282 files changed, 2948 insertions, 1609 deletions

diff --git a/drivers/acpi/button.c b/drivers/acpi/button.c
index b7c2a06963d6..25aba9b107dd 100644
--- a/drivers/acpi/button.c
+++ b/drivers/acpi/button.c
@@ -57,6 +57,7 @@
 
 #define ACPI_BUTTON_LID_INIT_IGNORE     0x00
 #define ACPI_BUTTON_LID_INIT_OPEN       0x01
+#define ACPI_BUTTON_LID_INIT_METHOD     0x02
 
 #define _COMPONENT              ACPI_BUTTON_COMPONENT
 ACPI_MODULE_NAME("button");
@@ -376,6 +377,9 @@ static void acpi_lid_initialize_state(struct acpi_device *device)
         case ACPI_BUTTON_LID_INIT_OPEN:
                 (void)acpi_lid_notify_state(device, 1);
                 break;
+        case ACPI_BUTTON_LID_INIT_METHOD:
+                (void)acpi_lid_update_state(device);
+                break;
         case ACPI_BUTTON_LID_INIT_IGNORE:
         default:
                 break;
@@ -560,6 +564,9 @@ static int param_set_lid_init_state(const char *val, struct kernel_param *kp)
         if (!strncmp(val, "open", sizeof("open") - 1)) {
                 lid_init_state = ACPI_BUTTON_LID_INIT_OPEN;
                 pr_info("Notify initial lid state as open\n");
+        } else if (!strncmp(val, "method", sizeof("method") - 1)) {
+                lid_init_state = ACPI_BUTTON_LID_INIT_METHOD;
+                pr_info("Notify initial lid state with _LID return value\n");
         } else if (!strncmp(val, "ignore", sizeof("ignore") - 1)) {
                 lid_init_state = ACPI_BUTTON_LID_INIT_IGNORE;
                 pr_info("Do not notify initial lid state\n");
@@ -573,6 +580,8 @@ static int param_get_lid_init_state(char *buffer, struct kernel_param *kp)
         switch (lid_init_state) {
         case ACPI_BUTTON_LID_INIT_OPEN:
                 return sprintf(buffer, "open");
+        case ACPI_BUTTON_LID_INIT_METHOD:
+                return sprintf(buffer, "method");
         case ACPI_BUTTON_LID_INIT_IGNORE:
                 return sprintf(buffer, "ignore");
         default:
diff --git a/drivers/acpi/nfit/mce.c b/drivers/acpi/nfit/mce.c
index 3ba1c3472cf9..fd86bec98dea 100644
--- a/drivers/acpi/nfit/mce.c
+++ b/drivers/acpi/nfit/mce.c
@@ -26,7 +26,7 @@ static int nfit_handle_mce(struct notifier_block *nb, unsigned long val,
         struct nfit_spa *nfit_spa;
 
         /* We only care about memory errors */
-        if (!(mce->status & MCACOD))
+        if (!mce_is_memory_error(mce))
                 return NOTIFY_DONE;
 
         /*
diff --git a/drivers/base/power/wakeup.c b/drivers/base/power/wakeup.c
index f62082fdd670..9c36b27996fc 100644
--- a/drivers/base/power/wakeup.c
+++ b/drivers/base/power/wakeup.c
@@ -512,13 +512,12 @@ static bool wakeup_source_not_registered(struct wakeup_source *ws)
 /**
  * wakup_source_activate - Mark given wakeup source as active.
  * @ws: Wakeup source to handle.
- * @hard: If set, abort suspends in progress and wake up from suspend-to-idle.
  *
  * Update the @ws' statistics and, if @ws has just been activated, notify the PM
  * core of the event by incrementing the counter of of wakeup events being
  * processed.
  */
-static void wakeup_source_activate(struct wakeup_source *ws, bool hard)
+static void wakeup_source_activate(struct wakeup_source *ws)
 {
         unsigned int cec;
 
@@ -526,9 +525,6 @@ static void wakeup_source_activate(struct wakeup_source *ws, bool hard)
                         "unregistered wakeup source\n"))
                 return;
 
-        if (hard)
-                pm_system_wakeup();
-
         ws->active = true;
         ws->active_count++;
         ws->last_time = ktime_get();
@@ -554,7 +550,10 @@ static void wakeup_source_report_event(struct wakeup_source *ws, bool hard)
                 ws->wakeup_count++;
 
         if (!ws->active)
-                wakeup_source_activate(ws, hard);
+                wakeup_source_activate(ws);
+
+        if (hard)
+                pm_system_wakeup();
 }
 
 /**
diff --git a/drivers/block/drbd/drbd_req.c b/drivers/block/drbd/drbd_req.c
index b5730e17b455..656624314f0d 100644
--- a/drivers/block/drbd/drbd_req.c
+++ b/drivers/block/drbd/drbd_req.c
@@ -315,24 +315,32 @@ void drbd_req_complete(struct drbd_request *req, struct bio_and_error *m)
 }
 
 /* still holds resource->req_lock */
-static int drbd_req_put_completion_ref(struct drbd_request *req, struct bio_and_error *m, int put)
+static void drbd_req_put_completion_ref(struct drbd_request *req, struct bio_and_error *m, int put)
 {
         struct drbd_device *device = req->device;
         D_ASSERT(device, m || (req->rq_state & RQ_POSTPONED));
 
+        if (!put)
+                return;
+
         if (!atomic_sub_and_test(put, &req->completion_ref))
-                return 0;
+                return;
 
         drbd_req_complete(req, m);
 
+        /* local completion may still come in later,
+         * we need to keep the req object around. */
+        if (req->rq_state & RQ_LOCAL_ABORTED)
+                return;
+
         if (req->rq_state & RQ_POSTPONED) {
                 /* don't destroy the req object just yet,
                  * but queue it for retry */
                 drbd_restart_request(req);
-                return 0;
+                return;
         }
 
-        return 1;
+        kref_put(&req->kref, drbd_req_destroy);
 }
 
 static void set_if_null_req_next(struct drbd_peer_device *peer_device, struct drbd_request *req)
@@ -519,12 +527,8 @@ static void mod_rq_state(struct drbd_request *req, struct bio_and_error *m,
         if (req->i.waiting)
                 wake_up(&device->misc_wait);
 
-        if (c_put) {
-                if (drbd_req_put_completion_ref(req, m, c_put))
-                        kref_put(&req->kref, drbd_req_destroy);
-        } else {
-                kref_put(&req->kref, drbd_req_destroy);
-        }
+        drbd_req_put_completion_ref(req, m, c_put);
+        kref_put(&req->kref, drbd_req_destroy);
 }
 
 static void drbd_report_io_error(struct drbd_device *device, struct drbd_request *req)
@@ -1366,8 +1370,7 @@ nodata:
         }
 
 out:
-        if (drbd_req_put_completion_ref(req, &m, 1))
-                kref_put(&req->kref, drbd_req_destroy);
+        drbd_req_put_completion_ref(req, &m, 1);
         spin_unlock_irq(&resource->req_lock);
 
         /* Even though above is a kref_put(), this is safe.
diff --git a/drivers/block/xen-blkback/xenbus.c b/drivers/block/xen-blkback/xenbus.c
index 8fe61b5dc5a6..1f3dfaa54d87 100644
--- a/drivers/block/xen-blkback/xenbus.c
+++ b/drivers/block/xen-blkback/xenbus.c
@@ -504,11 +504,13 @@ static int xen_blkbk_remove(struct xenbus_device *dev)
 
         dev_set_drvdata(&dev->dev, NULL);
 
-        if (be->blkif)
+        if (be->blkif) {
                 xen_blkif_disconnect(be->blkif);
 
-        /* Put the reference we set in xen_blkif_alloc(). */
-        xen_blkif_put(be->blkif);
+                /* Put the reference we set in xen_blkif_alloc(). */
+                xen_blkif_put(be->blkif);
+        }
+
         kfree(be->mode);
         kfree(be);
         return 0;
diff --git a/drivers/char/lp.c b/drivers/char/lp.c
index 565e4cf04a02..8249762192d5 100644
--- a/drivers/char/lp.c
+++ b/drivers/char/lp.c
@@ -859,7 +859,11 @@ static int __init lp_setup (char *str)
         } else if (!strcmp(str, "auto")) {
                 parport_nr[0] = LP_PARPORT_AUTO;
         } else if (!strcmp(str, "none")) {
-                parport_nr[parport_ptr++] = LP_PARPORT_NONE;
+                if (parport_ptr < LP_NO)
+                        parport_nr[parport_ptr++] = LP_PARPORT_NONE;
+                else
+                        printk(KERN_INFO "lp: too many ports, %s ignored.\n",
+                               str);
         } else if (!strcmp(str, "reset")) {
                 reset = 1;
         }
diff --git a/drivers/char/mem.c b/drivers/char/mem.c
index 7e4a9d1296bb..6e0cbe092220 100644
--- a/drivers/char/mem.c
+++ b/drivers/char/mem.c
@@ -340,6 +340,11 @@ static const struct vm_operations_struct mmap_mem_ops = {
 static int mmap_mem(struct file *file, struct vm_area_struct *vma)
 {
         size_t size = vma->vm_end - vma->vm_start;
+        phys_addr_t offset = (phys_addr_t)vma->vm_pgoff << PAGE_SHIFT;
+
+        /* It's illegal to wrap around the end of the physical address space. */
+        if (offset + (phys_addr_t)size < offset)
+                return -EINVAL;
 
         if (!valid_mmap_phys_addr_range(vma->vm_pgoff, size))
                 return -EINVAL;
diff --git a/drivers/cpufreq/Kconfig.arm b/drivers/cpufreq/Kconfig.arm
index 74ed7e9a7f27..2011fec2d6ad 100644
--- a/drivers/cpufreq/Kconfig.arm
+++ b/drivers/cpufreq/Kconfig.arm
@@ -71,6 +71,15 @@ config ARM_HIGHBANK_CPUFREQ
 
           If in doubt, say N.
 
+config ARM_DB8500_CPUFREQ
+        tristate "ST-Ericsson DB8500 cpufreq" if COMPILE_TEST && !ARCH_U8500
+        default ARCH_U8500
+        depends on HAS_IOMEM
+        depends on !CPU_THERMAL || THERMAL
+        help
+          This adds the CPUFreq driver for ST-Ericsson Ux500 (DB8500) SoC
+          series.
+
 config ARM_IMX6Q_CPUFREQ
         tristate "Freescale i.MX6 cpufreq support"
         depends on ARCH_MXC
diff --git a/drivers/cpufreq/Makefile b/drivers/cpufreq/Makefile
index b7e78f063c4f..ab3a42cd29ef 100644
--- a/drivers/cpufreq/Makefile
+++ b/drivers/cpufreq/Makefile
@@ -53,7 +53,7 @@ obj-$(CONFIG_ARM_DT_BL_CPUFREQ)		+= arm_big_little_dt.o
 
 obj-$(CONFIG_ARM_BRCMSTB_AVS_CPUFREQ)   += brcmstb-avs-cpufreq.o
 obj-$(CONFIG_ARCH_DAVINCI)              += davinci-cpufreq.o
-obj-$(CONFIG_UX500_SOC_DB8500)          += dbx500-cpufreq.o
+obj-$(CONFIG_ARM_DB8500_CPUFREQ)        += dbx500-cpufreq.o
 obj-$(CONFIG_ARM_EXYNOS5440_CPUFREQ)    += exynos5440-cpufreq.o
 obj-$(CONFIG_ARM_HIGHBANK_CPUFREQ)      += highbank-cpufreq.o
 obj-$(CONFIG_ARM_IMX6Q_CPUFREQ)         += imx6q-cpufreq.o
diff --git a/drivers/dax/super.c b/drivers/dax/super.c
index ebf43f531ada..6ed32aac8bbe 100644
--- a/drivers/dax/super.c
+++ b/drivers/dax/super.c
@@ -44,6 +44,7 @@ void dax_read_unlock(int id)
 }
 EXPORT_SYMBOL_GPL(dax_read_unlock);
 
+#ifdef CONFIG_BLOCK
 int bdev_dax_pgoff(struct block_device *bdev, sector_t sector, size_t size,
                 pgoff_t *pgoff)
 {
@@ -112,6 +113,7 @@ int __bdev_dax_supported(struct super_block *sb, int blocksize)
         return 0;
 }
 EXPORT_SYMBOL_GPL(__bdev_dax_supported);
+#endif
 
 /**
  * struct dax_device - anchor object for dax services
diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c
index 82dab1692264..3aea55698165 100644
--- a/drivers/edac/amd64_edac.c
+++ b/drivers/edac/amd64_edac.c
@@ -782,24 +782,26 @@ static void debug_dump_dramcfg_low(struct amd64_pvt *pvt, u32 dclr, int chan)
 
 static void debug_display_dimm_sizes_df(struct amd64_pvt *pvt, u8 ctrl)
 {
-        u32 *dcsb = ctrl ? pvt->csels[1].csbases : pvt->csels[0].csbases;
-        int dimm, size0, size1;
+        int dimm, size0, size1, cs0, cs1;
 
         edac_printk(KERN_DEBUG, EDAC_MC, "UMC%d chip selects:\n", ctrl);
 
         for (dimm = 0; dimm < 4; dimm++) {
                 size0 = 0;
+                cs0 = dimm * 2;
 
-                if (dcsb[dimm*2] & DCSB_CS_ENABLE)
-                        size0 = pvt->ops->dbam_to_cs(pvt, ctrl, 0, dimm);
+                if (csrow_enabled(cs0, ctrl, pvt))
+                        size0 = pvt->ops->dbam_to_cs(pvt, ctrl, 0, cs0);
 
                 size1 = 0;
-                if (dcsb[dimm*2 + 1] & DCSB_CS_ENABLE)
-                        size1 = pvt->ops->dbam_to_cs(pvt, ctrl, 0, dimm);
+                cs1 = dimm * 2 + 1;
+
+                if (csrow_enabled(cs1, ctrl, pvt))
+                        size1 = pvt->ops->dbam_to_cs(pvt, ctrl, 0, cs1);
 
                 amd64_info(EDAC_MC ": %d: %5dMB %d: %5dMB\n",
-                                dimm * 2,     size0,
-                                dimm * 2 + 1, size1);
+                                cs0,    size0,
+                                cs1,    size1);
         }
 }
 
@@ -2756,26 +2758,22 @@ skip:
  *      encompasses
  *
  */
-static u32 get_csrow_nr_pages(struct amd64_pvt *pvt, u8 dct, int csrow_nr)
+static u32 get_csrow_nr_pages(struct amd64_pvt *pvt, u8 dct, int csrow_nr_orig)
 {
-        u32 cs_mode, nr_pages;
         u32 dbam = dct ? pvt->dbam1 : pvt->dbam0;
+        int csrow_nr = csrow_nr_orig;
+        u32 cs_mode, nr_pages;
 
+        if (!pvt->umc)
+                csrow_nr >>= 1;
 
-        /*
-         * The math on this doesn't look right on the surface because x/2*4 can
-         * be simplified to x*2 but this expression makes use of the fact that
-         * it is integral math where 1/2=0. This intermediate value becomes the
-         * number of bits to shift the DBAM register to extract the proper CSROW
-         * field.
-         */
-        cs_mode = DBAM_DIMM(csrow_nr / 2, dbam);
+        cs_mode = DBAM_DIMM(csrow_nr, dbam);
 
-        nr_pages = pvt->ops->dbam_to_cs(pvt, dct, cs_mode, (csrow_nr / 2))
-                                                           << (20 - PAGE_SHIFT);
+        nr_pages   = pvt->ops->dbam_to_cs(pvt, dct, cs_mode, csrow_nr);
+        nr_pages <<= 20 - PAGE_SHIFT;
 
         edac_dbg(0, "csrow: %d, channel: %d, DBAM idx: %d\n",
-                    csrow_nr, dct,  cs_mode);
+                    csrow_nr_orig, dct,  cs_mode);
         edac_dbg(0, "nr_pages/channel: %u\n", nr_pages);
 
         return nr_pages;
diff --git a/drivers/firmware/efi/efi-pstore.c b/drivers/firmware/efi/efi-pstore.c
index ed3137c1ceb0..ef1fafdad400 100644
--- a/drivers/firmware/efi/efi-pstore.c
+++ b/drivers/firmware/efi/efi-pstore.c
@@ -53,6 +53,7 @@ static int efi_pstore_read_func(struct efivar_entry *entry,
         if (sscanf(name, "dump-type%u-%u-%d-%lu-%c",
                    &record->type, &part, &cnt, &time, &data_type) == 5) {
                 record->id = generic_id(time, part, cnt);
+                record->part = part;
                 record->count = cnt;
                 record->time.tv_sec = time;
                 record->time.tv_nsec = 0;
@@ -64,6 +65,7 @@ static int efi_pstore_read_func(struct efivar_entry *entry,
         } else if (sscanf(name, "dump-type%u-%u-%d-%lu",
                    &record->type, &part, &cnt, &time) == 4) {
                 record->id = generic_id(time, part, cnt);
+                record->part = part;
                 record->count = cnt;
                 record->time.tv_sec = time;
                 record->time.tv_nsec = 0;
@@ -77,6 +79,7 @@ static int efi_pstore_read_func(struct efivar_entry *entry,
                  * multiple logs, remains.
                  */
                 record->id = generic_id(time, part, 0);
+                record->part = part;
                 record->count = 0;
                 record->time.tv_sec = time;
                 record->time.tv_nsec = 0;
@@ -155,19 +158,14 @@ static int efi_pstore_scan_sysfs_exit(struct efivar_entry *pos,
  * efi_pstore_sysfs_entry_iter
  *
  * @record: pstore record to pass to callback
- * @pos: entry to begin iterating from
  *
  * You MUST call efivar_enter_iter_begin() before this function, and
  * efivar_entry_iter_end() afterwards.
  *
- * It is possible to begin iteration from an arbitrary entry within
- * the list by passing @pos. @pos is updated on return to point to
- * the next entry of the last one passed to efi_pstore_read_func().
- * To begin iterating from the beginning of the list @pos must be %NULL.
  */
-static int efi_pstore_sysfs_entry_iter(struct pstore_record *record,
-                                       struct efivar_entry **pos)
+static int efi_pstore_sysfs_entry_iter(struct pstore_record *record)
 {
+        struct efivar_entry **pos = (struct efivar_entry **)&record->psi->data;
         struct efivar_entry *entry, *n;
         struct list_head *head = &efivar_sysfs_list;
         int size = 0;
@@ -218,7 +216,6 @@ static int efi_pstore_sysfs_entry_iter(struct pstore_record *record,
  */
 static ssize_t efi_pstore_read(struct pstore_record *record)
 {
-        struct efivar_entry *entry = (struct efivar_entry *)record->psi->data;
         ssize_t size;
 
         record->buf = kzalloc(EFIVARS_DATA_SIZE_MAX, GFP_KERNEL);
@@ -229,7 +226,7 @@ static ssize_t efi_pstore_read(struct pstore_record *record)
                 size = -EINTR;
                 goto out;
         }
-        size = efi_pstore_sysfs_entry_iter(record, &entry);
+        size = efi_pstore_sysfs_entry_iter(record);
         efivar_entry_iter_end();
 
 out:
@@ -247,9 +244,15 @@ static int efi_pstore_write(struct pstore_record *record)
         efi_guid_t vendor = LINUX_EFI_CRASH_GUID;
         int i, ret = 0;
 
+        record->time.tv_sec = get_seconds();
+        record->time.tv_nsec = 0;
+
+        record->id = generic_id(record->time.tv_sec, record->part,
+                                record->count);
+
         snprintf(name, sizeof(name), "dump-type%u-%u-%d-%lu-%c",
                  record->type, record->part, record->count,
-                 get_seconds(), record->compressed ? 'C' : 'D');
+                 record->time.tv_sec, record->compressed ? 'C' : 'D');
 
         for (i = 0; i < DUMP_NAME_LEN; i++)
                 efi_name[i] = name[i];
@@ -261,7 +264,6 @@ static int efi_pstore_write(struct pstore_record *record)
         if (record->reason == KMSG_DUMP_OOPS)
                 efivar_run_worker();
 
-        record->id = record->part;
         return ret;
 };
 
@@ -293,7 +295,7 @@ static int efi_pstore_erase_func(struct efivar_entry *entry, void *data)
                  * holding multiple logs, remains.
                  */
                 snprintf(name_old, sizeof(name_old), "dump-type%u-%u-%lu",
-                        ed->record->type, (unsigned int)ed->record->id,
+                        ed->record->type, ed->record->part,
                         ed->record->time.tv_sec);
 
                 for (i = 0; i < DUMP_NAME_LEN; i++)
@@ -326,10 +328,7 @@ static int efi_pstore_erase(struct pstore_record *record)
         char name[DUMP_NAME_LEN];
         efi_char16_t efi_name[DUMP_NAME_LEN];
         int found, i;
-        unsigned int part;
 
-        do_div(record->id, 1000);
-        part = do_div(record->id, 100);
         snprintf(name, sizeof(name), "dump-type%u-%u-%d-%lu",
                  record->type, record->part, record->count,
                  record->time.tv_sec);
diff --git a/drivers/firmware/google/vpd.c b/drivers/firmware/google/vpd.c
index 3ce813110d5e..1e7860f02f4f 100644
--- a/drivers/firmware/google/vpd.c
+++ b/drivers/firmware/google/vpd.c
@@ -116,9 +116,13 @@ static int vpd_section_attrib_add(const u8 *key, s32 key_len,
                 return VPD_OK;
 
         info = kzalloc(sizeof(*info), GFP_KERNEL);
-        info->key = kzalloc(key_len + 1, GFP_KERNEL);
-        if (!info->key)
+        if (!info)
                 return -ENOMEM;
+        info->key = kzalloc(key_len + 1, GFP_KERNEL);
+        if (!info->key) {
+                ret = -ENOMEM;
+                goto free_info;
+        }
 
         memcpy(info->key, key, key_len);
 
@@ -135,12 +139,17 @@ static int vpd_section_attrib_add(const u8 *key, s32 key_len,
         list_add_tail(&info->list, &sec->attribs);
 
         ret = sysfs_create_bin_file(sec->kobj, &info->bin_attr);
-        if (ret) {
-                kfree(info->key);
-                return ret;
-        }
+        if (ret)
+                goto free_info_key;
 
         return 0;
+
+free_info_key:
+        kfree(info->key);
+free_info:
+        kfree(info);
+
+        return ret;
 }
 
 static void vpd_section_attrib_destroy(struct vpd_section *sec)
diff --git a/drivers/firmware/ti_sci.c b/drivers/firmware/ti_sci.c
index 874ff32db366..00cfed3c3e1a 100644
--- a/drivers/firmware/ti_sci.c
+++ b/drivers/firmware/ti_sci.c
@@ -202,7 +202,8 @@ static int ti_sci_debugfs_create(struct platform_device *pdev,
         info->debug_buffer[info->debug_region_size] = 0;
 
         info->d = debugfs_create_file(strncat(debug_name, dev_name(dev),
-                                              sizeof(debug_name)),
+                                              sizeof(debug_name) -
+                                              sizeof("ti_sci_debug@")),
                                       0444, NULL, info, &ti_sci_debug_fops);
         if (IS_ERR(info->d))
                 return PTR_ERR(info->d);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c
index 236d9950221b..c0d8c6ff6380 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c
@@ -425,10 +425,15 @@ bool amdgpu_fbdev_robj_is_fb(struct amdgpu_device *adev, struct amdgpu_bo *robj)
 
 void amdgpu_fbdev_restore_mode(struct amdgpu_device *adev)
 {
-        struct amdgpu_fbdev *afbdev = adev->mode_info.rfbdev;
+        struct amdgpu_fbdev *afbdev;
         struct drm_fb_helper *fb_helper;
         int ret;
 
+        if (!adev)
+                return;
+
+        afbdev = adev->mode_info.rfbdev;
+
         if (!afbdev)
                 return;
 
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
index 749a6cde7985..83c172a6e938 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
@@ -635,7 +635,7 @@ int amdgpu_vm_flush(struct amdgpu_ring *ring, struct amdgpu_job *job)
                 mutex_unlock(&id_mgr->lock);
         }
 
-        if (gds_switch_needed) {
+        if (ring->funcs->emit_gds_switch && gds_switch_needed) {
                 id->gds_base = job->gds_base;
                 id->gds_size = job->gds_size;
                 id->gws_base = job->gws_base;
@@ -673,6 +673,7 @@ void amdgpu_vm_reset_id(struct amdgpu_device *adev, unsigned vmhub,
         struct amdgpu_vm_id_manager *id_mgr = &adev->vm_manager.id_mgr[vmhub];
         struct amdgpu_vm_id *id = &id_mgr->ids[vmid];
 
+        atomic64_set(&id->owner, 0);
         id->gds_base = 0;
         id->gds_size = 0;
         id->gws_base = 0;
@@ -682,6 +683,26 @@ void amdgpu_vm_reset_id(struct amdgpu_device *adev, unsigned vmhub,
 }
 
 /**
+ * amdgpu_vm_reset_all_id - reset VMID to zero
+ *
+ * @adev: amdgpu device structure
+ *
+ * Reset VMID to force flush on next use
+ */
+void amdgpu_vm_reset_all_ids(struct amdgpu_device *adev)
+{
+        unsigned i, j;
+
+        for (i = 0; i < AMDGPU_MAX_VMHUBS; ++i) {
+                struct amdgpu_vm_id_manager *id_mgr =
+                        &adev->vm_manager.id_mgr[i];
+
+                for (j = 1; j < id_mgr->num_ids; ++j)
+                        amdgpu_vm_reset_id(adev, i, j);
+        }
+}
+
+/**
  * amdgpu_vm_bo_find - find the bo_va for a specific vm & bo
  *
  * @vm: requested vm
@@ -2271,7 +2292,6 @@ void amdgpu_vm_manager_init(struct amdgpu_device *adev)
         for (i = 0; i < AMDGPU_MAX_RINGS; ++i)
                 adev->vm_manager.seqno[i] = 0;
 
-
         atomic_set(&adev->vm_manager.vm_pte_next_ring, 0);
         atomic64_set(&adev->vm_manager.client_counter, 0);
         spin_lock_init(&adev->vm_manager.prt_lock);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h
index d97e28b4bdc4..e1d951ece433 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h
@@ -204,6 +204,7 @@ int amdgpu_vm_grab_id(struct amdgpu_vm *vm, struct amdgpu_ring *ring,
 int amdgpu_vm_flush(struct amdgpu_ring *ring, struct amdgpu_job *job);
 void amdgpu_vm_reset_id(struct amdgpu_device *adev, unsigned vmhub,
                         unsigned vmid);
+void amdgpu_vm_reset_all_ids(struct amdgpu_device *adev);
 int amdgpu_vm_update_directories(struct amdgpu_device *adev,
                                  struct amdgpu_vm *vm);
 int amdgpu_vm_clear_freed(struct amdgpu_device *adev,
diff --git a/drivers/gpu/drm/amd/amdgpu/ci_dpm.c b/drivers/gpu/drm/amd/amdgpu/ci_dpm.c
index 00e56a28b593..cb508a211b2f 100644
--- a/drivers/gpu/drm/amd/amdgpu/ci_dpm.c
+++ b/drivers/gpu/drm/amd/amdgpu/ci_dpm.c
@@ -906,6 +906,12 @@ static bool ci_dpm_vblank_too_short(struct amdgpu_device *adev)
         u32 vblank_time = amdgpu_dpm_get_vblank_time(adev);
         u32 switch_limit = adev->mc.vram_type == AMDGPU_VRAM_TYPE_GDDR5 ? 450 : 300;
 
+        /* disable mclk switching if the refresh is >120Hz, even if the
+         * blanking period would allow it
+         */
+        if (amdgpu_dpm_get_vrefresh(adev) > 120)
+                return true;
+
         if (vblank_time < switch_limit)
                 return true;
         else
diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c
index 2a3983036a30..9776ad3d2d71 100644
--- a/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c
@@ -950,10 +950,6 @@ static int gmc_v6_0_suspend(void *handle)
 {
         struct amdgpu_device *adev = (struct amdgpu_device *)handle;
 
-        if (adev->vm_manager.enabled) {
-                gmc_v6_0_vm_fini(adev);
-                adev->vm_manager.enabled = false;
-        }
         gmc_v6_0_hw_fini(adev);
 
         return 0;
@@ -968,16 +964,9 @@ static int gmc_v6_0_resume(void *handle)
         if (r)
                 return r;
 
-        if (!adev->vm_manager.enabled) {
-                r = gmc_v6_0_vm_init(adev);
-                if (r) {
-                        dev_err(adev->dev, "vm manager initialization failed (%d).\n", r);
-                        return r;
-                }
-                adev->vm_manager.enabled = true;
-        }
+        amdgpu_vm_reset_all_ids(adev);
 
-        return r;
+        return 0;
 }
 
 static bool gmc_v6_0_is_idle(void *handle)
diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c
index 6d347c1d2516..fca8e77182c9 100644
--- a/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c
@@ -1117,10 +1117,6 @@ static int gmc_v7_0_suspend(void *handle)
 {
         struct amdgpu_device *adev = (struct amdgpu_device *)handle;
 
-        if (adev->vm_manager.enabled) {
-                gmc_v7_0_vm_fini(adev);
-                adev->vm_manager.enabled = false;
-        }
         gmc_v7_0_hw_fini(adev);
 
         return 0;
@@ -1135,16 +1131,9 @@ static int gmc_v7_0_resume(void *handle)
         if (r)
                 return r;
 
-        if (!adev->vm_manager.enabled) {
-                r = gmc_v7_0_vm_init(adev);
-                if (r) {
-                        dev_err(adev->dev, "vm manager initialization failed (%d).\n", r);
-                        return r;
-                }
-                adev->vm_manager.enabled = true;
-        }
+        amdgpu_vm_reset_all_ids(adev);
 
-        return r;
+        return 0;
 }
 
 static bool gmc_v7_0_is_idle(void *handle)
diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c
index 2784ff49cf56..e9c127037b39 100644
--- a/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c
@@ -1209,10 +1209,6 @@ static int gmc_v8_0_suspend(void *handle)
 {
         struct amdgpu_device *adev = (struct amdgpu_device *)handle;
 
-        if (adev->vm_manager.enabled) {
-                gmc_v8_0_vm_fini(adev);
-                adev->vm_manager.enabled = false;
-        }
         gmc_v8_0_hw_fini(adev);
 
         return 0;
@@ -1227,16 +1223,9 @@ static int gmc_v8_0_resume(void *handle)
         if (r)
                 return r;
 
-        if (!adev->vm_manager.enabled) {
-                r = gmc_v8_0_vm_init(adev);
-                if (r) {
-                        dev_err(adev->dev, "vm manager initialization failed (%d).\n", r);
-                        return r;
-                }
-                adev->vm_manager.enabled = true;
-        }
+        amdgpu_vm_reset_all_ids(adev);
 
-        return r;
+        return 0;
 }
 
 static bool gmc_v8_0_is_idle(void *handle)
diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
index dc1e1c1d6b24..f936332a069d 100644
--- a/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
@@ -791,10 +791,6 @@ static int gmc_v9_0_suspend(void *handle)
 {
         struct amdgpu_device *adev = (struct amdgpu_device *)handle;
 
-        if (adev->vm_manager.enabled) {
-                gmc_v9_0_vm_fini(adev);
-                adev->vm_manager.enabled = false;
-        }
         gmc_v9_0_hw_fini(adev);
 
         return 0;
@@ -809,17 +805,9 @@ static int gmc_v9_0_resume(void *handle)
         if (r)
                 return r;
 
-        if (!adev->vm_manager.enabled) {
-                r = gmc_v9_0_vm_init(adev);
-                if (r) {
-                        dev_err(adev->dev,
-                                "vm manager initialization failed (%d).\n", r);
-                        return r;
-                }
-                adev->vm_manager.enabled = true;
-        }
+        amdgpu_vm_reset_all_ids(adev);
 
-        return r;
+        return 0;
 }
 
 static bool gmc_v9_0_is_idle(void *handle)
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
index 975567f6813d..1f01020ce3a9 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
@@ -2655,6 +2655,28 @@ static int smu7_get_power_state_size(struct pp_hwmgr *hwmgr)
         return sizeof(struct smu7_power_state);
 }
 
+static int smu7_vblank_too_short(struct pp_hwmgr *hwmgr,
+                                 uint32_t vblank_time_us)
+{
+        struct smu7_hwmgr *data = (struct smu7_hwmgr *)(hwmgr->backend);
+        uint32_t switch_limit_us;
+
+        switch (hwmgr->chip_id) {
+        case CHIP_POLARIS10:
+        case CHIP_POLARIS11:
+        case CHIP_POLARIS12:
+                switch_limit_us = data->is_memory_gddr5 ? 190 : 150;
+                break;
+        default:
+                switch_limit_us = data->is_memory_gddr5 ? 450 : 150;
+                break;
+        }
+
+        if (vblank_time_us < switch_limit_us)
+                return true;
+        else
+                return false;
+}
 
 static int smu7_apply_state_adjust_rules(struct pp_hwmgr *hwmgr,
                                 struct pp_power_state *request_ps,
@@ -2669,6 +2691,7 @@ static int smu7_apply_state_adjust_rules(struct pp_hwmgr *hwmgr,
         bool disable_mclk_switching;
         bool disable_mclk_switching_for_frame_lock;
         struct cgs_display_info info = {0};
+        struct cgs_mode_info mode_info = {0};
         const struct phm_clock_and_voltage_limits *max_limits;
         uint32_t i;
         struct smu7_hwmgr *data = (struct smu7_hwmgr *)(hwmgr->backend);
@@ -2677,6 +2700,7 @@ static int smu7_apply_state_adjust_rules(struct pp_hwmgr *hwmgr,
         int32_t count;
         int32_t stable_pstate_sclk = 0, stable_pstate_mclk = 0;
 
+        info.mode_info = &mode_info;
         data->battery_state = (PP_StateUILabel_Battery ==
                         request_ps->classification.ui_label);
 
@@ -2703,8 +2727,6 @@ static int smu7_apply_state_adjust_rules(struct pp_hwmgr *hwmgr,
 
         cgs_get_active_displays_info(hwmgr->device, &info);
 
-        /*TO DO result = PHM_CheckVBlankTime(hwmgr, &vblankTooShort);*/
-
         minimum_clocks.engineClock = hwmgr->display_config.min_core_set_clock;
         minimum_clocks.memoryClock = hwmgr->display_config.min_mem_set_clock;
 
@@ -2769,8 +2791,10 @@ static int smu7_apply_state_adjust_rules(struct pp_hwmgr *hwmgr,
                                     PHM_PlatformCaps_DisableMclkSwitchingForFrameLock);
 
 
-        disable_mclk_switching = (1 < info.display_count) ||
-                                    disable_mclk_switching_for_frame_lock;
+        disable_mclk_switching = ((1 < info.display_count) ||
+                                  disable_mclk_switching_for_frame_lock ||
+                                  smu7_vblank_too_short(hwmgr, mode_info.vblank_time_us) ||
+                                  (mode_info.refresh_rate > 120));
 
         sclk = smu7_ps->performance_levels[0].engine_clock;
         mclk = smu7_ps->performance_levels[0].memory_clock;
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c
index cd7bf6d3859a..ab17350e853d 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c
@@ -4187,7 +4187,7 @@ static int vega10_force_clock_level(struct pp_hwmgr *hwmgr,
                 enum pp_clock_type type, uint32_t mask)
 {
         struct vega10_hwmgr *data = (struct vega10_hwmgr *)(hwmgr->backend);
-        uint32_t i;
+        int i;
 
         if (hwmgr->dpm_level != AMD_DPM_FORCED_LEVEL_MANUAL)
                 return -EINVAL;
diff --git a/drivers/gpu/drm/arm/hdlcd_crtc.c b/drivers/gpu/drm/arm/hdlcd_crtc.c
index 798a3cc480a2..1a3359c0f6cd 100644
--- a/drivers/gpu/drm/arm/hdlcd_crtc.c
+++ b/drivers/gpu/drm/arm/hdlcd_crtc.c
@@ -10,6 +10,7 @@
  */
 
 #include <drm/drmP.h>
+#include <drm/drm_atomic.h>
 #include <drm/drm_atomic_helper.h>
 #include <drm/drm_crtc.h>
 #include <drm/drm_crtc_helper.h>
@@ -226,16 +227,33 @@ static const struct drm_crtc_helper_funcs hdlcd_crtc_helper_funcs = {
 static int hdlcd_plane_atomic_check(struct drm_plane *plane,
                                     struct drm_plane_state *state)
 {
-        u32 src_w, src_h;
+        struct drm_rect clip = { 0 };
+        struct drm_crtc_state *crtc_state;
+        u32 src_h = state->src_h >> 16;
 
-        src_w = state->src_w >> 16;
-        src_h = state->src_h >> 16;
+        /* only the HDLCD_REG_FB_LINE_COUNT register has a limit */
+        if (src_h >= HDLCD_MAX_YRES) {
+                DRM_DEBUG_KMS("Invalid source width: %d\n", src_h);
+                return -EINVAL;
+        }
+
+        if (!state->fb || !state->crtc)
+                return 0;
 
-        /* we can't do any scaling of the plane source */
-        if ((src_w != state->crtc_w) || (src_h != state->crtc_h))
+        crtc_state = drm_atomic_get_existing_crtc_state(state->state,
+                                                        state->crtc);
+        if (!crtc_state) {
+                DRM_DEBUG_KMS("Invalid crtc state\n");
                 return -EINVAL;
+        }
 
-        return 0;
+        clip.x2 = crtc_state->adjusted_mode.hdisplay;
+        clip.y2 = crtc_state->adjusted_mode.vdisplay;
+
+        return drm_plane_helper_check_state(state, &clip,
+                                            DRM_PLANE_HELPER_NO_SCALING,
+                                            DRM_PLANE_HELPER_NO_SCALING,
+                                            false, true);
 }
 
 static void hdlcd_plane_atomic_update(struct drm_plane *plane,
@@ -244,21 +262,20 @@ static void hdlcd_plane_atomic_update(struct drm_plane *plane,
         struct drm_framebuffer *fb = plane->state->fb;
         struct hdlcd_drm_private *hdlcd;
         struct drm_gem_cma_object *gem;
-        u32 src_w, src_h, dest_w, dest_h;
+        u32 src_x, src_y, dest_h;
         dma_addr_t scanout_start;
 
         if (!fb)
                 return;
 
-        src_w = plane->state->src_w >> 16;
-        src_h = plane->state->src_h >> 16;
-        dest_w = plane->state->crtc_w;
-        dest_h = plane->state->crtc_h;
+        src_x = plane->state->src.x1 >> 16;
+        src_y = plane->state->src.y1 >> 16;
+        dest_h = drm_rect_height(&plane->state->dst);
         gem = drm_fb_cma_get_gem_obj(fb, 0);
+
         scanout_start = gem->paddr + fb->offsets[0] +
-                plane->state->crtc_y * fb->pitches[0] +
-                plane->state->crtc_x *
-                fb->format->cpp[0];
+                        src_y * fb->pitches[0] +
+                        src_x * fb->format->cpp[0];
 
         hdlcd = plane->dev->dev_private;
         hdlcd_write(hdlcd, HDLCD_REG_FB_LINE_LENGTH, fb->pitches[0]);
@@ -305,7 +322,6 @@ static struct drm_plane *hdlcd_plane_init(struct drm_device *drm)
                                        formats, ARRAY_SIZE(formats),
                                        DRM_PLANE_TYPE_PRIMARY, NULL);
         if (ret) {
-                devm_kfree(drm->dev, plane);
                 return ERR_PTR(ret);
         }
 
@@ -329,7 +345,6 @@ int hdlcd_setup_crtc(struct drm_device *drm)
                                         &hdlcd_crtc_funcs, NULL);
         if (ret) {
                 hdlcd_plane_destroy(primary);
-                devm_kfree(drm->dev, primary);
                 return ret;
         }
 
diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_output.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_output.c
index 65a3bd7a0c00..423dda2785d4 100644
--- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_output.c
+++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_output.c
@@ -152,8 +152,7 @@ static const struct drm_connector_funcs atmel_hlcdc_panel_connector_funcs = {
         .atomic_destroy_state = drm_atomic_helper_connector_destroy_state,
 };
 
-static int atmel_hlcdc_attach_endpoint(struct drm_device *dev,
-                                       const struct device_node *np)
+static int atmel_hlcdc_attach_endpoint(struct drm_device *dev, int endpoint)
 {
         struct atmel_hlcdc_dc *dc = dev->dev_private;
         struct atmel_hlcdc_rgb_output *output;
@@ -161,6 +160,11 @@ static int atmel_hlcdc_attach_endpoint(struct drm_device *dev,
         struct drm_bridge *bridge;
         int ret;
 
+        ret = drm_of_find_panel_or_bridge(dev->dev->of_node, 0, endpoint,
+                                          &panel, &bridge);
+        if (ret)
+                return ret;
+
         output = devm_kzalloc(dev->dev, sizeof(*output), GFP_KERNEL);
         if (!output)
                 return -EINVAL;
@@ -177,10 +181,6 @@ static int atmel_hlcdc_attach_endpoint(struct drm_device *dev,
 
         output->encoder.possible_crtcs = 0x1;
 
-        ret = drm_of_find_panel_or_bridge(np, 0, 0, &panel, &bridge);
-        if (ret)
-                return ret;
-
         if (panel) {
                 output->connector.dpms = DRM_MODE_DPMS_OFF;
                 output->connector.polled = DRM_CONNECTOR_POLL_CONNECT;
@@ -220,22 +220,14 @@ err_encoder_cleanup:
 
 int atmel_hlcdc_create_outputs(struct drm_device *dev)
 {
-        struct device_node *remote;
-        int ret = -ENODEV;
-        int endpoint = 0;
-
-        while (true) {
-                /* Loop thru possible multiple connections to the output */
-                remote = of_graph_get_remote_node(dev->dev->of_node, 0,
-                                                  endpoint++);
-                if (!remote)
-                        break;
-
-                ret = atmel_hlcdc_attach_endpoint(dev, remote);
-                of_node_put(remote);
-                if (ret)
-                        return ret;
-        }
+        int endpoint, ret = 0;
+
+        for (endpoint = 0; !ret; endpoint++)
+                ret = atmel_hlcdc_attach_endpoint(dev, endpoint);
+
+        /* At least one device was successfully attached.*/
+        if (ret == -ENODEV && endpoint)
+                return 0;
 
         return ret;
 }
diff --git a/drivers/gpu/drm/drm_plane.c b/drivers/gpu/drm/drm_plane.c
index fedd4d60d9cd..5dc8c4350602 100644
--- a/drivers/gpu/drm/drm_plane.c
+++ b/drivers/gpu/drm/drm_plane.c
@@ -948,8 +948,6 @@ retry:
         }
 
 out:
-        if (ret && crtc->funcs->page_flip_target)
-                drm_crtc_vblank_put(crtc);
         if (fb)
                 drm_framebuffer_put(fb);
         if (crtc->primary->old_fb)
@@ -964,5 +962,8 @@ out:
         drm_modeset_drop_locks(&ctx);
         drm_modeset_acquire_fini(&ctx);
 
+        if (ret && crtc->funcs->page_flip_target)
+                drm_crtc_vblank_put(crtc);
+
         return ret;
 }
diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c b/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c
index a13930e1d8c9..ee7069e93eda 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c
@@ -44,6 +44,7 @@ static struct etnaviv_gem_submit *submit_create(struct drm_device *dev,
 
                 /* initially, until copy_from_user() and bo lookup succeeds: */
                 submit->nr_bos = 0;
+                submit->fence = NULL;
 
                 ww_acquire_init(&submit->ticket, &reservation_ww_class);
         }
@@ -294,7 +295,8 @@ static void submit_cleanup(struct etnaviv_gem_submit *submit)
         }
 
         ww_acquire_fini(&submit->ticket);
-        dma_fence_put(submit->fence);
+        if (submit->fence)
+                dma_fence_put(submit->fence);
         kfree(submit);
 }
 
diff --git a/drivers/gpu/drm/gma500/psb_intel_lvds.c b/drivers/gpu/drm/gma500/psb_intel_lvds.c
index 0066fe7e622e..be3eefec5152 100644
--- a/drivers/gpu/drm/gma500/psb_intel_lvds.c
+++ b/drivers/gpu/drm/gma500/psb_intel_lvds.c
@@ -759,20 +759,23 @@ void psb_intel_lvds_init(struct drm_device *dev,
                 if (scan->type & DRM_MODE_TYPE_PREFERRED) {
                         mode_dev->panel_fixed_mode =
                             drm_mode_duplicate(dev, scan);
+                        DRM_DEBUG_KMS("Using mode from DDC\n");
                         goto out;       /* FIXME: check for quirks */
                 }
         }
 
         /* Failed to get EDID, what about VBT? do we need this? */
-        if (mode_dev->vbt_mode)
+        if (dev_priv->lfp_lvds_vbt_mode) {
                 mode_dev->panel_fixed_mode =
-                    drm_mode_duplicate(dev, mode_dev->vbt_mode);
+                        drm_mode_duplicate(dev, dev_priv->lfp_lvds_vbt_mode);
 
-        if (!mode_dev->panel_fixed_mode)
-                if (dev_priv->lfp_lvds_vbt_mode)
-                        mode_dev->panel_fixed_mode =
-                                drm_mode_duplicate(dev,
-                                        dev_priv->lfp_lvds_vbt_mode);
+                if (mode_dev->panel_fixed_mode) {
+                        mode_dev->panel_fixed_mode->type |=
+                                DRM_MODE_TYPE_PREFERRED;
+                        DRM_DEBUG_KMS("Using mode from VBT\n");
+                        goto out;
+                }
+        }
 
         /*
          * If we didn't get EDID, try checking if the panel is already turned
@@ -789,6 +792,7 @@ void psb_intel_lvds_init(struct drm_device *dev,
                 if (mode_dev->panel_fixed_mode) {
                         mode_dev->panel_fixed_mode->type |=
                             DRM_MODE_TYPE_PREFERRED;
+                        DRM_DEBUG_KMS("Using pre-programmed mode\n");
                         goto out;       /* FIXME: check for quirks */
                 }
         }
diff --git a/drivers/gpu/drm/i915/gvt/handlers.c b/drivers/gpu/drm/i915/gvt/handlers.c
index 0ad1a508e2af..c995e540ff96 100644
--- a/drivers/gpu/drm/i915/gvt/handlers.c
+++ b/drivers/gpu/drm/i915/gvt/handlers.c
@@ -1244,7 +1244,7 @@ static int dma_ctrl_write(struct intel_vgpu *vgpu, unsigned int offset,
         mode = vgpu_vreg(vgpu, offset);
 
         if (GFX_MODE_BIT_SET_IN_MASK(mode, START_DMA)) {
-                WARN_ONCE(1, "VM(%d): iGVT-g doesn't supporte GuC\n",
+                WARN_ONCE(1, "VM(%d): iGVT-g doesn't support GuC\n",
                                 vgpu->id);
                 return 0;
         }
diff --git a/drivers/gpu/drm/i915/gvt/render.c b/drivers/gpu/drm/i915/gvt/render.c
index c6e7972ac21d..a5e11d89df2f 100644
--- a/drivers/gpu/drm/i915/gvt/render.c
+++ b/drivers/gpu/drm/i915/gvt/render.c
@@ -340,6 +340,9 @@ void intel_gvt_restore_render_mmio(struct intel_vgpu *vgpu, int ring_id)
                 } else
                         v = mmio->value;
 
+                if (mmio->in_context)
+                        continue;
+
                 I915_WRITE(mmio->reg, v);
                 POSTING_READ(mmio->reg);
 
diff --git a/drivers/gpu/drm/i915/gvt/sched_policy.c b/drivers/gpu/drm/i915/gvt/sched_policy.c
index 79ba4b3440aa..f25ff133865f 100644
--- a/drivers/gpu/drm/i915/gvt/sched_policy.c
+++ b/drivers/gpu/drm/i915/gvt/sched_policy.c
@@ -129,9 +129,13 @@ static void try_to_schedule_next_vgpu(struct intel_gvt *gvt)
         struct vgpu_sched_data *vgpu_data;
         ktime_t cur_time;
 
-        /* no target to schedule */
-        if (!scheduler->next_vgpu)
+        /* no need to schedule if next_vgpu is the same with current_vgpu,
+         * let scheduler chose next_vgpu again by setting it to NULL.
+         */
+        if (scheduler->next_vgpu == scheduler->current_vgpu) {
+                scheduler->next_vgpu = NULL;
                 return;
+        }
 
         /*
          * after the flag is set, workload dispatch thread will
diff --git a/drivers/gpu/drm/nouveau/nouveau_display.c b/drivers/gpu/drm/nouveau/nouveau_display.c
index 6718c84fb862..8d1df5678eaa 100644
--- a/drivers/gpu/drm/nouveau/nouveau_display.c
+++ b/drivers/gpu/drm/nouveau/nouveau_display.c
@@ -337,6 +337,8 @@ nouveau_display_hpd_work(struct work_struct *work)
         pm_runtime_get_sync(drm->dev->dev);
 
         drm_helper_hpd_irq_event(drm->dev);
+        /* enable polling for external displays */
+        drm_kms_helper_poll_enable(drm->dev);
 
         pm_runtime_mark_last_busy(drm->dev->dev);
         pm_runtime_put_sync(drm->dev->dev);
@@ -390,10 +392,6 @@ nouveau_display_init(struct drm_device *dev)
         if (ret)
                 return ret;
 
-        /* enable polling for external displays */
-        if (!dev->mode_config.poll_enabled)
-                drm_kms_helper_poll_enable(dev);
-
         /* enable hotplug interrupts */
         list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
                 struct nouveau_connector *conn = nouveau_connector(connector);
diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c
index c3dc75fee700..6844372366d3 100644
--- a/drivers/gpu/drm/nouveau/nouveau_drm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_drm.c
@@ -502,6 +502,9 @@ nouveau_drm_load(struct drm_device *dev, unsigned long flags)
                 pm_runtime_allow(dev->dev);
                 pm_runtime_mark_last_busy(dev->dev);
                 pm_runtime_put(dev->dev);
+        } else {
+                /* enable polling for external displays */
+                drm_kms_helper_poll_enable(dev);
         }
         return 0;
 
@@ -774,9 +777,6 @@ nouveau_pmops_runtime_resume(struct device *dev)
 
         ret = nouveau_do_resume(drm_dev, true);
 
-        if (!drm_dev->mode_config.poll_enabled)
-                drm_kms_helper_poll_enable(drm_dev);
-
         /* do magic */
         nvif_mask(&device->object, 0x088488, (1 << 25), (1 << 25));
         vga_switcheroo_set_dynamic_switch(pdev, VGA_SWITCHEROO_ON);
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gk104.c b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gk104.c
index 3a24788c3185..a7e55c422501 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gk104.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gk104.c
@@ -148,7 +148,7 @@ gk104_fifo_runlist_commit(struct gk104_fifo *fifo, int runl)
         case NVKM_MEM_TARGET_NCOH: target = 3; break;
         default:
                 WARN_ON(1);
-                return;
+                goto unlock;
         }
 
         nvkm_wr32(device, 0x002270, (nvkm_memory_addr(mem) >> 12) |
@@ -160,6 +160,7 @@ gk104_fifo_runlist_commit(struct gk104_fifo *fifo, int runl)
                                        & 0x00100000),
                                msecs_to_jiffies(2000)) == 0)
                 nvkm_error(subdev, "runlist %d update timeout\n", runl);
+unlock:
         mutex_unlock(&subdev->mutex);
 }
 
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/secboot/ls_ucode_gr.c b/drivers/gpu/drm/nouveau/nvkm/subdev/secboot/ls_ucode_gr.c
index d1cf02d22db1..1b0c793c0192 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/secboot/ls_ucode_gr.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/secboot/ls_ucode_gr.c
@@ -116,6 +116,7 @@ ls_ucode_img_load_gr(const struct nvkm_subdev *subdev, struct ls_ucode_img *img,
         ret = nvkm_firmware_get(subdev->device, f, &sig);
         if (ret)
                 goto free_data;
+
         img->sig = kmemdup(sig->data, sig->size, GFP_KERNEL);
         if (!img->sig) {
                 ret = -ENOMEM;
@@ -126,8 +127,9 @@ ls_ucode_img_load_gr(const struct nvkm_subdev *subdev, struct ls_ucode_img *img,
         img->ucode_data = ls_ucode_img_build(bl, code, data,
                                              &img->ucode_desc);
         if (IS_ERR(img->ucode_data)) {
+                kfree(img->sig);
                 ret = PTR_ERR(img->ucode_data);
-                goto free_data;
+                goto free_sig;
         }
         img->ucode_size = img->ucode_desc.image_size;
 
diff --git a/drivers/gpu/drm/qxl/qxl_display.c b/drivers/gpu/drm/qxl/qxl_display.c
index f5ef81595f5a..03fe182203ce 100644
--- a/drivers/gpu/drm/qxl/qxl_display.c
+++ b/drivers/gpu/drm/qxl/qxl_display.c
@@ -574,8 +574,6 @@ static void qxl_cursor_atomic_update(struct drm_plane *plane,
         if (ret)
                 return;
 
-        cmd = (struct qxl_cursor_cmd *) qxl_release_map(qdev, release);
-
         if (fb != old_state->fb) {
                 obj = to_qxl_framebuffer(fb)->obj;
                 user_bo = gem_to_qxl_bo(obj);
@@ -613,6 +611,7 @@ static void qxl_cursor_atomic_update(struct drm_plane *plane,
                 qxl_bo_kunmap(cursor_bo);
                 qxl_bo_kunmap(user_bo);
 
+                cmd = (struct qxl_cursor_cmd *) qxl_release_map(qdev, release);
                 cmd->u.set.visible = 1;
                 cmd->u.set.shape = qxl_bo_physical_address(qdev,
                                                            cursor_bo, 0);
@@ -623,6 +622,7 @@ static void qxl_cursor_atomic_update(struct drm_plane *plane,
                 if (ret)
                         goto out_free_release;
 
+                cmd = (struct qxl_cursor_cmd *) qxl_release_map(qdev, release);
                 cmd->type = QXL_CURSOR_MOVE;
         }
 
diff --git a/drivers/gpu/drm/radeon/ci_dpm.c b/drivers/gpu/drm/radeon/ci_dpm.c
index f0cf99783c62..c97fbb2ab48b 100644
--- a/drivers/gpu/drm/radeon/ci_dpm.c
+++ b/drivers/gpu/drm/radeon/ci_dpm.c
@@ -776,6 +776,12 @@ bool ci_dpm_vblank_too_short(struct radeon_device *rdev)
         u32 vblank_time = r600_dpm_get_vblank_time(rdev);
         u32 switch_limit = pi->mem_gddr5 ? 450 : 300;
 
+        /* disable mclk switching if the refresh is >120Hz, even if the
+        * blanking period would allow it
+        */
+        if (r600_dpm_get_vrefresh(rdev) > 120)
+                return true;
+
         if (vblank_time < switch_limit)
                 return true;
         else
diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
index e368ce22bcc4..258912132b62 100644
--- a/drivers/gpu/drm/radeon/cik.c
+++ b/drivers/gpu/drm/radeon/cik.c
@@ -7401,7 +7401,7 @@ static inline void cik_irq_ack(struct radeon_device *rdev)
                 WREG32(DC_HPD5_INT_CONTROL, tmp);
         }
         if (rdev->irq.stat_regs.cik.disp_int_cont5 & DC_HPD6_INTERRUPT) {
-                tmp = RREG32(DC_HPD5_INT_CONTROL);
+                tmp = RREG32(DC_HPD6_INT_CONTROL);
                 tmp |= DC_HPDx_INT_ACK;
                 WREG32(DC_HPD6_INT_CONTROL, tmp);
         }
@@ -7431,7 +7431,7 @@ static inline void cik_irq_ack(struct radeon_device *rdev)
                 WREG32(DC_HPD5_INT_CONTROL, tmp);
         }
         if (rdev->irq.stat_regs.cik.disp_int_cont5 & DC_HPD6_RX_INTERRUPT) {
-                tmp = RREG32(DC_HPD5_INT_CONTROL);
+                tmp = RREG32(DC_HPD6_INT_CONTROL);
                 tmp |= DC_HPDx_RX_INT_ACK;
                 WREG32(DC_HPD6_INT_CONTROL, tmp);
         }
diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
index f130ec41ee4b..0bf103536404 100644
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -4927,7 +4927,7 @@ static void evergreen_irq_ack(struct radeon_device *rdev)
                 WREG32(DC_HPD5_INT_CONTROL, tmp);
         }
         if (rdev->irq.stat_regs.evergreen.disp_int_cont5 & DC_HPD6_INTERRUPT) {
-                tmp = RREG32(DC_HPD5_INT_CONTROL);
+                tmp = RREG32(DC_HPD6_INT_CONTROL);
                 tmp |= DC_HPDx_INT_ACK;
                 WREG32(DC_HPD6_INT_CONTROL, tmp);
         }
@@ -4958,7 +4958,7 @@ static void evergreen_irq_ack(struct radeon_device *rdev)
                 WREG32(DC_HPD5_INT_CONTROL, tmp);
         }
         if (rdev->irq.stat_regs.evergreen.disp_int_cont5 & DC_HPD6_RX_INTERRUPT) {
-                tmp = RREG32(DC_HPD5_INT_CONTROL);
+                tmp = RREG32(DC_HPD6_INT_CONTROL);
                 tmp |= DC_HPDx_RX_INT_ACK;
                 WREG32(DC_HPD6_INT_CONTROL, tmp);
         }
diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
index 0a085176e79b..e06e2d8feab3 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -3988,7 +3988,7 @@ static void r600_irq_ack(struct radeon_device *rdev)
                         WREG32(DC_HPD5_INT_CONTROL, tmp);
                 }
                 if (rdev->irq.stat_regs.r600.disp_int_cont2 & DC_HPD6_INTERRUPT) {
-                        tmp = RREG32(DC_HPD5_INT_CONTROL);
+                        tmp = RREG32(DC_HPD6_INT_CONTROL);
                         tmp |= DC_HPDx_INT_ACK;
                         WREG32(DC_HPD6_INT_CONTROL, tmp);
                 }
diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c
index 6a68d440bc44..d0ad03674250 100644
--- a/drivers/gpu/drm/radeon/radeon_kms.c
+++ b/drivers/gpu/drm/radeon/radeon_kms.c
@@ -116,7 +116,7 @@ int radeon_driver_load_kms(struct drm_device *dev, unsigned long flags)
         if ((radeon_runtime_pm != 0) &&
             radeon_has_atpx() &&
             ((flags & RADEON_IS_IGP) == 0) &&
-            !pci_is_thunderbolt_attached(rdev->pdev))
+            !pci_is_thunderbolt_attached(dev->pdev))
                 flags |= RADEON_IS_PX;
 
         /* radeon_device_init should report only fatal error
diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
index ceee87f029d9..76d1888528e6 100644
--- a/drivers/gpu/drm/radeon/si.c
+++ b/drivers/gpu/drm/radeon/si.c
@@ -6317,7 +6317,7 @@ static inline void si_irq_ack(struct radeon_device *rdev)
                 WREG32(DC_HPD5_INT_CONTROL, tmp);
         }
         if (rdev->irq.stat_regs.evergreen.disp_int_cont5 & DC_HPD6_INTERRUPT) {
-                tmp = RREG32(DC_HPD5_INT_CONTROL);
+                tmp = RREG32(DC_HPD6_INT_CONTROL);
                 tmp |= DC_HPDx_INT_ACK;
                 WREG32(DC_HPD6_INT_CONTROL, tmp);
         }
@@ -6348,7 +6348,7 @@ static inline void si_irq_ack(struct radeon_device *rdev)
                 WREG32(DC_HPD5_INT_CONTROL, tmp);
         }
         if (rdev->irq.stat_regs.evergreen.disp_int_cont5 & DC_HPD6_RX_INTERRUPT) {
-                tmp = RREG32(DC_HPD5_INT_CONTROL);
+                tmp = RREG32(DC_HPD6_INT_CONTROL);
                 tmp |= DC_HPDx_RX_INT_ACK;
                 WREG32(DC_HPD6_INT_CONTROL, tmp);
         }
diff --git a/drivers/hwmon/coretemp.c b/drivers/hwmon/coretemp.c
index 3ac4c03ba77b..c13a4fd86b3c 100644
--- a/drivers/hwmon/coretemp.c
+++ b/drivers/hwmon/coretemp.c
@@ -605,6 +605,13 @@ static int coretemp_cpu_online(unsigned int cpu)
         struct platform_data *pdata;
 
         /*
+         * Don't execute this on resume as the offline callback did
+         * not get executed on suspend.
+         */
+        if (cpuhp_tasks_frozen)
+                return 0;
+
+        /*
          * CPUID.06H.EAX[0] indicates whether the CPU has thermal
          * sensors. We check this bit only, all the early CPUs
          * without thermal sensors will be filtered out.
@@ -654,6 +661,13 @@ static int coretemp_cpu_offline(unsigned int cpu)
         struct temp_data *tdata;
         int indx, target;
 
+        /*
+         * Don't execute this on suspend as the device remove locks
+         * up the machine.
+         */
+        if (cpuhp_tasks_frozen)
+                return 0;
+
         /* If the physical CPU device does not exist, just return */
         if (!pdev)
                 return 0;
diff --git a/drivers/i2c/busses/i2c-designware-platdrv.c b/drivers/i2c/busses/i2c-designware-platdrv.c
index f2acd4b6bf01..d1263b82d646 100644
--- a/drivers/i2c/busses/i2c-designware-platdrv.c
+++ b/drivers/i2c/busses/i2c-designware-platdrv.c
@@ -94,6 +94,7 @@ static void dw_i2c_acpi_params(struct platform_device *pdev, char method[],
 static int dw_i2c_acpi_configure(struct platform_device *pdev)
 {
         struct dw_i2c_dev *dev = platform_get_drvdata(pdev);
+        u32 ss_ht = 0, fp_ht = 0, hs_ht = 0, fs_ht = 0;
         acpi_handle handle = ACPI_HANDLE(&pdev->dev);
         const struct acpi_device_id *id;
         struct acpi_device *adev;
@@ -107,23 +108,24 @@ static int dw_i2c_acpi_configure(struct platform_device *pdev)
          * Try to get SDA hold time and *CNT values from an ACPI method for
          * selected speed modes.
          */
+        dw_i2c_acpi_params(pdev, "SSCN", &dev->ss_hcnt, &dev->ss_lcnt, &ss_ht);
+        dw_i2c_acpi_params(pdev, "FPCN", &dev->fp_hcnt, &dev->fp_lcnt, &fp_ht);
+        dw_i2c_acpi_params(pdev, "HSCN", &dev->hs_hcnt, &dev->hs_lcnt, &hs_ht);
+        dw_i2c_acpi_params(pdev, "FMCN", &dev->fs_hcnt, &dev->fs_lcnt, &fs_ht);
+
         switch (dev->clk_freq) {
         case 100000:
-                dw_i2c_acpi_params(pdev, "SSCN", &dev->ss_hcnt, &dev->ss_lcnt,
-                                   &dev->sda_hold_time);
+                dev->sda_hold_time = ss_ht;
                 break;
         case 1000000:
-                dw_i2c_acpi_params(pdev, "FPCN", &dev->fp_hcnt, &dev->fp_lcnt,
-                                   &dev->sda_hold_time);
+                dev->sda_hold_time = fp_ht;
                 break;
         case 3400000:
-                dw_i2c_acpi_params(pdev, "HSCN", &dev->hs_hcnt, &dev->hs_lcnt,
-                                   &dev->sda_hold_time);
+                dev->sda_hold_time = hs_ht;
                 break;
         case 400000:
         default:
-                dw_i2c_acpi_params(pdev, "FMCN", &dev->fs_hcnt, &dev->fs_lcnt,
-                                   &dev->sda_hold_time);
+                dev->sda_hold_time = fs_ht;
                 break;
         }
 
diff --git a/drivers/i2c/busses/i2c-mv64xxx.c b/drivers/i2c/busses/i2c-mv64xxx.c
index cf737ec8563b..5c4db65c5019 100644
--- a/drivers/i2c/busses/i2c-mv64xxx.c
+++ b/drivers/i2c/busses/i2c-mv64xxx.c
@@ -819,7 +819,6 @@ mv64xxx_of_config(struct mv64xxx_i2c_data *drv_data,
                 rc = -EINVAL;
                 goto out;
         }
-        drv_data->irq = irq_of_parse_and_map(np, 0);
 
         drv_data->rstc = devm_reset_control_get_optional(dev, NULL);
         if (IS_ERR(drv_data->rstc)) {
@@ -902,10 +901,11 @@ mv64xxx_i2c_probe(struct platform_device *pd)
         if (!IS_ERR(drv_data->clk))
                 clk_prepare_enable(drv_data->clk);
 
+        drv_data->irq = platform_get_irq(pd, 0);
+
         if (pdata) {
                 drv_data->freq_m = pdata->freq_m;
                 drv_data->freq_n = pdata->freq_n;
-                drv_data->irq = platform_get_irq(pd, 0);
                 drv_data->adapter.timeout = msecs_to_jiffies(pdata->timeout);
                 drv_data->offload_enabled = false;
                 memcpy(&drv_data->reg_offsets, &mv64xxx_i2c_regs_mv64xxx, sizeof(drv_data->reg_offsets));
@@ -915,7 +915,7 @@ mv64xxx_i2c_probe(struct platform_device *pd)
                         goto exit_clk;
         }
         if (drv_data->irq < 0) {
-                rc = -ENXIO;
+                rc = drv_data->irq;
                 goto exit_reset;
         }
 
diff --git a/drivers/i2c/busses/i2c-tiny-usb.c b/drivers/i2c/busses/i2c-tiny-usb.c
index 0ed77eeff31e..a2e3dd715380 100644
--- a/drivers/i2c/busses/i2c-tiny-usb.c
+++ b/drivers/i2c/busses/i2c-tiny-usb.c
@@ -178,22 +178,39 @@ static int usb_read(struct i2c_adapter *adapter, int cmd,
                     int value, int index, void *data, int len)
 {
         struct i2c_tiny_usb *dev = (struct i2c_tiny_usb *)adapter->algo_data;
+        void *dmadata = kmalloc(len, GFP_KERNEL);
+        int ret;
+
+        if (!dmadata)
+                return -ENOMEM;
 
         /* do control transfer */
-        return usb_control_msg(dev->usb_dev, usb_rcvctrlpipe(dev->usb_dev, 0),
+        ret = usb_control_msg(dev->usb_dev, usb_rcvctrlpipe(dev->usb_dev, 0),
                                cmd, USB_TYPE_VENDOR | USB_RECIP_INTERFACE |
-                               USB_DIR_IN, value, index, data, len, 2000);
+                               USB_DIR_IN, value, index, dmadata, len, 2000);
+
+        memcpy(data, dmadata, len);
+        kfree(dmadata);
+        return ret;
 }
 
 static int usb_write(struct i2c_adapter *adapter, int cmd,
                      int value, int index, void *data, int len)
 {
         struct i2c_tiny_usb *dev = (struct i2c_tiny_usb *)adapter->algo_data;
+        void *dmadata = kmemdup(data, len, GFP_KERNEL);
+        int ret;
+
+        if (!dmadata)
+                return -ENOMEM;
 
         /* do control transfer */
-        return usb_control_msg(dev->usb_dev, usb_sndctrlpipe(dev->usb_dev, 0),
+        ret = usb_control_msg(dev->usb_dev, usb_sndctrlpipe(dev->usb_dev, 0),
                                cmd, USB_TYPE_VENDOR | USB_RECIP_INTERFACE,
-                               value, index, data, len, 2000);
+                               value, index, dmadata, len, 2000);
+
+        kfree(dmadata);
+        return ret;
 }
 
 static void i2c_tiny_usb_free(struct i2c_tiny_usb *dev)
diff --git a/drivers/i2c/busses/i2c-xgene-slimpro.c b/drivers/i2c/busses/i2c-xgene-slimpro.c
index dbe7e44c9321..6ba6c83ca8f1 100644
--- a/drivers/i2c/busses/i2c-xgene-slimpro.c
+++ b/drivers/i2c/busses/i2c-xgene-slimpro.c
@@ -416,6 +416,7 @@ static int xgene_slimpro_i2c_probe(struct platform_device *pdev)
         adapter->class = I2C_CLASS_HWMON;
         adapter->dev.parent = &pdev->dev;
         adapter->dev.of_node = pdev->dev.of_node;
+        ACPI_COMPANION_SET(&adapter->dev, ACPI_COMPANION(&pdev->dev));
         i2c_set_adapdata(adapter, ctx);
         rc = i2c_add_adapter(adapter);
         if (rc) {
diff --git a/drivers/i2c/i2c-mux.c b/drivers/i2c/i2c-mux.c
index 26f7237558ba..9669ca4937b8 100644
--- a/drivers/i2c/i2c-mux.c
+++ b/drivers/i2c/i2c-mux.c
@@ -395,18 +395,20 @@ int i2c_mux_add_adapter(struct i2c_mux_core *muxc,
         if (force_nr) {
                 priv->adap.nr = force_nr;
                 ret = i2c_add_numbered_adapter(&priv->adap);
-                dev_err(&parent->dev,
-                        "failed to add mux-adapter %u as bus %u (error=%d)\n",
-                        chan_id, force_nr, ret);
+                if (ret < 0) {
+                        dev_err(&parent->dev,
+                                "failed to add mux-adapter %u as bus %u (error=%d)\n",
+                                chan_id, force_nr, ret);
+                        goto err_free_priv;
+                }
         } else {
                 ret = i2c_add_adapter(&priv->adap);
-                dev_err(&parent->dev,
-                        "failed to add mux-adapter %u (error=%d)\n",
-                        chan_id, ret);
-        }
-        if (ret < 0) {
-                kfree(priv);
-                return ret;
+                if (ret < 0) {
+                        dev_err(&parent->dev,
+                                "failed to add mux-adapter %u (error=%d)\n",
+                                chan_id, ret);
+                        goto err_free_priv;
+                }
         }
 
         WARN(sysfs_create_link(&priv->adap.dev.kobj, &muxc->dev->kobj,
@@ -422,6 +424,10 @@ int i2c_mux_add_adapter(struct i2c_mux_core *muxc,
 
         muxc->adapter[muxc->num_adapters++] = &priv->adap;
         return 0;
+
+err_free_priv:
+        kfree(priv);
+        return ret;
 }
 EXPORT_SYMBOL_GPL(i2c_mux_add_adapter);
 
diff --git a/drivers/i2c/muxes/i2c-mux-reg.c b/drivers/i2c/muxes/i2c-mux-reg.c
index 406d5059072c..d97031804de8 100644
--- a/drivers/i2c/muxes/i2c-mux-reg.c
+++ b/drivers/i2c/muxes/i2c-mux-reg.c
@@ -196,20 +196,25 @@ static int i2c_mux_reg_probe(struct platform_device *pdev)
                 res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
                 mux->data.reg_size = resource_size(res);
                 mux->data.reg = devm_ioremap_resource(&pdev->dev, res);
-                if (IS_ERR(mux->data.reg))
-                        return PTR_ERR(mux->data.reg);
+                if (IS_ERR(mux->data.reg)) {
+                        ret = PTR_ERR(mux->data.reg);
+                        goto err_put_parent;
+                }
         }
 
         if (mux->data.reg_size != 4 && mux->data.reg_size != 2 &&
             mux->data.reg_size != 1) {
                 dev_err(&pdev->dev, "Invalid register size\n");
-                return -EINVAL;
+                ret = -EINVAL;
+                goto err_put_parent;
         }
 
         muxc = i2c_mux_alloc(parent, &pdev->dev, mux->data.n_values, 0, 0,
                              i2c_mux_reg_select, NULL);
-        if (!muxc)
-                return -ENOMEM;
+        if (!muxc) {
+                ret = -ENOMEM;
+                goto err_put_parent;
+        }
         muxc->priv = mux;
 
         platform_set_drvdata(pdev, muxc);
@@ -223,7 +228,7 @@ static int i2c_mux_reg_probe(struct platform_device *pdev)
 
                 ret = i2c_mux_add_adapter(muxc, nr, mux->data.values[i], class);
                 if (ret)
-                        goto add_adapter_failed;
+                        goto err_del_mux_adapters;
         }
 
         dev_dbg(&pdev->dev, "%d port mux on %s adapter\n",
@@ -231,8 +236,10 @@ static int i2c_mux_reg_probe(struct platform_device *pdev)
 
         return 0;
 
