633 files changed, 6537 insertions, 3916 deletions

diff --git a/drivers/acpi/acpica/tbutils.c b/drivers/acpi/acpica/tbutils.c
index 5a968a78652b..0d2e98920069 100644
--- a/drivers/acpi/acpica/tbutils.c
+++ b/drivers/acpi/acpica/tbutils.c
@@ -416,13 +416,18 @@ acpi_tb_get_table(struct acpi_table_desc *table_desc,
                 }
         }
 
-        table_desc->validation_count++;
-        if (table_desc->validation_count == 0) {
-                ACPI_ERROR((AE_INFO,
-                            "Table %p, Validation count is zero after increment\n",
-                            table_desc));
-                table_desc->validation_count--;
-                return_ACPI_STATUS(AE_LIMIT);
+        if (table_desc->validation_count < ACPI_MAX_TABLE_VALIDATIONS) {
+                table_desc->validation_count++;
+
+                /*
+                 * Detect validation_count overflows to ensure that the warning
+                 * message will only be printed once.
+                 */
+                if (table_desc->validation_count >= ACPI_MAX_TABLE_VALIDATIONS) {
+                        ACPI_WARNING((AE_INFO,
+                                      "Table %p, Validation count overflows\n",
+                                      table_desc));
+                }
         }
 
         *out_table = table_desc->pointer;
@@ -449,13 +454,20 @@ void acpi_tb_put_table(struct acpi_table_desc *table_desc)
 
         ACPI_FUNCTION_TRACE(acpi_tb_put_table);
 
-        if (table_desc->validation_count == 0) {
-                ACPI_WARNING((AE_INFO,
-                              "Table %p, Validation count is zero before decrement\n",
-                              table_desc));
-                return_VOID;
+        if (table_desc->validation_count < ACPI_MAX_TABLE_VALIDATIONS) {
+                table_desc->validation_count--;
+
+                /*
+                 * Detect validation_count underflows to ensure that the warning
+                 * message will only be printed once.
+                 */
+                if (table_desc->validation_count >= ACPI_MAX_TABLE_VALIDATIONS) {
+                        ACPI_WARNING((AE_INFO,
+                                      "Table %p, Validation count underflows\n",
+                                      table_desc));
+                        return_VOID;
+                }
         }
-        table_desc->validation_count--;
 
         if (table_desc->validation_count == 0) {
 
diff --git a/drivers/acpi/acpica/utresrc.c b/drivers/acpi/acpica/utresrc.c
index e0587c85bafd..ff096d9755b9 100644
--- a/drivers/acpi/acpica/utresrc.c
+++ b/drivers/acpi/acpica/utresrc.c
@@ -474,15 +474,6 @@ acpi_ut_walk_aml_resources(struct acpi_walk_state *walk_state,
                                 return_ACPI_STATUS(AE_AML_NO_RESOURCE_END_TAG);
                         }
 
-                        /*
-                         * The end_tag opcode must be followed by a zero byte.
-                         * Although this byte is technically defined to be a checksum,
-                         * in practice, all ASL compilers set this byte to zero.
-                         */
-                        if (*(aml + 1) != 0) {
-                                return_ACPI_STATUS(AE_AML_NO_RESOURCE_END_TAG);
-                        }
-
                         /* Return the pointer to the end_tag if requested */
 
                         if (!user_function) {
diff --git a/drivers/acpi/arm64/iort.c b/drivers/acpi/arm64/iort.c
index c5fecf97ee2f..797b28dc7b34 100644
--- a/drivers/acpi/arm64/iort.c
+++ b/drivers/acpi/arm64/iort.c
@@ -666,14 +666,6 @@ static const struct iommu_ops *iort_iommu_xlate(struct device *dev,
         int ret = -ENODEV;
         struct fwnode_handle *iort_fwnode;
 
-        /*
-         * If we already translated the fwspec there
-         * is nothing left to do, return the iommu_ops.
-         */
-        ops = iort_fwspec_iommu_ops(dev->iommu_fwspec);
-        if (ops)
-                return ops;
-
         if (node) {
                 iort_fwnode = iort_get_fwnode(node);
                 if (!iort_fwnode)
@@ -735,6 +727,14 @@ const struct iommu_ops *iort_iommu_configure(struct device *dev)
         u32 streamid = 0;
         int err;
 
+        /*
+         * If we already translated the fwspec there
+         * is nothing left to do, return the iommu_ops.
+         */
+        ops = iort_fwspec_iommu_ops(dev->iommu_fwspec);
+        if (ops)
+                return ops;
+
         if (dev_is_pci(dev)) {
                 struct pci_bus *bus = to_pci_dev(dev)->bus;
                 u32 rid;
@@ -782,6 +782,12 @@ const struct iommu_ops *iort_iommu_configure(struct device *dev)
         if (err)
                 ops = ERR_PTR(err);
 
+        /* Ignore all other errors apart from EPROBE_DEFER */
+        if (IS_ERR(ops) && (PTR_ERR(ops) != -EPROBE_DEFER)) {
+                dev_dbg(dev, "Adding to IOMMU failed: %ld\n", PTR_ERR(ops));
+                ops = NULL;
+        }
+
         return ops;
 }
 
diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
index a9a9ab3399d4..d42eeef9d928 100644
--- a/drivers/acpi/battery.c
+++ b/drivers/acpi/battery.c
@@ -782,7 +782,7 @@ static int acpi_battery_update(struct acpi_battery *battery, bool resume)
         if ((battery->state & ACPI_BATTERY_STATE_CRITICAL) ||
             (test_bit(ACPI_BATTERY_ALARM_PRESENT, &battery->flags) &&
             (battery->capacity_now <= battery->alarm)))
-                pm_wakeup_hard_event(&battery->device->dev);
+                pm_wakeup_event(&battery->device->dev, 0);
 
         return result;
 }
diff --git a/drivers/acpi/button.c b/drivers/acpi/button.c
index 25aba9b107dd..e19f530f1083 100644
--- a/drivers/acpi/button.c
+++ b/drivers/acpi/button.c
@@ -113,7 +113,7 @@ struct acpi_button {
 
 static BLOCKING_NOTIFIER_HEAD(acpi_lid_notifier);
 static struct acpi_device *lid_device;
-static u8 lid_init_state = ACPI_BUTTON_LID_INIT_OPEN;
+static u8 lid_init_state = ACPI_BUTTON_LID_INIT_METHOD;
 
 static unsigned long lid_report_interval __read_mostly = 500;
 module_param(lid_report_interval, ulong, 0644);
@@ -217,7 +217,7 @@ static int acpi_lid_notify_state(struct acpi_device *device, int state)
         }
 
         if (state)
-                pm_wakeup_hard_event(&device->dev);
+                pm_wakeup_event(&device->dev, 0);
 
         ret = blocking_notifier_call_chain(&acpi_lid_notifier, state, device);
         if (ret == NOTIFY_DONE)
@@ -402,7 +402,7 @@ static void acpi_button_notify(struct acpi_device *device, u32 event)
                 } else {
                         int keycode;
 
-                        pm_wakeup_hard_event(&device->dev);
+                        pm_wakeup_event(&device->dev, 0);
                         if (button->suspended)
                                 break;
 
@@ -534,7 +534,6 @@ static int acpi_button_add(struct acpi_device *device)
                 lid_device = device;
         }
 
-        device_init_wakeup(&device->dev, true);
         printk(KERN_INFO PREFIX "%s [%s]\n", name, acpi_device_bid(device));
         return 0;
 
diff --git a/drivers/acpi/device_pm.c b/drivers/acpi/device_pm.c
index 798d5003a039..993fd31394c8 100644
--- a/drivers/acpi/device_pm.c
+++ b/drivers/acpi/device_pm.c
@@ -24,7 +24,6 @@
 #include <linux/pm_qos.h>
 #include <linux/pm_domain.h>
 #include <linux/pm_runtime.h>
-#include <linux/suspend.h>
 
 #include "internal.h"
 
@@ -400,7 +399,7 @@ static void acpi_pm_notify_handler(acpi_handle handle, u32 val, void *not_used)
         mutex_lock(&acpi_pm_notifier_lock);
 
         if (adev->wakeup.flags.notifier_present) {
-                pm_wakeup_ws_event(adev->wakeup.ws, 0, true);
+                __pm_wakeup_event(adev->wakeup.ws, 0);
                 if (adev->wakeup.context.work.func)
                         queue_pm_work(&adev->wakeup.context.work);
         }
diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
index e39ec7b7cb67..d53162997f32 100644
--- a/drivers/acpi/scan.c
+++ b/drivers/acpi/scan.c
@@ -1371,8 +1371,8 @@ int acpi_dma_configure(struct device *dev, enum dev_dma_attr attr)
         iort_set_dma_mask(dev);
 
         iommu = iort_iommu_configure(dev);
-        if (IS_ERR(iommu))
-                return PTR_ERR(iommu);
+        if (IS_ERR(iommu) && PTR_ERR(iommu) == -EPROBE_DEFER)
+                return -EPROBE_DEFER;
 
         size = max(dev->coherent_dma_mask, dev->coherent_dma_mask + 1);
         /*
@@ -1428,6 +1428,37 @@ static void acpi_init_coherency(struct acpi_device *adev)
         adev->flags.coherent_dma = cca;
 }
 
+static int acpi_check_spi_i2c_slave(struct acpi_resource *ares, void *data)
+{
+        bool *is_spi_i2c_slave_p = data;
+
+        if (ares->type != ACPI_RESOURCE_TYPE_SERIAL_BUS)
+                return 1;
+
+        /*
+         * devices that are connected to UART still need to be enumerated to
+         * platform bus
+         */
+        if (ares->data.common_serial_bus.type != ACPI_RESOURCE_SERIAL_TYPE_UART)
+                *is_spi_i2c_slave_p = true;
+
+         /* no need to do more checking */
+        return -1;
+}
+
+static bool acpi_is_spi_i2c_slave(struct acpi_device *device)
+{
+        struct list_head resource_list;
+        bool is_spi_i2c_slave = false;
+
+        INIT_LIST_HEAD(&resource_list);
+        acpi_dev_get_resources(device, &resource_list, acpi_check_spi_i2c_slave,
+                               &is_spi_i2c_slave);
+        acpi_dev_free_resource_list(&resource_list);
+
+        return is_spi_i2c_slave;
+}
+
 void acpi_init_device_object(struct acpi_device *device, acpi_handle handle,
                              int type, unsigned long long sta)
 {
@@ -1443,6 +1474,7 @@ void acpi_init_device_object(struct acpi_device *device, acpi_handle handle,
         acpi_bus_get_flags(device);
         device->flags.match_driver = false;
         device->flags.initialized = true;
+        device->flags.spi_i2c_slave = acpi_is_spi_i2c_slave(device);
         acpi_device_clear_enumerated(device);
         device_initialize(&device->dev);
         dev_set_uevent_suppress(&device->dev, true);
@@ -1727,38 +1759,13 @@ static acpi_status acpi_bus_check_add(acpi_handle handle, u32 lvl_not_used,
         return AE_OK;
 }
 
-static int acpi_check_spi_i2c_slave(struct acpi_resource *ares, void *data)
-{
-        bool *is_spi_i2c_slave_p = data;
-
-        if (ares->type != ACPI_RESOURCE_TYPE_SERIAL_BUS)
-                return 1;
-
-        /*
-         * devices that are connected to UART still need to be enumerated to
-         * platform bus
-         */
-        if (ares->data.common_serial_bus.type != ACPI_RESOURCE_SERIAL_TYPE_UART)
-                *is_spi_i2c_slave_p = true;
-
-         /* no need to do more checking */
-        return -1;
-}
-
 static void acpi_default_enumeration(struct acpi_device *device)
 {
-        struct list_head resource_list;
-        bool is_spi_i2c_slave = false;
-
         /*
          * Do not enumerate SPI/I2C slaves as they will be enumerated by their
          * respective parents.
          */
-        INIT_LIST_HEAD(&resource_list);
-        acpi_dev_get_resources(device, &resource_list, acpi_check_spi_i2c_slave,
-                               &is_spi_i2c_slave);
-        acpi_dev_free_resource_list(&resource_list);
-        if (!is_spi_i2c_slave) {
+        if (!device->flags.spi_i2c_slave) {
                 acpi_create_platform_device(device, NULL);
                 acpi_device_set_enumerated(device);
         } else {
@@ -1854,7 +1861,7 @@ static void acpi_bus_attach(struct acpi_device *device)
                 return;
 
         device->flags.match_driver = true;
-        if (ret > 0) {
+        if (ret > 0 && !device->flags.spi_i2c_slave) {
                 acpi_device_set_enumerated(device);
                 goto ok;
         }
@@ -1863,10 +1870,10 @@ static void acpi_bus_attach(struct acpi_device *device)
         if (ret < 0)
                 return;
 
-        if (device->pnp.type.platform_id)
-                acpi_default_enumeration(device);
-        else
+        if (!device->pnp.type.platform_id && !device->flags.spi_i2c_slave)
                 acpi_device_set_enumerated(device);
+        else
+                acpi_default_enumeration(device);
 
  ok:
         list_for_each_entry(child, &device->children, node)
diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c
index a6574d626340..097d630ab886 100644
--- a/drivers/acpi/sleep.c
+++ b/drivers/acpi/sleep.c
@@ -663,40 +663,14 @@ static int acpi_freeze_prepare(void)
         acpi_os_wait_events_complete();
         if (acpi_sci_irq_valid())
                 enable_irq_wake(acpi_sci_irq);
-
         return 0;
 }
 
-static void acpi_freeze_wake(void)
-{
-        /*
-         * If IRQD_WAKEUP_ARMED is not set for the SCI at this point, it means
-         * that the SCI has triggered while suspended, so cancel the wakeup in
-         * case it has not been a wakeup event (the GPEs will be checked later).
-         */
-        if (acpi_sci_irq_valid() &&
-            !irqd_is_wakeup_armed(irq_get_irq_data(acpi_sci_irq)))
-                pm_system_cancel_wakeup();
-}
-
-static void acpi_freeze_sync(void)
-{
-        /*
-         * Process all pending events in case there are any wakeup ones.
-         *
-         * The EC driver uses the system workqueue, so that one needs to be
-         * flushed too.
-         */
-        acpi_os_wait_events_complete();
-        flush_scheduled_work();
-}
-
 static void acpi_freeze_restore(void)
 {
         acpi_disable_wakeup_devices(ACPI_STATE_S0);
         if (acpi_sci_irq_valid())
                 disable_irq_wake(acpi_sci_irq);
-
         acpi_enable_all_runtime_gpes();
 }
 
@@ -708,8 +682,6 @@ static void acpi_freeze_end(void)
 static const struct platform_freeze_ops acpi_freeze_ops = {
         .begin = acpi_freeze_begin,
         .prepare = acpi_freeze_prepare,
-        .wake = acpi_freeze_wake,
-        .sync = acpi_freeze_sync,
         .restore = acpi_freeze_restore,
         .end = acpi_freeze_end,
 };
diff --git a/drivers/acpi/sysfs.c b/drivers/acpi/sysfs.c
index 1b5ee1e0e5a3..e414fabf7315 100644
--- a/drivers/acpi/sysfs.c
+++ b/drivers/acpi/sysfs.c
@@ -333,14 +333,17 @@ static ssize_t acpi_table_show(struct file *filp, struct kobject *kobj,
             container_of(bin_attr, struct acpi_table_attr, attr);
         struct acpi_table_header *table_header = NULL;
         acpi_status status;
+        ssize_t rc;
 
         status = acpi_get_table(table_attr->name, table_attr->instance,
                                 &table_header);
         if (ACPI_FAILURE(status))
                 return -ENODEV;
 
-        return memory_read_from_buffer(buf, count, &offset,
-                                       table_header, table_header->length);
+        rc = memory_read_from_buffer(buf, count, &offset, table_header,
+                        table_header->length);
+        acpi_put_table(table_header);
+        return rc;
 }
 
 static int acpi_table_attr_init(struct kobject *tables_obj,
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index 2fc52407306c..c69954023c2e 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -1364,6 +1364,40 @@ static inline void ahci_gtf_filter_workaround(struct ata_host *host)
 {}
 #endif
 
+/*
+ * On the Acer Aspire Switch Alpha 12, sometimes all SATA ports are detected
+ * as DUMMY, or detected but eventually get a "link down" and never get up
+ * again. When this happens, CAP.NP may hold a value of 0x00 or 0x01, and the
+ * port_map may hold a value of 0x00.
+ *
+ * Overriding CAP.NP to 0x02 and the port_map to 0x7 will reveal all 3 ports
+ * and can significantly reduce the occurrence of the problem.
+ *
+ * https://bugzilla.kernel.org/show_bug.cgi?id=189471
+ */
+static void acer_sa5_271_workaround(struct ahci_host_priv *hpriv,
+                                    struct pci_dev *pdev)
+{
+        static const struct dmi_system_id sysids[] = {
+                {
+                        .ident = "Acer Switch Alpha 12",
+                        .matches = {
+                                DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+                                DMI_MATCH(DMI_PRODUCT_NAME, "Switch SA5-271")
+                        },
+                },
+                { }
+        };
+
+        if (dmi_check_system(sysids)) {
+                dev_info(&pdev->dev, "enabling Acer Switch Alpha 12 workaround\n");
+                if ((hpriv->saved_cap & 0xC734FF00) == 0xC734FF00) {
+                        hpriv->port_map = 0x7;
+                        hpriv->cap = 0xC734FF02;
+                }
+        }
+}
+
 #ifdef CONFIG_ARM64
 /*
  * Due to ERRATA#22536, ThunderX needs to handle HOST_IRQ_STAT differently.
@@ -1636,6 +1670,10 @@ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
                          "online status unreliable, applying workaround\n");
         }
 
+
+        /* Acer SA5-271 workaround modifies private_data */
+        acer_sa5_271_workaround(hpriv, pdev);
+
         /* CAP.NP sometimes indicate the index of the last enabled
          * port, at other times, that of the last possible port, so
          * determining the maximum port number requires looking at
diff --git a/drivers/ata/libahci_platform.c b/drivers/ata/libahci_platform.c
index aaa761b9081c..cd2eab6aa92e 100644
--- a/drivers/ata/libahci_platform.c
+++ b/drivers/ata/libahci_platform.c
@@ -514,8 +514,9 @@ int ahci_platform_init_host(struct platform_device *pdev,
 
         irq = platform_get_irq(pdev, 0);
         if (irq <= 0) {
-                dev_err(dev, "no irq\n");
-                return -EINVAL;
+                if (irq != -EPROBE_DEFER)
+                        dev_err(dev, "no irq\n");
+                return irq;
         }
 
         hpriv->irq = irq;
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 2d83b8c75965..e157a0e44419 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -6800,7 +6800,7 @@ static int __init ata_parse_force_one(char **cur,
         }
 
         force_ent->port = simple_strtoul(id, &endp, 10);
-        if (p == endp || *endp != '\0') {
+        if (id == endp || *endp != '\0') {
                 *reason = "invalid port/link";
                 return -EINVAL;
         }
diff --git a/drivers/ata/sata_mv.c b/drivers/ata/sata_mv.c
index b66bcda88320..3b2246dded74 100644
--- a/drivers/ata/sata_mv.c
+++ b/drivers/ata/sata_mv.c
@@ -4067,7 +4067,6 @@ static int mv_platform_probe(struct platform_device *pdev)
         struct ata_host *host;
         struct mv_host_priv *hpriv;
         struct resource *res;
-        void __iomem *mmio;
         int n_ports = 0, irq = 0;
         int rc;
         int port;
@@ -4086,9 +4085,8 @@ static int mv_platform_probe(struct platform_device *pdev)
          * Get the register base first
          */
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-        mmio = devm_ioremap_resource(&pdev->dev, res);
-        if (IS_ERR(mmio))
-                return PTR_ERR(mmio);
+        if (res == NULL)
+                return -EINVAL;
 
         /* allocate host */
         if (pdev->dev.of_node) {
@@ -4132,7 +4130,12 @@ static int mv_platform_probe(struct platform_device *pdev)
         hpriv->board_idx = chip_soc;
 
         host->iomap = NULL;
-        hpriv->base = mmio - SATAHC0_REG_BASE;
+        hpriv->base = devm_ioremap(&pdev->dev, res->start,
+                                   resource_size(res));
+        if (!hpriv->base)
+                return -ENOMEM;
+
+        hpriv->base -= SATAHC0_REG_BASE;
 
         hpriv->clk = clk_get(&pdev->dev, NULL);
         if (IS_ERR(hpriv->clk))
diff --git a/drivers/ata/sata_rcar.c b/drivers/ata/sata_rcar.c
index 5d38245a7a73..b7939a2c1fab 100644
--- a/drivers/ata/sata_rcar.c
+++ b/drivers/ata/sata_rcar.c
@@ -890,7 +890,10 @@ static int sata_rcar_probe(struct platform_device *pdev)
                 dev_err(&pdev->dev, "failed to get access to sata clock\n");
                 return PTR_ERR(priv->clk);
         }
-        clk_prepare_enable(priv->clk);
+
+        ret = clk_prepare_enable(priv->clk);
+        if (ret)
+                return ret;
 
         host = ata_host_alloc(&pdev->dev, 1);
         if (!host) {
@@ -970,8 +973,11 @@ static int sata_rcar_resume(struct device *dev)
         struct ata_host *host = dev_get_drvdata(dev);
         struct sata_rcar_priv *priv = host->private_data;
         void __iomem *base = priv->base;
+        int ret;
 
-        clk_prepare_enable(priv->clk);
+        ret = clk_prepare_enable(priv->clk);
+        if (ret)
+                return ret;
 
         /* ack and mask */
         iowrite32(0, base + SATAINTSTAT_REG);
@@ -988,8 +994,11 @@ static int sata_rcar_restore(struct device *dev)
 {
         struct ata_host *host = dev_get_drvdata(dev);
         struct sata_rcar_priv *priv = host->private_data;
+        int ret;
 
-        clk_prepare_enable(priv->clk);
+        ret = clk_prepare_enable(priv->clk);
+        if (ret)
+                return ret;
 
         sata_rcar_setup_port(host);
 
diff --git a/drivers/base/base.h b/drivers/base/base.h
index e19b1008e5fb..539432a14b5c 100644
--- a/drivers/base/base.h
+++ b/drivers/base/base.h
@@ -126,11 +126,6 @@ extern int driver_add_groups(struct device_driver *drv,
 extern void driver_remove_groups(struct device_driver *drv,
                                  const struct attribute_group **groups);
 
-extern int device_add_groups(struct device *dev,
-                             const struct attribute_group **groups);
-extern void device_remove_groups(struct device *dev,
-                                 const struct attribute_group **groups);
-
 extern char *make_class_name(const char *name, struct kobject *kobj);
 
 extern int devres_release_all(struct device *dev);
diff --git a/drivers/base/core.c b/drivers/base/core.c
index bbecaf9293be..09723532725d 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -1026,12 +1026,144 @@ int device_add_groups(struct device *dev, const struct attribute_group **groups)
 {
         return sysfs_create_groups(&dev->kobj, groups);
 }
+EXPORT_SYMBOL_GPL(device_add_groups);
 
 void device_remove_groups(struct device *dev,
                           const struct attribute_group **groups)
 {
         sysfs_remove_groups(&dev->kobj, groups);
 }
+EXPORT_SYMBOL_GPL(device_remove_groups);
+
+union device_attr_group_devres {
+        const struct attribute_group *group;
+        const struct attribute_group **groups;
+};
+
+static int devm_attr_group_match(struct device *dev, void *res, void *data)
+{
+        return ((union device_attr_group_devres *)res)->group == data;
+}
+
+static void devm_attr_group_remove(struct device *dev, void *res)
+{
+        union device_attr_group_devres *devres = res;
+        const struct attribute_group *group = devres->group;
+
+        dev_dbg(dev, "%s: removing group %p\n", __func__, group);
+        sysfs_remove_group(&dev->kobj, group);
+}
+
+static void devm_attr_groups_remove(struct device *dev, void *res)
+{
+        union device_attr_group_devres *devres = res;
+        const struct attribute_group **groups = devres->groups;
+
+        dev_dbg(dev, "%s: removing groups %p\n", __func__, groups);
+        sysfs_remove_groups(&dev->kobj, groups);
+}
+
+/**
+ * devm_device_add_group - given a device, create a managed attribute group
+ * @dev:        The device to create the group for
+ * @grp:        The attribute group to create
+ *
+ * This function creates a group for the first time.  It will explicitly
+ * warn and error if any of the attribute files being created already exist.
+ *
+ * Returns 0 on success or error code on failure.
+ */
+int devm_device_add_group(struct device *dev, const struct attribute_group *grp)
+{
+        union device_attr_group_devres *devres;
+        int error;
+
+        devres = devres_alloc(devm_attr_group_remove,
+                              sizeof(*devres), GFP_KERNEL);
+        if (!devres)
+                return -ENOMEM;
+
+        error = sysfs_create_group(&dev->kobj, grp);
+        if (error) {
+                devres_free(devres);
+                return error;
+        }
+
+        devres->group = grp;
+        devres_add(dev, devres);
+        return 0;
+}
+EXPORT_SYMBOL_GPL(devm_device_add_group);
+
+/**
+ * devm_device_remove_group: remove a managed group from a device
+ * @dev:        device to remove the group from
+ * @grp:        group to remove
+ *
+ * This function removes a group of attributes from a device. The attributes
+ * previously have to have been created for this group, otherwise it will fail.
+ */
+void devm_device_remove_group(struct device *dev,
+                              const struct attribute_group *grp)
+{
+        WARN_ON(devres_release(dev, devm_attr_group_remove,
+                               devm_attr_group_match,
+                               /* cast away const */ (void *)grp));
+}
+EXPORT_SYMBOL_GPL(devm_device_remove_group);
+
+/**
+ * devm_device_add_groups - create a bunch of managed attribute groups
+ * @dev:        The device to create the group for
+ * @groups:     The attribute groups to create, NULL terminated
+ *
+ * This function creates a bunch of managed attribute groups.  If an error
+ * occurs when creating a group, all previously created groups will be
+ * removed, unwinding everything back to the original state when this
+ * function was called.  It will explicitly warn and error if any of the
+ * attribute files being created already exist.
+ *
+ * Returns 0 on success or error code from sysfs_create_group on failure.
+ */
+int devm_device_add_groups(struct device *dev,
+                           const struct attribute_group **groups)
+{
+        union device_attr_group_devres *devres;
+        int error;
+
+        devres = devres_alloc(devm_attr_groups_remove,
+                              sizeof(*devres), GFP_KERNEL);
+        if (!devres)
+                return -ENOMEM;
+
+        error = sysfs_create_groups(&dev->kobj, groups);
+        if (error) {
+                devres_free(devres);
+                return error;
+        }
+
+        devres->groups = groups;
+        devres_add(dev, devres);
+        return 0;
+}
+EXPORT_SYMBOL_GPL(devm_device_add_groups);
+
+/**
+ * devm_device_remove_groups - remove a list of managed groups
+ *
+ * @dev:        The device for the groups to be removed from
+ * @groups:     NULL terminated list of groups to be removed
+ *
+ * If groups is not NULL, remove the specified groups from the device.
+ */
+void devm_device_remove_groups(struct device *dev,
+                               const struct attribute_group **groups)
+{
+        WARN_ON(devres_release(dev, devm_attr_groups_remove,
+                               devm_attr_group_match,
+                               /* cast away const */ (void *)groups));
+}
+EXPORT_SYMBOL_GPL(devm_device_remove_groups);
 
 static int device_add_attrs(struct device *dev)
 {
diff --git a/drivers/base/dd.c b/drivers/base/dd.c
index 4882f06d12df..c17fefc77345 100644
--- a/drivers/base/dd.c
+++ b/drivers/base/dd.c
@@ -259,6 +259,8 @@ static void driver_bound(struct device *dev)
         if (dev->bus)
                 blocking_notifier_call_chain(&dev->bus->p->bus_notifier,
                                              BUS_NOTIFY_BOUND_DRIVER, dev);
+
+        kobject_uevent(&dev->kobj, KOBJ_BIND);
 }
 
 static int driver_sysfs_add(struct device *dev)
@@ -848,6 +850,8 @@ static void __device_release_driver(struct device *dev, struct device *parent)
                         blocking_notifier_call_chain(&dev->bus->p->bus_notifier,
                                                      BUS_NOTIFY_UNBOUND_DRIVER,
                                                      dev);
+
+                kobject_uevent(&dev->kobj, KOBJ_UNBIND);
         }
 }
 
diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c
index e987a6f55d36..9faee1c893e5 100644
--- a/drivers/base/power/main.c
+++ b/drivers/base/power/main.c
@@ -1091,6 +1091,11 @@ static int __device_suspend_noirq(struct device *dev, pm_message_t state, bool a
         if (async_error)
                 goto Complete;
 
