_ddp_comp *comp = mtk_crtc->ddp_comp[0];
 
-        mtk_ddp_comp_enable_vblank(ovl, &mtk_crtc->base);
+        mtk_ddp_comp_enable_vblank(comp, &mtk_crtc->base);
 
         return 0;
 }
@@ -181,9 +182,9 @@ static int mtk_drm_crtc_enable_vblank(struct drm_crtc *crtc)
 static void mtk_drm_crtc_disable_vblank(struct drm_crtc *crtc)
 {
         struct mtk_drm_crtc *mtk_crtc = to_mtk_crtc(crtc);
-        struct mtk_ddp_comp *ovl = mtk_crtc->ddp_comp[0];
+        struct mtk_ddp_comp *comp = mtk_crtc->ddp_comp[0];
 
-        mtk_ddp_comp_disable_vblank(ovl);
+        mtk_ddp_comp_disable_vblank(comp);
 }
 
 static int mtk_crtc_ddp_clk_enable(struct mtk_drm_crtc *mtk_crtc)
@@ -286,7 +287,7 @@ static int mtk_crtc_ddp_hw_init(struct mtk_drm_crtc *mtk_crtc)
         }
 
         /* Initially configure all planes */
-        for (i = 0; i < OVL_LAYER_NR; i++) {
+        for (i = 0; i < mtk_crtc->layer_nr; i++) {
                 struct drm_plane *plane = &mtk_crtc->planes[i];
                 struct mtk_plane_state *plane_state;
 
@@ -334,7 +335,7 @@ static void mtk_crtc_ddp_config(struct drm_crtc *crtc)
 {
         struct mtk_drm_crtc *mtk_crtc = to_mtk_crtc(crtc);
         struct mtk_crtc_state *state = to_mtk_crtc_state(mtk_crtc->base.state);
-        struct mtk_ddp_comp *ovl = mtk_crtc->ddp_comp[0];
+        struct mtk_ddp_comp *comp = mtk_crtc->ddp_comp[0];
         unsigned int i;
 
         /*
@@ -343,7 +344,7 @@ static void mtk_crtc_ddp_config(struct drm_crtc *crtc)
          * queue update module registers on vblank.
          */
         if (state->pending_config) {
-                mtk_ddp_comp_config(ovl, state->pending_width,
+                mtk_ddp_comp_config(comp, state->pending_width,
                                     state->pending_height,
                                     state->pending_vrefresh, 0);
 
@@ -351,14 +352,14 @@ static void mtk_crtc_ddp_config(struct drm_crtc *crtc)
         }
 
         if (mtk_crtc->pending_planes) {
-                for (i = 0; i < OVL_LAYER_NR; i++) {
+                for (i = 0; i < mtk_crtc->layer_nr; i++) {
                         struct drm_plane *plane = &mtk_crtc->planes[i];
                         struct mtk_plane_state *plane_state;
 
                         plane_state = to_mtk_plane_state(plane->state);
 
                         if (plane_state->pending.config) {
-                                mtk_ddp_comp_layer_config(ovl, i, plane_state);
+                                mtk_ddp_comp_layer_config(comp, i, plane_state);
                                 plane_state->pending.config = false;
                         }
                 }
@@ -370,12 +371,12 @@ static void mtk_drm_crtc_atomic_enable(struct drm_crtc *crtc,
                                        struct drm_crtc_state *old_state)
 {
         struct mtk_drm_crtc *mtk_crtc = to_mtk_crtc(crtc);
-        struct mtk_ddp_comp *ovl = mtk_crtc->ddp_comp[0];
+        struct mtk_ddp_comp *comp = mtk_crtc->ddp_comp[0];
         int ret;
 
         DRM_DEBUG_DRIVER("%s %d\n", __func__, crtc->base.id);
 
-        ret = mtk_smi_larb_get(ovl->larb_dev);
+        ret = mtk_smi_larb_get(comp->larb_dev);
         if (ret) {
                 DRM_ERROR("Failed to get larb: %d\n", ret);
                 return;
@@ -383,7 +384,7 @@ static void mtk_drm_crtc_atomic_enable(struct drm_crtc *crtc,
 
         ret = mtk_crtc_ddp_hw_init(mtk_crtc);
         if (ret) {
-                mtk_smi_larb_put(ovl->larb_dev);
+                mtk_smi_larb_put(comp->larb_dev);
                 return;
         }
 
@@ -395,7 +396,7 @@ static void mtk_drm_crtc_atomic_disable(struct drm_crtc *crtc,
                                         struct drm_crtc_state *old_state)
 {
         struct mtk_drm_crtc *mtk_crtc = to_mtk_crtc(crtc);
-        struct mtk_ddp_comp *ovl = mtk_crtc->ddp_comp[0];
+        struct mtk_ddp_comp *comp = mtk_crtc->ddp_comp[0];
         int i;
 
         DRM_DEBUG_DRIVER("%s %d\n", __func__, crtc->base.id);
@@ -403,7 +404,7 @@ static void mtk_drm_crtc_atomic_disable(struct drm_crtc *crtc,
                 return;
 
         /* Set all pending plane state to disabled */
-        for (i = 0; i < OVL_LAYER_NR; i++) {
+        for (i = 0; i < mtk_crtc->layer_nr; i++) {
                 struct drm_plane *plane = &mtk_crtc->planes[i];
                 struct mtk_plane_state *plane_state;
 
@@ -418,7 +419,7 @@ static void mtk_drm_crtc_atomic_disable(struct drm_crtc *crtc,
 
         drm_crtc_vblank_off(crtc);
         mtk_crtc_ddp_hw_fini(mtk_crtc);
-        mtk_smi_larb_put(ovl->larb_dev);
+        mtk_smi_larb_put(comp->larb_dev);
 
         mtk_crtc->enabled = false;
 }
@@ -450,7 +451,7 @@ static void mtk_drm_crtc_atomic_flush(struct drm_crtc *crtc,
 
         if (mtk_crtc->event)
                 mtk_crtc->pending_needs_vblank = true;
-        for (i = 0; i < OVL_LAYER_NR; i++) {
+        for (i = 0; i < mtk_crtc->layer_nr; i++) {
                 struct drm_plane *plane = &mtk_crtc->planes[i];
                 struct mtk_plane_state *plane_state;
 
@@ -516,7 +517,7 @@ err_cleanup_crtc:
         return ret;
 }
 
-void mtk_crtc_ddp_irq(struct drm_crtc *crtc, struct mtk_ddp_comp *ovl)
+void mtk_crtc_ddp_irq(struct drm_crtc *crtc, struct mtk_ddp_comp *comp)
 {
         struct mtk_drm_crtc *mtk_crtc = to_mtk_crtc(crtc);
         struct mtk_drm_private *priv = crtc->dev->dev_private;
@@ -598,7 +599,12 @@ int mtk_drm_crtc_create(struct drm_device *drm_dev,
                 mtk_crtc->ddp_comp[i] = comp;
         }
 
-        for (zpos = 0; zpos < OVL_LAYER_NR; zpos++) {
+        mtk_crtc->layer_nr = mtk_ddp_comp_layer_nr(mtk_crtc->ddp_comp[0]);
+        mtk_crtc->planes = devm_kzalloc(dev, mtk_crtc->layer_nr *
+                                        sizeof(struct drm_plane),
+                                        GFP_KERNEL);
+
+        for (zpos = 0; zpos < mtk_crtc->layer_nr; zpos++) {
                 type = (zpos == 0) ? DRM_PLANE_TYPE_PRIMARY :
                                 (zpos == 1) ? DRM_PLANE_TYPE_CURSOR :
                                                 DRM_PLANE_TYPE_OVERLAY;
@@ -609,7 +615,8 @@ int mtk_drm_crtc_create(struct drm_device *drm_dev,
         }
 
         ret = mtk_drm_crtc_init(drm_dev, mtk_crtc, &mtk_crtc->planes[0],
-                                &mtk_crtc->planes[1], pipe);
+                                mtk_crtc->layer_nr > 1 ? &mtk_crtc->planes[1] :
+                                NULL, pipe);
         if (ret < 0)
                 goto unprepare;
         drm_mode_crtc_set_gamma_size(&mtk_crtc->base, MTK_LUT_SIZE);
diff --git a/drivers/gpu/drm/mediatek/mtk_drm_crtc.h b/drivers/gpu/drm/mediatek/mtk_drm_crtc.h
index 9d9410c67ae9..091adb2087eb 100644
--- a/drivers/gpu/drm/mediatek/mtk_drm_crtc.h
+++ b/drivers/gpu/drm/mediatek/mtk_drm_crtc.h
@@ -18,13 +18,12 @@
 #include "mtk_drm_ddp_comp.h"
 #include "mtk_drm_plane.h"
 
-#define OVL_LAYER_NR    4
 #define MTK_LUT_SIZE    512
 #define MTK_MAX_BPC     10
 #define MTK_MIN_BPC     3
 
 void mtk_drm_crtc_commit(struct drm_crtc *crtc);
-void mtk_crtc_ddp_irq(struct drm_crtc *crtc, struct mtk_ddp_comp *ovl);
+void mtk_crtc_ddp_irq(struct drm_crtc *crtc, struct mtk_ddp_comp *comp);
 int mtk_drm_crtc_create(struct drm_device *drm_dev,
                         const enum mtk_ddp_comp_id *path,
                         unsigned int path_len);
diff --git a/drivers/gpu/drm/mediatek/mtk_drm_ddp.c b/drivers/gpu/drm/mediatek/mtk_drm_ddp.c
index 87e4191c250e..546b3e3b300b 100644
--- a/drivers/gpu/drm/mediatek/mtk_drm_ddp.c
+++ b/drivers/gpu/drm/mediatek/mtk_drm_ddp.c
@@ -106,6 +106,8 @@
 #define OVL1_MOUT_EN_COLOR1             0x1
 #define GAMMA_MOUT_EN_RDMA1             0x1
 #define RDMA0_SOUT_DPI0                 0x2
+#define RDMA0_SOUT_DPI1                 0x3
+#define RDMA0_SOUT_DSI1                 0x1
 #define RDMA0_SOUT_DSI2                 0x4
 #define RDMA0_SOUT_DSI3                 0x5
 #define RDMA1_SOUT_DPI0                 0x2
@@ -122,6 +124,8 @@
 #define DPI0_SEL_IN_RDMA2               0x3
 #define DPI1_SEL_IN_RDMA1               (0x1 << 8)
 #define DPI1_SEL_IN_RDMA2               (0x3 << 8)
+#define DSI0_SEL_IN_RDMA1               0x1
+#define DSI0_SEL_IN_RDMA2               0x4
 #define DSI1_SEL_IN_RDMA1               0x1
 #define DSI1_SEL_IN_RDMA2               0x4
 #define DSI2_SEL_IN_RDMA1               (0x1 << 16)
@@ -224,6 +228,12 @@ static unsigned int mtk_ddp_mout_en(enum mtk_ddp_comp_id cur,
         } else if (cur == DDP_COMPONENT_RDMA0 && next == DDP_COMPONENT_DPI0) {
                 *addr = DISP_REG_CONFIG_DISP_RDMA0_SOUT_EN;
                 value = RDMA0_SOUT_DPI0;
+        } else if (cur == DDP_COMPONENT_RDMA0 && next == DDP_COMPONENT_DPI1) {
+                *addr = DISP_REG_CONFIG_DISP_RDMA0_SOUT_EN;
+                value = RDMA0_SOUT_DPI1;
+        } else if (cur == DDP_COMPONENT_RDMA0 && next == DDP_COMPONENT_DSI1) {
+                *addr = DISP_REG_CONFIG_DISP_RDMA0_SOUT_EN;
+                value = RDMA0_SOUT_DSI1;
         } else if (cur == DDP_COMPONENT_RDMA0 && next == DDP_COMPONENT_DSI2) {
                 *addr = DISP_REG_CONFIG_DISP_RDMA0_SOUT_EN;
                 value = RDMA0_SOUT_DSI2;
@@ -282,6 +292,9 @@ static unsigned int mtk_ddp_sel_in(enum mtk_ddp_comp_id cur,
         } else if (cur == DDP_COMPONENT_RDMA1 && next == DDP_COMPONENT_DPI1) {
                 *addr = DISP_REG_CONFIG_DPI_SEL_IN;
                 value = DPI1_SEL_IN_RDMA1;
+        } else if (cur == DDP_COMPONENT_RDMA1 && next == DDP_COMPONENT_DSI0) {
+                *addr = DISP_REG_CONFIG_DSIE_SEL_IN;
+                value = DSI0_SEL_IN_RDMA1;
         } else if (cur == DDP_COMPONENT_RDMA1 && next == DDP_COMPONENT_DSI1) {
                 *addr = DISP_REG_CONFIG_DSIO_SEL_IN;
                 value = DSI1_SEL_IN_RDMA1;
@@ -297,8 +310,11 @@ static unsigned int mtk_ddp_sel_in(enum mtk_ddp_comp_id cur,
         } else if (cur == DDP_COMPONENT_RDMA2 && next == DDP_COMPONENT_DPI1) {
                 *addr = DISP_REG_CONFIG_DPI_SEL_IN;
                 value = DPI1_SEL_IN_RDMA2;
-        } else if (cur == DDP_COMPONENT_RDMA2 && next == DDP_COMPONENT_DSI1) {
+        } else if (cur == DDP_COMPONENT_RDMA2 && next == DDP_COMPONENT_DSI0) {
                 *addr = DISP_REG_CONFIG_DSIE_SEL_IN;
+                value = DSI0_SEL_IN_RDMA2;
+        } else if (cur == DDP_COMPONENT_RDMA2 && next == DDP_COMPONENT_DSI1) {
+                *addr = DISP_REG_CONFIG_DSIO_SEL_IN;
                 value = DSI1_SEL_IN_RDMA2;
         } else if (cur == DDP_COMPONENT_RDMA2 && next == DDP_COMPONENT_DSI2) {
                 *addr = DISP_REG_CONFIG_DSIE_SEL_IN;
diff --git a/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.h b/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.h
index 7413ffeb3c9d..8399229e6ad2 100644
--- a/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.h
+++ b/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.h
@@ -78,6 +78,7 @@ struct mtk_ddp_comp_funcs {
         void (*stop)(struct mtk_ddp_comp *comp);
         void (*enable_vblank)(struct mtk_ddp_comp *comp, struct drm_crtc *crtc);
         void (*disable_vblank)(struct mtk_ddp_comp *comp);
+        unsigned int (*layer_nr)(struct mtk_ddp_comp *comp);
         void (*layer_on)(struct mtk_ddp_comp *comp, unsigned int idx);
         void (*layer_off)(struct mtk_ddp_comp *comp, unsigned int idx);
         void (*layer_config)(struct mtk_ddp_comp *comp, unsigned int idx,
@@ -128,6 +129,14 @@ static inline void mtk_ddp_comp_disable_vblank(struct mtk_ddp_comp *comp)
                 comp->funcs->disable_vblank(comp);
 }
 
+static inline unsigned int mtk_ddp_comp_layer_nr(struct mtk_ddp_comp *comp)
+{
+        if (comp->funcs && comp->funcs->layer_nr)
+                return comp->funcs->layer_nr(comp);
+
+        return 0;
+}
+
 static inline void mtk_ddp_comp_layer_on(struct mtk_ddp_comp *comp,
                                          unsigned int idx)
 {
diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
index 39721119713b..47ec604289b7 100644
--- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c
+++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
@@ -381,7 +381,7 @@ static int mtk_drm_bind(struct device *dev)
 err_deinit:
         mtk_drm_kms_deinit(drm);
 err_free:
-        drm_dev_unref(drm);
+        drm_dev_put(drm);
         return ret;
 }
 
@@ -390,7 +390,7 @@ static void mtk_drm_unbind(struct device *dev)
         struct mtk_drm_private *private = dev_get_drvdata(dev);
 
         drm_dev_unregister(private->drm);
-        drm_dev_unref(private->drm);
+        drm_dev_put(private->drm);
         private->drm = NULL;
 }
 
@@ -564,7 +564,7 @@ static int mtk_drm_remove(struct platform_device *pdev)
 
         drm_dev_unregister(drm);
         mtk_drm_kms_deinit(drm);
-        drm_dev_unref(drm);
+        drm_dev_put(drm);
 
         component_master_del(&pdev->dev, &mtk_drm_ops);
         pm_runtime_disable(&pdev->dev);
@@ -580,29 +580,24 @@ static int mtk_drm_sys_suspend(struct device *dev)
 {
         struct mtk_drm_private *private = dev_get_drvdata(dev);
         struct drm_device *drm = private->drm;
+        int ret;
 
-        drm_kms_helper_poll_disable(drm);
-
-        private->suspend_state = drm_atomic_helper_suspend(drm);
-        if (IS_ERR(private->suspend_state)) {
-                drm_kms_helper_poll_enable(drm);
-                return PTR_ERR(private->suspend_state);
-        }
-
+        ret = drm_mode_config_helper_suspend(drm);
         DRM_DEBUG_DRIVER("mtk_drm_sys_suspend\n");
-        return 0;
+
+        return ret;
 }
 
 static int mtk_drm_sys_resume(struct device *dev)
 {
         struct mtk_drm_private *private = dev_get_drvdata(dev);
         struct drm_device *drm = private->drm;
+        int ret;
 
-        drm_atomic_helper_resume(drm, private->suspend_state);
-        drm_kms_helper_poll_enable(drm);
-
+        ret = drm_mode_config_helper_resume(drm);
         DRM_DEBUG_DRIVER("mtk_drm_sys_resume\n");
-        return 0;
+
+        return ret;
 }
 #endif
 
diff --git a/drivers/gpu/drm/nouveau/dispnv50/disp.c b/drivers/gpu/drm/nouveau/dispnv50/disp.c
index 8412119bd940..5691dfa1db6f 100644
--- a/drivers/gpu/drm/nouveau/dispnv50/disp.c
+++ b/drivers/gpu/drm/nouveau/dispnv50/disp.c
@@ -1123,17 +1123,21 @@ nv50_mstm_enable(struct nv50_mstm *mstm, u8 dpcd, int state)
         int ret;
 
         if (dpcd >= 0x12) {
-                ret = drm_dp_dpcd_readb(mstm->mgr.aux, DP_MSTM_CTRL, &dpcd);
+                /* Even if we're enabling MST, start with disabling the
+                 * branching unit to clear any sink-side MST topology state
+                 * that wasn't set by us
+                 */
+                ret = drm_dp_dpcd_writeb(mstm->mgr.aux, DP_MSTM_CTRL, 0);
                 if (ret < 0)
                         return ret;
 
-                dpcd &= ~DP_MST_EN;
-                if (state)
-                        dpcd |= DP_MST_EN;
-
-                ret = drm_dp_dpcd_writeb(mstm->mgr.aux, DP_MSTM_CTRL, dpcd);
-                if (ret < 0)
-                        return ret;
+                if (state) {
+                        /* Now, start initializing */
+                        ret = drm_dp_dpcd_writeb(mstm->mgr.aux, DP_MSTM_CTRL,
+                                                 DP_MST_EN);
+                        if (ret < 0)
+                                return ret;
+                }
         }
 
         return nvif_mthd(disp, 0, &args, sizeof(args));
@@ -1142,31 +1146,58 @@ nv50_mstm_enable(struct nv50_mstm *mstm, u8 dpcd, int state)
 int
 nv50_mstm_detect(struct nv50_mstm *mstm, u8 dpcd[8], int allow)
 {
-        int ret, state = 0;
+        struct drm_dp_aux *aux;
+        int ret;
+        bool old_state, new_state;
+        u8 mstm_ctrl;
 
         if (!mstm)
                 return 0;
 
-        if (dpcd[0] >= 0x12) {
-                ret = drm_dp_dpcd_readb(mstm->mgr.aux, DP_MSTM_CAP, &dpcd[1]);
+        mutex_lock(&mstm->mgr.lock);
+
+        old_state = mstm->mgr.mst_state;
+        new_state = old_state;
+        aux = mstm->mgr.aux;
+
+        if (old_state) {
+                /* Just check that the MST hub is still as we expect it */
+                ret = drm_dp_dpcd_readb(aux, DP_MSTM_CTRL, &mstm_ctrl);
+                if (ret < 0 || !(mstm_ctrl & DP_MST_EN)) {
+                        DRM_DEBUG_KMS("Hub gone, disabling MST topology\n");
+                        new_state = false;
+                }
+        } else if (dpcd[0] >= 0x12) {
+                ret = drm_dp_dpcd_readb(aux, DP_MSTM_CAP, &dpcd[1]);
                 if (ret < 0)
-                        return ret;
+                        goto probe_error;
 
                 if (!(dpcd[1] & DP_MST_CAP))
                         dpcd[0] = 0x11;
                 else
-                        state = allow;
+                        new_state = allow;
+        }
+
+        if (new_state == old_state) {
+                mutex_unlock(&mstm->mgr.lock);
+                return new_state;
         }
 
-        ret = nv50_mstm_enable(mstm, dpcd[0], state);
+        ret = nv50_mstm_enable(mstm, dpcd[0], new_state);
         if (ret)
-                return ret;
+                goto probe_error;
+
+        mutex_unlock(&mstm->mgr.lock);
 
-        ret = drm_dp_mst_topology_mgr_set_mst(&mstm->mgr, state);
+        ret = drm_dp_mst_topology_mgr_set_mst(&mstm->mgr, new_state);
         if (ret)
                 return nv50_mstm_enable(mstm, dpcd[0], 0);
 
-        return mstm->mgr.mst_state;
+        return new_state;
+
+probe_error:
+        mutex_unlock(&mstm->mgr.lock);
+        return ret;
 }
 
 static void
@@ -2074,7 +2105,7 @@ nv50_disp_atomic_state_alloc(struct drm_device *dev)
 static const struct drm_mode_config_funcs
 nv50_disp_func = {
         .fb_create = nouveau_user_framebuffer_create,
-        .output_poll_changed = drm_fb_helper_output_poll_changed,
+        .output_poll_changed = nouveau_fbcon_output_poll_changed,
         .atomic_check = nv50_disp_atomic_check,
         .atomic_commit = nv50_disp_atomic_commit,
         .atomic_state_alloc = nv50_disp_atomic_state_alloc,
diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.c b/drivers/gpu/drm/nouveau/nouveau_connector.c
index 51932c72334e..247f72cc4d10 100644
--- a/drivers/gpu/drm/nouveau/nouveau_connector.c
+++ b/drivers/gpu/drm/nouveau/nouveau_connector.c
@@ -409,59 +409,45 @@ static struct nouveau_encoder *
 nouveau_connector_ddc_detect(struct drm_connector *connector)
 {
         struct drm_device *dev = connector->dev;
-        struct nouveau_connector *nv_connector = nouveau_connector(connector);
-        struct nouveau_drm *drm = nouveau_drm(dev);
-        struct nvkm_gpio *gpio = nvxx_gpio(&drm->client.device);
-        struct nouveau_encoder *nv_encoder = NULL;
+        struct nouveau_encoder *nv_encoder = NULL, *found = NULL;
         struct drm_encoder *encoder;
-        int i, panel = -ENODEV;
-
-        /* eDP panels need powering on by us (if the VBIOS doesn't default it
-         * to on) before doing any AUX channel transactions.  LVDS panel power
-         * is handled by the SOR itself, and not required for LVDS DDC.
-         */
-        if (nv_connector->type == DCB_CONNECTOR_eDP) {
-                panel = nvkm_gpio_get(gpio, 0, DCB_GPIO_PANEL_POWER, 0xff);
-                if (panel == 0) {
-                        nvkm_gpio_set(gpio, 0, DCB_GPIO_PANEL_POWER, 0xff, 1);
-                        msleep(300);
-                }
-        }
+        int i, ret;
+        bool switcheroo_ddc = false;
 
         drm_connector_for_each_possible_encoder(connector, encoder, i) {
                 nv_encoder = nouveau_encoder(encoder);
 
-                if (nv_encoder->dcb->type == DCB_OUTPUT_DP) {
-                        int ret = nouveau_dp_detect(nv_encoder);
+                switch (nv_encoder->dcb->type) {
+                case DCB_OUTPUT_DP:
+                        ret = nouveau_dp_detect(nv_encoder);
                         if (ret == NOUVEAU_DP_MST)
                                 return NULL;
-                        if (ret == NOUVEAU_DP_SST)
-                                break;
-                } else
-                if ((vga_switcheroo_handler_flags() &
-                     VGA_SWITCHEROO_CAN_SWITCH_DDC) &&
-                    nv_encoder->dcb->type == DCB_OUTPUT_LVDS &&
-                    nv_encoder->i2c) {
-                        int ret;
-                        vga_switcheroo_lock_ddc(dev->pdev);
-                        ret = nvkm_probe_i2c(nv_encoder->i2c, 0x50);
-                        vga_switcheroo_unlock_ddc(dev->pdev);
-                        if (ret)
+                        else if (ret == NOUVEAU_DP_SST)
+                                found = nv_encoder;
+
+                        break;
+                case DCB_OUTPUT_LVDS:
+                        switcheroo_ddc = !!(vga_switcheroo_handler_flags() &
+                                            VGA_SWITCHEROO_CAN_SWITCH_DDC);
+                /* fall-through */
+                default:
+                        if (!nv_encoder->i2c)
                                 break;
-                } else
-                if (nv_encoder->i2c) {
+
+                        if (switcheroo_ddc)
+                                vga_switcheroo_lock_ddc(dev->pdev);
                         if (nvkm_probe_i2c(nv_encoder->i2c, 0x50))
-                                break;
+                                found = nv_encoder;
+                        if (switcheroo_ddc)
+                                vga_switcheroo_unlock_ddc(dev->pdev);
+
+                        break;
                 }
+                if (found)
+                        break;
         }
 
-        /* eDP panel not detected, restore panel power GPIO to previous
-         * state to avoid confusing the SOR for other output types.
-         */
-        if (!nv_encoder && panel == 0)
-                nvkm_gpio_set(gpio, 0, DCB_GPIO_PANEL_POWER, 0xff, panel);
-
-        return nv_encoder;
+        return found;
 }
 
 static struct nouveau_encoder *
@@ -555,12 +541,16 @@ nouveau_connector_detect(struct drm_connector *connector, bool force)
                 nv_connector->edid = NULL;
         }
 
-        /* Outputs are only polled while runtime active, so acquiring a
-         * runtime PM ref here is unnecessary (and would deadlock upon
-         * runtime suspend because it waits for polling to finish).
+        /* Outputs are only polled while runtime active, so resuming the
+         * device here is unnecessary (and would deadlock upon runtime suspend
+         * because it waits for polling to finish). We do however, want to
+         * prevent the autosuspend timer from elapsing during this operation
+         * if possible.
          */
-        if (!drm_kms_helper_is_poll_worker()) {
-                ret = pm_runtime_get_sync(connector->dev->dev);
+        if (drm_kms_helper_is_poll_worker()) {
+                pm_runtime_get_noresume(dev->dev);
+        } else {
+                ret = pm_runtime_get_sync(dev->dev);
                 if (ret < 0 && ret != -EACCES)
                         return conn_status;
         }
@@ -638,10 +628,8 @@ detect_analog:
 
  out:
 
-        if (!drm_kms_helper_is_poll_worker()) {
-                pm_runtime_mark_last_busy(connector->dev->dev);
-                pm_runtime_put_autosuspend(connector->dev->dev);
-        }
+        pm_runtime_mark_last_busy(dev->dev);
+        pm_runtime_put_autosuspend(dev->dev);
 
         return conn_status;
 }
@@ -1105,6 +1093,26 @@ nouveau_connector_hotplug(struct nvif_notify *notify)
         const struct nvif_notify_conn_rep_v0 *rep = notify->data;
         const char *name = connector->name;
         struct nouveau_encoder *nv_encoder;
+        int ret;
+
+        ret = pm_runtime_get(drm->dev->dev);
+        if (ret == 0) {
+                /* We can't block here if there's a pending PM request
+                 * running, as we'll deadlock nouveau_display_fini() when it
+                 * calls nvif_put() on our nvif_notify struct. So, simply
+                 * defer the hotplug event until the device finishes resuming
+                 */
+                NV_DEBUG(drm, "Deferring HPD on %s until runtime resume\n",
+                         name);
+                schedule_work(&drm->hpd_work);
+
+                pm_runtime_put_noidle(drm->dev->dev);
+                return NVIF_NOTIFY_KEEP;
+        } else if (ret != 1 && ret != -EACCES) {
+                NV_WARN(drm, "HPD on %s dropped due to RPM failure: %d\n",
+                        name, ret);
+                return NVIF_NOTIFY_DROP;
+        }
 
         if (rep->mask & NVIF_NOTIFY_CONN_V0_IRQ) {
                 NV_DEBUG(drm, "service %s\n", name);
@@ -1122,6 +1130,8 @@ nouveau_connector_hotplug(struct nvif_notify *notify)
                 drm_helper_hpd_irq_event(connector->dev);
         }
 
+        pm_runtime_mark_last_busy(drm->dev->dev);
+        pm_runtime_put_autosuspend(drm->dev->dev);
         return NVIF_NOTIFY_KEEP;
 }
 
diff --git a/drivers/gpu/drm/nouveau/nouveau_display.c b/drivers/gpu/drm/nouveau/nouveau_display.c
index 139368b31916..540c0cbbfcee 100644
--- a/drivers/gpu/drm/nouveau/nouveau_display.c
+++ b/drivers/gpu/drm/nouveau/nouveau_display.c
@@ -293,7 +293,7 @@ nouveau_user_framebuffer_create(struct drm_device *dev,
 
 static const struct drm_mode_config_funcs nouveau_mode_config_funcs = {
         .fb_create = nouveau_user_framebuffer_create,
-        .output_poll_changed = drm_fb_helper_output_poll_changed,
+        .output_poll_changed = nouveau_fbcon_output_poll_changed,
 };
 
 
@@ -355,8 +355,6 @@ nouveau_display_hpd_work(struct work_struct *work)
         pm_runtime_get_sync(drm->dev->dev);
 
         drm_helper_hpd_irq_event(drm->dev);
-        /* enable polling for external displays */
-        drm_kms_helper_poll_enable(drm->dev);
 
         pm_runtime_mark_last_busy(drm->dev->dev);
         pm_runtime_put_sync(drm->dev->dev);
@@ -379,15 +377,29 @@ nouveau_display_acpi_ntfy(struct notifier_block *nb, unsigned long val,
 {
         struct nouveau_drm *drm = container_of(nb, typeof(*drm), acpi_nb);
         struct acpi_bus_event *info = data;
+        int ret;
 
         if (!strcmp(info->device_class, ACPI_VIDEO_CLASS)) {
                 if (info->type == ACPI_VIDEO_NOTIFY_PROBE) {
-                        /*
-                         * This may be the only indication we receive of a
-                         * connector hotplug on a runtime suspended GPU,
-                         * schedule hpd_work to check.
-                         */
-                        schedule_work(&drm->hpd_work);
+                        ret = pm_runtime_get(drm->dev->dev);
+                        if (ret == 1 || ret == -EACCES) {
+                                /* If the GPU is already awake, or in a state
+                                 * where we can't wake it up, it can handle
+                                 * it's own hotplug events.
+                                 */
+                                pm_runtime_put_autosuspend(drm->dev->dev);
+                        } else if (ret == 0) {
+                                /* This may be the only indication we receive
+                                 * of a connector hotplug on a runtime
+                                 * suspended GPU, schedule hpd_work to check.
+                                 */
+                                NV_DEBUG(drm, "ACPI requested connector reprobe\n");
+                                schedule_work(&drm->hpd_work);
+                                pm_runtime_put_noidle(drm->dev->dev);
+                        } else {
+                                NV_WARN(drm, "Dropped ACPI reprobe event due to RPM error: %d\n",
+                                        ret);
+                        }
 
                         /* acpi-video should not generate keypresses for this */
                         return NOTIFY_BAD;
@@ -411,6 +423,11 @@ nouveau_display_init(struct drm_device *dev)
         if (ret)
                 return ret;
 
+        /* enable connector detection and polling for connectors without HPD
+         * support
+         */
+        drm_kms_helper_poll_enable(dev);
+
         /* enable hotplug interrupts */
         drm_connector_list_iter_begin(dev, &conn_iter);
         nouveau_for_each_non_mst_connector_iter(connector, &conn_iter) {
@@ -425,7 +442,7 @@ nouveau_display_init(struct drm_device *dev)
 }
 
 void
-nouveau_display_fini(struct drm_device *dev, bool suspend)
+nouveau_display_fini(struct drm_device *dev, bool suspend, bool runtime)
 {
         struct nouveau_display *disp = nouveau_display(dev);
         struct nouveau_drm *drm = nouveau_drm(dev);
@@ -450,6 +467,9 @@ nouveau_display_fini(struct drm_device *dev, bool suspend)
         }
         drm_connector_list_iter_end(&conn_iter);
 
+        if (!runtime)
+                cancel_work_sync(&drm->hpd_work);
+
         drm_kms_helper_poll_disable(dev);
         disp->fini(dev);
 }
@@ -618,11 +638,11 @@ nouveau_display_suspend(struct drm_device *dev, bool runtime)
                         }
                 }
 
-                nouveau_display_fini(dev, true);
+                nouveau_display_fini(dev, true, runtime);
                 return 0;
         }
 
-        nouveau_display_fini(dev, true);
+        nouveau_display_fini(dev, true, runtime);
 
         list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
                 struct nouveau_framebuffer *nouveau_fb;
diff --git a/drivers/gpu/drm/nouveau/nouveau_display.h b/drivers/gpu/drm/nouveau/nouveau_display.h
index 54aa7c3fa42d..ff92b54ce448 100644
--- a/drivers/gpu/drm/nouveau/nouveau_display.h
+++ b/drivers/gpu/drm/nouveau/nouveau_display.h
@@ -62,7 +62,7 @@ nouveau_display(struct drm_device *dev)
 int  nouveau_display_create(struct drm_device *dev);
 void nouveau_display_destroy(struct drm_device *dev);
 int  nouveau_display_init(struct drm_device *dev);
-void nouveau_display_fini(struct drm_device *dev, bool suspend);
+void nouveau_display_fini(struct drm_device *dev, bool suspend, bool runtime);
 int  nouveau_display_suspend(struct drm_device *dev, bool runtime);
 void nouveau_display_resume(struct drm_device *dev, bool runtime);
 int  nouveau_display_vblank_enable(struct drm_device *, unsigned int);
diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c
index c7ec86d6c3c9..74d2283f2c28 100644
--- a/drivers/gpu/drm/nouveau/nouveau_drm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_drm.c
@@ -230,7 +230,7 @@ nouveau_cli_init(struct nouveau_drm *drm, const char *sname,
                 mutex_unlock(&drm->master.lock);
         }
         if (ret) {
-                NV_ERROR(drm, "Client allocation failed: %d\n", ret);
+                NV_PRINTK(err, cli, "Client allocation failed: %d\n", ret);
                 goto done;
         }
 
@@ -240,37 +240,37 @@ nouveau_cli_init(struct nouveau_drm *drm, const char *sname,
                                }, sizeof(struct nv_device_v0),
                                &cli->device);
         if (ret) {
-                NV_ERROR(drm, "Device allocation failed: %d\n", ret);
+                NV_PRINTK(err, cli, "Device allocation failed: %d\n", ret);
                 goto done;
         }
 
         ret = nvif_mclass(&cli->device.object, mmus);
         if (ret < 0) {
-                NV_ERROR(drm, "No supported MMU class\n");
+                NV_PRINTK(err, cli, "No supported MMU class\n");
                 goto done;
         }
 
         ret = nvif_mmu_init(&cli->device.object, mmus[ret].oclass, &cli->mmu);
         if (ret) {
-                NV_ERROR(drm, "MMU allocation failed: %d\n", ret);
+                NV_PRINTK(err, cli, "MMU allocation failed: %d\n", ret);
                 goto done;
         }
 
         ret = nvif_mclass(&cli->mmu.object, vmms);
         if (ret < 0) {
-                NV_ERROR(drm, "No supported VMM class\n");
+                NV_PRINTK(err, cli, "No supported VMM class\n");
                 goto done;
         }
 
         ret = nouveau_vmm_init(cli, vmms[ret].oclass, &cli->vmm);
         if (ret) {
-                NV_ERROR(drm, "VMM allocation failed: %d\n", ret);
+                NV_PRINTK(err, cli, "VMM allocation failed: %d\n", ret);
                 goto done;
         }
 
         ret = nvif_mclass(&cli->mmu.object, mems);
         if (ret < 0) {
-                NV_ERROR(drm, "No supported MEM class\n");
+                NV_PRINTK(err, cli, "No supported MEM class\n");
                 goto done;
         }
 
@@ -592,10 +592,8 @@ nouveau_drm_load(struct drm_device *dev, unsigned long flags)
                 pm_runtime_allow(dev->dev);
                 pm_runtime_mark_last_busy(dev->dev);
                 pm_runtime_put(dev->dev);
-        } else {
-                /* enable polling for external displays */
-                drm_kms_helper_poll_enable(dev);
         }
+
         return 0;
 
 fail_dispinit:
@@ -629,7 +627,7 @@ nouveau_drm_unload(struct drm_device *dev)
         nouveau_debugfs_fini(drm);
 
         if (dev->mode_config.num_crtc)
-                nouveau_display_fini(dev, false);
+                nouveau_display_fini(dev, false, false);
         nouveau_display_destroy(dev);
 
         nouveau_bios_takedown(dev);
@@ -835,7 +833,6 @@ nouveau_pmops_runtime_suspend(struct device *dev)
                 return -EBUSY;
         }
 
-        drm_kms_helper_poll_disable(drm_dev);
         nouveau_switcheroo_optimus_dsm();
         ret = nouveau_do_suspend(drm_dev, true);
         pci_save_state(pdev);
diff --git a/drivers/gpu/drm/nouveau/nouveau_fbcon.c b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
index 844498c4267c..0f64c0a1d4b3 100644
--- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c
+++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
@@ -466,6 +466,7 @@ nouveau_fbcon_set_suspend_work(struct work_struct *work)
         console_unlock();
 
         if (state == FBINFO_STATE_RUNNING) {
+                nouveau_fbcon_hotplug_resume(drm->fbcon);
                 pm_runtime_mark_last_busy(drm->dev->dev);
                 pm_runtime_put_sync(drm->dev->dev);
         }
@@ -487,6 +488,61 @@ nouveau_fbcon_set_suspend(struct drm_device *dev, int state)
         schedule_work(&drm->fbcon_work);
 }
 
+void
+nouveau_fbcon_output_poll_changed(struct drm_device *dev)
+{
+        struct nouveau_drm *drm = nouveau_drm(dev);
+        struct nouveau_fbdev *fbcon = drm->fbcon;
+        int ret;
+
+        if (!fbcon)
+                return;
+
+        mutex_lock(&fbcon->hotplug_lock);
+
+        ret = pm_runtime_get(dev->dev);
+        if (ret == 1 || ret == -EACCES) {
+                drm_fb_helper_hotplug_event(&fbcon->helper);
+
+                pm_runtime_mark_last_busy(dev->dev);
+                pm_runtime_put_autosuspend(dev->dev);
+        } else if (ret == 0) {
+                /* If the GPU was already in the process of suspending before
+                 * this event happened, then we can't block here as we'll
+                 * deadlock the runtime pmops since they wait for us to
+                 * finish. So, just defer this event for when we runtime
+                 * resume again. It will be handled by fbcon_work.
+                 */
+                NV_DEBUG(drm, "fbcon HPD event deferred until runtime resume\n");
+                fbcon->hotplug_waiting = true;
+                pm_runtime_put_noidle(drm->dev->dev);
+        } else {
+                DRM_WARN("fbcon HPD event lost due to RPM failure: %d\n",
+                         ret);
+        }
+
+        mutex_unlock(&fbcon->hotplug_lock);
+}
+
+void
+nouveau_fbcon_hotplug_resume(struct nouveau_fbdev *fbcon)
+{
+        struct nouveau_drm *drm;
+
+        if (!fbcon)
+                return;
+        drm = nouveau_drm(fbcon->helper.dev);
+
+        mutex_lock(&fbcon->hotplug_lock);
+        if (fbcon->hotplug_waiting) {
+                fbcon->hotplug_waiting = false;
+
+                NV_DEBUG(drm, "Handling deferred fbcon HPD events\n");
+                drm_fb_helper_hotplug_event(&fbcon->helper);
+        }
+        mutex_unlock(&fbcon->hotplug_lock);
+}
+
 int
 nouveau_fbcon_init(struct drm_device *dev)
 {
@@ -505,6 +561,7 @@ nouveau_fbcon_init(struct drm_device *dev)
 
         drm->fbcon = fbcon;
         INIT_WORK(&drm->fbcon_work, nouveau_fbcon_set_suspend_work);
+        mutex_init(&fbcon->hotplug_lock);
 
         drm_fb_helper_prepare(dev, &fbcon->helper, &nouveau_fbcon_helper_funcs);
 
diff --git a/drivers/gpu/drm/nouveau/nouveau_fbcon.h b/drivers/gpu/drm/nouveau/nouveau_fbcon.h
index a6f192ea3fa6..db9d52047ef8 100644
--- a/drivers/gpu/drm/nouveau/nouveau_fbcon.h
+++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.h
@@ -41,6 +41,9 @@ struct nouveau_fbdev {
         struct nvif_object gdi;
         struct nvif_object blit;
         struct nvif_object twod;
+
+        struct mutex hotplug_lock;
+        bool hotplug_waiting;
 };
 
 void nouveau_fbcon_restore(void);
@@ -68,6 +71,8 @@ void nouveau_fbcon_set_suspend(struct drm_device *dev, int state);
 void nouveau_fbcon_accel_save_disable(struct drm_device *dev);
 void nouveau_fbcon_accel_restore(struct drm_device *dev);
 
+void nouveau_fbcon_output_poll_changed(struct drm_device *dev);
+void nouveau_fbcon_hotplug_resume(struct nouveau_fbdev *fbcon);
 extern int nouveau_nofbaccel;
 
 #endif /* __NV50_FBCON_H__ */
diff --git a/drivers/gpu/drm/nouveau/nouveau_vga.c b/drivers/gpu/drm/nouveau/nouveau_vga.c
index 3da5a4305aa4..8f1ce4833230 100644
--- a/drivers/gpu/drm/nouveau/nouveau_vga.c
+++ b/drivers/gpu/drm/nouveau/nouveau_vga.c
@@ -46,12 +46,10 @@ nouveau_switcheroo_set_state(struct pci_dev *pdev,
                 pr_err("VGA switcheroo: switched nouveau on\n");
                 dev->switch_power_state = DRM_SWITCH_POWER_CHANGING;
                 nouveau_pmops_resume(&pdev->dev);
-                drm_kms_helper_poll_enable(dev);
                 dev->switch_power_state = DRM_SWITCH_POWER_ON;
         } else {
                 pr_err("VGA switcheroo: switched nouveau off\n");
                 dev->switch_power_state = DRM_SWITCH_POWER_CHANGING;
-                drm_kms_helper_poll_disable(dev);
                 nouveau_switcheroo_optimus_dsm();
                 nouveau_pmops_suspend(&pdev->dev);
                 dev->switch_power_state = DRM_SWITCH_POWER_OFF;
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/base.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/base.c
index 32fa94a9773f..cbd33e87b799 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/base.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/base.c
@@ -275,6 +275,7 @@ nvkm_disp_oneinit(struct nvkm_engine *engine)
         struct nvkm_outp *outp, *outt, *pair;
         struct nvkm_conn *conn;
         struct nvkm_head *head;
+        struct nvkm_ior *ior;
         struct nvbios_connE connE;
         struct dcb_output dcbE;
         u8  hpd = 0, ver, hdr;
@@ -399,6 +400,19 @@ nvkm_disp_oneinit(struct nvkm_engine *engine)
                         return ret;
         }
 
+        /* Enforce identity-mapped SOR assignment for panels, which have
+         * certain bits (ie. backlight controls) wired to a specific SOR.
+         */
+        list_for_each_entry(outp, &disp->outp, head) {
+                if (outp->conn->info.type == DCB_CONNECTOR_LVDS ||
+                    outp->conn->info.type == DCB_CONNECTOR_eDP) {
+                        ior = nvkm_ior_find(disp, SOR, ffs(outp->info.or) - 1);
+                        if (!WARN_ON(!ior))
+                                ior->identity = true;
+                        outp->identity = true;
+                }
+        }
+
         i = 0;
         list_for_each_entry(head, &disp->head, head)
                 i = max(i, head->id + 1);
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/dp.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/dp.c
index 7c5bed29ffef..5f301e632599 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/dp.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/dp.c
@@ -28,6 +28,7 @@
 
 #include <subdev/bios.h>
 #include <subdev/bios/init.h>
+#include <subdev/gpio.h>
 #include <subdev/i2c.h>
 
 #include <nvif/event.h>
@@ -412,14 +413,10 @@ nvkm_dp_train(struct nvkm_dp *dp, u32 dataKBps)
 }
 
 static void
-nvkm_dp_release(struct nvkm_outp *outp, struct nvkm_ior *ior)
+nvkm_dp_disable(struct nvkm_outp *outp, struct nvkm_ior *ior)
 {
         struct nvkm_dp *dp = nvkm_dp(outp);
 
-        /* Prevent link from being retrained if sink sends an IRQ. */
-        atomic_set(&dp->lt.done, 0);
-        ior->dp.nr = 0;
-
         /* Execute DisableLT script from DP Info Table. */
         nvbios_init(&ior->disp->engine.subdev, dp->info.script[4],
                 init.outp = &dp->outp.info;
@@ -428,6 +425,16 @@ nvkm_dp_release(struct nvkm_outp *outp, struct nvkm_ior *ior)
         );
 }
 
+static void
+nvkm_dp_release(struct nvkm_outp *outp)
+{
+        struct nvkm_dp *dp = nvkm_dp(outp);
+
+        /* Prevent link from being retrained if sink sends an IRQ. */
+        atomic_set(&dp->lt.done, 0);
+        dp->outp.ior->dp.nr = 0;
+}
+
 static int
 nvkm_dp_acquire(struct nvkm_outp *outp)
 {
@@ -491,7 +498,7 @@ done:
         return ret;
 }
 
-static void
+static bool
 nvkm_dp_enable(struct nvkm_dp *dp, bool enable)
 {
         struct nvkm_i2c_aux *aux = dp->aux;
@@ -505,7 +512,7 @@ nvkm_dp_enable(struct nvkm_dp *dp, bool enable)
 
                 if (!nvkm_rdaux(aux, DPCD_RC00_DPCD_REV, dp->dpcd,
                                 sizeof(dp->dpcd)))
-                        return;
+                        return true;
         }
 
         if (dp->present) {
@@ -515,6 +522,7 @@ nvkm_dp_enable(struct nvkm_dp *dp, bool enable)
         }
 
         atomic_set(&dp->lt.done, 0);
+        return false;
 }
 
 static int
@@ -555,9 +563,38 @@ nvkm_dp_fini(struct nvkm_outp *outp)
 static void
 nvkm_dp_init(struct nvkm_outp *outp)
 {
+        struct nvkm_gpio *gpio = outp->disp->engine.subdev.device->gpio;
         struct nvkm_dp *dp = nvkm_dp(outp);
+
         nvkm_notify_put(&dp->outp.conn->hpd);
-        nvkm_dp_enable(dp, true);
+
+        /* eDP panels need powering on by us (if the VBIOS doesn't default it
+         * to on) before doing any AUX channel transactions.  LVDS panel power
+         * is handled by the SOR itself, and not required for LVDS DDC.
+         */
+        if (dp->outp.conn->info.type == DCB_CONNECTOR_eDP) {
+                int power = nvkm_gpio_get(gpio, 0, DCB_GPIO_PANEL_POWER, 0xff);
+                if (power == 0)
+                        nvkm_gpio_set(gpio, 0, DCB_GPIO_PANEL_POWER, 0xff, 1);
+
+                /* We delay here unconditionally, even if already powered,
+                 * because some laptop panels having a significant resume
+                 * delay before the panel begins responding.
+                 *
+                 * This is likely a bit of a hack, but no better idea for
+                 * handling this at the moment.
+                 */
+                msleep(300);
+
+                /* If the eDP panel can't be detected, we need to restore
+                 * the panel power GPIO to avoid breaking another output.
+                 */
+                if (!nvkm_dp_enable(dp, true) && power == 0)
+                        nvkm_gpio_set(gpio, 0, DCB_GPIO_PANEL_POWER, 0xff, 0);
+        } else {
+                nvkm_dp_enable(dp, true);
+        }
+
         nvkm_notify_get(&dp->hpd);
 }
 
@@ -576,6 +613,7 @@ nvkm_dp_func = {
         .fini = nvkm_dp_fini,
         .acquire = nvkm_dp_acquire,
         .release = nvkm_dp_release,
+        .disable = nvkm_dp_disable,
 };
 
 static int
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/ior.h b/drivers/gpu/drm/nouveau/nvkm/engine/disp/ior.h
index e0b4e0c5704e..19911211a12a 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/ior.h
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/ior.h
@@ -16,6 +16,7 @@ struct nvkm_ior {
         char name[8];
 
         struct list_head head;
+        bool identity;
 
         struct nvkm_ior_state {
                 struct nvkm_outp *outp;
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/nv50.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/nv50.c
index f89c7b977aa5..def005dd5fda 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/nv50.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/nv50.c
@@ -501,11 +501,11 @@ nv50_disp_super_2_0(struct nv50_disp *disp, struct nvkm_head *head)
         nv50_disp_super_ied_off(head, ior, 2);
 
         /* If we're shutting down the OR's only active head, execute
-         * the output path's release function.
+         * the output path's disable function.
          */
         if (ior->arm.head == (1 << head->id)) {
-                if ((outp = ior->arm.outp) && outp->func->release)
-                        outp->func->release(outp, ior);
+                if ((outp = ior->arm.outp) && outp->func->disable)
+                        outp->func->disable(outp, ior);
         }
 }
 
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.c
index be9e7f8c3b23..c62030c96fba 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.c
@@ -93,6 +93,8 @@ nvkm_outp_release(struct nvkm_outp *outp, u8 user)
         if (ior) {
                 outp->acquired &= ~user;
                 if (!outp->acquired) {
+                        if (outp->func->release && outp->ior)
+                                outp->func->release(outp);
                         outp->ior->asy.outp = NULL;
                         outp->ior = NULL;
                 }
@@ -127,17 +129,26 @@ nvkm_outp_acquire(struct nvkm_outp *outp, u8 user)
         if (proto == UNKNOWN)
                 return -ENOSYS;
 
+        /* Deal with panels requiring identity-mapped SOR assignment. */
+        if (outp->identity) {
+                ior = nvkm_ior_find(outp->disp, SOR, ffs(outp->info.or) - 1);
+                if (WARN_ON(!ior))
+                        return -ENOSPC;
+                return nvkm_outp_acquire_ior(outp, user, ior);
+        }
+
         /* First preference is to reuse the OR that is currently armed
          * on HW, if any, in order to prevent unnecessary switching.
          */
         list_for_each_entry(ior, &outp->disp->ior, head) {
-                if (!ior->asy.outp && ior->arm.outp == outp)
+                if (!ior->identity && !ior->asy.outp && ior->arm.outp == outp)
                         return nvkm_outp_acquire_ior(outp, user, ior);
         }
 
         /* Failing that, a completely unused OR is the next best thing. */
         list_for_each_entry(ior, &outp->disp->ior, head) {
-                if (!ior->asy.outp && ior->type == type && !ior->arm.outp &&
+                if (!ior->identity &&
+                    !ior->asy.outp && ior->type == type && !ior->arm.outp &&
                     (ior->func->route.set || ior->id == __ffs(outp->info.or)))
                         return nvkm_outp_acquire_ior(outp, user, ior);
         }
@@ -146,7 +157,7 @@ nvkm_outp_acquire(struct nvkm_outp *outp, u8 user)
          * but will be released during the next modeset.
          */
         list_for_each_entry(ior, &outp->disp->ior, head) {
-                if (!ior->asy.outp && ior->type == type &&
+                if (!ior->identity && !ior->asy.outp && ior->type == type &&
                     (ior->func->route.set || ior->id == __ffs(outp->info.or)))
                         return nvkm_outp_acquire_ior(outp, user, ior);
         }
@@ -245,7 +256,6 @@ nvkm_outp_ctor(const struct nvkm_outp_func *func, struct nvkm_disp *disp,
         outp->index = index;
         outp->info = *dcbE;
         outp->i2c = nvkm_i2c_bus_find(i2c, dcbE->i2c_index);
-        outp->or = ffs(outp->info.or) - 1;
 
         OUTP_DBG(outp, "type %02x loc %d or %d link %d con %x "
                        "edid %x bus %d head %x",
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.h b/drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.h
index ea84d7d5741a..6c8aa5cfed9d 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.h
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.h
@@ -13,10 +13,10 @@ struct nvkm_outp {
         struct dcb_output info;
 
         struct nvkm_i2c_bus *i2c;
-        int or;
 
         struct list_head head;
         struct nvkm_conn *conn;
+        bool identity;
 
         /* Assembly state. */
 #define NVKM_OUTP_PRIV 1
@@ -41,7 +41,8 @@ struct nvkm_outp_func {
         void (*init)(struct nvkm_outp *);
         void (*fini)(struct nvkm_outp *);
         int (*acquire)(struct nvkm_outp *);
-        void (*release)(struct nvkm_outp *, struct nvkm_ior *);
+        void (*release)(struct nvkm_outp *);
+        void (*disable)(struct nvkm_outp *, struct nvkm_ior *);
 };
 
 #define OUTP_MSG(o,l,f,a...) do {                                              \
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/gm200.c b/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/gm200.c
index b80618e35491..17235e940ca9 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/gm200.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/gm200.c
@@ -86,10 +86,8 @@ pmu_load(struct nv50_devinit *init, u8 type, bool post,
         struct nvkm_bios *bios = subdev->device->bios;
         struct nvbios_pmuR pmu;
 
-        if (!nvbios_pmuRm(bios, type, &pmu)) {
-                nvkm_error(subdev, "VBIOS PMU fuc %02x not found\n", type);
+        if (!nvbios_pmuRm(bios, type, &pmu))
                 return -EINVAL;
-        }
 
         if (!post)
                 return 0;
@@ -124,29 +122,30 @@ gm200_devinit_post(struct nvkm_devinit *base, bool post)
                 return -EINVAL;
         }
 
+        /* Upload DEVINIT application from VBIOS onto PMU. */
         ret = pmu_load(init, 0x04, post, &exec, &args);
-        if (ret)
+        if (ret) {
+                nvkm_error(subdev, "VBIOS PMU/DEVINIT not found\n");
                 return ret;
+        }
 
-        /* upload first chunk of init data */
+        /* Upload tables required by opcodes in boot scripts. */
         if (post) {
-                // devinit tables
                 u32 pmu = pmu_args(init, args + 0x08, 0x08);
                 u32 img = nvbios_rd16(bios, bit_I.offset + 0x14);
                 u32 len = nvbios_rd16(bios, bit_I.offset + 0x16);
                 pmu_data(init, pmu, img, len);
         }
 
-        /* upload second chunk of init data */
+        /* Upload boot scripts. */
         if (post) {
-                // devinit boot scripts
                 u32 pmu = pmu_args(init, args + 0x08, 0x10);
                 u32 img = nvbios_rd16(bios, bit_I.offset + 0x18);
                 u32 len = nvbios_rd16(bios, bit_I.offset + 0x1a);
                 pmu_data(init, pmu, img, len);
         }
 
-        /* execute init tables */
+        /* Execute DEVINIT. */
         if (post) {
                 nvkm_wr32(device, 0x10a040, 0x00005000);
                 pmu_exec(init, exec);
@@ -157,8 +156,11 @@ gm200_devinit_post(struct nvkm_devinit *base, bool post)
                         return -ETIMEDOUT;
         }
 
-        /* load and execute some other ucode image (bios therm?) */
-        return pmu_load(init, 0x01, post, NULL, NULL);
+        /* Optional: Execute PRE_OS application on PMU, which should at
+         * least take care of fans until a full PMU has been loaded.
+         */
+        pmu_load(init, 0x01, post, NULL, NULL);
+        return 0;
 }
 
 static const struct nvkm_devinit_func
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmm.c b/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmm.c
index de269eb482dd..7459def78d50 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmm.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmm.c
@@ -1423,7 +1423,7 @@ nvkm_vmm_get(struct nvkm_vmm *vmm, u8 page, u64 size, struct nvkm_vma **pvma)
 void
 nvkm_vmm_part(struct nvkm_vmm *vmm, struct nvkm_memory *inst)
 {
-        if (vmm->func->part && inst) {
+        if (inst && vmm->func->part) {
                 mutex_lock(&vmm->mutex);
                 vmm->func->part(vmm, inst);
                 mutex_unlock(&vmm->mutex);
diff --git a/drivers/gpu/drm/pl111/pl111_vexpress.c b/drivers/gpu/drm/pl111/pl111_vexpress.c
index a534b225e31b..5fa0441bb6df 100644
--- a/drivers/gpu/drm/pl111/pl111_vexpress.c
+++ b/drivers/gpu/drm/pl111/pl111_vexpress.c
@@ -111,7 +111,8 @@ static int vexpress_muxfpga_probe(struct platform_device *pdev)
 }
 
 static const struct of_device_id vexpress_muxfpga_match[] = {
-        { .compatible = "arm,vexpress-muxfpga", }
+        { .compatible = "arm,vexpress-muxfpga", },
+        {}
 };
 
 static struct platform_driver vexpress_muxfpga_driver = {
diff --git a/drivers/gpu/drm/sun4i/sun4i_drv.c b/drivers/gpu/drm/sun4i/sun4i_drv.c
index dd19d674055c..8b0cd08034e0 100644
--- a/drivers/gpu/drm/sun4i/sun4i_drv.c
+++ b/drivers/gpu/drm/sun4i/sun4i_drv.c
@@ -418,7 +418,6 @@ static const struct of_device_id sun4i_drv_of_table[] = {
         { .compatible = "allwinner,sun8i-a33-display-engine" },
         { .compatible = "allwinner,sun8i-a83t-display-engine" },
         { .compatible = "allwinner,sun8i-h3-display-engine" },
-        { .compatible = "allwinner,sun8i-r40-display-engine" },
         { .compatible = "allwinner,sun8i-v3s-display-engine" },
         { .compatible = "allwinner,sun9i-a80-display-engine" },
         { }
diff --git a/drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c b/drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c
index 82502b351aec..a564b5dfe082 100644
--- a/drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c
+++ b/drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c
@@ -398,7 +398,6 @@ static struct regmap_config sun8i_hdmi_phy_regmap_config = {
 
 static const struct sun8i_hdmi_phy_variant sun50i_a64_hdmi_phy = {
         .has_phy_clk = true,
-        .has_second_pll = true,
         .phy_init = &sun8i_hdmi_phy_init_h3,
         .phy_disable = &sun8i_hdmi_phy_disable_h3,
         .phy_config = &sun8i_hdmi_phy_config_h3,
diff --git a/drivers/gpu/drm/sun4i/sun8i_mixer.c b/drivers/gpu/drm/sun4i/sun8i_mixer.c
index fc3713608f78..cb65b0ed53fd 100644
--- a/drivers/gpu/drm/sun4i/sun8i_mixer.c
+++ b/drivers/gpu/drm/sun4i/sun8i_mixer.c
@@ -545,22 +545,6 @@ static const struct sun8i_mixer_cfg sun8i_h3_mixer0_cfg = {
         .vi_num         = 1,
 };
 
-static const struct sun8i_mixer_cfg sun8i_r40_mixer0_cfg = {
-        .ccsc           = 0,
-        .mod_rate       = 297000000,
-        .scaler_mask    = 0xf,
-        .ui_num         = 3,
-        .vi_num         = 1,
-};
-
-static const struct sun8i_mixer_cfg sun8i_r40_mixer1_cfg = {
-        .ccsc           = 1,
-        .mod_rate       = 297000000,
-        .scaler_mask    = 0x3,
-        .ui_num         = 1,
-        .vi_num         = 1,
-};
-
 static const struct sun8i_mixer_cfg sun8i_v3s_mixer_cfg = {
         .vi_num = 2,
         .ui_num = 1,
@@ -583,14 +567,6 @@ static const struct of_device_id sun8i_mixer_of_table[] = {
                 .data = &sun8i_h3_mixer0_cfg,
         },
         {
-                .compatible = "allwinner,sun8i-r40-de2-mixer-0",
-                .data = &sun8i_r40_mixer0_cfg,
-        },
-        {
-                .compatible = "allwinner,sun8i-r40-de2-mixer-1",
-                .data = &sun8i_r40_mixer1_cfg,
-        },
-        {
                 .compatible = "allwinner,sun8i-v3s-de2-mixer",
                 .data = &sun8i_v3s_mixer_cfg,
         },
diff --git a/drivers/gpu/drm/sun4i/sun8i_tcon_top.c b/drivers/gpu/drm/sun4i/sun8i_tcon_top.c
index 55fe398d8290..d5240b777a8f 100644
--- a/drivers/gpu/drm/sun4i/sun8i_tcon_top.c
+++ b/drivers/gpu/drm/sun4i/sun8i_tcon_top.c
@@ -253,7 +253,6 @@ static int sun8i_tcon_top_remove(struct platform_device *pdev)
 
 /* sun4i_drv uses this list to check if a device node is a TCON TOP */
 const struct of_device_id sun8i_tcon_top_of_table[] = {
-        { .compatible = "allwinner,sun8i-r40-tcon-top" },
         { /* sentinel */ }
 };
 MODULE_DEVICE_TABLE(of, sun8i_tcon_top_of_table);
diff --git a/drivers/gpu/drm/udl/udl_fb.c b/drivers/gpu/drm/udl/udl_fb.c
index dbb62f6eb48a..dd9ffded223b 100644
--- a/drivers/gpu/drm/udl/udl_fb.c
+++ b/drivers/gpu/drm/udl/udl_fb.c
@@ -432,9 +432,11 @@ static void udl_fbdev_destroy(struct drm_device *dev,
 {
         drm_fb_helper_unregister_fbi(&ufbdev->helper);
         drm_fb_helper_fini(&ufbdev->helper);
-        drm_framebuffer_unregister_private(&ufbdev->ufb.base);
-        drm_framebuffer_cleanup(&ufbdev->ufb.base);
-        drm_gem_object_put_unlocked(&ufbdev->ufb.obj->base);
+        if (ufbdev->ufb.obj) {
+                drm_framebuffer_unregister_private(&ufbdev->ufb.base);
+                drm_framebuffer_cleanup(&ufbdev->ufb.base);
+                drm_gem_object_put_unlocked(&ufbdev->ufb.obj->base);
+        }
 }
 
 int udl_fbdev_init(struct drm_device *dev)
diff --git a/drivers/gpu/drm/vc4/vc4_plane.c b/drivers/gpu/drm/vc4/vc4_plane.c
index cfb50fedfa2b..a3275fa66b7b 100644
--- a/drivers/gpu/drm/vc4/vc4_plane.c
+++ b/drivers/gpu/drm/vc4/vc4_plane.c
@@ -297,6 +297,9 @@ static int vc4_plane_setup_clipping_and_scaling(struct drm_plane_state *state)
         vc4_state->y_scaling[0] = vc4_get_scaling_mode(vc4_state->src_h[0],
                                                        vc4_state->crtc_h);
 
+        vc4_state->is_unity = (vc4_state->x_scaling[0] == VC4_SCALING_NONE &&
+                               vc4_state->y_scaling[0] == VC4_SCALING_NONE);
+
         if (num_planes > 1) {
                 vc4_state->is_yuv = true;
 
@@ -312,24 +315,17 @@ static int vc4_plane_setup_clipping_and_scaling(struct drm_plane_state *state)
                         vc4_get_scaling_mode(vc4_state->src_h[1],
                                              vc4_state->crtc_h);
 
-                /* YUV conversion requires that scaling be enabled,
-                 * even on a plane that's otherwise 1:1.  Choose TPZ
-                 * for simplicity.
+                /* YUV conversion requires that horizontal scaling be enabled,
+                 * even on a plane that's otherwise 1:1. Looks like only PPF
+                 * works in that case, so let's pick that one.
                  */
-                if (vc4_state->x_scaling[0] == VC4_SCALING_NONE)
-                        vc4_state->x_scaling[0] = VC4_SCALING_TPZ;
-                if (vc4_state->y_scaling[0] == VC4_SCALING_NONE)
-                        vc4_state->y_scaling[0] = VC4_SCALING_TPZ;
+                if (vc4_state->is_unity)
+                        vc4_state->x_scaling[0] = VC4_SCALING_PPF;
         } else {
                 vc4_state->x_scaling[1] = VC4_SCALING_NONE;
                 vc4_state->y_scaling[1] = VC4_SCALING_NONE;
         }
 
-        vc4_state->is_unity = (vc4_state->x_scaling[0] == VC4_SCALING_NONE &&
-                               vc4_state->y_scaling[0] == VC4_SCALING_NONE &&
-                               vc4_state->x_scaling[1] == VC4_SCALING_NONE &&
-                               vc4_state->y_scaling[1] == VC4_SCALING_NONE);
-
         /* No configuring scaling on the cursor plane, since it gets
            non-vblank-synced updates, and scaling requires requires
            LBM changes which have to be vblank-synced.
@@ -672,7 +668,10 @@ static int vc4_plane_mode_set(struct drm_plane *plane,
                 vc4_dlist_write(vc4_state, SCALER_CSC2_ITR_R_601_5);
         }
 
-        if (!vc4_state->is_unity) {
+        if (vc4_state->x_scaling[0] != VC4_SCALING_NONE ||
+            vc4_state->x_scaling[1] != VC4_SCALING_NONE ||
+            vc4_state->y_scaling[0] != VC4_SCALING_NONE ||
+            vc4_state->y_scaling[1] != VC4_SCALING_NONE) {
                 /* LBM Base Address. */
                 if (vc4_state->y_scaling[0] != VC4_SCALING_NONE ||
                     vc4_state->y_scaling[1] != VC4_SCALING_NONE) {
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
index 1f134570b759..f0ab6b2313bb 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
@@ -3729,7 +3729,7 @@ int vmw_validate_single_buffer(struct vmw_private *dev_priv,
 {
         struct vmw_buffer_object *vbo =
                 container_of(bo, struct vmw_buffer_object, base);
-        struct ttm_operation_ctx ctx = { interruptible, true };
+        struct ttm_operation_ctx ctx = { interruptible, false };
         int ret;
 
         if (vbo->pin_count > 0)
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
index 23beff5d8e3c..6a712a8d59e9 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
@@ -1512,21 +1512,19 @@ static int vmw_kms_check_display_memory(struct drm_device *dev,
                                         struct drm_rect *rects)
 {
         struct vmw_private *dev_priv = vmw_priv(dev);
-        struct drm_mode_config *mode_config = &dev->mode_config;
         struct drm_rect bounding_box = {0};
         u64 total_pixels = 0, pixel_mem, bb_mem;
         int i;
 
         for (i = 0; i < num_rects; i++) {
                 /*
-                 * Currently this check is limiting the topology within max
-                 * texture/screentarget size. This should change in future when
-                 * user-space support multiple fb with topology.
+                 * For STDU only individual screen (screen target) is limited by
+                 * SCREENTARGET_MAX_WIDTH/HEIGHT registers.
                  */
-                if (rects[i].x1 < 0 ||  rects[i].y1 < 0 ||
-                    rects[i].x2 > mode_config->max_width ||
-                    rects[i].y2 > mode_config->max_height) {
-                        DRM_ERROR("Invalid GUI layout.\n");
+                if (dev_priv->active_display_unit == vmw_du_screen_target &&
+                    (drm_rect_width(&rects[i]) > dev_priv->stdu_max_width ||
+                     drm_rect_height(&rects[i]) > dev_priv->stdu_max_height)) {
+                        DRM_ERROR("Screen size not supported.\n");
                         return -EINVAL;
                 }
 
@@ -1615,7 +1613,7 @@ static int vmw_kms_check_topology(struct drm_device *dev,
                 struct drm_connector_state *conn_state;
                 struct vmw_connector_state *vmw_conn_state;
 
-                if (!new_crtc_state->enable && old_crtc_state->enable) {
+                if (!new_crtc_state->enable) {
                         rects[i].x1 = 0;
                         rects[i].y1 = 0;
                         rects[i].x2 = 0;
@@ -2216,12 +2214,16 @@ int vmw_du_connector_fill_modes(struct drm_connector *connector,
         if (dev_priv->assume_16bpp)
                 assumed_bpp = 2;
 
+        max_width  = min(max_width,  dev_priv->texture_max_width);
+        max_height = min(max_height, dev_priv->texture_max_height);
+
+        /*
+         * For STDU extra limit for a mode on SVGA_REG_SCREENTARGET_MAX_WIDTH/
+         * HEIGHT registers.
+         */
         if (dev_priv->active_display_unit == vmw_du_screen_target) {
                 max_width  = min(max_width,  dev_priv->stdu_max_width);
-                max_width  = min(max_width,  dev_priv->texture_max_width);
-
                 max_height = min(max_height, dev_priv->stdu_max_height);
-                max_height = min(max_height, dev_priv->texture_max_height);
         }
 
         /* Add preferred mode */
@@ -2376,6 +2378,7 @@ int vmw_kms_update_layout_ioctl(struct drm_device *dev, void *data,
                                 struct drm_file *file_priv)
 {
         struct vmw_private *dev_priv = vmw_priv(dev);
+        struct drm_mode_config *mode_config = &dev->mode_config;
         struct drm_vmw_update_layout_arg *arg =
                 (struct drm_vmw_update_layout_arg *)data;
         void __user *user_rects;
@@ -2421,6 +2424,21 @@ int vmw_kms_update_layout_ioctl(struct drm_device *dev, void *data,
                 drm_rects[i].y1 = curr_rect.y;
                 drm_rects[i].x2 = curr_rect.x + curr_rect.w;
                 drm_rects[i].y2 = curr_rect.y + curr_rect.h;
+
+                /*
+                 * Currently this check is limiting the topology within
+                 * mode_config->max (which actually is max texture size
+                 * supported by virtual device). This limit is here to address
+                 * window managers that create a big framebuffer for whole
+                 * topology.
+                 */
+                if (drm_rects[i].x1 < 0 ||  drm_rects[i].y1 < 0 ||
+                    drm_rects[i].x2 > mode_config->max_width ||
+                    drm_rects[i].y2 > mode_config->max_height) {
+                        DRM_ERROR("Invalid GUI layout.\n");
+                        ret = -EINVAL;
+                        goto out_free;
+                }
         }
 
         ret = vmw_kms_check_display_memory(dev, arg->num_outputs, drm_rects);
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c b/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c
index 93f6b96ca7bb..f30e839f7bfd 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c
@@ -1600,31 +1600,6 @@ int vmw_kms_stdu_init_display(struct vmw_private *dev_priv)
 
         dev_priv->active_display_unit = vmw_du_screen_target;
 
-        if (dev_priv->capabilities & SVGA_CAP_3D) {
-                /*
-                 * For 3D VMs, display (scanout) buffer size is the smaller of
-                 * max texture and max STDU
-                 */
-                uint32_t max_width, max_height;
-
-                max_width = min(dev_priv->texture_max_width,
-                                dev_priv->stdu_max_width);
-                max_height = min(dev_priv->texture_max_height,
-                                 dev_priv->stdu_max_height);
-
-                dev->mode_config.max_width = max_width;
-                dev->mode_config.max_height = max_height;
-        } else {
-                /*
-                 * Given various display aspect ratios, there's no way to
-                 * estimate these using prim_bb_mem.  So just set these to
-                 * something arbitrarily large and we will reject any layout
-                 * that doesn't fit prim_bb_mem later
-                 */
-                dev->mode_config.max_width = 8192;
-                dev->mode_config.max_height = 8192;
-        }
-
         vmw_kms_create_implicit_placement_property(dev_priv, false);
 
         for (i = 0; i < VMWGFX_NUM_DISPLAY_UNITS; ++i) {
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
index e125233e074b..80a01cd4c051 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
@@ -1404,22 +1404,17 @@ int vmw_surface_gb_priv_define(struct drm_device *dev,
         *srf_out = NULL;
 
         if (for_scanout) {
-                uint32_t max_width, max_height;
-
                 if (!svga3dsurface_is_screen_target_format(format)) {
                         DRM_ERROR("Invalid Screen Target surface format.");
                         return -EINVAL;
                 }
 
-                max_width = min(dev_priv->texture_max_width,
-                                dev_priv->stdu_max_width);
-                max_height = min(dev_priv->texture_max_height,
-                                 dev_priv->stdu_max_height);
-
-                if (size.width > max_width || size.height > max_height) {
+                if (size.width > dev_priv->texture_max_width ||
+                    size.height > dev_priv->texture_max_height) {
                         DRM_ERROR("%ux%u\n, exceeds max surface size %ux%u",
                                   size.width, size.height,
-                                  max_width, max_height);
+                                  dev_priv->texture_max_width,
+                                  dev_priv->texture_max_height);
                         return -EINVAL;
                 }
         } else {
@@ -1495,8 +1490,17 @@ int vmw_surface_gb_priv_define(struct drm_device *dev,
         if (srf->flags & SVGA3D_SURFACE_BIND_STREAM_OUTPUT)
                 srf->res.backup_size += sizeof(SVGA3dDXSOState);
 
+        /*
+         * Don't set SVGA3D_SURFACE_SCREENTARGET flag for a scanout surface with
+         * size greater than STDU max width/height. This is really a workaround
+         * to support creation of big framebuffer requested by some user-space
+         * for whole topology. That big framebuffer won't really be used for
+         * binding with screen target as during prepare_fb a separate surface is
+         * created so it's safe to ignore SVGA3D_SURFACE_SCREENTARGET flag.
+         */
         if (dev_priv->active_display_unit == vmw_du_screen_target &&
-            for_scanout)
+            for_scanout && size.width <= dev_priv->stdu_max_width &&
+            size.height <= dev_priv->stdu_max_height)
                 srf->flags |= SVGA3D_SURFACE_SCREENTARGET;
 
         /*
diff --git a/drivers/gpu/vga/vga_switcheroo.c b/drivers/gpu/vga/vga_switcheroo.c
index a96bf46bc483..cf2a18571d48 100644
--- a/drivers/gpu/vga/vga_switcheroo.c
+++ b/drivers/gpu/vga/vga_switcheroo.c
@@ -215,6 +215,8 @@ static void vga_switcheroo_enable(void)
                         return;
 
                 client->id = ret | ID_BIT_AUDIO;
+                if (client->ops->gpu_bound)
+                        client->ops->gpu_bound(client->pdev, ret);
         }
 
         vga_switcheroo_debugfs_init(&vgasr_priv);
diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c
index 25b7bd56ae11..1cb41992aaa1 100644
--- a/drivers/hid/hid-apple.c
+++ b/drivers/hid/hid-apple.c
@@ -335,7 +335,8 @@ static int apple_input_mapping(struct hid_device *hdev, struct hid_input *hi,
                 struct hid_field *field, struct hid_usage *usage,
                 unsigned long **bit, int *max)
 {
-        if (usage->hid == (HID_UP_CUSTOM | 0x0003)) {
+        if (usage->hid == (HID_UP_CUSTOM | 0x0003) ||
+                        usage->hid == (HID_UP_MSVENDOR | 0x0003)) {
                 /* The fn key on Apple USB keyboards */
                 set_bit(EV_REP, hi->input->evbit);
                 hid_map_usage_clear(hi, usage, bit, max, EV_KEY, KEY_FN);
@@ -472,6 +473,12 @@ static const struct hid_device_id apple_devices[] = {
                 .driver_data = APPLE_NUMLOCK_EMULATION | APPLE_HAS_FN },
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_ANSI),
                 .driver_data = APPLE_HAS_FN },
+        { HID_BLUETOOTH_DEVICE(BT_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_ANSI),
+                .driver_data = APPLE_HAS_FN },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_NUMPAD_ANSI),
+                .driver_data = APPLE_HAS_FN },
+        { HID_BLUETOOTH_DEVICE(BT_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_NUMPAD_ANSI),
+                .driver_data = APPLE_HAS_FN },
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING_ANSI),
                 .driver_data = APPLE_HAS_FN },
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING_ISO),
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 3da354af7a0a..44564f61e9cc 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1000,7 +1000,7 @@ int hid_open_report(struct hid_device *device)
         parser = vzalloc(sizeof(struct hid_parser));
         if (!parser) {
                 ret = -ENOMEM;
-                goto err;
+                goto alloc_err;
         }
 
         parser->device = device;
@@ -1039,6 +1039,7 @@ int hid_open_report(struct hid_device *device)
                                 hid_err(device, "unbalanced delimiter at end of report description\n");
                                 goto err;
                         }
+                        kfree(parser->collection_stack);
                         vfree(parser);
                         device->status |= HID_STAT_PARSED;
                         return 0;
@@ -1047,6 +1048,8 @@ int hid_open_report(struct hid_device *device)
 
         hid_err(device, "item fetching failed at offset %d\n", (int)(end - start));
 err:
+        kfree(parser->collection_stack);
+alloc_err:
         vfree(parser);
         hid_close_report(device);
         return ret;
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 79bdf0c7e351..5146ee029db4 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -88,6 +88,7 @@
 #define USB_DEVICE_ID_ANTON_TOUCH_PAD   0x3101
 
 #define USB_VENDOR_ID_APPLE             0x05ac
+#define BT_VENDOR_ID_APPLE              0x004c
 #define USB_DEVICE_ID_APPLE_MIGHTYMOUSE 0x0304
 #define USB_DEVICE_ID_APPLE_MAGICMOUSE  0x030d
 #define USB_DEVICE_ID_APPLE_MAGICTRACKPAD       0x030e
@@ -157,6 +158,7 @@
 #define USB_DEVICE_ID_APPLE_ALU_WIRELESS_2011_ISO   0x0256
 #define USB_DEVICE_ID_APPLE_ALU_WIRELESS_2011_JIS   0x0257
 #define USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_ANSI   0x0267
+#define USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_NUMPAD_ANSI   0x026c
 #define USB_DEVICE_ID_APPLE_WELLSPRING8_ANSI    0x0290
 #define USB_DEVICE_ID_APPLE_WELLSPRING8_ISO     0x0291
 #define USB_DEVICE_ID_APPLE_WELLSPRING8_JIS     0x0292
@@ -528,9 +530,6 @@
 #define I2C_VENDOR_ID_HANTICK           0x0911
 #define I2C_PRODUCT_ID_HANTICK_5288     0x5288
 
-#define I2C_VENDOR_ID_RAYD              0x2386
-#define I2C_PRODUCT_ID_RAYD_3118        0x3118
-
 #define USB_VENDOR_ID_HANWANG           0x0b57
 #define USB_DEVICE_ID_HANWANG_TABLET_FIRST      0x5000
 #define USB_DEVICE_ID_HANWANG_TABLET_LAST       0x8fff
@@ -950,6 +949,7 @@
 #define USB_DEVICE_ID_SAITEK_RUMBLEPAD  0xff17
 #define USB_DEVICE_ID_SAITEK_PS1000     0x0621
 #define USB_DEVICE_ID_SAITEK_RAT7_OLD   0x0ccb
+#define USB_DEVICE_ID_SAITEK_RAT7_CONTAGION     0x0ccd
 #define USB_DEVICE_ID_SAITEK_RAT7       0x0cd7
 #define USB_DEVICE_ID_SAITEK_RAT9       0x0cfa
 #define USB_DEVICE_ID_SAITEK_MMO7       0x0cd0
diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
index 4e94ea3e280a..a481eaf39e88 100644
--- a/drivers/hid/hid-input.c
+++ b/drivers/hid/hid-input.c
@@ -1582,6 +1582,7 @@ static struct hid_input *hidinput_allocate(struct hid_device *hid,
         input_dev->dev.parent = &hid->dev;
 
         hidinput->input = input_dev;
+        hidinput->application = application;
         list_add_tail(&hidinput->list, &hid->inputs);
 
         INIT_LIST_HEAD(&hidinput->reports);
@@ -1677,8 +1678,7 @@ static struct hid_input *hidinput_match_application(struct hid_report *report)
         struct hid_input *hidinput;
 
         list_for_each_entry(hidinput, &hid->inputs, list) {
-                if (hidinput->report &&
-                    hidinput->report->application == report->application)
+                if (hidinput->application == report->application)
                         return hidinput;
         }
 
@@ -1815,6 +1815,7 @@ void hidinput_disconnect(struct hid_device *hid)
                         input_unregister_device(hidinput->input);
                 else
                         input_free_device(hidinput->input);
+                kfree(hidinput->name);
                 kfree(hidinput);
         }
 
diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
index 40fbb7c52723..da954f3f4da7 100644
--- a/drivers/hid/hid-multitouch.c
+++ b/drivers/hid/hid-multitouch.c
@@ -1375,7 +1375,8 @@ static bool mt_need_to_apply_feature(struct hid_device *hdev,
                                      struct hid_usage *usage,
                                      enum latency_mode latency,
                                      bool surface_switch,
-                                     bool button_switch)
+                                     bool button_switch,
+                                     bool *inputmode_found)
 {
         struct mt_device *td = hid_get_drvdata(hdev);
         struct mt_class *cls = &td->mtclass;
@@ -1387,6 +1388,14 @@ static bool mt_need_to_apply_feature(struct hid_device *hdev,
 
         switch (usage->hid) {
         case HID_DG_INPUTMODE:
+                /*
+                 * Some elan panels wrongly declare 2 input mode features,
+                 * and silently ignore when we set the value in the second
+                 * field. Skip the second feature and hope for the best.
+                 */
+                if (*inputmode_found)
+                        return false;
+
                 if (cls->quirks & MT_QUIRK_FORCE_GET_FEATURE) {
                         report_len = hid_report_len(report);
                         buf = hid_alloc_report_buf(report, GFP_KERNEL);
@@ -1402,6 +1411,7 @@ static bool mt_need_to_apply_feature(struct hid_device *hdev,
                 }
 
                 field->value[index] = td->inputmode_value;
+                *inputmode_found = true;
                 return true;
 
         case HID_DG_CONTACTMAX:
@@ -1439,6 +1449,7 @@ static void mt_set_modes(struct hid_device *hdev, enum latency_mode latency,
         struct hid_usage *usage;
         int i, j;
         bool update_report;
+        bool inputmode_found = false;
 
         rep_enum = &hdev->report_enum[HID_FEATURE_REPORT];
         list_for_each_entry(rep, &rep_enum->report_list, list) {
@@ -1457,7 +1468,8 @@ static void mt_set_modes(struct hid_device *hdev, enum latency_mode latency,
                                                              usage,
                                                              latency,
                                                              surface_switch,
-                                                             button_switch))
+                                                             button_switch,
+                                                             &inputmode_found))
                                         update_report = true;
                         }
                 }
@@ -1685,6 +1697,9 @@ static int mt_probe(struct hid_device *hdev, const struct hid_device_id *id)
          */
         hdev->quirks |= HID_QUIRK_INPUT_PER_APP;
 
+        if (id->group != HID_GROUP_MULTITOUCH_WIN_8)
+                hdev->quirks |= HID_QUIRK_MULTI_INPUT;
+
         timer_setup(&td->release_timer, mt_expired_timeout, 0);
 
         ret = hid_parse(hdev);
diff --git a/drivers/hid/hid-saitek.c b/drivers/hid/hid-saitek.c
index 39e642686ff0..683861f324e3 100644
--- a/drivers/hid/hid-saitek.c
+++ b/drivers/hid/hid-saitek.c
@@ -183,6 +183,8 @@ static const struct hid_device_id saitek_devices[] = {
                 .driver_data = SAITEK_RELEASE_MODE_RAT7 },
         { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_RAT7),
                 .driver_data = SAITEK_RELEASE_MODE_RAT7 },
+        { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_RAT7_CONTAGION),
+                .driver_data = SAITEK_RELEASE_MODE_RAT7 },
         { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_RAT9),
                 .driver_data = SAITEK_RELEASE_MODE_RAT7 },
         { HID_USB_DEVICE(USB_VENDOR_ID_MADCATZ, USB_DEVICE_ID_MADCATZ_RAT9),
diff --git a/drivers/hid/hid-sensor-hub.c b/drivers/hid/hid-sensor-hub.c
index 50af72baa5ca..2b63487057c2 100644
--- a/drivers/hid/hid-sensor-hub.c
+++ b/drivers/hid/hid-sensor-hub.c
@@ -579,6 +579,28 @@ void sensor_hub_device_close(struct hid_sensor_hub_device *hsdev)
 }
 EXPORT_SYMBOL_GPL(sensor_hub_device_close);
 
+static __u8 *sensor_hub_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+                unsigned int *rsize)
+{
+        /*
+         * Checks if the report descriptor of Thinkpad Helix 2 has a logical
+         * minimum for magnetic flux axis greater than the maximum.
+         */
+        if (hdev->product == USB_DEVICE_ID_TEXAS_INSTRUMENTS_LENOVO_YOGA &&
+                *rsize == 2558 && rdesc[913] == 0x17 && rdesc[914] == 0x40 &&
+                rdesc[915] == 0x81 && rdesc[916] == 0x08 &&
+                rdesc[917] == 0x00 && rdesc[918] == 0x27 &&
+                rdesc[921] == 0x07 && rdesc[922] == 0x00) {
+                /* Sets negative logical minimum for mag x, y and z */
+                rdesc[914] = rdesc[935] = rdesc[956] = 0xc0;
+                rdesc[915] = rdesc[936] = rdesc[957] = 0x7e;
+                rdesc[916] = rdesc[937] = rdesc[958] = 0xf7;
+                rdesc[917] = rdesc[938] = rdesc[959] = 0xff;
+        }
+
+        return rdesc;
+}
+
 static int sensor_hub_probe(struct hid_device *hdev,
                                 const struct hid_device_id *id)
 {
@@ -743,6 +765,7 @@ static struct hid_driver sensor_hub_driver = {
         .probe = sensor_hub_probe,
         .remove = sensor_hub_remove,
         .raw_event = sensor_hub_raw_event,
+        .report_fixup = sensor_hub_report_fixup,
 #ifdef CONFIG_PM
         .suspend = sensor_hub_suspend,
         .resume = sensor_hub_resume,
diff --git a/drivers/hid/i2c-hid/i2c-hid.c b/drivers/hid/i2c-hid/i2c-hid.c
index 2ce194a84868..f3076659361a 100644
--- a/drivers/hid/i2c-hid/i2c-hid.c
+++ b/drivers/hid/i2c-hid/i2c-hid.c
@@ -170,8 +170,6 @@ static const struct i2c_hid_quirks {
                 I2C_HID_QUIRK_SET_PWR_WAKEUP_DEV },
         { I2C_VENDOR_ID_HANTICK, I2C_PRODUCT_ID_HANTICK_5288,
                 I2C_HID_QUIRK_NO_IRQ_AFTER_RESET },
-        { I2C_VENDOR_ID_RAYD, I2C_PRODUCT_ID_RAYD_3118,
-                I2C_HID_QUIRK_RESEND_REPORT_DESCR },
         { USB_VENDOR_ID_SIS_TOUCH, USB_DEVICE_ID_SIS10FB_TOUCH,
                 I2C_HID_QUIRK_RESEND_REPORT_DESCR },
         { 0, 0 }
@@ -1235,11 +1233,16 @@ static int i2c_hid_resume(struct device *dev)
         pm_runtime_enable(dev);
 
         enable_irq(client->irq);
-        ret = i2c_hid_hwreset(client);
+
+        /* Instead of resetting device, simply powers the device on. This
+         * solves "incomplete reports" on Raydium devices 2386:3118 and
+         * 2386:4B33
+         */
+        ret = i2c_hid_set_power(client, I2C_HID_PWR_ON);
         if (ret)
                 return ret;
 
-        /* RAYDIUM device (2386:3118) need to re-send report descr cmd
+        /* Some devices need to re-send report descr cmd
          * after resume, after this it will be back normal.
          * otherwise it issues too many incomplete reports.
          */
diff --git a/drivers/hid/intel-ish-hid/ipc/hw-ish.h b/drivers/hid/intel-ish-hid/ipc/hw-ish.h
index 97869b7410eb..da133716bed0 100644
--- a/drivers/hid/intel-ish-hid/ipc/hw-ish.h
+++ b/drivers/hid/intel-ish-hid/ipc/hw-ish.h
@@ -29,6 +29,7 @@
 #define CNL_Ax_DEVICE_ID        0x9DFC
 #define GLK_Ax_DEVICE_ID        0x31A2
 #define CNL_H_DEVICE_ID         0xA37C
+#define SPT_H_DEVICE_ID         0xA135
 
 #define REVISION_ID_CHT_A0      0x6
 #define REVISION_ID_CHT_Ax_SI   0x0
diff --git a/drivers/hid/intel-ish-hid/ipc/pci-ish.c b/drivers/hid/intel-ish-hid/ipc/pci-ish.c
index 050f9872f5c0..a1125a5c7965 100644
--- a/drivers/hid/intel-ish-hid/ipc/pci-ish.c
+++ b/drivers/hid/intel-ish-hid/ipc/pci-ish.c
@@ -38,6 +38,7 @@ static const struct pci_device_id ish_pci_tbl[] = {
         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, CNL_Ax_DEVICE_ID)},
         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, GLK_Ax_DEVICE_ID)},
         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, CNL_H_DEVICE_ID)},
+        {PCI_DEVICE(PCI_VENDOR_ID_INTEL, SPT_H_DEVICE_ID)},
         {0, }
 };
 MODULE_DEVICE_TABLE(pci, ish_pci_tbl);
diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c
index b1b548a21f91..c71cc857b649 100644
--- a/drivers/hv/vmbus_drv.c
+++ b/drivers/hv/vmbus_drv.c
@@ -1291,6 +1291,9 @@ static ssize_t vmbus_chan_attr_show(struct kobject *kobj,
         if (!attribute->show)
                 return -EIO;
 
+        if (chan->state != CHANNEL_OPENED_STATE)
+                return -EINVAL;
+
         return attribute->show(chan, buf);
 }
 
diff --git a/drivers/hwmon/adt7475.c b/drivers/hwmon/adt7475.c
index 90837f7c7d0f..f4c7516eb989 100644
--- a/drivers/hwmon/adt7475.c
+++ b/drivers/hwmon/adt7475.c
@@ -302,14 +302,18 @@ static inline u16 volt2reg(int channel, long volt, u8 bypass_attn)
         return clamp_val(reg, 0, 1023) & (0xff << 2);
 }
 
-static u16 adt7475_read_word(struct i2c_client *client, int reg)
+static int adt7475_read_word(struct i2c_client *client, int reg)
 {
-        u16 val;
+        int val1, val2;
 
-        val = i2c_smbus_read_byte_data(client, reg);
-        val |= (i2c_smbus_read_byte_data(client, reg + 1) << 8);
+        val1 = i2c_smbus_read_byte_data(client, reg);
+        if (val1 < 0)
+                return val1;
+        val2 = i2c_smbus_read_byte_data(client, reg + 1);
+        if (val2 < 0)
+                return val2;
 
-        return val;
+        return val1 | (val2 << 8);
 }
 
 static void adt7475_write_word(struct i2c_client *client, int reg, u16 val)
@@ -962,13 +966,14 @@ static ssize_t show_pwmfreq(struct device *dev, struct device_attribute *attr,
 {
         struct adt7475_data *data = adt7475_update_device(dev);
         struct sensor_device_attribute_2 *sattr = to_sensor_dev_attr_2(attr);
-        int i = clamp_val(data->range[sattr->index] & 0xf, 0,
-                          ARRAY_SIZE(pwmfreq_table) - 1);
+        int idx;
 
         if (IS_ERR(data))
                 return PTR_ERR(data);
+        idx = clamp_val(data->range[sattr->index] & 0xf, 0,
+                        ARRAY_SIZE(pwmfreq_table) - 1);
 
-        return sprintf(buf, "%d\n", pwmfreq_table[i]);
+        return sprintf(buf, "%d\n", pwmfreq_table[idx]);
 }
 
 static ssize_t set_pwmfreq(struct device *dev, struct device_attribute *attr,
@@ -1004,6 +1009,10 @@ static ssize_t pwm_use_point2_pwm_at_crit_show(struct device *dev,
                                         char *buf)
 {
         struct adt7475_data *data = adt7475_update_device(dev);
+
+        if (IS_ERR(data))
+                return PTR_ERR(data);
+
         return sprintf(buf, "%d\n", !!(data->config4 & CONFIG4_MAXDUTY));
 }
 
diff --git a/drivers/hwmon/ina2xx.c b/drivers/hwmon/ina2xx.c
index e9e6aeabbf84..71d3445ba869 100644
--- a/drivers/hwmon/ina2xx.c
+++ b/drivers/hwmon/ina2xx.c
@@ -17,7 +17,7 @@
  * Bi-directional Current/Power Monitor with I2C Interface
  * Datasheet: http://www.ti.com/product/ina230
  *
- * Copyright (C) 2012 Lothar Felten <l-felten@ti.com>
+ * Copyright (C) 2012 Lothar Felten <lothar.felten@gmail.com>
  * Thanks to Jan Volkering
  *
  * This program is free software; you can redistribute it and/or modify
@@ -329,6 +329,15 @@ static int ina2xx_set_shunt(struct ina2xx_data *data, long val)
         return 0;
 }
 
+static ssize_t ina2xx_show_shunt(struct device *dev,
+                              struct device_attribute *da,
+                              char *buf)
+{
+        struct ina2xx_data *data = dev_get_drvdata(dev);
+
+        return snprintf(buf, PAGE_SIZE, "%li\n", data->rshunt);
+}
+
 static ssize_t ina2xx_store_shunt(struct device *dev,
                                   struct device_attribute *da,
                                   const char *buf, size_t count)
@@ -403,7 +412,7 @@ static SENSOR_DEVICE_ATTR(power1_input, S_IRUGO, ina2xx_show_value, NULL,
 
 /* shunt resistance */
 static SENSOR_DEVICE_ATTR(shunt_resistor, S_IRUGO | S_IWUSR,
-                          ina2xx_show_value, ina2xx_store_shunt,
+                          ina2xx_show_shunt, ina2xx_store_shunt,
                           INA2XX_CALIBRATION);
 
 /* update interval (ina226 only) */
diff --git a/drivers/hwmon/nct6775.c b/drivers/hwmon/nct6775.c
index c6bd61e4695a..78603b78cf41 100644
--- a/drivers/hwmon/nct6775.c
+++ b/drivers/hwmon/nct6775.c
@@ -63,6 +63,7 @@
 #include <linux/bitops.h>
 #include <linux/dmi.h>
 #include <linux/io.h>
+#include <linux/nospec.h>
 #include "lm75.h"
 
 #define USE_ALTERNATE
@@ -206,8 +207,6 @@ superio_exit(int ioreg)
 
 #define NUM_FAN         7
 
-#define TEMP_SOURCE_VIRTUAL     0x1f
-
 /* Common and NCT6775 specific data */
 
 /* Voltage min/max registers for nr=7..14 are in bank 5 */
@@ -298,8 +297,9 @@ static const u16 NCT6775_REG_PWM_READ[] = {
 
 static const u16 NCT6775_REG_FAN[] = { 0x630, 0x632, 0x634, 0x636, 0x638 };
 static const u16 NCT6775_REG_FAN_MIN[] = { 0x3b, 0x3c, 0x3d };
-static const u16 NCT6775_REG_FAN_PULSES[] = { 0x641, 0x642, 0x643, 0x644, 0 };
-static const u16 NCT6775_FAN_PULSE_SHIFT[] = { 0, 0, 0, 0, 0, 0 };
+static const u16 NCT6775_REG_FAN_PULSES[NUM_FAN] = {
+        0x641, 0x642, 0x643, 0x644 };
+static const u16 NCT6775_FAN_PULSE_SHIFT[NUM_FAN] = { };
 
 static const u16 NCT6775_REG_TEMP[] = {
         0x27, 0x150, 0x250, 0x62b, 0x62c, 0x62d };
@@ -372,6 +372,7 @@ static const char *const nct6775_temp_label[] = {
 };
 
 #define NCT6775_TEMP_MASK       0x001ffffe
+#define NCT6775_VIRT_TEMP_MASK  0x00000000
 
 static const u16 NCT6775_REG_TEMP_ALTERNATE[32] = {
         [13] = 0x661,
@@ -424,8 +425,8 @@ static const u8 NCT6776_PWM_MODE_MASK[] = { 0x01, 0, 0, 0, 0, 0 };
 
 static const u16 NCT6776_REG_FAN_MIN[] = {
         0x63a, 0x63c, 0x63e, 0x640, 0x642, 0x64a, 0x64c };
-static const u16 NCT6776_REG_FAN_PULSES[] = {
-        0x644, 0x645, 0x646, 0x647, 0x648, 0x649, 0 };
+static const u16 NCT6776_REG_FAN_PULSES[NUM_FAN] = {
+        0x644, 0x645, 0x646, 0x647, 0x648, 0x649 };
 
 static const u16 NCT6776_REG_WEIGHT_DUTY_BASE[] = {
         0x13e, 0x23e, 0x33e, 0x83e, 0x93e, 0xa3e };
@@ -460,6 +461,7 @@ static const char *const nct6776_temp_label[] = {
 };
 
 #define NCT6776_TEMP_MASK       0x007ffffe
+#define NCT6776_VIRT_TEMP_MASK  0x00000000
 
 static const u16 NCT6776_REG_TEMP_ALTERNATE[32] = {
         [14] = 0x401,
@@ -500,9 +502,9 @@ static const s8 NCT6779_BEEP_BITS[] = {
         30, 31 };                       /* intrusion0, intrusion1 */
 
 static const u16 NCT6779_REG_FAN[] = {
-        0x4b0, 0x4b2, 0x4b4, 0x4b6, 0x4b8, 0x4ba, 0x660 };
-static const u16 NCT6779_REG_FAN_PULSES[] = {
-        0x644, 0x645, 0x646, 0x647, 0x648, 0x649, 0 };
+        0x4c0, 0x4c2, 0x4c4, 0x4c6, 0x4c8, 0x4ca, 0x4ce };
+static const u16 NCT6779_REG_FAN_PULSES[NUM_FAN] = {
+        0x644, 0x645, 0x646, 0x647, 0x648, 0x649 };
 
 static const u16 NCT6779_REG_CRITICAL_PWM_ENABLE[] = {
         0x136, 0x236, 0x336, 0x836, 0x936, 0xa36, 0xb36 };
@@ -558,7 +560,9 @@ static const char *const nct6779_temp_label[] = {
 };
 
 #define NCT6779_TEMP_MASK       0x07ffff7e
+#define NCT6779_VIRT_TEMP_MASK  0x00000000
 #define NCT6791_TEMP_MASK       0x87ffff7e
+#define NCT6791_VIRT_TEMP_MASK  0x80000000
 
 static const u16 NCT6779_REG_TEMP_ALTERNATE[32]
         = { 0x490, 0x491, 0x492, 0x493, 0x494, 0x495, 0, 0,
@@ -637,6 +641,7 @@ static const char *const nct6792_temp_label[] = {
 };
 
 #define NCT6792_TEMP_MASK       0x9fffff7e
+#define NCT6792_VIRT_TEMP_MASK  0x80000000
 
 static const char *const nct6793_temp_label[] = {
         "",
@@ -674,6 +679,7 @@ static const char *const nct6793_temp_label[] = {
 };
 
 #define NCT6793_TEMP_MASK       0xbfff037e
+#define NCT6793_VIRT_TEMP_MASK  0x80000000
 
 static const char *const nct6795_temp_label[] = {
         "",
@@ -711,6 +717,7 @@ static const char *const nct6795_temp_label[] = {
 };
 
 #define NCT6795_TEMP_MASK       0xbfffff7e
+#define NCT6795_VIRT_TEMP_MASK  0x80000000
 
 static const char *const nct6796_temp_label[] = {
         "",
@@ -723,8 +730,8 @@ static const char *const nct6796_temp_label[] = {
         "AUXTIN4",
         "SMBUSMASTER 0",
         "SMBUSMASTER 1",
-        "",
-        "",
+        "Virtual_TEMP",
+        "Virtual_TEMP",
         "",
         "",
         "",
@@ -747,7 +754,8 @@ static const char *const nct6796_temp_label[] = {
         "Virtual_TEMP"
 };
 
-#define NCT6796_TEMP_MASK       0xbfff03fe
+#define NCT6796_TEMP_MASK       0xbfff0ffe
+#define NCT6796_VIRT_TEMP_MASK  0x80000c00
 
 /* NCT6102D/NCT6106D specific data */
 
@@ -778,8 +786,8 @@ static const u16 NCT6106_REG_TEMP_CONFIG[] = {
 
 static const u16 NCT6106_REG_FAN[] = { 0x20, 0x22, 0x24 };
 static const u16 NCT6106_REG_FAN_MIN[] = { 0xe0, 0xe2, 0xe4 };
-static const u16 NCT6106_REG_FAN_PULSES[] = { 0xf6, 0xf6, 0xf6, 0, 0 };
-static const u16 NCT6106_FAN_PULSE_SHIFT[] = { 0, 2, 4, 0, 0 };
+static const u16 NCT6106_REG_FAN_PULSES[] = { 0xf6, 0xf6, 0xf6 };
+static const u16 NCT6106_FAN_PULSE_SHIFT[] = { 0, 2, 4 };
 
 static const u8 NCT6106_REG_PWM_MODE[] = { 0xf3, 0xf3, 0xf3 };
 static const u8 NCT6106_PWM_MODE_MASK[] = { 0x01, 0x02, 0x04 };
@@ -916,6 +924,11 @@ static unsigned int fan_from_reg16(u16 reg, unsigned int divreg)
         return 1350000U / (reg << divreg);
 }
 
+static unsigned int fan_from_reg_rpm(u16 reg, unsigned int divreg)
+{
+        return reg;
+}
+
 static u16 fan_to_reg(u32 fan, unsigned int divreg)
 {
         if (!fan)
@@ -968,6 +981,7 @@ struct nct6775_data {
         u16 reg_temp_config[NUM_TEMP];
         const char * const *temp_label;
         u32 temp_mask;
+        u32 virt_temp_mask;
 
         u16 REG_CONFIG;
         u16 REG_VBAT;
@@ -1275,11 +1289,11 @@ static bool is_word_sized(struct nct6775_data *data, u16 reg)
         case nct6795:
         case nct6796:
                 return reg == 0x150 || reg == 0x153 || reg == 0x155 ||
-                  ((reg & 0xfff0) == 0x4b0 && (reg & 0x000f) < 0x0b) ||
+                  (reg & 0xfff0) == 0x4c0 ||
                   reg == 0x402 ||
                   reg == 0x63a || reg == 0x63c || reg == 0x63e ||
                   reg == 0x640 || reg == 0x642 || reg == 0x64a ||
-                  reg == 0x64c || reg == 0x660 ||
+                  reg == 0x64c ||
                   reg == 0x73 || reg == 0x75 || reg == 0x77 || reg == 0x79 ||
                   reg == 0x7b || reg == 0x7d;
         }
@@ -1557,7 +1571,7 @@ static void nct6775_update_pwm(struct device *dev)
                 reg = nct6775_read_value(data, data->REG_WEIGHT_TEMP_SEL[i]);
                 data->pwm_weight_temp_sel[i] = reg & 0x1f;
                 /* If weight is disabled, report weight source as 0 */
-                if (j == 1 && !(reg & 0x80))
+                if (!(reg & 0x80))
                         data->pwm_weight_temp_sel[i] = 0;
 
