360 files changed, 2851 insertions, 1859 deletions

diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c
index 5c093ce01bcd..147f6c7ea59c 100644
--- a/drivers/acpi/bus.c
+++ b/drivers/acpi/bus.c
@@ -1029,6 +1029,9 @@ void __init acpi_early_init(void)
 
         acpi_permanent_mmap = true;
 
+        /* Initialize debug output. Linux does not use ACPICA defaults */
+        acpi_dbg_level = ACPI_LV_INFO | ACPI_LV_REPAIR;
+
 #ifdef CONFIG_X86
         /*
          * If the machine falls into the DMI check table,
diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
index 5143e11e3b0f..e18ade5d74e9 100644
--- a/drivers/acpi/nfit/core.c
+++ b/drivers/acpi/nfit/core.c
@@ -409,6 +409,32 @@ static bool payload_dumpable(struct nvdimm *nvdimm, unsigned int func)
         return true;
 }
 
+static int cmd_to_func(struct nfit_mem *nfit_mem, unsigned int cmd,
+                struct nd_cmd_pkg *call_pkg)
+{
+        if (call_pkg) {
+                int i;
+
+                if (nfit_mem->family != call_pkg->nd_family)
+                        return -ENOTTY;
+
+                for (i = 0; i < ARRAY_SIZE(call_pkg->nd_reserved2); i++)
+                        if (call_pkg->nd_reserved2[i])
+                                return -EINVAL;
+                return call_pkg->nd_command;
+        }
+
+        /* Linux ND commands == NVDIMM_FAMILY_INTEL function numbers */
+        if (nfit_mem->family == NVDIMM_FAMILY_INTEL)
+                return cmd;
+
+        /*
+         * Force function number validation to fail since 0 is never
+         * published as a valid function in dsm_mask.
+         */
+        return 0;
+}
+
 int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, struct nvdimm *nvdimm,
                 unsigned int cmd, void *buf, unsigned int buf_len, int *cmd_rc)
 {
@@ -422,30 +448,23 @@ int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, struct nvdimm *nvdimm,
         unsigned long cmd_mask, dsm_mask;
         u32 offset, fw_status = 0;
         acpi_handle handle;
-        unsigned int func;
         const guid_t *guid;
-        int rc, i;
+        int func, rc, i;
 
         if (cmd_rc)
                 *cmd_rc = -EINVAL;
-        func = cmd;
-        if (cmd == ND_CMD_CALL) {
-                call_pkg = buf;
-                func = call_pkg->nd_command;
-
-                for (i = 0; i < ARRAY_SIZE(call_pkg->nd_reserved2); i++)
-                        if (call_pkg->nd_reserved2[i])
-                                return -EINVAL;
-        }
 
         if (nvdimm) {
                 struct acpi_device *adev = nfit_mem->adev;
 
                 if (!adev)
                         return -ENOTTY;
-                if (call_pkg && nfit_mem->family != call_pkg->nd_family)
-                        return -ENOTTY;
 
+                if (cmd == ND_CMD_CALL)
+                        call_pkg = buf;
+                func = cmd_to_func(nfit_mem, cmd, call_pkg);
+                if (func < 0)
+                        return func;
                 dimm_name = nvdimm_name(nvdimm);
                 cmd_name = nvdimm_cmd_name(cmd);
                 cmd_mask = nvdimm_cmd_mask(nvdimm);
@@ -456,6 +475,7 @@ int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, struct nvdimm *nvdimm,
         } else {
                 struct acpi_device *adev = to_acpi_dev(acpi_desc);
 
+                func = cmd;
                 cmd_name = nvdimm_bus_cmd_name(cmd);
                 cmd_mask = nd_desc->cmd_mask;
                 dsm_mask = cmd_mask;
@@ -470,7 +490,13 @@ int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, struct nvdimm *nvdimm,
         if (!desc || (cmd && (desc->out_num + desc->in_num == 0)))
                 return -ENOTTY;
 
-        if (!test_bit(cmd, &cmd_mask) || !test_bit(func, &dsm_mask))
+        /*
+         * Check for a valid command.  For ND_CMD_CALL, we also have to
+         * make sure that the DSM function is supported.
+         */
+        if (cmd == ND_CMD_CALL && !test_bit(func, &dsm_mask))
+                return -ENOTTY;
+        else if (!test_bit(cmd, &cmd_mask))
                 return -ENOTTY;
 
         in_obj.type = ACPI_TYPE_PACKAGE;
@@ -1867,6 +1893,13 @@ static int acpi_nfit_add_dimm(struct acpi_nfit_desc *acpi_desc,
                 return 0;
         }
 
+        /*
+         * Function 0 is the command interrogation function, don't
+         * export it to potential userspace use, and enable it to be
+         * used as an error value in acpi_nfit_ctl().
+         */
+        dsm_mask &= ~1UL;
+
         guid = to_nfit_uuid(nfit_mem->family);
         for_each_set_bit(i, &dsm_mask, BITS_PER_LONG)
                 if (acpi_check_dsm(adev_dimm->handle, guid,
@@ -2042,11 +2075,6 @@ static int acpi_nfit_register_dimms(struct acpi_nfit_desc *acpi_desc)
                 if (!nvdimm)
                         continue;
 
-                rc = nvdimm_security_setup_events(nvdimm);
-                if (rc < 0)
-                        dev_warn(acpi_desc->dev,
-                                "security event setup failed: %d\n", rc);
-
                 nfit_kernfs = sysfs_get_dirent(nvdimm_kobj(nvdimm)->sd, "nfit");
                 if (nfit_kernfs)
                         nfit_mem->flags_attr = sysfs_get_dirent(nfit_kernfs,
diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index cdfc87629efb..4d2b2ad1ee0e 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -5854,9 +5854,10 @@ static int __init init_binder_device(const char *name)
 static int __init binder_init(void)
 {
         int ret;
-        char *device_name, *device_names, *device_tmp;
+        char *device_name, *device_tmp;
         struct binder_device *device;
         struct hlist_node *tmp;
+        char *device_names = NULL;
 
         ret = binder_alloc_shrinker_init();
         if (ret)
@@ -5898,23 +5899,29 @@ static int __init binder_init(void)
                                     &transaction_log_fops);
         }
 
-        /*
-         * Copy the module_parameter string, because we don't want to
-         * tokenize it in-place.
-         */
-        device_names = kstrdup(binder_devices_param, GFP_KERNEL);
-        if (!device_names) {
-                ret = -ENOMEM;
-                goto err_alloc_device_names_failed;
-        }
+        if (strcmp(binder_devices_param, "") != 0) {
+                /*
+                * Copy the module_parameter string, because we don't want to
+                * tokenize it in-place.
+                 */
+                device_names = kstrdup(binder_devices_param, GFP_KERNEL);
+                if (!device_names) {
+                        ret = -ENOMEM;
+                        goto err_alloc_device_names_failed;
+                }
 
-        device_tmp = device_names;
-        while ((device_name = strsep(&device_tmp, ","))) {
-                ret = init_binder_device(device_name);
-                if (ret)
-                        goto err_init_binder_device_failed;
+                device_tmp = device_names;
+                while ((device_name = strsep(&device_tmp, ","))) {
+                        ret = init_binder_device(device_name);
+                        if (ret)
+                                goto err_init_binder_device_failed;
+                }
         }
 
+        ret = init_binderfs();
+        if (ret)
+                goto err_init_binder_device_failed;
+
         return ret;
 
 err_init_binder_device_failed:
diff --git a/drivers/android/binder_internal.h b/drivers/android/binder_internal.h
index 7fb97f503ef2..045b3e42d98b 100644
--- a/drivers/android/binder_internal.h
+++ b/drivers/android/binder_internal.h
@@ -46,4 +46,13 @@ static inline bool is_binderfs_device(const struct inode *inode)
 }
 #endif
 
+#ifdef CONFIG_ANDROID_BINDERFS
+extern int __init init_binderfs(void);
+#else
+static inline int __init init_binderfs(void)
+{
+        return 0;
+}
+#endif
+
 #endif /* _LINUX_BINDER_INTERNAL_H */
diff --git a/drivers/android/binderfs.c b/drivers/android/binderfs.c
index 7496b10532aa..e773f45d19d9 100644
--- a/drivers/android/binderfs.c
+++ b/drivers/android/binderfs.c
@@ -11,6 +11,7 @@
 #include <linux/kdev_t.h>
 #include <linux/kernel.h>
 #include <linux/list.h>
+#include <linux/namei.h>
 #include <linux/magic.h>
 #include <linux/major.h>
 #include <linux/miscdevice.h>
@@ -20,6 +21,7 @@
 #include <linux/parser.h>
 #include <linux/radix-tree.h>
 #include <linux/sched.h>
+#include <linux/seq_file.h>
 #include <linux/slab.h>
 #include <linux/spinlock_types.h>
 #include <linux/stddef.h>
@@ -30,7 +32,7 @@
 #include <linux/xarray.h>
 #include <uapi/asm-generic/errno-base.h>
 #include <uapi/linux/android/binder.h>
-#include <uapi/linux/android/binder_ctl.h>
+#include <uapi/linux/android/binderfs.h>
 
 #include "binder_internal.h"
 
@@ -39,14 +41,32 @@
 #define INODE_OFFSET 3
 #define INTSTRLEN 21
 #define BINDERFS_MAX_MINOR (1U << MINORBITS)
-
-static struct vfsmount *binderfs_mnt;
+/* Ensure that the initial ipc namespace always has devices available. */
+#define BINDERFS_MAX_MINOR_CAPPED (BINDERFS_MAX_MINOR - 4)
 
 static dev_t binderfs_dev;
 static DEFINE_MUTEX(binderfs_minors_mutex);
 static DEFINE_IDA(binderfs_minors);
 
 /**
+ * binderfs_mount_opts - mount options for binderfs
+ * @max: maximum number of allocatable binderfs binder devices
+ */
+struct binderfs_mount_opts {
+        int max;
+};
+
+enum {
+        Opt_max,
+        Opt_err
+};
+
+static const match_table_t tokens = {
+        { Opt_max, "max=%d" },
+        { Opt_err, NULL     }
+};
+
+/**
  * binderfs_info - information about a binderfs mount
  * @ipc_ns:         The ipc namespace the binderfs mount belongs to.
  * @control_dentry: This records the dentry of this binderfs mount
@@ -55,13 +75,16 @@ static DEFINE_IDA(binderfs_minors);
  *                  created.
  * @root_gid:       gid that needs to be used when a new binder device is
  *                  created.
+ * @mount_opts:     The mount options in use.
+ * @device_count:   The current number of allocated binder devices.
  */
 struct binderfs_info {
         struct ipc_namespace *ipc_ns;
         struct dentry *control_dentry;
         kuid_t root_uid;
         kgid_t root_gid;
-
+        struct binderfs_mount_opts mount_opts;
+        int device_count;
 };
 
 static inline struct binderfs_info *BINDERFS_I(const struct inode *inode)
@@ -84,7 +107,7 @@ bool is_binderfs_device(const struct inode *inode)
  * @userp:     buffer to copy information about new device for userspace to
  * @req:       struct binderfs_device as copied from userspace
  *
- * This function allocated a new binder_device and reserves a new minor
+ * This function allocates a new binder_device and reserves a new minor
  * number for it.
  * Minor numbers are limited and tracked globally in binderfs_minors. The
  * function will stash a struct binder_device for the specific binder
@@ -100,20 +123,34 @@ static int binderfs_binder_device_create(struct inode *ref_inode,
                                          struct binderfs_device *req)
 {
         int minor, ret;
-        struct dentry *dentry, *dup, *root;
+        struct dentry *dentry, *root;
         struct binder_device *device;
-        size_t name_len = BINDERFS_MAX_NAME + 1;
         char *name = NULL;
+        size_t name_len;
         struct inode *inode = NULL;
         struct super_block *sb = ref_inode->i_sb;
         struct binderfs_info *info = sb->s_fs_info;
+#if defined(CONFIG_IPC_NS)
+        bool use_reserve = (info->ipc_ns == &init_ipc_ns);
+#else
+        bool use_reserve = true;
+#endif
 
         /* Reserve new minor number for the new device. */
         mutex_lock(&binderfs_minors_mutex);
-        minor = ida_alloc_max(&binderfs_minors, BINDERFS_MAX_MINOR, GFP_KERNEL);
-        mutex_unlock(&binderfs_minors_mutex);
-        if (minor < 0)
+        if (++info->device_count <= info->mount_opts.max)
+                minor = ida_alloc_max(&binderfs_minors,
+                                      use_reserve ? BINDERFS_MAX_MINOR :
+                                                    BINDERFS_MAX_MINOR_CAPPED,
+                                      GFP_KERNEL);
+        else
+                minor = -ENOSPC;
+        if (minor < 0) {
+                --info->device_count;
+                mutex_unlock(&binderfs_minors_mutex);
                 return minor;
+        }
+        mutex_unlock(&binderfs_minors_mutex);
 
         ret = -ENOMEM;
         device = kzalloc(sizeof(*device), GFP_KERNEL);
@@ -132,12 +169,13 @@ static int binderfs_binder_device_create(struct inode *ref_inode,
         inode->i_uid = info->root_uid;
         inode->i_gid = info->root_gid;
 
-        name = kmalloc(name_len, GFP_KERNEL);
+        req->name[BINDERFS_MAX_NAME] = '\0'; /* NUL-terminate */
+        name_len = strlen(req->name);
+        /* Make sure to include terminating NUL byte */
+        name = kmemdup(req->name, name_len + 1, GFP_KERNEL);
         if (!name)
                 goto err;
 
-        strscpy(name, req->name, name_len);
-
         device->binderfs_inode = inode;
         device->context.binder_context_mgr_uid = INVALID_UID;
         device->context.name = name;
@@ -156,28 +194,25 @@ static int binderfs_binder_device_create(struct inode *ref_inode,
 
         root = sb->s_root;
         inode_lock(d_inode(root));
-        dentry = d_alloc_name(root, name);
-        if (!dentry) {
+
+        /* look it up */
+        dentry = lookup_one_len(name, root, name_len);
+        if (IS_ERR(dentry)) {
                 inode_unlock(d_inode(root));
-                ret = -ENOMEM;
+                ret = PTR_ERR(dentry);
                 goto err;
         }
 
-        /* Verify that the name userspace gave us is not already in use. */
-        dup = d_lookup(root, &dentry->d_name);
-        if (dup) {
-                if (d_really_is_positive(dup)) {
-                        dput(dup);
-                        dput(dentry);
-                        inode_unlock(d_inode(root));
-                        ret = -EEXIST;
-                        goto err;
-                }
-                dput(dup);
+        if (d_really_is_positive(dentry)) {
+                /* already exists */
+                dput(dentry);
+                inode_unlock(d_inode(root));
+                ret = -EEXIST;
+                goto err;
         }
 
         inode->i_private = device;
-        d_add(dentry, inode);
+        d_instantiate(dentry, inode);
         fsnotify_create(root->d_inode, dentry);
         inode_unlock(d_inode(root));
 
@@ -187,6 +222,7 @@ err:
         kfree(name);
         kfree(device);
         mutex_lock(&binderfs_minors_mutex);
+        --info->device_count;
         ida_free(&binderfs_minors, minor);
         mutex_unlock(&binderfs_minors_mutex);
         iput(inode);
@@ -232,6 +268,7 @@ static long binder_ctl_ioctl(struct file *file, unsigned int cmd,
 static void binderfs_evict_inode(struct inode *inode)
 {
         struct binder_device *device = inode->i_private;
+        struct binderfs_info *info = BINDERFS_I(inode);
 
         clear_inode(inode);
 
@@ -239,6 +276,7 @@ static void binderfs_evict_inode(struct inode *inode)
                 return;
 
         mutex_lock(&binderfs_minors_mutex);
+        --info->device_count;
         ida_free(&binderfs_minors, device->miscdev.minor);
         mutex_unlock(&binderfs_minors_mutex);
 
@@ -246,43 +284,87 @@ static void binderfs_evict_inode(struct inode *inode)
         kfree(device);
 }
 
+/**
+ * binderfs_parse_mount_opts - parse binderfs mount options
+ * @data: options to set (can be NULL in which case defaults are used)
+ */
+static int binderfs_parse_mount_opts(char *data,
+                                     struct binderfs_mount_opts *opts)
+{
+        char *p;
+        opts->max = BINDERFS_MAX_MINOR;
+
+        while ((p = strsep(&data, ",")) != NULL) {
+                substring_t args[MAX_OPT_ARGS];
+                int token;
+                int max_devices;
+
+                if (!*p)
+                        continue;
+
+                token = match_token(p, tokens, args);
+                switch (token) {
+                case Opt_max:
+                        if (match_int(&args[0], &max_devices) ||
+                            (max_devices < 0 ||
+                             (max_devices > BINDERFS_MAX_MINOR)))
+                                return -EINVAL;
+
+                        opts->max = max_devices;
+                        break;
+                default:
+                        pr_err("Invalid mount options\n");
+                        return -EINVAL;
+                }
+        }
+
+        return 0;
+}
+
+static int binderfs_remount(struct super_block *sb, int *flags, char *data)
+{
+        struct binderfs_info *info = sb->s_fs_info;
+        return binderfs_parse_mount_opts(data, &info->mount_opts);
+}
+
+static int binderfs_show_mount_opts(struct seq_file *seq, struct dentry *root)
+{
+        struct binderfs_info *info;
+
+        info = root->d_sb->s_fs_info;
+        if (info->mount_opts.max <= BINDERFS_MAX_MINOR)
+                seq_printf(seq, ",max=%d", info->mount_opts.max);
+
+        return 0;
+}
+
 static const struct super_operations binderfs_super_ops = {
-        .statfs = simple_statfs,
-        .evict_inode = binderfs_evict_inode,
+        .evict_inode    = binderfs_evict_inode,
+        .remount_fs     = binderfs_remount,
+        .show_options   = binderfs_show_mount_opts,
+        .statfs         = simple_statfs,
 };
 
+static inline bool is_binderfs_control_device(const struct dentry *dentry)
+{
+        struct binderfs_info *info = dentry->d_sb->s_fs_info;
+        return info->control_dentry == dentry;
+}
+
 static int binderfs_rename(struct inode *old_dir, struct dentry *old_dentry,
                            struct inode *new_dir, struct dentry *new_dentry,
                            unsigned int flags)
 {
-        struct inode *inode = d_inode(old_dentry);
-
-        /* binderfs doesn't support directories. */
-        if (d_is_dir(old_dentry))
+        if (is_binderfs_control_device(old_dentry) ||
+            is_binderfs_control_device(new_dentry))
                 return -EPERM;
 
-        if (flags & ~RENAME_NOREPLACE)
-                return -EINVAL;
-
-        if (!simple_empty(new_dentry))
-                return -ENOTEMPTY;
-
-        if (d_really_is_positive(new_dentry))
-                simple_unlink(new_dir, new_dentry);
-
-        old_dir->i_ctime = old_dir->i_mtime = new_dir->i_ctime =
-                new_dir->i_mtime = inode->i_ctime = current_time(old_dir);
-
-        return 0;
+        return simple_rename(old_dir, old_dentry, new_dir, new_dentry, flags);
 }
 
 static int binderfs_unlink(struct inode *dir, struct dentry *dentry)
 {
-        /*
-         * The control dentry is only ever touched during mount so checking it
-         * here should not require us to take lock.
-         */
-        if (BINDERFS_I(dir)->control_dentry == dentry)
+        if (is_binderfs_control_device(dentry))
                 return -EPERM;
 
         return simple_unlink(dir, dentry);
@@ -313,13 +395,16 @@ static int binderfs_binder_ctl_create(struct super_block *sb)
         struct inode *inode = NULL;
         struct dentry *root = sb->s_root;
         struct binderfs_info *info = sb->s_fs_info;
+#if defined(CONFIG_IPC_NS)
+        bool use_reserve = (info->ipc_ns == &init_ipc_ns);
+#else
+        bool use_reserve = true;
+#endif
 
         device = kzalloc(sizeof(*device), GFP_KERNEL);
         if (!device)
                 return -ENOMEM;
 
-        inode_lock(d_inode(root));
-
         /* If we have already created a binder-control node, return. */
         if (info->control_dentry) {
                 ret = 0;
@@ -333,7 +418,10 @@ static int binderfs_binder_ctl_create(struct super_block *sb)
 
         /* Reserve a new minor number for the new device. */
         mutex_lock(&binderfs_minors_mutex);
-        minor = ida_alloc_max(&binderfs_minors, BINDERFS_MAX_MINOR, GFP_KERNEL);
+        minor = ida_alloc_max(&binderfs_minors,
+                              use_reserve ? BINDERFS_MAX_MINOR :
+                                            BINDERFS_MAX_MINOR_CAPPED,
+                              GFP_KERNEL);
         mutex_unlock(&binderfs_minors_mutex);
         if (minor < 0) {
                 ret = minor;
@@ -358,12 +446,10 @@ static int binderfs_binder_ctl_create(struct super_block *sb)
         inode->i_private = device;
         info->control_dentry = dentry;
         d_add(dentry, inode);
-        inode_unlock(d_inode(root));
 
         return 0;
 
 out:
-        inode_unlock(d_inode(root));
         kfree(device);
         iput(inode);
 
@@ -378,12 +464,9 @@ static const struct inode_operations binderfs_dir_inode_operations = {
 
 static int binderfs_fill_super(struct super_block *sb, void *data, int silent)
 {
+        int ret;
         struct binderfs_info *info;
-        int ret = -ENOMEM;
         struct inode *inode = NULL;
-        struct ipc_namespace *ipc_ns = sb->s_fs_info;
-
-        get_ipc_ns(ipc_ns);
 
         sb->s_blocksize = PAGE_SIZE;
         sb->s_blocksize_bits = PAGE_SHIFT;
@@ -405,11 +488,17 @@ static int binderfs_fill_super(struct super_block *sb, void *data, int silent)
         sb->s_op = &binderfs_super_ops;
         sb->s_time_gran = 1;
 
-        info = kzalloc(sizeof(struct binderfs_info), GFP_KERNEL);
-        if (!info)
-                goto err_without_dentry;
+        sb->s_fs_info = kzalloc(sizeof(struct binderfs_info), GFP_KERNEL);
+        if (!sb->s_fs_info)
+                return -ENOMEM;
+        info = sb->s_fs_info;
+
+        info->ipc_ns = get_ipc_ns(current->nsproxy->ipc_ns);
+
+        ret = binderfs_parse_mount_opts(data, &info->mount_opts);
+        if (ret)
+                return ret;
 
-        info->ipc_ns = ipc_ns;
         info->root_gid = make_kgid(sb->s_user_ns, 0);
         if (!gid_valid(info->root_gid))
                 info->root_gid = GLOBAL_ROOT_GID;
@@ -417,11 +506,9 @@ static int binderfs_fill_super(struct super_block *sb, void *data, int silent)
         if (!uid_valid(info->root_uid))
                 info->root_uid = GLOBAL_ROOT_UID;
 
-        sb->s_fs_info = info;
-
         inode = new_inode(sb);
         if (!inode)
-                goto err_without_dentry;
+                return -ENOMEM;
 
         inode->i_ino = FIRST_INODE;
         inode->i_fop = &simple_dir_operations;
@@ -432,79 +519,28 @@ static int binderfs_fill_super(struct super_block *sb, void *data, int silent)
 
         sb->s_root = d_make_root(inode);
         if (!sb->s_root)
-                goto err_without_dentry;
-
-        ret = binderfs_binder_ctl_create(sb);
-        if (ret)
-                goto err_with_dentry;
-
-        return 0;
-
-err_with_dentry:
-        dput(sb->s_root);
-        sb->s_root = NULL;
-
-err_without_dentry:
-        put_ipc_ns(ipc_ns);
-        iput(inode);
-        kfree(info);
-
-        return ret;
-}
-
-static int binderfs_test_super(struct super_block *sb, void *data)
-{
-        struct binderfs_info *info = sb->s_fs_info;
-
-        if (info)
-                return info->ipc_ns == data;
-
-        return 0;
-}
+                return -ENOMEM;
 
-static int binderfs_set_super(struct super_block *sb, void *data)
-{
-        sb->s_fs_info = data;
-        return set_anon_super(sb, NULL);
+        return binderfs_binder_ctl_create(sb);
 }
 
 static struct dentry *binderfs_mount(struct file_system_type *fs_type,
                                      int flags, const char *dev_name,
                                      void *data)
 {
-        struct super_block *sb;
-        struct ipc_namespace *ipc_ns = current->nsproxy->ipc_ns;
-
-        if (!ns_capable(ipc_ns->user_ns, CAP_SYS_ADMIN))
-                return ERR_PTR(-EPERM);
-
-        sb = sget_userns(fs_type, binderfs_test_super, binderfs_set_super,
-                         flags, ipc_ns->user_ns, ipc_ns);
-        if (IS_ERR(sb))
-                return ERR_CAST(sb);
-
-        if (!sb->s_root) {
-                int ret = binderfs_fill_super(sb, data, flags & SB_SILENT ? 1 : 0);
-                if (ret) {
-                        deactivate_locked_super(sb);
-                        return ERR_PTR(ret);
-                }
-
-                sb->s_flags |= SB_ACTIVE;
-        }
-
-        return dget(sb->s_root);
+        return mount_nodev(fs_type, flags, data, binderfs_fill_super);
 }
 
 static void binderfs_kill_super(struct super_block *sb)
 {
         struct binderfs_info *info = sb->s_fs_info;
 
+        kill_litter_super(sb);
+
         if (info && info->ipc_ns)
                 put_ipc_ns(info->ipc_ns);
 
         kfree(info);
-        kill_litter_super(sb);
 }
 
 static struct file_system_type binder_fs_type = {
@@ -514,7 +550,7 @@ static struct file_system_type binder_fs_type = {
         .fs_flags       = FS_USERNS_MOUNT,
 };
 
-static int __init init_binderfs(void)
+int __init init_binderfs(void)
 {
         int ret;
 
@@ -530,15 +566,5 @@ static int __init init_binderfs(void)
                 return ret;
         }
 
-        binderfs_mnt = kern_mount(&binder_fs_type);
-        if (IS_ERR(binderfs_mnt)) {
-                ret = PTR_ERR(binderfs_mnt);
-                binderfs_mnt = NULL;
-                unregister_filesystem(&binder_fs_type);
-                unregister_chrdev_region(binderfs_dev, BINDERFS_MAX_MINOR);
-        }
-
         return ret;
 }
-
-device_initcall(init_binderfs);
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index b8c3f9e6af89..adf28788cab5 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -4554,6 +4554,7 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
         { "SAMSUNG MZMPC128HBFU-000MV", "CXM14M1Q", ATA_HORKAGE_NOLPM, },
         { "SAMSUNG SSD PM830 mSATA *",  "CXM13D1Q", ATA_HORKAGE_NOLPM, },
         { "SAMSUNG MZ7TD256HAFV-000L9", NULL,       ATA_HORKAGE_NOLPM, },
+        { "SAMSUNG MZ7TE512HMHP-000L1", "EXT06L0Q", ATA_HORKAGE_NOLPM, },
 
         /* devices that don't properly handle queued TRIM commands */
         { "Micron_M500IT_*",            "MU01", ATA_HORKAGE_NO_NCQ_TRIM |
diff --git a/drivers/ata/pata_macio.c b/drivers/ata/pata_macio.c
index 8cc9c429ad95..9e7fc302430f 100644
--- a/drivers/ata/pata_macio.c
+++ b/drivers/ata/pata_macio.c
@@ -915,6 +915,10 @@ static struct scsi_host_template pata_macio_sht = {
         .sg_tablesize           = MAX_DCMDS,
         /* We may not need that strict one */
         .dma_boundary           = ATA_DMA_BOUNDARY,
+        /* Not sure what the real max is but we know it's less than 64K, let's
+         * use 64K minus 256
+         */
+        .max_segment_size       = MAX_DBDMA_SEG,
         .slave_configure        = pata_macio_slave_config,
 };
 
@@ -1044,11 +1048,6 @@ static int pata_macio_common_init(struct pata_macio_priv *priv,
         /* Make sure we have sane initial timings in the cache */
         pata_macio_default_timings(priv);
 
-        /* Not sure what the real max is but we know it's less than 64K, let's
-         * use 64K minus 256
-         */
-        dma_set_max_seg_size(priv->dev, MAX_DBDMA_SEG);
-
         /* Allocate libata host for 1 port */
         memset(&pinfo, 0, sizeof(struct ata_port_info));
         pmac_macio_calc_timing_masks(priv, &pinfo);
diff --git a/drivers/ata/sata_inic162x.c b/drivers/ata/sata_inic162x.c
index e0bcf9b2dab0..174e84ce4379 100644
--- a/drivers/ata/sata_inic162x.c
+++ b/drivers/ata/sata_inic162x.c
@@ -245,8 +245,15 @@ struct inic_port_priv {
 
 static struct scsi_host_template inic_sht = {
         ATA_BASE_SHT(DRV_NAME),
-        .sg_tablesize   = LIBATA_MAX_PRD,       /* maybe it can be larger? */
-        .dma_boundary   = INIC_DMA_BOUNDARY,
+        .sg_tablesize           = LIBATA_MAX_PRD, /* maybe it can be larger? */
+
+        /*
+         * This controller is braindamaged.  dma_boundary is 0xffff like others
+         * but it will lock up the whole machine HARD if 65536 byte PRD entry
+         * is fed.  Reduce maximum segment size.
+         */
+        .dma_boundary           = INIC_DMA_BOUNDARY,
+        .max_segment_size       = 65536 - 512,
 };
 
 static const int scr_map[] = {
@@ -868,17 +875,6 @@ static int inic_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
                 return rc;
         }
 
-        /*
-         * This controller is braindamaged.  dma_boundary is 0xffff
-         * like others but it will lock up the whole machine HARD if
-         * 65536 byte PRD entry is fed. Reduce maximum segment size.
-         */
-        rc = dma_set_max_seg_size(&pdev->dev, 65536 - 512);
-        if (rc) {
-                dev_err(&pdev->dev, "failed to set the maximum segment size\n");
-                return rc;
-        }
-
         rc = init_controller(hpriv->mmio_base, hpriv->cached_hctl);
         if (rc) {
                 dev_err(&pdev->dev, "failed to initialize controller\n");
diff --git a/drivers/base/cacheinfo.c b/drivers/base/cacheinfo.c
index cf78fa6d470d..a7359535caf5 100644
--- a/drivers/base/cacheinfo.c
+++ b/drivers/base/cacheinfo.c
@@ -79,8 +79,7 @@ static void cache_size(struct cacheinfo *this_leaf, struct device_node *np)
         ct_idx = get_cacheinfo_idx(this_leaf->type);
         propname = cache_type_info[ct_idx].size_prop;
 
-        if (of_property_read_u32(np, propname, &this_leaf->size))
-                this_leaf->size = 0;
+        of_property_read_u32(np, propname, &this_leaf->size);
 }
 
 /* not cache_line_size() because that's a macro in include/linux/cache.h */
@@ -114,8 +113,7 @@ static void cache_nr_sets(struct cacheinfo *this_leaf, struct device_node *np)
         ct_idx = get_cacheinfo_idx(this_leaf->type);
         propname = cache_type_info[ct_idx].nr_sets_prop;
 
-        if (of_property_read_u32(np, propname, &this_leaf->number_of_sets))
-                this_leaf->number_of_sets = 0;
+        of_property_read_u32(np, propname, &this_leaf->number_of_sets);
 }
 
 static void cache_associativity(struct cacheinfo *this_leaf)
diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c
index 457be03b744d..0ea2139c50d8 100644
--- a/drivers/base/power/runtime.c
+++ b/drivers/base/power/runtime.c
@@ -130,7 +130,7 @@ u64 pm_runtime_autosuspend_expiration(struct device *dev)
 {
         int autosuspend_delay;
         u64 last_busy, expires = 0;
-        u64 now = ktime_to_ns(ktime_get());
+        u64 now = ktime_get_mono_fast_ns();
 
         if (!dev->power.use_autosuspend)
                 goto out;
@@ -909,7 +909,7 @@ static enum hrtimer_restart  pm_suspend_timer_fn(struct hrtimer *timer)
          * If 'expires' is after the current time, we've been called
          * too early.
          */
-        if (expires > 0 && expires < ktime_to_ns(ktime_get())) {
+        if (expires > 0 && expires < ktime_get_mono_fast_ns()) {
                 dev->power.timer_expires = 0;
                 rpm_suspend(dev, dev->power.timer_autosuspends ?
                     (RPM_ASYNC | RPM_AUTO) : RPM_ASYNC);
@@ -928,7 +928,7 @@ static enum hrtimer_restart  pm_suspend_timer_fn(struct hrtimer *timer)
 int pm_schedule_suspend(struct device *dev, unsigned int delay)
 {
         unsigned long flags;
-        ktime_t expires;
+        u64 expires;
         int retval;
 
         spin_lock_irqsave(&dev->power.lock, flags);
@@ -945,8 +945,8 @@ int pm_schedule_suspend(struct device *dev, unsigned int delay)
         /* Other scheduled or pending requests need to be canceled. */
         pm_runtime_cancel_pending(dev);
 
-        expires = ktime_add(ktime_get(), ms_to_ktime(delay));
-        dev->power.timer_expires = ktime_to_ns(expires);
+        expires = ktime_get_mono_fast_ns() + (u64)delay * NSEC_PER_MSEC;
+        dev->power.timer_expires = expires;
         dev->power.timer_autosuspends = 0;
         hrtimer_start(&dev->power.suspend_timer, expires, HRTIMER_MODE_ABS);
 
diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
index a74ce885b541..c518659b4d9f 100644
--- a/drivers/char/ipmi/ipmi_msghandler.c
+++ b/drivers/char/ipmi/ipmi_msghandler.c
@@ -32,6 +32,7 @@
 #include <linux/moduleparam.h>
 #include <linux/workqueue.h>
 #include <linux/uuid.h>
+#include <linux/nospec.h>
 
 #define IPMI_DRIVER_VERSION "39.2"
 
@@ -62,7 +63,8 @@ static void ipmi_debug_msg(const char *title, unsigned char *data,
 { }
 #endif
 
-static int initialized;
+static bool initialized;
+static bool drvregistered;
 
 enum ipmi_panic_event_op {
         IPMI_SEND_PANIC_EVENT_NONE,
@@ -612,7 +614,7 @@ static DEFINE_MUTEX(ipmidriver_mutex);
 
 static LIST_HEAD(ipmi_interfaces);
 static DEFINE_MUTEX(ipmi_interfaces_mutex);
-DEFINE_STATIC_SRCU(ipmi_interfaces_srcu);
+struct srcu_struct ipmi_interfaces_srcu;
 
 /*
  * List of watchers that want to know when smi's are added and deleted.
@@ -720,7 +722,15 @@ struct watcher_entry {
 int ipmi_smi_watcher_register(struct ipmi_smi_watcher *watcher)
 {
         struct ipmi_smi *intf;
-        int index;
+        int index, rv;
+
+        /*
+         * Make sure the driver is actually initialized, this handles
+         * problems with initialization order.
+         */
+        rv = ipmi_init_msghandler();
+        if (rv)
+                return rv;
 
         mutex_lock(&smi_watchers_mutex);
 
@@ -884,7 +894,7 @@ static int deliver_response(struct ipmi_smi *intf, struct ipmi_recv_msg *msg)
 
                 if (user) {
                         user->handler->ipmi_recv_hndl(msg, user->handler_data);
-                        release_ipmi_user(msg->user, index);
+                        release_ipmi_user(user, index);
                 } else {
                         /* User went away, give up. */
                         ipmi_free_recv_msg(msg);
@@ -1076,7 +1086,7 @@ int ipmi_create_user(unsigned int          if_num,
 {
         unsigned long flags;
         struct ipmi_user *new_user;
-        int           rv = 0, index;
+        int           rv, index;
         struct ipmi_smi *intf;
 
         /*
@@ -1094,18 +1104,9 @@ int ipmi_create_user(unsigned int          if_num,
          * Make sure the driver is actually initialized, this handles
          * problems with initialization order.
          */
-        if (!initialized) {
-                rv = ipmi_init_msghandler();
-                if (rv)
-                        return rv;
-
-                /*
-                 * The init code doesn't return an error if it was turned
-                 * off, but it won't initialize.  Check that.
-                 */
-                if (!initialized)
-                        return -ENODEV;
-        }
+        rv = ipmi_init_msghandler();
+        if (rv)
+                return rv;
 
         new_user = kmalloc(sizeof(*new_user), GFP_KERNEL);
         if (!new_user)
@@ -1183,6 +1184,7 @@ EXPORT_SYMBOL(ipmi_get_smi_info);
 static void free_user(struct kref *ref)
 {
         struct ipmi_user *user = container_of(ref, struct ipmi_user, refcount);
+        cleanup_srcu_struct(&user->release_barrier);
         kfree(user);
 }
 
@@ -1259,7 +1261,6 @@ int ipmi_destroy_user(struct ipmi_user *user)
 {
         _ipmi_destroy_user(user);
 
-        cleanup_srcu_struct(&user->release_barrier);
         kref_put(&user->refcount, free_user);
 
         return 0;
@@ -1298,10 +1299,12 @@ int ipmi_set_my_address(struct ipmi_user *user,
         if (!user)
                 return -ENODEV;
 
-        if (channel >= IPMI_MAX_CHANNELS)
+        if (channel >= IPMI_MAX_CHANNELS) {
                 rv = -EINVAL;
-        else
+        } else {
+                channel = array_index_nospec(channel, IPMI_MAX_CHANNELS);
                 user->intf->addrinfo[channel].address = address;
+        }
         release_ipmi_user(user, index);
 
         return rv;
@@ -1318,10 +1321,12 @@ int ipmi_get_my_address(struct ipmi_user *user,
         if (!user)
                 return -ENODEV;
 
-        if (channel >= IPMI_MAX_CHANNELS)
+        if (channel >= IPMI_MAX_CHANNELS) {
                 rv = -EINVAL;
-        else
+        } else {
+                channel = array_index_nospec(channel, IPMI_MAX_CHANNELS);
                 *address = user->intf->addrinfo[channel].address;
+        }
         release_ipmi_user(user, index);
 
         return rv;
@@ -1338,10 +1343,12 @@ int ipmi_set_my_LUN(struct ipmi_user *user,
         if (!user)
                 return -ENODEV;
 
-        if (channel >= IPMI_MAX_CHANNELS)
+        if (channel >= IPMI_MAX_CHANNELS) {
                 rv = -EINVAL;
-        else
+        } else {
+                channel = array_index_nospec(channel, IPMI_MAX_CHANNELS);
                 user->intf->addrinfo[channel].lun = LUN & 0x3;
+        }
         release_ipmi_user(user, index);
 
         return rv;
@@ -1358,10 +1365,12 @@ int ipmi_get_my_LUN(struct ipmi_user *user,
         if (!user)
                 return -ENODEV;
 
-        if (channel >= IPMI_MAX_CHANNELS)
+        if (channel >= IPMI_MAX_CHANNELS) {
                 rv = -EINVAL;
-        else
+        } else {
+                channel = array_index_nospec(channel, IPMI_MAX_CHANNELS);
                 *address = user->intf->addrinfo[channel].lun;
+        }
         release_ipmi_user(user, index);
 
         return rv;
@@ -2184,6 +2193,7 @@ static int check_addr(struct ipmi_smi  *intf,
 {
         if (addr->channel >= IPMI_MAX_CHANNELS)
                 return -EINVAL;
+        addr->channel = array_index_nospec(addr->channel, IPMI_MAX_CHANNELS);
         *lun = intf->addrinfo[addr->channel].lun;
         *saddr = intf->addrinfo[addr->channel].address;
         return 0;
@@ -3291,17 +3301,9 @@ int ipmi_register_smi(const struct ipmi_smi_handlers *handlers,
          * Make sure the driver is actually initialized, this handles
          * problems with initialization order.
          */
-        if (!initialized) {
-                rv = ipmi_init_msghandler();
-                if (rv)
-                        return rv;
-                /*
-                 * The init code doesn't return an error if it was turned
-                 * off, but it won't initialize.  Check that.
-                 */
-                if (!initialized)
-                        return -ENODEV;
-        }
+        rv = ipmi_init_msghandler();
+        if (rv)
+                return rv;
 
         intf = kzalloc(sizeof(*intf), GFP_KERNEL);
         if (!intf)
@@ -5017,6 +5019,22 @@ static int panic_event(struct notifier_block *this,
         return NOTIFY_DONE;
 }
 
+/* Must be called with ipmi_interfaces_mutex held. */
+static int ipmi_register_driver(void)
+{
+        int rv;
+
+        if (drvregistered)
+                return 0;
+
+        rv = driver_register(&ipmidriver.driver);
+        if (rv)
+                pr_err("Could not register IPMI driver\n");
+        else
+                drvregistered = true;
+        return rv;
+}
+
 static struct notifier_block panic_block = {
         .notifier_call  = panic_event,
         .next           = NULL,
@@ -5027,66 +5045,75 @@ static int ipmi_init_msghandler(void)
 {
         int rv;
 
+        mutex_lock(&ipmi_interfaces_mutex);
+        rv = ipmi_register_driver();
+        if (rv)
+                goto out;
         if (initialized)
-                return 0;
-
-        rv = driver_register(&ipmidriver.driver);
-        if (rv) {
-                pr_err("Could not register IPMI driver\n");
-                return rv;
-        }
+                goto out;
 
-        pr_info("version " IPMI_DRIVER_VERSION "\n");
+        init_srcu_struct(&ipmi_interfaces_srcu);
 
         timer_setup(&ipmi_timer, ipmi_timeout, 0);
         mod_timer(&ipmi_timer, jiffies + IPMI_TIMEOUT_JIFFIES);
 
         atomic_notifier_chain_register(&panic_notifier_list, &panic_block);
 
-        initialized = 1;
+        initialized = true;
 
-        return 0;
+out:
+        mutex_unlock(&ipmi_interfaces_mutex);
+        return rv;
 }
 
 static int __init ipmi_init_msghandler_mod(void)
 {
-        ipmi_init_msghandler();
-        return 0;
+        int rv;
+
+        pr_info("version " IPMI_DRIVER_VERSION "\n");
+
+        mutex_lock(&ipmi_interfaces_mutex);
+        rv = ipmi_register_driver();
+        mutex_unlock(&ipmi_interfaces_mutex);
+
+        return rv;
 }
 
 static void __exit cleanup_ipmi(void)
 {
         int count;
 
-        if (!initialized)
-                return;
-
-        atomic_notifier_chain_unregister(&panic_notifier_list, &panic_block);
+        if (initialized) {
+                atomic_notifier_chain_unregister(&panic_notifier_list,
+                                                 &panic_block);
 
-        /*
-         * This can't be called if any interfaces exist, so no worry
-         * about shutting down the interfaces.
-         */
+                /*
+                 * This can't be called if any interfaces exist, so no worry
+                 * about shutting down the interfaces.
+                 */
 
-        /*
-         * Tell the timer to stop, then wait for it to stop.  This
-         * avoids problems with race conditions removing the timer
-         * here.
-         */
-        atomic_inc(&stop_operation);
-        del_timer_sync(&ipmi_timer);
+                /*
+                 * Tell the timer to stop, then wait for it to stop.  This
+                 * avoids problems with race conditions removing the timer
+                 * here.
+                 */
+                atomic_inc(&stop_operation);
+                del_timer_sync(&ipmi_timer);
 
-        driver_unregister(&ipmidriver.driver);
+                initialized = false;
 
-        initialized = 0;
+                /* Check for buffer leaks. */
+                count = atomic_read(&smi_msg_inuse_count);
+                if (count != 0)
+                        pr_warn("SMI message count %d at exit\n", count);
+                count = atomic_read(&recv_msg_inuse_count);
+                if (count != 0)
+                        pr_warn("recv message count %d at exit\n", count);
 
-        /* Check for buffer leaks. */
-        count = atomic_read(&smi_msg_inuse_count);
-        if (count != 0)
-                pr_warn("SMI message count %d at exit\n", count);
-        count = atomic_read(&recv_msg_inuse_count);
-        if (count != 0)
-                pr_warn("recv message count %d at exit\n", count);
+                cleanup_srcu_struct(&ipmi_interfaces_srcu);
+        }
+        if (drvregistered)
+                driver_unregister(&ipmidriver.driver);
 }
 module_exit(cleanup_ipmi);
 
diff --git a/drivers/char/ipmi/ipmi_ssif.c b/drivers/char/ipmi/ipmi_ssif.c
index ca9528c4f183..b7a1ae2afaea 100644
--- a/drivers/char/ipmi/ipmi_ssif.c
+++ b/drivers/char/ipmi/ipmi_ssif.c
@@ -632,8 +632,9 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result,
 
                 /* Remove the multi-part read marker. */
                 len -= 2;
+                data += 2;
                 for (i = 0; i < len; i++)
-                        ssif_info->data[i] = data[i+2];
+                        ssif_info->data[i] = data[i];
                 ssif_info->multi_len = len;
                 ssif_info->multi_pos = 1;
 
@@ -661,8 +662,19 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result,
                 }
 
                 blocknum = data[0];
+                len--;
+                data++;
+
+                if (blocknum != 0xff && len != 31) {
+                    /* All blocks but the last must have 31 data bytes. */
+                        result = -EIO;
+                        if (ssif_info->ssif_debug & SSIF_DEBUG_MSG)
+                                pr_info("Received middle message <31\n");
 
-                if (ssif_info->multi_len + len - 1 > IPMI_MAX_MSG_LENGTH) {
+                        goto continue_op;
+                }
+
+                if (ssif_info->multi_len + len > IPMI_MAX_MSG_LENGTH) {
                         /* Received message too big, abort the operation. */
                         result = -E2BIG;
                         if (ssif_info->ssif_debug & SSIF_DEBUG_MSG)
@@ -671,16 +683,14 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result,
                         goto continue_op;
                 }
 
-                /* Remove the blocknum from the data. */
-                len--;
                 for (i = 0; i < len; i++)
-                        ssif_info->data[i + ssif_info->multi_len] = data[i + 1];
+                        ssif_info->data[i + ssif_info->multi_len] = data[i];
                 ssif_info->multi_len += len;
                 if (blocknum == 0xff) {
                         /* End of read */
                         len = ssif_info->multi_len;
                         data = ssif_info->data;
-                } else if (blocknum + 1 != ssif_info->multi_pos) {
+                } else if (blocknum != ssif_info->multi_pos) {
                         /*
                          * Out of sequence block, just abort.  Block
                          * numbers start at zero for the second block,
@@ -707,6 +717,7 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result,
                 }
         }
 
+ continue_op:
         if (result < 0) {
                 ssif_inc_stat(ssif_info, receive_errors);
         } else {
@@ -714,8 +725,6 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result,
                 ssif_inc_stat(ssif_info, received_message_parts);
         }
 
-
- continue_op:
         if (ssif_info->ssif_debug & SSIF_DEBUG_STATE)
                 pr_info("DONE 1: state = %d, result=%d\n",
                         ssif_info->ssif_state, result);
diff --git a/drivers/char/mwave/mwavedd.c b/drivers/char/mwave/mwavedd.c
index b5e3103c1175..e43c876a9223 100644
--- a/drivers/char/mwave/mwavedd.c
+++ b/drivers/char/mwave/mwavedd.c
@@ -59,6 +59,7 @@
 #include <linux/mutex.h>
 #include <linux/delay.h>
 #include <linux/serial_8250.h>
+#include <linux/nospec.h>
 #include "smapi.h"
 #include "mwavedd.h"
 #include "3780i.h"
@@ -289,6 +290,8 @@ static long mwave_ioctl(struct file *file, unsigned int iocmd,
                                                 ipcnum);
                                 return -EINVAL;
                         }
+                        ipcnum = array_index_nospec(ipcnum,
+                                                    ARRAY_SIZE(pDrvData->IPCs));
                         PRINTK_3(TRACE_MWAVE,
                                 "mwavedd::mwave_ioctl IOCTL_MW_REGISTER_IPC"
                                 " ipcnum %x entry usIntCount %x\n",
@@ -317,6 +320,8 @@ static long mwave_ioctl(struct file *file, unsigned int iocmd,
                                                 " Invalid ipcnum %x\n", ipcnum);
                                 return -EINVAL;
                         }
+                        ipcnum = array_index_nospec(ipcnum,
+                                                    ARRAY_SIZE(pDrvData->IPCs));
                         PRINTK_3(TRACE_MWAVE,
                                 "mwavedd::mwave_ioctl IOCTL_MW_GET_IPC"
                                 " ipcnum %x, usIntCount %x\n",
@@ -383,6 +388,8 @@ static long mwave_ioctl(struct file *file, unsigned int iocmd,
                                                 ipcnum);
                                 return -EINVAL;
                         }
+                        ipcnum = array_index_nospec(ipcnum,
+                                                    ARRAY_SIZE(pDrvData->IPCs));
                         mutex_lock(&mwave_mutex);
                         if (pDrvData->IPCs[ipcnum].bIsEnabled == true) {
                                 pDrvData->IPCs[ipcnum].bIsEnabled = false;
diff --git a/drivers/clk/Kconfig b/drivers/clk/Kconfig
index e5b2fe80eab4..d2f0bb5ba47e 100644
--- a/drivers/clk/Kconfig
+++ b/drivers/clk/Kconfig
@@ -293,7 +293,6 @@ config COMMON_CLK_BD718XX
 source "drivers/clk/actions/Kconfig"
 source "drivers/clk/bcm/Kconfig"
 source "drivers/clk/hisilicon/Kconfig"
-source "drivers/clk/imx/Kconfig"
 source "drivers/clk/imgtec/Kconfig"
 source "drivers/clk/imx/Kconfig"
 source "drivers/clk/ingenic/Kconfig"
diff --git a/drivers/clk/clk-versaclock5.c b/drivers/clk/clk-versaclock5.c
index 5b393e711e94..7d16ab0784ec 100644
--- a/drivers/clk/clk-versaclock5.c
+++ b/drivers/clk/clk-versaclock5.c
@@ -262,8 +262,10 @@ static int vc5_mux_set_parent(struct clk_hw *hw, u8 index)
 
                 if (vc5->clk_mux_ins == VC5_MUX_IN_XIN)
                         src = VC5_PRIM_SRC_SHDN_EN_XTAL;
-                if (vc5->clk_mux_ins == VC5_MUX_IN_CLKIN)
+                else if (vc5->clk_mux_ins == VC5_MUX_IN_CLKIN)
                         src = VC5_PRIM_SRC_SHDN_EN_CLKIN;
+                else /* Invalid; should have been caught by vc5_probe() */
+                        return -EINVAL;
         }
 
         return regmap_update_bits(vc5->regmap, VC5_PRIM_SRC_SHDN, mask, src);
diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
index 75d13c0eff12..d2477a5058ac 100644
--- a/drivers/clk/clk.c
+++ b/drivers/clk/clk.c
@@ -1513,9 +1513,19 @@ static int clk_fetch_parent_index(struct clk_core *core,
         if (!parent)
                 return -EINVAL;
 
-        for (i = 0; i < core->num_parents; i++)
-                if (clk_core_get_parent_by_index(core, i) == parent)
+        for (i = 0; i < core->num_parents; i++) {
+                if (core->parents[i] == parent)
+                        return i;
+
+                if (core->parents[i])
+                        continue;
+
+                /* Fallback to comparing globally unique names */
+                if (!strcmp(parent->name, core->parent_names[i])) {
+                        core->parents[i] = parent;
                         return i;
+                }
+        }
 
         return -EINVAL;
 }
@@ -2779,7 +2789,7 @@ static void clk_dump_one(struct seq_file *s, struct clk_core *c, int level)
         seq_printf(s, "\"protect_count\": %d,", c->protect_count);
         seq_printf(s, "\"rate\": %lu,", clk_core_get_rate(c));
         seq_printf(s, "\"accuracy\": %lu,", clk_core_get_accuracy(c));
-        seq_printf(s, "\"phase\": %d", clk_core_get_phase(c));
+        seq_printf(s, "\"phase\": %d,", clk_core_get_phase(c));
         seq_printf(s, "\"duty_cycle\": %u",
                    clk_core_get_scaled_duty_cycle(c, 100000));
 }
diff --git a/drivers/clk/imx/clk-frac-pll.c b/drivers/clk/imx/clk-frac-pll.c
index 0026c3969b1e..76b9eb15604e 100644
--- a/drivers/clk/imx/clk-frac-pll.c
+++ b/drivers/clk/imx/clk-frac-pll.c
@@ -155,13 +155,14 @@ static int clk_pll_set_rate(struct clk_hw *hw, unsigned long rate,
 {
         struct clk_frac_pll *pll = to_clk_frac_pll(hw);
         u32 val, divfi, divff;
-        u64 temp64 = parent_rate;
+        u64 temp64;
         int ret;
 
         parent_rate *= 8;
         rate *= 2;
         divfi = rate / parent_rate;
-        temp64 *= rate - divfi;
+        temp64 = parent_rate * divfi;
+        temp64 = rate - temp64;
         temp64 *= PLL_FRAC_DENOM;
         do_div(temp64, parent_rate);
         divff = temp64;
diff --git a/drivers/clk/imx/clk-imx8qxp-lpcg.c b/drivers/clk/imx/clk-imx8qxp-lpcg.c
index 99c2508de8e5..fb6edf1b8aa2 100644
--- a/drivers/clk/imx/clk-imx8qxp-lpcg.c
+++ b/drivers/clk/imx/clk-imx8qxp-lpcg.c
@@ -169,6 +169,8 @@ static int imx8qxp_lpcg_clk_probe(struct platform_device *pdev)
                 return -ENODEV;
 
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (!res)
+                return -EINVAL;
         base = devm_ioremap(dev, res->start, resource_size(res));
         if (!base)
                 return -ENOMEM;
diff --git a/drivers/clk/mmp/clk-of-mmp2.c b/drivers/clk/mmp/clk-of-mmp2.c
index 61fefc046ec5..d083b860f083 100644
--- a/drivers/clk/mmp/clk-of-mmp2.c
+++ b/drivers/clk/mmp/clk-of-mmp2.c
@@ -53,7 +53,6 @@
 #define APMU_DISP1      0x110
 #define APMU_CCIC0      0x50
 #define APMU_CCIC1      0xf4
-#define APMU_SP         0x68
 #define MPMU_UART_PLL   0x14
 
 struct mmp2_clk_unit {
@@ -210,8 +209,6 @@ static struct mmp_clk_mix_config ccic1_mix_config = {
         .reg_info = DEFINE_MIX_REG_INFO(4, 16, 2, 6, 32),
 };
 
-static DEFINE_SPINLOCK(sp_lock);
-
 static struct mmp_param_mux_clk apmu_mux_clks[] = {
         {MMP2_CLK_DISP0_MUX, "disp0_mux", disp_parent_names, ARRAY_SIZE(disp_parent_names), CLK_SET_RATE_PARENT, APMU_DISP0, 6, 2, 0, &disp0_lock},
         {MMP2_CLK_DISP1_MUX, "disp1_mux", disp_parent_names, ARRAY_SIZE(disp_parent_names), CLK_SET_RATE_PARENT, APMU_DISP1, 6, 2, 0, &disp1_lock},
@@ -242,7 +239,6 @@ static struct mmp_param_gate_clk apmu_gate_clks[] = {
         {MMP2_CLK_CCIC1, "ccic1_clk", "ccic1_mix_clk", CLK_SET_RATE_PARENT, APMU_CCIC1, 0x1b, 0x1b, 0x0, 0, &ccic1_lock},
         {MMP2_CLK_CCIC1_PHY, "ccic1_phy_clk", "ccic1_mix_clk", CLK_SET_RATE_PARENT, APMU_CCIC1, 0x24, 0x24, 0x0, 0, &ccic1_lock},
         {MMP2_CLK_CCIC1_SPHY, "ccic1_sphy_clk", "ccic1_sphy_div", CLK_SET_RATE_PARENT, APMU_CCIC1, 0x300, 0x300, 0x0, 0, &ccic1_lock},
-        {MMP2_CLK_SP, "sp_clk", NULL, CLK_SET_RATE_PARENT, APMU_SP, 0x1b, 0x1b, 0x0, 0, &sp_lock},
 };
 
 static void mmp2_axi_periph_clk_init(struct mmp2_clk_unit *pxa_unit)
diff --git a/drivers/clk/qcom/Kconfig b/drivers/clk/qcom/Kconfig
index 1b1ba54e33dd..1c04575c118f 100644
--- a/drivers/clk/qcom/Kconfig
+++ b/drivers/clk/qcom/Kconfig
@@ -215,6 +215,7 @@ config MSM_MMCC_8996
 
 config MSM_GCC_8998
         tristate "MSM8998 Global Clock Controller"
+        select QCOM_GDSC
         help
           Support for the global clock controller on msm8998 devices.
           Say Y if you want to use peripheral devices such as UART, SPI,
diff --git a/drivers/clk/qcom/gcc-sdm845.c b/drivers/clk/qcom/gcc-sdm845.c
index c782e62dd98b..58fa5c247af1 100644
--- a/drivers/clk/qcom/gcc-sdm845.c
+++ b/drivers/clk/qcom/gcc-sdm845.c
@@ -115,8 +115,8 @@ static const char * const gcc_parent_names_6[] = {
         "core_bi_pll_test_se",
 };
 
-static const char * const gcc_parent_names_7[] = {
-        "bi_tcxo",
+static const char * const gcc_parent_names_7_ao[] = {
+        "bi_tcxo_ao",
         "gpll0",
         "gpll0_out_even",
         "core_bi_pll_test_se",
@@ -128,6 +128,12 @@ static const char * const gcc_parent_names_8[] = {
         "core_bi_pll_test_se",
 };
 
+static const char * const gcc_parent_names_8_ao[] = {
+        "bi_tcxo_ao",
+        "gpll0",
+        "core_bi_pll_test_se",
+};
+
 static const struct parent_map gcc_parent_map_10[] = {
         { P_BI_TCXO, 0 },
         { P_GPLL0_OUT_MAIN, 1 },
@@ -210,7 +216,7 @@ static struct clk_rcg2 gcc_cpuss_ahb_clk_src = {
         .freq_tbl = ftbl_gcc_cpuss_ahb_clk_src,
         .clkr.hw.init = &(struct clk_init_data){
                 .name = "gcc_cpuss_ahb_clk_src",
-                .parent_names = gcc_parent_names_7,
+                .parent_names = gcc_parent_names_7_ao,
                 .num_parents = 4,
                 .ops = &clk_rcg2_ops,
         },
@@ -229,7 +235,7 @@ static struct clk_rcg2 gcc_cpuss_rbcpr_clk_src = {
         .freq_tbl = ftbl_gcc_cpuss_rbcpr_clk_src,
         .clkr.hw.init = &(struct clk_init_data){
                 .name = "gcc_cpuss_rbcpr_clk_src",
-                .parent_names = gcc_parent_names_8,
+                .parent_names = gcc_parent_names_8_ao,
                 .num_parents = 3,
                 .ops = &clk_rcg2_ops,
         },
diff --git a/drivers/clk/socfpga/clk-pll-s10.c b/drivers/clk/socfpga/clk-pll-s10.c
index 2d5d8b43727e..c4d0b6f6abf2 100644
--- a/drivers/clk/socfpga/clk-pll-s10.c
+++ b/drivers/clk/socfpga/clk-pll-s10.c
@@ -43,7 +43,7 @@ static unsigned long clk_pll_recalc_rate(struct clk_hw *hwclk,
         /* Read mdiv and fdiv from the fdbck register */
         reg = readl(socfpgaclk->hw.reg + 0x4);
         mdiv = (reg & SOCFPGA_PLL_MDIV_MASK) >> SOCFPGA_PLL_MDIV_SHIFT;
-        vco_freq = (unsigned long long)parent_rate * (mdiv + 6);
+        vco_freq = (unsigned long long)vco_freq * (mdiv + 6);
 
         return (unsigned long)vco_freq;
 }
diff --git a/drivers/clk/socfpga/clk-s10.c b/drivers/clk/socfpga/clk-s10.c
index 5b238fc314ac..8281dfbf38c2 100644
--- a/drivers/clk/socfpga/clk-s10.c
+++ b/drivers/clk/socfpga/clk-s10.c
@@ -12,17 +12,17 @@
 
 #include "stratix10-clk.h"
 
-static const char * const pll_mux[] = { "osc1", "cb_intosc_hs_div2_clk",
-                                        "f2s_free_clk",};
+static const char * const pll_mux[] = { "osc1", "cb-intosc-hs-div2-clk",
+                                        "f2s-free-clk",};
 static const char * const cntr_mux[] = { "main_pll", "periph_pll",
-                                         "osc1", "cb_intosc_hs_div2_clk",
-                                         "f2s_free_clk"};
-static const char * const boot_mux[] = { "osc1", "cb_intosc_hs_div2_clk",};
+                                         "osc1", "cb-intosc-hs-div2-clk",
+                                         "f2s-free-clk"};
+static const char * const boot_mux[] = { "osc1", "cb-intosc-hs-div2-clk",};
 
 static const char * const noc_free_mux[] = {"main_noc_base_clk",
                                             "peri_noc_base_clk",
-                                            "osc1", "cb_intosc_hs_div2_clk",
-                                            "f2s_free_clk"};
+                                            "osc1", "cb-intosc-hs-div2-clk",
+                                            "f2s-free-clk"};
 
 static const char * const emaca_free_mux[] = {"peri_emaca_clk", "boot_clk"};
 static const char * const emacb_free_mux[] = {"peri_emacb_clk", "boot_clk"};
@@ -33,14 +33,14 @@ static const char * const s2f_usr1_free_mux[] = {"peri_s2f_usr1_clk", "boot_clk"
 static const char * const psi_ref_free_mux[] = {"peri_psi_ref_clk", "boot_clk"};
 static const char * const mpu_mux[] = { "mpu_free_clk", "boot_clk",};
 
-static const char * const s2f_usr0_mux[] = {"f2s_free_clk", "boot_clk"};
+static const char * const s2f_usr0_mux[] = {"f2s-free-clk", "boot_clk"};
 static const char * const emac_mux[] = {"emaca_free_clk", "emacb_free_clk"};
 static const char * const noc_mux[] = {"noc_free_clk", "boot_clk"};
 
 static const char * const mpu_free_mux[] = {"main_mpu_base_clk",
                                             "peri_mpu_base_clk",
-                                            "osc1", "cb_intosc_hs_div2_clk",
-                                            "f2s_free_clk"};
+                                            "osc1", "cb-intosc-hs-div2-clk",
+                                            "f2s-free-clk"};
 
 /* clocks in AO (always on) controller */
 static const struct stratix10_pll_clock s10_pll_clks[] = {
diff --git a/drivers/clk/tegra/clk-tegra124-dfll-fcpu.c b/drivers/clk/tegra/clk-tegra124-dfll-fcpu.c
index 269d3595758b..edc31bb56674 100644
--- a/drivers/clk/tegra/clk-tegra124-dfll-fcpu.c
+++ b/drivers/clk/tegra/clk-tegra124-dfll-fcpu.c
@@ -133,9 +133,11 @@ static int tegra124_dfll_fcpu_remove(struct platform_device *pdev)
         struct tegra_dfll_soc_data *soc;
 
         soc = tegra_dfll_unregister(pdev);
-        if (IS_ERR(soc))
+        if (IS_ERR(soc)) {
                 dev_err(&pdev->dev, "failed to unregister DFLL: %ld\n",
                         PTR_ERR(soc));
+                return PTR_ERR(soc);
+        }
 
         tegra_cvb_remove_opp_table(soc->dev, soc->cvb, soc->max_freq);
 
diff --git a/drivers/clk/ti/divider.c b/drivers/clk/ti/divider.c
index 8d77090ad94a..0241450f3eb3 100644
--- a/drivers/clk/ti/divider.c
+++ b/drivers/clk/ti/divider.c
@@ -403,8 +403,10 @@ int ti_clk_parse_divider_data(int *div_table, int num_dividers, int max_div,
         num_dividers = i;
 
         tmp = kcalloc(valid_div + 1, sizeof(*tmp), GFP_KERNEL);
-        if (!tmp)
+        if (!tmp) {
+                *table = ERR_PTR(-ENOMEM);
                 return -ENOMEM;
+        }
 
         valid_div = 0;
         *width = 0;
@@ -439,6 +441,7 @@ struct clk_hw *ti_clk_build_component_div(struct ti_clk_divider *setup)
 {
         struct clk_omap_divider *div;
         struct clk_omap_reg *reg;
+        int ret;
 
         if (!setup)
                 return NULL;
@@ -458,6 +461,12 @@ struct clk_hw *ti_clk_build_component_div(struct ti_clk_divider *setup)
                 div->flags |= CLK_DIVIDER_POWER_OF_TWO;
 
         div->table = _get_div_table_from_setup(setup, &div->width);
+        if (IS_ERR(div->table)) {
+                ret = PTR_ERR(div->table);
+                kfree(div);
+                return ERR_PTR(ret);
+        }
+
 
         div->shift = setup->bit_shift;
         div->latch = -EINVAL;
diff --git a/drivers/clk/zynqmp/clkc.c b/drivers/clk/zynqmp/clkc.c
index f65cc0ff76ab..b0908ec62f73 100644
--- a/drivers/clk/zynqmp/clkc.c
+++ b/drivers/clk/zynqmp/clkc.c
@@ -669,8 +669,8 @@ static int zynqmp_clk_setup(struct device_node *np)
         if (ret)
                 return ret;
 
-        zynqmp_data = kzalloc(sizeof(*zynqmp_data) + sizeof(*zynqmp_data) *
-                                                clock_max_idx, GFP_KERNEL);
+        zynqmp_data = kzalloc(struct_size(zynqmp_data, hws, clock_max_idx),
+                              GFP_KERNEL);
         if (!zynqmp_data)
                 return -ENOMEM;
 
diff --git a/drivers/cpuidle/poll_state.c b/drivers/cpuidle/poll_state.c
index b17d153e724f..23a1b27579a5 100644
--- a/drivers/cpuidle/poll_state.c
+++ b/drivers/cpuidle/poll_state.c
@@ -21,7 +21,7 @@ static int __cpuidle poll_idle(struct cpuidle_device *dev,
         local_irq_enable();
         if (!current_set_polling_and_test()) {
                 unsigned int loop_count = 0;
-                u64 limit = TICK_USEC;
+                u64 limit = TICK_NSEC;
                 int i;
 
                 for (i = 1; i < drv->state_count; i++) {
diff --git a/drivers/crypto/cavium/nitrox/nitrox_reqmgr.c b/drivers/crypto/cavium/nitrox/nitrox_reqmgr.c
index fe070d75c842..4c97478d44bd 100644
--- a/drivers/crypto/cavium/nitrox/nitrox_reqmgr.c
+++ b/drivers/crypto/cavium/nitrox/nitrox_reqmgr.c
@@ -537,6 +537,8 @@ static void process_response_list(struct nitrox_cmdq *cmdq)
         struct nitrox_device *ndev = cmdq->ndev;
         struct nitrox_softreq *sr;
         int req_completed = 0, err = 0, budget;
+        completion_t callback;
+        void *cb_arg;
 
         /* check all pending requests */
         budget = atomic_read(&cmdq->pending_count);
@@ -564,13 +566,13 @@ static void process_response_list(struct nitrox_cmdq *cmdq)
                 smp_mb__after_atomic();
                 /* remove from response list */
                 response_list_del(sr, cmdq);
-
                 /* ORH error code */
                 err = READ_ONCE(*sr->resp.orh) & 0xff;
-
-                if (sr->callback)
-                        sr->callback(sr->cb_arg, err);
+                callback = sr->callback;
+                cb_arg = sr->cb_arg;
                 softreq_destroy(sr);
+                if (callback)
+                        callback(cb_arg, err);
 
                 req_completed++;
         }
diff --git a/drivers/dma/at_xdmac.c b/drivers/dma/at_xdmac.c
index 4e557684f792..fe69dccfa0c0 100644
--- a/drivers/dma/at_xdmac.c
+++ b/drivers/dma/at_xdmac.c
@@ -203,6 +203,7 @@ struct at_xdmac_chan {
         u32                             save_cim;
         u32                             save_cnda;
         u32                             save_cndc;
+        u32                             irq_status;
         unsigned long                   status;
         struct tasklet_struct           tasklet;
         struct dma_slave_config         sconfig;
@@ -1580,8 +1581,8 @@ static void at_xdmac_tasklet(unsigned long data)
         struct at_xdmac_desc    *desc;
         u32                     error_mask;
 
-        dev_dbg(chan2dev(&atchan->chan), "%s: status=0x%08lx\n",
-                 __func__, atchan->status);
+        dev_dbg(chan2dev(&atchan->chan), "%s: status=0x%08x\n",
+                __func__, atchan->irq_status);
 
         error_mask = AT_XDMAC_CIS_RBEIS
                      | AT_XDMAC_CIS_WBEIS
@@ -1589,15 +1590,15 @@ static void at_xdmac_tasklet(unsigned long data)
 
         if (at_xdmac_chan_is_cyclic(atchan)) {
                 at_xdmac_handle_cyclic(atchan);
-        } else if ((atchan->status & AT_XDMAC_CIS_LIS)
-                   || (atchan->status & error_mask)) {
+        } else if ((atchan->irq_status & AT_XDMAC_CIS_LIS)
+                   || (atchan->irq_status & error_mask)) {
                 struct dma_async_tx_descriptor  *txd;
 
-                if (atchan->status & AT_XDMAC_CIS_RBEIS)
+                if (atchan->irq_status & AT_XDMAC_CIS_RBEIS)
                         dev_err(chan2dev(&atchan->chan), "read bus error!!!");
-                if (atchan->status & AT_XDMAC_CIS_WBEIS)
+                if (atchan->irq_status & AT_XDMAC_CIS_WBEIS)
                         dev_err(chan2dev(&atchan->chan), "write bus error!!!");
-                if (atchan->status & AT_XDMAC_CIS_ROIS)
+                if (atchan->irq_status & AT_XDMAC_CIS_ROIS)
                         dev_err(chan2dev(&atchan->chan), "request overflow error!!!");
 
                 spin_lock(&atchan->lock);
@@ -1652,7 +1653,7 @@ static irqreturn_t at_xdmac_interrupt(int irq, void *dev_id)
                         atchan = &atxdmac->chan[i];
                         chan_imr = at_xdmac_chan_read(atchan, AT_XDMAC_CIM);
                         chan_status = at_xdmac_chan_read(atchan, AT_XDMAC_CIS);
-                        atchan->status = chan_status & chan_imr;
+                        atchan->irq_status = chan_status & chan_imr;
                         dev_vdbg(atxdmac->dma.dev,
                                  "%s: chan%d: imr=0x%x, status=0x%x\n",
                                  __func__, i, chan_imr, chan_status);
@@ -1666,7 +1667,7 @@ static irqreturn_t at_xdmac_interrupt(int irq, void *dev_id)
                                  at_xdmac_chan_read(atchan, AT_XDMAC_CDA),
                                  at_xdmac_chan_read(atchan, AT_XDMAC_CUBC));
 
-                        if (atchan->status & (AT_XDMAC_CIS_RBEIS | AT_XDMAC_CIS_WBEIS))
+                        if (atchan->irq_status & (AT_XDMAC_CIS_RBEIS | AT_XDMAC_CIS_WBEIS))
                                 at_xdmac_write(atxdmac, AT_XDMAC_GD, atchan->mask);
 
                         tasklet_schedule(&atchan->tasklet);
diff --git a/drivers/dma/bcm2835-dma.c b/drivers/dma/bcm2835-dma.c
index 1a44c8086d77..ae10f5614f95 100644
--- a/drivers/dma/bcm2835-dma.c
+++ b/drivers/dma/bcm2835-dma.c
@@ -406,38 +406,32 @@ static void bcm2835_dma_fill_cb_chain_with_sg(
         }
 }
 
-static int bcm2835_dma_abort(void __iomem *chan_base)
+static int bcm2835_dma_abort(struct bcm2835_chan *c)
 {
-        unsigned long cs;
+        void __iomem *chan_base = c->chan_base;
         long int timeout = 10000;
 
-        cs = readl(chan_base + BCM2835_DMA_CS);
-        if (!(cs & BCM2835_DMA_ACTIVE))
+        /*
+         * A zero control block address means the channel is idle.
+         * (The ACTIVE flag in the CS register is not a reliable indicator.)
+         */
+        if (!readl(chan_base + BCM2835_DMA_ADDR))
                 return 0;
 