+        if (pm_wakeup_pending()) {
+                async_error = -EBUSY;
+                goto Complete;
+        }
+
         if (dev->power.syscore || dev->power.direct_complete)
                 goto Complete;
 
diff --git a/drivers/base/power/wakeup.c b/drivers/base/power/wakeup.c
index 9c36b27996fc..c313b600d356 100644
--- a/drivers/base/power/wakeup.c
+++ b/drivers/base/power/wakeup.c
@@ -28,8 +28,8 @@ bool events_check_enabled __read_mostly;
 /* First wakeup IRQ seen by the kernel in the last cycle. */
 unsigned int pm_wakeup_irq __read_mostly;
 
-/* If greater than 0 and the system is suspending, terminate the suspend. */
-static atomic_t pm_abort_suspend __read_mostly;
+/* If set and the system is suspending, terminate the suspend. */
+static bool pm_abort_suspend __read_mostly;
 
 /*
  * Combined counters of registered wakeup events and wakeup events in progress.
@@ -855,26 +855,20 @@ bool pm_wakeup_pending(void)
                 pm_print_active_wakeup_sources();
         }
 
-        return ret || atomic_read(&pm_abort_suspend) > 0;
+        return ret || pm_abort_suspend;
 }
 
 void pm_system_wakeup(void)
 {
-        atomic_inc(&pm_abort_suspend);
+        pm_abort_suspend = true;
         freeze_wake();
 }
 EXPORT_SYMBOL_GPL(pm_system_wakeup);
 
-void pm_system_cancel_wakeup(void)
-{
-        atomic_dec(&pm_abort_suspend);
-}
-
-void pm_wakeup_clear(bool reset)
+void pm_wakeup_clear(void)
 {
+        pm_abort_suspend = false;
         pm_wakeup_irq = 0;
-        if (reset)
-                atomic_set(&pm_abort_suspend, 0);
 }
 
 void pm_system_irq_wakeup(unsigned int irq_number)
diff --git a/drivers/block/loop.c b/drivers/block/loop.c
index 28d932906f24..ebbd0c3fe0ed 100644
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -608,6 +608,9 @@ static int loop_switch(struct loop_device *lo, struct file *file)
  */
 static int loop_flush(struct loop_device *lo)
 {
+        /* loop not yet configured, no running thread, nothing to flush */
+        if (lo->lo_state != Lo_bound)
+                return 0;
         return loop_switch(lo, NULL);
 }
 
diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index 9a7bb2c29447..f3f191ba8ca4 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -937,14 +937,6 @@ static int nbd_reconnect_socket(struct nbd_device *nbd, unsigned long arg)
         return -ENOSPC;
 }
 
-/* Reset all properties of an NBD device */
-static void nbd_reset(struct nbd_device *nbd)
-{
-        nbd->config = NULL;
-        nbd->tag_set.timeout = 0;
-        queue_flag_clear_unlocked(QUEUE_FLAG_DISCARD, nbd->disk->queue);
-}
-
 static void nbd_bdev_reset(struct block_device *bdev)
 {
         if (bdev->bd_openers > 1)
@@ -1029,7 +1021,11 @@ static void nbd_config_put(struct nbd_device *nbd)
                         }
                         kfree(config->socks);
                 }
-                nbd_reset(nbd);
+                kfree(nbd->config);
+                nbd->config = NULL;
+
+                nbd->tag_set.timeout = 0;
+                queue_flag_clear_unlocked(QUEUE_FLAG_DISCARD, nbd->disk->queue);
 
                 mutex_unlock(&nbd->config_lock);
                 nbd_put(nbd);
@@ -1483,7 +1479,6 @@ static int nbd_dev_add(int index)
         disk->fops = &nbd_fops;
         disk->private_data = nbd;
         sprintf(disk->disk_name, "nbd%d", index);
-        nbd_reset(nbd);
         add_disk(disk);
         nbd_total_devices++;
         return index;
diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
index 454bf9c34882..c16f74547804 100644
--- a/drivers/block/rbd.c
+++ b/drivers/block/rbd.c
@@ -4023,6 +4023,7 @@ static void rbd_queue_workfn(struct work_struct *work)
 
         switch (req_op(rq)) {
         case REQ_OP_DISCARD:
+        case REQ_OP_WRITE_ZEROES:
                 op_type = OBJ_OP_DISCARD;
                 break;
         case REQ_OP_WRITE:
@@ -4420,6 +4421,7 @@ static int rbd_init_disk(struct rbd_device *rbd_dev)
         q->limits.discard_granularity = segment_size;
         q->limits.discard_alignment = segment_size;
         blk_queue_max_discard_sectors(q, segment_size / SECTOR_SIZE);
+        blk_queue_max_write_zeroes_sectors(q, segment_size / SECTOR_SIZE);
 
         if (!ceph_test_opt(rbd_dev->rbd_client->client, NOCRC))
                 q->backing_dev_info->capabilities |= BDI_CAP_STABLE_WRITES;
diff --git a/drivers/block/xen-blkback/blkback.c b/drivers/block/xen-blkback/blkback.c
index 726c32e35db9..0e824091a12f 100644
--- a/drivers/block/xen-blkback/blkback.c
+++ b/drivers/block/xen-blkback/blkback.c
@@ -609,8 +609,6 @@ int xen_blkif_schedule(void *arg)
         unsigned long timeout;
         int ret;
 
-        xen_blkif_get(blkif);
-
         set_freezable();
         while (!kthread_should_stop()) {
                 if (try_to_freeze())
@@ -665,7 +663,6 @@ purge_gnt_list:
                 print_stats(ring);
 
         ring->xenblkd = NULL;
-        xen_blkif_put(blkif);
 
         return 0;
 }
@@ -1436,34 +1433,35 @@ static int dispatch_rw_block_io(struct xen_blkif_ring *ring,
 static void make_response(struct xen_blkif_ring *ring, u64 id,
                           unsigned short op, int st)
 {
-        struct blkif_response  resp;
+        struct blkif_response *resp;
         unsigned long     flags;
         union blkif_back_rings *blk_rings;
         int notify;
 
-        resp.id        = id;
-        resp.operation = op;
-        resp.status    = st;
-
         spin_lock_irqsave(&ring->blk_ring_lock, flags);
         blk_rings = &ring->blk_rings;
         /* Place on the response ring for the relevant domain. */
         switch (ring->blkif->blk_protocol) {
         case BLKIF_PROTOCOL_NATIVE:
-                memcpy(RING_GET_RESPONSE(&blk_rings->native, blk_rings->native.rsp_prod_pvt),
-                       &resp, sizeof(resp));
+                resp = RING_GET_RESPONSE(&blk_rings->native,
+                                         blk_rings->native.rsp_prod_pvt);
                 break;
         case BLKIF_PROTOCOL_X86_32:
-                memcpy(RING_GET_RESPONSE(&blk_rings->x86_32, blk_rings->x86_32.rsp_prod_pvt),
-                       &resp, sizeof(resp));
+                resp = RING_GET_RESPONSE(&blk_rings->x86_32,
+                                         blk_rings->x86_32.rsp_prod_pvt);
                 break;
         case BLKIF_PROTOCOL_X86_64:
-                memcpy(RING_GET_RESPONSE(&blk_rings->x86_64, blk_rings->x86_64.rsp_prod_pvt),
-                       &resp, sizeof(resp));
+                resp = RING_GET_RESPONSE(&blk_rings->x86_64,
+                                         blk_rings->x86_64.rsp_prod_pvt);
                 break;
         default:
                 BUG();
         }
+
+        resp->id        = id;
+        resp->operation = op;
+        resp->status    = st;
+
         blk_rings->common.rsp_prod_pvt++;
         RING_PUSH_RESPONSES_AND_CHECK_NOTIFY(&blk_rings->common, notify);
         spin_unlock_irqrestore(&ring->blk_ring_lock, flags);
diff --git a/drivers/block/xen-blkback/common.h b/drivers/block/xen-blkback/common.h
index dea61f6ab8cb..ecb35fe8ca8d 100644
--- a/drivers/block/xen-blkback/common.h
+++ b/drivers/block/xen-blkback/common.h
@@ -75,9 +75,8 @@ extern unsigned int xenblk_max_queues;
 struct blkif_common_request {
         char dummy;
 };
-struct blkif_common_response {
-        char dummy;
-};
+
+/* i386 protocol version */
 
 struct blkif_x86_32_request_rw {
         uint8_t        nr_segments;  /* number of segments                   */
@@ -129,14 +128,6 @@ struct blkif_x86_32_request {
         } u;
 } __attribute__((__packed__));
 
-/* i386 protocol version */
-#pragma pack(push, 4)
-struct blkif_x86_32_response {
-        uint64_t        id;              /* copied from request */
-        uint8_t         operation;       /* copied from request */
-        int16_t         status;          /* BLKIF_RSP_???       */
-};
-#pragma pack(pop)
 /* x86_64 protocol version */
 
 struct blkif_x86_64_request_rw {
@@ -193,18 +184,12 @@ struct blkif_x86_64_request {
         } u;
 } __attribute__((__packed__));
 
-struct blkif_x86_64_response {
-        uint64_t       __attribute__((__aligned__(8))) id;
-        uint8_t         operation;       /* copied from request */
-        int16_t         status;          /* BLKIF_RSP_???       */
-};
-
 DEFINE_RING_TYPES(blkif_common, struct blkif_common_request,
-                  struct blkif_common_response);
+                  struct blkif_response);
 DEFINE_RING_TYPES(blkif_x86_32, struct blkif_x86_32_request,
-                  struct blkif_x86_32_response);
+                  struct blkif_response __packed);
 DEFINE_RING_TYPES(blkif_x86_64, struct blkif_x86_64_request,
-                  struct blkif_x86_64_response);
+                  struct blkif_response);
 
 union blkif_back_rings {
         struct blkif_back_ring        native;
@@ -281,6 +266,7 @@ struct xen_blkif_ring {
 
         wait_queue_head_t       wq;
         atomic_t                inflight;
+        bool                    active;
         /* One thread per blkif ring. */
         struct task_struct      *xenblkd;
         unsigned int            waiting_reqs;
diff --git a/drivers/block/xen-blkback/xenbus.c b/drivers/block/xen-blkback/xenbus.c
index 1f3dfaa54d87..792da683e70d 100644
--- a/drivers/block/xen-blkback/xenbus.c
+++ b/drivers/block/xen-blkback/xenbus.c
@@ -159,7 +159,7 @@ static int xen_blkif_alloc_rings(struct xen_blkif *blkif)
                 init_waitqueue_head(&ring->shutdown_wq);
                 ring->blkif = blkif;
                 ring->st_print = jiffies;
-                xen_blkif_get(blkif);
+                ring->active = true;
         }
 
         return 0;
@@ -249,10 +249,12 @@ static int xen_blkif_disconnect(struct xen_blkif *blkif)
                 struct xen_blkif_ring *ring = &blkif->rings[r];
                 unsigned int i = 0;
 
+                if (!ring->active)
+                        continue;
+
                 if (ring->xenblkd) {
                         kthread_stop(ring->xenblkd);
                         wake_up(&ring->shutdown_wq);
-                        ring->xenblkd = NULL;
                 }
 
                 /* The above kthread_stop() guarantees that at this point we
@@ -296,7 +298,7 @@ static int xen_blkif_disconnect(struct xen_blkif *blkif)
                 BUG_ON(ring->free_pages_num != 0);
                 BUG_ON(ring->persistent_gnt_c != 0);
                 WARN_ON(i != (XEN_BLKIF_REQS_PER_PAGE * blkif->nr_ring_pages));
-                xen_blkif_put(blkif);
+                ring->active = false;
         }
         blkif->nr_ring_pages = 0;
         /*
@@ -312,9 +314,10 @@ static int xen_blkif_disconnect(struct xen_blkif *blkif)
 
 static void xen_blkif_free(struct xen_blkif *blkif)
 {
-
-        xen_blkif_disconnect(blkif);
+        WARN_ON(xen_blkif_disconnect(blkif));
         xen_vbd_free(&blkif->vbd);
+        kfree(blkif->be->mode);
+        kfree(blkif->be);
 
         /* Make sure everything is drained before shutting down */
         kmem_cache_free(xen_blkif_cachep, blkif);
@@ -511,8 +514,6 @@ static int xen_blkbk_remove(struct xenbus_device *dev)
                 xen_blkif_put(be->blkif);
         }
 
-        kfree(be->mode);
-        kfree(be);
         return 0;
 }
 
diff --git a/drivers/char/mem.c b/drivers/char/mem.c
index 6e0cbe092220..593a8818aca9 100644
--- a/drivers/char/mem.c
+++ b/drivers/char/mem.c
@@ -343,7 +343,7 @@ static int mmap_mem(struct file *file, struct vm_area_struct *vma)
         phys_addr_t offset = (phys_addr_t)vma->vm_pgoff << PAGE_SHIFT;
 
         /* It's illegal to wrap around the end of the physical address space. */
-        if (offset + (phys_addr_t)size < offset)
+        if (offset + (phys_addr_t)size - 1 < offset)
                 return -EINVAL;
 
         if (!valid_mmap_phys_addr_range(vma->vm_pgoff, size))
diff --git a/drivers/char/pcmcia/cm4040_cs.c b/drivers/char/pcmcia/cm4040_cs.c
index d4dbd8d8e524..382c864814d9 100644
--- a/drivers/char/pcmcia/cm4040_cs.c
+++ b/drivers/char/pcmcia/cm4040_cs.c
@@ -374,7 +374,7 @@ static ssize_t cm4040_write(struct file *filp, const char __user *buf,
 
         rc = write_sync_reg(SCR_HOST_TO_READER_START, dev);
         if (rc <= 0) {
-                DEBUGP(5, dev, "write_sync_reg c=%.2Zx\n", rc);
+                DEBUGP(5, dev, "write_sync_reg c=%.2zx\n", rc);
                 DEBUGP(2, dev, "<- cm4040_write (failed)\n");
                 if (rc == -ERESTARTSYS)
                         return rc;
@@ -387,7 +387,7 @@ static ssize_t cm4040_write(struct file *filp, const char __user *buf,
         for (i = 0; i < bytes_to_write; i++) {
                 rc = wait_for_bulk_out_ready(dev);
                 if (rc <= 0) {
-                        DEBUGP(5, dev, "wait_for_bulk_out_ready rc=%.2Zx\n",
+                        DEBUGP(5, dev, "wait_for_bulk_out_ready rc=%.2zx\n",
                                rc);
                         DEBUGP(2, dev, "<- cm4040_write (failed)\n");
                         if (rc == -ERESTARTSYS)
@@ -403,7 +403,7 @@ static ssize_t cm4040_write(struct file *filp, const char __user *buf,
         rc = write_sync_reg(SCR_HOST_TO_READER_DONE, dev);
 
         if (rc <= 0) {
-                DEBUGP(5, dev, "write_sync_reg c=%.2Zx\n", rc);
+                DEBUGP(5, dev, "write_sync_reg c=%.2zx\n", rc);
                 DEBUGP(2, dev, "<- cm4040_write (failed)\n");
                 if (rc == -ERESTARTSYS)
                         return rc;
diff --git a/drivers/char/random.c b/drivers/char/random.c
index 0ab024918907..01a260f67437 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -1,6 +1,9 @@
 /*
  * random.c -- A strong random number generator
  *
+ * Copyright (C) 2017 Jason A. Donenfeld <Jason@zx2c4.com>. All
+ * Rights Reserved.
+ *
  * Copyright Matt Mackall <mpm@selenic.com>, 2003, 2004, 2005
  *
  * Copyright Theodore Ts'o, 1994, 1995, 1996, 1997, 1998, 1999.  All
@@ -762,6 +765,8 @@ static DECLARE_WAIT_QUEUE_HEAD(crng_init_wait);
 static struct crng_state **crng_node_pool __read_mostly;
 #endif
 
+static void invalidate_batched_entropy(void);
+
 static void crng_initialize(struct crng_state *crng)
 {
         int             i;
@@ -798,12 +803,13 @@ static int crng_fast_load(const char *cp, size_t len)
                 p[crng_init_cnt % CHACHA20_KEY_SIZE] ^= *cp;
                 cp++; crng_init_cnt++; len--;
         }
+        spin_unlock_irqrestore(&primary_crng.lock, flags);
         if (crng_init_cnt >= CRNG_INIT_CNT_THRESH) {
+                invalidate_batched_entropy();
                 crng_init = 1;
                 wake_up_interruptible(&crng_init_wait);
                 pr_notice("random: fast init done\n");
         }
-        spin_unlock_irqrestore(&primary_crng.lock, flags);
         return 1;
 }
 
@@ -835,13 +841,14 @@ static void crng_reseed(struct crng_state *crng, struct entropy_store *r)
         }
         memzero_explicit(&buf, sizeof(buf));
         crng->init_time = jiffies;
+        spin_unlock_irqrestore(&primary_crng.lock, flags);
         if (crng == &primary_crng && crng_init < 2) {
+                invalidate_batched_entropy();
                 crng_init = 2;
                 process_random_ready_list();
                 wake_up_interruptible(&crng_init_wait);
                 pr_notice("random: crng init done\n");
         }
-        spin_unlock_irqrestore(&primary_crng.lock, flags);
 }
 
 static inline void crng_wait_ready(void)
@@ -1097,12 +1104,16 @@ static void add_interrupt_bench(cycles_t start)
 static __u32 get_reg(struct fast_pool *f, struct pt_regs *regs)
 {
         __u32 *ptr = (__u32 *) regs;
+        unsigned int idx;
 
         if (regs == NULL)
                 return 0;
-        if (f->reg_idx >= sizeof(struct pt_regs) / sizeof(__u32))
-                f->reg_idx = 0;
-        return *(ptr + f->reg_idx++);
+        idx = READ_ONCE(f->reg_idx);
+        if (idx >= sizeof(struct pt_regs) / sizeof(__u32))
+                idx = 0;
+        ptr += idx++;
+        WRITE_ONCE(f->reg_idx, idx);
+        return *ptr;
 }
 
 void add_interrupt_randomness(int irq, int irq_flags)
@@ -2019,6 +2030,7 @@ struct batched_entropy {
         };
         unsigned int position;
 };
+static rwlock_t batched_entropy_reset_lock = __RW_LOCK_UNLOCKED(batched_entropy_reset_lock);
 
 /*
  * Get a random word for internal kernel use only. The quality of the random
@@ -2029,6 +2041,8 @@ static DEFINE_PER_CPU(struct batched_entropy, batched_entropy_u64);
 u64 get_random_u64(void)
 {
         u64 ret;
+        bool use_lock = READ_ONCE(crng_init) < 2;
+        unsigned long flags = 0;
         struct batched_entropy *batch;
 
 #if BITS_PER_LONG == 64
@@ -2041,11 +2055,15 @@ u64 get_random_u64(void)
 #endif
 
         batch = &get_cpu_var(batched_entropy_u64);
+        if (use_lock)
+                read_lock_irqsave(&batched_entropy_reset_lock, flags);
         if (batch->position % ARRAY_SIZE(batch->entropy_u64) == 0) {
                 extract_crng((u8 *)batch->entropy_u64);
                 batch->position = 0;
         }
         ret = batch->entropy_u64[batch->position++];
+        if (use_lock)
+                read_unlock_irqrestore(&batched_entropy_reset_lock, flags);
         put_cpu_var(batched_entropy_u64);
         return ret;
 }
@@ -2055,22 +2073,45 @@ static DEFINE_PER_CPU(struct batched_entropy, batched_entropy_u32);
 u32 get_random_u32(void)
 {
         u32 ret;
+        bool use_lock = READ_ONCE(crng_init) < 2;
+        unsigned long flags = 0;
         struct batched_entropy *batch;
 
         if (arch_get_random_int(&ret))
                 return ret;
 
         batch = &get_cpu_var(batched_entropy_u32);
+        if (use_lock)
+                read_lock_irqsave(&batched_entropy_reset_lock, flags);
         if (batch->position % ARRAY_SIZE(batch->entropy_u32) == 0) {
                 extract_crng((u8 *)batch->entropy_u32);
                 batch->position = 0;
         }
         ret = batch->entropy_u32[batch->position++];
+        if (use_lock)
+                read_unlock_irqrestore(&batched_entropy_reset_lock, flags);
         put_cpu_var(batched_entropy_u32);
         return ret;
 }
 EXPORT_SYMBOL(get_random_u32);
 
+/* It's important to invalidate all potential batched entropy that might
+ * be stored before the crng is initialized, which we can do lazily by
+ * simply resetting the counter to zero so that it's re-extracted on the
+ * next usage. */
+static void invalidate_batched_entropy(void)
+{
+        int cpu;
+        unsigned long flags;
+
+        write_lock_irqsave(&batched_entropy_reset_lock, flags);
+        for_each_possible_cpu (cpu) {
+                per_cpu_ptr(&batched_entropy_u32, cpu)->position = 0;
+                per_cpu_ptr(&batched_entropy_u64, cpu)->position = 0;
+        }
+        write_unlock_irqrestore(&batched_entropy_reset_lock, flags);
+}
+
 /**
  * randomize_page - Generate a random, page aligned address
  * @start:      The smallest acceptable address the caller will take.
diff --git a/drivers/clk/meson/Kconfig b/drivers/clk/meson/Kconfig
index 19480bcc7046..2f29ee1a4d00 100644
--- a/drivers/clk/meson/Kconfig
+++ b/drivers/clk/meson/Kconfig
@@ -14,6 +14,7 @@ config COMMON_CLK_MESON8B
 config COMMON_CLK_GXBB
         bool
         depends on COMMON_CLK_AMLOGIC
+        select RESET_CONTROLLER
         help
           Support for the clock controller on AmLogic S905 devices, aka gxbb.
           Say Y if you want peripherals and CPU frequency scaling to work.
diff --git a/drivers/clk/sunxi-ng/Kconfig b/drivers/clk/sunxi-ng/Kconfig
index b0d551a8efe4..eb89c7801f00 100644
--- a/drivers/clk/sunxi-ng/Kconfig
+++ b/drivers/clk/sunxi-ng/Kconfig
@@ -156,6 +156,7 @@ config SUN8I_R_CCU
         bool "Support for Allwinner SoCs' PRCM CCUs"
         select SUNXI_CCU_DIV
         select SUNXI_CCU_GATE
+        select SUNXI_CCU_MP
         default MACH_SUN8I || (ARCH_SUNXI && ARM64)
 
 endif
diff --git a/drivers/clk/sunxi-ng/ccu-sun50i-a64.h b/drivers/clk/sunxi-ng/ccu-sun50i-a64.h
index 9b3cd24b78d2..061b6fbb4f95 100644
--- a/drivers/clk/sunxi-ng/ccu-sun50i-a64.h
+++ b/drivers/clk/sunxi-ng/ccu-sun50i-a64.h
@@ -31,7 +31,9 @@
 #define CLK_PLL_VIDEO0_2X               8
 #define CLK_PLL_VE                      9
 #define CLK_PLL_DDR0                    10
-#define CLK_PLL_PERIPH0                 11
+
+/* PLL_PERIPH0 exported for PRCM */
+
 #define CLK_PLL_PERIPH0_2X              12
 #define CLK_PLL_PERIPH1                 13
 #define CLK_PLL_PERIPH1_2X              14
diff --git a/drivers/clk/sunxi-ng/ccu-sun5i.c b/drivers/clk/sunxi-ng/ccu-sun5i.c
index 5c476f966a72..5372bf8be5e6 100644
--- a/drivers/clk/sunxi-ng/ccu-sun5i.c
+++ b/drivers/clk/sunxi-ng/ccu-sun5i.c
@@ -243,7 +243,7 @@ static SUNXI_CCU_GATE(ahb_ss_clk,	"ahb-ss",	"ahb",
 static SUNXI_CCU_GATE(ahb_dma_clk,      "ahb-dma",      "ahb",
                       0x060, BIT(6), 0);
 static SUNXI_CCU_GATE(ahb_bist_clk,     "ahb-bist",     "ahb",
-                      0x060, BIT(6), 0);
+                      0x060, BIT(7), 0);
 static SUNXI_CCU_GATE(ahb_mmc0_clk,     "ahb-mmc0",     "ahb",
                       0x060, BIT(8), 0);
 static SUNXI_CCU_GATE(ahb_mmc1_clk,     "ahb-mmc1",     "ahb",
diff --git a/drivers/clk/sunxi-ng/ccu-sun6i-a31.c b/drivers/clk/sunxi-ng/ccu-sun6i-a31.c
index 89e68d29bf45..df97e25aec76 100644
--- a/drivers/clk/sunxi-ng/ccu-sun6i-a31.c
+++ b/drivers/clk/sunxi-ng/ccu-sun6i-a31.c
@@ -556,7 +556,7 @@ static SUNXI_CCU_M_WITH_MUX_GATE(lcd0_ch1_clk, "lcd0-ch1", lcd_ch1_parents,
                                  0x12c, 0, 4, 24, 3, BIT(31),
                                  CLK_SET_RATE_PARENT);
 static SUNXI_CCU_M_WITH_MUX_GATE(lcd1_ch1_clk, "lcd1-ch1", lcd_ch1_parents,
-                                 0x12c, 0, 4, 24, 3, BIT(31),
+                                 0x130, 0, 4, 24, 3, BIT(31),
                                  CLK_SET_RATE_PARENT);
 
 static const char * const csi_sclk_parents[] = { "pll-video0", "pll-video1",
diff --git a/drivers/clk/sunxi-ng/ccu-sun8i-h3.h b/drivers/clk/sunxi-ng/ccu-sun8i-h3.h
index 85973d1e8165..1b4baea37d81 100644
--- a/drivers/clk/sunxi-ng/ccu-sun8i-h3.h
+++ b/drivers/clk/sunxi-ng/ccu-sun8i-h3.h
@@ -29,7 +29,9 @@
 #define CLK_PLL_VIDEO           6
 #define CLK_PLL_VE              7
 #define CLK_PLL_DDR             8
-#define CLK_PLL_PERIPH0         9
+
+/* PLL_PERIPH0 exported for PRCM */
+
 #define CLK_PLL_PERIPH0_2X      10
 #define CLK_PLL_GPU             11
 #define CLK_PLL_PERIPH1         12
diff --git a/drivers/clk/sunxi-ng/ccu-sun8i-v3s.c b/drivers/clk/sunxi-ng/ccu-sun8i-v3s.c
index e58706b40ae9..6297add857b5 100644
--- a/drivers/clk/sunxi-ng/ccu-sun8i-v3s.c
+++ b/drivers/clk/sunxi-ng/ccu-sun8i-v3s.c
@@ -537,7 +537,7 @@ static struct ccu_reset_map sun8i_v3s_ccu_resets[] = {
         [RST_BUS_EMAC]          =  { 0x2c0, BIT(17) },
         [RST_BUS_HSTIMER]       =  { 0x2c0, BIT(19) },
         [RST_BUS_SPI0]          =  { 0x2c0, BIT(20) },
-        [RST_BUS_OTG]           =  { 0x2c0, BIT(23) },
+        [RST_BUS_OTG]           =  { 0x2c0, BIT(24) },
         [RST_BUS_EHCI0]         =  { 0x2c0, BIT(26) },
         [RST_BUS_OHCI0]         =  { 0x2c0, BIT(29) },
 
diff --git a/drivers/clocksource/arm_arch_timer.c b/drivers/clocksource/arm_arch_timer.c
index 4bed671e490e..8b5c30062d99 100644
--- a/drivers/clocksource/arm_arch_timer.c
+++ b/drivers/clocksource/arm_arch_timer.c
@@ -1209,9 +1209,9 @@ arch_timer_mem_frame_get_cntfrq(struct arch_timer_mem_frame *frame)
                 return 0;
         }
 