                 /* Weight temp data */
@@ -1681,9 +1695,13 @@ static struct nct6775_data *nct6775_update_device(struct device *dev)
                         if (data->has_fan_min & BIT(i))
                                 data->fan_min[i] = nct6775_read_value(data,
                                            data->REG_FAN_MIN[i]);
-                        data->fan_pulses[i] =
-                          (nct6775_read_value(data, data->REG_FAN_PULSES[i])
-                                >> data->FAN_PULSE_SHIFT[i]) & 0x03;
+
+                        if (data->REG_FAN_PULSES[i]) {
+                                data->fan_pulses[i] =
+                                  (nct6775_read_value(data,
+                                                      data->REG_FAN_PULSES[i])
+                                   >> data->FAN_PULSE_SHIFT[i]) & 0x03;
+                        }
 
                         nct6775_select_fan_div(dev, data, i, reg);
                 }
@@ -2689,6 +2707,7 @@ store_pwm_weight_temp_sel(struct device *dev, struct device_attribute *attr,
                 return err;
         if (val > NUM_TEMP)
                 return -EINVAL;
+        val = array_index_nospec(val, NUM_TEMP + 1);
         if (val && (!(data->have_temp & BIT(val - 1)) ||
                     !data->temp_src[val - 1]))
                 return -EINVAL;
@@ -3637,6 +3656,7 @@ static int nct6775_probe(struct platform_device *pdev)
 
                 data->temp_label = nct6776_temp_label;
                 data->temp_mask = NCT6776_TEMP_MASK;
+                data->virt_temp_mask = NCT6776_VIRT_TEMP_MASK;
 
                 data->REG_VBAT = NCT6106_REG_VBAT;
                 data->REG_DIODE = NCT6106_REG_DIODE;
@@ -3715,6 +3735,7 @@ static int nct6775_probe(struct platform_device *pdev)
 
                 data->temp_label = nct6775_temp_label;
                 data->temp_mask = NCT6775_TEMP_MASK;
+                data->virt_temp_mask = NCT6775_VIRT_TEMP_MASK;
 
                 data->REG_CONFIG = NCT6775_REG_CONFIG;
                 data->REG_VBAT = NCT6775_REG_VBAT;
@@ -3787,6 +3808,7 @@ static int nct6775_probe(struct platform_device *pdev)
 
                 data->temp_label = nct6776_temp_label;
                 data->temp_mask = NCT6776_TEMP_MASK;
+                data->virt_temp_mask = NCT6776_VIRT_TEMP_MASK;
 
                 data->REG_CONFIG = NCT6775_REG_CONFIG;
                 data->REG_VBAT = NCT6775_REG_VBAT;
@@ -3851,7 +3873,7 @@ static int nct6775_probe(struct platform_device *pdev)
                 data->ALARM_BITS = NCT6779_ALARM_BITS;
                 data->BEEP_BITS = NCT6779_BEEP_BITS;
 
-                data->fan_from_reg = fan_from_reg13;
+                data->fan_from_reg = fan_from_reg_rpm;
                 data->fan_from_reg_min = fan_from_reg13;
                 data->target_temp_mask = 0xff;
                 data->tolerance_mask = 0x07;
@@ -3859,6 +3881,7 @@ static int nct6775_probe(struct platform_device *pdev)
 
                 data->temp_label = nct6779_temp_label;
                 data->temp_mask = NCT6779_TEMP_MASK;
+                data->virt_temp_mask = NCT6779_VIRT_TEMP_MASK;
 
                 data->REG_CONFIG = NCT6775_REG_CONFIG;
                 data->REG_VBAT = NCT6775_REG_VBAT;
@@ -3931,7 +3954,7 @@ static int nct6775_probe(struct platform_device *pdev)
                 data->ALARM_BITS = NCT6791_ALARM_BITS;
                 data->BEEP_BITS = NCT6779_BEEP_BITS;
 
-                data->fan_from_reg = fan_from_reg13;
+                data->fan_from_reg = fan_from_reg_rpm;
                 data->fan_from_reg_min = fan_from_reg13;
                 data->target_temp_mask = 0xff;
                 data->tolerance_mask = 0x07;
@@ -3942,22 +3965,27 @@ static int nct6775_probe(struct platform_device *pdev)
                 case nct6791:
                         data->temp_label = nct6779_temp_label;
                         data->temp_mask = NCT6791_TEMP_MASK;
+                        data->virt_temp_mask = NCT6791_VIRT_TEMP_MASK;
                         break;
                 case nct6792:
                         data->temp_label = nct6792_temp_label;
                         data->temp_mask = NCT6792_TEMP_MASK;
+                        data->virt_temp_mask = NCT6792_VIRT_TEMP_MASK;
                         break;
                 case nct6793:
                         data->temp_label = nct6793_temp_label;
                         data->temp_mask = NCT6793_TEMP_MASK;
+                        data->virt_temp_mask = NCT6793_VIRT_TEMP_MASK;
                         break;
                 case nct6795:
                         data->temp_label = nct6795_temp_label;
                         data->temp_mask = NCT6795_TEMP_MASK;
+                        data->virt_temp_mask = NCT6795_VIRT_TEMP_MASK;
                         break;
                 case nct6796:
                         data->temp_label = nct6796_temp_label;
                         data->temp_mask = NCT6796_TEMP_MASK;
+                        data->virt_temp_mask = NCT6796_VIRT_TEMP_MASK;
                         break;
                 }
 
@@ -4141,7 +4169,7 @@ static int nct6775_probe(struct platform_device *pdev)
                  * for each fan reflects a different temperature, and there
                  * are no duplicates.
                  */
-                if (src != TEMP_SOURCE_VIRTUAL) {
+                if (!(data->virt_temp_mask & BIT(src))) {
                         if (mask & BIT(src))
                                 continue;
                         mask |= BIT(src);
diff --git a/drivers/hwmon/raspberrypi-hwmon.c b/drivers/hwmon/raspberrypi-hwmon.c
index fb4e4a6bb1f6..be5ba4690895 100644
--- a/drivers/hwmon/raspberrypi-hwmon.c
+++ b/drivers/hwmon/raspberrypi-hwmon.c
@@ -164,3 +164,4 @@ module_platform_driver(rpi_hwmon_driver);
 MODULE_AUTHOR("Stefan Wahren <stefan.wahren@i2se.com>");
 MODULE_DESCRIPTION("Raspberry Pi voltage sensor driver");
 MODULE_LICENSE("GPL v2");
+MODULE_ALIAS("platform:raspberrypi-hwmon");
diff --git a/drivers/hwtracing/intel_th/core.c b/drivers/hwtracing/intel_th/core.c
index da962aa2cef5..fc6b7f8b62fb 100644
--- a/drivers/hwtracing/intel_th/core.c
+++ b/drivers/hwtracing/intel_th/core.c
@@ -139,7 +139,8 @@ static int intel_th_remove(struct device *dev)
                         th->thdev[i] = NULL;
                 }
 
-                th->num_thdevs = lowest;
+                if (lowest >= 0)
+                        th->num_thdevs = lowest;
         }
 
         if (thdrv->attr_group)
@@ -487,7 +488,7 @@ static const struct intel_th_subdevice {
                                 .flags  = IORESOURCE_MEM,
                         },
                         {
-                                .start  = TH_MMIO_SW,
+                                .start  = 1, /* use resource[1] */
                                 .end    = 0,
                                 .flags  = IORESOURCE_MEM,
                         },
@@ -580,6 +581,7 @@ intel_th_subdevice_alloc(struct intel_th *th,
         struct intel_th_device *thdev;
         struct resource res[3];
         unsigned int req = 0;
+        bool is64bit = false;
         int r, err;
 
         thdev = intel_th_device_alloc(th, subdev->type, subdev->name,
@@ -589,12 +591,18 @@ intel_th_subdevice_alloc(struct intel_th *th,
 
         thdev->drvdata = th->drvdata;
 
+        for (r = 0; r < th->num_resources; r++)
+                if (th->resource[r].flags & IORESOURCE_MEM_64) {
+                        is64bit = true;
+                        break;
+                }
+
         memcpy(res, subdev->res,
                sizeof(struct resource) * subdev->nres);
 
         for (r = 0; r < subdev->nres; r++) {
                 struct resource *devres = th->resource;
-                int bar = TH_MMIO_CONFIG;
+                int bar = 0; /* cut subdevices' MMIO from resource[0] */
 
                 /*
                  * Take .end == 0 to mean 'take the whole bar',
@@ -603,6 +611,8 @@ intel_th_subdevice_alloc(struct intel_th *th,
                  */
                 if (!res[r].end && res[r].flags == IORESOURCE_MEM) {
                         bar = res[r].start;
+                        if (is64bit)
+                                bar *= 2;
                         res[r].start = 0;
                         res[r].end = resource_size(&devres[bar]) - 1;
                 }
diff --git a/drivers/hwtracing/intel_th/pci.c b/drivers/hwtracing/intel_th/pci.c
index c2e55e5d97f6..1cf6290d6435 100644
--- a/drivers/hwtracing/intel_th/pci.c
+++ b/drivers/hwtracing/intel_th/pci.c
@@ -160,6 +160,11 @@ static const struct pci_device_id intel_th_pci_id_table[] = {
                 PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x18e1),
                 .driver_data = (kernel_ulong_t)&intel_th_2x,
         },
+        {
+                /* Ice Lake PCH */
+                PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x34a6),
+                .driver_data = (kernel_ulong_t)&intel_th_2x,
+        },
         { 0 },
 };
 
diff --git a/drivers/i2c/algos/i2c-algo-bit.c b/drivers/i2c/algos/i2c-algo-bit.c
index 6ec65adaba49..c33dcfb87993 100644
--- a/drivers/i2c/algos/i2c-algo-bit.c
+++ b/drivers/i2c/algos/i2c-algo-bit.c
@@ -110,8 +110,8 @@ static int sclhi(struct i2c_algo_bit_data *adap)
         }
 #ifdef DEBUG
         if (jiffies != start && i2c_debug >= 3)
-                pr_debug("i2c-algo-bit: needed %ld jiffies for SCL to go "
-                         "high\n", jiffies - start);
+                pr_debug("i2c-algo-bit: needed %ld jiffies for SCL to go high\n",
+                         jiffies - start);
 #endif
 
 done:
@@ -171,8 +171,9 @@ static int i2c_outb(struct i2c_adapter *i2c_adap, unsigned char c)
                 setsda(adap, sb);
                 udelay((adap->udelay + 1) / 2);
                 if (sclhi(adap) < 0) { /* timed out */
-                        bit_dbg(1, &i2c_adap->dev, "i2c_outb: 0x%02x, "
-                                "timeout at bit #%d\n", (int)c, i);
+                        bit_dbg(1, &i2c_adap->dev,
+                                "i2c_outb: 0x%02x, timeout at bit #%d\n",
+                                (int)c, i);
                         return -ETIMEDOUT;
                 }
                 /* FIXME do arbitration here:
@@ -185,8 +186,8 @@ static int i2c_outb(struct i2c_adapter *i2c_adap, unsigned char c)
         }
         sdahi(adap);
         if (sclhi(adap) < 0) { /* timeout */
-                bit_dbg(1, &i2c_adap->dev, "i2c_outb: 0x%02x, "
-                        "timeout at ack\n", (int)c);
+                bit_dbg(1, &i2c_adap->dev,
+                        "i2c_outb: 0x%02x, timeout at ack\n", (int)c);
                 return -ETIMEDOUT;
         }
 
@@ -215,8 +216,9 @@ static int i2c_inb(struct i2c_adapter *i2c_adap)
         sdahi(adap);
         for (i = 0; i < 8; i++) {
                 if (sclhi(adap) < 0) { /* timeout */
-                        bit_dbg(1, &i2c_adap->dev, "i2c_inb: timeout at bit "
-                                "#%d\n", 7 - i);
+                        bit_dbg(1, &i2c_adap->dev,
+                                "i2c_inb: timeout at bit #%d\n",
+                                7 - i);
                         return -ETIMEDOUT;
                 }
                 indata *= 2;
@@ -265,8 +267,9 @@ static int test_bus(struct i2c_adapter *i2c_adap)
                 goto bailout;
         }
         if (!scl) {
-                printk(KERN_WARNING "%s: SCL unexpected low "
-                       "while pulling SDA low!\n", name);
+                printk(KERN_WARNING
+                       "%s: SCL unexpected low while pulling SDA low!\n",
+                       name);
                 goto bailout;
         }
 
@@ -278,8 +281,9 @@ static int test_bus(struct i2c_adapter *i2c_adap)
                 goto bailout;
         }
         if (!scl) {
-                printk(KERN_WARNING "%s: SCL unexpected low "
-                       "while pulling SDA high!\n", name);
+                printk(KERN_WARNING
+                       "%s: SCL unexpected low while pulling SDA high!\n",
+                       name);
                 goto bailout;
         }
 
@@ -291,8 +295,9 @@ static int test_bus(struct i2c_adapter *i2c_adap)
                 goto bailout;
         }
         if (!sda) {
-                printk(KERN_WARNING "%s: SDA unexpected low "
-                       "while pulling SCL low!\n", name);
+                printk(KERN_WARNING
+                       "%s: SDA unexpected low while pulling SCL low!\n",
+                       name);
                 goto bailout;
         }
 
@@ -304,8 +309,9 @@ static int test_bus(struct i2c_adapter *i2c_adap)
                 goto bailout;
         }
         if (!sda) {
-                printk(KERN_WARNING "%s: SDA unexpected low "
-                       "while pulling SCL high!\n", name);
+                printk(KERN_WARNING
+                       "%s: SDA unexpected low while pulling SCL high!\n",
+                       name);
                 goto bailout;
         }
 
@@ -352,8 +358,8 @@ static int try_address(struct i2c_adapter *i2c_adap,
                 i2c_start(adap);
         }
         if (i && ret)
-                bit_dbg(1, &i2c_adap->dev, "Used %d tries to %s client at "
-                        "0x%02x: %s\n", i + 1,
+                bit_dbg(1, &i2c_adap->dev,
+                        "Used %d tries to %s client at 0x%02x: %s\n", i + 1,
                         addr & 1 ? "read from" : "write to", addr >> 1,
                         ret == 1 ? "success" : "failed, timeout?");
         return ret;
@@ -442,8 +448,9 @@ static int readbytes(struct i2c_adapter *i2c_adap, struct i2c_msg *msg)
                         if (inval <= 0 || inval > I2C_SMBUS_BLOCK_MAX) {
                                 if (!(flags & I2C_M_NO_RD_ACK))
                                         acknak(i2c_adap, 0);
-                                dev_err(&i2c_adap->dev, "readbytes: invalid "
-                                        "block length (%d)\n", inval);
+                                dev_err(&i2c_adap->dev,
+                                        "readbytes: invalid block length (%d)\n",
+                                        inval);
                                 return -EPROTO;
                         }
                         /* The original count value accounts for the extra
@@ -506,8 +513,8 @@ static int bit_doAddress(struct i2c_adapter *i2c_adap, struct i2c_msg *msg)
                         return -ENXIO;
                 }
                 if (flags & I2C_M_RD) {
-                        bit_dbg(3, &i2c_adap->dev, "emitting repeated "
-                                "start condition\n");
+                        bit_dbg(3, &i2c_adap->dev,
+                                "emitting repeated start condition\n");
                         i2c_repstart(adap);
                         /* okay, now switch into reading mode */
                         addr |= 0x01;
@@ -564,8 +571,8 @@ static int bit_xfer(struct i2c_adapter *i2c_adap,
                         }
                         ret = bit_doAddress(i2c_adap, pmsg);
                         if ((ret != 0) && !nak_ok) {
-                                bit_dbg(1, &i2c_adap->dev, "NAK from "
-                                        "device addr 0x%02x msg #%d\n",
+                                bit_dbg(1, &i2c_adap->dev,
+                                        "NAK from device addr 0x%02x msg #%d\n",
                                         msgs[i].addr, i);
                                 goto bailout;
                         }
diff --git a/drivers/i2c/busses/i2c-designware-master.c b/drivers/i2c/busses/i2c-designware-master.c
index e18442b9973a..94d94b4a9a0d 100644
--- a/drivers/i2c/busses/i2c-designware-master.c
+++ b/drivers/i2c/busses/i2c-designware-master.c
@@ -708,7 +708,6 @@ int i2c_dw_probe(struct dw_i2c_dev *dev)
         i2c_set_adapdata(adap, dev);
 
         if (dev->pm_disabled) {
-                dev_pm_syscore_device(dev->dev, true);
                 irq_flags = IRQF_NO_SUSPEND;
         } else {
                 irq_flags = IRQF_SHARED | IRQF_COND_SUSPEND;
diff --git a/drivers/i2c/busses/i2c-designware-platdrv.c b/drivers/i2c/busses/i2c-designware-platdrv.c
index 1a8d2da5b000..b5750fd85125 100644
--- a/drivers/i2c/busses/i2c-designware-platdrv.c
+++ b/drivers/i2c/busses/i2c-designware-platdrv.c
@@ -434,6 +434,9 @@ static int dw_i2c_plat_suspend(struct device *dev)
 {
         struct dw_i2c_dev *i_dev = dev_get_drvdata(dev);
 
+        if (i_dev->pm_disabled)
+                return 0;
+
         i_dev->disable(i_dev);
         i2c_dw_prepare_clk(i_dev, false);
 
@@ -444,7 +447,9 @@ static int dw_i2c_plat_resume(struct device *dev)
 {
         struct dw_i2c_dev *i_dev = dev_get_drvdata(dev);
 
-        i2c_dw_prepare_clk(i_dev, true);
+        if (!i_dev->pm_disabled)
+                i2c_dw_prepare_clk(i_dev, true);
+
         i_dev->init(i_dev);
 
         return 0;
diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c
index 941c223f6491..c91e145ef5a5 100644
--- a/drivers/i2c/busses/i2c-i801.c
+++ b/drivers/i2c/busses/i2c-i801.c
@@ -140,6 +140,7 @@
 
 #define SBREG_BAR               0x10
 #define SBREG_SMBCTRL           0xc6000c
+#define SBREG_SMBCTRL_DNV       0xcf000c
 
 /* Host status bits for SMBPCISTS */
 #define SMBPCISTS_INTS          BIT(3)
@@ -1399,7 +1400,11 @@ static void i801_add_tco(struct i801_priv *priv)
         spin_unlock(&p2sb_spinlock);
 
         res = &tco_res[ICH_RES_MEM_OFF];
-        res->start = (resource_size_t)base64_addr + SBREG_SMBCTRL;
+        if (pci_dev->device == PCI_DEVICE_ID_INTEL_DNV_SMBUS)
+                res->start = (resource_size_t)base64_addr + SBREG_SMBCTRL_DNV;
+        else
+                res->start = (resource_size_t)base64_addr + SBREG_SMBCTRL;
+
         res->end = res->start + 3;
         res->flags = IORESOURCE_MEM;
 
@@ -1415,6 +1420,13 @@ static void i801_add_tco(struct i801_priv *priv)
 }
 
 #ifdef CONFIG_ACPI
+static bool i801_acpi_is_smbus_ioport(const struct i801_priv *priv,
+                                      acpi_physical_address address)
+{
+        return address >= priv->smba &&
+               address <= pci_resource_end(priv->pci_dev, SMBBAR);
+}
+
 static acpi_status
 i801_acpi_io_handler(u32 function, acpi_physical_address address, u32 bits,
                      u64 *value, void *handler_context, void *region_context)
@@ -1430,7 +1442,7 @@ i801_acpi_io_handler(u32 function, acpi_physical_address address, u32 bits,
          */
         mutex_lock(&priv->acpi_lock);
 
-        if (!priv->acpi_reserved) {
+        if (!priv->acpi_reserved && i801_acpi_is_smbus_ioport(priv, address)) {
                 priv->acpi_reserved = true;
 
                 dev_warn(&pdev->dev, "BIOS is accessing SMBus registers\n");
diff --git a/drivers/i2c/busses/i2c-imx-lpi2c.c b/drivers/i2c/busses/i2c-imx-lpi2c.c
index 6d975f5221ca..06c4c767af32 100644
--- a/drivers/i2c/busses/i2c-imx-lpi2c.c
+++ b/drivers/i2c/busses/i2c-imx-lpi2c.c
@@ -538,7 +538,6 @@ static const struct i2c_algorithm lpi2c_imx_algo = {
 
 static const struct of_device_id lpi2c_imx_of_match[] = {
         { .compatible = "fsl,imx7ulp-lpi2c" },
-        { .compatible = "fsl,imx8dv-lpi2c" },
         { },
 };
 MODULE_DEVICE_TABLE(of, lpi2c_imx_of_match);
diff --git a/drivers/i2c/busses/i2c-sh_mobile.c b/drivers/i2c/busses/i2c-sh_mobile.c
index 439e8778f849..818cab14e87c 100644
--- a/drivers/i2c/busses/i2c-sh_mobile.c
+++ b/drivers/i2c/busses/i2c-sh_mobile.c
@@ -507,8 +507,6 @@ static void sh_mobile_i2c_dma_callback(void *data)
         pd->pos = pd->msg->len;
         pd->stop_after_dma = true;
 
-        i2c_release_dma_safe_msg_buf(pd->msg, pd->dma_buf);
-
         iic_set_clr(pd, ICIC, 0, ICIC_TDMAE | ICIC_RDMAE);
 }
 
@@ -602,8 +600,8 @@ static void sh_mobile_i2c_xfer_dma(struct sh_mobile_i2c_data *pd)
         dma_async_issue_pending(chan);
 }
 
-static int start_ch(struct sh_mobile_i2c_data *pd, struct i2c_msg *usr_msg,
-                    bool do_init)
+static void start_ch(struct sh_mobile_i2c_data *pd, struct i2c_msg *usr_msg,
+                     bool do_init)
 {
         if (do_init) {
                 /* Initialize channel registers */
@@ -627,7 +625,6 @@ static int start_ch(struct sh_mobile_i2c_data *pd, struct i2c_msg *usr_msg,
 
         /* Enable all interrupts to begin with */
         iic_wr(pd, ICIC, ICIC_DTEE | ICIC_WAITE | ICIC_ALE | ICIC_TACKE);
-        return 0;
 }
 
 static int poll_dte(struct sh_mobile_i2c_data *pd)
@@ -698,9 +695,7 @@ static int sh_mobile_i2c_xfer(struct i2c_adapter *adapter,
                 pd->send_stop = i == num - 1 || msg->flags & I2C_M_STOP;
                 pd->stop_after_dma = false;
 
-                err = start_ch(pd, msg, do_start);
-                if (err)
-                        break;
+                start_ch(pd, msg, do_start);
 
                 if (do_start)
                         i2c_op(pd, OP_START, 0);
@@ -709,6 +704,10 @@ static int sh_mobile_i2c_xfer(struct i2c_adapter *adapter,
                 timeout = wait_event_timeout(pd->wait,
                                        pd->sr & (ICSR_TACK | SW_DONE),
                                        adapter->timeout);
+
+                /* 'stop_after_dma' tells if DMA transfer was complete */
+                i2c_put_dma_safe_msg_buf(pd->dma_buf, pd->msg, pd->stop_after_dma);
+
                 if (!timeout) {
                         dev_err(pd->dev, "Transfer request timed out\n");
                         if (pd->dma_direction != DMA_NONE)
diff --git a/drivers/i2c/busses/i2c-uniphier-f.c b/drivers/i2c/busses/i2c-uniphier-f.c
index 9918bdd81619..a403e8579b65 100644
--- a/drivers/i2c/busses/i2c-uniphier-f.c
+++ b/drivers/i2c/busses/i2c-uniphier-f.c
@@ -401,11 +401,8 @@ static int uniphier_fi2c_master_xfer(struct i2c_adapter *adap,
                 return ret;
 
         for (msg = msgs; msg < emsg; msg++) {
-                /* If next message is read, skip the stop condition */
-                bool stop = !(msg + 1 < emsg && msg[1].flags & I2C_M_RD);
-                /* but, force it if I2C_M_STOP is set */
-                if (msg->flags & I2C_M_STOP)
-                        stop = true;
+                /* Emit STOP if it is the last message or I2C_M_STOP is set. */
+                bool stop = (msg + 1 == emsg) || (msg->flags & I2C_M_STOP);
 
                 ret = uniphier_fi2c_master_xfer_one(adap, msg, stop);
                 if (ret)
diff --git a/drivers/i2c/busses/i2c-uniphier.c b/drivers/i2c/busses/i2c-uniphier.c
index bb181b088291..454f914ae66d 100644
--- a/drivers/i2c/busses/i2c-uniphier.c
+++ b/drivers/i2c/busses/i2c-uniphier.c
@@ -248,11 +248,8 @@ static int uniphier_i2c_master_xfer(struct i2c_adapter *adap,
                 return ret;
 
         for (msg = msgs; msg < emsg; msg++) {
-                /* If next message is read, skip the stop condition */
-                bool stop = !(msg + 1 < emsg && msg[1].flags & I2C_M_RD);
-                /* but, force it if I2C_M_STOP is set */
-                if (msg->flags & I2C_M_STOP)
-                        stop = true;
+                /* Emit STOP if it is the last message or I2C_M_STOP is set. */
+                bool stop = (msg + 1 == emsg) || (msg->flags & I2C_M_STOP);
 
                 ret = uniphier_i2c_master_xfer_one(adap, msg, stop);
                 if (ret)
diff --git a/drivers/i2c/busses/i2c-xiic.c b/drivers/i2c/busses/i2c-xiic.c
index 9a71e50d21f1..0c51c0ffdda9 100644
--- a/drivers/i2c/busses/i2c-xiic.c
+++ b/drivers/i2c/busses/i2c-xiic.c
@@ -532,6 +532,7 @@ static void xiic_start_recv(struct xiic_i2c *i2c)
 {
         u8 rx_watermark;
         struct i2c_msg *msg = i2c->rx_msg = i2c->tx_msg;
+        unsigned long flags;
 
         /* Clear and enable Rx full interrupt. */
         xiic_irq_clr_en(i2c, XIIC_INTR_RX_FULL_MASK | XIIC_INTR_TX_ERROR_MASK);
@@ -547,6 +548,7 @@ static void xiic_start_recv(struct xiic_i2c *i2c)
                 rx_watermark = IIC_RX_FIFO_DEPTH;
         xiic_setreg8(i2c, XIIC_RFD_REG_OFFSET, rx_watermark - 1);
 
+        local_irq_save(flags);
         if (!(msg->flags & I2C_M_NOSTART))
                 /* write the address */
                 xiic_setreg16(i2c, XIIC_DTR_REG_OFFSET,
@@ -556,6 +558,8 @@ static void xiic_start_recv(struct xiic_i2c *i2c)
 
         xiic_setreg16(i2c, XIIC_DTR_REG_OFFSET,
                 msg->len | ((i2c->nmsgs == 1) ? XIIC_TX_DYN_STOP_MASK : 0));
+        local_irq_restore(flags);
+
         if (i2c->nmsgs == 1)
                 /* very last, enable bus not busy as well */
                 xiic_irq_clr_en(i2c, XIIC_INTR_BNB_MASK);
diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c
index f15737763608..9ee9a15e7134 100644
--- a/drivers/i2c/i2c-core-base.c
+++ b/drivers/i2c/i2c-core-base.c
@@ -2293,21 +2293,22 @@ u8 *i2c_get_dma_safe_msg_buf(struct i2c_msg *msg, unsigned int threshold)
 EXPORT_SYMBOL_GPL(i2c_get_dma_safe_msg_buf);
 
 /**
- * i2c_release_dma_safe_msg_buf - release DMA safe buffer and sync with i2c_msg
- * @msg: the message to be synced with
+ * i2c_put_dma_safe_msg_buf - release DMA safe buffer and sync with i2c_msg
  * @buf: the buffer obtained from i2c_get_dma_safe_msg_buf(). May be NULL.
+ * @msg: the message which the buffer corresponds to
+ * @xferred: bool saying if the message was transferred
  */
-void i2c_release_dma_safe_msg_buf(struct i2c_msg *msg, u8 *buf)
+void i2c_put_dma_safe_msg_buf(u8 *buf, struct i2c_msg *msg, bool xferred)
 {
         if (!buf || buf == msg->buf)
                 return;
 
-        if (msg->flags & I2C_M_RD)
+        if (xferred && msg->flags & I2C_M_RD)
                 memcpy(msg->buf, buf, msg->len);
 
         kfree(buf);
 }
-EXPORT_SYMBOL_GPL(i2c_release_dma_safe_msg_buf);
+EXPORT_SYMBOL_GPL(i2c_put_dma_safe_msg_buf);
 
 MODULE_AUTHOR("Simon G. Vogl <simon@tk.uni-linz.ac.at>");
 MODULE_DESCRIPTION("I2C-Bus main module");
diff --git a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c
index 7589f2ad1dae..631360b14ca7 100644
--- a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c
+++ b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c
@@ -187,12 +187,15 @@ static int st_lsm6dsx_set_fifo_odr(struct st_lsm6dsx_sensor *sensor,
 
 int st_lsm6dsx_update_watermark(struct st_lsm6dsx_sensor *sensor, u16 watermark)
 {
-        u16 fifo_watermark = ~0, cur_watermark, sip = 0, fifo_th_mask;
+        u16 fifo_watermark = ~0, cur_watermark, fifo_th_mask;
         struct st_lsm6dsx_hw *hw = sensor->hw;
         struct st_lsm6dsx_sensor *cur_sensor;
         int i, err, data;
         __le16 wdata;
 
+        if (!hw->sip)
+                return 0;
+
         for (i = 0; i < ST_LSM6DSX_ID_MAX; i++) {
                 cur_sensor = iio_priv(hw->iio_devs[i]);
 
@@ -203,14 +206,10 @@ int st_lsm6dsx_update_watermark(struct st_lsm6dsx_sensor *sensor, u16 watermark)
                                                        : cur_sensor->watermark;
 
                 fifo_watermark = min_t(u16, fifo_watermark, cur_watermark);
-                sip += cur_sensor->sip;
         }
 
-        if (!sip)
-                return 0;
-
-        fifo_watermark = max_t(u16, fifo_watermark, sip);
-        fifo_watermark = (fifo_watermark / sip) * sip;
+        fifo_watermark = max_t(u16, fifo_watermark, hw->sip);
+        fifo_watermark = (fifo_watermark / hw->sip) * hw->sip;
         fifo_watermark = fifo_watermark * hw->settings->fifo_ops.th_wl;
 
         err = regmap_read(hw->regmap, hw->settings->fifo_ops.fifo_th.addr + 1,
diff --git a/drivers/iio/temperature/maxim_thermocouple.c b/drivers/iio/temperature/maxim_thermocouple.c
index 54e383231d1e..c31b9633f32d 100644
--- a/drivers/iio/temperature/maxim_thermocouple.c
+++ b/drivers/iio/temperature/maxim_thermocouple.c
@@ -258,7 +258,6 @@ static int maxim_thermocouple_remove(struct spi_device *spi)
 static const struct spi_device_id maxim_thermocouple_id[] = {
         {"max6675", MAX6675},
         {"max31855", MAX31855},
-        {"max31856", MAX31855},
         {},
 };
 MODULE_DEVICE_TABLE(spi, maxim_thermocouple_id);
diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index f72677291b69..a36c94930c31 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -724,6 +724,7 @@ static int cma_resolve_ib_dev(struct rdma_id_private *id_priv)
         dgid = (union ib_gid *) &addr->sib_addr;
         pkey = ntohs(addr->sib_pkey);
 
+        mutex_lock(&lock);
         list_for_each_entry(cur_dev, &dev_list, list) {
                 for (p = 1; p <= cur_dev->device->phys_port_cnt; ++p) {
                         if (!rdma_cap_af_ib(cur_dev->device, p))
@@ -750,18 +751,19 @@ static int cma_resolve_ib_dev(struct rdma_id_private *id_priv)
                                         cma_dev = cur_dev;
                                         sgid = gid;
                                         id_priv->id.port_num = p;
+                                        goto found;
                                 }
                         }
                 }
         }
-
-        if (!cma_dev)
-                return -ENODEV;
+        mutex_unlock(&lock);
+        return -ENODEV;
 
 found:
         cma_attach_to_dev(id_priv, cma_dev);
-        addr = (struct sockaddr_ib *) cma_src_addr(id_priv);
-        memcpy(&addr->sib_addr, &sgid, sizeof sgid);
+        mutex_unlock(&lock);
+        addr = (struct sockaddr_ib *)cma_src_addr(id_priv);
+        memcpy(&addr->sib_addr, &sgid, sizeof(sgid));
         cma_translate_ib(addr, &id_priv->id.route.addr.dev_addr);
         return 0;
 }
diff --git a/drivers/infiniband/core/rdma_core.c b/drivers/infiniband/core/rdma_core.c
index 6eb64c6f0802..c4118bcd5103 100644
--- a/drivers/infiniband/core/rdma_core.c
+++ b/drivers/infiniband/core/rdma_core.c
@@ -882,6 +882,8 @@ static int __uverbs_cleanup_ufile(struct ib_uverbs_file *ufile,
                 WARN_ON(uverbs_try_lock_object(obj, UVERBS_LOOKUP_WRITE));
                 if (!uverbs_destroy_uobject(obj, reason))
                         ret = 0;
+                else
+                        atomic_set(&obj->usecnt, 0);
         }
         return ret;
 }
diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c
index ec8fb289621f..5f437d1570fb 100644
--- a/drivers/infiniband/core/ucma.c
+++ b/drivers/infiniband/core/ucma.c
@@ -124,6 +124,8 @@ static DEFINE_MUTEX(mut);
 static DEFINE_IDR(ctx_idr);
 static DEFINE_IDR(multicast_idr);
 
+static const struct file_operations ucma_fops;
+
 static inline struct ucma_context *_ucma_find_context(int id,
                                                       struct ucma_file *file)
 {
@@ -1581,6 +1583,10 @@ static ssize_t ucma_migrate_id(struct ucma_file *new_file,
         f = fdget(cmd.fd);
         if (!f.file)
                 return -ENOENT;
+        if (f.file->f_op != &ucma_fops) {
+                ret = -EINVAL;
+                goto file_put;
+        }
 
         /* Validate current fd and prevent destruction of id. */
         ctx = ucma_get_ctx(f.file->private_data, cmd.id);
diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
index 823beca448e1..6d974e2363df 100644
--- a/drivers/infiniband/core/uverbs_main.c
+++ b/drivers/infiniband/core/uverbs_main.c
@@ -1050,7 +1050,7 @@ static void ib_uverbs_add_one(struct ib_device *device)
         uverbs_dev->num_comp_vectors = device->num_comp_vectors;
 
         if (ib_uverbs_create_uapi(device, uverbs_dev))
-                goto err;
+                goto err_uapi;
 
         cdev_init(&uverbs_dev->cdev, NULL);
         uverbs_dev->cdev.owner = THIS_MODULE;
@@ -1077,11 +1077,10 @@ static void ib_uverbs_add_one(struct ib_device *device)
 
 err_class:
         device_destroy(uverbs_class, uverbs_dev->cdev.dev);
-
 err_cdev:
         cdev_del(&uverbs_dev->cdev);
+err_uapi:
         clear_bit(devnum, dev_map);
-
 err:
         if (atomic_dec_and_test(&uverbs_dev->refcount))
                 ib_uverbs_comp_dev(uverbs_dev);
diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
index bbfb86eb2d24..bc2b9e038439 100644
--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
@@ -833,6 +833,8 @@ int bnxt_re_destroy_qp(struct ib_qp *ib_qp)
                                 "Failed to destroy Shadow QP");
                         return rc;
                 }
+                bnxt_qplib_free_qp_res(&rdev->qplib_res,
+                                       &rdev->qp1_sqp->qplib_qp);
                 mutex_lock(&rdev->qp_lock);
                 list_del(&rdev->qp1_sqp->list);
                 atomic_dec(&rdev->qp_count);
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.c b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
index e426b990c1dd..6ad0d46ab879 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.c
+++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
@@ -196,7 +196,7 @@ static int bnxt_qplib_alloc_qp_hdr_buf(struct bnxt_qplib_res *res,
                                        struct bnxt_qplib_qp *qp)
 {
         struct bnxt_qplib_q *rq = &qp->rq;
-        struct bnxt_qplib_q *sq = &qp->rq;
+        struct bnxt_qplib_q *sq = &qp->sq;
         int rc = 0;
 
         if (qp->sq_hdr_buf_size && sq->hwq.max_elements) {
diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4/qp.c
index b3203afa3b1d..347fe18b1a41 100644
--- a/drivers/infiniband/hw/cxgb4/qp.c
+++ b/drivers/infiniband/hw/cxgb4/qp.c
@@ -1685,6 +1685,12 @@ static void flush_qp(struct c4iw_qp *qhp)
         schp = to_c4iw_cq(qhp->ibqp.send_cq);
 
         if (qhp->ibqp.uobject) {
+
+                /* for user qps, qhp->wq.flushed is protected by qhp->mutex */
+                if (qhp->wq.flushed)
+                        return;
+
+                qhp->wq.flushed = 1;
                 t4_set_wq_in_error(&qhp->wq, 0);
                 t4_set_cq_in_error(&rchp->cq);
                 spin_lock_irqsave(&rchp->comp_handler_lock, flag);
diff --git a/drivers/infiniband/hw/hfi1/pcie.c b/drivers/infiniband/hw/hfi1/pcie.c
index eec83757d55f..6c967dde58e7 100644
--- a/drivers/infiniband/hw/hfi1/pcie.c
+++ b/drivers/infiniband/hw/hfi1/pcie.c
@@ -893,14 +893,11 @@ static int trigger_sbr(struct hfi1_devdata *dd)
                 }
 
         /*
-         * A secondary bus reset (SBR) issues a hot reset to our device.
-         * The following routine does a 1s wait after the reset is dropped
-         * per PCI Trhfa (recovery time).  PCIe 3.0 section 6.6.1 -
-         * Conventional Reset, paragraph 3, line 35 also says that a 1s
-         * delay after a reset is required.  Per spec requirements,
-         * the link is either working or not after that point.
+         * This is an end around to do an SBR during probe time. A new API needs
+         * to be implemented to have cleaner interface but this fixes the
+         * current brokenness
          */
-        return pci_reset_bus(dev);
+        return pci_bridge_secondary_bus_reset(dev->bus->self);
 }
 
 /*
diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c
index ca0f1ee26091..0bbeaaae47e0 100644
--- a/drivers/infiniband/hw/mlx4/main.c
+++ b/drivers/infiniband/hw/mlx4/main.c
@@ -517,9 +517,11 @@ static int mlx4_ib_query_device(struct ib_device *ibdev,
         props->page_size_cap       = dev->dev->caps.page_size_cap;
         props->max_qp              = dev->dev->quotas.qp;
         props->max_qp_wr           = dev->dev->caps.max_wqes - MLX4_IB_SQ_MAX_SPARE;
-        props->max_send_sge        = dev->dev->caps.max_sq_sg;
-        props->max_recv_sge        = dev->dev->caps.max_rq_sg;
-        props->max_sge_rd          = MLX4_MAX_SGE_RD;
+        props->max_send_sge =
+                min(dev->dev->caps.max_sq_sg, dev->dev->caps.max_rq_sg);
+        props->max_recv_sge =
+                min(dev->dev->caps.max_sq_sg, dev->dev->caps.max_rq_sg);
+        props->max_sge_rd = MLX4_MAX_SGE_RD;
         props->max_cq              = dev->dev->quotas.cq;
         props->max_cqe             = dev->dev->caps.max_cqes;
         props->max_mr              = dev->dev->quotas.mpt;
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
index ea01b8dd2be6..3d5424f335cb 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
@@ -1027,12 +1027,14 @@ static int ipoib_cm_rep_handler(struct ib_cm_id *cm_id,
 
         skb_queue_head_init(&skqueue);
 
+        netif_tx_lock_bh(p->dev);
         spin_lock_irq(&priv->lock);
         set_bit(IPOIB_FLAG_OPER_UP, &p->flags);
         if (p->neigh)
                 while ((skb = __skb_dequeue(&p->neigh->queue)))
                         __skb_queue_tail(&skqueue, skb);
         spin_unlock_irq(&priv->lock);
+        netif_tx_unlock_bh(p->dev);
 
         while ((skb = __skb_dequeue(&skqueue))) {
                 skb->dev = p->dev;
diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index 316a57530f6d..c2df341ff6fa 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -1439,6 +1439,7 @@ static struct irq_chip its_irq_chip = {
  * The consequence of the above is that allocation is cost is low, but
  * freeing is expensive. We assumes that freeing rarely occurs.
  */
+#define ITS_MAX_LPI_NRBITS      16 /* 64K LPIs */
 
 static DEFINE_MUTEX(lpi_range_lock);
 static LIST_HEAD(lpi_range_list);
@@ -1625,7 +1626,8 @@ static int __init its_alloc_lpi_tables(void)
 {
         phys_addr_t paddr;
 
-        lpi_id_bits = GICD_TYPER_ID_BITS(gic_rdists->gicd_typer);
+        lpi_id_bits = min_t(u32, GICD_TYPER_ID_BITS(gic_rdists->gicd_typer),
+                                ITS_MAX_LPI_NRBITS);
         gic_rdists->prop_page = its_allocate_prop_table(GFP_NOWAIT);
         if (!gic_rdists->prop_page) {
                 pr_err("Failed to allocate PROPBASE\n");
diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
index f266c81f396f..0481223b1deb 100644
--- a/drivers/md/dm-crypt.c
+++ b/drivers/md/dm-crypt.c
@@ -332,7 +332,7 @@ static int crypt_iv_essiv_init(struct crypt_config *cc)
         int err;
 
         desc->tfm = essiv->hash_tfm;
-        desc->flags = CRYPTO_TFM_REQ_MAY_SLEEP;
+        desc->flags = 0;
 
         err = crypto_shash_digest(desc, cc->key, cc->key_size, essiv->salt);
         shash_desc_zero(desc);
@@ -606,7 +606,7 @@ static int crypt_iv_lmk_one(struct crypt_config *cc, u8 *iv,
         int i, r;
 
         desc->tfm = lmk->hash_tfm;
-        desc->flags = CRYPTO_TFM_REQ_MAY_SLEEP;
+        desc->flags = 0;
 
         r = crypto_shash_init(desc);
         if (r)
@@ -768,7 +768,7 @@ static int crypt_iv_tcw_whitening(struct crypt_config *cc,
 
         /* calculate crc32 for every 32bit part and xor it */
         desc->tfm = tcw->crc32_tfm;
-        desc->flags = CRYPTO_TFM_REQ_MAY_SLEEP;
+        desc->flags = 0;
         for (i = 0; i < 4; i++) {
                 r = crypto_shash_init(desc);
                 if (r)
@@ -1251,7 +1251,7 @@ static void crypt_alloc_req_skcipher(struct crypt_config *cc,
          * requests if driver request queue is full.
          */
         skcipher_request_set_callback(ctx->r.req,
-            CRYPTO_TFM_REQ_MAY_BACKLOG | CRYPTO_TFM_REQ_MAY_SLEEP,
+            CRYPTO_TFM_REQ_MAY_BACKLOG,
             kcryptd_async_done, dmreq_of_req(cc, ctx->r.req));
 }
 
@@ -1268,7 +1268,7 @@ static void crypt_alloc_req_aead(struct crypt_config *cc,
          * requests if driver request queue is full.
          */
         aead_request_set_callback(ctx->r.req_aead,
-            CRYPTO_TFM_REQ_MAY_BACKLOG | CRYPTO_TFM_REQ_MAY_SLEEP,
+            CRYPTO_TFM_REQ_MAY_BACKLOG,
             kcryptd_async_done, dmreq_of_req(cc, ctx->r.req_aead));
 }
 
diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c
index 378878599466..89ccb64342de 100644
--- a/drivers/md/dm-integrity.c
+++ b/drivers/md/dm-integrity.c
@@ -532,7 +532,7 @@ static void section_mac(struct dm_integrity_c *ic, unsigned section, __u8 result
         unsigned j, size;
 
         desc->tfm = ic->journal_mac;
-        desc->flags = CRYPTO_TFM_REQ_MAY_SLEEP;
+        desc->flags = 0;
 
         r = crypto_shash_init(desc);
         if (unlikely(r)) {
@@ -676,7 +676,7 @@ static void complete_journal_encrypt(struct crypto_async_request *req, int err)
 static bool do_crypt(bool encrypt, struct skcipher_request *req, struct journal_completion *comp)
 {
         int r;
-        skcipher_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG | CRYPTO_TFM_REQ_MAY_SLEEP,
+        skcipher_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
                                       complete_journal_encrypt, comp);
         if (likely(encrypt))
                 r = crypto_skcipher_encrypt(req);
diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c
index cae689de75fd..5ba067fa0c72 100644
--- a/drivers/md/dm-raid.c
+++ b/drivers/md/dm-raid.c
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2010-2011 Neil Brown
- * Copyright (C) 2010-2017 Red Hat, Inc. All rights reserved.
+ * Copyright (C) 2010-2018 Red Hat, Inc. All rights reserved.
  *
  * This file is released under the GPL.
  */
@@ -29,9 +29,6 @@
  */
 #define MIN_RAID456_JOURNAL_SPACE (4*2048)
 
-/* Global list of all raid sets */
-static LIST_HEAD(raid_sets);
-
 static bool devices_handle_discard_safely = false;
 
 /*
@@ -227,7 +224,6 @@ struct rs_layout {
 
 struct raid_set {
         struct dm_target *ti;
-        struct list_head list;
 
         uint32_t stripe_cache_entries;
         unsigned long ctr_flags;
@@ -273,19 +269,6 @@ static void rs_config_restore(struct raid_set *rs, struct rs_layout *l)
         mddev->new_chunk_sectors = l->new_chunk_sectors;
 }
 
-/* Find any raid_set in active slot for @rs on global list */
-static struct raid_set *rs_find_active(struct raid_set *rs)
-{
-        struct raid_set *r;
-        struct mapped_device *md = dm_table_get_md(rs->ti->table);
-
-        list_for_each_entry(r, &raid_sets, list)
-                if (r != rs && dm_table_get_md(r->ti->table) == md)
-                        return r;
-
-        return NULL;
-}
-
 /* raid10 algorithms (i.e. formats) */
 #define ALGORITHM_RAID10_DEFAULT        0
 #define ALGORITHM_RAID10_NEAR           1
@@ -764,7 +747,6 @@ static struct raid_set *raid_set_alloc(struct dm_target *ti, struct raid_type *r
 
         mddev_init(&rs->md);
 
-        INIT_LIST_HEAD(&rs->list);
         rs->raid_disks = raid_devs;
         rs->delta_disks = 0;
 
@@ -782,9 +764,6 @@ static struct raid_set *raid_set_alloc(struct dm_target *ti, struct raid_type *r
         for (i = 0; i < raid_devs; i++)
                 md_rdev_init(&rs->dev[i].rdev);
 
-        /* Add @rs to global list. */
-        list_add(&rs->list, &raid_sets);
-
         /*
          * Remaining items to be initialized by further RAID params:
          *  rs->md.persistent
@@ -797,7 +776,7 @@ static struct raid_set *raid_set_alloc(struct dm_target *ti, struct raid_type *r
         return rs;
 }
 
-/* Free all @rs allocations and remove it from global list. */
+/* Free all @rs allocations */
 static void raid_set_free(struct raid_set *rs)
 {
         int i;
@@ -815,8 +794,6 @@ static void raid_set_free(struct raid_set *rs)
                         dm_put_device(rs->ti, rs->dev[i].data_dev);
         }
 
-        list_del(&rs->list);
-
         kfree(rs);
 }
 
@@ -2649,7 +2626,7 @@ static int rs_adjust_data_offsets(struct raid_set *rs)
                 return 0;
         }
 
-        /* HM FIXME: get InSync raid_dev? */
+        /* HM FIXME: get In_Sync raid_dev? */
         rdev = &rs->dev[0].rdev;
 
         if (rs->delta_disks < 0) {
@@ -3149,6 +3126,11 @@ static int raid_ctr(struct dm_target *ti, unsigned int argc, char **argv)
                 set_bit(RT_FLAG_UPDATE_SBS, &rs->runtime_flags);
                 rs_set_new(rs);
         } else if (rs_is_recovering(rs)) {
+                /* Rebuild particular devices */
+                if (test_bit(__CTR_FLAG_REBUILD, &rs->ctr_flags)) {
+                        set_bit(RT_FLAG_UPDATE_SBS, &rs->runtime_flags);
+                        rs_setup_recovery(rs, MaxSector);
+                }
                 /* A recovering raid set may be resized */
                 ; /* skip setup rs */
         } else if (rs_is_reshaping(rs)) {
@@ -3242,6 +3224,8 @@ static int raid_ctr(struct dm_target *ti, unsigned int argc, char **argv)
         /* Start raid set read-only and assumed clean to change in raid_resume() */
         rs->md.ro = 1;
         rs->md.in_sync = 1;
+
+        /* Keep array frozen */
         set_bit(MD_RECOVERY_FROZEN, &rs->md.recovery);
 
         /* Has to be held on running the array */
@@ -3265,7 +3249,7 @@ static int raid_ctr(struct dm_target *ti, unsigned int argc, char **argv)
         rs->callbacks.congested_fn = raid_is_congested;
         dm_table_add_target_callbacks(ti->table, &rs->callbacks);
 
-        /* If raid4/5/6 journal mode explictely requested (only possible with journal dev) -> set it */
+        /* If raid4/5/6 journal mode explicitly requested (only possible with journal dev) -> set it */
         if (test_bit(__CTR_FLAG_JOURNAL_MODE, &rs->ctr_flags)) {
                 r = r5c_journal_mode_set(&rs->md, rs->journal_dev.mode);
                 if (r) {
@@ -3350,32 +3334,53 @@ static int raid_map(struct dm_target *ti, struct bio *bio)
         return DM_MAPIO_SUBMITTED;
 }
 
-/* Return string describing the current sync action of @mddev */
-static const char *decipher_sync_action(struct mddev *mddev, unsigned long recovery)
+/* Return sync state string for @state */
+enum sync_state { st_frozen, st_reshape, st_resync, st_check, st_repair, st_recover, st_idle };
+static const char *sync_str(enum sync_state state)
+{
+        /* Has to be in above sync_state order! */
+        static const char *sync_strs[] = {
+                "frozen",
+                "reshape",
+                "resync",
+                "check",
+                "repair",
+                "recover",
+                "idle"
+        };
+
+        return __within_range(state, 0, ARRAY_SIZE(sync_strs) - 1) ? sync_strs[state] : "undef";
+};
+
+/* Return enum sync_state for @mddev derived from @recovery flags */
+static const enum sync_state decipher_sync_action(struct mddev *mddev, unsigned long recovery)
 {
         if (test_bit(MD_RECOVERY_FROZEN, &recovery))
-                return "frozen";
+                return st_frozen;
 
-        /* The MD sync thread can be done with io but still be running */
+        /* The MD sync thread can be done with io or be interrupted but still be running */
         if (!test_bit(MD_RECOVERY_DONE, &recovery) &&
             (test_bit(MD_RECOVERY_RUNNING, &recovery) ||
              (!mddev->ro && test_bit(MD_RECOVERY_NEEDED, &recovery)))) {
                 if (test_bit(MD_RECOVERY_RESHAPE, &recovery))
-                        return "reshape";
+                        return st_reshape;
 
                 if (test_bit(MD_RECOVERY_SYNC, &recovery)) {
                         if (!test_bit(MD_RECOVERY_REQUESTED, &recovery))
-                                return "resync";
-                        else if (test_bit(MD_RECOVERY_CHECK, &recovery))
-                                return "check";
-                        return "repair";
+                                return st_resync;
+                        if (test_bit(MD_RECOVERY_CHECK, &recovery))
+                                return st_check;
+                        return st_repair;
                 }
 
                 if (test_bit(MD_RECOVERY_RECOVER, &recovery))
-                        return "recover";
+                        return st_recover;
+
+                if (mddev->reshape_position != MaxSector)
+                        return st_reshape;
         }
 
-        return "idle";
+        return st_idle;
 }
 
 /*
@@ -3409,6 +3414,7 @@ static sector_t rs_get_progress(struct raid_set *rs, unsigned long recovery,
                                 sector_t resync_max_sectors)
 {
         sector_t r;
+        enum sync_state state;
         struct mddev *mddev = &rs->md;
 
         clear_bit(RT_FLAG_RS_IN_SYNC, &rs->runtime_flags);
@@ -3419,20 +3425,14 @@ static sector_t rs_get_progress(struct raid_set *rs, unsigned long recovery,
                 set_bit(RT_FLAG_RS_IN_SYNC, &rs->runtime_flags);
 
         } else {
-                if (!test_bit(__CTR_FLAG_NOSYNC, &rs->ctr_flags) &&
-                    !test_bit(MD_RECOVERY_INTR, &recovery) &&
-                    (test_bit(MD_RECOVERY_NEEDED, &recovery) ||
-                     test_bit(MD_RECOVERY_RESHAPE, &recovery) ||
-                     test_bit(MD_RECOVERY_RUNNING, &recovery)))
-                        r = mddev->curr_resync_completed;
-                else
+                state = decipher_sync_action(mddev, recovery);
+
+                if (state == st_idle && !test_bit(MD_RECOVERY_INTR, &recovery))
                         r = mddev->recovery_cp;
+                else
+                        r = mddev->curr_resync_completed;
 
-                if (r >= resync_max_sectors &&
-                    (!test_bit(MD_RECOVERY_REQUESTED, &recovery) ||
-                     (!test_bit(MD_RECOVERY_FROZEN, &recovery) &&
-                      !test_bit(MD_RECOVERY_NEEDED, &recovery) &&
-                      !test_bit(MD_RECOVERY_RUNNING, &recovery)))) {
+                if (state == st_idle && r >= resync_max_sectors) {
                         /*
                          * Sync complete.
                          */
@@ -3440,24 +3440,20 @@ static sector_t rs_get_progress(struct raid_set *rs, unsigned long recovery,
                         if (test_bit(MD_RECOVERY_RECOVER, &recovery))
                                 set_bit(RT_FLAG_RS_IN_SYNC, &rs->runtime_flags);
 
-                } else if (test_bit(MD_RECOVERY_RECOVER, &recovery)) {
+                } else if (state == st_recover)
                         /*
                          * In case we are recovering, the array is not in sync
                          * and health chars should show the recovering legs.
                          */
                         ;
-
-                } else if (test_bit(MD_RECOVERY_SYNC, &recovery) &&
-                           !test_bit(MD_RECOVERY_REQUESTED, &recovery)) {
+                else if (state == st_resync)
                         /*
                          * If "resync" is occurring, the raid set
                          * is or may be out of sync hence the health
                          * characters shall be 'a'.
                          */
                         set_bit(RT_FLAG_RS_RESYNCING, &rs->runtime_flags);
-
-                } else if (test_bit(MD_RECOVERY_RESHAPE, &recovery) &&
-                           !test_bit(MD_RECOVERY_REQUESTED, &recovery)) {
+                else if (state == st_reshape)
                         /*
                          * If "reshape" is occurring, the raid set
                          * is or may be out of sync hence the health
@@ -3465,7 +3461,7 @@ static sector_t rs_get_progress(struct raid_set *rs, unsigned long recovery,
                          */
                         set_bit(RT_FLAG_RS_RESYNCING, &rs->runtime_flags);
 
-                } else if (test_bit(MD_RECOVERY_REQUESTED, &recovery)) {
+                else if (state == st_check || state == st_repair)
                         /*
                          * If "check" or "repair" is occurring, the raid set has
                          * undergone an initial sync and the health characters
@@ -3473,12 +3469,12 @@ static sector_t rs_get_progress(struct raid_set *rs, unsigned long recovery,
                          */
                         set_bit(RT_FLAG_RS_IN_SYNC, &rs->runtime_flags);
 
-                } else {
+                else {
                         struct md_rdev *rdev;
 
                         /*
                          * We are idle and recovery is needed, prevent 'A' chars race
-                         * caused by components still set to in-sync by constrcuctor.
+                         * caused by components still set to in-sync by constructor.
                          */
                         if (test_bit(MD_RECOVERY_NEEDED, &recovery))
                                 set_bit(RT_FLAG_RS_RESYNCING, &rs->runtime_flags);
@@ -3542,7 +3538,7 @@ static void raid_status(struct dm_target *ti, status_type_t type,
                 progress = rs_get_progress(rs, recovery, resync_max_sectors);
                 resync_mismatches = (mddev->last_sync_action && !strcasecmp(mddev->last_sync_action, "check")) ?
                                     atomic64_read(&mddev->resync_mismatches) : 0;
-                sync_action = decipher_sync_action(&rs->md, recovery);
+                sync_action = sync_str(decipher_sync_action(&rs->md, recovery));
 
                 /* HM FIXME: do we want another state char for raid0? It shows 'D'/'A'/'-' now */
                 for (i = 0; i < rs->raid_disks; i++)
@@ -3892,14 +3888,13 @@ static int rs_start_reshape(struct raid_set *rs)
         struct mddev *mddev = &rs->md;
         struct md_personality *pers = mddev->pers;
 
+        /* Don't allow the sync thread to work until the table gets reloaded. */
+        set_bit(MD_RECOVERY_WAIT, &mddev->recovery);
+
         r = rs_setup_reshape(rs);
         if (r)
                 return r;
 
-        /* Need to be resumed to be able to start reshape, recovery is frozen until raid_resume() though */
-        if (test_and_clear_bit(RT_FLAG_RS_SUSPENDED, &rs->runtime_flags))
-                mddev_resume(mddev);
-
         /*
          * Check any reshape constraints enforced by the personalility
          *
@@ -3923,10 +3918,6 @@ static int rs_start_reshape(struct raid_set *rs)
                 }
         }
 
-        /* Suspend because a resume will happen in raid_resume() */
-        set_bit(RT_FLAG_RS_SUSPENDED, &rs->runtime_flags);
-        mddev_suspend(mddev);
-
         /*
          * Now reshape got set up, update superblocks to
          * reflect the fact so that a table reload will
@@ -3947,29 +3938,6 @@ static int raid_preresume(struct dm_target *ti)
         if (test_and_set_bit(RT_FLAG_RS_PRERESUMED, &rs->runtime_flags))
                 return 0;
 
-        if (!test_bit(__CTR_FLAG_REBUILD, &rs->ctr_flags)) {
-                struct raid_set *rs_active = rs_find_active(rs);
-
-                if (rs_active) {
-                        /*
-                         * In case no rebuilds have been requested
-                         * and an active table slot exists, copy
-                         * current resynchonization completed and
-                         * reshape position pointers across from
-                         * suspended raid set in the active slot.
-                         *
-                         * This resumes the new mapping at current
-                         * offsets to continue recover/reshape without
-                         * necessarily redoing a raid set partially or
-                         * causing data corruption in case of a reshape.
-                         */
-                        if (rs_active->md.curr_resync_completed != MaxSector)
-                                mddev->curr_resync_completed = rs_active->md.curr_resync_completed;
-                        if (rs_active->md.reshape_position != MaxSector)
-                                mddev->reshape_position = rs_active->md.reshape_position;
-                }
-        }
-
         /*
          * The superblocks need to be updated on disk if the
          * array is new or new devices got added (thus zeroed
@@ -4046,7 +4014,7 @@ static void raid_resume(struct dm_target *ti)
 
 static struct target_type raid_target = {
         .name = "raid",
-        .version = {1, 13, 2},
+        .version = {1, 14, 0},
         .module = THIS_MODULE,
         .ctr = raid_ctr,
         .dtr = raid_dtr,
diff --git a/drivers/md/dm-thin-metadata.c b/drivers/md/dm-thin-metadata.c
index 72142021b5c9..74f6770c70b1 100644
--- a/drivers/md/dm-thin-metadata.c
+++ b/drivers/md/dm-thin-metadata.c
@@ -189,6 +189,12 @@ struct dm_pool_metadata {
         sector_t data_block_size;
 
         /*
+         * We reserve a section of the metadata for commit overhead.
+         * All reported space does *not* include this.
+         */
+        dm_block_t metadata_reserve;
+
+        /*
          * Set if a transaction has to be aborted but the attempt to roll back
          * to the previous (good) transaction failed.  The only pool metadata
          * operation possible in this state is the closing of the device.
@@ -816,6 +822,22 @@ static int __commit_transaction(struct dm_pool_metadata *pmd)
         return dm_tm_commit(pmd->tm, sblock);
 }
 
+static void __set_metadata_reserve(struct dm_pool_metadata *pmd)
+{
+        int r;
+        dm_block_t total;
+        dm_block_t max_blocks = 4096; /* 16M */
+
+        r = dm_sm_get_nr_blocks(pmd->metadata_sm, &total);
+        if (r) {
+                DMERR("could not get size of metadata device");
+                pmd->metadata_reserve = max_blocks;
+        } else {
+                sector_div(total, 10);
+                pmd->metadata_reserve = min(max_blocks, total);
+        }
+}
+
 struct dm_pool_metadata *dm_pool_metadata_open(struct block_device *bdev,
                                                sector_t data_block_size,
                                                bool format_device)
@@ -849,6 +871,8 @@ struct dm_pool_metadata *dm_pool_metadata_open(struct block_device *bdev,
                 return ERR_PTR(r);
         }
 
+        __set_metadata_reserve(pmd);
+
         return pmd;
 }
 
@@ -1820,6 +1844,13 @@ int dm_pool_get_free_metadata_block_count(struct dm_pool_metadata *pmd,
         down_read(&pmd->root_lock);
         if (!pmd->fail_io)
                 r = dm_sm_get_nr_free(pmd->metadata_sm, result);
+
+        if (!r) {
+                if (*result < pmd->metadata_reserve)
+                        *result = 0;
+                else
+                        *result -= pmd->metadata_reserve;
+        }
         up_read(&pmd->root_lock);
 
         return r;
@@ -1932,8 +1963,11 @@ int dm_pool_resize_metadata_dev(struct dm_pool_metadata *pmd, dm_block_t new_cou
         int r = -EINVAL;
 
         down_write(&pmd->root_lock);
-        if (!pmd->fail_io)
+        if (!pmd->fail_io) {
                 r = __resize_space_map(pmd->metadata_sm, new_count);
+                if (!r)
+                        __set_metadata_reserve(pmd);
+        }
         up_write(&pmd->root_lock);
 
         return r;
diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
index 7bd60a150f8f..aaf1ad481ee8 100644
--- a/drivers/md/dm-thin.c
+++ b/drivers/md/dm-thin.c
@@ -200,7 +200,13 @@ struct dm_thin_new_mapping;
 enum pool_mode {
         PM_WRITE,               /* metadata may be changed */
         PM_OUT_OF_DATA_SPACE,   /* metadata may be changed, though data may not be allocated */
+
+        /*
+         * Like READ_ONLY, except may switch back to WRITE on metadata resize. Reported as READ_ONLY.
+         */
+        PM_OUT_OF_METADATA_SPACE,
         PM_READ_ONLY,           /* metadata may not be changed */
+
         PM_FAIL,                /* all I/O fails */
 };
 
@@ -1371,7 +1377,35 @@ static void set_pool_mode(struct pool *pool, enum pool_mode new_mode);
 
 static void requeue_bios(struct pool *pool);
 
-static void check_for_space(struct pool *pool)
+static bool is_read_only_pool_mode(enum pool_mode mode)
+{
+        return (mode == PM_OUT_OF_METADATA_SPACE || mode == PM_READ_ONLY);
+}
+
+static bool is_read_only(struct pool *pool)
+{
+        return is_read_only_pool_mode(get_pool_mode(pool));
+}
+
+static void check_for_metadata_space(struct pool *pool)
+{
+        int r;
+        const char *ooms_reason = NULL;
+        dm_block_t nr_free;
+
+        r = dm_pool_get_free_metadata_block_count(pool->pmd, &nr_free);
+        if (r)
+                ooms_reason = "Could not get free metadata blocks";
+        else if (!nr_free)
+                ooms_reason = "No free metadata blocks";
+
+        if (ooms_reason && !is_read_only(pool)) {
+                DMERR("%s", ooms_reason);
+                set_pool_mode(pool, PM_OUT_OF_METADATA_SPACE);
+        }
+}
+
+static void check_for_data_space(struct pool *pool)
 {
         int r;
         dm_block_t nr_free;
@@ -1397,14 +1431,16 @@ static int commit(struct pool *pool)
 {
         int r;
 
-        if (get_pool_mode(pool) >= PM_READ_ONLY)
+        if (get_pool_mode(pool) >= PM_OUT_OF_METADATA_SPACE)
                 return -EINVAL;
 
         r = dm_pool_commit_metadata(pool->pmd);
         if (r)
                 metadata_operation_failed(pool, "dm_pool_commit_metadata", r);
-        else
-                check_for_space(pool);
+        else {
+                check_for_metadata_space(pool);
+                check_for_data_space(pool);
+        }
 
         return r;
 }
@@ -1470,6 +1506,19 @@ static int alloc_data_block(struct thin_c *tc, dm_block_t *result)
                 return r;
         }
 
+        r = dm_pool_get_free_metadata_block_count(pool->pmd, &free_blocks);
+        if (r) {
+                metadata_operation_failed(pool, "dm_pool_get_free_metadata_block_count", r);
+                return r;
+        }
+
+        if (!free_blocks) {
+                /* Let's commit before we use up the metadata reserve. */
+                r = commit(pool);
+                if (r)
+                        return r;
+        }
+
         return 0;
 }
 
@@ -1501,6 +1550,7 @@ static blk_status_t should_error_unserviceable_bio(struct pool *pool)
         case PM_OUT_OF_DATA_SPACE:
                 return pool->pf.error_if_no_space ? BLK_STS_NOSPC : 0;
 
+        case PM_OUT_OF_METADATA_SPACE:
         case PM_READ_ONLY:
         case PM_FAIL:
                 return BLK_STS_IOERR;
@@ -2464,8 +2514,9 @@ static void set_pool_mode(struct pool *pool, enum pool_mode new_mode)
                 error_retry_list(pool);
                 break;
 
+        case PM_OUT_OF_METADATA_SPACE:
         case PM_READ_ONLY:
-                if (old_mode != new_mode)
+                if (!is_read_only_pool_mode(old_mode))
                         notify_of_pool_mode_change(pool, "read-only");
                 dm_pool_metadata_read_only(pool->pmd);
                 pool->process_bio = process_bio_read_only;
@@ -3403,6 +3454,10 @@ static int maybe_resize_metadata_dev(struct dm_target *ti, bool *need_commit)
                 DMINFO("%s: growing the metadata device from %llu to %llu blocks",
                        dm_device_name(pool->pool_md),
                        sb_metadata_dev_size, metadata_dev_size);
+
+                if (get_pool_mode(pool) == PM_OUT_OF_METADATA_SPACE)
+                        set_pool_mode(pool, PM_WRITE);
+
                 r = dm_pool_resize_metadata_dev(pool->pmd, metadata_dev_size);
                 if (r) {
                         metadata_operation_failed(pool, "dm_pool_resize_metadata_dev", r);
@@ -3707,7 +3762,7 @@ static int pool_message(struct dm_target *ti, unsigned argc, char **argv,
         struct pool_c *pt = ti->private;
         struct pool *pool = pt->pool;
 
-        if (get_pool_mode(pool) >= PM_READ_ONLY) {
+        if (get_pool_mode(pool) >= PM_OUT_OF_METADATA_SPACE) {
                 DMERR("%s: unable to service pool target messages in READ_ONLY or FAIL mode",
                       dm_device_name(pool->pool_md));
                 return -EOPNOTSUPP;
@@ -3781,6 +3836,7 @@ static void pool_status(struct dm_target *ti, status_type_t type,
         dm_block_t nr_blocks_data;
         dm_block_t nr_blocks_metadata;
         dm_block_t held_root;
+        enum pool_mode mode;
         char buf[BDEVNAME_SIZE];
         char buf2[BDEVNAME_SIZE];
         struct pool_c *pt = ti->private;
@@ -3851,9 +3907,10 @@ static void pool_status(struct dm_target *ti, status_type_t type,
                 else
                         DMEMIT("- ");
 
-                if (pool->pf.mode == PM_OUT_OF_DATA_SPACE)
+                mode = get_pool_mode(pool);
+                if (mode == PM_OUT_OF_DATA_SPACE)
                         DMEMIT("out_of_data_space ");
-                else if (pool->pf.mode == PM_READ_ONLY)
+                else if (is_read_only_pool_mode(mode))
                         DMEMIT("ro ");
                 else
                         DMEMIT("rw ");
diff --git a/drivers/md/dm-verity-target.c b/drivers/md/dm-verity-target.c
index 12decdbd722d..fc65f0dedf7f 100644
--- a/drivers/md/dm-verity-target.c
+++ b/drivers/md/dm-verity-target.c
@@ -99,10 +99,26 @@ static int verity_hash_update(struct dm_verity *v, struct ahash_request *req,
 {
         struct scatterlist sg;
 
-        sg_init_one(&sg, data, len);
-        ahash_request_set_crypt(req, &sg, NULL, len);
-
-        return crypto_wait_req(crypto_ahash_update(req), wait);
+        if (likely(!is_vmalloc_addr(data))) {
+                sg_init_one(&sg, data, len);
+                ahash_request_set_crypt(req, &sg, NULL, len);
+                return crypto_wait_req(crypto_ahash_update(req), wait);
+        } else {
+                do {
+                        int r;
+                        size_t this_step = min_t(size_t, len, PAGE_SIZE - offset_in_page(data));
+                        flush_kernel_vmap_range((void *)data, this_step);
+                        sg_init_table(&sg, 1);
+                        sg_set_page(&sg, vmalloc_to_page(data), this_step, offset_in_page(data));
+                        ahash_request_set_crypt(req, &sg, NULL, this_step);
+                        r = crypto_wait_req(crypto_ahash_update(req), wait);
+                        if (unlikely(r))
+                                return r;
+                        data += this_step;
+                        len -= this_step;
+                } while (len);
+                return 0;
+        }
 }
 
 /*
diff --git a/drivers/md/md-cluster.c b/drivers/md/md-cluster.c
index 94329e03001e..0b2af6e74fc3 100644
--- a/drivers/md/md-cluster.c
+++ b/drivers/md/md-cluster.c
@@ -1276,18 +1276,18 @@ static int resync_info_update(struct mddev *mddev, sector_t lo, sector_t hi)
 static int resync_finish(struct mddev *mddev)
 {
         struct md_cluster_info *cinfo = mddev->cluster_info;
+        int ret = 0;
 
         clear_bit(MD_RESYNCING_REMOTE, &mddev->recovery);
-        dlm_unlock_sync(cinfo->resync_lockres);
 
         /*
          * If resync thread is interrupted so we can't say resync is finished,
          * another node will launch resync thread to continue.
          */
-        if (test_bit(MD_CLOSING, &mddev->flags))
-                return 0;
-        else
-                return resync_info_update(mddev, 0, 0);
+        if (!test_bit(MD_CLOSING, &mddev->flags))
+                ret = resync_info_update(mddev, 0, 0);
+        dlm_unlock_sync(cinfo->resync_lockres);
+        return ret;
 }
 
 static int area_resyncing(struct mddev *mddev, int direction,
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 981898049491..d6f7978b4449 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -4529,11 +4529,12 @@ static sector_t reshape_request(struct mddev *mddev, sector_t sector_nr,
                 allow_barrier(conf);
         }
 
+        raise_barrier(conf, 0);
 read_more:
         /* Now schedule reads for blocks from sector_nr to last */
         r10_bio = raid10_alloc_init_r10buf(conf);
         r10_bio->state = 0;
-        raise_barrier(conf, sectors_done != 0);
+        raise_barrier(conf, 1);
         atomic_set(&r10_bio->remaining, 0);
         r10_bio->mddev = mddev;
         r10_bio->sector = sector_nr;
@@ -4629,6 +4630,8 @@ read_more:
         if (sector_nr <= last)
                 goto read_more;
 
+        lower_barrier(conf);
+
         /* Now that we have done the whole section we can
          * update reshape_progress
          */
diff --git a/drivers/md/raid5-log.h b/drivers/md/raid5-log.h
index a001808a2b77..bfb811407061 100644
--- a/drivers/md/raid5-log.h
+++ b/drivers/md/raid5-log.h
@@ -46,6 +46,11 @@ extern int ppl_modify_log(struct r5conf *conf, struct md_rdev *rdev, bool add);
 extern void ppl_quiesce(struct r5conf *conf, int quiesce);
 extern int ppl_handle_flush_request(struct r5l_log *log, struct bio *bio);
 
+static inline bool raid5_has_log(struct r5conf *conf)
+{
+        return test_bit(MD_HAS_JOURNAL, &conf->mddev->flags);
+}
+
 static inline bool raid5_has_ppl(struct r5conf *conf)
 {
         return test_bit(MD_HAS_PPL, &conf->mddev->flags);
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 4ce0d7502fad..e4e98f47865d 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -733,7 +733,7 @@ static bool stripe_can_batch(struct stripe_head *sh)
 {
         struct r5conf *conf = sh->raid_conf;
 
-        if (conf->log || raid5_has_ppl(conf))
+        if (raid5_has_log(conf) || raid5_has_ppl(conf))
                 return false;
         return test_bit(STRIPE_BATCH_READY, &sh->state) &&
                 !test_bit(STRIPE_BITMAP_PENDING, &sh->state) &&
@@ -7737,7 +7737,7 @@ static int raid5_resize(struct mddev *mddev, sector_t sectors)
         sector_t newsize;
         struct r5conf *conf = mddev->private;
 
-        if (conf->log || raid5_has_ppl(conf))
+        if (raid5_has_log(conf) || raid5_has_ppl(conf))
                 return -EINVAL;
         sectors &= ~((sector_t)conf->chunk_sectors - 1);
         newsize = raid5_size(mddev, sectors, mddev->raid_disks);
@@ -7788,7 +7788,7 @@ static int check_reshape(struct mddev *mddev)
 {
         struct r5conf *conf = mddev->private;
 
-        if (conf->log || raid5_has_ppl(conf))
+        if (raid5_has_log(conf) || raid5_has_ppl(conf))
                 return -EINVAL;
         if (mddev->delta_disks == 0 &&
             mddev->new_layout == mddev->layout &&
diff --git a/drivers/media/i2c/mt9v111.c b/drivers/media/i2c/mt9v111.c
index b5410aeb5fe2..bb41bea950ac 100644
--- a/drivers/media/i2c/mt9v111.c
+++ b/drivers/media/i2c/mt9v111.c
@@ -1159,41 +1159,21 @@ static int mt9v111_probe(struct i2c_client *client)
                                               V4L2_CID_AUTO_WHITE_BALANCE,
                                               0, 1, 1,
                                               V4L2_WHITE_BALANCE_AUTO);
-        if (IS_ERR_OR_NULL(mt9v111->auto_awb)) {
-                ret = PTR_ERR(mt9v111->auto_awb);
-                goto error_free_ctrls;
-        }
-
         mt9v111->auto_exp = v4l2_ctrl_new_std_menu(&mt9v111->ctrls,
                                                    &mt9v111_ctrl_ops,
                                                    V4L2_CID_EXPOSURE_AUTO,
                                                    V4L2_EXPOSURE_MANUAL,
                                                    0, V4L2_EXPOSURE_AUTO);
-        if (IS_ERR_OR_NULL(mt9v111->auto_exp)) {
-                ret = PTR_ERR(mt9v111->auto_exp);
-                goto error_free_ctrls;
-        }
-
-        /* Initialize timings */
         mt9v111->hblank = v4l2_ctrl_new_std(&mt9v111->ctrls, &mt9v111_ctrl_ops,
                                             V4L2_CID_HBLANK,
                                             MT9V111_CORE_R05_MIN_HBLANK,
                                             MT9V111_CORE_R05_MAX_HBLANK, 1,
                                             MT9V111_CORE_R05_DEF_HBLANK);
-        if (IS_ERR_OR_NULL(mt9v111->hblank)) {
-                ret = PTR_ERR(mt9v111->hblank);
-                goto error_free_ctrls;
-        }
-
         mt9v111->vblank = v4l2_ctrl_new_std(&mt9v111->ctrls, &mt9v111_ctrl_ops,
                                             V4L2_CID_VBLANK,
                                             MT9V111_CORE_R06_MIN_VBLANK,
                                             MT9V111_CORE_R06_MAX_VBLANK, 1,
                                             MT9V111_CORE_R06_DEF_VBLANK);
-        if (IS_ERR_OR_NULL(mt9v111->vblank)) {
-                ret = PTR_ERR(mt9v111->vblank);
-                goto error_free_ctrls;
-        }
 
         /* PIXEL_RATE is fixed: just expose it to user space. */
         v4l2_ctrl_new_std(&mt9v111->ctrls, &mt9v111_ctrl_ops,
@@ -1201,6 +1181,10 @@ static int mt9v111_probe(struct i2c_client *client)
                           DIV_ROUND_CLOSEST(mt9v111->sysclk, 2), 1,
                           DIV_ROUND_CLOSEST(mt9v111->sysclk, 2));
 
+        if (mt9v111->ctrls.error) {
+                ret = mt9v111->ctrls.error;
+                goto error_free_ctrls;
+        }
         mt9v111->sd.ctrl_handler = &mt9v111->ctrls;
 
         /* Start with default configuration: 640x480 UYVY. */
@@ -1226,26 +1210,27 @@ static int mt9v111_probe(struct i2c_client *client)
         mt9v111->pad.flags      = MEDIA_PAD_FL_SOURCE;
         ret = media_entity_pads_init(&mt9v111->sd.entity, 1, &mt9v111->pad);
         if (ret)
-                goto error_free_ctrls;
+                goto error_free_entity;
 #endif
 
         ret = mt9v111_chip_probe(mt9v111);
         if (ret)
-                goto error_free_ctrls;
+                goto error_free_entity;
 
         ret = v4l2_async_register_subdev(&mt9v111->sd);
         if (ret)
-                goto error_free_ctrls;
+                goto error_free_entity;
 
         return 0;
 
-error_free_ctrls:
-        v4l2_ctrl_handler_free(&mt9v111->ctrls);
-
+error_free_entity:
 #if IS_ENABLED(CONFIG_MEDIA_CONTROLLER)
         media_entity_cleanup(&mt9v111->sd.entity);
 #endif
 
+error_free_ctrls:
+        v4l2_ctrl_handler_free(&mt9v111->ctrls);
+
         mutex_destroy(&mt9v111->pwr_mutex);
         mutex_destroy(&mt9v111->stream_mutex);
 
@@ -1259,12 +1244,12 @@ static int mt9v111_remove(struct i2c_client *client)
 
         v4l2_async_unregister_subdev(sd);
 
-        v4l2_ctrl_handler_free(&mt9v111->ctrls);
-
 #if IS_ENABLED(CONFIG_MEDIA_CONTROLLER)
         media_entity_cleanup(&sd->entity);
 #endif
 
+        v4l2_ctrl_handler_free(&mt9v111->ctrls);
+
         mutex_destroy(&mt9v111->pwr_mutex);
         mutex_destroy(&mt9v111->stream_mutex);
 
diff --git a/drivers/media/platform/Kconfig b/drivers/media/platform/Kconfig
index 94c1fe0e9787..54fe90acb5b2 100644
--- a/drivers/media/platform/Kconfig
+++ b/drivers/media/platform/Kconfig
@@ -541,6 +541,8 @@ config VIDEO_CROS_EC_CEC
         depends on MFD_CROS_EC
         select CEC_CORE
         select CEC_NOTIFIER
+        select CHROME_PLATFORMS
+        select CROS_EC_PROTO
         ---help---
           If you say yes here you will get support for the
           ChromeOS Embedded Controller's CEC.
diff --git a/drivers/media/platform/qcom/camss/camss-csid.c b/drivers/media/platform/qcom/camss/camss-csid.c
index 729b31891466..a5ae85674ffb 100644
--- a/drivers/media/platform/qcom/camss/camss-csid.c
+++ b/drivers/media/platform/qcom/camss/camss-csid.c
@@ -10,6 +10,7 @@
 #include <linux/clk.h>
 #include <linux/completion.h>
 #include <linux/interrupt.h>
+#include <linux/io.h>
 #include <linux/kernel.h>
 #include <linux/of.h>
 #include <linux/platform_device.h>
diff --git a/drivers/media/platform/qcom/camss/camss-csiphy-2ph-1-0.c b/drivers/media/platform/qcom/camss/camss-csiphy-2ph-1-0.c
index c832539397d7..12bce391d71f 100644
--- a/drivers/media/platform/qcom/camss/camss-csiphy-2ph-1-0.c
+++ b/drivers/media/platform/qcom/camss/camss-csiphy-2ph-1-0.c
@@ -12,6 +12,7 @@
 
 #include <linux/delay.h>
 #include <linux/interrupt.h>
+#include <linux/io.h>
 
 #define CAMSS_CSI_PHY_LNn_CFG2(n)               (0x004 + 0x40 * (n))
 #define CAMSS_CSI_PHY_LNn_CFG3(n)               (0x008 + 0x40 * (n))
diff --git a/drivers/media/platform/qcom/camss/camss-csiphy-3ph-1-0.c b/drivers/media/platform/qcom/camss/camss-csiphy-3ph-1-0.c
index bcd0dfd33618..2e65caf1ecae 100644
--- a/drivers/media/platform/qcom/camss/camss-csiphy-3ph-1-0.c
+++ b/drivers/media/platform/qcom/camss/camss-csiphy-3ph-1-0.c
@@ -12,6 +12,7 @@
 
 #include <linux/delay.h>
 #include <linux/interrupt.h>
+#include <linux/io.h>
 
 #define CSIPHY_3PH_LNn_CFG1(n)                  (0x000 + 0x100 * (n))
 #define CSIPHY_3PH_LNn_CFG1_SWI_REC_DLY_PRG     (BIT(7) | BIT(6))
diff --git a/drivers/media/platform/qcom/camss/camss-csiphy.c b/drivers/media/platform/qcom/camss/camss-csiphy.c
index 4559f3b1b38c..008afb85023b 100644
--- a/drivers/media/platform/qcom/camss/camss-csiphy.c
+++ b/drivers/media/platform/qcom/camss/camss-csiphy.c
@@ -10,6 +10,7 @@
 #include <linux/clk.h>
 #include <linux/delay.h>
 #include <linux/interrupt.h>
+#include <linux/io.h>
 #include <linux/kernel.h>
 #include <linux/of.h>
 #include <linux/platform_device.h>
diff --git a/drivers/media/platform/qcom/camss/camss-ispif.c b/drivers/media/platform/qcom/camss/camss-ispif.c
index 7f269021d08c..1f33b4eb198c 100644
--- a/drivers/media/platform/qcom/camss/camss-ispif.c
+++ b/drivers/media/platform/qcom/camss/camss-ispif.c
@@ -10,6 +10,7 @@
 #include <linux/clk.h>
 #include <linux/completion.h>
 #include <linux/interrupt.h>
+#include <linux/io.h>
 #include <linux/iopoll.h>
 #include <linux/kernel.h>
 #include <linux/mutex.h>
@@ -1076,8 +1077,8 @@ int msm_ispif_subdev_init(struct ispif_device *ispif,
         else
                 return -EINVAL;
 
-        ispif->line = kcalloc(ispif->line_num, sizeof(*ispif->line),
-                              GFP_KERNEL);
+        ispif->line = devm_kcalloc(dev, ispif->line_num, sizeof(*ispif->line),
+                                   GFP_KERNEL);
         if (!ispif->line)
                 return -ENOMEM;
 
diff --git a/drivers/media/platform/qcom/camss/camss-vfe-4-1.c b/drivers/media/platform/qcom/camss/camss-vfe-4-1.c
index da3a9fed9f2d..174a36be6f5d 100644
--- a/drivers/media/platform/qcom/camss/camss-vfe-4-1.c
+++ b/drivers/media/platform/qcom/camss/camss-vfe-4-1.c
@@ -9,6 +9,7 @@
  */
 
 #include <linux/interrupt.h>
+#include <linux/io.h>
 #include <linux/iopoll.h>
 
 #include "camss-vfe.h"
diff --git a/drivers/media/platform/qcom/camss/camss-vfe-4-7.c b/drivers/media/platform/qcom/camss/camss-vfe-4-7.c
index 4c584bffd179..0dca8bf9281e 100644
--- a/drivers/media/platform/qcom/camss/camss-vfe-4-7.c
+++ b/drivers/media/platform/qcom/camss/camss-vfe-4-7.c
@@ -9,6 +9,7 @@
  */
 
 #include <linux/interrupt.h>
+#include <linux/io.h>
 #include <linux/iopoll.h>
 
 #include "camss-vfe.h"
diff --git a/drivers/media/platform/qcom/camss/camss.c b/drivers/media/platform/qcom/camss/camss.c
index dcc0c30ef1b1..669615fff6a0 100644
--- a/drivers/media/platform/qcom/camss/camss.c
+++ b/drivers/media/platform/qcom/camss/camss.c
@@ -848,17 +848,18 @@ static int camss_probe(struct platform_device *pdev)
                 return -EINVAL;
         }
 
-        camss->csiphy = kcalloc(camss->csiphy_num, sizeof(*camss->csiphy),
-                                GFP_KERNEL);
+        camss->csiphy = devm_kcalloc(dev, camss->csiphy_num,
+                                     sizeof(*camss->csiphy), GFP_KERNEL);
         if (!camss->csiphy)
                 return -ENOMEM;
 
-        camss->csid = kcalloc(camss->csid_num, sizeof(*camss->csid),
-                              GFP_KERNEL);
+        camss->csid = devm_kcalloc(dev, camss->csid_num, sizeof(*camss->csid),
+                                   GFP_KERNEL);
         if (!camss->csid)
                 return -ENOMEM;
 
-        camss->vfe = kcalloc(camss->vfe_num, sizeof(*camss->vfe), GFP_KERNEL);
+        camss->vfe = devm_kcalloc(dev, camss->vfe_num, sizeof(*camss->vfe),
+                                  GFP_KERNEL);
         if (!camss->vfe)
                 return -ENOMEM;
 
@@ -993,12 +994,12 @@ static const struct of_device_id camss_dt_match[] = {
 
 MODULE_DEVICE_TABLE(of, camss_dt_match);
 
-static int camss_runtime_suspend(struct device *dev)
+static int __maybe_unused camss_runtime_suspend(struct device *dev)
 {
         return 0;
 }
 
-static int camss_runtime_resume(struct device *dev)
+static int __maybe_unused camss_runtime_resume(struct device *dev)
 {
         return 0;
 }
diff --git a/drivers/media/usb/dvb-usb-v2/af9035.c b/drivers/media/usb/dvb-usb-v2/af9035.c
index 666d319d3d1a..1f6c1eefe389 100644
--- a/drivers/media/usb/dvb-usb-v2/af9035.c
+++ b/drivers/media/usb/dvb-usb-v2/af9035.c
@@ -402,8 +402,10 @@ static int af9035_i2c_master_xfer(struct i2c_adapter *adap,
                         if (msg[0].addr == state->af9033_i2c_addr[1])
                                 reg |= 0x100000;
 
-                        ret = af9035_wr_regs(d, reg, &msg[0].buf[3],
-                                        msg[0].len - 3);
+                        ret = (msg[0].len >= 3) ? af9035_wr_regs(d, reg,
+                                                                 &msg[0].buf[3],
+                                                                 msg[0].len - 3)
+                                                : -EOPNOTSUPP;
                 } else {
                         /* I2C write */
                         u8 buf[MAX_XFER_SIZE];
diff --git a/drivers/memory/ti-aemif.c b/drivers/memory/ti-aemif.c
index 31112f622b88..475e5b3790ed 100644
--- a/drivers/memory/ti-aemif.c
+++ b/drivers/memory/ti-aemif.c
@@ -411,7 +411,7 @@ static int aemif_probe(struct platform_device *pdev)
                         if (ret < 0)
                                 goto error;
                 }
-        } else {
+        } else if (pdata) {
                 for (i = 0; i < pdata->num_sub_devices; i++) {
                         pdata->sub_devices[i].dev.parent = dev;
                         ret = platform_device_register(&pdata->sub_devices[i]);
diff --git a/drivers/mfd/omap-usb-host.c b/drivers/mfd/omap-usb-host.c
index e11ab12fbdf2..800986a79704 100644
--- a/drivers/mfd/omap-usb-host.c
+++ b/drivers/mfd/omap-usb-host.c
@@ -528,8 +528,8 @@ static int usbhs_omap_get_dt_pdata(struct device *dev,
 }
 
 static const struct of_device_id usbhs_child_match_table[] = {
-        { .compatible = "ti,omap-ehci", },
-        { .compatible = "ti,omap-ohci", },
+        { .compatible = "ti,ehci-omap", },
+        { .compatible = "ti,ohci-omap3", },
         { }
 };
 
@@ -855,6 +855,7 @@ static struct platform_driver usbhs_omap_driver = {
                 .pm             = &usbhsomap_dev_pm_ops,
                 .of_match_table = usbhs_omap_dt_ids,
         },
+        .probe          = usbhs_omap_probe,
         .remove         = usbhs_omap_remove,
 };
 
@@ -864,9 +865,9 @@ MODULE_ALIAS("platform:" USBHS_DRIVER_NAME);
 MODULE_LICENSE("GPL v2");
 MODULE_DESCRIPTION("usb host common core driver for omap EHCI and OHCI");
 
-static int __init omap_usbhs_drvinit(void)
+static int omap_usbhs_drvinit(void)
 {
-        return platform_driver_probe(&usbhs_omap_driver, usbhs_omap_probe);
+        return platform_driver_register(&usbhs_omap_driver);
 }
 
 /*
@@ -878,7 +879,7 @@ static int __init omap_usbhs_drvinit(void)
  */
 fs_initcall_sync(omap_usbhs_drvinit);
 
-static void __exit omap_usbhs_drvexit(void)
+static void omap_usbhs_drvexit(void)
 {
         platform_driver_unregister(&usbhs_omap_driver);
 }
diff --git a/drivers/misc/hmc6352.c b/drivers/misc/hmc6352.c
index eeb7eef62174..38f90e179927 100644
--- a/drivers/misc/hmc6352.c
+++ b/drivers/misc/hmc6352.c
@@ -27,6 +27,7 @@
 #include <linux/err.h>
 #include <linux/delay.h>
 #include <linux/sysfs.h>
+#include <linux/nospec.h>
 
 static DEFINE_MUTEX(compass_mutex);
 
@@ -50,6 +51,7 @@ static int compass_store(struct device *dev, const char *buf, size_t count,
                 return ret;
         if (val >= strlen(map))
                 return -EINVAL;
+        val = array_index_nospec(val, strlen(map));
         mutex_lock(&compass_mutex);
         ret = compass_command(c, map[val]);
         mutex_unlock(&compass_mutex);
diff --git a/drivers/misc/ibmvmc.c b/drivers/misc/ibmvmc.c
index 8f82bb9d11e2..b8aaa684c397 100644
--- a/drivers/misc/ibmvmc.c
+++ b/drivers/misc/ibmvmc.c
@@ -2131,7 +2131,7 @@ static int ibmvmc_init_crq_queue(struct crq_server_adapter *adapter)
         retrc = plpar_hcall_norets(H_REG_CRQ,
                                    vdev->unit_address,
                                    queue->msg_token, PAGE_SIZE);
-        retrc = rc;
+        rc = retrc;
 
         if (rc == H_RESOURCE)
                 rc = ibmvmc_reset_crq_queue(adapter);
diff --git a/drivers/misc/mei/bus.c b/drivers/misc/mei/bus.c
index 7bba62a72921..fc3872fe7b25 100644
--- a/drivers/misc/mei/bus.c
+++ b/drivers/misc/mei/bus.c
@@ -521,17 +521,15 @@ int mei_cldev_enable(struct mei_cl_device *cldev)
 
         cl = cldev->cl;
 
+        mutex_lock(&bus->device_lock);
         if (cl->state == MEI_FILE_UNINITIALIZED) {
-                mutex_lock(&bus->device_lock);
                 ret = mei_cl_link(cl);
-                mutex_unlock(&bus->device_lock);
                 if (ret)
-                        return ret;
+                        goto out;
                 /* update pointers */
                 cl->cldev = cldev;
         }
 
-        mutex_lock(&bus->device_lock);
         if (mei_cl_is_connected(cl)) {
                 ret = 0;
                 goto out;
@@ -616,9 +614,8 @@ int mei_cldev_disable(struct mei_cl_device *cldev)
         if (err < 0)
                 dev_err(bus->dev, "Could not disconnect from the ME client\n");
 
-out:
         mei_cl_bus_module_put(cldev);
-
+out:
         /* Flush queues and remove any pending read */
         mei_cl_flush_queues(cl, NULL);
         mei_cl_unlink(cl);
@@ -876,12 +873,13 @@ static void mei_cl_bus_dev_release(struct device *dev)
 
         mei_me_cl_put(cldev->me_cl);
         mei_dev_bus_put(cldev->bus);
+        mei_cl_unlink(cldev->cl);
         kfree(cldev->cl);
         kfree(cldev);
 }
 
 static const struct device_type mei_cl_device_type = {
-        .release        = mei_cl_bus_dev_release,
+        .release = mei_cl_bus_dev_release,
 };
 
 /**
diff --git a/drivers/misc/mei/client.c b/drivers/misc/mei/client.c
index 4ab6251d418e..ebdcf0b450e2 100644
--- a/drivers/misc/mei/client.c
+++ b/drivers/misc/mei/client.c
@@ -1767,7 +1767,7 @@ out:
                 }
         }
 
-        rets = buf->size;
+        rets = len;
 err:
         cl_dbg(dev, cl, "rpm: autosuspend\n");
         pm_runtime_mark_last_busy(dev->dev);
diff --git a/drivers/misc/mei/hbm.c b/drivers/misc/mei/hbm.c
index 09e233d4c0de..e56f3e72d57a 100644
--- a/drivers/misc/mei/hbm.c
+++ b/drivers/misc/mei/hbm.c
@@ -1161,15 +1161,18 @@ int mei_hbm_dispatch(struct mei_device *dev, struct mei_msg_hdr *hdr)
 
                 props_res = (struct hbm_props_response *)mei_msg;
 
-                if (props_res->status) {
+                if (props_res->status == MEI_HBMS_CLIENT_NOT_FOUND) {
+                        dev_dbg(dev->dev, "hbm: properties response: %d CLIENT_NOT_FOUND\n",
+                                props_res->me_addr);
+                } else if (props_res->status) {
                         dev_err(dev->dev, "hbm: properties response: wrong status = %d %s\n",
                                 props_res->status,
                                 mei_hbm_status_str(props_res->status));
                         return -EPROTO;
+                } else {
+                        mei_hbm_me_cl_add(dev, props_res);
                 }
 
-                mei_hbm_me_cl_add(dev, props_res);
-
                 /* request property for the next client */
                 if (mei_hbm_prop_req(dev, props_res->me_addr + 1))
                         return -EIO;
diff --git a/drivers/mmc/core/queue.c b/drivers/mmc/core/queue.c
index 648eb6743ed5..6edffeed9953 100644
--- a/drivers/mmc/core/queue.c
+++ b/drivers/mmc/core/queue.c
@@ -238,10 +238,6 @@ static void mmc_mq_exit_request(struct blk_mq_tag_set *set, struct request *req,
         mmc_exit_request(mq->queue, req);
 }
 
-/*
- * We use BLK_MQ_F_BLOCKING and have only 1 hardware queue, which means requests
- * will not be dispatched in parallel.
- */
 static blk_status_t mmc_mq_queue_rq(struct blk_mq_hw_ctx *hctx,
                                     const struct blk_mq_queue_data *bd)
 {
@@ -264,7 +260,7 @@ static blk_status_t mmc_mq_queue_rq(struct blk_mq_hw_ctx *hctx,
 
         spin_lock_irq(q->queue_lock);
 
-        if (mq->recovery_needed) {
+        if (mq->recovery_needed || mq->busy) {
                 spin_unlock_irq(q->queue_lock);
                 return BLK_STS_RESOURCE;
         }
@@ -291,6 +287,9 @@ static blk_status_t mmc_mq_queue_rq(struct blk_mq_hw_ctx *hctx,
                 break;
         }
 
+        /* Parallel dispatch of requests is not supported at the moment */
+        mq->busy = true;
+
         mq->in_flight[issue_type] += 1;
         get_card = (mmc_tot_in_flight(mq) == 1);
         cqe_retune_ok = (mmc_cqe_qcnt(mq) == 1);
@@ -333,9 +332,12 @@ static blk_status_t mmc_mq_queue_rq(struct blk_mq_hw_ctx *hctx,
                 mq->in_flight[issue_type] -= 1;
                 if (mmc_tot_in_flight(mq) == 0)
                         put_card = true;
+                mq->busy = false;
                 spin_unlock_irq(q->queue_lock);
                 if (put_card)
                         mmc_put_card(card, &mq->ctx);
+        } else {
+                WRITE_ONCE(mq->busy, false);
         }
 
         return ret;
diff --git a/drivers/mmc/core/queue.h b/drivers/mmc/core/queue.h
index 17e59d50b496..9bf3c9245075 100644
--- a/drivers/mmc/core/queue.h
+++ b/drivers/mmc/core/queue.h
@@ -81,6 +81,7 @@ struct mmc_queue {
         unsigned int            cqe_busy;
 #define MMC_CQE_DCMD_BUSY       BIT(0)
 #define MMC_CQE_QUEUE_FULL      BIT(1)
+        bool                    busy;
         bool                    use_cqe;
         bool                    recovery_needed;
         bool                    in_recovery;
diff --git a/drivers/mmc/host/android-goldfish.c b/drivers/mmc/host/android-goldfish.c
index 294de177632c..61e4e2a213c9 100644
--- a/drivers/mmc/host/android-goldfish.c
+++ b/drivers/mmc/host/android-goldfish.c
@@ -217,7 +217,7 @@ static void goldfish_mmc_xfer_done(struct goldfish_mmc_host *host,
                          * We don't really have DMA, so we need
                          * to copy from our platform driver buffer
                          */
-                        sg_copy_to_buffer(data->sg, 1, host->virt_base,
+                        sg_copy_from_buffer(data->sg, 1, host->virt_base,
                                         data->sg->length);
                 }
                 host->data->bytes_xfered += data->sg->length;
@@ -393,7 +393,7 @@ static void goldfish_mmc_prepare_data(struct goldfish_mmc_host *host,
                  * We don't really have DMA, so we need to copy to our
                  * platform driver buffer
                  */
-                sg_copy_from_buffer(data->sg, 1, host->virt_base,
+                sg_copy_to_buffer(data->sg, 1, host->virt_base,
                                 data->sg->length);
         }
 }
diff --git a/drivers/mmc/host/atmel-mci.c b/drivers/mmc/host/atmel-mci.c
index 5aa2c9404e92..be53044086c7 100644
--- a/drivers/mmc/host/atmel-mci.c
+++ b/drivers/mmc/host/atmel-mci.c
@@ -1976,7 +1976,7 @@ static void atmci_read_data_pio(struct atmel_mci *host)
         do {
                 value = atmci_readl(host, ATMCI_RDR);
                 if (likely(offset + 4 <= sg->length)) {
-                        sg_pcopy_to_buffer(sg, 1, &value, sizeof(u32), offset);
+                        sg_pcopy_from_buffer(sg, 1, &value, sizeof(u32), offset);
 
                         offset += 4;
                         nbytes += 4;
@@ -1993,7 +1993,7 @@ static void atmci_read_data_pio(struct atmel_mci *host)
                 } else {
                         unsigned int remaining = sg->length - offset;
 
-                        sg_pcopy_to_buffer(sg, 1, &value, remaining, offset);
+                        sg_pcopy_from_buffer(sg, 1, &value, remaining, offset);
                         nbytes += remaining;
 
                         flush_dcache_page(sg_page(sg));
@@ -2003,7 +2003,7 @@ static void atmci_read_data_pio(struct atmel_mci *host)
                                 goto done;
 
                         offset = 4 - remaining;
-                        sg_pcopy_to_buffer(sg, 1, (u8 *)&value + remaining,
+                        sg_pcopy_from_buffer(sg, 1, (u8 *)&value + remaining,
                                         offset, 0);
                         nbytes += offset;
                 }
@@ -2042,7 +2042,7 @@ static void atmci_write_data_pio(struct atmel_mci *host)
 
         do {
                 if (likely(offset + 4 <= sg->length)) {
-                        sg_pcopy_from_buffer(sg, 1, &value, sizeof(u32), offset);
+                        sg_pcopy_to_buffer(sg, 1, &value, sizeof(u32), offset);
                         atmci_writel(host, ATMCI_TDR, value);
 
                         offset += 4;
@@ -2059,7 +2059,7 @@ static void atmci_write_data_pio(struct atmel_mci *host)
                         unsigned int remaining = sg->length - offset;
 
                         value = 0;
-                        sg_pcopy_from_buffer(sg, 1, &value, remaining, offset);
+                        sg_pcopy_to_buffer(sg, 1, &value, remaining, offset);
                         nbytes += remaining;
 
                         host->sg = sg = sg_next(sg);
@@ -2070,7 +2070,7 @@ static void atmci_write_data_pio(struct atmel_mci *host)
                         }
 
                         offset = 4 - remaining;
-                        sg_pcopy_from_buffer(sg, 1, (u8 *)&value + remaining,
+                        sg_pcopy_to_buffer(sg, 1, (u8 *)&value + remaining,
                                         offset, 0);
                         atmci_writel(host, ATMCI_TDR, value);
                         nbytes += offset;
diff --git a/drivers/mmc/host/meson-mx-sdio.c b/drivers/mmc/host/meson-mx-sdio.c
index 09cb89645d06..2cfec33178c1 100644
--- a/drivers/mmc/host/meson-mx-sdio.c
+++ b/drivers/mmc/host/meson-mx-sdio.c
@@ -517,19 +517,23 @@ static struct mmc_host_ops meson_mx_mmc_ops = {
 static struct platform_device *meson_mx_mmc_slot_pdev(struct device *parent)
 {
         struct device_node *slot_node;
+        struct platform_device *pdev;
 
         /*
          * TODO: the MMC core framework currently does not support
          * controllers with multiple slots properly. So we only register
          * the first slot for now
          */
-        slot_node = of_find_compatible_node(parent->of_node, NULL, "mmc-slot");
+        slot_node = of_get_compatible_child(parent->of_node, "mmc-slot");
         if (!slot_node) {
                 dev_warn(parent, "no 'mmc-slot' sub-node found\n");
                 return ERR_PTR(-ENOENT);
         }
 
-        return of_platform_device_create(slot_node, NULL, parent);
+        pdev = of_platform_device_create(slot_node, NULL, parent);
+        of_node_put(slot_node);
+
+        return pdev;
 }
 
 static int meson_mx_mmc_add_host(struct meson_mx_mmc_host *host)
diff --git a/drivers/mmc/host/omap_hsmmc.c b/drivers/mmc/host/omap_hsmmc.c
index 071693ebfe18..68760d4a5d3d 100644
--- a/drivers/mmc/host/omap_hsmmc.c
+++ b/drivers/mmc/host/omap_hsmmc.c
@@ -2177,6 +2177,7 @@ static int omap_hsmmc_remove(struct platform_device *pdev)
         dma_release_channel(host->tx_chan);
         dma_release_channel(host->rx_chan);
 
+        dev_pm_clear_wake_irq(host->dev);
         pm_runtime_dont_use_autosuspend(host->dev);
         pm_runtime_put_sync(host->dev);
         pm_runtime_disable(host->dev);
diff --git a/drivers/mmc/host/renesas_sdhi_internal_dmac.c b/drivers/mmc/host/renesas_sdhi_internal_dmac.c
index 35cc0de6be67..ca0b43973769 100644
--- a/drivers/mmc/host/renesas_sdhi_internal_dmac.c
+++ b/drivers/mmc/host/renesas_sdhi_internal_dmac.c
@@ -45,14 +45,16 @@
 /* DM_CM_RST */
 #define RST_DTRANRST1           BIT(9)
 #define RST_DTRANRST0           BIT(8)
-#define RST_RESERVED_BITS       GENMASK_ULL(32, 0)
+#define RST_RESERVED_BITS       GENMASK_ULL(31, 0)
 
