237 files changed, 1973 insertions, 1411 deletions
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 599e01bcdef2..a9dd4ea7467d 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -5359,10 +5359,20 @@ void ata_qc_complete(struct ata_queued_cmd *qc)
 */
 int ata_qc_complete_multiple(struct ata_port *ap, u64 qc_active)
 {
+        u64 done_mask, ap_qc_active = ap->qc_active;
        int nr_done = 0;
-        u64 done_mask;
-        done_mask = ap->qc_active ^ qc_active;
+        /*
+         * If the internal tag is set on ap->qc_active, then we care about
+         * bit0 on the passed in qc_active mask. Move that bit up to match
+         * the internal tag.
+         */
+        if (ap_qc_active & (1ULL << ATA_TAG_INTERNAL)) {
+                qc_active |= (qc_active & 0x01) << ATA_TAG_INTERNAL;
+                qc_active ^= qc_active & 0x01;
+        }
+        done_mask = ap_qc_active ^ qc_active;
        if (unlikely(done_mask & qc_active)) {
                ata_port_err(ap, "illegal qc_active transition (%08llx->%08llx)\n",
diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index 48f622728ce6..f2b6f4da1034 100644
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -3467,6 +3467,9 @@ static int fd_locked_ioctl(struct block_device *bdev, fmode_t mode, unsigned int
                                          (struct floppy_struct **)&outparam);
                if (ret)
                        return ret;
+                memcpy(&inparam.g, outparam,
+                                offsetof(struct floppy_struct, name));
+                outparam = &inparam.g;
                break;
        case FDMSGON:
                UDP->flags |= FTD_MSG;
diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
index a71d817e900d..429d20131c7e 100644
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -2670,8 +2670,8 @@ static void purge_persistent_grants(struct blkfront_info *info)
                        list_del(&gnt_list_entry->node);
                        gnttab_end_foreign_access(gnt_list_entry->gref, 0, 0UL);
                        rinfo->persistent_gnts_c--;
-                        __free_page(gnt_list_entry->page);
+                        gnt_list_entry->gref = GRANT_INVALID_REF;
-                        kfree(gnt_list_entry);
+                        list_add_tail(&gnt_list_entry->node, &rinfo->grants);
                }
                spin_unlock_irqrestore(&rinfo->ring_lock, flags);
diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c
index 963bb0309e25..ea6238ed5c0e 100644
--- a/drivers/bluetooth/hci_ldisc.c
+++ b/drivers/bluetooth/hci_ldisc.c
@@ -543,6 +543,8 @@ static void hci_uart_tty_close(struct tty_struct *tty)
        }
        clear_bit(HCI_UART_PROTO_SET, &hu->flags);
+        percpu_free_rwsem(&hu->proto_lock);
        kfree(hu);
 }
diff --git a/drivers/clk/x86/clk-pmc-atom.c b/drivers/clk/x86/clk-pmc-atom.c
index 08ef69945ffb..d977193842df 100644
--- a/drivers/clk/x86/clk-pmc-atom.c
+++ b/drivers/clk/x86/clk-pmc-atom.c
@@ -55,6 +55,7 @@ struct clk_plt_data {
        u8 nparents;
        struct clk_plt *clks[PMC_CLK_NUM];
        struct clk_lookup *mclk_lookup;
+        struct clk_lookup *ether_clk_lookup;
 };
 /* Return an index in parent table */
@@ -186,13 +187,6 @@ static struct clk_plt *plt_clk_register(struct platform_device *pdev, int id,
        pclk->reg = base + PMC_CLK_CTL_OFFSET + id * PMC_CLK_CTL_SIZE;
        spin_lock_init(&pclk->lock);
-        /*
-         * If the clock was already enabled by the firmware mark it as critical
-         * to avoid it being gated by the clock framework if no driver owns it.
-         */
-        if (plt_clk_is_enabled(&pclk->hw))
-                init.flags |= CLK_IS_CRITICAL;
        ret = devm_clk_hw_register(&pdev->dev, &pclk->hw);
        if (ret) {
                pclk = ERR_PTR(ret);
@@ -351,11 +345,20 @@ static int plt_clk_probe(struct platform_device *pdev)
                goto err_unreg_clk_plt;
        }
+        data->ether_clk_lookup = clkdev_hw_create(&data->clks[4]->hw,
+                                                  "ether_clk", NULL);
+        if (!data->ether_clk_lookup) {
+                err = -ENOMEM;
+                goto err_drop_mclk;
+        }
        plt_clk_free_parent_names_loop(parent_names, data->nparents);
        platform_set_drvdata(pdev, data);
        return 0;
+err_drop_mclk:
+        clkdev_drop(data->mclk_lookup);
 err_unreg_clk_plt:
        plt_clk_unregister_loop(data, i);
        plt_clk_unregister_parents(data);
@@ -369,6 +372,7 @@ static int plt_clk_remove(struct platform_device *pdev)
        data = platform_get_drvdata(pdev);
+        clkdev_drop(data->ether_clk_lookup);
        clkdev_drop(data->mclk_lookup);
        plt_clk_unregister_loop(data, PMC_CLK_NUM);
        plt_clk_unregister_parents(data);
diff --git a/drivers/clocksource/timer-atmel-pit.c b/drivers/clocksource/timer-atmel-pit.c
index ec8a4376f74f..2fab18fae4fc 100644
--- a/drivers/clocksource/timer-atmel-pit.c
+++ b/drivers/clocksource/timer-atmel-pit.c
@@ -180,26 +180,29 @@ static int __init at91sam926x_pit_dt_init(struct device_node *node)
        data->base = of_iomap(node, 0);
        if (!data->base) {
                pr_err("Could not map PIT address\n");
-                return -ENXIO;
+                ret = -ENXIO;
+                goto exit;
        }
        data->mck = of_clk_get(node, 0);
        if (IS_ERR(data->mck)) {
                pr_err("Unable to get mck clk\n");
-                return PTR_ERR(data->mck);
+                ret = PTR_ERR(data->mck);
+                goto exit;
        }
        ret = clk_prepare_enable(data->mck);
        if (ret) {
                pr_err("Unable to enable mck\n");
-                return ret;
+                goto exit;
        }
        /* Get the interrupts property */
        data->irq = irq_of_parse_and_map(node, 0);
        if (!data->irq) {
                pr_err("Unable to get IRQ from DT\n");
-                return -EINVAL;
+                ret = -EINVAL;
+                goto exit;
        }
        /*
@@ -227,7 +230,7 @@ static int __init at91sam926x_pit_dt_init(struct device_node *node)
        ret = clocksource_register_hz(&data->clksrc, pit_rate);
        if (ret) {
                pr_err("Failed to register clocksource\n");
-                return ret;
+                goto exit;
        }
        /* Set up irq handler */
@@ -236,7 +239,8 @@ static int __init at91sam926x_pit_dt_init(struct device_node *node)
                          "at91_tick", data);
        if (ret) {
                pr_err("Unable to setup IRQ\n");
-                return ret;
+                clocksource_unregister(&data->clksrc);
+                goto exit;
        }
        /* Set up and register clockevents */
@@ -254,6 +258,10 @@ static int __init at91sam926x_pit_dt_init(struct device_node *node)
        clockevents_register_device(&data->clkevt);
        return 0;
+exit:
+        kfree(data);
+        return ret;
 }
 TIMER_OF_DECLARE(at91sam926x_pit, "atmel,at91sam9260-pit",
                       at91sam926x_pit_dt_init);
diff --git a/drivers/clocksource/timer-fttmr010.c b/drivers/clocksource/timer-fttmr010.c
index c020038ebfab..cf93f6419b51 100644
--- a/drivers/clocksource/timer-fttmr010.c
+++ b/drivers/clocksource/timer-fttmr010.c
@@ -130,13 +130,17 @@ static int fttmr010_timer_set_next_event(unsigned long cycles,
        cr &= ~fttmr010->t1_enable_val;
        writel(cr, fttmr010->base + TIMER_CR);
-        /* Setup the match register forward/backward in time */
+        if (fttmr010->count_down) {
-        cr = readl(fttmr010->base + TIMER1_COUNT);
+                /*
-        if (fttmr010->count_down)
+                 * ASPEED Timer Controller will load TIMER1_LOAD register
-                cr -= cycles;
+                 * into TIMER1_COUNT register when the timer is re-enabled.
-        else
+                 */
-                cr += cycles;
+                writel(cycles, fttmr010->base + TIMER1_LOAD);
-        writel(cr, fttmr010->base + TIMER1_MATCH1);
+        } else {
+                /* Setup the match register forward in time */
+                cr = readl(fttmr010->base + TIMER1_COUNT);
+                writel(cr + cycles, fttmr010->base + TIMER1_MATCH1);
+        }
        /* Start */
        cr = readl(fttmr010->base + TIMER_CR);
diff --git a/drivers/clocksource/timer-ti-32k.c b/drivers/clocksource/timer-ti-32k.c
index 29e2e1a78a43..6949a9113dbb 100644
--- a/drivers/clocksource/timer-ti-32k.c
+++ b/drivers/clocksource/timer-ti-32k.c
@@ -97,6 +97,9 @@ static int __init ti_32k_timer_init(struct device_node *np)
                return -ENXIO;
        }
+        if (!of_machine_is_compatible("ti,am43"))
+                ti_32k_timer.cs.flags |= CLOCK_SOURCE_SUSPEND_NONSTOP;
        ti_32k_timer.counter = ti_32k_timer.base;
        /*
diff --git a/drivers/cpufreq/qcom-cpufreq-kryo.c b/drivers/cpufreq/qcom-cpufreq-kryo.c
index a1830fa25fc5..2a3675c24032 100644
--- a/drivers/cpufreq/qcom-cpufreq-kryo.c
+++ b/drivers/cpufreq/qcom-cpufreq-kryo.c
@@ -44,7 +44,7 @@ enum _msm8996_version {
 struct platform_device *cpufreq_dt_pdev, *kryo_cpufreq_pdev;
-static enum _msm8996_version __init qcom_cpufreq_kryo_get_msm_id(void)
+static enum _msm8996_version qcom_cpufreq_kryo_get_msm_id(void)
 {
        size_t len;
        u32 *msm_id;
@@ -222,7 +222,7 @@ static int __init qcom_cpufreq_kryo_init(void)
 }
 module_init(qcom_cpufreq_kryo_init);
-static void __init qcom_cpufreq_kryo_exit(void)
+static void __exit qcom_cpufreq_kryo_exit(void)
 {
        platform_device_unregister(kryo_cpufreq_pdev);
        platform_driver_unregister(&qcom_cpufreq_kryo_driver);
diff --git a/drivers/crypto/ccp/psp-dev.c b/drivers/crypto/ccp/psp-dev.c
index 218739b961fe..72790d88236d 100644
--- a/drivers/crypto/ccp/psp-dev.c
+++ b/drivers/crypto/ccp/psp-dev.c
@@ -38,6 +38,17 @@ static DEFINE_MUTEX(sev_cmd_mutex);
 static struct sev_misc_dev *misc_dev;
 static struct psp_device *psp_master;
+static int psp_cmd_timeout = 100;
+module_param(psp_cmd_timeout, int, 0644);
+MODULE_PARM_DESC(psp_cmd_timeout, " default timeout value, in seconds, for PSP commands");
+static int psp_probe_timeout = 5;
+module_param(psp_probe_timeout, int, 0644);
+MODULE_PARM_DESC(psp_probe_timeout, " default timeout value, in seconds, during PSP device probe");
+static bool psp_dead;
+static int psp_timeout;
 static struct psp_device *psp_alloc_struct(struct sp_device *sp)
 {
        struct device *dev = sp->dev;
@@ -82,10 +93,19 @@ done:
        return IRQ_HANDLED;
 }
-static void sev_wait_cmd_ioc(struct psp_device *psp, unsigned int *reg)
+static int sev_wait_cmd_ioc(struct psp_device *psp,
+                            unsigned int *reg, unsigned int timeout)
 {
-        wait_event(psp->sev_int_queue, psp->sev_int_rcvd);
+        int ret;
+        ret = wait_event_timeout(psp->sev_int_queue,
+                        psp->sev_int_rcvd, timeout * HZ);
+        if (!ret)
+                return -ETIMEDOUT;
        *reg = ioread32(psp->io_regs + psp->vdata->cmdresp_reg);
+        return 0;
 }
 static int sev_cmd_buffer_len(int cmd)
@@ -133,12 +153,15 @@ static int __sev_do_cmd_locked(int cmd, void *data, int *psp_ret)
        if (!psp)
                return -ENODEV;
+        if (psp_dead)
+                return -EBUSY;
        /* Get the physical address of the command buffer */
        phys_lsb = data ? lower_32_bits(__psp_pa(data)) : 0;
        phys_msb = data ? upper_32_bits(__psp_pa(data)) : 0;
-        dev_dbg(psp->dev, "sev command id %#x buffer 0x%08x%08x\n",
+        dev_dbg(psp->dev, "sev command id %#x buffer 0x%08x%08x timeout %us\n",
-                cmd, phys_msb, phys_lsb);
+                cmd, phys_msb, phys_lsb, psp_timeout);
        print_hex_dump_debug("(in):  ", DUMP_PREFIX_OFFSET, 16, 2, data,
                             sev_cmd_buffer_len(cmd), false);
@@ -154,7 +177,18 @@ static int __sev_do_cmd_locked(int cmd, void *data, int *psp_ret)
        iowrite32(reg, psp->io_regs + psp->vdata->cmdresp_reg);
        /* wait for command completion */
-        sev_wait_cmd_ioc(psp, &reg);
+        ret = sev_wait_cmd_ioc(psp, &reg, psp_timeout);
+        if (ret) {
+                if (psp_ret)
+                        *psp_ret = 0;
+                dev_err(psp->dev, "sev command %#x timed out, disabling PSP \n", cmd);
+                psp_dead = true;
+                return ret;
+        }
+        psp_timeout = psp_cmd_timeout;
        if (psp_ret)
                *psp_ret = reg & PSP_CMDRESP_ERR_MASK;
@@ -888,6 +922,8 @@ void psp_pci_init(void)
        psp_master = sp->psp_data;
+        psp_timeout = psp_probe_timeout;
        if (sev_get_api_version())
                goto err;
diff --git a/drivers/dax/device.c b/drivers/dax/device.c
index bbe4d72ca105..948806e57cee 100644
--- a/drivers/dax/device.c
+++ b/drivers/dax/device.c
@@ -535,6 +535,11 @@ static unsigned long dax_get_unmapped_area(struct file *filp,
        return current->mm->get_unmapped_area(filp, addr, len, pgoff, flags);
 }
+static const struct address_space_operations dev_dax_aops = {
+        .set_page_dirty         = noop_set_page_dirty,
+        .invalidatepage         = noop_invalidatepage,
+};
 static int dax_open(struct inode *inode, struct file *filp)
 {
        struct dax_device *dax_dev = inode_dax(inode);
@@ -544,6 +549,7 @@ static int dax_open(struct inode *inode, struct file *filp)
        dev_dbg(&dev_dax->dev, "trace\n");
        inode->i_mapping = __dax_inode->i_mapping;
        inode->i_mapping->host = __dax_inode;
+        inode->i_mapping->a_ops = &dev_dax_aops;
        filp->f_mapping = inode->i_mapping;
        filp->f_wb_err = filemap_sample_wb_err(filp->f_mapping);
        filp->private_data = dev_dax;
diff --git a/drivers/firmware/efi/Kconfig b/drivers/firmware/efi/Kconfig
index d8e159feb573..89110dfc7127 100644
--- a/drivers/firmware/efi/Kconfig
+++ b/drivers/firmware/efi/Kconfig
@@ -90,14 +90,17 @@ config EFI_ARMSTUB
 config EFI_ARMSTUB_DTB_LOADER
        bool "Enable the DTB loader"
        depends on EFI_ARMSTUB
+        default y
        help
          Select this config option to add support for the dtb= command
          line parameter, allowing a device tree blob to be loaded into
          memory from the EFI System Partition by the stub.
-          The device tree is typically provided by the platform or by
+          If the device tree is provided by the platform or by
-          the bootloader, so this option is mostly for development
+          the bootloader this option may not be needed.
-          purposes only.
+          But, for various development reasons and to maintain existing
+          functionality for bootloaders that do not have such support
+          this option is necessary.
 config EFI_BOOTLOADER_CONTROL
        tristate "EFI Bootloader Control"
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c
index f8bbbb3a9504..0c791e35acf0 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c
@@ -272,7 +272,7 @@ void amdgpu_amdkfd_gpu_reset(struct kgd_dev *kgd)
 int alloc_gtt_mem(struct kgd_dev *kgd, size_t size,
                        void **mem_obj, uint64_t *gpu_addr,
-                        void **cpu_ptr)
+                        void **cpu_ptr, bool mqd_gfx9)
 {
        struct amdgpu_device *adev = (struct amdgpu_device *)kgd;
        struct amdgpu_bo *bo = NULL;
@@ -287,6 +287,10 @@ int alloc_gtt_mem(struct kgd_dev *kgd, size_t size,
        bp.flags = AMDGPU_GEM_CREATE_CPU_GTT_USWC;
        bp.type = ttm_bo_type_kernel;
        bp.resv = NULL;
+        if (mqd_gfx9)
+                bp.flags |= AMDGPU_GEM_CREATE_MQD_GFX9;
        r = amdgpu_bo_create(adev, &bp, &bo);
        if (r) {
                dev_err(adev->dev,
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h
index 2f379c183ed2..cc9aeab5468c 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h
@@ -136,7 +136,7 @@ void amdgpu_amdkfd_gpu_reset(struct kgd_dev *kgd);
 /* Shared API */
 int alloc_gtt_mem(struct kgd_dev *kgd, size_t size,
                        void **mem_obj, uint64_t *gpu_addr,
-                        void **cpu_ptr);
+                        void **cpu_ptr, bool mqd_gfx9);
 void free_gtt_mem(struct kgd_dev *kgd, void *mem_obj);
 void get_local_mem_info(struct kgd_dev *kgd,
                        struct kfd_local_mem_info *mem_info);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v7.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v7.c
index ea3f698aef5e..9803b91f3e77 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v7.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v7.c
@@ -685,7 +685,7 @@ static int kgd_hqd_sdma_destroy(struct kgd_dev *kgd, void *mqd,
        while (true) {
                temp = RREG32(sdma_base_addr + mmSDMA0_RLC0_CONTEXT_STATUS);
-                if (temp & SDMA0_STATUS_REG__RB_CMD_IDLE__SHIFT)
+                if (temp & SDMA0_RLC0_CONTEXT_STATUS__IDLE_MASK)
                        break;
                if (time_after(jiffies, end_jiffies))
                        return -ETIME;
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c
index 693ec5ea4950..8816c697b205 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c
@@ -367,12 +367,14 @@ static int amdgpu_cgs_get_firmware_info(struct cgs_device *cgs_device,
                                break;
                        case CHIP_POLARIS10:
                                if (type == CGS_UCODE_ID_SMU) {
-                                        if ((adev->pdev->device == 0x67df) &&
+                                        if (((adev->pdev->device == 0x67df) &&
-                                            ((adev->pdev->revision == 0xe0) ||
+                                             ((adev->pdev->revision == 0xe0) ||
-                                             (adev->pdev->revision == 0xe3) ||
+                                              (adev->pdev->revision == 0xe3) ||
-                                             (adev->pdev->revision == 0xe4) ||
+                                              (adev->pdev->revision == 0xe4) ||
-                                             (adev->pdev->revision == 0xe5) ||
+                                              (adev->pdev->revision == 0xe5) ||
-                                             (adev->pdev->revision == 0xe7) ||
+                                              (adev->pdev->revision == 0xe7) ||
+                                              (adev->pdev->revision == 0xef))) ||
+                                            ((adev->pdev->device == 0x6fdf) &&
                                             (adev->pdev->revision == 0xef))) {
                                                info->is_kicker = true;
                                                strcpy(fw_name, "amdgpu/polaris10_k_smc.bin");
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
index 8843a06360fa..0f41d8647376 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
@@ -740,6 +740,7 @@ static const struct pci_device_id pciidlist[] = {
        {0x1002, 0x67CA, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS10},
        {0x1002, 0x67CC, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS10},
        {0x1002, 0x67CF, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS10},
+        {0x1002, 0x6FDF, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS10},
        /* Polaris12 */
        {0x1002, 0x6980, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS12},
        {0x1002, 0x6981, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS12},
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c
index 0cc5190f4f36..5f3f54073818 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c
@@ -258,6 +258,8 @@ int amdgpu_vce_suspend(struct amdgpu_device *adev)
 {
        int i;
+        cancel_delayed_work_sync(&adev->vce.idle_work);
        if (adev->vce.vcpu_bo == NULL)
                return 0;
@@ -268,7 +270,6 @@ int amdgpu_vce_suspend(struct amdgpu_device *adev)
        if (i == AMDGPU_MAX_VCE_HANDLES)
                return 0;
-        cancel_delayed_work_sync(&adev->vce.idle_work);
        /* TODO: suspending running encoding sessions isn't supported */
        return -EINVAL;
 }
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c
index fd654a4406db..400fc74bbae2 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c
@@ -153,11 +153,11 @@ int amdgpu_vcn_suspend(struct amdgpu_device *adev)
        unsigned size;
        void *ptr;
+        cancel_delayed_work_sync(&adev->vcn.idle_work);
        if (adev->vcn.vcpu_bo == NULL)
                return 0;
-        cancel_delayed_work_sync(&adev->vcn.idle_work);
        size = amdgpu_bo_size(adev->vcn.vcpu_bo);
        ptr = adev->vcn.cpu_addr;
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device.c b/drivers/gpu/drm/amd/amdkfd/kfd_device.c
index 1b048715ab8a..29ac74f40dce 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_device.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_device.c
@@ -457,7 +457,8 @@ bool kgd2kfd_device_init(struct kfd_dev *kfd,
        if (kfd->kfd2kgd->init_gtt_mem_allocation(
                        kfd->kgd, size, &kfd->gtt_mem,
-                        &kfd->gtt_start_gpu_addr, &kfd->gtt_start_cpu_ptr)){
+                        &kfd->gtt_start_gpu_addr, &kfd->gtt_start_cpu_ptr,
+                        false)) {
                dev_err(kfd_device, "Could not allocate %d bytes\n", size);
                goto out;
        }
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_iommu.c b/drivers/gpu/drm/amd/amdkfd/kfd_iommu.c
index 7a61f38c09e6..01494752c36a 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_iommu.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_iommu.c
@@ -62,9 +62,20 @@ int kfd_iommu_device_init(struct kfd_dev *kfd)
        struct amd_iommu_device_info iommu_info;
        unsigned int pasid_limit;
        int err;
+        struct kfd_topology_device *top_dev;
-        if (!kfd->device_info->needs_iommu_device)
+        top_dev = kfd_topology_device_by_id(kfd->id);
+        /*
+         * Overwrite ATS capability according to needs_iommu_device to fix
+         * potential missing corresponding bit in CRAT of BIOS.
+         */
+        if (!kfd->device_info->needs_iommu_device) {
+                top_dev->node_props.capability &= ~HSA_CAP_ATS_PRESENT;
                return 0;
+        }
+        top_dev->node_props.capability |= HSA_CAP_ATS_PRESENT;
        iommu_info.flags = 0;
        err = amd_iommu_device_info(kfd->pdev, &iommu_info);
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c
index f5fc3675f21e..0cedb37cf513 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c
@@ -88,7 +88,7 @@ static int init_mqd(struct mqd_manager *mm, void **mqd,
                                ALIGN(sizeof(struct v9_mqd), PAGE_SIZE),
                        &((*mqd_mem_obj)->gtt_mem),
                        &((*mqd_mem_obj)->gpu_addr),
-                        (void *)&((*mqd_mem_obj)->cpu_ptr));
+                        (void *)&((*mqd_mem_obj)->cpu_ptr), true);
        } else
                retval = kfd_gtt_sa_allocate(mm->dev, sizeof(struct v9_mqd),
                                mqd_mem_obj);
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
index f971710f1c91..92b285ca73aa 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
@@ -806,6 +806,7 @@ int kfd_topology_add_device(struct kfd_dev *gpu);
 int kfd_topology_remove_device(struct kfd_dev *gpu);
 struct kfd_topology_device *kfd_topology_device_by_proximity_domain(
                                                uint32_t proximity_domain);
+struct kfd_topology_device *kfd_topology_device_by_id(uint32_t gpu_id);
 struct kfd_dev *kfd_device_by_id(uint32_t gpu_id);
 struct kfd_dev *kfd_device_by_pci_dev(const struct pci_dev *pdev);
 int kfd_topology_enum_kfd_devices(uint8_t idx, struct kfd_dev **kdev);
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
index bc95d4dfee2e..80f5db4ef75f 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
@@ -63,22 +63,33 @@ struct kfd_topology_device *kfd_topology_device_by_proximity_domain(
        return device;
 }
-struct kfd_dev *kfd_device_by_id(uint32_t gpu_id)
+struct kfd_topology_device *kfd_topology_device_by_id(uint32_t gpu_id)
 {
-        struct kfd_topology_device *top_dev;
+        struct kfd_topology_device *top_dev = NULL;
-        struct kfd_dev *device = NULL;
+        struct kfd_topology_device *ret = NULL;
        down_read(&topology_lock);
        list_for_each_entry(top_dev, &topology_device_list, list)
                if (top_dev->gpu_id == gpu_id) {
-                        device = top_dev->gpu;
+                        ret = top_dev;
                        break;
                }
        up_read(&topology_lock);
-        return device;
+        return ret;
+}
+struct kfd_dev *kfd_device_by_id(uint32_t gpu_id)
+{
+        struct kfd_topology_device *top_dev;
+        top_dev = kfd_topology_device_by_id(gpu_id);
+        if (!top_dev)
+                return NULL;
+        return top_dev->gpu;
 }
 struct kfd_dev *kfd_device_by_pci_dev(const struct pci_dev *pdev)
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index 800f481a6995..96875950845a 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -641,6 +641,87 @@ amdgpu_dm_find_first_crtc_matching_connector(struct drm_atomic_state *state,
        return NULL;
 }
+static void emulated_link_detect(struct dc_link *link)
+{
+        struct dc_sink_init_data sink_init_data = { 0 };
+        struct display_sink_capability sink_caps = { 0 };
+        enum dc_edid_status edid_status;
+        struct dc_context *dc_ctx = link->ctx;
+        struct dc_sink *sink = NULL;
+        struct dc_sink *prev_sink = NULL;
+        link->type = dc_connection_none;
+        prev_sink = link->local_sink;
+        if (prev_sink != NULL)
+                dc_sink_retain(prev_sink);
+        switch (link->connector_signal) {
+        case SIGNAL_TYPE_HDMI_TYPE_A: {
+                sink_caps.transaction_type = DDC_TRANSACTION_TYPE_I2C;
+                sink_caps.signal = SIGNAL_TYPE_HDMI_TYPE_A;
+                break;
+        }
+        case SIGNAL_TYPE_DVI_SINGLE_LINK: {
+                sink_caps.transaction_type = DDC_TRANSACTION_TYPE_I2C;
+                sink_caps.signal = SIGNAL_TYPE_DVI_SINGLE_LINK;
+                break;
+        }
+        case SIGNAL_TYPE_DVI_DUAL_LINK: {
+                sink_caps.transaction_type = DDC_TRANSACTION_TYPE_I2C;
+                sink_caps.signal = SIGNAL_TYPE_DVI_DUAL_LINK;
+                break;
+        }
+        case SIGNAL_TYPE_LVDS: {
+                sink_caps.transaction_type = DDC_TRANSACTION_TYPE_I2C;
+                sink_caps.signal = SIGNAL_TYPE_LVDS;
+                break;
+        }
+        case SIGNAL_TYPE_EDP: {
+                sink_caps.transaction_type =
+                        DDC_TRANSACTION_TYPE_I2C_OVER_AUX;
+                sink_caps.signal = SIGNAL_TYPE_EDP;
+                break;
+        }
+        case SIGNAL_TYPE_DISPLAY_PORT: {
+                sink_caps.transaction_type =
+                        DDC_TRANSACTION_TYPE_I2C_OVER_AUX;
+                sink_caps.signal = SIGNAL_TYPE_VIRTUAL;
+                break;
+        }
+        default:
+                DC_ERROR("Invalid connector type! signal:%d\n",
+                        link->connector_signal);
+                return;
+        }
+        sink_init_data.link = link;
+        sink_init_data.sink_signal = sink_caps.signal;
+        sink = dc_sink_create(&sink_init_data);
+        if (!sink) {
+                DC_ERROR("Failed to create sink!\n");
+                return;
+        }
+        link->local_sink = sink;
+        edid_status = dm_helpers_read_local_edid(
+                        link->ctx,
+                        link,
+                        sink);
+        if (edid_status != EDID_OK)
+                DC_ERROR("Failed to read EDID");
+}
 static int dm_resume(void *handle)
 {
        struct amdgpu_device *adev = handle;
@@ -654,6 +735,7 @@ static int dm_resume(void *handle)
        struct drm_plane *plane;
        struct drm_plane_state *new_plane_state;
        struct dm_plane_state *dm_new_plane_state;
+        enum dc_connection_type new_connection_type = dc_connection_none;
        int ret;
        int i;
@@ -684,7 +766,13 @@ static int dm_resume(void *handle)
                        continue;
                mutex_lock(&aconnector->hpd_lock);
-                dc_link_detect(aconnector->dc_link, DETECT_REASON_HPD);
+                if (!dc_link_detect_sink(aconnector->dc_link, &new_connection_type))
+                        DRM_ERROR("KMS: Failed to detect connector\n");
+                if (aconnector->base.force && new_connection_type == dc_connection_none)
+                        emulated_link_detect(aconnector->dc_link);
+                else
+                        dc_link_detect(aconnector->dc_link, DETECT_REASON_HPD);
                if (aconnector->fake_enable && aconnector->dc_link->local_sink)
                        aconnector->fake_enable = false;
@@ -922,6 +1010,7 @@ static void handle_hpd_irq(void *param)
        struct amdgpu_dm_connector *aconnector = (struct amdgpu_dm_connector *)param;
        struct drm_connector *connector = &aconnector->base;
        struct drm_device *dev = connector->dev;
+        enum dc_connection_type new_connection_type = dc_connection_none;
        /* In case of failure or MST no need to update connector status or notify the OS
         * since (for MST case) MST does this in it's own context.
@@ -931,7 +1020,21 @@ static void handle_hpd_irq(void *param)
        if (aconnector->fake_enable)
                aconnector->fake_enable = false;
-        if (dc_link_detect(aconnector->dc_link, DETECT_REASON_HPD)) {
+        if (!dc_link_detect_sink(aconnector->dc_link, &new_connection_type))
+                DRM_ERROR("KMS: Failed to detect connector\n");
+        if (aconnector->base.force && new_connection_type == dc_connection_none) {
+                emulated_link_detect(aconnector->dc_link);
+                drm_modeset_lock_all(dev);
+                dm_restore_drm_connector_state(dev, connector);
+                drm_modeset_unlock_all(dev);
+                if (aconnector->base.force == DRM_FORCE_UNSPECIFIED)
+                        drm_kms_helper_hotplug_event(dev);
+        } else if (dc_link_detect(aconnector->dc_link, DETECT_REASON_HPD)) {
                amdgpu_dm_update_connector_after_detect(aconnector);
@@ -1031,6 +1134,7 @@ static void handle_hpd_rx_irq(void *param)
        struct drm_device *dev = connector->dev;
        struct dc_link *dc_link = aconnector->dc_link;
        bool is_mst_root_connector = aconnector->mst_mgr.mst_state;
+        enum dc_connection_type new_connection_type = dc_connection_none;
        /* TODO:Temporary add mutex to protect hpd interrupt not have a gpio
         * conflict, after implement i2c helper, this mutex should be
@@ -1042,7 +1146,24 @@ static void handle_hpd_rx_irq(void *param)
        if (dc_link_handle_hpd_rx_irq(dc_link, NULL, NULL) &&
                        !is_mst_root_connector) {
                /* Downstream Port status changed. */
-                if (dc_link_detect(dc_link, DETECT_REASON_HPDRX)) {
+                if (!dc_link_detect_sink(dc_link, &new_connection_type))
+                        DRM_ERROR("KMS: Failed to detect connector\n");
+                if (aconnector->base.force && new_connection_type == dc_connection_none) {
+                        emulated_link_detect(dc_link);
+                        if (aconnector->fake_enable)
+                                aconnector->fake_enable = false;
+                        amdgpu_dm_update_connector_after_detect(aconnector);
+                        drm_modeset_lock_all(dev);
+                        dm_restore_drm_connector_state(dev, connector);
+                        drm_modeset_unlock_all(dev);
+                        drm_kms_helper_hotplug_event(dev);
+                } else if (dc_link_detect(dc_link, DETECT_REASON_HPDRX)) {
                        if (aconnector->fake_enable)
                                aconnector->fake_enable = false;
@@ -1433,6 +1554,7 @@ static int amdgpu_dm_initialize_drm_device(struct amdgpu_device *adev)
        struct amdgpu_mode_info *mode_info = &adev->mode_info;
        uint32_t link_cnt;
        int32_t total_overlay_planes, total_primary_planes;
+        enum dc_connection_type new_connection_type = dc_connection_none;
        link_cnt = dm->dc->caps.max_links;
        if (amdgpu_dm_mode_config_init(dm->adev)) {
@@ -1499,7 +1621,14 @@ static int amdgpu_dm_initialize_drm_device(struct amdgpu_device *adev)
                link = dc_get_link_at_index(dm->dc, i);
-                if (dc_link_detect(link, DETECT_REASON_BOOT)) {
+                if (!dc_link_detect_sink(link, &new_connection_type))
+                        DRM_ERROR("KMS: Failed to detect connector\n");
+                if (aconnector->base.force && new_connection_type == dc_connection_none) {
+                        emulated_link_detect(link);
+                        amdgpu_dm_update_connector_after_detect(aconnector);
+                } else if (dc_link_detect(link, DETECT_REASON_BOOT)) {
                        amdgpu_dm_update_connector_after_detect(aconnector);
                        register_backlight_device(dm, link);
                }
@@ -2494,7 +2623,7 @@ create_stream_for_sink(struct amdgpu_dm_connector *aconnector,
        if (dm_state && dm_state->freesync_capable)
                stream->ignore_msa_timing_param = true;
 finish:
-        if (sink && sink->sink_signal == SIGNAL_TYPE_VIRTUAL)
+        if (sink && sink->sink_signal == SIGNAL_TYPE_VIRTUAL && aconnector->base.force != DRM_FORCE_ON)
                dc_sink_release(sink);
        return stream;
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
index 37eaf72ace54..fced3c1c2ef5 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
@@ -195,7 +195,7 @@ static bool program_hpd_filter(
        return result;
 }
-static bool detect_sink(struct dc_link *link, enum dc_connection_type *type)
+bool dc_link_detect_sink(struct dc_link *link, enum dc_connection_type *type)
 {
        uint32_t is_hpd_high = 0;
        struct gpio *hpd_pin;
@@ -604,7 +604,7 @@ bool dc_link_detect(struct dc_link *link, enum dc_detect_reason reason)
        if (link->connector_signal == SIGNAL_TYPE_VIRTUAL)
                return false;
-        if (false == detect_sink(link, &new_connection_type)) {
+        if (false == dc_link_detect_sink(link, &new_connection_type)) {
                BREAK_TO_DEBUGGER();
                return false;
        }
diff --git a/drivers/gpu/drm/amd/display/dc/dc_link.h b/drivers/gpu/drm/amd/display/dc/dc_link.h
index d43cefbc43d3..1b48ab9aea89 100644
--- a/drivers/gpu/drm/amd/display/dc/dc_link.h
+++ b/drivers/gpu/drm/amd/display/dc/dc_link.h
@@ -215,6 +215,7 @@ void dc_link_enable_hpd_filter(struct dc_link *link, bool enable);
 bool dc_link_is_dp_sink_present(struct dc_link *link);
+bool dc_link_detect_sink(struct dc_link *link, enum dc_connection_type *type);
 /*
 * DPCD access interfaces
 */
diff --git a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
index 14384d9675a8..b2f308766a9e 100644
--- a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
+++ b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
@@ -2560,7 +2560,7 @@ static void pplib_apply_display_requirements(
        dc->prev_display_config = *pp_display_cfg;
 }
-void dce110_set_bandwidth(
+static void dce110_set_bandwidth(
                struct dc *dc,
                struct dc_state *context,
                bool decrease_allowed)
diff --git a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.h b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.h
index e4c5db75c4c6..d6db3dbd9015 100644
--- a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.h
+++ b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.h
@@ -68,11 +68,6 @@ void dce110_fill_display_configs(
        const struct dc_state *context,
        struct dm_pp_display_configuration *pp_display_cfg);
-void dce110_set_bandwidth(
-                struct dc *dc,
-                struct dc_state *context,
-                bool decrease_allowed);
 uint32_t dce110_get_min_vblank_time_us(const struct dc_state *context);
 void dp_receiver_power_ctrl(struct dc_link *link, bool on);
diff --git a/drivers/gpu/drm/amd/display/dc/dce120/dce120_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dce120/dce120_hw_sequencer.c
index 5853522a6182..eb0f5f9a973b 100644
--- a/drivers/gpu/drm/amd/display/dc/dce120/dce120_hw_sequencer.c
+++ b/drivers/gpu/drm/amd/display/dc/dce120/dce120_hw_sequencer.c
@@ -244,17 +244,6 @@ static void dce120_update_dchub(
        dh_data->dchub_info_valid = false;
 }
-static void dce120_set_bandwidth(
-                struct dc *dc,
-                struct dc_state *context,
-                bool decrease_allowed)
-{
-        if (context->stream_count <= 0)
-                return;
-        dce110_set_bandwidth(dc, context, decrease_allowed);
-}
 void dce120_hw_sequencer_construct(struct dc *dc)
 {
        /* All registers used by dce11.2 match those in dce11 in offset and
@@ -263,6 +252,5 @@ void dce120_hw_sequencer_construct(struct dc *dc)
        dce110_hw_sequencer_construct(dc);
        dc->hwss.enable_display_power_gating = dce120_enable_display_power_gating;
        dc->hwss.update_dchub = dce120_update_dchub;
-        dc->hwss.set_bandwidth = dce120_set_bandwidth;
 }
diff --git a/drivers/gpu/drm/amd/include/kgd_kfd_interface.h b/drivers/gpu/drm/amd/include/kgd_kfd_interface.h
index 14391b06080c..43b82e14007e 100644
--- a/drivers/gpu/drm/amd/include/kgd_kfd_interface.h
+++ b/drivers/gpu/drm/amd/include/kgd_kfd_interface.h
@@ -292,7 +292,7 @@ struct tile_config {
 struct kfd2kgd_calls {
        int (*init_gtt_mem_allocation)(struct kgd_dev *kgd, size_t size,
                                        void **mem_obj, uint64_t *gpu_addr,
-                                        void **cpu_ptr);
+                                        void **cpu_ptr, bool mqd_gfx9);
        void (*free_gtt_mem)(struct kgd_dev *kgd, void *mem_obj);
diff --git a/drivers/gpu/drm/arm/malidp_drv.c b/drivers/gpu/drm/arm/malidp_drv.c
index 08b5bb219816..94d6dabec2dc 100644
--- a/drivers/gpu/drm/arm/malidp_drv.c
+++ b/drivers/gpu/drm/arm/malidp_drv.c
@@ -754,6 +754,7 @@ static int malidp_bind(struct device *dev)
        drm->irq_enabled = true;
        ret = drm_vblank_init(drm, drm->mode_config.num_crtc);
+        drm_crtc_vblank_reset(&malidp->crtc);
        if (ret < 0) {
                DRM_ERROR("failed to initialise vblank\n");
                goto vblank_fail;
diff --git a/drivers/gpu/drm/arm/malidp_hw.c b/drivers/gpu/drm/arm/malidp_hw.c
index c94a4422e0e9..2781e462c1ed 100644
--- a/drivers/gpu/drm/arm/malidp_hw.c
+++ b/drivers/gpu/drm/arm/malidp_hw.c
@@ -384,7 +384,8 @@ static long malidp500_se_calc_mclk(struct malidp_hw_device *hwdev,
 static int malidp500_enable_memwrite(struct malidp_hw_device *hwdev,
                                     dma_addr_t *addrs, s32 *pitches,
-                                     int num_planes, u16 w, u16 h, u32 fmt_id)
+                                     int num_planes, u16 w, u16 h, u32 fmt_id,
+                                     const s16 *rgb2yuv_coeffs)
 {
        u32 base = MALIDP500_SE_MEMWRITE_BASE;
        u32 de_base = malidp_get_block_base(hwdev, MALIDP_DE_BLOCK);
@@ -416,6 +417,16 @@ static int malidp500_enable_memwrite(struct malidp_hw_device *hwdev,
        malidp_hw_write(hwdev, MALIDP_DE_H_ACTIVE(w) | MALIDP_DE_V_ACTIVE(h),
                        MALIDP500_SE_MEMWRITE_OUT_SIZE);
+        if (rgb2yuv_coeffs) {
+                int i;
+                for (i = 0; i < MALIDP_COLORADJ_NUM_COEFFS; i++) {
+                        malidp_hw_write(hwdev, rgb2yuv_coeffs[i],
+                                        MALIDP500_SE_RGB_YUV_COEFFS + i * 4);
+                }
+        }
        malidp_hw_setbits(hwdev, MALIDP_SE_MEMWRITE_EN, MALIDP500_SE_CONTROL);
        return 0;
@@ -658,7 +669,8 @@ static long malidp550_se_calc_mclk(struct malidp_hw_device *hwdev,
 static int malidp550_enable_memwrite(struct malidp_hw_device *hwdev,
                                     dma_addr_t *addrs, s32 *pitches,
-                                     int num_planes, u16 w, u16 h, u32 fmt_id)
+                                     int num_planes, u16 w, u16 h, u32 fmt_id,
+                                     const s16 *rgb2yuv_coeffs)
 {
        u32 base = MALIDP550_SE_MEMWRITE_BASE;
        u32 de_base = malidp_get_block_base(hwdev, MALIDP_DE_BLOCK);
@@ -689,6 +701,15 @@ static int malidp550_enable_memwrite(struct malidp_hw_device *hwdev,
        malidp_hw_setbits(hwdev, MALIDP550_SE_MEMWRITE_ONESHOT | MALIDP_SE_MEMWRITE_EN,
                          MALIDP550_SE_CONTROL);
+        if (rgb2yuv_coeffs) {
+                int i;
+                for (i = 0; i < MALIDP_COLORADJ_NUM_COEFFS; i++) {
+                        malidp_hw_write(hwdev, rgb2yuv_coeffs[i],
+                                        MALIDP550_SE_RGB_YUV_COEFFS + i * 4);
+                }
+        }
        return 0;
 }
diff --git a/drivers/gpu/drm/arm/malidp_hw.h b/drivers/gpu/drm/arm/malidp_hw.h
index ad2e96915d44..9fc94c08190f 100644
--- a/drivers/gpu/drm/arm/malidp_hw.h
+++ b/drivers/gpu/drm/arm/malidp_hw.h
@@ -191,7 +191,8 @@ struct malidp_hw {
         * @param fmt_id - internal format ID of output buffer
         */
        int (*enable_memwrite)(struct malidp_hw_device *hwdev, dma_addr_t *addrs,
-                               s32 *pitches, int num_planes, u16 w, u16 h, u32 fmt_id);
+                               s32 *pitches, int num_planes, u16 w, u16 h, u32 fmt_id,
+                               const s16 *rgb2yuv_coeffs);
        /*
         * Disable the writing to memory of the next frame's content.
diff --git a/drivers/gpu/drm/arm/malidp_mw.c b/drivers/gpu/drm/arm/malidp_mw.c
index ba6ae66387c9..91472e5e0c8b 100644
--- a/drivers/gpu/drm/arm/malidp_mw.c
+++ b/drivers/gpu/drm/arm/malidp_mw.c
@@ -26,6 +26,8 @@ struct malidp_mw_connector_state {
        s32 pitches[2];
        u8 format;
        u8 n_planes;
+        bool rgb2yuv_initialized;
+        const s16 *rgb2yuv_coeffs;
 };
 static int malidp_mw_connector_get_modes(struct drm_connector *connector)
@@ -84,7 +86,7 @@ static void malidp_mw_connector_destroy(struct drm_connector *connector)
 static struct drm_connector_state *
 malidp_mw_connector_duplicate_state(struct drm_connector *connector)
 {
-        struct malidp_mw_connector_state *mw_state;
+        struct malidp_mw_connector_state *mw_state, *mw_current_state;
        if (WARN_ON(!connector->state))
                return NULL;
@@ -93,7 +95,10 @@ malidp_mw_connector_duplicate_state(struct drm_connector *connector)
        if (!mw_state)
                return NULL;
-        /* No need to preserve any of our driver-local data */
+        mw_current_state = to_mw_state(connector->state);
+        mw_state->rgb2yuv_coeffs = mw_current_state->rgb2yuv_coeffs;
+        mw_state->rgb2yuv_initialized = mw_current_state->rgb2yuv_initialized;
        __drm_atomic_helper_connector_duplicate_state(connector, &mw_state->base);
        return &mw_state->base;
@@ -108,6 +113,13 @@ static const struct drm_connector_funcs malidp_mw_connector_funcs = {
        .atomic_destroy_state = drm_atomic_helper_connector_destroy_state,
 };
+static const s16 rgb2yuv_coeffs_bt709_limited[MALIDP_COLORADJ_NUM_COEFFS] = {
+        47,  157,   16,
+        -26,  -87,  112,
+        112, -102,  -10,
+        16,  128,  128
+};
 static int
 malidp_mw_encoder_atomic_check(struct drm_encoder *encoder,
                               struct drm_crtc_state *crtc_state,
@@ -157,6 +169,9 @@ malidp_mw_encoder_atomic_check(struct drm_encoder *encoder,
        }
        mw_state->n_planes = n_planes;
+        if (fb->format->is_yuv)
+                mw_state->rgb2yuv_coeffs = rgb2yuv_coeffs_bt709_limited;
        return 0;
 }
@@ -239,10 +254,12 @@ void malidp_mw_atomic_commit(struct drm_device *drm,
                drm_writeback_queue_job(mw_conn, conn_state->writeback_job);
                conn_state->writeback_job = NULL;
                hwdev->hw->enable_memwrite(hwdev, mw_state->addrs,
                                           mw_state->pitches, mw_state->n_planes,
-                                           fb->width, fb->height, mw_state->format);
+                                           fb->width, fb->height, mw_state->format,
+                                           !mw_state->rgb2yuv_initialized ?