-        rate = readl_relaxed(frame + CNTFRQ);
+        rate = readl_relaxed(base + CNTFRQ);
 
-        iounmap(frame);
+        iounmap(base);
 
         return rate;
 }
diff --git a/drivers/clocksource/cadence_ttc_timer.c b/drivers/clocksource/cadence_ttc_timer.c
index 44e5e951583b..8e64b8460f11 100644
--- a/drivers/clocksource/cadence_ttc_timer.c
+++ b/drivers/clocksource/cadence_ttc_timer.c
@@ -18,6 +18,7 @@
 #include <linux/clk.h>
 #include <linux/interrupt.h>
 #include <linux/clockchips.h>
+#include <linux/clocksource.h>
 #include <linux/of_address.h>
 #include <linux/of_irq.h>
 #include <linux/slab.h>
diff --git a/drivers/clocksource/timer-sun5i.c b/drivers/clocksource/timer-sun5i.c
index 2e9c830ae1cd..c4656c4d44a6 100644
--- a/drivers/clocksource/timer-sun5i.c
+++ b/drivers/clocksource/timer-sun5i.c
@@ -12,6 +12,7 @@
 
 #include <linux/clk.h>
 #include <linux/clockchips.h>
+#include <linux/clocksource.h>
 #include <linux/delay.h>
 #include <linux/interrupt.h>
 #include <linux/irq.h>
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index 0e3f6496524d..26b643d57847 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -2468,6 +2468,7 @@ int cpufreq_register_driver(struct cpufreq_driver *driver_data)
         if (!(cpufreq_driver->flags & CPUFREQ_STICKY) &&
             list_empty(&cpufreq_policy_list)) {
                 /* if all ->init() calls failed, unregister */
+                ret = -ENODEV;
                 pr_debug("%s: No CPU initialized for driver %s\n", __func__,
                          driver_data->name);
                 goto err_if_unreg;
diff --git a/drivers/cpufreq/cpufreq_conservative.c b/drivers/cpufreq/cpufreq_conservative.c
index 992f7c20760f..88220ff3e1c2 100644
--- a/drivers/cpufreq/cpufreq_conservative.c
+++ b/drivers/cpufreq/cpufreq_conservative.c
@@ -185,8 +185,8 @@ static ssize_t store_down_threshold(struct gov_attr_set *attr_set,
         int ret;
         ret = sscanf(buf, "%u", &input);
 
-        /* cannot be lower than 11 otherwise freq will not fall */
-        if (ret != 1 || input < 11 || input > 100 ||
+        /* cannot be lower than 1 otherwise freq will not fall */
+        if (ret != 1 || input < 1 || input > 100 ||
                         input >= dbs_data->up_threshold)
                 return -EINVAL;
 
diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
index b7de5bd76a31..eb1158532de3 100644
--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -571,9 +571,10 @@ static inline void update_turbo_state(void)
 static int min_perf_pct_min(void)
 {
         struct cpudata *cpu = all_cpu_data[0];
+        int turbo_pstate = cpu->pstate.turbo_pstate;
 
-        return DIV_ROUND_UP(cpu->pstate.min_pstate * 100,
-                            cpu->pstate.turbo_pstate);
+        return turbo_pstate ?
+                DIV_ROUND_UP(cpu->pstate.min_pstate * 100, turbo_pstate) : 0;
 }
 
 static s16 intel_pstate_get_epb(struct cpudata *cpu_data)
diff --git a/drivers/cpufreq/kirkwood-cpufreq.c b/drivers/cpufreq/kirkwood-cpufreq.c
index 1b9bcd76c60e..c2dd43f3f5d8 100644
--- a/drivers/cpufreq/kirkwood-cpufreq.c
+++ b/drivers/cpufreq/kirkwood-cpufreq.c
@@ -127,7 +127,12 @@ static int kirkwood_cpufreq_probe(struct platform_device *pdev)
                 return PTR_ERR(priv.cpu_clk);
         }
 
-        clk_prepare_enable(priv.cpu_clk);
+        err = clk_prepare_enable(priv.cpu_clk);
+        if (err) {
+                dev_err(priv.dev, "Unable to prepare cpuclk\n");
+                return err;
+        }
+
         kirkwood_freq_table[0].frequency = clk_get_rate(priv.cpu_clk) / 1000;
 
         priv.ddr_clk = of_clk_get_by_name(np, "ddrclk");
@@ -137,7 +142,11 @@ static int kirkwood_cpufreq_probe(struct platform_device *pdev)
                 goto out_cpu;
         }
 
-        clk_prepare_enable(priv.ddr_clk);
+        err = clk_prepare_enable(priv.ddr_clk);
+        if (err) {
+                dev_err(priv.dev, "Unable to prepare ddrclk\n");
+                goto out_cpu;
+        }
         kirkwood_freq_table[1].frequency = clk_get_rate(priv.ddr_clk) / 1000;
 
         priv.powersave_clk = of_clk_get_by_name(np, "powersave");
@@ -146,7 +155,11 @@ static int kirkwood_cpufreq_probe(struct platform_device *pdev)
                 err = PTR_ERR(priv.powersave_clk);
                 goto out_ddr;
         }
-        clk_prepare_enable(priv.powersave_clk);
+        err = clk_prepare_enable(priv.powersave_clk);
+        if (err) {
+                dev_err(priv.dev, "Unable to prepare powersave clk\n");
+                goto out_ddr;
+        }
 
         of_node_put(np);
         np = NULL;
diff --git a/drivers/cpuidle/dt_idle_states.c b/drivers/cpuidle/dt_idle_states.c
index ffca4fc0061d..ae8eb0359889 100644
--- a/drivers/cpuidle/dt_idle_states.c
+++ b/drivers/cpuidle/dt_idle_states.c
@@ -180,8 +180,10 @@ int dt_init_idle_driver(struct cpuidle_driver *drv,
                 if (!state_node)
                         break;
 
-                if (!of_device_is_available(state_node))
+                if (!of_device_is_available(state_node)) {
+                        of_node_put(state_node);
                         continue;
+                }
 
                 if (!idle_state_valid(state_node, i, cpumask)) {
                         pr_warn("%s idle state not valid, bailing out\n",
diff --git a/drivers/dax/super.c b/drivers/dax/super.c
index 6ed32aac8bbe..922d0823f8ec 100644
--- a/drivers/dax/super.c
+++ b/drivers/dax/super.c
@@ -210,9 +210,12 @@ EXPORT_SYMBOL_GPL(kill_dax);
 static struct inode *dax_alloc_inode(struct super_block *sb)
 {
         struct dax_device *dax_dev;
+        struct inode *inode;
 
         dax_dev = kmem_cache_alloc(dax_cache, GFP_KERNEL);
-        return &dax_dev->inode;
+        inode = &dax_dev->inode;
+        inode->i_rdev = 0;
+        return inode;
 }
 
 static struct dax_device *to_dax_dev(struct inode *inode)
@@ -227,7 +230,8 @@ static void dax_i_callback(struct rcu_head *head)
 
         kfree(dax_dev->host);
         dax_dev->host = NULL;
-        ida_simple_remove(&dax_minor_ida, MINOR(inode->i_rdev));
+        if (inode->i_rdev)
+                ida_simple_remove(&dax_minor_ida, MINOR(inode->i_rdev));
         kmem_cache_free(dax_cache, dax_dev);
 }
 
@@ -423,6 +427,7 @@ static void init_once(void *_dax_dev)
         struct dax_device *dax_dev = _dax_dev;
         struct inode *inode = &dax_dev->inode;
 
+        memset(dax_dev, 0, sizeof(*dax_dev));
         inode_init_once(inode);
 }
 
diff --git a/drivers/devfreq/event/exynos-nocp.c b/drivers/devfreq/event/exynos-nocp.c
index 5c3e7b11e8a6..f6e7956fc91a 100644
--- a/drivers/devfreq/event/exynos-nocp.c
+++ b/drivers/devfreq/event/exynos-nocp.c
@@ -267,7 +267,11 @@ static int exynos_nocp_probe(struct platform_device *pdev)
         }
         platform_set_drvdata(pdev, nocp);
 
-        clk_prepare_enable(nocp->clk);
+        ret = clk_prepare_enable(nocp->clk);
+        if (ret) {
+                dev_err(&pdev->dev, "failed to prepare ppmu clock\n");
+                return ret;
+        }
 
         pr_info("exynos-nocp: new NoC Probe device registered: %s\n",
                         dev_name(dev));
diff --git a/drivers/devfreq/event/exynos-ppmu.c b/drivers/devfreq/event/exynos-ppmu.c
index 9b7350935b73..d96e3dc71cf8 100644
--- a/drivers/devfreq/event/exynos-ppmu.c
+++ b/drivers/devfreq/event/exynos-ppmu.c
@@ -44,7 +44,7 @@ struct exynos_ppmu {
         { "ppmu-event2-"#name, PPMU_PMNCNT2 },  \
         { "ppmu-event3-"#name, PPMU_PMNCNT3 }
 
-struct __exynos_ppmu_events {
+static struct __exynos_ppmu_events {
         char *name;
         int id;
 } ppmu_events[] = {
@@ -648,7 +648,11 @@ static int exynos_ppmu_probe(struct platform_device *pdev)
                         dev_name(&pdev->dev), desc[i].name);
         }
 
-        clk_prepare_enable(info->ppmu.clk);
+        ret = clk_prepare_enable(info->ppmu.clk);
+        if (ret) {
+                dev_err(&pdev->dev, "failed to prepare ppmu clock\n");
+                return ret;
+        }
 
         return 0;
 }
diff --git a/drivers/dma/ep93xx_dma.c b/drivers/dma/ep93xx_dma.c
index d37e8dda8079..ec240592f5c8 100644
--- a/drivers/dma/ep93xx_dma.c
+++ b/drivers/dma/ep93xx_dma.c
@@ -201,6 +201,7 @@ struct ep93xx_dma_engine {
         struct dma_device       dma_dev;
         bool                    m2m;
         int                     (*hw_setup)(struct ep93xx_dma_chan *);
+        void                    (*hw_synchronize)(struct ep93xx_dma_chan *);
         void                    (*hw_shutdown)(struct ep93xx_dma_chan *);
         void                    (*hw_submit)(struct ep93xx_dma_chan *);
         int                     (*hw_interrupt)(struct ep93xx_dma_chan *);
@@ -323,6 +324,8 @@ static int m2p_hw_setup(struct ep93xx_dma_chan *edmac)
                 | M2P_CONTROL_ENABLE;
         m2p_set_control(edmac, control);
 
+        edmac->buffer = 0;
+
         return 0;
 }
 
@@ -331,21 +334,27 @@ static inline u32 m2p_channel_state(struct ep93xx_dma_chan *edmac)
         return (readl(edmac->regs + M2P_STATUS) >> 4) & 0x3;
 }
 
-static void m2p_hw_shutdown(struct ep93xx_dma_chan *edmac)
+static void m2p_hw_synchronize(struct ep93xx_dma_chan *edmac)
 {
+        unsigned long flags;
         u32 control;
 
+        spin_lock_irqsave(&edmac->lock, flags);
         control = readl(edmac->regs + M2P_CONTROL);
         control &= ~(M2P_CONTROL_STALLINT | M2P_CONTROL_NFBINT);
         m2p_set_control(edmac, control);
+        spin_unlock_irqrestore(&edmac->lock, flags);
 
         while (m2p_channel_state(edmac) >= M2P_STATE_ON)
-                cpu_relax();
+                schedule();
+}
 
+static void m2p_hw_shutdown(struct ep93xx_dma_chan *edmac)
+{
         m2p_set_control(edmac, 0);
 
-        while (m2p_channel_state(edmac) == M2P_STATE_STALL)
-                cpu_relax();
+        while (m2p_channel_state(edmac) != M2P_STATE_IDLE)
+                dev_warn(chan2dev(edmac), "M2P: Not yet IDLE\n");
 }
 
 static void m2p_fill_desc(struct ep93xx_dma_chan *edmac)
@@ -1161,6 +1170,26 @@ fail:
 }
 
 /**
+ * ep93xx_dma_synchronize - Synchronizes the termination of transfers to the
+ * current context.
+ * @chan: channel
+ *
+ * Synchronizes the DMA channel termination to the current context. When this
+ * function returns it is guaranteed that all transfers for previously issued
+ * descriptors have stopped and and it is safe to free the memory associated
+ * with them. Furthermore it is guaranteed that all complete callback functions
+ * for a previously submitted descriptor have finished running and it is safe to
+ * free resources accessed from within the complete callbacks.
+ */
+static void ep93xx_dma_synchronize(struct dma_chan *chan)
+{
+        struct ep93xx_dma_chan *edmac = to_ep93xx_dma_chan(chan);
+
+        if (edmac->edma->hw_synchronize)
+                edmac->edma->hw_synchronize(edmac);
+}
+
+/**
  * ep93xx_dma_terminate_all - terminate all transactions
  * @chan: channel
  *
@@ -1323,6 +1352,7 @@ static int __init ep93xx_dma_probe(struct platform_device *pdev)
         dma_dev->device_prep_slave_sg = ep93xx_dma_prep_slave_sg;
         dma_dev->device_prep_dma_cyclic = ep93xx_dma_prep_dma_cyclic;
         dma_dev->device_config = ep93xx_dma_slave_config;
+        dma_dev->device_synchronize = ep93xx_dma_synchronize;
         dma_dev->device_terminate_all = ep93xx_dma_terminate_all;
         dma_dev->device_issue_pending = ep93xx_dma_issue_pending;
         dma_dev->device_tx_status = ep93xx_dma_tx_status;
@@ -1340,6 +1370,7 @@ static int __init ep93xx_dma_probe(struct platform_device *pdev)
         } else {
                 dma_cap_set(DMA_PRIVATE, dma_dev->cap_mask);
 
+                edma->hw_synchronize = m2p_hw_synchronize;
                 edma->hw_setup = m2p_hw_setup;
                 edma->hw_shutdown = m2p_hw_shutdown;
                 edma->hw_submit = m2p_hw_submit;
diff --git a/drivers/dma/mv_xor_v2.c b/drivers/dma/mv_xor_v2.c
index a28a01fcba67..f3e211f8f6c5 100644
--- a/drivers/dma/mv_xor_v2.c
+++ b/drivers/dma/mv_xor_v2.c
@@ -161,6 +161,7 @@ struct mv_xor_v2_device {
         struct mv_xor_v2_sw_desc *sw_desq;
         int desc_size;
         unsigned int npendings;
+        unsigned int hw_queue_idx;
 };
 
 /**
@@ -214,18 +215,6 @@ static void mv_xor_v2_set_data_buffers(struct mv_xor_v2_device *xor_dev,
 }
 
 /*
- * Return the next available index in the DESQ.
- */
-static int mv_xor_v2_get_desq_write_ptr(struct mv_xor_v2_device *xor_dev)
-{
-        /* read the index for the next available descriptor in the DESQ */
-        u32 reg = readl(xor_dev->dma_base + MV_XOR_V2_DMA_DESQ_ALLOC_OFF);
-
-        return ((reg >> MV_XOR_V2_DMA_DESQ_ALLOC_WRPTR_SHIFT)
-                & MV_XOR_V2_DMA_DESQ_ALLOC_WRPTR_MASK);
-}
-
-/*
  * notify the engine of new descriptors, and update the available index.
  */
 static void mv_xor_v2_add_desc_to_desq(struct mv_xor_v2_device *xor_dev,
@@ -257,22 +246,6 @@ static int mv_xor_v2_set_desc_size(struct mv_xor_v2_device *xor_dev)
         return MV_XOR_V2_EXT_DESC_SIZE;
 }
 
-/*
- * Set the IMSG threshold
- */
-static inline
-void mv_xor_v2_set_imsg_thrd(struct mv_xor_v2_device *xor_dev, int thrd_val)
-{
-        u32 reg;
-
-        reg = readl(xor_dev->dma_base + MV_XOR_V2_DMA_IMSG_THRD_OFF);
-
-        reg &= (~MV_XOR_V2_DMA_IMSG_THRD_MASK << MV_XOR_V2_DMA_IMSG_THRD_SHIFT);
-        reg |= (thrd_val << MV_XOR_V2_DMA_IMSG_THRD_SHIFT);
-
-        writel(reg, xor_dev->dma_base + MV_XOR_V2_DMA_IMSG_THRD_OFF);
-}
-
 static irqreturn_t mv_xor_v2_interrupt_handler(int irq, void *data)
 {
         struct mv_xor_v2_device *xor_dev = data;
@@ -288,12 +261,6 @@ static irqreturn_t mv_xor_v2_interrupt_handler(int irq, void *data)
         if (!ndescs)
                 return IRQ_NONE;
 
-        /*
-         * Update IMSG threshold, to disable new IMSG interrupts until
-         * end of the tasklet
-         */
-        mv_xor_v2_set_imsg_thrd(xor_dev, MV_XOR_V2_DESC_NUM);
-
         /* schedule a tasklet to handle descriptors callbacks */
         tasklet_schedule(&xor_dev->irq_tasklet);
 
@@ -306,7 +273,6 @@ static irqreturn_t mv_xor_v2_interrupt_handler(int irq, void *data)
 static dma_cookie_t
 mv_xor_v2_tx_submit(struct dma_async_tx_descriptor *tx)
 {
-        int desq_ptr;
         void *dest_hw_desc;
         dma_cookie_t cookie;
         struct mv_xor_v2_sw_desc *sw_desc =
@@ -322,15 +288,15 @@ mv_xor_v2_tx_submit(struct dma_async_tx_descriptor *tx)
         spin_lock_bh(&xor_dev->lock);
         cookie = dma_cookie_assign(tx);
 
-        /* get the next available slot in the DESQ */
-        desq_ptr = mv_xor_v2_get_desq_write_ptr(xor_dev);
-
         /* copy the HW descriptor from the SW descriptor to the DESQ */
-        dest_hw_desc = xor_dev->hw_desq_virt + desq_ptr;
+        dest_hw_desc = xor_dev->hw_desq_virt + xor_dev->hw_queue_idx;
 
         memcpy(dest_hw_desc, &sw_desc->hw_desc, xor_dev->desc_size);
 
         xor_dev->npendings++;
+        xor_dev->hw_queue_idx++;
+        if (xor_dev->hw_queue_idx >= MV_XOR_V2_DESC_NUM)
+                xor_dev->hw_queue_idx = 0;
 
         spin_unlock_bh(&xor_dev->lock);
 
@@ -344,6 +310,7 @@ static struct mv_xor_v2_sw_desc	*
 mv_xor_v2_prep_sw_desc(struct mv_xor_v2_device *xor_dev)
 {
         struct mv_xor_v2_sw_desc *sw_desc;
+        bool found = false;
 
         /* Lock the channel */
         spin_lock_bh(&xor_dev->lock);
@@ -355,19 +322,23 @@ mv_xor_v2_prep_sw_desc(struct mv_xor_v2_device *xor_dev)
                 return NULL;
         }
 
-        /* get a free SW descriptor from the SW DESQ */
-        sw_desc = list_first_entry(&xor_dev->free_sw_desc,
-                                   struct mv_xor_v2_sw_desc, free_list);
+        list_for_each_entry(sw_desc, &xor_dev->free_sw_desc, free_list) {
+                if (async_tx_test_ack(&sw_desc->async_tx)) {
+                        found = true;
+                        break;
+                }
+        }
+
+        if (!found) {
+                spin_unlock_bh(&xor_dev->lock);
+                return NULL;
+        }
+
         list_del(&sw_desc->free_list);
 
         /* Release the channel */
         spin_unlock_bh(&xor_dev->lock);
 
-        /* set the async tx descriptor */
-        dma_async_tx_descriptor_init(&sw_desc->async_tx, &xor_dev->dmachan);
-        sw_desc->async_tx.tx_submit = mv_xor_v2_tx_submit;
-        async_tx_ack(&sw_desc->async_tx);
-
         return sw_desc;
 }
 
@@ -389,6 +360,8 @@ mv_xor_v2_prep_dma_memcpy(struct dma_chan *chan, dma_addr_t dest,
                 __func__, len, &src, &dest, flags);
 
         sw_desc = mv_xor_v2_prep_sw_desc(xor_dev);
+        if (!sw_desc)
+                return NULL;
 
         sw_desc->async_tx.flags = flags;
 
@@ -443,6 +416,8 @@ mv_xor_v2_prep_dma_xor(struct dma_chan *chan, dma_addr_t dest, dma_addr_t *src,
                 __func__, src_cnt, len, &dest, flags);
 
         sw_desc = mv_xor_v2_prep_sw_desc(xor_dev);
+        if (!sw_desc)
+                return NULL;
 
         sw_desc->async_tx.flags = flags;
 
@@ -491,6 +466,8 @@ mv_xor_v2_prep_dma_interrupt(struct dma_chan *chan, unsigned long flags)
                 container_of(chan, struct mv_xor_v2_device, dmachan);
 
         sw_desc = mv_xor_v2_prep_sw_desc(xor_dev);
+        if (!sw_desc)
+                return NULL;
 
         /* set the HW descriptor */
         hw_descriptor = &sw_desc->hw_desc;
@@ -554,7 +531,6 @@ static void mv_xor_v2_tasklet(unsigned long data)
 {
         struct mv_xor_v2_device *xor_dev = (struct mv_xor_v2_device *) data;
         int pending_ptr, num_of_pending, i;
-        struct mv_xor_v2_descriptor *next_pending_hw_desc = NULL;
         struct mv_xor_v2_sw_desc *next_pending_sw_desc = NULL;
 
         dev_dbg(xor_dev->dmadev.dev, "%s %d\n", __func__, __LINE__);
@@ -562,17 +538,10 @@ static void mv_xor_v2_tasklet(unsigned long data)
         /* get the pending descriptors parameters */
         num_of_pending = mv_xor_v2_get_pending_params(xor_dev, &pending_ptr);
 
-        /* next HW descriptor */
-        next_pending_hw_desc = xor_dev->hw_desq_virt + pending_ptr;
-
         /* loop over free descriptors */
         for (i = 0; i < num_of_pending; i++) {
-
-                if (pending_ptr > MV_XOR_V2_DESC_NUM)
-                        pending_ptr = 0;
-
-                if (next_pending_sw_desc != NULL)
-                        next_pending_hw_desc++;
+                struct mv_xor_v2_descriptor *next_pending_hw_desc =
+                        xor_dev->hw_desq_virt + pending_ptr;
 
                 /* get the SW descriptor related to the HW descriptor */
                 next_pending_sw_desc =
@@ -608,15 +577,14 @@ static void mv_xor_v2_tasklet(unsigned long data)
 
                 /* increment the next descriptor */
                 pending_ptr++;
+                if (pending_ptr >= MV_XOR_V2_DESC_NUM)
+                        pending_ptr = 0;
         }
 
         if (num_of_pending != 0) {
                 /* free the descriptores */
                 mv_xor_v2_free_desc_from_desq(xor_dev, num_of_pending);
         }
-
-        /* Update IMSG threshold, to enable new IMSG interrupts */
-        mv_xor_v2_set_imsg_thrd(xor_dev, 0);
 }
 
 /*
@@ -648,9 +616,6 @@ static int mv_xor_v2_descq_init(struct mv_xor_v2_device *xor_dev)
         writel((xor_dev->hw_desq & 0xFFFF00000000) >> 32,
                xor_dev->dma_base + MV_XOR_V2_DMA_DESQ_BAHR_OFF);
 
-        /* enable the DMA engine */
-        writel(0, xor_dev->dma_base + MV_XOR_V2_DMA_DESQ_STOP_OFF);
-
         /*
          * This is a temporary solution, until we activate the
          * SMMU. Set the attributes for reading & writing data buffers
@@ -694,6 +659,9 @@ static int mv_xor_v2_descq_init(struct mv_xor_v2_device *xor_dev)
         reg |= MV_XOR_V2_GLOB_PAUSE_AXI_TIME_DIS_VAL;
         writel(reg, xor_dev->glob_base + MV_XOR_V2_GLOB_PAUSE);
 
+        /* enable the DMA engine */
+        writel(0, xor_dev->dma_base + MV_XOR_V2_DMA_DESQ_STOP_OFF);
+
         return 0;
 }
 