 /* DM_CM_INFO1 and DM_CM_INFO1_MASK */
 #define INFO1_CLEAR             0
+#define INFO1_MASK_CLEAR        GENMASK_ULL(31, 0)
 #define INFO1_DTRANEND1         BIT(17)
 #define INFO1_DTRANEND0         BIT(16)
 
 /* DM_CM_INFO2 and DM_CM_INFO2_MASK */
+#define INFO2_MASK_CLEAR        GENMASK_ULL(31, 0)
 #define INFO2_DTRANERR1         BIT(17)
 #define INFO2_DTRANERR0         BIT(16)
 
@@ -252,6 +254,12 @@ renesas_sdhi_internal_dmac_request_dma(struct tmio_mmc_host *host,
 {
         struct renesas_sdhi *priv = host_to_priv(host);
 
+        /* Disable DMAC interrupts, we don't use them */
+        renesas_sdhi_internal_dmac_dm_write(host, DM_CM_INFO1_MASK,
+                                            INFO1_MASK_CLEAR);
+        renesas_sdhi_internal_dmac_dm_write(host, DM_CM_INFO2_MASK,
+                                            INFO2_MASK_CLEAR);
+
         /* Each value is set to non-zero to assume "enabling" each DMA */
         host->chan_rx = host->chan_tx = (void *)0xdeadbeaf;
 
diff --git a/drivers/mtd/devices/m25p80.c b/drivers/mtd/devices/m25p80.c
index cbfafc453274..270d3c9580c5 100644
--- a/drivers/mtd/devices/m25p80.c
+++ b/drivers/mtd/devices/m25p80.c
@@ -39,13 +39,23 @@ static int m25p80_read_reg(struct spi_nor *nor, u8 code, u8 *val, int len)
         struct spi_mem_op op = SPI_MEM_OP(SPI_MEM_OP_CMD(code, 1),
                                           SPI_MEM_OP_NO_ADDR,
                                           SPI_MEM_OP_NO_DUMMY,
-                                          SPI_MEM_OP_DATA_IN(len, val, 1));
+                                          SPI_MEM_OP_DATA_IN(len, NULL, 1));
+        void *scratchbuf;
         int ret;
 
+        scratchbuf = kmalloc(len, GFP_KERNEL);
+        if (!scratchbuf)
+                return -ENOMEM;
+
+        op.data.buf.in = scratchbuf;
         ret = spi_mem_exec_op(flash->spimem, &op);
         if (ret < 0)
                 dev_err(&flash->spimem->spi->dev, "error %d reading %x\n", ret,
                         code);
+        else
+                memcpy(val, scratchbuf, len);
+
+        kfree(scratchbuf);
 
         return ret;
 }
@@ -56,9 +66,19 @@ static int m25p80_write_reg(struct spi_nor *nor, u8 opcode, u8 *buf, int len)
         struct spi_mem_op op = SPI_MEM_OP(SPI_MEM_OP_CMD(opcode, 1),
                                           SPI_MEM_OP_NO_ADDR,
                                           SPI_MEM_OP_NO_DUMMY,
-                                          SPI_MEM_OP_DATA_OUT(len, buf, 1));
+                                          SPI_MEM_OP_DATA_OUT(len, NULL, 1));
+        void *scratchbuf;
+        int ret;
 
-        return spi_mem_exec_op(flash->spimem, &op);
+        scratchbuf = kmemdup(buf, len, GFP_KERNEL);
+        if (!scratchbuf)
+                return -ENOMEM;
+
+        op.data.buf.out = scratchbuf;
+        ret = spi_mem_exec_op(flash->spimem, &op);
+        kfree(scratchbuf);
+
+        return ret;
 }
 
 static ssize_t m25p80_write(struct spi_nor *nor, loff_t to, size_t len,
diff --git a/drivers/mtd/mtdpart.c b/drivers/mtd/mtdpart.c
index 52e2cb35fc79..99c460facd5e 100644
--- a/drivers/mtd/mtdpart.c
+++ b/drivers/mtd/mtdpart.c
@@ -873,8 +873,11 @@ static int mtd_part_of_parse(struct mtd_info *master,
         int ret, err = 0;
 
         np = mtd_get_of_node(master);
-        if (!mtd_is_partition(master))
+        if (mtd_is_partition(master))
+                of_node_get(np);
+        else
                 np = of_get_child_by_name(np, "partitions");
+
         of_property_for_each_string(np, "compatible", prop, compat) {
                 parser = mtd_part_get_compatible_parser(compat);
                 if (!parser)
diff --git a/drivers/mtd/nand/raw/denali.c b/drivers/mtd/nand/raw/denali.c
index ca18612c4201..b864b93dd289 100644
--- a/drivers/mtd/nand/raw/denali.c
+++ b/drivers/mtd/nand/raw/denali.c
@@ -596,6 +596,12 @@ static int denali_dma_xfer(struct denali_nand_info *denali, void *buf,
         }
 
         iowrite32(DMA_ENABLE__FLAG, denali->reg + DMA_ENABLE);
+        /*
+         * The ->setup_dma() hook kicks DMA by using the data/command
+         * interface, which belongs to a different AXI port from the
+         * register interface.  Read back the register to avoid a race.
+         */
+        ioread32(denali->reg + DMA_ENABLE);
 
         denali_reset_irq(denali);
         denali->setup_dma(denali, dma_addr, page, write);
@@ -1338,6 +1344,11 @@ int denali_init(struct denali_nand_info *denali)
 
         denali_enable_irq(denali);
         denali_reset_banks(denali);
+        if (!denali->max_banks) {
+                /* Error out earlier if no chip is found for some reasons. */
+                ret = -ENODEV;
+                goto disable_irq;
+        }
 
         denali->active_bank = DENALI_INVALID_BANK;
 
diff --git a/drivers/mtd/nand/raw/docg4.c b/drivers/mtd/nand/raw/docg4.c
index a3f04315c05c..427fcbc1b71c 100644
--- a/drivers/mtd/nand/raw/docg4.c
+++ b/drivers/mtd/nand/raw/docg4.c
@@ -1218,7 +1218,7 @@ static int docg4_resume(struct platform_device *pdev)
         return 0;
 }
 
-static void __init init_mtd_structs(struct mtd_info *mtd)
+static void init_mtd_structs(struct mtd_info *mtd)
 {
         /* initialize mtd and nand data structures */
 
@@ -1290,7 +1290,7 @@ static void __init init_mtd_structs(struct mtd_info *mtd)
 
 }
 
-static int __init read_id_reg(struct mtd_info *mtd)
+static int read_id_reg(struct mtd_info *mtd)
 {
         struct nand_chip *nand = mtd_to_nand(mtd);
         struct docg4_priv *doc = nand_get_controller_data(nand);
diff --git a/drivers/mtd/nand/raw/marvell_nand.c b/drivers/mtd/nand/raw/marvell_nand.c
index 7af4d6213ee5..bc2ef5209783 100644
--- a/drivers/mtd/nand/raw/marvell_nand.c
+++ b/drivers/mtd/nand/raw/marvell_nand.c
@@ -1547,7 +1547,7 @@ static void marvell_nfc_parse_instructions(struct nand_chip *chip,
         for (op_id = 0; op_id < subop->ninstrs; op_id++) {
                 unsigned int offset, naddrs;
                 const u8 *addrs;
-                int len = nand_subop_get_data_len(subop, op_id);
+                int len;
 
                 instr = &subop->instrs[op_id];
 
@@ -1593,6 +1593,7 @@ static void marvell_nfc_parse_instructions(struct nand_chip *chip,
                                 nfc_op->ndcb[0] |=
                                         NDCB0_CMD_XTYPE(XTYPE_MONOLITHIC_RW) |
                                         NDCB0_LEN_OVRD;
+                                len = nand_subop_get_data_len(subop, op_id);
                                 nfc_op->ndcb[3] |= round_up(len, FIFO_DEPTH);
                         }
                         nfc_op->data_delay_ns = instr->delay_ns;
@@ -1606,6 +1607,7 @@ static void marvell_nfc_parse_instructions(struct nand_chip *chip,
                                 nfc_op->ndcb[0] |=
                                         NDCB0_CMD_XTYPE(XTYPE_MONOLITHIC_RW) |
                                         NDCB0_LEN_OVRD;
+                                len = nand_subop_get_data_len(subop, op_id);
                                 nfc_op->ndcb[3] |= round_up(len, FIFO_DEPTH);
                         }
                         nfc_op->data_delay_ns = instr->delay_ns;
diff --git a/drivers/net/appletalk/ipddp.c b/drivers/net/appletalk/ipddp.c
index 9375cef22420..3d27616d9c85 100644
--- a/drivers/net/appletalk/ipddp.c
+++ b/drivers/net/appletalk/ipddp.c
@@ -283,8 +283,12 @@ static int ipddp_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
                 case SIOCFINDIPDDPRT:
                         spin_lock_bh(&ipddp_route_lock);
                         rp = __ipddp_find_route(&rcp);
-                        if (rp)
-                                memcpy(&rcp2, rp, sizeof(rcp2));
+                        if (rp) {
+                                memset(&rcp2, 0, sizeof(rcp2));
+                                rcp2.ip    = rp->ip;
+                                rcp2.at    = rp->at;
+                                rcp2.flags = rp->flags;
+                        }
                         spin_unlock_bh(&ipddp_route_lock);
 
                         if (rp) {
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index a764a83f99da..ee28ec9e0aba 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -210,6 +210,7 @@ static void bond_get_stats(struct net_device *bond_dev,
 static void bond_slave_arr_handler(struct work_struct *work);
 static bool bond_time_in_interval(struct bonding *bond, unsigned long last_act,
                                   int mod);
+static void bond_netdev_notify_work(struct work_struct *work);
 
 /*---------------------------- General routines -----------------------------*/
 
@@ -971,16 +972,13 @@ static void bond_poll_controller(struct net_device *bond_dev)
         struct slave *slave = NULL;
         struct list_head *iter;
         struct ad_info ad_info;
-        struct netpoll_info *ni;
-        const struct net_device_ops *ops;
 
         if (BOND_MODE(bond) == BOND_MODE_8023AD)
                 if (bond_3ad_get_active_agg_info(bond, &ad_info))
                         return;
 
         bond_for_each_slave_rcu(bond, slave, iter) {
-                ops = slave->dev->netdev_ops;
-                if (!bond_slave_is_up(slave) || !ops->ndo_poll_controller)
+                if (!bond_slave_is_up(slave))
                         continue;
 
                 if (BOND_MODE(bond) == BOND_MODE_8023AD) {
@@ -992,11 +990,7 @@ static void bond_poll_controller(struct net_device *bond_dev)
                                 continue;
                 }
 
-                ni = rcu_dereference_bh(slave->dev->npinfo);
-                if (down_trylock(&ni->dev_lock))
-                        continue;
-                ops->ndo_poll_controller(slave->dev);
-                up(&ni->dev_lock);
+                netpoll_poll_dev(slave->dev);
         }
 }
 
@@ -1177,9 +1171,27 @@ static rx_handler_result_t bond_handle_frame(struct sk_buff **pskb)
                 }
         }
 
-        /* don't change skb->dev for link-local packets */
-        if (is_link_local_ether_addr(eth_hdr(skb)->h_dest))
+        /* Link-local multicast packets should be passed to the
+         * stack on the link they arrive as well as pass them to the
+         * bond-master device. These packets are mostly usable when
+         * stack receives it with the link on which they arrive
+         * (e.g. LLDP) they also must be available on master. Some of
+         * the use cases include (but are not limited to): LLDP agents
+         * that must be able to operate both on enslaved interfaces as
+         * well as on bonds themselves; linux bridges that must be able
+         * to process/pass BPDUs from attached bonds when any kind of
+         * STP version is enabled on the network.
+         */
+        if (is_link_local_ether_addr(eth_hdr(skb)->h_dest)) {
+                struct sk_buff *nskb = skb_clone(skb, GFP_ATOMIC);
+
+                if (nskb) {
+                        nskb->dev = bond->dev;
+                        nskb->queue_mapping = 0;
+                        netif_rx(nskb);
+                }
                 return RX_HANDLER_PASS;
+        }
         if (bond_should_deliver_exact_match(skb, slave, bond))
                 return RX_HANDLER_EXACT;
 
@@ -1276,6 +1288,8 @@ static struct slave *bond_alloc_slave(struct bonding *bond)
                         return NULL;
                 }
         }
+        INIT_DELAYED_WORK(&slave->notify_work, bond_netdev_notify_work);
+
         return slave;
 }
 
@@ -1283,6 +1297,7 @@ static void bond_free_slave(struct slave *slave)
 {
         struct bonding *bond = bond_get_bond_by_slave(slave);
 
+        cancel_delayed_work_sync(&slave->notify_work);
         if (BOND_MODE(bond) == BOND_MODE_8023AD)
                 kfree(SLAVE_AD_INFO(slave));
 
@@ -1304,39 +1319,26 @@ static void bond_fill_ifslave(struct slave *slave, struct ifslave *info)
         info->link_failure_count = slave->link_failure_count;
 }
 
-static void bond_netdev_notify(struct net_device *dev,
-                               struct netdev_bonding_info *info)
-{
-        rtnl_lock();
-        netdev_bonding_info_change(dev, info);
-        rtnl_unlock();
-}
-
 static void bond_netdev_notify_work(struct work_struct *_work)
 {
-        struct netdev_notify_work *w =
-                container_of(_work, struct netdev_notify_work, work.work);
+        struct slave *slave = container_of(_work, struct slave,
+                                           notify_work.work);
+
+        if (rtnl_trylock()) {
+                struct netdev_bonding_info binfo;
 
-        bond_netdev_notify(w->dev, &w->bonding_info);
-        dev_put(w->dev);
-        kfree(w);
+                bond_fill_ifslave(slave, &binfo.slave);
+                bond_fill_ifbond(slave->bond, &binfo.master);
+                netdev_bonding_info_change(slave->dev, &binfo);
+                rtnl_unlock();
+        } else {
+                queue_delayed_work(slave->bond->wq, &slave->notify_work, 1);
+        }
 }
 
 void bond_queue_slave_event(struct slave *slave)
 {
-        struct bonding *bond = slave->bond;
-        struct netdev_notify_work *nnw = kzalloc(sizeof(*nnw), GFP_ATOMIC);
-
-        if (!nnw)
-                return;
-
-        dev_hold(slave->dev);
-        nnw->dev = slave->dev;
-        bond_fill_ifslave(slave, &nnw->bonding_info.slave);
-        bond_fill_ifbond(bond, &nnw->bonding_info.master);
-        INIT_DELAYED_WORK(&nnw->work, bond_netdev_notify_work);
-
-        queue_delayed_work(slave->bond->wq, &nnw->work, 0);
+        queue_delayed_work(slave->bond->wq, &slave->notify_work, 0);
 }
 
 void bond_lower_state_changed(struct slave *slave)
diff --git a/drivers/net/dsa/mv88e6xxx/global1.h b/drivers/net/dsa/mv88e6xxx/global1.h
index 7c791c1da4b9..bef01331266f 100644
--- a/drivers/net/dsa/mv88e6xxx/global1.h
+++ b/drivers/net/dsa/mv88e6xxx/global1.h
@@ -128,7 +128,7 @@
 #define MV88E6XXX_G1_ATU_OP_GET_CLR_VIOLATION           0x7000
 #define MV88E6XXX_G1_ATU_OP_AGE_OUT_VIOLATION           BIT(7)
 #define MV88E6XXX_G1_ATU_OP_MEMBER_VIOLATION            BIT(6)
-#define MV88E6XXX_G1_ATU_OP_MISS_VIOLTATION             BIT(5)
+#define MV88E6XXX_G1_ATU_OP_MISS_VIOLATION              BIT(5)
 #define MV88E6XXX_G1_ATU_OP_FULL_VIOLATION              BIT(4)
 
 /* Offset 0x0C: ATU Data Register */
diff --git a/drivers/net/dsa/mv88e6xxx/global1_atu.c b/drivers/net/dsa/mv88e6xxx/global1_atu.c
index 307410898fc9..5200e4bdce93 100644
--- a/drivers/net/dsa/mv88e6xxx/global1_atu.c
+++ b/drivers/net/dsa/mv88e6xxx/global1_atu.c
@@ -349,7 +349,7 @@ static irqreturn_t mv88e6xxx_g1_atu_prob_irq_thread_fn(int irq, void *dev_id)
                 chip->ports[entry.portvec].atu_member_violation++;
         }
 
-        if (val & MV88E6XXX_G1_ATU_OP_MEMBER_VIOLATION) {
+        if (val & MV88E6XXX_G1_ATU_OP_MISS_VIOLATION) {
                 dev_err_ratelimited(chip->dev,
                                     "ATU miss violation for %pM portvec %x\n",
                                     entry.mac, entry.portvec);
diff --git a/drivers/net/ethernet/amazon/ena/ena_com.c b/drivers/net/ethernet/amazon/ena/ena_com.c
index 17f12c18d225..7635c38e77dd 100644
--- a/drivers/net/ethernet/amazon/ena/ena_com.c
+++ b/drivers/net/ethernet/amazon/ena/ena_com.c
@@ -459,12 +459,12 @@ static void ena_com_handle_admin_completion(struct ena_com_admin_queue *admin_qu
         cqe = &admin_queue->cq.entries[head_masked];
 
         /* Go over all the completions */
-        while ((cqe->acq_common_descriptor.flags &
+        while ((READ_ONCE(cqe->acq_common_descriptor.flags) &
                         ENA_ADMIN_ACQ_COMMON_DESC_PHASE_MASK) == phase) {
                 /* Do not read the rest of the completion entry before the
                  * phase bit was validated
                  */
-                rmb();
+                dma_rmb();
                 ena_com_handle_single_admin_completion(admin_queue, cqe);
 
                 head_masked++;
@@ -627,17 +627,10 @@ static u32 ena_com_reg_bar_read32(struct ena_com_dev *ena_dev, u16 offset)
         mmio_read_reg |= mmio_read->seq_num &
                         ENA_REGS_MMIO_REG_READ_REQ_ID_MASK;
 
-        /* make sure read_resp->req_id get updated before the hw can write
-         * there
-         */
-        wmb();
-
-        writel_relaxed(mmio_read_reg,
-                       ena_dev->reg_bar + ENA_REGS_MMIO_REG_READ_OFF);
+        writel(mmio_read_reg, ena_dev->reg_bar + ENA_REGS_MMIO_REG_READ_OFF);
 
-        mmiowb();
         for (i = 0; i < timeout; i++) {
-                if (read_resp->req_id == mmio_read->seq_num)
+                if (READ_ONCE(read_resp->req_id) == mmio_read->seq_num)
                         break;
 
                 udelay(1);
@@ -1796,8 +1789,13 @@ void ena_com_aenq_intr_handler(struct ena_com_dev *dev, void *data)
         aenq_common = &aenq_e->aenq_common_desc;
 
         /* Go over all the events */
-        while ((aenq_common->flags & ENA_ADMIN_AENQ_COMMON_DESC_PHASE_MASK) ==
-               phase) {
+        while ((READ_ONCE(aenq_common->flags) &
+                ENA_ADMIN_AENQ_COMMON_DESC_PHASE_MASK) == phase) {
+                /* Make sure the phase bit (ownership) is as expected before
+                 * reading the rest of the descriptor.
+                 */
+                dma_rmb();
+
                 pr_debug("AENQ! Group[%x] Syndrom[%x] timestamp: [%llus]\n",
                          aenq_common->group, aenq_common->syndrom,
                          (u64)aenq_common->timestamp_low +
diff --git a/drivers/net/ethernet/amazon/ena/ena_eth_com.c b/drivers/net/ethernet/amazon/ena/ena_eth_com.c
index ea149c134e15..1c682b76190f 100644
--- a/drivers/net/ethernet/amazon/ena/ena_eth_com.c
+++ b/drivers/net/ethernet/amazon/ena/ena_eth_com.c
@@ -51,6 +51,11 @@ static inline struct ena_eth_io_rx_cdesc_base *ena_com_get_next_rx_cdesc(
         if (desc_phase != expected_phase)
                 return NULL;
 
+        /* Make sure we read the rest of the descriptor after the phase bit
+         * has been read
+         */
+        dma_rmb();
+
         return cdesc;
 }
 
@@ -493,6 +498,7 @@ int ena_com_tx_comp_req_id_get(struct ena_com_io_cq *io_cq, u16 *req_id)
         if (cdesc_phase != expected_phase)
                 return -EAGAIN;
 
+        dma_rmb();
         if (unlikely(cdesc->req_id >= io_cq->q_depth)) {
                 pr_err("Invalid req id %d\n", cdesc->req_id);
                 return -EINVAL;
diff --git a/drivers/net/ethernet/amazon/ena/ena_eth_com.h b/drivers/net/ethernet/amazon/ena/ena_eth_com.h
index 6fdc753d9483..2f7657227cfe 100644
--- a/drivers/net/ethernet/amazon/ena/ena_eth_com.h
+++ b/drivers/net/ethernet/amazon/ena/ena_eth_com.h
@@ -107,8 +107,7 @@ static inline int ena_com_sq_empty_space(struct ena_com_io_sq *io_sq)
         return io_sq->q_depth - 1 - cnt;
 }
 
-static inline int ena_com_write_sq_doorbell(struct ena_com_io_sq *io_sq,
-                                            bool relaxed)
+static inline int ena_com_write_sq_doorbell(struct ena_com_io_sq *io_sq)
 {
         u16 tail;
 
@@ -117,10 +116,7 @@ static inline int ena_com_write_sq_doorbell(struct ena_com_io_sq *io_sq,
         pr_debug("write submission queue doorbell for queue: %d tail: %d\n",
                  io_sq->qid, tail);
 
-        if (relaxed)
-                writel_relaxed(tail, io_sq->db_addr);
-        else
-                writel(tail, io_sq->db_addr);
+        writel(tail, io_sq->db_addr);
 
         return 0;
 }
diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c b/drivers/net/ethernet/amazon/ena/ena_netdev.c
index c673ac2df65b..25621a218f20 100644
--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
+++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
@@ -76,7 +76,7 @@ MODULE_DEVICE_TABLE(pci, ena_pci_tbl);
 
 static int ena_rss_init_default(struct ena_adapter *adapter);
 static void check_for_admin_com_state(struct ena_adapter *adapter);
-static void ena_destroy_device(struct ena_adapter *adapter);
+static void ena_destroy_device(struct ena_adapter *adapter, bool graceful);
 static int ena_restore_device(struct ena_adapter *adapter);
 
 static void ena_tx_timeout(struct net_device *dev)
@@ -461,7 +461,7 @@ static inline int ena_alloc_rx_page(struct ena_ring *rx_ring,
                 return -ENOMEM;
         }
 
-        dma = dma_map_page(rx_ring->dev, page, 0, PAGE_SIZE,
+        dma = dma_map_page(rx_ring->dev, page, 0, ENA_PAGE_SIZE,
                            DMA_FROM_DEVICE);
         if (unlikely(dma_mapping_error(rx_ring->dev, dma))) {
                 u64_stats_update_begin(&rx_ring->syncp);
@@ -478,7 +478,7 @@ static inline int ena_alloc_rx_page(struct ena_ring *rx_ring,
         rx_info->page_offset = 0;
         ena_buf = &rx_info->ena_buf;
         ena_buf->paddr = dma;
-        ena_buf->len = PAGE_SIZE;
+        ena_buf->len = ENA_PAGE_SIZE;
 
         return 0;
 }
@@ -495,7 +495,7 @@ static void ena_free_rx_page(struct ena_ring *rx_ring,
                 return;
         }
 
-        dma_unmap_page(rx_ring->dev, ena_buf->paddr, PAGE_SIZE,
+        dma_unmap_page(rx_ring->dev, ena_buf->paddr, ENA_PAGE_SIZE,
                        DMA_FROM_DEVICE);
 
         __free_page(page);
@@ -551,14 +551,9 @@ static int ena_refill_rx_bufs(struct ena_ring *rx_ring, u32 num)
                             rx_ring->qid, i, num);
         }
 
-        if (likely(i)) {
-                /* Add memory barrier to make sure the desc were written before
-                 * issue a doorbell
-                 */
-                wmb();
-                ena_com_write_sq_doorbell(rx_ring->ena_com_io_sq, true);
-                mmiowb();
-        }
+        /* ena_com_write_sq_doorbell issues a wmb() */
+        if (likely(i))
+                ena_com_write_sq_doorbell(rx_ring->ena_com_io_sq);
 
         rx_ring->next_to_use = next_to_use;
 
@@ -916,10 +911,10 @@ static struct sk_buff *ena_rx_skb(struct ena_ring *rx_ring,
         do {
                 dma_unmap_page(rx_ring->dev,
                                dma_unmap_addr(&rx_info->ena_buf, paddr),
-                               PAGE_SIZE, DMA_FROM_DEVICE);
+                               ENA_PAGE_SIZE, DMA_FROM_DEVICE);
 
                 skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, rx_info->page,
-                                rx_info->page_offset, len, PAGE_SIZE);
+                                rx_info->page_offset, len, ENA_PAGE_SIZE);
 
                 netif_dbg(rx_ring->adapter, rx_status, rx_ring->netdev,
                           "rx skb updated. len %d. data_len %d\n",
@@ -1900,7 +1895,7 @@ static int ena_close(struct net_device *netdev)
                           "Destroy failure, restarting device\n");
                 ena_dump_stats_to_dmesg(adapter);
                 /* rtnl lock already obtained in dev_ioctl() layer */
-                ena_destroy_device(adapter);
+                ena_destroy_device(adapter, false);
                 ena_restore_device(adapter);
         }
 
@@ -2112,12 +2107,6 @@ static netdev_tx_t ena_start_xmit(struct sk_buff *skb, struct net_device *dev)
         tx_ring->next_to_use = ENA_TX_RING_IDX_NEXT(next_to_use,
                 tx_ring->ring_size);
 
-        /* This WMB is aimed to:
-         * 1 - perform smp barrier before reading next_to_completion
-         * 2 - make sure the desc were written before trigger DB
-         */
-        wmb();
-
         /* stop the queue when no more space available, the packet can have up
          * to sgl_size + 2. one for the meta descriptor and one for header
          * (if the header is larger than tx_max_header_size).
@@ -2136,10 +2125,11 @@ static netdev_tx_t ena_start_xmit(struct sk_buff *skb, struct net_device *dev)
                  * stop the queue but meanwhile clean_tx_irq updates
                  * next_to_completion and terminates.
                  * The queue will remain stopped forever.
-                 * To solve this issue this function perform rmb, check
-                 * the wakeup condition and wake up the queue if needed.
+                 * To solve this issue add a mb() to make sure that
+                 * netif_tx_stop_queue() write is vissible before checking if
+                 * there is additional space in the queue.
                  */
-                smp_rmb();
+                smp_mb();
 
                 if (ena_com_sq_empty_space(tx_ring->ena_com_io_sq)
                                 > ENA_TX_WAKEUP_THRESH) {
@@ -2151,8 +2141,10 @@ static netdev_tx_t ena_start_xmit(struct sk_buff *skb, struct net_device *dev)
         }
 
         if (netif_xmit_stopped(txq) || !skb->xmit_more) {
-                /* trigger the dma engine */
-                ena_com_write_sq_doorbell(tx_ring->ena_com_io_sq, false);
+                /* trigger the dma engine. ena_com_write_sq_doorbell()
+                 * has a mb
+                 */
+                ena_com_write_sq_doorbell(tx_ring->ena_com_io_sq);
                 u64_stats_update_begin(&tx_ring->syncp);
                 tx_ring->tx_stats.doorbells++;
                 u64_stats_update_end(&tx_ring->syncp);
@@ -2193,25 +2185,6 @@ error_drop_packet:
         return NETDEV_TX_OK;
 }
 
-#ifdef CONFIG_NET_POLL_CONTROLLER
-static void ena_netpoll(struct net_device *netdev)
-{
-        struct ena_adapter *adapter = netdev_priv(netdev);
-        int i;
-
-        /* Dont schedule NAPI if the driver is in the middle of reset
-         * or netdev is down.
-         */
-
-        if (!test_bit(ENA_FLAG_DEV_UP, &adapter->flags) ||
-            test_bit(ENA_FLAG_TRIGGER_RESET, &adapter->flags))
-                return;
-
-        for (i = 0; i < adapter->num_queues; i++)
-                napi_schedule(&adapter->ena_napi[i].napi);
-}
-#endif /* CONFIG_NET_POLL_CONTROLLER */
-
 static u16 ena_select_queue(struct net_device *dev, struct sk_buff *skb,
                             struct net_device *sb_dev,
                             select_queue_fallback_t fallback)
@@ -2377,9 +2350,6 @@ static const struct net_device_ops ena_netdev_ops = {
         .ndo_change_mtu         = ena_change_mtu,
         .ndo_set_mac_address    = NULL,
         .ndo_validate_addr      = eth_validate_addr,
-#ifdef CONFIG_NET_POLL_CONTROLLER
-        .ndo_poll_controller    = ena_netpoll,
-#endif /* CONFIG_NET_POLL_CONTROLLER */
 };
 
 static int ena_device_validate_params(struct ena_adapter *adapter,
@@ -2550,12 +2520,15 @@ err_disable_msix:
         return rc;
 }
 
-static void ena_destroy_device(struct ena_adapter *adapter)
+static void ena_destroy_device(struct ena_adapter *adapter, bool graceful)
 {
         struct net_device *netdev = adapter->netdev;
         struct ena_com_dev *ena_dev = adapter->ena_dev;
         bool dev_up;
 
+        if (!test_bit(ENA_FLAG_DEVICE_RUNNING, &adapter->flags))
+                return;
+
         netif_carrier_off(netdev);
 
         del_timer_sync(&adapter->timer_service);
@@ -2563,7 +2536,8 @@ static void ena_destroy_device(struct ena_adapter *adapter)
         dev_up = test_bit(ENA_FLAG_DEV_UP, &adapter->flags);
         adapter->dev_up_before_reset = dev_up;
 
-        ena_com_set_admin_running_state(ena_dev, false);
+        if (!graceful)
+                ena_com_set_admin_running_state(ena_dev, false);
 
         if (test_bit(ENA_FLAG_DEV_UP, &adapter->flags))
                 ena_down(adapter);
@@ -2591,6 +2565,7 @@ static void ena_destroy_device(struct ena_adapter *adapter)
         adapter->reset_reason = ENA_REGS_RESET_NORMAL;
 
         clear_bit(ENA_FLAG_TRIGGER_RESET, &adapter->flags);
+        clear_bit(ENA_FLAG_DEVICE_RUNNING, &adapter->flags);
 }
 
 static int ena_restore_device(struct ena_adapter *adapter)
@@ -2635,6 +2610,7 @@ static int ena_restore_device(struct ena_adapter *adapter)
                 }
         }
 
+        set_bit(ENA_FLAG_DEVICE_RUNNING, &adapter->flags);
         mod_timer(&adapter->timer_service, round_jiffies(jiffies + HZ));
         dev_err(&pdev->dev, "Device reset completed successfully\n");
 
@@ -2665,7 +2641,7 @@ static void ena_fw_reset_device(struct work_struct *work)
                 return;
         }
         rtnl_lock();
-        ena_destroy_device(adapter);
+        ena_destroy_device(adapter, false);
         ena_restore_device(adapter);
         rtnl_unlock();
 }
@@ -3409,30 +3385,24 @@ static void ena_remove(struct pci_dev *pdev)
                 netdev->rx_cpu_rmap = NULL;
         }
 #endif /* CONFIG_RFS_ACCEL */
-
-        unregister_netdev(netdev);
         del_timer_sync(&adapter->timer_service);
 
         cancel_work_sync(&adapter->reset_task);
 
-        /* Reset the device only if the device is running. */
-        if (test_bit(ENA_FLAG_DEVICE_RUNNING, &adapter->flags))
-                ena_com_dev_reset(ena_dev, adapter->reset_reason);
+        unregister_netdev(netdev);
 
-        ena_free_mgmnt_irq(adapter);
+        /* If the device is running then we want to make sure the device will be
+         * reset to make sure no more events will be issued by the device.
+         */
+        if (test_bit(ENA_FLAG_DEVICE_RUNNING, &adapter->flags))
+                set_bit(ENA_FLAG_TRIGGER_RESET, &adapter->flags);
 
-        ena_disable_msix(adapter);
+        rtnl_lock();
+        ena_destroy_device(adapter, true);
+        rtnl_unlock();
 
         free_netdev(netdev);
 
-        ena_com_mmio_reg_read_request_destroy(ena_dev);
-
-        ena_com_abort_admin_commands(ena_dev);
-
-        ena_com_wait_for_abort_completion(ena_dev);
-
-        ena_com_admin_destroy(ena_dev);
-
         ena_com_rss_destroy(ena_dev);
 
         ena_com_delete_debug_area(ena_dev);
@@ -3467,7 +3437,7 @@ static int ena_suspend(struct pci_dev *pdev,  pm_message_t state)
                         "ignoring device reset request as the device is being suspended\n");
                 clear_bit(ENA_FLAG_TRIGGER_RESET, &adapter->flags);
         }
-        ena_destroy_device(adapter);
+        ena_destroy_device(adapter, true);
         rtnl_unlock();
         return 0;
 }
diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.h b/drivers/net/ethernet/amazon/ena/ena_netdev.h
index f1972b5ab650..7c7ae56c52cf 100644
--- a/drivers/net/ethernet/amazon/ena/ena_netdev.h
+++ b/drivers/net/ethernet/amazon/ena/ena_netdev.h
@@ -355,4 +355,15 @@ void ena_dump_stats_to_buf(struct ena_adapter *adapter, u8 *buf);
 
 int ena_get_sset_count(struct net_device *netdev, int sset);
 
+/* The ENA buffer length fields is 16 bit long. So when PAGE_SIZE == 64kB the
+ * driver passas 0.
+ * Since the max packet size the ENA handles is ~9kB limit the buffer length to
+ * 16kB.
+ */
+#if PAGE_SIZE > SZ_16K
+#define ENA_PAGE_SIZE SZ_16K
+#else
+#define ENA_PAGE_SIZE PAGE_SIZE
+#endif
+
 #endif /* !(ENA_H) */
diff --git a/drivers/net/ethernet/amd/declance.c b/drivers/net/ethernet/amd/declance.c
index 116997a8b593..00332a1ea84b 100644
--- a/drivers/net/ethernet/amd/declance.c
+++ b/drivers/net/ethernet/amd/declance.c
@@ -1031,6 +1031,7 @@ static int dec_lance_probe(struct device *bdev, const int type)
         int i, ret;
         unsigned long esar_base;
         unsigned char *esar;
+        const char *desc;
 
         if (dec_lance_debug && version_printed++ == 0)
                 printk(version);
@@ -1216,19 +1217,20 @@ static int dec_lance_probe(struct device *bdev, const int type)
          */
         switch (type) {
         case ASIC_LANCE:
-                printk("%s: IOASIC onboard LANCE", name);
+                desc = "IOASIC onboard LANCE";
                 break;
         case PMAD_LANCE:
-                printk("%s: PMAD-AA", name);
+                desc = "PMAD-AA";
                 break;
         case PMAX_LANCE:
-                printk("%s: PMAX onboard LANCE", name);
+                desc = "PMAX onboard LANCE";
                 break;
         }
         for (i = 0; i < 6; i++)
                 dev->dev_addr[i] = esar[i * 4];
 
-        printk(", addr = %pM, irq = %d\n", dev->dev_addr, dev->irq);
+        printk("%s: %s, addr = %pM, irq = %d\n",
+               name, desc, dev->dev_addr, dev->irq);
 
         dev->netdev_ops = &lance_netdev_ops;
         dev->watchdog_timeo = 5*HZ;
diff --git a/drivers/net/ethernet/apple/bmac.c b/drivers/net/ethernet/apple/bmac.c
index 024998d6d8c6..6a8e2567f2bd 100644
--- a/drivers/net/ethernet/apple/bmac.c
+++ b/drivers/net/ethernet/apple/bmac.c
@@ -154,7 +154,7 @@ static irqreturn_t bmac_txdma_intr(int irq, void *dev_id);
 static irqreturn_t bmac_rxdma_intr(int irq, void *dev_id);
 static void bmac_set_timeout(struct net_device *dev);
 static void bmac_tx_timeout(struct timer_list *t);
-static int bmac_output(struct sk_buff *skb, struct net_device *dev);
+static netdev_tx_t bmac_output(struct sk_buff *skb, struct net_device *dev);
 static void bmac_start(struct net_device *dev);
 
 #define DBDMA_SET(x)    ( ((x) | (x) << 16) )
@@ -1456,7 +1456,7 @@ bmac_start(struct net_device *dev)
         spin_unlock_irqrestore(&bp->lock, flags);
 }
 
-static int
+static netdev_tx_t
 bmac_output(struct sk_buff *skb, struct net_device *dev)
 {
         struct bmac_data *bp = netdev_priv(dev);
diff --git a/drivers/net/ethernet/apple/mace.c b/drivers/net/ethernet/apple/mace.c
index 0b5429d76bcf..68b9ee489489 100644
--- a/drivers/net/ethernet/apple/mace.c
+++ b/drivers/net/ethernet/apple/mace.c
@@ -78,7 +78,7 @@ struct mace_data {
 
 static int mace_open(struct net_device *dev);
 static int mace_close(struct net_device *dev);
-static int mace_xmit_start(struct sk_buff *skb, struct net_device *dev);
+static netdev_tx_t mace_xmit_start(struct sk_buff *skb, struct net_device *dev);
 static void mace_set_multicast(struct net_device *dev);
 static void mace_reset(struct net_device *dev);
 static int mace_set_address(struct net_device *dev, void *addr);
@@ -525,7 +525,7 @@ static inline void mace_set_timeout(struct net_device *dev)
     mp->timeout_active = 1;
 }
 
-static int mace_xmit_start(struct sk_buff *skb, struct net_device *dev)
+static netdev_tx_t mace_xmit_start(struct sk_buff *skb, struct net_device *dev)
 {
     struct mace_data *mp = netdev_priv(dev);
     volatile struct dbdma_regs __iomem *td = mp->tx_dma;
diff --git a/drivers/net/ethernet/apple/macmace.c b/drivers/net/ethernet/apple/macmace.c
index 137cbb470af2..376f2c2613e7 100644
--- a/drivers/net/ethernet/apple/macmace.c
+++ b/drivers/net/ethernet/apple/macmace.c
@@ -89,7 +89,7 @@ struct mace_frame {
 
 static int mace_open(struct net_device *dev);
 static int mace_close(struct net_device *dev);
-static int mace_xmit_start(struct sk_buff *skb, struct net_device *dev);
+static netdev_tx_t mace_xmit_start(struct sk_buff *skb, struct net_device *dev);
 static void mace_set_multicast(struct net_device *dev);
 static int mace_set_address(struct net_device *dev, void *addr);
 static void mace_reset(struct net_device *dev);
@@ -444,7 +444,7 @@ static int mace_close(struct net_device *dev)
  * Transmit a frame
  */
 
-static int mace_xmit_start(struct sk_buff *skb, struct net_device *dev)
+static netdev_tx_t mace_xmit_start(struct sk_buff *skb, struct net_device *dev)
 {
         struct mace_data *mp = netdev_priv(dev);
         unsigned long flags;
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
index b5f1f62e8e25..d1e1a0ba8615 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
@@ -225,9 +225,10 @@ int aq_ring_rx_clean(struct aq_ring_s *self,
                 }
 
                 /* for single fragment packets use build_skb() */
-                if (buff->is_eop) {
+                if (buff->is_eop &&
+                    buff->len <= AQ_CFG_RX_FRAME_MAX - AQ_SKB_ALIGN) {
                         skb = build_skb(page_address(buff->page),
-                                        buff->len + AQ_SKB_ALIGN);
+                                        AQ_CFG_RX_FRAME_MAX);
                         if (unlikely(!skb)) {
                                 err = -ENOMEM;
                                 goto err_exit;
@@ -247,18 +248,21 @@ int aq_ring_rx_clean(struct aq_ring_s *self,
                                         buff->len - ETH_HLEN,
                                         SKB_TRUESIZE(buff->len - ETH_HLEN));
 
-                        for (i = 1U, next_ = buff->next,
-                             buff_ = &self->buff_ring[next_]; true;
-                             next_ = buff_->next,
-                             buff_ = &self->buff_ring[next_], ++i) {
-                                skb_add_rx_frag(skb, i, buff_->page, 0,
-                                                buff_->len,
-                                                SKB_TRUESIZE(buff->len -
-                                                ETH_HLEN));
-                                buff_->is_cleaned = 1;
-
-                                if (buff_->is_eop)
-                                        break;
+                        if (!buff->is_eop) {
+                                for (i = 1U, next_ = buff->next,
+                                     buff_ = &self->buff_ring[next_];
+                                     true; next_ = buff_->next,
+                                     buff_ = &self->buff_ring[next_], ++i) {
+                                        skb_add_rx_frag(skb, i,
+                                                        buff_->page, 0,
+                                                        buff_->len,
+                                                        SKB_TRUESIZE(buff->len -
+                                                        ETH_HLEN));
+                                        buff_->is_cleaned = 1;
+
+                                        if (buff_->is_eop)
+                                                break;
+                                }
                         }
                 }
 
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index 71362b7f6040..fcc2328bb0d9 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -12894,19 +12894,6 @@ static int bnx2x_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
         }
 }
 
-#ifdef CONFIG_NET_POLL_CONTROLLER
-static void poll_bnx2x(struct net_device *dev)
-{
-        struct bnx2x *bp = netdev_priv(dev);
-        int i;
-
-        for_each_eth_queue(bp, i) {
-                struct bnx2x_fastpath *fp = &bp->fp[i];
-                napi_schedule(&bnx2x_fp(bp, fp->index, napi));
-        }
-}
-#endif
-
 static int bnx2x_validate_addr(struct net_device *dev)
 {
         struct bnx2x *bp = netdev_priv(dev);
@@ -13113,9 +13100,6 @@ static const struct net_device_ops bnx2x_netdev_ops = {
         .ndo_tx_timeout         = bnx2x_tx_timeout,
         .ndo_vlan_rx_add_vid    = bnx2x_vlan_rx_add_vid,
         .ndo_vlan_rx_kill_vid   = bnx2x_vlan_rx_kill_vid,
-#ifdef CONFIG_NET_POLL_CONTROLLER
-        .ndo_poll_controller    = poll_bnx2x,
-#endif
         .ndo_setup_tc           = __bnx2x_setup_tc,
 #ifdef CONFIG_BNX2X_SRIOV
         .ndo_set_vf_mac         = bnx2x_set_vf_mac,
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index 8bb1e38b1681..0478e562abac 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -1884,8 +1884,11 @@ static int bnxt_poll_work(struct bnxt *bp, struct bnxt_napi *bnapi, int budget)
                 if (TX_CMP_TYPE(txcmp) == CMP_TYPE_TX_L2_CMP) {
                         tx_pkts++;
                         /* return full budget so NAPI will complete. */
-                        if (unlikely(tx_pkts > bp->tx_wake_thresh))
+                        if (unlikely(tx_pkts > bp->tx_wake_thresh)) {
                                 rx_pkts = budget;
+                                raw_cons = NEXT_RAW_CMP(raw_cons);
+                                break;
+                        }
                 } else if ((TX_CMP_TYPE(txcmp) & 0x30) == 0x10) {
                         if (likely(budget))
                                 rc = bnxt_rx_pkt(bp, bnapi, &raw_cons, &event);
@@ -1913,7 +1916,7 @@ static int bnxt_poll_work(struct bnxt *bp, struct bnxt_napi *bnapi, int budget)
                 }
                 raw_cons = NEXT_RAW_CMP(raw_cons);
 
-                if (rx_pkts == budget)
+                if (rx_pkts && rx_pkts == budget)
                         break;
         }
 
@@ -2027,8 +2030,12 @@ static int bnxt_poll(struct napi_struct *napi, int budget)
         while (1) {
                 work_done += bnxt_poll_work(bp, bnapi, budget - work_done);
 
-                if (work_done >= budget)
+                if (work_done >= budget) {
+                        if (!budget)
+                                BNXT_CP_DB_REARM(cpr->cp_doorbell,
+                                                 cpr->cp_raw_cons);
                         break;
+                }
 
                 if (!bnxt_has_work(bp, cpr)) {
                         if (napi_complete_done(napi, work_done))
@@ -5913,12 +5920,12 @@ unsigned int bnxt_get_max_func_cp_rings(struct bnxt *bp)
         return bp->hw_resc.max_cp_rings;
 }
 
-void bnxt_set_max_func_cp_rings(struct bnxt *bp, unsigned int max)
+unsigned int bnxt_get_max_func_cp_rings_for_en(struct bnxt *bp)
 {
-        bp->hw_resc.max_cp_rings = max;
+        return bp->hw_resc.max_cp_rings - bnxt_get_ulp_msix_num(bp);
 }
 
-unsigned int bnxt_get_max_func_irqs(struct bnxt *bp)
+static unsigned int bnxt_get_max_func_irqs(struct bnxt *bp)
 {
         struct bnxt_hw_resc *hw_resc = &bp->hw_resc;
 
@@ -6684,6 +6691,8 @@ static int bnxt_hwrm_if_change(struct bnxt *bp, bool up)
                 hw_resc->resv_rx_rings = 0;
                 hw_resc->resv_hw_ring_grps = 0;
                 hw_resc->resv_vnics = 0;
+                bp->tx_nr_rings = 0;
+                bp->rx_nr_rings = 0;
         }
         return rc;
 }
@@ -7670,21 +7679,6 @@ static void bnxt_tx_timeout(struct net_device *dev)
         bnxt_queue_sp_work(bp);
 }
 
-#ifdef CONFIG_NET_POLL_CONTROLLER
-static void bnxt_poll_controller(struct net_device *dev)
-{
-        struct bnxt *bp = netdev_priv(dev);
-        int i;
-
-        /* Only process tx rings/combined rings in netpoll mode. */
-        for (i = 0; i < bp->tx_nr_rings; i++) {
-                struct bnxt_tx_ring_info *txr = &bp->tx_ring[i];
-
-                napi_schedule(&txr->bnapi->napi);
-        }
-}
-#endif
-
 static void bnxt_timer(struct timer_list *t)
 {
         struct bnxt *bp = from_timer(bp, t, timer);
@@ -8025,7 +8019,7 @@ static int bnxt_change_mac_addr(struct net_device *dev, void *p)
         if (ether_addr_equal(addr->sa_data, dev->dev_addr))
                 return 0;
 
-        rc = bnxt_approve_mac(bp, addr->sa_data);
+        rc = bnxt_approve_mac(bp, addr->sa_data, true);
         if (rc)
                 return rc;
 
@@ -8518,9 +8512,6 @@ static const struct net_device_ops bnxt_netdev_ops = {
         .ndo_set_vf_spoofchk    = bnxt_set_vf_spoofchk,
         .ndo_set_vf_trust       = bnxt_set_vf_trust,
 #endif
-#ifdef CONFIG_NET_POLL_CONTROLLER
-        .ndo_poll_controller    = bnxt_poll_controller,
-#endif
         .ndo_setup_tc           = bnxt_setup_tc,
 #ifdef CONFIG_RFS_ACCEL
         .ndo_rx_flow_steer      = bnxt_rx_flow_steer,
@@ -8629,7 +8620,8 @@ static void _bnxt_get_max_rings(struct bnxt *bp, int *max_rx, int *max_tx,
 
         *max_tx = hw_resc->max_tx_rings;
         *max_rx = hw_resc->max_rx_rings;
-        *max_cp = min_t(int, hw_resc->max_irqs, hw_resc->max_cp_rings);
+        *max_cp = min_t(int, bnxt_get_max_func_cp_rings_for_en(bp),
+                        hw_resc->max_irqs);
         *max_cp = min_t(int, *max_cp, hw_resc->max_stat_ctxs);
         max_ring_grps = hw_resc->max_hw_ring_grps;
         if (BNXT_CHIP_TYPE_NITRO_A0(bp) && BNXT_PF(bp)) {
@@ -8769,20 +8761,25 @@ static int bnxt_init_dflt_ring_mode(struct bnxt *bp)
         if (bp->tx_nr_rings)
                 return 0;
 
+        bnxt_ulp_irq_stop(bp);
+        bnxt_clear_int_mode(bp);
         rc = bnxt_set_dflt_rings(bp, true);
         if (rc) {
                 netdev_err(bp->dev, "Not enough rings available.\n");
-                return rc;
+                goto init_dflt_ring_err;
         }
         rc = bnxt_init_int_mode(bp);
         if (rc)
-                return rc;
+                goto init_dflt_ring_err;
+
         bp->tx_nr_rings_per_tc = bp->tx_nr_rings;
         if (bnxt_rfs_supported(bp) && bnxt_rfs_capable(bp)) {
                 bp->flags |= BNXT_FLAG_RFS;
                 bp->dev->features |= NETIF_F_NTUPLE;
         }
-        return 0;
+init_dflt_ring_err:
+        bnxt_ulp_irq_restart(bp, rc);
+        return rc;
 }
 
 int bnxt_restore_pf_fw_resources(struct bnxt *bp)
@@ -8819,14 +8816,19 @@ static int bnxt_init_mac_addr(struct bnxt *bp)
         } else {
 #ifdef CONFIG_BNXT_SRIOV
                 struct bnxt_vf_info *vf = &bp->vf;
+                bool strict_approval = true;
 
                 if (is_valid_ether_addr(vf->mac_addr)) {
                         /* overwrite netdev dev_addr with admin VF MAC */
                         memcpy(bp->dev->dev_addr, vf->mac_addr, ETH_ALEN);
+                        /* Older PF driver or firmware may not approve this
+                         * correctly.
+                         */
+                        strict_approval = false;
                 } else {
                         eth_hw_addr_random(bp->dev);
                 }
-                rc = bnxt_approve_mac(bp, bp->dev->dev_addr);
+                rc = bnxt_approve_mac(bp, bp->dev->dev_addr, strict_approval);
 #endif
         }
         return rc;
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
index fefa011320e0..bde384630a75 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
@@ -1481,8 +1481,7 @@ int bnxt_hwrm_set_coal(struct bnxt *);
 unsigned int bnxt_get_max_func_stat_ctxs(struct bnxt *bp);
 void bnxt_set_max_func_stat_ctxs(struct bnxt *bp, unsigned int max);
 unsigned int bnxt_get_max_func_cp_rings(struct bnxt *bp);
-void bnxt_set_max_func_cp_rings(struct bnxt *bp, unsigned int max);
-unsigned int bnxt_get_max_func_irqs(struct bnxt *bp);
+unsigned int bnxt_get_max_func_cp_rings_for_en(struct bnxt *bp);
 int bnxt_get_avail_msix(struct bnxt *bp, int num);
 int bnxt_reserve_rings(struct bnxt *bp);
 void bnxt_tx_disable(struct bnxt *bp);
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c
index f3b9fbcc705b..790c684f08ab 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c
@@ -46,6 +46,9 @@ static int bnxt_hwrm_nvm_req(struct bnxt *bp, u32 param_id, void *msg,
                 }
         }
 
+        if (i == ARRAY_SIZE(nvm_params))
+                return -EOPNOTSUPP;
+
         if (nvm_param.dir_type == BNXT_NVM_PORT_CFG)
                 idx = bp->pf.port_id;
         else if (nvm_param.dir_type == BNXT_NVM_FUNC_CFG)
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c
index 6d583bcd2a81..3962f6fd543c 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c
@@ -451,7 +451,7 @@ static int bnxt_hwrm_func_vf_resc_cfg(struct bnxt *bp, int num_vfs)
 
         bnxt_hwrm_cmd_hdr_init(bp, &req, HWRM_FUNC_VF_RESOURCE_CFG, -1, -1);
 
-        vf_cp_rings = hw_resc->max_cp_rings - bp->cp_nr_rings;
+        vf_cp_rings = bnxt_get_max_func_cp_rings_for_en(bp) - bp->cp_nr_rings;
         vf_stat_ctx = hw_resc->max_stat_ctxs - bp->num_stat_ctxs;
         if (bp->flags & BNXT_FLAG_AGG_RINGS)
                 vf_rx_rings = hw_resc->max_rx_rings - bp->rx_nr_rings * 2;
@@ -549,7 +549,8 @@ static int bnxt_hwrm_func_cfg(struct bnxt *bp, int num_vfs)
         max_stat_ctxs = hw_resc->max_stat_ctxs;
 
         /* Remaining rings are distributed equally amongs VF's for now */
-        vf_cp_rings = (hw_resc->max_cp_rings - bp->cp_nr_rings) / num_vfs;
+        vf_cp_rings = (bnxt_get_max_func_cp_rings_for_en(bp) -
+                       bp->cp_nr_rings) / num_vfs;
         vf_stat_ctx = (max_stat_ctxs - bp->num_stat_ctxs) / num_vfs;
         if (bp->flags & BNXT_FLAG_AGG_RINGS)
                 vf_rx_rings = (hw_resc->max_rx_rings - bp->rx_nr_rings * 2) /
@@ -643,7 +644,7 @@ static int bnxt_sriov_enable(struct bnxt *bp, int *num_vfs)
          */
         vfs_supported = *num_vfs;
 
-        avail_cp = hw_resc->max_cp_rings - bp->cp_nr_rings;
+        avail_cp = bnxt_get_max_func_cp_rings_for_en(bp) - bp->cp_nr_rings;
         avail_stat = hw_resc->max_stat_ctxs - bp->num_stat_ctxs;
         avail_cp = min_t(int, avail_cp, avail_stat);
 
@@ -1103,7 +1104,7 @@ update_vf_mac_exit:
         mutex_unlock(&bp->hwrm_cmd_lock);
 }
 
-int bnxt_approve_mac(struct bnxt *bp, u8 *mac)
+int bnxt_approve_mac(struct bnxt *bp, u8 *mac, bool strict)
 {
         struct hwrm_func_vf_cfg_input req = {0};
         int rc = 0;
@@ -1121,12 +1122,13 @@ int bnxt_approve_mac(struct bnxt *bp, u8 *mac)
         memcpy(req.dflt_mac_addr, mac, ETH_ALEN);
         rc = hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT);
 mac_done:
-        if (rc) {
+        if (rc && strict) {
                 rc = -EADDRNOTAVAIL;
                 netdev_warn(bp->dev, "VF MAC address %pM not approved by the PF\n",
                             mac);
+                return rc;
         }
-        return rc;
+        return 0;
 }
 #else
 
@@ -1143,7 +1145,7 @@ void bnxt_update_vf_mac(struct bnxt *bp)
 {
 }
 
-int bnxt_approve_mac(struct bnxt *bp, u8 *mac)
+int bnxt_approve_mac(struct bnxt *bp, u8 *mac, bool strict)
 {
         return 0;
 }
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.h b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.h
index e9b20cd19881..2eed9eda1195 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.h
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.h
@@ -39,5 +39,5 @@ int bnxt_sriov_configure(struct pci_dev *pdev, int num_vfs);
 void bnxt_sriov_disable(struct bnxt *);
 void bnxt_hwrm_exec_fwd_req(struct bnxt *);
 void bnxt_update_vf_mac(struct bnxt *);
-int bnxt_approve_mac(struct bnxt *, u8 *);
+int bnxt_approve_mac(struct bnxt *, u8 *, bool);
 #endif
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
index 139d96c5a023..e1594c9df4c6 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
@@ -75,17 +75,23 @@ static int bnxt_tc_parse_redir(struct bnxt *bp,
         return 0;
 }
 
-static void bnxt_tc_parse_vlan(struct bnxt *bp,
-                               struct bnxt_tc_actions *actions,
-                               const struct tc_action *tc_act)
+static int bnxt_tc_parse_vlan(struct bnxt *bp,
+                              struct bnxt_tc_actions *actions,
+                              const struct tc_action *tc_act)
 {
-        if (tcf_vlan_action(tc_act) == TCA_VLAN_ACT_POP) {
+        switch (tcf_vlan_action(tc_act)) {
+        case TCA_VLAN_ACT_POP:
                 actions->flags |= BNXT_TC_ACTION_FLAG_POP_VLAN;
-        } else if (tcf_vlan_action(tc_act) == TCA_VLAN_ACT_PUSH) {
+                break;
+        case TCA_VLAN_ACT_PUSH:
                 actions->flags |= BNXT_TC_ACTION_FLAG_PUSH_VLAN;
                 actions->push_vlan_tci = htons(tcf_vlan_push_vid(tc_act));
                 actions->push_vlan_tpid = tcf_vlan_push_proto(tc_act);
+                break;
+        default:
+                return -EOPNOTSUPP;
         }
+        return 0;
 }
 
 static int bnxt_tc_parse_tunnel_set(struct bnxt *bp,
@@ -110,16 +116,14 @@ static int bnxt_tc_parse_actions(struct bnxt *bp,
                                  struct tcf_exts *tc_exts)
 {
         const struct tc_action *tc_act;
-        LIST_HEAD(tc_actions);
-        int rc;
+        int i, rc;
 
         if (!tcf_exts_has_actions(tc_exts)) {
                 netdev_info(bp->dev, "no actions");
                 return -EINVAL;
         }
 
-        tcf_exts_to_list(tc_exts, &tc_actions);
-        list_for_each_entry(tc_act, &tc_actions, list) {
+        tcf_exts_for_each_action(i, tc_act, tc_exts) {
                 /* Drop action */
                 if (is_tcf_gact_shot(tc_act)) {
                         actions->flags |= BNXT_TC_ACTION_FLAG_DROP;
@@ -136,7 +140,9 @@ static int bnxt_tc_parse_actions(struct bnxt *bp,
 
                 /* Push/pop VLAN */
                 if (is_tcf_vlan(tc_act)) {
-                        bnxt_tc_parse_vlan(bp, actions, tc_act);
+                        rc = bnxt_tc_parse_vlan(bp, actions, tc_act);
+                        if (rc)
+                                return rc;
                         continue;
                 }
 
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c
index c37b2842f972..beee61292d5e 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c
@@ -169,7 +169,6 @@ static int bnxt_req_msix_vecs(struct bnxt_en_dev *edev, int ulp_id,
                 edev->ulp_tbl[ulp_id].msix_requested = avail_msix;
         }
         bnxt_fill_msix_vecs(bp, ent);
-        bnxt_set_max_func_cp_rings(bp, max_cp_rings - avail_msix);
         edev->flags |= BNXT_EN_FLAG_MSIX_REQUESTED;
         return avail_msix;
 }
@@ -178,7 +177,6 @@ static int bnxt_free_msix_vecs(struct bnxt_en_dev *edev, int ulp_id)
 {
         struct net_device *dev = edev->net;
         struct bnxt *bp = netdev_priv(dev);
-        int max_cp_rings, msix_requested;
 
         ASSERT_RTNL();
         if (ulp_id != BNXT_ROCE_ULP)
@@ -187,9 +185,6 @@ static int bnxt_free_msix_vecs(struct bnxt_en_dev *edev, int ulp_id)
         if (!(edev->flags & BNXT_EN_FLAG_MSIX_REQUESTED))
                 return 0;
 
-        max_cp_rings = bnxt_get_max_func_cp_rings(bp);
-        msix_requested = edev->ulp_tbl[ulp_id].msix_requested;
-        bnxt_set_max_func_cp_rings(bp, max_cp_rings + msix_requested);
         edev->ulp_tbl[ulp_id].msix_requested = 0;
         edev->flags &= ~BNXT_EN_FLAG_MSIX_REQUESTED;
         if (netif_running(dev)) {
@@ -220,21 +215,6 @@ int bnxt_get_ulp_msix_base(struct bnxt *bp)
         return 0;
 }
 
-void bnxt_subtract_ulp_resources(struct bnxt *bp, int ulp_id)
-{
-        ASSERT_RTNL();
-        if (bnxt_ulp_registered(bp->edev, ulp_id)) {
-                struct bnxt_en_dev *edev = bp->edev;
-                unsigned int msix_req, max;
-
-                msix_req = edev->ulp_tbl[ulp_id].msix_requested;
-                max = bnxt_get_max_func_cp_rings(bp);
-                bnxt_set_max_func_cp_rings(bp, max - msix_req);
-                max = bnxt_get_max_func_stat_ctxs(bp);
-                bnxt_set_max_func_stat_ctxs(bp, max - 1);
-        }
-}
-
 static int bnxt_send_msg(struct bnxt_en_dev *edev, int ulp_id,
                          struct bnxt_fw_msg *fw_msg)
 {
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.h b/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.h
index df48ac71729f..d9bea37cd211 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.h
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.h
@@ -90,7 +90,6 @@ static inline bool bnxt_ulp_registered(struct bnxt_en_dev *edev, int ulp_id)
 
 int bnxt_get_ulp_msix_num(struct bnxt *bp);
 int bnxt_get_ulp_msix_base(struct bnxt *bp);
-void bnxt_subtract_ulp_resources(struct bnxt *bp, int ulp_id);
 void bnxt_ulp_stop(struct bnxt *bp);
 void bnxt_ulp_start(struct bnxt *bp);
 void bnxt_ulp_sriov_cfg(struct bnxt *bp, int num_vfs);
diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.h b/drivers/net/ethernet/broadcom/genet/bcmgenet.h
index b773bc07edf7..14b49612aa86 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.h
+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.h
@@ -186,6 +186,9 @@ struct bcmgenet_mib_counters {
 #define UMAC_MAC1                       0x010
 #define UMAC_MAX_FRAME_LEN              0x014
 
+#define UMAC_MODE                       0x44
+#define  MODE_LINK_STATUS               (1 << 5)
+
 #define UMAC_EEE_CTRL                   0x064
 #define  EN_LPI_RX_PAUSE                (1 << 0)
 #define  EN_LPI_TX_PFC                  (1 << 1)
diff --git a/drivers/net/ethernet/broadcom/genet/bcmmii.c b/drivers/net/ethernet/broadcom/genet/bcmmii.c
index 5333274a283c..4241ae928d4a 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmmii.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmmii.c
@@ -115,8 +115,14 @@ void bcmgenet_mii_setup(struct net_device *dev)
 static int bcmgenet_fixed_phy_link_update(struct net_device *dev,
                                           struct fixed_phy_status *status)
 {
-        if (dev && dev->phydev && status)
-                status->link = dev->phydev->link;
+        struct bcmgenet_priv *priv;
+        u32 reg;
+
+        if (dev && dev->phydev && status) {
+                priv = netdev_priv(dev);
+                reg = bcmgenet_umac_readl(priv, UMAC_MODE);
+                status->link = !!(reg & MODE_LINK_STATUS);
+        }
 
         return 0;
 }
diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
index dc09f9a8a49b..58b9744c4058 100644
--- a/drivers/net/ethernet/cadence/macb_main.c
+++ b/drivers/net/ethernet/cadence/macb_main.c
@@ -482,11 +482,6 @@ static int macb_mii_probe(struct net_device *dev)
 
         if (np) {
                 if (of_phy_is_fixed_link(np)) {
-                        if (of_phy_register_fixed_link(np) < 0) {
-                                dev_err(&bp->pdev->dev,
-                                        "broken fixed-link specification\n");
-                                return -ENODEV;
-                        }
                         bp->phy_node = of_node_get(np);
                 } else {
                         bp->phy_node = of_parse_phandle(np, "phy-handle", 0);
@@ -569,7 +564,7 @@ static int macb_mii_init(struct macb *bp)
 {
         struct macb_platform_data *pdata;
         struct device_node *np;
-        int err;
+        int err = -ENXIO;
 
         /* Enable management port */
         macb_writel(bp, NCR, MACB_BIT(MPE));
@@ -592,12 +587,23 @@ static int macb_mii_init(struct macb *bp)
         dev_set_drvdata(&bp->dev->dev, bp->mii_bus);
 
         np = bp->pdev->dev.of_node;
-        if (pdata)
-                bp->mii_bus->phy_mask = pdata->phy_mask;
+        if (np && of_phy_is_fixed_link(np)) {
+                if (of_phy_register_fixed_link(np) < 0) {
+                        dev_err(&bp->pdev->dev,
+                                "broken fixed-link specification %pOF\n", np);
+                        goto err_out_free_mdiobus;
+                }
+
+                err = mdiobus_register(bp->mii_bus);
+        } else {
+                if (pdata)
+                        bp->mii_bus->phy_mask = pdata->phy_mask;
+
+                err = of_mdiobus_register(bp->mii_bus, np);
+        }
 
-        err = of_mdiobus_register(bp->mii_bus, np);
         if (err)
-                goto err_out_free_mdiobus;
+                goto err_out_free_fixed_link;
 
         err = macb_mii_probe(bp->dev);
         if (err)
@@ -607,6 +613,7 @@ static int macb_mii_init(struct macb *bp)
 
 err_out_unregister_bus:
         mdiobus_unregister(bp->mii_bus);
+err_out_free_fixed_link:
         if (np && of_phy_is_fixed_link(np))
                 of_phy_deregister_fixed_link(np);
 err_out_free_mdiobus:
@@ -642,7 +649,7 @@ static int macb_halt_tx(struct macb *bp)
                 if (!(status & MACB_BIT(TGO)))
                         return 0;
 
-                usleep_range(10, 250);
+                udelay(250);
         } while (time_before(halt_time, timeout));
 
         return -ETIMEDOUT;
@@ -2028,14 +2035,17 @@ static void macb_reset_hw(struct macb *bp)
 {
         struct macb_queue *queue;
         unsigned int q;
+        u32 ctrl = macb_readl(bp, NCR);
 
         /* Disable RX and TX (XXX: Should we halt the transmission
          * more gracefully?)
          */
-        macb_writel(bp, NCR, 0);
+        ctrl &= ~(MACB_BIT(RE) | MACB_BIT(TE));
 
         /* Clear the stats registers (XXX: Update stats first?) */
-        macb_writel(bp, NCR, MACB_BIT(CLRSTAT));
+        ctrl |= MACB_BIT(CLRSTAT);
+
+        macb_writel(bp, NCR, ctrl);
 
         /* Clear all status flags */
         macb_writel(bp, TSR, -1);
@@ -2150,6 +2160,7 @@ static void macb_configure_dma(struct macb *bp)
                 else
                         dmacfg &= ~GEM_BIT(TXCOEN);
 
+                dmacfg &= ~GEM_BIT(ADDR64);
 #ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT
                 if (bp->hw_dma_cap & HW_DMA_CAP_64B)
                         dmacfg |= GEM_BIT(ADDR64);
@@ -2223,7 +2234,7 @@ static void macb_init_hw(struct macb *bp)
         }
 
         /* Enable TX and RX */
-        macb_writel(bp, NCR, MACB_BIT(RE) | MACB_BIT(TE) | MACB_BIT(MPE));
+        macb_writel(bp, NCR, macb_readl(bp, NCR) | MACB_BIT(RE) | MACB_BIT(TE));
 }
 
 /* The hash address register is 64 bits long and takes up two
@@ -3827,6 +3838,13 @@ static const struct macb_config at91sam9260_config = {
         .init = macb_init,
 };
 
+static const struct macb_config sama5d3macb_config = {
+        .caps = MACB_CAPS_SG_DISABLED
+              | MACB_CAPS_USRIO_HAS_CLKEN | MACB_CAPS_USRIO_DEFAULT_IS_MII_GMII,
+        .clk_init = macb_clk_init,
+        .init = macb_init,
+};
+
 static const struct macb_config pc302gem_config = {
         .caps = MACB_CAPS_SG_DISABLED | MACB_CAPS_GIGABIT_MODE_AVAILABLE,
         .dma_burst_length = 16,
@@ -3894,6 +3912,7 @@ static const struct of_device_id macb_dt_ids[] = {
         { .compatible = "cdns,gem", .data = &pc302gem_config },
         { .compatible = "atmel,sama5d2-gem", .data = &sama5d2_config },
         { .compatible = "atmel,sama5d3-gem", .data = &sama5d3_config },
+        { .compatible = "atmel,sama5d3-macb", .data = &sama5d3macb_config },
         { .compatible = "atmel,sama5d4-gem", .data = &sama5d4_config },
         { .compatible = "cdns,at91rm9200-emac", .data = &emac_config },
         { .compatible = "cdns,emac", .data = &emac_config },
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_flower.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_flower.c
index 623f73dd7738..c116f96956fe 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_flower.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_flower.c
@@ -417,10 +417,9 @@ static void cxgb4_process_flow_actions(struct net_device *in,
                                        struct ch_filter_specification *fs)
 {
         const struct tc_action *a;
-        LIST_HEAD(actions);
+        int i;
 
-        tcf_exts_to_list(cls->exts, &actions);
-        list_for_each_entry(a, &actions, list) {
+        tcf_exts_for_each_action(i, a, cls->exts) {
                 if (is_tcf_gact_ok(a)) {
                         fs->action = FILTER_PASS;
                 } else if (is_tcf_gact_shot(a)) {
@@ -591,10 +590,9 @@ static int cxgb4_validate_flow_actions(struct net_device *dev,
         bool act_redir = false;
         bool act_pedit = false;
         bool act_vlan = false;
-        LIST_HEAD(actions);
+        int i;
 
-        tcf_exts_to_list(cls->exts, &actions);
-        list_for_each_entry(a, &actions, list) {
+        tcf_exts_for_each_action(i, a, cls->exts) {
                 if (is_tcf_gact_ok(a)) {
                         /* Do nothing */
                 } else if (is_tcf_gact_shot(a)) {
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_u32.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_u32.c
index 18eb2aedd4cb..c7d2b4dc7568 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_u32.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_u32.c
@@ -93,14 +93,13 @@ static int fill_action_fields(struct adapter *adap,
         unsigned int num_actions = 0;
         const struct tc_action *a;
         struct tcf_exts *exts;
-        LIST_HEAD(actions);
+        int i;
 
         exts = cls->knode.exts;
         if (!tcf_exts_has_actions(exts))
                 return -EINVAL;
 
-        tcf_exts_to_list(exts, &actions);
-        list_for_each_entry(a, &actions, list) {
+        tcf_exts_for_each_action(i, a, exts) {
                 /* Don't allow more than one action per rule. */
                 if (num_actions)
                         return -EINVAL;
diff --git a/drivers/net/ethernet/cirrus/ep93xx_eth.c b/drivers/net/ethernet/cirrus/ep93xx_eth.c
index e2a702996db4..13dfdfca49fc 100644
--- a/drivers/net/ethernet/cirrus/ep93xx_eth.c
+++ b/drivers/net/ethernet/cirrus/ep93xx_eth.c
@@ -332,7 +332,7 @@ static int ep93xx_poll(struct napi_struct *napi, int budget)
         return rx;
 }
 
-static int ep93xx_xmit(struct sk_buff *skb, struct net_device *dev)
+static netdev_tx_t ep93xx_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         struct ep93xx_priv *ep = netdev_priv(dev);
         struct ep93xx_tdesc *txd;
diff --git a/drivers/net/ethernet/cirrus/mac89x0.c b/drivers/net/ethernet/cirrus/mac89x0.c
index 3f8fe8fd79cc..6324e80960c3 100644
--- a/drivers/net/ethernet/cirrus/mac89x0.c
+++ b/drivers/net/ethernet/cirrus/mac89x0.c
@@ -113,7 +113,7 @@ struct net_local {
 
 /* Index to functions, as function prototypes. */
 static int net_open(struct net_device *dev);
-static int net_send_packet(struct sk_buff *skb, struct net_device *dev);
+static netdev_tx_t net_send_packet(struct sk_buff *skb, struct net_device *dev);
 static irqreturn_t net_interrupt(int irq, void *dev_id);
 static void set_multicast_list(struct net_device *dev);
 static void net_rx(struct net_device *dev);
@@ -324,7 +324,7 @@ net_open(struct net_device *dev)
         return 0;
 }
 
-static int
+static netdev_tx_t
 net_send_packet(struct sk_buff *skb, struct net_device *dev)
 {
         struct net_local *lp = netdev_priv(dev);
diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.c b/drivers/net/ethernet/emulex/benet/be_cmds.c
index ff92ab1daeb8..1e9d882c04ef 100644
--- a/drivers/net/ethernet/emulex/benet/be_cmds.c
+++ b/drivers/net/ethernet/emulex/benet/be_cmds.c
@@ -4500,7 +4500,7 @@ int be_cmd_get_profile_config(struct be_adapter *adapter,
                                 port_res->max_vfs += le16_to_cpu(pcie->num_vfs);
                         }
                 }
-                return status;
+                goto err;
         }
 
         pcie = be_get_pcie_desc(resp->func_param, desc_count,
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index 2708297e7795..bf9b9fd6d2a0 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -1158,7 +1158,7 @@ static void fec_enet_timeout_work(struct work_struct *work)
                 napi_disable(&fep->napi);
                 netif_tx_lock_bh(ndev);
                 fec_restart(ndev);
-                netif_wake_queue(ndev);
+                netif_tx_wake_all_queues(ndev);
                 netif_tx_unlock_bh(ndev);
                 napi_enable(&fep->napi);
         }
@@ -1273,7 +1273,7 @@ skb_done:
 
                 /* Since we have freed up a buffer, the ring is no longer full
                  */
-                if (netif_queue_stopped(ndev)) {
+                if (netif_tx_queue_stopped(nq)) {
                         entries_free = fec_enet_get_free_txdesc_num(txq);
                         if (entries_free >= txq->tx_wake_threshold)
                                 netif_tx_wake_queue(nq);
@@ -1746,7 +1746,7 @@ static void fec_enet_adjust_link(struct net_device *ndev)
                         napi_disable(&fep->napi);
                         netif_tx_lock_bh(ndev);
                         fec_restart(ndev);
-                        netif_wake_queue(ndev);
+                        netif_tx_wake_all_queues(ndev);
                         netif_tx_unlock_bh(ndev);
                         napi_enable(&fep->napi);
                 }
@@ -2247,7 +2247,7 @@ static int fec_enet_set_pauseparam(struct net_device *ndev,
                 napi_disable(&fep->napi);
                 netif_tx_lock_bh(ndev);
                 fec_restart(ndev);
-                netif_wake_queue(ndev);
+                netif_tx_wake_all_queues(ndev);
                 netif_tx_unlock_bh(ndev);
                 napi_enable(&fep->napi);
         }
diff --git a/drivers/net/ethernet/hisilicon/hns/hnae.c b/drivers/net/ethernet/hisilicon/hns/hnae.c
index a051e582d541..79d03f8ee7b1 100644
--- a/drivers/net/ethernet/hisilicon/hns/hnae.c
+++ b/drivers/net/ethernet/hisilicon/hns/hnae.c
@@ -84,7 +84,7 @@ static void hnae_unmap_buffer(struct hnae_ring *ring, struct hnae_desc_cb *cb)
         if (cb->type == DESC_TYPE_SKB)
                 dma_unmap_single(ring_to_dev(ring), cb->dma, cb->length,
                                  ring_to_dma_dir(ring));
-        else
+        else if (cb->length)
                 dma_unmap_page(ring_to_dev(ring), cb->dma, cb->length,
                                ring_to_dma_dir(ring));
 }
diff --git a/drivers/net/ethernet/hisilicon/hns/hnae.h b/drivers/net/ethernet/hisilicon/hns/hnae.h
index fa5b30f547f6..08a750fb60c4 100644
--- a/drivers/net/ethernet/hisilicon/hns/hnae.h
+++ b/drivers/net/ethernet/hisilicon/hns/hnae.h
@@ -220,10 +220,10 @@ struct hnae_desc_cb {
 
         /* priv data for the desc, e.g. skb when use with ip stack*/
         void *priv;
-        u16 page_offset;
-        u16 reuse_flag;
+        u32 page_offset;
+        u32 length;     /* length of the buffer */
 
-        u16 length;     /* length of the buffer */
+        u16 reuse_flag;
 
        /* desc type, used by the ring user to mark the type of the priv data */
         u16 type;
@@ -486,6 +486,8 @@ struct hnae_ae_ops {
                         u8 *auto_neg, u16 *speed, u8 *duplex);
         void (*toggle_ring_irq)(struct hnae_ring *ring, u32 val);
         void (*adjust_link)(struct hnae_handle *handle, int speed, int duplex);
+        bool (*need_adjust_link)(struct hnae_handle *handle,
+                                 int speed, int duplex);
         int (*set_loopback)(struct hnae_handle *handle,
                             enum hnae_loop loop_mode, int en);
         void (*get_ring_bdnum_limit)(struct hnae_queue *queue,
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c b/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c
index e6aad30e7e69..b52029e26d15 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c
@@ -155,6 +155,41 @@ static void hns_ae_put_handle(struct hnae_handle *handle)
                 hns_ae_get_ring_pair(handle->qs[i])->used_by_vf = 0;
 }
 
+static int hns_ae_wait_flow_down(struct hnae_handle *handle)
+{
+        struct dsaf_device *dsaf_dev;
+        struct hns_ppe_cb *ppe_cb;
+        struct hnae_vf_cb *vf_cb;
+        int ret;
+        int i;
+
+        for (i = 0; i < handle->q_num; i++) {
+                ret = hns_rcb_wait_tx_ring_clean(handle->qs[i]);
+                if (ret)
+                        return ret;
+        }
+
+        ppe_cb = hns_get_ppe_cb(handle);
+        ret = hns_ppe_wait_tx_fifo_clean(ppe_cb);
+        if (ret)
+                return ret;
+
+        dsaf_dev = hns_ae_get_dsaf_dev(handle->dev);
+        if (!dsaf_dev)
+                return -EINVAL;
+        ret = hns_dsaf_wait_pkt_clean(dsaf_dev, handle->dport_id);
+        if (ret)
+                return ret;
+
+        vf_cb = hns_ae_get_vf_cb(handle);
+        ret = hns_mac_wait_fifo_clean(vf_cb->mac_cb);
+        if (ret)
+                return ret;
+
+        mdelay(10);
+        return 0;
+}
+
 static void hns_ae_ring_enable_all(struct hnae_handle *handle, int val)
 {
         int q_num = handle->q_num;
@@ -399,12 +434,41 @@ static int hns_ae_get_mac_info(struct hnae_handle *handle,
         return hns_mac_get_port_info(mac_cb, auto_neg, speed, duplex);
 }
 
+static bool hns_ae_need_adjust_link(struct hnae_handle *handle, int speed,
+                                    int duplex)
+{
+        struct hns_mac_cb *mac_cb = hns_get_mac_cb(handle);
+
+        return hns_mac_need_adjust_link(mac_cb, speed, duplex);
+}
+
 static void hns_ae_adjust_link(struct hnae_handle *handle, int speed,
                                int duplex)
 {
         struct hns_mac_cb *mac_cb = hns_get_mac_cb(handle);
 
-        hns_mac_adjust_link(mac_cb, speed, duplex);
+        switch (mac_cb->dsaf_dev->dsaf_ver) {
+        case AE_VERSION_1:
+                hns_mac_adjust_link(mac_cb, speed, duplex);
+                break;
+
+        case AE_VERSION_2:
+                /* chip need to clear all pkt inside */
+                hns_mac_disable(mac_cb, MAC_COMM_MODE_RX);
+                if (hns_ae_wait_flow_down(handle)) {
+                        hns_mac_enable(mac_cb, MAC_COMM_MODE_RX);
+                        break;
+                }
+
+                hns_mac_adjust_link(mac_cb, speed, duplex);
+                hns_mac_enable(mac_cb, MAC_COMM_MODE_RX);
+                break;
+
+        default:
+                break;
+        }
+
+        return;
 }
 
 static void hns_ae_get_ring_bdnum_limit(struct hnae_queue *queue,
@@ -902,6 +966,7 @@ static struct hnae_ae_ops hns_dsaf_ops = {
         .get_status = hns_ae_get_link_status,
         .get_info = hns_ae_get_mac_info,
         .adjust_link = hns_ae_adjust_link,
+        .need_adjust_link = hns_ae_need_adjust_link,
         .set_loopback = hns_ae_config_loopback,
         .get_ring_bdnum_limit = hns_ae_get_ring_bdnum_limit,
         .get_pauseparam = hns_ae_get_pauseparam,
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c
index 5488c6e89f21..09e4061d1fa6 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c
@@ -257,6 +257,16 @@ static void hns_gmac_get_pausefrm_cfg(void *mac_drv, u32 *rx_pause_en,
         *tx_pause_en = dsaf_get_bit(pause_en, GMAC_PAUSE_EN_TX_FDFC_B);
 }
 
+static bool hns_gmac_need_adjust_link(void *mac_drv, enum mac_speed speed,
+                                      int duplex)
+{
+        struct mac_driver *drv = (struct mac_driver *)mac_drv;
+        struct hns_mac_cb *mac_cb = drv->mac_cb;
+
+        return (mac_cb->speed != speed) ||
+                (mac_cb->half_duplex == duplex);
+}
+
 static int hns_gmac_adjust_link(void *mac_drv, enum mac_speed speed,
                                 u32 full_duplex)
 {
@@ -309,6 +319,30 @@ static void hns_gmac_set_promisc(void *mac_drv, u8 en)
                 hns_gmac_set_uc_match(mac_drv, en);
 }
 
+int hns_gmac_wait_fifo_clean(void *mac_drv)
+{
+        struct mac_driver *drv = (struct mac_driver *)mac_drv;
+        int wait_cnt;
+        u32 val;
+
+        wait_cnt = 0;
+        while (wait_cnt++ < HNS_MAX_WAIT_CNT) {
+                val = dsaf_read_dev(drv, GMAC_FIFO_STATE_REG);
+                /* bit5~bit0 is not send complete pkts */
+                if ((val & 0x3f) == 0)
+                        break;
+                usleep_range(100, 200);
+        }
+
+        if (wait_cnt >= HNS_MAX_WAIT_CNT) {
+                dev_err(drv->dev,
+                        "hns ge %d fifo was not idle.\n", drv->mac_id);
+                return -EBUSY;
+        }
+
+        return 0;
+}
+
 static void hns_gmac_init(void *mac_drv)
 {
         u32 port;
@@ -690,6 +724,7 @@ void *hns_gmac_config(struct hns_mac_cb *mac_cb, struct mac_params *mac_param)
         mac_drv->mac_disable = hns_gmac_disable;
         mac_drv->mac_free = hns_gmac_free;
         mac_drv->adjust_link = hns_gmac_adjust_link;
+        mac_drv->need_adjust_link = hns_gmac_need_adjust_link;
         mac_drv->set_tx_auto_pause_frames = hns_gmac_set_tx_auto_pause_frames;
         mac_drv->config_max_frame_length = hns_gmac_config_max_frame_length;
         mac_drv->mac_pausefrm_cfg = hns_gmac_pause_frm_cfg;
@@ -717,6 +752,7 @@ void *hns_gmac_config(struct hns_mac_cb *mac_cb, struct mac_params *mac_param)
         mac_drv->get_strings = hns_gmac_get_strings;
         mac_drv->update_stats = hns_gmac_update_stats;
         mac_drv->set_promiscuous = hns_gmac_set_promisc;
+        mac_drv->wait_fifo_clean = hns_gmac_wait_fifo_clean;
 
         return (void *)mac_drv;
 }
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c
index 1c2326bd76e2..6ed6f142427e 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c
@@ -114,6 +114,26 @@ int hns_mac_get_port_info(struct hns_mac_cb *mac_cb,
         return 0;
 }
 
+/**
+ *hns_mac_is_adjust_link - check is need change mac speed and duplex register
+ *@mac_cb: mac device
+ *@speed: phy device speed
+ *@duplex:phy device duplex
+ *
+ */
+bool hns_mac_need_adjust_link(struct hns_mac_cb *mac_cb, int speed, int duplex)
+{
+        struct mac_driver *mac_ctrl_drv;
+
+        mac_ctrl_drv = (struct mac_driver *)(mac_cb->priv.mac);
+
+        if (mac_ctrl_drv->need_adjust_link)
+                return mac_ctrl_drv->need_adjust_link(mac_ctrl_drv,
+                        (enum mac_speed)speed, duplex);
+        else
+                return true;
+}
+
 void hns_mac_adjust_link(struct hns_mac_cb *mac_cb, int speed, int duplex)
 {
         int ret;
@@ -430,6 +450,16 @@ int hns_mac_vm_config_bc_en(struct hns_mac_cb *mac_cb, u32 vmid, bool enable)
         return 0;
 }
 
+int hns_mac_wait_fifo_clean(struct hns_mac_cb *mac_cb)
+{
+        struct mac_driver *drv = hns_mac_get_drv(mac_cb);
+
+        if (drv->wait_fifo_clean)
+                return drv->wait_fifo_clean(drv);
+
+        return 0;
+}
+
 void hns_mac_reset(struct hns_mac_cb *mac_cb)
 {
         struct mac_driver *drv = hns_mac_get_drv(mac_cb);
@@ -998,6 +1028,20 @@ static int hns_mac_get_max_port_num(struct dsaf_device *dsaf_dev)
                 return  DSAF_MAX_PORT_NUM;
 }
 
+void hns_mac_enable(struct hns_mac_cb *mac_cb, enum mac_commom_mode mode)
+{
+        struct mac_driver *mac_ctrl_drv = hns_mac_get_drv(mac_cb);
+
+        mac_ctrl_drv->mac_enable(mac_cb->priv.mac, mode);
+}
+
+void hns_mac_disable(struct hns_mac_cb *mac_cb, enum mac_commom_mode mode)
+{
+        struct mac_driver *mac_ctrl_drv = hns_mac_get_drv(mac_cb);
+
+        mac_ctrl_drv->mac_disable(mac_cb->priv.mac, mode);
+}
+
 /**
  * hns_mac_init - init mac
  * @dsaf_dev: dsa fabric device struct pointer
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.h b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.h
index bbc0a98e7ca3..fbc75341bef7 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.h
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.h
@@ -356,6 +356,9 @@ struct mac_driver {
         /*adjust mac mode of port,include speed and duplex*/
         int (*adjust_link)(void *mac_drv, enum mac_speed speed,
                            u32 full_duplex);
+        /* need adjust link */
+        bool (*need_adjust_link)(void *mac_drv, enum mac_speed speed,
+                                 int duplex);
         /* config autoegotaite mode of port*/
         void (*set_an_mode)(void *mac_drv, u8 enable);
         /* config loopbank mode */
@@ -394,6 +397,7 @@ struct mac_driver {
         void (*get_info)(void *mac_drv, struct mac_info *mac_info);
 
         void (*update_stats)(void *mac_drv);
+        int (*wait_fifo_clean)(void *mac_drv);
 
         enum mac_mode mac_mode;
         u8 mac_id;
@@ -427,6 +431,7 @@ void *hns_xgmac_config(struct hns_mac_cb *mac_cb,
 
 int hns_mac_init(struct dsaf_device *dsaf_dev);
 void mac_adjust_link(struct net_device *net_dev);
+bool hns_mac_need_adjust_link(struct hns_mac_cb *mac_cb, int speed, int duplex);
 void hns_mac_get_link_status(struct hns_mac_cb *mac_cb, u32 *link_status);
 int hns_mac_change_vf_addr(struct hns_mac_cb *mac_cb, u32 vmid, char *addr);
 int hns_mac_set_multi(struct hns_mac_cb *mac_cb,
@@ -463,5 +468,8 @@ int hns_mac_add_uc_addr(struct hns_mac_cb *mac_cb, u8 vf_id,
 int hns_mac_rm_uc_addr(struct hns_mac_cb *mac_cb, u8 vf_id,
                        const unsigned char *addr);
 int hns_mac_clr_multicast(struct hns_mac_cb *mac_cb, int vfn);
+void hns_mac_enable(struct hns_mac_cb *mac_cb, enum mac_commom_mode mode);
+void hns_mac_disable(struct hns_mac_cb *mac_cb, enum mac_commom_mode mode);
+int hns_mac_wait_fifo_clean(struct hns_mac_cb *mac_cb);
 
 #endif /* _HNS_DSAF_MAC_H */
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
index ca50c2553a9c..e557a4ef5996 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
@@ -2727,6 +2727,35 @@ void hns_dsaf_set_promisc_tcam(struct dsaf_device *dsaf_dev,
         soft_mac_entry->index = enable ? entry_index : DSAF_INVALID_ENTRY_IDX;
 }
 
+int hns_dsaf_wait_pkt_clean(struct dsaf_device *dsaf_dev, int port)
+{
+        u32 val, val_tmp;
+        int wait_cnt;
+
+        if (port >= DSAF_SERVICE_NW_NUM)
+                return 0;
+
+        wait_cnt = 0;
+        while (wait_cnt++ < HNS_MAX_WAIT_CNT) {
+                val = dsaf_read_dev(dsaf_dev, DSAF_VOQ_IN_PKT_NUM_0_REG +
+                        (port + DSAF_XGE_NUM) * 0x40);
+                val_tmp = dsaf_read_dev(dsaf_dev, DSAF_VOQ_OUT_PKT_NUM_0_REG +
+                        (port + DSAF_XGE_NUM) * 0x40);
+                if (val == val_tmp)
+                        break;
+
+                usleep_range(100, 200);
+        }
+
+        if (wait_cnt >= HNS_MAX_WAIT_CNT) {
+                dev_err(dsaf_dev->dev, "hns dsaf clean wait timeout(%u - %u).\n",
+                        val, val_tmp);
+                return -EBUSY;
+        }
+
+        return 0;
+}
+
 /**
  * dsaf_probe - probo dsaf dev
  * @pdev: dasf platform device
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.h b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.h
index 4507e8222683..0e1cd99831a6 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.h
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.h
@@ -44,6 +44,8 @@ struct hns_mac_cb;
 #define DSAF_ROCE_CREDIT_CHN    8
 #define DSAF_ROCE_CHAN_MODE     3
 
+#define HNS_MAX_WAIT_CNT 10000
+
 enum dsaf_roce_port_mode {
         DSAF_ROCE_6PORT_MODE,
         DSAF_ROCE_4PORT_MODE,
@@ -463,5 +465,6 @@ int hns_dsaf_rm_mac_addr(
 
 int hns_dsaf_clr_mac_mc_port(struct dsaf_device *dsaf_dev,
                              u8 mac_id, u8 port_num);
+int hns_dsaf_wait_pkt_clean(struct dsaf_device *dsaf_dev, int port);
 
 #endif /* __HNS_DSAF_MAIN_H__ */
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c
index d160d8c9e45b..0942e4916d9d 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c
@@ -275,6 +275,29 @@ static void hns_ppe_exc_irq_en(struct hns_ppe_cb *ppe_cb, int en)
         dsaf_write_dev(ppe_cb, PPE_INTEN_REG, msk_vlue & vld_msk);
 }
 
+int hns_ppe_wait_tx_fifo_clean(struct hns_ppe_cb *ppe_cb)
+{
+        int wait_cnt;
+        u32 val;
+
+        wait_cnt = 0;
+        while (wait_cnt++ < HNS_MAX_WAIT_CNT) {
+                val = dsaf_read_dev(ppe_cb, PPE_CURR_TX_FIFO0_REG) & 0x3ffU;
+                if (!val)
+                        break;
+
+                usleep_range(100, 200);
+        }
+
+        if (wait_cnt >= HNS_MAX_WAIT_CNT) {
+                dev_err(ppe_cb->dev, "hns ppe tx fifo clean wait timeout, still has %u pkt.\n",
+                        val);
+                return -EBUSY;
+        }
+
+        return 0;
+}
+
 /**
  * ppe_init_hw - init ppe
  * @ppe_cb: ppe device
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.h b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.h
index 9d8e643e8aa6..f670e63a5a01 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.h
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.h
@@ -100,6 +100,7 @@ struct ppe_common_cb {
 
 };
 
+int hns_ppe_wait_tx_fifo_clean(struct hns_ppe_cb *ppe_cb);
 int hns_ppe_init(struct dsaf_device *dsaf_dev);
 
 void hns_ppe_uninit(struct dsaf_device *dsaf_dev);
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.c
index 9d76e2e54f9d..5d64519b9b1d 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.c
@@ -66,6 +66,29 @@ void hns_rcb_wait_fbd_clean(struct hnae_queue **qs, int q_num, u32 flag)
                         "queue(%d) wait fbd(%d) clean fail!!\n", i, fbd_num);
 }
 
+int hns_rcb_wait_tx_ring_clean(struct hnae_queue *qs)
+{
+        u32 head, tail;
+        int wait_cnt;
+
+        tail = dsaf_read_dev(&qs->tx_ring, RCB_REG_TAIL);
+        wait_cnt = 0;
+        while (wait_cnt++ < HNS_MAX_WAIT_CNT) {
+                head = dsaf_read_dev(&qs->tx_ring, RCB_REG_HEAD);
+                if (tail == head)
+                        break;
+
+                usleep_range(100, 200);
+        }
+
+        if (wait_cnt >= HNS_MAX_WAIT_CNT) {
+                dev_err(qs->dev->dev, "rcb wait timeout, head not equal to tail.\n");
+                return -EBUSY;
+        }
+
+        return 0;
+}
+
 /**
  *hns_rcb_reset_ring_hw - ring reset
  *@q: ring struct pointer
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.h b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.h
index 602816498c8d..2319b772a271 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.h
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.h
@@ -136,6 +136,7 @@ void hns_rcbv2_int_clr_hw(struct hnae_queue *q, u32 flag);
 void hns_rcb_init_hw(struct ring_pair_cb *ring);
 void hns_rcb_reset_ring_hw(struct hnae_queue *q);
 void hns_rcb_wait_fbd_clean(struct hnae_queue **qs, int q_num, u32 flag);
+int hns_rcb_wait_tx_ring_clean(struct hnae_queue *qs);
 u32 hns_rcb_get_rx_coalesced_frames(
         struct rcb_common_cb *rcb_common, u32 port_idx);
 u32 hns_rcb_get_tx_coalesced_frames(
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h
index 886cbbf25761..74d935d82cbc 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h
@@ -464,6 +464,7 @@
 #define RCB_RING_INTMSK_TX_OVERTIME_REG         0x000C4
 #define RCB_RING_INTSTS_TX_OVERTIME_REG         0x000C8
 
+#define GMAC_FIFO_STATE_REG                     0x0000UL
 #define GMAC_DUPLEX_TYPE_REG                    0x0008UL
 #define GMAC_FD_FC_TYPE_REG                     0x000CUL
 #define GMAC_TX_WATER_LINE_REG                  0x0010UL
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_enet.c b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
index 9f2b552aee33..28e907831b0e 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_enet.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
@@ -40,9 +40,9 @@
 #define SKB_TMP_LEN(SKB) \
         (((SKB)->transport_header - (SKB)->mac_header) + tcp_hdrlen(SKB))
 
-static void fill_v2_desc(struct hnae_ring *ring, void *priv,
-                         int size, dma_addr_t dma, int frag_end,
-                         int buf_num, enum hns_desc_type type, int mtu)
+static void fill_v2_desc_hw(struct hnae_ring *ring, void *priv, int size,
+                            int send_sz, dma_addr_t dma, int frag_end,
+                            int buf_num, enum hns_desc_type type, int mtu)
 {
         struct hnae_desc *desc = &ring->desc[ring->next_to_use];
         struct hnae_desc_cb *desc_cb = &ring->desc_cb[ring->next_to_use];
@@ -64,7 +64,7 @@ static void fill_v2_desc(struct hnae_ring *ring, void *priv,
         desc_cb->type = type;
 
         desc->addr = cpu_to_le64(dma);
-        desc->tx.send_size = cpu_to_le16((u16)size);
+        desc->tx.send_size = cpu_to_le16((u16)send_sz);
 
         /* config bd buffer end */
         hnae_set_bit(rrcfv, HNSV2_TXD_VLD_B, 1);
@@ -133,6 +133,14 @@ static void fill_v2_desc(struct hnae_ring *ring, void *priv,
         ring_ptr_move_fw(ring, next_to_use);
 }
 
+static void fill_v2_desc(struct hnae_ring *ring, void *priv,
+                         int size, dma_addr_t dma, int frag_end,
+                         int buf_num, enum hns_desc_type type, int mtu)
+{
+        fill_v2_desc_hw(ring, priv, size, size, dma, frag_end,
+                        buf_num, type, mtu);
+}
+
 static const struct acpi_device_id hns_enet_acpi_match[] = {
         { "HISI00C1", 0 },
         { "HISI00C2", 0 },
@@ -289,15 +297,15 @@ static void fill_tso_desc(struct hnae_ring *ring, void *priv,
 
         /* when the frag size is bigger than hardware, split this frag */
         for (k = 0; k < frag_buf_num; k++)
-                fill_v2_desc(ring, priv,
-                             (k == frag_buf_num - 1) ?
+                fill_v2_desc_hw(ring, priv, k == 0 ? size : 0,
+                                (k == frag_buf_num - 1) ?
                                         sizeoflast : BD_MAX_SEND_SIZE,
-                             dma + BD_MAX_SEND_SIZE * k,
-                             frag_end && (k == frag_buf_num - 1) ? 1 : 0,
-                             buf_num,
-                             (type == DESC_TYPE_SKB && !k) ?
+                                dma + BD_MAX_SEND_SIZE * k,
+                                frag_end && (k == frag_buf_num - 1) ? 1 : 0,
+                                buf_num,
+                                (type == DESC_TYPE_SKB && !k) ?
                                         DESC_TYPE_SKB : DESC_TYPE_PAGE,
-                             mtu);
+                                mtu);
 }
 
 netdev_tx_t hns_nic_net_xmit_hw(struct net_device *ndev,
@@ -406,113 +414,13 @@ out_net_tx_busy:
         return NETDEV_TX_BUSY;
 }
 
-/**
- * hns_nic_get_headlen - determine size of header for RSC/LRO/GRO/FCOE
- * @data: pointer to the start of the headers
- * @max: total length of section to find headers in
- *
- * This function is meant to determine the length of headers that will
- * be recognized by hardware for LRO, GRO, and RSC offloads.  The main
- * motivation of doing this is to only perform one pull for IPv4 TCP
- * packets so that we can do basic things like calculating the gso_size
- * based on the average data per packet.
- **/
-static unsigned int hns_nic_get_headlen(unsigned char *data, u32 flag,
-                                        unsigned int max_size)
-{
-        unsigned char *network;
-        u8 hlen;
-
-        /* this should never happen, but better safe than sorry */
-        if (max_size < ETH_HLEN)
-                return max_size;
-
-        /* initialize network frame pointer */
-        network = data;
-
-        /* set first protocol and move network header forward */
-        network += ETH_HLEN;
-
-        /* handle any vlan tag if present */
-        if (hnae_get_field(flag, HNS_RXD_VLAN_M, HNS_RXD_VLAN_S)
-                == HNS_RX_FLAG_VLAN_PRESENT) {
-                if ((typeof(max_size))(network - data) > (max_size - VLAN_HLEN))
-                        return max_size;
-
-                network += VLAN_HLEN;
-        }
-
-        /* handle L3 protocols */
-        if (hnae_get_field(flag, HNS_RXD_L3ID_M, HNS_RXD_L3ID_S)
-                == HNS_RX_FLAG_L3ID_IPV4) {
-                if ((typeof(max_size))(network - data) >
-                    (max_size - sizeof(struct iphdr)))
-                        return max_size;
-
-                /* access ihl as a u8 to avoid unaligned access on ia64 */
-                hlen = (network[0] & 0x0F) << 2;
-
-                /* verify hlen meets minimum size requirements */
-                if (hlen < sizeof(struct iphdr))
-                        return network - data;
-
-                /* record next protocol if header is present */
-        } else if (hnae_get_field(flag, HNS_RXD_L3ID_M, HNS_RXD_L3ID_S)
-                == HNS_RX_FLAG_L3ID_IPV6) {
-                if ((typeof(max_size))(network - data) >
-                    (max_size - sizeof(struct ipv6hdr)))
-                        return max_size;
-
-                /* record next protocol */
-                hlen = sizeof(struct ipv6hdr);
-        } else {
-                return network - data;
-        }
-
-        /* relocate pointer to start of L4 header */
-        network += hlen;
-
-        /* finally sort out TCP/UDP */
-        if (hnae_get_field(flag, HNS_RXD_L4ID_M, HNS_RXD_L4ID_S)
-                == HNS_RX_FLAG_L4ID_TCP) {
-                if ((typeof(max_size))(network - data) >
-                    (max_size - sizeof(struct tcphdr)))
-                        return max_size;
-
-                /* access doff as a u8 to avoid unaligned access on ia64 */
-                hlen = (network[12] & 0xF0) >> 2;
-
-                /* verify hlen meets minimum size requirements */
-                if (hlen < sizeof(struct tcphdr))
-                        return network - data;
-
-                network += hlen;
-        } else if (hnae_get_field(flag, HNS_RXD_L4ID_M, HNS_RXD_L4ID_S)
-                == HNS_RX_FLAG_L4ID_UDP) {
-                if ((typeof(max_size))(network - data) >
-                    (max_size - sizeof(struct udphdr)))
-                        return max_size;
-
-                network += sizeof(struct udphdr);
-        }
-
-        /* If everything has gone correctly network should be the
-         * data section of the packet and will be the end of the header.
-         * If not then it probably represents the end of the last recognized
-         * header.
-         */
-        if ((typeof(max_size))(network - data) < max_size)
-                return network - data;
-        else
-                return max_size;
-}
-
 static void hns_nic_reuse_page(struct sk_buff *skb, int i,
                                struct hnae_ring *ring, int pull_len,
                                struct hnae_desc_cb *desc_cb)
 {
         struct hnae_desc *desc;
-        int truesize, size;
+        u32 truesize;
+        int size;
         int last_offset;
         bool twobufs;
 
@@ -530,7 +438,7 @@ static void hns_nic_reuse_page(struct sk_buff *skb, int i,
         }
 
         skb_add_rx_frag(skb, i, desc_cb->priv, desc_cb->page_offset + pull_len,
-                        size - pull_len, truesize - pull_len);
+                        size - pull_len, truesize);
 
          /* avoid re-using remote pages,flag default unreuse */
         if (unlikely(page_to_nid(desc_cb->priv) != numa_node_id()))
@@ -695,7 +603,7 @@ static int hns_nic_poll_rx_skb(struct hns_nic_ring_data *ring_data,
         } else {
                 ring->stats.seg_pkt_cnt++;
 
-                pull_len = hns_nic_get_headlen(va, bnum_flag, HNS_RX_HEAD_SIZE);
+                pull_len = eth_get_headlen(va, HNS_RX_HEAD_SIZE);
                 memcpy(__skb_put(skb, pull_len), va,
                        ALIGN(pull_len, sizeof(long)));
 
@@ -1212,11 +1120,26 @@ static void hns_nic_adjust_link(struct net_device *ndev)
         struct hnae_handle *h = priv->ae_handle;
         int state = 1;
 
+        /* If there is no phy, do not need adjust link */
         if (ndev->phydev) {
-                h->dev->ops->adjust_link(h, ndev->phydev->speed,
-                                         ndev->phydev->duplex);
-                state = ndev->phydev->link;
+                /* When phy link down, do nothing */
+                if (ndev->phydev->link == 0)
+                        return;
+
+                if (h->dev->ops->need_adjust_link(h, ndev->phydev->speed,
+                                                  ndev->phydev->duplex)) {
+                        /* because Hi161X chip don't support to change gmac
+                         * speed and duplex with traffic. Delay 200ms to
+                         * make sure there is no more data in chip FIFO.
+                         */
+                        netif_carrier_off(ndev);
+                        msleep(200);
+                        h->dev->ops->adjust_link(h, ndev->phydev->speed,
+                                                 ndev->phydev->duplex);
+                        netif_carrier_on(ndev);
+                }
         }
+
         state = state && h->dev->ops->get_status(h);
 
         if (state != priv->link) {
@@ -1580,21 +1503,6 @@ static int hns_nic_do_ioctl(struct net_device *netdev, struct ifreq *ifr,
         return phy_mii_ioctl(phy_dev, ifr, cmd);
 }
 