+                                           mw_state->rgb2yuv_coeffs : NULL);
+                mw_state->rgb2yuv_initialized = !!mw_state->rgb2yuv_coeffs;
        } else {
                DRM_DEV_DEBUG_DRIVER(drm->dev, "Disable memwrite\n");
                hwdev->hw->disable_memwrite(hwdev);
diff --git a/drivers/gpu/drm/arm/malidp_regs.h b/drivers/gpu/drm/arm/malidp_regs.h
index 3579d36b2a71..6ffe849774f2 100644
--- a/drivers/gpu/drm/arm/malidp_regs.h
+++ b/drivers/gpu/drm/arm/malidp_regs.h
@@ -205,6 +205,7 @@
 #define MALIDP500_SE_BASE               0x00c00
 #define MALIDP500_SE_CONTROL            0x00c0c
 #define MALIDP500_SE_MEMWRITE_OUT_SIZE  0x00c2c
+#define MALIDP500_SE_RGB_YUV_COEFFS     0x00C74
 #define MALIDP500_SE_MEMWRITE_BASE      0x00e00
 #define MALIDP500_DC_IRQ_BASE           0x00f00
 #define MALIDP500_CONFIG_VALID          0x00f00
@@ -238,6 +239,7 @@
 #define MALIDP550_SE_CONTROL            0x08010
 #define   MALIDP550_SE_MEMWRITE_ONESHOT (1 << 7)
 #define MALIDP550_SE_MEMWRITE_OUT_SIZE  0x08030
+#define MALIDP550_SE_RGB_YUV_COEFFS     0x08078
 #define MALIDP550_SE_MEMWRITE_BASE      0x08100
 #define MALIDP550_DC_BASE               0x0c000
 #define MALIDP550_DC_CONTROL            0x0c010
diff --git a/drivers/gpu/drm/drm_atomic.c b/drivers/gpu/drm/drm_atomic.c
index 3eb061e11e2e..018fcdb353d2 100644
--- a/drivers/gpu/drm/drm_atomic.c
+++ b/drivers/gpu/drm/drm_atomic.c
@@ -2067,7 +2067,7 @@ static void __drm_state_dump(struct drm_device *dev, struct drm_printer *p,
        struct drm_connector *connector;
        struct drm_connector_list_iter conn_iter;
-        if (!drm_core_check_feature(dev, DRIVER_ATOMIC))
+        if (!drm_drv_uses_atomic_modeset(dev))
                return;
        list_for_each_entry(plane, &config->plane_list, head) {
diff --git a/drivers/gpu/drm/drm_debugfs.c b/drivers/gpu/drm/drm_debugfs.c
index 6f28fe58f169..373bd4c2b698 100644
--- a/drivers/gpu/drm/drm_debugfs.c
+++ b/drivers/gpu/drm/drm_debugfs.c
@@ -151,7 +151,7 @@ int drm_debugfs_init(struct drm_minor *minor, int minor_id,
                return ret;
        }
-        if (drm_core_check_feature(dev, DRIVER_ATOMIC)) {
+        if (drm_drv_uses_atomic_modeset(dev)) {
                ret = drm_atomic_debugfs_init(minor);
                if (ret) {
                        DRM_ERROR("Failed to create atomic debugfs files\n");
diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
index 4b0dd20bccb8..16ec93b75dbf 100644
--- a/drivers/gpu/drm/drm_fb_helper.c
+++ b/drivers/gpu/drm/drm_fb_helper.c
@@ -2370,7 +2370,6 @@ static int drm_pick_crtcs(struct drm_fb_helper *fb_helper,
 {
        int c, o;
        struct drm_connector *connector;
-        const struct drm_connector_helper_funcs *connector_funcs;
        int my_score, best_score, score;
        struct drm_fb_helper_crtc **crtcs, *crtc;
        struct drm_fb_helper_connector *fb_helper_conn;
@@ -2399,8 +2398,6 @@ static int drm_pick_crtcs(struct drm_fb_helper *fb_helper,
        if (drm_has_preferred_mode(fb_helper_conn, width, height))
                my_score++;
-        connector_funcs = connector->helper_private;
        /*
         * select a crtc for this connector and then attempt to configure
         * remaining connectors
diff --git a/drivers/gpu/drm/drm_panel.c b/drivers/gpu/drm/drm_panel.c
index b902361dee6e..1d9a9d2fe0e0 100644
--- a/drivers/gpu/drm/drm_panel.c
+++ b/drivers/gpu/drm/drm_panel.c
@@ -24,7 +24,6 @@
 #include <linux/err.h>
 #include <linux/module.h>
-#include <drm/drm_device.h>
 #include <drm/drm_crtc.h>
 #include <drm/drm_panel.h>
@@ -105,13 +104,6 @@ int drm_panel_attach(struct drm_panel *panel, struct drm_connector *connector)
        if (panel->connector)
                return -EBUSY;
-        panel->link = device_link_add(connector->dev->dev, panel->dev, 0);
-        if (!panel->link) {
-                dev_err(panel->dev, "failed to link panel to %s\n",
-                        dev_name(connector->dev->dev));
-                return -EINVAL;
-        }
        panel->connector = connector;
        panel->drm = connector->dev;
@@ -133,8 +125,6 @@ EXPORT_SYMBOL(drm_panel_attach);
 */
 int drm_panel_detach(struct drm_panel *panel)
 {
-        device_link_del(panel->link);
        panel->connector = NULL;
        panel->drm = NULL;
diff --git a/drivers/gpu/drm/drm_syncobj.c b/drivers/gpu/drm/drm_syncobj.c
index adb3cb27d31e..759278fef35a 100644
--- a/drivers/gpu/drm/drm_syncobj.c
+++ b/drivers/gpu/drm/drm_syncobj.c
@@ -97,6 +97,8 @@ static int drm_syncobj_fence_get_or_add_callback(struct drm_syncobj *syncobj,
 {
        int ret;
+        WARN_ON(*fence);
        *fence = drm_syncobj_fence_get(syncobj);
        if (*fence)
                return 1;
@@ -743,6 +745,9 @@ static signed long drm_syncobj_array_wait_timeout(struct drm_syncobj **syncobjs,
        if (flags & DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT) {
                for (i = 0; i < count; ++i) {
+                        if (entries[i].fence)
+                                continue;
                        drm_syncobj_fence_get_or_add_callback(syncobjs[i],
                                                              &entries[i].fence,
                                                              &entries[i].syncobj_cb,
diff --git a/drivers/gpu/drm/etnaviv/etnaviv_drv.c b/drivers/gpu/drm/etnaviv/etnaviv_drv.c
index 9b2720b41571..83c1f46670bf 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_drv.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_drv.c
@@ -592,8 +592,6 @@ static int etnaviv_pdev_probe(struct platform_device *pdev)
        struct device *dev = &pdev->dev;
        struct component_match *match = NULL;
-        dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(32));
        if (!dev->platform_data) {
                struct device_node *core_node;
@@ -655,13 +653,30 @@ static int __init etnaviv_init(void)
        for_each_compatible_node(np, NULL, "vivante,gc") {
                if (!of_device_is_available(np))
                        continue;
-                pdev = platform_device_register_simple("etnaviv", -1,
-                                                       NULL, 0);
+                pdev = platform_device_alloc("etnaviv", -1);
-                if (IS_ERR(pdev)) {
+                if (!pdev) {
-                        ret = PTR_ERR(pdev);
+                        ret = -ENOMEM;
+                        of_node_put(np);
+                        goto unregister_platform_driver;
+                }
+                pdev->dev.coherent_dma_mask = DMA_BIT_MASK(40);
+                pdev->dev.dma_mask = &pdev->dev.coherent_dma_mask;
+                /*
+                 * Apply the same DMA configuration to the virtual etnaviv
+                 * device as the GPU we found. This assumes that all Vivante
+                 * GPUs in the system share the same DMA constraints.
+                 */
+                of_dma_configure(&pdev->dev, np, true);
+                ret = platform_device_add(pdev);
+                if (ret) {
+                        platform_device_put(pdev);
                        of_node_put(np);
                        goto unregister_platform_driver;
                }
                etnaviv_drm = pdev;
                of_node_put(np);
                break;
diff --git a/drivers/gpu/drm/i915/gvt/handlers.c b/drivers/gpu/drm/i915/gvt/handlers.c
index 72afa518edd9..94c1089ecf59 100644
--- a/drivers/gpu/drm/i915/gvt/handlers.c
+++ b/drivers/gpu/drm/i915/gvt/handlers.c
@@ -3210,6 +3210,7 @@ static int init_bxt_mmio_info(struct intel_gvt *gvt)
        MMIO_D(BXT_DSI_PLL_ENABLE, D_BXT);
        MMIO_D(GEN9_CLKGATE_DIS_0, D_BXT);
+        MMIO_D(GEN9_CLKGATE_DIS_4, D_BXT);
        MMIO_D(HSW_TVIDEO_DIP_GCP(TRANSCODER_A), D_BXT);
        MMIO_D(HSW_TVIDEO_DIP_GCP(TRANSCODER_B), D_BXT);
diff --git a/drivers/gpu/drm/i915/gvt/kvmgt.c b/drivers/gpu/drm/i915/gvt/kvmgt.c
index c7afee37b2b8..9ad89e38f6c0 100644
--- a/drivers/gpu/drm/i915/gvt/kvmgt.c
+++ b/drivers/gpu/drm/i915/gvt/kvmgt.c
@@ -1833,6 +1833,8 @@ static bool kvmgt_is_valid_gfn(unsigned long handle, unsigned long gfn)
 {
        struct kvmgt_guest_info *info;
        struct kvm *kvm;
+        int idx;
+        bool ret;
        if (!handle_valid(handle))
                return false;
@@ -1840,8 +1842,11 @@ static bool kvmgt_is_valid_gfn(unsigned long handle, unsigned long gfn)
        info = (struct kvmgt_guest_info *)handle;
        kvm = info->kvm;
-        return kvm_is_visible_gfn(kvm, gfn);
+        idx = srcu_read_lock(&kvm->srcu);
+        ret = kvm_is_visible_gfn(kvm, gfn);
+        srcu_read_unlock(&kvm->srcu, idx);
+        return ret;
 }
 struct intel_gvt_mpt kvmgt_mpt = {
diff --git a/drivers/gpu/drm/i915/gvt/mmio.c b/drivers/gpu/drm/i915/gvt/mmio.c
index 994366035364..9bb9a85c992c 100644
--- a/drivers/gpu/drm/i915/gvt/mmio.c
+++ b/drivers/gpu/drm/i915/gvt/mmio.c
@@ -244,6 +244,34 @@ void intel_vgpu_reset_mmio(struct intel_vgpu *vgpu, bool dmlr)
                /* set the bit 0:2(Core C-State ) to C0 */
                vgpu_vreg_t(vgpu, GEN6_GT_CORE_STATUS) = 0;
+                if (IS_BROXTON(vgpu->gvt->dev_priv)) {
+                        vgpu_vreg_t(vgpu, BXT_P_CR_GT_DISP_PWRON) &=
+                                    ~(BIT(0) | BIT(1));
+                        vgpu_vreg_t(vgpu, BXT_PORT_CL1CM_DW0(DPIO_PHY0)) &=
+                                    ~PHY_POWER_GOOD;
+                        vgpu_vreg_t(vgpu, BXT_PORT_CL1CM_DW0(DPIO_PHY1)) &=
+                                    ~PHY_POWER_GOOD;
+                        vgpu_vreg_t(vgpu, BXT_PHY_CTL_FAMILY(DPIO_PHY0)) &=
+                                    ~BIT(30);
+                        vgpu_vreg_t(vgpu, BXT_PHY_CTL_FAMILY(DPIO_PHY1)) &=
+                                    ~BIT(30);
+                        vgpu_vreg_t(vgpu, BXT_PHY_CTL(PORT_A)) &=
+                                    ~BXT_PHY_LANE_ENABLED;
+                        vgpu_vreg_t(vgpu, BXT_PHY_CTL(PORT_A)) |=
+                                    BXT_PHY_CMNLANE_POWERDOWN_ACK |
+                                    BXT_PHY_LANE_POWERDOWN_ACK;
+                        vgpu_vreg_t(vgpu, BXT_PHY_CTL(PORT_B)) &=
+                                    ~BXT_PHY_LANE_ENABLED;
+                        vgpu_vreg_t(vgpu, BXT_PHY_CTL(PORT_B)) |=
+                                    BXT_PHY_CMNLANE_POWERDOWN_ACK |
+                                    BXT_PHY_LANE_POWERDOWN_ACK;
+                        vgpu_vreg_t(vgpu, BXT_PHY_CTL(PORT_C)) &=
+                                    ~BXT_PHY_LANE_ENABLED;
+                        vgpu_vreg_t(vgpu, BXT_PHY_CTL(PORT_C)) |=
+                                    BXT_PHY_CMNLANE_POWERDOWN_ACK |
+                                    BXT_PHY_LANE_POWERDOWN_ACK;
+                }
        } else {
 #define GVT_GEN8_MMIO_RESET_OFFSET              (0x44200)
                /* only reset the engine related, so starting with 0x44200
diff --git a/drivers/gpu/drm/i915/gvt/vgpu.c b/drivers/gpu/drm/i915/gvt/vgpu.c
index a4e8e3cf74fd..c628be05fbfe 100644
--- a/drivers/gpu/drm/i915/gvt/vgpu.c
+++ b/drivers/gpu/drm/i915/gvt/vgpu.c
@@ -281,6 +281,7 @@ void intel_gvt_destroy_vgpu(struct intel_vgpu *vgpu)
        intel_vgpu_clean_submission(vgpu);
        intel_vgpu_clean_display(vgpu);
        intel_vgpu_clean_opregion(vgpu);
+        intel_vgpu_reset_ggtt(vgpu, true);
        intel_vgpu_clean_gtt(vgpu);
        intel_gvt_hypervisor_detach_vgpu(vgpu);
        intel_vgpu_free_resource(vgpu);
diff --git a/drivers/gpu/drm/pl111/pl111_vexpress.c b/drivers/gpu/drm/pl111/pl111_vexpress.c
index a534b225e31b..5fa0441bb6df 100644
--- a/drivers/gpu/drm/pl111/pl111_vexpress.c
+++ b/drivers/gpu/drm/pl111/pl111_vexpress.c
@@ -111,7 +111,8 @@ static int vexpress_muxfpga_probe(struct platform_device *pdev)
 }
 static const struct of_device_id vexpress_muxfpga_match[] = {
-        { .compatible = "arm,vexpress-muxfpga", }
+        { .compatible = "arm,vexpress-muxfpga", },
+        {}
 };
 static struct platform_driver vexpress_muxfpga_driver = {
diff --git a/drivers/gpu/drm/sun4i/sun4i_drv.c b/drivers/gpu/drm/sun4i/sun4i_drv.c
index dd19d674055c..8b0cd08034e0 100644
--- a/drivers/gpu/drm/sun4i/sun4i_drv.c
+++ b/drivers/gpu/drm/sun4i/sun4i_drv.c
@@ -418,7 +418,6 @@ static const struct of_device_id sun4i_drv_of_table[] = {
        { .compatible = "allwinner,sun8i-a33-display-engine" },
        { .compatible = "allwinner,sun8i-a83t-display-engine" },
        { .compatible = "allwinner,sun8i-h3-display-engine" },
-        { .compatible = "allwinner,sun8i-r40-display-engine" },
        { .compatible = "allwinner,sun8i-v3s-display-engine" },
        { .compatible = "allwinner,sun9i-a80-display-engine" },
        { }
diff --git a/drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c b/drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c
index 82502b351aec..a564b5dfe082 100644
--- a/drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c
+++ b/drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c
@@ -398,7 +398,6 @@ static struct regmap_config sun8i_hdmi_phy_regmap_config = {
 static const struct sun8i_hdmi_phy_variant sun50i_a64_hdmi_phy = {
        .has_phy_clk = true,
-        .has_second_pll = true,
        .phy_init = &sun8i_hdmi_phy_init_h3,
        .phy_disable = &sun8i_hdmi_phy_disable_h3,
        .phy_config = &sun8i_hdmi_phy_config_h3,
diff --git a/drivers/gpu/drm/sun4i/sun8i_mixer.c b/drivers/gpu/drm/sun4i/sun8i_mixer.c
index fc3713608f78..cb65b0ed53fd 100644
--- a/drivers/gpu/drm/sun4i/sun8i_mixer.c
+++ b/drivers/gpu/drm/sun4i/sun8i_mixer.c
@@ -545,22 +545,6 @@ static const struct sun8i_mixer_cfg sun8i_h3_mixer0_cfg = {
        .vi_num         = 1,
 };
-static const struct sun8i_mixer_cfg sun8i_r40_mixer0_cfg = {
-        .ccsc           = 0,
-        .mod_rate       = 297000000,
-        .scaler_mask    = 0xf,
-        .ui_num         = 3,
-        .vi_num         = 1,
-};
-static const struct sun8i_mixer_cfg sun8i_r40_mixer1_cfg = {
-        .ccsc           = 1,
-        .mod_rate       = 297000000,
-        .scaler_mask    = 0x3,
-        .ui_num         = 1,
-        .vi_num         = 1,
-};
 static const struct sun8i_mixer_cfg sun8i_v3s_mixer_cfg = {
        .vi_num = 2,
        .ui_num = 1,
@@ -583,14 +567,6 @@ static const struct of_device_id sun8i_mixer_of_table[] = {
                .data = &sun8i_h3_mixer0_cfg,
        },
        {
-                .compatible = "allwinner,sun8i-r40-de2-mixer-0",
-                .data = &sun8i_r40_mixer0_cfg,
-        },
-        {
-                .compatible = "allwinner,sun8i-r40-de2-mixer-1",
-                .data = &sun8i_r40_mixer1_cfg,
-        },
-        {
                .compatible = "allwinner,sun8i-v3s-de2-mixer",
                .data = &sun8i_v3s_mixer_cfg,
        },
diff --git a/drivers/gpu/drm/sun4i/sun8i_tcon_top.c b/drivers/gpu/drm/sun4i/sun8i_tcon_top.c
index 55fe398d8290..d5240b777a8f 100644
--- a/drivers/gpu/drm/sun4i/sun8i_tcon_top.c
+++ b/drivers/gpu/drm/sun4i/sun8i_tcon_top.c
@@ -253,7 +253,6 @@ static int sun8i_tcon_top_remove(struct platform_device *pdev)
 /* sun4i_drv uses this list to check if a device node is a TCON TOP */
 const struct of_device_id sun8i_tcon_top_of_table[] = {
-        { .compatible = "allwinner,sun8i-r40-tcon-top" },
        { /* sentinel */ }
 };
 MODULE_DEVICE_TABLE(of, sun8i_tcon_top_of_table);
diff --git a/drivers/gpu/drm/udl/udl_fb.c b/drivers/gpu/drm/udl/udl_fb.c
index dbb62f6eb48a..dd9ffded223b 100644
--- a/drivers/gpu/drm/udl/udl_fb.c
+++ b/drivers/gpu/drm/udl/udl_fb.c
@@ -432,9 +432,11 @@ static void udl_fbdev_destroy(struct drm_device *dev,
 {
        drm_fb_helper_unregister_fbi(&ufbdev->helper);
        drm_fb_helper_fini(&ufbdev->helper);
-        drm_framebuffer_unregister_private(&ufbdev->ufb.base);
+        if (ufbdev->ufb.obj) {
-        drm_framebuffer_cleanup(&ufbdev->ufb.base);
+                drm_framebuffer_unregister_private(&ufbdev->ufb.base);
-        drm_gem_object_put_unlocked(&ufbdev->ufb.obj->base);
+                drm_framebuffer_cleanup(&ufbdev->ufb.base);
+                drm_gem_object_put_unlocked(&ufbdev->ufb.obj->base);
+        }
 }
 int udl_fbdev_init(struct drm_device *dev)
diff --git a/drivers/gpu/drm/vc4/vc4_plane.c b/drivers/gpu/drm/vc4/vc4_plane.c
index cfb50fedfa2b..a3275fa66b7b 100644
--- a/drivers/gpu/drm/vc4/vc4_plane.c
+++ b/drivers/gpu/drm/vc4/vc4_plane.c
@@ -297,6 +297,9 @@ static int vc4_plane_setup_clipping_and_scaling(struct drm_plane_state *state)
        vc4_state->y_scaling[0] = vc4_get_scaling_mode(vc4_state->src_h[0],
                                                       vc4_state->crtc_h);
+        vc4_state->is_unity = (vc4_state->x_scaling[0] == VC4_SCALING_NONE &&
+                               vc4_state->y_scaling[0] == VC4_SCALING_NONE);
        if (num_planes > 1) {
                vc4_state->is_yuv = true;
@@ -312,24 +315,17 @@ static int vc4_plane_setup_clipping_and_scaling(struct drm_plane_state *state)
                        vc4_get_scaling_mode(vc4_state->src_h[1],
                                             vc4_state->crtc_h);
-                /* YUV conversion requires that scaling be enabled,
+                /* YUV conversion requires that horizontal scaling be enabled,
-                 * even on a plane that's otherwise 1:1.  Choose TPZ
+                 * even on a plane that's otherwise 1:1. Looks like only PPF
-                 * for simplicity.
+                 * works in that case, so let's pick that one.
                 */
-                if (vc4_state->x_scaling[0] == VC4_SCALING_NONE)
+                if (vc4_state->is_unity)
-                        vc4_state->x_scaling[0] = VC4_SCALING_TPZ;
+                        vc4_state->x_scaling[0] = VC4_SCALING_PPF;
-                if (vc4_state->y_scaling[0] == VC4_SCALING_NONE)
-                        vc4_state->y_scaling[0] = VC4_SCALING_TPZ;
        } else {
                vc4_state->x_scaling[1] = VC4_SCALING_NONE;
                vc4_state->y_scaling[1] = VC4_SCALING_NONE;
        }
-        vc4_state->is_unity = (vc4_state->x_scaling[0] == VC4_SCALING_NONE &&
-                               vc4_state->y_scaling[0] == VC4_SCALING_NONE &&
-                               vc4_state->x_scaling[1] == VC4_SCALING_NONE &&
-                               vc4_state->y_scaling[1] == VC4_SCALING_NONE);
        /* No configuring scaling on the cursor plane, since it gets
           non-vblank-synced updates, and scaling requires requires
           LBM changes which have to be vblank-synced.
@@ -672,7 +668,10 @@ static int vc4_plane_mode_set(struct drm_plane *plane,
                vc4_dlist_write(vc4_state, SCALER_CSC2_ITR_R_601_5);
        }
-        if (!vc4_state->is_unity) {
+        if (vc4_state->x_scaling[0] != VC4_SCALING_NONE ||
+            vc4_state->x_scaling[1] != VC4_SCALING_NONE ||
+            vc4_state->y_scaling[0] != VC4_SCALING_NONE ||
+            vc4_state->y_scaling[1] != VC4_SCALING_NONE) {
                /* LBM Base Address. */
                if (vc4_state->y_scaling[0] != VC4_SCALING_NONE ||
                    vc4_state->y_scaling[1] != VC4_SCALING_NONE) {
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
index 1f134570b759..f0ab6b2313bb 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
@@ -3729,7 +3729,7 @@ int vmw_validate_single_buffer(struct vmw_private *dev_priv,
 {
        struct vmw_buffer_object *vbo =
                container_of(bo, struct vmw_buffer_object, base);
-        struct ttm_operation_ctx ctx = { interruptible, true };
+        struct ttm_operation_ctx ctx = { interruptible, false };
        int ret;
        if (vbo->pin_count > 0)
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
index 23beff5d8e3c..6a712a8d59e9 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
@@ -1512,21 +1512,19 @@ static int vmw_kms_check_display_memory(struct drm_device *dev,
                                        struct drm_rect *rects)
 {
        struct vmw_private *dev_priv = vmw_priv(dev);
-        struct drm_mode_config *mode_config = &dev->mode_config;
        struct drm_rect bounding_box = {0};
        u64 total_pixels = 0, pixel_mem, bb_mem;
        int i;
        for (i = 0; i < num_rects; i++) {
                /*
-                 * Currently this check is limiting the topology within max
+                 * For STDU only individual screen (screen target) is limited by
-                 * texture/screentarget size. This should change in future when
+                 * SCREENTARGET_MAX_WIDTH/HEIGHT registers.
-                 * user-space support multiple fb with topology.
                 */
-                if (rects[i].x1 < 0 ||  rects[i].y1 < 0 ||
+                if (dev_priv->active_display_unit == vmw_du_screen_target &&
-                    rects[i].x2 > mode_config->max_width ||
+                    (drm_rect_width(&rects[i]) > dev_priv->stdu_max_width ||
-                    rects[i].y2 > mode_config->max_height) {
+                     drm_rect_height(&rects[i]) > dev_priv->stdu_max_height)) {
-                        DRM_ERROR("Invalid GUI layout.\n");
+                        DRM_ERROR("Screen size not supported.\n");
                        return -EINVAL;
                }
@@ -1615,7 +1613,7 @@ static int vmw_kms_check_topology(struct drm_device *dev,
                struct drm_connector_state *conn_state;
                struct vmw_connector_state *vmw_conn_state;
-                if (!new_crtc_state->enable && old_crtc_state->enable) {
+                if (!new_crtc_state->enable) {
                        rects[i].x1 = 0;
                        rects[i].y1 = 0;
                        rects[i].x2 = 0;
@@ -2216,12 +2214,16 @@ int vmw_du_connector_fill_modes(struct drm_connector *connector,
        if (dev_priv->assume_16bpp)
                assumed_bpp = 2;
+        max_width  = min(max_width,  dev_priv->texture_max_width);
+        max_height = min(max_height, dev_priv->texture_max_height);
+        /*
+         * For STDU extra limit for a mode on SVGA_REG_SCREENTARGET_MAX_WIDTH/
+         * HEIGHT registers.
+         */
        if (dev_priv->active_display_unit == vmw_du_screen_target) {
                max_width  = min(max_width,  dev_priv->stdu_max_width);
-                max_width  = min(max_width,  dev_priv->texture_max_width);
                max_height = min(max_height, dev_priv->stdu_max_height);
-                max_height = min(max_height, dev_priv->texture_max_height);
        }
        /* Add preferred mode */
@@ -2376,6 +2378,7 @@ int vmw_kms_update_layout_ioctl(struct drm_device *dev, void *data,
                                struct drm_file *file_priv)
 {
        struct vmw_private *dev_priv = vmw_priv(dev);
+        struct drm_mode_config *mode_config = &dev->mode_config;
        struct drm_vmw_update_layout_arg *arg =
                (struct drm_vmw_update_layout_arg *)data;
        void __user *user_rects;
@@ -2421,6 +2424,21 @@ int vmw_kms_update_layout_ioctl(struct drm_device *dev, void *data,
                drm_rects[i].y1 = curr_rect.y;
                drm_rects[i].x2 = curr_rect.x + curr_rect.w;
                drm_rects[i].y2 = curr_rect.y + curr_rect.h;
+                /*
+                 * Currently this check is limiting the topology within
+                 * mode_config->max (which actually is max texture size
+                 * supported by virtual device). This limit is here to address
+                 * window managers that create a big framebuffer for whole
+                 * topology.
+                 */
+                if (drm_rects[i].x1 < 0 ||  drm_rects[i].y1 < 0 ||
+                    drm_rects[i].x2 > mode_config->max_width ||
+                    drm_rects[i].y2 > mode_config->max_height) {
+                        DRM_ERROR("Invalid GUI layout.\n");
+                        ret = -EINVAL;
+                        goto out_free;
+                }
        }
        ret = vmw_kms_check_display_memory(dev, arg->num_outputs, drm_rects);
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c b/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c
index 93f6b96ca7bb..f30e839f7bfd 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c
@@ -1600,31 +1600,6 @@ int vmw_kms_stdu_init_display(struct vmw_private *dev_priv)
        dev_priv->active_display_unit = vmw_du_screen_target;
-        if (dev_priv->capabilities & SVGA_CAP_3D) {
-                /*
-                 * For 3D VMs, display (scanout) buffer size is the smaller of
-                 * max texture and max STDU
-                 */
-                uint32_t max_width, max_height;
-                max_width = min(dev_priv->texture_max_width,
-                                dev_priv->stdu_max_width);
-                max_height = min(dev_priv->texture_max_height,
-                                 dev_priv->stdu_max_height);
-                dev->mode_config.max_width = max_width;
-                dev->mode_config.max_height = max_height;
-        } else {
-                /*
-                 * Given various display aspect ratios, there's no way to
-                 * estimate these using prim_bb_mem.  So just set these to
-                 * something arbitrarily large and we will reject any layout
-                 * that doesn't fit prim_bb_mem later
-                 */
-                dev->mode_config.max_width = 8192;
-                dev->mode_config.max_height = 8192;
-        }
        vmw_kms_create_implicit_placement_property(dev_priv, false);
        for (i = 0; i < VMWGFX_NUM_DISPLAY_UNITS; ++i) {
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
index e125233e074b..80a01cd4c051 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
@@ -1404,22 +1404,17 @@ int vmw_surface_gb_priv_define(struct drm_device *dev,
        *srf_out = NULL;
        if (for_scanout) {
-                uint32_t max_width, max_height;
                if (!svga3dsurface_is_screen_target_format(format)) {
                        DRM_ERROR("Invalid Screen Target surface format.");
                        return -EINVAL;
                }
-                max_width = min(dev_priv->texture_max_width,
+                if (size.width > dev_priv->texture_max_width ||
-                                dev_priv->stdu_max_width);
+                    size.height > dev_priv->texture_max_height) {
-                max_height = min(dev_priv->texture_max_height,
-                                 dev_priv->stdu_max_height);
-                if (size.width > max_width || size.height > max_height) {
                        DRM_ERROR("%ux%u\n, exceeds max surface size %ux%u",
                                  size.width, size.height,
-                                  max_width, max_height);
+                                  dev_priv->texture_max_width,
+                                  dev_priv->texture_max_height);
                        return -EINVAL;
                }
        } else {
@@ -1495,8 +1490,17 @@ int vmw_surface_gb_priv_define(struct drm_device *dev,
        if (srf->flags & SVGA3D_SURFACE_BIND_STREAM_OUTPUT)
                srf->res.backup_size += sizeof(SVGA3dDXSOState);
+        /*
+         * Don't set SVGA3D_SURFACE_SCREENTARGET flag for a scanout surface with
+         * size greater than STDU max width/height. This is really a workaround
+         * to support creation of big framebuffer requested by some user-space
+         * for whole topology. That big framebuffer won't really be used for
+         * binding with screen target as during prepare_fb a separate surface is
+         * created so it's safe to ignore SVGA3D_SURFACE_SCREENTARGET flag.
+         */
        if (dev_priv->active_display_unit == vmw_du_screen_target &&
-            for_scanout)
+            for_scanout && size.width <= dev_priv->stdu_max_width &&
+            size.height <= dev_priv->stdu_max_height)
                srf->flags |= SVGA3D_SURFACE_SCREENTARGET;
        /*
diff --git a/drivers/gpu/vga/vga_switcheroo.c b/drivers/gpu/vga/vga_switcheroo.c
index a96bf46bc483..cf2a18571d48 100644
--- a/drivers/gpu/vga/vga_switcheroo.c
+++ b/drivers/gpu/vga/vga_switcheroo.c
@@ -215,6 +215,8 @@ static void vga_switcheroo_enable(void)
                        return;
                client->id = ret | ID_BIT_AUDIO;
+                if (client->ops->gpu_bound)
+                        client->ops->gpu_bound(client->pdev, ret);
        }
        vga_switcheroo_debugfs_init(&vgasr_priv);
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 5146ee029db4..bc49909aba8e 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -976,7 +976,6 @@
 #define USB_DEVICE_ID_SIS817_TOUCH      0x0817
 #define USB_DEVICE_ID_SIS_TS            0x1013
 #define USB_DEVICE_ID_SIS1030_TOUCH     0x1030
-#define USB_DEVICE_ID_SIS10FB_TOUCH     0x10fb
 #define USB_VENDOR_ID_SKYCABLE                  0x1223
 #define USB_DEVICE_ID_SKYCABLE_WIRELESS_PRESENTER       0x3F07
diff --git a/drivers/hid/i2c-hid/i2c-hid.c b/drivers/hid/i2c-hid/i2c-hid.c
index f3076659361a..4e3592e7a3f7 100644
--- a/drivers/hid/i2c-hid/i2c-hid.c
+++ b/drivers/hid/i2c-hid/i2c-hid.c
@@ -47,7 +47,7 @@
 /* quirks to control the device */
 #define I2C_HID_QUIRK_SET_PWR_WAKEUP_DEV        BIT(0)
 #define I2C_HID_QUIRK_NO_IRQ_AFTER_RESET        BIT(1)
-#define I2C_HID_QUIRK_RESEND_REPORT_DESCR       BIT(2)
+#define I2C_HID_QUIRK_NO_RUNTIME_PM             BIT(2)
 /* flags */
 #define I2C_HID_STARTED         0
@@ -169,9 +169,8 @@ static const struct i2c_hid_quirks {
        { USB_VENDOR_ID_WEIDA, USB_DEVICE_ID_WEIDA_8755,
                I2C_HID_QUIRK_SET_PWR_WAKEUP_DEV },
        { I2C_VENDOR_ID_HANTICK, I2C_PRODUCT_ID_HANTICK_5288,
-                I2C_HID_QUIRK_NO_IRQ_AFTER_RESET },
+                I2C_HID_QUIRK_NO_IRQ_AFTER_RESET |
-        { USB_VENDOR_ID_SIS_TOUCH, USB_DEVICE_ID_SIS10FB_TOUCH,
+                I2C_HID_QUIRK_NO_RUNTIME_PM },
-                I2C_HID_QUIRK_RESEND_REPORT_DESCR },
        { 0, 0 }
 };
@@ -1105,7 +1104,9 @@ static int i2c_hid_probe(struct i2c_client *client,
                goto err_mem_free;
        }
-        pm_runtime_put(&client->dev);
+        if (!(ihid->quirks & I2C_HID_QUIRK_NO_RUNTIME_PM))
+                pm_runtime_put(&client->dev);
        return 0;
 err_mem_free:
@@ -1130,7 +1131,8 @@ static int i2c_hid_remove(struct i2c_client *client)
        struct i2c_hid *ihid = i2c_get_clientdata(client);
        struct hid_device *hid;
-        pm_runtime_get_sync(&client->dev);
+        if (!(ihid->quirks & I2C_HID_QUIRK_NO_RUNTIME_PM))
+                pm_runtime_get_sync(&client->dev);
        pm_runtime_disable(&client->dev);
        pm_runtime_set_suspended(&client->dev);
        pm_runtime_put_noidle(&client->dev);
@@ -1236,22 +1238,13 @@ static int i2c_hid_resume(struct device *dev)
        /* Instead of resetting device, simply powers the device on. This
         * solves "incomplete reports" on Raydium devices 2386:3118 and
-         * 2386:4B33
+         * 2386:4B33 and fixes various SIS touchscreens no longer sending
+         * data after a suspend/resume.
         */
        ret = i2c_hid_set_power(client, I2C_HID_PWR_ON);
        if (ret)
                return ret;
-        /* Some devices need to re-send report descr cmd
-         * after resume, after this it will be back normal.
-         * otherwise it issues too many incomplete reports.
-         */
-        if (ihid->quirks & I2C_HID_QUIRK_RESEND_REPORT_DESCR) {
-                ret = i2c_hid_command(client, &hid_report_descr_cmd, NULL, 0);
-                if (ret)
-                        return ret;
-        }
        if (hid->driver && hid->driver->reset_resume) {
                ret = hid->driver->reset_resume(hid);
                return ret;
diff --git a/drivers/hid/intel-ish-hid/ipc/hw-ish.h b/drivers/hid/intel-ish-hid/ipc/hw-ish.h
index da133716bed0..08a8327dfd22 100644
--- a/drivers/hid/intel-ish-hid/ipc/hw-ish.h
+++ b/drivers/hid/intel-ish-hid/ipc/hw-ish.h
@@ -29,6 +29,7 @@
 #define CNL_Ax_DEVICE_ID        0x9DFC
 #define GLK_Ax_DEVICE_ID        0x31A2
 #define CNL_H_DEVICE_ID         0xA37C
+#define ICL_MOBILE_DEVICE_ID    0x34FC
 #define SPT_H_DEVICE_ID         0xA135
 #define REVISION_ID_CHT_A0      0x6
diff --git a/drivers/hid/intel-ish-hid/ipc/pci-ish.c b/drivers/hid/intel-ish-hid/ipc/pci-ish.c
index a1125a5c7965..256b3016116c 100644
--- a/drivers/hid/intel-ish-hid/ipc/pci-ish.c
+++ b/drivers/hid/intel-ish-hid/ipc/pci-ish.c
@@ -38,6 +38,7 @@ static const struct pci_device_id ish_pci_tbl[] = {
        {PCI_DEVICE(PCI_VENDOR_ID_INTEL, CNL_Ax_DEVICE_ID)},
        {PCI_DEVICE(PCI_VENDOR_ID_INTEL, GLK_Ax_DEVICE_ID)},
        {PCI_DEVICE(PCI_VENDOR_ID_INTEL, CNL_H_DEVICE_ID)},
+        {PCI_DEVICE(PCI_VENDOR_ID_INTEL, ICL_MOBILE_DEVICE_ID)},
        {PCI_DEVICE(PCI_VENDOR_ID_INTEL, SPT_H_DEVICE_ID)},
        {0, }
 };
diff --git a/drivers/hwmon/nct6775.c b/drivers/hwmon/nct6775.c
index 944f5b63aecd..78603b78cf41 100644
--- a/drivers/hwmon/nct6775.c
+++ b/drivers/hwmon/nct6775.c
@@ -207,8 +207,6 @@ superio_exit(int ioreg)
 #define NUM_FAN         7
-#define TEMP_SOURCE_VIRTUAL     0x1f
 /* Common and NCT6775 specific data */
 /* Voltage min/max registers for nr=7..14 are in bank 5 */
@@ -299,8 +297,9 @@ static const u16 NCT6775_REG_PWM_READ[] = {
 static const u16 NCT6775_REG_FAN[] = { 0x630, 0x632, 0x634, 0x636, 0x638 };
 static const u16 NCT6775_REG_FAN_MIN[] = { 0x3b, 0x3c, 0x3d };
-static const u16 NCT6775_REG_FAN_PULSES[] = { 0x641, 0x642, 0x643, 0x644, 0 };
+static const u16 NCT6775_REG_FAN_PULSES[NUM_FAN] = {
-static const u16 NCT6775_FAN_PULSE_SHIFT[] = { 0, 0, 0, 0, 0, 0 };
+        0x641, 0x642, 0x643, 0x644 };
+static const u16 NCT6775_FAN_PULSE_SHIFT[NUM_FAN] = { };
 static const u16 NCT6775_REG_TEMP[] = {
        0x27, 0x150, 0x250, 0x62b, 0x62c, 0x62d };
@@ -373,6 +372,7 @@ static const char *const nct6775_temp_label[] = {
 };
 #define NCT6775_TEMP_MASK       0x001ffffe
+#define NCT6775_VIRT_TEMP_MASK  0x00000000
 static const u16 NCT6775_REG_TEMP_ALTERNATE[32] = {
        [13] = 0x661,
@@ -425,8 +425,8 @@ static const u8 NCT6776_PWM_MODE_MASK[] = { 0x01, 0, 0, 0, 0, 0 };
 static const u16 NCT6776_REG_FAN_MIN[] = {
        0x63a, 0x63c, 0x63e, 0x640, 0x642, 0x64a, 0x64c };
-static const u16 NCT6776_REG_FAN_PULSES[] = {
+static const u16 NCT6776_REG_FAN_PULSES[NUM_FAN] = {
-        0x644, 0x645, 0x646, 0x647, 0x648, 0x649, 0 };
+        0x644, 0x645, 0x646, 0x647, 0x648, 0x649 };
 static const u16 NCT6776_REG_WEIGHT_DUTY_BASE[] = {
        0x13e, 0x23e, 0x33e, 0x83e, 0x93e, 0xa3e };
@@ -461,6 +461,7 @@ static const char *const nct6776_temp_label[] = {
 };
 #define NCT6776_TEMP_MASK       0x007ffffe
+#define NCT6776_VIRT_TEMP_MASK  0x00000000
 static const u16 NCT6776_REG_TEMP_ALTERNATE[32] = {
        [14] = 0x401,
@@ -501,9 +502,9 @@ static const s8 NCT6779_BEEP_BITS[] = {
        30, 31 };                       /* intrusion0, intrusion1 */
 static const u16 NCT6779_REG_FAN[] = {
-        0x4b0, 0x4b2, 0x4b4, 0x4b6, 0x4b8, 0x4ba, 0x660 };
+        0x4c0, 0x4c2, 0x4c4, 0x4c6, 0x4c8, 0x4ca, 0x4ce };
-static const u16 NCT6779_REG_FAN_PULSES[] = {
+static const u16 NCT6779_REG_FAN_PULSES[NUM_FAN] = {
-        0x644, 0x645, 0x646, 0x647, 0x648, 0x649, 0 };
+        0x644, 0x645, 0x646, 0x647, 0x648, 0x649 };
 static const u16 NCT6779_REG_CRITICAL_PWM_ENABLE[] = {
        0x136, 0x236, 0x336, 0x836, 0x936, 0xa36, 0xb36 };
@@ -559,7 +560,9 @@ static const char *const nct6779_temp_label[] = {
 };
 #define NCT6779_TEMP_MASK       0x07ffff7e
+#define NCT6779_VIRT_TEMP_MASK  0x00000000
 #define NCT6791_TEMP_MASK       0x87ffff7e
+#define NCT6791_VIRT_TEMP_MASK  0x80000000
 static const u16 NCT6779_REG_TEMP_ALTERNATE[32]
        = { 0x490, 0x491, 0x492, 0x493, 0x494, 0x495, 0, 0,
@@ -638,6 +641,7 @@ static const char *const nct6792_temp_label[] = {
 };
 #define NCT6792_TEMP_MASK       0x9fffff7e
+#define NCT6792_VIRT_TEMP_MASK  0x80000000
 static const char *const nct6793_temp_label[] = {
        "",
@@ -675,6 +679,7 @@ static const char *const nct6793_temp_label[] = {
 };
 #define NCT6793_TEMP_MASK       0xbfff037e
+#define NCT6793_VIRT_TEMP_MASK  0x80000000
 static const char *const nct6795_temp_label[] = {
        "",
@@ -712,6 +717,7 @@ static const char *const nct6795_temp_label[] = {
 };
 #define NCT6795_TEMP_MASK       0xbfffff7e
+#define NCT6795_VIRT_TEMP_MASK  0x80000000
 static const char *const nct6796_temp_label[] = {
        "",
@@ -724,8 +730,8 @@ static const char *const nct6796_temp_label[] = {
        "AUXTIN4",
        "SMBUSMASTER 0",
        "SMBUSMASTER 1",
-        "",
+        "Virtual_TEMP",
-        "",
+        "Virtual_TEMP",
        "",
        "",
        "",
@@ -748,7 +754,8 @@ static const char *const nct6796_temp_label[] = {
        "Virtual_TEMP"
 };
-#define NCT6796_TEMP_MASK       0xbfff03fe
+#define NCT6796_TEMP_MASK       0xbfff0ffe
+#define NCT6796_VIRT_TEMP_MASK  0x80000c00
 /* NCT6102D/NCT6106D specific data */
@@ -779,8 +786,8 @@ static const u16 NCT6106_REG_TEMP_CONFIG[] = {
 static const u16 NCT6106_REG_FAN[] = { 0x20, 0x22, 0x24 };
 static const u16 NCT6106_REG_FAN_MIN[] = { 0xe0, 0xe2, 0xe4 };
-static const u16 NCT6106_REG_FAN_PULSES[] = { 0xf6, 0xf6, 0xf6, 0, 0 };
+static const u16 NCT6106_REG_FAN_PULSES[] = { 0xf6, 0xf6, 0xf6 };
-static const u16 NCT6106_FAN_PULSE_SHIFT[] = { 0, 2, 4, 0, 0 };
+static const u16 NCT6106_FAN_PULSE_SHIFT[] = { 0, 2, 4 };
 static const u8 NCT6106_REG_PWM_MODE[] = { 0xf3, 0xf3, 0xf3 };
 static const u8 NCT6106_PWM_MODE_MASK[] = { 0x01, 0x02, 0x04 };
@@ -917,6 +924,11 @@ static unsigned int fan_from_reg16(u16 reg, unsigned int divreg)
        return 1350000U / (reg << divreg);
 }
+static unsigned int fan_from_reg_rpm(u16 reg, unsigned int divreg)
+{
+        return reg;
+}
 static u16 fan_to_reg(u32 fan, unsigned int divreg)
 {
        if (!fan)
@@ -969,6 +981,7 @@ struct nct6775_data {
        u16 reg_temp_config[NUM_TEMP];
        const char * const *temp_label;
        u32 temp_mask;
+        u32 virt_temp_mask;
        u16 REG_CONFIG;
        u16 REG_VBAT;
@@ -1276,11 +1289,11 @@ static bool is_word_sized(struct nct6775_data *data, u16 reg)
        case nct6795:
        case nct6796:
                return reg == 0x150 || reg == 0x153 || reg == 0x155 ||
-                  ((reg & 0xfff0) == 0x4b0 && (reg & 0x000f) < 0x0b) ||
+                  (reg & 0xfff0) == 0x4c0 ||
                  reg == 0x402 ||
                  reg == 0x63a || reg == 0x63c || reg == 0x63e ||
                  reg == 0x640 || reg == 0x642 || reg == 0x64a ||
-                  reg == 0x64c || reg == 0x660 ||
+                  reg == 0x64c ||
                  reg == 0x73 || reg == 0x75 || reg == 0x77 || reg == 0x79 ||
                  reg == 0x7b || reg == 0x7d;
        }
@@ -1558,7 +1571,7 @@ static void nct6775_update_pwm(struct device *dev)
                reg = nct6775_read_value(data, data->REG_WEIGHT_TEMP_SEL[i]);
                data->pwm_weight_temp_sel[i] = reg & 0x1f;
                /* If weight is disabled, report weight source as 0 */
-                if (j == 1 && !(reg & 0x80))
+                if (!(reg & 0x80))
                        data->pwm_weight_temp_sel[i] = 0;
                /* Weight temp data */
@@ -1682,9 +1695,13 @@ static struct nct6775_data *nct6775_update_device(struct device *dev)
                        if (data->has_fan_min & BIT(i))
                                data->fan_min[i] = nct6775_read_value(data,
                                           data->REG_FAN_MIN[i]);
-                        data->fan_pulses[i] =
-                          (nct6775_read_value(data, data->REG_FAN_PULSES[i])
+                        if (data->REG_FAN_PULSES[i]) {
-                                >> data->FAN_PULSE_SHIFT[i]) & 0x03;
+                                data->fan_pulses[i] =
+                                  (nct6775_read_value(data,
+                                                      data->REG_FAN_PULSES[i])
+                                   >> data->FAN_PULSE_SHIFT[i]) & 0x03;
+                        }
                        nct6775_select_fan_div(dev, data, i, reg);
                }
@@ -3639,6 +3656,7 @@ static int nct6775_probe(struct platform_device *pdev)
                data->temp_label = nct6776_temp_label;
                data->temp_mask = NCT6776_TEMP_MASK;
+                data->virt_temp_mask = NCT6776_VIRT_TEMP_MASK;
                data->REG_VBAT = NCT6106_REG_VBAT;
                data->REG_DIODE = NCT6106_REG_DIODE;
@@ -3717,6 +3735,7 @@ static int nct6775_probe(struct platform_device *pdev)
                data->temp_label = nct6775_temp_label;
                data->temp_mask = NCT6775_TEMP_MASK;
+                data->virt_temp_mask = NCT6775_VIRT_TEMP_MASK;
                data->REG_CONFIG = NCT6775_REG_CONFIG;
                data->REG_VBAT = NCT6775_REG_VBAT;
@@ -3789,6 +3808,7 @@ static int nct6775_probe(struct platform_device *pdev)
                data->temp_label = nct6776_temp_label;
                data->temp_mask = NCT6776_TEMP_MASK;
+                data->virt_temp_mask = NCT6776_VIRT_TEMP_MASK;
                data->REG_CONFIG = NCT6775_REG_CONFIG;
                data->REG_VBAT = NCT6775_REG_VBAT;
@@ -3853,7 +3873,7 @@ static int nct6775_probe(struct platform_device *pdev)
                data->ALARM_BITS = NCT6779_ALARM_BITS;
                data->BEEP_BITS = NCT6779_BEEP_BITS;
-                data->fan_from_reg = fan_from_reg13;
+                data->fan_from_reg = fan_from_reg_rpm;
                data->fan_from_reg_min = fan_from_reg13;
                data->target_temp_mask = 0xff;
                data->tolerance_mask = 0x07;
@@ -3861,6 +3881,7 @@ static int nct6775_probe(struct platform_device *pdev)
                data->temp_label = nct6779_temp_label;
                data->temp_mask = NCT6779_TEMP_MASK;
+                data->virt_temp_mask = NCT6779_VIRT_TEMP_MASK;
                data->REG_CONFIG = NCT6775_REG_CONFIG;
                data->REG_VBAT = NCT6775_REG_VBAT;
@@ -3933,7 +3954,7 @@ static int nct6775_probe(struct platform_device *pdev)
                data->ALARM_BITS = NCT6791_ALARM_BITS;
                data->BEEP_BITS = NCT6779_BEEP_BITS;
-                data->fan_from_reg = fan_from_reg13;
+                data->fan_from_reg = fan_from_reg_rpm;
                data->fan_from_reg_min = fan_from_reg13;
                data->target_temp_mask = 0xff;
                data->tolerance_mask = 0x07;
@@ -3944,22 +3965,27 @@ static int nct6775_probe(struct platform_device *pdev)
                case nct6791:
                        data->temp_label = nct6779_temp_label;
                        data->temp_mask = NCT6791_TEMP_MASK;
+                        data->virt_temp_mask = NCT6791_VIRT_TEMP_MASK;
                        break;
                case nct6792:
                        data->temp_label = nct6792_temp_label;
                        data->temp_mask = NCT6792_TEMP_MASK;
+                        data->virt_temp_mask = NCT6792_VIRT_TEMP_MASK;
                        break;
                case nct6793:
                        data->temp_label = nct6793_temp_label;
                        data->temp_mask = NCT6793_TEMP_MASK;
+                        data->virt_temp_mask = NCT6793_VIRT_TEMP_MASK;
                        break;
                case nct6795:
                        data->temp_label = nct6795_temp_label;
                        data->temp_mask = NCT6795_TEMP_MASK;
+                        data->virt_temp_mask = NCT6795_VIRT_TEMP_MASK;
                        break;
                case nct6796:
                        data->temp_label = nct6796_temp_label;
                        data->temp_mask = NCT6796_TEMP_MASK;
+                        data->virt_temp_mask = NCT6796_VIRT_TEMP_MASK;
                        break;
                }
@@ -4143,7 +4169,7 @@ static int nct6775_probe(struct platform_device *pdev)
                 * for each fan reflects a different temperature, and there
                 * are no duplicates.