@@ -725,6 +693,10 @@ static int mv_xor_v2_probe(struct platform_device *pdev)
 
         platform_set_drvdata(pdev, xor_dev);
 
+        ret = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(40));
+        if (ret)
+                return ret;
+
         xor_dev->clk = devm_clk_get(&pdev->dev, NULL);
         if (IS_ERR(xor_dev->clk) && PTR_ERR(xor_dev->clk) == -EPROBE_DEFER)
                 return -EPROBE_DEFER;
@@ -785,8 +757,15 @@ static int mv_xor_v2_probe(struct platform_device *pdev)
 
         /* add all SW descriptors to the free list */
         for (i = 0; i < MV_XOR_V2_DESC_NUM; i++) {
-                xor_dev->sw_desq[i].idx = i;
-                list_add(&xor_dev->sw_desq[i].free_list,
+                struct mv_xor_v2_sw_desc *sw_desc =
+                        xor_dev->sw_desq + i;
+                sw_desc->idx = i;
+                dma_async_tx_descriptor_init(&sw_desc->async_tx,
+                                             &xor_dev->dmachan);
+                sw_desc->async_tx.tx_submit = mv_xor_v2_tx_submit;
+                async_tx_ack(&sw_desc->async_tx);
+
+                list_add(&sw_desc->free_list,
                          &xor_dev->free_sw_desc);
         }
 
diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c
index 8b0da7fa520d..e90a7a0d760a 100644
--- a/drivers/dma/pl330.c
+++ b/drivers/dma/pl330.c
@@ -3008,7 +3008,8 @@ static int pl330_remove(struct amba_device *adev)
 
         for (i = 0; i < AMBA_NR_IRQS; i++) {
                 irq = adev->irq[i];
-                devm_free_irq(&adev->dev, irq, pl330);
+                if (irq)
+                        devm_free_irq(&adev->dev, irq, pl330);
         }
 
         dma_async_device_unregister(&pl330->ddma);
diff --git a/drivers/dma/sh/rcar-dmac.c b/drivers/dma/sh/rcar-dmac.c
index db41795fe42a..bd261c9e9664 100644
--- a/drivers/dma/sh/rcar-dmac.c
+++ b/drivers/dma/sh/rcar-dmac.c
@@ -1287,6 +1287,9 @@ static unsigned int rcar_dmac_chan_get_residue(struct rcar_dmac_chan *chan,
         if (desc->hwdescs.use) {
                 dptr = (rcar_dmac_chan_read(chan, RCAR_DMACHCRB) &
                         RCAR_DMACHCRB_DPTR_MASK) >> RCAR_DMACHCRB_DPTR_SHIFT;
+                if (dptr == 0)
+                        dptr = desc->nchunks;
+                dptr--;
                 WARN_ON(dptr >= desc->nchunks);
         } else {
                 running = desc->running;
diff --git a/drivers/dma/sh/usb-dmac.c b/drivers/dma/sh/usb-dmac.c
index 72c649713ace..31a145154e9f 100644
--- a/drivers/dma/sh/usb-dmac.c
+++ b/drivers/dma/sh/usb-dmac.c
@@ -117,7 +117,7 @@ struct usb_dmac {
 #define USB_DMASWR                      0x0008
 #define USB_DMASWR_SWR                  (1 << 0)
 #define USB_DMAOR                       0x0060
-#define USB_DMAOR_AE                    (1 << 2)
+#define USB_DMAOR_AE                    (1 << 1)
 #define USB_DMAOR_DME                   (1 << 0)
 
 #define USB_DMASAR                      0x0000
diff --git a/drivers/firmware/dmi-id.c b/drivers/firmware/dmi-id.c
index 44c01390d035..951b6c79f166 100644
--- a/drivers/firmware/dmi-id.c
+++ b/drivers/firmware/dmi-id.c
@@ -47,6 +47,7 @@ DEFINE_DMI_ATTR_WITH_SHOW(product_name,		0444, DMI_PRODUCT_NAME);
 DEFINE_DMI_ATTR_WITH_SHOW(product_version,      0444, DMI_PRODUCT_VERSION);
 DEFINE_DMI_ATTR_WITH_SHOW(product_serial,       0400, DMI_PRODUCT_SERIAL);
 DEFINE_DMI_ATTR_WITH_SHOW(product_uuid,         0400, DMI_PRODUCT_UUID);
+DEFINE_DMI_ATTR_WITH_SHOW(product_family,       0444, DMI_PRODUCT_FAMILY);
 DEFINE_DMI_ATTR_WITH_SHOW(board_vendor,         0444, DMI_BOARD_VENDOR);
 DEFINE_DMI_ATTR_WITH_SHOW(board_name,           0444, DMI_BOARD_NAME);
 DEFINE_DMI_ATTR_WITH_SHOW(board_version,        0444, DMI_BOARD_VERSION);
@@ -191,6 +192,7 @@ static void __init dmi_id_init_attr_table(void)
         ADD_DMI_ATTR(product_version,   DMI_PRODUCT_VERSION);
         ADD_DMI_ATTR(product_serial,    DMI_PRODUCT_SERIAL);
         ADD_DMI_ATTR(product_uuid,      DMI_PRODUCT_UUID);
+        ADD_DMI_ATTR(product_family,    DMI_PRODUCT_FAMILY);
         ADD_DMI_ATTR(board_vendor,      DMI_BOARD_VENDOR);
         ADD_DMI_ATTR(board_name,        DMI_BOARD_NAME);
         ADD_DMI_ATTR(board_version,     DMI_BOARD_VERSION);
diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c
index 54be60ead08f..783041964439 100644
--- a/drivers/firmware/dmi_scan.c
+++ b/drivers/firmware/dmi_scan.c
@@ -144,7 +144,7 @@ static int __init dmi_walk_early(void (*decode)(const struct dmi_header *,
 
         buf = dmi_early_remap(dmi_base, orig_dmi_len);
         if (buf == NULL)
-                return -1;
+                return -ENOMEM;
 
         dmi_decode_table(buf, decode, NULL);
 
@@ -178,7 +178,7 @@ static void __init dmi_save_ident(const struct dmi_header *dm, int slot,
         const char *d = (const char *) dm;
         const char *p;
 
-        if (dmi_ident[slot])
+        if (dmi_ident[slot] || dm->length <= string)
                 return;
 
         p = dmi_string(dm, d[string]);
@@ -191,13 +191,14 @@ static void __init dmi_save_ident(const struct dmi_header *dm, int slot,
 static void __init dmi_save_uuid(const struct dmi_header *dm, int slot,
                 int index)
 {
-        const u8 *d = (u8 *) dm + index;
+        const u8 *d;
         char *s;
         int is_ff = 1, is_00 = 1, i;
 
-        if (dmi_ident[slot])
+        if (dmi_ident[slot] || dm->length <= index + 16)
                 return;
 
+        d = (u8 *) dm + index;
         for (i = 0; i < 16 && (is_ff || is_00); i++) {
                 if (d[i] != 0x00)
                         is_00 = 0;
@@ -228,16 +229,17 @@ static void __init dmi_save_uuid(const struct dmi_header *dm, int slot,
 static void __init dmi_save_type(const struct dmi_header *dm, int slot,
                 int index)
 {
-        const u8 *d = (u8 *) dm + index;
+        const u8 *d;
         char *s;
 
-        if (dmi_ident[slot])
+        if (dmi_ident[slot] || dm->length <= index)
                 return;
 
         s = dmi_alloc(4);
         if (!s)
                 return;
 
+        d = (u8 *) dm + index;
         sprintf(s, "%u", *d & 0x7F);
         dmi_ident[slot] = s;
 }
@@ -278,9 +280,13 @@ static void __init dmi_save_devices(const struct dmi_header *dm)
 
 static void __init dmi_save_oem_strings_devices(const struct dmi_header *dm)
 {
-        int i, count = *(u8 *)(dm + 1);
+        int i, count;
         struct dmi_device *dev;
 
+        if (dm->length < 0x05)
+                return;
+
+        count = *(u8 *)(dm + 1);
         for (i = 1; i <= count; i++) {
                 const char *devname = dmi_string(dm, i);
 
@@ -353,6 +359,9 @@ static void __init dmi_save_extended_devices(const struct dmi_header *dm)
         const char *name;
         const u8 *d = (u8 *)dm;
 
+        if (dm->length < 0x0B)
+                return;
+
         /* Skip disabled device */
         if ((d[0x5] & 0x80) == 0)
                 return;
@@ -387,7 +396,7 @@ static void __init save_mem_devices(const struct dmi_header *dm, void *v)
         const char *d = (const char *)dm;
         static int nr;
 
-        if (dm->type != DMI_ENTRY_MEM_DEVICE)
+        if (dm->type != DMI_ENTRY_MEM_DEVICE || dm->length < 0x12)
                 return;
         if (nr >= dmi_memdev_nr) {
                 pr_warn(FW_BUG "Too many DIMM entries in SMBIOS table\n");
@@ -430,6 +439,7 @@ static void __init dmi_decode(const struct dmi_header *dm, void *dummy)
                 dmi_save_ident(dm, DMI_PRODUCT_VERSION, 6);
                 dmi_save_ident(dm, DMI_PRODUCT_SERIAL, 7);
                 dmi_save_uuid(dm, DMI_PRODUCT_UUID, 8);
+                dmi_save_ident(dm, DMI_PRODUCT_FAMILY, 26);
                 break;
         case 2:         /* Base Board Information */
                 dmi_save_ident(dm, DMI_BOARD_VENDOR, 4);
@@ -649,6 +659,21 @@ void __init dmi_scan_machine(void)
                         goto error;
 
                 /*
+                 * Same logic as above, look for a 64-bit entry point
+                 * first, and if not found, fall back to 32-bit entry point.
+                 */
+                memcpy_fromio(buf, p, 16);
+                for (q = p + 16; q < p + 0x10000; q += 16) {
+                        memcpy_fromio(buf + 16, q, 16);
+                        if (!dmi_smbios3_present(buf)) {
+                                dmi_available = 1;
+                                dmi_early_unmap(p, 0x10000);
+                                goto out;
+                        }
+                        memcpy(buf, buf + 16, 16);
+                }
+
+                /*
                  * Iterate over all possible DMI header addresses q.
                  * Maintain the 32 bytes around q in buf.  On the
                  * first iteration, substitute zero for the
@@ -658,7 +683,7 @@ void __init dmi_scan_machine(void)
                 memset(buf, 0, 16);
                 for (q = p; q < p + 0x10000; q += 16) {
                         memcpy_fromio(buf + 16, q, 16);
-                        if (!dmi_smbios3_present(buf) || !dmi_present(buf)) {
+                        if (!dmi_present(buf)) {
                                 dmi_available = 1;
                                 dmi_early_unmap(p, 0x10000);
                                 goto out;
@@ -992,7 +1017,8 @@ EXPORT_SYMBOL(dmi_get_date);
  *      @decode: Callback function
  *      @private_data: Private data to be passed to the callback function
  *
- *      Returns -1 when the DMI table can't be reached, 0 on success.
+ *      Returns 0 on success, -ENXIO if DMI is not selected or not present,
+ *      or a different negative error code if DMI walking fails.
  */
 int dmi_walk(void (*decode)(const struct dmi_header *, void *),
              void *private_data)
@@ -1000,11 +1026,11 @@ int dmi_walk(void (*decode)(const struct dmi_header *, void *),
         u8 *buf;
 
         if (!dmi_available)
-                return -1;
+                return -ENXIO;
 
         buf = dmi_remap(dmi_base, dmi_len);
         if (buf == NULL)
-                return -1;
+                return -ENOMEM;
 
         dmi_decode_table(buf, decode, private_data);
 
diff --git a/drivers/firmware/efi/efi-bgrt.c b/drivers/firmware/efi/efi-bgrt.c
index 04ca8764f0c0..b58233e4ed71 100644
--- a/drivers/firmware/efi/efi-bgrt.c
+++ b/drivers/firmware/efi/efi-bgrt.c
@@ -27,6 +27,26 @@ struct bmp_header {
         u32 size;
 } __packed;
 
+static bool efi_bgrt_addr_valid(u64 addr)
+{
+        efi_memory_desc_t *md;
+
+        for_each_efi_memory_desc(md) {
+                u64 size;
+                u64 end;
+
+                if (md->type != EFI_BOOT_SERVICES_DATA)
+                        continue;
+
+                size = md->num_pages << EFI_PAGE_SHIFT;
+                end = md->phys_addr + size;
+                if (addr >= md->phys_addr && addr < end)
+                        return true;
+        }
+
+        return false;
+}
+
 void __init efi_bgrt_init(struct acpi_table_header *table)
 {
         void *image;
@@ -36,6 +56,9 @@ void __init efi_bgrt_init(struct acpi_table_header *table)
         if (acpi_disabled)
                 return;
 
+        if (!efi_enabled(EFI_MEMMAP))
+                return;
+
         if (table->length < sizeof(bgrt_tab)) {
                 pr_notice("Ignoring BGRT: invalid length %u (expected %zu)\n",
                        table->length, sizeof(bgrt_tab));
@@ -62,6 +85,10 @@ void __init efi_bgrt_init(struct acpi_table_header *table)
                 goto out;
         }
 
+        if (!efi_bgrt_addr_valid(bgrt->image_address)) {
+                pr_notice("Ignoring BGRT: invalid image address\n");
+                goto out;
+        }
         image = early_memremap(bgrt->image_address, sizeof(bmp_header));
         if (!image) {
                 pr_notice("Ignoring BGRT: failed to map image header memory\n");
diff --git a/drivers/firmware/efi/libstub/secureboot.c b/drivers/firmware/efi/libstub/secureboot.c
index 8c34d50a4d80..959777ec8a77 100644
--- a/drivers/firmware/efi/libstub/secureboot.c
+++ b/drivers/firmware/efi/libstub/secureboot.c
@@ -16,10 +16,10 @@
 
 /* BIOS variables */
 static const efi_guid_t efi_variable_guid = EFI_GLOBAL_VARIABLE_GUID;
-static const efi_char16_t const efi_SecureBoot_name[] = {
+static const efi_char16_t efi_SecureBoot_name[] = {
         'S', 'e', 'c', 'u', 'r', 'e', 'B', 'o', 'o', 't', 0
 };
-static const efi_char16_t const efi_SetupMode_name[] = {
+static const efi_char16_t efi_SetupMode_name[] = {
         'S', 'e', 't', 'u', 'p', 'M', 'o', 'd', 'e', 0
 };
 
diff --git a/drivers/firmware/google/vpd.c b/drivers/firmware/google/vpd.c
index 1e7860f02f4f..31058d400bda 100644
--- a/drivers/firmware/google/vpd.c
+++ b/drivers/firmware/google/vpd.c
@@ -136,12 +136,12 @@ static int vpd_section_attrib_add(const u8 *key, s32 key_len,
         info->value = value;
 
         INIT_LIST_HEAD(&info->list);
-        list_add_tail(&info->list, &sec->attribs);
 
         ret = sysfs_create_bin_file(sec->kobj, &info->bin_attr);
         if (ret)
                 goto free_info_key;
 
+        list_add_tail(&info->list, &sec->attribs);
         return 0;
 
 free_info_key:
@@ -158,8 +158,8 @@ static void vpd_section_attrib_destroy(struct vpd_section *sec)
         struct vpd_attrib_info *temp;
 
         list_for_each_entry_safe(info, temp, &sec->attribs, list) {
-                kfree(info->key);
                 sysfs_remove_bin_file(sec->kobj, &info->bin_attr);
+                kfree(info->key);
                 kfree(info);
         }
 }
@@ -244,7 +244,7 @@ static int vpd_section_destroy(struct vpd_section *sec)
 {
         if (sec->enabled) {
                 vpd_section_attrib_destroy(sec);
-                kobject_del(sec->kobj);
+                kobject_put(sec->kobj);
                 sysfs_remove_bin_file(vpd_kobj, &sec->bin_attr);
                 kfree(sec->raw_name);
                 iounmap(sec->baseaddr);
@@ -331,7 +331,7 @@ static void __exit vpd_platform_exit(void)
 {
         vpd_section_destroy(&ro_vpd);
         vpd_section_destroy(&rw_vpd);
-        kobject_del(vpd_kobj);
+        kobject_put(vpd_kobj);
 }
 
 module_init(vpd_platform_init);
diff --git a/drivers/gpio/gpio-aspeed.c b/drivers/gpio/gpio-aspeed.c
index ccea609676ee..4ca436e66bdb 100644
--- a/drivers/gpio/gpio-aspeed.c
+++ b/drivers/gpio/gpio-aspeed.c
@@ -646,6 +646,9 @@ static int enable_debounce(struct gpio_chip *chip, unsigned int offset,
         int rc;
         int i;
 
+        if (!gpio->clk)
+                return -EINVAL;
+
         rc = usecs_to_cycles(gpio, usecs, &requested_cycles);
         if (rc < 0) {
                 dev_warn(chip->parent, "Failed to convert %luus to cycles at %luHz: %d\n",
diff --git a/drivers/gpio/gpio-crystalcove.c b/drivers/gpio/gpio-crystalcove.c
index 2197368cc899..e60156ec0c18 100644
--- a/drivers/gpio/gpio-crystalcove.c
+++ b/drivers/gpio/gpio-crystalcove.c
@@ -90,8 +90,18 @@ static inline int to_reg(int gpio, enum ctrl_register reg_type)
 {
         int reg;
 
-        if (gpio == 94)
-                return GPIOPANELCTL;
+        if (gpio >= CRYSTALCOVE_GPIO_NUM) {
+                /*
+                 * Virtual GPIO called from ACPI, for now we only support
+                 * the panel ctl.
+                 */
+                switch (gpio) {
+                case 0x5e:
+                        return GPIOPANELCTL;
+                default:
+                        return -EOPNOTSUPP;
+                }
+        }
 
         if (reg_type == CTRL_IN) {
                 if (gpio < 8)
@@ -130,36 +140,36 @@ static void crystalcove_update_irq_ctrl(struct crystalcove_gpio *cg, int gpio)
 static int crystalcove_gpio_dir_in(struct gpio_chip *chip, unsigned gpio)
 {
         struct crystalcove_gpio *cg = gpiochip_get_data(chip);
+        int reg = to_reg(gpio, CTRL_OUT);
 
-        if (gpio > CRYSTALCOVE_VGPIO_NUM)
+        if (reg < 0)
                 return 0;
 
-        return regmap_write(cg->regmap, to_reg(gpio, CTRL_OUT),
-                            CTLO_INPUT_SET);
+        return regmap_write(cg->regmap, reg, CTLO_INPUT_SET);
 }
 
 static int crystalcove_gpio_dir_out(struct gpio_chip *chip, unsigned gpio,
                                     int value)
 {
         struct crystalcove_gpio *cg = gpiochip_get_data(chip);
+        int reg = to_reg(gpio, CTRL_OUT);
 
-        if (gpio > CRYSTALCOVE_VGPIO_NUM)
+        if (reg < 0)
                 return 0;
 
-        return regmap_write(cg->regmap, to_reg(gpio, CTRL_OUT),
-                            CTLO_OUTPUT_SET | value);
+        return regmap_write(cg->regmap, reg, CTLO_OUTPUT_SET | value);
 }
 
 static int crystalcove_gpio_get(struct gpio_chip *chip, unsigned gpio)
 {
         struct crystalcove_gpio *cg = gpiochip_get_data(chip);
-        int ret;
         unsigned int val;
+        int ret, reg = to_reg(gpio, CTRL_IN);
 
-        if (gpio > CRYSTALCOVE_VGPIO_NUM)
+        if (reg < 0)
                 return 0;
 
-        ret = regmap_read(cg->regmap, to_reg(gpio, CTRL_IN), &val);
+        ret = regmap_read(cg->regmap, reg, &val);
         if (ret)
                 return ret;
 
@@ -170,14 +180,15 @@ static void crystalcove_gpio_set(struct gpio_chip *chip,
                                  unsigned gpio, int value)
 {
         struct crystalcove_gpio *cg = gpiochip_get_data(chip);
+        int reg = to_reg(gpio, CTRL_OUT);
 
-        if (gpio > CRYSTALCOVE_VGPIO_NUM)
+        if (reg < 0)
                 return;
 
         if (value)
-                regmap_update_bits(cg->regmap, to_reg(gpio, CTRL_OUT), 1, 1);
+                regmap_update_bits(cg->regmap, reg, 1, 1);
         else
-                regmap_update_bits(cg->regmap, to_reg(gpio, CTRL_OUT), 1, 0);
+                regmap_update_bits(cg->regmap, reg, 1, 0);
 }
 
 static int crystalcove_irq_type(struct irq_data *data, unsigned type)
@@ -185,6 +196,9 @@ static int crystalcove_irq_type(struct irq_data *data, unsigned type)
         struct crystalcove_gpio *cg =
                 gpiochip_get_data(irq_data_get_irq_chip_data(data));
 
+        if (data->hwirq >= CRYSTALCOVE_GPIO_NUM)
+                return 0;
+
         switch (type) {
         case IRQ_TYPE_NONE:
                 cg->intcnt_value = CTLI_INTCNT_DIS;
@@ -235,8 +249,10 @@ static void crystalcove_irq_unmask(struct irq_data *data)
         struct crystalcove_gpio *cg =
                 gpiochip_get_data(irq_data_get_irq_chip_data(data));
 
-        cg->set_irq_mask = false;
-        cg->update |= UPDATE_IRQ_MASK;
+        if (data->hwirq < CRYSTALCOVE_GPIO_NUM) {
+                cg->set_irq_mask = false;
+                cg->update |= UPDATE_IRQ_MASK;
+        }
 }
 
 static void crystalcove_irq_mask(struct irq_data *data)
@@ -244,8 +260,10 @@ static void crystalcove_irq_mask(struct irq_data *data)
         struct crystalcove_gpio *cg =
                 gpiochip_get_data(irq_data_get_irq_chip_data(data));
 
-        cg->set_irq_mask = true;
-        cg->update |= UPDATE_IRQ_MASK;
+        if (data->hwirq < CRYSTALCOVE_GPIO_NUM) {
+                cg->set_irq_mask = true;
+                cg->update |= UPDATE_IRQ_MASK;
+        }
 }
 
 static struct irq_chip crystalcove_irqchip = {
diff --git a/drivers/gpio/gpio-mvebu.c b/drivers/gpio/gpio-mvebu.c
index 19a92efabbef..c83ea68be792 100644
--- a/drivers/gpio/gpio-mvebu.c
+++ b/drivers/gpio/gpio-mvebu.c
@@ -721,7 +721,7 @@ static int mvebu_pwm_probe(struct platform_device *pdev,
         u32 set;
 
         if (!of_device_is_compatible(mvchip->chip.of_node,
-                                     "marvell,armada-370-xp-gpio"))
+                                     "marvell,armada-370-gpio"))
                 return 0;
 
         if (IS_ERR(mvchip->clk))
@@ -747,7 +747,7 @@ static int mvebu_pwm_probe(struct platform_device *pdev,
                 set = U32_MAX;
         else
                 return -EINVAL;
-        writel_relaxed(0, mvebu_gpioreg_blink_counter_select(mvchip));
+        writel_relaxed(set, mvebu_gpioreg_blink_counter_select(mvchip));
 
         mvpwm = devm_kzalloc(dev, sizeof(struct mvebu_pwm), GFP_KERNEL);
         if (!mvpwm)
@@ -768,6 +768,13 @@ static int mvebu_pwm_probe(struct platform_device *pdev,
         mvpwm->chip.dev = dev;
         mvpwm->chip.ops = &mvebu_pwm_ops;
         mvpwm->chip.npwm = mvchip->chip.ngpio;
+        /*
+         * There may already be some PWM allocated, so we can't force
+         * mvpwm->chip.base to a fixed point like mvchip->chip.base.
+         * So, we let pwmchip_add() do the numbering and take the next free
+         * region.
+         */
+        mvpwm->chip.base = -1;
 
         spin_lock_init(&mvpwm->lock);
 
@@ -845,7 +852,7 @@ static const struct of_device_id mvebu_gpio_of_match[] = {
                 .data       = (void *) MVEBU_GPIO_SOC_VARIANT_ARMADAXP,
         },
         {
-                .compatible = "marvell,armada-370-xp-gpio",
+                .compatible = "marvell,armada-370-gpio",
                 .data       = (void *) MVEBU_GPIO_SOC_VARIANT_ORION,
         },
         {
@@ -1121,7 +1128,7 @@ static int mvebu_gpio_probe(struct platform_device *pdev)
                                                  mvchip);
         }
 
-        /* Armada 370/XP has simple PWM support for GPIO lines */
+        /* Some MVEBU SoCs have simple PWM support for GPIO lines */
         if (IS_ENABLED(CONFIG_PWM))
                 return mvebu_pwm_probe(pdev, mvchip, id);
 
diff --git a/drivers/gpio/gpiolib-acpi.c b/drivers/gpio/gpiolib-acpi.c
index 2185232da823..8fa5fcd00e9a 100644
--- a/drivers/gpio/gpiolib-acpi.c
+++ b/drivers/gpio/gpiolib-acpi.c
@@ -201,7 +201,7 @@ static acpi_status acpi_gpiochip_request_interrupt(struct acpi_resource *ares,
                         handler = acpi_gpio_irq_handler_evt;
         }
         if (!handler)
-                return AE_BAD_PARAMETER;
+                return AE_OK;
 
         pin = acpi_gpiochip_pin_to_gpio_offset(chip->gpiodev, pin);
         if (pin < 0)
diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index 5db44139cef8..a42a1eea5714 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -708,7 +708,8 @@ static irqreturn_t lineevent_irq_thread(int irq, void *p)
 
         ge.timestamp = ktime_get_real_ns();
 