-/* use only for netconsole to poll with the device without interrupt */
-#ifdef CONFIG_NET_POLL_CONTROLLER
-static void hns_nic_poll_controller(struct net_device *ndev)
-{
-        struct hns_nic_priv *priv = netdev_priv(ndev);
-        unsigned long flags;
-        int i;
-
-        local_irq_save(flags);
-        for (i = 0; i < priv->ae_handle->q_num * 2; i++)
-                napi_schedule(&priv->ring_data[i].napi);
-        local_irq_restore(flags);
-}
-#endif
-
 static netdev_tx_t hns_nic_net_xmit(struct sk_buff *skb,
                                     struct net_device *ndev)
 {
@@ -2047,9 +1955,6 @@ static const struct net_device_ops hns_nic_netdev_ops = {
         .ndo_set_features = hns_nic_set_features,
         .ndo_fix_features = hns_nic_fix_features,
         .ndo_get_stats64 = hns_nic_get_stats64,
-#ifdef CONFIG_NET_POLL_CONTROLLER
-        .ndo_poll_controller = hns_nic_poll_controller,
-#endif
         .ndo_set_rx_mode = hns_nic_set_rx_mode,
         .ndo_select_queue = hns_nic_select_queue,
 };
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c b/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c
index 08f3c4743f74..774beda040a1 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c
@@ -243,7 +243,9 @@ static int hns_nic_set_link_ksettings(struct net_device *net_dev,
         }
 
         if (h->dev->ops->adjust_link) {
+                netif_carrier_off(net_dev);
                 h->dev->ops->adjust_link(h, (int)speed, cmd->base.duplex);
+                netif_carrier_on(net_dev);
                 return 0;
         }
 
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
index 3554dca7a680..955c4ab18b03 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
@@ -2019,7 +2019,8 @@ static void hns3_nic_reuse_page(struct sk_buff *skb, int i,
                                 struct hns3_desc_cb *desc_cb)
 {
         struct hns3_desc *desc;
-        int truesize, size;
+        u32 truesize;
+        int size;
         int last_offset;
         bool twobufs;
 
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h
index a02a96aee2a2..cb450d7ec8c1 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h
@@ -284,11 +284,11 @@ struct hns3_desc_cb {
 
         /* priv data for the desc, e.g. skb when use with ip stack*/
         void *priv;
-        u16 page_offset;
-        u16 reuse_flag;
-
+        u32 page_offset;
         u32 length;     /* length of the buffer */
 
+        u16 reuse_flag;
+
        /* desc type, used by the ring user to mark the type of the priv data */
         u16 type;
 };
diff --git a/drivers/net/ethernet/hp/hp100.c b/drivers/net/ethernet/hp/hp100.c
index c8c7ad2eff77..9b5a68b65432 100644
--- a/drivers/net/ethernet/hp/hp100.c
+++ b/drivers/net/ethernet/hp/hp100.c
@@ -2634,7 +2634,7 @@ static int hp100_login_to_vg_hub(struct net_device *dev, u_short force_relogin)
                 /* Wait for link to drop */
                 time = jiffies + (HZ / 10);
                 do {
-                        if (~(hp100_inb(VG_LAN_CFG_1) & HP100_LINK_UP_ST))
+                        if (!(hp100_inb(VG_LAN_CFG_1) & HP100_LINK_UP_ST))
                                 break;
                         if (!in_interrupt())
                                 schedule_timeout_interruptible(1);
diff --git a/drivers/net/ethernet/huawei/hinic/hinic_main.c b/drivers/net/ethernet/huawei/hinic/hinic_main.c
index 09e9da10b786..4a8f82938ed5 100644
--- a/drivers/net/ethernet/huawei/hinic/hinic_main.c
+++ b/drivers/net/ethernet/huawei/hinic/hinic_main.c
@@ -789,23 +789,6 @@ static void hinic_get_stats64(struct net_device *netdev,
         stats->tx_errors  = nic_tx_stats->tx_dropped;
 }
 
-#ifdef CONFIG_NET_POLL_CONTROLLER
-static void hinic_netpoll(struct net_device *netdev)
-{
-        struct hinic_dev *nic_dev = netdev_priv(netdev);
-        int i, num_qps;
-
-        num_qps = hinic_hwdev_num_qps(nic_dev->hwdev);
-        for (i = 0; i < num_qps; i++) {
-                struct hinic_txq *txq = &nic_dev->txqs[i];
-                struct hinic_rxq *rxq = &nic_dev->rxqs[i];
-
-                napi_schedule(&txq->napi);
-                napi_schedule(&rxq->napi);
-        }
-}
-#endif
-
 static const struct net_device_ops hinic_netdev_ops = {
         .ndo_open = hinic_open,
         .ndo_stop = hinic_close,
@@ -818,9 +801,6 @@ static const struct net_device_ops hinic_netdev_ops = {
         .ndo_start_xmit = hinic_xmit_frame,
         .ndo_tx_timeout = hinic_tx_timeout,
         .ndo_get_stats64 = hinic_get_stats64,
-#ifdef CONFIG_NET_POLL_CONTROLLER
-        .ndo_poll_controller = hinic_netpoll,
-#endif
 };
 
 static void netdev_features_init(struct net_device *netdev)
diff --git a/drivers/net/ethernet/i825xx/ether1.c b/drivers/net/ethernet/i825xx/ether1.c
index dc983450354b..35f6291a3672 100644
--- a/drivers/net/ethernet/i825xx/ether1.c
+++ b/drivers/net/ethernet/i825xx/ether1.c
@@ -64,7 +64,8 @@ static unsigned int net_debug = NET_DEBUG;
 #define RX_AREA_END     0x0fc00
 
 static int ether1_open(struct net_device *dev);
-static int ether1_sendpacket(struct sk_buff *skb, struct net_device *dev);
+static netdev_tx_t ether1_sendpacket(struct sk_buff *skb,
+                                     struct net_device *dev);
 static irqreturn_t ether1_interrupt(int irq, void *dev_id);
 static int ether1_close(struct net_device *dev);
 static void ether1_setmulticastlist(struct net_device *dev);
@@ -667,7 +668,7 @@ ether1_timeout(struct net_device *dev)
         netif_wake_queue(dev);
 }
 
-static int
+static netdev_tx_t
 ether1_sendpacket (struct sk_buff *skb, struct net_device *dev)
 {
         int tmp, tst, nopaddr, txaddr, tbdaddr, dataddr;
diff --git a/drivers/net/ethernet/i825xx/lib82596.c b/drivers/net/ethernet/i825xx/lib82596.c
index f00a1dc2128c..2f7ae118217f 100644
--- a/drivers/net/ethernet/i825xx/lib82596.c
+++ b/drivers/net/ethernet/i825xx/lib82596.c
@@ -347,7 +347,7 @@ static const char init_setup[] =
         0x7f /*  *multi IA */ };
 
 static int i596_open(struct net_device *dev);
-static int i596_start_xmit(struct sk_buff *skb, struct net_device *dev);
+static netdev_tx_t i596_start_xmit(struct sk_buff *skb, struct net_device *dev);
 static irqreturn_t i596_interrupt(int irq, void *dev_id);
 static int i596_close(struct net_device *dev);
 static void i596_add_cmd(struct net_device *dev, struct i596_cmd *cmd);
@@ -966,7 +966,7 @@ static void i596_tx_timeout (struct net_device *dev)
 }
 
 
-static int i596_start_xmit(struct sk_buff *skb, struct net_device *dev)
+static netdev_tx_t i596_start_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         struct i596_private *lp = netdev_priv(dev);
         struct tx_cmd *tx_cmd;
diff --git a/drivers/net/ethernet/i825xx/sun3_82586.c b/drivers/net/ethernet/i825xx/sun3_82586.c
index 8bb15a8c2a40..1a86184d44c0 100644
--- a/drivers/net/ethernet/i825xx/sun3_82586.c
+++ b/drivers/net/ethernet/i825xx/sun3_82586.c
@@ -121,7 +121,8 @@ static int     sun3_82586_probe1(struct net_device *dev,int ioaddr);
 static irqreturn_t sun3_82586_interrupt(int irq,void *dev_id);
 static int     sun3_82586_open(struct net_device *dev);
 static int     sun3_82586_close(struct net_device *dev);
-static int     sun3_82586_send_packet(struct sk_buff *,struct net_device *);
+static netdev_tx_t     sun3_82586_send_packet(struct sk_buff *,
+                                              struct net_device *);
 static struct  net_device_stats *sun3_82586_get_stats(struct net_device *dev);
 static void    set_multicast_list(struct net_device *dev);
 static void    sun3_82586_timeout(struct net_device *dev);
@@ -1002,7 +1003,8 @@ static void sun3_82586_timeout(struct net_device *dev)
  * send frame
  */
 
-static int sun3_82586_send_packet(struct sk_buff *skb, struct net_device *dev)
+static netdev_tx_t
+sun3_82586_send_packet(struct sk_buff *skb, struct net_device *dev)
 {
         int len,i;
 #ifndef NO_NOPCOMMANDS
diff --git a/drivers/net/ethernet/ibm/ehea/ehea_main.c b/drivers/net/ethernet/ibm/ehea/ehea_main.c
index ba580bfae512..03f64f40b2a3 100644
--- a/drivers/net/ethernet/ibm/ehea/ehea_main.c
+++ b/drivers/net/ethernet/ibm/ehea/ehea_main.c
@@ -921,17 +921,6 @@ static int ehea_poll(struct napi_struct *napi, int budget)
         return rx;
 }
 
-#ifdef CONFIG_NET_POLL_CONTROLLER
-static void ehea_netpoll(struct net_device *dev)
-{
-        struct ehea_port *port = netdev_priv(dev);
-        int i;
-
-        for (i = 0; i < port->num_def_qps; i++)
-                napi_schedule(&port->port_res[i].napi);
-}
-#endif
-
 static irqreturn_t ehea_recv_irq_handler(int irq, void *param)
 {
         struct ehea_port_res *pr = param;
@@ -2953,9 +2942,6 @@ static const struct net_device_ops ehea_netdev_ops = {
         .ndo_open               = ehea_open,
         .ndo_stop               = ehea_stop,
         .ndo_start_xmit         = ehea_start_xmit,
-#ifdef CONFIG_NET_POLL_CONTROLLER
-        .ndo_poll_controller    = ehea_netpoll,
-#endif
         .ndo_get_stats64        = ehea_get_stats64,
         .ndo_set_mac_address    = ehea_set_mac_addr,
         .ndo_validate_addr      = eth_validate_addr,
diff --git a/drivers/net/ethernet/ibm/emac/core.c b/drivers/net/ethernet/ibm/emac/core.c
index 354c0982847b..129f4e9f38da 100644
--- a/drivers/net/ethernet/ibm/emac/core.c
+++ b/drivers/net/ethernet/ibm/emac/core.c
@@ -494,9 +494,6 @@ static u32 __emac_calc_base_mr1(struct emac_instance *dev, int tx_size, int rx_s
         case 16384:
                 ret |= EMAC_MR1_RFS_16K;
                 break;
-        case 8192:
-                ret |= EMAC4_MR1_RFS_8K;
-                break;
         case 4096:
                 ret |= EMAC_MR1_RFS_4K;
                 break;
@@ -537,6 +534,9 @@ static u32 __emac4_calc_base_mr1(struct emac_instance *dev, int tx_size, int rx_
         case 16384:
                 ret |= EMAC4_MR1_RFS_16K;
                 break;
+        case 8192:
+                ret |= EMAC4_MR1_RFS_8K;
+                break;
         case 4096:
                 ret |= EMAC4_MR1_RFS_4K;
                 break;
@@ -2677,12 +2677,17 @@ static int emac_init_phy(struct emac_instance *dev)
                 if (of_phy_is_fixed_link(np)) {
                         int res = emac_dt_mdio_probe(dev);
 
-                        if (!res) {
-                                res = of_phy_register_fixed_link(np);
-                                if (res)
-                                        mdiobus_unregister(dev->mii_bus);
+                        if (res)
+                                return res;
+
+                        res = of_phy_register_fixed_link(np);
+                        dev->phy_dev = of_phy_find_device(np);
+                        if (res || !dev->phy_dev) {
+                                mdiobus_unregister(dev->mii_bus);
+                                return res ? res : -EINVAL;
                         }
-                        return res;
+                        emac_adjust_link(dev->ndev);
+                        put_device(&dev->phy_dev->mdio.dev);
                 }
                 return 0;
         }
diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
index dafdd4ade705..699ef942b615 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.c
+++ b/drivers/net/ethernet/ibm/ibmvnic.c
@@ -1823,11 +1823,17 @@ static int do_reset(struct ibmvnic_adapter *adapter,
                         adapter->map_id = 1;
                         release_rx_pools(adapter);
                         release_tx_pools(adapter);
-                        init_rx_pools(netdev);
-                        init_tx_pools(netdev);
+                        rc = init_rx_pools(netdev);
+                        if (rc)
+                                return rc;
+                        rc = init_tx_pools(netdev);
+                        if (rc)
+                                return rc;
 
                         release_napi(adapter);
-                        init_napi(adapter);
+                        rc = init_napi(adapter);
+                        if (rc)
+                                return rc;
                 } else {
                         rc = reset_tx_pools(adapter);
                         if (rc)
@@ -2201,19 +2207,6 @@ restart_poll:
         return frames_processed;
 }
 
-#ifdef CONFIG_NET_POLL_CONTROLLER
-static void ibmvnic_netpoll_controller(struct net_device *dev)
-{
-        struct ibmvnic_adapter *adapter = netdev_priv(dev);
-        int i;
-
-        replenish_pools(netdev_priv(dev));
-        for (i = 0; i < adapter->req_rx_queues; i++)
-                ibmvnic_interrupt_rx(adapter->rx_scrq[i]->irq,
-                                     adapter->rx_scrq[i]);
-}
-#endif
-
 static int wait_for_reset(struct ibmvnic_adapter *adapter)
 {
         int rc, ret;
@@ -2286,9 +2279,6 @@ static const struct net_device_ops ibmvnic_netdev_ops = {
         .ndo_set_mac_address    = ibmvnic_set_mac,
         .ndo_validate_addr      = eth_validate_addr,
         .ndo_tx_timeout         = ibmvnic_tx_timeout,
-#ifdef CONFIG_NET_POLL_CONTROLLER
-        .ndo_poll_controller    = ibmvnic_netpoll_controller,
-#endif
         .ndo_change_mtu         = ibmvnic_change_mtu,
         .ndo_features_check     = ibmvnic_features_check,
 };
diff --git a/drivers/net/ethernet/intel/e1000/e1000_ethtool.c b/drivers/net/ethernet/intel/e1000/e1000_ethtool.c
index bdb3f8e65ed4..2569a168334c 100644
--- a/drivers/net/ethernet/intel/e1000/e1000_ethtool.c
+++ b/drivers/net/ethernet/intel/e1000/e1000_ethtool.c
@@ -624,14 +624,14 @@ static int e1000_set_ringparam(struct net_device *netdev,
                 adapter->tx_ring = tx_old;
                 e1000_free_all_rx_resources(adapter);
                 e1000_free_all_tx_resources(adapter);
-                kfree(tx_old);
-                kfree(rx_old);
                 adapter->rx_ring = rxdr;
                 adapter->tx_ring = txdr;
                 err = e1000_up(adapter);
                 if (err)
                         goto err_setup;
         }
+        kfree(tx_old);
+        kfree(rx_old);
 
         clear_bit(__E1000_RESETTING, &adapter->flags);
         return 0;
@@ -644,7 +644,8 @@ err_setup_rx:
 err_alloc_rx:
         kfree(txdr);
 err_alloc_tx:
-        e1000_up(adapter);
+        if (netif_running(adapter->netdev))
+                e1000_up(adapter);
 err_setup:
         clear_bit(__E1000_RESETTING, &adapter->flags);
         return err;
diff --git a/drivers/net/ethernet/intel/fm10k/fm10k.h b/drivers/net/ethernet/intel/fm10k/fm10k.h
index a903a0ba45e1..7d42582ed48d 100644
--- a/drivers/net/ethernet/intel/fm10k/fm10k.h
+++ b/drivers/net/ethernet/intel/fm10k/fm10k.h
@@ -504,9 +504,6 @@ void fm10k_update_stats(struct fm10k_intfc *interface);
 void fm10k_service_event_schedule(struct fm10k_intfc *interface);
 void fm10k_macvlan_schedule(struct fm10k_intfc *interface);
 void fm10k_update_rx_drop_en(struct fm10k_intfc *interface);
-#ifdef CONFIG_NET_POLL_CONTROLLER
-void fm10k_netpoll(struct net_device *netdev);
-#endif
 
 /* Netdev */
 struct net_device *fm10k_alloc_netdev(const struct fm10k_info *info);
diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_netdev.c b/drivers/net/ethernet/intel/fm10k/fm10k_netdev.c
index 929f538d28bc..538a8467f434 100644
--- a/drivers/net/ethernet/intel/fm10k/fm10k_netdev.c
+++ b/drivers/net/ethernet/intel/fm10k/fm10k_netdev.c
@@ -1648,9 +1648,6 @@ static const struct net_device_ops fm10k_netdev_ops = {
         .ndo_udp_tunnel_del     = fm10k_udp_tunnel_del,
         .ndo_dfwd_add_station   = fm10k_dfwd_add_station,
         .ndo_dfwd_del_station   = fm10k_dfwd_del_station,
-#ifdef CONFIG_NET_POLL_CONTROLLER
-        .ndo_poll_controller    = fm10k_netpoll,
-#endif
         .ndo_features_check     = fm10k_features_check,
 };
 
diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_pci.c b/drivers/net/ethernet/intel/fm10k/fm10k_pci.c
index 15071e4adb98..c859ababeed5 100644
--- a/drivers/net/ethernet/intel/fm10k/fm10k_pci.c
+++ b/drivers/net/ethernet/intel/fm10k/fm10k_pci.c
@@ -1210,28 +1210,6 @@ static irqreturn_t fm10k_msix_mbx_vf(int __always_unused irq, void *data)
         return IRQ_HANDLED;
 }
 
-#ifdef CONFIG_NET_POLL_CONTROLLER
-/**
- *  fm10k_netpoll - A Polling 'interrupt' handler
- *  @netdev: network interface device structure
- *
- *  This is used by netconsole to send skbs without having to re-enable
- *  interrupts. It's not called while the normal interrupt routine is executing.
- **/
-void fm10k_netpoll(struct net_device *netdev)
-{
-        struct fm10k_intfc *interface = netdev_priv(netdev);
-        int i;
-
-        /* if interface is down do nothing */
-        if (test_bit(__FM10K_DOWN, interface->state))
-                return;
-
-        for (i = 0; i < interface->num_q_vectors; i++)
-                fm10k_msix_clean_rings(0, interface->q_vector[i]);
-}
-
-#endif
 #define FM10K_ERR_MSG(type) case (type): error = #type; break
 static void fm10k_handle_fault(struct fm10k_intfc *interface, int type,
                                struct fm10k_fault *fault)
diff --git a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
index abcd096ede14..5ff6caa83948 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
@@ -2013,7 +2013,7 @@ static void i40e_get_stat_strings(struct net_device *netdev, u8 *data)
         for (i = 0; i < I40E_MAX_USER_PRIORITY; i++)
                 i40e_add_stat_strings(&data, i40e_gstrings_pfc_stats, i);
 
-        WARN_ONCE(p - data != i40e_get_stats_count(netdev) * ETH_GSTRING_LEN,
+        WARN_ONCE(data - p != i40e_get_stats_count(netdev) * ETH_GSTRING_LEN,
                   "stat strings count mismatch!");
 }
 
diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
index f2c622e78802..ac685ad4d877 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
@@ -5122,15 +5122,17 @@ static int i40e_vsi_configure_bw_alloc(struct i40e_vsi *vsi, u8 enabled_tc,
                                        u8 *bw_share)
 {
         struct i40e_aqc_configure_vsi_tc_bw_data bw_data;
+        struct i40e_pf *pf = vsi->back;
         i40e_status ret;
         int i;
 
-        if (vsi->back->flags & I40E_FLAG_TC_MQPRIO)
+        /* There is no need to reset BW when mqprio mode is on.  */
+        if (pf->flags & I40E_FLAG_TC_MQPRIO)
                 return 0;
-        if (!vsi->mqprio_qopt.qopt.hw) {
+        if (!vsi->mqprio_qopt.qopt.hw && !(pf->flags & I40E_FLAG_DCB_ENABLED)) {
                 ret = i40e_set_bw_limit(vsi, vsi->seid, 0);
                 if (ret)
-                        dev_info(&vsi->back->pdev->dev,
+                        dev_info(&pf->pdev->dev,
                                  "Failed to reset tx rate for vsi->seid %u\n",
                                  vsi->seid);
                 return ret;
@@ -5139,12 +5141,11 @@ static int i40e_vsi_configure_bw_alloc(struct i40e_vsi *vsi, u8 enabled_tc,
         for (i = 0; i < I40E_MAX_TRAFFIC_CLASS; i++)
                 bw_data.tc_bw_credits[i] = bw_share[i];
 
-        ret = i40e_aq_config_vsi_tc_bw(&vsi->back->hw, vsi->seid, &bw_data,
-                                       NULL);
+        ret = i40e_aq_config_vsi_tc_bw(&pf->hw, vsi->seid, &bw_data, NULL);
         if (ret) {
-                dev_info(&vsi->back->pdev->dev,
+                dev_info(&pf->pdev->dev,
                          "AQ command Config VSI BW allocation per TC failed = %d\n",
-                         vsi->back->hw.aq.asq_last_status);
+                         pf->hw.aq.asq_last_status);
                 return -EINVAL;
         }
 
diff --git a/drivers/net/ethernet/intel/i40evf/i40evf_main.c b/drivers/net/ethernet/intel/i40evf/i40evf_main.c
index 5906c1c1d19d..fef6d892ed4c 100644
--- a/drivers/net/ethernet/intel/i40evf/i40evf_main.c
+++ b/drivers/net/ethernet/intel/i40evf/i40evf_main.c
@@ -396,29 +396,6 @@ static void i40evf_map_rings_to_vectors(struct i40evf_adapter *adapter)
         adapter->aq_required |= I40EVF_FLAG_AQ_MAP_VECTORS;
 }
 
-#ifdef CONFIG_NET_POLL_CONTROLLER
-/**
- * i40evf_netpoll - A Polling 'interrupt' handler
- * @netdev: network interface device structure
- *
- * This is used by netconsole to send skbs without having to re-enable
- * interrupts.  It's not called while the normal interrupt routine is executing.
- **/
-static void i40evf_netpoll(struct net_device *netdev)
-{
-        struct i40evf_adapter *adapter = netdev_priv(netdev);
-        int q_vectors = adapter->num_msix_vectors - NONQ_VECS;
-        int i;
-
-        /* if interface is down do nothing */
-        if (test_bit(__I40E_VSI_DOWN, adapter->vsi.state))
-                return;
-
-        for (i = 0; i < q_vectors; i++)
-                i40evf_msix_clean_rings(0, &adapter->q_vectors[i]);
-}
-
-#endif
 /**
  * i40evf_irq_affinity_notify - Callback for affinity changes
  * @notify: context as to what irq was changed
@@ -3229,9 +3206,6 @@ static const struct net_device_ops i40evf_netdev_ops = {
         .ndo_features_check     = i40evf_features_check,
         .ndo_fix_features       = i40evf_fix_features,
         .ndo_set_features       = i40evf_set_features,
-#ifdef CONFIG_NET_POLL_CONTROLLER
-        .ndo_poll_controller    = i40evf_netpoll,
-#endif
         .ndo_setup_tc           = i40evf_setup_tc,
 };
 
diff --git a/drivers/net/ethernet/intel/ice/ice.h b/drivers/net/ethernet/intel/ice/ice.h
index d8b5fff581e7..868f4a1d0f72 100644
--- a/drivers/net/ethernet/intel/ice/ice.h
+++ b/drivers/net/ethernet/intel/ice/ice.h
@@ -89,6 +89,13 @@ extern const char ice_drv_ver[];
 #define ice_for_each_rxq(vsi, i) \
         for ((i) = 0; (i) < (vsi)->num_rxq; (i)++)
 
+/* Macros for each allocated tx/rx ring whether used or not in a VSI */
+#define ice_for_each_alloc_txq(vsi, i) \
+        for ((i) = 0; (i) < (vsi)->alloc_txq; (i)++)
+
+#define ice_for_each_alloc_rxq(vsi, i) \
+        for ((i) = 0; (i) < (vsi)->alloc_rxq; (i)++)
+
 struct ice_tc_info {
         u16 qoffset;
         u16 qcount;
@@ -189,9 +196,9 @@ struct ice_vsi {
         struct list_head tmp_sync_list;         /* MAC filters to be synced */
         struct list_head tmp_unsync_list;       /* MAC filters to be unsynced */
 
-        bool irqs_ready;
-        bool current_isup;               /* Sync 'link up' logging */
-        bool stat_offsets_loaded;
+        u8 irqs_ready;
+        u8 current_isup;                 /* Sync 'link up' logging */
+        u8 stat_offsets_loaded;
 
         /* queue information */
         u8 tx_mapping_mode;              /* ICE_MAP_MODE_[CONTIG|SCATTER] */
@@ -262,7 +269,7 @@ struct ice_pf {
         struct ice_hw_port_stats stats;
         struct ice_hw_port_stats stats_prev;
         struct ice_hw hw;
-        bool stat_prev_loaded;  /* has previous stats been loaded */
+        u8 stat_prev_loaded;    /* has previous stats been loaded */
         char int_name[ICE_INT_NAME_STR_LEN];
 };
 
diff --git a/drivers/net/ethernet/intel/ice/ice_adminq_cmd.h b/drivers/net/ethernet/intel/ice/ice_adminq_cmd.h
index 7541ec2270b3..a0614f472658 100644
--- a/drivers/net/ethernet/intel/ice/ice_adminq_cmd.h
+++ b/drivers/net/ethernet/intel/ice/ice_adminq_cmd.h
@@ -329,19 +329,19 @@ struct ice_aqc_vsi_props {
         /* VLAN section */
         __le16 pvid; /* VLANS include priority bits */
         u8 pvlan_reserved[2];
-        u8 port_vlan_flags;
-#define ICE_AQ_VSI_PVLAN_MODE_S 0
-#define ICE_AQ_VSI_PVLAN_MODE_M (0x3 << ICE_AQ_VSI_PVLAN_MODE_S)
-#define ICE_AQ_VSI_PVLAN_MODE_UNTAGGED  0x1
-#define ICE_AQ_VSI_PVLAN_MODE_TAGGED    0x2
-#define ICE_AQ_VSI_PVLAN_MODE_ALL       0x3
+        u8 vlan_flags;
+#define ICE_AQ_VSI_VLAN_MODE_S  0
+#define ICE_AQ_VSI_VLAN_MODE_M  (0x3 << ICE_AQ_VSI_VLAN_MODE_S)
+#define ICE_AQ_VSI_VLAN_MODE_UNTAGGED   0x1
+#define ICE_AQ_VSI_VLAN_MODE_TAGGED     0x2
+#define ICE_AQ_VSI_VLAN_MODE_ALL        0x3
 #define ICE_AQ_VSI_PVLAN_INSERT_PVID    BIT(2)
-#define ICE_AQ_VSI_PVLAN_EMOD_S 3
-#define ICE_AQ_VSI_PVLAN_EMOD_M (0x3 << ICE_AQ_VSI_PVLAN_EMOD_S)
-#define ICE_AQ_VSI_PVLAN_EMOD_STR_BOTH  (0x0 << ICE_AQ_VSI_PVLAN_EMOD_S)
-#define ICE_AQ_VSI_PVLAN_EMOD_STR_UP    (0x1 << ICE_AQ_VSI_PVLAN_EMOD_S)
-#define ICE_AQ_VSI_PVLAN_EMOD_STR       (0x2 << ICE_AQ_VSI_PVLAN_EMOD_S)
-#define ICE_AQ_VSI_PVLAN_EMOD_NOTHING   (0x3 << ICE_AQ_VSI_PVLAN_EMOD_S)
+#define ICE_AQ_VSI_VLAN_EMOD_S          3
+#define ICE_AQ_VSI_VLAN_EMOD_M          (0x3 << ICE_AQ_VSI_VLAN_EMOD_S)
+#define ICE_AQ_VSI_VLAN_EMOD_STR_BOTH   (0x0 << ICE_AQ_VSI_VLAN_EMOD_S)
+#define ICE_AQ_VSI_VLAN_EMOD_STR_UP     (0x1 << ICE_AQ_VSI_VLAN_EMOD_S)
+#define ICE_AQ_VSI_VLAN_EMOD_STR        (0x2 << ICE_AQ_VSI_VLAN_EMOD_S)
+#define ICE_AQ_VSI_VLAN_EMOD_NOTHING    (0x3 << ICE_AQ_VSI_VLAN_EMOD_S)
         u8 pvlan_reserved2[3];
         /* ingress egress up sections */
         __le32 ingress_table; /* bitmap, 3 bits per up */
@@ -594,6 +594,7 @@ struct ice_sw_rule_lg_act {
 #define ICE_LG_ACT_GENERIC_OFFSET_M     (0x7 << ICE_LG_ACT_GENERIC_OFFSET_S)
 #define ICE_LG_ACT_GENERIC_PRIORITY_S   22
 #define ICE_LG_ACT_GENERIC_PRIORITY_M   (0x7 << ICE_LG_ACT_GENERIC_PRIORITY_S)
+#define ICE_LG_ACT_GENERIC_OFF_RX_DESC_PROF_IDX 7
 
         /* Action = 7 - Set Stat count */
 #define ICE_LG_ACT_STAT_COUNT           0x7
diff --git a/drivers/net/ethernet/intel/ice/ice_common.c b/drivers/net/ethernet/intel/ice/ice_common.c
index 71d032cc5fa7..661beea6af79 100644
--- a/drivers/net/ethernet/intel/ice/ice_common.c
+++ b/drivers/net/ethernet/intel/ice/ice_common.c
@@ -45,6 +45,9 @@ static enum ice_status ice_set_mac_type(struct ice_hw *hw)
 /**
  * ice_clear_pf_cfg - Clear PF configuration
  * @hw: pointer to the hardware structure
+ *
+ * Clears any existing PF configuration (VSIs, VSI lists, switch rules, port
+ * configuration, flow director filters, etc.).
  */
 enum ice_status ice_clear_pf_cfg(struct ice_hw *hw)
 {
@@ -1483,7 +1486,7 @@ enum ice_status ice_get_link_status(struct ice_port_info *pi, bool *link_up)
         struct ice_phy_info *phy_info;
         enum ice_status status = 0;
 
-        if (!pi)
+        if (!pi || !link_up)
                 return ICE_ERR_PARAM;
 
         phy_info = &pi->phy;
@@ -1619,20 +1622,23 @@ __ice_aq_get_set_rss_lut(struct ice_hw *hw, u16 vsi_id, u8 lut_type, u8 *lut,
         }
 
         /* LUT size is only valid for Global and PF table types */
-        if (lut_size == ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_128) {
-                flags |= (ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_128_FLAG <<
-                          ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_S) &
-                         ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_M;
-        } else if (lut_size == ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_512) {
+        switch (lut_size) {
+        case ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_128:
+                break;
+        case ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_512:
                 flags |= (ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_512_FLAG <<
                           ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_S) &
                          ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_M;
-        } else if ((lut_size == ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_2K) &&
-                   (lut_type == ICE_AQC_GSET_RSS_LUT_TABLE_TYPE_PF)) {
-                flags |= (ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_2K_FLAG <<
-                          ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_S) &
-                         ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_M;
-        } else {
+                break;
+        case ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_2K:
+                if (lut_type == ICE_AQC_GSET_RSS_LUT_TABLE_TYPE_PF) {
+                        flags |= (ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_2K_FLAG <<
+                                  ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_S) &
+                                 ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_M;
+                        break;
+                }
+                /* fall-through */
+        default:
                 status = ICE_ERR_PARAM;
                 goto ice_aq_get_set_rss_lut_exit;
         }
diff --git a/drivers/net/ethernet/intel/ice/ice_controlq.c b/drivers/net/ethernet/intel/ice/ice_controlq.c
index 7c511f144ed6..62be72fdc8f3 100644
--- a/drivers/net/ethernet/intel/ice/ice_controlq.c
+++ b/drivers/net/ethernet/intel/ice/ice_controlq.c
@@ -597,10 +597,14 @@ static enum ice_status ice_init_check_adminq(struct ice_hw *hw)
         return 0;
 
 init_ctrlq_free_rq:
-        ice_shutdown_rq(hw, cq);
-        ice_shutdown_sq(hw, cq);
-        mutex_destroy(&cq->sq_lock);
-        mutex_destroy(&cq->rq_lock);
+        if (cq->rq.head) {
+                ice_shutdown_rq(hw, cq);
+                mutex_destroy(&cq->rq_lock);
+        }
+        if (cq->sq.head) {
+                ice_shutdown_sq(hw, cq);
+                mutex_destroy(&cq->sq_lock);
+        }
         return status;
 }
 
@@ -706,10 +710,14 @@ static void ice_shutdown_ctrlq(struct ice_hw *hw, enum ice_ctl_q q_type)
                 return;
         }
 
-        ice_shutdown_sq(hw, cq);
-        ice_shutdown_rq(hw, cq);
-        mutex_destroy(&cq->sq_lock);
-        mutex_destroy(&cq->rq_lock);
+        if (cq->sq.head) {
+                ice_shutdown_sq(hw, cq);
+                mutex_destroy(&cq->sq_lock);
+        }
+        if (cq->rq.head) {
+                ice_shutdown_rq(hw, cq);
+                mutex_destroy(&cq->rq_lock);
+        }
 }
 
 /**
@@ -1057,8 +1065,11 @@ ice_clean_rq_elem(struct ice_hw *hw, struct ice_ctl_q_info *cq,
 
 clean_rq_elem_out:
         /* Set pending if needed, unlock and return */
-        if (pending)
+        if (pending) {
+                /* re-read HW head to calculate actual pending messages */
+                ntu = (u16)(rd32(hw, cq->rq.head) & cq->rq.head_mask);
                 *pending = (u16)((ntc > ntu ? cq->rq.count : 0) + (ntu - ntc));
+        }
 clean_rq_elem_err:
         mutex_unlock(&cq->rq_lock);
 
diff --git a/drivers/net/ethernet/intel/ice/ice_ethtool.c b/drivers/net/ethernet/intel/ice/ice_ethtool.c
index 1db304c01d10..c71a9b528d6d 100644
--- a/drivers/net/ethernet/intel/ice/ice_ethtool.c
+++ b/drivers/net/ethernet/intel/ice/ice_ethtool.c
@@ -26,7 +26,7 @@ static int ice_q_stats_len(struct net_device *netdev)
 {
         struct ice_netdev_priv *np = netdev_priv(netdev);
 
-        return ((np->vsi->num_txq + np->vsi->num_rxq) *
+        return ((np->vsi->alloc_txq + np->vsi->alloc_rxq) *
                 (sizeof(struct ice_q_stats) / sizeof(u64)));
 }
 
@@ -218,7 +218,7 @@ static void ice_get_strings(struct net_device *netdev, u32 stringset, u8 *data)
                         p += ETH_GSTRING_LEN;
                 }
 
-                ice_for_each_txq(vsi, i) {
+                ice_for_each_alloc_txq(vsi, i) {
                         snprintf(p, ETH_GSTRING_LEN,
                                  "tx-queue-%u.tx_packets", i);
                         p += ETH_GSTRING_LEN;
@@ -226,7 +226,7 @@ static void ice_get_strings(struct net_device *netdev, u32 stringset, u8 *data)
                         p += ETH_GSTRING_LEN;
                 }
 
-                ice_for_each_rxq(vsi, i) {
+                ice_for_each_alloc_rxq(vsi, i) {
                         snprintf(p, ETH_GSTRING_LEN,
                                  "rx-queue-%u.rx_packets", i);
                         p += ETH_GSTRING_LEN;
@@ -253,6 +253,24 @@ static int ice_get_sset_count(struct net_device *netdev, int sset)
 {
         switch (sset) {
         case ETH_SS_STATS:
+                /* The number (and order) of strings reported *must* remain
+                 * constant for a given netdevice. This function must not
+                 * report a different number based on run time parameters
+                 * (such as the number of queues in use, or the setting of
+                 * a private ethtool flag). This is due to the nature of the
+                 * ethtool stats API.
+                 *
+                 * User space programs such as ethtool must make 3 separate
+                 * ioctl requests, one for size, one for the strings, and
+                 * finally one for the stats. Since these cross into
+                 * user space, changes to the number or size could result in
+                 * undefined memory access or incorrect string<->value
+                 * correlations for statistics.
+                 *
+                 * Even if it appears to be safe, changes to the size or
+                 * order of strings will suffer from race conditions and are
+                 * not safe.
+                 */
                 return ICE_ALL_STATS_LEN(netdev);
         default:
                 return -EOPNOTSUPP;
@@ -280,18 +298,26 @@ ice_get_ethtool_stats(struct net_device *netdev,
         /* populate per queue stats */
         rcu_read_lock();
 
-        ice_for_each_txq(vsi, j) {
+        ice_for_each_alloc_txq(vsi, j) {
                 ring = READ_ONCE(vsi->tx_rings[j]);
-                if (!ring)
-                        continue;
-                data[i++] = ring->stats.pkts;
-                data[i++] = ring->stats.bytes;
+                if (ring) {
+                        data[i++] = ring->stats.pkts;
+                        data[i++] = ring->stats.bytes;
+                } else {
+                        data[i++] = 0;
+                        data[i++] = 0;
+                }
         }
 
-        ice_for_each_rxq(vsi, j) {
+        ice_for_each_alloc_rxq(vsi, j) {
                 ring = READ_ONCE(vsi->rx_rings[j]);
-                data[i++] = ring->stats.pkts;
-                data[i++] = ring->stats.bytes;
+                if (ring) {
+                        data[i++] = ring->stats.pkts;
+                        data[i++] = ring->stats.bytes;
+                } else {
+                        data[i++] = 0;
+                        data[i++] = 0;
+                }
         }
 
         rcu_read_unlock();
@@ -519,7 +545,7 @@ ice_set_ringparam(struct net_device *netdev, struct ethtool_ringparam *ring)
                 goto done;
         }
 
-        for (i = 0; i < vsi->num_txq; i++) {
+        for (i = 0; i < vsi->alloc_txq; i++) {
                 /* clone ring and setup updated count */
                 tx_rings[i] = *vsi->tx_rings[i];
                 tx_rings[i].count = new_tx_cnt;
@@ -551,7 +577,7 @@ process_rx:
                 goto done;
         }
 
-        for (i = 0; i < vsi->num_rxq; i++) {
+        for (i = 0; i < vsi->alloc_rxq; i++) {
                 /* clone ring and setup updated count */
                 rx_rings[i] = *vsi->rx_rings[i];
                 rx_rings[i].count = new_rx_cnt;
diff --git a/drivers/net/ethernet/intel/ice/ice_hw_autogen.h b/drivers/net/ethernet/intel/ice/ice_hw_autogen.h
index 499904874b3f..6076fc87df9d 100644
--- a/drivers/net/ethernet/intel/ice/ice_hw_autogen.h
+++ b/drivers/net/ethernet/intel/ice/ice_hw_autogen.h
@@ -121,10 +121,6 @@
 #define PFINT_FW_CTL_CAUSE_ENA_S        30
 #define PFINT_FW_CTL_CAUSE_ENA_M        BIT(PFINT_FW_CTL_CAUSE_ENA_S)
 #define PFINT_OICR                      0x0016CA00
-#define PFINT_OICR_HLP_RDY_S            14
-#define PFINT_OICR_HLP_RDY_M            BIT(PFINT_OICR_HLP_RDY_S)
-#define PFINT_OICR_CPM_RDY_S            15
-#define PFINT_OICR_CPM_RDY_M            BIT(PFINT_OICR_CPM_RDY_S)
 #define PFINT_OICR_ECC_ERR_S            16
 #define PFINT_OICR_ECC_ERR_M            BIT(PFINT_OICR_ECC_ERR_S)
 #define PFINT_OICR_MAL_DETECT_S         19
@@ -133,10 +129,6 @@
 #define PFINT_OICR_GRST_M               BIT(PFINT_OICR_GRST_S)
 #define PFINT_OICR_PCI_EXCEPTION_S      21
 #define PFINT_OICR_PCI_EXCEPTION_M      BIT(PFINT_OICR_PCI_EXCEPTION_S)
-#define PFINT_OICR_GPIO_S               22
-#define PFINT_OICR_GPIO_M               BIT(PFINT_OICR_GPIO_S)
-#define PFINT_OICR_STORM_DETECT_S       24
-#define PFINT_OICR_STORM_DETECT_M       BIT(PFINT_OICR_STORM_DETECT_S)
 #define PFINT_OICR_HMC_ERR_S            26
 #define PFINT_OICR_HMC_ERR_M            BIT(PFINT_OICR_HMC_ERR_S)
 #define PFINT_OICR_PE_CRITERR_S         28
diff --git a/drivers/net/ethernet/intel/ice/ice_lan_tx_rx.h b/drivers/net/ethernet/intel/ice/ice_lan_tx_rx.h
index d23a91665b46..068dbc740b76 100644
--- a/drivers/net/ethernet/intel/ice/ice_lan_tx_rx.h
+++ b/drivers/net/ethernet/intel/ice/ice_lan_tx_rx.h
@@ -265,6 +265,7 @@ enum ice_rx_flex_desc_status_error_0_bits {
 struct ice_rlan_ctx {
         u16 head;
         u16 cpuid; /* bigger than needed, see above for reason */
+#define ICE_RLAN_BASE_S 7
         u64 base;
         u16 qlen;
 #define ICE_RLAN_CTX_DBUF_S 7
diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c
index 5299caf55a7f..3f047bb43348 100644
--- a/drivers/net/ethernet/intel/ice/ice_main.c
+++ b/drivers/net/ethernet/intel/ice/ice_main.c
@@ -901,7 +901,7 @@ static int __ice_clean_ctrlq(struct ice_pf *pf, enum ice_ctl_q q_type)
                 case ice_aqc_opc_get_link_status:
                         if (ice_handle_link_event(pf))
                                 dev_err(&pf->pdev->dev,
-                                        "Could not handle link event");
+                                        "Could not handle link event\n");
                         break;
                 default:
                         dev_dbg(&pf->pdev->dev,
@@ -917,13 +917,27 @@ static int __ice_clean_ctrlq(struct ice_pf *pf, enum ice_ctl_q q_type)
 }
 
 /**
+ * ice_ctrlq_pending - check if there is a difference between ntc and ntu
+ * @hw: pointer to hardware info
+ * @cq: control queue information
+ *
+ * returns true if there are pending messages in a queue, false if there aren't
+ */
+static bool ice_ctrlq_pending(struct ice_hw *hw, struct ice_ctl_q_info *cq)
+{
+        u16 ntu;
+
+        ntu = (u16)(rd32(hw, cq->rq.head) & cq->rq.head_mask);
+        return cq->rq.next_to_clean != ntu;
+}
+
+/**
  * ice_clean_adminq_subtask - clean the AdminQ rings
  * @pf: board private structure
  */
 static void ice_clean_adminq_subtask(struct ice_pf *pf)
 {
         struct ice_hw *hw = &pf->hw;
-        u32 val;
 
         if (!test_bit(__ICE_ADMINQ_EVENT_PENDING, pf->state))
                 return;
@@ -933,9 +947,13 @@ static void ice_clean_adminq_subtask(struct ice_pf *pf)
 
         clear_bit(__ICE_ADMINQ_EVENT_PENDING, pf->state);
 
-        /* re-enable Admin queue interrupt causes */
-        val = rd32(hw, PFINT_FW_CTL);
-        wr32(hw, PFINT_FW_CTL, (val | PFINT_FW_CTL_CAUSE_ENA_M));
+        /* There might be a situation where new messages arrive to a control
+         * queue between processing the last message and clearing the
+         * EVENT_PENDING bit. So before exiting, check queue head again (using
+         * ice_ctrlq_pending) and process new messages if any.
+         */
+        if (ice_ctrlq_pending(hw, &hw->adminq))
+                __ice_clean_ctrlq(pf, ICE_CTL_Q_ADMIN);
 
         ice_flush(hw);
 }
@@ -1295,11 +1313,8 @@ static void ice_vsi_setup_q_map(struct ice_vsi *vsi, struct ice_vsi_ctx *ctxt)
                 qcount = numq_tc;
         }
 
-        /* find higher power-of-2 of qcount */
-        pow = ilog2(qcount);
-
-        if (!is_power_of_2(qcount))
-                pow++;
+        /* find the (rounded up) power-of-2 of qcount */
+        pow = order_base_2(qcount);
 
         for (i = 0; i < ICE_MAX_TRAFFIC_CLASS; i++) {
                 if (!(vsi->tc_cfg.ena_tc & BIT(i))) {
@@ -1352,14 +1367,15 @@ static void ice_set_dflt_vsi_ctx(struct ice_vsi_ctx *ctxt)
         ctxt->info.sw_flags = ICE_AQ_VSI_SW_FLAG_SRC_PRUNE;
         /* Traffic from VSI can be sent to LAN */
         ctxt->info.sw_flags2 = ICE_AQ_VSI_SW_FLAG_LAN_ENA;
-        /* Allow all packets untagged/tagged */
-        ctxt->info.port_vlan_flags = ((ICE_AQ_VSI_PVLAN_MODE_ALL &
-                                       ICE_AQ_VSI_PVLAN_MODE_M) >>
-                                      ICE_AQ_VSI_PVLAN_MODE_S);
-        /* Show VLAN/UP from packets in Rx descriptors */
-        ctxt->info.port_vlan_flags |= ((ICE_AQ_VSI_PVLAN_EMOD_STR_BOTH &
-                                        ICE_AQ_VSI_PVLAN_EMOD_M) >>
-                                       ICE_AQ_VSI_PVLAN_EMOD_S);
+
+        /* By default bits 3 and 4 in vlan_flags are 0's which results in legacy
+         * behavior (show VLAN, DEI, and UP) in descriptor. Also, allow all
+         * packets untagged/tagged.
+         */
+        ctxt->info.vlan_flags = ((ICE_AQ_VSI_VLAN_MODE_ALL &
+                                  ICE_AQ_VSI_VLAN_MODE_M) >>
+                                 ICE_AQ_VSI_VLAN_MODE_S);
+
         /* Have 1:1 UP mapping for both ingress/egress tables */
         table |= ICE_UP_TABLE_TRANSLATE(0, 0);
         table |= ICE_UP_TABLE_TRANSLATE(1, 1);
@@ -1688,15 +1704,12 @@ static void ice_ena_misc_vector(struct ice_pf *pf)
         wr32(hw, PFINT_OICR_ENA, 0);    /* disable all */
         rd32(hw, PFINT_OICR);           /* read to clear */
 
-        val = (PFINT_OICR_HLP_RDY_M |
-               PFINT_OICR_CPM_RDY_M |
-               PFINT_OICR_ECC_ERR_M |
+        val = (PFINT_OICR_ECC_ERR_M |
                PFINT_OICR_MAL_DETECT_M |
                PFINT_OICR_GRST_M |
                PFINT_OICR_PCI_EXCEPTION_M |
-               PFINT_OICR_GPIO_M |
-               PFINT_OICR_STORM_DETECT_M |
-               PFINT_OICR_HMC_ERR_M);
+               PFINT_OICR_HMC_ERR_M |
+               PFINT_OICR_PE_CRITERR_M);
 
         wr32(hw, PFINT_OICR_ENA, val);
 
@@ -2058,15 +2071,13 @@ static int ice_req_irq_msix_misc(struct ice_pf *pf)
 skip_req_irq:
         ice_ena_misc_vector(pf);
 
-        val = (pf->oicr_idx & PFINT_OICR_CTL_MSIX_INDX_M) |
-              (ICE_RX_ITR & PFINT_OICR_CTL_ITR_INDX_M) |
-              PFINT_OICR_CTL_CAUSE_ENA_M;
+        val = ((pf->oicr_idx & PFINT_OICR_CTL_MSIX_INDX_M) |
+               PFINT_OICR_CTL_CAUSE_ENA_M);
         wr32(hw, PFINT_OICR_CTL, val);
 
         /* This enables Admin queue Interrupt causes */
-        val = (pf->oicr_idx & PFINT_FW_CTL_MSIX_INDX_M) |
-              (ICE_RX_ITR & PFINT_FW_CTL_ITR_INDX_M) |
-              PFINT_FW_CTL_CAUSE_ENA_M;
+        val = ((pf->oicr_idx & PFINT_FW_CTL_MSIX_INDX_M) |
+               PFINT_FW_CTL_CAUSE_ENA_M);
         wr32(hw, PFINT_FW_CTL, val);
 
         itr_gran = hw->itr_gran_200;
@@ -3246,8 +3257,10 @@ static void ice_clear_interrupt_scheme(struct ice_pf *pf)
         if (test_bit(ICE_FLAG_MSIX_ENA, pf->flags))
                 ice_dis_msix(pf);
 
-        devm_kfree(&pf->pdev->dev, pf->irq_tracker);
-        pf->irq_tracker = NULL;
+        if (pf->irq_tracker) {
+                devm_kfree(&pf->pdev->dev, pf->irq_tracker);
+                pf->irq_tracker = NULL;
+        }
 }
 
 /**
@@ -3271,7 +3284,7 @@ static int ice_probe(struct pci_dev *pdev,
 
         err = pcim_iomap_regions(pdev, BIT(ICE_BAR0), pci_name(pdev));
         if (err) {
-                dev_err(&pdev->dev, "I/O map error %d\n", err);
+                dev_err(&pdev->dev, "BAR0 I/O map error %d\n", err);
                 return err;
         }
 
@@ -3720,10 +3733,10 @@ static int ice_vsi_manage_vlan_insertion(struct ice_vsi *vsi)
         enum ice_status status;
 
         /* Here we are configuring the VSI to let the driver add VLAN tags by
-         * setting port_vlan_flags to ICE_AQ_VSI_PVLAN_MODE_ALL. The actual VLAN
-         * tag insertion happens in the Tx hot path, in ice_tx_map.
+         * setting vlan_flags to ICE_AQ_VSI_VLAN_MODE_ALL. The actual VLAN tag
+         * insertion happens in the Tx hot path, in ice_tx_map.
          */
-        ctxt.info.port_vlan_flags = ICE_AQ_VSI_PVLAN_MODE_ALL;
+        ctxt.info.vlan_flags = ICE_AQ_VSI_VLAN_MODE_ALL;
 
         ctxt.info.valid_sections = cpu_to_le16(ICE_AQ_VSI_PROP_VLAN_VALID);
         ctxt.vsi_num = vsi->vsi_num;
@@ -3735,7 +3748,7 @@ static int ice_vsi_manage_vlan_insertion(struct ice_vsi *vsi)
                 return -EIO;
         }
 
-        vsi->info.port_vlan_flags = ctxt.info.port_vlan_flags;
+        vsi->info.vlan_flags = ctxt.info.vlan_flags;
         return 0;
 }
 
@@ -3757,12 +3770,15 @@ static int ice_vsi_manage_vlan_stripping(struct ice_vsi *vsi, bool ena)
          */
         if (ena) {
                 /* Strip VLAN tag from Rx packet and put it in the desc */
-                ctxt.info.port_vlan_flags = ICE_AQ_VSI_PVLAN_EMOD_STR_BOTH;
+                ctxt.info.vlan_flags = ICE_AQ_VSI_VLAN_EMOD_STR_BOTH;
         } else {
                 /* Disable stripping. Leave tag in packet */
-                ctxt.info.port_vlan_flags = ICE_AQ_VSI_PVLAN_EMOD_NOTHING;
+                ctxt.info.vlan_flags = ICE_AQ_VSI_VLAN_EMOD_NOTHING;
         }
 
+        /* Allow all packets untagged/tagged */
+        ctxt.info.vlan_flags |= ICE_AQ_VSI_VLAN_MODE_ALL;
+
         ctxt.info.valid_sections = cpu_to_le16(ICE_AQ_VSI_PROP_VLAN_VALID);
         ctxt.vsi_num = vsi->vsi_num;
 
@@ -3773,7 +3789,7 @@ static int ice_vsi_manage_vlan_stripping(struct ice_vsi *vsi, bool ena)
                 return -EIO;
         }
 
-        vsi->info.port_vlan_flags = ctxt.info.port_vlan_flags;
+        vsi->info.vlan_flags = ctxt.info.vlan_flags;
         return 0;
 }
 
@@ -3986,7 +4002,7 @@ static int ice_setup_rx_ctx(struct ice_ring *ring)
         /* clear the context structure first */
         memset(&rlan_ctx, 0, sizeof(rlan_ctx));
 
-        rlan_ctx.base = ring->dma >> 7;
+        rlan_ctx.base = ring->dma >> ICE_RLAN_BASE_S;
 
         rlan_ctx.qlen = ring->count;
 
@@ -4098,11 +4114,12 @@ static int ice_vsi_cfg(struct ice_vsi *vsi)
 {
         int err;
 
-        ice_set_rx_mode(vsi->netdev);
-
-        err = ice_restore_vlan(vsi);
-        if (err)
-                return err;
+        if (vsi->netdev) {
+                ice_set_rx_mode(vsi->netdev);
+                err = ice_restore_vlan(vsi);
+                if (err)
+                        return err;
+        }
 
         err = ice_vsi_cfg_txqs(vsi);
         if (!err)
@@ -4789,30 +4806,6 @@ void ice_get_stats64(struct net_device *netdev, struct rtnl_link_stats64 *stats)
         stats->rx_length_errors = vsi_stats->rx_length_errors;
 }
 
-#ifdef CONFIG_NET_POLL_CONTROLLER
-/**
- * ice_netpoll - polling "interrupt" handler
- * @netdev: network interface device structure
- *
- * Used by netconsole to send skbs without having to re-enable interrupts.
- * This is not called in the normal interrupt path.
- */
-static void ice_netpoll(struct net_device *netdev)
-{
-        struct ice_netdev_priv *np = netdev_priv(netdev);
-        struct ice_vsi *vsi = np->vsi;
-        struct ice_pf *pf = vsi->back;
-        int i;
-
-        if (test_bit(__ICE_DOWN, vsi->state) ||
-            !test_bit(ICE_FLAG_MSIX_ENA, pf->flags))
-                return;
-
-        for (i = 0; i < vsi->num_q_vectors; i++)
-                ice_msix_clean_rings(0, vsi->q_vectors[i]);
-}
-#endif /* CONFIG_NET_POLL_CONTROLLER */
-
 /**
  * ice_napi_disable_all - Disable NAPI for all q_vectors in the VSI
  * @vsi: VSI having NAPI disabled
@@ -4868,7 +4861,7 @@ int ice_down(struct ice_vsi *vsi)
  */
 static int ice_vsi_setup_tx_rings(struct ice_vsi *vsi)
 {
-        int i, err;
+        int i, err = 0;
 
         if (!vsi->num_txq) {
                 dev_err(&vsi->back->pdev->dev, "VSI %d has 0 Tx queues\n",
@@ -4893,7 +4886,7 @@ static int ice_vsi_setup_tx_rings(struct ice_vsi *vsi)
  */
 static int ice_vsi_setup_rx_rings(struct ice_vsi *vsi)
 {
-        int i, err;
+        int i, err = 0;
 
         if (!vsi->num_rxq) {
                 dev_err(&vsi->back->pdev->dev, "VSI %d has 0 Rx queues\n",
@@ -5235,7 +5228,7 @@ static int ice_change_mtu(struct net_device *netdev, int new_mtu)
         u8 count = 0;
 
         if (new_mtu == netdev->mtu) {
-                netdev_warn(netdev, "mtu is already %d\n", netdev->mtu);
+                netdev_warn(netdev, "mtu is already %u\n", netdev->mtu);
                 return 0;
         }
 
@@ -5480,9 +5473,6 @@ static const struct net_device_ops ice_netdev_ops = {
         .ndo_validate_addr = eth_validate_addr,
         .ndo_change_mtu = ice_change_mtu,
         .ndo_get_stats64 = ice_get_stats64,
-#ifdef CONFIG_NET_POLL_CONTROLLER
-        .ndo_poll_controller = ice_netpoll,
-#endif /* CONFIG_NET_POLL_CONTROLLER */
         .ndo_vlan_rx_add_vid = ice_vlan_rx_add_vid,
         .ndo_vlan_rx_kill_vid = ice_vlan_rx_kill_vid,
         .ndo_set_features = ice_set_features,
diff --git a/drivers/net/ethernet/intel/ice/ice_nvm.c b/drivers/net/ethernet/intel/ice/ice_nvm.c
index 92da0a626ce0..295a8cd87fc1 100644
--- a/drivers/net/ethernet/intel/ice/ice_nvm.c
+++ b/drivers/net/ethernet/intel/ice/ice_nvm.c
@@ -131,9 +131,8 @@ ice_read_sr_word_aq(struct ice_hw *hw, u16 offset, u16 *data)
  *
  * This function will request NVM ownership.
  */
-static enum
-ice_status ice_acquire_nvm(struct ice_hw *hw,
-                           enum ice_aq_res_access_type access)
+static enum ice_status
+ice_acquire_nvm(struct ice_hw *hw, enum ice_aq_res_access_type access)
 {
         if (hw->nvm.blank_nvm_mode)
                 return 0;
diff --git a/drivers/net/ethernet/intel/ice/ice_sched.c b/drivers/net/ethernet/intel/ice/ice_sched.c
index 2e6c1d92cc88..eeae199469b6 100644
--- a/drivers/net/ethernet/intel/ice/ice_sched.c
+++ b/drivers/net/ethernet/intel/ice/ice_sched.c
@@ -1576,8 +1576,7 @@ ice_sched_update_vsi_child_nodes(struct ice_port_info *pi, u16 vsi_id, u8 tc,
                         return status;
         }
 
-        if (owner == ICE_SCHED_NODE_OWNER_LAN)
-                vsi->max_lanq[tc] = new_numqs;
+        vsi->max_lanq[tc] = new_numqs;
 
         return status;
 }
diff --git a/drivers/net/ethernet/intel/ice/ice_switch.c b/drivers/net/ethernet/intel/ice/ice_switch.c
index 723d15f1e90b..6b7ec2ae5ad6 100644
--- a/drivers/net/ethernet/intel/ice/ice_switch.c
+++ b/drivers/net/ethernet/intel/ice/ice_switch.c
@@ -645,14 +645,14 @@ ice_add_marker_act(struct ice_hw *hw, struct ice_fltr_mgmt_list_entry *m_ent,
         act |= (1 << ICE_LG_ACT_GENERIC_VALUE_S) & ICE_LG_ACT_GENERIC_VALUE_M;
         lg_act->pdata.lg_act.act[1] = cpu_to_le32(act);
 
-        act = (7 << ICE_LG_ACT_GENERIC_OFFSET_S) & ICE_LG_ACT_GENERIC_VALUE_M;
+        act = (ICE_LG_ACT_GENERIC_OFF_RX_DESC_PROF_IDX <<
+               ICE_LG_ACT_GENERIC_OFFSET_S) & ICE_LG_ACT_GENERIC_OFFSET_M;
 
         /* Third action Marker value */
         act |= ICE_LG_ACT_GENERIC;
         act |= (sw_marker << ICE_LG_ACT_GENERIC_VALUE_S) &
                 ICE_LG_ACT_GENERIC_VALUE_M;
 
-        act |= (0 << ICE_LG_ACT_GENERIC_OFFSET_S) & ICE_LG_ACT_GENERIC_VALUE_M;
         lg_act->pdata.lg_act.act[2] = cpu_to_le32(act);
 
         /* call the fill switch rule to fill the lookup tx rx structure */
diff --git a/drivers/net/ethernet/intel/ice/ice_switch.h b/drivers/net/ethernet/intel/ice/ice_switch.h
index 6f4a0d159dbf..9b8ec128ee31 100644
--- a/drivers/net/ethernet/intel/ice/ice_switch.h
+++ b/drivers/net/ethernet/intel/ice/ice_switch.h
@@ -17,7 +17,7 @@ struct ice_vsi_ctx {
         u16 vsis_unallocated;
         u16 flags;
         struct ice_aqc_vsi_props info;
-        bool alloc_from_pool;
+        u8 alloc_from_pool;
 };
 
 enum ice_sw_fwd_act_type {
@@ -94,8 +94,8 @@ struct ice_fltr_info {
         u8 qgrp_size;
 
         /* Rule creations populate these indicators basing on the switch type */
-        bool lb_en;     /* Indicate if packet can be looped back */
-        bool lan_en;    /* Indicate if packet can be forwarded to the uplink */
+        u8 lb_en;       /* Indicate if packet can be looped back */
+        u8 lan_en;      /* Indicate if packet can be forwarded to the uplink */
 };
 
 /* Bookkeeping structure to hold bitmap of VSIs corresponding to VSI list id */
diff --git a/drivers/net/ethernet/intel/ice/ice_txrx.h b/drivers/net/ethernet/intel/ice/ice_txrx.h
index 567067b650c4..31bc998fe200 100644
--- a/drivers/net/ethernet/intel/ice/ice_txrx.h
+++ b/drivers/net/ethernet/intel/ice/ice_txrx.h
@@ -143,7 +143,7 @@ struct ice_ring {
         u16 next_to_use;
         u16 next_to_clean;
 
-        bool ring_active;               /* is ring online or not */
+        u8 ring_active;                 /* is ring online or not */
 
         /* stats structs */
         struct ice_q_stats      stats;
diff --git a/drivers/net/ethernet/intel/ice/ice_type.h b/drivers/net/ethernet/intel/ice/ice_type.h
index 99c8a9a71b5e..97c366e0ca59 100644
--- a/drivers/net/ethernet/intel/ice/ice_type.h
+++ b/drivers/net/ethernet/intel/ice/ice_type.h
@@ -83,7 +83,7 @@ struct ice_link_status {
         u64 phy_type_low;
         u16 max_frame_size;
         u16 link_speed;
-        bool lse_ena;   /* Link Status Event notification */
+        u8 lse_ena;     /* Link Status Event notification */
         u8 link_info;
         u8 an_info;
         u8 ext_info;
@@ -101,7 +101,7 @@ struct ice_phy_info {
         struct ice_link_status link_info_old;
         u64 phy_type_low;
         enum ice_media_type media_type;
-        bool get_link_info;
+        u8 get_link_info;
 };
 
 /* Common HW capabilities for SW use */
@@ -167,7 +167,7 @@ struct ice_nvm_info {
         u32 oem_ver;              /* OEM version info */
         u16 sr_words;             /* Shadow RAM size in words */
         u16 ver;                  /* NVM package version */
-        bool blank_nvm_mode;      /* is NVM empty (no FW present) */
+        u8 blank_nvm_mode;        /* is NVM empty (no FW present) */
 };
 
 /* Max number of port to queue branches w.r.t topology */
@@ -181,7 +181,7 @@ struct ice_sched_node {
         struct ice_aqc_txsched_elem_data info;
         u32 agg_id;                     /* aggregator group id */
         u16 vsi_id;
-        bool in_use;                    /* suspended or in use */
+        u8 in_use;                      /* suspended or in use */
         u8 tx_sched_layer;              /* Logical Layer (1-9) */
         u8 num_children;
         u8 tc_num;
@@ -218,7 +218,7 @@ struct ice_sched_vsi_info {
 struct ice_sched_tx_policy {
         u16 max_num_vsis;
         u8 max_num_lan_qs_per_tc[ICE_MAX_TRAFFIC_CLASS];
-        bool rdma_ena;
+        u8 rdma_ena;
 };
 
 struct ice_port_info {
@@ -243,7 +243,7 @@ struct ice_port_info {
         struct list_head agg_list;      /* lists all aggregator */
         u8 lport;
 #define ICE_LPORT_MASK          0xff
-        bool is_vf;
+        u8 is_vf;
 };
 
 struct ice_switch_info {
@@ -287,7 +287,7 @@ struct ice_hw {
         u8 max_cgds;
         u8 sw_entry_point_layer;
 
-        bool evb_veb;           /* true for VEB, false for VEPA */
+        u8 evb_veb;             /* true for VEB, false for VEPA */
         struct ice_bus_info bus;
         struct ice_nvm_info nvm;
         struct ice_hw_dev_caps dev_caps;        /* device capabilities */
@@ -318,7 +318,7 @@ struct ice_hw {
         u8 itr_gran_100;
         u8 itr_gran_50;
         u8 itr_gran_25;
-        bool ucast_shared;      /* true if VSIs can share unicast addr */
+        u8 ucast_shared;        /* true if VSIs can share unicast addr */
 
 };
 
diff --git a/drivers/net/ethernet/intel/igb/igb_ethtool.c b/drivers/net/ethernet/intel/igb/igb_ethtool.c
index f92f7918112d..5acf3b743876 100644
--- a/drivers/net/ethernet/intel/igb/igb_ethtool.c
+++ b/drivers/net/ethernet/intel/igb/igb_ethtool.c
@@ -1649,7 +1649,7 @@ static int igb_integrated_phy_loopback(struct igb_adapter *adapter)
         if (hw->phy.type == e1000_phy_m88)
                 igb_phy_disable_receiver(adapter);
 
-        mdelay(500);
+        msleep(500);
         return 0;
 }
 
diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
index d03c2f0d7592..0796cef96fa3 100644
--- a/drivers/net/ethernet/intel/igb/igb_main.c
+++ b/drivers/net/ethernet/intel/igb/igb_main.c
@@ -205,10 +205,6 @@ static struct notifier_block dca_notifier = {
         .priority       = 0
 };
 #endif
-#ifdef CONFIG_NET_POLL_CONTROLLER
-/* for netdump / net console */
-static void igb_netpoll(struct net_device *);
-#endif
 #ifdef CONFIG_PCI_IOV
 static unsigned int max_vfs;
 module_param(max_vfs, uint, 0);
@@ -2881,9 +2877,6 @@ static const struct net_device_ops igb_netdev_ops = {
         .ndo_set_vf_spoofchk    = igb_ndo_set_vf_spoofchk,
         .ndo_set_vf_trust       = igb_ndo_set_vf_trust,
         .ndo_get_vf_config      = igb_ndo_get_vf_config,
-#ifdef CONFIG_NET_POLL_CONTROLLER
-        .ndo_poll_controller    = igb_netpoll,
-#endif
         .ndo_fix_features       = igb_fix_features,
         .ndo_set_features       = igb_set_features,
         .ndo_fdb_add            = igb_ndo_fdb_add,
@@ -3873,7 +3866,7 @@ static int igb_sw_init(struct igb_adapter *adapter)
 
         adapter->mac_table = kcalloc(hw->mac.rar_entry_count,
                                      sizeof(struct igb_mac_addr),
-                                     GFP_ATOMIC);
+                                     GFP_KERNEL);
         if (!adapter->mac_table)
                 return -ENOMEM;
 
@@ -3883,7 +3876,7 @@ static int igb_sw_init(struct igb_adapter *adapter)
 
         /* Setup and initialize a copy of the hw vlan table array */
         adapter->shadow_vfta = kcalloc(E1000_VLAN_FILTER_TBL_SIZE, sizeof(u32),
-                                       GFP_ATOMIC);
+                                       GFP_KERNEL);
         if (!adapter->shadow_vfta)
                 return -ENOMEM;
 
@@ -5816,7 +5809,8 @@ static void igb_tx_csum(struct igb_ring *tx_ring, struct igb_tx_buffer *first)
 
         if (skb->ip_summed != CHECKSUM_PARTIAL) {
 csum_failed:
-                if (!(first->tx_flags & IGB_TX_FLAGS_VLAN))
+                if (!(first->tx_flags & IGB_TX_FLAGS_VLAN) &&
+                    !tx_ring->launchtime_enable)
                         return;
                 goto no_csum;
         }
@@ -9052,29 +9046,6 @@ static int igb_pci_sriov_configure(struct pci_dev *dev, int num_vfs)
         return 0;
 }
 
-#ifdef CONFIG_NET_POLL_CONTROLLER
-/* Polling 'interrupt' - used by things like netconsole to send skbs
- * without having to re-enable interrupts. It's not called while
- * the interrupt routine is executing.
- */
-static void igb_netpoll(struct net_device *netdev)
-{
-        struct igb_adapter *adapter = netdev_priv(netdev);
-        struct e1000_hw *hw = &adapter->hw;
-        struct igb_q_vector *q_vector;
-        int i;
-
-        for (i = 0; i < adapter->num_q_vectors; i++) {
-                q_vector = adapter->q_vector[i];
-                if (adapter->flags & IGB_FLAG_HAS_MSIX)
-                        wr32(E1000_EIMC, q_vector->eims_value);
-                else
-                        igb_irq_disable(adapter);
-                napi_schedule(&q_vector->napi);
-        }
-}
-#endif /* CONFIG_NET_POLL_CONTROLLER */
-
 /**
  *  igb_io_error_detected - called when PCI error is detected
  *  @pdev: Pointer to PCI device
diff --git a/drivers/net/ethernet/intel/ixgb/ixgb_main.c b/drivers/net/ethernet/intel/ixgb/ixgb_main.c
index 43664adf7a3c..7722153c4ac2 100644
--- a/drivers/net/ethernet/intel/ixgb/ixgb_main.c
+++ b/drivers/net/ethernet/intel/ixgb/ixgb_main.c
@@ -81,11 +81,6 @@ static int ixgb_vlan_rx_kill_vid(struct net_device *netdev,
                                  __be16 proto, u16 vid);
 static void ixgb_restore_vlan(struct ixgb_adapter *adapter);
 
-#ifdef CONFIG_NET_POLL_CONTROLLER
-/* for netdump / net console */
-static void ixgb_netpoll(struct net_device *dev);
-#endif
-
 static pci_ers_result_t ixgb_io_error_detected (struct pci_dev *pdev,
                              enum pci_channel_state state);
 static pci_ers_result_t ixgb_io_slot_reset (struct pci_dev *pdev);
@@ -348,9 +343,6 @@ static const struct net_device_ops ixgb_netdev_ops = {
         .ndo_tx_timeout         = ixgb_tx_timeout,
         .ndo_vlan_rx_add_vid    = ixgb_vlan_rx_add_vid,
         .ndo_vlan_rx_kill_vid   = ixgb_vlan_rx_kill_vid,
-#ifdef CONFIG_NET_POLL_CONTROLLER
-        .ndo_poll_controller    = ixgb_netpoll,
-#endif
         .ndo_fix_features       = ixgb_fix_features,
         .ndo_set_features       = ixgb_set_features,
 };
@@ -771,14 +763,13 @@ ixgb_setup_rx_resources(struct ixgb_adapter *adapter)
         rxdr->size = rxdr->count * sizeof(struct ixgb_rx_desc);
         rxdr->size = ALIGN(rxdr->size, 4096);
 
-        rxdr->desc = dma_alloc_coherent(&pdev->dev, rxdr->size, &rxdr->dma,
-                                        GFP_KERNEL);
+        rxdr->desc = dma_zalloc_coherent(&pdev->dev, rxdr->size, &rxdr->dma,
+                                         GFP_KERNEL);
 
         if (!rxdr->desc) {
                 vfree(rxdr->buffer_info);
                 return -ENOMEM;
         }
-        memset(rxdr->desc, 0, rxdr->size);
 
         rxdr->next_to_clean = 0;
         rxdr->next_to_use = 0;
@@ -2196,23 +2187,6 @@ ixgb_restore_vlan(struct ixgb_adapter *adapter)
                 ixgb_vlan_rx_add_vid(adapter->netdev, htons(ETH_P_8021Q), vid);
 }
 
-#ifdef CONFIG_NET_POLL_CONTROLLER
-/*
- * Polling 'interrupt' - used by things like netconsole to send skbs
- * without having to re-enable interrupts. It's not called while
- * the interrupt routine is executing.
- */
-
-static void ixgb_netpoll(struct net_device *dev)
-{
-        struct ixgb_adapter *adapter = netdev_priv(dev);
-
-        disable_irq(adapter->pdev->irq);
-        ixgb_intr(adapter->pdev->irq, dev);
-        enable_irq(adapter->pdev->irq);
-}
-#endif
-
 /**
  * ixgb_io_error_detected - called when PCI error is detected
  * @pdev:    pointer to pci device with error
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_fcoe.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_fcoe.c
index 94b3165ff543..ccd852ad62a4 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_fcoe.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_fcoe.c
@@ -192,7 +192,7 @@ static int ixgbe_fcoe_ddp_setup(struct net_device *netdev, u16 xid,
         }
 
         /* alloc the udl from per cpu ddp pool */
-        ddp->udl = dma_pool_alloc(ddp_pool->pool, GFP_ATOMIC, &ddp->udp);
+        ddp->udl = dma_pool_alloc(ddp_pool->pool, GFP_KERNEL, &ddp->udp);
         if (!ddp->udl) {
                 e_err(drv, "failed allocated ddp context\n");
                 goto out_noddp_unmap;
@@ -760,7 +760,7 @@ int ixgbe_setup_fcoe_ddp_resources(struct ixgbe_adapter *adapter)
                 return 0;
 
         /* Extra buffer to be shared by all DDPs for HW work around */
-        buffer = kmalloc(IXGBE_FCBUFF_MIN, GFP_ATOMIC);
+        buffer = kmalloc(IXGBE_FCBUFF_MIN, GFP_KERNEL);
         if (!buffer)
                 return -ENOMEM;
 
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index 447098005490..f27d73a7bf16 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -6201,7 +6201,7 @@ static int ixgbe_sw_init(struct ixgbe_adapter *adapter,
 
         adapter->mac_table = kcalloc(hw->mac.num_rar_entries,
                                      sizeof(struct ixgbe_mac_addr),
-                                     GFP_ATOMIC);
+                                     GFP_KERNEL);
         if (!adapter->mac_table)
                 return -ENOMEM;
 
@@ -6620,8 +6620,18 @@ static int ixgbe_change_mtu(struct net_device *netdev, int new_mtu)
         struct ixgbe_adapter *adapter = netdev_priv(netdev);
 
         if (adapter->xdp_prog) {
-                e_warn(probe, "MTU cannot be changed while XDP program is loaded\n");
-                return -EPERM;
+                int new_frame_size = new_mtu + ETH_HLEN + ETH_FCS_LEN +
+                                     VLAN_HLEN;
+                int i;
+
+                for (i = 0; i < adapter->num_rx_queues; i++) {
+                        struct ixgbe_ring *ring = adapter->rx_ring[i];
+
+                        if (new_frame_size > ixgbe_rx_bufsz(ring)) {
+                                e_warn(probe, "Requested MTU size is not supported with XDP\n");
+                                return -EINVAL;
+                        }
+                }
         }
 
         /*
@@ -8758,28 +8768,6 @@ static int ixgbe_del_sanmac_netdev(struct net_device *dev)
         return err;
 }
 
-#ifdef CONFIG_NET_POLL_CONTROLLER
-/*
- * Polling 'interrupt' - used by things like netconsole to send skbs
- * without having to re-enable interrupts. It's not called while
- * the interrupt routine is executing.
- */
-static void ixgbe_netpoll(struct net_device *netdev)
-{
-        struct ixgbe_adapter *adapter = netdev_priv(netdev);
-        int i;
-
-        /* if interface is down do nothing */
-        if (test_bit(__IXGBE_DOWN, &adapter->state))
-                return;
-
-        /* loop through and schedule all active queues */
-        for (i = 0; i < adapter->num_q_vectors; i++)
-                ixgbe_msix_clean_rings(0, adapter->q_vector[i]);
-}
-
-#endif
-
 static void ixgbe_get_ring_stats64(struct rtnl_link_stats64 *stats,
                                    struct ixgbe_ring *ring)
 {
@@ -8983,6 +8971,15 @@ int ixgbe_setup_tc(struct net_device *dev, u8 tc)
 
 #ifdef CONFIG_IXGBE_DCB
         if (tc) {
+                if (adapter->xdp_prog) {
+                        e_warn(probe, "DCB is not supported with XDP\n");
+
+                        ixgbe_init_interrupt_scheme(adapter);
+                        if (netif_running(dev))
+                                ixgbe_open(dev);
+                        return -EINVAL;
+                }
+
                 netdev_set_num_tc(dev, tc);
                 ixgbe_set_prio_tc_map(adapter);
 
@@ -9171,14 +9168,12 @@ static int parse_tc_actions(struct ixgbe_adapter *adapter,
                             struct tcf_exts *exts, u64 *action, u8 *queue)
 {
         const struct tc_action *a;
-        LIST_HEAD(actions);
+        int i;
 
         if (!tcf_exts_has_actions(exts))
                 return -EINVAL;
 
-        tcf_exts_to_list(exts, &actions);
-        list_for_each_entry(a, &actions, list) {
-
+        tcf_exts_for_each_action(i, a, exts) {
                 /* Drop action */
                 if (is_tcf_gact_shot(a)) {
                         *action = IXGBE_FDIR_DROP_QUEUE;
@@ -9936,6 +9931,11 @@ static void *ixgbe_fwd_add(struct net_device *pdev, struct net_device *vdev)
         int tcs = adapter->hw_tcs ? : 1;
         int pool, err;
 
+        if (adapter->xdp_prog) {
+                e_warn(probe, "L2FW offload is not supported with XDP\n");
+                return ERR_PTR(-EINVAL);
+        }
+
         /* The hardware supported by ixgbe only filters on the destination MAC
          * address. In order to avoid issues we only support offloading modes
          * where the hardware can actually provide the functionality.
@@ -10229,9 +10229,6 @@ static const struct net_device_ops ixgbe_netdev_ops = {
         .ndo_get_vf_config      = ixgbe_ndo_get_vf_config,
         .ndo_get_stats64        = ixgbe_get_stats64,
         .ndo_setup_tc           = __ixgbe_setup_tc,
-#ifdef CONFIG_NET_POLL_CONTROLLER
-        .ndo_poll_controller    = ixgbe_netpoll,
-#endif
 #ifdef IXGBE_FCOE
         .ndo_select_queue       = ixgbe_select_queue,
         .ndo_fcoe_ddp_setup = ixgbe_fcoe_ddp_get,
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c
index 6f59933cdff7..3c6f01c41b78 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c
@@ -53,6 +53,11 @@ static int __ixgbe_enable_sriov(struct ixgbe_adapter *adapter,
         struct ixgbe_hw *hw = &adapter->hw;
         int i;
 
+        if (adapter->xdp_prog) {
+                e_warn(probe, "SRIOV is not supported with XDP\n");
+                return -EINVAL;
+        }
+
         /* Enable VMDq flag so device will be set in VM mode */
         adapter->flags |= IXGBE_FLAG_SRIOV_ENABLED |
                           IXGBE_FLAG_VMDQ_ENABLED;
@@ -688,8 +693,13 @@ static int ixgbe_set_vf_macvlan(struct ixgbe_adapter *adapter,
 static inline void ixgbe_vf_reset_event(struct ixgbe_adapter *adapter, u32 vf)
 {
         struct ixgbe_hw *hw = &adapter->hw;
+        struct ixgbe_ring_feature *vmdq = &adapter->ring_feature[RING_F_VMDQ];
         struct vf_data_storage *vfinfo = &adapter->vfinfo[vf];
+        u32 q_per_pool = __ALIGN_MASK(1, ~vmdq->mask);
         u8 num_tcs = adapter->hw_tcs;
+        u32 reg_val;
+        u32 queue;
+        u32 word;
 
         /* remove VLAN filters beloning to this VF */
         ixgbe_clear_vf_vlans(adapter, vf);
@@ -726,6 +736,27 @@ static inline void ixgbe_vf_reset_event(struct ixgbe_adapter *adapter, u32 vf)
 
         /* reset VF api back to unknown */
         adapter->vfinfo[vf].vf_api = ixgbe_mbox_api_10;
+
+        /* Restart each queue for given VF */
+        for (queue = 0; queue < q_per_pool; queue++) {
+                unsigned int reg_idx = (vf * q_per_pool) + queue;
+
+                reg_val = IXGBE_READ_REG(hw, IXGBE_PVFTXDCTL(reg_idx));
+
+                /* Re-enabling only configured queues */
+                if (reg_val) {
+                        reg_val |= IXGBE_TXDCTL_ENABLE;
+                        IXGBE_WRITE_REG(hw, IXGBE_PVFTXDCTL(reg_idx), reg_val);
+                        reg_val &= ~IXGBE_TXDCTL_ENABLE;
+                        IXGBE_WRITE_REG(hw, IXGBE_PVFTXDCTL(reg_idx), reg_val);
+                }
+        }
+
+        /* Clear VF's mailbox memory */
+        for (word = 0; word < IXGBE_VFMAILBOX_SIZE; word++)
+                IXGBE_WRITE_REG_ARRAY(hw, IXGBE_PFMBMEM(vf), word, 0);
+
+        IXGBE_WRITE_FLUSH(hw);
 }
 
 static int ixgbe_set_vf_mac(struct ixgbe_adapter *adapter,
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h b/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h
index 44cfb2021145..41bcbb337e83 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h
@@ -2518,6 +2518,7 @@ enum {
 /* Translated register #defines */
 #define IXGBE_PVFTDH(P)         (0x06010 + (0x40 * (P)))
 #define IXGBE_PVFTDT(P)         (0x06018 + (0x40 * (P)))
+#define IXGBE_PVFTXDCTL(P)      (0x06028 + (0x40 * (P)))
 #define IXGBE_PVFTDWBAL(P)      (0x06038 + (0x40 * (P)))
 #define IXGBE_PVFTDWBAH(P)      (0x0603C + (0x40 * (P)))
 
diff --git a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
index d86446d202d5..5a228582423b 100644
--- a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
+++ b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
@@ -4233,24 +4233,6 @@ static int ixgbevf_change_mtu(struct net_device *netdev, int new_mtu)
         return 0;
 }
 
-#ifdef CONFIG_NET_POLL_CONTROLLER
-/* Polling 'interrupt' - used by things like netconsole to send skbs
- * without having to re-enable interrupts. It's not called while
- * the interrupt routine is executing.
- */
-static void ixgbevf_netpoll(struct net_device *netdev)
-{
-        struct ixgbevf_adapter *adapter = netdev_priv(netdev);
-        int i;
-
-        /* if interface is down do nothing */
-        if (test_bit(__IXGBEVF_DOWN, &adapter->state))
-                return;
-        for (i = 0; i < adapter->num_rx_queues; i++)
-                ixgbevf_msix_clean_rings(0, adapter->q_vector[i]);
-}
-#endif /* CONFIG_NET_POLL_CONTROLLER */
-
 static int ixgbevf_suspend(struct pci_dev *pdev, pm_message_t state)
 {
         struct net_device *netdev = pci_get_drvdata(pdev);
@@ -4482,9 +4464,6 @@ static const struct net_device_ops ixgbevf_netdev_ops = {
         .ndo_tx_timeout         = ixgbevf_tx_timeout,
         .ndo_vlan_rx_add_vid    = ixgbevf_vlan_rx_add_vid,
         .ndo_vlan_rx_kill_vid   = ixgbevf_vlan_rx_kill_vid,
-#ifdef CONFIG_NET_POLL_CONTROLLER
-        .ndo_poll_controller    = ixgbevf_netpoll,
-#endif
         .ndo_features_check     = ixgbevf_features_check,
         .ndo_bpf                = ixgbevf_xdp,
 };
diff --git a/drivers/net/ethernet/lantiq_etop.c b/drivers/net/ethernet/lantiq_etop.c
index 7a637b51c7d2..e08301d833e2 100644
--- a/drivers/net/ethernet/lantiq_etop.c
+++ b/drivers/net/ethernet/lantiq_etop.c
@@ -274,6 +274,7 @@ ltq_etop_hw_init(struct net_device *dev)
                 struct ltq_etop_chan *ch = &priv->ch[i];
 
                 ch->idx = ch->dma.nr = i;
+                ch->dma.dev = &priv->pdev->dev;
 
                 if (IS_TX(i)) {
                         ltq_dma_alloc_tx(&ch->dma);
diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
index bc80a678abc3..b4ed7d394d07 100644
--- a/drivers/net/ethernet/marvell/mvneta.c
+++ b/drivers/net/ethernet/marvell/mvneta.c
@@ -1890,8 +1890,8 @@ static void mvneta_rxq_drop_pkts(struct mvneta_port *pp,
                 if (!data || !(rx_desc->buf_phys_addr))
                         continue;
 
-                dma_unmap_single(pp->dev->dev.parent, rx_desc->buf_phys_addr,
-                                 MVNETA_RX_BUF_SIZE(pp->pkt_size), DMA_FROM_DEVICE);
+                dma_unmap_page(pp->dev->dev.parent, rx_desc->buf_phys_addr,
+                               PAGE_SIZE, DMA_FROM_DEVICE);
                 __free_page(data);
         }
 }
@@ -2008,8 +2008,8 @@ static int mvneta_rx_swbm(struct napi_struct *napi,
                                 skb_add_rx_frag(rxq->skb, frag_num, page,
                                                 frag_offset, frag_size,
                                                 PAGE_SIZE);
-                                dma_unmap_single(dev->dev.parent, phys_addr,
-                                                 PAGE_SIZE, DMA_FROM_DEVICE);
+                                dma_unmap_page(dev->dev.parent, phys_addr,
+                                               PAGE_SIZE, DMA_FROM_DEVICE);
                                 rxq->left_size -= frag_size;
                         }
                 } else {
@@ -2039,9 +2039,8 @@ static int mvneta_rx_swbm(struct napi_struct *napi,
                                                 frag_offset, frag_size,
                                                 PAGE_SIZE);
 
-                                dma_unmap_single(dev->dev.parent, phys_addr,
-                                                 PAGE_SIZE,
-                                                 DMA_FROM_DEVICE);
+                                dma_unmap_page(dev->dev.parent, phys_addr,
+                                               PAGE_SIZE, DMA_FROM_DEVICE);
 
                                 rxq->left_size -= frag_size;
                         }
diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
index 32d785b616e1..38cc01beea79 100644
--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
@@ -58,6 +58,8 @@ static struct {
  */
 static void mvpp2_mac_config(struct net_device *dev, unsigned int mode,
                              const struct phylink_link_state *state);
+static void mvpp2_mac_link_up(struct net_device *dev, unsigned int mode,
+                              phy_interface_t interface, struct phy_device *phy);
 
 /* Queue modes */
 #define MVPP2_QDIST_SINGLE_MODE 0
@@ -3053,10 +3055,12 @@ static int mvpp2_poll(struct napi_struct *napi, int budget)
                                    cause_rx_tx & ~MVPP2_CAUSE_MISC_SUM_MASK);
         }
 
-        cause_tx = cause_rx_tx & MVPP2_CAUSE_TXQ_OCCUP_DESC_ALL_MASK;
-        if (cause_tx) {
-                cause_tx >>= MVPP2_CAUSE_TXQ_OCCUP_DESC_ALL_OFFSET;
-                mvpp2_tx_done(port, cause_tx, qv->sw_thread_id);
+        if (port->has_tx_irqs) {
+                cause_tx = cause_rx_tx & MVPP2_CAUSE_TXQ_OCCUP_DESC_ALL_MASK;
+                if (cause_tx) {
+                        cause_tx >>= MVPP2_CAUSE_TXQ_OCCUP_DESC_ALL_OFFSET;
+                        mvpp2_tx_done(port, cause_tx, qv->sw_thread_id);
+                }
         }
 
         /* Process RX packets */
@@ -3142,6 +3146,7 @@ static void mvpp2_start_dev(struct mvpp2_port *port)
                 mvpp22_mode_reconfigure(port);
 
         if (port->phylink) {
+                netif_carrier_off(port->dev);
                 phylink_start(port->phylink);
         } else {
                 /* Phylink isn't used as of now for ACPI, so the MAC has to be
@@ -3150,9 +3155,10 @@ static void mvpp2_start_dev(struct mvpp2_port *port)
                  */
                 struct phylink_link_state state = {
                         .interface = port->phy_interface,
-                        .link = 1,
                 };
                 mvpp2_mac_config(port->dev, MLO_AN_INBAND, &state);
+                mvpp2_mac_link_up(port->dev, MLO_AN_INBAND, port->phy_interface,
+                                  NULL);
         }
 
         netif_tx_start_all_queues(port->dev);
@@ -4495,10 +4501,6 @@ static void mvpp2_mac_config(struct net_device *dev, unsigned int mode,
                 return;
         }
 
-        netif_tx_stop_all_queues(port->dev);
-        if (!port->has_phy)
-                netif_carrier_off(port->dev);
-
         /* Make sure the port is disabled when reconfiguring the mode */
         mvpp2_port_disable(port);
 
@@ -4523,16 +4525,7 @@ static void mvpp2_mac_config(struct net_device *dev, unsigned int mode,
         if (port->priv->hw_version == MVPP21 && port->flags & MVPP2_F_LOOPBACK)
                 mvpp2_port_loopback_set(port, state);
 
-        /* If the port already was up, make sure it's still in the same state */
-        if (state->link || !port->has_phy) {
-                mvpp2_port_enable(port);
-
-                mvpp2_egress_enable(port);
-                mvpp2_ingress_enable(port);
-                if (!port->has_phy)
-                        netif_carrier_on(dev);
-                netif_tx_wake_all_queues(dev);
-        }
+        mvpp2_port_enable(port);
 }
 
 static void mvpp2_mac_link_up(struct net_device *dev, unsigned int mode,
@@ -4803,6 +4796,7 @@ static int mvpp2_port_probe(struct platform_device *pdev,
         dev->min_mtu = ETH_MIN_MTU;
         /* 9704 == 9728 - 20 and rounding to 8 */
         dev->max_mtu = MVPP2_BM_JUMBO_PKT_SIZE;
+        dev->dev.of_node = port_node;
 
         /* Phylink isn't used w/ ACPI as of now */
         if (port_node) {
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
index 6785661d1a72..fe49384eba48 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
@@ -1286,20 +1286,6 @@ out:
         mutex_unlock(&mdev->state_lock);
 }
 
-#ifdef CONFIG_NET_POLL_CONTROLLER
-static void mlx4_en_netpoll(struct net_device *dev)
-{
-        struct mlx4_en_priv *priv = netdev_priv(dev);
-        struct mlx4_en_cq *cq;
-        int i;
-
-        for (i = 0; i < priv->tx_ring_num[TX]; i++) {
-                cq = priv->tx_cq[TX][i];
-                napi_schedule(&cq->napi);
-        }
-}
-#endif
-
 static int mlx4_en_set_rss_steer_rules(struct mlx4_en_priv *priv)
 {
         u64 reg_id;
@@ -2946,9 +2932,6 @@ static const struct net_device_ops mlx4_netdev_ops = {
         .ndo_tx_timeout         = mlx4_en_tx_timeout,
         .ndo_vlan_rx_add_vid    = mlx4_en_vlan_rx_add_vid,
         .ndo_vlan_rx_kill_vid   = mlx4_en_vlan_rx_kill_vid,
-#ifdef CONFIG_NET_POLL_CONTROLLER
-        .ndo_poll_controller    = mlx4_en_netpoll,
-#endif
         .ndo_set_features       = mlx4_en_set_features,
         .ndo_fix_features       = mlx4_en_fix_features,
         .ndo_setup_tc           = __mlx4_en_setup_tc,
@@ -2983,9 +2966,6 @@ static const struct net_device_ops mlx4_netdev_ops_master = {
         .ndo_set_vf_link_state  = mlx4_en_set_vf_link_state,
         .ndo_get_vf_stats       = mlx4_en_get_vf_stats,
         .ndo_get_vf_config      = mlx4_en_get_vf_config,
-#ifdef CONFIG_NET_POLL_CONTROLLER
-        .ndo_poll_controller    = mlx4_en_netpoll,
-#endif
         .ndo_set_features       = mlx4_en_set_features,
         .ndo_fix_features       = mlx4_en_fix_features,
         .ndo_setup_tc           = __mlx4_en_setup_tc,
diff --git a/drivers/net/ethernet/mellanox/mlx4/eq.c b/drivers/net/ethernet/mellanox/mlx4/eq.c
index 1f3372c1802e..2df92dbd38e1 100644
--- a/drivers/net/ethernet/mellanox/mlx4/eq.c
+++ b/drivers/net/ethernet/mellanox/mlx4/eq.c
@@ -240,7 +240,8 @@ static void mlx4_set_eq_affinity_hint(struct mlx4_priv *priv, int vec)
         struct mlx4_dev *dev = &priv->dev;
         struct mlx4_eq *eq = &priv->eq_table.eq[vec];
 
-        if (!eq->affinity_mask || cpumask_empty(eq->affinity_mask))
+        if (!cpumask_available(eq->affinity_mask) ||
+            cpumask_empty(eq->affinity_mask))
                 return;
 
         hint_err = irq_set_affinity_hint(eq->irq, eq->affinity_mask);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
index 3ce14d42ddc8..a53736c26c0c 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
@@ -206,7 +206,7 @@ static void poll_timeout(struct mlx5_cmd_work_ent *ent)
         u8 own;
 
         do {
-                own = ent->lay->status_own;
+                own = READ_ONCE(ent->lay->status_own);
                 if (!(own & CMD_OWNER_HW)) {
                         ent->ret = 0;
                         return;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/dev.c b/drivers/net/ethernet/mellanox/mlx5/core/dev.c
index b994b80d5714..37ba7c78859d 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/dev.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/dev.c
@@ -132,11 +132,11 @@ void mlx5_add_device(struct mlx5_interface *intf, struct mlx5_priv *priv)
         delayed_event_start(priv);
 
         dev_ctx->context = intf->add(dev);
-        set_bit(MLX5_INTERFACE_ADDED, &dev_ctx->state);
-        if (intf->attach)
-                set_bit(MLX5_INTERFACE_ATTACHED, &dev_ctx->state);
-
         if (dev_ctx->context) {
+                set_bit(MLX5_INTERFACE_ADDED, &dev_ctx->state);
+                if (intf->attach)
+                        set_bit(MLX5_INTERFACE_ATTACHED, &dev_ctx->state);
+
                 spin_lock_irq(&priv->ctx_lock);
                 list_add_tail(&dev_ctx->list, &priv->ctx_list);
 
@@ -211,12 +211,17 @@ static void mlx5_attach_interface(struct mlx5_interface *intf, struct mlx5_priv
         if (intf->attach) {
                 if (test_bit(MLX5_INTERFACE_ATTACHED, &dev_ctx->state))
                         goto out;
-                intf->attach(dev, dev_ctx->context);
+                if (intf->attach(dev, dev_ctx->context))
+                        goto out;
+
                 set_bit(MLX5_INTERFACE_ATTACHED, &dev_ctx->state);
         } else {
                 if (test_bit(MLX5_INTERFACE_ADDED, &dev_ctx->state))
                         goto out;
                 dev_ctx->context = intf->add(dev);
+                if (!dev_ctx->context)
+                        goto out;
+
                 set_bit(MLX5_INTERFACE_ADDED, &dev_ctx->state);
         }
 
@@ -391,16 +396,17 @@ void mlx5_remove_dev_by_protocol(struct mlx5_core_dev *dev, int protocol)
                 }
 }
 
-static u16 mlx5_gen_pci_id(struct mlx5_core_dev *dev)
+static u32 mlx5_gen_pci_id(struct mlx5_core_dev *dev)
 {
-        return (u16)((dev->pdev->bus->number << 8) |
+        return (u32)((pci_domain_nr(dev->pdev->bus) << 16) |
+                     (dev->pdev->bus->number << 8) |
                      PCI_SLOT(dev->pdev->devfn));
 }
 
 /* Must be called with intf_mutex held */
 struct mlx5_core_dev *mlx5_get_next_phys_dev(struct mlx5_core_dev *dev)
 {
-        u16 pci_id = mlx5_gen_pci_id(dev);
+        u32 pci_id = mlx5_gen_pci_id(dev);
         struct mlx5_core_dev *res = NULL;
         struct mlx5_core_dev *tmp_dev;
         struct mlx5_priv *priv;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/tls.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/tls.c
index eddd7702680b..e88340e196f7 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/tls.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/tls.c
@@ -183,12 +183,13 @@ static const struct tlsdev_ops mlx5e_tls_ops = {
 
 void mlx5e_tls_build_netdev(struct mlx5e_priv *priv)
 {
-        u32 caps = mlx5_accel_tls_device_caps(priv->mdev);
         struct net_device *netdev = priv->netdev;
+        u32 caps;
 
         if (!mlx5_accel_is_tls_device(priv->mdev))
                 return;
 
+        caps = mlx5_accel_tls_device_caps(priv->mdev);
         if (caps & MLX5_ACCEL_TLS_TX) {
                 netdev->features          |= NETIF_F_HW_TLS_TX;
                 netdev->hw_features       |= NETIF_F_HW_TLS_TX;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_fs_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_fs_ethtool.c
index 75bb981e00b7..41cde926cdab 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_fs_ethtool.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_fs_ethtool.c
@@ -191,7 +191,7 @@ set_udp(void *headers_c, void *headers_v, __be16 psrc_m, __be16 psrc_v,
 {
         if (psrc_m) {
                 MLX5E_FTE_SET(headers_c, udp_sport, 0xffff);
-                MLX5E_FTE_SET(headers_c, udp_sport, ntohs(psrc_v));
+                MLX5E_FTE_SET(headers_v, udp_sport, ntohs(psrc_v));
         }
 
         if (pdst_m) {
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index 5a7939e70190..54118b77dc1f 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -4315,22 +4315,6 @@ static int mlx5e_xdp(struct net_device *dev, struct netdev_bpf *xdp)
         }
 }
 
-#ifdef CONFIG_NET_POLL_CONTROLLER
-/* Fake "interrupt" called by netpoll (eg netconsole) to send skbs without
- * reenabling interrupts.
- */
-static void mlx5e_netpoll(struct net_device *dev)
-{
-        struct mlx5e_priv *priv = netdev_priv(dev);
-        struct mlx5e_channels *chs = &priv->channels;
-
-        int i;
-
-        for (i = 0; i < chs->num; i++)
-                napi_schedule(&chs->c[i]->napi);
-}
-#endif
-
 static const struct net_device_ops mlx5e_netdev_ops = {
         .ndo_open                = mlx5e_open,
         .ndo_stop                = mlx5e_close,
@@ -4356,9 +4340,6 @@ static const struct net_device_ops mlx5e_netdev_ops = {
 #ifdef CONFIG_MLX5_EN_ARFS
         .ndo_rx_flow_steer       = mlx5e_rx_flow_steer,
 #endif
-#ifdef CONFIG_NET_POLL_CONTROLLER
-        .ndo_poll_controller     = mlx5e_netpoll,
-#endif
 #ifdef CONFIG_MLX5_ESWITCH
         /* SRIOV E-Switch NDOs */
         .ndo_set_vf_mac          = mlx5e_set_vf_mac,
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
index 9131a1376e7d..9fed54017659 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
@@ -1982,14 +1982,15 @@ static bool modify_header_match_supported(struct mlx5_flow_spec *spec,
                 goto out_ok;
 
         modify_ip_header = false;
-        tcf_exts_to_list(exts, &actions);
-        list_for_each_entry(a, &actions, list) {
+        tcf_exts_for_each_action(i, a, exts) {
+                int k;
+
                 if (!is_tcf_pedit(a))
                         continue;
 
                 nkeys = tcf_pedit_nkeys(a);
-                for (i = 0; i < nkeys; i++) {
-                        htype = tcf_pedit_htype(a, i);
+                for (k = 0; k < nkeys; k++) {
+                        htype = tcf_pedit_htype(a, k);
                         if (htype == TCA_PEDIT_KEY_EX_HDR_TYPE_IP4 ||
                             htype == TCA_PEDIT_KEY_EX_HDR_TYPE_IP6) {
                                 modify_ip_header = true;
@@ -2053,15 +2054,14 @@ static int parse_tc_nic_actions(struct mlx5e_priv *priv, struct tcf_exts *exts,
         const struct tc_action *a;
         LIST_HEAD(actions);
         u32 action = 0;
-        int err;
+        int err, i;
 
         if (!tcf_exts_has_actions(exts))
                 return -EINVAL;
 
         attr->flow_tag = MLX5_FS_DEFAULT_FLOW_TAG;
 
-        tcf_exts_to_list(exts, &actions);
-        list_for_each_entry(a, &actions, list) {
+        tcf_exts_for_each_action(i, a, exts) {
                 if (is_tcf_gact_shot(a)) {
                         action |= MLX5_FLOW_CONTEXT_ACTION_DROP;
                         if (MLX5_CAP_FLOWTABLE(priv->mdev,
@@ -2666,7 +2666,7 @@ static int parse_tc_fdb_actions(struct mlx5e_priv *priv, struct tcf_exts *exts,
         LIST_HEAD(actions);
         bool encap = false;
         u32 action = 0;
-        int err;
+        int err, i;
 
         if (!tcf_exts_has_actions(exts))
                 return -EINVAL;
@@ -2674,8 +2674,7 @@ static int parse_tc_fdb_actions(struct mlx5e_priv *priv, struct tcf_exts *exts,
         attr->in_rep = rpriv->rep;
         attr->in_mdev = priv->mdev;
 
-        tcf_exts_to_list(exts, &actions);
-        list_for_each_entry(a, &actions, list) {
+        tcf_exts_for_each_action(i, a, exts) {
                 if (is_tcf_gact_shot(a)) {
                         action |= MLX5_FLOW_CONTEXT_ACTION_DROP |
                                   MLX5_FLOW_CONTEXT_ACTION_COUNT;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
index f72b5c9dcfe9..3028e8d90920 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
@@ -663,6 +663,7 @@ static int esw_create_offloads_fdb_tables(struct mlx5_eswitch *esw, int nvports)
         if (err)
                 goto miss_rule_err;
 
+        kvfree(flow_group_in);
         return 0;
 
 miss_rule_err:
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
index f418541af7cf..37d114c668b7 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
@@ -1578,6 +1578,33 @@ static u64 matched_fgs_get_version(struct list_head *match_head)
         return version;
 }
 
+static struct fs_fte *
+lookup_fte_locked(struct mlx5_flow_group *g,
+                  u32 *match_value,
+                  bool take_write)
+{
+        struct fs_fte *fte_tmp;
+
+        if (take_write)
+                nested_down_write_ref_node(&g->node, FS_LOCK_PARENT);
+        else
+                nested_down_read_ref_node(&g->node, FS_LOCK_PARENT);
+        fte_tmp = rhashtable_lookup_fast(&g->ftes_hash, match_value,
+                                         rhash_fte);
+        if (!fte_tmp || !tree_get_node(&fte_tmp->node)) {
+                fte_tmp = NULL;
+                goto out;
+        }
+
+        nested_down_write_ref_node(&fte_tmp->node, FS_LOCK_CHILD);
+out:
+        if (take_write)
+                up_write_ref_node(&g->node);
+        else
+                up_read_ref_node(&g->node);
+        return fte_tmp;
+}
+
 static struct mlx5_flow_handle *
 try_add_to_existing_fg(struct mlx5_flow_table *ft,
                        struct list_head *match_head,
@@ -1600,10 +1627,6 @@ try_add_to_existing_fg(struct mlx5_flow_table *ft,
         if (IS_ERR(fte))
                 return  ERR_PTR(-ENOMEM);
 
-        list_for_each_entry(iter, match_head, list) {
-                nested_down_read_ref_node(&iter->g->node, FS_LOCK_PARENT);
-        }
-
 search_again_locked:
         version = matched_fgs_get_version(match_head);
         /* Try to find a fg that already contains a matching fte */
@@ -1611,20 +1634,9 @@ search_again_locked:
                 struct fs_fte *fte_tmp;
 
                 g = iter->g;
-                fte_tmp = rhashtable_lookup_fast(&g->ftes_hash, spec->match_value,
-                                                 rhash_fte);
-                if (!fte_tmp || !tree_get_node(&fte_tmp->node))
+                fte_tmp = lookup_fte_locked(g, spec->match_value, take_write);
+                if (!fte_tmp)
                         continue;
-
-                nested_down_write_ref_node(&fte_tmp->node, FS_LOCK_CHILD);
-                if (!take_write) {
-                        list_for_each_entry(iter, match_head, list)
-                                up_read_ref_node(&iter->g->node);
-                } else {
-                        list_for_each_entry(iter, match_head, list)
-                                up_write_ref_node(&iter->g->node);
-                }
-
                 rule = add_rule_fg(g, spec->match_value,
                                    flow_act, dest, dest_num, fte_tmp);
                 up_write_ref_node(&fte_tmp->node);
@@ -1633,19 +1645,6 @@ search_again_locked:
                 return rule;
         }
 