                 */
-                if (src != TEMP_SOURCE_VIRTUAL) {
+                if (!(data->virt_temp_mask & BIT(src))) {
                        if (mask & BIT(src))
                                continue;
                        mask |= BIT(src);
diff --git a/drivers/hwtracing/intel_th/core.c b/drivers/hwtracing/intel_th/core.c
index da962aa2cef5..fc6b7f8b62fb 100644
--- a/drivers/hwtracing/intel_th/core.c
+++ b/drivers/hwtracing/intel_th/core.c
@@ -139,7 +139,8 @@ static int intel_th_remove(struct device *dev)
                        th->thdev[i] = NULL;
                }
-                th->num_thdevs = lowest;
+                if (lowest >= 0)
+                        th->num_thdevs = lowest;
        }
        if (thdrv->attr_group)
@@ -487,7 +488,7 @@ static const struct intel_th_subdevice {
                                .flags  = IORESOURCE_MEM,
                        },
                        {
-                                .start  = TH_MMIO_SW,
+                                .start  = 1, /* use resource[1] */
                                .end    = 0,
                                .flags  = IORESOURCE_MEM,
                        },
@@ -580,6 +581,7 @@ intel_th_subdevice_alloc(struct intel_th *th,
        struct intel_th_device *thdev;
        struct resource res[3];
        unsigned int req = 0;
+        bool is64bit = false;
        int r, err;
        thdev = intel_th_device_alloc(th, subdev->type, subdev->name,
@@ -589,12 +591,18 @@ intel_th_subdevice_alloc(struct intel_th *th,
        thdev->drvdata = th->drvdata;
+        for (r = 0; r < th->num_resources; r++)
+                if (th->resource[r].flags & IORESOURCE_MEM_64) {
+                        is64bit = true;
+                        break;
+                }
        memcpy(res, subdev->res,
               sizeof(struct resource) * subdev->nres);
        for (r = 0; r < subdev->nres; r++) {
                struct resource *devres = th->resource;
-                int bar = TH_MMIO_CONFIG;
+                int bar = 0; /* cut subdevices' MMIO from resource[0] */
                /*
                 * Take .end == 0 to mean 'take the whole bar',
@@ -603,6 +611,8 @@ intel_th_subdevice_alloc(struct intel_th *th,
                 */
                if (!res[r].end && res[r].flags == IORESOURCE_MEM) {
                        bar = res[r].start;
+                        if (is64bit)
+                                bar *= 2;
                        res[r].start = 0;
                        res[r].end = resource_size(&devres[bar]) - 1;
                }
diff --git a/drivers/hwtracing/intel_th/pci.c b/drivers/hwtracing/intel_th/pci.c
index c2e55e5d97f6..1cf6290d6435 100644
--- a/drivers/hwtracing/intel_th/pci.c
+++ b/drivers/hwtracing/intel_th/pci.c
@@ -160,6 +160,11 @@ static const struct pci_device_id intel_th_pci_id_table[] = {
                PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x18e1),
                .driver_data = (kernel_ulong_t)&intel_th_2x,
        },
+        {
+                /* Ice Lake PCH */
+                PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x34a6),
+                .driver_data = (kernel_ulong_t)&intel_th_2x,
+        },
        { 0 },
 };
diff --git a/drivers/infiniband/core/cache.c b/drivers/infiniband/core/cache.c
index 0bee1f4b914e..3208ad6ad540 100644
--- a/drivers/infiniband/core/cache.c
+++ b/drivers/infiniband/core/cache.c
@@ -338,6 +338,39 @@ static int add_roce_gid(struct ib_gid_table_entry *entry)
 }
 /**
+ * del_gid - Delete GID table entry
+ *
+ * @ib_dev:     IB device whose GID entry to be deleted
+ * @port:       Port number of the IB device
+ * @table:      GID table of the IB device for a port
+ * @ix:         GID entry index to delete
+ *
+ */
+static void del_gid(struct ib_device *ib_dev, u8 port,
+                    struct ib_gid_table *table, int ix)
+{
+        struct ib_gid_table_entry *entry;
+        lockdep_assert_held(&table->lock);
+        pr_debug("%s device=%s port=%d index=%d gid %pI6\n", __func__,
+                 ib_dev->name, port, ix,
+                 table->data_vec[ix]->attr.gid.raw);
+        write_lock_irq(&table->rwlock);
+        entry = table->data_vec[ix];
+        entry->state = GID_TABLE_ENTRY_PENDING_DEL;
+        /*
+         * For non RoCE protocol, GID entry slot is ready to use.
+         */
+        if (!rdma_protocol_roce(ib_dev, port))
+                table->data_vec[ix] = NULL;
+        write_unlock_irq(&table->rwlock);
+        put_gid_entry_locked(entry);
+}
+/**
 * add_modify_gid - Add or modify GID table entry
 *
 * @table:      GID table in which GID to be added or modified
@@ -358,7 +391,7 @@ static int add_modify_gid(struct ib_gid_table *table,
         * this index.
         */
        if (is_gid_entry_valid(table->data_vec[attr->index]))
-                put_gid_entry(table->data_vec[attr->index]);
+                del_gid(attr->device, attr->port_num, table, attr->index);
        /*
         * Some HCA's report multiple GID entries with only one valid GID, and
@@ -386,39 +419,6 @@ done:
        return ret;
 }
-/**
- * del_gid - Delete GID table entry
- *
- * @ib_dev:     IB device whose GID entry to be deleted
- * @port:       Port number of the IB device
- * @table:      GID table of the IB device for a port
- * @ix:         GID entry index to delete
- *
- */
-static void del_gid(struct ib_device *ib_dev, u8 port,
-                    struct ib_gid_table *table, int ix)
-{
-        struct ib_gid_table_entry *entry;
-        lockdep_assert_held(&table->lock);
-        pr_debug("%s device=%s port=%d index=%d gid %pI6\n", __func__,
-                 ib_dev->name, port, ix,
-                 table->data_vec[ix]->attr.gid.raw);
-        write_lock_irq(&table->rwlock);
-        entry = table->data_vec[ix];
-        entry->state = GID_TABLE_ENTRY_PENDING_DEL;
-        /*
-         * For non RoCE protocol, GID entry slot is ready to use.
-         */
-        if (!rdma_protocol_roce(ib_dev, port))
-                table->data_vec[ix] = NULL;
-        write_unlock_irq(&table->rwlock);
-        put_gid_entry_locked(entry);
-}
 /* rwlock should be read locked, or lock should be held */
 static int find_gid(struct ib_gid_table *table, const union ib_gid *gid,
                    const struct ib_gid_attr *val, bool default_gid,
diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c
index 5f437d1570fb..21863ddde63e 100644
--- a/drivers/infiniband/core/ucma.c
+++ b/drivers/infiniband/core/ucma.c
@@ -1759,6 +1759,8 @@ static int ucma_close(struct inode *inode, struct file *filp)
                mutex_lock(&mut);
                if (!ctx->closing) {
                        mutex_unlock(&mut);
+                        ucma_put_ctx(ctx);
+                        wait_for_completion(&ctx->comp);
                        /* rdma_destroy_id ensures that no event handlers are
                         * inflight for that id before releasing it.
                         */
diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
index a21d5214afc3..e012ca80f9d1 100644
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -2027,33 +2027,55 @@ static int modify_qp(struct ib_uverbs_file *file,
        if ((cmd->base.attr_mask & IB_QP_CUR_STATE &&
            cmd->base.cur_qp_state > IB_QPS_ERR) ||
-            cmd->base.qp_state > IB_QPS_ERR) {
+            (cmd->base.attr_mask & IB_QP_STATE &&
+            cmd->base.qp_state > IB_QPS_ERR)) {
                ret = -EINVAL;
                goto release_qp;
        }
-        attr->qp_state            = cmd->base.qp_state;
+        if (cmd->base.attr_mask & IB_QP_STATE)
-        attr->cur_qp_state        = cmd->base.cur_qp_state;
+                attr->qp_state = cmd->base.qp_state;
-        attr->path_mtu            = cmd->base.path_mtu;
+        if (cmd->base.attr_mask & IB_QP_CUR_STATE)
-        attr->path_mig_state      = cmd->base.path_mig_state;
+                attr->cur_qp_state = cmd->base.cur_qp_state;
-        attr->qkey                = cmd->base.qkey;
+        if (cmd->base.attr_mask & IB_QP_PATH_MTU)
-        attr->rq_psn              = cmd->base.rq_psn;
+                attr->path_mtu = cmd->base.path_mtu;
-        attr->sq_psn              = cmd->base.sq_psn;
+        if (cmd->base.attr_mask & IB_QP_PATH_MIG_STATE)
-        attr->dest_qp_num         = cmd->base.dest_qp_num;
+                attr->path_mig_state = cmd->base.path_mig_state;
-        attr->qp_access_flags     = cmd->base.qp_access_flags;
+        if (cmd->base.attr_mask & IB_QP_QKEY)
-        attr->pkey_index          = cmd->base.pkey_index;
+                attr->qkey = cmd->base.qkey;
-        attr->alt_pkey_index      = cmd->base.alt_pkey_index;
+        if (cmd->base.attr_mask & IB_QP_RQ_PSN)
-        attr->en_sqd_async_notify = cmd->base.en_sqd_async_notify;
+                attr->rq_psn = cmd->base.rq_psn;
-        attr->max_rd_atomic       = cmd->base.max_rd_atomic;
+        if (cmd->base.attr_mask & IB_QP_SQ_PSN)
-        attr->max_dest_rd_atomic  = cmd->base.max_dest_rd_atomic;
+                attr->sq_psn = cmd->base.sq_psn;
-        attr->min_rnr_timer       = cmd->base.min_rnr_timer;
+        if (cmd->base.attr_mask & IB_QP_DEST_QPN)
-        attr->port_num            = cmd->base.port_num;
+                attr->dest_qp_num = cmd->base.dest_qp_num;
-        attr->timeout             = cmd->base.timeout;
+        if (cmd->base.attr_mask & IB_QP_ACCESS_FLAGS)
-        attr->retry_cnt           = cmd->base.retry_cnt;
+                attr->qp_access_flags = cmd->base.qp_access_flags;
-        attr->rnr_retry           = cmd->base.rnr_retry;
+        if (cmd->base.attr_mask & IB_QP_PKEY_INDEX)
-        attr->alt_port_num        = cmd->base.alt_port_num;
+                attr->pkey_index = cmd->base.pkey_index;
-        attr->alt_timeout         = cmd->base.alt_timeout;
+        if (cmd->base.attr_mask & IB_QP_EN_SQD_ASYNC_NOTIFY)
-        attr->rate_limit          = cmd->rate_limit;
+                attr->en_sqd_async_notify = cmd->base.en_sqd_async_notify;
+        if (cmd->base.attr_mask & IB_QP_MAX_QP_RD_ATOMIC)
+                attr->max_rd_atomic = cmd->base.max_rd_atomic;
+        if (cmd->base.attr_mask & IB_QP_MAX_DEST_RD_ATOMIC)
+                attr->max_dest_rd_atomic = cmd->base.max_dest_rd_atomic;
+        if (cmd->base.attr_mask & IB_QP_MIN_RNR_TIMER)
+                attr->min_rnr_timer = cmd->base.min_rnr_timer;
+        if (cmd->base.attr_mask & IB_QP_PORT)
+                attr->port_num = cmd->base.port_num;
+        if (cmd->base.attr_mask & IB_QP_TIMEOUT)
+                attr->timeout = cmd->base.timeout;
+        if (cmd->base.attr_mask & IB_QP_RETRY_CNT)
+                attr->retry_cnt = cmd->base.retry_cnt;
+        if (cmd->base.attr_mask & IB_QP_RNR_RETRY)
+                attr->rnr_retry = cmd->base.rnr_retry;
+        if (cmd->base.attr_mask & IB_QP_ALT_PATH) {
+                attr->alt_port_num = cmd->base.alt_port_num;
+                attr->alt_timeout = cmd->base.alt_timeout;
+                attr->alt_pkey_index = cmd->base.alt_pkey_index;
+        }
+        if (cmd->base.attr_mask & IB_QP_RATE_LIMIT)
+                attr->rate_limit = cmd->rate_limit;
        if (cmd->base.attr_mask & IB_QP_AV)
                copy_ah_attr_from_uverbs(qp->device, &attr->ah_attr,
diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
index 6d974e2363df..50152c1b1004 100644
--- a/drivers/infiniband/core/uverbs_main.c
+++ b/drivers/infiniband/core/uverbs_main.c
@@ -440,6 +440,7 @@ static int ib_uverbs_comp_event_close(struct inode *inode, struct file *filp)
                        list_del(&entry->obj_list);
                kfree(entry);
        }
+        file->ev_queue.is_closed = 1;
        spin_unlock_irq(&file->ev_queue.lock);
        uverbs_close_fd(filp);
diff --git a/drivers/infiniband/core/uverbs_uapi.c b/drivers/infiniband/core/uverbs_uapi.c
index 73ea6f0db88f..be854628a7c6 100644
--- a/drivers/infiniband/core/uverbs_uapi.c
+++ b/drivers/infiniband/core/uverbs_uapi.c
@@ -248,6 +248,7 @@ void uverbs_destroy_api(struct uverbs_api *uapi)
                kfree(rcu_dereference_protected(*slot, true));
                radix_tree_iter_delete(&uapi->radix, &iter, slot);
        }
+        kfree(uapi);
 }
 struct uverbs_api *uverbs_alloc_api(
diff --git a/drivers/infiniband/hw/bnxt_re/main.c b/drivers/infiniband/hw/bnxt_re/main.c
index 20b9f31052bf..85cd1a3593d6 100644
--- a/drivers/infiniband/hw/bnxt_re/main.c
+++ b/drivers/infiniband/hw/bnxt_re/main.c
@@ -78,7 +78,7 @@ static struct list_head bnxt_re_dev_list = LIST_HEAD_INIT(bnxt_re_dev_list);
 /* Mutex to protect the list of bnxt_re devices added */
 static DEFINE_MUTEX(bnxt_re_dev_lock);
 static struct workqueue_struct *bnxt_re_wq;
-static void bnxt_re_ib_unreg(struct bnxt_re_dev *rdev, bool lock_wait);
+static void bnxt_re_ib_unreg(struct bnxt_re_dev *rdev);
 /* SR-IOV helper functions */
@@ -182,7 +182,7 @@ static void bnxt_re_shutdown(void *p)
        if (!rdev)
                return;
-        bnxt_re_ib_unreg(rdev, false);
+        bnxt_re_ib_unreg(rdev);
 }
 static void bnxt_re_stop_irq(void *handle)
@@ -251,7 +251,7 @@ static struct bnxt_ulp_ops bnxt_re_ulp_ops = {
 /* Driver registration routines used to let the networking driver (bnxt_en)
 * to know that the RoCE driver is now installed
 */
-static int bnxt_re_unregister_netdev(struct bnxt_re_dev *rdev, bool lock_wait)
+static int bnxt_re_unregister_netdev(struct bnxt_re_dev *rdev)
 {
        struct bnxt_en_dev *en_dev;
        int rc;
@@ -260,14 +260,9 @@ static int bnxt_re_unregister_netdev(struct bnxt_re_dev *rdev, bool lock_wait)
                return -EINVAL;
        en_dev = rdev->en_dev;
-        /* Acquire rtnl lock if it is not invokded from netdev event */
-        if (lock_wait)
-                rtnl_lock();
        rc = en_dev->en_ops->bnxt_unregister_device(rdev->en_dev,
                                                    BNXT_ROCE_ULP);
-        if (lock_wait)
-                rtnl_unlock();
        return rc;
 }
@@ -281,14 +276,12 @@ static int bnxt_re_register_netdev(struct bnxt_re_dev *rdev)
        en_dev = rdev->en_dev;
-        rtnl_lock();
        rc = en_dev->en_ops->bnxt_register_device(en_dev, BNXT_ROCE_ULP,
                                                  &bnxt_re_ulp_ops, rdev);
-        rtnl_unlock();
        return rc;
 }
-static int bnxt_re_free_msix(struct bnxt_re_dev *rdev, bool lock_wait)
+static int bnxt_re_free_msix(struct bnxt_re_dev *rdev)
 {
        struct bnxt_en_dev *en_dev;
        int rc;
@@ -298,13 +291,9 @@ static int bnxt_re_free_msix(struct bnxt_re_dev *rdev, bool lock_wait)
        en_dev = rdev->en_dev;
-        if (lock_wait)
-                rtnl_lock();
        rc = en_dev->en_ops->bnxt_free_msix(rdev->en_dev, BNXT_ROCE_ULP);
-        if (lock_wait)
-                rtnl_unlock();
        return rc;
 }
@@ -320,7 +309,6 @@ static int bnxt_re_request_msix(struct bnxt_re_dev *rdev)
        num_msix_want = min_t(u32, BNXT_RE_MAX_MSIX, num_online_cpus());
-        rtnl_lock();
        num_msix_got = en_dev->en_ops->bnxt_request_msix(en_dev, BNXT_ROCE_ULP,
                                                         rdev->msix_entries,
                                                         num_msix_want);
@@ -335,7 +323,6 @@ static int bnxt_re_request_msix(struct bnxt_re_dev *rdev)
        }
        rdev->num_msix = num_msix_got;
 done:
-        rtnl_unlock();
        return rc;
 }
@@ -358,24 +345,18 @@ static void bnxt_re_fill_fw_msg(struct bnxt_fw_msg *fw_msg, void *msg,
        fw_msg->timeout = timeout;
 }
-static int bnxt_re_net_ring_free(struct bnxt_re_dev *rdev, u16 fw_ring_id,
+static int bnxt_re_net_ring_free(struct bnxt_re_dev *rdev, u16 fw_ring_id)
-                                 bool lock_wait)
 {
        struct bnxt_en_dev *en_dev = rdev->en_dev;
        struct hwrm_ring_free_input req = {0};
        struct hwrm_ring_free_output resp;
        struct bnxt_fw_msg fw_msg;
-        bool do_unlock = false;
        int rc = -EINVAL;
        if (!en_dev)
                return rc;
        memset(&fw_msg, 0, sizeof(fw_msg));
-        if (lock_wait) {
-                rtnl_lock();
-                do_unlock = true;
-        }
        bnxt_re_init_hwrm_hdr(rdev, (void *)&req, HWRM_RING_FREE, -1, -1);
        req.ring_type = RING_ALLOC_REQ_RING_TYPE_L2_CMPL;
@@ -386,8 +367,6 @@ static int bnxt_re_net_ring_free(struct bnxt_re_dev *rdev, u16 fw_ring_id,
        if (rc)
                dev_err(rdev_to_dev(rdev),
                        "Failed to free HW ring:%d :%#x", req.ring_id, rc);
-        if (do_unlock)
-                rtnl_unlock();
        return rc;
 }
@@ -405,7 +384,6 @@ static int bnxt_re_net_ring_alloc(struct bnxt_re_dev *rdev, dma_addr_t *dma_arr,
                return rc;
        memset(&fw_msg, 0, sizeof(fw_msg));
-        rtnl_lock();
        bnxt_re_init_hwrm_hdr(rdev, (void *)&req, HWRM_RING_ALLOC, -1, -1);
        req.enables = 0;
        req.page_tbl_addr =  cpu_to_le64(dma_arr[0]);
@@ -426,27 +404,21 @@ static int bnxt_re_net_ring_alloc(struct bnxt_re_dev *rdev, dma_addr_t *dma_arr,
        if (!rc)
                *fw_ring_id = le16_to_cpu(resp.ring_id);
-        rtnl_unlock();
        return rc;
 }
 static int bnxt_re_net_stats_ctx_free(struct bnxt_re_dev *rdev,
-                                      u32 fw_stats_ctx_id, bool lock_wait)
+                                      u32 fw_stats_ctx_id)
 {
        struct bnxt_en_dev *en_dev = rdev->en_dev;
        struct hwrm_stat_ctx_free_input req = {0};
        struct bnxt_fw_msg fw_msg;
-        bool do_unlock = false;
        int rc = -EINVAL;
        if (!en_dev)
                return rc;
        memset(&fw_msg, 0, sizeof(fw_msg));
-        if (lock_wait) {
-                rtnl_lock();
-                do_unlock = true;
-        }
        bnxt_re_init_hwrm_hdr(rdev, (void *)&req, HWRM_STAT_CTX_FREE, -1, -1);
        req.stat_ctx_id = cpu_to_le32(fw_stats_ctx_id);
@@ -457,8 +429,6 @@ static int bnxt_re_net_stats_ctx_free(struct bnxt_re_dev *rdev,
                dev_err(rdev_to_dev(rdev),
                        "Failed to free HW stats context %#x", rc);
-        if (do_unlock)
-                rtnl_unlock();
        return rc;
 }
@@ -478,7 +448,6 @@ static int bnxt_re_net_stats_ctx_alloc(struct bnxt_re_dev *rdev,
                return rc;
        memset(&fw_msg, 0, sizeof(fw_msg));
-        rtnl_lock();
        bnxt_re_init_hwrm_hdr(rdev, (void *)&req, HWRM_STAT_CTX_ALLOC, -1, -1);
        req.update_period_ms = cpu_to_le32(1000);
@@ -490,7 +459,6 @@ static int bnxt_re_net_stats_ctx_alloc(struct bnxt_re_dev *rdev,
        if (!rc)
                *fw_stats_ctx_id = le32_to_cpu(resp.stat_ctx_id);
-        rtnl_unlock();
        return rc;
 }
@@ -929,19 +897,19 @@ fail:
        return rc;
 }
-static void bnxt_re_free_nq_res(struct bnxt_re_dev *rdev, bool lock_wait)
+static void bnxt_re_free_nq_res(struct bnxt_re_dev *rdev)
 {
        int i;
        for (i = 0; i < rdev->num_msix - 1; i++) {
-                bnxt_re_net_ring_free(rdev, rdev->nq[i].ring_id, lock_wait);
+                bnxt_re_net_ring_free(rdev, rdev->nq[i].ring_id);
                bnxt_qplib_free_nq(&rdev->nq[i]);
        }
 }
-static void bnxt_re_free_res(struct bnxt_re_dev *rdev, bool lock_wait)
+static void bnxt_re_free_res(struct bnxt_re_dev *rdev)
 {
-        bnxt_re_free_nq_res(rdev, lock_wait);
+        bnxt_re_free_nq_res(rdev);
        if (rdev->qplib_res.dpi_tbl.max) {
                bnxt_qplib_dealloc_dpi(&rdev->qplib_res,
@@ -1219,7 +1187,7 @@ static int bnxt_re_setup_qos(struct bnxt_re_dev *rdev)
        return 0;
 }
-static void bnxt_re_ib_unreg(struct bnxt_re_dev *rdev, bool lock_wait)
+static void bnxt_re_ib_unreg(struct bnxt_re_dev *rdev)
 {
        int i, rc;
@@ -1234,28 +1202,27 @@ static void bnxt_re_ib_unreg(struct bnxt_re_dev *rdev, bool lock_wait)
                cancel_delayed_work(&rdev->worker);
        bnxt_re_cleanup_res(rdev);
-        bnxt_re_free_res(rdev, lock_wait);
+        bnxt_re_free_res(rdev);
        if (test_and_clear_bit(BNXT_RE_FLAG_RCFW_CHANNEL_EN, &rdev->flags)) {
                rc = bnxt_qplib_deinit_rcfw(&rdev->rcfw);
                if (rc)
                        dev_warn(rdev_to_dev(rdev),
                                 "Failed to deinitialize RCFW: %#x", rc);
-                bnxt_re_net_stats_ctx_free(rdev, rdev->qplib_ctx.stats.fw_id,
+                bnxt_re_net_stats_ctx_free(rdev, rdev->qplib_ctx.stats.fw_id);
-                                           lock_wait);
                bnxt_qplib_free_ctx(rdev->en_dev->pdev, &rdev->qplib_ctx);
                bnxt_qplib_disable_rcfw_channel(&rdev->rcfw);
-                bnxt_re_net_ring_free(rdev, rdev->rcfw.creq_ring_id, lock_wait);
+                bnxt_re_net_ring_free(rdev, rdev->rcfw.creq_ring_id);
                bnxt_qplib_free_rcfw_channel(&rdev->rcfw);
        }
        if (test_and_clear_bit(BNXT_RE_FLAG_GOT_MSIX, &rdev->flags)) {
-                rc = bnxt_re_free_msix(rdev, lock_wait);
+                rc = bnxt_re_free_msix(rdev);
                if (rc)
                        dev_warn(rdev_to_dev(rdev),
                                 "Failed to free MSI-X vectors: %#x", rc);
        }
        if (test_and_clear_bit(BNXT_RE_FLAG_NETDEV_REGISTERED, &rdev->flags)) {
-                rc = bnxt_re_unregister_netdev(rdev, lock_wait);
+                rc = bnxt_re_unregister_netdev(rdev);
                if (rc)
                        dev_warn(rdev_to_dev(rdev),
                                 "Failed to unregister with netdev: %#x", rc);
@@ -1276,6 +1243,12 @@ static int bnxt_re_ib_reg(struct bnxt_re_dev *rdev)
 {
        int i, j, rc;
+        bool locked;
+        /* Acquire rtnl lock through out this function */
+        rtnl_lock();
+        locked = true;
        /* Registered a new RoCE device instance to netdev */
        rc = bnxt_re_register_netdev(rdev);
        if (rc) {
@@ -1374,12 +1347,16 @@ static int bnxt_re_ib_reg(struct bnxt_re_dev *rdev)
                schedule_delayed_work(&rdev->worker, msecs_to_jiffies(30000));
        }
+        rtnl_unlock();
+        locked = false;
        /* Register ib dev */
        rc = bnxt_re_register_ib(rdev);
        if (rc) {
                pr_err("Failed to register with IB: %#x\n", rc);
                goto fail;
        }
+        set_bit(BNXT_RE_FLAG_IBDEV_REGISTERED, &rdev->flags);
        dev_info(rdev_to_dev(rdev), "Device registered successfully");
        for (i = 0; i < ARRAY_SIZE(bnxt_re_attributes); i++) {
                rc = device_create_file(&rdev->ibdev.dev,
@@ -1395,7 +1372,6 @@ static int bnxt_re_ib_reg(struct bnxt_re_dev *rdev)
                        goto fail;
                }
        }
-        set_bit(BNXT_RE_FLAG_IBDEV_REGISTERED, &rdev->flags);
        ib_get_eth_speed(&rdev->ibdev, 1, &rdev->active_speed,
                         &rdev->active_width);
        set_bit(BNXT_RE_FLAG_ISSUE_ROCE_STATS, &rdev->flags);
@@ -1404,17 +1380,21 @@ static int bnxt_re_ib_reg(struct bnxt_re_dev *rdev)
        return 0;
 free_sctx:
-        bnxt_re_net_stats_ctx_free(rdev, rdev->qplib_ctx.stats.fw_id, true);
+        bnxt_re_net_stats_ctx_free(rdev, rdev->qplib_ctx.stats.fw_id);
 free_ctx:
        bnxt_qplib_free_ctx(rdev->en_dev->pdev, &rdev->qplib_ctx);
 disable_rcfw:
        bnxt_qplib_disable_rcfw_channel(&rdev->rcfw);
 free_ring:
-        bnxt_re_net_ring_free(rdev, rdev->rcfw.creq_ring_id, true);
+        bnxt_re_net_ring_free(rdev, rdev->rcfw.creq_ring_id);
 free_rcfw:
        bnxt_qplib_free_rcfw_channel(&rdev->rcfw);
 fail:
-        bnxt_re_ib_unreg(rdev, true);
+        if (!locked)
+                rtnl_lock();
+        bnxt_re_ib_unreg(rdev);
+        rtnl_unlock();
        return rc;
 }
@@ -1567,7 +1547,7 @@ static int bnxt_re_netdev_event(struct notifier_block *notifier,
                 */
                if (atomic_read(&rdev->sched_count) > 0)
                        goto exit;
-                bnxt_re_ib_unreg(rdev, false);
+                bnxt_re_ib_unreg(rdev);
                bnxt_re_remove_one(rdev);
                bnxt_re_dev_unreg(rdev);
                break;
@@ -1646,7 +1626,10 @@ static void __exit bnxt_re_mod_exit(void)
                 */
                flush_workqueue(bnxt_re_wq);
                bnxt_re_dev_stop(rdev);
-                bnxt_re_ib_unreg(rdev, true);
+                /* Acquire the rtnl_lock as the L2 resources are freed here */
+                rtnl_lock();
+                bnxt_re_ib_unreg(rdev);
+                rtnl_unlock();
                bnxt_re_remove_one(rdev);
                bnxt_re_dev_unreg(rdev);
        }
diff --git a/drivers/infiniband/hw/hfi1/chip.c b/drivers/infiniband/hw/hfi1/chip.c
index 2c19bf772451..e1668bcc2d13 100644
--- a/drivers/infiniband/hw/hfi1/chip.c
+++ b/drivers/infiniband/hw/hfi1/chip.c
@@ -6733,6 +6733,7 @@ void start_freeze_handling(struct hfi1_pportdata *ppd, int flags)
        struct hfi1_devdata *dd = ppd->dd;
        struct send_context *sc;
        int i;
+        int sc_flags;
        if (flags & FREEZE_SELF)
                write_csr(dd, CCE_CTRL, CCE_CTRL_SPC_FREEZE_SMASK);
@@ -6743,11 +6744,13 @@ void start_freeze_handling(struct hfi1_pportdata *ppd, int flags)
        /* notify all SDMA engines that they are going into a freeze */
        sdma_freeze_notify(dd, !!(flags & FREEZE_LINK_DOWN));
+        sc_flags = SCF_FROZEN | SCF_HALTED | (flags & FREEZE_LINK_DOWN ?
+                                              SCF_LINK_DOWN : 0);
        /* do halt pre-handling on all enabled send contexts */
        for (i = 0; i < dd->num_send_contexts; i++) {
                sc = dd->send_contexts[i].sc;
                if (sc && (sc->flags & SCF_ENABLED))
-                        sc_stop(sc, SCF_FROZEN | SCF_HALTED);
+                        sc_stop(sc, sc_flags);
        }
        /* Send context are frozen. Notify user space */
@@ -10674,6 +10677,7 @@ int set_link_state(struct hfi1_pportdata *ppd, u32 state)
                add_rcvctrl(dd, RCV_CTRL_RCV_PORT_ENABLE_SMASK);
                handle_linkup_change(dd, 1);
+                pio_kernel_linkup(dd);
                /*
                 * After link up, a new link width will have been set.
diff --git a/drivers/infiniband/hw/hfi1/pio.c b/drivers/infiniband/hw/hfi1/pio.c
index c2c1cba5b23b..752057647f09 100644
--- a/drivers/infiniband/hw/hfi1/pio.c
+++ b/drivers/infiniband/hw/hfi1/pio.c
@@ -86,6 +86,7 @@ void pio_send_control(struct hfi1_devdata *dd, int op)
        unsigned long flags;
        int write = 1;  /* write sendctrl back */
        int flush = 0;  /* re-read sendctrl to make sure it is flushed */
+        int i;
        spin_lock_irqsave(&dd->sendctrl_lock, flags);
@@ -95,9 +96,13 @@ void pio_send_control(struct hfi1_devdata *dd, int op)
                reg |= SEND_CTRL_SEND_ENABLE_SMASK;
        /* Fall through */
        case PSC_DATA_VL_ENABLE:
+                mask = 0;
+                for (i = 0; i < ARRAY_SIZE(dd->vld); i++)
+                        if (!dd->vld[i].mtu)
+                                mask |= BIT_ULL(i);
                /* Disallow sending on VLs not enabled */
-                mask = (((~0ull) << num_vls) & SEND_CTRL_UNSUPPORTED_VL_MASK) <<
+                mask = (mask & SEND_CTRL_UNSUPPORTED_VL_MASK) <<
-                                SEND_CTRL_UNSUPPORTED_VL_SHIFT;
+                        SEND_CTRL_UNSUPPORTED_VL_SHIFT;
                reg = (reg & ~SEND_CTRL_UNSUPPORTED_VL_SMASK) | mask;
                break;
        case PSC_GLOBAL_DISABLE:
@@ -921,20 +926,18 @@ void sc_free(struct send_context *sc)
 void sc_disable(struct send_context *sc)
 {
        u64 reg;
-        unsigned long flags;
        struct pio_buf *pbuf;
        if (!sc)
                return;
        /* do all steps, even if already disabled */
-        spin_lock_irqsave(&sc->alloc_lock, flags);
+        spin_lock_irq(&sc->alloc_lock);
        reg = read_kctxt_csr(sc->dd, sc->hw_context, SC(CTRL));
        reg &= ~SC(CTRL_CTXT_ENABLE_SMASK);
        sc->flags &= ~SCF_ENABLED;
        sc_wait_for_packet_egress(sc, 1);
        write_kctxt_csr(sc->dd, sc->hw_context, SC(CTRL), reg);
-        spin_unlock_irqrestore(&sc->alloc_lock, flags);
        /*
         * Flush any waiters.  Once the context is disabled,
@@ -944,7 +947,7 @@ void sc_disable(struct send_context *sc)
         * proceed with the flush.
         */
        udelay(1);
-        spin_lock_irqsave(&sc->release_lock, flags);
+        spin_lock(&sc->release_lock);
        if (sc->sr) {   /* this context has a shadow ring */
                while (sc->sr_tail != sc->sr_head) {
                        pbuf = &sc->sr[sc->sr_tail].pbuf;
@@ -955,7 +958,8 @@ void sc_disable(struct send_context *sc)
                                sc->sr_tail = 0;
                }
        }
-        spin_unlock_irqrestore(&sc->release_lock, flags);
+        spin_unlock(&sc->release_lock);
+        spin_unlock_irq(&sc->alloc_lock);
 }
 /* return SendEgressCtxtStatus.PacketOccupancy */
@@ -1178,11 +1182,39 @@ void pio_kernel_unfreeze(struct hfi1_devdata *dd)
                sc = dd->send_contexts[i].sc;
                if (!sc || !(sc->flags & SCF_FROZEN) || sc->type == SC_USER)
                        continue;
+                if (sc->flags & SCF_LINK_DOWN)
+                        continue;
                sc_enable(sc);  /* will clear the sc frozen flag */
        }
 }
+/**
+ * pio_kernel_linkup() - Re-enable send contexts after linkup event
+ * @dd: valid devive data
+ *
+ * When the link goes down, the freeze path is taken.  However, a link down
+ * event is different from a freeze because if the send context is re-enabled
+ * whowever is sending data will start sending data again, which will hang
+ * any QP that is sending data.
+ *
+ * The freeze path now looks at the type of event that occurs and takes this
+ * path for link down event.
+ */
+void pio_kernel_linkup(struct hfi1_devdata *dd)
+{
+        struct send_context *sc;
+        int i;
+        for (i = 0; i < dd->num_send_contexts; i++) {
+                sc = dd->send_contexts[i].sc;
+                if (!sc || !(sc->flags & SCF_LINK_DOWN) || sc->type == SC_USER)
+                        continue;
+                sc_enable(sc);  /* will clear the sc link down flag */
+        }
+}
 /*
 * Wait for the SendPioInitCtxt.PioInitInProgress bit to clear.
 * Returns:
@@ -1382,11 +1414,10 @@ void sc_stop(struct send_context *sc, int flag)
 {
        unsigned long flags;
-        /* mark the context */
-        sc->flags |= flag;
        /* stop buffer allocations */
        spin_lock_irqsave(&sc->alloc_lock, flags);
+        /* mark the context */
+        sc->flags |= flag;
        sc->flags &= ~SCF_ENABLED;
        spin_unlock_irqrestore(&sc->alloc_lock, flags);
        wake_up(&sc->halt_wait);
diff --git a/drivers/infiniband/hw/hfi1/pio.h b/drivers/infiniband/hw/hfi1/pio.h
index 058b08f459ab..aaf372c3e5d6 100644
--- a/drivers/infiniband/hw/hfi1/pio.h
+++ b/drivers/infiniband/hw/hfi1/pio.h
@@ -139,6 +139,7 @@ struct send_context {
 #define SCF_IN_FREE 0x02
 #define SCF_HALTED  0x04
 #define SCF_FROZEN  0x08
+#define SCF_LINK_DOWN 0x10
 struct send_context_info {
        struct send_context *sc;        /* allocated working context */
@@ -306,6 +307,7 @@ void set_pio_integrity(struct send_context *sc);
 void pio_reset_all(struct hfi1_devdata *dd);
 void pio_freeze(struct hfi1_devdata *dd);
 void pio_kernel_unfreeze(struct hfi1_devdata *dd);
+void pio_kernel_linkup(struct hfi1_devdata *dd);
 /* global PIO send control operations */
 #define PSC_GLOBAL_ENABLE 0
diff --git a/drivers/infiniband/hw/hfi1/user_sdma.c b/drivers/infiniband/hw/hfi1/user_sdma.c
index a3a7b33196d6..5c88706121c1 100644
--- a/drivers/infiniband/hw/hfi1/user_sdma.c
+++ b/drivers/infiniband/hw/hfi1/user_sdma.c
@@ -828,7 +828,7 @@ static int user_sdma_send_pkts(struct user_sdma_request *req, unsigned maxpkts)
                        if (READ_ONCE(iovec->offset) == iovec->iov.iov_len) {
                                if (++req->iov_idx == req->data_iovs) {
                                        ret = -EFAULT;
-                                        goto free_txreq;
+                                        goto free_tx;
                                }
                                iovec = &req->iovs[req->iov_idx];
                                WARN_ON(iovec->offset);
diff --git a/drivers/infiniband/hw/hfi1/verbs.c b/drivers/infiniband/hw/hfi1/verbs.c
index 13374c727b14..a7c586a5589d 100644
--- a/drivers/infiniband/hw/hfi1/verbs.c
+++ b/drivers/infiniband/hw/hfi1/verbs.c
@@ -1582,6 +1582,7 @@ static int hfi1_check_ah(struct ib_device *ibdev, struct rdma_ah_attr *ah_attr)
        struct hfi1_pportdata *ppd;
        struct hfi1_devdata *dd;
        u8 sc5;
+        u8 sl;
        if (hfi1_check_mcast(rdma_ah_get_dlid(ah_attr)) &&
            !(rdma_ah_get_ah_flags(ah_attr) & IB_AH_GRH))
@@ -1590,8 +1591,13 @@ static int hfi1_check_ah(struct ib_device *ibdev, struct rdma_ah_attr *ah_attr)
        /* test the mapping for validity */
        ibp = to_iport(ibdev, rdma_ah_get_port_num(ah_attr));
        ppd = ppd_from_ibp(ibp);
-        sc5 = ibp->sl_to_sc[rdma_ah_get_sl(ah_attr)];
        dd = dd_from_ppd(ppd);
+        sl = rdma_ah_get_sl(ah_attr);
+        if (sl >= ARRAY_SIZE(ibp->sl_to_sc))
+                return -EINVAL;
+        sc5 = ibp->sl_to_sc[sl];
        if (sc_to_vlt(dd, sc5) > num_vls && sc_to_vlt(dd, sc5) != 0xf)
                return -EINVAL;
        return 0;
diff --git a/drivers/infiniband/hw/mlx5/devx.c b/drivers/infiniband/hw/mlx5/devx.c
index ac116d63e466..f2f11e652dcd 100644
--- a/drivers/infiniband/hw/mlx5/devx.c
+++ b/drivers/infiniband/hw/mlx5/devx.c
@@ -723,6 +723,7 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_OBJ_CREATE)(
                attrs, MLX5_IB_ATTR_DEVX_OBJ_CREATE_HANDLE);
        struct mlx5_ib_ucontext *c = to_mucontext(uobj->context);
        struct mlx5_ib_dev *dev = to_mdev(c->ibucontext.device);
+        u32 out[MLX5_ST_SZ_DW(general_obj_out_cmd_hdr)];
        struct devx_obj *obj;
        int err;
@@ -754,10 +755,12 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_OBJ_CREATE)(
        err = uverbs_copy_to(attrs, MLX5_IB_ATTR_DEVX_OBJ_CREATE_CMD_OUT, cmd_out, cmd_out_len);
        if (err)
-                goto obj_free;
+                goto obj_destroy;
        return 0;
+obj_destroy:
+        mlx5_cmd_exec(obj->mdev, obj->dinbox, obj->dinlen, out, sizeof(out));
 obj_free:
        kfree(obj);
        return err;
diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
index 444d16520506..0b34e909505f 100644
--- a/drivers/infiniband/ulp/srp/ib_srp.c
+++ b/drivers/infiniband/ulp/srp/ib_srp.c
@@ -2951,7 +2951,7 @@ static int srp_reset_device(struct scsi_cmnd *scmnd)
 {
        struct srp_target_port *target = host_to_target(scmnd->device->host);
        struct srp_rdma_ch *ch;
-        int i;
+        int i, j;
        u8 status;
        shost_printk(KERN_ERR, target->scsi_host, "SRP reset_device called\n");
@@ -2965,8 +2965,8 @@ static int srp_reset_device(struct scsi_cmnd *scmnd)
        for (i = 0; i < target->ch_count; i++) {
                ch = &target->ch[i];
-                for (i = 0; i < target->req_ring_size; ++i) {
+                for (j = 0; j < target->req_ring_size; ++j) {
-                        struct srp_request *req = &ch->req_ring[i];
+                        struct srp_request *req = &ch->req_ring[j];
                        srp_finish_req(ch, req, scmnd->device, DID_RESET << 16);
                }
diff --git a/drivers/input/keyboard/atakbd.c b/drivers/input/keyboard/atakbd.c
index 6f62da2909ec..6caee807cafa 100644
--- a/drivers/input/keyboard/atakbd.c
+++ b/drivers/input/keyboard/atakbd.c
@@ -75,8 +75,7 @@ MODULE_LICENSE("GPL");
 */
-static unsigned char atakbd_keycode[0x72] = {   /* American layout */
+static unsigned char atakbd_keycode[0x73] = {   /* American layout */
-        [0]      = KEY_GRAVE,
        [1]      = KEY_ESC,
        [2]      = KEY_1,
        [3]      = KEY_2,
@@ -117,9 +116,9 @@ static unsigned char atakbd_keycode[0x72] = {	/* American layout */
        [38]     = KEY_L,
        [39]     = KEY_SEMICOLON,
        [40]     = KEY_APOSTROPHE,
-        [41]     = KEY_BACKSLASH,       /* FIXME, '#' */
+        [41]     = KEY_GRAVE,
        [42]     = KEY_LEFTSHIFT,
-        [43]     = KEY_GRAVE,           /* FIXME: '~' */
+        [43]     = KEY_BACKSLASH,
        [44]     = KEY_Z,
        [45]     = KEY_X,
        [46]     = KEY_C,
@@ -145,45 +144,34 @@ static unsigned char atakbd_keycode[0x72] = {	/* American layout */
        [66]     = KEY_F8,
        [67]     = KEY_F9,
        [68]     = KEY_F10,
-        [69]     = KEY_ESC,
+        [71]     = KEY_HOME,
-        [70]     = KEY_DELETE,
+        [72]     = KEY_UP,
-        [71]     = KEY_KP7,
-        [72]     = KEY_KP8,
-        [73]     = KEY_KP9,
        [74]     = KEY_KPMINUS,
-        [75]     = KEY_KP4,
+        [75]     = KEY_LEFT,
-        [76]     = KEY_KP5,
+        [77]     = KEY_RIGHT,
-        [77]     = KEY_KP6,
        [78]     = KEY_KPPLUS,
-        [79]     = KEY_KP1,
+        [80]     = KEY_DOWN,
-        [80]     = KEY_KP2,
+        [82]     = KEY_INSERT,
-        [81]     = KEY_KP3,
+        [83]     = KEY_DELETE,
-        [82]     = KEY_KP0,
-        [83]     = KEY_KPDOT,
-        [90]     = KEY_KPLEFTPAREN,
-        [91]     = KEY_KPRIGHTPAREN,
-        [92]     = KEY_KPASTERISK,      /* FIXME */
-        [93]     = KEY_KPASTERISK,
-        [94]     = KEY_KPPLUS,
-        [95]     = KEY_HELP,
        [96]     = KEY_102ND,
-        [97]     = KEY_KPASTERISK,      /* FIXME */
+        [97]     = KEY_UNDO,
-        [98]     = KEY_KPSLASH,
+        [98]     = KEY_HELP,
        [99]     = KEY_KPLEFTPAREN,
        [100]    = KEY_KPRIGHTPAREN,
        [101]    = KEY_KPSLASH,
        [102]    = KEY_KPASTERISK,
-        [103]    = KEY_UP,
+        [103]    = KEY_KP7,
-        [104]    = KEY_KPASTERISK,      /* FIXME */
+        [104]    = KEY_KP8,
-        [105]    = KEY_LEFT,
+        [105]    = KEY_KP9,
-        [106]    = KEY_RIGHT,
+        [106]    = KEY_KP4,
-        [107]    = KEY_KPASTERISK,      /* FIXME */
+        [107]    = KEY_KP5,
-        [108]    = KEY_DOWN,
+        [108]    = KEY_KP6,
-        [109]    = KEY_KPASTERISK,      /* FIXME */
+        [109]    = KEY_KP1,
-        [110]    = KEY_KPASTERISK,      /* FIXME */
+        [110]    = KEY_KP2,
-        [111]    = KEY_KPASTERISK,      /* FIXME */
+        [111]    = KEY_KP3,
-        [112]    = KEY_KPASTERISK,      /* FIXME */
+        [112]    = KEY_KP0,
-        [113]    = KEY_KPASTERISK       /* FIXME */
+        [113]    = KEY_KPDOT,
+        [114]    = KEY_KPENTER,
 };
 static struct input_dev *atakbd_dev;
@@ -191,21 +179,15 @@ static struct input_dev *atakbd_dev;
 static void atakbd_interrupt(unsigned char scancode, char down)
 {
-        if (scancode < 0x72) {          /* scancodes < 0xf2 are keys */
+        if (scancode < 0x73) {          /* scancodes < 0xf3 are keys */
                // report raw events here?