-add_adapter_failed:
+err_del_mux_adapters:
         i2c_mux_del_adapters(muxc);
+err_put_parent:
+        i2c_put_adapter(parent);
 
         return ret;
 }
diff --git a/drivers/input/mouse/elan_i2c_i2c.c b/drivers/input/mouse/elan_i2c_i2c.c
index a679e56c44cd..f431da07f861 100644
--- a/drivers/input/mouse/elan_i2c_i2c.c
+++ b/drivers/input/mouse/elan_i2c_i2c.c
@@ -554,32 +554,34 @@ static int elan_i2c_finish_fw_update(struct i2c_client *client,
                                      struct completion *completion)
 {
         struct device *dev = &client->dev;
-        long ret;
         int error;
         int len;
-        u8 buffer[ETP_I2C_INF_LENGTH];
+        u8 buffer[ETP_I2C_REPORT_LEN];
+
+        len = i2c_master_recv(client, buffer, ETP_I2C_REPORT_LEN);
+        if (len != ETP_I2C_REPORT_LEN) {
+                error = len < 0 ? len : -EIO;
+                dev_warn(dev, "failed to read I2C data after FW WDT reset: %d (%d)\n",
+                        error, len);
+        }
 
         reinit_completion(completion);
         enable_irq(client->irq);
 
         error = elan_i2c_write_cmd(client, ETP_I2C_STAND_CMD, ETP_I2C_RESET);
-        if (!error)
-                ret = wait_for_completion_interruptible_timeout(completion,
-                                                        msecs_to_jiffies(300));
-        disable_irq(client->irq);
-
         if (error) {
                 dev_err(dev, "device reset failed: %d\n", error);
-                return error;
-        } else if (ret == 0) {
+        } else if (!wait_for_completion_timeout(completion,
+                                                msecs_to_jiffies(300))) {
                 dev_err(dev, "timeout waiting for device reset\n");
-                return -ETIMEDOUT;
-        } else if (ret < 0) {
-                error = ret;
-                dev_err(dev, "error waiting for device reset: %d\n", error);
-                return error;
+                error = -ETIMEDOUT;
         }
 
+        disable_irq(client->irq);
+
+        if (error)
+                return error;
+
         len = i2c_master_recv(client, buffer, ETP_I2C_INF_LENGTH);
         if (len != ETP_I2C_INF_LENGTH) {
                 error = len < 0 ? len : -EIO;
diff --git a/drivers/input/touchscreen/atmel_mxt_ts.c b/drivers/input/touchscreen/atmel_mxt_ts.c
index 2302aef2b2d4..dd042a9b0aaa 100644
--- a/drivers/input/touchscreen/atmel_mxt_ts.c
+++ b/drivers/input/touchscreen/atmel_mxt_ts.c
@@ -350,6 +350,7 @@ static bool mxt_object_readable(unsigned int type)
         case MXT_TOUCH_KEYARRAY_T15:
         case MXT_TOUCH_PROXIMITY_T23:
         case MXT_TOUCH_PROXKEY_T52:
+        case MXT_TOUCH_MULTITOUCHSCREEN_T100:
         case MXT_PROCI_GRIPFACE_T20:
         case MXT_PROCG_NOISE_T22:
         case MXT_PROCI_ONETOUCH_T24:
diff --git a/drivers/input/touchscreen/edt-ft5x06.c b/drivers/input/touchscreen/edt-ft5x06.c
index 8cf8d8d5d4ef..f872817e81e4 100644
--- a/drivers/input/touchscreen/edt-ft5x06.c
+++ b/drivers/input/touchscreen/edt-ft5x06.c
@@ -471,7 +471,7 @@ static EDT_ATTR(gain, S_IWUSR | S_IRUGO, WORK_REGISTER_GAIN,
 static EDT_ATTR(offset, S_IWUSR | S_IRUGO, WORK_REGISTER_OFFSET,
                 M09_REGISTER_OFFSET, 0, 31);
 static EDT_ATTR(threshold, S_IWUSR | S_IRUGO, WORK_REGISTER_THRESHOLD,
-                M09_REGISTER_THRESHOLD, 20, 80);
+                M09_REGISTER_THRESHOLD, 0, 80);
 static EDT_ATTR(report_rate, S_IWUSR | S_IRUGO, WORK_REGISTER_REPORT_RATE,
                 NO_REGISTER, 3, 14);
 
diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c
index 8348f366ddd1..62618e77bedc 100644
--- a/drivers/iommu/dma-iommu.c
+++ b/drivers/iommu/dma-iommu.c
@@ -396,13 +396,13 @@ static void iommu_dma_free_iova(struct iommu_dma_cookie *cookie,
                 dma_addr_t iova, size_t size)
 {
         struct iova_domain *iovad = &cookie->iovad;
-        unsigned long shift = iova_shift(iovad);
 
         /* The MSI case is only ever cleaning up its most recent allocation */
         if (cookie->type == IOMMU_DMA_MSI_COOKIE)
                 cookie->msi_iova -= size;
         else
-                free_iova_fast(iovad, iova >> shift, size >> shift);
+                free_iova_fast(iovad, iova_pfn(iovad, iova),
+                                size >> iova_shift(iovad));
 }
 
 static void __iommu_dma_unmap(struct iommu_domain *domain, dma_addr_t dma_addr,
@@ -617,11 +617,14 @@ static dma_addr_t __iommu_dma_map(struct device *dev, phys_addr_t phys,
 {
         struct iommu_domain *domain = iommu_get_domain_for_dev(dev);
         struct iommu_dma_cookie *cookie = domain->iova_cookie;
-        struct iova_domain *iovad = &cookie->iovad;
-        size_t iova_off = iova_offset(iovad, phys);
+        size_t iova_off = 0;
         dma_addr_t iova;
 
-        size = iova_align(iovad, size + iova_off);
+        if (cookie->type == IOMMU_DMA_IOVA_COOKIE) {
+                iova_off = iova_offset(&cookie->iovad, phys);
+                size = iova_align(&cookie->iovad, size + iova_off);
+        }
+
         iova = iommu_dma_alloc_iova(domain, size, dma_get_mask(dev), dev);
         if (!iova)
                 return DMA_ERROR_CODE;
diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index 90ab0115d78e..fc2765ccdb57 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -2055,11 +2055,14 @@ static int domain_context_mapping_one(struct dmar_domain *domain,
         if (context_copied(context)) {
                 u16 did_old = context_domain_id(context);
 
-                if (did_old >= 0 && did_old < cap_ndoms(iommu->cap))
+                if (did_old >= 0 && did_old < cap_ndoms(iommu->cap)) {
                         iommu->flush.flush_context(iommu, did_old,
                                                    (((u16)bus) << 8) | devfn,
                                                    DMA_CCMD_MASK_NOBIT,
                                                    DMA_CCMD_DEVICE_INVL);
+                        iommu->flush.flush_iotlb(iommu, did_old, 0, 0,
+                                                 DMA_TLB_DSI_FLUSH);
+                }
         }
 
         pgd = domain->pgd;
diff --git a/drivers/iommu/mtk_iommu_v1.c b/drivers/iommu/mtk_iommu_v1.c
index a27ef570c328..bc1efbfb9ddf 100644
--- a/drivers/iommu/mtk_iommu_v1.c
+++ b/drivers/iommu/mtk_iommu_v1.c
@@ -18,6 +18,7 @@
 #include <linux/clk.h>
 #include <linux/component.h>
 #include <linux/device.h>
+#include <linux/dma-mapping.h>
 #include <linux/dma-iommu.h>
 #include <linux/err.h>
 #include <linux/interrupt.h>
diff --git a/drivers/irqchip/irq-mbigen.c b/drivers/irqchip/irq-mbigen.c
index d2306c821ebb..31d6b5a582d2 100644
--- a/drivers/irqchip/irq-mbigen.c
+++ b/drivers/irqchip/irq-mbigen.c
@@ -106,10 +106,7 @@ static inline void get_mbigen_type_reg(irq_hw_number_t hwirq,
 static inline void get_mbigen_clear_reg(irq_hw_number_t hwirq,
                                         u32 *mask, u32 *addr)
 {
-        unsigned int ofst;
-
-        hwirq -= RESERVED_IRQ_PER_MBIGEN_CHIP;
-        ofst = hwirq / 32 * 4;
+        unsigned int ofst = (hwirq / 32) * 4;
 
         *mask = 1 << (hwirq % 32);
         *addr = ofst + REG_MBIGEN_CLEAR_OFFSET;
@@ -337,9 +334,15 @@ static int mbigen_device_probe(struct platform_device *pdev)
         mgn_chip->pdev = pdev;
 
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-        mgn_chip->base = devm_ioremap_resource(&pdev->dev, res);
-        if (IS_ERR(mgn_chip->base))
-                return PTR_ERR(mgn_chip->base);
+        if (!res)
+                return -EINVAL;
+
+        mgn_chip->base = devm_ioremap(&pdev->dev, res->start,
+                                      resource_size(res));
+        if (!mgn_chip->base) {
+                dev_err(&pdev->dev, "failed to ioremap %pR\n", res);
+                return -ENOMEM;
+        }
 
         if (IS_ENABLED(CONFIG_OF) && pdev->dev.of_node)
                 err = mbigen_of_create_domain(pdev, mgn_chip);
diff --git a/drivers/leds/leds-pca955x.c b/drivers/leds/leds-pca955x.c
index 78a7ce816a47..9a873118ea5f 100644
--- a/drivers/leds/leds-pca955x.c
+++ b/drivers/leds/leds-pca955x.c
@@ -285,7 +285,7 @@ static int pca955x_probe(struct i2c_client *client,
                         "slave address 0x%02x\n",
                         client->name, chip->bits, client->addr);
 
-        if (!i2c_check_functionality(adapter, I2C_FUNC_I2C))
+        if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_BYTE_DATA))
                 return -EIO;
 
         if (pdata) {
diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c
index 5db11a405129..cd8139593ccd 100644
--- a/drivers/md/dm-bufio.c
+++ b/drivers/md/dm-bufio.c
@@ -218,7 +218,7 @@ static DEFINE_SPINLOCK(param_spinlock);
  * Buffers are freed after this timeout
  */
 static unsigned dm_bufio_max_age = DM_BUFIO_DEFAULT_AGE_SECS;
-static unsigned dm_bufio_retain_bytes = DM_BUFIO_DEFAULT_RETAIN_BYTES;
+static unsigned long dm_bufio_retain_bytes = DM_BUFIO_DEFAULT_RETAIN_BYTES;
 
 static unsigned long dm_bufio_peak_allocated;
 static unsigned long dm_bufio_allocated_kmem_cache;
@@ -1558,10 +1558,10 @@ static bool __try_evict_buffer(struct dm_buffer *b, gfp_t gfp)
         return true;
 }
 
-static unsigned get_retain_buffers(struct dm_bufio_client *c)
+static unsigned long get_retain_buffers(struct dm_bufio_client *c)
 {
-        unsigned retain_bytes = ACCESS_ONCE(dm_bufio_retain_bytes);
-        return retain_bytes / c->block_size;
+        unsigned long retain_bytes = ACCESS_ONCE(dm_bufio_retain_bytes);
+        return retain_bytes >> (c->sectors_per_block_bits + SECTOR_SHIFT);
 }
 
 static unsigned long __scan(struct dm_bufio_client *c, unsigned long nr_to_scan,
@@ -1571,7 +1571,7 @@ static unsigned long __scan(struct dm_bufio_client *c, unsigned long nr_to_scan,
         struct dm_buffer *b, *tmp;
         unsigned long freed = 0;
         unsigned long count = nr_to_scan;
-        unsigned retain_target = get_retain_buffers(c);
+        unsigned long retain_target = get_retain_buffers(c);
 
         for (l = 0; l < LIST_SIZE; l++) {
                 list_for_each_entry_safe_reverse(b, tmp, &c->lru[l], lru_list) {
@@ -1794,8 +1794,8 @@ static bool older_than(struct dm_buffer *b, unsigned long age_hz)
 static void __evict_old_buffers(struct dm_bufio_client *c, unsigned long age_hz)
 {
         struct dm_buffer *b, *tmp;
-        unsigned retain_target = get_retain_buffers(c);
-        unsigned count;
+        unsigned long retain_target = get_retain_buffers(c);
+        unsigned long count;
         LIST_HEAD(write_list);
 
         dm_bufio_lock(c);
@@ -1955,7 +1955,7 @@ MODULE_PARM_DESC(max_cache_size_bytes, "Size of metadata cache");
 module_param_named(max_age_seconds, dm_bufio_max_age, uint, S_IRUGO | S_IWUSR);
 MODULE_PARM_DESC(max_age_seconds, "Max age of a buffer in seconds");
 
-module_param_named(retain_bytes, dm_bufio_retain_bytes, uint, S_IRUGO | S_IWUSR);
+module_param_named(retain_bytes, dm_bufio_retain_bytes, ulong, S_IRUGO | S_IWUSR);
 MODULE_PARM_DESC(retain_bytes, "Try to keep at least this many bytes cached in memory");
 
 module_param_named(peak_allocated_bytes, dm_bufio_peak_allocated, ulong, S_IRUGO | S_IWUSR);
diff --git a/drivers/md/dm-cache-background-tracker.c b/drivers/md/dm-cache-background-tracker.c
index 9b1afdfb13f0..707233891291 100644
--- a/drivers/md/dm-cache-background-tracker.c
+++ b/drivers/md/dm-cache-background-tracker.c
@@ -33,6 +33,11 @@ struct background_tracker *btracker_create(unsigned max_work)
 {
         struct background_tracker *b = kmalloc(sizeof(*b), GFP_KERNEL);
 
+        if (!b) {
+                DMERR("couldn't create background_tracker");
+                return NULL;
+        }
+
         b->max_work = max_work;
         atomic_set(&b->pending_promotes, 0);
         atomic_set(&b->pending_writebacks, 0);
diff --git a/drivers/md/dm-cache-policy-smq.c b/drivers/md/dm-cache-policy-smq.c
index 72479bd61e11..e5eb9c9b4bc8 100644
--- a/drivers/md/dm-cache-policy-smq.c
+++ b/drivers/md/dm-cache-policy-smq.c
@@ -1120,8 +1120,6 @@ static bool clean_target_met(struct smq_policy *mq, bool idle)
          * Cache entries may not be populated.  So we cannot rely on the
          * size of the clean queue.
          */
-        unsigned nr_clean;
-
         if (idle) {
                 /*
                  * We'd like to clean everything.
@@ -1129,18 +1127,16 @@ static bool clean_target_met(struct smq_policy *mq, bool idle)
                 return q_size(&mq->dirty) == 0u;
         }
 
-        nr_clean = from_cblock(mq->cache_size) - q_size(&mq->dirty);
-        return (nr_clean + btracker_nr_writebacks_queued(mq->bg_work)) >=
-                percent_to_target(mq, CLEAN_TARGET);
+        /*
+         * If we're busy we don't worry about cleaning at all.
+         */
+        return true;
 }
 
-static bool free_target_met(struct smq_policy *mq, bool idle)
+static bool free_target_met(struct smq_policy *mq)
 {
         unsigned nr_free;
 
-        if (!idle)
-                return true;
-
         nr_free = from_cblock(mq->cache_size) - mq->cache_alloc.nr_allocated;
         return (nr_free + btracker_nr_demotions_queued(mq->bg_work)) >=
                 percent_to_target(mq, FREE_TARGET);
@@ -1190,9 +1186,9 @@ static void queue_demotion(struct smq_policy *mq)
         if (unlikely(WARN_ON_ONCE(!mq->migrations_allowed)))
                 return;
 
-        e = q_peek(&mq->clean, mq->clean.nr_levels, true);
+        e = q_peek(&mq->clean, mq->clean.nr_levels / 2, true);
         if (!e) {
-                if (!clean_target_met(mq, false))
+                if (!clean_target_met(mq, true))
                         queue_writeback(mq);
                 return;
         }
@@ -1220,7 +1216,7 @@ static void queue_promotion(struct smq_policy *mq, dm_oblock_t oblock,
                  * We always claim to be 'idle' to ensure some demotions happen
                  * with continuous loads.
                  */
-                if (!free_target_met(mq, true))
+                if (!free_target_met(mq))
                         queue_demotion(mq);
                 return;
         }
@@ -1421,14 +1417,10 @@ static int smq_get_background_work(struct dm_cache_policy *p, bool idle,
         spin_lock_irqsave(&mq->lock, flags);
         r = btracker_issue(mq->bg_work, result);
         if (r == -ENODATA) {
-                /* find some writeback work to do */
-                if (mq->migrations_allowed && !free_target_met(mq, idle))
-                        queue_demotion(mq);
-
-                else if (!clean_target_met(mq, idle))
+                if (!clean_target_met(mq, idle)) {
                         queue_writeback(mq);
-
-                r = btracker_issue(mq->bg_work, result);
+                        r = btracker_issue(mq->bg_work, result);
+                }
         }
         spin_unlock_irqrestore(&mq->lock, flags);
 
@@ -1452,6 +1444,7 @@ static void __complete_background_work(struct smq_policy *mq,
                 clear_pending(mq, e);
                 if (success) {
                         e->oblock = work->oblock;
+                        e->level = NR_CACHE_LEVELS - 1;
                         push(mq, e);
                         // h, q, a
                 } else {
diff --git a/drivers/md/dm-cache-target.c b/drivers/md/dm-cache-target.c
index 1db375f50a13..d682a0511381 100644
--- a/drivers/md/dm-cache-target.c
+++ b/drivers/md/dm-cache-target.c
@@ -94,6 +94,9 @@ static void iot_io_begin(struct io_tracker *iot, sector_t len)
 
 static void __iot_io_end(struct io_tracker *iot, sector_t len)
 {
+        if (!len)
+                return;
+
         iot->in_flight -= len;
         if (!iot->in_flight)
                 iot->idle_time = jiffies;
@@ -474,7 +477,7 @@ struct cache {
         spinlock_t invalidation_lock;
         struct list_head invalidation_requests;
 
-        struct io_tracker origin_tracker;
+        struct io_tracker tracker;
 
         struct work_struct commit_ws;
         struct batcher committer;
@@ -901,8 +904,7 @@ static dm_oblock_t get_bio_block(struct cache *cache, struct bio *bio)
 
 static bool accountable_bio(struct cache *cache, struct bio *bio)
 {
-        return ((bio->bi_bdev == cache->origin_dev->bdev) &&
-                bio_op(bio) != REQ_OP_DISCARD);
+        return bio_op(bio) != REQ_OP_DISCARD;
 }
 
 static void accounted_begin(struct cache *cache, struct bio *bio)
@@ -912,7 +914,7 @@ static void accounted_begin(struct cache *cache, struct bio *bio)
 
         if (accountable_bio(cache, bio)) {
                 pb->len = bio_sectors(bio);
-                iot_io_begin(&cache->origin_tracker, pb->len);
+                iot_io_begin(&cache->tracker, pb->len);
         }
 }
 
@@ -921,7 +923,7 @@ static void accounted_complete(struct cache *cache, struct bio *bio)
         size_t pb_data_size = get_per_bio_data_size(cache);
         struct per_bio_data *pb = get_per_bio_data(bio, pb_data_size);
 
-        iot_io_end(&cache->origin_tracker, pb->len);
+        iot_io_end(&cache->tracker, pb->len);
 }
 
 static void accounted_request(struct cache *cache, struct bio *bio)
@@ -1716,20 +1718,19 @@ static int invalidate_start(struct cache *cache, dm_cblock_t cblock,
 
 enum busy {
         IDLE,
-        MODERATE,
         BUSY
 };
 
 static enum busy spare_migration_bandwidth(struct cache *cache)
 {
-        bool idle = iot_idle_for(&cache->origin_tracker, HZ);
+        bool idle = iot_idle_for(&cache->tracker, HZ);
         sector_t current_volume = (atomic_read(&cache->nr_io_migrations) + 1) *
                 cache->sectors_per_block;
 
-        if (current_volume <= cache->migration_threshold)
-                return idle ? IDLE : MODERATE;
+        if (idle && current_volume <= cache->migration_threshold)
+                return IDLE;
         else
-                return idle ? MODERATE : BUSY;
+                return BUSY;
 }
 
 static void inc_hit_counter(struct cache *cache, struct bio *bio)
@@ -2045,8 +2046,6 @@ static void check_migrations(struct work_struct *ws)
 
         for (;;) {
                 b = spare_migration_bandwidth(cache);
-                if (b == BUSY)
-                        break;
 
                 r = policy_get_background_work(cache->policy, b == IDLE, &op);
                 if (r == -ENODATA)
@@ -2717,7 +2716,7 @@ static int cache_create(struct cache_args *ca, struct cache **result)
 
         batcher_init(&cache->committer, commit_op, cache,
                      issue_op, cache, cache->wq);
-        iot_init(&cache->origin_tracker);
+        iot_init(&cache->tracker);
 
         init_rwsem(&cache->background_work_lock);
         prevent_background_work(cache);
@@ -2941,7 +2940,7 @@ static void cache_postsuspend(struct dm_target *ti)
 
         cancel_delayed_work(&cache->waker);
         flush_workqueue(cache->wq);
-        WARN_ON(cache->origin_tracker.in_flight);
+        WARN_ON(cache->tracker.in_flight);
 
         /*
          * If it's a flush suspend there won't be any deferred bios, so this
diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
index 926a6bcb32c8..3df056b73b66 100644
--- a/drivers/md/dm-mpath.c
+++ b/drivers/md/dm-mpath.c
@@ -447,7 +447,7 @@ failed:
  * it has been invoked.
  */
 #define dm_report_EIO(m)                                                \
-({                                                                      \
+do {                                                                    \
         struct mapped_device *md = dm_table_get_md((m)->ti->table);     \
                                                                         \
         pr_debug("%s: returning EIO; QIFNP = %d; SQIFNP = %d; DNFS = %d\n", \
@@ -455,8 +455,7 @@ failed:
                  test_bit(MPATHF_QUEUE_IF_NO_PATH, &(m)->flags),        \
                  test_bit(MPATHF_SAVED_QUEUE_IF_NO_PATH, &(m)->flags),  \
                  dm_noflush_suspending((m)->ti));                       \
-        -EIO;                                                           \
-})
+} while (0)
 
 /*
  * Map cloned requests (request-based multipath)
@@ -481,7 +480,8 @@ static int multipath_clone_and_map(struct dm_target *ti, struct request *rq,
         if (!pgpath) {
                 if (test_bit(MPATHF_QUEUE_IF_NO_PATH, &m->flags))
                         return DM_MAPIO_DELAY_REQUEUE;
-                return dm_report_EIO(m);        /* Failed */
+                dm_report_EIO(m);       /* Failed */
+                return DM_MAPIO_KILL;
         } else if (test_bit(MPATHF_QUEUE_IO, &m->flags) ||
                    test_bit(MPATHF_PG_INIT_REQUIRED, &m->flags)) {
                 if (pg_init_all_paths(m))
@@ -558,7 +558,8 @@ static int __multipath_map_bio(struct multipath *m, struct bio *bio, struct dm_m
         if (!pgpath) {
                 if (test_bit(MPATHF_QUEUE_IF_NO_PATH, &m->flags))
                         return DM_MAPIO_REQUEUE;
-                return dm_report_EIO(m);
+                dm_report_EIO(m);
+                return -EIO;
         }
 
         mpio->pgpath = pgpath;
@@ -1493,7 +1494,7 @@ static int multipath_end_io(struct dm_target *ti, struct request *clone,
                 if (atomic_read(&m->nr_valid_paths) == 0 &&
                     !test_bit(MPATHF_QUEUE_IF_NO_PATH, &m->flags)) {
                         if (error == -EIO)
-                                error = dm_report_EIO(m);
+                                dm_report_EIO(m);
                         /* complete with the original error */
                         r = DM_ENDIO_DONE;
                 }
@@ -1524,8 +1525,10 @@ static int do_end_io_bio(struct multipath *m, struct bio *clone,
                 fail_path(mpio->pgpath);
 
         if (atomic_read(&m->nr_valid_paths) == 0 &&
-            !test_bit(MPATHF_QUEUE_IF_NO_PATH, &m->flags))
-                return dm_report_EIO(m);
+            !test_bit(MPATHF_QUEUE_IF_NO_PATH, &m->flags)) {
+                dm_report_EIO(m);
+                return -EIO;
+        }
 
         /* Queue for the daemon to resubmit */
         dm_bio_restore(get_bio_details_from_bio(clone), clone);
diff --git a/drivers/md/dm-rq.c b/drivers/md/dm-rq.c
index 2af27026aa2e..b639fa7246ee 100644
--- a/drivers/md/dm-rq.c
+++ b/drivers/md/dm-rq.c
@@ -507,6 +507,7 @@ static int map_request(struct dm_rq_target_io *tio)
         case DM_MAPIO_KILL:
                 /* The target wants to complete the I/O */
                 dm_kill_unmapped_request(rq, -EIO);
+                break;
         default:
                 DMWARN("unimplemented target map return value: %d", r);
                 BUG();
diff --git a/drivers/md/dm-thin-metadata.c b/drivers/md/dm-thin-metadata.c
index 0f0251d0d337..d31d18d9727c 100644
--- a/drivers/md/dm-thin-metadata.c
+++ b/drivers/md/dm-thin-metadata.c
@@ -484,11 +484,11 @@ static int __write_initial_superblock(struct dm_pool_metadata *pmd)
         if (r < 0)
                 return r;
 
-        r = save_sm_roots(pmd);
+        r = dm_tm_pre_commit(pmd->tm);
         if (r < 0)
                 return r;
 
-        r = dm_tm_pre_commit(pmd->tm);
+        r = save_sm_roots(pmd);
         if (r < 0)
                 return r;
 
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 82f798be964f..10367ffe92e3 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -8022,18 +8022,15 @@ EXPORT_SYMBOL(md_write_end);
  * may proceed without blocking.  It is important to call this before
  * attempting a GFP_KERNEL allocation while holding the mddev lock.
  * Must be called with mddev_lock held.
- *
- * In the ->external case MD_SB_CHANGE_PENDING can not be cleared until mddev->lock
- * is dropped, so return -EAGAIN after notifying userspace.
  */
-int md_allow_write(struct mddev *mddev)
+void md_allow_write(struct mddev *mddev)
 {
         if (!mddev->pers)
-                return 0;
+                return;
         if (mddev->ro)
-                return 0;
+                return;
         if (!mddev->pers->sync_request)
-                return 0;
+                return;
 
         spin_lock(&mddev->lock);
         if (mddev->in_sync) {
@@ -8046,13 +8043,12 @@ int md_allow_write(struct mddev *mddev)
                 spin_unlock(&mddev->lock);
                 md_update_sb(mddev, 0);
                 sysfs_notify_dirent_safe(mddev->sysfs_state);
+                /* wait for the dirty state to be recorded in the metadata */
+                wait_event(mddev->sb_wait,
+                           !test_bit(MD_SB_CHANGE_CLEAN, &mddev->sb_flags) &&
+                           !test_bit(MD_SB_CHANGE_PENDING, &mddev->sb_flags));
         } else
                 spin_unlock(&mddev->lock);
-
-        if (test_bit(MD_SB_CHANGE_PENDING, &mddev->sb_flags))
-                return -EAGAIN;
-        else
-                return 0;
 }
 EXPORT_SYMBOL_GPL(md_allow_write);
 
diff --git a/drivers/md/md.h b/drivers/md/md.h
index 4e75d121bfcc..11f15146ce51 100644
--- a/drivers/md/md.h
+++ b/drivers/md/md.h
@@ -665,7 +665,7 @@ extern int sync_page_io(struct md_rdev *rdev, sector_t sector, int size,
                         bool metadata_op);
 extern void md_do_sync(struct md_thread *thread);
 extern void md_new_event(struct mddev *mddev);
-extern int md_allow_write(struct mddev *mddev);
+extern void md_allow_write(struct mddev *mddev);
 extern void md_wait_for_blocked_rdev(struct md_rdev *rdev, struct mddev *mddev);
 extern void md_set_array_sectors(struct mddev *mddev, sector_t array_sectors);
 extern int md_check_no_bitmap(struct mddev *mddev);
diff --git a/drivers/md/persistent-data/dm-space-map-disk.c b/drivers/md/persistent-data/dm-space-map-disk.c
index ebb280a14325..32adf6b4a9c7 100644
--- a/drivers/md/persistent-data/dm-space-map-disk.c
+++ b/drivers/md/persistent-data/dm-space-map-disk.c
@@ -142,10 +142,23 @@ static int sm_disk_inc_block(struct dm_space_map *sm, dm_block_t b)
 
 static int sm_disk_dec_block(struct dm_space_map *sm, dm_block_t b)
 {
+        int r;
+        uint32_t old_count;
         enum allocation_event ev;
         struct sm_disk *smd = container_of(sm, struct sm_disk, sm);
 
-        return sm_ll_dec(&smd->ll, b, &ev);
+        r = sm_ll_dec(&smd->ll, b, &ev);
+        if (!r && (ev == SM_FREE)) {
+                /*
+                 * It's only free if it's also free in the last
+                 * transaction.
+                 */
+                r = sm_ll_lookup(&smd->old_ll, b, &old_count);
+                if (!r && !old_count)
+                        smd->nr_allocated_this_transaction--;
+        }
+
+        return r;
 }
 
 static int sm_disk_new_block(struct dm_space_map *sm, dm_block_t *b)
diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c
index 84e58596594d..d6c0bc76e837 100644
--- a/drivers/md/raid0.c
+++ b/drivers/md/raid0.c
@@ -385,7 +385,7 @@ static int raid0_run(struct mddev *mddev)
                 blk_queue_max_hw_sectors(mddev->queue, mddev->chunk_sectors);
                 blk_queue_max_write_same_sectors(mddev->queue, mddev->chunk_sectors);
                 blk_queue_max_write_zeroes_sectors(mddev->queue, mddev->chunk_sectors);
-                blk_queue_max_discard_sectors(mddev->queue, mddev->chunk_sectors);
+                blk_queue_max_discard_sectors(mddev->queue, UINT_MAX);
 
                 blk_queue_io_min(mddev->queue, mddev->chunk_sectors << 9);
                 blk_queue_io_opt(mddev->queue,
@@ -459,6 +459,95 @@ static inline int is_io_in_chunk_boundary(struct mddev *mddev,
         }
 }
 
+static void raid0_handle_discard(struct mddev *mddev, struct bio *bio)
+{
+        struct r0conf *conf = mddev->private;
+        struct strip_zone *zone;
+        sector_t start = bio->bi_iter.bi_sector;
+        sector_t end;
+        unsigned int stripe_size;
+        sector_t first_stripe_index, last_stripe_index;
+        sector_t start_disk_offset;
+        unsigned int start_disk_index;
+        sector_t end_disk_offset;
+        unsigned int end_disk_index;
+        unsigned int disk;
+
+        zone = find_zone(conf, &start);
+
+        if (bio_end_sector(bio) > zone->zone_end) {
+                struct bio *split = bio_split(bio,
+                        zone->zone_end - bio->bi_iter.bi_sector, GFP_NOIO,
+                        mddev->bio_set);
+                bio_chain(split, bio);
+                generic_make_request(bio);
+                bio = split;
+                end = zone->zone_end;
+        } else
+                end = bio_end_sector(bio);
+
+        if (zone != conf->strip_zone)
+                end = end - zone[-1].zone_end;
+
+        /* Now start and end is the offset in zone */
+        stripe_size = zone->nb_dev * mddev->chunk_sectors;
+
+        first_stripe_index = start;
+        sector_div(first_stripe_index, stripe_size);
+        last_stripe_index = end;
+        sector_div(last_stripe_index, stripe_size);
+
+        start_disk_index = (int)(start - first_stripe_index * stripe_size) /
+                mddev->chunk_sectors;
+        start_disk_offset = ((int)(start - first_stripe_index * stripe_size) %
+                mddev->chunk_sectors) +
+                first_stripe_index * mddev->chunk_sectors;
+        end_disk_index = (int)(end - last_stripe_index * stripe_size) /
+                mddev->chunk_sectors;
+        end_disk_offset = ((int)(end - last_stripe_index * stripe_size) %
+                mddev->chunk_sectors) +
+                last_stripe_index * mddev->chunk_sectors;
+
+        for (disk = 0; disk < zone->nb_dev; disk++) {
+                sector_t dev_start, dev_end;
+                struct bio *discard_bio = NULL;
+                struct md_rdev *rdev;
+
+                if (disk < start_disk_index)
+                        dev_start = (first_stripe_index + 1) *
+                                mddev->chunk_sectors;
+                else if (disk > start_disk_index)
+                        dev_start = first_stripe_index * mddev->chunk_sectors;
+                else
+                        dev_start = start_disk_offset;
+
+                if (disk < end_disk_index)
+                        dev_end = (last_stripe_index + 1) * mddev->chunk_sectors;
+                else if (disk > end_disk_index)
+                        dev_end = last_stripe_index * mddev->chunk_sectors;
+                else
+                        dev_end = end_disk_offset;
+
+                if (dev_end <= dev_start)
+                        continue;
+
+                rdev = conf->devlist[(zone - conf->strip_zone) *
+                        conf->strip_zone[0].nb_dev + disk];
+                if (__blkdev_issue_discard(rdev->bdev,
+                        dev_start + zone->dev_start + rdev->data_offset,
+                        dev_end - dev_start, GFP_NOIO, 0, &discard_bio) ||
+                    !discard_bio)
+                        continue;
+                bio_chain(discard_bio, bio);
+                if (mddev->gendisk)
+                        trace_block_bio_remap(bdev_get_queue(rdev->bdev),
+                                discard_bio, disk_devt(mddev->gendisk),
+                                bio->bi_iter.bi_sector);
+                generic_make_request(discard_bio);
+        }
+        bio_endio(bio);
+}
+
 static void raid0_make_request(struct mddev *mddev, struct bio *bio)
 {
         struct strip_zone *zone;
@@ -473,6 +562,11 @@ static void raid0_make_request(struct mddev *mddev, struct bio *bio)
                 return;
         }
 
+        if (unlikely((bio_op(bio) == REQ_OP_DISCARD))) {
+                raid0_handle_discard(mddev, bio);
+                return;
+        }
+
         bio_sector = bio->bi_iter.bi_sector;
         sector = bio_sector;
         chunk_sects = mddev->chunk_sectors;
@@ -498,19 +592,13 @@ static void raid0_make_request(struct mddev *mddev, struct bio *bio)
         bio->bi_iter.bi_sector = sector + zone->dev_start +
                 tmp_dev->data_offset;
 
-        if (unlikely((bio_op(bio) == REQ_OP_DISCARD) &&
-                     !blk_queue_discard(bdev_get_queue(bio->bi_bdev)))) {
-                /* Just ignore it */
-                bio_endio(bio);
-        } else {
-                if (mddev->gendisk)
-                        trace_block_bio_remap(bdev_get_queue(bio->bi_bdev),
-                                              bio, disk_devt(mddev->gendisk),
-                                              bio_sector);
-                mddev_check_writesame(mddev, bio);
-                mddev_check_write_zeroes(mddev, bio);
-                generic_make_request(bio);
-        }
+        if (mddev->gendisk)
+                trace_block_bio_remap(bdev_get_queue(bio->bi_bdev),
+                                      bio, disk_devt(mddev->gendisk),
+                                      bio_sector);
+        mddev_check_writesame(mddev, bio);
+        mddev_check_write_zeroes(mddev, bio);
+        generic_make_request(bio);
 }
 
 static void raid0_status(struct seq_file *seq, struct mddev *mddev)
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index 7ed59351fe97..af5056d56878 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -666,8 +666,11 @@ static int read_balance(struct r1conf *conf, struct r1bio *r1_bio, int *max_sect
                                         break;
                         }
                         continue;
-                } else
+                } else {
+                        if ((sectors > best_good_sectors) && (best_disk >= 0))
+                                best_disk = -1;
                         best_good_sectors = sectors;
+                }
 
                 if (best_disk >= 0)
                         /* At least two disks to choose from so failfast is OK */
@@ -1529,17 +1532,16 @@ static void raid1_write_request(struct mddev *mddev, struct bio *bio,
                         plug = container_of(cb, struct raid1_plug_cb, cb);
                 else
                         plug = NULL;
-                spin_lock_irqsave(&conf->device_lock, flags);
                 if (plug) {
                         bio_list_add(&plug->pending, mbio);
                         plug->pending_cnt++;
                 } else {
+                        spin_lock_irqsave(&conf->device_lock, flags);
                         bio_list_add(&conf->pending_bio_list, mbio);
                         conf->pending_count++;
-                }
-                spin_unlock_irqrestore(&conf->device_lock, flags);
-                if (!plug)
+                        spin_unlock_irqrestore(&conf->device_lock, flags);
                         md_wakeup_thread(mddev->thread);
+                }
         }
 
         r1_bio_write_done(r1_bio);
@@ -3197,7 +3199,7 @@ static int raid1_reshape(struct mddev *mddev)
         struct r1conf *conf = mddev->private;
         int cnt, raid_disks;
         unsigned long flags;
-        int d, d2, err;
+        int d, d2;
 
         /* Cannot change chunk_size, layout, or level */
         if (mddev->chunk_sectors != mddev->new_chunk_sectors ||
@@ -3209,11 +3211,8 @@ static int raid1_reshape(struct mddev *mddev)
                 return -EINVAL;
         }
 
-        if (!mddev_is_clustered(mddev)) {
-                err = md_allow_write(mddev);
-                if (err)
-                        return err;
-        }
+        if (!mddev_is_clustered(mddev))
+                md_allow_write(mddev);
 
         raid_disks = mddev->raid_disks + mddev->delta_disks;
 
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 6b86a0032cf8..4343d7ff9916 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -1282,17 +1282,16 @@ static void raid10_write_one_disk(struct mddev *mddev, struct r10bio *r10_bio,
                 plug = container_of(cb, struct raid10_plug_cb, cb);
         else
                 plug = NULL;
-        spin_lock_irqsave(&conf->device_lock, flags);
         if (plug) {
                 bio_list_add(&plug->pending, mbio);
                 plug->pending_cnt++;
         } else {
+                spin_lock_irqsave(&conf->device_lock, flags);
                 bio_list_add(&conf->pending_bio_list, mbio);
                 conf->pending_count++;
-        }
-        spin_unlock_irqrestore(&conf->device_lock, flags);
-        if (!plug)
+                spin_unlock_irqrestore(&conf->device_lock, flags);
                 md_wakeup_thread(mddev->thread);
+        }
 }
 
 static void raid10_write_request(struct mddev *mddev, struct bio *bio,
diff --git a/drivers/md/raid5-cache.c b/drivers/md/raid5-cache.c
index 26ba09282e7c..4c00bc248287 100644
--- a/drivers/md/raid5-cache.c
+++ b/drivers/md/raid5-cache.c
@@ -24,6 +24,7 @@
 #include "md.h"
 #include "raid5.h"
 #include "bitmap.h"
+#include "raid5-log.h"
 
 /*
  * metadata/data stored in disk with 4k size unit (a block) regardless
@@ -622,20 +623,30 @@ static void r5l_do_submit_io(struct r5l_log *log, struct r5l_io_unit *io)
         __r5l_set_io_unit_state(io, IO_UNIT_IO_START);
         spin_unlock_irqrestore(&log->io_list_lock, flags);
 
+        /*
+         * In case of journal device failures, submit_bio will get error
+         * and calls endio, then active stripes will continue write
+         * process. Therefore, it is not necessary to check Faulty bit
+         * of journal device here.
+         *
+         * We can't check split_bio after current_bio is submitted. If
+         * io->split_bio is null, after current_bio is submitted, current_bio
+         * might already be completed and the io_unit is freed. We submit
+         * split_bio first to avoid the issue.
+         */
+        if (io->split_bio) {
+                if (io->has_flush)
+                        io->split_bio->bi_opf |= REQ_PREFLUSH;
+                if (io->has_fua)
+                        io->split_bio->bi_opf |= REQ_FUA;
+                submit_bio(io->split_bio);
+        }
+
         if (io->has_flush)
                 io->current_bio->bi_opf |= REQ_PREFLUSH;
         if (io->has_fua)
                 io->current_bio->bi_opf |= REQ_FUA;
         submit_bio(io->current_bio);
-
-        if (!io->split_bio)
-                return;
-
-        if (io->has_flush)
-                io->split_bio->bi_opf |= REQ_PREFLUSH;
-        if (io->has_fua)
-                io->split_bio->bi_opf |= REQ_FUA;
-        submit_bio(io->split_bio);
 }
 
 /* deferred io_unit will be dispatched here */
@@ -670,6 +681,11 @@ static void r5c_disable_writeback_async(struct work_struct *work)
                 return;
         pr_info("md/raid:%s: Disabling writeback cache for degraded array.\n",
                 mdname(mddev));
+
+        /* wait superblock change before suspend */
+        wait_event(mddev->sb_wait,
+                   !test_bit(MD_SB_CHANGE_PENDING, &mddev->sb_flags));
+
         mddev_suspend(mddev);
         log->r5c_journal_mode = R5C_JOURNAL_MODE_WRITE_THROUGH;
         mddev_resume(mddev);
@@ -2621,8 +2637,11 @@ int r5c_try_caching_write(struct r5conf *conf,
          * When run in degraded mode, array is set to write-through mode.
          * This check helps drain pending write safely in the transition to
          * write-through mode.
+         *
+         * When a stripe is syncing, the write is also handled in write
+         * through mode.
          */
-        if (s->failed) {
+        if (s->failed || test_bit(STRIPE_SYNCING, &sh->state)) {
                 r5c_make_stripe_write_out(sh);
                 return -EAGAIN;
         }
@@ -2825,6 +2844,9 @@ void r5c_finish_stripe_write_out(struct r5conf *conf,
         }
 
         r5l_append_flush_payload(log, sh->sector);
+        /* stripe is flused to raid disks, we can do resync now */
+        if (test_bit(STRIPE_SYNC_REQUESTED, &sh->state))
+                set_bit(STRIPE_HANDLE, &sh->state);
 }
 
 int r5c_cache_data(struct r5l_log *log, struct stripe_head *sh)
@@ -2973,7 +2995,7 @@ ioerr:
         return ret;
 }
 
-void r5c_update_on_rdev_error(struct mddev *mddev)
+void r5c_update_on_rdev_error(struct mddev *mddev, struct md_rdev *rdev)
 {
         struct r5conf *conf = mddev->private;
         struct r5l_log *log = conf->log;
@@ -2981,7 +3003,8 @@ void r5c_update_on_rdev_error(struct mddev *mddev)
         if (!log)
                 return;
 
-        if (raid5_calc_degraded(conf) > 0 &&
+        if ((raid5_calc_degraded(conf) > 0 ||
+             test_bit(Journal, &rdev->flags)) &&
             conf->log->r5c_journal_mode == R5C_JOURNAL_MODE_WRITE_BACK)
                 schedule_work(&log->disable_writeback_work);
 }
diff --git a/drivers/md/raid5-log.h b/drivers/md/raid5-log.h
index 27097101ccca..328d67aedda4 100644
--- a/drivers/md/raid5-log.h
+++ b/drivers/md/raid5-log.h
@@ -28,7 +28,8 @@ extern void r5c_flush_cache(struct r5conf *conf, int num);
 extern void r5c_check_stripe_cache_usage(struct r5conf *conf);
 extern void r5c_check_cached_full_stripe(struct r5conf *conf);
 extern struct md_sysfs_entry r5c_journal_mode;
-extern void r5c_update_on_rdev_error(struct mddev *mddev);
+extern void r5c_update_on_rdev_error(struct mddev *mddev,
+                                     struct md_rdev *rdev);
 extern bool r5c_big_stripe_cached(struct r5conf *conf, sector_t sect);
 
 extern struct dma_async_tx_descriptor *
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 2e38cfac5b1d..9c4f7659f8b1 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -103,8 +103,7 @@ static inline void unlock_device_hash_lock(struct r5conf *conf, int hash)
 static inline void lock_all_device_hash_locks_irq(struct r5conf *conf)
 {
         int i;
-        local_irq_disable();
-        spin_lock(conf->hash_locks);
+        spin_lock_irq(conf->hash_locks);
         for (i = 1; i < NR_STRIPE_HASH_LOCKS; i++)
                 spin_lock_nest_lock(conf->hash_locks + i, conf->hash_locks);
         spin_lock(&conf->device_lock);
@@ -114,9 +113,9 @@ static inline void unlock_all_device_hash_locks_irq(struct r5conf *conf)
 {
         int i;
         spin_unlock(&conf->device_lock);
-        for (i = NR_STRIPE_HASH_LOCKS; i; i--)
-                spin_unlock(conf->hash_locks + i - 1);
-        local_irq_enable();
+        for (i = NR_STRIPE_HASH_LOCKS - 1; i; i--)
+                spin_unlock(conf->hash_locks + i);
+        spin_unlock_irq(conf->hash_locks);
 }
 
 /* Find first data disk in a raid6 stripe */
@@ -234,11 +233,15 @@ static void do_release_stripe(struct r5conf *conf, struct stripe_head *sh,
                         if (test_bit(R5_InJournal, &sh->dev[i].flags))
                                 injournal++;
         /*
-         * When quiesce in r5c write back, set STRIPE_HANDLE for stripes with
-         * data in journal, so they are not released to cached lists
+         * In the following cases, the stripe cannot be released to cached
+         * lists. Therefore, we make the stripe write out and set
+         * STRIPE_HANDLE:
+         *   1. when quiesce in r5c write back;
+         *   2. when resync is requested fot the stripe.
          */
-        if (conf->quiesce && r5c_is_writeback(conf->log) &&
-            !test_bit(STRIPE_HANDLE, &sh->state) && injournal != 0) {
+        if (test_bit(STRIPE_SYNC_REQUESTED, &sh->state) ||
+            (conf->quiesce && r5c_is_writeback(conf->log) &&
+             !test_bit(STRIPE_HANDLE, &sh->state) && injournal != 0)) {
                 if (test_bit(STRIPE_R5C_CACHING, &sh->state))
                         r5c_make_stripe_write_out(sh);
                 set_bit(STRIPE_HANDLE, &sh->state);
@@ -714,12 +717,11 @@ static bool is_full_stripe_write(struct stripe_head *sh)
 
 static void lock_two_stripes(struct stripe_head *sh1, struct stripe_head *sh2)
 {
-        local_irq_disable();
         if (sh1 > sh2) {
-                spin_lock(&sh2->stripe_lock);
+                spin_lock_irq(&sh2->stripe_lock);
                 spin_lock_nested(&sh1->stripe_lock, 1);
         } else {
-                spin_lock(&sh1->stripe_lock);
+                spin_lock_irq(&sh1->stripe_lock);
                 spin_lock_nested(&sh2->stripe_lock, 1);
         }
 }
@@ -727,8 +729,7 @@ static void lock_two_stripes(struct stripe_head *sh1, struct stripe_head *sh2)
 static void unlock_two_stripes(struct stripe_head *sh1, struct stripe_head *sh2)
 {
         spin_unlock(&sh1->stripe_lock);
-        spin_unlock(&sh2->stripe_lock);
-        local_irq_enable();
+        spin_unlock_irq(&sh2->stripe_lock);
 }
 
 /* Only freshly new full stripe normal write stripe can be added to a batch list */
@@ -2312,14 +2313,12 @@ static int resize_stripes(struct r5conf *conf, int newsize)
         struct stripe_head *osh, *nsh;
         LIST_HEAD(newstripes);
         struct disk_info *ndisks;
-        int err;
+        int err = 0;
         struct kmem_cache *sc;
         int i;
         int hash, cnt;
 
-        err = md_allow_write(conf->mddev);
-        if (err)
-                return err;
+        md_allow_write(conf->mddev);
 
         /* Step 1 */
         sc = kmem_cache_create(conf->cache_name[1-conf->active_name],
@@ -2694,7 +2693,7 @@ static void raid5_error(struct mddev *mddev, struct md_rdev *rdev)
                 bdevname(rdev->bdev, b),
                 mdname(mddev),
                 conf->raid_disks - mddev->degraded);
-        r5c_update_on_rdev_error(mddev);
+        r5c_update_on_rdev_error(mddev, rdev);
 }
 
 /*
@@ -3055,6 +3054,11 @@ sector_t raid5_compute_blocknr(struct stripe_head *sh, int i, int previous)
  *      When LOG_CRITICAL, stripes with injournal == 0 will be sent to
  *      no_space_stripes list.
  *
+ *   3. during journal failure
+ *      In journal failure, we try to flush all cached data to raid disks
+ *      based on data in stripe cache. The array is read-only to upper
+ *      layers, so we would skip all pending writes.
+ *
  */
 static inline bool delay_towrite(struct r5conf *conf,
                                  struct r5dev *dev,
@@ -3068,6 +3072,9 @@ static inline bool delay_towrite(struct r5conf *conf,
         if (test_bit(R5C_LOG_CRITICAL, &conf->cache_state) &&
             s->injournal > 0)
                 return true;
+        /* case 3 above */
+        if (s->log_failed && s->injournal)
+                return true;
         return false;
 }
 
@@ -4653,8 +4660,13 @@ static void handle_stripe(struct stripe_head *sh)
 
         if (test_bit(STRIPE_SYNC_REQUESTED, &sh->state) && !sh->batch_head) {
                 spin_lock(&sh->stripe_lock);
-                /* Cannot process 'sync' concurrently with 'discard' */
-                if (!test_bit(STRIPE_DISCARD, &sh->state) &&
+                /*
+                 * Cannot process 'sync' concurrently with 'discard'.
+                 * Flush data in r5cache before 'sync'.
+                 */
+                if (!test_bit(STRIPE_R5C_PARTIAL_STRIPE, &sh->state) &&
+                    !test_bit(STRIPE_R5C_FULL_STRIPE, &sh->state) &&
+                    !test_bit(STRIPE_DISCARD, &sh->state) &&
                     test_and_clear_bit(STRIPE_SYNC_REQUESTED, &sh->state)) {
                         set_bit(STRIPE_SYNCING, &sh->state);
                         clear_bit(STRIPE_INSYNC, &sh->state);
@@ -4701,10 +4713,15 @@ static void handle_stripe(struct stripe_head *sh)
                " to_write=%d failed=%d failed_num=%d,%d\n",
                s.locked, s.uptodate, s.to_read, s.to_write, s.failed,
                s.failed_num[0], s.failed_num[1]);
-        /* check if the array has lost more than max_degraded devices and,
+        /*
+         * check if the array has lost more than max_degraded devices and,
          * if so, some requests might need to be failed.
+         *
+         * When journal device failed (log_failed), we will only process
+         * the stripe if there is data need write to raid disks
          */
-        if (s.failed > conf->max_degraded || s.log_failed) {
+        if (s.failed > conf->max_degraded ||
+            (s.log_failed && s.injournal == 0)) {
                 sh->check_state = 0;
                 sh->reconstruct_state = 0;
                 break_stripe_batch_list(sh, 0);
@@ -5277,8 +5294,10 @@ static struct stripe_head *__get_priority_stripe(struct r5conf *conf, int group)
         struct stripe_head *sh, *tmp;
         struct list_head *handle_list = NULL;
         struct r5worker_group *wg;
-        bool second_try = !r5c_is_writeback(conf->log);
-        bool try_loprio = test_bit(R5C_LOG_TIGHT, &conf->cache_state);
+        bool second_try = !r5c_is_writeback(conf->log) &&
+                !r5l_log_disk_error(conf);
+        bool try_loprio = test_bit(R5C_LOG_TIGHT, &conf->cache_state) ||
+                r5l_log_disk_error(conf);
 
 again:
         wg = NULL;
@@ -6313,7 +6332,6 @@ int
 raid5_set_cache_size(struct mddev *mddev, int size)
 {
         struct r5conf *conf = mddev->private;
-        int err;
 
         if (size <= 16 || size > 32768)
                 return -EINVAL;
@@ -6325,10 +6343,7 @@ raid5_set_cache_size(struct mddev *mddev, int size)
                 ;
         mutex_unlock(&conf->cache_size_mutex);
 
-
-        err = md_allow_write(mddev);
-        if (err)
-                return err;
+        md_allow_write(mddev);
 
         mutex_lock(&conf->cache_size_mutex);
         while (size > conf->max_nr_stripes)
@@ -7530,7 +7545,9 @@ static int raid5_remove_disk(struct mddev *mddev, struct md_rdev *rdev)
                  * neilb: there is no locking about new writes here,
                  * so this cannot be safe.
                  */
-                if (atomic_read(&conf->active_stripes)) {
+                if (atomic_read(&conf->active_stripes) ||
+                    atomic_read(&conf->r5c_cached_full_stripes) ||
+                    atomic_read(&conf->r5c_cached_partial_stripes)) {
                         return -EBUSY;
                 }
                 log_exit(conf);
diff --git a/drivers/memory/omap-gpmc.c b/drivers/memory/omap-gpmc.c
index bf0fe0137dfe..6d1b4b707cc2 100644
--- a/drivers/memory/omap-gpmc.c
+++ b/drivers/memory/omap-gpmc.c
@@ -512,7 +512,7 @@ static void gpmc_cs_show_timings(int cs, const char *desc)
         pr_info("gpmc cs%i access configuration:\n", cs);
         GPMC_GET_RAW_BOOL(GPMC_CS_CONFIG1,  4,  4, "time-para-granularity");
         GPMC_GET_RAW(GPMC_CS_CONFIG1,  8,  9, "mux-add-data");
-        GPMC_GET_RAW_MAX(GPMC_CS_CONFIG1, 12, 13,
+        GPMC_GET_RAW_SHIFT_MAX(GPMC_CS_CONFIG1, 12, 13, 1,
                          GPMC_CONFIG1_DEVICESIZE_MAX, "device-width");
         GPMC_GET_RAW(GPMC_CS_CONFIG1, 16, 17, "wait-pin");
         GPMC_GET_RAW_BOOL(GPMC_CS_CONFIG1, 21, 21, "wait-on-write");
diff --git a/drivers/misc/Kconfig b/drivers/misc/Kconfig
index 2cba76e6fa3c..07bbd4cc1852 100644
--- a/drivers/misc/Kconfig
+++ b/drivers/misc/Kconfig
@@ -492,6 +492,7 @@ config ASPEED_LPC_CTRL
 
 config PCI_ENDPOINT_TEST
         depends on PCI
+        select CRC32
         tristate "PCI Endpoint Test driver"
         ---help---
            Enable this configuration option to enable the host side test driver
diff --git a/drivers/mmc/core/pwrseq_simple.c b/drivers/mmc/core/pwrseq_simple.c
index 1304160de168..13ef162cf066 100644
--- a/drivers/mmc/core/pwrseq_simple.c
+++ b/drivers/mmc/core/pwrseq_simple.c
@@ -27,6 +27,7 @@ struct mmc_pwrseq_simple {
         struct mmc_pwrseq pwrseq;
         bool clk_enabled;
         u32 post_power_on_delay_ms;
+        u32 power_off_delay_us;
         struct clk *ext_clk;
         struct gpio_descs *reset_gpios;
 };
@@ -78,6 +79,10 @@ static void mmc_pwrseq_simple_power_off(struct mmc_host *host)
 
         mmc_pwrseq_simple_set_gpios_value(pwrseq, 1);
 
+        if (pwrseq->power_off_delay_us)
+                usleep_range(pwrseq->power_off_delay_us,
+                        2 * pwrseq->power_off_delay_us);
+
         if (!IS_ERR(pwrseq->ext_clk) && pwrseq->clk_enabled) {
                 clk_disable_unprepare(pwrseq->ext_clk);
                 pwrseq->clk_enabled = false;
@@ -119,6 +124,8 @@ static int mmc_pwrseq_simple_probe(struct platform_device *pdev)
 
         device_property_read_u32(dev, "post-power-on-delay-ms",
                                  &pwrseq->post_power_on_delay_ms);
+        device_property_read_u32(dev, "power-off-delay-us",
+                                 &pwrseq->power_off_delay_us);
 
         pwrseq->pwrseq.dev = dev;
         pwrseq->pwrseq.ops = &mmc_pwrseq_simple_ops;
diff --git a/drivers/mmc/host/cavium-octeon.c b/drivers/mmc/host/cavium-octeon.c
index 772d0900026d..951d2cdd7888 100644
--- a/drivers/mmc/host/cavium-octeon.c
+++ b/drivers/mmc/host/cavium-octeon.c
@@ -108,7 +108,7 @@ static void octeon_mmc_release_bus(struct cvm_mmc_host *host)
 static void octeon_mmc_int_enable(struct cvm_mmc_host *host, u64 val)
 {
         writeq(val, host->base + MIO_EMM_INT(host));
-        if (!host->dma_active || (host->dma_active && !host->has_ciu3))
+        if (!host->has_ciu3)
                 writeq(val, host->base + MIO_EMM_INT_EN(host));
 }
 
@@ -267,7 +267,7 @@ static int octeon_mmc_probe(struct platform_device *pdev)
         }
 
         host->global_pwr_gpiod = devm_gpiod_get_optional(&pdev->dev,
-                                                         "power-gpios",
+                                                         "power",
                                                          GPIOD_OUT_HIGH);
         if (IS_ERR(host->global_pwr_gpiod)) {
                 dev_err(&pdev->dev, "Invalid power GPIO\n");
@@ -288,11 +288,20 @@ static int octeon_mmc_probe(struct platform_device *pdev)
                 if (ret) {
                         dev_err(&pdev->dev, "Error populating slots\n");
                         octeon_mmc_set_shared_power(host, 0);
-                        return ret;
+                        goto error;
                 }
                 i++;
         }
         return 0;
+
+error:
+        for (i = 0; i < CAVIUM_MAX_MMC; i++) {
+                if (host->slot[i])
+                        cvm_mmc_of_slot_remove(host->slot[i]);
+                if (host->slot_pdev[i])
+                        of_platform_device_destroy(&host->slot_pdev[i]->dev, NULL);
+        }
+        return ret;
 }
 
 static int octeon_mmc_remove(struct platform_device *pdev)
diff --git a/drivers/mmc/host/cavium-thunderx.c b/drivers/mmc/host/cavium-thunderx.c
index fe3d77267cd6..b9cc95998799 100644
--- a/drivers/mmc/host/cavium-thunderx.c
+++ b/drivers/mmc/host/cavium-thunderx.c
@@ -146,6 +146,12 @@ static int thunder_mmc_probe(struct pci_dev *pdev,
         return 0;
 
 error:
+        for (i = 0; i < CAVIUM_MAX_MMC; i++) {
+                if (host->slot[i])
+                        cvm_mmc_of_slot_remove(host->slot[i]);
+                if (host->slot_pdev[i])
+                        of_platform_device_destroy(&host->slot_pdev[i]->dev, NULL);
+        }
         clk_disable_unprepare(host->clk);
         return ret;
 }
diff --git a/drivers/mmc/host/cavium.c b/drivers/mmc/host/cavium.c
index 58b51ba6aabd..b8aaf0fdb77c 100644
--- a/drivers/mmc/host/cavium.c
+++ b/drivers/mmc/host/cavium.c
@@ -839,14 +839,14 @@ static void cvm_mmc_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
                 cvm_mmc_reset_bus(slot);
                 if (host->global_pwr_gpiod)
                         host->set_shared_power(host, 0);
-                else
+                else if (!IS_ERR(mmc->supply.vmmc))
                         mmc_regulator_set_ocr(mmc, mmc->supply.vmmc, 0);
                 break;
 
         case MMC_POWER_UP:
                 if (host->global_pwr_gpiod)
                         host->set_shared_power(host, 1);
-                else
+                else if (!IS_ERR(mmc->supply.vmmc))
                         mmc_regulator_set_ocr(mmc, mmc->supply.vmmc, ios->vdd);
                 break;
         }
@@ -968,20 +968,15 @@ static int cvm_mmc_of_parse(struct device *dev, struct cvm_mmc_slot *slot)
                 return -EINVAL;
         }
 
-        mmc->supply.vmmc = devm_regulator_get_optional(dev, "vmmc");
-        if (IS_ERR(mmc->supply.vmmc)) {
-                if (PTR_ERR(mmc->supply.vmmc) == -EPROBE_DEFER)
-                        return -EPROBE_DEFER;
-                /*
-                 * Legacy Octeon firmware has no regulator entry, fall-back to
-                 * a hard-coded voltage to get a sane OCR.
-                 */
+        ret = mmc_regulator_get_supply(mmc);
+        if (ret == -EPROBE_DEFER)
+                return ret;
+        /*
+         * Legacy Octeon firmware has no regulator entry, fall-back to
+         * a hard-coded voltage to get a sane OCR.
+         */
+        if (IS_ERR(mmc->supply.vmmc))
                 mmc->ocr_avail = MMC_VDD_32_33 | MMC_VDD_33_34;
-        } else {
-                ret = mmc_regulator_get_ocrmask(mmc->supply.vmmc);
-                if (ret > 0)
-                        mmc->ocr_avail = ret;
-        }
 
         /* Common MMC bindings */
         ret = mmc_of_parse(mmc);
diff --git a/drivers/mmc/host/sdhci-iproc.c b/drivers/mmc/host/sdhci-iproc.c
index 3275d4995812..61666d269771 100644
--- a/drivers/mmc/host/sdhci-iproc.c
+++ b/drivers/mmc/host/sdhci-iproc.c
@@ -187,7 +187,8 @@ static const struct sdhci_iproc_data iproc_cygnus_data = {
 };
 
 static const struct sdhci_pltfm_data sdhci_iproc_pltfm_data = {
-        .quirks = SDHCI_QUIRK_DATA_TIMEOUT_USES_SDCLK,
+        .quirks = SDHCI_QUIRK_DATA_TIMEOUT_USES_SDCLK |
+                  SDHCI_QUIRK_MULTIBLOCK_READ_ACMD12,
         .quirks2 = SDHCI_QUIRK2_ACMD23_BROKEN,
         .ops = &sdhci_iproc_ops,
 };
diff --git a/drivers/mmc/host/sdhci-xenon-phy.c b/drivers/mmc/host/sdhci-xenon-phy.c
index 6356781f1cca..f7e26b031e76 100644
--- a/drivers/mmc/host/sdhci-xenon-phy.c
+++ b/drivers/mmc/host/sdhci-xenon-phy.c
@@ -787,14 +787,6 @@ int xenon_phy_adj(struct sdhci_host *host, struct mmc_ios *ios)
         return ret;
 }
 
-void xenon_clean_phy(struct sdhci_host *host)
-{
-        struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
-        struct xenon_priv *priv = sdhci_pltfm_priv(pltfm_host);
-
-        kfree(priv->phy_params);
-}
-
 static int xenon_add_phy(struct device_node *np, struct sdhci_host *host,
                          const char *phy_name)
 {
@@ -819,11 +811,7 @@ static int xenon_add_phy(struct device_node *np, struct sdhci_host *host,
         if (ret)
                 return ret;
 
-        ret = xenon_emmc_phy_parse_param_dt(host, np, priv->phy_params);
-        if (ret)
-                xenon_clean_phy(host);
-
-        return ret;
+        return xenon_emmc_phy_parse_param_dt(host, np, priv->phy_params);
 }
 
 int xenon_phy_parse_dt(struct device_node *np, struct sdhci_host *host)
diff --git a/drivers/mmc/host/sdhci-xenon.c b/drivers/mmc/host/sdhci-xenon.c
index 67246655315b..bc1781bb070b 100644
--- a/drivers/mmc/host/sdhci-xenon.c
+++ b/drivers/mmc/host/sdhci-xenon.c
@@ -486,7 +486,7 @@ static int xenon_probe(struct platform_device *pdev)
 
         err = xenon_sdhc_prepare(host);
         if (err)
-                goto clean_phy_param;
+                goto err_clk;
 
         err = sdhci_add_host(host);
         if (err)
@@ -496,8 +496,6 @@ static int xenon_probe(struct platform_device *pdev)
 
 remove_sdhc:
         xenon_sdhc_unprepare(host);
-clean_phy_param:
-        xenon_clean_phy(host);
 err_clk:
         clk_disable_unprepare(pltfm_host->clk);
 free_pltfm:
@@ -510,8 +508,6 @@ static int xenon_remove(struct platform_device *pdev)
         struct sdhci_host *host = platform_get_drvdata(pdev);
         struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
 
-        xenon_clean_phy(host);
-
         sdhci_remove_host(host, 0);
 
         xenon_sdhc_unprepare(host);
diff --git a/drivers/mmc/host/sdhci-xenon.h b/drivers/mmc/host/sdhci-xenon.h
index 6e6523ea01ce..73debb42dc2f 100644
--- a/drivers/mmc/host/sdhci-xenon.h
+++ b/drivers/mmc/host/sdhci-xenon.h
@@ -93,7 +93,6 @@ struct xenon_priv {
 };
 
 int xenon_phy_adj(struct sdhci_host *host, struct mmc_ios *ios);
-void xenon_clean_phy(struct sdhci_host *host);
 int xenon_phy_parse_dt(struct device_node *np,
                        struct sdhci_host *host);
 void xenon_soc_pad_ctrl(struct sdhci_host *host,
diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
index c5fd4259da33..b44a6aeb346d 100644
--- a/drivers/net/bonding/bond_3ad.c
+++ b/drivers/net/bonding/bond_3ad.c
@@ -2577,7 +2577,7 @@ int __bond_3ad_get_active_agg_info(struct bonding *bond,
                 return -1;
 
         ad_info->aggregator_id = aggregator->aggregator_identifier;
-        ad_info->ports = aggregator->num_of_ports;
+        ad_info->ports = __agg_active_ports(aggregator);
         ad_info->actor_key = aggregator->actor_oper_aggregator_key;
         ad_info->partner_key = aggregator->partner_oper_aggregator_key;
         ether_addr_copy(ad_info->partner_system,
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 2be78807fd6e..2359478b977f 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -2612,11 +2612,13 @@ static void bond_loadbalance_arp_mon(struct bonding *bond)
         bond_for_each_slave_rcu(bond, slave, iter) {
                 unsigned long trans_start = dev_trans_start(slave->dev);
 
+                slave->new_link = BOND_LINK_NOCHANGE;
+
                 if (slave->link != BOND_LINK_UP) {
                         if (bond_time_in_interval(bond, trans_start, 1) &&
                             bond_time_in_interval(bond, slave->last_rx, 1)) {
 
-                                slave->link  = BOND_LINK_UP;
+                                slave->new_link = BOND_LINK_UP;
                                 slave_state_changed = 1;
 
                                 /* primary_slave has no meaning in round-robin
@@ -2643,7 +2645,7 @@ static void bond_loadbalance_arp_mon(struct bonding *bond)
                         if (!bond_time_in_interval(bond, trans_start, 2) ||
                             !bond_time_in_interval(bond, slave->last_rx, 2)) {
 
-                                slave->link  = BOND_LINK_DOWN;
+                                slave->new_link = BOND_LINK_DOWN;
                                 slave_state_changed = 1;
 
                                 if (slave->link_failure_count < UINT_MAX)
@@ -2674,6 +2676,11 @@ static void bond_loadbalance_arp_mon(struct bonding *bond)
                 if (!rtnl_trylock())
                         goto re_arm;
 
+                bond_for_each_slave(bond, slave, iter) {
+                        if (slave->new_link != BOND_LINK_NOCHANGE)
+                                slave->link = slave->new_link;
+                }
+
                 if (slave_state_changed) {
                         bond_slave_state_change(bond);
                         if (BOND_MODE(bond) == BOND_MODE_XOR)
@@ -4271,10 +4278,10 @@ static int bond_check_params(struct bond_params *params)
         int arp_validate_value, fail_over_mac_value, primary_reselect_value, i;
         struct bond_opt_value newval;
         const struct bond_opt_value *valptr;
-        int arp_all_targets_value;
+        int arp_all_targets_value = 0;
         u16 ad_actor_sys_prio = 0;
         u16 ad_user_port_key = 0;
-        __be32 arp_target[BOND_MAX_ARP_TARGETS];
+        __be32 arp_target[BOND_MAX_ARP_TARGETS] = { 0 };
         int arp_ip_count;
         int bond_mode   = BOND_MODE_ROUNDROBIN;
         int xmit_hashtype = BOND_XMIT_POLICY_LAYER2;
@@ -4501,7 +4508,6 @@ static int bond_check_params(struct bond_params *params)
                 arp_validate_value = 0;
         }
 
-        arp_all_targets_value = 0;
         if (arp_all_targets) {
                 bond_opt_initstr(&newval, arp_all_targets);
                 valptr = bond_opt_parse(bond_opt_get(BOND_OPT_ARP_ALL_TARGETS),
diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
index 19581d783d8e..d034d8cd7d22 100644
--- a/drivers/net/dsa/mv88e6xxx/chip.c
+++ b/drivers/net/dsa/mv88e6xxx/chip.c
@@ -849,6 +849,9 @@ static uint64_t _mv88e6xxx_get_ethtool_stat(struct mv88e6xxx_chip *chip,
                 mv88e6xxx_g1_stats_read(chip, reg, &low);
                 if (s->sizeof_stat == 8)
                         mv88e6xxx_g1_stats_read(chip, reg + 1, &high);
+                break;
+        default:
+                return UINT64_MAX;
         }
         value = (((u64)high) << 16) | low;
         return value;
diff --git a/drivers/net/ethernet/8390/ax88796.c b/drivers/net/ethernet/8390/ax88796.c
index b0a3b85fc6f8..db02bc2fb4b2 100644
--- a/drivers/net/ethernet/8390/ax88796.c
+++ b/drivers/net/ethernet/8390/ax88796.c
@@ -748,13 +748,13 @@ static int ax_init_dev(struct net_device *dev)
 
         ret = ax_mii_init(dev);
         if (ret)
-                goto out_irq;
+                goto err_out;
 
         ax_NS8390_init(dev, 0);
 
         ret = register_netdev(dev);
         if (ret)
-                goto out_irq;
+                goto err_out;
 
         netdev_info(dev, "%dbit, irq %d, %lx, MAC: %pM\n",
                     ei_local->word16 ? 16 : 8, dev->irq, dev->base_addr,
@@ -762,9 +762,6 @@ static int ax_init_dev(struct net_device *dev)
 
         return 0;
 
- out_irq:
-        /* cleanup irq */
-        free_irq(dev->irq, dev);
  err_out:
         return ret;
 }
diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c
index 4ee15ff06a44..faeb4935ef3e 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c
@@ -200,29 +200,18 @@ err_exit:
 static int hw_atl_a0_hw_offload_set(struct aq_hw_s *self,
                                     struct aq_nic_cfg_s *aq_nic_cfg)
 {
-        int err = 0;
-
         /* TX checksums offloads*/
         tpo_ipv4header_crc_offload_en_set(self, 1);
         tpo_tcp_udp_crc_offload_en_set(self, 1);
-        if (err < 0)
-                goto err_exit;
 