-        /* No group with matching fte found. Try to add a new fte to any
-         * matching fg.
-         */
-
-        if (!take_write) {
-                list_for_each_entry(iter, match_head, list)
-                        up_read_ref_node(&iter->g->node);
-                list_for_each_entry(iter, match_head, list)
-                        nested_down_write_ref_node(&iter->g->node,
-                                                   FS_LOCK_PARENT);
-                take_write = true;
-        }
-
         /* Check the ft version, for case that new flow group
          * was added while the fgs weren't locked
          */
@@ -1657,27 +1656,30 @@ search_again_locked:
         /* Check the fgs version, for case the new FTE with the
          * same values was added while the fgs weren't locked
          */
-        if (version != matched_fgs_get_version(match_head))
+        if (version != matched_fgs_get_version(match_head)) {
+                take_write = true;
                 goto search_again_locked;
+        }
 
         list_for_each_entry(iter, match_head, list) {
                 g = iter->g;
 
                 if (!g->node.active)
                         continue;
+
+                nested_down_write_ref_node(&g->node, FS_LOCK_PARENT);
+
                 err = insert_fte(g, fte);
                 if (err) {
+                        up_write_ref_node(&g->node);
                         if (err == -ENOSPC)
                                 continue;
-                        list_for_each_entry(iter, match_head, list)
-                                up_write_ref_node(&iter->g->node);
                         kmem_cache_free(steering->ftes_cache, fte);
                         return ERR_PTR(err);
                 }
 
                 nested_down_write_ref_node(&fte->node, FS_LOCK_CHILD);
-                list_for_each_entry(iter, match_head, list)
-                        up_write_ref_node(&iter->g->node);
+                up_write_ref_node(&g->node);
                 rule = add_rule_fg(g, spec->match_value,
                                    flow_act, dest, dest_num, fte);
                 up_write_ref_node(&fte->node);
@@ -1686,8 +1688,6 @@ search_again_locked:
         }
         rule = ERR_PTR(-ENOENT);
 out:
-        list_for_each_entry(iter, match_head, list)
-                up_write_ref_node(&iter->g->node);
         kmem_cache_free(steering->ftes_cache, fte);
         return rule;
 }
@@ -1726,6 +1726,8 @@ search_again_locked:
         if (err) {
                 if (take_write)
                         up_write_ref_node(&ft->node);
+                else
+                        up_read_ref_node(&ft->node);
                 return ERR_PTR(err);
         }
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/health.c b/drivers/net/ethernet/mellanox/mlx5/core/health.c
index d39b0b7011b2..9f39aeca863f 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/health.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/health.c
@@ -331,9 +331,17 @@ void mlx5_start_health_poll(struct mlx5_core_dev *dev)
         add_timer(&health->timer);
 }
 
-void mlx5_stop_health_poll(struct mlx5_core_dev *dev)
+void mlx5_stop_health_poll(struct mlx5_core_dev *dev, bool disable_health)
 {
         struct mlx5_core_health *health = &dev->priv.health;
+        unsigned long flags;
+
+        if (disable_health) {
+                spin_lock_irqsave(&health->wq_lock, flags);
+                set_bit(MLX5_DROP_NEW_HEALTH_WORK, &health->flags);
+                set_bit(MLX5_DROP_NEW_RECOVERY_WORK, &health->flags);
+                spin_unlock_irqrestore(&health->wq_lock, flags);
+        }
 
         del_timer_sync(&health->timer);
 }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
index cf3e4a659052..b5e9f664fc66 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
@@ -878,8 +878,10 @@ static int mlx5_pci_init(struct mlx5_core_dev *dev, struct mlx5_priv *priv)
         priv->numa_node = dev_to_node(&dev->pdev->dev);
 
         priv->dbg_root = debugfs_create_dir(dev_name(&pdev->dev), mlx5_debugfs_root);
-        if (!priv->dbg_root)
+        if (!priv->dbg_root) {
+                dev_err(&pdev->dev, "Cannot create debugfs dir, aborting\n");
                 return -ENOMEM;
+        }
 
         err = mlx5_pci_enable_device(dev);
         if (err) {
@@ -928,7 +930,7 @@ static void mlx5_pci_close(struct mlx5_core_dev *dev, struct mlx5_priv *priv)
         pci_clear_master(dev->pdev);
         release_bar(dev->pdev);
         mlx5_pci_disable_device(dev);
-        debugfs_remove(priv->dbg_root);
+        debugfs_remove_recursive(priv->dbg_root);
 }
 
 static int mlx5_init_once(struct mlx5_core_dev *dev, struct mlx5_priv *priv)
@@ -1286,7 +1288,7 @@ err_cleanup_once:
                 mlx5_cleanup_once(dev);
 
 err_stop_poll:
-        mlx5_stop_health_poll(dev);
+        mlx5_stop_health_poll(dev, boot);
         if (mlx5_cmd_teardown_hca(dev)) {
                 dev_err(&dev->pdev->dev, "tear_down_hca failed, skip cleanup\n");
                 goto out_err;
@@ -1346,7 +1348,7 @@ static int mlx5_unload_one(struct mlx5_core_dev *dev, struct mlx5_priv *priv,
         mlx5_free_irq_vectors(dev);
         if (cleanup)
                 mlx5_cleanup_once(dev);
-        mlx5_stop_health_poll(dev);
+        mlx5_stop_health_poll(dev, cleanup);
         err = mlx5_cmd_teardown_hca(dev);
         if (err) {
                 dev_err(&dev->pdev->dev, "tear_down_hca failed, skip cleanup\n");
@@ -1608,7 +1610,7 @@ static int mlx5_try_fast_unload(struct mlx5_core_dev *dev)
          * with the HCA, so the health polll is no longer needed.
          */
         mlx5_drain_health_wq(dev);
-        mlx5_stop_health_poll(dev);
+        mlx5_stop_health_poll(dev, false);
 
         ret = mlx5_cmd_force_teardown_hca(dev);
         if (ret) {
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/transobj.c b/drivers/net/ethernet/mellanox/mlx5/core/transobj.c
index dae1c5c5d27c..d2f76070ea7c 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/transobj.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/transobj.c
@@ -509,7 +509,7 @@ static int mlx5_hairpin_modify_sq(struct mlx5_core_dev *peer_mdev, u32 sqn,
 
         sqc = MLX5_ADDR_OF(modify_sq_in, in, ctx);
 
-        if (next_state == MLX5_RQC_STATE_RDY) {
+        if (next_state == MLX5_SQC_STATE_RDY) {
                 MLX5_SET(sqc, sqc, hairpin_peer_rq, peer_rq);
                 MLX5_SET(sqc, sqc, hairpin_peer_vhca, peer_vhca);
         }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/wq.c b/drivers/net/ethernet/mellanox/mlx5/core/wq.c
index 86478a6b99c5..68e7f8df2a6d 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/wq.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/wq.c
@@ -39,9 +39,9 @@ u32 mlx5_wq_cyc_get_size(struct mlx5_wq_cyc *wq)
         return (u32)wq->fbc.sz_m1 + 1;
 }
 
-u32 mlx5_wq_cyc_get_frag_size(struct mlx5_wq_cyc *wq)
+u16 mlx5_wq_cyc_get_frag_size(struct mlx5_wq_cyc *wq)
 {
-        return (u32)wq->fbc.frag_sz_m1 + 1;
+        return wq->fbc.frag_sz_m1 + 1;
 }
 
 u32 mlx5_cqwq_get_size(struct mlx5_cqwq *wq)
@@ -138,15 +138,16 @@ int mlx5_wq_qp_create(struct mlx5_core_dev *mdev, struct mlx5_wq_param *param,
                       void *qpc, struct mlx5_wq_qp *wq,
                       struct mlx5_wq_ctrl *wq_ctrl)
 {
-        u32 sq_strides_offset;
+        u16 sq_strides_offset;
+        u32 rq_pg_remainder;
         int err;
 
         mlx5_fill_fbc(MLX5_GET(qpc, qpc, log_rq_stride) + 4,
                       MLX5_GET(qpc, qpc, log_rq_size),
                       &wq->rq.fbc);
 
-        sq_strides_offset =
-                ((wq->rq.fbc.frag_sz_m1 + 1) % PAGE_SIZE) / MLX5_SEND_WQE_BB;
+        rq_pg_remainder   = mlx5_wq_cyc_get_byte_size(&wq->rq) % PAGE_SIZE;
+        sq_strides_offset = rq_pg_remainder / MLX5_SEND_WQE_BB;
 
         mlx5_fill_fbc_offset(ilog2(MLX5_SEND_WQE_BB),
                              MLX5_GET(qpc, qpc, log_sq_size),
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/wq.h b/drivers/net/ethernet/mellanox/mlx5/core/wq.h
index 2bd4c3184eba..3a1a170bb2d7 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/wq.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/wq.h
@@ -80,7 +80,7 @@ int mlx5_wq_cyc_create(struct mlx5_core_dev *mdev, struct mlx5_wq_param *param,
                        void *wqc, struct mlx5_wq_cyc *wq,
                        struct mlx5_wq_ctrl *wq_ctrl);
 u32 mlx5_wq_cyc_get_size(struct mlx5_wq_cyc *wq);
-u32 mlx5_wq_cyc_get_frag_size(struct mlx5_wq_cyc *wq);
+u16 mlx5_wq_cyc_get_frag_size(struct mlx5_wq_cyc *wq);
 
 int mlx5_wq_qp_create(struct mlx5_core_dev *mdev, struct mlx5_wq_param *param,
                       void *qpc, struct mlx5_wq_qp *wq,
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
index 6070d1591d1e..b492152c8881 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
@@ -44,8 +44,8 @@
 #define MLXSW_SP_FWREV_MINOR_TO_BRANCH(minor) ((minor) / 100)
 
 #define MLXSW_SP1_FWREV_MAJOR 13
-#define MLXSW_SP1_FWREV_MINOR 1702
-#define MLXSW_SP1_FWREV_SUBMINOR 6
+#define MLXSW_SP1_FWREV_MINOR 1703
+#define MLXSW_SP1_FWREV_SUBMINOR 4
 #define MLXSW_SP1_FWREV_CAN_RESET_MINOR 1702
 
 static const struct mlxsw_fw_rev mlxsw_sp1_fw_rev = {
@@ -1346,8 +1346,7 @@ static int mlxsw_sp_port_add_cls_matchall(struct mlxsw_sp_port *mlxsw_sp_port,
                 return -ENOMEM;
         mall_tc_entry->cookie = f->cookie;
 
-        tcf_exts_to_list(f->exts, &actions);
-        a = list_first_entry(&actions, struct tc_action, list);
+        a = tcf_exts_first_action(f->exts);
 
         if (is_tcf_mirred_egress_mirror(a) && protocol == htons(ETH_P_ALL)) {
                 struct mlxsw_sp_port_mall_mirror_tc_entry *mirror;
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.h b/drivers/net/ethernet/mellanox/mlxsw/spectrum.h
index 3ae930196741..3cdb7aca90b7 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.h
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.h
@@ -414,6 +414,8 @@ mlxsw_sp_netdevice_ipip_ul_event(struct mlxsw_sp *mlxsw_sp,
 void
 mlxsw_sp_port_vlan_router_leave(struct mlxsw_sp_port_vlan *mlxsw_sp_port_vlan);
 void mlxsw_sp_rif_destroy(struct mlxsw_sp_rif *rif);
+void mlxsw_sp_rif_destroy_by_dev(struct mlxsw_sp *mlxsw_sp,
+                                 struct net_device *dev);
 
 /* spectrum_kvdl.c */
 enum mlxsw_sp_kvdl_entry_type {
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c
index 4327487553c5..3589432d1643 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c
@@ -337,14 +337,14 @@ static const struct mlxsw_sp_sb_cm mlxsw_sp_sb_cms_egress[] = {
         MLXSW_SP_SB_CM(1500, 9, 0),
         MLXSW_SP_SB_CM(1500, 9, 0),
         MLXSW_SP_SB_CM(1500, 9, 0),
-        MLXSW_SP_SB_CM(0, 0, 0),
-        MLXSW_SP_SB_CM(0, 0, 0),
-        MLXSW_SP_SB_CM(0, 0, 0),
-        MLXSW_SP_SB_CM(0, 0, 0),
-        MLXSW_SP_SB_CM(0, 0, 0),
-        MLXSW_SP_SB_CM(0, 0, 0),
-        MLXSW_SP_SB_CM(0, 0, 0),
-        MLXSW_SP_SB_CM(0, 0, 0),
+        MLXSW_SP_SB_CM(0, 140000, 15),
+        MLXSW_SP_SB_CM(0, 140000, 15),
+        MLXSW_SP_SB_CM(0, 140000, 15),
+        MLXSW_SP_SB_CM(0, 140000, 15),
+        MLXSW_SP_SB_CM(0, 140000, 15),
+        MLXSW_SP_SB_CM(0, 140000, 15),
+        MLXSW_SP_SB_CM(0, 140000, 15),
+        MLXSW_SP_SB_CM(0, 140000, 15),
         MLXSW_SP_SB_CM(1, 0xff, 0),
 };
 
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c
index ebd1b24ebaa5..8d211972c5e9 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c
@@ -21,8 +21,7 @@ static int mlxsw_sp_flower_parse_actions(struct mlxsw_sp *mlxsw_sp,
                                          struct netlink_ext_ack *extack)
 {
         const struct tc_action *a;
-        LIST_HEAD(actions);
-        int err;
+        int err, i;
 
         if (!tcf_exts_has_actions(exts))
                 return 0;
@@ -32,8 +31,7 @@ static int mlxsw_sp_flower_parse_actions(struct mlxsw_sp *mlxsw_sp,
         if (err)
                 return err;
 
-        tcf_exts_to_list(exts, &actions);
-        list_for_each_entry(a, &actions, list) {
+        tcf_exts_for_each_action(i, a, exts) {
                 if (is_tcf_gact_ok(a)) {
                         err = mlxsw_sp_acl_rulei_act_terminate(rulei);
                         if (err) {
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
index 3a96307f51b0..2ab9cf25a08a 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
@@ -6234,6 +6234,17 @@ void mlxsw_sp_rif_destroy(struct mlxsw_sp_rif *rif)
         mlxsw_sp_vr_put(mlxsw_sp, vr);
 }
 
+void mlxsw_sp_rif_destroy_by_dev(struct mlxsw_sp *mlxsw_sp,
+                                 struct net_device *dev)
+{
+        struct mlxsw_sp_rif *rif;
+
+        rif = mlxsw_sp_rif_find_by_dev(mlxsw_sp, dev);
+        if (!rif)
+                return;
+        mlxsw_sp_rif_destroy(rif);
+}
+
 static void
 mlxsw_sp_rif_subport_params_init(struct mlxsw_sp_rif_params *params,
                                  struct mlxsw_sp_port_vlan *mlxsw_sp_port_vlan)
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
index 0d8444aaba01..db715da7bab7 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
@@ -127,6 +127,24 @@ bool mlxsw_sp_bridge_device_is_offloaded(const struct mlxsw_sp *mlxsw_sp,
         return !!mlxsw_sp_bridge_device_find(mlxsw_sp->bridge, br_dev);
 }
 
+static int mlxsw_sp_bridge_device_upper_rif_destroy(struct net_device *dev,
+                                                    void *data)
+{
+        struct mlxsw_sp *mlxsw_sp = data;
+
+        mlxsw_sp_rif_destroy_by_dev(mlxsw_sp, dev);
+        return 0;
+}
+
+static void mlxsw_sp_bridge_device_rifs_destroy(struct mlxsw_sp *mlxsw_sp,
+                                                struct net_device *dev)
+{
+        mlxsw_sp_rif_destroy_by_dev(mlxsw_sp, dev);
+        netdev_walk_all_upper_dev_rcu(dev,
+                                      mlxsw_sp_bridge_device_upper_rif_destroy,
+                                      mlxsw_sp);
+}
+
 static struct mlxsw_sp_bridge_device *
 mlxsw_sp_bridge_device_create(struct mlxsw_sp_bridge *bridge,
                               struct net_device *br_dev)
@@ -165,6 +183,8 @@ static void
 mlxsw_sp_bridge_device_destroy(struct mlxsw_sp_bridge *bridge,
                                struct mlxsw_sp_bridge_device *bridge_device)
 {
+        mlxsw_sp_bridge_device_rifs_destroy(bridge->mlxsw_sp,
+                                            bridge_device->dev);
         list_del(&bridge_device->list);
         if (bridge_device->vlan_enabled)
                 bridge->vlan_enabled_exists = false;
diff --git a/drivers/net/ethernet/microchip/lan743x_main.c b/drivers/net/ethernet/microchip/lan743x_main.c
index e7dce79ff2c9..001b5f714c1b 100644
--- a/drivers/net/ethernet/microchip/lan743x_main.c
+++ b/drivers/net/ethernet/microchip/lan743x_main.c
@@ -2850,7 +2850,7 @@ static void lan743x_pcidev_shutdown(struct pci_dev *pdev)
         lan743x_hardware_cleanup(adapter);
 }
 
-#ifdef CONFIG_PM
+#ifdef CONFIG_PM_SLEEP
 static u16 lan743x_pm_wakeframe_crc16(const u8 *buf, int len)
 {
         return bitrev16(crc16(0xFFFF, buf, len));
@@ -3016,7 +3016,7 @@ static int lan743x_pm_resume(struct device *dev)
 static const struct dev_pm_ops lan743x_pm_ops = {
         SET_SYSTEM_SLEEP_PM_OPS(lan743x_pm_suspend, lan743x_pm_resume)
 };
-#endif /*CONFIG_PM */
+#endif /* CONFIG_PM_SLEEP */
 
 static const struct pci_device_id lan743x_pcidev_tbl[] = {
         { PCI_DEVICE(PCI_VENDOR_ID_SMSC, PCI_DEVICE_ID_SMSC_LAN7430) },
@@ -3028,7 +3028,7 @@ static struct pci_driver lan743x_pcidev_driver = {
         .id_table = lan743x_pcidev_tbl,
         .probe    = lan743x_pcidev_probe,
         .remove   = lan743x_pcidev_remove,
-#ifdef CONFIG_PM
+#ifdef CONFIG_PM_SLEEP
         .driver.pm = &lan743x_pm_ops,
 #endif
         .shutdown = lan743x_pcidev_shutdown,
diff --git a/drivers/net/ethernet/mscc/ocelot_board.c b/drivers/net/ethernet/mscc/ocelot_board.c
index 26bb3b18f3be..3cdf63e35b53 100644
--- a/drivers/net/ethernet/mscc/ocelot_board.c
+++ b/drivers/net/ethernet/mscc/ocelot_board.c
@@ -91,7 +91,7 @@ static irqreturn_t ocelot_xtr_irq_handler(int irq, void *arg)
                 struct sk_buff *skb;
                 struct net_device *dev;
                 u32 *buf;
-                int sz, len;
+                int sz, len, buf_len;
                 u32 ifh[4];
                 u32 val;
                 struct frame_info info;
@@ -116,14 +116,20 @@ static irqreturn_t ocelot_xtr_irq_handler(int irq, void *arg)
                         err = -ENOMEM;
                         break;
                 }
-                buf = (u32 *)skb_put(skb, info.len);
+                buf_len = info.len - ETH_FCS_LEN;
+                buf = (u32 *)skb_put(skb, buf_len);
 
                 len = 0;
                 do {
                         sz = ocelot_rx_frame_word(ocelot, grp, false, &val);
                         *buf++ = val;
                         len += sz;
-                } while ((sz == 4) && (len < info.len));
+                } while (len < buf_len);
+
+                /* Read the FCS and discard it */
+                sz = ocelot_rx_frame_word(ocelot, grp, false, &val);
+                /* Update the statistics if part of the FCS was read before */
+                len -= ETH_FCS_LEN - sz;
 
                 if (sz < 0) {
                         err = sz;
diff --git a/drivers/net/ethernet/netronome/nfp/flower/action.c b/drivers/net/ethernet/netronome/nfp/flower/action.c
index 0ba0356ec4e6..46ba0cf257c6 100644
--- a/drivers/net/ethernet/netronome/nfp/flower/action.c
+++ b/drivers/net/ethernet/netronome/nfp/flower/action.c
@@ -52,6 +52,7 @@
 #define NFP_FL_TUNNEL_CSUM                      cpu_to_be16(0x01)
 #define NFP_FL_TUNNEL_KEY                       cpu_to_be16(0x04)
 #define NFP_FL_TUNNEL_GENEVE_OPT                cpu_to_be16(0x0800)
+#define NFP_FL_SUPPORTED_TUNNEL_INFO_FLAGS      IP_TUNNEL_INFO_TX
 #define NFP_FL_SUPPORTED_IPV4_UDP_TUN_FLAGS     (NFP_FL_TUNNEL_CSUM | \
                                                  NFP_FL_TUNNEL_KEY | \
                                                  NFP_FL_TUNNEL_GENEVE_OPT)
@@ -741,11 +742,16 @@ nfp_flower_loop_action(struct nfp_app *app, const struct tc_action *a,
                 nfp_fl_push_vlan(psh_v, a);
                 *a_len += sizeof(struct nfp_fl_push_vlan);
         } else if (is_tcf_tunnel_set(a)) {
+                struct ip_tunnel_info *ip_tun = tcf_tunnel_info(a);
                 struct nfp_repr *repr = netdev_priv(netdev);
+
                 *tun_type = nfp_fl_get_tun_from_act_l4_port(repr->app, a);
                 if (*tun_type == NFP_FL_TUNNEL_NONE)
                         return -EOPNOTSUPP;
 
+                if (ip_tun->mode & ~NFP_FL_SUPPORTED_TUNNEL_INFO_FLAGS)
+                        return -EOPNOTSUPP;
+
                 /* Pre-tunnel action is required for tunnel encap.
                  * This checks for next hop entries on NFP.
                  * If none, the packet falls back before applying other actions.
@@ -796,11 +802,10 @@ int nfp_flower_compile_action(struct nfp_app *app,
                               struct net_device *netdev,
                               struct nfp_fl_payload *nfp_flow)
 {
-        int act_len, act_cnt, err, tun_out_cnt, out_cnt;
+        int act_len, act_cnt, err, tun_out_cnt, out_cnt, i;
         enum nfp_flower_tun_type tun_type;
         const struct tc_action *a;
         u32 csum_updated = 0;
-        LIST_HEAD(actions);
 
         memset(nfp_flow->action_data, 0, NFP_FL_MAX_A_SIZ);
         nfp_flow->meta.act_len = 0;
@@ -810,8 +815,7 @@ int nfp_flower_compile_action(struct nfp_app *app,
         tun_out_cnt = 0;
         out_cnt = 0;
 
-        tcf_exts_to_list(flow->exts, &actions);
-        list_for_each_entry(a, &actions, list) {
+        tcf_exts_for_each_action(i, a, flow->exts) {
                 err = nfp_flower_loop_action(app, a, flow, nfp_flow, &act_len,
                                              netdev, &tun_type, &tun_out_cnt,
                                              &out_cnt, &csum_updated);
diff --git a/drivers/net/ethernet/netronome/nfp/flower/main.h b/drivers/net/ethernet/netronome/nfp/flower/main.h
index 85f8209bf007..81d941ab895c 100644
--- a/drivers/net/ethernet/netronome/nfp/flower/main.h
+++ b/drivers/net/ethernet/netronome/nfp/flower/main.h
@@ -70,6 +70,7 @@ struct nfp_app;
 #define NFP_FL_FEATS_GENEVE             BIT(0)
 #define NFP_FL_NBI_MTU_SETTING          BIT(1)
 #define NFP_FL_FEATS_GENEVE_OPT         BIT(2)
+#define NFP_FL_FEATS_VLAN_PCP           BIT(3)
 #define NFP_FL_FEATS_LAG                BIT(31)
 
 struct nfp_fl_mask_id {
diff --git a/drivers/net/ethernet/netronome/nfp/flower/match.c b/drivers/net/ethernet/netronome/nfp/flower/match.c
index a0c72f277faa..17acb8cc6044 100644
--- a/drivers/net/ethernet/netronome/nfp/flower/match.c
+++ b/drivers/net/ethernet/netronome/nfp/flower/match.c
@@ -56,7 +56,7 @@ nfp_flower_compile_meta_tci(struct nfp_flower_meta_tci *frame,
                                                       FLOW_DISSECTOR_KEY_VLAN,
                                                       target);
                 /* Populate the tci field. */
-                if (flow_vlan->vlan_id) {
+                if (flow_vlan->vlan_id || flow_vlan->vlan_priority) {
                         tmp_tci = FIELD_PREP(NFP_FLOWER_MASK_VLAN_PRIO,
                                              flow_vlan->vlan_priority) |
                                   FIELD_PREP(NFP_FLOWER_MASK_VLAN_VID,
diff --git a/drivers/net/ethernet/netronome/nfp/flower/offload.c b/drivers/net/ethernet/netronome/nfp/flower/offload.c
index 2edab01c3beb..bd19624f10cf 100644
--- a/drivers/net/ethernet/netronome/nfp/flower/offload.c
+++ b/drivers/net/ethernet/netronome/nfp/flower/offload.c
@@ -192,6 +192,17 @@ nfp_flower_calculate_key_layers(struct nfp_app *app,
                 key_size += sizeof(struct nfp_flower_mac_mpls);
         }
 
+        if (dissector_uses_key(flow->dissector, FLOW_DISSECTOR_KEY_VLAN)) {
+                struct flow_dissector_key_vlan *flow_vlan;
+
+                flow_vlan = skb_flow_dissector_target(flow->dissector,
+                                                      FLOW_DISSECTOR_KEY_VLAN,
+                                                      flow->mask);
+                if (!(priv->flower_ext_feats & NFP_FL_FEATS_VLAN_PCP) &&
+                    flow_vlan->vlan_priority)
+                        return -EOPNOTSUPP;
+        }
+
         if (dissector_uses_key(flow->dissector,
                                FLOW_DISSECTOR_KEY_ENC_CONTROL)) {
                 struct flow_dissector_key_ipv4_addrs *mask_ipv4 = NULL;
diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
index a8b9fbab5f73..c6d29fdbb880 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
+++ b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
@@ -229,29 +229,16 @@ done:
         spin_unlock_bh(&nn->reconfig_lock);
 }
 
-/**
- * nfp_net_reconfig() - Reconfigure the firmware
- * @nn:      NFP Net device to reconfigure
- * @update:  The value for the update field in the BAR config
- *
- * Write the update word to the BAR and ping the reconfig queue.  The
- * poll until the firmware has acknowledged the update by zeroing the
- * update word.
- *
- * Return: Negative errno on error, 0 on success
- */
-int nfp_net_reconfig(struct nfp_net *nn, u32 update)
+static void nfp_net_reconfig_sync_enter(struct nfp_net *nn)
 {
         bool cancelled_timer = false;
         u32 pre_posted_requests;
-        int ret;
 
         spin_lock_bh(&nn->reconfig_lock);
 
         nn->reconfig_sync_present = true;
 
         if (nn->reconfig_timer_active) {
-                del_timer(&nn->reconfig_timer);
                 nn->reconfig_timer_active = false;
                 cancelled_timer = true;
         }
@@ -260,14 +247,43 @@ int nfp_net_reconfig(struct nfp_net *nn, u32 update)
 
         spin_unlock_bh(&nn->reconfig_lock);
 
-        if (cancelled_timer)
+        if (cancelled_timer) {
+                del_timer_sync(&nn->reconfig_timer);
                 nfp_net_reconfig_wait(nn, nn->reconfig_timer.expires);
+        }
 
         /* Run the posted reconfigs which were issued before we started */
         if (pre_posted_requests) {
                 nfp_net_reconfig_start(nn, pre_posted_requests);
                 nfp_net_reconfig_wait(nn, jiffies + HZ * NFP_NET_POLL_TIMEOUT);
         }
+}
+
+static void nfp_net_reconfig_wait_posted(struct nfp_net *nn)
+{
+        nfp_net_reconfig_sync_enter(nn);
+
+        spin_lock_bh(&nn->reconfig_lock);
+        nn->reconfig_sync_present = false;
+        spin_unlock_bh(&nn->reconfig_lock);
+}
+
+/**
+ * nfp_net_reconfig() - Reconfigure the firmware
+ * @nn:      NFP Net device to reconfigure
+ * @update:  The value for the update field in the BAR config
+ *
+ * Write the update word to the BAR and ping the reconfig queue.  The
+ * poll until the firmware has acknowledged the update by zeroing the
+ * update word.
+ *
+ * Return: Negative errno on error, 0 on success
+ */
+int nfp_net_reconfig(struct nfp_net *nn, u32 update)
+{
+        int ret;
+
+        nfp_net_reconfig_sync_enter(nn);
 
         nfp_net_reconfig_start(nn, update);
         ret = nfp_net_reconfig_wait(nn, jiffies + HZ * NFP_NET_POLL_TIMEOUT);
@@ -2061,14 +2077,17 @@ nfp_ctrl_rx_one(struct nfp_net *nn, struct nfp_net_dp *dp,
         return true;
 }
 
-static void nfp_ctrl_rx(struct nfp_net_r_vector *r_vec)
+static bool nfp_ctrl_rx(struct nfp_net_r_vector *r_vec)
 {
         struct nfp_net_rx_ring *rx_ring = r_vec->rx_ring;
         struct nfp_net *nn = r_vec->nfp_net;
         struct nfp_net_dp *dp = &nn->dp;
+        unsigned int budget = 512;
 
-        while (nfp_ctrl_rx_one(nn, dp, r_vec, rx_ring))
+        while (nfp_ctrl_rx_one(nn, dp, r_vec, rx_ring) && budget--)
                 continue;
+
+        return budget;
 }
 
 static void nfp_ctrl_poll(unsigned long arg)
@@ -2080,9 +2099,13 @@ static void nfp_ctrl_poll(unsigned long arg)
         __nfp_ctrl_tx_queued(r_vec);
         spin_unlock_bh(&r_vec->lock);
 
-        nfp_ctrl_rx(r_vec);
-
-        nfp_net_irq_unmask(r_vec->nfp_net, r_vec->irq_entry);
+        if (nfp_ctrl_rx(r_vec)) {
+                nfp_net_irq_unmask(r_vec->nfp_net, r_vec->irq_entry);
+        } else {
+                tasklet_schedule(&r_vec->tasklet);
+                nn_dp_warn(&r_vec->nfp_net->dp,
+                           "control message budget exceeded!\n");
+        }
 }
 
 /* Setup and Configuration
@@ -3130,21 +3153,6 @@ nfp_net_vlan_rx_kill_vid(struct net_device *netdev, __be16 proto, u16 vid)
         return nfp_net_reconfig_mbox(nn, NFP_NET_CFG_MBOX_CMD_CTAG_FILTER_KILL);
 }
 
-#ifdef CONFIG_NET_POLL_CONTROLLER
-static void nfp_net_netpoll(struct net_device *netdev)
-{
-        struct nfp_net *nn = netdev_priv(netdev);
-        int i;
-
-        /* nfp_net's NAPIs are statically allocated so even if there is a race
-         * with reconfig path this will simply try to schedule some disabled
-         * NAPI instances.
-         */
-        for (i = 0; i < nn->dp.num_stack_tx_rings; i++)
-                napi_schedule_irqoff(&nn->r_vecs[i].napi);
-}
-#endif
-
 static void nfp_net_stat64(struct net_device *netdev,
                            struct rtnl_link_stats64 *stats)
 {
@@ -3503,9 +3511,6 @@ const struct net_device_ops nfp_net_netdev_ops = {
         .ndo_get_stats64        = nfp_net_stat64,
         .ndo_vlan_rx_add_vid    = nfp_net_vlan_rx_add_vid,
         .ndo_vlan_rx_kill_vid   = nfp_net_vlan_rx_kill_vid,
-#ifdef CONFIG_NET_POLL_CONTROLLER
-        .ndo_poll_controller    = nfp_net_netpoll,
-#endif
         .ndo_set_vf_mac         = nfp_app_set_vf_mac,
         .ndo_set_vf_vlan        = nfp_app_set_vf_vlan,
         .ndo_set_vf_spoofchk    = nfp_app_set_vf_spoofchk,
@@ -3633,6 +3638,7 @@ struct nfp_net *nfp_net_alloc(struct pci_dev *pdev, bool needs_netdev,
  */
 void nfp_net_free(struct nfp_net *nn)
 {
+        WARN_ON(timer_pending(&nn->reconfig_timer) || nn->reconfig_posted);
         if (nn->dp.netdev)
                 free_netdev(nn->dp.netdev);
         else
@@ -3920,4 +3926,5 @@ void nfp_net_clean(struct nfp_net *nn)
                 return;
 
         unregister_netdev(nn->dp.netdev);
+        nfp_net_reconfig_wait_posted(nn);
 }
diff --git a/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c b/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
index 69aa7fc392c5..59c70be22a84 100644
--- a/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
+++ b/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
@@ -72,9 +72,6 @@ static void netxen_schedule_work(struct netxen_adapter *adapter,
                 work_func_t func, int delay);
 static void netxen_cancel_fw_work(struct netxen_adapter *adapter);
 static int netxen_nic_poll(struct napi_struct *napi, int budget);
-#ifdef CONFIG_NET_POLL_CONTROLLER
-static void netxen_nic_poll_controller(struct net_device *netdev);
-#endif
 
 static void netxen_create_sysfs_entries(struct netxen_adapter *adapter);
 static void netxen_remove_sysfs_entries(struct netxen_adapter *adapter);
@@ -581,9 +578,6 @@ static const struct net_device_ops netxen_netdev_ops = {
         .ndo_tx_timeout    = netxen_tx_timeout,
         .ndo_fix_features = netxen_fix_features,
         .ndo_set_features = netxen_set_features,
-#ifdef CONFIG_NET_POLL_CONTROLLER
-        .ndo_poll_controller = netxen_nic_poll_controller,
-#endif
 };
 
 static inline bool netxen_function_zero(struct pci_dev *pdev)
@@ -2402,23 +2396,6 @@ static int netxen_nic_poll(struct napi_struct *napi, int budget)
         return work_done;
 }
 
-#ifdef CONFIG_NET_POLL_CONTROLLER
-static void netxen_nic_poll_controller(struct net_device *netdev)
-{
-        int ring;
-        struct nx_host_sds_ring *sds_ring;
-        struct netxen_adapter *adapter = netdev_priv(netdev);
-        struct netxen_recv_context *recv_ctx = &adapter->recv_ctx;
-
-        disable_irq(adapter->irq);
-        for (ring = 0; ring < adapter->max_sds_rings; ring++) {
-                sds_ring = &recv_ctx->sds_rings[ring];
-                netxen_intr(adapter->irq, sds_ring);
-        }
-        enable_irq(adapter->irq);
-}
-#endif
-
 static int
 nx_incr_dev_ref_cnt(struct netxen_adapter *adapter)
 {
diff --git a/drivers/net/ethernet/qlogic/qed/qed_dcbx.c b/drivers/net/ethernet/qlogic/qed/qed_dcbx.c
index 6bb76e6d3c14..f5459de6d60a 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_dcbx.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_dcbx.c
@@ -190,10 +190,8 @@ qed_dcbx_dp_protocol(struct qed_hwfn *p_hwfn, struct qed_dcbx_results *p_data)
 
 static void
 qed_dcbx_set_params(struct qed_dcbx_results *p_data,
-                    struct qed_hw_info *p_info,
-                    bool enable,
-                    u8 prio,
-                    u8 tc,
+                    struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt,
+                    bool enable, u8 prio, u8 tc,
                     enum dcbx_protocol_type type,
                     enum qed_pci_personality personality)
 {
@@ -206,19 +204,30 @@ qed_dcbx_set_params(struct qed_dcbx_results *p_data,
         else
                 p_data->arr[type].update = DONT_UPDATE_DCB_DSCP;
 
+        /* Do not add vlan tag 0 when DCB is enabled and port in UFP/OV mode */
+        if ((test_bit(QED_MF_8021Q_TAGGING, &p_hwfn->cdev->mf_bits) ||
+             test_bit(QED_MF_8021AD_TAGGING, &p_hwfn->cdev->mf_bits)))
+                p_data->arr[type].dont_add_vlan0 = true;
+
         /* QM reconf data */
-        if (p_info->personality == personality)
-                qed_hw_info_set_offload_tc(p_info, tc);
+        if (p_hwfn->hw_info.personality == personality)
+                qed_hw_info_set_offload_tc(&p_hwfn->hw_info, tc);
+
+        /* Configure dcbx vlan priority in doorbell block for roce EDPM */
+        if (test_bit(QED_MF_UFP_SPECIFIC, &p_hwfn->cdev->mf_bits) &&
+            type == DCBX_PROTOCOL_ROCE) {
+                qed_wr(p_hwfn, p_ptt, DORQ_REG_TAG1_OVRD_MODE, 1);
+                qed_wr(p_hwfn, p_ptt, DORQ_REG_PF_PCP_BB_K2, prio << 1);
+        }
 }
 
 /* Update app protocol data and hw_info fields with the TLV info */
 static void
 qed_dcbx_update_app_info(struct qed_dcbx_results *p_data,
-                         struct qed_hwfn *p_hwfn,
-                         bool enable,
-                         u8 prio, u8 tc, enum dcbx_protocol_type type)
+                         struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt,
+                         bool enable, u8 prio, u8 tc,
+                         enum dcbx_protocol_type type)
 {
-        struct qed_hw_info *p_info = &p_hwfn->hw_info;
         enum qed_pci_personality personality;
         enum dcbx_protocol_type id;
         int i;
@@ -231,7 +240,7 @@ qed_dcbx_update_app_info(struct qed_dcbx_results *p_data,
 
                 personality = qed_dcbx_app_update[i].personality;
 
-                qed_dcbx_set_params(p_data, p_info, enable,
+                qed_dcbx_set_params(p_data, p_hwfn, p_ptt, enable,
                                     prio, tc, type, personality);
         }
 }
@@ -265,7 +274,7 @@ qed_dcbx_get_app_protocol_type(struct qed_hwfn *p_hwfn,
  * reconfiguring QM. Get protocol specific data for PF update ramrod command.
  */
 static int
-qed_dcbx_process_tlv(struct qed_hwfn *p_hwfn,
+qed_dcbx_process_tlv(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt,
                      struct qed_dcbx_results *p_data,
                      struct dcbx_app_priority_entry *p_tbl,
                      u32 pri_tc_tbl, int count, u8 dcbx_version)
@@ -309,7 +318,7 @@ qed_dcbx_process_tlv(struct qed_hwfn *p_hwfn,
                                 enable = true;
                         }
 
-                        qed_dcbx_update_app_info(p_data, p_hwfn, enable,
+                        qed_dcbx_update_app_info(p_data, p_hwfn, p_ptt, enable,
                                                  priority, tc, type);
                 }
         }
@@ -331,7 +340,7 @@ qed_dcbx_process_tlv(struct qed_hwfn *p_hwfn,
                         continue;
 
                 enable = (type == DCBX_PROTOCOL_ETH) ? false : !!dcbx_version;
-                qed_dcbx_update_app_info(p_data, p_hwfn, enable,
+                qed_dcbx_update_app_info(p_data, p_hwfn, p_ptt, enable,
                                          priority, tc, type);
         }
 
@@ -341,7 +350,8 @@ qed_dcbx_process_tlv(struct qed_hwfn *p_hwfn,
 /* Parse app TLV's to update TC information in hw_info structure for
  * reconfiguring QM. Get protocol specific data for PF update ramrod command.
  */
-static int qed_dcbx_process_mib_info(struct qed_hwfn *p_hwfn)
+static int
+qed_dcbx_process_mib_info(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt)
 {
         struct dcbx_app_priority_feature *p_app;
         struct dcbx_app_priority_entry *p_tbl;
@@ -365,7 +375,7 @@ static int qed_dcbx_process_mib_info(struct qed_hwfn *p_hwfn)
         p_info = &p_hwfn->hw_info;
         num_entries = QED_MFW_GET_FIELD(p_app->flags, DCBX_APP_NUM_ENTRIES);
 
-        rc = qed_dcbx_process_tlv(p_hwfn, &data, p_tbl, pri_tc_tbl,
+        rc = qed_dcbx_process_tlv(p_hwfn, p_ptt, &data, p_tbl, pri_tc_tbl,
                                   num_entries, dcbx_version);
         if (rc)
                 return rc;
@@ -891,7 +901,7 @@ qed_dcbx_mib_update_event(struct qed_hwfn *p_hwfn,
                 return rc;
 
         if (type == QED_DCBX_OPERATIONAL_MIB) {
-                rc = qed_dcbx_process_mib_info(p_hwfn);
+                rc = qed_dcbx_process_mib_info(p_hwfn, p_ptt);
                 if (!rc) {
                         /* reconfigure tcs of QM queues according
                          * to negotiation results
@@ -954,6 +964,7 @@ static void qed_dcbx_update_protocol_data(struct protocol_dcb_data *p_data,
         p_data->dcb_enable_flag = p_src->arr[type].enable;
         p_data->dcb_priority = p_src->arr[type].priority;
         p_data->dcb_tc = p_src->arr[type].tc;
+        p_data->dcb_dont_add_vlan0 = p_src->arr[type].dont_add_vlan0;
 }
 
 /* Set pf update ramrod command params */
diff --git a/drivers/net/ethernet/qlogic/qed/qed_dcbx.h b/drivers/net/ethernet/qlogic/qed/qed_dcbx.h
index a4d688c04e18..01f253ea4b22 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_dcbx.h
+++ b/drivers/net/ethernet/qlogic/qed/qed_dcbx.h
@@ -55,6 +55,7 @@ struct qed_dcbx_app_data {
         u8 update;              /* Update indication */
         u8 priority;            /* Priority */
         u8 tc;                  /* Traffic Class */
+        bool dont_add_vlan0;    /* Do not insert a vlan tag with id 0 */
 };
 
 #define QED_DCBX_VERSION_DISABLED       0
diff --git a/drivers/net/ethernet/qlogic/qed/qed_dev.c b/drivers/net/ethernet/qlogic/qed/qed_dev.c
index 016ca8a7ec8a..97f073fd3725 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_dev.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_dev.c
@@ -1706,7 +1706,7 @@ static int qed_vf_start(struct qed_hwfn *p_hwfn,
 int qed_hw_init(struct qed_dev *cdev, struct qed_hw_init_params *p_params)
 {
         struct qed_load_req_params load_req_params;
-        u32 load_code, param, drv_mb_param;
+        u32 load_code, resp, param, drv_mb_param;
         bool b_default_mtu = true;
         struct qed_hwfn *p_hwfn;
         int rc = 0, mfw_rc, i;
@@ -1852,6 +1852,19 @@ int qed_hw_init(struct qed_dev *cdev, struct qed_hw_init_params *p_params)
 
         if (IS_PF(cdev)) {
                 p_hwfn = QED_LEADING_HWFN(cdev);
+
+                /* Get pre-negotiated values for stag, bandwidth etc. */
+                DP_VERBOSE(p_hwfn,
+                           QED_MSG_SPQ,
+                           "Sending GET_OEM_UPDATES command to trigger stag/bandwidth attention handling\n");
+                drv_mb_param = 1 << DRV_MB_PARAM_DUMMY_OEM_UPDATES_OFFSET;
+                rc = qed_mcp_cmd(p_hwfn, p_hwfn->p_main_ptt,
+                                 DRV_MSG_CODE_GET_OEM_UPDATES,
+                                 drv_mb_param, &resp, &param);
+                if (rc)
+                        DP_NOTICE(p_hwfn,
+                                  "Failed to send GET_OEM_UPDATES attention request\n");
+
                 drv_mb_param = STORM_FW_VERSION;
                 rc = qed_mcp_cmd(p_hwfn, p_hwfn->p_main_ptt,
                                  DRV_MSG_CODE_OV_UPDATE_STORM_FW_VER,
diff --git a/drivers/net/ethernet/qlogic/qed/qed_hsi.h b/drivers/net/ethernet/qlogic/qed/qed_hsi.h
index 8faceb691657..a71382687ef2 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_hsi.h
+++ b/drivers/net/ethernet/qlogic/qed/qed_hsi.h
@@ -11987,6 +11987,7 @@ struct public_global {
         u32 running_bundle_id;
         s32 external_temperature;
         u32 mdump_reason;
+        u64 reserved;
         u32 data_ptr;
         u32 data_size;
 };
@@ -12414,6 +12415,7 @@ struct public_drv_mb {
 #define DRV_MSG_SET_RESOURCE_VALUE_MSG          0x35000000
 #define DRV_MSG_CODE_OV_UPDATE_WOL              0x38000000
 #define DRV_MSG_CODE_OV_UPDATE_ESWITCH_MODE     0x39000000
+#define DRV_MSG_CODE_GET_OEM_UPDATES            0x41000000
 
 #define DRV_MSG_CODE_BW_UPDATE_ACK              0x32000000
 #define DRV_MSG_CODE_NIG_DRAIN                  0x30000000
@@ -12541,6 +12543,9 @@ struct public_drv_mb {
 #define DRV_MB_PARAM_ESWITCH_MODE_VEB   0x1
 #define DRV_MB_PARAM_ESWITCH_MODE_VEPA  0x2
 
+#define DRV_MB_PARAM_DUMMY_OEM_UPDATES_MASK     0x1
+#define DRV_MB_PARAM_DUMMY_OEM_UPDATES_OFFSET   0
+
 #define DRV_MB_PARAM_SET_LED_MODE_OPER          0x0
 #define DRV_MB_PARAM_SET_LED_MODE_ON            0x1
 #define DRV_MB_PARAM_SET_LED_MODE_OFF           0x2
diff --git a/drivers/net/ethernet/qlogic/qed/qed_init_ops.c b/drivers/net/ethernet/qlogic/qed/qed_init_ops.c
index d9ab5add27a8..34193c2f1699 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_init_ops.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_init_ops.c
@@ -407,7 +407,7 @@ static void qed_init_cmd_rd(struct qed_hwfn *p_hwfn,
 
         if (i == QED_INIT_MAX_POLL_COUNT) {
                 DP_ERR(p_hwfn,
-                       "Timeout when polling reg: 0x%08x [ Waiting-for: %08x Got: %08x (comparsion %08x)]\n",
+                       "Timeout when polling reg: 0x%08x [ Waiting-for: %08x Got: %08x (comparison %08x)]\n",
                        addr, le32_to_cpu(cmd->expected_val),
                        val, le32_to_cpu(cmd->op_data));
         }
diff --git a/drivers/net/ethernet/qlogic/qed/qed_iwarp.c b/drivers/net/ethernet/qlogic/qed/qed_iwarp.c
index 17f3dfa2cc94..e860bdf0f752 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_iwarp.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_iwarp.c
@@ -1710,7 +1710,7 @@ qed_iwarp_parse_rx_pkt(struct qed_hwfn *p_hwfn,
 
                 cm_info->local_ip[0] = ntohl(iph->daddr);
                 cm_info->remote_ip[0] = ntohl(iph->saddr);
-                cm_info->ip_version = TCP_IPV4;
+                cm_info->ip_version = QED_TCP_IPV4;
 
                 ip_hlen = (iph->ihl) * sizeof(u32);
                 *payload_len = ntohs(iph->tot_len) - ip_hlen;
@@ -1730,7 +1730,7 @@ qed_iwarp_parse_rx_pkt(struct qed_hwfn *p_hwfn,
                         cm_info->remote_ip[i] =
                             ntohl(ip6h->saddr.in6_u.u6_addr32[i]);
                 }
-                cm_info->ip_version = TCP_IPV6;
+                cm_info->ip_version = QED_TCP_IPV6;
 
                 ip_hlen = sizeof(*ip6h);
                 *payload_len = ntohs(ip6h->payload_len);
diff --git a/drivers/net/ethernet/qlogic/qed/qed_mcp.c b/drivers/net/ethernet/qlogic/qed/qed_mcp.c
index d89a0e22f6e4..58c7eb9d8e1b 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_mcp.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_mcp.c
@@ -48,7 +48,7 @@
 #include "qed_reg_addr.h"
 #include "qed_sriov.h"
 
-#define CHIP_MCP_RESP_ITER_US 10
+#define QED_MCP_RESP_ITER_US    10
 
 #define QED_DRV_MB_MAX_RETRIES  (500 * 1000)    /* Account for 5 sec */
 #define QED_MCP_RESET_RETRIES   (50 * 1000)     /* Account for 500 msec */
@@ -183,18 +183,57 @@ int qed_mcp_free(struct qed_hwfn *p_hwfn)
         return 0;
 }
 
+/* Maximum of 1 sec to wait for the SHMEM ready indication */
+#define QED_MCP_SHMEM_RDY_MAX_RETRIES   20
+#define QED_MCP_SHMEM_RDY_ITER_MS       50
+
 static int qed_load_mcp_offsets(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt)
 {
         struct qed_mcp_info *p_info = p_hwfn->mcp_info;
+        u8 cnt = QED_MCP_SHMEM_RDY_MAX_RETRIES;
+        u8 msec = QED_MCP_SHMEM_RDY_ITER_MS;
         u32 drv_mb_offsize, mfw_mb_offsize;
         u32 mcp_pf_id = MCP_PF_ID(p_hwfn);
 
         p_info->public_base = qed_rd(p_hwfn, p_ptt, MISC_REG_SHARED_MEM_ADDR);
-        if (!p_info->public_base)
-                return 0;
+        if (!p_info->public_base) {
+                DP_NOTICE(p_hwfn,
+                          "The address of the MCP scratch-pad is not configured\n");
+                return -EINVAL;
+        }
 
         p_info->public_base |= GRCBASE_MCP;
 
+        /* Get the MFW MB address and number of supported messages */
+        mfw_mb_offsize = qed_rd(p_hwfn, p_ptt,
+                                SECTION_OFFSIZE_ADDR(p_info->public_base,
+                                                     PUBLIC_MFW_MB));
+        p_info->mfw_mb_addr = SECTION_ADDR(mfw_mb_offsize, mcp_pf_id);
+        p_info->mfw_mb_length = (u16)qed_rd(p_hwfn, p_ptt,
+                                            p_info->mfw_mb_addr +
+                                            offsetof(struct public_mfw_mb,
+                                                     sup_msgs));
+
+        /* The driver can notify that there was an MCP reset, and might read the
+         * SHMEM values before the MFW has completed initializing them.
+         * To avoid this, the "sup_msgs" field in the MFW mailbox is used as a
+         * data ready indication.
+         */
+        while (!p_info->mfw_mb_length && --cnt) {
+                msleep(msec);
+                p_info->mfw_mb_length =
+                        (u16)qed_rd(p_hwfn, p_ptt,
+                                    p_info->mfw_mb_addr +
+                                    offsetof(struct public_mfw_mb, sup_msgs));
+        }
+
+        if (!cnt) {
+                DP_NOTICE(p_hwfn,
+                          "Failed to get the SHMEM ready notification after %d msec\n",
+                          QED_MCP_SHMEM_RDY_MAX_RETRIES * msec);
+                return -EBUSY;
+        }
+
         /* Calculate the driver and MFW mailbox address */
         drv_mb_offsize = qed_rd(p_hwfn, p_ptt,
                                 SECTION_OFFSIZE_ADDR(p_info->public_base,
@@ -204,13 +243,6 @@ static int qed_load_mcp_offsets(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt)
                    "drv_mb_offsiz = 0x%x, drv_mb_addr = 0x%x mcp_pf_id = 0x%x\n",
                    drv_mb_offsize, p_info->drv_mb_addr, mcp_pf_id);
 
-        /* Set the MFW MB address */
-        mfw_mb_offsize = qed_rd(p_hwfn, p_ptt,
-                                SECTION_OFFSIZE_ADDR(p_info->public_base,
-                                                     PUBLIC_MFW_MB));
-        p_info->mfw_mb_addr = SECTION_ADDR(mfw_mb_offsize, mcp_pf_id);
-        p_info->mfw_mb_length = (u16)qed_rd(p_hwfn, p_ptt, p_info->mfw_mb_addr);
-
         /* Get the current driver mailbox sequence before sending
          * the first command
          */
@@ -285,9 +317,15 @@ static void qed_mcp_reread_offsets(struct qed_hwfn *p_hwfn,
 
 int qed_mcp_reset(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt)
 {
-        u32 org_mcp_reset_seq, seq, delay = CHIP_MCP_RESP_ITER_US, cnt = 0;
+        u32 org_mcp_reset_seq, seq, delay = QED_MCP_RESP_ITER_US, cnt = 0;
         int rc = 0;
 
+        if (p_hwfn->mcp_info->b_block_cmd) {
+                DP_NOTICE(p_hwfn,
+                          "The MFW is not responsive. Avoid sending MCP_RESET mailbox command.\n");
+                return -EBUSY;
+        }
+
         /* Ensure that only a single thread is accessing the mailbox */
         spin_lock_bh(&p_hwfn->mcp_info->cmd_lock);
 
@@ -413,14 +451,41 @@ static void __qed_mcp_cmd_and_union(struct qed_hwfn *p_hwfn,
                    (p_mb_params->cmd | seq_num), p_mb_params->param);
 }
 
+static void qed_mcp_cmd_set_blocking(struct qed_hwfn *p_hwfn, bool block_cmd)
+{
+        p_hwfn->mcp_info->b_block_cmd = block_cmd;
+
+        DP_INFO(p_hwfn, "%s sending of mailbox commands to the MFW\n",
+                block_cmd ? "Block" : "Unblock");
+}
+
+static void qed_mcp_print_cpu_info(struct qed_hwfn *p_hwfn,
+                                   struct qed_ptt *p_ptt)
+{
+        u32 cpu_mode, cpu_state, cpu_pc_0, cpu_pc_1, cpu_pc_2;
+        u32 delay = QED_MCP_RESP_ITER_US;
+
+        cpu_mode = qed_rd(p_hwfn, p_ptt, MCP_REG_CPU_MODE);
+        cpu_state = qed_rd(p_hwfn, p_ptt, MCP_REG_CPU_STATE);
+        cpu_pc_0 = qed_rd(p_hwfn, p_ptt, MCP_REG_CPU_PROGRAM_COUNTER);
+        udelay(delay);
+        cpu_pc_1 = qed_rd(p_hwfn, p_ptt, MCP_REG_CPU_PROGRAM_COUNTER);
+        udelay(delay);
+        cpu_pc_2 = qed_rd(p_hwfn, p_ptt, MCP_REG_CPU_PROGRAM_COUNTER);
+
+        DP_NOTICE(p_hwfn,
+                  "MCP CPU info: mode 0x%08x, state 0x%08x, pc {0x%08x, 0x%08x, 0x%08x}\n",
+                  cpu_mode, cpu_state, cpu_pc_0, cpu_pc_1, cpu_pc_2);
+}
+
 static int
 _qed_mcp_cmd_and_union(struct qed_hwfn *p_hwfn,
                        struct qed_ptt *p_ptt,
                        struct qed_mcp_mb_params *p_mb_params,
-                       u32 max_retries, u32 delay)
+                       u32 max_retries, u32 usecs)
 {
+        u32 cnt = 0, msecs = DIV_ROUND_UP(usecs, 1000);
         struct qed_mcp_cmd_elem *p_cmd_elem;
-        u32 cnt = 0;
         u16 seq_num;
         int rc = 0;
 
@@ -443,7 +508,11 @@ _qed_mcp_cmd_and_union(struct qed_hwfn *p_hwfn,
                         goto err;
 
                 spin_unlock_bh(&p_hwfn->mcp_info->cmd_lock);
-                udelay(delay);
+
+                if (QED_MB_FLAGS_IS_SET(p_mb_params, CAN_SLEEP))
+                        msleep(msecs);
+                else
+                        udelay(usecs);
         } while (++cnt < max_retries);
 
         if (cnt >= max_retries) {
@@ -472,7 +541,11 @@ _qed_mcp_cmd_and_union(struct qed_hwfn *p_hwfn,
                  * The spinlock stays locked until the list element is removed.
                  */
 
-                udelay(delay);
+                if (QED_MB_FLAGS_IS_SET(p_mb_params, CAN_SLEEP))
+                        msleep(msecs);
+                else
+                        udelay(usecs);
+
                 spin_lock_bh(&p_hwfn->mcp_info->cmd_lock);
 
                 if (p_cmd_elem->b_is_completed)
@@ -491,11 +564,15 @@ _qed_mcp_cmd_and_union(struct qed_hwfn *p_hwfn,
                 DP_NOTICE(p_hwfn,
                           "The MFW failed to respond to command 0x%08x [param 0x%08x].\n",
                           p_mb_params->cmd, p_mb_params->param);
+                qed_mcp_print_cpu_info(p_hwfn, p_ptt);
 
                 spin_lock_bh(&p_hwfn->mcp_info->cmd_lock);
                 qed_mcp_cmd_del_elem(p_hwfn, p_cmd_elem);
                 spin_unlock_bh(&p_hwfn->mcp_info->cmd_lock);
 
+                if (!QED_MB_FLAGS_IS_SET(p_mb_params, AVOID_BLOCK))
+                        qed_mcp_cmd_set_blocking(p_hwfn, true);
+
                 return -EAGAIN;
         }
 
@@ -507,7 +584,7 @@ _qed_mcp_cmd_and_union(struct qed_hwfn *p_hwfn,
                    "MFW mailbox: response 0x%08x param 0x%08x [after %d.%03d ms]\n",
                    p_mb_params->mcp_resp,
                    p_mb_params->mcp_param,
-                   (cnt * delay) / 1000, (cnt * delay) % 1000);
+                   (cnt * usecs) / 1000, (cnt * usecs) % 1000);
 
         /* Clear the sequence number from the MFW response */
         p_mb_params->mcp_resp &= FW_MSG_CODE_MASK;
@@ -525,7 +602,7 @@ static int qed_mcp_cmd_and_union(struct qed_hwfn *p_hwfn,
 {
         size_t union_data_size = sizeof(union drv_union_data);
         u32 max_retries = QED_DRV_MB_MAX_RETRIES;
-        u32 delay = CHIP_MCP_RESP_ITER_US;
+        u32 usecs = QED_MCP_RESP_ITER_US;
 
         /* MCP not initialized */
         if (!qed_mcp_is_init(p_hwfn)) {
@@ -533,6 +610,13 @@ static int qed_mcp_cmd_and_union(struct qed_hwfn *p_hwfn,
                 return -EBUSY;
         }
 
+        if (p_hwfn->mcp_info->b_block_cmd) {
+                DP_NOTICE(p_hwfn,
+                          "The MFW is not responsive. Avoid sending mailbox command 0x%08x [param 0x%08x].\n",
+                          p_mb_params->cmd, p_mb_params->param);
+                return -EBUSY;
+        }
+
         if (p_mb_params->data_src_size > union_data_size ||
             p_mb_params->data_dst_size > union_data_size) {
                 DP_ERR(p_hwfn,
@@ -542,8 +626,13 @@ static int qed_mcp_cmd_and_union(struct qed_hwfn *p_hwfn,
                 return -EINVAL;
         }
 
+        if (QED_MB_FLAGS_IS_SET(p_mb_params, CAN_SLEEP)) {
+                max_retries = DIV_ROUND_UP(max_retries, 1000);
+                usecs *= 1000;
+        }
+
         return _qed_mcp_cmd_and_union(p_hwfn, p_ptt, p_mb_params, max_retries,
-                                      delay);
+                                      usecs);
 }
 
 int qed_mcp_cmd(struct qed_hwfn *p_hwfn,
@@ -761,6 +850,7 @@ __qed_mcp_load_req(struct qed_hwfn *p_hwfn,
         mb_params.data_src_size = sizeof(load_req);
         mb_params.p_data_dst = &load_rsp;
         mb_params.data_dst_size = sizeof(load_rsp);
+        mb_params.flags = QED_MB_FLAG_CAN_SLEEP | QED_MB_FLAG_AVOID_BLOCK;
 
         DP_VERBOSE(p_hwfn, QED_MSG_SP,
                    "Load Request: param 0x%08x [init_hw %d, drv_type %d, hsi_ver %d, pda 0x%04x]\n",
@@ -982,7 +1072,8 @@ int qed_mcp_load_req(struct qed_hwfn *p_hwfn,
 
 int qed_mcp_unload_req(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt)
 {
-        u32 wol_param, mcp_resp, mcp_param;
+        struct qed_mcp_mb_params mb_params;
+        u32 wol_param;
 
         switch (p_hwfn->cdev->wol_config) {
         case QED_OV_WOL_DISABLED:
@@ -1000,8 +1091,12 @@ int qed_mcp_unload_req(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt)
                 wol_param = DRV_MB_PARAM_UNLOAD_WOL_MCP;
         }
 
-        return qed_mcp_cmd(p_hwfn, p_ptt, DRV_MSG_CODE_UNLOAD_REQ, wol_param,
-                           &mcp_resp, &mcp_param);
+        memset(&mb_params, 0, sizeof(mb_params));
+        mb_params.cmd = DRV_MSG_CODE_UNLOAD_REQ;
+        mb_params.param = wol_param;
+        mb_params.flags = QED_MB_FLAG_CAN_SLEEP | QED_MB_FLAG_AVOID_BLOCK;
+
+        return qed_mcp_cmd_and_union(p_hwfn, p_ptt, &mb_params);
 }
 
 int qed_mcp_unload_done(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt)
@@ -1486,13 +1581,29 @@ static void qed_mcp_update_stag(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt)
         p_hwfn->mcp_info->func_info.ovlan = (u16)shmem_info.ovlan_stag &
                                                  FUNC_MF_CFG_OV_STAG_MASK;
         p_hwfn->hw_info.ovlan = p_hwfn->mcp_info->func_info.ovlan;
-        if ((p_hwfn->hw_info.hw_mode & BIT(MODE_MF_SD)) &&
-            (p_hwfn->hw_info.ovlan != QED_MCP_VLAN_UNSET)) {
-                qed_wr(p_hwfn, p_ptt,
-                       NIG_REG_LLH_FUNC_TAG_VALUE, p_hwfn->hw_info.ovlan);
+        if (test_bit(QED_MF_OVLAN_CLSS, &p_hwfn->cdev->mf_bits)) {
+                if (p_hwfn->hw_info.ovlan != QED_MCP_VLAN_UNSET) {
+                        qed_wr(p_hwfn, p_ptt, NIG_REG_LLH_FUNC_TAG_VALUE,
+                               p_hwfn->hw_info.ovlan);
+                        qed_wr(p_hwfn, p_ptt, NIG_REG_LLH_FUNC_TAG_EN, 1);
+
+                        /* Configure DB to add external vlan to EDPM packets */
+                        qed_wr(p_hwfn, p_ptt, DORQ_REG_TAG1_OVRD_MODE, 1);
+                        qed_wr(p_hwfn, p_ptt, DORQ_REG_PF_EXT_VID_BB_K2,
+                               p_hwfn->hw_info.ovlan);
+                } else {
+                        qed_wr(p_hwfn, p_ptt, NIG_REG_LLH_FUNC_TAG_EN, 0);
+                        qed_wr(p_hwfn, p_ptt, NIG_REG_LLH_FUNC_TAG_VALUE, 0);
+                        qed_wr(p_hwfn, p_ptt, DORQ_REG_TAG1_OVRD_MODE, 0);
+                        qed_wr(p_hwfn, p_ptt, DORQ_REG_PF_EXT_VID_BB_K2, 0);
+                }
+
                 qed_sp_pf_update_stag(p_hwfn);
         }
 
+        DP_VERBOSE(p_hwfn, QED_MSG_SP, "ovlan  = %d hw_mode = 0x%x\n",
+                   p_hwfn->mcp_info->func_info.ovlan, p_hwfn->hw_info.hw_mode);
+
         /* Acknowledge the MFW */
         qed_mcp_cmd(p_hwfn, p_ptt, DRV_MSG_CODE_S_TAG_UPDATE_ACK, 0,
                     &resp, &param);
@@ -2077,31 +2188,65 @@ qed_mcp_send_drv_version(struct qed_hwfn *p_hwfn,
         return rc;
 }
 
+/* A maximal 100 msec waiting time for the MCP to halt */
+#define QED_MCP_HALT_SLEEP_MS           10
+#define QED_MCP_HALT_MAX_RETRIES        10
+
 int qed_mcp_halt(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt)
 {
-        u32 resp = 0, param = 0;
+        u32 resp = 0, param = 0, cpu_state, cnt = 0;
         int rc;
 
         rc = qed_mcp_cmd(p_hwfn, p_ptt, DRV_MSG_CODE_MCP_HALT, 0, &resp,
                          &param);
-        if (rc)
+        if (rc) {
                 DP_ERR(p_hwfn, "MCP response failure, aborting\n");
+                return rc;
+        }
 
-        return rc;
+        do {
+                msleep(QED_MCP_HALT_SLEEP_MS);
+                cpu_state = qed_rd(p_hwfn, p_ptt, MCP_REG_CPU_STATE);
+                if (cpu_state & MCP_REG_CPU_STATE_SOFT_HALTED)
+                        break;
+        } while (++cnt < QED_MCP_HALT_MAX_RETRIES);
+
+        if (cnt == QED_MCP_HALT_MAX_RETRIES) {
+                DP_NOTICE(p_hwfn,
+                          "Failed to halt the MCP [CPU_MODE = 0x%08x, CPU_STATE = 0x%08x]\n",
+                          qed_rd(p_hwfn, p_ptt, MCP_REG_CPU_MODE), cpu_state);
+                return -EBUSY;
+        }
+
+        qed_mcp_cmd_set_blocking(p_hwfn, true);
+
+        return 0;
 }
 
+#define QED_MCP_RESUME_SLEEP_MS 10
+
 int qed_mcp_resume(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt)
 {
-        u32 value, cpu_mode;
+        u32 cpu_mode, cpu_state;
 
         qed_wr(p_hwfn, p_ptt, MCP_REG_CPU_STATE, 0xffffffff);
 
-        value = qed_rd(p_hwfn, p_ptt, MCP_REG_CPU_MODE);
-        value &= ~MCP_REG_CPU_MODE_SOFT_HALT;
-        qed_wr(p_hwfn, p_ptt, MCP_REG_CPU_MODE, value);
         cpu_mode = qed_rd(p_hwfn, p_ptt, MCP_REG_CPU_MODE);
+        cpu_mode &= ~MCP_REG_CPU_MODE_SOFT_HALT;
+        qed_wr(p_hwfn, p_ptt, MCP_REG_CPU_MODE, cpu_mode);
+        msleep(QED_MCP_RESUME_SLEEP_MS);
+        cpu_state = qed_rd(p_hwfn, p_ptt, MCP_REG_CPU_STATE);
+
+        if (cpu_state & MCP_REG_CPU_STATE_SOFT_HALTED) {
+                DP_NOTICE(p_hwfn,
+                          "Failed to resume the MCP [CPU_MODE = 0x%08x, CPU_STATE = 0x%08x]\n",
+                          cpu_mode, cpu_state);
+                return -EBUSY;
+        }
 
-        return (cpu_mode & MCP_REG_CPU_MODE_SOFT_HALT) ? -EAGAIN : 0;
+        qed_mcp_cmd_set_blocking(p_hwfn, false);
+
+        return 0;
 }
 
 int qed_mcp_ov_update_current_config(struct qed_hwfn *p_hwfn,
diff --git a/drivers/net/ethernet/qlogic/qed/qed_mcp.h b/drivers/net/ethernet/qlogic/qed/qed_mcp.h
index 047976d5c6e9..85e6b3989e7a 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_mcp.h
+++ b/drivers/net/ethernet/qlogic/qed/qed_mcp.h
@@ -635,11 +635,14 @@ struct qed_mcp_info {
          */
         spinlock_t                              cmd_lock;
 
+        /* Flag to indicate whether sending a MFW mailbox command is blocked */
+        bool                                    b_block_cmd;
+
         /* Spinlock used for syncing SW link-changes and link-changes
          * originating from attention context.
          */
         spinlock_t                              link_lock;
-        bool                                    block_mb_sending;
+
         u32                                     public_base;
         u32                                     drv_mb_addr;
         u32                                     mfw_mb_addr;
@@ -660,14 +663,20 @@ struct qed_mcp_info {
 };
 
 struct qed_mcp_mb_params {
-        u32                     cmd;
-        u32                     param;
-        void                    *p_data_src;
-        u8                      data_src_size;
-        void                    *p_data_dst;
-        u8                      data_dst_size;
-        u32                     mcp_resp;
-        u32                     mcp_param;
+        u32 cmd;
+        u32 param;
+        void *p_data_src;
+        void *p_data_dst;
+        u8 data_src_size;
+        u8 data_dst_size;
+        u32 mcp_resp;
+        u32 mcp_param;
+        u32 flags;
+#define QED_MB_FLAG_CAN_SLEEP   (0x1 << 0)
+#define QED_MB_FLAG_AVOID_BLOCK (0x1 << 1)
+#define QED_MB_FLAGS_IS_SET(params, flag) \
+        ({ typeof(params) __params = (params); \
+           (__params && (__params->flags & QED_MB_FLAG_ ## flag)); })
 };
 
 struct qed_drv_tlv_hdr {
diff --git a/drivers/net/ethernet/qlogic/qed/qed_rdma.c b/drivers/net/ethernet/qlogic/qed/qed_rdma.c
index be941cfaa2d4..c71391b9c757 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_rdma.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_rdma.c
@@ -228,7 +228,7 @@ static int qed_rdma_alloc(struct qed_hwfn *p_hwfn,
                                  num_cons, "Toggle");
         if (rc) {
                 DP_VERBOSE(p_hwfn, QED_MSG_RDMA,
-                           "Failed to allocate toogle bits, rc = %d\n", rc);
+                           "Failed to allocate toggle bits, rc = %d\n", rc);
                 goto free_cq_map;
         }
 
diff --git a/drivers/net/ethernet/qlogic/qed/qed_reg_addr.h b/drivers/net/ethernet/qlogic/qed/qed_reg_addr.h
index d8ad2dcad8d5..2440970882c4 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_reg_addr.h
+++ b/drivers/net/ethernet/qlogic/qed/qed_reg_addr.h
@@ -216,6 +216,12 @@
         0x00c000UL
 #define  DORQ_REG_IFEN \
         0x100040UL
+#define DORQ_REG_TAG1_OVRD_MODE \
+        0x1008b4UL
+#define DORQ_REG_PF_PCP_BB_K2 \
+        0x1008c4UL
+#define DORQ_REG_PF_EXT_VID_BB_K2 \
+        0x1008c8UL
 #define DORQ_REG_DB_DROP_REASON \
         0x100a2cUL
 #define DORQ_REG_DB_DROP_DETAILS \
@@ -562,8 +568,10 @@
         0
 #define MCP_REG_CPU_STATE \
         0xe05004UL
+#define MCP_REG_CPU_STATE_SOFT_HALTED   (0x1UL << 10)
 #define MCP_REG_CPU_EVENT_MASK \
         0xe05008UL
+#define MCP_REG_CPU_PROGRAM_COUNTER     0xe0501cUL
 #define PGLUE_B_REG_PF_BAR0_SIZE \
         0x2aae60UL
 #define PGLUE_B_REG_PF_BAR1_SIZE \
diff --git a/drivers/net/ethernet/qlogic/qed/qed_roce.c b/drivers/net/ethernet/qlogic/qed/qed_roce.c
index 7d7a64c55ff1..f9167d1354bb 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_roce.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_roce.c
@@ -140,23 +140,16 @@ static void qed_rdma_copy_gids(struct qed_rdma_qp *qp, __le32 *src_gid,
 
 static enum roce_flavor qed_roce_mode_to_flavor(enum roce_mode roce_mode)
 {
-        enum roce_flavor flavor;
-
         switch (roce_mode) {
         case ROCE_V1:
-                flavor = PLAIN_ROCE;
-                break;
+                return PLAIN_ROCE;
         case ROCE_V2_IPV4:
-                flavor = RROCE_IPV4;
-                break;
+                return RROCE_IPV4;
         case ROCE_V2_IPV6:
-                flavor = ROCE_V2_IPV6;
-                break;
+                return RROCE_IPV6;
         default:
-                flavor = MAX_ROCE_MODE;
-                break;
+                return MAX_ROCE_FLAVOR;
         }
-        return flavor;
 }
 
 static void qed_roce_free_cid_pair(struct qed_hwfn *p_hwfn, u16 cid)
diff --git a/drivers/net/ethernet/qlogic/qed/qed_sp_commands.c b/drivers/net/ethernet/qlogic/qed/qed_sp_commands.c
index 8de644b4721e..77b6248ad3b9 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_sp_commands.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_sp_commands.c
@@ -154,7 +154,7 @@ qed_set_pf_update_tunn_mode(struct qed_tunnel_info *p_tun,
 static void qed_set_tunn_cls_info(struct qed_tunnel_info *p_tun,
                                   struct qed_tunnel_info *p_src)
 {
-        enum tunnel_clss type;
+        int type;
 
         p_tun->b_update_rx_cls = p_src->b_update_rx_cls;
         p_tun->b_update_tx_cls = p_src->b_update_tx_cls;
diff --git a/drivers/net/ethernet/qlogic/qed/qed_vf.c b/drivers/net/ethernet/qlogic/qed/qed_vf.c
index 3d4269659820..be118d057b92 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_vf.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_vf.c
@@ -413,7 +413,6 @@ static int qed_vf_pf_acquire(struct qed_hwfn *p_hwfn)
         }
 
         if (!p_iov->b_pre_fp_hsi &&
-            ETH_HSI_VER_MINOR &&
             (resp->pfdev_info.minor_fp_hsi < ETH_HSI_VER_MINOR)) {
                 DP_INFO(p_hwfn,
                         "PF is using older fastpath HSI; %02x.%02x is configured\n",
@@ -572,7 +571,7 @@ free_p_iov:
 static void
 __qed_vf_prep_tunn_req_tlv(struct vfpf_update_tunn_param_tlv *p_req,
                            struct qed_tunn_update_type *p_src,
-                           enum qed_tunn_clss mask, u8 *p_cls)
+                           enum qed_tunn_mode mask, u8 *p_cls)
 {
         if (p_src->b_update_mode) {
                 p_req->tun_mode_update_mask |= BIT(mask);
@@ -587,7 +586,7 @@ __qed_vf_prep_tunn_req_tlv(struct vfpf_update_tunn_param_tlv *p_req,
 static void
 qed_vf_prep_tunn_req_tlv(struct vfpf_update_tunn_param_tlv *p_req,
                          struct qed_tunn_update_type *p_src,
-                         enum qed_tunn_clss mask,
+                         enum qed_tunn_mode mask,
                          u8 *p_cls, struct qed_tunn_update_udp_port *p_port,
                          u8 *p_update_port, u16 *p_udp_port)
 {
diff --git a/drivers/net/ethernet/qlogic/qede/qede_filter.c b/drivers/net/ethernet/qlogic/qede/qede_filter.c
index 9673d19308e6..b16ce7d93caf 100644
--- a/drivers/net/ethernet/qlogic/qede/qede_filter.c
+++ b/drivers/net/ethernet/qlogic/qede/qede_filter.c
@@ -2006,18 +2006,16 @@ unlock:
 static int qede_parse_actions(struct qede_dev *edev,
                               struct tcf_exts *exts)
 {
-        int rc = -EINVAL, num_act = 0;
+        int rc = -EINVAL, num_act = 0, i;
         const struct tc_action *a;
         bool is_drop = false;
-        LIST_HEAD(actions);
 
         if (!tcf_exts_has_actions(exts)) {
                 DP_NOTICE(edev, "No tc actions received\n");
                 return rc;
         }
 
-        tcf_exts_to_list(exts, &actions);
-        list_for_each_entry(a, &actions, list) {
+        tcf_exts_for_each_action(i, a, exts) {
                 num_act++;
 
                 if (is_tcf_gact_shot(a))
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
index 81312924df14..0c443ea98479 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
@@ -1800,7 +1800,8 @@ struct qlcnic_hardware_ops {
         int (*config_loopback) (struct qlcnic_adapter *, u8);
         int (*clear_loopback) (struct qlcnic_adapter *, u8);
         int (*config_promisc_mode) (struct qlcnic_adapter *, u32);
-        void (*change_l2_filter) (struct qlcnic_adapter *, u64 *, u16);
+        void (*change_l2_filter)(struct qlcnic_adapter *adapter, u64 *addr,
+                                 u16 vlan, struct qlcnic_host_tx_ring *tx_ring);
         int (*get_board_info) (struct qlcnic_adapter *);
         void (*set_mac_filter_count) (struct qlcnic_adapter *);
         void (*free_mac_list) (struct qlcnic_adapter *);
@@ -2064,9 +2065,10 @@ static inline int qlcnic_nic_set_promisc(struct qlcnic_adapter *adapter,
 }
 
 static inline void qlcnic_change_filter(struct qlcnic_adapter *adapter,
-                                        u64 *addr, u16 id)
+                                        u64 *addr, u16 vlan,
+                                        struct qlcnic_host_tx_ring *tx_ring)
 {
-        adapter->ahw->hw_ops->change_l2_filter(adapter, addr, id);
+        adapter->ahw->hw_ops->change_l2_filter(adapter, addr, vlan, tx_ring);
 }
 
 static inline int qlcnic_get_board_info(struct qlcnic_adapter *adapter)
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
index 569d54ededec..a79d84f99102 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
@@ -2135,7 +2135,8 @@ out:
 }
 
 void qlcnic_83xx_change_l2_filter(struct qlcnic_adapter *adapter, u64 *addr,
-                                  u16 vlan_id)
+                                  u16 vlan_id,
+                                  struct qlcnic_host_tx_ring *tx_ring)
 {
         u8 mac[ETH_ALEN];
         memcpy(&mac, addr, ETH_ALEN);
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.h
index b75a81246856..73fe2f64491d 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.h
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.h
@@ -550,7 +550,8 @@ int qlcnic_83xx_wrt_reg_indirect(struct qlcnic_adapter *, ulong, u32);
 int qlcnic_83xx_nic_set_promisc(struct qlcnic_adapter *, u32);
 int qlcnic_83xx_config_hw_lro(struct qlcnic_adapter *, int);
 int qlcnic_83xx_config_rss(struct qlcnic_adapter *, int);
-void qlcnic_83xx_change_l2_filter(struct qlcnic_adapter *, u64 *, u16);
+void qlcnic_83xx_change_l2_filter(struct qlcnic_adapter *adapter, u64 *addr,
+                                  u16 vlan, struct qlcnic_host_tx_ring *ring);
 int qlcnic_83xx_get_pci_info(struct qlcnic_adapter *, struct qlcnic_pci_info *);
 int qlcnic_83xx_set_nic_info(struct qlcnic_adapter *, struct qlcnic_info *);
 void qlcnic_83xx_initialize_nic(struct qlcnic_adapter *, int);
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.h
index 4bb33af8e2b3..56a3bd9e37dc 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.h
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.h
@@ -173,7 +173,8 @@ int qlcnic_82xx_napi_add(struct qlcnic_adapter *adapter,
                          struct net_device *netdev);
 void qlcnic_82xx_get_beacon_state(struct qlcnic_adapter *);
 void qlcnic_82xx_change_filter(struct qlcnic_adapter *adapter,
-                               u64 *uaddr, u16 vlan_id);
+                               u64 *uaddr, u16 vlan_id,
+                               struct qlcnic_host_tx_ring *tx_ring);
 int qlcnic_82xx_config_intr_coalesce(struct qlcnic_adapter *,
                                      struct ethtool_coalesce *);
 int qlcnic_82xx_set_rx_coalesce(struct qlcnic_adapter *);
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c
index 84dd83031a1b..9647578cbe6a 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c
@@ -268,13 +268,12 @@ static void qlcnic_add_lb_filter(struct qlcnic_adapter *adapter,
 }
 
 void qlcnic_82xx_change_filter(struct qlcnic_adapter *adapter, u64 *uaddr,
-                               u16 vlan_id)
+                               u16 vlan_id, struct qlcnic_host_tx_ring *tx_ring)
 {
         struct cmd_desc_type0 *hwdesc;
         struct qlcnic_nic_req *req;
         struct qlcnic_mac_req *mac_req;
         struct qlcnic_vlan_req *vlan_req;
-        struct qlcnic_host_tx_ring *tx_ring = adapter->tx_ring;
         u32 producer;
         u64 word;
 
@@ -301,7 +300,8 @@ void qlcnic_82xx_change_filter(struct qlcnic_adapter *adapter, u64 *uaddr,
 
 static void qlcnic_send_filter(struct qlcnic_adapter *adapter,
                                struct cmd_desc_type0 *first_desc,
-                               struct sk_buff *skb)
+                               struct sk_buff *skb,
+                               struct qlcnic_host_tx_ring *tx_ring)
 {
         struct vlan_ethhdr *vh = (struct vlan_ethhdr *)(skb->data);
         struct ethhdr *phdr = (struct ethhdr *)(skb->data);
@@ -335,7 +335,7 @@ static void qlcnic_send_filter(struct qlcnic_adapter *adapter,
                     tmp_fil->vlan_id == vlan_id) {
                         if (jiffies > (QLCNIC_READD_AGE * HZ + tmp_fil->ftime))
                                 qlcnic_change_filter(adapter, &src_addr,
-                                                     vlan_id);
+                                                     vlan_id, tx_ring);
                         tmp_fil->ftime = jiffies;
                         return;
                 }
@@ -350,7 +350,7 @@ static void qlcnic_send_filter(struct qlcnic_adapter *adapter,
         if (!fil)
                 return;
 
-        qlcnic_change_filter(adapter, &src_addr, vlan_id);
+        qlcnic_change_filter(adapter, &src_addr, vlan_id, tx_ring);
         fil->ftime = jiffies;
         fil->vlan_id = vlan_id;
         memcpy(fil->faddr, &src_addr, ETH_ALEN);
@@ -766,7 +766,7 @@ netdev_tx_t qlcnic_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
         }
 
         if (adapter->drv_mac_learn)
-                qlcnic_send_filter(adapter, first_desc, skb);
+                qlcnic_send_filter(adapter, first_desc, skb, tx_ring);
 
         tx_ring->tx_stats.tx_bytes += skb->len;
         tx_ring->tx_stats.xmit_called++;
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
index 2d38d1ac2aae..dbd48012224f 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
@@ -59,9 +59,6 @@ static int qlcnic_close(struct net_device *netdev);
 static void qlcnic_tx_timeout(struct net_device *netdev);
 static void qlcnic_attach_work(struct work_struct *work);
 static void qlcnic_fwinit_work(struct work_struct *work);
-#ifdef CONFIG_NET_POLL_CONTROLLER
-static void qlcnic_poll_controller(struct net_device *netdev);
-#endif
 
 static void qlcnic_idc_debug_info(struct qlcnic_adapter *adapter, u8 encoding);
 static int qlcnic_can_start_firmware(struct qlcnic_adapter *adapter);
@@ -545,9 +542,6 @@ static const struct net_device_ops qlcnic_netdev_ops = {
         .ndo_udp_tunnel_add     = qlcnic_add_vxlan_port,
         .ndo_udp_tunnel_del     = qlcnic_del_vxlan_port,
         .ndo_features_check     = qlcnic_features_check,
-#ifdef CONFIG_NET_POLL_CONTROLLER
-        .ndo_poll_controller = qlcnic_poll_controller,
-#endif
 #ifdef CONFIG_QLCNIC_SRIOV
         .ndo_set_vf_mac         = qlcnic_sriov_set_vf_mac,
         .ndo_set_vf_rate        = qlcnic_sriov_set_vf_tx_rate,
@@ -3200,45 +3194,6 @@ static irqreturn_t qlcnic_msix_tx_intr(int irq, void *data)
         return IRQ_HANDLED;
 }
 
-#ifdef CONFIG_NET_POLL_CONTROLLER
-static void qlcnic_poll_controller(struct net_device *netdev)
-{
-        struct qlcnic_adapter *adapter = netdev_priv(netdev);
-        struct qlcnic_host_sds_ring *sds_ring;
-        struct qlcnic_recv_context *recv_ctx;
-        struct qlcnic_host_tx_ring *tx_ring;
-        int ring;
-
-        if (!test_bit(__QLCNIC_DEV_UP, &adapter->state))
-                return;
-
-        recv_ctx = adapter->recv_ctx;
-
-        for (ring = 0; ring < adapter->drv_sds_rings; ring++) {
-                sds_ring = &recv_ctx->sds_rings[ring];
-                qlcnic_disable_sds_intr(adapter, sds_ring);
-                napi_schedule(&sds_ring->napi);
-        }
-
-        if (adapter->flags & QLCNIC_MSIX_ENABLED) {
-                /* Only Multi-Tx queue capable devices need to
-                 * schedule NAPI for TX rings
-                 */
-                if ((qlcnic_83xx_check(adapter) &&
-                     (adapter->flags & QLCNIC_TX_INTR_SHARED)) ||
-                    (qlcnic_82xx_check(adapter) &&
-                     !qlcnic_check_multi_tx(adapter)))
-                        return;
-
-                for (ring = 0; ring < adapter->drv_tx_rings; ring++) {
-                        tx_ring = &adapter->tx_ring[ring];
-                        qlcnic_disable_tx_intr(adapter, tx_ring);
-                        napi_schedule(&tx_ring->napi);
-                }
-        }
-}
-#endif
-
 static void
 qlcnic_idc_debug_info(struct qlcnic_adapter *adapter, u8 encoding)
 {
diff --git a/drivers/net/ethernet/qlogic/qlge/qlge_main.c b/drivers/net/ethernet/qlogic/qlge/qlge_main.c
index 353f1c129af1..059ba9429e51 100644
--- a/drivers/net/ethernet/qlogic/qlge/qlge_main.c
+++ b/drivers/net/ethernet/qlogic/qlge/qlge_main.c
@@ -2384,26 +2384,20 @@ static int qlge_update_hw_vlan_features(struct net_device *ndev,
         return status;
 }
 
-static netdev_features_t qlge_fix_features(struct net_device *ndev,
-        netdev_features_t features)
-{
-        int err;
-
-        /* Update the behavior of vlan accel in the adapter */
-        err = qlge_update_hw_vlan_features(ndev, features);
-        if (err)
-                return err;
-
-        return features;
-}
-
 static int qlge_set_features(struct net_device *ndev,
         netdev_features_t features)
 {
         netdev_features_t changed = ndev->features ^ features;
+        int err;
+
+        if (changed & NETIF_F_HW_VLAN_CTAG_RX) {
+                /* Update the behavior of vlan accel in the adapter */
+                err = qlge_update_hw_vlan_features(ndev, features);
+                if (err)
+                        return err;
 
-        if (changed & NETIF_F_HW_VLAN_CTAG_RX)
                 qlge_vlan_mode(ndev, features);
+        }
 
         return 0;
 }
@@ -4719,7 +4713,6 @@ static const struct net_device_ops qlge_netdev_ops = {
         .ndo_set_mac_address    = qlge_set_mac_address,
         .ndo_validate_addr      = eth_validate_addr,
         .ndo_tx_timeout         = qlge_tx_timeout,
-        .ndo_fix_features       = qlge_fix_features,
         .ndo_set_features       = qlge_set_features,
         .ndo_vlan_rx_add_vid    = qlge_vlan_rx_add_vid,
         .ndo_vlan_rx_kill_vid   = qlge_vlan_rx_kill_vid,
diff --git a/drivers/net/ethernet/qualcomm/qca_7k.c b/drivers/net/ethernet/qualcomm/qca_7k.c
index ffe7a16bdfc8..6c8543fb90c0 100644
--- a/drivers/net/ethernet/qualcomm/qca_7k.c
+++ b/drivers/net/ethernet/qualcomm/qca_7k.c
@@ -45,34 +45,33 @@ qcaspi_read_register(struct qcaspi *qca, u16 reg, u16 *result)
 {
         __be16 rx_data;
         __be16 tx_data;
-        struct spi_transfer *transfer;
-        struct spi_message *msg;
+        struct spi_transfer transfer[2];
+        struct spi_message msg;
         int ret;
 
+        memset(transfer, 0, sizeof(transfer));
+
+        spi_message_init(&msg);
+
         tx_data = cpu_to_be16(QCA7K_SPI_READ | QCA7K_SPI_INTERNAL | reg);
+        *result = 0;
+
+        transfer[0].tx_buf = &tx_data;
+        transfer[0].len = QCASPI_CMD_LEN;
+        transfer[1].rx_buf = &rx_data;
+        transfer[1].len = QCASPI_CMD_LEN;
+
+        spi_message_add_tail(&transfer[0], &msg);
 
         if (qca->legacy_mode) {
-                msg = &qca->spi_msg1;
-                transfer = &qca->spi_xfer1;
-                transfer->tx_buf = &tx_data;
-                transfer->rx_buf = NULL;
-                transfer->len = QCASPI_CMD_LEN;
-                spi_sync(qca->spi_dev, msg);
-        } else {
-                msg = &qca->spi_msg2;
-                transfer = &qca->spi_xfer2[0];
-                transfer->tx_buf = &tx_data;
-                transfer->rx_buf = NULL;
-                transfer->len = QCASPI_CMD_LEN;
-                transfer = &qca->spi_xfer2[1];
+                spi_sync(qca->spi_dev, &msg);
+                spi_message_init(&msg);
         }
-        transfer->tx_buf = NULL;
-        transfer->rx_buf = &rx_data;
-        transfer->len = QCASPI_CMD_LEN;
-        ret = spi_sync(qca->spi_dev, msg);
+        spi_message_add_tail(&transfer[1], &msg);
+        ret = spi_sync(qca->spi_dev, &msg);
 
         if (!ret)
-                ret = msg->status;
+                ret = msg.status;
 
         if (ret)
                 qcaspi_spi_error(qca);
@@ -86,35 +85,32 @@ int
 qcaspi_write_register(struct qcaspi *qca, u16 reg, u16 value)
 {
         __be16 tx_data[2];
-        struct spi_transfer *transfer;
-        struct spi_message *msg;
+        struct spi_transfer transfer[2];
+        struct spi_message msg;
         int ret;
 
+        memset(&transfer, 0, sizeof(transfer));
+
+        spi_message_init(&msg);
+
         tx_data[0] = cpu_to_be16(QCA7K_SPI_WRITE | QCA7K_SPI_INTERNAL | reg);
         tx_data[1] = cpu_to_be16(value);
 
+        transfer[0].tx_buf = &tx_data[0];
+        transfer[0].len = QCASPI_CMD_LEN;
+        transfer[1].tx_buf = &tx_data[1];
+        transfer[1].len = QCASPI_CMD_LEN;
+
+        spi_message_add_tail(&transfer[0], &msg);
         if (qca->legacy_mode) {
-                msg = &qca->spi_msg1;
-                transfer = &qca->spi_xfer1;
-                transfer->tx_buf = &tx_data[0];
-                transfer->rx_buf = NULL;
-                transfer->len = QCASPI_CMD_LEN;
-                spi_sync(qca->spi_dev, msg);
-        } else {
-                msg = &qca->spi_msg2;
-                transfer = &qca->spi_xfer2[0];
-                transfer->tx_buf = &tx_data[0];
-                transfer->rx_buf = NULL;
-                transfer->len = QCASPI_CMD_LEN;
-                transfer = &qca->spi_xfer2[1];
+                spi_sync(qca->spi_dev, &msg);
+                spi_message_init(&msg);
         }
-        transfer->tx_buf = &tx_data[1];
-        transfer->rx_buf = NULL;
-        transfer->len = QCASPI_CMD_LEN;
-        ret = spi_sync(qca->spi_dev, msg);
+        spi_message_add_tail(&transfer[1], &msg);
+        ret = spi_sync(qca->spi_dev, &msg);
 
         if (!ret)
-                ret = msg->status;
+                ret = msg.status;
 
         if (ret)
                 qcaspi_spi_error(qca);
diff --git a/drivers/net/ethernet/qualcomm/qca_spi.c b/drivers/net/ethernet/qualcomm/qca_spi.c
index 206f0266463e..66b775d462fd 100644
--- a/drivers/net/ethernet/qualcomm/qca_spi.c
+++ b/drivers/net/ethernet/qualcomm/qca_spi.c
@@ -99,22 +99,24 @@ static u32
 qcaspi_write_burst(struct qcaspi *qca, u8 *src, u32 len)
 {
         __be16 cmd;
-        struct spi_message *msg = &qca->spi_msg2;
-        struct spi_transfer *transfer = &qca->spi_xfer2[0];
+        struct spi_message msg;
+        struct spi_transfer transfer[2];
         int ret;
 
+        memset(&transfer, 0, sizeof(transfer));
+        spi_message_init(&msg);
+
         cmd = cpu_to_be16(QCA7K_SPI_WRITE | QCA7K_SPI_EXTERNAL);
-        transfer->tx_buf = &cmd;
-        transfer->rx_buf = NULL;
-        transfer->len = QCASPI_CMD_LEN;
-        transfer = &qca->spi_xfer2[1];
-        transfer->tx_buf = src;
-        transfer->rx_buf = NULL;
-        transfer->len = len;
+        transfer[0].tx_buf = &cmd;
+        transfer[0].len = QCASPI_CMD_LEN;
+        transfer[1].tx_buf = src;
+        transfer[1].len = len;
 
-        ret = spi_sync(qca->spi_dev, msg);
+        spi_message_add_tail(&transfer[0], &msg);
+        spi_message_add_tail(&transfer[1], &msg);
+        ret = spi_sync(qca->spi_dev, &msg);
 
-        if (ret || (msg->actual_length != QCASPI_CMD_LEN + len)) {
+        if (ret || (msg.actual_length != QCASPI_CMD_LEN + len)) {
                 qcaspi_spi_error(qca);
                 return 0;
         }
@@ -125,17 +127,20 @@ qcaspi_write_burst(struct qcaspi *qca, u8 *src, u32 len)
 static u32
 qcaspi_write_legacy(struct qcaspi *qca, u8 *src, u32 len)
 {
-        struct spi_message *msg = &qca->spi_msg1;
-        struct spi_transfer *transfer = &qca->spi_xfer1;
+        struct spi_message msg;
+        struct spi_transfer transfer;
         int ret;
 
-        transfer->tx_buf = src;
-        transfer->rx_buf = NULL;
-        transfer->len = len;
+        memset(&transfer, 0, sizeof(transfer));
+        spi_message_init(&msg);
+
+        transfer.tx_buf = src;
+        transfer.len = len;
 
-        ret = spi_sync(qca->spi_dev, msg);
+        spi_message_add_tail(&transfer, &msg);
+        ret = spi_sync(qca->spi_dev, &msg);
 
-        if (ret || (msg->actual_length != len)) {
+        if (ret || (msg.actual_length != len)) {
                 qcaspi_spi_error(qca);
                 return 0;
         }
@@ -146,23 +151,25 @@ qcaspi_write_legacy(struct qcaspi *qca, u8 *src, u32 len)
 static u32
 qcaspi_read_burst(struct qcaspi *qca, u8 *dst, u32 len)
 {
-        struct spi_message *msg = &qca->spi_msg2;
+        struct spi_message msg;
         __be16 cmd;
-        struct spi_transfer *transfer = &qca->spi_xfer2[0];
+        struct spi_transfer transfer[2];
         int ret;
 
+        memset(&transfer, 0, sizeof(transfer));
+        spi_message_init(&msg);
+
         cmd = cpu_to_be16(QCA7K_SPI_READ | QCA7K_SPI_EXTERNAL);
-        transfer->tx_buf = &cmd;
-        transfer->rx_buf = NULL;
-        transfer->len = QCASPI_CMD_LEN;
-        transfer = &qca->spi_xfer2[1];
-        transfer->tx_buf = NULL;
-        transfer->rx_buf = dst;
-        transfer->len = len;
+        transfer[0].tx_buf = &cmd;
+        transfer[0].len = QCASPI_CMD_LEN;
+        transfer[1].rx_buf = dst;
+        transfer[1].len = len;
 
-        ret = spi_sync(qca->spi_dev, msg);
+        spi_message_add_tail(&transfer[0], &msg);
+        spi_message_add_tail(&transfer[1], &msg);
+        ret = spi_sync(qca->spi_dev, &msg);
 
-        if (ret || (msg->actual_length != QCASPI_CMD_LEN + len)) {
+        if (ret || (msg.actual_length != QCASPI_CMD_LEN + len)) {
                 qcaspi_spi_error(qca);
                 return 0;
         }
@@ -173,17 +180,20 @@ qcaspi_read_burst(struct qcaspi *qca, u8 *dst, u32 len)
 static u32
 qcaspi_read_legacy(struct qcaspi *qca, u8 *dst, u32 len)
 {
-        struct spi_message *msg = &qca->spi_msg1;
-        struct spi_transfer *transfer = &qca->spi_xfer1;
+        struct spi_message msg;
+        struct spi_transfer transfer;
         int ret;
 
-        transfer->tx_buf = NULL;
-        transfer->rx_buf = dst;
-        transfer->len = len;
+        memset(&transfer, 0, sizeof(transfer));
+        spi_message_init(&msg);
 
-        ret = spi_sync(qca->spi_dev, msg);
+        transfer.rx_buf = dst;
+        transfer.len = len;
 
-        if (ret || (msg->actual_length != len)) {
+        spi_message_add_tail(&transfer, &msg);
+        ret = spi_sync(qca->spi_dev, &msg);
+
+        if (ret || (msg.actual_length != len)) {
                 qcaspi_spi_error(qca);
                 return 0;
         }
@@ -195,19 +205,23 @@ static int
 qcaspi_tx_cmd(struct qcaspi *qca, u16 cmd)
 {
         __be16 tx_data;
-        struct spi_message *msg = &qca->spi_msg1;
-        struct spi_transfer *transfer = &qca->spi_xfer1;
+        struct spi_message msg;
+        struct spi_transfer transfer;
         int ret;
 
+        memset(&transfer, 0, sizeof(transfer));
+
+        spi_message_init(&msg);
+
         tx_data = cpu_to_be16(cmd);
-        transfer->len = sizeof(tx_data);
-        transfer->tx_buf = &tx_data;
-        transfer->rx_buf = NULL;
+        transfer.len = sizeof(cmd);
+        transfer.tx_buf = &tx_data;
+        spi_message_add_tail(&transfer, &msg);
 
-        ret = spi_sync(qca->spi_dev, msg);
+        ret = spi_sync(qca->spi_dev, &msg);
 
         if (!ret)
-                ret = msg->status;
+                ret = msg.status;
 
         if (ret)
                 qcaspi_spi_error(qca);
@@ -835,16 +849,6 @@ qcaspi_netdev_setup(struct net_device *dev)
         qca = netdev_priv(dev);
         memset(qca, 0, sizeof(struct qcaspi));
 
-        memset(&qca->spi_xfer1, 0, sizeof(struct spi_transfer));
-        memset(&qca->spi_xfer2, 0, sizeof(struct spi_transfer) * 2);
-
-        spi_message_init(&qca->spi_msg1);
-        spi_message_add_tail(&qca->spi_xfer1, &qca->spi_msg1);
-
-        spi_message_init(&qca->spi_msg2);
-        spi_message_add_tail(&qca->spi_xfer2[0], &qca->spi_msg2);
-        spi_message_add_tail(&qca->spi_xfer2[1], &qca->spi_msg2);
-
         memset(&qca->txr, 0, sizeof(qca->txr));
         qca->txr.count = TX_RING_MAX_LEN;
 }
diff --git a/drivers/net/ethernet/qualcomm/qca_spi.h b/drivers/net/ethernet/qualcomm/qca_spi.h
index fc4beb1b32d1..fc0e98726b36 100644
--- a/drivers/net/ethernet/qualcomm/qca_spi.h
+++ b/drivers/net/ethernet/qualcomm/qca_spi.h
@@ -83,11 +83,6 @@ struct qcaspi {
         struct tx_ring txr;
         struct qcaspi_stats stats;
 
-        struct spi_message spi_msg1;
-        struct spi_message spi_msg2;
-        struct spi_transfer spi_xfer1;
-        struct spi_transfer spi_xfer2[2];
-
         u8 *rx_buffer;
         u32 buffer_size;
         u8 sync;
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index 0efa977c422d..a94b874982dc 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -13,6 +13,7 @@
 #include <linux/pci.h>
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
+#include <linux/clk.h>
 #include <linux/delay.h>
 #include <linux/ethtool.h>
 #include <linux/phy.h>
@@ -218,6 +219,7 @@ static const struct pci_device_id rtl8169_pci_tbl[] = {
         { PCI_DEVICE(PCI_VENDOR_ID_REALTEK,     0x8161), 0, 0, RTL_CFG_1 },
         { PCI_DEVICE(PCI_VENDOR_ID_REALTEK,     0x8167), 0, 0, RTL_CFG_0 },
         { PCI_DEVICE(PCI_VENDOR_ID_REALTEK,     0x8168), 0, 0, RTL_CFG_1 },
+        { PCI_DEVICE(PCI_VENDOR_ID_NCUBE,       0x8168), 0, 0, RTL_CFG_1 },
         { PCI_DEVICE(PCI_VENDOR_ID_REALTEK,     0x8169), 0, 0, RTL_CFG_0 },
         { PCI_VENDOR_ID_DLINK,                  0x4300,
                 PCI_VENDOR_ID_DLINK, 0x4b10,             0, 0, RTL_CFG_1 },
@@ -630,7 +632,7 @@ struct rtl8169_tc_offsets {
 };
 
 enum rtl_flag {
-        RTL_FLAG_TASK_ENABLED,
+        RTL_FLAG_TASK_ENABLED = 0,
         RTL_FLAG_TASK_SLOW_PENDING,
         RTL_FLAG_TASK_RESET_PENDING,
         RTL_FLAG_MAX
@@ -664,6 +666,7 @@ struct rtl8169_private {
 
         u16 event_slow;
         const struct rtl_coalesce_info *coalesce_info;
+        struct clk *clk;
 
         struct mdio_ops {
                 void (*write)(struct rtl8169_private *, int, int);
@@ -4068,6 +4071,15 @@ static void rtl8169_init_phy(struct net_device *dev, struct rtl8169_private *tp)
         phy_speed_up(dev->phydev);
 
         genphy_soft_reset(dev->phydev);
+
+        /* It was reported that chip version 33 ends up with 10MBit/Half on a
+         * 1GBit link after resuming from S3. For whatever reason the PHY on
+         * this chip doesn't properly start a renegotiation when soft-reset.
+         * Explicitly requesting a renegotiation fixes this.
+         */
+        if (tp->mac_version == RTL_GIGA_MAC_VER_33 &&
+            dev->phydev->autoneg == AUTONEG_ENABLE)
+                phy_restart_aneg(dev->phydev);
 }
 
 static void rtl_rar_set(struct rtl8169_private *tp, u8 *addr)
@@ -4522,11 +4534,16 @@ static void rtl8169_hw_reset(struct rtl8169_private *tp)
         rtl_hw_reset(tp);
 }
 
-static void rtl_set_rx_tx_config_registers(struct rtl8169_private *tp)
+static void rtl_set_tx_config_registers(struct rtl8169_private *tp)
 {
-        /* Set DMA burst size and Interframe Gap Time */
-        RTL_W32(tp, TxConfig, (TX_DMA_BURST << TxDMAShift) |
-                (InterFrameGap << TxInterFrameGapShift));
+        u32 val = TX_DMA_BURST << TxDMAShift |
+                  InterFrameGap << TxInterFrameGapShift;
+
+        if (tp->mac_version >= RTL_GIGA_MAC_VER_34 &&
+            tp->mac_version != RTL_GIGA_MAC_VER_39)
+                val |= TXCFG_AUTO_FIFO;
+
+        RTL_W32(tp, TxConfig, val);
 }
 
 static void rtl_set_rx_max_size(struct rtl8169_private *tp)
@@ -4633,12 +4650,14 @@ static void rtl_hw_start(struct  rtl8169_private *tp)
 
         rtl_set_rx_max_size(tp);
         rtl_set_rx_tx_desc_registers(tp);
-        rtl_set_rx_tx_config_registers(tp);
         RTL_W8(tp, Cfg9346, Cfg9346_Lock);
 