-        if (le->eflags & GPIOEVENT_REQUEST_BOTH_EDGES) {
+        if (le->eflags & GPIOEVENT_REQUEST_RISING_EDGE
+            && le->eflags & GPIOEVENT_REQUEST_FALLING_EDGE) {
                 int level = gpiod_get_value_cansleep(le->desc);
 
                 if (level)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c
index 1cf78f4dd339..1e8e1123ddf4 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c
@@ -693,6 +693,10 @@ int amdgpu_atombios_get_clock_info(struct amdgpu_device *adev)
                         DRM_INFO("Changing default dispclk from %dMhz to 600Mhz\n",
                                  adev->clock.default_dispclk / 100);
                         adev->clock.default_dispclk = 60000;
+                } else if (adev->clock.default_dispclk <= 60000) {
+                        DRM_INFO("Changing default dispclk from %dMhz to 625Mhz\n",
+                                 adev->clock.default_dispclk / 100);
+                        adev->clock.default_dispclk = 62500;
                 }
                 adev->clock.dp_extclk =
                         le16_to_cpu(firmware_info->info_21.usUniphyDPModeExtClkFreq);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
index f2d705e6a75a..ab6b0d0febab 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
@@ -449,6 +449,7 @@ static const struct pci_device_id pciidlist[] = {
         {0x1002, 0x6986, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS12},
         {0x1002, 0x6987, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS12},
         {0x1002, 0x6995, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS12},
+        {0x1002, 0x6997, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS12},
         {0x1002, 0x699F, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS12},
         /* Vega 10 */
         {0x1002, 0x6860, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VEGA10|AMD_EXP_HW_SUPPORT},
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c
index a4831fe0223b..a2c59a08b2bd 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c
@@ -220,9 +220,9 @@ static void amdgpu_vram_mgr_debug(struct ttm_mem_type_manager *man,
 }
 
 const struct ttm_mem_type_manager_func amdgpu_vram_mgr_func = {
-        amdgpu_vram_mgr_init,
-        amdgpu_vram_mgr_fini,
-        amdgpu_vram_mgr_new,
-        amdgpu_vram_mgr_del,
-        amdgpu_vram_mgr_debug
+        .init           = amdgpu_vram_mgr_init,
+        .takedown       = amdgpu_vram_mgr_fini,
+        .get_node       = amdgpu_vram_mgr_new,
+        .put_node       = amdgpu_vram_mgr_del,
+        .debug          = amdgpu_vram_mgr_debug
 };
diff --git a/drivers/gpu/drm/amd/amdgpu/atombios_crtc.c b/drivers/gpu/drm/amd/amdgpu/atombios_crtc.c
index 8c9bc75a9c2d..8a0818b23ea4 100644
--- a/drivers/gpu/drm/amd/amdgpu/atombios_crtc.c
+++ b/drivers/gpu/drm/amd/amdgpu/atombios_crtc.c
@@ -165,7 +165,7 @@ void amdgpu_atombios_crtc_powergate(struct drm_crtc *crtc, int state)
         struct drm_device *dev = crtc->dev;
         struct amdgpu_device *adev = dev->dev_private;
         int index = GetIndexIntoMasterTable(COMMAND, EnableDispPowerGating);
-        ENABLE_DISP_POWER_GATING_PARAMETERS_V2_1 args;
+        ENABLE_DISP_POWER_GATING_PS_ALLOCATION args;
 
         memset(&args, 0, sizeof(args));
 
@@ -178,7 +178,7 @@ void amdgpu_atombios_crtc_powergate(struct drm_crtc *crtc, int state)
 void amdgpu_atombios_crtc_powergate_init(struct amdgpu_device *adev)
 {
         int index = GetIndexIntoMasterTable(COMMAND, EnableDispPowerGating);
-        ENABLE_DISP_POWER_GATING_PARAMETERS_V2_1 args;
+        ENABLE_DISP_POWER_GATING_PS_ALLOCATION args;
 
         memset(&args, 0, sizeof(args));
 
diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c
index 0cdeb6a2e4a0..5dffa27afa45 100644
--- a/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c
@@ -1207,8 +1207,11 @@ static void dce_v10_0_program_watermarks(struct amdgpu_device *adev,
         u32 tmp, wm_mask, lb_vblank_lead_lines = 0;
 
         if (amdgpu_crtc->base.enabled && num_heads && mode) {
-                active_time = 1000000UL * (u32)mode->crtc_hdisplay / (u32)mode->clock;
-                line_time = min((u32) (1000000UL * (u32)mode->crtc_htotal / (u32)mode->clock), (u32)65535);
+                active_time = (u32) div_u64((u64)mode->crtc_hdisplay * 1000000,
+                                            (u32)mode->clock);
+                line_time = (u32) div_u64((u64)mode->crtc_htotal * 1000000,
+                                          (u32)mode->clock);
+                line_time = min(line_time, (u32)65535);
 
                 /* watermark for high clocks */
                 if (adev->pm.dpm_enabled) {
diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c
index 773654a19749..47bbc87f96d2 100644
--- a/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c
@@ -1176,8 +1176,11 @@ static void dce_v11_0_program_watermarks(struct amdgpu_device *adev,
         u32 tmp, wm_mask, lb_vblank_lead_lines = 0;
 
         if (amdgpu_crtc->base.enabled && num_heads && mode) {
-                active_time = 1000000UL * (u32)mode->crtc_hdisplay / (u32)mode->clock;
-                line_time = min((u32) (1000000UL * (u32)mode->crtc_htotal / (u32)mode->clock), (u32)65535);
+                active_time = (u32) div_u64((u64)mode->crtc_hdisplay * 1000000,
+                                            (u32)mode->clock);
+                line_time = (u32) div_u64((u64)mode->crtc_htotal * 1000000,
+                                          (u32)mode->clock);
+                line_time = min(line_time, (u32)65535);
 
                 /* watermark for high clocks */
                 if (adev->pm.dpm_enabled) {
diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v6_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v6_0.c
index 1f3552967ba3..d8c9a959493e 100644
--- a/drivers/gpu/drm/amd/amdgpu/dce_v6_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/dce_v6_0.c
@@ -983,8 +983,11 @@ static void dce_v6_0_program_watermarks(struct amdgpu_device *adev,
         fixed20_12 a, b, c;
 
         if (amdgpu_crtc->base.enabled && num_heads && mode) {
-                active_time = 1000000UL * (u32)mode->crtc_hdisplay / (u32)mode->clock;
-                line_time = min((u32) (1000000UL * (u32)mode->crtc_htotal / (u32)mode->clock), (u32)65535);
+                active_time = (u32) div_u64((u64)mode->crtc_hdisplay * 1000000,
+                                            (u32)mode->clock);
+                line_time = (u32) div_u64((u64)mode->crtc_htotal * 1000000,
+                                          (u32)mode->clock);
+                line_time = min(line_time, (u32)65535);
                 priority_a_cnt = 0;
                 priority_b_cnt = 0;
 
diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c
index 3c558c170e5e..db30c6ba563a 100644
--- a/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c
@@ -1091,8 +1091,11 @@ static void dce_v8_0_program_watermarks(struct amdgpu_device *adev,
         u32 tmp, wm_mask, lb_vblank_lead_lines = 0;
 
         if (amdgpu_crtc->base.enabled && num_heads && mode) {
-                active_time = 1000000UL * (u32)mode->crtc_hdisplay / (u32)mode->clock;
-                line_time = min((u32) (1000000UL * (u32)mode->crtc_htotal / (u32)mode->clock), (u32)65535);
+                active_time = (u32) div_u64((u64)mode->crtc_hdisplay * 1000000,
+                                            (u32)mode->clock);
+                line_time = (u32) div_u64((u64)mode->crtc_htotal * 1000000,
+                                          (u32)mode->clock);
+                line_time = min(line_time, (u32)65535);
 
                 /* watermark for high clocks */
                 if (adev->pm.dpm_enabled) {
diff --git a/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c b/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c
index fb0819359909..90332f55cfba 100644
--- a/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c
@@ -77,13 +77,26 @@ static int vce_v3_0_set_clockgating_state(void *handle,
 static uint64_t vce_v3_0_ring_get_rptr(struct amdgpu_ring *ring)
 {
         struct amdgpu_device *adev = ring->adev;
+        u32 v;
+
+        mutex_lock(&adev->grbm_idx_mutex);
+        if (adev->vce.harvest_config == 0 ||
+                adev->vce.harvest_config == AMDGPU_VCE_HARVEST_VCE1)
+                WREG32(mmGRBM_GFX_INDEX, GET_VCE_INSTANCE(0));
+        else if (adev->vce.harvest_config == AMDGPU_VCE_HARVEST_VCE0)
+                WREG32(mmGRBM_GFX_INDEX, GET_VCE_INSTANCE(1));
 
         if (ring == &adev->vce.ring[0])
-                return RREG32(mmVCE_RB_RPTR);
+                v = RREG32(mmVCE_RB_RPTR);
         else if (ring == &adev->vce.ring[1])
-                return RREG32(mmVCE_RB_RPTR2);
+                v = RREG32(mmVCE_RB_RPTR2);
         else
-                return RREG32(mmVCE_RB_RPTR3);
+                v = RREG32(mmVCE_RB_RPTR3);
+
+        WREG32(mmGRBM_GFX_INDEX, mmGRBM_GFX_INDEX_DEFAULT);
+        mutex_unlock(&adev->grbm_idx_mutex);
+
+        return v;
 }
 
 /**
@@ -96,13 +109,26 @@ static uint64_t vce_v3_0_ring_get_rptr(struct amdgpu_ring *ring)
 static uint64_t vce_v3_0_ring_get_wptr(struct amdgpu_ring *ring)
 {
         struct amdgpu_device *adev = ring->adev;
+        u32 v;
+
+        mutex_lock(&adev->grbm_idx_mutex);
+        if (adev->vce.harvest_config == 0 ||
+                adev->vce.harvest_config == AMDGPU_VCE_HARVEST_VCE1)
+                WREG32(mmGRBM_GFX_INDEX, GET_VCE_INSTANCE(0));
+        else if (adev->vce.harvest_config == AMDGPU_VCE_HARVEST_VCE0)
+                WREG32(mmGRBM_GFX_INDEX, GET_VCE_INSTANCE(1));
 
         if (ring == &adev->vce.ring[0])
-                return RREG32(mmVCE_RB_WPTR);
+                v = RREG32(mmVCE_RB_WPTR);
         else if (ring == &adev->vce.ring[1])
-                return RREG32(mmVCE_RB_WPTR2);
+                v = RREG32(mmVCE_RB_WPTR2);
         else
-                return RREG32(mmVCE_RB_WPTR3);
+                v = RREG32(mmVCE_RB_WPTR3);
+
+        WREG32(mmGRBM_GFX_INDEX, mmGRBM_GFX_INDEX_DEFAULT);
+        mutex_unlock(&adev->grbm_idx_mutex);
+
+        return v;
 }
 
 /**
@@ -116,12 +142,22 @@ static void vce_v3_0_ring_set_wptr(struct amdgpu_ring *ring)
 {
         struct amdgpu_device *adev = ring->adev;
 
+        mutex_lock(&adev->grbm_idx_mutex);
+        if (adev->vce.harvest_config == 0 ||
+                adev->vce.harvest_config == AMDGPU_VCE_HARVEST_VCE1)
+                WREG32(mmGRBM_GFX_INDEX, GET_VCE_INSTANCE(0));
+        else if (adev->vce.harvest_config == AMDGPU_VCE_HARVEST_VCE0)
+                WREG32(mmGRBM_GFX_INDEX, GET_VCE_INSTANCE(1));
+
         if (ring == &adev->vce.ring[0])
                 WREG32(mmVCE_RB_WPTR, lower_32_bits(ring->wptr));
         else if (ring == &adev->vce.ring[1])
                 WREG32(mmVCE_RB_WPTR2, lower_32_bits(ring->wptr));
         else
                 WREG32(mmVCE_RB_WPTR3, lower_32_bits(ring->wptr));
+
+        WREG32(mmGRBM_GFX_INDEX, mmGRBM_GFX_INDEX_DEFAULT);
+        mutex_unlock(&adev->grbm_idx_mutex);
 }
 
 static void vce_v3_0_override_vce_clock_gating(struct amdgpu_device *adev, bool override)
@@ -231,33 +267,38 @@ static int vce_v3_0_start(struct amdgpu_device *adev)
         struct amdgpu_ring *ring;
         int idx, r;
 
-        ring = &adev->vce.ring[0];
-        WREG32(mmVCE_RB_RPTR, lower_32_bits(ring->wptr));
-        WREG32(mmVCE_RB_WPTR, lower_32_bits(ring->wptr));
-        WREG32(mmVCE_RB_BASE_LO, ring->gpu_addr);
-        WREG32(mmVCE_RB_BASE_HI, upper_32_bits(ring->gpu_addr));
-        WREG32(mmVCE_RB_SIZE, ring->ring_size / 4);
-
-        ring = &adev->vce.ring[1];
-        WREG32(mmVCE_RB_RPTR2, lower_32_bits(ring->wptr));
-        WREG32(mmVCE_RB_WPTR2, lower_32_bits(ring->wptr));
-        WREG32(mmVCE_RB_BASE_LO2, ring->gpu_addr);
-        WREG32(mmVCE_RB_BASE_HI2, upper_32_bits(ring->gpu_addr));
-        WREG32(mmVCE_RB_SIZE2, ring->ring_size / 4);
-
-        ring = &adev->vce.ring[2];
-        WREG32(mmVCE_RB_RPTR3, lower_32_bits(ring->wptr));
-        WREG32(mmVCE_RB_WPTR3, lower_32_bits(ring->wptr));
-        WREG32(mmVCE_RB_BASE_LO3, ring->gpu_addr);
-        WREG32(mmVCE_RB_BASE_HI3, upper_32_bits(ring->gpu_addr));
-        WREG32(mmVCE_RB_SIZE3, ring->ring_size / 4);
-
         mutex_lock(&adev->grbm_idx_mutex);
         for (idx = 0; idx < 2; ++idx) {
                 if (adev->vce.harvest_config & (1 << idx))
                         continue;
 
                 WREG32(mmGRBM_GFX_INDEX, GET_VCE_INSTANCE(idx));
+
+                /* Program instance 0 reg space for two instances or instance 0 case
+                program instance 1 reg space for only instance 1 available case */
+                if (idx != 1 || adev->vce.harvest_config == AMDGPU_VCE_HARVEST_VCE0) {
+                        ring = &adev->vce.ring[0];
+                        WREG32(mmVCE_RB_RPTR, lower_32_bits(ring->wptr));
+                        WREG32(mmVCE_RB_WPTR, lower_32_bits(ring->wptr));
+                        WREG32(mmVCE_RB_BASE_LO, ring->gpu_addr);
+                        WREG32(mmVCE_RB_BASE_HI, upper_32_bits(ring->gpu_addr));
+                        WREG32(mmVCE_RB_SIZE, ring->ring_size / 4);
+
+                        ring = &adev->vce.ring[1];
+                        WREG32(mmVCE_RB_RPTR2, lower_32_bits(ring->wptr));
+                        WREG32(mmVCE_RB_WPTR2, lower_32_bits(ring->wptr));
+                        WREG32(mmVCE_RB_BASE_LO2, ring->gpu_addr);
+                        WREG32(mmVCE_RB_BASE_HI2, upper_32_bits(ring->gpu_addr));
+                        WREG32(mmVCE_RB_SIZE2, ring->ring_size / 4);
+
+                        ring = &adev->vce.ring[2];
+                        WREG32(mmVCE_RB_RPTR3, lower_32_bits(ring->wptr));
+                        WREG32(mmVCE_RB_WPTR3, lower_32_bits(ring->wptr));
+                        WREG32(mmVCE_RB_BASE_LO3, ring->gpu_addr);
+                        WREG32(mmVCE_RB_BASE_HI3, upper_32_bits(ring->gpu_addr));
+                        WREG32(mmVCE_RB_SIZE3, ring->ring_size / 4);
+                }
+
                 vce_v3_0_mc_resume(adev, idx);
                 WREG32_FIELD(VCE_STATUS, JOB_BUSY, 1);
 
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_thermal.c b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_thermal.c
index d5f53d04fa08..83e40fe51b62 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_thermal.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_thermal.c
@@ -709,17 +709,17 @@ static int tf_vega10_thermal_disable_alert(struct pp_hwmgr *hwmgr,
 
 static struct phm_master_table_item
 vega10_thermal_start_thermal_controller_master_list[] = {
-        {NULL, tf_vega10_thermal_initialize},
-        {NULL, tf_vega10_thermal_set_temperature_range},
-        {NULL, tf_vega10_thermal_enable_alert},
+        { .tableFunction = tf_vega10_thermal_initialize },
+        { .tableFunction = tf_vega10_thermal_set_temperature_range },
+        { .tableFunction = tf_vega10_thermal_enable_alert },
 /* We should restrict performance levels to low before we halt the SMC.
  * On the other hand we are still in boot state when we do this
  * so it would be pointless.
  * If this assumption changes we have to revisit this table.
  */
-        {NULL, tf_vega10_thermal_setup_fan_table},
-        {NULL, tf_vega10_thermal_start_smc_fan_control},
-        {NULL, NULL}
+        { .tableFunction = tf_vega10_thermal_setup_fan_table },
+        { .tableFunction = tf_vega10_thermal_start_smc_fan_control },
+        { }
 };
 
 static struct phm_master_table_header
@@ -731,10 +731,10 @@ vega10_thermal_start_thermal_controller_master = {
 
 static struct phm_master_table_item
 vega10_thermal_set_temperature_range_master_list[] = {
-        {NULL, tf_vega10_thermal_disable_alert},
-        {NULL, tf_vega10_thermal_set_temperature_range},
-        {NULL, tf_vega10_thermal_enable_alert},
-        {NULL, NULL}
+        { .tableFunction = tf_vega10_thermal_disable_alert },
+        { .tableFunction = tf_vega10_thermal_set_temperature_range },
+        { .tableFunction = tf_vega10_thermal_enable_alert },
+        { }
 };
 
 struct phm_master_table_header
diff --git a/drivers/gpu/drm/bridge/synopsys/Kconfig b/drivers/gpu/drm/bridge/synopsys/Kconfig
index 40d2827a6d19..53e78d092d18 100644
--- a/drivers/gpu/drm/bridge/synopsys/Kconfig
+++ b/drivers/gpu/drm/bridge/synopsys/Kconfig
@@ -1,6 +1,7 @@
 config DRM_DW_HDMI
         tristate
         select DRM_KMS_HELPER
+        select REGMAP_MMIO
 
 config DRM_DW_HDMI_AHB_AUDIO
         tristate "Synopsys Designware AHB Audio interface"
diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c
index 8be9719284b0..aa885a614e27 100644
--- a/drivers/gpu/drm/drm_atomic_helper.c
+++ b/drivers/gpu/drm/drm_atomic_helper.c
@@ -508,6 +508,8 @@ drm_atomic_helper_check_modeset(struct drm_device *dev,
                 bool has_connectors =
                         !!new_crtc_state->connector_mask;
 
+                WARN_ON(!drm_modeset_is_locked(&crtc->mutex));
+
                 if (!drm_mode_equal(&old_crtc_state->mode, &new_crtc_state->mode)) {
                         DRM_DEBUG_ATOMIC("[CRTC:%d:%s] mode changed\n",
                                          crtc->base.id, crtc->name);
@@ -551,6 +553,8 @@ drm_atomic_helper_check_modeset(struct drm_device *dev,
         for_each_oldnew_connector_in_state(state, connector, old_connector_state, new_connector_state, i) {
                 const struct drm_connector_helper_funcs *funcs = connector->helper_private;
 
+                WARN_ON(!drm_modeset_is_locked(&dev->mode_config.connection_mutex));
+
                 /*
                  * This only sets crtc->connectors_changed for routing changes,
                  * drivers must set crtc->connectors_changed themselves when
@@ -650,6 +654,8 @@ drm_atomic_helper_check_planes(struct drm_device *dev,
         for_each_oldnew_plane_in_state(state, plane, old_plane_state, new_plane_state, i) {
                 const struct drm_plane_helper_funcs *funcs;
 
+                WARN_ON(!drm_modeset_is_locked(&plane->mutex));
+
                 funcs = plane->helper_private;
 
                 drm_atomic_helper_plane_changed(state, old_plane_state, new_plane_state, plane);
@@ -2663,7 +2669,12 @@ int drm_atomic_helper_resume(struct drm_device *dev,
 
         drm_modeset_acquire_init(&ctx, 0);
         while (1) {
+                err = drm_modeset_lock_all_ctx(dev, &ctx);
+                if (err)
+                        goto out;
+
                 err = drm_atomic_helper_commit_duplicated_state(state, &ctx);
+out:
                 if (err != -EDEADLK)
                         break;
 
diff --git a/drivers/gpu/drm/drm_connector.c b/drivers/gpu/drm/drm_connector.c
index 9f847615ac74..48ca2457df8c 100644
--- a/drivers/gpu/drm/drm_connector.c
+++ b/drivers/gpu/drm/drm_connector.c
@@ -1229,21 +1229,6 @@ int drm_mode_getconnector(struct drm_device *dev, void *data,
         if (!connector)
                 return -ENOENT;
 
-        drm_modeset_lock(&dev->mode_config.connection_mutex, NULL);
-        encoder = drm_connector_get_encoder(connector);
-        if (encoder)
-                out_resp->encoder_id = encoder->base.id;
-        else
-                out_resp->encoder_id = 0;
-
-        ret = drm_mode_object_get_properties(&connector->base, file_priv->atomic,
-                        (uint32_t __user *)(unsigned long)(out_resp->props_ptr),
-                        (uint64_t __user *)(unsigned long)(out_resp->prop_values_ptr),
-                        &out_resp->count_props);
-        drm_modeset_unlock(&dev->mode_config.connection_mutex);
-        if (ret)
-                goto out_unref;
-
         for (i = 0; i < DRM_CONNECTOR_MAX_ENCODER; i++)
                 if (connector->encoder_ids[i] != 0)
                         encoders_count++;
@@ -1256,7 +1241,7 @@ int drm_mode_getconnector(struct drm_device *dev, void *data,
                                 if (put_user(connector->encoder_ids[i],
                                              encoder_ptr + copied)) {
                                         ret = -EFAULT;
-                                        goto out_unref;
+                                        goto out;
                                 }
                                 copied++;
                         }
@@ -1300,15 +1285,32 @@ int drm_mode_getconnector(struct drm_device *dev, void *data,
                         if (copy_to_user(mode_ptr + copied,
                                          &u_mode, sizeof(u_mode))) {
                                 ret = -EFAULT;
+                                mutex_unlock(&dev->mode_config.mutex);
+
                                 goto out;
                         }
                         copied++;
                 }
         }
         out_resp->count_modes = mode_count;
-out:
         mutex_unlock(&dev->mode_config.mutex);
-out_unref:
+
+        drm_modeset_lock(&dev->mode_config.connection_mutex, NULL);
+        encoder = drm_connector_get_encoder(connector);
+        if (encoder)
+                out_resp->encoder_id = encoder->base.id;
+        else
+                out_resp->encoder_id = 0;
+
+        /* Only grab properties after probing, to make sure EDID and other
+         * properties reflect the latest status. */
+        ret = drm_mode_object_get_properties(&connector->base, file_priv->atomic,
+                        (uint32_t __user *)(unsigned long)(out_resp->props_ptr),
+                        (uint64_t __user *)(unsigned long)(out_resp->prop_values_ptr),
+                        &out_resp->count_props);
+        drm_modeset_unlock(&dev->mode_config.connection_mutex);
+
+out:
         drm_connector_put(connector);
 
         return ret;
diff --git a/drivers/gpu/drm/drm_dp_helper.c b/drivers/gpu/drm/drm_dp_helper.c
index 3e5f52110ea1..213fb837e1c4 100644
--- a/drivers/gpu/drm/drm_dp_helper.c
+++ b/drivers/gpu/drm/drm_dp_helper.c
@@ -1208,3 +1208,86 @@ int drm_dp_stop_crc(struct drm_dp_aux *aux)
         return 0;
 }
 EXPORT_SYMBOL(drm_dp_stop_crc);
+
+struct dpcd_quirk {
+        u8 oui[3];
+        bool is_branch;
+        u32 quirks;
+};
+
+#define OUI(first, second, third) { (first), (second), (third) }
+
+static const struct dpcd_quirk dpcd_quirk_list[] = {
+        /* Analogix 7737 needs reduced M and N at HBR2 link rates */
+        { OUI(0x00, 0x22, 0xb9), true, BIT(DP_DPCD_QUIRK_LIMITED_M_N) },
+};
+
+#undef OUI
+
+/*
+ * Get a bit mask of DPCD quirks for the sink/branch device identified by
+ * ident. The quirk data is shared but it's up to the drivers to act on the
+ * data.
+ *
+ * For now, only the OUI (first three bytes) is used, but this may be extended
+ * to device identification string and hardware/firmware revisions later.
+ */
+static u32
+drm_dp_get_quirks(const struct drm_dp_dpcd_ident *ident, bool is_branch)
+{
+        const struct dpcd_quirk *quirk;
+        u32 quirks = 0;
+        int i;
+
+        for (i = 0; i < ARRAY_SIZE(dpcd_quirk_list); i++) {
+                quirk = &dpcd_quirk_list[i];
+
+                if (quirk->is_branch != is_branch)
+                        continue;
+
+                if (memcmp(quirk->oui, ident->oui, sizeof(ident->oui)) != 0)
+                        continue;
+
+                quirks |= quirk->quirks;
+        }
+
+        return quirks;
+}
+
+/**
+ * drm_dp_read_desc - read sink/branch descriptor from DPCD
+ * @aux: DisplayPort AUX channel
+ * @desc: Device decriptor to fill from DPCD
+ * @is_branch: true for branch devices, false for sink devices
+ *
+ * Read DPCD 0x400 (sink) or 0x500 (branch) into @desc. Also debug log the
+ * identification.
+ *
+ * Returns 0 on success or a negative error code on failure.
+ */
+int drm_dp_read_desc(struct drm_dp_aux *aux, struct drm_dp_desc *desc,
+                     bool is_branch)
+{
+        struct drm_dp_dpcd_ident *ident = &desc->ident;
+        unsigned int offset = is_branch ? DP_BRANCH_OUI : DP_SINK_OUI;
+        int ret, dev_id_len;
+
+        ret = drm_dp_dpcd_read(aux, offset, ident, sizeof(*ident));
+        if (ret < 0)
+                return ret;
+
+        desc->quirks = drm_dp_get_quirks(ident, is_branch);
+
+        dev_id_len = strnlen(ident->device_id, sizeof(ident->device_id));
+
+        DRM_DEBUG_KMS("DP %s: OUI %*phD dev-ID %*pE HW-rev %d.%d SW-rev %d.%d quirks 0x%04x\n",
+                      is_branch ? "branch" : "sink",
+                      (int)sizeof(ident->oui), ident->oui,
+                      dev_id_len, ident->device_id,
+                      ident->hw_rev >> 4, ident->hw_rev & 0xf,
+                      ident->sw_major_rev, ident->sw_minor_rev,
+                      desc->quirks);
+
+        return 0;
+}
+EXPORT_SYMBOL(drm_dp_read_desc);
diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
index b5c6bb46a425..37b8ad3e30d8 100644
--- a/drivers/gpu/drm/drm_drv.c
+++ b/drivers/gpu/drm/drm_drv.c
@@ -358,7 +358,12 @@ EXPORT_SYMBOL(drm_put_dev);
 void drm_unplug_dev(struct drm_device *dev)
 {
         /* for a USB device */
-        drm_dev_unregister(dev);
+        if (drm_core_check_feature(dev, DRIVER_MODESET))
+                drm_modeset_unregister_all(dev);
+
+        drm_minor_unregister(dev, DRM_MINOR_PRIMARY);
+        drm_minor_unregister(dev, DRM_MINOR_RENDER);
+        drm_minor_unregister(dev, DRM_MINOR_CONTROL);
 
         mutex_lock(&drm_global_mutex);
 
diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem.h b/drivers/gpu/drm/etnaviv/etnaviv_gem.h
index c4a091e87426..e437fba1209d 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_gem.h
+++ b/drivers/gpu/drm/etnaviv/etnaviv_gem.h
@@ -106,9 +106,10 @@ struct etnaviv_gem_submit {
         struct etnaviv_gpu *gpu;
         struct ww_acquire_ctx ticket;
         struct dma_fence *fence;
+        u32 flags;
         unsigned int nr_bos;
         struct etnaviv_gem_submit_bo bos[0];
-        u32 flags;
+        /* No new members here, the previous one is variable-length! */
 };
 
 int etnaviv_gem_wait_bo(struct etnaviv_gpu *gpu, struct drm_gem_object *obj,
diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c b/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c
index de80ee1b71df..1013765274da 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c
@@ -172,7 +172,7 @@ static int submit_fence_sync(const struct etnaviv_gem_submit *submit)
         for (i = 0; i < submit->nr_bos; i++) {
                 struct etnaviv_gem_object *etnaviv_obj = submit->bos[i].obj;
                 bool write = submit->bos[i].flags & ETNA_SUBMIT_BO_WRITE;
-                bool explicit = !(submit->flags & ETNA_SUBMIT_NO_IMPLICIT);
+                bool explicit = !!(submit->flags & ETNA_SUBMIT_NO_IMPLICIT);
 
                 ret = etnaviv_gpu_fence_sync_obj(etnaviv_obj, context, write,
                                                  explicit);
diff --git a/drivers/gpu/drm/exynos/exynos_drm_drv.c b/drivers/gpu/drm/exynos/exynos_drm_drv.c
index 09d3c4c3c858..50294a7bd29d 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_drv.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_drv.c
@@ -82,14 +82,9 @@ err_file_priv_free:
         return ret;
 }
 