         /* Write 0 to the active bit - Pause the DMA */
         writel(0, chan_base + BCM2835_DMA_CS);
 
         /* Wait for any current AXI transfer to complete */
-        while ((cs & BCM2835_DMA_ISPAUSED) && --timeout) {
+        while ((readl(chan_base + BCM2835_DMA_CS) &
+                BCM2835_DMA_WAITING_FOR_WRITES) && --timeout)
                 cpu_relax();
-                cs = readl(chan_base + BCM2835_DMA_CS);
-        }
 
-        /* We'll un-pause when we set of our next DMA */
+        /* Peripheral might be stuck and fail to signal AXI write responses */
         if (!timeout)
-                return -ETIMEDOUT;
-
-        if (!(cs & BCM2835_DMA_ACTIVE))
-                return 0;
-
-        /* Terminate the control block chain */
-        writel(0, chan_base + BCM2835_DMA_NEXTCB);
-
-        /* Abort the whole DMA */
-        writel(BCM2835_DMA_ABORT | BCM2835_DMA_ACTIVE,
-               chan_base + BCM2835_DMA_CS);
+                dev_err(c->vc.chan.device->dev,
+                        "failed to complete outstanding writes\n");
 
+        writel(BCM2835_DMA_RESET, chan_base + BCM2835_DMA_CS);
         return 0;
 }
 
@@ -476,8 +470,15 @@ static irqreturn_t bcm2835_dma_callback(int irq, void *data)
 
         spin_lock_irqsave(&c->vc.lock, flags);
 
-        /* Acknowledge interrupt */
-        writel(BCM2835_DMA_INT, c->chan_base + BCM2835_DMA_CS);
+        /*
+         * Clear the INT flag to receive further interrupts. Keep the channel
+         * active in case the descriptor is cyclic or in case the client has
+         * already terminated the descriptor and issued a new one. (May happen
+         * if this IRQ handler is threaded.) If the channel is finished, it
+         * will remain idle despite the ACTIVE flag being set.
+         */
+        writel(BCM2835_DMA_INT | BCM2835_DMA_ACTIVE,
+               c->chan_base + BCM2835_DMA_CS);
 
         d = c->desc;
 
@@ -485,11 +486,7 @@ static irqreturn_t bcm2835_dma_callback(int irq, void *data)
                 if (d->cyclic) {
                         /* call the cyclic callback */
                         vchan_cyclic_callback(&d->vd);
-
-                        /* Keep the DMA engine running */
-                        writel(BCM2835_DMA_ACTIVE,
-                               c->chan_base + BCM2835_DMA_CS);
-                } else {
+                } else if (!readl(c->chan_base + BCM2835_DMA_ADDR)) {
                         vchan_cookie_complete(&c->desc->vd);
                         bcm2835_dma_start_desc(c);
                 }
@@ -779,7 +776,6 @@ static int bcm2835_dma_terminate_all(struct dma_chan *chan)
         struct bcm2835_chan *c = to_bcm2835_dma_chan(chan);
         struct bcm2835_dmadev *d = to_bcm2835_dma_dev(c->vc.chan.device);
         unsigned long flags;
-        int timeout = 10000;
         LIST_HEAD(head);
 
         spin_lock_irqsave(&c->vc.lock, flags);
@@ -789,27 +785,11 @@ static int bcm2835_dma_terminate_all(struct dma_chan *chan)
         list_del_init(&c->node);
         spin_unlock(&d->lock);
 
-        /*
-         * Stop DMA activity: we assume the callback will not be called
-         * after bcm_dma_abort() returns (even if it does, it will see
-         * c->desc is NULL and exit.)
-         */
+        /* stop DMA activity */
         if (c->desc) {
                 vchan_terminate_vdesc(&c->desc->vd);
                 c->desc = NULL;
-                bcm2835_dma_abort(c->chan_base);
-
-                /* Wait for stopping */
-                while (--timeout) {
-                        if (!(readl(c->chan_base + BCM2835_DMA_CS) &
-                                                BCM2835_DMA_ACTIVE))
-                                break;
-
-                        cpu_relax();
-                }
-
-                if (!timeout)
-                        dev_err(d->ddev.dev, "DMA transfer could not be terminated\n");
+                bcm2835_dma_abort(c);
         }
 
         vchan_get_all_descriptors(&c->vc, &head);
diff --git a/drivers/dma/dmatest.c b/drivers/dma/dmatest.c
index 2eea4ef72915..6511928b4cdf 100644
--- a/drivers/dma/dmatest.c
+++ b/drivers/dma/dmatest.c
@@ -711,11 +711,9 @@ static int dmatest_func(void *data)
                         srcs[i] = um->addr[i] + src_off;
                         ret = dma_mapping_error(dev->dev, um->addr[i]);
                         if (ret) {
-                                dmaengine_unmap_put(um);
                                 result("src mapping error", total_tests,
                                        src_off, dst_off, len, ret);
-                                failed_tests++;
-                                continue;
+                                goto error_unmap_continue;
                         }
                         um->to_cnt++;
                 }
@@ -730,11 +728,9 @@ static int dmatest_func(void *data)
                                                DMA_BIDIRECTIONAL);
                         ret = dma_mapping_error(dev->dev, dsts[i]);
                         if (ret) {
-                                dmaengine_unmap_put(um);
                                 result("dst mapping error", total_tests,
                                        src_off, dst_off, len, ret);
-                                failed_tests++;
-                                continue;
+                                goto error_unmap_continue;
                         }
                         um->bidi_cnt++;
                 }
@@ -762,12 +758,10 @@ static int dmatest_func(void *data)
                 }
 
                 if (!tx) {
-                        dmaengine_unmap_put(um);
                         result("prep error", total_tests, src_off,
                                dst_off, len, ret);
                         msleep(100);
-                        failed_tests++;
-                        continue;
+                        goto error_unmap_continue;
                 }
 
                 done->done = false;
@@ -776,12 +770,10 @@ static int dmatest_func(void *data)
                 cookie = tx->tx_submit(tx);
 
                 if (dma_submit_error(cookie)) {
-                        dmaengine_unmap_put(um);
                         result("submit error", total_tests, src_off,
                                dst_off, len, ret);
                         msleep(100);
-                        failed_tests++;
-                        continue;
+                        goto error_unmap_continue;
                 }
                 dma_async_issue_pending(chan);
 
@@ -790,22 +782,20 @@ static int dmatest_func(void *data)
 
                 status = dma_async_is_tx_complete(chan, cookie, NULL, NULL);
 
-                dmaengine_unmap_put(um);
-
                 if (!done->done) {
                         result("test timed out", total_tests, src_off, dst_off,
                                len, 0);
-                        failed_tests++;
-                        continue;
+                        goto error_unmap_continue;
                 } else if (status != DMA_COMPLETE) {
                         result(status == DMA_ERROR ?
                                "completion error status" :
                                "completion busy status", total_tests, src_off,
                                dst_off, len, ret);
-                        failed_tests++;
-                        continue;
+                        goto error_unmap_continue;
                 }
 
+                dmaengine_unmap_put(um);
+
                 if (params->noverify) {
                         verbose_result("test passed", total_tests, src_off,
                                        dst_off, len, 0);
@@ -846,6 +836,12 @@ static int dmatest_func(void *data)
                         verbose_result("test passed", total_tests, src_off,
                                        dst_off, len, 0);
                 }
+
+                continue;
+
+error_unmap_continue:
+                dmaengine_unmap_put(um);
+                failed_tests++;
         }
         ktime = ktime_sub(ktime_get(), ktime);
         ktime = ktime_sub(ktime, comparetime);
diff --git a/drivers/dma/imx-dma.c b/drivers/dma/imx-dma.c
index c2fff3f6c9ca..4a09af3cd546 100644
--- a/drivers/dma/imx-dma.c
+++ b/drivers/dma/imx-dma.c
@@ -618,7 +618,7 @@ static void imxdma_tasklet(unsigned long data)
 {
         struct imxdma_channel *imxdmac = (void *)data;
         struct imxdma_engine *imxdma = imxdmac->imxdma;
-        struct imxdma_desc *desc;
+        struct imxdma_desc *desc, *next_desc;
         unsigned long flags;
 
         spin_lock_irqsave(&imxdma->lock, flags);
@@ -648,10 +648,10 @@ static void imxdma_tasklet(unsigned long data)
         list_move_tail(imxdmac->ld_active.next, &imxdmac->ld_free);
 
         if (!list_empty(&imxdmac->ld_queue)) {
-                desc = list_first_entry(&imxdmac->ld_queue, struct imxdma_desc,
-                                        node);
+                next_desc = list_first_entry(&imxdmac->ld_queue,
+                                             struct imxdma_desc, node);
                 list_move_tail(imxdmac->ld_queue.next, &imxdmac->ld_active);
-                if (imxdma_xfer_desc(desc) < 0)
+                if (imxdma_xfer_desc(next_desc) < 0)
                         dev_warn(imxdma->dev, "%s: channel: %d couldn't xfer desc\n",
                                  __func__, imxdmac->channel);
         }
diff --git a/drivers/edac/altera_edac.h b/drivers/edac/altera_edac.h
index 4213cb0bb2a7..f8664bac9fa8 100644
--- a/drivers/edac/altera_edac.h
+++ b/drivers/edac/altera_edac.h
@@ -295,8 +295,8 @@ struct altr_sdram_mc_data {
 #define S10_SYSMGR_ECC_INTSTAT_DERR_OFST  0xA0
 
 /* Sticky registers for Uncorrected Errors */
-#define S10_SYSMGR_UE_VAL_OFST            0x120
-#define S10_SYSMGR_UE_ADDR_OFST           0x124
+#define S10_SYSMGR_UE_VAL_OFST            0x220
+#define S10_SYSMGR_UE_ADDR_OFST           0x224
 
 #define S10_DDR0_IRQ_MASK                 BIT(16)
 
diff --git a/drivers/firewire/sbp2.c b/drivers/firewire/sbp2.c
index 09b845e90114..a785ffd5af89 100644
--- a/drivers/firewire/sbp2.c
+++ b/drivers/firewire/sbp2.c
@@ -1144,10 +1144,6 @@ static int sbp2_probe(struct fw_unit *unit, const struct ieee1394_device_id *id)
         if (device->is_local)
                 return -ENODEV;
 
-        if (dma_get_max_seg_size(device->card->device) > SBP2_MAX_SEG_SIZE)
-                WARN_ON(dma_set_max_seg_size(device->card->device,
-                                             SBP2_MAX_SEG_SIZE));
-
         shost = scsi_host_alloc(&scsi_driver_template, sizeof(*tgt));
         if (shost == NULL)
                 return -ENOMEM;
@@ -1610,6 +1606,7 @@ static struct scsi_host_template scsi_driver_template = {
         .eh_abort_handler       = sbp2_scsi_abort,
         .this_id                = -1,
         .sg_tablesize           = SG_ALL,
+        .max_segment_size       = SBP2_MAX_SEG_SIZE,
         .can_queue              = 1,
         .sdev_attrs             = sbp2_scsi_sysfs_attrs,
 };
diff --git a/drivers/firmware/arm_scmi/bus.c b/drivers/firmware/arm_scmi/bus.c
index 472c88ae1c0f..92f843eaf1e0 100644
--- a/drivers/firmware/arm_scmi/bus.c
+++ b/drivers/firmware/arm_scmi/bus.c
@@ -119,6 +119,11 @@ void scmi_driver_unregister(struct scmi_driver *driver)
 }
 EXPORT_SYMBOL_GPL(scmi_driver_unregister);
 
+static void scmi_device_release(struct device *dev)
+{
+        kfree(to_scmi_dev(dev));
+}
+
 struct scmi_device *
 scmi_device_create(struct device_node *np, struct device *parent, int protocol)
 {
@@ -138,6 +143,7 @@ scmi_device_create(struct device_node *np, struct device *parent, int protocol)
         scmi_dev->dev.parent = parent;
         scmi_dev->dev.of_node = np;
         scmi_dev->dev.bus = &scmi_bus_type;
+        scmi_dev->dev.release = scmi_device_release;
         dev_set_name(&scmi_dev->dev, "scmi_dev.%d", id);
 
         retval = device_register(&scmi_dev->dev);
@@ -156,9 +162,8 @@ free_mem:
 void scmi_device_destroy(struct scmi_device *scmi_dev)
 {
         scmi_handle_put(scmi_dev->handle);
-        device_unregister(&scmi_dev->dev);
         ida_simple_remove(&scmi_bus_id, scmi_dev->id);
-        kfree(scmi_dev);
+        device_unregister(&scmi_dev->dev);
 }
 
 void scmi_set_handle(struct scmi_device *scmi_dev)
diff --git a/drivers/firmware/efi/arm-runtime.c b/drivers/firmware/efi/arm-runtime.c
index 23ea1ed409d1..352bd2473162 100644
--- a/drivers/firmware/efi/arm-runtime.c
+++ b/drivers/firmware/efi/arm-runtime.c
@@ -37,8 +37,9 @@ extern u64 efi_system_table;
 static struct ptdump_info efi_ptdump_info = {
         .mm             = &efi_mm,
         .markers        = (struct addr_marker[]){
-                { 0,            "UEFI runtime start" },
-                { DEFAULT_MAP_WINDOW_64, "UEFI runtime end" }
+                { 0,                            "UEFI runtime start" },
+                { DEFAULT_MAP_WINDOW_64,        "UEFI runtime end" },
+                { -1,                           NULL }
         },
         .base_addr      = 0,
 };
diff --git a/drivers/fpga/stratix10-soc.c b/drivers/fpga/stratix10-soc.c
index a1a09e04fab8..13851b3d1c56 100644
--- a/drivers/fpga/stratix10-soc.c
+++ b/drivers/fpga/stratix10-soc.c
@@ -508,14 +508,11 @@ static int __init s10_init(void)
                 return -ENODEV;
 
         np = of_find_matching_node(fw_np, s10_of_match);
-        if (!np) {
-                of_node_put(fw_np);
+        if (!np)
                 return -ENODEV;
-        }
 
         of_node_put(np);
         ret = of_platform_populate(fw_np, s10_of_match, NULL, NULL);
-        of_node_put(fw_np);
         if (ret)
                 return ret;
 
diff --git a/drivers/gpio/gpio-altera-a10sr.c b/drivers/gpio/gpio-altera-a10sr.c
index 6b11f1314248..7f9e0304b510 100644
--- a/drivers/gpio/gpio-altera-a10sr.c
+++ b/drivers/gpio/gpio-altera-a10sr.c
@@ -66,8 +66,10 @@ static int altr_a10sr_gpio_direction_input(struct gpio_chip *gc,
 static int altr_a10sr_gpio_direction_output(struct gpio_chip *gc,
                                             unsigned int nr, int value)
 {
-        if (nr <= (ALTR_A10SR_OUT_VALID_RANGE_HI - ALTR_A10SR_LED_VALID_SHIFT))
+        if (nr <= (ALTR_A10SR_OUT_VALID_RANGE_HI - ALTR_A10SR_LED_VALID_SHIFT)) {
+                altr_a10sr_gpio_set(gc, nr, value);
                 return 0;
+        }
         return -EINVAL;
 }
 
diff --git a/drivers/gpio/gpio-eic-sprd.c b/drivers/gpio/gpio-eic-sprd.c
index e0d6a0a7bc69..e41223c05f6e 100644
--- a/drivers/gpio/gpio-eic-sprd.c
+++ b/drivers/gpio/gpio-eic-sprd.c
@@ -180,7 +180,18 @@ static void sprd_eic_free(struct gpio_chip *chip, unsigned int offset)
 
 static int sprd_eic_get(struct gpio_chip *chip, unsigned int offset)
 {
-        return sprd_eic_read(chip, offset, SPRD_EIC_DBNC_DATA);
+        struct sprd_eic *sprd_eic = gpiochip_get_data(chip);
+
+        switch (sprd_eic->type) {
+        case SPRD_EIC_DEBOUNCE:
+                return sprd_eic_read(chip, offset, SPRD_EIC_DBNC_DATA);
+        case SPRD_EIC_ASYNC:
+                return sprd_eic_read(chip, offset, SPRD_EIC_ASYNC_DATA);
+        case SPRD_EIC_SYNC:
+                return sprd_eic_read(chip, offset, SPRD_EIC_SYNC_DATA);
+        default:
+                return -ENOTSUPP;
+        }
 }
 
 static int sprd_eic_direction_input(struct gpio_chip *chip, unsigned int offset)
@@ -368,6 +379,7 @@ static int sprd_eic_irq_set_type(struct irq_data *data, unsigned int flow_type)
                         irq_set_handler_locked(data, handle_edge_irq);
                         break;
                 case IRQ_TYPE_EDGE_BOTH:
+                        sprd_eic_update(chip, offset, SPRD_EIC_ASYNC_INTMODE, 0);
                         sprd_eic_update(chip, offset, SPRD_EIC_ASYNC_INTBOTH, 1);
                         irq_set_handler_locked(data, handle_edge_irq);
                         break;
diff --git a/drivers/gpio/gpio-pcf857x.c b/drivers/gpio/gpio-pcf857x.c
index adf72dda25a2..68a35b65925a 100644
--- a/drivers/gpio/gpio-pcf857x.c
+++ b/drivers/gpio/gpio-pcf857x.c
@@ -84,6 +84,7 @@ MODULE_DEVICE_TABLE(of, pcf857x_of_table);
  */
 struct pcf857x {
         struct gpio_chip        chip;
+        struct irq_chip         irqchip;
         struct i2c_client       *client;
         struct mutex            lock;           /* protect 'out' */
         unsigned                out;            /* software latch */
@@ -252,18 +253,6 @@ static void pcf857x_irq_bus_sync_unlock(struct irq_data *data)
         mutex_unlock(&gpio->lock);
 }
 
-static struct irq_chip pcf857x_irq_chip = {
-        .name           = "pcf857x",
-        .irq_enable     = pcf857x_irq_enable,
-        .irq_disable    = pcf857x_irq_disable,
-        .irq_ack        = noop,
-        .irq_mask       = noop,
-        .irq_unmask     = noop,
-        .irq_set_wake   = pcf857x_irq_set_wake,
-        .irq_bus_lock           = pcf857x_irq_bus_lock,
-        .irq_bus_sync_unlock    = pcf857x_irq_bus_sync_unlock,
-};
-
 /*-------------------------------------------------------------------------*/
 
 static int pcf857x_probe(struct i2c_client *client,
@@ -376,8 +365,17 @@ static int pcf857x_probe(struct i2c_client *client,
 
         /* Enable irqchip if we have an interrupt */
         if (client->irq) {
+                gpio->irqchip.name = "pcf857x",
+                gpio->irqchip.irq_enable = pcf857x_irq_enable,
+                gpio->irqchip.irq_disable = pcf857x_irq_disable,
+                gpio->irqchip.irq_ack = noop,
+                gpio->irqchip.irq_mask = noop,
+                gpio->irqchip.irq_unmask = noop,
+                gpio->irqchip.irq_set_wake = pcf857x_irq_set_wake,
+                gpio->irqchip.irq_bus_lock = pcf857x_irq_bus_lock,
+                gpio->irqchip.irq_bus_sync_unlock = pcf857x_irq_bus_sync_unlock,
                 status = gpiochip_irqchip_add_nested(&gpio->chip,
-                                                     &pcf857x_irq_chip,
+                                                     &gpio->irqchip,
                                                      0, handle_level_irq,
                                                      IRQ_TYPE_NONE);
                 if (status) {
@@ -392,7 +390,7 @@ static int pcf857x_probe(struct i2c_client *client,
                 if (status)
                         goto fail;
 
-                gpiochip_set_nested_irqchip(&gpio->chip, &pcf857x_irq_chip,
+                gpiochip_set_nested_irqchip(&gpio->chip, &gpio->irqchip,
                                             client->irq);
                 gpio->irq_parent = client->irq;
         }
diff --git a/drivers/gpio/gpio-vf610.c b/drivers/gpio/gpio-vf610.c
index 1b79ebcfce3e..541fa6ac399d 100644
--- a/drivers/gpio/gpio-vf610.c
+++ b/drivers/gpio/gpio-vf610.c
@@ -253,6 +253,7 @@ static int vf610_gpio_probe(struct platform_device *pdev)
         struct vf610_gpio_port *port;
         struct resource *iores;
         struct gpio_chip *gc;
+        int i;
         int ret;
 
         port = devm_kzalloc(&pdev->dev, sizeof(*port), GFP_KERNEL);
@@ -319,6 +320,10 @@ static int vf610_gpio_probe(struct platform_device *pdev)
         if (ret < 0)
                 return ret;
 
+        /* Mask all GPIO interrupts */
+        for (i = 0; i < gc->ngpio; i++)
+                vf610_gpio_writel(0, port->base + PORT_PCR(i));
+
         /* Clear the interrupt status register for all GPIO's */
         vf610_gpio_writel(~0, port->base + PORT_ISFR);
 
diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index 1651d7f0a303..d1adfdf50fb3 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -828,7 +828,14 @@ static irqreturn_t lineevent_irq_thread(int irq, void *p)
         /* Do not leak kernel stack to userspace */
         memset(&ge, 0, sizeof(ge));
 
-        ge.timestamp = le->timestamp;
+        /*
+         * We may be running from a nested threaded interrupt in which case
+         * we didn't get the timestamp from lineevent_irq_handler().
+         */
+        if (!le->timestamp)
+                ge.timestamp = ktime_get_real_ns();
+        else
+                ge.timestamp = le->timestamp;
 
         if (le->eflags & GPIOEVENT_REQUEST_RISING_EDGE
             && le->eflags & GPIOEVENT_REQUEST_FALLING_EDGE) {
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
index a028661d9e20..92b11de19581 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
@@ -576,6 +576,7 @@ static const struct amdgpu_px_quirk amdgpu_px_quirk_list[] = {
         { 0x1002, 0x6900, 0x1028, 0x0812, AMDGPU_PX_QUIRK_FORCE_ATPX },
         { 0x1002, 0x6900, 0x1028, 0x0813, AMDGPU_PX_QUIRK_FORCE_ATPX },
         { 0x1002, 0x6900, 0x1025, 0x125A, AMDGPU_PX_QUIRK_FORCE_ATPX },
+        { 0x1002, 0x6900, 0x17AA, 0x3806, AMDGPU_PX_QUIRK_FORCE_ATPX },
         { 0, 0, 0, 0, 0 },
 };
 
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
index 6896dec97fc7..0ed41a9d2d77 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
@@ -1686,7 +1686,8 @@ static umode_t hwmon_attributes_visible(struct kobject *kobj,
                 effective_mode &= ~S_IWUSR;
 
         if ((adev->flags & AMD_IS_APU) &&
-            (attr == &sensor_dev_attr_power1_cap_max.dev_attr.attr ||
+            (attr == &sensor_dev_attr_power1_average.dev_attr.attr ||
+             attr == &sensor_dev_attr_power1_cap_max.dev_attr.attr ||
              attr == &sensor_dev_attr_power1_cap_min.dev_attr.attr||
              attr == &sensor_dev_attr_power1_cap.dev_attr.attr))
                 return 0;
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_prime.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_prime.c
index 71913a18d142..a38e0fb4a6fe 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_prime.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_prime.c
@@ -38,6 +38,7 @@
 #include "amdgpu_gem.h"
 #include <drm/amdgpu_drm.h>
 #include <linux/dma-buf.h>
+#include <linux/dma-fence-array.h>
 
 /**
  * amdgpu_gem_prime_get_sg_table - &drm_driver.gem_prime_get_sg_table
@@ -187,6 +188,48 @@ error:
         return ERR_PTR(ret);
 }
 
+static int
+__reservation_object_make_exclusive(struct reservation_object *obj)
+{
+        struct dma_fence **fences;
+        unsigned int count;
+        int r;
+
+        if (!reservation_object_get_list(obj)) /* no shared fences to convert */
+                return 0;
+
+        r = reservation_object_get_fences_rcu(obj, NULL, &count, &fences);
+        if (r)
+                return r;
+
+        if (count == 0) {
+                /* Now that was unexpected. */
+        } else if (count == 1) {
+                reservation_object_add_excl_fence(obj, fences[0]);
+                dma_fence_put(fences[0]);
+                kfree(fences);
+        } else {
+                struct dma_fence_array *array;
+
+                array = dma_fence_array_create(count, fences,
+                                               dma_fence_context_alloc(1), 0,
+                                               false);
+                if (!array)
+                        goto err_fences_put;
+
+                reservation_object_add_excl_fence(obj, &array->base);
+                dma_fence_put(&array->base);
+        }
+
+        return 0;
+
+err_fences_put:
+        while (count--)
+                dma_fence_put(fences[count]);
+        kfree(fences);
+        return -ENOMEM;
+}
+
 /**
  * amdgpu_gem_map_attach - &dma_buf_ops.attach implementation
  * @dma_buf: Shared DMA buffer
@@ -218,16 +261,16 @@ static int amdgpu_gem_map_attach(struct dma_buf *dma_buf,
 
         if (attach->dev->driver != adev->dev->driver) {
                 /*
-                 * Wait for all shared fences to complete before we switch to future
-                 * use of exclusive fence on this prime shared bo.
+                 * We only create shared fences for internal use, but importers
+                 * of the dmabuf rely on exclusive fences for implicitly
+                 * tracking write hazards. As any of the current fences may
+                 * correspond to a write, we need to convert all existing
+                 * fences on the reservation object into a single exclusive
+                 * fence.
                  */
-                r = reservation_object_wait_timeout_rcu(bo->tbo.resv,
-                                                        true, false,
-                                                        MAX_SCHEDULE_TIMEOUT);
-                if (unlikely(r < 0)) {
-                        DRM_DEBUG_PRIME("Fence wait failed: %li\n", r);
+                r = __reservation_object_make_exclusive(bo->tbo.resv);
+                if (r)
                         goto error_unreserve;
-                }
         }
 
         /* pin buffer into GTT */
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
index d2ea5ce2cefb..7c108e687683 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
@@ -3363,14 +3363,15 @@ void amdgpu_vm_get_task_info(struct amdgpu_device *adev, unsigned int pasid,
                          struct amdgpu_task_info *task_info)
 {
         struct amdgpu_vm *vm;
+        unsigned long flags;
 
-        spin_lock(&adev->vm_manager.pasid_lock);
+        spin_lock_irqsave(&adev->vm_manager.pasid_lock, flags);
 
         vm = idr_find(&adev->vm_manager.pasid_idr, pasid);
         if (vm)
                 *task_info = vm->task_info;
 
-        spin_unlock(&adev->vm_manager.pasid_lock);
+        spin_unlock_irqrestore(&adev->vm_manager.pasid_lock, flags);
 }
 
 /**
diff --git a/drivers/gpu/drm/amd/amdgpu/nbio_v7_4.c b/drivers/gpu/drm/amd/amdgpu/nbio_v7_4.c
index 4cd31a276dcd..186db182f924 100644
--- a/drivers/gpu/drm/amd/amdgpu/nbio_v7_4.c
+++ b/drivers/gpu/drm/amd/amdgpu/nbio_v7_4.c
@@ -93,7 +93,20 @@ static void nbio_v7_4_enable_doorbell_aperture(struct amdgpu_device *adev,
 static void nbio_v7_4_enable_doorbell_selfring_aperture(struct amdgpu_device *adev,
                                                         bool enable)
 {
+        u32 tmp = 0;
 
+        if (enable) {
+                tmp = REG_SET_FIELD(tmp, DOORBELL_SELFRING_GPA_APER_CNTL, DOORBELL_SELFRING_GPA_APER_EN, 1) |
+                      REG_SET_FIELD(tmp, DOORBELL_SELFRING_GPA_APER_CNTL, DOORBELL_SELFRING_GPA_APER_MODE, 1) |
+                      REG_SET_FIELD(tmp, DOORBELL_SELFRING_GPA_APER_CNTL, DOORBELL_SELFRING_GPA_APER_SIZE, 0);
+
+                WREG32_SOC15(NBIO, 0, mmDOORBELL_SELFRING_GPA_APER_BASE_LOW,
+                             lower_32_bits(adev->doorbell.base));
+                WREG32_SOC15(NBIO, 0, mmDOORBELL_SELFRING_GPA_APER_BASE_HIGH,
+                             upper_32_bits(adev->doorbell.base));
+        }
+
+        WREG32_SOC15(NBIO, 0, mmDOORBELL_SELFRING_GPA_APER_CNTL, tmp);
 }
 
 static void nbio_v7_4_ih_doorbell_range(struct amdgpu_device *adev,
diff --git a/drivers/gpu/drm/amd/amdgpu/soc15.c b/drivers/gpu/drm/amd/amdgpu/soc15.c
index 8849b74078d6..9b639974c70c 100644
--- a/drivers/gpu/drm/amd/amdgpu/soc15.c
+++ b/drivers/gpu/drm/amd/amdgpu/soc15.c
@@ -729,11 +729,13 @@ static int soc15_common_early_init(void *handle)
         case CHIP_RAVEN:
                 adev->asic_funcs = &soc15_asic_funcs;
                 if (adev->rev_id >= 0x8)
-                        adev->external_rev_id = adev->rev_id + 0x81;
+                        adev->external_rev_id = adev->rev_id + 0x79;
                 else if (adev->pdev->device == 0x15d8)
                         adev->external_rev_id = adev->rev_id + 0x41;
+                else if (adev->rev_id == 1)
+                        adev->external_rev_id = adev->rev_id + 0x20;
                 else
-                        adev->external_rev_id = 0x1;
+                        adev->external_rev_id = adev->rev_id + 0x01;
 
                 if (adev->rev_id >= 0x8) {
                         adev->cg_flags = AMD_CG_SUPPORT_GFX_MGCG |
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_crat.c b/drivers/gpu/drm/amd/amdkfd/kfd_crat.c
index 5d85ff341385..2e7c44955f43 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_crat.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_crat.c
@@ -863,7 +863,7 @@ static int kfd_fill_mem_info_for_cpu(int numa_node_id, int *avail_size,
         return 0;
 }
 
-#if CONFIG_X86_64
+#ifdef CONFIG_X86_64
 static int kfd_fill_iolink_info_for_cpu(int numa_node_id, int *avail_size,
                                 uint32_t *num_entries,
                                 struct crat_subtype_iolink *sub_type_hdr)
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index f4fa40c387d3..0b392bfca284 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -4082,7 +4082,8 @@ void amdgpu_dm_connector_init_helper(struct amdgpu_display_manager *dm,
         }
 
         if (connector_type == DRM_MODE_CONNECTOR_HDMIA ||
-            connector_type == DRM_MODE_CONNECTOR_DisplayPort) {
+            connector_type == DRM_MODE_CONNECTOR_DisplayPort ||
+            connector_type == DRM_MODE_CONNECTOR_eDP) {
                 drm_connector_attach_vrr_capable_property(
                         &aconnector->base);
         }
diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/dce/dce_clk_mgr.c
index afd287f08bc9..19801bdba0d2 100644
--- a/drivers/gpu/drm/amd/display/dc/dce/dce_clk_mgr.c
+++ b/drivers/gpu/drm/amd/display/dc/dce/dce_clk_mgr.c
@@ -591,7 +591,15 @@ static void dce11_pplib_apply_display_requirements(
                         dc,
                         context->bw.dce.sclk_khz);
 
-        pp_display_cfg->min_dcfclock_khz = pp_display_cfg->min_engine_clock_khz;
+        /*
+         * As workaround for >4x4K lightup set dcfclock to min_engine_clock value.
+         * This is not required for less than 5 displays,
+         * thus don't request decfclk in dc to avoid impact
+         * on power saving.
+         *
+         */
+        pp_display_cfg->min_dcfclock_khz = (context->stream_count > 4)?
+                        pp_display_cfg->min_engine_clock_khz : 0;
 
         pp_display_cfg->min_engine_clock_deep_sleep_khz
                         = context->bw.dce.sclk_deep_sleep_khz;
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/smu10_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/smu10_hwmgr.c
index f95c5f50eb0f..5273de3c5b98 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu10_hwmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu10_hwmgr.c
@@ -1033,6 +1033,7 @@ static int smu10_get_clock_by_type_with_latency(struct pp_hwmgr *hwmgr,
                 break;
         case amd_pp_dpp_clock:
                 pclk_vol_table = pinfo->vdd_dep_on_dppclk;
+                break;
         default:
                 return -EINVAL;
         }
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_processpptables.c b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_processpptables.c
index b8747a5c9204..99d596dc0e89 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_processpptables.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_processpptables.c
@@ -32,6 +32,7 @@
 #include "vega10_pptable.h"
 
 #define NUM_DSPCLK_LEVELS 8
+#define VEGA10_ENGINECLOCK_HARDMAX 198000
 
 static void set_hw_cap(struct pp_hwmgr *hwmgr, bool enable,
                 enum phm_platform_caps cap)
@@ -258,7 +259,26 @@ static int init_over_drive_limits(
                 struct pp_hwmgr *hwmgr,
                 const ATOM_Vega10_POWERPLAYTABLE *powerplay_table)
 {
-        hwmgr->platform_descriptor.overdriveLimit.engineClock =
+        const ATOM_Vega10_GFXCLK_Dependency_Table *gfxclk_dep_table =
+                        (const ATOM_Vega10_GFXCLK_Dependency_Table *)
+                        (((unsigned long) powerplay_table) +
+                        le16_to_cpu(powerplay_table->usGfxclkDependencyTableOffset));
+        bool is_acg_enabled = false;
+        ATOM_Vega10_GFXCLK_Dependency_Record_V2 *patom_record_v2;
+
+        if (gfxclk_dep_table->ucRevId == 1) {
+                patom_record_v2 =
+                        (ATOM_Vega10_GFXCLK_Dependency_Record_V2 *)gfxclk_dep_table->entries;
+                is_acg_enabled =
+                        (bool)patom_record_v2[gfxclk_dep_table->ucNumEntries-1].ucACGEnable;
+        }
+
+        if (powerplay_table->ulMaxODEngineClock > VEGA10_ENGINECLOCK_HARDMAX &&
+                !is_acg_enabled)
+                hwmgr->platform_descriptor.overdriveLimit.engineClock =
+                        VEGA10_ENGINECLOCK_HARDMAX;
+        else
+                hwmgr->platform_descriptor.overdriveLimit.engineClock =
                         le32_to_cpu(powerplay_table->ulMaxODEngineClock);
         hwmgr->platform_descriptor.overdriveLimit.memoryClock =
                         le32_to_cpu(powerplay_table->ulMaxODMemoryClock);
diff --git a/drivers/gpu/drm/drm_modes.c b/drivers/gpu/drm/drm_modes.c
index 24a750436559..f91e02c87fd8 100644
--- a/drivers/gpu/drm/drm_modes.c
+++ b/drivers/gpu/drm/drm_modes.c
@@ -758,7 +758,7 @@ int drm_mode_hsync(const struct drm_display_mode *mode)
         if (mode->hsync)
                 return mode->hsync;
 
-        if (mode->htotal < 0)
+        if (mode->htotal <= 0)
                 return 0;
 
         calc_val = (mode->clock * 1000) / mode->htotal; /* hsync in Hz */
diff --git a/drivers/gpu/drm/i915/gvt/scheduler.c b/drivers/gpu/drm/i915/gvt/scheduler.c
index 5567ddc7760f..55bb7885e228 100644
--- a/drivers/gpu/drm/i915/gvt/scheduler.c
+++ b/drivers/gpu/drm/i915/gvt/scheduler.c
@@ -332,6 +332,9 @@ static void release_shadow_wa_ctx(struct intel_shadow_wa_ctx *wa_ctx)
 
         i915_gem_object_unpin_map(wa_ctx->indirect_ctx.obj);
         i915_gem_object_put(wa_ctx->indirect_ctx.obj);
+
+        wa_ctx->indirect_ctx.obj = NULL;
+        wa_ctx->indirect_ctx.shadow_va = NULL;
 }
 
 static int set_context_ppgtt_from_shadow(struct intel_vgpu_workload *workload,
@@ -911,11 +914,6 @@ static void complete_current_workload(struct intel_gvt *gvt, int ring_id)
 
         list_del_init(&workload->list);
 
-        if (!workload->status) {
-                release_shadow_batch_buffer(workload);
-                release_shadow_wa_ctx(&workload->wa_ctx);
-        }
-
         if (workload->status || (vgpu->resetting_eng & ENGINE_MASK(ring_id))) {
                 /* if workload->status is not successful means HW GPU
                  * has occurred GPU hang or something wrong with i915/GVT,
@@ -1283,6 +1281,9 @@ void intel_vgpu_destroy_workload(struct intel_vgpu_workload *workload)
 {
         struct intel_vgpu_submission *s = &workload->vgpu->submission;
 
+        release_shadow_batch_buffer(workload);
+        release_shadow_wa_ctx(&workload->wa_ctx);
+
         if (workload->shadow_mm)
                 intel_vgpu_mm_put(workload->shadow_mm);
 
diff --git a/drivers/gpu/drm/i915/intel_ddi.c b/drivers/gpu/drm/i915/intel_ddi.c
index f3e1d6a0b7dd..4079050f9d6c 100644
--- a/drivers/gpu/drm/i915/intel_ddi.c
+++ b/drivers/gpu/drm/i915/intel_ddi.c
@@ -1086,7 +1086,7 @@ static uint32_t icl_pll_to_ddi_pll_sel(struct intel_encoder *encoder,
                         return DDI_CLK_SEL_TBT_810;
                 default:
                         MISSING_CASE(clock);
-                        break;
+                        return DDI_CLK_SEL_NONE;
                 }
         case DPLL_ID_ICL_MGPLL1:
         case DPLL_ID_ICL_MGPLL2:
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 3da9c0f9e948..248128126422 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -15415,16 +15415,45 @@ static void intel_sanitize_crtc(struct intel_crtc *crtc,
         }
 }
 
+static bool has_bogus_dpll_config(const struct intel_crtc_state *crtc_state)
+{
+        struct drm_i915_private *dev_priv = to_i915(crtc_state->base.crtc->dev);
+
+        /*
+         * Some SNB BIOSen (eg. ASUS K53SV) are known to misprogram
+         * the hardware when a high res displays plugged in. DPLL P
+         * divider is zero, and the pipe timings are bonkers. We'll
+         * try to disable everything in that case.
+         *
+         * FIXME would be nice to be able to sanitize this state
+         * without several WARNs, but for now let's take the easy
+         * road.
+         */
+        return IS_GEN6(dev_priv) &&
+                crtc_state->base.active &&
+                crtc_state->shared_dpll &&
+                crtc_state->port_clock == 0;
+}
+
 static void intel_sanitize_encoder(struct intel_encoder *encoder)
 {
         struct drm_i915_private *dev_priv = to_i915(encoder->base.dev);
         struct intel_connector *connector;
+        struct intel_crtc *crtc = to_intel_crtc(encoder->base.crtc);
+        struct intel_crtc_state *crtc_state = crtc ?
+                to_intel_crtc_state(crtc->base.state) : NULL;
 
         /* We need to check both for a crtc link (meaning that the
          * encoder is active and trying to read from a pipe) and the
          * pipe itself being active. */
-        bool has_active_crtc = encoder->base.crtc &&
-                to_intel_crtc(encoder->base.crtc)->active;
+        bool has_active_crtc = crtc_state &&
+                crtc_state->base.active;
+
+        if (crtc_state && has_bogus_dpll_config(crtc_state)) {
+                DRM_DEBUG_KMS("BIOS has misprogrammed the hardware. Disabling pipe %c\n",
+                              pipe_name(crtc->pipe));
+                has_active_crtc = false;
+        }
 
         connector = intel_encoder_find_connector(encoder);
         if (connector && !has_active_crtc) {
@@ -15435,16 +15464,25 @@ static void intel_sanitize_encoder(struct intel_encoder *encoder)
                 /* Connector is active, but has no active pipe. This is
                  * fallout from our resume register restoring. Disable
                  * the encoder manually again. */
-                if (encoder->base.crtc) {
-                        struct drm_crtc_state *crtc_state = encoder->base.crtc->state;
+                if (crtc_state) {
+                        struct drm_encoder *best_encoder;
 
                         DRM_DEBUG_KMS("[ENCODER:%d:%s] manually disabled\n",
                                       encoder->base.base.id,
                                       encoder->base.name);
+
+                        /* avoid oopsing in case the hooks consult best_encoder */
+                        best_encoder = connector->base.state->best_encoder;
+                        connector->base.state->best_encoder = &encoder->base;
+
                         if (encoder->disable)
-                                encoder->disable(encoder, to_intel_crtc_state(crtc_state), connector->base.state);
+                                encoder->disable(encoder, crtc_state,
+                                                 connector->base.state);
                         if (encoder->post_disable)
-                                encoder->post_disable(encoder, to_intel_crtc_state(crtc_state), connector->base.state);
+                                encoder->post_disable(encoder, crtc_state,
+                                                      connector->base.state);
+
+                        connector->base.state->best_encoder = best_encoder;
                 }
                 encoder->base.crtc = NULL;
 
diff --git a/drivers/gpu/drm/i915/intel_lrc.c b/drivers/gpu/drm/i915/intel_lrc.c
index 4796f40a6d4f..eab9341a5152 100644
--- a/drivers/gpu/drm/i915/intel_lrc.c
+++ b/drivers/gpu/drm/i915/intel_lrc.c
@@ -303,6 +303,7 @@ static void __unwind_incomplete_requests(struct intel_engine_cs *engine)
          */
         if (!(prio & I915_PRIORITY_NEWCLIENT)) {
                 prio |= I915_PRIORITY_NEWCLIENT;
+                active->sched.attr.priority = prio;
                 list_move_tail(&active->sched.link,
                                i915_sched_lookup_priolist(engine, prio));
         }
@@ -645,6 +646,9 @@ static void execlists_dequeue(struct intel_engine_cs *engine)
                 int i;
 
                 priolist_for_each_request_consume(rq, rn, p, i) {
+                        GEM_BUG_ON(last &&
+                                   need_preempt(engine, last, rq_prio(rq)));
+
                         /*
                          * Can we combine this request with the current port?
                          * It has to be the same context/ringbuffer and not
diff --git a/drivers/gpu/drm/i915/intel_sprite.c b/drivers/gpu/drm/i915/intel_sprite.c
index d2e003d8f3db..5170a0f5fe7b 100644
--- a/drivers/gpu/drm/i915/intel_sprite.c
+++ b/drivers/gpu/drm/i915/intel_sprite.c
@@ -494,7 +494,7 @@ skl_program_plane(struct intel_plane *plane,
 
         keymax = (key->max_value & 0xffffff) | PLANE_KEYMAX_ALPHA(alpha);
 
-        keymsk = key->channel_mask & 0x3ffffff;
+        keymsk = key->channel_mask & 0x7ffffff;
         if (alpha < 0xff)
                 keymsk |= PLANE_KEYMSK_ALPHA_ENABLE;
 
diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gmu.c b/drivers/gpu/drm/msm/adreno/a6xx_gmu.c
index 5beb83d1cf87..ce1b3cc4bf6d 100644
--- a/drivers/gpu/drm/msm/adreno/a6xx_gmu.c
+++ b/drivers/gpu/drm/msm/adreno/a6xx_gmu.c
@@ -944,7 +944,7 @@ static u32 a6xx_gmu_get_arc_level(struct device *dev, unsigned long freq)
         np = dev_pm_opp_get_of_node(opp);
 
         if (np) {
-                of_property_read_u32(np, "qcom,level", &val);
+                of_property_read_u32(np, "opp-level", &val);
                 of_node_put(np);
         }
 
diff --git a/drivers/gpu/drm/msm/adreno/adreno_gpu.c b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
index 2e4372ef17a3..2cfee1a4fe0b 100644
--- a/drivers/gpu/drm/msm/adreno/adreno_gpu.c
+++ b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
@@ -765,7 +765,6 @@ int adreno_gpu_init(struct drm_device *drm, struct platform_device *pdev,
         adreno_gpu->rev = config->rev;
 
         adreno_gpu_config.ioname = "kgsl_3d0_reg_memory";
-        adreno_gpu_config.irqname = "kgsl_3d0_irq";
 
         adreno_gpu_config.va_start = SZ_16M;
         adreno_gpu_config.va_end = 0xffffffff;
diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c
index fd75870eb17f..6aefcd6db46b 100644
--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c
+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c
@@ -365,19 +365,6 @@ static void _dpu_plane_set_qos_ctrl(struct drm_plane *plane,
                         &pdpu->pipe_qos_cfg);
 }
 
-static void dpu_plane_danger_signal_ctrl(struct drm_plane *plane, bool enable)
-{
-        struct dpu_plane *pdpu = to_dpu_plane(plane);
-        struct dpu_kms *dpu_kms = _dpu_plane_get_kms(plane);
-
-        if (!pdpu->is_rt_pipe)
-                return;
-
-        pm_runtime_get_sync(&dpu_kms->pdev->dev);
-        _dpu_plane_set_qos_ctrl(plane, enable, DPU_PLANE_QOS_PANIC_CTRL);
-        pm_runtime_put_sync(&dpu_kms->pdev->dev);
-}
-
 /**
  * _dpu_plane_set_ot_limit - set OT limit for the given plane
  * @plane:              Pointer to drm plane
@@ -1248,6 +1235,19 @@ static void dpu_plane_reset(struct drm_plane *plane)
 }
 
 #ifdef CONFIG_DEBUG_FS
+static void dpu_plane_danger_signal_ctrl(struct drm_plane *plane, bool enable)
+{
+        struct dpu_plane *pdpu = to_dpu_plane(plane);
+        struct dpu_kms *dpu_kms = _dpu_plane_get_kms(plane);
+
+        if (!pdpu->is_rt_pipe)
+                return;
+
+        pm_runtime_get_sync(&dpu_kms->pdev->dev);
+        _dpu_plane_set_qos_ctrl(plane, enable, DPU_PLANE_QOS_PANIC_CTRL);
+        pm_runtime_put_sync(&dpu_kms->pdev->dev);
+}
+
 static ssize_t _dpu_plane_danger_read(struct file *file,
                         char __user *buff, size_t count, loff_t *ppos)
 {
diff --git a/drivers/gpu/drm/msm/msm_drv.h b/drivers/gpu/drm/msm/msm_drv.h
index 9cd6a96c6bf2..927e5d86f7c1 100644
--- a/drivers/gpu/drm/msm/msm_drv.h
+++ b/drivers/gpu/drm/msm/msm_drv.h
@@ -250,7 +250,8 @@ void msm_gem_purge_vma(struct msm_gem_address_space *aspace,
 void msm_gem_unmap_vma(struct msm_gem_address_space *aspace,
                 struct msm_gem_vma *vma);
 int msm_gem_map_vma(struct msm_gem_address_space *aspace,
-                struct msm_gem_vma *vma, struct sg_table *sgt, int npages);
+                struct msm_gem_vma *vma, int prot,
+                struct sg_table *sgt, int npages);
 void msm_gem_close_vma(struct msm_gem_address_space *aspace,
                 struct msm_gem_vma *vma);
 
@@ -333,6 +334,7 @@ void msm_gem_kernel_put(struct drm_gem_object *bo,
 struct drm_gem_object *msm_gem_import(struct drm_device *dev,
                 struct dma_buf *dmabuf, struct sg_table *sgt);
 
+__printf(2, 3)
 void msm_gem_object_set_name(struct drm_gem_object *bo, const char *fmt, ...);
 
 int msm_framebuffer_prepare(struct drm_framebuffer *fb,
@@ -396,12 +398,14 @@ void msm_framebuffer_describe(struct drm_framebuffer *fb, struct seq_file *m);
 int msm_debugfs_late_init(struct drm_device *dev);
 int msm_rd_debugfs_init(struct drm_minor *minor);
 void msm_rd_debugfs_cleanup(struct msm_drm_private *priv);
+__printf(3, 4)
 void msm_rd_dump_submit(struct msm_rd_state *rd, struct msm_gem_submit *submit,
                 const char *fmt, ...);
 int msm_perf_debugfs_init(struct drm_minor *minor);
 void msm_perf_debugfs_cleanup(struct msm_drm_private *priv);
 #else
 static inline int msm_debugfs_late_init(struct drm_device *dev) { return 0; }
+__printf(3, 4)
 static inline void msm_rd_dump_submit(struct msm_rd_state *rd, struct msm_gem_submit *submit,
                 const char *fmt, ...) {}
 static inline void msm_rd_debugfs_cleanup(struct msm_drm_private *priv) {}
diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c
index 51a95da694d8..c8886d3071fa 100644
--- a/drivers/gpu/drm/msm/msm_gem.c
+++ b/drivers/gpu/drm/msm/msm_gem.c
@@ -391,6 +391,10 @@ static int msm_gem_pin_iova(struct drm_gem_object *obj,
         struct msm_gem_object *msm_obj = to_msm_bo(obj);
         struct msm_gem_vma *vma;
         struct page **pages;
+        int prot = IOMMU_READ;
+
+        if (!(msm_obj->flags & MSM_BO_GPU_READONLY))
+                prot |= IOMMU_WRITE;
 
         WARN_ON(!mutex_is_locked(&msm_obj->lock));
 
@@ -405,8 +409,8 @@ static int msm_gem_pin_iova(struct drm_gem_object *obj,
         if (IS_ERR(pages))
                 return PTR_ERR(pages);
 
-        return msm_gem_map_vma(aspace, vma, msm_obj->sgt,
-                        obj->size >> PAGE_SHIFT);
+        return msm_gem_map_vma(aspace, vma, prot,
+                        msm_obj->sgt, obj->size >> PAGE_SHIFT);
 }
 
 /* get iova and pin it. Should have a matching put */
diff --git a/drivers/gpu/drm/msm/msm_gem_vma.c b/drivers/gpu/drm/msm/msm_gem_vma.c
index 557360788084..49c04829cf34 100644
--- a/drivers/gpu/drm/msm/msm_gem_vma.c
+++ b/drivers/gpu/drm/msm/msm_gem_vma.c
@@ -68,7 +68,8 @@ void msm_gem_unmap_vma(struct msm_gem_address_space *aspace,
 
 int
 msm_gem_map_vma(struct msm_gem_address_space *aspace,
-                struct msm_gem_vma *vma, struct sg_table *sgt, int npages)
+                struct msm_gem_vma *vma, int prot,
+                struct sg_table *sgt, int npages)
 {
         unsigned size = npages << PAGE_SHIFT;
         int ret = 0;
@@ -86,7 +87,7 @@ msm_gem_map_vma(struct msm_gem_address_space *aspace,
 
         if (aspace->mmu)
                 ret = aspace->mmu->funcs->map(aspace->mmu, vma->iova, sgt,
-                                size, IOMMU_READ | IOMMU_WRITE);
+                                size, prot);
 
         if (ret)
                 vma->mapped = false;
diff --git a/drivers/gpu/drm/msm/msm_gpu.c b/drivers/gpu/drm/msm/msm_gpu.c
index 5f3eff304355..10babd18e286 100644
--- a/drivers/gpu/drm/msm/msm_gpu.c
+++ b/drivers/gpu/drm/msm/msm_gpu.c
@@ -900,7 +900,7 @@ int msm_gpu_init(struct drm_device *drm, struct platform_device *pdev,
         }
 
         /* Get Interrupt: */
-        gpu->irq = platform_get_irq_byname(pdev, config->irqname);
+        gpu->irq = platform_get_irq(pdev, 0);
         if (gpu->irq < 0) {
                 ret = gpu->irq;
                 DRM_DEV_ERROR(drm->dev, "failed to get irq: %d\n", ret);
diff --git a/drivers/gpu/drm/msm/msm_gpu.h b/drivers/gpu/drm/msm/msm_gpu.h
index efb49bb64191..ca17086f72c9 100644
--- a/drivers/gpu/drm/msm/msm_gpu.h
+++ b/drivers/gpu/drm/msm/msm_gpu.h
@@ -31,7 +31,6 @@ struct msm_gpu_state;
 
 struct msm_gpu_config {
         const char *ioname;
-        const char *irqname;
         uint64_t va_start;
         uint64_t va_end;
         unsigned int nr_rings;
@@ -63,7 +62,7 @@ struct msm_gpu_funcs {
         struct msm_ringbuffer *(*active_ring)(struct msm_gpu *gpu);
         void (*recover)(struct msm_gpu *gpu);
         void (*destroy)(struct msm_gpu *gpu);
-#ifdef CONFIG_DEBUG_FS
+#if defined(CONFIG_DEBUG_FS) || defined(CONFIG_DEV_COREDUMP)
         /* show GPU status in debugfs: */
         void (*show)(struct msm_gpu *gpu, struct msm_gpu_state *state,
                         struct drm_printer *p);
diff --git a/drivers/gpu/drm/msm/msm_rd.c b/drivers/gpu/drm/msm/msm_rd.c
index 90e9d0a48dc0..d21172933d92 100644
--- a/drivers/gpu/drm/msm/msm_rd.c
+++ b/drivers/gpu/drm/msm/msm_rd.c
@@ -115,7 +115,9 @@ static void rd_write(struct msm_rd_state *rd, const void *buf, int sz)
                 char *fptr = &fifo->buf[fifo->head];
                 int n;
 
-                wait_event(rd->fifo_event, circ_space(&rd->fifo) > 0);
+                wait_event(rd->fifo_event, circ_space(&rd->fifo) > 0 || !rd->open);
+                if (!rd->open)
+                        return;
 
                 /* Note that smp_load_acquire() is not strictly required
                  * as CIRC_SPACE_TO_END() does not access the tail more
@@ -213,7 +215,10 @@ out:
 static int rd_release(struct inode *inode, struct file *file)
 {
         struct msm_rd_state *rd = inode->i_private;
+
         rd->open = false;
+        wake_up_all(&rd->fifo_event);
+
         return 0;
 }
 
diff --git a/drivers/gpu/drm/omapdrm/dss/dsi.c b/drivers/gpu/drm/omapdrm/dss/dsi.c
index 00a9c2ab9e6c..64fb788b6647 100644
--- a/drivers/gpu/drm/omapdrm/dss/dsi.c
+++ b/drivers/gpu/drm/omapdrm/dss/dsi.c
@@ -1406,7 +1406,7 @@ static void dsi_pll_disable(struct dss_pll *pll)
 
 static int dsi_dump_dsi_clocks(struct seq_file *s, void *p)
 {
-        struct dsi_data *dsi = p;
+        struct dsi_data *dsi = s->private;
         struct dss_pll_clock_info *cinfo = &dsi->pll.cinfo;
         enum dss_clk_source dispc_clk_src, dsi_clk_src;
         int dsi_module = dsi->module_id;
@@ -1467,7 +1467,7 @@ static int dsi_dump_dsi_clocks(struct seq_file *s, void *p)
 #ifdef CONFIG_OMAP2_DSS_COLLECT_IRQ_STATS
 static int dsi_dump_dsi_irqs(struct seq_file *s, void *p)
 {
-        struct dsi_data *dsi = p;
+        struct dsi_data *dsi = s->private;
         unsigned long flags;
         struct dsi_irq_stats stats;
 
@@ -1558,7 +1558,7 @@ static int dsi_dump_dsi_irqs(struct seq_file *s, void *p)
 
 static int dsi_dump_dsi_regs(struct seq_file *s, void *p)
 {
-        struct dsi_data *dsi = p;
+        struct dsi_data *dsi = s->private;
 
         if (dsi_runtime_get(dsi))
                 return 0;
@@ -4751,6 +4751,17 @@ static int dsi_set_config(struct omap_dss_device *dssdev,
         dsi->vm.flags |= DISPLAY_FLAGS_HSYNC_HIGH;
         dsi->vm.flags &= ~DISPLAY_FLAGS_VSYNC_LOW;
         dsi->vm.flags |= DISPLAY_FLAGS_VSYNC_HIGH;
+        /*
+         * HACK: These flags should be handled through the omap_dss_device bus
+         * flags, but this will only be possible when the DSI encoder will be
+         * converted to the omapdrm-managed encoder model.
+         */
+        dsi->vm.flags &= ~DISPLAY_FLAGS_PIXDATA_NEGEDGE;
+        dsi->vm.flags |= DISPLAY_FLAGS_PIXDATA_POSEDGE;
+        dsi->vm.flags &= ~DISPLAY_FLAGS_DE_LOW;
+        dsi->vm.flags |= DISPLAY_FLAGS_DE_HIGH;
+        dsi->vm.flags &= ~DISPLAY_FLAGS_SYNC_POSEDGE;
+        dsi->vm.flags |= DISPLAY_FLAGS_SYNC_NEGEDGE;
 
         dss_mgr_set_timings(&dsi->output, &dsi->vm);
 
@@ -5083,15 +5094,15 @@ static int dsi_bind(struct device *dev, struct device *master, void *data)
 
         snprintf(name, sizeof(name), "dsi%u_regs", dsi->module_id + 1);
         dsi->debugfs.regs = dss_debugfs_create_file(dss, name,
-                                                    dsi_dump_dsi_regs, &dsi);
+                                                    dsi_dump_dsi_regs, dsi);
 #ifdef CONFIG_OMAP2_DSS_COLLECT_IRQ_STATS
         snprintf(name, sizeof(name), "dsi%u_irqs", dsi->module_id + 1);
         dsi->debugfs.irqs = dss_debugfs_create_file(dss, name,
-                                                    dsi_dump_dsi_irqs, &dsi);
+                                                    dsi_dump_dsi_irqs, dsi);
 #endif
         snprintf(name, sizeof(name), "dsi%u_clks", dsi->module_id + 1);
         dsi->debugfs.clks = dss_debugfs_create_file(dss, name,
-                                                    dsi_dump_dsi_clocks, &dsi);
+                                                    dsi_dump_dsi_clocks, dsi);
 
         return 0;
 }
@@ -5104,8 +5115,6 @@ static void dsi_unbind(struct device *dev, struct device *master, void *data)
         dss_debugfs_remove_file(dsi->debugfs.irqs);
         dss_debugfs_remove_file(dsi->debugfs.regs);
 
-        of_platform_depopulate(dev);
-
         WARN_ON(dsi->scp_clk_refcount > 0);
 
         dss_pll_unregister(&dsi->pll);
@@ -5457,6 +5466,8 @@ static int dsi_remove(struct platform_device *pdev)
 
         dsi_uninit_output(dsi);
 
+        of_platform_depopulate(&pdev->dev);
+
         pm_runtime_disable(&pdev->dev);
 
         if (dsi->vdds_dsi_reg != NULL && dsi->vdds_dsi_enabled) {
diff --git a/drivers/gpu/drm/radeon/ci_dpm.c b/drivers/gpu/drm/radeon/ci_dpm.c
index d587779a80b4..a97294ac96d5 100644
--- a/drivers/gpu/drm/radeon/ci_dpm.c
+++ b/drivers/gpu/drm/radeon/ci_dpm.c
@@ -5676,7 +5676,7 @@ int ci_dpm_init(struct radeon_device *rdev)
         u16 data_offset, size;
         u8 frev, crev;
         struct ci_power_info *pi;
-        enum pci_bus_speed speed_cap;
+        enum pci_bus_speed speed_cap = PCI_SPEED_UNKNOWN;
         struct pci_dev *root = rdev->pdev->bus->self;
         int ret;
 
@@ -5685,7 +5685,8 @@ int ci_dpm_init(struct radeon_device *rdev)
                 return -ENOMEM;
         rdev->pm.dpm.priv = pi;
 
-        speed_cap = pcie_get_speed_cap(root);
+        if (!pci_is_root_bus(rdev->pdev->bus))
+                speed_cap = pcie_get_speed_cap(root);
         if (speed_cap == PCI_SPEED_UNKNOWN) {
                 pi->sys_pcie_mask = 0;
         } else {
diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
index 8fb60b3af015..0a785ef0ab66 100644
--- a/drivers/gpu/drm/radeon/si_dpm.c
+++ b/drivers/gpu/drm/radeon/si_dpm.c
@@ -6899,7 +6899,7 @@ int si_dpm_init(struct radeon_device *rdev)
         struct ni_power_info *ni_pi;
         struct si_power_info *si_pi;
         struct atom_clock_dividers dividers;
-        enum pci_bus_speed speed_cap;
+        enum pci_bus_speed speed_cap = PCI_SPEED_UNKNOWN;
         struct pci_dev *root = rdev->pdev->bus->self;
         int ret;
 
@@ -6911,7 +6911,8 @@ int si_dpm_init(struct radeon_device *rdev)
         eg_pi = &ni_pi->eg;
         pi = &eg_pi->rv7xx;
 
-        speed_cap = pcie_get_speed_cap(root);
+        if (!pci_is_root_bus(rdev->pdev->bus))
+                speed_cap = pcie_get_speed_cap(root);
         if (speed_cap == PCI_SPEED_UNKNOWN) {
                 si_pi->sys_pcie_mask = 0;
         } else {
diff --git a/drivers/gpu/drm/rockchip/rockchip_rgb.c b/drivers/gpu/drm/rockchip/rockchip_rgb.c
index 37f93022a106..c0351abf83a3 100644
--- a/drivers/gpu/drm/rockchip/rockchip_rgb.c
+++ b/drivers/gpu/drm/rockchip/rockchip_rgb.c
@@ -1,17 +1,8 @@
-//SPDX-License-Identifier: GPL-2.0+
+// SPDX-License-Identifier: GPL-2.0
 /*
  * Copyright (C) Fuzhou Rockchip Electronics Co.Ltd
  * Author:
  *      Sandy Huang <hjc@rock-chips.com>
- *
- * This software is licensed under the terms of the GNU General Public
- * License version 2, as published by the Free Software Foundation, and
- * may be copied, distributed, and modified under those terms.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
  */
 
 #include <drm/drmP.h>
diff --git a/drivers/gpu/drm/rockchip/rockchip_rgb.h b/drivers/gpu/drm/rockchip/rockchip_rgb.h
index 38b52e63b2b0..27b9635124bc 100644
--- a/drivers/gpu/drm/rockchip/rockchip_rgb.h
+++ b/drivers/gpu/drm/rockchip/rockchip_rgb.h
@@ -1,17 +1,8 @@
-//SPDX-License-Identifier: GPL-2.0+
+/* SPDX-License-Identifier: GPL-2.0 */
 /*
  * Copyright (C) Fuzhou Rockchip Electronics Co.Ltd
  * Author:
  *      Sandy Huang <hjc@rock-chips.com>
- *
- * This software is licensed under the terms of the GNU General Public
- * License version 2, as published by the Free Software Foundation, and
- * may be copied, distributed, and modified under those terms.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
  */
 
 #ifdef CONFIG_ROCKCHIP_RGB
diff --git a/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c b/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c
index 061d2e0d9011..416da5376701 100644
--- a/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c
+++ b/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c
@@ -92,6 +92,8 @@ static void sun4i_hdmi_disable(struct drm_encoder *encoder)
         val = readl(hdmi->base + SUN4I_HDMI_VID_CTRL_REG);
         val &= ~SUN4I_HDMI_VID_CTRL_ENABLE;
         writel(val, hdmi->base + SUN4I_HDMI_VID_CTRL_REG);
+
+        clk_disable_unprepare(hdmi->tmds_clk);
 }
 
 static void sun4i_hdmi_enable(struct drm_encoder *encoder)
@@ -102,6 +104,8 @@ static void sun4i_hdmi_enable(struct drm_encoder *encoder)
 
         DRM_DEBUG_DRIVER("Enabling the HDMI Output\n");
 
+        clk_prepare_enable(hdmi->tmds_clk);
+
         sun4i_hdmi_setup_avi_infoframes(hdmi, mode);
         val |= SUN4I_HDMI_PKT_CTRL_TYPE(0, SUN4I_HDMI_PKT_AVI);
         val |= SUN4I_HDMI_PKT_CTRL_TYPE(1, SUN4I_HDMI_PKT_END);
diff --git a/drivers/gpu/drm/sun4i/sun4i_tcon.c b/drivers/gpu/drm/sun4i/sun4i_tcon.c
index 0420f5c978b9..cf45d0f940f9 100644
--- a/drivers/gpu/drm/sun4i/sun4i_tcon.c
+++ b/drivers/gpu/drm/sun4i/sun4i_tcon.c
@@ -761,6 +761,7 @@ static int sun4i_tcon_init_clocks(struct device *dev,
                         return PTR_ERR(tcon->sclk0);
                 }
         }
+        clk_prepare_enable(tcon->sclk0);
 
         if (tcon->quirks->has_channel_1) {
                 tcon->sclk1 = devm_clk_get(dev, "tcon-ch1");
@@ -775,6 +776,7 @@ static int sun4i_tcon_init_clocks(struct device *dev,
 
 static void sun4i_tcon_free_clocks(struct sun4i_tcon *tcon)
 {
+        clk_disable_unprepare(tcon->sclk0);
         clk_disable_unprepare(tcon->clk);
 }
 
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
index 25afb1d594e3..7ef5dcb06104 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
@@ -26,6 +26,7 @@
  **************************************************************************/
 #include <linux/module.h>
 #include <linux/console.h>
+#include <linux/dma-mapping.h>
 
 #include <drm/drmP.h>
 #include "vmwgfx_drv.h"
@@ -34,7 +35,6 @@
 #include <drm/ttm/ttm_placement.h>
 #include <drm/ttm/ttm_bo_driver.h>
 #include <drm/ttm/ttm_module.h>
-#include <linux/intel-iommu.h>
 
 #define VMWGFX_DRIVER_DESC "Linux drm driver for VMware graphics devices"
 #define VMWGFX_CHIP_SVGAII 0
@@ -546,6 +546,21 @@ static void vmw_get_initial_size(struct vmw_private *dev_priv)
 }
 
 /**
+ * vmw_assume_iommu - Figure out whether coherent dma-remapping might be
+ * taking place.
+ * @dev: Pointer to the struct drm_device.
+ *
+ * Return: true if iommu present, false otherwise.
+ */
+static bool vmw_assume_iommu(struct drm_device *dev)
+{
+        const struct dma_map_ops *ops = get_dma_ops(dev->dev);
+
+        return !dma_is_direct(ops) && ops &&
+                ops->map_page != dma_direct_map_page;
+}
+
+/**
  * vmw_dma_select_mode - Determine how DMA mappings should be set up for this
  * system.
  *
@@ -565,55 +580,27 @@ static int vmw_dma_select_mode(struct vmw_private *dev_priv)
                 [vmw_dma_alloc_coherent] = "Using coherent TTM pages.",
                 [vmw_dma_map_populate] = "Keeping DMA mappings.",
                 [vmw_dma_map_bind] = "Giving up DMA mappings early."};
-#ifdef CONFIG_X86
-        const struct dma_map_ops *dma_ops = get_dma_ops(dev_priv->dev->dev);
 
-#ifdef CONFIG_INTEL_IOMMU
-        if (intel_iommu_enabled) {
+        if (vmw_force_coherent)
+                dev_priv->map_mode = vmw_dma_alloc_coherent;
+        else if (vmw_assume_iommu(dev_priv->dev))
                 dev_priv->map_mode = vmw_dma_map_populate;
-                goto out_fixup;
-        }
-#endif
-
-        if (!(vmw_force_iommu || vmw_force_coherent)) {
+        else if (!vmw_force_iommu)
                 dev_priv->map_mode = vmw_dma_phys;
-                DRM_INFO("DMA map mode: %s\n", names[dev_priv->map_mode]);
-                return 0;
-        }
-
-        dev_priv->map_mode = vmw_dma_map_populate;
-
-        if (dma_ops && dma_ops->sync_single_for_cpu)
+        else if (IS_ENABLED(CONFIG_SWIOTLB) && swiotlb_nr_tbl())
                 dev_priv->map_mode = vmw_dma_alloc_coherent;
-#ifdef CONFIG_SWIOTLB
-        if (swiotlb_nr_tbl() == 0)
+        else
                 dev_priv->map_mode = vmw_dma_map_populate;
-#endif
 
-#ifdef CONFIG_INTEL_IOMMU
-out_fixup:
-#endif
-        if (dev_priv->map_mode == vmw_dma_map_populate &&
-            vmw_restrict_iommu)
+        if (dev_priv->map_mode == vmw_dma_map_populate && vmw_restrict_iommu)
                 dev_priv->map_mode = vmw_dma_map_bind;
 
-        if (vmw_force_coherent)
-                dev_priv->map_mode = vmw_dma_alloc_coherent;
-
-#if !defined(CONFIG_SWIOTLB) && !defined(CONFIG_INTEL_IOMMU)
-        /*
-         * No coherent page pool
-         */
-        if (dev_priv->map_mode == vmw_dma_alloc_coherent)
+        /* No TTM coherent page pool? FIXME: Ask TTM instead! */
+        if (!(IS_ENABLED(CONFIG_SWIOTLB) || IS_ENABLED(CONFIG_INTEL_IOMMU)) &&
+            (dev_priv->map_mode == vmw_dma_alloc_coherent))
                 return -EINVAL;
-#endif
-
-#else /* CONFIG_X86 */
-        dev_priv->map_mode = vmw_dma_map_populate;
-#endif /* CONFIG_X86 */
 
         DRM_INFO("DMA map mode: %s\n", names[dev_priv->map_mode]);
-
         return 0;
 }
 
@@ -625,24 +612,20 @@ out_fixup:
  * With 32-bit we can only handle 32 bit PFNs. Optionally set that
  * restriction also for 64-bit systems.
  */
-#ifdef CONFIG_INTEL_IOMMU
 static int vmw_dma_masks(struct vmw_private *dev_priv)
 {
         struct drm_device *dev = dev_priv->dev;
+        int ret = 0;
 
-        if (intel_iommu_enabled &&
+        ret = dma_set_mask_and_coherent(dev->dev, DMA_BIT_MASK(64));
+        if (dev_priv->map_mode != vmw_dma_phys &&
             (sizeof(unsigned long) == 4 || vmw_restrict_dma_mask)) {
                 DRM_INFO("Restricting DMA addresses to 44 bits.\n");
-                return dma_set_mask(dev->dev, DMA_BIT_MASK(44));
+                return dma_set_mask_and_coherent(dev->dev, DMA_BIT_MASK(44));
         }
-        return 0;
-}
-#else
-static int vmw_dma_masks(struct vmw_private *dev_priv)
-{
-        return 0;
+
+        return ret;
 }
-#endif
 
 static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
 {
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
index f2d13a72c05d..88b8178d4687 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
@@ -3570,7 +3570,7 @@ int vmw_execbuf_fence_commands(struct drm_file *file_priv,
                 *p_fence = NULL;
         }
 
-        return 0;
+        return ret;
 }
 
 /**
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
index b351fb5214d3..ed2f67822f45 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
@@ -1646,7 +1646,7 @@ static int vmw_kms_check_topology(struct drm_device *dev,
                 struct drm_connector_state *conn_state;
                 struct vmw_connector_state *vmw_conn_state;
 
-                if (!du->pref_active) {
+                if (!du->pref_active && new_crtc_state->enable) {
                         ret = -EINVAL;
                         goto clean;
                 }
@@ -2554,8 +2554,8 @@ void vmw_kms_helper_validation_finish(struct vmw_private *dev_priv,
                                       user_fence_rep)
 {
         struct vmw_fence_obj *fence = NULL;
-        uint32_t handle;
-        int ret;
+        uint32_t handle = 0;
+        int ret = 0;
 
         if (file_priv || user_fence_rep || vmw_validation_has_bos(ctx) ||
             out_fence)
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index f41d5fe51abe..9993b692598f 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -125,6 +125,7 @@ static int open_collection(struct hid_parser *parser, unsigned type)
 {
         struct hid_collection *collection;
         unsigned usage;
+        int collection_index;
 
         usage = parser->local.usage[0];
 
@@ -167,13 +168,13 @@ static int open_collection(struct hid_parser *parser, unsigned type)
         parser->collection_stack[parser->collection_stack_ptr++] =
                 parser->device->maxcollection;
 
-        collection = parser->device->collection +
-                parser->device->maxcollection++;
+        collection_index = parser->device->maxcollection++;
+        collection = parser->device->collection + collection_index;
         collection->type = type;
         collection->usage = usage;
         collection->level = parser->collection_stack_ptr - 1;
-        collection->parent = parser->active_collection;
-        parser->active_collection = collection;
+        collection->parent_idx = (collection->level == 0) ? -1 :
+                parser->collection_stack[collection->level - 1];
 
         if (type == HID_COLLECTION_APPLICATION)
                 parser->device->maxapplication++;
@@ -192,8 +193,6 @@ static int close_collection(struct hid_parser *parser)
                 return -EINVAL;
         }
         parser->collection_stack_ptr--;
-        if (parser->active_collection)
-                parser->active_collection = parser->active_collection->parent;
         return 0;
 }
 