         /* RX checksums offloads*/
         rpo_ipv4header_crc_offload_en_set(self, 1);
         rpo_tcp_udp_crc_offload_en_set(self, 1);
-        if (err < 0)
-                goto err_exit;
 
         /* LSO offloads*/
         tdm_large_send_offload_en_set(self, 0xFFFFFFFFU);
-        if (err < 0)
-                goto err_exit;
-
-        err = aq_hw_err_from_flags(self);
 
-err_exit:
-        return err;
+        return aq_hw_err_from_flags(self);
 }
 
 static int hw_atl_a0_hw_init_tx_path(struct aq_hw_s *self)
diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
index 42150708191d..1bceb7358e5c 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
@@ -200,25 +200,18 @@ err_exit:
 static int hw_atl_b0_hw_offload_set(struct aq_hw_s *self,
                                     struct aq_nic_cfg_s *aq_nic_cfg)
 {
-        int err = 0;
         unsigned int i;
 
         /* TX checksums offloads*/
         tpo_ipv4header_crc_offload_en_set(self, 1);
         tpo_tcp_udp_crc_offload_en_set(self, 1);
-        if (err < 0)
-                goto err_exit;
 
         /* RX checksums offloads*/
         rpo_ipv4header_crc_offload_en_set(self, 1);
         rpo_tcp_udp_crc_offload_en_set(self, 1);
-        if (err < 0)
-                goto err_exit;
 
         /* LSO offloads*/
         tdm_large_send_offload_en_set(self, 0xFFFFFFFFU);
-        if (err < 0)
-                goto err_exit;
 
 /* LRO offloads */
         {
@@ -245,10 +238,7 @@ static int hw_atl_b0_hw_offload_set(struct aq_hw_s *self,
 
                 rpo_lro_en_set(self, aq_nic_cfg->is_lro ? 0xFFFFFFFFU : 0U);
         }
-        err = aq_hw_err_from_flags(self);
-
-err_exit:
-        return err;
+        return aq_hw_err_from_flags(self);
 }
 
 static int hw_atl_b0_hw_init_tx_path(struct aq_hw_s *self)
diff --git a/drivers/net/ethernet/atheros/atlx/atl2.c b/drivers/net/ethernet/atheros/atlx/atl2.c
index 63f2deec2a52..77a1c03255de 100644
--- a/drivers/net/ethernet/atheros/atlx/atl2.c
+++ b/drivers/net/ethernet/atheros/atlx/atl2.c
@@ -1353,6 +1353,7 @@ static int atl2_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         if (pci_set_dma_mask(pdev, DMA_BIT_MASK(32)) &&
                 pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(32))) {
                 printk(KERN_ERR "atl2: No usable DMA configuration, aborting\n");
+                err = -EIO;
                 goto err_dma;
         }
 
@@ -1366,10 +1367,11 @@ static int atl2_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
          * pcibios_set_master to do the needed arch specific settings */
         pci_set_master(pdev);
 
-        err = -ENOMEM;
         netdev = alloc_etherdev(sizeof(struct atl2_adapter));
-        if (!netdev)
+        if (!netdev) {
+                err = -ENOMEM;
                 goto err_alloc_etherdev;
+        }
 
         SET_NETDEV_DEV(netdev, &pdev->dev);
 
@@ -1408,8 +1410,6 @@ static int atl2_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         if (err)
                 goto err_sw_init;
 
-        err = -EIO;
-
         netdev->hw_features = NETIF_F_HW_VLAN_CTAG_RX;
         netdev->features |= (NETIF_F_HW_VLAN_CTAG_TX | NETIF_F_HW_VLAN_CTAG_RX);
 
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index b56c54d68d5e..03f55daecb20 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -7630,8 +7630,6 @@ static int bnxt_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         dev->min_mtu = ETH_ZLEN;
         dev->max_mtu = BNXT_MAX_MTU;
 
-        bnxt_dcb_init(bp);
-
 #ifdef CONFIG_BNXT_SRIOV
         init_waitqueue_head(&bp->sriov_cfg_wait);
 #endif
@@ -7669,6 +7667,7 @@ static int bnxt_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         bnxt_hwrm_func_qcfg(bp);
         bnxt_hwrm_port_led_qcaps(bp);
         bnxt_ethtool_init(bp);
+        bnxt_dcb_init(bp);
 
         bnxt_set_rx_skb_mode(bp, false);
         bnxt_set_tpa_flags(bp);
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c
index 46de2f8ff024..5c6dd0ce209f 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c
@@ -553,8 +553,10 @@ static u8 bnxt_dcbnl_setdcbx(struct net_device *dev, u8 mode)
         if ((mode & DCB_CAP_DCBX_VER_CEE) || !(mode & DCB_CAP_DCBX_VER_IEEE))
                 return 1;
 
-        if ((mode & DCB_CAP_DCBX_HOST) && BNXT_VF(bp))
-                return 1;
+        if (mode & DCB_CAP_DCBX_HOST) {
+                if (BNXT_VF(bp) || (bp->flags & BNXT_FLAG_FW_LLDP_AGENT))
+                        return 1;
+        }
 
         if (mode == bp->dcbx_cap)
                 return 0;
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4fw_version.h b/drivers/net/ethernet/chelsio/cxgb4/t4fw_version.h
index fa376444e57c..3549d3876278 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4fw_version.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4fw_version.h
@@ -37,7 +37,7 @@
 
 #define T4FW_VERSION_MAJOR 0x01
 #define T4FW_VERSION_MINOR 0x10
-#define T4FW_VERSION_MICRO 0x21
+#define T4FW_VERSION_MICRO 0x2B
 #define T4FW_VERSION_BUILD 0x00
 
 #define T4FW_MIN_VERSION_MAJOR 0x01
@@ -46,7 +46,7 @@
 
 #define T5FW_VERSION_MAJOR 0x01
 #define T5FW_VERSION_MINOR 0x10
-#define T5FW_VERSION_MICRO 0x21
+#define T5FW_VERSION_MICRO 0x2B
 #define T5FW_VERSION_BUILD 0x00
 
 #define T5FW_MIN_VERSION_MAJOR 0x00
@@ -55,7 +55,7 @@
 
 #define T6FW_VERSION_MAJOR 0x01
 #define T6FW_VERSION_MINOR 0x10
-#define T6FW_VERSION_MICRO 0x21
+#define T6FW_VERSION_MICRO 0x2B
 #define T6FW_VERSION_BUILD 0x00
 
 #define T6FW_MIN_VERSION_MAJOR 0x00
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index f3a09ab55900..4eee18ce9be4 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -5078,9 +5078,11 @@ static netdev_features_t be_features_check(struct sk_buff *skb,
         struct be_adapter *adapter = netdev_priv(dev);
         u8 l4_hdr = 0;
 
-        /* The code below restricts offload features for some tunneled packets.
+        /* The code below restricts offload features for some tunneled and
+         * Q-in-Q packets.
          * Offload features for normal (non tunnel) packets are unchanged.
          */
+        features = vlan_features_check(skb, features);
         if (!skb->encapsulation ||
             !(adapter->flags & BE_FLAGS_VXLAN_OFFLOADS))
                 return features;
diff --git a/drivers/net/ethernet/faraday/ftmac100.c b/drivers/net/ethernet/faraday/ftmac100.c
index 6ac336b546e6..1536356e2ea8 100644
--- a/drivers/net/ethernet/faraday/ftmac100.c
+++ b/drivers/net/ethernet/faraday/ftmac100.c
@@ -1174,11 +1174,17 @@ static int ftmac100_remove(struct platform_device *pdev)
         return 0;
 }
 
+static const struct of_device_id ftmac100_of_ids[] = {
+        { .compatible = "andestech,atmac100" },
+        { }
+};
+
 static struct platform_driver ftmac100_driver = {
         .probe          = ftmac100_probe,
         .remove         = ftmac100_remove,
         .driver         = {
                 .name   = DRV_NAME,
+                .of_match_table = ftmac100_of_ids
         },
 };
 
@@ -1202,3 +1208,4 @@ module_exit(ftmac100_exit);
 MODULE_AUTHOR("Po-Yu Chuang <ratbert@faraday-tech.com>");
 MODULE_DESCRIPTION("FTMAC100 driver");
 MODULE_LICENSE("GPL");
+MODULE_DEVICE_TABLE(of, ftmac100_of_ids);
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index 56a563f90b0b..f7c8649fd28f 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -3192,7 +3192,7 @@ static int fec_reset_phy(struct platform_device *pdev)
 {
         int err, phy_reset;
         bool active_high = false;
-        int msec = 1;
+        int msec = 1, phy_post_delay = 0;
         struct device_node *np = pdev->dev.of_node;
 
         if (!np)
@@ -3209,6 +3209,11 @@ static int fec_reset_phy(struct platform_device *pdev)
         else if (!gpio_is_valid(phy_reset))
                 return 0;
 
+        err = of_property_read_u32(np, "phy-reset-post-delay", &phy_post_delay);
+        /* valid reset duration should be less than 1s */
+        if (!err && phy_post_delay > 1000)
+                return -EINVAL;
+
         active_high = of_property_read_bool(np, "phy-reset-active-high");
 
         err = devm_gpio_request_one(&pdev->dev, phy_reset,
@@ -3226,6 +3231,15 @@ static int fec_reset_phy(struct platform_device *pdev)
 
         gpio_set_value_cansleep(phy_reset, !active_high);
 
+        if (!phy_post_delay)
+                return 0;
+
+        if (phy_post_delay > 20)
+                msleep(phy_post_delay);
+        else
+                usleep_range(phy_post_delay * 1000,
+                             phy_post_delay * 1000 + 1000);
+
         return 0;
 }
 #else /* CONFIG_OF */
diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
index 703205475524..83aab1e4c8c8 100644
--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -2862,12 +2862,10 @@ static void mlx4_enable_msi_x(struct mlx4_dev *dev)
         int port = 0;
 
         if (msi_x) {
-                int nreq = dev->caps.num_ports * num_online_cpus() + 1;
-
-                nreq = min_t(int, dev->caps.num_eqs - dev->caps.reserved_eqs,
-                             nreq);
-                if (nreq > MAX_MSIX)
-                        nreq = MAX_MSIX;
+                int nreq = min3(dev->caps.num_ports *
+                                (int)num_online_cpus() + 1,
+                                dev->caps.num_eqs - dev->caps.reserved_eqs,
+                                MAX_MSIX);
 
                 entries = kcalloc(nreq, sizeof *entries, GFP_KERNEL);
                 if (!entries)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/Kconfig b/drivers/net/ethernet/mellanox/mlx5/core/Kconfig
index fc52d742b7f7..27251a78075c 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/Kconfig
+++ b/drivers/net/ethernet/mellanox/mlx5/core/Kconfig
@@ -13,7 +13,7 @@ config MLX5_CORE
 
 config MLX5_CORE_EN
         bool "Mellanox Technologies ConnectX-4 Ethernet support"
-        depends on NETDEVICES && ETHERNET && PCI && MLX5_CORE
+        depends on NETDEVICES && ETHERNET && INET && PCI && MLX5_CORE
         depends on IPV6=y || IPV6=n || MLX5_CORE=m
         imply PTP_1588_CLOCK
         default n
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
index 5bdaf3d545b2..10d282841f5b 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
@@ -774,7 +774,7 @@ static void cb_timeout_handler(struct work_struct *work)
         mlx5_core_warn(dev, "%s(0x%x) timeout. Will cause a leak of a command resource\n",
                        mlx5_command_str(msg_to_opcode(ent->in)),
                        msg_to_opcode(ent->in));
-        mlx5_cmd_comp_handler(dev, 1UL << ent->idx);
+        mlx5_cmd_comp_handler(dev, 1UL << ent->idx, true);
 }
 
 static void cmd_work_handler(struct work_struct *work)
@@ -804,6 +804,7 @@ static void cmd_work_handler(struct work_struct *work)
         }
 
         cmd->ent_arr[ent->idx] = ent;
+        set_bit(MLX5_CMD_ENT_STATE_PENDING_COMP, &ent->state);
         lay = get_inst(cmd, ent->idx);
         ent->lay = lay;
         memset(lay, 0, sizeof(*lay));
@@ -825,6 +826,20 @@ static void cmd_work_handler(struct work_struct *work)
         if (ent->callback)
                 schedule_delayed_work(&ent->cb_timeout_work, cb_timeout);
 
+        /* Skip sending command to fw if internal error */
+        if (pci_channel_offline(dev->pdev) ||
+            dev->state == MLX5_DEVICE_STATE_INTERNAL_ERROR) {
+                u8 status = 0;
+                u32 drv_synd;
+
+                ent->ret = mlx5_internal_err_ret_value(dev, msg_to_opcode(ent->in), &drv_synd, &status);
+                MLX5_SET(mbox_out, ent->out, status, status);
+                MLX5_SET(mbox_out, ent->out, syndrome, drv_synd);
+
+                mlx5_cmd_comp_handler(dev, 1UL << ent->idx, true);
+                return;
+        }
+
         /* ring doorbell after the descriptor is valid */
         mlx5_core_dbg(dev, "writing 0x%x to command doorbell\n", 1 << ent->idx);
         wmb();
@@ -835,7 +850,7 @@ static void cmd_work_handler(struct work_struct *work)
                 poll_timeout(ent);
                 /* make sure we read the descriptor after ownership is SW */
                 rmb();
-                mlx5_cmd_comp_handler(dev, 1UL << ent->idx);
+                mlx5_cmd_comp_handler(dev, 1UL << ent->idx, (ent->ret == -ETIMEDOUT));
         }
 }
 
@@ -879,7 +894,7 @@ static int wait_func(struct mlx5_core_dev *dev, struct mlx5_cmd_work_ent *ent)
                 wait_for_completion(&ent->done);
         } else if (!wait_for_completion_timeout(&ent->done, timeout)) {
                 ent->ret = -ETIMEDOUT;
-                mlx5_cmd_comp_handler(dev, 1UL << ent->idx);
+                mlx5_cmd_comp_handler(dev, 1UL << ent->idx, true);
         }
 
         err = ent->ret;
@@ -1375,7 +1390,7 @@ static void free_msg(struct mlx5_core_dev *dev, struct mlx5_cmd_msg *msg)
         }
 }
 
-void mlx5_cmd_comp_handler(struct mlx5_core_dev *dev, u64 vec)
+void mlx5_cmd_comp_handler(struct mlx5_core_dev *dev, u64 vec, bool forced)
 {
         struct mlx5_cmd *cmd = &dev->cmd;
         struct mlx5_cmd_work_ent *ent;
@@ -1395,6 +1410,19 @@ void mlx5_cmd_comp_handler(struct mlx5_core_dev *dev, u64 vec)
                         struct semaphore *sem;
 
                         ent = cmd->ent_arr[i];
+
+                        /* if we already completed the command, ignore it */
+                        if (!test_and_clear_bit(MLX5_CMD_ENT_STATE_PENDING_COMP,
+                                                &ent->state)) {
+                                /* only real completion can free the cmd slot */
+                                if (!forced) {
+                                        mlx5_core_err(dev, "Command completion arrived after timeout (entry idx = %d).\n",
+                                                      ent->idx);
+                                        free_ent(cmd, ent->idx);
+                                }
+                                continue;
+                        }
+
                         if (ent->callback)
                                 cancel_delayed_work(&ent->cb_timeout_work);
                         if (ent->page_queue)
@@ -1417,7 +1445,10 @@ void mlx5_cmd_comp_handler(struct mlx5_core_dev *dev, u64 vec)
                                 mlx5_core_dbg(dev, "command completed. ret 0x%x, delivery status %s(0x%x)\n",
                                               ent->ret, deliv_status_to_str(ent->status), ent->status);
                         }
-                        free_ent(cmd, ent->idx);
+
+                        /* only real completion will free the entry slot */
+                        if (!forced)
+                                free_ent(cmd, ent->idx);
 
                         if (ent->callback) {
                                 ds = ent->ts2 - ent->ts1;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h
index 0099a3e397bc..2fd044b23875 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h
@@ -1003,7 +1003,7 @@ int mlx5e_create_direct_tirs(struct mlx5e_priv *priv);
 void mlx5e_destroy_direct_tirs(struct mlx5e_priv *priv);
 void mlx5e_destroy_rqt(struct mlx5e_priv *priv, struct mlx5e_rqt *rqt);
 
-int mlx5e_create_ttc_table(struct mlx5e_priv *priv, u32 underlay_qpn);
+int mlx5e_create_ttc_table(struct mlx5e_priv *priv);
 void mlx5e_destroy_ttc_table(struct mlx5e_priv *priv);
 
 int mlx5e_create_tis(struct mlx5_core_dev *mdev, int tc,
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
index ce7b09d72ff6..8209affa75c3 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
@@ -794,7 +794,6 @@ static void get_supported(u32 eth_proto_cap,
         ptys2ethtool_supported_port(link_ksettings, eth_proto_cap);
         ptys2ethtool_supported_link(supported, eth_proto_cap);
         ethtool_link_ksettings_add_link_mode(link_ksettings, supported, Pause);
-        ethtool_link_ksettings_add_link_mode(link_ksettings, supported, Asym_Pause);
 }
 
 static void get_advertising(u32 eth_proto_cap, u8 tx_pause,
@@ -804,7 +803,7 @@ static void get_advertising(u32 eth_proto_cap, u8 tx_pause,
         unsigned long *advertising = link_ksettings->link_modes.advertising;
 
         ptys2ethtool_adver_link(advertising, eth_proto_cap);
-        if (tx_pause)
+        if (rx_pause)
                 ethtool_link_ksettings_add_link_mode(link_ksettings, advertising, Pause);
         if (tx_pause ^ rx_pause)
                 ethtool_link_ksettings_add_link_mode(link_ksettings, advertising, Asym_Pause);
@@ -849,6 +848,8 @@ static int mlx5e_get_link_ksettings(struct net_device *netdev,
         struct mlx5e_priv *priv    = netdev_priv(netdev);
         struct mlx5_core_dev *mdev = priv->mdev;
         u32 out[MLX5_ST_SZ_DW(ptys_reg)] = {0};
+        u32 rx_pause = 0;
+        u32 tx_pause = 0;
         u32 eth_proto_cap;
         u32 eth_proto_admin;
         u32 eth_proto_lp;
@@ -871,11 +872,13 @@ static int mlx5e_get_link_ksettings(struct net_device *netdev,
         an_disable_admin = MLX5_GET(ptys_reg, out, an_disable_admin);
         an_status        = MLX5_GET(ptys_reg, out, an_status);
 
+        mlx5_query_port_pause(mdev, &rx_pause, &tx_pause);
+
         ethtool_link_ksettings_zero_link_mode(link_ksettings, supported);
         ethtool_link_ksettings_zero_link_mode(link_ksettings, advertising);
 
         get_supported(eth_proto_cap, link_ksettings);
-        get_advertising(eth_proto_admin, 0, 0, link_ksettings);
+        get_advertising(eth_proto_admin, tx_pause, rx_pause, link_ksettings);
         get_speed_duplex(netdev, eth_proto_oper, link_ksettings);
 
         eth_proto_oper = eth_proto_oper ? eth_proto_oper : eth_proto_cap;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c
index 576d6787b484..53ed58320a24 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c
@@ -800,7 +800,7 @@ void mlx5e_destroy_ttc_table(struct mlx5e_priv *priv)
         mlx5e_destroy_flow_table(&ttc->ft);
 }
 
-int mlx5e_create_ttc_table(struct mlx5e_priv *priv, u32 underlay_qpn)
+int mlx5e_create_ttc_table(struct mlx5e_priv *priv)
 {
         struct mlx5e_ttc_table *ttc = &priv->fs.ttc;
         struct mlx5_flow_table_attr ft_attr = {};
@@ -810,7 +810,6 @@ int mlx5e_create_ttc_table(struct mlx5e_priv *priv, u32 underlay_qpn)
         ft_attr.max_fte = MLX5E_TTC_TABLE_SIZE;
         ft_attr.level = MLX5E_TTC_FT_LEVEL;
         ft_attr.prio = MLX5E_NIC_PRIO;
-        ft_attr.underlay_qpn = underlay_qpn;
 
         ft->t = mlx5_create_flow_table(priv->fs.ns, &ft_attr);
         if (IS_ERR(ft->t)) {
@@ -1147,7 +1146,7 @@ int mlx5e_create_flow_steering(struct mlx5e_priv *priv)
                 priv->netdev->hw_features &= ~NETIF_F_NTUPLE;
         }
 
-        err = mlx5e_create_ttc_table(priv, 0);
+        err = mlx5e_create_ttc_table(priv);
         if (err) {
                 netdev_err(priv->netdev, "Failed to create ttc table, err=%d\n",
                            err);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index a61b71b6fff3..41cd22a223dc 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -2976,7 +2976,7 @@ static int mlx5e_setup_tc(struct net_device *netdev, u8 tc)
         new_channels.params = priv->channels.params;
         new_channels.params.num_tc = tc ? tc : 1;
 
-        if (test_bit(MLX5E_STATE_OPENED, &priv->state)) {
+        if (!test_bit(MLX5E_STATE_OPENED, &priv->state)) {
                 priv->channels.params = new_channels.params;
                 goto out;
         }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
index 7b1566f0ae58..66b5fec15313 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
@@ -1041,6 +1041,8 @@ void mlx5e_free_xdpsq_descs(struct mlx5e_xdpsq *sq)
 #define MLX5_IB_GRH_BYTES       40
 #define MLX5_IPOIB_ENCAP_LEN    4
 #define MLX5_GID_SIZE           16
+#define MLX5_IPOIB_PSEUDO_LEN   20
+#define MLX5_IPOIB_HARD_LEN     (MLX5_IPOIB_PSEUDO_LEN + MLX5_IPOIB_ENCAP_LEN)
 
 static inline void mlx5i_complete_rx_cqe(struct mlx5e_rq *rq,
                                          struct mlx5_cqe64 *cqe,
@@ -1048,6 +1050,7 @@ static inline void mlx5i_complete_rx_cqe(struct mlx5e_rq *rq,
                                          struct sk_buff *skb)
 {
         struct net_device *netdev = rq->netdev;
+        char *pseudo_header;
         u8 *dgid;
         u8 g;
 
@@ -1076,8 +1079,11 @@ static inline void mlx5i_complete_rx_cqe(struct mlx5e_rq *rq,
         if (likely(netdev->features & NETIF_F_RXHASH))
                 mlx5e_skb_set_hash(cqe, skb);
 
+        /* 20 bytes of ipoib header and 4 for encap existing */
+        pseudo_header = skb_push(skb, MLX5_IPOIB_PSEUDO_LEN);
+        memset(pseudo_header, 0, MLX5_IPOIB_PSEUDO_LEN);
         skb_reset_mac_header(skb);
-        skb_pull(skb, MLX5_IPOIB_ENCAP_LEN);
+        skb_pull(skb, MLX5_IPOIB_HARD_LEN);
 
         skb->dev = netdev;
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
index 11c27e4fadf6..ec63158ab643 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
@@ -43,6 +43,7 @@
 #include <net/tc_act/tc_vlan.h>
 #include <net/tc_act/tc_tunnel_key.h>
 #include <net/tc_act/tc_pedit.h>
+#include <net/tc_act/tc_csum.h>
 #include <net/vxlan.h>
 #include <net/arp.h>
 #include "en.h"
@@ -384,7 +385,7 @@ static void mlx5e_detach_encap(struct mlx5e_priv *priv,
                 if (e->flags & MLX5_ENCAP_ENTRY_VALID)
                         mlx5_encap_dealloc(priv->mdev, e->encap_id);
 
-                hlist_del_rcu(&e->encap_hlist);
+                hash_del_rcu(&e->encap_hlist);
                 kfree(e->encap_header);
                 kfree(e);
         }
@@ -925,11 +926,11 @@ static int offload_pedit_fields(struct pedit_headers *masks,
                                 struct mlx5e_tc_flow_parse_attr *parse_attr)
 {
         struct pedit_headers *set_masks, *add_masks, *set_vals, *add_vals;
-        int i, action_size, nactions, max_actions, first, last;
+        int i, action_size, nactions, max_actions, first, last, first_z;
         void *s_masks_p, *a_masks_p, *vals_p;
-        u32 s_mask, a_mask, val;
         struct mlx5_fields *f;
         u8 cmd, field_bsize;
+        u32 s_mask, a_mask;
         unsigned long mask;
         void *action;
 
@@ -946,7 +947,8 @@ static int offload_pedit_fields(struct pedit_headers *masks,
         for (i = 0; i < ARRAY_SIZE(fields); i++) {
                 f = &fields[i];
                 /* avoid seeing bits set from previous iterations */
-                s_mask = a_mask = mask = val = 0;
+                s_mask = 0;
+                a_mask = 0;
 
                 s_masks_p = (void *)set_masks + f->offset;
                 a_masks_p = (void *)add_masks + f->offset;
@@ -981,12 +983,12 @@ static int offload_pedit_fields(struct pedit_headers *masks,
                         memset(a_masks_p, 0, f->size);
                 }
 
-                memcpy(&val, vals_p, f->size);
-
                 field_bsize = f->size * BITS_PER_BYTE;
+
+                first_z = find_first_zero_bit(&mask, field_bsize);
                 first = find_first_bit(&mask, field_bsize);
                 last  = find_last_bit(&mask, field_bsize);
-                if (first > 0 || last != (field_bsize - 1)) {
+                if (first > 0 || last != (field_bsize - 1) || first_z < last) {
                         printk(KERN_WARNING "mlx5: partial rewrite (mask %lx) is currently not offloaded\n",
                                mask);
                         return -EOPNOTSUPP;
@@ -1002,11 +1004,11 @@ static int offload_pedit_fields(struct pedit_headers *masks,
                 }
 
                 if (field_bsize == 32)
-                        MLX5_SET(set_action_in, action, data, ntohl(val));
+                        MLX5_SET(set_action_in, action, data, ntohl(*(__be32 *)vals_p));
                 else if (field_bsize == 16)
-                        MLX5_SET(set_action_in, action, data, ntohs(val));
+                        MLX5_SET(set_action_in, action, data, ntohs(*(__be16 *)vals_p));
                 else if (field_bsize == 8)
-                        MLX5_SET(set_action_in, action, data, val);
+                        MLX5_SET(set_action_in, action, data, *(u8 *)vals_p);
 
                 action += action_size;
                 nactions++;
@@ -1109,6 +1111,28 @@ out_err:
         return err;
 }
 
+static bool csum_offload_supported(struct mlx5e_priv *priv, u32 action, u32 update_flags)
+{
+        u32 prot_flags = TCA_CSUM_UPDATE_FLAG_IPV4HDR | TCA_CSUM_UPDATE_FLAG_TCP |
+                         TCA_CSUM_UPDATE_FLAG_UDP;
+
+        /*  The HW recalcs checksums only if re-writing headers */
+        if (!(action & MLX5_FLOW_CONTEXT_ACTION_MOD_HDR)) {
+                netdev_warn(priv->netdev,
+                            "TC csum action is only offloaded with pedit\n");
+                return false;
+        }
+
+        if (update_flags & ~prot_flags) {
+                netdev_warn(priv->netdev,
+                            "can't offload TC csum action for some header/s - flags %#x\n",
+                            update_flags);
+                return false;
+        }
+
+        return true;
+}
+
 static int parse_tc_nic_actions(struct mlx5e_priv *priv, struct tcf_exts *exts,
                                 struct mlx5e_tc_flow_parse_attr *parse_attr,
                                 struct mlx5e_tc_flow *flow)
@@ -1149,6 +1173,14 @@ static int parse_tc_nic_actions(struct mlx5e_priv *priv, struct tcf_exts *exts,
                         continue;
                 }
 
+                if (is_tcf_csum(a)) {
+                        if (csum_offload_supported(priv, attr->action,
+                                                   tcf_csum_update_flags(a)))
+                                continue;
+
+                        return -EOPNOTSUPP;
+                }
+
                 if (is_tcf_skbedit_mark(a)) {
                         u32 mark = tcf_skbedit_mark(a);
 
@@ -1651,6 +1683,14 @@ static int parse_tc_fdb_actions(struct mlx5e_priv *priv, struct tcf_exts *exts,
                         continue;
                 }
 
+                if (is_tcf_csum(a)) {
+                        if (csum_offload_supported(priv, attr->action,
+                                                   tcf_csum_update_flags(a)))
+                                continue;
+
+                        return -EOPNOTSUPP;
+                }
+
                 if (is_tcf_mirred_egress_redirect(a)) {
                         int ifindex = tcf_mirred_ifindex(a);
                         struct net_device *out_dev, *encap_dev = NULL;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eq.c b/drivers/net/ethernet/mellanox/mlx5/core/eq.c
index ea5d8d37a75c..33eae5ad2fb0 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eq.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eq.c
@@ -422,7 +422,7 @@ static irqreturn_t mlx5_eq_int(int irq, void *eq_ptr)
                         break;
 
                 case MLX5_EVENT_TYPE_CMD:
-                        mlx5_cmd_comp_handler(dev, be32_to_cpu(eqe->data.cmd.vector));
+                        mlx5_cmd_comp_handler(dev, be32_to_cpu(eqe->data.cmd.vector), false);
                         break;
 
                 case MLX5_EVENT_TYPE_PORT_CHANGE:
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c
index 19e3d2fc2099..fcec7bedd3cd 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c
@@ -40,28 +40,25 @@
 #include "eswitch.h"
 
 int mlx5_cmd_update_root_ft(struct mlx5_core_dev *dev,
-                            struct mlx5_flow_table *ft)
+                            struct mlx5_flow_table *ft, u32 underlay_qpn)
 {
         u32 in[MLX5_ST_SZ_DW(set_flow_table_root_in)]   = {0};
         u32 out[MLX5_ST_SZ_DW(set_flow_table_root_out)] = {0};
 
         if ((MLX5_CAP_GEN(dev, port_type) == MLX5_CAP_PORT_TYPE_IB) &&
-            ft->underlay_qpn == 0)
+            underlay_qpn == 0)
                 return 0;
 
         MLX5_SET(set_flow_table_root_in, in, opcode,
                  MLX5_CMD_OP_SET_FLOW_TABLE_ROOT);
         MLX5_SET(set_flow_table_root_in, in, table_type, ft->type);
         MLX5_SET(set_flow_table_root_in, in, table_id, ft->id);
+        MLX5_SET(set_flow_table_root_in, in, underlay_qpn, underlay_qpn);
         if (ft->vport) {
                 MLX5_SET(set_flow_table_root_in, in, vport_number, ft->vport);
                 MLX5_SET(set_flow_table_root_in, in, other_vport, 1);
         }
 
-        if ((MLX5_CAP_GEN(dev, port_type) == MLX5_CAP_PORT_TYPE_IB) &&
-            ft->underlay_qpn != 0)
-                MLX5_SET(set_flow_table_root_in, in, underlay_qpn, ft->underlay_qpn);
-
         return mlx5_cmd_exec(dev, in, sizeof(in), out, sizeof(out));
 }
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.h b/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.h
index 8fad80688536..0f98a7cf4877 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.h
@@ -71,7 +71,8 @@ int mlx5_cmd_delete_fte(struct mlx5_core_dev *dev,
                         unsigned int index);
 
 int mlx5_cmd_update_root_ft(struct mlx5_core_dev *dev,
-                            struct mlx5_flow_table *ft);
+                            struct mlx5_flow_table *ft,
+                            u32 underlay_qpn);
 
 int mlx5_cmd_fc_alloc(struct mlx5_core_dev *dev, u16 *id);
 int mlx5_cmd_fc_free(struct mlx5_core_dev *dev, u16 id);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
index b8a176503d38..0e487e8ca634 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
@@ -650,7 +650,7 @@ static int update_root_ft_create(struct mlx5_flow_table *ft, struct fs_prio
         if (ft->level >= min_level)
                 return 0;
 
-        err = mlx5_cmd_update_root_ft(root->dev, ft);
+        err = mlx5_cmd_update_root_ft(root->dev, ft, root->underlay_qpn);
         if (err)
                 mlx5_core_warn(root->dev, "Update root flow table of id=%u failed\n",
                                ft->id);
@@ -818,8 +818,6 @@ static struct mlx5_flow_table *__mlx5_create_flow_table(struct mlx5_flow_namespa
                 goto unlock_root;
         }
 
-        ft->underlay_qpn = ft_attr->underlay_qpn;
-
         tree_init_node(&ft->node, 1, del_flow_table);
         log_table_sz = ft->max_fte ? ilog2(ft->max_fte) : 0;
         next_ft = find_next_chained_ft(fs_prio);
@@ -1489,7 +1487,8 @@ static int update_root_ft_destroy(struct mlx5_flow_table *ft)
 
         new_root_ft = find_next_ft(ft);
         if (new_root_ft) {
-                int err = mlx5_cmd_update_root_ft(root->dev, new_root_ft);
+                int err = mlx5_cmd_update_root_ft(root->dev, new_root_ft,
+                                                  root->underlay_qpn);
 
                 if (err) {
                         mlx5_core_warn(root->dev, "Update root flow table of id=%u failed\n",
@@ -2062,3 +2061,21 @@ err:
         mlx5_cleanup_fs(dev);
         return err;
 }
+
+int mlx5_fs_add_rx_underlay_qpn(struct mlx5_core_dev *dev, u32 underlay_qpn)
+{
+        struct mlx5_flow_root_namespace *root = dev->priv.steering->root_ns;
+
+        root->underlay_qpn = underlay_qpn;
+        return 0;
+}
+EXPORT_SYMBOL(mlx5_fs_add_rx_underlay_qpn);
+
+int mlx5_fs_remove_rx_underlay_qpn(struct mlx5_core_dev *dev, u32 underlay_qpn)
+{
+        struct mlx5_flow_root_namespace *root = dev->priv.steering->root_ns;
+
+        root->underlay_qpn = 0;
+        return 0;
+}
+EXPORT_SYMBOL(mlx5_fs_remove_rx_underlay_qpn);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.h b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.h
index 81eafc7b9dd9..990acee6fb09 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.h
@@ -118,7 +118,6 @@ struct mlx5_flow_table {
         /* FWD rules that point on this flow table */
         struct list_head                fwd_rules;
         u32                             flags;
-        u32                             underlay_qpn;
 };
 
 struct mlx5_fc_cache {
@@ -195,6 +194,7 @@ struct mlx5_flow_root_namespace {
         struct mlx5_flow_table          *root_ft;
         /* Should be held when chaining flow tables */
         struct mutex                    chain_lock;
+        u32                             underlay_qpn;
 };
 
 int mlx5_init_fc_stats(struct mlx5_core_dev *dev);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/health.c b/drivers/net/ethernet/mellanox/mlx5/core/health.c
index d0515391d33b..44f59b1d6f0f 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/health.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/health.c
@@ -90,7 +90,7 @@ static void trigger_cmd_completions(struct mlx5_core_dev *dev)
         spin_unlock_irqrestore(&dev->cmd.alloc_lock, flags);
 
         mlx5_core_dbg(dev, "vector 0x%llx\n", vector);
-        mlx5_cmd_comp_handler(dev, vector);
+        mlx5_cmd_comp_handler(dev, vector, true);
         return;
 
 no_trig:
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/ipoib.c b/drivers/net/ethernet/mellanox/mlx5/core/ipoib.c
index 019c230da498..cc1858752e70 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/ipoib.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/ipoib.c
@@ -66,6 +66,10 @@ static void mlx5i_init(struct mlx5_core_dev *mdev,
 
         mlx5e_build_nic_params(mdev, &priv->channels.params, profile->max_nch(mdev));
 
+        /* Override RQ params as IPoIB supports only LINKED LIST RQ for now */
+        mlx5e_set_rq_type_params(mdev, &priv->channels.params, MLX5_WQ_TYPE_LINKED_LIST);
+        priv->channels.params.lro_en = false;
+
         mutex_init(&priv->state_lock);
 
         netdev->hw_features    |= NETIF_F_SG;
@@ -156,6 +160,8 @@ out:
 
 static void mlx5i_destroy_underlay_qp(struct mlx5_core_dev *mdev, struct mlx5_core_qp *qp)
 {
+        mlx5_fs_remove_rx_underlay_qpn(mdev, qp->qpn);
+
         mlx5_core_destroy_qp(mdev, qp);
 }
 
@@ -170,6 +176,8 @@ static int mlx5i_init_tx(struct mlx5e_priv *priv)
                 return err;
         }
 
+        mlx5_fs_add_rx_underlay_qpn(priv->mdev, ipriv->qp.qpn);
+
         err = mlx5e_create_tis(priv->mdev, 0 /* tc */, ipriv->qp.qpn, &priv->tisn[0]);
         if (err) {
                 mlx5_core_warn(priv->mdev, "create tis failed, %d\n", err);
@@ -189,7 +197,6 @@ static void mlx5i_cleanup_tx(struct mlx5e_priv *priv)
 
 static int mlx5i_create_flow_steering(struct mlx5e_priv *priv)
 {
-        struct mlx5i_priv *ipriv = priv->ppriv;
         int err;
 
         priv->fs.ns = mlx5_get_flow_namespace(priv->mdev,
@@ -205,7 +212,7 @@ static int mlx5i_create_flow_steering(struct mlx5e_priv *priv)
                 priv->netdev->hw_features &= ~NETIF_F_NTUPLE;
         }
 
-        err = mlx5e_create_ttc_table(priv, ipriv->qp.qpn);
+        err = mlx5e_create_ttc_table(priv);
         if (err) {
                 netdev_err(priv->netdev, "Failed to create ttc table, err=%d\n",
                            err);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
index 0c123d571b4c..fe5546bb4153 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
@@ -612,7 +612,6 @@ static int mlx5_irq_set_affinity_hint(struct mlx5_core_dev *mdev, int i)
         struct mlx5_priv *priv  = &mdev->priv;
         struct msix_entry *msix = priv->msix_arr;
         int irq                 = msix[i + MLX5_EQ_VEC_COMP_BASE].vector;
-        int err;
 
         if (!zalloc_cpumask_var(&priv->irq_info[i].mask, GFP_KERNEL)) {
                 mlx5_core_warn(mdev, "zalloc_cpumask_var failed");
@@ -622,18 +621,12 @@ static int mlx5_irq_set_affinity_hint(struct mlx5_core_dev *mdev, int i)
         cpumask_set_cpu(cpumask_local_spread(i, priv->numa_node),
                         priv->irq_info[i].mask);
 
-        err = irq_set_affinity_hint(irq, priv->irq_info[i].mask);
-        if (err) {
-                mlx5_core_warn(mdev, "irq_set_affinity_hint failed,irq 0x%.4x",
-                               irq);
-                goto err_clear_mask;
-        }
+#ifdef CONFIG_SMP
+        if (irq_set_affinity_hint(irq, priv->irq_info[i].mask))
+                mlx5_core_warn(mdev, "irq_set_affinity_hint failed, irq 0x%.4x", irq);
+#endif
 
         return 0;
-
-err_clear_mask:
-        free_cpumask_var(priv->irq_info[i].mask);
-        return err;
 }
 
 static void mlx5_irq_clear_affinity_hint(struct mlx5_core_dev *mdev, int i)
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_dpipe.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_dpipe.c
index ea56f6ade6b4..5f0a7bc692a4 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_dpipe.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_dpipe.c
@@ -199,10 +199,11 @@ static int mlxsw_sp_erif_entry_get(struct mlxsw_sp *mlxsw_sp,
 
         entry->counter_valid = false;
         entry->counter = 0;
+        entry->index = mlxsw_sp_rif_index(rif);
+
         if (!counters_enabled)
                 return 0;
 
-        entry->index = mlxsw_sp_rif_index(rif);
         err = mlxsw_sp_rif_counter_value_get(mlxsw_sp, rif,
                                              MLXSW_SP_RIF_COUNTER_EGRESS,
                                              &cnt);
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
index 33cec1cc1642..9f89c4137d21 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
@@ -206,6 +206,9 @@ void mlxsw_sp_rif_counter_free(struct mlxsw_sp *mlxsw_sp,
 {
         unsigned int *p_counter_index;
 
+        if (!mlxsw_sp_rif_counter_valid_get(rif, dir))
+                return;
+
         p_counter_index = mlxsw_sp_rif_p_counter_get(rif, dir);
         if (WARN_ON(!p_counter_index))
                 return;
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
index 0d8411f1f954..f4bb0c0b7c1d 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
@@ -1497,8 +1497,7 @@ do_fdb_op:
         err = mlxsw_sp_port_fdb_uc_op(mlxsw_sp, local_port, mac, fid,
                                       adding, true);
         if (err) {
-                if (net_ratelimit())
-                        netdev_err(mlxsw_sp_port->dev, "Failed to set FDB entry\n");
+                dev_err_ratelimited(mlxsw_sp->bus_info->dev, "Failed to set FDB entry\n");
                 return;
         }
 
@@ -1558,8 +1557,7 @@ do_fdb_op:
         err = mlxsw_sp_port_fdb_uc_lag_op(mlxsw_sp, lag_id, mac, fid, lag_vid,
                                           adding, true);
         if (err) {
-                if (net_ratelimit())
-                        netdev_err(mlxsw_sp_port->dev, "Failed to set FDB entry\n");
+                dev_err_ratelimited(mlxsw_sp->bus_info->dev, "Failed to set FDB entry\n");
                 return;
         }
 
diff --git a/drivers/net/ethernet/qlogic/netxen/netxen_nic_ctx.c b/drivers/net/ethernet/qlogic/netxen/netxen_nic_ctx.c
index b8d5270359cd..e30676515529 100644
--- a/drivers/net/ethernet/qlogic/netxen/netxen_nic_ctx.c
+++ b/drivers/net/ethernet/qlogic/netxen/netxen_nic_ctx.c
@@ -247,7 +247,7 @@ nx_fw_cmd_set_mtu(struct netxen_adapter *adapter, int mtu)
         cmd.req.arg3 = 0;
 
         if (recv_ctx->state == NX_HOST_CTX_STATE_ACTIVE)
-                netxen_issue_cmd(adapter, &cmd);
+                rcode = netxen_issue_cmd(adapter, &cmd);
 
         if (rcode != NX_RCODE_SUCCESS)
                 return -EIO;
diff --git a/drivers/net/ethernet/qlogic/qed/qed_init_fw_funcs.c b/drivers/net/ethernet/qlogic/qed/qed_init_fw_funcs.c
index 67200c5498ab..0a8fde629991 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_init_fw_funcs.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_init_fw_funcs.c
@@ -983,7 +983,7 @@ void qed_set_rfs_mode_disable(struct qed_hwfn *p_hwfn,
         memset(&camline, 0, sizeof(union gft_cam_line_union));
         qed_wr(p_hwfn, p_ptt, PRS_REG_GFT_CAM + CAM_LINE_SIZE * pf_id,
                camline.cam_line_mapped.camline);
-        memset(&ramline, 0, sizeof(union gft_cam_line_union));
+        memset(&ramline, 0, sizeof(ramline));
 
         for (i = 0; i < RAM_LINE_SIZE / REG_SIZE; i++) {
                 u32 hw_addr = PRS_REG_GFT_PROFILE_MASK_RAM;
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
index 49bad00a0f8f..7245b1072518 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
@@ -37,8 +37,8 @@
 
 #define _QLCNIC_LINUX_MAJOR 5
 #define _QLCNIC_LINUX_MINOR 3
-#define _QLCNIC_LINUX_SUBVERSION 65
-#define QLCNIC_LINUX_VERSIONID  "5.3.65"
+#define _QLCNIC_LINUX_SUBVERSION 66
+#define QLCNIC_LINUX_VERSIONID  "5.3.66"
 #define QLCNIC_DRV_IDC_VER  0x01
 #define QLCNIC_DRIVER_VERSION  ((_QLCNIC_LINUX_MAJOR << 16) |\
                  (_QLCNIC_LINUX_MINOR << 8) | (_QLCNIC_LINUX_SUBVERSION))
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
index 718bf58a7da6..4fb68797630e 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
@@ -3168,6 +3168,40 @@ int qlcnic_83xx_flash_read32(struct qlcnic_adapter *adapter, u32 flash_addr,
         return 0;
 }
 
+void qlcnic_83xx_get_port_type(struct qlcnic_adapter *adapter)
+{
+        struct qlcnic_hardware_context *ahw = adapter->ahw;
+        struct qlcnic_cmd_args cmd;
+        u32 config;
+        int err;
+
+        err = qlcnic_alloc_mbx_args(&cmd, adapter, QLCNIC_CMD_GET_LINK_STATUS);
+        if (err)
+                return;
+
+        err = qlcnic_issue_cmd(adapter, &cmd);
+        if (err) {
+                dev_info(&adapter->pdev->dev,
+                         "Get Link Status Command failed: 0x%x\n", err);
+                goto out;
+        } else {
+                config = cmd.rsp.arg[3];
+
+                switch (QLC_83XX_SFP_MODULE_TYPE(config)) {
+                case QLC_83XX_MODULE_FIBRE_1000BASE_SX:
+                case QLC_83XX_MODULE_FIBRE_1000BASE_LX:
+                case QLC_83XX_MODULE_FIBRE_1000BASE_CX:
+                case QLC_83XX_MODULE_TP_1000BASE_T:
+                        ahw->port_type = QLCNIC_GBE;
+                        break;
+                default:
+                        ahw->port_type = QLCNIC_XGBE;
+                }
+        }
+out:
+        qlcnic_free_mbx_args(&cmd);
+}
+
 int qlcnic_83xx_test_link(struct qlcnic_adapter *adapter)
 {
         u8 pci_func;
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.h
index 3dfe8e27b51c..b75a81246856 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.h
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.h
@@ -637,6 +637,7 @@ void qlcnic_83xx_get_pauseparam(struct qlcnic_adapter *,
 int qlcnic_83xx_set_pauseparam(struct qlcnic_adapter *,
                                struct ethtool_pauseparam *);
 int qlcnic_83xx_test_link(struct qlcnic_adapter *);
+void qlcnic_83xx_get_port_type(struct qlcnic_adapter *adapter);
 int qlcnic_83xx_reg_test(struct qlcnic_adapter *);
 int qlcnic_83xx_get_regs_len(struct qlcnic_adapter *);
 int qlcnic_83xx_get_registers(struct qlcnic_adapter *, u32 *);
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
index 9a869c15d8bf..7f7deeaf1cf0 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
@@ -486,6 +486,9 @@ static int qlcnic_set_link_ksettings(struct net_device *dev,
         u32 ret = 0;
         struct qlcnic_adapter *adapter = netdev_priv(dev);
 
+        if (qlcnic_83xx_check(adapter))
+                qlcnic_83xx_get_port_type(adapter);
+
         if (adapter->ahw->port_type != QLCNIC_GBE)
                 return -EOPNOTSUPP;
 
diff --git a/drivers/net/ethernet/qualcomm/qca_spi.c b/drivers/net/ethernet/qualcomm/qca_spi.c
index 513e6c74e199..24ca7df15d07 100644
--- a/drivers/net/ethernet/qualcomm/qca_spi.c
+++ b/drivers/net/ethernet/qualcomm/qca_spi.c
@@ -296,8 +296,9 @@ qcaspi_receive(struct qcaspi *qca)
 
         /* Allocate rx SKB if we don't have one available. */
         if (!qca->rx_skb) {
-                qca->rx_skb = netdev_alloc_skb(net_dev,
-                                               net_dev->mtu + VLAN_ETH_HLEN);
+                qca->rx_skb = netdev_alloc_skb_ip_align(net_dev,
+                                                        net_dev->mtu +
+                                                        VLAN_ETH_HLEN);
                 if (!qca->rx_skb) {
                         netdev_dbg(net_dev, "out of RX resources\n");
                         qca->stats.out_of_mem++;
@@ -377,7 +378,7 @@ qcaspi_receive(struct qcaspi *qca)
                                         qca->rx_skb, qca->rx_skb->dev);
                                 qca->rx_skb->ip_summed = CHECKSUM_UNNECESSARY;
                                 netif_rx_ni(qca->rx_skb);
-                                qca->rx_skb = netdev_alloc_skb(net_dev,
+                                qca->rx_skb = netdev_alloc_skb_ip_align(net_dev,
                                         net_dev->mtu + VLAN_ETH_HLEN);
                                 if (!qca->rx_skb) {
                                         netdev_dbg(net_dev, "out of RX resources\n");
@@ -759,7 +760,8 @@ qcaspi_netdev_init(struct net_device *dev)
         if (!qca->rx_buffer)
                 return -ENOBUFS;
 
-        qca->rx_skb = netdev_alloc_skb(dev, qca->net_dev->mtu + VLAN_ETH_HLEN);
+        qca->rx_skb = netdev_alloc_skb_ip_align(dev, qca->net_dev->mtu +
+                                                VLAN_ETH_HLEN);
         if (!qca->rx_skb) {
                 kfree(qca->rx_buffer);
                 netdev_info(qca->net_dev, "Failed to allocate RX sk_buff.\n");
diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
index f68c4db656ed..2d686ccf971b 100644
--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -3220,7 +3220,8 @@ static int sh_eth_drv_probe(struct platform_device *pdev)
         /* MDIO bus init */
         ret = sh_mdio_init(mdp, pd);
         if (ret) {
-                dev_err(&ndev->dev, "failed to initialise MDIO\n");
+                if (ret != -EPROBE_DEFER)
+                        dev_err(&pdev->dev, "MDIO init failed: %d\n", ret);
                 goto out_release;
         }
 
diff --git a/drivers/net/ethernet/sfc/nic.h b/drivers/net/ethernet/sfc/nic.h
index 7b916aa21bde..4d7fb8af880d 100644
--- a/drivers/net/ethernet/sfc/nic.h
+++ b/drivers/net/ethernet/sfc/nic.h
@@ -18,8 +18,12 @@
 #include "mcdi.h"
 
 enum {
-        EFX_REV_SIENA_A0 = 0,
-        EFX_REV_HUNT_A0 = 1,
+        /* Revisions 0-2 were Falcon A0, A1 and B0 respectively.
+         * They are not supported by this driver but these revision numbers
+         * form part of the ethtool API for register dumping.
+         */
+        EFX_REV_SIENA_A0 = 3,
+        EFX_REV_HUNT_A0 = 4,
 };
 
 static inline int efx_nic_rev(struct efx_nic *efx)
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index cd8c60132390..a74c481401c4 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -3725,7 +3725,7 @@ static void sysfs_display_ring(void *head, int size, int extend_desc,
                         ep++;
                 } else {
                         seq_printf(seq, "%d [0x%x]: 0x%x 0x%x 0x%x 0x%x\n",
-                                   i, (unsigned int)virt_to_phys(ep),
+                                   i, (unsigned int)virt_to_phys(p),
                                    le32_to_cpu(p->des0), le32_to_cpu(p->des1),
                                    le32_to_cpu(p->des2), le32_to_cpu(p->des3));
                         p++;
diff --git a/drivers/net/ethernet/sun/ldmvsw.c b/drivers/net/ethernet/sun/ldmvsw.c
index 5a90fed06260..5b56c24b6ed2 100644
--- a/drivers/net/ethernet/sun/ldmvsw.c
+++ b/drivers/net/ethernet/sun/ldmvsw.c
@@ -411,13 +411,14 @@ static int vsw_port_remove(struct vio_dev *vdev)
 
         if (port) {
                 del_timer_sync(&port->vio.timer);
+                del_timer_sync(&port->clean_timer);
 
                 napi_disable(&port->napi);
+                unregister_netdev(port->dev);
 
                 list_del_rcu(&port->list);
 
                 synchronize_rcu();
-                del_timer_sync(&port->clean_timer);
                 spin_lock_irqsave(&port->vp->lock, flags);
                 sunvnet_port_rm_txq_common(port);
                 spin_unlock_irqrestore(&port->vp->lock, flags);
@@ -427,7 +428,6 @@ static int vsw_port_remove(struct vio_dev *vdev)
 
                 dev_set_drvdata(&vdev->dev, NULL);
 
-                unregister_netdev(port->dev);
                 free_netdev(port->dev);
         }
 
diff --git a/drivers/net/ethernet/ti/netcp_core.c b/drivers/net/ethernet/ti/netcp_core.c
index 729a7da90b5b..e6222e535019 100644
--- a/drivers/net/ethernet/ti/netcp_core.c
+++ b/drivers/net/ethernet/ti/netcp_core.c
@@ -1353,9 +1353,10 @@ int netcp_txpipe_open(struct netcp_tx_pipe *tx_pipe)
 
         tx_pipe->dma_channel = knav_dma_open_channel(dev,
                                 tx_pipe->dma_chan_name, &config);
-        if (IS_ERR_OR_NULL(tx_pipe->dma_channel)) {
+        if (IS_ERR(tx_pipe->dma_channel)) {
                 dev_err(dev, "failed opening tx chan(%s)\n",
                         tx_pipe->dma_chan_name);
+                ret = PTR_ERR(tx_pipe->dma_channel);
                 goto err;
         }
 
@@ -1673,9 +1674,10 @@ static int netcp_setup_navigator_resources(struct net_device *ndev)
 
         netcp->rx_channel = knav_dma_open_channel(netcp->netcp_device->device,
                                         netcp->dma_chan_name, &config);
-        if (IS_ERR_OR_NULL(netcp->rx_channel)) {
+        if (IS_ERR(netcp->rx_channel)) {
                 dev_err(netcp->ndev_dev, "failed opening rx chan(%s\n",
                         netcp->dma_chan_name);
+                ret = PTR_ERR(netcp->rx_channel);
                 goto fail;
         }
 
diff --git a/drivers/net/ethernet/ti/netcp_ethss.c b/drivers/net/ethernet/ti/netcp_ethss.c
index 897176fc5043..dd92950a4615 100644
--- a/drivers/net/ethernet/ti/netcp_ethss.c
+++ b/drivers/net/ethernet/ti/netcp_ethss.c
@@ -2651,7 +2651,6 @@ static int gbe_hwtstamp_set(struct gbe_intf *gbe_intf, struct ifreq *ifr)
         case HWTSTAMP_FILTER_NONE:
                 cpts_rx_enable(cpts, 0);
                 break;
-        case HWTSTAMP_FILTER_ALL:
         case HWTSTAMP_FILTER_PTP_V1_L4_EVENT:
         case HWTSTAMP_FILTER_PTP_V1_L4_SYNC:
         case HWTSTAMP_FILTER_PTP_V1_L4_DELAY_REQ:
diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c
index dec5d563ab19..959fd12d2e67 100644
--- a/drivers/net/geneve.c
+++ b/drivers/net/geneve.c
@@ -1293,7 +1293,7 @@ static int geneve_fill_info(struct sk_buff *skb, const struct net_device *dev)
         if (nla_put_u32(skb, IFLA_GENEVE_ID, vni))
                 goto nla_put_failure;
 
-        if (ip_tunnel_info_af(info) == AF_INET) {
+        if (rtnl_dereference(geneve->sock4)) {
                 if (nla_put_in_addr(skb, IFLA_GENEVE_REMOTE,
                                     info->key.u.ipv4.dst))
                         goto nla_put_failure;
@@ -1302,8 +1302,10 @@ static int geneve_fill_info(struct sk_buff *skb, const struct net_device *dev)
                                !!(info->key.tun_flags & TUNNEL_CSUM)))
                         goto nla_put_failure;
 
+        }
+
 #if IS_ENABLED(CONFIG_IPV6)
-        } else {
+        if (rtnl_dereference(geneve->sock6)) {
                 if (nla_put_in6_addr(skb, IFLA_GENEVE_REMOTE6,
                                      &info->key.u.ipv6.dst))
                         goto nla_put_failure;
@@ -1315,8 +1317,8 @@ static int geneve_fill_info(struct sk_buff *skb, const struct net_device *dev)
                 if (nla_put_u8(skb, IFLA_GENEVE_UDP_ZERO_CSUM6_RX,
                                !geneve->use_udp6_rx_checksums))
                         goto nla_put_failure;
-#endif
         }
+#endif
 
         if (nla_put_u8(skb, IFLA_GENEVE_TTL, info->key.ttl) ||
             nla_put_u8(skb, IFLA_GENEVE_TOS, info->key.tos) ||
diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c
index 4fea1b3dfbb4..7b652bb7ebe4 100644
--- a/drivers/net/gtp.c
+++ b/drivers/net/gtp.c
@@ -873,7 +873,7 @@ static struct gtp_dev *gtp_find_dev(struct net *src_net, struct nlattr *nla[])
 
         /* Check if there's an existing gtpX device to configure */
         dev = dev_get_by_index_rcu(net, nla_get_u32(nla[GTPA_LINK]));
-        if (dev->netdev_ops == &gtp_netdev_ops)
+        if (dev && dev->netdev_ops == &gtp_netdev_ops)
                 gtp = netdev_priv(dev);
 
         put_net(net);
diff --git a/drivers/net/irda/irda-usb.c b/drivers/net/irda/irda-usb.c
index 8716b8c07feb..6f3c805f7211 100644
--- a/drivers/net/irda/irda-usb.c
+++ b/drivers/net/irda/irda-usb.c
@@ -1077,7 +1077,7 @@ static int stir421x_patch_device(struct irda_usb_cb *self)
          * are "42101001.sb" or "42101002.sb"
          */
         sprintf(stir421x_fw_name, "4210%4X.sb",
-                self->usbdev->descriptor.bcdDevice);
+                le16_to_cpu(self->usbdev->descriptor.bcdDevice));
         ret = request_firmware(&fw, stir421x_fw_name, &self->usbdev->dev);
         if (ret < 0)
                 return ret;
diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
index b34eaaae03fd..346ad2ff3998 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -789,10 +789,12 @@ static int macvlan_change_mtu(struct net_device *dev, int new_mtu)
  */
 static struct lock_class_key macvlan_netdev_addr_lock_key;
 
-#define ALWAYS_ON_FEATURES \
-        (NETIF_F_SG | NETIF_F_HW_CSUM | NETIF_F_GSO_SOFTWARE | NETIF_F_LLTX | \
+#define ALWAYS_ON_OFFLOADS \
+        (NETIF_F_SG | NETIF_F_HW_CSUM | NETIF_F_GSO_SOFTWARE | \
          NETIF_F_GSO_ROBUST)
 
+#define ALWAYS_ON_FEATURES (ALWAYS_ON_OFFLOADS | NETIF_F_LLTX)
+
 #define MACVLAN_FEATURES \
         (NETIF_F_SG | NETIF_F_HW_CSUM | NETIF_F_HIGHDMA | NETIF_F_FRAGLIST | \
          NETIF_F_GSO | NETIF_F_TSO | NETIF_F_UFO | NETIF_F_LRO | \
@@ -827,6 +829,7 @@ static int macvlan_init(struct net_device *dev)
         dev->features           |= ALWAYS_ON_FEATURES;
         dev->hw_features        |= NETIF_F_LRO;
         dev->vlan_features      = lowerdev->vlan_features & MACVLAN_FEATURES;
+        dev->vlan_features      |= ALWAYS_ON_OFFLOADS;
         dev->gso_max_size       = lowerdev->gso_max_size;
         dev->gso_max_segs       = lowerdev->gso_max_segs;
         dev->hard_header_len    = lowerdev->hard_header_len;
diff --git a/drivers/net/phy/Kconfig b/drivers/net/phy/Kconfig
index 60ffc9da6a28..c360dd6ead22 100644
--- a/drivers/net/phy/Kconfig
+++ b/drivers/net/phy/Kconfig
@@ -108,7 +108,7 @@ config MDIO_MOXART
 config MDIO_OCTEON
         tristate "Octeon and some ThunderX SOCs MDIO buses"
         depends on 64BIT
-        depends on HAS_IOMEM
+        depends on HAS_IOMEM && OF_MDIO
         select MDIO_CAVIUM
         help
           This module provides a driver for the Octeon and ThunderX MDIO
diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c
index 272b051a0199..9097e42bec2e 100644
--- a/drivers/net/phy/marvell.c
+++ b/drivers/net/phy/marvell.c
@@ -255,34 +255,6 @@ static int marvell_config_aneg(struct phy_device *phydev)
 {
         int err;
 
-        /* The Marvell PHY has an errata which requires
-         * that certain registers get written in order
-         * to restart autonegotiation */
-        err = phy_write(phydev, MII_BMCR, BMCR_RESET);
-
-        if (err < 0)
-                return err;
-
-        err = phy_write(phydev, 0x1d, 0x1f);
-        if (err < 0)
-                return err;
-
-        err = phy_write(phydev, 0x1e, 0x200c);
-        if (err < 0)
-                return err;
-
-        err = phy_write(phydev, 0x1d, 0x5);
-        if (err < 0)
-                return err;
-
-        err = phy_write(phydev, 0x1e, 0);
-        if (err < 0)
-                return err;
-
-        err = phy_write(phydev, 0x1e, 0x100);
-        if (err < 0)
-                return err;
-
         err = marvell_set_polarity(phydev, phydev->mdix_ctrl);
         if (err < 0)
                 return err;
@@ -316,6 +288,42 @@ static int marvell_config_aneg(struct phy_device *phydev)
         return 0;
 }
 
+static int m88e1101_config_aneg(struct phy_device *phydev)
+{
+        int err;
+
+        /* This Marvell PHY has an errata which requires
+         * that certain registers get written in order
+         * to restart autonegotiation
+         */
+        err = phy_write(phydev, MII_BMCR, BMCR_RESET);
+
+        if (err < 0)
+                return err;
+
+        err = phy_write(phydev, 0x1d, 0x1f);
+        if (err < 0)
+                return err;
+
+        err = phy_write(phydev, 0x1e, 0x200c);
+        if (err < 0)
+                return err;
+
+        err = phy_write(phydev, 0x1d, 0x5);
+        if (err < 0)
+                return err;
+
+        err = phy_write(phydev, 0x1e, 0);
+        if (err < 0)
+                return err;
+
+        err = phy_write(phydev, 0x1e, 0x100);
+        if (err < 0)
+                return err;
+
+        return marvell_config_aneg(phydev);
+}
+
 static int m88e1111_config_aneg(struct phy_device *phydev)
 {
         int err;
@@ -1892,7 +1900,7 @@ static struct phy_driver marvell_drivers[] = {
                 .flags = PHY_HAS_INTERRUPT,
                 .probe = marvell_probe,
                 .config_init = &marvell_config_init,
-                .config_aneg = &marvell_config_aneg,
+                .config_aneg = &m88e1101_config_aneg,
                 .read_status = &genphy_read_status,
                 .ack_interrupt = &marvell_ack_interrupt,
                 .config_intr = &marvell_config_intr,
diff --git a/drivers/net/phy/mdio-mux.c b/drivers/net/phy/mdio-mux.c
index 963838d4fac1..599ce24c514f 100644
--- a/drivers/net/phy/mdio-mux.c
+++ b/drivers/net/phy/mdio-mux.c
@@ -122,10 +122,9 @@ int mdio_mux_init(struct device *dev,
         pb = devm_kzalloc(dev, sizeof(*pb), GFP_KERNEL);
         if (pb == NULL) {
                 ret_val = -ENOMEM;
-                goto err_parent_bus;
+                goto err_pb_kz;
         }
 
-
         pb->switch_data = data;
         pb->switch_fn = switch_fn;
         pb->current_child = -1;
@@ -154,6 +153,7 @@ int mdio_mux_init(struct device *dev,
                 cb->mii_bus = mdiobus_alloc();
                 if (!cb->mii_bus) {
                         ret_val = -ENOMEM;
+                        devm_kfree(dev, cb);
                         of_node_put(child_bus_node);
                         break;
                 }
@@ -170,7 +170,6 @@ int mdio_mux_init(struct device *dev,
                         mdiobus_free(cb->mii_bus);
                         devm_kfree(dev, cb);
                 } else {
-                        of_node_get(child_bus_node);
                         cb->next = pb->children;
                         pb->children = cb;
                 }
@@ -181,9 +180,11 @@ int mdio_mux_init(struct device *dev,
                 return 0;
         }
 
+        devm_kfree(dev, pb);
+err_pb_kz:
         /* balance the reference of_mdio_find_bus() took */
-        put_device(&pb->mii_bus->dev);
-
+        if (!mux_bus)
+                put_device(&parent_bus->dev);
 err_parent_bus:
         of_node_put(parent_bus_node);
         return ret_val;
diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c
index a898e5c4ef1b..8e73f5f36e71 100644
--- a/drivers/net/phy/mdio_bus.c
+++ b/drivers/net/phy/mdio_bus.c
@@ -364,9 +364,6 @@ int __mdiobus_register(struct mii_bus *bus, struct module *owner)
 
         mutex_init(&bus->mdio_lock);
 
-        if (bus->reset)
-                bus->reset(bus);
-
         /* de-assert bus level PHY GPIO resets */
         if (bus->num_reset_gpios > 0) {
                 bus->reset_gpiod = devm_kcalloc(&bus->dev,
@@ -396,6 +393,9 @@ int __mdiobus_register(struct mii_bus *bus, struct module *owner)
                 }
         }
 
+        if (bus->reset)
+                bus->reset(bus);
+
         for (i = 0; i < PHY_MAX_ADDR; i++) {
                 if ((bus->phy_mask & (1 << i)) == 0) {
                         struct phy_device *phydev;
diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
index f3ae88fdf332..8ab281b478f2 100644
--- a/drivers/net/usb/cdc_ether.c
+++ b/drivers/net/usb/cdc_ether.c
@@ -310,6 +310,26 @@ skip:
                 return -ENODEV;
         }
 
+        return 0;
+
+bad_desc:
+        dev_info(&dev->udev->dev, "bad CDC descriptors\n");
+        return -ENODEV;
+}
+EXPORT_SYMBOL_GPL(usbnet_generic_cdc_bind);
+
+
+/* like usbnet_generic_cdc_bind() but handles filter initialization
+ * correctly
+ */
+int usbnet_ether_cdc_bind(struct usbnet *dev, struct usb_interface *intf)
+{
+        int rv;
+
+        rv = usbnet_generic_cdc_bind(dev, intf);
+        if (rv < 0)
+                goto bail_out;
+
         /* Some devices don't initialise properly. In particular
          * the packet filter is not reset. There are devices that
          * don't do reset all the way. So the packet filter should
@@ -317,13 +337,10 @@ skip:
          */
         usbnet_cdc_update_filter(dev);
 
-        return 0;
-
-bad_desc:
-        dev_info(&dev->udev->dev, "bad CDC descriptors\n");
-        return -ENODEV;
+bail_out:
+        return rv;
 }
-EXPORT_SYMBOL_GPL(usbnet_generic_cdc_bind);
+EXPORT_SYMBOL_GPL(usbnet_ether_cdc_bind);
 
 void usbnet_cdc_unbind(struct usbnet *dev, struct usb_interface *intf)
 {
@@ -417,7 +434,7 @@ int usbnet_cdc_bind(struct usbnet *dev, struct usb_interface *intf)
         BUILD_BUG_ON((sizeof(((struct usbnet *)0)->data)
                         < sizeof(struct cdc_state)));
 
-        status = usbnet_generic_cdc_bind(dev, intf);
+        status = usbnet_ether_cdc_bind(dev, intf);
         if (status < 0)
                 return status;
 
diff --git a/drivers/net/usb/ch9200.c b/drivers/net/usb/ch9200.c
index c4f1c363e24b..9df3c1ffff35 100644
--- a/drivers/net/usb/ch9200.c
+++ b/drivers/net/usb/ch9200.c
@@ -310,8 +310,8 @@ static int get_mac_address(struct usbnet *dev, unsigned char *data)
         int rd_mac_len = 0;
 
         netdev_dbg(dev->net, "get_mac_address:\n\tusbnet VID:%0x PID:%0x\n",
-                   dev->udev->descriptor.idVendor,
-                   dev->udev->descriptor.idProduct);
+                   le16_to_cpu(dev->udev->descriptor.idVendor),
+                   le16_to_cpu(dev->udev->descriptor.idProduct));
 
         memset(mac_addr, 0, sizeof(mac_addr));
         rd_mac_len = control_read(dev, REQUEST_READ, 0,
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index d7165767ca9d..8f923a147fa9 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -1196,6 +1196,8 @@ static const struct usb_device_id products[] = {
         {QMI_FIXED_INTF(0x1199, 0x9071, 10)},   /* Sierra Wireless MC74xx */
         {QMI_FIXED_INTF(0x1199, 0x9079, 8)},    /* Sierra Wireless EM74xx */
         {QMI_FIXED_INTF(0x1199, 0x9079, 10)},   /* Sierra Wireless EM74xx */
+        {QMI_FIXED_INTF(0x1199, 0x907b, 8)},    /* Sierra Wireless EM74xx */
+        {QMI_FIXED_INTF(0x1199, 0x907b, 10)},   /* Sierra Wireless EM74xx */
         {QMI_FIXED_INTF(0x1bbb, 0x011e, 4)},    /* Telekom Speedstick LTE II (Alcatel One Touch L100V LTE) */
         {QMI_FIXED_INTF(0x1bbb, 0x0203, 2)},    /* Alcatel L800MA */
         {QMI_FIXED_INTF(0x2357, 0x0201, 4)},    /* TP-LINK HSUPA Modem MA180 */
diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c
index 765400b62168..2dfca96a63b6 100644
--- a/drivers/net/usb/smsc95xx.c
+++ b/drivers/net/usb/smsc95xx.c
@@ -681,7 +681,7 @@ static int smsc95xx_set_features(struct net_device *netdev,
         if (ret < 0)
                 return ret;
 
-        if (features & NETIF_F_HW_CSUM)
+        if (features & NETIF_F_IP_CSUM)
                 read_buf |= Tx_COE_EN_;
         else
                 read_buf &= ~Tx_COE_EN_;
@@ -1279,12 +1279,19 @@ static int smsc95xx_bind(struct usbnet *dev, struct usb_interface *intf)
 
         spin_lock_init(&pdata->mac_cr_lock);
 
+        /* LAN95xx devices do not alter the computed checksum of 0 to 0xffff.
+         * RFC 2460, ipv6 UDP calculated checksum yields a result of zero must
+         * be changed to 0xffff. RFC 768, ipv4 UDP computed checksum is zero,
+         * it is transmitted as all ones. The zero transmitted checksum means
+         * transmitter generated no checksum. Hence, enable csum offload only
+         * for ipv4 packets.
+         */
         if (DEFAULT_TX_CSUM_ENABLE)
-                dev->net->features |= NETIF_F_HW_CSUM;
+                dev->net->features |= NETIF_F_IP_CSUM;
         if (DEFAULT_RX_CSUM_ENABLE)
                 dev->net->features |= NETIF_F_RXCSUM;
 
-        dev->net->hw_features = NETIF_F_HW_CSUM | NETIF_F_RXCSUM;
+        dev->net->hw_features = NETIF_F_IP_CSUM | NETIF_F_RXCSUM;
 
         smsc95xx_init_mac_address(dev);
 