                scancode = atakbd_keycode[scancode];
-                if (scancode == KEY_CAPSLOCK) { /* CapsLock is a toggle switch key on Amiga */
+                input_report_key(atakbd_dev, scancode, down);
-                        input_report_key(atakbd_dev, scancode, 1);
+                input_sync(atakbd_dev);
-                        input_report_key(atakbd_dev, scancode, 0);
+        } else                          /* scancodes >= 0xf3 are mouse data, most likely */
-                        input_sync(atakbd_dev);
-                } else {
-                        input_report_key(atakbd_dev, scancode, down);
-                        input_sync(atakbd_dev);
-                }
-        } else                          /* scancodes >= 0xf2 are mouse data, most likely */
                printk(KERN_INFO "atakbd: unhandled scancode %x\n", scancode);
        return;
diff --git a/drivers/input/misc/uinput.c b/drivers/input/misc/uinput.c
index 96a887f33698..eb14ddf69346 100644
--- a/drivers/input/misc/uinput.c
+++ b/drivers/input/misc/uinput.c
@@ -410,7 +410,7 @@ static int uinput_validate_absinfo(struct input_dev *dev, unsigned int code,
        min = abs->minimum;
        max = abs->maximum;
-        if ((min != 0 || max != 0) && max <= min) {
+        if ((min != 0 || max != 0) && max < min) {
                printk(KERN_DEBUG
                       "%s: invalid abs[%02x] min:%d max:%d\n",
                       UINPUT_NAME, code, min, max);
diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
index 44f57cf6675b..2d95e8d93cc7 100644
--- a/drivers/input/mouse/elantech.c
+++ b/drivers/input/mouse/elantech.c
@@ -1178,6 +1178,8 @@ static const struct dmi_system_id elantech_dmi_has_middle_button[] = {
 static const char * const middle_button_pnp_ids[] = {
        "LEN2131", /* ThinkPad P52 w/ NFC */
        "LEN2132", /* ThinkPad P52 */
+        "LEN2133", /* ThinkPad P72 w/ NFC */
+        "LEN2134", /* ThinkPad P72 */
        NULL
 };
diff --git a/drivers/input/touchscreen/egalax_ts.c b/drivers/input/touchscreen/egalax_ts.c
index 80e69bb8283e..83ac8c128192 100644
--- a/drivers/input/touchscreen/egalax_ts.c
+++ b/drivers/input/touchscreen/egalax_ts.c
@@ -241,6 +241,9 @@ static int __maybe_unused egalax_ts_suspend(struct device *dev)
        struct i2c_client *client = to_i2c_client(dev);
        int ret;
+        if (device_may_wakeup(dev))
+                return enable_irq_wake(client->irq);
        ret = i2c_master_send(client, suspend_cmd, MAX_I2C_DATA_LEN);
        return ret > 0 ? 0 : ret;
 }
@@ -249,6 +252,9 @@ static int __maybe_unused egalax_ts_resume(struct device *dev)
 {
        struct i2c_client *client = to_i2c_client(dev);
+        if (device_may_wakeup(dev))
+                return disable_irq_wake(client->irq);
        return egalax_wake_up_device(client);
 }
diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
index 4e04fff23977..73e47d93e7a0 100644
--- a/drivers/iommu/amd_iommu.c
+++ b/drivers/iommu/amd_iommu.c
@@ -246,7 +246,13 @@ static u16 get_alias(struct device *dev)
        /* The callers make sure that get_device_id() does not fail here */
        devid = get_device_id(dev);
+        /* For ACPI HID devices, we simply return the devid as such */
+        if (!dev_is_pci(dev))
+                return devid;
        ivrs_alias = amd_iommu_alias_table[devid];
        pci_for_each_dma_alias(pdev, __last_alias, &pci_alias);
        if (ivrs_alias == pci_alias)
diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index 5f3f10cf9d9d..bedc801b06a0 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -2540,9 +2540,9 @@ static struct dmar_domain *dmar_insert_one_dev_info(struct intel_iommu *iommu,
        if (dev && dev_is_pci(dev) && info->pasid_supported) {
                ret = intel_pasid_alloc_table(dev);
                if (ret) {
-                        __dmar_remove_one_dev_info(info);
+                        pr_warn("No pasid table for %s, pasid disabled\n",
-                        spin_unlock_irqrestore(&device_domain_lock, flags);
+                                dev_name(dev));
-                        return NULL;
+                        info->pasid_supported = 0;
                }
        }
        spin_unlock_irqrestore(&device_domain_lock, flags);
diff --git a/drivers/iommu/intel-pasid.h b/drivers/iommu/intel-pasid.h
index 1c05ed6fc5a5..1fb5e12b029a 100644
--- a/drivers/iommu/intel-pasid.h
+++ b/drivers/iommu/intel-pasid.h
@@ -11,7 +11,7 @@
 #define __INTEL_PASID_H
 #define PASID_MIN                       0x1
-#define PASID_MAX                       0x100000
+#define PASID_MAX                       0x20000
 struct pasid_entry {
        u64 val;
diff --git a/drivers/iommu/rockchip-iommu.c b/drivers/iommu/rockchip-iommu.c
index 258115b10fa9..ad3e2b97469e 100644
--- a/drivers/iommu/rockchip-iommu.c
+++ b/drivers/iommu/rockchip-iommu.c
@@ -1241,6 +1241,12 @@ err_unprepare_clocks:
 static void rk_iommu_shutdown(struct platform_device *pdev)
 {
+        struct rk_iommu *iommu = platform_get_drvdata(pdev);
+        int i = 0, irq;
+        while ((irq = platform_get_irq(pdev, i++)) != -ENXIO)
+                devm_free_irq(iommu->dev, irq, iommu);
        pm_runtime_force_suspend(&pdev->dev);
 }
diff --git a/drivers/md/bcache/bcache.h b/drivers/md/bcache/bcache.h
index 83504dd8100a..954dad29e6e8 100644
--- a/drivers/md/bcache/bcache.h
+++ b/drivers/md/bcache/bcache.h
@@ -965,6 +965,7 @@ void bch_prio_write(struct cache *ca);
 void bch_write_bdev_super(struct cached_dev *dc, struct closure *parent);
 extern struct workqueue_struct *bcache_wq;
+extern struct workqueue_struct *bch_journal_wq;
 extern struct mutex bch_register_lock;
 extern struct list_head bch_cache_sets;
diff --git a/drivers/md/bcache/journal.c b/drivers/md/bcache/journal.c
index 6116bbf870d8..522c7426f3a0 100644
--- a/drivers/md/bcache/journal.c
+++ b/drivers/md/bcache/journal.c
@@ -485,7 +485,7 @@ static void do_journal_discard(struct cache *ca)
                closure_get(&ca->set->cl);
                INIT_WORK(&ja->discard_work, journal_discard_work);
-                schedule_work(&ja->discard_work);
+                queue_work(bch_journal_wq, &ja->discard_work);
        }
 }
@@ -592,7 +592,7 @@ static void journal_write_done(struct closure *cl)
                : &j->w[0];
        __closure_wake_up(&w->wait);
-        continue_at_nobarrier(cl, journal_write, system_wq);
+        continue_at_nobarrier(cl, journal_write, bch_journal_wq);
 }
 static void journal_write_unlock(struct closure *cl)
@@ -627,7 +627,7 @@ static void journal_write_unlocked(struct closure *cl)
                spin_unlock(&c->journal.lock);
                btree_flush_write(c);
-                continue_at(cl, journal_write, system_wq);
+                continue_at(cl, journal_write, bch_journal_wq);
                return;
        }
diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
index 94c756c66bd7..30ba9aeb5ee8 100644
--- a/drivers/md/bcache/super.c
+++ b/drivers/md/bcache/super.c
@@ -47,6 +47,7 @@ static int bcache_major;
 static DEFINE_IDA(bcache_device_idx);
 static wait_queue_head_t unregister_wait;
 struct workqueue_struct *bcache_wq;
+struct workqueue_struct *bch_journal_wq;
 #define BTREE_MAX_PAGES         (256 * 1024 / PAGE_SIZE)
 /* limitation of partitions number on single bcache device */
@@ -2341,6 +2342,9 @@ static void bcache_exit(void)
                kobject_put(bcache_kobj);
        if (bcache_wq)
                destroy_workqueue(bcache_wq);
+        if (bch_journal_wq)
+                destroy_workqueue(bch_journal_wq);
        if (bcache_major)
                unregister_blkdev(bcache_major, "bcache");
        unregister_reboot_notifier(&reboot);
@@ -2370,6 +2374,10 @@ static int __init bcache_init(void)
        if (!bcache_wq)
                goto err;
+        bch_journal_wq = alloc_workqueue("bch_journal", WQ_MEM_RECLAIM, 0);
+        if (!bch_journal_wq)
+                goto err;
        bcache_kobj = kobject_create_and_add("bcache", fs_kobj);
        if (!bcache_kobj)
                goto err;
diff --git a/drivers/media/i2c/mt9v111.c b/drivers/media/i2c/mt9v111.c
index b5410aeb5fe2..bb41bea950ac 100644
--- a/drivers/media/i2c/mt9v111.c
+++ b/drivers/media/i2c/mt9v111.c
@@ -1159,41 +1159,21 @@ static int mt9v111_probe(struct i2c_client *client)
                                              V4L2_CID_AUTO_WHITE_BALANCE,
                                              0, 1, 1,
                                              V4L2_WHITE_BALANCE_AUTO);
-        if (IS_ERR_OR_NULL(mt9v111->auto_awb)) {
-                ret = PTR_ERR(mt9v111->auto_awb);
-                goto error_free_ctrls;
-        }
        mt9v111->auto_exp = v4l2_ctrl_new_std_menu(&mt9v111->ctrls,
                                                   &mt9v111_ctrl_ops,
                                                   V4L2_CID_EXPOSURE_AUTO,
                                                   V4L2_EXPOSURE_MANUAL,
                                                   0, V4L2_EXPOSURE_AUTO);
-        if (IS_ERR_OR_NULL(mt9v111->auto_exp)) {
-                ret = PTR_ERR(mt9v111->auto_exp);
-                goto error_free_ctrls;
-        }
-        /* Initialize timings */
        mt9v111->hblank = v4l2_ctrl_new_std(&mt9v111->ctrls, &mt9v111_ctrl_ops,
                                            V4L2_CID_HBLANK,
                                            MT9V111_CORE_R05_MIN_HBLANK,
                                            MT9V111_CORE_R05_MAX_HBLANK, 1,
                                            MT9V111_CORE_R05_DEF_HBLANK);
-        if (IS_ERR_OR_NULL(mt9v111->hblank)) {
-                ret = PTR_ERR(mt9v111->hblank);
-                goto error_free_ctrls;
-        }
        mt9v111->vblank = v4l2_ctrl_new_std(&mt9v111->ctrls, &mt9v111_ctrl_ops,
                                            V4L2_CID_VBLANK,
                                            MT9V111_CORE_R06_MIN_VBLANK,
                                            MT9V111_CORE_R06_MAX_VBLANK, 1,
                                            MT9V111_CORE_R06_DEF_VBLANK);
-        if (IS_ERR_OR_NULL(mt9v111->vblank)) {
-                ret = PTR_ERR(mt9v111->vblank);
-                goto error_free_ctrls;
-        }
        /* PIXEL_RATE is fixed: just expose it to user space. */
        v4l2_ctrl_new_std(&mt9v111->ctrls, &mt9v111_ctrl_ops,
@@ -1201,6 +1181,10 @@ static int mt9v111_probe(struct i2c_client *client)
                          DIV_ROUND_CLOSEST(mt9v111->sysclk, 2), 1,
                          DIV_ROUND_CLOSEST(mt9v111->sysclk, 2));
+        if (mt9v111->ctrls.error) {
+                ret = mt9v111->ctrls.error;
+                goto error_free_ctrls;
+        }
        mt9v111->sd.ctrl_handler = &mt9v111->ctrls;
        /* Start with default configuration: 640x480 UYVY. */
@@ -1226,26 +1210,27 @@ static int mt9v111_probe(struct i2c_client *client)
        mt9v111->pad.flags      = MEDIA_PAD_FL_SOURCE;
        ret = media_entity_pads_init(&mt9v111->sd.entity, 1, &mt9v111->pad);
        if (ret)
-                goto error_free_ctrls;
+                goto error_free_entity;
 #endif
        ret = mt9v111_chip_probe(mt9v111);
        if (ret)
-                goto error_free_ctrls;
+                goto error_free_entity;
        ret = v4l2_async_register_subdev(&mt9v111->sd);
        if (ret)
-                goto error_free_ctrls;
+                goto error_free_entity;
        return 0;
-error_free_ctrls:
+error_free_entity:
-        v4l2_ctrl_handler_free(&mt9v111->ctrls);
 #if IS_ENABLED(CONFIG_MEDIA_CONTROLLER)
        media_entity_cleanup(&mt9v111->sd.entity);
 #endif
+error_free_ctrls:
+        v4l2_ctrl_handler_free(&mt9v111->ctrls);
        mutex_destroy(&mt9v111->pwr_mutex);
        mutex_destroy(&mt9v111->stream_mutex);
@@ -1259,12 +1244,12 @@ static int mt9v111_remove(struct i2c_client *client)
        v4l2_async_unregister_subdev(sd);
-        v4l2_ctrl_handler_free(&mt9v111->ctrls);
 #if IS_ENABLED(CONFIG_MEDIA_CONTROLLER)
        media_entity_cleanup(&sd->entity);
 #endif
+        v4l2_ctrl_handler_free(&mt9v111->ctrls);
        mutex_destroy(&mt9v111->pwr_mutex);
        mutex_destroy(&mt9v111->stream_mutex);
diff --git a/drivers/media/platform/Kconfig b/drivers/media/platform/Kconfig
index 94c1fe0e9787..54fe90acb5b2 100644
--- a/drivers/media/platform/Kconfig
+++ b/drivers/media/platform/Kconfig
@@ -541,6 +541,8 @@ config VIDEO_CROS_EC_CEC
        depends on MFD_CROS_EC
        select CEC_CORE
        select CEC_NOTIFIER
+        select CHROME_PLATFORMS
+        select CROS_EC_PROTO
        ---help---
          If you say yes here you will get support for the
          ChromeOS Embedded Controller's CEC.
diff --git a/drivers/media/platform/qcom/camss/camss-csid.c b/drivers/media/platform/qcom/camss/camss-csid.c
index 729b31891466..a5ae85674ffb 100644
--- a/drivers/media/platform/qcom/camss/camss-csid.c
+++ b/drivers/media/platform/qcom/camss/camss-csid.c
@@ -10,6 +10,7 @@
 #include <linux/clk.h>
 #include <linux/completion.h>
 #include <linux/interrupt.h>
+#include <linux/io.h>
 #include <linux/kernel.h>
 #include <linux/of.h>
 #include <linux/platform_device.h>
diff --git a/drivers/media/platform/qcom/camss/camss-csiphy-2ph-1-0.c b/drivers/media/platform/qcom/camss/camss-csiphy-2ph-1-0.c
index c832539397d7..12bce391d71f 100644
--- a/drivers/media/platform/qcom/camss/camss-csiphy-2ph-1-0.c
+++ b/drivers/media/platform/qcom/camss/camss-csiphy-2ph-1-0.c
@@ -12,6 +12,7 @@
 #include <linux/delay.h>
 #include <linux/interrupt.h>
+#include <linux/io.h>
 #define CAMSS_CSI_PHY_LNn_CFG2(n)               (0x004 + 0x40 * (n))
 #define CAMSS_CSI_PHY_LNn_CFG3(n)               (0x008 + 0x40 * (n))
diff --git a/drivers/media/platform/qcom/camss/camss-csiphy-3ph-1-0.c b/drivers/media/platform/qcom/camss/camss-csiphy-3ph-1-0.c
index bcd0dfd33618..2e65caf1ecae 100644
--- a/drivers/media/platform/qcom/camss/camss-csiphy-3ph-1-0.c
+++ b/drivers/media/platform/qcom/camss/camss-csiphy-3ph-1-0.c
@@ -12,6 +12,7 @@
 #include <linux/delay.h>
 #include <linux/interrupt.h>
+#include <linux/io.h>
 #define CSIPHY_3PH_LNn_CFG1(n)                  (0x000 + 0x100 * (n))
 #define CSIPHY_3PH_LNn_CFG1_SWI_REC_DLY_PRG     (BIT(7) | BIT(6))
diff --git a/drivers/media/platform/qcom/camss/camss-csiphy.c b/drivers/media/platform/qcom/camss/camss-csiphy.c
index 4559f3b1b38c..008afb85023b 100644
--- a/drivers/media/platform/qcom/camss/camss-csiphy.c
+++ b/drivers/media/platform/qcom/camss/camss-csiphy.c
@@ -10,6 +10,7 @@
 #include <linux/clk.h>
 #include <linux/delay.h>
 #include <linux/interrupt.h>
+#include <linux/io.h>
 #include <linux/kernel.h>
 #include <linux/of.h>
 #include <linux/platform_device.h>
diff --git a/drivers/media/platform/qcom/camss/camss-ispif.c b/drivers/media/platform/qcom/camss/camss-ispif.c
index 7f269021d08c..1f33b4eb198c 100644
--- a/drivers/media/platform/qcom/camss/camss-ispif.c
+++ b/drivers/media/platform/qcom/camss/camss-ispif.c
@@ -10,6 +10,7 @@
 #include <linux/clk.h>
 #include <linux/completion.h>
 #include <linux/interrupt.h>
+#include <linux/io.h>
 #include <linux/iopoll.h>
 #include <linux/kernel.h>
 #include <linux/mutex.h>
@@ -1076,8 +1077,8 @@ int msm_ispif_subdev_init(struct ispif_device *ispif,
        else
                return -EINVAL;
-        ispif->line = kcalloc(ispif->line_num, sizeof(*ispif->line),
+        ispif->line = devm_kcalloc(dev, ispif->line_num, sizeof(*ispif->line),
-                              GFP_KERNEL);
+                                   GFP_KERNEL);
        if (!ispif->line)
                return -ENOMEM;
diff --git a/drivers/media/platform/qcom/camss/camss-vfe-4-1.c b/drivers/media/platform/qcom/camss/camss-vfe-4-1.c
index da3a9fed9f2d..174a36be6f5d 100644
--- a/drivers/media/platform/qcom/camss/camss-vfe-4-1.c
+++ b/drivers/media/platform/qcom/camss/camss-vfe-4-1.c
@@ -9,6 +9,7 @@
 */
 #include <linux/interrupt.h>
+#include <linux/io.h>
 #include <linux/iopoll.h>
 #include "camss-vfe.h"
diff --git a/drivers/media/platform/qcom/camss/camss-vfe-4-7.c b/drivers/media/platform/qcom/camss/camss-vfe-4-7.c
index 4c584bffd179..0dca8bf9281e 100644
--- a/drivers/media/platform/qcom/camss/camss-vfe-4-7.c
+++ b/drivers/media/platform/qcom/camss/camss-vfe-4-7.c
@@ -9,6 +9,7 @@
 */
 #include <linux/interrupt.h>
+#include <linux/io.h>
 #include <linux/iopoll.h>
 #include "camss-vfe.h"
diff --git a/drivers/media/platform/qcom/camss/camss.c b/drivers/media/platform/qcom/camss/camss.c
index dcc0c30ef1b1..669615fff6a0 100644
--- a/drivers/media/platform/qcom/camss/camss.c
+++ b/drivers/media/platform/qcom/camss/camss.c
@@ -848,17 +848,18 @@ static int camss_probe(struct platform_device *pdev)
                return -EINVAL;
        }
-        camss->csiphy = kcalloc(camss->csiphy_num, sizeof(*camss->csiphy),
+        camss->csiphy = devm_kcalloc(dev, camss->csiphy_num,
-                                GFP_KERNEL);
+                                     sizeof(*camss->csiphy), GFP_KERNEL);
        if (!camss->csiphy)
                return -ENOMEM;
-        camss->csid = kcalloc(camss->csid_num, sizeof(*camss->csid),
+        camss->csid = devm_kcalloc(dev, camss->csid_num, sizeof(*camss->csid),
-                              GFP_KERNEL);
+                                   GFP_KERNEL);
        if (!camss->csid)
                return -ENOMEM;
-        camss->vfe = kcalloc(camss->vfe_num, sizeof(*camss->vfe), GFP_KERNEL);
+        camss->vfe = devm_kcalloc(dev, camss->vfe_num, sizeof(*camss->vfe),
+                                  GFP_KERNEL);
        if (!camss->vfe)
                return -ENOMEM;
@@ -993,12 +994,12 @@ static const struct of_device_id camss_dt_match[] = {
 MODULE_DEVICE_TABLE(of, camss_dt_match);
-static int camss_runtime_suspend(struct device *dev)
+static int __maybe_unused camss_runtime_suspend(struct device *dev)
 {
        return 0;
 }
-static int camss_runtime_resume(struct device *dev)
+static int __maybe_unused camss_runtime_resume(struct device *dev)
 {
        return 0;
 }
diff --git a/drivers/media/usb/dvb-usb-v2/af9035.c b/drivers/media/usb/dvb-usb-v2/af9035.c
index 666d319d3d1a..1f6c1eefe389 100644
--- a/drivers/media/usb/dvb-usb-v2/af9035.c
+++ b/drivers/media/usb/dvb-usb-v2/af9035.c
@@ -402,8 +402,10 @@ static int af9035_i2c_master_xfer(struct i2c_adapter *adap,
                        if (msg[0].addr == state->af9033_i2c_addr[1])
                                reg |= 0x100000;
-                        ret = af9035_wr_regs(d, reg, &msg[0].buf[3],
+                        ret = (msg[0].len >= 3) ? af9035_wr_regs(d, reg,
-                                        msg[0].len - 3);
+                                                                 &msg[0].buf[3],
+                                                                 msg[0].len - 3)
+                                                : -EOPNOTSUPP;
                } else {
                        /* I2C write */
                        u8 buf[MAX_XFER_SIZE];
diff --git a/drivers/media/v4l2-core/v4l2-event.c b/drivers/media/v4l2-core/v4l2-event.c
index 127fe6eb91d9..a3ef1f50a4b3 100644
--- a/drivers/media/v4l2-core/v4l2-event.c
+++ b/drivers/media/v4l2-core/v4l2-event.c
@@ -115,14 +115,6 @@ static void __v4l2_event_queue_fh(struct v4l2_fh *fh, const struct v4l2_event *e
        if (sev == NULL)
                return;
-        /*
-         * If the event has been added to the fh->subscribed list, but its
-         * add op has not completed yet elems will be 0, treat this as
-         * not being subscribed.
-         */
-        if (!sev->elems)
-                return;
        /* Increase event sequence number on fh. */
        fh->sequence++;
@@ -208,6 +200,7 @@ int v4l2_event_subscribe(struct v4l2_fh *fh,
        struct v4l2_subscribed_event *sev, *found_ev;
        unsigned long flags;
        unsigned i;
+        int ret = 0;
        if (sub->type == V4L2_EVENT_ALL)
                return -EINVAL;
@@ -225,31 +218,36 @@ int v4l2_event_subscribe(struct v4l2_fh *fh,
        sev->flags = sub->flags;
        sev->fh = fh;
        sev->ops = ops;
+        sev->elems = elems;
+        mutex_lock(&fh->subscribe_lock);
        spin_lock_irqsave(&fh->vdev->fh_lock, flags);
        found_ev = v4l2_event_subscribed(fh, sub->type, sub->id);
-        if (!found_ev)
-                list_add(&sev->list, &fh->subscribed);
        spin_unlock_irqrestore(&fh->vdev->fh_lock, flags);
        if (found_ev) {
+                /* Already listening */
                kvfree(sev);
-                return 0; /* Already listening */
+                goto out_unlock;
        }
        if (sev->ops && sev->ops->add) {
-                int ret = sev->ops->add(sev, elems);
+                ret = sev->ops->add(sev, elems);
                if (ret) {
-                        sev->ops = NULL;
+                        kvfree(sev);
-                        v4l2_event_unsubscribe(fh, sub);
+                        goto out_unlock;
-                        return ret;
                }
        }
-        /* Mark as ready for use */
+        spin_lock_irqsave(&fh->vdev->fh_lock, flags);
-        sev->elems = elems;
+        list_add(&sev->list, &fh->subscribed);
+        spin_unlock_irqrestore(&fh->vdev->fh_lock, flags);
-        return 0;
+out_unlock:
+        mutex_unlock(&fh->subscribe_lock);
+        return ret;
 }
 EXPORT_SYMBOL_GPL(v4l2_event_subscribe);
@@ -288,6 +286,8 @@ int v4l2_event_unsubscribe(struct v4l2_fh *fh,
                return 0;
        }
+        mutex_lock(&fh->subscribe_lock);
        spin_lock_irqsave(&fh->vdev->fh_lock, flags);
        sev = v4l2_event_subscribed(fh, sub->type, sub->id);
@@ -305,6 +305,8 @@ int v4l2_event_unsubscribe(struct v4l2_fh *fh,
        if (sev && sev->ops && sev->ops->del)
                sev->ops->del(sev);
+        mutex_unlock(&fh->subscribe_lock);
        kvfree(sev);
        return 0;
diff --git a/drivers/media/v4l2-core/v4l2-fh.c b/drivers/media/v4l2-core/v4l2-fh.c
index 3895999bf880..c91a7bd3ecfc 100644
--- a/drivers/media/v4l2-core/v4l2-fh.c
+++ b/drivers/media/v4l2-core/v4l2-fh.c
@@ -45,6 +45,7 @@ void v4l2_fh_init(struct v4l2_fh *fh, struct video_device *vdev)
        INIT_LIST_HEAD(&fh->available);
        INIT_LIST_HEAD(&fh->subscribed);
        fh->sequence = -1;
+        mutex_init(&fh->subscribe_lock);
 }
 EXPORT_SYMBOL_GPL(v4l2_fh_init);
@@ -90,6 +91,7 @@ void v4l2_fh_exit(struct v4l2_fh *fh)
                return;
        v4l_disable_media_source(fh->vdev);
        v4l2_event_unsubscribe_all(fh);
+        mutex_destroy(&fh->subscribe_lock);
        fh->vdev = NULL;
 }
 EXPORT_SYMBOL_GPL(v4l2_fh_exit);
diff --git a/drivers/mfd/omap-usb-host.c b/drivers/mfd/omap-usb-host.c
index e11ab12fbdf2..800986a79704 100644
--- a/drivers/mfd/omap-usb-host.c
+++ b/drivers/mfd/omap-usb-host.c
@@ -528,8 +528,8 @@ static int usbhs_omap_get_dt_pdata(struct device *dev,
 }
 static const struct of_device_id usbhs_child_match_table[] = {
-        { .compatible = "ti,omap-ehci", },
+        { .compatible = "ti,ehci-omap", },
-        { .compatible = "ti,omap-ohci", },
+        { .compatible = "ti,ohci-omap3", },
        { }
 };
@@ -855,6 +855,7 @@ static struct platform_driver usbhs_omap_driver = {
                .pm             = &usbhsomap_dev_pm_ops,
                .of_match_table = usbhs_omap_dt_ids,
        },
+        .probe          = usbhs_omap_probe,
        .remove         = usbhs_omap_remove,
 };
@@ -864,9 +865,9 @@ MODULE_ALIAS("platform:" USBHS_DRIVER_NAME);
 MODULE_LICENSE("GPL v2");
 MODULE_DESCRIPTION("usb host common core driver for omap EHCI and OHCI");
-static int __init omap_usbhs_drvinit(void)
+static int omap_usbhs_drvinit(void)
 {
-        return platform_driver_probe(&usbhs_omap_driver, usbhs_omap_probe);
+        return platform_driver_register(&usbhs_omap_driver);
 }
 /*
@@ -878,7 +879,7 @@ static int __init omap_usbhs_drvinit(void)
 */
 fs_initcall_sync(omap_usbhs_drvinit);
-static void __exit omap_usbhs_drvexit(void)
+static void omap_usbhs_drvexit(void)
 {
        platform_driver_unregister(&usbhs_omap_driver);
 }
diff --git a/drivers/mmc/core/host.c b/drivers/mmc/core/host.c
index abf9e884386c..f57f5de54206 100644
--- a/drivers/mmc/core/host.c
+++ b/drivers/mmc/core/host.c
@@ -235,7 +235,7 @@ int mmc_of_parse(struct mmc_host *host)
                        host->caps |= MMC_CAP_NEEDS_POLL;
                ret = mmc_gpiod_request_cd(host, "cd", 0, true,
-                                           cd_debounce_delay_ms,
+                                           cd_debounce_delay_ms * 1000,
                                           &cd_gpio_invert);
                if (!ret)
                        dev_info(host->parent, "Got CD GPIO\n");
diff --git a/drivers/mmc/core/slot-gpio.c b/drivers/mmc/core/slot-gpio.c
index 2a833686784b..86803a3a04dc 100644
--- a/drivers/mmc/core/slot-gpio.c
+++ b/drivers/mmc/core/slot-gpio.c
@@ -271,7 +271,7 @@ int mmc_gpiod_request_cd(struct mmc_host *host, const char *con_id,
        if (debounce) {
                ret = gpiod_set_debounce(desc, debounce);
                if (ret < 0)
-                        ctx->cd_debounce_delay_ms = debounce;
+                        ctx->cd_debounce_delay_ms = debounce / 1000;
        }
        if (gpio_invert)
diff --git a/drivers/mmc/host/renesas_sdhi_sys_dmac.c b/drivers/mmc/host/renesas_sdhi_sys_dmac.c
index 890f192dedbd..5389c4821882 100644
--- a/drivers/mmc/host/renesas_sdhi_sys_dmac.c
+++ b/drivers/mmc/host/renesas_sdhi_sys_dmac.c
@@ -498,7 +498,8 @@ static const struct soc_device_attribute gen3_soc_whitelist[] = {
 static int renesas_sdhi_sys_dmac_probe(struct platform_device *pdev)
 {
-        if (of_device_get_match_data(&pdev->dev) == &of_rcar_gen3_compatible &&
+        if ((of_device_get_match_data(&pdev->dev) == &of_rcar_gen3_compatible ||
+            of_device_get_match_data(&pdev->dev) == &of_rcar_r8a7795_compatible) &&
            !soc_device_match(gen3_soc_whitelist))
                return -ENODEV;
diff --git a/drivers/mtd/devices/m25p80.c b/drivers/mtd/devices/m25p80.c
index cbfafc453274..270d3c9580c5 100644
--- a/drivers/mtd/devices/m25p80.c
+++ b/drivers/mtd/devices/m25p80.c
@@ -39,13 +39,23 @@ static int m25p80_read_reg(struct spi_nor *nor, u8 code, u8 *val, int len)
        struct spi_mem_op op = SPI_MEM_OP(SPI_MEM_OP_CMD(code, 1),
                                          SPI_MEM_OP_NO_ADDR,
                                          SPI_MEM_OP_NO_DUMMY,
-                                          SPI_MEM_OP_DATA_IN(len, val, 1));
+                                          SPI_MEM_OP_DATA_IN(len, NULL, 1));
+        void *scratchbuf;
        int ret;
+        scratchbuf = kmalloc(len, GFP_KERNEL);
+        if (!scratchbuf)
+                return -ENOMEM;
+        op.data.buf.in = scratchbuf;
        ret = spi_mem_exec_op(flash->spimem, &op);
        if (ret < 0)
                dev_err(&flash->spimem->spi->dev, "error %d reading %x\n", ret,
                        code);
+        else
+                memcpy(val, scratchbuf, len);
+        kfree(scratchbuf);
        return ret;
 }
@@ -56,9 +66,19 @@ static int m25p80_write_reg(struct spi_nor *nor, u8 opcode, u8 *buf, int len)
        struct spi_mem_op op = SPI_MEM_OP(SPI_MEM_OP_CMD(opcode, 1),
                                          SPI_MEM_OP_NO_ADDR,
                                          SPI_MEM_OP_NO_DUMMY,
-                                          SPI_MEM_OP_DATA_OUT(len, buf, 1));
+                                          SPI_MEM_OP_DATA_OUT(len, NULL, 1));
+        void *scratchbuf;
+        int ret;
-        return spi_mem_exec_op(flash->spimem, &op);
+        scratchbuf = kmemdup(buf, len, GFP_KERNEL);
+        if (!scratchbuf)
+                return -ENOMEM;
+        op.data.buf.out = scratchbuf;
+        ret = spi_mem_exec_op(flash->spimem, &op);
+        kfree(scratchbuf);
+        return ret;
 }
 static ssize_t m25p80_write(struct spi_nor *nor, loff_t to, size_t len,
diff --git a/drivers/mtd/mtdpart.c b/drivers/mtd/mtdpart.c
index 52e2cb35fc79..99c460facd5e 100644
--- a/drivers/mtd/mtdpart.c
+++ b/drivers/mtd/mtdpart.c
@@ -873,8 +873,11 @@ static int mtd_part_of_parse(struct mtd_info *master,
        int ret, err = 0;
        np = mtd_get_of_node(master);
-        if (!mtd_is_partition(master))
+        if (mtd_is_partition(master))
+                of_node_get(np);
+        else
                np = of_get_child_by_name(np, "partitions");
        of_property_for_each_string(np, "compatible", prop, compat) {
                parser = mtd_part_get_compatible_parser(compat);
                if (!parser)
diff --git a/drivers/mtd/nand/raw/denali.c b/drivers/mtd/nand/raw/denali.c
index 67b2065e7a19..b864b93dd289 100644
--- a/drivers/mtd/nand/raw/denali.c
+++ b/drivers/mtd/nand/raw/denali.c
@@ -596,6 +596,12 @@ static int denali_dma_xfer(struct denali_nand_info *denali, void *buf,
        }
        iowrite32(DMA_ENABLE__FLAG, denali->reg + DMA_ENABLE);
+        /*
+         * The ->setup_dma() hook kicks DMA by using the data/command
+         * interface, which belongs to a different AXI port from the
+         * register interface.  Read back the register to avoid a race.
+         */
+        ioread32(denali->reg + DMA_ENABLE);
        denali_reset_irq(denali);
        denali->setup_dma(denali, dma_addr, page, write);
diff --git a/drivers/mtd/nand/raw/marvell_nand.c b/drivers/mtd/nand/raw/marvell_nand.c
index 7af4d6213ee5..bc2ef5209783 100644
--- a/drivers/mtd/nand/raw/marvell_nand.c
+++ b/drivers/mtd/nand/raw/marvell_nand.c
@@ -1547,7 +1547,7 @@ static void marvell_nfc_parse_instructions(struct nand_chip *chip,
        for (op_id = 0; op_id < subop->ninstrs; op_id++) {
                unsigned int offset, naddrs;
                const u8 *addrs;
-                int len = nand_subop_get_data_len(subop, op_id);
+                int len;
                instr = &subop->instrs[op_id];
@@ -1593,6 +1593,7 @@ static void marvell_nfc_parse_instructions(struct nand_chip *chip,
                                nfc_op->ndcb[0] |=
                                        NDCB0_CMD_XTYPE(XTYPE_MONOLITHIC_RW) |
                                        NDCB0_LEN_OVRD;
+                                len = nand_subop_get_data_len(subop, op_id);
                                nfc_op->ndcb[3] |= round_up(len, FIFO_DEPTH);
                        }
                        nfc_op->data_delay_ns = instr->delay_ns;
@@ -1606,6 +1607,7 @@ static void marvell_nfc_parse_instructions(struct nand_chip *chip,
                                nfc_op->ndcb[0] |=
                                        NDCB0_CMD_XTYPE(XTYPE_MONOLITHIC_RW) |
                                        NDCB0_LEN_OVRD;
+                                len = nand_subop_get_data_len(subop, op_id);
                                nfc_op->ndcb[3] |= round_up(len, FIFO_DEPTH);
                        }
                        nfc_op->data_delay_ns = instr->delay_ns;
diff --git a/drivers/net/appletalk/ipddp.c b/drivers/net/appletalk/ipddp.c
index 9375cef22420..3d27616d9c85 100644
--- a/drivers/net/appletalk/ipddp.c
+++ b/drivers/net/appletalk/ipddp.c
@@ -283,8 +283,12 @@ static int ipddp_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
                case SIOCFINDIPDDPRT:
                        spin_lock_bh(&ipddp_route_lock);
                        rp = __ipddp_find_route(&rcp);
-                        if (rp)
+                        if (rp) {
-                                memcpy(&rcp2, rp, sizeof(rcp2));
+                                memset(&rcp2, 0, sizeof(rcp2));
+                                rcp2.ip    = rp->ip;
+                                rcp2.at    = rp->at;
+                                rcp2.flags = rp->flags;
+                        }
                        spin_unlock_bh(&ipddp_route_lock);
                        if (rp) {
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index a764a83f99da..0d87e11e7f1d 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -971,16 +971,13 @@ static void bond_poll_controller(struct net_device *bond_dev)
        struct slave *slave = NULL;
        struct list_head *iter;
        struct ad_info ad_info;
-        struct netpoll_info *ni;
-        const struct net_device_ops *ops;
        if (BOND_MODE(bond) == BOND_MODE_8023AD)
                if (bond_3ad_get_active_agg_info(bond, &ad_info))
                        return;
        bond_for_each_slave_rcu(bond, slave, iter) {
-                ops = slave->dev->netdev_ops;
+                if (!bond_slave_is_up(slave))
-                if (!bond_slave_is_up(slave) || !ops->ndo_poll_controller)
                        continue;
                if (BOND_MODE(bond) == BOND_MODE_8023AD) {
@@ -992,11 +989,7 @@ static void bond_poll_controller(struct net_device *bond_dev)
                                continue;
                }
-                ni = rcu_dereference_bh(slave->dev->npinfo);
+                netpoll_poll_dev(slave->dev);
-                if (down_trylock(&ni->dev_lock))
-                        continue;
-                ops->ndo_poll_controller(slave->dev);
-                up(&ni->dev_lock);
        }
 }
diff --git a/drivers/net/dsa/mv88e6xxx/global1.h b/drivers/net/dsa/mv88e6xxx/global1.h
index 7c791c1da4b9..bef01331266f 100644
--- a/drivers/net/dsa/mv88e6xxx/global1.h
+++ b/drivers/net/dsa/mv88e6xxx/global1.h
@@ -128,7 +128,7 @@
 #define MV88E6XXX_G1_ATU_OP_GET_CLR_VIOLATION           0x7000
 #define MV88E6XXX_G1_ATU_OP_AGE_OUT_VIOLATION           BIT(7)
 #define MV88E6XXX_G1_ATU_OP_MEMBER_VIOLATION            BIT(6)
-#define MV88E6XXX_G1_ATU_OP_MISS_VIOLTATION             BIT(5)
+#define MV88E6XXX_G1_ATU_OP_MISS_VIOLATION              BIT(5)
 #define MV88E6XXX_G1_ATU_OP_FULL_VIOLATION              BIT(4)
 /* Offset 0x0C: ATU Data Register */
diff --git a/drivers/net/dsa/mv88e6xxx/global1_atu.c b/drivers/net/dsa/mv88e6xxx/global1_atu.c
index 307410898fc9..5200e4bdce93 100644
--- a/drivers/net/dsa/mv88e6xxx/global1_atu.c
+++ b/drivers/net/dsa/mv88e6xxx/global1_atu.c
@@ -349,7 +349,7 @@ static irqreturn_t mv88e6xxx_g1_atu_prob_irq_thread_fn(int irq, void *dev_id)
                chip->ports[entry.portvec].atu_member_violation++;
        }
-        if (val & MV88E6XXX_G1_ATU_OP_MEMBER_VIOLATION) {
+        if (val & MV88E6XXX_G1_ATU_OP_MISS_VIOLATION) {
                dev_err_ratelimited(chip->dev,
                                    "ATU miss violation for %pM portvec %x\n",
                                    entry.mac, entry.portvec);
diff --git a/drivers/net/ethernet/apple/bmac.c b/drivers/net/ethernet/apple/bmac.c
index 024998d6d8c6..6a8e2567f2bd 100644
--- a/drivers/net/ethernet/apple/bmac.c
+++ b/drivers/net/ethernet/apple/bmac.c
@@ -154,7 +154,7 @@ static irqreturn_t bmac_txdma_intr(int irq, void *dev_id);
 static irqreturn_t bmac_rxdma_intr(int irq, void *dev_id);
 static void bmac_set_timeout(struct net_device *dev);
 static void bmac_tx_timeout(struct timer_list *t);
-static int bmac_output(struct sk_buff *skb, struct net_device *dev);
+static netdev_tx_t bmac_output(struct sk_buff *skb, struct net_device *dev);
 static void bmac_start(struct net_device *dev);
 #define DBDMA_SET(x)    ( ((x) | (x) << 16) )
@@ -1456,7 +1456,7 @@ bmac_start(struct net_device *dev)
        spin_unlock_irqrestore(&bp->lock, flags);
 }
-static int
+static netdev_tx_t
 bmac_output(struct sk_buff *skb, struct net_device *dev)
 {
        struct bmac_data *bp = netdev_priv(dev);
diff --git a/drivers/net/ethernet/apple/mace.c b/drivers/net/ethernet/apple/mace.c
index 0b5429d76bcf..68b9ee489489 100644
--- a/drivers/net/ethernet/apple/mace.c
+++ b/drivers/net/ethernet/apple/mace.c
@@ -78,7 +78,7 @@ struct mace_data {
 static int mace_open(struct net_device *dev);
 static int mace_close(struct net_device *dev);
-static int mace_xmit_start(struct sk_buff *skb, struct net_device *dev);
+static netdev_tx_t mace_xmit_start(struct sk_buff *skb, struct net_device *dev);
 static void mace_set_multicast(struct net_device *dev);
 static void mace_reset(struct net_device *dev);
 static int mace_set_address(struct net_device *dev, void *addr);
@@ -525,7 +525,7 @@ static inline void mace_set_timeout(struct net_device *dev)
    mp->timeout_active = 1;
 }
-static int mace_xmit_start(struct sk_buff *skb, struct net_device *dev)
+static netdev_tx_t mace_xmit_start(struct sk_buff *skb, struct net_device *dev)
 {
    struct mace_data *mp = netdev_priv(dev);
    volatile struct dbdma_regs __iomem *td = mp->tx_dma;
diff --git a/drivers/net/ethernet/apple/macmace.c b/drivers/net/ethernet/apple/macmace.c
index 137cbb470af2..376f2c2613e7 100644
--- a/drivers/net/ethernet/apple/macmace.c
+++ b/drivers/net/ethernet/apple/macmace.c
@@ -89,7 +89,7 @@ struct mace_frame {
 static int mace_open(struct net_device *dev);
 static int mace_close(struct net_device *dev);
-static int mace_xmit_start(struct sk_buff *skb, struct net_device *dev);
+static netdev_tx_t mace_xmit_start(struct sk_buff *skb, struct net_device *dev);
 static void mace_set_multicast(struct net_device *dev);
 static int mace_set_address(struct net_device *dev, void *addr);
 static void mace_reset(struct net_device *dev);
@@ -444,7 +444,7 @@ static int mace_close(struct net_device *dev)
 * Transmit a frame
 */
-static int mace_xmit_start(struct sk_buff *skb, struct net_device *dev)
+static netdev_tx_t mace_xmit_start(struct sk_buff *skb, struct net_device *dev)
 {
        struct mace_data *mp = netdev_priv(dev);
        unsigned long flags;
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
index b5f1f62e8e25..d1e1a0ba8615 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
@@ -225,9 +225,10 @@ int aq_ring_rx_clean(struct aq_ring_s *self,
                }
                /* for single fragment packets use build_skb() */
-                if (buff->is_eop) {
+                if (buff->is_eop &&
+                    buff->len <= AQ_CFG_RX_FRAME_MAX - AQ_SKB_ALIGN) {
                        skb = build_skb(page_address(buff->page),
-                                        buff->len + AQ_SKB_ALIGN);
+                                        AQ_CFG_RX_FRAME_MAX);
                        if (unlikely(!skb)) {
                                err = -ENOMEM;
                                goto err_exit;
@@ -247,18 +248,21 @@ int aq_ring_rx_clean(struct aq_ring_s *self,
                                        buff->len - ETH_HLEN,
                                        SKB_TRUESIZE(buff->len - ETH_HLEN));
-                        for (i = 1U, next_ = buff->next,
+                        if (!buff->is_eop) {
-                             buff_ = &self->buff_ring[next_]; true;
+                                for (i = 1U, next_ = buff->next,
-                             next_ = buff_->next,
+                                     buff_ = &self->buff_ring[next_];
-                             buff_ = &self->buff_ring[next_], ++i) {
+                                     true; next_ = buff_->next,
-                                skb_add_rx_frag(skb, i, buff_->page, 0,
+                                     buff_ = &self->buff_ring[next_], ++i) {
-                                                buff_->len,
+                                        skb_add_rx_frag(skb, i,
-                                                SKB_TRUESIZE(buff->len -
+                                                        buff_->page, 0,
-                                                ETH_HLEN));
+                                                        buff_->len,
-                                buff_->is_cleaned = 1;
+                                                        SKB_TRUESIZE(buff->len -
+                                                        ETH_HLEN));
-                                if (buff_->is_eop)
+                                        buff_->is_cleaned = 1;
-                                        break;
+                                        if (buff_->is_eop)
+                                                break;
+                                }
                        }
                }
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index 71362b7f6040..fcc2328bb0d9 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -12894,19 +12894,6 @@ static int bnx2x_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
        }
 }
-#ifdef CONFIG_NET_POLL_CONTROLLER
-static void poll_bnx2x(struct net_device *dev)
-{
-        struct bnx2x *bp = netdev_priv(dev);
-        int i;
-        for_each_eth_queue(bp, i) {
-                struct bnx2x_fastpath *fp = &bp->fp[i];
-                napi_schedule(&bnx2x_fp(bp, fp->index, napi));
-        }
-}
-#endif
 static int bnx2x_validate_addr(struct net_device *dev)
 {
        struct bnx2x *bp = netdev_priv(dev);
@@ -13113,9 +13100,6 @@ static const struct net_device_ops bnx2x_netdev_ops = {
        .ndo_tx_timeout         = bnx2x_tx_timeout,
        .ndo_vlan_rx_add_vid    = bnx2x_vlan_rx_add_vid,
        .ndo_vlan_rx_kill_vid   = bnx2x_vlan_rx_kill_vid,
-#ifdef CONFIG_NET_POLL_CONTROLLER
-        .ndo_poll_controller    = poll_bnx2x,
-#endif
        .ndo_setup_tc           = __bnx2x_setup_tc,
 #ifdef CONFIG_BNX2X_SRIOV
        .ndo_set_vf_mac         = bnx2x_set_vf_mac,
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index cecbb1d1f587..61957b0bbd8c 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -7672,21 +7672,6 @@ static void bnxt_tx_timeout(struct net_device *dev)
        bnxt_queue_sp_work(bp);
 }
-#ifdef CONFIG_NET_POLL_CONTROLLER
-static void bnxt_poll_controller(struct net_device *dev)
-{
-        struct bnxt *bp = netdev_priv(dev);
-        int i;
-        /* Only process tx rings/combined rings in netpoll mode. */
-        for (i = 0; i < bp->tx_nr_rings; i++) {
-                struct bnxt_tx_ring_info *txr = &bp->tx_ring[i];
-                napi_schedule(&txr->bnapi->napi);
-        }
-}
-#endif
 static void bnxt_timer(struct timer_list *t)
 {
        struct bnxt *bp = from_timer(bp, t, timer);
@@ -8027,7 +8012,7 @@ static int bnxt_change_mac_addr(struct net_device *dev, void *p)
        if (ether_addr_equal(addr->sa_data, dev->dev_addr))
                return 0;
-        rc = bnxt_approve_mac(bp, addr->sa_data);
+        rc = bnxt_approve_mac(bp, addr->sa_data, true);
        if (rc)
                return rc;
@@ -8520,9 +8505,6 @@ static const struct net_device_ops bnxt_netdev_ops = {
        .ndo_set_vf_spoofchk    = bnxt_set_vf_spoofchk,
        .ndo_set_vf_trust       = bnxt_set_vf_trust,
 #endif
-#ifdef CONFIG_NET_POLL_CONTROLLER
-        .ndo_poll_controller    = bnxt_poll_controller,
-#endif
        .ndo_setup_tc           = bnxt_setup_tc,
 #ifdef CONFIG_RFS_ACCEL
        .ndo_rx_flow_steer      = bnxt_rx_flow_steer,
@@ -8827,14 +8809,19 @@ static int bnxt_init_mac_addr(struct bnxt *bp)
        } else {
 #ifdef CONFIG_BNXT_SRIOV
                struct bnxt_vf_info *vf = &bp->vf;
+                bool strict_approval = true;
                if (is_valid_ether_addr(vf->mac_addr)) {
                        /* overwrite netdev dev_addr with admin VF MAC */
                        memcpy(bp->dev->dev_addr, vf->mac_addr, ETH_ALEN);
+                        /* Older PF driver or firmware may not approve this
+                         * correctly.
