384 files changed, 3796 insertions, 1818 deletions

diff --git a/drivers/acpi/acpica/hwsleep.c b/drivers/acpi/acpica/hwsleep.c
index fc0c2e2328cd..fe9d46d81750 100644
--- a/drivers/acpi/acpica/hwsleep.c
+++ b/drivers/acpi/acpica/hwsleep.c
@@ -51,16 +51,23 @@ acpi_status acpi_hw_legacy_sleep(u8 sleep_state)
                 return_ACPI_STATUS(status);
         }
 
-        /*
-         * 1) Disable all GPEs
-         * 2) Enable all wakeup GPEs
-         */
+        /* Disable all GPEs */
         status = acpi_hw_disable_all_gpes();
         if (ACPI_FAILURE(status)) {
                 return_ACPI_STATUS(status);
         }
+        /*
+         * If the target sleep state is S5, clear all GPEs and fixed events too
+         */
+        if (sleep_state == ACPI_STATE_S5) {
+                status = acpi_hw_clear_acpi_status();
+                if (ACPI_FAILURE(status)) {
+                        return_ACPI_STATUS(status);
+                }
+        }
         acpi_gbl_system_awake_and_running = FALSE;
 
+         /* Enable all wakeup GPEs */
         status = acpi_hw_enable_all_wakeup_gpes();
         if (ACPI_FAILURE(status)) {
                 return_ACPI_STATUS(status);
diff --git a/drivers/acpi/acpica/psloop.c b/drivers/acpi/acpica/psloop.c
index bc5f05906bd1..ee840be150b5 100644
--- a/drivers/acpi/acpica/psloop.c
+++ b/drivers/acpi/acpica/psloop.c
@@ -497,6 +497,18 @@ acpi_status acpi_ps_parse_loop(struct acpi_walk_state *walk_state)
                         status =
                             acpi_ps_create_op(walk_state, aml_op_start, &op);
                         if (ACPI_FAILURE(status)) {
+                                /*
+                                 * ACPI_PARSE_MODULE_LEVEL means that we are loading a table by
+                                 * executing it as a control method. However, if we encounter
+                                 * an error while loading the table, we need to keep trying to
+                                 * load the table rather than aborting the table load. Set the
+                                 * status to AE_OK to proceed with the table load.
+                                 */
+                                if ((walk_state->
+                                     parse_flags & ACPI_PARSE_MODULE_LEVEL)
+                                    && status == AE_ALREADY_EXISTS) {
+                                        status = AE_OK;
+                                }
                                 if (status == AE_CTRL_PARSE_CONTINUE) {
                                         continue;
                                 }
@@ -694,6 +706,20 @@ acpi_status acpi_ps_parse_loop(struct acpi_walk_state *walk_state)
                             acpi_ps_next_parse_state(walk_state, op, status);
                         if (status == AE_CTRL_PENDING) {
                                 status = AE_OK;
+                        } else
+                            if ((walk_state->
+                                 parse_flags & ACPI_PARSE_MODULE_LEVEL)
+                                && ACPI_FAILURE(status)) {
+                                /*
+                                 * ACPI_PARSE_MODULE_LEVEL means that we are loading a table by
+                                 * executing it as a control method. However, if we encounter
+                                 * an error while loading the table, we need to keep trying to
+                                 * load the table rather than aborting the table load. Set the
+                                 * status to AE_OK to proceed with the table load. If we get a
+                                 * failure at this point, it means that the dispatcher got an
+                                 * error while processing Op (most likely an AML operand error.
+                                 */
+                                status = AE_OK;
                         }
                 }
 
diff --git a/drivers/acpi/acpica/uterror.c b/drivers/acpi/acpica/uterror.c
index 5a64ddaed8a3..e47430272692 100644
--- a/drivers/acpi/acpica/uterror.c
+++ b/drivers/acpi/acpica/uterror.c
@@ -182,19 +182,19 @@ acpi_ut_prefixed_namespace_error(const char *module_name,
         switch (lookup_status) {
         case AE_ALREADY_EXISTS:
 
-                acpi_os_printf("\n" ACPI_MSG_BIOS_ERROR);
+                acpi_os_printf(ACPI_MSG_BIOS_ERROR);
                 message = "Failure creating";
                 break;
 
         case AE_NOT_FOUND:
 
-                acpi_os_printf("\n" ACPI_MSG_BIOS_ERROR);
+                acpi_os_printf(ACPI_MSG_BIOS_ERROR);
                 message = "Could not resolve";
                 break;
 
         default:
 
-                acpi_os_printf("\n" ACPI_MSG_ERROR);
+                acpi_os_printf(ACPI_MSG_ERROR);
                 message = "Failure resolving";
                 break;
         }
diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
index b0113a5802a3..d79ad844c78f 100644
--- a/drivers/acpi/battery.c
+++ b/drivers/acpi/battery.c
@@ -717,10 +717,11 @@ void battery_hook_register(struct acpi_battery_hook *hook)
                          */
                         pr_err("extension failed to load: %s", hook->name);
                         __battery_hook_unregister(hook, 0);
-                        return;
+                        goto end;
                 }
         }
         pr_info("new extension: %s\n", hook->name);
+end:
         mutex_unlock(&hook_mutex);
 }
 EXPORT_SYMBOL_GPL(battery_hook_register);
@@ -732,7 +733,7 @@ EXPORT_SYMBOL_GPL(battery_hook_register);
 */
 static void battery_hook_add_battery(struct acpi_battery *battery)
 {
-        struct acpi_battery_hook *hook_node;
+        struct acpi_battery_hook *hook_node, *tmp;
 
         mutex_lock(&hook_mutex);
         INIT_LIST_HEAD(&battery->list);
@@ -744,15 +745,15 @@ static void battery_hook_add_battery(struct acpi_battery *battery)
          * when a battery gets hotplugged or initialized
          * during the battery module initialization.
          */
-        list_for_each_entry(hook_node, &battery_hook_list, list) {
+        list_for_each_entry_safe(hook_node, tmp, &battery_hook_list, list) {
                 if (hook_node->add_battery(battery->bat)) {
                         /*
                          * The notification of the extensions has failed, to
                          * prevent further errors we will unload the extension.
                          */
-                        __battery_hook_unregister(hook_node, 0);
                         pr_err("error in extension, unloading: %s",
                                         hook_node->name);
+                        __battery_hook_unregister(hook_node, 0);
                 }
         }
         mutex_unlock(&hook_mutex);
diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
index 442a9e24f439..917f77f4cb55 100644
--- a/drivers/acpi/ec.c
+++ b/drivers/acpi/ec.c
@@ -2042,7 +2042,7 @@ static const struct dmi_system_id acpi_ec_no_wakeup[] = {
                 .ident = "Thinkpad X1 Carbon 6th",
                 .matches = {
                         DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-                        DMI_MATCH(DMI_PRODUCT_NAME, "20KGS3JF01"),
+                        DMI_MATCH(DMI_PRODUCT_FAMILY, "Thinkpad X1 Carbon 6th"),
                 },
         },
         { },
diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
index d15814e1727f..7c479002e798 100644
--- a/drivers/acpi/nfit/core.c
+++ b/drivers/acpi/nfit/core.c
@@ -408,6 +408,8 @@ int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, struct nvdimm *nvdimm,
         const guid_t *guid;
         int rc, i;
 
+        if (cmd_rc)
+                *cmd_rc = -EINVAL;
         func = cmd;
         if (cmd == ND_CMD_CALL) {
                 call_pkg = buf;
@@ -518,6 +520,8 @@ int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, struct nvdimm *nvdimm,
                  * If we return an error (like elsewhere) then caller wouldn't
                  * be able to rely upon data returned to make calculation.
                  */
+                if (cmd_rc)
+                        *cmd_rc = 0;
                 return 0;
         }
 
@@ -1273,7 +1277,7 @@ static ssize_t scrub_show(struct device *dev,
 
                 mutex_lock(&acpi_desc->init_mutex);
                 rc = sprintf(buf, "%d%s", acpi_desc->scrub_count,
-                                work_busy(&acpi_desc->dwork.work)
+                                acpi_desc->scrub_busy
                                 && !acpi_desc->cancel ? "+\n" : "\n");
                 mutex_unlock(&acpi_desc->init_mutex);
         }
@@ -2939,6 +2943,32 @@ static unsigned int __acpi_nfit_scrub(struct acpi_nfit_desc *acpi_desc,
         return 0;
 }
 
+static void __sched_ars(struct acpi_nfit_desc *acpi_desc, unsigned int tmo)
+{
+        lockdep_assert_held(&acpi_desc->init_mutex);
+
+        acpi_desc->scrub_busy = 1;
+        /* note this should only be set from within the workqueue */
+        if (tmo)
+                acpi_desc->scrub_tmo = tmo;
+        queue_delayed_work(nfit_wq, &acpi_desc->dwork, tmo * HZ);
+}
+
+static void sched_ars(struct acpi_nfit_desc *acpi_desc)
+{
+        __sched_ars(acpi_desc, 0);
+}
+
+static void notify_ars_done(struct acpi_nfit_desc *acpi_desc)
+{
+        lockdep_assert_held(&acpi_desc->init_mutex);
+
+        acpi_desc->scrub_busy = 0;
+        acpi_desc->scrub_count++;
+        if (acpi_desc->scrub_count_state)
+                sysfs_notify_dirent(acpi_desc->scrub_count_state);
+}
+
 static void acpi_nfit_scrub(struct work_struct *work)
 {
         struct acpi_nfit_desc *acpi_desc;
@@ -2949,14 +2979,10 @@ static void acpi_nfit_scrub(struct work_struct *work)
         mutex_lock(&acpi_desc->init_mutex);
         query_rc = acpi_nfit_query_poison(acpi_desc);
         tmo = __acpi_nfit_scrub(acpi_desc, query_rc);
-        if (tmo) {
-                queue_delayed_work(nfit_wq, &acpi_desc->dwork, tmo * HZ);
-                acpi_desc->scrub_tmo = tmo;
-        } else {
-                acpi_desc->scrub_count++;
-                if (acpi_desc->scrub_count_state)
-                        sysfs_notify_dirent(acpi_desc->scrub_count_state);
-        }
+        if (tmo)
+                __sched_ars(acpi_desc, tmo);
+        else
+                notify_ars_done(acpi_desc);
         memset(acpi_desc->ars_status, 0, acpi_desc->max_ars);
         mutex_unlock(&acpi_desc->init_mutex);
 }
@@ -3037,7 +3063,7 @@ static int acpi_nfit_register_regions(struct acpi_nfit_desc *acpi_desc)
                         break;
                 }
 
-        queue_delayed_work(nfit_wq, &acpi_desc->dwork, 0);
+        sched_ars(acpi_desc);
         return 0;
 }
 
@@ -3239,7 +3265,7 @@ int acpi_nfit_ars_rescan(struct acpi_nfit_desc *acpi_desc, unsigned long flags)
                 }
         }
         if (scheduled) {
-                queue_delayed_work(nfit_wq, &acpi_desc->dwork, 0);
+                sched_ars(acpi_desc);
                 dev_dbg(dev, "ars_scan triggered\n");
         }
         mutex_unlock(&acpi_desc->init_mutex);
diff --git a/drivers/acpi/nfit/nfit.h b/drivers/acpi/nfit/nfit.h
index 7d15856a739f..a97ff42fe311 100644
--- a/drivers/acpi/nfit/nfit.h
+++ b/drivers/acpi/nfit/nfit.h
@@ -203,6 +203,7 @@ struct acpi_nfit_desc {
         unsigned int max_ars;
         unsigned int scrub_count;
         unsigned int scrub_mode;
+        unsigned int scrub_busy:1;
         unsigned int cancel:1;
         unsigned long dimm_cmd_force_en;
         unsigned long bus_cmd_force_en;
diff --git a/drivers/acpi/pptt.c b/drivers/acpi/pptt.c
index e5ea1974d1e3..d1e26cb599bf 100644
--- a/drivers/acpi/pptt.c
+++ b/drivers/acpi/pptt.c
@@ -481,8 +481,14 @@ static int topology_get_acpi_cpu_tag(struct acpi_table_header *table,
         if (cpu_node) {
                 cpu_node = acpi_find_processor_package_id(table, cpu_node,
                                                           level, flag);
-                /* Only the first level has a guaranteed id */
-                if (level == 0)
+                /*
+                 * As per specification if the processor structure represents
+                 * an actual processor, then ACPI processor ID must be valid.
+                 * For processor containers ACPI_PPTT_ACPI_PROCESSOR_ID_VALID
+                 * should be set if the UID is valid
+                 */
+                if (level == 0 ||
+                    cpu_node->flags & ACPI_PPTT_ACPI_PROCESSOR_ID_VALID)
                         return cpu_node->acpi_processor_id;
                 return ACPI_PTR_DIFF(cpu_node, table);
         }
diff --git a/drivers/ata/Kconfig b/drivers/ata/Kconfig
index 2b16e7c8fff3..39b181d6bd0d 100644
--- a/drivers/ata/Kconfig
+++ b/drivers/ata/Kconfig
@@ -398,7 +398,6 @@ config SATA_DWC_VDEBUG
 
 config SATA_HIGHBANK
         tristate "Calxeda Highbank SATA support"
-        depends on HAS_DMA
         depends on ARCH_HIGHBANK || COMPILE_TEST
         help
           This option enables support for the Calxeda Highbank SoC's
@@ -408,7 +407,6 @@ config SATA_HIGHBANK
 
 config SATA_MV
         tristate "Marvell SATA support"
-        depends on HAS_DMA
         depends on PCI || ARCH_DOVE || ARCH_MV78XX0 || \
                    ARCH_MVEBU || ARCH_ORION5X || COMPILE_TEST
         select GENERIC_PHY
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index 738fb22978dd..b2b9eba1d214 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -400,6 +400,7 @@ static const struct pci_device_id ahci_pci_tbl[] = {
         { PCI_VDEVICE(INTEL, 0x0f23), board_ahci_mobile }, /* Bay Trail AHCI */
         { PCI_VDEVICE(INTEL, 0x22a3), board_ahci_mobile }, /* Cherry Tr. AHCI */
         { PCI_VDEVICE(INTEL, 0x5ae3), board_ahci_mobile }, /* ApolloLake AHCI */
+        { PCI_VDEVICE(INTEL, 0x34d3), board_ahci_mobile }, /* Ice Lake LP AHCI */
 
         /* JMicron 360/1/3/5/6, match class to avoid IDE function */
         { PCI_VENDOR_ID_JMICRON, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID,
@@ -1280,6 +1281,59 @@ static bool ahci_broken_suspend(struct pci_dev *pdev)
         return strcmp(buf, dmi->driver_data) < 0;
 }
 
+static bool ahci_broken_lpm(struct pci_dev *pdev)
+{
+        static const struct dmi_system_id sysids[] = {
+                /* Various Lenovo 50 series have LPM issues with older BIOSen */
+                {
+                        .matches = {
+                                DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                                DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X250"),
+                        },
+                        .driver_data = "20180406", /* 1.31 */
+                },
+                {
+                        .matches = {
+                                DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                                DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad L450"),
+                        },
+                        .driver_data = "20180420", /* 1.28 */
+                },
+                {
+                        .matches = {
+                                DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                                DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T450s"),
+                        },
+                        .driver_data = "20180315", /* 1.33 */
+                },
+                {
+                        .matches = {
+                                DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                                DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad W541"),
+                        },
+                        /*
+                         * Note date based on release notes, 2.35 has been
+                         * reported to be good, but I've been unable to get
+                         * a hold of the reporter to get the DMI BIOS date.
+                         * TODO: fix this.
+                         */
+                        .driver_data = "20180310", /* 2.35 */
+                },
+                { }     /* terminate list */
+        };
+        const struct dmi_system_id *dmi = dmi_first_match(sysids);
+        int year, month, date;
+        char buf[9];
+
+        if (!dmi)
+                return false;
+
+        dmi_get_date(DMI_BIOS_DATE, &year, &month, &date);
+        snprintf(buf, sizeof(buf), "%04d%02d%02d", year, month, date);
+
+        return strcmp(buf, dmi->driver_data) < 0;
+}
+
 static bool ahci_broken_online(struct pci_dev *pdev)
 {
 #define ENCODE_BUSDEVFN(bus, slot, func)                        \
@@ -1694,6 +1748,12 @@ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
                         "quirky BIOS, skipping spindown on poweroff\n");
         }
 
+        if (ahci_broken_lpm(pdev)) {
+                pi.flags |= ATA_FLAG_NO_LPM;
+                dev_warn(&pdev->dev,
+                         "BIOS update required for Link Power Management support\n");
+        }
+
         if (ahci_broken_suspend(pdev)) {
                 hpriv->flags |= AHCI_HFLAG_NO_SUSPEND;
                 dev_warn(&pdev->dev,
diff --git a/drivers/ata/ahci_mvebu.c b/drivers/ata/ahci_mvebu.c
index 0045dacd814b..72d90b4c3aae 100644
--- a/drivers/ata/ahci_mvebu.c
+++ b/drivers/ata/ahci_mvebu.c
@@ -82,7 +82,7 @@ static void ahci_mvebu_regret_option(struct ahci_host_priv *hpriv)
  *
  * Return: 0 on success; Error code otherwise.
  */
-int ahci_mvebu_stop_engine(struct ata_port *ap)
+static int ahci_mvebu_stop_engine(struct ata_port *ap)
 {
         void __iomem *port_mmio = ahci_port_base(ap);
         u32 tmp, port_fbs;
diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
index 965842a08743..09620c2ffa0f 100644
--- a/drivers/ata/libahci.c
+++ b/drivers/ata/libahci.c
@@ -35,6 +35,7 @@
 #include <linux/kernel.h>
 #include <linux/gfp.h>
 #include <linux/module.h>
+#include <linux/nospec.h>
 #include <linux/blkdev.h>
 #include <linux/delay.h>
 #include <linux/interrupt.h>
@@ -1146,10 +1147,12 @@ static ssize_t ahci_led_store(struct ata_port *ap, const char *buf,
 
         /* get the slot number from the message */
         pmp = (state & EM_MSG_LED_PMP_SLOT) >> 8;
-        if (pmp < EM_MAX_SLOTS)
+        if (pmp < EM_MAX_SLOTS) {
+                pmp = array_index_nospec(pmp, EM_MAX_SLOTS);
                 emp = &pp->em_priv[pmp];
-        else
+        } else {
                 return -EINVAL;
+        }
 
         /* mask off the activity bits if we are in sw_activity
          * mode, user should turn off sw_activity before setting
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 27d15ed7fa3d..cc71c63df381 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -2493,6 +2493,9 @@ int ata_dev_configure(struct ata_device *dev)
             (id[ATA_ID_SATA_CAPABILITY] & 0xe) == 0x2)
                 dev->horkage |= ATA_HORKAGE_NOLPM;
 
+        if (ap->flags & ATA_FLAG_NO_LPM)
+                dev->horkage |= ATA_HORKAGE_NOLPM;
+
         if (dev->horkage & ATA_HORKAGE_NOLPM) {
                 ata_dev_warn(dev, "LPM support broken, forcing max_power\n");
                 dev->link->ap->target_lpm_policy = ATA_LPM_MAX_POWER;
diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
index d5412145d76d..01306c018398 100644
--- a/drivers/ata/libata-eh.c
+++ b/drivers/ata/libata-eh.c
@@ -614,8 +614,7 @@ void ata_scsi_cmd_error_handler(struct Scsi_Host *host, struct ata_port *ap,
                 list_for_each_entry_safe(scmd, tmp, eh_work_q, eh_entry) {
                         struct ata_queued_cmd *qc;
 
-                        for (i = 0; i < ATA_MAX_QUEUE; i++) {
-                                qc = __ata_qc_from_tag(ap, i);
+                        ata_qc_for_each_raw(ap, qc, i) {
                                 if (qc->flags & ATA_QCFLAG_ACTIVE &&
                                     qc->scsicmd == scmd)
                                         break;
@@ -818,14 +817,13 @@ EXPORT_SYMBOL_GPL(ata_port_wait_eh);
 
 static int ata_eh_nr_in_flight(struct ata_port *ap)
 {
+        struct ata_queued_cmd *qc;
         unsigned int tag;
         int nr = 0;
 
         /* count only non-internal commands */
-        for (tag = 0; tag < ATA_MAX_QUEUE; tag++) {
-                if (ata_tag_internal(tag))
-                        continue;
-                if (ata_qc_from_tag(ap, tag))
+        ata_qc_for_each(ap, qc, tag) {
+                if (qc)
                         nr++;
         }
 
@@ -847,13 +845,13 @@ void ata_eh_fastdrain_timerfn(struct timer_list *t)
                 goto out_unlock;
 
         if (cnt == ap->fastdrain_cnt) {
+                struct ata_queued_cmd *qc;
                 unsigned int tag;
 
                 /* No progress during the last interval, tag all
                  * in-flight qcs as timed out and freeze the port.
                  */
-                for (tag = 0; tag < ATA_MAX_QUEUE; tag++) {
-                        struct ata_queued_cmd *qc = ata_qc_from_tag(ap, tag);
+                ata_qc_for_each(ap, qc, tag) {
                         if (qc)
                                 qc->err_mask |= AC_ERR_TIMEOUT;
                 }
@@ -999,6 +997,7 @@ void ata_port_schedule_eh(struct ata_port *ap)
 
 static int ata_do_link_abort(struct ata_port *ap, struct ata_link *link)
 {
+        struct ata_queued_cmd *qc;
         int tag, nr_aborted = 0;
 
         WARN_ON(!ap->ops->error_handler);
@@ -1007,9 +1006,7 @@ static int ata_do_link_abort(struct ata_port *ap, struct ata_link *link)
         ata_eh_set_pending(ap, 0);
 
         /* include internal tag in iteration */
-        for (tag = 0; tag <= ATA_MAX_QUEUE; tag++) {
-                struct ata_queued_cmd *qc = ata_qc_from_tag(ap, tag);
-
+        ata_qc_for_each_with_internal(ap, qc, tag) {
                 if (qc && (!link || qc->dev->link == link)) {
                         qc->flags |= ATA_QCFLAG_FAILED;
                         ata_qc_complete(qc);
@@ -1712,9 +1709,7 @@ void ata_eh_analyze_ncq_error(struct ata_link *link)
                 return;
 
         /* has LLDD analyzed already? */
-        for (tag = 0; tag < ATA_MAX_QUEUE; tag++) {
-                qc = __ata_qc_from_tag(ap, tag);
-
+        ata_qc_for_each_raw(ap, qc, tag) {
                 if (!(qc->flags & ATA_QCFLAG_FAILED))
                         continue;
 
@@ -2136,6 +2131,7 @@ static void ata_eh_link_autopsy(struct ata_link *link)
 {
         struct ata_port *ap = link->ap;
         struct ata_eh_context *ehc = &link->eh_context;
+        struct ata_queued_cmd *qc;
         struct ata_device *dev;
         unsigned int all_err_mask = 0, eflags = 0;
         int tag, nr_failed = 0, nr_quiet = 0;
@@ -2168,9 +2164,7 @@ static void ata_eh_link_autopsy(struct ata_link *link)
 
         all_err_mask |= ehc->i.err_mask;
 
-        for (tag = 0; tag < ATA_MAX_QUEUE; tag++) {
-                struct ata_queued_cmd *qc = __ata_qc_from_tag(ap, tag);
-
+        ata_qc_for_each_raw(ap, qc, tag) {
                 if (!(qc->flags & ATA_QCFLAG_FAILED) ||
                     ata_dev_phys_link(qc->dev) != link)
                         continue;
@@ -2436,6 +2430,7 @@ static void ata_eh_link_report(struct ata_link *link)
 {
         struct ata_port *ap = link->ap;
         struct ata_eh_context *ehc = &link->eh_context;
+        struct ata_queued_cmd *qc;
         const char *frozen, *desc;
         char tries_buf[6] = "";
         int tag, nr_failed = 0;
@@ -2447,9 +2442,7 @@ static void ata_eh_link_report(struct ata_link *link)
         if (ehc->i.desc[0] != '\0')
                 desc = ehc->i.desc;
 
-        for (tag = 0; tag < ATA_MAX_QUEUE; tag++) {
-                struct ata_queued_cmd *qc = __ata_qc_from_tag(ap, tag);
-
+        ata_qc_for_each_raw(ap, qc, tag) {
                 if (!(qc->flags & ATA_QCFLAG_FAILED) ||
                     ata_dev_phys_link(qc->dev) != link ||
                     ((qc->flags & ATA_QCFLAG_QUIET) &&
@@ -2511,8 +2504,7 @@ static void ata_eh_link_report(struct ata_link *link)
                   ehc->i.serror & SERR_DEV_XCHG ? "DevExch " : "");
 #endif
 
-        for (tag = 0; tag < ATA_MAX_QUEUE; tag++) {
-                struct ata_queued_cmd *qc = __ata_qc_from_tag(ap, tag);
+        ata_qc_for_each_raw(ap, qc, tag) {
                 struct ata_taskfile *cmd = &qc->tf, *res = &qc->result_tf;
                 char data_buf[20] = "";
                 char cdb_buf[70] = "";
@@ -3992,12 +3984,11 @@ int ata_eh_recover(struct ata_port *ap, ata_prereset_fn_t prereset,
  */
 void ata_eh_finish(struct ata_port *ap)
 {
+        struct ata_queued_cmd *qc;
         int tag;
 
         /* retry or finish qcs */
-        for (tag = 0; tag < ATA_MAX_QUEUE; tag++) {
-                struct ata_queued_cmd *qc = __ata_qc_from_tag(ap, tag);
-
+        ata_qc_for_each_raw(ap, qc, tag) {
                 if (!(qc->flags & ATA_QCFLAG_FAILED))
                         continue;
 
diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index 6a91d04351d9..aad1b01447de 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -3805,10 +3805,20 @@ static unsigned int ata_scsi_zbc_out_xlat(struct ata_queued_cmd *qc)
                  */
                 goto invalid_param_len;
         }
-        if (block > dev->n_sectors)
-                goto out_of_range;
 
         all = cdb[14] & 0x1;
+        if (all) {
+                /*
+                 * Ignore the block address (zone ID) as defined by ZBC.
+                 */
+                block = 0;
+        } else if (block >= dev->n_sectors) {
+                /*
+                 * Block must be a valid zone ID (a zone start LBA).
+                 */
+                fp = 2;
+                goto invalid_fld;
+        }
 
         if (ata_ncq_enabled(qc->dev) &&
             ata_fpdma_zac_mgmt_out_supported(qc->dev)) {
@@ -3837,10 +3847,6 @@ static unsigned int ata_scsi_zbc_out_xlat(struct ata_queued_cmd *qc)
  invalid_fld:
         ata_scsi_set_invalid_field(qc->dev, scmd, fp, 0xff);
         return 1;
- out_of_range:
-        /* "Logical Block Address out of range" */
-        ata_scsi_set_sense(qc->dev, scmd, ILLEGAL_REQUEST, 0x21, 0x00);
-        return 1;
 invalid_param_len:
         /* "Parameter list length error" */
         ata_scsi_set_sense(qc->dev, scmd, ILLEGAL_REQUEST, 0x1a, 0x0);
diff --git a/drivers/ata/sata_fsl.c b/drivers/ata/sata_fsl.c
index b8d9cfc60374..4dc528bf8e85 100644
--- a/drivers/ata/sata_fsl.c
+++ b/drivers/ata/sata_fsl.c
@@ -395,12 +395,6 @@ static inline unsigned int sata_fsl_tag(unsigned int tag,
 {
         /* We let libATA core do actual (queue) tag allocation */
 
-        /* all non NCQ/queued commands should have tag#0 */
-        if (ata_tag_internal(tag)) {
-                DPRINTK("mapping internal cmds to tag#0\n");
-                return 0;
-        }
-
         if (unlikely(tag >= SATA_FSL_QUEUE_DEPTH)) {
                 DPRINTK("tag %d invalid : out of range\n", tag);
                 return 0;
@@ -1229,8 +1223,7 @@ static void sata_fsl_host_intr(struct ata_port *ap)
 
         /* Workaround for data length mismatch errata */
         if (unlikely(hstatus & INT_ON_DATA_LENGTH_MISMATCH)) {
-                for (tag = 0; tag < ATA_MAX_QUEUE; tag++) {
-                        qc = ata_qc_from_tag(ap, tag);
+                ata_qc_for_each_with_internal(ap, qc, tag) {
                         if (qc && ata_is_atapi(qc->tf.protocol)) {
                                 u32 hcontrol;
                                 /* Set HControl[27] to clear error registers */
diff --git a/drivers/ata/sata_nv.c b/drivers/ata/sata_nv.c
index 10ae11aa1926..72c9b922a77b 100644
--- a/drivers/ata/sata_nv.c
+++ b/drivers/ata/sata_nv.c
@@ -675,7 +675,6 @@ static int nv_adma_slave_config(struct scsi_device *sdev)
         struct ata_port *ap = ata_shost_to_port(sdev->host);
         struct nv_adma_port_priv *pp = ap->private_data;
         struct nv_adma_port_priv *port0, *port1;
-        struct scsi_device *sdev0, *sdev1;
         struct pci_dev *pdev = to_pci_dev(ap->host->dev);
         unsigned long segment_boundary, flags;
         unsigned short sg_tablesize;
@@ -736,8 +735,6 @@ static int nv_adma_slave_config(struct scsi_device *sdev)
 
         port0 = ap->host->ports[0]->private_data;
         port1 = ap->host->ports[1]->private_data;
-        sdev0 = ap->host->ports[0]->link.device[0].sdev;
-        sdev1 = ap->host->ports[1]->link.device[0].sdev;
         if ((port0->flags & NV_ADMA_ATAPI_SETUP_COMPLETE) ||
             (port1->flags & NV_ADMA_ATAPI_SETUP_COMPLETE)) {
                 /*
diff --git a/drivers/atm/iphase.c b/drivers/atm/iphase.c
index ff81a576347e..82532c299bb5 100644
--- a/drivers/atm/iphase.c
+++ b/drivers/atm/iphase.c
@@ -1618,7 +1618,7 @@ static int rx_init(struct atm_dev *dev)
         skb_queue_head_init(&iadev->rx_dma_q);  
         iadev->rx_free_desc_qhead = NULL;   
 
-        iadev->rx_open = kcalloc(4, iadev->num_vc, GFP_KERNEL);
+        iadev->rx_open = kcalloc(iadev->num_vc, sizeof(void *), GFP_KERNEL);
         if (!iadev->rx_open) {
                 printk(KERN_ERR DEV_LABEL "itf %d couldn't get free page\n",
                 dev->number);  
diff --git a/drivers/atm/zatm.c b/drivers/atm/zatm.c
index a8d2eb0ceb8d..2c288d1f42bb 100644
--- a/drivers/atm/zatm.c
+++ b/drivers/atm/zatm.c
@@ -1483,6 +1483,8 @@ static int zatm_ioctl(struct atm_dev *dev,unsigned int cmd,void __user *arg)
                                         return -EFAULT;
                                 if (pool < 0 || pool > ZATM_LAST_POOL)
                                         return -EINVAL;
+                                pool = array_index_nospec(pool,
+                                                          ZATM_LAST_POOL + 1);
                                 if (copy_from_user(&info,
                                     &((struct zatm_pool_req __user *) arg)->info,
                                     sizeof(info))) return -EFAULT;
diff --git a/drivers/base/dd.c b/drivers/base/dd.c
index 1435d7281c66..6ebcd65d64b6 100644
--- a/drivers/base/dd.c
+++ b/drivers/base/dd.c
@@ -434,14 +434,6 @@ re_probe:
                         goto probe_failed;
         }
 
-        /*
-         * Ensure devices are listed in devices_kset in correct order
-         * It's important to move Dev to the end of devices_kset before
-         * calling .probe, because it could be recursive and parent Dev
-         * should always go first
-         */
-        devices_kset_move_last(dev);
-
         if (dev->bus->probe) {
                 ret = dev->bus->probe(dev);
                 if (ret)
diff --git a/drivers/base/power/domain.c b/drivers/base/power/domain.c
index c298de8a8308..9e8484189034 100644
--- a/drivers/base/power/domain.c
+++ b/drivers/base/power/domain.c
@@ -2235,7 +2235,7 @@ static void genpd_dev_pm_sync(struct device *dev)
 }
 
 static int __genpd_dev_pm_attach(struct device *dev, struct device_node *np,
-                                 unsigned int index)
+                                 unsigned int index, bool power_on)
 {
         struct of_phandle_args pd_args;
         struct generic_pm_domain *pd;
@@ -2271,9 +2271,11 @@ static int __genpd_dev_pm_attach(struct device *dev, struct device_node *np,
         dev->pm_domain->detach = genpd_dev_pm_detach;
         dev->pm_domain->sync = genpd_dev_pm_sync;
 
-        genpd_lock(pd);
-        ret = genpd_power_on(pd, 0);
-        genpd_unlock(pd);
+        if (power_on) {
+                genpd_lock(pd);
+                ret = genpd_power_on(pd, 0);
+                genpd_unlock(pd);
+        }
 
         if (ret)
                 genpd_remove_device(pd, dev);
@@ -2307,7 +2309,7 @@ int genpd_dev_pm_attach(struct device *dev)
                                        "#power-domain-cells") != 1)
                 return 0;
 
-        return __genpd_dev_pm_attach(dev, dev->of_node, 0);
+        return __genpd_dev_pm_attach(dev, dev->of_node, 0, true);
 }
 EXPORT_SYMBOL_GPL(genpd_dev_pm_attach);
 
@@ -2359,14 +2361,14 @@ struct device *genpd_dev_pm_attach_by_id(struct device *dev,
         }
 
         /* Try to attach the device to the PM domain at the specified index. */
-        ret = __genpd_dev_pm_attach(genpd_dev, dev->of_node, index);
+        ret = __genpd_dev_pm_attach(genpd_dev, dev->of_node, index, false);
         if (ret < 1) {
                 device_unregister(genpd_dev);
                 return ret ? ERR_PTR(ret) : NULL;
         }
 
-        pm_runtime_set_active(genpd_dev);
         pm_runtime_enable(genpd_dev);
+        genpd_queue_power_off_work(dev_to_genpd(genpd_dev));
 
         return genpd_dev;
 }
diff --git a/drivers/block/drbd/drbd_worker.c b/drivers/block/drbd/drbd_worker.c
index 1476cb3439f4..5e793dd7adfb 100644
--- a/drivers/block/drbd/drbd_worker.c
+++ b/drivers/block/drbd/drbd_worker.c
@@ -282,8 +282,8 @@ void drbd_request_endio(struct bio *bio)
                 what = COMPLETED_OK;
         }
 
-        bio_put(req->private_bio);
         req->private_bio = ERR_PTR(blk_status_to_errno(bio->bi_status));
+        bio_put(bio);
 
         /* not req_mod(), we need irqsave here! */
         spin_lock_irqsave(&device->resource->req_lock, flags);
diff --git a/drivers/block/loop.c b/drivers/block/loop.c
index d6b6f434fd4b..4cb1d1be3cfb 100644
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -1613,6 +1613,7 @@ static int lo_compat_ioctl(struct block_device *bdev, fmode_t mode,
                 arg = (unsigned long) compat_ptr(arg);
         case LOOP_SET_FD:
         case LOOP_CHANGE_FD:
+        case LOOP_SET_BLOCK_SIZE:
                 err = lo_ioctl(bdev, mode, cmd, arg);
                 break;
         default:
diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index 74a05561b620..3fb95c8d9fd8 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -112,12 +112,16 @@ struct nbd_device {
         struct task_struct *task_setup;
 };
 
+#define NBD_CMD_REQUEUED        1
+
 struct nbd_cmd {
         struct nbd_device *nbd;
+        struct mutex lock;
         int index;
         int cookie;
-        struct completion send_complete;
         blk_status_t status;
+        unsigned long flags;
+        u32 cmd_cookie;
 };
 
 #if IS_ENABLED(CONFIG_DEBUG_FS)
@@ -146,6 +150,35 @@ static inline struct device *nbd_to_dev(struct nbd_device *nbd)
         return disk_to_dev(nbd->disk);
 }
 
+static void nbd_requeue_cmd(struct nbd_cmd *cmd)
+{
+        struct request *req = blk_mq_rq_from_pdu(cmd);
+
+        if (!test_and_set_bit(NBD_CMD_REQUEUED, &cmd->flags))
+                blk_mq_requeue_request(req, true);
+}
+
+#define NBD_COOKIE_BITS 32
+
+static u64 nbd_cmd_handle(struct nbd_cmd *cmd)
+{
+        struct request *req = blk_mq_rq_from_pdu(cmd);
+        u32 tag = blk_mq_unique_tag(req);
+        u64 cookie = cmd->cmd_cookie;
+
+        return (cookie << NBD_COOKIE_BITS) | tag;
+}
+
+static u32 nbd_handle_to_tag(u64 handle)
+{
+        return (u32)handle;
+}
+
+static u32 nbd_handle_to_cookie(u64 handle)
+{
+        return (u32)(handle >> NBD_COOKIE_BITS);
+}
+
 static const char *nbdcmd_to_ascii(int cmd)
 {
         switch (cmd) {
@@ -319,6 +352,9 @@ static enum blk_eh_timer_return nbd_xmit_timeout(struct request *req,
         }
         config = nbd->config;
 
+        if (!mutex_trylock(&cmd->lock))
+                return BLK_EH_RESET_TIMER;
+
         if (config->num_connections > 1) {
                 dev_err_ratelimited(nbd_to_dev(nbd),
                                     "Connection timed out, retrying (%d/%d alive)\n",
@@ -343,7 +379,8 @@ static enum blk_eh_timer_return nbd_xmit_timeout(struct request *req,
                                         nbd_mark_nsock_dead(nbd, nsock, 1);
                                 mutex_unlock(&nsock->tx_lock);
                         }
-                        blk_mq_requeue_request(req, true);
+                        mutex_unlock(&cmd->lock);
+                        nbd_requeue_cmd(cmd);
                         nbd_config_put(nbd);
                         return BLK_EH_DONE;
                 }
@@ -353,6 +390,7 @@ static enum blk_eh_timer_return nbd_xmit_timeout(struct request *req,
         }
         set_bit(NBD_TIMEDOUT, &config->runtime_flags);
         cmd->status = BLK_STS_IOERR;
+        mutex_unlock(&cmd->lock);
         sock_shutdown(nbd);
         nbd_config_put(nbd);
 done:
@@ -430,9 +468,9 @@ static int nbd_send_cmd(struct nbd_device *nbd, struct nbd_cmd *cmd, int index)
         struct iov_iter from;
         unsigned long size = blk_rq_bytes(req);
         struct bio *bio;
+        u64 handle;
         u32 type;
         u32 nbd_cmd_flags = 0;
-        u32 tag = blk_mq_unique_tag(req);
         int sent = nsock->sent, skip = 0;
 
         iov_iter_kvec(&from, WRITE | ITER_KVEC, &iov, 1, sizeof(request));
@@ -474,6 +512,8 @@ static int nbd_send_cmd(struct nbd_device *nbd, struct nbd_cmd *cmd, int index)
                         goto send_pages;
                 }
                 iov_iter_advance(&from, sent);
+        } else {
+                cmd->cmd_cookie++;
         }
         cmd->index = index;
         cmd->cookie = nsock->cookie;
@@ -482,7 +522,8 @@ static int nbd_send_cmd(struct nbd_device *nbd, struct nbd_cmd *cmd, int index)
                 request.from = cpu_to_be64((u64)blk_rq_pos(req) << 9);
                 request.len = htonl(size);
         }
-        memcpy(request.handle, &tag, sizeof(tag));
+        handle = nbd_cmd_handle(cmd);
+        memcpy(request.handle, &handle, sizeof(handle));
 
         dev_dbg(nbd_to_dev(nbd), "request %p: sending control (%s@%llu,%uB)\n",
                 req, nbdcmd_to_ascii(type),
@@ -500,6 +541,7 @@ static int nbd_send_cmd(struct nbd_device *nbd, struct nbd_cmd *cmd, int index)
                                 nsock->pending = req;
                                 nsock->sent = sent;
                         }
+                        set_bit(NBD_CMD_REQUEUED, &cmd->flags);
                         return BLK_STS_RESOURCE;
                 }
                 dev_err_ratelimited(disk_to_dev(nbd->disk),
@@ -541,6 +583,7 @@ send_pages:
                                          */
                                         nsock->pending = req;
                                         nsock->sent = sent;
+                                        set_bit(NBD_CMD_REQUEUED, &cmd->flags);
                                         return BLK_STS_RESOURCE;
                                 }
                                 dev_err(disk_to_dev(nbd->disk),
@@ -573,10 +616,12 @@ static struct nbd_cmd *nbd_read_stat(struct nbd_device *nbd, int index)
         struct nbd_reply reply;
         struct nbd_cmd *cmd;
         struct request *req = NULL;
+        u64 handle;
         u16 hwq;
         u32 tag;
         struct kvec iov = {.iov_base = &reply, .iov_len = sizeof(reply)};
         struct iov_iter to;
+        int ret = 0;
 
         reply.magic = 0;
         iov_iter_kvec(&to, READ | ITER_KVEC, &iov, 1, sizeof(reply));
@@ -594,8 +639,8 @@ static struct nbd_cmd *nbd_read_stat(struct nbd_device *nbd, int index)
                 return ERR_PTR(-EPROTO);
         }
 
-        memcpy(&tag, reply.handle, sizeof(u32));
-
+        memcpy(&handle, reply.handle, sizeof(handle));
+        tag = nbd_handle_to_tag(handle);
         hwq = blk_mq_unique_tag_to_hwq(tag);
         if (hwq < nbd->tag_set.nr_hw_queues)
                 req = blk_mq_tag_to_rq(nbd->tag_set.tags[hwq],
@@ -606,11 +651,25 @@ static struct nbd_cmd *nbd_read_stat(struct nbd_device *nbd, int index)
                 return ERR_PTR(-ENOENT);
         }
         cmd = blk_mq_rq_to_pdu(req);
+
+        mutex_lock(&cmd->lock);
+        if (cmd->cmd_cookie != nbd_handle_to_cookie(handle)) {
+                dev_err(disk_to_dev(nbd->disk), "Double reply on req %p, cmd_cookie %u, handle cookie %u\n",
+                        req, cmd->cmd_cookie, nbd_handle_to_cookie(handle));
+                ret = -ENOENT;
+                goto out;
+        }
+        if (test_bit(NBD_CMD_REQUEUED, &cmd->flags)) {
+                dev_err(disk_to_dev(nbd->disk), "Raced with timeout on req %p\n",
+                        req);
+                ret = -ENOENT;
+                goto out;
+        }
         if (ntohl(reply.error)) {
                 dev_err(disk_to_dev(nbd->disk), "Other side returned error (%d)\n",
                         ntohl(reply.error));
                 cmd->status = BLK_STS_IOERR;
-                return cmd;
+                goto out;
         }
 
         dev_dbg(nbd_to_dev(nbd), "request %p: got reply\n", req);
@@ -635,18 +694,18 @@ static struct nbd_cmd *nbd_read_stat(struct nbd_device *nbd, int index)
                                 if (nbd_disconnected(config) ||
                                     config->num_connections <= 1) {
                                         cmd->status = BLK_STS_IOERR;
-                                        return cmd;
+                                        goto out;
                                 }
-                                return ERR_PTR(-EIO);
+                                ret = -EIO;
+                                goto out;
                         }
                         dev_dbg(nbd_to_dev(nbd), "request %p: got %d bytes data\n",
                                 req, bvec.bv_len);
                 }
-        } else {
-                /* See the comment in nbd_queue_rq. */
-                wait_for_completion(&cmd->send_complete);
         }
-        return cmd;
+out:
+        mutex_unlock(&cmd->lock);
+        return ret ? ERR_PTR(ret) : cmd;
 }
 
 static void recv_work(struct work_struct *work)
@@ -805,7 +864,7 @@ again:
          */
         blk_mq_start_request(req);
         if (unlikely(nsock->pending && nsock->pending != req)) {
-                blk_mq_requeue_request(req, true);
+                nbd_requeue_cmd(cmd);
                 ret = 0;
                 goto out;
         }
@@ -818,7 +877,7 @@ again:
                 dev_err_ratelimited(disk_to_dev(nbd->disk),
                                     "Request send failed, requeueing\n");
                 nbd_mark_nsock_dead(nbd, nsock, 1);
-                blk_mq_requeue_request(req, true);
+                nbd_requeue_cmd(cmd);
                 ret = 0;
         }
 out:
@@ -842,7 +901,8 @@ static blk_status_t nbd_queue_rq(struct blk_mq_hw_ctx *hctx,
          * that the server is misbehaving (or there was an error) before we're
          * done sending everything over the wire.
          */
-        init_completion(&cmd->send_complete);
+        mutex_lock(&cmd->lock);
+        clear_bit(NBD_CMD_REQUEUED, &cmd->flags);
 
         /* We can be called directly from the user space process, which means we
          * could possibly have signals pending so our sendmsg will fail.  In
@@ -854,7 +914,7 @@ static blk_status_t nbd_queue_rq(struct blk_mq_hw_ctx *hctx,
                 ret = BLK_STS_IOERR;
         else if (!ret)
                 ret = BLK_STS_OK;
-        complete(&cmd->send_complete);
+        mutex_unlock(&cmd->lock);
 
         return ret;
 }
@@ -1460,6 +1520,8 @@ static int nbd_init_request(struct blk_mq_tag_set *set, struct request *rq,
 {
         struct nbd_cmd *cmd = blk_mq_rq_to_pdu(rq);
         cmd->nbd = set->driver_data;
+        cmd->flags = 0;
+        mutex_init(&cmd->lock);
         return 0;
 }
 
diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c
index 1cc29629d238..80d60f43db56 100644
--- a/drivers/bus/ti-sysc.c
+++ b/drivers/bus/ti-sysc.c
@@ -169,9 +169,9 @@ static int sysc_get_clocks(struct sysc *ddata)
         const char *name;
         int nr_fck = 0, nr_ick = 0, i, error = 0;
 
-        ddata->clock_roles = devm_kzalloc(ddata->dev,
-                                          sizeof(*ddata->clock_roles) *
+        ddata->clock_roles = devm_kcalloc(ddata->dev,
                                           SYSC_MAX_CLOCKS,
+                                          sizeof(*ddata->clock_roles),
                                           GFP_KERNEL);
         if (!ddata->clock_roles)
                 return -ENOMEM;
@@ -200,8 +200,8 @@ static int sysc_get_clocks(struct sysc *ddata)
                 return -EINVAL;
         }
 
-        ddata->clocks = devm_kzalloc(ddata->dev,
-                                     sizeof(*ddata->clocks) * ddata->nr_clocks,
+        ddata->clocks = devm_kcalloc(ddata->dev,
+                                     ddata->nr_clocks, sizeof(*ddata->clocks),
                                      GFP_KERNEL);
         if (!ddata->clocks)
                 return -ENOMEM;
diff --git a/drivers/char/agp/alpha-agp.c b/drivers/char/agp/alpha-agp.c
index 53fe633df1e8..c9bf2c219841 100644
--- a/drivers/char/agp/alpha-agp.c
+++ b/drivers/char/agp/alpha-agp.c
@@ -11,7 +11,7 @@
 
 #include "agp.h"
 
-static int alpha_core_agp_vm_fault(struct vm_fault *vmf)
+static vm_fault_t alpha_core_agp_vm_fault(struct vm_fault *vmf)
 {
         alpha_agp_info *agp = agp_bridge->dev_private_data;
         dma_addr_t dma_addr;
diff --git a/drivers/char/agp/amd64-agp.c b/drivers/char/agp/amd64-agp.c
index e50c29c97ca7..c69e39fdd02b 100644
--- a/drivers/char/agp/amd64-agp.c
+++ b/drivers/char/agp/amd64-agp.c
@@ -156,7 +156,7 @@ static u64 amd64_configure(struct pci_dev *hammer, u64 gatt_table)
 
         /* Address to map to */
         pci_read_config_dword(hammer, AMD64_GARTAPERTUREBASE, &tmp);
-        aperturebase = tmp << 25;
+        aperturebase = (u64)tmp << 25;
         aper_base = (aperturebase & PCI_BASE_ADDRESS_MEM_MASK);
 
         enable_gart_translation(hammer, gatt_table);
@@ -277,7 +277,7 @@ static int fix_northbridge(struct pci_dev *nb, struct pci_dev *agp, u16 cap)
         pci_read_config_dword(nb, AMD64_GARTAPERTURECTL, &nb_order);
         nb_order = (nb_order >> 1) & 7;
         pci_read_config_dword(nb, AMD64_GARTAPERTUREBASE, &nb_base);
-        nb_aper = nb_base << 25;
+        nb_aper = (u64)nb_base << 25;
 
         /* Northbridge seems to contain crap. Try the AGP bridge. */
 
diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
index ad353be871bf..90ec010bffbd 100644
--- a/drivers/char/ipmi/ipmi_si_intf.c
+++ b/drivers/char/ipmi/ipmi_si_intf.c
@@ -2088,8 +2088,10 @@ static int try_smi_init(struct smi_info *new_smi)
         return 0;
 
 out_err:
-        ipmi_unregister_smi(new_smi->intf);
-        new_smi->intf = NULL;
+        if (new_smi->intf) {
+                ipmi_unregister_smi(new_smi->intf);
+                new_smi->intf = NULL;
+        }
 
         kfree(init_name);
 
diff --git a/drivers/char/ipmi/kcs_bmc.c b/drivers/char/ipmi/kcs_bmc.c
index fbfc05e3f3d1..bb882ab161fe 100644
--- a/drivers/char/ipmi/kcs_bmc.c
+++ b/drivers/char/ipmi/kcs_bmc.c
@@ -210,34 +210,23 @@ static void kcs_bmc_handle_cmd(struct kcs_bmc *kcs_bmc)
 int kcs_bmc_handle_event(struct kcs_bmc *kcs_bmc)
 {
         unsigned long flags;
-        int ret = 0;
+        int ret = -ENODATA;
         u8 status;
 
         spin_lock_irqsave(&kcs_bmc->lock, flags);
 
-        if (!kcs_bmc->running) {
-                kcs_force_abort(kcs_bmc);
-                ret = -ENODEV;
-                goto out_unlock;
-        }
-
-        status = read_status(kcs_bmc) & (KCS_STATUS_IBF | KCS_STATUS_CMD_DAT);
-
-        switch (status) {
-        case KCS_STATUS_IBF | KCS_STATUS_CMD_DAT:
-                kcs_bmc_handle_cmd(kcs_bmc);
-                break;
-
-        case KCS_STATUS_IBF:
-                kcs_bmc_handle_data(kcs_bmc);
-                break;
+        status = read_status(kcs_bmc);
+        if (status & KCS_STATUS_IBF) {
+                if (!kcs_bmc->running)
+                        kcs_force_abort(kcs_bmc);
+                else if (status & KCS_STATUS_CMD_DAT)
+                        kcs_bmc_handle_cmd(kcs_bmc);
+                else
+                        kcs_bmc_handle_data(kcs_bmc);
 
-        default:
-                ret = -ENODATA;
-                break;
+                ret = 0;
         }
 
-out_unlock:
         spin_unlock_irqrestore(&kcs_bmc->lock, flags);
 
         return ret;
diff --git a/drivers/char/mem.c b/drivers/char/mem.c
index ffeb60d3434c..df66a9dd0aae 100644
--- a/drivers/char/mem.c
+++ b/drivers/char/mem.c
@@ -708,6 +708,7 @@ static int mmap_zero(struct file *file, struct vm_area_struct *vma)
 #endif
         if (vma->vm_flags & VM_SHARED)
                 return shmem_zero_setup(vma);
+        vma_set_anonymous(vma);
         return 0;
 }
 
diff --git a/drivers/char/random.c b/drivers/char/random.c
index cd888d4ee605..bd449ad52442 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -1895,14 +1895,22 @@ static int
 write_pool(struct entropy_store *r, const char __user *buffer, size_t count)
 {
         size_t bytes;
-        __u32 buf[16];
+        __u32 t, buf[16];
         const char __user *p = buffer;
 
         while (count > 0) {
+                int b, i = 0;
+
                 bytes = min(count, sizeof(buf));
                 if (copy_from_user(&buf, p, bytes))
                         return -EFAULT;
 
+                for (b = bytes ; b > 0 ; b -= sizeof(__u32), i++) {
+                        if (!arch_get_random_int(&t))
+                                break;
+                        buf[i] ^= t;
+                }
+
                 count -= bytes;
                 p += bytes;
 
diff --git a/drivers/clk/Makefile b/drivers/clk/Makefile
index ae40cbe770f0..0bb25dd009d1 100644
--- a/drivers/clk/Makefile
+++ b/drivers/clk/Makefile
@@ -96,7 +96,7 @@ obj-$(CONFIG_ARCH_SPRD)			+= sprd/
 obj-$(CONFIG_ARCH_STI)                  += st/
 obj-$(CONFIG_ARCH_STRATIX10)            += socfpga/
 obj-$(CONFIG_ARCH_SUNXI)                += sunxi/
-obj-$(CONFIG_ARCH_SUNXI)                += sunxi-ng/
+obj-$(CONFIG_SUNXI_CCU)                 += sunxi-ng/
 obj-$(CONFIG_ARCH_TEGRA)                += tegra/
 obj-y                                   += ti/
 obj-$(CONFIG_CLK_UNIPHIER)              += uniphier/
diff --git a/drivers/clk/clk-aspeed.c b/drivers/clk/clk-aspeed.c
index 38b366b00c57..7b70a074095d 100644
--- a/drivers/clk/clk-aspeed.c
+++ b/drivers/clk/clk-aspeed.c
@@ -24,7 +24,7 @@
 #define ASPEED_MPLL_PARAM       0x20
 #define ASPEED_HPLL_PARAM       0x24
 #define  AST2500_HPLL_BYPASS_EN BIT(20)
-#define  AST2400_HPLL_STRAPPED  BIT(18)
+#define  AST2400_HPLL_PROGRAMMED BIT(18)
 #define  AST2400_HPLL_BYPASS_EN BIT(17)
 #define ASPEED_MISC_CTRL        0x2c
 #define  UART_DIV13_EN          BIT(12)
@@ -91,8 +91,8 @@ static const struct aspeed_gate_data aspeed_gates[] = {
         [ASPEED_CLK_GATE_GCLK] =        {  1,  7, "gclk-gate",          NULL,   0 }, /* 2D engine */
         [ASPEED_CLK_GATE_MCLK] =        {  2, -1, "mclk-gate",          "mpll", CLK_IS_CRITICAL }, /* SDRAM */
         [ASPEED_CLK_GATE_VCLK] =        {  3,  6, "vclk-gate",          NULL,   0 }, /* Video Capture */
-        [ASPEED_CLK_GATE_BCLK] =        {  4,  8, "bclk-gate",          "bclk", 0 }, /* PCIe/PCI */
-        [ASPEED_CLK_GATE_DCLK] =        {  5, -1, "dclk-gate",          NULL,   0 }, /* DAC */
+        [ASPEED_CLK_GATE_BCLK] =        {  4,  8, "bclk-gate",          "bclk", CLK_IS_CRITICAL }, /* PCIe/PCI */
+        [ASPEED_CLK_GATE_DCLK] =        {  5, -1, "dclk-gate",          NULL,   CLK_IS_CRITICAL }, /* DAC */
         [ASPEED_CLK_GATE_REFCLK] =      {  6, -1, "refclk-gate",        "clkin", CLK_IS_CRITICAL },
         [ASPEED_CLK_GATE_USBPORT2CLK] = {  7,  3, "usb-port2-gate",     NULL,   0 }, /* USB2.0 Host port 2 */
         [ASPEED_CLK_GATE_LCLK] =        {  8,  5, "lclk-gate",          NULL,   0 }, /* LPC */
@@ -212,9 +212,22 @@ static int aspeed_clk_is_enabled(struct clk_hw *hw)
 {
         struct aspeed_clk_gate *gate = to_aspeed_clk_gate(hw);
         u32 clk = BIT(gate->clock_idx);
+        u32 rst = BIT(gate->reset_idx);
         u32 enval = (gate->flags & CLK_GATE_SET_TO_DISABLE) ? 0 : clk;
         u32 reg;
 
+        /*
+         * If the IP is in reset, treat the clock as not enabled,
+         * this happens with some clocks such as the USB one when
+         * coming from cold reset. Without this, aspeed_clk_enable()
+         * will fail to lift the reset.
+         */
+        if (gate->reset_idx >= 0) {
+                regmap_read(gate->map, ASPEED_RESET_CTRL, &reg);
+                if (reg & rst)
+                        return 0;
+        }
+
         regmap_read(gate->map, ASPEED_CLK_STOP_CTRL, &reg);
 
         return ((reg & clk) == enval) ? 1 : 0;
@@ -565,29 +578,45 @@ builtin_platform_driver(aspeed_clk_driver);
 static void __init aspeed_ast2400_cc(struct regmap *map)
 {
         struct clk_hw *hw;
-        u32 val, freq, div;
+        u32 val, div, clkin, hpll;
+        const u16 hpll_rates[][4] = {
+                {384, 360, 336, 408},
+                {400, 375, 350, 425},
+        };
+        int rate;
 
         /*
          * CLKIN is the crystal oscillator, 24, 48 or 25MHz selected by
          * strapping
          */
         regmap_read(map, ASPEED_STRAP, &val);
-        if (val & CLKIN_25MHZ_EN)
-                freq = 25000000;
-        else if (val & AST2400_CLK_SOURCE_SEL)
-                freq = 48000000;
-        else
-                freq = 24000000;
-        hw = clk_hw_register_fixed_rate(NULL, "clkin", NULL, 0, freq);
-        pr_debug("clkin @%u MHz\n", freq / 1000000);
+        rate = (val >> 8) & 3;
+        if (val & CLKIN_25MHZ_EN) {
+                clkin = 25000000;
+                hpll = hpll_rates[1][rate];
+        } else if (val & AST2400_CLK_SOURCE_SEL) {
+                clkin = 48000000;
+                hpll = hpll_rates[0][rate];
+        } else {
+                clkin = 24000000;
+                hpll = hpll_rates[0][rate];
+        }
+        hw = clk_hw_register_fixed_rate(NULL, "clkin", NULL, 0, clkin);
+        pr_debug("clkin @%u MHz\n", clkin / 1000000);
 
         /*
          * High-speed PLL clock derived from the crystal. This the CPU clock,
-         * and we assume that it is enabled
+         * and we assume that it is enabled. It can be configured through the
+         * HPLL_PARAM register, or set to a specified frequency by strapping.
          */
         regmap_read(map, ASPEED_HPLL_PARAM, &val);
-        WARN(val & AST2400_HPLL_STRAPPED, "hpll is strapped not configured");
-        aspeed_clk_data->hws[ASPEED_CLK_HPLL] = aspeed_ast2400_calc_pll("hpll", val);
+        if (val & AST2400_HPLL_PROGRAMMED)
+                hw = aspeed_ast2400_calc_pll("hpll", val);
+        else
+                hw = clk_hw_register_fixed_rate(NULL, "hpll", "clkin", 0,
+                                hpll * 1000000);
+
+        aspeed_clk_data->hws[ASPEED_CLK_HPLL] = hw;
 
         /*
          * Strap bits 11:10 define the CPU/AHB clock frequency ratio (aka HCLK)
diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
index 9760b526ca31..e2ed078abd90 100644
--- a/drivers/clk/clk.c
+++ b/drivers/clk/clk.c
@@ -24,7 +24,6 @@
 #include <linux/pm_runtime.h>
 #include <linux/sched.h>
 #include <linux/clkdev.h>
-#include <linux/stringify.h>
 
 #include "clk.h"
 
@@ -2559,7 +2558,7 @@ static const struct {
         unsigned long flag;
         const char *name;
 } clk_flags[] = {
-#define ENTRY(f) { f, __stringify(f) }
+#define ENTRY(f) { f, #f }
         ENTRY(CLK_SET_RATE_GATE),
         ENTRY(CLK_SET_PARENT_GATE),
         ENTRY(CLK_SET_RATE_PARENT),
diff --git a/drivers/clk/davinci/da8xx-cfgchip.c b/drivers/clk/davinci/da8xx-cfgchip.c
index aae62a5b8734..d1bbee19ed0f 100644
--- a/drivers/clk/davinci/da8xx-cfgchip.c
+++ b/drivers/clk/davinci/da8xx-cfgchip.c
@@ -672,7 +672,7 @@ static int of_da8xx_usb_phy_clk_init(struct device *dev, struct regmap *regmap)
 
         usb1 = da8xx_cfgchip_register_usb1_clk48(dev, regmap);
         if (IS_ERR(usb1)) {
-                if (PTR_ERR(usb0) == -EPROBE_DEFER)
+                if (PTR_ERR(usb1) == -EPROBE_DEFER)
                         return -EPROBE_DEFER;
 
                 dev_warn(dev, "Failed to register usb1_clk48 (%ld)\n",
diff --git a/drivers/clk/davinci/psc.h b/drivers/clk/davinci/psc.h
index 6a42529d31a9..cc5614567a70 100644
--- a/drivers/clk/davinci/psc.h
+++ b/drivers/clk/davinci/psc.h
@@ -107,7 +107,7 @@ extern const struct davinci_psc_init_data of_da850_psc1_init_data;
 #ifdef CONFIG_ARCH_DAVINCI_DM355
 extern const struct davinci_psc_init_data dm355_psc_init_data;
 #endif
-#ifdef CONFIG_ARCH_DAVINCI_DM356
+#ifdef CONFIG_ARCH_DAVINCI_DM365
 extern const struct davinci_psc_init_data dm365_psc_init_data;
 #endif
 #ifdef CONFIG_ARCH_DAVINCI_DM644x
diff --git a/drivers/clk/meson/clk-audio-divider.c b/drivers/clk/meson/clk-audio-divider.c
index 58f546e04807..e4cf96ba704e 100644
--- a/drivers/clk/meson/clk-audio-divider.c
+++ b/drivers/clk/meson/clk-audio-divider.c
@@ -51,7 +51,7 @@ static unsigned long audio_divider_recalc_rate(struct clk_hw *hw,
         struct meson_clk_audio_div_data *adiv = meson_clk_audio_div_data(clk);
         unsigned long divider;
 
-        divider = meson_parm_read(clk->map, &adiv->div);
+        divider = meson_parm_read(clk->map, &adiv->div) + 1;
 
         return DIV_ROUND_UP_ULL((u64)parent_rate, divider);
 }
diff --git a/drivers/clk/meson/gxbb.c b/drivers/clk/meson/gxbb.c
index 240658404367..177fffb9ebef 100644
--- a/drivers/clk/meson/gxbb.c
+++ b/drivers/clk/meson/gxbb.c
@@ -498,6 +498,7 @@ static struct clk_regmap gxbb_fclk_div2 = {
                 .ops = &clk_regmap_gate_ops,
                 .parent_names = (const char *[]){ "fclk_div2_div" },
                 .num_parents = 1,
+                .flags = CLK_IS_CRITICAL,
         },
 };
 
diff --git a/drivers/clk/mvebu/armada-37xx-periph.c b/drivers/clk/mvebu/armada-37xx-periph.c
index 6860bd5a37c5..44e4e27eddad 100644
--- a/drivers/clk/mvebu/armada-37xx-periph.c
+++ b/drivers/clk/mvebu/armada-37xx-periph.c
@@ -35,6 +35,7 @@
 #define CLK_SEL         0x10
 #define CLK_DIS         0x14
 
+#define  ARMADA_37XX_DVFS_LOAD_1 1
 #define LOAD_LEVEL_NR   4
 
 #define ARMADA_37XX_NB_L0L1     0x18
@@ -507,6 +508,40 @@ static long clk_pm_cpu_round_rate(struct clk_hw *hw, unsigned long rate,
         return -EINVAL;
 }
 
+/*
+ * Switching the CPU from the L2 or L3 frequencies (300 and 200 Mhz
+ * respectively) to L0 frequency (1.2 Ghz) requires a significant
+ * amount of time to let VDD stabilize to the appropriate
+ * voltage. This amount of time is large enough that it cannot be
+ * covered by the hardware countdown register. Due to this, the CPU
+ * might start operating at L0 before the voltage is stabilized,
+ * leading to CPU stalls.
+ *
+ * To work around this problem, we prevent switching directly from the
+ * L2/L3 frequencies to the L0 frequency, and instead switch to the L1
+ * frequency in-between. The sequence therefore becomes:
+ * 1. First switch from L2/L3(200/300MHz) to L1(600MHZ)
+ * 2. Sleep 20ms for stabling VDD voltage
+ * 3. Then switch from L1(600MHZ) to L0(1200Mhz).
+ */
+static void clk_pm_cpu_set_rate_wa(unsigned long rate, struct regmap *base)
+{
+        unsigned int cur_level;
+
+        if (rate != 1200 * 1000 * 1000)
+                return;
+
+        regmap_read(base, ARMADA_37XX_NB_CPU_LOAD, &cur_level);
+        cur_level &= ARMADA_37XX_NB_CPU_LOAD_MASK;
+        if (cur_level <= ARMADA_37XX_DVFS_LOAD_1)
+                return;
+
+        regmap_update_bits(base, ARMADA_37XX_NB_CPU_LOAD,
+                           ARMADA_37XX_NB_CPU_LOAD_MASK,
+                           ARMADA_37XX_DVFS_LOAD_1);
+        msleep(20);
+}
+
 static int clk_pm_cpu_set_rate(struct clk_hw *hw, unsigned long rate,
                                unsigned long parent_rate)
 {
@@ -537,6 +572,9 @@ static int clk_pm_cpu_set_rate(struct clk_hw *hw, unsigned long rate,
                          */
                         reg = ARMADA_37XX_NB_CPU_LOAD;
                         mask = ARMADA_37XX_NB_CPU_LOAD_MASK;
+
+                        clk_pm_cpu_set_rate_wa(rate, base);
+
                         regmap_update_bits(base, reg, mask, load_level);
 
                         return rate;
diff --git a/drivers/clk/qcom/gcc-msm8996.c b/drivers/clk/qcom/gcc-msm8996.c
index 9f35b3fe1d97..ff8d66fd94e6 100644
--- a/drivers/clk/qcom/gcc-msm8996.c
+++ b/drivers/clk/qcom/gcc-msm8996.c
@@ -2781,6 +2781,7 @@ static struct clk_branch gcc_ufs_rx_cfg_clk = {
 
 static struct clk_branch gcc_ufs_tx_symbol_0_clk = {
         .halt_reg = 0x75018,
+        .halt_check = BRANCH_HALT_SKIP,
         .clkr = {
                 .enable_reg = 0x75018,
                 .enable_mask = BIT(0),
diff --git a/drivers/clk/qcom/mmcc-msm8996.c b/drivers/clk/qcom/mmcc-msm8996.c
index 1a25ee4f3658..4b20d1b67a1b 100644
--- a/drivers/clk/qcom/mmcc-msm8996.c
+++ b/drivers/clk/qcom/mmcc-msm8996.c
@@ -2910,6 +2910,7 @@ static struct gdsc mmagic_bimc_gdsc = {
                 .name = "mmagic_bimc",
         },
         .pwrsts = PWRSTS_OFF_ON,
+        .flags = ALWAYS_ON,
 };
 
 static struct gdsc mmagic_video_gdsc = {
diff --git a/drivers/clk/sunxi-ng/Makefile b/drivers/clk/sunxi-ng/Makefile
index acaa14cfa25c..49454700f2e5 100644
--- a/drivers/clk/sunxi-ng/Makefile
+++ b/drivers/clk/sunxi-ng/Makefile
@@ -1,24 +1,24 @@
 # SPDX-License-Identifier: GPL-2.0
 # Common objects
-lib-$(CONFIG_SUNXI_CCU)         += ccu_common.o
-lib-$(CONFIG_SUNXI_CCU)         += ccu_mmc_timing.o
-lib-$(CONFIG_SUNXI_CCU)         += ccu_reset.o
+obj-y                           += ccu_common.o
+obj-y                           += ccu_mmc_timing.o
+obj-y                           += ccu_reset.o
 
 # Base clock types
-lib-$(CONFIG_SUNXI_CCU)         += ccu_div.o
-lib-$(CONFIG_SUNXI_CCU)         += ccu_frac.o
-lib-$(CONFIG_SUNXI_CCU)         += ccu_gate.o
-lib-$(CONFIG_SUNXI_CCU)         += ccu_mux.o
-lib-$(CONFIG_SUNXI_CCU)         += ccu_mult.o
-lib-$(CONFIG_SUNXI_CCU)         += ccu_phase.o
-lib-$(CONFIG_SUNXI_CCU)         += ccu_sdm.o
+obj-y                           += ccu_div.o
+obj-y                           += ccu_frac.o
+obj-y                           += ccu_gate.o
+obj-y                           += ccu_mux.o
+obj-y                           += ccu_mult.o
+obj-y                           += ccu_phase.o
+obj-y                           += ccu_sdm.o
 
 # Multi-factor clocks
-lib-$(CONFIG_SUNXI_CCU)         += ccu_nk.o
-lib-$(CONFIG_SUNXI_CCU)         += ccu_nkm.o
-lib-$(CONFIG_SUNXI_CCU)         += ccu_nkmp.o
-lib-$(CONFIG_SUNXI_CCU)         += ccu_nm.o
-lib-$(CONFIG_SUNXI_CCU)         += ccu_mp.o
+obj-y                           += ccu_nk.o
+obj-y                           += ccu_nkm.o
+obj-y                           += ccu_nkmp.o
+obj-y                           += ccu_nm.o
+obj-y                           += ccu_mp.o
 
 # SoC support
 obj-$(CONFIG_SUN50I_A64_CCU)    += ccu-sun50i-a64.o
@@ -38,12 +38,3 @@ obj-$(CONFIG_SUN8I_R40_CCU)	+= ccu-sun8i-r40.o
 obj-$(CONFIG_SUN9I_A80_CCU)     += ccu-sun9i-a80.o
 obj-$(CONFIG_SUN9I_A80_CCU)     += ccu-sun9i-a80-de.o
 obj-$(CONFIG_SUN9I_A80_CCU)     += ccu-sun9i-a80-usb.o
-
-# The lib-y file goals is supposed to work only in arch/*/lib or lib/. In our
-# case, we want to use that goal, but even though lib.a will be properly
-# generated, it will not be linked in, eventually resulting in a linker error
-# for missing symbols.
-#
-# We can work around that by explicitly adding lib.a to the obj-y goal. This is
-# an undocumented behaviour, but works well for now.
-obj-$(CONFIG_SUNXI_CCU)         += lib.a
diff --git a/drivers/clocksource/arm_arch_timer.c b/drivers/clocksource/arm_arch_timer.c
index 57cb2f00fc07..d8c7f5750cdb 100644
--- a/drivers/clocksource/arm_arch_timer.c
+++ b/drivers/clocksource/arm_arch_timer.c
@@ -735,7 +735,7 @@ static void __arch_timer_setup(unsigned type,
                 clk->features |= CLOCK_EVT_FEAT_DYNIRQ;
                 clk->name = "arch_mem_timer";
                 clk->rating = 400;
-                clk->cpumask = cpu_all_mask;
+                clk->cpumask = cpu_possible_mask;
                 if (arch_timer_mem_use_virtual) {
                         clk->set_state_shutdown = arch_timer_shutdown_virt_mem;
                         clk->set_state_oneshot_stopped = arch_timer_shutdown_virt_mem;
diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
index ece120da3353..3c3971256130 100644
--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -2394,6 +2394,18 @@ static bool __init intel_pstate_no_acpi_pss(void)
         return true;
 }
 
+static bool __init intel_pstate_no_acpi_pcch(void)
+{
+        acpi_status status;
+        acpi_handle handle;
+
+        status = acpi_get_handle(NULL, "\\_SB", &handle);
+        if (ACPI_FAILURE(status))
+                return true;
+
+        return !acpi_has_method(handle, "PCCH");
+}
+
 static bool __init intel_pstate_has_acpi_ppc(void)
 {
         int i;
@@ -2453,7 +2465,10 @@ static bool __init intel_pstate_platform_pwr_mgmt_exists(void)
 
         switch (plat_info[idx].data) {
         case PSS:
-                return intel_pstate_no_acpi_pss();
+                if (!intel_pstate_no_acpi_pss())
+                        return false;
+
+                return intel_pstate_no_acpi_pcch();
         case PPC:
                 return intel_pstate_has_acpi_ppc() && !force_load;
         }
diff --git a/drivers/cpufreq/pcc-cpufreq.c b/drivers/cpufreq/pcc-cpufreq.c
index 3f0ce2ae35ee..0c56c9759672 100644
--- a/drivers/cpufreq/pcc-cpufreq.c
+++ b/drivers/cpufreq/pcc-cpufreq.c
@@ -580,6 +580,10 @@ static int __init pcc_cpufreq_init(void)
 {
         int ret;
 
+        /* Skip initialization if another cpufreq driver is there. */
+        if (cpufreq_get_current_driver())
+                return 0;
+
         if (acpi_disabled)
                 return 0;
 
diff --git a/drivers/cpufreq/qcom-cpufreq-kryo.c b/drivers/cpufreq/qcom-cpufreq-kryo.c
index 29389accf3e9..efc9a7ae4857 100644
--- a/drivers/cpufreq/qcom-cpufreq-kryo.c
+++ b/drivers/cpufreq/qcom-cpufreq-kryo.c
@@ -183,6 +183,7 @@ static struct platform_driver qcom_cpufreq_kryo_driver = {
 static const struct of_device_id qcom_cpufreq_kryo_match_list[] __initconst = {
         { .compatible = "qcom,apq8096", },
         { .compatible = "qcom,msm8996", },
+        {}
 };
 
 /*
diff --git a/drivers/dax/device.c b/drivers/dax/device.c
index de2f8297a210..108c37fca782 100644
--- a/drivers/dax/device.c
+++ b/drivers/dax/device.c
@@ -189,14 +189,16 @@ static int check_vma(struct dev_dax *dev_dax, struct vm_area_struct *vma,
 
         /* prevent private mappings from being established */
         if ((vma->vm_flags & VM_MAYSHARE) != VM_MAYSHARE) {
-                dev_info(dev, "%s: %s: fail, attempted private mapping\n",
+                dev_info_ratelimited(dev,
+                                "%s: %s: fail, attempted private mapping\n",
                                 current->comm, func);
                 return -EINVAL;
         }
 
         mask = dax_region->align - 1;
         if (vma->vm_start & mask || vma->vm_end & mask) {
-                dev_info(dev, "%s: %s: fail, unaligned vma (%#lx - %#lx, %#lx)\n",
+                dev_info_ratelimited(dev,
+                                "%s: %s: fail, unaligned vma (%#lx - %#lx, %#lx)\n",
                                 current->comm, func, vma->vm_start, vma->vm_end,
                                 mask);
                 return -EINVAL;
@@ -204,13 +206,15 @@ static int check_vma(struct dev_dax *dev_dax, struct vm_area_struct *vma,
 
         if ((dax_region->pfn_flags & (PFN_DEV|PFN_MAP)) == PFN_DEV
                         && (vma->vm_flags & VM_DONTCOPY) == 0) {
-                dev_info(dev, "%s: %s: fail, dax range requires MADV_DONTFORK\n",
+                dev_info_ratelimited(dev,
+                                "%s: %s: fail, dax range requires MADV_DONTFORK\n",
                                 current->comm, func);
                 return -EINVAL;
         }
 
         if (!vma_is_dax(vma)) {
-                dev_info(dev, "%s: %s: fail, vma is not DAX capable\n",
+                dev_info_ratelimited(dev,
+                                "%s: %s: fail, vma is not DAX capable\n",
                                 current->comm, func);
                 return -EINVAL;
         }
diff --git a/drivers/dma/k3dma.c b/drivers/dma/k3dma.c
index fa31cccbe04f..6bfa217ed6d0 100644
--- a/drivers/dma/k3dma.c
+++ b/drivers/dma/k3dma.c
@@ -794,7 +794,7 @@ static struct dma_chan *k3_of_dma_simple_xlate(struct of_phandle_args *dma_spec,
         struct k3_dma_dev *d = ofdma->of_dma_data;
         unsigned int request = dma_spec->args[0];
 
-        if (request > d->dma_requests)
+        if (request >= d->dma_requests)
                 return NULL;
 
         return dma_get_slave_channel(&(d->chans[request].vc.chan));
diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c
index defcdde4d358..de0957fe9668 100644
--- a/drivers/dma/pl330.c
+++ b/drivers/dma/pl330.c
@@ -3033,7 +3033,7 @@ pl330_probe(struct amba_device *adev, const struct amba_id *id)
         pd->src_addr_widths = PL330_DMA_BUSWIDTHS;
         pd->dst_addr_widths = PL330_DMA_BUSWIDTHS;
         pd->directions = BIT(DMA_DEV_TO_MEM) | BIT(DMA_MEM_TO_DEV);
-        pd->residue_granularity = DMA_RESIDUE_GRANULARITY_SEGMENT;
+        pd->residue_granularity = DMA_RESIDUE_GRANULARITY_BURST;
         pd->max_burst = ((pl330->quirks & PL330_QUIRK_BROKEN_NO_FLUSHP) ?
                          1 : PL330_MAX_BURST);
 
diff --git a/drivers/dma/ti/omap-dma.c b/drivers/dma/ti/omap-dma.c
index 9b5ca8691f27..a4a931ddf6f6 100644
--- a/drivers/dma/ti/omap-dma.c
+++ b/drivers/dma/ti/omap-dma.c
@@ -1485,7 +1485,11 @@ static int omap_dma_probe(struct platform_device *pdev)
         od->ddev.src_addr_widths = OMAP_DMA_BUSWIDTHS;
         od->ddev.dst_addr_widths = OMAP_DMA_BUSWIDTHS;
         od->ddev.directions = BIT(DMA_DEV_TO_MEM) | BIT(DMA_MEM_TO_DEV);
-        od->ddev.residue_granularity = DMA_RESIDUE_GRANULARITY_BURST;
+        if (__dma_omap15xx(od->plat->dma_attr))
+                od->ddev.residue_granularity =
+                                DMA_RESIDUE_GRANULARITY_DESCRIPTOR;
+        else
+                od->ddev.residue_granularity = DMA_RESIDUE_GRANULARITY_BURST;
         od->ddev.max_burst = SZ_16M - 1; /* CCEN: 24bit unsigned */
         od->ddev.dev = &pdev->dev;
         INIT_LIST_HEAD(&od->ddev.channels);
diff --git a/drivers/fpga/altera-cvp.c b/drivers/fpga/altera-cvp.c
index dd4edd8f22ce..7fa793672a7a 100644
--- a/drivers/fpga/altera-cvp.c
+++ b/drivers/fpga/altera-cvp.c
@@ -455,8 +455,10 @@ static int altera_cvp_probe(struct pci_dev *pdev,
 
         mgr = fpga_mgr_create(&pdev->dev, conf->mgr_name,
                               &altera_cvp_ops, conf);
-        if (!mgr)
-                return -ENOMEM;
+        if (!mgr) {
+                ret = -ENOMEM;
+                goto err_unmap;
+        }
 
         pci_set_drvdata(pdev, mgr);
 
diff --git a/drivers/gpio/gpio-uniphier.c b/drivers/gpio/gpio-uniphier.c
index d3cf9502e7e7..58faeb1cef63 100644
--- a/drivers/gpio/gpio-uniphier.c
+++ b/drivers/gpio/gpio-uniphier.c
@@ -181,7 +181,11 @@ static int uniphier_gpio_to_irq(struct gpio_chip *chip, unsigned int offset)
         fwspec.fwnode = of_node_to_fwnode(chip->parent->of_node);
         fwspec.param_count = 2;
         fwspec.param[0] = offset - UNIPHIER_GPIO_IRQ_OFFSET;
-        fwspec.param[1] = IRQ_TYPE_NONE;
+        /*
+         * IRQ_TYPE_NONE is rejected by the parent irq domain. Set LEVEL_HIGH
+         * temporarily. Anyway, ->irq_set_type() will override it later.
+         */
+        fwspec.param[1] = IRQ_TYPE_LEVEL_HIGH;
 
         return irq_create_fwspec_mapping(&fwspec);
 }
diff --git a/drivers/gpio/gpiolib-of.c b/drivers/gpio/gpiolib-of.c
index 28d968088131..53a14ee8ad6d 100644
--- a/drivers/gpio/gpiolib-of.c
+++ b/drivers/gpio/gpiolib-of.c
@@ -64,7 +64,8 @@ static void of_gpio_flags_quirks(struct device_node *np,
          * Note that active low is the default.
          */
         if (IS_ENABLED(CONFIG_REGULATOR) &&
-            (of_device_is_compatible(np, "reg-fixed-voltage") ||
+            (of_device_is_compatible(np, "regulator-fixed") ||
+             of_device_is_compatible(np, "reg-fixed-voltage") ||
              of_device_is_compatible(np, "regulator-gpio"))) {
                 /*
                  * The regulator GPIO handles are specified such that the
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c
index f4c474a95875..71efcf38f11b 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c
@@ -57,6 +57,10 @@
 #define ACP_I2S_COMP2_CAP_REG_OFFSET            0xa8
 #define ACP_I2S_COMP1_PLAY_REG_OFFSET           0x6c
 #define ACP_I2S_COMP2_PLAY_REG_OFFSET           0x68
+#define ACP_BT_PLAY_REGS_START                  0x14970
+#define ACP_BT_PLAY_REGS_END                    0x14a24
+#define ACP_BT_COMP1_REG_OFFSET                 0xac
+#define ACP_BT_COMP2_REG_OFFSET                 0xa8
 
 #define mmACP_PGFSM_RETAIN_REG                  0x51c9
 #define mmACP_PGFSM_CONFIG_REG                  0x51ca
@@ -77,7 +81,7 @@
 #define ACP_SOFT_RESET_DONE_TIME_OUT_VALUE      0x000000FF
 
 #define ACP_TIMEOUT_LOOP                        0x000000FF
-#define ACP_DEVS                                3
+#define ACP_DEVS                                4
 #define ACP_SRC_ID                              162
 
 enum {
@@ -316,14 +320,13 @@ static int acp_hw_init(void *handle)
         if (adev->acp.acp_cell == NULL)
                 return -ENOMEM;
 
-        adev->acp.acp_res = kcalloc(4, sizeof(struct resource), GFP_KERNEL);
-
+        adev->acp.acp_res = kcalloc(5, sizeof(struct resource), GFP_KERNEL);
         if (adev->acp.acp_res == NULL) {
                 kfree(adev->acp.acp_cell);
                 return -ENOMEM;
         }
 
-        i2s_pdata = kcalloc(2, sizeof(struct i2s_platform_data), GFP_KERNEL);
+        i2s_pdata = kcalloc(3, sizeof(struct i2s_platform_data), GFP_KERNEL);
         if (i2s_pdata == NULL) {
                 kfree(adev->acp.acp_res);
                 kfree(adev->acp.acp_cell);
@@ -358,6 +361,20 @@ static int acp_hw_init(void *handle)
         i2s_pdata[1].i2s_reg_comp1 = ACP_I2S_COMP1_CAP_REG_OFFSET;
         i2s_pdata[1].i2s_reg_comp2 = ACP_I2S_COMP2_CAP_REG_OFFSET;
 
+        i2s_pdata[2].quirks = DW_I2S_QUIRK_COMP_REG_OFFSET;
+        switch (adev->asic_type) {
+        case CHIP_STONEY:
+                i2s_pdata[2].quirks |= DW_I2S_QUIRK_16BIT_IDX_OVERRIDE;
+                break;
+        default:
+                break;
+        }
+
+        i2s_pdata[2].cap = DWC_I2S_PLAY | DWC_I2S_RECORD;
+        i2s_pdata[2].snd_rates = SNDRV_PCM_RATE_8000_96000;
+        i2s_pdata[2].i2s_reg_comp1 = ACP_BT_COMP1_REG_OFFSET;
+        i2s_pdata[2].i2s_reg_comp2 = ACP_BT_COMP2_REG_OFFSET;
+
         adev->acp.acp_res[0].name = "acp2x_dma";
         adev->acp.acp_res[0].flags = IORESOURCE_MEM;
         adev->acp.acp_res[0].start = acp_base;
@@ -373,13 +390,18 @@ static int acp_hw_init(void *handle)
         adev->acp.acp_res[2].start = acp_base + ACP_I2S_CAP_REGS_START;
         adev->acp.acp_res[2].end = acp_base + ACP_I2S_CAP_REGS_END;
 