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 9320d96a1632..3e9246cc49c3 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -1989,6 +1989,7 @@ static const struct net_device_ops virtnet_netdev = {
         .ndo_poll_controller = virtnet_netpoll,
 #endif
         .ndo_xdp                = virtnet_xdp,
+        .ndo_features_check     = passthru_features_check,
 };
 
 static void virtnet_config_changed_work(struct work_struct *work)
diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
index 25bc764ae7dc..d1c7029ded7c 100644
--- a/drivers/net/vmxnet3/vmxnet3_drv.c
+++ b/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -2962,6 +2962,11 @@ vmxnet3_force_close(struct vmxnet3_adapter *adapter)
         /* we need to enable NAPI, otherwise dev_close will deadlock */
         for (i = 0; i < adapter->num_rx_queues; i++)
                 napi_enable(&adapter->rx_queue[i].napi);
+        /*
+         * Need to clear the quiesce bit to ensure that vmxnet3_close
+         * can quiesce the device properly
+         */
+        clear_bit(VMXNET3_STATE_BIT_QUIESCED, &adapter->state);
         dev_close(adapter->netdev);
 }
 
diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c
index ceda5861da78..db882493875c 100644
--- a/drivers/net/vrf.c
+++ b/drivers/net/vrf.c
@@ -989,6 +989,7 @@ static u32 vrf_fib_table(const struct net_device *dev)
 
 static int vrf_rcv_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
 {
+        kfree_skb(skb);
         return 0;
 }
 
@@ -998,7 +999,7 @@ static struct sk_buff *vrf_rcv_nfhook(u8 pf, unsigned int hook,
 {
         struct net *net = dev_net(dev);
 
-        if (NF_HOOK(pf, hook, net, NULL, skb, dev, NULL, vrf_rcv_finish) < 0)
+        if (nf_hook(pf, hook, net, NULL, skb, dev, NULL, vrf_rcv_finish) != 1)
                 skb = NULL;    /* kfree_skb(skb) handled by nf code */
 
         return skb;
diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index 6ffc482550c1..7b61adb6270c 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -1934,8 +1934,7 @@ abort_transaction_no_dev_fatal:
         xennet_disconnect_backend(info);
         xennet_destroy_queues(info);
  out:
-        unregister_netdev(info->netdev);
-        xennet_free_netdev(info->netdev);
+        device_unregister(&dev->dev);
         return err;
 }
 
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index d5e0906262ea..a60926410438 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -925,6 +925,29 @@ static int nvme_getgeo(struct block_device *bdev, struct hd_geometry *geo)
 }
 
 #ifdef CONFIG_BLK_DEV_INTEGRITY
+static void nvme_prep_integrity(struct gendisk *disk, struct nvme_id_ns *id,
+                u16 bs)
+{
+        struct nvme_ns *ns = disk->private_data;
+        u16 old_ms = ns->ms;
+        u8 pi_type = 0;
+
+        ns->ms = le16_to_cpu(id->lbaf[id->flbas & NVME_NS_FLBAS_LBA_MASK].ms);
+        ns->ext = ns->ms && (id->flbas & NVME_NS_FLBAS_META_EXT);
+
+        /* PI implementation requires metadata equal t10 pi tuple size */
+        if (ns->ms == sizeof(struct t10_pi_tuple))
+                pi_type = id->dps & NVME_NS_DPS_PI_MASK;
+
+        if (blk_get_integrity(disk) &&
+            (ns->pi_type != pi_type || ns->ms != old_ms ||
+             bs != queue_logical_block_size(disk->queue) ||
+             (ns->ms && ns->ext)))
+                blk_integrity_unregister(disk);
+
+        ns->pi_type = pi_type;
+}
+
 static void nvme_init_integrity(struct nvme_ns *ns)
 {
         struct blk_integrity integrity;
@@ -951,6 +974,10 @@ static void nvme_init_integrity(struct nvme_ns *ns)
         blk_queue_max_integrity_segments(ns->queue, 1);
 }
 #else
+static void nvme_prep_integrity(struct gendisk *disk, struct nvme_id_ns *id,
+                u16 bs)
+{
+}
 static void nvme_init_integrity(struct nvme_ns *ns)
 {
 }
@@ -997,37 +1024,22 @@ static int nvme_revalidate_ns(struct nvme_ns *ns, struct nvme_id_ns **id)
 static void __nvme_revalidate_disk(struct gendisk *disk, struct nvme_id_ns *id)
 {
         struct nvme_ns *ns = disk->private_data;
-        u8 lbaf, pi_type;
-        u16 old_ms;
-        unsigned short bs;
-
-        old_ms = ns->ms;
-        lbaf = id->flbas & NVME_NS_FLBAS_LBA_MASK;
-        ns->lba_shift = id->lbaf[lbaf].ds;
-        ns->ms = le16_to_cpu(id->lbaf[lbaf].ms);
-        ns->ext = ns->ms && (id->flbas & NVME_NS_FLBAS_META_EXT);
+        u16 bs;
 
         /*
          * If identify namespace failed, use default 512 byte block size so
          * block layer can use before failing read/write for 0 capacity.
          */
+        ns->lba_shift = id->lbaf[id->flbas & NVME_NS_FLBAS_LBA_MASK].ds;
         if (ns->lba_shift == 0)
                 ns->lba_shift = 9;
         bs = 1 << ns->lba_shift;
-        /* XXX: PI implementation requires metadata equal t10 pi tuple size */
-        pi_type = ns->ms == sizeof(struct t10_pi_tuple) ?
-                                        id->dps & NVME_NS_DPS_PI_MASK : 0;
 
         blk_mq_freeze_queue(disk->queue);
-        if (blk_get_integrity(disk) && (ns->pi_type != pi_type ||
-                                ns->ms != old_ms ||
-                                bs != queue_logical_block_size(disk->queue) ||
-                                (ns->ms && ns->ext)))
-                blk_integrity_unregister(disk);
 
-        ns->pi_type = pi_type;
+        if (ns->ctrl->ops->flags & NVME_F_METADATA_SUPPORTED)
+                nvme_prep_integrity(disk, id, bs);
         blk_queue_logical_block_size(ns->queue, bs);
-
         if (ns->ms && !blk_get_integrity(disk) && !ns->ext)
                 nvme_init_integrity(ns);
         if (ns->ms && !(ns->ms == 8 && ns->pi_type) && !blk_get_integrity(disk))
@@ -1605,7 +1617,7 @@ int nvme_init_identify(struct nvme_ctrl *ctrl)
         }
         memcpy(ctrl->psd, id->psd, sizeof(ctrl->psd));
 
-        if (ctrl->ops->is_fabrics) {
+        if (ctrl->ops->flags & NVME_F_FABRICS) {
                 ctrl->icdoff = le16_to_cpu(id->icdoff);
                 ctrl->ioccsz = le32_to_cpu(id->ioccsz);
                 ctrl->iorcsz = le32_to_cpu(id->iorcsz);
@@ -2098,7 +2110,6 @@ static void nvme_ns_remove(struct nvme_ns *ns)
                 if (ns->ndev)
                         nvme_nvm_unregister_sysfs(ns);
                 del_gendisk(ns->disk);
-                blk_mq_abort_requeue_list(ns->queue);
                 blk_cleanup_queue(ns->queue);
         }
 
@@ -2436,8 +2447,16 @@ void nvme_kill_queues(struct nvme_ctrl *ctrl)
                         continue;
                 revalidate_disk(ns->disk);
                 blk_set_queue_dying(ns->queue);
-                blk_mq_abort_requeue_list(ns->queue);
-                blk_mq_start_stopped_hw_queues(ns->queue, true);
+
+                /*
+                 * Forcibly start all queues to avoid having stuck requests.
+                 * Note that we must ensure the queues are not stopped
+                 * when the final removal happens.
+                 */
+                blk_mq_start_hw_queues(ns->queue);
+
+                /* draining requests in requeue list */
+                blk_mq_kick_requeue_list(ns->queue);
         }
         mutex_unlock(&ctrl->namespaces_mutex);
 }
diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
index 70e689bf1cad..5b14cbefb724 100644
--- a/drivers/nvme/host/fc.c
+++ b/drivers/nvme/host/fc.c
@@ -45,8 +45,6 @@ enum nvme_fc_queue_flags {
 
 #define NVMEFC_QUEUE_DELAY      3               /* ms units */
 
-#define NVME_FC_MAX_CONNECT_ATTEMPTS    1
-
 struct nvme_fc_queue {
         struct nvme_fc_ctrl     *ctrl;
         struct device           *dev;
@@ -165,8 +163,6 @@ struct nvme_fc_ctrl {
         struct work_struct      delete_work;
         struct work_struct      reset_work;
         struct delayed_work     connect_work;
-        int                     reconnect_delay;
-        int                     connect_attempts;
 
         struct kref             ref;
         u32                     flags;
@@ -1376,9 +1372,9 @@ done:
         complete_rq = __nvme_fc_fcpop_chk_teardowns(ctrl, op);
         if (!complete_rq) {
                 if (unlikely(op->flags & FCOP_FLAGS_TERMIO)) {
-                        status = cpu_to_le16(NVME_SC_ABORT_REQ);
+                        status = cpu_to_le16(NVME_SC_ABORT_REQ << 1);
                         if (blk_queue_dying(rq->q))
-                                status |= cpu_to_le16(NVME_SC_DNR);
+                                status |= cpu_to_le16(NVME_SC_DNR << 1);
                 }
                 nvme_end_request(rq, status, result);
         } else
@@ -1751,9 +1747,13 @@ nvme_fc_error_recovery(struct nvme_fc_ctrl *ctrl, char *errmsg)
         dev_warn(ctrl->ctrl.device,
                 "NVME-FC{%d}: transport association error detected: %s\n",
                 ctrl->cnum, errmsg);
-        dev_info(ctrl->ctrl.device,
+        dev_warn(ctrl->ctrl.device,
                 "NVME-FC{%d}: resetting controller\n", ctrl->cnum);
 
+        /* stop the queues on error, cleanup is in reset thread */
+        if (ctrl->queue_count > 1)
+                nvme_stop_queues(&ctrl->ctrl);
+
         if (!nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_RECONNECTING)) {
                 dev_err(ctrl->ctrl.device,
                         "NVME-FC{%d}: error_recovery: Couldn't change state "
@@ -2191,9 +2191,6 @@ nvme_fc_create_io_queues(struct nvme_fc_ctrl *ctrl)
         if (!opts->nr_io_queues)
                 return 0;
 
-        dev_info(ctrl->ctrl.device, "creating %d I/O queues.\n",
-                        opts->nr_io_queues);
-
         nvme_fc_init_io_queues(ctrl);
 
         memset(&ctrl->tag_set, 0, sizeof(ctrl->tag_set));
@@ -2264,9 +2261,6 @@ nvme_fc_reinit_io_queues(struct nvme_fc_ctrl *ctrl)
         if (ctrl->queue_count == 1)
                 return 0;
 
-        dev_info(ctrl->ctrl.device, "Recreating %d I/O queues.\n",
-                        opts->nr_io_queues);
-
         nvme_fc_init_io_queues(ctrl);
 
         ret = blk_mq_reinit_tagset(&ctrl->tag_set);
@@ -2302,7 +2296,7 @@ nvme_fc_create_association(struct nvme_fc_ctrl *ctrl)
         int ret;
         bool changed;
 
-        ctrl->connect_attempts++;
+        ++ctrl->ctrl.opts->nr_reconnects;
 
         /*
          * Create the admin queue
@@ -2399,9 +2393,7 @@ nvme_fc_create_association(struct nvme_fc_ctrl *ctrl)
         changed = nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_LIVE);
         WARN_ON_ONCE(!changed);
 
-        ctrl->connect_attempts = 0;
-
-        kref_get(&ctrl->ctrl.kref);
+        ctrl->ctrl.opts->nr_reconnects = 0;
 
         if (ctrl->queue_count > 1) {
                 nvme_start_queues(&ctrl->ctrl);
@@ -2532,26 +2524,32 @@ nvme_fc_delete_ctrl_work(struct work_struct *work)
 
         /*
          * tear down the controller
-         * This will result in the last reference on the nvme ctrl to
-         * expire, calling the transport nvme_fc_nvme_ctrl_freed() callback.
-         * From there, the transport will tear down it's logical queues and
-         * association.
+         * After the last reference on the nvme ctrl is removed,
+         * the transport nvme_fc_nvme_ctrl_freed() callback will be
+         * invoked. From there, the transport will tear down it's
+         * logical queues and association.
          */
         nvme_uninit_ctrl(&ctrl->ctrl);
 
         nvme_put_ctrl(&ctrl->ctrl);
 }
 
-static int
-__nvme_fc_del_ctrl(struct nvme_fc_ctrl *ctrl)
+static bool
+__nvme_fc_schedule_delete_work(struct nvme_fc_ctrl *ctrl)
 {
         if (!nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_DELETING))
-                return -EBUSY;
+                return true;
 
         if (!queue_work(nvme_fc_wq, &ctrl->delete_work))
-                return -EBUSY;
+                return true;
 
-        return 0;
+        return false;
+}
+
+static int
+__nvme_fc_del_ctrl(struct nvme_fc_ctrl *ctrl)
+{
+        return __nvme_fc_schedule_delete_work(ctrl) ? -EBUSY : 0;
 }
 
 /*
@@ -2577,6 +2575,35 @@ nvme_fc_del_nvme_ctrl(struct nvme_ctrl *nctrl)
 }
 
 static void
+nvme_fc_reconnect_or_delete(struct nvme_fc_ctrl *ctrl, int status)
+{
+        /* If we are resetting/deleting then do nothing */
+        if (ctrl->ctrl.state != NVME_CTRL_RECONNECTING) {
+                WARN_ON_ONCE(ctrl->ctrl.state == NVME_CTRL_NEW ||
+                        ctrl->ctrl.state == NVME_CTRL_LIVE);
+                return;
+        }
+
+        dev_info(ctrl->ctrl.device,
+                "NVME-FC{%d}: reset: Reconnect attempt failed (%d)\n",
+                ctrl->cnum, status);
+
+        if (nvmf_should_reconnect(&ctrl->ctrl)) {
+                dev_info(ctrl->ctrl.device,
+                        "NVME-FC{%d}: Reconnect attempt in %d seconds.\n",
+                        ctrl->cnum, ctrl->ctrl.opts->reconnect_delay);
+                queue_delayed_work(nvme_fc_wq, &ctrl->connect_work,
+                                ctrl->ctrl.opts->reconnect_delay * HZ);
+        } else {
+                dev_warn(ctrl->ctrl.device,
+                                "NVME-FC{%d}: Max reconnect attempts (%d) "
+                                "reached. Removing controller\n",
+                                ctrl->cnum, ctrl->ctrl.opts->nr_reconnects);
+                WARN_ON(__nvme_fc_schedule_delete_work(ctrl));
+        }
+}
+
+static void
 nvme_fc_reset_ctrl_work(struct work_struct *work)
 {
         struct nvme_fc_ctrl *ctrl =
@@ -2587,34 +2614,9 @@ nvme_fc_reset_ctrl_work(struct work_struct *work)
         nvme_fc_delete_association(ctrl);
 
         ret = nvme_fc_create_association(ctrl);
-        if (ret) {
-                dev_warn(ctrl->ctrl.device,
-                        "NVME-FC{%d}: reset: Reconnect attempt failed (%d)\n",
-                        ctrl->cnum, ret);
-                if (ctrl->connect_attempts >= NVME_FC_MAX_CONNECT_ATTEMPTS) {
-                        dev_warn(ctrl->ctrl.device,
-                                "NVME-FC{%d}: Max reconnect attempts (%d) "
-                                "reached. Removing controller\n",
-                                ctrl->cnum, ctrl->connect_attempts);
-
-                        if (!nvme_change_ctrl_state(&ctrl->ctrl,
-                                NVME_CTRL_DELETING)) {
-                                dev_err(ctrl->ctrl.device,
-                                        "NVME-FC{%d}: failed to change state "
-                                        "to DELETING\n", ctrl->cnum);
-                                return;
-                        }
-
-                        WARN_ON(!queue_work(nvme_fc_wq, &ctrl->delete_work));
-                        return;
-                }
-
-                dev_warn(ctrl->ctrl.device,
-                        "NVME-FC{%d}: Reconnect attempt in %d seconds.\n",
-                        ctrl->cnum, ctrl->reconnect_delay);
-                queue_delayed_work(nvme_fc_wq, &ctrl->connect_work,
-                                ctrl->reconnect_delay * HZ);
-        } else
+        if (ret)
+                nvme_fc_reconnect_or_delete(ctrl, ret);
+        else
                 dev_info(ctrl->ctrl.device,
                         "NVME-FC{%d}: controller reset complete\n", ctrl->cnum);
 }
@@ -2628,7 +2630,7 @@ nvme_fc_reset_nvme_ctrl(struct nvme_ctrl *nctrl)
 {
         struct nvme_fc_ctrl *ctrl = to_fc_ctrl(nctrl);
 
-        dev_warn(ctrl->ctrl.device,
+        dev_info(ctrl->ctrl.device,
                 "NVME-FC{%d}: admin requested controller reset\n", ctrl->cnum);
 
         if (!nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_RESETTING))
@@ -2645,7 +2647,7 @@ nvme_fc_reset_nvme_ctrl(struct nvme_ctrl *nctrl)
 static const struct nvme_ctrl_ops nvme_fc_ctrl_ops = {
         .name                   = "fc",
         .module                 = THIS_MODULE,
-        .is_fabrics             = true,
+        .flags                  = NVME_F_FABRICS,
         .reg_read32             = nvmf_reg_read32,
         .reg_read64             = nvmf_reg_read64,
         .reg_write32            = nvmf_reg_write32,
@@ -2667,34 +2669,9 @@ nvme_fc_connect_ctrl_work(struct work_struct *work)
                                 struct nvme_fc_ctrl, connect_work);
 
         ret = nvme_fc_create_association(ctrl);
-        if (ret) {
-                dev_warn(ctrl->ctrl.device,
-                        "NVME-FC{%d}: Reconnect attempt failed (%d)\n",
-                        ctrl->cnum, ret);
-                if (ctrl->connect_attempts >= NVME_FC_MAX_CONNECT_ATTEMPTS) {
-                        dev_warn(ctrl->ctrl.device,
-                                "NVME-FC{%d}: Max reconnect attempts (%d) "
-                                "reached. Removing controller\n",
-                                ctrl->cnum, ctrl->connect_attempts);
-
-                        if (!nvme_change_ctrl_state(&ctrl->ctrl,
-                                NVME_CTRL_DELETING)) {
-                                dev_err(ctrl->ctrl.device,
-                                        "NVME-FC{%d}: failed to change state "
-                                        "to DELETING\n", ctrl->cnum);
-                                return;
-                        }
-
-                        WARN_ON(!queue_work(nvme_fc_wq, &ctrl->delete_work));
-                        return;
-                }
-
-                dev_warn(ctrl->ctrl.device,
-                        "NVME-FC{%d}: Reconnect attempt in %d seconds.\n",
-                        ctrl->cnum, ctrl->reconnect_delay);
-                queue_delayed_work(nvme_fc_wq, &ctrl->connect_work,
-                                ctrl->reconnect_delay * HZ);
-        } else
+        if (ret)
+                nvme_fc_reconnect_or_delete(ctrl, ret);
+        else
                 dev_info(ctrl->ctrl.device,
                         "NVME-FC{%d}: controller reconnect complete\n",
                         ctrl->cnum);
@@ -2720,6 +2697,12 @@ nvme_fc_init_ctrl(struct device *dev, struct nvmf_ctrl_options *opts,
         unsigned long flags;
         int ret, idx;
 
+        if (!(rport->remoteport.port_role &
+            (FC_PORT_ROLE_NVME_DISCOVERY | FC_PORT_ROLE_NVME_TARGET))) {
+                ret = -EBADR;
+                goto out_fail;
+        }
+
         ctrl = kzalloc(sizeof(*ctrl), GFP_KERNEL);
         if (!ctrl) {
                 ret = -ENOMEM;
@@ -2745,7 +2728,6 @@ nvme_fc_init_ctrl(struct device *dev, struct nvmf_ctrl_options *opts,
         INIT_WORK(&ctrl->delete_work, nvme_fc_delete_ctrl_work);
         INIT_WORK(&ctrl->reset_work, nvme_fc_reset_ctrl_work);
         INIT_DELAYED_WORK(&ctrl->connect_work, nvme_fc_connect_ctrl_work);
-        ctrl->reconnect_delay = opts->reconnect_delay;
         spin_lock_init(&ctrl->lock);
 
         /* io queue count */
@@ -2809,7 +2791,6 @@ nvme_fc_init_ctrl(struct device *dev, struct nvmf_ctrl_options *opts,
                 ctrl->ctrl.opts = NULL;
                 /* initiate nvme ctrl ref counting teardown */
                 nvme_uninit_ctrl(&ctrl->ctrl);
-                nvme_put_ctrl(&ctrl->ctrl);
 
                 /* as we're past the point where we transition to the ref
                  * counting teardown path, if we return a bad pointer here,
@@ -2825,6 +2806,8 @@ nvme_fc_init_ctrl(struct device *dev, struct nvmf_ctrl_options *opts,
                 return ERR_PTR(ret);
         }
 
+        kref_get(&ctrl->ctrl.kref);
+
         dev_info(ctrl->ctrl.device,
                 "NVME-FC{%d}: new ctrl: NQN \"%s\"\n",
                 ctrl->cnum, ctrl->ctrl.opts->subsysnqn);
@@ -2961,7 +2944,7 @@ nvme_fc_create_ctrl(struct device *dev, struct nvmf_ctrl_options *opts)
 static struct nvmf_transport_ops nvme_fc_transport = {
         .name           = "fc",
         .required_opts  = NVMF_OPT_TRADDR | NVMF_OPT_HOST_TRADDR,
-        .allowed_opts   = NVMF_OPT_RECONNECT_DELAY,
+        .allowed_opts   = NVMF_OPT_RECONNECT_DELAY | NVMF_OPT_CTRL_LOSS_TMO,
         .create_ctrl    = nvme_fc_create_ctrl,
 };
 
diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h
index 29c708ca9621..9d6a070d4391 100644
--- a/drivers/nvme/host/nvme.h
+++ b/drivers/nvme/host/nvme.h
@@ -208,7 +208,9 @@ struct nvme_ns {
 struct nvme_ctrl_ops {
         const char *name;
         struct module *module;
-        bool is_fabrics;
+        unsigned int flags;
+#define NVME_F_FABRICS                  (1 << 0)
+#define NVME_F_METADATA_SUPPORTED       (1 << 1)
         int (*reg_read32)(struct nvme_ctrl *ctrl, u32 off, u32 *val);
         int (*reg_write32)(struct nvme_ctrl *ctrl, u32 off, u32 val);
         int (*reg_read64)(struct nvme_ctrl *ctrl, u32 off, u64 *val);
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index fed803232edc..d52701df7245 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -263,7 +263,7 @@ static void nvme_dbbuf_set(struct nvme_dev *dev)
         c.dbbuf.prp2 = cpu_to_le64(dev->dbbuf_eis_dma_addr);
 
         if (nvme_submit_sync_cmd(dev->ctrl.admin_q, &c, NULL, 0)) {
-                dev_warn(dev->dev, "unable to set dbbuf\n");
+                dev_warn(dev->ctrl.device, "unable to set dbbuf\n");
                 /* Free memory and continue on */
                 nvme_dbbuf_dma_free(dev);
         }
@@ -1394,11 +1394,11 @@ static void nvme_warn_reset(struct nvme_dev *dev, u32 csts)
         result = pci_read_config_word(to_pci_dev(dev->dev), PCI_STATUS,
                                       &pci_status);
         if (result == PCIBIOS_SUCCESSFUL)
-                dev_warn(dev->dev,
+                dev_warn(dev->ctrl.device,
                          "controller is down; will reset: CSTS=0x%x, PCI_STATUS=0x%hx\n",
                          csts, pci_status);
         else
-                dev_warn(dev->dev,
+                dev_warn(dev->ctrl.device,
                          "controller is down; will reset: CSTS=0x%x, PCI_STATUS read failed (%d)\n",
                          csts, result);
 }
@@ -1506,6 +1506,11 @@ static inline void nvme_release_cmb(struct nvme_dev *dev)
         if (dev->cmb) {
                 iounmap(dev->cmb);
                 dev->cmb = NULL;
+                if (dev->cmbsz) {
+                        sysfs_remove_file_from_group(&dev->ctrl.device->kobj,
+                                                     &dev_attr_cmb.attr, NULL);
+                        dev->cmbsz = 0;
+                }
         }
 }
 
@@ -1735,8 +1740,8 @@ static int nvme_pci_enable(struct nvme_dev *dev)
          */
         if (pdev->vendor == PCI_VENDOR_ID_APPLE && pdev->device == 0x2001) {
                 dev->q_depth = 2;
-                dev_warn(dev->dev, "detected Apple NVMe controller, set "
-                        "queue depth=%u to work around controller resets\n",
+                dev_warn(dev->ctrl.device, "detected Apple NVMe controller, "
+                        "set queue depth=%u to work around controller resets\n",
                         dev->q_depth);
         }
 
@@ -1754,7 +1759,7 @@ static int nvme_pci_enable(struct nvme_dev *dev)
                 if (dev->cmbsz) {
                         if (sysfs_add_file_to_group(&dev->ctrl.device->kobj,
                                                     &dev_attr_cmb.attr, NULL))
-                                dev_warn(dev->dev,
+                                dev_warn(dev->ctrl.device,
                                          "failed to add sysfs attribute for CMB\n");
                 }
         }
@@ -1779,6 +1784,7 @@ static void nvme_pci_disable(struct nvme_dev *dev)
 {
         struct pci_dev *pdev = to_pci_dev(dev->dev);
 
+        nvme_release_cmb(dev);
         pci_free_irq_vectors(pdev);
 
         if (pci_is_enabled(pdev)) {
@@ -2041,6 +2047,7 @@ static int nvme_pci_reset_ctrl(struct nvme_ctrl *ctrl)
 static const struct nvme_ctrl_ops nvme_pci_ctrl_ops = {
         .name                   = "pcie",
         .module                 = THIS_MODULE,
+        .flags                  = NVME_F_METADATA_SUPPORTED,
         .reg_read32             = nvme_pci_reg_read32,
         .reg_write32            = nvme_pci_reg_write32,
         .reg_read64             = nvme_pci_reg_read64,
@@ -2184,7 +2191,6 @@ static void nvme_remove(struct pci_dev *pdev)
         nvme_dev_disable(dev, true);
         nvme_dev_remove_admin(dev);
         nvme_free_queues(dev, 0);
-        nvme_release_cmb(dev);
         nvme_release_prp_pools(dev);
         nvme_dev_unmap(dev);
         nvme_put_ctrl(&dev->ctrl);
@@ -2288,6 +2294,8 @@ static const struct pci_device_id nvme_id_table[] = {
         { PCI_VDEVICE(INTEL, 0x0a54),
                 .driver_data = NVME_QUIRK_STRIPE_SIZE |
                                 NVME_QUIRK_DEALLOCATE_ZEROES, },
+        { PCI_VDEVICE(INTEL, 0xf1a5),   /* Intel 600P/P3100 */
+                .driver_data = NVME_QUIRK_NO_DEEPEST_PS },
         { PCI_VDEVICE(INTEL, 0x5845),   /* Qemu emulated controller */
                 .driver_data = NVME_QUIRK_IDENTIFY_CNS, },
         { PCI_DEVICE(0x1c58, 0x0003),   /* HGST adapter */
diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
index dd1c6deef82f..28bd255c144d 100644
--- a/drivers/nvme/host/rdma.c
+++ b/drivers/nvme/host/rdma.c
@@ -1038,6 +1038,19 @@ static void nvme_rdma_send_done(struct ib_cq *cq, struct ib_wc *wc)
                 nvme_rdma_wr_error(cq, wc, "SEND");
 }
 
+static inline int nvme_rdma_queue_sig_limit(struct nvme_rdma_queue *queue)
+{
+        int sig_limit;
+
+        /*
+         * We signal completion every queue depth/2 and also handle the
+         * degenerated case of a  device with queue_depth=1, where we
+         * would need to signal every message.
+         */
+        sig_limit = max(queue->queue_size / 2, 1);
+        return (++queue->sig_count % sig_limit) == 0;
+}
+
 static int nvme_rdma_post_send(struct nvme_rdma_queue *queue,
                 struct nvme_rdma_qe *qe, struct ib_sge *sge, u32 num_sge,
                 struct ib_send_wr *first, bool flush)
@@ -1065,9 +1078,6 @@ static int nvme_rdma_post_send(struct nvme_rdma_queue *queue,
          * Would have been way to obvious to handle this in hardware or
          * at least the RDMA stack..
          *
-         * This messy and racy code sniplet is copy and pasted from the iSER
-         * initiator, and the magic '32' comes from there as well.
-         *
          * Always signal the flushes. The magic request used for the flush
          * sequencer is not allocated in our driver's tagset and it's
          * triggered to be freed by blk_cleanup_queue(). So we need to
@@ -1075,7 +1085,7 @@ static int nvme_rdma_post_send(struct nvme_rdma_queue *queue,
          * embedded in request's payload, is not freed when __ib_process_cq()
          * calls wr_cqe->done().
          */
-        if ((++queue->sig_count % 32) == 0 || flush)
+        if (nvme_rdma_queue_sig_limit(queue) || flush)
                 wr.send_flags |= IB_SEND_SIGNALED;
 
         if (first)
@@ -1782,7 +1792,7 @@ static int nvme_rdma_reset_ctrl(struct nvme_ctrl *nctrl)
 static const struct nvme_ctrl_ops nvme_rdma_ctrl_ops = {
         .name                   = "rdma",
         .module                 = THIS_MODULE,
-        .is_fabrics             = true,
+        .flags                  = NVME_F_FABRICS,
         .reg_read32             = nvmf_reg_read32,
         .reg_read64             = nvmf_reg_read64,
         .reg_write32            = nvmf_reg_write32,
diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c
index cf90713043da..eb9399ac97cf 100644
--- a/drivers/nvme/target/core.c
+++ b/drivers/nvme/target/core.c
@@ -529,6 +529,12 @@ fail:
 }
 EXPORT_SYMBOL_GPL(nvmet_req_init);
 
+void nvmet_req_uninit(struct nvmet_req *req)
+{
+        percpu_ref_put(&req->sq->ref);
+}
+EXPORT_SYMBOL_GPL(nvmet_req_uninit);
+
 static inline bool nvmet_cc_en(u32 cc)
 {
         return cc & 0x1;
diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c
index 62eba29c85fb..2006fae61980 100644
--- a/drivers/nvme/target/fc.c
+++ b/drivers/nvme/target/fc.c
@@ -517,9 +517,7 @@ nvmet_fc_queue_to_cpu(struct nvmet_fc_tgtport *tgtport, int qid)
 {
         int cpu, idx, cnt;
 
-        if (!(tgtport->ops->target_features &
-                        NVMET_FCTGTFEAT_NEEDS_CMD_CPUSCHED) ||
-            tgtport->ops->max_hw_queues == 1)
+        if (tgtport->ops->max_hw_queues == 1)
                 return WORK_CPU_UNBOUND;
 
         /* Simple cpu selection based on qid modulo active cpu count */
diff --git a/drivers/nvme/target/fcloop.c b/drivers/nvme/target/fcloop.c
index 15551ef79c8c..294a6611fb24 100644
--- a/drivers/nvme/target/fcloop.c
+++ b/drivers/nvme/target/fcloop.c
@@ -698,7 +698,6 @@ static struct nvmet_fc_target_template tgttemplate = {
         .dma_boundary           = FCLOOP_DMABOUND_4G,
         /* optional features */
         .target_features        = NVMET_FCTGTFEAT_CMD_IN_ISR |
-                                  NVMET_FCTGTFEAT_NEEDS_CMD_CPUSCHED |
                                   NVMET_FCTGTFEAT_OPDONE_IN_ISR,
         /* sizes of additional private data for data structures */
         .target_priv_sz         = sizeof(struct fcloop_tport),
diff --git a/drivers/nvme/target/loop.c b/drivers/nvme/target/loop.c
index feb497134aee..e503cfff0337 100644
--- a/drivers/nvme/target/loop.c
+++ b/drivers/nvme/target/loop.c
@@ -558,7 +558,7 @@ static int nvme_loop_reset_ctrl(struct nvme_ctrl *nctrl)
 static const struct nvme_ctrl_ops nvme_loop_ctrl_ops = {
         .name                   = "loop",
         .module                 = THIS_MODULE,
-        .is_fabrics             = true,
+        .flags                  = NVME_F_FABRICS,
         .reg_read32             = nvmf_reg_read32,
         .reg_read64             = nvmf_reg_read64,
         .reg_write32            = nvmf_reg_write32,
diff --git a/drivers/nvme/target/nvmet.h b/drivers/nvme/target/nvmet.h
index 7cb77ba5993b..cfc5c7fb0ab7 100644
--- a/drivers/nvme/target/nvmet.h
+++ b/drivers/nvme/target/nvmet.h
@@ -261,6 +261,7 @@ u16 nvmet_parse_fabrics_cmd(struct nvmet_req *req);
 
 bool nvmet_req_init(struct nvmet_req *req, struct nvmet_cq *cq,
                 struct nvmet_sq *sq, struct nvmet_fabrics_ops *ops);
+void nvmet_req_uninit(struct nvmet_req *req);
 void nvmet_req_complete(struct nvmet_req *req, u16 status);
 
 void nvmet_cq_setup(struct nvmet_ctrl *ctrl, struct nvmet_cq *cq, u16 qid,
diff --git a/drivers/nvme/target/rdma.c b/drivers/nvme/target/rdma.c
index 99c69018a35f..9e45cde63376 100644
--- a/drivers/nvme/target/rdma.c
+++ b/drivers/nvme/target/rdma.c
@@ -567,6 +567,7 @@ static void nvmet_rdma_read_data_done(struct ib_cq *cq, struct ib_wc *wc)
         rsp->n_rdma = 0;
 
         if (unlikely(wc->status != IB_WC_SUCCESS)) {
+                nvmet_req_uninit(&rsp->req);
                 nvmet_rdma_release_rsp(rsp);
                 if (wc->status != IB_WC_WR_FLUSH_ERR) {
                         pr_info("RDMA READ for CQE 0x%p failed with status %s (%d).\n",
diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
index 3080d9dd031d..43bd69dceabf 100644
--- a/drivers/of/fdt.c
+++ b/drivers/of/fdt.c
@@ -507,6 +507,9 @@ void *__unflatten_device_tree(const void *blob,
 
         /* Allocate memory for the expanded device tree */
         mem = dt_alloc(size + 4, __alignof__(struct device_node));
+        if (!mem)
+                return NULL;
+
         memset(mem, 0, size);
 
         *(__be32 *)(mem + size) = cpu_to_be32(0xdeadbeef);
diff --git a/drivers/of/of_reserved_mem.c b/drivers/of/of_reserved_mem.c
index 4dec07ea510f..d507c3569a88 100644
--- a/drivers/of/of_reserved_mem.c
+++ b/drivers/of/of_reserved_mem.c
@@ -197,7 +197,7 @@ static int __init __reserved_mem_init_node(struct reserved_mem *rmem)
         const struct of_device_id *i;
 
         for (i = __reservedmem_of_table; i < &__rmem_of_table_sentinel; i++) {
-                int const (*initfn)(struct reserved_mem *rmem) = i->data;
+                reservedmem_of_init_fn initfn = i->data;
                 const char *compat = i->compatible;
 
                 if (!of_flat_dt_is_compatible(rmem->fdt_node, compat))
diff --git a/drivers/of/platform.c b/drivers/of/platform.c
index 71fecc2debfc..703a42118ffc 100644
--- a/drivers/of/platform.c
+++ b/drivers/of/platform.c
@@ -523,7 +523,7 @@ static int __init of_platform_default_populate_init(void)
 arch_initcall_sync(of_platform_default_populate_init);
 #endif
 
-static int of_platform_device_destroy(struct device *dev, void *data)
+int of_platform_device_destroy(struct device *dev, void *data)
 {
         /* Do not touch devices not populated from the device tree */
         if (!dev->of_node || !of_node_check_flag(dev->of_node, OF_POPULATED))
@@ -544,6 +544,7 @@ static int of_platform_device_destroy(struct device *dev, void *data)
         of_node_clear_flag(dev->of_node, OF_POPULATED_BUS);
         return 0;
 }
+EXPORT_SYMBOL_GPL(of_platform_device_destroy);
 
 /**
  * of_platform_depopulate() - Remove devices populated from device tree
diff --git a/drivers/pci/dwc/pci-imx6.c b/drivers/pci/dwc/pci-imx6.c
index a98cba55c7f0..19a289b8cc94 100644
--- a/drivers/pci/dwc/pci-imx6.c
+++ b/drivers/pci/dwc/pci-imx6.c
@@ -252,7 +252,34 @@ static void imx6_pcie_reset_phy(struct imx6_pcie *imx6_pcie)
 static int imx6q_pcie_abort_handler(unsigned long addr,
                 unsigned int fsr, struct pt_regs *regs)
 {
-        return 0;
+        unsigned long pc = instruction_pointer(regs);
+        unsigned long instr = *(unsigned long *)pc;
+        int reg = (instr >> 12) & 15;
+
+        /*
+         * If the instruction being executed was a read,
+         * make it look like it read all-ones.
+         */
+        if ((instr & 0x0c100000) == 0x04100000) {
+                unsigned long val;
+
+                if (instr & 0x00400000)
+                        val = 255;
+                else
+                        val = -1;
+
+                regs->uregs[reg] = val;
+                regs->ARM_pc += 4;
+                return 0;
+        }
+
+        if ((instr & 0x0e100090) == 0x00100090) {
+                regs->uregs[reg] = -1;
+                regs->ARM_pc += 4;
+                return 0;
+        }
+
+        return 1;
 }
 
 static void imx6_pcie_assert_core_reset(struct imx6_pcie *imx6_pcie)
@@ -819,8 +846,8 @@ static int __init imx6_pcie_init(void)
          * we can install the handler here without risking it
          * accessing some uninitialized driver state.
          */
-        hook_fault_code(16 + 6, imx6q_pcie_abort_handler, SIGBUS, 0,
-                        "imprecise external abort");
+        hook_fault_code(8, imx6q_pcie_abort_handler, SIGBUS, 0,
+                        "external abort on non-linefetch");
 
         return platform_driver_register(&imx6_pcie_driver);
 }
diff --git a/drivers/pci/endpoint/Kconfig b/drivers/pci/endpoint/Kconfig
index c23f146fb5a6..c09623ca8c3b 100644
--- a/drivers/pci/endpoint/Kconfig
+++ b/drivers/pci/endpoint/Kconfig
@@ -6,6 +6,7 @@ menu "PCI Endpoint"
 
 config PCI_ENDPOINT
         bool "PCI Endpoint Support"
+        depends on HAS_DMA
         help
            Enable this configuration option to support configurable PCI
            endpoint. This should be enabled if the platform has a PCI
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index b01bd5bba8e6..563901cd9c06 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -2144,7 +2144,8 @@ bool pci_dev_keep_suspended(struct pci_dev *pci_dev)
 
         if (!pm_runtime_suspended(dev)
             || pci_target_state(pci_dev) != pci_dev->current_state
-            || platform_pci_need_resume(pci_dev))
+            || platform_pci_need_resume(pci_dev)
+            || (pci_dev->dev_flags & PCI_DEV_FLAGS_NEEDS_RESUME))
                 return false;
 
         /*
diff --git a/drivers/pci/switch/switchtec.c b/drivers/pci/switch/switchtec.c
index cc6e085008fb..f6a63406c76e 100644
--- a/drivers/pci/switch/switchtec.c
+++ b/drivers/pci/switch/switchtec.c
@@ -1291,7 +1291,6 @@ static struct switchtec_dev *stdev_create(struct pci_dev *pdev)
         cdev = &stdev->cdev;
         cdev_init(cdev, &switchtec_fops);
         cdev->owner = THIS_MODULE;
-        cdev->kobj.parent = &dev->kobj;
 
         return stdev;
 
@@ -1442,12 +1441,15 @@ static int switchtec_init_pci(struct switchtec_dev *stdev,
         stdev->mmio_sys_info = stdev->mmio + SWITCHTEC_GAS_SYS_INFO_OFFSET;
         stdev->mmio_flash_info = stdev->mmio + SWITCHTEC_GAS_FLASH_INFO_OFFSET;
         stdev->mmio_ntb = stdev->mmio + SWITCHTEC_GAS_NTB_OFFSET;
-        stdev->partition = ioread8(&stdev->mmio_ntb->partition_id);
+        stdev->partition = ioread8(&stdev->mmio_sys_info->partition_id);
         stdev->partition_count = ioread8(&stdev->mmio_ntb->partition_count);
         stdev->mmio_part_cfg_all = stdev->mmio + SWITCHTEC_GAS_PART_CFG_OFFSET;
         stdev->mmio_part_cfg = &stdev->mmio_part_cfg_all[stdev->partition];
         stdev->mmio_pff_csr = stdev->mmio + SWITCHTEC_GAS_PFF_CSR_OFFSET;
 
+        if (stdev->partition_count < 1)
+                stdev->partition_count = 1;
+
         init_pff(stdev);
 
         pci_set_drvdata(pdev, stdev);
@@ -1479,11 +1481,7 @@ static int switchtec_pci_probe(struct pci_dev *pdev,
                   SWITCHTEC_EVENT_EN_IRQ,
                   &stdev->mmio_part_cfg->mrpc_comp_hdr);
 
-        rc = cdev_add(&stdev->cdev, stdev->dev.devt, 1);
-        if (rc)
-                goto err_put;
-
-        rc = device_add(&stdev->dev);
+        rc = cdev_device_add(&stdev->cdev, &stdev->dev);
         if (rc)
                 goto err_devadd;
 
@@ -1492,7 +1490,6 @@ static int switchtec_pci_probe(struct pci_dev *pdev,
         return 0;
 
 err_devadd:
-        cdev_del(&stdev->cdev);
         stdev_kill(stdev);
 err_put:
         ida_simple_remove(&switchtec_minor_ida, MINOR(stdev->dev.devt));
@@ -1506,8 +1503,7 @@ static void switchtec_pci_remove(struct pci_dev *pdev)
 
         pci_set_drvdata(pdev, NULL);
 
-        device_del(&stdev->dev);
-        cdev_del(&stdev->cdev);
+        cdev_device_del(&stdev->cdev, &stdev->dev);
         ida_simple_remove(&switchtec_minor_ida, MINOR(stdev->dev.devt));
         dev_info(&stdev->dev, "unregistered.\n");
 
diff --git a/drivers/powercap/powercap_sys.c b/drivers/powercap/powercap_sys.c
index 14bde0db8c24..5b10b50f8686 100644
--- a/drivers/powercap/powercap_sys.c
+++ b/drivers/powercap/powercap_sys.c
@@ -538,6 +538,7 @@ struct powercap_zone *powercap_register_zone(
 
         power_zone->id = result;
         idr_init(&power_zone->idr);
+        result = -ENOMEM;
         power_zone->name = kstrdup(name, GFP_KERNEL);
         if (!power_zone->name)
                 goto err_name_alloc;
diff --git a/drivers/rtc/rtc-cmos.c b/drivers/rtc/rtc-cmos.c
index b3de973a6260..9dca53df3584 100644
--- a/drivers/rtc/rtc-cmos.c
+++ b/drivers/rtc/rtc-cmos.c
@@ -1088,7 +1088,7 @@ static u32 rtc_handler(void *context)
         }
         spin_unlock_irqrestore(&rtc_lock, flags);
 
-        pm_wakeup_event(dev, 0);
+        pm_wakeup_hard_event(dev);
         acpi_clear_event(ACPI_EVENT_RTC);
         acpi_disable_event(ACPI_EVENT_RTC, 0);
         return ACPI_INTERRUPT_HANDLED;
diff --git a/drivers/s390/cio/ccwgroup.c b/drivers/s390/cio/ccwgroup.c
index e443b0d0b236..34b9ad6b3143 100644
--- a/drivers/s390/cio/ccwgroup.c
+++ b/drivers/s390/cio/ccwgroup.c
@@ -35,7 +35,7 @@ static struct bus_type ccwgroup_bus_type;
 static void __ccwgroup_remove_symlinks(struct ccwgroup_device *gdev)
 {
         int i;
-        char str[8];
+        char str[16];
 
         for (i = 0; i < gdev->count; i++) {
                 sprintf(str, "cdev%d", i);
@@ -238,7 +238,7 @@ static void ccwgroup_release(struct device *dev)
 
 static int __ccwgroup_create_symlinks(struct ccwgroup_device *gdev)
 {
-        char str[8];
+        char str[16];
         int i, rc;
 
         for (i = 0; i < gdev->count; i++) {
diff --git a/drivers/s390/cio/qdio_debug.h b/drivers/s390/cio/qdio_debug.h
index f33ce8577619..1d595d17bf11 100644
--- a/drivers/s390/cio/qdio_debug.h
+++ b/drivers/s390/cio/qdio_debug.h
@@ -11,7 +11,7 @@
 #include "qdio.h"
 
 /* that gives us 15 characters in the text event views */
-#define QDIO_DBF_LEN    16
+#define QDIO_DBF_LEN    32
 
 extern debug_info_t *qdio_dbf_setup;
 extern debug_info_t *qdio_dbf_error;
diff --git a/drivers/s390/net/qeth_core.h b/drivers/s390/net/qeth_core.h
index f6aa21176d89..30bc6105aac3 100644
--- a/drivers/s390/net/qeth_core.h
+++ b/drivers/s390/net/qeth_core.h
@@ -701,6 +701,7 @@ enum qeth_discipline_id {
 };
 
 struct qeth_discipline {
+        const struct device_type *devtype;
         void (*start_poll)(struct ccw_device *, int, unsigned long);
         qdio_handler_t *input_handler;
         qdio_handler_t *output_handler;
@@ -875,6 +876,9 @@ extern struct qeth_discipline qeth_l2_discipline;
 extern struct qeth_discipline qeth_l3_discipline;
 extern const struct attribute_group *qeth_generic_attr_groups[];
 extern const struct attribute_group *qeth_osn_attr_groups[];
+extern const struct attribute_group qeth_device_attr_group;
+extern const struct attribute_group qeth_device_blkt_group;
+extern const struct device_type qeth_generic_devtype;
 extern struct workqueue_struct *qeth_wq;
 
 int qeth_card_hw_is_reachable(struct qeth_card *);
diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
index 38114a8d56e0..fc6d85f2b38d 100644
--- a/drivers/s390/net/qeth_core_main.c
+++ b/drivers/s390/net/qeth_core_main.c
@@ -5530,10 +5530,12 @@ void qeth_core_free_discipline(struct qeth_card *card)
         card->discipline = NULL;
 }
 
-static const struct device_type qeth_generic_devtype = {
+const struct device_type qeth_generic_devtype = {
         .name = "qeth_generic",
         .groups = qeth_generic_attr_groups,
 };
+EXPORT_SYMBOL_GPL(qeth_generic_devtype);
+
 static const struct device_type qeth_osn_devtype = {
         .name = "qeth_osn",
         .groups = qeth_osn_attr_groups,
@@ -5659,23 +5661,22 @@ static int qeth_core_probe_device(struct ccwgroup_device *gdev)
                 goto err_card;
         }
 
-        if (card->info.type == QETH_CARD_TYPE_OSN)
-                gdev->dev.type = &qeth_osn_devtype;
-        else
-                gdev->dev.type = &qeth_generic_devtype;
-
         switch (card->info.type) {
         case QETH_CARD_TYPE_OSN:
         case QETH_CARD_TYPE_OSM:
                 rc = qeth_core_load_discipline(card, QETH_DISCIPLINE_LAYER2);
                 if (rc)
                         goto err_card;
+
+                gdev->dev.type = (card->info.type != QETH_CARD_TYPE_OSN)
+                                        ? card->discipline->devtype
+                                        : &qeth_osn_devtype;
                 rc = card->discipline->setup(card->gdev);
                 if (rc)
                         goto err_disc;
-        case QETH_CARD_TYPE_OSD:
-        case QETH_CARD_TYPE_OSX:
+                break;
         default:
+                gdev->dev.type = &qeth_generic_devtype;
                 break;
         }
 
@@ -5731,8 +5732,10 @@ static int qeth_core_set_online(struct ccwgroup_device *gdev)
                 if (rc)
                         goto err;
                 rc = card->discipline->setup(card->gdev);
-                if (rc)
+                if (rc) {
+                        qeth_core_free_discipline(card);
                         goto err;
+                }
         }
         rc = card->discipline->set_online(gdev);
 err:
diff --git a/drivers/s390/net/qeth_core_sys.c b/drivers/s390/net/qeth_core_sys.c
index 75b29fd2fcf4..db6a285d41e0 100644
--- a/drivers/s390/net/qeth_core_sys.c
+++ b/drivers/s390/net/qeth_core_sys.c
@@ -413,12 +413,16 @@ static ssize_t qeth_dev_layer2_store(struct device *dev,
 
         if (card->options.layer2 == newdis)
                 goto out;
-        else {
-                card->info.mac_bits  = 0;
-                if (card->discipline) {
-                        card->discipline->remove(card->gdev);
-                        qeth_core_free_discipline(card);
-                }
+        if (card->info.type == QETH_CARD_TYPE_OSM) {
+                /* fixed layer, can't switch */
+                rc = -EOPNOTSUPP;
+                goto out;
+        }
+
+        card->info.mac_bits = 0;
+        if (card->discipline) {
+                card->discipline->remove(card->gdev);
+                qeth_core_free_discipline(card);
         }
 
         rc = qeth_core_load_discipline(card, newdis);
@@ -426,6 +430,8 @@ static ssize_t qeth_dev_layer2_store(struct device *dev,
                 goto out;
 
         rc = card->discipline->setup(card->gdev);
+        if (rc)
+                qeth_core_free_discipline(card);
 out:
         mutex_unlock(&card->discipline_mutex);
         return rc ? rc : count;
@@ -703,10 +709,11 @@ static struct attribute *qeth_blkt_device_attrs[] = {
         &dev_attr_inter_jumbo.attr,
         NULL,
 };
-static struct attribute_group qeth_device_blkt_group = {
+const struct attribute_group qeth_device_blkt_group = {
         .name = "blkt",
         .attrs = qeth_blkt_device_attrs,
 };
+EXPORT_SYMBOL_GPL(qeth_device_blkt_group);
 
 static struct attribute *qeth_device_attrs[] = {
         &dev_attr_state.attr,
@@ -726,9 +733,10 @@ static struct attribute *qeth_device_attrs[] = {
         &dev_attr_switch_attrs.attr,
         NULL,
 };
-static struct attribute_group qeth_device_attr_group = {
+const struct attribute_group qeth_device_attr_group = {
         .attrs = qeth_device_attrs,
 };
+EXPORT_SYMBOL_GPL(qeth_device_attr_group);
 
 const struct attribute_group *qeth_generic_attr_groups[] = {
         &qeth_device_attr_group,
diff --git a/drivers/s390/net/qeth_l2.h b/drivers/s390/net/qeth_l2.h
index 29d9fb3890ad..0d59f9a45ea9 100644
--- a/drivers/s390/net/qeth_l2.h
+++ b/drivers/s390/net/qeth_l2.h
@@ -8,6 +8,8 @@
 
 #include "qeth_core.h"
 
+extern const struct attribute_group *qeth_l2_attr_groups[];
+
 int qeth_l2_create_device_attributes(struct device *);
 void qeth_l2_remove_device_attributes(struct device *);
 void qeth_l2_setup_bridgeport_attrs(struct qeth_card *card);
diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c
index 1b07f382d74c..bd2df62a5cdf 100644
--- a/drivers/s390/net/qeth_l2_main.c
+++ b/drivers/s390/net/qeth_l2_main.c
@@ -880,11 +880,21 @@ static int qeth_l2_stop(struct net_device *dev)
         return 0;
 }
 
+static const struct device_type qeth_l2_devtype = {
+        .name = "qeth_layer2",
+        .groups = qeth_l2_attr_groups,
+};
+
 static int qeth_l2_probe_device(struct ccwgroup_device *gdev)
 {
         struct qeth_card *card = dev_get_drvdata(&gdev->dev);
+        int rc;
 
-        qeth_l2_create_device_attributes(&gdev->dev);
+        if (gdev->dev.type == &qeth_generic_devtype) {
+                rc = qeth_l2_create_device_attributes(&gdev->dev);
+                if (rc)
+                        return rc;
+        }
         INIT_LIST_HEAD(&card->vid_list);
         hash_init(card->mac_htable);
         card->options.layer2 = 1;
@@ -896,7 +906,8 @@ static void qeth_l2_remove_device(struct ccwgroup_device *cgdev)
 {
         struct qeth_card *card = dev_get_drvdata(&cgdev->dev);
 
-        qeth_l2_remove_device_attributes(&cgdev->dev);
+        if (cgdev->dev.type == &qeth_generic_devtype)
+                qeth_l2_remove_device_attributes(&cgdev->dev);
         qeth_set_allowed_threads(card, 0, 1);
         wait_event(card->wait_q, qeth_threads_running(card, 0xffffffff) == 0);
 
@@ -954,7 +965,6 @@ static int qeth_l2_setup_netdev(struct qeth_card *card)
         case QETH_CARD_TYPE_OSN:
                 card->dev = alloc_netdev(0, "osn%d", NET_NAME_UNKNOWN,
                                          ether_setup);
-                card->dev->flags |= IFF_NOARP;
                 break;
         default:
                 card->dev = alloc_etherdev(0);
@@ -969,9 +979,12 @@ static int qeth_l2_setup_netdev(struct qeth_card *card)
         card->dev->min_mtu = 64;
         card->dev->max_mtu = ETH_MAX_MTU;
         card->dev->netdev_ops = &qeth_l2_netdev_ops;
-        card->dev->ethtool_ops =
-                (card->info.type != QETH_CARD_TYPE_OSN) ?
-                &qeth_l2_ethtool_ops : &qeth_l2_osn_ops;
+        if (card->info.type == QETH_CARD_TYPE_OSN) {
+                card->dev->ethtool_ops = &qeth_l2_osn_ops;
+                card->dev->flags |= IFF_NOARP;
+        } else {
+                card->dev->ethtool_ops = &qeth_l2_ethtool_ops;
+        }
         card->dev->features |= NETIF_F_HW_VLAN_CTAG_FILTER;
         if (card->info.type == QETH_CARD_TYPE_OSD && !card->info.guestlan) {
                 card->dev->hw_features = NETIF_F_SG;
@@ -1269,6 +1282,7 @@ static int qeth_l2_control_event(struct qeth_card *card,
 }
 
 struct qeth_discipline qeth_l2_discipline = {
+        .devtype = &qeth_l2_devtype,
         .start_poll = qeth_qdio_start_poll,
         .input_handler = (qdio_handler_t *) qeth_qdio_input_handler,
         .output_handler = (qdio_handler_t *) qeth_qdio_output_handler,
diff --git a/drivers/s390/net/qeth_l2_sys.c b/drivers/s390/net/qeth_l2_sys.c
index 687972356d6b..9696baa49e2d 100644
--- a/drivers/s390/net/qeth_l2_sys.c
+++ b/drivers/s390/net/qeth_l2_sys.c
@@ -269,3 +269,11 @@ void qeth_l2_setup_bridgeport_attrs(struct qeth_card *card)
         } else
                 qeth_bridgeport_an_set(card, 0);
 }
+
+const struct attribute_group *qeth_l2_attr_groups[] = {
+        &qeth_device_attr_group,
+        &qeth_device_blkt_group,
+        /* l2 specific, see l2_{create,remove}_device_attributes(): */
+        &qeth_l2_bridgeport_attr_group,
+        NULL,
+};
diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c
index 6e0354ef4b86..d8df1e635163 100644
--- a/drivers/s390/net/qeth_l3_main.c
+++ b/drivers/s390/net/qeth_l3_main.c
@@ -3039,8 +3039,13 @@ static int qeth_l3_setup_netdev(struct qeth_card *card)
 static int qeth_l3_probe_device(struct ccwgroup_device *gdev)
 {
         struct qeth_card *card = dev_get_drvdata(&gdev->dev);
+        int rc;
 
-        qeth_l3_create_device_attributes(&gdev->dev);
+        rc = qeth_l3_create_device_attributes(&gdev->dev);
+        if (rc)
+                return rc;
+        hash_init(card->ip_htable);
+        hash_init(card->ip_mc_htable);
         card->options.layer2 = 0;
         card->info.hwtrap = 0;
         return 0;
@@ -3306,6 +3311,7 @@ static int qeth_l3_control_event(struct qeth_card *card,
 }
 
 struct qeth_discipline qeth_l3_discipline = {
+        .devtype = &qeth_generic_devtype,
         .start_poll = qeth_qdio_start_poll,
         .input_handler = (qdio_handler_t *) qeth_qdio_input_handler,
         .output_handler = (qdio_handler_t *) qeth_qdio_output_handler,
diff --git a/drivers/s390/virtio/virtio_ccw.c b/drivers/s390/virtio/virtio_ccw.c
index 2a76ea78a0bf..b18fe2014cf2 100644
--- a/drivers/s390/virtio/virtio_ccw.c
+++ b/drivers/s390/virtio/virtio_ccw.c
@@ -87,7 +87,7 @@ struct vq_info_block {
 } __packed;
 
 struct virtio_feature_desc {
-        __u32 features;
+        __le32 features;
         __u8 index;
 } __packed;
 
diff --git a/drivers/scsi/csiostor/csio_hw.c b/drivers/scsi/csiostor/csio_hw.c
index 622bdabc8894..dab195f04da7 100644
--- a/drivers/scsi/csiostor/csio_hw.c
+++ b/drivers/scsi/csiostor/csio_hw.c
@@ -1769,7 +1769,6 @@ csio_hw_use_fwconfig(struct csio_hw *hw, int reset, u32 *fw_cfg_param)
                 goto bye;
         }
 
-        mempool_free(mbp, hw->mb_mempool);
         if (finicsum != cfcsum) {
                 csio_warn(hw,
                       "Config File checksum mismatch: csum=%#x, computed=%#x\n",
@@ -1780,6 +1779,10 @@ csio_hw_use_fwconfig(struct csio_hw *hw, int reset, u32 *fw_cfg_param)
         rv = csio_hw_validate_caps(hw, mbp);
         if (rv != 0)
                 goto bye;
+
+        mempool_free(mbp, hw->mb_mempool);
+        mbp = NULL;
+
         /*
          * Note that we're operating with parameters
          * not supplied by the driver, rather than from hard-wired
diff --git a/drivers/scsi/cxlflash/Kconfig b/drivers/scsi/cxlflash/Kconfig
index c052104e523e..a011c5dbf214 100644
--- a/drivers/scsi/cxlflash/Kconfig
+++ b/drivers/scsi/cxlflash/Kconfig
@@ -5,6 +5,7 @@
 config CXLFLASH
         tristate "Support for IBM CAPI Flash"
         depends on PCI && SCSI && CXL && EEH
+        select IRQ_POLL
         default m
         help
           Allows CAPI Accelerated IO to Flash
diff --git a/drivers/scsi/libfc/fc_fcp.c b/drivers/scsi/libfc/fc_fcp.c
index a808e8ef1d08..234352da5c3c 100644
--- a/drivers/scsi/libfc/fc_fcp.c
+++ b/drivers/scsi/libfc/fc_fcp.c
@@ -407,11 +407,12 @@ unlock:
  * can_queue. Eventually we will hit the point where we run
  * on all reserved structs.
  */
-static void fc_fcp_can_queue_ramp_down(struct fc_lport *lport)
+static bool fc_fcp_can_queue_ramp_down(struct fc_lport *lport)
 {
         struct fc_fcp_internal *si = fc_get_scsi_internal(lport);
         unsigned long flags;
         int can_queue;
+        bool changed = false;
 
         spin_lock_irqsave(lport->host->host_lock, flags);
 
@@ -427,9 +428,11 @@ static void fc_fcp_can_queue_ramp_down(struct fc_lport *lport)
         if (!can_queue)
                 can_queue = 1;
         lport->host->can_queue = can_queue;
+        changed = true;
 
 unlock:
         spin_unlock_irqrestore(lport->host->host_lock, flags);
+        return changed;
 }
 
 /*
@@ -1896,11 +1899,11 @@ int fc_queuecommand(struct Scsi_Host *shost, struct scsi_cmnd *sc_cmd)
 
         if (!fc_fcp_lport_queue_ready(lport)) {
                 if (lport->qfull) {
-                        fc_fcp_can_queue_ramp_down(lport);
-                        shost_printk(KERN_ERR, lport->host,
-                                     "libfc: queue full, "
-                                     "reducing can_queue to %d.\n",
-                                     lport->host->can_queue);
+                        if (fc_fcp_can_queue_ramp_down(lport))
+                                shost_printk(KERN_ERR, lport->host,
+                                             "libfc: queue full, "
+                                             "reducing can_queue to %d.\n",
+                                             lport->host->can_queue);
                 }
                 rc = SCSI_MLQUEUE_HOST_BUSY;
                 goto out;
diff --git a/drivers/scsi/libfc/fc_rport.c b/drivers/scsi/libfc/fc_rport.c
index b44c3136eb51..520325867e2b 100644
--- a/drivers/scsi/libfc/fc_rport.c
+++ b/drivers/scsi/libfc/fc_rport.c
@@ -1422,7 +1422,7 @@ static void fc_rport_recv_rtv_req(struct fc_rport_priv *rdata,
         fp = fc_frame_alloc(lport, sizeof(*rtv));
         if (!fp) {
                 rjt_data.reason = ELS_RJT_UNAB;
-                rjt_data.reason = ELS_EXPL_INSUF_RES;
+                rjt_data.explan = ELS_EXPL_INSUF_RES;
                 fc_seq_els_rsp_send(in_fp, ELS_LS_RJT, &rjt_data);
                 goto drop;
         }
diff --git a/drivers/scsi/lpfc/lpfc.h b/drivers/scsi/lpfc/lpfc.h
index 6d7840b096e6..f2c0ba6ced78 100644
--- a/drivers/scsi/lpfc/lpfc.h
+++ b/drivers/scsi/lpfc/lpfc.h
@@ -141,6 +141,13 @@ struct lpfc_dmabuf {
         uint32_t   buffer_tag;  /* used for tagged queue ring */
 };
 
+struct lpfc_nvmet_ctxbuf {
+        struct list_head list;
+        struct lpfc_nvmet_rcv_ctx *context;
+        struct lpfc_iocbq *iocbq;
+        struct lpfc_sglq *sglq;
+};
+
 struct lpfc_dma_pool {
         struct lpfc_dmabuf   *elements;
         uint32_t    max_count;
@@ -163,9 +170,7 @@ struct rqb_dmabuf {
         struct lpfc_dmabuf dbuf;
         uint16_t total_size;
         uint16_t bytes_recv;
-        void *context;
-        struct lpfc_iocbq *iocbq;
-        struct lpfc_sglq *sglq;
+        uint16_t idx;
         struct lpfc_queue *hrq;   /* ptr to associated Header RQ */
         struct lpfc_queue *drq;   /* ptr to associated Data RQ */
 };
@@ -670,6 +675,8 @@ struct lpfc_hba {
                                         /* INIT_LINK mailbox command */
 #define LS_NPIV_FAB_SUPPORTED 0x2       /* Fabric supports NPIV */
 #define LS_IGNORE_ERATT       0x4       /* intr handler should ignore ERATT */
+#define LS_MDS_LINK_DOWN      0x8       /* MDS Diagnostics Link Down */
+#define LS_MDS_LOOPBACK      0x16       /* MDS Diagnostics Link Up (Loopback) */
 
         uint32_t hba_flag;      /* hba generic flags */
 #define HBA_ERATT_HANDLED       0x1 /* This flag is set when eratt handled */
@@ -777,7 +784,6 @@ struct lpfc_hba {
         uint32_t cfg_nvme_oas;
         uint32_t cfg_nvme_io_channel;
         uint32_t cfg_nvmet_mrq;
-        uint32_t cfg_nvmet_mrq_post;
         uint32_t cfg_enable_nvmet;
         uint32_t cfg_nvme_enable_fb;
         uint32_t cfg_nvmet_fb_size;
@@ -943,6 +949,7 @@ struct lpfc_hba {
         struct pci_pool *lpfc_mbuf_pool;
         struct pci_pool *lpfc_hrb_pool; /* header receive buffer pool */
         struct pci_pool *lpfc_drb_pool; /* data receive buffer pool */
+        struct pci_pool *lpfc_nvmet_drb_pool; /* data receive buffer pool */
         struct pci_pool *lpfc_hbq_pool; /* SLI3 hbq buffer pool */
         struct pci_pool *txrdy_payload_pool;
         struct lpfc_dma_pool lpfc_mbuf_safety_pool;
@@ -1228,7 +1235,11 @@ lpfc_sli_read_hs(struct lpfc_hba *phba)
 static inline struct lpfc_sli_ring *
 lpfc_phba_elsring(struct lpfc_hba *phba)
 {
-        if (phba->sli_rev == LPFC_SLI_REV4)
-                return phba->sli4_hba.els_wq->pring;
+        if (phba->sli_rev == LPFC_SLI_REV4) {
+                if (phba->sli4_hba.els_wq)
+                        return phba->sli4_hba.els_wq->pring;
+                else
+                        return NULL;
+        }
         return &phba->sli.sli3_ring[LPFC_ELS_RING];
 }
diff --git a/drivers/scsi/lpfc/lpfc_attr.c b/drivers/scsi/lpfc/lpfc_attr.c
index 4830370bfab1..bb2d9e238225 100644
--- a/drivers/scsi/lpfc/lpfc_attr.c
+++ b/drivers/scsi/lpfc/lpfc_attr.c
@@ -60,9 +60,9 @@
 #define LPFC_MIN_DEVLOSS_TMO    1
 #define LPFC_MAX_DEVLOSS_TMO    255
 
-#define LPFC_DEF_MRQ_POST       256
-#define LPFC_MIN_MRQ_POST       32
-#define LPFC_MAX_MRQ_POST       512
+#define LPFC_DEF_MRQ_POST       512
+#define LPFC_MIN_MRQ_POST       512
+#define LPFC_MAX_MRQ_POST       2048
 
 /*
  * Write key size should be multiple of 4. If write key is changed
@@ -205,8 +205,9 @@ lpfc_nvme_info_show(struct device *dev, struct device_attribute *attr,
                                 atomic_read(&tgtp->xmt_ls_rsp_error));
 
                 len += snprintf(buf+len, PAGE_SIZE-len,
-                                "FCP: Rcv %08x Drop %08x\n",
+                                "FCP: Rcv %08x Release %08x Drop %08x\n",
                                 atomic_read(&tgtp->rcv_fcp_cmd_in),
+                                atomic_read(&tgtp->xmt_fcp_release),
                                 atomic_read(&tgtp->rcv_fcp_cmd_drop));
 
                 if (atomic_read(&tgtp->rcv_fcp_cmd_in) !=
@@ -218,15 +219,12 @@ lpfc_nvme_info_show(struct device *dev, struct device_attribute *attr,
                 }
 
                 len += snprintf(buf+len, PAGE_SIZE-len,
-                                "FCP Rsp: RD %08x rsp %08x WR %08x rsp %08x\n",
+                                "FCP Rsp: RD %08x rsp %08x WR %08x rsp %08x "
+                                "drop %08x\n",
                                 atomic_read(&tgtp->xmt_fcp_read),
                                 atomic_read(&tgtp->xmt_fcp_read_rsp),
                                 atomic_read(&tgtp->xmt_fcp_write),
-                                atomic_read(&tgtp->xmt_fcp_rsp));
-
-                len += snprintf(buf+len, PAGE_SIZE-len,
-                                "FCP Rsp: abort %08x drop %08x\n",
-                                atomic_read(&tgtp->xmt_fcp_abort),
+                                atomic_read(&tgtp->xmt_fcp_rsp),
                                 atomic_read(&tgtp->xmt_fcp_drop));
 
                 len += snprintf(buf+len, PAGE_SIZE-len,
@@ -236,10 +234,22 @@ lpfc_nvme_info_show(struct device *dev, struct device_attribute *attr,
                                 atomic_read(&tgtp->xmt_fcp_rsp_drop));
 
                 len += snprintf(buf+len, PAGE_SIZE-len,
-                                "ABORT: Xmt %08x Err %08x Cmpl %08x",
+                                "ABORT: Xmt %08x Cmpl %08x\n",
+                                atomic_read(&tgtp->xmt_fcp_abort),
+                                atomic_read(&tgtp->xmt_fcp_abort_cmpl));
+
+                len += snprintf(buf + len, PAGE_SIZE - len,
+                                "ABORT: Sol %08x  Usol %08x Err %08x Cmpl %08x",
+                                atomic_read(&tgtp->xmt_abort_sol),
+                                atomic_read(&tgtp->xmt_abort_unsol),
                                 atomic_read(&tgtp->xmt_abort_rsp),
-                                atomic_read(&tgtp->xmt_abort_rsp_error),
-                                atomic_read(&tgtp->xmt_abort_cmpl));
+                                atomic_read(&tgtp->xmt_abort_rsp_error));
+
+                len += snprintf(buf + len, PAGE_SIZE - len,
+                                "IO_CTX: %08x outstanding %08x total %x",
+                                phba->sli4_hba.nvmet_ctx_cnt,
+                                phba->sli4_hba.nvmet_io_wait_cnt,
+                                phba->sli4_hba.nvmet_io_wait_total);
 
                 len +=  snprintf(buf+len, PAGE_SIZE-len, "\n");
                 return len;
@@ -3312,14 +3322,6 @@ LPFC_ATTR_R(nvmet_mrq,
             "Specify number of RQ pairs for processing NVMET cmds");
 
 /*
- * lpfc_nvmet_mrq_post: Specify number buffers to post on every MRQ
- *
- */
-LPFC_ATTR_R(nvmet_mrq_post, LPFC_DEF_MRQ_POST,
-            LPFC_MIN_MRQ_POST, LPFC_MAX_MRQ_POST,
-            "Specify number of buffers to post on every MRQ");
-
-/*
  * lpfc_enable_fc4_type: Defines what FC4 types are supported.
  * Supported Values:  1 - register just FCP
  *                    3 - register both FCP and NVME
@@ -5154,7 +5156,6 @@ struct device_attribute *lpfc_hba_attrs[] = {
         &dev_attr_lpfc_suppress_rsp,
         &dev_attr_lpfc_nvme_io_channel,
         &dev_attr_lpfc_nvmet_mrq,
-        &dev_attr_lpfc_nvmet_mrq_post,
         &dev_attr_lpfc_nvme_enable_fb,
         &dev_attr_lpfc_nvmet_fb_size,
         &dev_attr_lpfc_enable_bg,
@@ -6194,7 +6195,6 @@ lpfc_get_cfgparam(struct lpfc_hba *phba)
 
         lpfc_enable_fc4_type_init(phba, lpfc_enable_fc4_type);
         lpfc_nvmet_mrq_init(phba, lpfc_nvmet_mrq);
-        lpfc_nvmet_mrq_post_init(phba, lpfc_nvmet_mrq_post);
 