+                         */
+                        strict_approval = false;
                } else {
                        eth_hw_addr_random(bp->dev);
                }
-                rc = bnxt_approve_mac(bp, bp->dev->dev_addr);
+                rc = bnxt_approve_mac(bp, bp->dev->dev_addr, strict_approval);
 #endif
        }
        return rc;
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c
index f3b9fbcc705b..790c684f08ab 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c
@@ -46,6 +46,9 @@ static int bnxt_hwrm_nvm_req(struct bnxt *bp, u32 param_id, void *msg,
                }
        }
+        if (i == ARRAY_SIZE(nvm_params))
+                return -EOPNOTSUPP;
        if (nvm_param.dir_type == BNXT_NVM_PORT_CFG)
                idx = bp->pf.port_id;
        else if (nvm_param.dir_type == BNXT_NVM_FUNC_CFG)
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c
index fcd085a9853a..3962f6fd543c 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c
@@ -1104,7 +1104,7 @@ update_vf_mac_exit:
        mutex_unlock(&bp->hwrm_cmd_lock);
 }
-int bnxt_approve_mac(struct bnxt *bp, u8 *mac)
+int bnxt_approve_mac(struct bnxt *bp, u8 *mac, bool strict)
 {
        struct hwrm_func_vf_cfg_input req = {0};
        int rc = 0;
@@ -1122,12 +1122,13 @@ int bnxt_approve_mac(struct bnxt *bp, u8 *mac)
        memcpy(req.dflt_mac_addr, mac, ETH_ALEN);
        rc = hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT);
 mac_done:
-        if (rc) {
+        if (rc && strict) {
                rc = -EADDRNOTAVAIL;
                netdev_warn(bp->dev, "VF MAC address %pM not approved by the PF\n",
                            mac);
+                return rc;
        }
-        return rc;
+        return 0;
 }
 #else
@@ -1144,7 +1145,7 @@ void bnxt_update_vf_mac(struct bnxt *bp)
 {
 }
-int bnxt_approve_mac(struct bnxt *bp, u8 *mac)
+int bnxt_approve_mac(struct bnxt *bp, u8 *mac, bool strict)
 {
        return 0;
 }
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.h b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.h
index e9b20cd19881..2eed9eda1195 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.h
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.h
@@ -39,5 +39,5 @@ int bnxt_sriov_configure(struct pci_dev *pdev, int num_vfs);
 void bnxt_sriov_disable(struct bnxt *);
 void bnxt_hwrm_exec_fwd_req(struct bnxt *);
 void bnxt_update_vf_mac(struct bnxt *);
-int bnxt_approve_mac(struct bnxt *, u8 *);
+int bnxt_approve_mac(struct bnxt *, u8 *, bool);
 #endif
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
index 092c817f8f11..e1594c9df4c6 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
@@ -75,17 +75,23 @@ static int bnxt_tc_parse_redir(struct bnxt *bp,
        return 0;
 }
-static void bnxt_tc_parse_vlan(struct bnxt *bp,
+static int bnxt_tc_parse_vlan(struct bnxt *bp,
-                               struct bnxt_tc_actions *actions,
+                              struct bnxt_tc_actions *actions,
-                               const struct tc_action *tc_act)
+                              const struct tc_action *tc_act)
 {
-        if (tcf_vlan_action(tc_act) == TCA_VLAN_ACT_POP) {
+        switch (tcf_vlan_action(tc_act)) {
+        case TCA_VLAN_ACT_POP:
                actions->flags |= BNXT_TC_ACTION_FLAG_POP_VLAN;
-        } else if (tcf_vlan_action(tc_act) == TCA_VLAN_ACT_PUSH) {
+                break;
+        case TCA_VLAN_ACT_PUSH:
                actions->flags |= BNXT_TC_ACTION_FLAG_PUSH_VLAN;
                actions->push_vlan_tci = htons(tcf_vlan_push_vid(tc_act));
                actions->push_vlan_tpid = tcf_vlan_push_proto(tc_act);
+                break;
+        default:
+                return -EOPNOTSUPP;
        }
+        return 0;
 }
 static int bnxt_tc_parse_tunnel_set(struct bnxt *bp,
@@ -134,7 +140,9 @@ static int bnxt_tc_parse_actions(struct bnxt *bp,
                /* Push/pop VLAN */
                if (is_tcf_vlan(tc_act)) {
-                        bnxt_tc_parse_vlan(bp, actions, tc_act);
+                        rc = bnxt_tc_parse_vlan(bp, actions, tc_act);
+                        if (rc)
+                                return rc;
                        continue;
                }
diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
index 16e4ef7d7185..f1a86b422617 100644
--- a/drivers/net/ethernet/cadence/macb_main.c
+++ b/drivers/net/ethernet/cadence/macb_main.c
@@ -3837,6 +3837,13 @@ static const struct macb_config at91sam9260_config = {
        .init = macb_init,
 };
+static const struct macb_config sama5d3macb_config = {
+        .caps = MACB_CAPS_SG_DISABLED
+              | MACB_CAPS_USRIO_HAS_CLKEN | MACB_CAPS_USRIO_DEFAULT_IS_MII_GMII,
+        .clk_init = macb_clk_init,
+        .init = macb_init,
+};
 static const struct macb_config pc302gem_config = {
        .caps = MACB_CAPS_SG_DISABLED | MACB_CAPS_GIGABIT_MODE_AVAILABLE,
        .dma_burst_length = 16,
@@ -3904,6 +3911,7 @@ static const struct of_device_id macb_dt_ids[] = {
        { .compatible = "cdns,gem", .data = &pc302gem_config },
        { .compatible = "atmel,sama5d2-gem", .data = &sama5d2_config },
        { .compatible = "atmel,sama5d3-gem", .data = &sama5d3_config },
+        { .compatible = "atmel,sama5d3-macb", .data = &sama5d3macb_config },
        { .compatible = "atmel,sama5d4-gem", .data = &sama5d4_config },
        { .compatible = "cdns,at91rm9200-emac", .data = &emac_config },
        { .compatible = "cdns,emac", .data = &emac_config },
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_msg.h b/drivers/net/ethernet/chelsio/cxgb4/t4_msg.h
index b8f75a22fb6c..f152da1ce046 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4_msg.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_msg.h
@@ -753,7 +753,6 @@ struct cpl_abort_req_rss {
 };
 struct cpl_abort_req_rss6 {
-        WR_HDR;
        union opcode_tid ot;
        __be32 srqidx_status;
 };
diff --git a/drivers/net/ethernet/cirrus/ep93xx_eth.c b/drivers/net/ethernet/cirrus/ep93xx_eth.c
index e2a702996db4..13dfdfca49fc 100644
--- a/drivers/net/ethernet/cirrus/ep93xx_eth.c
+++ b/drivers/net/ethernet/cirrus/ep93xx_eth.c
@@ -332,7 +332,7 @@ static int ep93xx_poll(struct napi_struct *napi, int budget)
        return rx;
 }
-static int ep93xx_xmit(struct sk_buff *skb, struct net_device *dev)
+static netdev_tx_t ep93xx_xmit(struct sk_buff *skb, struct net_device *dev)
 {
        struct ep93xx_priv *ep = netdev_priv(dev);
        struct ep93xx_tdesc *txd;
diff --git a/drivers/net/ethernet/cirrus/mac89x0.c b/drivers/net/ethernet/cirrus/mac89x0.c
index 3f8fe8fd79cc..6324e80960c3 100644
--- a/drivers/net/ethernet/cirrus/mac89x0.c
+++ b/drivers/net/ethernet/cirrus/mac89x0.c
@@ -113,7 +113,7 @@ struct net_local {
 /* Index to functions, as function prototypes. */
 static int net_open(struct net_device *dev);
-static int net_send_packet(struct sk_buff *skb, struct net_device *dev);
+static netdev_tx_t net_send_packet(struct sk_buff *skb, struct net_device *dev);
 static irqreturn_t net_interrupt(int irq, void *dev_id);
 static void set_multicast_list(struct net_device *dev);
 static void net_rx(struct net_device *dev);
@@ -324,7 +324,7 @@ net_open(struct net_device *dev)
        return 0;
 }
-static int
+static netdev_tx_t
 net_send_packet(struct sk_buff *skb, struct net_device *dev)
 {
        struct net_local *lp = netdev_priv(dev);
diff --git a/drivers/net/ethernet/hp/hp100.c b/drivers/net/ethernet/hp/hp100.c
index c8c7ad2eff77..9b5a68b65432 100644
--- a/drivers/net/ethernet/hp/hp100.c
+++ b/drivers/net/ethernet/hp/hp100.c
@@ -2634,7 +2634,7 @@ static int hp100_login_to_vg_hub(struct net_device *dev, u_short force_relogin)
                /* Wait for link to drop */
                time = jiffies + (HZ / 10);
                do {
-                        if (~(hp100_inb(VG_LAN_CFG_1) & HP100_LINK_UP_ST))
+                        if (!(hp100_inb(VG_LAN_CFG_1) & HP100_LINK_UP_ST))
                                break;
                        if (!in_interrupt())
                                schedule_timeout_interruptible(1);
diff --git a/drivers/net/ethernet/i825xx/ether1.c b/drivers/net/ethernet/i825xx/ether1.c
index dc983450354b..35f6291a3672 100644
--- a/drivers/net/ethernet/i825xx/ether1.c
+++ b/drivers/net/ethernet/i825xx/ether1.c
@@ -64,7 +64,8 @@ static unsigned int net_debug = NET_DEBUG;
 #define RX_AREA_END     0x0fc00
 static int ether1_open(struct net_device *dev);
-static int ether1_sendpacket(struct sk_buff *skb, struct net_device *dev);
+static netdev_tx_t ether1_sendpacket(struct sk_buff *skb,
+                                     struct net_device *dev);
 static irqreturn_t ether1_interrupt(int irq, void *dev_id);
 static int ether1_close(struct net_device *dev);
 static void ether1_setmulticastlist(struct net_device *dev);
@@ -667,7 +668,7 @@ ether1_timeout(struct net_device *dev)
        netif_wake_queue(dev);
 }
-static int
+static netdev_tx_t
 ether1_sendpacket (struct sk_buff *skb, struct net_device *dev)
 {
        int tmp, tst, nopaddr, txaddr, tbdaddr, dataddr;
diff --git a/drivers/net/ethernet/i825xx/lib82596.c b/drivers/net/ethernet/i825xx/lib82596.c
index f00a1dc2128c..2f7ae118217f 100644
--- a/drivers/net/ethernet/i825xx/lib82596.c
+++ b/drivers/net/ethernet/i825xx/lib82596.c
@@ -347,7 +347,7 @@ static const char init_setup[] =
        0x7f /*  *multi IA */ };
 static int i596_open(struct net_device *dev);
-static int i596_start_xmit(struct sk_buff *skb, struct net_device *dev);
+static netdev_tx_t i596_start_xmit(struct sk_buff *skb, struct net_device *dev);
 static irqreturn_t i596_interrupt(int irq, void *dev_id);
 static int i596_close(struct net_device *dev);
 static void i596_add_cmd(struct net_device *dev, struct i596_cmd *cmd);
@@ -966,7 +966,7 @@ static void i596_tx_timeout (struct net_device *dev)
 }
-static int i596_start_xmit(struct sk_buff *skb, struct net_device *dev)
+static netdev_tx_t i596_start_xmit(struct sk_buff *skb, struct net_device *dev)
 {
        struct i596_private *lp = netdev_priv(dev);
        struct tx_cmd *tx_cmd;
diff --git a/drivers/net/ethernet/i825xx/sun3_82586.c b/drivers/net/ethernet/i825xx/sun3_82586.c
index 8bb15a8c2a40..1a86184d44c0 100644
--- a/drivers/net/ethernet/i825xx/sun3_82586.c
+++ b/drivers/net/ethernet/i825xx/sun3_82586.c
@@ -121,7 +121,8 @@ static int     sun3_82586_probe1(struct net_device *dev,int ioaddr);
 static irqreturn_t sun3_82586_interrupt(int irq,void *dev_id);
 static int     sun3_82586_open(struct net_device *dev);
 static int     sun3_82586_close(struct net_device *dev);
-static int     sun3_82586_send_packet(struct sk_buff *,struct net_device *);
+static netdev_tx_t     sun3_82586_send_packet(struct sk_buff *,
+                                              struct net_device *);
 static struct  net_device_stats *sun3_82586_get_stats(struct net_device *dev);
 static void    set_multicast_list(struct net_device *dev);
 static void    sun3_82586_timeout(struct net_device *dev);
@@ -1002,7 +1003,8 @@ static void sun3_82586_timeout(struct net_device *dev)
 * send frame
 */
-static int sun3_82586_send_packet(struct sk_buff *skb, struct net_device *dev)
+static netdev_tx_t
+sun3_82586_send_packet(struct sk_buff *skb, struct net_device *dev)
 {
        int len,i;
 #ifndef NO_NOPCOMMANDS
diff --git a/drivers/net/ethernet/ibm/emac/core.c b/drivers/net/ethernet/ibm/emac/core.c
index 372664686309..129f4e9f38da 100644
--- a/drivers/net/ethernet/ibm/emac/core.c
+++ b/drivers/net/ethernet/ibm/emac/core.c
@@ -2677,12 +2677,17 @@ static int emac_init_phy(struct emac_instance *dev)
                if (of_phy_is_fixed_link(np)) {
                        int res = emac_dt_mdio_probe(dev);
-                        if (!res) {
+                        if (res)
-                                res = of_phy_register_fixed_link(np);
+                                return res;
-                                if (res)
-                                        mdiobus_unregister(dev->mii_bus);
+                        res = of_phy_register_fixed_link(np);
+                        dev->phy_dev = of_phy_find_device(np);
+                        if (res || !dev->phy_dev) {
+                                mdiobus_unregister(dev->mii_bus);
+                                return res ? res : -EINVAL;
                        }
-                        return res;
+                        emac_adjust_link(dev->ndev);
+                        put_device(&dev->phy_dev->mdio.dev);
                }
                return 0;
        }
diff --git a/drivers/net/ethernet/intel/fm10k/fm10k.h b/drivers/net/ethernet/intel/fm10k/fm10k.h
index a903a0ba45e1..7d42582ed48d 100644
--- a/drivers/net/ethernet/intel/fm10k/fm10k.h
+++ b/drivers/net/ethernet/intel/fm10k/fm10k.h
@@ -504,9 +504,6 @@ void fm10k_update_stats(struct fm10k_intfc *interface);
 void fm10k_service_event_schedule(struct fm10k_intfc *interface);
 void fm10k_macvlan_schedule(struct fm10k_intfc *interface);
 void fm10k_update_rx_drop_en(struct fm10k_intfc *interface);
-#ifdef CONFIG_NET_POLL_CONTROLLER
-void fm10k_netpoll(struct net_device *netdev);
-#endif
 /* Netdev */
 struct net_device *fm10k_alloc_netdev(const struct fm10k_info *info);
diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_netdev.c b/drivers/net/ethernet/intel/fm10k/fm10k_netdev.c
index 929f538d28bc..538a8467f434 100644
--- a/drivers/net/ethernet/intel/fm10k/fm10k_netdev.c
+++ b/drivers/net/ethernet/intel/fm10k/fm10k_netdev.c
@@ -1648,9 +1648,6 @@ static const struct net_device_ops fm10k_netdev_ops = {
        .ndo_udp_tunnel_del     = fm10k_udp_tunnel_del,
        .ndo_dfwd_add_station   = fm10k_dfwd_add_station,
        .ndo_dfwd_del_station   = fm10k_dfwd_del_station,
-#ifdef CONFIG_NET_POLL_CONTROLLER
-        .ndo_poll_controller    = fm10k_netpoll,
-#endif
        .ndo_features_check     = fm10k_features_check,
 };
diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_pci.c b/drivers/net/ethernet/intel/fm10k/fm10k_pci.c
index 15071e4adb98..c859ababeed5 100644
--- a/drivers/net/ethernet/intel/fm10k/fm10k_pci.c
+++ b/drivers/net/ethernet/intel/fm10k/fm10k_pci.c
@@ -1210,28 +1210,6 @@ static irqreturn_t fm10k_msix_mbx_vf(int __always_unused irq, void *data)
        return IRQ_HANDLED;
 }
-#ifdef CONFIG_NET_POLL_CONTROLLER
-/**
- *  fm10k_netpoll - A Polling 'interrupt' handler
- *  @netdev: network interface device structure
- *
- *  This is used by netconsole to send skbs without having to re-enable
- *  interrupts. It's not called while the normal interrupt routine is executing.
- **/
-void fm10k_netpoll(struct net_device *netdev)
-{
-        struct fm10k_intfc *interface = netdev_priv(netdev);
-        int i;
-        /* if interface is down do nothing */
-        if (test_bit(__FM10K_DOWN, interface->state))
-                return;
-        for (i = 0; i < interface->num_q_vectors; i++)
-                fm10k_msix_clean_rings(0, interface->q_vector[i]);
-}
-#endif
 #define FM10K_ERR_MSG(type) case (type): error = #type; break
 static void fm10k_handle_fault(struct fm10k_intfc *interface, int type,
                               struct fm10k_fault *fault)
diff --git a/drivers/net/ethernet/intel/i40evf/i40evf_main.c b/drivers/net/ethernet/intel/i40evf/i40evf_main.c
index 5906c1c1d19d..fef6d892ed4c 100644
--- a/drivers/net/ethernet/intel/i40evf/i40evf_main.c
+++ b/drivers/net/ethernet/intel/i40evf/i40evf_main.c
@@ -396,29 +396,6 @@ static void i40evf_map_rings_to_vectors(struct i40evf_adapter *adapter)
        adapter->aq_required |= I40EVF_FLAG_AQ_MAP_VECTORS;
 }
-#ifdef CONFIG_NET_POLL_CONTROLLER
-/**
- * i40evf_netpoll - A Polling 'interrupt' handler
- * @netdev: network interface device structure
- *
- * This is used by netconsole to send skbs without having to re-enable
- * interrupts.  It's not called while the normal interrupt routine is executing.
- **/
-static void i40evf_netpoll(struct net_device *netdev)
-{
-        struct i40evf_adapter *adapter = netdev_priv(netdev);
-        int q_vectors = adapter->num_msix_vectors - NONQ_VECS;
-        int i;
-        /* if interface is down do nothing */
-        if (test_bit(__I40E_VSI_DOWN, adapter->vsi.state))
-                return;
-        for (i = 0; i < q_vectors; i++)
-                i40evf_msix_clean_rings(0, &adapter->q_vectors[i]);
-}
-#endif
 /**
 * i40evf_irq_affinity_notify - Callback for affinity changes
 * @notify: context as to what irq was changed
@@ -3229,9 +3206,6 @@ static const struct net_device_ops i40evf_netdev_ops = {
        .ndo_features_check     = i40evf_features_check,
        .ndo_fix_features       = i40evf_fix_features,
        .ndo_set_features       = i40evf_set_features,
-#ifdef CONFIG_NET_POLL_CONTROLLER
-        .ndo_poll_controller    = i40evf_netpoll,
-#endif
        .ndo_setup_tc           = i40evf_setup_tc,
 };
diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c
index f1e80eed2fd6..3f047bb43348 100644
--- a/drivers/net/ethernet/intel/ice/ice_main.c
+++ b/drivers/net/ethernet/intel/ice/ice_main.c
@@ -4806,30 +4806,6 @@ void ice_get_stats64(struct net_device *netdev, struct rtnl_link_stats64 *stats)
        stats->rx_length_errors = vsi_stats->rx_length_errors;
 }
-#ifdef CONFIG_NET_POLL_CONTROLLER
-/**
- * ice_netpoll - polling "interrupt" handler
- * @netdev: network interface device structure
- *
- * Used by netconsole to send skbs without having to re-enable interrupts.
- * This is not called in the normal interrupt path.
- */
-static void ice_netpoll(struct net_device *netdev)
-{
-        struct ice_netdev_priv *np = netdev_priv(netdev);
-        struct ice_vsi *vsi = np->vsi;
-        struct ice_pf *pf = vsi->back;
-        int i;
-        if (test_bit(__ICE_DOWN, vsi->state) ||
-            !test_bit(ICE_FLAG_MSIX_ENA, pf->flags))
-                return;
-        for (i = 0; i < vsi->num_q_vectors; i++)
-                ice_msix_clean_rings(0, vsi->q_vectors[i]);
-}
-#endif /* CONFIG_NET_POLL_CONTROLLER */
 /**
 * ice_napi_disable_all - Disable NAPI for all q_vectors in the VSI
 * @vsi: VSI having NAPI disabled
@@ -5497,9 +5473,6 @@ static const struct net_device_ops ice_netdev_ops = {
        .ndo_validate_addr = eth_validate_addr,
        .ndo_change_mtu = ice_change_mtu,
        .ndo_get_stats64 = ice_get_stats64,
-#ifdef CONFIG_NET_POLL_CONTROLLER
-        .ndo_poll_controller = ice_netpoll,
-#endif /* CONFIG_NET_POLL_CONTROLLER */
        .ndo_vlan_rx_add_vid = ice_vlan_rx_add_vid,
        .ndo_vlan_rx_kill_vid = ice_vlan_rx_kill_vid,
        .ndo_set_features = ice_set_features,
diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
index a32c576c1e65..0796cef96fa3 100644
--- a/drivers/net/ethernet/intel/igb/igb_main.c
+++ b/drivers/net/ethernet/intel/igb/igb_main.c
@@ -205,10 +205,6 @@ static struct notifier_block dca_notifier = {
        .priority       = 0
 };
 #endif
-#ifdef CONFIG_NET_POLL_CONTROLLER
-/* for netdump / net console */
-static void igb_netpoll(struct net_device *);
-#endif
 #ifdef CONFIG_PCI_IOV
 static unsigned int max_vfs;
 module_param(max_vfs, uint, 0);
@@ -2881,9 +2877,6 @@ static const struct net_device_ops igb_netdev_ops = {
        .ndo_set_vf_spoofchk    = igb_ndo_set_vf_spoofchk,
        .ndo_set_vf_trust       = igb_ndo_set_vf_trust,
        .ndo_get_vf_config      = igb_ndo_get_vf_config,
-#ifdef CONFIG_NET_POLL_CONTROLLER
-        .ndo_poll_controller    = igb_netpoll,
-#endif
        .ndo_fix_features       = igb_fix_features,
        .ndo_set_features       = igb_set_features,
        .ndo_fdb_add            = igb_ndo_fdb_add,
@@ -9053,29 +9046,6 @@ static int igb_pci_sriov_configure(struct pci_dev *dev, int num_vfs)
        return 0;
 }
-#ifdef CONFIG_NET_POLL_CONTROLLER
-/* Polling 'interrupt' - used by things like netconsole to send skbs
- * without having to re-enable interrupts. It's not called while
- * the interrupt routine is executing.
- */
-static void igb_netpoll(struct net_device *netdev)
-{
-        struct igb_adapter *adapter = netdev_priv(netdev);
-        struct e1000_hw *hw = &adapter->hw;
-        struct igb_q_vector *q_vector;
-        int i;
-        for (i = 0; i < adapter->num_q_vectors; i++) {
-                q_vector = adapter->q_vector[i];
-                if (adapter->flags & IGB_FLAG_HAS_MSIX)
-                        wr32(E1000_EIMC, q_vector->eims_value);
-                else
-                        igb_irq_disable(adapter);
-                napi_schedule(&q_vector->napi);
-        }
-}
-#endif /* CONFIG_NET_POLL_CONTROLLER */
 /**
 *  igb_io_error_detected - called when PCI error is detected
 *  @pdev: Pointer to PCI device
diff --git a/drivers/net/ethernet/intel/ixgb/ixgb_main.c b/drivers/net/ethernet/intel/ixgb/ixgb_main.c
index d3e72d0f66ef..7722153c4ac2 100644
--- a/drivers/net/ethernet/intel/ixgb/ixgb_main.c
+++ b/drivers/net/ethernet/intel/ixgb/ixgb_main.c
@@ -81,11 +81,6 @@ static int ixgb_vlan_rx_kill_vid(struct net_device *netdev,
                                 __be16 proto, u16 vid);
 static void ixgb_restore_vlan(struct ixgb_adapter *adapter);
-#ifdef CONFIG_NET_POLL_CONTROLLER
-/* for netdump / net console */
-static void ixgb_netpoll(struct net_device *dev);
-#endif
 static pci_ers_result_t ixgb_io_error_detected (struct pci_dev *pdev,
                             enum pci_channel_state state);
 static pci_ers_result_t ixgb_io_slot_reset (struct pci_dev *pdev);
@@ -348,9 +343,6 @@ static const struct net_device_ops ixgb_netdev_ops = {
        .ndo_tx_timeout         = ixgb_tx_timeout,
        .ndo_vlan_rx_add_vid    = ixgb_vlan_rx_add_vid,
        .ndo_vlan_rx_kill_vid   = ixgb_vlan_rx_kill_vid,
-#ifdef CONFIG_NET_POLL_CONTROLLER
-        .ndo_poll_controller    = ixgb_netpoll,
-#endif
        .ndo_fix_features       = ixgb_fix_features,
        .ndo_set_features       = ixgb_set_features,
 };
@@ -2195,23 +2187,6 @@ ixgb_restore_vlan(struct ixgb_adapter *adapter)
                ixgb_vlan_rx_add_vid(adapter->netdev, htons(ETH_P_8021Q), vid);
 }
-#ifdef CONFIG_NET_POLL_CONTROLLER
-/*
- * Polling 'interrupt' - used by things like netconsole to send skbs
- * without having to re-enable interrupts. It's not called while
- * the interrupt routine is executing.
- */
-static void ixgb_netpoll(struct net_device *dev)
-{
-        struct ixgb_adapter *adapter = netdev_priv(dev);
-        disable_irq(adapter->pdev->irq);
-        ixgb_intr(adapter->pdev->irq, dev);
-        enable_irq(adapter->pdev->irq);
-}
-#endif
 /**
 * ixgb_io_error_detected - called when PCI error is detected
 * @pdev:    pointer to pci device with error
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index 9a23d33a47ed..f27d73a7bf16 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -8768,28 +8768,6 @@ static int ixgbe_del_sanmac_netdev(struct net_device *dev)
        return err;
 }
-#ifdef CONFIG_NET_POLL_CONTROLLER
-/*
- * Polling 'interrupt' - used by things like netconsole to send skbs
- * without having to re-enable interrupts. It's not called while
- * the interrupt routine is executing.
- */
-static void ixgbe_netpoll(struct net_device *netdev)
-{
-        struct ixgbe_adapter *adapter = netdev_priv(netdev);
-        int i;
-        /* if interface is down do nothing */
-        if (test_bit(__IXGBE_DOWN, &adapter->state))
-                return;
-        /* loop through and schedule all active queues */
-        for (i = 0; i < adapter->num_q_vectors; i++)
-                ixgbe_msix_clean_rings(0, adapter->q_vector[i]);
-}
-#endif
 static void ixgbe_get_ring_stats64(struct rtnl_link_stats64 *stats,
                                   struct ixgbe_ring *ring)
 {
@@ -10251,9 +10229,6 @@ static const struct net_device_ops ixgbe_netdev_ops = {
        .ndo_get_vf_config      = ixgbe_ndo_get_vf_config,
        .ndo_get_stats64        = ixgbe_get_stats64,
        .ndo_setup_tc           = __ixgbe_setup_tc,
-#ifdef CONFIG_NET_POLL_CONTROLLER
-        .ndo_poll_controller    = ixgbe_netpoll,
-#endif
 #ifdef IXGBE_FCOE
        .ndo_select_queue       = ixgbe_select_queue,
        .ndo_fcoe_ddp_setup = ixgbe_fcoe_ddp_get,
diff --git a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
index d86446d202d5..5a228582423b 100644
--- a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
+++ b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
@@ -4233,24 +4233,6 @@ static int ixgbevf_change_mtu(struct net_device *netdev, int new_mtu)
        return 0;
 }
-#ifdef CONFIG_NET_POLL_CONTROLLER
-/* Polling 'interrupt' - used by things like netconsole to send skbs
- * without having to re-enable interrupts. It's not called while
- * the interrupt routine is executing.
- */
-static void ixgbevf_netpoll(struct net_device *netdev)
-{
-        struct ixgbevf_adapter *adapter = netdev_priv(netdev);
-        int i;
-        /* if interface is down do nothing */
-        if (test_bit(__IXGBEVF_DOWN, &adapter->state))
-                return;
-        for (i = 0; i < adapter->num_rx_queues; i++)
-                ixgbevf_msix_clean_rings(0, adapter->q_vector[i]);
-}
-#endif /* CONFIG_NET_POLL_CONTROLLER */
 static int ixgbevf_suspend(struct pci_dev *pdev, pm_message_t state)
 {
        struct net_device *netdev = pci_get_drvdata(pdev);
@@ -4482,9 +4464,6 @@ static const struct net_device_ops ixgbevf_netdev_ops = {
        .ndo_tx_timeout         = ixgbevf_tx_timeout,
        .ndo_vlan_rx_add_vid    = ixgbevf_vlan_rx_add_vid,
        .ndo_vlan_rx_kill_vid   = ixgbevf_vlan_rx_kill_vid,
-#ifdef CONFIG_NET_POLL_CONTROLLER
-        .ndo_poll_controller    = ixgbevf_netpoll,
-#endif
        .ndo_features_check     = ixgbevf_features_check,
        .ndo_bpf                = ixgbevf_xdp,
 };
diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
index bc80a678abc3..b4ed7d394d07 100644
--- a/drivers/net/ethernet/marvell/mvneta.c
+++ b/drivers/net/ethernet/marvell/mvneta.c
@@ -1890,8 +1890,8 @@ static void mvneta_rxq_drop_pkts(struct mvneta_port *pp,
                if (!data || !(rx_desc->buf_phys_addr))
                        continue;
-                dma_unmap_single(pp->dev->dev.parent, rx_desc->buf_phys_addr,
+                dma_unmap_page(pp->dev->dev.parent, rx_desc->buf_phys_addr,
-                                 MVNETA_RX_BUF_SIZE(pp->pkt_size), DMA_FROM_DEVICE);
+                               PAGE_SIZE, DMA_FROM_DEVICE);
                __free_page(data);
        }
 }
@@ -2008,8 +2008,8 @@ static int mvneta_rx_swbm(struct napi_struct *napi,
                                skb_add_rx_frag(rxq->skb, frag_num, page,
                                                frag_offset, frag_size,
                                                PAGE_SIZE);
-                                dma_unmap_single(dev->dev.parent, phys_addr,
+                                dma_unmap_page(dev->dev.parent, phys_addr,
-                                                 PAGE_SIZE, DMA_FROM_DEVICE);
+                                               PAGE_SIZE, DMA_FROM_DEVICE);
                                rxq->left_size -= frag_size;
                        }
                } else {
@@ -2039,9 +2039,8 @@ static int mvneta_rx_swbm(struct napi_struct *napi,
                                                frag_offset, frag_size,
                                                PAGE_SIZE);
-                                dma_unmap_single(dev->dev.parent, phys_addr,
+                                dma_unmap_page(dev->dev.parent, phys_addr,
-                                                 PAGE_SIZE,
+                                               PAGE_SIZE, DMA_FROM_DEVICE);
-                                                 DMA_FROM_DEVICE);
                                rxq->left_size -= frag_size;
                        }
diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
index 28500417843e..38cc01beea79 100644
--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
@@ -58,6 +58,8 @@ static struct {
 */
 static void mvpp2_mac_config(struct net_device *dev, unsigned int mode,
                             const struct phylink_link_state *state);
+static void mvpp2_mac_link_up(struct net_device *dev, unsigned int mode,
+                              phy_interface_t interface, struct phy_device *phy);
 /* Queue modes */
 #define MVPP2_QDIST_SINGLE_MODE 0
@@ -3053,10 +3055,12 @@ static int mvpp2_poll(struct napi_struct *napi, int budget)
                                   cause_rx_tx & ~MVPP2_CAUSE_MISC_SUM_MASK);
        }
-        cause_tx = cause_rx_tx & MVPP2_CAUSE_TXQ_OCCUP_DESC_ALL_MASK;
+        if (port->has_tx_irqs) {
-        if (cause_tx) {
+                cause_tx = cause_rx_tx & MVPP2_CAUSE_TXQ_OCCUP_DESC_ALL_MASK;
-                cause_tx >>= MVPP2_CAUSE_TXQ_OCCUP_DESC_ALL_OFFSET;
+                if (cause_tx) {
-                mvpp2_tx_done(port, cause_tx, qv->sw_thread_id);
+                        cause_tx >>= MVPP2_CAUSE_TXQ_OCCUP_DESC_ALL_OFFSET;
+                        mvpp2_tx_done(port, cause_tx, qv->sw_thread_id);
+                }
        }
        /* Process RX packets */
@@ -3142,6 +3146,7 @@ static void mvpp2_start_dev(struct mvpp2_port *port)
                mvpp22_mode_reconfigure(port);
        if (port->phylink) {
+                netif_carrier_off(port->dev);
                phylink_start(port->phylink);
        } else {
                /* Phylink isn't used as of now for ACPI, so the MAC has to be
@@ -3150,9 +3155,10 @@ static void mvpp2_start_dev(struct mvpp2_port *port)
                 */
                struct phylink_link_state state = {
                        .interface = port->phy_interface,
-                        .link = 1,
                };
                mvpp2_mac_config(port->dev, MLO_AN_INBAND, &state);
+                mvpp2_mac_link_up(port->dev, MLO_AN_INBAND, port->phy_interface,
+                                  NULL);
        }
        netif_tx_start_all_queues(port->dev);
@@ -4495,10 +4501,6 @@ static void mvpp2_mac_config(struct net_device *dev, unsigned int mode,
                return;
        }
-        netif_tx_stop_all_queues(port->dev);
-        if (!port->has_phy)
-                netif_carrier_off(port->dev);
        /* Make sure the port is disabled when reconfiguring the mode */
        mvpp2_port_disable(port);
@@ -4523,16 +4525,7 @@ static void mvpp2_mac_config(struct net_device *dev, unsigned int mode,
        if (port->priv->hw_version == MVPP21 && port->flags & MVPP2_F_LOOPBACK)
                mvpp2_port_loopback_set(port, state);
-        /* If the port already was up, make sure it's still in the same state */
+        mvpp2_port_enable(port);
-        if (state->link || !port->has_phy) {
-                mvpp2_port_enable(port);
-                mvpp2_egress_enable(port);
-                mvpp2_ingress_enable(port);
-                if (!port->has_phy)
-                        netif_carrier_on(dev);
-                netif_tx_wake_all_queues(dev);
-        }
 }
 static void mvpp2_mac_link_up(struct net_device *dev, unsigned int mode,
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
index 6785661d1a72..fe49384eba48 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
@@ -1286,20 +1286,6 @@ out:
        mutex_unlock(&mdev->state_lock);
 }
-#ifdef CONFIG_NET_POLL_CONTROLLER
-static void mlx4_en_netpoll(struct net_device *dev)
-{
-        struct mlx4_en_priv *priv = netdev_priv(dev);
-        struct mlx4_en_cq *cq;
-        int i;
-        for (i = 0; i < priv->tx_ring_num[TX]; i++) {
-                cq = priv->tx_cq[TX][i];
-                napi_schedule(&cq->napi);
-        }
-}
-#endif
 static int mlx4_en_set_rss_steer_rules(struct mlx4_en_priv *priv)
 {
        u64 reg_id;
@@ -2946,9 +2932,6 @@ static const struct net_device_ops mlx4_netdev_ops = {
        .ndo_tx_timeout         = mlx4_en_tx_timeout,
        .ndo_vlan_rx_add_vid    = mlx4_en_vlan_rx_add_vid,
        .ndo_vlan_rx_kill_vid   = mlx4_en_vlan_rx_kill_vid,
-#ifdef CONFIG_NET_POLL_CONTROLLER
-        .ndo_poll_controller    = mlx4_en_netpoll,
-#endif
        .ndo_set_features       = mlx4_en_set_features,
        .ndo_fix_features       = mlx4_en_fix_features,
        .ndo_setup_tc           = __mlx4_en_setup_tc,
@@ -2983,9 +2966,6 @@ static const struct net_device_ops mlx4_netdev_ops_master = {
        .ndo_set_vf_link_state  = mlx4_en_set_vf_link_state,
        .ndo_get_vf_stats       = mlx4_en_get_vf_stats,
        .ndo_get_vf_config      = mlx4_en_get_vf_config,
-#ifdef CONFIG_NET_POLL_CONTROLLER
-        .ndo_poll_controller    = mlx4_en_netpoll,
-#endif
        .ndo_set_features       = mlx4_en_set_features,
        .ndo_fix_features       = mlx4_en_fix_features,
        .ndo_setup_tc           = __mlx4_en_setup_tc,
diff --git a/drivers/net/ethernet/mellanox/mlx4/eq.c b/drivers/net/ethernet/mellanox/mlx4/eq.c
index 1f3372c1802e..2df92dbd38e1 100644
--- a/drivers/net/ethernet/mellanox/mlx4/eq.c
+++ b/drivers/net/ethernet/mellanox/mlx4/eq.c
@@ -240,7 +240,8 @@ static void mlx4_set_eq_affinity_hint(struct mlx4_priv *priv, int vec)
        struct mlx4_dev *dev = &priv->dev;
        struct mlx4_eq *eq = &priv->eq_table.eq[vec];
-        if (!eq->affinity_mask || cpumask_empty(eq->affinity_mask))
+        if (!cpumask_available(eq->affinity_mask) ||
+            cpumask_empty(eq->affinity_mask))
                return;
        hint_err = irq_set_affinity_hint(eq->irq, eq->affinity_mask);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
index 3ce14d42ddc8..a53736c26c0c 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
@@ -206,7 +206,7 @@ static void poll_timeout(struct mlx5_cmd_work_ent *ent)
        u8 own;
        do {
-                own = ent->lay->status_own;
+                own = READ_ONCE(ent->lay->status_own);
                if (!(own & CMD_OWNER_HW)) {
                        ent->ret = 0;
                        return;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/tls.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/tls.c
index eddd7702680b..e88340e196f7 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/tls.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/tls.c
@@ -183,12 +183,13 @@ static const struct tlsdev_ops mlx5e_tls_ops = {
 void mlx5e_tls_build_netdev(struct mlx5e_priv *priv)
 {
-        u32 caps = mlx5_accel_tls_device_caps(priv->mdev);
        struct net_device *netdev = priv->netdev;
+        u32 caps;
        if (!mlx5_accel_is_tls_device(priv->mdev))
                return;
+        caps = mlx5_accel_tls_device_caps(priv->mdev);
        if (caps & MLX5_ACCEL_TLS_TX) {
                netdev->features          |= NETIF_F_HW_TLS_TX;
                netdev->hw_features       |= NETIF_F_HW_TLS_TX;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index 5a7939e70190..54118b77dc1f 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -4315,22 +4315,6 @@ static int mlx5e_xdp(struct net_device *dev, struct netdev_bpf *xdp)
        }
 }
-#ifdef CONFIG_NET_POLL_CONTROLLER
-/* Fake "interrupt" called by netpoll (eg netconsole) to send skbs without
- * reenabling interrupts.
- */
-static void mlx5e_netpoll(struct net_device *dev)
-{
-        struct mlx5e_priv *priv = netdev_priv(dev);
-        struct mlx5e_channels *chs = &priv->channels;
-        int i;
-        for (i = 0; i < chs->num; i++)
-                napi_schedule(&chs->c[i]->napi);
-}
-#endif
 static const struct net_device_ops mlx5e_netdev_ops = {
        .ndo_open                = mlx5e_open,
        .ndo_stop                = mlx5e_close,
@@ -4356,9 +4340,6 @@ static const struct net_device_ops mlx5e_netdev_ops = {
 #ifdef CONFIG_MLX5_EN_ARFS
        .ndo_rx_flow_steer       = mlx5e_rx_flow_steer,
 #endif
-#ifdef CONFIG_NET_POLL_CONTROLLER
-        .ndo_poll_controller     = mlx5e_netpoll,
-#endif
 #ifdef CONFIG_MLX5_ESWITCH
        /* SRIOV E-Switch NDOs */
        .ndo_set_vf_mac          = mlx5e_set_vf_mac,
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/transobj.c b/drivers/net/ethernet/mellanox/mlx5/core/transobj.c
index dae1c5c5d27c..d2f76070ea7c 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/transobj.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/transobj.c
@@ -509,7 +509,7 @@ static int mlx5_hairpin_modify_sq(struct mlx5_core_dev *peer_mdev, u32 sqn,
        sqc = MLX5_ADDR_OF(modify_sq_in, in, ctx);
-        if (next_state == MLX5_RQC_STATE_RDY) {
+        if (next_state == MLX5_SQC_STATE_RDY) {
                MLX5_SET(sqc, sqc, hairpin_peer_rq, peer_rq);
                MLX5_SET(sqc, sqc, hairpin_peer_vhca, peer_vhca);
        }
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
index 930700413b1d..b492152c8881 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
@@ -44,8 +44,8 @@
 #define MLXSW_SP_FWREV_MINOR_TO_BRANCH(minor) ((minor) / 100)
 #define MLXSW_SP1_FWREV_MAJOR 13
-#define MLXSW_SP1_FWREV_MINOR 1702
+#define MLXSW_SP1_FWREV_MINOR 1703
-#define MLXSW_SP1_FWREV_SUBMINOR 6
+#define MLXSW_SP1_FWREV_SUBMINOR 4
 #define MLXSW_SP1_FWREV_CAN_RESET_MINOR 1702
 static const struct mlxsw_fw_rev mlxsw_sp1_fw_rev = {
diff --git a/drivers/net/ethernet/microchip/lan743x_main.c b/drivers/net/ethernet/microchip/lan743x_main.c
index e7dce79ff2c9..001b5f714c1b 100644
--- a/drivers/net/ethernet/microchip/lan743x_main.c
+++ b/drivers/net/ethernet/microchip/lan743x_main.c
@@ -2850,7 +2850,7 @@ static void lan743x_pcidev_shutdown(struct pci_dev *pdev)
        lan743x_hardware_cleanup(adapter);
 }
-#ifdef CONFIG_PM
+#ifdef CONFIG_PM_SLEEP
 static u16 lan743x_pm_wakeframe_crc16(const u8 *buf, int len)
 {
        return bitrev16(crc16(0xFFFF, buf, len));
@@ -3016,7 +3016,7 @@ static int lan743x_pm_resume(struct device *dev)
 static const struct dev_pm_ops lan743x_pm_ops = {
        SET_SYSTEM_SLEEP_PM_OPS(lan743x_pm_suspend, lan743x_pm_resume)
 };
-#endif /*CONFIG_PM */
+#endif /* CONFIG_PM_SLEEP */
 static const struct pci_device_id lan743x_pcidev_tbl[] = {
        { PCI_DEVICE(PCI_VENDOR_ID_SMSC, PCI_DEVICE_ID_SMSC_LAN7430) },
@@ -3028,7 +3028,7 @@ static struct pci_driver lan743x_pcidev_driver = {
        .id_table = lan743x_pcidev_tbl,
        .probe    = lan743x_pcidev_probe,
        .remove   = lan743x_pcidev_remove,
-#ifdef CONFIG_PM
+#ifdef CONFIG_PM_SLEEP
        .driver.pm = &lan743x_pm_ops,
 #endif
        .shutdown = lan743x_pcidev_shutdown,
diff --git a/drivers/net/ethernet/mscc/ocelot_board.c b/drivers/net/ethernet/mscc/ocelot_board.c
index 26bb3b18f3be..3cdf63e35b53 100644
--- a/drivers/net/ethernet/mscc/ocelot_board.c
+++ b/drivers/net/ethernet/mscc/ocelot_board.c
@@ -91,7 +91,7 @@ static irqreturn_t ocelot_xtr_irq_handler(int irq, void *arg)
                struct sk_buff *skb;
                struct net_device *dev;
                u32 *buf;
-                int sz, len;
+                int sz, len, buf_len;
                u32 ifh[4];
                u32 val;
                struct frame_info info;
@@ -116,14 +116,20 @@ static irqreturn_t ocelot_xtr_irq_handler(int irq, void *arg)
                        err = -ENOMEM;
                        break;
                }
-                buf = (u32 *)skb_put(skb, info.len);
+                buf_len = info.len - ETH_FCS_LEN;
+                buf = (u32 *)skb_put(skb, buf_len);
                len = 0;
                do {
                        sz = ocelot_rx_frame_word(ocelot, grp, false, &val);
                        *buf++ = val;
                        len += sz;
-                } while ((sz == 4) && (len < info.len));
+                } while (len < buf_len);
+                /* Read the FCS and discard it */
+                sz = ocelot_rx_frame_word(ocelot, grp, false, &val);
+                /* Update the statistics if part of the FCS was read before */
+                len -= ETH_FCS_LEN - sz;
                if (sz < 0) {
                        err = sz;
diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
index 253bdaef1505..8ed38fd5a852 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
+++ b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
@@ -3146,21 +3146,6 @@ nfp_net_vlan_rx_kill_vid(struct net_device *netdev, __be16 proto, u16 vid)
        return nfp_net_reconfig_mbox(nn, NFP_NET_CFG_MBOX_CMD_CTAG_FILTER_KILL);
 }
-#ifdef CONFIG_NET_POLL_CONTROLLER
-static void nfp_net_netpoll(struct net_device *netdev)
-{
-        struct nfp_net *nn = netdev_priv(netdev);
-        int i;
-        /* nfp_net's NAPIs are statically allocated so even if there is a race
-         * with reconfig path this will simply try to schedule some disabled
-         * NAPI instances.
-         */
-        for (i = 0; i < nn->dp.num_stack_tx_rings; i++)
-                napi_schedule_irqoff(&nn->r_vecs[i].napi);
-}
-#endif
 static void nfp_net_stat64(struct net_device *netdev,
                           struct rtnl_link_stats64 *stats)
 {
@@ -3519,9 +3504,6 @@ const struct net_device_ops nfp_net_netdev_ops = {
        .ndo_get_stats64        = nfp_net_stat64,
        .ndo_vlan_rx_add_vid    = nfp_net_vlan_rx_add_vid,
        .ndo_vlan_rx_kill_vid   = nfp_net_vlan_rx_kill_vid,
-#ifdef CONFIG_NET_POLL_CONTROLLER
-        .ndo_poll_controller    = nfp_net_netpoll,
-#endif
        .ndo_set_vf_mac         = nfp_app_set_vf_mac,
        .ndo_set_vf_vlan        = nfp_app_set_vf_vlan,
        .ndo_set_vf_spoofchk    = nfp_app_set_vf_spoofchk,
diff --git a/drivers/net/ethernet/qlogic/qed/qed_dcbx.c b/drivers/net/ethernet/qlogic/qed/qed_dcbx.c
index 6bb76e6d3c14..f5459de6d60a 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_dcbx.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_dcbx.c
@@ -190,10 +190,8 @@ qed_dcbx_dp_protocol(struct qed_hwfn *p_hwfn, struct qed_dcbx_results *p_data)
 static void
 qed_dcbx_set_params(struct qed_dcbx_results *p_data,
-                    struct qed_hw_info *p_info,
+                    struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt,
-                    bool enable,
+                    bool enable, u8 prio, u8 tc,
-                    u8 prio,
-                    u8 tc,
                    enum dcbx_protocol_type type,
                    enum qed_pci_personality personality)
 {
@@ -206,19 +204,30 @@ qed_dcbx_set_params(struct qed_dcbx_results *p_data,
        else
                p_data->arr[type].update = DONT_UPDATE_DCB_DSCP;
+        /* Do not add vlan tag 0 when DCB is enabled and port in UFP/OV mode */
+        if ((test_bit(QED_MF_8021Q_TAGGING, &p_hwfn->cdev->mf_bits) ||
+             test_bit(QED_MF_8021AD_TAGGING, &p_hwfn->cdev->mf_bits)))
+                p_data->arr[type].dont_add_vlan0 = true;
        /* QM reconf data */
-        if (p_info->personality == personality)
+        if (p_hwfn->hw_info.personality == personality)
-                qed_hw_info_set_offload_tc(p_info, tc);
+                qed_hw_info_set_offload_tc(&p_hwfn->hw_info, tc);
+        /* Configure dcbx vlan priority in doorbell block for roce EDPM */
+        if (test_bit(QED_MF_UFP_SPECIFIC, &p_hwfn->cdev->mf_bits) &&
+            type == DCBX_PROTOCOL_ROCE) {
+                qed_wr(p_hwfn, p_ptt, DORQ_REG_TAG1_OVRD_MODE, 1);
+                qed_wr(p_hwfn, p_ptt, DORQ_REG_PF_PCP_BB_K2, prio << 1);
+        }
 }
 /* Update app protocol data and hw_info fields with the TLV info */
 static void
 qed_dcbx_update_app_info(struct qed_dcbx_results *p_data,
-                         struct qed_hwfn *p_hwfn,
+                         struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt,
-                         bool enable,
+                         bool enable, u8 prio, u8 tc,
-                         u8 prio, u8 tc, enum dcbx_protocol_type type)
+                         enum dcbx_protocol_type type)
 {
-        struct qed_hw_info *p_info = &p_hwfn->hw_info;
        enum qed_pci_personality personality;
        enum dcbx_protocol_type id;
        int i;
@@ -231,7 +240,7 @@ qed_dcbx_update_app_info(struct qed_dcbx_results *p_data,
                personality = qed_dcbx_app_update[i].personality;
-                qed_dcbx_set_params(p_data, p_info, enable,
+                qed_dcbx_set_params(p_data, p_hwfn, p_ptt, enable,
                                    prio, tc, type, personality);
        }
 }
@@ -265,7 +274,7 @@ qed_dcbx_get_app_protocol_type(struct qed_hwfn *p_hwfn,
 * reconfiguring QM. Get protocol specific data for PF update ramrod command.
 */
 static int
-qed_dcbx_process_tlv(struct qed_hwfn *p_hwfn,
+qed_dcbx_process_tlv(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt,
                     struct qed_dcbx_results *p_data,
                     struct dcbx_app_priority_entry *p_tbl,
                     u32 pri_tc_tbl, int count, u8 dcbx_version)
@@ -309,7 +318,7 @@ qed_dcbx_process_tlv(struct qed_hwfn *p_hwfn,
                                enable = true;
                        }
-                        qed_dcbx_update_app_info(p_data, p_hwfn, enable,
+                        qed_dcbx_update_app_info(p_data, p_hwfn, p_ptt, enable,
                                                 priority, tc, type);
                }
        }
@@ -331,7 +340,7 @@ qed_dcbx_process_tlv(struct qed_hwfn *p_hwfn,
                        continue;
                enable = (type == DCBX_PROTOCOL_ETH) ? false : !!dcbx_version;
-                qed_dcbx_update_app_info(p_data, p_hwfn, enable,
+                qed_dcbx_update_app_info(p_data, p_hwfn, p_ptt, enable,
                                         priority, tc, type);
        }
@@ -341,7 +350,8 @@ qed_dcbx_process_tlv(struct qed_hwfn *p_hwfn,
 /* Parse app TLV's to update TC information in hw_info structure for
 * reconfiguring QM. Get protocol specific data for PF update ramrod command.