@@ -1006,10 +1005,12 @@ static void hid_apply_multiplier_to_field(struct hid_device *hid,
                 usage = &field->usage[i];
 
                 collection = &hid->collection[usage->collection_index];
-                while (collection && collection != multiplier_collection)
-                        collection = collection->parent;
+                while (collection->parent_idx != -1 &&
+                       collection != multiplier_collection)
+                        collection = &hid->collection[collection->parent_idx];
 
-                if (collection || multiplier_collection == NULL)
+                if (collection->parent_idx != -1 ||
+                    multiplier_collection == NULL)
                         usage->resolution_multiplier = effective_multiplier;
 
         }
@@ -1044,9 +1045,9 @@ static void hid_apply_multiplier(struct hid_device *hid,
          * applicable fields later.
          */
         multiplier_collection = &hid->collection[multiplier->usage->collection_index];
-        while (multiplier_collection &&
+        while (multiplier_collection->parent_idx != -1 &&
                multiplier_collection->type != HID_COLLECTION_LOGICAL)
-                multiplier_collection = multiplier_collection->parent;
+                multiplier_collection = &hid->collection[multiplier_collection->parent_idx];
 
         effective_multiplier = hid_calculate_multiplier(hid, multiplier);
 
diff --git a/drivers/hid/hid-debug.c b/drivers/hid/hid-debug.c
index c530476edba6..ac9fda1b5a72 100644
--- a/drivers/hid/hid-debug.c
+++ b/drivers/hid/hid-debug.c
@@ -30,6 +30,7 @@
 
 #include <linux/debugfs.h>
 #include <linux/seq_file.h>
+#include <linux/kfifo.h>
 #include <linux/sched/signal.h>
 #include <linux/export.h>
 #include <linux/slab.h>
@@ -661,17 +662,12 @@ EXPORT_SYMBOL_GPL(hid_dump_device);
 /* enqueue string to 'events' ring buffer */
 void hid_debug_event(struct hid_device *hdev, char *buf)
 {
-        unsigned i;
         struct hid_debug_list *list;
         unsigned long flags;
 
         spin_lock_irqsave(&hdev->debug_list_lock, flags);
-        list_for_each_entry(list, &hdev->debug_list, node) {
-                for (i = 0; buf[i]; i++)
-                        list->hid_debug_buf[(list->tail + i) % HID_DEBUG_BUFSIZE] =
-                                buf[i];
-                list->tail = (list->tail + i) % HID_DEBUG_BUFSIZE;
-        }
+        list_for_each_entry(list, &hdev->debug_list, node)
+                kfifo_in(&list->hid_debug_fifo, buf, strlen(buf));
         spin_unlock_irqrestore(&hdev->debug_list_lock, flags);
 
         wake_up_interruptible(&hdev->debug_wait);
@@ -722,8 +718,7 @@ void hid_dump_input(struct hid_device *hdev, struct hid_usage *usage, __s32 valu
         hid_debug_event(hdev, buf);
 
         kfree(buf);
-        wake_up_interruptible(&hdev->debug_wait);
-
+        wake_up_interruptible(&hdev->debug_wait);
 }
 EXPORT_SYMBOL_GPL(hid_dump_input);
 
@@ -1083,8 +1078,8 @@ static int hid_debug_events_open(struct inode *inode, struct file *file)
                 goto out;
         }
 
-        if (!(list->hid_debug_buf = kzalloc(HID_DEBUG_BUFSIZE, GFP_KERNEL))) {
-                err = -ENOMEM;
+        err = kfifo_alloc(&list->hid_debug_fifo, HID_DEBUG_FIFOSIZE, GFP_KERNEL);
+        if (err) {
                 kfree(list);
                 goto out;
         }
@@ -1104,77 +1099,57 @@ static ssize_t hid_debug_events_read(struct file *file, char __user *buffer,
                 size_t count, loff_t *ppos)
 {
         struct hid_debug_list *list = file->private_data;
-        int ret = 0, len;
+        int ret = 0, copied;
         DECLARE_WAITQUEUE(wait, current);
 
         mutex_lock(&list->read_mutex);
-        while (ret == 0) {
-                if (list->head == list->tail) {
-                        add_wait_queue(&list->hdev->debug_wait, &wait);
-                        set_current_state(TASK_INTERRUPTIBLE);
-
-                        while (list->head == list->tail) {
-                                if (file->f_flags & O_NONBLOCK) {
-                                        ret = -EAGAIN;
-                                        break;
-                                }
-                                if (signal_pending(current)) {
-                                        ret = -ERESTARTSYS;
-                                        break;
-                                }
+        if (kfifo_is_empty(&list->hid_debug_fifo)) {
+                add_wait_queue(&list->hdev->debug_wait, &wait);
+                set_current_state(TASK_INTERRUPTIBLE);
+
+                while (kfifo_is_empty(&list->hid_debug_fifo)) {
+                        if (file->f_flags & O_NONBLOCK) {
+                                ret = -EAGAIN;
+                                break;
+                        }
 
-                                if (!list->hdev || !list->hdev->debug) {
-                                        ret = -EIO;
-                                        set_current_state(TASK_RUNNING);
-                                        goto out;
-                                }
+                        if (signal_pending(current)) {
+                                ret = -ERESTARTSYS;
+                                break;
+                        }
 
-                                /* allow O_NONBLOCK from other threads */
-                                mutex_unlock(&list->read_mutex);
-                                schedule();
-                                mutex_lock(&list->read_mutex);
-                                set_current_state(TASK_INTERRUPTIBLE);
+                        /* if list->hdev is NULL we cannot remove_wait_queue().
+                         * if list->hdev->debug is 0 then hid_debug_unregister()
+                         * was already called and list->hdev is being destroyed.
+                         * if we add remove_wait_queue() here we can hit a race.
+                         */
+                        if (!list->hdev || !list->hdev->debug) {
+                                ret = -EIO;
+                                set_current_state(TASK_RUNNING);
+                                goto out;
                         }
 
-                        set_current_state(TASK_RUNNING);
-                        remove_wait_queue(&list->hdev->debug_wait, &wait);
+                        /* allow O_NONBLOCK from other threads */
+                        mutex_unlock(&list->read_mutex);
+                        schedule();
+                        mutex_lock(&list->read_mutex);
+                        set_current_state(TASK_INTERRUPTIBLE);
                 }
 
-                if (ret)
-                        goto out;
+                __set_current_state(TASK_RUNNING);
+                remove_wait_queue(&list->hdev->debug_wait, &wait);
 
-                /* pass the ringbuffer contents to userspace */
-copy_rest:
-                if (list->tail == list->head)
+                if (ret)
                         goto out;
-                if (list->tail > list->head) {
-                        len = list->tail - list->head;
-                        if (len > count)
-                                len = count;
-
-                        if (copy_to_user(buffer + ret, &list->hid_debug_buf[list->head], len)) {
-                                ret = -EFAULT;
-                                goto out;
-                        }
-                        ret += len;
-                        list->head += len;
-                } else {
-                        len = HID_DEBUG_BUFSIZE - list->head;
-                        if (len > count)
-                                len = count;
-
-                        if (copy_to_user(buffer, &list->hid_debug_buf[list->head], len)) {
-                                ret = -EFAULT;
-                                goto out;
-                        }
-                        list->head = 0;
-                        ret += len;
-                        count -= len;
-                        if (count > 0)
-                                goto copy_rest;
-                }
-
         }
+
+        /* pass the fifo content to userspace, locking is not needed with only
+         * one concurrent reader and one concurrent writer
+         */
+        ret = kfifo_to_user(&list->hid_debug_fifo, buffer, count, &copied);
+        if (ret)
+                goto out;
+        ret = copied;
 out:
         mutex_unlock(&list->read_mutex);
         return ret;
@@ -1185,7 +1160,7 @@ static __poll_t hid_debug_events_poll(struct file *file, poll_table *wait)
         struct hid_debug_list *list = file->private_data;
 
         poll_wait(file, &list->hdev->debug_wait, wait);
-        if (list->head != list->tail)
+        if (!kfifo_is_empty(&list->hid_debug_fifo))
                 return EPOLLIN | EPOLLRDNORM;
         if (!list->hdev->debug)
                 return EPOLLERR | EPOLLHUP;
@@ -1200,7 +1175,7 @@ static int hid_debug_events_release(struct inode *inode, struct file *file)
         spin_lock_irqsave(&list->hdev->debug_list_lock, flags);
         list_del(&list->node);
         spin_unlock_irqrestore(&list->hdev->debug_list_lock, flags);
-        kfree(list->hid_debug_buf);
+        kfifo_free(&list->hid_debug_fifo);
         kfree(list);
 
         return 0;
@@ -1246,4 +1221,3 @@ void hid_debug_exit(void)
 {
         debugfs_remove_recursive(hid_debug_root);
 }
-
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 518fa76414f5..24f846d67478 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -461,6 +461,9 @@
 #define USB_DEVICE_ID_GENERAL_TOUCH_WIN8_PIT_010A 0x010a
 #define USB_DEVICE_ID_GENERAL_TOUCH_WIN8_PIT_E100 0xe100
 
+#define I2C_VENDOR_ID_GOODIX            0x27c6
+#define I2C_DEVICE_ID_GOODIX_01F0       0x01f0
+
 #define USB_VENDOR_ID_GOODTOUCH         0x1aad
 #define USB_DEVICE_ID_GOODTOUCH_000f    0x000f
 
diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c
index 8555ce7e737b..c5edfa966343 100644
--- a/drivers/hid/i2c-hid/i2c-hid-core.c
+++ b/drivers/hid/i2c-hid/i2c-hid-core.c
@@ -179,6 +179,8 @@ static const struct i2c_hid_quirks {
                 I2C_HID_QUIRK_DELAY_AFTER_SLEEP },
         { USB_VENDOR_ID_LG, I2C_DEVICE_ID_LG_8001,
                 I2C_HID_QUIRK_NO_RUNTIME_PM },
+        { I2C_VENDOR_ID_GOODIX, I2C_DEVICE_ID_GOODIX_01F0,
+                I2C_HID_QUIRK_NO_RUNTIME_PM },
         { 0, 0 }
 };
 
diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c
index ce0ba2062723..bea4c9850247 100644
--- a/drivers/hv/channel.c
+++ b/drivers/hv/channel.c
@@ -701,19 +701,12 @@ static int vmbus_close_internal(struct vmbus_channel *channel)
 int vmbus_disconnect_ring(struct vmbus_channel *channel)
 {
         struct vmbus_channel *cur_channel, *tmp;
-        unsigned long flags;
-        LIST_HEAD(list);
         int ret;
 
         if (channel->primary_channel != NULL)
                 return -EINVAL;
 
-        /* Snapshot the list of subchannels */
-        spin_lock_irqsave(&channel->lock, flags);
-        list_splice_init(&channel->sc_list, &list);
-        spin_unlock_irqrestore(&channel->lock, flags);
-
-        list_for_each_entry_safe(cur_channel, tmp, &list, sc_list) {
+        list_for_each_entry_safe(cur_channel, tmp, &channel->sc_list, sc_list) {
                 if (cur_channel->rescind)
                         wait_for_completion(&cur_channel->rescind_event);
 
diff --git a/drivers/hv/hv_balloon.c b/drivers/hv/hv_balloon.c
index 5301fef16c31..7c6349a50ef1 100644
--- a/drivers/hv/hv_balloon.c
+++ b/drivers/hv/hv_balloon.c
@@ -888,12 +888,14 @@ static unsigned long handle_pg_range(unsigned long pg_start,
                         pfn_cnt -= pgs_ol;
                         /*
                          * Check if the corresponding memory block is already
-                         * online by checking its last previously backed page.
-                         * In case it is we need to bring rest (which was not
-                         * backed previously) online too.
+                         * online. It is possible to observe struct pages still
+                         * being uninitialized here so check section instead.
+                         * In case the section is online we need to bring the
+                         * rest of pfns (which were not backed previously)
+                         * online too.
                          */
                         if (start_pfn > has->start_pfn &&
-                            !PageReserved(pfn_to_page(start_pfn - 1)))
+                            online_section_nr(pfn_to_section_nr(start_pfn)))
                                 hv_bring_pgs_online(has, start_pfn, pgs_ol);
 
                 }
diff --git a/drivers/hv/ring_buffer.c b/drivers/hv/ring_buffer.c
index 64d0c85d5161..1f1a55e07733 100644
--- a/drivers/hv/ring_buffer.c
+++ b/drivers/hv/ring_buffer.c
@@ -164,26 +164,25 @@ hv_get_ringbuffer_availbytes(const struct hv_ring_buffer_info *rbi,
 }
 
 /* Get various debug metrics for the specified ring buffer. */
-void hv_ringbuffer_get_debuginfo(const struct hv_ring_buffer_info *ring_info,
-                                 struct hv_ring_buffer_debug_info *debug_info)
+int hv_ringbuffer_get_debuginfo(const struct hv_ring_buffer_info *ring_info,
+                                struct hv_ring_buffer_debug_info *debug_info)
 {
         u32 bytes_avail_towrite;
         u32 bytes_avail_toread;
 
-        if (ring_info->ring_buffer) {
-                hv_get_ringbuffer_availbytes(ring_info,
-                                        &bytes_avail_toread,
-                                        &bytes_avail_towrite);
-
-                debug_info->bytes_avail_toread = bytes_avail_toread;
-                debug_info->bytes_avail_towrite = bytes_avail_towrite;
-                debug_info->current_read_index =
-                        ring_info->ring_buffer->read_index;
-                debug_info->current_write_index =
-                        ring_info->ring_buffer->write_index;
-                debug_info->current_interrupt_mask =
-                        ring_info->ring_buffer->interrupt_mask;
-        }
+        if (!ring_info->ring_buffer)
+                return -EINVAL;
+
+        hv_get_ringbuffer_availbytes(ring_info,
+                                     &bytes_avail_toread,
+                                     &bytes_avail_towrite);
+        debug_info->bytes_avail_toread = bytes_avail_toread;
+        debug_info->bytes_avail_towrite = bytes_avail_towrite;
+        debug_info->current_read_index = ring_info->ring_buffer->read_index;
+        debug_info->current_write_index = ring_info->ring_buffer->write_index;
+        debug_info->current_interrupt_mask
+                = ring_info->ring_buffer->interrupt_mask;
+        return 0;
 }
 EXPORT_SYMBOL_GPL(hv_ringbuffer_get_debuginfo);
 
diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c
index d0ff65675292..403fee01572c 100644
--- a/drivers/hv/vmbus_drv.c
+++ b/drivers/hv/vmbus_drv.c
@@ -313,12 +313,16 @@ static ssize_t out_intr_mask_show(struct device *dev,
 {
         struct hv_device *hv_dev = device_to_hv_device(dev);
         struct hv_ring_buffer_debug_info outbound;
+        int ret;
 
         if (!hv_dev->channel)
                 return -ENODEV;
-        if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
-                return -EINVAL;
-        hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound, &outbound);
+
+        ret = hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound,
+                                          &outbound);
+        if (ret < 0)
+                return ret;
+
         return sprintf(buf, "%d\n", outbound.current_interrupt_mask);
 }
 static DEVICE_ATTR_RO(out_intr_mask);
@@ -328,12 +332,15 @@ static ssize_t out_read_index_show(struct device *dev,
 {
         struct hv_device *hv_dev = device_to_hv_device(dev);
         struct hv_ring_buffer_debug_info outbound;
+        int ret;
 
         if (!hv_dev->channel)
                 return -ENODEV;
-        if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
-                return -EINVAL;
-        hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound, &outbound);
+
+        ret = hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound,
+                                          &outbound);
+        if (ret < 0)
+                return ret;
         return sprintf(buf, "%d\n", outbound.current_read_index);
 }
 static DEVICE_ATTR_RO(out_read_index);
@@ -344,12 +351,15 @@ static ssize_t out_write_index_show(struct device *dev,
 {
         struct hv_device *hv_dev = device_to_hv_device(dev);
         struct hv_ring_buffer_debug_info outbound;
+        int ret;
 
         if (!hv_dev->channel)
                 return -ENODEV;
-        if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
-                return -EINVAL;
-        hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound, &outbound);
+
+        ret = hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound,
+                                          &outbound);
+        if (ret < 0)
+                return ret;
         return sprintf(buf, "%d\n", outbound.current_write_index);
 }
 static DEVICE_ATTR_RO(out_write_index);
@@ -360,12 +370,15 @@ static ssize_t out_read_bytes_avail_show(struct device *dev,
 {
         struct hv_device *hv_dev = device_to_hv_device(dev);
         struct hv_ring_buffer_debug_info outbound;
+        int ret;
 
         if (!hv_dev->channel)
                 return -ENODEV;
-        if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
-                return -EINVAL;
-        hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound, &outbound);
+
+        ret = hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound,
+                                          &outbound);
+        if (ret < 0)
+                return ret;
         return sprintf(buf, "%d\n", outbound.bytes_avail_toread);
 }
 static DEVICE_ATTR_RO(out_read_bytes_avail);
@@ -376,12 +389,15 @@ static ssize_t out_write_bytes_avail_show(struct device *dev,
 {
         struct hv_device *hv_dev = device_to_hv_device(dev);
         struct hv_ring_buffer_debug_info outbound;
+        int ret;
 
         if (!hv_dev->channel)
                 return -ENODEV;
-        if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
-                return -EINVAL;
-        hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound, &outbound);
+
+        ret = hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound,
+                                          &outbound);
+        if (ret < 0)
+                return ret;
         return sprintf(buf, "%d\n", outbound.bytes_avail_towrite);
 }
 static DEVICE_ATTR_RO(out_write_bytes_avail);
@@ -391,12 +407,15 @@ static ssize_t in_intr_mask_show(struct device *dev,
 {
         struct hv_device *hv_dev = device_to_hv_device(dev);
         struct hv_ring_buffer_debug_info inbound;
+        int ret;
 
         if (!hv_dev->channel)
                 return -ENODEV;
-        if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
-                return -EINVAL;
-        hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound);
+
+        ret = hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound);
+        if (ret < 0)
+                return ret;
+
         return sprintf(buf, "%d\n", inbound.current_interrupt_mask);
 }
 static DEVICE_ATTR_RO(in_intr_mask);
@@ -406,12 +425,15 @@ static ssize_t in_read_index_show(struct device *dev,
 {
         struct hv_device *hv_dev = device_to_hv_device(dev);
         struct hv_ring_buffer_debug_info inbound;
+        int ret;
 
         if (!hv_dev->channel)
                 return -ENODEV;
-        if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
-                return -EINVAL;
-        hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound);
+
+        ret = hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound);
+        if (ret < 0)
+                return ret;
+
         return sprintf(buf, "%d\n", inbound.current_read_index);
 }
 static DEVICE_ATTR_RO(in_read_index);
@@ -421,12 +443,15 @@ static ssize_t in_write_index_show(struct device *dev,
 {
         struct hv_device *hv_dev = device_to_hv_device(dev);
         struct hv_ring_buffer_debug_info inbound;
+        int ret;
 
         if (!hv_dev->channel)
                 return -ENODEV;
-        if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
-                return -EINVAL;
-        hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound);
+
+        ret = hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound);
+        if (ret < 0)
+                return ret;
+
         return sprintf(buf, "%d\n", inbound.current_write_index);
 }
 static DEVICE_ATTR_RO(in_write_index);
@@ -437,12 +462,15 @@ static ssize_t in_read_bytes_avail_show(struct device *dev,
 {
         struct hv_device *hv_dev = device_to_hv_device(dev);
         struct hv_ring_buffer_debug_info inbound;
+        int ret;
 
         if (!hv_dev->channel)
                 return -ENODEV;
-        if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
-                return -EINVAL;
-        hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound);
+
+        ret = hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound);
+        if (ret < 0)
+                return ret;
+
         return sprintf(buf, "%d\n", inbound.bytes_avail_toread);
 }
 static DEVICE_ATTR_RO(in_read_bytes_avail);
@@ -453,12 +481,15 @@ static ssize_t in_write_bytes_avail_show(struct device *dev,
 {
         struct hv_device *hv_dev = device_to_hv_device(dev);
         struct hv_ring_buffer_debug_info inbound;
+        int ret;
 
         if (!hv_dev->channel)
                 return -ENODEV;
-        if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
-                return -EINVAL;
-        hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound);
+
+        ret = hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound);
+        if (ret < 0)
+                return ret;
+
         return sprintf(buf, "%d\n", inbound.bytes_avail_towrite);
 }
 static DEVICE_ATTR_RO(in_write_bytes_avail);
diff --git a/drivers/i2c/busses/i2c-omap.c b/drivers/i2c/busses/i2c-omap.c
index b1086bfb0465..cd9c65f3d404 100644
--- a/drivers/i2c/busses/i2c-omap.c
+++ b/drivers/i2c/busses/i2c-omap.c
@@ -1500,8 +1500,7 @@ static int omap_i2c_remove(struct platform_device *pdev)
         return 0;
 }
 
-#ifdef CONFIG_PM
-static int omap_i2c_runtime_suspend(struct device *dev)
+static int __maybe_unused omap_i2c_runtime_suspend(struct device *dev)
 {
         struct omap_i2c_dev *omap = dev_get_drvdata(dev);
 
@@ -1527,7 +1526,7 @@ static int omap_i2c_runtime_suspend(struct device *dev)
         return 0;
 }
 
-static int omap_i2c_runtime_resume(struct device *dev)
+static int __maybe_unused omap_i2c_runtime_resume(struct device *dev)
 {
         struct omap_i2c_dev *omap = dev_get_drvdata(dev);
 
@@ -1542,20 +1541,18 @@ static int omap_i2c_runtime_resume(struct device *dev)
 }
 
 static const struct dev_pm_ops omap_i2c_pm_ops = {
+        SET_NOIRQ_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend,
+                                      pm_runtime_force_resume)
         SET_RUNTIME_PM_OPS(omap_i2c_runtime_suspend,
                            omap_i2c_runtime_resume, NULL)
 };
-#define OMAP_I2C_PM_OPS (&omap_i2c_pm_ops)
-#else
-#define OMAP_I2C_PM_OPS NULL
-#endif /* CONFIG_PM */
 
 static struct platform_driver omap_i2c_driver = {
         .probe          = omap_i2c_probe,
         .remove         = omap_i2c_remove,
         .driver         = {
                 .name   = "omap_i2c",
-                .pm     = OMAP_I2C_PM_OPS,
+                .pm     = &omap_i2c_pm_ops,
                 .of_match_table = of_match_ptr(omap_i2c_of_match),
         },
 };
diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c
index c39f89d2deba..2dc628d4f1ae 100644
--- a/drivers/i3c/master.c
+++ b/drivers/i3c/master.c
@@ -1828,7 +1828,7 @@ int i3c_master_add_i3c_dev_locked(struct i3c_master_controller *master,
 
         ret = i3c_master_retrieve_dev_info(newdev);
         if (ret)
-                goto err_free_dev;
+                goto err_detach_dev;
 
         olddev = i3c_master_search_i3c_dev_duplicate(newdev);
         if (olddev) {
diff --git a/drivers/i3c/master/dw-i3c-master.c b/drivers/i3c/master/dw-i3c-master.c
index f8c00b94817f..bb03079fbade 100644
--- a/drivers/i3c/master/dw-i3c-master.c
+++ b/drivers/i3c/master/dw-i3c-master.c
@@ -419,12 +419,9 @@ static void dw_i3c_master_enqueue_xfer(struct dw_i3c_master *master,
         spin_unlock_irqrestore(&master->xferqueue.lock, flags);
 }
 
-static void dw_i3c_master_dequeue_xfer(struct dw_i3c_master *master,
-                                       struct dw_i3c_xfer *xfer)
+static void dw_i3c_master_dequeue_xfer_locked(struct dw_i3c_master *master,
+                                              struct dw_i3c_xfer *xfer)
 {
-        unsigned long flags;
-
-        spin_lock_irqsave(&master->xferqueue.lock, flags);
         if (master->xferqueue.cur == xfer) {
                 u32 status;
 
@@ -439,6 +436,15 @@ static void dw_i3c_master_dequeue_xfer(struct dw_i3c_master *master,
         } else {
                 list_del_init(&xfer->node);
         }
+}
+
+static void dw_i3c_master_dequeue_xfer(struct dw_i3c_master *master,
+                                       struct dw_i3c_xfer *xfer)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&master->xferqueue.lock, flags);
+        dw_i3c_master_dequeue_xfer_locked(master, xfer);
         spin_unlock_irqrestore(&master->xferqueue.lock, flags);
 }
 
@@ -494,7 +500,7 @@ static void dw_i3c_master_end_xfer_locked(struct dw_i3c_master *master, u32 isr)
         complete(&xfer->comp);
 
         if (ret < 0) {
-                dw_i3c_master_dequeue_xfer(master, xfer);
+                dw_i3c_master_dequeue_xfer_locked(master, xfer);
                 writel(readl(master->regs + DEVICE_CTRL) | DEV_CTRL_RESUME,
                        master->regs + DEVICE_CTRL);
         }
diff --git a/drivers/ide/ide-atapi.c b/drivers/ide/ide-atapi.c
index da58020a144e..33a28cde126c 100644
--- a/drivers/ide/ide-atapi.c
+++ b/drivers/ide/ide-atapi.c
@@ -235,21 +235,28 @@ EXPORT_SYMBOL_GPL(ide_prep_sense);
 
 int ide_queue_sense_rq(ide_drive_t *drive, void *special)
 {
-        struct request *sense_rq = drive->sense_rq;
+        ide_hwif_t *hwif = drive->hwif;
+        struct request *sense_rq;
+        unsigned long flags;
+
+        spin_lock_irqsave(&hwif->lock, flags);
 
         /* deferred failure from ide_prep_sense() */
         if (!drive->sense_rq_armed) {
                 printk(KERN_WARNING PFX "%s: error queuing a sense request\n",
                        drive->name);
+                spin_unlock_irqrestore(&hwif->lock, flags);
                 return -ENOMEM;
         }
 
+        sense_rq = drive->sense_rq;
         ide_req(sense_rq)->special = special;
         drive->sense_rq_armed = false;
 
         drive->hwif->rq = NULL;
 
         ide_insert_request_head(drive, sense_rq);
+        spin_unlock_irqrestore(&hwif->lock, flags);
         return 0;
 }
 EXPORT_SYMBOL_GPL(ide_queue_sense_rq);
diff --git a/drivers/ide/ide-io.c b/drivers/ide/ide-io.c
index 8445b484ae69..b137f27a34d5 100644
--- a/drivers/ide/ide-io.c
+++ b/drivers/ide/ide-io.c
@@ -68,8 +68,10 @@ int ide_end_rq(ide_drive_t *drive, struct request *rq, blk_status_t error,
         }
 
         if (!blk_update_request(rq, error, nr_bytes)) {
-                if (rq == drive->sense_rq)
+                if (rq == drive->sense_rq) {
                         drive->sense_rq = NULL;
+                        drive->sense_rq_active = false;
+                }
 
                 __blk_mq_end_request(rq, error);
                 return 0;
@@ -451,16 +453,11 @@ void ide_requeue_and_plug(ide_drive_t *drive, struct request *rq)
                 blk_mq_delay_run_hw_queue(q->queue_hw_ctx[0], 3);
 }
 
-/*
- * Issue a new request to a device.
- */
-blk_status_t ide_queue_rq(struct blk_mq_hw_ctx *hctx,
-                          const struct blk_mq_queue_data *bd)
+blk_status_t ide_issue_rq(ide_drive_t *drive, struct request *rq,
+                          bool local_requeue)
 {
-        ide_drive_t     *drive = hctx->queue->queuedata;
-        ide_hwif_t      *hwif = drive->hwif;
+        ide_hwif_t *hwif = drive->hwif;
         struct ide_host *host = hwif->host;
-        struct request  *rq = bd->rq;
         ide_startstop_t startstop;
 
         if (!blk_rq_is_passthrough(rq) && !(rq->rq_flags & RQF_DONTPREP)) {
@@ -474,8 +471,6 @@ blk_status_t ide_queue_rq(struct blk_mq_hw_ctx *hctx,
         if (ide_lock_host(host, hwif))
                 return BLK_STS_DEV_RESOURCE;
 
-        blk_mq_start_request(rq);
-
         spin_lock_irq(&hwif->lock);
 
         if (!ide_lock_port(hwif)) {
@@ -511,18 +506,6 @@ repeat:
                 drive->dev_flags &= ~(IDE_DFLAG_SLEEPING | IDE_DFLAG_PARKED);
 
                 /*
-                 * we know that the queue isn't empty, but this can happen
-                 * if ->prep_rq() decides to kill a request
-                 */
-                if (!rq) {
-                        rq = bd->rq;
-                        if (!rq) {
-                                ide_unlock_port(hwif);
-                                goto out;
-                        }
-                }
-
-                /*
                  * Sanity: don't accept a request that isn't a PM request
                  * if we are currently power managed. This is very important as
                  * blk_stop_queue() doesn't prevent the blk_fetch_request()
@@ -560,9 +543,12 @@ repeat:
                 }
         } else {
 plug_device:
+                if (local_requeue)
+                        list_add(&rq->queuelist, &drive->rq_list);
                 spin_unlock_irq(&hwif->lock);
                 ide_unlock_host(host);
-                ide_requeue_and_plug(drive, rq);
+                if (!local_requeue)
+                        ide_requeue_and_plug(drive, rq);
                 return BLK_STS_OK;
         }
 
@@ -573,6 +559,26 @@ out:
         return BLK_STS_OK;
 }
 
+/*
+ * Issue a new request to a device.
+ */
+blk_status_t ide_queue_rq(struct blk_mq_hw_ctx *hctx,
+                          const struct blk_mq_queue_data *bd)
+{
+        ide_drive_t *drive = hctx->queue->queuedata;
+        ide_hwif_t *hwif = drive->hwif;
+
+        spin_lock_irq(&hwif->lock);
+        if (drive->sense_rq_active) {
+                spin_unlock_irq(&hwif->lock);
+                return BLK_STS_DEV_RESOURCE;
+        }
+        spin_unlock_irq(&hwif->lock);
+
+        blk_mq_start_request(bd->rq);
+        return ide_issue_rq(drive, bd->rq, false);
+}
+
 static int drive_is_ready(ide_drive_t *drive)
 {
         ide_hwif_t *hwif = drive->hwif;
@@ -893,13 +899,8 @@ EXPORT_SYMBOL_GPL(ide_pad_transfer);
 
 void ide_insert_request_head(ide_drive_t *drive, struct request *rq)
 {
-        ide_hwif_t *hwif = drive->hwif;
-        unsigned long flags;
-
-        spin_lock_irqsave(&hwif->lock, flags);
+        drive->sense_rq_active = true;
         list_add_tail(&rq->queuelist, &drive->rq_list);
-        spin_unlock_irqrestore(&hwif->lock, flags);
-
         kblockd_schedule_work(&drive->rq_work);
 }
 EXPORT_SYMBOL_GPL(ide_insert_request_head);
diff --git a/drivers/ide/ide-park.c b/drivers/ide/ide-park.c
index 102aa3bc3e7f..8af7af6001eb 100644
--- a/drivers/ide/ide-park.c
+++ b/drivers/ide/ide-park.c
@@ -54,7 +54,9 @@ static void issue_park_cmd(ide_drive_t *drive, unsigned long timeout)
         scsi_req(rq)->cmd[0] = REQ_UNPARK_HEADS;
         scsi_req(rq)->cmd_len = 1;
         ide_req(rq)->type = ATA_PRIV_MISC;
+        spin_lock_irq(&hwif->lock);
         ide_insert_request_head(drive, rq);
+        spin_unlock_irq(&hwif->lock);
 
 out:
         return;
diff --git a/drivers/ide/ide-probe.c b/drivers/ide/ide-probe.c
index 63627be0811a..5aeaca24a28f 100644
--- a/drivers/ide/ide-probe.c
+++ b/drivers/ide/ide-probe.c
@@ -1159,18 +1159,27 @@ static void drive_rq_insert_work(struct work_struct *work)
         ide_drive_t *drive = container_of(work, ide_drive_t, rq_work);
         ide_hwif_t *hwif = drive->hwif;
         struct request *rq;
+        blk_status_t ret;
         LIST_HEAD(list);
 
-        spin_lock_irq(&hwif->lock);
-        if (!list_empty(&drive->rq_list))
-                list_splice_init(&drive->rq_list, &list);
-        spin_unlock_irq(&hwif->lock);
+        blk_mq_quiesce_queue(drive->queue);
 
-        while (!list_empty(&list)) {
-                rq = list_first_entry(&list, struct request, queuelist);
+        ret = BLK_STS_OK;
+        spin_lock_irq(&hwif->lock);
+        while (!list_empty(&drive->rq_list)) {
+                rq = list_first_entry(&drive->rq_list, struct request, queuelist);
                 list_del_init(&rq->queuelist);
-                blk_execute_rq_nowait(drive->queue, rq->rq_disk, rq, true, NULL);
+
+                spin_unlock_irq(&hwif->lock);
+                ret = ide_issue_rq(drive, rq, true);
+                spin_lock_irq(&hwif->lock);
         }
+        spin_unlock_irq(&hwif->lock);
+
+        blk_mq_unquiesce_queue(drive->queue);
+
+        if (ret != BLK_STS_OK)
+                kblockd_schedule_work(&drive->rq_work);
 }
 
 static const u8 ide_hwif_to_major[] =
diff --git a/drivers/ide/ide-proc.c b/drivers/ide/ide-proc.c
index 4c8c7a620d08..a5dc13576394 100644
--- a/drivers/ide/ide-proc.c
+++ b/drivers/ide/ide-proc.c
@@ -544,7 +544,7 @@ void ide_proc_port_register_devices(ide_hwif_t *hwif)
                 drive->proc = proc_mkdir(drive->name, parent);
                 if (drive->proc) {
                         ide_add_proc_entries(drive->proc, generic_drive_entries, drive);
-                        proc_create_data("setting", S_IFREG|S_IRUSR|S_IWUSR,
+                        proc_create_data("settings", S_IFREG|S_IRUSR|S_IWUSR,
                                         drive->proc, &ide_settings_proc_fops,
                                         drive);
                 }
diff --git a/drivers/iio/adc/axp288_adc.c b/drivers/iio/adc/axp288_adc.c
index 031d568b4972..4e339cfd0c54 100644
--- a/drivers/iio/adc/axp288_adc.c
+++ b/drivers/iio/adc/axp288_adc.c
@@ -27,9 +27,18 @@
 #include <linux/iio/machine.h>
 #include <linux/iio/driver.h>
 
-#define AXP288_ADC_EN_MASK              0xF1
-#define AXP288_ADC_TS_PIN_GPADC         0xF2
-#define AXP288_ADC_TS_PIN_ON            0xF3
+/*
+ * This mask enables all ADCs except for the battery temp-sensor (TS), that is
+ * left as-is to avoid breaking charging on devices without a temp-sensor.
+ */
+#define AXP288_ADC_EN_MASK                              0xF0
+#define AXP288_ADC_TS_ENABLE                            0x01
+
+#define AXP288_ADC_TS_CURRENT_ON_OFF_MASK               GENMASK(1, 0)
+#define AXP288_ADC_TS_CURRENT_OFF                       (0 << 0)
+#define AXP288_ADC_TS_CURRENT_ON_WHEN_CHARGING          (1 << 0)
+#define AXP288_ADC_TS_CURRENT_ON_ONDEMAND               (2 << 0)
+#define AXP288_ADC_TS_CURRENT_ON                        (3 << 0)
 
 enum axp288_adc_id {
         AXP288_ADC_TS,
@@ -44,6 +53,7 @@ enum axp288_adc_id {
 struct axp288_adc_info {
         int irq;
         struct regmap *regmap;
+        bool ts_enabled;
 };
 
 static const struct iio_chan_spec axp288_adc_channels[] = {
@@ -115,21 +125,33 @@ static int axp288_adc_read_channel(int *val, unsigned long address,
         return IIO_VAL_INT;
 }
 
-static int axp288_adc_set_ts(struct regmap *regmap, unsigned int mode,
-                                unsigned long address)
+/*
+ * The current-source used for the battery temp-sensor (TS) is shared
+ * with the GPADC. For proper fuel-gauge and charger operation the TS
+ * current-source needs to be permanently on. But to read the GPADC we
+ * need to temporary switch the TS current-source to ondemand, so that
+ * the GPADC can use it, otherwise we will always read an all 0 value.
+ */
+static int axp288_adc_set_ts(struct axp288_adc_info *info,
+                             unsigned int mode, unsigned long address)
 {
         int ret;
 
-        /* channels other than GPADC do not need to switch TS pin */
+        /* No need to switch the current-source if the TS pin is disabled */
+        if (!info->ts_enabled)
+                return 0;
+
+        /* Channels other than GPADC do not need the current source */
         if (address != AXP288_GP_ADC_H)
                 return 0;
 
-        ret = regmap_write(regmap, AXP288_ADC_TS_PIN_CTRL, mode);
+        ret = regmap_update_bits(info->regmap, AXP288_ADC_TS_PIN_CTRL,
+                                 AXP288_ADC_TS_CURRENT_ON_OFF_MASK, mode);
         if (ret)
                 return ret;
 
         /* When switching to the GPADC pin give things some time to settle */
-        if (mode == AXP288_ADC_TS_PIN_GPADC)
+        if (mode == AXP288_ADC_TS_CURRENT_ON_ONDEMAND)
                 usleep_range(6000, 10000);
 
         return 0;
@@ -145,14 +167,14 @@ static int axp288_adc_read_raw(struct iio_dev *indio_dev,
         mutex_lock(&indio_dev->mlock);
         switch (mask) {
         case IIO_CHAN_INFO_RAW:
-                if (axp288_adc_set_ts(info->regmap, AXP288_ADC_TS_PIN_GPADC,
+                if (axp288_adc_set_ts(info, AXP288_ADC_TS_CURRENT_ON_ONDEMAND,
                                         chan->address)) {
                         dev_err(&indio_dev->dev, "GPADC mode\n");
                         ret = -EINVAL;
                         break;
                 }
                 ret = axp288_adc_read_channel(val, chan->address, info->regmap);
-                if (axp288_adc_set_ts(info->regmap, AXP288_ADC_TS_PIN_ON,
+                if (axp288_adc_set_ts(info, AXP288_ADC_TS_CURRENT_ON,
                                                 chan->address))
                         dev_err(&indio_dev->dev, "TS pin restore\n");
                 break;
@@ -164,13 +186,35 @@ static int axp288_adc_read_raw(struct iio_dev *indio_dev,
         return ret;
 }
 
-static int axp288_adc_set_state(struct regmap *regmap)
+static int axp288_adc_initialize(struct axp288_adc_info *info)
 {
-        /* ADC should be always enabled for internal FG to function */
-        if (regmap_write(regmap, AXP288_ADC_TS_PIN_CTRL, AXP288_ADC_TS_PIN_ON))
-                return -EIO;
+        int ret, adc_enable_val;
+
+        /*
+         * Determine if the TS pin is enabled and set the TS current-source
+         * accordingly.
+         */
+        ret = regmap_read(info->regmap, AXP20X_ADC_EN1, &adc_enable_val);
+        if (ret)
+                return ret;
+
+        if (adc_enable_val & AXP288_ADC_TS_ENABLE) {
+                info->ts_enabled = true;
+                ret = regmap_update_bits(info->regmap, AXP288_ADC_TS_PIN_CTRL,
+                                         AXP288_ADC_TS_CURRENT_ON_OFF_MASK,
+                                         AXP288_ADC_TS_CURRENT_ON);
+        } else {
+                info->ts_enabled = false;
+                ret = regmap_update_bits(info->regmap, AXP288_ADC_TS_PIN_CTRL,
+                                         AXP288_ADC_TS_CURRENT_ON_OFF_MASK,
+                                         AXP288_ADC_TS_CURRENT_OFF);
+        }
+        if (ret)
+                return ret;
 
-        return regmap_write(regmap, AXP20X_ADC_EN1, AXP288_ADC_EN_MASK);
+        /* Turn on the ADC for all channels except TS, leave TS as is */
+        return regmap_update_bits(info->regmap, AXP20X_ADC_EN1,
+                                  AXP288_ADC_EN_MASK, AXP288_ADC_EN_MASK);
 }
 
 static const struct iio_info axp288_adc_iio_info = {
@@ -200,7 +244,7 @@ static int axp288_adc_probe(struct platform_device *pdev)
          * Set ADC to enabled state at all time, including system suspend.
          * otherwise internal fuel gauge functionality may be affected.
          */
-        ret = axp288_adc_set_state(axp20x->regmap);
+        ret = axp288_adc_initialize(info);
         if (ret) {
                 dev_err(&pdev->dev, "unable to enable ADC device\n");
                 return ret;
diff --git a/drivers/iio/adc/ti-ads8688.c b/drivers/iio/adc/ti-ads8688.c
index 184d686ebd99..8b4568edd5cb 100644
--- a/drivers/iio/adc/ti-ads8688.c
+++ b/drivers/iio/adc/ti-ads8688.c
@@ -41,6 +41,7 @@
 
 #define ADS8688_VREF_MV                 4096
 #define ADS8688_REALBITS                16
+#define ADS8688_MAX_CHANNELS            8
 
 /*
  * enum ads8688_range - ADS8688 reference voltage range
@@ -385,7 +386,7 @@ static irqreturn_t ads8688_trigger_handler(int irq, void *p)
 {
         struct iio_poll_func *pf = p;
         struct iio_dev *indio_dev = pf->indio_dev;
-        u16 buffer[8];
+        u16 buffer[ADS8688_MAX_CHANNELS + sizeof(s64)/sizeof(u16)];
         int i, j = 0;
 
         for (i = 0; i < indio_dev->masklength; i++) {
diff --git a/drivers/iio/chemical/atlas-ph-sensor.c b/drivers/iio/chemical/atlas-ph-sensor.c
index a406ad31b096..3a20cb5d9bff 100644
--- a/drivers/iio/chemical/atlas-ph-sensor.c
+++ b/drivers/iio/chemical/atlas-ph-sensor.c
@@ -444,9 +444,8 @@ static int atlas_read_raw(struct iio_dev *indio_dev,
         case IIO_CHAN_INFO_SCALE:
                 switch (chan->type) {
                 case IIO_TEMP:
-                        *val = 1; /* 0.01 */
-                        *val2 = 100;
-                        break;
+                        *val = 10;
+                        return IIO_VAL_INT;
                 case IIO_PH:
                         *val = 1; /* 0.001 */
                         *val2 = 1000;
@@ -477,7 +476,7 @@ static int atlas_write_raw(struct iio_dev *indio_dev,
                            int val, int val2, long mask)
 {
         struct atlas_data *data = iio_priv(indio_dev);
-        __be32 reg = cpu_to_be32(val);
+        __be32 reg = cpu_to_be32(val / 10);
 
         if (val2 != 0 || val < 0 || val > 20000)
                 return -EINVAL;
diff --git a/drivers/infiniband/core/core_priv.h b/drivers/infiniband/core/core_priv.h
index 3cd830d52967..616734313f0c 100644
--- a/drivers/infiniband/core/core_priv.h
+++ b/drivers/infiniband/core/core_priv.h
@@ -267,7 +267,6 @@ static inline int ib_mad_enforce_security(struct ib_mad_agent_private *map,
 #endif
 
 struct ib_device *ib_device_get_by_index(u32 ifindex);
-void ib_device_put(struct ib_device *device);
 /* RDMA device netlink */
 void nldev_init(void);
 void nldev_exit(void);
diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
index 8872453e26c0..238ec42778ef 100644
--- a/drivers/infiniband/core/device.c
+++ b/drivers/infiniband/core/device.c
@@ -156,19 +156,26 @@ struct ib_device *ib_device_get_by_index(u32 index)
         down_read(&lists_rwsem);
         device = __ib_device_get_by_index(index);
         if (device) {
-                /* Do not return a device if unregistration has started. */
-                if (!refcount_inc_not_zero(&device->refcount))
+                if (!ib_device_try_get(device))
                         device = NULL;
         }
         up_read(&lists_rwsem);
         return device;
 }
 
+/**
+ * ib_device_put - Release IB device reference
+ * @device: device whose reference to be released
+ *
+ * ib_device_put() releases reference to the IB device to allow it to be
+ * unregistered and eventually free.
+ */
 void ib_device_put(struct ib_device *device)
 {
         if (refcount_dec_and_test(&device->refcount))
                 complete(&device->unreg_completion);
 }
+EXPORT_SYMBOL(ib_device_put);
 
 static struct ib_device *__ib_device_get_by_name(const char *name)
 {
@@ -303,7 +310,6 @@ struct ib_device *ib_alloc_device(size_t size)
         rwlock_init(&device->client_data_lock);
         INIT_LIST_HEAD(&device->client_data_list);
         INIT_LIST_HEAD(&device->port_list);
-        refcount_set(&device->refcount, 1);
         init_completion(&device->unreg_completion);
 
         return device;
@@ -620,6 +626,7 @@ int ib_register_device(struct ib_device *device, const char *name,
                 goto cg_cleanup;
         }
 
+        refcount_set(&device->refcount, 1);
         device->reg_state = IB_DEV_REGISTERED;
 
         list_for_each_entry(client, &client_list, list)
diff --git a/drivers/infiniband/core/umem_odp.c b/drivers/infiniband/core/umem_odp.c
index a4ec43093cb3..acb882f279cb 100644
--- a/drivers/infiniband/core/umem_odp.c
+++ b/drivers/infiniband/core/umem_odp.c
@@ -352,6 +352,8 @@ struct ib_umem_odp *ib_alloc_odp_umem(struct ib_ucontext_per_mm *per_mm,
         umem->writable   = 1;
         umem->is_odp = 1;
         odp_data->per_mm = per_mm;
+        umem->owning_mm  = per_mm->mm;
+        mmgrab(umem->owning_mm);
 
         mutex_init(&odp_data->umem_mutex);
         init_completion(&odp_data->notifier_completion);
@@ -384,6 +386,7 @@ struct ib_umem_odp *ib_alloc_odp_umem(struct ib_ucontext_per_mm *per_mm,
 out_page_list:
         vfree(odp_data->page_list);
 out_odp_data:
+        mmdrop(umem->owning_mm);
         kfree(odp_data);
         return ERR_PTR(ret);
 }
diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
index 2890a77339e1..5f366838b7ff 100644
--- a/drivers/infiniband/core/uverbs_main.c
+++ b/drivers/infiniband/core/uverbs_main.c
@@ -204,6 +204,9 @@ void ib_uverbs_release_file(struct kref *ref)
         if (atomic_dec_and_test(&file->device->refcount))
                 ib_uverbs_comp_dev(file->device);
 
+        if (file->async_file)
+                kref_put(&file->async_file->ref,
+                         ib_uverbs_release_async_event_file);
         put_device(&file->device->dev);
         kfree(file);
 }
@@ -964,11 +967,19 @@ void uverbs_user_mmap_disassociate(struct ib_uverbs_file *ufile)
 
                 /* Get an arbitrary mm pointer that hasn't been cleaned yet */
                 mutex_lock(&ufile->umap_lock);
-                if (!list_empty(&ufile->umaps)) {
-                        mm = list_first_entry(&ufile->umaps,
-                                              struct rdma_umap_priv, list)
-                                     ->vma->vm_mm;
-                        mmget(mm);
+                while (!list_empty(&ufile->umaps)) {
+                        int ret;
+
+                        priv = list_first_entry(&ufile->umaps,
+                                                struct rdma_umap_priv, list);
+                        mm = priv->vma->vm_mm;
+                        ret = mmget_not_zero(mm);
+                        if (!ret) {
+                                list_del_init(&priv->list);
+                                mm = NULL;
+                                continue;
+                        }
+                        break;
                 }
                 mutex_unlock(&ufile->umap_lock);
                 if (!mm)
@@ -1096,10 +1107,6 @@ static int ib_uverbs_close(struct inode *inode, struct file *filp)
         list_del_init(&file->list);
         mutex_unlock(&file->device->lists_mutex);
 
-        if (file->async_file)
-                kref_put(&file->async_file->ref,
-                         ib_uverbs_release_async_event_file);
-
         kref_put(&file->ref, ib_uverbs_release_file);
 
         return 0;
diff --git a/drivers/infiniband/core/uverbs_std_types_device.c b/drivers/infiniband/core/uverbs_std_types_device.c
index 5030ec480370..2a3f2f01028d 100644
--- a/drivers/infiniband/core/uverbs_std_types_device.c
+++ b/drivers/infiniband/core/uverbs_std_types_device.c
@@ -168,12 +168,18 @@ void copy_port_attr_to_resp(struct ib_port_attr *attr,
 static int UVERBS_HANDLER(UVERBS_METHOD_QUERY_PORT)(
         struct uverbs_attr_bundle *attrs)
 {
-        struct ib_device *ib_dev = attrs->ufile->device->ib_dev;
+        struct ib_device *ib_dev;
         struct ib_port_attr attr = {};
         struct ib_uverbs_query_port_resp_ex resp = {};
+        struct ib_ucontext *ucontext;
         int ret;
         u8 port_num;
 
+        ucontext = ib_uverbs_get_ucontext(attrs);
+        if (IS_ERR(ucontext))
+                return PTR_ERR(ucontext);
+        ib_dev = ucontext->device;
+
         /* FIXME: Extend the UAPI_DEF_OBJ_NEEDS_FN stuff.. */
         if (!ib_dev->ops.query_port)
                 return -EOPNOTSUPP;
diff --git a/drivers/infiniband/hw/hfi1/file_ops.c b/drivers/infiniband/hw/hfi1/file_ops.c
index c22ebc774a6a..f9a7e9d29c8b 100644
--- a/drivers/infiniband/hw/hfi1/file_ops.c
+++ b/drivers/infiniband/hw/hfi1/file_ops.c
@@ -488,7 +488,7 @@ static int hfi1_file_mmap(struct file *fp, struct vm_area_struct *vma)
                 vmf = 1;
                 break;
         case STATUS:
-                if (flags & (unsigned long)(VM_WRITE | VM_EXEC)) {
+                if (flags & VM_WRITE) {
                         ret = -EPERM;
                         goto done;
                 }
diff --git a/drivers/infiniband/hw/hfi1/ud.c b/drivers/infiniband/hw/hfi1/ud.c
index 88242fe95eaa..bf96067876c9 100644
--- a/drivers/infiniband/hw/hfi1/ud.c
+++ b/drivers/infiniband/hw/hfi1/ud.c
@@ -987,7 +987,6 @@ void hfi1_ud_rcv(struct hfi1_packet *packet)
             opcode == IB_OPCODE_UD_SEND_ONLY_WITH_IMMEDIATE) {
                 wc.ex.imm_data = packet->ohdr->u.ud.imm_data;
                 wc.wc_flags = IB_WC_WITH_IMM;
-                tlen -= sizeof(u32);
         } else if (opcode == IB_OPCODE_UD_SEND_ONLY) {
                 wc.ex.imm_data = 0;
                 wc.wc_flags = 0;
diff --git a/drivers/infiniband/hw/hns/hns_roce_srq.c b/drivers/infiniband/hw/hns/hns_roce_srq.c
index 960b1946c365..12deacf442cf 100644
--- a/drivers/infiniband/hw/hns/hns_roce_srq.c
+++ b/drivers/infiniband/hw/hns/hns_roce_srq.c
@@ -210,6 +210,7 @@ struct ib_srq *hns_roce_create_srq(struct ib_pd *pd,
                                    struct ib_udata *udata)
 {
         struct hns_roce_dev *hr_dev = to_hr_dev(pd->device);
+        struct hns_roce_ib_create_srq_resp resp = {};
         struct hns_roce_srq *srq;
         int srq_desc_size;
         int srq_buf_size;
@@ -378,16 +379,21 @@ struct ib_srq *hns_roce_create_srq(struct ib_pd *pd,
 
         srq->event = hns_roce_ib_srq_event;
         srq->ibsrq.ext.xrc.srq_num = srq->srqn;
+        resp.srqn = srq->srqn;
 
         if (udata) {
-                if (ib_copy_to_udata(udata, &srq->srqn, sizeof(__u32))) {
+                if (ib_copy_to_udata(udata, &resp,
+                                     min(udata->outlen, sizeof(resp)))) {
                         ret = -EFAULT;
-                        goto err_wrid;
+                        goto err_srqc_alloc;
                 }
         }
 
         return &srq->ibsrq;
 
+err_srqc_alloc:
+        hns_roce_srq_free(hr_dev, srq);
+
 err_wrid:
         kvfree(srq->wrid);
 
diff --git a/drivers/infiniband/hw/mlx4/mad.c b/drivers/infiniband/hw/mlx4/mad.c
index 25439da8976c..936ee1314bcd 100644
--- a/drivers/infiniband/hw/mlx4/mad.c
+++ b/drivers/infiniband/hw/mlx4/mad.c
@@ -1411,7 +1411,7 @@ int mlx4_ib_send_to_wire(struct mlx4_ib_dev *dev, int slave, u8 port,
 
         sqp_mad = (struct mlx4_mad_snd_buf *) (sqp->tx_ring[wire_tx_ix].buf.addr);
         if (sqp->tx_ring[wire_tx_ix].ah)
-                rdma_destroy_ah(sqp->tx_ring[wire_tx_ix].ah, 0);
+                mlx4_ib_destroy_ah(sqp->tx_ring[wire_tx_ix].ah, 0);
         sqp->tx_ring[wire_tx_ix].ah = ah;
         ib_dma_sync_single_for_cpu(&dev->ib_dev,
                                    sqp->tx_ring[wire_tx_ix].buf.map,
@@ -1902,7 +1902,7 @@ static void mlx4_ib_sqp_comp_worker(struct work_struct *work)
                 if (wc.status == IB_WC_SUCCESS) {
                         switch (wc.opcode) {
                         case IB_WC_SEND:
-                                rdma_destroy_ah(sqp->tx_ring[wc.wr_id &
+                                mlx4_ib_destroy_ah(sqp->tx_ring[wc.wr_id &
                                               (MLX4_NUM_TUNNEL_BUFS - 1)].ah, 0);
                                 sqp->tx_ring[wc.wr_id & (MLX4_NUM_TUNNEL_BUFS - 1)].ah
                                         = NULL;
@@ -1931,7 +1931,7 @@ static void mlx4_ib_sqp_comp_worker(struct work_struct *work)
                                  " status = %d, wrid = 0x%llx\n",
                                  ctx->slave, wc.status, wc.wr_id);
                         if (!MLX4_TUN_IS_RECV(wc.wr_id)) {
-                                rdma_destroy_ah(sqp->tx_ring[wc.wr_id &
+                                mlx4_ib_destroy_ah(sqp->tx_ring[wc.wr_id &
                                               (MLX4_NUM_TUNNEL_BUFS - 1)].ah, 0);
                                 sqp->tx_ring[wc.wr_id & (MLX4_NUM_TUNNEL_BUFS - 1)].ah
                                         = NULL;
diff --git a/drivers/infiniband/hw/mlx5/flow.c b/drivers/infiniband/hw/mlx5/flow.c
index e8a1e4498e3f..798591a18484 100644
--- a/drivers/infiniband/hw/mlx5/flow.c
+++ b/drivers/infiniband/hw/mlx5/flow.c
@@ -630,8 +630,7 @@ const struct uapi_definition mlx5_ib_flow_defs[] = {
                 UAPI_DEF_IS_OBJ_SUPPORTED(flow_is_supported)),
         UAPI_DEF_CHAIN_OBJ_TREE(
                 UVERBS_OBJECT_FLOW,
-                &mlx5_ib_fs,
-                UAPI_DEF_IS_OBJ_SUPPORTED(flow_is_supported)),
+                &mlx5_ib_fs),
         UAPI_DEF_CHAIN_OBJ_TREE(UVERBS_OBJECT_FLOW_ACTION,
                                 &mlx5_ib_flow_actions),
         {},
diff --git a/drivers/infiniband/hw/mlx5/odp.c b/drivers/infiniband/hw/mlx5/odp.c
index 01e0f6200631..4ee32964e1dd 100644
--- a/drivers/infiniband/hw/mlx5/odp.c
+++ b/drivers/infiniband/hw/mlx5/odp.c
@@ -1595,10 +1595,12 @@ static void mlx5_ib_prefetch_mr_work(struct work_struct *work)
         struct prefetch_mr_work *w =
                 container_of(work, struct prefetch_mr_work, work);
 
-        if (w->dev->ib_dev.reg_state == IB_DEV_REGISTERED)
+        if (ib_device_try_get(&w->dev->ib_dev)) {
                 mlx5_ib_prefetch_sg_list(w->dev, w->pf_flags, w->sg_list,
                                          w->num_sge);
-
+                ib_device_put(&w->dev->ib_dev);
+        }
+        put_device(&w->dev->ib_dev.dev);
         kfree(w);
 }
 
@@ -1617,15 +1619,13 @@ int mlx5_ib_advise_mr_prefetch(struct ib_pd *pd,
                 return mlx5_ib_prefetch_sg_list(dev, pf_flags, sg_list,
                                                 num_sge);
 
-        if (dev->ib_dev.reg_state != IB_DEV_REGISTERED)
-                return -ENODEV;
-
         work = kvzalloc(struct_size(work, sg_list, num_sge), GFP_KERNEL);
         if (!work)
                 return -ENOMEM;
 
         memcpy(work->sg_list, sg_list, num_sge * sizeof(struct ib_sge));
 
+        get_device(&dev->ib_dev.dev);
         work->dev = dev;
         work->pf_flags = pf_flags;
         work->num_sge = num_sge;
diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
index dd2ae640bc84..7db778d96ef5 100644
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -1912,14 +1912,16 @@ static int create_qp_common(struct mlx5_ib_dev *dev, struct ib_pd *pd,
                 }
 
                 if (!check_flags_mask(ucmd.flags,
+                                      MLX5_QP_FLAG_ALLOW_SCATTER_CQE |
+                                      MLX5_QP_FLAG_BFREG_INDEX |
+                                      MLX5_QP_FLAG_PACKET_BASED_CREDIT_MODE |
+                                      MLX5_QP_FLAG_SCATTER_CQE |
                                       MLX5_QP_FLAG_SIGNATURE |
-                                              MLX5_QP_FLAG_SCATTER_CQE |
-                                              MLX5_QP_FLAG_TUNNEL_OFFLOADS |
-                                              MLX5_QP_FLAG_BFREG_INDEX |
-                                              MLX5_QP_FLAG_TYPE_DCT |
-                                              MLX5_QP_FLAG_TYPE_DCI |
-                                              MLX5_QP_FLAG_ALLOW_SCATTER_CQE |
-                                              MLX5_QP_FLAG_PACKET_BASED_CREDIT_MODE))
+                                      MLX5_QP_FLAG_TIR_ALLOW_SELF_LB_MC |
+                                      MLX5_QP_FLAG_TIR_ALLOW_SELF_LB_UC |
+                                      MLX5_QP_FLAG_TUNNEL_OFFLOADS |
+                                      MLX5_QP_FLAG_TYPE_DCI |
+                                      MLX5_QP_FLAG_TYPE_DCT))
                         return -EINVAL;
 
                 err = get_qp_user_index(to_mucontext(pd->uobject->context),
diff --git a/drivers/infiniband/hw/qib/qib_ud.c b/drivers/infiniband/hw/qib/qib_ud.c
index 868da0ece7ba..445ea19a2ec8 100644
--- a/drivers/infiniband/hw/qib/qib_ud.c
+++ b/drivers/infiniband/hw/qib/qib_ud.c
@@ -512,7 +512,6 @@ void qib_ud_rcv(struct qib_ibport *ibp, struct ib_header *hdr,
             opcode == IB_OPCODE_UD_SEND_ONLY_WITH_IMMEDIATE) {
                 wc.ex.imm_data = ohdr->u.ud.imm_data;
                 wc.wc_flags = IB_WC_WITH_IMM;
-                tlen -= sizeof(u32);
         } else if (opcode == IB_OPCODE_UD_SEND_ONLY) {
                 wc.ex.imm_data = 0;
                 wc.wc_flags = 0;
diff --git a/drivers/infiniband/sw/rdmavt/qp.c b/drivers/infiniband/sw/rdmavt/qp.c
index a1bd8cfc2c25..c6cc3e4ab71d 100644
--- a/drivers/infiniband/sw/rdmavt/qp.c
+++ b/drivers/infiniband/sw/rdmavt/qp.c
@@ -2910,6 +2910,8 @@ send:
                         goto op_err;
                 if (!ret)
                         goto rnr_nak;
+                if (wqe->length > qp->r_len)
+                        goto inv_err;
                 break;
 
         case IB_WR_RDMA_WRITE_WITH_IMM:
@@ -3078,7 +3080,10 @@ op_err:
         goto err;
 
 inv_err:
-        send_status = IB_WC_REM_INV_REQ_ERR;
+        send_status =
+                sqp->ibqp.qp_type == IB_QPT_RC ?
+                        IB_WC_REM_INV_REQ_ERR :
+                        IB_WC_SUCCESS;
         wc.status = IB_WC_LOC_QP_OP_ERR;
         goto err;
 
diff --git a/drivers/infiniband/ulp/ipoib/ipoib.h b/drivers/infiniband/ulp/ipoib/ipoib.h
index 1da119d901a9..73e808c1e6ad 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib.h
+++ b/drivers/infiniband/ulp/ipoib/ipoib.h
@@ -248,7 +248,6 @@ struct ipoib_cm_tx {
         struct list_head     list;
         struct net_device   *dev;
         struct ipoib_neigh  *neigh;
-        struct ipoib_path   *path;
         struct ipoib_tx_buf *tx_ring;
         unsigned int         tx_head;
         unsigned int         tx_tail;
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
index 0428e01e8f69..aa9dcfc36cd3 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
@@ -1312,7 +1312,6 @@ struct ipoib_cm_tx *ipoib_cm_create_tx(struct net_device *dev, struct ipoib_path
 
         neigh->cm = tx;
         tx->neigh = neigh;
-        tx->path = path;
         tx->dev = dev;
         list_add(&tx->list, &priv->cm.start_list);
         set_bit(IPOIB_FLAG_INITIALIZED, &tx->flags);
@@ -1371,7 +1370,7 @@ static void ipoib_cm_tx_start(struct work_struct *work)
                                 neigh->daddr + QPN_AND_OPTIONS_OFFSET);
                         goto free_neigh;
                 }
-                memcpy(&pathrec, &p->path->pathrec, sizeof(pathrec));
+                memcpy(&pathrec, &path->pathrec, sizeof(pathrec));
 
                 spin_unlock_irqrestore(&priv->lock, flags);
                 netif_tx_unlock_bh(dev);
diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
index cfc8b94527b9..aa4e431cbcd3 100644
--- a/drivers/input/joystick/xpad.c
+++ b/drivers/input/joystick/xpad.c
@@ -252,6 +252,8 @@ static const struct xpad_device {
         { 0x0f30, 0x0202, "Joytech Advanced Controller", 0, XTYPE_XBOX },
         { 0x0f30, 0x8888, "BigBen XBMiniPad Controller", 0, XTYPE_XBOX },
         { 0x102c, 0xff0c, "Joytech Wireless Advanced Controller", 0, XTYPE_XBOX },
+        { 0x1038, 0x1430, "SteelSeries Stratus Duo", 0, XTYPE_XBOX360 },
+        { 0x1038, 0x1431, "SteelSeries Stratus Duo", 0, XTYPE_XBOX360 },
         { 0x11c9, 0x55f0, "Nacon GC-100XF", 0, XTYPE_XBOX360 },
         { 0x12ab, 0x0004, "Honey Bee Xbox360 dancepad", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360 },
         { 0x12ab, 0x0301, "PDP AFTERGLOW AX.1", 0, XTYPE_XBOX360 },
@@ -428,6 +430,7 @@ static const struct usb_device_id xpad_table[] = {
         XPAD_XBOXONE_VENDOR(0x0e6f),            /* 0x0e6f X-Box One controllers */
         XPAD_XBOX360_VENDOR(0x0f0d),            /* Hori Controllers */
         XPAD_XBOXONE_VENDOR(0x0f0d),            /* Hori Controllers */
+        XPAD_XBOX360_VENDOR(0x1038),            /* SteelSeries Controllers */
         XPAD_XBOX360_VENDOR(0x11c9),            /* Nacon GC100XF */
         XPAD_XBOX360_VENDOR(0x12ab),            /* X-Box 360 dance pads */
         XPAD_XBOX360_VENDOR(0x1430),            /* RedOctane X-Box 360 controllers */
diff --git a/drivers/input/misc/uinput.c b/drivers/input/misc/uinput.c
index 8ec483e8688b..26ec603fe220 100644
--- a/drivers/input/misc/uinput.c
+++ b/drivers/input/misc/uinput.c
@@ -39,6 +39,7 @@
 #include <linux/init.h>
 #include <linux/fs.h>
 #include <linux/miscdevice.h>
+#include <linux/overflow.h>
 #include <linux/input/mt.h>
 #include "../input-compat.h"
 
@@ -405,7 +406,7 @@ static int uinput_open(struct inode *inode, struct file *file)
 static int uinput_validate_absinfo(struct input_dev *dev, unsigned int code,
                                    const struct input_absinfo *abs)
 {
-        int min, max;
+        int min, max, range;
 
         min = abs->minimum;
         max = abs->maximum;
@@ -417,7 +418,7 @@ static int uinput_validate_absinfo(struct input_dev *dev, unsigned int code,
                 return -EINVAL;
         }
 
-        if (abs->flat > max - min) {
+        if (!check_sub_overflow(max, min, &range) && abs->flat > range) {
                 printk(KERN_DEBUG
                        "%s: abs_flat #%02x out of range: %d (min:%d/max:%d)\n",
                        UINPUT_NAME, code, abs->flat, min, max);
diff --git a/drivers/input/serio/olpc_apsp.c b/drivers/input/serio/olpc_apsp.c
index b36084710f69..a7cfab3db9ee 100644
--- a/drivers/input/serio/olpc_apsp.c
+++ b/drivers/input/serio/olpc_apsp.c
@@ -23,7 +23,6 @@
 #include <linux/of.h>
 #include <linux/slab.h>
 #include <linux/delay.h>
-#include <linux/clk.h>
 
 /*
  * The OLPC XO-1.75 and XO-4 laptops do not have a hardware PS/2 controller.
@@ -75,7 +74,6 @@ struct olpc_apsp {
         struct serio *kbio;
         struct serio *padio;
         void __iomem *base;
-        struct clk *clk;
         int open_count;
         int irq;
 };
@@ -148,17 +146,11 @@ static int olpc_apsp_open(struct serio *port)
         struct olpc_apsp *priv = port->port_data;
         unsigned int tmp;
         unsigned long l;
-        int error;
 
         if (priv->open_count++ == 0) {
-                error = clk_prepare_enable(priv->clk);
-                if (error)
-                        return error;
-
                 l = readl(priv->base + COMMAND_FIFO_STATUS);
                 if (!(l & CMD_STS_MASK)) {
                         dev_err(priv->dev, "SP cannot accept commands.\n");
-                        clk_disable_unprepare(priv->clk);
                         return -EIO;
                 }
 
@@ -179,8 +171,6 @@ static void olpc_apsp_close(struct serio *port)
                 /* Disable interrupt 0 */
                 tmp = readl(priv->base + PJ_INTERRUPT_MASK);
                 writel(tmp | INT_0, priv->base + PJ_INTERRUPT_MASK);
-
-                clk_disable_unprepare(priv->clk);
         }
 }
 
@@ -195,6 +185,8 @@ static int olpc_apsp_probe(struct platform_device *pdev)
         if (!priv)
                 return -ENOMEM;
 
+        priv->dev = &pdev->dev;
+
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         priv->base = devm_ioremap_resource(&pdev->dev, res);
         if (IS_ERR(priv->base)) {
@@ -206,10 +198,6 @@ static int olpc_apsp_probe(struct platform_device *pdev)
         if (priv->irq < 0)
                 return priv->irq;
 
-        priv->clk = devm_clk_get(&pdev->dev, "sp");
-        if (IS_ERR(priv->clk))
-                return PTR_ERR(priv->clk);
-
         /* KEYBOARD */
         kb_serio = kzalloc(sizeof(struct serio), GFP_KERNEL);
         if (!kb_serio)
@@ -248,7 +236,6 @@ static int olpc_apsp_probe(struct platform_device *pdev)
                 goto err_irq;
         }
 
-        priv->dev = &pdev->dev;
         device_init_wakeup(priv->dev, 1);
         platform_set_drvdata(pdev, priv);
 
diff --git a/drivers/input/touchscreen/Kconfig b/drivers/input/touchscreen/Kconfig
index af6027cc7bbf..068dbbc610fc 100644
--- a/drivers/input/touchscreen/Kconfig
+++ b/drivers/input/touchscreen/Kconfig
@@ -698,7 +698,7 @@ config TOUCHSCREEN_EDT_FT5X06
 
 config TOUCHSCREEN_RASPBERRYPI_FW
         tristate "Raspberry Pi's firmware base touch screen support"
-        depends on RASPBERRYPI_FIRMWARE || COMPILE_TEST
+        depends on RASPBERRYPI_FIRMWARE || (RASPBERRYPI_FIRMWARE=n && COMPILE_TEST)
         help
           Say Y here if you have the official Raspberry Pi 7 inch screen on
           your system.
diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
index 87ba23a75b38..2a7b78bb98b4 100644
--- a/drivers/iommu/amd_iommu.c
+++ b/drivers/iommu/amd_iommu.c
@@ -1991,16 +1991,13 @@ static void do_attach(struct iommu_dev_data *dev_data,
 
 static void do_detach(struct iommu_dev_data *dev_data)
 {
+        struct protection_domain *domain = dev_data->domain;
         struct amd_iommu *iommu;
         u16 alias;
 
         iommu = amd_iommu_rlookup_table[dev_data->devid];
         alias = dev_data->alias;
 
-        /* decrease reference counters */
-        dev_data->domain->dev_iommu[iommu->index] -= 1;
-        dev_data->domain->dev_cnt                 -= 1;
-
         /* Update data structures */
         dev_data->domain = NULL;
         list_del(&dev_data->list);
@@ -2010,6 +2007,16 @@ static void do_detach(struct iommu_dev_data *dev_data)
 
         /* Flush the DTE entry */
         device_flush_dte(dev_data);
+
+        /* Flush IOTLB */
+        domain_flush_tlb_pde(domain);
+
+        /* Wait for the flushes to finish */
+        domain_flush_complete(domain);
+
+        /* decrease reference counters - needs to happen after the flushes */
+        domain->dev_iommu[iommu->index] -= 1;
+        domain->dev_cnt                 -= 1;
 }
 
 /*
@@ -2617,13 +2624,13 @@ out_unmap:
                         bus_addr  = address + s->dma_address + (j << PAGE_SHIFT);
                         iommu_unmap_page(domain, bus_addr, PAGE_SIZE);
 
-                        if (--mapped_pages)
+                        if (--mapped_pages == 0)
                                 goto out_free_iova;
                 }
         }
 
 out_free_iova:
-        free_iova_fast(&dma_dom->iovad, address, npages);
+        free_iova_fast(&dma_dom->iovad, address >> PAGE_SHIFT, npages);
 
 out_err:
         return 0;
diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index 2bd9ac285c0d..78188bf7e90d 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -363,7 +363,7 @@ static int dmar_map_gfx = 1;
 static int dmar_forcedac;
 static int intel_iommu_strict;
 static int intel_iommu_superpage = 1;
-static int intel_iommu_sm = 1;
+static int intel_iommu_sm;
 static int iommu_identity_mapping;
 