         /* Initialize first burst. Target vs Initiator are different. */
         lpfc_nvme_enable_fb_init(phba, lpfc_nvme_enable_fb);
@@ -6291,7 +6291,6 @@ lpfc_nvme_mod_param_dep(struct lpfc_hba *phba)
                 /* Not NVME Target mode.  Turn off Target parameters. */
                 phba->nvmet_support = 0;
                 phba->cfg_nvmet_mrq = 0;
-                phba->cfg_nvmet_mrq_post = 0;
                 phba->cfg_nvmet_fb_size = 0;
         }
 
diff --git a/drivers/scsi/lpfc/lpfc_crtn.h b/drivers/scsi/lpfc/lpfc_crtn.h
index 944b32ca4931..8912767e7bc8 100644
--- a/drivers/scsi/lpfc/lpfc_crtn.h
+++ b/drivers/scsi/lpfc/lpfc_crtn.h
@@ -75,6 +75,10 @@ void lpfc_init_vpi_cmpl(struct lpfc_hba *, LPFC_MBOXQ_t *);
 void lpfc_cancel_all_vport_retry_delay_timer(struct lpfc_hba *);
 void lpfc_retry_pport_discovery(struct lpfc_hba *);
 void lpfc_release_rpi(struct lpfc_hba *, struct lpfc_vport *, uint16_t);
+int lpfc_init_iocb_list(struct lpfc_hba *phba, int cnt);
+void lpfc_free_iocb_list(struct lpfc_hba *phba);
+int lpfc_post_rq_buffer(struct lpfc_hba *phba, struct lpfc_queue *hrq,
+                        struct lpfc_queue *drq, int count, int idx);
 
 void lpfc_mbx_cmpl_local_config_link(struct lpfc_hba *, LPFC_MBOXQ_t *);
 void lpfc_mbx_cmpl_reg_login(struct lpfc_hba *, LPFC_MBOXQ_t *);
@@ -246,16 +250,14 @@ struct hbq_dmabuf *lpfc_sli4_rb_alloc(struct lpfc_hba *);
 void lpfc_sli4_rb_free(struct lpfc_hba *, struct hbq_dmabuf *);
 struct rqb_dmabuf *lpfc_sli4_nvmet_alloc(struct lpfc_hba *phba);
 void lpfc_sli4_nvmet_free(struct lpfc_hba *phba, struct rqb_dmabuf *dmab);
-void lpfc_nvmet_rq_post(struct lpfc_hba *phba, struct lpfc_nvmet_rcv_ctx *ctxp,
-                        struct lpfc_dmabuf *mp);
+void lpfc_nvmet_ctxbuf_post(struct lpfc_hba *phba,
+                            struct lpfc_nvmet_ctxbuf *ctxp);
 int lpfc_nvmet_rcv_unsol_abort(struct lpfc_vport *vport,
                                struct fc_frame_header *fc_hdr);
 void lpfc_sli4_build_dflt_fcf_record(struct lpfc_hba *, struct fcf_record *,
                         uint16_t);
 int lpfc_sli4_rq_put(struct lpfc_queue *hq, struct lpfc_queue *dq,
                      struct lpfc_rqe *hrqe, struct lpfc_rqe *drqe);
-int lpfc_post_rq_buffer(struct lpfc_hba *phba, struct lpfc_queue *hq,
-                        struct lpfc_queue *dq, int count);
 int lpfc_free_rq_buffer(struct lpfc_hba *phba, struct lpfc_queue *hq);
 void lpfc_unregister_fcf(struct lpfc_hba *);
 void lpfc_unregister_fcf_rescan(struct lpfc_hba *);
@@ -271,6 +273,7 @@ int lpfc_sli4_fcf_rr_next_proc(struct lpfc_vport *, uint16_t);
 void lpfc_sli4_clear_fcf_rr_bmask(struct lpfc_hba *);
 
 int lpfc_mem_alloc(struct lpfc_hba *, int align);
+int lpfc_nvmet_mem_alloc(struct lpfc_hba *phba);
 int lpfc_mem_alloc_active_rrq_pool_s4(struct lpfc_hba *);
 void lpfc_mem_free(struct lpfc_hba *);
 void lpfc_mem_free_all(struct lpfc_hba *);
@@ -294,6 +297,7 @@ int lpfc_selective_reset(struct lpfc_hba *);
 void lpfc_reset_barrier(struct lpfc_hba *);
 int lpfc_sli_brdready(struct lpfc_hba *, uint32_t);
 int lpfc_sli_brdkill(struct lpfc_hba *);
+int lpfc_sli_chipset_init(struct lpfc_hba *phba);
 int lpfc_sli_brdreset(struct lpfc_hba *);
 int lpfc_sli_brdrestart(struct lpfc_hba *);
 int lpfc_sli_hba_setup(struct lpfc_hba *);
diff --git a/drivers/scsi/lpfc/lpfc_ct.c b/drivers/scsi/lpfc/lpfc_ct.c
index 1487406aea77..f2cd19c6c2df 100644
--- a/drivers/scsi/lpfc/lpfc_ct.c
+++ b/drivers/scsi/lpfc/lpfc_ct.c
@@ -630,7 +630,7 @@ lpfc_ns_rsp(struct lpfc_vport *vport, struct lpfc_dmabuf *mp, uint8_t fc4_type,
                                                 NLP_EVT_DEVICE_RECOVERY);
                         spin_lock_irq(shost->host_lock);
                         ndlp->nlp_flag &= ~NLP_NVMET_RECOV;
-                        spin_lock_irq(shost->host_lock);
+                        spin_unlock_irq(shost->host_lock);
                 }
         }
 
@@ -2092,6 +2092,7 @@ lpfc_fdmi_port_attr_fc4type(struct lpfc_vport *vport,
 
         ae->un.AttrTypes[3] = 0x02; /* Type 1 - ELS */
         ae->un.AttrTypes[2] = 0x01; /* Type 8 - FCP */
+        ae->un.AttrTypes[6] = 0x01; /* Type 40 - NVME */
         ae->un.AttrTypes[7] = 0x01; /* Type 32 - CT */
         size = FOURBYTES + 32;
         ad->AttrLen = cpu_to_be16(size);
diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c
index fce549a91911..4bcb92c844ca 100644
--- a/drivers/scsi/lpfc/lpfc_debugfs.c
+++ b/drivers/scsi/lpfc/lpfc_debugfs.c
@@ -798,21 +798,22 @@ lpfc_debugfs_nvmestat_data(struct lpfc_vport *vport, char *buf, int size)
                                 atomic_read(&tgtp->xmt_fcp_rsp));
 
                 len += snprintf(buf + len, size - len,
-                                "FCP Rsp: abort %08x drop %08x\n",
-                                atomic_read(&tgtp->xmt_fcp_abort),
-                                atomic_read(&tgtp->xmt_fcp_drop));
-
-                len += snprintf(buf + len, size - len,
                                 "FCP Rsp Cmpl: %08x err %08x drop %08x\n",
                                 atomic_read(&tgtp->xmt_fcp_rsp_cmpl),
                                 atomic_read(&tgtp->xmt_fcp_rsp_error),
                                 atomic_read(&tgtp->xmt_fcp_rsp_drop));
 
                 len += snprintf(buf + len, size - len,
-                                "ABORT: Xmt %08x Err %08x Cmpl %08x",
+                                "ABORT: Xmt %08x Cmpl %08x\n",
+                                atomic_read(&tgtp->xmt_fcp_abort),
+                                atomic_read(&tgtp->xmt_fcp_abort_cmpl));
+
+                len += snprintf(buf + len, size - len,
+                                "ABORT: Sol %08x  Usol %08x Err %08x Cmpl %08x",
+                                atomic_read(&tgtp->xmt_abort_sol),
+                                atomic_read(&tgtp->xmt_abort_unsol),
                                 atomic_read(&tgtp->xmt_abort_rsp),
-                                atomic_read(&tgtp->xmt_abort_rsp_error),
-                                atomic_read(&tgtp->xmt_abort_cmpl));
+                                atomic_read(&tgtp->xmt_abort_rsp_error));
 
                 len +=  snprintf(buf + len, size - len, "\n");
 
@@ -841,6 +842,12 @@ lpfc_debugfs_nvmestat_data(struct lpfc_vport *vport, char *buf, int size)
                         }
                         spin_unlock(&phba->sli4_hba.abts_nvme_buf_list_lock);
                 }
+
+                len += snprintf(buf + len, size - len,
+                                "IO_CTX: %08x  outstanding %08x total %08x\n",
+                                phba->sli4_hba.nvmet_ctx_cnt,
+                                phba->sli4_hba.nvmet_io_wait_cnt,
+                                phba->sli4_hba.nvmet_io_wait_total);
         } else {
                 if (!(phba->cfg_enable_fc4_type & LPFC_ENABLE_NVME))
                         return len;
@@ -1959,6 +1966,7 @@ lpfc_debugfs_nvmestat_write(struct file *file, const char __user *buf,
                 atomic_set(&tgtp->rcv_ls_req_out, 0);
                 atomic_set(&tgtp->rcv_ls_req_drop, 0);
                 atomic_set(&tgtp->xmt_ls_abort, 0);
+                atomic_set(&tgtp->xmt_ls_abort_cmpl, 0);
                 atomic_set(&tgtp->xmt_ls_rsp, 0);
                 atomic_set(&tgtp->xmt_ls_drop, 0);
                 atomic_set(&tgtp->xmt_ls_rsp_error, 0);
@@ -1967,19 +1975,22 @@ lpfc_debugfs_nvmestat_write(struct file *file, const char __user *buf,
                 atomic_set(&tgtp->rcv_fcp_cmd_in, 0);
                 atomic_set(&tgtp->rcv_fcp_cmd_out, 0);
                 atomic_set(&tgtp->rcv_fcp_cmd_drop, 0);
-                atomic_set(&tgtp->xmt_fcp_abort, 0);
                 atomic_set(&tgtp->xmt_fcp_drop, 0);
                 atomic_set(&tgtp->xmt_fcp_read_rsp, 0);
                 atomic_set(&tgtp->xmt_fcp_read, 0);
                 atomic_set(&tgtp->xmt_fcp_write, 0);
                 atomic_set(&tgtp->xmt_fcp_rsp, 0);
+                atomic_set(&tgtp->xmt_fcp_release, 0);
                 atomic_set(&tgtp->xmt_fcp_rsp_cmpl, 0);
                 atomic_set(&tgtp->xmt_fcp_rsp_error, 0);
                 atomic_set(&tgtp->xmt_fcp_rsp_drop, 0);
 
+                atomic_set(&tgtp->xmt_fcp_abort, 0);
+                atomic_set(&tgtp->xmt_fcp_abort_cmpl, 0);
+                atomic_set(&tgtp->xmt_abort_sol, 0);
+                atomic_set(&tgtp->xmt_abort_unsol, 0);
                 atomic_set(&tgtp->xmt_abort_rsp, 0);
                 atomic_set(&tgtp->xmt_abort_rsp_error, 0);
-                atomic_set(&tgtp->xmt_abort_cmpl, 0);
         }
         return nbytes;
 }
@@ -3070,11 +3081,11 @@ __lpfc_idiag_print_wq(struct lpfc_queue *qp, char *wqtype,
                         qp->assoc_qid, qp->q_cnt_1,
                         (unsigned long long)qp->q_cnt_4);
         len += snprintf(pbuffer + len, LPFC_QUE_INFO_GET_BUF_SIZE - len,
-                        "\t\tWQID[%02d], QE-CNT[%04d], QE-SIZE[%04d], "
-                        "HOST-IDX[%04d], PORT-IDX[%04d]",
+                        "\t\tWQID[%02d], QE-CNT[%04d], QE-SZ[%04d], "
+                        "HST-IDX[%04d], PRT-IDX[%04d], PST[%03d]",
                         qp->queue_id, qp->entry_count,
                         qp->entry_size, qp->host_index,
-                        qp->hba_index);
+                        qp->hba_index, qp->entry_repost);
         len +=  snprintf(pbuffer + len,
                         LPFC_QUE_INFO_GET_BUF_SIZE - len, "\n");
         return len;
@@ -3121,11 +3132,11 @@ __lpfc_idiag_print_cq(struct lpfc_queue *qp, char *cqtype,
                         qp->assoc_qid, qp->q_cnt_1, qp->q_cnt_2,
                         qp->q_cnt_3, (unsigned long long)qp->q_cnt_4);
         len += snprintf(pbuffer + len, LPFC_QUE_INFO_GET_BUF_SIZE - len,
-                        "\tCQID[%02d], QE-CNT[%04d], QE-SIZE[%04d], "
-                        "HOST-IDX[%04d], PORT-IDX[%04d]",
+                        "\tCQID[%02d], QE-CNT[%04d], QE-SZ[%04d], "
+                        "HST-IDX[%04d], PRT-IDX[%04d], PST[%03d]",
                         qp->queue_id, qp->entry_count,
                         qp->entry_size, qp->host_index,
-                        qp->hba_index);
+                        qp->hba_index, qp->entry_repost);
 
         len +=  snprintf(pbuffer + len, LPFC_QUE_INFO_GET_BUF_SIZE - len, "\n");
 
@@ -3143,20 +3154,20 @@ __lpfc_idiag_print_rqpair(struct lpfc_queue *qp, struct lpfc_queue *datqp,
                         "\t\t%s RQ info: ", rqtype);
         len += snprintf(pbuffer + len, LPFC_QUE_INFO_GET_BUF_SIZE - len,
                         "AssocCQID[%02d]: RQ-STAT[nopost:x%x nobuf:x%x "
-                        "trunc:x%x rcv:x%llx]\n",
+                        "posted:x%x rcv:x%llx]\n",
                         qp->assoc_qid, qp->q_cnt_1, qp->q_cnt_2,
                         qp->q_cnt_3, (unsigned long long)qp->q_cnt_4);
         len += snprintf(pbuffer + len, LPFC_QUE_INFO_GET_BUF_SIZE - len,
-                        "\t\tHQID[%02d], QE-CNT[%04d], QE-SIZE[%04d], "
-                        "HOST-IDX[%04d], PORT-IDX[%04d]\n",
+                        "\t\tHQID[%02d], QE-CNT[%04d], QE-SZ[%04d], "
+                        "HST-IDX[%04d], PRT-IDX[%04d], PST[%03d]\n",
                         qp->queue_id, qp->entry_count, qp->entry_size,
-                        qp->host_index, qp->hba_index);
+                        qp->host_index, qp->hba_index, qp->entry_repost);
         len += snprintf(pbuffer + len, LPFC_QUE_INFO_GET_BUF_SIZE - len,
-                        "\t\tDQID[%02d], QE-CNT[%04d], QE-SIZE[%04d], "
-                        "HOST-IDX[%04d], PORT-IDX[%04d]\n",
+                        "\t\tDQID[%02d], QE-CNT[%04d], QE-SZ[%04d], "
+                        "HST-IDX[%04d], PRT-IDX[%04d], PST[%03d]\n",
                         datqp->queue_id, datqp->entry_count,
                         datqp->entry_size, datqp->host_index,
-                        datqp->hba_index);
+                        datqp->hba_index, datqp->entry_repost);
         return len;
 }
 
@@ -3242,10 +3253,10 @@ __lpfc_idiag_print_eq(struct lpfc_queue *qp, char *eqtype,
                         eqtype, qp->q_cnt_1, qp->q_cnt_2, qp->q_cnt_3,
                         (unsigned long long)qp->q_cnt_4);
         len += snprintf(pbuffer + len, LPFC_QUE_INFO_GET_BUF_SIZE - len,
-                        "EQID[%02d], QE-CNT[%04d], QE-SIZE[%04d], "
-                        "HOST-IDX[%04d], PORT-IDX[%04d]",
+                        "EQID[%02d], QE-CNT[%04d], QE-SZ[%04d], "
+                        "HST-IDX[%04d], PRT-IDX[%04d], PST[%03d]",
                         qp->queue_id, qp->entry_count, qp->entry_size,
-                        qp->host_index, qp->hba_index);
+                        qp->host_index, qp->hba_index, qp->entry_repost);
         len +=  snprintf(pbuffer + len, LPFC_QUE_INFO_GET_BUF_SIZE - len, "\n");
 
         return len;
@@ -5855,8 +5866,10 @@ lpfc_debugfs_terminate(struct lpfc_vport *vport)
                         atomic_dec(&lpfc_debugfs_hba_count);
                 }
 
-                debugfs_remove(lpfc_debugfs_root); /* lpfc */
-                lpfc_debugfs_root = NULL;
+                if (atomic_read(&lpfc_debugfs_hba_count) == 0) {
+                        debugfs_remove(lpfc_debugfs_root); /* lpfc */
+                        lpfc_debugfs_root = NULL;
+                }
         }
 #endif
         return;
diff --git a/drivers/scsi/lpfc/lpfc_disc.h b/drivers/scsi/lpfc/lpfc_disc.h
index 9d5a379f4b15..094c97b9e5f7 100644
--- a/drivers/scsi/lpfc/lpfc_disc.h
+++ b/drivers/scsi/lpfc/lpfc_disc.h
@@ -90,6 +90,7 @@ struct lpfc_nodelist {
 #define NLP_FCP_INITIATOR  0x10                 /* entry is an FCP Initiator */
 #define NLP_NVME_TARGET    0x20                 /* entry is a NVME Target */
 #define NLP_NVME_INITIATOR 0x40                 /* entry is a NVME Initiator */
+#define NLP_NVME_DISCOVERY 0x80                 /* entry has NVME disc srvc */
 
         uint16_t        nlp_fc4_type;           /* FC types node supports. */
                                                 /* Assigned from GID_FF, only
diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c
index 67827e397431..8e532b39ae93 100644
--- a/drivers/scsi/lpfc/lpfc_els.c
+++ b/drivers/scsi/lpfc/lpfc_els.c
@@ -1047,6 +1047,13 @@ stop_rr_fcf_flogi:
                                  irsp->ulpStatus, irsp->un.ulpWord[4],
                                  irsp->ulpTimeout);
 
+
+                /* If this is not a loop open failure, bail out */
+                if (!(irsp->ulpStatus == IOSTAT_LOCAL_REJECT &&
+                      ((irsp->un.ulpWord[4] & IOERR_PARAM_MASK) ==
+                                        IOERR_LOOP_OPEN_FAILURE)))
+                        goto flogifail;
+
                 /* FLOGI failed, so there is no fabric */
                 spin_lock_irq(shost->host_lock);
                 vport->fc_flag &= ~(FC_FABRIC | FC_PUBLIC_LOOP);
@@ -2077,16 +2084,19 @@ lpfc_cmpl_els_prli(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,
 
         if (irsp->ulpStatus) {
                 /* Check for retry */
+                ndlp->fc4_prli_sent--;
                 if (lpfc_els_retry(phba, cmdiocb, rspiocb)) {
                         /* ELS command is being retried */
-                        ndlp->fc4_prli_sent--;
                         goto out;
                 }
+
                 /* PRLI failed */
                 lpfc_printf_vlog(vport, KERN_ERR, LOG_ELS,
-                                 "2754 PRLI failure DID:%06X Status:x%x/x%x\n",
+                                 "2754 PRLI failure DID:%06X Status:x%x/x%x, "
+                                 "data: x%x\n",
                                  ndlp->nlp_DID, irsp->ulpStatus,
-                                 irsp->un.ulpWord[4]);
+                                 irsp->un.ulpWord[4], ndlp->fc4_prli_sent);
+
                 /* Do not call DSM for lpfc_els_abort'ed ELS cmds */
                 if (lpfc_error_lost_link(irsp))
                         goto out;
@@ -7441,6 +7451,13 @@ lpfc_els_flush_cmd(struct lpfc_vport *vport)
          */
         spin_lock_irq(&phba->hbalock);
         pring = lpfc_phba_elsring(phba);
+
+        /* Bail out if we've no ELS wq, like in PCI error recovery case. */
+        if (unlikely(!pring)) {
+                spin_unlock_irq(&phba->hbalock);
+                return;
+        }
+
         if (phba->sli_rev == LPFC_SLI_REV4)
                 spin_lock(&pring->ring_lock);
 
@@ -8667,7 +8684,8 @@ lpfc_cmpl_els_fdisc(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,
                 lpfc_do_scr_ns_plogi(phba, vport);
         goto out;
 fdisc_failed:
-        if (vport->fc_vport->vport_state != FC_VPORT_NO_FABRIC_RSCS)
+        if (vport->fc_vport &&
+            (vport->fc_vport->vport_state != FC_VPORT_NO_FABRIC_RSCS))
                 lpfc_vport_set_state(vport, FC_VPORT_FAILED);
         /* Cancel discovery timer */
         lpfc_can_disctmo(vport);
diff --git a/drivers/scsi/lpfc/lpfc_hbadisc.c b/drivers/scsi/lpfc/lpfc_hbadisc.c
index 0482c5580331..3ffcd9215ca8 100644
--- a/drivers/scsi/lpfc/lpfc_hbadisc.c
+++ b/drivers/scsi/lpfc/lpfc_hbadisc.c
@@ -693,15 +693,16 @@ lpfc_work_done(struct lpfc_hba *phba)
         pring = lpfc_phba_elsring(phba);
         status = (ha_copy & (HA_RXMASK  << (4*LPFC_ELS_RING)));
         status >>= (4*LPFC_ELS_RING);
-        if ((status & HA_RXMASK) ||
-            (pring->flag & LPFC_DEFERRED_RING_EVENT) ||
-            (phba->hba_flag & HBA_SP_QUEUE_EVT)) {
+        if (pring && (status & HA_RXMASK ||
+                      pring->flag & LPFC_DEFERRED_RING_EVENT ||
+                      phba->hba_flag & HBA_SP_QUEUE_EVT)) {
                 if (pring->flag & LPFC_STOP_IOCB_EVENT) {
                         pring->flag |= LPFC_DEFERRED_RING_EVENT;
                         /* Set the lpfc data pending flag */
                         set_bit(LPFC_DATA_READY, &phba->data_flags);
                 } else {
-                        if (phba->link_state >= LPFC_LINK_UP) {
+                        if (phba->link_state >= LPFC_LINK_UP ||
+                            phba->link_flag & LS_MDS_LOOPBACK) {
                                 pring->flag &= ~LPFC_DEFERRED_RING_EVENT;
                                 lpfc_sli_handle_slow_ring_event(phba, pring,
                                                                 (status &
diff --git a/drivers/scsi/lpfc/lpfc_hw4.h b/drivers/scsi/lpfc/lpfc_hw4.h
index 1d12f2be36bc..e0a5fce416ae 100644
--- a/drivers/scsi/lpfc/lpfc_hw4.h
+++ b/drivers/scsi/lpfc/lpfc_hw4.h
@@ -1356,6 +1356,7 @@ struct lpfc_mbx_wq_destroy {
 
 #define LPFC_HDR_BUF_SIZE 128
 #define LPFC_DATA_BUF_SIZE 2048
+#define LPFC_NVMET_DATA_BUF_SIZE 128
 struct rq_context {
         uint32_t word0;
 #define lpfc_rq_context_rqe_count_SHIFT 16      /* Version 0 Only */
@@ -4420,6 +4421,19 @@ struct fcp_treceive64_wqe {
 };
 #define TXRDY_PAYLOAD_LEN      12
 
+#define CMD_SEND_FRAME  0xE1
+
+struct send_frame_wqe {
+        struct ulp_bde64 bde;          /* words 0-2 */
+        uint32_t frame_len;            /* word 3 */
+        uint32_t fc_hdr_wd0;           /* word 4 */
+        uint32_t fc_hdr_wd1;           /* word 5 */
+        struct wqe_common wqe_com;     /* words 6-11 */
+        uint32_t fc_hdr_wd2;           /* word 12 */
+        uint32_t fc_hdr_wd3;           /* word 13 */
+        uint32_t fc_hdr_wd4;           /* word 14 */
+        uint32_t fc_hdr_wd5;           /* word 15 */
+};
 
 union lpfc_wqe {
         uint32_t words[16];
@@ -4438,7 +4452,7 @@ union lpfc_wqe {
         struct fcp_trsp64_wqe fcp_trsp;
         struct fcp_tsend64_wqe fcp_tsend;
         struct fcp_treceive64_wqe fcp_treceive;
-
+        struct send_frame_wqe send_frame;
 };
 
 union lpfc_wqe128 {
diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
index 90ae354a9c45..9add9473cae5 100644
--- a/drivers/scsi/lpfc/lpfc_init.c
+++ b/drivers/scsi/lpfc/lpfc_init.c
@@ -1099,7 +1099,7 @@ lpfc_hba_down_post_s4(struct lpfc_hba *phba)
 
                 list_for_each_entry_safe(ctxp, ctxp_next, &nvmet_aborts, list) {
                         ctxp->flag &= ~(LPFC_NVMET_XBUSY | LPFC_NVMET_ABORT_OP);
-                        lpfc_nvmet_rq_post(phba, ctxp, &ctxp->rqb_buffer->hbuf);
+                        lpfc_nvmet_ctxbuf_post(phba, ctxp->ctxbuf);
                 }
         }
 
@@ -3381,7 +3381,7 @@ lpfc_sli4_nvmet_sgl_update(struct lpfc_hba *phba)
 {
         struct lpfc_sglq *sglq_entry = NULL, *sglq_entry_next = NULL;
         uint16_t i, lxri, xri_cnt, els_xri_cnt;
-        uint16_t nvmet_xri_cnt, tot_cnt;
+        uint16_t nvmet_xri_cnt;
         LIST_HEAD(nvmet_sgl_list);
         int rc;
 
@@ -3389,15 +3389,9 @@ lpfc_sli4_nvmet_sgl_update(struct lpfc_hba *phba)
          * update on pci function's nvmet xri-sgl list
          */
         els_xri_cnt = lpfc_sli4_get_els_iocb_cnt(phba);
-        nvmet_xri_cnt = phba->cfg_nvmet_mrq * phba->cfg_nvmet_mrq_post;
-        tot_cnt = phba->sli4_hba.max_cfg_param.max_xri - els_xri_cnt;
-        if (nvmet_xri_cnt > tot_cnt) {
-                phba->cfg_nvmet_mrq_post = tot_cnt / phba->cfg_nvmet_mrq;
-                nvmet_xri_cnt = phba->cfg_nvmet_mrq * phba->cfg_nvmet_mrq_post;
-                lpfc_printf_log(phba, KERN_INFO, LOG_SLI,
-                                "6301 NVMET post-sgl count changed to %d\n",
-                                phba->cfg_nvmet_mrq_post);
-        }
+
+        /* For NVMET, ALL remaining XRIs are dedicated for IO processing */
+        nvmet_xri_cnt = phba->sli4_hba.max_cfg_param.max_xri - els_xri_cnt;
 
         if (nvmet_xri_cnt > phba->sli4_hba.nvmet_xri_cnt) {
                 /* els xri-sgl expanded */
@@ -3602,6 +3596,13 @@ lpfc_get_wwpn(struct lpfc_hba *phba)
         LPFC_MBOXQ_t *mboxq;
         MAILBOX_t *mb;
 
+        if (phba->sli_rev < LPFC_SLI_REV4) {
+                /* Reset the port first */
+                lpfc_sli_brdrestart(phba);
+                rc = lpfc_sli_chipset_init(phba);
+                if (rc)
+                        return (uint64_t)-1;
+        }
 
         mboxq = (LPFC_MBOXQ_t *) mempool_alloc(phba->mbox_mem_pool,
                                                 GFP_KERNEL);
@@ -4539,6 +4540,19 @@ lpfc_sli4_async_fc_evt(struct lpfc_hba *phba, struct lpfc_acqe_fc_la *acqe_fc)
         pmb->vport = phba->pport;
 
         if (phba->sli4_hba.link_state.status != LPFC_FC_LA_TYPE_LINK_UP) {
+                phba->link_flag &= ~(LS_MDS_LINK_DOWN | LS_MDS_LOOPBACK);
+
+                switch (phba->sli4_hba.link_state.status) {
+                case LPFC_FC_LA_TYPE_MDS_LINK_DOWN:
+                        phba->link_flag |= LS_MDS_LINK_DOWN;
+                        break;
+                case LPFC_FC_LA_TYPE_MDS_LOOPBACK:
+                        phba->link_flag |= LS_MDS_LOOPBACK;
+                        break;
+                default:
+                        break;
+                }
+
                 /* Parse and translate status field */
                 mb = &pmb->u.mb;
                 mb->mbxStatus = lpfc_sli4_parse_latt_fault(phba,
@@ -5823,6 +5837,9 @@ lpfc_sli4_driver_resource_setup(struct lpfc_hba *phba)
                 spin_lock_init(&phba->sli4_hba.abts_nvme_buf_list_lock);
                 INIT_LIST_HEAD(&phba->sli4_hba.lpfc_abts_nvme_buf_list);
                 INIT_LIST_HEAD(&phba->sli4_hba.lpfc_abts_nvmet_ctx_list);
+                INIT_LIST_HEAD(&phba->sli4_hba.lpfc_nvmet_ctx_list);
+                INIT_LIST_HEAD(&phba->sli4_hba.lpfc_nvmet_io_wait_list);
+
                 /* Fast-path XRI aborted CQ Event work queue list */
                 INIT_LIST_HEAD(&phba->sli4_hba.sp_nvme_xri_aborted_work_queue);
         }
@@ -5830,6 +5847,7 @@ lpfc_sli4_driver_resource_setup(struct lpfc_hba *phba)
         /* This abort list used by worker thread */
         spin_lock_init(&phba->sli4_hba.sgl_list_lock);
         spin_lock_init(&phba->sli4_hba.nvmet_io_lock);
+        spin_lock_init(&phba->sli4_hba.nvmet_io_wait_lock);
 
         /*
          * Initialize driver internal slow-path work queues
@@ -5944,16 +5962,21 @@ lpfc_sli4_driver_resource_setup(struct lpfc_hba *phba)
                 for (i = 0; i < lpfc_enable_nvmet_cnt; i++) {
                         if (wwn == lpfc_enable_nvmet[i]) {
 #if (IS_ENABLED(CONFIG_NVME_TARGET_FC))
+                                if (lpfc_nvmet_mem_alloc(phba))
+                                        break;
+
+                                phba->nvmet_support = 1; /* a match */
+
                                 lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
                                                 "6017 NVME Target %016llx\n",
                                                 wwn);
-                                phba->nvmet_support = 1; /* a match */
 #else
                                 lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
                                                 "6021 Can't enable NVME Target."
                                                 " NVME_TARGET_FC infrastructure"
                                                 " is not in kernel\n");
 #endif
+                                break;
                         }
                 }
         }
@@ -6262,7 +6285,7 @@ lpfc_unset_driver_resource_phase2(struct lpfc_hba *phba)
  *
  * This routine is invoked to free the driver's IOCB list and memory.
  **/
-static void
+void
 lpfc_free_iocb_list(struct lpfc_hba *phba)
 {
         struct lpfc_iocbq *iocbq_entry = NULL, *iocbq_next = NULL;
@@ -6290,7 +6313,7 @@ lpfc_free_iocb_list(struct lpfc_hba *phba)
  *      0 - successful
  *      other values - error
  **/
-static int
+int
 lpfc_init_iocb_list(struct lpfc_hba *phba, int iocb_count)
 {
         struct lpfc_iocbq *iocbq_entry = NULL;
@@ -6518,7 +6541,6 @@ lpfc_sli4_create_rpi_hdr(struct lpfc_hba *phba)
         uint16_t rpi_limit, curr_rpi_range;
         struct lpfc_dmabuf *dmabuf;
         struct lpfc_rpi_hdr *rpi_hdr;
-        uint32_t rpi_count;
 
         /*
          * If the SLI4 port supports extents, posting the rpi header isn't
@@ -6531,8 +6553,7 @@ lpfc_sli4_create_rpi_hdr(struct lpfc_hba *phba)
                 return NULL;
 
         /* The limit on the logical index is just the max_rpi count. */
-        rpi_limit = phba->sli4_hba.max_cfg_param.rpi_base +
-        phba->sli4_hba.max_cfg_param.max_rpi - 1;
+        rpi_limit = phba->sli4_hba.max_cfg_param.max_rpi;
 
         spin_lock_irq(&phba->hbalock);
         /*
@@ -6543,18 +6564,10 @@ lpfc_sli4_create_rpi_hdr(struct lpfc_hba *phba)
         curr_rpi_range = phba->sli4_hba.next_rpi;
         spin_unlock_irq(&phba->hbalock);
 
-        /*
-         * The port has a limited number of rpis. The increment here
-         * is LPFC_RPI_HDR_COUNT - 1 to account for the starting value
-         * and to allow the full max_rpi range per port.
-         */
-        if ((curr_rpi_range + (LPFC_RPI_HDR_COUNT - 1)) > rpi_limit)
-                rpi_count = rpi_limit - curr_rpi_range;
-        else
-                rpi_count = LPFC_RPI_HDR_COUNT;
-
-        if (!rpi_count)
+        /* Reached full RPI range */
+        if (curr_rpi_range == rpi_limit)
                 return NULL;
+
         /*
          * First allocate the protocol header region for the port.  The
          * port expects a 4KB DMA-mapped memory region that is 4K aligned.
@@ -6588,13 +6601,9 @@ lpfc_sli4_create_rpi_hdr(struct lpfc_hba *phba)
 
         /* The rpi_hdr stores the logical index only. */
         rpi_hdr->start_rpi = curr_rpi_range;
+        rpi_hdr->next_rpi = phba->sli4_hba.next_rpi + LPFC_RPI_HDR_COUNT;
         list_add_tail(&rpi_hdr->list, &phba->sli4_hba.lpfc_rpi_hdr_list);
 
-        /*
-         * The next_rpi stores the next logical module-64 rpi value used
-         * to post physical rpis in subsequent rpi postings.
-         */
-        phba->sli4_hba.next_rpi += rpi_count;
         spin_unlock_irq(&phba->hbalock);
         return rpi_hdr;
 
@@ -8165,7 +8174,7 @@ lpfc_sli4_queue_create(struct lpfc_hba *phba)
                         /* Create NVMET Receive Queue for header */
                         qdesc = lpfc_sli4_queue_alloc(phba,
                                                       phba->sli4_hba.rq_esize,
-                                                      phba->sli4_hba.rq_ecount);
+                                                      LPFC_NVMET_RQE_DEF_COUNT);
                         if (!qdesc) {
                                 lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
                                                 "3146 Failed allocate "
@@ -8187,7 +8196,7 @@ lpfc_sli4_queue_create(struct lpfc_hba *phba)
                         /* Create NVMET Receive Queue for data */
                         qdesc = lpfc_sli4_queue_alloc(phba,
                                                       phba->sli4_hba.rq_esize,
-                                                      phba->sli4_hba.rq_ecount);
+                                                      LPFC_NVMET_RQE_DEF_COUNT);
                         if (!qdesc) {
                                 lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
                                                 "3156 Failed allocate "
@@ -8319,46 +8328,6 @@ lpfc_sli4_queue_destroy(struct lpfc_hba *phba)
 }
 
 int
-lpfc_post_rq_buffer(struct lpfc_hba *phba, struct lpfc_queue *hrq,
-                    struct lpfc_queue *drq, int count)
-{
-        int rc, i;
-        struct lpfc_rqe hrqe;
-        struct lpfc_rqe drqe;
-        struct lpfc_rqb *rqbp;
-        struct rqb_dmabuf *rqb_buffer;
-        LIST_HEAD(rqb_buf_list);
-
-        rqbp = hrq->rqbp;
-        for (i = 0; i < count; i++) {
-                rqb_buffer = (rqbp->rqb_alloc_buffer)(phba);
-                if (!rqb_buffer)
-                        break;
-                rqb_buffer->hrq = hrq;
-                rqb_buffer->drq = drq;
-                list_add_tail(&rqb_buffer->hbuf.list, &rqb_buf_list);
-        }
-        while (!list_empty(&rqb_buf_list)) {
-                list_remove_head(&rqb_buf_list, rqb_buffer, struct rqb_dmabuf,
-                                 hbuf.list);
-
-                hrqe.address_lo = putPaddrLow(rqb_buffer->hbuf.phys);
-                hrqe.address_hi = putPaddrHigh(rqb_buffer->hbuf.phys);
-                drqe.address_lo = putPaddrLow(rqb_buffer->dbuf.phys);
-                drqe.address_hi = putPaddrHigh(rqb_buffer->dbuf.phys);
-                rc = lpfc_sli4_rq_put(hrq, drq, &hrqe, &drqe);
-                if (rc < 0) {
-                        (rqbp->rqb_free_buffer)(phba, rqb_buffer);
-                } else {
-                        list_add_tail(&rqb_buffer->hbuf.list,
-                                      &rqbp->rqb_buffer_list);
-                        rqbp->buffer_count++;
-                }
-        }
-        return 1;
-}
-
-int
 lpfc_free_rq_buffer(struct lpfc_hba *phba, struct lpfc_queue *rq)
 {
         struct lpfc_rqb *rqbp;
@@ -8777,9 +8746,6 @@ lpfc_sli4_queue_setup(struct lpfc_hba *phba)
                 goto out_destroy;
         }
 
-        lpfc_rq_adjust_repost(phba, phba->sli4_hba.hdr_rq, LPFC_ELS_HBQ);
-        lpfc_rq_adjust_repost(phba, phba->sli4_hba.dat_rq, LPFC_ELS_HBQ);
-
         rc = lpfc_rq_create(phba, phba->sli4_hba.hdr_rq, phba->sli4_hba.dat_rq,
                             phba->sli4_hba.els_cq, LPFC_USOL);
         if (rc) {
@@ -8847,7 +8813,7 @@ lpfc_sli4_queue_unset(struct lpfc_hba *phba)
                 lpfc_wq_destroy(phba, phba->sli4_hba.nvmels_wq);
 
         /* Unset ELS work queue */
-        if (phba->sli4_hba.els_cq)
+        if (phba->sli4_hba.els_wq)
                 lpfc_wq_destroy(phba, phba->sli4_hba.els_wq);
 
         /* Unset unsolicited receive queue */
@@ -11103,7 +11069,7 @@ lpfc_pci_probe_one_s4(struct pci_dev *pdev, const struct pci_device_id *pid)
         struct lpfc_hba   *phba;
         struct lpfc_vport *vport = NULL;
         struct Scsi_Host  *shost = NULL;
-        int error, cnt;
+        int error;
         uint32_t cfg_mode, intr_mode;
 
         /* Allocate memory for HBA structure */
@@ -11137,22 +11103,6 @@ lpfc_pci_probe_one_s4(struct pci_dev *pdev, const struct pci_device_id *pid)
                 goto out_unset_pci_mem_s4;
         }
 
-        cnt = phba->cfg_iocb_cnt * 1024;
-        if (phba->nvmet_support)
-                cnt += phba->cfg_nvmet_mrq_post * phba->cfg_nvmet_mrq;
-
-        /* Initialize and populate the iocb list per host */
-        lpfc_printf_log(phba, KERN_INFO, LOG_INIT,
-                        "2821 initialize iocb list %d total %d\n",
-                        phba->cfg_iocb_cnt, cnt);
-        error = lpfc_init_iocb_list(phba, cnt);
-
-        if (error) {
-                lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
-                                "1413 Failed to initialize iocb list.\n");
-                goto out_unset_driver_resource_s4;
-        }
-
         INIT_LIST_HEAD(&phba->active_rrq_list);
         INIT_LIST_HEAD(&phba->fcf.fcf_pri_list);
 
@@ -11161,7 +11111,7 @@ lpfc_pci_probe_one_s4(struct pci_dev *pdev, const struct pci_device_id *pid)
         if (error) {
                 lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
                                 "1414 Failed to set up driver resource.\n");
-                goto out_free_iocb_list;
+                goto out_unset_driver_resource_s4;
         }
 
         /* Get the default values for Model Name and Description */
@@ -11261,8 +11211,6 @@ out_destroy_shost:
         lpfc_destroy_shost(phba);
 out_unset_driver_resource:
         lpfc_unset_driver_resource_phase2(phba);
-out_free_iocb_list:
-        lpfc_free_iocb_list(phba);
 out_unset_driver_resource_s4:
         lpfc_sli4_driver_resource_unset(phba);
 out_unset_pci_mem_s4:
diff --git a/drivers/scsi/lpfc/lpfc_mem.c b/drivers/scsi/lpfc/lpfc_mem.c
index 5986c7957199..fcc05a1517c2 100644
--- a/drivers/scsi/lpfc/lpfc_mem.c
+++ b/drivers/scsi/lpfc/lpfc_mem.c
@@ -214,6 +214,21 @@ fail_free_drb_pool:
         return -ENOMEM;
 }
 
+int
+lpfc_nvmet_mem_alloc(struct lpfc_hba *phba)
+{
+        phba->lpfc_nvmet_drb_pool =
+                pci_pool_create("lpfc_nvmet_drb_pool",
+                                phba->pcidev, LPFC_NVMET_DATA_BUF_SIZE,
+                                SGL_ALIGN_SZ, 0);
+        if (!phba->lpfc_nvmet_drb_pool) {
+                lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
+                                "6024 Can't enable NVME Target - no memory\n");
+                return -ENOMEM;
+        }
+        return 0;
+}
+
 /**
  * lpfc_mem_free - Frees memory allocated by lpfc_mem_alloc
  * @phba: HBA to free memory for
@@ -232,6 +247,9 @@ lpfc_mem_free(struct lpfc_hba *phba)
 
         /* Free HBQ pools */
         lpfc_sli_hbqbuf_free_all(phba);
+        if (phba->lpfc_nvmet_drb_pool)
+                pci_pool_destroy(phba->lpfc_nvmet_drb_pool);
+        phba->lpfc_nvmet_drb_pool = NULL;
         if (phba->lpfc_drb_pool)
                 pci_pool_destroy(phba->lpfc_drb_pool);
         phba->lpfc_drb_pool = NULL;
@@ -611,8 +629,6 @@ struct rqb_dmabuf *
 lpfc_sli4_nvmet_alloc(struct lpfc_hba *phba)
 {
         struct rqb_dmabuf *dma_buf;
-        struct lpfc_iocbq *nvmewqe;
-        union lpfc_wqe128 *wqe;
 
         dma_buf = kzalloc(sizeof(struct rqb_dmabuf), GFP_KERNEL);
         if (!dma_buf)
@@ -624,69 +640,15 @@ lpfc_sli4_nvmet_alloc(struct lpfc_hba *phba)
                 kfree(dma_buf);
                 return NULL;
         }
-        dma_buf->dbuf.virt = pci_pool_alloc(phba->lpfc_drb_pool, GFP_KERNEL,
-                                            &dma_buf->dbuf.phys);
+        dma_buf->dbuf.virt = pci_pool_alloc(phba->lpfc_nvmet_drb_pool,
+                                            GFP_KERNEL, &dma_buf->dbuf.phys);
         if (!dma_buf->dbuf.virt) {
                 pci_pool_free(phba->lpfc_hrb_pool, dma_buf->hbuf.virt,
                               dma_buf->hbuf.phys);
                 kfree(dma_buf);
                 return NULL;
         }
-        dma_buf->total_size = LPFC_DATA_BUF_SIZE;
-
-        dma_buf->context = kzalloc(sizeof(struct lpfc_nvmet_rcv_ctx),
-                                   GFP_KERNEL);
-        if (!dma_buf->context) {
-                pci_pool_free(phba->lpfc_drb_pool, dma_buf->dbuf.virt,
-                              dma_buf->dbuf.phys);
-                pci_pool_free(phba->lpfc_hrb_pool, dma_buf->hbuf.virt,
-                              dma_buf->hbuf.phys);
-                kfree(dma_buf);
-                return NULL;
-        }
-
-        dma_buf->iocbq = lpfc_sli_get_iocbq(phba);
-        if (!dma_buf->iocbq) {
-                kfree(dma_buf->context);
-                pci_pool_free(phba->lpfc_drb_pool, dma_buf->dbuf.virt,
-                              dma_buf->dbuf.phys);
-                pci_pool_free(phba->lpfc_hrb_pool, dma_buf->hbuf.virt,
-                              dma_buf->hbuf.phys);
-                kfree(dma_buf);
-                lpfc_printf_log(phba, KERN_ERR, LOG_NVME,
-                                "2621 Ran out of nvmet iocb/WQEs\n");
-                return NULL;
-        }
-        dma_buf->iocbq->iocb_flag = LPFC_IO_NVMET;
-        nvmewqe = dma_buf->iocbq;
-        wqe = (union lpfc_wqe128 *)&nvmewqe->wqe;
-        /* Initialize WQE */
-        memset(wqe, 0, sizeof(union lpfc_wqe));
-        /* Word 7 */
-        bf_set(wqe_ct, &wqe->generic.wqe_com, SLI4_CT_RPI);
-        bf_set(wqe_class, &wqe->generic.wqe_com, CLASS3);
-        bf_set(wqe_pu, &wqe->generic.wqe_com, 1);
-        /* Word 10 */
-        bf_set(wqe_nvme, &wqe->fcp_tsend.wqe_com, 1);
-        bf_set(wqe_ebde_cnt, &wqe->generic.wqe_com, 0);
-        bf_set(wqe_qosd, &wqe->generic.wqe_com, 0);
-
-        dma_buf->iocbq->context1 = NULL;
-        spin_lock(&phba->sli4_hba.sgl_list_lock);
-        dma_buf->sglq = __lpfc_sli_get_nvmet_sglq(phba, dma_buf->iocbq);
-        spin_unlock(&phba->sli4_hba.sgl_list_lock);
-        if (!dma_buf->sglq) {
-                lpfc_sli_release_iocbq(phba, dma_buf->iocbq);
-                kfree(dma_buf->context);
-                pci_pool_free(phba->lpfc_drb_pool, dma_buf->dbuf.virt,
-                              dma_buf->dbuf.phys);
-                pci_pool_free(phba->lpfc_hrb_pool, dma_buf->hbuf.virt,
-                              dma_buf->hbuf.phys);
-                kfree(dma_buf);
-                lpfc_printf_log(phba, KERN_ERR, LOG_NVME,
-                                "6132 Ran out of nvmet XRIs\n");
-                return NULL;
-        }
+        dma_buf->total_size = LPFC_NVMET_DATA_BUF_SIZE;
         return dma_buf;
 }
 
@@ -705,20 +667,9 @@ lpfc_sli4_nvmet_alloc(struct lpfc_hba *phba)
 void
 lpfc_sli4_nvmet_free(struct lpfc_hba *phba, struct rqb_dmabuf *dmab)
 {
-        unsigned long flags;
-
-        __lpfc_clear_active_sglq(phba, dmab->sglq->sli4_lxritag);
-        dmab->sglq->state = SGL_FREED;
-        dmab->sglq->ndlp = NULL;
-
-        spin_lock_irqsave(&phba->sli4_hba.sgl_list_lock, flags);
-        list_add_tail(&dmab->sglq->list, &phba->sli4_hba.lpfc_nvmet_sgl_list);
-        spin_unlock_irqrestore(&phba->sli4_hba.sgl_list_lock, flags);
-
-        lpfc_sli_release_iocbq(phba, dmab->iocbq);
-        kfree(dmab->context);
         pci_pool_free(phba->lpfc_hrb_pool, dmab->hbuf.virt, dmab->hbuf.phys);
-        pci_pool_free(phba->lpfc_drb_pool, dmab->dbuf.virt, dmab->dbuf.phys);
+        pci_pool_free(phba->lpfc_nvmet_drb_pool,
+                      dmab->dbuf.virt, dmab->dbuf.phys);
         kfree(dmab);
 }
 
@@ -803,6 +754,11 @@ lpfc_rq_buf_free(struct lpfc_hba *phba, struct lpfc_dmabuf *mp)
         rc = lpfc_sli4_rq_put(rqb_entry->hrq, rqb_entry->drq, &hrqe, &drqe);
         if (rc < 0) {
                 (rqbp->rqb_free_buffer)(phba, rqb_entry);
+                lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
+                                "6409 Cannot post to RQ %d: %x %x\n",
+                                rqb_entry->hrq->queue_id,
+                                rqb_entry->hrq->host_index,
+                                rqb_entry->hrq->hba_index);
         } else {
                 list_add_tail(&rqb_entry->hbuf.list, &rqbp->rqb_buffer_list);
                 rqbp->buffer_count++;
diff --git a/drivers/scsi/lpfc/lpfc_nportdisc.c b/drivers/scsi/lpfc/lpfc_nportdisc.c
index 8777c2d5f50d..bff3de053df4 100644
--- a/drivers/scsi/lpfc/lpfc_nportdisc.c
+++ b/drivers/scsi/lpfc/lpfc_nportdisc.c
@@ -1944,7 +1944,13 @@ lpfc_cmpl_prli_prli_issue(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp,
 
                 /* Target driver cannot solicit NVME FB. */
                 if (bf_get_be32(prli_tgt, nvpr)) {
+                        /* Complete the nvme target roles.  The transport
+                         * needs to know if the rport is capable of
+                         * discovery in addition to its role.
+                         */
                         ndlp->nlp_type |= NLP_NVME_TARGET;
+                        if (bf_get_be32(prli_disc, nvpr))
+                                ndlp->nlp_type |= NLP_NVME_DISCOVERY;
                         if ((bf_get_be32(prli_fba, nvpr) == 1) &&
                             (bf_get_be32(prli_fb_sz, nvpr) > 0) &&
                             (phba->cfg_nvme_enable_fb) &&
diff --git a/drivers/scsi/lpfc/lpfc_nvmet.c b/drivers/scsi/lpfc/lpfc_nvmet.c
index 94434e621c33..074a6b5e7763 100644
--- a/drivers/scsi/lpfc/lpfc_nvmet.c
+++ b/drivers/scsi/lpfc/lpfc_nvmet.c
@@ -142,7 +142,7 @@ out:
 }
 
 /**
- * lpfc_nvmet_rq_post - Repost a NVMET RQ DMA buffer and clean up context
+ * lpfc_nvmet_ctxbuf_post - Repost a NVMET RQ DMA buffer and clean up context
  * @phba: HBA buffer is associated with
  * @ctxp: context to clean up
  * @mp: Buffer to free
@@ -155,24 +155,113 @@ out:
  * Returns: None
  **/
 void
-lpfc_nvmet_rq_post(struct lpfc_hba *phba, struct lpfc_nvmet_rcv_ctx *ctxp,
-                   struct lpfc_dmabuf *mp)
+lpfc_nvmet_ctxbuf_post(struct lpfc_hba *phba, struct lpfc_nvmet_ctxbuf *ctx_buf)
 {
-        if (ctxp) {
-                if (ctxp->flag)
-                        lpfc_printf_log(phba, KERN_INFO, LOG_NVME_ABTS,
-                                "6314 rq_post ctx xri x%x flag x%x\n",
-                                ctxp->oxid, ctxp->flag);
-
-                if (ctxp->txrdy) {
-                        pci_pool_free(phba->txrdy_payload_pool, ctxp->txrdy,
-                                      ctxp->txrdy_phys);
-                        ctxp->txrdy = NULL;
-                        ctxp->txrdy_phys = 0;
+#if (IS_ENABLED(CONFIG_NVME_TARGET_FC))
+        struct lpfc_nvmet_rcv_ctx *ctxp = ctx_buf->context;
+        struct lpfc_nvmet_tgtport *tgtp;
+        struct fc_frame_header *fc_hdr;
+        struct rqb_dmabuf *nvmebuf;
+        struct lpfc_dmabuf *hbufp;
+        uint32_t *payload;
+        uint32_t size, oxid, sid, rc;
+        unsigned long iflag;
+
+        if (ctxp->txrdy) {
+                pci_pool_free(phba->txrdy_payload_pool, ctxp->txrdy,
+                              ctxp->txrdy_phys);
+                ctxp->txrdy = NULL;
+                ctxp->txrdy_phys = 0;
+        }
+        ctxp->state = LPFC_NVMET_STE_FREE;
+
+        spin_lock_irqsave(&phba->sli4_hba.nvmet_io_wait_lock, iflag);
+        if (phba->sli4_hba.nvmet_io_wait_cnt) {
+                hbufp = &nvmebuf->hbuf;
+                list_remove_head(&phba->sli4_hba.lpfc_nvmet_io_wait_list,
+                                 nvmebuf, struct rqb_dmabuf,
+                                 hbuf.list);
+                phba->sli4_hba.nvmet_io_wait_cnt--;
+                spin_unlock_irqrestore(&phba->sli4_hba.nvmet_io_wait_lock,
+                                       iflag);
+
+                fc_hdr = (struct fc_frame_header *)(nvmebuf->hbuf.virt);
+                oxid = be16_to_cpu(fc_hdr->fh_ox_id);
+                tgtp = (struct lpfc_nvmet_tgtport *)phba->targetport->private;
+                payload = (uint32_t *)(nvmebuf->dbuf.virt);
+                size = nvmebuf->bytes_recv;
+                sid = sli4_sid_from_fc_hdr(fc_hdr);
+
+                ctxp = (struct lpfc_nvmet_rcv_ctx *)ctx_buf->context;
+                memset(ctxp, 0, sizeof(ctxp->ctx));
+                ctxp->wqeq = NULL;
+                ctxp->txrdy = NULL;
+                ctxp->offset = 0;
+                ctxp->phba = phba;
+                ctxp->size = size;
+                ctxp->oxid = oxid;
+                ctxp->sid = sid;
+                ctxp->state = LPFC_NVMET_STE_RCV;
+                ctxp->entry_cnt = 1;
+                ctxp->flag = 0;
+                ctxp->ctxbuf = ctx_buf;
+                spin_lock_init(&ctxp->ctxlock);
+
+#ifdef CONFIG_SCSI_LPFC_DEBUG_FS
+                if (phba->ktime_on) {
+                        ctxp->ts_cmd_nvme = ktime_get_ns();
+                        ctxp->ts_isr_cmd = ctxp->ts_cmd_nvme;
+                        ctxp->ts_nvme_data = 0;
+                        ctxp->ts_data_wqput = 0;
+                        ctxp->ts_isr_data = 0;
+                        ctxp->ts_data_nvme = 0;
+                        ctxp->ts_nvme_status = 0;
+                        ctxp->ts_status_wqput = 0;
+                        ctxp->ts_isr_status = 0;
+                        ctxp->ts_status_nvme = 0;
                 }
-                ctxp->state = LPFC_NVMET_STE_FREE;
+#endif
+                atomic_inc(&tgtp->rcv_fcp_cmd_in);
+                /*
+                 * The calling sequence should be:
+                 * nvmet_fc_rcv_fcp_req->lpfc_nvmet_xmt_fcp_op/cmp- req->done
+                 * lpfc_nvmet_xmt_fcp_op_cmp should free the allocated ctxp.
+                 * When we return from nvmet_fc_rcv_fcp_req, all relevant info
+                 * the NVME command / FC header is stored.
+                 * A buffer has already been reposted for this IO, so just free
+                 * the nvmebuf.
+                 */
+                rc = nvmet_fc_rcv_fcp_req(phba->targetport, &ctxp->ctx.fcp_req,
+                                          payload, size);
+
+                /* Process FCP command */
+                if (rc == 0) {
+                        atomic_inc(&tgtp->rcv_fcp_cmd_out);
+                        nvmebuf->hrq->rqbp->rqb_free_buffer(phba, nvmebuf);
+                        return;
+                }
+
+                atomic_inc(&tgtp->rcv_fcp_cmd_drop);
+                lpfc_printf_log(phba, KERN_ERR, LOG_NVME_IOERR,
+                                "2582 FCP Drop IO x%x: err x%x: x%x x%x x%x\n",
+                                ctxp->oxid, rc,
+                                atomic_read(&tgtp->rcv_fcp_cmd_in),
+                                atomic_read(&tgtp->rcv_fcp_cmd_out),
+                                atomic_read(&tgtp->xmt_fcp_release));
+
+                lpfc_nvmet_defer_release(phba, ctxp);
+                lpfc_nvmet_unsol_fcp_issue_abort(phba, ctxp, sid, oxid);
+                nvmebuf->hrq->rqbp->rqb_free_buffer(phba, nvmebuf);
+                return;
         }
-        lpfc_rq_buf_free(phba, mp);
+        spin_unlock_irqrestore(&phba->sli4_hba.nvmet_io_wait_lock, iflag);
+
+        spin_lock_irqsave(&phba->sli4_hba.nvmet_io_lock, iflag);
+        list_add_tail(&ctx_buf->list,
+                      &phba->sli4_hba.lpfc_nvmet_ctx_list);
+        phba->sli4_hba.nvmet_ctx_cnt++;
+        spin_unlock_irqrestore(&phba->sli4_hba.nvmet_io_lock, iflag);
+#endif
 }
 
 #ifdef CONFIG_SCSI_LPFC_DEBUG_FS
@@ -502,6 +591,7 @@ lpfc_nvmet_xmt_ls_rsp(struct nvmet_fc_target_port *tgtport,
                                 "6150 LS Drop IO x%x: Prep\n",
                                 ctxp->oxid);
                 lpfc_in_buf_free(phba, &nvmebuf->dbuf);
+                atomic_inc(&nvmep->xmt_ls_abort);
                 lpfc_nvmet_unsol_ls_issue_abort(phba, ctxp,
                                                 ctxp->sid, ctxp->oxid);
                 return -ENOMEM;
@@ -545,6 +635,7 @@ lpfc_nvmet_xmt_ls_rsp(struct nvmet_fc_target_port *tgtport,
         lpfc_nlp_put(nvmewqeq->context1);
 
         lpfc_in_buf_free(phba, &nvmebuf->dbuf);
+        atomic_inc(&nvmep->xmt_ls_abort);
         lpfc_nvmet_unsol_ls_issue_abort(phba, ctxp, ctxp->sid, ctxp->oxid);
         return -ENXIO;
 }
@@ -612,9 +703,9 @@ lpfc_nvmet_xmt_fcp_op(struct nvmet_fc_target_port *tgtport,
         lpfc_nvmeio_data(phba, "NVMET FCP CMND: xri x%x op x%x len x%x\n",
                          ctxp->oxid, rsp->op, rsp->rsplen);
 
+        ctxp->flag |= LPFC_NVMET_IO_INP;
         rc = lpfc_sli4_issue_wqe(phba, LPFC_FCP_RING, nvmewqeq);
         if (rc == WQE_SUCCESS) {
-                ctxp->flag |= LPFC_NVMET_IO_INP;
 #ifdef CONFIG_SCSI_LPFC_DEBUG_FS
                 if (!phba->ktime_on)
                         return 0;
@@ -692,6 +783,7 @@ static void
 lpfc_nvmet_xmt_fcp_release(struct nvmet_fc_target_port *tgtport,
                            struct nvmefc_tgt_fcp_req *rsp)
 {
+        struct lpfc_nvmet_tgtport *lpfc_nvmep = tgtport->private;
         struct lpfc_nvmet_rcv_ctx *ctxp =
                 container_of(rsp, struct lpfc_nvmet_rcv_ctx, ctx.fcp_req);
         struct lpfc_hba *phba = ctxp->phba;
@@ -710,10 +802,12 @@ lpfc_nvmet_xmt_fcp_release(struct nvmet_fc_target_port *tgtport,
         lpfc_nvmeio_data(phba, "NVMET FCP FREE: xri x%x ste %d\n", ctxp->oxid,
                          ctxp->state, 0);
 
+        atomic_inc(&lpfc_nvmep->xmt_fcp_release);
+
         if (aborting)
                 return;
 
-        lpfc_nvmet_rq_post(phba, ctxp, &ctxp->rqb_buffer->hbuf);
+        lpfc_nvmet_ctxbuf_post(phba, ctxp->ctxbuf);
 }
 
 static struct nvmet_fc_target_template lpfc_tgttemplate = {
@@ -734,17 +828,128 @@ static struct nvmet_fc_target_template lpfc_tgttemplate = {
         .target_priv_sz = sizeof(struct lpfc_nvmet_tgtport),
 };
 
+void
+lpfc_nvmet_cleanup_io_context(struct lpfc_hba *phba)
+{
+        struct lpfc_nvmet_ctxbuf *ctx_buf, *next_ctx_buf;
+        unsigned long flags;
+
+        list_for_each_entry_safe(
+                ctx_buf, next_ctx_buf,
+                &phba->sli4_hba.lpfc_nvmet_ctx_list, list) {
+                spin_lock_irqsave(
+                        &phba->sli4_hba.abts_nvme_buf_list_lock, flags);
+                list_del_init(&ctx_buf->list);
+                spin_unlock_irqrestore(
+                        &phba->sli4_hba.abts_nvme_buf_list_lock, flags);
+                __lpfc_clear_active_sglq(phba,
+                                         ctx_buf->sglq->sli4_lxritag);
+                ctx_buf->sglq->state = SGL_FREED;
+                ctx_buf->sglq->ndlp = NULL;
+
+                spin_lock_irqsave(&phba->sli4_hba.sgl_list_lock, flags);
+                list_add_tail(&ctx_buf->sglq->list,
+                              &phba->sli4_hba.lpfc_nvmet_sgl_list);
+                spin_unlock_irqrestore(&phba->sli4_hba.sgl_list_lock,
+                                       flags);
+
+                lpfc_sli_release_iocbq(phba, ctx_buf->iocbq);
+                kfree(ctx_buf->context);
+        }
+}
+
+int
+lpfc_nvmet_setup_io_context(struct lpfc_hba *phba)
+{
+        struct lpfc_nvmet_ctxbuf *ctx_buf;
+        struct lpfc_iocbq *nvmewqe;
+        union lpfc_wqe128 *wqe;
+        int i;
+
+        lpfc_printf_log(phba, KERN_INFO, LOG_NVME,
+                        "6403 Allocate NVMET resources for %d XRIs\n",
+                        phba->sli4_hba.nvmet_xri_cnt);
+
+        /* For all nvmet xris, allocate resources needed to process a
+         * received command on a per xri basis.
+         */
+        for (i = 0; i < phba->sli4_hba.nvmet_xri_cnt; i++) {
+                ctx_buf = kzalloc(sizeof(*ctx_buf), GFP_KERNEL);
+                if (!ctx_buf) {
+                        lpfc_printf_log(phba, KERN_ERR, LOG_NVME,
+                                        "6404 Ran out of memory for NVMET\n");
+                        return -ENOMEM;
+                }
+
+                ctx_buf->context = kzalloc(sizeof(*ctx_buf->context),
+                                           GFP_KERNEL);
+                if (!ctx_buf->context) {
+                        kfree(ctx_buf);
+                        lpfc_printf_log(phba, KERN_ERR, LOG_NVME,
+                                        "6405 Ran out of NVMET "
+                                        "context memory\n");
+                        return -ENOMEM;
+                }
+                ctx_buf->context->ctxbuf = ctx_buf;
+
+                ctx_buf->iocbq = lpfc_sli_get_iocbq(phba);
+                if (!ctx_buf->iocbq) {
+                        kfree(ctx_buf->context);
+                        kfree(ctx_buf);
+                        lpfc_printf_log(phba, KERN_ERR, LOG_NVME,
+                                        "6406 Ran out of NVMET iocb/WQEs\n");
+                        return -ENOMEM;
+                }
+                ctx_buf->iocbq->iocb_flag = LPFC_IO_NVMET;
+                nvmewqe = ctx_buf->iocbq;
+                wqe = (union lpfc_wqe128 *)&nvmewqe->wqe;
+                /* Initialize WQE */
+                memset(wqe, 0, sizeof(union lpfc_wqe));
+                /* Word 7 */
+                bf_set(wqe_ct, &wqe->generic.wqe_com, SLI4_CT_RPI);
+                bf_set(wqe_class, &wqe->generic.wqe_com, CLASS3);
+                bf_set(wqe_pu, &wqe->generic.wqe_com, 1);
+                /* Word 10 */
+                bf_set(wqe_nvme, &wqe->fcp_tsend.wqe_com, 1);
+                bf_set(wqe_ebde_cnt, &wqe->generic.wqe_com, 0);
+                bf_set(wqe_qosd, &wqe->generic.wqe_com, 0);
+
+                ctx_buf->iocbq->context1 = NULL;
+                spin_lock(&phba->sli4_hba.sgl_list_lock);
+                ctx_buf->sglq = __lpfc_sli_get_nvmet_sglq(phba, ctx_buf->iocbq);
+                spin_unlock(&phba->sli4_hba.sgl_list_lock);
+                if (!ctx_buf->sglq) {
+                        lpfc_sli_release_iocbq(phba, ctx_buf->iocbq);
+                        kfree(ctx_buf->context);
+                        kfree(ctx_buf);
+                        lpfc_printf_log(phba, KERN_ERR, LOG_NVME,
+                                        "6407 Ran out of NVMET XRIs\n");
+                        return -ENOMEM;
+                }
+                spin_lock(&phba->sli4_hba.nvmet_io_lock);
+                list_add_tail(&ctx_buf->list,
+                              &phba->sli4_hba.lpfc_nvmet_ctx_list);
+                spin_unlock(&phba->sli4_hba.nvmet_io_lock);
+        }
+        phba->sli4_hba.nvmet_ctx_cnt = phba->sli4_hba.nvmet_xri_cnt;
+        return 0;
+}
+
 int
 lpfc_nvmet_create_targetport(struct lpfc_hba *phba)
 {
         struct lpfc_vport  *vport = phba->pport;
         struct lpfc_nvmet_tgtport *tgtp;
         struct nvmet_fc_port_info pinfo;
-        int error = 0;
+        int error;
 
         if (phba->targetport)
                 return 0;
 
+        error = lpfc_nvmet_setup_io_context(phba);
+        if (error)
+                return error;
+
         memset(&pinfo, 0, sizeof(struct nvmet_fc_port_info));
         pinfo.node_name = wwn_to_u64(vport->fc_nodename.u.wwn);
         pinfo.port_name = wwn_to_u64(vport->fc_portname.u.wwn);
@@ -764,7 +969,6 @@ lpfc_nvmet_create_targetport(struct lpfc_hba *phba)
         lpfc_tgttemplate.max_sgl_segments = phba->cfg_nvme_seg_cnt + 1;
         lpfc_tgttemplate.max_hw_queues = phba->cfg_nvme_io_channel;
         lpfc_tgttemplate.target_features = NVMET_FCTGTFEAT_READDATA_RSP |
-                                           NVMET_FCTGTFEAT_NEEDS_CMD_CPUSCHED |
                                            NVMET_FCTGTFEAT_CMD_IN_ISR |
                                            NVMET_FCTGTFEAT_OPDONE_IN_ISR;
 
@@ -773,13 +977,16 @@ lpfc_nvmet_create_targetport(struct lpfc_hba *phba)
                                              &phba->pcidev->dev,
                                              &phba->targetport);
 #else
-        error = -ENOMEM;
+        error = -ENOENT;
 #endif
         if (error) {
                 lpfc_printf_log(phba, KERN_ERR, LOG_NVME_DISC,
                                 "6025 Cannot register NVME targetport "
                                 "x%x\n", error);
                 phba->targetport = NULL;
+
+                lpfc_nvmet_cleanup_io_context(phba);
+
         } else {
                 tgtp = (struct lpfc_nvmet_tgtport *)
                         phba->targetport->private;
@@ -796,6 +1003,7 @@ lpfc_nvmet_create_targetport(struct lpfc_hba *phba)
                 atomic_set(&tgtp->rcv_ls_req_out, 0);
                 atomic_set(&tgtp->rcv_ls_req_drop, 0);
                 atomic_set(&tgtp->xmt_ls_abort, 0);
+                atomic_set(&tgtp->xmt_ls_abort_cmpl, 0);
                 atomic_set(&tgtp->xmt_ls_rsp, 0);
                 atomic_set(&tgtp->xmt_ls_drop, 0);
                 atomic_set(&tgtp->xmt_ls_rsp_error, 0);
@@ -803,18 +1011,21 @@ lpfc_nvmet_create_targetport(struct lpfc_hba *phba)
                 atomic_set(&tgtp->rcv_fcp_cmd_in, 0);
                 atomic_set(&tgtp->rcv_fcp_cmd_out, 0);
                 atomic_set(&tgtp->rcv_fcp_cmd_drop, 0);
-                atomic_set(&tgtp->xmt_fcp_abort, 0);
                 atomic_set(&tgtp->xmt_fcp_drop, 0);
                 atomic_set(&tgtp->xmt_fcp_read_rsp, 0);
                 atomic_set(&tgtp->xmt_fcp_read, 0);
                 atomic_set(&tgtp->xmt_fcp_write, 0);
                 atomic_set(&tgtp->xmt_fcp_rsp, 0);
+                atomic_set(&tgtp->xmt_fcp_release, 0);
                 atomic_set(&tgtp->xmt_fcp_rsp_cmpl, 0);
                 atomic_set(&tgtp->xmt_fcp_rsp_error, 0);
                 atomic_set(&tgtp->xmt_fcp_rsp_drop, 0);
+                atomic_set(&tgtp->xmt_fcp_abort, 0);
+                atomic_set(&tgtp->xmt_fcp_abort_cmpl, 0);
+                atomic_set(&tgtp->xmt_abort_unsol, 0);
+                atomic_set(&tgtp->xmt_abort_sol, 0);
                 atomic_set(&tgtp->xmt_abort_rsp, 0);
                 atomic_set(&tgtp->xmt_abort_rsp_error, 0);
-                atomic_set(&tgtp->xmt_abort_cmpl, 0);
         }
         return error;
 }
@@ -865,7 +1076,7 @@ lpfc_sli4_nvmet_xri_aborted(struct lpfc_hba *phba,
         list_for_each_entry_safe(ctxp, next_ctxp,
                                  &phba->sli4_hba.lpfc_abts_nvmet_ctx_list,
                                  list) {
-                if (ctxp->rqb_buffer->sglq->sli4_xritag != xri)
+                if (ctxp->ctxbuf->sglq->sli4_xritag != xri)
                         continue;
 
                 /* Check if we already received a free context call
@@ -886,7 +1097,7 @@ lpfc_sli4_nvmet_xri_aborted(struct lpfc_hba *phba,
                     (ndlp->nlp_state == NLP_STE_UNMAPPED_NODE ||
                      ndlp->nlp_state == NLP_STE_MAPPED_NODE)) {
                         lpfc_set_rrq_active(phba, ndlp,
-                                ctxp->rqb_buffer->sglq->sli4_lxritag,
+                                ctxp->ctxbuf->sglq->sli4_lxritag,
                                 rxid, 1);
                         lpfc_sli4_abts_err_handler(phba, ndlp, axri);
                 }
@@ -895,8 +1106,8 @@ lpfc_sli4_nvmet_xri_aborted(struct lpfc_hba *phba,
                                 "6318 XB aborted %x flg x%x (%x)\n",
                                 ctxp->oxid, ctxp->flag, released);
                 if (released)
-                        lpfc_nvmet_rq_post(phba, ctxp,
-                                           &ctxp->rqb_buffer->hbuf);
+                        lpfc_nvmet_ctxbuf_post(phba, ctxp->ctxbuf);
+
                 if (rrq_empty)
                         lpfc_worker_wake_up(phba);
                 return;
@@ -924,7 +1135,7 @@ lpfc_nvmet_rcv_unsol_abort(struct lpfc_vport *vport,
         list_for_each_entry_safe(ctxp, next_ctxp,
                                  &phba->sli4_hba.lpfc_abts_nvmet_ctx_list,
                                  list) {
-                if (ctxp->rqb_buffer->sglq->sli4_xritag != xri)
+                if (ctxp->ctxbuf->sglq->sli4_xritag != xri)
                         continue;
 
                 spin_unlock(&phba->sli4_hba.abts_nvme_buf_list_lock);
@@ -976,6 +1187,7 @@ lpfc_nvmet_destroy_targetport(struct lpfc_hba *phba)
                 init_completion(&tgtp->tport_unreg_done);
                 nvmet_fc_unregister_targetport(phba->targetport);
                 wait_for_completion_timeout(&tgtp->tport_unreg_done, 5);
+                lpfc_nvmet_cleanup_io_context(phba);
         }
         phba->targetport = NULL;
 #endif
@@ -1011,6 +1223,7 @@ lpfc_nvmet_unsol_ls_buffer(struct lpfc_hba *phba, struct lpfc_sli_ring *pring,
                 oxid = 0;
                 size = 0;
                 sid = 0;
+                ctxp = NULL;
                 goto dropit;
         }
 