         /* Initially a 10 us delay. Turned it into a PCI commit. - FR */
         RTL_R8(tp, IntrMask);
         RTL_W8(tp, ChipCmd, CmdTxEnb | CmdRxEnb);
+        rtl_init_rxcfg(tp);
+        rtl_set_tx_config_registers(tp);
+
         rtl_set_rx_mode(tp->dev);
         /* no early-rx interrupts */
         RTL_W16(tp, MultiIntr, RTL_R16(tp, MultiIntr) & 0xf000);
@@ -4772,12 +4791,14 @@ static void rtl_pcie_state_l2l3_enable(struct rtl8169_private *tp, bool enable)
 static void rtl_hw_aspm_clkreq_enable(struct rtl8169_private *tp, bool enable)
 {
         if (enable) {
-                RTL_W8(tp, Config2, RTL_R8(tp, Config2) | ClkReqEn);
                 RTL_W8(tp, Config5, RTL_R8(tp, Config5) | ASPM_en);
+                RTL_W8(tp, Config2, RTL_R8(tp, Config2) | ClkReqEn);
         } else {
                 RTL_W8(tp, Config2, RTL_R8(tp, Config2) & ~ClkReqEn);
                 RTL_W8(tp, Config5, RTL_R8(tp, Config5) & ~ASPM_en);
         }
+
+        udelay(10);
 }
 
 static void rtl_hw_start_8168bb(struct rtl8169_private *tp)
@@ -5017,7 +5038,6 @@ static void rtl_hw_start_8168e_2(struct rtl8169_private *tp)
 
         rtl_disable_clock_request(tp);
 
-        RTL_W32(tp, TxConfig, RTL_R32(tp, TxConfig) | TXCFG_AUTO_FIFO);
         RTL_W8(tp, MCU, RTL_R8(tp, MCU) & ~NOW_IS_OOB);
 
         /* Adjust EEE LED frequency */
@@ -5051,7 +5071,6 @@ static void rtl_hw_start_8168f(struct rtl8169_private *tp)
 
         rtl_disable_clock_request(tp);
 
-        RTL_W32(tp, TxConfig, RTL_R32(tp, TxConfig) | TXCFG_AUTO_FIFO);
         RTL_W8(tp, MCU, RTL_R8(tp, MCU) & ~NOW_IS_OOB);
         RTL_W8(tp, DLLPR, RTL_R8(tp, DLLPR) | PFM_EN);
         RTL_W32(tp, MISC, RTL_R32(tp, MISC) | PWM_EN);
@@ -5096,8 +5115,6 @@ static void rtl_hw_start_8411(struct rtl8169_private *tp)
 
 static void rtl_hw_start_8168g(struct rtl8169_private *tp)
 {
-        RTL_W32(tp, TxConfig, RTL_R32(tp, TxConfig) | TXCFG_AUTO_FIFO);
-
         rtl_eri_write(tp, 0xc8, ERIAR_MASK_0101, 0x080002, ERIAR_EXGMAC);
         rtl_eri_write(tp, 0xcc, ERIAR_MASK_0001, 0x38, ERIAR_EXGMAC);
         rtl_eri_write(tp, 0xd0, ERIAR_MASK_0001, 0x48, ERIAR_EXGMAC);
@@ -5195,8 +5212,6 @@ static void rtl_hw_start_8168h_1(struct rtl8169_private *tp)
         rtl_hw_aspm_clkreq_enable(tp, false);
         rtl_ephy_init(tp, e_info_8168h_1, ARRAY_SIZE(e_info_8168h_1));
 
-        RTL_W32(tp, TxConfig, RTL_R32(tp, TxConfig) | TXCFG_AUTO_FIFO);
-
         rtl_eri_write(tp, 0xc8, ERIAR_MASK_0101, 0x00080002, ERIAR_EXGMAC);
         rtl_eri_write(tp, 0xcc, ERIAR_MASK_0001, 0x38, ERIAR_EXGMAC);
         rtl_eri_write(tp, 0xd0, ERIAR_MASK_0001, 0x48, ERIAR_EXGMAC);
@@ -5279,8 +5294,6 @@ static void rtl_hw_start_8168ep(struct rtl8169_private *tp)
 {
         rtl8168ep_stop_cmac(tp);
 
-        RTL_W32(tp, TxConfig, RTL_R32(tp, TxConfig) | TXCFG_AUTO_FIFO);
-
         rtl_eri_write(tp, 0xc8, ERIAR_MASK_0101, 0x00080002, ERIAR_EXGMAC);
         rtl_eri_write(tp, 0xcc, ERIAR_MASK_0001, 0x2f, ERIAR_EXGMAC);
         rtl_eri_write(tp, 0xd0, ERIAR_MASK_0001, 0x5f, ERIAR_EXGMAC);
@@ -5602,7 +5615,6 @@ static void rtl_hw_start_8402(struct rtl8169_private *tp)
         /* Force LAN exit from ASPM if Rx/Tx are not idle */
         RTL_W32(tp, FuncEvent, RTL_R32(tp, FuncEvent) | 0x002800);
 
-        RTL_W32(tp, TxConfig, RTL_R32(tp, TxConfig) | TXCFG_AUTO_FIFO);
         RTL_W8(tp, MCU, RTL_R8(tp, MCU) & ~NOW_IS_OOB);
 
         rtl_ephy_init(tp, e_info_8402, ARRAY_SIZE(e_info_8402));
@@ -5622,6 +5634,8 @@ static void rtl_hw_start_8402(struct rtl8169_private *tp)
 
 static void rtl_hw_start_8106(struct rtl8169_private *tp)
 {
+        rtl_hw_aspm_clkreq_enable(tp, false);
+
         /* Force LAN exit from ASPM if Rx/Tx are not idle */
         RTL_W32(tp, FuncEvent, RTL_R32(tp, FuncEvent) | 0x002800);
 
@@ -5630,6 +5644,7 @@ static void rtl_hw_start_8106(struct rtl8169_private *tp)
         RTL_W8(tp, DLLPR, RTL_R8(tp, DLLPR) & ~PFM_EN);
 
         rtl_pcie_state_l2l3_enable(tp, false);
+        rtl_hw_aspm_clkreq_enable(tp, true);
 }
 
 static void rtl_hw_start_8101(struct rtl8169_private *tp)
@@ -6652,7 +6667,8 @@ static int rtl8169_close(struct net_device *dev)
         rtl8169_update_counters(tp);
 
         rtl_lock_work(tp);
-        clear_bit(RTL_FLAG_TASK_ENABLED, tp->wk.flags);
+        /* Clear all task flags */
+        bitmap_zero(tp->wk.flags, RTL_FLAG_MAX);
 
         rtl8169_down(dev);
         rtl_unlock_work(tp);
@@ -6835,7 +6851,9 @@ static void rtl8169_net_suspend(struct net_device *dev)
 
         rtl_lock_work(tp);
         napi_disable(&tp->napi);
-        clear_bit(RTL_FLAG_TASK_ENABLED, tp->wk.flags);
+        /* Clear all task flags */
+        bitmap_zero(tp->wk.flags, RTL_FLAG_MAX);
+
         rtl_unlock_work(tp);
 
         rtl_pll_power_down(tp);
@@ -6847,8 +6865,10 @@ static int rtl8169_suspend(struct device *device)
 {
         struct pci_dev *pdev = to_pci_dev(device);
         struct net_device *dev = pci_get_drvdata(pdev);
+        struct rtl8169_private *tp = netdev_priv(dev);
 
         rtl8169_net_suspend(dev);
+        clk_disable_unprepare(tp->clk);
 
         return 0;
 }
@@ -6876,6 +6896,9 @@ static int rtl8169_resume(struct device *device)
 {
         struct pci_dev *pdev = to_pci_dev(device);
         struct net_device *dev = pci_get_drvdata(pdev);
+        struct rtl8169_private *tp = netdev_priv(dev);
+
+        clk_prepare_enable(tp->clk);
 
         if (netif_running(dev))
                 __rtl8169_resume(dev);
@@ -7251,6 +7274,11 @@ static int rtl_jumbo_max(struct rtl8169_private *tp)
         }
 }
 
+static void rtl_disable_clk(void *data)
+{
+        clk_disable_unprepare(data);
+}
+
 static int rtl_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
 {
         const struct rtl_cfg_info *cfg = rtl_cfg_infos + ent->driver_data;
@@ -7271,6 +7299,32 @@ static int rtl_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         tp->msg_enable = netif_msg_init(debug.msg_enable, R8169_MSG_DEFAULT);
         tp->supports_gmii = cfg->has_gmii;
 
+        /* Get the *optional* external "ether_clk" used on some boards */
+        tp->clk = devm_clk_get(&pdev->dev, "ether_clk");
+        if (IS_ERR(tp->clk)) {
+                rc = PTR_ERR(tp->clk);
+                if (rc == -ENOENT) {
+                        /* clk-core allows NULL (for suspend / resume) */
+                        tp->clk = NULL;
+                } else if (rc == -EPROBE_DEFER) {
+                        return rc;
+                } else {
+                        dev_err(&pdev->dev, "failed to get clk: %d\n", rc);
+                        return rc;
+                }
+        } else {
+                rc = clk_prepare_enable(tp->clk);
+                if (rc) {
+                        dev_err(&pdev->dev, "failed to enable clk: %d\n", rc);
+                        return rc;
+                }
+
+                rc = devm_add_action_or_reset(&pdev->dev, rtl_disable_clk,
+                                              tp->clk);
+                if (rc)
+                        return rc;
+        }
+
         /* enable device (incl. PCI PM wakeup and hotplug setup) */
         rc = pcim_enable_device(pdev);
         if (rc < 0) {
diff --git a/drivers/net/ethernet/renesas/Kconfig b/drivers/net/ethernet/renesas/Kconfig
index f3f7477043ce..bb0ebdfd4459 100644
--- a/drivers/net/ethernet/renesas/Kconfig
+++ b/drivers/net/ethernet/renesas/Kconfig
@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: GPL-2.0
 #
 # Renesas device configuration
 #
diff --git a/drivers/net/ethernet/renesas/Makefile b/drivers/net/ethernet/renesas/Makefile
index a05102a7df02..f21ab8c02af0 100644
--- a/drivers/net/ethernet/renesas/Makefile
+++ b/drivers/net/ethernet/renesas/Makefile
@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: GPL-2.0
 #
 # Makefile for the Renesas device drivers.
 #
diff --git a/drivers/net/ethernet/renesas/ravb.h b/drivers/net/ethernet/renesas/ravb.h
index b81f4faf7b10..9b6bf557a2f5 100644
--- a/drivers/net/ethernet/renesas/ravb.h
+++ b/drivers/net/ethernet/renesas/ravb.h
@@ -1,3 +1,4 @@
+/* SPDX-License-Identifier: GPL-2.0 */
 /* Renesas Ethernet AVB device driver
  *
  * Copyright (C) 2014-2015 Renesas Electronics Corporation
@@ -5,10 +6,6 @@
  * Copyright (C) 2015-2016 Cogent Embedded, Inc. <source@cogentembedded.com>
  *
  * Based on the SuperH Ethernet driver
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License version 2,
- * as published by the Free Software Foundation.
  */
 
 #ifndef __RAVB_H__
@@ -431,6 +428,7 @@ enum EIS_BIT {
         EIS_CULF1       = 0x00000080,
         EIS_TFFF        = 0x00000100,
         EIS_QFS         = 0x00010000,
+        EIS_RESERVED    = (GENMASK(31, 17) | GENMASK(15, 11)),
 };
 
 /* RIC0 */
@@ -475,6 +473,7 @@ enum RIS0_BIT {
         RIS0_FRF15      = 0x00008000,
         RIS0_FRF16      = 0x00010000,
         RIS0_FRF17      = 0x00020000,
+        RIS0_RESERVED   = GENMASK(31, 18),
 };
 
 /* RIC1 */
@@ -531,6 +530,7 @@ enum RIS2_BIT {
         RIS2_QFF16      = 0x00010000,
         RIS2_QFF17      = 0x00020000,
         RIS2_RFFF       = 0x80000000,
+        RIS2_RESERVED   = GENMASK(30, 18),
 };
 
 /* TIC */
@@ -547,6 +547,7 @@ enum TIS_BIT {
         TIS_FTF1        = 0x00000002,   /* Undocumented? */
         TIS_TFUF        = 0x00000100,
         TIS_TFWF        = 0x00000200,
+        TIS_RESERVED    = (GENMASK(31, 20) | GENMASK(15, 12) | GENMASK(7, 4))
 };
 
 /* ISS */
@@ -620,6 +621,7 @@ enum GIC_BIT {
 enum GIS_BIT {
         GIS_PTCF        = 0x00000001,   /* Undocumented? */
         GIS_PTMF        = 0x00000004,
+        GIS_RESERVED    = GENMASK(15, 10),
 };
 
 /* GIE (R-Car Gen3 only) */
diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c
index c06f2df895c2..d6f753925352 100644
--- a/drivers/net/ethernet/renesas/ravb_main.c
+++ b/drivers/net/ethernet/renesas/ravb_main.c
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: GPL-2.0
 /* Renesas Ethernet AVB device driver
  *
  * Copyright (C) 2014-2015 Renesas Electronics Corporation
@@ -5,10 +6,6 @@
  * Copyright (C) 2015-2016 Cogent Embedded, Inc. <source@cogentembedded.com>
  *
  * Based on the SuperH Ethernet driver
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License version 2,
- * as published by the Free Software Foundation.
  */
 
 #include <linux/cache.h>
@@ -742,10 +739,11 @@ static void ravb_error_interrupt(struct net_device *ndev)
         u32 eis, ris2;
 
         eis = ravb_read(ndev, EIS);
-        ravb_write(ndev, ~EIS_QFS, EIS);
+        ravb_write(ndev, ~(EIS_QFS | EIS_RESERVED), EIS);
         if (eis & EIS_QFS) {
                 ris2 = ravb_read(ndev, RIS2);
-                ravb_write(ndev, ~(RIS2_QFF0 | RIS2_RFFF), RIS2);
+                ravb_write(ndev, ~(RIS2_QFF0 | RIS2_RFFF | RIS2_RESERVED),
+                           RIS2);
 
                 /* Receive Descriptor Empty int */
                 if (ris2 & RIS2_QFF0)
@@ -798,7 +796,7 @@ static bool ravb_timestamp_interrupt(struct net_device *ndev)
         u32 tis = ravb_read(ndev, TIS);
 
         if (tis & TIS_TFUF) {
-                ravb_write(ndev, ~TIS_TFUF, TIS);
+                ravb_write(ndev, ~(TIS_TFUF | TIS_RESERVED), TIS);
                 ravb_get_tx_tstamp(ndev);
                 return true;
         }
@@ -933,7 +931,7 @@ static int ravb_poll(struct napi_struct *napi, int budget)
                 /* Processing RX Descriptor Ring */
                 if (ris0 & mask) {
                         /* Clear RX interrupt */
-                        ravb_write(ndev, ~mask, RIS0);
+                        ravb_write(ndev, ~(mask | RIS0_RESERVED), RIS0);
                         if (ravb_rx(ndev, &quota, q))
                                 goto out;
                 }
@@ -941,7 +939,7 @@ static int ravb_poll(struct napi_struct *napi, int budget)
                 if (tis & mask) {
                         spin_lock_irqsave(&priv->lock, flags);
                         /* Clear TX interrupt */
-                        ravb_write(ndev, ~mask, TIS);
+                        ravb_write(ndev, ~(mask | TIS_RESERVED), TIS);
                         ravb_tx_free(ndev, q, true);
                         netif_wake_subqueue(ndev, q);
                         mmiowb();
diff --git a/drivers/net/ethernet/renesas/ravb_ptp.c b/drivers/net/ethernet/renesas/ravb_ptp.c
index eede70ec37f8..dce2a40a31e3 100644
--- a/drivers/net/ethernet/renesas/ravb_ptp.c
+++ b/drivers/net/ethernet/renesas/ravb_ptp.c
@@ -1,13 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0+
 /* PTP 1588 clock using the Renesas Ethernet AVB
  *
  * Copyright (C) 2013-2015 Renesas Electronics Corporation
  * Copyright (C) 2015 Renesas Solutions Corp.
  * Copyright (C) 2015-2016 Cogent Embedded, Inc. <source@cogentembedded.com>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
  */
 
 #include "ravb.h"
@@ -319,7 +315,7 @@ void ravb_ptp_interrupt(struct net_device *ndev)
                 }
         }
 
-        ravb_write(ndev, ~gis, GIS);
+        ravb_write(ndev, ~(gis | GIS_RESERVED), GIS);
 }
 
 void ravb_ptp_init(struct net_device *ndev, struct platform_device *pdev)
diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
index 5573199c4536..f27a0dc8c563 100644
--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: GPL-2.0
 /*  SuperH Ethernet device driver
  *
  *  Copyright (C) 2014 Renesas Electronics Corporation
@@ -5,18 +6,6 @@
  *  Copyright (C) 2008-2014 Renesas Solutions Corp.
  *  Copyright (C) 2013-2017 Cogent Embedded, Inc.
  *  Copyright (C) 2014 Codethink Limited
- *
- *  This program is free software; you can redistribute it and/or modify it
- *  under the terms and conditions of the GNU General Public License,
- *  version 2, as published by the Free Software Foundation.
- *
- *  This program is distributed in the hope it will be useful, but WITHOUT
- *  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- *  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- *  more details.
- *
- *  The full GNU General Public License is included in this distribution in
- *  the file called "COPYING".
  */
 
 #include <linux/module.h>
@@ -809,6 +798,41 @@ static struct sh_eth_cpu_data r8a77980_data = {
         .magic          = 1,
         .cexcr          = 1,
 };
+
+/* R7S9210 */
+static struct sh_eth_cpu_data r7s9210_data = {
+        .soft_reset     = sh_eth_soft_reset,
+
+        .set_duplex     = sh_eth_set_duplex,
+        .set_rate       = sh_eth_set_rate_rcar,
+
+        .register_type  = SH_ETH_REG_FAST_SH4,
+
+        .edtrr_trns     = EDTRR_TRNS_ETHER,
+        .ecsr_value     = ECSR_ICD,
+        .ecsipr_value   = ECSIPR_ICDIP,
+        .eesipr_value   = EESIPR_TWBIP | EESIPR_TABTIP | EESIPR_RABTIP |
+                          EESIPR_RFCOFIP | EESIPR_ECIIP | EESIPR_FTCIP |
+                          EESIPR_TDEIP | EESIPR_TFUFIP | EESIPR_FRIP |
+                          EESIPR_RDEIP | EESIPR_RFOFIP | EESIPR_CNDIP |
+                          EESIPR_DLCIP | EESIPR_CDIP | EESIPR_TROIP |
+                          EESIPR_RMAFIP | EESIPR_RRFIP | EESIPR_RTLFIP |
+                          EESIPR_RTSFIP | EESIPR_PREIP | EESIPR_CERFIP,
+
+        .tx_check       = EESR_FTC | EESR_CND | EESR_DLC | EESR_CD | EESR_TRO,
+        .eesr_err_check = EESR_TWB | EESR_TABT | EESR_RABT | EESR_RFE |
+                          EESR_RDE | EESR_RFRMER | EESR_TFE | EESR_TDE,
+
+        .fdr_value      = 0x0000070f,
+
+        .apr            = 1,
+        .mpr            = 1,
+        .tpauser        = 1,
+        .hw_swap        = 1,
+        .rpadir         = 1,
+        .no_ade         = 1,
+        .xdfar_rw       = 1,
+};
 #endif /* CONFIG_OF */
 
 static void sh_eth_set_rate_sh7724(struct net_device *ndev)
@@ -3132,6 +3156,7 @@ static const struct of_device_id sh_eth_match_table[] = {
         { .compatible = "renesas,ether-r8a7794", .data = &rcar_gen2_data },
         { .compatible = "renesas,gether-r8a77980", .data = &r8a77980_data },
         { .compatible = "renesas,ether-r7s72100", .data = &r7s72100_data },
+        { .compatible = "renesas,ether-r7s9210", .data = &r7s9210_data },
         { .compatible = "renesas,rcar-gen1-ether", .data = &rcar_gen1_data },
         { .compatible = "renesas,rcar-gen2-ether", .data = &rcar_gen2_data },
         { }
diff --git a/drivers/net/ethernet/renesas/sh_eth.h b/drivers/net/ethernet/renesas/sh_eth.h
index f94be99cf400..0c18650bbfe6 100644
--- a/drivers/net/ethernet/renesas/sh_eth.h
+++ b/drivers/net/ethernet/renesas/sh_eth.h
@@ -1,19 +1,8 @@
+/* SPDX-License-Identifier: GPL-2.0 */
 /*  SuperH Ethernet device driver
  *
  *  Copyright (C) 2006-2012 Nobuhiro Iwamatsu
  *  Copyright (C) 2008-2012 Renesas Solutions Corp.
- *
- *  This program is free software; you can redistribute it and/or modify it
- *  under the terms and conditions of the GNU General Public License,
- *  version 2, as published by the Free Software Foundation.
- *
- *  This program is distributed in the hope it will be useful, but WITHOUT
- *  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- *  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- *  more details.
- *
- *  The full GNU General Public License is included in this distribution in
- *  the file called "COPYING".
  */
 
 #ifndef __SH_ETH_H__
diff --git a/drivers/net/ethernet/seeq/ether3.c b/drivers/net/ethernet/seeq/ether3.c
index c5bc124b41a9..d1bb73bf9914 100644
--- a/drivers/net/ethernet/seeq/ether3.c
+++ b/drivers/net/ethernet/seeq/ether3.c
@@ -77,7 +77,8 @@ static void	ether3_setmulticastlist(struct net_device *dev);
 static int      ether3_rx(struct net_device *dev, unsigned int maxcnt);
 static void     ether3_tx(struct net_device *dev);
 static int      ether3_open (struct net_device *dev);
-static int      ether3_sendpacket (struct sk_buff *skb, struct net_device *dev);
+static netdev_tx_t      ether3_sendpacket(struct sk_buff *skb,
+                                          struct net_device *dev);
 static irqreturn_t ether3_interrupt (int irq, void *dev_id);
 static int      ether3_close (struct net_device *dev);
 static void     ether3_setmulticastlist (struct net_device *dev);
@@ -481,7 +482,7 @@ static void ether3_timeout(struct net_device *dev)
 /*
  * Transmit a packet
  */
-static int
+static netdev_tx_t
 ether3_sendpacket(struct sk_buff *skb, struct net_device *dev)
 {
         unsigned long flags;
diff --git a/drivers/net/ethernet/seeq/sgiseeq.c b/drivers/net/ethernet/seeq/sgiseeq.c
index 573691bc3b71..70cce63a6081 100644
--- a/drivers/net/ethernet/seeq/sgiseeq.c
+++ b/drivers/net/ethernet/seeq/sgiseeq.c
@@ -578,7 +578,8 @@ static inline int sgiseeq_reset(struct net_device *dev)
         return 0;
 }
 
-static int sgiseeq_start_xmit(struct sk_buff *skb, struct net_device *dev)
+static netdev_tx_t
+sgiseeq_start_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         struct sgiseeq_private *sp = netdev_priv(dev);
         struct hpc3_ethregs *hregs = sp->hregs;
diff --git a/drivers/net/ethernet/sfc/efx.c b/drivers/net/ethernet/sfc/efx.c
index 330233286e78..3d0dd39c289e 100644
--- a/drivers/net/ethernet/sfc/efx.c
+++ b/drivers/net/ethernet/sfc/efx.c
@@ -2208,29 +2208,6 @@ static void efx_fini_napi(struct efx_nic *efx)
 
 /**************************************************************************
  *
- * Kernel netpoll interface
- *
- *************************************************************************/
-
-#ifdef CONFIG_NET_POLL_CONTROLLER
-
-/* Although in the common case interrupts will be disabled, this is not
- * guaranteed. However, all our work happens inside the NAPI callback,
- * so no locking is required.
- */
-static void efx_netpoll(struct net_device *net_dev)
-{
-        struct efx_nic *efx = netdev_priv(net_dev);
-        struct efx_channel *channel;
-
-        efx_for_each_channel(channel, efx)
-                efx_schedule_channel(channel);
-}
-
-#endif
-
-/**************************************************************************
- *
  * Kernel net device interface
  *
  *************************************************************************/
@@ -2509,9 +2486,6 @@ static const struct net_device_ops efx_netdev_ops = {
 #endif
         .ndo_get_phys_port_id   = efx_get_phys_port_id,
         .ndo_get_phys_port_name = efx_get_phys_port_name,
-#ifdef CONFIG_NET_POLL_CONTROLLER
-        .ndo_poll_controller = efx_netpoll,
-#endif
         .ndo_setup_tc           = efx_setup_tc,
 #ifdef CONFIG_RFS_ACCEL
         .ndo_rx_flow_steer      = efx_filter_rfs,
diff --git a/drivers/net/ethernet/sfc/falcon/efx.c b/drivers/net/ethernet/sfc/falcon/efx.c
index dd5530a4f8c8..03e2455c502e 100644
--- a/drivers/net/ethernet/sfc/falcon/efx.c
+++ b/drivers/net/ethernet/sfc/falcon/efx.c
@@ -2054,29 +2054,6 @@ static void ef4_fini_napi(struct ef4_nic *efx)
 
 /**************************************************************************
  *
- * Kernel netpoll interface
- *
- *************************************************************************/
-
-#ifdef CONFIG_NET_POLL_CONTROLLER
-
-/* Although in the common case interrupts will be disabled, this is not
- * guaranteed. However, all our work happens inside the NAPI callback,
- * so no locking is required.
- */
-static void ef4_netpoll(struct net_device *net_dev)
-{
-        struct ef4_nic *efx = netdev_priv(net_dev);
-        struct ef4_channel *channel;
-
-        ef4_for_each_channel(channel, efx)
-                ef4_schedule_channel(channel);
-}
-
-#endif
-
-/**************************************************************************
- *
  * Kernel net device interface
  *
  *************************************************************************/
@@ -2250,9 +2227,6 @@ static const struct net_device_ops ef4_netdev_ops = {
         .ndo_set_mac_address    = ef4_set_mac_address,
         .ndo_set_rx_mode        = ef4_set_rx_mode,
         .ndo_set_features       = ef4_set_features,
-#ifdef CONFIG_NET_POLL_CONTROLLER
-        .ndo_poll_controller = ef4_netpoll,
-#endif
         .ndo_setup_tc           = ef4_setup_tc,
 #ifdef CONFIG_RFS_ACCEL
         .ndo_rx_flow_steer      = ef4_filter_rfs,
diff --git a/drivers/net/ethernet/sgi/ioc3-eth.c b/drivers/net/ethernet/sgi/ioc3-eth.c
index 18d533fdf14c..3140999642ba 100644
--- a/drivers/net/ethernet/sgi/ioc3-eth.c
+++ b/drivers/net/ethernet/sgi/ioc3-eth.c
@@ -99,7 +99,7 @@ struct ioc3_private {
 
 static int ioc3_ioctl(struct net_device *dev, struct ifreq *rq, int cmd);
 static void ioc3_set_multicast_list(struct net_device *dev);
-static int ioc3_start_xmit(struct sk_buff *skb, struct net_device *dev);
+static netdev_tx_t ioc3_start_xmit(struct sk_buff *skb, struct net_device *dev);
 static void ioc3_timeout(struct net_device *dev);
 static inline unsigned int ioc3_hash(const unsigned char *addr);
 static inline void ioc3_stop(struct ioc3_private *ip);
@@ -1390,7 +1390,7 @@ static struct pci_driver ioc3_driver = {
         .remove         = ioc3_remove_one,
 };
 
-static int ioc3_start_xmit(struct sk_buff *skb, struct net_device *dev)
+static netdev_tx_t ioc3_start_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         unsigned long data;
         struct ioc3_private *ip = netdev_priv(dev);
diff --git a/drivers/net/ethernet/sgi/meth.c b/drivers/net/ethernet/sgi/meth.c
index ea55abd62ec7..703fbbefea44 100644
--- a/drivers/net/ethernet/sgi/meth.c
+++ b/drivers/net/ethernet/sgi/meth.c
@@ -697,7 +697,7 @@ static void meth_add_to_tx_ring(struct meth_private *priv, struct sk_buff *skb)
 /*
  * Transmit a packet (called by the kernel)
  */
-static int meth_tx(struct sk_buff *skb, struct net_device *dev)
+static netdev_tx_t meth_tx(struct sk_buff *skb, struct net_device *dev)
 {
         struct meth_private *priv = netdev_priv(dev);
         unsigned long flags;
diff --git a/drivers/net/ethernet/stmicro/stmmac/Kconfig b/drivers/net/ethernet/stmicro/stmmac/Kconfig
index edf20361ea5f..324049eebb9b 100644
--- a/drivers/net/ethernet/stmicro/stmmac/Kconfig
+++ b/drivers/net/ethernet/stmicro/stmmac/Kconfig
@@ -33,7 +33,7 @@ config DWMAC_DWC_QOS_ETH
         select PHYLIB
         select CRC32
         select MII
-        depends on OF && COMMON_CLK && HAS_DMA
+        depends on OF && HAS_DMA
         help
           Support for chips using the snps,dwc-qos-ethernet.txt DT binding.
 
@@ -57,7 +57,7 @@ config DWMAC_ANARION
 config DWMAC_IPQ806X
         tristate "QCA IPQ806x DWMAC support"
         default ARCH_QCOM
-        depends on OF && COMMON_CLK && (ARCH_QCOM || COMPILE_TEST)
+        depends on OF && (ARCH_QCOM || COMPILE_TEST)
         select MFD_SYSCON
         help
           Support for QCA IPQ806X DWMAC Ethernet.
@@ -100,7 +100,7 @@ config DWMAC_OXNAS
 config DWMAC_ROCKCHIP
         tristate "Rockchip dwmac support"
         default ARCH_ROCKCHIP
-        depends on OF && COMMON_CLK && (ARCH_ROCKCHIP || COMPILE_TEST)
+        depends on OF && (ARCH_ROCKCHIP || COMPILE_TEST)
         select MFD_SYSCON
         help
           Support for Ethernet controller on Rockchip RK3288 SoC.
@@ -110,7 +110,7 @@ config DWMAC_ROCKCHIP
 
 config DWMAC_SOCFPGA
         tristate "SOCFPGA dwmac support"
-        default ARCH_SOCFPGA
+        default (ARCH_SOCFPGA || ARCH_STRATIX10)
         depends on OF && (ARCH_SOCFPGA || ARCH_STRATIX10 || COMPILE_TEST)
         select MFD_SYSCON
         help
@@ -123,7 +123,7 @@ config DWMAC_SOCFPGA
 config DWMAC_STI
         tristate "STi GMAC support"
         default ARCH_STI
-        depends on OF && COMMON_CLK && (ARCH_STI || COMPILE_TEST)
+        depends on OF && (ARCH_STI || COMPILE_TEST)
         select MFD_SYSCON
         ---help---
           Support for ethernet controller on STi SOCs.
@@ -147,7 +147,7 @@ config DWMAC_STM32
 config DWMAC_SUNXI
         tristate "Allwinner GMAC support"
         default ARCH_SUNXI
-        depends on OF && COMMON_CLK && (ARCH_SUNXI || COMPILE_TEST)
+        depends on OF && (ARCH_SUNXI || COMPILE_TEST)
         ---help---
           Support for Allwinner A20/A31 GMAC ethernet controllers.
 
diff --git a/drivers/net/ethernet/stmicro/stmmac/common.h b/drivers/net/ethernet/stmicro/stmmac/common.h
index 1854f270ad66..b1b305f8f414 100644
--- a/drivers/net/ethernet/stmicro/stmmac/common.h
+++ b/drivers/net/ethernet/stmicro/stmmac/common.h
@@ -258,10 +258,10 @@ struct stmmac_safety_stats {
 #define MAX_DMA_RIWT            0xff
 #define MIN_DMA_RIWT            0x20
 /* Tx coalesce parameters */
-#define STMMAC_COAL_TX_TIMER    40000
+#define STMMAC_COAL_TX_TIMER    1000
 #define STMMAC_MAX_COAL_TX_TICK 100000
 #define STMMAC_TX_MAX_FRAMES    256
-#define STMMAC_TX_FRAMES        64
+#define STMMAC_TX_FRAMES        25
 
 /* Packets types */
 enum packets_types {
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac.h b/drivers/net/ethernet/stmicro/stmmac/stmmac.h
index 76649adf8fb0..63e1064b27a2 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac.h
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac.h
@@ -48,6 +48,8 @@ struct stmmac_tx_info {
 
 /* Frequently used values are kept adjacent for cache effect */
 struct stmmac_tx_queue {
+        u32 tx_count_frames;
+        struct timer_list txtimer;
         u32 queue_index;
         struct stmmac_priv *priv_data;
         struct dma_extended_desc *dma_etx ____cacheline_aligned_in_smp;
@@ -73,7 +75,14 @@ struct stmmac_rx_queue {
         u32 rx_zeroc_thresh;
         dma_addr_t dma_rx_phy;
         u32 rx_tail_addr;
+};
+
+struct stmmac_channel {
         struct napi_struct napi ____cacheline_aligned_in_smp;
+        struct stmmac_priv *priv_data;
+        u32 index;
+        int has_rx;
+        int has_tx;
 };
 
 struct stmmac_tc_entry {
@@ -109,15 +118,12 @@ struct stmmac_pps_cfg {
 
 struct stmmac_priv {
         /* Frequently used values are kept adjacent for cache effect */
-        u32 tx_count_frames;
         u32 tx_coal_frames;
         u32 tx_coal_timer;
-        bool tx_timer_armed;
 
         int tx_coalesce;
         int hwts_tx_en;
         bool tx_path_in_lpi_mode;
-        struct timer_list txtimer;
         bool tso;
 
         unsigned int dma_buf_sz;
@@ -138,6 +144,9 @@ struct stmmac_priv {
         /* TX Queue */
         struct stmmac_tx_queue tx_queue[MTL_MAX_TX_QUEUES];
 
+        /* Generic channel for NAPI */
+        struct stmmac_channel channel[STMMAC_CH_MAX];
+
         bool oldlink;
         int speed;
         int oldduplex;
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index ff1ffb46198a..75896d6ba6e2 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -148,12 +148,14 @@ static void stmmac_verify_args(void)
 static void stmmac_disable_all_queues(struct stmmac_priv *priv)
 {
         u32 rx_queues_cnt = priv->plat->rx_queues_to_use;
+        u32 tx_queues_cnt = priv->plat->tx_queues_to_use;
+        u32 maxq = max(rx_queues_cnt, tx_queues_cnt);
         u32 queue;
 
-        for (queue = 0; queue < rx_queues_cnt; queue++) {
-                struct stmmac_rx_queue *rx_q = &priv->rx_queue[queue];
+        for (queue = 0; queue < maxq; queue++) {
+                struct stmmac_channel *ch = &priv->channel[queue];
 
-                napi_disable(&rx_q->napi);
+                napi_disable(&ch->napi);
         }
 }
 
@@ -164,12 +166,14 @@ static void stmmac_disable_all_queues(struct stmmac_priv *priv)
 static void stmmac_enable_all_queues(struct stmmac_priv *priv)
 {
         u32 rx_queues_cnt = priv->plat->rx_queues_to_use;
+        u32 tx_queues_cnt = priv->plat->tx_queues_to_use;
+        u32 maxq = max(rx_queues_cnt, tx_queues_cnt);
         u32 queue;
 
-        for (queue = 0; queue < rx_queues_cnt; queue++) {
-                struct stmmac_rx_queue *rx_q = &priv->rx_queue[queue];
+        for (queue = 0; queue < maxq; queue++) {
+                struct stmmac_channel *ch = &priv->channel[queue];
 
-                napi_enable(&rx_q->napi);
+                napi_enable(&ch->napi);
         }
 }
 
@@ -1843,18 +1847,18 @@ static void stmmac_dma_operation_mode(struct stmmac_priv *priv)
  * @queue: TX queue index
  * Description: it reclaims the transmit resources after transmission completes.
  */
-static void stmmac_tx_clean(struct stmmac_priv *priv, u32 queue)
+static int stmmac_tx_clean(struct stmmac_priv *priv, int budget, u32 queue)
 {
         struct stmmac_tx_queue *tx_q = &priv->tx_queue[queue];
         unsigned int bytes_compl = 0, pkts_compl = 0;
-        unsigned int entry;
+        unsigned int entry, count = 0;
 
-        netif_tx_lock(priv->dev);
+        __netif_tx_lock_bh(netdev_get_tx_queue(priv->dev, queue));
 
         priv->xstats.tx_clean++;
 
         entry = tx_q->dirty_tx;
-        while (entry != tx_q->cur_tx) {
+        while ((entry != tx_q->cur_tx) && (count < budget)) {
                 struct sk_buff *skb = tx_q->tx_skbuff[entry];
                 struct dma_desc *p;
                 int status;
@@ -1870,6 +1874,8 @@ static void stmmac_tx_clean(struct stmmac_priv *priv, u32 queue)
                 if (unlikely(status & tx_dma_own))
                         break;
 
+                count++;
+
                 /* Make sure descriptor fields are read after reading
                  * the own bit.
                  */
@@ -1937,7 +1943,10 @@ static void stmmac_tx_clean(struct stmmac_priv *priv, u32 queue)
                 stmmac_enable_eee_mode(priv);
                 mod_timer(&priv->eee_ctrl_timer, STMMAC_LPI_T(eee_timer));
         }
-        netif_tx_unlock(priv->dev);
+
+        __netif_tx_unlock_bh(netdev_get_tx_queue(priv->dev, queue));
+
+        return count;
 }
 
 /**
@@ -2020,6 +2029,33 @@ static bool stmmac_safety_feat_interrupt(struct stmmac_priv *priv)
         return false;
 }
 
+static int stmmac_napi_check(struct stmmac_priv *priv, u32 chan)
+{
+        int status = stmmac_dma_interrupt_status(priv, priv->ioaddr,
+                                                 &priv->xstats, chan);
+        struct stmmac_channel *ch = &priv->channel[chan];
+        bool needs_work = false;
+
+        if ((status & handle_rx) && ch->has_rx) {
+                needs_work = true;
+        } else {
+                status &= ~handle_rx;
+        }
+
+        if ((status & handle_tx) && ch->has_tx) {
+                needs_work = true;
+        } else {
+                status &= ~handle_tx;
+        }
+
+        if (needs_work && napi_schedule_prep(&ch->napi)) {
+                stmmac_disable_dma_irq(priv, priv->ioaddr, chan);
+                __napi_schedule(&ch->napi);
+        }
+
+        return status;
+}
+
 /**
  * stmmac_dma_interrupt - DMA ISR
  * @priv: driver private structure
@@ -2034,57 +2070,14 @@ static void stmmac_dma_interrupt(struct stmmac_priv *priv)
         u32 channels_to_check = tx_channel_count > rx_channel_count ?
                                 tx_channel_count : rx_channel_count;
         u32 chan;
-        bool poll_scheduled = false;
         int status[max_t(u32, MTL_MAX_TX_QUEUES, MTL_MAX_RX_QUEUES)];
 
         /* Make sure we never check beyond our status buffer. */
         if (WARN_ON_ONCE(channels_to_check > ARRAY_SIZE(status)))
                 channels_to_check = ARRAY_SIZE(status);
 
-        /* Each DMA channel can be used for rx and tx simultaneously, yet
-         * napi_struct is embedded in struct stmmac_rx_queue rather than in a
-         * stmmac_channel struct.
-         * Because of this, stmmac_poll currently checks (and possibly wakes)
-         * all tx queues rather than just a single tx queue.
-         */
         for (chan = 0; chan < channels_to_check; chan++)
-                status[chan] = stmmac_dma_interrupt_status(priv, priv->ioaddr,
-                                &priv->xstats, chan);
-
-        for (chan = 0; chan < rx_channel_count; chan++) {
-                if (likely(status[chan] & handle_rx)) {
-                        struct stmmac_rx_queue *rx_q = &priv->rx_queue[chan];
-
-                        if (likely(napi_schedule_prep(&rx_q->napi))) {
-                                stmmac_disable_dma_irq(priv, priv->ioaddr, chan);
-                                __napi_schedule(&rx_q->napi);
-                                poll_scheduled = true;
-                        }
-                }
-        }
-
-        /* If we scheduled poll, we already know that tx queues will be checked.
-         * If we didn't schedule poll, see if any DMA channel (used by tx) has a
-         * completed transmission, if so, call stmmac_poll (once).
-         */
-        if (!poll_scheduled) {
-                for (chan = 0; chan < tx_channel_count; chan++) {
-                        if (status[chan] & handle_tx) {
-                                /* It doesn't matter what rx queue we choose
-                                 * here. We use 0 since it always exists.
-                                 */
-                                struct stmmac_rx_queue *rx_q =
-                                        &priv->rx_queue[0];
-
-                                if (likely(napi_schedule_prep(&rx_q->napi))) {
-                                        stmmac_disable_dma_irq(priv,
-                                                        priv->ioaddr, chan);
-                                        __napi_schedule(&rx_q->napi);
-                                }
-                                break;
-                        }
-                }
-        }
+                status[chan] = stmmac_napi_check(priv, chan);
 
         for (chan = 0; chan < tx_channel_count; chan++) {
                 if (unlikely(status[chan] & tx_hard_error_bump_tc)) {
@@ -2220,8 +2213,7 @@ static int stmmac_init_dma_engine(struct stmmac_priv *priv)
                 stmmac_init_tx_chan(priv, priv->ioaddr, priv->plat->dma_cfg,
                                     tx_q->dma_tx_phy, chan);
 
-                tx_q->tx_tail_addr = tx_q->dma_tx_phy +
-                            (DMA_TX_SIZE * sizeof(struct dma_desc));
+                tx_q->tx_tail_addr = tx_q->dma_tx_phy;
                 stmmac_set_tx_tail_ptr(priv, priv->ioaddr,
                                        tx_q->tx_tail_addr, chan);
         }
@@ -2233,6 +2225,13 @@ static int stmmac_init_dma_engine(struct stmmac_priv *priv)
         return ret;
 }
 
+static void stmmac_tx_timer_arm(struct stmmac_priv *priv, u32 queue)
+{
+        struct stmmac_tx_queue *tx_q = &priv->tx_queue[queue];
+
+        mod_timer(&tx_q->txtimer, STMMAC_COAL_TIMER(priv->tx_coal_timer));
+}
+
 /**
  * stmmac_tx_timer - mitigation sw timer for tx.
  * @data: data pointer
@@ -2241,13 +2240,14 @@ static int stmmac_init_dma_engine(struct stmmac_priv *priv)
  */
 static void stmmac_tx_timer(struct timer_list *t)
 {
-        struct stmmac_priv *priv = from_timer(priv, t, txtimer);
-        u32 tx_queues_count = priv->plat->tx_queues_to_use;
-        u32 queue;
+        struct stmmac_tx_queue *tx_q = from_timer(tx_q, t, txtimer);
+        struct stmmac_priv *priv = tx_q->priv_data;
+        struct stmmac_channel *ch;
+
+        ch = &priv->channel[tx_q->queue_index];
 
-        /* let's scan all the tx queues */
-        for (queue = 0; queue < tx_queues_count; queue++)
-                stmmac_tx_clean(priv, queue);
+        if (likely(napi_schedule_prep(&ch->napi)))
+                __napi_schedule(&ch->napi);
 }
 
 /**
@@ -2260,11 +2260,17 @@ static void stmmac_tx_timer(struct timer_list *t)
  */
 static void stmmac_init_tx_coalesce(struct stmmac_priv *priv)
 {
+        u32 tx_channel_count = priv->plat->tx_queues_to_use;
+        u32 chan;
+
         priv->tx_coal_frames = STMMAC_TX_FRAMES;
         priv->tx_coal_timer = STMMAC_COAL_TX_TIMER;
-        timer_setup(&priv->txtimer, stmmac_tx_timer, 0);
-        priv->txtimer.expires = STMMAC_COAL_TIMER(priv->tx_coal_timer);
-        add_timer(&priv->txtimer);
+
+        for (chan = 0; chan < tx_channel_count; chan++) {
+                struct stmmac_tx_queue *tx_q = &priv->tx_queue[chan];
+
+                timer_setup(&tx_q->txtimer, stmmac_tx_timer, 0);
+        }
 }
 
 static void stmmac_set_rings_length(struct stmmac_priv *priv)
@@ -2592,6 +2598,7 @@ static void stmmac_hw_teardown(struct net_device *dev)
 static int stmmac_open(struct net_device *dev)
 {
         struct stmmac_priv *priv = netdev_priv(dev);
+        u32 chan;
         int ret;
 
         stmmac_check_ether_addr(priv);
@@ -2688,7 +2695,9 @@ irq_error:
         if (dev->phydev)
                 phy_stop(dev->phydev);
 
-        del_timer_sync(&priv->txtimer);
+        for (chan = 0; chan < priv->plat->tx_queues_to_use; chan++)
+                del_timer_sync(&priv->tx_queue[chan].txtimer);
+
         stmmac_hw_teardown(dev);
 init_error:
         free_dma_desc_resources(priv);
@@ -2708,6 +2717,7 @@ dma_desc_error:
 static int stmmac_release(struct net_device *dev)
 {
         struct stmmac_priv *priv = netdev_priv(dev);
+        u32 chan;
 
         if (priv->eee_enabled)
                 del_timer_sync(&priv->eee_ctrl_timer);
@@ -2722,7 +2732,8 @@ static int stmmac_release(struct net_device *dev)
 
         stmmac_disable_all_queues(priv);
 
-        del_timer_sync(&priv->txtimer);
+        for (chan = 0; chan < priv->plat->tx_queues_to_use; chan++)
+                del_timer_sync(&priv->tx_queue[chan].txtimer);
 
         /* Free the IRQ lines */
         free_irq(dev->irq, dev);
@@ -2936,14 +2947,13 @@ static netdev_tx_t stmmac_tso_xmit(struct sk_buff *skb, struct net_device *dev)
         priv->xstats.tx_tso_nfrags += nfrags;
 
         /* Manage tx mitigation */
-        priv->tx_count_frames += nfrags + 1;
-        if (likely(priv->tx_coal_frames > priv->tx_count_frames)) {
-                mod_timer(&priv->txtimer,
-                          STMMAC_COAL_TIMER(priv->tx_coal_timer));
-        } else {
-                priv->tx_count_frames = 0;
+        tx_q->tx_count_frames += nfrags + 1;
+        if (priv->tx_coal_frames <= tx_q->tx_count_frames) {
                 stmmac_set_tx_ic(priv, desc);
                 priv->xstats.tx_set_ic_bit++;
+                tx_q->tx_count_frames = 0;
+        } else {
+                stmmac_tx_timer_arm(priv, queue);
         }
 
         skb_tx_timestamp(skb);
@@ -2992,6 +3002,7 @@ static netdev_tx_t stmmac_tso_xmit(struct sk_buff *skb, struct net_device *dev)
 
         netdev_tx_sent_queue(netdev_get_tx_queue(dev, queue), skb->len);
 
+        tx_q->tx_tail_addr = tx_q->dma_tx_phy + (tx_q->cur_tx * sizeof(*desc));
         stmmac_set_tx_tail_ptr(priv, priv->ioaddr, tx_q->tx_tail_addr, queue);
 
         return NETDEV_TX_OK;
@@ -3146,17 +3157,13 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)
          * This approach takes care about the fragments: desc is the first
          * element in case of no SG.
          */
-        priv->tx_count_frames += nfrags + 1;
-        if (likely(priv->tx_coal_frames > priv->tx_count_frames) &&
-            !priv->tx_timer_armed) {
-                mod_timer(&priv->txtimer,
-                          STMMAC_COAL_TIMER(priv->tx_coal_timer));
-                priv->tx_timer_armed = true;
-        } else {
-                priv->tx_count_frames = 0;
+        tx_q->tx_count_frames += nfrags + 1;
+        if (priv->tx_coal_frames <= tx_q->tx_count_frames) {
                 stmmac_set_tx_ic(priv, desc);
                 priv->xstats.tx_set_ic_bit++;
-                priv->tx_timer_armed = false;
+                tx_q->tx_count_frames = 0;
+        } else {
+                stmmac_tx_timer_arm(priv, queue);
         }
 
         skb_tx_timestamp(skb);
@@ -3202,6 +3209,8 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)
         netdev_tx_sent_queue(netdev_get_tx_queue(dev, queue), skb->len);
 
         stmmac_enable_dma_transmission(priv, priv->ioaddr);
+
+        tx_q->tx_tail_addr = tx_q->dma_tx_phy + (tx_q->cur_tx * sizeof(*desc));
         stmmac_set_tx_tail_ptr(priv, priv->ioaddr, tx_q->tx_tail_addr, queue);
 
         return NETDEV_TX_OK;
@@ -3322,6 +3331,7 @@ static inline void stmmac_rx_refill(struct stmmac_priv *priv, u32 queue)
 static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)
 {
         struct stmmac_rx_queue *rx_q = &priv->rx_queue[queue];
+        struct stmmac_channel *ch = &priv->channel[queue];
         unsigned int entry = rx_q->cur_rx;
         int coe = priv->hw->rx_csum;
         unsigned int next_entry;
@@ -3494,7 +3504,7 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)
                         else
                                 skb->ip_summed = CHECKSUM_UNNECESSARY;
 
-                        napi_gro_receive(&rx_q->napi, skb);
+                        napi_gro_receive(&ch->napi, skb);
 
                         priv->dev->stats.rx_packets++;
                         priv->dev->stats.rx_bytes += frame_len;
@@ -3517,27 +3527,33 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)
  *  Description :
  *  To look at the incoming frames and clear the tx resources.
  */
-static int stmmac_poll(struct napi_struct *napi, int budget)
+static int stmmac_napi_poll(struct napi_struct *napi, int budget)
 {
-        struct stmmac_rx_queue *rx_q =
-                container_of(napi, struct stmmac_rx_queue, napi);
-        struct stmmac_priv *priv = rx_q->priv_data;
-        u32 tx_count = priv->plat->tx_queues_to_use;
-        u32 chan = rx_q->queue_index;
-        int work_done = 0;
-        u32 queue;
+        struct stmmac_channel *ch =
+                container_of(napi, struct stmmac_channel, napi);
+        struct stmmac_priv *priv = ch->priv_data;
+        int work_done = 0, work_rem = budget;
+        u32 chan = ch->index;
 
         priv->xstats.napi_poll++;
 
-        /* check all the queues */
-        for (queue = 0; queue < tx_count; queue++)
-                stmmac_tx_clean(priv, queue);
+        if (ch->has_tx) {
+                int done = stmmac_tx_clean(priv, work_rem, chan);
 
-        work_done = stmmac_rx(priv, budget, rx_q->queue_index);
-        if (work_done < budget) {
-                napi_complete_done(napi, work_done);
-                stmmac_enable_dma_irq(priv, priv->ioaddr, chan);
+                work_done += done;
+                work_rem -= done;
+        }
+
+        if (ch->has_rx) {
+                int done = stmmac_rx(priv, work_rem, chan);
+
+                work_done += done;
+                work_rem -= done;
         }
+
+        if (work_done < budget && napi_complete_done(napi, work_done))
+                stmmac_enable_dma_irq(priv, priv->ioaddr, chan);
+
         return work_done;
 }
 
@@ -4201,8 +4217,8 @@ int stmmac_dvr_probe(struct device *device,
 {
         struct net_device *ndev = NULL;
         struct stmmac_priv *priv;
+        u32 queue, maxq;
         int ret = 0;
-        u32 queue;
 
         ndev = alloc_etherdev_mqs(sizeof(struct stmmac_priv),
                                   MTL_MAX_TX_QUEUES,
@@ -4325,11 +4341,22 @@ int stmmac_dvr_probe(struct device *device,
                          "Enable RX Mitigation via HW Watchdog Timer\n");
         }
 
-        for (queue = 0; queue < priv->plat->rx_queues_to_use; queue++) {
-                struct stmmac_rx_queue *rx_q = &priv->rx_queue[queue];
+        /* Setup channels NAPI */
+        maxq = max(priv->plat->rx_queues_to_use, priv->plat->tx_queues_to_use);
 
-                netif_napi_add(ndev, &rx_q->napi, stmmac_poll,
-                               (8 * priv->plat->rx_queues_to_use));
+        for (queue = 0; queue < maxq; queue++) {
+                struct stmmac_channel *ch = &priv->channel[queue];
+
+                ch->priv_data = priv;
+                ch->index = queue;
+
+                if (queue < priv->plat->rx_queues_to_use)
+                        ch->has_rx = true;
+                if (queue < priv->plat->tx_queues_to_use)
+                        ch->has_tx = true;
+
+                netif_napi_add(ndev, &ch->napi, stmmac_napi_poll,
+                               NAPI_POLL_WEIGHT);
         }
 
         mutex_init(&priv->lock);
@@ -4375,10 +4402,10 @@ error_netdev_register:
             priv->hw->pcs != STMMAC_PCS_RTBI)
                 stmmac_mdio_unregister(ndev);
 error_mdio_register:
-        for (queue = 0; queue < priv->plat->rx_queues_to_use; queue++) {
-                struct stmmac_rx_queue *rx_q = &priv->rx_queue[queue];
+        for (queue = 0; queue < maxq; queue++) {
+                struct stmmac_channel *ch = &priv->channel[queue];
 
-                netif_napi_del(&rx_q->napi);
+                netif_napi_del(&ch->napi);
         }
 error_hw_init:
         destroy_workqueue(priv->wq);
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
index 3609c7b696c7..2b800ce1d5bf 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
@@ -67,7 +67,7 @@ static int dwmac1000_validate_mcast_bins(int mcast_bins)
  * Description:
  * This function validates the number of Unicast address entries supported
  * by a particular Synopsys 10/100/1000 controller. The Synopsys controller
- * supports 1, 32, 64, or 128 Unicast filter entries for it's Unicast filter
+ * supports 1..32, 64, or 128 Unicast filter entries for it's Unicast filter
  * logic. This function validates a valid, supported configuration is
  * selected, and defaults to 1 Unicast address if an unsupported
  * configuration is selected.
@@ -77,8 +77,7 @@ static int dwmac1000_validate_ucast_entries(int ucast_entries)
         int x = ucast_entries;
 
         switch (x) {
-        case 1:
-        case 32:
+        case 1 ... 32:
         case 64:
         case 128:
                 break;
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
index 1a96dd9c1091..531294f4978b 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
@@ -61,7 +61,7 @@ static int tc_fill_actions(struct stmmac_tc_entry *entry,
         struct stmmac_tc_entry *action_entry = entry;
         const struct tc_action *act;
         struct tcf_exts *exts;
-        LIST_HEAD(actions);
+        int i;
 
         exts = cls->knode.exts;
         if (!tcf_exts_has_actions(exts))
@@ -69,8 +69,7 @@ static int tc_fill_actions(struct stmmac_tc_entry *entry,
         if (frag)
                 action_entry = frag;
 
-        tcf_exts_to_list(exts, &actions);
-        list_for_each_entry(act, &actions, list) {
+        tcf_exts_for_each_action(i, act, exts) {
                 /* Accept */
                 if (is_tcf_gact_ok(act)) {
                         action_entry->val.af = 1;
diff --git a/drivers/net/ethernet/ti/Kconfig b/drivers/net/ethernet/ti/Kconfig
index 9263d638bd6d..f932923f7d56 100644
--- a/drivers/net/ethernet/ti/Kconfig
+++ b/drivers/net/ethernet/ti/Kconfig
@@ -41,6 +41,7 @@ config TI_DAVINCI_MDIO
 config TI_DAVINCI_CPDMA
         tristate "TI DaVinci CPDMA Support"
         depends on ARCH_DAVINCI || ARCH_OMAP2PLUS || COMPILE_TEST
+        select GENERIC_ALLOCATOR
         ---help---
           This driver supports TI's DaVinci CPDMA dma engine.
 
diff --git a/drivers/net/ethernet/ti/cpsw-phy-sel.c b/drivers/net/ethernet/ti/cpsw-phy-sel.c
index 0c1adad7415d..396e1cd10667 100644
--- a/drivers/net/ethernet/ti/cpsw-phy-sel.c
+++ b/drivers/net/ethernet/ti/cpsw-phy-sel.c
@@ -170,10 +170,13 @@ void cpsw_phy_sel(struct device *dev, phy_interface_t phy_mode, int slave)
         struct device_node *node;
         struct cpsw_phy_sel_priv *priv;
 
-        node = of_get_child_by_name(dev->of_node, "cpsw-phy-sel");
+        node = of_parse_phandle(dev->of_node, "cpsw-phy-sel", 0);
         if (!node) {
-                dev_err(dev, "Phy mode driver DT not found\n");
-                return;
+                node = of_get_child_by_name(dev->of_node, "cpsw-phy-sel");
+                if (!node) {
+                        dev_err(dev, "Phy mode driver DT not found\n");
+                        return;
+                }
         }
 
         dev = bus_find_device(&platform_bus_type, NULL, node, match);
diff --git a/drivers/net/ethernet/wiznet/w5100.c b/drivers/net/ethernet/wiznet/w5100.c
index 2bdfb39215e9..d8ba512f166a 100644
--- a/drivers/net/ethernet/wiznet/w5100.c
+++ b/drivers/net/ethernet/wiznet/w5100.c
@@ -835,7 +835,7 @@ static void w5100_tx_work(struct work_struct *work)
         w5100_tx_skb(priv->ndev, skb);
 }
 
-static int w5100_start_tx(struct sk_buff *skb, struct net_device *ndev)
+static netdev_tx_t w5100_start_tx(struct sk_buff *skb, struct net_device *ndev)
 {
         struct w5100_priv *priv = netdev_priv(ndev);
 
diff --git a/drivers/net/ethernet/wiznet/w5300.c b/drivers/net/ethernet/wiznet/w5300.c
index 56ae573001e8..80fdbff67d82 100644
--- a/drivers/net/ethernet/wiznet/w5300.c
+++ b/drivers/net/ethernet/wiznet/w5300.c
@@ -365,7 +365,7 @@ static void w5300_tx_timeout(struct net_device *ndev)
         netif_wake_queue(ndev);
 }
 
-static int w5300_start_tx(struct sk_buff *skb, struct net_device *ndev)
+static netdev_tx_t w5300_start_tx(struct sk_buff *skb, struct net_device *ndev)
 {
         struct w5300_priv *priv = netdev_priv(ndev);
 
diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c
index 31c3d77b4733..fe01e141c8f8 100644
--- a/drivers/net/hyperv/netvsc.c
+++ b/drivers/net/hyperv/netvsc.c
@@ -1203,6 +1203,9 @@ static void netvsc_send_vf(struct net_device *ndev,
 
         net_device_ctx->vf_alloc = nvmsg->msg.v4_msg.vf_assoc.allocated;
         net_device_ctx->vf_serial = nvmsg->msg.v4_msg.vf_assoc.serial;
+        netdev_info(ndev, "VF slot %u %s\n",
+                    net_device_ctx->vf_serial,
+                    net_device_ctx->vf_alloc ? "added" : "removed");
 }
 
 static  void netvsc_receive_inband(struct net_device *ndev,
diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index 507f68190cb1..3af6d8d15233 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -29,6 +29,7 @@
 #include <linux/netdevice.h>
 #include <linux/inetdevice.h>
 #include <linux/etherdevice.h>
+#include <linux/pci.h>
 #include <linux/skbuff.h>
 #include <linux/if_vlan.h>
 #include <linux/in.h>
@@ -1893,20 +1894,6 @@ out_unlock:
         rtnl_unlock();
 }
 
-static struct net_device *get_netvsc_bymac(const u8 *mac)
-{
-        struct net_device_context *ndev_ctx;
-
-        list_for_each_entry(ndev_ctx, &netvsc_dev_list, list) {
-                struct net_device *dev = hv_get_drvdata(ndev_ctx->device_ctx);
-
-                if (ether_addr_equal(mac, dev->perm_addr))
-                        return dev;
-        }
-
-        return NULL;
-}
-
 static struct net_device *get_netvsc_byref(struct net_device *vf_netdev)
 {
         struct net_device_context *net_device_ctx;
@@ -2035,22 +2022,48 @@ static void netvsc_vf_setup(struct work_struct *w)
         rtnl_unlock();
 }
 
+/* Find netvsc by VMBus serial number.
+ * The PCI hyperv controller records the serial number as the slot.
+ */
+static struct net_device *get_netvsc_byslot(const struct net_device *vf_netdev)
+{
+        struct device *parent = vf_netdev->dev.parent;
+        struct net_device_context *ndev_ctx;
+        struct pci_dev *pdev;
+
+        if (!parent || !dev_is_pci(parent))
+                return NULL; /* not a PCI device */
+
+        pdev = to_pci_dev(parent);
+        if (!pdev->slot) {
+                netdev_notice(vf_netdev, "no PCI slot information\n");
+                return NULL;
+        }
+
+        list_for_each_entry(ndev_ctx, &netvsc_dev_list, list) {
+                if (!ndev_ctx->vf_alloc)
+                        continue;
+
+                if (ndev_ctx->vf_serial == pdev->slot->number)
+                        return hv_get_drvdata(ndev_ctx->device_ctx);
+        }
+
+        netdev_notice(vf_netdev,
+                      "no netdev found for slot %u\n", pdev->slot->number);
+        return NULL;
+}
+
 static int netvsc_register_vf(struct net_device *vf_netdev)
 {
-        struct net_device *ndev;
         struct net_device_context *net_device_ctx;
         struct netvsc_device *netvsc_dev;
+        struct net_device *ndev;
         int ret;
 
         if (vf_netdev->addr_len != ETH_ALEN)
                 return NOTIFY_DONE;
 
-        /*
-         * We will use the MAC address to locate the synthetic interface to
-         * associate with the VF interface. If we don't find a matching
-         * synthetic interface, move on.
-         */
-        ndev = get_netvsc_bymac(vf_netdev->perm_addr);
+        ndev = get_netvsc_byslot(vf_netdev);
         if (!ndev)
                 return NOTIFY_DONE;
 
@@ -2201,6 +2214,16 @@ static int netvsc_probe(struct hv_device *dev,
 
         memcpy(net->dev_addr, device_info.mac_adr, ETH_ALEN);
 
+        /* We must get rtnl lock before scheduling nvdev->subchan_work,
+         * otherwise netvsc_subchan_work() can get rtnl lock first and wait
+         * all subchannels to show up, but that may not happen because
+         * netvsc_probe() can't get rtnl lock and as a result vmbus_onoffer()
+         * -> ... -> device_add() -> ... -> __device_attach() can't get
+         * the device lock, so all the subchannels can't be processed --
+         * finally netvsc_subchan_work() hangs for ever.
+         */
+        rtnl_lock();
+
         if (nvdev->num_chn > 1)
                 schedule_work(&nvdev->subchan_work);
 
@@ -2219,7 +2242,6 @@ static int netvsc_probe(struct hv_device *dev,
         else
                 net->max_mtu = ETH_DATA_LEN;
 
-        rtnl_lock();
         ret = register_netdevice(net);
         if (ret != 0) {
                 pr_err("Unable to register netdev.\n");
@@ -2258,17 +2280,15 @@ static int netvsc_remove(struct hv_device *dev)
 
         cancel_delayed_work_sync(&ndev_ctx->dwork);
 
-        rcu_read_lock();
-        nvdev = rcu_dereference(ndev_ctx->nvdev);
-
-        if  (nvdev)
+        rtnl_lock();
+        nvdev = rtnl_dereference(ndev_ctx->nvdev);
+        if (nvdev)
                 cancel_work_sync(&nvdev->subchan_work);
 
         /*
          * Call to the vsc driver to let it know that the device is being
          * removed. Also blocks mtu and channel changes.
          */
-        rtnl_lock();
         vf_netdev = rtnl_dereference(ndev_ctx->vf_netdev);
         if (vf_netdev)
                 netvsc_unregister_vf(vf_netdev);
@@ -2280,7 +2300,6 @@ static int netvsc_remove(struct hv_device *dev)
         list_del(&ndev_ctx->list);
 
         rtnl_unlock();
-        rcu_read_unlock();
 
         hv_set_drvdata(dev, NULL);
 
diff --git a/drivers/net/ieee802154/adf7242.c b/drivers/net/ieee802154/adf7242.c
index 23a52b9293f3..cd1d8faccca5 100644
--- a/drivers/net/ieee802154/adf7242.c
+++ b/drivers/net/ieee802154/adf7242.c
@@ -1308,8 +1308,7 @@ static int adf7242_remove(struct spi_device *spi)
 {
         struct adf7242_local *lp = spi_get_drvdata(spi);
 
-        if (!IS_ERR_OR_NULL(lp->debugfs_root))
-                debugfs_remove_recursive(lp->debugfs_root);
+        debugfs_remove_recursive(lp->debugfs_root);
 
         cancel_delayed_work_sync(&lp->work);
         destroy_workqueue(lp->wqueue);
diff --git a/drivers/net/ieee802154/ca8210.c b/drivers/net/ieee802154/ca8210.c
index 58299fb666ed..0ff5a403a8dc 100644
--- a/drivers/net/ieee802154/ca8210.c
+++ b/drivers/net/ieee802154/ca8210.c
@@ -634,10 +634,9 @@ static int ca8210_test_int_driver_write(
         for (i = 0; i < len; i++)
                 dev_dbg(&priv->spi->dev, "%#03x\n", buf[i]);
 
-        fifo_buffer = kmalloc(len, GFP_KERNEL);
+        fifo_buffer = kmemdup(buf, len, GFP_KERNEL);
         if (!fifo_buffer)
                 return -ENOMEM;
-        memcpy(fifo_buffer, buf, len);
         kfifo_in(&test->up_fifo, &fifo_buffer, 4);
         wake_up_interruptible(&priv->test.readq);
 
@@ -3044,8 +3043,7 @@ static void ca8210_test_interface_clear(struct ca8210_priv *priv)
 {
         struct ca8210_test *test = &priv->test;
 
-        if (!IS_ERR(test->ca8210_dfs_spi_int))
-                debugfs_remove(test->ca8210_dfs_spi_int);
+        debugfs_remove(test->ca8210_dfs_spi_int);
         kfifo_free(&test->up_fifo);
         dev_info(&priv->spi->dev, "Test interface removed\n");
 }
diff --git a/drivers/net/ieee802154/mcr20a.c b/drivers/net/ieee802154/mcr20a.c
index e428277781ac..04891429a554 100644
--- a/drivers/net/ieee802154/mcr20a.c
+++ b/drivers/net/ieee802154/mcr20a.c
@@ -903,19 +903,19 @@ mcr20a_irq_clean_complete(void *context)
 
         switch (seq_state) {
         /* TX IRQ, RX IRQ and SEQ IRQ */
-        case (0x03):
+        case (DAR_IRQSTS1_TXIRQ | DAR_IRQSTS1_SEQIRQ):
                 if (lp->is_tx) {
                         lp->is_tx = 0;
                         dev_dbg(printdev(lp), "TX is done. No ACK\n");
                         mcr20a_handle_tx_complete(lp);
                 }
                 break;
-        case (0x05):
+        case (DAR_IRQSTS1_RXIRQ | DAR_IRQSTS1_SEQIRQ):
                         /* rx is starting */
                         dev_dbg(printdev(lp), "RX is starting\n");
                         mcr20a_handle_rx(lp);
                 break;
-        case (0x07):
+        case (DAR_IRQSTS1_RXIRQ | DAR_IRQSTS1_TXIRQ | DAR_IRQSTS1_SEQIRQ):
                 if (lp->is_tx) {
                         /* tx is done */
                         lp->is_tx = 0;
@@ -927,7 +927,7 @@ mcr20a_irq_clean_complete(void *context)
                         mcr20a_handle_rx(lp);
                 }
                 break;
-        case (0x01):
+        case (DAR_IRQSTS1_SEQIRQ):
                 if (lp->is_tx) {
                         dev_dbg(printdev(lp), "TX is starting\n");
                         mcr20a_handle_tx(lp);
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index db1172db1e7c..19ab8a7d1e48 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -93,7 +93,12 @@ static bool mdio_bus_phy_may_suspend(struct phy_device *phydev)
         if (!netdev)
                 return !phydev->suspended;
 
-        /* Don't suspend PHY if the attached netdev parent may wakeup.
+        if (netdev->wol_enabled)
+                return false;
+
+        /* As long as not all affected network drivers support the
+         * wol_enabled flag, let's check for hints that WoL is enabled.
+         * Don't suspend PHY if the attached netdev parent may wake up.
          * The parent may point to a PCI device, as in tg3 driver.
          */
         if (netdev->dev.parent && device_may_wakeup(netdev->dev.parent))
@@ -1132,9 +1137,9 @@ void phy_detach(struct phy_device *phydev)
                 sysfs_remove_link(&dev->dev.kobj, "phydev");
                 sysfs_remove_link(&phydev->mdio.dev.kobj, "attached_dev");
         }
+        phy_suspend(phydev);
         phydev->attached_dev->phydev = NULL;
         phydev->attached_dev = NULL;
-        phy_suspend(phydev);
         phydev->phylink = NULL;
 
         phy_led_triggers_unregister(phydev);
@@ -1168,12 +1173,13 @@ EXPORT_SYMBOL(phy_detach);
 int phy_suspend(struct phy_device *phydev)
 {
         struct phy_driver *phydrv = to_phy_driver(phydev->mdio.dev.driver);
+        struct net_device *netdev = phydev->attached_dev;
         struct ethtool_wolinfo wol = { .cmd = ETHTOOL_GWOL };
         int ret = 0;
 
         /* If the device has WOL enabled, we cannot suspend the PHY */
         phy_ethtool_get_wol(phydev, &wol);
-        if (wol.wolopts)
+        if (wol.wolopts || (netdev && netdev->wol_enabled))
                 return -EBUSY;
 
         if (phydev->drv && phydrv->suspend)
diff --git a/drivers/net/phy/sfp-bus.c b/drivers/net/phy/sfp-bus.c
index 740655261e5b..83060fb349f4 100644
--- a/drivers/net/phy/sfp-bus.c
+++ b/drivers/net/phy/sfp-bus.c
@@ -349,6 +349,7 @@ static int sfp_register_bus(struct sfp_bus *bus)
         }
         if (bus->started)
                 bus->socket_ops->start(bus->sfp);
+        bus->netdev->sfp_bus = bus;
         bus->registered = true;
         return 0;
 }
@@ -357,6 +358,7 @@ static void sfp_unregister_bus(struct sfp_bus *bus)
 {
         const struct sfp_upstream_ops *ops = bus->upstream_ops;
 
+        bus->netdev->sfp_bus = NULL;
         if (bus->registered) {
                 if (bus->started)
                         bus->socket_ops->stop(bus->sfp);
@@ -438,7 +440,6 @@ static void sfp_upstream_clear(struct sfp_bus *bus)
 {
         bus->upstream_ops = NULL;
         bus->upstream = NULL;
-        bus->netdev->sfp_bus = NULL;
         bus->netdev = NULL;
 }
 
@@ -467,7 +468,6 @@ struct sfp_bus *sfp_register_upstream(struct fwnode_handle *fwnode,
                 bus->upstream_ops = ops;
                 bus->upstream = upstream;
                 bus->netdev = ndev;
-                ndev->sfp_bus = bus;
 
                 if (bus->sfp) {
                         ret = sfp_register_bus(bus);
diff --git a/drivers/net/phy/sfp.c b/drivers/net/phy/sfp.c
index 4637d980310e..6e13b8832bc7 100644
--- a/drivers/net/phy/sfp.c
+++ b/drivers/net/phy/sfp.c
@@ -398,7 +398,6 @@ static umode_t sfp_hwmon_is_visible(const void *data,
         switch (type) {
         case hwmon_temp:
                 switch (attr) {
-                case hwmon_temp_input:
                 case hwmon_temp_min_alarm:
                 case hwmon_temp_max_alarm:
                 case hwmon_temp_lcrit_alarm:
@@ -407,13 +406,16 @@ static umode_t sfp_hwmon_is_visible(const void *data,
                 case hwmon_temp_max:
                 case hwmon_temp_lcrit:
                 case hwmon_temp_crit:
+                        if (!(sfp->id.ext.enhopts & SFP_ENHOPTS_ALARMWARN))
+                                return 0;
+                        /* fall through */
+                case hwmon_temp_input:
                         return 0444;
                 default:
                         return 0;
                 }
         case hwmon_in:
                 switch (attr) {
-                case hwmon_in_input:
                 case hwmon_in_min_alarm:
                 case hwmon_in_max_alarm:
                 case hwmon_in_lcrit_alarm:
@@ -422,13 +424,16 @@ static umode_t sfp_hwmon_is_visible(const void *data,
                 case hwmon_in_max:
                 case hwmon_in_lcrit:
                 case hwmon_in_crit:
+                        if (!(sfp->id.ext.enhopts & SFP_ENHOPTS_ALARMWARN))
+                                return 0;
+                        /* fall through */
+                case hwmon_in_input:
                         return 0444;
                 default:
                         return 0;
                 }
         case hwmon_curr:
                 switch (attr) {
-                case hwmon_curr_input:
                 case hwmon_curr_min_alarm:
                 case hwmon_curr_max_alarm:
                 case hwmon_curr_lcrit_alarm:
@@ -437,6 +442,10 @@ static umode_t sfp_hwmon_is_visible(const void *data,
                 case hwmon_curr_max:
                 case hwmon_curr_lcrit:
                 case hwmon_curr_crit:
+                        if (!(sfp->id.ext.enhopts & SFP_ENHOPTS_ALARMWARN))
+                                return 0;
+                        /* fall through */
+                case hwmon_curr_input:
                         return 0444;
                 default:
                         return 0;
@@ -452,7 +461,6 @@ static umode_t sfp_hwmon_is_visible(const void *data,
                     channel == 1)
                         return 0;
                 switch (attr) {
-                case hwmon_power_input:
                 case hwmon_power_min_alarm:
                 case hwmon_power_max_alarm:
                 case hwmon_power_lcrit_alarm:
@@ -461,6 +469,10 @@ static umode_t sfp_hwmon_is_visible(const void *data,
                 case hwmon_power_max:
                 case hwmon_power_lcrit:
                 case hwmon_power_crit:
+                        if (!(sfp->id.ext.enhopts & SFP_ENHOPTS_ALARMWARN))
+                                return 0;
+                        /* fall through */
+                case hwmon_power_input:
                         return 0444;
                 default:
                         return 0;
@@ -1086,8 +1098,11 @@ static int sfp_hwmon_insert(struct sfp *sfp)
 
 static void sfp_hwmon_remove(struct sfp *sfp)
 {
-        hwmon_device_unregister(sfp->hwmon_dev);
-        kfree(sfp->hwmon_name);
+        if (!IS_ERR_OR_NULL(sfp->hwmon_dev)) {
+                hwmon_device_unregister(sfp->hwmon_dev);
+                sfp->hwmon_dev = NULL;
+                kfree(sfp->hwmon_name);
+        }
 }
 #else
 static int sfp_hwmon_insert(struct sfp *sfp)
diff --git a/drivers/net/ppp/pppoe.c b/drivers/net/ppp/pppoe.c
index ce61231e96ea..62dc564b251d 100644
--- a/drivers/net/ppp/pppoe.c
+++ b/drivers/net/ppp/pppoe.c
@@ -429,6 +429,9 @@ static int pppoe_rcv(struct sk_buff *skb, struct net_device *dev,
         if (!skb)
                 goto out;
 
+        if (skb_mac_header_len(skb) < ETH_HLEN)
+                goto drop;
+
         if (!pskb_may_pull(skb, sizeof(struct pppoe_hdr)))
                 goto drop;
 
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index ebd07ad82431..50e9cc19023a 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -181,6 +181,7 @@ struct tun_file {
         };
         struct napi_struct napi;
         bool napi_enabled;
+        bool napi_frags_enabled;
         struct mutex napi_mutex;        /* Protects access to the above napi */
         struct list_head next;
         struct tun_struct *detached;
@@ -313,32 +314,32 @@ static int tun_napi_poll(struct napi_struct *napi, int budget)
 }
 
 static void tun_napi_init(struct tun_struct *tun, struct tun_file *tfile,
-                          bool napi_en)
+                          bool napi_en, bool napi_frags)
 {
         tfile->napi_enabled = napi_en;
+        tfile->napi_frags_enabled = napi_en && napi_frags;
         if (napi_en) {
                 netif_napi_add(tun->dev, &tfile->napi, tun_napi_poll,
                                NAPI_POLL_WEIGHT);
                 napi_enable(&tfile->napi);
-                mutex_init(&tfile->napi_mutex);
         }
 }
 
-static void tun_napi_disable(struct tun_struct *tun, struct tun_file *tfile)
+static void tun_napi_disable(struct tun_file *tfile)
 {
         if (tfile->napi_enabled)
                 napi_disable(&tfile->napi);
 }
 
-static void tun_napi_del(struct tun_struct *tun, struct tun_file *tfile)
+static void tun_napi_del(struct tun_file *tfile)
 {
         if (tfile->napi_enabled)
                 netif_napi_del(&tfile->napi);
 }
 
-static bool tun_napi_frags_enabled(const struct tun_struct *tun)
+static bool tun_napi_frags_enabled(const struct tun_file *tfile)
 {
-        return READ_ONCE(tun->flags) & IFF_NAPI_FRAGS;
+        return tfile->napi_frags_enabled;
 }
 
 #ifdef CONFIG_TUN_VNET_CROSS_LE
@@ -690,8 +691,8 @@ static void __tun_detach(struct tun_file *tfile, bool clean)
         tun = rtnl_dereference(tfile->tun);
 
         if (tun && clean) {
-                tun_napi_disable(tun, tfile);
-                tun_napi_del(tun, tfile);
+                tun_napi_disable(tfile);
+                tun_napi_del(tfile);
         }
 
         if (tun && !tfile->detached) {
@@ -758,7 +759,7 @@ static void tun_detach_all(struct net_device *dev)
         for (i = 0; i < n; i++) {
                 tfile = rtnl_dereference(tun->tfiles[i]);
                 BUG_ON(!tfile);
-                tun_napi_disable(tun, tfile);
+                tun_napi_disable(tfile);
                 tfile->socket.sk->sk_shutdown = RCV_SHUTDOWN;
                 tfile->socket.sk->sk_data_ready(tfile->socket.sk);
                 RCU_INIT_POINTER(tfile->tun, NULL);
@@ -774,7 +775,7 @@ static void tun_detach_all(struct net_device *dev)
         synchronize_net();
         for (i = 0; i < n; i++) {
                 tfile = rtnl_dereference(tun->tfiles[i]);
-                tun_napi_del(tun, tfile);
+                tun_napi_del(tfile);
                 /* Drop read queue */
                 tun_queue_purge(tfile);
                 xdp_rxq_info_unreg(&tfile->xdp_rxq);
@@ -793,7 +794,7 @@ static void tun_detach_all(struct net_device *dev)
 }
 
 static int tun_attach(struct tun_struct *tun, struct file *file,
-                      bool skip_filter, bool napi)
+                      bool skip_filter, bool napi, bool napi_frags)
 {
         struct tun_file *tfile = file->private_data;
         struct net_device *dev = tun->dev;
@@ -866,7 +867,7 @@ static int tun_attach(struct tun_struct *tun, struct file *file,
                 tun_enable_queue(tfile);
         } else {
                 sock_hold(&tfile->sk);
-                tun_napi_init(tun, tfile, napi);
+                tun_napi_init(tun, tfile, napi, napi_frags);
         }
 
         tun_set_real_num_queues(tun);
@@ -1153,43 +1154,6 @@ static netdev_features_t tun_net_fix_features(struct net_device *dev,
 
         return (features & tun->set_features) | (features & ~TUN_USER_FEATURES);
 }
-#ifdef CONFIG_NET_POLL_CONTROLLER
-static void tun_poll_controller(struct net_device *dev)
-{
-        /*
-         * Tun only receives frames when:
-         * 1) the char device endpoint gets data from user space
-         * 2) the tun socket gets a sendmsg call from user space
-         * If NAPI is not enabled, since both of those are synchronous
-         * operations, we are guaranteed never to have pending data when we poll
-         * for it so there is nothing to do here but return.
-         * We need this though so netpoll recognizes us as an interface that
-         * supports polling, which enables bridge devices in virt setups to
-         * still use netconsole
-         * If NAPI is enabled, however, we need to schedule polling for all
-         * queues unless we are using napi_gro_frags(), which we call in
-         * process context and not in NAPI context.
-         */
-        struct tun_struct *tun = netdev_priv(dev);
-
-        if (tun->flags & IFF_NAPI) {
-                struct tun_file *tfile;
-                int i;
-
-                if (tun_napi_frags_enabled(tun))
-                        return;
-
-                rcu_read_lock();
-                for (i = 0; i < tun->numqueues; i++) {
-                        tfile = rcu_dereference(tun->tfiles[i]);
-                        if (tfile->napi_enabled)
-                                napi_schedule(&tfile->napi);
-                }
-                rcu_read_unlock();
-        }
-        return;
-}
-#endif
 
 static void tun_set_headroom(struct net_device *dev, int new_hr)
 {
@@ -1283,9 +1247,6 @@ static const struct net_device_ops tun_netdev_ops = {
         .ndo_start_xmit         = tun_net_xmit,
         .ndo_fix_features       = tun_net_fix_features,
         .ndo_select_queue       = tun_select_queue,
-#ifdef CONFIG_NET_POLL_CONTROLLER
-        .ndo_poll_controller    = tun_poll_controller,
-#endif
         .ndo_set_rx_headroom    = tun_set_headroom,
         .ndo_get_stats64        = tun_net_get_stats64,
 };
@@ -1365,9 +1326,6 @@ static const struct net_device_ops tap_netdev_ops = {
         .ndo_set_mac_address    = eth_mac_addr,
         .ndo_validate_addr      = eth_validate_addr,
         .ndo_select_queue       = tun_select_queue,
-#ifdef CONFIG_NET_POLL_CONTROLLER
-        .ndo_poll_controller    = tun_poll_controller,
-#endif
         .ndo_features_check     = passthru_features_check,
         .ndo_set_rx_headroom    = tun_set_headroom,
         .ndo_get_stats64        = tun_net_get_stats64,
@@ -1752,7 +1710,7 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
         int err;
         u32 rxhash = 0;
         int skb_xdp = 1;
-        bool frags = tun_napi_frags_enabled(tun);
+        bool frags = tun_napi_frags_enabled(tfile);
 
         if (!(tun->dev->flags & IFF_UP))
                 return -EIO;
@@ -2577,7 +2535,8 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
                         return err;
 
                 err = tun_attach(tun, file, ifr->ifr_flags & IFF_NOFILTER,
-                                 ifr->ifr_flags & IFF_NAPI);
+                                 ifr->ifr_flags & IFF_NAPI,
+                                 ifr->ifr_flags & IFF_NAPI_FRAGS);
                 if (err < 0)
                         return err;
 
@@ -2675,7 +2634,8 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
                               (ifr->ifr_flags & TUN_FEATURES);
 
                 INIT_LIST_HEAD(&tun->disabled);
-                err = tun_attach(tun, file, false, ifr->ifr_flags & IFF_NAPI);
+                err = tun_attach(tun, file, false, ifr->ifr_flags & IFF_NAPI,
+                                 ifr->ifr_flags & IFF_NAPI_FRAGS);
                 if (err < 0)
                         goto err_free_flow;
 
@@ -2824,7 +2784,8 @@ static int tun_set_queue(struct file *file, struct ifreq *ifr)
                 ret = security_tun_dev_attach_queue(tun->security);
                 if (ret < 0)
                         goto unlock;
-                ret = tun_attach(tun, file, false, tun->flags & IFF_NAPI);
+                ret = tun_attach(tun, file, false, tun->flags & IFF_NAPI,
+                                 tun->flags & IFF_NAPI_FRAGS);
         } else if (ifr->ifr_flags & IFF_DETACH_QUEUE) {
                 tun = rtnl_dereference(tfile->tun);
                 if (!tun || !(tun->flags & IFF_MULTI_QUEUE) || tfile->detached)
@@ -3242,6 +3203,7 @@ static int tun_chr_open(struct inode *inode, struct file * file)
                 return -ENOMEM;
         }
 
+        mutex_init(&tfile->napi_mutex);
         RCU_INIT_POINTER(tfile->tun, NULL);
         tfile->flags = 0;
         tfile->ifindex = 0;
diff --git a/drivers/net/usb/asix_common.c b/drivers/net/usb/asix_common.c
index e95dd12edec4..023b8d0bf175 100644
--- a/drivers/net/usb/asix_common.c
+++ b/drivers/net/usb/asix_common.c
@@ -607,6 +607,9 @@ int asix_set_wol(struct net_device *net, struct ethtool_wolinfo *wolinfo)
         struct usbnet *dev = netdev_priv(net);
         u8 opt = 0;
 
+        if (wolinfo->wolopts & ~(WAKE_PHY | WAKE_MAGIC))
+                return -EINVAL;
+
         if (wolinfo->wolopts & WAKE_PHY)
                 opt |= AX_MONITOR_LINK;
         if (wolinfo->wolopts & WAKE_MAGIC)
diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c
index 9e8ad372f419..2207f7a7d1ff 100644
--- a/drivers/net/usb/ax88179_178a.c
+++ b/drivers/net/usb/ax88179_178a.c
@@ -566,6 +566,9 @@ ax88179_set_wol(struct net_device *net, struct ethtool_wolinfo *wolinfo)
         struct usbnet *dev = netdev_priv(net);
         u8 opt = 0;
 
+        if (wolinfo->wolopts & ~(WAKE_PHY | WAKE_MAGIC))
+                return -EINVAL;
+
         if (wolinfo->wolopts & WAKE_PHY)
                 opt |= AX_MONITOR_MODE_RWLC;
         if (wolinfo->wolopts & WAKE_MAGIC)
diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
index a9991c5f4736..c3c9ba44e2a1 100644
--- a/drivers/net/usb/lan78xx.c
+++ b/drivers/net/usb/lan78xx.c
@@ -1401,19 +1401,10 @@ static int lan78xx_set_wol(struct net_device *netdev,
         if (ret < 0)
                 return ret;
 
-        pdata->wol = 0;
-        if (wol->wolopts & WAKE_UCAST)
-                pdata->wol |= WAKE_UCAST;
-        if (wol->wolopts & WAKE_MCAST)
-                pdata->wol |= WAKE_MCAST;
-        if (wol->wolopts & WAKE_BCAST)
-                pdata->wol |= WAKE_BCAST;
-        if (wol->wolopts & WAKE_MAGIC)
-                pdata->wol |= WAKE_MAGIC;
-        if (wol->wolopts & WAKE_PHY)
-                pdata->wol |= WAKE_PHY;
-        if (wol->wolopts & WAKE_ARP)
-                pdata->wol |= WAKE_ARP;
+        if (wol->wolopts & ~WAKE_ALL)
+                return -EINVAL;
+
+        pdata->wol = wol->wolopts;
 
         device_set_wakeup_enable(&dev->udev->dev, (bool)wol->wolopts);
 
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index cb0cc30c3d6a..533b6fb8d923 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -967,6 +967,13 @@ static const struct usb_device_id products[] = {
                 USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0x581d, USB_CLASS_VENDOR_SPEC, 1, 7),
                 .driver_info = (unsigned long)&qmi_wwan_info,
         },
+        {       /* Quectel EP06/EG06/EM06 */
+                USB_DEVICE_AND_INTERFACE_INFO(0x2c7c, 0x0306,
+                                              USB_CLASS_VENDOR_SPEC,
+                                              USB_SUBCLASS_VENDOR_SPEC,
+                                              0xff),
+                .driver_info        = (unsigned long)&qmi_wwan_info_quirk_dtr,
+        },
 
         /* 3. Combined interface devices matching on interface number */
         {QMI_FIXED_INTF(0x0408, 0xea42, 4)},    /* Yota / Megafon M100-1 */
@@ -1206,13 +1213,13 @@ static const struct usb_device_id products[] = {
         {QMI_FIXED_INTF(0x1199, 0x9061, 8)},    /* Sierra Wireless Modem */
         {QMI_FIXED_INTF(0x1199, 0x9063, 8)},    /* Sierra Wireless EM7305 */
         {QMI_FIXED_INTF(0x1199, 0x9063, 10)},   /* Sierra Wireless EM7305 */
-        {QMI_FIXED_INTF(0x1199, 0x9071, 8)},    /* Sierra Wireless MC74xx */
-        {QMI_FIXED_INTF(0x1199, 0x9071, 10)},   /* Sierra Wireless MC74xx */
-        {QMI_FIXED_INTF(0x1199, 0x9079, 8)},    /* Sierra Wireless EM74xx */
-        {QMI_FIXED_INTF(0x1199, 0x9079, 10)},   /* Sierra Wireless EM74xx */
-        {QMI_FIXED_INTF(0x1199, 0x907b, 8)},    /* Sierra Wireless EM74xx */
-        {QMI_FIXED_INTF(0x1199, 0x907b, 10)},   /* Sierra Wireless EM74xx */
-        {QMI_FIXED_INTF(0x1199, 0x9091, 8)},    /* Sierra Wireless EM7565 */
+        {QMI_QUIRK_SET_DTR(0x1199, 0x9071, 8)}, /* Sierra Wireless MC74xx */
+        {QMI_QUIRK_SET_DTR(0x1199, 0x9071, 10)},/* Sierra Wireless MC74xx */
+        {QMI_QUIRK_SET_DTR(0x1199, 0x9079, 8)}, /* Sierra Wireless EM74xx */
+        {QMI_QUIRK_SET_DTR(0x1199, 0x9079, 10)},/* Sierra Wireless EM74xx */
+        {QMI_QUIRK_SET_DTR(0x1199, 0x907b, 8)}, /* Sierra Wireless EM74xx */
+        {QMI_QUIRK_SET_DTR(0x1199, 0x907b, 10)},/* Sierra Wireless EM74xx */
+        {QMI_QUIRK_SET_DTR(0x1199, 0x9091, 8)}, /* Sierra Wireless EM7565 */
         {QMI_FIXED_INTF(0x1bbb, 0x011e, 4)},    /* Telekom Speedstick LTE II (Alcatel One Touch L100V LTE) */
         {QMI_FIXED_INTF(0x1bbb, 0x0203, 2)},    /* Alcatel L800MA */
         {QMI_FIXED_INTF(0x2357, 0x0201, 4)},    /* TP-LINK HSUPA Modem MA180 */
@@ -1255,7 +1262,6 @@ static const struct usb_device_id products[] = {
         {QMI_QUIRK_SET_DTR(0x2c7c, 0x0121, 4)}, /* Quectel EC21 Mini PCIe */
         {QMI_QUIRK_SET_DTR(0x2c7c, 0x0191, 4)}, /* Quectel EG91 */
         {QMI_FIXED_INTF(0x2c7c, 0x0296, 4)},    /* Quectel BG96 */
-        {QMI_QUIRK_SET_DTR(0x2c7c, 0x0306, 4)}, /* Quectel EP06 Mini PCIe */
 
         /* 4. Gobi 1000 devices */
         {QMI_GOBI1K_DEVICE(0x05c6, 0x9212)},    /* Acer Gobi Modem Device */
@@ -1331,6 +1337,19 @@ static bool quectel_ec20_detected(struct usb_interface *intf)
         return false;
 }
 
+static bool quectel_ep06_diag_detected(struct usb_interface *intf)
+{
+        struct usb_device *dev = interface_to_usbdev(intf);
+        struct usb_interface_descriptor intf_desc = intf->cur_altsetting->desc;
+
+        if (le16_to_cpu(dev->descriptor.idVendor) == 0x2c7c &&
+            le16_to_cpu(dev->descriptor.idProduct) == 0x0306 &&
+            intf_desc.bNumEndpoints == 2)
+                return true;
+
+        return false;
+}
+
 static int qmi_wwan_probe(struct usb_interface *intf,
                           const struct usb_device_id *prod)
 {
@@ -1365,6 +1384,15 @@ static int qmi_wwan_probe(struct usb_interface *intf,
                 return -ENODEV;
         }
 
+        /* Quectel EP06/EM06/EG06 supports dynamic interface configuration, so
+         * we need to match on class/subclass/protocol. These values are
+         * identical for the diagnostic- and QMI-interface, but bNumEndpoints is
+         * different. Ignore the current interface if the number of endpoints
+         * the number for the diag interface (two).
+         */
+        if (quectel_ep06_diag_detected(intf))
+                return -ENODEV;
+
         return usbnet_probe(intf, id);
 }
 
diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index 97742708460b..f1b5201cc320 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -4506,6 +4506,9 @@ static int rtl8152_set_wol(struct net_device *dev, struct ethtool_wolinfo *wol)
         if (!rtl_can_wakeup(tp))
                 return -EOPNOTSUPP;
 
+        if (wol->wolopts & ~WAKE_ANY)
+                return -EINVAL;
+
         ret = usb_autopm_get_interface(tp->intf);
         if (ret < 0)
                 goto out_set_wol;
@@ -5217,8 +5220,8 @@ static int rtl8152_probe(struct usb_interface *intf,
                 netdev->hw_features &= ~NETIF_F_RXCSUM;
         }
 
-        if (le16_to_cpu(udev->descriptor.bcdDevice) == 0x3011 &&
-            udev->serial && !strcmp(udev->serial, "000001000000")) {
+        if (le16_to_cpu(udev->descriptor.bcdDevice) == 0x3011 && udev->serial &&
+            (!strcmp(udev->serial, "000001000000") || !strcmp(udev->serial, "000002000000"))) {
                 dev_info(&udev->dev, "Dell TB16 Dock, disable RX aggregation");
                 set_bit(DELL_TB_RX_AGG_BUG, &tp->flags);
         }
diff --git a/drivers/net/usb/smsc75xx.c b/drivers/net/usb/smsc75xx.c
index 05553d252446..e5a4cbb366dc 100644
--- a/drivers/net/usb/smsc75xx.c
+++ b/drivers/net/usb/smsc75xx.c
@@ -731,6 +731,9 @@ static int smsc75xx_ethtool_set_wol(struct net_device *net,
         struct smsc75xx_priv *pdata = (struct smsc75xx_priv *)(dev->data[0]);
         int ret;
 
+        if (wolinfo->wolopts & ~SUPPORTED_WAKE)
+                return -EINVAL;
+
         pdata->wolopts = wolinfo->wolopts & SUPPORTED_WAKE;
 
         ret = device_set_wakeup_enable(&dev->udev->dev, pdata->wolopts);
diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c
index 06b4d290784d..262e7a3c23cb 100644
--- a/drivers/net/usb/smsc95xx.c
+++ b/drivers/net/usb/smsc95xx.c
@@ -774,6 +774,9 @@ static int smsc95xx_ethtool_set_wol(struct net_device *net,
         struct smsc95xx_priv *pdata = (struct smsc95xx_priv *)(dev->data[0]);
         int ret;
 
+        if (wolinfo->wolopts & ~SUPPORTED_WAKE)
+                return -EINVAL;
+
         pdata->wolopts = wolinfo->wolopts & SUPPORTED_WAKE;
 
         ret = device_set_wakeup_enable(&dev->udev->dev, pdata->wolopts);
diff --git a/drivers/net/usb/sr9800.c b/drivers/net/usb/sr9800.c
index 9277a0f228df..35f39f23d881 100644
--- a/drivers/net/usb/sr9800.c
+++ b/drivers/net/usb/sr9800.c
@@ -421,6 +421,9 @@ sr_set_wol(struct net_device *net, struct ethtool_wolinfo *wolinfo)
         struct usbnet *dev = netdev_priv(net);
         u8 opt = 0;
 
+        if (wolinfo->wolopts & ~(WAKE_PHY | WAKE_MAGIC))
+                return -EINVAL;
+
         if (wolinfo->wolopts & WAKE_PHY)
                 opt |= SR_MONITOR_LINK;
         if (wolinfo->wolopts & WAKE_MAGIC)
diff --git a/drivers/net/veth.c b/drivers/net/veth.c
index 8d679c8b7f25..41a00cd76955 100644
--- a/drivers/net/veth.c
+++ b/drivers/net/veth.c
@@ -463,6 +463,8 @@ static struct sk_buff *veth_xdp_rcv_skb(struct veth_rq *rq, struct sk_buff *skb,
         int mac_len, delta, off;
         struct xdp_buff xdp;
 
+        skb_orphan(skb);
+
         rcu_read_lock();
         xdp_prog = rcu_dereference(rq->xdp_prog);
         if (unlikely(!xdp_prog)) {
@@ -508,8 +510,6 @@ static struct sk_buff *veth_xdp_rcv_skb(struct veth_rq *rq, struct sk_buff *skb,
                 skb_copy_header(nskb, skb);
                 head_off = skb_headroom(nskb) - skb_headroom(skb);
                 skb_headers_offset_update(nskb, head_off);
-                if (skb->sk)
-                        skb_set_owner_w(nskb, skb->sk);
                 consume_skb(skb);
                 skb = nskb;
         }
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 765920905226..dab504ec5e50 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -1699,17 +1699,6 @@ static void virtnet_stats(struct net_device *dev,
         tot->rx_frame_errors = dev->stats.rx_frame_errors;
 }
 
-#ifdef CONFIG_NET_POLL_CONTROLLER
-static void virtnet_netpoll(struct net_device *dev)
-{
-        struct virtnet_info *vi = netdev_priv(dev);
-        int i;
-
-        for (i = 0; i < vi->curr_queue_pairs; i++)
-                napi_schedule(&vi->rq[i].napi);
-}
-#endif
-
 static void virtnet_ack_link_announce(struct virtnet_info *vi)
 {
         rtnl_lock();
@@ -2447,9 +2436,6 @@ static const struct net_device_ops virtnet_netdev = {
         .ndo_get_stats64     = virtnet_stats,
         .ndo_vlan_rx_add_vid = virtnet_vlan_rx_add_vid,
         .ndo_vlan_rx_kill_vid = virtnet_vlan_rx_kill_vid,
-#ifdef CONFIG_NET_POLL_CONTROLLER
-        .ndo_poll_controller = virtnet_netpoll,
-#endif
         .ndo_bpf                = virtnet_xdp,
         .ndo_xdp_xmit           = virtnet_xdp_xmit,
         .ndo_features_check     = passthru_features_check,
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index ababba37d735..2b8da2b7e721 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -3539,6 +3539,7 @@ static size_t vxlan_get_size(const struct net_device *dev)
                 nla_total_size(sizeof(__u32)) + /* IFLA_VXLAN_LINK */
                 nla_total_size(sizeof(struct in6_addr)) + /* IFLA_VXLAN_LOCAL{6} */
                 nla_total_size(sizeof(__u8)) +  /* IFLA_VXLAN_TTL */
+                nla_total_size(sizeof(__u8)) +  /* IFLA_VXLAN_TTL_INHERIT */
                 nla_total_size(sizeof(__u8)) +  /* IFLA_VXLAN_TOS */
                 nla_total_size(sizeof(__be32)) + /* IFLA_VXLAN_LABEL */
                 nla_total_size(sizeof(__u8)) +  /* IFLA_VXLAN_LEARNING */
@@ -3603,6 +3604,8 @@ static int vxlan_fill_info(struct sk_buff *skb, const struct net_device *dev)
         }
 
         if (nla_put_u8(skb, IFLA_VXLAN_TTL, vxlan->cfg.ttl) ||
+            nla_put_u8(skb, IFLA_VXLAN_TTL_INHERIT,
+                       !!(vxlan->cfg.flags & VXLAN_F_TTL_INHERIT)) ||
             nla_put_u8(skb, IFLA_VXLAN_TOS, vxlan->cfg.tos) ||
             nla_put_be32(skb, IFLA_VXLAN_LABEL, vxlan->cfg.label) ||
             nla_put_u8(skb, IFLA_VXLAN_LEARNING,
diff --git a/drivers/net/wimax/i2400m/control.c b/drivers/net/wimax/i2400m/control.c
index 094cea775d0c..ef298d8525c5 100644
--- a/drivers/net/wimax/i2400m/control.c
+++ b/drivers/net/wimax/i2400m/control.c
@@ -257,7 +257,7 @@ static const struct
         [I2400M_MS_ACCESSIBILITY_ERROR] = { "accesibility error", -EIO },
         [I2400M_MS_BUSY] = { "busy", -EBUSY },
         [I2400M_MS_CORRUPTED_TLV] = { "corrupted TLV", -EILSEQ },
-        [I2400M_MS_UNINITIALIZED] = { "not unitialized", -EILSEQ },
+        [I2400M_MS_UNINITIALIZED] = { "uninitialized", -EILSEQ },
         [I2400M_MS_UNKNOWN_ERROR] = { "unknown error", -EIO },
         [I2400M_MS_PRODUCTION_ERROR] = { "production error", -EIO },
         [I2400M_MS_NO_RF] = { "no RF", -EIO },
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
index b4c3a957c102..73969dbeb5c5 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
@@ -985,15 +985,12 @@ iwl_parse_nvm_mcc_info(struct device *dev, const struct iwl_cfg *cfg,
         const u8 *nvm_chan = cfg->nvm_type == IWL_NVM_EXT ?
                              iwl_ext_nvm_channels : iwl_nvm_channels;
         struct ieee80211_regdomain *regd, *copy_rd;
-        int size_of_regd, regd_to_copy, wmms_to_copy;
-        int size_of_wmms = 0;
+        int size_of_regd, regd_to_copy;
         struct ieee80211_reg_rule *rule;
-        struct ieee80211_wmm_rule *wmm_rule, *d_wmm, *s_wmm;
         struct regdb_ptrs *regdb_ptrs;
         enum nl80211_band band;
         int center_freq, prev_center_freq = 0;
-        int valid_rules = 0, n_wmms = 0;
-        int i;
+        int valid_rules = 0;
         bool new_rule;
         int max_num_ch = cfg->nvm_type == IWL_NVM_EXT ?
                          IWL_NVM_NUM_CHANNELS_EXT : IWL_NVM_NUM_CHANNELS;
@@ -1012,11 +1009,7 @@ iwl_parse_nvm_mcc_info(struct device *dev, const struct iwl_cfg *cfg,
                 sizeof(struct ieee80211_regdomain) +
                 num_of_ch * sizeof(struct ieee80211_reg_rule);
 
-        if (geo_info & GEO_WMM_ETSI_5GHZ_INFO)
-                size_of_wmms =
-                        num_of_ch * sizeof(struct ieee80211_wmm_rule);
-
-        regd = kzalloc(size_of_regd + size_of_wmms, GFP_KERNEL);
+        regd = kzalloc(size_of_regd, GFP_KERNEL);
         if (!regd)
                 return ERR_PTR(-ENOMEM);
 
@@ -1030,8 +1023,6 @@ iwl_parse_nvm_mcc_info(struct device *dev, const struct iwl_cfg *cfg,
         regd->alpha2[0] = fw_mcc >> 8;
         regd->alpha2[1] = fw_mcc & 0xff;
 
-        wmm_rule = (struct ieee80211_wmm_rule *)((u8 *)regd + size_of_regd);
-
         for (ch_idx = 0; ch_idx < num_of_ch; ch_idx++) {
                 ch_flags = (u16)__le32_to_cpup(channels + ch_idx);
                 band = (ch_idx < NUM_2GHZ_CHANNELS) ?
@@ -1085,26 +1076,10 @@ iwl_parse_nvm_mcc_info(struct device *dev, const struct iwl_cfg *cfg,
                     band == NL80211_BAND_2GHZ)
                         continue;
 