-static void exynos_drm_preclose(struct drm_device *dev,
-                                        struct drm_file *file)
-{
-        exynos_drm_subdrv_close(dev, file);
-}
-
 static void exynos_drm_postclose(struct drm_device *dev, struct drm_file *file)
 {
+        exynos_drm_subdrv_close(dev, file);
         kfree(file->driver_priv);
         file->driver_priv = NULL;
 }
@@ -145,7 +140,6 @@ static struct drm_driver exynos_drm_driver = {
         .driver_features        = DRIVER_MODESET | DRIVER_GEM | DRIVER_PRIME
                                   | DRIVER_ATOMIC | DRIVER_RENDER,
         .open                   = exynos_drm_open,
-        .preclose               = exynos_drm_preclose,
         .lastclose              = exynos_drm_lastclose,
         .postclose              = exynos_drm_postclose,
         .gem_free_object_unlocked = exynos_drm_gem_free_object,
diff --git a/drivers/gpu/drm/exynos/exynos_drm_drv.h b/drivers/gpu/drm/exynos/exynos_drm_drv.h
index cb3176930596..39c740572034 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_drv.h
+++ b/drivers/gpu/drm/exynos/exynos_drm_drv.h
@@ -160,12 +160,9 @@ struct exynos_drm_clk {
  *      drm framework doesn't support multiple irq yet.
  *      we can refer to the crtc to current hardware interrupt occurred through
  *      this pipe value.
- * @enabled: if the crtc is enabled or not
- * @event: vblank event that is currently queued for flip
- * @wait_update: wait all pending planes updates to finish
- * @pending_update: number of pending plane updates in this crtc
  * @ops: pointer to callbacks for exynos drm specific functionality
  * @ctx: A pointer to the crtc's implementation specific context
+ * @pipe_clk: A pointer to the crtc's pipeline clock.
  */
 struct exynos_drm_crtc {
         struct drm_crtc                 base;
diff --git a/drivers/gpu/drm/exynos/exynos_drm_dsi.c b/drivers/gpu/drm/exynos/exynos_drm_dsi.c
index fc4fda738906..d404de86d5f9 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_dsi.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_dsi.c
@@ -1633,7 +1633,6 @@ static int exynos_dsi_parse_dt(struct exynos_dsi *dsi)
 {
         struct device *dev = dsi->dev;
         struct device_node *node = dev->of_node;
-        struct device_node *ep;
         int ret;
 
         ret = exynos_dsi_of_read_u32(node, "samsung,pll-clock-frequency",
@@ -1641,32 +1640,21 @@ static int exynos_dsi_parse_dt(struct exynos_dsi *dsi)
         if (ret < 0)
                 return ret;
 
-        ep = of_graph_get_endpoint_by_regs(node, DSI_PORT_OUT, 0);
-        if (!ep) {
-                dev_err(dev, "no output port with endpoint specified\n");
-                return -EINVAL;
-        }
-
-        ret = exynos_dsi_of_read_u32(ep, "samsung,burst-clock-frequency",
+        ret = exynos_dsi_of_read_u32(node, "samsung,burst-clock-frequency",
                                      &dsi->burst_clk_rate);
         if (ret < 0)
-                goto end;
+                return ret;
 
-        ret = exynos_dsi_of_read_u32(ep, "samsung,esc-clock-frequency",
+        ret = exynos_dsi_of_read_u32(node, "samsung,esc-clock-frequency",
                                      &dsi->esc_clk_rate);
         if (ret < 0)
-                goto end;
-
-        of_node_put(ep);
+                return ret;
 
         dsi->bridge_node = of_graph_get_remote_node(node, DSI_PORT_OUT, 0);
         if (!dsi->bridge_node)
                 return -EINVAL;
 
-end:
-        of_node_put(ep);
-
-        return ret;
+        return 0;
 }
 
 static int exynos_dsi_bind(struct device *dev, struct device *master,
@@ -1817,6 +1805,10 @@ static int exynos_dsi_probe(struct platform_device *pdev)
 
 static int exynos_dsi_remove(struct platform_device *pdev)
 {
+        struct exynos_dsi *dsi = platform_get_drvdata(pdev);
+
+        of_node_put(dsi->bridge_node);
+
         pm_runtime_disable(&pdev->dev);
 
         component_del(&pdev->dev, &exynos_dsi_component_ops);
diff --git a/drivers/gpu/drm/hisilicon/kirin/dw_drm_dsi.c b/drivers/gpu/drm/hisilicon/kirin/dw_drm_dsi.c
index 5abc69c9630f..f77dcfaade6c 100644
--- a/drivers/gpu/drm/hisilicon/kirin/dw_drm_dsi.c
+++ b/drivers/gpu/drm/hisilicon/kirin/dw_drm_dsi.c
@@ -760,7 +760,7 @@ static int dsi_parse_dt(struct platform_device *pdev, struct dw_dsi *dsi)
          * Get the endpoint node. In our case, dsi has one output port1
          * to which the external HDMI bridge is connected.
          */
-        ret = drm_of_find_panel_or_bridge(np, 0, 0, NULL, &dsi->bridge);
+        ret = drm_of_find_panel_or_bridge(np, 1, 0, NULL, &dsi->bridge);
         if (ret)
                 return ret;
 
diff --git a/drivers/gpu/drm/i915/gvt/execlist.c b/drivers/gpu/drm/i915/gvt/execlist.c
index dca989eb2d42..24fe04d6307b 100644
--- a/drivers/gpu/drm/i915/gvt/execlist.c
+++ b/drivers/gpu/drm/i915/gvt/execlist.c
@@ -779,8 +779,26 @@ static void init_vgpu_execlist(struct intel_vgpu *vgpu, int ring_id)
         vgpu_vreg(vgpu, ctx_status_ptr_reg) = ctx_status_ptr.dw;
 }
 
+static void clean_workloads(struct intel_vgpu *vgpu, unsigned long engine_mask)
+{
+        struct drm_i915_private *dev_priv = vgpu->gvt->dev_priv;
+        struct intel_engine_cs *engine;
+        struct intel_vgpu_workload *pos, *n;
+        unsigned int tmp;
+
+        /* free the unsubmited workloads in the queues. */
+        for_each_engine_masked(engine, dev_priv, engine_mask, tmp) {
+                list_for_each_entry_safe(pos, n,
+                        &vgpu->workload_q_head[engine->id], list) {
+                        list_del_init(&pos->list);
+                        free_workload(pos);
+                }
+        }
+}
+
 void intel_vgpu_clean_execlist(struct intel_vgpu *vgpu)
 {
+        clean_workloads(vgpu, ALL_ENGINES);
         kmem_cache_destroy(vgpu->workloads);
 }
 
@@ -811,17 +829,9 @@ void intel_vgpu_reset_execlist(struct intel_vgpu *vgpu,
 {
         struct drm_i915_private *dev_priv = vgpu->gvt->dev_priv;
         struct intel_engine_cs *engine;
-        struct intel_vgpu_workload *pos, *n;
         unsigned int tmp;
 
-        for_each_engine_masked(engine, dev_priv, engine_mask, tmp) {
-                /* free the unsubmited workload in the queue */
-                list_for_each_entry_safe(pos, n,
-                        &vgpu->workload_q_head[engine->id], list) {
-                        list_del_init(&pos->list);
-                        free_workload(pos);
-                }
-
+        clean_workloads(vgpu, engine_mask);
+        for_each_engine_masked(engine, dev_priv, engine_mask, tmp)
                 init_vgpu_execlist(vgpu, engine->id);
-        }
 }
diff --git a/drivers/gpu/drm/i915/gvt/handlers.c b/drivers/gpu/drm/i915/gvt/handlers.c
index c995e540ff96..0ffd69654592 100644
--- a/drivers/gpu/drm/i915/gvt/handlers.c
+++ b/drivers/gpu/drm/i915/gvt/handlers.c
@@ -1366,18 +1366,28 @@ static int skl_misc_ctl_write(struct intel_vgpu *vgpu, unsigned int offset,
                 void *p_data, unsigned int bytes)
 {
         struct drm_i915_private *dev_priv = vgpu->gvt->dev_priv;
-        i915_reg_t reg = {.reg = offset};
+        u32 v = *(u32 *)p_data;
+
+        if (!IS_SKYLAKE(dev_priv) && !IS_KABYLAKE(dev_priv))
+                return intel_vgpu_default_mmio_write(vgpu,
+                                offset, p_data, bytes);
 
         switch (offset) {
         case 0x4ddc:
-                vgpu_vreg(vgpu, offset) = 0x8000003c;
-                /* WaCompressedResourceSamplerPbeMediaNewHashMode:skl */
-                I915_WRITE(reg, vgpu_vreg(vgpu, offset));
+                /* bypass WaCompressedResourceSamplerPbeMediaNewHashMode */
+                vgpu_vreg(vgpu, offset) = v & ~(1 << 31);
                 break;
         case 0x42080:
-                vgpu_vreg(vgpu, offset) = 0x8000;
-                /* WaCompressedResourceDisplayNewHashMode:skl */
-                I915_WRITE(reg, vgpu_vreg(vgpu, offset));
+                /* bypass WaCompressedResourceDisplayNewHashMode */
+                vgpu_vreg(vgpu, offset) = v & ~(1 << 15);
+                break;
+        case 0xe194:
+                /* bypass WaCompressedResourceSamplerPbeMediaNewHashMode */
+                vgpu_vreg(vgpu, offset) = v & ~(1 << 8);
+                break;
+        case 0x7014:
+                /* bypass WaCompressedResourceSamplerPbeMediaNewHashMode */
+                vgpu_vreg(vgpu, offset) = v & ~(1 << 13);
                 break;
         default:
                 return -EINVAL;
@@ -1634,7 +1644,8 @@ static int init_generic_mmio_info(struct intel_gvt *gvt)
         MMIO_DFH(GAM_ECOCHK, D_ALL, F_CMD_ACCESS, NULL, NULL);
         MMIO_DFH(GEN7_COMMON_SLICE_CHICKEN1, D_ALL, F_MODE_MASK | F_CMD_ACCESS,
                 NULL, NULL);
-        MMIO_DFH(COMMON_SLICE_CHICKEN2, D_ALL, F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(COMMON_SLICE_CHICKEN2, D_ALL, F_MODE_MASK | F_CMD_ACCESS, NULL,
+                 skl_misc_ctl_write);
         MMIO_DFH(0x9030, D_ALL, F_CMD_ACCESS, NULL, NULL);
         MMIO_DFH(0x20a0, D_ALL, F_CMD_ACCESS, NULL, NULL);
         MMIO_DFH(0x2420, D_ALL, F_CMD_ACCESS, NULL, NULL);
@@ -2568,7 +2579,8 @@ static int init_broadwell_mmio_info(struct intel_gvt *gvt)
         MMIO_D(0x6e570, D_BDW_PLUS);
         MMIO_D(0x65f10, D_BDW_PLUS);
 
-        MMIO_DFH(0xe194, D_BDW_PLUS, F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0xe194, D_BDW_PLUS, F_MODE_MASK | F_CMD_ACCESS, NULL,
+                 skl_misc_ctl_write);
         MMIO_DFH(0xe188, D_BDW_PLUS, F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
         MMIO_DFH(HALF_SLICE_CHICKEN2, D_BDW_PLUS, F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
         MMIO_DFH(0x2580, D_BDW_PLUS, F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
index d689e511744e..4bd1467c17b1 100644
--- a/drivers/gpu/drm/i915/i915_debugfs.c
+++ b/drivers/gpu/drm/i915/i915_debugfs.c
@@ -292,6 +292,8 @@ static int per_file_stats(int id, void *ptr, void *data)
         struct file_stats *stats = data;
         struct i915_vma *vma;
 
+        lockdep_assert_held(&obj->base.dev->struct_mutex);
+
         stats->count++;
         stats->total += obj->base.size;
         if (!obj->bind_count)
@@ -476,6 +478,8 @@ static int i915_gem_object_info(struct seq_file *m, void *data)
                 struct drm_i915_gem_request *request;
                 struct task_struct *task;
 
+                mutex_lock(&dev->struct_mutex);
+
                 memset(&stats, 0, sizeof(stats));
                 stats.file_priv = file->driver_priv;
                 spin_lock(&file->table_lock);
@@ -487,7 +491,6 @@ static int i915_gem_object_info(struct seq_file *m, void *data)
                  * still alive (e.g. get_pid(current) => fork() => exit()).
                  * Therefore, we need to protect this ->comm access using RCU.
                  */
-                mutex_lock(&dev->struct_mutex);
                 request = list_first_entry_or_null(&file_priv->mm.request_list,
                                                    struct drm_i915_gem_request,
                                                    client_link);
@@ -497,6 +500,7 @@ static int i915_gem_object_info(struct seq_file *m, void *data)
                                 PIDTYPE_PID);
                 print_file_stats(m, task ? task->comm : "<unknown>", stats);
                 rcu_read_unlock();
+
                 mutex_unlock(&dev->struct_mutex);
         }
         mutex_unlock(&dev->filelist_mutex);
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index 3036d4835b0f..48428672fc6e 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -1235,6 +1235,15 @@ int i915_driver_load(struct pci_dev *pdev, const struct pci_device_id *ent)
                 goto out_fini;
 
         pci_set_drvdata(pdev, &dev_priv->drm);
+        /*
+         * Disable the system suspend direct complete optimization, which can
+         * leave the device suspended skipping the driver's suspend handlers
+         * if the device was already runtime suspended. This is needed due to
+         * the difference in our runtime and system suspend sequence and
+         * becaue the HDA driver may require us to enable the audio power
+         * domain during system suspend.
+         */
+        pdev->dev_flags |= PCI_DEV_FLAGS_NEEDS_RESUME;
 
         ret = i915_driver_init_early(dev_priv, ent);
         if (ret < 0)
@@ -1272,10 +1281,6 @@ int i915_driver_load(struct pci_dev *pdev, const struct pci_device_id *ent)
 
         dev_priv->ipc_enabled = false;
 
-        /* Everything is in place, we can now relax! */
-        DRM_INFO("Initialized %s %d.%d.%d %s for %s on minor %d\n",
-                 driver.name, driver.major, driver.minor, driver.patchlevel,
-                 driver.date, pci_name(pdev), dev_priv->drm.primary->index);
         if (IS_ENABLED(CONFIG_DRM_I915_DEBUG))
                 DRM_INFO("DRM_I915_DEBUG enabled\n");
         if (IS_ENABLED(CONFIG_DRM_I915_DEBUG_GEM))
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index c9b0949f6c1a..2c453a4e97d5 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -562,7 +562,8 @@ struct intel_link_m_n {
 
 void intel_link_compute_m_n(int bpp, int nlanes,
                             int pixel_clock, int link_clock,
-                            struct intel_link_m_n *m_n);
+                            struct intel_link_m_n *m_n,
+                            bool reduce_m_n);
 
 /* Interface history:
  *
@@ -2990,6 +2991,16 @@ static inline bool intel_scanout_needs_vtd_wa(struct drm_i915_private *dev_priv)
         return false;
 }
 
+static inline bool
+intel_ggtt_update_needs_vtd_wa(struct drm_i915_private *dev_priv)
+{
+#ifdef CONFIG_INTEL_IOMMU
+        if (IS_BROXTON(dev_priv) && intel_iommu_gfx_mapped)
+                return true;
+#endif
+        return false;
+}
+
 int intel_sanitize_enable_ppgtt(struct drm_i915_private *dev_priv,
                                 int enable_ppgtt);
 
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index b6ac3df18b58..615f0a855222 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -2285,8 +2285,8 @@ i915_gem_object_get_pages_gtt(struct drm_i915_gem_object *obj)
         struct page *page;
         unsigned long last_pfn = 0;     /* suppress gcc warning */
         unsigned int max_segment;
+        gfp_t noreclaim;
         int ret;
-        gfp_t gfp;
 
         /* Assert that the object is not currently in any GPU domain. As it
          * wasn't in the GTT, there shouldn't be any way it could have been in
@@ -2315,22 +2315,31 @@ rebuild_st:
          * Fail silently without starting the shrinker
          */
         mapping = obj->base.filp->f_mapping;
-        gfp = mapping_gfp_constraint(mapping, ~(__GFP_IO | __GFP_RECLAIM));
-        gfp |= __GFP_NORETRY | __GFP_NOWARN;
+        noreclaim = mapping_gfp_constraint(mapping,
+                                           ~(__GFP_IO | __GFP_RECLAIM));
+        noreclaim |= __GFP_NORETRY | __GFP_NOWARN;
+
         sg = st->sgl;
         st->nents = 0;
         for (i = 0; i < page_count; i++) {
-                page = shmem_read_mapping_page_gfp(mapping, i, gfp);
-                if (unlikely(IS_ERR(page))) {
-                        i915_gem_shrink(dev_priv,
-                                        page_count,
-                                        I915_SHRINK_BOUND |
-                                        I915_SHRINK_UNBOUND |
-                                        I915_SHRINK_PURGEABLE);
+                const unsigned int shrink[] = {
+                        I915_SHRINK_BOUND | I915_SHRINK_UNBOUND | I915_SHRINK_PURGEABLE,
+                        0,
+                }, *s = shrink;
+                gfp_t gfp = noreclaim;
+
+                do {
                         page = shmem_read_mapping_page_gfp(mapping, i, gfp);
-                }
-                if (unlikely(IS_ERR(page))) {
-                        gfp_t reclaim;
+                        if (likely(!IS_ERR(page)))
+                                break;
+
+                        if (!*s) {
+                                ret = PTR_ERR(page);
+                                goto err_sg;
+                        }
+
+                        i915_gem_shrink(dev_priv, 2 * page_count, *s++);
+                        cond_resched();
 
                         /* We've tried hard to allocate the memory by reaping
                          * our own buffer, now let the real VM do its job and
@@ -2340,15 +2349,26 @@ rebuild_st:
                          * defer the oom here by reporting the ENOMEM back
                          * to userspace.
                          */
-                        reclaim = mapping_gfp_mask(mapping);
-                        reclaim |= __GFP_NORETRY; /* reclaim, but no oom */
-
-                        page = shmem_read_mapping_page_gfp(mapping, i, reclaim);
-                        if (IS_ERR(page)) {
-                                ret = PTR_ERR(page);
-                                goto err_sg;
+                        if (!*s) {
+                                /* reclaim and warn, but no oom */
+                                gfp = mapping_gfp_mask(mapping);
+
+                                /* Our bo are always dirty and so we require
+                                 * kswapd to reclaim our pages (direct reclaim
+                                 * does not effectively begin pageout of our
+                                 * buffers on its own). However, direct reclaim
+                                 * only waits for kswapd when under allocation
+                                 * congestion. So as a result __GFP_RECLAIM is
+                                 * unreliable and fails to actually reclaim our
+                                 * dirty pages -- unless you try over and over
+                                 * again with !__GFP_NORETRY. However, we still
+                                 * want to fail this allocation rather than
+                                 * trigger the out-of-memory killer and for
+                                 * this we want the future __GFP_MAYFAIL.
+                                 */
                         }
-                }
+                } while (1);
+
                 if (!i ||
                     sg->length >= max_segment ||
                     page_to_pfn(page) != last_pfn + 1) {
@@ -3298,6 +3318,10 @@ int i915_gem_wait_for_idle(struct drm_i915_private *i915, unsigned int flags)
 {
         int ret;
 
+        /* If the device is asleep, we have no requests outstanding */
+        if (!READ_ONCE(i915->gt.awake))
+                return 0;
+
         if (flags & I915_WAIT_LOCKED) {
                 struct i915_gem_timeline *tl;
 
@@ -4218,6 +4242,7 @@ i915_gem_object_create(struct drm_i915_private *dev_priv, u64 size)
 
         mapping = obj->base.filp->f_mapping;
         mapping_set_gfp_mask(mapping, mask);
+        GEM_BUG_ON(!(mapping_gfp_mask(mapping) & __GFP_RECLAIM));
 
         i915_gem_object_init(obj, &i915_gem_object_ops);
 
diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
index a3e59c8ef27b..9ad13eeed904 100644
--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
@@ -546,11 +546,12 @@ repeat:
 }
 
 static int
-i915_gem_execbuffer_relocate_entry(struct drm_i915_gem_object *obj,
+i915_gem_execbuffer_relocate_entry(struct i915_vma *vma,
                                    struct eb_vmas *eb,
                                    struct drm_i915_gem_relocation_entry *reloc,
                                    struct reloc_cache *cache)
 {
+        struct drm_i915_gem_object *obj = vma->obj;
         struct drm_i915_private *dev_priv = to_i915(obj->base.dev);
         struct drm_gem_object *target_obj;
         struct drm_i915_gem_object *target_i915_obj;
@@ -628,6 +629,16 @@ i915_gem_execbuffer_relocate_entry(struct drm_i915_gem_object *obj,
                 return -EINVAL;
         }
 
+        /*
+         * If we write into the object, we need to force the synchronisation
+         * barrier, either with an asynchronous clflush or if we executed the
+         * patching using the GPU (though that should be serialised by the
+         * timeline). To be completely sure, and since we are required to
+         * do relocations we are already stalling, disable the user's opt
+         * of our synchronisation.
+         */
+        vma->exec_entry->flags &= ~EXEC_OBJECT_ASYNC;
+
         ret = relocate_entry(obj, reloc, cache, target_offset);
         if (ret)
                 return ret;
@@ -678,7 +689,7 @@ i915_gem_execbuffer_relocate_vma(struct i915_vma *vma,
                 do {
                         u64 offset = r->presumed_offset;
 
-                        ret = i915_gem_execbuffer_relocate_entry(vma->obj, eb, r, &cache);
+                        ret = i915_gem_execbuffer_relocate_entry(vma, eb, r, &cache);
                         if (ret)
                                 goto out;
 
@@ -726,7 +737,7 @@ i915_gem_execbuffer_relocate_vma_slow(struct i915_vma *vma,
 
         reloc_cache_init(&cache, eb->i915);
         for (i = 0; i < entry->relocation_count; i++) {
-                ret = i915_gem_execbuffer_relocate_entry(vma->obj, eb, &relocs[i], &cache);
+                ret = i915_gem_execbuffer_relocate_entry(vma, eb, &relocs[i], &cache);
                 if (ret)
                         break;
         }
diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c
index a0563e18d753..f1989b8792dd 100644
--- a/drivers/gpu/drm/i915/i915_gem_gtt.c
+++ b/drivers/gpu/drm/i915/i915_gem_gtt.c
@@ -2191,6 +2191,101 @@ static void gen8_ggtt_clear_range(struct i915_address_space *vm,
                 gen8_set_pte(&gtt_base[i], scratch_pte);
 }
 
+static void bxt_vtd_ggtt_wa(struct i915_address_space *vm)
+{
+        struct drm_i915_private *dev_priv = vm->i915;
+
+        /*
+         * Make sure the internal GAM fifo has been cleared of all GTT
+         * writes before exiting stop_machine(). This guarantees that
+         * any aperture accesses waiting to start in another process
+         * cannot back up behind the GTT writes causing a hang.
+         * The register can be any arbitrary GAM register.
+         */
+        POSTING_READ(GFX_FLSH_CNTL_GEN6);
+}
+
+struct insert_page {
+        struct i915_address_space *vm;
+        dma_addr_t addr;
+        u64 offset;
+        enum i915_cache_level level;
+};
+
+static int bxt_vtd_ggtt_insert_page__cb(void *_arg)
+{
+        struct insert_page *arg = _arg;
+
+        gen8_ggtt_insert_page(arg->vm, arg->addr, arg->offset, arg->level, 0);
+        bxt_vtd_ggtt_wa(arg->vm);
+
+        return 0;
+}
+
+static void bxt_vtd_ggtt_insert_page__BKL(struct i915_address_space *vm,
+                                          dma_addr_t addr,
+                                          u64 offset,
+                                          enum i915_cache_level level,
+                                          u32 unused)
+{
+        struct insert_page arg = { vm, addr, offset, level };
+
+        stop_machine(bxt_vtd_ggtt_insert_page__cb, &arg, NULL);
+}
+
+struct insert_entries {
+        struct i915_address_space *vm;
+        struct sg_table *st;
+        u64 start;
+        enum i915_cache_level level;
+};
+
+static int bxt_vtd_ggtt_insert_entries__cb(void *_arg)
+{
+        struct insert_entries *arg = _arg;
+
+        gen8_ggtt_insert_entries(arg->vm, arg->st, arg->start, arg->level, 0);
+        bxt_vtd_ggtt_wa(arg->vm);
+
+        return 0;
+}
+
+static void bxt_vtd_ggtt_insert_entries__BKL(struct i915_address_space *vm,
+                                             struct sg_table *st,
+                                             u64 start,
+                                             enum i915_cache_level level,
+                                             u32 unused)
+{
+        struct insert_entries arg = { vm, st, start, level };
+
+        stop_machine(bxt_vtd_ggtt_insert_entries__cb, &arg, NULL);
+}
+
+struct clear_range {
+        struct i915_address_space *vm;
+        u64 start;
+        u64 length;
+};
+
+static int bxt_vtd_ggtt_clear_range__cb(void *_arg)
+{
+        struct clear_range *arg = _arg;
+
+        gen8_ggtt_clear_range(arg->vm, arg->start, arg->length);
+        bxt_vtd_ggtt_wa(arg->vm);
+
+        return 0;
+}
+
+static void bxt_vtd_ggtt_clear_range__BKL(struct i915_address_space *vm,
+                                          u64 start,
+                                          u64 length)
+{
+        struct clear_range arg = { vm, start, length };
+
+        stop_machine(bxt_vtd_ggtt_clear_range__cb, &arg, NULL);
+}
+
 static void gen6_ggtt_clear_range(struct i915_address_space *vm,
                                   u64 start, u64 length)
 {
@@ -2313,7 +2408,7 @@ static int aliasing_gtt_bind_vma(struct i915_vma *vma,
                     appgtt->base.allocate_va_range) {
                         ret = appgtt->base.allocate_va_range(&appgtt->base,
                                                              vma->node.start,
-                                                             vma->node.size);
+                                                             vma->size);
                         if (ret)
                                 goto err_pages;
                 }
@@ -2785,6 +2880,14 @@ static int gen8_gmch_probe(struct i915_ggtt *ggtt)
 
         ggtt->base.insert_entries = gen8_ggtt_insert_entries;
 