@@ -1105,39 +1318,71 @@ lpfc_nvmet_unsol_fcp_buffer(struct lpfc_hba *phba,
         struct lpfc_nvmet_rcv_ctx *ctxp;
         struct lpfc_nvmet_tgtport *tgtp;
         struct fc_frame_header *fc_hdr;
+        struct lpfc_nvmet_ctxbuf *ctx_buf;
         uint32_t *payload;
-        uint32_t size, oxid, sid, rc;
+        uint32_t size, oxid, sid, rc, qno;
+        unsigned long iflag;
 #ifdef CONFIG_SCSI_LPFC_DEBUG_FS
         uint32_t id;
 #endif
 
+        ctx_buf = NULL;
         if (!nvmebuf || !phba->targetport) {
                 lpfc_printf_log(phba, KERN_ERR, LOG_NVME_IOERR,
-                                "6157 FCP Drop IO\n");
+                                "6157 NVMET FCP Drop IO\n");
                 oxid = 0;
                 size = 0;
                 sid = 0;
+                ctxp = NULL;
                 goto dropit;
         }
 
+        spin_lock_irqsave(&phba->sli4_hba.nvmet_io_lock, iflag);
+        if (phba->sli4_hba.nvmet_ctx_cnt) {
+                list_remove_head(&phba->sli4_hba.lpfc_nvmet_ctx_list,
+                                 ctx_buf, struct lpfc_nvmet_ctxbuf, list);
+                phba->sli4_hba.nvmet_ctx_cnt--;
+        }
+        spin_unlock_irqrestore(&phba->sli4_hba.nvmet_io_lock, iflag);
 
-        tgtp = (struct lpfc_nvmet_tgtport *)phba->targetport->private;
-        payload = (uint32_t *)(nvmebuf->dbuf.virt);
         fc_hdr = (struct fc_frame_header *)(nvmebuf->hbuf.virt);
-        size = nvmebuf->bytes_recv;
         oxid = be16_to_cpu(fc_hdr->fh_ox_id);
-        sid = sli4_sid_from_fc_hdr(fc_hdr);
+        size = nvmebuf->bytes_recv;
 
-        ctxp = (struct lpfc_nvmet_rcv_ctx *)nvmebuf->context;
-        if (ctxp == NULL) {
-                atomic_inc(&tgtp->rcv_fcp_cmd_drop);
-                lpfc_printf_log(phba, KERN_ERR, LOG_NVME_IOERR,
-                                "6158 FCP Drop IO x%x: Alloc\n",
-                                oxid);
-                lpfc_nvmet_rq_post(phba, NULL, &nvmebuf->hbuf);
-                /* Cannot send ABTS without context */
+#ifdef CONFIG_SCSI_LPFC_DEBUG_FS
+        if (phba->cpucheck_on & LPFC_CHECK_NVMET_RCV) {
+                id = smp_processor_id();
+                if (id < LPFC_CHECK_CPU_CNT)
+                        phba->cpucheck_rcv_io[id]++;
+        }
+#endif
+
+        lpfc_nvmeio_data(phba, "NVMET FCP  RCV: xri x%x sz %d CPU %02x\n",
+                         oxid, size, smp_processor_id());
+
+        if (!ctx_buf) {
+                /* Queue this NVME IO to process later */
+                spin_lock_irqsave(&phba->sli4_hba.nvmet_io_wait_lock, iflag);
+                list_add_tail(&nvmebuf->hbuf.list,
+                              &phba->sli4_hba.lpfc_nvmet_io_wait_list);
+                phba->sli4_hba.nvmet_io_wait_cnt++;
+                phba->sli4_hba.nvmet_io_wait_total++;
+                spin_unlock_irqrestore(&phba->sli4_hba.nvmet_io_wait_lock,
+                                       iflag);
+
+                /* Post a brand new DMA buffer to RQ */
+                qno = nvmebuf->idx;
+                lpfc_post_rq_buffer(
+                        phba, phba->sli4_hba.nvmet_mrq_hdr[qno],
+                        phba->sli4_hba.nvmet_mrq_data[qno], 1, qno);
                 return;
         }
+
+        tgtp = (struct lpfc_nvmet_tgtport *)phba->targetport->private;
+        payload = (uint32_t *)(nvmebuf->dbuf.virt);
+        sid = sli4_sid_from_fc_hdr(fc_hdr);
+
+        ctxp = (struct lpfc_nvmet_rcv_ctx *)ctx_buf->context;
         memset(ctxp, 0, sizeof(ctxp->ctx));
         ctxp->wqeq = NULL;
         ctxp->txrdy = NULL;
@@ -1147,9 +1392,9 @@ lpfc_nvmet_unsol_fcp_buffer(struct lpfc_hba *phba,
         ctxp->oxid = oxid;
         ctxp->sid = sid;
         ctxp->state = LPFC_NVMET_STE_RCV;
-        ctxp->rqb_buffer = nvmebuf;
         ctxp->entry_cnt = 1;
         ctxp->flag = 0;
+        ctxp->ctxbuf = ctx_buf;
         spin_lock_init(&ctxp->ctxlock);
 
 #ifdef CONFIG_SCSI_LPFC_DEBUG_FS
@@ -1165,22 +1410,16 @@ lpfc_nvmet_unsol_fcp_buffer(struct lpfc_hba *phba,
                 ctxp->ts_isr_status = 0;
                 ctxp->ts_status_nvme = 0;
         }
-
-        if (phba->cpucheck_on & LPFC_CHECK_NVMET_RCV) {
-                id = smp_processor_id();
-                if (id < LPFC_CHECK_CPU_CNT)
-                        phba->cpucheck_rcv_io[id]++;
-        }
 #endif
 
-        lpfc_nvmeio_data(phba, "NVMET FCP  RCV: xri x%x sz %d CPU %02x\n",
-                         oxid, size, smp_processor_id());
-
         atomic_inc(&tgtp->rcv_fcp_cmd_in);
         /*
          * The calling sequence should be:
          * nvmet_fc_rcv_fcp_req -> lpfc_nvmet_xmt_fcp_op/cmp -> req->done
          * lpfc_nvmet_xmt_fcp_op_cmp should free the allocated ctxp.
+         * When we return from nvmet_fc_rcv_fcp_req, all relevant info in
+         * the NVME command / FC header is stored, so we are free to repost
+         * the buffer.
          */
         rc = nvmet_fc_rcv_fcp_req(phba->targetport, &ctxp->ctx.fcp_req,
                                   payload, size);
@@ -1188,26 +1427,32 @@ lpfc_nvmet_unsol_fcp_buffer(struct lpfc_hba *phba,
         /* Process FCP command */
         if (rc == 0) {
                 atomic_inc(&tgtp->rcv_fcp_cmd_out);
+                lpfc_rq_buf_free(phba, &nvmebuf->hbuf); /* repost */
                 return;
         }
 
         atomic_inc(&tgtp->rcv_fcp_cmd_drop);
         lpfc_printf_log(phba, KERN_ERR, LOG_NVME_IOERR,
-                        "6159 FCP Drop IO x%x: err x%x\n",
-                        ctxp->oxid, rc);
+                        "6159 FCP Drop IO x%x: err x%x: x%x x%x x%x\n",
+                        ctxp->oxid, rc,
+                        atomic_read(&tgtp->rcv_fcp_cmd_in),
+                        atomic_read(&tgtp->rcv_fcp_cmd_out),
+                        atomic_read(&tgtp->xmt_fcp_release));
 dropit:
         lpfc_nvmeio_data(phba, "NVMET FCP DROP: xri x%x sz %d from %06x\n",
                          oxid, size, sid);
         if (oxid) {
+                lpfc_nvmet_defer_release(phba, ctxp);
                 lpfc_nvmet_unsol_fcp_issue_abort(phba, ctxp, sid, oxid);
+                lpfc_rq_buf_free(phba, &nvmebuf->hbuf); /* repost */
                 return;
         }
 
-        if (nvmebuf) {
-                nvmebuf->iocbq->hba_wqidx = 0;
-                /* We assume a rcv'ed cmd ALWAYs fits into 1 buffer */
-                lpfc_nvmet_rq_post(phba, NULL, &nvmebuf->hbuf);
-        }
+        if (ctx_buf)
+                lpfc_nvmet_ctxbuf_post(phba, ctx_buf);
+
+        if (nvmebuf)
+                lpfc_rq_buf_free(phba, &nvmebuf->hbuf); /* repost */
 #endif
 }
 
@@ -1259,7 +1504,7 @@ lpfc_nvmet_unsol_fcp_event(struct lpfc_hba *phba,
                            uint64_t isr_timestamp)
 {
         if (phba->nvmet_support == 0) {
-                lpfc_nvmet_rq_post(phba, NULL, &nvmebuf->hbuf);
+                lpfc_rq_buf_free(phba, &nvmebuf->hbuf);
                 return;
         }
         lpfc_nvmet_unsol_fcp_buffer(phba, pring, nvmebuf,
@@ -1460,7 +1705,7 @@ lpfc_nvmet_prep_fcp_wqe(struct lpfc_hba *phba,
         nvmewqe = ctxp->wqeq;
         if (nvmewqe == NULL) {
                 /* Allocate buffer for  command wqe */
-                nvmewqe = ctxp->rqb_buffer->iocbq;
+                nvmewqe = ctxp->ctxbuf->iocbq;
                 if (nvmewqe == NULL) {
                         lpfc_printf_log(phba, KERN_ERR, LOG_NVME_IOERR,
                                         "6110 lpfc_nvmet_prep_fcp_wqe: No "
@@ -1487,7 +1732,7 @@ lpfc_nvmet_prep_fcp_wqe(struct lpfc_hba *phba,
                 return NULL;
         }
 
-        sgl  = (struct sli4_sge *)ctxp->rqb_buffer->sglq->sgl;
+        sgl  = (struct sli4_sge *)ctxp->ctxbuf->sglq->sgl;
         switch (rsp->op) {
         case NVMET_FCOP_READDATA:
         case NVMET_FCOP_READDATA_RSP:
@@ -1812,7 +2057,8 @@ lpfc_nvmet_sol_fcp_abort_cmp(struct lpfc_hba *phba, struct lpfc_iocbq *cmdwqe,
         result = wcqe->parameter;
 
         tgtp = (struct lpfc_nvmet_tgtport *)phba->targetport->private;
-        atomic_inc(&tgtp->xmt_abort_cmpl);
+        if (ctxp->flag & LPFC_NVMET_ABORT_OP)
+                atomic_inc(&tgtp->xmt_fcp_abort_cmpl);
 
         ctxp->state = LPFC_NVMET_STE_DONE;
 
@@ -1827,6 +2073,7 @@ lpfc_nvmet_sol_fcp_abort_cmp(struct lpfc_hba *phba, struct lpfc_iocbq *cmdwqe,
         }
         ctxp->flag &= ~LPFC_NVMET_ABORT_OP;
         spin_unlock_irqrestore(&ctxp->ctxlock, flags);
+        atomic_inc(&tgtp->xmt_abort_rsp);
 
         lpfc_printf_log(phba, KERN_ERR, LOG_NVME_ABTS,
                         "6165 ABORT cmpl: xri x%x flg x%x (%d) "
@@ -1835,15 +2082,16 @@ lpfc_nvmet_sol_fcp_abort_cmp(struct lpfc_hba *phba, struct lpfc_iocbq *cmdwqe,
                         wcqe->word0, wcqe->total_data_placed,
                         result, wcqe->word3);
 
+        cmdwqe->context2 = NULL;
+        cmdwqe->context3 = NULL;
         /*
          * if transport has released ctx, then can reuse it. Otherwise,
          * will be recycled by transport release call.
          */
         if (released)
-                lpfc_nvmet_rq_post(phba, ctxp, &ctxp->rqb_buffer->hbuf);
+                lpfc_nvmet_ctxbuf_post(phba, ctxp->ctxbuf);
 
-        cmdwqe->context2 = NULL;
-        cmdwqe->context3 = NULL;
+        /* This is the iocbq for the abort, not the command */
         lpfc_sli_release_iocbq(phba, cmdwqe);
 
         /* Since iaab/iaar are NOT set, there is no work left.
@@ -1877,7 +2125,8 @@ lpfc_nvmet_unsol_fcp_abort_cmp(struct lpfc_hba *phba, struct lpfc_iocbq *cmdwqe,
         result = wcqe->parameter;
 
         tgtp = (struct lpfc_nvmet_tgtport *)phba->targetport->private;
-        atomic_inc(&tgtp->xmt_abort_cmpl);
+        if (ctxp->flag & LPFC_NVMET_ABORT_OP)
+                atomic_inc(&tgtp->xmt_fcp_abort_cmpl);
 
         if (!ctxp) {
                 /* if context is clear, related io alrady complete */
@@ -1907,6 +2156,7 @@ lpfc_nvmet_unsol_fcp_abort_cmp(struct lpfc_hba *phba, struct lpfc_iocbq *cmdwqe,
         }
         ctxp->flag &= ~LPFC_NVMET_ABORT_OP;
         spin_unlock_irqrestore(&ctxp->ctxlock, flags);
+        atomic_inc(&tgtp->xmt_abort_rsp);
 
         lpfc_printf_log(phba, KERN_INFO, LOG_NVME_ABTS,
                         "6316 ABTS cmpl xri x%x flg x%x (%x) "
@@ -1914,15 +2164,15 @@ lpfc_nvmet_unsol_fcp_abort_cmp(struct lpfc_hba *phba, struct lpfc_iocbq *cmdwqe,
                         ctxp->oxid, ctxp->flag, released,
                         wcqe->word0, wcqe->total_data_placed,
                         result, wcqe->word3);
+
+        cmdwqe->context2 = NULL;
+        cmdwqe->context3 = NULL;
         /*
          * if transport has released ctx, then can reuse it. Otherwise,
          * will be recycled by transport release call.
          */
         if (released)
-                lpfc_nvmet_rq_post(phba, ctxp, &ctxp->rqb_buffer->hbuf);
-
-        cmdwqe->context2 = NULL;
-        cmdwqe->context3 = NULL;
+                lpfc_nvmet_ctxbuf_post(phba, ctxp->ctxbuf);
 
         /* Since iaab/iaar are NOT set, there is no work left.
          * For LPFC_NVMET_XBUSY, lpfc_sli4_nvmet_xri_aborted
@@ -1953,7 +2203,7 @@ lpfc_nvmet_xmt_ls_abort_cmp(struct lpfc_hba *phba, struct lpfc_iocbq *cmdwqe,
         result = wcqe->parameter;
 
         tgtp = (struct lpfc_nvmet_tgtport *)phba->targetport->private;
-        atomic_inc(&tgtp->xmt_abort_cmpl);
+        atomic_inc(&tgtp->xmt_ls_abort_cmpl);
 
         lpfc_printf_log(phba, KERN_INFO, LOG_NVME_ABTS,
                         "6083 Abort cmpl: ctx %p WCQE: %08x %08x %08x %08x\n",
@@ -1984,10 +2234,6 @@ lpfc_nvmet_unsol_issue_abort(struct lpfc_hba *phba,
                         sid, xri, ctxp->wqeq->sli4_xritag);
 
         tgtp = (struct lpfc_nvmet_tgtport *)phba->targetport->private;
-        if (!ctxp->wqeq) {
-                ctxp->wqeq = ctxp->rqb_buffer->iocbq;
-                ctxp->wqeq->hba_wqidx = 0;
-        }
 
         ndlp = lpfc_findnode_did(phba->pport, sid);
         if (!ndlp || !NLP_CHK_NODE_ACT(ndlp) ||
@@ -2083,7 +2329,7 @@ lpfc_nvmet_sol_fcp_issue_abort(struct lpfc_hba *phba,
 
         tgtp = (struct lpfc_nvmet_tgtport *)phba->targetport->private;
         if (!ctxp->wqeq) {
-                ctxp->wqeq = ctxp->rqb_buffer->iocbq;
+                ctxp->wqeq = ctxp->ctxbuf->iocbq;
                 ctxp->wqeq->hba_wqidx = 0;
         }
 
@@ -2104,6 +2350,7 @@ lpfc_nvmet_sol_fcp_issue_abort(struct lpfc_hba *phba,
         /* Issue ABTS for this WQE based on iotag */
         ctxp->abort_wqeq = lpfc_sli_get_iocbq(phba);
         if (!ctxp->abort_wqeq) {
+                atomic_inc(&tgtp->xmt_abort_rsp_error);
                 lpfc_printf_log(phba, KERN_WARNING, LOG_NVME_ABTS,
                                 "6161 ABORT failed: No wqeqs: "
                                 "xri: x%x\n", ctxp->oxid);
@@ -2128,6 +2375,7 @@ lpfc_nvmet_sol_fcp_issue_abort(struct lpfc_hba *phba,
         /* driver queued commands are in process of being flushed */
         if (phba->hba_flag & HBA_NVME_IOQ_FLUSH) {
                 spin_unlock_irqrestore(&phba->hbalock, flags);
+                atomic_inc(&tgtp->xmt_abort_rsp_error);
                 lpfc_printf_log(phba, KERN_ERR, LOG_NVME,
                                 "6163 Driver in reset cleanup - flushing "
                                 "NVME Req now. hba_flag x%x oxid x%x\n",
@@ -2140,6 +2388,7 @@ lpfc_nvmet_sol_fcp_issue_abort(struct lpfc_hba *phba,
         /* Outstanding abort is in progress */
         if (abts_wqeq->iocb_flag & LPFC_DRIVER_ABORTED) {
                 spin_unlock_irqrestore(&phba->hbalock, flags);
+                atomic_inc(&tgtp->xmt_abort_rsp_error);
                 lpfc_printf_log(phba, KERN_ERR, LOG_NVME,
                                 "6164 Outstanding NVME I/O Abort Request "
                                 "still pending on oxid x%x\n",
@@ -2190,9 +2439,12 @@ lpfc_nvmet_sol_fcp_issue_abort(struct lpfc_hba *phba,
         abts_wqeq->context2 = ctxp;
         rc = lpfc_sli4_issue_wqe(phba, LPFC_FCP_RING, abts_wqeq);
         spin_unlock_irqrestore(&phba->hbalock, flags);
-        if (rc == WQE_SUCCESS)
+        if (rc == WQE_SUCCESS) {
+                atomic_inc(&tgtp->xmt_abort_sol);
                 return 0;
+        }
 
+        atomic_inc(&tgtp->xmt_abort_rsp_error);
         ctxp->flag &= ~LPFC_NVMET_ABORT_OP;
         lpfc_sli_release_iocbq(phba, abts_wqeq);
         lpfc_printf_log(phba, KERN_ERR, LOG_NVME_ABTS,
@@ -2215,7 +2467,7 @@ lpfc_nvmet_unsol_fcp_issue_abort(struct lpfc_hba *phba,
 
         tgtp = (struct lpfc_nvmet_tgtport *)phba->targetport->private;
         if (!ctxp->wqeq) {
-                ctxp->wqeq = ctxp->rqb_buffer->iocbq;
+                ctxp->wqeq = ctxp->ctxbuf->iocbq;
                 ctxp->wqeq->hba_wqidx = 0;
         }
 
@@ -2231,11 +2483,11 @@ lpfc_nvmet_unsol_fcp_issue_abort(struct lpfc_hba *phba,
         rc = lpfc_sli4_issue_wqe(phba, LPFC_FCP_RING, abts_wqeq);
         spin_unlock_irqrestore(&phba->hbalock, flags);
         if (rc == WQE_SUCCESS) {
-                atomic_inc(&tgtp->xmt_abort_rsp);
                 return 0;
         }
 
 aerr:
+        atomic_inc(&tgtp->xmt_abort_rsp_error);
         ctxp->flag &= ~LPFC_NVMET_ABORT_OP;
         atomic_inc(&tgtp->xmt_abort_rsp_error);
         lpfc_printf_log(phba, KERN_WARNING, LOG_NVME_ABTS,
@@ -2270,6 +2522,7 @@ lpfc_nvmet_unsol_ls_issue_abort(struct lpfc_hba *phba,
         }
         abts_wqeq = ctxp->wqeq;
         wqe_abts = &abts_wqeq->wqe;
+
         lpfc_nvmet_unsol_issue_abort(phba, ctxp, sid, xri);
 
         spin_lock_irqsave(&phba->hbalock, flags);
@@ -2279,7 +2532,7 @@ lpfc_nvmet_unsol_ls_issue_abort(struct lpfc_hba *phba,
         rc = lpfc_sli4_issue_wqe(phba, LPFC_ELS_RING, abts_wqeq);
         spin_unlock_irqrestore(&phba->hbalock, flags);
         if (rc == WQE_SUCCESS) {
-                atomic_inc(&tgtp->xmt_abort_rsp);
+                atomic_inc(&tgtp->xmt_abort_unsol);
                 return 0;
         }
 
diff --git a/drivers/scsi/lpfc/lpfc_nvmet.h b/drivers/scsi/lpfc/lpfc_nvmet.h
index 128759fe6650..6eb2f5d8d4ed 100644
--- a/drivers/scsi/lpfc/lpfc_nvmet.h
+++ b/drivers/scsi/lpfc/lpfc_nvmet.h
@@ -22,6 +22,7 @@
  ********************************************************************/
 
 #define LPFC_NVMET_DEFAULT_SEGS         (64 + 1)        /* 256K IOs */
+#define LPFC_NVMET_RQE_DEF_COUNT        512
 #define LPFC_NVMET_SUCCESS_LEN  12
 
 /* Used for NVME Target */
@@ -34,6 +35,7 @@ struct lpfc_nvmet_tgtport {
         atomic_t rcv_ls_req_out;
         atomic_t rcv_ls_req_drop;
         atomic_t xmt_ls_abort;
+        atomic_t xmt_ls_abort_cmpl;
 
         /* Stats counters - lpfc_nvmet_xmt_ls_rsp */
         atomic_t xmt_ls_rsp;
@@ -47,9 +49,9 @@ struct lpfc_nvmet_tgtport {
         atomic_t rcv_fcp_cmd_in;
         atomic_t rcv_fcp_cmd_out;
         atomic_t rcv_fcp_cmd_drop;
+        atomic_t xmt_fcp_release;
 
         /* Stats counters - lpfc_nvmet_xmt_fcp_op */
-        atomic_t xmt_fcp_abort;
         atomic_t xmt_fcp_drop;
         atomic_t xmt_fcp_read_rsp;
         atomic_t xmt_fcp_read;
@@ -62,12 +64,13 @@ struct lpfc_nvmet_tgtport {
         atomic_t xmt_fcp_rsp_drop;
 
 
-        /* Stats counters - lpfc_nvmet_unsol_issue_abort */
+        /* Stats counters - lpfc_nvmet_xmt_fcp_abort */
+        atomic_t xmt_fcp_abort;
+        atomic_t xmt_fcp_abort_cmpl;
+        atomic_t xmt_abort_sol;
+        atomic_t xmt_abort_unsol;
         atomic_t xmt_abort_rsp;
         atomic_t xmt_abort_rsp_error;
-
-        /* Stats counters - lpfc_nvmet_xmt_abort_cmp */
-        atomic_t xmt_abort_cmpl;
 };
 
 struct lpfc_nvmet_rcv_ctx {
@@ -103,6 +106,7 @@ struct lpfc_nvmet_rcv_ctx {
 #define LPFC_NVMET_CTX_RLS              0x8  /* ctx free requested */
 #define LPFC_NVMET_ABTS_RCV             0x10  /* ABTS received on exchange */
         struct rqb_dmabuf *rqb_buffer;
+        struct lpfc_nvmet_ctxbuf *ctxbuf;
 
 #ifdef CONFIG_SCSI_LPFC_DEBUG_FS
         uint64_t ts_isr_cmd;
diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
index cf19f4976f5f..d6b184839bc2 100644
--- a/drivers/scsi/lpfc/lpfc_sli.c
+++ b/drivers/scsi/lpfc/lpfc_sli.c
@@ -74,6 +74,8 @@ static struct lpfc_iocbq *lpfc_sli4_els_wcqe_to_rspiocbq(struct lpfc_hba *,
                                                          struct lpfc_iocbq *);
 static void lpfc_sli4_send_seq_to_ulp(struct lpfc_vport *,
                                       struct hbq_dmabuf *);
+static void lpfc_sli4_handle_mds_loopback(struct lpfc_vport *vport,
+                                          struct hbq_dmabuf *dmabuf);
 static int lpfc_sli4_fp_handle_cqe(struct lpfc_hba *, struct lpfc_queue *,
                                     struct lpfc_cqe *);
 static int lpfc_sli4_post_sgl_list(struct lpfc_hba *, struct list_head *,
@@ -479,22 +481,23 @@ lpfc_sli4_rq_put(struct lpfc_queue *hq, struct lpfc_queue *dq,
         if (unlikely(!hq) || unlikely(!dq))
                 return -ENOMEM;
         put_index = hq->host_index;
-        temp_hrqe = hq->qe[hq->host_index].rqe;
+        temp_hrqe = hq->qe[put_index].rqe;
         temp_drqe = dq->qe[dq->host_index].rqe;
 
         if (hq->type != LPFC_HRQ || dq->type != LPFC_DRQ)
                 return -EINVAL;
-        if (hq->host_index != dq->host_index)
+        if (put_index != dq->host_index)
                 return -EINVAL;
         /* If the host has not yet processed the next entry then we are done */
-        if (((hq->host_index + 1) % hq->entry_count) == hq->hba_index)
+        if (((put_index + 1) % hq->entry_count) == hq->hba_index)
                 return -EBUSY;
         lpfc_sli_pcimem_bcopy(hrqe, temp_hrqe, hq->entry_size);
         lpfc_sli_pcimem_bcopy(drqe, temp_drqe, dq->entry_size);
 
         /* Update the host index to point to the next slot */
-        hq->host_index = ((hq->host_index + 1) % hq->entry_count);
+        hq->host_index = ((put_index + 1) % hq->entry_count);
         dq->host_index = ((dq->host_index + 1) % dq->entry_count);
+        hq->RQ_buf_posted++;
 
         /* Ring The Header Receive Queue Doorbell */
         if (!(hq->host_index % hq->entry_repost)) {
@@ -4204,13 +4207,16 @@ lpfc_sli_brdreset(struct lpfc_hba *phba)
         /* Reset HBA */
         lpfc_printf_log(phba, KERN_INFO, LOG_SLI,
                         "0325 Reset HBA Data: x%x x%x\n",
-                        phba->pport->port_state, psli->sli_flag);
+                        (phba->pport) ? phba->pport->port_state : 0,
+                        psli->sli_flag);
 
         /* perform board reset */
         phba->fc_eventTag = 0;
         phba->link_events = 0;
-        phba->pport->fc_myDID = 0;
-        phba->pport->fc_prevDID = 0;
+        if (phba->pport) {
+                phba->pport->fc_myDID = 0;
+                phba->pport->fc_prevDID = 0;
+        }
 
         /* Turn off parity checking and serr during the physical reset */
         pci_read_config_word(phba->pcidev, PCI_COMMAND, &cfg_value);
@@ -4336,7 +4342,8 @@ lpfc_sli_brdrestart_s3(struct lpfc_hba *phba)
         /* Restart HBA */
         lpfc_printf_log(phba, KERN_INFO, LOG_SLI,
                         "0337 Restart HBA Data: x%x x%x\n",
-                        phba->pport->port_state, psli->sli_flag);
+                        (phba->pport) ? phba->pport->port_state : 0,
+                        psli->sli_flag);
 
         word0 = 0;
         mb = (MAILBOX_t *) &word0;
@@ -4350,7 +4357,7 @@ lpfc_sli_brdrestart_s3(struct lpfc_hba *phba)
         readl(to_slim); /* flush */
 
         /* Only skip post after fc_ffinit is completed */
-        if (phba->pport->port_state)
+        if (phba->pport && phba->pport->port_state)
                 word0 = 1;      /* This is really setting up word1 */
         else
                 word0 = 0;      /* This is really setting up word1 */
@@ -4359,7 +4366,8 @@ lpfc_sli_brdrestart_s3(struct lpfc_hba *phba)
         readl(to_slim); /* flush */
 
         lpfc_sli_brdreset(phba);
-        phba->pport->stopped = 0;
+        if (phba->pport)
+                phba->pport->stopped = 0;
         phba->link_state = LPFC_INIT_START;
         phba->hba_flag = 0;
         spin_unlock_irq(&phba->hbalock);
@@ -4446,7 +4454,7 @@ lpfc_sli_brdrestart(struct lpfc_hba *phba)
  * iteration, the function will restart the HBA again. The function returns
  * zero if HBA successfully restarted else returns negative error code.
  **/
-static int
+int
 lpfc_sli_chipset_init(struct lpfc_hba *phba)
 {
         uint32_t status, i = 0;
@@ -5901,7 +5909,7 @@ lpfc_set_features(struct lpfc_hba *phba, LPFC_MBOXQ_t *mbox,
                 bf_set(lpfc_mbx_set_feature_mds,
                        &mbox->u.mqe.un.set_feature, 1);
                 bf_set(lpfc_mbx_set_feature_mds_deep_loopbk,
-                       &mbox->u.mqe.un.set_feature, 0);
+                       &mbox->u.mqe.un.set_feature, 1);
                 mbox->u.mqe.un.set_feature.feature = LPFC_SET_MDS_DIAGS;
                 mbox->u.mqe.un.set_feature.param_len = 8;
                 break;
@@ -6507,6 +6515,50 @@ lpfc_set_host_data(struct lpfc_hba *phba, LPFC_MBOXQ_t *mbox)
                  (phba->hba_flag & HBA_FCOE_MODE) ? "FCoE" : "FC");
 }
 
+int
+lpfc_post_rq_buffer(struct lpfc_hba *phba, struct lpfc_queue *hrq,
+                    struct lpfc_queue *drq, int count, int idx)
+{
+        int rc, i;
+        struct lpfc_rqe hrqe;
+        struct lpfc_rqe drqe;
+        struct lpfc_rqb *rqbp;
+        struct rqb_dmabuf *rqb_buffer;
+        LIST_HEAD(rqb_buf_list);
+
+        rqbp = hrq->rqbp;
+        for (i = 0; i < count; i++) {
+                /* IF RQ is already full, don't bother */
+                if (rqbp->buffer_count + i >= rqbp->entry_count - 1)
+                        break;
+                rqb_buffer = rqbp->rqb_alloc_buffer(phba);
+                if (!rqb_buffer)
+                        break;
+                rqb_buffer->hrq = hrq;
+                rqb_buffer->drq = drq;
+                rqb_buffer->idx = idx;
+                list_add_tail(&rqb_buffer->hbuf.list, &rqb_buf_list);
+        }
+        while (!list_empty(&rqb_buf_list)) {
+                list_remove_head(&rqb_buf_list, rqb_buffer, struct rqb_dmabuf,
+                                 hbuf.list);
+
+                hrqe.address_lo = putPaddrLow(rqb_buffer->hbuf.phys);
+                hrqe.address_hi = putPaddrHigh(rqb_buffer->hbuf.phys);
+                drqe.address_lo = putPaddrLow(rqb_buffer->dbuf.phys);
+                drqe.address_hi = putPaddrHigh(rqb_buffer->dbuf.phys);
+                rc = lpfc_sli4_rq_put(hrq, drq, &hrqe, &drqe);
+                if (rc < 0) {
+                        rqbp->rqb_free_buffer(phba, rqb_buffer);
+                } else {
+                        list_add_tail(&rqb_buffer->hbuf.list,
+                                      &rqbp->rqb_buffer_list);
+                        rqbp->buffer_count++;
+                }
+        }
+        return 1;
+}
+
 /**
  * lpfc_sli4_hba_setup - SLI4 device initialization PCI function
  * @phba: Pointer to HBA context object.
@@ -6519,7 +6571,7 @@ lpfc_set_host_data(struct lpfc_hba *phba, LPFC_MBOXQ_t *mbox)
 int
 lpfc_sli4_hba_setup(struct lpfc_hba *phba)
 {
-        int rc, i;
+        int rc, i, cnt;
         LPFC_MBOXQ_t *mboxq;
         struct lpfc_mqe *mqe;
         uint8_t *vpd;
@@ -6870,6 +6922,21 @@ lpfc_sli4_hba_setup(struct lpfc_hba *phba)
                         goto out_destroy_queue;
                 }
                 phba->sli4_hba.nvmet_xri_cnt = rc;
+
+                cnt = phba->cfg_iocb_cnt * 1024;
+                /* We need 1 iocbq for every SGL, for IO processing */
+                cnt += phba->sli4_hba.nvmet_xri_cnt;
+                /* Initialize and populate the iocb list per host */
+                lpfc_printf_log(phba, KERN_INFO, LOG_INIT,
+                                "2821 initialize iocb list %d total %d\n",
+                                phba->cfg_iocb_cnt, cnt);
+                rc = lpfc_init_iocb_list(phba, cnt);
+                if (rc) {
+                        lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
+                                        "1413 Failed to init iocb list.\n");
+                        goto out_destroy_queue;
+                }
+
                 lpfc_nvmet_create_targetport(phba);
         } else {
                 /* update host scsi xri-sgl sizes and mappings */
@@ -6889,28 +6956,34 @@ lpfc_sli4_hba_setup(struct lpfc_hba *phba)
                                         "and mapping: %d\n", rc);
                         goto out_destroy_queue;
                 }
+
+                cnt = phba->cfg_iocb_cnt * 1024;
+                /* Initialize and populate the iocb list per host */
+                lpfc_printf_log(phba, KERN_INFO, LOG_INIT,
+                                "2820 initialize iocb list %d total %d\n",
+                                phba->cfg_iocb_cnt, cnt);
+                rc = lpfc_init_iocb_list(phba, cnt);
+                if (rc) {
+                        lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
+                                        "6301 Failed to init iocb list.\n");
+                        goto out_destroy_queue;
+                }
         }
 
         if (phba->nvmet_support && phba->cfg_nvmet_mrq) {
-
                 /* Post initial buffers to all RQs created */
                 for (i = 0; i < phba->cfg_nvmet_mrq; i++) {
                         rqbp = phba->sli4_hba.nvmet_mrq_hdr[i]->rqbp;
                         INIT_LIST_HEAD(&rqbp->rqb_buffer_list);
                         rqbp->rqb_alloc_buffer = lpfc_sli4_nvmet_alloc;
                         rqbp->rqb_free_buffer = lpfc_sli4_nvmet_free;
-                        rqbp->entry_count = 256;
+                        rqbp->entry_count = LPFC_NVMET_RQE_DEF_COUNT;
                         rqbp->buffer_count = 0;
 
-                        /* Divide by 4 and round down to multiple of 16 */
-                        rc = (phba->cfg_nvmet_mrq_post >> 2) & 0xfff8;
-                        phba->sli4_hba.nvmet_mrq_hdr[i]->entry_repost = rc;
-                        phba->sli4_hba.nvmet_mrq_data[i]->entry_repost = rc;
-
                         lpfc_post_rq_buffer(
                                 phba, phba->sli4_hba.nvmet_mrq_hdr[i],
                                 phba->sli4_hba.nvmet_mrq_data[i],
-                                phba->cfg_nvmet_mrq_post);
+                                LPFC_NVMET_RQE_DEF_COUNT, i);
                 }
         }
 
@@ -7077,6 +7150,7 @@ out_unset_queue:
         /* Unset all the queues set up in this routine when error out */
         lpfc_sli4_queue_unset(phba);
 out_destroy_queue:
+        lpfc_free_iocb_list(phba);
         lpfc_sli4_queue_destroy(phba);
 out_stop_timers:
         lpfc_stop_hba_timers(phba);
@@ -8616,8 +8690,11 @@ lpfc_sli4_iocb2wqe(struct lpfc_hba *phba, struct lpfc_iocbq *iocbq,
                 memset(wqe, 0, sizeof(union lpfc_wqe128));
         /* Some of the fields are in the right position already */
         memcpy(wqe, &iocbq->iocb, sizeof(union lpfc_wqe));
-        wqe->generic.wqe_com.word7 = 0; /* The ct field has moved so reset */
-        wqe->generic.wqe_com.word10 = 0;
+        if (iocbq->iocb.ulpCommand != CMD_SEND_FRAME) {
+                /* The ct field has moved so reset */
+                wqe->generic.wqe_com.word7 = 0;
+                wqe->generic.wqe_com.word10 = 0;
+        }
 
         abort_tag = (uint32_t) iocbq->iotag;
         xritag = iocbq->sli4_xritag;
@@ -9111,6 +9188,10 @@ lpfc_sli4_iocb2wqe(struct lpfc_hba *phba, struct lpfc_iocbq *iocbq,
                 }
 
                 break;
+        case CMD_SEND_FRAME:
+                bf_set(wqe_xri_tag, &wqe->generic.wqe_com, xritag);
+                bf_set(wqe_reqtag, &wqe->generic.wqe_com, iocbq->iotag);
+                return 0;
         case CMD_XRI_ABORTED_CX:
         case CMD_CREATE_XRI_CR: /* Do we expect to use this? */
         case CMD_IOCB_FCP_IBIDIR64_CR: /* bidirectional xfer */
@@ -12783,6 +12864,7 @@ lpfc_sli4_sp_handle_rcqe(struct lpfc_hba *phba, struct lpfc_rcqe *rcqe)
         struct fc_frame_header *fc_hdr;
         struct lpfc_queue *hrq = phba->sli4_hba.hdr_rq;
         struct lpfc_queue *drq = phba->sli4_hba.dat_rq;
+        struct lpfc_nvmet_tgtport *tgtp;
         struct hbq_dmabuf *dma_buf;
         uint32_t status, rq_id;
         unsigned long iflags;
@@ -12803,7 +12885,6 @@ lpfc_sli4_sp_handle_rcqe(struct lpfc_hba *phba, struct lpfc_rcqe *rcqe)
         case FC_STATUS_RQ_BUF_LEN_EXCEEDED:
                 lpfc_printf_log(phba, KERN_ERR, LOG_SLI,
                                 "2537 Receive Frame Truncated!!\n");
-                hrq->RQ_buf_trunc++;
         case FC_STATUS_RQ_SUCCESS:
                 lpfc_sli4_rq_release(hrq, drq);
                 spin_lock_irqsave(&phba->hbalock, iflags);
@@ -12814,6 +12895,7 @@ lpfc_sli4_sp_handle_rcqe(struct lpfc_hba *phba, struct lpfc_rcqe *rcqe)
                         goto out;
                 }
                 hrq->RQ_rcv_buf++;
+                hrq->RQ_buf_posted--;
                 memcpy(&dma_buf->cq_event.cqe.rcqe_cmpl, rcqe, sizeof(*rcqe));
 
                 /* If a NVME LS event (type 0x28), treat it as Fast path */
@@ -12827,8 +12909,21 @@ lpfc_sli4_sp_handle_rcqe(struct lpfc_hba *phba, struct lpfc_rcqe *rcqe)
                 spin_unlock_irqrestore(&phba->hbalock, iflags);
                 workposted = true;
                 break;
-        case FC_STATUS_INSUFF_BUF_NEED_BUF:
         case FC_STATUS_INSUFF_BUF_FRM_DISC:
+                if (phba->nvmet_support) {
+                        tgtp = phba->targetport->private;
+                        lpfc_printf_log(phba, KERN_ERR, LOG_SLI | LOG_NVME,
+                                        "6402 RQE Error x%x, posted %d err_cnt "
+                                        "%d: %x %x %x\n",
+                                        status, hrq->RQ_buf_posted,
+                                        hrq->RQ_no_posted_buf,
+                                        atomic_read(&tgtp->rcv_fcp_cmd_in),
+                                        atomic_read(&tgtp->rcv_fcp_cmd_out),
+                                        atomic_read(&tgtp->xmt_fcp_release));
+                }
+                /* fallthrough */
+
+        case FC_STATUS_INSUFF_BUF_NEED_BUF:
                 hrq->RQ_no_posted_buf++;
                 /* Post more buffers if possible */
                 spin_lock_irqsave(&phba->hbalock, iflags);
@@ -12946,7 +13041,7 @@ lpfc_sli4_sp_handle_eqe(struct lpfc_hba *phba, struct lpfc_eqe *eqe,
                 while ((cqe = lpfc_sli4_cq_get(cq))) {
                         workposted |= lpfc_sli4_sp_handle_mcqe(phba, cqe);
                         if (!(++ecount % cq->entry_repost))
-                                lpfc_sli4_cq_release(cq, LPFC_QUEUE_NOARM);
+                                break;
                         cq->CQ_mbox++;
                 }
                 break;
@@ -12960,7 +13055,7 @@ lpfc_sli4_sp_handle_eqe(struct lpfc_hba *phba, struct lpfc_eqe *eqe,
                                 workposted |= lpfc_sli4_sp_handle_cqe(phba, cq,
                                                                       cqe);
                         if (!(++ecount % cq->entry_repost))
-                                lpfc_sli4_cq_release(cq, LPFC_QUEUE_NOARM);
+                                break;
                 }
 
                 /* Track the max number of CQEs processed in 1 EQ */
@@ -13130,6 +13225,7 @@ lpfc_sli4_nvmet_handle_rcqe(struct lpfc_hba *phba, struct lpfc_queue *cq,
         struct lpfc_queue *drq;
         struct rqb_dmabuf *dma_buf;
         struct fc_frame_header *fc_hdr;
+        struct lpfc_nvmet_tgtport *tgtp;
         uint32_t status, rq_id;
         unsigned long iflags;
         uint32_t fctl, idx;
@@ -13160,8 +13256,6 @@ lpfc_sli4_nvmet_handle_rcqe(struct lpfc_hba *phba, struct lpfc_queue *cq,
         case FC_STATUS_RQ_BUF_LEN_EXCEEDED:
                 lpfc_printf_log(phba, KERN_ERR, LOG_SLI,
                                 "6126 Receive Frame Truncated!!\n");
-                hrq->RQ_buf_trunc++;
-                break;
         case FC_STATUS_RQ_SUCCESS:
                 lpfc_sli4_rq_release(hrq, drq);
                 spin_lock_irqsave(&phba->hbalock, iflags);
@@ -13173,6 +13267,7 @@ lpfc_sli4_nvmet_handle_rcqe(struct lpfc_hba *phba, struct lpfc_queue *cq,
                 }
                 spin_unlock_irqrestore(&phba->hbalock, iflags);
                 hrq->RQ_rcv_buf++;
+                hrq->RQ_buf_posted--;
                 fc_hdr = (struct fc_frame_header *)dma_buf->hbuf.virt;
 
                 /* Just some basic sanity checks on FCP Command frame */
@@ -13195,14 +13290,23 @@ lpfc_sli4_nvmet_handle_rcqe(struct lpfc_hba *phba, struct lpfc_queue *cq,
 drop:
                 lpfc_in_buf_free(phba, &dma_buf->dbuf);
                 break;
-        case FC_STATUS_INSUFF_BUF_NEED_BUF:
         case FC_STATUS_INSUFF_BUF_FRM_DISC:
+                if (phba->nvmet_support) {
+                        tgtp = phba->targetport->private;
+                        lpfc_printf_log(phba, KERN_ERR, LOG_SLI | LOG_NVME,
+                                        "6401 RQE Error x%x, posted %d err_cnt "
+                                        "%d: %x %x %x\n",
+                                        status, hrq->RQ_buf_posted,
+                                        hrq->RQ_no_posted_buf,
+                                        atomic_read(&tgtp->rcv_fcp_cmd_in),
+                                        atomic_read(&tgtp->rcv_fcp_cmd_out),
+                                        atomic_read(&tgtp->xmt_fcp_release));
+                }
+                /* fallthrough */
+
+        case FC_STATUS_INSUFF_BUF_NEED_BUF:
                 hrq->RQ_no_posted_buf++;
                 /* Post more buffers if possible */
-                spin_lock_irqsave(&phba->hbalock, iflags);
-                phba->hba_flag |= HBA_POST_RECEIVE_BUFFER;
-                spin_unlock_irqrestore(&phba->hbalock, iflags);
-                workposted = true;
                 break;
         }
 out:
@@ -13356,7 +13460,7 @@ process_cq:
         while ((cqe = lpfc_sli4_cq_get(cq))) {
                 workposted |= lpfc_sli4_fp_handle_cqe(phba, cq, cqe);
                 if (!(++ecount % cq->entry_repost))
-                        lpfc_sli4_cq_release(cq, LPFC_QUEUE_NOARM);
+                        break;
         }
 
         /* Track the max number of CQEs processed in 1 EQ */
@@ -13447,7 +13551,7 @@ lpfc_sli4_fof_handle_eqe(struct lpfc_hba *phba, struct lpfc_eqe *eqe)
         while ((cqe = lpfc_sli4_cq_get(cq))) {
                 workposted |= lpfc_sli4_fp_handle_cqe(phba, cq, cqe);
                 if (!(++ecount % cq->entry_repost))
-                        lpfc_sli4_cq_release(cq, LPFC_QUEUE_NOARM);
+                        break;
         }
 
         /* Track the max number of CQEs processed in 1 EQ */
@@ -13529,7 +13633,7 @@ lpfc_sli4_fof_intr_handler(int irq, void *dev_id)
         while ((eqe = lpfc_sli4_eq_get(eq))) {
                 lpfc_sli4_fof_handle_eqe(phba, eqe);
                 if (!(++ecount % eq->entry_repost))
-                        lpfc_sli4_eq_release(eq, LPFC_QUEUE_NOARM);
+                        break;
                 eq->EQ_processed++;
         }
 
@@ -13646,7 +13750,7 @@ lpfc_sli4_hba_intr_handler(int irq, void *dev_id)
 
                 lpfc_sli4_hba_handle_eqe(phba, eqe, hba_eqidx);
                 if (!(++ecount % fpeq->entry_repost))
-                        lpfc_sli4_eq_release(fpeq, LPFC_QUEUE_NOARM);
+                        break;
                 fpeq->EQ_processed++;
         }
 
@@ -13827,17 +13931,10 @@ lpfc_sli4_queue_alloc(struct lpfc_hba *phba, uint32_t entry_size,
         }
         queue->entry_size = entry_size;
         queue->entry_count = entry_count;
-
-        /*
-         * entry_repost is calculated based on the number of entries in the
-         * queue. This works out except for RQs. If buffers are NOT initially
-         * posted for every RQE, entry_repost should be adjusted accordingly.
-         */
-        queue->entry_repost = (entry_count >> 3);
-        if (queue->entry_repost < LPFC_QUEUE_MIN_REPOST)
-                queue->entry_repost = LPFC_QUEUE_MIN_REPOST;
         queue->phba = phba;
 
+        /* entry_repost will be set during q creation */
+
         return queue;
 out_fail:
         lpfc_sli4_queue_free(queue);
@@ -14068,6 +14165,7 @@ lpfc_eq_create(struct lpfc_hba *phba, struct lpfc_queue *eq, uint32_t imax)
                 status = -ENXIO;
         eq->host_index = 0;
         eq->hba_index = 0;
+        eq->entry_repost = LPFC_EQ_REPOST;
 
         mempool_free(mbox, phba->mbox_mem_pool);
         return status;
@@ -14141,9 +14239,9 @@ lpfc_cq_create(struct lpfc_hba *phba, struct lpfc_queue *cq,
         default:
                 lpfc_printf_log(phba, KERN_ERR, LOG_SLI,
                                 "0361 Unsupported CQ count: "
-                                "entry cnt %d sz %d pg cnt %d repost %d\n",
+                                "entry cnt %d sz %d pg cnt %d\n",
                                 cq->entry_count, cq->entry_size,
-                                cq->page_count, cq->entry_repost);
+                                cq->page_count);
                 if (cq->entry_count < 256) {
                         status = -EINVAL;
                         goto out;
@@ -14196,6 +14294,7 @@ lpfc_cq_create(struct lpfc_hba *phba, struct lpfc_queue *cq,
         cq->assoc_qid = eq->queue_id;
         cq->host_index = 0;
         cq->hba_index = 0;
+        cq->entry_repost = LPFC_CQ_REPOST;
 
 out:
         mempool_free(mbox, phba->mbox_mem_pool);
@@ -14387,6 +14486,7 @@ lpfc_cq_create_set(struct lpfc_hba *phba, struct lpfc_queue **cqp,
                 cq->assoc_qid = eq->queue_id;
                 cq->host_index = 0;
                 cq->hba_index = 0;
+                cq->entry_repost = LPFC_CQ_REPOST;
 
                 rc = 0;
                 list_for_each_entry(dmabuf, &cq->page_list, list) {
@@ -14635,6 +14735,7 @@ lpfc_mq_create(struct lpfc_hba *phba, struct lpfc_queue *mq,
         mq->subtype = subtype;
         mq->host_index = 0;
         mq->hba_index = 0;
+        mq->entry_repost = LPFC_MQ_REPOST;
 
         /* link the mq onto the parent cq child list */
         list_add_tail(&mq->list, &cq->child_list);
@@ -14860,34 +14961,6 @@ out:
 }
 
 /**
- * lpfc_rq_adjust_repost - Adjust entry_repost for an RQ
- * @phba: HBA structure that indicates port to create a queue on.
- * @rq:   The queue structure to use for the receive queue.
- * @qno:  The associated HBQ number
- *
- *
- * For SLI4 we need to adjust the RQ repost value based on
- * the number of buffers that are initially posted to the RQ.
- */
-void
-lpfc_rq_adjust_repost(struct lpfc_hba *phba, struct lpfc_queue *rq, int qno)
-{
-        uint32_t cnt;
-
-        /* sanity check on queue memory */
-        if (!rq)
-                return;
-        cnt = lpfc_hbq_defs[qno]->entry_count;
-
-        /* Recalc repost for RQs based on buffers initially posted */
-        cnt = (cnt >> 3);
-        if (cnt < LPFC_QUEUE_MIN_REPOST)
-                cnt = LPFC_QUEUE_MIN_REPOST;
-
-        rq->entry_repost = cnt;
-}
-
-/**
  * lpfc_rq_create - Create a Receive Queue on the HBA
  * @phba: HBA structure that indicates port to create a queue on.
  * @hrq: The queue structure to use to create the header receive queue.
@@ -15072,6 +15145,7 @@ lpfc_rq_create(struct lpfc_hba *phba, struct lpfc_queue *hrq,
         hrq->subtype = subtype;
         hrq->host_index = 0;
         hrq->hba_index = 0;
+        hrq->entry_repost = LPFC_RQ_REPOST;
 
         /* now create the data queue */
         lpfc_sli4_config(phba, mbox, LPFC_MBOX_SUBSYSTEM_FCOE,
@@ -15082,7 +15156,12 @@ lpfc_rq_create(struct lpfc_hba *phba, struct lpfc_queue *hrq,
         if (phba->sli4_hba.pc_sli4_params.rqv == LPFC_Q_CREATE_VERSION_1) {
                 bf_set(lpfc_rq_context_rqe_count_1,
                        &rq_create->u.request.context, hrq->entry_count);
-                rq_create->u.request.context.buffer_size = LPFC_DATA_BUF_SIZE;
+                if (subtype == LPFC_NVMET)
+                        rq_create->u.request.context.buffer_size =
+                                LPFC_NVMET_DATA_BUF_SIZE;
+                else
+                        rq_create->u.request.context.buffer_size =
+                                LPFC_DATA_BUF_SIZE;
                 bf_set(lpfc_rq_context_rqe_size, &rq_create->u.request.context,
                        LPFC_RQE_SIZE_8);
                 bf_set(lpfc_rq_context_page_size, &rq_create->u.request.context,
@@ -15119,8 +15198,14 @@ lpfc_rq_create(struct lpfc_hba *phba, struct lpfc_queue *hrq,
                                LPFC_RQ_RING_SIZE_4096);
                         break;
                 }
-                bf_set(lpfc_rq_context_buf_size, &rq_create->u.request.context,
-                       LPFC_DATA_BUF_SIZE);
+                if (subtype == LPFC_NVMET)
+                        bf_set(lpfc_rq_context_buf_size,
+                               &rq_create->u.request.context,
+                               LPFC_NVMET_DATA_BUF_SIZE);
+                else
+                        bf_set(lpfc_rq_context_buf_size,
+                               &rq_create->u.request.context,
+                               LPFC_DATA_BUF_SIZE);
         }
         bf_set(lpfc_rq_context_cq_id, &rq_create->u.request.context,
                cq->queue_id);
@@ -15153,6 +15238,7 @@ lpfc_rq_create(struct lpfc_hba *phba, struct lpfc_queue *hrq,
         drq->subtype = subtype;
         drq->host_index = 0;
         drq->hba_index = 0;
+        drq->entry_repost = LPFC_RQ_REPOST;
 
         /* link the header and data RQs onto the parent cq child list */
         list_add_tail(&hrq->list, &cq->child_list);
@@ -15265,7 +15351,7 @@ lpfc_mrq_create(struct lpfc_hba *phba, struct lpfc_queue **hrqp,
                                cq->queue_id);
                         bf_set(lpfc_rq_context_data_size,
                                &rq_create->u.request.context,
-                               LPFC_DATA_BUF_SIZE);
+                               LPFC_NVMET_DATA_BUF_SIZE);
                         bf_set(lpfc_rq_context_hdr_size,
                                &rq_create->u.request.context,
                                LPFC_HDR_BUF_SIZE);
@@ -15310,6 +15396,7 @@ lpfc_mrq_create(struct lpfc_hba *phba, struct lpfc_queue **hrqp,
                 hrq->subtype = subtype;
                 hrq->host_index = 0;
                 hrq->hba_index = 0;
+                hrq->entry_repost = LPFC_RQ_REPOST;
 
                 drq->db_format = LPFC_DB_RING_FORMAT;
                 drq->db_regaddr = phba->sli4_hba.RQDBregaddr;
@@ -15318,6 +15405,7 @@ lpfc_mrq_create(struct lpfc_hba *phba, struct lpfc_queue **hrqp,
                 drq->subtype = subtype;
                 drq->host_index = 0;
                 drq->hba_index = 0;
+                drq->entry_repost = LPFC_RQ_REPOST;
 
                 list_add_tail(&hrq->list, &cq->child_list);
                 list_add_tail(&drq->list, &cq->child_list);
@@ -16058,6 +16146,8 @@ lpfc_fc_frame_check(struct lpfc_hba *phba, struct fc_frame_header *fc_hdr)
         struct fc_vft_header *fc_vft_hdr;
         uint32_t *header = (uint32_t *) fc_hdr;
 
+#define FC_RCTL_MDS_DIAGS       0xF4
+
         switch (fc_hdr->fh_r_ctl) {
         case FC_RCTL_DD_UNCAT:          /* uncategorized information */
         case FC_RCTL_DD_SOL_DATA:       /* solicited data */
@@ -16085,6 +16175,7 @@ lpfc_fc_frame_check(struct lpfc_hba *phba, struct fc_frame_header *fc_hdr)
         case FC_RCTL_F_BSY:     /* fabric busy to data frame */
         case FC_RCTL_F_BSYL:    /* fabric busy to link control frame */
         case FC_RCTL_LCR:       /* link credit reset */
+        case FC_RCTL_MDS_DIAGS: /* MDS Diagnostics */
         case FC_RCTL_END:       /* end */
                 break;
         case FC_RCTL_VFTH:      /* Virtual Fabric tagging Header */
@@ -16094,12 +16185,16 @@ lpfc_fc_frame_check(struct lpfc_hba *phba, struct fc_frame_header *fc_hdr)
         default:
                 goto drop;
         }
+
+#define FC_TYPE_VENDOR_UNIQUE   0xFF
+
         switch (fc_hdr->fh_type) {
         case FC_TYPE_BLS:
         case FC_TYPE_ELS:
         case FC_TYPE_FCP:
         case FC_TYPE_CT:
         case FC_TYPE_NVME:
+        case FC_TYPE_VENDOR_UNIQUE:
                 break;
         case FC_TYPE_IP:
         case FC_TYPE_ILS:
@@ -16110,12 +16205,14 @@ lpfc_fc_frame_check(struct lpfc_hba *phba, struct fc_frame_header *fc_hdr)
         lpfc_printf_log(phba, KERN_INFO, LOG_ELS,
                         "2538 Received frame rctl:%s (x%x), type:%s (x%x), "
                         "frame Data:%08x %08x %08x %08x %08x %08x %08x\n",
+                        (fc_hdr->fh_r_ctl == FC_RCTL_MDS_DIAGS) ? "MDS Diags" :
                         lpfc_rctl_names[fc_hdr->fh_r_ctl], fc_hdr->fh_r_ctl,
-                        lpfc_type_names[fc_hdr->fh_type], fc_hdr->fh_type,
-                        be32_to_cpu(header[0]), be32_to_cpu(header[1]),
-                        be32_to_cpu(header[2]), be32_to_cpu(header[3]),
-                        be32_to_cpu(header[4]), be32_to_cpu(header[5]),
-                        be32_to_cpu(header[6]));
+                        (fc_hdr->fh_type == FC_TYPE_VENDOR_UNIQUE) ?
+                        "Vendor Unique" : lpfc_type_names[fc_hdr->fh_type],
+                        fc_hdr->fh_type, be32_to_cpu(header[0]),
+                        be32_to_cpu(header[1]), be32_to_cpu(header[2]),
+                        be32_to_cpu(header[3]), be32_to_cpu(header[4]),
+                        be32_to_cpu(header[5]), be32_to_cpu(header[6]));
         return 0;
 drop:
         lpfc_printf_log(phba, KERN_WARNING, LOG_ELS,
@@ -16921,6 +17018,96 @@ lpfc_sli4_send_seq_to_ulp(struct lpfc_vport *vport,
         lpfc_sli_release_iocbq(phba, iocbq);
 }
 
+static void
+lpfc_sli4_mds_loopback_cmpl(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,
+                            struct lpfc_iocbq *rspiocb)
+{
+        struct lpfc_dmabuf *pcmd = cmdiocb->context2;
+
+        if (pcmd && pcmd->virt)
+                pci_pool_free(phba->lpfc_drb_pool, pcmd->virt, pcmd->phys);
+        kfree(pcmd);
+        lpfc_sli_release_iocbq(phba, cmdiocb);
+}
+
+static void
+lpfc_sli4_handle_mds_loopback(struct lpfc_vport *vport,
+                              struct hbq_dmabuf *dmabuf)
+{
+        struct fc_frame_header *fc_hdr;
+        struct lpfc_hba *phba = vport->phba;
+        struct lpfc_iocbq *iocbq = NULL;
+        union  lpfc_wqe *wqe;
+        struct lpfc_dmabuf *pcmd = NULL;
+        uint32_t frame_len;
+        int rc;
+
+        fc_hdr = (struct fc_frame_header *)dmabuf->hbuf.virt;
+        frame_len = bf_get(lpfc_rcqe_length, &dmabuf->cq_event.cqe.rcqe_cmpl);
+
+        /* Send the received frame back */
+        iocbq = lpfc_sli_get_iocbq(phba);
+        if (!iocbq)
+                goto exit;
+
+        /* Allocate buffer for command payload */
+        pcmd = kmalloc(sizeof(struct lpfc_dmabuf), GFP_KERNEL);
+        if (pcmd)
+                pcmd->virt = pci_pool_alloc(phba->lpfc_drb_pool, GFP_KERNEL,
+                                            &pcmd->phys);
+        if (!pcmd || !pcmd->virt)
+                goto exit;
+
+        INIT_LIST_HEAD(&pcmd->list);
+
+        /* copyin the payload */
+        memcpy(pcmd->virt, dmabuf->dbuf.virt, frame_len);
+
+        /* fill in BDE's for command */
+        iocbq->iocb.un.xseq64.bdl.addrHigh = putPaddrHigh(pcmd->phys);
+        iocbq->iocb.un.xseq64.bdl.addrLow = putPaddrLow(pcmd->phys);
+        iocbq->iocb.un.xseq64.bdl.bdeFlags = BUFF_TYPE_BDE_64;
+        iocbq->iocb.un.xseq64.bdl.bdeSize = frame_len;
+
+        iocbq->context2 = pcmd;
+        iocbq->vport = vport;
+        iocbq->iocb_flag &= ~LPFC_FIP_ELS_ID_MASK;
+        iocbq->iocb_flag |= LPFC_USE_FCPWQIDX;
+
+        /*
+         * Setup rest of the iocb as though it were a WQE
+         * Build the SEND_FRAME WQE
+         */
+        wqe = (union lpfc_wqe *)&iocbq->iocb;
+
+        wqe->send_frame.frame_len = frame_len;
+        wqe->send_frame.fc_hdr_wd0 = be32_to_cpu(*((uint32_t *)fc_hdr));
+        wqe->send_frame.fc_hdr_wd1 = be32_to_cpu(*((uint32_t *)fc_hdr + 1));
+        wqe->send_frame.fc_hdr_wd2 = be32_to_cpu(*((uint32_t *)fc_hdr + 2));
+        wqe->send_frame.fc_hdr_wd3 = be32_to_cpu(*((uint32_t *)fc_hdr + 3));
+        wqe->send_frame.fc_hdr_wd4 = be32_to_cpu(*((uint32_t *)fc_hdr + 4));
+        wqe->send_frame.fc_hdr_wd5 = be32_to_cpu(*((uint32_t *)fc_hdr + 5));
+
+        iocbq->iocb.ulpCommand = CMD_SEND_FRAME;
+        iocbq->iocb.ulpLe = 1;
+        iocbq->iocb_cmpl = lpfc_sli4_mds_loopback_cmpl;
+        rc = lpfc_sli_issue_iocb(phba, LPFC_ELS_RING, iocbq, 0);
+        if (rc == IOCB_ERROR)
+                goto exit;
+
+        lpfc_in_buf_free(phba, &dmabuf->dbuf);
+        return;
+
+exit:
+        lpfc_printf_log(phba, KERN_WARNING, LOG_SLI,
+                        "2023 Unable to process MDS loopback frame\n");
+        if (pcmd && pcmd->virt)
+                pci_pool_free(phba->lpfc_drb_pool, pcmd->virt, pcmd->phys);
+        kfree(pcmd);
+        lpfc_sli_release_iocbq(phba, iocbq);
+        lpfc_in_buf_free(phba, &dmabuf->dbuf);
+}
+
 /**
  * lpfc_sli4_handle_received_buffer - Handle received buffers from firmware
  * @phba: Pointer to HBA context object.
@@ -16959,6 +17146,13 @@ lpfc_sli4_handle_received_buffer(struct lpfc_hba *phba,
                 fcfi = bf_get(lpfc_rcqe_fcf_id,
                               &dmabuf->cq_event.cqe.rcqe_cmpl);
 
+        if (fc_hdr->fh_r_ctl == 0xF4 && fc_hdr->fh_type == 0xFF) {
+                vport = phba->pport;
+                /* Handle MDS Loopback frames */
+                lpfc_sli4_handle_mds_loopback(vport, dmabuf);
+                return;
+        }
+
         /* d_id this frame is directed to */
         did = sli4_did_from_fc_hdr(fc_hdr);
 
@@ -17132,6 +17326,14 @@ lpfc_sli4_post_rpi_hdr(struct lpfc_hba *phba, struct lpfc_rpi_hdr *rpi_page)
                                 "status x%x add_status x%x, mbx status x%x\n",
                                 shdr_status, shdr_add_status, rc);
                 rc = -ENXIO;
+        } else {
+                /*
+                 * The next_rpi stores the next logical module-64 rpi value used
+                 * to post physical rpis in subsequent rpi postings.
+                 */
+                spin_lock_irq(&phba->hbalock);
+                phba->sli4_hba.next_rpi = rpi_page->next_rpi;
+                spin_unlock_irq(&phba->hbalock);
         }
         return rc;
 }
@@ -18712,7 +18914,7 @@ lpfc_sli4_issue_wqe(struct lpfc_hba *phba, uint32_t ring_number,
 
                 spin_lock_irqsave(&pring->ring_lock, iflags);
                 ctxp = pwqe->context2;
-                sglq = ctxp->rqb_buffer->sglq;
+                sglq = ctxp->ctxbuf->sglq;
                 if (pwqe->sli4_xritag ==  NO_XRI) {
                         pwqe->sli4_lxritag = sglq->sli4_lxritag;
                         pwqe->sli4_xritag = sglq->sli4_xritag;
diff --git a/drivers/scsi/lpfc/lpfc_sli4.h b/drivers/scsi/lpfc/lpfc_sli4.h
index da46471337c8..cf863db27700 100644
--- a/drivers/scsi/lpfc/lpfc_sli4.h
+++ b/drivers/scsi/lpfc/lpfc_sli4.h
@@ -24,7 +24,6 @@
 #define LPFC_XRI_EXCH_BUSY_WAIT_TMO             10000
 #define LPFC_XRI_EXCH_BUSY_WAIT_T1              10
 #define LPFC_XRI_EXCH_BUSY_WAIT_T2              30000
-#define LPFC_RELEASE_NOTIFICATION_INTERVAL      32
 #define LPFC_RPI_LOW_WATER_MARK                 10
 
 #define LPFC_UNREG_FCF                          1
@@ -155,7 +154,11 @@ struct lpfc_queue {
         uint32_t entry_count;   /* Number of entries to support on the queue */
         uint32_t entry_size;    /* Size of each queue entry. */
         uint32_t entry_repost;  /* Count of entries before doorbell is rung */
-#define LPFC_QUEUE_MIN_REPOST   8
+#define LPFC_EQ_REPOST          8
+#define LPFC_MQ_REPOST          8
+#define LPFC_CQ_REPOST          64
+#define LPFC_RQ_REPOST          64
+#define LPFC_RELEASE_NOTIFICATION_INTERVAL      32  /* For WQs */
         uint32_t queue_id;      /* Queue ID assigned by the hardware */
         uint32_t assoc_qid;     /* Queue ID associated with, for CQ/WQ/MQ */
         uint32_t page_count;    /* Number of pages allocated for this queue */
@@ -195,7 +198,7 @@ struct lpfc_queue {
 /* defines for RQ stats */
 #define RQ_no_posted_buf        q_cnt_1
 #define RQ_no_buf_found         q_cnt_2
-#define RQ_buf_trunc            q_cnt_3
+#define RQ_buf_posted           q_cnt_3
 #define RQ_rcv_buf              q_cnt_4
 
         uint64_t isr_timestamp;
@@ -617,12 +620,17 @@ struct lpfc_sli4_hba {
         uint16_t scsi_xri_start;
         uint16_t els_xri_cnt;
         uint16_t nvmet_xri_cnt;
+        uint16_t nvmet_ctx_cnt;
+        uint16_t nvmet_io_wait_cnt;
+        uint16_t nvmet_io_wait_total;
         struct list_head lpfc_els_sgl_list;
         struct list_head lpfc_abts_els_sgl_list;
         struct list_head lpfc_nvmet_sgl_list;
         struct list_head lpfc_abts_nvmet_ctx_list;
         struct list_head lpfc_abts_scsi_buf_list;
         struct list_head lpfc_abts_nvme_buf_list;
+        struct list_head lpfc_nvmet_ctx_list;
+        struct list_head lpfc_nvmet_io_wait_list;
         struct lpfc_sglq **lpfc_sglq_active_list;
         struct list_head lpfc_rpi_hdr_list;
         unsigned long *rpi_bmask;
@@ -654,6 +662,7 @@ struct lpfc_sli4_hba {
         spinlock_t abts_scsi_buf_list_lock; /* list of aborted SCSI IOs */
         spinlock_t sgl_list_lock; /* list of aborted els IOs */
         spinlock_t nvmet_io_lock;
+        spinlock_t nvmet_io_wait_lock; /* IOs waiting for ctx resources */
         uint32_t physical_port;
 
         /* CPU to vector mapping information */
@@ -661,8 +670,6 @@ struct lpfc_sli4_hba {
         uint16_t num_online_cpu;
         uint16_t num_present_cpu;
         uint16_t curr_disp_cpu;
-
-        uint16_t nvmet_mrq_post_idx;
 };
 
 enum lpfc_sge_type {
@@ -698,6 +705,7 @@ struct lpfc_rpi_hdr {
         struct lpfc_dmabuf *dmabuf;
         uint32_t page_count;
         uint32_t start_rpi;
+        uint16_t next_rpi;
 };
 
 struct lpfc_rsrc_blks {
@@ -762,7 +770,6 @@ int lpfc_rq_create(struct lpfc_hba *, struct lpfc_queue *,
 int lpfc_mrq_create(struct lpfc_hba *phba, struct lpfc_queue **hrqp,
                         struct lpfc_queue **drqp, struct lpfc_queue **cqp,
                         uint32_t subtype);
-void lpfc_rq_adjust_repost(struct lpfc_hba *, struct lpfc_queue *, int);
 int lpfc_eq_destroy(struct lpfc_hba *, struct lpfc_queue *);
 int lpfc_cq_destroy(struct lpfc_hba *, struct lpfc_queue *);
 int lpfc_mq_destroy(struct lpfc_hba *, struct lpfc_queue *);
diff --git a/drivers/scsi/lpfc/lpfc_version.h b/drivers/scsi/lpfc/lpfc_version.h
index 1c26dc67151b..c2653244221c 100644
--- a/drivers/scsi/lpfc/lpfc_version.h
+++ b/drivers/scsi/lpfc/lpfc_version.h
@@ -20,7 +20,7 @@
  * included with this package.                                     *
  *******************************************************************/
 
-#define LPFC_DRIVER_VERSION "11.2.0.12"
+#define LPFC_DRIVER_VERSION "11.2.0.14"
 #define LPFC_DRIVER_NAME                "lpfc"
 
 /* Used for SLI 2/3 */
diff --git a/drivers/scsi/pmcraid.c b/drivers/scsi/pmcraid.c
index a4aadf5f4dc6..1cc814f1505a 100644
--- a/drivers/scsi/pmcraid.c
+++ b/drivers/scsi/pmcraid.c
@@ -3770,9 +3770,6 @@ static long pmcraid_ioctl_passthrough(
                         pmcraid_err("couldn't build passthrough ioadls\n");
                         goto out_free_cmd;
                 }
-        } else if (request_size < 0) {
-                rc = -EINVAL;
-                goto out_free_cmd;
         }
 
         /* If data is being written into the device, copy the data from user
diff --git a/drivers/scsi/qedf/qedf.h b/drivers/scsi/qedf/qedf.h
index 40aeb6bb96a2..07ee88200e91 100644
--- a/drivers/scsi/qedf/qedf.h
+++ b/drivers/scsi/qedf/qedf.h
@@ -259,7 +259,7 @@ struct qedf_io_log {
         uint16_t task_id;
         uint32_t port_id; /* Remote port fabric ID */
         int lun;
-        char op; /* SCSI CDB */
+        unsigned char op; /* SCSI CDB */
         uint8_t lba[4];
         unsigned int bufflen; /* SCSI buffer length */
         unsigned int sg_count; /* Number of SG elements */
diff --git a/drivers/scsi/qedf/qedf_els.c b/drivers/scsi/qedf/qedf_els.c
index c505d41f6dc8..90627033bde6 100644
--- a/drivers/scsi/qedf/qedf_els.c
+++ b/drivers/scsi/qedf/qedf_els.c
@@ -109,7 +109,7 @@ retry_els:
         did = fcport->rdata->ids.port_id;
         sid = fcport->sid;
 