-        adev->acp.acp_res[3].name = "acp2x_dma_irq";
-        adev->acp.acp_res[3].flags = IORESOURCE_IRQ;
-        adev->acp.acp_res[3].start = amdgpu_irq_create_mapping(adev, 162);
-        adev->acp.acp_res[3].end = adev->acp.acp_res[3].start;
+        adev->acp.acp_res[3].name = "acp2x_dw_bt_i2s_play_cap";
+        adev->acp.acp_res[3].flags = IORESOURCE_MEM;
+        adev->acp.acp_res[3].start = acp_base + ACP_BT_PLAY_REGS_START;
+        adev->acp.acp_res[3].end = acp_base + ACP_BT_PLAY_REGS_END;
+
+        adev->acp.acp_res[4].name = "acp2x_dma_irq";
+        adev->acp.acp_res[4].flags = IORESOURCE_IRQ;
+        adev->acp.acp_res[4].start = amdgpu_irq_create_mapping(adev, 162);
+        adev->acp.acp_res[4].end = adev->acp.acp_res[4].start;
 
         adev->acp.acp_cell[0].name = "acp_audio_dma";
-        adev->acp.acp_cell[0].num_resources = 4;
+        adev->acp.acp_cell[0].num_resources = 5;
         adev->acp.acp_cell[0].resources = &adev->acp.acp_res[0];
         adev->acp.acp_cell[0].platform_data = &adev->asic_type;
         adev->acp.acp_cell[0].pdata_size = sizeof(adev->asic_type);
@@ -396,6 +418,12 @@ static int acp_hw_init(void *handle)
         adev->acp.acp_cell[2].platform_data = &i2s_pdata[1];
         adev->acp.acp_cell[2].pdata_size = sizeof(struct i2s_platform_data);
 
+        adev->acp.acp_cell[3].name = "designware-i2s";
+        adev->acp.acp_cell[3].num_resources = 1;
+        adev->acp.acp_cell[3].resources = &adev->acp.acp_res[3];
+        adev->acp.acp_cell[3].platform_data = &i2s_pdata[2];
+        adev->acp.acp_cell[3].pdata_size = sizeof(struct i2s_platform_data);
+
         r = mfd_add_hotplug_devices(adev->acp.parent, adev->acp.acp_cell,
                                                                 ACP_DEVS);
         if (r)
@@ -451,7 +479,6 @@ static int acp_hw_init(void *handle)
         val = cgs_read_register(adev->acp.cgs_device, mmACP_SOFT_RESET);
         val &= ~ACP_SOFT_RESET__SoftResetAud_MASK;
         cgs_write_register(adev->acp.cgs_device, mmACP_SOFT_RESET, val);
-
         return 0;
 }
 
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
index b33f1680c9a3..a028661d9e20 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
@@ -575,6 +575,7 @@ static const struct amdgpu_px_quirk amdgpu_px_quirk_list[] = {
         { 0x1002, 0x6900, 0x1002, 0x0124, AMDGPU_PX_QUIRK_FORCE_ATPX },
         { 0x1002, 0x6900, 0x1028, 0x0812, AMDGPU_PX_QUIRK_FORCE_ATPX },
         { 0x1002, 0x6900, 0x1028, 0x0813, AMDGPU_PX_QUIRK_FORCE_ATPX },
+        { 0x1002, 0x6900, 0x1025, 0x125A, AMDGPU_PX_QUIRK_FORCE_ATPX },
         { 0, 0, 0, 0, 0 },
 };
 
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
index 13acef526c5b..e839470880d7 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -2843,6 +2843,9 @@ int amdgpu_device_resume(struct drm_device *dev, bool resume, bool fbcon)
         if (r)
                 return r;
 
+        /* Make sure IB tests flushed */
+        flush_delayed_work(&adev->late_init_work);
+
         /* blat the mode back in */
         if (fbcon) {
                 if (!amdgpu_device_has_dc_support(adev)) {
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_services.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_services.c
index 9f0a217603ad..516795342dd2 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_services.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_services.c
@@ -74,4 +74,3 @@ bool dm_read_persistent_data(struct dc_context *ctx,
 
 /**** power component interfaces ****/
 
-
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
index 9d901ca70588..af9386ee5a93 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
@@ -1781,12 +1781,10 @@ static void dp_test_send_link_training(struct dc_link *link)
         dp_retrain_link_dp_test(link, &link_settings, false);
 }
 
-/* TODO hbr2 compliance eye output is unstable
+/* TODO Raven hbr2 compliance eye output is unstable
  * (toggling on and off) with debugger break
  * This caueses intermittent PHY automation failure
  * Need to look into the root cause */
-static uint8_t force_tps4_for_cp2520 = 1;
-
 static void dp_test_send_phy_test_pattern(struct dc_link *link)
 {
         union phy_test_pattern dpcd_test_pattern;
@@ -1846,13 +1844,13 @@ static void dp_test_send_phy_test_pattern(struct dc_link *link)
                 break;
         case PHY_TEST_PATTERN_CP2520_1:
                 /* CP2520 pattern is unstable, temporarily use TPS4 instead */
-                test_pattern = (force_tps4_for_cp2520 == 1) ?
+                test_pattern = (link->dc->caps.force_dp_tps4_for_cp2520 == 1) ?
                                 DP_TEST_PATTERN_TRAINING_PATTERN4 :
                                 DP_TEST_PATTERN_HBR2_COMPLIANCE_EYE;
                 break;
         case PHY_TEST_PATTERN_CP2520_2:
                 /* CP2520 pattern is unstable, temporarily use TPS4 instead */
-                test_pattern = (force_tps4_for_cp2520 == 1) ?
+                test_pattern = (link->dc->caps.force_dp_tps4_for_cp2520 == 1) ?
                                 DP_TEST_PATTERN_TRAINING_PATTERN4 :
                                 DP_TEST_PATTERN_HBR2_COMPLIANCE_EYE;
                 break;
diff --git a/drivers/gpu/drm/amd/display/dc/dc.h b/drivers/gpu/drm/amd/display/dc/dc.h
index 7515c0dcbdd2..b91f14989aef 100644
--- a/drivers/gpu/drm/amd/display/dc/dc.h
+++ b/drivers/gpu/drm/amd/display/dc/dc.h
@@ -77,6 +77,7 @@ struct dc_caps {
         bool is_apu;
         bool dual_link_dvi;
         bool post_blend_color_processing;
+        bool force_dp_tps4_for_cp2520;
 };
 
 struct dc_dcc_surface_param {
diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_resource.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_resource.c
index cd8c22839227..c39934f8677f 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_resource.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_resource.c
@@ -1127,6 +1127,8 @@ static bool construct(
         dc->caps.max_slave_planes = 1;
         dc->caps.is_apu = true;
         dc->caps.post_blend_color_processing = false;
+        /* Raven DP PHY HBR2 eye diagram pattern is not stable. Use TP4 */
+        dc->caps.force_dp_tps4_for_cp2520 = true;
 
         if (dc->ctx->dce_environment == DCE_ENV_PRODUCTION_DRV)
                 dc->debug = debug_defaults_drv;
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega12_processpptables.c b/drivers/gpu/drm/amd/powerplay/hwmgr/vega12_processpptables.c
index f4f366b26fd1..cb3a5b1737c8 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega12_processpptables.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega12_processpptables.c
@@ -226,6 +226,8 @@ static int append_vbios_pptable(struct pp_hwmgr *hwmgr, PPTable_t *ppsmc_pptable
 
         ppsmc_pptable->Vr2_I2C_address = smc_dpm_table.Vr2_I2C_address;
 
+        ppsmc_pptable->Vr2_I2C_address = smc_dpm_table.Vr2_I2C_address;
+
         return 0;
 }
 
diff --git a/drivers/gpu/drm/armada/armada_crtc.c b/drivers/gpu/drm/armada/armada_crtc.c
index 03eeee11dd5b..42a40daff132 100644
--- a/drivers/gpu/drm/armada/armada_crtc.c
+++ b/drivers/gpu/drm/armada/armada_crtc.c
@@ -519,8 +519,9 @@ static irqreturn_t armada_drm_irq(int irq, void *arg)
         u32 v, stat = readl_relaxed(dcrtc->base + LCD_SPU_IRQ_ISR);
 
         /*
-         * This is rediculous - rather than writing bits to clear, we
-         * have to set the actual status register value.  This is racy.
+         * Reading the ISR appears to clear bits provided CLEAN_SPU_IRQ_ISR
+         * is set.  Writing has some other effect to acknowledge the IRQ -
+         * without this, we only get a single IRQ.
          */
         writel_relaxed(0, dcrtc->base + LCD_SPU_IRQ_ISR);
 
@@ -1116,16 +1117,22 @@ armada_drm_crtc_set_property(struct drm_crtc *crtc,
 static int armada_drm_crtc_enable_vblank(struct drm_crtc *crtc)
 {
         struct armada_crtc *dcrtc = drm_to_armada_crtc(crtc);
+        unsigned long flags;
 
+        spin_lock_irqsave(&dcrtc->irq_lock, flags);
         armada_drm_crtc_enable_irq(dcrtc, VSYNC_IRQ_ENA);
+        spin_unlock_irqrestore(&dcrtc->irq_lock, flags);
         return 0;
 }
 
 static void armada_drm_crtc_disable_vblank(struct drm_crtc *crtc)
 {
         struct armada_crtc *dcrtc = drm_to_armada_crtc(crtc);
+        unsigned long flags;
 
+        spin_lock_irqsave(&dcrtc->irq_lock, flags);
         armada_drm_crtc_disable_irq(dcrtc, VSYNC_IRQ_ENA);
+        spin_unlock_irqrestore(&dcrtc->irq_lock, flags);
 }
 
 static const struct drm_crtc_funcs armada_crtc_funcs = {
@@ -1415,6 +1422,7 @@ static int armada_drm_crtc_create(struct drm_device *drm, struct device *dev,
                        CFG_PDWN64x66, dcrtc->base + LCD_SPU_SRAM_PARA1);
         writel_relaxed(0x2032ff81, dcrtc->base + LCD_SPU_DMA_CTRL1);
         writel_relaxed(dcrtc->irq_ena, dcrtc->base + LCD_SPU_IRQ_ENA);
+        readl_relaxed(dcrtc->base + LCD_SPU_IRQ_ISR);
         writel_relaxed(0, dcrtc->base + LCD_SPU_IRQ_ISR);
 
         ret = devm_request_irq(dev, irq, armada_drm_irq, 0, "armada_drm_crtc",
diff --git a/drivers/gpu/drm/armada/armada_hw.h b/drivers/gpu/drm/armada/armada_hw.h
index 27319a8335e2..345dc4d0851e 100644
--- a/drivers/gpu/drm/armada/armada_hw.h
+++ b/drivers/gpu/drm/armada/armada_hw.h
@@ -160,6 +160,7 @@ enum {
         CFG_ALPHAM_GRA          = 0x1 << 16,
         CFG_ALPHAM_CFG          = 0x2 << 16,
         CFG_ALPHA_MASK          = 0xff << 8,
+#define CFG_ALPHA(x)            ((x) << 8)
         CFG_PIXCMD_MASK         = 0xff,
 };
 
diff --git a/drivers/gpu/drm/armada/armada_overlay.c b/drivers/gpu/drm/armada/armada_overlay.c
index c391955009d6..afa7ded3ae31 100644
--- a/drivers/gpu/drm/armada/armada_overlay.c
+++ b/drivers/gpu/drm/armada/armada_overlay.c
@@ -28,6 +28,7 @@ struct armada_ovl_plane_properties {
         uint16_t contrast;
         uint16_t saturation;
         uint32_t colorkey_mode;
+        uint32_t colorkey_enable;
 };
 
 struct armada_ovl_plane {
@@ -54,11 +55,13 @@ armada_ovl_update_attr(struct armada_ovl_plane_properties *prop,
         writel_relaxed(0x00002000, dcrtc->base + LCD_SPU_CBSH_HUE);
 
         spin_lock_irq(&dcrtc->irq_lock);
-        armada_updatel(prop->colorkey_mode | CFG_ALPHAM_GRA,
-                     CFG_CKMODE_MASK | CFG_ALPHAM_MASK | CFG_ALPHA_MASK,
-                     dcrtc->base + LCD_SPU_DMA_CTRL1);
-
-        armada_updatel(ADV_GRACOLORKEY, 0, dcrtc->base + LCD_SPU_ADV_REG);
+        armada_updatel(prop->colorkey_mode,
+                       CFG_CKMODE_MASK | CFG_ALPHAM_MASK | CFG_ALPHA_MASK,
+                       dcrtc->base + LCD_SPU_DMA_CTRL1);
+        if (dcrtc->variant->has_spu_adv_reg)
+                armada_updatel(prop->colorkey_enable,
+                               ADV_GRACOLORKEY | ADV_VIDCOLORKEY,
+                               dcrtc->base + LCD_SPU_ADV_REG);
         spin_unlock_irq(&dcrtc->irq_lock);
 }
 
@@ -321,8 +324,17 @@ static int armada_ovl_plane_set_property(struct drm_plane *plane,
                 dplane->prop.colorkey_vb |= K2B(val);
                 update_attr = true;
         } else if (property == priv->colorkey_mode_prop) {
-                dplane->prop.colorkey_mode &= ~CFG_CKMODE_MASK;
-                dplane->prop.colorkey_mode |= CFG_CKMODE(val);
+                if (val == CKMODE_DISABLE) {
+                        dplane->prop.colorkey_mode =
+                                CFG_CKMODE(CKMODE_DISABLE) |
+                                CFG_ALPHAM_CFG | CFG_ALPHA(255);
+                        dplane->prop.colorkey_enable = 0;
+                } else {
+                        dplane->prop.colorkey_mode =
+                                CFG_CKMODE(val) |
+                                CFG_ALPHAM_GRA | CFG_ALPHA(0);
+                        dplane->prop.colorkey_enable = ADV_GRACOLORKEY;
+                }
                 update_attr = true;
         } else if (property == priv->brightness_prop) {
                 dplane->prop.brightness = val - 256;
@@ -453,7 +465,9 @@ int armada_overlay_plane_create(struct drm_device *dev, unsigned long crtcs)
         dplane->prop.colorkey_yr = 0xfefefe00;
         dplane->prop.colorkey_ug = 0x01010100;
         dplane->prop.colorkey_vb = 0x01010100;
-        dplane->prop.colorkey_mode = CFG_CKMODE(CKMODE_RGB);
+        dplane->prop.colorkey_mode = CFG_CKMODE(CKMODE_RGB) |
+                                     CFG_ALPHAM_GRA | CFG_ALPHA(0);
+        dplane->prop.colorkey_enable = ADV_GRACOLORKEY;
         dplane->prop.brightness = 0;
         dplane->prop.contrast = 0x4000;
         dplane->prop.saturation = 0x4000;
diff --git a/drivers/gpu/drm/bridge/sil-sii8620.c b/drivers/gpu/drm/bridge/sil-sii8620.c
index 250effa0e6b8..a6e8f4591e63 100644
--- a/drivers/gpu/drm/bridge/sil-sii8620.c
+++ b/drivers/gpu/drm/bridge/sil-sii8620.c
@@ -14,6 +14,7 @@
 #include <drm/bridge/mhl.h>
 #include <drm/drm_crtc.h>
 #include <drm/drm_edid.h>
+#include <drm/drm_encoder.h>
 
 #include <linux/clk.h>
 #include <linux/delay.h>
@@ -72,9 +73,7 @@ struct sii8620 {
         struct regulator_bulk_data supplies[2];
         struct mutex lock; /* context lock, protects fields below */
         int error;
-        int pixel_clock;
         unsigned int use_packed_pixel:1;
-        int video_code;
         enum sii8620_mode mode;
         enum sii8620_sink_type sink_type;
         u8 cbus_status;
@@ -82,7 +81,6 @@ struct sii8620 {
         u8 xstat[MHL_XDS_SIZE];
         u8 devcap[MHL_DCAP_SIZE];
         u8 xdevcap[MHL_XDC_SIZE];
-        u8 avif[HDMI_INFOFRAME_SIZE(AVI)];
         bool feature_complete;
         bool devcap_read;
         bool sink_detected;
@@ -1017,21 +1015,36 @@ static void sii8620_stop_video(struct sii8620 *ctx)
 
 static void sii8620_set_format(struct sii8620 *ctx)
 {
+        u8 out_fmt;
+
         if (sii8620_is_mhl3(ctx)) {
                 sii8620_setbits(ctx, REG_M3_P0CTRL,
                                 BIT_M3_P0CTRL_MHL3_P0_PIXEL_MODE_PACKED,
                                 ctx->use_packed_pixel ? ~0 : 0);
         } else {
+                if (ctx->use_packed_pixel) {
+                        sii8620_write_seq_static(ctx,
+                                REG_VID_MODE, BIT_VID_MODE_M1080P,
+                                REG_MHL_TOP_CTL, BIT_MHL_TOP_CTL_MHL_PP_SEL | 1,
+                                REG_MHLTX_CTL6, 0x60
+                        );
+                } else {
                         sii8620_write_seq_static(ctx,
                                 REG_VID_MODE, 0,
                                 REG_MHL_TOP_CTL, 1,
                                 REG_MHLTX_CTL6, 0xa0
                         );
+                }
         }
 
+        if (ctx->use_packed_pixel)
+                out_fmt = VAL_TPI_FORMAT(YCBCR422, FULL);
+        else
+                out_fmt = VAL_TPI_FORMAT(RGB, FULL);
+
         sii8620_write_seq(ctx,
                 REG_TPI_INPUT, VAL_TPI_FORMAT(RGB, FULL),
-                REG_TPI_OUTPUT, VAL_TPI_FORMAT(RGB, FULL),
+                REG_TPI_OUTPUT, out_fmt,
         );
 }
 
@@ -1082,18 +1095,28 @@ static ssize_t mhl3_infoframe_pack(struct mhl3_infoframe *frame,
         return frm_len;
 }
 
-static void sii8620_set_infoframes(struct sii8620 *ctx)
+static void sii8620_set_infoframes(struct sii8620 *ctx,
+                                   struct drm_display_mode *mode)
 {
         struct mhl3_infoframe mhl_frm;
         union hdmi_infoframe frm;
         u8 buf[31];
         int ret;
 
+        ret = drm_hdmi_avi_infoframe_from_display_mode(&frm.avi,
+                                                       mode,
+                                                       true);
+        if (ctx->use_packed_pixel)
+                frm.avi.colorspace = HDMI_COLORSPACE_YUV422;
+
+        if (!ret)
+                ret = hdmi_avi_infoframe_pack(&frm.avi, buf, ARRAY_SIZE(buf));
+        if (ret > 0)
+                sii8620_write_buf(ctx, REG_TPI_AVI_CHSUM, buf + 3, ret - 3);
+
         if (!sii8620_is_mhl3(ctx) || !ctx->use_packed_pixel) {
                 sii8620_write(ctx, REG_TPI_SC,
                         BIT_TPI_SC_TPI_OUTPUT_MODE_0_HDMI);
-                sii8620_write_buf(ctx, REG_TPI_AVI_CHSUM, ctx->avif + 3,
-                        ARRAY_SIZE(ctx->avif) - 3);
                 sii8620_write(ctx, REG_PKT_FILTER_0,
                         BIT_PKT_FILTER_0_DROP_CEA_GAMUT_PKT |
                         BIT_PKT_FILTER_0_DROP_MPEG_PKT |
@@ -1102,16 +1125,6 @@ static void sii8620_set_infoframes(struct sii8620 *ctx)
                 return;
         }
 
-        ret = hdmi_avi_infoframe_init(&frm.avi);
-        frm.avi.colorspace = HDMI_COLORSPACE_YUV422;
-        frm.avi.active_aspect = HDMI_ACTIVE_ASPECT_PICTURE;
-        frm.avi.picture_aspect = HDMI_PICTURE_ASPECT_16_9;
-        frm.avi.colorimetry = HDMI_COLORIMETRY_ITU_709;
-        frm.avi.video_code = ctx->video_code;
-        if (!ret)
-                ret = hdmi_avi_infoframe_pack(&frm.avi, buf, ARRAY_SIZE(buf));
-        if (ret > 0)
-                sii8620_write_buf(ctx, REG_TPI_AVI_CHSUM, buf + 3, ret - 3);
         sii8620_write(ctx, REG_PKT_FILTER_0,
                 BIT_PKT_FILTER_0_DROP_CEA_GAMUT_PKT |
                 BIT_PKT_FILTER_0_DROP_MPEG_PKT |
@@ -1131,6 +1144,9 @@ static void sii8620_set_infoframes(struct sii8620 *ctx)
 
 static void sii8620_start_video(struct sii8620 *ctx)
 {
+        struct drm_display_mode *mode =
+                &ctx->bridge.encoder->crtc->state->adjusted_mode;
+
         if (!sii8620_is_mhl3(ctx))
                 sii8620_stop_video(ctx);
 
@@ -1149,8 +1165,14 @@ static void sii8620_start_video(struct sii8620 *ctx)
         sii8620_set_format(ctx);
 
         if (!sii8620_is_mhl3(ctx)) {
-                sii8620_mt_write_stat(ctx, MHL_DST_REG(LINK_MODE),
-                        MHL_DST_LM_CLK_MODE_NORMAL | MHL_DST_LM_PATH_ENABLED);
+                u8 link_mode = MHL_DST_LM_PATH_ENABLED;
+
+                if (ctx->use_packed_pixel)
+                        link_mode |= MHL_DST_LM_CLK_MODE_PACKED_PIXEL;
+                else
+                        link_mode |= MHL_DST_LM_CLK_MODE_NORMAL;
+
+                sii8620_mt_write_stat(ctx, MHL_DST_REG(LINK_MODE), link_mode);
                 sii8620_set_auto_zone(ctx);
         } else {
                 static const struct {
@@ -1167,7 +1189,7 @@ static void sii8620_start_video(struct sii8620 *ctx)
                           MHL_XDS_LINK_RATE_6_0_GBPS, 0x40 },
                 };
                 u8 p0_ctrl = BIT_M3_P0CTRL_MHL3_P0_PORT_EN;
-                int clk = ctx->pixel_clock * (ctx->use_packed_pixel ? 2 : 3);
+                int clk = mode->clock * (ctx->use_packed_pixel ? 2 : 3);
                 int i;
 
                 for (i = 0; i < ARRAY_SIZE(clk_spec) - 1; ++i)
@@ -1196,7 +1218,7 @@ static void sii8620_start_video(struct sii8620 *ctx)
                         clk_spec[i].link_rate);
         }
 
-        sii8620_set_infoframes(ctx);
+        sii8620_set_infoframes(ctx, mode);
 }
 
 static void sii8620_disable_hpd(struct sii8620 *ctx)
@@ -1661,14 +1683,18 @@ static void sii8620_status_dcap_ready(struct sii8620 *ctx)
 
 static void sii8620_status_changed_path(struct sii8620 *ctx)
 {
-        if (ctx->stat[MHL_DST_LINK_MODE] & MHL_DST_LM_PATH_ENABLED) {
-                sii8620_mt_write_stat(ctx, MHL_DST_REG(LINK_MODE),
-                                      MHL_DST_LM_CLK_MODE_NORMAL
-                                      | MHL_DST_LM_PATH_ENABLED);
-        } else {
-                sii8620_mt_write_stat(ctx, MHL_DST_REG(LINK_MODE),
-                                      MHL_DST_LM_CLK_MODE_NORMAL);
-        }
+        u8 link_mode;
+
+        if (ctx->use_packed_pixel)
+                link_mode = MHL_DST_LM_CLK_MODE_PACKED_PIXEL;
+        else
+                link_mode = MHL_DST_LM_CLK_MODE_NORMAL;
+
+        if (ctx->stat[MHL_DST_LINK_MODE] & MHL_DST_LM_PATH_ENABLED)
+                link_mode |= MHL_DST_LM_PATH_ENABLED;
+
+        sii8620_mt_write_stat(ctx, MHL_DST_REG(LINK_MODE),
+                              link_mode);
 }
 
 static void sii8620_msc_mr_write_stat(struct sii8620 *ctx)
@@ -2242,8 +2268,6 @@ static bool sii8620_mode_fixup(struct drm_bridge *bridge,
         mutex_lock(&ctx->lock);
 
         ctx->use_packed_pixel = sii8620_is_packing_required(ctx, adjusted_mode);
-        ctx->video_code = drm_match_cea_mode(adjusted_mode);
-        ctx->pixel_clock = adjusted_mode->clock;
 
         mutex_unlock(&ctx->lock);
 
diff --git a/drivers/gpu/drm/drm_lease.c b/drivers/gpu/drm/drm_lease.c
index 50c73c0a20b9..d638c0fb3418 100644
--- a/drivers/gpu/drm/drm_lease.c
+++ b/drivers/gpu/drm/drm_lease.c
@@ -553,24 +553,13 @@ int drm_mode_create_lease_ioctl(struct drm_device *dev,
 
         /* Clone the lessor file to create a new file for us */
         DRM_DEBUG_LEASE("Allocating lease file\n");
-        path_get(&lessor_file->f_path);
-        lessee_file = alloc_file(&lessor_file->f_path,
-                                 lessor_file->f_mode,
-                                 fops_get(lessor_file->f_inode->i_fop));
-
+        lessee_file = filp_clone_open(lessor_file);
         if (IS_ERR(lessee_file)) {
                 ret = PTR_ERR(lessee_file);
                 goto out_lessee;
         }
 
-        /* Initialize the new file for DRM */
-        DRM_DEBUG_LEASE("Initializing the file with %p\n", lessee_file->f_op->open);
-        ret = lessee_file->f_op->open(lessee_file->f_inode, lessee_file);
-        if (ret)
-                goto out_lessee_file;
-
         lessee_priv = lessee_file->private_data;
-
         /* Change the file to a master one */
         drm_master_put(&lessee_priv->master);
         lessee_priv->master = lessee;
@@ -588,9 +577,6 @@ int drm_mode_create_lease_ioctl(struct drm_device *dev,
         DRM_DEBUG_LEASE("drm_mode_create_lease_ioctl succeeded\n");
         return 0;
 
-out_lessee_file:
-        fput(lessee_file);
-
 out_lessee:
         drm_master_put(&lessee);
 
diff --git a/drivers/gpu/drm/drm_property.c b/drivers/gpu/drm/drm_property.c
index 1f8031e30f53..cdb10f885a4f 100644
--- a/drivers/gpu/drm/drm_property.c
+++ b/drivers/gpu/drm/drm_property.c
@@ -532,7 +532,7 @@ static void drm_property_free_blob(struct kref *kref)
 
         drm_mode_object_unregister(blob->dev, &blob->base);
 
-        kfree(blob);
+        kvfree(blob);
 }
 
 /**
@@ -559,7 +559,7 @@ drm_property_create_blob(struct drm_device *dev, size_t length,
         if (!length || length > ULONG_MAX - sizeof(struct drm_property_blob))
                 return ERR_PTR(-EINVAL);
 
-        blob = kzalloc(sizeof(struct drm_property_blob)+length, GFP_KERNEL);
+        blob = kvzalloc(sizeof(struct drm_property_blob)+length, GFP_KERNEL);
         if (!blob)
                 return ERR_PTR(-ENOMEM);
 
@@ -576,7 +576,7 @@ drm_property_create_blob(struct drm_device *dev, size_t length,
         ret = __drm_mode_object_add(dev, &blob->base, DRM_MODE_OBJECT_BLOB,
                                     true, drm_property_free_blob);
         if (ret) {
-                kfree(blob);
+                kvfree(blob);
                 return ERR_PTR(-EINVAL);
         }
 
diff --git a/drivers/gpu/drm/etnaviv/etnaviv_drv.c b/drivers/gpu/drm/etnaviv/etnaviv_drv.c
index 207532c05eb8..9b2720b41571 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_drv.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_drv.c
@@ -630,8 +630,11 @@ static struct platform_driver etnaviv_platform_driver = {
         },
 };
 
+static struct platform_device *etnaviv_drm;
+
 static int __init etnaviv_init(void)
 {
+        struct platform_device *pdev;
         int ret;
         struct device_node *np;
 
@@ -643,7 +646,7 @@ static int __init etnaviv_init(void)
 
         ret = platform_driver_register(&etnaviv_platform_driver);
         if (ret != 0)
-                platform_driver_unregister(&etnaviv_gpu_driver);
+                goto unregister_gpu_driver;
 
         /*
          * If the DT contains at least one available GPU device, instantiate
@@ -652,20 +655,33 @@ static int __init etnaviv_init(void)
         for_each_compatible_node(np, NULL, "vivante,gc") {
                 if (!of_device_is_available(np))
                         continue;
-
-                platform_device_register_simple("etnaviv", -1, NULL, 0);
+                pdev = platform_device_register_simple("etnaviv", -1,
+                                                       NULL, 0);
+                if (IS_ERR(pdev)) {
+                        ret = PTR_ERR(pdev);
+                        of_node_put(np);
+                        goto unregister_platform_driver;
+                }
+                etnaviv_drm = pdev;
                 of_node_put(np);
                 break;
         }
 
+        return 0;
+
+unregister_platform_driver:
+        platform_driver_unregister(&etnaviv_platform_driver);
+unregister_gpu_driver:
+        platform_driver_unregister(&etnaviv_gpu_driver);
         return ret;
 }
 module_init(etnaviv_init);
 
 static void __exit etnaviv_exit(void)
 {
-        platform_driver_unregister(&etnaviv_gpu_driver);
+        platform_device_unregister(etnaviv_drm);
         platform_driver_unregister(&etnaviv_platform_driver);
+        platform_driver_unregister(&etnaviv_gpu_driver);
 }
 module_exit(etnaviv_exit);
 
diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gpu.h b/drivers/gpu/drm/etnaviv/etnaviv_gpu.h
index dd430f0f8ff5..90f17ff7888e 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_gpu.h
+++ b/drivers/gpu/drm/etnaviv/etnaviv_gpu.h
@@ -131,6 +131,9 @@ struct etnaviv_gpu {
         struct work_struct sync_point_work;
         int sync_point_event;
 
+        /* hang detection */
+        u32 hangcheck_dma_addr;
+
         void __iomem *mmio;
         int irq;
 
diff --git a/drivers/gpu/drm/etnaviv/etnaviv_sched.c b/drivers/gpu/drm/etnaviv/etnaviv_sched.c
index 590e44b0d963..3949f18afb35 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_sched.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_sched.c
@@ -10,6 +10,7 @@
 #include "etnaviv_gem.h"
 #include "etnaviv_gpu.h"
 #include "etnaviv_sched.h"
+#include "state.xml.h"
 
 static int etnaviv_job_hang_limit = 0;
 module_param_named(job_hang_limit, etnaviv_job_hang_limit, int , 0444);
@@ -85,6 +86,29 @@ static void etnaviv_sched_timedout_job(struct drm_sched_job *sched_job)
 {
         struct etnaviv_gem_submit *submit = to_etnaviv_submit(sched_job);
         struct etnaviv_gpu *gpu = submit->gpu;
+        u32 dma_addr;
+        int change;
+
+        /*
+         * If the GPU managed to complete this jobs fence, the timout is
+         * spurious. Bail out.
+         */
+        if (fence_completed(gpu, submit->out_fence->seqno))
+                return;
+
+        /*
+         * If the GPU is still making forward progress on the front-end (which
+         * should never loop) we shift out the timeout to give it a chance to
+         * finish the job.
+         */
+        dma_addr = gpu_read(gpu, VIVS_FE_DMA_ADDRESS);
+        change = dma_addr - gpu->hangcheck_dma_addr;
+        if (change < 0 || change > 16) {
+                gpu->hangcheck_dma_addr = dma_addr;
+                schedule_delayed_work(&sched_job->work_tdr,
+                                      sched_job->sched->timeout);
+                return;
+        }
 
         /* block scheduler */
         kthread_park(gpu->sched.thread);
diff --git a/drivers/gpu/drm/i915/gvt/cmd_parser.c b/drivers/gpu/drm/i915/gvt/cmd_parser.c
index 0651e63b25fb..45e89b1e0481 100644
--- a/drivers/gpu/drm/i915/gvt/cmd_parser.c
+++ b/drivers/gpu/drm/i915/gvt/cmd_parser.c
@@ -863,6 +863,7 @@ static int cmd_reg_handler(struct parser_exec_state *s,
 {
         struct intel_vgpu *vgpu = s->vgpu;
         struct intel_gvt *gvt = vgpu->gvt;
+        u32 ctx_sr_ctl;
 
         if (offset + 4 > gvt->device_info.mmio_size) {
                 gvt_vgpu_err("%s access to (%x) outside of MMIO range\n",
@@ -895,6 +896,28 @@ static int cmd_reg_handler(struct parser_exec_state *s,
                 patch_value(s, cmd_ptr(s, index), VGT_PVINFO_PAGE);
         }
 
+        /* TODO
+         * Right now only scan LRI command on KBL and in inhibit context.
+         * It's good enough to support initializing mmio by lri command in
+         * vgpu inhibit context on KBL.
+         */
+        if (IS_KABYLAKE(s->vgpu->gvt->dev_priv) &&
+                        intel_gvt_mmio_is_in_ctx(gvt, offset) &&
+                        !strncmp(cmd, "lri", 3)) {
+                intel_gvt_hypervisor_read_gpa(s->vgpu,
+                        s->workload->ring_context_gpa + 12, &ctx_sr_ctl, 4);
+                /* check inhibit context */
+                if (ctx_sr_ctl & 1) {
+                        u32 data = cmd_val(s, index + 1);
+
+                        if (intel_gvt_mmio_has_mode_mask(s->vgpu->gvt, offset))
+                                intel_vgpu_mask_mmio_write(vgpu,
+                                                        offset, &data, 4);
+                        else
+                                vgpu_vreg(vgpu, offset) = data;
+                }
+        }
+
         /* TODO: Update the global mask if this MMIO is a masked-MMIO */
         intel_gvt_mmio_set_cmd_accessed(gvt, offset);
         return 0;
diff --git a/drivers/gpu/drm/i915/gvt/display.c b/drivers/gpu/drm/i915/gvt/display.c
index 6ee50cb328f8..3019dbc39aef 100644
--- a/drivers/gpu/drm/i915/gvt/display.c
+++ b/drivers/gpu/drm/i915/gvt/display.c
@@ -219,7 +219,7 @@ static void emulate_monitor_status_change(struct intel_vgpu *vgpu)
                         ~(TRANS_DDI_BPC_MASK | TRANS_DDI_MODE_SELECT_MASK |
                         TRANS_DDI_PORT_MASK);
                 vgpu_vreg_t(vgpu, TRANS_DDI_FUNC_CTL(TRANSCODER_A)) |=
-                        (TRANS_DDI_BPC_8 | TRANS_DDI_MODE_SELECT_DP_SST |
+                        (TRANS_DDI_BPC_8 | TRANS_DDI_MODE_SELECT_DVI |
                         (PORT_B << TRANS_DDI_PORT_SHIFT) |
                         TRANS_DDI_FUNC_ENABLE);
                 if (IS_BROADWELL(dev_priv)) {
@@ -239,7 +239,7 @@ static void emulate_monitor_status_change(struct intel_vgpu *vgpu)
                         ~(TRANS_DDI_BPC_MASK | TRANS_DDI_MODE_SELECT_MASK |
                         TRANS_DDI_PORT_MASK);
                 vgpu_vreg_t(vgpu, TRANS_DDI_FUNC_CTL(TRANSCODER_A)) |=
-                        (TRANS_DDI_BPC_8 | TRANS_DDI_MODE_SELECT_DP_SST |
+                        (TRANS_DDI_BPC_8 | TRANS_DDI_MODE_SELECT_DVI |
                         (PORT_C << TRANS_DDI_PORT_SHIFT) |
                         TRANS_DDI_FUNC_ENABLE);
                 if (IS_BROADWELL(dev_priv)) {
@@ -259,7 +259,7 @@ static void emulate_monitor_status_change(struct intel_vgpu *vgpu)
                         ~(TRANS_DDI_BPC_MASK | TRANS_DDI_MODE_SELECT_MASK |
                         TRANS_DDI_PORT_MASK);
                 vgpu_vreg_t(vgpu, TRANS_DDI_FUNC_CTL(TRANSCODER_A)) |=
-                        (TRANS_DDI_BPC_8 | TRANS_DDI_MODE_SELECT_DP_SST |
+                        (TRANS_DDI_BPC_8 | TRANS_DDI_MODE_SELECT_DVI |
                         (PORT_D << TRANS_DDI_PORT_SHIFT) |
                         TRANS_DDI_FUNC_ENABLE);
                 if (IS_BROADWELL(dev_priv)) {
diff --git a/drivers/gpu/drm/i915/gvt/gtt.c b/drivers/gpu/drm/i915/gvt/gtt.c
index 39980dfbbebd..00aad8164dec 100644
--- a/drivers/gpu/drm/i915/gvt/gtt.c
+++ b/drivers/gpu/drm/i915/gvt/gtt.c
@@ -1901,6 +1901,7 @@ static struct intel_vgpu_mm *intel_vgpu_create_ggtt_mm(struct intel_vgpu *vgpu)
                 vgpu_free_mm(mm);
                 return ERR_PTR(-ENOMEM);
         }
+        mm->ggtt_mm.last_partial_off = -1UL;
 
         return mm;
 }
@@ -1925,6 +1926,7 @@ void _intel_vgpu_mm_release(struct kref *mm_ref)
                 invalidate_ppgtt_mm(mm);
         } else {
                 vfree(mm->ggtt_mm.virtual_ggtt);
+                mm->ggtt_mm.last_partial_off = -1UL;
         }
 
         vgpu_free_mm(mm);
@@ -2177,6 +2179,62 @@ static int emulate_ggtt_mmio_write(struct intel_vgpu *vgpu, unsigned int off,
         memcpy((void *)&e.val64 + (off & (info->gtt_entry_size - 1)), p_data,
                         bytes);
 
+        /* If ggtt entry size is 8 bytes, and it's split into two 4 bytes
+         * write, we assume the two 4 bytes writes are consecutive.
+         * Otherwise, we abort and report error
+         */
+        if (bytes < info->gtt_entry_size) {
+                if (ggtt_mm->ggtt_mm.last_partial_off == -1UL) {
+                        /* the first partial part*/
+                        ggtt_mm->ggtt_mm.last_partial_off = off;
+                        ggtt_mm->ggtt_mm.last_partial_data = e.val64;
+                        return 0;
+                } else if ((g_gtt_index ==
+                                (ggtt_mm->ggtt_mm.last_partial_off >>
+                                info->gtt_entry_size_shift)) &&
+                        (off != ggtt_mm->ggtt_mm.last_partial_off)) {
+                        /* the second partial part */
+
+                        int last_off = ggtt_mm->ggtt_mm.last_partial_off &
+                                (info->gtt_entry_size - 1);
+
+                        memcpy((void *)&e.val64 + last_off,
+                                (void *)&ggtt_mm->ggtt_mm.last_partial_data +
+                                last_off, bytes);
+
+                        ggtt_mm->ggtt_mm.last_partial_off = -1UL;
+                } else {
+                        int last_offset;
+
+                        gvt_vgpu_err("failed to populate guest ggtt entry: abnormal ggtt entry write sequence, last_partial_off=%lx, offset=%x, bytes=%d, ggtt entry size=%d\n",
+                                        ggtt_mm->ggtt_mm.last_partial_off, off,
+                                        bytes, info->gtt_entry_size);
+
+                        /* set host ggtt entry to scratch page and clear
+                         * virtual ggtt entry as not present for last
+                         * partially write offset
+                         */
+                        last_offset = ggtt_mm->ggtt_mm.last_partial_off &
+                                        (~(info->gtt_entry_size - 1));
+
+                        ggtt_get_host_entry(ggtt_mm, &m, last_offset);
+                        ggtt_invalidate_pte(vgpu, &m);
+                        ops->set_pfn(&m, gvt->gtt.scratch_mfn);
+                        ops->clear_present(&m);
+                        ggtt_set_host_entry(ggtt_mm, &m, last_offset);
+                        ggtt_invalidate(gvt->dev_priv);
+
+                        ggtt_get_guest_entry(ggtt_mm, &e, last_offset);
+                        ops->clear_present(&e);
+                        ggtt_set_guest_entry(ggtt_mm, &e, last_offset);
+
+                        ggtt_mm->ggtt_mm.last_partial_off = off;
+                        ggtt_mm->ggtt_mm.last_partial_data = e.val64;
+
+                        return 0;
+                }
+        }
+
         if (ops->test_present(&e)) {
                 gfn = ops->get_pfn(&e);
                 m = e;
diff --git a/drivers/gpu/drm/i915/gvt/gtt.h b/drivers/gpu/drm/i915/gvt/gtt.h
index b7bf68cc8418..7a9b36176efb 100644
--- a/drivers/gpu/drm/i915/gvt/gtt.h
+++ b/drivers/gpu/drm/i915/gvt/gtt.h
@@ -157,6 +157,8 @@ struct intel_vgpu_mm {
                 } ppgtt_mm;
                 struct {
                         void *virtual_ggtt;
+                        unsigned long last_partial_off;
+                        u64 last_partial_data;
                 } ggtt_mm;
         };
 };
diff --git a/drivers/gpu/drm/i915/gvt/gvt.h b/drivers/gpu/drm/i915/gvt/gvt.h
index de2a3a2580be..9a9671522774 100644
--- a/drivers/gpu/drm/i915/gvt/gvt.h
+++ b/drivers/gpu/drm/i915/gvt/gvt.h
@@ -274,6 +274,8 @@ struct intel_gvt_mmio {
 #define F_CMD_ACCESSED  (1 << 5)
 /* This reg could be accessed by unaligned address */
 #define F_UNALIGN       (1 << 6)
+/* This reg is saved/restored in context */
+#define F_IN_CTX        (1 << 7)
 
         struct gvt_mmio_block *mmio_block;
         unsigned int num_mmio_block;
@@ -655,6 +657,33 @@ static inline bool intel_gvt_mmio_has_mode_mask(
         return gvt->mmio.mmio_attribute[offset >> 2] & F_MODE_MASK;
 }
 
+/**
+ * intel_gvt_mmio_is_in_ctx - check if a MMIO has in-ctx mask
+ * @gvt: a GVT device
+ * @offset: register offset
+ *
+ * Returns:
+ * True if a MMIO has a in-context mask, false if it isn't.
+ *
+ */
+static inline bool intel_gvt_mmio_is_in_ctx(
+                        struct intel_gvt *gvt, unsigned int offset)
+{
+        return gvt->mmio.mmio_attribute[offset >> 2] & F_IN_CTX;
+}
+
+/**
+ * intel_gvt_mmio_set_in_ctx - mask a MMIO in logical context
+ * @gvt: a GVT device
+ * @offset: register offset
+ *
+ */
+static inline void intel_gvt_mmio_set_in_ctx(
+                        struct intel_gvt *gvt, unsigned int offset)
+{
+        gvt->mmio.mmio_attribute[offset >> 2] |= F_IN_CTX;
+}
+
 int intel_gvt_debugfs_add_vgpu(struct intel_vgpu *vgpu);
 void intel_gvt_debugfs_remove_vgpu(struct intel_vgpu *vgpu);
 int intel_gvt_debugfs_init(struct intel_gvt *gvt);
diff --git a/drivers/gpu/drm/i915/gvt/handlers.c b/drivers/gpu/drm/i915/gvt/handlers.c
index 6b50f850dc28..7a58ca555197 100644
--- a/drivers/gpu/drm/i915/gvt/handlers.c
+++ b/drivers/gpu/drm/i915/gvt/handlers.c
@@ -3388,6 +3388,30 @@ int intel_vgpu_default_mmio_write(struct intel_vgpu *vgpu, unsigned int offset,
 }
 
 /**
+ * intel_vgpu_mask_mmio_write - write mask register
+ * @vgpu: a vGPU
+ * @offset: access offset
+ * @p_data: write data buffer
+ * @bytes: access data length
+ *
+ * Returns:
+ * Zero on success, negative error code if failed.
+ */
+int intel_vgpu_mask_mmio_write(struct intel_vgpu *vgpu, unsigned int offset,
+                void *p_data, unsigned int bytes)
+{
+        u32 mask, old_vreg;
+
+        old_vreg = vgpu_vreg(vgpu, offset);
+        write_vreg(vgpu, offset, p_data, bytes);
+        mask = vgpu_vreg(vgpu, offset) >> 16;
+        vgpu_vreg(vgpu, offset) = (old_vreg & ~mask) |
+                                (vgpu_vreg(vgpu, offset) & mask);
+
+        return 0;
+}
+
+/**
  * intel_gvt_in_force_nonpriv_whitelist - if a mmio is in whitelist to be
  * force-nopriv register
  *
diff --git a/drivers/gpu/drm/i915/gvt/mmio.h b/drivers/gpu/drm/i915/gvt/mmio.h
index e474188b46d2..1ffc69eba30e 100644
--- a/drivers/gpu/drm/i915/gvt/mmio.h
+++ b/drivers/gpu/drm/i915/gvt/mmio.h
@@ -99,4 +99,6 @@ bool intel_gvt_in_force_nonpriv_whitelist(struct intel_gvt *gvt,
 int intel_vgpu_mmio_reg_rw(struct intel_vgpu *vgpu, unsigned int offset,
                            void *pdata, unsigned int bytes, bool is_read);
 
+int intel_vgpu_mask_mmio_write(struct intel_vgpu *vgpu, unsigned int offset,
+                                  void *p_data, unsigned int bytes);
 #endif
diff --git a/drivers/gpu/drm/i915/gvt/mmio_context.c b/drivers/gpu/drm/i915/gvt/mmio_context.c
index 20be9a92600f..42e1e6bdcc2c 100644
--- a/drivers/gpu/drm/i915/gvt/mmio_context.c
+++ b/drivers/gpu/drm/i915/gvt/mmio_context.c
@@ -587,7 +587,9 @@ void intel_gvt_init_engine_mmio_context(struct intel_gvt *gvt)
 
         for (mmio = gvt->engine_mmio_list.mmio;
              i915_mmio_reg_valid(mmio->reg); mmio++) {
-                if (mmio->in_context)
+                if (mmio->in_context) {
                         gvt->engine_mmio_list.ctx_mmio_count[mmio->ring_id]++;
+                        intel_gvt_mmio_set_in_ctx(gvt, mmio->reg.reg);
+                }
         }
 }
diff --git a/drivers/gpu/drm/nouveau/dispnv04/disp.c b/drivers/gpu/drm/nouveau/dispnv04/disp.c
index 501d2d290e9c..70dce544984e 100644
--- a/drivers/gpu/drm/nouveau/dispnv04/disp.c
+++ b/drivers/gpu/drm/nouveau/dispnv04/disp.c
@@ -55,6 +55,9 @@ nv04_display_create(struct drm_device *dev)
         nouveau_display(dev)->init = nv04_display_init;
         nouveau_display(dev)->fini = nv04_display_fini;
 
+        /* Pre-nv50 doesn't support atomic, so don't expose the ioctls */
+        dev->driver->driver_features &= ~DRIVER_ATOMIC;
+
         nouveau_hw_save_vga_fonts(dev, 1);
 
         nv04_crtc_create(dev, 0);
diff --git a/drivers/gpu/drm/nouveau/dispnv50/disp.c b/drivers/gpu/drm/nouveau/dispnv50/disp.c
index 0190377b02a6..8412119bd940 100644
--- a/drivers/gpu/drm/nouveau/dispnv50/disp.c
+++ b/drivers/gpu/drm/nouveau/dispnv50/disp.c
@@ -1610,8 +1610,9 @@ nv50_pior_create(struct drm_connector *connector, struct dcb_output *dcbe)
  *****************************************************************************/
 
 static void
-nv50_disp_atomic_commit_core(struct nouveau_drm *drm, u32 *interlock)
+nv50_disp_atomic_commit_core(struct drm_atomic_state *state, u32 *interlock)
 {
+        struct nouveau_drm *drm = nouveau_drm(state->dev);
         struct nv50_disp *disp = nv50_disp(drm->dev);
         struct nv50_core *core = disp->core;
         struct nv50_mstm *mstm;
@@ -1643,6 +1644,22 @@ nv50_disp_atomic_commit_core(struct nouveau_drm *drm, u32 *interlock)
 }
 
 static void
+nv50_disp_atomic_commit_wndw(struct drm_atomic_state *state, u32 *interlock)
+{
+        struct drm_plane_state *new_plane_state;
+        struct drm_plane *plane;
+        int i;
+
+        for_each_new_plane_in_state(state, plane, new_plane_state, i) {
+                struct nv50_wndw *wndw = nv50_wndw(plane);
+                if (interlock[wndw->interlock.type] & wndw->interlock.data) {
+                        if (wndw->func->update)
+                                wndw->func->update(wndw, interlock);
+                }
+        }
+}
+
+static void
 nv50_disp_atomic_commit_tail(struct drm_atomic_state *state)
 {
         struct drm_device *dev = state->dev;
@@ -1709,7 +1726,8 @@ nv50_disp_atomic_commit_tail(struct drm_atomic_state *state)
                         help->disable(encoder);
                         interlock[NV50_DISP_INTERLOCK_CORE] |= 1;
                         if (outp->flush_disable) {
-                                nv50_disp_atomic_commit_core(drm, interlock);
+                                nv50_disp_atomic_commit_wndw(state, interlock);
+                                nv50_disp_atomic_commit_core(state, interlock);
                                 memset(interlock, 0x00, sizeof(interlock));
                         }
                 }
@@ -1718,15 +1736,8 @@ nv50_disp_atomic_commit_tail(struct drm_atomic_state *state)
         /* Flush disable. */
         if (interlock[NV50_DISP_INTERLOCK_CORE]) {
                 if (atom->flush_disable) {
-                        for_each_new_plane_in_state(state, plane, new_plane_state, i) {
-                                struct nv50_wndw *wndw = nv50_wndw(plane);
-                                if (interlock[wndw->interlock.type] & wndw->interlock.data) {
-                                        if (wndw->func->update)
-                                                wndw->func->update(wndw, interlock);
-                                }
-                        }
-
-                        nv50_disp_atomic_commit_core(drm, interlock);
+                        nv50_disp_atomic_commit_wndw(state, interlock);
+                        nv50_disp_atomic_commit_core(state, interlock);
                         memset(interlock, 0x00, sizeof(interlock));
                 }
         }
@@ -1787,18 +1798,14 @@ nv50_disp_atomic_commit_tail(struct drm_atomic_state *state)
         }
 
         /* Flush update. */
-        for_each_new_plane_in_state(state, plane, new_plane_state, i) {
-                struct nv50_wndw *wndw = nv50_wndw(plane);
-                if (interlock[wndw->interlock.type] & wndw->interlock.data) {
-                        if (wndw->func->update)
-                                wndw->func->update(wndw, interlock);
-                }
-        }
+        nv50_disp_atomic_commit_wndw(state, interlock);
 
         if (interlock[NV50_DISP_INTERLOCK_CORE]) {
                 if (interlock[NV50_DISP_INTERLOCK_BASE] ||
+                    interlock[NV50_DISP_INTERLOCK_OVLY] ||
+                    interlock[NV50_DISP_INTERLOCK_WNDW] ||
                     !atom->state.legacy_cursor_update)
-                        nv50_disp_atomic_commit_core(drm, interlock);
+                        nv50_disp_atomic_commit_core(state, interlock);
                 else
                         disp->core->func->update(disp->core, interlock, false);
         }
@@ -1896,7 +1903,7 @@ nv50_disp_atomic_commit(struct drm_device *dev,
                 nv50_disp_atomic_commit_tail(state);
 
         drm_for_each_crtc(crtc, dev) {
-                if (crtc->state->enable) {
+                if (crtc->state->active) {
                         if (!drm->have_disp_power_ref) {
                                 drm->have_disp_power_ref = true;
                                 return 0;
@@ -2144,10 +2151,6 @@ nv50_display_destroy(struct drm_device *dev)
         kfree(disp);
 }
 
-MODULE_PARM_DESC(atomic, "Expose atomic ioctl (default: disabled)");
-static int nouveau_atomic = 0;
-module_param_named(atomic, nouveau_atomic, int, 0400);
-
 int
 nv50_display_create(struct drm_device *dev)
 {
@@ -2172,8 +2175,6 @@ nv50_display_create(struct drm_device *dev)
         disp->disp = &nouveau_display(dev)->disp;
         dev->mode_config.funcs = &nv50_disp_func;
         dev->driver->driver_features |= DRIVER_PREFER_XBGR_30BPP;
-        if (nouveau_atomic)
-                dev->driver->driver_features |= DRIVER_ATOMIC;
 
         /* small shared memory area we use for notifiers and semaphores */
         ret = nouveau_bo_new(&drm->client, 4096, 0x1000, TTM_PL_FLAG_VRAM,
diff --git a/drivers/gpu/drm/nouveau/nouveau_backlight.c b/drivers/gpu/drm/nouveau/nouveau_backlight.c
index debbbf0fd4bd..408b955e5c39 100644
--- a/drivers/gpu/drm/nouveau/nouveau_backlight.c
+++ b/drivers/gpu/drm/nouveau/nouveau_backlight.c
@@ -267,6 +267,7 @@ nouveau_backlight_init(struct drm_device *dev)
         struct nouveau_drm *drm = nouveau_drm(dev);
         struct nvif_device *device = &drm->client.device;
         struct drm_connector *connector;
+        struct drm_connector_list_iter conn_iter;
 
         INIT_LIST_HEAD(&drm->bl_connectors);
 
@@ -275,7 +276,8 @@ nouveau_backlight_init(struct drm_device *dev)
                 return 0;
         }
 
-        list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
+        drm_connector_list_iter_begin(dev, &conn_iter);
+        drm_for_each_connector_iter(connector, &conn_iter) {
                 if (connector->connector_type != DRM_MODE_CONNECTOR_LVDS &&
                     connector->connector_type != DRM_MODE_CONNECTOR_eDP)
                         continue;
@@ -292,7 +294,7 @@ nouveau_backlight_init(struct drm_device *dev)
                         break;
                 }
         }
-
+        drm_connector_list_iter_end(&conn_iter);
 
         return 0;
 }
diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.c b/drivers/gpu/drm/nouveau/nouveau_connector.c
index 22a15478d23d..51932c72334e 100644
--- a/drivers/gpu/drm/nouveau/nouveau_connector.c
+++ b/drivers/gpu/drm/nouveau/nouveau_connector.c
@@ -1193,14 +1193,19 @@ nouveau_connector_create(struct drm_device *dev, int index)
         struct nouveau_display *disp = nouveau_display(dev);
         struct nouveau_connector *nv_connector = NULL;
         struct drm_connector *connector;
+        struct drm_connector_list_iter conn_iter;
         int type, ret = 0;
         bool dummy;
 
-        list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
+        drm_connector_list_iter_begin(dev, &conn_iter);
+        nouveau_for_each_non_mst_connector_iter(connector, &conn_iter) {
                 nv_connector = nouveau_connector(connector);
-                if (nv_connector->index == index)
+                if (nv_connector->index == index) {
+                        drm_connector_list_iter_end(&conn_iter);
                         return connector;
+                }
         }
+        drm_connector_list_iter_end(&conn_iter);
 
         nv_connector = kzalloc(sizeof(*nv_connector), GFP_KERNEL);
         if (!nv_connector)
diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.h b/drivers/gpu/drm/nouveau/nouveau_connector.h
index a4d1a059bd3d..dc7454e7f19a 100644
--- a/drivers/gpu/drm/nouveau/nouveau_connector.h
+++ b/drivers/gpu/drm/nouveau/nouveau_connector.h
@@ -33,6 +33,7 @@
 #include <drm/drm_encoder.h>
 #include <drm/drm_dp_helper.h>
 #include "nouveau_crtc.h"
+#include "nouveau_encoder.h"
 
 struct nvkm_i2c_port;
 
@@ -60,19 +61,46 @@ static inline struct nouveau_connector *nouveau_connector(
         return container_of(con, struct nouveau_connector, base);
 }
 
+static inline bool
+nouveau_connector_is_mst(struct drm_connector *connector)
+{
+        const struct nouveau_encoder *nv_encoder;
+        const struct drm_encoder *encoder;
+
+        if (connector->connector_type != DRM_MODE_CONNECTOR_DisplayPort)
+                return false;
+
+        nv_encoder = find_encoder(connector, DCB_OUTPUT_ANY);
+        if (!nv_encoder)
+                return false;
+
+        encoder = &nv_encoder->base.base;
+        return encoder->encoder_type == DRM_MODE_ENCODER_DPMST;
+}
+
+#define nouveau_for_each_non_mst_connector_iter(connector, iter) \
+        drm_for_each_connector_iter(connector, iter) \
+                for_each_if(!nouveau_connector_is_mst(connector))
+
 static inline struct nouveau_connector *
 nouveau_crtc_connector_get(struct nouveau_crtc *nv_crtc)
 {
         struct drm_device *dev = nv_crtc->base.dev;
         struct drm_connector *connector;
+        struct drm_connector_list_iter conn_iter;
+        struct nouveau_connector *nv_connector = NULL;
         struct drm_crtc *crtc = to_drm_crtc(nv_crtc);
 
-        list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
-                if (connector->encoder && connector->encoder->crtc == crtc)
-                        return nouveau_connector(connector);
+        drm_connector_list_iter_begin(dev, &conn_iter);
+        nouveau_for_each_non_mst_connector_iter(connector, &conn_iter) {
+                if (connector->encoder && connector->encoder->crtc == crtc) {
+                        nv_connector = nouveau_connector(connector);
+                        break;
+                }
         }
+        drm_connector_list_iter_end(&conn_iter);
 
-        return NULL;
+        return nv_connector;
 }
 
 struct drm_connector *
diff --git a/drivers/gpu/drm/nouveau/nouveau_display.c b/drivers/gpu/drm/nouveau/nouveau_display.c
index dfa236370726..139368b31916 100644
--- a/drivers/gpu/drm/nouveau/nouveau_display.c
+++ b/drivers/gpu/drm/nouveau/nouveau_display.c
@@ -404,6 +404,7 @@ nouveau_display_init(struct drm_device *dev)
         struct nouveau_display *disp = nouveau_display(dev);
         struct nouveau_drm *drm = nouveau_drm(dev);
         struct drm_connector *connector;
+        struct drm_connector_list_iter conn_iter;
         int ret;
 
         ret = disp->init(dev);
@@ -411,10 +412,12 @@ nouveau_display_init(struct drm_device *dev)
                 return ret;
 
         /* enable hotplug interrupts */
-        list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
+        drm_connector_list_iter_begin(dev, &conn_iter);
+        nouveau_for_each_non_mst_connector_iter(connector, &conn_iter) {
                 struct nouveau_connector *conn = nouveau_connector(connector);
                 nvif_notify_get(&conn->hpd);
         }
+        drm_connector_list_iter_end(&conn_iter);
 
         /* enable flip completion events */
         nvif_notify_get(&drm->flip);
@@ -427,6 +430,7 @@ nouveau_display_fini(struct drm_device *dev, bool suspend)
         struct nouveau_display *disp = nouveau_display(dev);
         struct nouveau_drm *drm = nouveau_drm(dev);
         struct drm_connector *connector;
+        struct drm_connector_list_iter conn_iter;
 
         if (!suspend) {
                 if (drm_drv_uses_atomic_modeset(dev))
@@ -439,10 +443,12 @@ nouveau_display_fini(struct drm_device *dev, bool suspend)
         nvif_notify_put(&drm->flip);
 
         /* disable hotplug interrupts */
-        list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
+        drm_connector_list_iter_begin(dev, &conn_iter);
+        nouveau_for_each_non_mst_connector_iter(connector, &conn_iter) {
                 struct nouveau_connector *conn = nouveau_connector(connector);
                 nvif_notify_put(&conn->hpd);
         }
+        drm_connector_list_iter_end(&conn_iter);
 
         drm_kms_helper_poll_disable(dev);
         disp->fini(dev);
diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c
index c779ee3c665b..c7ec86d6c3c9 100644
--- a/drivers/gpu/drm/nouveau/nouveau_drm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_drm.c
@@ -81,6 +81,10 @@ MODULE_PARM_DESC(modeset, "enable driver (default: auto, "
 int nouveau_modeset = -1;
 module_param_named(modeset, nouveau_modeset, int, 0400);
 
+MODULE_PARM_DESC(atomic, "Expose atomic ioctl (default: disabled)");
+static int nouveau_atomic = 0;
+module_param_named(atomic, nouveau_atomic, int, 0400);
+
 MODULE_PARM_DESC(runpm, "disable (0), force enable (1), optimus only default (-1)");
 static int nouveau_runtime_pm = -1;
 module_param_named(runpm, nouveau_runtime_pm, int, 0400);
@@ -509,6 +513,9 @@ static int nouveau_drm_probe(struct pci_dev *pdev,
 
         pci_set_master(pdev);
 
+        if (nouveau_atomic)
+                driver_pci.driver_features |= DRIVER_ATOMIC;
+
         ret = drm_get_pci_dev(pdev, pent, &driver_pci);
         if (ret) {
                 nvkm_device_del(&device);
@@ -874,22 +881,11 @@ nouveau_pmops_runtime_resume(struct device *dev)
 static int
 nouveau_pmops_runtime_idle(struct device *dev)
 {
-        struct pci_dev *pdev = to_pci_dev(dev);
-        struct drm_device *drm_dev = pci_get_drvdata(pdev);
-        struct nouveau_drm *drm = nouveau_drm(drm_dev);
-        struct drm_crtc *crtc;
-
         if (!nouveau_pmops_runtime()) {
                 pm_runtime_forbid(dev);
                 return -EBUSY;
         }
 
-        list_for_each_entry(crtc, &drm->dev->mode_config.crtc_list, head) {
-                if (crtc->enabled) {
-                        DRM_DEBUG_DRIVER("failing to power off - crtc active\n");
-                        return -EBUSY;
-                }
-        }
         pm_runtime_mark_last_busy(dev);
         pm_runtime_autosuspend(dev);
         /* we don't want the main rpm_idle to call suspend - we want to autosuspend */
diff --git a/drivers/gpu/drm/nouveau/nouveau_gem.c b/drivers/gpu/drm/nouveau/nouveau_gem.c
index df73bec354e8..b56524d343c3 100644
--- a/drivers/gpu/drm/nouveau/nouveau_gem.c
+++ b/drivers/gpu/drm/nouveau/nouveau_gem.c
@@ -616,7 +616,7 @@ nouveau_gem_pushbuf_reloc_apply(struct nouveau_cli *cli,
                 struct nouveau_bo *nvbo;
                 uint32_t data;
 
-                if (unlikely(r->bo_index > req->nr_buffers)) {
+                if (unlikely(r->bo_index >= req->nr_buffers)) {
                         NV_PRINTK(err, cli, "reloc bo index invalid\n");
                         ret = -EINVAL;
                         break;
@@ -626,7 +626,7 @@ nouveau_gem_pushbuf_reloc_apply(struct nouveau_cli *cli,
                 if (b->presumed.valid)
                         continue;
 
-                if (unlikely(r->reloc_bo_index > req->nr_buffers)) {
+                if (unlikely(r->reloc_bo_index >= req->nr_buffers)) {
                         NV_PRINTK(err, cli, "reloc container bo index invalid\n");
                         ret = -EINVAL;
                         break;
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/fb/base.c b/drivers/gpu/drm/nouveau/nvkm/subdev/fb/base.c
index 73b5d46104bd..434d2fc5bb1c 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/fb/base.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/fb/base.c
@@ -140,6 +140,9 @@ nvkm_fb_init(struct nvkm_subdev *subdev)
         if (fb->func->init)
                 fb->func->init(fb);
 
+        if (fb->func->init_remapper)
+                fb->func->init_remapper(fb);
+
         if (fb->func->init_page) {
                 ret = fb->func->init_page(fb);
                 if (WARN_ON(ret))
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/fb/gp100.c b/drivers/gpu/drm/nouveau/nvkm/subdev/fb/gp100.c
index dffe1f5e1071..8205ce436b3e 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/fb/gp100.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/fb/gp100.c
@@ -37,6 +37,14 @@ gp100_fb_init_unkn(struct nvkm_fb *base)
 }
 
 void
+gp100_fb_init_remapper(struct nvkm_fb *fb)
+{
+        struct nvkm_device *device = fb->subdev.device;
+        /* Disable address remapper. */
+        nvkm_mask(device, 0x100c14, 0x00040000, 0x00000000);
+}
+
+void
 gp100_fb_init(struct nvkm_fb *base)
 {
         struct gf100_fb *fb = gf100_fb(base);
@@ -56,6 +64,7 @@ gp100_fb = {
         .dtor = gf100_fb_dtor,
         .oneinit = gf100_fb_oneinit,
         .init = gp100_fb_init,
+        .init_remapper = gp100_fb_init_remapper,
         .init_page = gm200_fb_init_page,
         .init_unkn = gp100_fb_init_unkn,
         .ram_new = gp100_ram_new,
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/fb/gp102.c b/drivers/gpu/drm/nouveau/nvkm/subdev/fb/gp102.c
index b84b9861ef26..b4d74e815674 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/fb/gp102.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/fb/gp102.c
@@ -31,6 +31,7 @@ gp102_fb = {
         .dtor = gf100_fb_dtor,
         .oneinit = gf100_fb_oneinit,
         .init = gp100_fb_init,
+        .init_remapper = gp100_fb_init_remapper,
         .init_page = gm200_fb_init_page,
         .ram_new = gp100_ram_new,
 };
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/fb/priv.h b/drivers/gpu/drm/nouveau/nvkm/subdev/fb/priv.h
index 2857f31466bf..1e4ad61c19e1 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/fb/priv.h
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/fb/priv.h
@@ -11,6 +11,7 @@ struct nvkm_fb_func {
         u32 (*tags)(struct nvkm_fb *);
         int (*oneinit)(struct nvkm_fb *);
         void (*init)(struct nvkm_fb *);
+        void (*init_remapper)(struct nvkm_fb *);
         int (*init_page)(struct nvkm_fb *);
         void (*init_unkn)(struct nvkm_fb *);
         void (*intr)(struct nvkm_fb *);
@@ -69,5 +70,6 @@ int gf100_fb_init_page(struct nvkm_fb *);
 
 int gm200_fb_init_page(struct nvkm_fb *);
 
+void gp100_fb_init_remapper(struct nvkm_fb *);
 void gp100_fb_init_unkn(struct nvkm_fb *);
 #endif
diff --git a/drivers/gpu/drm/sun4i/Makefile b/drivers/gpu/drm/sun4i/Makefile
index b04ea0f3da75..0eb38ac8e86e 100644
--- a/drivers/gpu/drm/sun4i/Makefile
+++ b/drivers/gpu/drm/sun4i/Makefile
@@ -32,7 +32,10 @@ obj-$(CONFIG_DRM_SUN4I)		+= sun4i-tcon.o
 obj-$(CONFIG_DRM_SUN4I)         += sun4i_tv.o
 obj-$(CONFIG_DRM_SUN4I)         += sun6i_drc.o
 
-obj-$(CONFIG_DRM_SUN4I_BACKEND) += sun4i-backend.o sun4i-frontend.o
+obj-$(CONFIG_DRM_SUN4I_BACKEND) += sun4i-backend.o
+ifdef CONFIG_DRM_SUN4I_BACKEND
+obj-$(CONFIG_DRM_SUN4I)         += sun4i-frontend.o
+endif
 obj-$(CONFIG_DRM_SUN4I_HDMI)    += sun4i-drm-hdmi.o
 obj-$(CONFIG_DRM_SUN6I_DSI)     += sun6i-dsi.o
 obj-$(CONFIG_DRM_SUN8I_DW_HDMI) += sun8i-drm-hdmi.o
diff --git a/drivers/gpu/drm/tegra/drm.c b/drivers/gpu/drm/tegra/drm.c
index 776c1513e582..a2bd5876c633 100644
--- a/drivers/gpu/drm/tegra/drm.c
+++ b/drivers/gpu/drm/tegra/drm.c
@@ -398,7 +398,7 @@ int tegra_drm_submit(struct tegra_drm_context *context,
                  * unaligned offset is malformed and cause commands stream
                  * corruption on the buffer address relocation.
                  */
-                if (offset & 3 || offset >= obj->gem.size) {
+                if (offset & 3 || offset > obj->gem.size) {
                         err = -EINVAL;
                         goto fail;
                 }
diff --git a/drivers/gpu/drm/udl/udl_fb.c b/drivers/gpu/drm/udl/udl_fb.c
index 2ebdc6d5a76e..d5583190f3e4 100644
--- a/drivers/gpu/drm/udl/udl_fb.c
+++ b/drivers/gpu/drm/udl/udl_fb.c
@@ -137,7 +137,10 @@ int udl_handle_damage(struct udl_framebuffer *fb, int x, int y,
 
         if (cmd > (char *) urb->transfer_buffer) {
                 /* Send partial buffer remaining before exiting */
-                int len = cmd - (char *) urb->transfer_buffer;
+                int len;
+                if (cmd < (char *) urb->transfer_buffer + urb->transfer_buffer_length)
+                        *cmd++ = 0xAF;
+                len = cmd - (char *) urb->transfer_buffer;
                 ret = udl_submit_urb(dev, urb, len);
                 bytes_sent += len;
         } else
diff --git a/drivers/gpu/drm/udl/udl_transfer.c b/drivers/gpu/drm/udl/udl_transfer.c
index 0c87b1ac6b68..b992644c17e6 100644
--- a/drivers/gpu/drm/udl/udl_transfer.c
+++ b/drivers/gpu/drm/udl/udl_transfer.c
@@ -153,11 +153,11 @@ static void udl_compress_hline16(
                 raw_pixels_count_byte = cmd++; /*  we'll know this later */
                 raw_pixel_start = pixel;
 
-                cmd_pixel_end = pixel + (min(MAX_CMD_PIXELS + 1,
-                        min((int)(pixel_end - pixel) / bpp,
-                            (int)(cmd_buffer_end - cmd) / 2))) * bpp;
+                cmd_pixel_end = pixel + min3(MAX_CMD_PIXELS + 1UL,
+                                        (unsigned long)(pixel_end - pixel) / bpp,
+                                        (unsigned long)(cmd_buffer_end - 1 - cmd) / 2) * bpp;
 
-                prefetch_range((void *) pixel, (cmd_pixel_end - pixel) * bpp);
+                prefetch_range((void *) pixel, cmd_pixel_end - pixel);
                 pixel_val16 = get_pixel_val16(pixel, bpp);
 
                 while (pixel < cmd_pixel_end) {
@@ -193,6 +193,9 @@ static void udl_compress_hline16(
                 if (pixel > raw_pixel_start) {
                         /* finalize last RAW span */
                         *raw_pixels_count_byte = ((pixel-raw_pixel_start) / bpp) & 0xFF;
+                } else {
+                        /* undo unused byte */
+                        cmd--;
                 }
 
                 *cmd_pixels_count_byte = ((pixel - cmd_pixel_start) / bpp) & 0xFF;
diff --git a/drivers/gpu/host1x/dev.c b/drivers/gpu/host1x/dev.c
index f1d5f76e9c33..d88073e7d22d 100644
--- a/drivers/gpu/host1x/dev.c
+++ b/drivers/gpu/host1x/dev.c
@@ -218,6 +218,9 @@ static int host1x_probe(struct platform_device *pdev)
                 return err;
         }
 
+        if (IS_ENABLED(CONFIG_TEGRA_HOST1X_FIREWALL))
+                goto skip_iommu;
+
         host->group = iommu_group_get(&pdev->dev);
         if (host->group) {
                 struct iommu_domain_geometry *geometry;
diff --git a/drivers/gpu/host1x/job.c b/drivers/gpu/host1x/job.c
index e2f4a4d93d20..527a1cddb14f 100644
--- a/drivers/gpu/host1x/job.c
+++ b/drivers/gpu/host1x/job.c
@@ -569,7 +569,8 @@ void host1x_job_unpin(struct host1x_job *job)
         for (i = 0; i < job->num_unpins; i++) {
                 struct host1x_job_unpin_data *unpin = &job->unpins[i];
 
-                if (!IS_ENABLED(CONFIG_TEGRA_HOST1X_FIREWALL) && host->domain) {
+                if (!IS_ENABLED(CONFIG_TEGRA_HOST1X_FIREWALL) &&
+                    unpin->size && host->domain) {
                         iommu_unmap(host->domain, job->addr_phys[i],
                                     unpin->size);
                         free_iova(&host->iova,
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index f858cc72011d..3942ee61bd1c 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1952,6 +1952,8 @@ static int hid_device_probe(struct device *dev)
         }
         hdev->io_started = false;
 
+        clear_bit(ffs(HID_STAT_REPROBED), &hdev->status);
+
         if (!hdev->driver) {
                 id = hid_match_device(hdev, hdrv);
                 if (id == NULL) {
@@ -2215,7 +2217,8 @@ static int __hid_bus_reprobe_drivers(struct device *dev, void *data)
         struct hid_device *hdev = to_hid_device(dev);
 
         if (hdev->driver == hdrv &&
-            !hdrv->match(hdev, hid_ignore_special_drivers))
+            !hdrv->match(hdev, hid_ignore_special_drivers) &&
+            !test_and_set_bit(ffs(HID_STAT_REPROBED), &hdev->status))
                 return device_reprobe(dev);
 
         return 0;
diff --git a/drivers/hid/hid-debug.c b/drivers/hid/hid-debug.c
index 8469b6964ff6..b48100236df8 100644
--- a/drivers/hid/hid-debug.c
+++ b/drivers/hid/hid-debug.c
@@ -1154,6 +1154,8 @@ copy_rest:
                         goto out;
                 if (list->tail > list->head) {
                         len = list->tail - list->head;
+                        if (len > count)
+                                len = count;
 
                         if (copy_to_user(buffer + ret, &list->hid_debug_buf[list->head], len)) {
                                 ret = -EFAULT;
@@ -1163,6 +1165,8 @@ copy_rest:
                         list->head += len;
                 } else {
                         len = HID_DEBUG_BUFSIZE - list->head;
+                        if (len > count)
+                                len = count;
 
                         if (copy_to_user(buffer, &list->hid_debug_buf[list->head], len)) {
                                 ret = -EFAULT;
@@ -1170,7 +1174,9 @@ copy_rest:
                         }
                         list->head = 0;
                         ret += len;
-                        goto copy_rest;
+                        count -= len;
+                        if (count > 0)
+                                goto copy_rest;
                 }
 
         }
diff --git a/drivers/hid/i2c-hid/i2c-hid.c b/drivers/hid/i2c-hid/i2c-hid.c
index c1652bb7bd15..eae0cb3ddec6 100644
--- a/drivers/hid/i2c-hid/i2c-hid.c
+++ b/drivers/hid/i2c-hid/i2c-hid.c
@@ -484,7 +484,7 @@ static void i2c_hid_get_input(struct i2c_hid *ihid)
                 return;
         }
 
-        if ((ret_size > size) || (ret_size <= 2)) {
+        if ((ret_size > size) || (ret_size < 2)) {
                 dev_err(&ihid->client->dev, "%s: incomplete report (%d/%d)\n",
                         __func__, size, ret_size);
                 return;
diff --git a/drivers/hid/usbhid/hiddev.c b/drivers/hid/usbhid/hiddev.c
index e3ce233f8bdc..23872d08308c 100644
--- a/drivers/hid/usbhid/hiddev.c
+++ b/drivers/hid/usbhid/hiddev.c
@@ -36,6 +36,7 @@
 #include <linux/hiddev.h>
 #include <linux/compat.h>
 #include <linux/vmalloc.h>
+#include <linux/nospec.h>
 #include "usbhid.h"
 
 #ifdef CONFIG_USB_DYNAMIC_MINORS
@@ -469,10 +470,14 @@ static noinline int hiddev_ioctl_usage(struct hiddev *hiddev, unsigned int cmd,
 
                 if (uref->field_index >= report->maxfield)
                         goto inval;
+                uref->field_index = array_index_nospec(uref->field_index,
+                                                       report->maxfield);
 
                 field = report->field[uref->field_index];
                 if (uref->usage_index >= field->maxusage)
                         goto inval;
+                uref->usage_index = array_index_nospec(uref->usage_index,
+                                                       field->maxusage);
 
                 uref->usage_code = field->usage[uref->usage_index].hid;
 
@@ -499,6 +504,8 @@ static noinline int hiddev_ioctl_usage(struct hiddev *hiddev, unsigned int cmd,
 
                         if (uref->field_index >= report->maxfield)
                                 goto inval;
+                        uref->field_index = array_index_nospec(uref->field_index,
+                                                               report->maxfield);
 
                         field = report->field[uref->field_index];
 
@@ -753,6 +760,8 @@ static long hiddev_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 
                 if (finfo.field_index >= report->maxfield)
                         break;
+                finfo.field_index = array_index_nospec(finfo.field_index,
+                                                       report->maxfield);
 
                 field = report->field[finfo.field_index];
                 memset(&finfo, 0, sizeof(finfo));
@@ -797,6 +806,8 @@ static long hiddev_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 
                 if (cinfo.index >= hid->maxcollection)
                         break;
+                cinfo.index = array_index_nospec(cinfo.index,
+                                                 hid->maxcollection);
 
                 cinfo.type = hid->collection[cinfo.index].type;
                 cinfo.usage = hid->collection[cinfo.index].usage;
diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
index 0bb44d0088ed..ad7afa74d365 100644
--- a/drivers/hid/wacom_wac.c
+++ b/drivers/hid/wacom_wac.c
@@ -3365,8 +3365,14 @@ void wacom_setup_device_quirks(struct wacom *wacom)
                         if (features->type >= INTUOSHT && features->type <= BAMBOO_PT)
                                 features->device_type |= WACOM_DEVICETYPE_PAD;
 
-                        features->x_max = 4096;
-                        features->y_max = 4096;
+                        if (features->type == INTUOSHT2) {
+                                features->x_max = features->x_max / 10;
+                                features->y_max = features->y_max / 10;
+                        }
+                        else {
+                                features->x_max = 4096;
+                                features->y_max = 4096;
+                        }
                 }
                 else if (features->pktlen == WACOM_PKGLEN_BBTOUCH) {
                         features->device_type |= WACOM_DEVICETYPE_PAD;
diff --git a/drivers/i2c/busses/i2c-cht-wc.c b/drivers/i2c/busses/i2c-cht-wc.c
index 44cffad43701..c4d176f5ed79 100644
--- a/drivers/i2c/busses/i2c-cht-wc.c
+++ b/drivers/i2c/busses/i2c-cht-wc.c
@@ -234,7 +234,8 @@ static const struct irq_chip cht_wc_i2c_irq_chip = {
         .name                   = "cht_wc_ext_chrg_irq_chip",
 };
 
-static const char * const bq24190_suppliers[] = { "fusb302-typec-source" };
+static const char * const bq24190_suppliers[] = {
+        "tcpm-source-psy-i2c-fusb302" };
 
 static const struct property_entry bq24190_props[] = {
         PROPERTY_ENTRY_STRING_ARRAY("supplied-from", bq24190_suppliers),
diff --git a/drivers/i2c/busses/i2c-davinci.c b/drivers/i2c/busses/i2c-davinci.c
index 75d6ab177055..7379043711df 100644
--- a/drivers/i2c/busses/i2c-davinci.c
+++ b/drivers/i2c/busses/i2c-davinci.c
@@ -237,12 +237,16 @@ static void i2c_davinci_calc_clk_dividers(struct davinci_i2c_dev *dev)
         /*
          * It's not always possible to have 1 to 2 ratio when d=7, so fall back
          * to minimal possible clkh in this case.
+         *
+         * Note:
+         * CLKH is not allowed to be 0, in this case I2C clock is not generated
+         * at all
          */
-        if (clk >= clkl + d) {
+        if (clk > clkl + d) {
                 clkh = clk - clkl - d;
                 clkl -= d;
         } else {
-                clkh = 0;
+                clkh = 1;
                 clkl = clk - (d << 1);
         }
 
diff --git a/drivers/i2c/busses/i2c-imx.c b/drivers/i2c/busses/i2c-imx.c
index 0207e194f84b..498c5e891649 100644
--- a/drivers/i2c/busses/i2c-imx.c
+++ b/drivers/i2c/busses/i2c-imx.c
@@ -368,6 +368,7 @@ static int i2c_imx_dma_xfer(struct imx_i2c_struct *i2c_imx,
                 goto err_desc;
         }
 
+        reinit_completion(&dma->cmd_complete);
         txdesc->callback = i2c_imx_dma_callback;
         txdesc->callback_param = i2c_imx;
         if (dma_submit_error(dmaengine_submit(txdesc))) {
@@ -622,7 +623,6 @@ static int i2c_imx_dma_write(struct imx_i2c_struct *i2c_imx,
          * The first byte must be transmitted by the CPU.
          */
         imx_i2c_write_reg(i2c_8bit_addr_from_msg(msgs), i2c_imx, IMX_I2C_I2DR);
-        reinit_completion(&i2c_imx->dma->cmd_complete);
         time_left = wait_for_completion_timeout(
                                 &i2c_imx->dma->cmd_complete,
                                 msecs_to_jiffies(DMA_TIMEOUT));
@@ -681,7 +681,6 @@ static int i2c_imx_dma_read(struct imx_i2c_struct *i2c_imx,
         if (result)
                 return result;
 
-        reinit_completion(&i2c_imx->dma->cmd_complete);
         time_left = wait_for_completion_timeout(
                                 &i2c_imx->dma->cmd_complete,
                                 msecs_to_jiffies(DMA_TIMEOUT));
@@ -1010,7 +1009,7 @@ static int i2c_imx_init_recovery_info(struct imx_i2c_struct *i2c_imx,
         i2c_imx->pinctrl_pins_gpio = pinctrl_lookup_state(i2c_imx->pinctrl,
                         "gpio");
         rinfo->sda_gpiod = devm_gpiod_get(&pdev->dev, "sda", GPIOD_IN);
-        rinfo->scl_gpiod = devm_gpiod_get(&pdev->dev, "scl", GPIOD_OUT_HIGH);
+        rinfo->scl_gpiod = devm_gpiod_get(&pdev->dev, "scl", GPIOD_OUT_HIGH_OPEN_DRAIN);
 
         if (PTR_ERR(rinfo->sda_gpiod) == -EPROBE_DEFER ||
             PTR_ERR(rinfo->scl_gpiod) == -EPROBE_DEFER) {
diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c
index 5e310efd9446..3c1c817f6968 100644
--- a/drivers/i2c/busses/i2c-rcar.c
+++ b/drivers/i2c/busses/i2c-rcar.c
@@ -32,6 +32,7 @@
 #include <linux/of_device.h>
 #include <linux/platform_device.h>
 #include <linux/pm_runtime.h>
+#include <linux/reset.h>
 #include <linux/slab.h>
 
 /* register offsets */
@@ -111,8 +112,9 @@
 #define ID_ARBLOST      (1 << 3)
 #define ID_NACK         (1 << 4)
 /* persistent flags */
+#define ID_P_NO_RXDMA   (1 << 30) /* HW forbids RXDMA sometimes */
 #define ID_P_PM_BLOCKED (1 << 31)
-#define ID_P_MASK       ID_P_PM_BLOCKED
+#define ID_P_MASK       (ID_P_PM_BLOCKED | ID_P_NO_RXDMA)
 
 enum rcar_i2c_type {
         I2C_RCAR_GEN1,
@@ -141,6 +143,8 @@ struct rcar_i2c_priv {
         struct dma_chan *dma_rx;
         struct scatterlist sg;
         enum dma_data_direction dma_direction;
+
+        struct reset_control *rstc;
 };
 
 #define rcar_i2c_priv_to_dev(p)         ((p)->adap.dev.parent)
@@ -370,6 +374,11 @@ static void rcar_i2c_dma_unmap(struct rcar_i2c_priv *priv)
         dma_unmap_single(chan->device->dev, sg_dma_address(&priv->sg),
                          sg_dma_len(&priv->sg), priv->dma_direction);
 
+        /* Gen3 can only do one RXDMA per transfer and we just completed it */
+        if (priv->devtype == I2C_RCAR_GEN3 &&
+            priv->dma_direction == DMA_FROM_DEVICE)
+                priv->flags |= ID_P_NO_RXDMA;
+
         priv->dma_direction = DMA_NONE;
 }
 