 */
-static int qed_dcbx_process_mib_info(struct qed_hwfn *p_hwfn)
+static int
+qed_dcbx_process_mib_info(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt)
 {
        struct dcbx_app_priority_feature *p_app;
        struct dcbx_app_priority_entry *p_tbl;
@@ -365,7 +375,7 @@ static int qed_dcbx_process_mib_info(struct qed_hwfn *p_hwfn)
        p_info = &p_hwfn->hw_info;
        num_entries = QED_MFW_GET_FIELD(p_app->flags, DCBX_APP_NUM_ENTRIES);
-        rc = qed_dcbx_process_tlv(p_hwfn, &data, p_tbl, pri_tc_tbl,
+        rc = qed_dcbx_process_tlv(p_hwfn, p_ptt, &data, p_tbl, pri_tc_tbl,
                                  num_entries, dcbx_version);
        if (rc)
                return rc;
@@ -891,7 +901,7 @@ qed_dcbx_mib_update_event(struct qed_hwfn *p_hwfn,
                return rc;
        if (type == QED_DCBX_OPERATIONAL_MIB) {
-                rc = qed_dcbx_process_mib_info(p_hwfn);
+                rc = qed_dcbx_process_mib_info(p_hwfn, p_ptt);
                if (!rc) {
                        /* reconfigure tcs of QM queues according
                         * to negotiation results
@@ -954,6 +964,7 @@ static void qed_dcbx_update_protocol_data(struct protocol_dcb_data *p_data,
        p_data->dcb_enable_flag = p_src->arr[type].enable;
        p_data->dcb_priority = p_src->arr[type].priority;
        p_data->dcb_tc = p_src->arr[type].tc;
+        p_data->dcb_dont_add_vlan0 = p_src->arr[type].dont_add_vlan0;
 }
 /* Set pf update ramrod command params */
diff --git a/drivers/net/ethernet/qlogic/qed/qed_dcbx.h b/drivers/net/ethernet/qlogic/qed/qed_dcbx.h
index a4d688c04e18..01f253ea4b22 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_dcbx.h
+++ b/drivers/net/ethernet/qlogic/qed/qed_dcbx.h
@@ -55,6 +55,7 @@ struct qed_dcbx_app_data {
        u8 update;              /* Update indication */
        u8 priority;            /* Priority */
        u8 tc;                  /* Traffic Class */
+        bool dont_add_vlan0;    /* Do not insert a vlan tag with id 0 */
 };
 #define QED_DCBX_VERSION_DISABLED       0
diff --git a/drivers/net/ethernet/qlogic/qed/qed_dev.c b/drivers/net/ethernet/qlogic/qed/qed_dev.c
index 016ca8a7ec8a..97f073fd3725 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_dev.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_dev.c
@@ -1706,7 +1706,7 @@ static int qed_vf_start(struct qed_hwfn *p_hwfn,
 int qed_hw_init(struct qed_dev *cdev, struct qed_hw_init_params *p_params)
 {
        struct qed_load_req_params load_req_params;
-        u32 load_code, param, drv_mb_param;
+        u32 load_code, resp, param, drv_mb_param;
        bool b_default_mtu = true;
        struct qed_hwfn *p_hwfn;
        int rc = 0, mfw_rc, i;
@@ -1852,6 +1852,19 @@ int qed_hw_init(struct qed_dev *cdev, struct qed_hw_init_params *p_params)
        if (IS_PF(cdev)) {
                p_hwfn = QED_LEADING_HWFN(cdev);
+                /* Get pre-negotiated values for stag, bandwidth etc. */
+                DP_VERBOSE(p_hwfn,
+                           QED_MSG_SPQ,
+                           "Sending GET_OEM_UPDATES command to trigger stag/bandwidth attention handling\n");
+                drv_mb_param = 1 << DRV_MB_PARAM_DUMMY_OEM_UPDATES_OFFSET;
+                rc = qed_mcp_cmd(p_hwfn, p_hwfn->p_main_ptt,
+                                 DRV_MSG_CODE_GET_OEM_UPDATES,
+                                 drv_mb_param, &resp, &param);
+                if (rc)
+                        DP_NOTICE(p_hwfn,
+                                  "Failed to send GET_OEM_UPDATES attention request\n");
                drv_mb_param = STORM_FW_VERSION;
                rc = qed_mcp_cmd(p_hwfn, p_hwfn->p_main_ptt,
                                 DRV_MSG_CODE_OV_UPDATE_STORM_FW_VER,
diff --git a/drivers/net/ethernet/qlogic/qed/qed_hsi.h b/drivers/net/ethernet/qlogic/qed/qed_hsi.h
index 8faceb691657..9b3ef00e5782 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_hsi.h
+++ b/drivers/net/ethernet/qlogic/qed/qed_hsi.h
@@ -12414,6 +12414,7 @@ struct public_drv_mb {
 #define DRV_MSG_SET_RESOURCE_VALUE_MSG          0x35000000
 #define DRV_MSG_CODE_OV_UPDATE_WOL              0x38000000
 #define DRV_MSG_CODE_OV_UPDATE_ESWITCH_MODE     0x39000000
+#define DRV_MSG_CODE_GET_OEM_UPDATES            0x41000000
 #define DRV_MSG_CODE_BW_UPDATE_ACK              0x32000000
 #define DRV_MSG_CODE_NIG_DRAIN                  0x30000000
@@ -12541,6 +12542,9 @@ struct public_drv_mb {
 #define DRV_MB_PARAM_ESWITCH_MODE_VEB   0x1
 #define DRV_MB_PARAM_ESWITCH_MODE_VEPA  0x2
+#define DRV_MB_PARAM_DUMMY_OEM_UPDATES_MASK     0x1
+#define DRV_MB_PARAM_DUMMY_OEM_UPDATES_OFFSET   0
 #define DRV_MB_PARAM_SET_LED_MODE_OPER          0x0
 #define DRV_MB_PARAM_SET_LED_MODE_ON            0x1
 #define DRV_MB_PARAM_SET_LED_MODE_OFF           0x2
diff --git a/drivers/net/ethernet/qlogic/qed/qed_mcp.c b/drivers/net/ethernet/qlogic/qed/qed_mcp.c
index 5d37ec7e9b0b..58c7eb9d8e1b 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_mcp.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_mcp.c
@@ -1581,13 +1581,29 @@ static void qed_mcp_update_stag(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt)
        p_hwfn->mcp_info->func_info.ovlan = (u16)shmem_info.ovlan_stag &
                                                 FUNC_MF_CFG_OV_STAG_MASK;
        p_hwfn->hw_info.ovlan = p_hwfn->mcp_info->func_info.ovlan;
-        if ((p_hwfn->hw_info.hw_mode & BIT(MODE_MF_SD)) &&
+        if (test_bit(QED_MF_OVLAN_CLSS, &p_hwfn->cdev->mf_bits)) {
-            (p_hwfn->hw_info.ovlan != QED_MCP_VLAN_UNSET)) {
+                if (p_hwfn->hw_info.ovlan != QED_MCP_VLAN_UNSET) {
-                qed_wr(p_hwfn, p_ptt,
+                        qed_wr(p_hwfn, p_ptt, NIG_REG_LLH_FUNC_TAG_VALUE,
-                       NIG_REG_LLH_FUNC_TAG_VALUE, p_hwfn->hw_info.ovlan);
+                               p_hwfn->hw_info.ovlan);
+                        qed_wr(p_hwfn, p_ptt, NIG_REG_LLH_FUNC_TAG_EN, 1);
+                        /* Configure DB to add external vlan to EDPM packets */
+                        qed_wr(p_hwfn, p_ptt, DORQ_REG_TAG1_OVRD_MODE, 1);
+                        qed_wr(p_hwfn, p_ptt, DORQ_REG_PF_EXT_VID_BB_K2,
+                               p_hwfn->hw_info.ovlan);
+                } else {
+                        qed_wr(p_hwfn, p_ptt, NIG_REG_LLH_FUNC_TAG_EN, 0);
+                        qed_wr(p_hwfn, p_ptt, NIG_REG_LLH_FUNC_TAG_VALUE, 0);
+                        qed_wr(p_hwfn, p_ptt, DORQ_REG_TAG1_OVRD_MODE, 0);
+                        qed_wr(p_hwfn, p_ptt, DORQ_REG_PF_EXT_VID_BB_K2, 0);
+                }
                qed_sp_pf_update_stag(p_hwfn);
        }
+        DP_VERBOSE(p_hwfn, QED_MSG_SP, "ovlan  = %d hw_mode = 0x%x\n",
+                   p_hwfn->mcp_info->func_info.ovlan, p_hwfn->hw_info.hw_mode);
        /* Acknowledge the MFW */
        qed_mcp_cmd(p_hwfn, p_ptt, DRV_MSG_CODE_S_TAG_UPDATE_ACK, 0,
                    &resp, &param);
diff --git a/drivers/net/ethernet/qlogic/qed/qed_reg_addr.h b/drivers/net/ethernet/qlogic/qed/qed_reg_addr.h
index f736f70956fd..2440970882c4 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_reg_addr.h
+++ b/drivers/net/ethernet/qlogic/qed/qed_reg_addr.h
@@ -216,6 +216,12 @@
        0x00c000UL
 #define  DORQ_REG_IFEN \
        0x100040UL
+#define DORQ_REG_TAG1_OVRD_MODE \
+        0x1008b4UL
+#define DORQ_REG_PF_PCP_BB_K2 \
+        0x1008c4UL
+#define DORQ_REG_PF_EXT_VID_BB_K2 \
+        0x1008c8UL
 #define DORQ_REG_DB_DROP_REASON \
        0x100a2cUL
 #define DORQ_REG_DB_DROP_DETAILS \
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index 1d8631303b53..ab30aaeac6d3 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -13,6 +13,7 @@
 #include <linux/pci.h>
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
+#include <linux/clk.h>
 #include <linux/delay.h>
 #include <linux/ethtool.h>
 #include <linux/phy.h>
@@ -665,6 +666,7 @@ struct rtl8169_private {
        u16 event_slow;
        const struct rtl_coalesce_info *coalesce_info;
+        struct clk *clk;
        struct mdio_ops {
                void (*write)(struct rtl8169_private *, int, int);
@@ -4069,6 +4071,15 @@ static void rtl8169_init_phy(struct net_device *dev, struct rtl8169_private *tp)
        phy_speed_up(dev->phydev);
        genphy_soft_reset(dev->phydev);
+        /* It was reported that chip version 33 ends up with 10MBit/Half on a
+         * 1GBit link after resuming from S3. For whatever reason the PHY on
+         * this chip doesn't properly start a renegotiation when soft-reset.
+         * Explicitly requesting a renegotiation fixes this.
+         */
+        if (tp->mac_version == RTL_GIGA_MAC_VER_33 &&
+            dev->phydev->autoneg == AUTONEG_ENABLE)
+                phy_restart_aneg(dev->phydev);
 }
 static void rtl_rar_set(struct rtl8169_private *tp, u8 *addr)
@@ -4775,12 +4786,14 @@ static void rtl_pcie_state_l2l3_enable(struct rtl8169_private *tp, bool enable)
 static void rtl_hw_aspm_clkreq_enable(struct rtl8169_private *tp, bool enable)
 {
        if (enable) {
-                RTL_W8(tp, Config2, RTL_R8(tp, Config2) | ClkReqEn);
                RTL_W8(tp, Config5, RTL_R8(tp, Config5) | ASPM_en);
+                RTL_W8(tp, Config2, RTL_R8(tp, Config2) | ClkReqEn);
        } else {
                RTL_W8(tp, Config2, RTL_R8(tp, Config2) & ~ClkReqEn);
                RTL_W8(tp, Config5, RTL_R8(tp, Config5) & ~ASPM_en);
        }
+        udelay(10);
 }
 static void rtl_hw_start_8168bb(struct rtl8169_private *tp)
@@ -5625,6 +5638,8 @@ static void rtl_hw_start_8402(struct rtl8169_private *tp)
 static void rtl_hw_start_8106(struct rtl8169_private *tp)
 {
+        rtl_hw_aspm_clkreq_enable(tp, false);
        /* Force LAN exit from ASPM if Rx/Tx are not idle */
        RTL_W32(tp, FuncEvent, RTL_R32(tp, FuncEvent) | 0x002800);
@@ -5633,6 +5648,7 @@ static void rtl_hw_start_8106(struct rtl8169_private *tp)
        RTL_W8(tp, DLLPR, RTL_R8(tp, DLLPR) & ~PFM_EN);
        rtl_pcie_state_l2l3_enable(tp, false);
+        rtl_hw_aspm_clkreq_enable(tp, true);
 }
 static void rtl_hw_start_8101(struct rtl8169_private *tp)
@@ -7257,6 +7273,11 @@ static int rtl_jumbo_max(struct rtl8169_private *tp)
        }
 }
+static void rtl_disable_clk(void *data)
+{
+        clk_disable_unprepare(data);
+}
 static int rtl_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
 {
        const struct rtl_cfg_info *cfg = rtl_cfg_infos + ent->driver_data;
@@ -7277,6 +7298,32 @@ static int rtl_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
        tp->msg_enable = netif_msg_init(debug.msg_enable, R8169_MSG_DEFAULT);
        tp->supports_gmii = cfg->has_gmii;
+        /* Get the *optional* external "ether_clk" used on some boards */
+        tp->clk = devm_clk_get(&pdev->dev, "ether_clk");
+        if (IS_ERR(tp->clk)) {
+                rc = PTR_ERR(tp->clk);
+                if (rc == -ENOENT) {
+                        /* clk-core allows NULL (for suspend / resume) */
+                        tp->clk = NULL;
+                } else if (rc == -EPROBE_DEFER) {
+                        return rc;
+                } else {
+                        dev_err(&pdev->dev, "failed to get clk: %d\n", rc);
+                        return rc;
+                }
+        } else {
+                rc = clk_prepare_enable(tp->clk);
+                if (rc) {
+                        dev_err(&pdev->dev, "failed to enable clk: %d\n", rc);
+                        return rc;
+                }
+                rc = devm_add_action_or_reset(&pdev->dev, rtl_disable_clk,
+                                              tp->clk);
+                if (rc)
+                        return rc;
+        }
        /* enable device (incl. PCI PM wakeup and hotplug setup) */
        rc = pcim_enable_device(pdev);
        if (rc < 0) {
diff --git a/drivers/net/ethernet/renesas/ravb.h b/drivers/net/ethernet/renesas/ravb.h
index 1470fc12282b..9b6bf557a2f5 100644
--- a/drivers/net/ethernet/renesas/ravb.h
+++ b/drivers/net/ethernet/renesas/ravb.h
@@ -428,6 +428,7 @@ enum EIS_BIT {
        EIS_CULF1       = 0x00000080,
        EIS_TFFF        = 0x00000100,
        EIS_QFS         = 0x00010000,
+        EIS_RESERVED    = (GENMASK(31, 17) | GENMASK(15, 11)),
 };
 /* RIC0 */
@@ -472,6 +473,7 @@ enum RIS0_BIT {
        RIS0_FRF15      = 0x00008000,
        RIS0_FRF16      = 0x00010000,
        RIS0_FRF17      = 0x00020000,
+        RIS0_RESERVED   = GENMASK(31, 18),
 };
 /* RIC1 */
@@ -528,6 +530,7 @@ enum RIS2_BIT {
        RIS2_QFF16      = 0x00010000,
        RIS2_QFF17      = 0x00020000,
        RIS2_RFFF       = 0x80000000,
+        RIS2_RESERVED   = GENMASK(30, 18),
 };
 /* TIC */
@@ -544,6 +547,7 @@ enum TIS_BIT {
        TIS_FTF1        = 0x00000002,   /* Undocumented? */
        TIS_TFUF        = 0x00000100,
        TIS_TFWF        = 0x00000200,
+        TIS_RESERVED    = (GENMASK(31, 20) | GENMASK(15, 12) | GENMASK(7, 4))
 };
 /* ISS */
@@ -617,6 +621,7 @@ enum GIC_BIT {
 enum GIS_BIT {
        GIS_PTCF        = 0x00000001,   /* Undocumented? */
        GIS_PTMF        = 0x00000004,
+        GIS_RESERVED    = GENMASK(15, 10),
 };
 /* GIE (R-Car Gen3 only) */
diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c
index aff5516b781e..d6f753925352 100644
--- a/drivers/net/ethernet/renesas/ravb_main.c
+++ b/drivers/net/ethernet/renesas/ravb_main.c
@@ -739,10 +739,11 @@ static void ravb_error_interrupt(struct net_device *ndev)
        u32 eis, ris2;
        eis = ravb_read(ndev, EIS);
-        ravb_write(ndev, ~EIS_QFS, EIS);
+        ravb_write(ndev, ~(EIS_QFS | EIS_RESERVED), EIS);
        if (eis & EIS_QFS) {
                ris2 = ravb_read(ndev, RIS2);
-                ravb_write(ndev, ~(RIS2_QFF0 | RIS2_RFFF), RIS2);
+                ravb_write(ndev, ~(RIS2_QFF0 | RIS2_RFFF | RIS2_RESERVED),
+                           RIS2);
                /* Receive Descriptor Empty int */
                if (ris2 & RIS2_QFF0)
@@ -795,7 +796,7 @@ static bool ravb_timestamp_interrupt(struct net_device *ndev)
        u32 tis = ravb_read(ndev, TIS);
        if (tis & TIS_TFUF) {
-                ravb_write(ndev, ~TIS_TFUF, TIS);
+                ravb_write(ndev, ~(TIS_TFUF | TIS_RESERVED), TIS);
                ravb_get_tx_tstamp(ndev);
                return true;
        }
@@ -930,7 +931,7 @@ static int ravb_poll(struct napi_struct *napi, int budget)
                /* Processing RX Descriptor Ring */
                if (ris0 & mask) {
                        /* Clear RX interrupt */
-                        ravb_write(ndev, ~mask, RIS0);
+                        ravb_write(ndev, ~(mask | RIS0_RESERVED), RIS0);
                        if (ravb_rx(ndev, &quota, q))
                                goto out;
                }
@@ -938,7 +939,7 @@ static int ravb_poll(struct napi_struct *napi, int budget)
                if (tis & mask) {
                        spin_lock_irqsave(&priv->lock, flags);
                        /* Clear TX interrupt */
-                        ravb_write(ndev, ~mask, TIS);
+                        ravb_write(ndev, ~(mask | TIS_RESERVED), TIS);
                        ravb_tx_free(ndev, q, true);
                        netif_wake_subqueue(ndev, q);
                        mmiowb();
diff --git a/drivers/net/ethernet/renesas/ravb_ptp.c b/drivers/net/ethernet/renesas/ravb_ptp.c
index 0721b5c35d91..dce2a40a31e3 100644
--- a/drivers/net/ethernet/renesas/ravb_ptp.c
+++ b/drivers/net/ethernet/renesas/ravb_ptp.c
@@ -315,7 +315,7 @@ void ravb_ptp_interrupt(struct net_device *ndev)
                }
        }
-        ravb_write(ndev, ~gis, GIS);
+        ravb_write(ndev, ~(gis | GIS_RESERVED), GIS);
 }
 void ravb_ptp_init(struct net_device *ndev, struct platform_device *pdev)
diff --git a/drivers/net/ethernet/seeq/ether3.c b/drivers/net/ethernet/seeq/ether3.c
index c5bc124b41a9..d1bb73bf9914 100644
--- a/drivers/net/ethernet/seeq/ether3.c
+++ b/drivers/net/ethernet/seeq/ether3.c
@@ -77,7 +77,8 @@ static void	ether3_setmulticastlist(struct net_device *dev);
 static int      ether3_rx(struct net_device *dev, unsigned int maxcnt);
 static void     ether3_tx(struct net_device *dev);
 static int      ether3_open (struct net_device *dev);
-static int      ether3_sendpacket (struct sk_buff *skb, struct net_device *dev);
+static netdev_tx_t      ether3_sendpacket(struct sk_buff *skb,
+                                          struct net_device *dev);
 static irqreturn_t ether3_interrupt (int irq, void *dev_id);
 static int      ether3_close (struct net_device *dev);
 static void     ether3_setmulticastlist (struct net_device *dev);
@@ -481,7 +482,7 @@ static void ether3_timeout(struct net_device *dev)
 /*
 * Transmit a packet
 */
-static int
+static netdev_tx_t
 ether3_sendpacket(struct sk_buff *skb, struct net_device *dev)
 {
        unsigned long flags;
diff --git a/drivers/net/ethernet/seeq/sgiseeq.c b/drivers/net/ethernet/seeq/sgiseeq.c
index 573691bc3b71..70cce63a6081 100644
--- a/drivers/net/ethernet/seeq/sgiseeq.c
+++ b/drivers/net/ethernet/seeq/sgiseeq.c
@@ -578,7 +578,8 @@ static inline int sgiseeq_reset(struct net_device *dev)
        return 0;
 }
-static int sgiseeq_start_xmit(struct sk_buff *skb, struct net_device *dev)
+static netdev_tx_t
+sgiseeq_start_xmit(struct sk_buff *skb, struct net_device *dev)
 {
        struct sgiseeq_private *sp = netdev_priv(dev);
        struct hpc3_ethregs *hregs = sp->hregs;
diff --git a/drivers/net/ethernet/sgi/ioc3-eth.c b/drivers/net/ethernet/sgi/ioc3-eth.c
index 18d533fdf14c..3140999642ba 100644
--- a/drivers/net/ethernet/sgi/ioc3-eth.c
+++ b/drivers/net/ethernet/sgi/ioc3-eth.c
@@ -99,7 +99,7 @@ struct ioc3_private {
 static int ioc3_ioctl(struct net_device *dev, struct ifreq *rq, int cmd);
 static void ioc3_set_multicast_list(struct net_device *dev);
-static int ioc3_start_xmit(struct sk_buff *skb, struct net_device *dev);
+static netdev_tx_t ioc3_start_xmit(struct sk_buff *skb, struct net_device *dev);
 static void ioc3_timeout(struct net_device *dev);
 static inline unsigned int ioc3_hash(const unsigned char *addr);
 static inline void ioc3_stop(struct ioc3_private *ip);
@@ -1390,7 +1390,7 @@ static struct pci_driver ioc3_driver = {
        .remove         = ioc3_remove_one,
 };
-static int ioc3_start_xmit(struct sk_buff *skb, struct net_device *dev)
+static netdev_tx_t ioc3_start_xmit(struct sk_buff *skb, struct net_device *dev)
 {
        unsigned long data;
        struct ioc3_private *ip = netdev_priv(dev);
diff --git a/drivers/net/ethernet/sgi/meth.c b/drivers/net/ethernet/sgi/meth.c
index ea55abd62ec7..703fbbefea44 100644
--- a/drivers/net/ethernet/sgi/meth.c
+++ b/drivers/net/ethernet/sgi/meth.c
@@ -697,7 +697,7 @@ static void meth_add_to_tx_ring(struct meth_private *priv, struct sk_buff *skb)
 /*
 * Transmit a packet (called by the kernel)
 */
-static int meth_tx(struct sk_buff *skb, struct net_device *dev)
+static netdev_tx_t meth_tx(struct sk_buff *skb, struct net_device *dev)
 {
        struct meth_private *priv = netdev_priv(dev);
        unsigned long flags;
diff --git a/drivers/net/ethernet/stmicro/stmmac/common.h b/drivers/net/ethernet/stmicro/stmmac/common.h
index 1854f270ad66..b1b305f8f414 100644
--- a/drivers/net/ethernet/stmicro/stmmac/common.h
+++ b/drivers/net/ethernet/stmicro/stmmac/common.h
@@ -258,10 +258,10 @@ struct stmmac_safety_stats {
 #define MAX_DMA_RIWT            0xff
 #define MIN_DMA_RIWT            0x20
 /* Tx coalesce parameters */
-#define STMMAC_COAL_TX_TIMER    40000
+#define STMMAC_COAL_TX_TIMER    1000
 #define STMMAC_MAX_COAL_TX_TICK 100000
 #define STMMAC_TX_MAX_FRAMES    256
-#define STMMAC_TX_FRAMES        64
+#define STMMAC_TX_FRAMES        25
 /* Packets types */
 enum packets_types {
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac.h b/drivers/net/ethernet/stmicro/stmmac/stmmac.h
index c0a855b7ab3b..63e1064b27a2 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac.h
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac.h
@@ -48,6 +48,8 @@ struct stmmac_tx_info {
 /* Frequently used values are kept adjacent for cache effect */
 struct stmmac_tx_queue {
+        u32 tx_count_frames;
+        struct timer_list txtimer;
        u32 queue_index;
        struct stmmac_priv *priv_data;
        struct dma_extended_desc *dma_etx ____cacheline_aligned_in_smp;
@@ -73,7 +75,14 @@ struct stmmac_rx_queue {
        u32 rx_zeroc_thresh;
        dma_addr_t dma_rx_phy;
        u32 rx_tail_addr;
+};
+struct stmmac_channel {
        struct napi_struct napi ____cacheline_aligned_in_smp;
+        struct stmmac_priv *priv_data;
+        u32 index;
+        int has_rx;
+        int has_tx;
 };
 struct stmmac_tc_entry {
@@ -109,14 +118,12 @@ struct stmmac_pps_cfg {
 struct stmmac_priv {
        /* Frequently used values are kept adjacent for cache effect */
-        u32 tx_count_frames;
        u32 tx_coal_frames;
        u32 tx_coal_timer;
        int tx_coalesce;
        int hwts_tx_en;
        bool tx_path_in_lpi_mode;
-        struct timer_list txtimer;
        bool tso;
        unsigned int dma_buf_sz;
@@ -137,6 +144,9 @@ struct stmmac_priv {
        /* TX Queue */
        struct stmmac_tx_queue tx_queue[MTL_MAX_TX_QUEUES];
+        /* Generic channel for NAPI */
+        struct stmmac_channel channel[STMMAC_CH_MAX];
        bool oldlink;
        int speed;
        int oldduplex;
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 9f458bb16f2a..75896d6ba6e2 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -148,12 +148,14 @@ static void stmmac_verify_args(void)
 static void stmmac_disable_all_queues(struct stmmac_priv *priv)
 {
        u32 rx_queues_cnt = priv->plat->rx_queues_to_use;
+        u32 tx_queues_cnt = priv->plat->tx_queues_to_use;
+        u32 maxq = max(rx_queues_cnt, tx_queues_cnt);
        u32 queue;
-        for (queue = 0; queue < rx_queues_cnt; queue++) {
+        for (queue = 0; queue < maxq; queue++) {
-                struct stmmac_rx_queue *rx_q = &priv->rx_queue[queue];
+                struct stmmac_channel *ch = &priv->channel[queue];
-                napi_disable(&rx_q->napi);
+                napi_disable(&ch->napi);
        }
 }
@@ -164,12 +166,14 @@ static void stmmac_disable_all_queues(struct stmmac_priv *priv)
 static void stmmac_enable_all_queues(struct stmmac_priv *priv)
 {
        u32 rx_queues_cnt = priv->plat->rx_queues_to_use;
+        u32 tx_queues_cnt = priv->plat->tx_queues_to_use;
+        u32 maxq = max(rx_queues_cnt, tx_queues_cnt);
        u32 queue;
-        for (queue = 0; queue < rx_queues_cnt; queue++) {
+        for (queue = 0; queue < maxq; queue++) {
-                struct stmmac_rx_queue *rx_q = &priv->rx_queue[queue];
+                struct stmmac_channel *ch = &priv->channel[queue];
-                napi_enable(&rx_q->napi);
+                napi_enable(&ch->napi);
        }
 }
@@ -1843,18 +1847,18 @@ static void stmmac_dma_operation_mode(struct stmmac_priv *priv)
 * @queue: TX queue index
 * Description: it reclaims the transmit resources after transmission completes.
 */
-static void stmmac_tx_clean(struct stmmac_priv *priv, u32 queue)
+static int stmmac_tx_clean(struct stmmac_priv *priv, int budget, u32 queue)
 {
        struct stmmac_tx_queue *tx_q = &priv->tx_queue[queue];
        unsigned int bytes_compl = 0, pkts_compl = 0;
-        unsigned int entry;
+        unsigned int entry, count = 0;
-        netif_tx_lock(priv->dev);
+        __netif_tx_lock_bh(netdev_get_tx_queue(priv->dev, queue));
        priv->xstats.tx_clean++;
        entry = tx_q->dirty_tx;
-        while (entry != tx_q->cur_tx) {
+        while ((entry != tx_q->cur_tx) && (count < budget)) {
                struct sk_buff *skb = tx_q->tx_skbuff[entry];
                struct dma_desc *p;
                int status;
@@ -1870,6 +1874,8 @@ static void stmmac_tx_clean(struct stmmac_priv *priv, u32 queue)
                if (unlikely(status & tx_dma_own))
                        break;
+                count++;
                /* Make sure descriptor fields are read after reading
                 * the own bit.
                 */
@@ -1937,7 +1943,10 @@ static void stmmac_tx_clean(struct stmmac_priv *priv, u32 queue)
                stmmac_enable_eee_mode(priv);
                mod_timer(&priv->eee_ctrl_timer, STMMAC_LPI_T(eee_timer));
        }
-        netif_tx_unlock(priv->dev);
+        __netif_tx_unlock_bh(netdev_get_tx_queue(priv->dev, queue));
+        return count;
 }
 /**
@@ -2020,6 +2029,33 @@ static bool stmmac_safety_feat_interrupt(struct stmmac_priv *priv)
        return false;
 }
+static int stmmac_napi_check(struct stmmac_priv *priv, u32 chan)
+{
+        int status = stmmac_dma_interrupt_status(priv, priv->ioaddr,
+                                                 &priv->xstats, chan);
+        struct stmmac_channel *ch = &priv->channel[chan];
+        bool needs_work = false;
+        if ((status & handle_rx) && ch->has_rx) {
+                needs_work = true;
+        } else {
+                status &= ~handle_rx;
+        }
+        if ((status & handle_tx) && ch->has_tx) {
+                needs_work = true;
+        } else {
+                status &= ~handle_tx;
+        }
+        if (needs_work && napi_schedule_prep(&ch->napi)) {
+                stmmac_disable_dma_irq(priv, priv->ioaddr, chan);
+                __napi_schedule(&ch->napi);
+        }
+        return status;
+}
 /**
 * stmmac_dma_interrupt - DMA ISR
 * @priv: driver private structure
@@ -2034,57 +2070,14 @@ static void stmmac_dma_interrupt(struct stmmac_priv *priv)
        u32 channels_to_check = tx_channel_count > rx_channel_count ?
                                tx_channel_count : rx_channel_count;
        u32 chan;
-        bool poll_scheduled = false;
        int status[max_t(u32, MTL_MAX_TX_QUEUES, MTL_MAX_RX_QUEUES)];
        /* Make sure we never check beyond our status buffer. */
        if (WARN_ON_ONCE(channels_to_check > ARRAY_SIZE(status)))
                channels_to_check = ARRAY_SIZE(status);
-        /* Each DMA channel can be used for rx and tx simultaneously, yet
-         * napi_struct is embedded in struct stmmac_rx_queue rather than in a
-         * stmmac_channel struct.
-         * Because of this, stmmac_poll currently checks (and possibly wakes)
-         * all tx queues rather than just a single tx queue.
-         */
        for (chan = 0; chan < channels_to_check; chan++)
-                status[chan] = stmmac_dma_interrupt_status(priv, priv->ioaddr,
+                status[chan] = stmmac_napi_check(priv, chan);
-                                &priv->xstats, chan);
-        for (chan = 0; chan < rx_channel_count; chan++) {
-                if (likely(status[chan] & handle_rx)) {
-                        struct stmmac_rx_queue *rx_q = &priv->rx_queue[chan];
-                        if (likely(napi_schedule_prep(&rx_q->napi))) {
-                                stmmac_disable_dma_irq(priv, priv->ioaddr, chan);
-                                __napi_schedule(&rx_q->napi);
-                                poll_scheduled = true;
-                        }
-                }
-        }
-        /* If we scheduled poll, we already know that tx queues will be checked.
-         * If we didn't schedule poll, see if any DMA channel (used by tx) has a
-         * completed transmission, if so, call stmmac_poll (once).
-         */
-        if (!poll_scheduled) {
-                for (chan = 0; chan < tx_channel_count; chan++) {
-                        if (status[chan] & handle_tx) {
-                                /* It doesn't matter what rx queue we choose
-                                 * here. We use 0 since it always exists.
-                                 */
-                                struct stmmac_rx_queue *rx_q =
-                                        &priv->rx_queue[0];
-                                if (likely(napi_schedule_prep(&rx_q->napi))) {
-                                        stmmac_disable_dma_irq(priv,
-                                                        priv->ioaddr, chan);
-                                        __napi_schedule(&rx_q->napi);
-                                }
-                                break;
-                        }
-                }
-        }
        for (chan = 0; chan < tx_channel_count; chan++) {
                if (unlikely(status[chan] & tx_hard_error_bump_tc)) {
@@ -2220,8 +2213,7 @@ static int stmmac_init_dma_engine(struct stmmac_priv *priv)
                stmmac_init_tx_chan(priv, priv->ioaddr, priv->plat->dma_cfg,
                                    tx_q->dma_tx_phy, chan);
-                tx_q->tx_tail_addr = tx_q->dma_tx_phy +
+                tx_q->tx_tail_addr = tx_q->dma_tx_phy;
-                            (DMA_TX_SIZE * sizeof(struct dma_desc));
                stmmac_set_tx_tail_ptr(priv, priv->ioaddr,
                                       tx_q->tx_tail_addr, chan);
        }
@@ -2233,6 +2225,13 @@ static int stmmac_init_dma_engine(struct stmmac_priv *priv)
        return ret;
 }
+static void stmmac_tx_timer_arm(struct stmmac_priv *priv, u32 queue)
+{
+        struct stmmac_tx_queue *tx_q = &priv->tx_queue[queue];
+        mod_timer(&tx_q->txtimer, STMMAC_COAL_TIMER(priv->tx_coal_timer));
+}
 /**
 * stmmac_tx_timer - mitigation sw timer for tx.
 * @data: data pointer
@@ -2241,13 +2240,14 @@ static int stmmac_init_dma_engine(struct stmmac_priv *priv)
 */
 static void stmmac_tx_timer(struct timer_list *t)
 {
-        struct stmmac_priv *priv = from_timer(priv, t, txtimer);
+        struct stmmac_tx_queue *tx_q = from_timer(tx_q, t, txtimer);
-        u32 tx_queues_count = priv->plat->tx_queues_to_use;
+        struct stmmac_priv *priv = tx_q->priv_data;
-        u32 queue;
+        struct stmmac_channel *ch;
+        ch = &priv->channel[tx_q->queue_index];
-        /* let's scan all the tx queues */
+        if (likely(napi_schedule_prep(&ch->napi)))
-        for (queue = 0; queue < tx_queues_count; queue++)
+                __napi_schedule(&ch->napi);
-                stmmac_tx_clean(priv, queue);
 }
 /**
@@ -2260,11 +2260,17 @@ static void stmmac_tx_timer(struct timer_list *t)
 */
 static void stmmac_init_tx_coalesce(struct stmmac_priv *priv)
 {
+        u32 tx_channel_count = priv->plat->tx_queues_to_use;
+        u32 chan;
        priv->tx_coal_frames = STMMAC_TX_FRAMES;
        priv->tx_coal_timer = STMMAC_COAL_TX_TIMER;
-        timer_setup(&priv->txtimer, stmmac_tx_timer, 0);
-        priv->txtimer.expires = STMMAC_COAL_TIMER(priv->tx_coal_timer);
+        for (chan = 0; chan < tx_channel_count; chan++) {
-        add_timer(&priv->txtimer);
+                struct stmmac_tx_queue *tx_q = &priv->tx_queue[chan];
+                timer_setup(&tx_q->txtimer, stmmac_tx_timer, 0);
+        }
 }
 static void stmmac_set_rings_length(struct stmmac_priv *priv)
@@ -2592,6 +2598,7 @@ static void stmmac_hw_teardown(struct net_device *dev)
 static int stmmac_open(struct net_device *dev)
 {
        struct stmmac_priv *priv = netdev_priv(dev);
+        u32 chan;
        int ret;
        stmmac_check_ether_addr(priv);
@@ -2688,7 +2695,9 @@ irq_error:
        if (dev->phydev)
                phy_stop(dev->phydev);
-        del_timer_sync(&priv->txtimer);
+        for (chan = 0; chan < priv->plat->tx_queues_to_use; chan++)
+                del_timer_sync(&priv->tx_queue[chan].txtimer);
        stmmac_hw_teardown(dev);
 init_error:
        free_dma_desc_resources(priv);
@@ -2708,6 +2717,7 @@ dma_desc_error:
 static int stmmac_release(struct net_device *dev)
 {
        struct stmmac_priv *priv = netdev_priv(dev);
+        u32 chan;
        if (priv->eee_enabled)
                del_timer_sync(&priv->eee_ctrl_timer);
@@ -2722,7 +2732,8 @@ static int stmmac_release(struct net_device *dev)
        stmmac_disable_all_queues(priv);
-        del_timer_sync(&priv->txtimer);
+        for (chan = 0; chan < priv->plat->tx_queues_to_use; chan++)
+                del_timer_sync(&priv->tx_queue[chan].txtimer);
        /* Free the IRQ lines */
        free_irq(dev->irq, dev);
@@ -2936,14 +2947,13 @@ static netdev_tx_t stmmac_tso_xmit(struct sk_buff *skb, struct net_device *dev)
        priv->xstats.tx_tso_nfrags += nfrags;
        /* Manage tx mitigation */
-        priv->tx_count_frames += nfrags + 1;
+        tx_q->tx_count_frames += nfrags + 1;
-        if (likely(priv->tx_coal_frames > priv->tx_count_frames)) {
+        if (priv->tx_coal_frames <= tx_q->tx_count_frames) {
-                mod_timer(&priv->txtimer,
-                          STMMAC_COAL_TIMER(priv->tx_coal_timer));
-        } else {
-                priv->tx_count_frames = 0;
                stmmac_set_tx_ic(priv, desc);
                priv->xstats.tx_set_ic_bit++;
+                tx_q->tx_count_frames = 0;
+        } else {
+                stmmac_tx_timer_arm(priv, queue);
        }
        skb_tx_timestamp(skb);
@@ -2992,6 +3002,7 @@ static netdev_tx_t stmmac_tso_xmit(struct sk_buff *skb, struct net_device *dev)
        netdev_tx_sent_queue(netdev_get_tx_queue(dev, queue), skb->len);
+        tx_q->tx_tail_addr = tx_q->dma_tx_phy + (tx_q->cur_tx * sizeof(*desc));
        stmmac_set_tx_tail_ptr(priv, priv->ioaddr, tx_q->tx_tail_addr, queue);
        return NETDEV_TX_OK;
@@ -3146,14 +3157,13 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)
         * This approach takes care about the fragments: desc is the first
         * element in case of no SG.
         */
-        priv->tx_count_frames += nfrags + 1;
+        tx_q->tx_count_frames += nfrags + 1;
-        if (likely(priv->tx_coal_frames > priv->tx_count_frames)) {
+        if (priv->tx_coal_frames <= tx_q->tx_count_frames) {
-                mod_timer(&priv->txtimer,
-                          STMMAC_COAL_TIMER(priv->tx_coal_timer));
-        } else {
-                priv->tx_count_frames = 0;
                stmmac_set_tx_ic(priv, desc);
                priv->xstats.tx_set_ic_bit++;
+                tx_q->tx_count_frames = 0;
+        } else {
+                stmmac_tx_timer_arm(priv, queue);
        }
        skb_tx_timestamp(skb);
@@ -3199,6 +3209,8 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)
        netdev_tx_sent_queue(netdev_get_tx_queue(dev, queue), skb->len);
        stmmac_enable_dma_transmission(priv, priv->ioaddr);
+        tx_q->tx_tail_addr = tx_q->dma_tx_phy + (tx_q->cur_tx * sizeof(*desc));
        stmmac_set_tx_tail_ptr(priv, priv->ioaddr, tx_q->tx_tail_addr, queue);
        return NETDEV_TX_OK;
@@ -3319,6 +3331,7 @@ static inline void stmmac_rx_refill(struct stmmac_priv *priv, u32 queue)
 static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)
 {
        struct stmmac_rx_queue *rx_q = &priv->rx_queue[queue];
+        struct stmmac_channel *ch = &priv->channel[queue];
        unsigned int entry = rx_q->cur_rx;
        int coe = priv->hw->rx_csum;
        unsigned int next_entry;
@@ -3491,7 +3504,7 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)
                        else
                                skb->ip_summed = CHECKSUM_UNNECESSARY;
-                        napi_gro_receive(&rx_q->napi, skb);
+                        napi_gro_receive(&ch->napi, skb);
                        priv->dev->stats.rx_packets++;
                        priv->dev->stats.rx_bytes += frame_len;
@@ -3514,27 +3527,33 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)
 *  Description :
 *  To look at the incoming frames and clear the tx resources.
 */
-static int stmmac_poll(struct napi_struct *napi, int budget)
+static int stmmac_napi_poll(struct napi_struct *napi, int budget)
 {
-        struct stmmac_rx_queue *rx_q =
+        struct stmmac_channel *ch =
-                container_of(napi, struct stmmac_rx_queue, napi);
+                container_of(napi, struct stmmac_channel, napi);
-        struct stmmac_priv *priv = rx_q->priv_data;
+        struct stmmac_priv *priv = ch->priv_data;
-        u32 tx_count = priv->plat->tx_queues_to_use;
+        int work_done = 0, work_rem = budget;
-        u32 chan = rx_q->queue_index;
+        u32 chan = ch->index;
-        int work_done = 0;
-        u32 queue;
        priv->xstats.napi_poll++;
-        /* check all the queues */
+        if (ch->has_tx) {
-        for (queue = 0; queue < tx_count; queue++)
+                int done = stmmac_tx_clean(priv, work_rem, chan);
-                stmmac_tx_clean(priv, queue);
-        work_done = stmmac_rx(priv, budget, rx_q->queue_index);
+                work_done += done;
-        if (work_done < budget) {
+                work_rem -= done;
-                napi_complete_done(napi, work_done);
+        }
-                stmmac_enable_dma_irq(priv, priv->ioaddr, chan);
+        if (ch->has_rx) {
+                int done = stmmac_rx(priv, work_rem, chan);
+                work_done += done;
+                work_rem -= done;
        }
+        if (work_done < budget && napi_complete_done(napi, work_done))
+                stmmac_enable_dma_irq(priv, priv->ioaddr, chan);
        return work_done;
 }
@@ -4198,8 +4217,8 @@ int stmmac_dvr_probe(struct device *device,
 {
        struct net_device *ndev = NULL;
        struct stmmac_priv *priv;
+        u32 queue, maxq;
        int ret = 0;
-        u32 queue;
        ndev = alloc_etherdev_mqs(sizeof(struct stmmac_priv),
                                  MTL_MAX_TX_QUEUES,
@@ -4322,11 +4341,22 @@ int stmmac_dvr_probe(struct device *device,
                         "Enable RX Mitigation via HW Watchdog Timer\n");
        }
-        for (queue = 0; queue < priv->plat->rx_queues_to_use; queue++) {
+        /* Setup channels NAPI */
-                struct stmmac_rx_queue *rx_q = &priv->rx_queue[queue];
+        maxq = max(priv->plat->rx_queues_to_use, priv->plat->tx_queues_to_use);
-                netif_napi_add(ndev, &rx_q->napi, stmmac_poll,
+        for (queue = 0; queue < maxq; queue++) {
-                               (8 * priv->plat->rx_queues_to_use));
+                struct stmmac_channel *ch = &priv->channel[queue];
+                ch->priv_data = priv;
+                ch->index = queue;
+                if (queue < priv->plat->rx_queues_to_use)
+                        ch->has_rx = true;
+                if (queue < priv->plat->tx_queues_to_use)
+                        ch->has_tx = true;
+                netif_napi_add(ndev, &ch->napi, stmmac_napi_poll,
+                               NAPI_POLL_WEIGHT);
        }
        mutex_init(&priv->lock);
@@ -4372,10 +4402,10 @@ error_netdev_register:
            priv->hw->pcs != STMMAC_PCS_RTBI)
                stmmac_mdio_unregister(ndev);
 error_mdio_register:
-        for (queue = 0; queue < priv->plat->rx_queues_to_use; queue++) {
+        for (queue = 0; queue < maxq; queue++) {
-                struct stmmac_rx_queue *rx_q = &priv->rx_queue[queue];
+                struct stmmac_channel *ch = &priv->channel[queue];
-                netif_napi_del(&rx_q->napi);
+                netif_napi_del(&ch->napi);
        }
 error_hw_init:
        destroy_workqueue(priv->wq);
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
index 3609c7b696c7..2b800ce1d5bf 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
@@ -67,7 +67,7 @@ static int dwmac1000_validate_mcast_bins(int mcast_bins)
 * Description:
 * This function validates the number of Unicast address entries supported
 * by a particular Synopsys 10/100/1000 controller. The Synopsys controller
- * supports 1, 32, 64, or 128 Unicast filter entries for it's Unicast filter
+ * supports 1..32, 64, or 128 Unicast filter entries for it's Unicast filter
 * logic. This function validates a valid, supported configuration is
 * selected, and defaults to 1 Unicast address if an unsupported
 * configuration is selected.
@@ -77,8 +77,7 @@ static int dwmac1000_validate_ucast_entries(int ucast_entries)
        int x = ucast_entries;
        switch (x) {
-        case 1:
+        case 1 ... 32:
-        case 32:
        case 64:
        case 128:
                break;
diff --git a/drivers/net/ethernet/ti/Kconfig b/drivers/net/ethernet/ti/Kconfig
index 9263d638bd6d..f932923f7d56 100644
--- a/drivers/net/ethernet/ti/Kconfig
+++ b/drivers/net/ethernet/ti/Kconfig
@@ -41,6 +41,7 @@ config TI_DAVINCI_MDIO
 config TI_DAVINCI_CPDMA
        tristate "TI DaVinci CPDMA Support"
        depends on ARCH_DAVINCI || ARCH_OMAP2PLUS || COMPILE_TEST
+        select GENERIC_ALLOCATOR
        ---help---
          This driver supports TI's DaVinci CPDMA dma engine.
diff --git a/drivers/net/ethernet/wiznet/w5100.c b/drivers/net/ethernet/wiznet/w5100.c
index 2bdfb39215e9..d8ba512f166a 100644
--- a/drivers/net/ethernet/wiznet/w5100.c
+++ b/drivers/net/ethernet/wiznet/w5100.c
@@ -835,7 +835,7 @@ static void w5100_tx_work(struct work_struct *work)
        w5100_tx_skb(priv->ndev, skb);
 }
-static int w5100_start_tx(struct sk_buff *skb, struct net_device *ndev)
+static netdev_tx_t w5100_start_tx(struct sk_buff *skb, struct net_device *ndev)
 {
        struct w5100_priv *priv = netdev_priv(ndev);
diff --git a/drivers/net/ethernet/wiznet/w5300.c b/drivers/net/ethernet/wiznet/w5300.c
index 56ae573001e8..80fdbff67d82 100644
--- a/drivers/net/ethernet/wiznet/w5300.c
+++ b/drivers/net/ethernet/wiznet/w5300.c
@@ -365,7 +365,7 @@ static void w5300_tx_timeout(struct net_device *ndev)
        netif_wake_queue(ndev);
 }
-static int w5300_start_tx(struct sk_buff *skb, struct net_device *ndev)
+static netdev_tx_t w5300_start_tx(struct sk_buff *skb, struct net_device *ndev)
 {
        struct w5300_priv *priv = netdev_priv(ndev);
diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c
index 31c3d77b4733..fe01e141c8f8 100644
--- a/drivers/net/hyperv/netvsc.c
+++ b/drivers/net/hyperv/netvsc.c
@@ -1203,6 +1203,9 @@ static void netvsc_send_vf(struct net_device *ndev,
        net_device_ctx->vf_alloc = nvmsg->msg.v4_msg.vf_assoc.allocated;
        net_device_ctx->vf_serial = nvmsg->msg.v4_msg.vf_assoc.serial;
+        netdev_info(ndev, "VF slot %u %s\n",
+                    net_device_ctx->vf_serial,
+                    net_device_ctx->vf_alloc ? "added" : "removed");
 }
 static  void netvsc_receive_inband(struct net_device *ndev,
diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index 70921bbe0e28..3af6d8d15233 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -1894,20 +1894,6 @@ out_unlock:
        rtnl_unlock();
 }
-static struct net_device *get_netvsc_bymac(const u8 *mac)
-{
-        struct net_device_context *ndev_ctx;
-        list_for_each_entry(ndev_ctx, &netvsc_dev_list, list) {
-                struct net_device *dev = hv_get_drvdata(ndev_ctx->device_ctx);
-                if (ether_addr_equal(mac, dev->perm_addr))
-                        return dev;
-        }
-        return NULL;
-}
 static struct net_device *get_netvsc_byref(struct net_device *vf_netdev)
 {
        struct net_device_context *net_device_ctx;
@@ -2036,26 +2022,48 @@ static void netvsc_vf_setup(struct work_struct *w)
        rtnl_unlock();
 }
+/* Find netvsc by VMBus serial number.
+ * The PCI hyperv controller records the serial number as the slot.
+ */
+static struct net_device *get_netvsc_byslot(const struct net_device *vf_netdev)
+{
+        struct device *parent = vf_netdev->dev.parent;
+        struct net_device_context *ndev_ctx;
+        struct pci_dev *pdev;
+        if (!parent || !dev_is_pci(parent))
+                return NULL; /* not a PCI device */
+        pdev = to_pci_dev(parent);
+        if (!pdev->slot) {
+                netdev_notice(vf_netdev, "no PCI slot information\n");
+                return NULL;
+        }
+        list_for_each_entry(ndev_ctx, &netvsc_dev_list, list) {
+                if (!ndev_ctx->vf_alloc)
+                        continue;
+                if (ndev_ctx->vf_serial == pdev->slot->number)
+                        return hv_get_drvdata(ndev_ctx->device_ctx);
+        }
+        netdev_notice(vf_netdev,
+                      "no netdev found for slot %u\n", pdev->slot->number);
+        return NULL;
+}
 static int netvsc_register_vf(struct net_device *vf_netdev)
 {
-        struct net_device *ndev;
        struct net_device_context *net_device_ctx;
-        struct device *pdev = vf_netdev->dev.parent;
        struct netvsc_device *netvsc_dev;
+        struct net_device *ndev;
        int ret;
        if (vf_netdev->addr_len != ETH_ALEN)
                return NOTIFY_DONE;
-        if (!pdev || !dev_is_pci(pdev) || dev_is_pf(pdev))
+        ndev = get_netvsc_byslot(vf_netdev);
-                return NOTIFY_DONE;
-        /*
-         * We will use the MAC address to locate the synthetic interface to
-         * associate with the VF interface. If we don't find a matching
-         * synthetic interface, move on.
-         */
-        ndev = get_netvsc_bymac(vf_netdev->perm_addr);
        if (!ndev)
                return NOTIFY_DONE;
@@ -2272,17 +2280,15 @@ static int netvsc_remove(struct hv_device *dev)
        cancel_delayed_work_sync(&ndev_ctx->dwork);
-        rcu_read_lock();
+        rtnl_lock();
-        nvdev = rcu_dereference(ndev_ctx->nvdev);
+        nvdev = rtnl_dereference(ndev_ctx->nvdev);
+        if (nvdev)
-        if  (nvdev)
                cancel_work_sync(&nvdev->subchan_work);
        /*
         * Call to the vsc driver to let it know that the device is being
         * removed. Also blocks mtu and channel changes.