-        __fc_fill_fc_hdr(fc_hdr, FC_RCTL_ELS_REQ, sid, did,
+        __fc_fill_fc_hdr(fc_hdr, FC_RCTL_ELS_REQ, did, sid,
                            FC_TYPE_ELS, FC_FC_FIRST_SEQ | FC_FC_END_SEQ |
                            FC_FC_SEQ_INIT, 0);
 
diff --git a/drivers/scsi/qedf/qedf_main.c b/drivers/scsi/qedf/qedf_main.c
index cceddd995a4b..a5c97342fd5d 100644
--- a/drivers/scsi/qedf/qedf_main.c
+++ b/drivers/scsi/qedf/qedf_main.c
@@ -2895,7 +2895,7 @@ static int __qedf_probe(struct pci_dev *pdev, int mode)
         slowpath_params.drv_minor = QEDF_DRIVER_MINOR_VER;
         slowpath_params.drv_rev = QEDF_DRIVER_REV_VER;
         slowpath_params.drv_eng = QEDF_DRIVER_ENG_VER;
-        memcpy(slowpath_params.name, "qedf", QED_DRV_VER_STR_SIZE);
+        strncpy(slowpath_params.name, "qedf", QED_DRV_VER_STR_SIZE);
         rc = qed_ops->common->slowpath_start(qedf->cdev, &slowpath_params);
         if (rc) {
                 QEDF_ERR(&(qedf->dbg_ctx), "Cannot start slowpath.\n");
diff --git a/drivers/scsi/scsi.c b/drivers/scsi/scsi.c
index 7bfbcfa7af40..61cdd99ae41e 100644
--- a/drivers/scsi/scsi.c
+++ b/drivers/scsi/scsi.c
@@ -763,6 +763,8 @@ struct scsi_device *__scsi_device_lookup(struct Scsi_Host *shost,
         struct scsi_device *sdev;
 
         list_for_each_entry(sdev, &shost->__devices, siblings) {
+                if (sdev->sdev_state == SDEV_DEL)
+                        continue;
                 if (sdev->channel == channel && sdev->id == id &&
                                 sdev->lun ==lun)
                         return sdev;
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index 814a4bd8405d..99e16ac479e3 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -30,6 +30,7 @@
 #include <scsi/scsi_driver.h>
 #include <scsi/scsi_eh.h>
 #include <scsi/scsi_host.h>
+#include <scsi/scsi_transport.h> /* __scsi_init_queue() */
 #include <scsi/scsi_dh.h>
 
 #include <trace/events/scsi.h>
@@ -1850,7 +1851,7 @@ static int scsi_mq_prep_fn(struct request *req)
 
         /* zero out the cmd, except for the embedded scsi_request */
         memset((char *)cmd + sizeof(cmd->req), 0,
-                sizeof(*cmd) - sizeof(cmd->req));
+                sizeof(*cmd) - sizeof(cmd->req) + shost->hostt->cmd_size);
 
         req->special = cmd;
 
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index f9d1432d7cc5..b6bb4e0ce0e3 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -827,21 +827,32 @@ static int sd_setup_write_zeroes_cmnd(struct scsi_cmnd *cmd)
         struct scsi_disk *sdkp = scsi_disk(rq->rq_disk);
         u64 sector = blk_rq_pos(rq) >> (ilog2(sdp->sector_size) - 9);
         u32 nr_sectors = blk_rq_sectors(rq) >> (ilog2(sdp->sector_size) - 9);
+        int ret;
 
         if (!(rq->cmd_flags & REQ_NOUNMAP)) {
                 switch (sdkp->zeroing_mode) {
                 case SD_ZERO_WS16_UNMAP:
-                        return sd_setup_write_same16_cmnd(cmd, true);
+                        ret = sd_setup_write_same16_cmnd(cmd, true);
+                        goto out;
                 case SD_ZERO_WS10_UNMAP:
-                        return sd_setup_write_same10_cmnd(cmd, true);
+                        ret = sd_setup_write_same10_cmnd(cmd, true);
+                        goto out;
                 }
         }
 
         if (sdp->no_write_same)
                 return BLKPREP_INVALID;
+
         if (sdkp->ws16 || sector > 0xffffffff || nr_sectors > 0xffff)
-                return sd_setup_write_same16_cmnd(cmd, false);
-        return sd_setup_write_same10_cmnd(cmd, false);
+                ret = sd_setup_write_same16_cmnd(cmd, false);
+        else
+                ret = sd_setup_write_same10_cmnd(cmd, false);
+
+out:
+        if (sd_is_zoned(sdkp) && ret == BLKPREP_OK)
+                return sd_zbc_write_lock_zone(cmd);
+
+        return ret;
 }
 
 static void sd_config_write_same(struct scsi_disk *sdkp)
@@ -948,6 +959,10 @@ static int sd_setup_write_same_cmnd(struct scsi_cmnd *cmd)
         rq->__data_len = sdp->sector_size;
         ret = scsi_init_io(cmd);
         rq->__data_len = nr_bytes;
+
+        if (sd_is_zoned(sdkp) && ret != BLKPREP_OK)
+                sd_zbc_write_unlock_zone(cmd);
+
         return ret;
 }
 
@@ -1567,17 +1582,21 @@ out:
         return retval;
 }
 
-static int sd_sync_cache(struct scsi_disk *sdkp)
+static int sd_sync_cache(struct scsi_disk *sdkp, struct scsi_sense_hdr *sshdr)
 {
         int retries, res;
         struct scsi_device *sdp = sdkp->device;
         const int timeout = sdp->request_queue->rq_timeout
                 * SD_FLUSH_TIMEOUT_MULTIPLIER;
-        struct scsi_sense_hdr sshdr;
+        struct scsi_sense_hdr my_sshdr;
 
         if (!scsi_device_online(sdp))
                 return -ENODEV;
 
+        /* caller might not be interested in sense, but we need it */
+        if (!sshdr)
+                sshdr = &my_sshdr;
+
         for (retries = 3; retries > 0; --retries) {
                 unsigned char cmd[10] = { 0 };
 
@@ -1586,7 +1605,7 @@ static int sd_sync_cache(struct scsi_disk *sdkp)
                  * Leave the rest of the command zero to indicate
                  * flush everything.
                  */
-                res = scsi_execute(sdp, cmd, DMA_NONE, NULL, 0, NULL, &sshdr,
+                res = scsi_execute(sdp, cmd, DMA_NONE, NULL, 0, NULL, sshdr,
                                 timeout, SD_MAX_RETRIES, 0, RQF_PM, NULL);
                 if (res == 0)
                         break;
@@ -1596,11 +1615,12 @@ static int sd_sync_cache(struct scsi_disk *sdkp)
                 sd_print_result(sdkp, "Synchronize Cache(10) failed", res);
 
                 if (driver_byte(res) & DRIVER_SENSE)
-                        sd_print_sense_hdr(sdkp, &sshdr);
+                        sd_print_sense_hdr(sdkp, sshdr);
+
                 /* we need to evaluate the error return  */
-                if (scsi_sense_valid(&sshdr) &&
-                        (sshdr.asc == 0x3a ||   /* medium not present */
-                         sshdr.asc == 0x20))    /* invalid command */
+                if (scsi_sense_valid(sshdr) &&
+                        (sshdr->asc == 0x3a ||  /* medium not present */
+                         sshdr->asc == 0x20))   /* invalid command */
                                 /* this is no error here */
                                 return 0;
 
@@ -3444,7 +3464,7 @@ static void sd_shutdown(struct device *dev)
 
         if (sdkp->WCE && sdkp->media_present) {
                 sd_printk(KERN_NOTICE, sdkp, "Synchronizing SCSI cache\n");
-                sd_sync_cache(sdkp);
+                sd_sync_cache(sdkp, NULL);
         }
 
         if (system_state != SYSTEM_RESTART && sdkp->device->manage_start_stop) {
@@ -3456,6 +3476,7 @@ static void sd_shutdown(struct device *dev)
 static int sd_suspend_common(struct device *dev, bool ignore_stop_errors)
 {
         struct scsi_disk *sdkp = dev_get_drvdata(dev);
+        struct scsi_sense_hdr sshdr;
         int ret = 0;
 
         if (!sdkp)      /* E.g.: runtime suspend following sd_remove() */
@@ -3463,12 +3484,23 @@ static int sd_suspend_common(struct device *dev, bool ignore_stop_errors)
 
         if (sdkp->WCE && sdkp->media_present) {
                 sd_printk(KERN_NOTICE, sdkp, "Synchronizing SCSI cache\n");
-                ret = sd_sync_cache(sdkp);
+                ret = sd_sync_cache(sdkp, &sshdr);
+
                 if (ret) {
                         /* ignore OFFLINE device */
                         if (ret == -ENODEV)
-                                ret = 0;
-                        goto done;
+                                return 0;
+
+                        if (!scsi_sense_valid(&sshdr) ||
+                            sshdr.sense_key != ILLEGAL_REQUEST)
+                                return ret;
+
+                        /*
+                         * sshdr.sense_key == ILLEGAL_REQUEST means this drive
+                         * doesn't support sync. There's not much to do and
+                         * suspend shouldn't fail.
+                         */
+                         ret = 0;
                 }
         }
 
@@ -3480,7 +3512,6 @@ static int sd_suspend_common(struct device *dev, bool ignore_stop_errors)
                         ret = 0;
         }
 
-done:
         return ret;
 }
 
diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
index 0a38ba01b7b4..82c33a6edbea 100644
--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -2074,11 +2074,12 @@ sg_get_rq_mark(Sg_fd * sfp, int pack_id)
                 if ((1 == resp->done) && (!resp->sg_io_owned) &&
                     ((-1 == pack_id) || (resp->header.pack_id == pack_id))) {
                         resp->done = 2; /* guard against other readers */
-                        break;
+                        write_unlock_irqrestore(&sfp->rq_list_lock, iflags);
+                        return resp;
                 }
         }
         write_unlock_irqrestore(&sfp->rq_list_lock, iflags);
-        return resp;
+        return NULL;
 }
 
 /* always adds to end of list */
diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
index abc7e87937cc..ffe8d8608818 100644
--- a/drivers/scsi/ufs/ufshcd.c
+++ b/drivers/scsi/ufs/ufshcd.c
@@ -7698,6 +7698,12 @@ static inline void ufshcd_add_sysfs_nodes(struct ufs_hba *hba)
         ufshcd_add_spm_lvl_sysfs_nodes(hba);
 }
 
+static inline void ufshcd_remove_sysfs_nodes(struct ufs_hba *hba)
+{
+        device_remove_file(hba->dev, &hba->rpm_lvl_attr);
+        device_remove_file(hba->dev, &hba->spm_lvl_attr);
+}
+
 /**
  * ufshcd_shutdown - shutdown routine
  * @hba: per adapter instance
@@ -7735,6 +7741,7 @@ EXPORT_SYMBOL(ufshcd_shutdown);
  */
 void ufshcd_remove(struct ufs_hba *hba)
 {
+        ufshcd_remove_sysfs_nodes(hba);
         scsi_remove_host(hba->host);
         /* disable interrupts */
         ufshcd_disable_intr(hba, hba->intr_mask);
diff --git a/drivers/soc/bcm/brcmstb/common.c b/drivers/soc/bcm/brcmstb/common.c
index b6195fdf0d00..22e98a90468c 100644
--- a/drivers/soc/bcm/brcmstb/common.c
+++ b/drivers/soc/bcm/brcmstb/common.c
@@ -49,7 +49,7 @@ static const struct of_device_id sun_top_ctrl_match[] = {
         { .compatible = "brcm,bcm7420-sun-top-ctrl", },
         { .compatible = "brcm,bcm7425-sun-top-ctrl", },
         { .compatible = "brcm,bcm7429-sun-top-ctrl", },
-        { .compatible = "brcm,bcm7425-sun-top-ctrl", },
+        { .compatible = "brcm,bcm7435-sun-top-ctrl", },
         { .compatible = "brcm,brcmstb-sun-top-ctrl", },
         { }
 };
diff --git a/drivers/soc/imx/Kconfig b/drivers/soc/imx/Kconfig
index 357a5d8f8da0..a5b86a28f343 100644
--- a/drivers/soc/imx/Kconfig
+++ b/drivers/soc/imx/Kconfig
@@ -2,8 +2,9 @@ menu "i.MX SoC drivers"
 
 config IMX7_PM_DOMAINS
         bool "i.MX7 PM domains"
-        select PM_GENERIC_DOMAINS
         depends on SOC_IMX7D || (COMPILE_TEST && OF)
+        depends on PM
+        select PM_GENERIC_DOMAINS
         default y if SOC_IMX7D
 
 endmenu
diff --git a/drivers/soc/ti/knav_dma.c b/drivers/soc/ti/knav_dma.c
index ecebe2eecc3a..026182d3b27c 100644
--- a/drivers/soc/ti/knav_dma.c
+++ b/drivers/soc/ti/knav_dma.c
@@ -413,7 +413,7 @@ static int of_channel_match_helper(struct device_node *np, const char *name,
  * @name:       slave channel name
  * @config:     dma configuration parameters
  *
- * Returns pointer to appropriate DMA channel on success or NULL.
+ * Returns pointer to appropriate DMA channel on success or error.
  */
 void *knav_dma_open_channel(struct device *dev, const char *name,
                                         struct knav_dma_cfg *config)
diff --git a/drivers/staging/android/ion/devicetree.txt b/drivers/staging/android/ion/devicetree.txt
deleted file mode 100644
index 168715271f06..000000000000
--- a/drivers/staging/android/ion/devicetree.txt
+++ /dev/null
@@ -1,51 +0,0 @@
-Ion Memory Manager
-
-Ion is a memory manager that allows for sharing of buffers via dma-buf.
-Ion allows for different types of allocation via an abstraction called
-a 'heap'. A heap represents a specific type of memory. Each heap has
-a different type. There can be multiple instances of the same heap
-type.
-
-Specific heap instances are tied to heap IDs. Heap IDs are not to be specified
-in the devicetree.
-
-Required properties for Ion
-
-- compatible: "linux,ion" PLUS a compatible property for the device
-
-All child nodes of a linux,ion node are interpreted as heaps
-
-required properties for heaps
-
-- compatible: compatible string for a heap type PLUS a compatible property
-for the specific instance of the heap. Current heap types
--- linux,ion-heap-system
--- linux,ion-heap-system-contig
--- linux,ion-heap-carveout
--- linux,ion-heap-chunk
--- linux,ion-heap-dma
--- linux,ion-heap-custom
-
-Optional properties
-- memory-region: A phandle to a memory region. Required for DMA heap type
-(see reserved-memory.txt for details on the reservation)
-
-Example:
-
-        ion {
-                compatbile = "hisilicon,ion", "linux,ion";
-
-                ion-system-heap {
-                        compatbile = "hisilicon,system-heap", "linux,ion-heap-system"
-                };
-
-                ion-camera-region {
-                        compatible = "hisilicon,camera-heap", "linux,ion-heap-dma"
-                        memory-region = <&camera_region>;
-                };
-
-                ion-fb-region {
-                        compatbile = "hisilicon,fb-heap", "linux,ion-heap-dma"
-                        memory-region = <&fb_region>;
-                };
-        }
diff --git a/drivers/staging/ccree/ssi_request_mgr.c b/drivers/staging/ccree/ssi_request_mgr.c
index 522bd62c102e..8611adf3bb2e 100644
--- a/drivers/staging/ccree/ssi_request_mgr.c
+++ b/drivers/staging/ccree/ssi_request_mgr.c
@@ -376,7 +376,6 @@ int send_request(
         rc = ssi_power_mgr_runtime_get(&drvdata->plat_dev->dev);
         if (rc != 0) {
                 SSI_LOG_ERR("ssi_power_mgr_runtime_get returned %x\n",rc);
-                spin_unlock_bh(&req_mgr_h->hw_lock);
                 return rc;
         }
 #endif
diff --git a/drivers/staging/fsl-dpaa2/Kconfig b/drivers/staging/fsl-dpaa2/Kconfig
index 2e325cb747ae..730fd6d4db33 100644
--- a/drivers/staging/fsl-dpaa2/Kconfig
+++ b/drivers/staging/fsl-dpaa2/Kconfig
@@ -12,6 +12,7 @@ config FSL_DPAA2
 config FSL_DPAA2_ETH
         tristate "Freescale DPAA2 Ethernet"
         depends on FSL_DPAA2 && FSL_MC_DPIO
+        depends on NETDEVICES && ETHERNET
         ---help---
           Ethernet driver for Freescale DPAA2 SoCs, using the
           Freescale MC bus driver
diff --git a/drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c b/drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c
index 4723a0bd5067..1c6ed5b2a6f9 100644
--- a/drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c
+++ b/drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c
@@ -97,8 +97,9 @@ void rtl92e_set_reg(struct net_device *dev, u8 variable, u8 *val)
 
         switch (variable) {
         case HW_VAR_BSSID:
-                rtl92e_writel(dev, BSSIDR, ((u32 *)(val))[0]);
-                rtl92e_writew(dev, BSSIDR+2, ((u16 *)(val+2))[0]);
+                /* BSSIDR 2 byte alignment */
+                rtl92e_writew(dev, BSSIDR, *(u16 *)val);
+                rtl92e_writel(dev, BSSIDR + 2, *(u32 *)(val + 2));
                 break;
 
         case HW_VAR_MEDIA_STATUS:
@@ -624,7 +625,7 @@ void rtl92e_get_eeprom_size(struct net_device *dev)
         struct r8192_priv *priv = rtllib_priv(dev);
 
         RT_TRACE(COMP_INIT, "===========>%s()\n", __func__);
-        curCR = rtl92e_readl(dev, EPROM_CMD);
+        curCR = rtl92e_readw(dev, EPROM_CMD);
         RT_TRACE(COMP_INIT, "read from Reg Cmd9346CR(%x):%x\n", EPROM_CMD,
                  curCR);
         priv->epromtype = (curCR & EPROM_CMD_9356SEL) ? EEPROM_93C56 :
@@ -961,8 +962,8 @@ static void _rtl92e_net_update(struct net_device *dev)
         rtl92e_config_rate(dev, &rate_config);
         priv->dot11CurrentPreambleMode = PREAMBLE_AUTO;
          priv->basic_rate = rate_config &= 0x15f;
-        rtl92e_writel(dev, BSSIDR, ((u32 *)net->bssid)[0]);
-        rtl92e_writew(dev, BSSIDR+4, ((u16 *)net->bssid)[2]);
+        rtl92e_writew(dev, BSSIDR, *(u16 *)net->bssid);
+        rtl92e_writel(dev, BSSIDR + 2, *(u32 *)(net->bssid + 2));
 
         if (priv->rtllib->iw_mode == IW_MODE_ADHOC) {
                 rtl92e_writew(dev, ATIMWND, 2);
@@ -1182,8 +1183,7 @@ void  rtl92e_fill_tx_desc(struct net_device *dev, struct tx_desc *pdesc,
                           struct cb_desc *cb_desc, struct sk_buff *skb)
 {
         struct r8192_priv *priv = rtllib_priv(dev);
-        dma_addr_t mapping = pci_map_single(priv->pdev, skb->data, skb->len,
-                         PCI_DMA_TODEVICE);
+        dma_addr_t mapping;
         struct tx_fwinfo_8190pci *pTxFwInfo;
 
         pTxFwInfo = (struct tx_fwinfo_8190pci *)skb->data;
@@ -1194,8 +1194,6 @@ void  rtl92e_fill_tx_desc(struct net_device *dev, struct tx_desc *pdesc,
         pTxFwInfo->Short = _rtl92e_query_is_short(pTxFwInfo->TxHT,
                                                   pTxFwInfo->TxRate, cb_desc);
 
-        if (pci_dma_mapping_error(priv->pdev, mapping))
-                netdev_err(dev, "%s(): DMA Mapping error\n", __func__);
         if (cb_desc->bAMPDUEnable) {
                 pTxFwInfo->AllowAggregation = 1;
                 pTxFwInfo->RxMF = cb_desc->ampdu_factor;
@@ -1230,6 +1228,14 @@ void  rtl92e_fill_tx_desc(struct net_device *dev, struct tx_desc *pdesc,
         }
 
         memset((u8 *)pdesc, 0, 12);
+
+        mapping = pci_map_single(priv->pdev, skb->data, skb->len,
+                                 PCI_DMA_TODEVICE);
+        if (pci_dma_mapping_error(priv->pdev, mapping)) {
+                netdev_err(dev, "%s(): DMA Mapping error\n", __func__);
+                return;
+        }
+
         pdesc->LINIP = 0;
         pdesc->CmdInit = 1;
         pdesc->Offset = sizeof(struct tx_fwinfo_8190pci) + 8;
diff --git a/drivers/staging/rtl8192e/rtl819x_TSProc.c b/drivers/staging/rtl8192e/rtl819x_TSProc.c
index 48bbd9e8a52f..dcc4eb691889 100644
--- a/drivers/staging/rtl8192e/rtl819x_TSProc.c
+++ b/drivers/staging/rtl8192e/rtl819x_TSProc.c
@@ -306,11 +306,6 @@ static void MakeTSEntry(struct ts_common_info *pTsCommonInfo, u8 *Addr,
         pTsCommonInfo->TClasNum = TCLAS_Num;
 }
 
-static bool IsACValid(unsigned int tid)
-{
-        return tid < 7;
-}
-
 bool GetTs(struct rtllib_device *ieee, struct ts_common_info **ppTS,
            u8 *Addr, u8 TID, enum tr_select TxRxSelect, bool bAddNewTs)
 {
@@ -328,12 +323,6 @@ bool GetTs(struct rtllib_device *ieee, struct ts_common_info **ppTS,
         if (ieee->current_network.qos_data.supported == 0) {
                 UP = 0;
         } else {
-                if (!IsACValid(TID)) {
-                        netdev_warn(ieee->dev, "%s(): TID(%d) is not valid\n",
-                                    __func__, TID);
-                        return false;
-                }
-
                 switch (TID) {
                 case 0:
                 case 3:
@@ -351,6 +340,10 @@ bool GetTs(struct rtllib_device *ieee, struct ts_common_info **ppTS,
                 case 7:
                         UP = 7;
                         break;
+                default:
+                        netdev_warn(ieee->dev, "%s(): TID(%d) is not valid\n",
+                                    __func__, TID);
+                        return false;
                 }
         }
 
diff --git a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
index 5e7a61f24f8d..36c3189fc4b7 100644
--- a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
+++ b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
@@ -3531,7 +3531,6 @@ int rtw_wdev_alloc(struct adapter *padapter, struct device *dev)
                 pwdev_priv->power_mgmt = true;
         else
                 pwdev_priv->power_mgmt = false;
-        kfree((u8 *)wdev);
 
         return ret;
 
diff --git a/drivers/staging/typec/fusb302/fusb302.c b/drivers/staging/typec/fusb302/fusb302.c
index 2cee9a952c9b..4a356e509fe4 100644
--- a/drivers/staging/typec/fusb302/fusb302.c
+++ b/drivers/staging/typec/fusb302/fusb302.c
@@ -264,22 +264,36 @@ static void fusb302_debugfs_exit(const struct fusb302_chip *chip) { }
 
 #define FUSB302_RESUME_RETRY 10
 #define FUSB302_RESUME_RETRY_SLEEP 50
-static int fusb302_i2c_write(struct fusb302_chip *chip,
-                             u8 address, u8 data)
+
+static bool fusb302_is_suspended(struct fusb302_chip *chip)
 {
         int retry_cnt;
-        int ret = 0;
 
-        atomic_set(&chip->i2c_busy, 1);
         for (retry_cnt = 0; retry_cnt < FUSB302_RESUME_RETRY; retry_cnt++) {
                 if (atomic_read(&chip->pm_suspend)) {
-                        pr_err("fusb302_i2c: pm suspend, retry %d/%d\n",
-                               retry_cnt + 1, FUSB302_RESUME_RETRY);
+                        dev_err(chip->dev, "i2c: pm suspend, retry %d/%d\n",
+                                retry_cnt + 1, FUSB302_RESUME_RETRY);
                         msleep(FUSB302_RESUME_RETRY_SLEEP);
                 } else {
-                        break;
+                        return false;
                 }
         }
+
+        return true;
+}
+
+static int fusb302_i2c_write(struct fusb302_chip *chip,
+                             u8 address, u8 data)
+{
+        int ret = 0;
+
+        atomic_set(&chip->i2c_busy, 1);
+
+        if (fusb302_is_suspended(chip)) {
+                atomic_set(&chip->i2c_busy, 0);
+                return -ETIMEDOUT;
+        }
+
         ret = i2c_smbus_write_byte_data(chip->i2c_client, address, data);
         if (ret < 0)
                 fusb302_log(chip, "cannot write 0x%02x to 0x%02x, ret=%d",
@@ -292,21 +306,17 @@ static int fusb302_i2c_write(struct fusb302_chip *chip,
 static int fusb302_i2c_block_write(struct fusb302_chip *chip, u8 address,
                                    u8 length, const u8 *data)
 {
-        int retry_cnt;
         int ret = 0;
 
         if (length <= 0)
                 return ret;
         atomic_set(&chip->i2c_busy, 1);
-        for (retry_cnt = 0; retry_cnt < FUSB302_RESUME_RETRY; retry_cnt++) {
-                if (atomic_read(&chip->pm_suspend)) {
-                        pr_err("fusb302_i2c: pm suspend, retry %d/%d\n",
-                               retry_cnt + 1, FUSB302_RESUME_RETRY);
-                        msleep(FUSB302_RESUME_RETRY_SLEEP);
-                } else {
-                        break;
-                }
+
+        if (fusb302_is_suspended(chip)) {
+                atomic_set(&chip->i2c_busy, 0);
+                return -ETIMEDOUT;
         }
+
         ret = i2c_smbus_write_i2c_block_data(chip->i2c_client, address,
                                              length, data);
         if (ret < 0)
@@ -320,19 +330,15 @@ static int fusb302_i2c_block_write(struct fusb302_chip *chip, u8 address,
 static int fusb302_i2c_read(struct fusb302_chip *chip,
                             u8 address, u8 *data)
 {
-        int retry_cnt;
         int ret = 0;
 
         atomic_set(&chip->i2c_busy, 1);
-        for (retry_cnt = 0; retry_cnt < FUSB302_RESUME_RETRY; retry_cnt++) {
-                if (atomic_read(&chip->pm_suspend)) {
-                        pr_err("fusb302_i2c: pm suspend, retry %d/%d\n",
-                               retry_cnt + 1, FUSB302_RESUME_RETRY);
-                        msleep(FUSB302_RESUME_RETRY_SLEEP);
-                } else {
-                        break;
-                }
+
+        if (fusb302_is_suspended(chip)) {
+                atomic_set(&chip->i2c_busy, 0);
+                return -ETIMEDOUT;
         }
+
         ret = i2c_smbus_read_byte_data(chip->i2c_client, address);
         *data = (u8)ret;
         if (ret < 0)
@@ -345,33 +351,31 @@ static int fusb302_i2c_read(struct fusb302_chip *chip,
 static int fusb302_i2c_block_read(struct fusb302_chip *chip, u8 address,
                                   u8 length, u8 *data)
 {
-        int retry_cnt;
         int ret = 0;
 
         if (length <= 0)
                 return ret;
         atomic_set(&chip->i2c_busy, 1);
-        for (retry_cnt = 0; retry_cnt < FUSB302_RESUME_RETRY; retry_cnt++) {
-                if (atomic_read(&chip->pm_suspend)) {
-                        pr_err("fusb302_i2c: pm suspend, retry %d/%d\n",
-                               retry_cnt + 1, FUSB302_RESUME_RETRY);
-                        msleep(FUSB302_RESUME_RETRY_SLEEP);
-                } else {
-                        break;
-                }
+
+        if (fusb302_is_suspended(chip)) {
+                atomic_set(&chip->i2c_busy, 0);
+                return -ETIMEDOUT;
         }
+
         ret = i2c_smbus_read_i2c_block_data(chip->i2c_client, address,
                                             length, data);
         if (ret < 0) {
                 fusb302_log(chip, "cannot block read 0x%02x, len=%d, ret=%d",
                             address, length, ret);
-                return ret;
+                goto done;
         }
         if (ret != length) {
                 fusb302_log(chip, "only read %d/%d bytes from 0x%02x",
                             ret, length, address);
-                return -EIO;
+                ret = -EIO;
         }
+
+done:
         atomic_set(&chip->i2c_busy, 0);
 
         return ret;
@@ -489,7 +493,7 @@ static int tcpm_init(struct tcpc_dev *dev)
         ret = fusb302_i2c_read(chip, FUSB_REG_STATUS0, &data);
         if (ret < 0)
                 return ret;
-        chip->vbus_present = !!(FUSB_REG_STATUS0 & FUSB_REG_STATUS0_VBUSOK);
+        chip->vbus_present = !!(data & FUSB_REG_STATUS0_VBUSOK);
         ret = fusb302_i2c_read(chip, FUSB_REG_DEVICE_ID, &data);
         if (ret < 0)
                 return ret;
@@ -1025,7 +1029,7 @@ static int fusb302_pd_send_message(struct fusb302_chip *chip,
         buf[pos++] = FUSB302_TKN_SYNC1;
         buf[pos++] = FUSB302_TKN_SYNC2;
 
-        len = pd_header_cnt(msg->header) * 4;
+        len = pd_header_cnt_le(msg->header) * 4;
         /* plug 2 for header */
         len += 2;
         if (len > 0x1F) {
@@ -1481,7 +1485,7 @@ static int fusb302_pd_read_message(struct fusb302_chip *chip,
                                      (u8 *)&msg->header);
         if (ret < 0)
                 return ret;
-        len = pd_header_cnt(msg->header) * 4;
+        len = pd_header_cnt_le(msg->header) * 4;
         /* add 4 to length to include the CRC */
         if (len > PD_MAX_PAYLOAD * 4) {
                 fusb302_log(chip, "PD message too long %d", len);
@@ -1663,14 +1667,12 @@ static int init_gpio(struct fusb302_chip *chip)
         if (ret < 0) {
                 fusb302_log(chip,
                             "cannot set GPIO Int_N to input, ret=%d", ret);
-                gpio_free(chip->gpio_int_n);
                 return ret;
         }
         ret = gpio_to_irq(chip->gpio_int_n);
         if (ret < 0) {
                 fusb302_log(chip,
                             "cannot request IRQ for GPIO Int_N, ret=%d", ret);
-                gpio_free(chip->gpio_int_n);
                 return ret;
         }
         chip->gpio_int_n_irq = ret;
@@ -1787,11 +1789,13 @@ static const struct of_device_id fusb302_dt_match[] = {
         {.compatible = "fcs,fusb302"},
         {},
 };
+MODULE_DEVICE_TABLE(of, fusb302_dt_match);
 
 static const struct i2c_device_id fusb302_i2c_device_id[] = {
         {"typec_fusb302", 0},
         {},
 };
+MODULE_DEVICE_TABLE(i2c, fusb302_i2c_device_id);
 
 static const struct dev_pm_ops fusb302_pm_ops = {
         .suspend = fusb302_pm_suspend,
diff --git a/drivers/staging/typec/pd.h b/drivers/staging/typec/pd.h
index 8d97bdb95f23..510ef7279900 100644
--- a/drivers/staging/typec/pd.h
+++ b/drivers/staging/typec/pd.h
@@ -92,6 +92,16 @@ static inline unsigned int pd_header_type_le(__le16 header)
         return pd_header_type(le16_to_cpu(header));
 }
 
+static inline unsigned int pd_header_msgid(u16 header)
+{
+        return (header >> PD_HEADER_ID_SHIFT) & PD_HEADER_ID_MASK;
+}
+
+static inline unsigned int pd_header_msgid_le(__le16 header)
+{
+        return pd_header_msgid(le16_to_cpu(header));
+}
+
 #define PD_MAX_PAYLOAD          7
 
 struct pd_message {
diff --git a/drivers/staging/typec/pd_vdo.h b/drivers/staging/typec/pd_vdo.h
index dba172e0e0d1..d92259f8de0a 100644
--- a/drivers/staging/typec/pd_vdo.h
+++ b/drivers/staging/typec/pd_vdo.h
@@ -22,6 +22,9 @@
  * VDM object is minimum of VDM header + 6 additional data objects.
  */
 
+#define VDO_MAX_OBJECTS         6
+#define VDO_MAX_SIZE            (VDO_MAX_OBJECTS + 1)
+
 /*
  * VDM header
  * ----------
@@ -34,7 +37,6 @@
  * <5>      :: reserved (SVDM), command type (UVDM)
  * <4:0>    :: command
  */
-#define VDO_MAX_SIZE 7
 #define VDO(vid, type, custom)                          \
         (((vid) << 16) |                                \
          ((type) << 15) |                               \
diff --git a/drivers/staging/typec/tcpci.c b/drivers/staging/typec/tcpci.c
index 5e5be74c7850..df72d8b01e73 100644
--- a/drivers/staging/typec/tcpci.c
+++ b/drivers/staging/typec/tcpci.c
@@ -425,7 +425,7 @@ static const struct regmap_config tcpci_regmap_config = {
         .max_register = 0x7F, /* 0x80 .. 0xFF are vendor defined */
 };
 
-const struct tcpc_config tcpci_tcpc_config = {
+static const struct tcpc_config tcpci_tcpc_config = {
         .type = TYPEC_PORT_DFP,
         .default_role = TYPEC_SINK,
 };
diff --git a/drivers/staging/typec/tcpm.c b/drivers/staging/typec/tcpm.c
index abba655ba00a..20eb4ebcf8c3 100644
--- a/drivers/staging/typec/tcpm.c
+++ b/drivers/staging/typec/tcpm.c
@@ -238,6 +238,7 @@ struct tcpm_port {
         unsigned int hard_reset_count;
         bool pd_capable;
         bool explicit_contract;
+        unsigned int rx_msgid;
 
         /* Partner capabilities/requests */
         u32 sink_request;
@@ -251,6 +252,8 @@ struct tcpm_port {
         unsigned int nr_src_pdo;
         u32 snk_pdo[PDO_MAX_OBJECTS];
         unsigned int nr_snk_pdo;
+        u32 snk_vdo[VDO_MAX_OBJECTS];
+        unsigned int nr_snk_vdo;
 
         unsigned int max_snk_mv;
         unsigned int max_snk_ma;
@@ -997,6 +1000,7 @@ static int tcpm_pd_svdm(struct tcpm_port *port, const __le32 *payload, int cnt,
         struct pd_mode_data *modep;
         int rlen = 0;
         u16 svid;
+        int i;
 
         tcpm_log(port, "Rx VDM cmd 0x%x type %d cmd %d len %d",
                  p0, cmd_type, cmd, cnt);
@@ -1007,6 +1011,14 @@ static int tcpm_pd_svdm(struct tcpm_port *port, const __le32 *payload, int cnt,
         case CMDT_INIT:
                 switch (cmd) {
                 case CMD_DISCOVER_IDENT:
+                        /* 6.4.4.3.1: Only respond as UFP (device) */
+                        if (port->data_role == TYPEC_DEVICE &&
+                            port->nr_snk_vdo) {
+                                for (i = 0; i <  port->nr_snk_vdo; i++)
+                                        response[i + 1]
+                                                = cpu_to_le32(port->snk_vdo[i]);
+                                rlen = port->nr_snk_vdo + 1;
+                        }
                         break;
                 case CMD_DISCOVER_SVID:
                         break;
@@ -1415,6 +1427,7 @@ static void tcpm_pd_ctrl_request(struct tcpm_port *port,
                         break;
                 case SOFT_RESET_SEND:
                         port->message_id = 0;
+                        port->rx_msgid = -1;
                         if (port->pwr_role == TYPEC_SOURCE)
                                 next_state = SRC_SEND_CAPABILITIES;
                         else
@@ -1503,6 +1516,22 @@ static void tcpm_pd_rx_handler(struct work_struct *work)
                  port->attached);
 
         if (port->attached) {
+                enum pd_ctrl_msg_type type = pd_header_type_le(msg->header);
+                unsigned int msgid = pd_header_msgid_le(msg->header);
+
+                /*
+                 * USB PD standard, 6.6.1.2:
+                 * "... if MessageID value in a received Message is the
+                 * same as the stored value, the receiver shall return a
+                 * GoodCRC Message with that MessageID value and drop
+                 * the Message (this is a retry of an already received
+                 * Message). Note: this shall not apply to the Soft_Reset
+                 * Message which always has a MessageID value of zero."
+                 */
+                if (msgid == port->rx_msgid && type != PD_CTRL_SOFT_RESET)
+                        goto done;
+                port->rx_msgid = msgid;
+
                 /*
                  * If both ends believe to be DFP/host, we have a data role
                  * mismatch.
@@ -1520,6 +1549,7 @@ static void tcpm_pd_rx_handler(struct work_struct *work)
                 }
         }
 
+done:
         mutex_unlock(&port->lock);
         kfree(event);
 }
@@ -1719,8 +1749,7 @@ static int tcpm_pd_build_request(struct tcpm_port *port, u32 *rdo)
         }
         ma = min(ma, port->max_snk_ma);
 
-        /* XXX: Any other flags need to be set? */
-        flags = 0;
+        flags = RDO_USB_COMM | RDO_NO_SUSPEND;
 
         /* Set mismatch bit if offered power is less than operating power */
         mw = ma * mv / 1000;
@@ -1957,6 +1986,12 @@ static void tcpm_reset_port(struct tcpm_port *port)
         port->attached = false;
         port->pd_capable = false;
 
+        /*
+         * First Rx ID should be 0; set this to a sentinel of -1 so that
+         * we can check tcpm_pd_rx_handler() if we had seen it before.
+         */
+        port->rx_msgid = -1;
+
         port->tcpc->set_pd_rx(port->tcpc, false);
         tcpm_init_vbus(port);   /* also disables charging */
         tcpm_init_vconn(port);
@@ -2170,6 +2205,7 @@ static void run_state_machine(struct tcpm_port *port)
                 port->pwr_opmode = TYPEC_PWR_MODE_USB;
                 port->caps_count = 0;
                 port->message_id = 0;
+                port->rx_msgid = -1;
                 port->explicit_contract = false;
                 tcpm_set_state(port, SRC_SEND_CAPABILITIES, 0);
                 break;
@@ -2329,6 +2365,7 @@ static void run_state_machine(struct tcpm_port *port)
                 typec_set_pwr_opmode(port->typec_port, TYPEC_PWR_MODE_USB);
                 port->pwr_opmode = TYPEC_PWR_MODE_USB;
                 port->message_id = 0;
+                port->rx_msgid = -1;
                 port->explicit_contract = false;
                 tcpm_set_state(port, SNK_DISCOVERY, 0);
                 break;
@@ -2496,6 +2533,7 @@ static void run_state_machine(struct tcpm_port *port)
         /* Soft_Reset states */
         case SOFT_RESET:
                 port->message_id = 0;
+                port->rx_msgid = -1;
                 tcpm_pd_send_control(port, PD_CTRL_ACCEPT);
                 if (port->pwr_role == TYPEC_SOURCE)
                         tcpm_set_state(port, SRC_SEND_CAPABILITIES, 0);
@@ -2504,6 +2542,7 @@ static void run_state_machine(struct tcpm_port *port)
                 break;
         case SOFT_RESET_SEND:
                 port->message_id = 0;
+                port->rx_msgid = -1;
                 if (tcpm_pd_send_control(port, PD_CTRL_SOFT_RESET))
                         tcpm_set_state_cond(port, hard_reset_state(port), 0);
                 else
@@ -2568,6 +2607,14 @@ static void run_state_machine(struct tcpm_port *port)
                 break;
         case PR_SWAP_SRC_SNK_SOURCE_OFF:
                 tcpm_set_cc(port, TYPEC_CC_RD);
+                /*
+                 * USB-PD standard, 6.2.1.4, Port Power Role:
+                 * "During the Power Role Swap Sequence, for the initial Source
+                 * Port, the Port Power Role field shall be set to Sink in the
+                 * PS_RDY Message indicating that the initial Source’s power
+                 * supply is turned off"
+                 */
+                tcpm_set_pwr_role(port, TYPEC_SINK);
                 if (tcpm_pd_send_control(port, PD_CTRL_PS_RDY)) {
                         tcpm_set_state(port, ERROR_RECOVERY, 0);
                         break;
@@ -2575,7 +2622,6 @@ static void run_state_machine(struct tcpm_port *port)
                 tcpm_set_state_cond(port, SNK_UNATTACHED, PD_T_PS_SOURCE_ON);
                 break;
         case PR_SWAP_SRC_SNK_SINK_ON:
-                tcpm_set_pwr_role(port, TYPEC_SINK);
                 tcpm_swap_complete(port, 0);
                 tcpm_set_state(port, SNK_STARTUP, 0);
                 break;
@@ -2587,8 +2633,15 @@ static void run_state_machine(struct tcpm_port *port)
         case PR_SWAP_SNK_SRC_SOURCE_ON:
                 tcpm_set_cc(port, tcpm_rp_cc(port));
                 tcpm_set_vbus(port, true);
-                tcpm_pd_send_control(port, PD_CTRL_PS_RDY);
+                /*
+                 * USB PD standard, 6.2.1.4:
+                 * "Subsequent Messages initiated by the Policy Engine,
+                 * such as the PS_RDY Message sent to indicate that Vbus
+                 * is ready, will have the Port Power Role field set to
+                 * Source."
+                 */
                 tcpm_set_pwr_role(port, TYPEC_SOURCE);
+                tcpm_pd_send_control(port, PD_CTRL_PS_RDY);
                 tcpm_swap_complete(port, 0);
                 tcpm_set_state(port, SRC_STARTUP, 0);
                 break;
@@ -3292,6 +3345,20 @@ static int tcpm_copy_pdos(u32 *dest_pdo, const u32 *src_pdo,
         return nr_pdo;
 }
 
+static int tcpm_copy_vdos(u32 *dest_vdo, const u32 *src_vdo,
+                          unsigned int nr_vdo)
+{
+        unsigned int i;
+
+        if (nr_vdo > VDO_MAX_OBJECTS)
+                nr_vdo = VDO_MAX_OBJECTS;
+
+        for (i = 0; i < nr_vdo; i++)
+                dest_vdo[i] = src_vdo[i];
+
+        return nr_vdo;
+}
+
 void tcpm_update_source_capabilities(struct tcpm_port *port, const u32 *pdo,
                                      unsigned int nr_pdo)
 {
@@ -3382,6 +3449,8 @@ struct tcpm_port *tcpm_register_port(struct device *dev, struct tcpc_dev *tcpc)
                                           tcpc->config->nr_src_pdo);
         port->nr_snk_pdo = tcpm_copy_pdos(port->snk_pdo, tcpc->config->snk_pdo,
                                           tcpc->config->nr_snk_pdo);
+        port->nr_snk_vdo = tcpm_copy_vdos(port->snk_vdo, tcpc->config->snk_vdo,
+                                          tcpc->config->nr_snk_vdo);
 
         port->max_snk_mv = tcpc->config->max_snk_mv;
         port->max_snk_ma = tcpc->config->max_snk_ma;
diff --git a/drivers/staging/typec/tcpm.h b/drivers/staging/typec/tcpm.h
index 969b365e6549..19c307d31a5a 100644
--- a/drivers/staging/typec/tcpm.h
+++ b/drivers/staging/typec/tcpm.h
@@ -60,6 +60,9 @@ struct tcpc_config {
         const u32 *snk_pdo;
         unsigned int nr_snk_pdo;
 
+        const u32 *snk_vdo;
+        unsigned int nr_snk_vdo;
+
         unsigned int max_snk_mv;
         unsigned int max_snk_ma;
         unsigned int max_snk_mw;
diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c
index 988ee61fb4a7..d04db3f55519 100644
--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c
+++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c
@@ -502,8 +502,15 @@ create_pagelist(char __user *buf, size_t count, unsigned short type,
          */
         sg_init_table(scatterlist, num_pages);
         /* Now set the pages for each scatterlist */
-        for (i = 0; i < num_pages; i++)
-                sg_set_page(scatterlist + i, pages[i], PAGE_SIZE, 0);
+        for (i = 0; i < num_pages; i++) {
+                unsigned int len = PAGE_SIZE - offset;
+
+                if (len > count)
+                        len = count;
+                sg_set_page(scatterlist + i, pages[i], len, offset);
+                offset = 0;
+                count -= len;
+        }
 
         dma_buffers = dma_map_sg(g_dev,
                                  scatterlist,
@@ -524,20 +531,20 @@ create_pagelist(char __user *buf, size_t count, unsigned short type,
                 u32 addr = sg_dma_address(sg);
 
                 /* Note: addrs is the address + page_count - 1
-                 * The firmware expects the block to be page
+                 * The firmware expects blocks after the first to be page-
                  * aligned and a multiple of the page size
                  */
                 WARN_ON(len == 0);
-                WARN_ON(len & ~PAGE_MASK);
-                WARN_ON(addr & ~PAGE_MASK);
+                WARN_ON(i && (i != (dma_buffers - 1)) && (len & ~PAGE_MASK));
+                WARN_ON(i && (addr & ~PAGE_MASK));
                 if (k > 0 &&
-                    ((addrs[k - 1] & PAGE_MASK) |
-                        ((addrs[k - 1] & ~PAGE_MASK) + 1) << PAGE_SHIFT)
-                    == addr) {
-                        addrs[k - 1] += (len >> PAGE_SHIFT);
-                } else {
-                        addrs[k++] = addr | ((len >> PAGE_SHIFT) - 1);
-                }
+                    ((addrs[k - 1] & PAGE_MASK) +
+                     (((addrs[k - 1] & ~PAGE_MASK) + 1) << PAGE_SHIFT))
+                    == (addr & PAGE_MASK))
+                        addrs[k - 1] += ((len + PAGE_SIZE - 1) >> PAGE_SHIFT);
+                else
+                        addrs[k++] = (addr & PAGE_MASK) |
+                                (((len + PAGE_SIZE - 1) >> PAGE_SHIFT) - 1);
         }
 
         /* Partial cache lines (fragments) require special measures */
diff --git a/drivers/tee/Kconfig b/drivers/tee/Kconfig
index 2330a4eb4e8b..a6df12d88f90 100644
--- a/drivers/tee/Kconfig
+++ b/drivers/tee/Kconfig
@@ -1,6 +1,7 @@
 # Generic Trusted Execution Environment Configuration
 config TEE
         tristate "Trusted Execution Environment support"
+        depends on HAVE_ARM_SMCCC || COMPILE_TEST
         select DMA_SHARED_BUFFER
         select GENERIC_ALLOCATOR
         help
diff --git a/drivers/thermal/broadcom/Kconfig b/drivers/thermal/broadcom/Kconfig
index ab08af4654ef..42c098e86f84 100644
--- a/drivers/thermal/broadcom/Kconfig
+++ b/drivers/thermal/broadcom/Kconfig
@@ -9,8 +9,9 @@ config BCM2835_THERMAL
 config BCM_NS_THERMAL
         tristate "Northstar thermal driver"
         depends on ARCH_BCM_IPROC || COMPILE_TEST
+        default y if ARCH_BCM_IPROC
         help
-          Northstar is a family of SoCs that includes e.g. BCM4708, BCM47081,
-          BCM4709 and BCM47094. It contains DMU (Device Management Unit) block
-          with a thermal sensor that allows checking CPU temperature. This
-          driver provides support for it.
+          Support for the Northstar and Northstar Plus family of SoCs (e.g.
+          BCM4708, BCM4709, BCM5301x, BCM95852X, etc). It contains DMU (Device
+          Management Unit) block with a thermal sensor that allows checking CPU
+          temperature.
diff --git a/drivers/thermal/qoriq_thermal.c b/drivers/thermal/qoriq_thermal.c
index 644ba526d9ea..4362a69ac88d 100644
--- a/drivers/thermal/qoriq_thermal.c
+++ b/drivers/thermal/qoriq_thermal.c
@@ -195,7 +195,6 @@ static struct thermal_zone_of_device_ops tmu_tz_ops = {
 static int qoriq_tmu_probe(struct platform_device *pdev)
 {
         int ret;
-        const struct thermal_trip *trip;
         struct qoriq_tmu_data *data;
         struct device_node *np = pdev->dev.of_node;
         u32 site = 0;
@@ -243,8 +242,6 @@ static int qoriq_tmu_probe(struct platform_device *pdev)
                 goto err_tmu;
         }
 
-        trip = of_thermal_get_trip_points(data->tz);
-
         /* Enable monitoring */
         site |= 0x1 << (15 - data->sensor_id);
         tmu_write(data, site | TMR_ME | TMR_ALPF, &data->regs->tmr);
diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c
index b21b9cc2c8d6..5a51c740e372 100644
--- a/drivers/thermal/thermal_core.c
+++ b/drivers/thermal/thermal_core.c
@@ -359,7 +359,7 @@ static DECLARE_DELAYED_WORK(thermal_emergency_poweroff_work,
  * This may be called from any critical situation to trigger a system shutdown
  * after a known period of time. By default this is not scheduled.
  */
-void thermal_emergency_poweroff(void)
+static void thermal_emergency_poweroff(void)
 {
         int poweroff_delay_ms = CONFIG_THERMAL_EMERGENCY_POWEROFF_DELAY_MS;
         /*
diff --git a/drivers/thermal/ti-soc-thermal/ti-bandgap.c b/drivers/thermal/ti-soc-thermal/ti-bandgap.c
index ba9c302454fb..696ab3046b87 100644
--- a/drivers/thermal/ti-soc-thermal/ti-bandgap.c
+++ b/drivers/thermal/ti-soc-thermal/ti-bandgap.c
@@ -1010,7 +1010,7 @@ ti_bandgap_force_single_read(struct ti_bandgap *bgp, int id)
 }
 
 /**
- * ti_bandgap_set_continous_mode() - One time enabling of continuous mode
+ * ti_bandgap_set_continuous_mode() - One time enabling of continuous mode
  * @bgp: pointer to struct ti_bandgap
  *
  * Call this function only if HAS(MODE_CONFIG) is set. As this driver may
@@ -1214,22 +1214,18 @@ static struct ti_bandgap *ti_bandgap_build(struct platform_device *pdev)
         }
 
         bgp = devm_kzalloc(&pdev->dev, sizeof(*bgp), GFP_KERNEL);
-        if (!bgp) {
-                dev_err(&pdev->dev, "Unable to allocate mem for driver ref\n");
+        if (!bgp)
                 return ERR_PTR(-ENOMEM);
-        }
 
         of_id = of_match_device(of_ti_bandgap_match, &pdev->dev);
         if (of_id)
                 bgp->conf = of_id->data;
 
         /* register shadow for context save and restore */
-        bgp->regval = devm_kzalloc(&pdev->dev, sizeof(*bgp->regval) *
-                                   bgp->conf->sensor_count, GFP_KERNEL);
-        if (!bgp->regval) {
-                dev_err(&pdev->dev, "Unable to allocate mem for driver ref\n");
+        bgp->regval = devm_kcalloc(&pdev->dev, bgp->conf->sensor_count,
+                                   sizeof(*bgp->regval), GFP_KERNEL);
+        if (!bgp->regval)
                 return ERR_PTR(-ENOMEM);
-        }
 
         i = 0;
         do {
diff --git a/drivers/tty/ehv_bytechan.c b/drivers/tty/ehv_bytechan.c
index 7ac9bcdf1e61..61fe8d6fd24e 100644
--- a/drivers/tty/ehv_bytechan.c
+++ b/drivers/tty/ehv_bytechan.c
@@ -764,7 +764,7 @@ static int __init ehv_bc_init(void)
         ehv_bc_driver = alloc_tty_driver(count);
         if (!ehv_bc_driver) {
                 ret = -ENOMEM;
-                goto error;
+                goto err_free_bcs;
         }
 
         ehv_bc_driver->driver_name = "ehv-bc";
@@ -778,24 +778,23 @@ static int __init ehv_bc_init(void)
         ret = tty_register_driver(ehv_bc_driver);
         if (ret) {
                 pr_err("ehv-bc: could not register tty driver (ret=%i)\n", ret);
-                goto error;
+                goto err_put_tty_driver;
         }
 
         ret = platform_driver_register(&ehv_bc_tty_driver);
         if (ret) {
                 pr_err("ehv-bc: could not register platform driver (ret=%i)\n",
                        ret);
-                goto error;
+                goto err_deregister_tty_driver;
         }
 
         return 0;
 
-error:
-        if (ehv_bc_driver) {
-                tty_unregister_driver(ehv_bc_driver);
-                put_tty_driver(ehv_bc_driver);
-        }
-
+err_deregister_tty_driver:
+        tty_unregister_driver(ehv_bc_driver);
+err_put_tty_driver:
+        put_tty_driver(ehv_bc_driver);
+err_free_bcs:
         kfree(bcs);
 
         return ret;
diff --git a/drivers/tty/serdev/core.c b/drivers/tty/serdev/core.c
index 433de5ea9b02..f71b47334149 100644
--- a/drivers/tty/serdev/core.c
+++ b/drivers/tty/serdev/core.c
@@ -122,6 +122,18 @@ void serdev_device_write_wakeup(struct serdev_device *serdev)
 }
 EXPORT_SYMBOL_GPL(serdev_device_write_wakeup);
 
+int serdev_device_write_buf(struct serdev_device *serdev,
+                            const unsigned char *buf, size_t count)
+{
+        struct serdev_controller *ctrl = serdev->ctrl;
+
+        if (!ctrl || !ctrl->ops->write_buf)
+                return -EINVAL;
+
+        return ctrl->ops->write_buf(ctrl, buf, count);
+}
+EXPORT_SYMBOL_GPL(serdev_device_write_buf);
+
 int serdev_device_write(struct serdev_device *serdev,
                         const unsigned char *buf, size_t count,
                         unsigned long timeout)
diff --git a/drivers/tty/serdev/serdev-ttyport.c b/drivers/tty/serdev/serdev-ttyport.c
index 487c88f6aa0e..d0a021c93986 100644
--- a/drivers/tty/serdev/serdev-ttyport.c
+++ b/drivers/tty/serdev/serdev-ttyport.c
@@ -102,9 +102,6 @@ static int ttyport_open(struct serdev_controller *ctrl)
                 return PTR_ERR(tty);
         serport->tty = tty;
 
-        serport->port->client_ops = &client_ops;
-        serport->port->client_data = ctrl;
-
         if (tty->ops->open)
                 tty->ops->open(serport->tty, NULL);
         else
@@ -215,6 +212,7 @@ struct device *serdev_tty_port_register(struct tty_port *port,
                                         struct device *parent,
                                         struct tty_driver *drv, int idx)
 {
+        const struct tty_port_client_operations *old_ops;
         struct serdev_controller *ctrl;
         struct serport *serport;
         int ret;
@@ -233,28 +231,37 @@ struct device *serdev_tty_port_register(struct tty_port *port,
 
         ctrl->ops = &ctrl_ops;
 
+        old_ops = port->client_ops;
+        port->client_ops = &client_ops;
+        port->client_data = ctrl;
+
         ret = serdev_controller_add(ctrl);
         if (ret)
-                goto err_controller_put;
+                goto err_reset_data;
 
         dev_info(&ctrl->dev, "tty port %s%d registered\n", drv->name, idx);
         return &ctrl->dev;
 
-err_controller_put:
+err_reset_data:
+        port->client_data = NULL;
+        port->client_ops = old_ops;
         serdev_controller_put(ctrl);
+
         return ERR_PTR(ret);
 }
 
-void serdev_tty_port_unregister(struct tty_port *port)
+int serdev_tty_port_unregister(struct tty_port *port)
 {
         struct serdev_controller *ctrl = port->client_data;
         struct serport *serport = serdev_controller_get_drvdata(ctrl);
 
         if (!serport)
-                return;
+                return -ENODEV;
 
         serdev_controller_remove(ctrl);
         port->client_ops = NULL;
         port->client_data = NULL;
         serdev_controller_put(ctrl);
+
+        return 0;
 }
diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c
index 09a65a3ec7f7..68fd045a7025 100644
--- a/drivers/tty/serial/8250/8250_port.c
+++ b/drivers/tty/serial/8250/8250_port.c
@@ -47,6 +47,7 @@
 /*
  * These are definitions for the Exar XR17V35X and XR17(C|D)15X
  */
+#define UART_EXAR_INT0          0x80
 #define UART_EXAR_SLEEP         0x8b    /* Sleep mode */
 #define UART_EXAR_DVID          0x8d    /* Device identification */
 
@@ -1337,7 +1338,7 @@ out_lock:
         /*
          * Check if the device is a Fintek F81216A
          */
-        if (port->type == PORT_16550A)
+        if (port->type == PORT_16550A && port->iotype == UPIO_PORT)
                 fintek_8250_probe(up);
 
         if (up->capabilities != old_capabilities) {
@@ -1869,17 +1870,13 @@ static int serial8250_default_handle_irq(struct uart_port *port)
 static int exar_handle_irq(struct uart_port *port)
 {
         unsigned int iir = serial_port_in(port, UART_IIR);
-        int ret;
+        int ret = 0;
 
-        ret = serial8250_handle_irq(port, iir);
+        if (((port->type == PORT_XR17V35X) || (port->type == PORT_XR17D15X)) &&
+            serial_port_in(port, UART_EXAR_INT0) != 0)
+                ret = 1;
 
-        if ((port->type == PORT_XR17V35X) ||
-           (port->type == PORT_XR17D15X)) {
-                serial_port_in(port, 0x80);
-                serial_port_in(port, 0x81);
-                serial_port_in(port, 0x82);
-                serial_port_in(port, 0x83);
-        }
+        ret |= serial8250_handle_irq(port, iir);
 
         return ret;
 }
@@ -2177,6 +2174,8 @@ int serial8250_do_startup(struct uart_port *port)
         serial_port_in(port, UART_RX);
         serial_port_in(port, UART_IIR);
         serial_port_in(port, UART_MSR);
+        if ((port->type == PORT_XR17V35X) || (port->type == PORT_XR17D15X))
+                serial_port_in(port, UART_EXAR_INT0);
 
         /*
          * At this point, there's no way the LSR could still be 0xff;
@@ -2335,6 +2334,8 @@ dont_test_tx_en:
         serial_port_in(port, UART_RX);
         serial_port_in(port, UART_IIR);
         serial_port_in(port, UART_MSR);
+        if ((port->type == PORT_XR17V35X) || (port->type == PORT_XR17D15X))
+                serial_port_in(port, UART_EXAR_INT0);
         up->lsr_saved_flags = 0;
         up->msr_saved_flags = 0;
 
diff --git a/drivers/tty/serial/altera_jtaguart.c b/drivers/tty/serial/altera_jtaguart.c
index 18e3f8342b85..0475f5d261ce 100644
--- a/drivers/tty/serial/altera_jtaguart.c
+++ b/drivers/tty/serial/altera_jtaguart.c
@@ -478,6 +478,7 @@ static int altera_jtaguart_remove(struct platform_device *pdev)
 
         port = &altera_jtaguart_ports[i].port;
         uart_remove_one_port(&altera_jtaguart_driver, port);
+        iounmap(port->membase);
 
         return 0;
 }
diff --git a/drivers/tty/serial/altera_uart.c b/drivers/tty/serial/altera_uart.c
index 46d3438a0d27..3e4b717670d7 100644
--- a/drivers/tty/serial/altera_uart.c
+++ b/drivers/tty/serial/altera_uart.c
@@ -615,6 +615,7 @@ static int altera_uart_remove(struct platform_device *pdev)
         if (port) {
                 uart_remove_one_port(&altera_uart_driver, port);
                 port->mapbase = 0;
+                iounmap(port->membase);
         }
 
         return 0;
diff --git a/drivers/tty/serial/efm32-uart.c b/drivers/tty/serial/efm32-uart.c
index ebd8569f9ad5..9fff25be87f9 100644
--- a/drivers/tty/serial/efm32-uart.c
+++ b/drivers/tty/serial/efm32-uart.c
@@ -27,6 +27,7 @@
 #define UARTn_FRAME             0x04
 #define UARTn_FRAME_DATABITS__MASK      0x000f
 #define UARTn_FRAME_DATABITS(n)         ((n) - 3)
+#define UARTn_FRAME_PARITY__MASK        0x0300
 #define UARTn_FRAME_PARITY_NONE         0x0000
 #define UARTn_FRAME_PARITY_EVEN         0x0200
 #define UARTn_FRAME_PARITY_ODD          0x0300
@@ -572,12 +573,16 @@ static void efm32_uart_console_get_options(struct efm32_uart_port *efm_port,
                         16 * (4 + (clkdiv >> 6)));
 
         frame = efm32_uart_read32(efm_port, UARTn_FRAME);
-        if (frame & UARTn_FRAME_PARITY_ODD)
+        switch (frame & UARTn_FRAME_PARITY__MASK) {
+        case UARTn_FRAME_PARITY_ODD:
                 *parity = 'o';
-        else if (frame & UARTn_FRAME_PARITY_EVEN)
+                break;
+        case UARTn_FRAME_PARITY_EVEN:
                 *parity = 'e';
-        else
+                break;
+        default:
                 *parity = 'n';
+        }
 
         *bits = (frame & UARTn_FRAME_DATABITS__MASK) -
                         UARTn_FRAME_DATABITS(4) + 4;
diff --git a/drivers/tty/serial/ifx6x60.c b/drivers/tty/serial/ifx6x60.c
index 157883653256..f190a84a0246 100644
--- a/drivers/tty/serial/ifx6x60.c
+++ b/drivers/tty/serial/ifx6x60.c
@@ -1382,9 +1382,9 @@ static struct spi_driver ifx_spi_driver = {
 static void __exit ifx_spi_exit(void)
 {
         /* unregister */
+        spi_unregister_driver(&ifx_spi_driver);
         tty_unregister_driver(tty_drv);
         put_tty_driver(tty_drv);
-        spi_unregister_driver(&ifx_spi_driver);
         unregister_reboot_notifier(&ifx_modem_reboot_notifier_block);
 }
 
diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c
index 33509b4beaec..bbefddd92bfe 100644
--- a/drivers/tty/serial/imx.c
+++ b/drivers/tty/serial/imx.c
@@ -2184,7 +2184,9 @@ static int serial_imx_probe(struct platform_device *pdev)
                  * and DCD (when they are outputs) or enables the respective
                  * irqs. So set this bit early, i.e. before requesting irqs.
                  */
-                writel(UFCR_DCEDTE, sport->port.membase + UFCR);
+                reg = readl(sport->port.membase + UFCR);
+                if (!(reg & UFCR_DCEDTE))
+                        writel(reg | UFCR_DCEDTE, sport->port.membase + UFCR);
 
                 /*
                  * Disable UCR3_RI and UCR3_DCD irqs. They are also not
@@ -2195,7 +2197,15 @@ static int serial_imx_probe(struct platform_device *pdev)
                        sport->port.membase + UCR3);
 
         } else {
-                writel(0, sport->port.membase + UFCR);
+                unsigned long ucr3 = UCR3_DSR;
+
+                reg = readl(sport->port.membase + UFCR);
+                if (reg & UFCR_DCEDTE)
+                        writel(reg & ~UFCR_DCEDTE, sport->port.membase + UFCR);
+
+                if (!is_imx1_uart(sport))
+                        ucr3 |= IMX21_UCR3_RXDMUXSEL | UCR3_ADNIMP;
+                writel(ucr3, sport->port.membase + UCR3);
         }
 
         clk_disable_unprepare(sport->clk_ipg);
diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
index 0f45b7884a2c..13bfd5dcffce 100644
--- a/drivers/tty/serial/serial_core.c
+++ b/drivers/tty/serial/serial_core.c
@@ -2083,7 +2083,7 @@ int uart_suspend_port(struct uart_driver *drv, struct uart_port *uport)
         mutex_lock(&port->mutex);
 
         tty_dev = device_find_child(uport->dev, &match, serial_match_port);
-        if (device_may_wakeup(tty_dev)) {
+        if (tty_dev && device_may_wakeup(tty_dev)) {
                 if (!enable_irq_wake(uport->irq))
                         uport->irq_wake = 1;
                 put_device(tty_dev);
@@ -2782,7 +2782,7 @@ int uart_add_one_port(struct uart_driver *drv, struct uart_port *uport)
          * Register the port whether it's detected or not.  This allows
          * setserial to be used to alter this port's parameters.
          */
-        tty_dev = tty_port_register_device_attr(port, drv->tty_driver,
+        tty_dev = tty_port_register_device_attr_serdev(port, drv->tty_driver,
                         uport->line, uport->dev, port, uport->tty_groups);
         if (likely(!IS_ERR(tty_dev))) {
                 device_set_wakeup_capable(tty_dev, 1);
@@ -2845,7 +2845,7 @@ int uart_remove_one_port(struct uart_driver *drv, struct uart_port *uport)
         /*
          * Remove the devices from the tty layer
          */
-        tty_unregister_device(drv->tty_driver, uport->line);
+        tty_port_unregister_device(port, drv->tty_driver, uport->line);
 
         tty = tty_port_tty_get(port);
         if (tty) {
diff --git a/drivers/tty/tty_port.c b/drivers/tty/tty_port.c
index 1d21a9c1d33e..4fb3165384c4 100644
--- a/drivers/tty/tty_port.c
+++ b/drivers/tty/tty_port.c
@@ -34,7 +34,9 @@ static int tty_port_default_receive_buf(struct tty_port *port,
         if (!disc)
                 return 0;
 
+        mutex_lock(&tty->atomic_write_lock);
         ret = tty_ldisc_receive_buf(disc, p, (char *)f, count);
+        mutex_unlock(&tty->atomic_write_lock);
 
         tty_ldisc_deref(disc);
 
@@ -129,19 +131,85 @@ struct device *tty_port_register_device_attr(struct tty_port *port,
                 struct device *device, void *drvdata,
                 const struct attribute_group **attr_grp)
 {
+        tty_port_link_device(port, driver, index);
+        return tty_register_device_attr(driver, index, device, drvdata,
+                        attr_grp);
+}
+EXPORT_SYMBOL_GPL(tty_port_register_device_attr);
+
+/**
+ * tty_port_register_device_attr_serdev - register tty or serdev device
+ * @port: tty_port of the device
+ * @driver: tty_driver for this device
+ * @index: index of the tty
+ * @device: parent if exists, otherwise NULL
+ * @drvdata: driver data for the device
+ * @attr_grp: attribute group for the device
+ *
+ * Register a serdev or tty device depending on if the parent device has any
+ * defined serdev clients or not.
+ */
+struct device *tty_port_register_device_attr_serdev(struct tty_port *port,
+                struct tty_driver *driver, unsigned index,
+                struct device *device, void *drvdata,
+                const struct attribute_group **attr_grp)
+{
         struct device *dev;
 
         tty_port_link_device(port, driver, index);
 
         dev = serdev_tty_port_register(port, device, driver, index);
-        if (PTR_ERR(dev) != -ENODEV)
+        if (PTR_ERR(dev) != -ENODEV) {
                 /* Skip creating cdev if we registered a serdev device */
                 return dev;
+        }
 
         return tty_register_device_attr(driver, index, device, drvdata,
                         attr_grp);
 }
-EXPORT_SYMBOL_GPL(tty_port_register_device_attr);
+EXPORT_SYMBOL_GPL(tty_port_register_device_attr_serdev);
+
+/**
+ * tty_port_register_device_serdev - register tty or serdev device
+ * @port: tty_port of the device
+ * @driver: tty_driver for this device
+ * @index: index of the tty
+ * @device: parent if exists, otherwise NULL
+ *
+ * Register a serdev or tty device depending on if the parent device has any
+ * defined serdev clients or not.
+ */
+struct device *tty_port_register_device_serdev(struct tty_port *port,
+                struct tty_driver *driver, unsigned index,
+                struct device *device)
+{
+        return tty_port_register_device_attr_serdev(port, driver, index,
+                        device, NULL, NULL);
+}
+EXPORT_SYMBOL_GPL(tty_port_register_device_serdev);
+
+/**
+ * tty_port_unregister_device - deregister a tty or serdev device
+ * @port: tty_port of the device
+ * @driver: tty_driver for this device
+ * @index: index of the tty
+ *
+ * If a tty or serdev device is registered with a call to
+ * tty_port_register_device_serdev() then this function must be called when
+ * the device is gone.
+ */
+void tty_port_unregister_device(struct tty_port *port,
+                struct tty_driver *driver, unsigned index)
+{
+        int ret;
+
+        ret = serdev_tty_port_unregister(port);
+        if (ret == 0)
+                return;
+
+        tty_unregister_device(driver, index);
+}
+EXPORT_SYMBOL_GPL(tty_port_unregister_device);
 
 int tty_port_alloc_xmit_buf(struct tty_port *port)
 {
@@ -189,9 +257,6 @@ static void tty_port_destructor(struct kref *kref)
         /* check if last port ref was dropped before tty release */
         if (WARN_ON(port->itty))
                 return;
-
-        serdev_tty_port_unregister(port);
-
         if (port->xmit_buf)
                 free_page((unsigned long)port->xmit_buf);
         tty_port_destroy(port);
diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c
index 1c196f87e9d9..ff04b7f8549f 100644
--- a/drivers/uio/uio.c
+++ b/drivers/uio/uio.c
@@ -279,7 +279,7 @@ static int uio_dev_add_attributes(struct uio_device *idev)
                 map = kzalloc(sizeof(*map), GFP_KERNEL);
                 if (!map) {
                         ret = -ENOMEM;
-                        goto err_map_kobj;
+                        goto err_map;
                 }
                 kobject_init(&map->kobj, &map_attr_type);
                 map->mem = mem;
@@ -289,7 +289,7 @@ static int uio_dev_add_attributes(struct uio_device *idev)
                         goto err_map_kobj;
                 ret = kobject_uevent(&map->kobj, KOBJ_ADD);
                 if (ret)
-                        goto err_map;
+                        goto err_map_kobj;
         }
 
         for (pi = 0; pi < MAX_UIO_PORT_REGIONS; pi++) {
@@ -308,7 +308,7 @@ static int uio_dev_add_attributes(struct uio_device *idev)
                 portio = kzalloc(sizeof(*portio), GFP_KERNEL);
                 if (!portio) {
                         ret = -ENOMEM;
-                        goto err_portio_kobj;
+                        goto err_portio;
                 }
                 kobject_init(&portio->kobj, &portio_attr_type);
                 portio->port = port;
@@ -319,7 +319,7 @@ static int uio_dev_add_attributes(struct uio_device *idev)
                         goto err_portio_kobj;
                 ret = kobject_uevent(&portio->kobj, KOBJ_ADD);
                 if (ret)
-                        goto err_portio;
+                        goto err_portio_kobj;
         }
 
         return 0;
diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index cfc3cff6e8d5..8e6ef671be9b 100644
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -475,11 +475,11 @@ static void snoop_urb(struct usb_device *udev,
 
         if (userurb) {          /* Async */
                 if (when == SUBMIT)
-                        dev_info(&udev->dev, "userurb %p, ep%d %s-%s, "
+                        dev_info(&udev->dev, "userurb %pK, ep%d %s-%s, "
                                         "length %u\n",
                                         userurb, ep, t, d, length);
                 else
-                        dev_info(&udev->dev, "userurb %p, ep%d %s-%s, "
+                        dev_info(&udev->dev, "userurb %pK, ep%d %s-%s, "
                                         "actual_length %u status %d\n",
                                         userurb, ep, t, d, length,
                                         timeout_or_status);
@@ -1895,7 +1895,7 @@ static int proc_reapurb(struct usb_dev_state *ps, void __user *arg)
         if (as) {
                 int retval;
 
-                snoop(&ps->dev->dev, "reap %p\n", as->userurb);
+                snoop(&ps->dev->dev, "reap %pK\n", as->userurb);
                 retval = processcompl(as, (void __user * __user *)arg);
                 free_async(as);
                 return retval;
@@ -1912,7 +1912,7 @@ static int proc_reapurbnonblock(struct usb_dev_state *ps, void __user *arg)
 
         as = async_getcompleted(ps);
         if (as) {
-                snoop(&ps->dev->dev, "reap %p\n", as->userurb);
+                snoop(&ps->dev->dev, "reap %pK\n", as->userurb);
                 retval = processcompl(as, (void __user * __user *)arg);
                 free_async(as);
         } else {
@@ -2043,7 +2043,7 @@ static int proc_reapurb_compat(struct usb_dev_state *ps, void __user *arg)
         if (as) {
                 int retval;
 