@@ -407,8 +416,9 @@ static void rcar_i2c_dma(struct rcar_i2c_priv *priv)
         unsigned char *buf;
         int len;
 
-        /* Do not use DMA if it's not available or for messages < 8 bytes */
-        if (IS_ERR(chan) || msg->len < 8 || !(msg->flags & I2C_M_DMA_SAFE))
+        /* Do various checks to see if DMA is feasible at all */
+        if (IS_ERR(chan) || msg->len < 8 || !(msg->flags & I2C_M_DMA_SAFE) ||
+            (read && priv->flags & ID_P_NO_RXDMA))
                 return;
 
         if (read) {
@@ -739,6 +749,25 @@ static void rcar_i2c_release_dma(struct rcar_i2c_priv *priv)
         }
 }
 
+/* I2C is a special case, we need to poll the status of a reset */
+static int rcar_i2c_do_reset(struct rcar_i2c_priv *priv)
+{
+        int i, ret;
+
+        ret = reset_control_reset(priv->rstc);
+        if (ret)
+                return ret;
+
+        for (i = 0; i < LOOP_TIMEOUT; i++) {
+                ret = reset_control_status(priv->rstc);
+                if (ret == 0)
+                        return 0;
+                udelay(1);
+        }
+
+        return -ETIMEDOUT;
+}
+
 static int rcar_i2c_master_xfer(struct i2c_adapter *adap,
                                 struct i2c_msg *msgs,
                                 int num)
@@ -750,6 +779,16 @@ static int rcar_i2c_master_xfer(struct i2c_adapter *adap,
 
         pm_runtime_get_sync(dev);
 
+        /* Gen3 needs a reset before allowing RXDMA once */
+        if (priv->devtype == I2C_RCAR_GEN3) {
+                priv->flags |= ID_P_NO_RXDMA;
+                if (!IS_ERR(priv->rstc)) {
+                        ret = rcar_i2c_do_reset(priv);
+                        if (ret == 0)
+                                priv->flags &= ~ID_P_NO_RXDMA;
+                }
+        }
+
         rcar_i2c_init(priv);
 
         ret = rcar_i2c_bus_barrier(priv);
@@ -920,6 +959,15 @@ static int rcar_i2c_probe(struct platform_device *pdev)
         if (ret < 0)
                 goto out_pm_put;
 
+        if (priv->devtype == I2C_RCAR_GEN3) {
+                priv->rstc = devm_reset_control_get_exclusive(&pdev->dev, NULL);
+                if (!IS_ERR(priv->rstc)) {
+                        ret = reset_control_status(priv->rstc);
+                        if (ret < 0)
+                                priv->rstc = ERR_PTR(-ENOTSUPP);
+                }
+        }
+
         /* Stay always active when multi-master to keep arbitration working */
         if (of_property_read_bool(dev->of_node, "multi-master"))
                 priv->flags |= ID_P_PM_BLOCKED;
diff --git a/drivers/i2c/busses/i2c-stu300.c b/drivers/i2c/busses/i2c-stu300.c
index e866c481bfc3..fce52bdab2b7 100644
--- a/drivers/i2c/busses/i2c-stu300.c
+++ b/drivers/i2c/busses/i2c-stu300.c
@@ -127,7 +127,7 @@ enum stu300_error {
 
 /*
  * The number of address send athemps tried before giving up.
- * If the first one failes it seems like 5 to 8 attempts are required.
+ * If the first one fails it seems like 5 to 8 attempts are required.
  */
 #define NUM_ADDR_RESEND_ATTEMPTS 12
 
diff --git a/drivers/i2c/busses/i2c-tegra.c b/drivers/i2c/busses/i2c-tegra.c
index 5fccd1f1bca8..797def5319f1 100644
--- a/drivers/i2c/busses/i2c-tegra.c
+++ b/drivers/i2c/busses/i2c-tegra.c
@@ -545,6 +545,14 @@ static int tegra_i2c_disable_packet_mode(struct tegra_i2c_dev *i2c_dev)
 {
         u32 cnfg;
 
+        /*
+         * NACK interrupt is generated before the I2C controller generates
+         * the STOP condition on the bus. So wait for 2 clock periods
+         * before disabling the controller so that the STOP condition has
+         * been delivered properly.
+         */
+        udelay(DIV_ROUND_UP(2 * 1000000, i2c_dev->bus_clk_rate));
+
         cnfg = i2c_readl(i2c_dev, I2C_CNFG);
         if (cnfg & I2C_CNFG_PACKET_MODE_EN)
                 i2c_writel(i2c_dev, cnfg & ~I2C_CNFG_PACKET_MODE_EN, I2C_CNFG);
@@ -706,15 +714,6 @@ static int tegra_i2c_xfer_msg(struct tegra_i2c_dev *i2c_dev,
         if (likely(i2c_dev->msg_err == I2C_ERR_NONE))
                 return 0;
 
-        /*
-         * NACK interrupt is generated before the I2C controller generates
-         * the STOP condition on the bus. So wait for 2 clock periods
-         * before resetting the controller so that the STOP condition has
-         * been delivered properly.
-         */
-        if (i2c_dev->msg_err == I2C_ERR_NO_ACK)
-                udelay(DIV_ROUND_UP(2 * 1000000, i2c_dev->bus_clk_rate));
-
         tegra_i2c_init(i2c_dev);
         if (i2c_dev->msg_err == I2C_ERR_NO_ACK) {
                 if (msg->flags & I2C_M_IGNORE_NAK)
diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c
index 31d16ada6e7d..301285c54603 100644
--- a/drivers/i2c/i2c-core-base.c
+++ b/drivers/i2c/i2c-core-base.c
@@ -198,7 +198,16 @@ int i2c_generic_scl_recovery(struct i2c_adapter *adap)
 
                 val = !val;
                 bri->set_scl(adap, val);
-                ndelay(RECOVERY_NDELAY);
+
+                /*
+                 * If we can set SDA, we will always create STOP here to ensure
+                 * the additional pulses will do no harm. This is achieved by
+                 * letting SDA follow SCL half a cycle later.
+                 */
+                ndelay(RECOVERY_NDELAY / 2);
+                if (bri->set_sda)
+                        bri->set_sda(adap, val);
+                ndelay(RECOVERY_NDELAY / 2);
         }
 
         /* check if recovery actually succeeded */
diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
index 3e90b6a1d9d2..cc06e8404e9b 100644
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -3488,8 +3488,8 @@ int ib_uverbs_ex_create_flow(struct ib_uverbs_file *file,
         struct ib_flow_attr               *flow_attr;
         struct ib_qp                      *qp;
         struct ib_uflow_resources         *uflow_res;
+        struct ib_uverbs_flow_spec_hdr    *kern_spec;
         int err = 0;
-        void *kern_spec;
         void *ib_spec;
         int i;
 
@@ -3538,8 +3538,8 @@ int ib_uverbs_ex_create_flow(struct ib_uverbs_file *file,
                 if (!kern_flow_attr)
                         return -ENOMEM;
 
-                memcpy(kern_flow_attr, &cmd.flow_attr, sizeof(*kern_flow_attr));
-                err = ib_copy_from_udata(kern_flow_attr + 1, ucore,
+                *kern_flow_attr = cmd.flow_attr;
+                err = ib_copy_from_udata(&kern_flow_attr->flow_specs, ucore,
                                          cmd.flow_attr.size);
                 if (err)
                         goto err_free_attr;
@@ -3559,6 +3559,11 @@ int ib_uverbs_ex_create_flow(struct ib_uverbs_file *file,
                 goto err_uobj;
         }
 
+        if (qp->qp_type != IB_QPT_UD && qp->qp_type != IB_QPT_RAW_PACKET) {
+                err = -EINVAL;
+                goto err_put;
+        }
+
         flow_attr = kzalloc(struct_size(flow_attr, flows,
                                 cmd.flow_attr.num_of_specs), GFP_KERNEL);
         if (!flow_attr) {
@@ -3578,21 +3583,22 @@ int ib_uverbs_ex_create_flow(struct ib_uverbs_file *file,
         flow_attr->flags = kern_flow_attr->flags;
         flow_attr->size = sizeof(*flow_attr);
 
-        kern_spec = kern_flow_attr + 1;
+        kern_spec = kern_flow_attr->flow_specs;
         ib_spec = flow_attr + 1;
         for (i = 0; i < flow_attr->num_of_specs &&
-             cmd.flow_attr.size > offsetof(struct ib_uverbs_flow_spec, reserved) &&
-             cmd.flow_attr.size >=
-             ((struct ib_uverbs_flow_spec *)kern_spec)->size; i++) {
-                err = kern_spec_to_ib_spec(file->ucontext, kern_spec, ib_spec,
-                                           uflow_res);
+                        cmd.flow_attr.size >= sizeof(*kern_spec) &&
+                        cmd.flow_attr.size >= kern_spec->size;
+             i++) {
+                err = kern_spec_to_ib_spec(
+                                file->ucontext, (struct ib_uverbs_flow_spec *)kern_spec,
+                                ib_spec, uflow_res);
                 if (err)
                         goto err_free;
 
                 flow_attr->size +=
                         ((union ib_flow_spec *) ib_spec)->size;
-                cmd.flow_attr.size -= ((struct ib_uverbs_flow_spec *)kern_spec)->size;
-                kern_spec += ((struct ib_uverbs_flow_spec *) kern_spec)->size;
+                cmd.flow_attr.size -= kern_spec->size;
+                kern_spec = ((void *)kern_spec) + kern_spec->size;
                 ib_spec += ((union ib_flow_spec *) ib_spec)->size;
         }
         if (cmd.flow_attr.size || (i != flow_attr->num_of_specs)) {
diff --git a/drivers/infiniband/hw/cxgb4/mem.c b/drivers/infiniband/hw/cxgb4/mem.c
index 1445918e3239..7b76e6f81aeb 100644
--- a/drivers/infiniband/hw/cxgb4/mem.c
+++ b/drivers/infiniband/hw/cxgb4/mem.c
@@ -774,7 +774,7 @@ static int c4iw_set_page(struct ib_mr *ibmr, u64 addr)
 {
         struct c4iw_mr *mhp = to_c4iw_mr(ibmr);
 
-        if (unlikely(mhp->mpl_len == mhp->max_mpl_len))
+        if (unlikely(mhp->mpl_len == mhp->attr.pbl_size))
                 return -ENOMEM;
 
         mhp->mpl[mhp->mpl_len++] = addr;
diff --git a/drivers/infiniband/hw/hfi1/rc.c b/drivers/infiniband/hw/hfi1/rc.c
index 1a1a47ac53c6..f15c93102081 100644
--- a/drivers/infiniband/hw/hfi1/rc.c
+++ b/drivers/infiniband/hw/hfi1/rc.c
@@ -271,7 +271,7 @@ int hfi1_make_rc_req(struct rvt_qp *qp, struct hfi1_pkt_state *ps)
 
         lockdep_assert_held(&qp->s_lock);
         ps->s_txreq = get_txreq(ps->dev, qp);
-        if (IS_ERR(ps->s_txreq))
+        if (!ps->s_txreq)
                 goto bail_no_tx;
 
         if (priv->hdr_type == HFI1_PKT_TYPE_9B) {
diff --git a/drivers/infiniband/hw/hfi1/uc.c b/drivers/infiniband/hw/hfi1/uc.c
index b7b671017e59..e254dcec6f64 100644
--- a/drivers/infiniband/hw/hfi1/uc.c
+++ b/drivers/infiniband/hw/hfi1/uc.c
@@ -1,5 +1,5 @@
 /*
- * Copyright(c) 2015, 2016 Intel Corporation.
+ * Copyright(c) 2015 - 2018 Intel Corporation.
  *
  * This file is provided under a dual BSD/GPLv2 license.  When using or
  * redistributing this file, you may do so under either license.
@@ -72,7 +72,7 @@ int hfi1_make_uc_req(struct rvt_qp *qp, struct hfi1_pkt_state *ps)
         int middle = 0;
 
         ps->s_txreq = get_txreq(ps->dev, qp);
-        if (IS_ERR(ps->s_txreq))
+        if (!ps->s_txreq)
                 goto bail_no_tx;
 
         if (!(ib_rvt_state_ops[qp->state] & RVT_PROCESS_SEND_OK)) {
diff --git a/drivers/infiniband/hw/hfi1/ud.c b/drivers/infiniband/hw/hfi1/ud.c
index 1ab332f1866e..70d39fc450a1 100644
--- a/drivers/infiniband/hw/hfi1/ud.c
+++ b/drivers/infiniband/hw/hfi1/ud.c
@@ -1,5 +1,5 @@
 /*
- * Copyright(c) 2015, 2016 Intel Corporation.
+ * Copyright(c) 2015 - 2018 Intel Corporation.
  *
  * This file is provided under a dual BSD/GPLv2 license.  When using or
  * redistributing this file, you may do so under either license.
@@ -503,7 +503,7 @@ int hfi1_make_ud_req(struct rvt_qp *qp, struct hfi1_pkt_state *ps)
         u32 lid;
 
         ps->s_txreq = get_txreq(ps->dev, qp);
-        if (IS_ERR(ps->s_txreq))
+        if (!ps->s_txreq)
                 goto bail_no_tx;
 
         if (!(ib_rvt_state_ops[qp->state] & RVT_PROCESS_NEXT_SEND_OK)) {
diff --git a/drivers/infiniband/hw/hfi1/verbs_txreq.c b/drivers/infiniband/hw/hfi1/verbs_txreq.c
index 873e48ea923f..c4ab2d5b4502 100644
--- a/drivers/infiniband/hw/hfi1/verbs_txreq.c
+++ b/drivers/infiniband/hw/hfi1/verbs_txreq.c
@@ -1,5 +1,5 @@
 /*
- * Copyright(c) 2016 - 2017 Intel Corporation.
+ * Copyright(c) 2016 - 2018 Intel Corporation.
  *
  * This file is provided under a dual BSD/GPLv2 license.  When using or
  * redistributing this file, you may do so under either license.
@@ -94,7 +94,7 @@ struct verbs_txreq *__get_txreq(struct hfi1_ibdev *dev,
                                 struct rvt_qp *qp)
         __must_hold(&qp->s_lock)
 {
-        struct verbs_txreq *tx = ERR_PTR(-EBUSY);
+        struct verbs_txreq *tx = NULL;
 
         write_seqlock(&dev->txwait_lock);
         if (ib_rvt_state_ops[qp->state] & RVT_PROCESS_RECV_OK) {
diff --git a/drivers/infiniband/hw/hfi1/verbs_txreq.h b/drivers/infiniband/hw/hfi1/verbs_txreq.h
index 729244c3086c..1c19bbc764b2 100644
--- a/drivers/infiniband/hw/hfi1/verbs_txreq.h
+++ b/drivers/infiniband/hw/hfi1/verbs_txreq.h
@@ -1,5 +1,5 @@
 /*
- * Copyright(c) 2016 Intel Corporation.
+ * Copyright(c) 2016 - 2018 Intel Corporation.
  *
  * This file is provided under a dual BSD/GPLv2 license.  When using or
  * redistributing this file, you may do so under either license.
@@ -83,7 +83,7 @@ static inline struct verbs_txreq *get_txreq(struct hfi1_ibdev *dev,
         if (unlikely(!tx)) {
                 /* call slow path to get the lock */
                 tx = __get_txreq(dev, qp);
-                if (IS_ERR(tx))
+                if (!tx)
                         return tx;
         }
         tx->qp = qp;
diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
index e3e330f59c2c..b3ba9a222550 100644
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -6113,7 +6113,7 @@ static void *mlx5_ib_add(struct mlx5_core_dev *mdev)
         dev->num_ports = max(MLX5_CAP_GEN(mdev, num_ports),
                              MLX5_CAP_GEN(mdev, num_vhca_ports));
 
-        if (MLX5_VPORT_MANAGER(mdev) &&
+        if (MLX5_ESWITCH_MANAGER(mdev) &&
             mlx5_ib_eswitch_mode(mdev->priv.eswitch) == SRIOV_OFFLOADS) {
                 dev->rep = mlx5_ib_vport_rep(mdev->priv.eswitch, 0);
 
diff --git a/drivers/infiniband/hw/mlx5/srq.c b/drivers/infiniband/hw/mlx5/srq.c
index 0af7b7905550..f5de5adc9b1a 100644
--- a/drivers/infiniband/hw/mlx5/srq.c
+++ b/drivers/infiniband/hw/mlx5/srq.c
@@ -266,18 +266,24 @@ struct ib_srq *mlx5_ib_create_srq(struct ib_pd *pd,
 
         desc_size = sizeof(struct mlx5_wqe_srq_next_seg) +
                     srq->msrq.max_gs * sizeof(struct mlx5_wqe_data_seg);
-        if (desc_size == 0 || srq->msrq.max_gs > desc_size)
-                return ERR_PTR(-EINVAL);
+        if (desc_size == 0 || srq->msrq.max_gs > desc_size) {
+                err = -EINVAL;
+                goto err_srq;
+        }
         desc_size = roundup_pow_of_two(desc_size);
         desc_size = max_t(size_t, 32, desc_size);
-        if (desc_size < sizeof(struct mlx5_wqe_srq_next_seg))
-                return ERR_PTR(-EINVAL);
+        if (desc_size < sizeof(struct mlx5_wqe_srq_next_seg)) {
+                err = -EINVAL;
+                goto err_srq;
+        }
         srq->msrq.max_avail_gather = (desc_size - sizeof(struct mlx5_wqe_srq_next_seg)) /
                 sizeof(struct mlx5_wqe_data_seg);
         srq->msrq.wqe_shift = ilog2(desc_size);
         buf_size = srq->msrq.max * desc_size;
-        if (buf_size < desc_size)
-                return ERR_PTR(-EINVAL);
+        if (buf_size < desc_size) {
+                err = -EINVAL;
+                goto err_srq;
+        }
         in.type = init_attr->srq_type;
 
         if (pd->uobject)
diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c
index 1f9cd7d8b7ad..f5ae24865355 100644
--- a/drivers/input/mouse/elan_i2c_core.c
+++ b/drivers/input/mouse/elan_i2c_core.c
@@ -1346,6 +1346,8 @@ static const struct acpi_device_id elan_acpi_id[] = {
         { "ELAN0611", 0 },
         { "ELAN0612", 0 },
         { "ELAN0618", 0 },
+        { "ELAN061D", 0 },
+        { "ELAN0622", 0 },
         { "ELAN1000", 0 },
         { }
 };
diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
index b353d494ad40..136f6e7bf797 100644
--- a/drivers/input/serio/i8042-x86ia64io.h
+++ b/drivers/input/serio/i8042-x86ia64io.h
@@ -527,6 +527,13 @@ static const struct dmi_system_id __initconst i8042_dmi_nomux_table[] = {
                         DMI_MATCH(DMI_PRODUCT_NAME, "N24_25BU"),
                 },
         },
+        {
+                /* Lenovo LaVie Z */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                        DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo LaVie Z"),
+                },
+        },
         { }
 };
 
diff --git a/drivers/iommu/Kconfig b/drivers/iommu/Kconfig
index e055d228bfb9..689ffe538370 100644
--- a/drivers/iommu/Kconfig
+++ b/drivers/iommu/Kconfig
@@ -142,7 +142,6 @@ config DMAR_TABLE
 config INTEL_IOMMU
         bool "Support for Intel IOMMU using DMA Remapping Devices"
         depends on PCI_MSI && ACPI && (X86 || IA64_GENERIC)
-        select DMA_DIRECT_OPS
         select IOMMU_API
         select IOMMU_IOVA
         select NEED_DMA_MAP_STATE
diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index 14e4b3722428..115ff26e9ced 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -31,7 +31,6 @@
 #include <linux/pci.h>
 #include <linux/dmar.h>
 #include <linux/dma-mapping.h>
-#include <linux/dma-direct.h>
 #include <linux/mempool.h>
 #include <linux/memory.h>
 #include <linux/cpu.h>
@@ -485,14 +484,37 @@ static int dmar_forcedac;
 static int intel_iommu_strict;
 static int intel_iommu_superpage = 1;
 static int intel_iommu_ecs = 1;
+static int intel_iommu_pasid28;
 static int iommu_identity_mapping;
 
 #define IDENTMAP_ALL            1
 #define IDENTMAP_GFX            2
 #define IDENTMAP_AZALIA         4
 
-#define ecs_enabled(iommu)      (intel_iommu_ecs && ecap_ecs(iommu->ecap))
-#define pasid_enabled(iommu)    (ecs_enabled(iommu) && ecap_pasid(iommu->ecap))
+/* Broadwell and Skylake have broken ECS support — normal so-called "second
+ * level" translation of DMA requests-without-PASID doesn't actually happen
+ * unless you also set the NESTE bit in an extended context-entry. Which of
+ * course means that SVM doesn't work because it's trying to do nested
+ * translation of the physical addresses it finds in the process page tables,
+ * through the IOVA->phys mapping found in the "second level" page tables.
+ *
+ * The VT-d specification was retroactively changed to change the definition
+ * of the capability bits and pretend that Broadwell/Skylake never happened...
+ * but unfortunately the wrong bit was changed. It's ECS which is broken, but
+ * for some reason it was the PASID capability bit which was redefined (from
+ * bit 28 on BDW/SKL to bit 40 in future).
+ *
+ * So our test for ECS needs to eschew those implementations which set the old
+ * PASID capabiity bit 28, since those are the ones on which ECS is broken.
+ * Unless we are working around the 'pasid28' limitations, that is, by putting
+ * the device into passthrough mode for normal DMA and thus masking the bug.
+ */
+#define ecs_enabled(iommu) (intel_iommu_ecs && ecap_ecs(iommu->ecap) && \
+                            (intel_iommu_pasid28 || !ecap_broken_pasid(iommu->ecap)))
+/* PASID support is thus enabled if ECS is enabled and *either* of the old
+ * or new capability bits are set. */
+#define pasid_enabled(iommu) (ecs_enabled(iommu) &&                     \
+                              (ecap_pasid(iommu->ecap) || ecap_broken_pasid(iommu->ecap)))
 
 int intel_iommu_gfx_mapped;
 EXPORT_SYMBOL_GPL(intel_iommu_gfx_mapped);
@@ -555,6 +577,11 @@ static int __init intel_iommu_setup(char *str)
                         printk(KERN_INFO
                                 "Intel-IOMMU: disable extended context table support\n");
                         intel_iommu_ecs = 0;
+                } else if (!strncmp(str, "pasid28", 7)) {
+                        printk(KERN_INFO
+                                "Intel-IOMMU: enable pre-production PASID support\n");
+                        intel_iommu_pasid28 = 1;
+                        iommu_identity_mapping |= IDENTMAP_GFX;
                 } else if (!strncmp(str, "tboot_noforce", 13)) {
                         printk(KERN_INFO
                                 "Intel-IOMMU: not forcing on after tboot. This could expose security risk for tboot\n");
@@ -3713,30 +3740,61 @@ static void *intel_alloc_coherent(struct device *dev, size_t size,
                                   dma_addr_t *dma_handle, gfp_t flags,
                                   unsigned long attrs)
 {
-        void *vaddr;
+        struct page *page = NULL;
+        int order;
 
-        vaddr = dma_direct_alloc(dev, size, dma_handle, flags, attrs);
-        if (iommu_no_mapping(dev) || !vaddr)
-                return vaddr;
+        size = PAGE_ALIGN(size);
+        order = get_order(size);
 
-        *dma_handle = __intel_map_single(dev, virt_to_phys(vaddr),
-                        PAGE_ALIGN(size), DMA_BIDIRECTIONAL,
-                        dev->coherent_dma_mask);
-        if (!*dma_handle)
-                goto out_free_pages;
-        return vaddr;
+        if (!iommu_no_mapping(dev))
+                flags &= ~(GFP_DMA | GFP_DMA32);
+        else if (dev->coherent_dma_mask < dma_get_required_mask(dev)) {
+                if (dev->coherent_dma_mask < DMA_BIT_MASK(32))
+                        flags |= GFP_DMA;
+                else
+                        flags |= GFP_DMA32;
+        }
+
+        if (gfpflags_allow_blocking(flags)) {
+                unsigned int count = size >> PAGE_SHIFT;
+
+                page = dma_alloc_from_contiguous(dev, count, order, flags);
+                if (page && iommu_no_mapping(dev) &&
+                    page_to_phys(page) + size > dev->coherent_dma_mask) {
+                        dma_release_from_contiguous(dev, page, count);
+                        page = NULL;
+                }
+        }
+
+        if (!page)
+                page = alloc_pages(flags, order);
+        if (!page)
+                return NULL;
+        memset(page_address(page), 0, size);
+
+        *dma_handle = __intel_map_single(dev, page_to_phys(page), size,
+                                         DMA_BIDIRECTIONAL,
+                                         dev->coherent_dma_mask);
+        if (*dma_handle)
+                return page_address(page);
+        if (!dma_release_from_contiguous(dev, page, size >> PAGE_SHIFT))
+                __free_pages(page, order);
 
-out_free_pages:
-        dma_direct_free(dev, size, vaddr, *dma_handle, attrs);
         return NULL;
 }
 
 static void intel_free_coherent(struct device *dev, size_t size, void *vaddr,
                                 dma_addr_t dma_handle, unsigned long attrs)
 {
-        if (!iommu_no_mapping(dev))
-                intel_unmap(dev, dma_handle, PAGE_ALIGN(size));
-        dma_direct_free(dev, size, vaddr, dma_handle, attrs);
+        int order;
+        struct page *page = virt_to_page(vaddr);
+
+        size = PAGE_ALIGN(size);
+        order = get_order(size);
+
+        intel_unmap(dev, dma_handle, size);
+        if (!dma_release_from_contiguous(dev, page, size >> PAGE_SHIFT))
+                __free_pages(page, order);
 }
 
 static void intel_unmap_sg(struct device *dev, struct scatterlist *sglist,
diff --git a/drivers/md/dm-writecache.c b/drivers/md/dm-writecache.c
index 07ea6a48aac6..87107c995cb5 100644
--- a/drivers/md/dm-writecache.c
+++ b/drivers/md/dm-writecache.c
@@ -136,6 +136,7 @@ struct dm_writecache {
         struct dm_target *ti;
         struct dm_dev *dev;
         struct dm_dev *ssd_dev;
+        sector_t start_sector;
         void *memory_map;
         uint64_t memory_map_size;
         size_t metadata_sectors;
@@ -293,6 +294,10 @@ static int persistent_memory_claim(struct dm_writecache *wc)
         }
 
         dax_read_unlock(id);
+
+        wc->memory_map += (size_t)wc->start_sector << SECTOR_SHIFT;
+        wc->memory_map_size -= (size_t)wc->start_sector << SECTOR_SHIFT;
+
         return 0;
 err3:
         kvfree(pages);
@@ -311,7 +316,7 @@ static int persistent_memory_claim(struct dm_writecache *wc)
 static void persistent_memory_release(struct dm_writecache *wc)
 {
         if (wc->memory_vmapped)
-                vunmap(wc->memory_map);
+                vunmap(wc->memory_map - ((size_t)wc->start_sector << SECTOR_SHIFT));
 }
 
 static struct page *persistent_memory_page(void *addr)
@@ -359,7 +364,7 @@ static void *memory_data(struct dm_writecache *wc, struct wc_entry *e)
 
 static sector_t cache_sector(struct dm_writecache *wc, struct wc_entry *e)
 {
-        return wc->metadata_sectors +
+        return wc->start_sector + wc->metadata_sectors +
                 ((sector_t)e->index << (wc->block_size_bits - SECTOR_SHIFT));
 }
 
@@ -471,6 +476,7 @@ static void ssd_commit_flushed(struct dm_writecache *wc)
                 if (unlikely(region.sector + region.count > wc->metadata_sectors))
                         region.count = wc->metadata_sectors - region.sector;
 
+                region.sector += wc->start_sector;
                 atomic_inc(&endio.count);
                 req.bi_op = REQ_OP_WRITE;
                 req.bi_op_flags = REQ_SYNC;
@@ -1946,14 +1952,6 @@ static int writecache_ctr(struct dm_target *ti, unsigned argc, char **argv)
         }
         wc->memory_map_size = i_size_read(wc->ssd_dev->bdev->bd_inode);
 
-        if (WC_MODE_PMEM(wc)) {
-                r = persistent_memory_claim(wc);
-                if (r) {
-                        ti->error = "Unable to map persistent memory for cache";
-                        goto bad;
-                }
-        }
-
         /*
          * Parse the cache block size
          */
@@ -1982,7 +1980,16 @@ static int writecache_ctr(struct dm_target *ti, unsigned argc, char **argv)
 
         while (opt_params) {
                 string = dm_shift_arg(&as), opt_params--;
-                if (!strcasecmp(string, "high_watermark") && opt_params >= 1) {
+                if (!strcasecmp(string, "start_sector") && opt_params >= 1) {
+                        unsigned long long start_sector;
+                        string = dm_shift_arg(&as), opt_params--;
+                        if (sscanf(string, "%llu%c", &start_sector, &dummy) != 1)
+                                goto invalid_optional;
+                        wc->start_sector = start_sector;
+                        if (wc->start_sector != start_sector ||
+                            wc->start_sector >= wc->memory_map_size >> SECTOR_SHIFT)
+                                goto invalid_optional;
+                } else if (!strcasecmp(string, "high_watermark") && opt_params >= 1) {
                         string = dm_shift_arg(&as), opt_params--;
                         if (sscanf(string, "%d%c", &high_wm_percent, &dummy) != 1)
                                 goto invalid_optional;
@@ -2039,12 +2046,20 @@ invalid_optional:
                 goto bad;
         }
 
-        if (!WC_MODE_PMEM(wc)) {
+        if (WC_MODE_PMEM(wc)) {
+                r = persistent_memory_claim(wc);
+                if (r) {
+                        ti->error = "Unable to map persistent memory for cache";
+                        goto bad;
+                }
+        } else {
                 struct dm_io_region region;
                 struct dm_io_request req;
                 size_t n_blocks, n_metadata_blocks;
                 uint64_t n_bitmap_bits;
 
+                wc->memory_map_size -= (uint64_t)wc->start_sector << SECTOR_SHIFT;
+
                 bio_list_init(&wc->flush_list);
                 wc->flush_thread = kthread_create(writecache_flush_thread, wc, "dm_writecache_flush");
                 if (IS_ERR(wc->flush_thread)) {
@@ -2097,7 +2112,7 @@ invalid_optional:
                 }
 
                 region.bdev = wc->ssd_dev->bdev;
-                region.sector = 0;
+                region.sector = wc->start_sector;
                 region.count = wc->metadata_sectors;
                 req.bi_op = REQ_OP_READ;
                 req.bi_op_flags = REQ_SYNC;
@@ -2265,7 +2280,7 @@ static void writecache_status(struct dm_target *ti, status_type_t type,
 
 static struct target_type writecache_target = {
         .name                   = "writecache",
-        .version                = {1, 0, 0},
+        .version                = {1, 1, 0},
         .module                 = THIS_MODULE,
         .ctr                    = writecache_ctr,
         .dtr                    = writecache_dtr,
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 29b0cd9ec951..994aed2f9dff 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -5547,7 +5547,8 @@ int md_run(struct mddev *mddev)
                 else
                         pr_warn("md: personality for level %s is not loaded!\n",
                                 mddev->clevel);
-                return -EINVAL;
+                err = -EINVAL;
+                goto abort;
         }
         spin_unlock(&pers_lock);
         if (mddev->level != pers->level) {
@@ -5560,7 +5561,8 @@ int md_run(struct mddev *mddev)
             pers->start_reshape == NULL) {
                 /* This personality cannot handle reshaping... */
                 module_put(pers->owner);
-                return -EINVAL;
+                err = -EINVAL;
+                goto abort;
         }
 
         if (pers->sync_request) {
@@ -5629,7 +5631,7 @@ int md_run(struct mddev *mddev)
                 mddev->private = NULL;
                 module_put(pers->owner);
                 bitmap_destroy(mddev);
-                return err;
+                goto abort;
         }
         if (mddev->queue) {
                 bool nonrot = true;
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 478cf446827f..35bd3a62451b 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -3893,6 +3893,13 @@ static int raid10_run(struct mddev *mddev)
                             disk->rdev->saved_raid_disk < 0)
                                 conf->fullsync = 1;
                 }
+
+                if (disk->replacement &&
+                    !test_bit(In_sync, &disk->replacement->flags) &&
+                    disk->replacement->saved_raid_disk < 0) {
+                        conf->fullsync = 1;
+                }
+
                 disk->recovery_disabled = mddev->recovery_disabled - 1;
         }
 
diff --git a/drivers/media/rc/bpf-lirc.c b/drivers/media/rc/bpf-lirc.c
index 40826bba06b6..fcfab6635f9c 100644
--- a/drivers/media/rc/bpf-lirc.c
+++ b/drivers/media/rc/bpf-lirc.c
@@ -207,29 +207,19 @@ void lirc_bpf_free(struct rc_dev *rcdev)
         bpf_prog_array_free(rcdev->raw->progs);
 }
 
-int lirc_prog_attach(const union bpf_attr *attr)
+int lirc_prog_attach(const union bpf_attr *attr, struct bpf_prog *prog)
 {
-        struct bpf_prog *prog;
         struct rc_dev *rcdev;
         int ret;
 
         if (attr->attach_flags)
                 return -EINVAL;
 
-        prog = bpf_prog_get_type(attr->attach_bpf_fd,
-                                 BPF_PROG_TYPE_LIRC_MODE2);
-        if (IS_ERR(prog))
-                return PTR_ERR(prog);
-
         rcdev = rc_dev_get_from_fd(attr->target_fd);
-        if (IS_ERR(rcdev)) {
-                bpf_prog_put(prog);
+        if (IS_ERR(rcdev))
                 return PTR_ERR(rcdev);
-        }
 
         ret = lirc_bpf_attach(rcdev, prog);
-        if (ret)
-                bpf_prog_put(prog);
 
         put_device(&rcdev->dev);
 
diff --git a/drivers/misc/cxl/api.c b/drivers/misc/cxl/api.c
index 753b1a698fc4..6b16946f9b05 100644
--- a/drivers/misc/cxl/api.c
+++ b/drivers/misc/cxl/api.c
@@ -103,15 +103,15 @@ static struct file *cxl_getfile(const char *name,
         d_instantiate(path.dentry, inode);
 
         file = alloc_file(&path, OPEN_FMODE(flags), fops);
-        if (IS_ERR(file))
-                goto err_dput;
+        if (IS_ERR(file)) {
+                path_put(&path);
+                goto err_fs;
+        }
         file->f_flags = flags & (O_ACCMODE | O_NONBLOCK);
         file->private_data = priv;
 
         return file;
 
-err_dput:
-        path_put(&path);
 err_inode:
         iput(inode);
 err_fs:
diff --git a/drivers/misc/ibmasm/ibmasmfs.c b/drivers/misc/ibmasm/ibmasmfs.c
index e05c3245930a..fa840666bdd1 100644
--- a/drivers/misc/ibmasm/ibmasmfs.c
+++ b/drivers/misc/ibmasm/ibmasmfs.c
@@ -507,35 +507,14 @@ static int remote_settings_file_close(struct inode *inode, struct file *file)
 static ssize_t remote_settings_file_read(struct file *file, char __user *buf, size_t count, loff_t *offset)
 {
         void __iomem *address = (void __iomem *)file->private_data;
-        unsigned char *page;
-        int retval;
         int len = 0;
         unsigned int value;
-
-        if (*offset < 0)
-                return -EINVAL;
-        if (count == 0 || count > 1024)
-                return 0;
-        if (*offset != 0)
-                return 0;
-
-        page = (unsigned char *)__get_free_page(GFP_KERNEL);
-        if (!page)
-                return -ENOMEM;
+        char lbuf[20];
 
         value = readl(address);
-        len = sprintf(page, "%d\n", value);
-
-        if (copy_to_user(buf, page, len)) {
-                retval = -EFAULT;
-                goto exit;
-        }
-        *offset += len;
-        retval = len;
+        len = snprintf(lbuf, sizeof(lbuf), "%d\n", value);
 
-exit:
-        free_page((unsigned long)page);
-        return retval;
+        return simple_read_from_buffer(buf, count, offset, lbuf, len);
 }
 
 static ssize_t remote_settings_file_write(struct file *file, const char __user *ubuff, size_t count, loff_t *offset)
diff --git a/drivers/misc/mei/interrupt.c b/drivers/misc/mei/interrupt.c
index b0b8f18a85e3..6649f0d56d2f 100644
--- a/drivers/misc/mei/interrupt.c
+++ b/drivers/misc/mei/interrupt.c
@@ -310,8 +310,11 @@ int mei_irq_read_handler(struct mei_device *dev,
         if (&cl->link == &dev->file_list) {
                 /* A message for not connected fixed address clients
                  * should be silently discarded
+                 * On power down client may be force cleaned,
+                 * silently discard such messages
                  */
-                if (hdr_is_fixed(mei_hdr)) {
+                if (hdr_is_fixed(mei_hdr) ||
+                    dev->dev_state == MEI_DEV_POWER_DOWN) {
                         mei_irq_discard_msg(dev, mei_hdr);
                         ret = 0;
                         goto reset_slots;
diff --git a/drivers/misc/vmw_balloon.c b/drivers/misc/vmw_balloon.c
index efd733472a35..56c6f79a5c5a 100644
--- a/drivers/misc/vmw_balloon.c
+++ b/drivers/misc/vmw_balloon.c
@@ -467,7 +467,7 @@ static int vmballoon_send_batched_lock(struct vmballoon *b,
                 unsigned int num_pages, bool is_2m_pages, unsigned int *target)
 {
         unsigned long status;
-        unsigned long pfn = page_to_pfn(b->page);
+        unsigned long pfn = PHYS_PFN(virt_to_phys(b->batch_page));
 
         STATS_INC(b->stats.lock[is_2m_pages]);
 
@@ -515,7 +515,7 @@ static bool vmballoon_send_batched_unlock(struct vmballoon *b,
                 unsigned int num_pages, bool is_2m_pages, unsigned int *target)
 {
         unsigned long status;
-        unsigned long pfn = page_to_pfn(b->page);
+        unsigned long pfn = PHYS_PFN(virt_to_phys(b->batch_page));
 
         STATS_INC(b->stats.unlock[is_2m_pages]);
 
diff --git a/drivers/mmc/core/slot-gpio.c b/drivers/mmc/core/slot-gpio.c
index ef05e0039378..2a833686784b 100644
--- a/drivers/mmc/core/slot-gpio.c
+++ b/drivers/mmc/core/slot-gpio.c
@@ -27,8 +27,8 @@ struct mmc_gpio {
         bool override_cd_active_level;
         irqreturn_t (*cd_gpio_isr)(int irq, void *dev_id);
         char *ro_label;
-        char cd_label[0];
         u32 cd_debounce_delay_ms;
+        char cd_label[];
 };
 
 static irqreturn_t mmc_gpio_cd_irqt(int irq, void *dev_id)
diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c
index 623f4d27fa01..80dc2fd6576c 100644
--- a/drivers/mmc/host/dw_mmc.c
+++ b/drivers/mmc/host/dw_mmc.c
@@ -1065,8 +1065,8 @@ static void dw_mci_ctrl_thld(struct dw_mci *host, struct mmc_data *data)
          * It's used when HS400 mode is enabled.
          */
         if (data->flags & MMC_DATA_WRITE &&
-                !(host->timing != MMC_TIMING_MMC_HS400))
-                return;
+                host->timing != MMC_TIMING_MMC_HS400)
+                goto disable;
 
         if (data->flags & MMC_DATA_WRITE)
                 enable = SDMMC_CARD_WR_THR_EN;
@@ -1074,7 +1074,8 @@ static void dw_mci_ctrl_thld(struct dw_mci *host, struct mmc_data *data)
                 enable = SDMMC_CARD_RD_THR_EN;
 
         if (host->timing != MMC_TIMING_MMC_HS200 &&
-            host->timing != MMC_TIMING_UHS_SDR104)
+            host->timing != MMC_TIMING_UHS_SDR104 &&
+            host->timing != MMC_TIMING_MMC_HS400)
                 goto disable;
 
         blksz_depth = blksz / (1 << host->data_shift);
diff --git a/drivers/mmc/host/renesas_sdhi_internal_dmac.c b/drivers/mmc/host/renesas_sdhi_internal_dmac.c
index f7f9773d161f..d032bd63444d 100644
--- a/drivers/mmc/host/renesas_sdhi_internal_dmac.c
+++ b/drivers/mmc/host/renesas_sdhi_internal_dmac.c
@@ -139,8 +139,7 @@ renesas_sdhi_internal_dmac_abort_dma(struct tmio_mmc_host *host) {
         renesas_sdhi_internal_dmac_dm_write(host, DM_CM_RST,
                                             RST_RESERVED_BITS | val);
 
-        if (host->data && host->data->flags & MMC_DATA_READ)
-                clear_bit(SDHI_INTERNAL_DMAC_RX_IN_USE, &global_flags);
+        clear_bit(SDHI_INTERNAL_DMAC_RX_IN_USE, &global_flags);
 
         renesas_sdhi_internal_dmac_enable_dma(host, true);
 }
@@ -164,17 +163,14 @@ renesas_sdhi_internal_dmac_start_dma(struct tmio_mmc_host *host,
                 goto force_pio;
 
         /* This DMAC cannot handle if buffer is not 8-bytes alignment */
-        if (!IS_ALIGNED(sg_dma_address(sg), 8)) {
-                dma_unmap_sg(&host->pdev->dev, sg, host->sg_len,
-                             mmc_get_dma_dir(data));
-                goto force_pio;
-        }
+        if (!IS_ALIGNED(sg_dma_address(sg), 8))
+                goto force_pio_with_unmap;
 
         if (data->flags & MMC_DATA_READ) {
                 dtran_mode |= DTRAN_MODE_CH_NUM_CH1;
                 if (test_bit(SDHI_INTERNAL_DMAC_ONE_RX_ONLY, &global_flags) &&
                     test_and_set_bit(SDHI_INTERNAL_DMAC_RX_IN_USE, &global_flags))
-                        goto force_pio;
+                        goto force_pio_with_unmap;
         } else {
                 dtran_mode |= DTRAN_MODE_CH_NUM_CH0;
         }
@@ -189,6 +185,9 @@ renesas_sdhi_internal_dmac_start_dma(struct tmio_mmc_host *host,
 
         return;
 
+force_pio_with_unmap:
+        dma_unmap_sg(&host->pdev->dev, sg, host->sg_len, mmc_get_dma_dir(data));
+
 force_pio:
         host->force_pio = true;
         renesas_sdhi_internal_dmac_enable_dma(host, false);
diff --git a/drivers/mmc/host/sdhci-esdhc-imx.c b/drivers/mmc/host/sdhci-esdhc-imx.c
index d6aef70d34fa..4eb3d29ecde1 100644
--- a/drivers/mmc/host/sdhci-esdhc-imx.c
+++ b/drivers/mmc/host/sdhci-esdhc-imx.c
@@ -312,6 +312,15 @@ static u32 esdhc_readl_le(struct sdhci_host *host, int reg)
 
                         if (imx_data->socdata->flags & ESDHC_FLAG_HS400)
                                 val |= SDHCI_SUPPORT_HS400;
+
+                        /*
+                         * Do not advertise faster UHS modes if there are no
+                         * pinctrl states for 100MHz/200MHz.
+                         */
+                        if (IS_ERR_OR_NULL(imx_data->pins_100mhz) ||
+                            IS_ERR_OR_NULL(imx_data->pins_200mhz))
+                                val &= ~(SDHCI_SUPPORT_SDR50 | SDHCI_SUPPORT_DDR50
+                                         | SDHCI_SUPPORT_SDR104 | SDHCI_SUPPORT_HS400);
                 }
         }
 
@@ -1158,18 +1167,6 @@ sdhci_esdhc_imx_probe_dt(struct platform_device *pdev,
                                                 ESDHC_PINCTRL_STATE_100MHZ);
                 imx_data->pins_200mhz = pinctrl_lookup_state(imx_data->pinctrl,
                                                 ESDHC_PINCTRL_STATE_200MHZ);
-                if (IS_ERR(imx_data->pins_100mhz) ||
-                                IS_ERR(imx_data->pins_200mhz)) {
-                        dev_warn(mmc_dev(host->mmc),
-                                "could not get ultra high speed state, work on normal mode\n");
-                        /*
-                         * fall back to not supporting uhs by specifying no
-                         * 1.8v quirk
-                         */
-                        host->quirks2 |= SDHCI_QUIRK2_NO_1_8_V;
-                }
-        } else {
-                host->quirks2 |= SDHCI_QUIRK2_NO_1_8_V;
         }
 
         /* call to generic mmc_of_parse to support additional capabilities */
diff --git a/drivers/mmc/host/sunxi-mmc.c b/drivers/mmc/host/sunxi-mmc.c
index e7472590f2ed..8e7f3e35ee3d 100644
--- a/drivers/mmc/host/sunxi-mmc.c
+++ b/drivers/mmc/host/sunxi-mmc.c
@@ -1446,6 +1446,7 @@ static int sunxi_mmc_runtime_resume(struct device *dev)
         sunxi_mmc_init_host(host);
         sunxi_mmc_set_bus_width(host, mmc->ios.bus_width);
         sunxi_mmc_set_clk(host, &mmc->ios);
+        enable_irq(host->irq);
 
         return 0;
 }
@@ -1455,6 +1456,12 @@ static int sunxi_mmc_runtime_suspend(struct device *dev)
         struct mmc_host *mmc = dev_get_drvdata(dev);
         struct sunxi_mmc_host *host = mmc_priv(mmc);
 
+        /*
+         * When clocks are off, it's possible receiving
+         * fake interrupts, which will stall the system.
+         * Disabling the irq  will prevent this.
+         */
+        disable_irq(host->irq);
         sunxi_mmc_reset_host(host);
         sunxi_mmc_disable(host);
 
diff --git a/drivers/mtd/spi-nor/cadence-quadspi.c b/drivers/mtd/spi-nor/cadence-quadspi.c
index c3f7aaa5d18f..d7e10b36a0b9 100644
--- a/drivers/mtd/spi-nor/cadence-quadspi.c
+++ b/drivers/mtd/spi-nor/cadence-quadspi.c
@@ -926,10 +926,12 @@ static ssize_t cqspi_write(struct spi_nor *nor, loff_t to,
         if (ret)
                 return ret;
 
-        if (f_pdata->use_direct_mode)
+        if (f_pdata->use_direct_mode) {
                 memcpy_toio(cqspi->ahb_base + to, buf, len);
-        else
+                ret = cqspi_wait_idle(cqspi);
+        } else {
                 ret = cqspi_indirect_write_execute(nor, to, buf, len);
+        }
         if (ret)
                 return ret;
 
diff --git a/drivers/net/bonding/bond_options.c b/drivers/net/bonding/bond_options.c
index 98663c50ded0..4d5d01cb8141 100644
--- a/drivers/net/bonding/bond_options.c
+++ b/drivers/net/bonding/bond_options.c
@@ -743,15 +743,20 @@ const struct bond_option *bond_opt_get(unsigned int option)
 static int bond_option_mode_set(struct bonding *bond,
                                 const struct bond_opt_value *newval)
 {
-        if (!bond_mode_uses_arp(newval->value) && bond->params.arp_interval) {
-                netdev_dbg(bond->dev, "%s mode is incompatible with arp monitoring, start mii monitoring\n",
-                           newval->string);
-                /* disable arp monitoring */
-                bond->params.arp_interval = 0;
-                /* set miimon to default value */
-                bond->params.miimon = BOND_DEFAULT_MIIMON;
-                netdev_dbg(bond->dev, "Setting MII monitoring interval to %d\n",
-                           bond->params.miimon);
+        if (!bond_mode_uses_arp(newval->value)) {
+                if (bond->params.arp_interval) {
+                        netdev_dbg(bond->dev, "%s mode is incompatible with arp monitoring, start mii monitoring\n",
+                                   newval->string);
+                        /* disable arp monitoring */
+                        bond->params.arp_interval = 0;
+                }
+
+                if (!bond->params.miimon) {
+                        /* set miimon to default value */
+                        bond->params.miimon = BOND_DEFAULT_MIIMON;
+                        netdev_dbg(bond->dev, "Setting MII monitoring interval to %d\n",
+                                   bond->params.miimon);
+                }
         }
 
         if (newval->value == BOND_MODE_ALB)
diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c
index b397a33f3d32..9b449400376b 100644
--- a/drivers/net/can/m_can/m_can.c
+++ b/drivers/net/can/m_can/m_can.c
@@ -634,10 +634,12 @@ static int m_can_clk_start(struct m_can_priv *priv)
         int err;
 
         err = pm_runtime_get_sync(priv->device);
-        if (err)
+        if (err < 0) {
                 pm_runtime_put_noidle(priv->device);
+                return err;
+        }
 
-        return err;
+        return 0;
 }
 
 static void m_can_clk_stop(struct m_can_priv *priv)
@@ -1109,7 +1111,8 @@ static void m_can_chip_config(struct net_device *dev)
 
         } else {
         /* Version 3.1.x or 3.2.x */
-                cccr &= ~(CCCR_TEST | CCCR_MON | CCCR_BRSE | CCCR_FDOE);
+                cccr &= ~(CCCR_TEST | CCCR_MON | CCCR_BRSE | CCCR_FDOE |
+                          CCCR_NISO);
 
                 /* Only 3.2.x has NISO Bit implemented */
                 if (priv->can.ctrlmode & CAN_CTRLMODE_FD_NON_ISO)
@@ -1642,8 +1645,6 @@ static int m_can_plat_probe(struct platform_device *pdev)
         priv->can.clock.freq = clk_get_rate(cclk);
         priv->mram_base = mram_addr;
 
-        m_can_of_parse_mram(priv, mram_config_vals);
-
         platform_set_drvdata(pdev, dev);
         SET_NETDEV_DEV(dev, &pdev->dev);
 
@@ -1666,6 +1667,8 @@ static int m_can_plat_probe(struct platform_device *pdev)
                 goto clk_disable;
         }
 
+        m_can_of_parse_mram(priv, mram_config_vals);
+
         devm_can_led_init(dev);
 
         of_can_transceiver(dev);
@@ -1687,8 +1690,6 @@ failed_ret:
         return ret;
 }
 
-/* TODO: runtime PM with power down or sleep mode  */
-
 static __maybe_unused int m_can_suspend(struct device *dev)
 {
         struct net_device *ndev = dev_get_drvdata(dev);
@@ -1715,8 +1716,6 @@ static __maybe_unused int m_can_resume(struct device *dev)
 
         pinctrl_pm_select_default_state(dev);
 
-        m_can_init_ram(priv);
-
         priv->can.state = CAN_STATE_ERROR_ACTIVE;
 
         if (netif_running(ndev)) {
@@ -1726,6 +1725,7 @@ static __maybe_unused int m_can_resume(struct device *dev)
                 if (ret)
                         return ret;
 
+                m_can_init_ram(priv);
                 m_can_start(ndev);
                 netif_device_attach(ndev);
                 netif_start_queue(ndev);
diff --git a/drivers/net/can/mscan/mpc5xxx_can.c b/drivers/net/can/mscan/mpc5xxx_can.c
index c7427bdd3a4b..2949a381a94d 100644
--- a/drivers/net/can/mscan/mpc5xxx_can.c
+++ b/drivers/net/can/mscan/mpc5xxx_can.c
@@ -86,6 +86,11 @@ static u32 mpc52xx_can_get_clock(struct platform_device *ofdev,
                 return 0;
         }
         cdm = of_iomap(np_cdm, 0);
+        if (!cdm) {
+                of_node_put(np_cdm);
+                dev_err(&ofdev->dev, "can't map clock node!\n");
+                return 0;
+        }
 
         if (in_8(&cdm->ipb_clk_sel) & 0x1)
                 freq *= 2;
diff --git a/drivers/net/can/peak_canfd/peak_pciefd_main.c b/drivers/net/can/peak_canfd/peak_pciefd_main.c
index b9e28578bc7b..455a3797a200 100644
--- a/drivers/net/can/peak_canfd/peak_pciefd_main.c
+++ b/drivers/net/can/peak_canfd/peak_pciefd_main.c
@@ -58,6 +58,10 @@ MODULE_LICENSE("GPL v2");
 #define PCIEFD_REG_SYS_VER1             0x0040  /* version reg #1 */
 #define PCIEFD_REG_SYS_VER2             0x0044  /* version reg #2 */
 
+#define PCIEFD_FW_VERSION(x, y, z)      (((u32)(x) << 24) | \
+                                         ((u32)(y) << 16) | \
+                                         ((u32)(z) << 8))
+
 /* System Control Registers Bits */
 #define PCIEFD_SYS_CTL_TS_RST           0x00000001      /* timestamp clock */
 #define PCIEFD_SYS_CTL_CLK_EN           0x00000002      /* system clock */
@@ -782,6 +786,21 @@ static int peak_pciefd_probe(struct pci_dev *pdev,
                  "%ux CAN-FD PCAN-PCIe FPGA v%u.%u.%u:\n", can_count,
                  hw_ver_major, hw_ver_minor, hw_ver_sub);
 
+#ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT
+        /* FW < v3.3.0 DMA logic doesn't handle correctly the mix of 32-bit and
+         * 64-bit logical addresses: this workaround forces usage of 32-bit
+         * DMA addresses only when such a fw is detected.
+         */
+        if (PCIEFD_FW_VERSION(hw_ver_major, hw_ver_minor, hw_ver_sub) <
+            PCIEFD_FW_VERSION(3, 3, 0)) {
+                err = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32));
+                if (err)
+                        dev_warn(&pdev->dev,
+                                 "warning: can't set DMA mask %llxh (err %d)\n",
+                                 DMA_BIT_MASK(32), err);
+        }
+#endif
+
         /* stop system clock */
         pciefd_sys_writereg(pciefd, PCIEFD_SYS_CTL_CLK_EN,
                             PCIEFD_REG_SYS_CTL_CLR);
diff --git a/drivers/net/can/xilinx_can.c b/drivers/net/can/xilinx_can.c
index 89aec07c225f..5a24039733ef 100644
--- a/drivers/net/can/xilinx_can.c
+++ b/drivers/net/can/xilinx_can.c
@@ -2,6 +2,7 @@
  *
  * Copyright (C) 2012 - 2014 Xilinx, Inc.
  * Copyright (C) 2009 PetaLogix. All rights reserved.
+ * Copyright (C) 2017 Sandvik Mining and Construction Oy
  *
  * Description:
  * This driver is developed for Axi CAN IP and for Zynq CANPS Controller.
@@ -25,8 +26,10 @@
 #include <linux/module.h>
 #include <linux/netdevice.h>
 #include <linux/of.h>
+#include <linux/of_device.h>
 #include <linux/platform_device.h>
 #include <linux/skbuff.h>
+#include <linux/spinlock.h>
 #include <linux/string.h>
 #include <linux/types.h>
 #include <linux/can/dev.h>
@@ -101,7 +104,7 @@ enum xcan_reg {
 #define XCAN_INTR_ALL           (XCAN_IXR_TXOK_MASK | XCAN_IXR_BSOFF_MASK |\
                                  XCAN_IXR_WKUP_MASK | XCAN_IXR_SLP_MASK | \
                                  XCAN_IXR_RXNEMP_MASK | XCAN_IXR_ERROR_MASK | \
-                                 XCAN_IXR_ARBLST_MASK | XCAN_IXR_RXOK_MASK)
+                                 XCAN_IXR_RXOFLW_MASK | XCAN_IXR_ARBLST_MASK)
 
 /* CAN register bit shift - XCAN_<REG>_<BIT>_SHIFT */
 #define XCAN_BTR_SJW_SHIFT              7  /* Synchronous jump width */
@@ -118,6 +121,7 @@ enum xcan_reg {
 /**
  * struct xcan_priv - This definition define CAN driver instance
  * @can:                        CAN private data structure.
+ * @tx_lock:                    Lock for synchronizing TX interrupt handling
  * @tx_head:                    Tx CAN packets ready to send on the queue
  * @tx_tail:                    Tx CAN packets successfully sended on the queue
  * @tx_max:                     Maximum number packets the driver can send
@@ -132,6 +136,7 @@ enum xcan_reg {
  */
 struct xcan_priv {
         struct can_priv can;
+        spinlock_t tx_lock;
         unsigned int tx_head;
         unsigned int tx_tail;
         unsigned int tx_max;
@@ -159,6 +164,11 @@ static const struct can_bittiming_const xcan_bittiming_const = {
         .brp_inc = 1,
 };
 
+#define XCAN_CAP_WATERMARK      0x0001
+struct xcan_devtype_data {
+        unsigned int caps;
+};
+
 /**
  * xcan_write_reg_le - Write a value to the device register little endian
  * @priv:       Driver private data structure
@@ -238,6 +248,10 @@ static int set_reset_mode(struct net_device *ndev)
                 usleep_range(500, 10000);
         }
 
+        /* reset clears FIFOs */
+        priv->tx_head = 0;
+        priv->tx_tail = 0;
+
         return 0;
 }
 
@@ -392,6 +406,7 @@ static int xcan_start_xmit(struct sk_buff *skb, struct net_device *ndev)
         struct net_device_stats *stats = &ndev->stats;
         struct can_frame *cf = (struct can_frame *)skb->data;
         u32 id, dlc, data[2] = {0, 0};
+        unsigned long flags;
 
         if (can_dropped_invalid_skb(ndev, skb))
                 return NETDEV_TX_OK;
@@ -439,6 +454,9 @@ static int xcan_start_xmit(struct sk_buff *skb, struct net_device *ndev)
                 data[1] = be32_to_cpup((__be32 *)(cf->data + 4));
 
         can_put_echo_skb(skb, ndev, priv->tx_head % priv->tx_max);
+
+        spin_lock_irqsave(&priv->tx_lock, flags);
+
         priv->tx_head++;
 
         /* Write the Frame to Xilinx CAN TX FIFO */
@@ -454,10 +472,16 @@ static int xcan_start_xmit(struct sk_buff *skb, struct net_device *ndev)
                 stats->tx_bytes += cf->can_dlc;
         }
 
+        /* Clear TX-FIFO-empty interrupt for xcan_tx_interrupt() */
+        if (priv->tx_max > 1)
+                priv->write_reg(priv, XCAN_ICR_OFFSET, XCAN_IXR_TXFEMP_MASK);
+
         /* Check if the TX buffer is full */
         if ((priv->tx_head - priv->tx_tail) == priv->tx_max)
                 netif_stop_queue(ndev);
 
+        spin_unlock_irqrestore(&priv->tx_lock, flags);
+
         return NETDEV_TX_OK;
 }
 
@@ -530,6 +554,123 @@ static int xcan_rx(struct net_device *ndev)
 }
 
 /**
+ * xcan_current_error_state - Get current error state from HW
+ * @ndev:       Pointer to net_device structure
+ *
+ * Checks the current CAN error state from the HW. Note that this
+ * only checks for ERROR_PASSIVE and ERROR_WARNING.
+ *
+ * Return:
+ * ERROR_PASSIVE or ERROR_WARNING if either is active, ERROR_ACTIVE
+ * otherwise.
+ */
+static enum can_state xcan_current_error_state(struct net_device *ndev)
+{
+        struct xcan_priv *priv = netdev_priv(ndev);
+        u32 status = priv->read_reg(priv, XCAN_SR_OFFSET);
+
+        if ((status & XCAN_SR_ESTAT_MASK) == XCAN_SR_ESTAT_MASK)
+                return CAN_STATE_ERROR_PASSIVE;
+        else if (status & XCAN_SR_ERRWRN_MASK)
+                return CAN_STATE_ERROR_WARNING;
+        else
+                return CAN_STATE_ERROR_ACTIVE;
+}
+
+/**
+ * xcan_set_error_state - Set new CAN error state
+ * @ndev:       Pointer to net_device structure
+ * @new_state:  The new CAN state to be set
+ * @cf:         Error frame to be populated or NULL
+ *
+ * Set new CAN error state for the device, updating statistics and
+ * populating the error frame if given.
+ */
+static void xcan_set_error_state(struct net_device *ndev,
+                                 enum can_state new_state,
+                                 struct can_frame *cf)
+{
+        struct xcan_priv *priv = netdev_priv(ndev);
+        u32 ecr = priv->read_reg(priv, XCAN_ECR_OFFSET);
+        u32 txerr = ecr & XCAN_ECR_TEC_MASK;
+        u32 rxerr = (ecr & XCAN_ECR_REC_MASK) >> XCAN_ESR_REC_SHIFT;
+
+        priv->can.state = new_state;
+
+        if (cf) {
+                cf->can_id |= CAN_ERR_CRTL;
+                cf->data[6] = txerr;
+                cf->data[7] = rxerr;
+        }
+
+        switch (new_state) {
+        case CAN_STATE_ERROR_PASSIVE:
+                priv->can.can_stats.error_passive++;
+                if (cf)
+                        cf->data[1] = (rxerr > 127) ?
+                                        CAN_ERR_CRTL_RX_PASSIVE :
+                                        CAN_ERR_CRTL_TX_PASSIVE;
+                break;
+        case CAN_STATE_ERROR_WARNING:
+                priv->can.can_stats.error_warning++;
+                if (cf)
+                        cf->data[1] |= (txerr > rxerr) ?
+                                        CAN_ERR_CRTL_TX_WARNING :
+                                        CAN_ERR_CRTL_RX_WARNING;
+                break;
+        case CAN_STATE_ERROR_ACTIVE:
+                if (cf)
+                        cf->data[1] |= CAN_ERR_CRTL_ACTIVE;
+                break;
+        default:
+                /* non-ERROR states are handled elsewhere */
+                WARN_ON(1);
+                break;
+        }
+}
+
+/**
+ * xcan_update_error_state_after_rxtx - Update CAN error state after RX/TX
+ * @ndev:       Pointer to net_device structure
+ *
+ * If the device is in a ERROR-WARNING or ERROR-PASSIVE state, check if
+ * the performed RX/TX has caused it to drop to a lesser state and set
+ * the interface state accordingly.
+ */
+static void xcan_update_error_state_after_rxtx(struct net_device *ndev)
+{
+        struct xcan_priv *priv = netdev_priv(ndev);
+        enum can_state old_state = priv->can.state;
+        enum can_state new_state;
+
+        /* changing error state due to successful frame RX/TX can only
+         * occur from these states
+         */
+        if (old_state != CAN_STATE_ERROR_WARNING &&
+            old_state != CAN_STATE_ERROR_PASSIVE)
+                return;
+
+        new_state = xcan_current_error_state(ndev);
+
+        if (new_state != old_state) {
+                struct sk_buff *skb;
+                struct can_frame *cf;
+
+                skb = alloc_can_err_skb(ndev, &cf);
+
+                xcan_set_error_state(ndev, new_state, skb ? cf : NULL);
+
+                if (skb) {
+                        struct net_device_stats *stats = &ndev->stats;
+
+                        stats->rx_packets++;
+                        stats->rx_bytes += cf->can_dlc;
+                        netif_rx(skb);
+                }
+        }
+}
+
+/**
  * xcan_err_interrupt - error frame Isr
  * @ndev:       net_device pointer
  * @isr:        interrupt status register value
@@ -544,16 +685,12 @@ static void xcan_err_interrupt(struct net_device *ndev, u32 isr)
         struct net_device_stats *stats = &ndev->stats;
         struct can_frame *cf;
         struct sk_buff *skb;
-        u32 err_status, status, txerr = 0, rxerr = 0;
+        u32 err_status;
 
         skb = alloc_can_err_skb(ndev, &cf);
 
         err_status = priv->read_reg(priv, XCAN_ESR_OFFSET);
         priv->write_reg(priv, XCAN_ESR_OFFSET, err_status);
-        txerr = priv->read_reg(priv, XCAN_ECR_OFFSET) & XCAN_ECR_TEC_MASK;
-        rxerr = ((priv->read_reg(priv, XCAN_ECR_OFFSET) &
-                        XCAN_ECR_REC_MASK) >> XCAN_ESR_REC_SHIFT);
-        status = priv->read_reg(priv, XCAN_SR_OFFSET);
 
         if (isr & XCAN_IXR_BSOFF_MASK) {
                 priv->can.state = CAN_STATE_BUS_OFF;
@@ -563,28 +700,10 @@ static void xcan_err_interrupt(struct net_device *ndev, u32 isr)
                 can_bus_off(ndev);
                 if (skb)
                         cf->can_id |= CAN_ERR_BUSOFF;
-        } else if ((status & XCAN_SR_ESTAT_MASK) == XCAN_SR_ESTAT_MASK) {
-                priv->can.state = CAN_STATE_ERROR_PASSIVE;
-                priv->can.can_stats.error_passive++;
-                if (skb) {
-                        cf->can_id |= CAN_ERR_CRTL;
-                        cf->data[1] = (rxerr > 127) ?
-                                        CAN_ERR_CRTL_RX_PASSIVE :
-                                        CAN_ERR_CRTL_TX_PASSIVE;
-                        cf->data[6] = txerr;
-                        cf->data[7] = rxerr;
-                }
-        } else if (status & XCAN_SR_ERRWRN_MASK) {
-                priv->can.state = CAN_STATE_ERROR_WARNING;
-                priv->can.can_stats.error_warning++;
-                if (skb) {
-                        cf->can_id |= CAN_ERR_CRTL;
-                        cf->data[1] |= (txerr > rxerr) ?
-                                        CAN_ERR_CRTL_TX_WARNING :
-                                        CAN_ERR_CRTL_RX_WARNING;
-                        cf->data[6] = txerr;
-                        cf->data[7] = rxerr;
-                }
+        } else {
+                enum can_state new_state = xcan_current_error_state(ndev);
+
+                xcan_set_error_state(ndev, new_state, skb ? cf : NULL);
         }
 
         /* Check for Arbitration lost interrupt */
@@ -600,7 +719,6 @@ static void xcan_err_interrupt(struct net_device *ndev, u32 isr)
         if (isr & XCAN_IXR_RXOFLW_MASK) {
                 stats->rx_over_errors++;
                 stats->rx_errors++;
-                priv->write_reg(priv, XCAN_SRR_OFFSET, XCAN_SRR_RESET_MASK);
                 if (skb) {
                         cf->can_id |= CAN_ERR_CRTL;
                         cf->data[1] |= CAN_ERR_CRTL_RX_OVERFLOW;
@@ -709,26 +827,20 @@ static int xcan_rx_poll(struct napi_struct *napi, int quota)
 
         isr = priv->read_reg(priv, XCAN_ISR_OFFSET);
         while ((isr & XCAN_IXR_RXNEMP_MASK) && (work_done < quota)) {
-                if (isr & XCAN_IXR_RXOK_MASK) {
-                        priv->write_reg(priv, XCAN_ICR_OFFSET,
-                                XCAN_IXR_RXOK_MASK);
-                        work_done += xcan_rx(ndev);
-                } else {
-                        priv->write_reg(priv, XCAN_ICR_OFFSET,
-                                XCAN_IXR_RXNEMP_MASK);
-                        break;
-                }
+                work_done += xcan_rx(ndev);
                 priv->write_reg(priv, XCAN_ICR_OFFSET, XCAN_IXR_RXNEMP_MASK);
                 isr = priv->read_reg(priv, XCAN_ISR_OFFSET);
         }
 
-        if (work_done)
+        if (work_done) {
                 can_led_event(ndev, CAN_LED_EVENT_RX);
+                xcan_update_error_state_after_rxtx(ndev);
+        }
 
         if (work_done < quota) {
                 napi_complete_done(napi, work_done);
                 ier = priv->read_reg(priv, XCAN_IER_OFFSET);
-                ier |= (XCAN_IXR_RXOK_MASK | XCAN_IXR_RXNEMP_MASK);
+                ier |= XCAN_IXR_RXNEMP_MASK;
                 priv->write_reg(priv, XCAN_IER_OFFSET, ier);
         }
         return work_done;
@@ -743,18 +855,71 @@ static void xcan_tx_interrupt(struct net_device *ndev, u32 isr)
 {
         struct xcan_priv *priv = netdev_priv(ndev);
         struct net_device_stats *stats = &ndev->stats;
+        unsigned int frames_in_fifo;
+        int frames_sent = 1; /* TXOK => at least 1 frame was sent */
+        unsigned long flags;
+        int retries = 0;
+
+        /* Synchronize with xmit as we need to know the exact number
+         * of frames in the FIFO to stay in sync due to the TXFEMP
+         * handling.
+         * This also prevents a race between netif_wake_queue() and
+         * netif_stop_queue().
+         */
+        spin_lock_irqsave(&priv->tx_lock, flags);
+
+        frames_in_fifo = priv->tx_head - priv->tx_tail;
+
+        if (WARN_ON_ONCE(frames_in_fifo == 0)) {
+                /* clear TXOK anyway to avoid getting back here */
+                priv->write_reg(priv, XCAN_ICR_OFFSET, XCAN_IXR_TXOK_MASK);
+                spin_unlock_irqrestore(&priv->tx_lock, flags);
+                return;
+        }
+
+        /* Check if 2 frames were sent (TXOK only means that at least 1
+         * frame was sent).
+         */
+        if (frames_in_fifo > 1) {
+                WARN_ON(frames_in_fifo > priv->tx_max);
+
+                /* Synchronize TXOK and isr so that after the loop:
+                 * (1) isr variable is up-to-date at least up to TXOK clear
+                 *     time. This avoids us clearing a TXOK of a second frame
+                 *     but not noticing that the FIFO is now empty and thus
+                 *     marking only a single frame as sent.
+                 * (2) No TXOK is left. Having one could mean leaving a
+                 *     stray TXOK as we might process the associated frame
+                 *     via TXFEMP handling as we read TXFEMP *after* TXOK
+                 *     clear to satisfy (1).
+                 */
+                while ((isr & XCAN_IXR_TXOK_MASK) && !WARN_ON(++retries == 100)) {
+                        priv->write_reg(priv, XCAN_ICR_OFFSET, XCAN_IXR_TXOK_MASK);
+                        isr = priv->read_reg(priv, XCAN_ISR_OFFSET);
+                }
 
-        while ((priv->tx_head - priv->tx_tail > 0) &&
-                        (isr & XCAN_IXR_TXOK_MASK)) {
+                if (isr & XCAN_IXR_TXFEMP_MASK) {
+                        /* nothing in FIFO anymore */
+                        frames_sent = frames_in_fifo;
+                }
+        } else {
+                /* single frame in fifo, just clear TXOK */
                 priv->write_reg(priv, XCAN_ICR_OFFSET, XCAN_IXR_TXOK_MASK);
+        }
+
+        while (frames_sent--) {
                 can_get_echo_skb(ndev, priv->tx_tail %
                                         priv->tx_max);
                 priv->tx_tail++;
                 stats->tx_packets++;
-                isr = priv->read_reg(priv, XCAN_ISR_OFFSET);
         }
-        can_led_event(ndev, CAN_LED_EVENT_TX);
+
         netif_wake_queue(ndev);
+
+        spin_unlock_irqrestore(&priv->tx_lock, flags);
+
+        can_led_event(ndev, CAN_LED_EVENT_TX);
+        xcan_update_error_state_after_rxtx(ndev);
 }
 
 /**
@@ -773,6 +938,7 @@ static irqreturn_t xcan_interrupt(int irq, void *dev_id)
         struct net_device *ndev = (struct net_device *)dev_id;
         struct xcan_priv *priv = netdev_priv(ndev);
         u32 isr, ier;
+        u32 isr_errors;
 
         /* Get the interrupt status from Xilinx CAN */
         isr = priv->read_reg(priv, XCAN_ISR_OFFSET);
@@ -791,18 +957,17 @@ static irqreturn_t xcan_interrupt(int irq, void *dev_id)
                 xcan_tx_interrupt(ndev, isr);
 
         /* Check for the type of error interrupt and Processing it */
-        if (isr & (XCAN_IXR_ERROR_MASK | XCAN_IXR_RXOFLW_MASK |
-                        XCAN_IXR_BSOFF_MASK | XCAN_IXR_ARBLST_MASK)) {
-                priv->write_reg(priv, XCAN_ICR_OFFSET, (XCAN_IXR_ERROR_MASK |
-                                XCAN_IXR_RXOFLW_MASK | XCAN_IXR_BSOFF_MASK |
-                                XCAN_IXR_ARBLST_MASK));
+        isr_errors = isr & (XCAN_IXR_ERROR_MASK | XCAN_IXR_RXOFLW_MASK |
+                            XCAN_IXR_BSOFF_MASK | XCAN_IXR_ARBLST_MASK);
+        if (isr_errors) {
+                priv->write_reg(priv, XCAN_ICR_OFFSET, isr_errors);
                 xcan_err_interrupt(ndev, isr);
         }
 
         /* Check for the type of receive interrupt and Processing it */
-        if (isr & (XCAN_IXR_RXNEMP_MASK | XCAN_IXR_RXOK_MASK)) {
+        if (isr & XCAN_IXR_RXNEMP_MASK) {
                 ier = priv->read_reg(priv, XCAN_IER_OFFSET);
-                ier &= ~(XCAN_IXR_RXNEMP_MASK | XCAN_IXR_RXOK_MASK);
+                ier &= ~XCAN_IXR_RXNEMP_MASK;
                 priv->write_reg(priv, XCAN_IER_OFFSET, ier);
                 napi_schedule(&priv->napi);
         }
@@ -819,13 +984,9 @@ static irqreturn_t xcan_interrupt(int irq, void *dev_id)
 static void xcan_chip_stop(struct net_device *ndev)
 {
         struct xcan_priv *priv = netdev_priv(ndev);
-        u32 ier;
 
         /* Disable interrupts and leave the can in configuration mode */
-        ier = priv->read_reg(priv, XCAN_IER_OFFSET);
-        ier &= ~XCAN_INTR_ALL;
-        priv->write_reg(priv, XCAN_IER_OFFSET, ier);
-        priv->write_reg(priv, XCAN_SRR_OFFSET, XCAN_SRR_RESET_MASK);
+        set_reset_mode(ndev);
         priv->can.state = CAN_STATE_STOPPED;
 }
 
@@ -958,10 +1119,15 @@ static const struct net_device_ops xcan_netdev_ops = {
  */
 static int __maybe_unused xcan_suspend(struct device *dev)
 {
-        if (!device_may_wakeup(dev))
-                return pm_runtime_force_suspend(dev);
+        struct net_device *ndev = dev_get_drvdata(dev);
 
-        return 0;
+        if (netif_running(ndev)) {
+                netif_stop_queue(ndev);
+                netif_device_detach(ndev);
+                xcan_chip_stop(ndev);
+        }
+
+        return pm_runtime_force_suspend(dev);
 }
 
 /**
@@ -973,11 +1139,27 @@ static int __maybe_unused xcan_suspend(struct device *dev)
  */
 static int __maybe_unused xcan_resume(struct device *dev)
 {
-        if (!device_may_wakeup(dev))
-                return pm_runtime_force_resume(dev);
+        struct net_device *ndev = dev_get_drvdata(dev);
+        int ret;
 
-        return 0;
+        ret = pm_runtime_force_resume(dev);
+        if (ret) {
+                dev_err(dev, "pm_runtime_force_resume failed on resume\n");
+                return ret;
+        }
+
+        if (netif_running(ndev)) {
+                ret = xcan_chip_start(ndev);
+                if (ret) {
+                        dev_err(dev, "xcan_chip_start failed on resume\n");
+                        return ret;
+                }
+
+                netif_device_attach(ndev);
+                netif_start_queue(ndev);
+        }
 
+        return 0;
 }
 
 /**
@@ -992,14 +1174,6 @@ static int __maybe_unused xcan_runtime_suspend(struct device *dev)
         struct net_device *ndev = dev_get_drvdata(dev);
         struct xcan_priv *priv = netdev_priv(ndev);
 
-        if (netif_running(ndev)) {
-                netif_stop_queue(ndev);
-                netif_device_detach(ndev);
-        }
-
-        priv->write_reg(priv, XCAN_MSR_OFFSET, XCAN_MSR_SLEEP_MASK);
-        priv->can.state = CAN_STATE_SLEEPING;
-
         clk_disable_unprepare(priv->bus_clk);
         clk_disable_unprepare(priv->can_clk);
 
@@ -1018,7 +1192,6 @@ static int __maybe_unused xcan_runtime_resume(struct device *dev)
         struct net_device *ndev = dev_get_drvdata(dev);
         struct xcan_priv *priv = netdev_priv(ndev);
         int ret;
-        u32 isr, status;
 
         ret = clk_prepare_enable(priv->bus_clk);
         if (ret) {
@@ -1032,27 +1205,6 @@ static int __maybe_unused xcan_runtime_resume(struct device *dev)
                 return ret;
         }
 
-        priv->write_reg(priv, XCAN_SRR_OFFSET, XCAN_SRR_RESET_MASK);
-        isr = priv->read_reg(priv, XCAN_ISR_OFFSET);
-        status = priv->read_reg(priv, XCAN_SR_OFFSET);
-
-        if (netif_running(ndev)) {
-                if (isr & XCAN_IXR_BSOFF_MASK) {
-                        priv->can.state = CAN_STATE_BUS_OFF;
-                        priv->write_reg(priv, XCAN_SRR_OFFSET,
-                                        XCAN_SRR_RESET_MASK);
-                } else if ((status & XCAN_SR_ESTAT_MASK) ==
-                                        XCAN_SR_ESTAT_MASK) {
-                        priv->can.state = CAN_STATE_ERROR_PASSIVE;
-                } else if (status & XCAN_SR_ERRWRN_MASK) {
-                        priv->can.state = CAN_STATE_ERROR_WARNING;
-                } else {
-                        priv->can.state = CAN_STATE_ERROR_ACTIVE;
-                }
-                netif_device_attach(ndev);
-                netif_start_queue(ndev);
-        }
-
         return 0;
 }
 
@@ -1061,6 +1213,18 @@ static const struct dev_pm_ops xcan_dev_pm_ops = {
         SET_RUNTIME_PM_OPS(xcan_runtime_suspend, xcan_runtime_resume, NULL)
 };
 
+static const struct xcan_devtype_data xcan_zynq_data = {
+        .caps = XCAN_CAP_WATERMARK,
+};
+
+/* Match table for OF platform binding */
+static const struct of_device_id xcan_of_match[] = {
+        { .compatible = "xlnx,zynq-can-1.0", .data = &xcan_zynq_data },
+        { .compatible = "xlnx,axi-can-1.00.a", },
+        { /* end of list */ },
+};
+MODULE_DEVICE_TABLE(of, xcan_of_match);
+
 /**
  * xcan_probe - Platform registration call
  * @pdev:       Handle to the platform device structure
@@ -1075,8 +1239,10 @@ static int xcan_probe(struct platform_device *pdev)
         struct resource *res; /* IO mem resources */
         struct net_device *ndev;
         struct xcan_priv *priv;
+        const struct of_device_id *of_id;
+        int caps = 0;
         void __iomem *addr;
-        int ret, rx_max, tx_max;
+        int ret, rx_max, tx_max, tx_fifo_depth;
 
         /* Get the virtual base address for the device */
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
@@ -1086,7 +1252,8 @@ static int xcan_probe(struct platform_device *pdev)
                 goto err;
         }
 
-        ret = of_property_read_u32(pdev->dev.of_node, "tx-fifo-depth", &tx_max);
+        ret = of_property_read_u32(pdev->dev.of_node, "tx-fifo-depth",
+                                   &tx_fifo_depth);
         if (ret < 0)
                 goto err;
 
@@ -1094,6 +1261,30 @@ static int xcan_probe(struct platform_device *pdev)
         if (ret < 0)
                 goto err;
 
+        of_id = of_match_device(xcan_of_match, &pdev->dev);
+        if (of_id) {
+                const struct xcan_devtype_data *devtype_data = of_id->data;
+
+                if (devtype_data)
+                        caps = devtype_data->caps;
+        }
+
+        /* There is no way to directly figure out how many frames have been
+         * sent when the TXOK interrupt is processed. If watermark programming
+         * is supported, we can have 2 frames in the FIFO and use TXFEMP
+         * to determine if 1 or 2 frames have been sent.
+         * Theoretically we should be able to use TXFWMEMP to determine up
+         * to 3 frames, but it seems that after putting a second frame in the
+         * FIFO, with watermark at 2 frames, it can happen that TXFWMEMP (less
+         * than 2 frames in FIFO) is set anyway with no TXOK (a frame was
+         * sent), which is not a sensible state - possibly TXFWMEMP is not
+         * completely synchronized with the rest of the bits?
+         */
+        if (caps & XCAN_CAP_WATERMARK)
+                tx_max = min(tx_fifo_depth, 2);
+        else
+                tx_max = 1;
+
         /* Create a CAN device instance */
         ndev = alloc_candev(sizeof(struct xcan_priv), tx_max);
         if (!ndev)
@@ -1108,6 +1299,7 @@ static int xcan_probe(struct platform_device *pdev)
                                         CAN_CTRLMODE_BERR_REPORTING;
         priv->reg_base = addr;
         priv->tx_max = tx_max;
+        spin_lock_init(&priv->tx_lock);
 
         /* Get IRQ for the device */
         ndev->irq = platform_get_irq(pdev, 0);
@@ -1172,9 +1364,9 @@ static int xcan_probe(struct platform_device *pdev)
 
         pm_runtime_put(&pdev->dev);
 
-        netdev_dbg(ndev, "reg_base=0x%p irq=%d clock=%d, tx fifo depth:%d\n",
+        netdev_dbg(ndev, "reg_base=0x%p irq=%d clock=%d, tx fifo depth: actual %d, using %d\n",
                         priv->reg_base, ndev->irq, priv->can.clock.freq,
-                        priv->tx_max);
+                        tx_fifo_depth, priv->tx_max);
 
         return 0;
 
@@ -1208,14 +1400,6 @@ static int xcan_remove(struct platform_device *pdev)
         return 0;
 }
 
-/* Match table for OF platform binding */
-static const struct of_device_id xcan_of_match[] = {
-        { .compatible = "xlnx,zynq-can-1.0", },
-        { .compatible = "xlnx,axi-can-1.00.a", },
-        { /* end of list */ },
-};
-MODULE_DEVICE_TABLE(of, xcan_of_match);
-
 static struct platform_driver xcan_driver = {
         .probe = xcan_probe,
         .remove = xcan_remove,
diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
index 437cd6eb4faa..9ef07a06aceb 100644
--- a/drivers/net/dsa/mv88e6xxx/chip.c
+++ b/drivers/net/dsa/mv88e6xxx/chip.c
@@ -343,6 +343,7 @@ static const struct irq_domain_ops mv88e6xxx_g1_irq_domain_ops = {
         .xlate  = irq_domain_xlate_twocell,
 };
 
+/* To be called with reg_lock held */
 static void mv88e6xxx_g1_irq_free_common(struct mv88e6xxx_chip *chip)
 {
         int irq, virq;
@@ -362,9 +363,15 @@ static void mv88e6xxx_g1_irq_free_common(struct mv88e6xxx_chip *chip)
 
 static void mv88e6xxx_g1_irq_free(struct mv88e6xxx_chip *chip)
 {
-        mv88e6xxx_g1_irq_free_common(chip);
-
+        /*
+         * free_irq must be called without reg_lock taken because the irq
+         * handler takes this lock, too.
+         */
         free_irq(chip->irq, chip);
+
+        mutex_lock(&chip->reg_lock);
+        mv88e6xxx_g1_irq_free_common(chip);
+        mutex_unlock(&chip->reg_lock);
 }
 
 static int mv88e6xxx_g1_irq_setup_common(struct mv88e6xxx_chip *chip)
@@ -469,10 +476,12 @@ static int mv88e6xxx_irq_poll_setup(struct mv88e6xxx_chip *chip)
 
 static void mv88e6xxx_irq_poll_free(struct mv88e6xxx_chip *chip)
 {
-        mv88e6xxx_g1_irq_free_common(chip);
-
         kthread_cancel_delayed_work_sync(&chip->irq_poll_work);
         kthread_destroy_worker(chip->kworker);
+
+        mutex_lock(&chip->reg_lock);
+        mv88e6xxx_g1_irq_free_common(chip);
+        mutex_unlock(&chip->reg_lock);
 }
 
 int mv88e6xxx_wait(struct mv88e6xxx_chip *chip, int addr, int reg, u16 mask)
@@ -4506,12 +4515,10 @@ out_g2_irq:
         if (chip->info->g2_irqs > 0)
                 mv88e6xxx_g2_irq_free(chip);
 out_g1_irq:
-        mutex_lock(&chip->reg_lock);
         if (chip->irq > 0)
                 mv88e6xxx_g1_irq_free(chip);
         else
                 mv88e6xxx_irq_poll_free(chip);
-        mutex_unlock(&chip->reg_lock);
 out:
         if (pdata)
                 dev_put(pdata->netdev);
@@ -4539,12 +4546,10 @@ static void mv88e6xxx_remove(struct mdio_device *mdiodev)
         if (chip->info->g2_irqs > 0)
                 mv88e6xxx_g2_irq_free(chip);
 
-        mutex_lock(&chip->reg_lock);
         if (chip->irq > 0)
                 mv88e6xxx_g1_irq_free(chip);
         else
                 mv88e6xxx_irq_poll_free(chip);
-        mutex_unlock(&chip->reg_lock);
 }
 
 static const struct of_device_id mv88e6xxx_of_match[] = {
diff --git a/drivers/net/ethernet/3com/Kconfig b/drivers/net/ethernet/3com/Kconfig
index 5b7658bcf020..5c3ef9fc8207 100644
--- a/drivers/net/ethernet/3com/Kconfig
+++ b/drivers/net/ethernet/3com/Kconfig
@@ -32,7 +32,7 @@ config EL3
 
 config 3C515
         tristate "3c515 ISA \"Fast EtherLink\""
-        depends on ISA && ISA_DMA_API
+        depends on ISA && ISA_DMA_API && !PPC32
         ---help---
           If you have a 3Com ISA EtherLink XL "Corkscrew" 3c515 Fast Ethernet
           network card, say Y here.
diff --git a/drivers/net/ethernet/amd/Kconfig b/drivers/net/ethernet/amd/Kconfig
index f273af136fc7..9e5cf5583c87 100644
--- a/drivers/net/ethernet/amd/Kconfig
+++ b/drivers/net/ethernet/amd/Kconfig
@@ -44,7 +44,7 @@ config AMD8111_ETH
 
 config LANCE
         tristate "AMD LANCE and PCnet (AT1500 and NE2100) support"
-        depends on ISA && ISA_DMA_API && !ARM
+        depends on ISA && ISA_DMA_API && !ARM && !PPC32
         ---help---
           If you have a network (Ethernet) card of this type, say Y here.
           Some LinkSys cards are of this type.
@@ -138,7 +138,7 @@ config PCMCIA_NMCLAN
 
 config NI65
         tristate "NI6510 support"
-        depends on ISA && ISA_DMA_API && !ARM
+        depends on ISA && ISA_DMA_API && !ARM && !PPC32
         ---help---
           If you have a network (Ethernet) card of this type, say Y here.
 