         */
-        rtnl_lock();
        vf_netdev = rtnl_dereference(ndev_ctx->vf_netdev);
        if (vf_netdev)
                netvsc_unregister_vf(vf_netdev);
@@ -2294,7 +2300,6 @@ static int netvsc_remove(struct hv_device *dev)
        list_del(&ndev_ctx->list);
        rtnl_unlock();
-        rcu_read_unlock();
        hv_set_drvdata(dev, NULL);
diff --git a/drivers/net/phy/sfp-bus.c b/drivers/net/phy/sfp-bus.c
index 740655261e5b..83060fb349f4 100644
--- a/drivers/net/phy/sfp-bus.c
+++ b/drivers/net/phy/sfp-bus.c
@@ -349,6 +349,7 @@ static int sfp_register_bus(struct sfp_bus *bus)
        }
        if (bus->started)
                bus->socket_ops->start(bus->sfp);
+        bus->netdev->sfp_bus = bus;
        bus->registered = true;
        return 0;
 }
@@ -357,6 +358,7 @@ static void sfp_unregister_bus(struct sfp_bus *bus)
 {
        const struct sfp_upstream_ops *ops = bus->upstream_ops;
+        bus->netdev->sfp_bus = NULL;
        if (bus->registered) {
                if (bus->started)
                        bus->socket_ops->stop(bus->sfp);
@@ -438,7 +440,6 @@ static void sfp_upstream_clear(struct sfp_bus *bus)
 {
        bus->upstream_ops = NULL;
        bus->upstream = NULL;
-        bus->netdev->sfp_bus = NULL;
        bus->netdev = NULL;
 }
@@ -467,7 +468,6 @@ struct sfp_bus *sfp_register_upstream(struct fwnode_handle *fwnode,
                bus->upstream_ops = ops;
                bus->upstream = upstream;
                bus->netdev = ndev;
-                ndev->sfp_bus = bus;
                if (bus->sfp) {
                        ret = sfp_register_bus(bus);
diff --git a/drivers/net/ppp/pppoe.c b/drivers/net/ppp/pppoe.c
index ce61231e96ea..62dc564b251d 100644
--- a/drivers/net/ppp/pppoe.c
+++ b/drivers/net/ppp/pppoe.c
@@ -429,6 +429,9 @@ static int pppoe_rcv(struct sk_buff *skb, struct net_device *dev,
        if (!skb)
                goto out;
+        if (skb_mac_header_len(skb) < ETH_HLEN)
+                goto drop;
        if (!pskb_may_pull(skb, sizeof(struct pppoe_hdr)))
                goto drop;
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index ebd07ad82431..e2648b5a3861 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1153,43 +1153,6 @@ static netdev_features_t tun_net_fix_features(struct net_device *dev,
        return (features & tun->set_features) | (features & ~TUN_USER_FEATURES);
 }
-#ifdef CONFIG_NET_POLL_CONTROLLER
-static void tun_poll_controller(struct net_device *dev)
-{
-        /*
-         * Tun only receives frames when:
-         * 1) the char device endpoint gets data from user space
-         * 2) the tun socket gets a sendmsg call from user space
-         * If NAPI is not enabled, since both of those are synchronous
-         * operations, we are guaranteed never to have pending data when we poll
-         * for it so there is nothing to do here but return.
-         * We need this though so netpoll recognizes us as an interface that
-         * supports polling, which enables bridge devices in virt setups to
-         * still use netconsole
-         * If NAPI is enabled, however, we need to schedule polling for all
-         * queues unless we are using napi_gro_frags(), which we call in
-         * process context and not in NAPI context.
-         */
-        struct tun_struct *tun = netdev_priv(dev);
-        if (tun->flags & IFF_NAPI) {
-                struct tun_file *tfile;
-                int i;
-                if (tun_napi_frags_enabled(tun))
-                        return;
-                rcu_read_lock();
-                for (i = 0; i < tun->numqueues; i++) {
-                        tfile = rcu_dereference(tun->tfiles[i]);
-                        if (tfile->napi_enabled)
-                                napi_schedule(&tfile->napi);
-                }
-                rcu_read_unlock();
-        }
-        return;
-}
-#endif
 static void tun_set_headroom(struct net_device *dev, int new_hr)
 {
@@ -1283,9 +1246,6 @@ static const struct net_device_ops tun_netdev_ops = {
        .ndo_start_xmit         = tun_net_xmit,
        .ndo_fix_features       = tun_net_fix_features,
        .ndo_select_queue       = tun_select_queue,
-#ifdef CONFIG_NET_POLL_CONTROLLER
-        .ndo_poll_controller    = tun_poll_controller,
-#endif
        .ndo_set_rx_headroom    = tun_set_headroom,
        .ndo_get_stats64        = tun_net_get_stats64,
 };
@@ -1365,9 +1325,6 @@ static const struct net_device_ops tap_netdev_ops = {
        .ndo_set_mac_address    = eth_mac_addr,
        .ndo_validate_addr      = eth_validate_addr,
        .ndo_select_queue       = tun_select_queue,
-#ifdef CONFIG_NET_POLL_CONTROLLER
-        .ndo_poll_controller    = tun_poll_controller,
-#endif
        .ndo_features_check     = passthru_features_check,
        .ndo_set_rx_headroom    = tun_set_headroom,
        .ndo_get_stats64        = tun_net_get_stats64,
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index e3270deecec2..533b6fb8d923 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -1213,13 +1213,13 @@ static const struct usb_device_id products[] = {
        {QMI_FIXED_INTF(0x1199, 0x9061, 8)},    /* Sierra Wireless Modem */
        {QMI_FIXED_INTF(0x1199, 0x9063, 8)},    /* Sierra Wireless EM7305 */
        {QMI_FIXED_INTF(0x1199, 0x9063, 10)},   /* Sierra Wireless EM7305 */
-        {QMI_FIXED_INTF(0x1199, 0x9071, 8)},    /* Sierra Wireless MC74xx */
+        {QMI_QUIRK_SET_DTR(0x1199, 0x9071, 8)}, /* Sierra Wireless MC74xx */
-        {QMI_FIXED_INTF(0x1199, 0x9071, 10)},   /* Sierra Wireless MC74xx */
+        {QMI_QUIRK_SET_DTR(0x1199, 0x9071, 10)},/* Sierra Wireless MC74xx */
-        {QMI_FIXED_INTF(0x1199, 0x9079, 8)},    /* Sierra Wireless EM74xx */
+        {QMI_QUIRK_SET_DTR(0x1199, 0x9079, 8)}, /* Sierra Wireless EM74xx */
-        {QMI_FIXED_INTF(0x1199, 0x9079, 10)},   /* Sierra Wireless EM74xx */
+        {QMI_QUIRK_SET_DTR(0x1199, 0x9079, 10)},/* Sierra Wireless EM74xx */
-        {QMI_FIXED_INTF(0x1199, 0x907b, 8)},    /* Sierra Wireless EM74xx */
+        {QMI_QUIRK_SET_DTR(0x1199, 0x907b, 8)}, /* Sierra Wireless EM74xx */
-        {QMI_FIXED_INTF(0x1199, 0x907b, 10)},   /* Sierra Wireless EM74xx */
+        {QMI_QUIRK_SET_DTR(0x1199, 0x907b, 10)},/* Sierra Wireless EM74xx */
-        {QMI_FIXED_INTF(0x1199, 0x9091, 8)},    /* Sierra Wireless EM7565 */
+        {QMI_QUIRK_SET_DTR(0x1199, 0x9091, 8)}, /* Sierra Wireless EM7565 */
        {QMI_FIXED_INTF(0x1bbb, 0x011e, 4)},    /* Telekom Speedstick LTE II (Alcatel One Touch L100V LTE) */
        {QMI_FIXED_INTF(0x1bbb, 0x0203, 2)},    /* Alcatel L800MA */
        {QMI_FIXED_INTF(0x2357, 0x0201, 4)},    /* TP-LINK HSUPA Modem MA180 */
diff --git a/drivers/net/veth.c b/drivers/net/veth.c
index 8d679c8b7f25..41a00cd76955 100644
--- a/drivers/net/veth.c
+++ b/drivers/net/veth.c
@@ -463,6 +463,8 @@ static struct sk_buff *veth_xdp_rcv_skb(struct veth_rq *rq, struct sk_buff *skb,
        int mac_len, delta, off;
        struct xdp_buff xdp;
+        skb_orphan(skb);
        rcu_read_lock();
        xdp_prog = rcu_dereference(rq->xdp_prog);
        if (unlikely(!xdp_prog)) {
@@ -508,8 +510,6 @@ static struct sk_buff *veth_xdp_rcv_skb(struct veth_rq *rq, struct sk_buff *skb,
                skb_copy_header(nskb, skb);
                head_off = skb_headroom(nskb) - skb_headroom(skb);
                skb_headers_offset_update(nskb, head_off);
-                if (skb->sk)
-                        skb_set_owner_w(nskb, skb->sk);
                consume_skb(skb);
                skb = nskb;
        }
diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index 9407acbd19a9..f17f602e6171 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -908,7 +908,11 @@ static RING_IDX xennet_fill_frags(struct netfront_queue *queue,
                        BUG_ON(pull_to <= skb_headlen(skb));
                        __pskb_pull_tail(skb, pull_to - skb_headlen(skb));
                }
-                BUG_ON(skb_shinfo(skb)->nr_frags >= MAX_SKB_FRAGS);
+                if (unlikely(skb_shinfo(skb)->nr_frags >= MAX_SKB_FRAGS)) {
+                        queue->rx.rsp_cons = ++cons;
+                        kfree_skb(nskb);
+                        return ~0U;
+                }
                skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags,
                                skb_frag_page(nfrag),
@@ -1045,6 +1049,8 @@ err:
                skb->len += rx->status;
                i = xennet_fill_frags(queue, skb, &tmpq);
+                if (unlikely(i == ~0U))
+                        goto err;
                if (rx->flags & XEN_NETRXF_csum_blank)
                        skb->ip_summed = CHECKSUM_PARTIAL;
diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
index 5a9562881d4e..9fe3fff818b8 100644
--- a/drivers/nvme/host/multipath.c
+++ b/drivers/nvme/host/multipath.c
@@ -537,8 +537,10 @@ int nvme_mpath_init(struct nvme_ctrl *ctrl, struct nvme_id_ctrl *id)
        INIT_WORK(&ctrl->ana_work, nvme_ana_work);
        ctrl->ana_log_buf = kmalloc(ctrl->ana_log_size, GFP_KERNEL);
-        if (!ctrl->ana_log_buf)
+        if (!ctrl->ana_log_buf) {
+                error = -ENOMEM;
                goto out;
+        }
        error = nvme_read_ana_log(ctrl, true);
        if (error)
@@ -547,7 +549,7 @@ int nvme_mpath_init(struct nvme_ctrl *ctrl, struct nvme_id_ctrl *id)
 out_free_ana_log_buf:
        kfree(ctrl->ana_log_buf);
 out:
-        return -ENOMEM;
+        return error;
 }
 void nvme_mpath_uninit(struct nvme_ctrl *ctrl)
diff --git a/drivers/nvme/target/admin-cmd.c b/drivers/nvme/target/admin-cmd.c
index a21caea1e080..2008fa62a373 100644
--- a/drivers/nvme/target/admin-cmd.c
+++ b/drivers/nvme/target/admin-cmd.c
@@ -245,6 +245,10 @@ static void nvmet_execute_get_log_page_ana(struct nvmet_req *req)
                offset += len;
                ngrps++;
        }
+        for ( ; grpid <= NVMET_MAX_ANAGRPS; grpid++) {
+                if (nvmet_ana_group_enabled[grpid])
+                        ngrps++;
+        }
        hdr.chgcnt = cpu_to_le64(nvmet_ana_chgcnt);
        hdr.ngrps = cpu_to_le16(ngrps);
diff --git a/drivers/pci/controller/dwc/pcie-designware.c b/drivers/pci/controller/dwc/pcie-designware.c
index 778c4f76a884..2153956a0b20 100644
--- a/drivers/pci/controller/dwc/pcie-designware.c
+++ b/drivers/pci/controller/dwc/pcie-designware.c
@@ -135,7 +135,7 @@ static void dw_pcie_prog_outbound_atu_unroll(struct dw_pcie *pci, int index,
                if (val & PCIE_ATU_ENABLE)
                        return;
-                usleep_range(LINK_WAIT_IATU_MIN, LINK_WAIT_IATU_MAX);
+                mdelay(LINK_WAIT_IATU);
        }
        dev_err(pci->dev, "Outbound iATU is not being enabled\n");
 }
@@ -178,7 +178,7 @@ void dw_pcie_prog_outbound_atu(struct dw_pcie *pci, int index, int type,
                if (val & PCIE_ATU_ENABLE)
                        return;
-                usleep_range(LINK_WAIT_IATU_MIN, LINK_WAIT_IATU_MAX);
+                mdelay(LINK_WAIT_IATU);
        }
        dev_err(pci->dev, "Outbound iATU is not being enabled\n");
 }
@@ -236,7 +236,7 @@ static int dw_pcie_prog_inbound_atu_unroll(struct dw_pcie *pci, int index,
                if (val & PCIE_ATU_ENABLE)
                        return 0;
-                usleep_range(LINK_WAIT_IATU_MIN, LINK_WAIT_IATU_MAX);
+                mdelay(LINK_WAIT_IATU);
        }
        dev_err(pci->dev, "Inbound iATU is not being enabled\n");
@@ -282,7 +282,7 @@ int dw_pcie_prog_inbound_atu(struct dw_pcie *pci, int index, int bar,
                if (val & PCIE_ATU_ENABLE)
                        return 0;
-                usleep_range(LINK_WAIT_IATU_MIN, LINK_WAIT_IATU_MAX);
+                mdelay(LINK_WAIT_IATU);
        }
        dev_err(pci->dev, "Inbound iATU is not being enabled\n");
diff --git a/drivers/pci/controller/dwc/pcie-designware.h b/drivers/pci/controller/dwc/pcie-designware.h
index 96126fd8403c..9f1a5e399b70 100644
--- a/drivers/pci/controller/dwc/pcie-designware.h
+++ b/drivers/pci/controller/dwc/pcie-designware.h
@@ -26,8 +26,7 @@
 /* Parameters for the waiting for iATU enabled routine */
 #define LINK_WAIT_MAX_IATU_RETRIES      5
-#define LINK_WAIT_IATU_MIN              9000
+#define LINK_WAIT_IATU                  9
-#define LINK_WAIT_IATU_MAX              10000
 /* Synopsys-specific PCIe configuration registers */
 #define PCIE_PORT_LINK_CONTROL          0x710
diff --git a/drivers/pci/controller/pci-hyperv.c b/drivers/pci/controller/pci-hyperv.c
index c00f82cc54aa..9ba4d12c179c 100644
--- a/drivers/pci/controller/pci-hyperv.c
+++ b/drivers/pci/controller/pci-hyperv.c
@@ -89,6 +89,9 @@ static enum pci_protocol_version_t pci_protocol_version;
 #define STATUS_REVISION_MISMATCH 0xC0000059
+/* space for 32bit serial number as string */
+#define SLOT_NAME_SIZE 11
 /*
 * Message Types
 */
@@ -494,6 +497,7 @@ struct hv_pci_dev {
        struct list_head list_entry;
        refcount_t refs;
        enum hv_pcichild_state state;
+        struct pci_slot *pci_slot;
        struct pci_function_description desc;
        bool reported_missing;
        struct hv_pcibus_device *hbus;
@@ -1457,6 +1461,36 @@ static void prepopulate_bars(struct hv_pcibus_device *hbus)
        spin_unlock_irqrestore(&hbus->device_list_lock, flags);
 }
+/*
+ * Assign entries in sysfs pci slot directory.
+ *
+ * Note that this function does not need to lock the children list
+ * because it is called from pci_devices_present_work which
+ * is serialized with hv_eject_device_work because they are on the
+ * same ordered workqueue. Therefore hbus->children list will not change
+ * even when pci_create_slot sleeps.
+ */
+static void hv_pci_assign_slots(struct hv_pcibus_device *hbus)
+{
+        struct hv_pci_dev *hpdev;
+        char name[SLOT_NAME_SIZE];
+        int slot_nr;
+        list_for_each_entry(hpdev, &hbus->children, list_entry) {
+                if (hpdev->pci_slot)
+                        continue;
+                slot_nr = PCI_SLOT(wslot_to_devfn(hpdev->desc.win_slot.slot));
+                snprintf(name, SLOT_NAME_SIZE, "%u", hpdev->desc.ser);
+                hpdev->pci_slot = pci_create_slot(hbus->pci_bus, slot_nr,
+                                          name, NULL);
+                if (IS_ERR(hpdev->pci_slot)) {
+                        pr_warn("pci_create slot %s failed\n", name);
+                        hpdev->pci_slot = NULL;
+                }
+        }
+}
 /**
 * create_root_hv_pci_bus() - Expose a new root PCI bus
 * @hbus:       Root PCI bus, as understood by this driver
@@ -1480,6 +1514,7 @@ static int create_root_hv_pci_bus(struct hv_pcibus_device *hbus)
        pci_lock_rescan_remove();
        pci_scan_child_bus(hbus->pci_bus);
        pci_bus_assign_resources(hbus->pci_bus);
+        hv_pci_assign_slots(hbus);
        pci_bus_add_devices(hbus->pci_bus);
        pci_unlock_rescan_remove();
        hbus->state = hv_pcibus_installed;
@@ -1742,6 +1777,7 @@ static void pci_devices_present_work(struct work_struct *work)
                 */
                pci_lock_rescan_remove();
                pci_scan_child_bus(hbus->pci_bus);
+                hv_pci_assign_slots(hbus);
                pci_unlock_rescan_remove();
                break;
@@ -1858,6 +1894,9 @@ static void hv_eject_device_work(struct work_struct *work)
        list_del(&hpdev->list_entry);
        spin_unlock_irqrestore(&hpdev->hbus->device_list_lock, flags);
+        if (hpdev->pci_slot)
+                pci_destroy_slot(hpdev->pci_slot);
        memset(&ctxt, 0, sizeof(ctxt));
        ejct_pkt = (struct pci_eject_response *)&ctxt.pkt.message;
        ejct_pkt->message_type.type = PCI_EJECTION_COMPLETE;
diff --git a/drivers/pci/hotplug/acpiphp_glue.c b/drivers/pci/hotplug/acpiphp_glue.c
index ef0b1b6ba86f..12afa7fdf77e 100644
--- a/drivers/pci/hotplug/acpiphp_glue.c
+++ b/drivers/pci/hotplug/acpiphp_glue.c
@@ -457,17 +457,18 @@ static void acpiphp_native_scan_bridge(struct pci_dev *bridge)
 /**
 * enable_slot - enable, configure a slot
 * @slot: slot to be enabled
+ * @bridge: true if enable is for the whole bridge (not a single slot)
 *
 * This function should be called per *physical slot*,
 * not per each slot object in ACPI namespace.
 */
-static void enable_slot(struct acpiphp_slot *slot)
+static void enable_slot(struct acpiphp_slot *slot, bool bridge)
 {
        struct pci_dev *dev;
        struct pci_bus *bus = slot->bus;
        struct acpiphp_func *func;
-        if (bus->self && hotplug_is_native(bus->self)) {
+        if (bridge && bus->self && hotplug_is_native(bus->self)) {
                /*
                 * If native hotplug is used, it will take care of hotplug
                 * slot management and resource allocation for hotplug
@@ -701,7 +702,7 @@ static void acpiphp_check_bridge(struct acpiphp_bridge *bridge)
                                        trim_stale_devices(dev);
                        /* configure all functions */
-                        enable_slot(slot);
+                        enable_slot(slot, true);
                } else {
                        disable_slot(slot);
                }
@@ -785,7 +786,7 @@ static void hotplug_event(u32 type, struct acpiphp_context *context)
                if (bridge)
                        acpiphp_check_bridge(bridge);
                else if (!(slot->flags & SLOT_IS_GOING_AWAY))
-                        enable_slot(slot);
+                        enable_slot(slot, false);
                break;
@@ -973,7 +974,7 @@ int acpiphp_enable_slot(struct acpiphp_slot *slot)
        /* configure all functions */
        if (!(slot->flags & SLOT_ENABLED))
-                enable_slot(slot);
+                enable_slot(slot, false);
        pci_unlock_rescan_remove();
        return 0;
diff --git a/drivers/pinctrl/intel/pinctrl-cannonlake.c b/drivers/pinctrl/intel/pinctrl-cannonlake.c
index fb1afe55bf53..e7f45d96b0cb 100644
--- a/drivers/pinctrl/intel/pinctrl-cannonlake.c
+++ b/drivers/pinctrl/intel/pinctrl-cannonlake.c
@@ -15,10 +15,11 @@
 #include "pinctrl-intel.h"
-#define CNL_PAD_OWN     0x020
+#define CNL_PAD_OWN             0x020
-#define CNL_PADCFGLOCK  0x080
+#define CNL_PADCFGLOCK          0x080
-#define CNL_HOSTSW_OWN  0x0b0
+#define CNL_LP_HOSTSW_OWN       0x0b0
-#define CNL_GPI_IE      0x120
+#define CNL_H_HOSTSW_OWN        0x0c0
+#define CNL_GPI_IE              0x120
 #define CNL_GPP(r, s, e, g)                             \
        {                                               \
@@ -30,12 +31,12 @@
 #define CNL_NO_GPIO     -1
-#define CNL_COMMUNITY(b, s, e, g)                       \
+#define CNL_COMMUNITY(b, s, e, o, g)                    \
        {                                               \
                .barno = (b),                           \
                .padown_offset = CNL_PAD_OWN,           \
                .padcfglock_offset = CNL_PADCFGLOCK,    \
-                .hostown_offset = CNL_HOSTSW_OWN,       \
+                .hostown_offset = (o),                  \
                .ie_offset = CNL_GPI_IE,                \
                .pin_base = (s),                        \
                .npins = ((e) - (s) + 1),               \
@@ -43,6 +44,12 @@
                .ngpps = ARRAY_SIZE(g),                 \
        }
+#define CNLLP_COMMUNITY(b, s, e, g)                     \
+        CNL_COMMUNITY(b, s, e, CNL_LP_HOSTSW_OWN, g)
+#define CNLH_COMMUNITY(b, s, e, g)                      \
+        CNL_COMMUNITY(b, s, e, CNL_H_HOSTSW_OWN, g)
 /* Cannon Lake-H */
 static const struct pinctrl_pin_desc cnlh_pins[] = {
        /* GPP_A */
@@ -379,7 +386,7 @@ static const struct intel_padgroup cnlh_community1_gpps[] = {
 static const struct intel_padgroup cnlh_community3_gpps[] = {
        CNL_GPP(0, 155, 178, 192),              /* GPP_K */
        CNL_GPP(1, 179, 202, 224),              /* GPP_H */
-        CNL_GPP(2, 203, 215, 258),              /* GPP_E */
+        CNL_GPP(2, 203, 215, 256),              /* GPP_E */
        CNL_GPP(3, 216, 239, 288),              /* GPP_F */
        CNL_GPP(4, 240, 248, CNL_NO_GPIO),      /* SPI */
 };
@@ -442,10 +449,10 @@ static const struct intel_function cnlh_functions[] = {
 };
 static const struct intel_community cnlh_communities[] = {
-        CNL_COMMUNITY(0, 0, 50, cnlh_community0_gpps),
+        CNLH_COMMUNITY(0, 0, 50, cnlh_community0_gpps),
-        CNL_COMMUNITY(1, 51, 154, cnlh_community1_gpps),
+        CNLH_COMMUNITY(1, 51, 154, cnlh_community1_gpps),
-        CNL_COMMUNITY(2, 155, 248, cnlh_community3_gpps),
+        CNLH_COMMUNITY(2, 155, 248, cnlh_community3_gpps),
-        CNL_COMMUNITY(3, 249, 298, cnlh_community4_gpps),
+        CNLH_COMMUNITY(3, 249, 298, cnlh_community4_gpps),
 };
 static const struct intel_pinctrl_soc_data cnlh_soc_data = {
@@ -803,9 +810,9 @@ static const struct intel_padgroup cnllp_community4_gpps[] = {
 };
 static const struct intel_community cnllp_communities[] = {
-        CNL_COMMUNITY(0, 0, 67, cnllp_community0_gpps),
+        CNLLP_COMMUNITY(0, 0, 67, cnllp_community0_gpps),
-        CNL_COMMUNITY(1, 68, 180, cnllp_community1_gpps),
+        CNLLP_COMMUNITY(1, 68, 180, cnllp_community1_gpps),
-        CNL_COMMUNITY(2, 181, 243, cnllp_community4_gpps),
+        CNLLP_COMMUNITY(2, 181, 243, cnllp_community4_gpps),
 };
 static const struct intel_pinctrl_soc_data cnllp_soc_data = {
diff --git a/drivers/pinctrl/intel/pinctrl-intel.c b/drivers/pinctrl/intel/pinctrl-intel.c
index 62b009b27eda..1ea3438ea67e 100644
--- a/drivers/pinctrl/intel/pinctrl-intel.c
+++ b/drivers/pinctrl/intel/pinctrl-intel.c
@@ -747,13 +747,63 @@ static const struct pinctrl_desc intel_pinctrl_desc = {
        .owner = THIS_MODULE,
 };
+/**
+ * intel_gpio_to_pin() - Translate from GPIO offset to pin number
+ * @pctrl: Pinctrl structure
+ * @offset: GPIO offset from gpiolib
+ * @commmunity: Community is filled here if not %NULL
+ * @padgrp: Pad group is filled here if not %NULL
+ *
+ * When coming through gpiolib irqchip, the GPIO offset is not
+ * automatically translated to pinctrl pin number. This function can be
+ * used to find out the corresponding pinctrl pin.
+ */
+static int intel_gpio_to_pin(struct intel_pinctrl *pctrl, unsigned offset,
+                             const struct intel_community **community,
+                             const struct intel_padgroup **padgrp)
+{
+        int i;
+        for (i = 0; i < pctrl->ncommunities; i++) {
+                const struct intel_community *comm = &pctrl->communities[i];
+                int j;
+                for (j = 0; j < comm->ngpps; j++) {
+                        const struct intel_padgroup *pgrp = &comm->gpps[j];
+                        if (pgrp->gpio_base < 0)
+                                continue;
+                        if (offset >= pgrp->gpio_base &&
+                            offset < pgrp->gpio_base + pgrp->size) {
+                                int pin;
+                                pin = pgrp->base + offset - pgrp->gpio_base;
+                                if (community)
+                                        *community = comm;
+                                if (padgrp)
+                                        *padgrp = pgrp;
+                                return pin;
+                        }
+                }
+        }
+        return -EINVAL;
+}
 static int intel_gpio_get(struct gpio_chip *chip, unsigned offset)
 {
        struct intel_pinctrl *pctrl = gpiochip_get_data(chip);
        void __iomem *reg;
        u32 padcfg0;
+        int pin;
-        reg = intel_get_padcfg(pctrl, offset, PADCFG0);
+        pin = intel_gpio_to_pin(pctrl, offset, NULL, NULL);
+        if (pin < 0)
+                return -EINVAL;
+        reg = intel_get_padcfg(pctrl, pin, PADCFG0);
        if (!reg)
                return -EINVAL;
@@ -770,8 +820,13 @@ static void intel_gpio_set(struct gpio_chip *chip, unsigned offset, int value)
        unsigned long flags;
        void __iomem *reg;
        u32 padcfg0;
+        int pin;
-        reg = intel_get_padcfg(pctrl, offset, PADCFG0);
+        pin = intel_gpio_to_pin(pctrl, offset, NULL, NULL);
+        if (pin < 0)
+                return;
+        reg = intel_get_padcfg(pctrl, pin, PADCFG0);
        if (!reg)
                return;
@@ -790,8 +845,13 @@ static int intel_gpio_get_direction(struct gpio_chip *chip, unsigned int offset)
        struct intel_pinctrl *pctrl = gpiochip_get_data(chip);
        void __iomem *reg;
        u32 padcfg0;
+        int pin;
-        reg = intel_get_padcfg(pctrl, offset, PADCFG0);
+        pin = intel_gpio_to_pin(pctrl, offset, NULL, NULL);
+        if (pin < 0)
+                return -EINVAL;
+        reg = intel_get_padcfg(pctrl, pin, PADCFG0);
        if (!reg)
                return -EINVAL;
@@ -827,81 +887,6 @@ static const struct gpio_chip intel_gpio_chip = {
        .set_config = gpiochip_generic_config,
 };
-/**
- * intel_gpio_to_pin() - Translate from GPIO offset to pin number
- * @pctrl: Pinctrl structure
- * @offset: GPIO offset from gpiolib
- * @commmunity: Community is filled here if not %NULL
- * @padgrp: Pad group is filled here if not %NULL
- *
- * When coming through gpiolib irqchip, the GPIO offset is not
- * automatically translated to pinctrl pin number. This function can be
- * used to find out the corresponding pinctrl pin.
- */
-static int intel_gpio_to_pin(struct intel_pinctrl *pctrl, unsigned offset,
-                             const struct intel_community **community,
-                             const struct intel_padgroup **padgrp)
-{
-        int i;
-        for (i = 0; i < pctrl->ncommunities; i++) {
-                const struct intel_community *comm = &pctrl->communities[i];
-                int j;
-                for (j = 0; j < comm->ngpps; j++) {
-                        const struct intel_padgroup *pgrp = &comm->gpps[j];
-                        if (pgrp->gpio_base < 0)
-                                continue;
-                        if (offset >= pgrp->gpio_base &&
-                            offset < pgrp->gpio_base + pgrp->size) {
-                                int pin;
-                                pin = pgrp->base + offset - pgrp->gpio_base;
-                                if (community)
-                                        *community = comm;
-                                if (padgrp)
-                                        *padgrp = pgrp;
-                                return pin;
-                        }
-                }
-        }
-        return -EINVAL;
-}
-static int intel_gpio_irq_reqres(struct irq_data *d)
-{
-        struct gpio_chip *gc = irq_data_get_irq_chip_data(d);
-        struct intel_pinctrl *pctrl = gpiochip_get_data(gc);
-        int pin;
-        int ret;
-        pin = intel_gpio_to_pin(pctrl, irqd_to_hwirq(d), NULL, NULL);
-        if (pin >= 0) {
-                ret = gpiochip_lock_as_irq(gc, pin);
-                if (ret) {
-                        dev_err(pctrl->dev, "unable to lock HW IRQ %d for IRQ\n",
-                                pin);
-                        return ret;
-                }
-        }
-        return 0;
-}
-static void intel_gpio_irq_relres(struct irq_data *d)
-{
-        struct gpio_chip *gc = irq_data_get_irq_chip_data(d);
-        struct intel_pinctrl *pctrl = gpiochip_get_data(gc);
-        int pin;
-        pin = intel_gpio_to_pin(pctrl, irqd_to_hwirq(d), NULL, NULL);
-        if (pin >= 0)
-                gpiochip_unlock_as_irq(gc, pin);
-}
 static void intel_gpio_irq_ack(struct irq_data *d)
 {
        struct gpio_chip *gc = irq_data_get_irq_chip_data(d);
@@ -1117,8 +1102,6 @@ static irqreturn_t intel_gpio_irq(int irq, void *data)
 static struct irq_chip intel_gpio_irqchip = {
        .name = "intel-gpio",
-        .irq_request_resources = intel_gpio_irq_reqres,
-        .irq_release_resources = intel_gpio_irq_relres,
        .irq_enable = intel_gpio_irq_enable,
        .irq_ack = intel_gpio_irq_ack,
        .irq_mask = intel_gpio_irq_mask,
diff --git a/drivers/pinctrl/pinctrl-amd.c b/drivers/pinctrl/pinctrl-amd.c
index 41ccc759b8b8..1425c2874d40 100644
--- a/drivers/pinctrl/pinctrl-amd.c
+++ b/drivers/pinctrl/pinctrl-amd.c
@@ -348,21 +348,12 @@ static void amd_gpio_irq_enable(struct irq_data *d)
        unsigned long flags;
        struct gpio_chip *gc = irq_data_get_irq_chip_data(d);
        struct amd_gpio *gpio_dev = gpiochip_get_data(gc);
-        u32 mask = BIT(INTERRUPT_ENABLE_OFF) | BIT(INTERRUPT_MASK_OFF);
        raw_spin_lock_irqsave(&gpio_dev->lock, flags);
        pin_reg = readl(gpio_dev->base + (d->hwirq)*4);
        pin_reg |= BIT(INTERRUPT_ENABLE_OFF);
        pin_reg |= BIT(INTERRUPT_MASK_OFF);
        writel(pin_reg, gpio_dev->base + (d->hwirq)*4);
-        /*
-         * When debounce logic is enabled it takes ~900 us before interrupts
-         * can be enabled.  During this "debounce warm up" period the
-         * "INTERRUPT_ENABLE" bit will read as 0. Poll the bit here until it
-         * reads back as 1, signaling that interrupts are now enabled.
-         */
-        while ((readl(gpio_dev->base + (d->hwirq)*4) & mask) != mask)
-                continue;
        raw_spin_unlock_irqrestore(&gpio_dev->lock, flags);
 }
@@ -426,7 +417,7 @@ static void amd_gpio_irq_eoi(struct irq_data *d)
 static int amd_gpio_irq_set_type(struct irq_data *d, unsigned int type)
 {
        int ret = 0;
-        u32 pin_reg;
+        u32 pin_reg, pin_reg_irq_en, mask;
        unsigned long flags, irq_flags;
        struct gpio_chip *gc = irq_data_get_irq_chip_data(d);
        struct amd_gpio *gpio_dev = gpiochip_get_data(gc);
@@ -495,6 +486,28 @@ static int amd_gpio_irq_set_type(struct irq_data *d, unsigned int type)
        }
        pin_reg |= CLR_INTR_STAT << INTERRUPT_STS_OFF;
+        /*
+         * If WAKE_INT_MASTER_REG.MaskStsEn is set, a software write to the
+         * debounce registers of any GPIO will block wake/interrupt status
+         * generation for *all* GPIOs for a lenght of time that depends on
+         * WAKE_INT_MASTER_REG.MaskStsLength[11:0].  During this period the
+         * INTERRUPT_ENABLE bit will read as 0.
+         *
+         * We temporarily enable irq for the GPIO whose configuration is
+         * changing, and then wait for it to read back as 1 to know when
+         * debounce has settled and then disable the irq again.
+         * We do this polling with the spinlock held to ensure other GPIO
+         * access routines do not read an incorrect value for the irq enable
+         * bit of other GPIOs.  We keep the GPIO masked while polling to avoid
+         * spurious irqs, and disable the irq again after polling.
+         */
+        mask = BIT(INTERRUPT_ENABLE_OFF);
+        pin_reg_irq_en = pin_reg;
+        pin_reg_irq_en |= mask;
+        pin_reg_irq_en &= ~BIT(INTERRUPT_MASK_OFF);
+        writel(pin_reg_irq_en, gpio_dev->base + (d->hwirq)*4);
+        while ((readl(gpio_dev->base + (d->hwirq)*4) & mask) != mask)
+                continue;
        writel(pin_reg, gpio_dev->base + (d->hwirq)*4);
        raw_spin_unlock_irqrestore(&gpio_dev->lock, flags);
diff --git a/drivers/platform/x86/alienware-wmi.c b/drivers/platform/x86/alienware-wmi.c
index d975462a4c57..f10af5c383c5 100644
--- a/drivers/platform/x86/alienware-wmi.c
+++ b/drivers/platform/x86/alienware-wmi.c
@@ -536,6 +536,7 @@ static acpi_status alienware_wmax_command(struct wmax_basic_args *in_args,
                if (obj && obj->type == ACPI_TYPE_INTEGER)
                        *out_data = (u32) obj->integer.value;
        }
+        kfree(output.pointer);
        return status;
 }
diff --git a/drivers/platform/x86/dell-smbios-wmi.c b/drivers/platform/x86/dell-smbios-wmi.c
index 88afe5651d24..cf2229ece9ff 100644
--- a/drivers/platform/x86/dell-smbios-wmi.c
+++ b/drivers/platform/x86/dell-smbios-wmi.c
@@ -78,6 +78,7 @@ static int run_smbios_call(struct wmi_device *wdev)
        dev_dbg(&wdev->dev, "result: [%08x,%08x,%08x,%08x]\n",
                priv->buf->std.output[0], priv->buf->std.output[1],
                priv->buf->std.output[2], priv->buf->std.output[3]);
+        kfree(output.pointer);
        return 0;
 }
diff --git a/drivers/regulator/bd71837-regulator.c b/drivers/regulator/bd71837-regulator.c
index 0f8ac8dec3e1..a1bd8aaf4d98 100644
--- a/drivers/regulator/bd71837-regulator.c
+++ b/drivers/regulator/bd71837-regulator.c
@@ -569,6 +569,25 @@ static int bd71837_probe(struct platform_device *pdev)
                        BD71837_REG_REGLOCK);
        }
+        /*
+         * There is a HW quirk in BD71837. The shutdown sequence timings for
+         * bucks/LDOs which are controlled via register interface are changed.
+         * At PMIC poweroff the voltage for BUCK6/7 is cut immediately at the
+         * beginning of shut-down sequence. As bucks 6 and 7 are parent
+         * supplies for LDO5 and LDO6 - this causes LDO5/6 voltage
+         * monitoring to errorneously detect under voltage and force PMIC to
+         * emergency state instead of poweroff. In order to avoid this we
+         * disable voltage monitoring for LDO5 and LDO6
+         */
+        err = regmap_update_bits(pmic->mfd->regmap, BD718XX_REG_MVRFLTMASK2,
+                                 BD718XX_LDO5_VRMON80 | BD718XX_LDO6_VRMON80,
+                                 BD718XX_LDO5_VRMON80 | BD718XX_LDO6_VRMON80);
+        if (err) {
+                dev_err(&pmic->pdev->dev,
+                        "Failed to disable voltage monitoring\n");
+                goto err;
+        }
        for (i = 0; i < ARRAY_SIZE(pmic_regulator_inits); i++) {
                struct regulator_desc *desc;
diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index bb1324f93143..9577d8941846 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -3161,7 +3161,7 @@ static inline int regulator_suspend_toggle(struct regulator_dev *rdev,
        if (!rstate->changeable)
                return -EPERM;
-        rstate->enabled = en;
+        rstate->enabled = (en) ? ENABLE_IN_SUSPEND : DISABLE_IN_SUSPEND;
        return 0;
 }
@@ -4395,13 +4395,13 @@ regulator_register(const struct regulator_desc *regulator_desc,
            !rdev->desc->fixed_uV)
                rdev->is_switch = true;
+        dev_set_drvdata(&rdev->dev, rdev);
        ret = device_register(&rdev->dev);
        if (ret != 0) {
                put_device(&rdev->dev);
                goto unset_supplies;
        }
-        dev_set_drvdata(&rdev->dev, rdev);
        rdev_init_debugfs(rdev);
        /* try to resolve regulators supply since a new one was registered */
diff --git a/drivers/regulator/of_regulator.c b/drivers/regulator/of_regulator.c
index 638f17d4c848..210fc20f7de7 100644
--- a/drivers/regulator/of_regulator.c
+++ b/drivers/regulator/of_regulator.c
@@ -213,8 +213,6 @@ static void of_get_regulation_constraints(struct device_node *np,
                else if (of_property_read_bool(suspend_np,
                                        "regulator-off-in-suspend"))
                        suspend_state->enabled = DISABLE_IN_SUSPEND;
-                else
-                        suspend_state->enabled = DO_NOTHING_IN_SUSPEND;
                if (!of_property_read_u32(np, "regulator-suspend-min-microvolt",
                                          &pval))
diff --git a/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c b/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c
index fac377320158..f42a619198c4 100644
--- a/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c
+++ b/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c
@@ -3474,11 +3474,10 @@ static int ibmvscsis_probe(struct vio_dev *vdev,
                vscsi->dds.window[LOCAL].liobn,
                vscsi->dds.window[REMOTE].liobn);
-        strcpy(vscsi->eye, "VSCSI ");
+        snprintf(vscsi->eye, sizeof(vscsi->eye), "VSCSI %s", vdev->name);
-        strncat(vscsi->eye, vdev->name, MAX_EYE);
        vscsi->dds.unit_id = vdev->unit_address;
-        strncpy(vscsi->dds.partition_name, partition_name,
+        strscpy(vscsi->dds.partition_name, partition_name,
                sizeof(vscsi->dds.partition_name));
        vscsi->dds.partition_num = partition_number;
diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c
index f2ec80b0ffc0..271990bc065b 100644
--- a/drivers/scsi/ipr.c
+++ b/drivers/scsi/ipr.c
@@ -3335,6 +3335,65 @@ static void ipr_release_dump(struct kref *kref)
        LEAVE;
 }
+static void ipr_add_remove_thread(struct work_struct *work)
+{
+        unsigned long lock_flags;
+        struct ipr_resource_entry *res;
+        struct scsi_device *sdev;
+        struct ipr_ioa_cfg *ioa_cfg =
+                container_of(work, struct ipr_ioa_cfg, scsi_add_work_q);
+        u8 bus, target, lun;
+        int did_work;
+        ENTER;
+        spin_lock_irqsave(ioa_cfg->host->host_lock, lock_flags);
+restart:
+        do {
+                did_work = 0;
+                if (!ioa_cfg->hrrq[IPR_INIT_HRRQ].allow_cmds) {
+                        spin_unlock_irqrestore(ioa_cfg->host->host_lock, lock_flags);
+                        return;
+                }
+                list_for_each_entry(res, &ioa_cfg->used_res_q, queue) {
+                        if (res->del_from_ml && res->sdev) {
+                                did_work = 1;
+                                sdev = res->sdev;
+                                if (!scsi_device_get(sdev)) {
+                                        if (!res->add_to_ml)
+                                                list_move_tail(&res->queue, &ioa_cfg->free_res_q);
+                                        else
+                                                res->del_from_ml = 0;
+                                        spin_unlock_irqrestore(ioa_cfg->host->host_lock, lock_flags);
+                                        scsi_remove_device(sdev);
+                                        scsi_device_put(sdev);
+                                        spin_lock_irqsave(ioa_cfg->host->host_lock, lock_flags);
+                                }
+                                break;
+                        }
+                }
+        } while (did_work);
+        list_for_each_entry(res, &ioa_cfg->used_res_q, queue) {
+                if (res->add_to_ml) {
+                        bus = res->bus;
+                        target = res->target;
+                        lun = res->lun;
+                        res->add_to_ml = 0;
+                        spin_unlock_irqrestore(ioa_cfg->host->host_lock, lock_flags);
+                        scsi_add_device(ioa_cfg->host, bus, target, lun);
+                        spin_lock_irqsave(ioa_cfg->host->host_lock, lock_flags);
+                        goto restart;
+                }
+        }
+        ioa_cfg->scan_done = 1;
+        spin_unlock_irqrestore(ioa_cfg->host->host_lock, lock_flags);
+        kobject_uevent(&ioa_cfg->host->shost_dev.kobj, KOBJ_CHANGE);
+        LEAVE;
+}
 /**
 * ipr_worker_thread - Worker thread
 * @work:               ioa config struct
@@ -3349,13 +3408,9 @@ static void ipr_release_dump(struct kref *kref)
 static void ipr_worker_thread(struct work_struct *work)
 {
        unsigned long lock_flags;
-        struct ipr_resource_entry *res;
-        struct scsi_device *sdev;
        struct ipr_dump *dump;
        struct ipr_ioa_cfg *ioa_cfg =
                container_of(work, struct ipr_ioa_cfg, work_q);
-        u8 bus, target, lun;
-        int did_work;
        ENTER;
        spin_lock_irqsave(ioa_cfg->host->host_lock, lock_flags);
@@ -3393,49 +3448,9 @@ static void ipr_worker_thread(struct work_struct *work)
                return;
        }
-restart:
+        schedule_work(&ioa_cfg->scsi_add_work_q);
-        do {
-                did_work = 0;
-                if (!ioa_cfg->hrrq[IPR_INIT_HRRQ].allow_cmds) {
-                        spin_unlock_irqrestore(ioa_cfg->host->host_lock, lock_flags);
-                        return;
-                }
-                list_for_each_entry(res, &ioa_cfg->used_res_q, queue) {
-                        if (res->del_from_ml && res->sdev) {
-                                did_work = 1;
-                                sdev = res->sdev;
-                                if (!scsi_device_get(sdev)) {
-                                        if (!res->add_to_ml)
-                                                list_move_tail(&res->queue, &ioa_cfg->free_res_q);
-                                        else
-                                                res->del_from_ml = 0;
-                                        spin_unlock_irqrestore(ioa_cfg->host->host_lock, lock_flags);
-                                        scsi_remove_device(sdev);
-                                        scsi_device_put(sdev);
-                                        spin_lock_irqsave(ioa_cfg->host->host_lock, lock_flags);
-                                }
-                                break;
-                        }
-                }
-        } while (did_work);
-        list_for_each_entry(res, &ioa_cfg->used_res_q, queue) {
-                if (res->add_to_ml) {
-                        bus = res->bus;
-                        target = res->target;
-                        lun = res->lun;
-                        res->add_to_ml = 0;
-                        spin_unlock_irqrestore(ioa_cfg->host->host_lock, lock_flags);
-                        scsi_add_device(ioa_cfg->host, bus, target, lun);
-                        spin_lock_irqsave(ioa_cfg->host->host_lock, lock_flags);
-                        goto restart;
-                }
-        }
-        ioa_cfg->scan_done = 1;
        spin_unlock_irqrestore(ioa_cfg->host->host_lock, lock_flags);
-        kobject_uevent(&ioa_cfg->host->shost_dev.kobj, KOBJ_CHANGE);
        LEAVE;
 }
@@ -9933,6 +9948,7 @@ static void ipr_init_ioa_cfg(struct ipr_ioa_cfg *ioa_cfg,
        INIT_LIST_HEAD(&ioa_cfg->free_res_q);
        INIT_LIST_HEAD(&ioa_cfg->used_res_q);
        INIT_WORK(&ioa_cfg->work_q, ipr_worker_thread);
+        INIT_WORK(&ioa_cfg->scsi_add_work_q, ipr_add_remove_thread);
        init_waitqueue_head(&ioa_cfg->reset_wait_q);
        init_waitqueue_head(&ioa_cfg->msi_wait_q);
        init_waitqueue_head(&ioa_cfg->eeh_wait_q);
diff --git a/drivers/scsi/ipr.h b/drivers/scsi/ipr.h
index 68afbbde54d3..f6baa2351313 100644
--- a/drivers/scsi/ipr.h
+++ b/drivers/scsi/ipr.h
@@ -1575,6 +1575,7 @@ struct ipr_ioa_cfg {
        u8 saved_mode_page_len;
        struct work_struct work_q;
+        struct work_struct scsi_add_work_q;
        struct workqueue_struct *reset_work_q;
        wait_queue_head_t reset_wait_q;
diff --git a/drivers/scsi/lpfc/lpfc_attr.c b/drivers/scsi/lpfc/lpfc_attr.c
index 057a60abe664..1a6ed9b0a249 100644
--- a/drivers/scsi/lpfc/lpfc_attr.c
+++ b/drivers/scsi/lpfc/lpfc_attr.c
@@ -360,12 +360,12 @@ lpfc_nvme_info_show(struct device *dev, struct device_attribute *attr,
                goto buffer_done;
        list_for_each_entry(ndlp, &vport->fc_nodes, nlp_listp) {
+                nrport = NULL;
+                spin_lock(&vport->phba->hbalock);
                rport = lpfc_ndlp_get_nrport(ndlp);
-                if (!rport)
+                if (rport)
-                        continue;
+                        nrport = rport->remoteport;
+                spin_unlock(&vport->phba->hbalock);
-                /* local short-hand pointer. */
-                nrport = rport->remoteport;
                if (!nrport)
                        continue;
@@ -3386,6 +3386,7 @@ lpfc_update_rport_devloss_tmo(struct lpfc_vport *vport)
        struct lpfc_nodelist  *ndlp;
 #if (IS_ENABLED(CONFIG_NVME_FC))
        struct lpfc_nvme_rport *rport;
+        struct nvme_fc_remote_port *remoteport = NULL;
 #endif
        shost = lpfc_shost_from_vport(vport);
@@ -3396,8 +3397,12 @@ lpfc_update_rport_devloss_tmo(struct lpfc_vport *vport)
                if (ndlp->rport)
                        ndlp->rport->dev_loss_tmo = vport->cfg_devloss_tmo;
 #if (IS_ENABLED(CONFIG_NVME_FC))
+                spin_lock(&vport->phba->hbalock);
                rport = lpfc_ndlp_get_nrport(ndlp);
                if (rport)
+                        remoteport = rport->remoteport;
+                spin_unlock(&vport->phba->hbalock);
+                if (remoteport)
                        nvme_fc_set_remoteport_devloss(rport->remoteport,
                                                       vport->cfg_devloss_tmo);
 #endif
diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c
index 9df0c051349f..aec5b10a8c85 100644
--- a/drivers/scsi/lpfc/lpfc_debugfs.c
+++ b/drivers/scsi/lpfc/lpfc_debugfs.c
@@ -551,7 +551,7 @@ lpfc_debugfs_nodelist_data(struct lpfc_vport *vport, char *buf, int size)
        unsigned char *statep;
        struct nvme_fc_local_port *localport;
        struct lpfc_nvmet_tgtport *tgtp;
-        struct nvme_fc_remote_port *nrport;
+        struct nvme_fc_remote_port *nrport = NULL;
        struct lpfc_nvme_rport *rport;
        cnt = (LPFC_NODELIST_SIZE / LPFC_NODELIST_ENTRY_SIZE);
@@ -696,11 +696,11 @@ lpfc_debugfs_nodelist_data(struct lpfc_vport *vport, char *buf, int size)
        len += snprintf(buf + len, size - len, "\tRport List:\n");
        list_for_each_entry(ndlp, &vport->fc_nodes, nlp_listp) {
                /* local short-hand pointer. */
+                spin_lock(&phba->hbalock);
                rport = lpfc_ndlp_get_nrport(ndlp);
-                if (!rport)
+                if (rport)
-                        continue;
+                        nrport = rport->remoteport;
+                spin_unlock(&phba->hbalock);
-                nrport = rport->remoteport;
                if (!nrport)
                        continue;
diff --git a/drivers/scsi/lpfc/lpfc_nvme.c b/drivers/scsi/lpfc/lpfc_nvme.c
index 028462e5994d..918ae18ef8a8 100644
--- a/drivers/scsi/lpfc/lpfc_nvme.c
+++ b/drivers/scsi/lpfc/lpfc_nvme.c
@@ -2725,7 +2725,9 @@ lpfc_nvme_register_port(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp)
        rpinfo.port_name = wwn_to_u64(ndlp->nlp_portname.u.wwn);
        rpinfo.node_name = wwn_to_u64(ndlp->nlp_nodename.u.wwn);
+        spin_lock_irq(&vport->phba->hbalock);
        oldrport = lpfc_ndlp_get_nrport(ndlp);
+        spin_unlock_irq(&vport->phba->hbalock);
        if (!oldrport)
                lpfc_nlp_get(ndlp);
@@ -2840,7 +2842,7 @@ lpfc_nvme_unregister_port(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp)
        struct nvme_fc_local_port *localport;
        struct lpfc_nvme_lport *lport;
        struct lpfc_nvme_rport *rport;
-        struct nvme_fc_remote_port *remoteport;
+        struct nvme_fc_remote_port *remoteport = NULL;
        localport = vport->localport;
@@ -2854,11 +2856,14 @@ lpfc_nvme_unregister_port(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp)
        if (!lport)
                goto input_err;
+        spin_lock_irq(&vport->phba->hbalock);
        rport = lpfc_ndlp_get_nrport(ndlp);
-        if (!rport)
+        if (rport)
+                remoteport = rport->remoteport;
+        spin_unlock_irq(&vport->phba->hbalock);
+        if (!remoteport)
                goto input_err;
-        remoteport = rport->remoteport;
        lpfc_printf_vlog(vport, KERN_INFO, LOG_NVME_DISC,
                         "6033 Unreg nvme remoteport %p, portname x%llx, "
                         "port_id x%06x, portstate x%x port type x%x\n",
diff --git a/drivers/scsi/qla2xxx/qla_target.h b/drivers/scsi/qla2xxx/qla_target.h
index fecf96f0225c..199d3ba1916d 100644
--- a/drivers/scsi/qla2xxx/qla_target.h
+++ b/drivers/scsi/qla2xxx/qla_target.h
@@ -374,8 +374,8 @@ struct atio_from_isp {
 static inline int fcpcmd_is_corrupted(struct atio *atio)
 {
        if (atio->entry_type == ATIO_TYPE7 &&
-            (le16_to_cpu(atio->attr_n_length & FCP_CMD_LENGTH_MASK) <
+            ((le16_to_cpu(atio->attr_n_length) & FCP_CMD_LENGTH_MASK) <
-            FCP_CMD_LENGTH_MIN))
+             FCP_CMD_LENGTH_MIN))
                return 1;
        else
                return 0;
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index b79b366a94f7..4a57ffecc7e6 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -1276,7 +1276,8 @@ static int sd_init_command(struct scsi_cmnd *cmd)
        case REQ_OP_ZONE_RESET:
                return sd_zbc_setup_reset_cmnd(cmd);
        default:
-                BUG();
+                WARN_ON_ONCE(1);
+                return BLKPREP_KILL;
        }
 }
@@ -2959,6 +2960,9 @@ static void sd_read_block_characteristics(struct scsi_disk *sdkp)
        if (rot == 1) {
                blk_queue_flag_set(QUEUE_FLAG_NONROT, q);
                blk_queue_flag_clear(QUEUE_FLAG_ADD_RANDOM, q);
+        } else {
+                blk_queue_flag_clear(QUEUE_FLAG_NONROT, q);
+                blk_queue_flag_set(QUEUE_FLAG_ADD_RANDOM, q);
        }
        if (sdkp->device->type == TYPE_ZBC) {
diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
index 9d5d2ca7fc4f..c55f38ec391c 100644
--- a/drivers/scsi/ufs/ufshcd.c
+++ b/drivers/scsi/ufs/ufshcd.c
@@ -7940,6 +7940,13 @@ int ufshcd_alloc_host(struct device *dev, struct ufs_hba **hba_handle)
                err = -ENOMEM;
                goto out_error;
        }
+        /*
+         * Do not use blk-mq at this time because blk-mq does not support
+         * runtime pm.