-                if (!reg_query_regdb_wmm(regd->alpha2, center_freq,
-                                         &regdb_ptrs[n_wmms].token, wmm_rule)) {
-                        /* Add only new rules */
-                        for (i = 0; i < n_wmms; i++) {
-                                if (regdb_ptrs[i].token ==
-                                    regdb_ptrs[n_wmms].token) {
-                                        rule->wmm_rule = regdb_ptrs[i].rule;
-                                        break;
-                                }
-                        }
-                        if (i == n_wmms) {
-                                rule->wmm_rule = wmm_rule;
-                                regdb_ptrs[n_wmms++].rule = wmm_rule;
-                                wmm_rule++;
-                        }
-                }
+                reg_query_regdb_wmm(regd->alpha2, center_freq, rule);
         }
 
         regd->n_reg_rules = valid_rules;
-        regd->n_wmm_rules = n_wmms;
 
         /*
          * Narrow down regdom for unused regulatory rules to prevent hole
@@ -1113,28 +1088,13 @@ iwl_parse_nvm_mcc_info(struct device *dev, const struct iwl_cfg *cfg,
         regd_to_copy = sizeof(struct ieee80211_regdomain) +
                 valid_rules * sizeof(struct ieee80211_reg_rule);
 
-        wmms_to_copy = sizeof(struct ieee80211_wmm_rule) * n_wmms;
-
-        copy_rd = kzalloc(regd_to_copy + wmms_to_copy, GFP_KERNEL);
+        copy_rd = kzalloc(regd_to_copy, GFP_KERNEL);
         if (!copy_rd) {
                 copy_rd = ERR_PTR(-ENOMEM);
                 goto out;
         }
 
         memcpy(copy_rd, regd, regd_to_copy);
-        memcpy((u8 *)copy_rd + regd_to_copy, (u8 *)regd + size_of_regd,
-               wmms_to_copy);
-
-        d_wmm = (struct ieee80211_wmm_rule *)((u8 *)copy_rd + regd_to_copy);
-        s_wmm = (struct ieee80211_wmm_rule *)((u8 *)regd + size_of_regd);
-
-        for (i = 0; i < regd->n_reg_rules; i++) {
-                if (!regd->reg_rules[i].wmm_rule)
-                        continue;
-
-                copy_rd->reg_rules[i].wmm_rule = d_wmm +
-                        (regd->reg_rules[i].wmm_rule - s_wmm);
-        }
 
 out:
         kfree(regdb_ptrs);
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index 998dfac0fcff..07442ada6dd0 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -34,6 +34,7 @@
 #include <net/net_namespace.h>
 #include <net/netns/generic.h>
 #include <linux/rhashtable.h>
+#include <linux/nospec.h>
 #include "mac80211_hwsim.h"
 
 #define WARN_QUEUE 100
@@ -519,7 +520,6 @@ struct mac80211_hwsim_data {
         int channels, idx;
         bool use_chanctx;
         bool destroy_on_close;
-        struct work_struct destroy_work;
         u32 portid;
         char alpha2[2];
         const struct ieee80211_regdomain *regd;
@@ -2820,9 +2820,6 @@ static int mac80211_hwsim_new_radio(struct genl_info *info,
                                 IEEE80211_VHT_CAP_SHORT_GI_80 |
                                 IEEE80211_VHT_CAP_SHORT_GI_160 |
                                 IEEE80211_VHT_CAP_TXSTBC |
-                                IEEE80211_VHT_CAP_RXSTBC_1 |
-                                IEEE80211_VHT_CAP_RXSTBC_2 |
-                                IEEE80211_VHT_CAP_RXSTBC_3 |
                                 IEEE80211_VHT_CAP_RXSTBC_4 |
                                 IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK;
                         sband->vht_cap.vht_mcs.rx_mcs_map =
@@ -2937,8 +2934,7 @@ static int mac80211_hwsim_new_radio(struct genl_info *info,
         hwsim_radios_generation++;
         spin_unlock_bh(&hwsim_radio_lock);
 
-        if (idx > 0)
-                hwsim_mcast_new_radio(idx, info, param);
+        hwsim_mcast_new_radio(idx, info, param);
 
         return idx;
 
@@ -3317,6 +3313,11 @@ static int hwsim_new_radio_nl(struct sk_buff *msg, struct genl_info *info)
         if (info->attrs[HWSIM_ATTR_CHANNELS])
                 param.channels = nla_get_u32(info->attrs[HWSIM_ATTR_CHANNELS]);
 
+        if (param.channels < 1) {
+                GENL_SET_ERR_MSG(info, "must have at least one channel");
+                return -EINVAL;
+        }
+
         if (param.channels > CFG80211_MAX_NUM_DIFFERENT_CHANNELS) {
                 GENL_SET_ERR_MSG(info, "too many channels specified");
                 return -EINVAL;
@@ -3350,6 +3351,9 @@ static int hwsim_new_radio_nl(struct sk_buff *msg, struct genl_info *info)
                         kfree(hwname);
                         return -EINVAL;
                 }
+
+                idx = array_index_nospec(idx,
+                                         ARRAY_SIZE(hwsim_world_regdom_custom));
                 param.regd = hwsim_world_regdom_custom[idx];
         }
 
@@ -3559,30 +3563,27 @@ static struct genl_family hwsim_genl_family __ro_after_init = {
         .n_mcgrps = ARRAY_SIZE(hwsim_mcgrps),
 };
 
-static void destroy_radio(struct work_struct *work)
-{
-        struct mac80211_hwsim_data *data =
-                container_of(work, struct mac80211_hwsim_data, destroy_work);
-
-        hwsim_radios_generation++;
-        mac80211_hwsim_del_radio(data, wiphy_name(data->hw->wiphy), NULL);
-}
-
 static void remove_user_radios(u32 portid)
 {
         struct mac80211_hwsim_data *entry, *tmp;
+        LIST_HEAD(list);
 
         spin_lock_bh(&hwsim_radio_lock);
         list_for_each_entry_safe(entry, tmp, &hwsim_radios, list) {
                 if (entry->destroy_on_close && entry->portid == portid) {
-                        list_del(&entry->list);
+                        list_move(&entry->list, &list);
                         rhashtable_remove_fast(&hwsim_radios_rht, &entry->rht,
                                                hwsim_rht_params);
-                        INIT_WORK(&entry->destroy_work, destroy_radio);
-                        queue_work(hwsim_wq, &entry->destroy_work);
+                        hwsim_radios_generation++;
                 }
         }
         spin_unlock_bh(&hwsim_radio_lock);
+
+        list_for_each_entry_safe(entry, tmp, &list, list) {
+                list_del(&entry->list);
+                mac80211_hwsim_del_radio(entry, wiphy_name(entry->hw->wiphy),
+                                         NULL);
+        }
 }
 
 static int mac80211_hwsim_netlink_notify(struct notifier_block *nb,
@@ -3640,6 +3641,7 @@ static __net_init int hwsim_init_net(struct net *net)
 static void __net_exit hwsim_exit_net(struct net *net)
 {
         struct mac80211_hwsim_data *data, *tmp;
+        LIST_HEAD(list);
 
         spin_lock_bh(&hwsim_radio_lock);
         list_for_each_entry_safe(data, tmp, &hwsim_radios, list) {
@@ -3650,17 +3652,19 @@ static void __net_exit hwsim_exit_net(struct net *net)
                 if (data->netgroup == hwsim_net_get_netgroup(&init_net))
                         continue;
 
-                list_del(&data->list);
+                list_move(&data->list, &list);
                 rhashtable_remove_fast(&hwsim_radios_rht, &data->rht,
                                        hwsim_rht_params);
                 hwsim_radios_generation++;
-                spin_unlock_bh(&hwsim_radio_lock);
+        }
+        spin_unlock_bh(&hwsim_radio_lock);
+
+        list_for_each_entry_safe(data, tmp, &list, list) {
+                list_del(&data->list);
                 mac80211_hwsim_del_radio(data,
                                          wiphy_name(data->hw->wiphy),
                                          NULL);
-                spin_lock_bh(&hwsim_radio_lock);
         }
-        spin_unlock_bh(&hwsim_radio_lock);
 
         ida_simple_remove(&hwsim_netgroup_ida, hwsim_net_get_netgroup(net));
 }
diff --git a/drivers/net/xen-netback/common.h b/drivers/net/xen-netback/common.h
index a46a1e94505d..936c0b3e0ba2 100644
--- a/drivers/net/xen-netback/common.h
+++ b/drivers/net/xen-netback/common.h
@@ -241,8 +241,9 @@ struct xenvif_hash_cache {
 struct xenvif_hash {
         unsigned int alg;
         u32 flags;
+        bool mapping_sel;
         u8 key[XEN_NETBK_MAX_HASH_KEY_SIZE];
-        u32 mapping[XEN_NETBK_MAX_HASH_MAPPING_SIZE];
+        u32 mapping[2][XEN_NETBK_MAX_HASH_MAPPING_SIZE];
         unsigned int size;
         struct xenvif_hash_cache cache;
 };
diff --git a/drivers/net/xen-netback/hash.c b/drivers/net/xen-netback/hash.c
index 3c4c58b9fe76..0ccb021f1e78 100644
--- a/drivers/net/xen-netback/hash.c
+++ b/drivers/net/xen-netback/hash.c
@@ -324,7 +324,8 @@ u32 xenvif_set_hash_mapping_size(struct xenvif *vif, u32 size)
                 return XEN_NETIF_CTRL_STATUS_INVALID_PARAMETER;
 
         vif->hash.size = size;
-        memset(vif->hash.mapping, 0, sizeof(u32) * size);
+        memset(vif->hash.mapping[vif->hash.mapping_sel], 0,
+               sizeof(u32) * size);
 
         return XEN_NETIF_CTRL_STATUS_SUCCESS;
 }
@@ -332,31 +333,49 @@ u32 xenvif_set_hash_mapping_size(struct xenvif *vif, u32 size)
 u32 xenvif_set_hash_mapping(struct xenvif *vif, u32 gref, u32 len,
                             u32 off)
 {
-        u32 *mapping = &vif->hash.mapping[off];
-        struct gnttab_copy copy_op = {
+        u32 *mapping = vif->hash.mapping[!vif->hash.mapping_sel];
+        unsigned int nr = 1;
+        struct gnttab_copy copy_op[2] = {{
                 .source.u.ref = gref,
                 .source.domid = vif->domid,
-                .dest.u.gmfn = virt_to_gfn(mapping),
                 .dest.domid = DOMID_SELF,
-                .dest.offset = xen_offset_in_page(mapping),
-                .len = len * sizeof(u32),
+                .len = len * sizeof(*mapping),
                 .flags = GNTCOPY_source_gref
-        };
+        }};
 
-        if ((off + len > vif->hash.size) || copy_op.len > XEN_PAGE_SIZE)
+        if ((off + len < off) || (off + len > vif->hash.size) ||
+            len > XEN_PAGE_SIZE / sizeof(*mapping))
                 return XEN_NETIF_CTRL_STATUS_INVALID_PARAMETER;
 
-        while (len-- != 0)
-                if (mapping[off++] >= vif->num_queues)
-                        return XEN_NETIF_CTRL_STATUS_INVALID_PARAMETER;
+        copy_op[0].dest.u.gmfn = virt_to_gfn(mapping + off);
+        copy_op[0].dest.offset = xen_offset_in_page(mapping + off);
+        if (copy_op[0].dest.offset + copy_op[0].len > XEN_PAGE_SIZE) {
+                copy_op[1] = copy_op[0];
+                copy_op[1].source.offset = XEN_PAGE_SIZE - copy_op[0].dest.offset;
+                copy_op[1].dest.u.gmfn = virt_to_gfn(mapping + off + len);
+                copy_op[1].dest.offset = 0;
+                copy_op[1].len = copy_op[0].len - copy_op[1].source.offset;
+                copy_op[0].len = copy_op[1].source.offset;
+                nr = 2;
+        }
 
-        if (copy_op.len != 0) {
-                gnttab_batch_copy(&copy_op, 1);
+        memcpy(mapping, vif->hash.mapping[vif->hash.mapping_sel],
+               vif->hash.size * sizeof(*mapping));
 
-                if (copy_op.status != GNTST_okay)
+        if (copy_op[0].len != 0) {
+                gnttab_batch_copy(copy_op, nr);
+
+                if (copy_op[0].status != GNTST_okay ||
+                    copy_op[nr - 1].status != GNTST_okay)
                         return XEN_NETIF_CTRL_STATUS_INVALID_PARAMETER;
         }
 
+        while (len-- != 0)
+                if (mapping[off++] >= vif->num_queues)
+                        return XEN_NETIF_CTRL_STATUS_INVALID_PARAMETER;
+
+        vif->hash.mapping_sel = !vif->hash.mapping_sel;
+
         return XEN_NETIF_CTRL_STATUS_SUCCESS;
 }
 
@@ -408,6 +427,8 @@ void xenvif_dump_hash_info(struct xenvif *vif, struct seq_file *m)
         }
 
         if (vif->hash.size != 0) {
+                const u32 *mapping = vif->hash.mapping[vif->hash.mapping_sel];
+
                 seq_puts(m, "\nHash Mapping:\n");
 
                 for (i = 0; i < vif->hash.size; ) {
@@ -420,7 +441,7 @@ void xenvif_dump_hash_info(struct xenvif *vif, struct seq_file *m)
                         seq_printf(m, "[%4u - %4u]: ", i, i + n - 1);
 
                         for (j = 0; j < n; j++, i++)
-                                seq_printf(m, "%4u ", vif->hash.mapping[i]);
+                                seq_printf(m, "%4u ", mapping[i]);
 
                         seq_puts(m, "\n");
                 }
diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
index 92274c237200..f6ae23fc3f6b 100644
--- a/drivers/net/xen-netback/interface.c
+++ b/drivers/net/xen-netback/interface.c
@@ -162,7 +162,8 @@ static u16 xenvif_select_queue(struct net_device *dev, struct sk_buff *skb,
         if (size == 0)
                 return skb_get_hash_raw(skb) % dev->real_num_tx_queues;
 
-        return vif->hash.mapping[skb_get_hash_raw(skb) % size];
+        return vif->hash.mapping[vif->hash.mapping_sel]
+                                [skb_get_hash_raw(skb) % size];
 }
 
 static int xenvif_start_xmit(struct sk_buff *skb, struct net_device *dev)
diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index 73f596a90c69..f17f602e6171 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -87,8 +87,7 @@ struct netfront_cb {
 /* IRQ name is queue name with "-tx" or "-rx" appended */
 #define IRQ_NAME_SIZE (QUEUE_NAME_SIZE + 3)
 
-static DECLARE_WAIT_QUEUE_HEAD(module_load_q);
-static DECLARE_WAIT_QUEUE_HEAD(module_unload_q);
+static DECLARE_WAIT_QUEUE_HEAD(module_wq);
 
 struct netfront_stats {
         u64                     packets;
@@ -909,7 +908,11 @@ static RING_IDX xennet_fill_frags(struct netfront_queue *queue,
                         BUG_ON(pull_to <= skb_headlen(skb));
                         __pskb_pull_tail(skb, pull_to - skb_headlen(skb));
                 }
-                BUG_ON(skb_shinfo(skb)->nr_frags >= MAX_SKB_FRAGS);
+                if (unlikely(skb_shinfo(skb)->nr_frags >= MAX_SKB_FRAGS)) {
+                        queue->rx.rsp_cons = ++cons;
+                        kfree_skb(nskb);
+                        return ~0U;
+                }
 
                 skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags,
                                 skb_frag_page(nfrag),
@@ -1046,6 +1049,8 @@ err:
                 skb->len += rx->status;
 
                 i = xennet_fill_frags(queue, skb, &tmpq);
+                if (unlikely(i == ~0U))
+                        goto err;
 
                 if (rx->flags & XEN_NETRXF_csum_blank)
                         skb->ip_summed = CHECKSUM_PARTIAL;
@@ -1332,11 +1337,11 @@ static struct net_device *xennet_create_dev(struct xenbus_device *dev)
         netif_carrier_off(netdev);
 
         xenbus_switch_state(dev, XenbusStateInitialising);
-        wait_event(module_load_q,
-                           xenbus_read_driver_state(dev->otherend) !=
-                           XenbusStateClosed &&
-                           xenbus_read_driver_state(dev->otherend) !=
-                           XenbusStateUnknown);
+        wait_event(module_wq,
+                   xenbus_read_driver_state(dev->otherend) !=
+                   XenbusStateClosed &&
+                   xenbus_read_driver_state(dev->otherend) !=
+                   XenbusStateUnknown);
         return netdev;
 
  exit:
@@ -2010,15 +2015,14 @@ static void netback_changed(struct xenbus_device *dev,
 
         dev_dbg(&dev->dev, "%s\n", xenbus_strstate(backend_state));
 
+        wake_up_all(&module_wq);
+
         switch (backend_state) {
         case XenbusStateInitialising:
         case XenbusStateInitialised:
         case XenbusStateReconfiguring:
         case XenbusStateReconfigured:
-                break;
-
         case XenbusStateUnknown:
-                wake_up_all(&module_unload_q);
                 break;
 
         case XenbusStateInitWait:
@@ -2034,12 +2038,10 @@ static void netback_changed(struct xenbus_device *dev,
                 break;
 
         case XenbusStateClosed:
-                wake_up_all(&module_unload_q);
                 if (dev->state == XenbusStateClosed)
                         break;
                 /* Missed the backend's CLOSING state -- fallthrough */
         case XenbusStateClosing:
-                wake_up_all(&module_unload_q);
                 xenbus_frontend_closed(dev);
                 break;
         }
@@ -2147,14 +2149,14 @@ static int xennet_remove(struct xenbus_device *dev)
 
         if (xenbus_read_driver_state(dev->otherend) != XenbusStateClosed) {
                 xenbus_switch_state(dev, XenbusStateClosing);
-                wait_event(module_unload_q,
+                wait_event(module_wq,
                            xenbus_read_driver_state(dev->otherend) ==
                            XenbusStateClosing ||
                            xenbus_read_driver_state(dev->otherend) ==
                            XenbusStateUnknown);
 
                 xenbus_switch_state(dev, XenbusStateClosed);
-                wait_event(module_unload_q,
+                wait_event(module_wq,
                            xenbus_read_driver_state(dev->otherend) ==
                            XenbusStateClosed ||
                            xenbus_read_driver_state(dev->otherend) ==
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index 1b9951d2067e..d668682f91df 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -316,6 +316,14 @@ static bool nvme_dbbuf_update_and_check_event(u16 value, u32 *dbbuf_db,
                 old_value = *dbbuf_db;
                 *dbbuf_db = value;
 
+                /*
+                 * Ensure that the doorbell is updated before reading the event
+                 * index from memory.  The controller needs to provide similar
+                 * ordering to ensure the envent index is updated before reading
+                 * the doorbell.
+                 */
+                mb();
+
                 if (!nvme_dbbuf_need_event(*dbbuf_ei, value, old_value))
                         return false;
         }
diff --git a/drivers/nvme/target/admin-cmd.c b/drivers/nvme/target/admin-cmd.c
index a21caea1e080..2008fa62a373 100644
--- a/drivers/nvme/target/admin-cmd.c
+++ b/drivers/nvme/target/admin-cmd.c
@@ -245,6 +245,10 @@ static void nvmet_execute_get_log_page_ana(struct nvmet_req *req)
                 offset += len;
                 ngrps++;
         }
+        for ( ; grpid <= NVMET_MAX_ANAGRPS; grpid++) {
+                if (nvmet_ana_group_enabled[grpid])
+                        ngrps++;
+        }
 
         hdr.chgcnt = cpu_to_le64(nvmet_ana_chgcnt);
         hdr.ngrps = cpu_to_le16(ngrps);
diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c
index ebf3e7a6c49e..b5ec96abd048 100644
--- a/drivers/nvme/target/core.c
+++ b/drivers/nvme/target/core.c
@@ -1210,7 +1210,7 @@ static int __init nvmet_init(void)
 
         error = nvmet_init_discovery();
         if (error)
-                goto out;
+                goto out_free_work_queue;
 
         error = nvmet_init_configfs();
         if (error)
@@ -1219,6 +1219,8 @@ static int __init nvmet_init(void)
 
 out_exit_discovery:
         nvmet_exit_discovery();
+out_free_work_queue:
+        destroy_workqueue(buffered_io_wq);
 out:
         return error;
 }
diff --git a/drivers/nvme/target/fcloop.c b/drivers/nvme/target/fcloop.c
index 34712def81b1..5251689a1d9a 100644
--- a/drivers/nvme/target/fcloop.c
+++ b/drivers/nvme/target/fcloop.c
@@ -311,7 +311,7 @@ fcloop_tgt_lsrqst_done_work(struct work_struct *work)
         struct fcloop_tport *tport = tls_req->tport;
         struct nvmefc_ls_req *lsreq = tls_req->lsreq;
 
-        if (tport->remoteport)
+        if (!tport || tport->remoteport)
                 lsreq->done(lsreq, tls_req->status);
 }
 
@@ -329,6 +329,7 @@ fcloop_ls_req(struct nvme_fc_local_port *localport,
 
         if (!rport->targetport) {
                 tls_req->status = -ECONNREFUSED;
+                tls_req->tport = NULL;
                 schedule_work(&tls_req->work);
                 return ret;
         }
diff --git a/drivers/nvme/target/rdma.c b/drivers/nvme/target/rdma.c
index 3533e918ea37..bfc4da660bb4 100644
--- a/drivers/nvme/target/rdma.c
+++ b/drivers/nvme/target/rdma.c
@@ -66,6 +66,7 @@ struct nvmet_rdma_rsp {
 
         struct nvmet_req        req;
 
+        bool                    allocated;
         u8                      n_rdma;
         u32                     flags;
         u32                     invalidate_rkey;
@@ -174,11 +175,19 @@ nvmet_rdma_get_rsp(struct nvmet_rdma_queue *queue)
         unsigned long flags;
 
         spin_lock_irqsave(&queue->rsps_lock, flags);
-        rsp = list_first_entry(&queue->free_rsps,
+        rsp = list_first_entry_or_null(&queue->free_rsps,
                                 struct nvmet_rdma_rsp, free_list);
-        list_del(&rsp->free_list);
+        if (likely(rsp))
+                list_del(&rsp->free_list);
         spin_unlock_irqrestore(&queue->rsps_lock, flags);
 
+        if (unlikely(!rsp)) {
+                rsp = kmalloc(sizeof(*rsp), GFP_KERNEL);
+                if (unlikely(!rsp))
+                        return NULL;
+                rsp->allocated = true;
+        }
+
         return rsp;
 }
 
@@ -187,6 +196,11 @@ nvmet_rdma_put_rsp(struct nvmet_rdma_rsp *rsp)
 {
         unsigned long flags;
 
+        if (rsp->allocated) {
+                kfree(rsp);
+                return;
+        }
+
         spin_lock_irqsave(&rsp->queue->rsps_lock, flags);
         list_add_tail(&rsp->free_list, &rsp->queue->free_rsps);
         spin_unlock_irqrestore(&rsp->queue->rsps_lock, flags);
@@ -776,6 +790,15 @@ static void nvmet_rdma_recv_done(struct ib_cq *cq, struct ib_wc *wc)
 
         cmd->queue = queue;
         rsp = nvmet_rdma_get_rsp(queue);
+        if (unlikely(!rsp)) {
+                /*
+                 * we get here only under memory pressure,
+                 * silently drop and have the host retry
+                 * as we can't even fail it.
+                 */
+                nvmet_rdma_post_recv(queue->dev, cmd);
+                return;
+        }
         rsp->queue = queue;
         rsp->cmd = cmd;
         rsp->flags = 0;
diff --git a/drivers/of/base.c b/drivers/of/base.c
index 466e3c8582f0..74eaedd5b860 100644
--- a/drivers/of/base.c
+++ b/drivers/of/base.c
@@ -54,6 +54,28 @@ DEFINE_MUTEX(of_mutex);
  */
 DEFINE_RAW_SPINLOCK(devtree_lock);
 
+bool of_node_name_eq(const struct device_node *np, const char *name)
+{
+        const char *node_name;
+        size_t len;
+
+        if (!np)
+                return false;
+
+        node_name = kbasename(np->full_name);
+        len = strchrnul(node_name, '@') - node_name;
+
+        return (strlen(name) == len) && (strncmp(node_name, name, len) == 0);
+}
+
+bool of_node_name_prefix(const struct device_node *np, const char *prefix)
+{
+        if (!np)
+                return false;
+
+        return strncmp(kbasename(np->full_name), prefix, strlen(prefix)) == 0;
+}
+
 int of_n_addr_cells(struct device_node *np)
 {
         u32 cells;
@@ -118,6 +140,9 @@ void of_populate_phandle_cache(void)
                 if (np->phandle && np->phandle != OF_PHANDLE_ILLEGAL)
                         phandles++;
 
+        if (!phandles)
+                goto out;
+
         cache_entries = roundup_pow_of_two(phandles);
         phandle_cache_mask = cache_entries - 1;
 
@@ -720,6 +745,31 @@ struct device_node *of_get_next_available_child(const struct device_node *node,
 EXPORT_SYMBOL(of_get_next_available_child);
 
 /**
+ * of_get_compatible_child - Find compatible child node
+ * @parent:     parent node
+ * @compatible: compatible string
+ *
+ * Lookup child node whose compatible property contains the given compatible
+ * string.
+ *
+ * Returns a node pointer with refcount incremented, use of_node_put() on it
+ * when done; or NULL if not found.
+ */
+struct device_node *of_get_compatible_child(const struct device_node *parent,
+                                const char *compatible)
+{
+        struct device_node *child;
+
+        for_each_child_of_node(parent, child) {
+                if (of_device_is_compatible(child, compatible))
+                        break;
+        }
+
+        return child;
+}
+EXPORT_SYMBOL(of_get_compatible_child);
+
+/**
  *      of_get_child_by_name - Find the child node by name for a given parent
  *      @node:  parent node
  *      @name:  child name to look for.
diff --git a/drivers/of/platform.c b/drivers/of/platform.c
index 7ba90c290a42..6c59673933e9 100644
--- a/drivers/of/platform.c
+++ b/drivers/of/platform.c
@@ -241,6 +241,10 @@ static struct amba_device *of_amba_device_create(struct device_node *node,
         if (!dev)
                 goto err_clear_flag;
 
+        /* AMBA devices only support a single DMA mask */
+        dev->dev.coherent_dma_mask = DMA_BIT_MASK(32);
+        dev->dev.dma_mask = &dev->dev.coherent_dma_mask;
+
         /* setup generic device info */
         dev->dev.of_node = of_node_get(node);
         dev->dev.fwnode = &node->fwnode;
diff --git a/drivers/pci/controller/pci-hyperv.c b/drivers/pci/controller/pci-hyperv.c
index c00f82cc54aa..9ba4d12c179c 100644
--- a/drivers/pci/controller/pci-hyperv.c
+++ b/drivers/pci/controller/pci-hyperv.c
@@ -89,6 +89,9 @@ static enum pci_protocol_version_t pci_protocol_version;
 
 #define STATUS_REVISION_MISMATCH 0xC0000059
 
+/* space for 32bit serial number as string */
+#define SLOT_NAME_SIZE 11
+
 /*
  * Message Types
  */
@@ -494,6 +497,7 @@ struct hv_pci_dev {
         struct list_head list_entry;
         refcount_t refs;
         enum hv_pcichild_state state;
+        struct pci_slot *pci_slot;
         struct pci_function_description desc;
         bool reported_missing;
         struct hv_pcibus_device *hbus;
@@ -1457,6 +1461,36 @@ static void prepopulate_bars(struct hv_pcibus_device *hbus)
         spin_unlock_irqrestore(&hbus->device_list_lock, flags);
 }
 
+/*
+ * Assign entries in sysfs pci slot directory.
+ *
+ * Note that this function does not need to lock the children list
+ * because it is called from pci_devices_present_work which
+ * is serialized with hv_eject_device_work because they are on the
+ * same ordered workqueue. Therefore hbus->children list will not change
+ * even when pci_create_slot sleeps.
+ */
+static void hv_pci_assign_slots(struct hv_pcibus_device *hbus)
+{
+        struct hv_pci_dev *hpdev;
+        char name[SLOT_NAME_SIZE];
+        int slot_nr;
+
+        list_for_each_entry(hpdev, &hbus->children, list_entry) {
+                if (hpdev->pci_slot)
+                        continue;
+
+                slot_nr = PCI_SLOT(wslot_to_devfn(hpdev->desc.win_slot.slot));
+                snprintf(name, SLOT_NAME_SIZE, "%u", hpdev->desc.ser);
+                hpdev->pci_slot = pci_create_slot(hbus->pci_bus, slot_nr,
+                                          name, NULL);
+                if (IS_ERR(hpdev->pci_slot)) {
+                        pr_warn("pci_create slot %s failed\n", name);
+                        hpdev->pci_slot = NULL;
+                }
+        }
+}
+
 /**
  * create_root_hv_pci_bus() - Expose a new root PCI bus
  * @hbus:       Root PCI bus, as understood by this driver
@@ -1480,6 +1514,7 @@ static int create_root_hv_pci_bus(struct hv_pcibus_device *hbus)
         pci_lock_rescan_remove();
         pci_scan_child_bus(hbus->pci_bus);
         pci_bus_assign_resources(hbus->pci_bus);
+        hv_pci_assign_slots(hbus);
         pci_bus_add_devices(hbus->pci_bus);
         pci_unlock_rescan_remove();
         hbus->state = hv_pcibus_installed;
@@ -1742,6 +1777,7 @@ static void pci_devices_present_work(struct work_struct *work)
                  */
                 pci_lock_rescan_remove();
                 pci_scan_child_bus(hbus->pci_bus);
+                hv_pci_assign_slots(hbus);
                 pci_unlock_rescan_remove();
                 break;
 
@@ -1858,6 +1894,9 @@ static void hv_eject_device_work(struct work_struct *work)
         list_del(&hpdev->list_entry);
         spin_unlock_irqrestore(&hpdev->hbus->device_list_lock, flags);
 
+        if (hpdev->pci_slot)
+                pci_destroy_slot(hpdev->pci_slot);
+
         memset(&ctxt, 0, sizeof(ctxt));
         ejct_pkt = (struct pci_eject_response *)&ctxt.pkt.message;
         ejct_pkt->message_type.type = PCI_EJECTION_COMPLETE;
diff --git a/drivers/pci/hotplug/pciehp_hpc.c b/drivers/pci/hotplug/pciehp_hpc.c
index 7136e3430925..a938abdb41ce 100644
--- a/drivers/pci/hotplug/pciehp_hpc.c
+++ b/drivers/pci/hotplug/pciehp_hpc.c
@@ -496,7 +496,7 @@ int pciehp_power_on_slot(struct slot *slot)
         u16 slot_status;
         int retval;
 
-        /* Clear sticky power-fault bit from previous power failures */
+        /* Clear power-fault bit from previous power failures */
         pcie_capability_read_word(pdev, PCI_EXP_SLTSTA, &slot_status);
         if (slot_status & PCI_EXP_SLTSTA_PFD)
                 pcie_capability_write_word(pdev, PCI_EXP_SLTSTA,
@@ -646,6 +646,14 @@ static irqreturn_t pciehp_ist(int irq, void *dev_id)
                 pciehp_handle_button_press(slot);
         }
 
+        /* Check Power Fault Detected */
+        if ((events & PCI_EXP_SLTSTA_PFD) && !ctrl->power_fault_detected) {
+                ctrl->power_fault_detected = 1;
+                ctrl_err(ctrl, "Slot(%s): Power fault\n", slot_name(slot));
+                pciehp_set_attention_status(slot, 1);
+                pciehp_green_led_off(slot);
+        }
+
         /*
          * Disable requests have higher priority than Presence Detect Changed
          * or Data Link Layer State Changed events.
@@ -657,14 +665,6 @@ static irqreturn_t pciehp_ist(int irq, void *dev_id)
                 pciehp_handle_presence_or_link_change(slot, events);
         up_read(&ctrl->reset_lock);
 
-        /* Check Power Fault Detected */
-        if ((events & PCI_EXP_SLTSTA_PFD) && !ctrl->power_fault_detected) {
-                ctrl->power_fault_detected = 1;
-                ctrl_err(ctrl, "Slot(%s): Power fault\n", slot_name(slot));
-                pciehp_set_attention_status(slot, 1);
-                pciehp_green_led_off(slot);
-        }
-
         pci_config_pm_runtime_put(pdev);
         wake_up(&ctrl->requester);
         return IRQ_HANDLED;
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index 29ff9619b5fa..1835f3a7aa8d 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -4547,6 +4547,7 @@ int pci_bridge_secondary_bus_reset(struct pci_dev *dev)
 
         return pci_dev_wait(dev, "bus reset", PCIE_RESET_READY_POLL_MS);
 }
+EXPORT_SYMBOL_GPL(pci_bridge_secondary_bus_reset);
 
 static int pci_parent_bus_reset(struct pci_dev *dev, int probe)
 {
@@ -5200,7 +5201,7 @@ static int __pci_reset_bus(struct pci_bus *bus)
  */
 int pci_reset_bus(struct pci_dev *pdev)
 {
-        return pci_probe_reset_slot(pdev->slot) ?
+        return (!pci_probe_reset_slot(pdev->slot)) ?
             __pci_reset_slot(pdev->slot) : __pci_reset_bus(pdev->bus);
 }
 EXPORT_SYMBOL_GPL(pci_reset_bus);
diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
index ec784009a36b..201f9e5ff55c 100644
--- a/drivers/pci/probe.c
+++ b/drivers/pci/probe.c
@@ -2074,6 +2074,7 @@ static void pci_configure_eetlp_prefix(struct pci_dev *dev)
 {
 #ifdef CONFIG_PCI_PASID
         struct pci_dev *bridge;
+        int pcie_type;
         u32 cap;
 
         if (!pci_is_pcie(dev))
@@ -2083,7 +2084,9 @@ static void pci_configure_eetlp_prefix(struct pci_dev *dev)
         if (!(cap & PCI_EXP_DEVCAP2_EE_PREFIX))
                 return;
 
-        if (pci_pcie_type(dev) == PCI_EXP_TYPE_ROOT_PORT)
+        pcie_type = pci_pcie_type(dev);
+        if (pcie_type == PCI_EXP_TYPE_ROOT_PORT ||
+            pcie_type == PCI_EXP_TYPE_RC_END)
                 dev->eetlp_prefix_path = 1;
         else {
                 bridge = pci_upstream_bridge(dev);
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index ef7143a274e0..6bc27b7fd452 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -4355,11 +4355,6 @@ static int pci_quirk_qcom_rp_acs(struct pci_dev *dev, u16 acs_flags)
  *
  * 0x9d10-0x9d1b PCI Express Root port #{1-12}
  *
- * The 300 series chipset suffers from the same bug so include those root
- * ports here as well.
- *
- * 0xa32c-0xa343 PCI Express Root port #{0-24}
- *
  * [1] http://www.intel.com/content/www/us/en/chipsets/100-series-chipset-datasheet-vol-2.html
  * [2] http://www.intel.com/content/www/us/en/chipsets/100-series-chipset-datasheet-vol-1.html
  * [3] http://www.intel.com/content/www/us/en/chipsets/100-series-chipset-spec-update.html
@@ -4377,7 +4372,6 @@ static bool pci_quirk_intel_spt_pch_acs_match(struct pci_dev *dev)
         case 0xa110 ... 0xa11f: case 0xa167 ... 0xa16a: /* Sunrise Point */
         case 0xa290 ... 0xa29f: case 0xa2e7 ... 0xa2ee: /* Union Point */
         case 0x9d10 ... 0x9d1b: /* 7th & 8th Gen Mobile */
-        case 0xa32c ... 0xa343:                         /* 300 series */
                 return true;
         }
 
diff --git a/drivers/pci/switch/switchtec.c b/drivers/pci/switch/switchtec.c
index 9940cc70f38b..54a8b30dda38 100644
--- a/drivers/pci/switch/switchtec.c
+++ b/drivers/pci/switch/switchtec.c
@@ -14,6 +14,8 @@
 #include <linux/poll.h>
 #include <linux/wait.h>
 
+#include <linux/nospec.h>
+
 MODULE_DESCRIPTION("Microsemi Switchtec(tm) PCIe Management Driver");
 MODULE_VERSION("0.1");
 MODULE_LICENSE("GPL");
@@ -909,6 +911,8 @@ static int ioctl_port_to_pff(struct switchtec_dev *stdev,
         default:
                 if (p.port > ARRAY_SIZE(pcfg->dsp_pff_inst_id))
                         return -EINVAL;
+                p.port = array_index_nospec(p.port,
+                                        ARRAY_SIZE(pcfg->dsp_pff_inst_id) + 1);
                 p.pff = ioread32(&pcfg->dsp_pff_inst_id[p.port - 1]);
                 break;
         }
diff --git a/drivers/pinctrl/cirrus/pinctrl-madera-core.c b/drivers/pinctrl/cirrus/pinctrl-madera-core.c
index ece41fb2848f..c4f4d904e4a6 100644
--- a/drivers/pinctrl/cirrus/pinctrl-madera-core.c
+++ b/drivers/pinctrl/cirrus/pinctrl-madera-core.c
@@ -1040,7 +1040,7 @@ static int madera_pin_probe(struct platform_device *pdev)
         }
 
         /* if the configuration is provided through pdata, apply it */
-        if (pdata) {
+        if (pdata && pdata->gpio_configs) {
                 ret = pinctrl_register_mappings(pdata->gpio_configs,
                                                 pdata->n_gpio_configs);
                 if (ret) {
diff --git a/drivers/pinctrl/intel/pinctrl-cannonlake.c b/drivers/pinctrl/intel/pinctrl-cannonlake.c
index fb1afe55bf53..8d48371caaa2 100644
--- a/drivers/pinctrl/intel/pinctrl-cannonlake.c
+++ b/drivers/pinctrl/intel/pinctrl-cannonlake.c
@@ -379,7 +379,7 @@ static const struct intel_padgroup cnlh_community1_gpps[] = {
 static const struct intel_padgroup cnlh_community3_gpps[] = {
         CNL_GPP(0, 155, 178, 192),              /* GPP_K */
         CNL_GPP(1, 179, 202, 224),              /* GPP_H */
-        CNL_GPP(2, 203, 215, 258),              /* GPP_E */
+        CNL_GPP(2, 203, 215, 256),              /* GPP_E */
         CNL_GPP(3, 216, 239, 288),              /* GPP_F */
         CNL_GPP(4, 240, 248, CNL_NO_GPIO),      /* SPI */
 };
diff --git a/drivers/pinctrl/intel/pinctrl-intel.c b/drivers/pinctrl/intel/pinctrl-intel.c
index 62b009b27eda..ec8dafc94694 100644
--- a/drivers/pinctrl/intel/pinctrl-intel.c
+++ b/drivers/pinctrl/intel/pinctrl-intel.c
@@ -747,13 +747,63 @@ static const struct pinctrl_desc intel_pinctrl_desc = {
         .owner = THIS_MODULE,
 };
 
+/**
+ * intel_gpio_to_pin() - Translate from GPIO offset to pin number
+ * @pctrl: Pinctrl structure
+ * @offset: GPIO offset from gpiolib
+ * @commmunity: Community is filled here if not %NULL
+ * @padgrp: Pad group is filled here if not %NULL
+ *
+ * When coming through gpiolib irqchip, the GPIO offset is not
+ * automatically translated to pinctrl pin number. This function can be
+ * used to find out the corresponding pinctrl pin.
+ */
+static int intel_gpio_to_pin(struct intel_pinctrl *pctrl, unsigned offset,
+                             const struct intel_community **community,
+                             const struct intel_padgroup **padgrp)
+{
+        int i;
+
+        for (i = 0; i < pctrl->ncommunities; i++) {
+                const struct intel_community *comm = &pctrl->communities[i];
+                int j;
+
+                for (j = 0; j < comm->ngpps; j++) {
+                        const struct intel_padgroup *pgrp = &comm->gpps[j];
+
+                        if (pgrp->gpio_base < 0)
+                                continue;
+
+                        if (offset >= pgrp->gpio_base &&
+                            offset < pgrp->gpio_base + pgrp->size) {
+                                int pin;
+
+                                pin = pgrp->base + offset - pgrp->gpio_base;
+                                if (community)
+                                        *community = comm;
+                                if (padgrp)
+                                        *padgrp = pgrp;
+
+                                return pin;
+                        }
+                }
+        }
+
+        return -EINVAL;
+}
+
 static int intel_gpio_get(struct gpio_chip *chip, unsigned offset)
 {
         struct intel_pinctrl *pctrl = gpiochip_get_data(chip);
         void __iomem *reg;
         u32 padcfg0;
+        int pin;
+
+        pin = intel_gpio_to_pin(pctrl, offset, NULL, NULL);
+        if (pin < 0)
+                return -EINVAL;
 
-        reg = intel_get_padcfg(pctrl, offset, PADCFG0);
+        reg = intel_get_padcfg(pctrl, pin, PADCFG0);
         if (!reg)
                 return -EINVAL;
 
@@ -770,8 +820,13 @@ static void intel_gpio_set(struct gpio_chip *chip, unsigned offset, int value)
         unsigned long flags;
         void __iomem *reg;
         u32 padcfg0;
+        int pin;
+
+        pin = intel_gpio_to_pin(pctrl, offset, NULL, NULL);
+        if (pin < 0)
+                return;
 
-        reg = intel_get_padcfg(pctrl, offset, PADCFG0);
+        reg = intel_get_padcfg(pctrl, pin, PADCFG0);
         if (!reg)
                 return;
 
@@ -790,8 +845,13 @@ static int intel_gpio_get_direction(struct gpio_chip *chip, unsigned int offset)
         struct intel_pinctrl *pctrl = gpiochip_get_data(chip);
         void __iomem *reg;
         u32 padcfg0;
+        int pin;
 
-        reg = intel_get_padcfg(pctrl, offset, PADCFG0);
+        pin = intel_gpio_to_pin(pctrl, offset, NULL, NULL);
+        if (pin < 0)
+                return -EINVAL;
+
+        reg = intel_get_padcfg(pctrl, pin, PADCFG0);
         if (!reg)
                 return -EINVAL;
 
@@ -827,51 +887,6 @@ static const struct gpio_chip intel_gpio_chip = {
         .set_config = gpiochip_generic_config,
 };
 
-/**
- * intel_gpio_to_pin() - Translate from GPIO offset to pin number
- * @pctrl: Pinctrl structure
- * @offset: GPIO offset from gpiolib
- * @commmunity: Community is filled here if not %NULL
- * @padgrp: Pad group is filled here if not %NULL
- *
- * When coming through gpiolib irqchip, the GPIO offset is not
- * automatically translated to pinctrl pin number. This function can be
- * used to find out the corresponding pinctrl pin.
- */
-static int intel_gpio_to_pin(struct intel_pinctrl *pctrl, unsigned offset,
-                             const struct intel_community **community,
-                             const struct intel_padgroup **padgrp)
-{
-        int i;
-
-        for (i = 0; i < pctrl->ncommunities; i++) {
-                const struct intel_community *comm = &pctrl->communities[i];
-                int j;
-
-                for (j = 0; j < comm->ngpps; j++) {
-                        const struct intel_padgroup *pgrp = &comm->gpps[j];
-
-                        if (pgrp->gpio_base < 0)
-                                continue;
-
-                        if (offset >= pgrp->gpio_base &&
-                            offset < pgrp->gpio_base + pgrp->size) {
-                                int pin;
-
-                                pin = pgrp->base + offset - pgrp->gpio_base;
-                                if (community)
-                                        *community = comm;
-                                if (padgrp)
-                                        *padgrp = pgrp;
-
-                                return pin;
-                        }
-                }
-        }
-
-        return -EINVAL;
-}
-
 static int intel_gpio_irq_reqres(struct irq_data *d)
 {
         struct gpio_chip *gc = irq_data_get_irq_chip_data(d);
diff --git a/drivers/pinctrl/pinctrl-ingenic.c b/drivers/pinctrl/pinctrl-ingenic.c
index 6a1b6058b991..628817c40e3b 100644
--- a/drivers/pinctrl/pinctrl-ingenic.c
+++ b/drivers/pinctrl/pinctrl-ingenic.c
@@ -793,7 +793,7 @@ static int ingenic_pinctrl_probe(struct platform_device *pdev)
 
                 err = pinctrl_generic_add_group(jzpc->pctl, group->name,
                                 group->pins, group->num_pins, group->data);
-                if (err) {
+                if (err < 0) {
                         dev_err(dev, "Failed to register group %s\n",
                                         group->name);
                         return err;
@@ -806,7 +806,7 @@ static int ingenic_pinctrl_probe(struct platform_device *pdev)
                 err = pinmux_generic_add_function(jzpc->pctl, func->name,
                                 func->group_names, func->num_group_names,
                                 func->data);
-                if (err) {
+                if (err < 0) {
                         dev_err(dev, "Failed to register function %s\n",
                                         func->name);
                         return err;
diff --git a/drivers/pinctrl/qcom/pinctrl-msm.c b/drivers/pinctrl/qcom/pinctrl-msm.c
index 2155a30c282b..5d72ffad32c2 100644
--- a/drivers/pinctrl/qcom/pinctrl-msm.c
+++ b/drivers/pinctrl/qcom/pinctrl-msm.c
@@ -634,6 +634,29 @@ static void msm_gpio_irq_mask(struct irq_data *d)
         raw_spin_lock_irqsave(&pctrl->lock, flags);
 
         val = readl(pctrl->regs + g->intr_cfg_reg);
+        /*
+         * There are two bits that control interrupt forwarding to the CPU. The
+         * RAW_STATUS_EN bit causes the level or edge sensed on the line to be
+         * latched into the interrupt status register when the hardware detects
+         * an irq that it's configured for (either edge for edge type or level
+         * for level type irq). The 'non-raw' status enable bit causes the
+         * hardware to assert the summary interrupt to the CPU if the latched
+         * status bit is set. There's a bug though, the edge detection logic
+         * seems to have a problem where toggling the RAW_STATUS_EN bit may
+         * cause the status bit to latch spuriously when there isn't any edge
+         * so we can't touch that bit for edge type irqs and we have to keep
+         * the bit set anyway so that edges are latched while the line is masked.
+         *
+         * To make matters more complicated, leaving the RAW_STATUS_EN bit
+         * enabled all the time causes level interrupts to re-latch into the
+         * status register because the level is still present on the line after
+         * we ack it. We clear the raw status enable bit during mask here and
+         * set the bit on unmask so the interrupt can't latch into the hardware
+         * while it's masked.
+         */
+        if (irqd_get_trigger_type(d) & IRQ_TYPE_LEVEL_MASK)
+                val &= ~BIT(g->intr_raw_status_bit);
+
         val &= ~BIT(g->intr_enable_bit);
         writel(val, pctrl->regs + g->intr_cfg_reg);
 
@@ -655,6 +678,7 @@ static void msm_gpio_irq_unmask(struct irq_data *d)
         raw_spin_lock_irqsave(&pctrl->lock, flags);
 
         val = readl(pctrl->regs + g->intr_cfg_reg);
+        val |= BIT(g->intr_raw_status_bit);
         val |= BIT(g->intr_enable_bit);
         writel(val, pctrl->regs + g->intr_cfg_reg);
 
diff --git a/drivers/platform/x86/alienware-wmi.c b/drivers/platform/x86/alienware-wmi.c
index d975462a4c57..f10af5c383c5 100644
--- a/drivers/platform/x86/alienware-wmi.c
+++ b/drivers/platform/x86/alienware-wmi.c
@@ -536,6 +536,7 @@ static acpi_status alienware_wmax_command(struct wmax_basic_args *in_args,
                 if (obj && obj->type == ACPI_TYPE_INTEGER)
                         *out_data = (u32) obj->integer.value;
         }
+        kfree(output.pointer);
         return status;
 
 }
diff --git a/drivers/platform/x86/dell-smbios-wmi.c b/drivers/platform/x86/dell-smbios-wmi.c
index 88afe5651d24..cf2229ece9ff 100644
--- a/drivers/platform/x86/dell-smbios-wmi.c
+++ b/drivers/platform/x86/dell-smbios-wmi.c
@@ -78,6 +78,7 @@ static int run_smbios_call(struct wmi_device *wdev)
         dev_dbg(&wdev->dev, "result: [%08x,%08x,%08x,%08x]\n",
                 priv->buf->std.output[0], priv->buf->std.output[1],
                 priv->buf->std.output[2], priv->buf->std.output[3]);
+        kfree(output.pointer);
 
         return 0;
 }
diff --git a/drivers/s390/crypto/ap_bus.c b/drivers/s390/crypto/ap_bus.c
index ec891bc7d10a..f039266b275d 100644
--- a/drivers/s390/crypto/ap_bus.c
+++ b/drivers/s390/crypto/ap_bus.c
@@ -872,8 +872,6 @@ static int hex2bitmap(const char *str, unsigned long *bitmap, int bits)
         if (bits & 0x07)
                 return -EINVAL;
 
-        memset(bitmap, 0, bits / 8);
-
         if (str[0] == '0' && str[1] == 'x')
                 str++;
         if (*str == 'x')
@@ -895,25 +893,23 @@ static int hex2bitmap(const char *str, unsigned long *bitmap, int bits)
 }
 
 /*
- * str2clrsetmasks() - parse bitmask argument and set the clear and
- * the set bitmap mask. A concatenation (done with ',') of these terms
- * is recognized:
+ * modify_bitmap() - parse bitmask argument and modify an existing
+ * bit mask accordingly. A concatenation (done with ',') of these
+ * terms is recognized:
  *   +<bitnr>[-<bitnr>] or -<bitnr>[-<bitnr>]
  * <bitnr> may be any valid number (hex, decimal or octal) in the range
  * 0...bits-1; the leading + or - is required. Here are some examples:
  *   +0-15,+32,-128,-0xFF
  *   -0-255,+1-16,+0x128
  *   +1,+2,+3,+4,-5,-7-10
- * Returns a clear and a set bitmask. Every positive value in the string
- * results in a bit set in the set mask and every negative value in the
- * string results in a bit SET in the clear mask. As a bit may be touched
- * more than once, the last 'operation' wins: +0-255,-128 = all but bit
- * 128 set in the set mask, only bit 128 set in the clear mask.
+ * Returns the new bitmap after all changes have been applied. Every
+ * positive value in the string will set a bit and every negative value
+ * in the string will clear a bit. As a bit may be touched more than once,
+ * the last 'operation' wins:
+ * +0-255,-128 = first bits 0-255 will be set, then bit 128 will be
+ * cleared again. All other bits are unmodified.
  */
-static int str2clrsetmasks(const char *str,
-                           unsigned long *clrmap,
-                           unsigned long *setmap,
-                           int bits)
+static int modify_bitmap(const char *str, unsigned long *bitmap, int bits)
 {
         int a, i, z;
         char *np, sign;
@@ -922,9 +918,6 @@ static int str2clrsetmasks(const char *str,
         if (bits & 0x07)
                 return -EINVAL;
 
-        memset(clrmap, 0, bits / 8);
-        memset(setmap, 0, bits / 8);
-
         while (*str) {
                 sign = *str++;
                 if (sign != '+' && sign != '-')
@@ -940,13 +933,10 @@ static int str2clrsetmasks(const char *str,
                         str = np;
                 }
                 for (i = a; i <= z; i++)
-                        if (sign == '+') {
-                                set_bit_inv(i, setmap);
-                                clear_bit_inv(i, clrmap);
-                        } else {
-                                clear_bit_inv(i, setmap);
-                                set_bit_inv(i, clrmap);
-                        }
+                        if (sign == '+')
+                                set_bit_inv(i, bitmap);
+                        else
+                                clear_bit_inv(i, bitmap);
                 while (*str == ',' || *str == '\n')
                         str++;
         }
@@ -970,44 +960,34 @@ static int process_mask_arg(const char *str,
                             unsigned long *bitmap, int bits,
                             struct mutex *lock)
 {
-        int i;
+        unsigned long *newmap, size;
+        int rc;
 
         /* bits needs to be a multiple of 8 */
         if (bits & 0x07)
                 return -EINVAL;
 
+        size = BITS_TO_LONGS(bits)*sizeof(unsigned long);
+        newmap = kmalloc(size, GFP_KERNEL);
+        if (!newmap)
+                return -ENOMEM;
+        if (mutex_lock_interruptible(lock)) {
+                kfree(newmap);
+                return -ERESTARTSYS;
+        }
+
         if (*str == '+' || *str == '-') {
-                DECLARE_BITMAP(clrm, bits);
-                DECLARE_BITMAP(setm, bits);
-
-                i = str2clrsetmasks(str, clrm, setm, bits);
-                if (i)
-                        return i;
-                if (mutex_lock_interruptible(lock))
-                        return -ERESTARTSYS;
-                for (i = 0; i < bits; i++) {
-                        if (test_bit_inv(i, clrm))
-                                clear_bit_inv(i, bitmap);
-                        if (test_bit_inv(i, setm))
-                                set_bit_inv(i, bitmap);
-                }
+                memcpy(newmap, bitmap, size);
+                rc = modify_bitmap(str, newmap, bits);
         } else {
-                DECLARE_BITMAP(setm, bits);
-
-                i = hex2bitmap(str, setm, bits);
-                if (i)
-                        return i;
-                if (mutex_lock_interruptible(lock))
-                        return -ERESTARTSYS;
-                for (i = 0; i < bits; i++)
-                        if (test_bit_inv(i, setm))
-                                set_bit_inv(i, bitmap);
-                        else
-                                clear_bit_inv(i, bitmap);
+                memset(newmap, 0, size);
+                rc = hex2bitmap(str, newmap, bits);
         }
+        if (rc == 0)
+                memcpy(bitmap, newmap, size);
         mutex_unlock(lock);
-
-        return 0;
+        kfree(newmap);
+        return rc;
 }
 
 /*
diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
index 49f64eb3eab0..ffce6f39828a 100644
--- a/drivers/s390/net/qeth_core_main.c
+++ b/drivers/s390/net/qeth_core_main.c
@@ -25,6 +25,7 @@
 #include <linux/netdevice.h>
 #include <linux/netdev_features.h>
 #include <linux/skbuff.h>
+#include <linux/vmalloc.h>
 
 #include <net/iucv/af_iucv.h>
 #include <net/dsfield.h>
@@ -609,7 +610,7 @@ static void qeth_put_reply(struct qeth_reply *reply)
 static void qeth_issue_ipa_msg(struct qeth_ipa_cmd *cmd, int rc,
                 struct qeth_card *card)
 {
-        char *ipa_name;
+        const char *ipa_name;
         int com = cmd->hdr.command;
         ipa_name = qeth_get_ipa_cmd_name(com);
         if (rc)
@@ -4699,7 +4700,7 @@ static int qeth_query_oat_command(struct qeth_card *card, char __user *udata)
 
         priv.buffer_len = oat_data.buffer_len;
         priv.response_len = 0;
-        priv.buffer =  kzalloc(oat_data.buffer_len, GFP_KERNEL);
+        priv.buffer = vzalloc(oat_data.buffer_len);
         if (!priv.buffer) {
                 rc = -ENOMEM;
                 goto out;
@@ -4740,7 +4741,7 @@ static int qeth_query_oat_command(struct qeth_card *card, char __user *udata)
                         rc = -EFAULT;
 
 out_free:
-        kfree(priv.buffer);
+        vfree(priv.buffer);
 out:
         return rc;
 }
@@ -5706,6 +5707,8 @@ static struct net_device *qeth_alloc_netdev(struct qeth_card *card)
                 dev->priv_flags &= ~IFF_TX_SKB_SHARING;
                 dev->hw_features |= NETIF_F_SG;
                 dev->vlan_features |= NETIF_F_SG;
+                if (IS_IQD(card))
+                        dev->features |= NETIF_F_SG;
         }
 
         return dev;
@@ -5768,8 +5771,10 @@ static int qeth_core_probe_device(struct ccwgroup_device *gdev)
         qeth_update_from_chp_desc(card);
 
         card->dev = qeth_alloc_netdev(card);
-        if (!card->dev)
+        if (!card->dev) {
+                rc = -ENOMEM;
                 goto err_card;
+        }
 
         qeth_determine_capabilities(card);
         enforced_disc = qeth_enforce_discipline(card);
diff --git a/drivers/s390/net/qeth_core_mpc.c b/drivers/s390/net/qeth_core_mpc.c
index 5bcb8dafc3ee..e891c0b52f4c 100644
--- a/drivers/s390/net/qeth_core_mpc.c
+++ b/drivers/s390/net/qeth_core_mpc.c
@@ -148,10 +148,10 @@ EXPORT_SYMBOL_GPL(IPA_PDU_HEADER);
 
 struct ipa_rc_msg {
         enum qeth_ipa_return_codes rc;
-        char *msg;
+        const char *msg;
 };
 
-static struct ipa_rc_msg qeth_ipa_rc_msg[] = {
+static const struct ipa_rc_msg qeth_ipa_rc_msg[] = {
         {IPA_RC_SUCCESS,                "success"},
         {IPA_RC_NOTSUPP,                "Command not supported"},
         {IPA_RC_IP_TABLE_FULL,          "Add Addr IP Table Full - ipv6"},
@@ -219,23 +219,23 @@ static struct ipa_rc_msg qeth_ipa_rc_msg[] = {
 
 
 
-char *qeth_get_ipa_msg(enum qeth_ipa_return_codes rc)
+const char *qeth_get_ipa_msg(enum qeth_ipa_return_codes rc)
 {
-        int x = 0;
-        qeth_ipa_rc_msg[sizeof(qeth_ipa_rc_msg) /
-                        sizeof(struct ipa_rc_msg) - 1].rc = rc;
-        while (qeth_ipa_rc_msg[x].rc != rc)
-                x++;
+        int x;
+
+        for (x = 0; x < ARRAY_SIZE(qeth_ipa_rc_msg) - 1; x++)
+                if (qeth_ipa_rc_msg[x].rc == rc)
+                        return qeth_ipa_rc_msg[x].msg;
         return qeth_ipa_rc_msg[x].msg;
 }
 
 
 struct ipa_cmd_names {
         enum qeth_ipa_cmds cmd;
-        char *name;
+        const char *name;
 };
 
-static struct ipa_cmd_names qeth_ipa_cmd_names[] = {
+static const struct ipa_cmd_names qeth_ipa_cmd_names[] = {
         {IPA_CMD_STARTLAN,      "startlan"},
         {IPA_CMD_STOPLAN,       "stoplan"},
         {IPA_CMD_SETVMAC,       "setvmac"},
@@ -267,13 +267,12 @@ static struct ipa_cmd_names qeth_ipa_cmd_names[] = {
         {IPA_CMD_UNKNOWN,       "unknown"},
 };
 
-char *qeth_get_ipa_cmd_name(enum qeth_ipa_cmds cmd)
+const char *qeth_get_ipa_cmd_name(enum qeth_ipa_cmds cmd)
 {
-        int x = 0;
-        qeth_ipa_cmd_names[
-                sizeof(qeth_ipa_cmd_names) /
-                        sizeof(struct ipa_cmd_names)-1].cmd = cmd;
-        while (qeth_ipa_cmd_names[x].cmd != cmd)
-                x++;
+        int x;
+
+        for (x = 0; x < ARRAY_SIZE(qeth_ipa_cmd_names) - 1; x++)
+                if (qeth_ipa_cmd_names[x].cmd == cmd)
+                        return qeth_ipa_cmd_names[x].name;
         return qeth_ipa_cmd_names[x].name;
 }
diff --git a/drivers/s390/net/qeth_core_mpc.h b/drivers/s390/net/qeth_core_mpc.h
index aa8b9196b089..aa5de1fe01e1 100644
--- a/drivers/s390/net/qeth_core_mpc.h
+++ b/drivers/s390/net/qeth_core_mpc.h
@@ -797,8 +797,8 @@ enum qeth_ipa_arp_return_codes {
         QETH_IPA_ARP_RC_Q_NO_DATA    = 0x0008,
 };
 
-extern char *qeth_get_ipa_msg(enum qeth_ipa_return_codes rc);
-extern char *qeth_get_ipa_cmd_name(enum qeth_ipa_cmds cmd);
+extern const char *qeth_get_ipa_msg(enum qeth_ipa_return_codes rc);
+extern const char *qeth_get_ipa_cmd_name(enum qeth_ipa_cmds cmd);
 
 #define QETH_SETASS_BASE_LEN (sizeof(struct qeth_ipacmd_hdr) + \
                                sizeof(struct qeth_ipacmd_setassparms_hdr))
diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c
index 710fa74892ae..b5e38531733f 100644
--- a/drivers/s390/net/qeth_l2_main.c
+++ b/drivers/s390/net/qeth_l2_main.c
@@ -423,7 +423,7 @@ static int qeth_l2_process_inbound_buffer(struct qeth_card *card,
                 default:
                         dev_kfree_skb_any(skb);
                         QETH_CARD_TEXT(card, 3, "inbunkno");
-                        QETH_DBF_HEX(CTRL, 3, hdr, QETH_DBF_CTRL_LEN);
+                        QETH_DBF_HEX(CTRL, 3, hdr, sizeof(*hdr));
                         continue;
                 }
                 work_done++;
diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c
index 7175086677fb..ada258c01a08 100644
--- a/drivers/s390/net/qeth_l3_main.c
+++ b/drivers/s390/net/qeth_l3_main.c
@@ -1390,7 +1390,7 @@ static int qeth_l3_process_inbound_buffer(struct qeth_card *card,
                 default:
                         dev_kfree_skb_any(skb);
                         QETH_CARD_TEXT(card, 3, "inbunkno");
-                        QETH_DBF_HEX(CTRL, 3, hdr, QETH_DBF_CTRL_LEN);
+                        QETH_DBF_HEX(CTRL, 3, hdr, sizeof(*hdr));
                         continue;
                 }
                 work_done++;
diff --git a/drivers/scsi/Kconfig b/drivers/scsi/Kconfig
index 8fc851a9e116..7c097006c54d 100644
--- a/drivers/scsi/Kconfig
+++ b/drivers/scsi/Kconfig
@@ -52,12 +52,12 @@ config SCSI_MQ_DEFAULT
         default y
         depends on SCSI
         ---help---
-          This option enables the new blk-mq based I/O path for SCSI
-          devices by default.  With the option the scsi_mod.use_blk_mq
-          module/boot option defaults to Y, without it to N, but it can
-          still be overridden either way.
+          This option enables the blk-mq based I/O path for SCSI devices by
+          default.  With this option the scsi_mod.use_blk_mq module/boot
+          option defaults to Y, without it to N, but it can still be
+          overridden either way.
 
-          If unsure say N.
+          If unsure say Y.
 
 config SCSI_PROC_FS
         bool "legacy /proc/scsi/ support"
diff --git a/drivers/scsi/aacraid/aacraid.h b/drivers/scsi/aacraid/aacraid.h
index 29bf1e60f542..39eb415987fc 100644
--- a/drivers/scsi/aacraid/aacraid.h
+++ b/drivers/scsi/aacraid/aacraid.h
@@ -1346,7 +1346,7 @@ struct fib {
 struct aac_hba_map_info {
         __le32  rmw_nexus;              /* nexus for native HBA devices */
         u8              devtype;        /* device type */
-        u8              reset_state;    /* 0 - no reset, 1..x - */
+        s8              reset_state;    /* 0 - no reset, 1..x - */
                                         /* after xth TM LUN reset */
         u16             qd_limit;
         u32             scan_counter;
diff --git a/drivers/scsi/csiostor/csio_hw.c b/drivers/scsi/csiostor/csio_hw.c
index 23d07e9f87d0..e51923886475 100644
--- a/drivers/scsi/csiostor/csio_hw.c
+++ b/drivers/scsi/csiostor/csio_hw.c
@@ -1602,6 +1602,46 @@ fw_port_cap32_t fwcaps16_to_caps32(fw_port_cap16_t caps16)
 }
 
 /**
+ *      fwcaps32_to_caps16 - convert 32-bit Port Capabilities to 16-bits
+ *      @caps32: a 32-bit Port Capabilities value
+ *
+ *      Returns the equivalent 16-bit Port Capabilities value.  Note that
+ *      not all 32-bit Port Capabilities can be represented in the 16-bit
+ *      Port Capabilities and some fields/values may not make it.
+ */
+fw_port_cap16_t fwcaps32_to_caps16(fw_port_cap32_t caps32)
+{
+        fw_port_cap16_t caps16 = 0;
+
+        #define CAP32_TO_CAP16(__cap) \
+                do { \
+                        if (caps32 & FW_PORT_CAP32_##__cap) \
+                                caps16 |= FW_PORT_CAP_##__cap; \
+                } while (0)
+
+        CAP32_TO_CAP16(SPEED_100M);
+        CAP32_TO_CAP16(SPEED_1G);
+        CAP32_TO_CAP16(SPEED_10G);
+        CAP32_TO_CAP16(SPEED_25G);
+        CAP32_TO_CAP16(SPEED_40G);
+        CAP32_TO_CAP16(SPEED_100G);
+        CAP32_TO_CAP16(FC_RX);
+        CAP32_TO_CAP16(FC_TX);
+        CAP32_TO_CAP16(802_3_PAUSE);
+        CAP32_TO_CAP16(802_3_ASM_DIR);
+        CAP32_TO_CAP16(ANEG);
+        CAP32_TO_CAP16(FORCE_PAUSE);
+        CAP32_TO_CAP16(MDIAUTO);
+        CAP32_TO_CAP16(MDISTRAIGHT);
+        CAP32_TO_CAP16(FEC_RS);
+        CAP32_TO_CAP16(FEC_BASER_RS);
+
+        #undef CAP32_TO_CAP16
+
+        return caps16;
+}
+
+/**
  *      lstatus_to_fwcap - translate old lstatus to 32-bit Port Capabilities
  *      @lstatus: old FW_PORT_ACTION_GET_PORT_INFO lstatus value
  *
@@ -1759,7 +1799,7 @@ csio_enable_ports(struct csio_hw *hw)
                         val = 1;
 
                         csio_mb_params(hw, mbp, CSIO_MB_DEFAULT_TMO,
-                                       hw->pfn, 0, 1, &param, &val, false,
+                                       hw->pfn, 0, 1, &param, &val, true,
                                        NULL);
 
                         if (csio_mb_issue(hw, mbp)) {
@@ -1769,16 +1809,9 @@ csio_enable_ports(struct csio_hw *hw)
                                 return -EINVAL;
                         }
 
-                        csio_mb_process_read_params_rsp(hw, mbp, &retval, 1,
-                                                        &val);
-                        if (retval != FW_SUCCESS) {
-                                csio_err(hw, "FW_PARAMS_CMD(r) port:%d failed: 0x%x\n",
-                                         portid, retval);
-                                mempool_free(mbp, hw->mb_mempool);
-                                return -EINVAL;
-                        }
-
-                        fw_caps = val;
+                        csio_mb_process_read_params_rsp(hw, mbp, &retval,
+                                                        0, NULL);
+                        fw_caps = retval ? FW_CAPS16 : FW_CAPS32;
                 }
 
                 /* Read PORT information */
@@ -2364,8 +2397,8 @@ bye:
 }
 
 /*
- * Returns -EINVAL if attempts to flash the firmware failed
- * else returns 0,
+ * Returns -EINVAL if attempts to flash the firmware failed,
+ * -ENOMEM if memory allocation failed else returns 0,
  * if flashing was not attempted because the card had the
  * latest firmware ECANCELED is returned
  */
@@ -2393,6 +2426,13 @@ csio_hw_flash_fw(struct csio_hw *hw, int *reset)
                 return -EINVAL;
         }
 
+        /* allocate memory to read the header of the firmware on the
+         * card
+         */
+        card_fw = kmalloc(sizeof(*card_fw), GFP_KERNEL);
+        if (!card_fw)
+                return -ENOMEM;
+
         if (csio_is_t5(pci_dev->device & CSIO_HW_CHIP_MASK))
                 fw_bin_file = FW_FNAME_T5;
         else
@@ -2406,11 +2446,6 @@ csio_hw_flash_fw(struct csio_hw *hw, int *reset)
                 fw_size = fw->size;
         }
 
-        /* allocate memory to read the header of the firmware on the
-         * card
-         */
-        card_fw = kmalloc(sizeof(*card_fw), GFP_KERNEL);
-
         /* upgrade FW logic */
         ret = csio_hw_prep_fw(hw, fw_info, fw_data, fw_size, card_fw,
                          hw->fw_state, reset);
diff --git a/drivers/scsi/csiostor/csio_hw.h b/drivers/scsi/csiostor/csio_hw.h
index 9e73ef771eb7..e351af6e7c81 100644
--- a/drivers/scsi/csiostor/csio_hw.h
+++ b/drivers/scsi/csiostor/csio_hw.h
@@ -639,6 +639,7 @@ int csio_handle_intr_status(struct csio_hw *, unsigned int,
 
 fw_port_cap32_t fwcap_to_fwspeed(fw_port_cap32_t acaps);
 fw_port_cap32_t fwcaps16_to_caps32(fw_port_cap16_t caps16);
+fw_port_cap16_t fwcaps32_to_caps16(fw_port_cap32_t caps32);
 fw_port_cap32_t lstatus_to_fwcap(u32 lstatus);
 
 int csio_hw_start(struct csio_hw *);
diff --git a/drivers/scsi/csiostor/csio_mb.c b/drivers/scsi/csiostor/csio_mb.c
index c026417269c3..6f13673d6aa0 100644
--- a/drivers/scsi/csiostor/csio_mb.c
+++ b/drivers/scsi/csiostor/csio_mb.c
@@ -368,7 +368,7 @@ csio_mb_port(struct csio_hw *hw, struct csio_mb *mbp, uint32_t tmo,
                         FW_CMD_LEN16_V(sizeof(*cmdp) / 16));
 
         if (fw_caps == FW_CAPS16)
-                cmdp->u.l1cfg.rcap = cpu_to_be32(fc);
+                cmdp->u.l1cfg.rcap = cpu_to_be32(fwcaps32_to_caps16(fc));
         else
                 cmdp->u.l1cfg32.rcap32 = cpu_to_be32(fc);
 }
@@ -395,8 +395,8 @@ csio_mb_process_read_port_rsp(struct csio_hw *hw, struct csio_mb *mbp,
                         *pcaps = fwcaps16_to_caps32(ntohs(rsp->u.info.pcap));
                         *acaps = fwcaps16_to_caps32(ntohs(rsp->u.info.acap));
                 } else {
-                        *pcaps = ntohs(rsp->u.info32.pcaps32);
-                        *acaps = ntohs(rsp->u.info32.acaps32);
+                        *pcaps = be32_to_cpu(rsp->u.info32.pcaps32);
+                        *acaps = be32_to_cpu(rsp->u.info32.acaps32);
                 }
         }
 }
diff --git a/drivers/scsi/hosts.c b/drivers/scsi/hosts.c
index f02dcc875a09..ea4b0bb0c1cd 100644
--- a/drivers/scsi/hosts.c
+++ b/drivers/scsi/hosts.c
@@ -563,35 +563,13 @@ struct Scsi_Host *scsi_host_get(struct Scsi_Host *shost)
 }
 EXPORT_SYMBOL(scsi_host_get);
 
-struct scsi_host_mq_in_flight {
-        int cnt;
-};
-
-static void scsi_host_check_in_flight(struct request *rq, void *data,
-                bool reserved)
-{
-        struct scsi_host_mq_in_flight *in_flight = data;
-
-        if (blk_mq_request_started(rq))
-                in_flight->cnt++;
-}
-
 /**
  * scsi_host_busy - Return the host busy counter
  * @shost:      Pointer to Scsi_Host to inc.
  **/
 int scsi_host_busy(struct Scsi_Host *shost)
 {
-        struct scsi_host_mq_in_flight in_flight = {
-                .cnt = 0,
-        };
-
-        if (!shost->use_blk_mq)
-                return atomic_read(&shost->host_busy);
-
-        blk_mq_tagset_busy_iter(&shost->tag_set, scsi_host_check_in_flight,
-                        &in_flight);
-        return in_flight.cnt;
+        return atomic_read(&shost->host_busy);
 }
 EXPORT_SYMBOL(scsi_host_busy);
 
diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
index 58bb70b886d7..c120929d4ffe 100644
--- a/drivers/scsi/hpsa.c
+++ b/drivers/scsi/hpsa.c
@@ -976,7 +976,7 @@ static struct scsi_host_template hpsa_driver_template = {
 #endif
         .sdev_attrs = hpsa_sdev_attrs,
         .shost_attrs = hpsa_shost_attrs,
-        .max_sectors = 1024,
+        .max_sectors = 2048,
         .no_write_same = 1,
 };
 
diff --git a/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c b/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c
index fac377320158..f42a619198c4 100644
--- a/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c
+++ b/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c
@@ -3474,11 +3474,10 @@ static int ibmvscsis_probe(struct vio_dev *vdev,
                 vscsi->dds.window[LOCAL].liobn,
                 vscsi->dds.window[REMOTE].liobn);
 
-        strcpy(vscsi->eye, "VSCSI ");
-        strncat(vscsi->eye, vdev->name, MAX_EYE);
+        snprintf(vscsi->eye, sizeof(vscsi->eye), "VSCSI %s", vdev->name);
 
         vscsi->dds.unit_id = vdev->unit_address;
-        strncpy(vscsi->dds.partition_name, partition_name,
+        strscpy(vscsi->dds.partition_name, partition_name,
                 sizeof(vscsi->dds.partition_name));
         vscsi->dds.partition_num = partition_number;
 
diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c
index f2ec80b0ffc0..271990bc065b 100644
--- a/drivers/scsi/ipr.c
+++ b/drivers/scsi/ipr.c
@@ -3335,6 +3335,65 @@ static void ipr_release_dump(struct kref *kref)
         LEAVE;
 }
 
+static void ipr_add_remove_thread(struct work_struct *work)
+{
+        unsigned long lock_flags;
+        struct ipr_resource_entry *res;
+        struct scsi_device *sdev;
+        struct ipr_ioa_cfg *ioa_cfg =
+                container_of(work, struct ipr_ioa_cfg, scsi_add_work_q);
+        u8 bus, target, lun;
+        int did_work;
+
+        ENTER;
+        spin_lock_irqsave(ioa_cfg->host->host_lock, lock_flags);
+
+restart:
+        do {
+                did_work = 0;
+                if (!ioa_cfg->hrrq[IPR_INIT_HRRQ].allow_cmds) {
+                        spin_unlock_irqrestore(ioa_cfg->host->host_lock, lock_flags);
+                        return;
+                }
+
+                list_for_each_entry(res, &ioa_cfg->used_res_q, queue) {
+                        if (res->del_from_ml && res->sdev) {
+                                did_work = 1;
+                                sdev = res->sdev;
+                                if (!scsi_device_get(sdev)) {
+                                        if (!res->add_to_ml)
+                                                list_move_tail(&res->queue, &ioa_cfg->free_res_q);
+                                        else
+                                                res->del_from_ml = 0;
+                                        spin_unlock_irqrestore(ioa_cfg->host->host_lock, lock_flags);
+                                        scsi_remove_device(sdev);
+                                        scsi_device_put(sdev);
+                                        spin_lock_irqsave(ioa_cfg->host->host_lock, lock_flags);
+                                }
+                                break;
+                        }
+                }
+        } while (did_work);
+
+        list_for_each_entry(res, &ioa_cfg->used_res_q, queue) {
+                if (res->add_to_ml) {
+                        bus = res->bus;
+                        target = res->target;
+                        lun = res->lun;
+                        res->add_to_ml = 0;
+                        spin_unlock_irqrestore(ioa_cfg->host->host_lock, lock_flags);
+                        scsi_add_device(ioa_cfg->host, bus, target, lun);
+                        spin_lock_irqsave(ioa_cfg->host->host_lock, lock_flags);
+                        goto restart;
+                }
+        }
+
+        ioa_cfg->scan_done = 1;
+        spin_unlock_irqrestore(ioa_cfg->host->host_lock, lock_flags);
+        kobject_uevent(&ioa_cfg->host->shost_dev.kobj, KOBJ_CHANGE);
+        LEAVE;
+}
+
 /**
  * ipr_worker_thread - Worker thread
  * @work:               ioa config struct
@@ -3349,13 +3408,9 @@ static void ipr_release_dump(struct kref *kref)
 static void ipr_worker_thread(struct work_struct *work)
 {
         unsigned long lock_flags;
-        struct ipr_resource_entry *res;
-        struct scsi_device *sdev;
         struct ipr_dump *dump;
         struct ipr_ioa_cfg *ioa_cfg =
                 container_of(work, struct ipr_ioa_cfg, work_q);
-        u8 bus, target, lun;
-        int did_work;
 
         ENTER;
         spin_lock_irqsave(ioa_cfg->host->host_lock, lock_flags);
@@ -3393,49 +3448,9 @@ static void ipr_worker_thread(struct work_struct *work)
                 return;
         }
 
-restart:
-        do {
-                did_work = 0;
-                if (!ioa_cfg->hrrq[IPR_INIT_HRRQ].allow_cmds) {
-                        spin_unlock_irqrestore(ioa_cfg->host->host_lock, lock_flags);
-                        return;
-                }
+        schedule_work(&ioa_cfg->scsi_add_work_q);
 
-                list_for_each_entry(res, &ioa_cfg->used_res_q, queue) {
-                        if (res->del_from_ml && res->sdev) {
-                                did_work = 1;
-                                sdev = res->sdev;
-                                if (!scsi_device_get(sdev)) {
-                                        if (!res->add_to_ml)
-                                                list_move_tail(&res->queue, &ioa_cfg->free_res_q);
-                                        else
-                                                res->del_from_ml = 0;
-                                        spin_unlock_irqrestore(ioa_cfg->host->host_lock, lock_flags);
-                                        scsi_remove_device(sdev);
-                                        scsi_device_put(sdev);
-                                        spin_lock_irqsave(ioa_cfg->host->host_lock, lock_flags);
-                                }
-                                break;
-                        }
-                }
-        } while (did_work);
-
-        list_for_each_entry(res, &ioa_cfg->used_res_q, queue) {
-                if (res->add_to_ml) {
-                        bus = res->bus;
-                        target = res->target;
-                        lun = res->lun;
-                        res->add_to_ml = 0;
-                        spin_unlock_irqrestore(ioa_cfg->host->host_lock, lock_flags);
-                        scsi_add_device(ioa_cfg->host, bus, target, lun);
-                        spin_lock_irqsave(ioa_cfg->host->host_lock, lock_flags);
-                        goto restart;
-                }
-        }
-
-        ioa_cfg->scan_done = 1;
         spin_unlock_irqrestore(ioa_cfg->host->host_lock, lock_flags);
-        kobject_uevent(&ioa_cfg->host->shost_dev.kobj, KOBJ_CHANGE);
         LEAVE;
 }
 
@@ -9933,6 +9948,7 @@ static void ipr_init_ioa_cfg(struct ipr_ioa_cfg *ioa_cfg,
         INIT_LIST_HEAD(&ioa_cfg->free_res_q);
         INIT_LIST_HEAD(&ioa_cfg->used_res_q);
         INIT_WORK(&ioa_cfg->work_q, ipr_worker_thread);
+        INIT_WORK(&ioa_cfg->scsi_add_work_q, ipr_add_remove_thread);
         init_waitqueue_head(&ioa_cfg->reset_wait_q);
         init_waitqueue_head(&ioa_cfg->msi_wait_q);
         init_waitqueue_head(&ioa_cfg->eeh_wait_q);
diff --git a/drivers/scsi/ipr.h b/drivers/scsi/ipr.h
index 68afbbde54d3..f6baa2351313 100644
--- a/drivers/scsi/ipr.h
+++ b/drivers/scsi/ipr.h
@@ -1575,6 +1575,7 @@ struct ipr_ioa_cfg {
         u8 saved_mode_page_len;
 
         struct work_struct work_q;
+        struct work_struct scsi_add_work_q;
         struct workqueue_struct *reset_work_q;
 
         wait_queue_head_t reset_wait_q;
diff --git a/drivers/scsi/lpfc/lpfc.h b/drivers/scsi/lpfc/lpfc.h
index e0d0da5f43d6..43732e8d1347 100644
--- a/drivers/scsi/lpfc/lpfc.h
+++ b/drivers/scsi/lpfc/lpfc.h
@@ -672,7 +672,7 @@ struct lpfc_hba {
 #define LS_NPIV_FAB_SUPPORTED 0x2       /* Fabric supports NPIV */
 #define LS_IGNORE_ERATT       0x4       /* intr handler should ignore ERATT */
 #define LS_MDS_LINK_DOWN      0x8       /* MDS Diagnostics Link Down */
-#define LS_MDS_LOOPBACK      0x16       /* MDS Diagnostics Link Up (Loopback) */
+#define LS_MDS_LOOPBACK      0x10       /* MDS Diagnostics Link Up (Loopback) */
 
         uint32_t hba_flag;      /* hba generic flags */
 #define HBA_ERATT_HANDLED       0x1 /* This flag is set when eratt handled */
diff --git a/drivers/scsi/lpfc/lpfc_attr.c b/drivers/scsi/lpfc/lpfc_attr.c
index 5a25553415f8..1a6ed9b0a249 100644
--- a/drivers/scsi/lpfc/lpfc_attr.c
+++ b/drivers/scsi/lpfc/lpfc_attr.c
@@ -360,12 +360,12 @@ lpfc_nvme_info_show(struct device *dev, struct device_attribute *attr,
                 goto buffer_done;
 
         list_for_each_entry(ndlp, &vport->fc_nodes, nlp_listp) {
+                nrport = NULL;
+                spin_lock(&vport->phba->hbalock);
                 rport = lpfc_ndlp_get_nrport(ndlp);
-                if (!rport)
-                        continue;
-
-                /* local short-hand pointer. */
-                nrport = rport->remoteport;
+                if (rport)
+                        nrport = rport->remoteport;
+                spin_unlock(&vport->phba->hbalock);
                 if (!nrport)
                         continue;
 
@@ -3386,6 +3386,7 @@ lpfc_update_rport_devloss_tmo(struct lpfc_vport *vport)
         struct lpfc_nodelist  *ndlp;
 #if (IS_ENABLED(CONFIG_NVME_FC))
         struct lpfc_nvme_rport *rport;
+        struct nvme_fc_remote_port *remoteport = NULL;
 #endif
 
         shost = lpfc_shost_from_vport(vport);
@@ -3396,8 +3397,12 @@ lpfc_update_rport_devloss_tmo(struct lpfc_vport *vport)
                 if (ndlp->rport)
                         ndlp->rport->dev_loss_tmo = vport->cfg_devloss_tmo;
 #if (IS_ENABLED(CONFIG_NVME_FC))
+                spin_lock(&vport->phba->hbalock);
                 rport = lpfc_ndlp_get_nrport(ndlp);
                 if (rport)
+                        remoteport = rport->remoteport;
+                spin_unlock(&vport->phba->hbalock);
+                if (remoteport)
                         nvme_fc_set_remoteport_devloss(rport->remoteport,
                                                        vport->cfg_devloss_tmo);
 #endif
@@ -5122,16 +5127,16 @@ LPFC_ATTR_R(enable_SmartSAN, 0, 0, 1, "Enable SmartSAN functionality");
 
 /*
 # lpfc_fdmi_on: Controls FDMI support.
-#       0       No FDMI support (default)
-#       1       Traditional FDMI support
+#       0       No FDMI support
+#       1       Traditional FDMI support (default)
 # Traditional FDMI support means the driver will assume FDMI-2 support;
 # however, if that fails, it will fallback to FDMI-1.
 # If lpfc_enable_SmartSAN is set to 1, the driver ignores lpfc_fdmi_on.
 # If lpfc_enable_SmartSAN is set 0, the driver uses the current value of
 # lpfc_fdmi_on.
-# Value range [0,1]. Default value is 0.
+# Value range [0,1]. Default value is 1.
 */
-LPFC_ATTR_R(fdmi_on, 0, 0, 1, "Enable FDMI support");
+LPFC_ATTR_R(fdmi_on, 1, 0, 1, "Enable FDMI support");
 
 /*
 # Specifies the maximum number of ELS cmds we can have outstanding (for
diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c
index 9df0c051349f..aec5b10a8c85 100644
--- a/drivers/scsi/lpfc/lpfc_debugfs.c
+++ b/drivers/scsi/lpfc/lpfc_debugfs.c
@@ -551,7 +551,7 @@ lpfc_debugfs_nodelist_data(struct lpfc_vport *vport, char *buf, int size)
         unsigned char *statep;
         struct nvme_fc_local_port *localport;
         struct lpfc_nvmet_tgtport *tgtp;
-        struct nvme_fc_remote_port *nrport;
+        struct nvme_fc_remote_port *nrport = NULL;
         struct lpfc_nvme_rport *rport;
 
         cnt = (LPFC_NODELIST_SIZE / LPFC_NODELIST_ENTRY_SIZE);
@@ -696,11 +696,11 @@ lpfc_debugfs_nodelist_data(struct lpfc_vport *vport, char *buf, int size)
         len += snprintf(buf + len, size - len, "\tRport List:\n");
         list_for_each_entry(ndlp, &vport->fc_nodes, nlp_listp) {
                 /* local short-hand pointer. */
+                spin_lock(&phba->hbalock);
                 rport = lpfc_ndlp_get_nrport(ndlp);
-                if (!rport)
-                        continue;
-
-                nrport = rport->remoteport;
+                if (rport)
+                        nrport = rport->remoteport;
+                spin_unlock(&phba->hbalock);
                 if (!nrport)
                         continue;
 
diff --git a/drivers/scsi/lpfc/lpfc_nvme.c b/drivers/scsi/lpfc/lpfc_nvme.c
index 028462e5994d..918ae18ef8a8 100644
--- a/drivers/scsi/lpfc/lpfc_nvme.c
+++ b/drivers/scsi/lpfc/lpfc_nvme.c
@@ -2725,7 +2725,9 @@ lpfc_nvme_register_port(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp)
         rpinfo.port_name = wwn_to_u64(ndlp->nlp_portname.u.wwn);
         rpinfo.node_name = wwn_to_u64(ndlp->nlp_nodename.u.wwn);
 
+        spin_lock_irq(&vport->phba->hbalock);
         oldrport = lpfc_ndlp_get_nrport(ndlp);
+        spin_unlock_irq(&vport->phba->hbalock);
         if (!oldrport)
                 lpfc_nlp_get(ndlp);
 
@@ -2840,7 +2842,7 @@ lpfc_nvme_unregister_port(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp)
         struct nvme_fc_local_port *localport;
         struct lpfc_nvme_lport *lport;
         struct lpfc_nvme_rport *rport;
-        struct nvme_fc_remote_port *remoteport;
+        struct nvme_fc_remote_port *remoteport = NULL;
 
         localport = vport->localport;
 
@@ -2854,11 +2856,14 @@ lpfc_nvme_unregister_port(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp)
         if (!lport)
                 goto input_err;
 
+        spin_lock_irq(&vport->phba->hbalock);
         rport = lpfc_ndlp_get_nrport(ndlp);
-        if (!rport)
+        if (rport)
+                remoteport = rport->remoteport;
+        spin_unlock_irq(&vport->phba->hbalock);
+        if (!remoteport)
                 goto input_err;
 
-        remoteport = rport->remoteport;
         lpfc_printf_vlog(vport, KERN_INFO, LOG_NVME_DISC,
                          "6033 Unreg nvme remoteport %p, portname x%llx, "
                          "port_id x%06x, portstate x%x port type x%x\n",
diff --git a/drivers/scsi/qedi/qedi.h b/drivers/scsi/qedi/qedi.h
index fc3babc15fa3..a6f96b35e971 100644
--- a/drivers/scsi/qedi/qedi.h
+++ b/drivers/scsi/qedi/qedi.h
@@ -77,6 +77,11 @@ enum qedi_nvm_tgts {
         QEDI_NVM_TGT_SEC,
 };
 
+struct qedi_nvm_iscsi_image {
+        struct nvm_iscsi_cfg iscsi_cfg;
+        u32 crc;
+};
+
 struct qedi_uio_ctrl {
         /* meta data */
         u32 uio_hsi_version;
@@ -294,7 +299,7 @@ struct qedi_ctx {
         void *bdq_pbl_list;
         dma_addr_t bdq_pbl_list_dma;
         u8 bdq_pbl_list_num_entries;
-        struct nvm_iscsi_cfg *iscsi_cfg;
+        struct qedi_nvm_iscsi_image *iscsi_image;
         dma_addr_t nvm_buf_dma;
         void __iomem *bdq_primary_prod;
         void __iomem *bdq_secondary_prod;
diff --git a/drivers/scsi/qedi/qedi_main.c b/drivers/scsi/qedi/qedi_main.c
index aa96bccb5a96..cc8e64dc65ad 100644
--- a/drivers/scsi/qedi/qedi_main.c
+++ b/drivers/scsi/qedi/qedi_main.c
@@ -1346,23 +1346,26 @@ exit_setup_int:
 
 static void qedi_free_nvm_iscsi_cfg(struct qedi_ctx *qedi)
 {
-        if (qedi->iscsi_cfg)
+        if (qedi->iscsi_image)
                 dma_free_coherent(&qedi->pdev->dev,
-                                  sizeof(struct nvm_iscsi_cfg),
-                                  qedi->iscsi_cfg, qedi->nvm_buf_dma);
+                                  sizeof(struct qedi_nvm_iscsi_image),
+                                  qedi->iscsi_image, qedi->nvm_buf_dma);
 }
 
 static int qedi_alloc_nvm_iscsi_cfg(struct qedi_ctx *qedi)
 {
-        qedi->iscsi_cfg = dma_zalloc_coherent(&qedi->pdev->dev,
-                                             sizeof(struct nvm_iscsi_cfg),
-                                             &qedi->nvm_buf_dma, GFP_KERNEL);
-        if (!qedi->iscsi_cfg) {
+        struct qedi_nvm_iscsi_image nvm_image;
+
+        qedi->iscsi_image = dma_zalloc_coherent(&qedi->pdev->dev,
+                                                sizeof(nvm_image),
+                                                &qedi->nvm_buf_dma,
+                                                GFP_KERNEL);
+        if (!qedi->iscsi_image) {
                 QEDI_ERR(&qedi->dbg_ctx, "Could not allocate NVM BUF.\n");
                 return -ENOMEM;
         }
         QEDI_INFO(&qedi->dbg_ctx, QEDI_LOG_INFO,
-                  "NVM BUF addr=0x%p dma=0x%llx.\n", qedi->iscsi_cfg,
+                  "NVM BUF addr=0x%p dma=0x%llx.\n", qedi->iscsi_image,
                   qedi->nvm_buf_dma);
 
         return 0;
@@ -1905,7 +1908,7 @@ qedi_get_nvram_block(struct qedi_ctx *qedi)
         struct nvm_iscsi_block *block;
 
         pf = qedi->dev_info.common.abs_pf_id;
-        block = &qedi->iscsi_cfg->block[0];
+        block = &qedi->iscsi_image->iscsi_cfg.block[0];
         for (i = 0; i < NUM_OF_ISCSI_PF_SUPPORTED; i++, block++) {
                 flags = ((block->id) & NVM_ISCSI_CFG_BLK_CTRL_FLAG_MASK) >>
                         NVM_ISCSI_CFG_BLK_CTRL_FLAG_OFFSET;
@@ -2194,15 +2197,14 @@ static void qedi_boot_release(void *data)
 static int qedi_get_boot_info(struct qedi_ctx *qedi)
 {
         int ret = 1;
-        u16 len;
-
-        len = sizeof(struct nvm_iscsi_cfg);
+        struct qedi_nvm_iscsi_image nvm_image;
 
         QEDI_INFO(&qedi->dbg_ctx, QEDI_LOG_INFO,
                   "Get NVM iSCSI CFG image\n");
         ret = qedi_ops->common->nvm_get_image(qedi->cdev,
                                               QED_NVM_IMAGE_ISCSI_CFG,
-                                              (char *)qedi->iscsi_cfg, len);
+                                              (char *)qedi->iscsi_image,
+                                              sizeof(nvm_image));
         if (ret)
                 QEDI_ERR(&qedi->dbg_ctx,
                          "Could not get NVM image. ret = %d\n", ret);
diff --git a/drivers/scsi/qla2xxx/qla_target.h b/drivers/scsi/qla2xxx/qla_target.h
index fecf96f0225c..199d3ba1916d 100644
--- a/drivers/scsi/qla2xxx/qla_target.h
+++ b/drivers/scsi/qla2xxx/qla_target.h
@@ -374,8 +374,8 @@ struct atio_from_isp {
 static inline int fcpcmd_is_corrupted(struct atio *atio)
 {
         if (atio->entry_type == ATIO_TYPE7 &&
-            (le16_to_cpu(atio->attr_n_length & FCP_CMD_LENGTH_MASK) <
-            FCP_CMD_LENGTH_MIN))
+            ((le16_to_cpu(atio->attr_n_length) & FCP_CMD_LENGTH_MASK) <
+             FCP_CMD_LENGTH_MIN))
                 return 1;
         else
                 return 0;
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index 0adfb3bce0fd..eb97d2dd3651 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -345,8 +345,7 @@ static void scsi_dec_host_busy(struct Scsi_Host *shost)
         unsigned long flags;
 
         rcu_read_lock();
-        if (!shost->use_blk_mq)
-                atomic_dec(&shost->host_busy);
+        atomic_dec(&shost->host_busy);
         if (unlikely(scsi_host_in_recovery(shost))) {
                 spin_lock_irqsave(shost->host_lock, flags);
                 if (shost->host_failed || shost->host_eh_scheduled)
@@ -445,12 +444,7 @@ static inline bool scsi_target_is_busy(struct scsi_target *starget)
 
 static inline bool scsi_host_is_busy(struct Scsi_Host *shost)
 {
-        /*
-         * blk-mq can handle host queue busy efficiently via host-wide driver
-         * tag allocation
-         */
-
-        if (!shost->use_blk_mq && shost->can_queue > 0 &&
+        if (shost->can_queue > 0 &&
             atomic_read(&shost->host_busy) >= shost->can_queue)
                 return true;
         if (atomic_read(&shost->host_blocked) > 0)
@@ -1606,10 +1600,7 @@ static inline int scsi_host_queue_ready(struct request_queue *q,
         if (scsi_host_in_recovery(shost))
                 return 0;
 
-        if (!shost->use_blk_mq)
-                busy = atomic_inc_return(&shost->host_busy) - 1;
-        else
-                busy = 0;
+        busy = atomic_inc_return(&shost->host_busy) - 1;
         if (atomic_read(&shost->host_blocked) > 0) {
                 if (busy)
                         goto starved;
@@ -1625,7 +1616,7 @@ static inline int scsi_host_queue_ready(struct request_queue *q,
                                      "unblocking host at zero depth\n"));
         }
 
-        if (!shost->use_blk_mq && shost->can_queue > 0 && busy >= shost->can_queue)
+        if (shost->can_queue > 0 && busy >= shost->can_queue)
                 goto starved;
         if (shost->host_self_blocked)
                 goto starved;
@@ -1711,9 +1702,7 @@ static void scsi_kill_request(struct request *req, struct request_queue *q)
          * with the locks as normal issue path does.
          */
         atomic_inc(&sdev->device_busy);
-
-        if (!shost->use_blk_mq)
-                atomic_inc(&shost->host_busy);
+        atomic_inc(&shost->host_busy);
         if (starget->can_queue > 0)
                 atomic_inc(&starget->target_busy);
 
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index b79b366a94f7..4a57ffecc7e6 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -1276,7 +1276,8 @@ static int sd_init_command(struct scsi_cmnd *cmd)
         case REQ_OP_ZONE_RESET:
                 return sd_zbc_setup_reset_cmnd(cmd);
         default:
-                BUG();
+                WARN_ON_ONCE(1);
+                return BLKPREP_KILL;
         }
 }
 
@@ -2959,6 +2960,9 @@ static void sd_read_block_characteristics(struct scsi_disk *sdkp)
         if (rot == 1) {
                 blk_queue_flag_set(QUEUE_FLAG_NONROT, q);
                 blk_queue_flag_clear(QUEUE_FLAG_ADD_RANDOM, q);
+        } else {
+                blk_queue_flag_clear(QUEUE_FLAG_NONROT, q);
+                blk_queue_flag_set(QUEUE_FLAG_ADD_RANDOM, q);
         }
 
         if (sdkp->device->type == TYPE_ZBC) {
diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
index 9d5d2ca7fc4f..c55f38ec391c 100644
--- a/drivers/scsi/ufs/ufshcd.c
+++ b/drivers/scsi/ufs/ufshcd.c
@@ -7940,6 +7940,13 @@ int ufshcd_alloc_host(struct device *dev, struct ufs_hba **hba_handle)
                 err = -ENOMEM;
                 goto out_error;
         }
+
+        /*
+         * Do not use blk-mq at this time because blk-mq does not support
+         * runtime pm.
+         */
+        host->use_blk_mq = false;
+
         hba = shost_priv(host);
         hba->host = host;
         hba->dev = dev;
diff --git a/drivers/soundwire/stream.c b/drivers/soundwire/stream.c
index 4b5e250e8615..e5c7e1ef6318 100644
--- a/drivers/soundwire/stream.c
+++ b/drivers/soundwire/stream.c
@@ -899,9 +899,10 @@ static void sdw_release_master_stream(struct sdw_stream_runtime *stream)
         struct sdw_master_runtime *m_rt = stream->m_rt;
         struct sdw_slave_runtime *s_rt, *_s_rt;
 
-        list_for_each_entry_safe(s_rt, _s_rt,
-                        &m_rt->slave_rt_list, m_rt_node)
-                sdw_stream_remove_slave(s_rt->slave, stream);
+        list_for_each_entry_safe(s_rt, _s_rt, &m_rt->slave_rt_list, m_rt_node) {
+                sdw_slave_port_release(s_rt->slave->bus, s_rt->slave, stream);
+                sdw_release_slave_stream(s_rt->slave, stream);
+        }
 
         list_del(&m_rt->bus_node);
 }
@@ -1112,7 +1113,7 @@ int sdw_stream_add_master(struct sdw_bus *bus,
                                 "Master runtime config failed for stream:%s",
                                 stream->name);
                 ret = -ENOMEM;
-                goto error;
+                goto unlock;
         }
 
         ret = sdw_config_stream(bus->dev, stream, stream_config, false);
@@ -1123,11 +1124,11 @@ int sdw_stream_add_master(struct sdw_bus *bus,
         if (ret)
                 goto stream_error;
 
-        stream->state = SDW_STREAM_CONFIGURED;
+        goto unlock;
 
 stream_error:
         sdw_release_master_stream(stream);
-error:
+unlock:
         mutex_unlock(&bus->bus_lock);
         return ret;
 }
@@ -1141,6 +1142,10 @@ EXPORT_SYMBOL(sdw_stream_add_master);
  * @stream: SoundWire stream
  * @port_config: Port configuration for audio stream
  * @num_ports: Number of ports
+ *
+ * It is expected that Slave is added before adding Master
+ * to the Stream.
+ *
  */
 int sdw_stream_add_slave(struct sdw_slave *slave,
                 struct sdw_stream_config *stream_config,
@@ -1186,6 +1191,12 @@ int sdw_stream_add_slave(struct sdw_slave *slave,
         if (ret)
                 goto stream_error;
 
+        /*
+         * Change stream state to CONFIGURED on first Slave add.
+         * Bus is not aware of number of Slave(s) in a stream at this
+         * point so cannot depend on all Slave(s) to be added in order to
+         * change stream state to CONFIGURED.
+         */
         stream->state = SDW_STREAM_CONFIGURED;
         goto error;
 
diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c
index 7cb3ab0a35a0..3082e72e4f6c 100644
--- a/drivers/spi/spi-fsl-dspi.c
+++ b/drivers/spi/spi-fsl-dspi.c
@@ -30,7 +30,11 @@
 
 #define DRIVER_NAME "fsl-dspi"
 
+#ifdef CONFIG_M5441x
+#define DSPI_FIFO_SIZE                  16
+#else
 #define DSPI_FIFO_SIZE                  4
+#endif
 #define DSPI_DMA_BUFSIZE                (DSPI_FIFO_SIZE * 1024)
 
 #define SPI_MCR         0x00
@@ -623,9 +627,11 @@ static void dspi_tcfq_read(struct fsl_dspi *dspi)
 static void dspi_eoq_write(struct fsl_dspi *dspi)
 {
         int fifo_size = DSPI_FIFO_SIZE;
+        u16 xfer_cmd = dspi->tx_cmd;
 
         /* Fill TX FIFO with as many transfers as possible */
         while (dspi->len && fifo_size--) {
+                dspi->tx_cmd = xfer_cmd;
                 /* Request EOQF for last transfer in FIFO */
                 if (dspi->len == dspi->bytes_per_word || fifo_size == 0)
                         dspi->tx_cmd |= SPI_PUSHR_CMD_EOQ;
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index ec395a6baf9c..9da0bc5a036c 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -2143,8 +2143,17 @@ int spi_register_controller(struct spi_controller *ctlr)
          */
         if (ctlr->num_chipselect == 0)
                 return -EINVAL;
-        /* allocate dynamic bus number using Linux idr */
-        if ((ctlr->bus_num < 0) && ctlr->dev.of_node) {
+        if (ctlr->bus_num >= 0) {
+                /* devices with a fixed bus num must check-in with the num */
+                mutex_lock(&board_lock);
+                id = idr_alloc(&spi_master_idr, ctlr, ctlr->bus_num,
+                        ctlr->bus_num + 1, GFP_KERNEL);
+                mutex_unlock(&board_lock);
+                if (WARN(id < 0, "couldn't get idr"))
+                        return id == -ENOSPC ? -EBUSY : id;
+                ctlr->bus_num = id;
+        } else if (ctlr->dev.of_node) {
+                /* allocate dynamic bus number using Linux idr */
                 id = of_alias_get_id(ctlr->dev.of_node, "spi");
                 if (id >= 0) {
                         ctlr->bus_num = id;
diff --git a/drivers/staging/erofs/Kconfig b/drivers/staging/erofs/Kconfig
index 96f614934df1..663b755bf2fb 100644
--- a/drivers/staging/erofs/Kconfig
+++ b/drivers/staging/erofs/Kconfig
@@ -2,7 +2,7 @@
 
 config EROFS_FS
         tristate "EROFS filesystem support"
-        depends on BROKEN
+        depends on BLOCK
         help
           EROFS(Enhanced Read-Only File System) is a lightweight
           read-only file system with modern designs (eg. page-sized
diff --git a/drivers/staging/erofs/super.c b/drivers/staging/erofs/super.c
index 1aec509c805f..2df9768edac9 100644
--- a/drivers/staging/erofs/super.c
+++ b/drivers/staging/erofs/super.c
@@ -340,7 +340,7 @@ static int erofs_read_super(struct super_block *sb,
                 goto err_sbread;
 
         sb->s_magic = EROFS_SUPER_MAGIC;
-        sb->s_flags |= MS_RDONLY | MS_NOATIME;
+        sb->s_flags |= SB_RDONLY | SB_NOATIME;
         sb->s_maxbytes = MAX_LFS_FILESIZE;
         sb->s_time_gran = 1;
 
@@ -627,7 +627,7 @@ static int erofs_remount(struct super_block *sb, int *flags, char *data)
 {
         BUG_ON(!sb_rdonly(sb));
 