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h b/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h
index fc7383106946..91eb8910b1c9 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h
@@ -63,8 +63,6 @@
 
 #define AQ_CFG_NAPI_WEIGHT     64U
 
-#define AQ_CFG_MULTICAST_ADDRESS_MAX     32U
-
 /*#define AQ_CFG_MAC_ADDR_PERMANENT {0x30, 0x0E, 0xE3, 0x12, 0x34, 0x56}*/
 
 #define AQ_NIC_FC_OFF    0U
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_hw.h b/drivers/net/ethernet/aquantia/atlantic/aq_hw.h
index a2d416b24ffc..2c6ebd91a9f2 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_hw.h
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_hw.h
@@ -98,6 +98,8 @@ struct aq_stats_s {
 #define AQ_HW_MEDIA_TYPE_TP    1U
 #define AQ_HW_MEDIA_TYPE_FIBRE 2U
 
+#define AQ_HW_MULTICAST_ADDRESS_MAX     32U
+
 struct aq_hw_s {
         atomic_t flags;
         u8 rbl_enabled:1;
@@ -177,7 +179,7 @@ struct aq_hw_ops {
                                     unsigned int packet_filter);
 
         int (*hw_multicast_list_set)(struct aq_hw_s *self,
-                                     u8 ar_mac[AQ_CFG_MULTICAST_ADDRESS_MAX]
+                                     u8 ar_mac[AQ_HW_MULTICAST_ADDRESS_MAX]
                                      [ETH_ALEN],
                                      u32 count);
 
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_main.c b/drivers/net/ethernet/aquantia/atlantic/aq_main.c
index ba5fe8c4125d..e3ae29e523f0 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_main.c
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_main.c
@@ -135,17 +135,10 @@ err_exit:
 static void aq_ndev_set_multicast_settings(struct net_device *ndev)
 {
         struct aq_nic_s *aq_nic = netdev_priv(ndev);
-        int err = 0;
 
-        err = aq_nic_set_packet_filter(aq_nic, ndev->flags);
-        if (err < 0)
-                return;
+        aq_nic_set_packet_filter(aq_nic, ndev->flags);
 
-        if (netdev_mc_count(ndev)) {
-                err = aq_nic_set_multicast_list(aq_nic, ndev);
-                if (err < 0)
-                        return;
-        }
+        aq_nic_set_multicast_list(aq_nic, ndev);
 }
 
 static const struct net_device_ops aq_ndev_ops = {
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
index 1a1a6380c128..7a22d0257e04 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
@@ -563,34 +563,41 @@ err_exit:
 
 int aq_nic_set_multicast_list(struct aq_nic_s *self, struct net_device *ndev)
 {
+        unsigned int packet_filter = self->packet_filter;
         struct netdev_hw_addr *ha = NULL;
         unsigned int i = 0U;
 
-        self->mc_list.count = 0U;
-
-        netdev_for_each_mc_addr(ha, ndev) {
-                ether_addr_copy(self->mc_list.ar[i++], ha->addr);
-                ++self->mc_list.count;
+        self->mc_list.count = 0;
+        if (netdev_uc_count(ndev) > AQ_HW_MULTICAST_ADDRESS_MAX) {
+                packet_filter |= IFF_PROMISC;
+        } else {
+                netdev_for_each_uc_addr(ha, ndev) {
+                        ether_addr_copy(self->mc_list.ar[i++], ha->addr);
 
-                if (i >= AQ_CFG_MULTICAST_ADDRESS_MAX)
-                        break;
+                        if (i >= AQ_HW_MULTICAST_ADDRESS_MAX)
+                                break;
+                }
         }
 
-        if (i >= AQ_CFG_MULTICAST_ADDRESS_MAX) {
-                /* Number of filters is too big: atlantic does not support this.
-                 * Force all multi filter to support this.
-                 * With this we disable all UC filters and setup "all pass"
-                 * multicast mask
-                 */
-                self->packet_filter |= IFF_ALLMULTI;
-                self->aq_nic_cfg.mc_list_count = 0;
-                return self->aq_hw_ops->hw_packet_filter_set(self->aq_hw,
-                                                             self->packet_filter);
+        if (i + netdev_mc_count(ndev) > AQ_HW_MULTICAST_ADDRESS_MAX) {
+                packet_filter |= IFF_ALLMULTI;
         } else {
-                return self->aq_hw_ops->hw_multicast_list_set(self->aq_hw,
-                                                    self->mc_list.ar,
-                                                    self->mc_list.count);
+                netdev_for_each_mc_addr(ha, ndev) {
+                        ether_addr_copy(self->mc_list.ar[i++], ha->addr);
+
+                        if (i >= AQ_HW_MULTICAST_ADDRESS_MAX)
+                                break;
+                }
+        }
+
+        if (i > 0 && i < AQ_HW_MULTICAST_ADDRESS_MAX) {
+                packet_filter |= IFF_MULTICAST;
+                self->mc_list.count = i;
+                self->aq_hw_ops->hw_multicast_list_set(self->aq_hw,
+                                                       self->mc_list.ar,
+                                                       self->mc_list.count);
         }
+        return aq_nic_set_packet_filter(self, packet_filter);
 }
 
 int aq_nic_set_mtu(struct aq_nic_s *self, int new_mtu)
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_nic.h b/drivers/net/ethernet/aquantia/atlantic/aq_nic.h
index faa533a0ec47..fecfc401f95d 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.h
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.h
@@ -75,7 +75,7 @@ struct aq_nic_s {
         struct aq_hw_link_status_s link_status;
         struct {
                 u32 count;
-                u8 ar[AQ_CFG_MULTICAST_ADDRESS_MAX][ETH_ALEN];
+                u8 ar[AQ_HW_MULTICAST_ADDRESS_MAX][ETH_ALEN];
         } mc_list;
 
         struct pci_dev *pdev;
diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c
index 67e2f9fb9402..8cc6abadc03b 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c
@@ -765,7 +765,7 @@ static int hw_atl_a0_hw_packet_filter_set(struct aq_hw_s *self,
 
 static int hw_atl_a0_hw_multicast_list_set(struct aq_hw_s *self,
                                            u8 ar_mac
-                                           [AQ_CFG_MULTICAST_ADDRESS_MAX]
+                                           [AQ_HW_MULTICAST_ADDRESS_MAX]
                                            [ETH_ALEN],
                                            u32 count)
 {
diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
index 819f6bcf9b4e..956860a69797 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
@@ -784,7 +784,7 @@ static int hw_atl_b0_hw_packet_filter_set(struct aq_hw_s *self,
 
 static int hw_atl_b0_hw_multicast_list_set(struct aq_hw_s *self,
                                            u8 ar_mac
-                                           [AQ_CFG_MULTICAST_ADDRESS_MAX]
+                                           [AQ_HW_MULTICAST_ADDRESS_MAX]
                                            [ETH_ALEN],
                                            u32 count)
 {
@@ -812,7 +812,7 @@ static int hw_atl_b0_hw_multicast_list_set(struct aq_hw_s *self,
 
                 hw_atl_rpfl2_uc_flr_en_set(self,
                                            (self->aq_nic_cfg->is_mc_list_enabled),
-                                    HW_ATL_B0_MAC_MIN + i);
+                                           HW_ATL_B0_MAC_MIN + i);
         }
 
         err = aq_hw_err_from_flags(self);
diff --git a/drivers/net/ethernet/atheros/alx/main.c b/drivers/net/ethernet/atheros/alx/main.c
index 567ee54504bc..5e5022fa1d04 100644
--- a/drivers/net/ethernet/atheros/alx/main.c
+++ b/drivers/net/ethernet/atheros/alx/main.c
@@ -1897,13 +1897,19 @@ static int alx_resume(struct device *dev)
         struct pci_dev *pdev = to_pci_dev(dev);
         struct alx_priv *alx = pci_get_drvdata(pdev);
         struct alx_hw *hw = &alx->hw;
+        int err;
 
         alx_reset_phy(hw);
 
         if (!netif_running(alx->dev))
                 return 0;
         netif_device_attach(alx->dev);
-        return __alx_open(alx, true);
+
+        rtnl_lock();
+        err = __alx_open(alx, true);
+        rtnl_unlock();
+
+        return err;
 }
 
 static SIMPLE_DEV_PM_OPS(alx_pm_ops, alx_suspend, alx_resume);
diff --git a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
index 94270f654b3b..7087b88550db 100644
--- a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
+++ b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
@@ -1686,6 +1686,7 @@ static struct sk_buff *atl1c_alloc_skb(struct atl1c_adapter *adapter)
         skb = build_skb(page_address(page) + adapter->rx_page_offset,
                         adapter->rx_frag_size);
         if (likely(skb)) {
+                skb_reserve(skb, NET_SKB_PAD);
                 adapter->rx_page_offset += adapter->rx_frag_size;
                 if (adapter->rx_page_offset >= PAGE_SIZE)
                         adapter->rx_page = NULL;
diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
index d5fca2e5a9bc..a1f60f89e059 100644
--- a/drivers/net/ethernet/broadcom/bcmsysport.c
+++ b/drivers/net/ethernet/broadcom/bcmsysport.c
@@ -1946,8 +1946,8 @@ static int bcm_sysport_open(struct net_device *dev)
         if (!priv->is_lite)
                 priv->crc_fwd = !!(umac_readl(priv, UMAC_CMD) & CMD_CRC_FWD);
         else
-                priv->crc_fwd = !!(gib_readl(priv, GIB_CONTROL) &
-                                   GIB_FCS_STRIP);
+                priv->crc_fwd = !((gib_readl(priv, GIB_CONTROL) &
+                                  GIB_FCS_STRIP) >> GIB_FCS_STRIP_SHIFT);
 
         phydev = of_phy_connect(dev, priv->phy_dn, bcm_sysport_adj_link,
                                 0, priv->phy_interface);
diff --git a/drivers/net/ethernet/broadcom/bcmsysport.h b/drivers/net/ethernet/broadcom/bcmsysport.h
index d6e5d0cbf3a3..cf440b91fd04 100644
--- a/drivers/net/ethernet/broadcom/bcmsysport.h
+++ b/drivers/net/ethernet/broadcom/bcmsysport.h
@@ -278,7 +278,8 @@ struct bcm_rsb {
 #define  GIB_GTX_CLK_EXT_CLK            (0 << GIB_GTX_CLK_SEL_SHIFT)
 #define  GIB_GTX_CLK_125MHZ             (1 << GIB_GTX_CLK_SEL_SHIFT)
 #define  GIB_GTX_CLK_250MHZ             (2 << GIB_GTX_CLK_SEL_SHIFT)
-#define  GIB_FCS_STRIP                  (1 << 6)
+#define  GIB_FCS_STRIP_SHIFT            6
+#define  GIB_FCS_STRIP                  (1 << GIB_FCS_STRIP_SHIFT)
 #define  GIB_LCL_LOOP_EN                (1 << 7)
 #define  GIB_LCL_LOOP_TXEN              (1 << 8)
 #define  GIB_RMT_LOOP_EN                (1 << 9)
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
index d847e1b9c37b..be1506169076 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
@@ -1533,6 +1533,7 @@ struct bnx2x {
         struct link_vars        link_vars;
         u32                     link_cnt;
         struct bnx2x_link_report_data last_reported_link;
+        bool                    force_link_down;
 
         struct mdio_if_info     mdio;
 
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
index 8cd73ff5debc..af7b5a4d8ba0 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -1261,6 +1261,11 @@ void __bnx2x_link_report(struct bnx2x *bp)
 {
         struct bnx2x_link_report_data cur_data;
 
+        if (bp->force_link_down) {
+                bp->link_vars.link_up = 0;
+                return;
+        }
+
         /* reread mf_cfg */
         if (IS_PF(bp) && !CHIP_IS_E1(bp))
                 bnx2x_read_mf_cfg(bp);
@@ -2817,6 +2822,7 @@ int bnx2x_nic_load(struct bnx2x *bp, int load_mode)
                 bp->pending_max = 0;
         }
 
+        bp->force_link_down = false;
         if (bp->port.pmf) {
                 rc = bnx2x_initial_phy_init(bp, load_mode);
                 if (rc)
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
index da18aa239acb..a4a90b6cdb46 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
@@ -3388,14 +3388,18 @@ static int bnx2x_set_rss_flags(struct bnx2x *bp, struct ethtool_rxnfc *info)
                         DP(BNX2X_MSG_ETHTOOL,
                            "rss re-configured, UDP 4-tupple %s\n",
                            udp_rss_requested ? "enabled" : "disabled");
-                        return bnx2x_rss(bp, &bp->rss_conf_obj, false, true);
+                        if (bp->state == BNX2X_STATE_OPEN)
+                                return bnx2x_rss(bp, &bp->rss_conf_obj, false,
+                                                 true);
                 } else if ((info->flow_type == UDP_V6_FLOW) &&
                            (bp->rss_conf_obj.udp_rss_v6 != udp_rss_requested)) {
                         bp->rss_conf_obj.udp_rss_v6 = udp_rss_requested;
                         DP(BNX2X_MSG_ETHTOOL,
                            "rss re-configured, UDP 4-tupple %s\n",
                            udp_rss_requested ? "enabled" : "disabled");
-                        return bnx2x_rss(bp, &bp->rss_conf_obj, false, true);
+                        if (bp->state == BNX2X_STATE_OPEN)
+                                return bnx2x_rss(bp, &bp->rss_conf_obj, false,
+                                                 true);
                 }
                 return 0;
 
@@ -3509,7 +3513,10 @@ static int bnx2x_set_rxfh(struct net_device *dev, const u32 *indir,
                 bp->rss_conf_obj.ind_table[i] = indir[i] + bp->fp->cl_id;
         }
 
-        return bnx2x_config_rss_eth(bp, false);
+        if (bp->state == BNX2X_STATE_OPEN)
+                return bnx2x_config_rss_eth(bp, false);
+
+        return 0;
 }
 
 /**
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index 5b1ed240bf18..57348f2b49a3 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -10279,6 +10279,12 @@ static void bnx2x_sp_rtnl_task(struct work_struct *work)
                 bp->sp_rtnl_state = 0;
                 smp_mb();
 
+                /* Immediately indicate link as down */
+                bp->link_vars.link_up = 0;
+                bp->force_link_down = true;
+                netif_carrier_off(bp->dev);
+                BNX2X_ERR("Indicating link is down due to Tx-timeout\n");
+
                 bnx2x_nic_unload(bp, UNLOAD_NORMAL, true);
                 /* When ret value shows failure of allocation failure,
                  * the nic is rebooted again. If open still fails, a error
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index 176fc9f4d7de..4394c1162be4 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -5712,7 +5712,9 @@ static int bnxt_init_chip(struct bnxt *bp, bool irq_re_init)
         }
         vnic->uc_filter_count = 1;
 
-        vnic->rx_mask = CFA_L2_SET_RX_MASK_REQ_MASK_BCAST;
+        vnic->rx_mask = 0;
+        if (bp->dev->flags & IFF_BROADCAST)
+                vnic->rx_mask |= CFA_L2_SET_RX_MASK_REQ_MASK_BCAST;
 
         if ((bp->dev->flags & IFF_PROMISC) && bnxt_promisc_ok(bp))
                 vnic->rx_mask |= CFA_L2_SET_RX_MASK_REQ_MASK_PROMISCUOUS;
@@ -5917,7 +5919,7 @@ unsigned int bnxt_get_max_func_irqs(struct bnxt *bp)
         return min_t(unsigned int, hw_resc->max_irqs, hw_resc->max_cp_rings);
 }
 
-void bnxt_set_max_func_irqs(struct bnxt *bp, unsigned int max_irqs)
+static void bnxt_set_max_func_irqs(struct bnxt *bp, unsigned int max_irqs)
 {
         bp->hw_resc.max_irqs = max_irqs;
 }
@@ -6888,7 +6890,7 @@ static int __bnxt_open_nic(struct bnxt *bp, bool irq_re_init, bool link_re_init)
                 rc = bnxt_request_irq(bp);
                 if (rc) {
                         netdev_err(bp->dev, "bnxt_request_irq err: %x\n", rc);
-                        goto open_err;
+                        goto open_err_irq;
                 }
         }
 
@@ -6928,6 +6930,8 @@ static int __bnxt_open_nic(struct bnxt *bp, bool irq_re_init, bool link_re_init)
 open_err:
         bnxt_debug_dev_exit(bp);
         bnxt_disable_napi(bp);
+
+open_err_irq:
         bnxt_del_napi(bp);
 
 open_err_free_mem:
@@ -7214,13 +7218,16 @@ static void bnxt_set_rx_mode(struct net_device *dev)
 
         mask &= ~(CFA_L2_SET_RX_MASK_REQ_MASK_PROMISCUOUS |
                   CFA_L2_SET_RX_MASK_REQ_MASK_MCAST |
-                  CFA_L2_SET_RX_MASK_REQ_MASK_ALL_MCAST);
+                  CFA_L2_SET_RX_MASK_REQ_MASK_ALL_MCAST |
+                  CFA_L2_SET_RX_MASK_REQ_MASK_BCAST);
 
         if ((dev->flags & IFF_PROMISC) && bnxt_promisc_ok(bp))
                 mask |= CFA_L2_SET_RX_MASK_REQ_MASK_PROMISCUOUS;
 
         uc_update = bnxt_uc_list_updated(bp);
 
+        if (dev->flags & IFF_BROADCAST)
+                mask |= CFA_L2_SET_RX_MASK_REQ_MASK_BCAST;
         if (dev->flags & IFF_ALLMULTI) {
                 mask |= CFA_L2_SET_RX_MASK_REQ_MASK_ALL_MCAST;
                 vnic->mc_list_count = 0;
@@ -8502,11 +8509,11 @@ int bnxt_get_max_rings(struct bnxt *bp, int *max_rx, int *max_tx, bool shared)
         int rx, tx, cp;
 
         _bnxt_get_max_rings(bp, &rx, &tx, &cp);
+        *max_rx = rx;
+        *max_tx = tx;
         if (!rx || !tx || !cp)
                 return -ENOMEM;
 
-        *max_rx = rx;
-        *max_tx = tx;
         return bnxt_trim_rings(bp, max_rx, max_tx, cp, shared);
 }
 
@@ -8520,8 +8527,11 @@ static int bnxt_get_dflt_rings(struct bnxt *bp, int *max_rx, int *max_tx,
                 /* Not enough rings, try disabling agg rings. */
                 bp->flags &= ~BNXT_FLAG_AGG_RINGS;
                 rc = bnxt_get_max_rings(bp, max_rx, max_tx, shared);
-                if (rc)
+                if (rc) {
+                        /* set BNXT_FLAG_AGG_RINGS back for consistency */
+                        bp->flags |= BNXT_FLAG_AGG_RINGS;
                         return rc;
+                }
                 bp->flags |= BNXT_FLAG_NO_AGG_RINGS;
                 bp->dev->hw_features &= ~(NETIF_F_LRO | NETIF_F_GRO_HW);
                 bp->dev->features &= ~(NETIF_F_LRO | NETIF_F_GRO_HW);
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
index 9b14eb610b9f..91575ef97c8c 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
@@ -1470,7 +1470,6 @@ void bnxt_set_max_func_stat_ctxs(struct bnxt *bp, unsigned int max);
 unsigned int bnxt_get_max_func_cp_rings(struct bnxt *bp);
 void bnxt_set_max_func_cp_rings(struct bnxt *bp, unsigned int max);
 unsigned int bnxt_get_max_func_irqs(struct bnxt *bp);
-void bnxt_set_max_func_irqs(struct bnxt *bp, unsigned int max);
 int bnxt_get_avail_msix(struct bnxt *bp, int num);
 int bnxt_reserve_rings(struct bnxt *bp);
 void bnxt_tx_disable(struct bnxt *bp);
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
index 795f45024c20..491bd40a254d 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
@@ -27,6 +27,15 @@
 #define BNXT_FID_INVALID                        0xffff
 #define VLAN_TCI(vid, prio)     ((vid) | ((prio) << VLAN_PRIO_SHIFT))
 
+#define is_vlan_pcp_wildcarded(vlan_tci_mask)   \
+        ((ntohs(vlan_tci_mask) & VLAN_PRIO_MASK) == 0x0000)
+#define is_vlan_pcp_exactmatch(vlan_tci_mask)   \
+        ((ntohs(vlan_tci_mask) & VLAN_PRIO_MASK) == VLAN_PRIO_MASK)
+#define is_vlan_pcp_zero(vlan_tci)      \
+        ((ntohs(vlan_tci) & VLAN_PRIO_MASK) == 0x0000)
+#define is_vid_exactmatch(vlan_tci_mask)        \
+        ((ntohs(vlan_tci_mask) & VLAN_VID_MASK) == VLAN_VID_MASK)
+
 /* Return the dst fid of the func for flow forwarding
  * For PFs: src_fid is the fid of the PF
  * For VF-reps: src_fid the fid of the VF
@@ -389,6 +398,21 @@ static bool is_exactmatch(void *mask, int len)
         return true;
 }
 
+static bool is_vlan_tci_allowed(__be16  vlan_tci_mask,
+                                __be16  vlan_tci)
+{
+        /* VLAN priority must be either exactly zero or fully wildcarded and
+         * VLAN id must be exact match.
+         */
+        if (is_vid_exactmatch(vlan_tci_mask) &&
+            ((is_vlan_pcp_exactmatch(vlan_tci_mask) &&
+              is_vlan_pcp_zero(vlan_tci)) ||
+             is_vlan_pcp_wildcarded(vlan_tci_mask)))
+                return true;
+
+        return false;
+}
+
 static bool bits_set(void *key, int len)
 {
         const u8 *p = key;
@@ -803,9 +827,9 @@ static bool bnxt_tc_can_offload(struct bnxt *bp, struct bnxt_tc_flow *flow)
         /* Currently VLAN fields cannot be partial wildcard */
         if (bits_set(&flow->l2_key.inner_vlan_tci,
                      sizeof(flow->l2_key.inner_vlan_tci)) &&
-            !is_exactmatch(&flow->l2_mask.inner_vlan_tci,
-                           sizeof(flow->l2_mask.inner_vlan_tci))) {
-                netdev_info(bp->dev, "Wildcard match unsupported for VLAN TCI\n");
+            !is_vlan_tci_allowed(flow->l2_mask.inner_vlan_tci,
+                                 flow->l2_key.inner_vlan_tci)) {
+                netdev_info(bp->dev, "Unsupported VLAN TCI\n");
                 return false;
         }
         if (bits_set(&flow->l2_key.inner_vlan_tpid,
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c
index 347e4f946eb2..840f6e505f73 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c
@@ -169,7 +169,6 @@ static int bnxt_req_msix_vecs(struct bnxt_en_dev *edev, int ulp_id,
                 edev->ulp_tbl[ulp_id].msix_requested = avail_msix;
         }
         bnxt_fill_msix_vecs(bp, ent);
-        bnxt_set_max_func_irqs(bp, bnxt_get_max_func_irqs(bp) - avail_msix);
         bnxt_set_max_func_cp_rings(bp, max_cp_rings - avail_msix);
         edev->flags |= BNXT_EN_FLAG_MSIX_REQUESTED;
         return avail_msix;
@@ -192,7 +191,6 @@ static int bnxt_free_msix_vecs(struct bnxt_en_dev *edev, int ulp_id)
         msix_requested = edev->ulp_tbl[ulp_id].msix_requested;
         bnxt_set_max_func_cp_rings(bp, max_cp_rings + msix_requested);
         edev->ulp_tbl[ulp_id].msix_requested = 0;
-        bnxt_set_max_func_irqs(bp, bnxt_get_max_func_irqs(bp) + msix_requested);
         edev->flags &= ~BNXT_EN_FLAG_MSIX_REQUESTED;
         if (netif_running(dev)) {
                 bnxt_close_nic(bp, true, false);
diff --git a/drivers/net/ethernet/broadcom/cnic.c b/drivers/net/ethernet/broadcom/cnic.c
index 30273a7717e2..4fd829b5e65d 100644
--- a/drivers/net/ethernet/broadcom/cnic.c
+++ b/drivers/net/ethernet/broadcom/cnic.c
@@ -660,7 +660,7 @@ static int cnic_init_id_tbl(struct cnic_id_tbl *id_tbl, u32 size, u32 start_id,
         id_tbl->max = size;
         id_tbl->next = next;
         spin_lock_init(&id_tbl->lock);
-        id_tbl->table = kcalloc(DIV_ROUND_UP(size, 32), 4, GFP_KERNEL);
+        id_tbl->table = kcalloc(BITS_TO_LONGS(size), sizeof(long), GFP_KERNEL);
         if (!id_tbl->table)
                 return -ENOMEM;
 
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index 3be87efdc93d..aa1374d0af93 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -6,11 +6,15 @@
  * Copyright (C) 2004 Sun Microsystems Inc.
  * Copyright (C) 2005-2016 Broadcom Corporation.
  * Copyright (C) 2016-2017 Broadcom Limited.
+ * Copyright (C) 2018 Broadcom. All Rights Reserved. The term "Broadcom"
+ * refers to Broadcom Inc. and/or its subsidiaries.
  *
  * Firmware is:
  *      Derived from proprietary unpublished source code,
  *      Copyright (C) 2000-2016 Broadcom Corporation.
  *      Copyright (C) 2016-2017 Broadcom Ltd.
+ *      Copyright (C) 2018 Broadcom. All Rights Reserved. The term "Broadcom"
+ *      refers to Broadcom Inc. and/or its subsidiaries.
  *
  *      Permission is hereby granted for the distribution of this firmware
  *      data in hexadecimal or equivalent format, provided this copyright
@@ -9290,6 +9294,15 @@ static int tg3_chip_reset(struct tg3 *tp)
 
         tg3_restore_clk(tp);
 
+        /* Increase the core clock speed to fix tx timeout issue for 5762
+         * with 100Mbps link speed.
+         */
+        if (tg3_asic_rev(tp) == ASIC_REV_5762) {
+                val = tr32(TG3_CPMU_CLCK_ORIDE_ENABLE);
+                tw32(TG3_CPMU_CLCK_ORIDE_ENABLE, val |
+                     TG3_CPMU_MAC_ORIDE_ENABLE);
+        }
+
         /* Reprobe ASF enable state.  */
         tg3_flag_clear(tp, ENABLE_ASF);
         tp->phy_flags &= ~(TG3_PHYFLG_1G_ON_VAUX_OK |
diff --git a/drivers/net/ethernet/broadcom/tg3.h b/drivers/net/ethernet/broadcom/tg3.h
index 1d61aa3efda1..a772a33b685c 100644
--- a/drivers/net/ethernet/broadcom/tg3.h
+++ b/drivers/net/ethernet/broadcom/tg3.h
@@ -7,6 +7,8 @@
  * Copyright (C) 2004 Sun Microsystems Inc.
  * Copyright (C) 2007-2016 Broadcom Corporation.
  * Copyright (C) 2016-2017 Broadcom Limited.
+ * Copyright (C) 2018 Broadcom. All Rights Reserved. The term "Broadcom"
+ * refers to Broadcom Inc. and/or its subsidiaries.
  */
 
 #ifndef _T3_H
diff --git a/drivers/net/ethernet/cadence/macb.h b/drivers/net/ethernet/cadence/macb.h
index 86659823b259..3d45f4c92cf6 100644
--- a/drivers/net/ethernet/cadence/macb.h
+++ b/drivers/net/ethernet/cadence/macb.h
@@ -166,6 +166,7 @@
 #define GEM_DCFG6               0x0294 /* Design Config 6 */
 #define GEM_DCFG7               0x0298 /* Design Config 7 */
 #define GEM_DCFG8               0x029C /* Design Config 8 */
+#define GEM_DCFG10              0x02A4 /* Design Config 10 */
 
 #define GEM_TXBDCTRL    0x04cc /* TX Buffer Descriptor control register */
 #define GEM_RXBDCTRL    0x04d0 /* RX Buffer Descriptor control register */
@@ -490,6 +491,12 @@
 #define GEM_SCR2CMP_OFFSET                      0
 #define GEM_SCR2CMP_SIZE                        8
 
+/* Bitfields in DCFG10 */
+#define GEM_TXBD_RDBUFF_OFFSET                  12
+#define GEM_TXBD_RDBUFF_SIZE                    4
+#define GEM_RXBD_RDBUFF_OFFSET                  8
+#define GEM_RXBD_RDBUFF_SIZE                    4
+
 /* Bitfields in TISUBN */
 #define GEM_SUBNSINCR_OFFSET                    0
 #define GEM_SUBNSINCR_SIZE                      16
@@ -635,6 +642,7 @@
 #define MACB_CAPS_USRIO_DISABLED                0x00000010
 #define MACB_CAPS_JUMBO                         0x00000020
 #define MACB_CAPS_GEM_HAS_PTP                   0x00000040
+#define MACB_CAPS_BD_RD_PREFETCH                0x00000080
 #define MACB_CAPS_FIFO_MODE                     0x10000000
 #define MACB_CAPS_GIGABIT_MODE_AVAILABLE        0x20000000
 #define MACB_CAPS_SG_DISABLED                   0x40000000
@@ -1203,6 +1211,9 @@ struct macb {
         unsigned int max_tuples;
 
         struct tasklet_struct   hresp_err_tasklet;
+
+        int     rx_bd_rd_prefetch;
+        int     tx_bd_rd_prefetch;
 };
 
 #ifdef CONFIG_MACB_USE_HWSTAMP
diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
index 3e93df5d4e3b..a6c911bb5ce2 100644
--- a/drivers/net/ethernet/cadence/macb_main.c
+++ b/drivers/net/ethernet/cadence/macb_main.c
@@ -1811,23 +1811,25 @@ static void macb_free_consistent(struct macb *bp)
 {
         struct macb_queue *queue;
         unsigned int q;
+        int size;
 
-        queue = &bp->queues[0];
         bp->macbgem_ops.mog_free_rx_buffers(bp);
-        if (queue->rx_ring) {
-                dma_free_coherent(&bp->pdev->dev, RX_RING_BYTES(bp),
-                                queue->rx_ring, queue->rx_ring_dma);
-                queue->rx_ring = NULL;
-        }
 
         for (q = 0, queue = bp->queues; q < bp->num_queues; ++q, ++queue) {
                 kfree(queue->tx_skb);
                 queue->tx_skb = NULL;
                 if (queue->tx_ring) {
-                        dma_free_coherent(&bp->pdev->dev, TX_RING_BYTES(bp),
+                        size = TX_RING_BYTES(bp) + bp->tx_bd_rd_prefetch;
+                        dma_free_coherent(&bp->pdev->dev, size,
                                           queue->tx_ring, queue->tx_ring_dma);
                         queue->tx_ring = NULL;
                 }
+                if (queue->rx_ring) {
+                        size = RX_RING_BYTES(bp) + bp->rx_bd_rd_prefetch;
+                        dma_free_coherent(&bp->pdev->dev, size,
+                                          queue->rx_ring, queue->rx_ring_dma);
+                        queue->rx_ring = NULL;
+                }
         }
 }
 
@@ -1874,7 +1876,7 @@ static int macb_alloc_consistent(struct macb *bp)
         int size;
 
         for (q = 0, queue = bp->queues; q < bp->num_queues; ++q, ++queue) {
-                size = TX_RING_BYTES(bp);
+                size = TX_RING_BYTES(bp) + bp->tx_bd_rd_prefetch;
                 queue->tx_ring = dma_alloc_coherent(&bp->pdev->dev, size,
                                                     &queue->tx_ring_dma,
                                                     GFP_KERNEL);
@@ -1890,7 +1892,7 @@ static int macb_alloc_consistent(struct macb *bp)
                 if (!queue->tx_skb)
                         goto out_err;
 
-                size = RX_RING_BYTES(bp);
+                size = RX_RING_BYTES(bp) + bp->rx_bd_rd_prefetch;
                 queue->rx_ring = dma_alloc_coherent(&bp->pdev->dev, size,
                                                  &queue->rx_ring_dma, GFP_KERNEL);
                 if (!queue->rx_ring)
@@ -3726,6 +3728,8 @@ static int at91ether_init(struct platform_device *pdev)
         int err;
         u32 reg;
 
+        bp->queues[0].bp = bp;
+
         dev->netdev_ops = &at91ether_netdev_ops;
         dev->ethtool_ops = &macb_ethtool_ops;
 
@@ -3795,7 +3799,7 @@ static const struct macb_config np4_config = {
 static const struct macb_config zynqmp_config = {
         .caps = MACB_CAPS_GIGABIT_MODE_AVAILABLE |
                         MACB_CAPS_JUMBO |
-                        MACB_CAPS_GEM_HAS_PTP,
+                        MACB_CAPS_GEM_HAS_PTP | MACB_CAPS_BD_RD_PREFETCH,
         .dma_burst_length = 16,
         .clk_init = macb_clk_init,
         .init = macb_init,
@@ -3856,7 +3860,7 @@ static int macb_probe(struct platform_device *pdev)
         void __iomem *mem;
         const char *mac;
         struct macb *bp;
-        int err;
+        int err, val;
 
         regs = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         mem = devm_ioremap_resource(&pdev->dev, regs);
@@ -3945,6 +3949,18 @@ static int macb_probe(struct platform_device *pdev)
         else
                 dev->max_mtu = ETH_DATA_LEN;
 
+        if (bp->caps & MACB_CAPS_BD_RD_PREFETCH) {
+                val = GEM_BFEXT(RXBD_RDBUFF, gem_readl(bp, DCFG10));
+                if (val)
+                        bp->rx_bd_rd_prefetch = (2 << (val - 1)) *
+                                                macb_dma_desc_get_size(bp);
+
+                val = GEM_BFEXT(TXBD_RDBUFF, gem_readl(bp, DCFG10));
+                if (val)
+                        bp->tx_bd_rd_prefetch = (2 << (val - 1)) *
+                                                macb_dma_desc_get_size(bp);
+        }
+
         mac = of_get_mac_address(np);
         if (mac) {
                 ether_addr_copy(bp->dev->dev_addr, mac);
diff --git a/drivers/net/ethernet/cavium/Kconfig b/drivers/net/ethernet/cavium/Kconfig
index 043e3c11c42b..92d88c5f76fb 100644
--- a/drivers/net/ethernet/cavium/Kconfig
+++ b/drivers/net/ethernet/cavium/Kconfig
@@ -15,7 +15,7 @@ if NET_VENDOR_CAVIUM
 
 config THUNDER_NIC_PF
         tristate "Thunder Physical function driver"
-        depends on 64BIT
+        depends on 64BIT && PCI
         select THUNDER_NIC_BGX
         ---help---
           This driver supports Thunder's NIC physical function.
@@ -28,13 +28,13 @@ config THUNDER_NIC_PF
 config THUNDER_NIC_VF
         tristate "Thunder Virtual function driver"
         imply CAVIUM_PTP
-        depends on 64BIT
+        depends on 64BIT && PCI
         ---help---
           This driver supports Thunder's NIC virtual function
 
 config  THUNDER_NIC_BGX
         tristate "Thunder MAC interface driver (BGX)"
-        depends on 64BIT
+        depends on 64BIT && PCI
         select PHYLIB
         select MDIO_THUNDER
         select THUNDER_NIC_RGX
@@ -44,7 +44,7 @@ config	THUNDER_NIC_BGX
 
 config  THUNDER_NIC_RGX
         tristate "Thunder MAC interface driver (RGX)"
-        depends on 64BIT
+        depends on 64BIT && PCI
         select PHYLIB
         select MDIO_THUNDER
         ---help---
@@ -53,7 +53,7 @@ config	THUNDER_NIC_RGX
 
 config CAVIUM_PTP
         tristate "Cavium PTP coprocessor as PTP clock"
-        depends on 64BIT
+        depends on 64BIT && PCI
         imply PTP_1588_CLOCK
         default y
         ---help---
@@ -65,7 +65,7 @@ config CAVIUM_PTP
 
 config LIQUIDIO
         tristate "Cavium LiquidIO support"
-        depends on 64BIT
+        depends on 64BIT && PCI
         depends on MAY_USE_DEVLINK
         imply PTP_1588_CLOCK
         select FW_LOADER
diff --git a/drivers/net/ethernet/cavium/liquidio/lio_main.c b/drivers/net/ethernet/cavium/liquidio/lio_main.c
index 8a815bb57177..7e8454d3b1ad 100644
--- a/drivers/net/ethernet/cavium/liquidio/lio_main.c
+++ b/drivers/net/ethernet/cavium/liquidio/lio_main.c
@@ -91,6 +91,9 @@ static int octeon_console_debug_enabled(u32 console)
  */
 #define LIO_SYNC_OCTEON_TIME_INTERVAL_MS 60000
 
+/* time to wait for possible in-flight requests in milliseconds */
+#define WAIT_INFLIGHT_REQUEST   msecs_to_jiffies(1000)
+
 struct lio_trusted_vf_ctx {
         struct completion complete;
         int status;
@@ -259,7 +262,7 @@ static inline void pcierror_quiesce_device(struct octeon_device *oct)
         force_io_queues_off(oct);
 
         /* To allow for in-flight requests */
-        schedule_timeout_uninterruptible(100);
+        schedule_timeout_uninterruptible(WAIT_INFLIGHT_REQUEST);
 
         if (wait_for_pending_requests(oct))
                 dev_err(&oct->pci_dev->dev, "There were pending requests\n");
diff --git a/drivers/net/ethernet/cavium/octeon/octeon_mgmt.c b/drivers/net/ethernet/cavium/octeon/octeon_mgmt.c
index 3f6afb54a5eb..bb43ddb7539e 100644
--- a/drivers/net/ethernet/cavium/octeon/octeon_mgmt.c
+++ b/drivers/net/ethernet/cavium/octeon/octeon_mgmt.c
@@ -643,13 +643,21 @@ static int octeon_mgmt_set_mac_address(struct net_device *netdev, void *addr)
 static int octeon_mgmt_change_mtu(struct net_device *netdev, int new_mtu)
 {
         struct octeon_mgmt *p = netdev_priv(netdev);
-        int size_without_fcs = new_mtu + OCTEON_MGMT_RX_HEADROOM;
+        int max_packet = new_mtu + ETH_HLEN + ETH_FCS_LEN;
 
         netdev->mtu = new_mtu;
 
-        cvmx_write_csr(p->agl + AGL_GMX_RX_FRM_MAX, size_without_fcs);
+        /* HW lifts the limit if the frame is VLAN tagged
+         * (+4 bytes per each tag, up to two tags)
+         */
+        cvmx_write_csr(p->agl + AGL_GMX_RX_FRM_MAX, max_packet);
+        /* Set the hardware to truncate packets larger than the MTU. The jabber
+         * register must be set to a multiple of 8 bytes, so round up. JABBER is
+         * an unconditional limit, so we need to account for two possible VLAN
+         * tags.
+         */
         cvmx_write_csr(p->agl + AGL_GMX_RX_JABBER,
-                       (size_without_fcs + 7) & 0xfff8);
+                       (max_packet + 7 + VLAN_HLEN * 2) & 0xfff8);
 
         return 0;
 }
diff --git a/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c b/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c
index 7b795edd9d3a..a19172dbe6be 100644
--- a/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c
@@ -51,6 +51,7 @@
 #include <linux/sched.h>
 #include <linux/slab.h>
 #include <linux/uaccess.h>
+#include <linux/nospec.h>
 
 #include "common.h"
 #include "cxgb3_ioctl.h"
@@ -2268,6 +2269,7 @@ static int cxgb_extension_ioctl(struct net_device *dev, void __user *useraddr)
 
                 if (t.qset_idx >= nqsets)
                         return -EINVAL;
+                t.qset_idx = array_index_nospec(t.qset_idx, nqsets);
 
                 q = &adapter->params.sge.qset[q1 + t.qset_idx];
                 t.rspq_size = q->rspq_size;
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
index 974a868a4824..3720c3e11ebb 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
@@ -8702,7 +8702,7 @@ static int t4_get_flash_params(struct adapter *adap)
         };
 
         unsigned int part, manufacturer;
-        unsigned int density, size;
+        unsigned int density, size = 0;
         u32 flashid = 0;
         int ret;
 
@@ -8772,11 +8772,6 @@ static int t4_get_flash_params(struct adapter *adap)
                 case 0x22: /* 256MB */
                         size = 1 << 28;
                         break;
-
-                default:
-                        dev_err(adap->pdev_dev, "Micron Flash Part has bad size, ID = %#x, Density code = %#x\n",
-                                flashid, density);
-                        return -EINVAL;
                 }
                 break;
         }
@@ -8792,10 +8787,6 @@ static int t4_get_flash_params(struct adapter *adap)
                 case 0x17: /* 64MB */
                         size = 1 << 26;
                         break;
-                default:
-                        dev_err(adap->pdev_dev, "ISSI Flash Part has bad size, ID = %#x, Density code = %#x\n",
-                                flashid, density);
-                        return -EINVAL;
                 }
                 break;
         }
@@ -8811,10 +8802,6 @@ static int t4_get_flash_params(struct adapter *adap)
                 case 0x18: /* 16MB */
                         size = 1 << 24;
                         break;
-                default:
-                        dev_err(adap->pdev_dev, "Macronix Flash Part has bad size, ID = %#x, Density code = %#x\n",
-                                flashid, density);
-                        return -EINVAL;
                 }
                 break;
         }
@@ -8830,17 +8817,21 @@ static int t4_get_flash_params(struct adapter *adap)
                 case 0x18: /* 16MB */
                         size = 1 << 24;
                         break;
-                default:
-                        dev_err(adap->pdev_dev, "Winbond Flash Part has bad size, ID = %#x, Density code = %#x\n",
-                                flashid, density);
-                        return -EINVAL;
                 }
                 break;
         }
-        default:
-                dev_err(adap->pdev_dev, "Unsupported Flash Part, ID = %#x\n",
-                        flashid);
-                return -EINVAL;
+        }
+
+        /* If we didn't recognize the FLASH part, that's no real issue: the
+         * Hardware/Software contract says that Hardware will _*ALWAYS*_
+         * use a FLASH part which is at least 4MB in size and has 64KB
+         * sectors.  The unrecognized FLASH part is likely to be much larger
+         * than 4MB, but that's all we really need.
+         */
+        if (size == 0) {
+                dev_warn(adap->pdev_dev, "Unknown Flash Part, ID = %#x, assuming 4MB\n",
+                         flashid);
+                size = 1 << 22;
         }
 
         /* Store decoded Flash size and fall through into vetting code. */
diff --git a/drivers/net/ethernet/cirrus/Kconfig b/drivers/net/ethernet/cirrus/Kconfig
index 5ab912937aff..ec0b545197e2 100644
--- a/drivers/net/ethernet/cirrus/Kconfig
+++ b/drivers/net/ethernet/cirrus/Kconfig
@@ -19,6 +19,7 @@ if NET_VENDOR_CIRRUS
 config CS89x0
         tristate "CS89x0 support"
         depends on ISA || EISA || ARM
+        depends on !PPC32
         ---help---
           Support for CS89x0 chipset based Ethernet cards. If you have a
           network (Ethernet) card of this type, say Y and read the file
diff --git a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
index 5f4e1ffa7b95..ab02057ac730 100644
--- a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
+++ b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
@@ -125,6 +125,9 @@ MODULE_PARM_DESC(tx_timeout, "The Tx timeout in ms");
 /* Default alignment for start of data in an Rx FD */
 #define DPAA_FD_DATA_ALIGNMENT  16
 
+/* The DPAA requires 256 bytes reserved and mapped for the SGT */
+#define DPAA_SGT_SIZE 256
+
 /* Values for the L3R field of the FM Parse Results
  */
 /* L3 Type field: First IP Present IPv4 */
@@ -1617,8 +1620,8 @@ static struct sk_buff *dpaa_cleanup_tx_fd(const struct dpaa_priv *priv,
 
         if (unlikely(qm_fd_get_format(fd) == qm_fd_sg)) {
                 nr_frags = skb_shinfo(skb)->nr_frags;
-                dma_unmap_single(dev, addr, qm_fd_get_offset(fd) +
-                                 sizeof(struct qm_sg_entry) * (1 + nr_frags),
+                dma_unmap_single(dev, addr,
+                                 qm_fd_get_offset(fd) + DPAA_SGT_SIZE,
                                  dma_dir);
 
                 /* The sgt buffer has been allocated with netdev_alloc_frag(),
@@ -1903,8 +1906,7 @@ static int skb_to_sg_fd(struct dpaa_priv *priv,
         void *sgt_buf;
 
         /* get a page frag to store the SGTable */
-        sz = SKB_DATA_ALIGN(priv->tx_headroom +
-                sizeof(struct qm_sg_entry) * (1 + nr_frags));
+        sz = SKB_DATA_ALIGN(priv->tx_headroom + DPAA_SGT_SIZE);
         sgt_buf = netdev_alloc_frag(sz);
         if (unlikely(!sgt_buf)) {
                 netdev_err(net_dev, "netdev_alloc_frag() failed for size %d\n",
@@ -1972,9 +1974,8 @@ static int skb_to_sg_fd(struct dpaa_priv *priv,
         skbh = (struct sk_buff **)buffer_start;
         *skbh = skb;
 
-        addr = dma_map_single(dev, buffer_start, priv->tx_headroom +
-                              sizeof(struct qm_sg_entry) * (1 + nr_frags),
-                              dma_dir);
+        addr = dma_map_single(dev, buffer_start,
+                              priv->tx_headroom + DPAA_SGT_SIZE, dma_dir);
         if (unlikely(dma_mapping_error(dev, addr))) {
                 dev_err(dev, "DMA mapping failed");
                 err = -EINVAL;
diff --git a/drivers/net/ethernet/freescale/fman/fman_port.c b/drivers/net/ethernet/freescale/fman/fman_port.c
index ce6e24c74978..ecbf6187e13a 100644
--- a/drivers/net/ethernet/freescale/fman/fman_port.c
+++ b/drivers/net/ethernet/freescale/fman/fman_port.c
@@ -324,6 +324,10 @@ struct fman_port_qmi_regs {
 #define HWP_HXS_PHE_REPORT 0x00000800
 #define HWP_HXS_PCAC_PSTAT 0x00000100
 #define HWP_HXS_PCAC_PSTOP 0x00000001
+#define HWP_HXS_TCP_OFFSET 0xA
+#define HWP_HXS_UDP_OFFSET 0xB
+#define HWP_HXS_SH_PAD_REM 0x80000000
+
 struct fman_port_hwp_regs {
         struct {
                 u32 ssa; /* Soft Sequence Attachment */
@@ -728,6 +732,10 @@ static void init_hwp(struct fman_port *port)
                 iowrite32be(0xffffffff, &regs->pmda[i].lcv);
         }
 
+        /* Short packet padding removal from checksum calculation */
+        iowrite32be(HWP_HXS_SH_PAD_REM, &regs->pmda[HWP_HXS_TCP_OFFSET].ssa);
+        iowrite32be(HWP_HXS_SH_PAD_REM, &regs->pmda[HWP_HXS_UDP_OFFSET].ssa);
+
         start_port_hwp(port);
 }
 
diff --git a/drivers/net/ethernet/huawei/hinic/hinic_rx.c b/drivers/net/ethernet/huawei/hinic/hinic_rx.c
index e2e5cdc7119c..4c0f7eda1166 100644
--- a/drivers/net/ethernet/huawei/hinic/hinic_rx.c
+++ b/drivers/net/ethernet/huawei/hinic/hinic_rx.c
@@ -439,6 +439,7 @@ static void rx_free_irq(struct hinic_rxq *rxq)
 {
         struct hinic_rq *rq = rxq->rq;
 
+        irq_set_affinity_hint(rq->irq, NULL);
         free_irq(rq->irq, rxq);
         rx_del_napi(rxq);
 }
diff --git a/drivers/net/ethernet/huawei/hinic/hinic_tx.c b/drivers/net/ethernet/huawei/hinic/hinic_tx.c
index 9128858479c4..2353ec829c04 100644
--- a/drivers/net/ethernet/huawei/hinic/hinic_tx.c
+++ b/drivers/net/ethernet/huawei/hinic/hinic_tx.c
@@ -229,6 +229,7 @@ netdev_tx_t hinic_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
                 txq->txq_stats.tx_busy++;
                 u64_stats_update_end(&txq->txq_stats.syncp);
                 err = NETDEV_TX_BUSY;
+                wqe_size = 0;
                 goto flush_skbs;
         }
 
diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
index d0e196bff081..ffe7acbeaa22 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.c
+++ b/drivers/net/ethernet/ibm/ibmvnic.c
@@ -329,7 +329,8 @@ static void replenish_rx_pool(struct ibmvnic_adapter *adapter,
         return;
 
 failure:
-        dev_info(dev, "replenish pools failure\n");
+        if (lpar_rc != H_PARAMETER && lpar_rc != H_CLOSED)
+                dev_err_ratelimited(dev, "rx: replenish packet buffer failed\n");
         pool->free_map[pool->next_free] = index;
         pool->rx_buff[index].skb = NULL;
 
@@ -1617,7 +1618,8 @@ static int ibmvnic_xmit(struct sk_buff *skb, struct net_device *netdev)
                                       &tx_crq);
         }
         if (lpar_rc != H_SUCCESS) {
-                dev_err(dev, "tx failed with code %ld\n", lpar_rc);
+                if (lpar_rc != H_CLOSED && lpar_rc != H_PARAMETER)
+                        dev_err_ratelimited(dev, "tx: send failed\n");
                 dev_kfree_skb_any(skb);
                 tx_buff->skb = NULL;
 
@@ -1825,8 +1827,8 @@ static int do_reset(struct ibmvnic_adapter *adapter,
 
                 rc = ibmvnic_login(netdev);
                 if (rc) {
-                        adapter->state = VNIC_PROBED;
-                        return 0;
+                        adapter->state = reset_state;
+                        return rc;
                 }
 
                 if (adapter->reset_reason == VNIC_RESET_CHANGE_PARAM ||
@@ -3204,6 +3206,25 @@ static union ibmvnic_crq *ibmvnic_next_crq(struct ibmvnic_adapter *adapter)
         return crq;
 }
 
+static void print_subcrq_error(struct device *dev, int rc, const char *func)
+{
+        switch (rc) {
+        case H_PARAMETER:
+                dev_warn_ratelimited(dev,
+                                     "%s failed: Send request is malformed or adapter failover pending. (rc=%d)\n",
+                                     func, rc);
+                break;
+        case H_CLOSED:
+                dev_warn_ratelimited(dev,
+                                     "%s failed: Backing queue closed. Adapter is down or failover pending. (rc=%d)\n",
+                                     func, rc);
+                break;
+        default:
+                dev_err_ratelimited(dev, "%s failed: (rc=%d)\n", func, rc);
+                break;
+        }
+}
+
 static int send_subcrq(struct ibmvnic_adapter *adapter, u64 remote_handle,
                        union sub_crq *sub_crq)
 {
@@ -3230,11 +3251,8 @@ static int send_subcrq(struct ibmvnic_adapter *adapter, u64 remote_handle,
                                 cpu_to_be64(u64_crq[2]),
                                 cpu_to_be64(u64_crq[3]));
 
-        if (rc) {
-                if (rc == H_CLOSED)
-                        dev_warn(dev, "CRQ Queue closed\n");
-                dev_err(dev, "Send error (rc=%d)\n", rc);
-        }
+        if (rc)
+                print_subcrq_error(dev, rc, __func__);
 
         return rc;
 }
@@ -3252,11 +3270,8 @@ static int send_subcrq_indirect(struct ibmvnic_adapter *adapter,
                                 cpu_to_be64(remote_handle),
                                 ioba, num_entries);
 
-        if (rc) {
-                if (rc == H_CLOSED)
-                        dev_warn(dev, "CRQ Queue closed\n");
-                dev_err(dev, "Send (indirect) error (rc=%d)\n", rc);
-        }
+        if (rc)
+                print_subcrq_error(dev, rc, __func__);
 
         return rc;
 }
diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.c b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
index ed6dbcfd4e96..b151ae316546 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
@@ -2199,9 +2199,10 @@ static bool i40e_is_non_eop(struct i40e_ring *rx_ring,
         return true;
 }
 
-#define I40E_XDP_PASS 0
-#define I40E_XDP_CONSUMED 1
-#define I40E_XDP_TX 2
+#define I40E_XDP_PASS           0
+#define I40E_XDP_CONSUMED       BIT(0)
+#define I40E_XDP_TX             BIT(1)
+#define I40E_XDP_REDIR          BIT(2)
 
 static int i40e_xmit_xdp_ring(struct xdp_frame *xdpf,
                               struct i40e_ring *xdp_ring);
@@ -2248,7 +2249,7 @@ static struct sk_buff *i40e_run_xdp(struct i40e_ring *rx_ring,
                 break;
         case XDP_REDIRECT:
                 err = xdp_do_redirect(rx_ring->netdev, xdp, xdp_prog);
-                result = !err ? I40E_XDP_TX : I40E_XDP_CONSUMED;
+                result = !err ? I40E_XDP_REDIR : I40E_XDP_CONSUMED;
                 break;
         default:
                 bpf_warn_invalid_xdp_action(act);
@@ -2311,7 +2312,8 @@ static int i40e_clean_rx_irq(struct i40e_ring *rx_ring, int budget)
         unsigned int total_rx_bytes = 0, total_rx_packets = 0;
         struct sk_buff *skb = rx_ring->skb;
         u16 cleaned_count = I40E_DESC_UNUSED(rx_ring);
-        bool failure = false, xdp_xmit = false;
+        unsigned int xdp_xmit = 0;
+        bool failure = false;
         struct xdp_buff xdp;
 
         xdp.rxq = &rx_ring->xdp_rxq;
@@ -2372,8 +2374,10 @@ static int i40e_clean_rx_irq(struct i40e_ring *rx_ring, int budget)
                 }
 
                 if (IS_ERR(skb)) {
-                        if (PTR_ERR(skb) == -I40E_XDP_TX) {
-                                xdp_xmit = true;
+                        unsigned int xdp_res = -PTR_ERR(skb);
+
+                        if (xdp_res & (I40E_XDP_TX | I40E_XDP_REDIR)) {
+                                xdp_xmit |= xdp_res;
                                 i40e_rx_buffer_flip(rx_ring, rx_buffer, size);
                         } else {
                                 rx_buffer->pagecnt_bias++;
@@ -2427,12 +2431,14 @@ static int i40e_clean_rx_irq(struct i40e_ring *rx_ring, int budget)
                 total_rx_packets++;
         }
 
-        if (xdp_xmit) {
+        if (xdp_xmit & I40E_XDP_REDIR)
+                xdp_do_flush_map();
+
+        if (xdp_xmit & I40E_XDP_TX) {
                 struct i40e_ring *xdp_ring =
                         rx_ring->vsi->xdp_rings[rx_ring->queue_index];
 
                 i40e_xdp_ring_update_tail(xdp_ring);
-                xdp_do_flush_map();
         }
 
         rx_ring->skb = skb;
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c
index 3f5c350716bb..0bd1294ba517 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c
@@ -1871,7 +1871,12 @@ s32 ixgbe_set_rar_generic(struct ixgbe_hw *hw, u32 index, u8 *addr, u32 vmdq,
         if (enable_addr != 0)
                 rar_high |= IXGBE_RAH_AV;
 
+        /* Record lower 32 bits of MAC address and then make
+         * sure that write is flushed to hardware before writing
+         * the upper 16 bits and setting the valid bit.
+         */
         IXGBE_WRITE_REG(hw, IXGBE_RAL(index), rar_low);
+        IXGBE_WRITE_FLUSH(hw);
         IXGBE_WRITE_REG(hw, IXGBE_RAH(index), rar_high);
 
         return 0;
@@ -1903,8 +1908,13 @@ s32 ixgbe_clear_rar_generic(struct ixgbe_hw *hw, u32 index)
         rar_high = IXGBE_READ_REG(hw, IXGBE_RAH(index));
         rar_high &= ~(0x0000FFFF | IXGBE_RAH_AV);
 
-        IXGBE_WRITE_REG(hw, IXGBE_RAL(index), 0);
+        /* Clear the address valid bit and upper 16 bits of the address
+         * before clearing the lower bits. This way we aren't updating
+         * a live filter.
+         */
         IXGBE_WRITE_REG(hw, IXGBE_RAH(index), rar_high);
+        IXGBE_WRITE_FLUSH(hw);
+        IXGBE_WRITE_REG(hw, IXGBE_RAL(index), 0);
 
         /* clear VMDq pool/queue selection for this RAR */
         hw->mac.ops.clear_vmdq(hw, index, IXGBE_CLEAR_VMDQ_ALL);
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
index c116f459945d..da4322e4daed 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
@@ -839,7 +839,7 @@ int ixgbe_ipsec_tx(struct ixgbe_ring *tx_ring,
         }
 
         itd->sa_idx = xs->xso.offload_handle - IXGBE_IPSEC_BASE_TX_INDEX;
-        if (unlikely(itd->sa_idx > IXGBE_IPSEC_MAX_SA_COUNT)) {
+        if (unlikely(itd->sa_idx >= IXGBE_IPSEC_MAX_SA_COUNT)) {
                 netdev_err(tx_ring->netdev, "%s: bad sa_idx=%d handle=%lu\n",
                            __func__, itd->sa_idx, xs->xso.offload_handle);
                 return 0;
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index 3e87dbbc9024..62e57b05a0ae 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -2186,9 +2186,10 @@ static struct sk_buff *ixgbe_build_skb(struct ixgbe_ring *rx_ring,
         return skb;
 }
 
-#define IXGBE_XDP_PASS 0
-#define IXGBE_XDP_CONSUMED 1
-#define IXGBE_XDP_TX 2
+#define IXGBE_XDP_PASS          0
+#define IXGBE_XDP_CONSUMED      BIT(0)
+#define IXGBE_XDP_TX            BIT(1)
+#define IXGBE_XDP_REDIR         BIT(2)
 
 static int ixgbe_xmit_xdp_ring(struct ixgbe_adapter *adapter,
                                struct xdp_frame *xdpf);
@@ -2225,7 +2226,7 @@ static struct sk_buff *ixgbe_run_xdp(struct ixgbe_adapter *adapter,
         case XDP_REDIRECT:
                 err = xdp_do_redirect(adapter->netdev, xdp, xdp_prog);
                 if (!err)
-                        result = IXGBE_XDP_TX;
+                        result = IXGBE_XDP_REDIR;
                 else
                         result = IXGBE_XDP_CONSUMED;
                 break;
@@ -2285,7 +2286,7 @@ static int ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector,
         unsigned int mss = 0;
 #endif /* IXGBE_FCOE */
         u16 cleaned_count = ixgbe_desc_unused(rx_ring);
-        bool xdp_xmit = false;
+        unsigned int xdp_xmit = 0;
         struct xdp_buff xdp;
 
         xdp.rxq = &rx_ring->xdp_rxq;
@@ -2328,8 +2329,10 @@ static int ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector,
                 }
 
                 if (IS_ERR(skb)) {
-                        if (PTR_ERR(skb) == -IXGBE_XDP_TX) {
-                                xdp_xmit = true;
+                        unsigned int xdp_res = -PTR_ERR(skb);
+
+                        if (xdp_res & (IXGBE_XDP_TX | IXGBE_XDP_REDIR)) {
+                                xdp_xmit |= xdp_res;
                                 ixgbe_rx_buffer_flip(rx_ring, rx_buffer, size);
                         } else {
                                 rx_buffer->pagecnt_bias++;
@@ -2401,7 +2404,10 @@ static int ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector,
                 total_rx_packets++;
         }
 
-        if (xdp_xmit) {
+        if (xdp_xmit & IXGBE_XDP_REDIR)
+                xdp_do_flush_map();
+
+        if (xdp_xmit & IXGBE_XDP_TX) {
                 struct ixgbe_ring *ring = adapter->xdp_ring[smp_processor_id()];
 
                 /* Force memory writes to complete before letting h/w
@@ -2409,8 +2415,6 @@ static int ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector,
                  */
                 wmb();
                 writel(ring->next_to_use, ring->tail);
-
-                xdp_do_flush_map();
         }
 
         u64_stats_update_begin(&rx_ring->syncp);
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_rx.c b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
index 9f54ccbddea7..3360f7b9ee73 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_rx.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
@@ -474,10 +474,10 @@ static int mlx4_en_complete_rx_desc(struct mlx4_en_priv *priv,
 {
         const struct mlx4_en_frag_info *frag_info = priv->frag_info;
         unsigned int truesize = 0;
+        bool release = true;
         int nr, frag_size;
         struct page *page;
         dma_addr_t dma;
-        bool release;
 
         /* Collect used fragments while replacing them in the HW descriptors */
         for (nr = 0;; frags++) {
@@ -500,7 +500,11 @@ static int mlx4_en_complete_rx_desc(struct mlx4_en_priv *priv,
                         release = page_count(page) != 1 ||
                                   page_is_pfmemalloc(page) ||
                                   page_to_nid(page) != numa_mem_id();
-                } else {
+                } else if (!priv->rx_headroom) {
+                        /* rx_headroom for non XDP setup is always 0.
+                         * When XDP is set, the above condition will
+                         * guarantee page is always released.
+                         */
                         u32 sz_align = ALIGN(frag_size, SMP_CACHE_BYTES);
 
                         frags->page_offset += sz_align;
diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
index 7b1b5ac986d0..31bd56727022 100644
--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
+++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
@@ -2958,7 +2958,7 @@ int mlx4_RST2INIT_QP_wrapper(struct mlx4_dev *dev, int slave,
         u32 srqn = qp_get_srqn(qpc) & 0xffffff;
         int use_srq = (qp_get_srqn(qpc) >> 24) & 1;
         struct res_srq *srq;
-        int local_qpn = be32_to_cpu(qpc->local_qpn) & 0xffffff;
+        int local_qpn = vhcr->in_modifier & 0xffffff;
 
         err = adjust_qp_sched_queue(dev, slave, qpc, inbox);
         if (err)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/alloc.c b/drivers/net/ethernet/mellanox/mlx5/core/alloc.c
index 323ffe8bf7e4..456f30007ad6 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/alloc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/alloc.c
@@ -123,7 +123,7 @@ int mlx5_frag_buf_alloc_node(struct mlx5_core_dev *dev, int size,
         int i;
 
         buf->size = size;
-        buf->npages = 1 << get_order(size);
+        buf->npages = DIV_ROUND_UP(size, PAGE_SIZE);
         buf->page_shift = PAGE_SHIFT;
         buf->frags = kcalloc(buf->npages, sizeof(struct mlx5_buf_list),
                              GFP_KERNEL);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
index 487388aed98f..384c1fa49081 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
@@ -807,6 +807,7 @@ static void cmd_work_handler(struct work_struct *work)
         unsigned long flags;
         bool poll_cmd = ent->polling;
         int alloc_ret;
+        int cmd_mode;
 
         sem = ent->page_queue ? &cmd->pages_sem : &cmd->sem;
         down(sem);
@@ -853,6 +854,7 @@ static void cmd_work_handler(struct work_struct *work)
         set_signature(ent, !cmd->checksum_disabled);
         dump_command(dev, ent, 1);
         ent->ts1 = ktime_get_ns();
+        cmd_mode = cmd->mode;
 
         if (ent->callback)
                 schedule_delayed_work(&ent->cb_timeout_work, cb_timeout);
@@ -877,7 +879,7 @@ static void cmd_work_handler(struct work_struct *work)
         iowrite32be(1 << ent->idx, &dev->iseg->cmd_dbell);
         mmiowb();
         /* if not in polling don't use ent after this point */
-        if (cmd->mode == CMD_MODE_POLLING || poll_cmd) {
+        if (cmd_mode == CMD_MODE_POLLING || poll_cmd) {
                 poll_timeout(ent);
                 /* make sure we read the descriptor after ownership is SW */
                 rmb();
@@ -1276,7 +1278,7 @@ static ssize_t outlen_write(struct file *filp, const char __user *buf,
 {
         struct mlx5_core_dev *dev = filp->private_data;
         struct mlx5_cmd_debug *dbg = &dev->cmd.dbg;
-        char outlen_str[8];
+        char outlen_str[8] = {0};
         int outlen;
         void *ptr;
         int err;
@@ -1291,8 +1293,6 @@ static ssize_t outlen_write(struct file *filp, const char __user *buf,
         if (copy_from_user(outlen_str, buf, count))
                 return -EFAULT;
 
-        outlen_str[7] = 0;
-
         err = sscanf(outlen_str, "%d", &outlen);
         if (err < 0)
                 return err;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c
index 75e4308ba786..d258bb679271 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c
@@ -381,14 +381,14 @@ static void arfs_may_expire_flow(struct mlx5e_priv *priv)
         HLIST_HEAD(del_list);
         spin_lock_bh(&priv->fs.arfs.arfs_lock);
         mlx5e_for_each_arfs_rule(arfs_rule, htmp, priv->fs.arfs.arfs_tables, i, j) {
-                if (quota++ > MLX5E_ARFS_EXPIRY_QUOTA)
-                        break;
                 if (!work_pending(&arfs_rule->arfs_work) &&
                     rps_may_expire_flow(priv->netdev,
                                         arfs_rule->rxq, arfs_rule->flow_id,
                                         arfs_rule->filter_id)) {
                         hlist_del_init(&arfs_rule->hlist);
                         hlist_add_head(&arfs_rule->hlist, &del_list);
+                        if (quota++ > MLX5E_ARFS_EXPIRY_QUOTA)
+                                break;
                 }
         }
         spin_unlock_bh(&priv->fs.arfs.arfs_lock);
@@ -711,6 +711,9 @@ int mlx5e_rx_flow_steer(struct net_device *dev, const struct sk_buff *skb,
             skb->protocol != htons(ETH_P_IPV6))
                 return -EPROTONOSUPPORT;
 
+        if (skb->encapsulation)
+                return -EPROTONOSUPPORT;
+
         arfs_t = arfs_get_table(arfs, arfs_get_ip_proto(skb), skb->protocol);
         if (!arfs_t)
                 return -EPROTONOSUPPORT;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
index 0a52f31fef37..86bc9ac99586 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
@@ -275,7 +275,8 @@ int mlx5e_dcbnl_ieee_setets_core(struct mlx5e_priv *priv, struct ieee_ets *ets)
 }
 
 static int mlx5e_dbcnl_validate_ets(struct net_device *netdev,
-                                    struct ieee_ets *ets)
+                                    struct ieee_ets *ets,
+                                    bool zero_sum_allowed)
 {
         bool have_ets_tc = false;
         int bw_sum = 0;
@@ -300,8 +301,9 @@ static int mlx5e_dbcnl_validate_ets(struct net_device *netdev,
         }
 
         if (have_ets_tc && bw_sum != 100) {
-                netdev_err(netdev,
-                           "Failed to validate ETS: BW sum is illegal\n");
+                if (bw_sum || (!bw_sum && !zero_sum_allowed))
+                        netdev_err(netdev,
+                                   "Failed to validate ETS: BW sum is illegal\n");
                 return -EINVAL;
         }
         return 0;
@@ -316,7 +318,7 @@ static int mlx5e_dcbnl_ieee_setets(struct net_device *netdev,
         if (!MLX5_CAP_GEN(priv->mdev, ets))
                 return -EOPNOTSUPP;
 
-        err = mlx5e_dbcnl_validate_ets(netdev, ets);
+        err = mlx5e_dbcnl_validate_ets(netdev, ets, false);
         if (err)
                 return err;
 
@@ -642,12 +644,9 @@ static u8 mlx5e_dcbnl_setall(struct net_device *netdev)
                           ets.prio_tc[i]);
         }
 
-        err = mlx5e_dbcnl_validate_ets(netdev, &ets);
-        if (err) {
-                netdev_err(netdev,
-                           "%s, Failed to validate ETS: %d\n", __func__, err);
+        err = mlx5e_dbcnl_validate_ets(netdev, &ets, true);
+        if (err)
                 goto out;
-        }
 
         err = mlx5e_dcbnl_ieee_setets_core(priv, &ets);
         if (err) {
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index 56c1b6f5593e..dae4156a710d 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -2846,7 +2846,7 @@ void mlx5e_activate_priv_channels(struct mlx5e_priv *priv)
         mlx5e_activate_channels(&priv->channels);
         netif_tx_start_all_queues(priv->netdev);
 
-        if (MLX5_VPORT_MANAGER(priv->mdev))
+        if (MLX5_ESWITCH_MANAGER(priv->mdev))
                 mlx5e_add_sqs_fwd_rules(priv);
 
         mlx5e_wait_channels_min_rx_wqes(&priv->channels);
@@ -2857,7 +2857,7 @@ void mlx5e_deactivate_priv_channels(struct mlx5e_priv *priv)
 {
         mlx5e_redirect_rqts_to_drop(priv);
 
-        if (MLX5_VPORT_MANAGER(priv->mdev))
+        if (MLX5_ESWITCH_MANAGER(priv->mdev))
                 mlx5e_remove_sqs_fwd_rules(priv);
 
         /* FIXME: This is a W/A only for tx timeout watch dog false alarm when
@@ -4597,7 +4597,7 @@ static void mlx5e_build_nic_netdev(struct net_device *netdev)
         mlx5e_set_netdev_dev_addr(netdev);
 
 #if IS_ENABLED(CONFIG_MLX5_ESWITCH)
-        if (MLX5_VPORT_MANAGER(mdev))
+        if (MLX5_ESWITCH_MANAGER(mdev))
                 netdev->switchdev_ops = &mlx5e_switchdev_ops;
 #endif
 
@@ -4753,7 +4753,7 @@ static void mlx5e_nic_enable(struct mlx5e_priv *priv)
 
         mlx5e_enable_async_events(priv);
 
-        if (MLX5_VPORT_MANAGER(priv->mdev))
+        if (MLX5_ESWITCH_MANAGER(priv->mdev))
                 mlx5e_register_vport_reps(priv);
 
         if (netdev->reg_state != NETREG_REGISTERED)
@@ -4788,7 +4788,7 @@ static void mlx5e_nic_disable(struct mlx5e_priv *priv)
 
         queue_work(priv->wq, &priv->set_rx_mode_work);
 
-        if (MLX5_VPORT_MANAGER(priv->mdev))
+        if (MLX5_ESWITCH_MANAGER(priv->mdev))
                 mlx5e_unregister_vport_reps(priv);
 
         mlx5e_disable_async_events(priv);
@@ -4972,7 +4972,7 @@ static void *mlx5e_add(struct mlx5_core_dev *mdev)
                 return NULL;
 
 #ifdef CONFIG_MLX5_ESWITCH
-        if (MLX5_VPORT_MANAGER(mdev)) {
+        if (MLX5_ESWITCH_MANAGER(mdev)) {
                 rpriv = mlx5e_alloc_nic_rep_priv(mdev);
                 if (!rpriv) {
                         mlx5_core_warn(mdev, "Failed to alloc NIC rep priv data\n");
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
index 57987f6546e8..2b8040a3cdbd 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
@@ -823,7 +823,7 @@ bool mlx5e_is_uplink_rep(struct mlx5e_priv *priv)
         struct mlx5e_rep_priv *rpriv = priv->ppriv;
         struct mlx5_eswitch_rep *rep;
 
-        if (!MLX5_CAP_GEN(priv->mdev, vport_group_manager))
+        if (!MLX5_ESWITCH_MANAGER(priv->mdev))
                 return false;
 
         rep = rpriv->rep;
@@ -837,8 +837,12 @@ bool mlx5e_is_uplink_rep(struct mlx5e_priv *priv)
 static bool mlx5e_is_vf_vport_rep(struct mlx5e_priv *priv)
 {
         struct mlx5e_rep_priv *rpriv = priv->ppriv;
-        struct mlx5_eswitch_rep *rep = rpriv->rep;
+        struct mlx5_eswitch_rep *rep;
 
+        if (!MLX5_ESWITCH_MANAGER(priv->mdev))
+                return false;
+
+        rep = rpriv->rep;
         if (rep && rep->vport != FDB_UPLINK_VPORT)
                 return true;
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
index 0edf4751a8ba..3a2c4e548226 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
@@ -1957,6 +1957,10 @@ static bool actions_match_supported(struct mlx5e_priv *priv,
         else
                 actions = flow->nic_attr->action;
 
+        if (flow->flags & MLX5E_TC_FLOW_EGRESS &&
+            !(actions & MLX5_FLOW_CONTEXT_ACTION_DECAP))
+                return false;
+
         if (actions & MLX5_FLOW_CONTEXT_ACTION_MOD_HDR)
                 return modify_header_match_supported(&parse_attr->spec, exts);
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
index f63dfbcd29fe..dd01ad4c0b54 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
@@ -1594,17 +1594,15 @@ static void esw_disable_vport(struct mlx5_eswitch *esw, int vport_num)
 }
 
 /* Public E-Switch API */
-#define ESW_ALLOWED(esw) ((esw) && MLX5_VPORT_MANAGER((esw)->dev))
+#define ESW_ALLOWED(esw) ((esw) && MLX5_ESWITCH_MANAGER((esw)->dev))
+
 
 int mlx5_eswitch_enable_sriov(struct mlx5_eswitch *esw, int nvfs, int mode)
 {
         int err;
         int i, enabled_events;
 
-        if (!ESW_ALLOWED(esw))
-                return 0;
-
-        if (!MLX5_CAP_GEN(esw->dev, eswitch_flow_table) ||
+        if (!ESW_ALLOWED(esw) ||
             !MLX5_CAP_ESW_FLOWTABLE_FDB(esw->dev, ft_support)) {
                 esw_warn(esw->dev, "E-Switch FDB is not supported, aborting ...\n");
                 return -EOPNOTSUPP;
@@ -1806,7 +1804,7 @@ int mlx5_eswitch_set_vport_mac(struct mlx5_eswitch *esw,
         u64 node_guid;
         int err = 0;
 
-        if (!ESW_ALLOWED(esw))
+        if (!MLX5_CAP_GEN(esw->dev, vport_group_manager))
                 return -EPERM;
         if (!LEGAL_VPORT(esw, vport) || is_multicast_ether_addr(mac))
                 return -EINVAL;
@@ -1883,7 +1881,7 @@ int mlx5_eswitch_get_vport_config(struct mlx5_eswitch *esw,
 {
         struct mlx5_vport *evport;
 
-        if (!ESW_ALLOWED(esw))
+        if (!MLX5_CAP_GEN(esw->dev, vport_group_manager))
                 return -EPERM;
         if (!LEGAL_VPORT(esw, vport))
                 return -EINVAL;
@@ -2218,6 +2216,6 @@ free_out:
 
 u8 mlx5_eswitch_mode(struct mlx5_eswitch *esw)
 {
-        return esw->mode;
+        return ESW_ALLOWED(esw) ? esw->mode : SRIOV_NONE;
 }
 EXPORT_SYMBOL_GPL(mlx5_eswitch_mode);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
index cecd201f0b73..91f1209886ff 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
@@ -1079,8 +1079,8 @@ static int mlx5_devlink_eswitch_check(struct devlink *devlink)
         if (MLX5_CAP_GEN(dev, port_type) != MLX5_CAP_PORT_TYPE_ETH)
                 return -EOPNOTSUPP;
 
-        if (!MLX5_CAP_GEN(dev, vport_group_manager))
-                return -EOPNOTSUPP;
+        if(!MLX5_ESWITCH_MANAGER(dev))
+                return -EPERM;
 
         if (dev->priv.eswitch->mode == SRIOV_NONE)
                 return -EOPNOTSUPP;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
index 49a75d31185e..6ddb2565884d 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
@@ -32,6 +32,7 @@
 
 #include <linux/mutex.h>
 #include <linux/mlx5/driver.h>
+#include <linux/mlx5/eswitch.h>
 
 #include "mlx5_core.h"
 #include "fs_core.h"
@@ -1886,7 +1887,7 @@ mlx5_add_flow_rules(struct mlx5_flow_table *ft,
         if (flow_act->action == MLX5_FLOW_CONTEXT_ACTION_FWD_NEXT_PRIO) {
                 if (!fwd_next_prio_supported(ft))
                         return ERR_PTR(-EOPNOTSUPP);
-                if (dest)
+                if (dest_num)
                         return ERR_PTR(-EINVAL);
                 mutex_lock(&root->chain_lock);
                 next_ft = find_next_chained_ft(prio);
@@ -2652,7 +2653,7 @@ int mlx5_init_fs(struct mlx5_core_dev *dev)
                         goto err;
         }
 
-        if (MLX5_CAP_GEN(dev, eswitch_flow_table)) {
+        if (MLX5_ESWITCH_MANAGER(dev)) {
                 if (MLX5_CAP_ESW_FLOWTABLE_FDB(dev, ft_support)) {
                         err = init_fdb_root_ns(steering);
                         if (err)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fw.c b/drivers/net/ethernet/mellanox/mlx5/core/fw.c
index afd9f4fa22f4..41ad24f0de2c 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fw.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fw.c
@@ -32,6 +32,7 @@
 
 #include <linux/mlx5/driver.h>
 #include <linux/mlx5/cmd.h>
+#include <linux/mlx5/eswitch.h>
 #include <linux/module.h>
 #include "mlx5_core.h"
 #include "../../mlxfw/mlxfw.h"
@@ -159,13 +160,13 @@ int mlx5_query_hca_caps(struct mlx5_core_dev *dev)
         }
 
         if (MLX5_CAP_GEN(dev, vport_group_manager) &&
-            MLX5_CAP_GEN(dev, eswitch_flow_table)) {
+            MLX5_ESWITCH_MANAGER(dev)) {
                 err = mlx5_core_get_caps(dev, MLX5_CAP_ESWITCH_FLOW_TABLE);
                 if (err)
                         return err;
         }
 
-        if (MLX5_CAP_GEN(dev, eswitch_flow_table)) {
+        if (MLX5_ESWITCH_MANAGER(dev)) {
                 err = mlx5_core_get_caps(dev, MLX5_CAP_ESWITCH);
                 if (err)
                         return err;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c
index 1e062e6b2587..3f767cde4c1d 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c
@@ -488,6 +488,7 @@ void mlx5_pps_event(struct mlx5_core_dev *mdev,
 void mlx5_init_clock(struct mlx5_core_dev *mdev)
 {
         struct mlx5_clock *clock = &mdev->clock;
+        u64 overflow_cycles;
         u64 ns;
         u64 frac = 0;
         u32 dev_freq;
@@ -511,10 +512,17 @@ void mlx5_init_clock(struct mlx5_core_dev *mdev)
 
         /* Calculate period in seconds to call the overflow watchdog - to make
          * sure counter is checked at least once every wrap around.
+         * The period is calculated as the minimum between max HW cycles count
+         * (The clock source mask) and max amount of cycles that can be
+         * multiplied by clock multiplier where the result doesn't exceed
+         * 64bits.
          */
-        ns = cyclecounter_cyc2ns(&clock->cycles, clock->cycles.mask,
+        overflow_cycles = div64_u64(~0ULL >> 1, clock->cycles.mult);
+        overflow_cycles = min(overflow_cycles, clock->cycles.mask >> 1);
+
+        ns = cyclecounter_cyc2ns(&clock->cycles, overflow_cycles,
                                  frac, &frac);
-        do_div(ns, NSEC_PER_SEC / 2 / HZ);
+        do_div(ns, NSEC_PER_SEC / HZ);
         clock->overflow_period = ns;
 
         mdev->clock_info_page = alloc_page(GFP_KERNEL);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/mpfs.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/mpfs.c
index 7cb67122e8b5..98359559c77e 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/lib/mpfs.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/mpfs.c
@@ -33,6 +33,7 @@
 #include <linux/etherdevice.h>
 #include <linux/mlx5/driver.h>
 #include <linux/mlx5/mlx5_ifc.h>
+#include <linux/mlx5/eswitch.h>
 #include "mlx5_core.h"
 #include "lib/mpfs.h"
 
@@ -98,7 +99,7 @@ int mlx5_mpfs_init(struct mlx5_core_dev *dev)
         int l2table_size = 1 << MLX5_CAP_GEN(dev, log_max_l2_table);
         struct mlx5_mpfs *mpfs;
 
-        if (!MLX5_VPORT_MANAGER(dev))
+        if (!MLX5_ESWITCH_MANAGER(dev))
                 return 0;
 
         mpfs = kzalloc(sizeof(*mpfs), GFP_KERNEL);
@@ -122,7 +123,7 @@ void mlx5_mpfs_cleanup(struct mlx5_core_dev *dev)
 {
         struct mlx5_mpfs *mpfs = dev->priv.mpfs;
 
-        if (!MLX5_VPORT_MANAGER(dev))
+        if (!MLX5_ESWITCH_MANAGER(dev))
                 return;
 
         WARN_ON(!hlist_empty(mpfs->hash));
@@ -137,7 +138,7 @@ int mlx5_mpfs_add_mac(struct mlx5_core_dev *dev, u8 *mac)
         u32 index;
         int err;
 
-        if (!MLX5_VPORT_MANAGER(dev))
+        if (!MLX5_ESWITCH_MANAGER(dev))
                 return 0;
 
         mutex_lock(&mpfs->lock);
@@ -179,7 +180,7 @@ int mlx5_mpfs_del_mac(struct mlx5_core_dev *dev, u8 *mac)
         int err = 0;
         u32 index;
 