+        /* Serialize GTT updates with aperture access on BXT if VT-d is on. */
+        if (intel_ggtt_update_needs_vtd_wa(dev_priv)) {
+                ggtt->base.insert_entries = bxt_vtd_ggtt_insert_entries__BKL;
+                ggtt->base.insert_page    = bxt_vtd_ggtt_insert_page__BKL;
+                if (ggtt->base.clear_range != nop_clear_range)
+                        ggtt->base.clear_range = bxt_vtd_ggtt_clear_range__BKL;
+        }
+
         ggtt->invalidate = gen6_ggtt_invalidate;
 
         return ggtt_probe_common(ggtt, size);
@@ -2997,7 +3100,8 @@ void i915_ggtt_enable_guc(struct drm_i915_private *i915)
 
 void i915_ggtt_disable_guc(struct drm_i915_private *i915)
 {
-        i915->ggtt.invalidate = gen6_ggtt_invalidate;
+        if (i915->ggtt.invalidate == guc_ggtt_invalidate)
+                i915->ggtt.invalidate = gen6_ggtt_invalidate;
 }
 
 void i915_gem_restore_gtt_mappings(struct drm_i915_private *dev_priv)
diff --git a/drivers/gpu/drm/i915/i915_gem_request.c b/drivers/gpu/drm/i915/i915_gem_request.c
index 5ddbc9499775..a74d0ac737cb 100644
--- a/drivers/gpu/drm/i915/i915_gem_request.c
+++ b/drivers/gpu/drm/i915/i915_gem_request.c
@@ -623,7 +623,7 @@ i915_gem_request_alloc(struct intel_engine_cs *engine,
          * GPU processing the request, we never over-estimate the
          * position of the head.
          */
-        req->head = req->ring->tail;
+        req->head = req->ring->emit;
 
         /* Check that we didn't interrupt ourselves with a new request */
         GEM_BUG_ON(req->timeline->seqno != req->fence.seqno);
diff --git a/drivers/gpu/drm/i915/i915_gem_shrinker.c b/drivers/gpu/drm/i915/i915_gem_shrinker.c
index 129ed303a6c4..57d9f7f4ef15 100644
--- a/drivers/gpu/drm/i915/i915_gem_shrinker.c
+++ b/drivers/gpu/drm/i915/i915_gem_shrinker.c
@@ -59,9 +59,6 @@ static void i915_gem_shrinker_unlock(struct drm_device *dev, bool unlock)
                 return;
 
         mutex_unlock(&dev->struct_mutex);
-
-        /* expedite the RCU grace period to free some request slabs */
-        synchronize_rcu_expedited();
 }
 
 static bool any_vma_pinned(struct drm_i915_gem_object *obj)
@@ -274,8 +271,6 @@ unsigned long i915_gem_shrink_all(struct drm_i915_private *dev_priv)
                                 I915_SHRINK_ACTIVE);
         intel_runtime_pm_put(dev_priv);
 
-        synchronize_rcu(); /* wait for our earlier RCU delayed slab frees */
-
         return freed;
 }
 
diff --git a/drivers/gpu/drm/i915/i915_gem_tiling.c b/drivers/gpu/drm/i915/i915_gem_tiling.c
index a0d6d4317a49..fb5231f98c0d 100644
--- a/drivers/gpu/drm/i915/i915_gem_tiling.c
+++ b/drivers/gpu/drm/i915/i915_gem_tiling.c
@@ -278,7 +278,7 @@ i915_gem_object_set_tiling(struct drm_i915_gem_object *obj,
                         obj->mm.quirked = false;
                 }
                 if (!i915_gem_object_is_tiled(obj)) {
-                        GEM_BUG_ON(!obj->mm.quirked);
+                        GEM_BUG_ON(obj->mm.quirked);
                         __i915_gem_object_pin_pages(obj);
                         obj->mm.quirked = true;
                 }
diff --git a/drivers/gpu/drm/i915/i915_guc_submission.c b/drivers/gpu/drm/i915/i915_guc_submission.c
index 1642fff9cf13..ab5140ba108d 100644
--- a/drivers/gpu/drm/i915/i915_guc_submission.c
+++ b/drivers/gpu/drm/i915/i915_guc_submission.c
@@ -480,9 +480,7 @@ static void guc_wq_item_append(struct i915_guc_client *client,
         GEM_BUG_ON(freespace < wqi_size);
 
         /* The GuC firmware wants the tail index in QWords, not bytes */
-        tail = rq->tail;
-        assert_ring_tail_valid(rq->ring, rq->tail);
-        tail >>= 3;
+        tail = intel_ring_set_tail(rq->ring, rq->tail) >> 3;
         GEM_BUG_ON(tail > WQ_RING_TAIL_MAX);
 
         /* For now workqueue item is 4 DWs; workqueue buffer is 2 pages. So we
diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index fd97fe00cd0d..190f6aa5d15e 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -2953,7 +2953,6 @@ static void vlv_display_irq_postinstall(struct drm_i915_private *dev_priv)
         u32 pipestat_mask;
         u32 enable_mask;
         enum pipe pipe;
-        u32 val;
 
         pipestat_mask = PLANE_FLIP_DONE_INT_STATUS_VLV |
                         PIPE_CRC_DONE_INTERRUPT_STATUS;
@@ -2964,18 +2963,16 @@ static void vlv_display_irq_postinstall(struct drm_i915_private *dev_priv)
 
         enable_mask = I915_DISPLAY_PORT_INTERRUPT |
                 I915_DISPLAY_PIPE_A_EVENT_INTERRUPT |
-                I915_DISPLAY_PIPE_B_EVENT_INTERRUPT;
+                I915_DISPLAY_PIPE_B_EVENT_INTERRUPT |
+                I915_LPE_PIPE_A_INTERRUPT |
+                I915_LPE_PIPE_B_INTERRUPT;
+
         if (IS_CHERRYVIEW(dev_priv))
-                enable_mask |= I915_DISPLAY_PIPE_C_EVENT_INTERRUPT;
+                enable_mask |= I915_DISPLAY_PIPE_C_EVENT_INTERRUPT |
+                        I915_LPE_PIPE_C_INTERRUPT;
 
         WARN_ON(dev_priv->irq_mask != ~0);
 
-        val = (I915_LPE_PIPE_A_INTERRUPT |
-                I915_LPE_PIPE_B_INTERRUPT |
-                I915_LPE_PIPE_C_INTERRUPT);
-
-        enable_mask |= val;
-
         dev_priv->irq_mask = ~enable_mask;
 
         GEN5_IRQ_INIT(VLV_, dev_priv->irq_mask, enable_mask);
diff --git a/drivers/gpu/drm/i915/i915_pci.c b/drivers/gpu/drm/i915/i915_pci.c
index f87b0c4e564d..1a78363c7f4a 100644
--- a/drivers/gpu/drm/i915/i915_pci.c
+++ b/drivers/gpu/drm/i915/i915_pci.c
@@ -208,7 +208,7 @@ static const struct intel_device_info intel_ironlake_d_info = {
 static const struct intel_device_info intel_ironlake_m_info = {
         GEN5_FEATURES,
         .platform = INTEL_IRONLAKE,
-        .is_mobile = 1,
+        .is_mobile = 1, .has_fbc = 1,
 };
 
 #define GEN6_FEATURES \
@@ -390,7 +390,6 @@ static const struct intel_device_info intel_skylake_gt3_info = {
         .has_hw_contexts = 1, \
         .has_logical_ring_contexts = 1, \
         .has_guc = 1, \
-        .has_decoupled_mmio = 1, \
         .has_aliasing_ppgtt = 1, \
         .has_full_ppgtt = 1, \
         .has_full_48bit_ppgtt = 1, \
diff --git a/drivers/gpu/drm/i915/i915_pvinfo.h b/drivers/gpu/drm/i915/i915_pvinfo.h
index c0cb2974caac..2cfe96d3e5d1 100644
--- a/drivers/gpu/drm/i915/i915_pvinfo.h
+++ b/drivers/gpu/drm/i915/i915_pvinfo.h
@@ -36,10 +36,6 @@
 #define VGT_VERSION_MAJOR 1
 #define VGT_VERSION_MINOR 0
 
-#define INTEL_VGT_IF_VERSION_ENCODE(major, minor) ((major) << 16 | (minor))
-#define INTEL_VGT_IF_VERSION \
-        INTEL_VGT_IF_VERSION_ENCODE(VGT_VERSION_MAJOR, VGT_VERSION_MINOR)
-
 /*
  * notifications from guest to vgpu device model
  */
@@ -55,8 +51,8 @@ enum vgt_g2v_type {
 
 struct vgt_if {
         u64 magic;              /* VGT_MAGIC */
-        uint16_t version_major;
-        uint16_t version_minor;
+        u16 version_major;
+        u16 version_minor;
         u32 vgt_id;             /* ID of vGT instance */
         u32 rsv1[12];           /* pad to offset 0x40 */
         /*
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index 5a7c63e64381..65b837e96fe6 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -8280,7 +8280,7 @@ enum {
 
 /* MIPI DSI registers */
 
-#define _MIPI_PORT(port, a, c)  ((port) ? c : a)        /* ports A and C only */
+#define _MIPI_PORT(port, a, c)  (((port) == PORT_A) ? a : c)    /* ports A and C only */
 #define _MMIO_MIPI(port, a, c)  _MMIO(_MIPI_PORT(port, a, c))
 
 #define MIPIO_TXESC_CLK_DIV1                    _MMIO(0x160004)
diff --git a/drivers/gpu/drm/i915/i915_vgpu.c b/drivers/gpu/drm/i915/i915_vgpu.c
index 4ab8a973b61f..2e739018fb4c 100644
--- a/drivers/gpu/drm/i915/i915_vgpu.c
+++ b/drivers/gpu/drm/i915/i915_vgpu.c
@@ -60,8 +60,8 @@
  */
 void i915_check_vgpu(struct drm_i915_private *dev_priv)
 {
-        uint64_t magic;
-        uint32_t version;
+        u64 magic;
+        u16 version_major;
 
         BUILD_BUG_ON(sizeof(struct vgt_if) != VGT_PVINFO_SIZE);
 
@@ -69,10 +69,8 @@ void i915_check_vgpu(struct drm_i915_private *dev_priv)
         if (magic != VGT_MAGIC)
                 return;
 
-        version = INTEL_VGT_IF_VERSION_ENCODE(
-                __raw_i915_read16(dev_priv, vgtif_reg(version_major)),
-                __raw_i915_read16(dev_priv, vgtif_reg(version_minor)));
-        if (version != INTEL_VGT_IF_VERSION) {
+        version_major = __raw_i915_read16(dev_priv, vgtif_reg(version_major));
+        if (version_major < VGT_VERSION_MAJOR) {
                 DRM_INFO("VGT interface version mismatch!\n");
                 return;
         }
diff --git a/drivers/gpu/drm/i915/i915_vma.c b/drivers/gpu/drm/i915/i915_vma.c
index 1aba47024656..f066e2d785f5 100644
--- a/drivers/gpu/drm/i915/i915_vma.c
+++ b/drivers/gpu/drm/i915/i915_vma.c
@@ -650,6 +650,11 @@ int i915_vma_unbind(struct i915_vma *vma)
                                 break;
                 }
 
+                if (!ret) {
+                        ret = i915_gem_active_retire(&vma->last_fence,
+                                                     &vma->vm->i915->drm.struct_mutex);
+                }
+
                 __i915_vma_unpin(vma);
                 if (ret)
                         return ret;
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 3617927af269..9106ea32b048 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -120,7 +120,8 @@ static void intel_crtc_init_scalers(struct intel_crtc *crtc,
 static void skylake_pfit_enable(struct intel_crtc *crtc);
 static void ironlake_pfit_disable(struct intel_crtc *crtc, bool force);
 static void ironlake_pfit_enable(struct intel_crtc *crtc);
-static void intel_modeset_setup_hw_state(struct drm_device *dev);
+static void intel_modeset_setup_hw_state(struct drm_device *dev,
+                                         struct drm_modeset_acquire_ctx *ctx);
 static void intel_pre_disable_primary_noatomic(struct drm_crtc *crtc);
 
 struct intel_limit {
@@ -3449,7 +3450,7 @@ __intel_display_resume(struct drm_device *dev,
         struct drm_crtc *crtc;
         int i, ret;
 
-        intel_modeset_setup_hw_state(dev);
+        intel_modeset_setup_hw_state(dev, ctx);
         i915_redisable_vga(to_i915(dev));
 
         if (!state)
@@ -4598,7 +4599,7 @@ static void cpt_verify_modeset(struct drm_device *dev, int pipe)
 
 static int
 skl_update_scaler(struct intel_crtc_state *crtc_state, bool force_detach,
-                  unsigned scaler_user, int *scaler_id, unsigned int rotation,
+                  unsigned int scaler_user, int *scaler_id,
                   int src_w, int src_h, int dst_w, int dst_h)
 {
         struct intel_crtc_scaler_state *scaler_state =
@@ -4607,9 +4608,12 @@ skl_update_scaler(struct intel_crtc_state *crtc_state, bool force_detach,
                 to_intel_crtc(crtc_state->base.crtc);
         int need_scaling;
 
-        need_scaling = drm_rotation_90_or_270(rotation) ?
-                (src_h != dst_w || src_w != dst_h):
-                (src_w != dst_w || src_h != dst_h);
+        /*
+         * Src coordinates are already rotated by 270 degrees for
+         * the 90/270 degree plane rotation cases (to match the
+         * GTT mapping), hence no need to account for rotation here.
+         */
+        need_scaling = src_w != dst_w || src_h != dst_h;
 
         /*
          * if plane is being disabled or scaler is no more required or force detach
@@ -4671,7 +4675,7 @@ int skl_update_scaler_crtc(struct intel_crtc_state *state)
         const struct drm_display_mode *adjusted_mode = &state->base.adjusted_mode;
 
         return skl_update_scaler(state, !state->base.active, SKL_CRTC_INDEX,
-                &state->scaler_state.scaler_id, DRM_ROTATE_0,
+                &state->scaler_state.scaler_id,
                 state->pipe_src_w, state->pipe_src_h,
                 adjusted_mode->crtc_hdisplay, adjusted_mode->crtc_vdisplay);
 }
@@ -4700,7 +4704,6 @@ static int skl_update_scaler_plane(struct intel_crtc_state *crtc_state,
         ret = skl_update_scaler(crtc_state, force_detach,
                                 drm_plane_index(&intel_plane->base),
                                 &plane_state->scaler_id,
-                                plane_state->base.rotation,
                                 drm_rect_width(&plane_state->base.src) >> 16,
                                 drm_rect_height(&plane_state->base.src) >> 16,
                                 drm_rect_width(&plane_state->base.dst),
@@ -5823,7 +5826,8 @@ static void i9xx_crtc_disable(struct intel_crtc_state *old_crtc_state,
                 intel_update_watermarks(intel_crtc);
 }
 
-static void intel_crtc_disable_noatomic(struct drm_crtc *crtc)
+static void intel_crtc_disable_noatomic(struct drm_crtc *crtc,
+                                        struct drm_modeset_acquire_ctx *ctx)
 {
         struct intel_encoder *encoder;
         struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
@@ -5853,7 +5857,7 @@ static void intel_crtc_disable_noatomic(struct drm_crtc *crtc)
                 return;
         }
 
-        state->acquire_ctx = crtc->dev->mode_config.acquire_ctx;
+        state->acquire_ctx = ctx;
 
         /* Everything's already locked, -EDEADLK can't happen. */
         crtc_state = intel_atomic_get_crtc_state(state, intel_crtc);
@@ -6101,7 +6105,7 @@ retry:
         pipe_config->fdi_lanes = lane;
 
         intel_link_compute_m_n(pipe_config->pipe_bpp, lane, fdi_dotclock,
-                               link_bw, &pipe_config->fdi_m_n);
+                               link_bw, &pipe_config->fdi_m_n, false);
 
         ret = ironlake_check_fdi_lanes(dev, intel_crtc->pipe, pipe_config);
         if (ret == -EINVAL && pipe_config->pipe_bpp > 6*3) {
@@ -6277,7 +6281,8 @@ intel_reduce_m_n_ratio(uint32_t *num, uint32_t *den)
 }
 
 static void compute_m_n(unsigned int m, unsigned int n,
-                        uint32_t *ret_m, uint32_t *ret_n)
+                        uint32_t *ret_m, uint32_t *ret_n,
+                        bool reduce_m_n)
 {
         /*
          * Reduce M/N as much as possible without loss in precision. Several DP
@@ -6285,9 +6290,11 @@ static void compute_m_n(unsigned int m, unsigned int n,
          * values. The passed in values are more likely to have the least
          * significant bits zero than M after rounding below, so do this first.
          */
-        while ((m & 1) == 0 && (n & 1) == 0) {
-                m >>= 1;
-                n >>= 1;
+        if (reduce_m_n) {
+                while ((m & 1) == 0 && (n & 1) == 0) {
+                        m >>= 1;
+                        n >>= 1;
+                }
         }
 
         *ret_n = min_t(unsigned int, roundup_pow_of_two(n), DATA_LINK_N_MAX);
@@ -6298,16 +6305,19 @@ static void compute_m_n(unsigned int m, unsigned int n,
 void
 intel_link_compute_m_n(int bits_per_pixel, int nlanes,
                        int pixel_clock, int link_clock,
-                       struct intel_link_m_n *m_n)
+                       struct intel_link_m_n *m_n,
+                       bool reduce_m_n)
 {
         m_n->tu = 64;
 
         compute_m_n(bits_per_pixel * pixel_clock,
                     link_clock * nlanes * 8,
-                    &m_n->gmch_m, &m_n->gmch_n);
+                    &m_n->gmch_m, &m_n->gmch_n,
+                    reduce_m_n);
 
         compute_m_n(pixel_clock, link_clock,
-                    &m_n->link_m, &m_n->link_n);
+                    &m_n->link_m, &m_n->link_n,
+                    reduce_m_n);
 }
 
 static inline bool intel_panel_use_ssc(struct drm_i915_private *dev_priv)
@@ -12197,6 +12207,15 @@ static void update_scanline_offset(struct intel_crtc *crtc)
          * type. For DP ports it behaves like most other platforms, but on HDMI
          * there's an extra 1 line difference. So we need to add two instead of
          * one to the value.
+         *
+         * On VLV/CHV DSI the scanline counter would appear to increment
+         * approx. 1/3 of a scanline before start of vblank. Unfortunately
+         * that means we can't tell whether we're in vblank or not while
+         * we're on that particular line. We must still set scanline_offset
+         * to 1 so that the vblank timestamps come out correct when we query
+         * the scanline counter from within the vblank interrupt handler.
+         * However if queried just before the start of vblank we'll get an
+         * answer that's slightly in the future.
          */
         if (IS_GEN2(dev_priv)) {
                 const struct drm_display_mode *adjusted_mode = &crtc->config->base.adjusted_mode;
@@ -15013,7 +15032,7 @@ int intel_modeset_init(struct drm_device *dev)
         intel_setup_outputs(dev_priv);
 
         drm_modeset_lock_all(dev);
-        intel_modeset_setup_hw_state(dev);
+        intel_modeset_setup_hw_state(dev, dev->mode_config.acquire_ctx);
         drm_modeset_unlock_all(dev);
 
         for_each_intel_crtc(dev, crtc) {
@@ -15050,13 +15069,13 @@ int intel_modeset_init(struct drm_device *dev)
         return 0;
 }
 
-static void intel_enable_pipe_a(struct drm_device *dev)
+static void intel_enable_pipe_a(struct drm_device *dev,
+                                struct drm_modeset_acquire_ctx *ctx)
 {
         struct intel_connector *connector;
         struct drm_connector_list_iter conn_iter;
         struct drm_connector *crt = NULL;
         struct intel_load_detect_pipe load_detect_temp;
-        struct drm_modeset_acquire_ctx *ctx = dev->mode_config.acquire_ctx;
         int ret;
 
         /* We can't just switch on the pipe A, we need to set things up with a
@@ -15128,7 +15147,8 @@ static bool has_pch_trancoder(struct drm_i915_private *dev_priv,
                 (HAS_PCH_LPT_H(dev_priv) && pch_transcoder == TRANSCODER_A);
 }
 
-static void intel_sanitize_crtc(struct intel_crtc *crtc)
+static void intel_sanitize_crtc(struct intel_crtc *crtc,
+                                struct drm_modeset_acquire_ctx *ctx)
 {
         struct drm_device *dev = crtc->base.dev;
         struct drm_i915_private *dev_priv = to_i915(dev);
@@ -15174,7 +15194,7 @@ static void intel_sanitize_crtc(struct intel_crtc *crtc)
                 plane = crtc->plane;
                 crtc->base.primary->state->visible = true;
                 crtc->plane = !plane;
-                intel_crtc_disable_noatomic(&crtc->base);
+                intel_crtc_disable_noatomic(&crtc->base, ctx);
                 crtc->plane = plane;
         }
 
@@ -15184,13 +15204,13 @@ static void intel_sanitize_crtc(struct intel_crtc *crtc)
                  * resume. Force-enable the pipe to fix this, the update_dpms
                  * call below we restore the pipe to the right state, but leave
                  * the required bits on. */
-                intel_enable_pipe_a(dev);
+                intel_enable_pipe_a(dev, ctx);
         }
 
         /* Adjust the state of the output pipe according to whether we
          * have active connectors/encoders. */
         if (crtc->active && !intel_crtc_has_encoders(crtc))
-                intel_crtc_disable_noatomic(&crtc->base);
+                intel_crtc_disable_noatomic(&crtc->base, ctx);
 
         if (crtc->active || HAS_GMCH_DISPLAY(dev_priv)) {
                 /*
@@ -15488,7 +15508,8 @@ get_encoder_power_domains(struct drm_i915_private *dev_priv)
  * and sanitizes it to the current state
  */
 static void
-intel_modeset_setup_hw_state(struct drm_device *dev)
+intel_modeset_setup_hw_state(struct drm_device *dev,
+                             struct drm_modeset_acquire_ctx *ctx)
 {
         struct drm_i915_private *dev_priv = to_i915(dev);
         enum pipe pipe;
@@ -15508,7 +15529,7 @@ intel_modeset_setup_hw_state(struct drm_device *dev)
         for_each_pipe(dev_priv, pipe) {
                 crtc = intel_get_crtc_for_pipe(dev_priv, pipe);
 
-                intel_sanitize_crtc(crtc);
+                intel_sanitize_crtc(crtc, ctx);
                 intel_dump_pipe_config(crtc, crtc->config,
                                        "[setup_hw_state]");
         }
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index ee77b519835c..fc691b8b317c 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -1507,37 +1507,6 @@ static void intel_dp_print_rates(struct intel_dp *intel_dp)
         DRM_DEBUG_KMS("common rates: %s\n", str);
 }
 
-bool
-__intel_dp_read_desc(struct intel_dp *intel_dp, struct intel_dp_desc *desc)
-{
-        u32 base = drm_dp_is_branch(intel_dp->dpcd) ? DP_BRANCH_OUI :
-                                                      DP_SINK_OUI;
-
-        return drm_dp_dpcd_read(&intel_dp->aux, base, desc, sizeof(*desc)) ==
-               sizeof(*desc);
-}
-
-bool intel_dp_read_desc(struct intel_dp *intel_dp)
-{
-        struct intel_dp_desc *desc = &intel_dp->desc;
-        bool oui_sup = intel_dp->dpcd[DP_DOWN_STREAM_PORT_COUNT] &
-                       DP_OUI_SUPPORT;
-        int dev_id_len;
-
-        if (!__intel_dp_read_desc(intel_dp, desc))
-                return false;
-
-        dev_id_len = strnlen(desc->device_id, sizeof(desc->device_id));
-        DRM_DEBUG_KMS("DP %s: OUI %*phD%s dev-ID %*pE HW-rev %d.%d SW-rev %d.%d\n",
-                      drm_dp_is_branch(intel_dp->dpcd) ? "branch" : "sink",
-                      (int)sizeof(desc->oui), desc->oui, oui_sup ? "" : "(NS)",
-                      dev_id_len, desc->device_id,
-                      desc->hw_rev >> 4, desc->hw_rev & 0xf,
-                      desc->sw_major_rev, desc->sw_minor_rev);
-
-        return true;
-}
-
 static int rate_to_index(int find, const int *rates)
 {
         int i = 0;
@@ -1624,6 +1593,8 @@ intel_dp_compute_config(struct intel_encoder *encoder,
         int common_rates[DP_MAX_SUPPORTED_RATES] = {};
         int common_len;
         uint8_t link_bw, rate_select;
+        bool reduce_m_n = drm_dp_has_quirk(&intel_dp->desc,
+                                           DP_DPCD_QUIRK_LIMITED_M_N);
 
         common_len = intel_dp_common_rates(intel_dp, common_rates);
 
@@ -1753,7 +1724,8 @@ found:
         intel_link_compute_m_n(bpp, lane_count,
                                adjusted_mode->crtc_clock,
                                pipe_config->port_clock,
-                               &pipe_config->dp_m_n);
+                               &pipe_config->dp_m_n,
+                               reduce_m_n);
 
         if (intel_connector->panel.downclock_mode != NULL &&
                 dev_priv->drrs.type == SEAMLESS_DRRS_SUPPORT) {
@@ -1761,7 +1733,8 @@ found:
                         intel_link_compute_m_n(bpp, lane_count,
                                 intel_connector->panel.downclock_mode->clock,
                                 pipe_config->port_clock,
-                                &pipe_config->dp_m2_n2);
+                                &pipe_config->dp_m2_n2,
+                                reduce_m_n);
         }
 
         /*
@@ -3622,7 +3595,8 @@ intel_edp_init_dpcd(struct intel_dp *intel_dp)
         if (!intel_dp_read_dpcd(intel_dp))
                 return false;
 