-        *flags |= MS_RDONLY;
+        *flags |= SB_RDONLY;
         return 0;
 }
 
diff --git a/drivers/staging/fbtft/TODO b/drivers/staging/fbtft/TODO
index 7e64c7e438f0..a9f4802bb6be 100644
--- a/drivers/staging/fbtft/TODO
+++ b/drivers/staging/fbtft/TODO
@@ -2,3 +2,7 @@
   GPIO descriptor API in <linux/gpio/consumer.h> and look up GPIO
   lines from device tree, ACPI or board files, board files should
   use <linux/gpio/machine.h>
+
+* convert all these over to drm_simple_display_pipe and submit for inclusion
+  into the DRM subsystem under drivers/gpu/drm - fbdev doesn't take any new
+  drivers anymore.
diff --git a/drivers/staging/gasket/TODO b/drivers/staging/gasket/TODO
index 6ff8e01b04cc..5b1865f8af2d 100644
--- a/drivers/staging/gasket/TODO
+++ b/drivers/staging/gasket/TODO
@@ -1,9 +1,22 @@
 This is a list of things that need to be done to get this driver out of the
 staging directory.
+
+- Implement the gasket framework's functionality through UIO instead of
+  introducing a new user-space drivers framework that is quite similar.
+
+  UIO provides the necessary bits to implement user-space drivers. Meanwhile
+  the gasket APIs adds some extra conveniences like PCI BAR mapping, and
+  MSI interrupts. Add these features to the UIO subsystem, then re-implement
+  the Apex driver as a basic UIO driver instead (include/linux/uio_driver.h)
+
 - Document sysfs files with Documentation/ABI/ entries.
+
 - Use misc interface instead of major number for driver version description.
+
 - Add descriptions of module_param's
+
 - apex_get_status() should actually check status.
+
 - "drivers" should never be dealing with "raw" sysfs calls or mess around with
   kobjects at all. The driver core should handle all of this for you
   automaically. There should not be a need for raw attribute macros.
diff --git a/drivers/staging/media/mt9t031/Kconfig b/drivers/staging/media/mt9t031/Kconfig
index f48e06a03cdb..9a58aaf72edd 100644
--- a/drivers/staging/media/mt9t031/Kconfig
+++ b/drivers/staging/media/mt9t031/Kconfig
@@ -1,9 +1,3 @@
-config SOC_CAMERA_IMX074
-        tristate "imx074 support (DEPRECATED)"
-        depends on SOC_CAMERA && I2C
-        help
-          This driver supports IMX074 cameras from Sony
-
 config SOC_CAMERA_MT9T031
         tristate "mt9t031 support (DEPRECATED)"
         depends on SOC_CAMERA && I2C
diff --git a/drivers/staging/vboxvideo/vbox_drv.c b/drivers/staging/vboxvideo/vbox_drv.c
index da92c493f157..69cc508af1bc 100644
--- a/drivers/staging/vboxvideo/vbox_drv.c
+++ b/drivers/staging/vboxvideo/vbox_drv.c
@@ -59,6 +59,11 @@ static int vbox_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
                 ret = PTR_ERR(dev);
                 goto err_drv_alloc;
         }
+
+        ret = pci_enable_device(pdev);
+        if (ret)
+                goto err_pci_enable;
+
         dev->pdev = pdev;
         pci_set_drvdata(pdev, dev);
 
@@ -75,6 +80,8 @@ static int vbox_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
  err_drv_dev_register:
         vbox_driver_unload(dev);
  err_vbox_driver_load:
+        pci_disable_device(pdev);
+ err_pci_enable:
         drm_dev_put(dev);
  err_drv_alloc:
         return ret;
diff --git a/drivers/staging/vboxvideo/vbox_mode.c b/drivers/staging/vboxvideo/vbox_mode.c
index a83eac8668d0..79836c8fb909 100644
--- a/drivers/staging/vboxvideo/vbox_mode.c
+++ b/drivers/staging/vboxvideo/vbox_mode.c
@@ -323,6 +323,11 @@ static int vbox_crtc_page_flip(struct drm_crtc *crtc,
         if (rc)
                 return rc;
 
+        mutex_lock(&vbox->hw_mutex);
+        vbox_set_view(crtc);
+        vbox_do_modeset(crtc, &crtc->mode);
+        mutex_unlock(&vbox->hw_mutex);
+
         spin_lock_irqsave(&drm->event_lock, flags);
 
         if (event)
diff --git a/drivers/staging/wilc1000/Makefile b/drivers/staging/wilc1000/Makefile
index f7b07c0b5ce2..ee7e26b886a5 100644
--- a/drivers/staging/wilc1000/Makefile
+++ b/drivers/staging/wilc1000/Makefile
@@ -1,4 +1,5 @@
 # SPDX-License-Identifier: GPL-2.0
+obj-$(CONFIG_WILC1000) += wilc1000.o
 
 ccflags-y += -DFIRMWARE_1002=\"atmel/wilc1002_firmware.bin\" \
                 -DFIRMWARE_1003=\"atmel/wilc1003_firmware.bin\"
@@ -11,9 +12,7 @@ wilc1000-objs := wilc_wfi_cfgoperations.o linux_wlan.o linux_mon.o \
                         wilc_wlan.o
 
 obj-$(CONFIG_WILC1000_SDIO) += wilc1000-sdio.o
-wilc1000-sdio-objs += $(wilc1000-objs)
 wilc1000-sdio-objs += wilc_sdio.o
 
 obj-$(CONFIG_WILC1000_SPI) += wilc1000-spi.o
-wilc1000-spi-objs += $(wilc1000-objs)
 wilc1000-spi-objs += wilc_spi.o
diff --git a/drivers/staging/wilc1000/linux_wlan.c b/drivers/staging/wilc1000/linux_wlan.c
index 01cf4bd2e192..3b8d237decbf 100644
--- a/drivers/staging/wilc1000/linux_wlan.c
+++ b/drivers/staging/wilc1000/linux_wlan.c
@@ -1038,8 +1038,8 @@ void wilc_netdev_cleanup(struct wilc *wilc)
         }
 
         kfree(wilc);
-        wilc_debugfs_remove();
 }
+EXPORT_SYMBOL_GPL(wilc_netdev_cleanup);
 
 static const struct net_device_ops wilc_netdev_ops = {
         .ndo_init = mac_init_fn,
@@ -1062,7 +1062,6 @@ int wilc_netdev_init(struct wilc **wilc, struct device *dev, int io_type,
         if (!wl)
                 return -ENOMEM;
 
-        wilc_debugfs_init();
         *wilc = wl;
         wl->io_type = io_type;
         wl->hif_func = ops;
@@ -1124,3 +1123,6 @@ int wilc_netdev_init(struct wilc **wilc, struct device *dev, int io_type,
 
         return 0;
 }
+EXPORT_SYMBOL_GPL(wilc_netdev_init);
+
+MODULE_LICENSE("GPL");
diff --git a/drivers/staging/wilc1000/wilc_debugfs.c b/drivers/staging/wilc1000/wilc_debugfs.c
index edc72876458d..8001df66b8c2 100644
--- a/drivers/staging/wilc1000/wilc_debugfs.c
+++ b/drivers/staging/wilc1000/wilc_debugfs.c
@@ -19,6 +19,7 @@ static struct dentry *wilc_dir;
 
 #define DBG_LEVEL_ALL   (DEBUG | INFO | WRN | ERR)
 static atomic_t WILC_DEBUG_LEVEL = ATOMIC_INIT(ERR);
+EXPORT_SYMBOL_GPL(WILC_DEBUG_LEVEL);
 
 static ssize_t wilc_debug_level_read(struct file *file, char __user *userbuf,
                                      size_t count, loff_t *ppos)
@@ -87,7 +88,7 @@ static struct wilc_debugfs_info_t debugfs_info[] = {
         },
 };
 
-int wilc_debugfs_init(void)
+static int __init wilc_debugfs_init(void)
 {
         int i;
         struct wilc_debugfs_info_t *info;
@@ -103,10 +104,12 @@ int wilc_debugfs_init(void)
         }
         return 0;
 }
+module_init(wilc_debugfs_init);
 
-void wilc_debugfs_remove(void)
+static void __exit wilc_debugfs_remove(void)
 {
         debugfs_remove_recursive(wilc_dir);
 }
+module_exit(wilc_debugfs_remove);
 
 #endif
diff --git a/drivers/staging/wilc1000/wilc_wlan.c b/drivers/staging/wilc1000/wilc_wlan.c
index 6787b6e9f124..8b184aa30d25 100644
--- a/drivers/staging/wilc1000/wilc_wlan.c
+++ b/drivers/staging/wilc1000/wilc_wlan.c
@@ -417,6 +417,7 @@ void chip_allow_sleep(struct wilc *wilc)
         wilc->hif_func->hif_write_reg(wilc, 0xf0, reg & ~BIT(0));
         wilc->hif_func->hif_write_reg(wilc, 0xfa, 0);
 }
+EXPORT_SYMBOL_GPL(chip_allow_sleep);
 
 void chip_wakeup(struct wilc *wilc)
 {
@@ -471,6 +472,7 @@ void chip_wakeup(struct wilc *wilc)
         }
         chip_ps_state = CHIP_WAKEDUP;
 }
+EXPORT_SYMBOL_GPL(chip_wakeup);
 
 void wilc_chip_sleep_manually(struct wilc *wilc)
 {
@@ -484,6 +486,7 @@ void wilc_chip_sleep_manually(struct wilc *wilc)
         chip_ps_state = CHIP_SLEEPING_MANUAL;
         release_bus(wilc, RELEASE_ONLY);
 }
+EXPORT_SYMBOL_GPL(wilc_chip_sleep_manually);
 
 void host_wakeup_notify(struct wilc *wilc)
 {
@@ -491,6 +494,7 @@ void host_wakeup_notify(struct wilc *wilc)
         wilc->hif_func->hif_write_reg(wilc, 0x10b0, 1);
         release_bus(wilc, RELEASE_ONLY);
 }
+EXPORT_SYMBOL_GPL(host_wakeup_notify);
 
 void host_sleep_notify(struct wilc *wilc)
 {
@@ -498,6 +502,7 @@ void host_sleep_notify(struct wilc *wilc)
         wilc->hif_func->hif_write_reg(wilc, 0x10ac, 1);
         release_bus(wilc, RELEASE_ONLY);
 }
+EXPORT_SYMBOL_GPL(host_sleep_notify);
 
 int wilc_wlan_handle_txq(struct net_device *dev, u32 *txq_count)
 {
@@ -871,6 +876,7 @@ void wilc_handle_isr(struct wilc *wilc)
 
         release_bus(wilc, RELEASE_ALLOW_SLEEP);
 }
+EXPORT_SYMBOL_GPL(wilc_handle_isr);
 
 int wilc_wlan_firmware_download(struct wilc *wilc, const u8 *buffer,
                                 u32 buffer_size)
diff --git a/drivers/staging/wilc1000/wilc_wlan_if.h b/drivers/staging/wilc1000/wilc_wlan_if.h
index 00d13b153f80..b81a73b9bd67 100644
--- a/drivers/staging/wilc1000/wilc_wlan_if.h
+++ b/drivers/staging/wilc1000/wilc_wlan_if.h
@@ -831,6 +831,4 @@ struct wilc;
 int wilc_wlan_init(struct net_device *dev);
 u32 wilc_get_chipid(struct wilc *wilc, bool update);
 
-int wilc_debugfs_init(void);
-void wilc_debugfs_remove(void);
 #endif
diff --git a/drivers/target/iscsi/cxgbit/cxgbit_ddp.c b/drivers/target/iscsi/cxgbit/cxgbit_ddp.c
index 768cce0ccb80..76a262674c8d 100644
--- a/drivers/target/iscsi/cxgbit/cxgbit_ddp.c
+++ b/drivers/target/iscsi/cxgbit/cxgbit_ddp.c
@@ -207,8 +207,8 @@ cxgbit_ddp_reserve(struct cxgbit_sock *csk, struct cxgbi_task_tag_info *ttinfo,
         ret = dma_map_sg(&ppm->pdev->dev, sgl, sgcnt, DMA_FROM_DEVICE);
         sgl->offset = sg_offset;
         if (!ret) {
-                pr_info("%s: 0x%x, xfer %u, sgl %u dma mapping err.\n",
-                        __func__, 0, xferlen, sgcnt);
+                pr_debug("%s: 0x%x, xfer %u, sgl %u dma mapping err.\n",
+                         __func__, 0, xferlen, sgcnt);
                 goto rel_ppods;
         }
 
@@ -250,8 +250,8 @@ cxgbit_get_r2t_ttt(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
 
         ret = cxgbit_ddp_reserve(csk, ttinfo, cmd->se_cmd.data_length);
         if (ret < 0) {
-                pr_info("csk 0x%p, cmd 0x%p, xfer len %u, sgcnt %u no ddp.\n",
-                        csk, cmd, cmd->se_cmd.data_length, ttinfo->nents);
+                pr_debug("csk 0x%p, cmd 0x%p, xfer len %u, sgcnt %u no ddp.\n",
+                         csk, cmd, cmd->se_cmd.data_length, ttinfo->nents);
 
                 ttinfo->sgl = NULL;
                 ttinfo->nents = 0;
diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
index 94bad43c41ff..cc756a123fd8 100644
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -1416,7 +1416,8 @@ static void iscsit_do_crypto_hash_buf(struct ahash_request *hash,
 
         sg_init_table(sg, ARRAY_SIZE(sg));
         sg_set_buf(sg, buf, payload_length);
-        sg_set_buf(sg + 1, pad_bytes, padding);
+        if (padding)
+                sg_set_buf(sg + 1, pad_bytes, padding);
 
         ahash_request_set_crypt(hash, sg, data_crc, payload_length + padding);
 
@@ -3910,10 +3911,14 @@ static bool iscsi_target_check_conn_state(struct iscsi_conn *conn)
 static void iscsit_get_rx_pdu(struct iscsi_conn *conn)
 {
         int ret;
-        u8 buffer[ISCSI_HDR_LEN], opcode;
+        u8 *buffer, opcode;
         u32 checksum = 0, digest = 0;
         struct kvec iov;
 
+        buffer = kcalloc(ISCSI_HDR_LEN, sizeof(*buffer), GFP_KERNEL);
+        if (!buffer)
+                return;
+
         while (!kthread_should_stop()) {
                 /*
                  * Ensure that both TX and RX per connection kthreads
@@ -3921,7 +3926,6 @@ static void iscsit_get_rx_pdu(struct iscsi_conn *conn)
                  */
                 iscsit_thread_check_cpumask(conn, current, 0);
 
-                memset(buffer, 0, ISCSI_HDR_LEN);
                 memset(&iov, 0, sizeof(struct kvec));
 
                 iov.iov_base    = buffer;
@@ -3930,7 +3934,7 @@ static void iscsit_get_rx_pdu(struct iscsi_conn *conn)
                 ret = rx_data(conn, &iov, 1, ISCSI_HDR_LEN);
                 if (ret != ISCSI_HDR_LEN) {
                         iscsit_rx_thread_wait_for_tcp(conn);
-                        return;
+                        break;
                 }
 
                 if (conn->conn_ops->HeaderDigest) {
@@ -3940,7 +3944,7 @@ static void iscsit_get_rx_pdu(struct iscsi_conn *conn)
                         ret = rx_data(conn, &iov, 1, ISCSI_CRC_LEN);
                         if (ret != ISCSI_CRC_LEN) {
                                 iscsit_rx_thread_wait_for_tcp(conn);
-                                return;
+                                break;
                         }
 
                         iscsit_do_crypto_hash_buf(conn->conn_rx_hash, buffer,
@@ -3964,7 +3968,7 @@ static void iscsit_get_rx_pdu(struct iscsi_conn *conn)
                 }
 
                 if (conn->conn_state == TARG_CONN_STATE_IN_LOGOUT)
-                        return;
+                        break;
 
                 opcode = buffer[0] & ISCSI_OPCODE_MASK;
 
@@ -3975,13 +3979,15 @@ static void iscsit_get_rx_pdu(struct iscsi_conn *conn)
                         " while in Discovery Session, rejecting.\n", opcode);
                         iscsit_add_reject(conn, ISCSI_REASON_PROTOCOL_ERROR,
                                           buffer);
-                        return;
+                        break;
                 }
 
                 ret = iscsi_target_rx_opcode(conn, buffer);
                 if (ret < 0)
-                        return;
+                        break;
         }
+
+        kfree(buffer);
 }
 
 int iscsi_target_rx_thread(void *arg)
@@ -4208,22 +4214,15 @@ int iscsit_close_connection(
                 crypto_free_ahash(tfm);
         }
 
-        free_cpumask_var(conn->conn_cpumask);
-
-        kfree(conn->conn_ops);
-        conn->conn_ops = NULL;
-
         if (conn->sock)
                 sock_release(conn->sock);
 
         if (conn->conn_transport->iscsit_free_conn)
                 conn->conn_transport->iscsit_free_conn(conn);
 
-        iscsit_put_transport(conn->conn_transport);
-
         pr_debug("Moving to TARG_CONN_STATE_FREE.\n");
         conn->conn_state = TARG_CONN_STATE_FREE;
-        kfree(conn);
+        iscsit_free_conn(conn);
 
         spin_lock_bh(&sess->conn_lock);
         atomic_dec(&sess->nconn);
diff --git a/drivers/target/iscsi/iscsi_target_auth.c b/drivers/target/iscsi/iscsi_target_auth.c
index 9518ffd8b8ba..4e680d753941 100644
--- a/drivers/target/iscsi/iscsi_target_auth.c
+++ b/drivers/target/iscsi/iscsi_target_auth.c
@@ -26,27 +26,6 @@
 #include "iscsi_target_nego.h"
 #include "iscsi_target_auth.h"
 
-static int chap_string_to_hex(unsigned char *dst, unsigned char *src, int len)
-{
-        int j = DIV_ROUND_UP(len, 2), rc;
-
-        rc = hex2bin(dst, src, j);
-        if (rc < 0)
-                pr_debug("CHAP string contains non hex digit symbols\n");
-
-        dst[j] = '\0';
-        return j;
-}
-
-static void chap_binaryhex_to_asciihex(char *dst, char *src, int src_len)
-{
-        int i;
-
-        for (i = 0; i < src_len; i++) {
-                sprintf(&dst[i*2], "%02x", (int) src[i] & 0xff);
-        }
-}
-
 static int chap_gen_challenge(
         struct iscsi_conn *conn,
         int caller,
@@ -62,7 +41,7 @@ static int chap_gen_challenge(
         ret = get_random_bytes_wait(chap->challenge, CHAP_CHALLENGE_LENGTH);
         if (unlikely(ret))
                 return ret;
-        chap_binaryhex_to_asciihex(challenge_asciihex, chap->challenge,
+        bin2hex(challenge_asciihex, chap->challenge,
                                 CHAP_CHALLENGE_LENGTH);
         /*
          * Set CHAP_C, and copy the generated challenge into c_str.
@@ -248,9 +227,16 @@ static int chap_server_compute_md5(
                 pr_err("Could not find CHAP_R.\n");
                 goto out;
         }
+        if (strlen(chap_r) != MD5_SIGNATURE_SIZE * 2) {
+                pr_err("Malformed CHAP_R\n");
+                goto out;
+        }
+        if (hex2bin(client_digest, chap_r, MD5_SIGNATURE_SIZE) < 0) {
+                pr_err("Malformed CHAP_R\n");
+                goto out;
+        }
 
         pr_debug("[server] Got CHAP_R=%s\n", chap_r);
-        chap_string_to_hex(client_digest, chap_r, strlen(chap_r));
 
         tfm = crypto_alloc_shash("md5", 0, 0);
         if (IS_ERR(tfm)) {
@@ -294,7 +280,7 @@ static int chap_server_compute_md5(
                 goto out;
         }
 
-        chap_binaryhex_to_asciihex(response, server_digest, MD5_SIGNATURE_SIZE);
+        bin2hex(response, server_digest, MD5_SIGNATURE_SIZE);
         pr_debug("[server] MD5 Server Digest: %s\n", response);
 
         if (memcmp(server_digest, client_digest, MD5_SIGNATURE_SIZE) != 0) {
@@ -349,9 +335,7 @@ static int chap_server_compute_md5(
                 pr_err("Could not find CHAP_C.\n");
                 goto out;
         }
-        pr_debug("[server] Got CHAP_C=%s\n", challenge);
-        challenge_len = chap_string_to_hex(challenge_binhex, challenge,
-                                strlen(challenge));
+        challenge_len = DIV_ROUND_UP(strlen(challenge), 2);
         if (!challenge_len) {
                 pr_err("Unable to convert incoming challenge\n");
                 goto out;
@@ -360,6 +344,11 @@ static int chap_server_compute_md5(
                 pr_err("CHAP_C exceeds maximum binary size of 1024 bytes\n");
                 goto out;
         }
+        if (hex2bin(challenge_binhex, challenge, challenge_len) < 0) {
+                pr_err("Malformed CHAP_C\n");
+                goto out;
+        }
+        pr_debug("[server] Got CHAP_C=%s\n", challenge);
         /*
          * During mutual authentication, the CHAP_C generated by the
          * initiator must not match the original CHAP_C generated by
@@ -413,7 +402,7 @@ static int chap_server_compute_md5(
         /*
          * Convert response from binary hex to ascii hext.
          */
-        chap_binaryhex_to_asciihex(response, digest, MD5_SIGNATURE_SIZE);
+        bin2hex(response, digest, MD5_SIGNATURE_SIZE);
         *nr_out_len += sprintf(nr_out_ptr + *nr_out_len, "CHAP_R=0x%s",
                         response);
         *nr_out_len += 1;
diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c
index 9e74f8bc2963..bb90c80ff388 100644
--- a/drivers/target/iscsi/iscsi_target_login.c
+++ b/drivers/target/iscsi/iscsi_target_login.c
@@ -67,45 +67,10 @@ static struct iscsi_login *iscsi_login_init_conn(struct iscsi_conn *conn)
                 goto out_req_buf;
         }
 
-        conn->conn_ops = kzalloc(sizeof(struct iscsi_conn_ops), GFP_KERNEL);
-        if (!conn->conn_ops) {
-                pr_err("Unable to allocate memory for"
-                        " struct iscsi_conn_ops.\n");
-                goto out_rsp_buf;
-        }
-
-        init_waitqueue_head(&conn->queues_wq);
-        INIT_LIST_HEAD(&conn->conn_list);
-        INIT_LIST_HEAD(&conn->conn_cmd_list);
-        INIT_LIST_HEAD(&conn->immed_queue_list);
-        INIT_LIST_HEAD(&conn->response_queue_list);
-        init_completion(&conn->conn_post_wait_comp);
-        init_completion(&conn->conn_wait_comp);
-        init_completion(&conn->conn_wait_rcfr_comp);
-        init_completion(&conn->conn_waiting_on_uc_comp);
-        init_completion(&conn->conn_logout_comp);
-        init_completion(&conn->rx_half_close_comp);
-        init_completion(&conn->tx_half_close_comp);
-        init_completion(&conn->rx_login_comp);
-        spin_lock_init(&conn->cmd_lock);
-        spin_lock_init(&conn->conn_usage_lock);
-        spin_lock_init(&conn->immed_queue_lock);
-        spin_lock_init(&conn->nopin_timer_lock);
-        spin_lock_init(&conn->response_queue_lock);
-        spin_lock_init(&conn->state_lock);
-
-        if (!zalloc_cpumask_var(&conn->conn_cpumask, GFP_KERNEL)) {
-                pr_err("Unable to allocate conn->conn_cpumask\n");
-                goto out_conn_ops;
-        }
         conn->conn_login = login;
 
         return login;
 
-out_conn_ops:
-        kfree(conn->conn_ops);
-out_rsp_buf:
-        kfree(login->rsp_buf);
 out_req_buf:
         kfree(login->req_buf);
 out_login:
@@ -310,11 +275,9 @@ static int iscsi_login_zero_tsih_s1(
                 return -ENOMEM;
         }
 
-        ret = iscsi_login_set_conn_values(sess, conn, pdu->cid);
-        if (unlikely(ret)) {
-                kfree(sess);
-                return ret;
-        }
+        if (iscsi_login_set_conn_values(sess, conn, pdu->cid))
+                goto free_sess;
+
         sess->init_task_tag     = pdu->itt;
         memcpy(&sess->isid, pdu->isid, 6);
         sess->exp_cmd_sn        = be32_to_cpu(pdu->cmdsn);
@@ -1149,6 +1112,75 @@ iscsit_conn_set_transport(struct iscsi_conn *conn, struct iscsit_transport *t)
         return 0;
 }
 
+static struct iscsi_conn *iscsit_alloc_conn(struct iscsi_np *np)
+{
+        struct iscsi_conn *conn;
+
+        conn = kzalloc(sizeof(struct iscsi_conn), GFP_KERNEL);
+        if (!conn) {
+                pr_err("Could not allocate memory for new connection\n");
+                return NULL;
+        }
+        pr_debug("Moving to TARG_CONN_STATE_FREE.\n");
+        conn->conn_state = TARG_CONN_STATE_FREE;
+
+        init_waitqueue_head(&conn->queues_wq);
+        INIT_LIST_HEAD(&conn->conn_list);
+        INIT_LIST_HEAD(&conn->conn_cmd_list);
+        INIT_LIST_HEAD(&conn->immed_queue_list);
+        INIT_LIST_HEAD(&conn->response_queue_list);
+        init_completion(&conn->conn_post_wait_comp);
+        init_completion(&conn->conn_wait_comp);
+        init_completion(&conn->conn_wait_rcfr_comp);
+        init_completion(&conn->conn_waiting_on_uc_comp);
+        init_completion(&conn->conn_logout_comp);
+        init_completion(&conn->rx_half_close_comp);
+        init_completion(&conn->tx_half_close_comp);
+        init_completion(&conn->rx_login_comp);
+        spin_lock_init(&conn->cmd_lock);
+        spin_lock_init(&conn->conn_usage_lock);
+        spin_lock_init(&conn->immed_queue_lock);
+        spin_lock_init(&conn->nopin_timer_lock);
+        spin_lock_init(&conn->response_queue_lock);
+        spin_lock_init(&conn->state_lock);
+
+        timer_setup(&conn->nopin_response_timer,
+                    iscsit_handle_nopin_response_timeout, 0);
+        timer_setup(&conn->nopin_timer, iscsit_handle_nopin_timeout, 0);
+
+        if (iscsit_conn_set_transport(conn, np->np_transport) < 0)
+                goto free_conn;
+
+        conn->conn_ops = kzalloc(sizeof(struct iscsi_conn_ops), GFP_KERNEL);
+        if (!conn->conn_ops) {
+                pr_err("Unable to allocate memory for struct iscsi_conn_ops.\n");
+                goto put_transport;
+        }
+
+        if (!zalloc_cpumask_var(&conn->conn_cpumask, GFP_KERNEL)) {
+                pr_err("Unable to allocate conn->conn_cpumask\n");
+                goto free_mask;
+        }
+
+        return conn;
+
+free_mask:
+        free_cpumask_var(conn->conn_cpumask);
+put_transport:
+        iscsit_put_transport(conn->conn_transport);
+free_conn:
+        kfree(conn);
+        return NULL;
+}
+
+void iscsit_free_conn(struct iscsi_conn *conn)
+{
+        free_cpumask_var(conn->conn_cpumask);
+        kfree(conn->conn_ops);
+        iscsit_put_transport(conn->conn_transport);
+        kfree(conn);
+}
+
 void iscsi_target_login_sess_out(struct iscsi_conn *conn,
                 struct iscsi_np *np, bool zero_tsih, bool new_sess)
 {
@@ -1198,10 +1230,6 @@ old_sess_out:
                 crypto_free_ahash(tfm);
         }
 
-        free_cpumask_var(conn->conn_cpumask);
-
-        kfree(conn->conn_ops);
-
         if (conn->param_list) {
                 iscsi_release_param_list(conn->param_list);
                 conn->param_list = NULL;
@@ -1219,8 +1247,7 @@ old_sess_out:
         if (conn->conn_transport->iscsit_free_conn)
                 conn->conn_transport->iscsit_free_conn(conn);
 
-        iscsit_put_transport(conn->conn_transport);
-        kfree(conn);
+        iscsit_free_conn(conn);
 }
 
 static int __iscsi_target_login_thread(struct iscsi_np *np)
@@ -1250,31 +1277,16 @@ static int __iscsi_target_login_thread(struct iscsi_np *np)
         }
         spin_unlock_bh(&np->np_thread_lock);
 
-        conn = kzalloc(sizeof(struct iscsi_conn), GFP_KERNEL);
+        conn = iscsit_alloc_conn(np);
         if (!conn) {
-                pr_err("Could not allocate memory for"
-                        " new connection\n");
                 /* Get another socket */
                 return 1;
         }
-        pr_debug("Moving to TARG_CONN_STATE_FREE.\n");
-        conn->conn_state = TARG_CONN_STATE_FREE;
-
-        timer_setup(&conn->nopin_response_timer,
-                    iscsit_handle_nopin_response_timeout, 0);
-        timer_setup(&conn->nopin_timer, iscsit_handle_nopin_timeout, 0);
-
-        if (iscsit_conn_set_transport(conn, np->np_transport) < 0) {
-                kfree(conn);
-                return 1;
-        }
 
         rc = np->np_transport->iscsit_accept_np(np, conn);
         if (rc == -ENOSYS) {
                 complete(&np->np_restart_comp);
-                iscsit_put_transport(conn->conn_transport);
-                kfree(conn);
-                conn = NULL;
+                iscsit_free_conn(conn);
                 goto exit;
         } else if (rc < 0) {
                 spin_lock_bh(&np->np_thread_lock);
@@ -1282,17 +1294,13 @@ static int __iscsi_target_login_thread(struct iscsi_np *np)
                         np->np_thread_state = ISCSI_NP_THREAD_ACTIVE;
                         spin_unlock_bh(&np->np_thread_lock);
                         complete(&np->np_restart_comp);
-                        iscsit_put_transport(conn->conn_transport);
-                        kfree(conn);
-                        conn = NULL;
+                        iscsit_free_conn(conn);
                         /* Get another socket */
                         return 1;
                 }
                 spin_unlock_bh(&np->np_thread_lock);
-                iscsit_put_transport(conn->conn_transport);
-                kfree(conn);
-                conn = NULL;
-                goto out;
+                iscsit_free_conn(conn);
+                return 1;
         }
         /*
          * Perform the remaining iSCSI connection initialization items..
@@ -1442,7 +1450,6 @@ old_sess_out:
                 tpg_np = NULL;
         }
 
-out:
         return 1;
 
 exit:
diff --git a/drivers/target/iscsi/iscsi_target_login.h b/drivers/target/iscsi/iscsi_target_login.h
index 74ac3abc44a0..3b8e3639ff5d 100644
--- a/drivers/target/iscsi/iscsi_target_login.h
+++ b/drivers/target/iscsi/iscsi_target_login.h
@@ -19,7 +19,7 @@ extern int iscsi_target_setup_login_socket(struct iscsi_np *,
 extern int iscsit_accept_np(struct iscsi_np *, struct iscsi_conn *);
 extern int iscsit_get_login_rx(struct iscsi_conn *, struct iscsi_login *);
 extern int iscsit_put_login_tx(struct iscsi_conn *, struct iscsi_login *, u32);
-extern void iscsit_free_conn(struct iscsi_np *, struct iscsi_conn *);
+extern void iscsit_free_conn(struct iscsi_conn *);
 extern int iscsit_start_kthreads(struct iscsi_conn *);
 extern void iscsi_post_login_handler(struct iscsi_np *, struct iscsi_conn *, u8);
 extern void iscsi_target_login_sess_out(struct iscsi_conn *, struct iscsi_np *,
diff --git a/drivers/thermal/of-thermal.c b/drivers/thermal/of-thermal.c
index 977a8307fbb1..4f2816559205 100644
--- a/drivers/thermal/of-thermal.c
+++ b/drivers/thermal/of-thermal.c
@@ -260,10 +260,13 @@ static int of_thermal_set_mode(struct thermal_zone_device *tz,
 
         mutex_lock(&tz->lock);
 
-        if (mode == THERMAL_DEVICE_ENABLED)
+        if (mode == THERMAL_DEVICE_ENABLED) {
                 tz->polling_delay = data->polling_delay;
-        else
+                tz->passive_delay = data->passive_delay;
+        } else {
                 tz->polling_delay = 0;
+                tz->passive_delay = 0;
+        }
 
         mutex_unlock(&tz->lock);
 
diff --git a/drivers/thermal/qoriq_thermal.c b/drivers/thermal/qoriq_thermal.c
index c866cc165960..450ed66edf58 100644
--- a/drivers/thermal/qoriq_thermal.c
+++ b/drivers/thermal/qoriq_thermal.c
@@ -1,16 +1,6 @@
-/*
- * Copyright 2016 Freescale Semiconductor, Inc.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- */
+// SPDX-License-Identifier: GPL-2.0
+//
+// Copyright 2016 Freescale Semiconductor, Inc.
 
 #include <linux/module.h>
 #include <linux/platform_device.h>
@@ -197,7 +187,7 @@ static int qoriq_tmu_probe(struct platform_device *pdev)
         int ret;
         struct qoriq_tmu_data *data;
         struct device_node *np = pdev->dev.of_node;
-        u32 site = 0;
+        u32 site;
 
         if (!np) {
                 dev_err(&pdev->dev, "Device OF-Node is NULL");
@@ -233,8 +223,9 @@ static int qoriq_tmu_probe(struct platform_device *pdev)
         if (ret < 0)
                 goto err_tmu;
 
-        data->tz = thermal_zone_of_sensor_register(&pdev->dev, data->sensor_id,
-                                data, &tmu_tz_ops);
+        data->tz = devm_thermal_zone_of_sensor_register(&pdev->dev,
+                                                        data->sensor_id,
+                                                        data, &tmu_tz_ops);
         if (IS_ERR(data->tz)) {
                 ret = PTR_ERR(data->tz);
                 dev_err(&pdev->dev,
@@ -243,7 +234,7 @@ static int qoriq_tmu_probe(struct platform_device *pdev)
         }
 
         /* Enable monitoring */
-        site |= 0x1 << (15 - data->sensor_id);
+        site = 0x1 << (15 - data->sensor_id);
         tmu_write(data, site | TMR_ME | TMR_ALPF, &data->regs->tmr);
 
         return 0;
@@ -261,8 +252,6 @@ static int qoriq_tmu_remove(struct platform_device *pdev)
 {
         struct qoriq_tmu_data *data = platform_get_drvdata(pdev);
 
-        thermal_zone_of_sensor_unregister(&pdev->dev, data->tz);
-
         /* Disable monitoring */
         tmu_write(data, TMR_DISABLE, &data->regs->tmr);
 
diff --git a/drivers/thermal/rcar_gen3_thermal.c b/drivers/thermal/rcar_gen3_thermal.c
index 766521eb7071..7aed5337bdd3 100644
--- a/drivers/thermal/rcar_gen3_thermal.c
+++ b/drivers/thermal/rcar_gen3_thermal.c
@@ -1,19 +1,10 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
  *  R-Car Gen3 THS thermal sensor driver
  *  Based on rcar_thermal.c and work from Hien Dang and Khiem Nguyen.
  *
  * Copyright (C) 2016 Renesas Electronics Corporation.
  * Copyright (C) 2016 Sang Engineering
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; version 2 of the License.
- *
- *  This program is distributed in the hope that it will be useful, but
- *  WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- *  General Public License for more details.
- *
  */
 #include <linux/delay.h>
 #include <linux/err.h>
diff --git a/drivers/thermal/rcar_thermal.c b/drivers/thermal/rcar_thermal.c
index e77e63070e99..78f932822d38 100644
--- a/drivers/thermal/rcar_thermal.c
+++ b/drivers/thermal/rcar_thermal.c
@@ -1,21 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
  *  R-Car THS/TSC thermal sensor driver
  *
  * Copyright (C) 2012 Renesas Solutions Corp.
  * Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; version 2 of the License.
- *
- *  This program is distributed in the hope that it will be useful, but
- *  WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- *  General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  59 Temple Place, Suite 330, Boston, MA 02111-1307 USA.
  */
 #include <linux/delay.h>
 #include <linux/err.h>
@@ -660,6 +648,6 @@ static struct platform_driver rcar_thermal_driver = {
 };
 module_platform_driver(rcar_thermal_driver);
 
-MODULE_LICENSE("GPL");
+MODULE_LICENSE("GPL v2");
 MODULE_DESCRIPTION("R-Car THS/TSC thermal sensor driver");
 MODULE_AUTHOR("Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>");
diff --git a/drivers/tty/hvc/hvc_console.c b/drivers/tty/hvc/hvc_console.c
index 5414c4a87bea..27284a2dcd2b 100644
--- a/drivers/tty/hvc/hvc_console.c
+++ b/drivers/tty/hvc/hvc_console.c
@@ -522,6 +522,8 @@ static int hvc_write(struct tty_struct *tty, const unsigned char *buf, int count
                 return -EIO;
 
         while (count > 0) {
+                int ret = 0;
+
                 spin_lock_irqsave(&hp->lock, flags);
 
                 rsize = hp->outbuf_size - hp->n_outbuf;
@@ -537,10 +539,13 @@ static int hvc_write(struct tty_struct *tty, const unsigned char *buf, int count
                 }
 
                 if (hp->n_outbuf > 0)
-                        hvc_push(hp);
+                        ret = hvc_push(hp);
 
                 spin_unlock_irqrestore(&hp->lock, flags);
 
+                if (!ret)
+                        break;
+
                 if (count) {
                         if (hp->n_outbuf > 0)
                                 hvc_flush(hp);
@@ -623,6 +628,15 @@ static int hvc_chars_in_buffer(struct tty_struct *tty)
 #define MAX_TIMEOUT             (2000)
 static u32 timeout = MIN_TIMEOUT;
 
+/*
+ * Maximum number of bytes to get from the console driver if hvc_poll is
+ * called from driver (and can't sleep). Any more than this and we break
+ * and start polling with khvcd. This value was derived from from an OpenBMC
+ * console with the OPAL driver that results in about 0.25ms interrupts off
+ * latency.
+ */
+#define HVC_ATOMIC_READ_MAX     128
+
 #define HVC_POLL_READ   0x00000001
 #define HVC_POLL_WRITE  0x00000002
 
@@ -669,8 +683,8 @@ static int __hvc_poll(struct hvc_struct *hp, bool may_sleep)
         if (!hp->irq_requested)
                 poll_mask |= HVC_POLL_READ;
 
+ read_again:
         /* Read data if any */
-
         count = tty_buffer_request_room(&hp->port, N_INBUF);
 
         /* If flip is full, just reschedule a later read */
@@ -717,9 +731,23 @@ static int __hvc_poll(struct hvc_struct *hp, bool may_sleep)
 #endif /* CONFIG_MAGIC_SYSRQ */
                 tty_insert_flip_char(&hp->port, buf[i], 0);
         }
-        if (n == count)
-                poll_mask |= HVC_POLL_READ;
-        read_total = n;
+        read_total += n;
+
+        if (may_sleep) {
+                /* Keep going until the flip is full */
+                spin_unlock_irqrestore(&hp->lock, flags);
+                cond_resched();
+                spin_lock_irqsave(&hp->lock, flags);
+                goto read_again;
+        } else if (read_total < HVC_ATOMIC_READ_MAX) {
+                /* Break and defer if it's a large read in atomic */
+                goto read_again;
+        }
+
+        /*
+         * Latency break, schedule another poll immediately.
+         */
+        poll_mask |= HVC_POLL_READ;
 
  out:
         /* Wakeup write queue if necessary */
diff --git a/drivers/tty/serial/cpm_uart/cpm_uart_core.c b/drivers/tty/serial/cpm_uart/cpm_uart_core.c
index 24a5f05e769b..e5389591bb4f 100644
--- a/drivers/tty/serial/cpm_uart/cpm_uart_core.c
+++ b/drivers/tty/serial/cpm_uart/cpm_uart_core.c
@@ -1054,8 +1054,8 @@ static int poll_wait_key(char *obuf, struct uart_cpm_port *pinfo)
         /* Get the address of the host memory buffer.
          */
         bdp = pinfo->rx_cur;
-        while (bdp->cbd_sc & BD_SC_EMPTY)
-                ;
+        if (bdp->cbd_sc & BD_SC_EMPTY)
+                return NO_POLL_CHAR;
 
         /* If the buffer address is in the CPM DPRAM, don't
          * convert it.
@@ -1090,7 +1090,11 @@ static int cpm_get_poll_char(struct uart_port *port)
                 poll_chars = 0;
         }
         if (poll_chars <= 0) {
-                poll_chars = poll_wait_key(poll_buf, pinfo);
+                int ret = poll_wait_key(poll_buf, pinfo);
+
+                if (ret == NO_POLL_CHAR)
+                        return ret;
+                poll_chars = ret;
                 pollp = poll_buf;
         }
         poll_chars--;
diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
index 51e47a63d61a..3f8d1274fc85 100644
--- a/drivers/tty/serial/fsl_lpuart.c
+++ b/drivers/tty/serial/fsl_lpuart.c
@@ -979,7 +979,8 @@ static inline int lpuart_start_rx_dma(struct lpuart_port *sport)
         struct circ_buf *ring = &sport->rx_ring;
         int ret, nent;
         int bits, baud;
-        struct tty_struct *tty = tty_port_tty_get(&sport->port.state->port);
+        struct tty_port *port = &sport->port.state->port;
+        struct tty_struct *tty = port->tty;
         struct ktermios *termios = &tty->termios;
 
         baud = tty_get_baud_rate(tty);
diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c
index 239c0fa2e981..0f67197a3783 100644
--- a/drivers/tty/serial/imx.c
+++ b/drivers/tty/serial/imx.c
@@ -2351,6 +2351,14 @@ static int imx_uart_probe(struct platform_device *pdev)
                                 ret);
                         return ret;
                 }
+
+                ret = devm_request_irq(&pdev->dev, rtsirq, imx_uart_rtsint, 0,
+                                       dev_name(&pdev->dev), sport);
+                if (ret) {
+                        dev_err(&pdev->dev, "failed to request rts irq: %d\n",
+                                ret);
+                        return ret;
+                }
         } else {
                 ret = devm_request_irq(&pdev->dev, rxirq, imx_uart_int, 0,
                                        dev_name(&pdev->dev), sport);
diff --git a/drivers/tty/serial/mvebu-uart.c b/drivers/tty/serial/mvebu-uart.c
index d04b5eeea3c6..170e446a2f62 100644
--- a/drivers/tty/serial/mvebu-uart.c
+++ b/drivers/tty/serial/mvebu-uart.c
@@ -511,6 +511,7 @@ static void mvebu_uart_set_termios(struct uart_port *port,
                 termios->c_iflag |= old->c_iflag & ~(INPCK | IGNPAR);
                 termios->c_cflag &= CREAD | CBAUD;
                 termios->c_cflag |= old->c_cflag & ~(CREAD | CBAUD);
+                termios->c_cflag |= CS8;
         }
 
         spin_unlock_irqrestore(&port->lock, flags);
diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
index 32bc3e3fe4d3..5e5da9acaf0a 100644
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -1255,6 +1255,7 @@ static void tty_driver_remove_tty(struct tty_driver *driver, struct tty_struct *
 static int tty_reopen(struct tty_struct *tty)
 {
         struct tty_driver *driver = tty->driver;
+        int retval;
 
         if (driver->type == TTY_DRIVER_TYPE_PTY &&
             driver->subtype == PTY_TYPE_MASTER)
@@ -1268,10 +1269,14 @@ static int tty_reopen(struct tty_struct *tty)
 
         tty->count++;
 
-        if (!tty->ldisc)
-                return tty_ldisc_reinit(tty, tty->termios.c_line);
+        if (tty->ldisc)
+                return 0;
 
-        return 0;
+        retval = tty_ldisc_reinit(tty, tty->termios.c_line);
+        if (retval)
+                tty->count--;
+
+        return retval;
 }
 
 /**
diff --git a/drivers/tty/vt/vt_ioctl.c b/drivers/tty/vt/vt_ioctl.c
index a78ad10a119b..73cdc0d633dd 100644
--- a/drivers/tty/vt/vt_ioctl.c
+++ b/drivers/tty/vt/vt_ioctl.c
@@ -32,6 +32,8 @@
 #include <asm/io.h>
 #include <linux/uaccess.h>
 
+#include <linux/nospec.h>
+
 #include <linux/kbd_kern.h>
 #include <linux/vt_kern.h>
 #include <linux/kbd_diacr.h>
@@ -700,6 +702,8 @@ int vt_ioctl(struct tty_struct *tty,
                 if (vsa.console == 0 || vsa.console > MAX_NR_CONSOLES)
                         ret = -ENXIO;
                 else {
+                        vsa.console = array_index_nospec(vsa.console,
+                                                         MAX_NR_CONSOLES + 1);
                         vsa.console--;
                         console_lock();
                         ret = vc_allocate(vsa.console);
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 27346d69f393..f9b40a9dc4d3 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -780,20 +780,9 @@ static int acm_tty_write(struct tty_struct *tty,
         }
 
         if (acm->susp_count) {
-                if (acm->putbuffer) {
-                        /* now to preserve order */
-                        usb_anchor_urb(acm->putbuffer->urb, &acm->delayed);
-                        acm->putbuffer = NULL;
-                }
                 usb_anchor_urb(wb->urb, &acm->delayed);
                 spin_unlock_irqrestore(&acm->write_lock, flags);
                 return count;
-        } else {
-                if (acm->putbuffer) {
-                        /* at this point there is no good way to handle errors */
-                        acm_start_wb(acm, acm->putbuffer);
-                        acm->putbuffer = NULL;
-                }
         }
 
         stat = acm_start_wb(acm, wb);
@@ -804,66 +793,6 @@ static int acm_tty_write(struct tty_struct *tty,
         return count;
 }
 
-static void acm_tty_flush_chars(struct tty_struct *tty)
-{
-        struct acm *acm = tty->driver_data;
-        struct acm_wb *cur;
-        int err;
-        unsigned long flags;
-
-        spin_lock_irqsave(&acm->write_lock, flags);
-
-        cur = acm->putbuffer;
-        if (!cur) /* nothing to do */
-                goto out;
-
-        acm->putbuffer = NULL;
-        err = usb_autopm_get_interface_async(acm->control);
-        if (err < 0) {
-                cur->use = 0;
-                acm->putbuffer = cur;
-                goto out;
-        }
-
-        if (acm->susp_count)
-                usb_anchor_urb(cur->urb, &acm->delayed);
-        else
-                acm_start_wb(acm, cur);
-out:
-        spin_unlock_irqrestore(&acm->write_lock, flags);
-        return;
-}
-
-static int acm_tty_put_char(struct tty_struct *tty, unsigned char ch)
-{
-        struct acm *acm = tty->driver_data;
-        struct acm_wb *cur;
-        int wbn;
-        unsigned long flags;
-
-overflow:
-        cur = acm->putbuffer;
-        if (!cur) {
-                spin_lock_irqsave(&acm->write_lock, flags);
-                wbn = acm_wb_alloc(acm);
-                if (wbn >= 0) {
-                        cur = &acm->wb[wbn];
-                        acm->putbuffer = cur;
-                }
-                spin_unlock_irqrestore(&acm->write_lock, flags);
-                if (!cur)
-                        return 0;
-        }
-
-        if (cur->len == acm->writesize) {
-                acm_tty_flush_chars(tty);
-                goto overflow;
-        }
-
-        cur->buf[cur->len++] = ch;
-        return 1;
-}
-
 static int acm_tty_write_room(struct tty_struct *tty)
 {
         struct acm *acm = tty->driver_data;
@@ -1987,8 +1916,6 @@ static const struct tty_operations acm_ops = {
         .cleanup =              acm_tty_cleanup,
         .hangup =               acm_tty_hangup,
         .write =                acm_tty_write,
-        .put_char =             acm_tty_put_char,
-        .flush_chars =          acm_tty_flush_chars,
         .write_room =           acm_tty_write_room,
         .ioctl =                acm_tty_ioctl,
         .throttle =             acm_tty_throttle,
diff --git a/drivers/usb/class/cdc-acm.h b/drivers/usb/class/cdc-acm.h
index eacc116e83da..ca06b20d7af9 100644
--- a/drivers/usb/class/cdc-acm.h
+++ b/drivers/usb/class/cdc-acm.h
@@ -96,7 +96,6 @@ struct acm {
         unsigned long read_urbs_free;
         struct urb *read_urbs[ACM_NR];
         struct acm_rb read_buffers[ACM_NR];
-        struct acm_wb *putbuffer;                       /* for acm_tty_put_char() */
         int rx_buflimit;
         spinlock_t read_lock;
         u8 *notification_buffer;                        /* to reassemble fragmented notifications */
diff --git a/drivers/usb/common/common.c b/drivers/usb/common/common.c
index 50a2362ed3ea..48277bbc15e4 100644
--- a/drivers/usb/common/common.c
+++ b/drivers/usb/common/common.c
@@ -246,6 +246,31 @@ int of_usb_update_otg_caps(struct device_node *np,
 }
 EXPORT_SYMBOL_GPL(of_usb_update_otg_caps);
 
+/**
+ * usb_of_get_companion_dev - Find the companion device
+ * @dev: the device pointer to find a companion
+ *
+ * Find the companion device from platform bus.
+ *
+ * Takes a reference to the returned struct device which needs to be dropped
+ * after use.
+ *
+ * Return: On success, a pointer to the companion device, %NULL on failure.
+ */
+struct device *usb_of_get_companion_dev(struct device *dev)
+{
+        struct device_node *node;
+        struct platform_device *pdev = NULL;
+
+        node = of_parse_phandle(dev->of_node, "companion", 0);
+        if (node)
+                pdev = of_find_device_by_node(node);
+
+        of_node_put(node);
+
+        return pdev ? &pdev->dev : NULL;
+}
+EXPORT_SYMBOL_GPL(usb_of_get_companion_dev);
 #endif
 
 MODULE_LICENSE("GPL");
diff --git a/drivers/usb/common/roles.c b/drivers/usb/common/roles.c
index 15cc76e22123..99116af07f1d 100644
--- a/drivers/usb/common/roles.c
+++ b/drivers/usb/common/roles.c
@@ -109,8 +109,15 @@ static void *usb_role_switch_match(struct device_connection *con, int ep,
  */
 struct usb_role_switch *usb_role_switch_get(struct device *dev)
 {
-        return device_connection_find_match(dev, "usb-role-switch", NULL,
-                                            usb_role_switch_match);
+        struct usb_role_switch *sw;
+
+        sw = device_connection_find_match(dev, "usb-role-switch", NULL,
+                                          usb_role_switch_match);
+
+        if (!IS_ERR_OR_NULL(sw))
+                WARN_ON(!try_module_get(sw->dev.parent->driver->owner));
+
+        return sw;
 }
 EXPORT_SYMBOL_GPL(usb_role_switch_get);
 
@@ -122,8 +129,10 @@ EXPORT_SYMBOL_GPL(usb_role_switch_get);
  */
 void usb_role_switch_put(struct usb_role_switch *sw)
 {
-        if (!IS_ERR_OR_NULL(sw))
+        if (!IS_ERR_OR_NULL(sw)) {
                 put_device(&sw->dev);
+                module_put(sw->dev.parent->driver->owner);
+        }
 }
 EXPORT_SYMBOL_GPL(usb_role_switch_put);
 
diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index 6ce77b33da61..244417d0dfd1 100644
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -1434,10 +1434,13 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb
         struct async *as = NULL;
         struct usb_ctrlrequest *dr = NULL;
         unsigned int u, totlen, isofrmlen;
-        int i, ret, is_in, num_sgs = 0, ifnum = -1;
+        int i, ret, num_sgs = 0, ifnum = -1;
         int number_of_packets = 0;
         unsigned int stream_id = 0;
         void *buf;
+        bool is_in;
+        bool allow_short = false;
+        bool allow_zero = false;
         unsigned long mask =    USBDEVFS_URB_SHORT_NOT_OK |
                                 USBDEVFS_URB_BULK_CONTINUATION |
                                 USBDEVFS_URB_NO_FSBR |
@@ -1471,6 +1474,8 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb
         u = 0;
         switch (uurb->type) {
         case USBDEVFS_URB_TYPE_CONTROL:
+                if (is_in)
+                        allow_short = true;
                 if (!usb_endpoint_xfer_control(&ep->desc))
                         return -EINVAL;
                 /* min 8 byte setup packet */
@@ -1511,6 +1516,10 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb
                 break;
 
         case USBDEVFS_URB_TYPE_BULK:
+                if (!is_in)
+                        allow_zero = true;
+                else
+                        allow_short = true;
                 switch (usb_endpoint_type(&ep->desc)) {
                 case USB_ENDPOINT_XFER_CONTROL:
                 case USB_ENDPOINT_XFER_ISOC:
@@ -1531,6 +1540,10 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb
                 if (!usb_endpoint_xfer_int(&ep->desc))
                         return -EINVAL;
  interrupt_urb:
+                if (!is_in)
+                        allow_zero = true;
+                else
+                        allow_short = true;
                 break;
 
         case USBDEVFS_URB_TYPE_ISO:
@@ -1676,14 +1689,19 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb
         u = (is_in ? URB_DIR_IN : URB_DIR_OUT);
         if (uurb->flags & USBDEVFS_URB_ISO_ASAP)
                 u |= URB_ISO_ASAP;
-        if (uurb->flags & USBDEVFS_URB_SHORT_NOT_OK && is_in)
+        if (allow_short && uurb->flags & USBDEVFS_URB_SHORT_NOT_OK)
                 u |= URB_SHORT_NOT_OK;
-        if (uurb->flags & USBDEVFS_URB_ZERO_PACKET)
+        if (allow_zero && uurb->flags & USBDEVFS_URB_ZERO_PACKET)
                 u |= URB_ZERO_PACKET;
         if (uurb->flags & USBDEVFS_URB_NO_INTERRUPT)
                 u |= URB_NO_INTERRUPT;
         as->urb->transfer_flags = u;
 
+        if (!allow_short && uurb->flags & USBDEVFS_URB_SHORT_NOT_OK)
+                dev_warn(&ps->dev->dev, "Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK.\n");
+        if (!allow_zero && uurb->flags & USBDEVFS_URB_ZERO_PACKET)
+                dev_warn(&ps->dev->dev, "Requested nonsensical USBDEVFS_URB_ZERO_PACKET.\n");
+
         as->urb->transfer_buffer_length = uurb->buffer_length;
         as->urb->setup_packet = (unsigned char *)dr;
         dr = NULL;
diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
index e76e95f62f76..a1f225f077cd 100644
--- a/drivers/usb/core/driver.c
+++ b/drivers/usb/core/driver.c
@@ -512,7 +512,6 @@ int usb_driver_claim_interface(struct usb_driver *driver,
         struct device *dev;
         struct usb_device *udev;
         int retval = 0;
-        int lpm_disable_error = -ENODEV;
 
         if (!iface)
                 return -ENODEV;
@@ -533,16 +532,6 @@ int usb_driver_claim_interface(struct usb_driver *driver,
 
         iface->condition = USB_INTERFACE_BOUND;
 
-        /* See the comment about disabling LPM in usb_probe_interface(). */
-        if (driver->disable_hub_initiated_lpm) {
-                lpm_disable_error = usb_unlocked_disable_lpm(udev);
-                if (lpm_disable_error) {
-                        dev_err(&iface->dev, "%s Failed to disable LPM for driver %s\n",
-                                __func__, driver->name);
-                        return -ENOMEM;
-                }
-        }
-
         /* Claimed interfaces are initially inactive (suspended) and
          * runtime-PM-enabled, but only if the driver has autosuspend
          * support.  Otherwise they are marked active, to prevent the
@@ -561,9 +550,20 @@ int usb_driver_claim_interface(struct usb_driver *driver,
         if (device_is_registered(dev))
                 retval = device_bind_driver(dev);
 
-        /* Attempt to re-enable USB3 LPM, if the disable was successful. */
-        if (!lpm_disable_error)
-                usb_unlocked_enable_lpm(udev);
+        if (retval) {
+                dev->driver = NULL;
+                usb_set_intfdata(iface, NULL);
+                iface->needs_remote_wakeup = 0;
+                iface->condition = USB_INTERFACE_UNBOUND;
+
+                /*
+                 * Unbound interfaces are always runtime-PM-disabled
+                 * and runtime-PM-suspended
+                 */
+                if (driver->supports_autosuspend)
+                        pm_runtime_disable(dev);
+                pm_runtime_set_suspended(dev);
+        }
 
         return retval;
 }
diff --git a/drivers/usb/core/hcd-pci.c b/drivers/usb/core/hcd-pci.c
index 66fe1b78d952..03432467b05f 100644
--- a/drivers/usb/core/hcd-pci.c
+++ b/drivers/usb/core/hcd-pci.c
@@ -515,8 +515,6 @@ static int resume_common(struct device *dev, int event)
                                 event == PM_EVENT_RESTORE);
                 if (retval) {
                         dev_err(dev, "PCI post-resume error %d!\n", retval);
-                        if (hcd->shared_hcd)
-                                usb_hc_died(hcd->shared_hcd);
                         usb_hc_died(hcd);
                 }
         }
diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
index 228672f2c4a1..bfa5eda0cc26 100644
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -1341,6 +1341,11 @@ void usb_enable_interface(struct usb_device *dev,
  * is submitted that needs that bandwidth.  Some other operating systems
  * allocate bandwidth early, when a configuration is chosen.
  *
+ * xHCI reserves bandwidth and configures the alternate setting in
+ * usb_hcd_alloc_bandwidth(). If it fails the original interface altsetting
+ * may be disabled. Drivers cannot rely on any particular alternate
+ * setting being in effect after a failure.
+ *
  * This call is synchronous, and may not be used in an interrupt context.
  * Also, drivers must not change altsettings while urbs are scheduled for
  * endpoints in that interface; all such urbs must first be completed
@@ -1376,6 +1381,12 @@ int usb_set_interface(struct usb_device *dev, int interface, int alternate)
                          alternate);
                 return -EINVAL;
         }
+        /*
+         * usb3 hosts configure the interface in usb_hcd_alloc_bandwidth,
+         * including freeing dropped endpoint ring buffers.
+         * Make sure the interface endpoints are flushed before that
+         */
+        usb_disable_interface(dev, iface, false);
 
         /* Make sure we have enough bandwidth for this alternate interface.
          * Remove the current alt setting and add the new alt setting.
diff --git a/drivers/usb/core/of.c b/drivers/usb/core/of.c
index fd77442c2d12..651708d8c908 100644
--- a/drivers/usb/core/of.c
+++ b/drivers/usb/core/of.c
@@ -105,29 +105,3 @@ usb_of_get_interface_node(struct usb_device *udev, u8 config, u8 ifnum)
         return NULL;
 }
 EXPORT_SYMBOL_GPL(usb_of_get_interface_node);
-
-/**
- * usb_of_get_companion_dev - Find the companion device
- * @dev: the device pointer to find a companion
- *
- * Find the companion device from platform bus.
- *
- * Takes a reference to the returned struct device which needs to be dropped
- * after use.
- *
- * Return: On success, a pointer to the companion device, %NULL on failure.
- */
-struct device *usb_of_get_companion_dev(struct device *dev)
-{
-        struct device_node *node;
-        struct platform_device *pdev = NULL;
-
-        node = of_parse_phandle(dev->of_node, "companion", 0);
-        if (node)
-                pdev = of_find_device_by_node(node);
-
-        of_node_put(node);
-
-        return pdev ? &pdev->dev : NULL;
-}
-EXPORT_SYMBOL_GPL(usb_of_get_companion_dev);
diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index 097057d2eacf..178d6c6063c0 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -58,6 +58,7 @@ static int quirks_param_set(const char *val, const struct kernel_param *kp)
         quirk_list = kcalloc(quirk_count, sizeof(struct quirk_entry),
                              GFP_KERNEL);
         if (!quirk_list) {
+                quirk_count = 0;
                 mutex_unlock(&quirk_mutex);
                 return -ENOMEM;
         }
@@ -154,7 +155,7 @@ static struct kparam_string quirks_param_string = {
         .string = quirks_param,
 };
 
-module_param_cb(quirks, &quirks_param_ops, &quirks_param_string, 0644);
+device_param_cb(quirks, &quirks_param_ops, &quirks_param_string, 0644);
 MODULE_PARM_DESC(quirks, "Add/modify USB quirks by specifying quirks=vendorID:productID:quirks");
 
 /* Lists of quirky USB devices, split in device quirks and interface quirks.
@@ -178,6 +179,10 @@ static const struct usb_device_id usb_quirk_list[] = {
         /* CBM - Flash disk */
         { USB_DEVICE(0x0204, 0x6025), .driver_info = USB_QUIRK_RESET_RESUME },
 
+        /* WORLDE Controller KS49 or Prodipe MIDI 49C USB controller */
+        { USB_DEVICE(0x0218, 0x0201), .driver_info =
+                        USB_QUIRK_CONFIG_INTF_STRINGS },
+
         /* WORLDE easy key (easykey.25) MIDI controller  */
         { USB_DEVICE(0x0218, 0x0401), .driver_info =
                         USB_QUIRK_CONFIG_INTF_STRINGS },
@@ -406,6 +411,9 @@ static const struct usb_device_id usb_quirk_list[] = {
         { USB_DEVICE(0x2040, 0x7200), .driver_info =
                         USB_QUIRK_CONFIG_INTF_STRINGS },
 
+        /* DJI CineSSD */
+        { USB_DEVICE(0x2ca3, 0x0031), .driver_info = USB_QUIRK_NO_LPM },
+
         /* INTEL VALUE SSD */
         { USB_DEVICE(0x8086, 0xf1a5), .driver_info = USB_QUIRK_RESET_RESUME },
 
diff --git a/drivers/usb/core/usb.c b/drivers/usb/core/usb.c
index 623be3174fb3..79d8bd7a612e 100644
--- a/drivers/usb/core/usb.c
+++ b/drivers/usb/core/usb.c
@@ -228,6 +228,8 @@ struct usb_host_interface *usb_find_alt_setting(
         struct usb_interface_cache *intf_cache = NULL;
         int i;
 
+        if (!config)
+                return NULL;
         for (i = 0; i < config->desc.bNumInterfaces; i++) {
                 if (config->intf_cache[i]->altsetting[0].desc.bInterfaceNumber
                                 == iface_num) {
diff --git a/drivers/usb/dwc2/platform.c b/drivers/usb/dwc2/platform.c
index 9a53a58e676e..577642895b57 100644
--- a/drivers/usb/dwc2/platform.c
+++ b/drivers/usb/dwc2/platform.c
@@ -412,8 +412,6 @@ static int dwc2_driver_probe(struct platform_device *dev)
         dev_dbg(&dev->dev, "mapped PA %08lx to VA %p\n",
                 (unsigned long)res->start, hsotg->regs);
 
-        hsotg->needs_byte_swap = dwc2_check_core_endianness(hsotg);
-
         retval = dwc2_lowlevel_hw_init(hsotg);
         if (retval)
                 return retval;
@@ -438,6 +436,8 @@ static int dwc2_driver_probe(struct platform_device *dev)
         if (retval)
                 return retval;
 
+        hsotg->needs_byte_swap = dwc2_check_core_endianness(hsotg);
+
         retval = dwc2_get_dr_mode(hsotg);
         if (retval)
                 goto error;
diff --git a/drivers/usb/dwc3/dwc3-of-simple.c b/drivers/usb/dwc3/dwc3-of-simple.c
index 40bf9e0bbc59..4c2771c5e727 100644
--- a/drivers/usb/dwc3/dwc3-of-simple.c
+++ b/drivers/usb/dwc3/dwc3-of-simple.c
@@ -180,8 +180,7 @@ static int dwc3_of_simple_remove(struct platform_device *pdev)
         return 0;
 }
 
-#ifdef CONFIG_PM
-static int dwc3_of_simple_runtime_suspend(struct device *dev)
+static int __maybe_unused dwc3_of_simple_runtime_suspend(struct device *dev)
 {
         struct dwc3_of_simple   *simple = dev_get_drvdata(dev);
         int                     i;
@@ -192,7 +191,7 @@ static int dwc3_of_simple_runtime_suspend(struct device *dev)
         return 0;
 }
 
-static int dwc3_of_simple_runtime_resume(struct device *dev)
+static int __maybe_unused dwc3_of_simple_runtime_resume(struct device *dev)
 {
         struct dwc3_of_simple   *simple = dev_get_drvdata(dev);
         int                     ret;
@@ -210,7 +209,7 @@ static int dwc3_of_simple_runtime_resume(struct device *dev)
         return 0;
 }
 
-static int dwc3_of_simple_suspend(struct device *dev)
+static int __maybe_unused dwc3_of_simple_suspend(struct device *dev)
 {
         struct dwc3_of_simple *simple = dev_get_drvdata(dev);
 
@@ -220,7 +219,7 @@ static int dwc3_of_simple_suspend(struct device *dev)
         return 0;
 }
 
-static int dwc3_of_simple_resume(struct device *dev)
+static int __maybe_unused dwc3_of_simple_resume(struct device *dev)
 {
         struct dwc3_of_simple *simple = dev_get_drvdata(dev);
 
@@ -229,7 +228,6 @@ static int dwc3_of_simple_resume(struct device *dev)
 
         return 0;
 }
-#endif
 
 static const struct dev_pm_ops dwc3_of_simple_dev_pm_ops = {
         SET_SYSTEM_SLEEP_PM_OPS(dwc3_of_simple_suspend, dwc3_of_simple_resume)
diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c
index 5edd79470368..1286076a8890 100644
--- a/drivers/usb/dwc3/dwc3-pci.c
+++ b/drivers/usb/dwc3/dwc3-pci.c
@@ -85,8 +85,8 @@ static int dwc3_byt_enable_ulpi_refclock(struct pci_dev *pci)
         u32             value;
 
         reg = pcim_iomap(pci, GP_RWBAR, 0);
-        if (IS_ERR(reg))
-                return PTR_ERR(reg);
+        if (!reg)
+                return -ENOMEM;
 
         value = readl(reg + GP_RWREG1);
         if (!(value & GP_RWREG1_ULPI_REFCLK_DISABLE))
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 032ea7d709ba..2b53194081ba 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -473,7 +473,6 @@ static int dwc3_gadget_set_xfer_resource(struct dwc3_ep *dep)
 
 /**
  * dwc3_gadget_start_config - configure ep resources
- * @dwc: pointer to our controller context structure
  * @dep: endpoint that is being enabled
  *
  * Issue a %DWC3_DEPCMD_DEPSTARTCFG command to @dep. After the command's
diff --git a/drivers/usb/gadget/udc/fotg210-udc.c b/drivers/usb/gadget/udc/fotg210-udc.c
index 53a48f561458..587c5037ff07 100644
--- a/drivers/usb/gadget/udc/fotg210-udc.c
+++ b/drivers/usb/gadget/udc/fotg210-udc.c
@@ -1063,12 +1063,15 @@ static const struct usb_gadget_ops fotg210_gadget_ops = {
 static int fotg210_udc_remove(struct platform_device *pdev)
 {
         struct fotg210_udc *fotg210 = platform_get_drvdata(pdev);
+        int i;
 
         usb_del_gadget_udc(&fotg210->gadget);
         iounmap(fotg210->reg);
         free_irq(platform_get_irq(pdev, 0), fotg210);
 
         fotg210_ep_free_request(&fotg210->ep[0]->ep, fotg210->ep0_req);
+        for (i = 0; i < FOTG210_MAX_NUM_EP; i++)
+                kfree(fotg210->ep[i]);
         kfree(fotg210);
 
         return 0;
@@ -1099,7 +1102,7 @@ static int fotg210_udc_probe(struct platform_device *pdev)
         /* initialize udc */
         fotg210 = kzalloc(sizeof(struct fotg210_udc), GFP_KERNEL);
         if (fotg210 == NULL)
-                goto err_alloc;
+                goto err;
 
         for (i = 0; i < FOTG210_MAX_NUM_EP; i++) {
                 _ep[i] = kzalloc(sizeof(struct fotg210_ep), GFP_KERNEL);
@@ -1111,7 +1114,7 @@ static int fotg210_udc_probe(struct platform_device *pdev)
         fotg210->reg = ioremap(res->start, resource_size(res));
         if (fotg210->reg == NULL) {
                 pr_err("ioremap error.\n");
-                goto err_map;
+                goto err_alloc;
         }
 
         spin_lock_init(&fotg210->lock);
@@ -1159,7 +1162,7 @@ static int fotg210_udc_probe(struct platform_device *pdev)
         fotg210->ep0_req = fotg210_ep_alloc_request(&fotg210->ep[0]->ep,
                                 GFP_KERNEL);
         if (fotg210->ep0_req == NULL)
-                goto err_req;
+                goto err_map;
 
         fotg210_init(fotg210);
 
@@ -1187,12 +1190,14 @@ err_req:
         fotg210_ep_free_request(&fotg210->ep[0]->ep, fotg210->ep0_req);
 
 err_map:
-        if (fotg210->reg)
-                iounmap(fotg210->reg);
+        iounmap(fotg210->reg);
 
 err_alloc:
+        for (i = 0; i < FOTG210_MAX_NUM_EP; i++)
+                kfree(fotg210->ep[i]);
         kfree(fotg210);
 
+err:
         return ret;
 }
 
diff --git a/drivers/usb/gadget/udc/net2280.c b/drivers/usb/gadget/udc/net2280.c
index 318246d8b2e2..b02ab2a8d927 100644
--- a/drivers/usb/gadget/udc/net2280.c
+++ b/drivers/usb/gadget/udc/net2280.c
@@ -1545,11 +1545,14 @@ static int net2280_pullup(struct usb_gadget *_gadget, int is_on)
                 writel(tmp | BIT(USB_DETECT_ENABLE), &dev->usb->usbctl);
         } else {
                 writel(tmp & ~BIT(USB_DETECT_ENABLE), &dev->usb->usbctl);
-                stop_activity(dev, dev->driver);
+                stop_activity(dev, NULL);
         }
 
         spin_unlock_irqrestore(&dev->lock, flags);
 
+        if (!is_on && dev->driver)
+                dev->driver->disconnect(&dev->gadget);
+
         return 0;
 }
 
@@ -2466,8 +2469,11 @@ static void stop_activity(struct net2280 *dev, struct usb_gadget_driver *driver)
                 nuke(&dev->ep[i]);
 
         /* report disconnect; the driver is already quiesced */
-        if (driver)
+        if (driver) {
+                spin_unlock(&dev->lock);
                 driver->disconnect(&dev->gadget);
+                spin_lock(&dev->lock);
+        }
 
         usb_reinit(dev);
 }
@@ -3341,6 +3347,8 @@ next_endpoints:
                 BIT(PCI_RETRY_ABORT_INTERRUPT))
 
 static void handle_stat1_irqs(struct net2280 *dev, u32 stat)
+__releases(dev->lock)
+__acquires(dev->lock)
 {
         struct net2280_ep       *ep;
         u32                     tmp, num, mask, scratch;
@@ -3381,12 +3389,14 @@ static void handle_stat1_irqs(struct net2280 *dev, u32 stat)
                         if (disconnect || reset) {
                                 stop_activity(dev, dev->driver);
                                 ep0_start(dev);
+                                spin_unlock(&dev->lock);
                                 if (reset)
                                         usb_gadget_udc_reset
                                                 (&dev->gadget, dev->driver);
                                 else
                                         (dev->driver->disconnect)
                                                 (&dev->gadget);
+                                spin_lock(&dev->lock);
                                 return;
                         }
                 }
@@ -3405,6 +3415,7 @@ static void handle_stat1_irqs(struct net2280 *dev, u32 stat)
         tmp = BIT(SUSPEND_REQUEST_CHANGE_INTERRUPT);
         if (stat & tmp) {
                 writel(tmp, &dev->regs->irqstat1);
+                spin_unlock(&dev->lock);
                 if (stat & BIT(SUSPEND_REQUEST_INTERRUPT)) {
                         if (dev->driver->suspend)
                                 dev->driver->suspend(&dev->gadget);
@@ -3415,6 +3426,7 @@ static void handle_stat1_irqs(struct net2280 *dev, u32 stat)
                                 dev->driver->resume(&dev->gadget);
                         /* at high speed, note erratum 0133 */
                 }
+                spin_lock(&dev->lock);
                 stat &= ~tmp;
         }
 
diff --git a/drivers/usb/gadget/udc/renesas_usb3.c b/drivers/usb/gadget/udc/renesas_usb3.c
index 1f879b3f2c96..e1656f361e08 100644
--- a/drivers/usb/gadget/udc/renesas_usb3.c
+++ b/drivers/usb/gadget/udc/renesas_usb3.c
@@ -812,12 +812,15 @@ static void usb3_irq_epc_int_1_speed(struct renesas_usb3 *usb3)
         switch (speed) {
         case USB_STA_SPEED_SS:
                 usb3->gadget.speed = USB_SPEED_SUPER;
+                usb3->gadget.ep0->maxpacket = USB3_EP0_SS_MAX_PACKET_SIZE;
                 break;
         case USB_STA_SPEED_HS:
                 usb3->gadget.speed = USB_SPEED_HIGH;
+                usb3->gadget.ep0->maxpacket = USB3_EP0_HSFS_MAX_PACKET_SIZE;
                 break;
         case USB_STA_SPEED_FS:
                 usb3->gadget.speed = USB_SPEED_FULL;
+                usb3->gadget.ep0->maxpacket = USB3_EP0_HSFS_MAX_PACKET_SIZE;
                 break;
         default:
                 usb3->gadget.speed = USB_SPEED_UNKNOWN;
@@ -2513,7 +2516,7 @@ static int renesas_usb3_init_ep(struct renesas_usb3 *usb3, struct device *dev,
                         /* for control pipe */
                         usb3->gadget.ep0 = &usb3_ep->ep;
                         usb_ep_set_maxpacket_limit(&usb3_ep->ep,
-                                                USB3_EP0_HSFS_MAX_PACKET_SIZE);
+                                                USB3_EP0_SS_MAX_PACKET_SIZE);
                         usb3_ep->ep.caps.type_control = true;
                         usb3_ep->ep.caps.dir_in = true;
                         usb3_ep->ep.caps.dir_out = true;
diff --git a/drivers/usb/host/u132-hcd.c b/drivers/usb/host/u132-hcd.c
index 072bd5d5738e..5b8a3d9530c4 100644
--- a/drivers/usb/host/u132-hcd.c
+++ b/drivers/usb/host/u132-hcd.c
@@ -2555,7 +2555,7 @@ static int u132_get_frame(struct usb_hcd *hcd)
         } else {
                 int frame = 0;
                 dev_err(&u132->platform_dev->dev, "TODO: u132_get_frame\n");
-                msleep(100);
+                mdelay(100);
                 return frame;
         }
 }
diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
index ef350c33dc4a..b1f27aa38b10 100644
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -1613,6 +1613,10 @@ void xhci_endpoint_copy(struct xhci_hcd *xhci,
         in_ep_ctx->ep_info2 = out_ep_ctx->ep_info2;
         in_ep_ctx->deq = out_ep_ctx->deq;
         in_ep_ctx->tx_info = out_ep_ctx->tx_info;
+        if (xhci->quirks & XHCI_MTK_HOST) {
+                in_ep_ctx->reserved[0] = out_ep_ctx->reserved[0];
+                in_ep_ctx->reserved[1] = out_ep_ctx->reserved[1];
+        }
 }
 
 /* Copy output xhci_slot_ctx to the input xhci_slot_ctx.
diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
index 8dc77e34a859..94e939249b2b 100644
--- a/drivers/usb/host/xhci-plat.c
+++ b/drivers/usb/host/xhci-plat.c
@@ -153,7 +153,7 @@ static int xhci_plat_probe(struct platform_device *pdev)
 {
         const struct xhci_plat_priv *priv_match;
         const struct hc_driver  *driver;
-        struct device           *sysdev;
+        struct device           *sysdev, *tmpdev;
         struct xhci_hcd         *xhci;
         struct resource         *res;
         struct usb_hcd          *hcd;
@@ -273,19 +273,24 @@ static int xhci_plat_probe(struct platform_device *pdev)
                 goto disable_clk;
         }
 
-        if (device_property_read_bool(sysdev, "usb2-lpm-disable"))
-                xhci->quirks |= XHCI_HW_LPM_DISABLE;
+        /* imod_interval is the interrupt moderation value in nanoseconds. */
+        xhci->imod_interval = 40000;
 
-        if (device_property_read_bool(sysdev, "usb3-lpm-capable"))
-                xhci->quirks |= XHCI_LPM_SUPPORT;
+        /* Iterate over all parent nodes for finding quirks */
+        for (tmpdev = &pdev->dev; tmpdev; tmpdev = tmpdev->parent) {
 
-        if (device_property_read_bool(&pdev->dev, "quirk-broken-port-ped"))
-                xhci->quirks |= XHCI_BROKEN_PORT_PED;
+                if (device_property_read_bool(tmpdev, "usb2-lpm-disable"))
+                        xhci->quirks |= XHCI_HW_LPM_DISABLE;
 
-        /* imod_interval is the interrupt moderation value in nanoseconds. */
-        xhci->imod_interval = 40000;
-        device_property_read_u32(sysdev, "imod-interval-ns",
-                                 &xhci->imod_interval);
+                if (device_property_read_bool(tmpdev, "usb3-lpm-capable"))
+                        xhci->quirks |= XHCI_LPM_SUPPORT;
+
+                if (device_property_read_bool(tmpdev, "quirk-broken-port-ped"))
+                        xhci->quirks |= XHCI_BROKEN_PORT_PED;
+
+                device_property_read_u32(tmpdev, "imod-interval-ns",
+                                         &xhci->imod_interval);
+        }
 
         hcd->usb_phy = devm_usb_get_phy_by_phandle(sysdev, "usb-phy", 0);
         if (IS_ERR(hcd->usb_phy)) {
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 61f48b17e57b..0420eefa647a 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -37,6 +37,21 @@ static unsigned long long quirks;
 module_param(quirks, ullong, S_IRUGO);
 MODULE_PARM_DESC(quirks, "Bit flags for quirks to be enabled as default");
 
+static bool td_on_ring(struct xhci_td *td, struct xhci_ring *ring)
+{
+        struct xhci_segment *seg = ring->first_seg;
+
+        if (!td || !td->start_seg)
+                return false;
+        do {
+                if (seg == td->start_seg)
+                        return true;
+                seg = seg->next;
+        } while (seg && seg != ring->first_seg);
+
+        return false;
+}
+
 /* TODO: copied from ehci-hcd.c - can this be refactored? */
 /*
  * xhci_handshake - spin reading hc until handshake completes or fails
@@ -1571,6 +1586,21 @@ static int xhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
                 goto done;
         }
 
+        /*
+         * check ring is not re-allocated since URB was enqueued. If it is, then
+         * make sure none of the ring related pointers in this URB private data
+         * are touched, such as td_list, otherwise we overwrite freed data
+         */
+        if (!td_on_ring(&urb_priv->td[0], ep_ring)) {
+                xhci_err(xhci, "Canceled URB td not found on endpoint ring");
+                for (i = urb_priv->num_tds_done; i < urb_priv->num_tds; i++) {
+                        td = &urb_priv->td[i];
+                        if (!list_empty(&td->cancelled_td_list))
+                                list_del_init(&td->cancelled_td_list);
+                }
+                goto err_giveback;
+        }
+
         if (xhci->xhc_state & XHCI_STATE_HALTED) {
                 xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,
                                 "HC halted, freeing TD manually.");
diff --git a/drivers/usb/misc/uss720.c b/drivers/usb/misc/uss720.c
index 82f220631bd7..b5d661644263 100644
--- a/drivers/usb/misc/uss720.c
+++ b/drivers/usb/misc/uss720.c
@@ -369,7 +369,7 @@ static unsigned char parport_uss720_frob_control(struct parport *pp, unsigned ch
         mask &= 0x0f;
         val &= 0x0f;
         d = (priv->reg[1] & (~mask)) ^ val;
-        if (set_1284_register(pp, 2, d, GFP_KERNEL))
+        if (set_1284_register(pp, 2, d, GFP_ATOMIC))
                 return 0;
         priv->reg[1] = d;
         return d & 0xf;
@@ -379,7 +379,7 @@ static unsigned char parport_uss720_read_status(struct parport *pp)
 {
         unsigned char ret;
 
-        if (get_1284_register(pp, 1, &ret, GFP_KERNEL))
+        if (get_1284_register(pp, 1, &ret, GFP_ATOMIC))
                 return 0;
         return ret & 0xf8;
 }
diff --git a/drivers/usb/misc/yurex.c b/drivers/usb/misc/yurex.c
index 3be40eaa1ac9..6d9fd5f64903 100644
--- a/drivers/usb/misc/yurex.c
+++ b/drivers/usb/misc/yurex.c
@@ -413,6 +413,9 @@ static ssize_t yurex_read(struct file *file, char __user *buffer, size_t count,
         spin_unlock_irqrestore(&dev->lock, flags);
         mutex_unlock(&dev->io_mutex);
 
+        if (WARN_ON_ONCE(len >= sizeof(in_buffer)))
+                return -EIO;
+
         return simple_read_from_buffer(buffer, count, ppos, in_buffer, len);
 }
 
@@ -421,13 +424,13 @@ static ssize_t yurex_write(struct file *file, const char __user *user_buffer,
 {
         struct usb_yurex *dev;
         int i, set = 0, retval = 0;
-        char buffer[16];
+        char buffer[16 + 1];
         char *data = buffer;
         unsigned long long c, c2 = 0;
         signed long timeout = 0;
         DEFINE_WAIT(wait);
 
-        count = min(sizeof(buffer), count);
+        count = min(sizeof(buffer) - 1, count);
         dev = file->private_data;
 
         /* verify that we actually have some data to write */
@@ -446,6 +449,7 @@ static ssize_t yurex_write(struct file *file, const char __user *user_buffer,
                 retval = -EFAULT;
                 goto error;
         }
+        buffer[count] = 0;
         memset(dev->cntl_buffer, CMD_PADDING, YUREX_BUF_SIZE);
 
         switch (buffer[0]) {
diff --git a/drivers/usb/mtu3/mtu3_core.c b/drivers/usb/mtu3/mtu3_core.c
index eecfd0671362..d045d8458f81 100644
--- a/drivers/usb/mtu3/mtu3_core.c
+++ b/drivers/usb/mtu3/mtu3_core.c
@@ -107,8 +107,12 @@ static int mtu3_device_enable(struct mtu3 *mtu)
                 (SSUSB_U2_PORT_DIS | SSUSB_U2_PORT_PDN |
                 SSUSB_U2_PORT_HOST_SEL));
 
-        if (mtu->ssusb->dr_mode == USB_DR_MODE_OTG)
+        if (mtu->ssusb->dr_mode == USB_DR_MODE_OTG) {
                 mtu3_setbits(ibase, SSUSB_U2_CTRL(0), SSUSB_U2_PORT_OTG_SEL);
+                if (mtu->is_u3_ip)
+                        mtu3_setbits(ibase, SSUSB_U3_CTRL(0),
+                                     SSUSB_U3_PORT_DUAL_MODE);
+        }
 
         return ssusb_check_clocks(mtu->ssusb, check_clk);
 }
diff --git a/drivers/usb/mtu3/mtu3_hw_regs.h b/drivers/usb/mtu3/mtu3_hw_regs.h
index 6ee371478d89..a45bb253939f 100644
--- a/drivers/usb/mtu3/mtu3_hw_regs.h
+++ b/drivers/usb/mtu3/mtu3_hw_regs.h
@@ -459,6 +459,7 @@
 
 /* U3D_SSUSB_U3_CTRL_0P */
 #define SSUSB_U3_PORT_SSP_SPEED BIT(9)
+#define SSUSB_U3_PORT_DUAL_MODE BIT(7)
 #define SSUSB_U3_PORT_HOST_SEL          BIT(2)
 #define SSUSB_U3_PORT_PDN               BIT(1)
 #define SSUSB_U3_PORT_DIS               BIT(0)
diff --git a/drivers/usb/musb/musb_dsps.c b/drivers/usb/musb/musb_dsps.c
index df827ff57b0d..23a0df79ef21 100644
--- a/drivers/usb/musb/musb_dsps.c
+++ b/drivers/usb/musb/musb_dsps.c
@@ -658,16 +658,6 @@ dsps_dma_controller_create(struct musb *musb, void __iomem *base)
         return controller;
 }
 
-static void dsps_dma_controller_destroy(struct dma_controller *c)
-{
-        struct musb *musb = c->musb;
-        struct dsps_glue *glue = dev_get_drvdata(musb->controller->parent);
-        void __iomem *usbss_base = glue->usbss_base;
-
-        musb_writel(usbss_base, USBSS_IRQ_CLEARR, USBSS_IRQ_PD_COMP);
-        cppi41_dma_controller_destroy(c);
-}
-
 #ifdef CONFIG_PM_SLEEP
 static void dsps_dma_controller_suspend(struct dsps_glue *glue)
 {
@@ -697,7 +687,7 @@ static struct musb_platform_ops dsps_ops = {
 
 #ifdef CONFIG_USB_TI_CPPI41_DMA
         .dma_init       = dsps_dma_controller_create,
-        .dma_exit       = dsps_dma_controller_destroy,
+        .dma_exit       = cppi41_dma_controller_destroy,
 #endif
         .enable         = dsps_musb_enable,
         .disable        = dsps_musb_disable,
diff --git a/drivers/usb/serial/io_ti.h b/drivers/usb/serial/io_ti.h
index e53c68261017..9bbcee37524e 100644
--- a/drivers/usb/serial/io_ti.h
+++ b/drivers/usb/serial/io_ti.h
@@ -173,7 +173,7 @@ struct ump_interrupt {
 }  __attribute__((packed));
 
 
-#define TIUMP_GET_PORT_FROM_CODE(c)     (((c) >> 4) - 3)
+#define TIUMP_GET_PORT_FROM_CODE(c)     (((c) >> 6) & 0x01)
 #define TIUMP_GET_FUNC_FROM_CODE(c)     ((c) & 0x0f)
 #define TIUMP_INTERRUPT_CODE_LSR        0x03
 #define TIUMP_INTERRUPT_CODE_MSR        0x04
diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c
index 3010878f7f8e..e3c5832337e0 100644
--- a/drivers/usb/serial/ti_usb_3410_5052.c
+++ b/drivers/usb/serial/ti_usb_3410_5052.c
@@ -1119,7 +1119,7 @@ static void ti_break(struct tty_struct *tty, int break_state)
 
 static int ti_get_port_from_code(unsigned char code)
 {
-        return (code >> 4) - 3;
+        return (code >> 6) & 0x01;
 }
 
 static int ti_get_func_from_code(unsigned char code)
diff --git a/drivers/usb/storage/scsiglue.c b/drivers/usb/storage/scsiglue.c
index c267f2812a04..e227bb5b794f 100644
--- a/drivers/usb/storage/scsiglue.c
+++ b/drivers/usb/storage/scsiglue.c
@@ -376,6 +376,15 @@ static int queuecommand_lck(struct scsi_cmnd *srb,
                 return 0;
         }
 
+        if ((us->fflags & US_FL_NO_ATA_1X) &&
+                        (srb->cmnd[0] == ATA_12 || srb->cmnd[0] == ATA_16)) {
+                memcpy(srb->sense_buffer, usb_stor_sense_invalidCDB,
+                       sizeof(usb_stor_sense_invalidCDB));
+                srb->result = SAM_STAT_CHECK_CONDITION;
+                done(srb);
+                return 0;
+        }
+
         /* enqueue the command and wake up the control thread */
         srb->scsi_done = done;
         us->srb = srb;
diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c
index 9e9de5452860..1f7b401c4d04 100644
--- a/drivers/usb/storage/uas.c
+++ b/drivers/usb/storage/uas.c
@@ -842,6 +842,27 @@ static int uas_slave_configure(struct scsi_device *sdev)
                 sdev->skip_ms_page_8 = 1;
                 sdev->wce_default_on = 1;
         }
+
+        /*
+         * Some disks return the total number of blocks in response
+         * to READ CAPACITY rather than the highest block number.
+         * If this device makes that mistake, tell the sd driver.
+         */
+        if (devinfo->flags & US_FL_FIX_CAPACITY)
+                sdev->fix_capacity = 1;
+
+        /*
+         * Some devices don't like MODE SENSE with page=0x3f,
+         * which is the command used for checking if a device
+         * is write-protected.  Now that we tell the sd driver
+         * to do a 192-byte transfer with this command the
+         * majority of devices work fine, but a few still can't
+         * handle it.  The sd driver will simply assume those
+         * devices are write-enabled.
+         */
+        if (devinfo->flags & US_FL_NO_WP_DETECT)
+                sdev->skip_ms_page_3f = 1;
+
         scsi_change_queue_depth(sdev, devinfo->qdepth - 2);
         return 0;
 }
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index 22fcfccf453a..f7f83b21dc74 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -2288,6 +2288,13 @@ UNUSUAL_DEV(  0x2735, 0x100b, 0x0000, 0x9999,
                 USB_SC_DEVICE, USB_PR_DEVICE, NULL,
                 US_FL_GO_SLOW ),
 
+/* Reported-by: Tim Anderson <tsa@biglakesoftware.com> */
+UNUSUAL_DEV(  0x2ca3, 0x0031, 0x0000, 0x9999,
+                "DJI",
+                "CineSSD",
+                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+                US_FL_NO_ATA_1X),
+
 /*
  * Reported by Frederic Marchal <frederic.marchal@wowcompany.com>
  * Mio Moov 330
diff --git a/drivers/usb/typec/bus.c b/drivers/usb/typec/bus.c
index 95a2b10127db..76299b6ff06d 100644
--- a/drivers/usb/typec/bus.c
+++ b/drivers/usb/typec/bus.c
@@ -255,12 +255,13 @@ EXPORT_SYMBOL_GPL(typec_altmode_unregister_driver);
 /* API for the port drivers */
 
 /**
- * typec_match_altmode - Match SVID to an array of alternate modes
+ * typec_match_altmode - Match SVID and mode to an array of alternate modes
  * @altmodes: Array of alternate modes
- * @n: Number of elements in the array, or -1 for NULL termiated arrays
+ * @n: Number of elements in the array, or -1 for NULL terminated arrays
  * @svid: Standard or Vendor ID to match with
+ * @mode: Mode to match with
  *
- * Return pointer to an alternate mode with SVID mathing @svid, or NULL when no
+ * Return pointer to an alternate mode with SVID matching @svid, or NULL when no
  * match is found.
  */
 struct typec_altmode *typec_match_altmode(struct typec_altmode **altmodes,
diff --git a/drivers/usb/typec/class.c b/drivers/usb/typec/class.c
index c202975f8097..e61dffb27a0c 100644
--- a/drivers/usb/typec/class.c
+++ b/drivers/usb/typec/class.c
@@ -1484,7 +1484,6 @@ EXPORT_SYMBOL_GPL(typec_set_mode);
  * typec_port_register_altmode - Register USB Type-C Port Alternate Mode
  * @port: USB Type-C Port that supports the alternate mode
  * @desc: Description of the alternate mode
- * @drvdata: Private pointer to driver specific info
  *
  * This routine is used to register an alternate mode that @port is capable of
  * supporting.
diff --git a/drivers/usb/typec/mux.c b/drivers/usb/typec/mux.c
index ddaac63ecf12..d990aa510fab 100644
--- a/drivers/usb/typec/mux.c
+++ b/drivers/usb/typec/mux.c
@@ -9,6 +9,7 @@
 
 #include <linux/device.h>
 #include <linux/list.h>
+#include <linux/module.h>
 #include <linux/mutex.h>
 #include <linux/usb/typec_mux.h>
 
@@ -49,8 +50,10 @@ struct typec_switch *typec_switch_get(struct device *dev)
         mutex_lock(&switch_lock);
         sw = device_connection_find_match(dev, "typec-switch", NULL,
                                           typec_switch_match);
-        if (!IS_ERR_OR_NULL(sw))
+        if (!IS_ERR_OR_NULL(sw)) {
+                WARN_ON(!try_module_get(sw->dev->driver->owner));
                 get_device(sw->dev);
+        }
         mutex_unlock(&switch_lock);
 
         return sw;
@@ -65,8 +68,10 @@ EXPORT_SYMBOL_GPL(typec_switch_get);
  */
 void typec_switch_put(struct typec_switch *sw)
 {
-        if (!IS_ERR_OR_NULL(sw))
+        if (!IS_ERR_OR_NULL(sw)) {
+                module_put(sw->dev->driver->owner);
                 put_device(sw->dev);
+        }
 }
 EXPORT_SYMBOL_GPL(typec_switch_put);
 
@@ -136,8 +141,10 @@ struct typec_mux *typec_mux_get(struct device *dev, const char *name)
 
         mutex_lock(&mux_lock);
         mux = device_connection_find_match(dev, name, NULL, typec_mux_match);
-        if (!IS_ERR_OR_NULL(mux))
+        if (!IS_ERR_OR_NULL(mux)) {
+                WARN_ON(!try_module_get(mux->dev->driver->owner));
                 get_device(mux->dev);
+        }
         mutex_unlock(&mux_lock);
 
         return mux;
@@ -152,8 +159,10 @@ EXPORT_SYMBOL_GPL(typec_mux_get);
  */
 void typec_mux_put(struct typec_mux *mux)
 {
-        if (!IS_ERR_OR_NULL(mux))
+        if (!IS_ERR_OR_NULL(mux)) {
+                module_put(mux->dev->driver->owner);
                 put_device(mux->dev);
+        }
 }
 EXPORT_SYMBOL_GPL(typec_mux_put);
 
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index 96c1d8400822..b13c6b4b2c66 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -952,7 +952,7 @@ static void vhost_iotlb_notify_vq(struct vhost_dev *d,
         list_for_each_entry_safe(node, n, &d->pending_list, node) {
                 struct vhost_iotlb_msg *vq_msg = &node->msg.iotlb;
                 if (msg->iova <= vq_msg->iova &&
-                    msg->iova + msg->size - 1 > vq_msg->iova &&
+                    msg->iova + msg->size - 1 >= vq_msg->iova &&
                     vq_msg->type == VHOST_IOTLB_MISS) {
                         vhost_poll_queue(&node->vq->poll);
                         list_del(&node->node);
diff --git a/drivers/xen/Kconfig b/drivers/xen/Kconfig
index b459edfacff3..90d387b50ab7 100644
--- a/drivers/xen/Kconfig
+++ b/drivers/xen/Kconfig
@@ -79,15 +79,19 @@ config XEN_BALLOON_MEMORY_HOTPLUG_LIMIT
           This value is used to allocate enough space in internal
           tables needed for physical memory administration.
 
-config XEN_SCRUB_PAGES
-        bool "Scrub pages before returning them to system"
+config XEN_SCRUB_PAGES_DEFAULT
+        bool "Scrub pages before returning them to system by default"
         depends on XEN_BALLOON
         default y
         help
           Scrub pages before returning them to the system for reuse by
           other domains.  This makes sure that any confidential data
           is not accidentally visible to other domains.  Is it more
-          secure, but slightly less efficient.
+          secure, but slightly less efficient. This can be controlled with
+          xen_scrub_pages=0 parameter and
+          /sys/devices/system/xen_memory/xen_memory0/scrub_pages.
+          This option only sets the default value.
+
           If in doubt, say yes.
 
 config XEN_DEV_EVTCHN
diff --git a/drivers/xen/cpu_hotplug.c b/drivers/xen/cpu_hotplug.c
index d4265c8ebb22..b1357aa4bc55 100644
--- a/drivers/xen/cpu_hotplug.c
+++ b/drivers/xen/cpu_hotplug.c
@@ -19,15 +19,16 @@ static void enable_hotplug_cpu(int cpu)
 
 static void disable_hotplug_cpu(int cpu)
 {
-        if (cpu_online(cpu)) {
-                lock_device_hotplug();
+        if (!cpu_is_hotpluggable(cpu))
+                return;
+        lock_device_hotplug();
+        if (cpu_online(cpu))
                 device_offline(get_cpu_device(cpu));
-                unlock_device_hotplug();
-        }
-        if (cpu_present(cpu))
+        if (!cpu_online(cpu) && cpu_present(cpu)) {
                 xen_arch_unregister_cpu(cpu);
-
-        set_cpu_present(cpu, false);
+                set_cpu_present(cpu, false);
+        }
+        unlock_device_hotplug();
 }
 
 static int vcpu_online(unsigned int cpu)
diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c
index 08e4af04d6f2..e6c1934734b7 100644
--- a/drivers/xen/events/events_base.c
+++ b/drivers/xen/events/events_base.c
@@ -138,7 +138,7 @@ static int set_evtchn_to_irq(unsigned evtchn, unsigned irq)
                 clear_evtchn_to_irq_row(row);
         }
 
-        evtchn_to_irq[EVTCHN_ROW(evtchn)][EVTCHN_COL(evtchn)] = irq;
+        evtchn_to_irq[row][col] = irq;
         return 0;
 }
 
diff --git a/drivers/xen/gntdev.c b/drivers/xen/gntdev.c
index 57390c7666e5..b0b02a501167 100644
--- a/drivers/xen/gntdev.c
+++ b/drivers/xen/gntdev.c
@@ -492,12 +492,19 @@ static bool in_range(struct gntdev_grant_map *map,
         return true;
 }
 
-static void unmap_if_in_range(struct gntdev_grant_map *map,
-                              unsigned long start, unsigned long end)
+static int unmap_if_in_range(struct gntdev_grant_map *map,
+                              unsigned long start, unsigned long end,
+                              bool blockable)
 {
         unsigned long mstart, mend;
         int err;
 
+        if (!in_range(map, start, end))
+                return 0;
+
+        if (!blockable)
+                return -EAGAIN;
+
         mstart = max(start, map->vma->vm_start);
         mend   = min(end,   map->vma->vm_end);
         pr_debug("map %d+%d (%lx %lx), range %lx %lx, mrange %lx %lx\n",
@@ -508,6 +515,8 @@ static void unmap_if_in_range(struct gntdev_grant_map *map,
                                 (mstart - map->vma->vm_start) >> PAGE_SHIFT,
                                 (mend - mstart) >> PAGE_SHIFT);
         WARN_ON(err);
+
+        return 0;
 }
 
 static int mn_invl_range_start(struct mmu_notifier *mn,
@@ -519,25 +528,20 @@ static int mn_invl_range_start(struct mmu_notifier *mn,
         struct gntdev_grant_map *map;
         int ret = 0;
 
-        /* TODO do we really need a mutex here? */
         if (blockable)
                 mutex_lock(&priv->lock);
         else if (!mutex_trylock(&priv->lock))
                 return -EAGAIN;
 
         list_for_each_entry(map, &priv->maps, next) {
-                if (in_range(map, start, end)) {
-                        ret = -EAGAIN;
+                ret = unmap_if_in_range(map, start, end, blockable);
+                if (ret)
                         goto out_unlock;
-                }
-                unmap_if_in_range(map, start, end);
         }
         list_for_each_entry(map, &priv->freeable_maps, next) {
-                if (in_range(map, start, end)) {
-                        ret = -EAGAIN;
+                ret = unmap_if_in_range(map, start, end, blockable);
+                if (ret)
                         goto out_unlock;
-                }
-                unmap_if_in_range(map, start, end);
         }
 
 out_unlock:
diff --git a/drivers/xen/grant-table.c b/drivers/xen/grant-table.c
index 7bafa703a992..84575baceebc 100644
--- a/drivers/xen/grant-table.c
+++ b/drivers/xen/grant-table.c
@@ -1040,18 +1040,33 @@ int gnttab_map_refs(struct gnttab_map_grant_ref *map_ops,
                 return ret;
 
         for (i = 0; i < count; i++) {
-                /* Retry eagain maps */
-                if (map_ops[i].status == GNTST_eagain)
-                        gnttab_retry_eagain_gop(GNTTABOP_map_grant_ref, map_ops + i,
-                                                &map_ops[i].status, __func__);
-
-                if (map_ops[i].status == GNTST_okay) {
+                switch (map_ops[i].status) {
+                case GNTST_okay:
+                {
                         struct xen_page_foreign *foreign;
 
                         SetPageForeign(pages[i]);
                         foreign = xen_page_foreign(pages[i]);
                         foreign->domid = map_ops[i].dom;
                         foreign->gref = map_ops[i].ref;
+                        break;
+                }
+
+                case GNTST_no_device_space:
+                        pr_warn_ratelimited("maptrack limit reached, can't map all guest pages\n");
+                        break;
+
+                case GNTST_eagain:
+                        /* Retry eagain maps */
+                        gnttab_retry_eagain_gop(GNTTABOP_map_grant_ref,
+                                                map_ops + i,
+                                                &map_ops[i].status, __func__);
+                        /* Test status in next loop iteration. */
+                        i--;
+                        break;
+
+                default:
+                        break;
                 }
         }
 
diff --git a/drivers/xen/manage.c b/drivers/xen/manage.c
index c93d8ef8df34..5bb01a62f214 100644
--- a/drivers/xen/manage.c
+++ b/drivers/xen/manage.c
@@ -280,9 +280,11 @@ static void sysrq_handler(struct xenbus_watch *watch, const char *path,
                 /*
                  * The Xenstore watch fires directly after registering it and
                  * after a suspend/resume cycle. So ENOENT is no error but
-                 * might happen in those cases.
+                 * might happen in those cases. ERANGE is observed when we get
+                 * an empty value (''), this happens when we acknowledge the
+                 * request by writing '\0' below.
                  */
-                if (err != -ENOENT)
+                if (err != -ENOENT && err != -ERANGE)
                         pr_err("Error %d reading sysrq code in control/sysrq\n",
                                err);
                 xenbus_transaction_end(xbt, 1);
diff --git a/drivers/xen/mem-reservation.c b/drivers/xen/mem-reservation.c
index 084799c6180e..3782cf070338 100644
--- a/drivers/xen/mem-reservation.c
+++ b/drivers/xen/mem-reservation.c
@@ -14,6 +14,10 @@
 
 #include <xen/interface/memory.h>
 #include <xen/mem-reservation.h>
+#include <linux/moduleparam.h>
+
+bool __read_mostly xen_scrub_pages = IS_ENABLED(CONFIG_XEN_SCRUB_PAGES_DEFAULT);
+core_param(xen_scrub_pages, xen_scrub_pages, bool, 0);
 
 /*
  * Use one extent per PAGE_SIZE to avoid to break down the page into
diff --git a/drivers/xen/xen-balloon.c b/drivers/xen/xen-balloon.c
index 294f35ce9e46..63c1494a8d73 100644
--- a/drivers/xen/xen-balloon.c
+++ b/drivers/xen/xen-balloon.c
@@ -44,6 +44,7 @@
 #include <xen/xenbus.h>
 #include <xen/features.h>
 #include <xen/page.h>
+#include <xen/mem-reservation.h>
 
 #define PAGES2KB(_p) ((_p)<<(PAGE_SHIFT-10))
 
@@ -137,6 +138,7 @@ static DEVICE_ULONG_ATTR(schedule_delay, 0444, balloon_stats.schedule_delay);
 static DEVICE_ULONG_ATTR(max_schedule_delay, 0644, balloon_stats.max_schedule_delay);
 static DEVICE_ULONG_ATTR(retry_count, 0444, balloon_stats.retry_count);
 static DEVICE_ULONG_ATTR(max_retry_count, 0644, balloon_stats.max_retry_count);
+static DEVICE_BOOL_ATTR(scrub_pages, 0644, xen_scrub_pages);
 
 static ssize_t show_target_kb(struct device *dev, struct device_attribute *attr,
                               char *buf)
@@ -203,6 +205,7 @@ static struct attribute *balloon_attrs[] = {
         &dev_attr_max_schedule_delay.attr.attr,
         &dev_attr_retry_count.attr.attr,
         &dev_attr_max_retry_count.attr.attr,
+        &dev_attr_scrub_pages.attr.attr,
         NULL
 };
 
diff --git a/drivers/xen/xenbus/xenbus_probe.c b/drivers/xen/xenbus/xenbus_probe.c
index f2088838f690..5b471889d723 100644
--- a/drivers/xen/xenbus/xenbus_probe.c
+++ b/drivers/xen/xenbus/xenbus_probe.c
@@ -402,10 +402,19 @@ static ssize_t modalias_show(struct device *dev,
 }
 static DEVICE_ATTR_RO(modalias);
 
+static ssize_t state_show(struct device *dev,
+                            struct device_attribute *attr, char *buf)
+{
+        return sprintf(buf, "%s\n",
+                        xenbus_strstate(to_xenbus_device(dev)->state));
+}
+static DEVICE_ATTR_RO(state);
+
 static struct attribute *xenbus_dev_attrs[] = {
         &dev_attr_nodename.attr,
         &dev_attr_devtype.attr,
         &dev_attr_modalias.attr,
+        &dev_attr_state.attr,
         NULL,
 };