-        if (!MLX5_VPORT_MANAGER(dev))
+        if (!MLX5_ESWITCH_MANAGER(dev))
                 return 0;
 
         mutex_lock(&mpfs->lock);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/port.c b/drivers/net/ethernet/mellanox/mlx5/core/port.c
index fa9d0760dd36..31a9cbd85689 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/port.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/port.c
@@ -701,7 +701,7 @@ EXPORT_SYMBOL_GPL(mlx5_query_port_prio_tc);
 static int mlx5_set_port_qetcr_reg(struct mlx5_core_dev *mdev, u32 *in,
                                    int inlen)
 {
-        u32 out[MLX5_ST_SZ_DW(qtct_reg)];
+        u32 out[MLX5_ST_SZ_DW(qetc_reg)];
 
         if (!MLX5_CAP_GEN(mdev, ets))
                 return -EOPNOTSUPP;
@@ -713,7 +713,7 @@ static int mlx5_set_port_qetcr_reg(struct mlx5_core_dev *mdev, u32 *in,
 static int mlx5_query_port_qetcr_reg(struct mlx5_core_dev *mdev, u32 *out,
                                      int outlen)
 {
-        u32 in[MLX5_ST_SZ_DW(qtct_reg)];
+        u32 in[MLX5_ST_SZ_DW(qetc_reg)];
 
         if (!MLX5_CAP_GEN(mdev, ets))
                 return -EOPNOTSUPP;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/sriov.c b/drivers/net/ethernet/mellanox/mlx5/core/sriov.c
index 2a8b529ce6dd..a0674962f02c 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/sriov.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/sriov.c
@@ -88,6 +88,9 @@ static int mlx5_device_enable_sriov(struct mlx5_core_dev *dev, int num_vfs)
                 return -EBUSY;
         }
 
+        if (!MLX5_ESWITCH_MANAGER(dev))
+                goto enable_vfs_hca;
+
         err = mlx5_eswitch_enable_sriov(dev->priv.eswitch, num_vfs, SRIOV_LEGACY);
         if (err) {
                 mlx5_core_warn(dev,
@@ -95,6 +98,7 @@ static int mlx5_device_enable_sriov(struct mlx5_core_dev *dev, int num_vfs)
                 return err;
         }
 
+enable_vfs_hca:
         for (vf = 0; vf < num_vfs; vf++) {
                 err = mlx5_core_enable_hca(dev, vf + 1);
                 if (err) {
@@ -140,7 +144,8 @@ static void mlx5_device_disable_sriov(struct mlx5_core_dev *dev)
         }
 
 out:
-        mlx5_eswitch_disable_sriov(dev->priv.eswitch);
+        if (MLX5_ESWITCH_MANAGER(dev))
+                mlx5_eswitch_disable_sriov(dev->priv.eswitch);
 
         if (mlx5_wait_for_vf_pages(dev))
                 mlx5_core_warn(dev, "timeout reclaiming VFs pages\n");
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/vport.c b/drivers/net/ethernet/mellanox/mlx5/core/vport.c
index 719cecb182c6..7eecd5b07bb1 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/vport.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/vport.c
@@ -549,8 +549,6 @@ int mlx5_modify_nic_vport_node_guid(struct mlx5_core_dev *mdev,
                 return -EINVAL;
         if (!MLX5_CAP_GEN(mdev, vport_group_manager))
                 return -EACCES;
-        if (!MLX5_CAP_ESW(mdev, nic_vport_node_guid_modify))
-                return -EOPNOTSUPP;
 
         in = kvzalloc(inlen, GFP_KERNEL);
         if (!in)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/wq.c b/drivers/net/ethernet/mellanox/mlx5/core/wq.c
index b97bb72b4db4..86478a6b99c5 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/wq.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/wq.c
@@ -113,35 +113,45 @@ err_db_free:
         return err;
 }
 
-static void mlx5e_qp_set_frag_buf(struct mlx5_frag_buf *buf,
-                                  struct mlx5_wq_qp *qp)
+static void mlx5_qp_set_frag_buf(struct mlx5_frag_buf *buf,
+                                 struct mlx5_wq_qp *qp)
 {
+        struct mlx5_frag_buf_ctrl *sq_fbc;
         struct mlx5_frag_buf *rqb, *sqb;
 
-        rqb = &qp->rq.fbc.frag_buf;
+        rqb  = &qp->rq.fbc.frag_buf;
         *rqb = *buf;
         rqb->size   = mlx5_wq_cyc_get_byte_size(&qp->rq);
-        rqb->npages = 1 << get_order(rqb->size);
+        rqb->npages = DIV_ROUND_UP(rqb->size, PAGE_SIZE);
 
-        sqb = &qp->sq.fbc.frag_buf;
-        *sqb = *buf;
-        sqb->size   = mlx5_wq_cyc_get_byte_size(&qp->rq);
-        sqb->npages = 1 << get_order(sqb->size);
+        sq_fbc = &qp->sq.fbc;
+        sqb    = &sq_fbc->frag_buf;
+        *sqb   = *buf;
+        sqb->size   = mlx5_wq_cyc_get_byte_size(&qp->sq);
+        sqb->npages = DIV_ROUND_UP(sqb->size, PAGE_SIZE);
         sqb->frags += rqb->npages; /* first part is for the rq */
+        if (sq_fbc->strides_offset)
+                sqb->frags--;
 }
 
 int mlx5_wq_qp_create(struct mlx5_core_dev *mdev, struct mlx5_wq_param *param,
                       void *qpc, struct mlx5_wq_qp *wq,
                       struct mlx5_wq_ctrl *wq_ctrl)
 {
+        u32 sq_strides_offset;
         int err;
 
         mlx5_fill_fbc(MLX5_GET(qpc, qpc, log_rq_stride) + 4,
                       MLX5_GET(qpc, qpc, log_rq_size),
                       &wq->rq.fbc);
-        mlx5_fill_fbc(ilog2(MLX5_SEND_WQE_BB),
-                      MLX5_GET(qpc, qpc, log_sq_size),
-                      &wq->sq.fbc);
+
+        sq_strides_offset =
+                ((wq->rq.fbc.frag_sz_m1 + 1) % PAGE_SIZE) / MLX5_SEND_WQE_BB;
+
+        mlx5_fill_fbc_offset(ilog2(MLX5_SEND_WQE_BB),
+                             MLX5_GET(qpc, qpc, log_sq_size),
+                             sq_strides_offset,
+                             &wq->sq.fbc);
 
         err = mlx5_db_alloc_node(mdev, &wq_ctrl->db, param->db_numa_node);
         if (err) {
@@ -156,7 +166,7 @@ int mlx5_wq_qp_create(struct mlx5_core_dev *mdev, struct mlx5_wq_param *param,
                 goto err_db_free;
         }
 
-        mlx5e_qp_set_frag_buf(&wq_ctrl->buf, wq);
+        mlx5_qp_set_frag_buf(&wq_ctrl->buf, wq);
 
         wq->rq.db  = &wq_ctrl->db.db[MLX5_RCV_DBR];
         wq->sq.db  = &wq_ctrl->db.db[MLX5_SND_DBR];
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
index 6aaaf3d9ba31..77b2adb29341 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
@@ -4756,6 +4756,12 @@ static void mlxsw_sp_rt6_destroy(struct mlxsw_sp_rt6 *mlxsw_sp_rt6)
         kfree(mlxsw_sp_rt6);
 }
 
+static bool mlxsw_sp_fib6_rt_can_mp(const struct fib6_info *rt)
+{
+        /* RTF_CACHE routes are ignored */
+        return (rt->fib6_flags & (RTF_GATEWAY | RTF_ADDRCONF)) == RTF_GATEWAY;
+}
+
 static struct fib6_info *
 mlxsw_sp_fib6_entry_rt(const struct mlxsw_sp_fib6_entry *fib6_entry)
 {
@@ -4765,11 +4771,11 @@ mlxsw_sp_fib6_entry_rt(const struct mlxsw_sp_fib6_entry *fib6_entry)
 
 static struct mlxsw_sp_fib6_entry *
 mlxsw_sp_fib6_node_mp_entry_find(const struct mlxsw_sp_fib_node *fib_node,
-                                 const struct fib6_info *nrt, bool append)
+                                 const struct fib6_info *nrt, bool replace)
 {
         struct mlxsw_sp_fib6_entry *fib6_entry;
 
-        if (!append)
+        if (!mlxsw_sp_fib6_rt_can_mp(nrt) || replace)
                 return NULL;
 
         list_for_each_entry(fib6_entry, &fib_node->entry_list, common.list) {
@@ -4784,7 +4790,8 @@ mlxsw_sp_fib6_node_mp_entry_find(const struct mlxsw_sp_fib_node *fib_node,
                         break;
                 if (rt->fib6_metric < nrt->fib6_metric)
                         continue;
-                if (rt->fib6_metric == nrt->fib6_metric)
+                if (rt->fib6_metric == nrt->fib6_metric &&
+                    mlxsw_sp_fib6_rt_can_mp(rt))
                         return fib6_entry;
                 if (rt->fib6_metric > nrt->fib6_metric)
                         break;
@@ -5163,7 +5170,7 @@ static struct mlxsw_sp_fib6_entry *
 mlxsw_sp_fib6_node_entry_find(const struct mlxsw_sp_fib_node *fib_node,
                               const struct fib6_info *nrt, bool replace)
 {
-        struct mlxsw_sp_fib6_entry *fib6_entry;
+        struct mlxsw_sp_fib6_entry *fib6_entry, *fallback = NULL;
 
         list_for_each_entry(fib6_entry, &fib_node->entry_list, common.list) {
                 struct fib6_info *rt = mlxsw_sp_fib6_entry_rt(fib6_entry);
@@ -5172,13 +5179,18 @@ mlxsw_sp_fib6_node_entry_find(const struct mlxsw_sp_fib_node *fib_node,
                         continue;
                 if (rt->fib6_table->tb6_id != nrt->fib6_table->tb6_id)
                         break;
-                if (replace && rt->fib6_metric == nrt->fib6_metric)
-                        return fib6_entry;
+                if (replace && rt->fib6_metric == nrt->fib6_metric) {
+                        if (mlxsw_sp_fib6_rt_can_mp(rt) ==
+                            mlxsw_sp_fib6_rt_can_mp(nrt))
+                                return fib6_entry;
+                        if (mlxsw_sp_fib6_rt_can_mp(nrt))
+                                fallback = fallback ?: fib6_entry;
+                }
                 if (rt->fib6_metric > nrt->fib6_metric)
-                        return fib6_entry;
+                        return fallback ?: fib6_entry;
         }
 
-        return NULL;
+        return fallback;
 }
 
 static int
@@ -5304,8 +5316,7 @@ static void mlxsw_sp_fib6_entry_replace(struct mlxsw_sp *mlxsw_sp,
 }
 
 static int mlxsw_sp_router_fib6_add(struct mlxsw_sp *mlxsw_sp,
-                                    struct fib6_info *rt, bool replace,
-                                    bool append)
+                                    struct fib6_info *rt, bool replace)
 {
         struct mlxsw_sp_fib6_entry *fib6_entry;
         struct mlxsw_sp_fib_node *fib_node;
@@ -5331,7 +5342,7 @@ static int mlxsw_sp_router_fib6_add(struct mlxsw_sp *mlxsw_sp,
         /* Before creating a new entry, try to append route to an existing
          * multipath entry.
          */
-        fib6_entry = mlxsw_sp_fib6_node_mp_entry_find(fib_node, rt, append);
+        fib6_entry = mlxsw_sp_fib6_node_mp_entry_find(fib_node, rt, replace);
         if (fib6_entry) {
                 err = mlxsw_sp_fib6_entry_nexthop_add(mlxsw_sp, fib6_entry, rt);
                 if (err)
@@ -5339,14 +5350,6 @@ static int mlxsw_sp_router_fib6_add(struct mlxsw_sp *mlxsw_sp,
                 return 0;
         }
 
-        /* We received an append event, yet did not find any route to
-         * append to.
-         */
-        if (WARN_ON(append)) {
-                err = -EINVAL;
-                goto err_fib6_entry_append;
-        }
-
         fib6_entry = mlxsw_sp_fib6_entry_create(mlxsw_sp, fib_node, rt);
         if (IS_ERR(fib6_entry)) {
                 err = PTR_ERR(fib6_entry);
@@ -5364,7 +5367,6 @@ static int mlxsw_sp_router_fib6_add(struct mlxsw_sp *mlxsw_sp,
 err_fib6_node_entry_link:
         mlxsw_sp_fib6_entry_destroy(mlxsw_sp, fib6_entry);
 err_fib6_entry_create:
-err_fib6_entry_append:
 err_fib6_entry_nexthop_add:
         mlxsw_sp_fib_node_put(mlxsw_sp, fib_node);
         return err;
@@ -5715,7 +5717,7 @@ static void mlxsw_sp_router_fib6_event_work(struct work_struct *work)
         struct mlxsw_sp_fib_event_work *fib_work =
                 container_of(work, struct mlxsw_sp_fib_event_work, work);
         struct mlxsw_sp *mlxsw_sp = fib_work->mlxsw_sp;
-        bool replace, append;
+        bool replace;
         int err;
 
         rtnl_lock();
@@ -5726,10 +5728,8 @@ static void mlxsw_sp_router_fib6_event_work(struct work_struct *work)
         case FIB_EVENT_ENTRY_APPEND: /* fall through */
         case FIB_EVENT_ENTRY_ADD:
                 replace = fib_work->event == FIB_EVENT_ENTRY_REPLACE;
-                append = fib_work->event == FIB_EVENT_ENTRY_APPEND;
                 err = mlxsw_sp_router_fib6_add(mlxsw_sp,
-                                               fib_work->fen6_info.rt, replace,
-                                               append);
+                                               fib_work->fen6_info.rt, replace);
                 if (err)
                         mlxsw_sp_router_fib_abort(mlxsw_sp);
                 mlxsw_sp_rt6_release(fib_work->fen6_info.rt);
diff --git a/drivers/net/ethernet/netronome/nfp/bpf/main.c b/drivers/net/ethernet/netronome/nfp/bpf/main.c
index fcdfb8e7fdea..40216d56dddc 100644
--- a/drivers/net/ethernet/netronome/nfp/bpf/main.c
+++ b/drivers/net/ethernet/netronome/nfp/bpf/main.c
@@ -81,10 +81,10 @@ nfp_bpf_xdp_offload(struct nfp_app *app, struct nfp_net *nn,
 
         ret = nfp_net_bpf_offload(nn, prog, running, extack);
         /* Stop offload if replace not possible */
-        if (ret && prog)
-                nfp_bpf_xdp_offload(app, nn, NULL, extack);
+        if (ret)
+                return ret;
 
-        nn->dp.bpf_offload_xdp = prog && !ret;
+        nn->dp.bpf_offload_xdp = !!prog;
         return ret;
 }
 
@@ -202,6 +202,9 @@ static int nfp_bpf_setup_tc_block(struct net_device *netdev,
         if (f->binder_type != TCF_BLOCK_BINDER_TYPE_CLSACT_INGRESS)
                 return -EOPNOTSUPP;
 
+        if (tcf_block_shared(f->block))
+                return -EOPNOTSUPP;
+
         switch (f->command) {
         case TC_BLOCK_BIND:
                 return tcf_block_cb_register(f->block,
diff --git a/drivers/net/ethernet/netronome/nfp/flower/match.c b/drivers/net/ethernet/netronome/nfp/flower/match.c
index 91935405f586..84f7a5dbea9d 100644
--- a/drivers/net/ethernet/netronome/nfp/flower/match.c
+++ b/drivers/net/ethernet/netronome/nfp/flower/match.c
@@ -123,6 +123,20 @@ nfp_flower_compile_mac(struct nfp_flower_mac_mpls *frame,
                          NFP_FLOWER_MASK_MPLS_Q;
 
                 frame->mpls_lse = cpu_to_be32(t_mpls);
+        } else if (dissector_uses_key(flow->dissector,
+                                      FLOW_DISSECTOR_KEY_BASIC)) {
+                /* Check for mpls ether type and set NFP_FLOWER_MASK_MPLS_Q
+                 * bit, which indicates an mpls ether type but without any
+                 * mpls fields.
+                 */
+                struct flow_dissector_key_basic *key_basic;
+
+                key_basic = skb_flow_dissector_target(flow->dissector,
+                                                      FLOW_DISSECTOR_KEY_BASIC,
+                                                      flow->key);
+                if (key_basic->n_proto == cpu_to_be16(ETH_P_MPLS_UC) ||
+                    key_basic->n_proto == cpu_to_be16(ETH_P_MPLS_MC))
+                        frame->mpls_lse = cpu_to_be32(NFP_FLOWER_MASK_MPLS_Q);
         }
 }
 
diff --git a/drivers/net/ethernet/netronome/nfp/flower/offload.c b/drivers/net/ethernet/netronome/nfp/flower/offload.c
index c42e64f32333..525057bee0ed 100644
--- a/drivers/net/ethernet/netronome/nfp/flower/offload.c
+++ b/drivers/net/ethernet/netronome/nfp/flower/offload.c
@@ -264,6 +264,14 @@ nfp_flower_calculate_key_layers(struct nfp_app *app,
                 case cpu_to_be16(ETH_P_ARP):
                         return -EOPNOTSUPP;
 
+                case cpu_to_be16(ETH_P_MPLS_UC):
+                case cpu_to_be16(ETH_P_MPLS_MC):
+                        if (!(key_layer & NFP_FLOWER_LAYER_MAC)) {
+                                key_layer |= NFP_FLOWER_LAYER_MAC;
+                                key_size += sizeof(struct nfp_flower_mac_mpls);
+                        }
+                        break;
+
                 /* Will be included in layer 2. */
                 case cpu_to_be16(ETH_P_8021Q):
                         break;
@@ -623,6 +631,9 @@ static int nfp_flower_setup_tc_block(struct net_device *netdev,
         if (f->binder_type != TCF_BLOCK_BINDER_TYPE_CLSACT_INGRESS)
                 return -EOPNOTSUPP;
 
+        if (tcf_block_shared(f->block))
+                return -EOPNOTSUPP;
+
         switch (f->command) {
         case TC_BLOCK_BIND:
                 return tcf_block_cb_register(f->block,
diff --git a/drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c b/drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c
index 78afe75129ab..382bb93cb090 100644
--- a/drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c
+++ b/drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c
@@ -317,7 +317,7 @@ nfp_tun_write_neigh(struct net_device *netdev, struct nfp_app *app,
         payload.dst_ipv4 = flow->daddr;
 
         /* If entry has expired send dst IP with all other fields 0. */
-        if (!(neigh->nud_state & NUD_VALID)) {
+        if (!(neigh->nud_state & NUD_VALID) || neigh->dead) {
                 nfp_tun_del_route_from_cache(app, payload.dst_ipv4);
                 /* Trigger ARP to verify invalid neighbour state. */
                 neigh_event_send(neigh, NULL);
diff --git a/drivers/net/ethernet/netronome/nfp/nfp_main.c b/drivers/net/ethernet/netronome/nfp/nfp_main.c
index 46b76d5a726c..152283d7e59c 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_main.c
+++ b/drivers/net/ethernet/netronome/nfp/nfp_main.c
@@ -240,7 +240,6 @@ static int nfp_pcie_sriov_read_nfd_limit(struct nfp_pf *pf)
                 return pci_sriov_set_totalvfs(pf->pdev, pf->limit_vfs);
 
         pf->limit_vfs = ~0;
-        pci_sriov_set_totalvfs(pf->pdev, 0); /* 0 is unset */
         /* Allow any setting for backwards compatibility if symbol not found */
         if (err == -ENOENT)
                 return 0;
@@ -668,7 +667,7 @@ static int nfp_pci_probe(struct pci_dev *pdev,
 
         err = nfp_net_pci_probe(pf);
         if (err)
-                goto err_sriov_unlimit;
+                goto err_fw_unload;
 
         err = nfp_hwmon_register(pf);
         if (err) {
@@ -680,8 +679,6 @@ static int nfp_pci_probe(struct pci_dev *pdev,
 
 err_net_remove:
         nfp_net_pci_remove(pf);
-err_sriov_unlimit:
-        pci_sriov_set_totalvfs(pf->pdev, 0);
 err_fw_unload:
         kfree(pf->rtbl);
         nfp_mip_close(pf->mip);
@@ -715,7 +712,6 @@ static void nfp_pci_remove(struct pci_dev *pdev)
         nfp_hwmon_unregister(pf);
 
         nfp_pcie_sriov_disable(pdev);
-        pci_sriov_set_totalvfs(pf->pdev, 0);
 
         nfp_net_pci_remove(pf);
 
diff --git a/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_nffw.c b/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_nffw.c
index cd34097b79f1..37a6d7822a38 100644
--- a/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_nffw.c
+++ b/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_nffw.c
@@ -232,7 +232,7 @@ struct nfp_nffw_info *nfp_nffw_info_open(struct nfp_cpp *cpp)
         err = nfp_cpp_read(cpp, nfp_resource_cpp_id(state->res),
                            nfp_resource_address(state->res),
                            fwinf, sizeof(*fwinf));
-        if (err < sizeof(*fwinf))
+        if (err < (int)sizeof(*fwinf))
                 goto err_release;
 
         if (!nffw_res_flg_init_get(fwinf))
diff --git a/drivers/net/ethernet/qlogic/qed/qed.h b/drivers/net/ethernet/qlogic/qed/qed.h
index 00db3401b898..1dfaccd151f0 100644
--- a/drivers/net/ethernet/qlogic/qed/qed.h
+++ b/drivers/net/ethernet/qlogic/qed/qed.h
@@ -502,6 +502,7 @@ enum BAR_ID {
 struct qed_nvm_image_info {
         u32 num_images;
         struct bist_nvm_image_att *image_att;
+        bool valid;
 };
 
 #define DRV_MODULE_VERSION                    \
diff --git a/drivers/net/ethernet/qlogic/qed/qed_dcbx.c b/drivers/net/ethernet/qlogic/qed/qed_dcbx.c
index f0b01385d5cb..e0680ce91328 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_dcbx.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_dcbx.c
@@ -709,9 +709,9 @@ qed_dcbx_get_local_lldp_params(struct qed_hwfn *p_hwfn,
         p_local = &p_hwfn->p_dcbx_info->lldp_local[LLDP_NEAREST_BRIDGE];
 
         memcpy(params->lldp_local.local_chassis_id, p_local->local_chassis_id,
-               ARRAY_SIZE(p_local->local_chassis_id));
+               sizeof(p_local->local_chassis_id));
         memcpy(params->lldp_local.local_port_id, p_local->local_port_id,
-               ARRAY_SIZE(p_local->local_port_id));
+               sizeof(p_local->local_port_id));
 }
 
 static void
@@ -723,9 +723,9 @@ qed_dcbx_get_remote_lldp_params(struct qed_hwfn *p_hwfn,
         p_remote = &p_hwfn->p_dcbx_info->lldp_remote[LLDP_NEAREST_BRIDGE];
 
         memcpy(params->lldp_remote.peer_chassis_id, p_remote->peer_chassis_id,
-               ARRAY_SIZE(p_remote->peer_chassis_id));
+               sizeof(p_remote->peer_chassis_id));
         memcpy(params->lldp_remote.peer_port_id, p_remote->peer_port_id,
-               ARRAY_SIZE(p_remote->peer_port_id));
+               sizeof(p_remote->peer_port_id));
 }
 
 static int
diff --git a/drivers/net/ethernet/qlogic/qed/qed_debug.c b/drivers/net/ethernet/qlogic/qed/qed_debug.c
index a14e48489029..4340c4c90bcb 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_debug.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_debug.c
@@ -6723,7 +6723,7 @@ static enum dbg_status qed_parse_mcp_trace_buf(u8 *trace_buf,
                 format_idx = header & MFW_TRACE_EVENTID_MASK;
 
                 /* Skip message if its index doesn't exist in the meta data */
-                if (format_idx > s_mcp_trace_meta.formats_num) {
+                if (format_idx >= s_mcp_trace_meta.formats_num) {
                         u8 format_size =
                                 (u8)((header & MFW_TRACE_PRM_SIZE_MASK) >>
                                      MFW_TRACE_PRM_SIZE_SHIFT);
diff --git a/drivers/net/ethernet/qlogic/qed/qed_dev.c b/drivers/net/ethernet/qlogic/qed/qed_dev.c
index 329781cda77f..e5249b4741d0 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_dev.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_dev.c
@@ -1804,7 +1804,7 @@ int qed_hw_init(struct qed_dev *cdev, struct qed_hw_init_params *p_params)
                         DP_INFO(p_hwfn, "Failed to update driver state\n");
 
                 rc = qed_mcp_ov_update_eswitch(p_hwfn, p_hwfn->p_main_ptt,
-                                               QED_OV_ESWITCH_VEB);
+                                               QED_OV_ESWITCH_NONE);
                 if (rc)
                         DP_INFO(p_hwfn, "Failed to update eswitch mode\n");
         }
diff --git a/drivers/net/ethernet/qlogic/qed/qed_l2.c b/drivers/net/ethernet/qlogic/qed/qed_l2.c
index 99973e10b179..5ede6408649d 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_l2.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_l2.c
@@ -665,7 +665,7 @@ qed_sp_update_mcast_bin(struct qed_hwfn *p_hwfn,
 
         p_ramrod->common.update_approx_mcast_flg = 1;
         for (i = 0; i < ETH_MULTICAST_MAC_BINS_IN_REGS; i++) {
-                u32 *p_bins = (u32 *)p_params->bins;
+                u32 *p_bins = p_params->bins;
 
                 p_ramrod->approx_mcast.bins[i] = cpu_to_le32(p_bins[i]);
         }
@@ -1476,8 +1476,8 @@ qed_sp_eth_filter_mcast(struct qed_hwfn *p_hwfn,
                         enum spq_mode comp_mode,
                         struct qed_spq_comp_cb *p_comp_data)
 {
-        unsigned long bins[ETH_MULTICAST_MAC_BINS_IN_REGS];
         struct vport_update_ramrod_data *p_ramrod = NULL;
+        u32 bins[ETH_MULTICAST_MAC_BINS_IN_REGS];
         struct qed_spq_entry *p_ent = NULL;
         struct qed_sp_init_data init_data;
         u8 abs_vport_id = 0;
@@ -1513,26 +1513,25 @@ qed_sp_eth_filter_mcast(struct qed_hwfn *p_hwfn,
         /* explicitly clear out the entire vector */
         memset(&p_ramrod->approx_mcast.bins, 0,
                sizeof(p_ramrod->approx_mcast.bins));
-        memset(bins, 0, sizeof(unsigned long) *
-               ETH_MULTICAST_MAC_BINS_IN_REGS);
+        memset(bins, 0, sizeof(bins));
         /* filter ADD op is explicit set op and it removes
          *  any existing filters for the vport
          */
         if (p_filter_cmd->opcode == QED_FILTER_ADD) {
                 for (i = 0; i < p_filter_cmd->num_mc_addrs; i++) {
-                        u32 bit;
+                        u32 bit, nbits;
 
                         bit = qed_mcast_bin_from_mac(p_filter_cmd->mac[i]);
-                        __set_bit(bit, bins);
+                        nbits = sizeof(u32) * BITS_PER_BYTE;
+                        bins[bit / nbits] |= 1 << (bit % nbits);
                 }
 
                 /* Convert to correct endianity */
                 for (i = 0; i < ETH_MULTICAST_MAC_BINS_IN_REGS; i++) {
                         struct vport_update_ramrod_mcast *p_ramrod_bins;
-                        u32 *p_bins = (u32 *)bins;
 
                         p_ramrod_bins = &p_ramrod->approx_mcast;
-                        p_ramrod_bins->bins[i] = cpu_to_le32(p_bins[i]);
+                        p_ramrod_bins->bins[i] = cpu_to_le32(bins[i]);
                 }
         }
 
diff --git a/drivers/net/ethernet/qlogic/qed/qed_l2.h b/drivers/net/ethernet/qlogic/qed/qed_l2.h
index 806a8da257e9..8d80f1095d17 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_l2.h
+++ b/drivers/net/ethernet/qlogic/qed/qed_l2.h
@@ -215,7 +215,7 @@ struct qed_sp_vport_update_params {
         u8                              anti_spoofing_en;
         u8                              update_accept_any_vlan_flg;
         u8                              accept_any_vlan;
-        unsigned long                   bins[8];
+        u32                             bins[8];
         struct qed_rss_params           *rss_params;
         struct qed_filter_accept_flags  accept_flags;
         struct qed_sge_tpa_params       *sge_tpa_params;
diff --git a/drivers/net/ethernet/qlogic/qed/qed_main.c b/drivers/net/ethernet/qlogic/qed/qed_main.c
index 5c10fd7210c3..758a9a5127fa 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_main.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_main.c
@@ -371,7 +371,7 @@ static struct qed_dev *qed_probe(struct pci_dev *pdev,
                 goto err2;
         }
 
-        DP_INFO(cdev, "qed_probe completed successffuly\n");
+        DP_INFO(cdev, "qed_probe completed successfully\n");
 
         return cdev;
 
@@ -789,6 +789,14 @@ static int qed_slowpath_setup_int(struct qed_dev *cdev,
         /* We want a minimum of one slowpath and one fastpath vector per hwfn */
         cdev->int_params.in.min_msix_cnt = cdev->num_hwfns * 2;
 
+        if (is_kdump_kernel()) {
+                DP_INFO(cdev,
+                        "Kdump kernel: Limit the max number of requested MSI-X vectors to %hd\n",
+                        cdev->int_params.in.min_msix_cnt);
+                cdev->int_params.in.num_vectors =
+                        cdev->int_params.in.min_msix_cnt;
+        }
+
         rc = qed_set_int_mode(cdev, false);
         if (rc)  {
                 DP_ERR(cdev, "qed_slowpath_setup_int ERR\n");
diff --git a/drivers/net/ethernet/qlogic/qed/qed_mcp.c b/drivers/net/ethernet/qlogic/qed/qed_mcp.c
index 4e0b443c9519..cdd645024a32 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_mcp.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_mcp.c
@@ -592,6 +592,9 @@ int qed_mcp_nvm_wr_cmd(struct qed_hwfn *p_hwfn,
         *o_mcp_resp = mb_params.mcp_resp;
         *o_mcp_param = mb_params.mcp_param;
 
+        /* nvm_info needs to be updated */
+        p_hwfn->nvm_info.valid = false;
+
         return 0;
 }
 
@@ -1208,6 +1211,7 @@ static void qed_mcp_handle_link_change(struct qed_hwfn *p_hwfn,
                 break;
         default:
                 p_link->speed = 0;
+                p_link->link_up = 0;
         }
 
         if (p_link->link_up && p_link->speed)
@@ -1305,9 +1309,15 @@ int qed_mcp_set_link(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt, bool b_up)
         phy_cfg.pause |= (params->pause.forced_tx) ? ETH_PAUSE_TX : 0;
         phy_cfg.adv_speed = params->speed.advertised_speeds;
         phy_cfg.loopback_mode = params->loopback_mode;
-        if (p_hwfn->mcp_info->capabilities & FW_MB_PARAM_FEATURE_SUPPORT_EEE) {
-                if (params->eee.enable)
-                        phy_cfg.eee_cfg |= EEE_CFG_EEE_ENABLED;
+
+        /* There are MFWs that share this capability regardless of whether
+         * this is feasible or not. And given that at the very least adv_caps
+         * would be set internally by qed, we want to make sure LFA would
+         * still work.
+         */
+        if ((p_hwfn->mcp_info->capabilities &
+             FW_MB_PARAM_FEATURE_SUPPORT_EEE) && params->eee.enable) {
+                phy_cfg.eee_cfg |= EEE_CFG_EEE_ENABLED;
                 if (params->eee.tx_lpi_enable)
                         phy_cfg.eee_cfg |= EEE_CFG_TX_LPI;
                 if (params->eee.adv_caps & QED_EEE_1G_ADV)
@@ -2555,11 +2565,14 @@ int qed_mcp_bist_nvm_get_image_att(struct qed_hwfn *p_hwfn,
 
 int qed_mcp_nvm_info_populate(struct qed_hwfn *p_hwfn)
 {
-        struct qed_nvm_image_info *nvm_info = &p_hwfn->nvm_info;
+        struct qed_nvm_image_info nvm_info;
         struct qed_ptt *p_ptt;
         int rc;
         u32 i;
 
+        if (p_hwfn->nvm_info.valid)
+                return 0;
+
         p_ptt = qed_ptt_acquire(p_hwfn);
         if (!p_ptt) {
                 DP_ERR(p_hwfn, "failed to acquire ptt\n");
@@ -2567,29 +2580,29 @@ int qed_mcp_nvm_info_populate(struct qed_hwfn *p_hwfn)
         }
 
         /* Acquire from MFW the amount of available images */
-        nvm_info->num_images = 0;
+        nvm_info.num_images = 0;
         rc = qed_mcp_bist_nvm_get_num_images(p_hwfn,
-                                             p_ptt, &nvm_info->num_images);
+                                             p_ptt, &nvm_info.num_images);
         if (rc == -EOPNOTSUPP) {
                 DP_INFO(p_hwfn, "DRV_MSG_CODE_BIST_TEST is not supported\n");
                 goto out;
-        } else if (rc || !nvm_info->num_images) {
+        } else if (rc || !nvm_info.num_images) {
                 DP_ERR(p_hwfn, "Failed getting number of images\n");
                 goto err0;
         }
 
-        nvm_info->image_att = kmalloc_array(nvm_info->num_images,
-                                            sizeof(struct bist_nvm_image_att),
-                                            GFP_KERNEL);
-        if (!nvm_info->image_att) {
+        nvm_info.image_att = kmalloc_array(nvm_info.num_images,
+                                           sizeof(struct bist_nvm_image_att),
+                                           GFP_KERNEL);
+        if (!nvm_info.image_att) {
                 rc = -ENOMEM;
                 goto err0;
         }
 
         /* Iterate over images and get their attributes */
-        for (i = 0; i < nvm_info->num_images; i++) {
+        for (i = 0; i < nvm_info.num_images; i++) {
                 rc = qed_mcp_bist_nvm_get_image_att(p_hwfn, p_ptt,
-                                                    &nvm_info->image_att[i], i);
+                                                    &nvm_info.image_att[i], i);
                 if (rc) {
                         DP_ERR(p_hwfn,
                                "Failed getting image index %d attributes\n", i);
@@ -2597,14 +2610,22 @@ int qed_mcp_nvm_info_populate(struct qed_hwfn *p_hwfn)
                 }
 
                 DP_VERBOSE(p_hwfn, QED_MSG_SP, "image index %d, size %x\n", i,
-                           nvm_info->image_att[i].len);
+                           nvm_info.image_att[i].len);
         }
 out:
+        /* Update hwfn's nvm_info */
+        if (nvm_info.num_images) {
+                p_hwfn->nvm_info.num_images = nvm_info.num_images;
+                kfree(p_hwfn->nvm_info.image_att);
+                p_hwfn->nvm_info.image_att = nvm_info.image_att;
+                p_hwfn->nvm_info.valid = true;
+        }
+
         qed_ptt_release(p_hwfn, p_ptt);
         return 0;
 
 err1:
-        kfree(nvm_info->image_att);
+        kfree(nvm_info.image_att);
 err0:
         qed_ptt_release(p_hwfn, p_ptt);
         return rc;
@@ -2641,6 +2662,7 @@ qed_mcp_get_nvm_image_att(struct qed_hwfn *p_hwfn,
                 return -EINVAL;
         }
 
+        qed_mcp_nvm_info_populate(p_hwfn);
         for (i = 0; i < p_hwfn->nvm_info.num_images; i++)
                 if (type == p_hwfn->nvm_info.image_att[i].image_type)
                         break;
diff --git a/drivers/net/ethernet/qlogic/qed/qed_sriov.c b/drivers/net/ethernet/qlogic/qed/qed_sriov.c
index f01bf52bc381..26e918d7f2f9 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_sriov.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_sriov.c
@@ -2831,7 +2831,7 @@ qed_iov_vp_update_mcast_bin_param(struct qed_hwfn *p_hwfn,
 
         p_data->update_approx_mcast_flg = 1;
         memcpy(p_data->bins, p_mcast_tlv->bins,
-               sizeof(unsigned long) * ETH_MULTICAST_MAC_BINS_IN_REGS);
+               sizeof(u32) * ETH_MULTICAST_MAC_BINS_IN_REGS);
         *tlvs_mask |= 1 << QED_IOV_VP_UPDATE_MCAST;
 }
 
@@ -4513,6 +4513,8 @@ static void qed_sriov_enable_qid_config(struct qed_hwfn *hwfn,
 static int qed_sriov_enable(struct qed_dev *cdev, int num)
 {
         struct qed_iov_vf_init_params params;
+        struct qed_hwfn *hwfn;
+        struct qed_ptt *ptt;
         int i, j, rc;
 
         if (num >= RESC_NUM(&cdev->hwfns[0], QED_VPORT)) {
@@ -4525,8 +4527,8 @@ static int qed_sriov_enable(struct qed_dev *cdev, int num)
 
         /* Initialize HW for VF access */
         for_each_hwfn(cdev, j) {
-                struct qed_hwfn *hwfn = &cdev->hwfns[j];
-                struct qed_ptt *ptt = qed_ptt_acquire(hwfn);
+                hwfn = &cdev->hwfns[j];
+                ptt = qed_ptt_acquire(hwfn);
 
                 /* Make sure not to use more than 16 queues per VF */
                 params.num_queues = min_t(int,
@@ -4562,6 +4564,19 @@ static int qed_sriov_enable(struct qed_dev *cdev, int num)
                 goto err;
         }
 
+        hwfn = QED_LEADING_HWFN(cdev);
+        ptt = qed_ptt_acquire(hwfn);
+        if (!ptt) {
+                DP_ERR(hwfn, "Failed to acquire ptt\n");
+                rc = -EBUSY;
+                goto err;
+        }
+
+        rc = qed_mcp_ov_update_eswitch(hwfn, ptt, QED_OV_ESWITCH_VEB);
+        if (rc)
+                DP_INFO(cdev, "Failed to update eswitch mode\n");
+        qed_ptt_release(hwfn, ptt);
+
         return num;
 
 err:
diff --git a/drivers/net/ethernet/qlogic/qed/qed_vf.c b/drivers/net/ethernet/qlogic/qed/qed_vf.c
index 2d7fcd6a0777..be6ddde1a104 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_vf.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_vf.c
@@ -1126,7 +1126,7 @@ int qed_vf_pf_vport_update(struct qed_hwfn *p_hwfn,
                 resp_size += sizeof(struct pfvf_def_resp_tlv);
 
                 memcpy(p_mcast_tlv->bins, p_params->bins,
-                       sizeof(unsigned long) * ETH_MULTICAST_MAC_BINS_IN_REGS);
+                       sizeof(u32) * ETH_MULTICAST_MAC_BINS_IN_REGS);
         }
 
         update_rx = p_params->accept_flags.update_rx_mode_config;
@@ -1272,7 +1272,7 @@ void qed_vf_pf_filter_mcast(struct qed_hwfn *p_hwfn,
                         u32 bit;
 
                         bit = qed_mcast_bin_from_mac(p_filter_cmd->mac[i]);
-                        __set_bit(bit, sp_params.bins);
+                        sp_params.bins[bit / 32] |= 1 << (bit % 32);
                 }
         }
 
diff --git a/drivers/net/ethernet/qlogic/qed/qed_vf.h b/drivers/net/ethernet/qlogic/qed/qed_vf.h
index 4f05d5eb3cf5..033409db86ae 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_vf.h
+++ b/drivers/net/ethernet/qlogic/qed/qed_vf.h
@@ -392,7 +392,12 @@ struct vfpf_vport_update_mcast_bin_tlv {
         struct channel_tlv tl;
         u8 padding[4];
 
-        u64 bins[8];
+        /* There are only 256 approx bins, and in HSI they're divided into
+         * 32-bit values. As old VFs used to set-bit to the values on its side,
+         * the upper half of the array is never expected to contain any data.
+         */
+        u64 bins[4];
+        u64 obsolete_bins[4];
 };
 
 struct vfpf_vport_update_accept_param_tlv {
diff --git a/drivers/net/ethernet/qlogic/qede/qede_ptp.c b/drivers/net/ethernet/qlogic/qede/qede_ptp.c
index 02adb513f475..013ff567283c 100644
--- a/drivers/net/ethernet/qlogic/qede/qede_ptp.c
+++ b/drivers/net/ethernet/qlogic/qede/qede_ptp.c
@@ -337,8 +337,14 @@ int qede_ptp_get_ts_info(struct qede_dev *edev, struct ethtool_ts_info *info)
 {
         struct qede_ptp *ptp = edev->ptp;
 
-        if (!ptp)
-                return -EIO;
+        if (!ptp) {
+                info->so_timestamping = SOF_TIMESTAMPING_TX_SOFTWARE |
+                                        SOF_TIMESTAMPING_RX_SOFTWARE |
+                                        SOF_TIMESTAMPING_SOFTWARE;
+                info->phc_index = -1;
+
+                return 0;
+        }
 
         info->so_timestamping = SOF_TIMESTAMPING_TX_SOFTWARE |
                                 SOF_TIMESTAMPING_RX_SOFTWARE |
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c
index 891f03a7a33d..8d7b9bb910f2 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c
@@ -1128,6 +1128,8 @@ static ssize_t qlcnic_83xx_sysfs_flash_write_handler(struct file *filp,
         struct qlcnic_adapter *adapter = dev_get_drvdata(dev);
 
         ret = kstrtoul(buf, 16, &data);
+        if (ret)
+                return ret;
 
         switch (data) {
         case QLC_83XX_FLASH_SECTOR_ERASE_CMD:
diff --git a/drivers/net/ethernet/qualcomm/qca_spi.c b/drivers/net/ethernet/qualcomm/qca_spi.c
index 5803cd6db406..206f0266463e 100644
--- a/drivers/net/ethernet/qualcomm/qca_spi.c
+++ b/drivers/net/ethernet/qualcomm/qca_spi.c
@@ -658,7 +658,7 @@ qcaspi_netdev_open(struct net_device *dev)
                 return ret;
         }
 
-        netif_start_queue(qca->net_dev);
+        /* SPI thread takes care of TX queue */
 
         return 0;
 }
@@ -760,6 +760,9 @@ qcaspi_netdev_tx_timeout(struct net_device *dev)
         qca->net_dev->stats.tx_errors++;
         /* Trigger tx queue flush and QCA7000 reset */
         qca->sync = QCASPI_SYNC_UNKNOWN;
+
+        if (qca->spi_thread)
+                wake_up_process(qca->spi_thread);
 }
 
 static int
@@ -878,22 +881,22 @@ qca_spi_probe(struct spi_device *spi)
 
         if ((qcaspi_clkspeed < QCASPI_CLK_SPEED_MIN) ||
             (qcaspi_clkspeed > QCASPI_CLK_SPEED_MAX)) {
-                dev_info(&spi->dev, "Invalid clkspeed: %d\n",
-                         qcaspi_clkspeed);
+                dev_err(&spi->dev, "Invalid clkspeed: %d\n",
+                        qcaspi_clkspeed);
                 return -EINVAL;
         }
 
         if ((qcaspi_burst_len < QCASPI_BURST_LEN_MIN) ||
             (qcaspi_burst_len > QCASPI_BURST_LEN_MAX)) {
-                dev_info(&spi->dev, "Invalid burst len: %d\n",
-                         qcaspi_burst_len);
+                dev_err(&spi->dev, "Invalid burst len: %d\n",
+                        qcaspi_burst_len);
                 return -EINVAL;
         }
 
         if ((qcaspi_pluggable < QCASPI_PLUGGABLE_MIN) ||
             (qcaspi_pluggable > QCASPI_PLUGGABLE_MAX)) {
-                dev_info(&spi->dev, "Invalid pluggable: %d\n",
-                         qcaspi_pluggable);
+                dev_err(&spi->dev, "Invalid pluggable: %d\n",
+                        qcaspi_pluggable);
                 return -EINVAL;
         }
 
@@ -955,8 +958,8 @@ qca_spi_probe(struct spi_device *spi)
         }
 
         if (register_netdev(qcaspi_devs)) {
-                dev_info(&spi->dev, "Unable to register net device %s\n",
-                         qcaspi_devs->name);
+                dev_err(&spi->dev, "Unable to register net device %s\n",
+                        qcaspi_devs->name);
                 free_netdev(qcaspi_devs);
                 return -EFAULT;
         }
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index f4cae2be0fda..eaedc11ed686 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -7734,8 +7734,7 @@ static int rtl_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
                 return rc;
         }
 
-        /* override BIOS settings, use userspace tools to enable WOL */
-        __rtl8169_set_wol(tp, 0);
+        tp->saved_wolopts = __rtl8169_get_wol(tp);
 
         if (rtl_tbi_enabled(tp)) {
                 tp->set_speed = rtl8169_set_speed_tbi;
@@ -7789,6 +7788,7 @@ static int rtl_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
                 NETIF_F_HW_VLAN_CTAG_RX;
         dev->vlan_features = NETIF_F_SG | NETIF_F_IP_CSUM | NETIF_F_TSO |
                 NETIF_F_HIGHDMA;
+        dev->priv_flags |= IFF_LIVE_ADDR_CHANGE;
 
         tp->cp_cmd |= RxChkSum | RxVlan;
 
diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c
index 68f122140966..0d811c02ff34 100644
--- a/drivers/net/ethernet/renesas/ravb_main.c
+++ b/drivers/net/ethernet/renesas/ravb_main.c
@@ -980,6 +980,13 @@ static void ravb_adjust_link(struct net_device *ndev)
         struct ravb_private *priv = netdev_priv(ndev);
         struct phy_device *phydev = ndev->phydev;
         bool new_state = false;
+        unsigned long flags;
+
+        spin_lock_irqsave(&priv->lock, flags);
+
+        /* Disable TX and RX right over here, if E-MAC change is ignored */
+        if (priv->no_avb_link)
+                ravb_rcv_snd_disable(ndev);
 
         if (phydev->link) {
                 if (phydev->duplex != priv->duplex) {
@@ -997,18 +1004,21 @@ static void ravb_adjust_link(struct net_device *ndev)
                         ravb_modify(ndev, ECMR, ECMR_TXF, 0);
                         new_state = true;
                         priv->link = phydev->link;
-                        if (priv->no_avb_link)
-                                ravb_rcv_snd_enable(ndev);
                 }
         } else if (priv->link) {
                 new_state = true;
                 priv->link = 0;
                 priv->speed = 0;
                 priv->duplex = -1;
-                if (priv->no_avb_link)
-                        ravb_rcv_snd_disable(ndev);
         }
 
+        /* Enable TX and RX right over here, if E-MAC change is ignored */
+        if (priv->no_avb_link && phydev->link)
+                ravb_rcv_snd_enable(ndev);
+
+        mmiowb();
+        spin_unlock_irqrestore(&priv->lock, flags);
+
         if (new_state && netif_msg_link(priv))
                 phy_print_status(phydev);
 }
@@ -1096,75 +1106,6 @@ static int ravb_phy_start(struct net_device *ndev)
         return 0;
 }
 
-static int ravb_get_link_ksettings(struct net_device *ndev,
-                                   struct ethtool_link_ksettings *cmd)
-{
-        struct ravb_private *priv = netdev_priv(ndev);
-        unsigned long flags;
-
-        if (!ndev->phydev)
-                return -ENODEV;
-
-        spin_lock_irqsave(&priv->lock, flags);
-        phy_ethtool_ksettings_get(ndev->phydev, cmd);
-        spin_unlock_irqrestore(&priv->lock, flags);
-
-        return 0;
-}
-
-static int ravb_set_link_ksettings(struct net_device *ndev,
-                                   const struct ethtool_link_ksettings *cmd)
-{
-        struct ravb_private *priv = netdev_priv(ndev);
-        unsigned long flags;
-        int error;
-
-        if (!ndev->phydev)
-                return -ENODEV;
-
-        spin_lock_irqsave(&priv->lock, flags);
-
-        /* Disable TX and RX */
-        ravb_rcv_snd_disable(ndev);
-
-        error = phy_ethtool_ksettings_set(ndev->phydev, cmd);
-        if (error)
-                goto error_exit;
-
-        if (cmd->base.duplex == DUPLEX_FULL)
-                priv->duplex = 1;
-        else
-                priv->duplex = 0;
-
-        ravb_set_duplex(ndev);
-
-error_exit:
-        mdelay(1);
-
-        /* Enable TX and RX */
-        ravb_rcv_snd_enable(ndev);
-
-        mmiowb();
-        spin_unlock_irqrestore(&priv->lock, flags);
-
-        return error;
-}
-
-static int ravb_nway_reset(struct net_device *ndev)
-{
-        struct ravb_private *priv = netdev_priv(ndev);
-        int error = -ENODEV;
-        unsigned long flags;
-
-        if (ndev->phydev) {
-                spin_lock_irqsave(&priv->lock, flags);
-                error = phy_start_aneg(ndev->phydev);
-                spin_unlock_irqrestore(&priv->lock, flags);
-        }
-
-        return error;
-}
-
 static u32 ravb_get_msglevel(struct net_device *ndev)
 {
         struct ravb_private *priv = netdev_priv(ndev);
@@ -1377,7 +1318,7 @@ static int ravb_set_wol(struct net_device *ndev, struct ethtool_wolinfo *wol)
 }
 
 static const struct ethtool_ops ravb_ethtool_ops = {
-        .nway_reset             = ravb_nway_reset,
+        .nway_reset             = phy_ethtool_nway_reset,
         .get_msglevel           = ravb_get_msglevel,
         .set_msglevel           = ravb_set_msglevel,
         .get_link               = ethtool_op_get_link,
@@ -1387,8 +1328,8 @@ static const struct ethtool_ops ravb_ethtool_ops = {
         .get_ringparam          = ravb_get_ringparam,
         .set_ringparam          = ravb_set_ringparam,
         .get_ts_info            = ravb_get_ts_info,
-        .get_link_ksettings     = ravb_get_link_ksettings,
-        .set_link_ksettings     = ravb_set_link_ksettings,
+        .get_link_ksettings     = phy_ethtool_get_link_ksettings,
+        .set_link_ksettings     = phy_ethtool_set_link_ksettings,
         .get_wol                = ravb_get_wol,
         .set_wol                = ravb_set_wol,
 };
diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
index e9007b613f17..5614fd231bbe 100644
--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -1927,8 +1927,15 @@ static void sh_eth_adjust_link(struct net_device *ndev)
 {
         struct sh_eth_private *mdp = netdev_priv(ndev);
         struct phy_device *phydev = ndev->phydev;
+        unsigned long flags;
         int new_state = 0;
 
+        spin_lock_irqsave(&mdp->lock, flags);
+
+        /* Disable TX and RX right over here, if E-MAC change is ignored */
+        if (mdp->cd->no_psr || mdp->no_ether_link)
+                sh_eth_rcv_snd_disable(ndev);
+
         if (phydev->link) {
                 if (phydev->duplex != mdp->duplex) {
                         new_state = 1;
@@ -1947,18 +1954,21 @@ static void sh_eth_adjust_link(struct net_device *ndev)
                         sh_eth_modify(ndev, ECMR, ECMR_TXF, 0);
                         new_state = 1;
                         mdp->link = phydev->link;
-                        if (mdp->cd->no_psr || mdp->no_ether_link)
-                                sh_eth_rcv_snd_enable(ndev);
                 }
         } else if (mdp->link) {
                 new_state = 1;
                 mdp->link = 0;
                 mdp->speed = 0;
                 mdp->duplex = -1;
-                if (mdp->cd->no_psr || mdp->no_ether_link)
-                        sh_eth_rcv_snd_disable(ndev);
         }
 
+        /* Enable TX and RX right over here, if E-MAC change is ignored */
+        if ((mdp->cd->no_psr || mdp->no_ether_link) && phydev->link)
+                sh_eth_rcv_snd_enable(ndev);
+
+        mmiowb();
+        spin_unlock_irqrestore(&mdp->lock, flags);
+
         if (new_state && netif_msg_link(mdp))
                 phy_print_status(phydev);
 }
@@ -2030,60 +2040,6 @@ static int sh_eth_phy_start(struct net_device *ndev)
         return 0;
 }
 
-static int sh_eth_get_link_ksettings(struct net_device *ndev,
-                                     struct ethtool_link_ksettings *cmd)
-{
-        struct sh_eth_private *mdp = netdev_priv(ndev);
-        unsigned long flags;
-
-        if (!ndev->phydev)
-                return -ENODEV;
-
-        spin_lock_irqsave(&mdp->lock, flags);
-        phy_ethtool_ksettings_get(ndev->phydev, cmd);
-        spin_unlock_irqrestore(&mdp->lock, flags);
-
-        return 0;
-}
-
-static int sh_eth_set_link_ksettings(struct net_device *ndev,
-                                     const struct ethtool_link_ksettings *cmd)
-{
-        struct sh_eth_private *mdp = netdev_priv(ndev);
-        unsigned long flags;
-        int ret;
-
-        if (!ndev->phydev)
-                return -ENODEV;
-
-        spin_lock_irqsave(&mdp->lock, flags);
-
-        /* disable tx and rx */
-        sh_eth_rcv_snd_disable(ndev);
-
-        ret = phy_ethtool_ksettings_set(ndev->phydev, cmd);
-        if (ret)
-                goto error_exit;
-
-        if (cmd->base.duplex == DUPLEX_FULL)
-                mdp->duplex = 1;
-        else
-                mdp->duplex = 0;
-
-        if (mdp->cd->set_duplex)
-                mdp->cd->set_duplex(ndev);
-
-error_exit:
-        mdelay(1);
-
-        /* enable tx and rx */
-        sh_eth_rcv_snd_enable(ndev);
-
-        spin_unlock_irqrestore(&mdp->lock, flags);
-
-        return ret;
-}
-
 /* If it is ever necessary to increase SH_ETH_REG_DUMP_MAX_REGS, the
  * version must be bumped as well.  Just adding registers up to that
  * limit is fine, as long as the existing register indices don't
@@ -2263,22 +2219,6 @@ static void sh_eth_get_regs(struct net_device *ndev, struct ethtool_regs *regs,
         pm_runtime_put_sync(&mdp->pdev->dev);
 }
 
-static int sh_eth_nway_reset(struct net_device *ndev)
-{
-        struct sh_eth_private *mdp = netdev_priv(ndev);
-        unsigned long flags;
-        int ret;
-
-        if (!ndev->phydev)
-                return -ENODEV;
-
-        spin_lock_irqsave(&mdp->lock, flags);
-        ret = phy_start_aneg(ndev->phydev);
-        spin_unlock_irqrestore(&mdp->lock, flags);
-
-        return ret;
-}
-
 static u32 sh_eth_get_msglevel(struct net_device *ndev)
 {
         struct sh_eth_private *mdp = netdev_priv(ndev);
@@ -2429,7 +2369,7 @@ static int sh_eth_set_wol(struct net_device *ndev, struct ethtool_wolinfo *wol)
 static const struct ethtool_ops sh_eth_ethtool_ops = {
         .get_regs_len   = sh_eth_get_regs_len,
         .get_regs       = sh_eth_get_regs,
-        .nway_reset     = sh_eth_nway_reset,
+        .nway_reset     = phy_ethtool_nway_reset,
         .get_msglevel   = sh_eth_get_msglevel,
         .set_msglevel   = sh_eth_set_msglevel,
         .get_link       = ethtool_op_get_link,
@@ -2438,8 +2378,8 @@ static const struct ethtool_ops sh_eth_ethtool_ops = {
         .get_sset_count     = sh_eth_get_sset_count,
         .get_ringparam  = sh_eth_get_ringparam,
         .set_ringparam  = sh_eth_set_ringparam,
-        .get_link_ksettings = sh_eth_get_link_ksettings,
-        .set_link_ksettings = sh_eth_set_link_ksettings,
+        .get_link_ksettings = phy_ethtool_get_link_ksettings,
+        .set_link_ksettings = phy_ethtool_set_link_ksettings,
         .get_wol        = sh_eth_get_wol,
         .set_wol        = sh_eth_set_wol,
 };
diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c
index 23f0785c0573..7eeac3d6cfe8 100644
--- a/drivers/net/ethernet/sfc/ef10.c
+++ b/drivers/net/ethernet/sfc/ef10.c
@@ -4288,9 +4288,9 @@ static int efx_ef10_filter_pri(struct efx_ef10_filter_table *table,
         return -EPROTONOSUPPORT;
 }
 
-static s32 efx_ef10_filter_insert(struct efx_nic *efx,
-                                  struct efx_filter_spec *spec,
-                                  bool replace_equal)
+static s32 efx_ef10_filter_insert_locked(struct efx_nic *efx,
+                                         struct efx_filter_spec *spec,
+                                         bool replace_equal)
 {
         DECLARE_BITMAP(mc_rem_map, EFX_EF10_FILTER_SEARCH_LIMIT);
         struct efx_ef10_nic_data *nic_data = efx->nic_data;
@@ -4307,7 +4307,7 @@ static s32 efx_ef10_filter_insert(struct efx_nic *efx,
         bool is_mc_recip;
         s32 rc;
 
-        down_read(&efx->filter_sem);
+        WARN_ON(!rwsem_is_locked(&efx->filter_sem));
         table = efx->filter_state;
         down_write(&table->lock);
 
@@ -4498,10 +4498,22 @@ out_unlock:
         if (rss_locked)
                 mutex_unlock(&efx->rss_lock);
         up_write(&table->lock);
-        up_read(&efx->filter_sem);
         return rc;
 }
 
+static s32 efx_ef10_filter_insert(struct efx_nic *efx,
+                                  struct efx_filter_spec *spec,
+                                  bool replace_equal)
+{
+        s32 ret;
+
+        down_read(&efx->filter_sem);
+        ret = efx_ef10_filter_insert_locked(efx, spec, replace_equal);
+        up_read(&efx->filter_sem);
+
+        return ret;
+}
+
 static void efx_ef10_filter_update_rx_scatter(struct efx_nic *efx)
 {
         /* no need to do anything here on EF10 */
@@ -5285,7 +5297,7 @@ static int efx_ef10_filter_insert_addr_list(struct efx_nic *efx,
                 EFX_WARN_ON_PARANOID(ids[i] != EFX_EF10_FILTER_ID_INVALID);
                 efx_filter_init_rx(&spec, EFX_FILTER_PRI_AUTO, filter_flags, 0);
                 efx_filter_set_eth_local(&spec, vlan->vid, addr_list[i].addr);
-                rc = efx_ef10_filter_insert(efx, &spec, true);
+                rc = efx_ef10_filter_insert_locked(efx, &spec, true);
                 if (rc < 0) {
                         if (rollback) {
                                 netif_info(efx, drv, efx->net_dev,
@@ -5314,7 +5326,7 @@ static int efx_ef10_filter_insert_addr_list(struct efx_nic *efx,
                 efx_filter_init_rx(&spec, EFX_FILTER_PRI_AUTO, filter_flags, 0);
                 eth_broadcast_addr(baddr);
                 efx_filter_set_eth_local(&spec, vlan->vid, baddr);
-                rc = efx_ef10_filter_insert(efx, &spec, true);
+                rc = efx_ef10_filter_insert_locked(efx, &spec, true);
                 if (rc < 0) {
                         netif_warn(efx, drv, efx->net_dev,
                                    "Broadcast filter insert failed rc=%d\n", rc);
@@ -5370,7 +5382,7 @@ static int efx_ef10_filter_insert_def(struct efx_nic *efx,
         if (vlan->vid != EFX_FILTER_VID_UNSPEC)
                 efx_filter_set_eth_local(&spec, vlan->vid, NULL);
 
-        rc = efx_ef10_filter_insert(efx, &spec, true);
+        rc = efx_ef10_filter_insert_locked(efx, &spec, true);
         if (rc < 0) {
                 const char *um = multicast ? "Multicast" : "Unicast";
                 const char *encap_name = "";
@@ -5430,7 +5442,7 @@ static int efx_ef10_filter_insert_def(struct efx_nic *efx,
                                            filter_flags, 0);
                         eth_broadcast_addr(baddr);
                         efx_filter_set_eth_local(&spec, vlan->vid, baddr);
-                        rc = efx_ef10_filter_insert(efx, &spec, true);
+                        rc = efx_ef10_filter_insert_locked(efx, &spec, true);
                         if (rc < 0) {
                                 netif_warn(efx, drv, efx->net_dev,
                                            "Broadcast filter insert failed rc=%d\n",
diff --git a/drivers/net/ethernet/sfc/efx.c b/drivers/net/ethernet/sfc/efx.c
index 570ec72266f3..ce3a177081a8 100644
--- a/drivers/net/ethernet/sfc/efx.c
+++ b/drivers/net/ethernet/sfc/efx.c
@@ -1871,12 +1871,6 @@ static void efx_remove_filters(struct efx_nic *efx)
         up_write(&efx->filter_sem);
 }
 
-static void efx_restore_filters(struct efx_nic *efx)
-{
-        down_read(&efx->filter_sem);
-        efx->type->filter_table_restore(efx);
-        up_read(&efx->filter_sem);
-}
 
 /**************************************************************************
  *
@@ -2688,6 +2682,7 @@ void efx_reset_down(struct efx_nic *efx, enum reset_type method)
         efx_disable_interrupts(efx);
 
         mutex_lock(&efx->mac_lock);
+        down_write(&efx->filter_sem);
         mutex_lock(&efx->rss_lock);
         if (efx->port_initialized && method != RESET_TYPE_INVISIBLE &&
             method != RESET_TYPE_DATAPATH)
@@ -2745,9 +2740,8 @@ int efx_reset_up(struct efx_nic *efx, enum reset_type method, bool ok)
         if (efx->type->rx_restore_rss_contexts)
                 efx->type->rx_restore_rss_contexts(efx);
         mutex_unlock(&efx->rss_lock);
-        down_read(&efx->filter_sem);
-        efx_restore_filters(efx);
-        up_read(&efx->filter_sem);
+        efx->type->filter_table_restore(efx);
+        up_write(&efx->filter_sem);
         if (efx->type->sriov_reset)
                 efx->type->sriov_reset(efx);
 
@@ -2764,6 +2758,7 @@ fail:
         efx->port_initialized = false;
 
         mutex_unlock(&efx->rss_lock);
+        up_write(&efx->filter_sem);
         mutex_unlock(&efx->mac_lock);
 
         return rc;
@@ -3473,7 +3468,9 @@ static int efx_pci_probe_main(struct efx_nic *efx)
 
         efx_init_napi(efx);
 
+        down_write(&efx->filter_sem);
         rc = efx->type->init(efx);
+        up_write(&efx->filter_sem);
         if (rc) {
                 netif_err(efx, probe, efx->net_dev,
                           "failed to initialise NIC\n");
@@ -3765,7 +3762,9 @@ static int efx_pm_resume(struct device *dev)
         rc = efx->type->reset(efx, RESET_TYPE_ALL);
         if (rc)
                 return rc;
+        down_write(&efx->filter_sem);
         rc = efx->type->init(efx);
+        up_write(&efx->filter_sem);
         if (rc)
                 return rc;
         rc = efx_pm_thaw(dev);
diff --git a/drivers/net/ethernet/sfc/farch.c b/drivers/net/ethernet/sfc/farch.c
index 8edf20967c82..e045a5d6b938 100644
--- a/drivers/net/ethernet/sfc/farch.c
+++ b/drivers/net/ethernet/sfc/farch.c
@@ -2794,6 +2794,7 @@ int efx_farch_filter_table_probe(struct efx_nic *efx)
         if (!state)
                 return -ENOMEM;
         efx->filter_state = state;
+        init_rwsem(&state->lock);
 
         table = &state->table[EFX_FARCH_FILTER_TABLE_RX_IP];
         table->id = EFX_FARCH_FILTER_TABLE_RX_IP;
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
index 2e6e2a96b4f2..f9a61f90cfbc 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
@@ -37,7 +37,7 @@
  *              is done in the "stmmac files"
  */
 
-/* struct emac_variant - Descrive dwmac-sun8i hardware variant
+/* struct emac_variant - Describe dwmac-sun8i hardware variant
  * @default_syscon_value:       The default value of the EMAC register in syscon
  *                              This value is used for disabling properly EMAC
  *                              and used as a good starting value in case of the
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.c
index d37f17ca62fe..65bc3556bd8f 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.c
@@ -407,6 +407,16 @@ static void dwmac4_enable_tso(void __iomem *ioaddr, bool en, u32 chan)
         }
 }
 
+static void dwmac4_set_bfsize(void __iomem *ioaddr, int bfsize, u32 chan)
+{
+        u32 value = readl(ioaddr + DMA_CHAN_RX_CONTROL(chan));
+
+        value &= ~DMA_RBSZ_MASK;
+        value |= (bfsize << DMA_RBSZ_SHIFT) & DMA_RBSZ_MASK;
+
+        writel(value, ioaddr + DMA_CHAN_RX_CONTROL(chan));
+}
+
 const struct stmmac_dma_ops dwmac4_dma_ops = {
         .reset = dwmac4_dma_reset,
         .init = dwmac4_dma_init,
@@ -431,6 +441,7 @@ const struct stmmac_dma_ops dwmac4_dma_ops = {
         .set_rx_tail_ptr = dwmac4_set_rx_tail_ptr,
         .set_tx_tail_ptr = dwmac4_set_tx_tail_ptr,
         .enable_tso = dwmac4_enable_tso,
+        .set_bfsize = dwmac4_set_bfsize,
 };
 
 const struct stmmac_dma_ops dwmac410_dma_ops = {
@@ -457,4 +468,5 @@ const struct stmmac_dma_ops dwmac410_dma_ops = {
         .set_rx_tail_ptr = dwmac4_set_rx_tail_ptr,
         .set_tx_tail_ptr = dwmac4_set_tx_tail_ptr,
         .enable_tso = dwmac4_enable_tso,
+        .set_bfsize = dwmac4_set_bfsize,
 };
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.h b/drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.h
index c63c1fe3f26b..22a4a6dbb1a4 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.h
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.h
@@ -120,6 +120,8 @@
 
 /* DMA Rx Channel X Control register defines */
 #define DMA_CONTROL_SR                  BIT(0)
+#define DMA_RBSZ_MASK                   GENMASK(14, 1)
+#define DMA_RBSZ_SHIFT                  1
 
 /* Interrupt status per channel */
 #define DMA_CHAN_STATUS_REB             GENMASK(21, 19)
diff --git a/drivers/net/ethernet/stmicro/stmmac/hwif.h b/drivers/net/ethernet/stmicro/stmmac/hwif.h
index e44e7b26ce82..fe8b536b13f8 100644
--- a/drivers/net/ethernet/stmicro/stmmac/hwif.h
+++ b/drivers/net/ethernet/stmicro/stmmac/hwif.h
@@ -183,6 +183,7 @@ struct stmmac_dma_ops {
         void (*set_rx_tail_ptr)(void __iomem *ioaddr, u32 tail_ptr, u32 chan);
         void (*set_tx_tail_ptr)(void __iomem *ioaddr, u32 tail_ptr, u32 chan);
         void (*enable_tso)(void __iomem *ioaddr, bool en, u32 chan);
+        void (*set_bfsize)(void __iomem *ioaddr, int bfsize, u32 chan);
 };
 
 #define stmmac_reset(__priv, __args...) \
@@ -235,6 +236,8 @@ struct stmmac_dma_ops {
         stmmac_do_void_callback(__priv, dma, set_tx_tail_ptr, __args)
 #define stmmac_enable_tso(__priv, __args...) \
         stmmac_do_void_callback(__priv, dma, enable_tso, __args)
+#define stmmac_set_dma_bfsize(__priv, __args...) \
+        stmmac_do_void_callback(__priv, dma, set_bfsize, __args)
 
 struct mac_device_info;
 struct net_device;
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index cba46b62a1cd..60f59abab009 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -1804,6 +1804,8 @@ static void stmmac_dma_operation_mode(struct stmmac_priv *priv)
 
                 stmmac_dma_rx_mode(priv, priv->ioaddr, rxmode, chan,
                                 rxfifosz, qmode);
+                stmmac_set_dma_bfsize(priv, priv->ioaddr, priv->dma_buf_sz,
+                                chan);
         }
 
         for (chan = 0; chan < tx_channels_count; chan++) {
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
index 6d141f3931eb..72da77b94ecd 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
@@ -94,7 +94,6 @@ static int dwmac1000_validate_ucast_entries(int ucast_entries)
 /**
  * stmmac_axi_setup - parse DT parameters for programming the AXI register
  * @pdev: platform device
- * @priv: driver private struct.
  * Description:
  * if required, from device-tree the AXI internal register can be tuned
  * by using platform parameters.
diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_mdio.c b/drivers/net/ethernet/xilinx/xilinx_axienet_mdio.c
index 16c3bfbe1992..757a3b37ae8a 100644
--- a/drivers/net/ethernet/xilinx/xilinx_axienet_mdio.c
+++ b/drivers/net/ethernet/xilinx/xilinx_axienet_mdio.c
@@ -218,6 +218,7 @@ issue:
         ret = of_mdiobus_register(bus, np1);
         if (ret) {
                 mdiobus_free(bus);
+                lp->mii_bus = NULL;
                 return ret;
         }
         return 0;
diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c
index 750eaa53bf0c..ada33c2d9ac2 100644
--- a/drivers/net/geneve.c
+++ b/drivers/net/geneve.c
@@ -476,7 +476,7 @@ static struct sk_buff **geneve_gro_receive(struct sock *sk,
 out_unlock:
         rcu_read_unlock();
 out:
-        NAPI_GRO_CB(skb)->flush |= flush;
+        skb_gro_flush_final(skb, pp, flush);
 
         return pp;
 }
diff --git a/drivers/net/hyperv/hyperv_net.h b/drivers/net/hyperv/hyperv_net.h
index 1a924b867b07..4b6e308199d2 100644
--- a/drivers/net/hyperv/hyperv_net.h
+++ b/drivers/net/hyperv/hyperv_net.h
@@ -210,7 +210,7 @@ int netvsc_recv_callback(struct net_device *net,
 void netvsc_channel_cb(void *context);
 int netvsc_poll(struct napi_struct *napi, int budget);
 
-void rndis_set_subchannel(struct work_struct *w);
+int rndis_set_subchannel(struct net_device *ndev, struct netvsc_device *nvdev);
 int rndis_filter_open(struct netvsc_device *nvdev);
 int rndis_filter_close(struct netvsc_device *nvdev);
 struct netvsc_device *rndis_filter_device_add(struct hv_device *dev,
diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c
index 5d5bd513847f..31c3d77b4733 100644
--- a/drivers/net/hyperv/netvsc.c
+++ b/drivers/net/hyperv/netvsc.c
@@ -65,6 +65,41 @@ void netvsc_switch_datapath(struct net_device *ndev, bool vf)
                                VM_PKT_DATA_INBAND, 0);
 }
 
+/* Worker to setup sub channels on initial setup
+ * Initial hotplug event occurs in softirq context
+ * and can't wait for channels.
+ */
+static void netvsc_subchan_work(struct work_struct *w)
+{
+        struct netvsc_device *nvdev =
+                container_of(w, struct netvsc_device, subchan_work);
+        struct rndis_device *rdev;
+        int i, ret;
+
+        /* Avoid deadlock with device removal already under RTNL */
+        if (!rtnl_trylock()) {
+                schedule_work(w);
+                return;
+        }
+
+        rdev = nvdev->extension;
+        if (rdev) {
+                ret = rndis_set_subchannel(rdev->ndev, nvdev);
+                if (ret == 0) {
+                        netif_device_attach(rdev->ndev);
+                } else {
+                        /* fallback to only primary channel */
+                        for (i = 1; i < nvdev->num_chn; i++)
+                                netif_napi_del(&nvdev->chan_table[i].napi);
+
+                        nvdev->max_chn = 1;
+                        nvdev->num_chn = 1;
+                }
+        }
+
+        rtnl_unlock();
+}
+
 static struct netvsc_device *alloc_net_device(void)
 {
         struct netvsc_device *net_device;
@@ -81,7 +116,7 @@ static struct netvsc_device *alloc_net_device(void)
 
         init_completion(&net_device->channel_init_wait);
         init_waitqueue_head(&net_device->subchan_open);
-        INIT_WORK(&net_device->subchan_work, rndis_set_subchannel);
+        INIT_WORK(&net_device->subchan_work, netvsc_subchan_work);
 
         return net_device;
 }
@@ -1239,6 +1274,7 @@ int netvsc_poll(struct napi_struct *napi, int budget)
         struct hv_device *device = netvsc_channel_to_device(channel);
         struct net_device *ndev = hv_get_drvdata(device);
         int work_done = 0;
+        int ret;
 
         /* If starting a new interval */
         if (!nvchan->desc)
@@ -1250,16 +1286,18 @@ int netvsc_poll(struct napi_struct *napi, int budget)
                 nvchan->desc = hv_pkt_iter_next(channel, nvchan->desc);
         }
 
-        /* If send of pending receive completions suceeded
-         *   and did not exhaust NAPI budget this time
-         *   and not doing busy poll
+        /* Send any pending receive completions */
+        ret = send_recv_completions(ndev, net_device, nvchan);
+
+        /* If it did not exhaust NAPI budget this time
+         *  and not doing busy poll
          * then re-enable host interrupts
-         *     and reschedule if ring is not empty.
+         *  and reschedule if ring is not empty
+         *   or sending receive completion failed.
          */
-        if (send_recv_completions(ndev, net_device, nvchan) == 0 &&
-            work_done < budget &&
+        if (work_done < budget &&
             napi_complete_done(napi, work_done) &&
-            hv_end_read(&channel->inbound) &&
+            (ret || hv_end_read(&channel->inbound)) &&
             napi_schedule_prep(napi)) {
                 hv_begin_read(&channel->inbound);
                 __napi_schedule(napi);
diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index fe2256bf1d13..dd1d6e115145 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -905,8 +905,20 @@ static int netvsc_attach(struct net_device *ndev,
         if (IS_ERR(nvdev))
                 return PTR_ERR(nvdev);
 
-        /* Note: enable and attach happen when sub-channels setup */
+        if (nvdev->num_chn > 1) {
+                ret = rndis_set_subchannel(ndev, nvdev);
+
+                /* if unavailable, just proceed with one queue */
+                if (ret) {
+                        nvdev->max_chn = 1;
+                        nvdev->num_chn = 1;
+                }
+        }
+
+        /* In any case device is now ready */
+        netif_device_attach(ndev);
 
+        /* Note: enable and attach happen when sub-channels setup */
         netif_carrier_off(ndev);
 
         if (netif_running(ndev)) {
@@ -2089,6 +2101,9 @@ static int netvsc_probe(struct hv_device *dev,
 
         memcpy(net->dev_addr, device_info.mac_adr, ETH_ALEN);
 
+        if (nvdev->num_chn > 1)
+                schedule_work(&nvdev->subchan_work);
+
         /* hw_features computed in rndis_netdev_set_hwcaps() */
         net->features = net->hw_features |
                 NETIF_F_HIGHDMA | NETIF_F_SG |
diff --git a/drivers/net/hyperv/rndis_filter.c b/drivers/net/hyperv/rndis_filter.c
index 5428bb261102..408ece27131c 100644
--- a/drivers/net/hyperv/rndis_filter.c
+++ b/drivers/net/hyperv/rndis_filter.c
@@ -1062,29 +1062,15 @@ static void netvsc_sc_open(struct vmbus_channel *new_sc)
  * This breaks overlap of processing the host message for the
  * new primary channel with the initialization of sub-channels.
  */
-void rndis_set_subchannel(struct work_struct *w)
+int rndis_set_subchannel(struct net_device *ndev, struct netvsc_device *nvdev)
 {
-        struct netvsc_device *nvdev
-                = container_of(w, struct netvsc_device, subchan_work);
         struct nvsp_message *init_packet = &nvdev->channel_init_pkt;
-        struct net_device_context *ndev_ctx;
-        struct rndis_device *rdev;
-        struct net_device *ndev;
-        struct hv_device *hv_dev;
+        struct net_device_context *ndev_ctx = netdev_priv(ndev);
+        struct hv_device *hv_dev = ndev_ctx->device_ctx;
+        struct rndis_device *rdev = nvdev->extension;
         int i, ret;
 
-        if (!rtnl_trylock()) {
-                schedule_work(w);
-                return;
-        }
-
-        rdev = nvdev->extension;
-        if (!rdev)
-                goto unlock;    /* device was removed */
-
-        ndev = rdev->ndev;
-        ndev_ctx = netdev_priv(ndev);
-        hv_dev = ndev_ctx->device_ctx;
+        ASSERT_RTNL();
 
         memset(init_packet, 0, sizeof(struct nvsp_message));
         init_packet->hdr.msg_type = NVSP_MSG5_TYPE_SUBCHANNEL;
@@ -1100,13 +1086,13 @@ void rndis_set_subchannel(struct work_struct *w)
                                VMBUS_DATA_PACKET_FLAG_COMPLETION_REQUESTED);
         if (ret) {
                 netdev_err(ndev, "sub channel allocate send failed: %d\n", ret);
-                goto failed;
+                return ret;
         }
 
         wait_for_completion(&nvdev->channel_init_wait);
         if (init_packet->msg.v5_msg.subchn_comp.status != NVSP_STAT_SUCCESS) {
                 netdev_err(ndev, "sub channel request failed\n");
-                goto failed;
+                return -EIO;
         }
 
         nvdev->num_chn = 1 +
@@ -1125,21 +1111,7 @@ void rndis_set_subchannel(struct work_struct *w)
         for (i = 0; i < VRSS_SEND_TAB_SIZE; i++)
                 ndev_ctx->tx_table[i] = i % nvdev->num_chn;
 
-        netif_device_attach(ndev);
-        rtnl_unlock();
-        return;
-
-failed:
-        /* fallback to only primary channel */
-        for (i = 1; i < nvdev->num_chn; i++)
-                netif_napi_del(&nvdev->chan_table[i].napi);
-
-        nvdev->max_chn = 1;
-        nvdev->num_chn = 1;
-
-        netif_device_attach(ndev);
-unlock:
-        rtnl_unlock();
+        return 0;
 }
 
 static int rndis_netdev_set_hwcaps(struct rndis_device *rndis_device,
@@ -1360,21 +1332,13 @@ struct netvsc_device *rndis_filter_device_add(struct hv_device *dev,
                 netif_napi_add(net, &net_device->chan_table[i].napi,
                                netvsc_poll, NAPI_POLL_WEIGHT);
 
-        if (net_device->num_chn > 1)
-                schedule_work(&net_device->subchan_work);
+        return net_device;
 
 out:
-        /* if unavailable, just proceed with one queue */
-        if (ret) {
-                net_device->max_chn = 1;
-                net_device->num_chn = 1;
-        }
-
-        /* No sub channels, device is ready */
-        if (net_device->num_chn == 1)
-                netif_device_attach(net);
-
-        return net_device;
+        /* setting up multiple channels failed */
+        net_device->max_chn = 1;
+        net_device->num_chn = 1;
+        return 0;
 
 err_dev_remv:
         rndis_filter_device_remove(dev, net_device);
diff --git a/drivers/net/ieee802154/adf7242.c b/drivers/net/ieee802154/adf7242.c
index 64f1b1e77bc0..23a52b9293f3 100644
--- a/drivers/net/ieee802154/adf7242.c
+++ b/drivers/net/ieee802154/adf7242.c
@@ -275,6 +275,8 @@ struct adf7242_local {
         struct spi_message stat_msg;
         struct spi_transfer stat_xfer;
         struct dentry *debugfs_root;
+        struct delayed_work work;
+        struct workqueue_struct *wqueue;
         unsigned long flags;
         int tx_stat;
         bool promiscuous;
@@ -575,10 +577,26 @@ static int adf7242_cmd_rx(struct adf7242_local *lp)
         /* Wait until the ACK is sent */
         adf7242_wait_status(lp, RC_STATUS_PHY_RDY, RC_STATUS_MASK, __LINE__);
         adf7242_clear_irqstat(lp);
+        mod_delayed_work(lp->wqueue, &lp->work, msecs_to_jiffies(400));
 
         return adf7242_cmd(lp, CMD_RC_RX);
 }
 
+static void adf7242_rx_cal_work(struct work_struct *work)
+{
+        struct adf7242_local *lp =
+        container_of(work, struct adf7242_local, work.work);
+
+        /* Reissuing RC_RX every 400ms - to adjust for offset
+         * drift in receiver (datasheet page 61, OCL section)
+         */
+
+        if (!test_bit(FLAG_XMIT, &lp->flags)) {
+                adf7242_cmd(lp, CMD_RC_PHY_RDY);
+                adf7242_cmd_rx(lp);
+        }
+}
+
 static int adf7242_set_txpower(struct ieee802154_hw *hw, int mbm)
 {
         struct adf7242_local *lp = hw->priv;
@@ -686,7 +704,7 @@ static int adf7242_start(struct ieee802154_hw *hw)
         enable_irq(lp->spi->irq);
         set_bit(FLAG_START, &lp->flags);
 
-        return adf7242_cmd(lp, CMD_RC_RX);
+        return adf7242_cmd_rx(lp);
 }
 
 static void adf7242_stop(struct ieee802154_hw *hw)
@@ -694,6 +712,7 @@ static void adf7242_stop(struct ieee802154_hw *hw)
         struct adf7242_local *lp = hw->priv;
 
         disable_irq(lp->spi->irq);
+        cancel_delayed_work_sync(&lp->work);
         adf7242_cmd(lp, CMD_RC_IDLE);
         clear_bit(FLAG_START, &lp->flags);
         adf7242_clear_irqstat(lp);
@@ -719,7 +738,10 @@ static int adf7242_channel(struct ieee802154_hw *hw, u8 page, u8 channel)
         adf7242_write_reg(lp, REG_CH_FREQ1, freq >> 8);
         adf7242_write_reg(lp, REG_CH_FREQ2, freq >> 16);
 
-        return adf7242_cmd(lp, CMD_RC_RX);
+        if (test_bit(FLAG_START, &lp->flags))
+                return adf7242_cmd_rx(lp);
+        else
+                return adf7242_cmd(lp, CMD_RC_PHY_RDY);
 }
 
 static int adf7242_set_hw_addr_filt(struct ieee802154_hw *hw,
@@ -814,6 +836,7 @@ static int adf7242_xmit(struct ieee802154_hw *hw, struct sk_buff *skb)
         /* ensure existing instances of the IRQ handler have completed */
         disable_irq(lp->spi->irq);
         set_bit(FLAG_XMIT, &lp->flags);
+        cancel_delayed_work_sync(&lp->work);
         reinit_completion(&lp->tx_complete);
         adf7242_cmd(lp, CMD_RC_PHY_RDY);
         adf7242_clear_irqstat(lp);
@@ -952,6 +975,7 @@ static irqreturn_t adf7242_isr(int irq, void *data)
         unsigned int xmit;
         u8 irq1;
 
+        mod_delayed_work(lp->wqueue, &lp->work, msecs_to_jiffies(400));
         adf7242_read_reg(lp, REG_IRQ1_SRC1, &irq1);
 
         if (!(irq1 & (IRQ_RX_PKT_RCVD | IRQ_CSMA_CA)))
@@ -1241,6 +1265,9 @@ static int adf7242_probe(struct spi_device *spi)
         spi_message_add_tail(&lp->stat_xfer, &lp->stat_msg);
 
         spi_set_drvdata(spi, lp);
+        INIT_DELAYED_WORK(&lp->work, adf7242_rx_cal_work);
+        lp->wqueue = alloc_ordered_workqueue(dev_name(&spi->dev),
+                                             WQ_MEM_RECLAIM);
 
         ret = adf7242_hw_init(lp);
         if (ret)
@@ -1284,6 +1311,9 @@ static int adf7242_remove(struct spi_device *spi)
         if (!IS_ERR_OR_NULL(lp->debugfs_root))
                 debugfs_remove_recursive(lp->debugfs_root);
 
+        cancel_delayed_work_sync(&lp->work);
+        destroy_workqueue(lp->wqueue);
+
         ieee802154_unregister_hw(lp->hw);
         mutex_destroy(&lp->bmux);
         ieee802154_free_hw(lp->hw);
diff --git a/drivers/net/ieee802154/at86rf230.c b/drivers/net/ieee802154/at86rf230.c
index 77abedf0b524..3d9e91579866 100644
--- a/drivers/net/ieee802154/at86rf230.c
+++ b/drivers/net/ieee802154/at86rf230.c
@@ -940,7 +940,7 @@ at86rf230_xmit(struct ieee802154_hw *hw, struct sk_buff *skb)
 static int
 at86rf230_ed(struct ieee802154_hw *hw, u8 *level)
 {
-        BUG_ON(!level);
+        WARN_ON(!level);
         *level = 0xbe;
         return 0;
 }
@@ -1121,8 +1121,7 @@ at86rf230_set_hw_addr_filt(struct ieee802154_hw *hw,
         if (changed & IEEE802154_AFILT_SADDR_CHANGED) {
                 u16 addr = le16_to_cpu(filt->short_addr);
 