 #define IDENTMAP_ALL            1
@@ -456,9 +456,9 @@ static int __init intel_iommu_setup(char *str)
                 } else if (!strncmp(str, "sp_off", 6)) {
                         pr_info("Disable supported super page\n");
                         intel_iommu_superpage = 0;
-                } else if (!strncmp(str, "sm_off", 6)) {
-                        pr_info("Intel-IOMMU: disable scalable mode support\n");
-                        intel_iommu_sm = 0;
+                } else if (!strncmp(str, "sm_on", 5)) {
+                        pr_info("Intel-IOMMU: scalable mode supported\n");
+                        intel_iommu_sm = 1;
                 } else if (!strncmp(str, "tboot_noforce", 13)) {
                         printk(KERN_INFO
                                 "Intel-IOMMU: not forcing on after tboot. This could expose security risk for tboot\n");
@@ -5294,7 +5294,7 @@ static void intel_iommu_put_resv_regions(struct device *dev,
         struct iommu_resv_region *entry, *next;
 
         list_for_each_entry_safe(entry, next, head, list) {
-                if (entry->type == IOMMU_RESV_RESERVED)
+                if (entry->type == IOMMU_RESV_MSI)
                         kfree(entry);
         }
 }
diff --git a/drivers/iommu/mtk_iommu_v1.c b/drivers/iommu/mtk_iommu_v1.c
index 730f7dabcf37..7e0df67bd3e9 100644
--- a/drivers/iommu/mtk_iommu_v1.c
+++ b/drivers/iommu/mtk_iommu_v1.c
@@ -441,6 +441,10 @@ static int mtk_iommu_add_device(struct device *dev)
                 iommu_spec.args_count = count;
 
                 mtk_iommu_create_mapping(dev, &iommu_spec);
+
+                /* dev->iommu_fwspec might have changed */
+                fwspec = dev_iommu_fwspec_get(dev);
+
                 of_node_put(iommu_spec.np);
         }
 
diff --git a/drivers/iommu/of_iommu.c b/drivers/iommu/of_iommu.c
index d8947b28db2d..f04a6df65eb8 100644
--- a/drivers/iommu/of_iommu.c
+++ b/drivers/iommu/of_iommu.c
@@ -224,7 +224,7 @@ const struct iommu_ops *of_iommu_configure(struct device *dev,
          * If we have reason to believe the IOMMU driver missed the initial
          * probe for dev, replay it to get things in order.
          */
-        if (dev->bus && !device_iommu_mapped(dev))
+        if (!err && dev->bus && !device_iommu_mapped(dev))
                 err = iommu_probe_device(dev);
 
         /* Ignore all other errors apart from EPROBE_DEFER */
diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index db20e992a40f..c3aba3fc818d 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -97,9 +97,14 @@ struct its_device;
  * The ITS structure - contains most of the infrastructure, with the
  * top-level MSI domain, the command queue, the collections, and the
  * list of devices writing to it.
+ *
+ * dev_alloc_lock has to be taken for device allocations, while the
+ * spinlock must be taken to parse data structures such as the device
+ * list.
  */
 struct its_node {
         raw_spinlock_t          lock;
+        struct mutex            dev_alloc_lock;
         struct list_head        entry;
         void __iomem            *base;
         phys_addr_t             phys_base;
@@ -156,6 +161,7 @@ struct its_device {
         void                    *itt;
         u32                     nr_ites;
         u32                     device_id;
+        bool                    shared;
 };
 
 static struct {
@@ -1580,6 +1586,9 @@ static unsigned long *its_lpi_alloc(int nr_irqs, u32 *base, int *nr_ids)
                 nr_irqs /= 2;
         } while (nr_irqs > 0);
 
+        if (!nr_irqs)
+                err = -ENOSPC;
+
         if (err)
                 goto out;
 
@@ -2059,6 +2068,29 @@ static int __init allocate_lpi_tables(void)
         return 0;
 }
 
+static u64 its_clear_vpend_valid(void __iomem *vlpi_base)
+{
+        u32 count = 1000000;    /* 1s! */
+        bool clean;
+        u64 val;
+
+        val = gits_read_vpendbaser(vlpi_base + GICR_VPENDBASER);
+        val &= ~GICR_VPENDBASER_Valid;
+        gits_write_vpendbaser(val, vlpi_base + GICR_VPENDBASER);
+
+        do {
+                val = gits_read_vpendbaser(vlpi_base + GICR_VPENDBASER);
+                clean = !(val & GICR_VPENDBASER_Dirty);
+                if (!clean) {
+                        count--;
+                        cpu_relax();
+                        udelay(1);
+                }
+        } while (!clean && count);
+
+        return val;
+}
+
 static void its_cpu_init_lpis(void)
 {
         void __iomem *rbase = gic_data_rdist_rd_base();
@@ -2144,6 +2176,30 @@ static void its_cpu_init_lpis(void)
         val |= GICR_CTLR_ENABLE_LPIS;
         writel_relaxed(val, rbase + GICR_CTLR);
 
+        if (gic_rdists->has_vlpis) {
+                void __iomem *vlpi_base = gic_data_rdist_vlpi_base();
+
+                /*
+                 * It's possible for CPU to receive VLPIs before it is
+                 * sheduled as a vPE, especially for the first CPU, and the
+                 * VLPI with INTID larger than 2^(IDbits+1) will be considered
+                 * as out of range and dropped by GIC.
+                 * So we initialize IDbits to known value to avoid VLPI drop.
+                 */
+                val = (LPI_NRBITS - 1) & GICR_VPROPBASER_IDBITS_MASK;
+                pr_debug("GICv4: CPU%d: Init IDbits to 0x%llx for GICR_VPROPBASER\n",
+                        smp_processor_id(), val);
+                gits_write_vpropbaser(val, vlpi_base + GICR_VPROPBASER);
+
+                /*
+                 * Also clear Valid bit of GICR_VPENDBASER, in case some
+                 * ancient programming gets left in and has possibility of
+                 * corrupting memory.
+                 */
+                val = its_clear_vpend_valid(vlpi_base);
+                WARN_ON(val & GICR_VPENDBASER_Dirty);
+        }
+
         /* Make sure the GIC has seen the above */
         dsb(sy);
 out:
@@ -2399,13 +2455,14 @@ static void its_free_device(struct its_device *its_dev)
         kfree(its_dev);
 }
 
-static int its_alloc_device_irq(struct its_device *dev, irq_hw_number_t *hwirq)
+static int its_alloc_device_irq(struct its_device *dev, int nvecs, irq_hw_number_t *hwirq)
 {
         int idx;
 
-        idx = find_first_zero_bit(dev->event_map.lpi_map,
-                                  dev->event_map.nr_lpis);
-        if (idx == dev->event_map.nr_lpis)
+        idx = bitmap_find_free_region(dev->event_map.lpi_map,
+                                      dev->event_map.nr_lpis,
+                                      get_count_order(nvecs));
+        if (idx < 0)
                 return -ENOSPC;
 
         *hwirq = dev->event_map.lpi_base + idx;
@@ -2421,6 +2478,7 @@ static int its_msi_prepare(struct irq_domain *domain, struct device *dev,
         struct its_device *its_dev;
         struct msi_domain_info *msi_info;
         u32 dev_id;
+        int err = 0;
 
         /*
          * We ignore "dev" entierely, and rely on the dev_id that has
@@ -2443,6 +2501,7 @@ static int its_msi_prepare(struct irq_domain *domain, struct device *dev,
                 return -EINVAL;
         }
 
+        mutex_lock(&its->dev_alloc_lock);
         its_dev = its_find_device(its, dev_id);
         if (its_dev) {
                 /*
@@ -2450,18 +2509,22 @@ static int its_msi_prepare(struct irq_domain *domain, struct device *dev,
                  * another alias (PCI bridge of some sort). No need to
                  * create the device.
                  */
+                its_dev->shared = true;
                 pr_debug("Reusing ITT for devID %x\n", dev_id);
                 goto out;
         }
 
         its_dev = its_create_device(its, dev_id, nvec, true);
-        if (!its_dev)
-                return -ENOMEM;
+        if (!its_dev) {
+                err = -ENOMEM;
+                goto out;
+        }
 
         pr_debug("ITT %d entries, %d bits\n", nvec, ilog2(nvec));
 out:
+        mutex_unlock(&its->dev_alloc_lock);
         info->scratchpad[0].ptr = its_dev;
-        return 0;
+        return err;
 }
 
 static struct msi_domain_ops its_msi_domain_ops = {
@@ -2501,21 +2564,21 @@ static int its_irq_domain_alloc(struct irq_domain *domain, unsigned int virq,
         int err;
         int i;
 
-        for (i = 0; i < nr_irqs; i++) {
-                err = its_alloc_device_irq(its_dev, &hwirq);
-                if (err)
-                        return err;
+        err = its_alloc_device_irq(its_dev, nr_irqs, &hwirq);
+        if (err)
+                return err;
 
-                err = its_irq_gic_domain_alloc(domain, virq + i, hwirq);
+        for (i = 0; i < nr_irqs; i++) {
+                err = its_irq_gic_domain_alloc(domain, virq + i, hwirq + i);
                 if (err)
                         return err;
 
                 irq_domain_set_hwirq_and_chip(domain, virq + i,
-                                              hwirq, &its_irq_chip, its_dev);
+                                              hwirq + i, &its_irq_chip, its_dev);
                 irqd_set_single_target(irq_desc_get_irq_data(irq_to_desc(virq + i)));
                 pr_debug("ID:%d pID:%d vID:%d\n",
-                         (int)(hwirq - its_dev->event_map.lpi_base),
-                         (int) hwirq, virq + i);
+                         (int)(hwirq + i - its_dev->event_map.lpi_base),
+                         (int)(hwirq + i), virq + i);
         }
 
         return 0;
@@ -2565,6 +2628,7 @@ static void its_irq_domain_free(struct irq_domain *domain, unsigned int virq,
 {
         struct irq_data *d = irq_domain_get_irq_data(domain, virq);
         struct its_device *its_dev = irq_data_get_irq_chip_data(d);
+        struct its_node *its = its_dev->its;
         int i;
 
         for (i = 0; i < nr_irqs; i++) {
@@ -2579,8 +2643,14 @@ static void its_irq_domain_free(struct irq_domain *domain, unsigned int virq,
                 irq_domain_reset_irq_data(data);
         }
 
-        /* If all interrupts have been freed, start mopping the floor */
-        if (bitmap_empty(its_dev->event_map.lpi_map,
+        mutex_lock(&its->dev_alloc_lock);
+
+        /*
+         * If all interrupts have been freed, start mopping the
+         * floor. This is conditionned on the device not being shared.
+         */
+        if (!its_dev->shared &&
+            bitmap_empty(its_dev->event_map.lpi_map,
                          its_dev->event_map.nr_lpis)) {
                 its_lpi_free(its_dev->event_map.lpi_map,
                              its_dev->event_map.lpi_base,
@@ -2592,6 +2662,8 @@ static void its_irq_domain_free(struct irq_domain *domain, unsigned int virq,
                 its_free_device(its_dev);
         }
 
+        mutex_unlock(&its->dev_alloc_lock);
+
         irq_domain_free_irqs_parent(domain, virq, nr_irqs);
 }
 
@@ -2754,26 +2826,11 @@ static void its_vpe_schedule(struct its_vpe *vpe)
 static void its_vpe_deschedule(struct its_vpe *vpe)
 {
         void __iomem *vlpi_base = gic_data_rdist_vlpi_base();
-        u32 count = 1000000;    /* 1s! */
-        bool clean;
         u64 val;
 
-        /* We're being scheduled out */
-        val = gits_read_vpendbaser(vlpi_base + GICR_VPENDBASER);
-        val &= ~GICR_VPENDBASER_Valid;
-        gits_write_vpendbaser(val, vlpi_base + GICR_VPENDBASER);
-
-        do {
-                val = gits_read_vpendbaser(vlpi_base + GICR_VPENDBASER);
-                clean = !(val & GICR_VPENDBASER_Dirty);
-                if (!clean) {
-                        count--;
-                        cpu_relax();
-                        udelay(1);
-                }
-        } while (!clean && count);
+        val = its_clear_vpend_valid(vlpi_base);
 
-        if (unlikely(!clean && !count)) {
+        if (unlikely(val & GICR_VPENDBASER_Dirty)) {
                 pr_err_ratelimited("ITS virtual pending table not cleaning\n");
                 vpe->idai = false;
                 vpe->pending_last = true;
@@ -3516,6 +3573,7 @@ static int __init its_probe_one(struct resource *res,
         }
 
         raw_spin_lock_init(&its->lock);
+        mutex_init(&its->dev_alloc_lock);
         INIT_LIST_HEAD(&its->entry);
         INIT_LIST_HEAD(&its->its_device_list);
         typer = gic_read_typer(its_base + GITS_TYPER);
diff --git a/drivers/irqchip/irq-gic-v3-mbi.c b/drivers/irqchip/irq-gic-v3-mbi.c
index ad70e7c416e3..fbfa7ff6deb1 100644
--- a/drivers/irqchip/irq-gic-v3-mbi.c
+++ b/drivers/irqchip/irq-gic-v3-mbi.c
@@ -24,7 +24,7 @@ struct mbi_range {
         unsigned long           *bm;
 };
 
-static struct mutex             mbi_lock;
+static DEFINE_MUTEX(mbi_lock);
 static phys_addr_t              mbi_phys_base;
 static struct mbi_range         *mbi_ranges;
 static unsigned int             mbi_range_nr;
diff --git a/drivers/irqchip/irq-madera.c b/drivers/irqchip/irq-madera.c
index e9256dee1a45..8b81271c823c 100644
--- a/drivers/irqchip/irq-madera.c
+++ b/drivers/irqchip/irq-madera.c
@@ -7,7 +7,6 @@
  */
 
 #include <linux/module.h>
-#include <linux/gpio.h>
 #include <linux/interrupt.h>
 #include <linux/irq.h>
 #include <linux/irqdomain.h>
@@ -16,7 +15,6 @@
 #include <linux/slab.h>
 #include <linux/of.h>
 #include <linux/of_device.h>
-#include <linux/of_gpio.h>
 #include <linux/of_irq.h>
 #include <linux/irqchip/irq-madera.h>
 #include <linux/mfd/madera/core.h>
diff --git a/drivers/irqchip/irq-mmp.c b/drivers/irqchip/irq-mmp.c
index 25f32e1d7764..3496b61a312a 100644
--- a/drivers/irqchip/irq-mmp.c
+++ b/drivers/irqchip/irq-mmp.c
@@ -34,6 +34,9 @@
 #define SEL_INT_PENDING         (1 << 6)
 #define SEL_INT_NUM_MASK        0x3f
 
+#define MMP2_ICU_INT_ROUTE_PJ4_IRQ      (1 << 5)
+#define MMP2_ICU_INT_ROUTE_PJ4_FIQ      (1 << 6)
+
 struct icu_chip_data {
         int                     nr_irqs;
         unsigned int            virq_base;
@@ -190,7 +193,8 @@ static const struct mmp_intc_conf mmp_conf = {
 static const struct mmp_intc_conf mmp2_conf = {
         .conf_enable    = 0x20,
         .conf_disable   = 0x0,
-        .conf_mask      = 0x7f,
+        .conf_mask      = MMP2_ICU_INT_ROUTE_PJ4_IRQ |
+                          MMP2_ICU_INT_ROUTE_PJ4_FIQ,
 };
 
 static void __exception_irq_entry mmp_handle_irq(struct pt_regs *regs)
diff --git a/drivers/irqchip/irq-stm32-exti.c b/drivers/irqchip/irq-stm32-exti.c
index 6edfd4bfa169..a93296b9b45d 100644
--- a/drivers/irqchip/irq-stm32-exti.c
+++ b/drivers/irqchip/irq-stm32-exti.c
@@ -822,6 +822,7 @@ out_unmap:
 static const struct irq_domain_ops stm32_exti_h_domain_ops = {
         .alloc  = stm32_exti_h_domain_alloc,
         .free   = irq_domain_free_irqs_common,
+        .xlate = irq_domain_xlate_twocell,
 };
 
 static int
diff --git a/drivers/irqchip/irq-xtensa-mx.c b/drivers/irqchip/irq-xtensa-mx.c
index 5385f5768345..27933338f7b3 100644
--- a/drivers/irqchip/irq-xtensa-mx.c
+++ b/drivers/irqchip/irq-xtensa-mx.c
@@ -71,14 +71,17 @@ static void xtensa_mx_irq_mask(struct irq_data *d)
         unsigned int mask = 1u << d->hwirq;
 
         if (mask & (XCHAL_INTTYPE_MASK_EXTERN_EDGE |
-                                XCHAL_INTTYPE_MASK_EXTERN_LEVEL)) {
-                set_er(1u << (xtensa_get_ext_irq_no(d->hwirq) -
-                                        HW_IRQ_MX_BASE), MIENG);
-        } else {
-                mask = __this_cpu_read(cached_irq_mask) & ~mask;
-                __this_cpu_write(cached_irq_mask, mask);
-                xtensa_set_sr(mask, intenable);
+                    XCHAL_INTTYPE_MASK_EXTERN_LEVEL)) {
+                unsigned int ext_irq = xtensa_get_ext_irq_no(d->hwirq);
+
+                if (ext_irq >= HW_IRQ_MX_BASE) {
+                        set_er(1u << (ext_irq - HW_IRQ_MX_BASE), MIENG);
+                        return;
+                }
         }
+        mask = __this_cpu_read(cached_irq_mask) & ~mask;
+        __this_cpu_write(cached_irq_mask, mask);
+        xtensa_set_sr(mask, intenable);
 }
 
 static void xtensa_mx_irq_unmask(struct irq_data *d)
@@ -86,14 +89,17 @@ static void xtensa_mx_irq_unmask(struct irq_data *d)
         unsigned int mask = 1u << d->hwirq;
 
         if (mask & (XCHAL_INTTYPE_MASK_EXTERN_EDGE |
-                                XCHAL_INTTYPE_MASK_EXTERN_LEVEL)) {
-                set_er(1u << (xtensa_get_ext_irq_no(d->hwirq) -
-                                        HW_IRQ_MX_BASE), MIENGSET);
-        } else {
-                mask |= __this_cpu_read(cached_irq_mask);
-                __this_cpu_write(cached_irq_mask, mask);
-                xtensa_set_sr(mask, intenable);
+                    XCHAL_INTTYPE_MASK_EXTERN_LEVEL)) {
+                unsigned int ext_irq = xtensa_get_ext_irq_no(d->hwirq);
+
+                if (ext_irq >= HW_IRQ_MX_BASE) {
+                        set_er(1u << (ext_irq - HW_IRQ_MX_BASE), MIENGSET);
+                        return;
+                }
         }
+        mask |= __this_cpu_read(cached_irq_mask);
+        __this_cpu_write(cached_irq_mask, mask);
+        xtensa_set_sr(mask, intenable);
 }
 
 static void xtensa_mx_irq_enable(struct irq_data *d)
@@ -113,7 +119,11 @@ static void xtensa_mx_irq_ack(struct irq_data *d)
 
 static int xtensa_mx_irq_retrigger(struct irq_data *d)
 {
-        xtensa_set_sr(1 << d->hwirq, intset);
+        unsigned int mask = 1u << d->hwirq;
+
+        if (WARN_ON(mask & ~XCHAL_INTTYPE_MASK_SOFTWARE))
+                return 0;
+        xtensa_set_sr(mask, intset);
         return 1;
 }
 
diff --git a/drivers/irqchip/irq-xtensa-pic.c b/drivers/irqchip/irq-xtensa-pic.c
index c200234dd2c9..ab12328be5ee 100644
--- a/drivers/irqchip/irq-xtensa-pic.c
+++ b/drivers/irqchip/irq-xtensa-pic.c
@@ -70,7 +70,11 @@ static void xtensa_irq_ack(struct irq_data *d)
 
 static int xtensa_irq_retrigger(struct irq_data *d)
 {
-        xtensa_set_sr(1 << d->hwirq, intset);
+        unsigned int mask = 1u << d->hwirq;
+
+        if (WARN_ON(mask & ~XCHAL_INTTYPE_MASK_SOFTWARE))
+                return 0;
+        xtensa_set_sr(mask, intset);
         return 1;
 }
 
diff --git a/drivers/isdn/mISDN/timerdev.c b/drivers/isdn/mISDN/timerdev.c
index 211ed6cffd10..578978711887 100644
--- a/drivers/isdn/mISDN/timerdev.c
+++ b/drivers/isdn/mISDN/timerdev.c
@@ -170,8 +170,8 @@ dev_expire_timer(struct timer_list *t)
         spin_lock_irqsave(&timer->dev->lock, flags);
         if (timer->id >= 0)
                 list_move_tail(&timer->list, &timer->dev->expired);
-        spin_unlock_irqrestore(&timer->dev->lock, flags);
         wake_up_interruptible(&timer->dev->wait);
+        spin_unlock_irqrestore(&timer->dev->lock, flags);
 }
 
 static int
diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
index 0ff22159a0ca..47d4e0d30bf0 100644
--- a/drivers/md/dm-crypt.c
+++ b/drivers/md/dm-crypt.c
@@ -2414,9 +2414,21 @@ static int crypt_ctr_cipher_new(struct dm_target *ti, char *cipher_in, char *key
          * capi:cipher_api_spec-iv:ivopts
          */
         tmp = &cipher_in[strlen("capi:")];
-        cipher_api = strsep(&tmp, "-");
-        *ivmode = strsep(&tmp, ":");
-        *ivopts = tmp;
+
+        /* Separate IV options if present, it can contain another '-' in hash name */
+        *ivopts = strrchr(tmp, ':');
+        if (*ivopts) {
+                **ivopts = '\0';
+                (*ivopts)++;
+        }
+        /* Parse IV mode */
+        *ivmode = strrchr(tmp, '-');
+        if (*ivmode) {
+                **ivmode = '\0';
+                (*ivmode)++;
+        }
+        /* The rest is crypto API spec */
+        cipher_api = tmp;
 
         if (*ivmode && !strcmp(*ivmode, "lmk"))
                 cc->tfms_count = 64;
@@ -2486,11 +2498,8 @@ static int crypt_ctr_cipher_old(struct dm_target *ti, char *cipher_in, char *key
                 goto bad_mem;
 
         chainmode = strsep(&tmp, "-");
-        *ivopts = strsep(&tmp, "-");
-        *ivmode = strsep(&*ivopts, ":");
-
-        if (tmp)
-                DMWARN("Ignoring unexpected additional cipher options");
+        *ivmode = strsep(&tmp, ":");
+        *ivopts = tmp;
 
         /*
          * For compatibility with the original dm-crypt mapping format, if
diff --git a/drivers/md/dm-rq.c b/drivers/md/dm-rq.c
index 4eb5f8c56535..a20531e5f3b4 100644
--- a/drivers/md/dm-rq.c
+++ b/drivers/md/dm-rq.c
@@ -131,7 +131,7 @@ static void rq_end_stats(struct mapped_device *md, struct request *orig)
 static void rq_completed(struct mapped_device *md)
 {
         /* nudge anyone waiting on suspend queue */
-        if (unlikely(waitqueue_active(&md->wait)))
+        if (unlikely(wq_has_sleeper(&md->wait)))
                 wake_up(&md->wait);
 
         /*
diff --git a/drivers/md/dm-thin-metadata.c b/drivers/md/dm-thin-metadata.c
index 20b0776e39ef..ed3caceaed07 100644
--- a/drivers/md/dm-thin-metadata.c
+++ b/drivers/md/dm-thin-metadata.c
@@ -1678,7 +1678,7 @@ int dm_thin_remove_range(struct dm_thin_device *td,
         return r;
 }
 
-int dm_pool_block_is_used(struct dm_pool_metadata *pmd, dm_block_t b, bool *result)
+int dm_pool_block_is_shared(struct dm_pool_metadata *pmd, dm_block_t b, bool *result)
 {
         int r;
         uint32_t ref_count;
@@ -1686,7 +1686,7 @@ int dm_pool_block_is_used(struct dm_pool_metadata *pmd, dm_block_t b, bool *resu
         down_read(&pmd->root_lock);
         r = dm_sm_get_count(pmd->data_sm, b, &ref_count);
         if (!r)
-                *result = (ref_count != 0);
+                *result = (ref_count > 1);
         up_read(&pmd->root_lock);
 
         return r;
diff --git a/drivers/md/dm-thin-metadata.h b/drivers/md/dm-thin-metadata.h
index 35e954ea20a9..f6be0d733c20 100644
--- a/drivers/md/dm-thin-metadata.h
+++ b/drivers/md/dm-thin-metadata.h
@@ -195,7 +195,7 @@ int dm_pool_get_metadata_dev_size(struct dm_pool_metadata *pmd,
 
 int dm_pool_get_data_dev_size(struct dm_pool_metadata *pmd, dm_block_t *result);
 
-int dm_pool_block_is_used(struct dm_pool_metadata *pmd, dm_block_t b, bool *result);
+int dm_pool_block_is_shared(struct dm_pool_metadata *pmd, dm_block_t b, bool *result);
 
 int dm_pool_inc_data_range(struct dm_pool_metadata *pmd, dm_block_t b, dm_block_t e);
 int dm_pool_dec_data_range(struct dm_pool_metadata *pmd, dm_block_t b, dm_block_t e);
diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
index dadd9696340c..ca8af21bf644 100644
--- a/drivers/md/dm-thin.c
+++ b/drivers/md/dm-thin.c
@@ -1048,7 +1048,7 @@ static void passdown_double_checking_shared_status(struct dm_thin_new_mapping *m
          * passdown we have to check that these blocks are now unused.
          */
         int r = 0;
-        bool used = true;
+        bool shared = true;
         struct thin_c *tc = m->tc;
         struct pool *pool = tc->pool;
         dm_block_t b = m->data_block, e, end = m->data_block + m->virt_end - m->virt_begin;
@@ -1058,11 +1058,11 @@ static void passdown_double_checking_shared_status(struct dm_thin_new_mapping *m
         while (b != end) {
                 /* find start of unmapped run */
                 for (; b < end; b++) {
-                        r = dm_pool_block_is_used(pool->pmd, b, &used);
+                        r = dm_pool_block_is_shared(pool->pmd, b, &shared);
                         if (r)
                                 goto out;
 
-                        if (!used)
+                        if (!shared)
                                 break;
                 }
 
@@ -1071,11 +1071,11 @@ static void passdown_double_checking_shared_status(struct dm_thin_new_mapping *m
 
                 /* find end of run */
                 for (e = b + 1; e != end; e++) {
-                        r = dm_pool_block_is_used(pool->pmd, e, &used);
+                        r = dm_pool_block_is_shared(pool->pmd, e, &shared);
                         if (r)
                                 goto out;
 
-                        if (used)
+                        if (shared)
                                 break;
                 }
 
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index d67c95ef8d7e..515e6af9bed2 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -699,7 +699,7 @@ static void end_io_acct(struct dm_io *io)
                                     true, duration, &io->stats_aux);
 
         /* nudge anyone waiting on suspend queue */
-        if (unlikely(waitqueue_active(&md->wait)))
+        if (unlikely(wq_has_sleeper(&md->wait)))
                 wake_up(&md->wait);
 }
 
@@ -1320,7 +1320,7 @@ static int clone_bio(struct dm_target_io *tio, struct bio *bio,
 
         __bio_clone_fast(clone, bio);
 
-        if (unlikely(bio_integrity(bio) != NULL)) {
+        if (bio_integrity(bio)) {
                 int r;
 
                 if (unlikely(!dm_target_has_integrity(tio->ti->type) &&
@@ -1339,7 +1339,7 @@ static int clone_bio(struct dm_target_io *tio, struct bio *bio,
         bio_advance(clone, to_bytes(sector - clone->bi_iter.bi_sector));
         clone->bi_iter.bi_size = to_bytes(len);
 
-        if (unlikely(bio_integrity(bio) != NULL))
+        if (bio_integrity(bio))
                 bio_integrity_trim(clone);
 
         return 0;
@@ -1588,6 +1588,9 @@ static void init_clone_info(struct clone_info *ci, struct mapped_device *md,
         ci->sector = bio->bi_iter.bi_sector;
 }
 
+#define __dm_part_stat_sub(part, field, subnd)  \
+        (part_stat_get(part, field) -= (subnd))
+
 /*
  * Entry point to split a bio into clones and submit them to the targets.
  */
@@ -1642,7 +1645,21 @@ static blk_qc_t __split_and_process_bio(struct mapped_device *md,
                                 struct bio *b = bio_split(bio, bio_sectors(bio) - ci.sector_count,
                                                           GFP_NOIO, &md->queue->bio_split);
                                 ci.io->orig_bio = b;
+
+                                /*
+                                 * Adjust IO stats for each split, otherwise upon queue
+                                 * reentry there will be redundant IO accounting.
+                                 * NOTE: this is a stop-gap fix, a proper fix involves
+                                 * significant refactoring of DM core's bio splitting
+                                 * (by eliminating DM's splitting and just using bio_split)
+                                 */
+                                part_stat_lock();
+                                __dm_part_stat_sub(&dm_disk(md)->part0,
+                                                   sectors[op_stat_group(bio_op(bio))], ci.sector_count);
+                                part_stat_unlock();
+
                                 bio_chain(b, bio);
+                                trace_block_split(md->queue, b, bio->bi_iter.bi_sector);
                                 ret = generic_make_request(bio);
                                 break;
                         }
@@ -1713,6 +1730,15 @@ out:
         return ret;
 }
 
+static blk_qc_t dm_process_bio(struct mapped_device *md,
+                               struct dm_table *map, struct bio *bio)
+{
+        if (dm_get_md_type(md) == DM_TYPE_NVME_BIO_BASED)
+                return __process_bio(md, map, bio);
+        else
+                return __split_and_process_bio(md, map, bio);
+}
+
 static blk_qc_t dm_make_request(struct request_queue *q, struct bio *bio)
 {
         struct mapped_device *md = q->queuedata;
@@ -1733,10 +1759,7 @@ static blk_qc_t dm_make_request(struct request_queue *q, struct bio *bio)
                 return ret;
         }
 
-        if (dm_get_md_type(md) == DM_TYPE_NVME_BIO_BASED)
-                ret = __process_bio(md, map, bio);
-        else
-                ret = __split_and_process_bio(md, map, bio);
+        ret = dm_process_bio(md, map, bio);
 
         dm_put_live_table(md, srcu_idx);
         return ret;
@@ -2415,9 +2438,9 @@ static void dm_wq_work(struct work_struct *work)
                         break;
 
                 if (dm_request_based(md))
-                        generic_make_request(c);
+                        (void) generic_make_request(c);
                 else
-                        __split_and_process_bio(md, map, c);
+                        (void) dm_process_bio(md, map, c);
         }
 
         dm_put_live_table(md, srcu_idx);
diff --git a/drivers/md/raid5-cache.c b/drivers/md/raid5-cache.c
index ec3a5ef7fee0..cbbe6b6535be 100644
--- a/drivers/md/raid5-cache.c
+++ b/drivers/md/raid5-cache.c
@@ -1935,12 +1935,14 @@ out:
 }
 
 static struct stripe_head *
-r5c_recovery_alloc_stripe(struct r5conf *conf,
-                          sector_t stripe_sect)
+r5c_recovery_alloc_stripe(
+                struct r5conf *conf,
+                sector_t stripe_sect,
+                int noblock)
 {
         struct stripe_head *sh;
 
-        sh = raid5_get_active_stripe(conf, stripe_sect, 0, 1, 0);
+        sh = raid5_get_active_stripe(conf, stripe_sect, 0, noblock, 0);
         if (!sh)
                 return NULL;  /* no more stripe available */
 
@@ -2150,7 +2152,7 @@ r5c_recovery_analyze_meta_block(struct r5l_log *log,
                                                 stripe_sect);
 
                 if (!sh) {
-                        sh = r5c_recovery_alloc_stripe(conf, stripe_sect);
+                        sh = r5c_recovery_alloc_stripe(conf, stripe_sect, 1);
                         /*
                          * cannot get stripe from raid5_get_active_stripe
                          * try replay some stripes
@@ -2159,20 +2161,29 @@ r5c_recovery_analyze_meta_block(struct r5l_log *log,
                                 r5c_recovery_replay_stripes(
                                         cached_stripe_list, ctx);
                                 sh = r5c_recovery_alloc_stripe(
-                                        conf, stripe_sect);
+                                        conf, stripe_sect, 1);
                         }
                         if (!sh) {
+                                int new_size = conf->min_nr_stripes * 2;
                                 pr_debug("md/raid:%s: Increasing stripe cache size to %d to recovery data on journal.\n",
                                         mdname(mddev),
-                                        conf->min_nr_stripes * 2);
-                                raid5_set_cache_size(mddev,
-                                                     conf->min_nr_stripes * 2);
-                                sh = r5c_recovery_alloc_stripe(conf,
-                                                               stripe_sect);
+                                        new_size);
+                                ret = raid5_set_cache_size(mddev, new_size);
+                                if (conf->min_nr_stripes <= new_size / 2) {
+                                        pr_err("md/raid:%s: Cannot increase cache size, ret=%d, new_size=%d, min_nr_stripes=%d, max_nr_stripes=%d\n",
+                                                mdname(mddev),
+                                                ret,
+                                                new_size,
+                                                conf->min_nr_stripes,
+                                                conf->max_nr_stripes);
+                                        return -ENOMEM;
+                                }
+                                sh = r5c_recovery_alloc_stripe(
+                                        conf, stripe_sect, 0);
                         }
                         if (!sh) {
                                 pr_err("md/raid:%s: Cannot get enough stripes due to memory pressure. Recovery failed.\n",
-                                       mdname(mddev));
+                                        mdname(mddev));
                                 return -ENOMEM;
                         }
                         list_add_tail(&sh->lru, cached_stripe_list);
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 4990f0319f6c..cecea901ab8c 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -6369,6 +6369,7 @@ raid5_show_stripe_cache_size(struct mddev *mddev, char *page)
 int
 raid5_set_cache_size(struct mddev *mddev, int size)
 {
+        int result = 0;
         struct r5conf *conf = mddev->private;
 
         if (size <= 16 || size > 32768)
@@ -6385,11 +6386,14 @@ raid5_set_cache_size(struct mddev *mddev, int size)
 
         mutex_lock(&conf->cache_size_mutex);
         while (size > conf->max_nr_stripes)
-                if (!grow_one_stripe(conf, GFP_KERNEL))
+                if (!grow_one_stripe(conf, GFP_KERNEL)) {
+                        conf->min_nr_stripes = conf->max_nr_stripes;
+                        result = -ENOMEM;
                         break;
+                }
         mutex_unlock(&conf->cache_size_mutex);
 
-        return 0;
+        return result;
 }
 EXPORT_SYMBOL(raid5_set_cache_size);
 
diff --git a/drivers/mfd/Kconfig b/drivers/mfd/Kconfig
index f461460a2aeb..76f9909cf396 100644
--- a/drivers/mfd/Kconfig
+++ b/drivers/mfd/Kconfig
@@ -1419,7 +1419,7 @@ config MFD_TPS65217
 
 config MFD_TPS68470
         bool "TI TPS68470 Power Management / LED chips"
-        depends on ACPI && I2C=y
+        depends on ACPI && PCI && I2C=y
         select MFD_CORE
         select REGMAP_I2C
         select I2C_DESIGNWARE_PLATFORM
diff --git a/drivers/misc/ibmvmc.c b/drivers/misc/ibmvmc.c
index b8aaa684c397..2ed23c99f59f 100644
--- a/drivers/misc/ibmvmc.c
+++ b/drivers/misc/ibmvmc.c
@@ -820,21 +820,24 @@ static int ibmvmc_send_msg(struct crq_server_adapter *adapter,
  *
  * Return:
  *      0 - Success
+ *      Non-zero - Failure
  */
 static int ibmvmc_open(struct inode *inode, struct file *file)
 {
         struct ibmvmc_file_session *session;
-        int rc = 0;
 
         pr_debug("%s: inode = 0x%lx, file = 0x%lx, state = 0x%x\n", __func__,
                  (unsigned long)inode, (unsigned long)file,
                  ibmvmc.state);
 
         session = kzalloc(sizeof(*session), GFP_KERNEL);
+        if (!session)
+                return -ENOMEM;
+
         session->file = file;
         file->private_data = session;
 
-        return rc;
+        return 0;
 }
 
 /**
diff --git a/drivers/misc/mei/client.c b/drivers/misc/mei/client.c
index 1fc8ea0f519b..ca4c9cc218a2 100644
--- a/drivers/misc/mei/client.c
+++ b/drivers/misc/mei/client.c
@@ -401,8 +401,11 @@ static void mei_io_list_flush_cl(struct list_head *head,
         struct mei_cl_cb *cb, *next;
 
         list_for_each_entry_safe(cb, next, head, list) {
-                if (cl == cb->cl)
+                if (cl == cb->cl) {
                         list_del_init(&cb->list);
+                        if (cb->fop_type == MEI_FOP_READ)
+                                mei_io_cb_free(cb);
+                }
         }
 }
 
diff --git a/drivers/misc/mei/hbm.c b/drivers/misc/mei/hbm.c
index 78c26cebf5d4..8f7616557c97 100644
--- a/drivers/misc/mei/hbm.c
+++ b/drivers/misc/mei/hbm.c
@@ -1187,9 +1187,15 @@ int mei_hbm_dispatch(struct mei_device *dev, struct mei_msg_hdr *hdr)
                 dma_setup_res = (struct hbm_dma_setup_response *)mei_msg;
 
                 if (dma_setup_res->status) {
-                        dev_info(dev->dev, "hbm: dma setup response: failure = %d %s\n",
-                                 dma_setup_res->status,
-                                 mei_hbm_status_str(dma_setup_res->status));
+                        u8 status = dma_setup_res->status;
+
+                        if (status == MEI_HBMS_NOT_ALLOWED) {
+                                dev_dbg(dev->dev, "hbm: dma setup not allowed\n");
+                        } else {
+                                dev_info(dev->dev, "hbm: dma setup response: failure = %d %s\n",
+                                         status,
+                                         mei_hbm_status_str(status));
+                        }
                         dev->hbm_f_dr_supported = 0;
                         mei_dmam_ring_free(dev);
                 }
diff --git a/drivers/misc/mei/hw-me-regs.h b/drivers/misc/mei/hw-me-regs.h
index e4b10b2d1a08..bb1ee9834a02 100644
--- a/drivers/misc/mei/hw-me-regs.h
+++ b/drivers/misc/mei/hw-me-regs.h
@@ -127,6 +127,8 @@
 #define MEI_DEV_ID_BXT_M      0x1A9A  /* Broxton M */
 #define MEI_DEV_ID_APL_I      0x5A9A  /* Apollo Lake I */
 
+#define MEI_DEV_ID_DNV_IE     0x19E5  /* Denverton IE */
+
 #define MEI_DEV_ID_GLK        0x319A  /* Gemini Lake */
 
 #define MEI_DEV_ID_KBP        0xA2BA  /* Kaby Point */
@@ -137,6 +139,8 @@
 #define MEI_DEV_ID_CNP_H      0xA360  /* Cannon Point H */
 #define MEI_DEV_ID_CNP_H_4    0xA364  /* Cannon Point H 4 (iTouch) */
 
+#define MEI_DEV_ID_ICP_LP     0x34E0  /* Ice Lake Point LP */
+
 /*
  * MEI HW Section
  */
diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c
index 73ace2d59dea..3ab946ad3257 100644
--- a/drivers/misc/mei/pci-me.c
+++ b/drivers/misc/mei/pci-me.c
@@ -88,11 +88,13 @@ static const struct pci_device_id mei_me_pci_tbl[] = {
         {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_2, MEI_ME_PCH8_CFG)},
         {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H, MEI_ME_PCH8_SPS_CFG)},
         {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H_2, MEI_ME_PCH8_SPS_CFG)},
-        {MEI_PCI_DEVICE(MEI_DEV_ID_LBG, MEI_ME_PCH8_CFG)},
+        {MEI_PCI_DEVICE(MEI_DEV_ID_LBG, MEI_ME_PCH12_CFG)},
 
         {MEI_PCI_DEVICE(MEI_DEV_ID_BXT_M, MEI_ME_PCH8_CFG)},
         {MEI_PCI_DEVICE(MEI_DEV_ID_APL_I, MEI_ME_PCH8_CFG)},
 
+        {MEI_PCI_DEVICE(MEI_DEV_ID_DNV_IE, MEI_ME_PCH8_CFG)},
+
         {MEI_PCI_DEVICE(MEI_DEV_ID_GLK, MEI_ME_PCH8_CFG)},
 
         {MEI_PCI_DEVICE(MEI_DEV_ID_KBP, MEI_ME_PCH8_CFG)},
@@ -103,6 +105,8 @@ static const struct pci_device_id mei_me_pci_tbl[] = {
         {MEI_PCI_DEVICE(MEI_DEV_ID_CNP_H, MEI_ME_PCH12_CFG)},
         {MEI_PCI_DEVICE(MEI_DEV_ID_CNP_H_4, MEI_ME_PCH8_CFG)},
 
+        {MEI_PCI_DEVICE(MEI_DEV_ID_ICP_LP, MEI_ME_PCH12_CFG)},
+
         /* required last entry */
         {0, }
 };
diff --git a/drivers/misc/mic/vop/vop_main.c b/drivers/misc/mic/vop/vop_main.c
index 2bfa3a903bf9..744757f541be 100644
--- a/drivers/misc/mic/vop/vop_main.c
+++ b/drivers/misc/mic/vop/vop_main.c
@@ -47,7 +47,8 @@
  * @dc: Virtio device control
  * @vpdev: VOP device which is the parent for this virtio device
  * @vr: Buffer for accessing the VRING
- * @used: Buffer for used
+ * @used_virt: Virtual address of used ring
+ * @used: DMA address of used ring
  * @used_size: Size of the used buffer
  * @reset_done: Track whether VOP reset is complete
  * @virtio_cookie: Cookie returned upon requesting a interrupt
@@ -61,6 +62,7 @@ struct _vop_vdev {
         struct mic_device_ctrl __iomem *dc;
         struct vop_device *vpdev;
         void __iomem *vr[VOP_MAX_VRINGS];
+        void *used_virt[VOP_MAX_VRINGS];
         dma_addr_t used[VOP_MAX_VRINGS];
         int used_size[VOP_MAX_VRINGS];
         struct completion reset_done;
@@ -260,12 +262,12 @@ static bool vop_notify(struct virtqueue *vq)
 static void vop_del_vq(struct virtqueue *vq, int n)
 {
         struct _vop_vdev *vdev = to_vopvdev(vq->vdev);
-        struct vring *vr = (struct vring *)(vq + 1);
         struct vop_device *vpdev = vdev->vpdev;
 
         dma_unmap_single(&vpdev->dev, vdev->used[n],
                          vdev->used_size[n], DMA_BIDIRECTIONAL);
-        free_pages((unsigned long)vr->used, get_order(vdev->used_size[n]));
+        free_pages((unsigned long)vdev->used_virt[n],
+                   get_order(vdev->used_size[n]));
         vring_del_virtqueue(vq);
         vpdev->hw_ops->iounmap(vpdev, vdev->vr[n]);
         vdev->vr[n] = NULL;
@@ -283,6 +285,26 @@ static void vop_del_vqs(struct virtio_device *dev)
                 vop_del_vq(vq, idx++);
 }
 
+static struct virtqueue *vop_new_virtqueue(unsigned int index,
+                                      unsigned int num,
+                                      struct virtio_device *vdev,
+                                      bool context,
+                                      void *pages,
+                                      bool (*notify)(struct virtqueue *vq),
+                                      void (*callback)(struct virtqueue *vq),
+                                      const char *name,
+                                      void *used)
+{
+        bool weak_barriers = false;
+        struct vring vring;
+
+        vring_init(&vring, num, pages, MIC_VIRTIO_RING_ALIGN);
+        vring.used = used;
+
+        return __vring_new_virtqueue(index, vring, vdev, weak_barriers, context,
+                                     notify, callback, name);
+}
+
 /*
  * This routine will assign vring's allocated in host/io memory. Code in
  * virtio_ring.c however continues to access this io memory as if it were local
@@ -302,7 +324,6 @@ static struct virtqueue *vop_find_vq(struct virtio_device *dev,
         struct _mic_vring_info __iomem *info;
         void *used;
         int vr_size, _vr_size, err, magic;
-        struct vring *vr;
         u8 type = ioread8(&vdev->desc->type);
 
         if (index >= ioread8(&vdev->desc->num_vq))
@@ -322,17 +343,7 @@ static struct virtqueue *vop_find_vq(struct virtio_device *dev,
                 return ERR_PTR(-ENOMEM);
         vdev->vr[index] = va;
         memset_io(va, 0x0, _vr_size);
-        vq = vring_new_virtqueue(
-                                index,
-                                le16_to_cpu(config.num), MIC_VIRTIO_RING_ALIGN,
-                                dev,
-                                false,
-                                ctx,
-                                (void __force *)va, vop_notify, callback, name);
-        if (!vq) {
-                err = -ENOMEM;
-                goto unmap;
-        }
+
         info = va + _vr_size;
         magic = ioread32(&info->magic);
 
@@ -341,18 +352,27 @@ static struct virtqueue *vop_find_vq(struct virtio_device *dev,
                 goto unmap;
         }
 
-        /* Allocate and reassign used ring now */
         vdev->used_size[index] = PAGE_ALIGN(sizeof(__u16) * 3 +
                                              sizeof(struct vring_used_elem) *
                                              le16_to_cpu(config.num));
         used = (void *)__get_free_pages(GFP_KERNEL | __GFP_ZERO,
                                         get_order(vdev->used_size[index]));
+        vdev->used_virt[index] = used;
         if (!used) {
                 err = -ENOMEM;
                 dev_err(_vop_dev(vdev), "%s %d err %d\n",
                         __func__, __LINE__, err);
-                goto del_vq;
+                goto unmap;
+        }
+
+        vq = vop_new_virtqueue(index, le16_to_cpu(config.num), dev, ctx,
+                               (void __force *)va, vop_notify, callback,
+                               name, used);
+        if (!vq) {
+                err = -ENOMEM;
+                goto free_used;
         }
+
         vdev->used[index] = dma_map_single(&vpdev->dev, used,
                                             vdev->used_size[index],
                                             DMA_BIDIRECTIONAL);
@@ -360,26 +380,17 @@ static struct virtqueue *vop_find_vq(struct virtio_device *dev,
                 err = -ENOMEM;
                 dev_err(_vop_dev(vdev), "%s %d err %d\n",
                         __func__, __LINE__, err);
-                goto free_used;
+                goto del_vq;
         }
         writeq(vdev->used[index], &vqconfig->used_address);
-        /*
-         * To reassign the used ring here we are directly accessing
-         * struct vring_virtqueue which is a private data structure
-         * in virtio_ring.c. At the minimum, a BUILD_BUG_ON() in
-         * vring_new_virtqueue() would ensure that
-         *  (&vq->vring == (struct vring *) (&vq->vq + 1));
-         */
-        vr = (struct vring *)(vq + 1);
-        vr->used = used;
 
         vq->priv = vdev;
         return vq;
+del_vq:
+        vring_del_virtqueue(vq);
 free_used:
         free_pages((unsigned long)used,
                    get_order(vdev->used_size[index]));
-del_vq:
-        vring_del_virtqueue(vq);
 unmap:
         vpdev->hw_ops->iounmap(vpdev, vdev->vr[index]);
         return ERR_PTR(err);
@@ -581,6 +592,8 @@ static int _vop_remove_device(struct mic_device_desc __iomem *d,
         int ret = -1;
 
         if (ioread8(&dc->config_change) == MIC_VIRTIO_PARAM_DEV_REMOVE) {
+                struct device *dev = get_device(&vdev->vdev.dev);
+
                 dev_dbg(&vpdev->dev,
                         "%s %d config_change %d type %d vdev %p\n",
                         __func__, __LINE__,
@@ -592,7 +605,7 @@ static int _vop_remove_device(struct mic_device_desc __iomem *d,
                 iowrite8(-1, &dc->h2c_vdev_db);
                 if (status & VIRTIO_CONFIG_S_DRIVER_OK)
                         wait_for_completion(&vdev->reset_done);
-                put_device(&vdev->vdev.dev);
+                put_device(dev);
                 iowrite8(1, &dc->guest_ack);
                 dev_dbg(&vpdev->dev, "%s %d guest_ack %d\n",
                         __func__, __LINE__, ioread8(&dc->guest_ack));
diff --git a/drivers/misc/pvpanic.c b/drivers/misc/pvpanic.c
index 595ac065b401..95ff7c5a1dfb 100644
--- a/drivers/misc/pvpanic.c
+++ b/drivers/misc/pvpanic.c
@@ -70,8 +70,12 @@ pvpanic_walk_resources(struct acpi_resource *res, void *context)
         struct resource r;
 
         if (acpi_dev_resource_io(res, &r)) {
+#ifdef CONFIG_HAS_IOPORT_MAP
                 base = ioport_map(r.start, resource_size(&r));
                 return AE_OK;
+#else
+                return AE_ERROR;
+#endif
         } else if (acpi_dev_resource_memory(res, &r)) {
                 base = ioremap(r.start, resource_size(&r));
                 return AE_OK;
diff --git a/drivers/mmc/host/Kconfig b/drivers/mmc/host/Kconfig
index e26b8145efb3..a44ec8bb5418 100644
--- a/drivers/mmc/host/Kconfig
+++ b/drivers/mmc/host/Kconfig
@@ -116,7 +116,7 @@ config MMC_RICOH_MMC
 
 config MMC_SDHCI_ACPI
         tristate "SDHCI support for ACPI enumerated SDHCI controllers"
-        depends on MMC_SDHCI && ACPI
+        depends on MMC_SDHCI && ACPI && PCI
         select IOSF_MBI if X86
         help
           This selects support for ACPI enumerated SDHCI controllers,
@@ -978,7 +978,7 @@ config MMC_SDHCI_OMAP
         tristate "TI SDHCI Controller Support"
         depends on MMC_SDHCI_PLTFM && OF
         select THERMAL
-        select TI_SOC_THERMAL
+        imply TI_SOC_THERMAL
         help
           This selects the Secure Digital Host Controller Interface (SDHCI)
           support present in TI's DRA7 SOCs. The controller supports
diff --git a/drivers/mmc/host/bcm2835.c b/drivers/mmc/host/bcm2835.c
index 50293529d6de..c9e7aa50bb0a 100644
--- a/drivers/mmc/host/bcm2835.c
+++ b/drivers/mmc/host/bcm2835.c
@@ -1431,6 +1431,8 @@ static int bcm2835_probe(struct platform_device *pdev)
 
 err:
         dev_dbg(dev, "%s -> err %d\n", __func__, ret);
+        if (host->dma_chan_rxtx)
+                dma_release_channel(host->dma_chan_rxtx);
         mmc_free_host(mmc);
 
         return ret;
diff --git a/drivers/mmc/host/dw_mmc-bluefield.c b/drivers/mmc/host/dw_mmc-bluefield.c
index ed8f2254b66a..aa38b1a8017e 100644
--- a/drivers/mmc/host/dw_mmc-bluefield.c
+++ b/drivers/mmc/host/dw_mmc-bluefield.c
@@ -1,11 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0
 /*
  * Copyright (C) 2018 Mellanox Technologies.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
  */
 
 #include <linux/bitfield.h>
diff --git a/drivers/mmc/host/meson-gx-mmc.c b/drivers/mmc/host/meson-gx-mmc.c
index c2690c1a50ff..f19ec60bcbdc 100644
--- a/drivers/mmc/host/meson-gx-mmc.c
+++ b/drivers/mmc/host/meson-gx-mmc.c
@@ -179,6 +179,8 @@ struct meson_host {
         struct sd_emmc_desc *descs;
         dma_addr_t descs_dma_addr;
 
+        int irq;
+
         bool vqmmc_enabled;
 };
 
@@ -738,6 +740,11 @@ static int meson_mmc_clk_phase_tuning(struct mmc_host *mmc, u32 opcode,
 static int meson_mmc_execute_tuning(struct mmc_host *mmc, u32 opcode)
 {
         struct meson_host *host = mmc_priv(mmc);
+        int adj = 0;
+
+        /* enable signal resampling w/o delay */
+        adj = ADJUST_ADJ_EN;
+        writel(adj, host->regs + host->data->adjust);
 
         return meson_mmc_clk_phase_tuning(mmc, opcode, host->rx_clk);
 }
@@ -768,6 +775,9 @@ static void meson_mmc_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
                 if (!IS_ERR(mmc->supply.vmmc))
                         mmc_regulator_set_ocr(mmc, mmc->supply.vmmc, ios->vdd);
 
+                /* disable signal resampling */
+                writel(0, host->regs + host->data->adjust);
+
                 /* Reset rx phase */
                 clk_set_phase(host->rx_clk, 0);
 
@@ -1166,7 +1176,7 @@ static int meson_mmc_get_cd(struct mmc_host *mmc)
 
 static void meson_mmc_cfg_init(struct meson_host *host)
 {
-        u32 cfg = 0, adj = 0;
+        u32 cfg = 0;
 
         cfg |= FIELD_PREP(CFG_RESP_TIMEOUT_MASK,
                           ilog2(SD_EMMC_CFG_RESP_TIMEOUT));
@@ -1177,10 +1187,6 @@ static void meson_mmc_cfg_init(struct meson_host *host)
         cfg |= CFG_ERR_ABORT;
 
         writel(cfg, host->regs + SD_EMMC_CFG);
-
-        /* enable signal resampling w/o delay */
-        adj = ADJUST_ADJ_EN;
-        writel(adj, host->regs + host->data->adjust);
 }
 
 static int meson_mmc_card_busy(struct mmc_host *mmc)
@@ -1231,7 +1237,7 @@ static int meson_mmc_probe(struct platform_device *pdev)
         struct resource *res;
         struct meson_host *host;
         struct mmc_host *mmc;
-        int ret, irq;
+        int ret;
 
         mmc = mmc_alloc_host(sizeof(struct meson_host), &pdev->dev);
         if (!mmc)
@@ -1276,8 +1282,8 @@ static int meson_mmc_probe(struct platform_device *pdev)
                 goto free_host;
         }
 
-        irq = platform_get_irq(pdev, 0);
-        if (irq <= 0) {
+        host->irq = platform_get_irq(pdev, 0);
+        if (host->irq <= 0) {
                 dev_err(&pdev->dev, "failed to get interrupt resource.\n");
                 ret = -EINVAL;
                 goto free_host;
@@ -1331,9 +1337,8 @@ static int meson_mmc_probe(struct platform_device *pdev)
         writel(IRQ_CRC_ERR | IRQ_TIMEOUTS | IRQ_END_OF_CHAIN,
                host->regs + SD_EMMC_IRQ_EN);
 
-        ret = devm_request_threaded_irq(&pdev->dev, irq, meson_mmc_irq,
-                                        meson_mmc_irq_thread, IRQF_SHARED,
-                                        NULL, host);
+        ret = request_threaded_irq(host->irq, meson_mmc_irq,
+                        meson_mmc_irq_thread, IRQF_SHARED, NULL, host);
         if (ret)
                 goto err_init_clk;
 
@@ -1351,7 +1356,7 @@ static int meson_mmc_probe(struct platform_device *pdev)
         if (host->bounce_buf == NULL) {
                 dev_err(host->dev, "Unable to map allocate DMA bounce buffer.\n");
                 ret = -ENOMEM;
-                goto err_init_clk;
+                goto err_free_irq;
         }
 
         host->descs = dma_alloc_coherent(host->dev, SD_EMMC_DESC_BUF_LEN,
@@ -1370,6 +1375,8 @@ static int meson_mmc_probe(struct platform_device *pdev)
 err_bounce_buf:
         dma_free_coherent(host->dev, host->bounce_buf_size,
                           host->bounce_buf, host->bounce_dma_addr);
+err_free_irq:
+        free_irq(host->irq, host);
 err_init_clk:
         clk_disable_unprepare(host->mmc_clk);
 err_core_clk:
@@ -1387,6 +1394,7 @@ static int meson_mmc_remove(struct platform_device *pdev)
 
         /* disable interrupts */
         writel(0, host->regs + SD_EMMC_IRQ_EN);
+        free_irq(host->irq, host);
 
         dma_free_coherent(host->dev, SD_EMMC_DESC_BUF_LEN,
                           host->descs, host->descs_dma_addr);
diff --git a/drivers/mmc/host/mtk-sd.c b/drivers/mmc/host/mtk-sd.c
index 8afeaf81ae66..833ef0590af8 100644
--- a/drivers/mmc/host/mtk-sd.c
+++ b/drivers/mmc/host/mtk-sd.c
@@ -846,7 +846,7 @@ static void msdc_set_mclk(struct msdc_host *host, unsigned char timing, u32 hz)
 
         if (timing == MMC_TIMING_MMC_HS400 &&
             host->dev_comp->hs400_tune)
-                sdr_set_field(host->base + PAD_CMD_TUNE,
+                sdr_set_field(host->base + tune_reg,
                               MSDC_PAD_TUNE_CMDRRDLY,
                               host->hs400_cmd_int_delay);
         dev_dbg(host->dev, "sclk: %d, timing: %d\n", host->mmc->actual_clock,
diff --git a/drivers/mmc/host/sdhci-iproc.c b/drivers/mmc/host/sdhci-iproc.c
index 0db99057c44f..9d12c06c7fd6 100644
--- a/drivers/mmc/host/sdhci-iproc.c
+++ b/drivers/mmc/host/sdhci-iproc.c
@@ -296,7 +296,10 @@ static int sdhci_iproc_probe(struct platform_device *pdev)
 
         iproc_host->data = iproc_data;
 
-        mmc_of_parse(host->mmc);
+        ret = mmc_of_parse(host->mmc);
+        if (ret)
+                goto err;
+
         sdhci_get_property(pdev);
 
         host->mmc->caps |= iproc_host->data->mmc_caps;
diff --git a/drivers/mtd/mtdpart.c b/drivers/mtd/mtdpart.c
index 60104e1079c5..37f174ccbcec 100644
--- a/drivers/mtd/mtdpart.c
+++ b/drivers/mtd/mtdpart.c
@@ -480,6 +480,10 @@ static struct mtd_part *allocate_partition(struct mtd_info *parent,
                 /* let's register it anyway to preserve ordering */
                 slave->offset = 0;
                 slave->mtd.size = 0;
+
+                /* Initialize ->erasesize to make add_mtd_device() happy. */
+                slave->mtd.erasesize = parent->erasesize;
+
                 printk(KERN_ERR"mtd: partition \"%s\" is out of reach -- disabled\n",
                         part->name);
                 goto out_register;
@@ -632,7 +636,6 @@ err_remove_part:
         mutex_unlock(&mtd_partitions_mutex);
 
         free_partition(new);
-        pr_info("%s:%i\n", __func__, __LINE__);
 
         return ret;
 }
diff --git a/drivers/mtd/nand/raw/gpmi-nand/gpmi-lib.c b/drivers/mtd/nand/raw/gpmi-nand/gpmi-lib.c
index bd4cfac6b5aa..a4768df5083f 100644
--- a/drivers/mtd/nand/raw/gpmi-nand/gpmi-lib.c
+++ b/drivers/mtd/nand/raw/gpmi-nand/gpmi-lib.c
@@ -155,9 +155,10 @@ int gpmi_init(struct gpmi_nand_data *this)
 
         /*
          * Reset BCH here, too. We got failures otherwise :(
-         * See later BCH reset for explanation of MX23 handling
+         * See later BCH reset for explanation of MX23 and MX28 handling
          */
-        ret = gpmi_reset_block(r->bch_regs, GPMI_IS_MX23(this));
+        ret = gpmi_reset_block(r->bch_regs,
+                               GPMI_IS_MX23(this) || GPMI_IS_MX28(this));
         if (ret)
                 goto err_out;
 
@@ -263,12 +264,10 @@ int bch_set_geometry(struct gpmi_nand_data *this)
         /*
         * Due to erratum #2847 of the MX23, the BCH cannot be soft reset on this
         * chip, otherwise it will lock up. So we skip resetting BCH on the MX23.
-        * On the other hand, the MX28 needs the reset, because one case has been
-        * seen where the BCH produced ECC errors constantly after 10000
-        * consecutive reboots. The latter case has not been seen on the MX23
-        * yet, still we don't know if it could happen there as well.
+        * and MX28.
         */
-        ret = gpmi_reset_block(r->bch_regs, GPMI_IS_MX23(this));
+        ret = gpmi_reset_block(r->bch_regs,
+                               GPMI_IS_MX23(this) || GPMI_IS_MX28(this));
         if (ret)
                 goto err_out;
 
diff --git a/drivers/mtd/nand/raw/nand_base.c b/drivers/mtd/nand/raw/nand_base.c
index cca4b24d2ffa..839494ac457c 100644
--- a/drivers/mtd/nand/raw/nand_base.c
+++ b/drivers/mtd/nand/raw/nand_base.c
@@ -410,6 +410,7 @@ static int nand_check_wp(struct nand_chip *chip)
 
 /**
  * nand_fill_oob - [INTERN] Transfer client buffer to oob
+ * @chip: NAND chip object
  * @oob: oob data buffer
  * @len: oob data write length
  * @ops: oob ops structure
diff --git a/drivers/mtd/nand/raw/nand_bbt.c b/drivers/mtd/nand/raw/nand_bbt.c
index 1b722fe9213c..19a2b563acdf 100644
--- a/drivers/mtd/nand/raw/nand_bbt.c
+++ b/drivers/mtd/nand/raw/nand_bbt.c
@@ -158,7 +158,7 @@ static u32 add_marker_len(struct nand_bbt_descr *td)
 
 /**
  * read_bbt - [GENERIC] Read the bad block table starting from page
- * @chip: NAND chip object
+ * @this: NAND chip object
  * @buf: temporary buffer
  * @page: the starting page
  * @num: the number of bbt descriptors to read
diff --git a/drivers/mtd/nand/spi/core.c b/drivers/mtd/nand/spi/core.c
index 479c2f2cf17f..fa87ae28cdfe 100644
--- a/drivers/mtd/nand/spi/core.c
+++ b/drivers/mtd/nand/spi/core.c
@@ -304,24 +304,30 @@ static int spinand_write_to_cache_op(struct spinand_device *spinand,
         struct nand_device *nand = spinand_to_nand(spinand);
         struct mtd_info *mtd = nanddev_to_mtd(nand);
         struct nand_page_io_req adjreq = *req;
-        unsigned int nbytes = 0;
-        void *buf = NULL;
+        void *buf = spinand->databuf;
+        unsigned int nbytes;
         u16 column = 0;
         int ret;
 
-        memset(spinand->databuf, 0xff,
-               nanddev_page_size(nand) +
-               nanddev_per_page_oobsize(nand));
+        /*
+         * Looks like PROGRAM LOAD (AKA write cache) does not necessarily reset
+         * the cache content to 0xFF (depends on vendor implementation), so we
+         * must fill the page cache entirely even if we only want to program
+         * the data portion of the page, otherwise we might corrupt the BBM or
+         * user data previously programmed in OOB area.
+         */
+        nbytes = nanddev_page_size(nand) + nanddev_per_page_oobsize(nand);
+        memset(spinand->databuf, 0xff, nbytes);
+        adjreq.dataoffs = 0;
+        adjreq.datalen = nanddev_page_size(nand);
+        adjreq.databuf.out = spinand->databuf;
+        adjreq.ooblen = nanddev_per_page_oobsize(nand);
+        adjreq.ooboffs = 0;
+        adjreq.oobbuf.out = spinand->oobbuf;
 
-        if (req->datalen) {
+        if (req->datalen)
                 memcpy(spinand->databuf + req->dataoffs, req->databuf.out,
                        req->datalen);
-                adjreq.dataoffs = 0;
-                adjreq.datalen = nanddev_page_size(nand);
-                adjreq.databuf.out = spinand->databuf;
-                nbytes = adjreq.datalen;
-                buf = spinand->databuf;
-        }
 
         if (req->ooblen) {
                 if (req->mode == MTD_OPS_AUTO_OOB)
@@ -332,14 +338,6 @@ static int spinand_write_to_cache_op(struct spinand_device *spinand,
                 else
                         memcpy(spinand->oobbuf + req->ooboffs, req->oobbuf.out,
                                req->ooblen);
-
-                adjreq.ooblen = nanddev_per_page_oobsize(nand);
-                adjreq.ooboffs = 0;
-                nbytes += nanddev_per_page_oobsize(nand);
-                if (!buf) {
-                        buf = spinand->oobbuf;
-                        column = nanddev_page_size(nand);
-                }
         }
 
         spinand_cache_op_adjust_colum(spinand, &adjreq, &column);
@@ -370,8 +368,8 @@ static int spinand_write_to_cache_op(struct spinand_device *spinand,
 
                 /*
                  * We need to use the RANDOM LOAD CACHE operation if there's
-                 * more than one iteration, because the LOAD operation resets
-                 * the cache to 0xff.
+                 * more than one iteration, because the LOAD operation might
+                 * reset the cache to 0xff.
                  */
                 if (nbytes) {
                         column = op.addr.val;
@@ -1018,11 +1016,11 @@ static int spinand_init(struct spinand_device *spinand)
         for (i = 0; i < nand->memorg.ntargets; i++) {
                 ret = spinand_select_target(spinand, i);
                 if (ret)
-                        goto err_free_bufs;
+                        goto err_manuf_cleanup;
 
                 ret = spinand_lock_block(spinand, BL_ALL_UNLOCKED);
                 if (ret)
-                        goto err_free_bufs;
+                        goto err_manuf_cleanup;
         }
 
         ret = nanddev_init(nand, &spinand_ops, THIS_MODULE);
diff --git a/drivers/net/caif/caif_serial.c b/drivers/net/caif/caif_serial.c
index a0f954f36c09..44e6c7b1b222 100644
--- a/drivers/net/caif/caif_serial.c
+++ b/drivers/net/caif/caif_serial.c
@@ -257,10 +257,7 @@ static int handle_tx(struct ser_device *ser)
                 if (skb->len == 0) {
                         struct sk_buff *tmp = skb_dequeue(&ser->head);
                         WARN_ON(tmp != skb);
-                        if (in_interrupt())
-                                dev_kfree_skb_irq(skb);
-                        else
-                                kfree_skb(skb);
+                        dev_consume_skb_any(skb);
                 }
         }
         /* Send flow off if queue is empty */
diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
index 3b3f88ffab53..c05e4d50d43d 100644
--- a/drivers/net/can/dev.c
+++ b/drivers/net/can/dev.c
@@ -480,8 +480,6 @@ EXPORT_SYMBOL_GPL(can_put_echo_skb);
 struct sk_buff *__can_get_echo_skb(struct net_device *dev, unsigned int idx, u8 *len_ptr)
 {
         struct can_priv *priv = netdev_priv(dev);
-        struct sk_buff *skb = priv->echo_skb[idx];
-        struct canfd_frame *cf;
 
         if (idx >= priv->echo_skb_max) {
                 netdev_err(dev, "%s: BUG! Trying to access can_priv::echo_skb out of bounds (%u/max %u)\n",
@@ -489,20 +487,21 @@ struct sk_buff *__can_get_echo_skb(struct net_device *dev, unsigned int idx, u8
                 return NULL;
         }
 
-        if (!skb) {
-                netdev_err(dev, "%s: BUG! Trying to echo non existing skb: can_priv::echo_skb[%u]\n",
-                           __func__, idx);
-                return NULL;
-        }
+        if (priv->echo_skb[idx]) {
+                /* Using "struct canfd_frame::len" for the frame
+                 * length is supported on both CAN and CANFD frames.
+                 */
+                struct sk_buff *skb = priv->echo_skb[idx];
+                struct canfd_frame *cf = (struct canfd_frame *)skb->data;
+                u8 len = cf->len;
 
-        /* Using "struct canfd_frame::len" for the frame
-         * length is supported on both CAN and CANFD frames.
-         */
-        cf = (struct canfd_frame *)skb->data;
-        *len_ptr = cf->len;
-        priv->echo_skb[idx] = NULL;
+                *len_ptr = len;
+                priv->echo_skb[idx] = NULL;
 
-        return skb;
+                return skb;
+        }
+
+        return NULL;
 }
 
 /*
diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
index 0f36eafe3ac1..1c66fb2ad76b 100644
--- a/drivers/net/can/flexcan.c
+++ b/drivers/net/can/flexcan.c
@@ -1106,7 +1106,7 @@ static int flexcan_chip_start(struct net_device *dev)
                 }
         } else {
                 /* clear and invalidate unused mailboxes first */
-                for (i = FLEXCAN_TX_MB_RESERVED_OFF_FIFO; i <= priv->mb_count; i++) {
+                for (i = FLEXCAN_TX_MB_RESERVED_OFF_FIFO; i < priv->mb_count; i++) {
                         mb = flexcan_get_mb(priv, i);
                         priv->write(FLEXCAN_MB_CODE_RX_INACTIVE,
                                     &mb->can_ctrl);
@@ -1432,7 +1432,7 @@ static int flexcan_setup_stop_mode(struct platform_device *pdev)
         gpr_np = of_find_node_by_phandle(phandle);
         if (!gpr_np) {
                 dev_dbg(&pdev->dev, "could not find gpr node by phandle\n");
-                return PTR_ERR(gpr_np);
+                return -ENODEV;
         }
 
         priv = netdev_priv(dev);
diff --git a/drivers/net/dsa/b53/b53_srab.c b/drivers/net/dsa/b53/b53_srab.c
index 90f514252987..d9c56a779c08 100644
--- a/drivers/net/dsa/b53/b53_srab.c
+++ b/drivers/net/dsa/b53/b53_srab.c
@@ -511,9 +511,6 @@ static void b53_srab_prepare_irq(struct platform_device *pdev)
         /* Clear all pending interrupts */
         writel(0xffffffff, priv->regs + B53_SRAB_INTR);
 
-        if (dev->pdata && dev->pdata->chip_id != BCM58XX_DEVICE_ID)
-                return;
-
         for (i = 0; i < B53_N_PORTS; i++) {
                 port = &priv->port_intrs[i];
 
diff --git a/drivers/net/dsa/mv88e6xxx/global1_atu.c b/drivers/net/dsa/mv88e6xxx/global1_atu.c
index 5200e4bdce93..ea243840ee0f 100644
--- a/drivers/net/dsa/mv88e6xxx/global1_atu.c
+++ b/drivers/net/dsa/mv88e6xxx/global1_atu.c
@@ -314,6 +314,7 @@ static irqreturn_t mv88e6xxx_g1_atu_prob_irq_thread_fn(int irq, void *dev_id)
 {
         struct mv88e6xxx_chip *chip = dev_id;
         struct mv88e6xxx_atu_entry entry;
+        int spid;
         int err;
         u16 val;
 
@@ -336,6 +337,8 @@ static irqreturn_t mv88e6xxx_g1_atu_prob_irq_thread_fn(int irq, void *dev_id)
         if (err)
                 goto out;
 
+        spid = entry.state;
+
         if (val & MV88E6XXX_G1_ATU_OP_AGE_OUT_VIOLATION) {
                 dev_err_ratelimited(chip->dev,
                                     "ATU age out violation for %pM\n",
@@ -344,23 +347,23 @@ static irqreturn_t mv88e6xxx_g1_atu_prob_irq_thread_fn(int irq, void *dev_id)
 
         if (val & MV88E6XXX_G1_ATU_OP_MEMBER_VIOLATION) {
                 dev_err_ratelimited(chip->dev,
-                                    "ATU member violation for %pM portvec %x\n",
-                                    entry.mac, entry.portvec);
-                chip->ports[entry.portvec].atu_member_violation++;
+                                    "ATU member violation for %pM portvec %x spid %d\n",
+                                    entry.mac, entry.portvec, spid);
+                chip->ports[spid].atu_member_violation++;
         }
 
         if (val & MV88E6XXX_G1_ATU_OP_MISS_VIOLATION) {
                 dev_err_ratelimited(chip->dev,
-                                    "ATU miss violation for %pM portvec %x\n",
-                                    entry.mac, entry.portvec);
-                chip->ports[entry.portvec].atu_miss_violation++;
+                                    "ATU miss violation for %pM portvec %x spid %d\n",
+                                    entry.mac, entry.portvec, spid);
+                chip->ports[spid].atu_miss_violation++;
         }
 
         if (val & MV88E6XXX_G1_ATU_OP_FULL_VIOLATION) {
                 dev_err_ratelimited(chip->dev,
-                                    "ATU full violation for %pM portvec %x\n",
-                                    entry.mac, entry.portvec);
-                chip->ports[entry.portvec].atu_full_violation++;
+                                    "ATU full violation for %pM portvec %x spid %d\n",
+                                    entry.mac, entry.portvec, spid);
+                chip->ports[spid].atu_full_violation++;
         }
         mutex_unlock(&chip->reg_lock);
 
diff --git a/drivers/net/dsa/mv88e6xxx/serdes.c b/drivers/net/dsa/mv88e6xxx/serdes.c
index 2caa8c8b4b55..1bfc5ff8d81d 100644
--- a/drivers/net/dsa/mv88e6xxx/serdes.c
+++ b/drivers/net/dsa/mv88e6xxx/serdes.c
@@ -664,7 +664,7 @@ int mv88e6390_serdes_irq_setup(struct mv88e6xxx_chip *chip, int port)
         if (port < 9)
                 return 0;
 