+         */
+        host->use_blk_mq = false;
        hba = shost_priv(host);
        hba->host = host;
        hba->dev = dev;
diff --git a/drivers/soc/fsl/qbman/qman.c b/drivers/soc/fsl/qbman/qman.c
index ecb22749df0b..8cc015183043 100644
--- a/drivers/soc/fsl/qbman/qman.c
+++ b/drivers/soc/fsl/qbman/qman.c
@@ -2729,6 +2729,9 @@ static int qman_alloc_range(struct gen_pool *p, u32 *result, u32 cnt)
 {
        unsigned long addr;
+        if (!p)
+                return -ENODEV;
        addr = gen_pool_alloc(p, cnt);
        if (!addr)
                return -ENOMEM;
diff --git a/drivers/soc/fsl/qe/ucc.c b/drivers/soc/fsl/qe/ucc.c
index c646d8713861..681f7d4b7724 100644
--- a/drivers/soc/fsl/qe/ucc.c
+++ b/drivers/soc/fsl/qe/ucc.c
@@ -626,7 +626,7 @@ static u32 ucc_get_tdm_sync_shift(enum comm_dir mode, u32 tdm_num)
 {
        u32 shift;
-        shift = (mode == COMM_DIR_RX) ? RX_SYNC_SHIFT_BASE : RX_SYNC_SHIFT_BASE;
+        shift = (mode == COMM_DIR_RX) ? RX_SYNC_SHIFT_BASE : TX_SYNC_SHIFT_BASE;
        shift -= tdm_num * 2;
        return shift;
diff --git a/drivers/soundwire/stream.c b/drivers/soundwire/stream.c
index 4b5e250e8615..e5c7e1ef6318 100644
--- a/drivers/soundwire/stream.c
+++ b/drivers/soundwire/stream.c
@@ -899,9 +899,10 @@ static void sdw_release_master_stream(struct sdw_stream_runtime *stream)
        struct sdw_master_runtime *m_rt = stream->m_rt;
        struct sdw_slave_runtime *s_rt, *_s_rt;
-        list_for_each_entry_safe(s_rt, _s_rt,
+        list_for_each_entry_safe(s_rt, _s_rt, &m_rt->slave_rt_list, m_rt_node) {
-                        &m_rt->slave_rt_list, m_rt_node)
+                sdw_slave_port_release(s_rt->slave->bus, s_rt->slave, stream);
-                sdw_stream_remove_slave(s_rt->slave, stream);
+                sdw_release_slave_stream(s_rt->slave, stream);
+        }
        list_del(&m_rt->bus_node);
 }
@@ -1112,7 +1113,7 @@ int sdw_stream_add_master(struct sdw_bus *bus,
                                "Master runtime config failed for stream:%s",
                                stream->name);
                ret = -ENOMEM;
-                goto error;
+                goto unlock;
        }
        ret = sdw_config_stream(bus->dev, stream, stream_config, false);
@@ -1123,11 +1124,11 @@ int sdw_stream_add_master(struct sdw_bus *bus,
        if (ret)
                goto stream_error;
-        stream->state = SDW_STREAM_CONFIGURED;
+        goto unlock;
 stream_error:
        sdw_release_master_stream(stream);
-error:
+unlock:
        mutex_unlock(&bus->bus_lock);
        return ret;
 }
@@ -1141,6 +1142,10 @@ EXPORT_SYMBOL(sdw_stream_add_master);
 * @stream: SoundWire stream
 * @port_config: Port configuration for audio stream
 * @num_ports: Number of ports
+ *
+ * It is expected that Slave is added before adding Master
+ * to the Stream.
+ *
 */
 int sdw_stream_add_slave(struct sdw_slave *slave,
                struct sdw_stream_config *stream_config,
@@ -1186,6 +1191,12 @@ int sdw_stream_add_slave(struct sdw_slave *slave,
        if (ret)
                goto stream_error;
+        /*
+         * Change stream state to CONFIGURED on first Slave add.
+         * Bus is not aware of number of Slave(s) in a stream at this
+         * point so cannot depend on all Slave(s) to be added in order to
+         * change stream state to CONFIGURED.
+         */
        stream->state = SDW_STREAM_CONFIGURED;
        goto error;
diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c
index 7cb3ab0a35a0..3082e72e4f6c 100644
--- a/drivers/spi/spi-fsl-dspi.c
+++ b/drivers/spi/spi-fsl-dspi.c
@@ -30,7 +30,11 @@
 #define DRIVER_NAME "fsl-dspi"
+#ifdef CONFIG_M5441x
+#define DSPI_FIFO_SIZE                  16
+#else
 #define DSPI_FIFO_SIZE                  4
+#endif
 #define DSPI_DMA_BUFSIZE                (DSPI_FIFO_SIZE * 1024)
 #define SPI_MCR         0x00
@@ -623,9 +627,11 @@ static void dspi_tcfq_read(struct fsl_dspi *dspi)
 static void dspi_eoq_write(struct fsl_dspi *dspi)
 {
        int fifo_size = DSPI_FIFO_SIZE;
+        u16 xfer_cmd = dspi->tx_cmd;
        /* Fill TX FIFO with as many transfers as possible */
        while (dspi->len && fifo_size--) {
+                dspi->tx_cmd = xfer_cmd;
                /* Request EOQF for last transfer in FIFO */
                if (dspi->len == dspi->bytes_per_word || fifo_size == 0)
                        dspi->tx_cmd |= SPI_PUSHR_CMD_EOQ;
diff --git a/drivers/spi/spi-gpio.c b/drivers/spi/spi-gpio.c
index 0626e6e3ea0c..421bfc7dda67 100644
--- a/drivers/spi/spi-gpio.c
+++ b/drivers/spi/spi-gpio.c
@@ -300,8 +300,8 @@ static int spi_gpio_request(struct device *dev,
                *mflags |= SPI_MASTER_NO_RX;
        spi_gpio->sck = devm_gpiod_get(dev, "sck", GPIOD_OUT_LOW);
-        if (IS_ERR(spi_gpio->mosi))
+        if (IS_ERR(spi_gpio->sck))
-                return PTR_ERR(spi_gpio->mosi);
+                return PTR_ERR(spi_gpio->sck);
        for (i = 0; i < num_chipselects; i++) {
                spi_gpio->cs_gpios[i] = devm_gpiod_get_index(dev, "cs",
diff --git a/drivers/spi/spi-rspi.c b/drivers/spi/spi-rspi.c
index 95dc4d78618d..b37de1d991d6 100644
--- a/drivers/spi/spi-rspi.c
+++ b/drivers/spi/spi-rspi.c
@@ -598,11 +598,13 @@ static int rspi_dma_transfer(struct rspi_data *rspi, struct sg_table *tx,
        ret = wait_event_interruptible_timeout(rspi->wait,
                                               rspi->dma_callbacked, HZ);
-        if (ret > 0 && rspi->dma_callbacked)
+        if (ret > 0 && rspi->dma_callbacked) {
                ret = 0;
-        else if (!ret) {
+        } else {
-                dev_err(&rspi->master->dev, "DMA timeout\n");
+                if (!ret) {
-                ret = -ETIMEDOUT;
+                        dev_err(&rspi->master->dev, "DMA timeout\n");
+                        ret = -ETIMEDOUT;
+                }
                if (tx)
                        dmaengine_terminate_all(rspi->master->dma_tx);
                if (rx)
@@ -1350,12 +1352,36 @@ static const struct platform_device_id spi_driver_ids[] = {
 MODULE_DEVICE_TABLE(platform, spi_driver_ids);
+#ifdef CONFIG_PM_SLEEP
+static int rspi_suspend(struct device *dev)
+{
+        struct platform_device *pdev = to_platform_device(dev);
+        struct rspi_data *rspi = platform_get_drvdata(pdev);
+        return spi_master_suspend(rspi->master);
+}
+static int rspi_resume(struct device *dev)
+{
+        struct platform_device *pdev = to_platform_device(dev);
+        struct rspi_data *rspi = platform_get_drvdata(pdev);
+        return spi_master_resume(rspi->master);
+}
+static SIMPLE_DEV_PM_OPS(rspi_pm_ops, rspi_suspend, rspi_resume);
+#define DEV_PM_OPS      &rspi_pm_ops
+#else
+#define DEV_PM_OPS      NULL
+#endif /* CONFIG_PM_SLEEP */
 static struct platform_driver rspi_driver = {
        .probe =        rspi_probe,
        .remove =       rspi_remove,
        .id_table =     spi_driver_ids,
        .driver         = {
                .name = "renesas_spi",
+                .pm = DEV_PM_OPS,
                .of_match_table = of_match_ptr(rspi_of_match),
        },
 };
diff --git a/drivers/spi/spi-sh-msiof.c b/drivers/spi/spi-sh-msiof.c
index 539d6d1a277a..101cd6aae2ea 100644
--- a/drivers/spi/spi-sh-msiof.c
+++ b/drivers/spi/spi-sh-msiof.c
@@ -397,7 +397,8 @@ static void sh_msiof_spi_set_mode_regs(struct sh_msiof_spi_priv *p,
 static void sh_msiof_reset_str(struct sh_msiof_spi_priv *p)
 {
-        sh_msiof_write(p, STR, sh_msiof_read(p, STR));
+        sh_msiof_write(p, STR,
+                       sh_msiof_read(p, STR) & ~(STR_TDREQ | STR_RDREQ));
 }
 static void sh_msiof_spi_write_fifo_8(struct sh_msiof_spi_priv *p,
@@ -1426,12 +1427,37 @@ static const struct platform_device_id spi_driver_ids[] = {
 };
 MODULE_DEVICE_TABLE(platform, spi_driver_ids);
+#ifdef CONFIG_PM_SLEEP
+static int sh_msiof_spi_suspend(struct device *dev)
+{
+        struct platform_device *pdev = to_platform_device(dev);
+        struct sh_msiof_spi_priv *p = platform_get_drvdata(pdev);
+        return spi_master_suspend(p->master);
+}
+static int sh_msiof_spi_resume(struct device *dev)
+{
+        struct platform_device *pdev = to_platform_device(dev);
+        struct sh_msiof_spi_priv *p = platform_get_drvdata(pdev);
+        return spi_master_resume(p->master);
+}
+static SIMPLE_DEV_PM_OPS(sh_msiof_spi_pm_ops, sh_msiof_spi_suspend,
+                         sh_msiof_spi_resume);
+#define DEV_PM_OPS      &sh_msiof_spi_pm_ops
+#else
+#define DEV_PM_OPS      NULL
+#endif /* CONFIG_PM_SLEEP */
 static struct platform_driver sh_msiof_spi_drv = {
        .probe          = sh_msiof_spi_probe,
        .remove         = sh_msiof_spi_remove,
        .id_table       = spi_driver_ids,
        .driver         = {
                .name           = "spi_sh_msiof",
+                .pm             = DEV_PM_OPS,
                .of_match_table = of_match_ptr(sh_msiof_match),
        },
 };
diff --git a/drivers/spi/spi-tegra20-slink.c b/drivers/spi/spi-tegra20-slink.c
index 6f7b946b5ced..1427f343b39a 100644
--- a/drivers/spi/spi-tegra20-slink.c
+++ b/drivers/spi/spi-tegra20-slink.c
@@ -1063,6 +1063,24 @@ static int tegra_slink_probe(struct platform_device *pdev)
                goto exit_free_master;
        }
+        /* disabled clock may cause interrupt storm upon request */
+        tspi->clk = devm_clk_get(&pdev->dev, NULL);
+        if (IS_ERR(tspi->clk)) {
+                ret = PTR_ERR(tspi->clk);
+                dev_err(&pdev->dev, "Can not get clock %d\n", ret);
+                goto exit_free_master;
+        }
+        ret = clk_prepare(tspi->clk);
+        if (ret < 0) {
+                dev_err(&pdev->dev, "Clock prepare failed %d\n", ret);
+                goto exit_free_master;
+        }
+        ret = clk_enable(tspi->clk);
+        if (ret < 0) {
+                dev_err(&pdev->dev, "Clock enable failed %d\n", ret);
+                goto exit_free_master;
+        }
        spi_irq = platform_get_irq(pdev, 0);
        tspi->irq = spi_irq;
        ret = request_threaded_irq(tspi->irq, tegra_slink_isr,
@@ -1071,14 +1089,7 @@ static int tegra_slink_probe(struct platform_device *pdev)
        if (ret < 0) {
                dev_err(&pdev->dev, "Failed to register ISR for IRQ %d\n",
                                        tspi->irq);
-                goto exit_free_master;
+                goto exit_clk_disable;
-        }
-        tspi->clk = devm_clk_get(&pdev->dev, NULL);
-        if (IS_ERR(tspi->clk)) {
-                dev_err(&pdev->dev, "can not get clock\n");
-                ret = PTR_ERR(tspi->clk);
-                goto exit_free_irq;
        }
        tspi->rst = devm_reset_control_get_exclusive(&pdev->dev, "spi");
@@ -1138,6 +1149,8 @@ exit_rx_dma_free:
        tegra_slink_deinit_dma_param(tspi, true);
 exit_free_irq:
        free_irq(spi_irq, tspi);
+exit_clk_disable:
+        clk_disable(tspi->clk);
 exit_free_master:
        spi_master_put(master);
        return ret;
@@ -1150,6 +1163,8 @@ static int tegra_slink_remove(struct platform_device *pdev)
        free_irq(tspi->irq, tspi);
+        clk_disable(tspi->clk);
        if (tspi->tx_dma_chan)
                tegra_slink_deinit_dma_param(tspi, false);
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index ec395a6baf9c..9da0bc5a036c 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -2143,8 +2143,17 @@ int spi_register_controller(struct spi_controller *ctlr)
         */
        if (ctlr->num_chipselect == 0)
                return -EINVAL;
-        /* allocate dynamic bus number using Linux idr */
+        if (ctlr->bus_num >= 0) {
-        if ((ctlr->bus_num < 0) && ctlr->dev.of_node) {
+                /* devices with a fixed bus num must check-in with the num */
+                mutex_lock(&board_lock);
+                id = idr_alloc(&spi_master_idr, ctlr, ctlr->bus_num,
+                        ctlr->bus_num + 1, GFP_KERNEL);
+                mutex_unlock(&board_lock);
+                if (WARN(id < 0, "couldn't get idr"))
+                        return id == -ENOSPC ? -EBUSY : id;
+                ctlr->bus_num = id;
+        } else if (ctlr->dev.of_node) {
+                /* allocate dynamic bus number using Linux idr */
                id = of_alias_get_id(ctlr->dev.of_node, "spi");
                if (id >= 0) {
                        ctlr->bus_num = id;
diff --git a/drivers/staging/media/mt9t031/Kconfig b/drivers/staging/media/mt9t031/Kconfig
index f48e06a03cdb..9a58aaf72edd 100644
--- a/drivers/staging/media/mt9t031/Kconfig
+++ b/drivers/staging/media/mt9t031/Kconfig
@@ -1,9 +1,3 @@
-config SOC_CAMERA_IMX074
-        tristate "imx074 support (DEPRECATED)"
-        depends on SOC_CAMERA && I2C
-        help
-          This driver supports IMX074 cameras from Sony
 config SOC_CAMERA_MT9T031
        tristate "mt9t031 support (DEPRECATED)"
        depends on SOC_CAMERA && I2C
diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
index 9cdfccbdd06f..cc756a123fd8 100644
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -1416,7 +1416,8 @@ static void iscsit_do_crypto_hash_buf(struct ahash_request *hash,
        sg_init_table(sg, ARRAY_SIZE(sg));
        sg_set_buf(sg, buf, payload_length);
-        sg_set_buf(sg + 1, pad_bytes, padding);
+        if (padding)
+                sg_set_buf(sg + 1, pad_bytes, padding);
        ahash_request_set_crypt(hash, sg, data_crc, payload_length + padding);
@@ -3910,10 +3911,14 @@ static bool iscsi_target_check_conn_state(struct iscsi_conn *conn)
 static void iscsit_get_rx_pdu(struct iscsi_conn *conn)
 {
        int ret;
-        u8 buffer[ISCSI_HDR_LEN], opcode;
+        u8 *buffer, opcode;
        u32 checksum = 0, digest = 0;
        struct kvec iov;
+        buffer = kcalloc(ISCSI_HDR_LEN, sizeof(*buffer), GFP_KERNEL);
+        if (!buffer)
+                return;
        while (!kthread_should_stop()) {
                /*
                 * Ensure that both TX and RX per connection kthreads
@@ -3921,7 +3926,6 @@ static void iscsit_get_rx_pdu(struct iscsi_conn *conn)
                 */
                iscsit_thread_check_cpumask(conn, current, 0);
-                memset(buffer, 0, ISCSI_HDR_LEN);
                memset(&iov, 0, sizeof(struct kvec));
                iov.iov_base    = buffer;
@@ -3930,7 +3934,7 @@ static void iscsit_get_rx_pdu(struct iscsi_conn *conn)
                ret = rx_data(conn, &iov, 1, ISCSI_HDR_LEN);
                if (ret != ISCSI_HDR_LEN) {
                        iscsit_rx_thread_wait_for_tcp(conn);
-                        return;
+                        break;
                }
                if (conn->conn_ops->HeaderDigest) {
@@ -3940,7 +3944,7 @@ static void iscsit_get_rx_pdu(struct iscsi_conn *conn)
                        ret = rx_data(conn, &iov, 1, ISCSI_CRC_LEN);
                        if (ret != ISCSI_CRC_LEN) {
                                iscsit_rx_thread_wait_for_tcp(conn);
-                                return;
+                                break;
                        }
                        iscsit_do_crypto_hash_buf(conn->conn_rx_hash, buffer,
@@ -3964,7 +3968,7 @@ static void iscsit_get_rx_pdu(struct iscsi_conn *conn)
                }
                if (conn->conn_state == TARG_CONN_STATE_IN_LOGOUT)
-                        return;
+                        break;
                opcode = buffer[0] & ISCSI_OPCODE_MASK;
@@ -3975,13 +3979,15 @@ static void iscsit_get_rx_pdu(struct iscsi_conn *conn)
                        " while in Discovery Session, rejecting.\n", opcode);
                        iscsit_add_reject(conn, ISCSI_REASON_PROTOCOL_ERROR,
                                          buffer);
-                        return;
+                        break;
                }
                ret = iscsi_target_rx_opcode(conn, buffer);
                if (ret < 0)
-                        return;
+                        break;
        }
+        kfree(buffer);
 }
 int iscsi_target_rx_thread(void *arg)
diff --git a/drivers/target/iscsi/iscsi_target_auth.c b/drivers/target/iscsi/iscsi_target_auth.c
index 9518ffd8b8ba..4e680d753941 100644
--- a/drivers/target/iscsi/iscsi_target_auth.c
+++ b/drivers/target/iscsi/iscsi_target_auth.c
@@ -26,27 +26,6 @@
 #include "iscsi_target_nego.h"
 #include "iscsi_target_auth.h"
-static int chap_string_to_hex(unsigned char *dst, unsigned char *src, int len)
-{
-        int j = DIV_ROUND_UP(len, 2), rc;
-        rc = hex2bin(dst, src, j);
-        if (rc < 0)
-                pr_debug("CHAP string contains non hex digit symbols\n");
-        dst[j] = '\0';
-        return j;
-}
-static void chap_binaryhex_to_asciihex(char *dst, char *src, int src_len)
-{
-        int i;
-        for (i = 0; i < src_len; i++) {
-                sprintf(&dst[i*2], "%02x", (int) src[i] & 0xff);
-        }
-}
 static int chap_gen_challenge(
        struct iscsi_conn *conn,
        int caller,
@@ -62,7 +41,7 @@ static int chap_gen_challenge(
        ret = get_random_bytes_wait(chap->challenge, CHAP_CHALLENGE_LENGTH);
        if (unlikely(ret))
                return ret;
-        chap_binaryhex_to_asciihex(challenge_asciihex, chap->challenge,
+        bin2hex(challenge_asciihex, chap->challenge,
                                CHAP_CHALLENGE_LENGTH);
        /*
         * Set CHAP_C, and copy the generated challenge into c_str.
@@ -248,9 +227,16 @@ static int chap_server_compute_md5(
                pr_err("Could not find CHAP_R.\n");
                goto out;
        }
+        if (strlen(chap_r) != MD5_SIGNATURE_SIZE * 2) {
+                pr_err("Malformed CHAP_R\n");
+                goto out;
+        }
+        if (hex2bin(client_digest, chap_r, MD5_SIGNATURE_SIZE) < 0) {
+                pr_err("Malformed CHAP_R\n");
+                goto out;
+        }
        pr_debug("[server] Got CHAP_R=%s\n", chap_r);
-        chap_string_to_hex(client_digest, chap_r, strlen(chap_r));
        tfm = crypto_alloc_shash("md5", 0, 0);
        if (IS_ERR(tfm)) {
@@ -294,7 +280,7 @@ static int chap_server_compute_md5(
                goto out;
        }
-        chap_binaryhex_to_asciihex(response, server_digest, MD5_SIGNATURE_SIZE);
+        bin2hex(response, server_digest, MD5_SIGNATURE_SIZE);
        pr_debug("[server] MD5 Server Digest: %s\n", response);
        if (memcmp(server_digest, client_digest, MD5_SIGNATURE_SIZE) != 0) {
@@ -349,9 +335,7 @@ static int chap_server_compute_md5(
                pr_err("Could not find CHAP_C.\n");
                goto out;
        }
-        pr_debug("[server] Got CHAP_C=%s\n", challenge);
+        challenge_len = DIV_ROUND_UP(strlen(challenge), 2);
-        challenge_len = chap_string_to_hex(challenge_binhex, challenge,
-                                strlen(challenge));
        if (!challenge_len) {
                pr_err("Unable to convert incoming challenge\n");
                goto out;
@@ -360,6 +344,11 @@ static int chap_server_compute_md5(
                pr_err("CHAP_C exceeds maximum binary size of 1024 bytes\n");
                goto out;
        }
+        if (hex2bin(challenge_binhex, challenge, challenge_len) < 0) {
+                pr_err("Malformed CHAP_C\n");
+                goto out;
+        }
+        pr_debug("[server] Got CHAP_C=%s\n", challenge);
        /*
         * During mutual authentication, the CHAP_C generated by the
         * initiator must not match the original CHAP_C generated by
@@ -413,7 +402,7 @@ static int chap_server_compute_md5(
        /*
         * Convert response from binary hex to ascii hext.
         */
-        chap_binaryhex_to_asciihex(response, digest, MD5_SIGNATURE_SIZE);
+        bin2hex(response, digest, MD5_SIGNATURE_SIZE);
        *nr_out_len += sprintf(nr_out_ptr + *nr_out_len, "CHAP_R=0x%s",
                        response);
        *nr_out_len += 1;
diff --git a/drivers/tty/serial/cpm_uart/cpm_uart_core.c b/drivers/tty/serial/cpm_uart/cpm_uart_core.c
index 24a5f05e769b..e5389591bb4f 100644
--- a/drivers/tty/serial/cpm_uart/cpm_uart_core.c
+++ b/drivers/tty/serial/cpm_uart/cpm_uart_core.c
@@ -1054,8 +1054,8 @@ static int poll_wait_key(char *obuf, struct uart_cpm_port *pinfo)
        /* Get the address of the host memory buffer.
         */
        bdp = pinfo->rx_cur;
-        while (bdp->cbd_sc & BD_SC_EMPTY)
+        if (bdp->cbd_sc & BD_SC_EMPTY)
-                ;
+                return NO_POLL_CHAR;
        /* If the buffer address is in the CPM DPRAM, don't
         * convert it.
@@ -1090,7 +1090,11 @@ static int cpm_get_poll_char(struct uart_port *port)
                poll_chars = 0;
        }
        if (poll_chars <= 0) {
-                poll_chars = poll_wait_key(poll_buf, pinfo);
+                int ret = poll_wait_key(poll_buf, pinfo);
+                if (ret == NO_POLL_CHAR)
+                        return ret;
+                poll_chars = ret;
                pollp = poll_buf;
        }
        poll_chars--;
diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
index 51e47a63d61a..3f8d1274fc85 100644
--- a/drivers/tty/serial/fsl_lpuart.c
+++ b/drivers/tty/serial/fsl_lpuart.c
@@ -979,7 +979,8 @@ static inline int lpuart_start_rx_dma(struct lpuart_port *sport)
        struct circ_buf *ring = &sport->rx_ring;
        int ret, nent;
        int bits, baud;
-        struct tty_struct *tty = tty_port_tty_get(&sport->port.state->port);
+        struct tty_port *port = &sport->port.state->port;
+        struct tty_struct *tty = port->tty;
        struct ktermios *termios = &tty->termios;
        baud = tty_get_baud_rate(tty);
diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c
index 239c0fa2e981..0f67197a3783 100644
--- a/drivers/tty/serial/imx.c
+++ b/drivers/tty/serial/imx.c
@@ -2351,6 +2351,14 @@ static int imx_uart_probe(struct platform_device *pdev)
                                ret);
                        return ret;
                }
+                ret = devm_request_irq(&pdev->dev, rtsirq, imx_uart_rtsint, 0,
+                                       dev_name(&pdev->dev), sport);
+                if (ret) {
+                        dev_err(&pdev->dev, "failed to request rts irq: %d\n",
+                                ret);
+                        return ret;
+                }
        } else {
                ret = devm_request_irq(&pdev->dev, rxirq, imx_uart_int, 0,
                                       dev_name(&pdev->dev), sport);
diff --git a/drivers/tty/serial/mvebu-uart.c b/drivers/tty/serial/mvebu-uart.c
index d04b5eeea3c6..170e446a2f62 100644
--- a/drivers/tty/serial/mvebu-uart.c
+++ b/drivers/tty/serial/mvebu-uart.c
@@ -511,6 +511,7 @@ static void mvebu_uart_set_termios(struct uart_port *port,
                termios->c_iflag |= old->c_iflag & ~(INPCK | IGNPAR);
                termios->c_cflag &= CREAD | CBAUD;
                termios->c_cflag |= old->c_cflag & ~(CREAD | CBAUD);
+                termios->c_cflag |= CS8;
        }
        spin_unlock_irqrestore(&port->lock, flags);
diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
index 32bc3e3fe4d3..5e5da9acaf0a 100644
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -1255,6 +1255,7 @@ static void tty_driver_remove_tty(struct tty_driver *driver, struct tty_struct *
 static int tty_reopen(struct tty_struct *tty)
 {
        struct tty_driver *driver = tty->driver;
+        int retval;
        if (driver->type == TTY_DRIVER_TYPE_PTY &&
            driver->subtype == PTY_TYPE_MASTER)
@@ -1268,10 +1269,14 @@ static int tty_reopen(struct tty_struct *tty)
        tty->count++;
-        if (!tty->ldisc)
+        if (tty->ldisc)
-                return tty_ldisc_reinit(tty, tty->termios.c_line);
+                return 0;
-        return 0;
+        retval = tty_ldisc_reinit(tty, tty->termios.c_line);
+        if (retval)
+                tty->count--;
+        return retval;
 }
 /**
diff --git a/drivers/tty/vt/vt_ioctl.c b/drivers/tty/vt/vt_ioctl.c
index a78ad10a119b..73cdc0d633dd 100644
--- a/drivers/tty/vt/vt_ioctl.c
+++ b/drivers/tty/vt/vt_ioctl.c
@@ -32,6 +32,8 @@
 #include <asm/io.h>
 #include <linux/uaccess.h>
+#include <linux/nospec.h>
 #include <linux/kbd_kern.h>
 #include <linux/vt_kern.h>
 #include <linux/kbd_diacr.h>
@@ -700,6 +702,8 @@ int vt_ioctl(struct tty_struct *tty,
                if (vsa.console == 0 || vsa.console > MAX_NR_CONSOLES)
                        ret = -ENXIO;
                else {
+                        vsa.console = array_index_nospec(vsa.console,
+                                                         MAX_NR_CONSOLES + 1);
                        vsa.console--;
                        console_lock();
                        ret = vc_allocate(vsa.console);
diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
index 656d247819c9..bec581fb7c63 100644
--- a/drivers/usb/class/cdc-wdm.c
+++ b/drivers/usb/class/cdc-wdm.c
@@ -460,7 +460,7 @@ static int service_outstanding_interrupt(struct wdm_device *desc)
        set_bit(WDM_RESPONDING, &desc->flags);
        spin_unlock_irq(&desc->iuspin);
-        rv = usb_submit_urb(desc->response, GFP_ATOMIC);
+        rv = usb_submit_urb(desc->response, GFP_KERNEL);
        spin_lock_irq(&desc->iuspin);
        if (rv) {
                dev_err(&desc->intf->dev,
diff --git a/drivers/usb/common/roles.c b/drivers/usb/common/roles.c
index 15cc76e22123..99116af07f1d 100644
--- a/drivers/usb/common/roles.c
+++ b/drivers/usb/common/roles.c
@@ -109,8 +109,15 @@ static void *usb_role_switch_match(struct device_connection *con, int ep,
 */
 struct usb_role_switch *usb_role_switch_get(struct device *dev)
 {
-        return device_connection_find_match(dev, "usb-role-switch", NULL,
+        struct usb_role_switch *sw;
-                                            usb_role_switch_match);
+        sw = device_connection_find_match(dev, "usb-role-switch", NULL,
+                                          usb_role_switch_match);
+        if (!IS_ERR_OR_NULL(sw))
+                WARN_ON(!try_module_get(sw->dev.parent->driver->owner));
+        return sw;
 }
 EXPORT_SYMBOL_GPL(usb_role_switch_get);
@@ -122,8 +129,10 @@ EXPORT_SYMBOL_GPL(usb_role_switch_get);
 */
 void usb_role_switch_put(struct usb_role_switch *sw)
 {
-        if (!IS_ERR_OR_NULL(sw))
+        if (!IS_ERR_OR_NULL(sw)) {
                put_device(&sw->dev);
+                module_put(sw->dev.parent->driver->owner);
+        }
 }
 EXPORT_SYMBOL_GPL(usb_role_switch_put);
diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index 6ce77b33da61..244417d0dfd1 100644
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -1434,10 +1434,13 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb
        struct async *as = NULL;
        struct usb_ctrlrequest *dr = NULL;
        unsigned int u, totlen, isofrmlen;
-        int i, ret, is_in, num_sgs = 0, ifnum = -1;
+        int i, ret, num_sgs = 0, ifnum = -1;
        int number_of_packets = 0;
        unsigned int stream_id = 0;
        void *buf;
+        bool is_in;
+        bool allow_short = false;
+        bool allow_zero = false;
        unsigned long mask =    USBDEVFS_URB_SHORT_NOT_OK |
                                USBDEVFS_URB_BULK_CONTINUATION |
                                USBDEVFS_URB_NO_FSBR |
@@ -1471,6 +1474,8 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb
        u = 0;
        switch (uurb->type) {
        case USBDEVFS_URB_TYPE_CONTROL:
+                if (is_in)
+                        allow_short = true;
                if (!usb_endpoint_xfer_control(&ep->desc))
                        return -EINVAL;
                /* min 8 byte setup packet */
@@ -1511,6 +1516,10 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb
                break;
        case USBDEVFS_URB_TYPE_BULK:
+                if (!is_in)
+                        allow_zero = true;
+                else
+                        allow_short = true;
                switch (usb_endpoint_type(&ep->desc)) {
                case USB_ENDPOINT_XFER_CONTROL:
                case USB_ENDPOINT_XFER_ISOC:
@@ -1531,6 +1540,10 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb
                if (!usb_endpoint_xfer_int(&ep->desc))
                        return -EINVAL;
 interrupt_urb:
+                if (!is_in)
+                        allow_zero = true;
+                else
+                        allow_short = true;
                break;
        case USBDEVFS_URB_TYPE_ISO:
@@ -1676,14 +1689,19 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb
        u = (is_in ? URB_DIR_IN : URB_DIR_OUT);
        if (uurb->flags & USBDEVFS_URB_ISO_ASAP)
                u |= URB_ISO_ASAP;
-        if (uurb->flags & USBDEVFS_URB_SHORT_NOT_OK && is_in)
+        if (allow_short && uurb->flags & USBDEVFS_URB_SHORT_NOT_OK)
                u |= URB_SHORT_NOT_OK;
-        if (uurb->flags & USBDEVFS_URB_ZERO_PACKET)
+        if (allow_zero && uurb->flags & USBDEVFS_URB_ZERO_PACKET)
                u |= URB_ZERO_PACKET;
        if (uurb->flags & USBDEVFS_URB_NO_INTERRUPT)
                u |= URB_NO_INTERRUPT;
        as->urb->transfer_flags = u;
+        if (!allow_short && uurb->flags & USBDEVFS_URB_SHORT_NOT_OK)
+                dev_warn(&ps->dev->dev, "Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK.\n");
+        if (!allow_zero && uurb->flags & USBDEVFS_URB_ZERO_PACKET)
+                dev_warn(&ps->dev->dev, "Requested nonsensical USBDEVFS_URB_ZERO_PACKET.\n");
        as->urb->transfer_buffer_length = uurb->buffer_length;
        as->urb->setup_packet = (unsigned char *)dr;
        dr = NULL;
diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
index e76e95f62f76..a1f225f077cd 100644
--- a/drivers/usb/core/driver.c
+++ b/drivers/usb/core/driver.c
@@ -512,7 +512,6 @@ int usb_driver_claim_interface(struct usb_driver *driver,
        struct device *dev;
        struct usb_device *udev;
        int retval = 0;
-        int lpm_disable_error = -ENODEV;
        if (!iface)
                return -ENODEV;
@@ -533,16 +532,6 @@ int usb_driver_claim_interface(struct usb_driver *driver,
        iface->condition = USB_INTERFACE_BOUND;
-        /* See the comment about disabling LPM in usb_probe_interface(). */
-        if (driver->disable_hub_initiated_lpm) {
-                lpm_disable_error = usb_unlocked_disable_lpm(udev);
-                if (lpm_disable_error) {
-                        dev_err(&iface->dev, "%s Failed to disable LPM for driver %s\n",
-                                __func__, driver->name);
-                        return -ENOMEM;
-                }
-        }
        /* Claimed interfaces are initially inactive (suspended) and
         * runtime-PM-enabled, but only if the driver has autosuspend
         * support.  Otherwise they are marked active, to prevent the
@@ -561,9 +550,20 @@ int usb_driver_claim_interface(struct usb_driver *driver,
        if (device_is_registered(dev))
                retval = device_bind_driver(dev);
-        /* Attempt to re-enable USB3 LPM, if the disable was successful. */
+        if (retval) {
-        if (!lpm_disable_error)
+                dev->driver = NULL;
-                usb_unlocked_enable_lpm(udev);
+                usb_set_intfdata(iface, NULL);
+                iface->needs_remote_wakeup = 0;
+                iface->condition = USB_INTERFACE_UNBOUND;
+                /*
+                 * Unbound interfaces are always runtime-PM-disabled
+                 * and runtime-PM-suspended
+                 */
+                if (driver->supports_autosuspend)
+                        pm_runtime_disable(dev);
+                pm_runtime_set_suspended(dev);
+        }
        return retval;
 }
diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index e77dfe5ed5ec..178d6c6063c0 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -58,6 +58,7 @@ static int quirks_param_set(const char *val, const struct kernel_param *kp)
        quirk_list = kcalloc(quirk_count, sizeof(struct quirk_entry),
                             GFP_KERNEL);
        if (!quirk_list) {
+                quirk_count = 0;
                mutex_unlock(&quirk_mutex);
                return -ENOMEM;
        }
@@ -154,7 +155,7 @@ static struct kparam_string quirks_param_string = {
        .string = quirks_param,
 };
-module_param_cb(quirks, &quirks_param_ops, &quirks_param_string, 0644);
+device_param_cb(quirks, &quirks_param_ops, &quirks_param_string, 0644);
 MODULE_PARM_DESC(quirks, "Add/modify USB quirks by specifying quirks=vendorID:productID:quirks");
 /* Lists of quirky USB devices, split in device quirks and interface quirks.
diff --git a/drivers/usb/core/usb.c b/drivers/usb/core/usb.c
index 623be3174fb3..79d8bd7a612e 100644
--- a/drivers/usb/core/usb.c
+++ b/drivers/usb/core/usb.c
@@ -228,6 +228,8 @@ struct usb_host_interface *usb_find_alt_setting(
        struct usb_interface_cache *intf_cache = NULL;
        int i;
+        if (!config)
+                return NULL;
        for (i = 0; i < config->desc.bNumInterfaces; i++) {
                if (config->intf_cache[i]->altsetting[0].desc.bInterfaceNumber
                                == iface_num) {
diff --git a/drivers/usb/musb/musb_dsps.c b/drivers/usb/musb/musb_dsps.c
index df827ff57b0d..23a0df79ef21 100644
--- a/drivers/usb/musb/musb_dsps.c
+++ b/drivers/usb/musb/musb_dsps.c
@@ -658,16 +658,6 @@ dsps_dma_controller_create(struct musb *musb, void __iomem *base)
        return controller;
 }
-static void dsps_dma_controller_destroy(struct dma_controller *c)
-{
-        struct musb *musb = c->musb;
-        struct dsps_glue *glue = dev_get_drvdata(musb->controller->parent);
-        void __iomem *usbss_base = glue->usbss_base;
-        musb_writel(usbss_base, USBSS_IRQ_CLEARR, USBSS_IRQ_PD_COMP);
-        cppi41_dma_controller_destroy(c);
-}
 #ifdef CONFIG_PM_SLEEP
 static void dsps_dma_controller_suspend(struct dsps_glue *glue)
 {
@@ -697,7 +687,7 @@ static struct musb_platform_ops dsps_ops = {
 #ifdef CONFIG_USB_TI_CPPI41_DMA
        .dma_init       = dsps_dma_controller_create,
-        .dma_exit       = dsps_dma_controller_destroy,
+        .dma_exit       = cppi41_dma_controller_destroy,
 #endif
        .enable         = dsps_musb_enable,
        .disable        = dsps_musb_disable,
diff --git a/drivers/usb/typec/mux.c b/drivers/usb/typec/mux.c
index ddaac63ecf12..d990aa510fab 100644
--- a/drivers/usb/typec/mux.c
+++ b/drivers/usb/typec/mux.c
@@ -9,6 +9,7 @@
 #include <linux/device.h>
 #include <linux/list.h>
+#include <linux/module.h>
 #include <linux/mutex.h>
 #include <linux/usb/typec_mux.h>
@@ -49,8 +50,10 @@ struct typec_switch *typec_switch_get(struct device *dev)
        mutex_lock(&switch_lock);
        sw = device_connection_find_match(dev, "typec-switch", NULL,
                                          typec_switch_match);
-        if (!IS_ERR_OR_NULL(sw))
+        if (!IS_ERR_OR_NULL(sw)) {
+                WARN_ON(!try_module_get(sw->dev->driver->owner));
                get_device(sw->dev);
+        }
        mutex_unlock(&switch_lock);
        return sw;
@@ -65,8 +68,10 @@ EXPORT_SYMBOL_GPL(typec_switch_get);
 */
 void typec_switch_put(struct typec_switch *sw)
 {
-        if (!IS_ERR_OR_NULL(sw))
+        if (!IS_ERR_OR_NULL(sw)) {
+                module_put(sw->dev->driver->owner);
                put_device(sw->dev);
+        }
 }
 EXPORT_SYMBOL_GPL(typec_switch_put);
@@ -136,8 +141,10 @@ struct typec_mux *typec_mux_get(struct device *dev, const char *name)
        mutex_lock(&mux_lock);
        mux = device_connection_find_match(dev, name, NULL, typec_mux_match);
-        if (!IS_ERR_OR_NULL(mux))
+        if (!IS_ERR_OR_NULL(mux)) {
+                WARN_ON(!try_module_get(mux->dev->driver->owner));
                get_device(mux->dev);
+        }
        mutex_unlock(&mux_lock);
        return mux;
@@ -152,8 +159,10 @@ EXPORT_SYMBOL_GPL(typec_mux_get);
 */
 void typec_mux_put(struct typec_mux *mux)
 {
-        if (!IS_ERR_OR_NULL(mux))
+        if (!IS_ERR_OR_NULL(mux)) {
+                module_put(mux->dev->driver->owner);
                put_device(mux->dev);
+        }
 }
 EXPORT_SYMBOL_GPL(typec_mux_put);
diff --git a/drivers/video/fbdev/efifb.c b/drivers/video/fbdev/efifb.c
index 3946649b85c8..ba906876cc45 100644
--- a/drivers/video/fbdev/efifb.c
+++ b/drivers/video/fbdev/efifb.c
@@ -42,6 +42,7 @@ struct bmp_dib_header {
        u32 colors_important;
 } __packed;
+static bool use_bgrt = true;
 static bool request_mem_succeeded = false;
 static u64 mem_flags = EFI_MEMORY_WC | EFI_MEMORY_UC;
@@ -160,6 +161,9 @@ static void efifb_show_boot_graphics(struct fb_info *info)
        void *bgrt_image = NULL;
        u8 *dst = info->screen_base;
+        if (!use_bgrt)
+                return;
        if (!bgrt_tab.image_address) {
                pr_info("efifb: No BGRT, not showing boot graphics\n");
                return;
@@ -290,6 +294,8 @@ static int efifb_setup(char *options)
                                screen_info.lfb_width = simple_strtoul(this_opt+6, NULL, 0);
                        else if (!strcmp(this_opt, "nowc"))
                                mem_flags &= ~EFI_MEMORY_WC;
+                        else if (!strcmp(this_opt, "nobgrt"))
+                                use_bgrt = false;
                }
        }
diff --git a/drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c b/drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c
index ef69273074ba..a3edb20ea4c3 100644
--- a/drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c
+++ b/drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c
@@ -496,6 +496,9 @@ static int omapfb_memory_read(struct fb_info *fbi,
        if (!access_ok(VERIFY_WRITE, mr->buffer, mr->buffer_size))
                return -EFAULT;
+        if (mr->w > 4096 || mr->h > 4096)
+                return -EINVAL;
        if (mr->w * mr->h * 3 > mr->buffer_size)
                return -EINVAL;
@@ -509,7 +512,7 @@ static int omapfb_memory_read(struct fb_info *fbi,
                        mr->x, mr->y, mr->w, mr->h);
        if (r > 0) {
-                if (copy_to_user(mr->buffer, buf, mr->buffer_size))
+                if (copy_to_user(mr->buffer, buf, r))
                        r = -EFAULT;
        }
diff --git a/drivers/video/fbdev/pxa168fb.c b/drivers/video/fbdev/pxa168fb.c
index def3a501acd6..d059d04c63ac 100644
--- a/drivers/video/fbdev/pxa168fb.c
+++ b/drivers/video/fbdev/pxa168fb.c
@@ -712,7 +712,7 @@ static int pxa168fb_probe(struct platform_device *pdev)
        /*
         * enable controller clock
         */
-        clk_enable(fbi->clk);
+        clk_prepare_enable(fbi->clk);
        pxa168fb_set_par(info);
@@ -767,7 +767,7 @@ static int pxa168fb_probe(struct platform_device *pdev)
 failed_free_cmap:
        fb_dealloc_cmap(&info->cmap);
 failed_free_clk:
-        clk_disable(fbi->clk);
+        clk_disable_unprepare(fbi->clk);
 failed_free_fbmem:
        dma_free_coherent(fbi->dev, info->fix.smem_len,
                        info->screen_base, fbi->fb_start_dma);
@@ -807,7 +807,7 @@ static int pxa168fb_remove(struct platform_device *pdev)
        dma_free_wc(fbi->dev, PAGE_ALIGN(info->fix.smem_len),
                    info->screen_base, info->fix.smem_start);
-        clk_disable(fbi->clk);
+        clk_disable_unprepare(fbi->clk);
        framebuffer_release(info);
diff --git a/drivers/video/fbdev/stifb.c b/drivers/video/fbdev/stifb.c
index 045e8afe398b..9e88e3f594c2 100644
--- a/drivers/video/fbdev/stifb.c
+++ b/drivers/video/fbdev/stifb.c
@@ -1157,7 +1157,7 @@ static int __init stifb_init_fb(struct sti_struct *sti, int bpp_pref)
                        dev_name);
                   goto out_err0;
                }
-                /* fall though */
+                /* fall through */
        case S9000_ID_ARTIST:
        case S9000_ID_HCRX:
        case S9000_ID_TIMBER:
diff --git a/drivers/xen/grant-table.c b/drivers/xen/grant-table.c
index 7bafa703a992..84575baceebc 100644
--- a/drivers/xen/grant-table.c
+++ b/drivers/xen/grant-table.c
@@ -1040,18 +1040,33 @@ int gnttab_map_refs(struct gnttab_map_grant_ref *map_ops,
                return ret;
        for (i = 0; i < count; i++) {
-                /* Retry eagain maps */
+                switch (map_ops[i].status) {
-                if (map_ops[i].status == GNTST_eagain)
+                case GNTST_okay:
-                        gnttab_retry_eagain_gop(GNTTABOP_map_grant_ref, map_ops + i,
+                {
-                                                &map_ops[i].status, __func__);
-                if (map_ops[i].status == GNTST_okay) {
                        struct xen_page_foreign *foreign;
                        SetPageForeign(pages[i]);
                        foreign = xen_page_foreign(pages[i]);
                        foreign->domid = map_ops[i].dom;
                        foreign->gref = map_ops[i].ref;
+                        break;
+                }
+                case GNTST_no_device_space:
+                        pr_warn_ratelimited("maptrack limit reached, can't map all guest pages\n");
+                        break;
+                case GNTST_eagain:
+                        /* Retry eagain maps */
+                        gnttab_retry_eagain_gop(GNTTABOP_map_grant_ref,
+                                                map_ops + i,
+                                                &map_ops[i].status, __func__);
+                        /* Test status in next loop iteration. */
+                        i--;
+                        break;
+                default:
+                        break;
                }
        }