-                dev_vdbg(&lp->spi->dev,
-                         "at86rf230_set_hw_addr_filt called for saddr\n");
+                dev_vdbg(&lp->spi->dev, "%s called for saddr\n", __func__);
                 __at86rf230_write(lp, RG_SHORT_ADDR_0, addr);
                 __at86rf230_write(lp, RG_SHORT_ADDR_1, addr >> 8);
         }
@@ -1130,8 +1129,7 @@ at86rf230_set_hw_addr_filt(struct ieee802154_hw *hw,
         if (changed & IEEE802154_AFILT_PANID_CHANGED) {
                 u16 pan = le16_to_cpu(filt->pan_id);
 
-                dev_vdbg(&lp->spi->dev,
-                         "at86rf230_set_hw_addr_filt called for pan id\n");
+                dev_vdbg(&lp->spi->dev, "%s called for pan id\n", __func__);
                 __at86rf230_write(lp, RG_PAN_ID_0, pan);
                 __at86rf230_write(lp, RG_PAN_ID_1, pan >> 8);
         }
@@ -1140,15 +1138,13 @@ at86rf230_set_hw_addr_filt(struct ieee802154_hw *hw,
                 u8 i, addr[8];
 
                 memcpy(addr, &filt->ieee_addr, 8);
-                dev_vdbg(&lp->spi->dev,
-                         "at86rf230_set_hw_addr_filt called for IEEE addr\n");
+                dev_vdbg(&lp->spi->dev, "%s called for IEEE addr\n", __func__);
                 for (i = 0; i < 8; i++)
                         __at86rf230_write(lp, RG_IEEE_ADDR_0 + i, addr[i]);
         }
 
         if (changed & IEEE802154_AFILT_PANC_CHANGED) {
-                dev_vdbg(&lp->spi->dev,
-                         "at86rf230_set_hw_addr_filt called for panc change\n");
+                dev_vdbg(&lp->spi->dev, "%s called for panc change\n", __func__);
                 if (filt->pan_coord)
                         at86rf230_write_subreg(lp, SR_AACK_I_AM_COORD, 1);
                 else
@@ -1252,7 +1248,6 @@ at86rf230_set_cca_mode(struct ieee802154_hw *hw,
         return at86rf230_write_subreg(lp, SR_CCA_MODE, val);
 }
 
-
 static int
 at86rf230_set_cca_ed_level(struct ieee802154_hw *hw, s32 mbm)
 {
diff --git a/drivers/net/ieee802154/fakelb.c b/drivers/net/ieee802154/fakelb.c
index 0d673f7682ee..176395e4b7bb 100644
--- a/drivers/net/ieee802154/fakelb.c
+++ b/drivers/net/ieee802154/fakelb.c
@@ -49,7 +49,7 @@ struct fakelb_phy {
 
 static int fakelb_hw_ed(struct ieee802154_hw *hw, u8 *level)
 {
-        BUG_ON(!level);
+        WARN_ON(!level);
         *level = 0xbe;
 
         return 0;
diff --git a/drivers/net/ieee802154/mcr20a.c b/drivers/net/ieee802154/mcr20a.c
index de0d7f28a181..e428277781ac 100644
--- a/drivers/net/ieee802154/mcr20a.c
+++ b/drivers/net/ieee802154/mcr20a.c
@@ -15,10 +15,11 @@
  */
 #include <linux/kernel.h>
 #include <linux/module.h>
-#include <linux/gpio.h>
+#include <linux/gpio/consumer.h>
 #include <linux/spi/spi.h>
 #include <linux/workqueue.h>
 #include <linux/interrupt.h>
+#include <linux/irq.h>
 #include <linux/skbuff.h>
 #include <linux/of_gpio.h>
 #include <linux/regmap.h>
diff --git a/drivers/net/ipvlan/ipvlan_main.c b/drivers/net/ipvlan/ipvlan_main.c
index 23c1d6600241..4a949569ec4c 100644
--- a/drivers/net/ipvlan/ipvlan_main.c
+++ b/drivers/net/ipvlan/ipvlan_main.c
@@ -75,10 +75,23 @@ static int ipvlan_set_port_mode(struct ipvl_port *port, u16 nval)
 {
         struct ipvl_dev *ipvlan;
         struct net_device *mdev = port->dev;
-        int err = 0;
+        unsigned int flags;
+        int err;
 
         ASSERT_RTNL();
         if (port->mode != nval) {
+                list_for_each_entry(ipvlan, &port->ipvlans, pnode) {
+                        flags = ipvlan->dev->flags;
+                        if (nval == IPVLAN_MODE_L3 || nval == IPVLAN_MODE_L3S) {
+                                err = dev_change_flags(ipvlan->dev,
+                                                       flags | IFF_NOARP);
+                        } else {
+                                err = dev_change_flags(ipvlan->dev,
+                                                       flags & ~IFF_NOARP);
+                        }
+                        if (unlikely(err))
+                                goto fail;
+                }
                 if (nval == IPVLAN_MODE_L3S) {
                         /* New mode is L3S */
                         err = ipvlan_register_nf_hook(read_pnet(&port->pnet));
@@ -86,21 +99,28 @@ static int ipvlan_set_port_mode(struct ipvl_port *port, u16 nval)
                                 mdev->l3mdev_ops = &ipvl_l3mdev_ops;
                                 mdev->priv_flags |= IFF_L3MDEV_MASTER;
                         } else
-                                return err;
+                                goto fail;
                 } else if (port->mode == IPVLAN_MODE_L3S) {
                         /* Old mode was L3S */
                         mdev->priv_flags &= ~IFF_L3MDEV_MASTER;
                         ipvlan_unregister_nf_hook(read_pnet(&port->pnet));
                         mdev->l3mdev_ops = NULL;
                 }
-                list_for_each_entry(ipvlan, &port->ipvlans, pnode) {
-                        if (nval == IPVLAN_MODE_L3 || nval == IPVLAN_MODE_L3S)
-                                ipvlan->dev->flags |= IFF_NOARP;
-                        else
-                                ipvlan->dev->flags &= ~IFF_NOARP;
-                }
                 port->mode = nval;
         }
+        return 0;
+
+fail:
+        /* Undo the flags changes that have been done so far. */
+        list_for_each_entry_continue_reverse(ipvlan, &port->ipvlans, pnode) {
+                flags = ipvlan->dev->flags;
+                if (port->mode == IPVLAN_MODE_L3 ||
+                    port->mode == IPVLAN_MODE_L3S)
+                        dev_change_flags(ipvlan->dev, flags | IFF_NOARP);
+                else
+                        dev_change_flags(ipvlan->dev, flags & ~IFF_NOARP);
+        }
+
         return err;
 }
 
diff --git a/drivers/net/phy/dp83tc811.c b/drivers/net/phy/dp83tc811.c
index 081d99aa3985..49ac678eb2dc 100644
--- a/drivers/net/phy/dp83tc811.c
+++ b/drivers/net/phy/dp83tc811.c
@@ -222,7 +222,7 @@ static int dp83811_config_intr(struct phy_device *phydev)
                 if (err < 0)
                         return err;
 
-                err = phy_write(phydev, MII_DP83811_INT_STAT1, 0);
+                err = phy_write(phydev, MII_DP83811_INT_STAT2, 0);
         }
 
         return err;
diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c
index b8f57e9b9379..1cd439bdf608 100644
--- a/drivers/net/phy/marvell.c
+++ b/drivers/net/phy/marvell.c
@@ -130,8 +130,9 @@
 #define MII_88E1318S_PHY_WOL_CTRL_CLEAR_WOL_STATUS              BIT(12)
 #define MII_88E1318S_PHY_WOL_CTRL_MAGIC_PACKET_MATCH_ENABLE     BIT(14)
 
-#define MII_88E1121_PHY_LED_CTRL        16
+#define MII_PHY_LED_CTRL                16
 #define MII_88E1121_PHY_LED_DEF         0x0030
+#define MII_88E1510_PHY_LED_DEF         0x1177
 
 #define MII_M1011_PHY_STATUS            0x11
 #define MII_M1011_PHY_STATUS_1000       0x8000
@@ -632,8 +633,40 @@ error:
         return err;
 }
 
+static void marvell_config_led(struct phy_device *phydev)
+{
+        u16 def_config;
+        int err;
+
+        switch (MARVELL_PHY_FAMILY_ID(phydev->phy_id)) {
+        /* Default PHY LED config: LED[0] .. Link, LED[1] .. Activity */
+        case MARVELL_PHY_FAMILY_ID(MARVELL_PHY_ID_88E1121R):
+        case MARVELL_PHY_FAMILY_ID(MARVELL_PHY_ID_88E1318S):
+                def_config = MII_88E1121_PHY_LED_DEF;
+                break;
+        /* Default PHY LED config:
+         * LED[0] .. 1000Mbps Link
+         * LED[1] .. 100Mbps Link
+         * LED[2] .. Blink, Activity
+         */
+        case MARVELL_PHY_FAMILY_ID(MARVELL_PHY_ID_88E1510):
+                def_config = MII_88E1510_PHY_LED_DEF;
+                break;
+        default:
+                return;
+        }
+
+        err = phy_write_paged(phydev, MII_MARVELL_LED_PAGE, MII_PHY_LED_CTRL,
+                              def_config);
+        if (err < 0)
+                pr_warn("Fail to config marvell phy LED.\n");
+}
+
 static int marvell_config_init(struct phy_device *phydev)
 {
+        /* Set defalut LED */
+        marvell_config_led(phydev);
+
         /* Set registers from marvell,reg-init DT property */
         return marvell_of_reg_init(phydev);
 }
@@ -813,21 +846,6 @@ static int m88e1111_config_init(struct phy_device *phydev)
         return genphy_soft_reset(phydev);
 }
 
-static int m88e1121_config_init(struct phy_device *phydev)
-{
-        int err;
-
-        /* Default PHY LED config: LED[0] .. Link, LED[1] .. Activity */
-        err = phy_write_paged(phydev, MII_MARVELL_LED_PAGE,
-                              MII_88E1121_PHY_LED_CTRL,
-                              MII_88E1121_PHY_LED_DEF);
-        if (err < 0)
-                return err;
-
-        /* Set marvell,reg-init configuration from device tree */
-        return marvell_config_init(phydev);
-}
-
 static int m88e1318_config_init(struct phy_device *phydev)
 {
         if (phy_interrupt_is_valid(phydev)) {
@@ -841,7 +859,7 @@ static int m88e1318_config_init(struct phy_device *phydev)
                         return err;
         }
 
-        return m88e1121_config_init(phydev);
+        return marvell_config_init(phydev);
 }
 
 static int m88e1510_config_init(struct phy_device *phydev)
@@ -2087,7 +2105,7 @@ static struct phy_driver marvell_drivers[] = {
                 .features = PHY_GBIT_FEATURES,
                 .flags = PHY_HAS_INTERRUPT,
                 .probe = &m88e1121_probe,
-                .config_init = &m88e1121_config_init,
+                .config_init = &marvell_config_init,
                 .config_aneg = &m88e1121_config_aneg,
                 .read_status = &marvell_read_status,
                 .ack_interrupt = &marvell_ack_interrupt,
diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
index 537297d2b4b4..6c9b24fe3148 100644
--- a/drivers/net/phy/phy.c
+++ b/drivers/net/phy/phy.c
@@ -514,7 +514,7 @@ static int phy_start_aneg_priv(struct phy_device *phydev, bool sync)
          * negotiation may already be done and aneg interrupt may not be
          * generated.
          */
-        if (phy_interrupt_is_valid(phydev) && (phydev->state == PHY_AN)) {
+        if (phydev->irq != PHY_POLL && phydev->state == PHY_AN) {
                 err = phy_aneg_done(phydev);
                 if (err > 0) {
                         trigger = true;
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index bd0f339f69fd..b9f5f40a7ac1 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -1724,11 +1724,8 @@ EXPORT_SYMBOL(genphy_loopback);
 
 static int __set_phy_supported(struct phy_device *phydev, u32 max_speed)
 {
-        /* The default values for phydev->supported are provided by the PHY
-         * driver "features" member, we want to reset to sane defaults first
-         * before supporting higher speeds.
-         */
-        phydev->supported &= PHY_DEFAULT_FEATURES;
+        phydev->supported &= ~(PHY_1000BT_FEATURES | PHY_100BT_FEATURES |
+                               PHY_10BT_FEATURES);
 
         switch (max_speed) {
         default:
diff --git a/drivers/net/phy/sfp-bus.c b/drivers/net/phy/sfp-bus.c
index d437f4f5ed52..740655261e5b 100644
--- a/drivers/net/phy/sfp-bus.c
+++ b/drivers/net/phy/sfp-bus.c
@@ -349,7 +349,6 @@ static int sfp_register_bus(struct sfp_bus *bus)
         }
         if (bus->started)
                 bus->socket_ops->start(bus->sfp);
-        bus->netdev->sfp_bus = bus;
         bus->registered = true;
         return 0;
 }
@@ -364,7 +363,6 @@ static void sfp_unregister_bus(struct sfp_bus *bus)
                 if (bus->phydev && ops && ops->disconnect_phy)
                         ops->disconnect_phy(bus->upstream);
         }
-        bus->netdev->sfp_bus = NULL;
         bus->registered = false;
 }
 
@@ -436,6 +434,14 @@ void sfp_upstream_stop(struct sfp_bus *bus)
 }
 EXPORT_SYMBOL_GPL(sfp_upstream_stop);
 
+static void sfp_upstream_clear(struct sfp_bus *bus)
+{
+        bus->upstream_ops = NULL;
+        bus->upstream = NULL;
+        bus->netdev->sfp_bus = NULL;
+        bus->netdev = NULL;
+}
+
 /**
  * sfp_register_upstream() - Register the neighbouring device
  * @fwnode: firmware node for the SFP bus
@@ -461,9 +467,13 @@ struct sfp_bus *sfp_register_upstream(struct fwnode_handle *fwnode,
                 bus->upstream_ops = ops;
                 bus->upstream = upstream;
                 bus->netdev = ndev;
+                ndev->sfp_bus = bus;
 
-                if (bus->sfp)
+                if (bus->sfp) {
                         ret = sfp_register_bus(bus);
+                        if (ret)
+                                sfp_upstream_clear(bus);
+                }
                 rtnl_unlock();
         }
 
@@ -488,8 +498,7 @@ void sfp_unregister_upstream(struct sfp_bus *bus)
         rtnl_lock();
         if (bus->sfp)
                 sfp_unregister_bus(bus);
-        bus->upstream = NULL;
-        bus->netdev = NULL;
+        sfp_upstream_clear(bus);
         rtnl_unlock();
 
         sfp_bus_put(bus);
@@ -561,6 +570,13 @@ void sfp_module_remove(struct sfp_bus *bus)
 }
 EXPORT_SYMBOL_GPL(sfp_module_remove);
 
+static void sfp_socket_clear(struct sfp_bus *bus)
+{
+        bus->sfp_dev = NULL;
+        bus->sfp = NULL;
+        bus->socket_ops = NULL;
+}
+
 struct sfp_bus *sfp_register_socket(struct device *dev, struct sfp *sfp,
                                     const struct sfp_socket_ops *ops)
 {
@@ -573,8 +589,11 @@ struct sfp_bus *sfp_register_socket(struct device *dev, struct sfp *sfp,
                 bus->sfp = sfp;
                 bus->socket_ops = ops;
 
-                if (bus->netdev)
+                if (bus->netdev) {
                         ret = sfp_register_bus(bus);
+                        if (ret)
+                                sfp_socket_clear(bus);
+                }
                 rtnl_unlock();
         }
 
@@ -592,9 +611,7 @@ void sfp_unregister_socket(struct sfp_bus *bus)
         rtnl_lock();
         if (bus->netdev)
                 sfp_unregister_bus(bus);
-        bus->sfp_dev = NULL;
-        bus->sfp = NULL;
-        bus->socket_ops = NULL;
+        sfp_socket_clear(bus);
         rtnl_unlock();
 
         sfp_bus_put(bus);
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index a192a017cc68..f5727baac84a 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1688,7 +1688,7 @@ static struct sk_buff *tun_build_skb(struct tun_struct *tun,
                 case XDP_TX:
                         get_page(alloc_frag->page);
                         alloc_frag->offset += buflen;
-                        if (tun_xdp_tx(tun->dev, &xdp))
+                        if (tun_xdp_tx(tun->dev, &xdp) < 0)
                                 goto err_redirect;
                         rcu_read_unlock();
                         local_bh_enable();
diff --git a/drivers/net/usb/asix_devices.c b/drivers/net/usb/asix_devices.c
index 3d4f7959dabb..b1b3d8f7e67d 100644
--- a/drivers/net/usb/asix_devices.c
+++ b/drivers/net/usb/asix_devices.c
@@ -642,10 +642,12 @@ static void ax88772_restore_phy(struct usbnet *dev)
                                      priv->presvd_phy_advertise);
 
                 /* Restore BMCR */
+                if (priv->presvd_phy_bmcr & BMCR_ANENABLE)
+                        priv->presvd_phy_bmcr |= BMCR_ANRESTART;
+
                 asix_mdio_write_nopm(dev->net, dev->mii.phy_id, MII_BMCR,
                                      priv->presvd_phy_bmcr);
 
-                mii_nway_restart(&dev->mii);
                 priv->presvd_phy_advertise = 0;
                 priv->presvd_phy_bmcr = 0;
         }
diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
index 8dff87ec6d99..ed10d49eb5e0 100644
--- a/drivers/net/usb/lan78xx.c
+++ b/drivers/net/usb/lan78xx.c
@@ -64,6 +64,7 @@
 #define DEFAULT_RX_CSUM_ENABLE          (true)
 #define DEFAULT_TSO_CSUM_ENABLE         (true)
 #define DEFAULT_VLAN_FILTER_ENABLE      (true)
+#define DEFAULT_VLAN_RX_OFFLOAD         (true)
 #define TX_OVERHEAD                     (8)
 #define RXW_PADDING                     2
 
@@ -2298,7 +2299,7 @@ static int lan78xx_change_mtu(struct net_device *netdev, int new_mtu)
         if ((ll_mtu % dev->maxpacket) == 0)
                 return -EDOM;
 
-        ret = lan78xx_set_rx_max_frame_length(dev, new_mtu + ETH_HLEN);
+        ret = lan78xx_set_rx_max_frame_length(dev, new_mtu + VLAN_ETH_HLEN);
 
         netdev->mtu = new_mtu;
 
@@ -2364,6 +2365,11 @@ static int lan78xx_set_features(struct net_device *netdev,
         }
 
         if (features & NETIF_F_HW_VLAN_CTAG_RX)
+                pdata->rfe_ctl |= RFE_CTL_VLAN_STRIP_;
+        else
+                pdata->rfe_ctl &= ~RFE_CTL_VLAN_STRIP_;
+
+        if (features & NETIF_F_HW_VLAN_CTAG_FILTER)
                 pdata->rfe_ctl |= RFE_CTL_VLAN_FILTER_;
         else
                 pdata->rfe_ctl &= ~RFE_CTL_VLAN_FILTER_;
@@ -2587,7 +2593,8 @@ static int lan78xx_reset(struct lan78xx_net *dev)
         buf |= FCT_TX_CTL_EN_;
         ret = lan78xx_write_reg(dev, FCT_TX_CTL, buf);
 
-        ret = lan78xx_set_rx_max_frame_length(dev, dev->net->mtu + ETH_HLEN);
+        ret = lan78xx_set_rx_max_frame_length(dev,
+                                              dev->net->mtu + VLAN_ETH_HLEN);
 
         ret = lan78xx_read_reg(dev, MAC_RX, &buf);
         buf |= MAC_RX_RXEN_;
@@ -2975,6 +2982,12 @@ static int lan78xx_bind(struct lan78xx_net *dev, struct usb_interface *intf)
         if (DEFAULT_TSO_CSUM_ENABLE)
                 dev->net->features |= NETIF_F_TSO | NETIF_F_TSO6 | NETIF_F_SG;
 
+        if (DEFAULT_VLAN_RX_OFFLOAD)
+                dev->net->features |= NETIF_F_HW_VLAN_CTAG_RX;
+
+        if (DEFAULT_VLAN_FILTER_ENABLE)
+                dev->net->features |= NETIF_F_HW_VLAN_CTAG_FILTER;
+
         dev->net->hw_features = dev->net->features;
 
         ret = lan78xx_setup_irq_domain(dev);
@@ -3039,8 +3052,13 @@ static void lan78xx_rx_csum_offload(struct lan78xx_net *dev,
                                     struct sk_buff *skb,
                                     u32 rx_cmd_a, u32 rx_cmd_b)
 {
+        /* HW Checksum offload appears to be flawed if used when not stripping
+         * VLAN headers. Drop back to S/W checksums under these conditions.
+         */
         if (!(dev->net->features & NETIF_F_RXCSUM) ||
-            unlikely(rx_cmd_a & RX_CMD_A_ICSM_)) {
+            unlikely(rx_cmd_a & RX_CMD_A_ICSM_) ||
+            ((rx_cmd_a & RX_CMD_A_FVTG_) &&
+             !(dev->net->features & NETIF_F_HW_VLAN_CTAG_RX))) {
                 skb->ip_summed = CHECKSUM_NONE;
         } else {
                 skb->csum = ntohs((u16)(rx_cmd_b >> RX_CMD_B_CSUM_SHIFT_));
@@ -3048,6 +3066,16 @@ static void lan78xx_rx_csum_offload(struct lan78xx_net *dev,
         }
 }
 
+static void lan78xx_rx_vlan_offload(struct lan78xx_net *dev,
+                                    struct sk_buff *skb,
+                                    u32 rx_cmd_a, u32 rx_cmd_b)
+{
+        if ((dev->net->features & NETIF_F_HW_VLAN_CTAG_RX) &&
+            (rx_cmd_a & RX_CMD_A_FVTG_))
+                __vlan_hwaccel_put_tag(skb, htons(ETH_P_8021Q),
+                                       (rx_cmd_b & 0xffff));
+}
+
 static void lan78xx_skb_return(struct lan78xx_net *dev, struct sk_buff *skb)
 {
         int             status;
@@ -3112,6 +3140,8 @@ static int lan78xx_rx(struct lan78xx_net *dev, struct sk_buff *skb)
                         if (skb->len == size) {
                                 lan78xx_rx_csum_offload(dev, skb,
                                                         rx_cmd_a, rx_cmd_b);
+                                lan78xx_rx_vlan_offload(dev, skb,
+                                                        rx_cmd_a, rx_cmd_b);
 
                                 skb_trim(skb, skb->len - 4); /* remove fcs */
                                 skb->truesize = size + sizeof(struct sk_buff);
@@ -3130,6 +3160,7 @@ static int lan78xx_rx(struct lan78xx_net *dev, struct sk_buff *skb)
                         skb_set_tail_pointer(skb2, size);
 
                         lan78xx_rx_csum_offload(dev, skb2, rx_cmd_a, rx_cmd_b);
+                        lan78xx_rx_vlan_offload(dev, skb2, rx_cmd_a, rx_cmd_b);
 
                         skb_trim(skb2, skb2->len - 4); /* remove fcs */
                         skb2->truesize = size + sizeof(struct sk_buff);
@@ -3313,6 +3344,7 @@ static void lan78xx_tx_bh(struct lan78xx_net *dev)
         pkt_cnt = 0;
         count = 0;
         length = 0;
+        spin_lock_irqsave(&tqp->lock, flags);
         for (skb = tqp->next; pkt_cnt < tqp->qlen; skb = skb->next) {
                 if (skb_is_gso(skb)) {
                         if (pkt_cnt) {
@@ -3321,7 +3353,8 @@ static void lan78xx_tx_bh(struct lan78xx_net *dev)
                         }
                         count = 1;
                         length = skb->len - TX_OVERHEAD;
-                        skb2 = skb_dequeue(tqp);
+                        __skb_unlink(skb, tqp);
+                        spin_unlock_irqrestore(&tqp->lock, flags);
                         goto gso_skb;
                 }
 
@@ -3330,6 +3363,7 @@ static void lan78xx_tx_bh(struct lan78xx_net *dev)
                 skb_totallen = skb->len + roundup(skb_totallen, sizeof(u32));
                 pkt_cnt++;
         }
+        spin_unlock_irqrestore(&tqp->lock, flags);
 
         /* copy to a single skb */
         skb = alloc_skb(skb_totallen, GFP_ATOMIC);
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 8fac8e132c5b..cb0cc30c3d6a 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -1246,13 +1246,14 @@ static const struct usb_device_id products[] = {
         {QMI_FIXED_INTF(0x413c, 0x81b3, 8)},    /* Dell Wireless 5809e Gobi(TM) 4G LTE Mobile Broadband Card (rev3) */
         {QMI_FIXED_INTF(0x413c, 0x81b6, 8)},    /* Dell Wireless 5811e */
         {QMI_FIXED_INTF(0x413c, 0x81b6, 10)},   /* Dell Wireless 5811e */
-        {QMI_FIXED_INTF(0x413c, 0x81d7, 1)},    /* Dell Wireless 5821e */
+        {QMI_FIXED_INTF(0x413c, 0x81d7, 0)},    /* Dell Wireless 5821e */
         {QMI_FIXED_INTF(0x03f0, 0x4e1d, 8)},    /* HP lt4111 LTE/EV-DO/HSPA+ Gobi 4G Module */
         {QMI_FIXED_INTF(0x03f0, 0x9d1d, 1)},    /* HP lt4120 Snapdragon X5 LTE */
         {QMI_FIXED_INTF(0x22de, 0x9061, 3)},    /* WeTelecom WPD-600N */
         {QMI_QUIRK_SET_DTR(0x1e0e, 0x9001, 5)}, /* SIMCom 7100E, 7230E, 7600E ++ */
         {QMI_QUIRK_SET_DTR(0x2c7c, 0x0125, 4)}, /* Quectel EC25, EC20 R2.0  Mini PCIe */
         {QMI_QUIRK_SET_DTR(0x2c7c, 0x0121, 4)}, /* Quectel EC21 Mini PCIe */
+        {QMI_QUIRK_SET_DTR(0x2c7c, 0x0191, 4)}, /* Quectel EG91 */
         {QMI_FIXED_INTF(0x2c7c, 0x0296, 4)},    /* Quectel BG96 */
         {QMI_QUIRK_SET_DTR(0x2c7c, 0x0306, 4)}, /* Quectel EP06 Mini PCIe */
 
diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index 86f7196f9d91..2a58607a6aea 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -3962,7 +3962,8 @@ static int rtl8152_close(struct net_device *netdev)
 #ifdef CONFIG_PM_SLEEP
         unregister_pm_notifier(&tp->pm_notifier);
 #endif
-        napi_disable(&tp->napi);
+        if (!test_bit(RTL8152_UNPLUG, &tp->flags))
+                napi_disable(&tp->napi);
         clear_bit(WORK_ENABLE, &tp->flags);
         usb_kill_urb(tp->intr_urb);
         cancel_delayed_work_sync(&tp->schedule);
diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c
index 5f565bd574da..48ba80a8ca5c 100644
--- a/drivers/net/usb/rtl8150.c
+++ b/drivers/net/usb/rtl8150.c
@@ -681,7 +681,7 @@ static void rtl8150_set_multicast(struct net_device *netdev)
                    (netdev->flags & IFF_ALLMULTI)) {
                 rx_creg &= 0xfffe;
                 rx_creg |= 0x0002;
-                dev_info(&netdev->dev, "%s: allmulti set\n", netdev->name);
+                dev_dbg(&netdev->dev, "%s: allmulti set\n", netdev->name);
         } else {
                 /* ~RX_MULTICAST, ~RX_PROMISCUOUS */
                 rx_creg &= 0x00fc;
diff --git a/drivers/net/usb/smsc75xx.c b/drivers/net/usb/smsc75xx.c
index 7a6a1fe79309..05553d252446 100644
--- a/drivers/net/usb/smsc75xx.c
+++ b/drivers/net/usb/smsc75xx.c
@@ -82,6 +82,9 @@ static bool turbo_mode = true;
 module_param(turbo_mode, bool, 0644);
 MODULE_PARM_DESC(turbo_mode, "Enable multiple frames per Rx transaction");
 
+static int smsc75xx_link_ok_nopm(struct usbnet *dev);
+static int smsc75xx_phy_gig_workaround(struct usbnet *dev);
+
 static int __must_check __smsc75xx_read_reg(struct usbnet *dev, u32 index,
                                             u32 *data, int in_pm)
 {
@@ -852,6 +855,9 @@ static int smsc75xx_phy_initialize(struct usbnet *dev)
                 return -EIO;
         }
 
+        /* phy workaround for gig link */
+        smsc75xx_phy_gig_workaround(dev);
+
         smsc75xx_mdio_write(dev->net, dev->mii.phy_id, MII_ADVERTISE,
                 ADVERTISE_ALL | ADVERTISE_CSMA | ADVERTISE_PAUSE_CAP |
                 ADVERTISE_PAUSE_ASYM);
@@ -987,6 +993,62 @@ static int smsc75xx_wait_ready(struct usbnet *dev, int in_pm)
         return -EIO;
 }
 
+static int smsc75xx_phy_gig_workaround(struct usbnet *dev)
+{
+        struct mii_if_info *mii = &dev->mii;
+        int ret = 0, timeout = 0;
+        u32 buf, link_up = 0;
+
+        /* Set the phy in Gig loopback */
+        smsc75xx_mdio_write(dev->net, mii->phy_id, MII_BMCR, 0x4040);
+
+        /* Wait for the link up */
+        do {
+                link_up = smsc75xx_link_ok_nopm(dev);
+                usleep_range(10000, 20000);
+                timeout++;
+        } while ((!link_up) && (timeout < 1000));
+
+        if (timeout >= 1000) {
+                netdev_warn(dev->net, "Timeout waiting for PHY link up\n");
+                return -EIO;
+        }
+
+        /* phy reset */
+        ret = smsc75xx_read_reg(dev, PMT_CTL, &buf);
+        if (ret < 0) {
+                netdev_warn(dev->net, "Failed to read PMT_CTL: %d\n", ret);
+                return ret;
+        }
+
+        buf |= PMT_CTL_PHY_RST;
+
+        ret = smsc75xx_write_reg(dev, PMT_CTL, buf);
+        if (ret < 0) {
+                netdev_warn(dev->net, "Failed to write PMT_CTL: %d\n", ret);
+                return ret;
+        }
+
+        timeout = 0;
+        do {
+                usleep_range(10000, 20000);
+                ret = smsc75xx_read_reg(dev, PMT_CTL, &buf);
+                if (ret < 0) {
+                        netdev_warn(dev->net, "Failed to read PMT_CTL: %d\n",
+                                    ret);
+                        return ret;
+                }
+                timeout++;
+        } while ((buf & PMT_CTL_PHY_RST) && (timeout < 100));
+
+        if (timeout >= 100) {
+                netdev_warn(dev->net, "timeout waiting for PHY Reset\n");
+                return -EIO;
+        }
+
+        return 0;
+}
+
 static int smsc75xx_reset(struct usbnet *dev)
 {
         struct smsc75xx_priv *pdata = (struct smsc75xx_priv *)(dev->data[0]);
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index b6c9a2af3732..53085c63277b 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -53,6 +53,10 @@ module_param(napi_tx, bool, 0644);
 /* Amount of XDP headroom to prepend to packets for use by xdp_adjust_head */
 #define VIRTIO_XDP_HEADROOM 256
 
+/* Separating two types of XDP xmit */
+#define VIRTIO_XDP_TX           BIT(0)
+#define VIRTIO_XDP_REDIR        BIT(1)
+
 /* RX packet size EWMA. The average packet size is used to determine the packet
  * buffer size when refilling RX rings. As the entire RX ring may be refilled
  * at once, the weight is chosen so that the EWMA will be insensitive to short-
@@ -582,7 +586,7 @@ static struct sk_buff *receive_small(struct net_device *dev,
                                      struct receive_queue *rq,
                                      void *buf, void *ctx,
                                      unsigned int len,
-                                     bool *xdp_xmit)
+                                     unsigned int *xdp_xmit)
 {
         struct sk_buff *skb;
         struct bpf_prog *xdp_prog;
@@ -654,14 +658,14 @@ static struct sk_buff *receive_small(struct net_device *dev,
                                 trace_xdp_exception(vi->dev, xdp_prog, act);
                                 goto err_xdp;
                         }
-                        *xdp_xmit = true;
+                        *xdp_xmit |= VIRTIO_XDP_TX;
                         rcu_read_unlock();
                         goto xdp_xmit;
                 case XDP_REDIRECT:
                         err = xdp_do_redirect(dev, &xdp, xdp_prog);
                         if (err)
                                 goto err_xdp;
-                        *xdp_xmit = true;
+                        *xdp_xmit |= VIRTIO_XDP_REDIR;
                         rcu_read_unlock();
                         goto xdp_xmit;
                 default:
@@ -723,7 +727,7 @@ static struct sk_buff *receive_mergeable(struct net_device *dev,
                                          void *buf,
                                          void *ctx,
                                          unsigned int len,
-                                         bool *xdp_xmit)
+                                         unsigned int *xdp_xmit)
 {
         struct virtio_net_hdr_mrg_rxbuf *hdr = buf;
         u16 num_buf = virtio16_to_cpu(vi->vdev, hdr->num_buffers);
@@ -818,7 +822,7 @@ static struct sk_buff *receive_mergeable(struct net_device *dev,
                                         put_page(xdp_page);
                                 goto err_xdp;
                         }
-                        *xdp_xmit = true;
+                        *xdp_xmit |= VIRTIO_XDP_TX;
                         if (unlikely(xdp_page != page))
                                 put_page(page);
                         rcu_read_unlock();
@@ -830,7 +834,7 @@ static struct sk_buff *receive_mergeable(struct net_device *dev,
                                         put_page(xdp_page);
                                 goto err_xdp;
                         }
-                        *xdp_xmit = true;
+                        *xdp_xmit |= VIRTIO_XDP_REDIR;
                         if (unlikely(xdp_page != page))
                                 put_page(page);
                         rcu_read_unlock();
@@ -939,7 +943,8 @@ xdp_xmit:
 }
 
 static int receive_buf(struct virtnet_info *vi, struct receive_queue *rq,
-                       void *buf, unsigned int len, void **ctx, bool *xdp_xmit)
+                       void *buf, unsigned int len, void **ctx,
+                       unsigned int *xdp_xmit)
 {
         struct net_device *dev = vi->dev;
         struct sk_buff *skb;
@@ -1232,7 +1237,8 @@ static void refill_work(struct work_struct *work)
         }
 }
 
-static int virtnet_receive(struct receive_queue *rq, int budget, bool *xdp_xmit)
+static int virtnet_receive(struct receive_queue *rq, int budget,
+                           unsigned int *xdp_xmit)
 {
         struct virtnet_info *vi = rq->vq->vdev->priv;
         unsigned int len, received = 0, bytes = 0;
@@ -1321,7 +1327,7 @@ static int virtnet_poll(struct napi_struct *napi, int budget)
         struct virtnet_info *vi = rq->vq->vdev->priv;
         struct send_queue *sq;
         unsigned int received, qp;
-        bool xdp_xmit = false;
+        unsigned int xdp_xmit = 0;
 
         virtnet_poll_cleantx(rq);
 
@@ -1331,12 +1337,14 @@ static int virtnet_poll(struct napi_struct *napi, int budget)
         if (received < budget)
                 virtqueue_napi_complete(napi, rq->vq, received);
 
-        if (xdp_xmit) {
+        if (xdp_xmit & VIRTIO_XDP_REDIR)
+                xdp_do_flush_map();
+
+        if (xdp_xmit & VIRTIO_XDP_TX) {
                 qp = vi->curr_queue_pairs - vi->xdp_queue_pairs +
                      smp_processor_id();
                 sq = &vi->sq[qp];
                 virtqueue_kick(sq->vq);
-                xdp_do_flush_map();
         }
 
         return received;
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index aee0e60471f1..e857cb3335f6 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -623,9 +623,7 @@ static struct sk_buff **vxlan_gro_receive(struct sock *sk,
         flush = 0;
 
 out:
-        skb_gro_remcsum_cleanup(skb, &grc);
-        skb->remcsum_offload = 0;
-        NAPI_GRO_CB(skb)->flush |= flush;
+        skb_gro_flush_final_remcsum(skb, pp, flush, &grc);
 
         return pp;
 }
@@ -638,9 +636,62 @@ static int vxlan_gro_complete(struct sock *sk, struct sk_buff *skb, int nhoff)
         return eth_gro_complete(skb, nhoff + sizeof(struct vxlanhdr));
 }
 
-/* Add new entry to forwarding table -- assumes lock held */
+static struct vxlan_fdb *vxlan_fdb_alloc(struct vxlan_dev *vxlan,
+                                         const u8 *mac, __u16 state,
+                                         __be32 src_vni, __u8 ndm_flags)
+{
+        struct vxlan_fdb *f;
+
+        f = kmalloc(sizeof(*f), GFP_ATOMIC);
+        if (!f)
+                return NULL;
+        f->state = state;
+        f->flags = ndm_flags;
+        f->updated = f->used = jiffies;
+        f->vni = src_vni;
+        INIT_LIST_HEAD(&f->remotes);
+        memcpy(f->eth_addr, mac, ETH_ALEN);
+
+        return f;
+}
+
 static int vxlan_fdb_create(struct vxlan_dev *vxlan,
                             const u8 *mac, union vxlan_addr *ip,
+                            __u16 state, __be16 port, __be32 src_vni,
+                            __be32 vni, __u32 ifindex, __u8 ndm_flags,
+                            struct vxlan_fdb **fdb)
+{
+        struct vxlan_rdst *rd = NULL;
+        struct vxlan_fdb *f;
+        int rc;
+
+        if (vxlan->cfg.addrmax &&
+            vxlan->addrcnt >= vxlan->cfg.addrmax)
+                return -ENOSPC;
+
+        netdev_dbg(vxlan->dev, "add %pM -> %pIS\n", mac, ip);
+        f = vxlan_fdb_alloc(vxlan, mac, state, src_vni, ndm_flags);
+        if (!f)
+                return -ENOMEM;
+
+        rc = vxlan_fdb_append(f, ip, port, vni, ifindex, &rd);
+        if (rc < 0) {
+                kfree(f);
+                return rc;
+        }
+
+        ++vxlan->addrcnt;
+        hlist_add_head_rcu(&f->hlist,
+                           vxlan_fdb_head(vxlan, mac, src_vni));
+
+        *fdb = f;
+
+        return 0;
+}
+
+/* Add new entry to forwarding table -- assumes lock held */
+static int vxlan_fdb_update(struct vxlan_dev *vxlan,
+                            const u8 *mac, union vxlan_addr *ip,
                             __u16 state, __u16 flags,
                             __be16 port, __be32 src_vni, __be32 vni,
                             __u32 ifindex, __u8 ndm_flags)
@@ -689,37 +740,17 @@ static int vxlan_fdb_create(struct vxlan_dev *vxlan,
                 if (!(flags & NLM_F_CREATE))
                         return -ENOENT;
 
-                if (vxlan->cfg.addrmax &&
-                    vxlan->addrcnt >= vxlan->cfg.addrmax)
-                        return -ENOSPC;
-
                 /* Disallow replace to add a multicast entry */
                 if ((flags & NLM_F_REPLACE) &&
                     (is_multicast_ether_addr(mac) || is_zero_ether_addr(mac)))
                         return -EOPNOTSUPP;
 
                 netdev_dbg(vxlan->dev, "add %pM -> %pIS\n", mac, ip);
-                f = kmalloc(sizeof(*f), GFP_ATOMIC);
-                if (!f)
-                        return -ENOMEM;
-
-                notify = 1;
-                f->state = state;
-                f->flags = ndm_flags;
-                f->updated = f->used = jiffies;
-                f->vni = src_vni;
-                INIT_LIST_HEAD(&f->remotes);
-                memcpy(f->eth_addr, mac, ETH_ALEN);
-
-                rc = vxlan_fdb_append(f, ip, port, vni, ifindex, &rd);
-                if (rc < 0) {
-                        kfree(f);
+                rc = vxlan_fdb_create(vxlan, mac, ip, state, port, src_vni,
+                                      vni, ifindex, ndm_flags, &f);
+                if (rc < 0)
                         return rc;
-                }
-
-                ++vxlan->addrcnt;
-                hlist_add_head_rcu(&f->hlist,
-                                   vxlan_fdb_head(vxlan, mac, src_vni));
+                notify = 1;
         }
 
         if (notify) {
@@ -743,13 +774,15 @@ static void vxlan_fdb_free(struct rcu_head *head)
         kfree(f);
 }
 
-static void vxlan_fdb_destroy(struct vxlan_dev *vxlan, struct vxlan_fdb *f)
+static void vxlan_fdb_destroy(struct vxlan_dev *vxlan, struct vxlan_fdb *f,
+                              bool do_notify)
 {
         netdev_dbg(vxlan->dev,
                     "delete %pM\n", f->eth_addr);
 
         --vxlan->addrcnt;
-        vxlan_fdb_notify(vxlan, f, first_remote_rtnl(f), RTM_DELNEIGH);
+        if (do_notify)
+                vxlan_fdb_notify(vxlan, f, first_remote_rtnl(f), RTM_DELNEIGH);
 
         hlist_del_rcu(&f->hlist);
         call_rcu(&f->rcu, vxlan_fdb_free);
@@ -865,7 +898,7 @@ static int vxlan_fdb_add(struct ndmsg *ndm, struct nlattr *tb[],
                 return -EAFNOSUPPORT;
 
         spin_lock_bh(&vxlan->hash_lock);
-        err = vxlan_fdb_create(vxlan, addr, &ip, ndm->ndm_state, flags,
+        err = vxlan_fdb_update(vxlan, addr, &ip, ndm->ndm_state, flags,
                                port, src_vni, vni, ifindex, ndm->ndm_flags);
         spin_unlock_bh(&vxlan->hash_lock);
 
@@ -899,7 +932,7 @@ static int __vxlan_fdb_delete(struct vxlan_dev *vxlan,
                 goto out;
         }
 
-        vxlan_fdb_destroy(vxlan, f);
+        vxlan_fdb_destroy(vxlan, f, true);
 
 out:
         return 0;
@@ -1008,7 +1041,7 @@ static bool vxlan_snoop(struct net_device *dev,
 
                 /* close off race between vxlan_flush and incoming packets */
                 if (netif_running(dev))
-                        vxlan_fdb_create(vxlan, src_mac, src_ip,
+                        vxlan_fdb_update(vxlan, src_mac, src_ip,
                                          NUD_REACHABLE,
                                          NLM_F_EXCL|NLM_F_CREATE,
                                          vxlan->cfg.dst_port,
@@ -2366,7 +2399,7 @@ static void vxlan_cleanup(struct timer_list *t)
                                            "garbage collect %pM\n",
                                            f->eth_addr);
                                 f->state = NUD_STALE;
-                                vxlan_fdb_destroy(vxlan, f);
+                                vxlan_fdb_destroy(vxlan, f, true);
                         } else if (time_before(timeout, next_timer))
                                 next_timer = timeout;
                 }
@@ -2417,7 +2450,7 @@ static void vxlan_fdb_delete_default(struct vxlan_dev *vxlan, __be32 vni)
         spin_lock_bh(&vxlan->hash_lock);
         f = __vxlan_find_mac(vxlan, all_zeros_mac, vni);
         if (f)
-                vxlan_fdb_destroy(vxlan, f);
+                vxlan_fdb_destroy(vxlan, f, true);
         spin_unlock_bh(&vxlan->hash_lock);
 }
 
@@ -2471,7 +2504,7 @@ static void vxlan_flush(struct vxlan_dev *vxlan, bool do_all)
                                 continue;
                         /* the all_zeros_mac entry is deleted at vxlan_uninit */
                         if (!is_zero_ether_addr(f->eth_addr))
-                                vxlan_fdb_destroy(vxlan, f);
+                                vxlan_fdb_destroy(vxlan, f, true);
                 }
         }
         spin_unlock_bh(&vxlan->hash_lock);
@@ -3162,6 +3195,7 @@ static int __vxlan_dev_create(struct net *net, struct net_device *dev,
 {
         struct vxlan_net *vn = net_generic(net, vxlan_net_id);
         struct vxlan_dev *vxlan = netdev_priv(dev);
+        struct vxlan_fdb *f = NULL;
         int err;
 
         err = vxlan_dev_configure(net, dev, conf, false, extack);
@@ -3175,24 +3209,35 @@ static int __vxlan_dev_create(struct net *net, struct net_device *dev,
                 err = vxlan_fdb_create(vxlan, all_zeros_mac,
                                        &vxlan->default_dst.remote_ip,
                                        NUD_REACHABLE | NUD_PERMANENT,
-                                       NLM_F_EXCL | NLM_F_CREATE,
                                        vxlan->cfg.dst_port,
                                        vxlan->default_dst.remote_vni,
                                        vxlan->default_dst.remote_vni,
                                        vxlan->default_dst.remote_ifindex,
-                                       NTF_SELF);
+                                       NTF_SELF, &f);
                 if (err)
                         return err;
         }
 
         err = register_netdevice(dev);
+        if (err)
+                goto errout;
+
+        err = rtnl_configure_link(dev, NULL);
         if (err) {
-                vxlan_fdb_delete_default(vxlan, vxlan->default_dst.remote_vni);
-                return err;
+                unregister_netdevice(dev);
+                goto errout;
         }
 
+        /* notify default fdb entry */
+        if (f)
+                vxlan_fdb_notify(vxlan, f, first_remote_rtnl(f), RTM_NEWNEIGH);
+
         list_add(&vxlan->next, &vn->vxlan_list);
         return 0;
+errout:
+        if (f)
+                vxlan_fdb_destroy(vxlan, f, false);
+        return err;
 }
 
 static int vxlan_nl2conf(struct nlattr *tb[], struct nlattr *data[],
@@ -3427,6 +3472,7 @@ static int vxlan_changelink(struct net_device *dev, struct nlattr *tb[],
         struct vxlan_rdst *dst = &vxlan->default_dst;
         struct vxlan_rdst old_dst;
         struct vxlan_config conf;
+        struct vxlan_fdb *f = NULL;
         int err;
 
         err = vxlan_nl2conf(tb, data,
@@ -3455,16 +3501,16 @@ static int vxlan_changelink(struct net_device *dev, struct nlattr *tb[],
                         err = vxlan_fdb_create(vxlan, all_zeros_mac,
                                                &dst->remote_ip,
                                                NUD_REACHABLE | NUD_PERMANENT,
-                                               NLM_F_CREATE | NLM_F_APPEND,
                                                vxlan->cfg.dst_port,
                                                dst->remote_vni,
                                                dst->remote_vni,
                                                dst->remote_ifindex,
-                                               NTF_SELF);
+                                               NTF_SELF, &f);
                         if (err) {
                                 spin_unlock_bh(&vxlan->hash_lock);
                                 return err;
                         }
+                        vxlan_fdb_notify(vxlan, f, first_remote_rtnl(f), RTM_NEWNEIGH);
                 }
                 spin_unlock_bh(&vxlan->hash_lock);
         }
diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
index e9c2fb318c03..836e0a47b94a 100644
--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -6058,8 +6058,19 @@ static void ath10k_sta_rc_update_wk(struct work_struct *wk)
                            ath10k_mac_max_vht_nss(vht_mcs_mask)));
 
         if (changed & IEEE80211_RC_BW_CHANGED) {
-                ath10k_dbg(ar, ATH10K_DBG_MAC, "mac update sta %pM peer bw %d\n",
-                           sta->addr, bw);
+                enum wmi_phy_mode mode;
+
+                mode = chan_to_phymode(&def);
+                ath10k_dbg(ar, ATH10K_DBG_MAC, "mac update sta %pM peer bw %d phymode %d\n",
+                                sta->addr, bw, mode);
+
+                err = ath10k_wmi_peer_set_param(ar, arvif->vdev_id, sta->addr,
+                                WMI_PEER_PHYMODE, mode);
+                if (err) {
+                        ath10k_warn(ar, "failed to update STA %pM peer phymode %d: %d\n",
+                                        sta->addr, mode, err);
+                        goto exit;
+                }
 
                 err = ath10k_wmi_peer_set_param(ar, arvif->vdev_id, sta->addr,
                                                 WMI_PEER_CHAN_WIDTH, bw);
@@ -6100,6 +6111,7 @@ static void ath10k_sta_rc_update_wk(struct work_struct *wk)
                                     sta->addr);
         }
 
+exit:
         mutex_unlock(&ar->conf_mutex);
 }
 
diff --git a/drivers/net/wireless/ath/ath10k/wmi.h b/drivers/net/wireless/ath/ath10k/wmi.h
index b48db54e9865..d68afb65402a 100644
--- a/drivers/net/wireless/ath/ath10k/wmi.h
+++ b/drivers/net/wireless/ath/ath10k/wmi.h
@@ -6144,6 +6144,7 @@ enum wmi_peer_param {
         WMI_PEER_NSS        = 0x5,
         WMI_PEER_USE_4ADDR  = 0x6,
         WMI_PEER_DEBUG      = 0xa,
+        WMI_PEER_PHYMODE    = 0xd,
         WMI_PEER_DUMMY_VAR  = 0xff, /* dummy parameter for STA PS workaround */
 };
 
diff --git a/drivers/net/wireless/ath/wcn36xx/testmode.c b/drivers/net/wireless/ath/wcn36xx/testmode.c
index 1279064a3b71..51a038022c8b 100644
--- a/drivers/net/wireless/ath/wcn36xx/testmode.c
+++ b/drivers/net/wireless/ath/wcn36xx/testmode.c
@@ -1,4 +1,4 @@
-/*
+/*
  * Copyright (c) 2018, The Linux Foundation. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
index c99a191e8d69..a907d7b065fa 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
@@ -4296,6 +4296,13 @@ void brcmf_sdio_remove(struct brcmf_sdio *bus)
         brcmf_dbg(TRACE, "Enter\n");
 
         if (bus) {
+                /* Stop watchdog task */
+                if (bus->watchdog_tsk) {
+                        send_sig(SIGTERM, bus->watchdog_tsk, 1);
+                        kthread_stop(bus->watchdog_tsk);
+                        bus->watchdog_tsk = NULL;
+                }
+
                 /* De-register interrupt handler */
                 brcmf_sdiod_intr_unregister(bus->sdiodev);
 
diff --git a/drivers/net/wireless/marvell/mwifiex/usb.c b/drivers/net/wireless/marvell/mwifiex/usb.c
index 6e3cf9817730..88f4c89f89ba 100644
--- a/drivers/net/wireless/marvell/mwifiex/usb.c
+++ b/drivers/net/wireless/marvell/mwifiex/usb.c
@@ -644,11 +644,6 @@ static void mwifiex_usb_disconnect(struct usb_interface *intf)
                                          MWIFIEX_FUNC_SHUTDOWN);
         }
 
-        if (adapter->workqueue)
-                flush_workqueue(adapter->workqueue);
-
-        mwifiex_usb_free(card);
-
         mwifiex_dbg(adapter, FATAL,
                     "%s: removing card\n", __func__);
         mwifiex_remove_card(adapter);
@@ -1356,6 +1351,8 @@ static void mwifiex_unregister_dev(struct mwifiex_adapter *adapter)
 {
         struct usb_card_rec *card = (struct usb_card_rec *)adapter->card;
 
+        mwifiex_usb_free(card);
+
         mwifiex_usb_cleanup_tx_aggr(adapter);
 
         card->adapter = NULL;
diff --git a/drivers/net/wireless/mediatek/mt7601u/phy.c b/drivers/net/wireless/mediatek/mt7601u/phy.c
index 9d2f9a776ef1..b804abd464ae 100644
--- a/drivers/net/wireless/mediatek/mt7601u/phy.c
+++ b/drivers/net/wireless/mediatek/mt7601u/phy.c
@@ -986,13 +986,15 @@ static void mt7601u_agc_tune(struct mt7601u_dev *dev)
          */
         spin_lock_bh(&dev->con_mon_lock);
         avg_rssi = ewma_rssi_read(&dev->avg_rssi);
-        WARN_ON_ONCE(avg_rssi == 0);
+        spin_unlock_bh(&dev->con_mon_lock);
+        if (avg_rssi == 0)
+                return;
+
         avg_rssi = -avg_rssi;
         if (avg_rssi <= -70)
                 val -= 0x20;
         else if (avg_rssi <= -60)
                 val -= 0x10;
-        spin_unlock_bh(&dev->con_mon_lock);
 
         if (val != mt7601u_bbp_rr(dev, 66))
                 mt7601u_bbp_wr(dev, 66, val);
diff --git a/drivers/net/wireless/quantenna/qtnfmac/cfg80211.c b/drivers/net/wireless/quantenna/qtnfmac/cfg80211.c
index 220e2b710208..ae0ca8006849 100644
--- a/drivers/net/wireless/quantenna/qtnfmac/cfg80211.c
+++ b/drivers/net/wireless/quantenna/qtnfmac/cfg80211.c
@@ -654,8 +654,7 @@ qtnf_disconnect(struct wiphy *wiphy, struct net_device *dev,
         vif = qtnf_mac_get_base_vif(mac);
         if (!vif) {
                 pr_err("MAC%u: primary VIF is not configured\n", mac->macid);
-                ret = -EFAULT;
-                goto out;
+                return -EFAULT;
         }
 
         if (vif->wdev.iftype != NL80211_IFTYPE_STATION) {
diff --git a/drivers/net/wireless/realtek/rtlwifi/base.c b/drivers/net/wireless/realtek/rtlwifi/base.c
index 39c817eddd78..54c9f6ab0c8c 100644
--- a/drivers/net/wireless/realtek/rtlwifi/base.c
+++ b/drivers/net/wireless/realtek/rtlwifi/base.c
@@ -484,18 +484,21 @@ static void _rtl_init_deferred_work(struct ieee80211_hw *hw)
 
 }
 
-void rtl_deinit_deferred_work(struct ieee80211_hw *hw)
+void rtl_deinit_deferred_work(struct ieee80211_hw *hw, bool ips_wq)
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
 
         del_timer_sync(&rtlpriv->works.watchdog_timer);
 
-        cancel_delayed_work(&rtlpriv->works.watchdog_wq);
-        cancel_delayed_work(&rtlpriv->works.ips_nic_off_wq);
-        cancel_delayed_work(&rtlpriv->works.ps_work);
-        cancel_delayed_work(&rtlpriv->works.ps_rfon_wq);
-        cancel_delayed_work(&rtlpriv->works.fwevt_wq);
-        cancel_delayed_work(&rtlpriv->works.c2hcmd_wq);
+        cancel_delayed_work_sync(&rtlpriv->works.watchdog_wq);
+        if (ips_wq)
+                cancel_delayed_work(&rtlpriv->works.ips_nic_off_wq);
+        else
+                cancel_delayed_work_sync(&rtlpriv->works.ips_nic_off_wq);
+        cancel_delayed_work_sync(&rtlpriv->works.ps_work);
+        cancel_delayed_work_sync(&rtlpriv->works.ps_rfon_wq);
+        cancel_delayed_work_sync(&rtlpriv->works.fwevt_wq);
+        cancel_delayed_work_sync(&rtlpriv->works.c2hcmd_wq);
 }
 EXPORT_SYMBOL_GPL(rtl_deinit_deferred_work);
 
diff --git a/drivers/net/wireless/realtek/rtlwifi/base.h b/drivers/net/wireless/realtek/rtlwifi/base.h
index 912f205779c3..a7ae40eaa3cd 100644
--- a/drivers/net/wireless/realtek/rtlwifi/base.h
+++ b/drivers/net/wireless/realtek/rtlwifi/base.h
@@ -121,7 +121,7 @@ void rtl_init_rfkill(struct ieee80211_hw *hw);
 void rtl_deinit_rfkill(struct ieee80211_hw *hw);
 
 void rtl_watch_dog_timer_callback(struct timer_list *t);
-void rtl_deinit_deferred_work(struct ieee80211_hw *hw);
+void rtl_deinit_deferred_work(struct ieee80211_hw *hw, bool ips_wq);
 
 bool rtl_action_proc(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx);
 int rtlwifi_rate_mapping(struct ieee80211_hw *hw, bool isht,
diff --git a/drivers/net/wireless/realtek/rtlwifi/core.c b/drivers/net/wireless/realtek/rtlwifi/core.c
index cfea57efa7f4..4bf7967590ca 100644
--- a/drivers/net/wireless/realtek/rtlwifi/core.c
+++ b/drivers/net/wireless/realtek/rtlwifi/core.c
@@ -130,7 +130,6 @@ found_alt:
                        firmware->size);
                 rtlpriv->rtlhal.wowlan_fwsize = firmware->size;
         }
-        rtlpriv->rtlhal.fwsize = firmware->size;
         release_firmware(firmware);
 }
 
@@ -196,7 +195,7 @@ static void rtl_op_stop(struct ieee80211_hw *hw)
                 /* reset sec info */
                 rtl_cam_reset_sec_info(hw);
 
-                rtl_deinit_deferred_work(hw);
+                rtl_deinit_deferred_work(hw, false);
         }
         rtlpriv->intf_ops->adapter_stop(hw);
 
diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c
index ae13bcfb3bf0..5d1fda16fc8c 100644
--- a/drivers/net/wireless/realtek/rtlwifi/pci.c
+++ b/drivers/net/wireless/realtek/rtlwifi/pci.c
@@ -2377,7 +2377,7 @@ void rtl_pci_disconnect(struct pci_dev *pdev)
                 ieee80211_unregister_hw(hw);
                 rtlmac->mac80211_registered = 0;
         } else {
-                rtl_deinit_deferred_work(hw);
+                rtl_deinit_deferred_work(hw, false);
                 rtlpriv->intf_ops->adapter_stop(hw);
         }
         rtlpriv->cfg->ops->disable_interrupt(hw);
diff --git a/drivers/net/wireless/realtek/rtlwifi/ps.c b/drivers/net/wireless/realtek/rtlwifi/ps.c
index 71af24e2e051..479a4cfc245d 100644
--- a/drivers/net/wireless/realtek/rtlwifi/ps.c
+++ b/drivers/net/wireless/realtek/rtlwifi/ps.c
@@ -71,7 +71,7 @@ bool rtl_ps_disable_nic(struct ieee80211_hw *hw)
         struct rtl_priv *rtlpriv = rtl_priv(hw);
 
         /*<1> Stop all timer */
-        rtl_deinit_deferred_work(hw);
+        rtl_deinit_deferred_work(hw, true);
 
         /*<2> Disable Interrupt */
         rtlpriv->cfg->ops->disable_interrupt(hw);
@@ -292,7 +292,7 @@ void rtl_ips_nic_on(struct ieee80211_hw *hw)
         struct rtl_ps_ctl *ppsc = rtl_psc(rtl_priv(hw));
         enum rf_pwrstate rtstate;
 
-        cancel_delayed_work(&rtlpriv->works.ips_nic_off_wq);
+        cancel_delayed_work_sync(&rtlpriv->works.ips_nic_off_wq);
 
         mutex_lock(&rtlpriv->locks.ips_mutex);
         if (ppsc->inactiveps) {
diff --git a/drivers/net/wireless/realtek/rtlwifi/usb.c b/drivers/net/wireless/realtek/rtlwifi/usb.c
index f9faffc498bc..2ac5004d7a40 100644
--- a/drivers/net/wireless/realtek/rtlwifi/usb.c
+++ b/drivers/net/wireless/realtek/rtlwifi/usb.c
@@ -1132,7 +1132,7 @@ void rtl_usb_disconnect(struct usb_interface *intf)
                 ieee80211_unregister_hw(hw);
                 rtlmac->mac80211_registered = 0;
         } else {
-                rtl_deinit_deferred_work(hw);
+                rtl_deinit_deferred_work(hw, false);
                 rtlpriv->intf_ops->adapter_stop(hw);
         }
         /*deinit rfkill */
diff --git a/drivers/nvdimm/claim.c b/drivers/nvdimm/claim.c
index 2e96b34bc936..fb667bf469c7 100644
--- a/drivers/nvdimm/claim.c
+++ b/drivers/nvdimm/claim.c
@@ -278,6 +278,7 @@ static int nsio_rw_bytes(struct nd_namespace_common *ndns,
                         return -EIO;
                 if (memcpy_mcsafe(buf, nsio->addr + offset, size) != 0)
                         return -EIO;
+                return 0;
         }
 
         if (unlikely(is_bad_pmem(&nsio->bb, sector, sz_align))) {
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index 46df030b2c3f..bf65501e6ed6 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -100,6 +100,22 @@ static struct class *nvme_subsys_class;
 static void nvme_ns_remove(struct nvme_ns *ns);
 static int nvme_revalidate_disk(struct gendisk *disk);
 static void nvme_put_subsystem(struct nvme_subsystem *subsys);
+static void nvme_remove_invalid_namespaces(struct nvme_ctrl *ctrl,
+                                           unsigned nsid);
+
+static void nvme_set_queue_dying(struct nvme_ns *ns)
+{
+        /*
+         * Revalidating a dead namespace sets capacity to 0. This will end
+         * buffered writers dirtying pages that can't be synced.
+         */
+        if (!ns->disk || test_and_set_bit(NVME_NS_DEAD, &ns->flags))
+                return;
+        revalidate_disk(ns->disk);
+        blk_set_queue_dying(ns->queue);
+        /* Forcibly unquiesce queues to avoid blocking dispatch */
+        blk_mq_unquiesce_queue(ns->queue);
+}
 
 static void nvme_queue_scan(struct nvme_ctrl *ctrl)
 {
@@ -1044,14 +1060,17 @@ EXPORT_SYMBOL_GPL(nvme_set_queue_count);
 
 static void nvme_enable_aen(struct nvme_ctrl *ctrl)
 {
-        u32 result;
+        u32 result, supported_aens = ctrl->oaes & NVME_AEN_SUPPORTED;
         int status;
 
-        status = nvme_set_features(ctrl, NVME_FEAT_ASYNC_EVENT,
-                        ctrl->oaes & NVME_AEN_SUPPORTED, NULL, 0, &result);
+        if (!supported_aens)
+                return;
+
+        status = nvme_set_features(ctrl, NVME_FEAT_ASYNC_EVENT, supported_aens,
+                        NULL, 0, &result);
         if (status)
                 dev_warn(ctrl->device, "Failed to configure AEN (cfg %x)\n",
-                         ctrl->oaes & NVME_AEN_SUPPORTED);
+                         supported_aens);
 }
 
 static int nvme_submit_io(struct nvme_ns *ns, struct nvme_user_io __user *uio)
@@ -1151,19 +1170,15 @@ static u32 nvme_passthru_start(struct nvme_ctrl *ctrl, struct nvme_ns *ns,
 
 static void nvme_update_formats(struct nvme_ctrl *ctrl)
 {
-        struct nvme_ns *ns, *next;
-        LIST_HEAD(rm_list);
+        struct nvme_ns *ns;
 
-        down_write(&ctrl->namespaces_rwsem);
-        list_for_each_entry(ns, &ctrl->namespaces, list) {
-                if (ns->disk && nvme_revalidate_disk(ns->disk)) {
-                        list_move_tail(&ns->list, &rm_list);
-                }
-        }
-        up_write(&ctrl->namespaces_rwsem);
+        down_read(&ctrl->namespaces_rwsem);
+        list_for_each_entry(ns, &ctrl->namespaces, list)
+                if (ns->disk && nvme_revalidate_disk(ns->disk))
+                        nvme_set_queue_dying(ns);
+        up_read(&ctrl->namespaces_rwsem);
 
-        list_for_each_entry_safe(ns, next, &rm_list, list)
-                nvme_ns_remove(ns);
+        nvme_remove_invalid_namespaces(ctrl, NVME_NSID_ALL);
 }
 
 static void nvme_passthru_end(struct nvme_ctrl *ctrl, u32 effects)
@@ -1218,7 +1233,7 @@ static int nvme_user_cmd(struct nvme_ctrl *ctrl, struct nvme_ns *ns,
         effects = nvme_passthru_start(ctrl, ns, cmd.opcode);
         status = nvme_submit_user_cmd(ns ? ns->queue : ctrl->admin_q, &c,
                         (void __user *)(uintptr_t)cmd.addr, cmd.data_len,
-                        (void __user *)(uintptr_t)cmd.metadata, cmd.metadata,
+                        (void __user *)(uintptr_t)cmd.metadata, cmd.metadata_len,
                         0, &cmd.result, timeout);
         nvme_passthru_end(ctrl, effects);
 
@@ -3138,7 +3153,7 @@ static void nvme_remove_invalid_namespaces(struct nvme_ctrl *ctrl,
 
         down_write(&ctrl->namespaces_rwsem);
         list_for_each_entry_safe(ns, next, &ctrl->namespaces, list) {
-                if (ns->head->ns_id > nsid)
+                if (ns->head->ns_id > nsid || test_bit(NVME_NS_DEAD, &ns->flags))
                         list_move_tail(&ns->list, &rm_list);
         }
         up_write(&ctrl->namespaces_rwsem);
@@ -3542,19 +3557,9 @@ void nvme_kill_queues(struct nvme_ctrl *ctrl)
         if (ctrl->admin_q)
                 blk_mq_unquiesce_queue(ctrl->admin_q);
 
-        list_for_each_entry(ns, &ctrl->namespaces, list) {
-                /*
-                 * Revalidating a dead namespace sets capacity to 0. This will
-                 * end buffered writers dirtying pages that can't be synced.
-                 */
-                if (!ns->disk || test_and_set_bit(NVME_NS_DEAD, &ns->flags))
-                        continue;
-                revalidate_disk(ns->disk);
-                blk_set_queue_dying(ns->queue);
+        list_for_each_entry(ns, &ctrl->namespaces, list)
+                nvme_set_queue_dying(ns);
 
-                /* Forcibly unquiesce queues to avoid blocking dispatch */
-                blk_mq_unquiesce_queue(ns->queue);
-        }
         up_read(&ctrl->namespaces_rwsem);
 }
 EXPORT_SYMBOL_GPL(nvme_kill_queues);
diff --git a/drivers/nvme/host/fabrics.c b/drivers/nvme/host/fabrics.c
index 903eb4545e26..f7efe5a58cc7 100644
--- a/drivers/nvme/host/fabrics.c
+++ b/drivers/nvme/host/fabrics.c
@@ -539,14 +539,18 @@ static struct nvmf_transport_ops *nvmf_lookup_transport(
 /*
  * For something we're not in a state to send to the device the default action
  * is to busy it and retry it after the controller state is recovered.  However,
- * anything marked for failfast or nvme multipath is immediately failed.
+ * if the controller is deleting or if anything is marked for failfast or
+ * nvme multipath it is immediately failed.
  *
  * Note: commands used to initialize the controller will be marked for failfast.
  * Note: nvme cli/ioctl commands are marked for failfast.
  */
-blk_status_t nvmf_fail_nonready_command(struct request *rq)
+blk_status_t nvmf_fail_nonready_command(struct nvme_ctrl *ctrl,
+                struct request *rq)
 {
-        if (!blk_noretry_request(rq) && !(rq->cmd_flags & REQ_NVME_MPATH))
+        if (ctrl->state != NVME_CTRL_DELETING &&
+            ctrl->state != NVME_CTRL_DEAD &&
+            !blk_noretry_request(rq) && !(rq->cmd_flags & REQ_NVME_MPATH))
                 return BLK_STS_RESOURCE;
         nvme_req(rq)->status = NVME_SC_ABORT_REQ;
         return BLK_STS_IOERR;
diff --git a/drivers/nvme/host/fabrics.h b/drivers/nvme/host/fabrics.h
index e1818a27aa2d..aa2fdb2a2e8f 100644
--- a/drivers/nvme/host/fabrics.h
+++ b/drivers/nvme/host/fabrics.h
@@ -162,7 +162,8 @@ void nvmf_unregister_transport(struct nvmf_transport_ops *ops);
 void nvmf_free_options(struct nvmf_ctrl_options *opts);
 int nvmf_get_address(struct nvme_ctrl *ctrl, char *buf, int size);
 bool nvmf_should_reconnect(struct nvme_ctrl *ctrl);
-blk_status_t nvmf_fail_nonready_command(struct request *rq);
+blk_status_t nvmf_fail_nonready_command(struct nvme_ctrl *ctrl,
+                struct request *rq);
 bool __nvmf_check_ready(struct nvme_ctrl *ctrl, struct request *rq,
                 bool queue_live);
 
diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
index 41d45a1b5c62..9bac912173ba 100644
--- a/drivers/nvme/host/fc.c
+++ b/drivers/nvme/host/fc.c
@@ -2272,7 +2272,7 @@ nvme_fc_queue_rq(struct blk_mq_hw_ctx *hctx,
 
         if (ctrl->rport->remoteport.port_state != FC_OBJSTATE_ONLINE ||
             !nvmf_check_ready(&queue->ctrl->ctrl, rq, queue_ready))
-                return nvmf_fail_nonready_command(rq);
+                return nvmf_fail_nonready_command(&queue->ctrl->ctrl, rq);
 
         ret = nvme_setup_cmd(ns, rq, sqe);
         if (ret)
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index ba943f211687..ddd441b1516a 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -2556,11 +2556,6 @@ static int nvme_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 
         quirks |= check_vendor_combination_bug(pdev);
 
-        result = nvme_init_ctrl(&dev->ctrl, &pdev->dev, &nvme_pci_ctrl_ops,
-                        quirks);
-        if (result)
-                goto release_pools;
-
         /*
          * Double check that our mempool alloc size will cover the biggest
          * command we support.
@@ -2578,6 +2573,11 @@ static int nvme_probe(struct pci_dev *pdev, const struct pci_device_id *id)
                 goto release_pools;
         }
 
+        result = nvme_init_ctrl(&dev->ctrl, &pdev->dev, &nvme_pci_ctrl_ops,
+                        quirks);
+        if (result)
+                goto release_mempool;
+
         dev_info(dev->ctrl.device, "pci function %s\n", dev_name(&pdev->dev));
 
         nvme_get_ctrl(&dev->ctrl);
@@ -2585,6 +2585,8 @@ static int nvme_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 
         return 0;
 
+ release_mempool:
+        mempool_destroy(dev->iod_mempool);
  release_pools:
         nvme_release_prp_pools(dev);
  unmap:
diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
index 518c5b09038c..66ec5985c9f3 100644
--- a/drivers/nvme/host/rdma.c
+++ b/drivers/nvme/host/rdma.c
@@ -1639,7 +1639,7 @@ static blk_status_t nvme_rdma_queue_rq(struct blk_mq_hw_ctx *hctx,
         WARN_ON_ONCE(rq->tag < 0);
 
         if (!nvmf_check_ready(&queue->ctrl->ctrl, rq, queue_ready))
-                return nvmf_fail_nonready_command(rq);
+                return nvmf_fail_nonready_command(&queue->ctrl->ctrl, rq);
 
         dev = queue->device->dev;
         ib_dma_sync_single_for_cpu(dev, sqe->dma,
diff --git a/drivers/nvme/target/configfs.c b/drivers/nvme/target/configfs.c
index d3f3b3ec4d1a..ebea1373d1b7 100644
--- a/drivers/nvme/target/configfs.c
+++ b/drivers/nvme/target/configfs.c
@@ -282,6 +282,7 @@ static ssize_t nvmet_ns_device_path_store(struct config_item *item,
 {
         struct nvmet_ns *ns = to_nvmet_ns(item);
         struct nvmet_subsys *subsys = ns->subsys;
+        size_t len;
         int ret;
 
         mutex_lock(&subsys->lock);
@@ -289,10 +290,14 @@ static ssize_t nvmet_ns_device_path_store(struct config_item *item,
         if (ns->enabled)
                 goto out_unlock;
 
-        kfree(ns->device_path);
+        ret = -EINVAL;
+        len = strcspn(page, "\n");
+        if (!len)
+                goto out_unlock;
 
+        kfree(ns->device_path);
         ret = -ENOMEM;
-        ns->device_path = kstrndup(page, strcspn(page, "\n"), GFP_KERNEL);
+        ns->device_path = kstrndup(page, len, GFP_KERNEL);
         if (!ns->device_path)
                 goto out_unlock;
 
diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c
index 74d4b785d2da..9838103f2d62 100644
--- a/drivers/nvme/target/core.c
+++ b/drivers/nvme/target/core.c
@@ -339,7 +339,7 @@ int nvmet_ns_enable(struct nvmet_ns *ns)
                 goto out_unlock;
 
         ret = nvmet_bdev_ns_enable(ns);
-        if (ret)
+        if (ret == -ENOTBLK)
                 ret = nvmet_file_ns_enable(ns);
         if (ret)
                 goto out_unlock;
diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c
index 408279cb6f2c..29b4b236afd8 100644
--- a/drivers/nvme/target/fc.c
+++ b/drivers/nvme/target/fc.c
@@ -58,8 +58,8 @@ struct nvmet_fc_ls_iod {
         struct work_struct              work;
 } __aligned(sizeof(unsigned long long));
 
+/* desired maximum for a single sequence - if sg list allows it */
 #define NVMET_FC_MAX_SEQ_LENGTH         (256 * 1024)
-#define NVMET_FC_MAX_XFR_SGENTS         (NVMET_FC_MAX_SEQ_LENGTH / PAGE_SIZE)
 
 enum nvmet_fcp_datadir {
         NVMET_FCP_NODATA,
@@ -74,6 +74,7 @@ struct nvmet_fc_fcp_iod {
         struct nvme_fc_cmd_iu           cmdiubuf;
         struct nvme_fc_ersp_iu          rspiubuf;
         dma_addr_t                      rspdma;
+        struct scatterlist              *next_sg;
         struct scatterlist              *data_sg;
         int                             data_sg_cnt;
         u32                             offset;
@@ -1025,8 +1026,7 @@ nvmet_fc_register_targetport(struct nvmet_fc_port_info *pinfo,
         INIT_LIST_HEAD(&newrec->assoc_list);
         kref_init(&newrec->ref);
         ida_init(&newrec->assoc_cnt);
-        newrec->max_sg_cnt = min_t(u32, NVMET_FC_MAX_XFR_SGENTS,
-                                        template->max_sgl_segments);
+        newrec->max_sg_cnt = template->max_sgl_segments;
 
         ret = nvmet_fc_alloc_ls_iodlist(newrec);
         if (ret) {
@@ -1722,6 +1722,7 @@ nvmet_fc_alloc_tgt_pgs(struct nvmet_fc_fcp_iod *fod)
                                 ((fod->io_dir == NVMET_FCP_WRITE) ?
                                         DMA_FROM_DEVICE : DMA_TO_DEVICE));
                                 /* note: write from initiator perspective */
+        fod->next_sg = fod->data_sg;
 
         return 0;
 
@@ -1866,24 +1867,49 @@ nvmet_fc_transfer_fcp_data(struct nvmet_fc_tgtport *tgtport,
                                 struct nvmet_fc_fcp_iod *fod, u8 op)
 {
         struct nvmefc_tgt_fcp_req *fcpreq = fod->fcpreq;
+        struct scatterlist *sg = fod->next_sg;
         unsigned long flags;
-        u32 tlen;
+        u32 remaininglen = fod->req.transfer_len - fod->offset;
+        u32 tlen = 0;
         int ret;
 
         fcpreq->op = op;
         fcpreq->offset = fod->offset;
         fcpreq->timeout = NVME_FC_TGTOP_TIMEOUT_SEC;
 
-        tlen = min_t(u32, tgtport->max_sg_cnt * PAGE_SIZE,
-                        (fod->req.transfer_len - fod->offset));
+        /*
+         * for next sequence:
+         *  break at a sg element boundary
+         *  attempt to keep sequence length capped at
+         *    NVMET_FC_MAX_SEQ_LENGTH but allow sequence to
+         *    be longer if a single sg element is larger
+         *    than that amount. This is done to avoid creating
+         *    a new sg list to use for the tgtport api.
+         */
+        fcpreq->sg = sg;
+        fcpreq->sg_cnt = 0;
+        while (tlen < remaininglen &&
+               fcpreq->sg_cnt < tgtport->max_sg_cnt &&
+               tlen + sg_dma_len(sg) < NVMET_FC_MAX_SEQ_LENGTH) {
+                fcpreq->sg_cnt++;
+                tlen += sg_dma_len(sg);
+                sg = sg_next(sg);
+        }
+        if (tlen < remaininglen && fcpreq->sg_cnt == 0) {
+                fcpreq->sg_cnt++;
+                tlen += min_t(u32, sg_dma_len(sg), remaininglen);
+                sg = sg_next(sg);
+        }
+        if (tlen < remaininglen)
+                fod->next_sg = sg;
+        else
+                fod->next_sg = NULL;
+
         fcpreq->transfer_length = tlen;
         fcpreq->transferred_length = 0;
         fcpreq->fcp_error = 0;
         fcpreq->rsplen = 0;
 
-        fcpreq->sg = &fod->data_sg[fod->offset / PAGE_SIZE];
-        fcpreq->sg_cnt = DIV_ROUND_UP(tlen, PAGE_SIZE);
-
         /*
          * If the last READDATA request: check if LLDD supports
          * combined xfr with response.
diff --git a/drivers/nvme/target/loop.c b/drivers/nvme/target/loop.c
index d8d91f04bd7e..ae7586b8be07 100644
--- a/drivers/nvme/target/loop.c
+++ b/drivers/nvme/target/loop.c
@@ -162,7 +162,7 @@ static blk_status_t nvme_loop_queue_rq(struct blk_mq_hw_ctx *hctx,
         blk_status_t ret;
 
         if (!nvmf_check_ready(&queue->ctrl->ctrl, req, queue_ready))
-                return nvmf_fail_nonready_command(req);
+                return nvmf_fail_nonready_command(&queue->ctrl->ctrl, req);
 
         ret = nvme_setup_cmd(ns, req, &iod->cmd);
         if (ret)
diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c
index b5b0cdc21d01..514d1dfc5630 100644
--- a/drivers/nvmem/core.c
+++ b/drivers/nvmem/core.c
@@ -936,6 +936,10 @@ struct nvmem_cell *nvmem_cell_get(struct device *dev, const char *cell_id)
                         return cell;
         }
 
+        /* NULL cell_id only allowed for device tree; invalid otherwise */
+        if (!cell_id)
+                return ERR_PTR(-EINVAL);
+
         return nvmem_cell_get_from_list(cell_id);
 }
 EXPORT_SYMBOL_GPL(nvmem_cell_get);
diff --git a/drivers/of/base.c b/drivers/of/base.c
index 848f549164cd..466e3c8582f0 100644
--- a/drivers/of/base.c
+++ b/drivers/of/base.c
@@ -102,7 +102,7 @@ static u32 phandle_cache_mask;
  *   - the phandle lookup overhead reduction provided by the cache
  *     will likely be less
  */
-static void of_populate_phandle_cache(void)
+void of_populate_phandle_cache(void)
 {
         unsigned long flags;
         u32 cache_entries;
@@ -134,8 +134,7 @@ out:
         raw_spin_unlock_irqrestore(&devtree_lock, flags);
 }
 
-#ifndef CONFIG_MODULES
-static int __init of_free_phandle_cache(void)
+int of_free_phandle_cache(void)
 {
         unsigned long flags;
 
@@ -148,6 +147,7 @@ static int __init of_free_phandle_cache(void)
 
         return 0;
 }
+#if !defined(CONFIG_MODULES)
 late_initcall_sync(of_free_phandle_cache);
 #endif
 
diff --git a/drivers/of/of_private.h b/drivers/of/of_private.h
index 891d780c076a..216175d11d3d 100644
--- a/drivers/of/of_private.h
+++ b/drivers/of/of_private.h
@@ -79,6 +79,8 @@ int of_resolve_phandles(struct device_node *tree);
 #if defined(CONFIG_OF_OVERLAY)
 void of_overlay_mutex_lock(void);
 void of_overlay_mutex_unlock(void);
+int of_free_phandle_cache(void);
+void of_populate_phandle_cache(void);
 #else
 static inline void of_overlay_mutex_lock(void) {};
 static inline void of_overlay_mutex_unlock(void) {};
diff --git a/drivers/of/overlay.c b/drivers/of/overlay.c
index 7baa53e5b1d7..eda57ef12fd0 100644
--- a/drivers/of/overlay.c
+++ b/drivers/of/overlay.c
@@ -804,6 +804,8 @@ static int of_overlay_apply(const void *fdt, struct device_node *tree,
                 goto err_free_overlay_changeset;
         }
 
+        of_populate_phandle_cache();
+
         ret = __of_changeset_apply_notify(&ovcs->cset);
         if (ret)
                 pr_err("overlay changeset entry notify error %d\n", ret);
@@ -1046,8 +1048,17 @@ int of_overlay_remove(int *ovcs_id)
 
         list_del(&ovcs->ovcs_list);
 
+        /*
+         * Disable phandle cache.  Avoids race condition that would arise
+         * from removing cache entry when the associated node is deleted.
+         */
+        of_free_phandle_cache();
+
         ret_apply = 0;
         ret = __of_changeset_revert_entries(&ovcs->cset, &ret_apply);
+
+        of_populate_phandle_cache();
+
         if (ret) {
                 if (ret_apply)
                         devicetree_state_flags |= DTSF_REVERT_FAIL;
diff --git a/drivers/pci/controller/dwc/Kconfig b/drivers/pci/controller/dwc/Kconfig
index 16f52c626b4b..91b0194240a5 100644
--- a/drivers/pci/controller/dwc/Kconfig
+++ b/drivers/pci/controller/dwc/Kconfig
@@ -58,7 +58,6 @@ config PCIE_DW_PLAT_HOST
         depends on PCI && PCI_MSI_IRQ_DOMAIN
         select PCIE_DW_HOST
         select PCIE_DW_PLAT
-        default y
         help
           Enables support for the PCIe controller in the Designware IP to
           work in host mode. There are two instances of PCIe controller in
diff --git a/drivers/pci/controller/dwc/pcie-designware-host.c b/drivers/pci/controller/dwc/pcie-designware-host.c
index 781aa03aeede..29a05759a294 100644
--- a/drivers/pci/controller/dwc/pcie-designware-host.c
+++ b/drivers/pci/controller/dwc/pcie-designware-host.c
@@ -363,7 +363,8 @@ int dw_pcie_host_init(struct pcie_port *pp)
         resource_list_for_each_entry_safe(win, tmp, &bridge->windows) {
                 switch (resource_type(win->res)) {
                 case IORESOURCE_IO:
-                        ret = pci_remap_iospace(win->res, pp->io_base);
+                        ret = devm_pci_remap_iospace(dev, win->res,
+                                                     pp->io_base);
                         if (ret) {
                                 dev_warn(dev, "Error %d: failed to map resource %pR\n",
                                          ret, win->res);
diff --git a/drivers/pci/controller/pci-aardvark.c b/drivers/pci/controller/pci-aardvark.c
index d3172d5d3d35..0fae816fba39 100644
--- a/drivers/pci/controller/pci-aardvark.c
+++ b/drivers/pci/controller/pci-aardvark.c
@@ -849,7 +849,7 @@ static int advk_pcie_parse_request_of_pci_ranges(struct advk_pcie *pcie)
                                              0, 0xF8000000, 0,
                                              lower_32_bits(res->start),
                                              OB_PCIE_IO);
-                        err = pci_remap_iospace(res, iobase);
+                        err = devm_pci_remap_iospace(dev, res, iobase);
                         if (err) {
                                 dev_warn(dev, "error %d: failed to map resource %pR\n",
                                          err, res);
diff --git a/drivers/pci/controller/pci-ftpci100.c b/drivers/pci/controller/pci-ftpci100.c
index a1ebe9ed441f..bf5ece5d9291 100644
--- a/drivers/pci/controller/pci-ftpci100.c
+++ b/drivers/pci/controller/pci-ftpci100.c
@@ -355,11 +355,13 @@ static int faraday_pci_setup_cascaded_irq(struct faraday_pci *p)
         irq = of_irq_get(intc, 0);
         if (irq <= 0) {
                 dev_err(p->dev, "failed to get parent IRQ\n");
+                of_node_put(intc);
                 return irq ?: -EINVAL;
         }
 
         p->irqdomain = irq_domain_add_linear(intc, PCI_NUM_INTX,
                                              &faraday_pci_irqdomain_ops, p);
+        of_node_put(intc);
         if (!p->irqdomain) {
                 dev_err(p->dev, "failed to create Gemini PCI IRQ domain\n");
                 return -EINVAL;
@@ -501,7 +503,7 @@ static int faraday_pci_probe(struct platform_device *pdev)
                                 dev_err(dev, "illegal IO mem size\n");
                                 return -EINVAL;
                         }
-                        ret = pci_remap_iospace(io, io_base);
+                        ret = devm_pci_remap_iospace(dev, io, io_base);
                         if (ret) {
                                 dev_warn(dev, "error %d: failed to map resource %pR\n",
                                          ret, io);
diff --git a/drivers/pci/controller/pci-hyperv.c b/drivers/pci/controller/pci-hyperv.c
index 6cc5036ac83c..f6325f1a89e8 100644
--- a/drivers/pci/controller/pci-hyperv.c
+++ b/drivers/pci/controller/pci-hyperv.c
@@ -1073,6 +1073,7 @@ static void hv_compose_msi_msg(struct irq_data *data, struct msi_msg *msg)
         struct pci_bus *pbus;
         struct pci_dev *pdev;
         struct cpumask *dest;
+        unsigned long flags;
         struct compose_comp_ctxt comp;
         struct tran_int_desc *int_desc;
         struct {
@@ -1164,14 +1165,15 @@ static void hv_compose_msi_msg(struct irq_data *data, struct msi_msg *msg)
                  * the channel callback directly when channel->target_cpu is
                  * the current CPU. When the higher level interrupt code
                  * calls us with interrupt enabled, let's add the
-                 * local_bh_disable()/enable() to avoid race.
+                 * local_irq_save()/restore() to avoid race:
+                 * hv_pci_onchannelcallback() can also run in tasklet.
                  */
-                local_bh_disable();
+                local_irq_save(flags);
 
                 if (hbus->hdev->channel->target_cpu == smp_processor_id())
                         hv_pci_onchannelcallback(hbus);
 