-        return mv88e6390_serdes_irq_setup(chip, port);
+        return mv88e6390x_serdes_irq_setup(chip, port);
 }
 
 void mv88e6390x_serdes_irq_free(struct mv88e6xxx_chip *chip, int port)
diff --git a/drivers/net/ethernet/alteon/acenic.c b/drivers/net/ethernet/alteon/acenic.c
index 4f11f98347ed..1827ef1f6d55 100644
--- a/drivers/net/ethernet/alteon/acenic.c
+++ b/drivers/net/ethernet/alteon/acenic.c
@@ -2059,7 +2059,7 @@ static inline void ace_tx_int(struct net_device *dev,
                 if (skb) {
                         dev->stats.tx_packets++;
                         dev->stats.tx_bytes += skb->len;
-                        dev_kfree_skb_irq(skb);
+                        dev_consume_skb_irq(skb);
                         info->skb = NULL;
                 }
 
diff --git a/drivers/net/ethernet/altera/altera_msgdma.c b/drivers/net/ethernet/altera/altera_msgdma.c
index 0fb986ba3290..0ae723f75341 100644
--- a/drivers/net/ethernet/altera/altera_msgdma.c
+++ b/drivers/net/ethernet/altera/altera_msgdma.c
@@ -145,7 +145,8 @@ u32 msgdma_tx_completions(struct altera_tse_private *priv)
                         & 0xffff;
 
         if (inuse) { /* Tx FIFO is not empty */
-                ready = priv->tx_prod - priv->tx_cons - inuse - 1;
+                ready = max_t(int,
+                              priv->tx_prod - priv->tx_cons - inuse - 1, 0);
         } else {
                 /* Check for buffered last packet */
                 status = csrrd32(priv->tx_dma_csr, msgdma_csroffs(status));
diff --git a/drivers/net/ethernet/altera/altera_tse_main.c b/drivers/net/ethernet/altera/altera_tse_main.c
index 02921d877c08..aa1d1f5339d2 100644
--- a/drivers/net/ethernet/altera/altera_tse_main.c
+++ b/drivers/net/ethernet/altera/altera_tse_main.c
@@ -714,8 +714,10 @@ static struct phy_device *connect_local_phy(struct net_device *dev)
 
                 phydev = phy_connect(dev, phy_id_fmt, &altera_tse_adjust_link,
                                      priv->phy_iface);
-                if (IS_ERR(phydev))
+                if (IS_ERR(phydev)) {
                         netdev_err(dev, "Could not attach to PHY\n");
+                        phydev = NULL;
+                }
 
         } else {
                 int ret;
diff --git a/drivers/net/ethernet/amd/amd8111e.c b/drivers/net/ethernet/amd/amd8111e.c
index a90080f12e67..e548c0ae2e00 100644
--- a/drivers/net/ethernet/amd/amd8111e.c
+++ b/drivers/net/ethernet/amd/amd8111e.c
@@ -666,7 +666,7 @@ static int amd8111e_tx(struct net_device *dev)
                         pci_unmap_single(lp->pci_dev, lp->tx_dma_addr[tx_index],
                                         lp->tx_skbuff[tx_index]->len,
                                         PCI_DMA_TODEVICE);
-                        dev_kfree_skb_irq (lp->tx_skbuff[tx_index]);
+                        dev_consume_skb_irq(lp->tx_skbuff[tx_index]);
                         lp->tx_skbuff[tx_index] = NULL;
                         lp->tx_dma_addr[tx_index] = 0;
                 }
diff --git a/drivers/net/ethernet/apple/bmac.c b/drivers/net/ethernet/apple/bmac.c
index 6a8e2567f2bd..4d3855ceb500 100644
--- a/drivers/net/ethernet/apple/bmac.c
+++ b/drivers/net/ethernet/apple/bmac.c
@@ -777,7 +777,7 @@ static irqreturn_t bmac_txdma_intr(int irq, void *dev_id)
 
                 if (bp->tx_bufs[bp->tx_empty]) {
                         ++dev->stats.tx_packets;
-                        dev_kfree_skb_irq(bp->tx_bufs[bp->tx_empty]);
+                        dev_consume_skb_irq(bp->tx_bufs[bp->tx_empty]);
                 }
                 bp->tx_bufs[bp->tx_empty] = NULL;
                 bp->tx_fullup = 0;
diff --git a/drivers/net/ethernet/broadcom/b44.c b/drivers/net/ethernet/broadcom/b44.c
index f44808959ff3..97ab0dd25552 100644
--- a/drivers/net/ethernet/broadcom/b44.c
+++ b/drivers/net/ethernet/broadcom/b44.c
@@ -638,7 +638,7 @@ static void b44_tx(struct b44 *bp)
                 bytes_compl += skb->len;
                 pkts_compl++;
 
-                dev_kfree_skb_irq(skb);
+                dev_consume_skb_irq(skb);
         }
 
         netdev_completed_queue(bp->dev, pkts_compl, bytes_compl);
@@ -1012,7 +1012,7 @@ static netdev_tx_t b44_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 }
 
                 skb_copy_from_linear_data(skb, skb_put(bounce_skb, len), len);
-                dev_kfree_skb_any(skb);
+                dev_consume_skb_any(skb);
                 skb = bounce_skb;
         }
 
diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
index f9521d0274b7..28c9b0bdf2f6 100644
--- a/drivers/net/ethernet/broadcom/bcmsysport.c
+++ b/drivers/net/ethernet/broadcom/bcmsysport.c
@@ -520,7 +520,6 @@ static void bcm_sysport_get_wol(struct net_device *dev,
                                 struct ethtool_wolinfo *wol)
 {
         struct bcm_sysport_priv *priv = netdev_priv(dev);
-        u32 reg;
 
         wol->supported = WAKE_MAGIC | WAKE_MAGICSECURE | WAKE_FILTER;
         wol->wolopts = priv->wolopts;
@@ -528,11 +527,7 @@ static void bcm_sysport_get_wol(struct net_device *dev,
         if (!(priv->wolopts & WAKE_MAGICSECURE))
                 return;
 
-        /* Return the programmed SecureOn password */
-        reg = umac_readl(priv, UMAC_PSW_MS);
-        put_unaligned_be16(reg, &wol->sopass[0]);
-        reg = umac_readl(priv, UMAC_PSW_LS);
-        put_unaligned_be32(reg, &wol->sopass[2]);
+        memcpy(wol->sopass, priv->sopass, sizeof(priv->sopass));
 }
 
 static int bcm_sysport_set_wol(struct net_device *dev,
@@ -548,13 +543,8 @@ static int bcm_sysport_set_wol(struct net_device *dev,
         if (wol->wolopts & ~supported)
                 return -EINVAL;
 
-        /* Program the SecureOn password */
-        if (wol->wolopts & WAKE_MAGICSECURE) {
-                umac_writel(priv, get_unaligned_be16(&wol->sopass[0]),
-                            UMAC_PSW_MS);
-                umac_writel(priv, get_unaligned_be32(&wol->sopass[2]),
-                            UMAC_PSW_LS);
-        }
+        if (wol->wolopts & WAKE_MAGICSECURE)
+                memcpy(priv->sopass, wol->sopass, sizeof(priv->sopass));
 
         /* Flag the device and relevant IRQ as wakeup capable */
         if (wol->wolopts) {
@@ -2649,13 +2639,18 @@ static int bcm_sysport_suspend_to_wol(struct bcm_sysport_priv *priv)
         unsigned int index, i = 0;
         u32 reg;
 
-        /* Password has already been programmed */
         reg = umac_readl(priv, UMAC_MPD_CTRL);
         if (priv->wolopts & (WAKE_MAGIC | WAKE_MAGICSECURE))
                 reg |= MPD_EN;
         reg &= ~PSW_EN;
-        if (priv->wolopts & WAKE_MAGICSECURE)
+        if (priv->wolopts & WAKE_MAGICSECURE) {
+                /* Program the SecureOn password */
+                umac_writel(priv, get_unaligned_be16(&priv->sopass[0]),
+                            UMAC_PSW_MS);
+                umac_writel(priv, get_unaligned_be32(&priv->sopass[2]),
+                            UMAC_PSW_LS);
                 reg |= PSW_EN;
+        }
         umac_writel(priv, reg, UMAC_MPD_CTRL);
 
         if (priv->wolopts & WAKE_FILTER) {
diff --git a/drivers/net/ethernet/broadcom/bcmsysport.h b/drivers/net/ethernet/broadcom/bcmsysport.h
index 0887e6356649..0b192fea9c5d 100644
--- a/drivers/net/ethernet/broadcom/bcmsysport.h
+++ b/drivers/net/ethernet/broadcom/bcmsysport.h
@@ -12,6 +12,7 @@
 #define __BCM_SYSPORT_H
 
 #include <linux/bitmap.h>
+#include <linux/ethtool.h>
 #include <linux/if_vlan.h>
 #include <linux/net_dim.h>
 
@@ -778,6 +779,7 @@ struct bcm_sysport_priv {
         unsigned int            crc_fwd:1;
         u16                     rev;
         u32                     wolopts;
+        u8                      sopass[SOPASS_MAX];
         unsigned int            wol_irq_disabled:1;
 
         /* MIB related fields */
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index 6a512871176b..8bc7e495b027 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -4973,12 +4973,18 @@ static int bnxt_hwrm_ring_alloc(struct bnxt *bp)
                 struct bnxt_cp_ring_info *cpr = &bnapi->cp_ring;
                 struct bnxt_ring_struct *ring = &cpr->cp_ring_struct;
                 u32 map_idx = ring->map_idx;
+                unsigned int vector;
 
+                vector = bp->irq_tbl[map_idx].vector;
+                disable_irq_nosync(vector);
                 rc = hwrm_ring_alloc_send_msg(bp, ring, type, map_idx);
-                if (rc)
+                if (rc) {
+                        enable_irq(vector);
                         goto err_out;
+                }
                 bnxt_set_db(bp, &cpr->cp_db, type, map_idx, ring->fw_ring_id);
                 bnxt_db_nq(bp, &cpr->cp_db, cpr->cp_raw_cons);
+                enable_irq(vector);
                 bp->grp_info[i].cp_fw_ring_id = ring->fw_ring_id;
 
                 if (!i) {
diff --git a/drivers/net/ethernet/broadcom/sb1250-mac.c b/drivers/net/ethernet/broadcom/sb1250-mac.c
index 5db9f4158e62..134ae2862efa 100644
--- a/drivers/net/ethernet/broadcom/sb1250-mac.c
+++ b/drivers/net/ethernet/broadcom/sb1250-mac.c
@@ -1288,7 +1288,7 @@ static void sbdma_tx_process(struct sbmac_softc *sc, struct sbmacdma *d,
                  * for transmits, we just free buffers.
                  */
 
-                dev_kfree_skb_irq(sb);
+                dev_consume_skb_irq(sb);
 
                 /*
                  * .. and advance to the next buffer.
diff --git a/drivers/net/ethernet/cadence/macb.h b/drivers/net/ethernet/cadence/macb.h
index 3d45f4c92cf6..9bbaad9f3d63 100644
--- a/drivers/net/ethernet/cadence/macb.h
+++ b/drivers/net/ethernet/cadence/macb.h
@@ -643,6 +643,7 @@
 #define MACB_CAPS_JUMBO                         0x00000020
 #define MACB_CAPS_GEM_HAS_PTP                   0x00000040
 #define MACB_CAPS_BD_RD_PREFETCH                0x00000080
+#define MACB_CAPS_NEEDS_RSTONUBR                0x00000100
 #define MACB_CAPS_FIFO_MODE                     0x10000000
 #define MACB_CAPS_GIGABIT_MODE_AVAILABLE        0x20000000
 #define MACB_CAPS_SG_DISABLED                   0x40000000
@@ -1214,6 +1215,8 @@ struct macb {
 
         int     rx_bd_rd_prefetch;
         int     tx_bd_rd_prefetch;
+
+        u32     rx_intr_mask;
 };
 
 #ifdef CONFIG_MACB_USE_HWSTAMP
diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
index 66cc7927061a..2b2882615e8b 100644
--- a/drivers/net/ethernet/cadence/macb_main.c
+++ b/drivers/net/ethernet/cadence/macb_main.c
@@ -56,8 +56,7 @@
 /* level of occupied TX descriptors under which we wake up TX process */
 #define MACB_TX_WAKEUP_THRESH(bp)       (3 * (bp)->tx_ring_size / 4)
 
-#define MACB_RX_INT_FLAGS       (MACB_BIT(RCOMP) | MACB_BIT(RXUBR)      \
-                                 | MACB_BIT(ISR_ROVR))
+#define MACB_RX_INT_FLAGS       (MACB_BIT(RCOMP) | MACB_BIT(ISR_ROVR))
 #define MACB_TX_ERR_FLAGS       (MACB_BIT(ISR_TUND)                     \
                                         | MACB_BIT(ISR_RLE)             \
                                         | MACB_BIT(TXERR))
@@ -1270,7 +1269,7 @@ static int macb_poll(struct napi_struct *napi, int budget)
                                 queue_writel(queue, ISR, MACB_BIT(RCOMP));
                         napi_reschedule(napi);
                 } else {
-                        queue_writel(queue, IER, MACB_RX_INT_FLAGS);
+                        queue_writel(queue, IER, bp->rx_intr_mask);
                 }
         }
 
@@ -1288,7 +1287,7 @@ static void macb_hresp_error_task(unsigned long data)
         u32 ctrl;
 
         for (q = 0, queue = bp->queues; q < bp->num_queues; ++q, ++queue) {
-                queue_writel(queue, IDR, MACB_RX_INT_FLAGS |
+                queue_writel(queue, IDR, bp->rx_intr_mask |
                                          MACB_TX_INT_FLAGS |
                                          MACB_BIT(HRESP));
         }
@@ -1318,7 +1317,7 @@ static void macb_hresp_error_task(unsigned long data)
 
                 /* Enable interrupts */
                 queue_writel(queue, IER,
-                             MACB_RX_INT_FLAGS |
+                             bp->rx_intr_mask |
                              MACB_TX_INT_FLAGS |
                              MACB_BIT(HRESP));
         }
@@ -1372,14 +1371,14 @@ static irqreturn_t macb_interrupt(int irq, void *dev_id)
                             (unsigned int)(queue - bp->queues),
                             (unsigned long)status);
 
-                if (status & MACB_RX_INT_FLAGS) {
+                if (status & bp->rx_intr_mask) {
                         /* There's no point taking any more interrupts
                          * until we have processed the buffers. The
                          * scheduling call may fail if the poll routine
                          * is already scheduled, so disable interrupts
                          * now.
                          */
-                        queue_writel(queue, IDR, MACB_RX_INT_FLAGS);
+                        queue_writel(queue, IDR, bp->rx_intr_mask);
                         if (bp->caps & MACB_CAPS_ISR_CLEAR_ON_WRITE)
                                 queue_writel(queue, ISR, MACB_BIT(RCOMP));
 
@@ -1412,8 +1411,9 @@ static irqreturn_t macb_interrupt(int irq, void *dev_id)
                 /* There is a hardware issue under heavy load where DMA can
                  * stop, this causes endless "used buffer descriptor read"
                  * interrupts but it can be cleared by re-enabling RX. See
-                 * the at91 manual, section 41.3.1 or the Zynq manual
-                 * section 16.7.4 for details.
+                 * the at91rm9200 manual, section 41.3.1 or the Zynq manual
+                 * section 16.7.4 for details. RXUBR is only enabled for
+                 * these two versions.
                  */
                 if (status & MACB_BIT(RXUBR)) {
                         ctrl = macb_readl(bp, NCR);
@@ -2259,7 +2259,7 @@ static void macb_init_hw(struct macb *bp)
 
                 /* Enable interrupts */
                 queue_writel(queue, IER,
-                             MACB_RX_INT_FLAGS |
+                             bp->rx_intr_mask |
                              MACB_TX_INT_FLAGS |
                              MACB_BIT(HRESP));
         }
@@ -3907,6 +3907,7 @@ static const struct macb_config sama5d4_config = {
 };
 
 static const struct macb_config emac_config = {
+        .caps = MACB_CAPS_NEEDS_RSTONUBR,
         .clk_init = at91ether_clk_init,
         .init = at91ether_init,
 };
@@ -3928,7 +3929,8 @@ static const struct macb_config zynqmp_config = {
 };
 
 static const struct macb_config zynq_config = {
-        .caps = MACB_CAPS_GIGABIT_MODE_AVAILABLE | MACB_CAPS_NO_GIGABIT_HALF,
+        .caps = MACB_CAPS_GIGABIT_MODE_AVAILABLE | MACB_CAPS_NO_GIGABIT_HALF |
+                MACB_CAPS_NEEDS_RSTONUBR,
         .dma_burst_length = 16,
         .clk_init = macb_clk_init,
         .init = macb_init,
@@ -4083,6 +4085,10 @@ static int macb_probe(struct platform_device *pdev)
                                                 macb_dma_desc_get_size(bp);
         }
 
+        bp->rx_intr_mask = MACB_RX_INT_FLAGS;
+        if (bp->caps & MACB_CAPS_NEEDS_RSTONUBR)
+                bp->rx_intr_mask |= MACB_BIT(RXUBR);
+
         mac = of_get_mac_address(np);
         if (mac) {
                 ether_addr_copy(bp->dev->dev_addr, mac);
diff --git a/drivers/net/ethernet/cavium/Kconfig b/drivers/net/ethernet/cavium/Kconfig
index 5f03199a3acf..05f4a3b21e29 100644
--- a/drivers/net/ethernet/cavium/Kconfig
+++ b/drivers/net/ethernet/cavium/Kconfig
@@ -54,7 +54,6 @@ config CAVIUM_PTP
         tristate "Cavium PTP coprocessor as PTP clock"
         depends on 64BIT && PCI
         imply PTP_1588_CLOCK
-        default y
         ---help---
           This driver adds support for the Precision Time Protocol Clocks and
           Timestamping coprocessor (PTP) found on Cavium processors.
diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c
index 60641e202534..9a7f70db20c7 100644
--- a/drivers/net/ethernet/cisco/enic/enic_main.c
+++ b/drivers/net/ethernet/cisco/enic/enic_main.c
@@ -1434,7 +1434,8 @@ static void enic_rq_indicate_buf(struct vnic_rq *rq,
                  * csum is correct or is zero.
                  */
                 if ((netdev->features & NETIF_F_RXCSUM) && !csum_not_calc &&
-                    tcp_udp_csum_ok && ipv4_csum_ok && outer_csum_ok) {
+                    tcp_udp_csum_ok && outer_csum_ok &&
+                    (ipv4_csum_ok || ipv6)) {
                         skb->ip_summed = CHECKSUM_UNNECESSARY;
                         skb->csum_level = encap;
                 }
diff --git a/drivers/net/ethernet/dec/tulip/de2104x.c b/drivers/net/ethernet/dec/tulip/de2104x.c
index 13430f75496c..f1a2da15dd0a 100644
--- a/drivers/net/ethernet/dec/tulip/de2104x.c
+++ b/drivers/net/ethernet/dec/tulip/de2104x.c
@@ -585,7 +585,7 @@ static void de_tx (struct de_private *de)
                                 netif_dbg(de, tx_done, de->dev,
                                           "tx done, slot %d\n", tx_tail);
                         }
-                        dev_kfree_skb_irq(skb);
+                        dev_consume_skb_irq(skb);
                 }
 
 next:
diff --git a/drivers/net/ethernet/freescale/dpaa2/Kconfig b/drivers/net/ethernet/freescale/dpaa2/Kconfig
index 809a155eb193..f6d244c663fd 100644
--- a/drivers/net/ethernet/freescale/dpaa2/Kconfig
+++ b/drivers/net/ethernet/freescale/dpaa2/Kconfig
@@ -9,8 +9,9 @@ config FSL_DPAA2_ETH
 
 config FSL_DPAA2_PTP_CLOCK
         tristate "Freescale DPAA2 PTP Clock"
-        depends on FSL_DPAA2_ETH && POSIX_TIMERS
-        select PTP_1588_CLOCK
+        depends on FSL_DPAA2_ETH
+        imply PTP_1588_CLOCK
+        default y
         help
           This driver adds support for using the DPAA2 1588 timer module
           as a PTP clock.
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index ae0f88bce9aa..2370dc204202 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -3467,7 +3467,7 @@ fec_probe(struct platform_device *pdev)
         if (ret)
                 goto failed_clk_ipg;
 
-        fep->reg_phy = devm_regulator_get(&pdev->dev, "phy");
+        fep->reg_phy = devm_regulator_get_optional(&pdev->dev, "phy");
         if (!IS_ERR(fep->reg_phy)) {
                 ret = regulator_enable(fep->reg_phy);
                 if (ret) {
diff --git a/drivers/net/ethernet/freescale/fec_mpc52xx.c b/drivers/net/ethernet/freescale/fec_mpc52xx.c
index b90bab72efdb..c1968b3ecec8 100644
--- a/drivers/net/ethernet/freescale/fec_mpc52xx.c
+++ b/drivers/net/ethernet/freescale/fec_mpc52xx.c
@@ -369,7 +369,7 @@ static irqreturn_t mpc52xx_fec_tx_interrupt(int irq, void *dev_id)
                 dma_unmap_single(dev->dev.parent, bd->skb_pa, skb->len,
                                  DMA_TO_DEVICE);
 
-                dev_kfree_skb_irq(skb);
+                dev_consume_skb_irq(skb);
         }
         spin_unlock(&priv->lock);
 
diff --git a/drivers/net/ethernet/freescale/ucc_geth.c b/drivers/net/ethernet/freescale/ucc_geth.c
index c3d539e209ed..eb3e65e8868f 100644
--- a/drivers/net/ethernet/freescale/ucc_geth.c
+++ b/drivers/net/ethernet/freescale/ucc_geth.c
@@ -1879,6 +1879,8 @@ static void ucc_geth_free_tx(struct ucc_geth_private *ugeth)
         u16 i, j;
         u8 __iomem *bd;
 
+        netdev_reset_queue(ugeth->ndev);
+
         ug_info = ugeth->ug_info;
         uf_info = &ug_info->uf_info;
 
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_enet.c b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
index 5b33238c6680..60e7d7ae3787 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_enet.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
@@ -2418,6 +2418,8 @@ static int hns_nic_dev_probe(struct platform_device *pdev)
 out_notify_fail:
         (void)cancel_work_sync(&priv->service_task);
 out_read_prop_fail:
+        /* safe for ACPI FW */
+        of_node_put(to_of_node(priv->fwnode));
         free_netdev(ndev);
         return ret;
 }
@@ -2447,6 +2449,9 @@ static int hns_nic_dev_remove(struct platform_device *pdev)
         set_bit(NIC_STATE_REMOVING, &priv->state);
         (void)cancel_work_sync(&priv->service_task);
 
+        /* safe for ACPI FW */
+        of_node_put(to_of_node(priv->fwnode));
+
         free_netdev(ndev);
         return 0;
 }
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c b/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c
index 8e9b95871d30..ce15d2350db9 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c
@@ -1157,16 +1157,18 @@ static int hns_get_regs_len(struct net_device *net_dev)
  */
 static int hns_nic_nway_reset(struct net_device *netdev)
 {
-        int ret = 0;
         struct phy_device *phy = netdev->phydev;
 
-        if (netif_running(netdev)) {
-                /* if autoneg is disabled, don't restart auto-negotiation */
-                if (phy && phy->autoneg == AUTONEG_ENABLE)
-                        ret = genphy_restart_aneg(phy);
-        }
+        if (!netif_running(netdev))
+                return 0;
 
-        return ret;
+        if (!phy)
+                return -EOPNOTSUPP;
+
+        if (phy->autoneg != AUTONEG_ENABLE)
+                return -EINVAL;
+
+        return genphy_restart_aneg(phy);
 }
 
 static u32
diff --git a/drivers/net/ethernet/hisilicon/hns_mdio.c b/drivers/net/ethernet/hisilicon/hns_mdio.c
index 017e08452d8c..baf5cc251f32 100644
--- a/drivers/net/ethernet/hisilicon/hns_mdio.c
+++ b/drivers/net/ethernet/hisilicon/hns_mdio.c
@@ -321,7 +321,7 @@ static int hns_mdio_read(struct mii_bus *bus, int phy_id, int regnum)
                 }
 
                 hns_mdio_cmd_write(mdio_dev, is_c45,
-                                   MDIO_C45_WRITE_ADDR, phy_id, devad);
+                                   MDIO_C45_READ, phy_id, devad);
         }
 
         /* Step 5: waitting for MDIO_COMMAND_REG 's mdio_start==0,*/
diff --git a/drivers/net/ethernet/i825xx/82596.c b/drivers/net/ethernet/i825xx/82596.c
index d719668a6684..92929750f832 100644
--- a/drivers/net/ethernet/i825xx/82596.c
+++ b/drivers/net/ethernet/i825xx/82596.c
@@ -1310,7 +1310,7 @@ static irqreturn_t i596_interrupt(int irq, void *dev_id)
                                                 dev->stats.tx_aborted_errors++;
                                 }
 
-                                dev_kfree_skb_irq(skb);
+                                dev_consume_skb_irq(skb);
 
                                 tx_cmd->cmd.command = 0; /* Mark free */
                                 break;
diff --git a/drivers/net/ethernet/ibm/ibmveth.c b/drivers/net/ethernet/ibm/ibmveth.c
index 098d8764c0ea..dd71d5db7274 100644
--- a/drivers/net/ethernet/ibm/ibmveth.c
+++ b/drivers/net/ethernet/ibm/ibmveth.c
@@ -1313,7 +1313,6 @@ static int ibmveth_poll(struct napi_struct *napi, int budget)
         unsigned long lpar_rc;
         u16 mss = 0;
 
-restart_poll:
         while (frames_processed < budget) {
                 if (!ibmveth_rxq_pending_buffer(adapter))
                         break;
@@ -1401,7 +1400,6 @@ restart_poll:
                     napi_reschedule(napi)) {
                         lpar_rc = h_vio_signal(adapter->vdev->unit_address,
                                                VIO_IRQ_DISABLE);
-                        goto restart_poll;
                 }
         }
 
diff --git a/drivers/net/ethernet/marvell/skge.c b/drivers/net/ethernet/marvell/skge.c
index 04fd1f135011..654ac534b10e 100644
--- a/drivers/net/ethernet/marvell/skge.c
+++ b/drivers/net/ethernet/marvell/skge.c
@@ -152,8 +152,10 @@ static void skge_get_regs(struct net_device *dev, struct ethtool_regs *regs,
         memset(p, 0, regs->len);
         memcpy_fromio(p, io, B3_RAM_ADDR);
 
-        memcpy_fromio(p + B3_RI_WTO_R1, io + B3_RI_WTO_R1,
-                      regs->len - B3_RI_WTO_R1);
+        if (regs->len > B3_RI_WTO_R1) {
+                memcpy_fromio(p + B3_RI_WTO_R1, io + B3_RI_WTO_R1,
+                              regs->len - B3_RI_WTO_R1);
+        }
 }
 
 /* Wake on Lan only supported on Yukon chips with rev 1 or above */
diff --git a/drivers/net/ethernet/mellanox/mlx4/cq.c b/drivers/net/ethernet/mellanox/mlx4/cq.c
index db909b6069b5..65f8a4b6ed0c 100644
--- a/drivers/net/ethernet/mellanox/mlx4/cq.c
+++ b/drivers/net/ethernet/mellanox/mlx4/cq.c
@@ -306,14 +306,16 @@ static int mlx4_init_user_cqes(void *buf, int entries, int cqe_size)
 
         if (entries_per_copy < entries) {
                 for (i = 0; i < entries / entries_per_copy; i++) {
-                        err = copy_to_user(buf, init_ents, PAGE_SIZE);
+                        err = copy_to_user((void __user *)buf, init_ents, PAGE_SIZE) ?
+                                -EFAULT : 0;
                         if (err)
                                 goto out;
 
                         buf += PAGE_SIZE;
                 }
         } else {
-                err = copy_to_user(buf, init_ents, entries * cqe_size);
+                err = copy_to_user((void __user *)buf, init_ents, entries * cqe_size) ?
+                        -EFAULT : 0;
         }
 
 out:
diff --git a/drivers/net/ethernet/mellanox/mlx4/fw.c b/drivers/net/ethernet/mellanox/mlx4/fw.c
index 7df728f1e5b5..6e501af0e532 100644
--- a/drivers/net/ethernet/mellanox/mlx4/fw.c
+++ b/drivers/net/ethernet/mellanox/mlx4/fw.c
@@ -2067,9 +2067,11 @@ int mlx4_QUERY_HCA(struct mlx4_dev *dev,
 {
         struct mlx4_cmd_mailbox *mailbox;
         __be32 *outbox;
+        u64 qword_field;
         u32 dword_field;
-        int err;
+        u16 word_field;
         u8 byte_field;
+        int err;
         static const u8 a0_dmfs_query_hw_steering[] =  {
                 [0] = MLX4_STEERING_DMFS_A0_DEFAULT,
                 [1] = MLX4_STEERING_DMFS_A0_DYNAMIC,
@@ -2097,19 +2099,32 @@ int mlx4_QUERY_HCA(struct mlx4_dev *dev,
 
         /* QPC/EEC/CQC/EQC/RDMARC attributes */
 
-        MLX4_GET(param->qpc_base,      outbox, INIT_HCA_QPC_BASE_OFFSET);
-        MLX4_GET(param->log_num_qps,   outbox, INIT_HCA_LOG_QP_OFFSET);
-        MLX4_GET(param->srqc_base,     outbox, INIT_HCA_SRQC_BASE_OFFSET);
-        MLX4_GET(param->log_num_srqs,  outbox, INIT_HCA_LOG_SRQ_OFFSET);
-        MLX4_GET(param->cqc_base,      outbox, INIT_HCA_CQC_BASE_OFFSET);
-        MLX4_GET(param->log_num_cqs,   outbox, INIT_HCA_LOG_CQ_OFFSET);
-        MLX4_GET(param->altc_base,     outbox, INIT_HCA_ALTC_BASE_OFFSET);
-        MLX4_GET(param->auxc_base,     outbox, INIT_HCA_AUXC_BASE_OFFSET);
-        MLX4_GET(param->eqc_base,      outbox, INIT_HCA_EQC_BASE_OFFSET);
-        MLX4_GET(param->log_num_eqs,   outbox, INIT_HCA_LOG_EQ_OFFSET);
-        MLX4_GET(param->num_sys_eqs,   outbox, INIT_HCA_NUM_SYS_EQS_OFFSET);
-        MLX4_GET(param->rdmarc_base,   outbox, INIT_HCA_RDMARC_BASE_OFFSET);
-        MLX4_GET(param->log_rd_per_qp, outbox, INIT_HCA_LOG_RD_OFFSET);
+        MLX4_GET(qword_field, outbox, INIT_HCA_QPC_BASE_OFFSET);
+        param->qpc_base = qword_field & ~((u64)0x1f);
+        MLX4_GET(byte_field, outbox, INIT_HCA_LOG_QP_OFFSET);
+        param->log_num_qps = byte_field & 0x1f;
+        MLX4_GET(qword_field, outbox, INIT_HCA_SRQC_BASE_OFFSET);
+        param->srqc_base = qword_field & ~((u64)0x1f);
+        MLX4_GET(byte_field, outbox, INIT_HCA_LOG_SRQ_OFFSET);
+        param->log_num_srqs = byte_field & 0x1f;
+        MLX4_GET(qword_field, outbox, INIT_HCA_CQC_BASE_OFFSET);
+        param->cqc_base = qword_field & ~((u64)0x1f);
+        MLX4_GET(byte_field, outbox, INIT_HCA_LOG_CQ_OFFSET);
+        param->log_num_cqs = byte_field & 0x1f;
+        MLX4_GET(qword_field, outbox, INIT_HCA_ALTC_BASE_OFFSET);
+        param->altc_base = qword_field;
+        MLX4_GET(qword_field, outbox, INIT_HCA_AUXC_BASE_OFFSET);
+        param->auxc_base = qword_field;
+        MLX4_GET(qword_field, outbox, INIT_HCA_EQC_BASE_OFFSET);
+        param->eqc_base = qword_field & ~((u64)0x1f);
+        MLX4_GET(byte_field, outbox, INIT_HCA_LOG_EQ_OFFSET);
+        param->log_num_eqs = byte_field & 0x1f;
+        MLX4_GET(word_field, outbox, INIT_HCA_NUM_SYS_EQS_OFFSET);
+        param->num_sys_eqs = word_field & 0xfff;
+        MLX4_GET(qword_field, outbox, INIT_HCA_RDMARC_BASE_OFFSET);
+        param->rdmarc_base = qword_field & ~((u64)0x1f);
+        MLX4_GET(byte_field, outbox, INIT_HCA_LOG_RD_OFFSET);
+        param->log_rd_per_qp = byte_field & 0x7;
 
         MLX4_GET(dword_field, outbox, INIT_HCA_FLAGS_OFFSET);
         if (dword_field & (1 << INIT_HCA_DEVICE_MANAGED_FLOW_STEERING_EN)) {
@@ -2128,22 +2143,21 @@ int mlx4_QUERY_HCA(struct mlx4_dev *dev,
         /* steering attributes */
         if (param->steering_mode == MLX4_STEERING_MODE_DEVICE_MANAGED) {
                 MLX4_GET(param->mc_base, outbox, INIT_HCA_FS_BASE_OFFSET);
-                MLX4_GET(param->log_mc_entry_sz, outbox,
-                         INIT_HCA_FS_LOG_ENTRY_SZ_OFFSET);
-                MLX4_GET(param->log_mc_table_sz, outbox,
-                         INIT_HCA_FS_LOG_TABLE_SZ_OFFSET);
-                MLX4_GET(byte_field, outbox,
-                         INIT_HCA_FS_A0_OFFSET);
+                MLX4_GET(byte_field, outbox, INIT_HCA_FS_LOG_ENTRY_SZ_OFFSET);
+                param->log_mc_entry_sz = byte_field & 0x1f;
+                MLX4_GET(byte_field, outbox, INIT_HCA_FS_LOG_TABLE_SZ_OFFSET);
+                param->log_mc_table_sz = byte_field & 0x1f;
+                MLX4_GET(byte_field, outbox, INIT_HCA_FS_A0_OFFSET);
                 param->dmfs_high_steer_mode =
                         a0_dmfs_query_hw_steering[(byte_field >> 6) & 3];
         } else {
                 MLX4_GET(param->mc_base, outbox, INIT_HCA_MC_BASE_OFFSET);
-                MLX4_GET(param->log_mc_entry_sz, outbox,
-                         INIT_HCA_LOG_MC_ENTRY_SZ_OFFSET);
-                MLX4_GET(param->log_mc_hash_sz,  outbox,
-                         INIT_HCA_LOG_MC_HASH_SZ_OFFSET);
-                MLX4_GET(param->log_mc_table_sz, outbox,
-                         INIT_HCA_LOG_MC_TABLE_SZ_OFFSET);
+                MLX4_GET(byte_field, outbox, INIT_HCA_LOG_MC_ENTRY_SZ_OFFSET);
+                param->log_mc_entry_sz = byte_field & 0x1f;
+                MLX4_GET(byte_field,  outbox, INIT_HCA_LOG_MC_HASH_SZ_OFFSET);
+                param->log_mc_hash_sz = byte_field & 0x1f;
+                MLX4_GET(byte_field, outbox, INIT_HCA_LOG_MC_TABLE_SZ_OFFSET);
+                param->log_mc_table_sz = byte_field & 0x1f;
         }
 
         /* CX3 is capable of extending CQEs/EQEs from 32 to 64 bytes */
@@ -2167,15 +2181,18 @@ int mlx4_QUERY_HCA(struct mlx4_dev *dev,
         /* TPT attributes */
 
         MLX4_GET(param->dmpt_base,  outbox, INIT_HCA_DMPT_BASE_OFFSET);
-        MLX4_GET(param->mw_enabled, outbox, INIT_HCA_TPT_MW_OFFSET);
-        MLX4_GET(param->log_mpt_sz, outbox, INIT_HCA_LOG_MPT_SZ_OFFSET);
+        MLX4_GET(byte_field, outbox, INIT_HCA_TPT_MW_OFFSET);
+        param->mw_enabled = byte_field >> 7;
+        MLX4_GET(byte_field, outbox, INIT_HCA_LOG_MPT_SZ_OFFSET);
+        param->log_mpt_sz = byte_field & 0x3f;
         MLX4_GET(param->mtt_base,   outbox, INIT_HCA_MTT_BASE_OFFSET);
         MLX4_GET(param->cmpt_base,  outbox, INIT_HCA_CMPT_BASE_OFFSET);
 
         /* UAR attributes */
 
         MLX4_GET(param->uar_page_sz, outbox, INIT_HCA_UAR_PAGE_SZ_OFFSET);
-        MLX4_GET(param->log_uar_sz, outbox, INIT_HCA_LOG_UAR_SZ_OFFSET);
+        MLX4_GET(byte_field, outbox, INIT_HCA_LOG_UAR_SZ_OFFSET);
+        param->log_uar_sz = byte_field & 0xf;
 
         /* phv_check enable */
         MLX4_GET(byte_field, outbox, INIT_HCA_CACHELINE_SZ_OFFSET);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c
index 046948ead152..f3c7ab6faea5 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c
@@ -256,6 +256,7 @@ int mlx5e_tc_tun_create_header_ipv4(struct mlx5e_priv *priv,
         e->m_neigh.family = n->ops->family;
         memcpy(&e->m_neigh.dst_ip, n->primary_key, n->tbl->key_len);
         e->out_dev = out_dev;
+        e->route_dev = route_dev;
 
         /* It's important to add the neigh to the hash table before checking
          * the neigh validity state. So if we'll get a notification, in case the
@@ -369,6 +370,7 @@ int mlx5e_tc_tun_create_header_ipv6(struct mlx5e_priv *priv,
         e->m_neigh.family = n->ops->family;
         memcpy(&e->m_neigh.dst_ip, n->primary_key, n->tbl->key_len);
         e->out_dev = out_dev;
+        e->route_dev = route_dev;
 
         /* It's importent to add the neigh to the hash table before checking
          * the neigh validity state. So if we'll get a notification, in case the
@@ -612,16 +614,18 @@ int mlx5e_tc_tun_parse(struct net_device *filter_dev,
                        struct mlx5_flow_spec *spec,
                        struct tc_cls_flower_offload *f,
                        void *headers_c,
-                       void *headers_v)
+                       void *headers_v, u8 *match_level)
 {
         int tunnel_type;
         int err = 0;
 
         tunnel_type = mlx5e_tc_tun_get_type(filter_dev);
         if (tunnel_type == MLX5E_TC_TUNNEL_TYPE_VXLAN) {
+                *match_level = MLX5_MATCH_L4;
                 err = mlx5e_tc_tun_parse_vxlan(priv, spec, f,
                                                headers_c, headers_v);
         } else if (tunnel_type == MLX5E_TC_TUNNEL_TYPE_GRETAP) {
+                *match_level = MLX5_MATCH_L3;
                 err = mlx5e_tc_tun_parse_gretap(priv, spec, f,
                                                 headers_c, headers_v);
         } else {
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.h b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.h
index 706ce7bf15e7..b63f15de899d 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.h
@@ -39,6 +39,6 @@ int mlx5e_tc_tun_parse(struct net_device *filter_dev,
                        struct mlx5_flow_spec *spec,
                        struct tc_cls_flower_offload *f,
                        void *headers_c,
-                       void *headers_v);
+                       void *headers_v, u8 *match_level);
 
 #endif //__MLX5_EN_TC_TUNNEL_H__
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index 8cfd2ec7c0a2..01819e5c9975 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -950,7 +950,7 @@ static int mlx5e_open_rq(struct mlx5e_channel *c,
         if (params->rx_dim_enabled)
                 __set_bit(MLX5E_RQ_STATE_AM, &c->rq.state);
 
-        if (params->pflags & MLX5E_PFLAG_RX_NO_CSUM_COMPLETE)
+        if (MLX5E_GET_PFLAG(params, MLX5E_PFLAG_RX_NO_CSUM_COMPLETE))
                 __set_bit(MLX5E_RQ_STATE_NO_CSUM_COMPLETE, &c->rq.state);
 
         return 0;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
index 04736212a21c..ef9e472daffb 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
@@ -596,6 +596,10 @@ static void mlx5e_rep_update_flows(struct mlx5e_priv *priv,
         if (neigh_connected && !(e->flags & MLX5_ENCAP_ENTRY_VALID)) {
                 ether_addr_copy(e->h_dest, ha);
                 ether_addr_copy(eth->h_dest, ha);
+                /* Update the encap source mac, in case that we delete
+                 * the flows when encap source mac changed.
+                 */
+                ether_addr_copy(eth->h_source, e->route_dev->dev_addr);
 
                 mlx5e_tc_encap_flows_add(priv, e);
         }
@@ -1126,9 +1130,17 @@ static int mlx5e_rep_get_phys_port_name(struct net_device *dev,
         struct mlx5e_priv *priv = netdev_priv(dev);
         struct mlx5e_rep_priv *rpriv = priv->ppriv;
         struct mlx5_eswitch_rep *rep = rpriv->rep;
-        int ret;
+        int ret, pf_num;
+
+        ret = mlx5_lag_get_pf_num(priv->mdev, &pf_num);
+        if (ret)
+                return ret;
+
+        if (rep->vport == FDB_UPLINK_VPORT)
+                ret = snprintf(buf, len, "p%d", pf_num);
+        else
+                ret = snprintf(buf, len, "pf%dvf%d", pf_num, rep->vport - 1);
 
-        ret = snprintf(buf, len, "%d", rep->vport - 1);
         if (ret >= len)
                 return -EOPNOTSUPP;
 
@@ -1285,6 +1297,18 @@ static int mlx5e_uplink_rep_set_mac(struct net_device *netdev, void *addr)
         return 0;
 }
 
+static int mlx5e_uplink_rep_set_vf_vlan(struct net_device *dev, int vf, u16 vlan, u8 qos,
+                                        __be16 vlan_proto)
+{
+        netdev_warn_once(dev, "legacy vf vlan setting isn't supported in switchdev mode\n");
+
+        if (vlan != 0)
+                return -EOPNOTSUPP;
+
+        /* allow setting 0-vid for compatibility with libvirt */
+        return 0;
+}
+
 static const struct switchdev_ops mlx5e_rep_switchdev_ops = {
         .switchdev_port_attr_get        = mlx5e_attr_get,
 };
@@ -1319,6 +1343,7 @@ static const struct net_device_ops mlx5e_netdev_ops_uplink_rep = {
         .ndo_set_vf_rate         = mlx5e_set_vf_rate,
         .ndo_get_vf_config       = mlx5e_get_vf_config,
         .ndo_get_vf_stats        = mlx5e_get_vf_stats,
+        .ndo_set_vf_vlan         = mlx5e_uplink_rep_set_vf_vlan,
 };
 
 bool mlx5e_eswitch_rep(struct net_device *netdev)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.h b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.h
index edd722824697..36eafc877e6b 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.h
@@ -148,6 +148,7 @@ struct mlx5e_encap_entry {
         unsigned char h_dest[ETH_ALEN]; /* destination eth addr */
 
         struct net_device *out_dev;
+        struct net_device *route_dev;
         int tunnel_type;
         int tunnel_hlen;
         int reformat_type;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
index cae6c6d48984..b5c1b039375a 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
@@ -128,6 +128,7 @@ struct mlx5e_tc_flow_parse_attr {
         struct net_device *filter_dev;
         struct mlx5_flow_spec spec;
         int num_mod_hdr_actions;
+        int max_mod_hdr_actions;
         void *mod_hdr_actions;
         int mirred_ifindex[MLX5_MAX_FLOW_FWD_VPORTS];
 };
@@ -1302,7 +1303,7 @@ static void mlx5e_tc_del_flow(struct mlx5e_priv *priv,
 static int parse_tunnel_attr(struct mlx5e_priv *priv,
                              struct mlx5_flow_spec *spec,
                              struct tc_cls_flower_offload *f,
-                             struct net_device *filter_dev)
+                             struct net_device *filter_dev, u8 *match_level)
 {
         struct netlink_ext_ack *extack = f->common.extack;
         void *headers_c = MLX5_ADDR_OF(fte_match_param, spec->match_criteria,
@@ -1317,7 +1318,7 @@ static int parse_tunnel_attr(struct mlx5e_priv *priv,
         int err = 0;
 
         err = mlx5e_tc_tun_parse(filter_dev, priv, spec, f,
-                                 headers_c, headers_v);
+                                 headers_c, headers_v, match_level);
         if (err) {
                 NL_SET_ERR_MSG_MOD(extack,
                                    "failed to parse tunnel attributes");
@@ -1426,7 +1427,7 @@ static int __parse_cls_flower(struct mlx5e_priv *priv,
                               struct mlx5_flow_spec *spec,
                               struct tc_cls_flower_offload *f,
                               struct net_device *filter_dev,
-                              u8 *match_level)
+                              u8 *match_level, u8 *tunnel_match_level)
 {
         struct netlink_ext_ack *extack = f->common.extack;
         void *headers_c = MLX5_ADDR_OF(fte_match_param, spec->match_criteria,
@@ -1477,7 +1478,7 @@ static int __parse_cls_flower(struct mlx5e_priv *priv,
                 switch (key->addr_type) {
                 case FLOW_DISSECTOR_KEY_IPV4_ADDRS:
                 case FLOW_DISSECTOR_KEY_IPV6_ADDRS:
-                        if (parse_tunnel_attr(priv, spec, f, filter_dev))
+                        if (parse_tunnel_attr(priv, spec, f, filter_dev, tunnel_match_level))
                                 return -EOPNOTSUPP;
                         break;
                 default:
@@ -1826,11 +1827,11 @@ static int parse_cls_flower(struct mlx5e_priv *priv,
         struct mlx5_core_dev *dev = priv->mdev;
         struct mlx5_eswitch *esw = dev->priv.eswitch;
         struct mlx5e_rep_priv *rpriv = priv->ppriv;
+        u8 match_level, tunnel_match_level = MLX5_MATCH_NONE;
         struct mlx5_eswitch_rep *rep;
-        u8 match_level;
         int err;
 
-        err = __parse_cls_flower(priv, spec, f, filter_dev, &match_level);
+        err = __parse_cls_flower(priv, spec, f, filter_dev, &match_level, &tunnel_match_level);
 
         if (!err && (flow->flags & MLX5E_TC_FLOW_ESWITCH)) {
                 rep = rpriv->rep;
@@ -1846,10 +1847,12 @@ static int parse_cls_flower(struct mlx5e_priv *priv,
                 }
         }
 
-        if (flow->flags & MLX5E_TC_FLOW_ESWITCH)
+        if (flow->flags & MLX5E_TC_FLOW_ESWITCH) {
                 flow->esw_attr->match_level = match_level;
-        else
+                flow->esw_attr->tunnel_match_level = tunnel_match_level;
+        } else {
                 flow->nic_attr->match_level = match_level;
+        }
 
         return err;
 }
@@ -1934,9 +1937,9 @@ static struct mlx5_fields fields[] = {
         OFFLOAD(UDP_DPORT, 2, udp.dest,   0),
 };
 
-/* On input attr->num_mod_hdr_actions tells how many HW actions can be parsed at
- * max from the SW pedit action. On success, it says how many HW actions were
- * actually parsed.
+/* On input attr->max_mod_hdr_actions tells how many HW actions can be parsed at
+ * max from the SW pedit action. On success, attr->num_mod_hdr_actions
+ * says how many HW actions were actually parsed.
  */
 static int offload_pedit_fields(struct pedit_headers *masks,
                                 struct pedit_headers *vals,
@@ -1960,9 +1963,11 @@ static int offload_pedit_fields(struct pedit_headers *masks,
         add_vals = &vals[TCA_PEDIT_KEY_EX_CMD_ADD];
 
         action_size = MLX5_UN_SZ_BYTES(set_action_in_add_action_in_auto);
-        action = parse_attr->mod_hdr_actions;
-        max_actions = parse_attr->num_mod_hdr_actions;
-        nactions = 0;
+        action = parse_attr->mod_hdr_actions +
+                 parse_attr->num_mod_hdr_actions * action_size;
+
+        max_actions = parse_attr->max_mod_hdr_actions;
+        nactions = parse_attr->num_mod_hdr_actions;
 
         for (i = 0; i < ARRAY_SIZE(fields); i++) {
                 f = &fields[i];
@@ -2073,7 +2078,7 @@ static int alloc_mod_hdr_actions(struct mlx5e_priv *priv,
         if (!parse_attr->mod_hdr_actions)
                 return -ENOMEM;
 
-        parse_attr->num_mod_hdr_actions = max_actions;
+        parse_attr->max_mod_hdr_actions = max_actions;
         return 0;
 }
 
@@ -2119,9 +2124,11 @@ static int parse_tc_pedit_action(struct mlx5e_priv *priv,
                         goto out_err;
         }
 
-        err = alloc_mod_hdr_actions(priv, a, namespace, parse_attr);
-        if (err)
-                goto out_err;
+        if (!parse_attr->mod_hdr_actions) {
+                err = alloc_mod_hdr_actions(priv, a, namespace, parse_attr);
+                if (err)
+                        goto out_err;
+        }
 
         err = offload_pedit_fields(masks, vals, parse_attr, extack);
         if (err < 0)
@@ -2179,6 +2186,7 @@ static bool csum_offload_supported(struct mlx5e_priv *priv,
 
 static bool modify_header_match_supported(struct mlx5_flow_spec *spec,
                                           struct tcf_exts *exts,
+                                          u32 actions,
                                           struct netlink_ext_ack *extack)
 {
         const struct tc_action *a;
@@ -2188,7 +2196,11 @@ static bool modify_header_match_supported(struct mlx5_flow_spec *spec,
         u16 ethertype;
         int nkeys, i;
 
-        headers_v = MLX5_ADDR_OF(fte_match_param, spec->match_value, outer_headers);
+        if (actions & MLX5_FLOW_CONTEXT_ACTION_DECAP)
+                headers_v = MLX5_ADDR_OF(fte_match_param, spec->match_value, inner_headers);
+        else
+                headers_v = MLX5_ADDR_OF(fte_match_param, spec->match_value, outer_headers);
+
         ethertype = MLX5_GET(fte_match_set_lyr_2_4, headers_v, ethertype);
 
         /* for non-IP we only re-write MACs, so we're okay */
@@ -2245,7 +2257,7 @@ static bool actions_match_supported(struct mlx5e_priv *priv,
 
         if (actions & MLX5_FLOW_CONTEXT_ACTION_MOD_HDR)
                 return modify_header_match_supported(&parse_attr->spec, exts,
-                                                     extack);
+                                                     actions, extack);
 
         return true;
 }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
index 598ad7e4d5c9..0e55cd1f2e98 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
@@ -387,8 +387,14 @@ netdev_tx_t mlx5e_sq_xmit(struct mlx5e_txqsq *sq, struct sk_buff *skb,
         num_wqebbs = DIV_ROUND_UP(ds_cnt, MLX5_SEND_WQEBB_NUM_DS);
         contig_wqebbs_room = mlx5_wq_cyc_get_contig_wqebbs(wq, pi);
         if (unlikely(contig_wqebbs_room < num_wqebbs)) {
+#ifdef CONFIG_MLX5_EN_IPSEC
+                struct mlx5_wqe_eth_seg cur_eth = wqe->eth;
+#endif
                 mlx5e_fill_sq_frag_edge(sq, wq, pi, contig_wqebbs_room);
                 mlx5e_sq_fetch_wqe(sq, &wqe, &pi);
+#ifdef CONFIG_MLX5_EN_IPSEC
+                wqe->eth = cur_eth;
+#endif
         }
 
         /* fill wqe */
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
index a44ea7b85614..5b492b67f4e1 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
@@ -1134,13 +1134,6 @@ static int esw_vport_ingress_config(struct mlx5_eswitch *esw,
         int err = 0;
         u8 *smac_v;
 
-        if (vport->info.spoofchk && !is_valid_ether_addr(vport->info.mac)) {
-                mlx5_core_warn(esw->dev,
-                               "vport[%d] configure ingress rules failed, illegal mac with spoofchk\n",
-                               vport->vport);
-                return -EPERM;
-        }
-
         esw_vport_cleanup_ingress_rules(esw, vport);
 
         if (!vport->info.vlan && !vport->info.qos && !vport->info.spoofchk) {
@@ -1728,7 +1721,7 @@ int mlx5_eswitch_init(struct mlx5_core_dev *dev)
         int vport_num;
         int err;
 
-        if (!MLX5_ESWITCH_MANAGER(dev))
+        if (!MLX5_VPORT_MANAGER(dev))
                 return 0;
 
         esw_info(dev,
@@ -1797,7 +1790,7 @@ abort:
 
 void mlx5_eswitch_cleanup(struct mlx5_eswitch *esw)
 {
-        if (!esw || !MLX5_ESWITCH_MANAGER(esw->dev))
+        if (!esw || !MLX5_VPORT_MANAGER(esw->dev))
                 return;
 
         esw_info(esw->dev, "cleanup\n");
@@ -1827,13 +1820,10 @@ int mlx5_eswitch_set_vport_mac(struct mlx5_eswitch *esw,
         mutex_lock(&esw->state_lock);
         evport = &esw->vports[vport];
 
-        if (evport->info.spoofchk && !is_valid_ether_addr(mac)) {
+        if (evport->info.spoofchk && !is_valid_ether_addr(mac))
                 mlx5_core_warn(esw->dev,
-                               "MAC invalidation is not allowed when spoofchk is on, vport(%d)\n",
+                               "Set invalid MAC while spoofchk is on, vport(%d)\n",
                                vport);
-                err = -EPERM;
-                goto unlock;
-        }
 
         err = mlx5_modify_nic_vport_mac_address(esw->dev, vport, mac);
         if (err) {
@@ -1979,6 +1969,10 @@ int mlx5_eswitch_set_vport_spoofchk(struct mlx5_eswitch *esw,
         evport = &esw->vports[vport];
         pschk = evport->info.spoofchk;
         evport->info.spoofchk = spoofchk;
+        if (pschk && !is_valid_ether_addr(evport->info.mac))
+                mlx5_core_warn(esw->dev,
+                               "Spoofchk in set while MAC is invalid, vport(%d)\n",
+                               evport->vport);
         if (evport->enabled && esw->mode == SRIOV_LEGACY)
                 err = esw_vport_ingress_config(esw, evport);
         if (err)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h
index 9c89eea9b2c3..748ff178a1d6 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h
@@ -312,6 +312,7 @@ struct mlx5_esw_flow_attr {
         } dests[MLX5_MAX_FLOW_FWD_VPORTS];
         u32     mod_hdr_id;
         u8      match_level;
+        u8      tunnel_match_level;
         struct mlx5_fc *counter;
         u32     chain;
         u16     prio;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
index 53065b6ae593..d4e6fe5b9300 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
@@ -160,14 +160,15 @@ mlx5_eswitch_add_offloaded_rule(struct mlx5_eswitch *esw,
                 MLX5_SET_TO_ONES(fte_match_set_misc, misc,
                                  source_eswitch_owner_vhca_id);
 
-        if (attr->match_level == MLX5_MATCH_NONE)
-                spec->match_criteria_enable = MLX5_MATCH_MISC_PARAMETERS;
-        else
-                spec->match_criteria_enable = MLX5_MATCH_OUTER_HEADERS |
-                                              MLX5_MATCH_MISC_PARAMETERS;
-
-        if (flow_act.action & MLX5_FLOW_CONTEXT_ACTION_DECAP)
-                spec->match_criteria_enable |= MLX5_MATCH_INNER_HEADERS;
+        spec->match_criteria_enable = MLX5_MATCH_MISC_PARAMETERS;
+        if (flow_act.action & MLX5_FLOW_CONTEXT_ACTION_DECAP) {
+                if (attr->tunnel_match_level != MLX5_MATCH_NONE)
+                        spec->match_criteria_enable |= MLX5_MATCH_OUTER_HEADERS;
+                if (attr->match_level != MLX5_MATCH_NONE)
+                        spec->match_criteria_enable |= MLX5_MATCH_INNER_HEADERS;
+        } else if (attr->match_level != MLX5_MATCH_NONE) {
+                spec->match_criteria_enable |= MLX5_MATCH_OUTER_HEADERS;
+        }
 
         if (flow_act.action & MLX5_FLOW_CONTEXT_ACTION_MOD_HDR)
                 flow_act.modify_id = attr->mod_hdr_id;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lag.c b/drivers/net/ethernet/mellanox/mlx5/core/lag.c
index 3a6baed722d8..2d223385dc81 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/lag.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/lag.c
@@ -616,6 +616,27 @@ void mlx5_lag_add(struct mlx5_core_dev *dev, struct net_device *netdev)
         }
 }
 
+int mlx5_lag_get_pf_num(struct mlx5_core_dev *dev, int *pf_num)
+{
+        struct mlx5_lag *ldev;
+        int n;
+
+        ldev = mlx5_lag_dev_get(dev);
+        if (!ldev) {
+                mlx5_core_warn(dev, "no lag device, can't get pf num\n");
+                return -EINVAL;
+        }
+
+        for (n = 0; n < MLX5_MAX_PORTS; n++)
+                if (ldev->pf[n].dev == dev) {
+                        *pf_num = n;
+                        return 0;
+                }
+
+        mlx5_core_warn(dev, "wasn't able to locate pf in the lag device\n");
+        return -EINVAL;
+}
+
 /* Must be called with intf_mutex held */
 void mlx5_lag_remove(struct mlx5_core_dev *dev)
 {
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h b/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h
index c68dcea5985b..5300b0b6d836 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h
@@ -187,6 +187,8 @@ static inline int mlx5_lag_is_lacp_owner(struct mlx5_core_dev *dev)
                     MLX5_CAP_GEN(dev, lag_master);
 }
 
+int mlx5_lag_get_pf_num(struct mlx5_core_dev *dev, int *pf_num);
+
 void mlx5_reload_interface(struct mlx5_core_dev *mdev, int protocol);
 void mlx5_lag_update(struct mlx5_core_dev *dev);
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/qp.c b/drivers/net/ethernet/mellanox/mlx5/core/qp.c
index 388f205a497f..370ca94b6775 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/qp.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/qp.c
@@ -44,14 +44,15 @@ static struct mlx5_core_rsc_common *
 mlx5_get_rsc(struct mlx5_qp_table *table, u32 rsn)
 {
         struct mlx5_core_rsc_common *common;
+        unsigned long flags;
 
-        spin_lock(&table->lock);
+        spin_lock_irqsave(&table->lock, flags);
 
         common = radix_tree_lookup(&table->tree, rsn);
         if (common)
                 atomic_inc(&common->refcount);
 
-        spin_unlock(&table->lock);
+        spin_unlock_irqrestore(&table->lock, flags);
 
         return common;
 }
diff --git a/drivers/net/ethernet/qlogic/qed/qed.h b/drivers/net/ethernet/qlogic/qed/qed.h
index 24a90163775e..2d8a77cc156b 100644
--- a/drivers/net/ethernet/qlogic/qed/qed.h
+++ b/drivers/net/ethernet/qlogic/qed/qed.h
@@ -53,7 +53,7 @@
 extern const struct qed_common_ops qed_common_ops_pass;
 
 #define QED_MAJOR_VERSION               8
-#define QED_MINOR_VERSION               33
+#define QED_MINOR_VERSION               37
 #define QED_REVISION_VERSION            0
 #define QED_ENGINEERING_VERSION         20
 
diff --git a/drivers/net/ethernet/qlogic/qed/qed_dev.c b/drivers/net/ethernet/qlogic/qed/qed_dev.c
index 8f6551421945..2ecaaaa4469a 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_dev.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_dev.c
@@ -795,19 +795,19 @@ static void qed_init_qm_pq(struct qed_hwfn *p_hwfn,
 
 /* get pq index according to PQ_FLAGS */
 static u16 *qed_init_qm_get_idx_from_flags(struct qed_hwfn *p_hwfn,
-                                           u32 pq_flags)
+                                           unsigned long pq_flags)
 {
         struct qed_qm_info *qm_info = &p_hwfn->qm_info;
 
         /* Can't have multiple flags set here */
-        if (bitmap_weight((unsigned long *)&pq_flags,
+        if (bitmap_weight(&pq_flags,
                           sizeof(pq_flags) * BITS_PER_BYTE) > 1) {
-                DP_ERR(p_hwfn, "requested multiple pq flags 0x%x\n", pq_flags);
+                DP_ERR(p_hwfn, "requested multiple pq flags 0x%lx\n", pq_flags);
                 goto err;
         }
 
         if (!(qed_get_pq_flags(p_hwfn) & pq_flags)) {
-                DP_ERR(p_hwfn, "pq flag 0x%x is not set\n", pq_flags);
+                DP_ERR(p_hwfn, "pq flag 0x%lx is not set\n", pq_flags);
                 goto err;
         }
 
diff --git a/drivers/net/ethernet/qlogic/qed/qed_l2.c b/drivers/net/ethernet/qlogic/qed/qed_l2.c
index 67c02ea93906..58be1c4c6668 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_l2.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_l2.c
@@ -609,6 +609,10 @@ qed_sp_update_accept_mode(struct qed_hwfn *p_hwfn,
                           (!!(accept_filter & QED_ACCEPT_MCAST_MATCHED) &&
                            !!(accept_filter & QED_ACCEPT_MCAST_UNMATCHED)));
 
+                SET_FIELD(state, ETH_VPORT_TX_MODE_UCAST_ACCEPT_ALL,
+                          (!!(accept_filter & QED_ACCEPT_UCAST_MATCHED) &&
+                           !!(accept_filter & QED_ACCEPT_UCAST_UNMATCHED)));
+
                 SET_FIELD(state, ETH_VPORT_TX_MODE_BCAST_ACCEPT_ALL,
                           !!(accept_filter & QED_ACCEPT_BCAST));
 
@@ -744,6 +748,11 @@ int qed_sp_vport_update(struct qed_hwfn *p_hwfn,
                 return rc;
         }
 
+        if (p_params->update_ctl_frame_check) {
+                p_cmn->ctl_frame_mac_check_en = p_params->mac_chk_en;
+                p_cmn->ctl_frame_ethtype_check_en = p_params->ethtype_chk_en;
+        }
+
         /* Update mcast bins for VFs, PF doesn't use this functionality */
         qed_sp_update_mcast_bin(p_hwfn, p_ramrod, p_params);
 
@@ -2207,7 +2216,7 @@ static int qed_fill_eth_dev_info(struct qed_dev *cdev,
                         u16 num_queues = 0;
 
                         /* Since the feature controls only queue-zones,
-                         * make sure we have the contexts [rx, tx, xdp] to
+                         * make sure we have the contexts [rx, xdp, tcs] to
                          * match.
                          */
                         for_each_hwfn(cdev, i) {
@@ -2217,7 +2226,8 @@ static int qed_fill_eth_dev_info(struct qed_dev *cdev,
                                 u16 cids;
 
                                 cids = hwfn->pf_params.eth_pf_params.num_cons;
-                                num_queues += min_t(u16, l2_queues, cids / 3);
+                                cids /= (2 + info->num_tc);
+                                num_queues += min_t(u16, l2_queues, cids);
                         }
 
                         /* queues might theoretically be >256, but interrupts'
@@ -2688,7 +2698,8 @@ static int qed_configure_filter_rx_mode(struct qed_dev *cdev,
         if (type == QED_FILTER_RX_MODE_TYPE_PROMISC) {
                 accept_flags.rx_accept_filter |= QED_ACCEPT_UCAST_UNMATCHED |
                                                  QED_ACCEPT_MCAST_UNMATCHED;
-                accept_flags.tx_accept_filter |= QED_ACCEPT_MCAST_UNMATCHED;
+                accept_flags.tx_accept_filter |= QED_ACCEPT_UCAST_UNMATCHED |
+                                                 QED_ACCEPT_MCAST_UNMATCHED;
         } else if (type == QED_FILTER_RX_MODE_TYPE_MULTI_PROMISC) {
                 accept_flags.rx_accept_filter |= QED_ACCEPT_MCAST_UNMATCHED;
                 accept_flags.tx_accept_filter |= QED_ACCEPT_MCAST_UNMATCHED;
@@ -2860,7 +2871,8 @@ static int qed_get_coalesce(struct qed_dev *cdev, u16 *coal, void *handle)
         p_hwfn = p_cid->p_owner;
         rc = qed_get_queue_coalesce(p_hwfn, coal, handle);
         if (rc)
-                DP_NOTICE(p_hwfn, "Unable to read queue coalescing\n");
+                DP_VERBOSE(cdev, QED_MSG_DEBUG,
+                           "Unable to read queue coalescing\n");
 
         return rc;
 }
diff --git a/drivers/net/ethernet/qlogic/qed/qed_l2.h b/drivers/net/ethernet/qlogic/qed/qed_l2.h
index 8d80f1095d17..7127d5aaac42 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_l2.h
+++ b/drivers/net/ethernet/qlogic/qed/qed_l2.h
@@ -219,6 +219,9 @@ struct qed_sp_vport_update_params {
         struct qed_rss_params           *rss_params;
         struct qed_filter_accept_flags  accept_flags;
         struct qed_sge_tpa_params       *sge_tpa_params;
+        u8                              update_ctl_frame_check;
+        u8                              mac_chk_en;
+        u8                              ethtype_chk_en;
 };
 
 int qed_sp_vport_update(struct qed_hwfn *p_hwfn,
diff --git a/drivers/net/ethernet/qlogic/qed/qed_ll2.c b/drivers/net/ethernet/qlogic/qed/qed_ll2.c
index d9237c65a838..b5f419b71287 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_ll2.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_ll2.c
@@ -2451,19 +2451,24 @@ static int qed_ll2_start_xmit(struct qed_dev *cdev, struct sk_buff *skb,
 {
         struct qed_ll2_tx_pkt_info pkt;
         const skb_frag_t *frag;
+        u8 flags = 0, nr_frags;
         int rc = -EINVAL, i;
         dma_addr_t mapping;
         u16 vlan = 0;
-        u8 flags = 0;
 
         if (unlikely(skb->ip_summed != CHECKSUM_NONE)) {
                 DP_INFO(cdev, "Cannot transmit a checksummed packet\n");
                 return -EINVAL;
         }
 
-        if (1 + skb_shinfo(skb)->nr_frags > CORE_LL2_TX_MAX_BDS_PER_PACKET) {
+        /* Cache number of fragments from SKB since SKB may be freed by
+         * the completion routine after calling qed_ll2_prepare_tx_packet()
+         */
+        nr_frags = skb_shinfo(skb)->nr_frags;
+
+        if (1 + nr_frags > CORE_LL2_TX_MAX_BDS_PER_PACKET) {
                 DP_ERR(cdev, "Cannot transmit a packet with %d fragments\n",
-                       1 + skb_shinfo(skb)->nr_frags);
+                       1 + nr_frags);
                 return -EINVAL;
         }
 
@@ -2485,7 +2490,7 @@ static int qed_ll2_start_xmit(struct qed_dev *cdev, struct sk_buff *skb,
         }
 
         memset(&pkt, 0, sizeof(pkt));
-        pkt.num_of_bds = 1 + skb_shinfo(skb)->nr_frags;
+        pkt.num_of_bds = 1 + nr_frags;
         pkt.vlan = vlan;
         pkt.bd_flags = flags;
         pkt.tx_dest = QED_LL2_TX_DEST_NW;
@@ -2496,12 +2501,17 @@ static int qed_ll2_start_xmit(struct qed_dev *cdev, struct sk_buff *skb,
             test_bit(QED_LL2_XMIT_FLAGS_FIP_DISCOVERY, &xmit_flags))
                 pkt.remove_stag = true;
 
+        /* qed_ll2_prepare_tx_packet() may actually send the packet if
+         * there are no fragments in the skb and subsequently the completion
+         * routine may run and free the SKB, so no dereferencing the SKB
+         * beyond this point unless skb has any fragments.
+         */
         rc = qed_ll2_prepare_tx_packet(&cdev->hwfns[0], cdev->ll2->handle,
                                        &pkt, 1);
         if (rc)
                 goto err;
 
-        for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
+        for (i = 0; i < nr_frags; i++) {
                 frag = &skb_shinfo(skb)->frags[i];
 
                 mapping = skb_frag_dma_map(&cdev->pdev->dev, frag, 0,
diff --git a/drivers/net/ethernet/qlogic/qed/qed_sp.h b/drivers/net/ethernet/qlogic/qed/qed_sp.h
index 4179c9013fc6..96ab77ae6af5 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_sp.h
+++ b/drivers/net/ethernet/qlogic/qed/qed_sp.h
@@ -382,6 +382,7 @@ void qed_consq_setup(struct qed_hwfn *p_hwfn);
  * @param p_hwfn
  */
 void qed_consq_free(struct qed_hwfn *p_hwfn);
+int qed_spq_pend_post(struct qed_hwfn *p_hwfn);
 
 /**
  * @file
diff --git a/drivers/net/ethernet/qlogic/qed/qed_sp_commands.c b/drivers/net/ethernet/qlogic/qed/qed_sp_commands.c
index 888274fa208b..5a495fda9e9d 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_sp_commands.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_sp_commands.c
@@ -604,6 +604,9 @@ int qed_sp_pf_update_stag(struct qed_hwfn *p_hwfn)
 
         p_ent->ramrod.pf_update.update_mf_vlan_flag = true;
         p_ent->ramrod.pf_update.mf_vlan = cpu_to_le16(p_hwfn->hw_info.ovlan);
+        if (test_bit(QED_MF_UFP_SPECIFIC, &p_hwfn->cdev->mf_bits))
+                p_ent->ramrod.pf_update.mf_vlan |=
+                        cpu_to_le16(((u16)p_hwfn->ufp_info.tc << 13));
 
         return qed_spq_post(p_hwfn, p_ent, NULL);
 }
diff --git a/drivers/net/ethernet/qlogic/qed/qed_spq.c b/drivers/net/ethernet/qlogic/qed/qed_spq.c
index eb88bbc6b193..ba64ff9bedbd 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_spq.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_spq.c
@@ -397,6 +397,11 @@ int qed_eq_completion(struct qed_hwfn *p_hwfn, void *cookie)
 
         qed_eq_prod_update(p_hwfn, qed_chain_get_prod_idx(p_chain));
 
+        /* Attempt to post pending requests */
+        spin_lock_bh(&p_hwfn->p_spq->lock);
+        rc = qed_spq_pend_post(p_hwfn);
+        spin_unlock_bh(&p_hwfn->p_spq->lock);
+
         return rc;
 }
 
@@ -767,7 +772,7 @@ static int qed_spq_post_list(struct qed_hwfn *p_hwfn,
         return 0;
 }
 
-static int qed_spq_pend_post(struct qed_hwfn *p_hwfn)
+int qed_spq_pend_post(struct qed_hwfn *p_hwfn)
 {
         struct qed_spq *p_spq = p_hwfn->p_spq;
         struct qed_spq_entry *p_ent = NULL;
@@ -905,7 +910,6 @@ int qed_spq_completion(struct qed_hwfn *p_hwfn,
         struct qed_spq_entry    *p_ent = NULL;
         struct qed_spq_entry    *tmp;
         struct qed_spq_entry    *found = NULL;
-        int                     rc;
 
         if (!p_hwfn)
                 return -EINVAL;
@@ -963,12 +967,7 @@ int qed_spq_completion(struct qed_hwfn *p_hwfn,
                  */
                 qed_spq_return_entry(p_hwfn, found);
 