-                snoop(&ps->dev->dev, "reap %p\n", as->userurb);
+                snoop(&ps->dev->dev, "reap %pK\n", as->userurb);
                 retval = processcompl_compat(as, (void __user * __user *)arg);
                 free_async(as);
                 return retval;
@@ -2060,7 +2060,7 @@ static int proc_reapurbnonblock_compat(struct usb_dev_state *ps, void __user *ar
 
         as = async_getcompleted(ps);
         if (as) {
-                snoop(&ps->dev->dev, "reap %p\n", as->userurb);
+                snoop(&ps->dev->dev, "reap %pK\n", as->userurb);
                 retval = processcompl_compat(as, (void __user * __user *)arg);
                 free_async(as);
         } else {
@@ -2489,7 +2489,7 @@ static long usbdev_do_ioctl(struct file *file, unsigned int cmd,
 #endif
 
         case USBDEVFS_DISCARDURB:
-                snoop(&dev->dev, "%s: DISCARDURB %p\n", __func__, p);
+                snoop(&dev->dev, "%s: DISCARDURB %pK\n", __func__, p);
                 ret = proc_unlinkurb(ps, p);
                 break;
 
diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
index 49550790a3cb..5dea98358c05 100644
--- a/drivers/usb/core/hcd.c
+++ b/drivers/usb/core/hcd.c
@@ -1723,7 +1723,7 @@ int usb_hcd_unlink_urb (struct urb *urb, int status)
                 if (retval == 0)
                         retval = -EINPROGRESS;
                 else if (retval != -EIDRM && retval != -EBUSY)
-                        dev_dbg(&udev->dev, "hcd_unlink_urb %p fail %d\n",
+                        dev_dbg(&udev->dev, "hcd_unlink_urb %pK fail %d\n",
                                         urb, retval);
                 usb_put_dev(udev);
         }
@@ -1890,7 +1890,7 @@ rescan:
                 /* kick hcd */
                 unlink1(hcd, urb, -ESHUTDOWN);
                 dev_dbg (hcd->self.controller,
-                        "shutdown urb %p ep%d%s%s\n",
+                        "shutdown urb %pK ep%d%s%s\n",
                         urb, usb_endpoint_num(&ep->desc),
                         is_in ? "in" : "out",
                         ({      char *s;
@@ -2520,6 +2520,7 @@ struct usb_hcd *__usb_create_hcd(const struct hc_driver *driver,
                 hcd->bandwidth_mutex = kmalloc(sizeof(*hcd->bandwidth_mutex),
                                 GFP_KERNEL);
                 if (!hcd->bandwidth_mutex) {
+                        kfree(hcd->address0_mutex);
                         kfree(hcd);
                         dev_dbg(dev, "hcd bandwidth mutex alloc failed\n");
                         return NULL;
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 9dca59ef18b3..b8bb20d7acdb 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -362,7 +362,8 @@ static void usb_set_lpm_parameters(struct usb_device *udev)
 }
 
 /* USB 2.0 spec Section 11.24.4.5 */
-static int get_hub_descriptor(struct usb_device *hdev, void *data)
+static int get_hub_descriptor(struct usb_device *hdev,
+                struct usb_hub_descriptor *desc)
 {
         int i, ret, size;
         unsigned dtype;
@@ -378,10 +379,18 @@ static int get_hub_descriptor(struct usb_device *hdev, void *data)
         for (i = 0; i < 3; i++) {
                 ret = usb_control_msg(hdev, usb_rcvctrlpipe(hdev, 0),
                         USB_REQ_GET_DESCRIPTOR, USB_DIR_IN | USB_RT_HUB,
-                        dtype << 8, 0, data, size,
+                        dtype << 8, 0, desc, size,
                         USB_CTRL_GET_TIMEOUT);
-                if (ret >= (USB_DT_HUB_NONVAR_SIZE + 2))
+                if (hub_is_superspeed(hdev)) {
+                        if (ret == size)
+                                return ret;
+                } else if (ret >= USB_DT_HUB_NONVAR_SIZE + 2) {
+                        /* Make sure we have the DeviceRemovable field. */
+                        size = USB_DT_HUB_NONVAR_SIZE + desc->bNbrPorts / 8 + 1;
+                        if (ret < size)
+                                return -EMSGSIZE;
                         return ret;
+                }
         }
         return -EINVAL;
 }
@@ -1313,7 +1322,7 @@ static int hub_configure(struct usb_hub *hub,
         }
         mutex_init(&hub->status_mutex);
 
-        hub->descriptor = kmalloc(sizeof(*hub->descriptor), GFP_KERNEL);
+        hub->descriptor = kzalloc(sizeof(*hub->descriptor), GFP_KERNEL);
         if (!hub->descriptor) {
                 ret = -ENOMEM;
                 goto fail;
@@ -1321,13 +1330,19 @@ static int hub_configure(struct usb_hub *hub,
 
         /* Request the entire hub descriptor.
          * hub->descriptor can handle USB_MAXCHILDREN ports,
-         * but the hub can/will return fewer bytes here.
+         * but a (non-SS) hub can/will return fewer bytes here.
          */
         ret = get_hub_descriptor(hdev, hub->descriptor);
         if (ret < 0) {
                 message = "can't read hub descriptor";
                 goto fail;
-        } else if (hub->descriptor->bNbrPorts > USB_MAXCHILDREN) {
+        }
+
+        maxchild = USB_MAXCHILDREN;
+        if (hub_is_superspeed(hdev))
+                maxchild = min_t(unsigned, maxchild, USB_SS_MAXPORTS);
+
+        if (hub->descriptor->bNbrPorts > maxchild) {
                 message = "hub has too many ports!";
                 ret = -ENODEV;
                 goto fail;
diff --git a/drivers/usb/core/of.c b/drivers/usb/core/of.c
index d787f195a9a6..d563cbcf76cf 100644
--- a/drivers/usb/core/of.c
+++ b/drivers/usb/core/of.c
@@ -53,6 +53,9 @@ EXPORT_SYMBOL_GPL(usb_of_get_child_node);
  *
  * Find the companion device from platform bus.
  *
+ * Takes a reference to the returned struct device which needs to be dropped
+ * after use.
+ *
  * Return: On success, a pointer to the companion device, %NULL on failure.
  */
 struct device *usb_of_get_companion_dev(struct device *dev)
diff --git a/drivers/usb/core/urb.c b/drivers/usb/core/urb.c
index d75cb8c0f7df..47903d510955 100644
--- a/drivers/usb/core/urb.c
+++ b/drivers/usb/core/urb.c
@@ -338,7 +338,7 @@ int usb_submit_urb(struct urb *urb, gfp_t mem_flags)
         if (!urb || !urb->complete)
                 return -EINVAL;
         if (urb->hcpriv) {
-                WARN_ONCE(1, "URB %p submitted while active\n", urb);
+                WARN_ONCE(1, "URB %pK submitted while active\n", urb);
                 return -EBUSY;
         }
 
diff --git a/drivers/usb/dwc3/dwc3-keystone.c b/drivers/usb/dwc3/dwc3-keystone.c
index 72664700b8a2..12ee23f53cdd 100644
--- a/drivers/usb/dwc3/dwc3-keystone.c
+++ b/drivers/usb/dwc3/dwc3-keystone.c
@@ -107,6 +107,10 @@ static int kdwc3_probe(struct platform_device *pdev)
                 return PTR_ERR(kdwc->usbss);
 
         kdwc->clk = devm_clk_get(kdwc->dev, "usb");
+        if (IS_ERR(kdwc->clk)) {
+                dev_err(kdwc->dev, "unable to get usb clock\n");
+                return PTR_ERR(kdwc->clk);
+        }
 
         error = clk_prepare_enable(kdwc->clk);
         if (error < 0) {
diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c
index a15ec71d0423..84a2cebfc712 100644
--- a/drivers/usb/dwc3/dwc3-pci.c
+++ b/drivers/usb/dwc3/dwc3-pci.c
@@ -39,6 +39,8 @@
 #define PCI_DEVICE_ID_INTEL_APL                 0x5aaa
 #define PCI_DEVICE_ID_INTEL_KBP                 0xa2b0
 #define PCI_DEVICE_ID_INTEL_GLK                 0x31aa
+#define PCI_DEVICE_ID_INTEL_CNPLP               0x9dee
+#define PCI_DEVICE_ID_INTEL_CNPH                0xa36e
 
 #define PCI_INTEL_BXT_DSM_UUID          "732b85d5-b7a7-4a1b-9ba0-4bbd00ffd511"
 #define PCI_INTEL_BXT_FUNC_PMU_PWR      4
@@ -270,6 +272,8 @@ static const struct pci_device_id dwc3_pci_id_table[] = {
         { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_APL), },
         { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_KBP), },
         { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_GLK), },
+        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CNPLP), },
+        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CNPH), },
         { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_NL_USB), },
         {  }    /* Terminating Entry */
 };
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 6f6f0b3be3ad..aea9a5b948b4 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -1261,14 +1261,24 @@ static int __dwc3_gadget_ep_queue(struct dwc3_ep *dep, struct dwc3_request *req)
                                 __dwc3_gadget_start_isoc(dwc, dep, cur_uf);
                                 dep->flags &= ~DWC3_EP_PENDING_REQUEST;
                         }
+                        return 0;
                 }
-                return 0;
+
+                if ((dep->flags & DWC3_EP_BUSY) &&
+                    !(dep->flags & DWC3_EP_MISSED_ISOC)) {
+                        WARN_ON_ONCE(!dep->resource_index);
+                        ret = __dwc3_gadget_kick_transfer(dep,
+                                                          dep->resource_index);
+                }
+
+                goto out;
         }
 
         if (!dwc3_calc_trbs_left(dep))
                 return 0;
 
         ret = __dwc3_gadget_kick_transfer(dep, 0);
+out:
         if (ret == -EBUSY)
                 ret = 0;
 
@@ -3026,6 +3036,15 @@ static irqreturn_t dwc3_check_event_buf(struct dwc3_event_buffer *evt)
                 return IRQ_HANDLED;
         }
 
+        /*
+         * With PCIe legacy interrupt, test shows that top-half irq handler can
+         * be called again after HW interrupt deassertion. Check if bottom-half
+         * irq event handler completes before caching new event to prevent
+         * losing events.
+         */
+        if (evt->flags & DWC3_EVENT_PENDING)
+                return IRQ_HANDLED;
+
         count = dwc3_readl(dwc->regs, DWC3_GEVNTCOUNT(0));
         count &= DWC3_GEVNTCOUNT_MASK;
         if (!count)
diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index 71dd27c0d7f2..47dda3450abd 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -1858,12 +1858,12 @@ static int ffs_func_eps_enable(struct ffs_function *func)
                 ep->ep->driver_data = ep;
                 ep->ep->desc = ds;
 
-                comp_desc = (struct usb_ss_ep_comp_descriptor *)(ds +
-                                USB_DT_ENDPOINT_SIZE);
-                ep->ep->maxburst = comp_desc->bMaxBurst + 1;
-
-                if (needs_comp_desc)
+                if (needs_comp_desc) {
+                        comp_desc = (struct usb_ss_ep_comp_descriptor *)(ds +
+                                        USB_DT_ENDPOINT_SIZE);
+                        ep->ep->maxburst = comp_desc->bMaxBurst + 1;
                         ep->ep->comp_desc = comp_desc;
+                }
 
                 ret = usb_ep_enable(ep->ep);
                 if (likely(!ret)) {
diff --git a/drivers/usb/gadget/function/u_serial.c b/drivers/usb/gadget/function/u_serial.c
index 000677c991b0..9b0805f55ad7 100644
--- a/drivers/usb/gadget/function/u_serial.c
+++ b/drivers/usb/gadget/function/u_serial.c
@@ -1256,7 +1256,7 @@ static void gserial_console_exit(void)
         struct gscons_info *info = &gscons_info;
 
         unregister_console(&gserial_cons);
-        if (info->console_thread != NULL)
+        if (!IS_ERR_OR_NULL(info->console_thread))
                 kthread_stop(info->console_thread);
         gs_buf_free(&info->con_buf);
 }
diff --git a/drivers/usb/gadget/udc/dummy_hcd.c b/drivers/usb/gadget/udc/dummy_hcd.c
index c79081952ea0..ccabb51cb98d 100644
--- a/drivers/usb/gadget/udc/dummy_hcd.c
+++ b/drivers/usb/gadget/udc/dummy_hcd.c
@@ -2008,7 +2008,7 @@ ss_hub_descriptor(struct usb_hub_descriptor *desc)
                         HUB_CHAR_COMMON_OCPM);
         desc->bNbrPorts = 1;
         desc->u.ss.bHubHdrDecLat = 0x04; /* Worst case: 0.4 micro sec*/
-        desc->u.ss.DeviceRemovable = 0xffff;
+        desc->u.ss.DeviceRemovable = 0;
 }
 
 static inline void hub_descriptor(struct usb_hub_descriptor *desc)
@@ -2020,8 +2020,8 @@ static inline void hub_descriptor(struct usb_hub_descriptor *desc)
                         HUB_CHAR_INDV_PORT_LPSM |
                         HUB_CHAR_COMMON_OCPM);
         desc->bNbrPorts = 1;
-        desc->u.hs.DeviceRemovable[0] = 0xff;
-        desc->u.hs.DeviceRemovable[1] = 0xff;
+        desc->u.hs.DeviceRemovable[0] = 0;
+        desc->u.hs.DeviceRemovable[1] = 0xff;   /* PortPwrCtrlMask */
 }
 
 static int dummy_hub_control(
diff --git a/drivers/usb/host/ehci-platform.c b/drivers/usb/host/ehci-platform.c
index bc7b9be12f54..f1908ea9fbd8 100644
--- a/drivers/usb/host/ehci-platform.c
+++ b/drivers/usb/host/ehci-platform.c
@@ -384,8 +384,10 @@ static int ehci_platform_resume(struct device *dev)
         }
 
         companion_dev = usb_of_get_companion_dev(hcd->self.controller);
-        if (companion_dev)
+        if (companion_dev) {
                 device_pm_wait_for_dev(hcd->self.controller, companion_dev);
+                put_device(companion_dev);
+        }
 
         ehci_resume(hcd, priv->reset_on_resume);
         return 0;
diff --git a/drivers/usb/host/r8a66597-hcd.c b/drivers/usb/host/r8a66597-hcd.c
index bfa7fa3d2eea..7bf78be1fd32 100644
--- a/drivers/usb/host/r8a66597-hcd.c
+++ b/drivers/usb/host/r8a66597-hcd.c
@@ -1269,7 +1269,7 @@ static void set_td_timer(struct r8a66597 *r8a66597, struct r8a66597_td *td)
                         time = 30;
                         break;
                 default:
-                        time = 300;
+                        time = 50;
                         break;
                 }
 
@@ -1785,6 +1785,7 @@ static void r8a66597_td_timer(unsigned long _r8a66597)
                 pipe = td->pipe;
                 pipe_stop(r8a66597, pipe);
 
+                /* Select a different address or endpoint */
                 new_td = td;
                 do {
                         list_move_tail(&new_td->queue,
@@ -1794,7 +1795,8 @@ static void r8a66597_td_timer(unsigned long _r8a66597)
                                 new_td = td;
                                 break;
                         }
-                } while (td != new_td && td->address == new_td->address);
+                } while (td != new_td && td->address == new_td->address &&
+                        td->pipe->info.epnum == new_td->pipe->info.epnum);
 
                 start_transfer(r8a66597, new_td);
 
diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index 5e3e9d4c6956..0dde49c35dd2 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -419,7 +419,7 @@ static int xhci_stop_device(struct xhci_hcd *xhci, int slot_id, int suspend)
         wait_for_completion(cmd->completion);
 
         if (cmd->status == COMP_COMMAND_ABORTED ||
-                        cmd->status == COMP_STOPPED) {
+            cmd->status == COMP_COMMAND_RING_STOPPED) {
                 xhci_warn(xhci, "Timeout while waiting for stop endpoint command\n");
                 ret = -ETIME;
         }
diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
index bbe22bcc550a..1f1687e888d6 100644
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -56,7 +56,7 @@ static struct xhci_segment *xhci_segment_alloc(struct xhci_hcd *xhci,
         }
 
         if (max_packet) {
-                seg->bounce_buf = kzalloc(max_packet, flags | GFP_DMA);
+                seg->bounce_buf = kzalloc(max_packet, flags);
                 if (!seg->bounce_buf) {
                         dma_pool_free(xhci->segment_pool, seg->trbs, dma);
                         kfree(seg);
@@ -1724,7 +1724,7 @@ static int scratchpad_alloc(struct xhci_hcd *xhci, gfp_t flags)
         xhci->dcbaa->dev_context_ptrs[0] = cpu_to_le64(xhci->scratchpad->sp_dma);
         for (i = 0; i < num_sp; i++) {
                 dma_addr_t dma;
-                void *buf = dma_alloc_coherent(dev, xhci->page_size, &dma,
+                void *buf = dma_zalloc_coherent(dev, xhci->page_size, &dma,
                                 flags);
                 if (!buf)
                         goto fail_sp4;
@@ -2307,10 +2307,11 @@ static int xhci_setup_port_arrays(struct xhci_hcd *xhci, gfp_t flags)
         /* Place limits on the number of roothub ports so that the hub
          * descriptors aren't longer than the USB core will allocate.
          */
-        if (xhci->num_usb3_ports > 15) {
+        if (xhci->num_usb3_ports > USB_SS_MAXPORTS) {
                 xhci_dbg_trace(xhci, trace_xhci_dbg_init,
-                                "Limiting USB 3.0 roothub ports to 15.");
-                xhci->num_usb3_ports = 15;
+                                "Limiting USB 3.0 roothub ports to %u.",
+                                USB_SS_MAXPORTS);
+                xhci->num_usb3_ports = USB_SS_MAXPORTS;
         }
         if (xhci->num_usb2_ports > USB_MAXCHILDREN) {
                 xhci_dbg_trace(xhci, trace_xhci_dbg_init,
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index 7b86508ac8cf..fcf1f3f63e7a 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -52,6 +52,7 @@
 #define PCI_DEVICE_ID_INTEL_BROXTON_M_XHCI              0x0aa8
 #define PCI_DEVICE_ID_INTEL_BROXTON_B_XHCI              0x1aa8
 #define PCI_DEVICE_ID_INTEL_APL_XHCI                    0x5aa8
+#define PCI_DEVICE_ID_INTEL_DNV_XHCI                    0x19d0
 
 static const char hcd_name[] = "xhci_hcd";
 
@@ -166,7 +167,8 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
                  pdev->device == PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI ||
                  pdev->device == PCI_DEVICE_ID_INTEL_BROXTON_M_XHCI ||
                  pdev->device == PCI_DEVICE_ID_INTEL_BROXTON_B_XHCI ||
-                 pdev->device == PCI_DEVICE_ID_INTEL_APL_XHCI)) {
+                 pdev->device == PCI_DEVICE_ID_INTEL_APL_XHCI ||
+                 pdev->device == PCI_DEVICE_ID_INTEL_DNV_XHCI)) {
                 xhci->quirks |= XHCI_PME_STUCK_QUIRK;
         }
         if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
@@ -175,7 +177,8 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
         }
         if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
             (pdev->device == PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI ||
-             pdev->device == PCI_DEVICE_ID_INTEL_APL_XHCI))
+             pdev->device == PCI_DEVICE_ID_INTEL_APL_XHCI ||
+             pdev->device == PCI_DEVICE_ID_INTEL_DNV_XHCI))
                 xhci->quirks |= XHCI_MISSING_CAS;
 
         if (pdev->vendor == PCI_VENDOR_ID_ETRON &&
diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
index 7c2a9e7c8e0f..c04144b25a67 100644
--- a/drivers/usb/host/xhci-plat.c
+++ b/drivers/usb/host/xhci-plat.c
@@ -177,7 +177,7 @@ static int xhci_plat_probe(struct platform_device *pdev)
 
         irq = platform_get_irq(pdev, 0);
         if (irq < 0)
-                return -ENODEV;
+                return irq;
 
         /*
          * sysdev must point to a device that is known to the system firmware
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 74bf5c60a260..03f63f50afb6 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -323,7 +323,7 @@ static void xhci_handle_stopped_cmd_ring(struct xhci_hcd *xhci,
                 if (i_cmd->status != COMP_COMMAND_ABORTED)
                         continue;
 
-                i_cmd->status = COMP_STOPPED;
+                i_cmd->status = COMP_COMMAND_RING_STOPPED;
 
                 xhci_dbg(xhci, "Turn aborted command %p to no-op\n",
                          i_cmd->command_trb);
@@ -641,8 +641,8 @@ static void xhci_giveback_urb_in_irq(struct xhci_hcd *xhci,
         xhci_urb_free_priv(urb_priv);
         usb_hcd_unlink_urb_from_ep(hcd, urb);
         spin_unlock(&xhci->lock);
-        usb_hcd_giveback_urb(hcd, urb, status);
         trace_xhci_urb_giveback(urb);
+        usb_hcd_giveback_urb(hcd, urb, status);
         spin_lock(&xhci->lock);
 }
 
@@ -1380,7 +1380,7 @@ static void handle_cmd_completion(struct xhci_hcd *xhci,
         cmd_comp_code = GET_COMP_CODE(le32_to_cpu(event->status));
 
         /* If CMD ring stopped we own the trbs between enqueue and dequeue */
-        if (cmd_comp_code == COMP_STOPPED) {
+        if (cmd_comp_code == COMP_COMMAND_RING_STOPPED) {
                 complete_all(&xhci->cmd_ring_stop_completion);
                 return;
         }
@@ -1436,8 +1436,8 @@ static void handle_cmd_completion(struct xhci_hcd *xhci,
                 break;
         case TRB_CMD_NOOP:
                 /* Is this an aborted command turned to NO-OP? */
-                if (cmd->status == COMP_STOPPED)
-                        cmd_comp_code = COMP_STOPPED;
+                if (cmd->status == COMP_COMMAND_RING_STOPPED)
+                        cmd_comp_code = COMP_COMMAND_RING_STOPPED;
                 break;
         case TRB_RESET_EP:
                 WARN_ON(slot_id != TRB_TO_SLOT_ID(
@@ -2677,11 +2677,12 @@ irqreturn_t xhci_irq(struct usb_hcd *hcd)
         struct xhci_hcd *xhci = hcd_to_xhci(hcd);
         union xhci_trb *event_ring_deq;
         irqreturn_t ret = IRQ_NONE;
+        unsigned long flags;
         dma_addr_t deq;
         u64 temp_64;
         u32 status;
 
-        spin_lock(&xhci->lock);
+        spin_lock_irqsave(&xhci->lock, flags);
         /* Check if the xHC generated the interrupt, or the irq is shared */
         status = readl(&xhci->op_regs->status);
         if (status == ~(u32)0) {
@@ -2707,12 +2708,9 @@ irqreturn_t xhci_irq(struct usb_hcd *hcd)
          */
         status |= STS_EINT;
         writel(status, &xhci->op_regs->status);
-        /* FIXME when MSI-X is supported and there are multiple vectors */
-        /* Clear the MSI-X event interrupt status */
 
-        if (hcd->irq) {
+        if (!hcd->msi_enabled) {
                 u32 irq_pending;
-                /* Acknowledge the PCI interrupt */
                 irq_pending = readl(&xhci->ir_set->irq_pending);
                 irq_pending |= IMAN_IP;
                 writel(irq_pending, &xhci->ir_set->irq_pending);
@@ -2757,7 +2755,7 @@ irqreturn_t xhci_irq(struct usb_hcd *hcd)
         ret = IRQ_HANDLED;
 
 out:
-        spin_unlock(&xhci->lock);
+        spin_unlock_irqrestore(&xhci->lock, flags);
 
         return ret;
 }
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 2d1310220832..30f47d92a610 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -359,9 +359,10 @@ static int xhci_try_enable_msi(struct usb_hcd *hcd)
                 /* fall back to msi*/
                 ret = xhci_setup_msi(xhci);
 
-        if (!ret)
-                /* hcd->irq is 0, we have MSI */
+        if (!ret) {
+                hcd->msi_enabled = 1;
                 return 0;
+        }
 
         if (!pdev->irq) {
                 xhci_err(xhci, "No msi-x/msi found and no IRQ in BIOS\n");
@@ -1763,7 +1764,7 @@ static int xhci_configure_endpoint_result(struct xhci_hcd *xhci,
 
         switch (*cmd_status) {
         case COMP_COMMAND_ABORTED:
-        case COMP_STOPPED:
+        case COMP_COMMAND_RING_STOPPED:
                 xhci_warn(xhci, "Timeout while waiting for configure endpoint command\n");
                 ret = -ETIME;
                 break;
@@ -1813,7 +1814,7 @@ static int xhci_evaluate_context_result(struct xhci_hcd *xhci,
 
         switch (*cmd_status) {
         case COMP_COMMAND_ABORTED:
-        case COMP_STOPPED:
+        case COMP_COMMAND_RING_STOPPED:
                 xhci_warn(xhci, "Timeout while waiting for evaluate context command\n");
                 ret = -ETIME;
                 break;
@@ -3432,7 +3433,7 @@ static int xhci_discover_or_reset_device(struct usb_hcd *hcd,
         ret = reset_device_cmd->status;
         switch (ret) {
         case COMP_COMMAND_ABORTED:
-        case COMP_STOPPED:
+        case COMP_COMMAND_RING_STOPPED:
                 xhci_warn(xhci, "Timeout waiting for reset device command\n");
                 ret = -ETIME;
                 goto command_cleanup;
@@ -3817,7 +3818,7 @@ static int xhci_setup_device(struct usb_hcd *hcd, struct usb_device *udev,
          */
         switch (command->status) {
         case COMP_COMMAND_ABORTED:
-        case COMP_STOPPED:
+        case COMP_COMMAND_RING_STOPPED:
                 xhci_warn(xhci, "Timeout while waiting for setup device command\n");
                 ret = -ETIME;
                 break;
diff --git a/drivers/usb/misc/chaoskey.c b/drivers/usb/misc/chaoskey.c
index e9cae4d82af2..15d4e64d3b65 100644
--- a/drivers/usb/misc/chaoskey.c
+++ b/drivers/usb/misc/chaoskey.c
@@ -192,7 +192,7 @@ static int chaoskey_probe(struct usb_interface *interface,
 
         dev->in_ep = in_ep;
 
-        if (udev->descriptor.idVendor != ALEA_VENDOR_ID)
+        if (le16_to_cpu(udev->descriptor.idVendor) != ALEA_VENDOR_ID)
                 dev->reads_started = 1;
 
         dev->size = size;
diff --git a/drivers/usb/misc/iowarrior.c b/drivers/usb/misc/iowarrior.c
index 77569531b78a..83b05a287b0c 100644
--- a/drivers/usb/misc/iowarrior.c
+++ b/drivers/usb/misc/iowarrior.c
@@ -554,7 +554,7 @@ static long iowarrior_ioctl(struct file *file, unsigned int cmd,
                         info.revision = le16_to_cpu(dev->udev->descriptor.bcdDevice);
 
                         /* 0==UNKNOWN, 1==LOW(usb1.1) ,2=FULL(usb1.1), 3=HIGH(usb2.0) */
-                        info.speed = le16_to_cpu(dev->udev->speed);
+                        info.speed = dev->udev->speed;
                         info.if_num = dev->interface->cur_altsetting->desc.bInterfaceNumber;
                         info.report_size = dev->report_size;
 
diff --git a/drivers/usb/misc/legousbtower.c b/drivers/usb/misc/legousbtower.c
index aa3c280fdf8d..0782ac6f5edf 100644
--- a/drivers/usb/misc/legousbtower.c
+++ b/drivers/usb/misc/legousbtower.c
@@ -926,6 +926,7 @@ static int tower_probe (struct usb_interface *interface, const struct usb_device
                  USB_MAJOR, dev->minor);
 
 exit:
+        kfree(get_version_reply);
         return retval;
 
 error:
diff --git a/drivers/usb/misc/sisusbvga/sisusb_con.c b/drivers/usb/misc/sisusbvga/sisusb_con.c
index 3c6948af726a..f019d80ca9e4 100644
--- a/drivers/usb/misc/sisusbvga/sisusb_con.c
+++ b/drivers/usb/misc/sisusbvga/sisusb_con.c
@@ -973,7 +973,7 @@ sisusbcon_set_origin(struct vc_data *c)
 
         mutex_unlock(&sisusb->lock);
 
-        return 1;
+        return true;
 }
 
 /* Interface routine */
diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c
index ac3a4952abb4..dbe617a735d8 100644
--- a/drivers/usb/musb/musb_host.c
+++ b/drivers/usb/musb/musb_host.c
@@ -2780,10 +2780,11 @@ int musb_host_setup(struct musb *musb, int power_budget)
         int ret;
         struct usb_hcd *hcd = musb->hcd;
 
-        MUSB_HST_MODE(musb);
-        musb->xceiv->otg->default_a = 1;
-        musb->xceiv->otg->state = OTG_STATE_A_IDLE;
-
+        if (musb->port_mode == MUSB_PORT_MODE_HOST) {
+                MUSB_HST_MODE(musb);
+                musb->xceiv->otg->default_a = 1;
+                musb->xceiv->otg->state = OTG_STATE_A_IDLE;
+        }
         otg_set_host(musb->xceiv->otg, &hcd->self);
         hcd->self.otg_port = 1;
         musb->xceiv->otg->host = &hcd->self;
diff --git a/drivers/usb/musb/tusb6010_omap.c b/drivers/usb/musb/tusb6010_omap.c
index 8b43c4b99f04..7870b37e0ea5 100644
--- a/drivers/usb/musb/tusb6010_omap.c
+++ b/drivers/usb/musb/tusb6010_omap.c
@@ -219,6 +219,7 @@ static int tusb_omap_dma_program(struct dma_channel *channel, u16 packet_sz,
         u32                             dma_remaining;
         int                             src_burst, dst_burst;
         u16                             csr;
+        u32                             psize;
         int                             ch;
         s8                              dmareq;
         s8                              sync_dev;
@@ -390,15 +391,19 @@ static int tusb_omap_dma_program(struct dma_channel *channel, u16 packet_sz,
 
         if (chdat->tx) {
                 /* Send transfer_packet_sz packets at a time */
-                musb_writel(ep_conf, TUSB_EP_MAX_PACKET_SIZE_OFFSET,
-                        chdat->transfer_packet_sz);
+                psize = musb_readl(ep_conf, TUSB_EP_MAX_PACKET_SIZE_OFFSET);
+                psize &= ~0x7ff;
+                psize |= chdat->transfer_packet_sz;
+                musb_writel(ep_conf, TUSB_EP_MAX_PACKET_SIZE_OFFSET, psize);
 
                 musb_writel(ep_conf, TUSB_EP_TX_OFFSET,
                         TUSB_EP_CONFIG_XFR_SIZE(chdat->transfer_len));
         } else {
                 /* Receive transfer_packet_sz packets at a time */
-                musb_writel(ep_conf, TUSB_EP_MAX_PACKET_SIZE_OFFSET,
-                        chdat->transfer_packet_sz << 16);
+                psize = musb_readl(ep_conf, TUSB_EP_MAX_PACKET_SIZE_OFFSET);
+                psize &= ~(0x7ff << 16);
+                psize |= (chdat->transfer_packet_sz << 16);
+                musb_writel(ep_conf, TUSB_EP_MAX_PACKET_SIZE_OFFSET, psize);
 
                 musb_writel(ep_conf, TUSB_EP_RX_OFFSET,
                         TUSB_EP_CONFIG_XFR_SIZE(chdat->transfer_len));
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index d38780fa8788..aba74f817dc6 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -809,10 +809,10 @@ static const struct usb_device_id id_table_combined[] = {
         { USB_DEVICE(FTDI_VID, FTDI_PROPOX_ISPCABLEIII_PID) },
         { USB_DEVICE(FTDI_VID, CYBER_CORTEX_AV_PID),
                 .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
-        { USB_DEVICE(OLIMEX_VID, OLIMEX_ARM_USB_OCD_PID),
-                .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
-        { USB_DEVICE(OLIMEX_VID, OLIMEX_ARM_USB_OCD_H_PID),
-                .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+        { USB_DEVICE_INTERFACE_NUMBER(OLIMEX_VID, OLIMEX_ARM_USB_OCD_PID, 1) },
+        { USB_DEVICE_INTERFACE_NUMBER(OLIMEX_VID, OLIMEX_ARM_USB_OCD_H_PID, 1) },
+        { USB_DEVICE_INTERFACE_NUMBER(OLIMEX_VID, OLIMEX_ARM_USB_TINY_PID, 1) },
+        { USB_DEVICE_INTERFACE_NUMBER(OLIMEX_VID, OLIMEX_ARM_USB_TINY_H_PID, 1) },
         { USB_DEVICE(FIC_VID, FIC_NEO1973_DEBUG_PID),
                 .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
         { USB_DEVICE(FTDI_VID, FTDI_OOCDLINK_PID),
@@ -1527,9 +1527,9 @@ static int set_serial_info(struct tty_struct *tty,
                                         (new_serial.flags & ASYNC_FLAGS));
         priv->custom_divisor = new_serial.custom_divisor;
 
+check_and_exit:
         write_latency_timer(port);
 
-check_and_exit:
         if ((old_priv.flags & ASYNC_SPD_MASK) !=
              (priv->flags & ASYNC_SPD_MASK)) {
                 if ((priv->flags & ASYNC_SPD_MASK) == ASYNC_SPD_HI)
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index 71fb9e59db71..4fcf1cecb6d7 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -882,6 +882,8 @@
 /* Olimex */
 #define OLIMEX_VID                      0x15BA
 #define OLIMEX_ARM_USB_OCD_PID          0x0003
+#define OLIMEX_ARM_USB_TINY_PID 0x0004
+#define OLIMEX_ARM_USB_TINY_H_PID       0x002a
 #define OLIMEX_ARM_USB_OCD_H_PID        0x002b
 
 /*
diff --git a/drivers/usb/serial/io_ti.c b/drivers/usb/serial/io_ti.c
index 87798e625d6c..6cefb9cb133d 100644
--- a/drivers/usb/serial/io_ti.c
+++ b/drivers/usb/serial/io_ti.c
@@ -2336,8 +2336,11 @@ static void change_port_settings(struct tty_struct *tty,
         if (!baud) {
                 /* pick a default, any default... */
                 baud = 9600;
-        } else
+        } else {
+                /* Avoid a zero divisor. */
+                baud = min(baud, 461550);
                 tty_encode_baud_rate(tty, baud, baud);
+        }
 
         edge_port->baud_rate = baud;
         config->wBaudRate = (__u16)((461550L + baud/2) / baud);
diff --git a/drivers/usb/serial/ir-usb.c b/drivers/usb/serial/ir-usb.c
index 73956d48a0c5..f9734a96d516 100644
--- a/drivers/usb/serial/ir-usb.c
+++ b/drivers/usb/serial/ir-usb.c
@@ -197,6 +197,7 @@ static u8 ir_xbof_change(u8 xbof)
 static int ir_startup(struct usb_serial *serial)
 {
         struct usb_irda_cs_descriptor *irda_desc;
+        int rates;
 
         irda_desc = irda_usb_find_class_desc(serial, 0);
         if (!irda_desc) {
@@ -205,18 +206,20 @@ static int ir_startup(struct usb_serial *serial)
                 return -ENODEV;
         }
 
+        rates = le16_to_cpu(irda_desc->wBaudRate);
+
         dev_dbg(&serial->dev->dev,
                 "%s - Baud rates supported:%s%s%s%s%s%s%s%s%s\n",
                 __func__,
-                (irda_desc->wBaudRate & USB_IRDA_BR_2400) ? " 2400" : "",
-                (irda_desc->wBaudRate & USB_IRDA_BR_9600) ? " 9600" : "",
-                (irda_desc->wBaudRate & USB_IRDA_BR_19200) ? " 19200" : "",
-                (irda_desc->wBaudRate & USB_IRDA_BR_38400) ? " 38400" : "",
-                (irda_desc->wBaudRate & USB_IRDA_BR_57600) ? " 57600" : "",
-                (irda_desc->wBaudRate & USB_IRDA_BR_115200) ? " 115200" : "",
-                (irda_desc->wBaudRate & USB_IRDA_BR_576000) ? " 576000" : "",
-                (irda_desc->wBaudRate & USB_IRDA_BR_1152000) ? " 1152000" : "",
-                (irda_desc->wBaudRate & USB_IRDA_BR_4000000) ? " 4000000" : "");
+                (rates & USB_IRDA_BR_2400) ? " 2400" : "",
+                (rates & USB_IRDA_BR_9600) ? " 9600" : "",
+                (rates & USB_IRDA_BR_19200) ? " 19200" : "",
+                (rates & USB_IRDA_BR_38400) ? " 38400" : "",
+                (rates & USB_IRDA_BR_57600) ? " 57600" : "",
+                (rates & USB_IRDA_BR_115200) ? " 115200" : "",
+                (rates & USB_IRDA_BR_576000) ? " 576000" : "",
+                (rates & USB_IRDA_BR_1152000) ? " 1152000" : "",
+                (rates & USB_IRDA_BR_4000000) ? " 4000000" : "");
 
         switch (irda_desc->bmAdditionalBOFs) {
         case USB_IRDA_AB_48:
diff --git a/drivers/usb/serial/mct_u232.c b/drivers/usb/serial/mct_u232.c
index edbc81f205c2..70f346f1aa86 100644
--- a/drivers/usb/serial/mct_u232.c
+++ b/drivers/usb/serial/mct_u232.c
@@ -189,7 +189,7 @@ static int mct_u232_set_baud_rate(struct tty_struct *tty,
                 return -ENOMEM;
 
         divisor = mct_u232_calculate_baud_rate(serial, value, &speed);
-        put_unaligned_le32(cpu_to_le32(divisor), buf);
+        put_unaligned_le32(divisor, buf);
         rc = usb_control_msg(serial->dev, usb_sndctrlpipe(serial->dev, 0),
                                 MCT_U232_SET_BAUD_RATE_REQUEST,
                                 MCT_U232_SET_REQUEST_TYPE,
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index af67a0de6b5d..3bf61acfc26b 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -281,6 +281,7 @@ static void option_instat_callback(struct urb *urb);
 #define TELIT_PRODUCT_LE922_USBCFG0             0x1042
 #define TELIT_PRODUCT_LE922_USBCFG3             0x1043
 #define TELIT_PRODUCT_LE922_USBCFG5             0x1045
+#define TELIT_PRODUCT_ME910                     0x1100
 #define TELIT_PRODUCT_LE920                     0x1200
 #define TELIT_PRODUCT_LE910                     0x1201
 #define TELIT_PRODUCT_LE910_USBCFG4             0x1206
@@ -640,6 +641,11 @@ static const struct option_blacklist_info simcom_sim7100e_blacklist = {
         .reserved = BIT(5) | BIT(6),
 };
 
+static const struct option_blacklist_info telit_me910_blacklist = {
+        .sendsetup = BIT(0),
+        .reserved = BIT(1) | BIT(3),
+};
+
 static const struct option_blacklist_info telit_le910_blacklist = {
         .sendsetup = BIT(0),
         .reserved = BIT(1) | BIT(2),
@@ -1235,6 +1241,8 @@ static const struct usb_device_id option_ids[] = {
                 .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 },
         { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG5, 0xff),
                 .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg0 },
+        { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910),
+                .driver_info = (kernel_ulong_t)&telit_me910_blacklist },
         { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910),
                 .driver_info = (kernel_ulong_t)&telit_le910_blacklist },
         { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910_USBCFG4),
diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
index 38b3f0d8cd58..fd509ed6cf70 100644
--- a/drivers/usb/serial/qcserial.c
+++ b/drivers/usb/serial/qcserial.c
@@ -162,6 +162,8 @@ static const struct usb_device_id id_table[] = {
         {DEVICE_SWI(0x1199, 0x9071)},   /* Sierra Wireless MC74xx */
         {DEVICE_SWI(0x1199, 0x9078)},   /* Sierra Wireless EM74xx */
         {DEVICE_SWI(0x1199, 0x9079)},   /* Sierra Wireless EM74xx */
+        {DEVICE_SWI(0x1199, 0x907a)},   /* Sierra Wireless EM74xx QDL */
+        {DEVICE_SWI(0x1199, 0x907b)},   /* Sierra Wireless EM74xx */
         {DEVICE_SWI(0x413c, 0x81a2)},   /* Dell Wireless 5806 Gobi(TM) 4G LTE Mobile Broadband Card */
         {DEVICE_SWI(0x413c, 0x81a3)},   /* Dell Wireless 5570 HSPA+ (42Mbps) Mobile Broadband Card */
         {DEVICE_SWI(0x413c, 0x81a4)},   /* Dell Wireless 5570e HSPA+ (42Mbps) Mobile Broadband Card */
diff --git a/drivers/usb/storage/ene_ub6250.c b/drivers/usb/storage/ene_ub6250.c
index 369f3c24815a..44af719194b2 100644
--- a/drivers/usb/storage/ene_ub6250.c
+++ b/drivers/usb/storage/ene_ub6250.c
@@ -446,6 +446,10 @@ struct ms_lib_ctrl {
 #define SD_BLOCK_LEN  9
 
 struct ene_ub6250_info {
+
+        /* I/O bounce buffer */
+        u8              *bbuf;
+
         /* for 6250 code */
         struct SD_STATUS        SD_Status;
         struct MS_STATUS        MS_Status;
@@ -493,8 +497,11 @@ static int ene_load_bincode(struct us_data *us, unsigned char flag);
 
 static void ene_ub6250_info_destructor(void *extra)
 {
+        struct ene_ub6250_info *info = (struct ene_ub6250_info *) extra;
+
         if (!extra)
                 return;
+        kfree(info->bbuf);
 }
 
 static int ene_send_scsi_cmd(struct us_data *us, u8 fDir, void *buf, int use_sg)
@@ -860,8 +867,9 @@ static int ms_read_readpage(struct us_data *us, u32 PhyBlockAddr,
                 u8 PageNum, u32 *PageBuf, struct ms_lib_type_extdat *ExtraDat)
 {
         struct bulk_cb_wrap *bcb = (struct bulk_cb_wrap *) us->iobuf;
+        struct ene_ub6250_info *info = (struct ene_ub6250_info *) us->extra;
+        u8 *bbuf = info->bbuf;
         int result;
-        u8 ExtBuf[4];
         u32 bn = PhyBlockAddr * 0x20 + PageNum;
 
         result = ene_load_bincode(us, MS_RW_PATTERN);
@@ -901,7 +909,7 @@ static int ms_read_readpage(struct us_data *us, u32 PhyBlockAddr,
         bcb->CDB[2]     = (unsigned char)(PhyBlockAddr>>16);
         bcb->CDB[6]     = 0x01;
 
-        result = ene_send_scsi_cmd(us, FDIR_READ, &ExtBuf, 0);
+        result = ene_send_scsi_cmd(us, FDIR_READ, bbuf, 0);
         if (result != USB_STOR_XFER_GOOD)
                 return USB_STOR_TRANSPORT_ERROR;
 
@@ -910,9 +918,9 @@ static int ms_read_readpage(struct us_data *us, u32 PhyBlockAddr,
         ExtraDat->status0  = 0x10;  /* Not yet,fireware support */
 
         ExtraDat->status1  = 0x00;  /* Not yet,fireware support */
-        ExtraDat->ovrflg   = ExtBuf[0];
-        ExtraDat->mngflg   = ExtBuf[1];
-        ExtraDat->logadr   = memstick_logaddr(ExtBuf[2], ExtBuf[3]);
+        ExtraDat->ovrflg   = bbuf[0];
+        ExtraDat->mngflg   = bbuf[1];
+        ExtraDat->logadr   = memstick_logaddr(bbuf[2], bbuf[3]);
 
         return USB_STOR_TRANSPORT_GOOD;
 }
@@ -1332,8 +1340,9 @@ static int ms_lib_read_extra(struct us_data *us, u32 PhyBlock,
                                 u8 PageNum, struct ms_lib_type_extdat *ExtraDat)
 {
         struct bulk_cb_wrap *bcb = (struct bulk_cb_wrap *) us->iobuf;
+        struct ene_ub6250_info *info = (struct ene_ub6250_info *) us->extra;
+        u8 *bbuf = info->bbuf;
         int result;
-        u8 ExtBuf[4];
 
         memset(bcb, 0, sizeof(struct bulk_cb_wrap));
         bcb->Signature = cpu_to_le32(US_BULK_CB_SIGN);
@@ -1347,7 +1356,7 @@ static int ms_lib_read_extra(struct us_data *us, u32 PhyBlock,
         bcb->CDB[2]     = (unsigned char)(PhyBlock>>16);
         bcb->CDB[6]     = 0x01;
 
-        result = ene_send_scsi_cmd(us, FDIR_READ, &ExtBuf, 0);
+        result = ene_send_scsi_cmd(us, FDIR_READ, bbuf, 0);
         if (result != USB_STOR_XFER_GOOD)
                 return USB_STOR_TRANSPORT_ERROR;
 
@@ -1355,9 +1364,9 @@ static int ms_lib_read_extra(struct us_data *us, u32 PhyBlock,
         ExtraDat->intr     = 0x80;  /* Not yet, waiting for fireware support */
         ExtraDat->status0  = 0x10;  /* Not yet, waiting for fireware support */
         ExtraDat->status1  = 0x00;  /* Not yet, waiting for fireware support */
-        ExtraDat->ovrflg   = ExtBuf[0];
-        ExtraDat->mngflg   = ExtBuf[1];
-        ExtraDat->logadr   = memstick_logaddr(ExtBuf[2], ExtBuf[3]);
+        ExtraDat->ovrflg   = bbuf[0];
+        ExtraDat->mngflg   = bbuf[1];
+        ExtraDat->logadr   = memstick_logaddr(bbuf[2], bbuf[3]);
 
         return USB_STOR_TRANSPORT_GOOD;
 }
@@ -1556,9 +1565,9 @@ static int ms_lib_scan_logicalblocknumber(struct us_data *us, u16 btBlk1st)
         u16 PhyBlock, newblk, i;
         u16 LogStart, LogEnde;
         struct ms_lib_type_extdat extdat;
-        u8 buf[0x200];
         u32 count = 0, index = 0;
         struct ene_ub6250_info *info = (struct ene_ub6250_info *) us->extra;
+        u8 *bbuf = info->bbuf;
 
         for (PhyBlock = 0; PhyBlock < info->MS_Lib.NumberOfPhyBlock;) {
                 ms_lib_phy_to_log_range(PhyBlock, &LogStart, &LogEnde);
@@ -1572,14 +1581,16 @@ static int ms_lib_scan_logicalblocknumber(struct us_data *us, u16 btBlk1st)
                         }
 
                         if (count == PhyBlock) {
-                                ms_lib_read_extrablock(us, PhyBlock, 0, 0x80, &buf);
+                                ms_lib_read_extrablock(us, PhyBlock, 0, 0x80,
+                                                bbuf);
                                 count += 0x80;
                         }
                         index = (PhyBlock % 0x80) * 4;
 
-                        extdat.ovrflg = buf[index];
-                        extdat.mngflg = buf[index+1];
-                        extdat.logadr = memstick_logaddr(buf[index+2], buf[index+3]);
+                        extdat.ovrflg = bbuf[index];
+                        extdat.mngflg = bbuf[index+1];
+                        extdat.logadr = memstick_logaddr(bbuf[index+2],
+                                        bbuf[index+3]);
 
                         if ((extdat.ovrflg & MS_REG_OVR_BKST) != MS_REG_OVR_BKST_OK) {
                                 ms_lib_setacquired_errorblock(us, PhyBlock);
@@ -2062,9 +2073,9 @@ static int ene_ms_init(struct us_data *us)
 {
         struct bulk_cb_wrap *bcb = (struct bulk_cb_wrap *) us->iobuf;
         int result;
-        u8 buf[0x200];
         u16 MSP_BlockSize, MSP_UserAreaBlocks;
         struct ene_ub6250_info *info = (struct ene_ub6250_info *) us->extra;
+        u8 *bbuf = info->bbuf;
 
         printk(KERN_INFO "transport --- ENE_MSInit\n");
 
@@ -2083,13 +2094,13 @@ static int ene_ms_init(struct us_data *us)
         bcb->CDB[0]     = 0xF1;
         bcb->CDB[1]     = 0x01;
 
-        result = ene_send_scsi_cmd(us, FDIR_READ, &buf, 0);
+        result = ene_send_scsi_cmd(us, FDIR_READ, bbuf, 0);
         if (result != USB_STOR_XFER_GOOD) {
                 printk(KERN_ERR "Execution MS Init Code Fail !!\n");
                 return USB_STOR_TRANSPORT_ERROR;
         }
         /* the same part to test ENE */
-        info->MS_Status = *(struct MS_STATUS *)&buf[0];
+        info->MS_Status = *(struct MS_STATUS *) bbuf;
 
         if (info->MS_Status.Insert && info->MS_Status.Ready) {
                 printk(KERN_INFO "Insert     = %x\n", info->MS_Status.Insert);
@@ -2098,15 +2109,15 @@ static int ene_ms_init(struct us_data *us)
                 printk(KERN_INFO "IsMSPHG    = %x\n", info->MS_Status.IsMSPHG);
                 printk(KERN_INFO "WtP= %x\n", info->MS_Status.WtP);
                 if (info->MS_Status.IsMSPro) {
-                        MSP_BlockSize      = (buf[6] << 8) | buf[7];
-                        MSP_UserAreaBlocks = (buf[10] << 8) | buf[11];
+                        MSP_BlockSize      = (bbuf[6] << 8) | bbuf[7];
+                        MSP_UserAreaBlocks = (bbuf[10] << 8) | bbuf[11];
                         info->MSP_TotalBlock = MSP_BlockSize * MSP_UserAreaBlocks;
                 } else {
                         ms_card_init(us); /* Card is MS (to ms.c)*/
                 }
                 usb_stor_dbg(us, "MS Init Code OK !!\n");
         } else {
-                usb_stor_dbg(us, "MS Card Not Ready --- %x\n", buf[0]);
+                usb_stor_dbg(us, "MS Card Not Ready --- %x\n", bbuf[0]);
                 return USB_STOR_TRANSPORT_ERROR;
         }
 
@@ -2116,9 +2127,9 @@ static int ene_ms_init(struct us_data *us)
 static int ene_sd_init(struct us_data *us)
 {
         int result;
-        u8  buf[0x200];
         struct bulk_cb_wrap *bcb = (struct bulk_cb_wrap *) us->iobuf;
         struct ene_ub6250_info *info = (struct ene_ub6250_info *) us->extra;
+        u8 *bbuf = info->bbuf;
 
         usb_stor_dbg(us, "transport --- ENE_SDInit\n");
         /* SD Init Part-1 */
@@ -2152,17 +2163,17 @@ static int ene_sd_init(struct us_data *us)
         bcb->Flags              = US_BULK_FLAG_IN;
         bcb->CDB[0]             = 0xF1;
 
-        result = ene_send_scsi_cmd(us, FDIR_READ, &buf, 0);
+        result = ene_send_scsi_cmd(us, FDIR_READ, bbuf, 0);
         if (result != USB_STOR_XFER_GOOD) {
                 usb_stor_dbg(us, "Execution SD Init Code Fail !!\n");
                 return USB_STOR_TRANSPORT_ERROR;
         }
 
-        info->SD_Status =  *(struct SD_STATUS *)&buf[0];
+        info->SD_Status =  *(struct SD_STATUS *) bbuf;
         if (info->SD_Status.Insert && info->SD_Status.Ready) {
                 struct SD_STATUS *s = &info->SD_Status;
 
-                ene_get_card_status(us, (unsigned char *)&buf);
+                ene_get_card_status(us, bbuf);
                 usb_stor_dbg(us, "Insert     = %x\n", s->Insert);
                 usb_stor_dbg(us, "Ready      = %x\n", s->Ready);
                 usb_stor_dbg(us, "IsMMC      = %x\n", s->IsMMC);
@@ -2170,7 +2181,7 @@ static int ene_sd_init(struct us_data *us)
                 usb_stor_dbg(us, "HiSpeed    = %x\n", s->HiSpeed);
                 usb_stor_dbg(us, "WtP        = %x\n", s->WtP);
         } else {
-                usb_stor_dbg(us, "SD Card Not Ready --- %x\n", buf[0]);
+                usb_stor_dbg(us, "SD Card Not Ready --- %x\n", bbuf[0]);
                 return USB_STOR_TRANSPORT_ERROR;
         }
         return USB_STOR_TRANSPORT_GOOD;
@@ -2180,13 +2191,15 @@ static int ene_sd_init(struct us_data *us)
 static int ene_init(struct us_data *us)
 {
         int result;
-        u8  misc_reg03 = 0;
+        u8  misc_reg03;
         struct ene_ub6250_info *info = (struct ene_ub6250_info *)(us->extra);
+        u8 *bbuf = info->bbuf;
 
-        result = ene_get_card_type(us, REG_CARD_STATUS, &misc_reg03);
+        result = ene_get_card_type(us, REG_CARD_STATUS, bbuf);
         if (result != USB_STOR_XFER_GOOD)
                 return USB_STOR_TRANSPORT_ERROR;
 
+        misc_reg03 = bbuf[0];
         if (misc_reg03 & 0x01) {
                 if (!info->SD_Status.Ready) {
                         result = ene_sd_init(us);
@@ -2303,8 +2316,9 @@ static int ene_ub6250_probe(struct usb_interface *intf,
                          const struct usb_device_id *id)
 {
         int result;
-        u8  misc_reg03 = 0;
+        u8  misc_reg03;
         struct us_data *us;
+        struct ene_ub6250_info *info;
 
         result = usb_stor_probe1(&us, intf, id,
                    (id - ene_ub6250_usb_ids) + ene_ub6250_unusual_dev_list,
@@ -2313,11 +2327,16 @@ static int ene_ub6250_probe(struct usb_interface *intf,
                 return result;
 
         /* FIXME: where should the code alloc extra buf ? */
-        if (!us->extra) {
-                us->extra = kzalloc(sizeof(struct ene_ub6250_info), GFP_KERNEL);
-                if (!us->extra)
-                        return -ENOMEM;
-                us->extra_destructor = ene_ub6250_info_destructor;
+        us->extra = kzalloc(sizeof(struct ene_ub6250_info), GFP_KERNEL);
+        if (!us->extra)
+                return -ENOMEM;
+        us->extra_destructor = ene_ub6250_info_destructor;
+
+        info = (struct ene_ub6250_info *)(us->extra);
+        info->bbuf = kmalloc(512, GFP_KERNEL);
+        if (!info->bbuf) {
+                kfree(us->extra);
+                return -ENOMEM;
         }
 
         us->transport_name = "ene_ub6250";
@@ -2329,12 +2348,13 @@ static int ene_ub6250_probe(struct usb_interface *intf,
                 return result;
 
         /* probe card type */
-        result = ene_get_card_type(us, REG_CARD_STATUS, &misc_reg03);
+        result = ene_get_card_type(us, REG_CARD_STATUS, info->bbuf);
         if (result != USB_STOR_XFER_GOOD) {
                 usb_stor_disconnect(intf);
                 return USB_STOR_TRANSPORT_ERROR;
         }
 
+        misc_reg03 = info->bbuf[0];
         if (!(misc_reg03 & 0x01)) {
                 pr_info("ums_eneub6250: This driver only supports SD/MS cards. "
                         "It does not support SM cards.\n");
diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c
index 5d8b2c261940..0585078638db 100644
--- a/drivers/usb/usbip/vhci_hcd.c
+++ b/drivers/usb/usbip/vhci_hcd.c
@@ -235,14 +235,19 @@ done:
 
 static inline void hub_descriptor(struct usb_hub_descriptor *desc)
 {
+        int width;
+
         memset(desc, 0, sizeof(*desc));
         desc->bDescriptorType = USB_DT_HUB;
-        desc->bDescLength = 9;
         desc->wHubCharacteristics = cpu_to_le16(
                 HUB_CHAR_INDV_PORT_LPSM | HUB_CHAR_COMMON_OCPM);
+
         desc->bNbrPorts = VHCI_HC_PORTS;
-        desc->u.hs.DeviceRemovable[0] = 0xff;
-        desc->u.hs.DeviceRemovable[1] = 0xff;
+        BUILD_BUG_ON(VHCI_HC_PORTS > USB_MAXCHILDREN);
+        width = desc->bNbrPorts / 8 + 1;
+        desc->bDescLength = USB_DT_HUB_NONVAR_SIZE + 2 * width;
+        memset(&desc->u.hs.DeviceRemovable[0], 0, width);
+        memset(&desc->u.hs.DeviceRemovable[width], 0xff, width);
 }
 
 static int vhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
diff --git a/drivers/uwb/i1480/dfu/usb.c b/drivers/uwb/i1480/dfu/usb.c
index 6345e85822a4..a50cf45e530f 100644
--- a/drivers/uwb/i1480/dfu/usb.c
+++ b/drivers/uwb/i1480/dfu/usb.c
@@ -341,6 +341,7 @@ error_submit_ep1:
 static
 int i1480_usb_probe(struct usb_interface *iface, const struct usb_device_id *id)
 {
+        struct usb_device *udev = interface_to_usbdev(iface);
         struct i1480_usb *i1480_usb;
         struct i1480 *i1480;
         struct device *dev = &iface->dev;
@@ -352,8 +353,8 @@ int i1480_usb_probe(struct usb_interface *iface, const struct usb_device_id *id)
                         iface->cur_altsetting->desc.bInterfaceNumber);
                 goto error;
         }
-        if (iface->num_altsetting > 1
-            && interface_to_usbdev(iface)->descriptor.idProduct == 0xbabe) {
+        if (iface->num_altsetting > 1 &&
+                        le16_to_cpu(udev->descriptor.idProduct) == 0xbabe) {
                 /* Need altsetting #1 [HW QUIRK] or EP1 won't work */
                 result = usb_set_interface(interface_to_usbdev(iface), 0, 1);
                 if (result < 0)
diff --git a/drivers/watchdog/Kconfig b/drivers/watchdog/Kconfig
index 52a70ee6014f..8b9049dac094 100644
--- a/drivers/watchdog/Kconfig
+++ b/drivers/watchdog/Kconfig
@@ -452,7 +452,7 @@ config DAVINCI_WATCHDOG
 
 config ORION_WATCHDOG
         tristate "Orion watchdog"
-        depends on ARCH_ORION5X || ARCH_DOVE || MACH_DOVE || ARCH_MVEBU || COMPILE_TEST
+        depends on ARCH_ORION5X || ARCH_DOVE || MACH_DOVE || ARCH_MVEBU || (COMPILE_TEST && !ARCH_EBSA110)
         depends on ARM
         select WATCHDOG_CORE
         help
diff --git a/drivers/watchdog/bcm_kona_wdt.c b/drivers/watchdog/bcm_kona_wdt.c
index 6fce17d5b9f1..a5775dfd8d5f 100644
--- a/drivers/watchdog/bcm_kona_wdt.c
+++ b/drivers/watchdog/bcm_kona_wdt.c
@@ -304,6 +304,8 @@ static int bcm_kona_wdt_probe(struct platform_device *pdev)
         if (!wdt)
                 return -ENOMEM;
 
+        spin_lock_init(&wdt->lock);
+
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         wdt->base = devm_ioremap_resource(dev, res);
         if (IS_ERR(wdt->base))
@@ -316,7 +318,6 @@ static int bcm_kona_wdt_probe(struct platform_device *pdev)
                 return ret;
         }
 
-        spin_lock_init(&wdt->lock);
         platform_set_drvdata(pdev, wdt);
         watchdog_set_drvdata(&bcm_kona_wdt_wdd, wdt);
         bcm_kona_wdt_wdd.parent = &pdev->dev;
diff --git a/drivers/watchdog/cadence_wdt.c b/drivers/watchdog/cadence_wdt.c
index 8d61e8bfe60b..86e0b5d2e761 100644
--- a/drivers/watchdog/cadence_wdt.c
+++ b/drivers/watchdog/cadence_wdt.c
@@ -49,7 +49,7 @@
 /* Counter maximum value */
 #define CDNS_WDT_COUNTER_MAX 0xFFF
 
-static int wdt_timeout = CDNS_WDT_DEFAULT_TIMEOUT;
+static int wdt_timeout;
 static int nowayout = WATCHDOG_NOWAYOUT;
 
 module_param(wdt_timeout, int, 0);
diff --git a/drivers/watchdog/iTCO_wdt.c b/drivers/watchdog/iTCO_wdt.c
index 347f0389b089..c4f65873bfa4 100644
--- a/drivers/watchdog/iTCO_wdt.c
+++ b/drivers/watchdog/iTCO_wdt.c
@@ -306,16 +306,15 @@ static int iTCO_wdt_ping(struct watchdog_device *wd_dev)
 
         iTCO_vendor_pre_keepalive(p->smi_res, wd_dev->timeout);
 
+        /* Reset the timeout status bit so that the timer
+         * needs to count down twice again before rebooting */
+        outw(0x0008, TCO1_STS(p));      /* write 1 to clear bit */
+
         /* Reload the timer by writing to the TCO Timer Counter register */
-        if (p->iTCO_version >= 2) {
+        if (p->iTCO_version >= 2)
                 outw(0x01, TCO_RLD(p));
-        } else if (p->iTCO_version == 1) {
-                /* Reset the timeout status bit so that the timer
-                 * needs to count down twice again before rebooting */
-                outw(0x0008, TCO1_STS(p));      /* write 1 to clear bit */
-
+        else if (p->iTCO_version == 1)
                 outb(0x01, TCO_RLD(p));
-        }
 
         spin_unlock(&p->io_lock);
         return 0;
@@ -328,11 +327,8 @@ static int iTCO_wdt_set_timeout(struct watchdog_device *wd_dev, unsigned int t)
         unsigned char val8;
         unsigned int tmrval;
 
-        tmrval = seconds_to_ticks(p, t);
-
-        /* For TCO v1 the timer counts down twice before rebooting */
-        if (p->iTCO_version == 1)
-                tmrval /= 2;
+        /* The timer counts down twice before rebooting */
+        tmrval = seconds_to_ticks(p, t) / 2;
 
         /* from the specs: */
         /* "Values of 0h-3h are ignored and should not be attempted" */
@@ -385,6 +381,8 @@ static unsigned int iTCO_wdt_get_timeleft(struct watchdog_device *wd_dev)
                 spin_lock(&p->io_lock);
                 val16 = inw(TCO_RLD(p));
                 val16 &= 0x3ff;
+                if (!(inw(TCO1_STS(p)) & 0x0008))
+                        val16 += (inw(TCOv2_TMR(p)) & 0x3ff);
                 spin_unlock(&p->io_lock);
 
                 time_left = ticks_to_seconds(p, val16);
diff --git a/drivers/watchdog/pcwd_usb.c b/drivers/watchdog/pcwd_usb.c
index 99ebf6ea3de6..5615f4013924 100644
--- a/drivers/watchdog/pcwd_usb.c
+++ b/drivers/watchdog/pcwd_usb.c
@@ -630,6 +630,9 @@ static int usb_pcwd_probe(struct usb_interface *interface,
                 return -ENODEV;
         }
 
+        if (iface_desc->desc.bNumEndpoints < 1)
+                return -ENODEV;
+
         /* check out the endpoint: it has to be Interrupt & IN */
         endpoint = &iface_desc->endpoint[0].desc;
 
diff --git a/drivers/watchdog/sama5d4_wdt.c b/drivers/watchdog/sama5d4_wdt.c
index f709962018ac..362fd229786d 100644
--- a/drivers/watchdog/sama5d4_wdt.c
+++ b/drivers/watchdog/sama5d4_wdt.c
@@ -6,6 +6,7 @@
  * Licensed under GPLv2.
  */
 
+#include <linux/delay.h>
 #include <linux/interrupt.h>
 #include <linux/io.h>
 #include <linux/kernel.h>
@@ -29,6 +30,7 @@ struct sama5d4_wdt {
         struct watchdog_device  wdd;
         void __iomem            *reg_base;
         u32                     mr;
+        unsigned long           last_ping;
 };
 
 static int wdt_timeout = WDT_DEFAULT_TIMEOUT;
@@ -44,11 +46,34 @@ MODULE_PARM_DESC(nowayout,
         "Watchdog cannot be stopped once started (default="
         __MODULE_STRING(WATCHDOG_NOWAYOUT) ")");
 
+#define wdt_enabled (!(wdt->mr & AT91_WDT_WDDIS))
+
 #define wdt_read(wdt, field) \
         readl_relaxed((wdt)->reg_base + (field))
 
-#define wdt_write(wtd, field, val) \
-        writel_relaxed((val), (wdt)->reg_base + (field))
+/* 4 slow clock periods is 4/32768 = 122.07µs*/
+#define WDT_DELAY       usecs_to_jiffies(123)
+
+static void wdt_write(struct sama5d4_wdt *wdt, u32 field, u32 val)
+{
+        /*
+         * WDT_CR and WDT_MR must not be modified within three slow clock
+         * periods following a restart of the watchdog performed by a write
+         * access in WDT_CR.
+         */
+        while (time_before(jiffies, wdt->last_ping + WDT_DELAY))
+                usleep_range(30, 125);
+        writel_relaxed(val, wdt->reg_base + field);
+        wdt->last_ping = jiffies;
+}
+
+static void wdt_write_nosleep(struct sama5d4_wdt *wdt, u32 field, u32 val)
+{
+        if (time_before(jiffies, wdt->last_ping + WDT_DELAY))
+                udelay(123);
+        writel_relaxed(val, wdt->reg_base + field);
+        wdt->last_ping = jiffies;
+}
 
 static int sama5d4_wdt_start(struct watchdog_device *wdd)
 {
@@ -89,7 +114,16 @@ static int sama5d4_wdt_set_timeout(struct watchdog_device *wdd,
         wdt->mr &= ~AT91_WDT_WDD;
         wdt->mr |= AT91_WDT_SET_WDV(value);
         wdt->mr |= AT91_WDT_SET_WDD(value);
-        wdt_write(wdt, AT91_WDT_MR, wdt->mr);
+
+        /*
+         * WDDIS has to be 0 when updating WDD/WDV. The datasheet states: When
+         * setting the WDDIS bit, and while it is set, the fields WDV and WDD
+         * must not be modified.
+         * If the watchdog is enabled, then the timeout can be updated. Else,
+         * wait that the user enables it.
+         */
+        if (wdt_enabled)
+                wdt_write(wdt, AT91_WDT_MR, wdt->mr & ~AT91_WDT_WDDIS);
 
         wdd->timeout = timeout;
 
@@ -145,23 +179,21 @@ static int of_sama5d4_wdt_init(struct device_node *np, struct sama5d4_wdt *wdt)
 
 static int sama5d4_wdt_init(struct sama5d4_wdt *wdt)
 {
-        struct watchdog_device *wdd = &wdt->wdd;
-        u32 value = WDT_SEC2TICKS(wdd->timeout);
         u32 reg;
-
         /*
-         * Because the fields WDV and WDD must not be modified when the WDDIS
-         * bit is set, so clear the WDDIS bit before writing the WDT_MR.
+         * When booting and resuming, the bootloader may have changed the
+         * watchdog configuration.
+         * If the watchdog is already running, we can safely update it.
+         * Else, we have to disable it properly.
          */
-        reg = wdt_read(wdt, AT91_WDT_MR);
-        reg &= ~AT91_WDT_WDDIS;
-        wdt_write(wdt, AT91_WDT_MR, reg);
-
-        wdt->mr |= AT91_WDT_SET_WDD(value);
-        wdt->mr |= AT91_WDT_SET_WDV(value);
-
-        wdt_write(wdt, AT91_WDT_MR, wdt->mr);
-
+        if (wdt_enabled) {
+                wdt_write_nosleep(wdt, AT91_WDT_MR, wdt->mr);
+        } else {
+                reg = wdt_read(wdt, AT91_WDT_MR);
+                if (!(reg & AT91_WDT_WDDIS))
+                        wdt_write_nosleep(wdt, AT91_WDT_MR,
+                                          reg | AT91_WDT_WDDIS);
+        }
         return 0;
 }
 
@@ -172,6 +204,7 @@ static int sama5d4_wdt_probe(struct platform_device *pdev)
         struct resource *res;
         void __iomem *regs;
         u32 irq = 0;
+        u32 timeout;
         int ret;
 
         wdt = devm_kzalloc(&pdev->dev, sizeof(*wdt), GFP_KERNEL);
@@ -184,6 +217,7 @@ static int sama5d4_wdt_probe(struct platform_device *pdev)
         wdd->ops = &sama5d4_wdt_ops;
         wdd->min_timeout = MIN_WDT_TIMEOUT;
         wdd->max_timeout = MAX_WDT_TIMEOUT;
+        wdt->last_ping = jiffies;
 
         watchdog_set_drvdata(wdd, wdt);
 
@@ -221,6 +255,11 @@ static int sama5d4_wdt_probe(struct platform_device *pdev)
                 return ret;
         }
 
+        timeout = WDT_SEC2TICKS(wdd->timeout);
+
+        wdt->mr |= AT91_WDT_SET_WDD(timeout);
+        wdt->mr |= AT91_WDT_SET_WDV(timeout);
+
         ret = sama5d4_wdt_init(wdt);
         if (ret)
                 return ret;
@@ -263,9 +302,7 @@ static int sama5d4_wdt_resume(struct device *dev)
 {
         struct sama5d4_wdt *wdt = dev_get_drvdata(dev);
 
-        wdt_write(wdt, AT91_WDT_MR, wdt->mr & ~AT91_WDT_WDDIS);
-        if (wdt->mr & AT91_WDT_WDDIS)
-                wdt_write(wdt, AT91_WDT_MR, wdt->mr);
+        sama5d4_wdt_init(wdt);
 
         return 0;
 }
diff --git a/drivers/watchdog/wdt_pci.c b/drivers/watchdog/wdt_pci.c
index 48b2c058b009..bc7addc2dc06 100644
--- a/drivers/watchdog/wdt_pci.c
+++ b/drivers/watchdog/wdt_pci.c
@@ -332,7 +332,7 @@ static irqreturn_t wdtpci_interrupt(int irq, void *dev_id)
                 pr_crit("Would Reboot\n");
 #else
                 pr_crit("Initiating system reboot\n");
-                emergency_restart(NULL);
+                emergency_restart();
 #endif
 #else
                 pr_crit("Reset in 5ms\n");
diff --git a/drivers/watchdog/zx2967_wdt.c b/drivers/watchdog/zx2967_wdt.c
index e290d5a13a6d..c98252733c30 100644
--- a/drivers/watchdog/zx2967_wdt.c
+++ b/drivers/watchdog/zx2967_wdt.c
@@ -211,10 +211,8 @@ static int zx2967_wdt_probe(struct platform_device *pdev)
 
         base = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         wdt->reg_base = devm_ioremap_resource(dev, base);
-        if (IS_ERR(wdt->reg_base)) {
-                dev_err(dev, "ioremap failed\n");
+        if (IS_ERR(wdt->reg_base))
                 return PTR_ERR(wdt->reg_base);
-        }
 
         zx2967_wdt_reset_sysctrl(dev);