-                local_bh_enable();
+                local_irq_restore(flags);
 
                 if (hpdev->state == hv_pcichild_ejecting) {
                         dev_err_once(&hbus->hdev->device,
diff --git a/drivers/pci/controller/pci-v3-semi.c b/drivers/pci/controller/pci-v3-semi.c
index 68b8bfbdb867..d219404bad92 100644
--- a/drivers/pci/controller/pci-v3-semi.c
+++ b/drivers/pci/controller/pci-v3-semi.c
@@ -537,7 +537,7 @@ static int v3_pci_setup_resource(struct v3_pci *v3,
                 v3->io_bus_addr = io->start - win->offset;
                 dev_dbg(dev, "I/O window %pR, bus addr %pap\n",
                         io, &v3->io_bus_addr);
-                ret = pci_remap_iospace(io, io_base);
+                ret = devm_pci_remap_iospace(dev, io, io_base);
                 if (ret) {
                         dev_warn(dev,
                                  "error %d: failed to map resource %pR\n",
diff --git a/drivers/pci/controller/pci-versatile.c b/drivers/pci/controller/pci-versatile.c
index 994f32061b32..f59ad2728c0b 100644
--- a/drivers/pci/controller/pci-versatile.c
+++ b/drivers/pci/controller/pci-versatile.c
@@ -82,7 +82,7 @@ static int versatile_pci_parse_request_of_pci_ranges(struct device *dev,
 
                 switch (resource_type(res)) {
                 case IORESOURCE_IO:
-                        err = pci_remap_iospace(res, iobase);
+                        err = devm_pci_remap_iospace(dev, res, iobase);
                         if (err) {
                                 dev_warn(dev, "error %d: failed to map resource %pR\n",
                                          err, res);
diff --git a/drivers/pci/controller/pci-xgene.c b/drivers/pci/controller/pci-xgene.c
index d854d67e873c..ffda3e8b4742 100644
--- a/drivers/pci/controller/pci-xgene.c
+++ b/drivers/pci/controller/pci-xgene.c
@@ -423,7 +423,7 @@ static int xgene_pcie_map_ranges(struct xgene_pcie_port *port,
                 case IORESOURCE_IO:
                         xgene_pcie_setup_ob_reg(port, res, OMR3BARL, io_base,
                                                 res->start - window->offset);
-                        ret = pci_remap_iospace(res, io_base);
+                        ret = devm_pci_remap_iospace(dev, res, io_base);
                         if (ret < 0)
                                 return ret;
                         break;
diff --git a/drivers/pci/controller/pcie-mediatek.c b/drivers/pci/controller/pcie-mediatek.c
index 0baabe30858f..861dda69f366 100644
--- a/drivers/pci/controller/pcie-mediatek.c
+++ b/drivers/pci/controller/pcie-mediatek.c
@@ -1109,7 +1109,7 @@ static int mtk_pcie_request_resources(struct mtk_pcie *pcie)
         if (err < 0)
                 return err;
 
-        pci_remap_iospace(&pcie->pio, pcie->io.start);
+        devm_pci_remap_iospace(dev, &pcie->pio, pcie->io.start);
 
         return 0;
 }
diff --git a/drivers/pci/controller/pcie-rcar.c b/drivers/pci/controller/pcie-rcar.c
index 874d75c9ee4a..c8febb009454 100644
--- a/drivers/pci/controller/pcie-rcar.c
+++ b/drivers/pci/controller/pcie-rcar.c
@@ -680,7 +680,11 @@ static int rcar_pcie_phy_init_gen3(struct rcar_pcie *pcie)
         if (err)
                 return err;
 
-        return phy_power_on(pcie->phy);
+        err = phy_power_on(pcie->phy);
+        if (err)
+                phy_exit(pcie->phy);
+
+        return err;
 }
 
 static int rcar_msi_alloc(struct rcar_msi *chip)
@@ -1165,7 +1169,7 @@ static int rcar_pcie_probe(struct platform_device *pdev)
         if (rcar_pcie_hw_init(pcie)) {
                 dev_info(dev, "PCIe link down\n");
                 err = -ENODEV;
-                goto err_clk_disable;
+                goto err_phy_shutdown;
         }
 
         data = rcar_pci_read_reg(pcie, MACSR);
@@ -1177,7 +1181,7 @@ static int rcar_pcie_probe(struct platform_device *pdev)
                         dev_err(dev,
                                 "failed to enable MSI support: %d\n",
                                 err);
-                        goto err_clk_disable;
+                        goto err_phy_shutdown;
                 }
         }
 
@@ -1191,6 +1195,12 @@ err_msi_teardown:
         if (IS_ENABLED(CONFIG_PCI_MSI))
                 rcar_pcie_teardown_msi(pcie);
 
+err_phy_shutdown:
+        if (pcie->phy) {
+                phy_power_off(pcie->phy);
+                phy_exit(pcie->phy);
+        }
+
 err_clk_disable:
         clk_disable_unprepare(pcie->bus_clk);
 
diff --git a/drivers/pci/controller/pcie-xilinx-nwl.c b/drivers/pci/controller/pcie-xilinx-nwl.c
index 6a4bbb5b3de0..fb32840ce8e6 100644
--- a/drivers/pci/controller/pcie-xilinx-nwl.c
+++ b/drivers/pci/controller/pcie-xilinx-nwl.c
@@ -559,7 +559,7 @@ static int nwl_pcie_init_irq_domain(struct nwl_pcie *pcie)
                                                         PCI_NUM_INTX,
                                                         &legacy_domain_ops,
                                                         pcie);
-
+        of_node_put(legacy_intc_node);
         if (!pcie->legacy_irq_domain) {
                 dev_err(dev, "failed to create IRQ domain\n");
                 return -ENOMEM;
diff --git a/drivers/pci/controller/pcie-xilinx.c b/drivers/pci/controller/pcie-xilinx.c
index b110a3a814e3..7b1389d8e2a5 100644
--- a/drivers/pci/controller/pcie-xilinx.c
+++ b/drivers/pci/controller/pcie-xilinx.c
@@ -509,6 +509,7 @@ static int xilinx_pcie_init_irq_domain(struct xilinx_pcie_port *port)
         port->leg_domain = irq_domain_add_linear(pcie_intc_node, PCI_NUM_INTX,
                                                  &intx_domain_ops,
                                                  port);
+        of_node_put(pcie_intc_node);
         if (!port->leg_domain) {
                 dev_err(dev, "Failed to get a INTx IRQ domain\n");
                 return -ENODEV;
diff --git a/drivers/pci/endpoint/pci-epf-core.c b/drivers/pci/endpoint/pci-epf-core.c
index 523a8cab3bfb..825fa24427a3 100644
--- a/drivers/pci/endpoint/pci-epf-core.c
+++ b/drivers/pci/endpoint/pci-epf-core.c
@@ -137,6 +137,20 @@ void *pci_epf_alloc_space(struct pci_epf *epf, size_t size, enum pci_barno bar)
 }
 EXPORT_SYMBOL_GPL(pci_epf_alloc_space);
 
+static void pci_epf_remove_cfs(struct pci_epf_driver *driver)
+{
+        struct config_group *group, *tmp;
+
+        if (!IS_ENABLED(CONFIG_PCI_ENDPOINT_CONFIGFS))
+                return;
+
+        mutex_lock(&pci_epf_mutex);
+        list_for_each_entry_safe(group, tmp, &driver->epf_group, group_entry)
+                pci_ep_cfs_remove_epf_group(group);
+        list_del(&driver->epf_group);
+        mutex_unlock(&pci_epf_mutex);
+}
+
 /**
  * pci_epf_unregister_driver() - unregister the PCI EPF driver
  * @driver: the PCI EPF driver that has to be unregistered
@@ -145,17 +159,38 @@ EXPORT_SYMBOL_GPL(pci_epf_alloc_space);
  */
 void pci_epf_unregister_driver(struct pci_epf_driver *driver)
 {
-        struct config_group *group;
-
-        mutex_lock(&pci_epf_mutex);
-        list_for_each_entry(group, &driver->epf_group, group_entry)
-                pci_ep_cfs_remove_epf_group(group);
-        list_del(&driver->epf_group);
-        mutex_unlock(&pci_epf_mutex);
+        pci_epf_remove_cfs(driver);
         driver_unregister(&driver->driver);
 }
 EXPORT_SYMBOL_GPL(pci_epf_unregister_driver);
 
+static int pci_epf_add_cfs(struct pci_epf_driver *driver)
+{
+        struct config_group *group;
+        const struct pci_epf_device_id *id;
+
+        if (!IS_ENABLED(CONFIG_PCI_ENDPOINT_CONFIGFS))
+                return 0;
+
+        INIT_LIST_HEAD(&driver->epf_group);
+
+        id = driver->id_table;
+        while (id->name[0]) {
+                group = pci_ep_cfs_add_epf_group(id->name);
+                if (IS_ERR(group)) {
+                        pci_epf_remove_cfs(driver);
+                        return PTR_ERR(group);
+                }
+
+                mutex_lock(&pci_epf_mutex);
+                list_add_tail(&group->group_entry, &driver->epf_group);
+                mutex_unlock(&pci_epf_mutex);
+                id++;
+        }
+
+        return 0;
+}
+
 /**
  * __pci_epf_register_driver() - register a new PCI EPF driver
  * @driver: structure representing PCI EPF driver
@@ -167,8 +202,6 @@ int __pci_epf_register_driver(struct pci_epf_driver *driver,
                               struct module *owner)
 {
         int ret;
-        struct config_group *group;
-        const struct pci_epf_device_id *id;
 
         if (!driver->ops)
                 return -EINVAL;
@@ -183,16 +216,7 @@ int __pci_epf_register_driver(struct pci_epf_driver *driver,
         if (ret)
                 return ret;
 
-        INIT_LIST_HEAD(&driver->epf_group);
-
-        id = driver->id_table;
-        while (id->name[0]) {
-                group = pci_ep_cfs_add_epf_group(id->name);
-                mutex_lock(&pci_epf_mutex);
-                list_add_tail(&group->group_entry, &driver->epf_group);
-                mutex_unlock(&pci_epf_mutex);
-                id++;
-        }
+        pci_epf_add_cfs(driver);
 
         return 0;
 }
diff --git a/drivers/pci/iov.c b/drivers/pci/iov.c
index d0d73dbbd5ca..0f04ae648cf1 100644
--- a/drivers/pci/iov.c
+++ b/drivers/pci/iov.c
@@ -575,6 +575,22 @@ void pci_iov_release(struct pci_dev *dev)
 }
 
 /**
+ * pci_iov_remove - clean up SR-IOV state after PF driver is detached
+ * @dev: the PCI device
+ */
+void pci_iov_remove(struct pci_dev *dev)
+{
+        struct pci_sriov *iov = dev->sriov;
+
+        if (!dev->is_physfn)
+                return;
+
+        iov->driver_max_VFs = iov->total_VFs;
+        if (iov->num_VFs)
+                pci_warn(dev, "driver left SR-IOV enabled after remove\n");
+}
+
+/**
  * pci_iov_update_resource - update a VF BAR
  * @dev: the PCI device
  * @resno: the resource number
diff --git a/drivers/pci/of.c b/drivers/pci/of.c
index d088c9147f10..69a60d6ebd73 100644
--- a/drivers/pci/of.c
+++ b/drivers/pci/of.c
@@ -612,7 +612,7 @@ int pci_parse_request_of_pci_ranges(struct device *dev,
 
                 switch (resource_type(res)) {
                 case IORESOURCE_IO:
-                        err = pci_remap_iospace(res, iobase);
+                        err = devm_pci_remap_iospace(dev, res, iobase);
                         if (err) {
                                 dev_warn(dev, "error %d: failed to map resource %pR\n",
                                          err, res);
diff --git a/drivers/pci/pci-acpi.c b/drivers/pci/pci-acpi.c
index 65113b6eed14..89ee6a2b6eb8 100644
--- a/drivers/pci/pci-acpi.c
+++ b/drivers/pci/pci-acpi.c
@@ -629,6 +629,18 @@ static bool acpi_pci_need_resume(struct pci_dev *dev)
 {
         struct acpi_device *adev = ACPI_COMPANION(&dev->dev);
 
+        /*
+         * In some cases (eg. Samsung 305V4A) leaving a bridge in suspend over
+         * system-wide suspend/resume confuses the platform firmware, so avoid
+         * doing that, unless the bridge has a driver that should take care of
+         * the PM handling.  According to Section 16.1.6 of ACPI 6.2, endpoint
+         * devices are expected to be in D3 before invoking the S3 entry path
+         * from the firmware, so they should not be affected by this issue.
+         */
+        if (pci_is_bridge(dev) && !dev->driver &&
+            acpi_target_system_state() != ACPI_STATE_S0)
+                return true;
+
         if (!adev || !acpi_device_power_manageable(adev))
                 return false;
 
diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c
index c125d53033c6..6792292b5fc7 100644
--- a/drivers/pci/pci-driver.c
+++ b/drivers/pci/pci-driver.c
@@ -445,6 +445,7 @@ static int pci_device_remove(struct device *dev)
                 }
                 pcibios_free_irq(pci_dev);
                 pci_dev->driver = NULL;
+                pci_iov_remove(pci_dev);
         }
 
         /* Undo the runtime PM settings in local_pci_probe() */
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index 22adaf35b136..aa1684d99b70 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -3579,6 +3579,44 @@ void pci_unmap_iospace(struct resource *res)
 }
 EXPORT_SYMBOL(pci_unmap_iospace);
 
+static void devm_pci_unmap_iospace(struct device *dev, void *ptr)
+{
+        struct resource **res = ptr;
+
+        pci_unmap_iospace(*res);
+}
+
+/**
+ * devm_pci_remap_iospace - Managed pci_remap_iospace()
+ * @dev: Generic device to remap IO address for
+ * @res: Resource describing the I/O space
+ * @phys_addr: physical address of range to be mapped
+ *
+ * Managed pci_remap_iospace().  Map is automatically unmapped on driver
+ * detach.
+ */
+int devm_pci_remap_iospace(struct device *dev, const struct resource *res,
+                           phys_addr_t phys_addr)
+{
+        const struct resource **ptr;
+        int error;
+
+        ptr = devres_alloc(devm_pci_unmap_iospace, sizeof(*ptr), GFP_KERNEL);
+        if (!ptr)
+                return -ENOMEM;
+
+        error = pci_remap_iospace(res, phys_addr);
+        if (error) {
+                devres_free(ptr);
+        } else  {
+                *ptr = res;
+                devres_add(dev, ptr);
+        }
+
+        return error;
+}
+EXPORT_SYMBOL(devm_pci_remap_iospace);
+
 /**
  * devm_pci_remap_cfgspace - Managed pci_remap_cfgspace()
  * @dev: Generic device to remap IO address for
diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h
index c358e7a07f3f..882f1f9596df 100644
--- a/drivers/pci/pci.h
+++ b/drivers/pci/pci.h
@@ -311,6 +311,7 @@ static inline void pci_restore_ats_state(struct pci_dev *dev)
 #ifdef CONFIG_PCI_IOV
 int pci_iov_init(struct pci_dev *dev);
 void pci_iov_release(struct pci_dev *dev);
+void pci_iov_remove(struct pci_dev *dev);
 void pci_iov_update_resource(struct pci_dev *dev, int resno);
 resource_size_t pci_sriov_resource_alignment(struct pci_dev *dev, int resno);
 void pci_restore_iov_state(struct pci_dev *dev);
@@ -325,6 +326,9 @@ static inline void pci_iov_release(struct pci_dev *dev)
 
 {
 }
+static inline void pci_iov_remove(struct pci_dev *dev)
+{
+}
 static inline void pci_restore_iov_state(struct pci_dev *dev)
 {
 }
diff --git a/drivers/pci/pcie/err.c b/drivers/pci/pcie/err.c
index f7ce0cb0b0b7..f02e334beb45 100644
--- a/drivers/pci/pcie/err.c
+++ b/drivers/pci/pcie/err.c
@@ -295,6 +295,7 @@ void pcie_do_fatal_recovery(struct pci_dev *dev, u32 service)
 
         parent = udev->subordinate;
         pci_lock_rescan_remove();
+        pci_dev_get(dev);
         list_for_each_entry_safe_reverse(pdev, temp, &parent->devices,
                                          bus_list) {
                 pci_dev_get(pdev);
@@ -328,6 +329,7 @@ void pcie_do_fatal_recovery(struct pci_dev *dev, u32 service)
                 pci_info(dev, "Device recovery from fatal error failed\n");
         }
 
+        pci_dev_put(dev);
         pci_unlock_rescan_remove();
 }
 
diff --git a/drivers/phy/broadcom/phy-brcm-usb-init.c b/drivers/phy/broadcom/phy-brcm-usb-init.c
index 1b7febc43da9..29d2c3b1913a 100644
--- a/drivers/phy/broadcom/phy-brcm-usb-init.c
+++ b/drivers/phy/broadcom/phy-brcm-usb-init.c
@@ -962,6 +962,10 @@ void brcm_usb_init_xhci(struct brcm_usb_init_params *params)
 {
         void __iomem *ctrl = params->ctrl_regs;
 
+        USB_CTRL_UNSET(ctrl, USB30_PCTL, PHY3_IDDQ_OVERRIDE);
+        /* 1 millisecond - for USB clocks to settle down */
+        usleep_range(1000, 2000);
+
         if (BRCM_ID(params->family_id) == 0x7366) {
                 /*
                  * The PHY3_SOFT_RESETB bits default to the wrong state.
diff --git a/drivers/phy/motorola/phy-mapphone-mdm6600.c b/drivers/phy/motorola/phy-mapphone-mdm6600.c
index 23705e1a0023..0075fb0bef8c 100644
--- a/drivers/phy/motorola/phy-mapphone-mdm6600.c
+++ b/drivers/phy/motorola/phy-mapphone-mdm6600.c
@@ -182,13 +182,13 @@ static void phy_mdm6600_status(struct work_struct *work)
         ddata = container_of(work, struct phy_mdm6600, status_work.work);
         dev = ddata->dev;
 
-        error = gpiod_get_array_value_cansleep(PHY_MDM6600_NR_CMD_LINES,
+        error = gpiod_get_array_value_cansleep(PHY_MDM6600_NR_STATUS_LINES,
                                                ddata->status_gpios->desc,
                                                values);
         if (error)
                 return;
 
-        for (i = 0; i < PHY_MDM6600_NR_CMD_LINES; i++) {
+        for (i = 0; i < PHY_MDM6600_NR_STATUS_LINES; i++) {
                 val |= values[i] << i;
                 dev_dbg(ddata->dev, "XXX %s: i: %i values[i]: %i val: %i\n",
                         __func__, i, values[i], val);
diff --git a/drivers/pinctrl/bcm/pinctrl-nsp-mux.c b/drivers/pinctrl/bcm/pinctrl-nsp-mux.c
index 35c17653c694..87618a4e90e4 100644
--- a/drivers/pinctrl/bcm/pinctrl-nsp-mux.c
+++ b/drivers/pinctrl/bcm/pinctrl-nsp-mux.c
@@ -460,8 +460,8 @@ static int nsp_pinmux_enable(struct pinctrl_dev *pctrl_dev,
         const struct nsp_pin_function *func;
         const struct nsp_pin_group *grp;
 
-        if (grp_select > pinctrl->num_groups ||
-                func_select > pinctrl->num_functions)
+        if (grp_select >= pinctrl->num_groups ||
+            func_select >= pinctrl->num_functions)
                 return -EINVAL;
 
         func = &pinctrl->functions[func_select];
@@ -577,6 +577,8 @@ static int nsp_pinmux_probe(struct platform_device *pdev)
                 return PTR_ERR(pinctrl->base0);
 
         res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
+        if (!res)
+                return -EINVAL;
         pinctrl->base1 = devm_ioremap_nocache(&pdev->dev, res->start,
                                               resource_size(res));
         if (!pinctrl->base1) {
diff --git a/drivers/pinctrl/mediatek/pinctrl-mt7622.c b/drivers/pinctrl/mediatek/pinctrl-mt7622.c
index e3f1ab2290fc..4c4740ffeb9c 100644
--- a/drivers/pinctrl/mediatek/pinctrl-mt7622.c
+++ b/drivers/pinctrl/mediatek/pinctrl-mt7622.c
@@ -1424,7 +1424,7 @@ static struct pinctrl_desc mtk_desc = {
 
 static int mtk_gpio_get(struct gpio_chip *chip, unsigned int gpio)
 {
-        struct mtk_pinctrl *hw = dev_get_drvdata(chip->parent);
+        struct mtk_pinctrl *hw = gpiochip_get_data(chip);
         int value, err;
 
         err = mtk_hw_get_value(hw, gpio, PINCTRL_PIN_REG_DI, &value);
@@ -1436,7 +1436,7 @@ static int mtk_gpio_get(struct gpio_chip *chip, unsigned int gpio)
 
 static void mtk_gpio_set(struct gpio_chip *chip, unsigned int gpio, int value)
 {
-        struct mtk_pinctrl *hw = dev_get_drvdata(chip->parent);
+        struct mtk_pinctrl *hw = gpiochip_get_data(chip);
 
         mtk_hw_set_value(hw, gpio, PINCTRL_PIN_REG_DO, !!value);
 }
@@ -1508,11 +1508,20 @@ static int mtk_build_gpiochip(struct mtk_pinctrl *hw, struct device_node *np)
         if (ret < 0)
                 return ret;
 
-        ret = gpiochip_add_pin_range(chip, dev_name(hw->dev), 0, 0,
-                                     chip->ngpio);
-        if (ret < 0) {
-                gpiochip_remove(chip);
-                return ret;
+        /* Just for backward compatible for these old pinctrl nodes without
+         * "gpio-ranges" property. Otherwise, called directly from a
+         * DeviceTree-supported pinctrl driver is DEPRECATED.
+         * Please see Section 2.1 of
+         * Documentation/devicetree/bindings/gpio/gpio.txt on how to
+         * bind pinctrl and gpio drivers via the "gpio-ranges" property.
+         */
+        if (!of_find_property(np, "gpio-ranges", NULL)) {
+                ret = gpiochip_add_pin_range(chip, dev_name(hw->dev), 0, 0,
+                                             chip->ngpio);
+                if (ret < 0) {
+                        gpiochip_remove(chip);
+                        return ret;
+                }
         }
 
         return 0;
@@ -1695,15 +1704,16 @@ static int mtk_pinctrl_probe(struct platform_device *pdev)
         mtk_desc.custom_conf_items = mtk_conf_items;
 #endif
 
-        hw->pctrl = devm_pinctrl_register(&pdev->dev, &mtk_desc, hw);
-        if (IS_ERR(hw->pctrl))
-                return PTR_ERR(hw->pctrl);
+        err = devm_pinctrl_register_and_init(&pdev->dev, &mtk_desc, hw,
+                                             &hw->pctrl);
+        if (err)
+                return err;
 
         /* Setup groups descriptions per SoC types */
         err = mtk_build_groups(hw);
         if (err) {
                 dev_err(&pdev->dev, "Failed to build groups\n");
-                return 0;
+                return err;
         }
 
         /* Setup functions descriptions per SoC types */
@@ -1713,17 +1723,25 @@ static int mtk_pinctrl_probe(struct platform_device *pdev)
                 return err;
         }
 
-        err = mtk_build_gpiochip(hw, pdev->dev.of_node);
-        if (err) {
-                dev_err(&pdev->dev, "Failed to add gpio_chip\n");
+        /* For able to make pinctrl_claim_hogs, we must not enable pinctrl
+         * until all groups and functions are being added one.
+         */
+        err = pinctrl_enable(hw->pctrl);
+        if (err)
                 return err;
-        }
 
         err = mtk_build_eint(hw, pdev);
         if (err)
                 dev_warn(&pdev->dev,
                          "Failed to add EINT, but pinctrl still can work\n");
 
+        /* Build gpiochip should be after pinctrl_enable is done */
+        err = mtk_build_gpiochip(hw, pdev->dev.of_node);
+        if (err) {
+                dev_err(&pdev->dev, "Failed to add gpio_chip\n");
+                return err;
+        }
+
         platform_set_drvdata(pdev, hw);
 
         return 0;
diff --git a/drivers/pinctrl/pinctrl-ingenic.c b/drivers/pinctrl/pinctrl-ingenic.c
index a1d7156d0a43..6a1b6058b991 100644
--- a/drivers/pinctrl/pinctrl-ingenic.c
+++ b/drivers/pinctrl/pinctrl-ingenic.c
@@ -536,7 +536,7 @@ static int ingenic_pinmux_gpio_set_direction(struct pinctrl_dev *pctldev,
                 ingenic_config_pin(jzpc, pin, JZ4770_GPIO_PAT1, input);
         } else {
                 ingenic_config_pin(jzpc, pin, JZ4740_GPIO_SELECT, false);
-                ingenic_config_pin(jzpc, pin, JZ4740_GPIO_DIR, input);
+                ingenic_config_pin(jzpc, pin, JZ4740_GPIO_DIR, !input);
                 ingenic_config_pin(jzpc, pin, JZ4740_GPIO_FUNC, false);
         }
 
diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a77970.c b/drivers/pinctrl/sh-pfc/pfc-r8a77970.c
index b02caf316711..eeb58b3bbc9a 100644
--- a/drivers/pinctrl/sh-pfc/pfc-r8a77970.c
+++ b/drivers/pinctrl/sh-pfc/pfc-r8a77970.c
@@ -21,15 +21,13 @@
 #include "core.h"
 #include "sh_pfc.h"
 
-#define CFG_FLAGS SH_PFC_PIN_CFG_DRIVE_STRENGTH
-
 #define CPU_ALL_PORT(fn, sfx)                                           \
-        PORT_GP_CFG_22(0, fn, sfx, CFG_FLAGS | SH_PFC_PIN_CFG_IO_VOLTAGE), \
-        PORT_GP_CFG_28(1, fn, sfx, CFG_FLAGS),                          \
-        PORT_GP_CFG_17(2, fn, sfx, CFG_FLAGS | SH_PFC_PIN_CFG_IO_VOLTAGE), \
-        PORT_GP_CFG_17(3, fn, sfx, CFG_FLAGS | SH_PFC_PIN_CFG_IO_VOLTAGE), \
-        PORT_GP_CFG_6(4,  fn, sfx, CFG_FLAGS),                          \
-        PORT_GP_CFG_15(5, fn, sfx, CFG_FLAGS)
+        PORT_GP_CFG_22(0, fn, sfx, SH_PFC_PIN_CFG_IO_VOLTAGE),          \
+        PORT_GP_28(1, fn, sfx),                                         \
+        PORT_GP_CFG_17(2, fn, sfx, SH_PFC_PIN_CFG_IO_VOLTAGE),          \
+        PORT_GP_CFG_17(3, fn, sfx, SH_PFC_PIN_CFG_IO_VOLTAGE),          \
+        PORT_GP_6(4,  fn, sfx),                                         \
+        PORT_GP_15(5, fn, sfx)
 /*
  * F_() : just information
  * FM() : macro for FN_xxx / xxx_MARK
diff --git a/drivers/platform/x86/dell-laptop.c b/drivers/platform/x86/dell-laptop.c
index f1fa8612db40..06978c14c83b 100644
--- a/drivers/platform/x86/dell-laptop.c
+++ b/drivers/platform/x86/dell-laptop.c
@@ -2185,7 +2185,7 @@ static int __init dell_init(void)
                 dell_fill_request(&buffer, token->location, 0, 0, 0);
                 ret = dell_send_request(&buffer,
                                         CLASS_TOKEN_READ, SELECT_TOKEN_AC);
-                if (ret)
+                if (ret == 0)
                         max_intensity = buffer.output[3];
         }
 
diff --git a/drivers/ptp/ptp_chardev.c b/drivers/ptp/ptp_chardev.c
index 547dbdac9d54..01b0e2bb3319 100644
--- a/drivers/ptp/ptp_chardev.c
+++ b/drivers/ptp/ptp_chardev.c
@@ -89,6 +89,7 @@ int ptp_set_pinfunc(struct ptp_clock *ptp, unsigned int pin,
         case PTP_PF_PHYSYNC:
                 if (chan != 0)
                         return -EINVAL;
+                break;
         default:
                 return -EINVAL;
         }
diff --git a/drivers/rtc/interface.c b/drivers/rtc/interface.c
index 6d4012dd6922..bac1eeb3d312 100644
--- a/drivers/rtc/interface.c
+++ b/drivers/rtc/interface.c
@@ -265,8 +265,10 @@ int __rtc_read_alarm(struct rtc_device *rtc, struct rtc_wkalrm *alarm)
                         return err;
 
                 /* full-function RTCs won't have such missing fields */
-                if (rtc_valid_tm(&alarm->time) == 0)
+                if (rtc_valid_tm(&alarm->time) == 0) {
+                        rtc_add_offset(rtc, &alarm->time);
                         return 0;
+                }
 
                 /* get the "after" timestamp, to detect wrapped fields */
                 err = rtc_read_time(rtc, &now);
@@ -409,7 +411,6 @@ static int __rtc_set_alarm(struct rtc_device *rtc, struct rtc_wkalrm *alarm)
         if (err)
                 return err;
 
-        rtc_subtract_offset(rtc, &alarm->time);
         scheduled = rtc_tm_to_time64(&alarm->time);
 
         /* Make sure we're not setting alarms in the past */
@@ -426,6 +427,8 @@ static int __rtc_set_alarm(struct rtc_device *rtc, struct rtc_wkalrm *alarm)
          * over right here, before we set the alarm.
          */
 
+        rtc_subtract_offset(rtc, &alarm->time);
+
         if (!rtc->ops)
                 err = -ENODEV;
         else if (!rtc->ops->set_alarm)
@@ -467,7 +470,6 @@ int rtc_set_alarm(struct rtc_device *rtc, struct rtc_wkalrm *alarm)
 
         mutex_unlock(&rtc->ops_lock);
 
-        rtc_add_offset(rtc, &alarm->time);
         return err;
 }
 EXPORT_SYMBOL_GPL(rtc_set_alarm);
diff --git a/drivers/rtc/rtc-mrst.c b/drivers/rtc/rtc-mrst.c
index 097a4d4e2aba..1925aaf09093 100644
--- a/drivers/rtc/rtc-mrst.c
+++ b/drivers/rtc/rtc-mrst.c
@@ -367,10 +367,8 @@ static int vrtc_mrst_do_probe(struct device *dev, struct resource *iomem,
         }
 
         retval = rtc_register_device(mrst_rtc.rtc);
-        if (retval) {
-                retval = PTR_ERR(mrst_rtc.rtc);
+        if (retval)
                 goto cleanup0;
-        }
 
         dev_dbg(dev, "initialised\n");
         return 0;
diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
index d3a38c421503..a9f60d0ee02e 100644
--- a/drivers/s390/block/dasd.c
+++ b/drivers/s390/block/dasd.c
@@ -41,6 +41,15 @@
 
 #define DASD_DIAG_MOD           "dasd_diag_mod"
 
+static unsigned int queue_depth = 32;
+static unsigned int nr_hw_queues = 4;
+
+module_param(queue_depth, uint, 0444);
+MODULE_PARM_DESC(queue_depth, "Default queue depth for new DASD devices");
+
+module_param(nr_hw_queues, uint, 0444);
+MODULE_PARM_DESC(nr_hw_queues, "Default number of hardware queues for new DASD devices");
+
 /*
  * SECTION: exported variables of dasd.c
  */
@@ -3115,8 +3124,8 @@ static int dasd_alloc_queue(struct dasd_block *block)
 
         block->tag_set.ops = &dasd_mq_ops;
         block->tag_set.cmd_size = sizeof(struct dasd_ccw_req);
-        block->tag_set.nr_hw_queues = DASD_NR_HW_QUEUES;
-        block->tag_set.queue_depth = DASD_MAX_LCU_DEV * DASD_REQ_PER_DEV;
+        block->tag_set.nr_hw_queues = nr_hw_queues;
+        block->tag_set.queue_depth = queue_depth;
         block->tag_set.flags = BLK_MQ_F_SHOULD_MERGE;
 
         rc = blk_mq_alloc_tag_set(&block->tag_set);
diff --git a/drivers/s390/block/dasd_int.h b/drivers/s390/block/dasd_int.h
index 976b6bd4fb05..de6b96036aa4 100644
--- a/drivers/s390/block/dasd_int.h
+++ b/drivers/s390/block/dasd_int.h
@@ -228,14 +228,6 @@ struct dasd_ccw_req {
 #define DASD_CQR_SUPPRESS_IL    6       /* Suppress 'Incorrect Length' error */
 #define DASD_CQR_SUPPRESS_CR    7       /* Suppress 'Command Reject' error */
 
-/*
- * There is no reliable way to determine the number of available CPUs on
- * LPAR but there is no big performance difference between 1 and the
- * maximum CPU number.
- * 64 is a good trade off performance wise.
- */
-#define DASD_NR_HW_QUEUES 64
-#define DASD_MAX_LCU_DEV 256
 #define DASD_REQ_PER_DEV 4
 
 /* Signature for error recovery functions. */
diff --git a/drivers/s390/net/qeth_core.h b/drivers/s390/net/qeth_core.h
index 2a5fec55bf60..a246a618f9a4 100644
--- a/drivers/s390/net/qeth_core.h
+++ b/drivers/s390/net/qeth_core.h
@@ -829,6 +829,17 @@ struct qeth_trap_id {
 /*some helper functions*/
 #define QETH_CARD_IFNAME(card) (((card)->dev)? (card)->dev->name : "")
 
+static inline void qeth_scrub_qdio_buffer(struct qdio_buffer *buf,
+                                          unsigned int elements)
+{
+        unsigned int i;
+
+        for (i = 0; i < elements; i++)
+                memset(&buf->element[i], 0, sizeof(struct qdio_buffer_element));
+        buf->element[14].sflags = 0;
+        buf->element[15].sflags = 0;
+}
+
 /**
  * qeth_get_elements_for_range() -      find number of SBALEs to cover range.
  * @start:                              Start of the address range.
@@ -1029,7 +1040,7 @@ struct qeth_cmd_buffer *qeth_get_setassparms_cmd(struct qeth_card *,
                                                  __u16, __u16,
                                                  enum qeth_prot_versions);
 int qeth_set_features(struct net_device *, netdev_features_t);
-void qeth_recover_features(struct net_device *dev);
+void qeth_enable_hw_features(struct net_device *dev);
 netdev_features_t qeth_fix_features(struct net_device *, netdev_features_t);
 netdev_features_t qeth_features_check(struct sk_buff *skb,
                                       struct net_device *dev,
diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
index 8e1474f1ffac..d01ac29fd986 100644
--- a/drivers/s390/net/qeth_core_main.c
+++ b/drivers/s390/net/qeth_core_main.c
@@ -73,9 +73,6 @@ static void qeth_notify_skbs(struct qeth_qdio_out_q *queue,
                 struct qeth_qdio_out_buffer *buf,
                 enum iucv_tx_notify notification);
 static void qeth_release_skbs(struct qeth_qdio_out_buffer *buf);
-static void qeth_clear_output_buffer(struct qeth_qdio_out_q *queue,
-                struct qeth_qdio_out_buffer *buf,
-                enum qeth_qdio_buffer_states newbufstate);
 static int qeth_init_qdio_out_buf(struct qeth_qdio_out_q *, int);
 
 struct workqueue_struct *qeth_wq;
@@ -489,6 +486,7 @@ static void qeth_qdio_handle_aob(struct qeth_card *card,
         struct qaob *aob;
         struct qeth_qdio_out_buffer *buffer;
         enum iucv_tx_notify notification;
+        unsigned int i;
 
         aob = (struct qaob *) phys_to_virt(phys_aob_addr);
         QETH_CARD_TEXT(card, 5, "haob");
@@ -513,10 +511,18 @@ static void qeth_qdio_handle_aob(struct qeth_card *card,
         qeth_notify_skbs(buffer->q, buffer, notification);
 
         buffer->aob = NULL;
-        qeth_clear_output_buffer(buffer->q, buffer,
-                                 QETH_QDIO_BUF_HANDLED_DELAYED);
+        /* Free dangling allocations. The attached skbs are handled by
+         * qeth_cleanup_handled_pending().
+         */
+        for (i = 0;
+             i < aob->sb_count && i < QETH_MAX_BUFFER_ELEMENTS(card);
+             i++) {
+                if (aob->sba[i] && buffer->is_header[i])
+                        kmem_cache_free(qeth_core_header_cache,
+                                        (void *) aob->sba[i]);
+        }
+        atomic_set(&buffer->state, QETH_QDIO_BUF_HANDLED_DELAYED);
 
-        /* from here on: do not touch buffer anymore */
         qdio_release_aob(aob);
 }
 
@@ -3759,6 +3765,10 @@ static void qeth_qdio_output_handler(struct ccw_device *ccwdev,
                         QETH_CARD_TEXT(queue->card, 5, "aob");
                         QETH_CARD_TEXT_(queue->card, 5, "%lx",
                                         virt_to_phys(buffer->aob));
+
+                        /* prepare the queue slot for re-use: */
+                        qeth_scrub_qdio_buffer(buffer->buffer,
+                                               QETH_MAX_BUFFER_ELEMENTS(card));
                         if (qeth_init_qdio_out_buf(queue, bidx)) {
                                 QETH_CARD_TEXT(card, 2, "outofbuf");
                                 qeth_schedule_recovery(card);
@@ -4834,7 +4844,7 @@ int qeth_vm_request_mac(struct qeth_card *card)
                 goto out;
         }
 
-        ccw_device_get_id(CARD_RDEV(card), &id);
+        ccw_device_get_id(CARD_DDEV(card), &id);
         request->resp_buf_len = sizeof(*response);
         request->resp_version = DIAG26C_VERSION2;
         request->op_code = DIAG26C_GET_MAC;
@@ -6459,28 +6469,27 @@ static int qeth_set_ipa_rx_csum(struct qeth_card *card, bool on)
 #define QETH_HW_FEATURES (NETIF_F_RXCSUM | NETIF_F_IP_CSUM | NETIF_F_TSO | \
                           NETIF_F_IPV6_CSUM)
 /**
- * qeth_recover_features() - Restore device features after recovery
- * @dev:        the recovering net_device
- *
- * Caller must hold rtnl lock.
+ * qeth_enable_hw_features() - (Re-)Enable HW functions for device features
+ * @dev:        a net_device
  */
-void qeth_recover_features(struct net_device *dev)
+void qeth_enable_hw_features(struct net_device *dev)
 {
-        netdev_features_t features = dev->features;
         struct qeth_card *card = dev->ml_priv;
+        netdev_features_t features;
 
+        rtnl_lock();
+        features = dev->features;
         /* force-off any feature that needs an IPA sequence.
          * netdev_update_features() will restart them.
          */
         dev->features &= ~QETH_HW_FEATURES;
         netdev_update_features(dev);
-
-        if (features == dev->features)
-                return;
-        dev_warn(&card->gdev->dev,
-                 "Device recovery failed to restore all offload features\n");
+        if (features != dev->features)
+                dev_warn(&card->gdev->dev,
+                         "Device recovery failed to restore all offload features\n");
+        rtnl_unlock();
 }
-EXPORT_SYMBOL_GPL(qeth_recover_features);
+EXPORT_SYMBOL_GPL(qeth_enable_hw_features);
 
 int qeth_set_features(struct net_device *dev, netdev_features_t features)
 {
diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c
index a7cb37da6a21..2487f0aeb165 100644
--- a/drivers/s390/net/qeth_l2_main.c
+++ b/drivers/s390/net/qeth_l2_main.c
@@ -140,7 +140,7 @@ static int qeth_l2_send_setmac(struct qeth_card *card, __u8 *mac)
 
 static int qeth_l2_write_mac(struct qeth_card *card, u8 *mac)
 {
-        enum qeth_ipa_cmds cmd = is_multicast_ether_addr_64bits(mac) ?
+        enum qeth_ipa_cmds cmd = is_multicast_ether_addr(mac) ?
                                         IPA_CMD_SETGMAC : IPA_CMD_SETVMAC;
         int rc;
 
@@ -157,7 +157,7 @@ static int qeth_l2_write_mac(struct qeth_card *card, u8 *mac)
 
 static int qeth_l2_remove_mac(struct qeth_card *card, u8 *mac)
 {
-        enum qeth_ipa_cmds cmd = is_multicast_ether_addr_64bits(mac) ?
+        enum qeth_ipa_cmds cmd = is_multicast_ether_addr(mac) ?
                                         IPA_CMD_DELGMAC : IPA_CMD_DELVMAC;
         int rc;
 
@@ -501,27 +501,34 @@ static int qeth_l2_set_mac_address(struct net_device *dev, void *p)
                 return -ERESTARTSYS;
         }
 
+        /* avoid racing against concurrent state change: */
+        if (!mutex_trylock(&card->conf_mutex))
+                return -EAGAIN;
+
         if (!qeth_card_hw_is_reachable(card)) {
                 ether_addr_copy(dev->dev_addr, addr->sa_data);
-                return 0;
+                goto out_unlock;
         }
 
         /* don't register the same address twice */
         if (ether_addr_equal_64bits(dev->dev_addr, addr->sa_data) &&
             (card->info.mac_bits & QETH_LAYER2_MAC_REGISTERED))
-                return 0;
+                goto out_unlock;
 
         /* add the new address, switch over, drop the old */
         rc = qeth_l2_send_setmac(card, addr->sa_data);
         if (rc)
-                return rc;
+                goto out_unlock;
         ether_addr_copy(old_addr, dev->dev_addr);
         ether_addr_copy(dev->dev_addr, addr->sa_data);
 
         if (card->info.mac_bits & QETH_LAYER2_MAC_REGISTERED)
                 qeth_l2_remove_mac(card, old_addr);
         card->info.mac_bits |= QETH_LAYER2_MAC_REGISTERED;
-        return 0;
+
+out_unlock:
+        mutex_unlock(&card->conf_mutex);
+        return rc;
 }
 
 static void qeth_promisc_to_bridge(struct qeth_card *card)
@@ -1112,6 +1119,8 @@ static int __qeth_l2_set_online(struct ccwgroup_device *gdev, int recovery_mode)
                 netif_carrier_off(card->dev);
 
         qeth_set_allowed_threads(card, 0xffffffff, 0);
+
+        qeth_enable_hw_features(card->dev);
         if (recover_flag == CARD_STATE_RECOVER) {
                 if (recovery_mode &&
                     card->info.type != QETH_CARD_TYPE_OSN) {
@@ -1123,9 +1132,6 @@ static int __qeth_l2_set_online(struct ccwgroup_device *gdev, int recovery_mode)
                 }
                 /* this also sets saved unicast addresses */
                 qeth_l2_set_rx_mode(card->dev);
-                rtnl_lock();
-                qeth_recover_features(card->dev);
-                rtnl_unlock();
         }
         /* let user_space know that device is online */
         kobject_uevent(&gdev->dev.kobj, KOBJ_CHANGE);
diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c
index e7fa479adf47..5905dc63e256 100644
--- a/drivers/s390/net/qeth_l3_main.c
+++ b/drivers/s390/net/qeth_l3_main.c
@@ -2662,6 +2662,8 @@ static int __qeth_l3_set_online(struct ccwgroup_device *gdev, int recovery_mode)
                 netif_carrier_on(card->dev);
         else
                 netif_carrier_off(card->dev);
+
+        qeth_enable_hw_features(card->dev);
         if (recover_flag == CARD_STATE_RECOVER) {
                 rtnl_lock();
                 if (recovery_mode)
@@ -2669,7 +2671,6 @@ static int __qeth_l3_set_online(struct ccwgroup_device *gdev, int recovery_mode)
                 else
                         dev_open(card->dev);
                 qeth_l3_set_rx_mode(card->dev);
-                qeth_recover_features(card->dev);
                 rtnl_unlock();
         }
         qeth_trace_features(card);
diff --git a/drivers/scsi/aacraid/aachba.c b/drivers/scsi/aacraid/aachba.c
index a9831bd37a73..a57f3a7d4748 100644
--- a/drivers/scsi/aacraid/aachba.c
+++ b/drivers/scsi/aacraid/aachba.c
@@ -1974,7 +1974,6 @@ static void aac_set_safw_attr_all_targets(struct aac_dev *dev)
         u32 lun_count, nexus;
         u32 i, bus, target;
         u8 expose_flag, attribs;
-        u8 devtype;
 
         lun_count = aac_get_safw_phys_lun_count(dev);
 
@@ -1992,23 +1991,23 @@ static void aac_set_safw_attr_all_targets(struct aac_dev *dev)
                         continue;
 
                 if (expose_flag != 0) {
-                        devtype = AAC_DEVTYPE_RAID_MEMBER;
-                        goto update_devtype;
+                        dev->hba_map[bus][target].devtype =
+                                AAC_DEVTYPE_RAID_MEMBER;
+                        continue;
                 }
 
                 if (nexus != 0 && (attribs & 8)) {
-                        devtype = AAC_DEVTYPE_NATIVE_RAW;
+                        dev->hba_map[bus][target].devtype =
+                                AAC_DEVTYPE_NATIVE_RAW;
                         dev->hba_map[bus][target].rmw_nexus =
                                         nexus;
                 } else
-                        devtype = AAC_DEVTYPE_ARC_RAW;
+                        dev->hba_map[bus][target].devtype =
+                                AAC_DEVTYPE_ARC_RAW;
 
                 dev->hba_map[bus][target].scan_counter = dev->scan_counter;
 
                 aac_set_safw_target_qd(dev, bus, target);
-
-update_devtype:
-                dev->hba_map[bus][target].devtype = devtype;
         }
 }
 
diff --git a/drivers/scsi/cxlflash/main.h b/drivers/scsi/cxlflash/main.h
index 2a3977823812..a39be94d110c 100644
--- a/drivers/scsi/cxlflash/main.h
+++ b/drivers/scsi/cxlflash/main.h
@@ -107,12 +107,12 @@ cxlflash_assign_ops(struct dev_dependent_vals *ddv)
 {
         const struct cxlflash_backend_ops *ops = NULL;
 
-#ifdef CONFIG_OCXL
+#ifdef CONFIG_OCXL_BASE
         if (ddv->flags & CXLFLASH_OCXL_DEV)
                 ops = &cxlflash_ocxl_ops;
 #endif
 
-#ifdef CONFIG_CXL
+#ifdef CONFIG_CXL_BASE
         if (!(ddv->flags & CXLFLASH_OCXL_DEV))
                 ops = &cxlflash_cxl_ops;
 #endif
diff --git a/drivers/scsi/cxlflash/ocxl_hw.c b/drivers/scsi/cxlflash/ocxl_hw.c
index 0a95b5f25380..497a68389461 100644
--- a/drivers/scsi/cxlflash/ocxl_hw.c
+++ b/drivers/scsi/cxlflash/ocxl_hw.c
@@ -134,15 +134,14 @@ static struct file *ocxlflash_getfile(struct device *dev, const char *name,
                 rc = PTR_ERR(file);
                 dev_err(dev, "%s: alloc_file failed rc=%d\n",
                         __func__, rc);
-                goto err5;
+                path_put(&path);
+                goto err3;
         }
 
         file->f_flags = flags & (O_ACCMODE | O_NONBLOCK);
         file->private_data = priv;
 out:
         return file;
-err5:
-        path_put(&path);
 err4:
         iput(inode);
 err3:
diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
index 15c7f3b6f35e..58bb70b886d7 100644
--- a/drivers/scsi/hpsa.c
+++ b/drivers/scsi/hpsa.c
@@ -3440,11 +3440,11 @@ static void hpsa_get_enclosure_info(struct ctlr_info *h,
         struct ext_report_lun_entry *rle = &rlep->LUN[rle_index];
         u16 bmic_device_index = 0;
 
-        bmic_device_index = GET_BMIC_DRIVE_NUMBER(&rle->lunid[0]);
-
-        encl_dev->sas_address =
+        encl_dev->eli =
                 hpsa_get_enclosure_logical_identifier(h, scsi3addr);
 
+        bmic_device_index = GET_BMIC_DRIVE_NUMBER(&rle->lunid[0]);
+
         if (encl_dev->target == -1 || encl_dev->lun == -1) {
                 rc = IO_OK;
                 goto out;
@@ -9697,7 +9697,24 @@ hpsa_sas_get_linkerrors(struct sas_phy *phy)
 static int
 hpsa_sas_get_enclosure_identifier(struct sas_rphy *rphy, u64 *identifier)
 {
-        *identifier = rphy->identify.sas_address;
+        struct Scsi_Host *shost = phy_to_shost(rphy);
+        struct ctlr_info *h;
+        struct hpsa_scsi_dev_t *sd;
+
+        if (!shost)
+                return -ENXIO;
+
+        h = shost_to_hba(shost);
+
+        if (!h)
+                return -ENXIO;
+
+        sd = hpsa_find_device_by_sas_rphy(h, rphy);
+        if (!sd)
+                return -ENXIO;
+
+        *identifier = sd->eli;
+
         return 0;
 }
 
diff --git a/drivers/scsi/hpsa.h b/drivers/scsi/hpsa.h
index fb9f5e7f8209..59e023696fff 100644
--- a/drivers/scsi/hpsa.h
+++ b/drivers/scsi/hpsa.h
@@ -68,6 +68,7 @@ struct hpsa_scsi_dev_t {
 #define RAID_CTLR_LUNID "\0\0\0\0\0\0\0\0"
         unsigned char device_id[16];    /* from inquiry pg. 0x83 */
         u64 sas_address;
+        u64 eli;                        /* from report diags. */
         unsigned char vendor[8];        /* bytes 8-15 of inquiry data */
         unsigned char model[16];        /* bytes 16-31 of inquiry data */
         unsigned char rev;              /* byte 2 of inquiry data */
diff --git a/drivers/scsi/qedf/qedf_main.c b/drivers/scsi/qedf/qedf_main.c
index 90394cef0f41..0a5dd5595dd3 100644
--- a/drivers/scsi/qedf/qedf_main.c
+++ b/drivers/scsi/qedf/qedf_main.c
@@ -3295,6 +3295,11 @@ static int __qedf_probe(struct pci_dev *pdev, int mode)
 
         init_completion(&qedf->flogi_compl);
 
+        status = qed_ops->common->update_drv_state(qedf->cdev, true);
+        if (status)
+                QEDF_ERR(&(qedf->dbg_ctx),
+                        "Failed to send drv state to MFW.\n");
+
         memset(&link_params, 0, sizeof(struct qed_link_params));
         link_params.link_up = true;
         status = qed_ops->common->set_link(qedf->cdev, &link_params);
@@ -3343,6 +3348,7 @@ static int qedf_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 static void __qedf_remove(struct pci_dev *pdev, int mode)
 {
         struct qedf_ctx *qedf;
+        int rc;
 
         if (!pdev) {
                 QEDF_ERR(NULL, "pdev is NULL.\n");
@@ -3437,6 +3443,12 @@ static void __qedf_remove(struct pci_dev *pdev, int mode)
                 qed_ops->common->set_power_state(qedf->cdev, PCI_D0);
                 pci_set_drvdata(pdev, NULL);
         }
+
+        rc = qed_ops->common->update_drv_state(qedf->cdev, false);
+        if (rc)
+                QEDF_ERR(&(qedf->dbg_ctx),
+                        "Failed to send drv state to MFW.\n");
+
         qed_ops->common->slowpath_stop(qedf->cdev);
         qed_ops->common->remove(qedf->cdev);
 
diff --git a/drivers/scsi/qedi/qedi_main.c b/drivers/scsi/qedi/qedi_main.c
index cf274a79e77a..091ec1207bea 100644
--- a/drivers/scsi/qedi/qedi_main.c
+++ b/drivers/scsi/qedi/qedi_main.c
@@ -2273,6 +2273,7 @@ kset_free:
 static void __qedi_remove(struct pci_dev *pdev, int mode)
 {
         struct qedi_ctx *qedi = pci_get_drvdata(pdev);
+        int rval;
 
         if (qedi->tmf_thread) {
                 flush_workqueue(qedi->tmf_thread);
@@ -2302,6 +2303,10 @@ static void __qedi_remove(struct pci_dev *pdev, int mode)
         if (mode == QEDI_MODE_NORMAL)
                 qedi_free_iscsi_pf_param(qedi);
 
+        rval = qedi_ops->common->update_drv_state(qedi->cdev, false);
+        if (rval)
+                QEDI_ERR(&qedi->dbg_ctx, "Failed to send drv state to MFW\n");
+
         if (!test_bit(QEDI_IN_OFFLINE, &qedi->flags)) {
                 qedi_ops->common->slowpath_stop(qedi->cdev);
                 qedi_ops->common->remove(qedi->cdev);
@@ -2576,6 +2581,12 @@ static int __qedi_probe(struct pci_dev *pdev, int mode)
                 if (qedi_setup_boot_info(qedi))
                         QEDI_ERR(&qedi->dbg_ctx,
                                  "No iSCSI boot target configured\n");
+
+                rc = qedi_ops->common->update_drv_state(qedi->cdev, true);
+                if (rc)
+                        QEDI_ERR(&qedi->dbg_ctx,
+                                 "Failed to send drv state to MFW\n");
+
         }
 
         return 0;
diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h
index 9442e18aef6f..0f94b1d62d3f 100644
--- a/drivers/scsi/qla2xxx/qla_def.h
+++ b/drivers/scsi/qla2xxx/qla_def.h
@@ -361,6 +361,8 @@ struct ct_arg {
         dma_addr_t      rsp_dma;
         u32             req_size;
         u32             rsp_size;
+        u32             req_allocated_size;
+        u32             rsp_allocated_size;
         void            *req;
         void            *rsp;
         port_id_t       id;
diff --git a/drivers/scsi/qla2xxx/qla_gs.c b/drivers/scsi/qla2xxx/qla_gs.c
index 4bc2b66b299f..2c35b0b2baa0 100644
--- a/drivers/scsi/qla2xxx/qla_gs.c
+++ b/drivers/scsi/qla2xxx/qla_gs.c
@@ -556,7 +556,7 @@ err2:
                 /* please ignore kernel warning. otherwise, we have mem leak. */
                 if (sp->u.iocb_cmd.u.ctarg.req) {
                         dma_free_coherent(&vha->hw->pdev->dev,
-                            sizeof(struct ct_sns_pkt),
+                            sp->u.iocb_cmd.u.ctarg.req_allocated_size,
                             sp->u.iocb_cmd.u.ctarg.req,
                             sp->u.iocb_cmd.u.ctarg.req_dma);
                         sp->u.iocb_cmd.u.ctarg.req = NULL;
@@ -564,7 +564,7 @@ err2:
 
                 if (sp->u.iocb_cmd.u.ctarg.rsp) {
                         dma_free_coherent(&vha->hw->pdev->dev,
-                            sizeof(struct ct_sns_pkt),
+                            sp->u.iocb_cmd.u.ctarg.rsp_allocated_size,
                             sp->u.iocb_cmd.u.ctarg.rsp,
                             sp->u.iocb_cmd.u.ctarg.rsp_dma);
                         sp->u.iocb_cmd.u.ctarg.rsp = NULL;
@@ -617,6 +617,7 @@ static int qla_async_rftid(scsi_qla_host_t *vha, port_id_t *d_id)
         sp->u.iocb_cmd.u.ctarg.req = dma_alloc_coherent(&vha->hw->pdev->dev,
             sizeof(struct ct_sns_pkt), &sp->u.iocb_cmd.u.ctarg.req_dma,
             GFP_KERNEL);
+        sp->u.iocb_cmd.u.ctarg.req_allocated_size = sizeof(struct ct_sns_pkt);
         if (!sp->u.iocb_cmd.u.ctarg.req) {
                 ql_log(ql_log_warn, vha, 0xd041,
                     "%s: Failed to allocate ct_sns request.\n",
@@ -627,6 +628,7 @@ static int qla_async_rftid(scsi_qla_host_t *vha, port_id_t *d_id)
         sp->u.iocb_cmd.u.ctarg.rsp = dma_alloc_coherent(&vha->hw->pdev->dev,
             sizeof(struct ct_sns_pkt), &sp->u.iocb_cmd.u.ctarg.rsp_dma,
             GFP_KERNEL);
+        sp->u.iocb_cmd.u.ctarg.rsp_allocated_size = sizeof(struct ct_sns_pkt);
         if (!sp->u.iocb_cmd.u.ctarg.rsp) {
                 ql_log(ql_log_warn, vha, 0xd042,
                     "%s: Failed to allocate ct_sns request.\n",
@@ -712,6 +714,7 @@ static int qla_async_rffid(scsi_qla_host_t *vha, port_id_t *d_id,
         sp->u.iocb_cmd.u.ctarg.req = dma_alloc_coherent(&vha->hw->pdev->dev,
             sizeof(struct ct_sns_pkt), &sp->u.iocb_cmd.u.ctarg.req_dma,
             GFP_KERNEL);
+        sp->u.iocb_cmd.u.ctarg.req_allocated_size = sizeof(struct ct_sns_pkt);
         if (!sp->u.iocb_cmd.u.ctarg.req) {
                 ql_log(ql_log_warn, vha, 0xd041,
                     "%s: Failed to allocate ct_sns request.\n",
@@ -722,6 +725,7 @@ static int qla_async_rffid(scsi_qla_host_t *vha, port_id_t *d_id,
         sp->u.iocb_cmd.u.ctarg.rsp = dma_alloc_coherent(&vha->hw->pdev->dev,
             sizeof(struct ct_sns_pkt), &sp->u.iocb_cmd.u.ctarg.rsp_dma,
             GFP_KERNEL);
+        sp->u.iocb_cmd.u.ctarg.rsp_allocated_size = sizeof(struct ct_sns_pkt);
         if (!sp->u.iocb_cmd.u.ctarg.rsp) {
                 ql_log(ql_log_warn, vha, 0xd042,
                     "%s: Failed to allocate ct_sns request.\n",
@@ -802,6 +806,7 @@ static int qla_async_rnnid(scsi_qla_host_t *vha, port_id_t *d_id,
         sp->u.iocb_cmd.u.ctarg.req = dma_alloc_coherent(&vha->hw->pdev->dev,
             sizeof(struct ct_sns_pkt), &sp->u.iocb_cmd.u.ctarg.req_dma,
             GFP_KERNEL);
+        sp->u.iocb_cmd.u.ctarg.req_allocated_size = sizeof(struct ct_sns_pkt);
         if (!sp->u.iocb_cmd.u.ctarg.req) {
                 ql_log(ql_log_warn, vha, 0xd041,
                     "%s: Failed to allocate ct_sns request.\n",
@@ -812,6 +817,7 @@ static int qla_async_rnnid(scsi_qla_host_t *vha, port_id_t *d_id,
         sp->u.iocb_cmd.u.ctarg.rsp = dma_alloc_coherent(&vha->hw->pdev->dev,
             sizeof(struct ct_sns_pkt), &sp->u.iocb_cmd.u.ctarg.rsp_dma,
             GFP_KERNEL);
+        sp->u.iocb_cmd.u.ctarg.rsp_allocated_size = sizeof(struct ct_sns_pkt);
         if (!sp->u.iocb_cmd.u.ctarg.rsp) {
                 ql_log(ql_log_warn, vha, 0xd042,
                     "%s: Failed to allocate ct_sns request.\n",
@@ -909,6 +915,7 @@ static int qla_async_rsnn_nn(scsi_qla_host_t *vha)
         sp->u.iocb_cmd.u.ctarg.req = dma_alloc_coherent(&vha->hw->pdev->dev,
             sizeof(struct ct_sns_pkt), &sp->u.iocb_cmd.u.ctarg.req_dma,
             GFP_KERNEL);
+        sp->u.iocb_cmd.u.ctarg.req_allocated_size = sizeof(struct ct_sns_pkt);
         if (!sp->u.iocb_cmd.u.ctarg.req) {
                 ql_log(ql_log_warn, vha, 0xd041,
                     "%s: Failed to allocate ct_sns request.\n",
@@ -919,6 +926,7 @@ static int qla_async_rsnn_nn(scsi_qla_host_t *vha)
         sp->u.iocb_cmd.u.ctarg.rsp = dma_alloc_coherent(&vha->hw->pdev->dev,
             sizeof(struct ct_sns_pkt), &sp->u.iocb_cmd.u.ctarg.rsp_dma,
             GFP_KERNEL);
+        sp->u.iocb_cmd.u.ctarg.rsp_allocated_size = sizeof(struct ct_sns_pkt);
         if (!sp->u.iocb_cmd.u.ctarg.rsp) {
                 ql_log(ql_log_warn, vha, 0xd042,
                     "%s: Failed to allocate ct_sns request.\n",
@@ -3388,14 +3396,14 @@ void qla24xx_sp_unmap(scsi_qla_host_t *vha, srb_t *sp)
 {
         if (sp->u.iocb_cmd.u.ctarg.req) {
                 dma_free_coherent(&vha->hw->pdev->dev,
-                        sizeof(struct ct_sns_pkt),
+                        sp->u.iocb_cmd.u.ctarg.req_allocated_size,
                         sp->u.iocb_cmd.u.ctarg.req,
                         sp->u.iocb_cmd.u.ctarg.req_dma);
                 sp->u.iocb_cmd.u.ctarg.req = NULL;
         }
         if (sp->u.iocb_cmd.u.ctarg.rsp) {
                 dma_free_coherent(&vha->hw->pdev->dev,
-                        sizeof(struct ct_sns_pkt),
+                        sp->u.iocb_cmd.u.ctarg.rsp_allocated_size,
                         sp->u.iocb_cmd.u.ctarg.rsp,
                         sp->u.iocb_cmd.u.ctarg.rsp_dma);
                 sp->u.iocb_cmd.u.ctarg.rsp = NULL;
@@ -3596,14 +3604,14 @@ static void qla2x00_async_gpnid_sp_done(void *s, int res)
                 /* please ignore kernel warning. otherwise, we have mem leak. */
                 if (sp->u.iocb_cmd.u.ctarg.req) {
                         dma_free_coherent(&vha->hw->pdev->dev,
-                                sizeof(struct ct_sns_pkt),
+                                sp->u.iocb_cmd.u.ctarg.req_allocated_size,
                                 sp->u.iocb_cmd.u.ctarg.req,
                                 sp->u.iocb_cmd.u.ctarg.req_dma);
                         sp->u.iocb_cmd.u.ctarg.req = NULL;
                 }
                 if (sp->u.iocb_cmd.u.ctarg.rsp) {
                         dma_free_coherent(&vha->hw->pdev->dev,
-                                sizeof(struct ct_sns_pkt),
+                                sp->u.iocb_cmd.u.ctarg.rsp_allocated_size,
                                 sp->u.iocb_cmd.u.ctarg.rsp,
                                 sp->u.iocb_cmd.u.ctarg.rsp_dma);
                         sp->u.iocb_cmd.u.ctarg.rsp = NULL;
@@ -3654,6 +3662,7 @@ int qla24xx_async_gpnid(scsi_qla_host_t *vha, port_id_t *id)
         sp->u.iocb_cmd.u.ctarg.req = dma_alloc_coherent(&vha->hw->pdev->dev,
                 sizeof(struct ct_sns_pkt), &sp->u.iocb_cmd.u.ctarg.req_dma,
                 GFP_KERNEL);
+        sp->u.iocb_cmd.u.ctarg.req_allocated_size = sizeof(struct ct_sns_pkt);
         if (!sp->u.iocb_cmd.u.ctarg.req) {
                 ql_log(ql_log_warn, vha, 0xd041,
                     "Failed to allocate ct_sns request.\n");
@@ -3663,6 +3672,7 @@ int qla24xx_async_gpnid(scsi_qla_host_t *vha, port_id_t *id)
         sp->u.iocb_cmd.u.ctarg.rsp = dma_alloc_coherent(&vha->hw->pdev->dev,
                 sizeof(struct ct_sns_pkt), &sp->u.iocb_cmd.u.ctarg.rsp_dma,
                 GFP_KERNEL);
+        sp->u.iocb_cmd.u.ctarg.rsp_allocated_size = sizeof(struct ct_sns_pkt);
         if (!sp->u.iocb_cmd.u.ctarg.rsp) {
                 ql_log(ql_log_warn, vha, 0xd042,
                     "Failed to allocate ct_sns request.\n");
@@ -4142,14 +4152,14 @@ static void qla2x00_async_gpnft_gnnft_sp_done(void *s, int res)
                          */
                         if (sp->u.iocb_cmd.u.ctarg.req) {
                                 dma_free_coherent(&vha->hw->pdev->dev,
-                                    sizeof(struct ct_sns_pkt),
+                                    sp->u.iocb_cmd.u.ctarg.req_allocated_size,
                                     sp->u.iocb_cmd.u.ctarg.req,
                                     sp->u.iocb_cmd.u.ctarg.req_dma);
                                 sp->u.iocb_cmd.u.ctarg.req = NULL;
                         }
                         if (sp->u.iocb_cmd.u.ctarg.rsp) {
                                 dma_free_coherent(&vha->hw->pdev->dev,
-                                    sizeof(struct ct_sns_pkt),
+                                    sp->u.iocb_cmd.u.ctarg.rsp_allocated_size,
                                     sp->u.iocb_cmd.u.ctarg.rsp,
                                     sp->u.iocb_cmd.u.ctarg.rsp_dma);
                                 sp->u.iocb_cmd.u.ctarg.rsp = NULL;
@@ -4179,14 +4189,14 @@ static void qla2x00_async_gpnft_gnnft_sp_done(void *s, int res)
                 /* please ignore kernel warning. Otherwise, we have mem leak. */
                 if (sp->u.iocb_cmd.u.ctarg.req) {
                         dma_free_coherent(&vha->hw->pdev->dev,
-                            sizeof(struct ct_sns_pkt),
+                            sp->u.iocb_cmd.u.ctarg.req_allocated_size,
                             sp->u.iocb_cmd.u.ctarg.req,
                             sp->u.iocb_cmd.u.ctarg.req_dma);
                         sp->u.iocb_cmd.u.ctarg.req = NULL;
                 }
                 if (sp->u.iocb_cmd.u.ctarg.rsp) {
                         dma_free_coherent(&vha->hw->pdev->dev,
-                            sizeof(struct ct_sns_pkt),
+                            sp->u.iocb_cmd.u.ctarg.rsp_allocated_size,
                             sp->u.iocb_cmd.u.ctarg.rsp,
                             sp->u.iocb_cmd.u.ctarg.rsp_dma);
                         sp->u.iocb_cmd.u.ctarg.rsp = NULL;
@@ -4281,14 +4291,14 @@ static int qla24xx_async_gnnft(scsi_qla_host_t *vha, struct srb *sp,
 done_free_sp:
         if (sp->u.iocb_cmd.u.ctarg.req) {
                 dma_free_coherent(&vha->hw->pdev->dev,
-                    sizeof(struct ct_sns_pkt),
+                    sp->u.iocb_cmd.u.ctarg.req_allocated_size,
                     sp->u.iocb_cmd.u.ctarg.req,
                     sp->u.iocb_cmd.u.ctarg.req_dma);
                 sp->u.iocb_cmd.u.ctarg.req = NULL;
         }
         if (sp->u.iocb_cmd.u.ctarg.rsp) {
                 dma_free_coherent(&vha->hw->pdev->dev,
-                    sizeof(struct ct_sns_pkt),
+                    sp->u.iocb_cmd.u.ctarg.rsp_allocated_size,
                     sp->u.iocb_cmd.u.ctarg.rsp,
                     sp->u.iocb_cmd.u.ctarg.rsp_dma);
                 sp->u.iocb_cmd.u.ctarg.rsp = NULL;
@@ -4349,6 +4359,7 @@ int qla24xx_async_gpnft(scsi_qla_host_t *vha, u8 fc4_type, srb_t *sp)
                 sp->u.iocb_cmd.u.ctarg.req = dma_zalloc_coherent(
                         &vha->hw->pdev->dev, sizeof(struct ct_sns_pkt),
                         &sp->u.iocb_cmd.u.ctarg.req_dma, GFP_KERNEL);
+                sp->u.iocb_cmd.u.ctarg.req_allocated_size = sizeof(struct ct_sns_pkt);
                 if (!sp->u.iocb_cmd.u.ctarg.req) {
                         ql_log(ql_log_warn, vha, 0xffff,
                             "Failed to allocate ct_sns request.\n");
@@ -4366,6 +4377,7 @@ int qla24xx_async_gpnft(scsi_qla_host_t *vha, u8 fc4_type, srb_t *sp)
                 sp->u.iocb_cmd.u.ctarg.rsp = dma_zalloc_coherent(
                         &vha->hw->pdev->dev, rspsz,
                         &sp->u.iocb_cmd.u.ctarg.rsp_dma, GFP_KERNEL);
+                sp->u.iocb_cmd.u.ctarg.rsp_allocated_size = sizeof(struct ct_sns_pkt);
                 if (!sp->u.iocb_cmd.u.ctarg.rsp) {
                         ql_log(ql_log_warn, vha, 0xffff,
                             "Failed to allocate ct_sns request.\n");
@@ -4425,14 +4437,14 @@ int qla24xx_async_gpnft(scsi_qla_host_t *vha, u8 fc4_type, srb_t *sp)
 done_free_sp:
         if (sp->u.iocb_cmd.u.ctarg.req) {
                 dma_free_coherent(&vha->hw->pdev->dev,
-                    sizeof(struct ct_sns_pkt),
+                    sp->u.iocb_cmd.u.ctarg.req_allocated_size,
                     sp->u.iocb_cmd.u.ctarg.req,
                     sp->u.iocb_cmd.u.ctarg.req_dma);
                 sp->u.iocb_cmd.u.ctarg.req = NULL;
         }
         if (sp->u.iocb_cmd.u.ctarg.rsp) {
                 dma_free_coherent(&vha->hw->pdev->dev,
-                    sizeof(struct ct_sns_pkt),
+                    sp->u.iocb_cmd.u.ctarg.rsp_allocated_size,
                     sp->u.iocb_cmd.u.ctarg.rsp,
                     sp->u.iocb_cmd.u.ctarg.rsp_dma);
                 sp->u.iocb_cmd.u.ctarg.rsp = NULL;
diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
index 7b675243bd16..db0e3279e07a 100644
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -591,12 +591,14 @@ static void qla24xx_handle_gnl_done_event(scsi_qla_host_t *vha,
                                 conflict_fcport =
                                         qla2x00_find_fcport_by_wwpn(vha,
                                             e->port_name, 0);
-                                ql_dbg(ql_dbg_disc, vha, 0x20e6,
-                                    "%s %d %8phC post del sess\n",
-                                    __func__, __LINE__,
-                                    conflict_fcport->port_name);
-                                qlt_schedule_sess_for_deletion
-                                        (conflict_fcport);
+                                if (conflict_fcport) {
+                                        qlt_schedule_sess_for_deletion
+                                                (conflict_fcport);
+                                        ql_dbg(ql_dbg_disc, vha, 0x20e6,
+                                            "%s %d %8phC post del sess\n",
+                                            __func__, __LINE__,
+                                            conflict_fcport->port_name);
+                                }
                         }
 
                         /* FW already picked this loop id for another fcport */
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index e881fce7477a..9f309e572be4 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -3180,6 +3180,8 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
             "req->req_q_in=%p req->req_q_out=%p rsp->rsp_q_in=%p rsp->rsp_q_out=%p.\n",
             req->req_q_in, req->req_q_out, rsp->rsp_q_in, rsp->rsp_q_out);
 
+        ha->wq = alloc_workqueue("qla2xxx_wq", 0, 0);
+
         if (ha->isp_ops->initialize_adapter(base_vha)) {
                 ql_log(ql_log_fatal, base_vha, 0x00d6,
                     "Failed to initialize adapter - Adapter flags %x.\n",
@@ -3216,8 +3218,6 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
             host->can_queue, base_vha->req,
             base_vha->mgmt_svr_loop_id, host->sg_tablesize);
 
-        ha->wq = alloc_workqueue("qla2xxx_wq", 0, 0);
-
         if (ha->mqenable) {
                 bool mq = false;
                 bool startit = false;
diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c
index 8932ae81a15a..2715cdaa669c 100644
--- a/drivers/scsi/scsi_error.c
+++ b/drivers/scsi/scsi_error.c
@@ -296,6 +296,20 @@ enum blk_eh_timer_return scsi_times_out(struct request *req)
                 rtn = host->hostt->eh_timed_out(scmd);
 
         if (rtn == BLK_EH_DONE) {
+                /*
+                 * For blk-mq, we must set the request state to complete now
+                 * before sending the request to the scsi error handler. This
+                 * will prevent a use-after-free in the event the LLD manages
+                 * to complete the request before the error handler finishes
+                 * processing this timed out request.
+                 *
+                 * If the request was already completed, then the LLD beat the
+                 * time out handler from transferring the request to the scsi
+                 * error handler. In that case we can return immediately as no
+                 * further action is required.
+                 */
+                if (req->q->mq_ops && !blk_mq_mark_complete(req))
+                        return rtn;
                 if (scsi_abort_command(scmd) != SUCCESS) {
                         set_host_byte(scmd, DID_TIME_OUT);
                         scsi_eh_scmd_add(scmd);
diff --git a/drivers/scsi/sd_zbc.c b/drivers/scsi/sd_zbc.c
index a14fef11776e..2bf3bf73886e 100644
--- a/drivers/scsi/sd_zbc.c
+++ b/drivers/scsi/sd_zbc.c
@@ -391,7 +391,8 @@ static int sd_zbc_check_capacity(struct scsi_disk *sdkp, unsigned char *buf)
  * Check that all zones of the device are equal. The last zone can however
  * be smaller. The zone size must also be a power of two number of LBAs.
  *
- * Returns the zone size in bytes upon success or an error code upon failure.
+ * Returns the zone size in number of blocks upon success or an error code
+ * upon failure.
  */
 static s64 sd_zbc_check_zone_size(struct scsi_disk *sdkp)
 {
@@ -401,7 +402,7 @@ static s64 sd_zbc_check_zone_size(struct scsi_disk *sdkp)
         unsigned char *rec;
         unsigned int buf_len;
         unsigned int list_length;
-        int ret;
+        s64 ret;
         u8 same;
 
         /* Get a buffer */
diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
index 53ae52dbff84..cd2fdac000c9 100644
--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -51,6 +51,7 @@ static int sg_version_num = 30536;	/* 2 digits for each component */
 #include <linux/atomic.h>
 #include <linux/ratelimit.h>
 #include <linux/uio.h>
+#include <linux/cred.h> /* for sg_check_file_access() */
 
 #include "scsi.h"
 #include <scsi/scsi_dbg.h>
@@ -209,6 +210,33 @@ static void sg_device_destroy(struct kref *kref);
         sdev_prefix_printk(prefix, (sdp)->device,               \
                            (sdp)->disk->disk_name, fmt, ##a)
 
+/*
+ * The SCSI interfaces that use read() and write() as an asynchronous variant of
+ * ioctl(..., SG_IO, ...) are fundamentally unsafe, since there are lots of ways
+ * to trigger read() and write() calls from various contexts with elevated
+ * privileges. This can lead to kernel memory corruption (e.g. if these
+ * interfaces are called through splice()) and privilege escalation inside
+ * userspace (e.g. if a process with access to such a device passes a file
+ * descriptor to a SUID binary as stdin/stdout/stderr).
+ *
+ * This function provides protection for the legacy API by restricting the
+ * calling context.
+ */
+static int sg_check_file_access(struct file *filp, const char *caller)
+{
+        if (filp->f_cred != current_real_cred()) {
+                pr_err_once("%s: process %d (%s) changed security contexts after opening file descriptor, this is not allowed.\n",
+                        caller, task_tgid_vnr(current), current->comm);
+                return -EPERM;
+        }
+        if (uaccess_kernel()) {
+                pr_err_once("%s: process %d (%s) called from kernel context, this is not allowed.\n",
+                        caller, task_tgid_vnr(current), current->comm);
+                return -EACCES;
+        }
+        return 0;
+}
+
 static int sg_allow_access(struct file *filp, unsigned char *cmd)
 {
         struct sg_fd *sfp = filp->private_data;
@@ -393,6 +421,14 @@ sg_read(struct file *filp, char __user *buf, size_t count, loff_t * ppos)
         struct sg_header *old_hdr = NULL;
         int retval = 0;
 
+        /*
+         * This could cause a response to be stranded. Close the associated
+         * file descriptor to free up any resources being held.
+         */
+        retval = sg_check_file_access(filp, __func__);
+        if (retval)
+                return retval;
+
         if ((!(sfp = (Sg_fd *) filp->private_data)) || (!(sdp = sfp->parentdp)))
                 return -ENXIO;
         SCSI_LOG_TIMEOUT(3, sg_printk(KERN_INFO, sdp,
@@ -580,9 +616,11 @@ sg_write(struct file *filp, const char __user *buf, size_t count, loff_t * ppos)
         struct sg_header old_hdr;
         sg_io_hdr_t *hp;
         unsigned char cmnd[SG_MAX_CDB_SIZE];
+        int retval;
 
-        if (unlikely(uaccess_kernel()))
-                return -EINVAL;
+        retval = sg_check_file_access(filp, __func__);
+        if (retval)
+                return retval;
 
         if ((!(sfp = (Sg_fd *) filp->private_data)) || (!(sdp = sfp->parentdp)))
                 return -ENXIO;
diff --git a/drivers/soc/imx/gpc.c b/drivers/soc/imx/gpc.c
index 32f0748fd067..0097a939487f 100644
--- a/drivers/soc/imx/gpc.c
+++ b/drivers/soc/imx/gpc.c
@@ -27,9 +27,16 @@
 #define GPC_PGC_SW2ISO_SHIFT    0x8
 #define GPC_PGC_SW_SHIFT        0x0
 
+#define GPC_PGC_PCI_PDN         0x200
+#define GPC_PGC_PCI_SR          0x20c
+
 #define GPC_PGC_GPU_PDN         0x260
 #define GPC_PGC_GPU_PUPSCR      0x264
 #define GPC_PGC_GPU_PDNSCR      0x268
+#define GPC_PGC_GPU_SR          0x26c
+
+#define GPC_PGC_DISP_PDN        0x240
+#define GPC_PGC_DISP_SR         0x24c
 
 #define GPU_VPU_PUP_REQ         BIT(1)
 #define GPU_VPU_PDN_REQ         BIT(0)
@@ -318,10 +325,24 @@ static const struct of_device_id imx_gpc_dt_ids[] = {
         { }
 };
 
+static const struct regmap_range yes_ranges[] = {
+        regmap_reg_range(GPC_CNTR, GPC_CNTR),
+        regmap_reg_range(GPC_PGC_PCI_PDN, GPC_PGC_PCI_SR),
+        regmap_reg_range(GPC_PGC_GPU_PDN, GPC_PGC_GPU_SR),
+        regmap_reg_range(GPC_PGC_DISP_PDN, GPC_PGC_DISP_SR),
+};
+
+static const struct regmap_access_table access_table = {
+        .yes_ranges     = yes_ranges,
+        .n_yes_ranges   = ARRAY_SIZE(yes_ranges),
+};
+
 static const struct regmap_config imx_gpc_regmap_config = {
         .reg_bits = 32,
         .val_bits = 32,
         .reg_stride = 4,
+        .rd_table = &access_table,
+        .wr_table = &access_table,
         .max_register = 0x2ac,
 };
 
diff --git a/drivers/staging/ks7010/ks_hostif.c b/drivers/staging/ks7010/ks_hostif.c
index 0ecffab52ec2..abdaf7cf8162 100644
--- a/drivers/staging/ks7010/ks_hostif.c
+++ b/drivers/staging/ks7010/ks_hostif.c
@@ -1842,15 +1842,15 @@ void hostif_sme_multicast_set(struct ks_wlan_private *priv)
         memset(set_address, 0, NIC_MAX_MCAST_LIST * ETH_ALEN);
 
         if (dev->flags & IFF_PROMISC) {
-                hostif_mib_set_request_bool(priv, LOCAL_MULTICAST_FILTER,
-                                            MCAST_FILTER_PROMISC);
+                hostif_mib_set_request_int(priv, LOCAL_MULTICAST_FILTER,
+                                           MCAST_FILTER_PROMISC);
                 goto spin_unlock;
         }
 
         if ((netdev_mc_count(dev) > NIC_MAX_MCAST_LIST) ||
             (dev->flags & IFF_ALLMULTI)) {
-                hostif_mib_set_request_bool(priv, LOCAL_MULTICAST_FILTER,
-                                            MCAST_FILTER_MCASTALL);
+                hostif_mib_set_request_int(priv, LOCAL_MULTICAST_FILTER,
+                                           MCAST_FILTER_MCASTALL);
                 goto spin_unlock;
         }
 
@@ -1866,8 +1866,8 @@ void hostif_sme_multicast_set(struct ks_wlan_private *priv)
                                                ETH_ALEN * mc_count);
         } else {
                 priv->sme_i.sme_flag |= SME_MULTICAST;
-                hostif_mib_set_request_bool(priv, LOCAL_MULTICAST_FILTER,
-                                            MCAST_FILTER_MCAST);
+                hostif_mib_set_request_int(priv, LOCAL_MULTICAST_FILTER,
+                                           MCAST_FILTER_MCAST);
         }
 
 spin_unlock:
diff --git a/drivers/staging/media/omap4iss/iss_video.c b/drivers/staging/media/omap4iss/iss_video.c
index a3a83424a926..16478fe9e3f8 100644
--- a/drivers/staging/media/omap4iss/iss_video.c
+++ b/drivers/staging/media/omap4iss/iss_video.c
@@ -11,7 +11,6 @@
  * (at your option) any later version.
  */
 
-#include <asm/cacheflush.h>
 #include <linux/clk.h>
 #include <linux/mm.h>
 #include <linux/pagemap.h>
@@ -24,6 +23,8 @@
 #include <media/v4l2-ioctl.h>
 #include <media/v4l2-mc.h>
 