-        /* Attempt to post pending requests */
-        spin_lock_bh(&p_spq->lock);
-        rc = qed_spq_pend_post(p_hwfn);
-        spin_unlock_bh(&p_spq->lock);
-
-        return rc;
+        return 0;
 }
 
 int qed_consq_alloc(struct qed_hwfn *p_hwfn)
diff --git a/drivers/net/ethernet/qlogic/qed/qed_sriov.c b/drivers/net/ethernet/qlogic/qed/qed_sriov.c
index ca6290fa0f30..71a7af134dd8 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_sriov.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_sriov.c
@@ -1969,7 +1969,9 @@ static void qed_iov_vf_mbx_start_vport(struct qed_hwfn *p_hwfn,
         params.vport_id = vf->vport_id;
         params.max_buffers_per_cqe = start->max_buffers_per_cqe;
         params.mtu = vf->mtu;
-        params.check_mac = true;
+
+        /* Non trusted VFs should enable control frame filtering */
+        params.check_mac = !vf->p_vf_info.is_trusted_configured;
 
         rc = qed_sp_eth_vport_start(p_hwfn, &params);
         if (rc) {
@@ -5130,6 +5132,9 @@ static void qed_iov_handle_trust_change(struct qed_hwfn *hwfn)
                 params.opaque_fid = vf->opaque_fid;
                 params.vport_id = vf->vport_id;
 
+                params.update_ctl_frame_check = 1;
+                params.mac_chk_en = !vf_info->is_trusted_configured;
+
                 if (vf_info->rx_accept_mode & mask) {
                         flags->update_rx_mode_config = 1;
                         flags->rx_accept_filter = vf_info->rx_accept_mode;
@@ -5147,7 +5152,8 @@ static void qed_iov_handle_trust_change(struct qed_hwfn *hwfn)
                 }
 
                 if (flags->update_rx_mode_config ||
-                    flags->update_tx_mode_config)
+                    flags->update_tx_mode_config ||
+                    params.update_ctl_frame_check)
                         qed_sp_vport_update(hwfn, &params,
                                             QED_SPQ_MODE_EBLOCK, NULL);
         }
diff --git a/drivers/net/ethernet/qlogic/qed/qed_vf.c b/drivers/net/ethernet/qlogic/qed/qed_vf.c
index b6cccf44bf40..5dda547772c1 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_vf.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_vf.c
@@ -261,6 +261,7 @@ static int qed_vf_pf_acquire(struct qed_hwfn *p_hwfn)
         struct pfvf_acquire_resp_tlv *resp = &p_iov->pf2vf_reply->acquire_resp;
         struct pf_vf_pfdev_info *pfdev_info = &resp->pfdev_info;
         struct vf_pf_resc_request *p_resc;
+        u8 retry_cnt = VF_ACQUIRE_THRESH;
         bool resources_acquired = false;
         struct vfpf_acquire_tlv *req;
         int rc = 0, attempts = 0;
@@ -314,6 +315,15 @@ static int qed_vf_pf_acquire(struct qed_hwfn *p_hwfn)
 
                 /* send acquire request */
                 rc = qed_send_msg2pf(p_hwfn, &resp->hdr.status, sizeof(*resp));
+
+                /* Re-try acquire in case of vf-pf hw channel timeout */
+                if (retry_cnt && rc == -EBUSY) {
+                        DP_VERBOSE(p_hwfn, QED_MSG_IOV,
+                                   "VF retrying to acquire due to VPC timeout\n");
+                        retry_cnt--;
+                        continue;
+                }
+
                 if (rc)
                         goto exit;
 
diff --git a/drivers/net/ethernet/qlogic/qede/qede.h b/drivers/net/ethernet/qlogic/qede/qede.h
index 613249d1e967..730997b13747 100644
--- a/drivers/net/ethernet/qlogic/qede/qede.h
+++ b/drivers/net/ethernet/qlogic/qede/qede.h
@@ -56,7 +56,7 @@
 #include <net/tc_act/tc_gact.h>
 
 #define QEDE_MAJOR_VERSION              8
-#define QEDE_MINOR_VERSION              33
+#define QEDE_MINOR_VERSION              37
 #define QEDE_REVISION_VERSION           0
 #define QEDE_ENGINEERING_VERSION        20
 #define DRV_MODULE_VERSION __stringify(QEDE_MAJOR_VERSION) "."  \
@@ -494,6 +494,9 @@ struct qede_reload_args {
 
 /* Datapath functions definition */
 netdev_tx_t qede_start_xmit(struct sk_buff *skb, struct net_device *ndev);
+u16 qede_select_queue(struct net_device *dev, struct sk_buff *skb,
+                      struct net_device *sb_dev,
+                      select_queue_fallback_t fallback);
 netdev_features_t qede_features_check(struct sk_buff *skb,
                                       struct net_device *dev,
                                       netdev_features_t features);
diff --git a/drivers/net/ethernet/qlogic/qede/qede_fp.c b/drivers/net/ethernet/qlogic/qede/qede_fp.c
index bdf816fe5a16..31b046e24565 100644
--- a/drivers/net/ethernet/qlogic/qede/qede_fp.c
+++ b/drivers/net/ethernet/qlogic/qede/qede_fp.c
@@ -1695,6 +1695,19 @@ netdev_tx_t qede_start_xmit(struct sk_buff *skb, struct net_device *ndev)
         return NETDEV_TX_OK;
 }
 
+u16 qede_select_queue(struct net_device *dev, struct sk_buff *skb,
+                      struct net_device *sb_dev,
+                      select_queue_fallback_t fallback)
+{
+        struct qede_dev *edev = netdev_priv(dev);
+        int total_txq;
+
+        total_txq = QEDE_TSS_COUNT(edev) * edev->dev_info.num_tc;
+
+        return QEDE_TSS_COUNT(edev) ?
+                fallback(dev, skb, NULL) % total_txq :  0;
+}
+
 /* 8B udp header + 8B base tunnel header + 32B option length */
 #define QEDE_MAX_TUN_HDR_LEN 48
 
diff --git a/drivers/net/ethernet/qlogic/qede/qede_main.c b/drivers/net/ethernet/qlogic/qede/qede_main.c
index 5a74fcbdbc2b..9790f26d17c4 100644
--- a/drivers/net/ethernet/qlogic/qede/qede_main.c
+++ b/drivers/net/ethernet/qlogic/qede/qede_main.c
@@ -631,6 +631,7 @@ static const struct net_device_ops qede_netdev_ops = {
         .ndo_open = qede_open,
         .ndo_stop = qede_close,
         .ndo_start_xmit = qede_start_xmit,
+        .ndo_select_queue = qede_select_queue,
         .ndo_set_rx_mode = qede_set_rx_mode,
         .ndo_set_mac_address = qede_set_mac_addr,
         .ndo_validate_addr = eth_validate_addr,
@@ -666,6 +667,7 @@ static const struct net_device_ops qede_netdev_vf_ops = {
         .ndo_open = qede_open,
         .ndo_stop = qede_close,
         .ndo_start_xmit = qede_start_xmit,
+        .ndo_select_queue = qede_select_queue,
         .ndo_set_rx_mode = qede_set_rx_mode,
         .ndo_set_mac_address = qede_set_mac_addr,
         .ndo_validate_addr = eth_validate_addr,
@@ -684,6 +686,7 @@ static const struct net_device_ops qede_netdev_vf_xdp_ops = {
         .ndo_open = qede_open,
         .ndo_stop = qede_close,
         .ndo_start_xmit = qede_start_xmit,
+        .ndo_select_queue = qede_select_queue,
         .ndo_set_rx_mode = qede_set_rx_mode,
         .ndo_set_mac_address = qede_set_mac_addr,
         .ndo_validate_addr = eth_validate_addr,
diff --git a/drivers/net/ethernet/realtek/8139cp.c b/drivers/net/ethernet/realtek/8139cp.c
index 44f6e4873aad..4f910c4f67b0 100644
--- a/drivers/net/ethernet/realtek/8139cp.c
+++ b/drivers/net/ethernet/realtek/8139cp.c
@@ -691,7 +691,7 @@ static void cp_tx (struct cp_private *cp)
                         }
                         bytes_compl += skb->len;
                         pkts_compl++;
-                        dev_kfree_skb_irq(skb);
+                        dev_consume_skb_irq(skb);
                 }
 
                 cp->tx_skb[tx_tail] = NULL;
diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c
index ffc1ada4e6da..d28c8f9ca55b 100644
--- a/drivers/net/ethernet/renesas/ravb_main.c
+++ b/drivers/net/ethernet/renesas/ravb_main.c
@@ -343,7 +343,7 @@ static int ravb_ring_init(struct net_device *ndev, int q)
         int i;
 
         priv->rx_buf_sz = (ndev->mtu <= 1492 ? PKT_BUF_SZ : ndev->mtu) +
-                ETH_HLEN + VLAN_HLEN;
+                ETH_HLEN + VLAN_HLEN + sizeof(__sum16);
 
         /* Allocate RX and TX skb rings */
         priv->rx_skb[q] = kcalloc(priv->num_rx_ring[q],
@@ -524,13 +524,15 @@ static void ravb_rx_csum(struct sk_buff *skb)
 {
         u8 *hw_csum;
 
-        /* The hardware checksum is 2 bytes appended to packet data */
-        if (unlikely(skb->len < 2))
+        /* The hardware checksum is contained in sizeof(__sum16) (2) bytes
+         * appended to packet data
+         */
+        if (unlikely(skb->len < sizeof(__sum16)))
                 return;
-        hw_csum = skb_tail_pointer(skb) - 2;
+        hw_csum = skb_tail_pointer(skb) - sizeof(__sum16);
         skb->csum = csum_unfold((__force __sum16)get_unaligned_le16(hw_csum));
         skb->ip_summed = CHECKSUM_COMPLETE;
-        skb_trim(skb, skb->len - 2);
+        skb_trim(skb, skb->len - sizeof(__sum16));
 }
 
 /* Packet receive function for Ethernet AVB */
diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c
index b6a50058bb8d..2f2bda68d861 100644
--- a/drivers/net/ethernet/sfc/ef10.c
+++ b/drivers/net/ethernet/sfc/ef10.c
@@ -6046,22 +6046,25 @@ static const struct efx_ef10_nvram_type_info efx_ef10_nvram_types[] = {
         { NVRAM_PARTITION_TYPE_EXPANSION_UEFI,     0,    0, "sfc_uefi" },
         { NVRAM_PARTITION_TYPE_STATUS,             0,    0, "sfc_status" }
 };
+#define EF10_NVRAM_PARTITION_COUNT      ARRAY_SIZE(efx_ef10_nvram_types)
 
 static int efx_ef10_mtd_probe_partition(struct efx_nic *efx,
                                         struct efx_mcdi_mtd_partition *part,
-                                        unsigned int type)
+                                        unsigned int type,
+                                        unsigned long *found)
 {
         MCDI_DECLARE_BUF(inbuf, MC_CMD_NVRAM_METADATA_IN_LEN);
         MCDI_DECLARE_BUF(outbuf, MC_CMD_NVRAM_METADATA_OUT_LENMAX);
         const struct efx_ef10_nvram_type_info *info;
         size_t size, erase_size, outlen;
+        int type_idx = 0;
         bool protected;
         int rc;
 
-        for (info = efx_ef10_nvram_types; ; info++) {
-                if (info ==
-                    efx_ef10_nvram_types + ARRAY_SIZE(efx_ef10_nvram_types))
+        for (type_idx = 0; ; type_idx++) {
+                if (type_idx == EF10_NVRAM_PARTITION_COUNT)
                         return -ENODEV;
+                info = efx_ef10_nvram_types + type_idx;
                 if ((type & ~info->type_mask) == info->type)
                         break;
         }
@@ -6074,6 +6077,13 @@ static int efx_ef10_mtd_probe_partition(struct efx_nic *efx,
         if (protected)
                 return -ENODEV; /* hide it */
 
+        /* If we've already exposed a partition of this type, hide this
+         * duplicate.  All operations on MTDs are keyed by the type anyway,
+         * so we can't act on the duplicate.
+         */
+        if (__test_and_set_bit(type_idx, found))
+                return -EEXIST;
+
         part->nvram_type = type;
 
         MCDI_SET_DWORD(inbuf, NVRAM_METADATA_IN_TYPE, type);
@@ -6105,6 +6115,7 @@ static int efx_ef10_mtd_probe_partition(struct efx_nic *efx,
 static int efx_ef10_mtd_probe(struct efx_nic *efx)
 {
         MCDI_DECLARE_BUF(outbuf, MC_CMD_NVRAM_PARTITIONS_OUT_LENMAX);
+        DECLARE_BITMAP(found, EF10_NVRAM_PARTITION_COUNT);
         struct efx_mcdi_mtd_partition *parts;
         size_t outlen, n_parts_total, i, n_parts;
         unsigned int type;
@@ -6133,11 +6144,13 @@ static int efx_ef10_mtd_probe(struct efx_nic *efx)
         for (i = 0; i < n_parts_total; i++) {
                 type = MCDI_ARRAY_DWORD(outbuf, NVRAM_PARTITIONS_OUT_TYPE_ID,
                                         i);
-                rc = efx_ef10_mtd_probe_partition(efx, &parts[n_parts], type);
-                if (rc == 0)
-                        n_parts++;
-                else if (rc != -ENODEV)
+                rc = efx_ef10_mtd_probe_partition(efx, &parts[n_parts], type,
+                                                  found);
+                if (rc == -EEXIST || rc == -ENODEV)
+                        continue;
+                if (rc)
                         goto fail;
+                n_parts++;
         }
 
         rc = efx_mtd_add(efx, &parts[0].common, n_parts, sizeof(*parts));
diff --git a/drivers/net/ethernet/smsc/epic100.c b/drivers/net/ethernet/smsc/epic100.c
index 15c62c160953..be47d864f8b9 100644
--- a/drivers/net/ethernet/smsc/epic100.c
+++ b/drivers/net/ethernet/smsc/epic100.c
@@ -1037,7 +1037,7 @@ static void epic_tx(struct net_device *dev, struct epic_private *ep)
                 skb = ep->tx_skbuff[entry];
                 pci_unmap_single(ep->pci_dev, ep->tx_ring[entry].bufaddr,
                                  skb->len, PCI_DMA_TODEVICE);
-                dev_kfree_skb_irq(skb);
+                dev_consume_skb_irq(skb);
                 ep->tx_skbuff[entry] = NULL;
         }
 
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c
index 7b923362ee55..3b174eae77c1 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c
@@ -1342,8 +1342,10 @@ static int rk_gmac_powerup(struct rk_priv_data *bsp_priv)
         }
 
         ret = phy_power_on(bsp_priv, true);
-        if (ret)
+        if (ret) {
+                gmac_clk_enable(bsp_priv, false);
                 return ret;
+        }
 
         pm_runtime_enable(dev);
         pm_runtime_get_sync(dev);
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c
index d1f61c25d82b..5d85742a2be0 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c
@@ -721,8 +721,11 @@ static u32 stmmac_usec2riwt(u32 usec, struct stmmac_priv *priv)
 {
         unsigned long clk = clk_get_rate(priv->plat->stmmac_clk);
 
-        if (!clk)
-                return 0;
+        if (!clk) {
+                clk = priv->plat->clk_ref_rate;
+                if (!clk)
+                        return 0;
+        }
 
         return (usec * (clk / 1000000)) / 256;
 }
@@ -731,8 +734,11 @@ static u32 stmmac_riwt2usec(u32 riwt, struct stmmac_priv *priv)
 {
         unsigned long clk = clk_get_rate(priv->plat->stmmac_clk);
 
-        if (!clk)
-                return 0;
+        if (!clk) {
+                clk = priv->plat->clk_ref_rate;
+                if (!clk)
+                        return 0;
+        }
 
         return (riwt * 256) / (clk / 1000000);
 }
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 5afba69981cf..685d20472358 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -3023,10 +3023,22 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)
 
         tx_q = &priv->tx_queue[queue];
 
+        if (priv->tx_path_in_lpi_mode)
+                stmmac_disable_eee_mode(priv);
+
         /* Manage oversized TCP frames for GMAC4 device */
         if (skb_is_gso(skb) && priv->tso) {
-                if (skb_shinfo(skb)->gso_type & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6))
+                if (skb_shinfo(skb)->gso_type & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6)) {
+                        /*
+                         * There is no way to determine the number of TSO
+                         * capable Queues. Let's use always the Queue 0
+                         * because if TSO is supported then at least this
+                         * one will be capable.
+                         */
+                        skb_set_queue_mapping(skb, 0);
+
                         return stmmac_tso_xmit(skb, dev);
+                }
         }
 
         if (unlikely(stmmac_tx_avail(priv, queue) < nfrags + 1)) {
@@ -3041,9 +3053,6 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)
                 return NETDEV_TX_BUSY;
         }
 
-        if (priv->tx_path_in_lpi_mode)
-                stmmac_disable_eee_mode(priv);
-
         entry = tx_q->cur_tx;
         first_entry = entry;
         WARN_ON(tx_q->tx_skbuff[first_entry]);
diff --git a/drivers/net/ethernet/sun/cassini.c b/drivers/net/ethernet/sun/cassini.c
index 9020b084b953..6fc05c106afc 100644
--- a/drivers/net/ethernet/sun/cassini.c
+++ b/drivers/net/ethernet/sun/cassini.c
@@ -1,22 +1,9 @@
-// SPDX-License-Identifier: GPL-2.0
+// SPDX-License-Identifier: GPL-2.0+
 /* cassini.c: Sun Microsystems Cassini(+) ethernet driver.
  *
  * Copyright (C) 2004 Sun Microsystems Inc.
  * Copyright (C) 2003 Adrian Sun (asun@darksunrising.com)
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License as
- * published by the Free Software Foundation; either version 2 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, see <http://www.gnu.org/licenses/>.
- *
  * This driver uses the sungem driver (c) David Miller
  * (davem@redhat.com) as its basis.
  *
@@ -1911,7 +1898,7 @@ static inline void cas_tx_ringN(struct cas *cp, int ring, int limit)
                 cp->net_stats[ring].tx_packets++;
                 cp->net_stats[ring].tx_bytes += skb->len;
                 spin_unlock(&cp->stat_lock[ring]);
-                dev_kfree_skb_irq(skb);
+                dev_consume_skb_irq(skb);
         }
         cp->tx_old[ring] = entry;
 
diff --git a/drivers/net/ethernet/sun/cassini.h b/drivers/net/ethernet/sun/cassini.h
index 13f3860496a8..ae5f05f03f88 100644
--- a/drivers/net/ethernet/sun/cassini.h
+++ b/drivers/net/ethernet/sun/cassini.h
@@ -1,23 +1,10 @@
-/* SPDX-License-Identifier: GPL-2.0 */
+/* SPDX-License-Identifier: GPL-2.0+ */
 /* $Id: cassini.h,v 1.16 2004/08/17 21:15:16 zaumen Exp $
  * cassini.h: Definitions for Sun Microsystems Cassini(+) ethernet driver.
  *
  * Copyright (C) 2004 Sun Microsystems Inc.
  * Copyright (c) 2003 Adrian Sun (asun@darksunrising.com)
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License as
- * published by the Free Software Foundation; either version 2 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, see <http://www.gnu.org/licenses/>.
- *
  * vendor id: 0x108E (Sun Microsystems, Inc.)
  * device id: 0xabba (Cassini)
  * revision ids: 0x01 = Cassini
diff --git a/drivers/net/ethernet/sun/sunbmac.c b/drivers/net/ethernet/sun/sunbmac.c
index 720b7ac77f3b..e9b757b03b56 100644
--- a/drivers/net/ethernet/sun/sunbmac.c
+++ b/drivers/net/ethernet/sun/sunbmac.c
@@ -781,7 +781,7 @@ static void bigmac_tx(struct bigmac *bp)
 
                 DTX(("skb(%p) ", skb));
                 bp->tx_skbs[elem] = NULL;
-                dev_kfree_skb_irq(skb);
+                dev_consume_skb_irq(skb);
 
                 elem = NEXT_TX(elem);
         }
diff --git a/drivers/net/ethernet/sun/sunhme.c b/drivers/net/ethernet/sun/sunhme.c
index ff641cf30a4e..d007dfeba5c3 100644
--- a/drivers/net/ethernet/sun/sunhme.c
+++ b/drivers/net/ethernet/sun/sunhme.c
@@ -1962,7 +1962,7 @@ static void happy_meal_tx(struct happy_meal *hp)
                         this = &txbase[elem];
                 }
 
-                dev_kfree_skb_irq(skb);
+                dev_consume_skb_irq(skb);
                 dev->stats.tx_packets++;
         }
         hp->tx_old = elem;
diff --git a/drivers/net/ethernet/tehuti/tehuti.c b/drivers/net/ethernet/tehuti/tehuti.c
index dc966ddb6d81..b24c11187017 100644
--- a/drivers/net/ethernet/tehuti/tehuti.c
+++ b/drivers/net/ethernet/tehuti/tehuti.c
@@ -1739,7 +1739,7 @@ static void bdx_tx_cleanup(struct bdx_priv *priv)
                 tx_level -= db->rptr->len;      /* '-' koz len is negative */
 
                 /* now should come skb pointer - free it */
-                dev_kfree_skb_irq(db->rptr->addr.skb);
+                dev_consume_skb_irq(db->rptr->addr.skb);
                 bdx_tx_db_inc_rptr(db);
         }
 
diff --git a/drivers/net/ethernet/ti/cpmac.c b/drivers/net/ethernet/ti/cpmac.c
index 810dfc7de1f9..e2d47b24a869 100644
--- a/drivers/net/ethernet/ti/cpmac.c
+++ b/drivers/net/ethernet/ti/cpmac.c
@@ -608,7 +608,7 @@ static void cpmac_end_xmit(struct net_device *dev, int queue)
                         netdev_dbg(dev, "sent 0x%p, len=%d\n",
                                    desc->skb, desc->skb->len);
 
-                dev_kfree_skb_irq(desc->skb);
+                dev_consume_skb_irq(desc->skb);
                 desc->skb = NULL;
                 if (__netif_subqueue_stopped(dev, queue))
                         netif_wake_subqueue(dev, queue);
diff --git a/drivers/net/ethernet/via/via-velocity.c b/drivers/net/ethernet/via/via-velocity.c
index 82412691ee66..27f6cf140845 100644
--- a/drivers/net/ethernet/via/via-velocity.c
+++ b/drivers/net/ethernet/via/via-velocity.c
@@ -1740,7 +1740,7 @@ static void velocity_free_tx_buf(struct velocity_info *vptr,
                 dma_unmap_single(vptr->dev, tdinfo->skb_dma[i],
                                  le16_to_cpu(pktlen), DMA_TO_DEVICE);
         }
-        dev_kfree_skb_irq(skb);
+        dev_consume_skb_irq(skb);
         tdinfo->skb = NULL;
 }
 
diff --git a/drivers/net/fddi/defxx.c b/drivers/net/fddi/defxx.c
index 38ac8ef41f5f..56b7791911bf 100644
--- a/drivers/net/fddi/defxx.c
+++ b/drivers/net/fddi/defxx.c
@@ -3512,7 +3512,7 @@ static int dfx_xmt_done(DFX_board_t *bp)
                                  bp->descr_block_virt->xmt_data[comp].long_1,
                                  p_xmt_drv_descr->p_skb->len,
                                  DMA_TO_DEVICE);
-                dev_kfree_skb_irq(p_xmt_drv_descr->p_skb);
+                dev_consume_skb_irq(p_xmt_drv_descr->p_skb);
 
                 /*
                  * Move to start of next packet by updating completion index
diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c
index 58bbba8582b0..3377ac66a347 100644
--- a/drivers/net/geneve.c
+++ b/drivers/net/geneve.c
@@ -1512,9 +1512,13 @@ static void geneve_link_config(struct net_device *dev,
         }
 #if IS_ENABLED(CONFIG_IPV6)
         case AF_INET6: {
-                struct rt6_info *rt = rt6_lookup(geneve->net,
-                                                 &info->key.u.ipv6.dst, NULL, 0,
-                                                 NULL, 0);
+                struct rt6_info *rt;
+
+                if (!__in6_dev_get(dev))
+                        break;
+
+                rt = rt6_lookup(geneve->net, &info->key.u.ipv6.dst, NULL, 0,
+                                NULL, 0);
 
                 if (rt && rt->dst.dev)
                         ldev_mtu = rt->dst.dev->mtu - GENEVE_IPV6_HLEN;
diff --git a/drivers/net/hyperv/hyperv_net.h b/drivers/net/hyperv/hyperv_net.h
index ef6f766f6389..e859ae2e42d5 100644
--- a/drivers/net/hyperv/hyperv_net.h
+++ b/drivers/net/hyperv/hyperv_net.h
@@ -144,6 +144,8 @@ struct hv_netvsc_packet {
         u32 total_data_buflen;
 };
 
+#define NETVSC_HASH_KEYLEN 40
+
 struct netvsc_device_info {
         unsigned char mac_adr[ETH_ALEN];
         u32  num_chn;
@@ -151,6 +153,8 @@ struct netvsc_device_info {
         u32  recv_sections;
         u32  send_section_size;
         u32  recv_section_size;
+
+        u8 rss_key[NETVSC_HASH_KEYLEN];
 };
 
 enum rndis_device_state {
@@ -160,8 +164,6 @@ enum rndis_device_state {
         RNDIS_DEV_DATAINITIALIZED,
 };
 
-#define NETVSC_HASH_KEYLEN 40
-
 struct rndis_device {
         struct net_device *ndev;
 
@@ -209,7 +211,9 @@ int netvsc_recv_callback(struct net_device *net,
 void netvsc_channel_cb(void *context);
 int netvsc_poll(struct napi_struct *napi, int budget);
 
-int rndis_set_subchannel(struct net_device *ndev, struct netvsc_device *nvdev);
+int rndis_set_subchannel(struct net_device *ndev,
+                         struct netvsc_device *nvdev,
+                         struct netvsc_device_info *dev_info);
 int rndis_filter_open(struct netvsc_device *nvdev);
 int rndis_filter_close(struct netvsc_device *nvdev);
 struct netvsc_device *rndis_filter_device_add(struct hv_device *dev,
@@ -1177,7 +1181,7 @@ enum ndis_per_pkt_info_type {
 
 enum rndis_per_pkt_info_interal_type {
         RNDIS_PKTINFO_ID = 1,
-        /* Add more memebers here */
+        /* Add more members here */
 
         RNDIS_PKTINFO_MAX
 };
diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c
index 922054c1d544..813d195bbd57 100644
--- a/drivers/net/hyperv/netvsc.c
+++ b/drivers/net/hyperv/netvsc.c
@@ -84,7 +84,7 @@ static void netvsc_subchan_work(struct work_struct *w)
 
         rdev = nvdev->extension;
         if (rdev) {
-                ret = rndis_set_subchannel(rdev->ndev, nvdev);
+                ret = rndis_set_subchannel(rdev->ndev, nvdev, NULL);
                 if (ret == 0) {
                         netif_device_attach(rdev->ndev);
                 } else {
@@ -1331,7 +1331,7 @@ void netvsc_channel_cb(void *context)
         prefetch(hv_get_ring_buffer(rbi) + rbi->priv_read_index);
 
         if (napi_schedule_prep(&nvchan->napi)) {
-                /* disable interupts from host */
+                /* disable interrupts from host */
                 hv_begin_read(rbi);
 
                 __napi_schedule_irqoff(&nvchan->napi);
diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index 91ed15ea5883..256adbd044f5 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -370,7 +370,7 @@ static u32 fill_pg_buf(struct page *page, u32 offset, u32 len,
 {
         int j = 0;
 
-        /* Deal with compund pages by ignoring unused part
+        /* Deal with compound pages by ignoring unused part
          * of the page.
          */
         page += (offset >> PAGE_SHIFT);
@@ -858,6 +858,39 @@ static void netvsc_get_channels(struct net_device *net,
         }
 }
 
+/* Alloc struct netvsc_device_info, and initialize it from either existing
+ * struct netvsc_device, or from default values.
+ */
+static struct netvsc_device_info *netvsc_devinfo_get
+                        (struct netvsc_device *nvdev)
+{
+        struct netvsc_device_info *dev_info;
+
+        dev_info = kzalloc(sizeof(*dev_info), GFP_ATOMIC);
+
+        if (!dev_info)
+                return NULL;
+
+        if (nvdev) {
+                dev_info->num_chn = nvdev->num_chn;
+                dev_info->send_sections = nvdev->send_section_cnt;
+                dev_info->send_section_size = nvdev->send_section_size;
+                dev_info->recv_sections = nvdev->recv_section_cnt;
+                dev_info->recv_section_size = nvdev->recv_section_size;
+
+                memcpy(dev_info->rss_key, nvdev->extension->rss_key,
+                       NETVSC_HASH_KEYLEN);
+        } else {
+                dev_info->num_chn = VRSS_CHANNEL_DEFAULT;
+                dev_info->send_sections = NETVSC_DEFAULT_TX;
+                dev_info->send_section_size = NETVSC_SEND_SECTION_SIZE;
+                dev_info->recv_sections = NETVSC_DEFAULT_RX;
+                dev_info->recv_section_size = NETVSC_RECV_SECTION_SIZE;
+        }
+
+        return dev_info;
+}
+
 static int netvsc_detach(struct net_device *ndev,
                          struct netvsc_device *nvdev)
 {
@@ -909,7 +942,7 @@ static int netvsc_attach(struct net_device *ndev,
                 return PTR_ERR(nvdev);
 
         if (nvdev->num_chn > 1) {
-                ret = rndis_set_subchannel(ndev, nvdev);
+                ret = rndis_set_subchannel(ndev, nvdev, dev_info);
 
                 /* if unavailable, just proceed with one queue */
                 if (ret) {
@@ -943,7 +976,7 @@ static int netvsc_set_channels(struct net_device *net,
         struct net_device_context *net_device_ctx = netdev_priv(net);
         struct netvsc_device *nvdev = rtnl_dereference(net_device_ctx->nvdev);
         unsigned int orig, count = channels->combined_count;
-        struct netvsc_device_info device_info;
+        struct netvsc_device_info *device_info;
         int ret;
 
         /* We do not support separate count for rx, tx, or other */
@@ -962,24 +995,26 @@ static int netvsc_set_channels(struct net_device *net,
 
         orig = nvdev->num_chn;
 
-        memset(&device_info, 0, sizeof(device_info));
-        device_info.num_chn = count;
-        device_info.send_sections = nvdev->send_section_cnt;
-        device_info.send_section_size = nvdev->send_section_size;
-        device_info.recv_sections = nvdev->recv_section_cnt;
-        device_info.recv_section_size = nvdev->recv_section_size;
+        device_info = netvsc_devinfo_get(nvdev);
+
+        if (!device_info)
+                return -ENOMEM;
+
+        device_info->num_chn = count;
 
         ret = netvsc_detach(net, nvdev);
         if (ret)
-                return ret;
+                goto out;
 
-        ret = netvsc_attach(net, &device_info);
+        ret = netvsc_attach(net, device_info);
         if (ret) {
-                device_info.num_chn = orig;
-                if (netvsc_attach(net, &device_info))
+                device_info->num_chn = orig;
+                if (netvsc_attach(net, device_info))
                         netdev_err(net, "restoring channel setting failed\n");
         }
 
+out:
+        kfree(device_info);
         return ret;
 }
 
@@ -1048,48 +1083,45 @@ static int netvsc_change_mtu(struct net_device *ndev, int mtu)
         struct net_device *vf_netdev = rtnl_dereference(ndevctx->vf_netdev);
         struct netvsc_device *nvdev = rtnl_dereference(ndevctx->nvdev);
         int orig_mtu = ndev->mtu;
-        struct netvsc_device_info device_info;
+        struct netvsc_device_info *device_info;
         int ret = 0;
 
         if (!nvdev || nvdev->destroy)
                 return -ENODEV;
 
+        device_info = netvsc_devinfo_get(nvdev);
+
+        if (!device_info)
+                return -ENOMEM;
+
         /* Change MTU of underlying VF netdev first. */
         if (vf_netdev) {
                 ret = dev_set_mtu(vf_netdev, mtu);
                 if (ret)
-                        return ret;
+                        goto out;
         }
 
-        memset(&device_info, 0, sizeof(device_info));
-        device_info.num_chn = nvdev->num_chn;
-        device_info.send_sections = nvdev->send_section_cnt;
-        device_info.send_section_size = nvdev->send_section_size;
-        device_info.recv_sections = nvdev->recv_section_cnt;
-        device_info.recv_section_size = nvdev->recv_section_size;
-
         ret = netvsc_detach(ndev, nvdev);
         if (ret)
                 goto rollback_vf;
 
         ndev->mtu = mtu;
 
-        ret = netvsc_attach(ndev, &device_info);
-        if (ret)
-                goto rollback;
-
-        return 0;
+        ret = netvsc_attach(ndev, device_info);
+        if (!ret)
+                goto out;
 
-rollback:
         /* Attempt rollback to original MTU */
         ndev->mtu = orig_mtu;
 
-        if (netvsc_attach(ndev, &device_info))
+        if (netvsc_attach(ndev, device_info))
                 netdev_err(ndev, "restoring mtu failed\n");
 rollback_vf:
         if (vf_netdev)
                 dev_set_mtu(vf_netdev, orig_mtu);
 
+out:
+        kfree(device_info);
         return ret;
 }
 
@@ -1674,7 +1706,7 @@ static int netvsc_set_ringparam(struct net_device *ndev,
 {
         struct net_device_context *ndevctx = netdev_priv(ndev);
         struct netvsc_device *nvdev = rtnl_dereference(ndevctx->nvdev);
-        struct netvsc_device_info device_info;
+        struct netvsc_device_info *device_info;
         struct ethtool_ringparam orig;
         u32 new_tx, new_rx;
         int ret = 0;
@@ -1694,26 +1726,29 @@ static int netvsc_set_ringparam(struct net_device *ndev,
             new_rx == orig.rx_pending)
                 return 0;        /* no change */
 
-        memset(&device_info, 0, sizeof(device_info));
-        device_info.num_chn = nvdev->num_chn;
-        device_info.send_sections = new_tx;
-        device_info.send_section_size = nvdev->send_section_size;
-        device_info.recv_sections = new_rx;
-        device_info.recv_section_size = nvdev->recv_section_size;
+        device_info = netvsc_devinfo_get(nvdev);
+
+        if (!device_info)
+                return -ENOMEM;
+
+        device_info->send_sections = new_tx;
+        device_info->recv_sections = new_rx;
 
         ret = netvsc_detach(ndev, nvdev);
         if (ret)
-                return ret;
+                goto out;
 
-        ret = netvsc_attach(ndev, &device_info);
+        ret = netvsc_attach(ndev, device_info);
         if (ret) {
-                device_info.send_sections = orig.tx_pending;
-                device_info.recv_sections = orig.rx_pending;
+                device_info->send_sections = orig.tx_pending;
+                device_info->recv_sections = orig.rx_pending;
 
-                if (netvsc_attach(ndev, &device_info))
+                if (netvsc_attach(ndev, device_info))
                         netdev_err(ndev, "restoring ringparam failed");
         }
 
+out:
+        kfree(device_info);
         return ret;
 }
 
@@ -2088,7 +2123,7 @@ static int netvsc_register_vf(struct net_device *vf_netdev)
         if (!netvsc_dev || rtnl_dereference(net_device_ctx->vf_netdev))
                 return NOTIFY_DONE;
 
-        /* if syntihetic interface is a different namespace,
+        /* if synthetic interface is a different namespace,
          * then move the VF to that namespace; join will be
          * done again in that context.
          */
@@ -2167,7 +2202,7 @@ static int netvsc_probe(struct hv_device *dev,
 {
         struct net_device *net = NULL;
         struct net_device_context *net_device_ctx;
-        struct netvsc_device_info device_info;
+        struct netvsc_device_info *device_info = NULL;
         struct netvsc_device *nvdev;
         int ret = -ENOMEM;
 
@@ -2214,21 +2249,21 @@ static int netvsc_probe(struct hv_device *dev,
         netif_set_real_num_rx_queues(net, 1);
 
         /* Notify the netvsc driver of the new device */
-        memset(&device_info, 0, sizeof(device_info));
-        device_info.num_chn = VRSS_CHANNEL_DEFAULT;
-        device_info.send_sections = NETVSC_DEFAULT_TX;
-        device_info.send_section_size = NETVSC_SEND_SECTION_SIZE;
-        device_info.recv_sections = NETVSC_DEFAULT_RX;
-        device_info.recv_section_size = NETVSC_RECV_SECTION_SIZE;
-
-        nvdev = rndis_filter_device_add(dev, &device_info);
+        device_info = netvsc_devinfo_get(NULL);
+
+        if (!device_info) {
+                ret = -ENOMEM;
+                goto devinfo_failed;
+        }
+
+        nvdev = rndis_filter_device_add(dev, device_info);
         if (IS_ERR(nvdev)) {
                 ret = PTR_ERR(nvdev);
                 netdev_err(net, "unable to add netvsc device (ret %d)\n", ret);
                 goto rndis_failed;
         }
 
-        memcpy(net->dev_addr, device_info.mac_adr, ETH_ALEN);
+        memcpy(net->dev_addr, device_info->mac_adr, ETH_ALEN);
 
         /* We must get rtnl lock before scheduling nvdev->subchan_work,
          * otherwise netvsc_subchan_work() can get rtnl lock first and wait
@@ -2236,7 +2271,7 @@ static int netvsc_probe(struct hv_device *dev,
          * netvsc_probe() can't get rtnl lock and as a result vmbus_onoffer()
          * -> ... -> device_add() -> ... -> __device_attach() can't get
          * the device lock, so all the subchannels can't be processed --
-         * finally netvsc_subchan_work() hangs for ever.
+         * finally netvsc_subchan_work() hangs forever.
          */
         rtnl_lock();
 
@@ -2266,12 +2301,16 @@ static int netvsc_probe(struct hv_device *dev,
 
         list_add(&net_device_ctx->list, &netvsc_dev_list);
         rtnl_unlock();
+
+        kfree(device_info);
         return 0;
 
 register_failed:
         rtnl_unlock();
         rndis_filter_device_remove(dev, nvdev);
 rndis_failed:
+        kfree(device_info);
+devinfo_failed:
         free_percpu(net_device_ctx->vf_stats);
 no_stats:
         hv_set_drvdata(dev, NULL);
diff --git a/drivers/net/hyperv/rndis_filter.c b/drivers/net/hyperv/rndis_filter.c
index 8b537a049c1e..73b60592de06 100644
--- a/drivers/net/hyperv/rndis_filter.c
+++ b/drivers/net/hyperv/rndis_filter.c
@@ -774,8 +774,8 @@ cleanup:
         return ret;
 }
 
-int rndis_filter_set_rss_param(struct rndis_device *rdev,
-                               const u8 *rss_key)
+static int rndis_set_rss_param_msg(struct rndis_device *rdev,
+                                   const u8 *rss_key, u16 flag)
 {
         struct net_device *ndev = rdev->ndev;
         struct rndis_request *request;
@@ -804,7 +804,7 @@ int rndis_filter_set_rss_param(struct rndis_device *rdev,
         rssp->hdr.type = NDIS_OBJECT_TYPE_RSS_PARAMETERS;
         rssp->hdr.rev = NDIS_RECEIVE_SCALE_PARAMETERS_REVISION_2;
         rssp->hdr.size = sizeof(struct ndis_recv_scale_param);
-        rssp->flag = 0;
+        rssp->flag = flag;
         rssp->hashinfo = NDIS_HASH_FUNC_TOEPLITZ | NDIS_HASH_IPV4 |
                          NDIS_HASH_TCP_IPV4 | NDIS_HASH_IPV6 |
                          NDIS_HASH_TCP_IPV6;
@@ -829,9 +829,12 @@ int rndis_filter_set_rss_param(struct rndis_device *rdev,
 
         wait_for_completion(&request->wait_event);
         set_complete = &request->response_msg.msg.set_complete;
-        if (set_complete->status == RNDIS_STATUS_SUCCESS)
-                memcpy(rdev->rss_key, rss_key, NETVSC_HASH_KEYLEN);
-        else {
+        if (set_complete->status == RNDIS_STATUS_SUCCESS) {
+                if (!(flag & NDIS_RSS_PARAM_FLAG_DISABLE_RSS) &&
+                    !(flag & NDIS_RSS_PARAM_FLAG_HASH_KEY_UNCHANGED))
+                        memcpy(rdev->rss_key, rss_key, NETVSC_HASH_KEYLEN);
+
+        } else {
                 netdev_err(ndev, "Fail to set RSS parameters:0x%x\n",
                            set_complete->status);
                 ret = -EINVAL;
@@ -842,6 +845,16 @@ cleanup:
         return ret;
 }
 
+int rndis_filter_set_rss_param(struct rndis_device *rdev,
+                               const u8 *rss_key)
+{
+        /* Disable RSS before change */
+        rndis_set_rss_param_msg(rdev, rss_key,
+                                NDIS_RSS_PARAM_FLAG_DISABLE_RSS);
+
+        return rndis_set_rss_param_msg(rdev, rss_key, 0);
+}
+
 static int rndis_filter_query_device_link_status(struct rndis_device *dev,
                                                  struct netvsc_device *net_device)
 {
@@ -1121,7 +1134,9 @@ static void netvsc_sc_open(struct vmbus_channel *new_sc)
  * This breaks overlap of processing the host message for the
  * new primary channel with the initialization of sub-channels.
  */
-int rndis_set_subchannel(struct net_device *ndev, struct netvsc_device *nvdev)
+int rndis_set_subchannel(struct net_device *ndev,
+                         struct netvsc_device *nvdev,
+                         struct netvsc_device_info *dev_info)
 {
         struct nvsp_message *init_packet = &nvdev->channel_init_pkt;
         struct net_device_context *ndev_ctx = netdev_priv(ndev);
@@ -1161,8 +1176,11 @@ int rndis_set_subchannel(struct net_device *ndev, struct netvsc_device *nvdev)
         wait_event(nvdev->subchan_open,
                    atomic_read(&nvdev->open_chn) == nvdev->num_chn);
 
-        /* ignore failues from setting rss parameters, still have channels */
-        rndis_filter_set_rss_param(rdev, netvsc_hash_key);
+        /* ignore failures from setting rss parameters, still have channels */
+        if (dev_info)
+                rndis_filter_set_rss_param(rdev, dev_info->rss_key);
+        else
+                rndis_filter_set_rss_param(rdev, netvsc_hash_key);
 
         netif_set_real_num_tx_queues(ndev, nvdev->num_chn);
         netif_set_real_num_rx_queues(ndev, nvdev->num_chn);
diff --git a/drivers/net/ieee802154/mcr20a.c b/drivers/net/ieee802154/mcr20a.c
index 44de81e5f140..c589f5ae75bb 100644
--- a/drivers/net/ieee802154/mcr20a.c
+++ b/drivers/net/ieee802154/mcr20a.c
@@ -905,9 +905,9 @@ mcr20a_irq_clean_complete(void *context)
                 }
                 break;
         case (DAR_IRQSTS1_RXIRQ | DAR_IRQSTS1_SEQIRQ):
-                        /* rx is starting */
-                        dev_dbg(printdev(lp), "RX is starting\n");
-                        mcr20a_handle_rx(lp);
+                /* rx is starting */
+                dev_dbg(printdev(lp), "RX is starting\n");
+                mcr20a_handle_rx(lp);
                 break;
         case (DAR_IRQSTS1_RXIRQ | DAR_IRQSTS1_TXIRQ | DAR_IRQSTS1_SEQIRQ):
                 if (lp->is_tx) {
diff --git a/drivers/net/ipvlan/ipvlan_main.c b/drivers/net/ipvlan/ipvlan_main.c
index 19bdde60680c..7cdac77d0c68 100644
--- a/drivers/net/ipvlan/ipvlan_main.c
+++ b/drivers/net/ipvlan/ipvlan_main.c
@@ -100,12 +100,12 @@ static int ipvlan_set_port_mode(struct ipvl_port *port, u16 nval,
                         err = ipvlan_register_nf_hook(read_pnet(&port->pnet));
                         if (!err) {
                                 mdev->l3mdev_ops = &ipvl_l3mdev_ops;
-                                mdev->priv_flags |= IFF_L3MDEV_MASTER;
+                                mdev->priv_flags |= IFF_L3MDEV_RX_HANDLER;
                         } else
                                 goto fail;
                 } else if (port->mode == IPVLAN_MODE_L3S) {
                         /* Old mode was L3S */
-                        mdev->priv_flags &= ~IFF_L3MDEV_MASTER;
+                        mdev->priv_flags &= ~IFF_L3MDEV_RX_HANDLER;
                         ipvlan_unregister_nf_hook(read_pnet(&port->pnet));
                         mdev->l3mdev_ops = NULL;
                 }
@@ -167,7 +167,7 @@ static void ipvlan_port_destroy(struct net_device *dev)
         struct sk_buff *skb;
 
         if (port->mode == IPVLAN_MODE_L3S) {
-                dev->priv_flags &= ~IFF_L3MDEV_MASTER;
+                dev->priv_flags &= ~IFF_L3MDEV_RX_HANDLER;
                 ipvlan_unregister_nf_hook(dev_net(dev));
                 dev->l3mdev_ops = NULL;
         }
diff --git a/drivers/net/phy/asix.c b/drivers/net/phy/asix.c
index 8ebe7f5484ae..f14ba5366b91 100644
--- a/drivers/net/phy/asix.c
+++ b/drivers/net/phy/asix.c
@@ -1,13 +1,7 @@
-// SPDX-License-Identifier: GPL-2.0
+// SPDX-License-Identifier: GPL-2.0+
 /* Driver for Asix PHYs
  *
  * Author: Michael Schmitz <schmitzmic@gmail.com>
- *
- * This program is free software; you can redistribute  it and/or modify it
- * under  the terms of  the GNU General  Public License as published by the
- * Free Software Foundation;  either version 2 of the  License, or (at your
- * option) any later version.
- *
  */
 #include <linux/kernel.h>
 #include <linux/errno.h>
diff --git a/drivers/net/phy/dp83640.c b/drivers/net/phy/dp83640.c
index 18b41bc345ab..6e8807212aa3 100644
--- a/drivers/net/phy/dp83640.c
+++ b/drivers/net/phy/dp83640.c
@@ -898,14 +898,14 @@ static void decode_txts(struct dp83640_private *dp83640,
                         struct phy_txts *phy_txts)
 {
         struct skb_shared_hwtstamps shhwtstamps;
+        struct dp83640_skb_info *skb_info;
         struct sk_buff *skb;
-        u64 ns;
         u8 overflow;
+        u64 ns;
 
         /* We must already have the skb that triggered this. */
-
+again:
         skb = skb_dequeue(&dp83640->tx_queue);
-
         if (!skb) {
                 pr_debug("have timestamp but tx_queue empty\n");
                 return;
@@ -920,6 +920,11 @@ static void decode_txts(struct dp83640_private *dp83640,
                 }
                 return;
         }
+        skb_info = (struct dp83640_skb_info *)skb->cb;
+        if (time_after(jiffies, skb_info->tmo)) {
+                kfree_skb(skb);
+                goto again;
+        }
 
         ns = phy2txts(phy_txts);
         memset(&shhwtstamps, 0, sizeof(shhwtstamps));
@@ -1472,6 +1477,7 @@ static bool dp83640_rxtstamp(struct phy_device *phydev,
 static void dp83640_txtstamp(struct phy_device *phydev,
                              struct sk_buff *skb, int type)
 {
+        struct dp83640_skb_info *skb_info = (struct dp83640_skb_info *)skb->cb;
         struct dp83640_private *dp83640 = phydev->priv;
 
         switch (dp83640->hwts_tx_en) {
@@ -1484,6 +1490,7 @@ static void dp83640_txtstamp(struct phy_device *phydev,
                 /* fall through */
         case HWTSTAMP_TX_ON:
                 skb_shinfo(skb)->tx_flags |= SKBTX_IN_PROGRESS;
+                skb_info->tmo = jiffies + SKB_TIMESTAMP_TIMEOUT;
                 skb_queue_tail(&dp83640->tx_queue, skb);
                 break;
 
diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c
index 2e12f982534f..abb7876a8776 100644
--- a/drivers/net/phy/marvell.c
+++ b/drivers/net/phy/marvell.c
@@ -847,7 +847,6 @@ static int m88e1510_config_init(struct phy_device *phydev)
 
         /* SGMII-to-Copper mode initialization */
         if (phydev->interface == PHY_INTERFACE_MODE_SGMII) {
-
                 /* Select page 18 */
                 err = marvell_set_page(phydev, 18);
                 if (err < 0)
@@ -870,21 +869,6 @@ static int m88e1510_config_init(struct phy_device *phydev)
                 err = marvell_set_page(phydev, MII_MARVELL_COPPER_PAGE);
                 if (err < 0)
                         return err;
-
-                /* There appears to be a bug in the 88e1512 when used in
-                 * SGMII to copper mode, where the AN advertisement register
-                 * clears the pause bits each time a negotiation occurs.
-                 * This means we can never be truely sure what was advertised,
-                 * so disable Pause support.
-                 */
-                linkmode_clear_bit(ETHTOOL_LINK_MODE_Asym_Pause_BIT,
-                                   phydev->supported);
-                linkmode_clear_bit(ETHTOOL_LINK_MODE_Pause_BIT,
-                                   phydev->supported);
-                linkmode_clear_bit(ETHTOOL_LINK_MODE_Asym_Pause_BIT,
-                                   phydev->advertising);
-                linkmode_clear_bit(ETHTOOL_LINK_MODE_Pause_BIT,
-                                   phydev->advertising);
         }
 
         return m88e1318_config_init(phydev);
diff --git a/drivers/net/phy/mdio-hisi-femac.c b/drivers/net/phy/mdio-hisi-femac.c
index b03fedd6c1d8..287f3ccf1da1 100644
--- a/drivers/net/phy/mdio-hisi-femac.c
+++ b/drivers/net/phy/mdio-hisi-femac.c
@@ -1,20 +1,8 @@
+// SPDX-License-Identifier: GPL-2.0+
 /*
  * Hisilicon Fast Ethernet MDIO Bus Driver
  *
  * Copyright (c) 2016 HiSilicon Technologies Co., Ltd.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program. If not, see <http://www.gnu.org/licenses/>.
  */
 
 #include <linux/clk.h>
@@ -163,4 +151,4 @@ module_platform_driver(hisi_femac_mdio_driver);
 
 MODULE_DESCRIPTION("Hisilicon Fast Ethernet MAC MDIO interface driver");
 MODULE_AUTHOR("Dongpo Li <lidongpo@hisilicon.com>");
-MODULE_LICENSE("GPL v2");
+MODULE_LICENSE("GPL");
diff --git a/drivers/net/phy/rockchip.c b/drivers/net/phy/rockchip.c
index f1da70b9b55f..95abf7072f32 100644
--- a/drivers/net/phy/rockchip.c
+++ b/drivers/net/phy/rockchip.c
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: GPL-2.0+
 /**
  * drivers/net/phy/rockchip.c
  *
@@ -6,12 +7,6 @@
  * Copyright (c) 2017, Fuzhou Rockchip Electronics Co., Ltd
  *
  * David Wu <david.wu@rock-chips.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
  */
 
 #include <linux/ethtool.h>
@@ -229,4 +224,4 @@ MODULE_DEVICE_TABLE(mdio, rockchip_phy_tbl);
 
 MODULE_AUTHOR("David Wu <david.wu@rock-chips.com>");
 MODULE_DESCRIPTION("Rockchip Ethernet PHY driver");
-MODULE_LICENSE("GPL v2");
+MODULE_LICENSE("GPL");
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 18656c4094b3..fed298c0cb39 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -866,8 +866,6 @@ static int tun_attach(struct tun_struct *tun, struct file *file,
         if (rtnl_dereference(tun->xdp_prog))
                 sock_set_flag(&tfile->sk, SOCK_XDP);
 
-        tun_set_real_num_queues(tun);
-
         /* device is allowed to go away first, so no need to hold extra
          * refcnt.
          */
@@ -879,6 +877,7 @@ static int tun_attach(struct tun_struct *tun, struct file *file,
         rcu_assign_pointer(tfile->tun, tun);
         rcu_assign_pointer(tun->tfiles[tun->numqueues], tfile);
         tun->numqueues++;
+        tun_set_real_num_queues(tun);
 out:
         return err;
 }
diff --git a/drivers/net/usb/asix_devices.c b/drivers/net/usb/asix_devices.c
index b654f05b2ccd..3d93993e74da 100644
--- a/drivers/net/usb/asix_devices.c
+++ b/drivers/net/usb/asix_devices.c
@@ -739,8 +739,13 @@ static int ax88772_bind(struct usbnet *dev, struct usb_interface *intf)
         asix_read_cmd(dev, AX_CMD_STATMNGSTS_REG, 0, 0, 1, &chipcode, 0);
         chipcode &= AX_CHIPCODE_MASK;
 
-        (chipcode == AX_AX88772_CHIPCODE) ? ax88772_hw_reset(dev, 0) :
-                                            ax88772a_hw_reset(dev, 0);
+        ret = (chipcode == AX_AX88772_CHIPCODE) ? ax88772_hw_reset(dev, 0) :
+                                                  ax88772a_hw_reset(dev, 0);
+
+        if (ret < 0) {
+                netdev_dbg(dev->net, "Failed to reset AX88772: %d\n", ret);
+                return ret;
+        }
 
         /* Read PHYID register *AFTER* the PHY was reset properly */
         phyid = asix_get_phyid(dev);
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 8fadd8eaf601..4cfceb789eea 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -57,6 +57,8 @@ module_param(napi_tx, bool, 0644);
 #define VIRTIO_XDP_TX           BIT(0)
 #define VIRTIO_XDP_REDIR        BIT(1)
 
+#define VIRTIO_XDP_FLAG BIT(0)
+
 /* RX packet size EWMA. The average packet size is used to determine the packet
  * buffer size when refilling RX rings. As the entire RX ring may be refilled
  * at once, the weight is chosen so that the EWMA will be insensitive to short-
@@ -252,6 +254,21 @@ struct padded_vnet_hdr {
         char padding[4];
 };
 
+static bool is_xdp_frame(void *ptr)
+{
+        return (unsigned long)ptr & VIRTIO_XDP_FLAG;
+}
+
+static void *xdp_to_ptr(struct xdp_frame *ptr)
+{
+        return (void *)((unsigned long)ptr | VIRTIO_XDP_FLAG);
+}
+
+static struct xdp_frame *ptr_to_xdp(void *ptr)
+{
+        return (struct xdp_frame *)((unsigned long)ptr & ~VIRTIO_XDP_FLAG);
+}
+
 /* Converting between virtqueue no. and kernel tx/rx queue no.
  * 0:rx0 1:tx0 2:rx1 3:tx1 ... 2N:rxN 2N+1:txN 2N+2:cvq
  */
@@ -462,7 +479,8 @@ static int __virtnet_xdp_xmit_one(struct virtnet_info *vi,
 
         sg_init_one(sq->sg, xdpf->data, xdpf->len);
 
-        err = virtqueue_add_outbuf(sq->vq, sq->sg, 1, xdpf, GFP_ATOMIC);
+        err = virtqueue_add_outbuf(sq->vq, sq->sg, 1, xdp_to_ptr(xdpf),
+                                   GFP_ATOMIC);
         if (unlikely(err))
                 return -ENOSPC; /* Caller handle free/refcnt */
 
@@ -482,36 +500,47 @@ static int virtnet_xdp_xmit(struct net_device *dev,
 {
         struct virtnet_info *vi = netdev_priv(dev);
         struct receive_queue *rq = vi->rq;
-        struct xdp_frame *xdpf_sent;
         struct bpf_prog *xdp_prog;
         struct send_queue *sq;
         unsigned int len;
+        int packets = 0;
+        int bytes = 0;
         int drops = 0;
         int kicks = 0;
         int ret, err;
+        void *ptr;
         int i;
 
-        sq = virtnet_xdp_sq(vi);
-
-        if (unlikely(flags & ~XDP_XMIT_FLAGS_MASK)) {
-                ret = -EINVAL;
-                drops = n;
-                goto out;
-        }
-
         /* Only allow ndo_xdp_xmit if XDP is loaded on dev, as this
          * indicate XDP resources have been successfully allocated.
          */
         xdp_prog = rcu_dereference(rq->xdp_prog);
-        if (!xdp_prog) {
-                ret = -ENXIO;
+        if (!xdp_prog)
+                return -ENXIO;
+
+        sq = virtnet_xdp_sq(vi);
+
+        if (unlikely(flags & ~XDP_XMIT_FLAGS_MASK)) {
+                ret = -EINVAL;
                 drops = n;
                 goto out;
         }
 
         /* Free up any pending old buffers before queueing new ones. */
-        while ((xdpf_sent = virtqueue_get_buf(sq->vq, &len)) != NULL)
-                xdp_return_frame(xdpf_sent);
+        while ((ptr = virtqueue_get_buf(sq->vq, &len)) != NULL) {
+                if (likely(is_xdp_frame(ptr))) {
+                        struct xdp_frame *frame = ptr_to_xdp(ptr);
+
+                        bytes += frame->len;
+                        xdp_return_frame(frame);
+                } else {
+                        struct sk_buff *skb = ptr;
+
+                        bytes += skb->len;
+                        napi_consume_skb(skb, false);
+                }
+                packets++;
+        }
 
         for (i = 0; i < n; i++) {
                 struct xdp_frame *xdpf = frames[i];
@@ -530,6 +559,8 @@ static int virtnet_xdp_xmit(struct net_device *dev,
         }
 out:
         u64_stats_update_begin(&sq->stats.syncp);
+        sq->stats.bytes += bytes;
+        sq->stats.packets += packets;
         sq->stats.xdp_tx += n;
         sq->stats.xdp_tx_drops += drops;
         sq->stats.kicks += kicks;
@@ -1332,18 +1363,26 @@ static int virtnet_receive(struct receive_queue *rq, int budget,
 
 static void free_old_xmit_skbs(struct send_queue *sq, bool in_napi)
 {
-        struct sk_buff *skb;
         unsigned int len;
         unsigned int packets = 0;
         unsigned int bytes = 0;
+        void *ptr;
 
-        while ((skb = virtqueue_get_buf(sq->vq, &len)) != NULL) {
-                pr_debug("Sent skb %p\n", skb);
+        while ((ptr = virtqueue_get_buf(sq->vq, &len)) != NULL) {
+                if (likely(!is_xdp_frame(ptr))) {
+                        struct sk_buff *skb = ptr;
 
-                bytes += skb->len;
-                packets++;
+                        pr_debug("Sent skb %p\n", skb);
+
+                        bytes += skb->len;
+                        napi_consume_skb(skb, in_napi);
+                } else {
+                        struct xdp_frame *frame = ptr_to_xdp(ptr);
 
-                napi_consume_skb(skb, in_napi);
+                        bytes += frame->len;
+                        xdp_return_frame(frame);
+                }
+                packets++;
         }
 
         /* Avoid overhead when no packets have been processed
@@ -1358,6 +1397,16 @@ static void free_old_xmit_skbs(struct send_queue *sq, bool in_napi)
         u64_stats_update_end(&sq->stats.syncp);
 }
 
+static bool is_xdp_raw_buffer_queue(struct virtnet_info *vi, int q)
+{
+        if (q < (vi->curr_queue_pairs - vi->xdp_queue_pairs))
+                return false;
+        else if (q < vi->curr_queue_pairs)
+                return true;
+        else
+                return false;
+}
+
 static void virtnet_poll_cleantx(struct receive_queue *rq)
 {
         struct virtnet_info *vi = rq->vq->vdev->priv;
@@ -1365,7 +1414,7 @@ static void virtnet_poll_cleantx(struct receive_queue *rq)
         struct send_queue *sq = &vi->sq[index];
         struct netdev_queue *txq = netdev_get_tx_queue(vi->dev, index);
 
-        if (!sq->napi.weight)
+        if (!sq->napi.weight || is_xdp_raw_buffer_queue(vi, index))
                 return;
 
         if (__netif_tx_trylock(txq)) {
@@ -1442,8 +1491,16 @@ static int virtnet_poll_tx(struct napi_struct *napi, int budget)
 {
         struct send_queue *sq = container_of(napi, struct send_queue, napi);
         struct virtnet_info *vi = sq->vq->vdev->priv;
-        struct netdev_queue *txq = netdev_get_tx_queue(vi->dev, vq2txq(sq->vq));
+        unsigned int index = vq2txq(sq->vq);
+        struct netdev_queue *txq;
 
+        if (unlikely(is_xdp_raw_buffer_queue(vi, index))) {
+                /* We don't need to enable cb for XDP */
+                napi_complete_done(napi, 0);
+                return 0;
+        }
+
+        txq = netdev_get_tx_queue(vi->dev, index);
         __netif_tx_lock(txq, raw_smp_processor_id());
         free_old_xmit_skbs(sq, true);
         __netif_tx_unlock(txq);
@@ -2395,6 +2452,10 @@ static int virtnet_xdp_set(struct net_device *dev, struct bpf_prog *prog,
                 return -ENOMEM;
         }
 
+        old_prog = rtnl_dereference(vi->rq[0].xdp_prog);
+        if (!prog && !old_prog)
+                return 0;
+
         if (prog) {
                 prog = bpf_prog_add(prog, vi->max_queue_pairs - 1);
                 if (IS_ERR(prog))
@@ -2402,36 +2463,62 @@ static int virtnet_xdp_set(struct net_device *dev, struct bpf_prog *prog,
         }
 
         /* Make sure NAPI is not using any XDP TX queues for RX. */
-        if (netif_running(dev))
-                for (i = 0; i < vi->max_queue_pairs; i++)
+        if (netif_running(dev)) {
+                for (i = 0; i < vi->max_queue_pairs; i++) {
                         napi_disable(&vi->rq[i].napi);
+                        virtnet_napi_tx_disable(&vi->sq[i].napi);
+                }
+        }
+
+        if (!prog) {
+                for (i = 0; i < vi->max_queue_pairs; i++) {
+                        rcu_assign_pointer(vi->rq[i].xdp_prog, prog);
+                        if (i == 0)
+                                virtnet_restore_guest_offloads(vi);
+                }
+                synchronize_net();
+        }
 
-        netif_set_real_num_rx_queues(dev, curr_qp + xdp_qp);
         err = _virtnet_set_queues(vi, curr_qp + xdp_qp);
         if (err)
                 goto err;
+        netif_set_real_num_rx_queues(dev, curr_qp + xdp_qp);
         vi->xdp_queue_pairs = xdp_qp;
 
-        for (i = 0; i < vi->max_queue_pairs; i++) {
-                old_prog = rtnl_dereference(vi->rq[i].xdp_prog);
-                rcu_assign_pointer(vi->rq[i].xdp_prog, prog);
-                if (i == 0) {
-                        if (!old_prog)
+        if (prog) {
+                for (i = 0; i < vi->max_queue_pairs; i++) {
+                        rcu_assign_pointer(vi->rq[i].xdp_prog, prog);
+                        if (i == 0 && !old_prog)
                                 virtnet_clear_guest_offloads(vi);
-                        if (!prog)
-                                virtnet_restore_guest_offloads(vi);
                 }
+        }
+
+        for (i = 0; i < vi->max_queue_pairs; i++) {
                 if (old_prog)
                         bpf_prog_put(old_prog);
-                if (netif_running(dev))
+                if (netif_running(dev)) {
                         virtnet_napi_enable(vi->rq[i].vq, &vi->rq[i].napi);
+                        virtnet_napi_tx_enable(vi, vi->sq[i].vq,
+                                               &vi->sq[i].napi);
+                }
         }
 
         return 0;
 
 err:
-        for (i = 0; i < vi->max_queue_pairs; i++)
-                virtnet_napi_enable(vi->rq[i].vq, &vi->rq[i].napi);
+        if (!prog) {
+                virtnet_clear_guest_offloads(vi);
+                for (i = 0; i < vi->max_queue_pairs; i++)
+                        rcu_assign_pointer(vi->rq[i].xdp_prog, old_prog);
+        }
+
+        if (netif_running(dev)) {
+                for (i = 0; i < vi->max_queue_pairs; i++) {
+                        virtnet_napi_enable(vi->rq[i].vq, &vi->rq[i].napi);
+                        virtnet_napi_tx_enable(vi, vi->sq[i].vq,
+                                               &vi->sq[i].napi);
+                }
+        }
         if (prog)
                 bpf_prog_sub(prog, vi->max_queue_pairs - 1);
         return err;
@@ -2613,16 +2700,6 @@ static void free_receive_page_frags(struct virtnet_info *vi)
                         put_page(vi->rq[i].alloc_frag.page);
 }
 
-static bool is_xdp_raw_buffer_queue(struct virtnet_info *vi, int q)
-{
-        if (q < (vi->curr_queue_pairs - vi->xdp_queue_pairs))
-                return false;
-        else if (q < vi->curr_queue_pairs)
-                return true;
-        else
-                return false;
-}
-
 static void free_unused_bufs(struct virtnet_info *vi)
 {
         void *buf;
@@ -2631,10 +2708,10 @@ static void free_unused_bufs(struct virtnet_info *vi)
         for (i = 0; i < vi->max_queue_pairs; i++) {
                 struct virtqueue *vq = vi->sq[i].vq;
                 while ((buf = virtqueue_detach_unused_buf(vq)) != NULL) {
-                        if (!is_xdp_raw_buffer_queue(vi, i))
+                        if (!is_xdp_frame(buf))
                                 dev_kfree_skb(buf);
                         else
-                                put_page(virt_to_head_page(buf));
+                                xdp_return_frame(ptr_to_xdp(buf));
                 }
         }
 
diff --git a/drivers/net/wan/dscc4.c b/drivers/net/wan/dscc4.c
index c0b0f525c87c..27decf8ae840 100644
--- a/drivers/net/wan/dscc4.c
+++ b/drivers/net/wan/dscc4.c
@@ -1575,7 +1575,7 @@ try:
                                         dev->stats.tx_packets++;
                                         dev->stats.tx_bytes += skb->len;
                                 }
-                                dev_kfree_skb_irq(skb);
+                                dev_consume_skb_irq(skb);
                                 dpriv->tx_skbuff[cur] = NULL;
                                 ++dpriv->tx_dirty;
                         } else {
diff --git a/drivers/net/wan/fsl_ucc_hdlc.c b/drivers/net/wan/fsl_ucc_hdlc.c
index 66d889d54e58..a08f04c3f644 100644
--- a/drivers/net/wan/fsl_ucc_hdlc.c
+++ b/drivers/net/wan/fsl_ucc_hdlc.c
@@ -482,7 +482,7 @@ static int hdlc_tx_done(struct ucc_hdlc_private *priv)
                 memset(priv->tx_buffer +
                        (be32_to_cpu(bd->buf) - priv->dma_tx_addr),
                        0, skb->len);
-                dev_kfree_skb_irq(skb);
+                dev_consume_skb_irq(skb);
 
                 priv->tx_skbuff[priv->skb_dirtytx] = NULL;
                 priv->skb_dirtytx =
diff --git a/drivers/net/wireless/ath/ath10k/core.c b/drivers/net/wireless/ath/ath10k/core.c
index 399b501f3c3c..e8891f5fc83a 100644
--- a/drivers/net/wireless/ath/ath10k/core.c
+++ b/drivers/net/wireless/ath/ath10k/core.c
@@ -548,7 +548,7 @@ static const struct ath10k_hw_params ath10k_hw_params_list[] = {
         {
                 .id = WCN3990_HW_1_0_DEV_VERSION,
                 .dev_id = 0,
-                .bus = ATH10K_BUS_PCI,
+                .bus = ATH10K_BUS_SNOC,
                 .name = "wcn3990 hw1.0",
                 .continuous_frag_desc = true,
                 .tx_chain_mask = 0x7,
diff --git a/drivers/net/wireless/intel/iwlwifi/Kconfig b/drivers/net/wireless/intel/iwlwifi/Kconfig
index 491ca3c8b43c..83d5bceea08f 100644
--- a/drivers/net/wireless/intel/iwlwifi/Kconfig
+++ b/drivers/net/wireless/intel/iwlwifi/Kconfig
@@ -1,6 +1,6 @@
 config IWLWIFI
         tristate "Intel Wireless WiFi Next Gen AGN - Wireless-N/Advanced-N/Ultimate-N (iwlwifi) "
-        depends on PCI && HAS_IOMEM
+        depends on PCI && HAS_IOMEM && CFG80211
         select FW_LOADER
         ---help---
           Select to build the driver supporting the:
@@ -47,6 +47,7 @@ if IWLWIFI
 config IWLWIFI_LEDS
         bool
         depends on LEDS_CLASS=y || LEDS_CLASS=IWLWIFI
+        depends on IWLMVM || IWLDVM
         select LEDS_TRIGGERS
         select MAC80211_LEDS
         default y
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index 3a4b8786f7ea..320edcac4699 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -2761,6 +2761,11 @@ static int mac80211_hwsim_new_radio(struct genl_info *info,
                                         BIT(NL80211_CHAN_WIDTH_160);
         }
 
+        if (!n_limits) {
+                err = -EINVAL;
+                goto failed_hw;
+        }
+
         data->if_combination.n_limits = n_limits;
         data->if_combination.max_interfaces = 2048;
         data->if_combination.limits = data->if_limits;
diff --git a/drivers/net/wireless/mediatek/mt76/mt76x0/eeprom.c b/drivers/net/wireless/mediatek/mt76/mt76x0/eeprom.c
index 497e762978cc..b2cabce1d74d 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76x0/eeprom.c
+++ b/drivers/net/wireless/mediatek/mt76/mt76x0/eeprom.c
@@ -212,24 +212,24 @@ void mt76x0_get_tx_power_per_rate(struct mt76x02_dev *dev)
         mt76x02_add_rate_power_offset(t, delta);
 }
 
-void mt76x0_get_power_info(struct mt76x02_dev *dev, u8 *info)
+void mt76x0_get_power_info(struct mt76x02_dev *dev, s8 *tp)
 {
         struct mt76x0_chan_map {
                 u8 chan;
                 u8 offset;
         } chan_map[] = {
-                {   2,  0 }, {   4,  1 }, {   6,  2 }, {   8,  3 },
-                {  10,  4 }, {  12,  5 }, {  14,  6 }, {  38,  0 },
-                {  44,  1 }, {  48,  2 }, {  54,  3 }, {  60,  4 },
-                {  64,  5 }, { 102,  6 }, { 108,  7 }, { 112,  8 },
-                { 118,  9 }, { 124, 10 }, { 128, 11 }, { 134, 12 },
-                { 140, 13 }, { 151, 14 }, { 157, 15 }, { 161, 16 },
-                { 167, 17 }, { 171, 18 }, { 173, 19 },
+                {   2,  0 }, {   4,  2 }, {   6,  4 }, {   8,  6 },
+                {  10,  8 }, {  12, 10 }, {  14, 12 }, {  38,  0 },
+                {  44,  2 }, {  48,  4 }, {  54,  6 }, {  60,  8 },
+                {  64, 10 }, { 102, 12 }, { 108, 14 }, { 112, 16 },
+                { 118, 18 }, { 124, 20 }, { 128, 22 }, { 134, 24 },
+                { 140, 26 }, { 151, 28 }, { 157, 30 }, { 161, 32 },
+                { 167, 34 }, { 171, 36 }, { 175, 38 },
         };
         struct ieee80211_channel *chan = dev->mt76.chandef.chan;
         u8 offset, addr;
+        int i, idx = 0;
         u16 data;
-        int i;
 
         if (mt76x0_tssi_enabled(dev)) {
                 s8 target_power;
@@ -239,14 +239,14 @@ void mt76x0_get_power_info(struct mt76x02_dev *dev, u8 *info)
                 else
                         data = mt76x02_eeprom_get(dev, MT_EE_2G_TARGET_POWER);
                 target_power = (data & 0xff) - dev->mt76.rate_power.ofdm[7];
-                info[0] = target_power + mt76x0_get_delta(dev);
-                info[1] = 0;
+                *tp = target_power + mt76x0_get_delta(dev);
 
                 return;
         }
 
         for (i = 0; i < ARRAY_SIZE(chan_map); i++) {
-                if (chan_map[i].chan <= chan->hw_value) {
+                if (chan->hw_value <= chan_map[i].chan) {
+                        idx = (chan->hw_value == chan_map[i].chan);
                         offset = chan_map[i].offset;
                         break;
                 }
@@ -258,13 +258,16 @@ void mt76x0_get_power_info(struct mt76x02_dev *dev, u8 *info)
                 addr = MT_EE_TX_POWER_DELTA_BW80 + offset;
         } else {
                 switch (chan->hw_value) {
+                case 42:
+                        offset = 2;
+                        break;
                 case 58:
                         offset = 8;
                         break;
                 case 106:
                         offset = 14;
                         break;
-                case 112:
+                case 122:
                         offset = 20;
                         break;
                 case 155:
@@ -277,14 +280,9 @@ void mt76x0_get_power_info(struct mt76x02_dev *dev, u8 *info)
         }
 
         data = mt76x02_eeprom_get(dev, addr);
-
-        info[0] = data;
-        if (!info[0] || info[0] > 0x3f)
-                info[0] = 5;
-
-        info[1] = data >> 8;
-        if (!info[1] || info[1] > 0x3f)
-                info[1] = 5;
+        *tp = data >> (8 * idx);
+        if (*tp < 0 || *tp > 0x3f)
+                *tp = 5;
 }
 
 static int mt76x0_check_eeprom(struct mt76x02_dev *dev)
diff --git a/drivers/net/wireless/mediatek/mt76/mt76x0/eeprom.h b/drivers/net/wireless/mediatek/mt76/mt76x0/eeprom.h
index ee9ade9f3c8b..42b259f90b6d 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76x0/eeprom.h
+++ b/drivers/net/wireless/mediatek/mt76/mt76x0/eeprom.h
@@ -26,7 +26,7 @@ struct mt76x02_dev;
 int mt76x0_eeprom_init(struct mt76x02_dev *dev);
 void mt76x0_read_rx_gain(struct mt76x02_dev *dev);
 void mt76x0_get_tx_power_per_rate(struct mt76x02_dev *dev);
-void mt76x0_get_power_info(struct mt76x02_dev *dev, u8 *info);
+void mt76x0_get_power_info(struct mt76x02_dev *dev, s8 *tp);
 
 static inline s8 s6_to_s8(u32 val)
 {
diff --git a/drivers/net/wireless/mediatek/mt76/mt76x0/phy.c b/drivers/net/wireless/mediatek/mt76/mt76x0/phy.c
index 1eb1a802ed20..b6166703ad76 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76x0/phy.c
+++ b/drivers/net/wireless/mediatek/mt76/mt76x0/phy.c
@@ -845,17 +845,17 @@ static void mt76x0_phy_tssi_calibrate(struct mt76x02_dev *dev)
 void mt76x0_phy_set_txpower(struct mt76x02_dev *dev)
 {
         struct mt76_rate_power *t = &dev->mt76.rate_power;
-        u8 info[2];
+        s8 info;
 
         mt76x0_get_tx_power_per_rate(dev);
-        mt76x0_get_power_info(dev, info);
+        mt76x0_get_power_info(dev, &info);
 
-        mt76x02_add_rate_power_offset(t, info[0]);
+        mt76x02_add_rate_power_offset(t, info);
         mt76x02_limit_rate_power(t, dev->mt76.txpower_conf);
         dev->mt76.txpower_cur = mt76x02_get_max_rate_power(t);
-        mt76x02_add_rate_power_offset(t, -info[0]);
+        mt76x02_add_rate_power_offset(t, -info);
 
-        mt76x02_phy_set_txpower(dev, info[0], info[1]);
+        mt76x02_phy_set_txpower(dev, info, info);
 }
 
 void mt76x0_phy_calibrate(struct mt76x02_dev *dev, bool power_on)
diff --git a/drivers/net/wireless/ti/wlcore/sdio.c b/drivers/net/wireless/ti/wlcore/sdio.c
index bd10165d7eec..4d4b07701149 100644
--- a/drivers/net/wireless/ti/wlcore/sdio.c
+++ b/drivers/net/wireless/ti/wlcore/sdio.c
@@ -164,6 +164,12 @@ static int wl12xx_sdio_power_on(struct wl12xx_sdio_glue *glue)
         }
 
         sdio_claim_host(func);
+        /*
+         * To guarantee that the SDIO card is power cycled, as required to make
+         * the FW programming to succeed, let's do a brute force HW reset.
+         */
+        mmc_hw_reset(card->host);
+
         sdio_enable_func(func);
         sdio_release_host(func);
 
@@ -174,20 +180,13 @@ static int wl12xx_sdio_power_off(struct wl12xx_sdio_glue *glue)
 {
         struct sdio_func *func = dev_to_sdio_func(glue->dev);
         struct mmc_card *card = func->card;
-        int error;
 
         sdio_claim_host(func);
         sdio_disable_func(func);
         sdio_release_host(func);
 
         /* Let runtime PM know the card is powered off */
-        error = pm_runtime_put(&card->dev);
-        if (error < 0 && error != -EBUSY) {
-                dev_err(&card->dev, "%s failed: %i\n", __func__, error);
-
-                return error;
-        }
-
+        pm_runtime_put(&card->dev);
         return 0;
 }
 
diff --git a/drivers/net/wireless/virt_wifi.c b/drivers/net/wireless/virt_wifi.c
index 64b218699656..3a93e4d9828b 100644
--- a/drivers/net/wireless/virt_wifi.c
+++ b/drivers/net/wireless/virt_wifi.c
@@ -530,8 +530,10 @@ static int virt_wifi_newlink(struct net *src_net, struct net_device *dev,
         SET_NETDEV_DEV(dev, &priv->lowerdev->dev);
         dev->ieee80211_ptr = kzalloc(sizeof(*dev->ieee80211_ptr), GFP_KERNEL);
 
-        if (!dev->ieee80211_ptr)
+        if (!dev->ieee80211_ptr) {
+                err = -ENOMEM;
                 goto remove_handler;
+        }
 
         dev->ieee80211_ptr->iftype = NL80211_IFTYPE_STATION;
         dev->ieee80211_ptr->wiphy = common_wiphy;
diff --git a/drivers/nvdimm/dimm.c b/drivers/nvdimm/dimm.c
index 0cf58cabc9ed..3cf50274fadb 100644
--- a/drivers/nvdimm/dimm.c
+++ b/drivers/nvdimm/dimm.c
@@ -26,6 +26,12 @@ static int nvdimm_probe(struct device *dev)
         struct nvdimm_drvdata *ndd;
         int rc;
 
+        rc = nvdimm_security_setup_events(dev);
+        if (rc < 0) {
+                dev_err(dev, "security event setup failed: %d\n", rc);
+                return rc;
+        }
+
         rc = nvdimm_check_config_data(dev);
         if (rc) {
                 /* not required for non-aliased nvdimm, ex. NVDIMM-N */
diff --git a/drivers/nvdimm/dimm_devs.c b/drivers/nvdimm/dimm_devs.c
index 4890310df874..efe412a6b5b9 100644
--- a/drivers/nvdimm/dimm_devs.c
+++ b/drivers/nvdimm/dimm_devs.c
@@ -578,13 +578,25 @@ struct nvdimm *__nvdimm_create(struct nvdimm_bus *nvdimm_bus,
 }
 EXPORT_SYMBOL_GPL(__nvdimm_create);
 
-int nvdimm_security_setup_events(struct nvdimm *nvdimm)
+static void shutdown_security_notify(void *data)
 {
-        nvdimm->sec.overwrite_state = sysfs_get_dirent(nvdimm->dev.kobj.sd,
-                        "security");
+        struct nvdimm *nvdimm = data;
+
+        sysfs_put(nvdimm->sec.overwrite_state);
+}
+
+int nvdimm_security_setup_events(struct device *dev)
+{
+        struct nvdimm *nvdimm = to_nvdimm(dev);
+
+        if (nvdimm->sec.state < 0 || !nvdimm->sec.ops
+                        || !nvdimm->sec.ops->overwrite)
+                return 0;
+        nvdimm->sec.overwrite_state = sysfs_get_dirent(dev->kobj.sd, "security");
         if (!nvdimm->sec.overwrite_state)
-                return -ENODEV;
-        return 0;
+                return -ENOMEM;
+
+        return devm_add_action_or_reset(dev, shutdown_security_notify, nvdimm);
 }
 EXPORT_SYMBOL_GPL(nvdimm_security_setup_events);
 
diff --git a/drivers/nvdimm/nd.h b/drivers/nvdimm/nd.h
index cfde992684e7..379bf4305e61 100644
--- a/drivers/nvdimm/nd.h
+++ b/drivers/nvdimm/nd.h
@@ -250,6 +250,7 @@ long nvdimm_clear_poison(struct device *dev, phys_addr_t phys,
 void nvdimm_set_aliasing(struct device *dev);
 void nvdimm_set_locked(struct device *dev);
 void nvdimm_clear_locked(struct device *dev);
+int nvdimm_security_setup_events(struct device *dev);
 #if IS_ENABLED(CONFIG_NVDIMM_KEYS)
 int nvdimm_security_unlock(struct device *dev);
 #else
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index 150e49723c15..6a9dd68c0f4f 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -1253,6 +1253,7 @@ static u32 nvme_passthru_start(struct nvme_ctrl *ctrl, struct nvme_ns *ns,
          * effects say only one namespace is affected.
          */
         if (effects & (NVME_CMD_EFFECTS_LBCC | NVME_CMD_EFFECTS_CSE_MASK)) {
+                mutex_lock(&ctrl->scan_lock);
                 nvme_start_freeze(ctrl);
                 nvme_wait_freeze(ctrl);
         }
@@ -1281,8 +1282,10 @@ static void nvme_passthru_end(struct nvme_ctrl *ctrl, u32 effects)
          */
         if (effects & NVME_CMD_EFFECTS_LBCC)
                 nvme_update_formats(ctrl);
-        if (effects & (NVME_CMD_EFFECTS_LBCC | NVME_CMD_EFFECTS_CSE_MASK))
+        if (effects & (NVME_CMD_EFFECTS_LBCC | NVME_CMD_EFFECTS_CSE_MASK)) {
                 nvme_unfreeze(ctrl);
+                mutex_unlock(&ctrl->scan_lock);
+        }
         if (effects & NVME_CMD_EFFECTS_CCC)
                 nvme_init_identify(ctrl);
         if (effects & (NVME_CMD_EFFECTS_NIC | NVME_CMD_EFFECTS_NCC))
@@ -3401,6 +3404,7 @@ static void nvme_scan_work(struct work_struct *work)
         if (nvme_identify_ctrl(ctrl, &id))
                 return;
 
+        mutex_lock(&ctrl->scan_lock);
         nn = le32_to_cpu(id->nn);
         if (ctrl->vs >= NVME_VS(1, 1, 0) &&
             !(ctrl->quirks & NVME_QUIRK_IDENTIFY_CNS)) {
@@ -3409,6 +3413,7 @@ static void nvme_scan_work(struct work_struct *work)
         }
         nvme_scan_ns_sequential(ctrl, nn);
 out_free_id:
+        mutex_unlock(&ctrl->scan_lock);
         kfree(id);
         down_write(&ctrl->namespaces_rwsem);
         list_sort(NULL, &ctrl->namespaces, ns_cmp);
@@ -3652,6 +3657,7 @@ int nvme_init_ctrl(struct nvme_ctrl *ctrl, struct device *dev,
 
         ctrl->state = NVME_CTRL_NEW;
         spin_lock_init(&ctrl->lock);
+        mutex_init(&ctrl->scan_lock);
         INIT_LIST_HEAD(&ctrl->namespaces);
         init_rwsem(&ctrl->namespaces_rwsem);
         ctrl->dev = dev;
diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
index df4b3a6db51b..b9fff3b8ed1b 100644
--- a/drivers/nvme/host/multipath.c
+++ b/drivers/nvme/host/multipath.c
@@ -545,8 +545,7 @@ int nvme_mpath_init(struct nvme_ctrl *ctrl, struct nvme_id_ctrl *id)
         timer_setup(&ctrl->anatt_timer, nvme_anatt_timeout, 0);
         ctrl->ana_log_size = sizeof(struct nvme_ana_rsp_hdr) +
                 ctrl->nanagrpid * sizeof(struct nvme_ana_group_desc);
-        if (!(ctrl->anacap & (1 << 6)))
-                ctrl->ana_log_size += ctrl->max_namespaces * sizeof(__le32);
+        ctrl->ana_log_size += ctrl->max_namespaces * sizeof(__le32);
 
         if (ctrl->ana_log_size > ctrl->max_hw_sectors << SECTOR_SHIFT) {
                 dev_err(ctrl->device,
diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h
index ab961bdeea89..c4a1bb41abf0 100644
--- a/drivers/nvme/host/nvme.h
+++ b/drivers/nvme/host/nvme.h
@@ -154,6 +154,7 @@ struct nvme_ctrl {
         enum nvme_ctrl_state state;
         bool identified;
         spinlock_t lock;
+        struct mutex scan_lock;
         const struct nvme_ctrl_ops *ops;
         struct request_queue *admin_q;
         struct request_queue *connect_q;
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index 9bc585415d9b..022ea1ee63f8 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -2557,16 +2557,7 @@ static void nvme_reset_work(struct work_struct *work)
         if (dev->ctrl.ctrl_config & NVME_CC_ENABLE)
                 nvme_dev_disable(dev, false);
 
-        /*
-         * Introduce CONNECTING state from nvme-fc/rdma transports to mark the
-         * initializing procedure here.
-         */
-        if (!nvme_change_ctrl_state(&dev->ctrl, NVME_CTRL_CONNECTING)) {
-                dev_warn(dev->ctrl.device,
-                        "failed to mark controller CONNECTING\n");
-                goto out;
-        }
-
+        mutex_lock(&dev->shutdown_lock);
         result = nvme_pci_enable(dev);
         if (result)
                 goto out;
@@ -2585,6 +2576,17 @@ static void nvme_reset_work(struct work_struct *work)
          */
         dev->ctrl.max_hw_sectors = NVME_MAX_KB_SZ << 1;
         dev->ctrl.max_segments = NVME_MAX_SEGS;
+        mutex_unlock(&dev->shutdown_lock);
+
+        /*
+         * Introduce CONNECTING state from nvme-fc/rdma transports to mark the
+         * initializing procedure here.
+         */
+        if (!nvme_change_ctrl_state(&dev->ctrl, NVME_CTRL_CONNECTING)) {
+                dev_warn(dev->ctrl.device,
+                        "failed to mark controller CONNECTING\n");
+                goto out;
+        }
 
         result = nvme_init_identify(&dev->ctrl);
         if (result)
diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
index 0a2fd2949ad7..52abc3a6de12 100644
--- a/drivers/nvme/host/rdma.c
+++ b/drivers/nvme/host/rdma.c
@@ -119,6 +119,7 @@ struct nvme_rdma_ctrl {
 
         struct nvme_ctrl        ctrl;
         bool                    use_inline_data;
+        u32                     io_queues[HCTX_MAX_TYPES];
 };
 
 static inline struct nvme_rdma_ctrl *to_rdma_ctrl(struct nvme_ctrl *ctrl)
@@ -165,8 +166,8 @@ static inline int nvme_rdma_queue_idx(struct nvme_rdma_queue *queue)
 static bool nvme_rdma_poll_queue(struct nvme_rdma_queue *queue)
 {
         return nvme_rdma_queue_idx(queue) >
-                queue->ctrl->ctrl.opts->nr_io_queues +
-                queue->ctrl->ctrl.opts->nr_write_queues;
+                queue->ctrl->io_queues[HCTX_TYPE_DEFAULT] +
+                queue->ctrl->io_queues[HCTX_TYPE_READ];
 }
 
 static inline size_t nvme_rdma_inline_data_size(struct nvme_rdma_queue *queue)
@@ -661,8 +662,21 @@ static int nvme_rdma_alloc_io_queues(struct nvme_rdma_ctrl *ctrl)
         nr_io_queues = min_t(unsigned int, nr_io_queues,
                                 ibdev->num_comp_vectors);
 
-        nr_io_queues += min(opts->nr_write_queues, num_online_cpus());
-        nr_io_queues += min(opts->nr_poll_queues, num_online_cpus());
+        if (opts->nr_write_queues) {
+                ctrl->io_queues[HCTX_TYPE_DEFAULT] =
+                                min(opts->nr_write_queues, nr_io_queues);
+                nr_io_queues += ctrl->io_queues[HCTX_TYPE_DEFAULT];
+        } else {
+                ctrl->io_queues[HCTX_TYPE_DEFAULT] = nr_io_queues;
+        }
+
+        ctrl->io_queues[HCTX_TYPE_READ] = nr_io_queues;
+
+        if (opts->nr_poll_queues) {
+                ctrl->io_queues[HCTX_TYPE_POLL] =
+                        min(opts->nr_poll_queues, num_online_cpus());
+                nr_io_queues += ctrl->io_queues[HCTX_TYPE_POLL];
+        }
 
         ret = nvme_set_queue_count(&ctrl->ctrl, &nr_io_queues);
         if (ret)
@@ -1689,18 +1703,28 @@ static enum blk_eh_timer_return
 nvme_rdma_timeout(struct request *rq, bool reserved)
 {
         struct nvme_rdma_request *req = blk_mq_rq_to_pdu(rq);
+        struct nvme_rdma_queue *queue = req->queue;
+        struct nvme_rdma_ctrl *ctrl = queue->ctrl;
 
-        dev_warn(req->queue->ctrl->ctrl.device,
-                 "I/O %d QID %d timeout, reset controller\n",
-                 rq->tag, nvme_rdma_queue_idx(req->queue));
+        dev_warn(ctrl->ctrl.device, "I/O %d QID %d timeout\n",
+                 rq->tag, nvme_rdma_queue_idx(queue));
 
-        /* queue error recovery */
-        nvme_rdma_error_recovery(req->queue->ctrl);
+        if (ctrl->ctrl.state != NVME_CTRL_LIVE) {
+                /*
+                 * Teardown immediately if controller times out while starting
+                 * or we are already started error recovery. all outstanding
+                 * requests are completed on shutdown, so we return BLK_EH_DONE.
+                 */
+                flush_work(&ctrl->err_work);
+                nvme_rdma_teardown_io_queues(ctrl, false);
+                nvme_rdma_teardown_admin_queue(ctrl, false);
+                return BLK_EH_DONE;
+        }
 
-        /* fail with DNR on cmd timeout */
-        nvme_req(rq)->status = NVME_SC_ABORT_REQ | NVME_SC_DNR;
+        dev_warn(ctrl->ctrl.device, "starting error recovery\n");
+        nvme_rdma_error_recovery(ctrl);
 
-        return BLK_EH_DONE;
+        return BLK_EH_RESET_TIMER;
 }
 
 static blk_status_t nvme_rdma_queue_rq(struct blk_mq_hw_ctx *hctx,
@@ -1779,17 +1803,15 @@ static int nvme_rdma_map_queues(struct blk_mq_tag_set *set)
         struct nvme_rdma_ctrl *ctrl = set->driver_data;
 
         set->map[HCTX_TYPE_DEFAULT].queue_offset = 0;
-        set->map[HCTX_TYPE_READ].nr_queues = ctrl->ctrl.opts->nr_io_queues;
+        set->map[HCTX_TYPE_DEFAULT].nr_queues =
+                        ctrl->io_queues[HCTX_TYPE_DEFAULT];
+        set->map[HCTX_TYPE_READ].nr_queues = ctrl->io_queues[HCTX_TYPE_READ];
         if (ctrl->ctrl.opts->nr_write_queues) {
                 /* separate read/write queues */
-                set->map[HCTX_TYPE_DEFAULT].nr_queues =
-                                ctrl->ctrl.opts->nr_write_queues;
                 set->map[HCTX_TYPE_READ].queue_offset =
-                                ctrl->ctrl.opts->nr_write_queues;
+                                ctrl->io_queues[HCTX_TYPE_DEFAULT];
         } else {
                 /* mixed read/write queues */
-                set->map[HCTX_TYPE_DEFAULT].nr_queues =
-                                ctrl->ctrl.opts->nr_io_queues;
                 set->map[HCTX_TYPE_READ].queue_offset = 0;
         }
         blk_mq_rdma_map_queues(&set->map[HCTX_TYPE_DEFAULT],
@@ -1799,12 +1821,12 @@ static int nvme_rdma_map_queues(struct blk_mq_tag_set *set)
 
         if (ctrl->ctrl.opts->nr_poll_queues) {
                 set->map[HCTX_TYPE_POLL].nr_queues =
-                                ctrl->ctrl.opts->nr_poll_queues;
+                                ctrl->io_queues[HCTX_TYPE_POLL];
                 set->map[HCTX_TYPE_POLL].queue_offset =
-                                ctrl->ctrl.opts->nr_io_queues;
+                                ctrl->io_queues[HCTX_TYPE_DEFAULT];
                 if (ctrl->ctrl.opts->nr_write_queues)
                         set->map[HCTX_TYPE_POLL].queue_offset +=
-                                ctrl->ctrl.opts->nr_write_queues;
+                                ctrl->io_queues[HCTX_TYPE_READ];
                 blk_mq_map_queues(&set->map[HCTX_TYPE_POLL]);
         }
         return 0;
diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
index 265a0543b381..5f0a00425242 100644
--- a/drivers/nvme/host/tcp.c
+++ b/drivers/nvme/host/tcp.c
@@ -1948,20 +1948,23 @@ nvme_tcp_timeout(struct request *rq, bool reserved)
         struct nvme_tcp_ctrl *ctrl = req->queue->ctrl;
         struct nvme_tcp_cmd_pdu *pdu = req->pdu;
 
-        dev_dbg(ctrl->ctrl.device,
+        dev_warn(ctrl->ctrl.device,
                 "queue %d: timeout request %#x type %d\n",
-                nvme_tcp_queue_id(req->queue), rq->tag,
-                pdu->hdr.type);
+                nvme_tcp_queue_id(req->queue), rq->tag, pdu->hdr.type);
 
         if (ctrl->ctrl.state != NVME_CTRL_LIVE) {
-                union nvme_result res = {};
-
-                nvme_req(rq)->flags |= NVME_REQ_CANCELLED;
-                nvme_end_request(rq, cpu_to_le16(NVME_SC_ABORT_REQ), res);
+                /*
+                 * Teardown immediately if controller times out while starting
+                 * or we are already started error recovery. all outstanding
+                 * requests are completed on shutdown, so we return BLK_EH_DONE.
+                 */
+                flush_work(&ctrl->err_work);
+                nvme_tcp_teardown_io_queues(&ctrl->ctrl, false);
+                nvme_tcp_teardown_admin_queue(&ctrl->ctrl, false);
                 return BLK_EH_DONE;
         }
 
-        /* queue error recovery */
+        dev_warn(ctrl->ctrl.device, "starting error recovery\n");
         nvme_tcp_error_recovery(&ctrl->ctrl);
 
         return BLK_EH_RESET_TIMER;
diff --git a/drivers/nvme/target/rdma.c b/drivers/nvme/target/rdma.c
index a8d23eb80192..a884e3a0e8af 100644
--- a/drivers/nvme/target/rdma.c
+++ b/drivers/nvme/target/rdma.c
@@ -139,6 +139,10 @@ static void nvmet_rdma_recv_done(struct ib_cq *cq, struct ib_wc *wc);
 static void nvmet_rdma_read_data_done(struct ib_cq *cq, struct ib_wc *wc);
 static void nvmet_rdma_qp_event(struct ib_event *event, void *priv);
 static void nvmet_rdma_queue_disconnect(struct nvmet_rdma_queue *queue);
+static void nvmet_rdma_free_rsp(struct nvmet_rdma_device *ndev,
+                                struct nvmet_rdma_rsp *r);
+static int nvmet_rdma_alloc_rsp(struct nvmet_rdma_device *ndev,
+                                struct nvmet_rdma_rsp *r);
 
 static const struct nvmet_fabrics_ops nvmet_rdma_ops;
 
@@ -182,9 +186,17 @@ nvmet_rdma_get_rsp(struct nvmet_rdma_queue *queue)
         spin_unlock_irqrestore(&queue->rsps_lock, flags);
 
         if (unlikely(!rsp)) {
-                rsp = kmalloc(sizeof(*rsp), GFP_KERNEL);
+                int ret;
+
+                rsp = kzalloc(sizeof(*rsp), GFP_KERNEL);
                 if (unlikely(!rsp))
                         return NULL;
+                ret = nvmet_rdma_alloc_rsp(queue->dev, rsp);
+                if (unlikely(ret)) {
+                        kfree(rsp);
+                        return NULL;
+                }
+
                 rsp->allocated = true;
         }
 
@@ -197,6 +209,7 @@ nvmet_rdma_put_rsp(struct nvmet_rdma_rsp *rsp)
         unsigned long flags;
 
         if (unlikely(rsp->allocated)) {
+                nvmet_rdma_free_rsp(rsp->queue->dev, rsp);
                 kfree(rsp);
                 return;
         }
diff --git a/drivers/pci/controller/dwc/pci-imx6.c b/drivers/pci/controller/dwc/pci-imx6.c
index 52e47dac028f..80f843030e36 100644
--- a/drivers/pci/controller/dwc/pci-imx6.c
+++ b/drivers/pci/controller/dwc/pci-imx6.c
@@ -310,6 +310,9 @@ static int imx6_pcie_attach_pd(struct device *dev)
         imx6_pcie->pd_pcie = dev_pm_domain_attach_by_name(dev, "pcie");
         if (IS_ERR(imx6_pcie->pd_pcie))
                 return PTR_ERR(imx6_pcie->pd_pcie);
+        /* Do nothing when power domain missing */
+        if (!imx6_pcie->pd_pcie)
+                return 0;
         link = device_link_add(dev, imx6_pcie->pd_pcie,
                         DL_FLAG_STATELESS |
                         DL_FLAG_PM_RUNTIME |
@@ -323,13 +326,13 @@ static int imx6_pcie_attach_pd(struct device *dev)
         if (IS_ERR(imx6_pcie->pd_pcie_phy))
                 return PTR_ERR(imx6_pcie->pd_pcie_phy);
 
-        device_link_add(dev, imx6_pcie->pd_pcie_phy,
+        link = device_link_add(dev, imx6_pcie->pd_pcie_phy,
                         DL_FLAG_STATELESS |
                         DL_FLAG_PM_RUNTIME |
                         DL_FLAG_RPM_ACTIVE);
-        if (IS_ERR(link)) {
-                dev_err(dev, "Failed to add device_link to pcie_phy pd: %ld\n", PTR_ERR(link));
-                return PTR_ERR(link);
+        if (!link) {
+                dev_err(dev, "Failed to add device_link to pcie_phy pd.\n");
+                return -EINVAL;
         }
 
         return 0;
diff --git a/drivers/pci/controller/dwc/pcie-armada8k.c b/drivers/pci/controller/dwc/pcie-armada8k.c
index b171b6bc15c8..0c389a30ef5d 100644
--- a/drivers/pci/controller/dwc/pcie-armada8k.c
+++ b/drivers/pci/controller/dwc/pcie-armada8k.c
@@ -22,7 +22,6 @@
 #include <linux/resource.h>
 #include <linux/of_pci.h>
 #include <linux/of_irq.h>
-#include <linux/gpio/consumer.h>
 
 #include "pcie-designware.h"
 
@@ -30,7 +29,6 @@ struct armada8k_pcie {
         struct dw_pcie *pci;
         struct clk *clk;
         struct clk *clk_reg;
-        struct gpio_desc *reset_gpio;
 };
 
 #define PCIE_VENDOR_REGS_OFFSET         0x8000
@@ -139,12 +137,6 @@ static int armada8k_pcie_host_init(struct pcie_port *pp)
         struct dw_pcie *pci = to_dw_pcie_from_pp(pp);
         struct armada8k_pcie *pcie = to_armada8k_pcie(pci);
 
-        if (pcie->reset_gpio) {
-                /* assert and then deassert the reset signal */
-                gpiod_set_value_cansleep(pcie->reset_gpio, 1);
-                msleep(100);
-                gpiod_set_value_cansleep(pcie->reset_gpio, 0);
-        }
         dw_pcie_setup_rc(pp);
         armada8k_pcie_establish_link(pcie);
 
@@ -257,14 +249,6 @@ static int armada8k_pcie_probe(struct platform_device *pdev)
                 goto fail_clkreg;
         }
 
-        /* Get reset gpio signal and hold asserted (logically high) */
-        pcie->reset_gpio = devm_gpiod_get_optional(dev, "reset",
-                                                   GPIOD_OUT_HIGH);
-        if (IS_ERR(pcie->reset_gpio)) {
-                ret = PTR_ERR(pcie->reset_gpio);
-                goto fail_clkreg;
-        }
-
         platform_set_drvdata(pdev, pcie);
 
         ret = armada8k_add_pcie_port(pcie, pdev);
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index b0a413f3f7ca..e2a879e93d86 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -639,8 +639,9 @@ static void quirk_synopsys_haps(struct pci_dev *pdev)
                 break;
         }
 }
-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_SYNOPSYS, PCI_ANY_ID,
-                         quirk_synopsys_haps);
+DECLARE_PCI_FIXUP_CLASS_HEADER(PCI_VENDOR_ID_SYNOPSYS, PCI_ANY_ID,
+                               PCI_CLASS_SERIAL_USB_XHCI, 0,
+                               quirk_synopsys_haps);
 
 /*
  * Let's make the southbridge information explicit instead of having to
diff --git a/drivers/phy/qualcomm/phy-ath79-usb.c b/drivers/phy/qualcomm/phy-ath79-usb.c
index 6fd6e07ab345..09a77e556ece 100644
--- a/drivers/phy/qualcomm/phy-ath79-usb.c
+++ b/drivers/phy/qualcomm/phy-ath79-usb.c
@@ -31,7 +31,7 @@ static int ath79_usb_phy_power_on(struct phy *phy)
 
         err = reset_control_deassert(priv->reset);
         if (err && priv->no_suspend_override)
-                reset_control_assert(priv->no_suspend_override);
+                reset_control_deassert(priv->no_suspend_override);
 
         return err;
 }
@@ -69,7 +69,7 @@ static int ath79_usb_phy_probe(struct platform_device *pdev)
         if (!priv)
                 return -ENOMEM;
 
-        priv->reset = devm_reset_control_get(&pdev->dev, "usb-phy");
+        priv->reset = devm_reset_control_get(&pdev->dev, "phy");
         if (IS_ERR(priv->reset))
                 return PTR_ERR(priv->reset);
 
diff --git a/drivers/phy/ti/phy-gmii-sel.c b/drivers/phy/ti/phy-gmii-sel.c
index 77fdaa551977..a52c5bb35033 100644
--- a/drivers/phy/ti/phy-gmii-sel.c
+++ b/drivers/phy/ti/phy-gmii-sel.c
@@ -204,11 +204,11 @@ static struct phy *phy_gmii_sel_of_xlate(struct device *dev,
 
         if (args->args_count < 1)
                 return ERR_PTR(-EINVAL);
+        if (!priv || !priv->if_phys)
+                return ERR_PTR(-ENODEV);
         if (priv->soc_data->features & BIT(PHY_GMII_SEL_RMII_IO_CLK_EN) &&
             args->args_count < 2)
                 return ERR_PTR(-EINVAL);
-        if (!priv || !priv->if_phys)
-                return ERR_PTR(-ENODEV);
         if (phy_id > priv->soc_data->num_ports)
                 return ERR_PTR(-EINVAL);
         if (phy_id != priv->if_phys[phy_id - 1].id)
diff --git a/drivers/pinctrl/intel/pinctrl-cherryview.c b/drivers/pinctrl/intel/pinctrl-cherryview.c
index 05044e323ea5..03ec7a5d9d0b 100644
--- a/drivers/pinctrl/intel/pinctrl-cherryview.c
+++ b/drivers/pinctrl/intel/pinctrl-cherryview.c
@@ -1513,7 +1513,7 @@ static const struct dmi_system_id chv_no_valid_mask[] = {
                 .matches = {
                         DMI_MATCH(DMI_SYS_VENDOR, "GOOGLE"),
                         DMI_MATCH(DMI_PRODUCT_FAMILY, "Intel_Strago"),
-                        DMI_MATCH(DMI_BOARD_VERSION, "1.0"),
+                        DMI_MATCH(DMI_PRODUCT_VERSION, "1.0"),
                 },
         },
         {
@@ -1521,7 +1521,7 @@ static const struct dmi_system_id chv_no_valid_mask[] = {
                 .matches = {
                         DMI_MATCH(DMI_SYS_VENDOR, "HP"),
                         DMI_MATCH(DMI_PRODUCT_NAME, "Setzer"),
-                        DMI_MATCH(DMI_BOARD_VERSION, "1.0"),
+                        DMI_MATCH(DMI_PRODUCT_VERSION, "1.0"),
                 },
         },
         {
@@ -1529,7 +1529,7 @@ static const struct dmi_system_id chv_no_valid_mask[] = {
                 .matches = {
                         DMI_MATCH(DMI_SYS_VENDOR, "GOOGLE"),
                         DMI_MATCH(DMI_PRODUCT_NAME, "Cyan"),
-                        DMI_MATCH(DMI_BOARD_VERSION, "1.0"),
+                        DMI_MATCH(DMI_PRODUCT_VERSION, "1.0"),
                 },
         },
         {
@@ -1537,7 +1537,7 @@ static const struct dmi_system_id chv_no_valid_mask[] = {
                 .matches = {
                         DMI_MATCH(DMI_SYS_VENDOR, "GOOGLE"),
                         DMI_MATCH(DMI_PRODUCT_NAME, "Celes"),
-                        DMI_MATCH(DMI_BOARD_VERSION, "1.0"),
+                        DMI_MATCH(DMI_PRODUCT_VERSION, "1.0"),
                 },
         },
         {}
diff --git a/drivers/pinctrl/mediatek/Kconfig b/drivers/pinctrl/mediatek/Kconfig
index 1817786ab6aa..a005cbccb4f7 100644
--- a/drivers/pinctrl/mediatek/Kconfig
+++ b/drivers/pinctrl/mediatek/Kconfig
@@ -45,12 +45,14 @@ config PINCTRL_MT2701
 config PINCTRL_MT7623
         bool "Mediatek MT7623 pin control with generic binding"
         depends on MACH_MT7623 || COMPILE_TEST
+        depends on OF
         default MACH_MT7623
         select PINCTRL_MTK_MOORE
 
 config PINCTRL_MT7629
         bool "Mediatek MT7629 pin control"
         depends on MACH_MT7629 || COMPILE_TEST
+        depends on OF
         default MACH_MT7629
         select PINCTRL_MTK_MOORE
 
@@ -92,6 +94,7 @@ config PINCTRL_MT6797
 
 config PINCTRL_MT7622
         bool "MediaTek MT7622 pin control"
+        depends on OF
         depends on ARM64 || COMPILE_TEST
         default ARM64 && ARCH_MEDIATEK
         select PINCTRL_MTK_MOORE
diff --git a/drivers/pinctrl/pinctrl-mcp23s08.c b/drivers/pinctrl/pinctrl-mcp23s08.c
index b03481ef99a1..98905d4a79ca 100644
--- a/drivers/pinctrl/pinctrl-mcp23s08.c
+++ b/drivers/pinctrl/pinctrl-mcp23s08.c
@@ -832,8 +832,13 @@ static int mcp23s08_probe_one(struct mcp23s08 *mcp, struct device *dev,
                 break;
 
         case MCP_TYPE_S18:
+                one_regmap_config =
+                        devm_kmemdup(dev, &mcp23x17_regmap,
+                                sizeof(struct regmap_config), GFP_KERNEL);
+                if (!one_regmap_config)
+                        return -ENOMEM;
                 mcp->regmap = devm_regmap_init(dev, &mcp23sxx_spi_regmap, mcp,
-                                               &mcp23x17_regmap);
+                                               one_regmap_config);
                 mcp->reg_shift = 1;
                 mcp->chip.ngpio = 16;
                 mcp->chip.label = "mcp23s18";
diff --git a/drivers/pinctrl/sunxi/pinctrl-sun50i-h6.c b/drivers/pinctrl/sunxi/pinctrl-sun50i-h6.c
index aa8b58125568..ef4268cc6227 100644
--- a/drivers/pinctrl/sunxi/pinctrl-sun50i-h6.c
+++ b/drivers/pinctrl/sunxi/pinctrl-sun50i-h6.c
@@ -588,7 +588,7 @@ static const unsigned int h6_irq_bank_map[] = { 1, 5, 6, 7 };
 static const struct sunxi_pinctrl_desc h6_pinctrl_data = {
         .pins = h6_pins,
         .npins = ARRAY_SIZE(h6_pins),
-        .irq_banks = 3,
+        .irq_banks = 4,
         .irq_bank_map = h6_irq_bank_map,
         .irq_read_needs_mux = true,
 };
diff --git a/drivers/pinctrl/sunxi/pinctrl-sunxi.c b/drivers/pinctrl/sunxi/pinctrl-sunxi.c
index 5d9184d18c16..0e7fa69e93df 100644
--- a/drivers/pinctrl/sunxi/pinctrl-sunxi.c
+++ b/drivers/pinctrl/sunxi/pinctrl-sunxi.c
@@ -698,26 +698,24 @@ static int sunxi_pmx_request(struct pinctrl_dev *pctldev, unsigned offset)
 {
         struct sunxi_pinctrl *pctl = pinctrl_dev_get_drvdata(pctldev);
         unsigned short bank = offset / PINS_PER_BANK;
-        struct sunxi_pinctrl_regulator *s_reg = &pctl->regulators[bank];
-        struct regulator *reg;
+        unsigned short bank_offset = bank - pctl->desc->pin_base /
+                                            PINS_PER_BANK;
+        struct sunxi_pinctrl_regulator *s_reg = &pctl->regulators[bank_offset];
+        struct regulator *reg = s_reg->regulator;
+        char supply[16];
         int ret;
 
-        reg = s_reg->regulator;
-        if (!reg) {
-                char supply[16];
-
-                snprintf(supply, sizeof(supply), "vcc-p%c", 'a' + bank);
-                reg = regulator_get(pctl->dev, supply);
-                if (IS_ERR(reg)) {
-                        dev_err(pctl->dev, "Couldn't get bank P%c regulator\n",
-                                'A' + bank);
-                        return PTR_ERR(reg);
-                }
-
-                s_reg->regulator = reg;
-                refcount_set(&s_reg->refcount, 1);
-        } else {
+        if (reg) {
                 refcount_inc(&s_reg->refcount);
+                return 0;
+        }
+
+        snprintf(supply, sizeof(supply), "vcc-p%c", 'a' + bank);
+        reg = regulator_get(pctl->dev, supply);
+        if (IS_ERR(reg)) {
+                dev_err(pctl->dev, "Couldn't get bank P%c regulator\n",
+                        'A' + bank);
+                return PTR_ERR(reg);
         }
 
         ret = regulator_enable(reg);
@@ -727,13 +725,13 @@ static int sunxi_pmx_request(struct pinctrl_dev *pctldev, unsigned offset)
                 goto out;
         }
 
+        s_reg->regulator = reg;
+        refcount_set(&s_reg->refcount, 1);
+
         return 0;
 
 out:
-        if (refcount_dec_and_test(&s_reg->refcount)) {
-                regulator_put(s_reg->regulator);
-                s_reg->regulator = NULL;
-        }
+        regulator_put(s_reg->regulator);
 
         return ret;
 }
@@ -742,7 +740,9 @@ static int sunxi_pmx_free(struct pinctrl_dev *pctldev, unsigned offset)
 {
         struct sunxi_pinctrl *pctl = pinctrl_dev_get_drvdata(pctldev);
         unsigned short bank = offset / PINS_PER_BANK;
-        struct sunxi_pinctrl_regulator *s_reg = &pctl->regulators[bank];
+        unsigned short bank_offset = bank - pctl->desc->pin_base /
+                                            PINS_PER_BANK;
+        struct sunxi_pinctrl_regulator *s_reg = &pctl->regulators[bank_offset];
 
         if (!refcount_dec_and_test(&s_reg->refcount))
                 return 0;
diff --git a/drivers/pinctrl/sunxi/pinctrl-sunxi.h b/drivers/pinctrl/sunxi/pinctrl-sunxi.h
index e340d2a24b44..034c0317c8d6 100644
--- a/drivers/pinctrl/sunxi/pinctrl-sunxi.h
+++ b/drivers/pinctrl/sunxi/pinctrl-sunxi.h
@@ -136,7 +136,7 @@ struct sunxi_pinctrl {
         struct gpio_chip                *chip;
         const struct sunxi_pinctrl_desc *desc;
         struct device                   *dev;
-        struct sunxi_pinctrl_regulator  regulators[12];
+        struct sunxi_pinctrl_regulator  regulators[9];
         struct irq_domain               *domain;
         struct sunxi_pinctrl_function   *functions;
         unsigned                        nfunctions;
diff --git a/drivers/platform/x86/Kconfig b/drivers/platform/x86/Kconfig
index 5e2109c54c7c..b5e9db85e881 100644
--- a/drivers/platform/x86/Kconfig
+++ b/drivers/platform/x86/Kconfig
@@ -905,6 +905,7 @@ config TOSHIBA_WMI
 config ACPI_CMPC
         tristate "CMPC Laptop Extras"
         depends on ACPI && INPUT
+        depends on BACKLIGHT_LCD_SUPPORT
         depends on RFKILL || RFKILL=n
         select BACKLIGHT_CLASS_DEVICE
         help
@@ -1128,6 +1129,7 @@ config INTEL_OAKTRAIL
 config SAMSUNG_Q10
         tristate "Samsung Q10 Extras"
         depends on ACPI
+        depends on BACKLIGHT_LCD_SUPPORT
         select BACKLIGHT_CLASS_DEVICE
         ---help---
           This driver provides support for backlight control on Samsung Q10
diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c
index 4e7b55a14b1a..6e294b4d3635 100644
--- a/drivers/s390/block/dasd_eckd.c
+++ b/drivers/s390/block/dasd_eckd.c
@@ -4469,6 +4469,14 @@ static int dasd_symm_io(struct dasd_device *device, void __user *argp)
                 usrparm.psf_data &= 0x7fffffffULL;
                 usrparm.rssd_result &= 0x7fffffffULL;
         }
+        /* at least 2 bytes are accessed and should be allocated */
+        if (usrparm.psf_data_len < 2) {
+                DBF_DEV_EVENT(DBF_WARNING, device,
+                              "Symmetrix ioctl invalid data length %d",
+                              usrparm.psf_data_len);
+                rc = -EINVAL;
+                goto out;
+        }
         /* alloc I/O data area */
         psf_data = kzalloc(usrparm.psf_data_len, GFP_KERNEL | GFP_DMA);
         rssd_result = kzalloc(usrparm.rssd_result_len, GFP_KERNEL | GFP_DMA);
diff --git a/drivers/s390/char/sclp_config.c b/drivers/s390/char/sclp_config.c
index 194ffd5c8580..039b2074db7e 100644
--- a/drivers/s390/char/sclp_config.c
+++ b/drivers/s390/char/sclp_config.c
@@ -60,7 +60,9 @@ static void sclp_cpu_capability_notify(struct work_struct *work)
 
 static void __ref sclp_cpu_change_notify(struct work_struct *work)
 {
+        lock_device_hotplug();
         smp_rescan_cpus();
+        unlock_device_hotplug();
 }
 
 static void sclp_conf_receiver_fn(struct evbuf_header *evbuf)
diff --git a/drivers/s390/crypto/ap_bus.c b/drivers/s390/crypto/ap_bus.c
index 48ea0004a56d..5a699746c357 100644
--- a/drivers/s390/crypto/ap_bus.c
+++ b/drivers/s390/crypto/ap_bus.c
@@ -248,7 +248,8 @@ static inline int ap_test_config(unsigned int *field, unsigned int nr)
 static inline int ap_test_config_card_id(unsigned int id)
 {
         if (!ap_configuration)  /* QCI not supported */
-                return 1;
+                /* only ids 0...3F may be probed */
+                return id < 0x40 ? 1 : 0;
         return ap_test_config(ap_configuration->apm, id);
 }
 
diff --git a/drivers/s390/net/qeth_core.h b/drivers/s390/net/qeth_core.h
index 0ee026947f20..122059ecad84 100644
--- a/drivers/s390/net/qeth_core.h
+++ b/drivers/s390/net/qeth_core.h
@@ -22,6 +22,7 @@
 #include <linux/hashtable.h>
 #include <linux/ip.h>
 #include <linux/refcount.h>
+#include <linux/workqueue.h>
 
 #include <net/ipv6.h>
 #include <net/if_inet6.h>
@@ -789,6 +790,7 @@ struct qeth_card {
         struct qeth_seqno seqno;
         struct qeth_card_options options;
 
+        struct workqueue_struct *event_wq;
         wait_queue_head_t wait_q;
         spinlock_t mclock;
         unsigned long active_vlans[BITS_TO_LONGS(VLAN_N_VID)];
@@ -962,7 +964,6 @@ extern const struct attribute_group *qeth_osn_attr_groups[];
 extern const struct attribute_group qeth_device_attr_group;
 extern const struct attribute_group qeth_device_blkt_group;
 extern const struct device_type qeth_generic_devtype;
-extern struct workqueue_struct *qeth_wq;
 
 int qeth_card_hw_is_reachable(struct qeth_card *);
 const char *qeth_get_cardname_short(struct qeth_card *);
diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
index e63e03143ca7..89f912213e62 100644
--- a/drivers/s390/net/qeth_core_main.c
+++ b/drivers/s390/net/qeth_core_main.c
@@ -74,8 +74,7 @@ static void qeth_notify_skbs(struct qeth_qdio_out_q *queue,
 static void qeth_release_skbs(struct qeth_qdio_out_buffer *buf);
 static int qeth_init_qdio_out_buf(struct qeth_qdio_out_q *, int);
 
-struct workqueue_struct *qeth_wq;
-EXPORT_SYMBOL_GPL(qeth_wq);
+static struct workqueue_struct *qeth_wq;
 
 int qeth_card_hw_is_reachable(struct qeth_card *card)
 {
@@ -566,6 +565,7 @@ static int __qeth_issue_next_read(struct qeth_card *card)
                 QETH_DBF_MESSAGE(2, "error %i on device %x when starting next read ccw!\n",
                                  rc, CARD_DEVID(card));
                 atomic_set(&channel->irq_pending, 0);
+                qeth_release_buffer(channel, iob);
                 card->read_or_write_problem = 1;
                 qeth_schedule_recovery(card);
                 wake_up(&card->wait_q);
@@ -1127,6 +1127,8 @@ static void qeth_irq(struct ccw_device *cdev, unsigned long intparm,
                 rc = qeth_get_problem(card, cdev, irb);
                 if (rc) {
                         card->read_or_write_problem = 1;
+                        if (iob)
+                                qeth_release_buffer(iob->channel, iob);
                         qeth_clear_ipacmd_list(card);
                         qeth_schedule_recovery(card);
                         goto out;
@@ -1466,6 +1468,10 @@ static struct qeth_card *qeth_alloc_card(struct ccwgroup_device *gdev)
         CARD_RDEV(card) = gdev->cdev[0];
         CARD_WDEV(card) = gdev->cdev[1];
         CARD_DDEV(card) = gdev->cdev[2];
+
+        card->event_wq = alloc_ordered_workqueue("%s", 0, dev_name(&gdev->dev));
+        if (!card->event_wq)
+                goto out_wq;
         if (qeth_setup_channel(&card->read, true))
                 goto out_ip;
         if (qeth_setup_channel(&card->write, true))
@@ -1481,6 +1487,8 @@ out_data:
 out_channel:
         qeth_clean_channel(&card->read);
 out_ip:
+        destroy_workqueue(card->event_wq);
+out_wq:
         dev_set_drvdata(&gdev->dev, NULL);
         kfree(card);
 out:
@@ -1809,6 +1817,7 @@ static int qeth_idx_activate_get_answer(struct qeth_card *card,
                 QETH_DBF_MESSAGE(2, "Error2 in activating channel rc=%d\n", rc);
                 QETH_DBF_TEXT_(SETUP, 2, "2err%d", rc);
                 atomic_set(&channel->irq_pending, 0);
+                qeth_release_buffer(channel, iob);
                 wake_up(&card->wait_q);
                 return rc;
         }
@@ -1878,6 +1887,7 @@ static int qeth_idx_activate_channel(struct qeth_card *card,
                         rc);
                 QETH_DBF_TEXT_(SETUP, 2, "1err%d", rc);
                 atomic_set(&channel->irq_pending, 0);
+                qeth_release_buffer(channel, iob);
                 wake_up(&card->wait_q);
                 return rc;
         }
@@ -2058,6 +2068,7 @@ int qeth_send_control_data(struct qeth_card *card, int len,
         }
         reply = qeth_alloc_reply(card);
         if (!reply) {
+                qeth_release_buffer(channel, iob);
                 return -ENOMEM;
         }
         reply->callback = reply_cb;
@@ -2389,11 +2400,12 @@ static int qeth_init_qdio_out_buf(struct qeth_qdio_out_q *q, int bidx)
         return 0;
 }
 
-static void qeth_free_qdio_out_buf(struct qeth_qdio_out_q *q)
+static void qeth_free_output_queue(struct qeth_qdio_out_q *q)
 {
         if (!q)
                 return;
 
+        qeth_clear_outq_buffers(q, 1);
         qdio_free_buffers(q->qdio_bufs, QDIO_MAX_BUFFERS_PER_Q);
         kfree(q);
 }
@@ -2467,10 +2479,8 @@ out_freeoutqbufs:
                 card->qdio.out_qs[i]->bufs[j] = NULL;
         }
 out_freeoutq:
-        while (i > 0) {
-                qeth_free_qdio_out_buf(card->qdio.out_qs[--i]);
-                qeth_clear_outq_buffers(card->qdio.out_qs[i], 1);
-        }
+        while (i > 0)
+                qeth_free_output_queue(card->qdio.out_qs[--i]);
         kfree(card->qdio.out_qs);
         card->qdio.out_qs = NULL;
 out_freepool:
@@ -2503,10 +2513,8 @@ static void qeth_free_qdio_buffers(struct qeth_card *card)
         qeth_free_buffer_pool(card);
         /* free outbound qdio_qs */
         if (card->qdio.out_qs) {
-                for (i = 0; i < card->qdio.no_out_queues; ++i) {
-                        qeth_clear_outq_buffers(card->qdio.out_qs[i], 1);
-                        qeth_free_qdio_out_buf(card->qdio.out_qs[i]);
-                }
+                for (i = 0; i < card->qdio.no_out_queues; i++)
+                        qeth_free_output_queue(card->qdio.out_qs[i]);
                 kfree(card->qdio.out_qs);
                 card->qdio.out_qs = NULL;
         }
@@ -5028,6 +5036,7 @@ static void qeth_core_free_card(struct qeth_card *card)
         qeth_clean_channel(&card->read);
         qeth_clean_channel(&card->write);
         qeth_clean_channel(&card->data);
+        destroy_workqueue(card->event_wq);
         qeth_free_qdio_buffers(card);
         unregister_service_level(&card->qeth_service_level);
         dev_set_drvdata(&card->gdev->dev, NULL);
diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c
index f108d4b44605..a43de2f9bcac 100644
--- a/drivers/s390/net/qeth_l2_main.c
+++ b/drivers/s390/net/qeth_l2_main.c
@@ -369,6 +369,8 @@ static void qeth_l2_stop_card(struct qeth_card *card, int recovery_mode)
                 qeth_clear_cmd_buffers(&card->read);
                 qeth_clear_cmd_buffers(&card->write);
         }
+
+        flush_workqueue(card->event_wq);
 }
 
 static int qeth_l2_process_inbound_buffer(struct qeth_card *card,
@@ -801,6 +803,8 @@ static void qeth_l2_remove_device(struct ccwgroup_device *cgdev)
 
         if (cgdev->state == CCWGROUP_ONLINE)
                 qeth_l2_set_offline(cgdev);
+
+        cancel_work_sync(&card->close_dev_work);
         if (qeth_netdev_is_registered(card->dev))
                 unregister_netdev(card->dev);
 }
@@ -1434,7 +1438,7 @@ static void qeth_bridge_state_change(struct qeth_card *card,
         data->card = card;
         memcpy(&data->qports, qports,
                         sizeof(struct qeth_sbp_state_change) + extrasize);
-        queue_work(qeth_wq, &data->worker);
+        queue_work(card->event_wq, &data->worker);
 }
 
 struct qeth_bridge_host_data {
@@ -1506,7 +1510,7 @@ static void qeth_bridge_host_event(struct qeth_card *card,
         data->card = card;
         memcpy(&data->hostevs, hostevs,
                         sizeof(struct qeth_ipacmd_addr_change) + extrasize);
-        queue_work(qeth_wq, &data->worker);
+        queue_work(card->event_wq, &data->worker);
 }
 
 /* SETBRIDGEPORT support; sending commands */
diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c
index 42a7cdc59b76..df34bff4ac31 100644
--- a/drivers/s390/net/qeth_l3_main.c
+++ b/drivers/s390/net/qeth_l3_main.c
@@ -1433,6 +1433,8 @@ static void qeth_l3_stop_card(struct qeth_card *card, int recovery_mode)
                 qeth_clear_cmd_buffers(&card->read);
                 qeth_clear_cmd_buffers(&card->write);
         }
+
+        flush_workqueue(card->event_wq);
 }
 
 /*
@@ -2338,6 +2340,7 @@ static void qeth_l3_remove_device(struct ccwgroup_device *cgdev)
         if (cgdev->state == CCWGROUP_ONLINE)
                 qeth_l3_set_offline(cgdev);
 
+        cancel_work_sync(&card->close_dev_work);
         if (qeth_netdev_is_registered(card->dev))
                 unregister_netdev(card->dev);
         qeth_l3_clear_ip_htable(card, 0);
diff --git a/drivers/s390/scsi/zfcp_aux.c b/drivers/s390/scsi/zfcp_aux.c
index 9cf30d124b9e..e390f8c6d5f3 100644
--- a/drivers/s390/scsi/zfcp_aux.c
+++ b/drivers/s390/scsi/zfcp_aux.c
@@ -403,7 +403,6 @@ struct zfcp_adapter *zfcp_adapter_enqueue(struct ccw_device *ccw_device)
                 goto failed;
 
         /* report size limit per scatter-gather segment */
-        adapter->dma_parms.max_segment_size = ZFCP_QDIO_SBALE_LEN;
         adapter->ccw_device->dev.dma_parms = &adapter->dma_parms;
 
         adapter->stat_read_buf_num = FSF_STATUS_READS_RECOM;
diff --git a/drivers/s390/scsi/zfcp_scsi.c b/drivers/s390/scsi/zfcp_scsi.c
index 00acc7144bbc..f4f6a07c5222 100644
--- a/drivers/s390/scsi/zfcp_scsi.c
+++ b/drivers/s390/scsi/zfcp_scsi.c
@@ -428,6 +428,8 @@ static struct scsi_host_template zfcp_scsi_host_template = {
         .max_sectors             = (((QDIO_MAX_ELEMENTS_PER_BUFFER - 1)
                                      * ZFCP_QDIO_MAX_SBALS_PER_REQ) - 2) * 8,
                                    /* GCD, adjusted later */
+        /* report size limit per scatter-gather segment */
+        .max_segment_size        = ZFCP_QDIO_SBALE_LEN,
         .dma_boundary            = ZFCP_QDIO_SBALE_LEN - 1,
         .shost_attrs             = zfcp_sysfs_shost_attrs,
         .sdev_attrs              = zfcp_sysfs_sdev_attrs,
diff --git a/drivers/scsi/53c700.c b/drivers/scsi/53c700.c
index 128d658d472a..16957d7ac414 100644
--- a/drivers/scsi/53c700.c
+++ b/drivers/scsi/53c700.c
@@ -295,7 +295,7 @@ NCR_700_detect(struct scsi_host_template *tpnt,
         if(tpnt->sdev_attrs == NULL)
                 tpnt->sdev_attrs = NCR_700_dev_attrs;
 
-        memory = dma_alloc_attrs(hostdata->dev, TOTAL_MEM_SIZE, &pScript,
+        memory = dma_alloc_attrs(dev, TOTAL_MEM_SIZE, &pScript,
                                  GFP_KERNEL, DMA_ATTR_NON_CONSISTENT);
         if(memory == NULL) {
                 printk(KERN_ERR "53c700: Failed to allocate memory for driver, detaching\n");
diff --git a/drivers/scsi/aacraid/linit.c b/drivers/scsi/aacraid/linit.c
index 634ddb90e7aa..7e56a11836c1 100644
--- a/drivers/scsi/aacraid/linit.c
+++ b/drivers/scsi/aacraid/linit.c
@@ -1747,11 +1747,10 @@ static int aac_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
                 shost->max_sectors = (shost->sg_tablesize * 8) + 112;
         }
 
-        error = dma_set_max_seg_size(&pdev->dev,
-                (aac->adapter_info.options & AAC_OPT_NEW_COMM) ?
-                        (shost->max_sectors << 9) : 65536);
-        if (error)
-                goto out_deinit;
+        if (aac->adapter_info.options & AAC_OPT_NEW_COMM)
+                shost->max_segment_size = shost->max_sectors << 9;
+        else
+                shost->max_segment_size = 65536;
 
         /*
          * Firmware printf works only with older firmware.
diff --git a/drivers/scsi/aic94xx/aic94xx_init.c b/drivers/scsi/aic94xx/aic94xx_init.c
index f83f79b07b50..07efcb9b5b94 100644
--- a/drivers/scsi/aic94xx/aic94xx_init.c
+++ b/drivers/scsi/aic94xx/aic94xx_init.c
@@ -280,7 +280,7 @@ static ssize_t asd_show_dev_rev(struct device *dev,
         return snprintf(buf, PAGE_SIZE, "%s\n",
                         asd_dev_rev[asd_ha->revision_id]);
 }
-static DEVICE_ATTR(revision, S_IRUGO, asd_show_dev_rev, NULL);
+static DEVICE_ATTR(aic_revision, S_IRUGO, asd_show_dev_rev, NULL);
 
 static ssize_t asd_show_dev_bios_build(struct device *dev,
                                        struct device_attribute *attr,char *buf)
@@ -477,7 +477,7 @@ static int asd_create_dev_attrs(struct asd_ha_struct *asd_ha)
 {
         int err;
 
-        err = device_create_file(&asd_ha->pcidev->dev, &dev_attr_revision);
+        err = device_create_file(&asd_ha->pcidev->dev, &dev_attr_aic_revision);
         if (err)
                 return err;
 
@@ -499,13 +499,13 @@ err_update_bios:
 err_biosb:
         device_remove_file(&asd_ha->pcidev->dev, &dev_attr_bios_build);
 err_rev:
-        device_remove_file(&asd_ha->pcidev->dev, &dev_attr_revision);
+        device_remove_file(&asd_ha->pcidev->dev, &dev_attr_aic_revision);
         return err;
 }
 
 static void asd_remove_dev_attrs(struct asd_ha_struct *asd_ha)
 {
-        device_remove_file(&asd_ha->pcidev->dev, &dev_attr_revision);
+        device_remove_file(&asd_ha->pcidev->dev, &dev_attr_aic_revision);
         device_remove_file(&asd_ha->pcidev->dev, &dev_attr_bios_build);
         device_remove_file(&asd_ha->pcidev->dev, &dev_attr_pcba_sn);
         device_remove_file(&asd_ha->pcidev->dev, &dev_attr_update_bios);
diff --git a/drivers/scsi/bnx2fc/bnx2fc_io.c b/drivers/scsi/bnx2fc/bnx2fc_io.c
index 350257c13a5b..bc9f2a2365f4 100644
--- a/drivers/scsi/bnx2fc/bnx2fc_io.c
+++ b/drivers/scsi/bnx2fc/bnx2fc_io.c
@@ -240,6 +240,7 @@ struct bnx2fc_cmd_mgr *bnx2fc_cmd_mgr_alloc(struct bnx2fc_hba *hba)
                 return NULL;
         }
 
+        cmgr->hba = hba;
         cmgr->free_list = kcalloc(arr_sz, sizeof(*cmgr->free_list),
                                   GFP_KERNEL);
         if (!cmgr->free_list) {
@@ -256,7 +257,6 @@ struct bnx2fc_cmd_mgr *bnx2fc_cmd_mgr_alloc(struct bnx2fc_hba *hba)
                 goto mem_err;
         }
 
-        cmgr->hba = hba;
         cmgr->cmds = (struct bnx2fc_cmd **)(cmgr + 1);
 
         for (i = 0; i < arr_sz; i++)  {
@@ -295,7 +295,7 @@ struct bnx2fc_cmd_mgr *bnx2fc_cmd_mgr_alloc(struct bnx2fc_hba *hba)
 
         /* Allocate pool of io_bdts - one for each bnx2fc_cmd */
         mem_size = num_ios * sizeof(struct io_bdt *);
-        cmgr->io_bdt_pool = kmalloc(mem_size, GFP_KERNEL);
+        cmgr->io_bdt_pool = kzalloc(mem_size, GFP_KERNEL);
         if (!cmgr->io_bdt_pool) {
                 printk(KERN_ERR PFX "failed to alloc io_bdt_pool\n");
                 goto mem_err;
diff --git a/drivers/scsi/csiostor/csio_attr.c b/drivers/scsi/csiostor/csio_attr.c
index 8a004036e3d7..9bd2bd8dc2be 100644
--- a/drivers/scsi/csiostor/csio_attr.c
+++ b/drivers/scsi/csiostor/csio_attr.c
@@ -594,12 +594,12 @@ csio_vport_create(struct fc_vport *fc_vport, bool disable)
         }
 
         fc_vport_set_state(fc_vport, FC_VPORT_INITIALIZING);
+        ln->fc_vport = fc_vport;
 
         if (csio_fcoe_alloc_vnp(hw, ln))
                 goto error;
 
         *(struct csio_lnode **)fc_vport->dd_data = ln;
-        ln->fc_vport = fc_vport;
         if (!fc_vport->node_name)
                 fc_vport->node_name = wwn_to_u64(csio_ln_wwnn(ln));
         if (!fc_vport->port_name)
diff --git a/drivers/scsi/cxlflash/main.c b/drivers/scsi/cxlflash/main.c
index bfa13e3b191c..c8bad2c093b8 100644
--- a/drivers/scsi/cxlflash/main.c
+++ b/drivers/scsi/cxlflash/main.c
@@ -3687,6 +3687,7 @@ static int cxlflash_probe(struct pci_dev *pdev,
         host->max_cmd_len = CXLFLASH_MAX_CDB_LEN;
 
         cfg = shost_priv(host);
+        cfg->state = STATE_PROBING;
         cfg->host = host;
         rc = alloc_mem(cfg);
         if (rc) {
@@ -3775,6 +3776,7 @@ out:
         return rc;
 
 out_remove:
+        cfg->state = STATE_PROBED;
         cxlflash_remove(pdev);
         goto out;
 }
diff --git a/drivers/scsi/libfc/fc_lport.c b/drivers/scsi/libfc/fc_lport.c
index be83590ed955..ff943f477d6f 100644
--- a/drivers/scsi/libfc/fc_lport.c
+++ b/drivers/scsi/libfc/fc_lport.c
@@ -1726,14 +1726,14 @@ void fc_lport_flogi_resp(struct fc_seq *sp, struct fc_frame *fp,
             fc_frame_payload_op(fp) != ELS_LS_ACC) {
                 FC_LPORT_DBG(lport, "FLOGI not accepted or bad response\n");
                 fc_lport_error(lport, fp);
-                goto err;
+                goto out;
         }
 
         flp = fc_frame_payload_get(fp, sizeof(*flp));
         if (!flp) {
                 FC_LPORT_DBG(lport, "FLOGI bad response\n");
                 fc_lport_error(lport, fp);
-                goto err;
+                goto out;
         }
 
         mfs = ntohs(flp->fl_csp.sp_bb_data) &
@@ -1743,7 +1743,7 @@ void fc_lport_flogi_resp(struct fc_seq *sp, struct fc_frame *fp,
                 FC_LPORT_DBG(lport, "FLOGI bad mfs:%hu response, "
                              "lport->mfs:%hu\n", mfs, lport->mfs);
                 fc_lport_error(lport, fp);
-                goto err;
+                goto out;
         }
 
         if (mfs <= lport->mfs) {
diff --git a/drivers/scsi/libfc/fc_rport.c b/drivers/scsi/libfc/fc_rport.c
index 9192a1d9dec6..dfba4921b265 100644
--- a/drivers/scsi/libfc/fc_rport.c
+++ b/drivers/scsi/libfc/fc_rport.c
@@ -184,7 +184,6 @@ void fc_rport_destroy(struct kref *kref)
         struct fc_rport_priv *rdata;
 
         rdata = container_of(kref, struct fc_rport_priv, kref);
-        WARN_ON(!list_empty(&rdata->peers));
         kfree_rcu(rdata, rcu);
 }
 EXPORT_SYMBOL(fc_rport_destroy);
diff --git a/drivers/scsi/lpfc/lpfc_nvme.c b/drivers/scsi/lpfc/lpfc_nvme.c
index 4c66b19e6199..8c9f79042228 100644
--- a/drivers/scsi/lpfc/lpfc_nvme.c
+++ b/drivers/scsi/lpfc/lpfc_nvme.c
@@ -297,7 +297,8 @@ lpfc_nvme_localport_delete(struct nvme_fc_local_port *localport)
                          lport);
 
         /* release any threads waiting for the unreg to complete */
-        complete(&lport->lport_unreg_done);
+        if (lport->vport->localport)
+                complete(lport->lport_unreg_cmp);
 }
 
 /* lpfc_nvme_remoteport_delete
@@ -2545,7 +2546,8 @@ lpfc_nvme_create_localport(struct lpfc_vport *vport)
  */
 void
 lpfc_nvme_lport_unreg_wait(struct lpfc_vport *vport,
-                           struct lpfc_nvme_lport *lport)
+                           struct lpfc_nvme_lport *lport,
+                           struct completion *lport_unreg_cmp)
 {
 #if (IS_ENABLED(CONFIG_NVME_FC))
         u32 wait_tmo;
@@ -2557,8 +2559,7 @@ lpfc_nvme_lport_unreg_wait(struct lpfc_vport *vport,
          */
         wait_tmo = msecs_to_jiffies(LPFC_NVME_WAIT_TMO * 1000);
         while (true) {
-                ret = wait_for_completion_timeout(&lport->lport_unreg_done,
-                                                  wait_tmo);
+                ret = wait_for_completion_timeout(lport_unreg_cmp, wait_tmo);
                 if (unlikely(!ret)) {
                         lpfc_printf_vlog(vport, KERN_ERR, LOG_NVME_IOERR,
                                          "6176 Lport %p Localport %p wait "
@@ -2592,12 +2593,12 @@ lpfc_nvme_destroy_localport(struct lpfc_vport *vport)
         struct lpfc_nvme_lport *lport;
         struct lpfc_nvme_ctrl_stat *cstat;
         int ret;
+        DECLARE_COMPLETION_ONSTACK(lport_unreg_cmp);
 
         if (vport->nvmei_support == 0)
                 return;
 
         localport = vport->localport;
-        vport->localport = NULL;
         lport = (struct lpfc_nvme_lport *)localport->private;
         cstat = lport->cstat;
 
@@ -2608,13 +2609,14 @@ lpfc_nvme_destroy_localport(struct lpfc_vport *vport)
         /* lport's rport list is clear.  Unregister
          * lport and release resources.
          */
-        init_completion(&lport->lport_unreg_done);
+        lport->lport_unreg_cmp = &lport_unreg_cmp;
         ret = nvme_fc_unregister_localport(localport);
 
         /* Wait for completion.  This either blocks
          * indefinitely or succeeds
          */
-        lpfc_nvme_lport_unreg_wait(vport, lport);
+        lpfc_nvme_lport_unreg_wait(vport, lport, &lport_unreg_cmp);
+        vport->localport = NULL;
         kfree(cstat);
 
         /* Regardless of the unregister upcall response, clear
diff --git a/drivers/scsi/lpfc/lpfc_nvme.h b/drivers/scsi/lpfc/lpfc_nvme.h
index cfd4719be25c..b234d0298994 100644
--- a/drivers/scsi/lpfc/lpfc_nvme.h
+++ b/drivers/scsi/lpfc/lpfc_nvme.h
@@ -50,7 +50,7 @@ struct lpfc_nvme_ctrl_stat {
 /* Declare nvme-based local and remote port definitions. */
 struct lpfc_nvme_lport {
         struct lpfc_vport *vport;
-        struct completion lport_unreg_done;
+        struct completion *lport_unreg_cmp;
         /* Add stats counters here */
         struct lpfc_nvme_ctrl_stat *cstat;
         atomic_t fc4NvmeLsRequests;
diff --git a/drivers/scsi/lpfc/lpfc_nvmet.c b/drivers/scsi/lpfc/lpfc_nvmet.c
index 6245f442d784..95fee83090eb 100644
--- a/drivers/scsi/lpfc/lpfc_nvmet.c
+++ b/drivers/scsi/lpfc/lpfc_nvmet.c
@@ -1003,7 +1003,8 @@ lpfc_nvmet_targetport_delete(struct nvmet_fc_target_port *targetport)
         struct lpfc_nvmet_tgtport *tport = targetport->private;
 
         /* release any threads waiting for the unreg to complete */
-        complete(&tport->tport_unreg_done);
+        if (tport->phba->targetport)
+                complete(tport->tport_unreg_cmp);
 }
 
 static void
@@ -1692,6 +1693,7 @@ lpfc_nvmet_destroy_targetport(struct lpfc_hba *phba)
         struct lpfc_nvmet_tgtport *tgtp;
         struct lpfc_queue *wq;
         uint32_t qidx;
+        DECLARE_COMPLETION_ONSTACK(tport_unreg_cmp);
 
         if (phba->nvmet_support == 0)
                 return;
@@ -1701,9 +1703,9 @@ lpfc_nvmet_destroy_targetport(struct lpfc_hba *phba)
                         wq = phba->sli4_hba.nvme_wq[qidx];
                         lpfc_nvmet_wqfull_flush(phba, wq, NULL);
                 }
-                init_completion(&tgtp->tport_unreg_done);
+                tgtp->tport_unreg_cmp = &tport_unreg_cmp;
                 nvmet_fc_unregister_targetport(phba->targetport);
-                wait_for_completion_timeout(&tgtp->tport_unreg_done, 5);
+                wait_for_completion_timeout(&tport_unreg_cmp, 5);
                 lpfc_nvmet_cleanup_io_context(phba);
         }
         phba->targetport = NULL;
diff --git a/drivers/scsi/lpfc/lpfc_nvmet.h b/drivers/scsi/lpfc/lpfc_nvmet.h
index 1aaff63f1f41..0ec1082ce7ef 100644
--- a/drivers/scsi/lpfc/lpfc_nvmet.h
+++ b/drivers/scsi/lpfc/lpfc_nvmet.h
@@ -34,7 +34,7 @@
 /* Used for NVME Target */
 struct lpfc_nvmet_tgtport {
         struct lpfc_hba *phba;
-        struct completion tport_unreg_done;
+        struct completion *tport_unreg_cmp;
 
         /* Stats counters - lpfc_nvmet_unsol_ls_buffer */
         atomic_t rcv_ls_req_in;
diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c
index 661512bec3ac..e27f4df24021 100644
--- a/drivers/scsi/scsi_debug.c
+++ b/drivers/scsi/scsi_debug.c
@@ -62,7 +62,7 @@
 
 /* make sure inq_product_rev string corresponds to this version */
 #define SDEBUG_VERSION "0188"   /* format to fit INQUIRY revision field */
-static const char *sdebug_version_date = "20180128";
+static const char *sdebug_version_date = "20190125";
 
 #define MY_NAME "scsi_debug"
 
@@ -735,7 +735,7 @@ static inline bool scsi_debug_lbp(void)
                 (sdebug_lbpu || sdebug_lbpws || sdebug_lbpws10);
 }
 
-static void *fake_store(unsigned long long lba)
+static void *lba2fake_store(unsigned long long lba)
 {
         lba = do_div(lba, sdebug_store_sectors);
 
@@ -2514,8 +2514,8 @@ static int do_device_access(struct scsi_cmnd *scmd, u32 sg_skip, u64 lba,
         return ret;
 }
 