+#include <asm/cacheflush.h>
+
 #include "iss_video.h"
 #include "iss.h"
 
diff --git a/drivers/staging/rtl8188eu/Kconfig b/drivers/staging/rtl8188eu/Kconfig
index 673fdce25530..ff7832798a77 100644
--- a/drivers/staging/rtl8188eu/Kconfig
+++ b/drivers/staging/rtl8188eu/Kconfig
@@ -7,7 +7,6 @@ config R8188EU
         select LIB80211
         select LIB80211_CRYPT_WEP
         select LIB80211_CRYPT_CCMP
-        select LIB80211_CRYPT_TKIP
         ---help---
         This option adds the Realtek RTL8188EU USB device such as TP-Link TL-WN725N.
         If built as a module, it will be called r8188eu.
diff --git a/drivers/staging/rtl8188eu/core/rtw_recv.c b/drivers/staging/rtl8188eu/core/rtw_recv.c
index 05936a45eb93..c6857a5be12a 100644
--- a/drivers/staging/rtl8188eu/core/rtw_recv.c
+++ b/drivers/staging/rtl8188eu/core/rtw_recv.c
@@ -23,7 +23,6 @@
 #include <mon.h>
 #include <wifi.h>
 #include <linux/vmalloc.h>
-#include <net/lib80211.h>
 
 #define ETHERNET_HEADER_SIZE    14      /*  Ethernet Header Length */
 #define LLC_HEADER_SIZE                 6       /*  LLC Header Length */
@@ -221,20 +220,31 @@ u32 rtw_free_uc_swdec_pending_queue(struct adapter *adapter)
 static int recvframe_chkmic(struct adapter *adapter,
                             struct recv_frame *precvframe)
 {
-        int res = _SUCCESS;
-        struct rx_pkt_attrib *prxattrib = &precvframe->attrib;
-        struct sta_info *stainfo = rtw_get_stainfo(&adapter->stapriv, prxattrib->ta);
+        int     i, res = _SUCCESS;
+        u32     datalen;
+        u8      miccode[8];
+        u8      bmic_err = false, brpt_micerror = true;
+        u8      *pframe, *payload, *pframemic;
+        u8      *mickey;
+        struct  sta_info                *stainfo;
+        struct  rx_pkt_attrib   *prxattrib = &precvframe->attrib;
+        struct  security_priv   *psecuritypriv = &adapter->securitypriv;
+
+        struct mlme_ext_priv    *pmlmeext = &adapter->mlmeextpriv;
+        struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
+
+        stainfo = rtw_get_stainfo(&adapter->stapriv, &prxattrib->ta[0]);
 
         if (prxattrib->encrypt == _TKIP_) {
+                RT_TRACE(_module_rtl871x_recv_c_, _drv_info_,
+                         ("\n %s: prxattrib->encrypt==_TKIP_\n", __func__));
+                RT_TRACE(_module_rtl871x_recv_c_, _drv_info_,
+                         ("\n %s: da=0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x\n",
+                          __func__, prxattrib->ra[0], prxattrib->ra[1], prxattrib->ra[2],
+                          prxattrib->ra[3], prxattrib->ra[4], prxattrib->ra[5]));
+
+                /* calculate mic code */
                 if (stainfo) {
-                        int key_idx;
-                        const int iv_len = 8, icv_len = 4, key_length = 32;
-                        struct sk_buff *skb = precvframe->pkt;
-                        u8 key[32], iv[8], icv[4], *pframe = skb->data;
-                        void *crypto_private = NULL;
-                        struct lib80211_crypto_ops *crypto_ops = try_then_request_module(lib80211_get_crypto_ops("TKIP"), "lib80211_crypt_tkip");
-                        struct security_priv *psecuritypriv = &adapter->securitypriv;
-
                         if (IS_MCAST(prxattrib->ra)) {
                                 if (!psecuritypriv) {
                                         res = _FAIL;
@@ -243,58 +253,115 @@ static int recvframe_chkmic(struct adapter *adapter,
                                         DBG_88E("\n %s: didn't install group key!!!!!!!!!!\n", __func__);
                                         goto exit;
                                 }
-                                key_idx = prxattrib->key_index;
-                                memcpy(key, psecuritypriv->dot118021XGrpKey[key_idx].skey, 16);
-                                memcpy(key + 16, psecuritypriv->dot118021XGrprxmickey[key_idx].skey, 16);
+                                mickey = &psecuritypriv->dot118021XGrprxmickey[prxattrib->key_index].skey[0];
+
+                                RT_TRACE(_module_rtl871x_recv_c_, _drv_info_,
+                                         ("\n %s: bcmc key\n", __func__));
                         } else {
-                                key_idx = 0;
-                                memcpy(key, stainfo->dot118021x_UncstKey.skey, 16);
-                                memcpy(key + 16, stainfo->dot11tkiprxmickey.skey, 16);
+                                mickey = &stainfo->dot11tkiprxmickey.skey[0];
+                                RT_TRACE(_module_rtl871x_recv_c_, _drv_err_,
+                                         ("\n %s: unicast key\n", __func__));
                         }
 
-                        if (!crypto_ops) {
-                                res = _FAIL;
-                                goto exit_lib80211_tkip;
-                        }
+                        /* icv_len included the mic code */
+                        datalen = precvframe->pkt->len-prxattrib->hdrlen -
+                                  prxattrib->iv_len-prxattrib->icv_len-8;
+                        pframe = precvframe->pkt->data;
+                        payload = pframe+prxattrib->hdrlen+prxattrib->iv_len;
 
-                        memcpy(iv, pframe + prxattrib->hdrlen, iv_len);
-                        memcpy(icv, pframe + skb->len - icv_len, icv_len);
-                        memmove(pframe + iv_len, pframe, prxattrib->hdrlen);
+                        RT_TRACE(_module_rtl871x_recv_c_, _drv_info_, ("\n prxattrib->iv_len=%d prxattrib->icv_len=%d\n", prxattrib->iv_len, prxattrib->icv_len));
+                        rtw_seccalctkipmic(mickey, pframe, payload, datalen, &miccode[0],
+                                           (unsigned char)prxattrib->priority); /* care the length of the data */
 
-                        skb_pull(skb, iv_len);
-                        skb_trim(skb, skb->len - icv_len);
+                        pframemic = payload+datalen;
 
-                        crypto_private = crypto_ops->init(key_idx);
-                        if (!crypto_private) {
-                                res = _FAIL;
-                                goto exit_lib80211_tkip;
-                        }
-                        if (crypto_ops->set_key(key, key_length, NULL, crypto_private) < 0) {
-                                res = _FAIL;
-                                goto exit_lib80211_tkip;
-                        }
-                        if (crypto_ops->decrypt_msdu(skb, key_idx, prxattrib->hdrlen, crypto_private)) {
-                                res = _FAIL;
-                                goto exit_lib80211_tkip;
+                        bmic_err = false;
+
+                        for (i = 0; i < 8; i++) {
+                                if (miccode[i] != *(pframemic+i)) {
+                                        RT_TRACE(_module_rtl871x_recv_c_, _drv_err_,
+                                                 ("%s: miccode[%d](%02x)!=*(pframemic+%d)(%02x) ",
+                                                  __func__, i, miccode[i], i, *(pframemic + i)));
+                                        bmic_err = true;
+                                }
                         }
 
-                        memmove(pframe, pframe + iv_len, prxattrib->hdrlen);
-                        skb_push(skb, iv_len);
-                        skb_put(skb, icv_len);
+                        if (bmic_err) {
+                                RT_TRACE(_module_rtl871x_recv_c_, _drv_err_,
+                                         ("\n *(pframemic-8)-*(pframemic-1)=0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x\n",
+                                         *(pframemic-8), *(pframemic-7), *(pframemic-6),
+                                         *(pframemic-5), *(pframemic-4), *(pframemic-3),
+                                         *(pframemic-2), *(pframemic-1)));
+                                RT_TRACE(_module_rtl871x_recv_c_, _drv_err_,
+                                         ("\n *(pframemic-16)-*(pframemic-9)=0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x\n",
+                                         *(pframemic-16), *(pframemic-15), *(pframemic-14),
+                                         *(pframemic-13), *(pframemic-12), *(pframemic-11),
+                                         *(pframemic-10), *(pframemic-9)));
+                                {
+                                        uint i;
 
-                        memcpy(pframe + prxattrib->hdrlen, iv, iv_len);
-                        memcpy(pframe + skb->len - icv_len, icv, icv_len);
+                                        RT_TRACE(_module_rtl871x_recv_c_, _drv_err_,
+                                                 ("\n ======demp packet (len=%d)======\n",
+                                                 precvframe->pkt->len));
+                                        for (i = 0; i < precvframe->pkt->len; i += 8) {
+                                                RT_TRACE(_module_rtl871x_recv_c_,
+                                                         _drv_err_,
+                                                         ("0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x",
+                                                         *(precvframe->pkt->data+i),
+                                                         *(precvframe->pkt->data+i+1),
+                                                         *(precvframe->pkt->data+i+2),
+                                                         *(precvframe->pkt->data+i+3),
+                                                         *(precvframe->pkt->data+i+4),
+                                                         *(precvframe->pkt->data+i+5),
+                                                         *(precvframe->pkt->data+i+6),
+                                                         *(precvframe->pkt->data+i+7)));
+                                        }
+                                        RT_TRACE(_module_rtl871x_recv_c_,
+                                                 _drv_err_,
+                                                 ("\n ====== demp packet end [len=%d]======\n",
+                                                 precvframe->pkt->len));
+                                        RT_TRACE(_module_rtl871x_recv_c_,
+                                                 _drv_err_,
+                                                 ("\n hrdlen=%d,\n",
+                                                 prxattrib->hdrlen));
+                                }
 
-exit_lib80211_tkip:
-                        if (crypto_ops && crypto_private)
-                                crypto_ops->deinit(crypto_private);
+                                RT_TRACE(_module_rtl871x_recv_c_, _drv_err_,
+                                         ("ra=0x%.2x 0x%.2x 0x%.2x 0x%.2x 0x%.2x 0x%.2x psecuritypriv->binstallGrpkey=%d ",
+                                         prxattrib->ra[0], prxattrib->ra[1], prxattrib->ra[2],
+                                         prxattrib->ra[3], prxattrib->ra[4], prxattrib->ra[5], psecuritypriv->binstallGrpkey));
+
+                                /*  double check key_index for some timing issue , */
+                                /*  cannot compare with psecuritypriv->dot118021XGrpKeyid also cause timing issue */
+                                if ((IS_MCAST(prxattrib->ra) == true)  && (prxattrib->key_index != pmlmeinfo->key_index))
+                                        brpt_micerror = false;
+
+                                if ((prxattrib->bdecrypted) && (brpt_micerror)) {
+                                        rtw_handle_tkip_mic_err(adapter, (u8)IS_MCAST(prxattrib->ra));
+                                        RT_TRACE(_module_rtl871x_recv_c_, _drv_err_, (" mic error :prxattrib->bdecrypted=%d ", prxattrib->bdecrypted));
+                                        DBG_88E(" mic error :prxattrib->bdecrypted=%d\n", prxattrib->bdecrypted);
+                                } else {
+                                        RT_TRACE(_module_rtl871x_recv_c_, _drv_err_, (" mic error :prxattrib->bdecrypted=%d ", prxattrib->bdecrypted));
+                                        DBG_88E(" mic error :prxattrib->bdecrypted=%d\n", prxattrib->bdecrypted);
+                                }
+                                res = _FAIL;
+                        } else {
+                                /* mic checked ok */
+                                if ((!psecuritypriv->bcheck_grpkey) && (IS_MCAST(prxattrib->ra))) {
+                                        psecuritypriv->bcheck_grpkey = true;
+                                        RT_TRACE(_module_rtl871x_recv_c_, _drv_err_, ("psecuritypriv->bcheck_grpkey = true"));
+                                }
+                        }
                 } else {
                         RT_TRACE(_module_rtl871x_recv_c_, _drv_err_,
                                  ("%s: rtw_get_stainfo==NULL!!!\n", __func__));
                 }
+
+                skb_trim(precvframe->pkt, precvframe->pkt->len - 8);
         }
 
 exit:
+
         return res;
 }
 
diff --git a/drivers/staging/rtl8188eu/core/rtw_security.c b/drivers/staging/rtl8188eu/core/rtw_security.c
index bfe0b217e679..67a2490f055e 100644
--- a/drivers/staging/rtl8188eu/core/rtw_security.c
+++ b/drivers/staging/rtl8188eu/core/rtw_security.c
@@ -650,71 +650,71 @@ u32	rtw_tkip_encrypt(struct adapter *padapter, u8 *pxmitframe)
         return res;
 }
 
+/* The hlen isn't include the IV */
 u32 rtw_tkip_decrypt(struct adapter *padapter, u8 *precvframe)
-{
-        struct rx_pkt_attrib *prxattrib = &((struct recv_frame *)precvframe)->attrib;
-        u32 res = _SUCCESS;
+{                                                                                                                                       /*  exclude ICV */
+        u16 pnl;
+        u32 pnh;
+        u8   rc4key[16];
+        u8   ttkey[16];
+        u8      crc[4];
+        struct arc4context mycontext;
+        int                     length;
+
+        u8      *pframe, *payload, *iv, *prwskey;
+        union pn48 dot11txpn;
+        struct  sta_info                *stainfo;
+        struct  rx_pkt_attrib    *prxattrib = &((struct recv_frame *)precvframe)->attrib;
+        struct  security_priv   *psecuritypriv = &padapter->securitypriv;
+        u32             res = _SUCCESS;
+
+
+        pframe = (unsigned char *)((struct recv_frame *)precvframe)->pkt->data;
 
         /* 4 start to decrypt recvframe */
         if (prxattrib->encrypt == _TKIP_) {
-                struct sta_info *stainfo = rtw_get_stainfo(&padapter->stapriv, prxattrib->ta);
-
+                stainfo = rtw_get_stainfo(&padapter->stapriv, &prxattrib->ta[0]);
                 if (stainfo) {
-                        int key_idx;
-                        const int iv_len = 8, icv_len = 4, key_length = 32;
-                        void *crypto_private = NULL;
-                        struct sk_buff *skb = ((struct recv_frame *)precvframe)->pkt;
-                        u8 key[32], iv[8], icv[4], *pframe = skb->data;
-                        struct lib80211_crypto_ops *crypto_ops = try_then_request_module(lib80211_get_crypto_ops("TKIP"), "lib80211_crypt_tkip");
-                        struct security_priv *psecuritypriv = &padapter->securitypriv;
-
                         if (IS_MCAST(prxattrib->ra)) {
                                 if (!psecuritypriv->binstallGrpkey) {
                                         res = _FAIL;
                                         DBG_88E("%s:rx bc/mc packets, but didn't install group key!!!!!!!!!!\n", __func__);
                                         goto exit;
                                 }
-                                key_idx = prxattrib->key_index;
-                                memcpy(key, psecuritypriv->dot118021XGrpKey[key_idx].skey, 16);
-                                memcpy(key + 16, psecuritypriv->dot118021XGrprxmickey[key_idx].skey, 16);
+                                prwskey = psecuritypriv->dot118021XGrpKey[prxattrib->key_index].skey;
                         } else {
-                                key_idx = 0;
-                                memcpy(key, stainfo->dot118021x_UncstKey.skey, 16);
-                                memcpy(key + 16, stainfo->dot11tkiprxmickey.skey, 16);
+                                RT_TRACE(_module_rtl871x_security_c_, _drv_err_, ("%s: stainfo!= NULL!!!\n", __func__));
+                                prwskey = &stainfo->dot118021x_UncstKey.skey[0];
                         }
 
-                        if (!crypto_ops) {
-                                res = _FAIL;
-                                goto exit_lib80211_tkip;
-                        }
+                        iv = pframe+prxattrib->hdrlen;
+                        payload = pframe+prxattrib->iv_len+prxattrib->hdrlen;
+                        length = ((struct recv_frame *)precvframe)->pkt->len-prxattrib->hdrlen-prxattrib->iv_len;
 
-                        memcpy(iv, pframe + prxattrib->hdrlen, iv_len);
-                        memcpy(icv, pframe + skb->len - icv_len, icv_len);
+                        GET_TKIP_PN(iv, dot11txpn);
 
-                        crypto_private = crypto_ops->init(key_idx);
-                        if (!crypto_private) {
-                                res = _FAIL;
-                                goto exit_lib80211_tkip;
-                        }
-                        if (crypto_ops->set_key(key, key_length, NULL, crypto_private) < 0) {
-                                res = _FAIL;
-                                goto exit_lib80211_tkip;
-                        }
-                        if (crypto_ops->decrypt_mpdu(skb, prxattrib->hdrlen, crypto_private)) {
-                                res = _FAIL;
-                                goto exit_lib80211_tkip;
-                        }
+                        pnl = (u16)(dot11txpn.val);
+                        pnh = (u32)(dot11txpn.val>>16);
 
-                        memmove(pframe, pframe + iv_len, prxattrib->hdrlen);
-                        skb_push(skb, iv_len);
-                        skb_put(skb, icv_len);
+                        phase1((u16 *)&ttkey[0], prwskey, &prxattrib->ta[0], pnh);
+                        phase2(&rc4key[0], prwskey, (unsigned short *)&ttkey[0], pnl);
 
-                        memcpy(pframe + prxattrib->hdrlen, iv, iv_len);
-                        memcpy(pframe + skb->len - icv_len, icv, icv_len);
+                        /* 4 decrypt payload include icv */
 
-exit_lib80211_tkip:
-                        if (crypto_ops && crypto_private)
-                                crypto_ops->deinit(crypto_private);
+                        arcfour_init(&mycontext, rc4key, 16);
+                        arcfour_encrypt(&mycontext, payload, payload, length);
+
+                        *((__le32 *)crc) = getcrc32(payload, length-4);
+
+                        if (crc[3] != payload[length-1] ||
+                            crc[2] != payload[length-2] ||
+                            crc[1] != payload[length-3] ||
+                            crc[0] != payload[length-4]) {
+                                RT_TRACE(_module_rtl871x_security_c_, _drv_err_,
+                                         ("rtw_wep_decrypt:icv error crc (%4ph)!=payload (%4ph)\n",
+                                         &crc, &payload[length-4]));
+                                res = _FAIL;
+                        }
                 } else {
                         RT_TRACE(_module_rtl871x_security_c_, _drv_err_, ("rtw_tkip_decrypt: stainfo==NULL!!!\n"));
                         res = _FAIL;
diff --git a/drivers/staging/rtl8723bs/core/rtw_ap.c b/drivers/staging/rtl8723bs/core/rtw_ap.c
index 45c05527a57a..faf4b4158cfa 100644
--- a/drivers/staging/rtl8723bs/core/rtw_ap.c
+++ b/drivers/staging/rtl8723bs/core/rtw_ap.c
@@ -1051,7 +1051,7 @@ int rtw_check_beacon_data(struct adapter *padapter, u8 *pbuf,  int len)
                 return _FAIL;
 
 
-        if (len > MAX_IE_SZ)
+        if (len < 0 || len > MAX_IE_SZ)
                 return _FAIL;
 
         pbss_network->IELength = len;
diff --git a/drivers/staging/rtlwifi/rtl8822be/hw.c b/drivers/staging/rtlwifi/rtl8822be/hw.c
index 7947edb239a1..88ba5b2fea6a 100644
--- a/drivers/staging/rtlwifi/rtl8822be/hw.c
+++ b/drivers/staging/rtlwifi/rtl8822be/hw.c
@@ -803,7 +803,7 @@ static void _rtl8822be_enable_aspm_back_door(struct ieee80211_hw *hw)
                 return;
 
         pci_read_config_byte(rtlpci->pdev, 0x70f, &tmp);
-        pci_write_config_byte(rtlpci->pdev, 0x70f, tmp | BIT(7));
+        pci_write_config_byte(rtlpci->pdev, 0x70f, tmp | ASPM_L1_LATENCY << 3);
 
         pci_read_config_byte(rtlpci->pdev, 0x719, &tmp);
         pci_write_config_byte(rtlpci->pdev, 0x719, tmp | BIT(3) | BIT(4));
diff --git a/drivers/staging/rtlwifi/wifi.h b/drivers/staging/rtlwifi/wifi.h
index 012fb618840b..a45f0eb69d3f 100644
--- a/drivers/staging/rtlwifi/wifi.h
+++ b/drivers/staging/rtlwifi/wifi.h
@@ -88,6 +88,7 @@
 #define RTL_USB_MAX_RX_COUNT                    100
 #define QBSS_LOAD_SIZE                          5
 #define MAX_WMMELE_LENGTH                       64
+#define ASPM_L1_LATENCY                         7
 
 #define TOTAL_CAM_ENTRY                         32
 
diff --git a/drivers/staging/speakup/speakup_soft.c b/drivers/staging/speakup/speakup_soft.c
index a61bc41b82d7..947c79532e10 100644
--- a/drivers/staging/speakup/speakup_soft.c
+++ b/drivers/staging/speakup/speakup_soft.c
@@ -198,11 +198,15 @@ static ssize_t softsynthx_read(struct file *fp, char __user *buf, size_t count,
         int chars_sent = 0;
         char __user *cp;
         char *init;
+        size_t bytes_per_ch = unicode ? 3 : 1;
         u16 ch;
         int empty;
         unsigned long flags;
         DEFINE_WAIT(wait);
 
+        if (count < bytes_per_ch)
+                return -EINVAL;
+
         spin_lock_irqsave(&speakup_info.spinlock, flags);
         while (1) {
                 prepare_to_wait(&speakup_event, &wait, TASK_INTERRUPTIBLE);
@@ -228,7 +232,7 @@ static ssize_t softsynthx_read(struct file *fp, char __user *buf, size_t count,
         init = get_initstring();
 
         /* Keep 3 bytes available for a 16bit UTF-8-encoded character */
-        while (chars_sent <= count - 3) {
+        while (chars_sent <= count - bytes_per_ch) {
                 if (speakup_info.flushing) {
                         speakup_info.flushing = 0;
                         ch = '\x18';
diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c
index 01ac306131c1..10db5656fd5d 100644
--- a/drivers/target/target_core_pr.c
+++ b/drivers/target/target_core_pr.c
@@ -3727,11 +3727,16 @@ core_scsi3_pri_read_keys(struct se_cmd *cmd)
                  * Check for overflow of 8byte PRI READ_KEYS payload and
                  * next reservation key list descriptor.
                  */
-                if ((add_len + 8) > (cmd->data_length - 8))
-                        break;
-
-                put_unaligned_be64(pr_reg->pr_res_key, &buf[off]);
-                off += 8;
+                if (off + 8 <= cmd->data_length) {
+                        put_unaligned_be64(pr_reg->pr_res_key, &buf[off]);
+                        off += 8;
+                }
+                /*
+                 * SPC5r17: 6.16.2 READ KEYS service action
+                 * The ADDITIONAL LENGTH field indicates the number of bytes in
+                 * the Reservation key list. The contents of the ADDITIONAL
+                 * LENGTH field are not altered based on the allocation length
+                 */
                 add_len += 8;
         }
         spin_unlock(&dev->t10_pr.registration_lock);
diff --git a/drivers/thunderbolt/domain.c b/drivers/thunderbolt/domain.c
index 6281266b8ec0..a923ebdeb73c 100644
--- a/drivers/thunderbolt/domain.c
+++ b/drivers/thunderbolt/domain.c
@@ -213,6 +213,10 @@ static ssize_t boot_acl_store(struct device *dev, struct device_attribute *attr,
                 goto err_free_acl;
         }
         ret = tb->cm_ops->set_boot_acl(tb, acl, tb->nboot_acl);
+        if (!ret) {
+                /* Notify userspace about the change */
+                kobject_uevent(&tb->dev.kobj, KOBJ_CHANGE);
+        }
         mutex_unlock(&tb->lock);
 
 err_free_acl:
diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c
index e8f4ac9400ea..5d421d7e8904 100644
--- a/drivers/uio/uio.c
+++ b/drivers/uio/uio.c
@@ -215,7 +215,20 @@ static ssize_t name_show(struct device *dev,
                          struct device_attribute *attr, char *buf)
 {
         struct uio_device *idev = dev_get_drvdata(dev);
-        return sprintf(buf, "%s\n", idev->info->name);
+        int ret;
+
+        mutex_lock(&idev->info_lock);
+        if (!idev->info) {
+                ret = -EINVAL;
+                dev_err(dev, "the device has been unregistered\n");
+                goto out;
+        }
+
+        ret = sprintf(buf, "%s\n", idev->info->name);
+
+out:
+        mutex_unlock(&idev->info_lock);
+        return ret;
 }
 static DEVICE_ATTR_RO(name);
 
@@ -223,7 +236,20 @@ static ssize_t version_show(struct device *dev,
                             struct device_attribute *attr, char *buf)
 {
         struct uio_device *idev = dev_get_drvdata(dev);
-        return sprintf(buf, "%s\n", idev->info->version);
+        int ret;
+
+        mutex_lock(&idev->info_lock);
+        if (!idev->info) {
+                ret = -EINVAL;
+                dev_err(dev, "the device has been unregistered\n");
+                goto out;
+        }
+
+        ret = sprintf(buf, "%s\n", idev->info->version);
+
+out:
+        mutex_unlock(&idev->info_lock);
+        return ret;
 }
 static DEVICE_ATTR_RO(version);
 
@@ -415,11 +441,15 @@ EXPORT_SYMBOL_GPL(uio_event_notify);
 static irqreturn_t uio_interrupt(int irq, void *dev_id)
 {
         struct uio_device *idev = (struct uio_device *)dev_id;
-        irqreturn_t ret = idev->info->handler(irq, idev->info);
+        irqreturn_t ret;
 
+        mutex_lock(&idev->info_lock);
+
+        ret = idev->info->handler(irq, idev->info);
         if (ret == IRQ_HANDLED)
                 uio_event_notify(idev->info);
 
+        mutex_unlock(&idev->info_lock);
         return ret;
 }
 
@@ -433,7 +463,6 @@ static int uio_open(struct inode *inode, struct file *filep)
         struct uio_device *idev;
         struct uio_listener *listener;
         int ret = 0;
-        unsigned long flags;
 
         mutex_lock(&minor_lock);
         idev = idr_find(&uio_idr, iminor(inode));
@@ -460,10 +489,16 @@ static int uio_open(struct inode *inode, struct file *filep)
         listener->event_count = atomic_read(&idev->event);
         filep->private_data = listener;
 
-        spin_lock_irqsave(&idev->info_lock, flags);
+        mutex_lock(&idev->info_lock);
+        if (!idev->info) {
+                mutex_unlock(&idev->info_lock);
+                ret = -EINVAL;
+                goto err_alloc_listener;
+        }
+
         if (idev->info && idev->info->open)
                 ret = idev->info->open(idev->info, inode);
-        spin_unlock_irqrestore(&idev->info_lock, flags);
+        mutex_unlock(&idev->info_lock);
         if (ret)
                 goto err_infoopen;
 
@@ -495,12 +530,11 @@ static int uio_release(struct inode *inode, struct file *filep)
         int ret = 0;
         struct uio_listener *listener = filep->private_data;
         struct uio_device *idev = listener->dev;
-        unsigned long flags;
 
-        spin_lock_irqsave(&idev->info_lock, flags);
+        mutex_lock(&idev->info_lock);
         if (idev->info && idev->info->release)
                 ret = idev->info->release(idev->info, inode);
-        spin_unlock_irqrestore(&idev->info_lock, flags);
+        mutex_unlock(&idev->info_lock);
 
         module_put(idev->owner);
         kfree(listener);
@@ -513,12 +547,11 @@ static __poll_t uio_poll(struct file *filep, poll_table *wait)
         struct uio_listener *listener = filep->private_data;
         struct uio_device *idev = listener->dev;
         __poll_t ret = 0;
-        unsigned long flags;
 
-        spin_lock_irqsave(&idev->info_lock, flags);
+        mutex_lock(&idev->info_lock);
         if (!idev->info || !idev->info->irq)
                 ret = -EIO;
-        spin_unlock_irqrestore(&idev->info_lock, flags);
+        mutex_unlock(&idev->info_lock);
 
         if (ret)
                 return ret;
@@ -537,12 +570,11 @@ static ssize_t uio_read(struct file *filep, char __user *buf,
         DECLARE_WAITQUEUE(wait, current);
         ssize_t retval = 0;
         s32 event_count;
-        unsigned long flags;
 
-        spin_lock_irqsave(&idev->info_lock, flags);
+        mutex_lock(&idev->info_lock);
         if (!idev->info || !idev->info->irq)
                 retval = -EIO;
-        spin_unlock_irqrestore(&idev->info_lock, flags);
+        mutex_unlock(&idev->info_lock);
 
         if (retval)
                 return retval;
@@ -592,9 +624,13 @@ static ssize_t uio_write(struct file *filep, const char __user *buf,
         struct uio_device *idev = listener->dev;
         ssize_t retval;
         s32 irq_on;
-        unsigned long flags;
 
-        spin_lock_irqsave(&idev->info_lock, flags);
+        mutex_lock(&idev->info_lock);
+        if (!idev->info) {
+                retval = -EINVAL;
+                goto out;
+        }
+
         if (!idev->info || !idev->info->irq) {
                 retval = -EIO;
                 goto out;
@@ -618,7 +654,7 @@ static ssize_t uio_write(struct file *filep, const char __user *buf,
         retval = idev->info->irqcontrol(idev->info, irq_on);
 
 out:
-        spin_unlock_irqrestore(&idev->info_lock, flags);
+        mutex_unlock(&idev->info_lock);
         return retval ? retval : sizeof(s32);
 }
 
@@ -640,10 +676,20 @@ static vm_fault_t uio_vma_fault(struct vm_fault *vmf)
         struct page *page;
         unsigned long offset;
         void *addr;
+        int ret = 0;
+        int mi;
 
-        int mi = uio_find_mem_index(vmf->vma);
-        if (mi < 0)
-                return VM_FAULT_SIGBUS;
+        mutex_lock(&idev->info_lock);
+        if (!idev->info) {
+                ret = VM_FAULT_SIGBUS;
+                goto out;
+        }
+
+        mi = uio_find_mem_index(vmf->vma);
+        if (mi < 0) {
+                ret = VM_FAULT_SIGBUS;
+                goto out;
+        }
 
         /*
          * We need to subtract mi because userspace uses offset = N*PAGE_SIZE
@@ -658,7 +704,11 @@ static vm_fault_t uio_vma_fault(struct vm_fault *vmf)
                 page = vmalloc_to_page(addr);
         get_page(page);
         vmf->page = page;
-        return 0;
+
+out:
+        mutex_unlock(&idev->info_lock);
+
+        return ret;
 }
 
 static const struct vm_operations_struct uio_logical_vm_ops = {
@@ -683,6 +733,7 @@ static int uio_mmap_physical(struct vm_area_struct *vma)
         struct uio_device *idev = vma->vm_private_data;
         int mi = uio_find_mem_index(vma);
         struct uio_mem *mem;
+
         if (mi < 0)
                 return -EINVAL;
         mem = idev->info->mem + mi;
@@ -724,30 +775,46 @@ static int uio_mmap(struct file *filep, struct vm_area_struct *vma)
 
         vma->vm_private_data = idev;
 
+        mutex_lock(&idev->info_lock);
+        if (!idev->info) {
+                ret = -EINVAL;
+                goto out;
+        }
+
         mi = uio_find_mem_index(vma);
-        if (mi < 0)
-                return -EINVAL;
+        if (mi < 0) {
+                ret = -EINVAL;
+                goto out;
+        }
 
         requested_pages = vma_pages(vma);
         actual_pages = ((idev->info->mem[mi].addr & ~PAGE_MASK)
                         + idev->info->mem[mi].size + PAGE_SIZE -1) >> PAGE_SHIFT;
-        if (requested_pages > actual_pages)
-                return -EINVAL;
+        if (requested_pages > actual_pages) {
+                ret = -EINVAL;
+                goto out;
+        }
 
         if (idev->info->mmap) {
                 ret = idev->info->mmap(idev->info, vma);
-                return ret;
+                goto out;
         }
 
         switch (idev->info->mem[mi].memtype) {
                 case UIO_MEM_PHYS:
-                        return uio_mmap_physical(vma);
+                        ret = uio_mmap_physical(vma);
+                        break;
                 case UIO_MEM_LOGICAL:
                 case UIO_MEM_VIRTUAL:
-                        return uio_mmap_logical(vma);
+                        ret = uio_mmap_logical(vma);
+                        break;
                 default:
-                        return -EINVAL;
+                        ret = -EINVAL;
         }
+
+out:
+        mutex_unlock(&idev->info_lock);
+        return 0;
 }
 
 static const struct file_operations uio_fops = {
@@ -865,7 +932,7 @@ int __uio_register_device(struct module *owner,
 
         idev->owner = owner;
         idev->info = info;
-        spin_lock_init(&idev->info_lock);
+        mutex_init(&idev->info_lock);
         init_waitqueue_head(&idev->wait);
         atomic_set(&idev->event, 0);
 
@@ -902,8 +969,9 @@ int __uio_register_device(struct module *owner,
                  * FDs at the time of unregister and therefore may not be
                  * freed until they are released.
                  */
-                ret = request_irq(info->irq, uio_interrupt,
-                                  info->irq_flags, info->name, idev);
+                ret = request_threaded_irq(info->irq, NULL, uio_interrupt,
+                                           info->irq_flags, info->name, idev);
+
                 if (ret)
                         goto err_request_irq;
         }
@@ -928,7 +996,6 @@ EXPORT_SYMBOL_GPL(__uio_register_device);
 void uio_unregister_device(struct uio_info *info)
 {
         struct uio_device *idev;
-        unsigned long flags;
 
         if (!info || !info->uio_dev)
                 return;
@@ -937,14 +1004,14 @@ void uio_unregister_device(struct uio_info *info)
 
         uio_free_minor(idev);
 
+        mutex_lock(&idev->info_lock);
         uio_dev_del_attributes(idev);
 
         if (info->irq && info->irq != UIO_IRQ_CUSTOM)
                 free_irq(info->irq, idev);
 
-        spin_lock_irqsave(&idev->info_lock, flags);
         idev->info = NULL;
-        spin_unlock_irqrestore(&idev->info_lock, flags);
+        mutex_unlock(&idev->info_lock);
 
         device_unregister(&idev->dev);
 
diff --git a/drivers/usb/chipidea/Kconfig b/drivers/usb/chipidea/Kconfig
index 785f0ed037f7..ee34e9046f7e 100644
--- a/drivers/usb/chipidea/Kconfig
+++ b/drivers/usb/chipidea/Kconfig
@@ -3,6 +3,7 @@ config USB_CHIPIDEA
         depends on ((USB_EHCI_HCD && USB_GADGET) || (USB_EHCI_HCD && !USB_GADGET) || (!USB_EHCI_HCD && USB_GADGET)) && HAS_DMA
         select EXTCON
         select RESET_CONTROLLER
+        select USB_ULPI_BUS
         help
           Say Y here if your system has a dual role high speed USB
           controller based on ChipIdea silicon IP. It supports:
@@ -38,12 +39,4 @@ config USB_CHIPIDEA_HOST
         help
           Say Y here to enable host controller functionality of the
           ChipIdea driver.
-
-config USB_CHIPIDEA_ULPI
-        bool "ChipIdea ULPI PHY support"
-        depends on USB_ULPI_BUS=y || USB_ULPI_BUS=USB_CHIPIDEA
-        help
-          Say Y here if you have a ULPI PHY attached to your ChipIdea
-          controller.
-
 endif
diff --git a/drivers/usb/chipidea/Makefile b/drivers/usb/chipidea/Makefile
index e3d5e728fa53..12df94f78f72 100644
--- a/drivers/usb/chipidea/Makefile
+++ b/drivers/usb/chipidea/Makefile
@@ -1,11 +1,10 @@
 # SPDX-License-Identifier: GPL-2.0
 obj-$(CONFIG_USB_CHIPIDEA)              += ci_hdrc.o
 
-ci_hdrc-y                               := core.o otg.o debug.o
+ci_hdrc-y                               := core.o otg.o debug.o ulpi.o
 ci_hdrc-$(CONFIG_USB_CHIPIDEA_UDC)      += udc.o
 ci_hdrc-$(CONFIG_USB_CHIPIDEA_HOST)     += host.o
 ci_hdrc-$(CONFIG_USB_OTG_FSM)           += otg_fsm.o
-ci_hdrc-$(CONFIG_USB_CHIPIDEA_ULPI)     += ulpi.o
 
 # Glue/Bridge layers go here
 
diff --git a/drivers/usb/chipidea/ci.h b/drivers/usb/chipidea/ci.h
index 0bf244d50544..6a2cc5cd0281 100644
--- a/drivers/usb/chipidea/ci.h
+++ b/drivers/usb/chipidea/ci.h
@@ -240,10 +240,8 @@ struct ci_hdrc {
 
         struct ci_hdrc_platform_data    *platdata;
         int                             vbus_active;
-#ifdef CONFIG_USB_CHIPIDEA_ULPI
         struct ulpi                     *ulpi;
         struct ulpi_ops                 ulpi_ops;
-#endif
         struct phy                      *phy;
         /* old usb_phy interface */
         struct usb_phy                  *usb_phy;
@@ -426,15 +424,9 @@ static inline bool ci_otg_is_fsm_mode(struct ci_hdrc *ci)
 #endif
 }
 
-#if IS_ENABLED(CONFIG_USB_CHIPIDEA_ULPI)
 int ci_ulpi_init(struct ci_hdrc *ci);
 void ci_ulpi_exit(struct ci_hdrc *ci);
 int ci_ulpi_resume(struct ci_hdrc *ci);
-#else
-static inline int ci_ulpi_init(struct ci_hdrc *ci) { return 0; }
-static inline void ci_ulpi_exit(struct ci_hdrc *ci) { }
-static inline int ci_ulpi_resume(struct ci_hdrc *ci) { return 0; }
-#endif
 
 u32 hw_read_intr_enable(struct ci_hdrc *ci);
 
diff --git a/drivers/usb/chipidea/ulpi.c b/drivers/usb/chipidea/ulpi.c
index 6da42dcd2888..dfec07e8ae1d 100644
--- a/drivers/usb/chipidea/ulpi.c
+++ b/drivers/usb/chipidea/ulpi.c
@@ -95,6 +95,9 @@ int ci_ulpi_resume(struct ci_hdrc *ci)
 {
         int cnt = 100000;
 
+        if (ci->platdata->phy_mode != USBPHY_INTERFACE_MODE_ULPI)
+                return 0;
+
         while (cnt-- > 0) {
                 if (hw_read(ci, OP_ULPI_VIEWPORT, ULPI_SYNC_STATE))
                         return 0;
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 998b32d0167e..75c4623ad779 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1831,6 +1831,9 @@ static const struct usb_device_id acm_ids[] = {
         { USB_DEVICE(0x09d8, 0x0320), /* Elatec GmbH TWN3 */
         .driver_info = NO_UNION_NORMAL, /* has misplaced union descriptor */
         },
+        { USB_DEVICE(0x0ca6, 0xa050), /* Castles VEGA3000 */
+        .driver_info = NO_UNION_NORMAL, /* reports zero length descriptor */
+        },
 
         { USB_DEVICE(0x2912, 0x0001), /* ATOL FPrint */
         .driver_info = CLEAR_HALT_CONDITIONS,
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index fcae521df29b..1fb266809966 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -1142,10 +1142,14 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
 
                 if (!udev || udev->state == USB_STATE_NOTATTACHED) {
                         /* Tell hub_wq to disconnect the device or
-                         * check for a new connection
+                         * check for a new connection or over current condition.
+                         * Based on USB2.0 Spec Section 11.12.5,
+                         * C_PORT_OVER_CURRENT could be set while
+                         * PORT_OVER_CURRENT is not. So check for any of them.
                          */
                         if (udev || (portstatus & USB_PORT_STAT_CONNECTION) ||
-                            (portstatus & USB_PORT_STAT_OVERCURRENT))
+                            (portstatus & USB_PORT_STAT_OVERCURRENT) ||
+                            (portchange & USB_PORT_STAT_C_OVERCURRENT))
                                 set_bit(port1, hub->change_bits);
 
                 } else if (portstatus & USB_PORT_STAT_ENABLE) {
diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index c55def2f1320..097057d2eacf 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -378,6 +378,10 @@ static const struct usb_device_id usb_quirk_list[] = {
         /* Corsair K70 RGB */
         { USB_DEVICE(0x1b1c, 0x1b13), .driver_info = USB_QUIRK_DELAY_INIT },
 
+        /* Corsair Strafe */
+        { USB_DEVICE(0x1b1c, 0x1b15), .driver_info = USB_QUIRK_DELAY_INIT |
+          USB_QUIRK_DELAY_CTRL_MSG },
+
         /* Corsair Strafe RGB */
         { USB_DEVICE(0x1b1c, 0x1b20), .driver_info = USB_QUIRK_DELAY_INIT |
           USB_QUIRK_DELAY_CTRL_MSG },
diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
index a0f82cca2d9a..cefc99ae69b2 100644
--- a/drivers/usb/dwc2/gadget.c
+++ b/drivers/usb/dwc2/gadget.c
@@ -3430,7 +3430,7 @@ static void dwc2_gadget_handle_incomplete_isoc_in(struct dwc2_hsotg *hsotg)
         for (idx = 1; idx < hsotg->num_of_eps; idx++) {
                 hs_ep = hsotg->eps_in[idx];
                 /* Proceed only unmasked ISOC EPs */
-                if (!hs_ep->isochronous || (BIT(idx) & ~daintmsk))
+                if ((BIT(idx) & ~daintmsk) || !hs_ep->isochronous)
                         continue;
 
                 epctrl = dwc2_readl(hsotg->regs + DIEPCTL(idx));
@@ -3476,7 +3476,7 @@ static void dwc2_gadget_handle_incomplete_isoc_out(struct dwc2_hsotg *hsotg)
         for (idx = 1; idx < hsotg->num_of_eps; idx++) {
                 hs_ep = hsotg->eps_out[idx];
                 /* Proceed only unmasked ISOC EPs */
-                if (!hs_ep->isochronous || (BIT(idx) & ~daintmsk))
+                if ((BIT(idx) & ~daintmsk) || !hs_ep->isochronous)
                         continue;
 
                 epctrl = dwc2_readl(hsotg->regs + DOEPCTL(idx));
@@ -3650,7 +3650,7 @@ irq_retry:
                 for (idx = 1; idx < hsotg->num_of_eps; idx++) {
                         hs_ep = hsotg->eps_out[idx];
                         /* Proceed only unmasked ISOC EPs */
-                        if (!hs_ep->isochronous || (BIT(idx) & ~daintmsk))
+                        if ((BIT(idx) & ~daintmsk) || !hs_ep->isochronous)
                                 continue;
 
                         epctrl = dwc2_readl(hsotg->regs + DOEPCTL(idx));
diff --git a/drivers/usb/dwc2/hcd.c b/drivers/usb/dwc2/hcd.c
index b1104be3429c..6e2cdd7b93d4 100644
--- a/drivers/usb/dwc2/hcd.c
+++ b/drivers/usb/dwc2/hcd.c
@@ -2665,34 +2665,35 @@ static int dwc2_alloc_split_dma_aligned_buf(struct dwc2_hsotg *hsotg,
 
 #define DWC2_USB_DMA_ALIGN 4
 
-struct dma_aligned_buffer {
-        void *kmalloc_ptr;
-        void *old_xfer_buffer;
-        u8 data[0];
-};
-
 static void dwc2_free_dma_aligned_buffer(struct urb *urb)
 {
-        struct dma_aligned_buffer *temp;
+        void *stored_xfer_buffer;
+        size_t length;
 
         if (!(urb->transfer_flags & URB_ALIGNED_TEMP_BUFFER))
                 return;
 
-        temp = container_of(urb->transfer_buffer,
-                            struct dma_aligned_buffer, data);
+        /* Restore urb->transfer_buffer from the end of the allocated area */
+        memcpy(&stored_xfer_buffer, urb->transfer_buffer +
+               urb->transfer_buffer_length, sizeof(urb->transfer_buffer));
 
-        if (usb_urb_dir_in(urb))
-                memcpy(temp->old_xfer_buffer, temp->data,
-                       urb->transfer_buffer_length);
-        urb->transfer_buffer = temp->old_xfer_buffer;
-        kfree(temp->kmalloc_ptr);
+        if (usb_urb_dir_in(urb)) {
+                if (usb_pipeisoc(urb->pipe))
+                        length = urb->transfer_buffer_length;
+                else
+                        length = urb->actual_length;
+
+                memcpy(stored_xfer_buffer, urb->transfer_buffer, length);
+        }
+        kfree(urb->transfer_buffer);
+        urb->transfer_buffer = stored_xfer_buffer;
 
         urb->transfer_flags &= ~URB_ALIGNED_TEMP_BUFFER;
 }
 
 static int dwc2_alloc_dma_aligned_buffer(struct urb *urb, gfp_t mem_flags)
 {
-        struct dma_aligned_buffer *temp, *kmalloc_ptr;
+        void *kmalloc_ptr;
         size_t kmalloc_size;
 
         if (urb->num_sgs || urb->sg ||
@@ -2700,22 +2701,29 @@ static int dwc2_alloc_dma_aligned_buffer(struct urb *urb, gfp_t mem_flags)
             !((uintptr_t)urb->transfer_buffer & (DWC2_USB_DMA_ALIGN - 1)))
                 return 0;
 
-        /* Allocate a buffer with enough padding for alignment */
+        /*
+         * Allocate a buffer with enough padding for original transfer_buffer
+         * pointer. This allocation is guaranteed to be aligned properly for
+         * DMA
+         */
         kmalloc_size = urb->transfer_buffer_length +
-                sizeof(struct dma_aligned_buffer) + DWC2_USB_DMA_ALIGN - 1;
+                sizeof(urb->transfer_buffer);
 
         kmalloc_ptr = kmalloc(kmalloc_size, mem_flags);
         if (!kmalloc_ptr)
                 return -ENOMEM;
 
-        /* Position our struct dma_aligned_buffer such that data is aligned */
-        temp = PTR_ALIGN(kmalloc_ptr + 1, DWC2_USB_DMA_ALIGN) - 1;
-        temp->kmalloc_ptr = kmalloc_ptr;
-        temp->old_xfer_buffer = urb->transfer_buffer;
+        /*
+         * Position value of original urb->transfer_buffer pointer to the end
+         * of allocation for later referencing
+         */
+        memcpy(kmalloc_ptr + urb->transfer_buffer_length,
+               &urb->transfer_buffer, sizeof(urb->transfer_buffer));
+
         if (usb_urb_dir_out(urb))
-                memcpy(temp->data, urb->transfer_buffer,
+                memcpy(kmalloc_ptr, urb->transfer_buffer,
                        urb->transfer_buffer_length);
-        urb->transfer_buffer = temp->data;
+        urb->transfer_buffer = kmalloc_ptr;
 
         urb->transfer_flags |= URB_ALIGNED_TEMP_BUFFER;
 
diff --git a/drivers/usb/dwc2/hcd_intr.c b/drivers/usb/dwc2/hcd_intr.c
index ed7f05cf4906..8ce10caf3e19 100644
--- a/drivers/usb/dwc2/hcd_intr.c
+++ b/drivers/usb/dwc2/hcd_intr.c
@@ -1231,7 +1231,10 @@ static void dwc2_hc_nak_intr(struct dwc2_hsotg *hsotg,
          * avoid interrupt storms we'll wait before retrying if we've got
          * several NAKs. If we didn't do this we'd retry directly from the
          * interrupt handler and could end up quickly getting another
-         * interrupt (another NAK), which we'd retry.
+         * interrupt (another NAK), which we'd retry. Note that we do not
+         * delay retries for IN parts of control requests, as those are expected
+         * to complete fairly quickly, and if we delay them we risk confusing
+         * the device and cause it issue STALL.
          *
          * Note that in DMA mode software only gets involved to re-send NAKed
          * transfers for split transactions, so we only need to apply this
@@ -1244,7 +1247,9 @@ static void dwc2_hc_nak_intr(struct dwc2_hsotg *hsotg,
                         qtd->error_count = 0;
                 qtd->complete_split = 0;
                 qtd->num_naks++;
-                qtd->qh->want_wait = qtd->num_naks >= DWC2_NAKS_BEFORE_DELAY;
+                qtd->qh->want_wait = qtd->num_naks >= DWC2_NAKS_BEFORE_DELAY &&
+                                !(chan->ep_type == USB_ENDPOINT_XFER_CONTROL &&
+                                  chan->ep_is_in);
                 dwc2_halt_channel(hsotg, chan, qtd, DWC2_HC_XFER_NAK);
                 goto handle_nak_done;
         }
diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c
index c77ff50a88a2..8efde178eef4 100644
--- a/drivers/usb/dwc3/ep0.c
+++ b/drivers/usb/dwc3/ep0.c
@@ -973,15 +973,12 @@ static void __dwc3_ep0_do_control_data(struct dwc3 *dwc,
                 ret = dwc3_ep0_start_trans(dep);
         } else if (IS_ALIGNED(req->request.length, dep->endpoint.maxpacket) &&
                    req->request.length && req->request.zero) {
-                u32     maxpacket;
 
                 ret = usb_gadget_map_request_by_dev(dwc->sysdev,
                                 &req->request, dep->number);
                 if (ret)
                         return;
 
-                maxpacket = dep->endpoint.maxpacket;
-
                 /* prepare normal TRB */
                 dwc3_ep0_prepare_one_trb(dep, req->request.dma,
                                          req->request.length,
diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
index d2fa071c21b1..b8a15840b4ff 100644
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -1819,7 +1819,6 @@ unknown:
                 if (cdev->use_os_string && cdev->os_desc_config &&
                     (ctrl->bRequestType & USB_TYPE_VENDOR) &&
                     ctrl->bRequest == cdev->b_vendor_code) {
-                        struct usb_request              *req;
                         struct usb_configuration        *os_desc_cfg;
                         u8                              *buf;
                         int                             interface;
diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index 33e2030503fa..3ada83d81bda 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -3263,7 +3263,7 @@ static int ffs_func_setup(struct usb_function *f,
         __ffs_event_add(ffs, FUNCTIONFS_SETUP);
         spin_unlock_irqrestore(&ffs->ev.waitq.lock, flags);
 
-        return USB_GADGET_DELAYED_STATUS;
+        return creq->wLength == 0 ? USB_GADGET_DELAYED_STATUS : 0;
 }
 
 static bool ffs_func_req_match(struct usb_function *f,
diff --git a/drivers/usb/gadget/function/f_uac2.c b/drivers/usb/gadget/function/f_uac2.c
index d2dc1f00180b..d582921f7257 100644
--- a/drivers/usb/gadget/function/f_uac2.c
+++ b/drivers/usb/gadget/function/f_uac2.c
@@ -438,14 +438,14 @@ static struct usb_descriptor_header *hs_audio_desc[] = {
 };
 
 struct cntrl_cur_lay3 {
-        __u32   dCUR;
+        __le32  dCUR;
 };
 
 struct cntrl_range_lay3 {
-        __u16   wNumSubRanges;
-        __u32   dMIN;
-        __u32   dMAX;
-        __u32   dRES;
+        __le16  wNumSubRanges;
+        __le32  dMIN;
+        __le32  dMAX;
+        __le32  dRES;
 } __packed;
 
 static void set_ep_max_packet_size(const struct f_uac2_opts *uac2_opts,
@@ -559,13 +559,13 @@ afunc_bind(struct usb_configuration *cfg, struct usb_function *fn)
         agdev->out_ep = usb_ep_autoconfig(gadget, &fs_epout_desc);
         if (!agdev->out_ep) {
                 dev_err(dev, "%s:%d Error!\n", __func__, __LINE__);
-                return ret;
+                return -ENODEV;
         }
 
         agdev->in_ep = usb_ep_autoconfig(gadget, &fs_epin_desc);
         if (!agdev->in_ep) {
                 dev_err(dev, "%s:%d Error!\n", __func__, __LINE__);
-                return ret;
+                return -ENODEV;
         }
 
         agdev->in_ep_maxpsize = max_t(u16,
@@ -703,9 +703,9 @@ in_rq_cur(struct usb_function *fn, const struct usb_ctrlrequest *cr)
                 memset(&c, 0, sizeof(struct cntrl_cur_lay3));
 
                 if (entity_id == USB_IN_CLK_ID)
-                        c.dCUR = p_srate;
+                        c.dCUR = cpu_to_le32(p_srate);
                 else if (entity_id == USB_OUT_CLK_ID)
-                        c.dCUR = c_srate;
+                        c.dCUR = cpu_to_le32(c_srate);
 
                 value = min_t(unsigned, w_length, sizeof c);
                 memcpy(req->buf, &c, value);
@@ -742,15 +742,15 @@ in_rq_range(struct usb_function *fn, const struct usb_ctrlrequest *cr)
 
         if (control_selector == UAC2_CS_CONTROL_SAM_FREQ) {
                 if (entity_id == USB_IN_CLK_ID)
-                        r.dMIN = p_srate;
+                        r.dMIN = cpu_to_le32(p_srate);
                 else if (entity_id == USB_OUT_CLK_ID)
-                        r.dMIN = c_srate;
+                        r.dMIN = cpu_to_le32(c_srate);
                 else
                         return -EOPNOTSUPP;
 
                 r.dMAX = r.dMIN;
                 r.dRES = 0;
-                r.wNumSubRanges = 1;
+                r.wNumSubRanges = cpu_to_le16(1);
 
                 value = min_t(unsigned, w_length, sizeof r);
                 memcpy(req->buf, &r, value);
diff --git a/drivers/usb/gadget/function/u_audio.c b/drivers/usb/gadget/function/u_audio.c
index a72295c953bb..fb5ed97572e5 100644
--- a/drivers/usb/gadget/function/u_audio.c
+++ b/drivers/usb/gadget/function/u_audio.c
@@ -32,9 +32,6 @@ struct uac_req {
 struct uac_rtd_params {
         struct snd_uac_chip *uac; /* parent chip */
         bool ep_enabled; /* if the ep is enabled */
-        /* Size of the ring buffer */
-        size_t dma_bytes;
-        unsigned char *dma_area;
 
         struct snd_pcm_substream *ss;
 
@@ -43,8 +40,6 @@ struct uac_rtd_params {
 
         void *rbuf;
 
-        size_t period_size;
-
         unsigned max_psize;     /* MaxPacketSize of endpoint */
         struct uac_req *ureq;
 
@@ -84,12 +79,12 @@ static const struct snd_pcm_hardware uac_pcm_hardware = {
 static void u_audio_iso_complete(struct usb_ep *ep, struct usb_request *req)
 {
         unsigned pending;
-        unsigned long flags;
+        unsigned long flags, flags2;
         unsigned int hw_ptr;
-        bool update_alsa = false;
         int status = req->status;
         struct uac_req *ur = req->context;
         struct snd_pcm_substream *substream;
+        struct snd_pcm_runtime *runtime;
         struct uac_rtd_params *prm = ur->pp;
         struct snd_uac_chip *uac = prm->uac;
 
@@ -111,6 +106,14 @@ static void u_audio_iso_complete(struct usb_ep *ep, struct usb_request *req)
         if (!substream)
                 goto exit;
 
+        snd_pcm_stream_lock_irqsave(substream, flags2);
+
+        runtime = substream->runtime;
+        if (!runtime || !snd_pcm_running(substream)) {
+                snd_pcm_stream_unlock_irqrestore(substream, flags2);
+                goto exit;
+        }
+
         spin_lock_irqsave(&prm->lock, flags);
 
         if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) {
@@ -137,43 +140,46 @@ static void u_audio_iso_complete(struct usb_ep *ep, struct usb_request *req)
                 req->actual = req->length;
         }
 
-        pending = prm->hw_ptr % prm->period_size;
-        pending += req->actual;
-        if (pending >= prm->period_size)
-                update_alsa = true;
-
         hw_ptr = prm->hw_ptr;
-        prm->hw_ptr = (prm->hw_ptr + req->actual) % prm->dma_bytes;
 
         spin_unlock_irqrestore(&prm->lock, flags);
 
         /* Pack USB load in ALSA ring buffer */
-        pending = prm->dma_bytes - hw_ptr;
+        pending = runtime->dma_bytes - hw_ptr;
 
         if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) {
                 if (unlikely(pending < req->actual)) {
-                        memcpy(req->buf, prm->dma_area + hw_ptr, pending);
-                        memcpy(req->buf + pending, prm->dma_area,
+                        memcpy(req->buf, runtime->dma_area + hw_ptr, pending);
+                        memcpy(req->buf + pending, runtime->dma_area,
                                req->actual - pending);
                 } else {
-                        memcpy(req->buf, prm->dma_area + hw_ptr, req->actual);
+                        memcpy(req->buf, runtime->dma_area + hw_ptr,
+                               req->actual);
                 }
         } else {
                 if (unlikely(pending < req->actual)) {
-                        memcpy(prm->dma_area + hw_ptr, req->buf, pending);
-                        memcpy(prm->dma_area, req->buf + pending,
+                        memcpy(runtime->dma_area + hw_ptr, req->buf, pending);
+                        memcpy(runtime->dma_area, req->buf + pending,
                                req->actual - pending);
                 } else {
-                        memcpy(prm->dma_area + hw_ptr, req->buf, req->actual);
+                        memcpy(runtime->dma_area + hw_ptr, req->buf,
+                               req->actual);
                 }
         }
 
+        spin_lock_irqsave(&prm->lock, flags);
+        /* update hw_ptr after data is copied to memory */
+        prm->hw_ptr = (hw_ptr + req->actual) % runtime->dma_bytes;
+        hw_ptr = prm->hw_ptr;
+        spin_unlock_irqrestore(&prm->lock, flags);
+        snd_pcm_stream_unlock_irqrestore(substream, flags2);
+
+        if ((hw_ptr % snd_pcm_lib_period_bytes(substream)) < req->actual)
+                snd_pcm_period_elapsed(substream);
+
 exit:
         if (usb_ep_queue(ep, req, GFP_ATOMIC))
                 dev_err(uac->card->dev, "%d Error!\n", __LINE__);
-
-        if (update_alsa)
-                snd_pcm_period_elapsed(substream);
 }
 
 static int uac_pcm_trigger(struct snd_pcm_substream *substream, int cmd)
@@ -236,40 +242,12 @@ static snd_pcm_uframes_t uac_pcm_pointer(struct snd_pcm_substream *substream)
 static int uac_pcm_hw_params(struct snd_pcm_substream *substream,
                                struct snd_pcm_hw_params *hw_params)
 {
-        struct snd_uac_chip *uac = snd_pcm_substream_chip(substream);
-        struct uac_rtd_params *prm;
-        int err;
-
-        if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
-                prm = &uac->p_prm;
-        else
-                prm = &uac->c_prm;
-
-        err = snd_pcm_lib_malloc_pages(substream,
+        return snd_pcm_lib_malloc_pages(substream,
                                         params_buffer_bytes(hw_params));
-        if (err >= 0) {
-                prm->dma_bytes = substream->runtime->dma_bytes;
-                prm->dma_area = substream->runtime->dma_area;
-                prm->period_size = params_period_bytes(hw_params);
-        }
-
-        return err;
 }
 
 static int uac_pcm_hw_free(struct snd_pcm_substream *substream)
 {
-        struct snd_uac_chip *uac = snd_pcm_substream_chip(substream);
-        struct uac_rtd_params *prm;
-
-        if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
-                prm = &uac->p_prm;
-        else
-                prm = &uac->c_prm;
-
-        prm->dma_area = NULL;
-        prm->dma_bytes = 0;
-        prm->period_size = 0;
-
         return snd_pcm_lib_free_pages(substream);
 }
 
@@ -595,15 +573,15 @@ int g_audio_setup(struct g_audio *g_audio, const char *pcm_name,
         if (err < 0)
                 goto snd_fail;
 
-        strcpy(pcm->name, pcm_name);
+        strlcpy(pcm->name, pcm_name, sizeof(pcm->name));
         pcm->private_data = uac;
         uac->pcm = pcm;
 
         snd_pcm_set_ops(pcm, SNDRV_PCM_STREAM_PLAYBACK, &uac_pcm_ops);
         snd_pcm_set_ops(pcm, SNDRV_PCM_STREAM_CAPTURE, &uac_pcm_ops);
 
-        strcpy(card->driver, card_name);
-        strcpy(card->shortname, card_name);
+        strlcpy(card->driver, card_name, sizeof(card->driver));
+        strlcpy(card->shortname, card_name, sizeof(card->shortname));
         sprintf(card->longname, "%s %i", card_name, card->dev->id);
 
         snd_pcm_lib_preallocate_pages_for_all(pcm, SNDRV_DMA_TYPE_CONTINUOUS,
diff --git a/drivers/usb/gadget/udc/aspeed-vhub/Kconfig b/drivers/usb/gadget/udc/aspeed-vhub/Kconfig
index f0cdf89b8503..83ba8a2eb6af 100644
--- a/drivers/usb/gadget/udc/aspeed-vhub/Kconfig
+++ b/drivers/usb/gadget/udc/aspeed-vhub/Kconfig
@@ -2,6 +2,7 @@
 config USB_ASPEED_VHUB
         tristate "Aspeed vHub UDC driver"
         depends on ARCH_ASPEED || COMPILE_TEST
+        depends on USB_LIBCOMPOSITE
         help
           USB peripheral controller for the Aspeed AST2500 family
           SoCs supporting the "vHub" functionality and USB2.0
diff --git a/drivers/usb/gadget/udc/aspeed-vhub/ep0.c b/drivers/usb/gadget/udc/aspeed-vhub/ep0.c
index 20ffb03ff6ac..e2927fb083cf 100644
--- a/drivers/usb/gadget/udc/aspeed-vhub/ep0.c
+++ b/drivers/usb/gadget/udc/aspeed-vhub/ep0.c
@@ -108,6 +108,13 @@ void ast_vhub_ep0_handle_setup(struct ast_vhub_ep *ep)
         /* Check our state, cancel pending requests if needed */
         if (ep->ep0.state != ep0_state_token) {
                 EPDBG(ep, "wrong state\n");
+                ast_vhub_nuke(ep, -EIO);
+
+                /*
+                 * Accept the packet regardless, this seems to happen
+                 * when stalling a SETUP packet that has an OUT data
+                 * phase.
+                 */
                 ast_vhub_nuke(ep, 0);
                 goto stall;
         }
@@ -212,6 +219,8 @@ static void ast_vhub_ep0_do_send(struct ast_vhub_ep *ep,
         if (chunk && req->req.buf)
                 memcpy(ep->buf, req->req.buf + req->req.actual, chunk);
 
+        vhub_dma_workaround(ep->buf);
+
         /* Remember chunk size and trigger send */
         reg = VHUB_EP0_SET_TX_LEN(chunk);
         writel(reg, ep->ep0.ctlstat);
@@ -224,7 +233,7 @@ static void ast_vhub_ep0_rx_prime(struct ast_vhub_ep *ep)
         EPVDBG(ep, "rx prime\n");
 
         /* Prime endpoint for receiving data */
-        writel(VHUB_EP0_RX_BUFF_RDY, ep->ep0.ctlstat + AST_VHUB_EP0_CTRL);
+        writel(VHUB_EP0_RX_BUFF_RDY, ep->ep0.ctlstat);
 }
 
 static void ast_vhub_ep0_do_receive(struct ast_vhub_ep *ep, struct ast_vhub_req *req,
diff --git a/drivers/usb/gadget/udc/aspeed-vhub/epn.c b/drivers/usb/gadget/udc/aspeed-vhub/epn.c
index 80c9feac5147..5939eb1e97f2 100644
--- a/drivers/usb/gadget/udc/aspeed-vhub/epn.c
+++ b/drivers/usb/gadget/udc/aspeed-vhub/epn.c
@@ -66,11 +66,16 @@ static void ast_vhub_epn_kick(struct ast_vhub_ep *ep, struct ast_vhub_req *req)
         if (!req->req.dma) {
 
                 /* For IN transfers, copy data over first */
-                if (ep->epn.is_in)
+                if (ep->epn.is_in) {
                         memcpy(ep->buf, req->req.buf + act, chunk);
+                        vhub_dma_workaround(ep->buf);
+                }
                 writel(ep->buf_dma, ep->epn.regs + AST_VHUB_EP_DESC_BASE);
-        } else
+        } else {
+                if (ep->epn.is_in)
+                        vhub_dma_workaround(req->req.buf);
                 writel(req->req.dma + act, ep->epn.regs + AST_VHUB_EP_DESC_BASE);
+        }
 
         /* Start DMA */
         req->active = true;
@@ -161,6 +166,7 @@ static inline unsigned int ast_vhub_count_free_descs(struct ast_vhub_ep *ep)
 static void ast_vhub_epn_kick_desc(struct ast_vhub_ep *ep,
                                    struct ast_vhub_req *req)
 {
+        struct ast_vhub_desc *desc = NULL;
         unsigned int act = req->act_count;
         unsigned int len = req->req.length;
         unsigned int chunk;
@@ -177,7 +183,6 @@ static void ast_vhub_epn_kick_desc(struct ast_vhub_ep *ep,
 
         /* While we can create descriptors */
         while (ast_vhub_count_free_descs(ep) && req->last_desc < 0) {
-                struct ast_vhub_desc *desc;
                 unsigned int d_num;
 
                 /* Grab next free descriptor */
@@ -227,6 +232,9 @@ static void ast_vhub_epn_kick_desc(struct ast_vhub_ep *ep,
                 req->act_count = act = act + chunk;
         }
 
+        if (likely(desc))
+                vhub_dma_workaround(desc);
+
         /* Tell HW about new descriptors */
         writel(VHUB_EP_DMA_SET_CPU_WPTR(ep->epn.d_next),
                ep->epn.regs + AST_VHUB_EP_DESC_STATUS);
diff --git a/drivers/usb/gadget/udc/aspeed-vhub/vhub.h b/drivers/usb/gadget/udc/aspeed-vhub/vhub.h
index 2b040257bc1f..4ed03d33a5a9 100644
--- a/drivers/usb/gadget/udc/aspeed-vhub/vhub.h
+++ b/drivers/usb/gadget/udc/aspeed-vhub/vhub.h
@@ -462,6 +462,39 @@ enum std_req_rc {
 #define DDBG(d, fmt, ...)       do { } while(0)
 #endif
 
+static inline void vhub_dma_workaround(void *addr)
+{
+        /*
+         * This works around a confirmed HW issue with the Aspeed chip.
+         *
+         * The core uses a different bus to memory than the AHB going to
+         * the USB device controller. Due to the latter having a higher
+         * priority than the core for arbitration on that bus, it's
+         * possible for an MMIO to the device, followed by a DMA by the
+         * device from memory to all be performed and services before
+         * a previous store to memory gets completed.
+         *
+         * This the following scenario can happen:
+         *
+         *    - Driver writes to a DMA descriptor (Mbus)
+         *    - Driver writes to the MMIO register to start the DMA (AHB)
+         *    - The gadget sees the second write and sends a read of the
+         *      descriptor to the memory controller (Mbus)
+         *    - The gadget hits memory before the descriptor write
+         *      causing it to read an obsolete value.
+         *
+         * Thankfully the problem is limited to the USB gadget device, other
+         * masters in the SoC all have a lower priority than the core, thus
+         * ensuring that the store by the core arrives first.
+         *
+         * The workaround consists of using a dummy read of the memory before
+         * doing the MMIO writes. This will ensure that the previous writes
+         * have been "pushed out".
+         */
+        mb();
+        (void)__raw_readl((void __iomem *)addr);
+}
+
 /* core.c */
 void ast_vhub_done(struct ast_vhub_ep *ep, struct ast_vhub_req *req,
                    int status);
diff --git a/drivers/usb/gadget/udc/r8a66597-udc.c b/drivers/usb/gadget/udc/r8a66597-udc.c
index a3ecce62662b..11e25a3f4f1f 100644
--- a/drivers/usb/gadget/udc/r8a66597-udc.c
+++ b/drivers/usb/gadget/udc/r8a66597-udc.c
@@ -832,11 +832,11 @@ static void init_controller(struct r8a66597 *r8a66597)
 
                 r8a66597_bset(r8a66597, XCKE, SYSCFG0);
 
-                msleep(3);
+                mdelay(3);
 
                 r8a66597_bset(r8a66597, PLLC, SYSCFG0);
 
-                msleep(1);
+                mdelay(1);
 
                 r8a66597_bset(r8a66597, SCKE, SYSCFG0);
 
@@ -1190,7 +1190,7 @@ __acquires(r8a66597->lock)
         r8a66597->ep0_req->length = 2;
         /* AV: what happens if we get called again before that gets through? */
         spin_unlock(&r8a66597->lock);
-        r8a66597_queue(r8a66597->gadget.ep0, r8a66597->ep0_req, GFP_KERNEL);
+        r8a66597_queue(r8a66597->gadget.ep0, r8a66597->ep0_req, GFP_ATOMIC);
         spin_lock(&r8a66597->lock);
 }
 
diff --git a/drivers/usb/host/xhci-dbgcap.c b/drivers/usb/host/xhci-dbgcap.c
index 1fbfd89d0a0f..387f124a8334 100644
--- a/drivers/usb/host/xhci-dbgcap.c
+++ b/drivers/usb/host/xhci-dbgcap.c
@@ -508,16 +508,18 @@ static int xhci_do_dbc_start(struct xhci_hcd *xhci)
         return 0;
 }
 
-static void xhci_do_dbc_stop(struct xhci_hcd *xhci)
+static int xhci_do_dbc_stop(struct xhci_hcd *xhci)
 {
         struct xhci_dbc         *dbc = xhci->dbc;
 
         if (dbc->state == DS_DISABLED)
-                return;
+                return -1;
 
         writel(0, &dbc->regs->control);
         xhci_dbc_mem_cleanup(xhci);
         dbc->state = DS_DISABLED;
+
+        return 0;
 }
 
 static int xhci_dbc_start(struct xhci_hcd *xhci)
@@ -544,6 +546,7 @@ static int xhci_dbc_start(struct xhci_hcd *xhci)
 
 static void xhci_dbc_stop(struct xhci_hcd *xhci)
 {
+        int ret;
         unsigned long           flags;
         struct xhci_dbc         *dbc = xhci->dbc;
         struct dbc_port         *port = &dbc->port;
@@ -556,10 +559,11 @@ static void xhci_dbc_stop(struct xhci_hcd *xhci)
                 xhci_dbc_tty_unregister_device(xhci);
 
         spin_lock_irqsave(&dbc->lock, flags);
-        xhci_do_dbc_stop(xhci);
+        ret = xhci_do_dbc_stop(xhci);
         spin_unlock_irqrestore(&dbc->lock, flags);
 
-        pm_runtime_put_sync(xhci_to_hcd(xhci)->self.controller);
+        if (!ret)
+                pm_runtime_put_sync(xhci_to_hcd(xhci)->self.controller);
 }
 
 static void
diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
index 8a62eee9eee1..ef350c33dc4a 100644
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -595,7 +595,7 @@ struct xhci_ring *xhci_stream_id_to_ring(
         if (!ep->stream_info)
                 return NULL;
 
-        if (stream_id > ep->stream_info->num_streams)
+        if (stream_id >= ep->stream_info->num_streams)
                 return NULL;
         return ep->stream_info->stream_rings[stream_id];
 }
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 2f4850f25e82..68e6132aa8b2 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -3051,6 +3051,7 @@ static void xhci_endpoint_reset(struct usb_hcd *hcd,
         if (!list_empty(&ep->ring->td_list)) {
                 dev_err(&udev->dev, "EP not empty, refuse reset\n");
                 spin_unlock_irqrestore(&xhci->lock, flags);
+                xhci_free_command(xhci, cfg_cmd);
                 goto cleanup;
         }
         xhci_queue_stop_endpoint(xhci, stop_cmd, udev->slot_id, ep_index, 0);
diff --git a/drivers/usb/misc/yurex.c b/drivers/usb/misc/yurex.c
index 8abb6cbbd98a..3be40eaa1ac9 100644
--- a/drivers/usb/misc/yurex.c
+++ b/drivers/usb/misc/yurex.c
@@ -396,8 +396,7 @@ static ssize_t yurex_read(struct file *file, char __user *buffer, size_t count,
                           loff_t *ppos)
 {
         struct usb_yurex *dev;
-        int retval = 0;
-        int bytes_read = 0;
+        int len = 0;
         char in_buffer[20];
         unsigned long flags;
 
@@ -405,26 +404,16 @@ static ssize_t yurex_read(struct file *file, char __user *buffer, size_t count,
 
         mutex_lock(&dev->io_mutex);
         if (!dev->interface) {          /* already disconnected */
-                retval = -ENODEV;
-                goto exit;
+                mutex_unlock(&dev->io_mutex);
+                return -ENODEV;
         }
 
         spin_lock_irqsave(&dev->lock, flags);
-        bytes_read = snprintf(in_buffer, 20, "%lld\n", dev->bbu);
+        len = snprintf(in_buffer, 20, "%lld\n", dev->bbu);
         spin_unlock_irqrestore(&dev->lock, flags);
-
-        if (*ppos < bytes_read) {
-                if (copy_to_user(buffer, in_buffer + *ppos, bytes_read - *ppos))
-                        retval = -EFAULT;
-                else {
-                        retval = bytes_read - *ppos;
-                        *ppos += bytes_read;
-                }
-        }
-
-exit:
         mutex_unlock(&dev->io_mutex);
-        return retval;
+
+        return simple_read_from_buffer(buffer, count, ppos, in_buffer, len);
 }
 
 static ssize_t yurex_write(struct file *file, const char __user *user_buffer,
diff --git a/drivers/usb/phy/phy-fsl-usb.c b/drivers/usb/phy/phy-fsl-usb.c
index 900875f326d7..f7c96d209eda 100644
--- a/drivers/usb/phy/phy-fsl-usb.c
+++ b/drivers/usb/phy/phy-fsl-usb.c
@@ -861,6 +861,7 @@ int usb_otg_start(struct platform_device *pdev)
         if (pdata->init && pdata->init(pdev) != 0)
                 return -EINVAL;
 
+#ifdef CONFIG_PPC32
         if (pdata->big_endian_mmio) {
                 _fsl_readl = _fsl_readl_be;
                 _fsl_writel = _fsl_writel_be;
@@ -868,6 +869,7 @@ int usb_otg_start(struct platform_device *pdev)
                 _fsl_readl = _fsl_readl_le;
                 _fsl_writel = _fsl_writel_le;
         }
+#endif
 
         /* request irq */
         p_otg->irq = platform_get_irq(pdev, 0);
@@ -958,7 +960,7 @@ int usb_otg_start(struct platform_device *pdev)
 /*
  * state file in sysfs
  */
-static int show_fsl_usb2_otg_state(struct device *dev,
+static ssize_t show_fsl_usb2_otg_state(struct device *dev,
                                    struct device_attribute *attr, char *buf)
 {
         struct otg_fsm *fsm = &fsl_otg_dev->fsm;
diff --git a/drivers/usb/serial/ch341.c b/drivers/usb/serial/ch341.c
index bdd7a5ad3bf1..3bb1fff02bed 100644
--- a/drivers/usb/serial/ch341.c
+++ b/drivers/usb/serial/ch341.c
@@ -128,7 +128,7 @@ static int ch341_control_in(struct usb_device *dev,
         r = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), request,
                             USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_IN,
                             value, index, buf, bufsize, DEFAULT_TIMEOUT);
-        if (r < bufsize) {
+        if (r < (int)bufsize) {
                 if (r >= 0) {
                         dev_err(&dev->dev,
                                 "short control message received (%d < %u)\n",
diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
index ee0cc1d90b51..626a29d9aa58 100644
--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
@@ -149,6 +149,7 @@ static const struct usb_device_id id_table[] = {
         { USB_DEVICE(0x10C4, 0x8977) }, /* CEL MeshWorks DevKit Device */
         { USB_DEVICE(0x10C4, 0x8998) }, /* KCF Technologies PRN */
         { USB_DEVICE(0x10C4, 0x89A4) }, /* CESINEL FTBC Flexible Thyristor Bridge Controller */
+        { USB_DEVICE(0x10C4, 0x89FB) }, /* Qivicon ZigBee USB Radio Stick */
         { USB_DEVICE(0x10C4, 0x8A2A) }, /* HubZ dual ZigBee and Z-Wave dongle */
         { USB_DEVICE(0x10C4, 0x8A5E) }, /* CEL EM3588 ZigBee USB Stick Long Range */
         { USB_DEVICE(0x10C4, 0x8B34) }, /* Qivicon ZigBee USB Radio Stick */
diff --git a/drivers/usb/serial/keyspan_pda.c b/drivers/usb/serial/keyspan_pda.c
index 5169624d8b11..38d43c4b7ce5 100644
--- a/drivers/usb/serial/keyspan_pda.c
+++ b/drivers/usb/serial/keyspan_pda.c
@@ -369,8 +369,10 @@ static int keyspan_pda_get_modem_info(struct usb_serial *serial,
                              3, /* get pins */
                              USB_TYPE_VENDOR|USB_RECIP_INTERFACE|USB_DIR_IN,
                              0, 0, data, 1, 2000);
-        if (rc >= 0)
+        if (rc == 1)
                 *value = *data;
+        else if (rc >= 0)
+                rc = -EIO;
 
         kfree(data);
         return rc;
diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c
index fdceb46d9fc6..b580b4c7fa48 100644
--- a/drivers/usb/serial/mos7840.c
+++ b/drivers/usb/serial/mos7840.c
@@ -468,6 +468,9 @@ static void mos7840_control_callback(struct urb *urb)
         }
 
         dev_dbg(dev, "%s urb buffer size is %d\n", __func__, urb->actual_length);
+        if (urb->actual_length < 1)
+                goto out;
+
         dev_dbg(dev, "%s mos7840_port->MsrLsr is %d port %d\n", __func__,
                 mos7840_port->MsrLsr, mos7840_port->port_num);
         data = urb->transfer_buffer;
diff --git a/drivers/usb/typec/tcpm.c b/drivers/usb/typec/tcpm.c
index d961f1ec0e08..d1d20252bad8 100644
--- a/drivers/usb/typec/tcpm.c
+++ b/drivers/usb/typec/tcpm.c
@@ -725,6 +725,9 @@ static int tcpm_set_current_limit(struct tcpm_port *port, u32 max_ma, u32 mv)
 
         tcpm_log(port, "Setting voltage/current limit %u mV %u mA", mv, max_ma);
 
+        port->supply_voltage = mv;
+        port->current_limit = max_ma;
+
         if (port->tcpc->set_current_limit)
                 ret = port->tcpc->set_current_limit(port->tcpc, max_ma, mv);
 
@@ -2137,7 +2140,7 @@ static unsigned int tcpm_pd_select_pps_apdo(struct tcpm_port *port)
                          * PPS APDO. Again skip the first sink PDO as this will
                          * always be 5V 3A.
                          */
-                        for (j = i; j < port->nr_snk_pdo; j++) {
+                        for (j = 1; j < port->nr_snk_pdo; j++) {
                                 pdo = port->snk_pdo[j];
 
                                 switch (pdo_type(pdo)) {
@@ -2595,8 +2598,6 @@ static void tcpm_reset_port(struct tcpm_port *port)
         tcpm_set_attached_state(port, false);
         port->try_src_count = 0;
         port->try_snk_count = 0;
-        port->supply_voltage = 0;
-        port->current_limit = 0;
         port->usb_type = POWER_SUPPLY_USB_TYPE_C;
 
         power_supply_changed(port->psy);
diff --git a/drivers/vfio/pci/Kconfig b/drivers/vfio/pci/Kconfig
index 24ee2605b9f0..42dc1d3d71cf 100644
--- a/drivers/vfio/pci/Kconfig
+++ b/drivers/vfio/pci/Kconfig
@@ -28,5 +28,13 @@ config VFIO_PCI_INTX
         def_bool y if !S390
 
 config VFIO_PCI_IGD
-        depends on VFIO_PCI
-        def_bool y if X86
+        bool "VFIO PCI extensions for Intel graphics (GVT-d)"
+        depends on VFIO_PCI && X86
+        default y
+        help
+          Support for Intel IGD specific extensions to enable direct
+          assignment to virtual machines.  This includes exposing an IGD
+          specific firmware table and read-only copies of the host bridge
+          and LPC bridge config space.
+
+          To enable Intel IGD assignment through vfio-pci, say Y.
diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
index b423a309a6e0..125b58eff936 100644
--- a/drivers/vfio/pci/vfio_pci.c
+++ b/drivers/vfio/pci/vfio_pci.c
@@ -28,6 +28,7 @@
 #include <linux/uaccess.h>
 #include <linux/vfio.h>
 #include <linux/vgaarb.h>
+#include <linux/nospec.h>
 
 #include "vfio_pci_private.h"
 
@@ -727,6 +728,9 @@ static long vfio_pci_ioctl(void *device_data,
                         if (info.index >=
                             VFIO_PCI_NUM_REGIONS + vdev->num_regions)
                                 return -EINVAL;
+                        info.index = array_index_nospec(info.index,
+                                                        VFIO_PCI_NUM_REGIONS +
+                                                        vdev->num_regions);
 
                         i = info.index - VFIO_PCI_NUM_REGIONS;
 
diff --git a/drivers/vfio/vfio_iommu_spapr_tce.c b/drivers/vfio/vfio_iommu_spapr_tce.c
index 759a5bdd40e1..7cd63b0c1a46 100644
--- a/drivers/vfio/vfio_iommu_spapr_tce.c
+++ b/drivers/vfio/vfio_iommu_spapr_tce.c
@@ -457,17 +457,17 @@ static void tce_iommu_unuse_page(struct tce_container *container,
 }
 
 static int tce_iommu_prereg_ua_to_hpa(struct tce_container *container,
-                unsigned long tce, unsigned long size,
+                unsigned long tce, unsigned long shift,
                 unsigned long *phpa, struct mm_iommu_table_group_mem_t **pmem)
 {
         long ret = 0;
         struct mm_iommu_table_group_mem_t *mem;
 
-        mem = mm_iommu_lookup(container->mm, tce, size);
+        mem = mm_iommu_lookup(container->mm, tce, 1ULL << shift);
         if (!mem)
                 return -EINVAL;
 
-        ret = mm_iommu_ua_to_hpa(mem, tce, phpa);
+        ret = mm_iommu_ua_to_hpa(mem, tce, shift, phpa);
         if (ret)
                 return -EINVAL;
 
@@ -487,7 +487,7 @@ static void tce_iommu_unuse_page_v2(struct tce_container *container,
         if (!pua)
                 return;
 
-        ret = tce_iommu_prereg_ua_to_hpa(container, *pua, IOMMU_PAGE_SIZE(tbl),
+        ret = tce_iommu_prereg_ua_to_hpa(container, *pua, tbl->it_page_shift,
                         &hpa, &mem);
         if (ret)
                 pr_debug("%s: tce %lx at #%lx was not cached, ret=%d\n",
@@ -611,7 +611,7 @@ static long tce_iommu_build_v2(struct tce_container *container,
                                 entry + i);
 
                 ret = tce_iommu_prereg_ua_to_hpa(container,
-                                tce, IOMMU_PAGE_SIZE(tbl), &hpa, &mem);
+                                tce, tbl->it_page_shift, &hpa, &mem);
                 if (ret)
                         break;
 
diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c
index 2c75b33db4ac..3e5b17710a4f 100644
--- a/drivers/vfio/vfio_iommu_type1.c
+++ b/drivers/vfio/vfio_iommu_type1.c
@@ -343,18 +343,16 @@ static int vaddr_get_pfn(struct mm_struct *mm, unsigned long vaddr,
         struct page *page[1];
         struct vm_area_struct *vma;
         struct vm_area_struct *vmas[1];
+        unsigned int flags = 0;
         int ret;
 
+        if (prot & IOMMU_WRITE)
+                flags |= FOLL_WRITE;
+
+        down_read(&mm->mmap_sem);
         if (mm == current->mm) {
-                ret = get_user_pages_longterm(vaddr, 1, !!(prot & IOMMU_WRITE),
-                                              page, vmas);
+                ret = get_user_pages_longterm(vaddr, 1, flags, page, vmas);
         } else {
-                unsigned int flags = 0;
-
-                if (prot & IOMMU_WRITE)
-                        flags |= FOLL_WRITE;
-
-                down_read(&mm->mmap_sem);
                 ret = get_user_pages_remote(NULL, mm, vaddr, 1, flags, page,
                                             vmas, NULL);
                 /*
@@ -368,8 +366,8 @@ static int vaddr_get_pfn(struct mm_struct *mm, unsigned long vaddr,
                         ret = -EOPNOTSUPP;
                         put_page(page[0]);
                 }
-                up_read(&mm->mmap_sem);
         }
+        up_read(&mm->mmap_sem);
 
         if (ret == 1) {
                 *pfn = page_to_pfn(page[0]);