-/* If fake_store(lba,num) compares equal to arr(num), then copy top half of
- * arr into fake_store(lba,num) and return true. If comparison fails then
+/* If lba2fake_store(lba,num) compares equal to arr(num), then copy top half of
+ * arr into lba2fake_store(lba,num) and return true. If comparison fails then
  * return false. */
 static bool comp_write_worker(u64 lba, u32 num, const u8 *arr)
 {
@@ -2643,7 +2643,7 @@ static int prot_verify_read(struct scsi_cmnd *SCpnt, sector_t start_sec,
                 if (sdt->app_tag == cpu_to_be16(0xffff))
                         continue;
 
-                ret = dif_verify(sdt, fake_store(sector), sector, ei_lba);
+                ret = dif_verify(sdt, lba2fake_store(sector), sector, ei_lba);
                 if (ret) {
                         dif_errors++;
                         return ret;
@@ -3261,10 +3261,12 @@ err_out:
 static int resp_write_same(struct scsi_cmnd *scp, u64 lba, u32 num,
                            u32 ei_lba, bool unmap, bool ndob)
 {
+        int ret;
         unsigned long iflags;
         unsigned long long i;
-        int ret;
-        u64 lba_off;
+        u32 lb_size = sdebug_sector_size;
+        u64 block, lbaa;
+        u8 *fs1p;
 
         ret = check_device_access_params(scp, lba, num);
         if (ret)
@@ -3276,31 +3278,30 @@ static int resp_write_same(struct scsi_cmnd *scp, u64 lba, u32 num,
                 unmap_region(lba, num);
                 goto out;
         }
-
-        lba_off = lba * sdebug_sector_size;
+        lbaa = lba;
+        block = do_div(lbaa, sdebug_store_sectors);
         /* if ndob then zero 1 logical block, else fetch 1 logical block */
+        fs1p = fake_storep + (block * lb_size);
         if (ndob) {
-                memset(fake_storep + lba_off, 0, sdebug_sector_size);
+                memset(fs1p, 0, lb_size);
                 ret = 0;
         } else
-                ret = fetch_to_dev_buffer(scp, fake_storep + lba_off,
-                                          sdebug_sector_size);
+                ret = fetch_to_dev_buffer(scp, fs1p, lb_size);
 
         if (-1 == ret) {
                 write_unlock_irqrestore(&atomic_rw, iflags);
                 return DID_ERROR << 16;
-        } else if (sdebug_verbose && !ndob && (ret < sdebug_sector_size))
+        } else if (sdebug_verbose && !ndob && (ret < lb_size))
                 sdev_printk(KERN_INFO, scp->device,
                             "%s: %s: lb size=%u, IO sent=%d bytes\n",
-                            my_name, "write same",
-                            sdebug_sector_size, ret);
+                            my_name, "write same", lb_size, ret);
 
         /* Copy first sector to remaining blocks */
-        for (i = 1 ; i < num ; i++)
-                memcpy(fake_storep + ((lba + i) * sdebug_sector_size),
-                       fake_storep + lba_off,
-                       sdebug_sector_size);
-
+        for (i = 1 ; i < num ; i++) {
+                lbaa = lba + i;
+                block = do_div(lbaa, sdebug_store_sectors);
+                memmove(fake_storep + (block * lb_size), fs1p, lb_size);
+        }
         if (scsi_debug_lbp())
                 map_region(lba, num);
 out:
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index b13cc9288ba0..6d65ac584eba 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -1842,8 +1842,8 @@ void __scsi_init_queue(struct Scsi_Host *shost, struct request_queue *q)
         blk_queue_segment_boundary(q, shost->dma_boundary);
         dma_set_seg_boundary(dev, shost->dma_boundary);
 
-        blk_queue_max_segment_size(q,
-                min(shost->max_segment_size, dma_get_max_seg_size(dev)));
+        blk_queue_max_segment_size(q, shost->max_segment_size);
+        dma_set_max_seg_size(dev, shost->max_segment_size);
 
         /*
          * Set a reasonable default alignment:  The larger of 32-byte (dword),
diff --git a/drivers/scsi/sd_zbc.c b/drivers/scsi/sd_zbc.c
index 83365b29a4d8..fff86940388b 100644
--- a/drivers/scsi/sd_zbc.c
+++ b/drivers/scsi/sd_zbc.c
@@ -462,12 +462,16 @@ int sd_zbc_read_zones(struct scsi_disk *sdkp, unsigned char *buf)
         sdkp->device->use_10_for_rw = 0;
 
         /*
-         * If something changed, revalidate the disk zone bitmaps once we have
-         * the capacity, that is on the second revalidate execution during disk
-         * scan and always during normal revalidate.
+         * Revalidate the disk zone bitmaps once the block device capacity is
+         * set on the second revalidate execution during disk scan and if
+         * something changed when executing a normal revalidate.
          */
-        if (sdkp->first_scan)
+        if (sdkp->first_scan) {
+                sdkp->zone_blocks = zone_blocks;
+                sdkp->nr_zones = nr_zones;
                 return 0;
+        }
+
         if (sdkp->zone_blocks != zone_blocks ||
             sdkp->nr_zones != nr_zones ||
             disk->queue->nr_zones != nr_zones) {
diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
index 71334aaf1447..2ddf24466a62 100644
--- a/drivers/scsi/ufs/ufshcd.c
+++ b/drivers/scsi/ufs/ufshcd.c
@@ -108,13 +108,19 @@
 int ufshcd_dump_regs(struct ufs_hba *hba, size_t offset, size_t len,
                      const char *prefix)
 {
-        u8 *regs;
+        u32 *regs;
+        size_t pos;
+
+        if (offset % 4 != 0 || len % 4 != 0) /* keep readl happy */
+                return -EINVAL;
 
         regs = kzalloc(len, GFP_KERNEL);
         if (!regs)
                 return -ENOMEM;
 
-        memcpy_fromio(regs, hba->mmio_base + offset, len);
+        for (pos = 0; pos < len; pos += 4)
+                regs[pos / 4] = ufshcd_readl(hba, offset + pos);
+
         ufshcd_hex_dump(prefix, regs, len);
         kfree(regs);
 
diff --git a/drivers/soc/fsl/qbman/qman.c b/drivers/soc/fsl/qbman/qman.c
index 52c153cd795a..636f83f781f5 100644
--- a/drivers/soc/fsl/qbman/qman.c
+++ b/drivers/soc/fsl/qbman/qman.c
@@ -1143,18 +1143,19 @@ static void qm_mr_process_task(struct work_struct *work);
 static irqreturn_t portal_isr(int irq, void *ptr)
 {
         struct qman_portal *p = ptr;
-
-        u32 clear = QM_DQAVAIL_MASK | p->irq_sources;
         u32 is = qm_in(&p->p, QM_REG_ISR) & p->irq_sources;
+        u32 clear = 0;
 
         if (unlikely(!is))
                 return IRQ_NONE;
 
         /* DQRR-handling if it's interrupt-driven */
-        if (is & QM_PIRQ_DQRI)
+        if (is & QM_PIRQ_DQRI) {
                 __poll_portal_fast(p, QMAN_POLL_LIMIT);
+                clear = QM_DQAVAIL_MASK | QM_PIRQ_DQRI;
+        }
         /* Handling of anything else that's interrupt-driven */
-        clear |= __poll_portal_slow(p, is);
+        clear |= __poll_portal_slow(p, is) & QM_PIRQ_SLOW;
         qm_out(&p->p, QM_REG_ISR, clear);
         return IRQ_HANDLED;
 }
diff --git a/drivers/staging/android/ion/ion.c b/drivers/staging/android/ion/ion.c
index a0802de8c3a1..6f5afab7c1a1 100644
--- a/drivers/staging/android/ion/ion.c
+++ b/drivers/staging/android/ion/ion.c
@@ -248,10 +248,10 @@ static void ion_dma_buf_detatch(struct dma_buf *dmabuf,
         struct ion_dma_buf_attachment *a = attachment->priv;
         struct ion_buffer *buffer = dmabuf->priv;
 
-        free_duped_table(a->table);
         mutex_lock(&buffer->lock);
         list_del(&a->list);
         mutex_unlock(&buffer->lock);
+        free_duped_table(a->table);
 
         kfree(a);
 }
diff --git a/drivers/staging/octeon/ethernet-mdio.c b/drivers/staging/octeon/ethernet-mdio.c
index 2848fa71a33d..d6248eecf123 100644
--- a/drivers/staging/octeon/ethernet-mdio.c
+++ b/drivers/staging/octeon/ethernet-mdio.c
@@ -170,7 +170,7 @@ int cvm_oct_phy_setup_device(struct net_device *dev)
                 return -ENODEV;
 
         priv->last_link = 0;
-        phy_start_aneg(phydev);
+        phy_start(phydev);
 
         return 0;
 no_phy:
diff --git a/drivers/staging/rtl8188eu/os_dep/usb_intf.c b/drivers/staging/rtl8188eu/os_dep/usb_intf.c
index 28cbd6b3d26c..dfee6985efa6 100644
--- a/drivers/staging/rtl8188eu/os_dep/usb_intf.c
+++ b/drivers/staging/rtl8188eu/os_dep/usb_intf.c
@@ -35,6 +35,7 @@ static const struct usb_device_id rtw_usb_id_tbl[] = {
         {USB_DEVICE(0x2001, 0x330F)}, /* DLink DWA-125 REV D1 */
         {USB_DEVICE(0x2001, 0x3310)}, /* Dlink DWA-123 REV D1 */
         {USB_DEVICE(0x2001, 0x3311)}, /* DLink GO-USB-N150 REV B1 */
+        {USB_DEVICE(0x2001, 0x331B)}, /* D-Link DWA-121 rev B1 */
         {USB_DEVICE(0x2357, 0x010c)}, /* TP-Link TL-WN722N v2 */
         {USB_DEVICE(0x0df6, 0x0076)}, /* Sitecom N150 v2 */
         {USB_DEVICE(USB_VENDER_ID_REALTEK, 0xffef)}, /* Rosewill RNX-N150NUB */
diff --git a/drivers/staging/rtl8723bs/include/ieee80211.h b/drivers/staging/rtl8723bs/include/ieee80211.h
index bcc8dfa8e672..9efb4dcb9d3a 100644
--- a/drivers/staging/rtl8723bs/include/ieee80211.h
+++ b/drivers/staging/rtl8723bs/include/ieee80211.h
@@ -850,18 +850,18 @@ enum ieee80211_state {
 #define IP_FMT "%pI4"
 #define IP_ARG(x) (x)
 
-extern __inline int is_multicast_mac_addr(const u8 *addr)
+static inline int is_multicast_mac_addr(const u8 *addr)
 {
         return ((addr[0] != 0xff) && (0x01 & addr[0]));
 }
 
-extern __inline int is_broadcast_mac_addr(const u8 *addr)
+static inline int is_broadcast_mac_addr(const u8 *addr)
 {
         return ((addr[0] == 0xff) && (addr[1] == 0xff) && (addr[2] == 0xff) &&   \
                 (addr[3] == 0xff) && (addr[4] == 0xff) && (addr[5] == 0xff));
 }
 
-extern __inline int is_zero_mac_addr(const u8 *addr)
+static inline int is_zero_mac_addr(const u8 *addr)
 {
         return ((addr[0] == 0x00) && (addr[1] == 0x00) && (addr[2] == 0x00) &&   \
                 (addr[3] == 0x00) && (addr[4] == 0x00) && (addr[5] == 0x00));
diff --git a/drivers/staging/speakup/spk_ttyio.c b/drivers/staging/speakup/spk_ttyio.c
index c92bbd05516e..005de0024dd4 100644
--- a/drivers/staging/speakup/spk_ttyio.c
+++ b/drivers/staging/speakup/spk_ttyio.c
@@ -265,7 +265,8 @@ static void spk_ttyio_send_xchar(char ch)
                 return;
         }
 
-        speakup_tty->ops->send_xchar(speakup_tty, ch);
+        if (speakup_tty->ops->send_xchar)
+                speakup_tty->ops->send_xchar(speakup_tty, ch);
         mutex_unlock(&speakup_tty_mutex);
 }
 
@@ -277,7 +278,8 @@ static void spk_ttyio_tiocmset(unsigned int set, unsigned int clear)
                 return;
         }
 
-        speakup_tty->ops->tiocmset(speakup_tty, set, clear);
+        if (speakup_tty->ops->tiocmset)
+                speakup_tty->ops->tiocmset(speakup_tty, set, clear);
         mutex_unlock(&speakup_tty_mutex);
 }
 
diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_core.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_core.c
index 9e17ec651bde..53f5a1cb4636 100644
--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_core.c
+++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_core.c
@@ -446,6 +446,7 @@ remote_event_wait(wait_queue_head_t *wq, struct remote_event *event)
 static inline void
 remote_event_signal_local(wait_queue_head_t *wq, struct remote_event *event)
 {
+        event->fired = 1;
         event->armed = 0;
         wake_up_all(wq);
 }
diff --git a/drivers/staging/wilc1000/host_interface.c b/drivers/staging/wilc1000/host_interface.c
index 70c854d939ce..3d0badc34825 100644
--- a/drivers/staging/wilc1000/host_interface.c
+++ b/drivers/staging/wilc1000/host_interface.c
@@ -36,7 +36,7 @@ struct wilc_op_mode {
 struct wilc_reg_frame {
         bool reg;
         u8 reg_id;
-        __le32 frame_type;
+        __le16 frame_type;
 } __packed;
 
 struct wilc_drv_handler {
@@ -1744,7 +1744,6 @@ int wilc_add_rx_gtk(struct wilc_vif *vif, const u8 *rx_gtk, u8 gtk_key_len,
                 result = wilc_send_config_pkt(vif, WILC_SET_CFG, wid_list,
                                               ARRAY_SIZE(wid_list),
                                               wilc_get_vif_idx(vif));
-                kfree(gtk_key);
         } else if (mode == WILC_STATION_MODE) {
                 struct wid wid;
 
@@ -1754,9 +1753,9 @@ int wilc_add_rx_gtk(struct wilc_vif *vif, const u8 *rx_gtk, u8 gtk_key_len,
                 wid.val = (u8 *)gtk_key;
                 result = wilc_send_config_pkt(vif, WILC_SET_CFG, &wid, 1,
                                               wilc_get_vif_idx(vif));
-                kfree(gtk_key);
         }
 
+        kfree(gtk_key);
         return result;
 }
 
diff --git a/drivers/staging/wilc1000/wilc_wlan.c b/drivers/staging/wilc1000/wilc_wlan.c
index 3c5e9e030cad..489e5a5038f8 100644
--- a/drivers/staging/wilc1000/wilc_wlan.c
+++ b/drivers/staging/wilc1000/wilc_wlan.c
@@ -1252,21 +1252,22 @@ static u32 init_chip(struct net_device *dev)
                 ret = wilc->hif_func->hif_read_reg(wilc, 0x1118, &reg);
                 if (!ret) {
                         netdev_err(dev, "fail read reg 0x1118\n");
-                        return ret;
+                        goto release;
                 }
                 reg |= BIT(0);
                 ret = wilc->hif_func->hif_write_reg(wilc, 0x1118, reg);
                 if (!ret) {
                         netdev_err(dev, "fail write reg 0x1118\n");
-                        return ret;
+                        goto release;
                 }
                 ret = wilc->hif_func->hif_write_reg(wilc, 0xc0000, 0x71);
                 if (!ret) {
                         netdev_err(dev, "fail write reg 0xc0000\n");
-                        return ret;
+                        goto release;
                 }
         }
 
+release:
         release_bus(wilc, WILC_BUS_RELEASE_ONLY);
 
         return ret;
diff --git a/drivers/target/target_core_configfs.c b/drivers/target/target_core_configfs.c
index 72016d0dfca5..8e7fffbb8802 100644
--- a/drivers/target/target_core_configfs.c
+++ b/drivers/target/target_core_configfs.c
@@ -852,6 +852,12 @@ static ssize_t pi_prot_type_store(struct config_item *item,
         return count;
 }
 
+/* always zero, but attr needs to remain RW to avoid userspace breakage */
+static ssize_t pi_prot_format_show(struct config_item *item, char *page)
+{
+        return snprintf(page, PAGE_SIZE, "0\n");
+}
+
 static ssize_t pi_prot_format_store(struct config_item *item,
                 const char *page, size_t count)
 {
@@ -1132,7 +1138,7 @@ CONFIGFS_ATTR(, emulate_3pc);
 CONFIGFS_ATTR(, emulate_pr);
 CONFIGFS_ATTR(, pi_prot_type);
 CONFIGFS_ATTR_RO(, hw_pi_prot_type);
-CONFIGFS_ATTR_WO(, pi_prot_format);
+CONFIGFS_ATTR(, pi_prot_format);
 CONFIGFS_ATTR(, pi_prot_verify);
 CONFIGFS_ATTR(, enforce_pr_isids);
 CONFIGFS_ATTR(, is_nonrot);
diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c
index c34c88ef3319..5831e0eecea1 100644
--- a/drivers/target/target_core_user.c
+++ b/drivers/target/target_core_user.c
@@ -1317,12 +1317,13 @@ static int tcmu_check_expired_cmd(int id, void *p, void *data)
                  * target_complete_cmd will translate this to LUN COMM FAILURE
                  */
                 scsi_status = SAM_STAT_CHECK_CONDITION;
+                list_del_init(&cmd->queue_entry);
         } else {
+                list_del_init(&cmd->queue_entry);
                 idr_remove(&udev->commands, id);
                 tcmu_free_cmd(cmd);
                 scsi_status = SAM_STAT_TASK_SET_FULL;
         }
-        list_del_init(&cmd->queue_entry);
 
         pr_debug("Timing out cmd %u on dev %s that is %s.\n",
                  id, udev->name, is_running ? "inflight" : "queued");
diff --git a/drivers/thermal/cpu_cooling.c b/drivers/thermal/cpu_cooling.c
index dfd23245f778..6fff16113628 100644
--- a/drivers/thermal/cpu_cooling.c
+++ b/drivers/thermal/cpu_cooling.c
@@ -774,7 +774,7 @@ of_cpufreq_cooling_register(struct cpufreq_policy *policy)
 
                 cdev = __cpufreq_cooling_register(np, policy, capacitance);
                 if (IS_ERR(cdev)) {
-                        pr_err("cpu_cooling: cpu%d is not running as cooling device: %ld\n",
+                        pr_err("cpu_cooling: cpu%d failed to register as cooling device: %ld\n",
                                policy->cpu, PTR_ERR(cdev));
                         cdev = NULL;
                 }
diff --git a/drivers/thermal/intel/int340x_thermal/processor_thermal_device.c b/drivers/thermal/intel/int340x_thermal/processor_thermal_device.c
index 284cf2c5a8fd..8e1cf4d789be 100644
--- a/drivers/thermal/intel/int340x_thermal/processor_thermal_device.c
+++ b/drivers/thermal/intel/int340x_thermal/processor_thermal_device.c
@@ -84,7 +84,12 @@ static ssize_t power_limit_##index##_##suffix##_show(struct device *dev, \
         struct pci_dev *pci_dev; \
         struct platform_device *pdev; \
         struct proc_thermal_device *proc_dev; \
-\
+        \
+        if (proc_thermal_emum_mode == PROC_THERMAL_NONE) { \
+                dev_warn(dev, "Attempted to get power limit before device was initialized!\n"); \
+                return 0; \
+        } \
+        \
         if (proc_thermal_emum_mode == PROC_THERMAL_PLATFORM_DEV) { \
                 pdev = to_platform_device(dev); \
                 proc_dev = platform_get_drvdata(pdev); \
@@ -298,11 +303,6 @@ static int proc_thermal_add(struct device *dev,
         *priv = proc_priv;
 
         ret = proc_thermal_read_ppcc(proc_priv);
-        if (!ret) {
-                ret = sysfs_create_group(&dev->kobj,
-                                         &power_limit_attribute_group);
-
-        }
         if (ret)
                 return ret;
 
@@ -316,8 +316,7 @@ static int proc_thermal_add(struct device *dev,
 
         proc_priv->int340x_zone = int340x_thermal_zone_add(adev, ops);
         if (IS_ERR(proc_priv->int340x_zone)) {
-                ret = PTR_ERR(proc_priv->int340x_zone);
-                goto remove_group;
+                return PTR_ERR(proc_priv->int340x_zone);
         } else
                 ret = 0;
 
@@ -331,9 +330,6 @@ static int proc_thermal_add(struct device *dev,
 
 remove_zone:
         int340x_thermal_zone_remove(proc_priv->int340x_zone);
-remove_group:
-        sysfs_remove_group(&proc_priv->dev->kobj,
-                           &power_limit_attribute_group);
 
         return ret;
 }
@@ -364,7 +360,10 @@ static int int3401_add(struct platform_device *pdev)
         platform_set_drvdata(pdev, proc_priv);
         proc_thermal_emum_mode = PROC_THERMAL_PLATFORM_DEV;
 
-        return 0;
+        dev_info(&pdev->dev, "Creating sysfs group for PROC_THERMAL_PLATFORM_DEV\n");
+
+        return sysfs_create_group(&pdev->dev.kobj,
+                                         &power_limit_attribute_group);
 }
 
 static int int3401_remove(struct platform_device *pdev)
@@ -423,7 +422,7 @@ static int  proc_thermal_pci_probe(struct pci_dev *pdev,
                 proc_priv->soc_dts = intel_soc_dts_iosf_init(
                                         INTEL_SOC_DTS_INTERRUPT_MSI, 2, 0);
 
-                if (proc_priv->soc_dts && pdev->irq) {
+                if (!IS_ERR(proc_priv->soc_dts) && pdev->irq) {
                         ret = pci_enable_msi(pdev);
                         if (!ret) {
                                 ret = request_threaded_irq(pdev->irq, NULL,
@@ -441,7 +440,10 @@ static int  proc_thermal_pci_probe(struct pci_dev *pdev,
                         dev_err(&pdev->dev, "No auxiliary DTSs enabled\n");
         }
 
-        return 0;
+        dev_info(&pdev->dev, "Creating sysfs group for PROC_THERMAL_PCI\n");
+
+        return sysfs_create_group(&pdev->dev.kobj,
+                                         &power_limit_attribute_group);
 }
 
 static void  proc_thermal_pci_remove(struct pci_dev *pdev)
diff --git a/drivers/thermal/of-thermal.c b/drivers/thermal/of-thermal.c
index 4bfdb4a1e47d..2df059cc07e2 100644
--- a/drivers/thermal/of-thermal.c
+++ b/drivers/thermal/of-thermal.c
@@ -867,14 +867,14 @@ __init *thermal_of_build_thermal_zone(struct device_node *np)
 
         ret = of_property_read_u32(np, "polling-delay-passive", &prop);
         if (ret < 0) {
-                pr_err("missing polling-delay-passive property\n");
+                pr_err("%pOFn: missing polling-delay-passive property\n", np);
                 goto free_tz;
         }
         tz->passive_delay = prop;
 
         ret = of_property_read_u32(np, "polling-delay", &prop);
         if (ret < 0) {
-                pr_err("missing polling-delay property\n");
+                pr_err("%pOFn: missing polling-delay property\n", np);
                 goto free_tz;
         }
         tz->polling_delay = prop;
diff --git a/drivers/tty/n_hdlc.c b/drivers/tty/n_hdlc.c
index 4164414d4c64..8bdf42bc8fc8 100644
--- a/drivers/tty/n_hdlc.c
+++ b/drivers/tty/n_hdlc.c
@@ -597,6 +597,7 @@ static ssize_t n_hdlc_tty_read(struct tty_struct *tty, struct file *file,
                                 /* too large for caller's buffer */
                                 ret = -EOVERFLOW;
                         } else {
+                                __set_current_state(TASK_RUNNING);
                                 if (copy_to_user(buf, rbuf->buf, rbuf->count))
                                         ret = -EFAULT;
                                 else
diff --git a/drivers/tty/serial/8250/8250_core.c b/drivers/tty/serial/8250/8250_core.c
index 189ab1212d9a..e441221e04b9 100644
--- a/drivers/tty/serial/8250/8250_core.c
+++ b/drivers/tty/serial/8250/8250_core.c
@@ -1070,15 +1070,16 @@ int serial8250_register_8250_port(struct uart_8250_port *up)
 
                         ret = 0;
                 }
-        }
 
-        /* Initialise interrupt backoff work if required */
-        if (up->overrun_backoff_time_ms > 0) {
-                uart->overrun_backoff_time_ms = up->overrun_backoff_time_ms;
-                INIT_DELAYED_WORK(&uart->overrun_backoff,
-                                  serial_8250_overrun_backoff_work);
-        } else {
-                uart->overrun_backoff_time_ms = 0;
+                /* Initialise interrupt backoff work if required */
+                if (up->overrun_backoff_time_ms > 0) {
+                        uart->overrun_backoff_time_ms =
+                                up->overrun_backoff_time_ms;
+                        INIT_DELAYED_WORK(&uart->overrun_backoff,
+                                        serial_8250_overrun_backoff_work);
+                } else {
+                        uart->overrun_backoff_time_ms = 0;
+                }
         }
 
         mutex_unlock(&serial_mutex);
diff --git a/drivers/tty/serial/8250/8250_mtk.c b/drivers/tty/serial/8250/8250_mtk.c
index e2c407656fa6..c1fdbc0b6840 100644
--- a/drivers/tty/serial/8250/8250_mtk.c
+++ b/drivers/tty/serial/8250/8250_mtk.c
@@ -357,6 +357,9 @@ static int mtk8250_probe_of(struct platform_device *pdev, struct uart_port *p,
         if (dmacnt == 2) {
                 data->dma = devm_kzalloc(&pdev->dev, sizeof(*data->dma),
                                          GFP_KERNEL);
+                if (!data->dma)
+                        return -ENOMEM;
+
                 data->dma->fn = mtk8250_dma_filter;
                 data->dma->rx_size = MTK_UART_RX_SIZE;
                 data->dma->rxconf.src_maxburst = MTK_UART_RX_TRIGGER;
diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c
index f80a300b5d68..48bd694a5fa1 100644
--- a/drivers/tty/serial/8250/8250_pci.c
+++ b/drivers/tty/serial/8250/8250_pci.c
@@ -3420,6 +3420,11 @@ static int
 serial_pci_guess_board(struct pci_dev *dev, struct pciserial_board *board)
 {
         int num_iomem, num_port, first_port = -1, i;
+        int rc;
+
+        rc = serial_pci_is_class_communication(dev);
+        if (rc)
+                return rc;
 
         /*
          * Should we try to make guesses for multiport serial devices later?
@@ -3647,10 +3652,6 @@ pciserial_init_one(struct pci_dev *dev, const struct pci_device_id *ent)
 
         board = &pci_boards[ent->driver_data];
 
-        rc = serial_pci_is_class_communication(dev);
-        if (rc)
-                return rc;
-
         rc = serial_pci_is_blacklisted(dev);
         if (rc)
                 return rc;
diff --git a/drivers/tty/serial/earlycon-riscv-sbi.c b/drivers/tty/serial/earlycon-riscv-sbi.c
index e1a551aae336..ce81523c3113 100644
--- a/drivers/tty/serial/earlycon-riscv-sbi.c
+++ b/drivers/tty/serial/earlycon-riscv-sbi.c
@@ -10,13 +10,16 @@
 #include <linux/serial_core.h>
 #include <asm/sbi.h>
 
-static void sbi_console_write(struct console *con,
-                              const char *s, unsigned int n)
+static void sbi_putc(struct uart_port *port, int c)
 {
-        int i;
+        sbi_console_putchar(c);
+}
 
-        for (i = 0; i < n; ++i)
-                sbi_console_putchar(s[i]);
+static void sbi_console_write(struct console *con,
+                              const char *s, unsigned n)
+{
+        struct earlycon_device *dev = con->data;
+        uart_console_write(&dev->port, s, n, sbi_putc);
 }
 
 static int __init early_sbi_setup(struct earlycon_device *device,
diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
index 241a48e5052c..debdd1b9e01a 100644
--- a/drivers/tty/serial/fsl_lpuart.c
+++ b/drivers/tty/serial/fsl_lpuart.c
@@ -1697,7 +1697,7 @@ lpuart32_set_termios(struct uart_port *port, struct ktermios *termios,
         }
 
         /* ask the core to calculate the divisor */
-        baud = uart_get_baud_rate(port, termios, old, 50, port->uartclk / 16);
+        baud = uart_get_baud_rate(port, termios, old, 50, port->uartclk / 4);
 
         spin_lock_irqsave(&sport->port.lock, flags);
 
diff --git a/drivers/tty/serial/qcom_geni_serial.c b/drivers/tty/serial/qcom_geni_serial.c
index a72d6d9fb983..38016609c7fa 100644
--- a/drivers/tty/serial/qcom_geni_serial.c
+++ b/drivers/tty/serial/qcom_geni_serial.c
@@ -225,7 +225,7 @@ static unsigned int qcom_geni_serial_get_mctrl(struct uart_port *uport)
         unsigned int mctrl = TIOCM_DSR | TIOCM_CAR;
         u32 geni_ios;
 
-        if (uart_console(uport) || !uart_cts_enabled(uport)) {
+        if (uart_console(uport)) {
                 mctrl |= TIOCM_CTS;
         } else {
                 geni_ios = readl_relaxed(uport->membase + SE_GENI_IOS);
@@ -241,7 +241,7 @@ static void qcom_geni_serial_set_mctrl(struct uart_port *uport,
 {
         u32 uart_manual_rfr = 0;
 
-        if (uart_console(uport) || !uart_cts_enabled(uport))
+        if (uart_console(uport))
                 return;
 
         if (!(mctrl & TIOCM_RTS))
diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
index d4cca5bdaf1c..556f50aa1b58 100644
--- a/drivers/tty/serial/serial_core.c
+++ b/drivers/tty/serial/serial_core.c
@@ -130,6 +130,9 @@ static void uart_start(struct tty_struct *tty)
         struct uart_port *port;
         unsigned long flags;
 
+        if (!state)
+                return;
+
         port = uart_port_lock(state, flags);
         __uart_start(tty);
         uart_port_unlock(port, flags);
@@ -550,10 +553,12 @@ static int uart_put_char(struct tty_struct *tty, unsigned char c)
         int ret = 0;
 
         circ = &state->xmit;
-        if (!circ->buf)
+        port = uart_port_lock(state, flags);
+        if (!circ->buf) {
+                uart_port_unlock(port, flags);
                 return 0;
+        }
 
-        port = uart_port_lock(state, flags);
         if (port && uart_circ_chars_free(circ) != 0) {
                 circ->buf[circ->head] = c;
                 circ->head = (circ->head + 1) & (UART_XMIT_SIZE - 1);
@@ -586,11 +591,13 @@ static int uart_write(struct tty_struct *tty,
                 return -EL3HLT;
         }
 
+        port = uart_port_lock(state, flags);
         circ = &state->xmit;
-        if (!circ->buf)
+        if (!circ->buf) {
+                uart_port_unlock(port, flags);
                 return 0;
+        }
 
-        port = uart_port_lock(state, flags);
         while (port) {
                 c = CIRC_SPACE_TO_END(circ->head, circ->tail, UART_XMIT_SIZE);
                 if (count < c)
@@ -723,6 +730,9 @@ static void uart_unthrottle(struct tty_struct *tty)
         upstat_t mask = UPSTAT_SYNC_FIFO;
         struct uart_port *port;
 
+        if (!state)
+                return;
+
         port = uart_port_ref(state);
         if (!port)
                 return;
diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c
index 8df0fd824520..64bbeb7d7e0c 100644
--- a/drivers/tty/serial/sh-sci.c
+++ b/drivers/tty/serial/sh-sci.c
@@ -1921,7 +1921,7 @@ out_nomem:
 
 static void sci_free_irq(struct sci_port *port)
 {
-        int i;
+        int i, j;
 
         /*
          * Intentionally in reverse order so we iterate over the muxed
@@ -1937,6 +1937,13 @@ static void sci_free_irq(struct sci_port *port)
                 if (unlikely(irq < 0))
                         continue;
 
+                /* Check if already freed (irq was muxed) */
+                for (j = 0; j < i; j++)
+                        if (port->irqs[j] == irq)
+                                j = i + 1;
+                if (j > i)
+                        continue;
+
                 free_irq(port->irqs[i], port);
                 kfree(port->irqstr[i]);
 
diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
index 23c6fd238422..21ffcce16927 100644
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -2189,7 +2189,8 @@ static int tiocsti(struct tty_struct *tty, char __user *p)
         ld = tty_ldisc_ref_wait(tty);
         if (!ld)
                 return -EIO;
-        ld->ops->receive_buf(tty, &ch, &mbz, 1);
+        if (ld->ops->receive_buf)
+                ld->ops->receive_buf(tty, &ch, &mbz, 1);
         tty_ldisc_deref(ld);
         return 0;
 }
diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
index 41ec8e5010f3..bba75560d11e 100644
--- a/drivers/tty/vt/vt.c
+++ b/drivers/tty/vt/vt.c
@@ -1272,6 +1272,7 @@ static int vc_do_resize(struct tty_struct *tty, struct vc_data *vc,
         if (con_is_visible(vc))
                 update_screen(vc);
         vt_event_post(VT_EVENT_RESIZE, vc->vc_num, vc->vc_num);
+        notify_update(vc);
         return err;
 }
 
@@ -2764,8 +2765,8 @@ rescan_last_byte:
         con_flush(vc, draw_from, draw_to, &draw_x);
         vc_uniscr_debug_check(vc);
         console_conditional_schedule();
-        console_unlock();
         notify_update(vc);
+        console_unlock();
         return n;
 }
 
@@ -2884,8 +2885,7 @@ static void vt_console_print(struct console *co, const char *b, unsigned count)
         unsigned char c;
         static DEFINE_SPINLOCK(printing_lock);
         const ushort *start;
-        ushort cnt = 0;
-        ushort myx;
+        ushort start_x, cnt;
         int kmsg_console;
 
         /* console busy or not yet initialized */
@@ -2898,10 +2898,6 @@ static void vt_console_print(struct console *co, const char *b, unsigned count)
         if (kmsg_console && vc_cons_allocated(kmsg_console - 1))
                 vc = vc_cons[kmsg_console - 1].d;
 
-        /* read `x' only after setting currcons properly (otherwise
-           the `x' macro will read the x of the foreground console). */
-        myx = vc->vc_x;
-
         if (!vc_cons_allocated(fg_console)) {
                 /* impossible */
                 /* printk("vt_console_print: tty %d not allocated ??\n", currcons+1); */
@@ -2916,53 +2912,41 @@ static void vt_console_print(struct console *co, const char *b, unsigned count)
                 hide_cursor(vc);
 
         start = (ushort *)vc->vc_pos;
-
-        /* Contrived structure to try to emulate original need_wrap behaviour
-         * Problems caused when we have need_wrap set on '\n' character */
+        start_x = vc->vc_x;
+        cnt = 0;
         while (count--) {
                 c = *b++;
                 if (c == 10 || c == 13 || c == 8 || vc->vc_need_wrap) {
-                        if (cnt > 0) {
-                                if (con_is_visible(vc))
-                                        vc->vc_sw->con_putcs(vc, start, cnt, vc->vc_y, vc->vc_x);
-                                vc->vc_x += cnt;
-                                if (vc->vc_need_wrap)
-                                        vc->vc_x--;
-                                cnt = 0;
-                        }
+                        if (cnt && con_is_visible(vc))
+                                vc->vc_sw->con_putcs(vc, start, cnt, vc->vc_y, start_x);
+                        cnt = 0;
                         if (c == 8) {           /* backspace */
                                 bs(vc);
                                 start = (ushort *)vc->vc_pos;
-                                myx = vc->vc_x;
+                                start_x = vc->vc_x;
                                 continue;
                         }
                         if (c != 13)
                                 lf(vc);
                         cr(vc);
                         start = (ushort *)vc->vc_pos;
-                        myx = vc->vc_x;
+                        start_x = vc->vc_x;
                         if (c == 10 || c == 13)
                                 continue;
                 }
+                vc_uniscr_putc(vc, c);
                 scr_writew((vc->vc_attr << 8) + c, (unsigned short *)vc->vc_pos);
                 notify_write(vc, c);
                 cnt++;
-                if (myx == vc->vc_cols - 1) {
-                        vc->vc_need_wrap = 1;
-                        continue;
-                }
-                vc->vc_pos += 2;
-                myx++;
-        }
-        if (cnt > 0) {
-                if (con_is_visible(vc))
-                        vc->vc_sw->con_putcs(vc, start, cnt, vc->vc_y, vc->vc_x);
-                vc->vc_x += cnt;
-                if (vc->vc_x == vc->vc_cols) {
-                        vc->vc_x--;
+                if (vc->vc_x == vc->vc_cols - 1) {
                         vc->vc_need_wrap = 1;
+                } else {
+                        vc->vc_pos += 2;
+                        vc->vc_x++;
                 }
         }
+        if (cnt && con_is_visible(vc))
+                vc->vc_sw->con_putcs(vc, start, cnt, vc->vc_y, start_x);
         set_cursor(vc);
         notify_update(vc);
 
diff --git a/drivers/usb/chipidea/ci_hdrc_imx.c b/drivers/usb/chipidea/ci_hdrc_imx.c
index e81de9ca8729..9b45aa422e69 100644
--- a/drivers/usb/chipidea/ci_hdrc_imx.c
+++ b/drivers/usb/chipidea/ci_hdrc_imx.c
@@ -316,7 +316,8 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev)
         if (IS_ERR(data->usbmisc_data))
                 return PTR_ERR(data->usbmisc_data);
 
-        if (of_usb_get_phy_mode(dev->of_node) == USBPHY_INTERFACE_MODE_HSIC) {
+        if ((of_usb_get_phy_mode(dev->of_node) == USBPHY_INTERFACE_MODE_HSIC)
+                && data->usbmisc_data) {
                 pdata.flags |= CI_HDRC_IMX_IS_HSIC;
                 data->usbmisc_data->hsic = 1;
                 data->pinctrl = devm_pinctrl_get(dev);
diff --git a/drivers/usb/core/ledtrig-usbport.c b/drivers/usb/core/ledtrig-usbport.c
index dc7f7fd71684..c12ac56606c3 100644
--- a/drivers/usb/core/ledtrig-usbport.c
+++ b/drivers/usb/core/ledtrig-usbport.c
@@ -119,11 +119,6 @@ static const struct attribute_group ports_group = {
         .attrs = ports_attrs,
 };
 
-static const struct attribute_group *ports_groups[] = {
-        &ports_group,
-        NULL
-};
-
 /***************************************
  * Adding & removing ports
  ***************************************/
@@ -307,6 +302,7 @@ static int usbport_trig_notify(struct notifier_block *nb, unsigned long action,
 static int usbport_trig_activate(struct led_classdev *led_cdev)
 {
         struct usbport_trig_data *usbport_data;
+        int err;
 
         usbport_data = kzalloc(sizeof(*usbport_data), GFP_KERNEL);
         if (!usbport_data)
@@ -315,6 +311,9 @@ static int usbport_trig_activate(struct led_classdev *led_cdev)
 
         /* List of ports */
         INIT_LIST_HEAD(&usbport_data->ports);
+        err = sysfs_create_group(&led_cdev->dev->kobj, &ports_group);
+        if (err)
+                goto err_free;
         usb_for_each_dev(usbport_data, usbport_trig_add_usb_dev_ports);
         usbport_trig_update_count(usbport_data);
 
@@ -322,8 +321,11 @@ static int usbport_trig_activate(struct led_classdev *led_cdev)
         usbport_data->nb.notifier_call = usbport_trig_notify;
         led_set_trigger_data(led_cdev, usbport_data);
         usb_register_notify(&usbport_data->nb);
-
         return 0;
+
+err_free:
+        kfree(usbport_data);
+        return err;
 }
 
 static void usbport_trig_deactivate(struct led_classdev *led_cdev)
@@ -335,6 +337,8 @@ static void usbport_trig_deactivate(struct led_classdev *led_cdev)
                 usbport_trig_remove_port(usbport_data, port);
         }
 
+        sysfs_remove_group(&led_cdev->dev->kobj, &ports_group);
+
         usb_unregister_notify(&usbport_data->nb);
 
         kfree(usbport_data);
@@ -344,7 +348,6 @@ static struct led_trigger usbport_led_trigger = {
         .name     = "usbport",
         .activate = usbport_trig_activate,
         .deactivate = usbport_trig_deactivate,
-        .groups = ports_groups,
 };
 
 static int __init usbport_trig_init(void)
diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
index 68ad75a7460d..55ef3cc2701b 100644
--- a/drivers/usb/dwc2/gadget.c
+++ b/drivers/usb/dwc2/gadget.c
@@ -261,7 +261,7 @@ static void dwc2_gadget_wkup_alert_handler(struct dwc2_hsotg *hsotg)
 
         if (gintsts2 & GINTSTS2_WKUP_ALERT_INT) {
                 dev_dbg(hsotg->dev, "%s: Wkup_Alert_Int\n", __func__);
-                dwc2_clear_bit(hsotg, GINTSTS2, GINTSTS2_WKUP_ALERT_INT);
+                dwc2_set_bit(hsotg, GINTSTS2, GINTSTS2_WKUP_ALERT_INT);
                 dwc2_set_bit(hsotg, DCTL, DCTL_RMTWKUPSIG);
         }
 }
diff --git a/drivers/usb/dwc3/dwc3-exynos.c b/drivers/usb/dwc3/dwc3-exynos.c
index cb7fcd7c0ad8..c1e9ea621f41 100644
--- a/drivers/usb/dwc3/dwc3-exynos.c
+++ b/drivers/usb/dwc3/dwc3-exynos.c
@@ -78,7 +78,7 @@ static int dwc3_exynos_probe(struct platform_device *pdev)
         for (i = 0; i < exynos->num_clks; i++) {
                 ret = clk_prepare_enable(exynos->clks[i]);
                 if (ret) {
-                        while (--i > 0)
+                        while (i-- > 0)
                                 clk_disable_unprepare(exynos->clks[i]);
                         return ret;
                 }
@@ -223,7 +223,7 @@ static int dwc3_exynos_resume(struct device *dev)
         for (i = 0; i < exynos->num_clks; i++) {
                 ret = clk_prepare_enable(exynos->clks[i]);
                 if (ret) {
-                        while (--i > 0)
+                        while (i-- > 0)
                                 clk_disable_unprepare(exynos->clks[i]);
                         return ret;
                 }
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 07bd31bb2f8a..6c9b76bcc2e1 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -177,6 +177,7 @@ static void dwc3_gadget_del_and_unmap_request(struct dwc3_ep *dep,
         req->started = false;
         list_del(&req->list);
         req->remaining = 0;
+        req->needs_extra_trb = false;
 
         if (req->request.status == -EINPROGRESS)
                 req->request.status = status;
@@ -1118,7 +1119,7 @@ static void dwc3_prepare_one_trb_linear(struct dwc3_ep *dep,
         unsigned int maxp = usb_endpoint_maxp(dep->endpoint.desc);
         unsigned int rem = length % maxp;
 
-        if (rem && usb_endpoint_dir_out(dep->endpoint.desc)) {
+        if ((!length || rem) && usb_endpoint_dir_out(dep->endpoint.desc)) {
                 struct dwc3     *dwc = dep->dwc;
                 struct dwc3_trb *trb;
 
@@ -1984,6 +1985,7 @@ static int __dwc3_gadget_start(struct dwc3 *dwc)
 
         /* begin to receive SETUP packets */
         dwc->ep0state = EP0_SETUP_PHASE;
+        dwc->link_state = DWC3_LINK_STATE_SS_DIS;
         dwc3_ep0_out_start(dwc);
 
         dwc3_gadget_enable_irq(dwc);
@@ -3379,6 +3381,8 @@ int dwc3_gadget_suspend(struct dwc3 *dwc)
         dwc3_disconnect_gadget(dwc);
         __dwc3_gadget_stop(dwc);
 
+        synchronize_irq(dwc->irq_gadget);
+
         return 0;
 }
 
diff --git a/drivers/usb/gadget/function/f_sourcesink.c b/drivers/usb/gadget/function/f_sourcesink.c
index 9cdef108fb1b..ed68a4860b7d 100644
--- a/drivers/usb/gadget/function/f_sourcesink.c
+++ b/drivers/usb/gadget/function/f_sourcesink.c
@@ -838,7 +838,7 @@ static struct usb_function *source_sink_alloc_func(
 
         ss = kzalloc(sizeof(*ss), GFP_KERNEL);
         if (!ss)
-                return NULL;
+                return ERR_PTR(-ENOMEM);
 
         ss_opts =  container_of(fi, struct f_ss_opts, func_inst);
 
diff --git a/drivers/usb/gadget/udc/net2272.c b/drivers/usb/gadget/udc/net2272.c
index 660878a19505..b77f3126580e 100644
--- a/drivers/usb/gadget/udc/net2272.c
+++ b/drivers/usb/gadget/udc/net2272.c
@@ -2083,7 +2083,7 @@ static irqreturn_t net2272_irq(int irq, void *_dev)
 #if defined(PLX_PCI_RDK2)
         /* see if PCI int for us by checking irqstat */
         intcsr = readl(dev->rdk2.fpga_base_addr + RDK2_IRQSTAT);
-        if (!intcsr & (1 << NET2272_PCI_IRQ)) {
+        if (!(intcsr & (1 << NET2272_PCI_IRQ))) {
                 spin_unlock(&dev->lock);
                 return IRQ_NONE;
         }
diff --git a/drivers/usb/host/ehci-mv.c b/drivers/usb/host/ehci-mv.c
index f26109eafdbf..66ec1fdf9fe7 100644
--- a/drivers/usb/host/ehci-mv.c
+++ b/drivers/usb/host/ehci-mv.c
@@ -302,3 +302,4 @@ MODULE_AUTHOR("Chao Xie <chao.xie@marvell.com>");
 MODULE_AUTHOR("Neil Zhang <zhangwm@marvell.com>");
 MODULE_ALIAS("mv-ehci");
 MODULE_LICENSE("GPL");
+MODULE_DEVICE_TABLE(of, ehci_mv_dt_ids);
diff --git a/drivers/usb/musb/musb_gadget.c b/drivers/usb/musb/musb_gadget.c
index eae8b1b1b45b..ffe462a657b1 100644
--- a/drivers/usb/musb/musb_gadget.c
+++ b/drivers/usb/musb/musb_gadget.c
@@ -452,13 +452,10 @@ void musb_g_tx(struct musb *musb, u8 epnum)
         }
 
         if (request) {
-                u8      is_dma = 0;
-                bool    short_packet = false;
 
                 trace_musb_req_tx(req);
 
                 if (dma && (csr & MUSB_TXCSR_DMAENAB)) {
-                        is_dma = 1;
                         csr |= MUSB_TXCSR_P_WZC_BITS;
                         csr &= ~(MUSB_TXCSR_DMAENAB | MUSB_TXCSR_P_UNDERRUN |
                                  MUSB_TXCSR_TXPKTRDY | MUSB_TXCSR_AUTOSET);
@@ -476,16 +473,8 @@ void musb_g_tx(struct musb *musb, u8 epnum)
                  */
                 if ((request->zero && request->length)
                         && (request->length % musb_ep->packet_sz == 0)
-                        && (request->actual == request->length))
-                                short_packet = true;
+                        && (request->actual == request->length)) {
 
-                if ((musb_dma_inventra(musb) || musb_dma_ux500(musb)) &&
-                        (is_dma && (!dma->desired_mode ||
-                                (request->actual &
-                                        (musb_ep->packet_sz - 1)))))
-                                short_packet = true;
-
-                if (short_packet) {
                         /*
                          * On DMA completion, FIFO may not be
                          * available yet...
diff --git a/drivers/usb/musb/musbhsdma.c b/drivers/usb/musb/musbhsdma.c
index a688f7f87829..5fc6825745f2 100644
--- a/drivers/usb/musb/musbhsdma.c
+++ b/drivers/usb/musb/musbhsdma.c
@@ -346,12 +346,10 @@ static irqreturn_t dma_controller_irq(int irq, void *private_data)
                                 channel->status = MUSB_DMA_STATUS_FREE;
 
                                 /* completed */
-                                if ((devctl & MUSB_DEVCTL_HM)
-                                        && (musb_channel->transmit)
-                                        && ((channel->desired_mode == 0)
-                                            || (channel->actual_len &
-                                            (musb_channel->max_packet_sz - 1)))
-                                    ) {
+                                if (musb_channel->transmit &&
+                                        (!channel->desired_mode ||
+                                        (channel->actual_len %
+                                            musb_channel->max_packet_sz))) {
                                         u8  epnum  = musb_channel->epnum;
                                         int offset = musb->io.ep_offset(epnum,
                                                                     MUSB_TXCSR);
@@ -363,11 +361,14 @@ static irqreturn_t dma_controller_irq(int irq, void *private_data)
                                          */
                                         musb_ep_select(mbase, epnum);
                                         txcsr = musb_readw(mbase, offset);
-                                        txcsr &= ~(MUSB_TXCSR_DMAENAB
+                                        if (channel->desired_mode == 1) {
+                                                txcsr &= ~(MUSB_TXCSR_DMAENAB
                                                         | MUSB_TXCSR_AUTOSET);
-                                        musb_writew(mbase, offset, txcsr);
-                                        /* Send out the packet */
-                                        txcsr &= ~MUSB_TXCSR_DMAMODE;
+                                                musb_writew(mbase, offset, txcsr);
+                                                /* Send out the packet */
+                                                txcsr &= ~MUSB_TXCSR_DMAMODE;
+                                                txcsr |= MUSB_TXCSR_DMAENAB;
+                                        }
                                         txcsr |=  MUSB_TXCSR_TXPKTRDY;
                                         musb_writew(mbase, offset, txcsr);
                                 }
diff --git a/drivers/usb/phy/Kconfig b/drivers/usb/phy/Kconfig
index d7312eed6088..91ea3083e7ad 100644
--- a/drivers/usb/phy/Kconfig
+++ b/drivers/usb/phy/Kconfig
@@ -21,7 +21,7 @@ config AB8500_USB
 
 config FSL_USB2_OTG
         bool "Freescale USB OTG Transceiver Driver"
-        depends on USB_EHCI_FSL && USB_FSL_USB2 && USB_OTG_FSM && PM
+        depends on USB_EHCI_FSL && USB_FSL_USB2 && USB_OTG_FSM=y && PM
         depends on USB_GADGET || !USB_GADGET # if USB_GADGET=m, this can't be 'y'
         select USB_PHY
         help
diff --git a/drivers/usb/phy/phy-am335x.c b/drivers/usb/phy/phy-am335x.c
index 27bdb7222527..f5f0568d8533 100644
--- a/drivers/usb/phy/phy-am335x.c
+++ b/drivers/usb/phy/phy-am335x.c
@@ -61,9 +61,6 @@ static int am335x_phy_probe(struct platform_device *pdev)
         if (ret)
                 return ret;
 
-        ret = usb_add_phy_dev(&am_phy->usb_phy_gen.phy);
-        if (ret)
-                return ret;
         am_phy->usb_phy_gen.phy.init = am335x_init;
         am_phy->usb_phy_gen.phy.shutdown = am335x_shutdown;
 
@@ -82,7 +79,7 @@ static int am335x_phy_probe(struct platform_device *pdev)
         device_set_wakeup_enable(dev, false);
         phy_ctrl_power(am_phy->phy_ctrl, am_phy->id, am_phy->dr_mode, false);
 
-        return 0;
+        return usb_add_phy_dev(&am_phy->usb_phy_gen.phy);
 }
 
 static int am335x_phy_remove(struct platform_device *pdev)
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 1ab2a6191013..77ef4c481f3c 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -1783,6 +1783,10 @@ static int ftdi_set_bitmode(struct usb_serial_port *port, u8 mode)
         int result;
         u16 val;
 
+        result = usb_autopm_get_interface(serial->interface);
+        if (result)
+                return result;
+
         val = (mode << 8) | (priv->gpio_output << 4) | priv->gpio_value;
         result = usb_control_msg(serial->dev,
                                  usb_sndctrlpipe(serial->dev, 0),
@@ -1795,6 +1799,8 @@ static int ftdi_set_bitmode(struct usb_serial_port *port, u8 mode)
                         val, result);
         }
 
+        usb_autopm_put_interface(serial->interface);
+
         return result;
 }
 
@@ -1846,9 +1852,15 @@ static int ftdi_read_cbus_pins(struct usb_serial_port *port)
         unsigned char *buf;
         int result;
 
+        result = usb_autopm_get_interface(serial->interface);
+        if (result)
+                return result;
+
         buf = kmalloc(1, GFP_KERNEL);
-        if (!buf)
+        if (!buf) {
+                usb_autopm_put_interface(serial->interface);
                 return -ENOMEM;
+        }
 
         result = usb_control_msg(serial->dev,
                                  usb_rcvctrlpipe(serial->dev, 0),
@@ -1863,6 +1875,7 @@ static int ftdi_read_cbus_pins(struct usb_serial_port *port)
         }
 
         kfree(buf);
+        usb_autopm_put_interface(serial->interface);
 
         return result;
 }
diff --git a/drivers/usb/serial/keyspan_usa26msg.h b/drivers/usb/serial/keyspan_usa26msg.h
index 09e21e84fc4e..a68f1fb25b8a 100644
--- a/drivers/usb/serial/keyspan_usa26msg.h
+++ b/drivers/usb/serial/keyspan_usa26msg.h
@@ -1,3 +1,4 @@
+/* SPDX-License-Identifier: BSD-3-Clause */
 /*
         usa26msg.h
 
diff --git a/drivers/usb/serial/keyspan_usa28msg.h b/drivers/usb/serial/keyspan_usa28msg.h
index dee454c4609a..a19f3fe5d98d 100644
--- a/drivers/usb/serial/keyspan_usa28msg.h
+++ b/drivers/usb/serial/keyspan_usa28msg.h
@@ -1,3 +1,4 @@
+/* SPDX-License-Identifier: BSD-3-Clause */
 /*
         usa28msg.h
 
diff --git a/drivers/usb/serial/keyspan_usa49msg.h b/drivers/usb/serial/keyspan_usa49msg.h
index 163b2dea2ec5..8c3970fdd868 100644
--- a/drivers/usb/serial/keyspan_usa49msg.h
+++ b/drivers/usb/serial/keyspan_usa49msg.h
@@ -1,3 +1,4 @@
+/* SPDX-License-Identifier: BSD-3-Clause */
 /*
         usa49msg.h
 
diff --git a/drivers/usb/serial/keyspan_usa67msg.h b/drivers/usb/serial/keyspan_usa67msg.h
index 20fa3e2f7187..dcf502fdbb44 100644
--- a/drivers/usb/serial/keyspan_usa67msg.h
+++ b/drivers/usb/serial/keyspan_usa67msg.h
@@ -1,3 +1,4 @@
+/* SPDX-License-Identifier: BSD-3-Clause */
 /*
         usa67msg.h
 
diff --git a/drivers/usb/serial/keyspan_usa90msg.h b/drivers/usb/serial/keyspan_usa90msg.h
index 86708ecd8735..c4ca0f631d20 100644
--- a/drivers/usb/serial/keyspan_usa90msg.h
+++ b/drivers/usb/serial/keyspan_usa90msg.h
@@ -1,3 +1,4 @@
+/* SPDX-License-Identifier: BSD-3-Clause */
 /*
         usa90msg.h
 
diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
index 98e7a5df0f6d..bb3f9aa4a909 100644
--- a/drivers/usb/serial/pl2303.c
+++ b/drivers/usb/serial/pl2303.c
@@ -46,6 +46,7 @@ static const struct usb_device_id id_table[] = {
         { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_HCR331) },
         { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_MOTOROLA) },
         { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_ZTEK) },
+        { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_TB) },
         { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID) },
         { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID_RSAQ5) },
         { USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_ID),
diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h
index 4e2554d55362..559941ca884d 100644
--- a/drivers/usb/serial/pl2303.h
+++ b/drivers/usb/serial/pl2303.h
@@ -8,6 +8,7 @@
 
 #define PL2303_VENDOR_ID        0x067b
 #define PL2303_PRODUCT_ID       0x2303
+#define PL2303_PRODUCT_ID_TB            0x2304
 #define PL2303_PRODUCT_ID_RSAQ2         0x04bb
 #define PL2303_PRODUCT_ID_DCU11         0x1234
 #define PL2303_PRODUCT_ID_PHAROS        0xaaa0
@@ -20,6 +21,7 @@
 #define PL2303_PRODUCT_ID_MOTOROLA      0x0307
 #define PL2303_PRODUCT_ID_ZTEK          0xe1f1
 
+
 #define ATEN_VENDOR_ID          0x0557
 #define ATEN_VENDOR_ID2         0x0547
 #define ATEN_PRODUCT_ID         0x2008
diff --git a/drivers/usb/serial/usb-serial-simple.c b/drivers/usb/serial/usb-serial-simple.c
index 4d0273508043..edbbb13d6de6 100644
--- a/drivers/usb/serial/usb-serial-simple.c
+++ b/drivers/usb/serial/usb-serial-simple.c
@@ -85,7 +85,8 @@ DEVICE(moto_modem, MOTO_IDS);
 /* Motorola Tetra driver */
 #define MOTOROLA_TETRA_IDS()                    \
         { USB_DEVICE(0x0cad, 0x9011) }, /* Motorola Solutions TETRA PEI */ \
-        { USB_DEVICE(0x0cad, 0x9012) }  /* MTP6550 */
+        { USB_DEVICE(0x0cad, 0x9012) }, /* MTP6550 */ \
+        { USB_DEVICE(0x0cad, 0x9016) }  /* TPG2200 */
 DEVICE(motorola_tetra, MOTOROLA_TETRA_IDS);
 
 /* Novatel Wireless GPS driver */
diff --git a/drivers/usb/typec/tcpm/tcpm.c b/drivers/usb/typec/tcpm/tcpm.c
index 4bc29b586698..f1c39a3c7534 100644
--- a/drivers/usb/typec/tcpm/tcpm.c
+++ b/drivers/usb/typec/tcpm/tcpm.c
@@ -2297,7 +2297,8 @@ static unsigned int tcpm_pd_select_pps_apdo(struct tcpm_port *port)
                                               pdo_pps_apdo_max_voltage(snk));
                 port->pps_data.max_curr = min_pps_apdo_current(src, snk);
                 port->pps_data.out_volt = min(port->pps_data.max_volt,
-                                              port->pps_data.out_volt);
+                                              max(port->pps_data.min_volt,
+                                                  port->pps_data.out_volt));
                 port->pps_data.op_curr = min(port->pps_data.max_curr,
                                              port->pps_data.op_curr);
         }
diff --git a/drivers/usb/usbip/README b/drivers/usb/usbip/README
deleted file mode 100644
index 41a2cf2e77a6..000000000000
--- a/drivers/usb/usbip/README
+++ /dev/null
@@ -1,7 +0,0 @@
-TODO:
-        - more discussion about the protocol
-        - testing
-        - review of the userspace interface
-        - document the protocol
-
-Please send patches for this code to Greg Kroah-Hartman <greg@kroah.com>
diff --git a/drivers/vfio/pci/trace.h b/drivers/vfio/pci/trace.h
index 4d13e510590e..b2aa986ab9ed 100644
--- a/drivers/vfio/pci/trace.h
+++ b/drivers/vfio/pci/trace.h
@@ -1,13 +1,9 @@
-/* SPDX-License-Identifier: GPL-2.0+ */
+/* SPDX-License-Identifier: GPL-2.0-only */
 /*
  * VFIO PCI mmap/mmap_fault tracepoints
  *
  * Copyright (C) 2018 IBM Corp.  All rights reserved.
  *     Author: Alexey Kardashevskiy <aik@ozlabs.ru>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
  */
 
 #undef TRACE_SYSTEM
diff --git a/drivers/vfio/pci/vfio_pci_nvlink2.c b/drivers/vfio/pci/vfio_pci_nvlink2.c
index 054a2cf9dd8e..32f695ffe128 100644
--- a/drivers/vfio/pci/vfio_pci_nvlink2.c
+++ b/drivers/vfio/pci/vfio_pci_nvlink2.c
@@ -1,14 +1,10 @@
-// SPDX-License-Identifier: GPL-2.0+
+// SPDX-License-Identifier: GPL-2.0-only
 /*
  * VFIO PCI NVIDIA Whitherspoon GPU support a.k.a. NVLink2.
  *
  * Copyright (C) 2018 IBM Corp.  All rights reserved.
  *     Author: Alexey Kardashevskiy <aik@ozlabs.ru>
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- *
  * Register an on-GPU RAM region for cacheable access.
  *
  * Derived from original vfio_pci_igd.c:
@@ -178,11 +174,11 @@ static int vfio_pci_nvgpu_add_capability(struct vfio_pci_device *vdev,
                 struct vfio_pci_region *region, struct vfio_info_cap *caps)
 {
         struct vfio_pci_nvgpu_data *data = region->data;
-        struct vfio_region_info_cap_nvlink2_ssatgt cap = { 0 };
-
-        cap.header.id = VFIO_REGION_INFO_CAP_NVLINK2_SSATGT;
-        cap.header.version = 1;
-        cap.tgt = data->gpu_tgt;
+        struct vfio_region_info_cap_nvlink2_ssatgt cap = {
+                .header.id = VFIO_REGION_INFO_CAP_NVLINK2_SSATGT,
+                .header.version = 1,
+                .tgt = data->gpu_tgt
+        };
 
         return vfio_info_add_capability(caps, &cap.header, sizeof(cap));
 }
@@ -365,18 +361,18 @@ static int vfio_pci_npu2_add_capability(struct vfio_pci_device *vdev,
                 struct vfio_pci_region *region, struct vfio_info_cap *caps)
 {
         struct vfio_pci_npu2_data *data = region->data;
-        struct vfio_region_info_cap_nvlink2_ssatgt captgt = { 0 };
-        struct vfio_region_info_cap_nvlink2_lnkspd capspd = { 0 };
+        struct vfio_region_info_cap_nvlink2_ssatgt captgt = {
+                .header.id = VFIO_REGION_INFO_CAP_NVLINK2_SSATGT,
+                .header.version = 1,
+                .tgt = data->gpu_tgt
+        };
+        struct vfio_region_info_cap_nvlink2_lnkspd capspd = {
+                .header.id = VFIO_REGION_INFO_CAP_NVLINK2_LNKSPD,
+                .header.version = 1,
+                .link_speed = data->link_speed
+        };
         int ret;
 
-        captgt.header.id = VFIO_REGION_INFO_CAP_NVLINK2_SSATGT;
-        captgt.header.version = 1;
-        captgt.tgt = data->gpu_tgt;
-
-        capspd.header.id = VFIO_REGION_INFO_CAP_NVLINK2_LNKSPD;
-        capspd.header.version = 1;
-        capspd.link_speed = data->link_speed;
-
         ret = vfio_info_add_capability(caps, &captgt.header, sizeof(captgt));
         if (ret)
                 return ret;
diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
index bca86bf7189f..df51a35cf537 100644
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -1337,7 +1337,8 @@ static int vhost_net_open(struct inode *inode, struct file *f)
                 n->vqs[i].rx_ring = NULL;
                 vhost_net_buf_init(&n->vqs[i].rxq);
         }
-        vhost_dev_init(dev, vqs, VHOST_NET_VQ_MAX);
+        vhost_dev_init(dev, vqs, VHOST_NET_VQ_MAX,
+                       UIO_MAXIOV + VHOST_NET_BATCH);
 
         vhost_poll_init(n->poll + VHOST_NET_VQ_TX, handle_tx_net, EPOLLOUT, dev);
         vhost_poll_init(n->poll + VHOST_NET_VQ_RX, handle_rx_net, EPOLLIN, dev);
diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
index 344684f3e2e4..23593cb23dd0 100644
--- a/drivers/vhost/scsi.c
+++ b/drivers/vhost/scsi.c
@@ -1627,7 +1627,7 @@ static int vhost_scsi_open(struct inode *inode, struct file *f)
                 vqs[i] = &vs->vqs[i].vq;
                 vs->vqs[i].vq.handle_kick = vhost_scsi_handle_kick;
         }
-        vhost_dev_init(&vs->dev, vqs, VHOST_SCSI_MAX_VQ);
+        vhost_dev_init(&vs->dev, vqs, VHOST_SCSI_MAX_VQ, UIO_MAXIOV);
 
         vhost_scsi_init_inflight(vs, NULL);
 
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index 15a216cdd507..24a129fcdd61 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -390,9 +390,9 @@ static long vhost_dev_alloc_iovecs(struct vhost_dev *dev)
                 vq->indirect = kmalloc_array(UIO_MAXIOV,
                                              sizeof(*vq->indirect),
                                              GFP_KERNEL);
-                vq->log = kmalloc_array(UIO_MAXIOV, sizeof(*vq->log),
+                vq->log = kmalloc_array(dev->iov_limit, sizeof(*vq->log),
                                         GFP_KERNEL);
-                vq->heads = kmalloc_array(UIO_MAXIOV, sizeof(*vq->heads),
+                vq->heads = kmalloc_array(dev->iov_limit, sizeof(*vq->heads),
                                           GFP_KERNEL);
                 if (!vq->indirect || !vq->log || !vq->heads)
                         goto err_nomem;
@@ -414,7 +414,7 @@ static void vhost_dev_free_iovecs(struct vhost_dev *dev)
 }
 
 void vhost_dev_init(struct vhost_dev *dev,
-                    struct vhost_virtqueue **vqs, int nvqs)
+                    struct vhost_virtqueue **vqs, int nvqs, int iov_limit)
 {
         struct vhost_virtqueue *vq;
         int i;
@@ -427,6 +427,7 @@ void vhost_dev_init(struct vhost_dev *dev,
         dev->iotlb = NULL;
         dev->mm = NULL;
         dev->worker = NULL;
+        dev->iov_limit = iov_limit;
         init_llist_head(&dev->work_list);
         init_waitqueue_head(&dev->wait);
         INIT_LIST_HEAD(&dev->read_list);
diff --git a/drivers/vhost/vhost.h b/drivers/vhost/vhost.h
index 1b675dad5e05..9490e7ddb340 100644
--- a/drivers/vhost/vhost.h
+++ b/drivers/vhost/vhost.h
@@ -170,9 +170,11 @@ struct vhost_dev {
         struct list_head read_list;
         struct list_head pending_list;
         wait_queue_head_t wait;
+        int iov_limit;
 };
 
-void vhost_dev_init(struct vhost_dev *, struct vhost_virtqueue **vqs, int nvqs);
+void vhost_dev_init(struct vhost_dev *, struct vhost_virtqueue **vqs,
+                    int nvqs, int iov_limit);
 long vhost_dev_set_owner(struct vhost_dev *dev);
 bool vhost_dev_has_owner(struct vhost_dev *dev);
 long vhost_dev_check_owner(struct vhost_dev *);
diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c
index 3fbc068eaa9b..bb5fc0e9fbc2 100644
--- a/drivers/vhost/vsock.c
+++ b/drivers/vhost/vsock.c
@@ -531,7 +531,7 @@ static int vhost_vsock_dev_open(struct inode *inode, struct file *file)
         vsock->vqs[VSOCK_VQ_TX].handle_kick = vhost_vsock_handle_tx_kick;
         vsock->vqs[VSOCK_VQ_RX].handle_kick = vhost_vsock_handle_rx_kick;
 
-        vhost_dev_init(&vsock->dev, vqs, ARRAY_SIZE(vsock->vqs));
+        vhost_dev_init(&vsock->dev, vqs, ARRAY_SIZE(vsock->vqs), UIO_MAXIOV);
 
         file->private_data = vsock;
         spin_lock_init(&vsock->send_pkt_list_lock);
diff --git a/drivers/video/console/vgacon.c b/drivers/video/console/vgacon.c
index 09731b2f6815..c6b3bdbbdbc9 100644
--- a/drivers/video/console/vgacon.c
+++ b/drivers/video/console/vgacon.c
@@ -271,6 +271,7 @@ static void vgacon_scrollback_update(struct vc_data *c, int t, int count)
 
 static void vgacon_restore_screen(struct vc_data *c)
 {
+        c->vc_origin = c->vc_visible_origin;
         vgacon_scrollback_cur->save = 0;
 
         if (!vga_is_gfx && !vgacon_scrollback_cur->restore) {
@@ -287,8 +288,7 @@ static void vgacon_scrolldelta(struct vc_data *c, int lines)
         int start, end, count, soff;
 
         if (!lines) {
-                c->vc_visible_origin = c->vc_origin;
-                vga_set_mem_top(c);
+                vgacon_restore_screen(c);
                 return;
         }
 
@@ -298,6 +298,7 @@ static void vgacon_scrolldelta(struct vc_data *c, int lines)
         if (!vgacon_scrollback_cur->save) {
                 vgacon_cursor(c, CM_ERASE);
                 vgacon_save_screen(c);
+                c->vc_origin = (unsigned long)c->vc_screenbuf;
                 vgacon_scrollback_cur->save = 1;
         }
 
@@ -335,7 +336,7 @@ static void vgacon_scrolldelta(struct vc_data *c, int lines)
                 int copysize;
 
                 int diff = c->vc_rows - count;
-                void *d = (void *) c->vc_origin;
+                void *d = (void *) c->vc_visible_origin;
                 void *s = (void *) c->vc_screenbuf;
 
                 count *= c->vc_size_row;
diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
index cd7e755484e3..a0b07c331255 100644
--- a/drivers/virtio/virtio_ring.c
+++ b/drivers/virtio/virtio_ring.c
@@ -152,7 +152,12 @@ struct vring_virtqueue {
                 /* Available for packed ring */
                 struct {
                         /* Actual memory layout for this queue. */
-                        struct vring_packed vring;
+                        struct {
+                                unsigned int num;
+                                struct vring_packed_desc *desc;
+                                struct vring_packed_desc_event *driver;
+                                struct vring_packed_desc_event *device;
+                        } vring;
 
                         /* Driver ring wrap counter. */
                         bool avail_wrap_counter;
@@ -1609,6 +1614,9 @@ static struct virtqueue *vring_create_virtqueue_packed(
                 !context;
         vq->event = virtio_has_feature(vdev, VIRTIO_RING_F_EVENT_IDX);
 
+        if (virtio_has_feature(vdev, VIRTIO_F_ORDER_PLATFORM))
+                vq->weak_barriers = false;
+
         vq->packed.ring_dma_addr = ring_dma_addr;
         vq->packed.driver_event_dma_addr = driver_event_dma_addr;
         vq->packed.device_event_dma_addr = device_event_dma_addr;
@@ -2079,6 +2087,9 @@ struct virtqueue *__vring_new_virtqueue(unsigned int index,
                 !context;
         vq->event = virtio_has_feature(vdev, VIRTIO_RING_F_EVENT_IDX);
 
+        if (virtio_has_feature(vdev, VIRTIO_F_ORDER_PLATFORM))
+                vq->weak_barriers = false;
+
         vq->split.queue_dma_addr = 0;
         vq->split.queue_size_in_bytes = 0;
 
@@ -2213,6 +2224,8 @@ void vring_transport_features(struct virtio_device *vdev)
                         break;
                 case VIRTIO_F_RING_PACKED:
                         break;
+                case VIRTIO_F_ORDER_PLATFORM:
+                        break;
                 default:
                         /* We don't understand this bit. */
                         __virtio_clear_bit(vdev, i);
diff --git a/drivers/xen/swiotlb-xen.c b/drivers/xen/swiotlb-xen.c
index 989cf872b98c..bb7888429be6 100644
--- a/drivers/xen/swiotlb-xen.c
+++ b/drivers/xen/swiotlb-xen.c
@@ -645,7 +645,7 @@ xen_swiotlb_dma_mmap(struct device *dev, struct vm_area_struct *vma,
                      void *cpu_addr, dma_addr_t dma_addr, size_t size,
                      unsigned long attrs)
 {
-#if defined(CONFIG_ARM) || defined(CONFIG_ARM64)
+#ifdef CONFIG_ARM
         if (xen_get_dma_ops(dev)->mmap)
                 return xen_get_dma_ops(dev)->mmap(dev, vma, cpu_addr,
                                                     dma_addr, size, attrs);
@@ -662,7 +662,7 @@ xen_swiotlb_get_sgtable(struct device *dev, struct sg_table *sgt,
                         void *cpu_addr, dma_addr_t handle, size_t size,
                         unsigned long attrs)
 {
-#if defined(CONFIG_ARM) || defined(CONFIG_ARM64)
+#ifdef CONFIG_ARM
         if (xen_get_dma_ops(dev)->get_sgtable) {
 #if 0
         /*