-        intel_dp_read_desc(intel_dp);
+        drm_dp_read_desc(&intel_dp->aux, &intel_dp->desc,
+                         drm_dp_is_branch(intel_dp->dpcd));
 
         if (intel_dp->dpcd[DP_DPCD_REV] >= 0x11)
                 dev_priv->no_aux_handshake = intel_dp->dpcd[DP_MAX_DOWNSPREAD] &
@@ -4624,7 +4598,8 @@ intel_dp_long_pulse(struct intel_connector *intel_connector)
 
         intel_dp_print_rates(intel_dp);
 
-        intel_dp_read_desc(intel_dp);
+        drm_dp_read_desc(&intel_dp->aux, &intel_dp->desc,
+                         drm_dp_is_branch(intel_dp->dpcd));
 
         intel_dp_configure_mst(intel_dp);
 
diff --git a/drivers/gpu/drm/i915/intel_dp_aux_backlight.c b/drivers/gpu/drm/i915/intel_dp_aux_backlight.c
index 6532e226db29..40ba3134545e 100644
--- a/drivers/gpu/drm/i915/intel_dp_aux_backlight.c
+++ b/drivers/gpu/drm/i915/intel_dp_aux_backlight.c
@@ -119,8 +119,6 @@ static int intel_dp_aux_setup_backlight(struct intel_connector *connector,
         struct intel_dp *intel_dp = enc_to_intel_dp(&connector->encoder->base);
         struct intel_panel *panel = &connector->panel;
 
-        intel_dp_aux_enable_backlight(connector);
-
         if (intel_dp->edp_dpcd[2] & DP_EDP_BACKLIGHT_BRIGHTNESS_BYTE_COUNT)
                 panel->backlight.max = 0xFFFF;
         else
diff --git a/drivers/gpu/drm/i915/intel_dp_mst.c b/drivers/gpu/drm/i915/intel_dp_mst.c
index c1f62eb07c07..989e25577ac0 100644
--- a/drivers/gpu/drm/i915/intel_dp_mst.c
+++ b/drivers/gpu/drm/i915/intel_dp_mst.c
@@ -44,6 +44,8 @@ static bool intel_dp_mst_compute_config(struct intel_encoder *encoder,
         int lane_count, slots;
         const struct drm_display_mode *adjusted_mode = &pipe_config->base.adjusted_mode;
         int mst_pbn;
+        bool reduce_m_n = drm_dp_has_quirk(&intel_dp->desc,
+                                           DP_DPCD_QUIRK_LIMITED_M_N);
 
         pipe_config->has_pch_encoder = false;
         bpp = 24;
@@ -75,7 +77,8 @@ static bool intel_dp_mst_compute_config(struct intel_encoder *encoder,
         intel_link_compute_m_n(bpp, lane_count,
                                adjusted_mode->crtc_clock,
                                pipe_config->port_clock,
-                               &pipe_config->dp_m_n);
+                               &pipe_config->dp_m_n,
+                               reduce_m_n);
 
         pipe_config->dp_m_n.tu = slots;
 
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index aaee3949a422..f630c7af5020 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -906,14 +906,6 @@ enum link_m_n_set {
         M2_N2
 };
 
-struct intel_dp_desc {
-        u8 oui[3];
-        u8 device_id[6];
-        u8 hw_rev;
-        u8 sw_major_rev;
-        u8 sw_minor_rev;
-} __packed;
-
 struct intel_dp_compliance_data {
         unsigned long edid;
         uint8_t video_pattern;
@@ -957,7 +949,7 @@ struct intel_dp {
         /* Max link BW for the sink as per DPCD registers */
         int max_sink_link_bw;
         /* sink or branch descriptor */
-        struct intel_dp_desc desc;
+        struct drm_dp_desc desc;
         struct drm_dp_aux aux;
         enum intel_display_power_domain aux_power_domain;
         uint8_t train_set[4];
@@ -1532,9 +1524,6 @@ static inline unsigned int intel_dp_unused_lane_mask(int lane_count)
 }
 
 bool intel_dp_read_dpcd(struct intel_dp *intel_dp);
-bool __intel_dp_read_desc(struct intel_dp *intel_dp,
-                          struct intel_dp_desc *desc);
-bool intel_dp_read_desc(struct intel_dp *intel_dp);
 int intel_dp_link_required(int pixel_clock, int bpp);
 int intel_dp_max_data_rate(int max_link_clock, int max_lanes);
 bool intel_digital_port_connected(struct drm_i915_private *dev_priv,
diff --git a/drivers/gpu/drm/i915/intel_engine_cs.c b/drivers/gpu/drm/i915/intel_engine_cs.c
index 854e8e0c836b..f94eacff196c 100644
--- a/drivers/gpu/drm/i915/intel_engine_cs.c
+++ b/drivers/gpu/drm/i915/intel_engine_cs.c
@@ -1075,6 +1075,22 @@ int intel_ring_workarounds_emit(struct drm_i915_gem_request *req)
         return 0;
 }
 
+static bool ring_is_idle(struct intel_engine_cs *engine)
+{
+        struct drm_i915_private *dev_priv = engine->i915;
+        bool idle = true;
+
+        intel_runtime_pm_get(dev_priv);
+
+        /* No bit for gen2, so assume the CS parser is idle */
+        if (INTEL_GEN(dev_priv) > 2 && !(I915_READ_MODE(engine) & MODE_IDLE))
+                idle = false;
+
+        intel_runtime_pm_put(dev_priv);
+
+        return idle;
+}
+
 /**
  * intel_engine_is_idle() - Report if the engine has finished process all work
  * @engine: the intel_engine_cs
@@ -1084,8 +1100,6 @@ int intel_ring_workarounds_emit(struct drm_i915_gem_request *req)
  */
 bool intel_engine_is_idle(struct intel_engine_cs *engine)
 {
-        struct drm_i915_private *dev_priv = engine->i915;
-
         /* Any inflight/incomplete requests? */
         if (!i915_seqno_passed(intel_engine_get_seqno(engine),
                                intel_engine_last_submit(engine)))
@@ -1100,7 +1114,7 @@ bool intel_engine_is_idle(struct intel_engine_cs *engine)
                 return false;
 
         /* Ring stopped? */
-        if (INTEL_GEN(dev_priv) > 2 && !(I915_READ_MODE(engine) & MODE_IDLE))
+        if (!ring_is_idle(engine))
                 return false;
 
         return true;
diff --git a/drivers/gpu/drm/i915/intel_fbc.c b/drivers/gpu/drm/i915/intel_fbc.c
index ded2add18b26..d93c58410bff 100644
--- a/drivers/gpu/drm/i915/intel_fbc.c
+++ b/drivers/gpu/drm/i915/intel_fbc.c
@@ -82,20 +82,10 @@ static unsigned int get_crtc_fence_y_offset(struct intel_crtc *crtc)
 static void intel_fbc_get_plane_source_size(struct intel_fbc_state_cache *cache,
                                             int *width, int *height)
 {
-        int w, h;
-
-        if (drm_rotation_90_or_270(cache->plane.rotation)) {
-                w = cache->plane.src_h;
-                h = cache->plane.src_w;
-        } else {
-                w = cache->plane.src_w;
-                h = cache->plane.src_h;
-        }
-
         if (width)
-                *width = w;
+                *width = cache->plane.src_w;
         if (height)
-                *height = h;
+                *height = cache->plane.src_h;
 }
 
 static int intel_fbc_calculate_cfb_size(struct drm_i915_private *dev_priv,
@@ -746,6 +736,11 @@ static void intel_fbc_update_state_cache(struct intel_crtc *crtc,
                 cache->crtc.hsw_bdw_pixel_rate = crtc_state->pixel_rate;
 
         cache->plane.rotation = plane_state->base.rotation;
+        /*
+         * Src coordinates are already rotated by 270 degrees for
+         * the 90/270 degree plane rotation cases (to match the
+         * GTT mapping), hence no need to account for rotation here.
+         */
         cache->plane.src_w = drm_rect_width(&plane_state->base.src) >> 16;
         cache->plane.src_h = drm_rect_height(&plane_state->base.src) >> 16;
         cache->plane.visible = plane_state->base.visible;
diff --git a/drivers/gpu/drm/i915/intel_lpe_audio.c b/drivers/gpu/drm/i915/intel_lpe_audio.c
index 668f00480d97..292fedf30b00 100644
--- a/drivers/gpu/drm/i915/intel_lpe_audio.c
+++ b/drivers/gpu/drm/i915/intel_lpe_audio.c
@@ -149,44 +149,10 @@ static void lpe_audio_platdev_destroy(struct drm_i915_private *dev_priv)
 
 static void lpe_audio_irq_unmask(struct irq_data *d)
 {
-        struct drm_i915_private *dev_priv = d->chip_data;
-        unsigned long irqflags;
-        u32 val = (I915_LPE_PIPE_A_INTERRUPT |
-                I915_LPE_PIPE_B_INTERRUPT);
-
-        if (IS_CHERRYVIEW(dev_priv))
-                val |= I915_LPE_PIPE_C_INTERRUPT;
-
-        spin_lock_irqsave(&dev_priv->irq_lock, irqflags);
-
-        dev_priv->irq_mask &= ~val;
-        I915_WRITE(VLV_IIR, val);
-        I915_WRITE(VLV_IIR, val);
-        I915_WRITE(VLV_IMR, dev_priv->irq_mask);
-        POSTING_READ(VLV_IMR);
-
-        spin_unlock_irqrestore(&dev_priv->irq_lock, irqflags);
 }
 
 static void lpe_audio_irq_mask(struct irq_data *d)
 {
-        struct drm_i915_private *dev_priv = d->chip_data;
-        unsigned long irqflags;
-        u32 val = (I915_LPE_PIPE_A_INTERRUPT |
-                I915_LPE_PIPE_B_INTERRUPT);
-
-        if (IS_CHERRYVIEW(dev_priv))
-                val |= I915_LPE_PIPE_C_INTERRUPT;
-
-        spin_lock_irqsave(&dev_priv->irq_lock, irqflags);
-
-        dev_priv->irq_mask |= val;
-        I915_WRITE(VLV_IMR, dev_priv->irq_mask);
-        I915_WRITE(VLV_IIR, val);
-        I915_WRITE(VLV_IIR, val);
-        POSTING_READ(VLV_IIR);
-
-        spin_unlock_irqrestore(&dev_priv->irq_lock, irqflags);
 }
 
 static struct irq_chip lpe_audio_irqchip = {
@@ -330,8 +296,6 @@ void intel_lpe_audio_teardown(struct drm_i915_private *dev_priv)
 
         desc = irq_to_desc(dev_priv->lpe_audio.irq);
 
-        lpe_audio_irq_mask(&desc->irq_data);
-
         lpe_audio_platdev_destroy(dev_priv);
 
         irq_free_desc(dev_priv->lpe_audio.irq);
diff --git a/drivers/gpu/drm/i915/intel_lrc.c b/drivers/gpu/drm/i915/intel_lrc.c
index c8f7c631fc1f..62f44d3e7c43 100644
--- a/drivers/gpu/drm/i915/intel_lrc.c
+++ b/drivers/gpu/drm/i915/intel_lrc.c
@@ -326,8 +326,7 @@ static u64 execlists_update_context(struct drm_i915_gem_request *rq)
                 rq->ctx->ppgtt ?: rq->i915->mm.aliasing_ppgtt;
         u32 *reg_state = ce->lrc_reg_state;
 
-        assert_ring_tail_valid(rq->ring, rq->tail);
-        reg_state[CTX_RING_TAIL+1] = rq->tail;
+        reg_state[CTX_RING_TAIL+1] = intel_ring_set_tail(rq->ring, rq->tail);
 
         /* True 32b PPGTT with dynamic page allocation: update PDP
          * registers and point the unallocated PDPs to scratch page.
@@ -1989,7 +1988,7 @@ static int execlists_context_deferred_alloc(struct i915_gem_context *ctx,
 
         ce->ring = ring;
         ce->state = vma;
-        ce->initialised = engine->init_context == NULL;
+        ce->initialised |= engine->init_context == NULL;
 
         return 0;
 
@@ -2036,8 +2035,7 @@ void intel_lr_context_resume(struct drm_i915_private *dev_priv)
                         ce->state->obj->mm.dirty = true;
                         i915_gem_object_unpin_map(ce->state->obj);
 
-                        ce->ring->head = ce->ring->tail = 0;
-                        intel_ring_update_space(ce->ring);
+                        intel_ring_reset(ce->ring, 0);
                 }
         }
 }
diff --git a/drivers/gpu/drm/i915/intel_lspcon.c b/drivers/gpu/drm/i915/intel_lspcon.c
index 71cbe9c08932..5abef482eacf 100644
--- a/drivers/gpu/drm/i915/intel_lspcon.c
+++ b/drivers/gpu/drm/i915/intel_lspcon.c
@@ -240,7 +240,7 @@ bool lspcon_init(struct intel_digital_port *intel_dig_port)
                 return false;
         }
 
-        intel_dp_read_desc(dp);
+        drm_dp_read_desc(&dp->aux, &dp->desc, drm_dp_is_branch(dp->dpcd));
 
         DRM_DEBUG_KMS("Success: LSPCON init\n");
         return true;
diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index 570bd603f401..078fd1bfa5ea 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -3373,20 +3373,26 @@ skl_plane_downscale_amount(const struct intel_crtc_state *cstate,
 
         /* n.b., src is 16.16 fixed point, dst is whole integer */
         if (plane->id == PLANE_CURSOR) {
+                /*
+                 * Cursors only support 0/180 degree rotation,
+                 * hence no need to account for rotation here.
+                 */
                 src_w = pstate->base.src_w;
                 src_h = pstate->base.src_h;
                 dst_w = pstate->base.crtc_w;
                 dst_h = pstate->base.crtc_h;
         } else {
+                /*
+                 * Src coordinates are already rotated by 270 degrees for
+                 * the 90/270 degree plane rotation cases (to match the
+                 * GTT mapping), hence no need to account for rotation here.
+                 */
                 src_w = drm_rect_width(&pstate->base.src);
                 src_h = drm_rect_height(&pstate->base.src);
                 dst_w = drm_rect_width(&pstate->base.dst);
                 dst_h = drm_rect_height(&pstate->base.dst);
         }
 
-        if (drm_rotation_90_or_270(pstate->base.rotation))
-                swap(dst_w, dst_h);
-
         downscale_h = max(src_h / dst_h, (uint32_t)DRM_PLANE_HELPER_NO_SCALING);
         downscale_w = max(src_w / dst_w, (uint32_t)DRM_PLANE_HELPER_NO_SCALING);
 
@@ -3417,12 +3423,14 @@ skl_plane_relative_data_rate(const struct intel_crtc_state *cstate,
         if (y && format != DRM_FORMAT_NV12)
                 return 0;
 
+        /*
+         * Src coordinates are already rotated by 270 degrees for
+         * the 90/270 degree plane rotation cases (to match the
+         * GTT mapping), hence no need to account for rotation here.
+         */
         width = drm_rect_width(&intel_pstate->base.src) >> 16;
         height = drm_rect_height(&intel_pstate->base.src) >> 16;
 
-        if (drm_rotation_90_or_270(pstate->rotation))
-                swap(width, height);
-
         /* for planar format */
         if (format == DRM_FORMAT_NV12) {
                 if (y)  /* y-plane data rate */
@@ -3505,12 +3513,14 @@ skl_ddb_min_alloc(const struct drm_plane_state *pstate,
             fb->modifier != I915_FORMAT_MOD_Yf_TILED)
                 return 8;
 
+        /*
+         * Src coordinates are already rotated by 270 degrees for
+         * the 90/270 degree plane rotation cases (to match the
+         * GTT mapping), hence no need to account for rotation here.
+         */
         src_w = drm_rect_width(&intel_pstate->base.src) >> 16;
         src_h = drm_rect_height(&intel_pstate->base.src) >> 16;
 
-        if (drm_rotation_90_or_270(pstate->rotation))
-                swap(src_w, src_h);
-
         /* Halve UV plane width and height for NV12 */
         if (fb->format->format == DRM_FORMAT_NV12 && !y) {
                 src_w /= 2;
@@ -3794,13 +3804,15 @@ static int skl_compute_plane_wm(const struct drm_i915_private *dev_priv,
                 width = intel_pstate->base.crtc_w;
                 height = intel_pstate->base.crtc_h;
         } else {
+                /*
+                 * Src coordinates are already rotated by 270 degrees for
+                 * the 90/270 degree plane rotation cases (to match the
+                 * GTT mapping), hence no need to account for rotation here.
+                 */
                 width = drm_rect_width(&intel_pstate->base.src) >> 16;
                 height = drm_rect_height(&intel_pstate->base.src) >> 16;
         }
 
-        if (drm_rotation_90_or_270(pstate->rotation))
-                swap(width, height);
-
         cpp = fb->format->cpp[0];
         plane_pixel_rate = skl_adjusted_plane_pixel_rate(cstate, intel_pstate);
 
@@ -4335,11 +4347,19 @@ skl_compute_wm(struct drm_atomic_state *state)
         struct drm_crtc_state *cstate;
         struct intel_atomic_state *intel_state = to_intel_atomic_state(state);
         struct skl_wm_values *results = &intel_state->wm_results;
+        struct drm_device *dev = state->dev;
         struct skl_pipe_wm *pipe_wm;
         bool changed = false;
         int ret, i;
 
         /*
+         * When we distrust bios wm we always need to recompute to set the
+         * expected DDB allocations for each CRTC.
+         */
+        if (to_i915(dev)->wm.distrust_bios_wm)
+                changed = true;
+
+        /*
          * If this transaction isn't actually touching any CRTC's, don't
          * bother with watermark calculation.  Note that if we pass this
          * test, we're guaranteed to hold at least one CRTC state mutex,
@@ -4349,6 +4369,7 @@ skl_compute_wm(struct drm_atomic_state *state)
          */
         for_each_new_crtc_in_state(state, crtc, cstate, i)
                 changed = true;
+
         if (!changed)
                 return 0;
 
diff --git a/drivers/gpu/drm/i915/intel_psr.c b/drivers/gpu/drm/i915/intel_psr.c
index c3780d0d2baf..559f1ab42bfc 100644
--- a/drivers/gpu/drm/i915/intel_psr.c
+++ b/drivers/gpu/drm/i915/intel_psr.c
@@ -435,8 +435,9 @@ static bool intel_psr_match_conditions(struct intel_dp *intel_dp)
         }
 
         /* PSR2 is restricted to work with panel resolutions upto 3200x2000 */
-        if (intel_crtc->config->pipe_src_w > 3200 ||
-                                intel_crtc->config->pipe_src_h > 2000) {
+        if (dev_priv->psr.psr2_support &&
+            (intel_crtc->config->pipe_src_w > 3200 ||
+             intel_crtc->config->pipe_src_h > 2000)) {
                 dev_priv->psr.psr2_support = false;
                 return false;
         }
diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c
index 66a2b8b83972..513a0f4b469b 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
@@ -49,7 +49,7 @@ static int __intel_ring_space(int head, int tail, int size)
 
 void intel_ring_update_space(struct intel_ring *ring)
 {
-        ring->space = __intel_ring_space(ring->head, ring->tail, ring->size);
+        ring->space = __intel_ring_space(ring->head, ring->emit, ring->size);
 }
 
 static int
@@ -774,8 +774,8 @@ static void i9xx_submit_request(struct drm_i915_gem_request *request)
 
         i915_gem_request_submit(request);
 
-        assert_ring_tail_valid(request->ring, request->tail);
-        I915_WRITE_TAIL(request->engine, request->tail);
+        I915_WRITE_TAIL(request->engine,
+                        intel_ring_set_tail(request->ring, request->tail));
 }
 
 static void i9xx_emit_breadcrumb(struct drm_i915_gem_request *req, u32 *cs)
@@ -1316,11 +1316,23 @@ err:
         return PTR_ERR(addr);
 }
 
+void intel_ring_reset(struct intel_ring *ring, u32 tail)
+{
+        GEM_BUG_ON(!list_empty(&ring->request_list));
+        ring->tail = tail;
+        ring->head = tail;
+        ring->emit = tail;
+        intel_ring_update_space(ring);
+}
+
 void intel_ring_unpin(struct intel_ring *ring)
 {
         GEM_BUG_ON(!ring->vma);
         GEM_BUG_ON(!ring->vaddr);
 
+        /* Discard any unused bytes beyond that submitted to hw. */
+        intel_ring_reset(ring, ring->tail);
+
         if (i915_vma_is_map_and_fenceable(ring->vma))
                 i915_vma_unpin_iomap(ring->vma);
         else
@@ -1562,8 +1574,9 @@ void intel_legacy_submission_resume(struct drm_i915_private *dev_priv)
         struct intel_engine_cs *engine;
         enum intel_engine_id id;
 
+        /* Restart from the beginning of the rings for convenience */
         for_each_engine(engine, dev_priv, id)
-                engine->buffer->head = engine->buffer->tail;
+                intel_ring_reset(engine->buffer, 0);
 }
 
 static int ring_request_alloc(struct drm_i915_gem_request *request)
@@ -1616,7 +1629,7 @@ static int wait_for_space(struct drm_i915_gem_request *req, int bytes)
                 unsigned space;
 
                 /* Would completion of this request free enough space? */
-                space = __intel_ring_space(target->postfix, ring->tail,
+                space = __intel_ring_space(target->postfix, ring->emit,
                                            ring->size);
                 if (space >= bytes)
                         break;
@@ -1641,8 +1654,8 @@ static int wait_for_space(struct drm_i915_gem_request *req, int bytes)
 u32 *intel_ring_begin(struct drm_i915_gem_request *req, int num_dwords)
 {
         struct intel_ring *ring = req->ring;
-        int remain_actual = ring->size - ring->tail;
-        int remain_usable = ring->effective_size - ring->tail;
+        int remain_actual = ring->size - ring->emit;
+        int remain_usable = ring->effective_size - ring->emit;
         int bytes = num_dwords * sizeof(u32);
         int total_bytes, wait_bytes;
         bool need_wrap = false;
@@ -1678,17 +1691,17 @@ u32 *intel_ring_begin(struct drm_i915_gem_request *req, int num_dwords)
 
         if (unlikely(need_wrap)) {
                 GEM_BUG_ON(remain_actual > ring->space);
-                GEM_BUG_ON(ring->tail + remain_actual > ring->size);
+                GEM_BUG_ON(ring->emit + remain_actual > ring->size);
 
                 /* Fill the tail with MI_NOOP */
-                memset(ring->vaddr + ring->tail, 0, remain_actual);
-                ring->tail = 0;
+                memset(ring->vaddr + ring->emit, 0, remain_actual);
+                ring->emit = 0;
                 ring->space -= remain_actual;
         }
 
-        GEM_BUG_ON(ring->tail > ring->size - bytes);
-        cs = ring->vaddr + ring->tail;
-        ring->tail += bytes;
+        GEM_BUG_ON(ring->emit > ring->size - bytes);
+        cs = ring->vaddr + ring->emit;
+        ring->emit += bytes;
         ring->space -= bytes;
         GEM_BUG_ON(ring->space < 0);
 
@@ -1699,7 +1712,7 @@ u32 *intel_ring_begin(struct drm_i915_gem_request *req, int num_dwords)
 int intel_ring_cacheline_align(struct drm_i915_gem_request *req)
 {
         int num_dwords =
-                (req->ring->tail & (CACHELINE_BYTES - 1)) / sizeof(uint32_t);
+                (req->ring->emit & (CACHELINE_BYTES - 1)) / sizeof(uint32_t);
         u32 *cs;
 
         if (num_dwords == 0)
diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.h b/drivers/gpu/drm/i915/intel_ringbuffer.h
index a82a0807f64d..f7144fe09613 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.h
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.h
@@ -145,6 +145,7 @@ struct intel_ring {
 
         u32 head;
         u32 tail;
+        u32 emit;
 
         int space;
         int size;
@@ -488,6 +489,8 @@ intel_write_status_page(struct intel_engine_cs *engine, int reg, u32 value)
 struct intel_ring *
 intel_engine_create_ring(struct intel_engine_cs *engine, int size);
 int intel_ring_pin(struct intel_ring *ring, unsigned int offset_bias);
+void intel_ring_reset(struct intel_ring *ring, u32 tail);
+void intel_ring_update_space(struct intel_ring *ring);
 void intel_ring_unpin(struct intel_ring *ring);
 void intel_ring_free(struct intel_ring *ring);
 
@@ -511,7 +514,7 @@ intel_ring_advance(struct drm_i915_gem_request *req, u32 *cs)
          * reserved for the command packet (i.e. the value passed to
          * intel_ring_begin()).
          */
-        GEM_BUG_ON((req->ring->vaddr + req->ring->tail) != cs);
+        GEM_BUG_ON((req->ring->vaddr + req->ring->emit) != cs);
 }
 
 static inline u32
@@ -540,7 +543,19 @@ assert_ring_tail_valid(const struct intel_ring *ring, unsigned int tail)
         GEM_BUG_ON(tail >= ring->size);
 }
 
-void intel_ring_update_space(struct intel_ring *ring);
+static inline unsigned int
+intel_ring_set_tail(struct intel_ring *ring, unsigned int tail)
+{
+        /* Whilst writes to the tail are strictly order, there is no
+         * serialisation between readers and the writers. The tail may be
+         * read by i915_gem_request_retire() just as it is being updated
+         * by execlists, as although the breadcrumb is complete, the context
+         * switch hasn't been seen.
+         */
+        assert_ring_tail_valid(ring, tail);
+        ring->tail = tail;
+        return tail;
+}
 
 void intel_engine_init_global_seqno(struct intel_engine_cs *engine, u32 seqno);
 
diff --git a/drivers/gpu/drm/i915/intel_sprite.c b/drivers/gpu/drm/i915/intel_sprite.c
index 8c87c717c7cd..e6517edcd16b 100644
--- a/drivers/gpu/drm/i915/intel_sprite.c
+++ b/drivers/gpu/drm/i915/intel_sprite.c
@@ -83,10 +83,13 @@ int intel_usecs_to_scanlines(const struct drm_display_mode *adjusted_mode,
  */
 void intel_pipe_update_start(struct intel_crtc *crtc)
 {
+        struct drm_i915_private *dev_priv = to_i915(crtc->base.dev);
         const struct drm_display_mode *adjusted_mode = &crtc->config->base.adjusted_mode;
         long timeout = msecs_to_jiffies_timeout(1);
         int scanline, min, max, vblank_start;
         wait_queue_head_t *wq = drm_crtc_vblank_waitqueue(&crtc->base);
+        bool need_vlv_dsi_wa = (IS_VALLEYVIEW(dev_priv) || IS_CHERRYVIEW(dev_priv)) &&
+                intel_crtc_has_type(crtc->config, INTEL_OUTPUT_DSI);
         DEFINE_WAIT(wait);
 
         vblank_start = adjusted_mode->crtc_vblank_start;
@@ -139,6 +142,24 @@ void intel_pipe_update_start(struct intel_crtc *crtc)
 
         drm_crtc_vblank_put(&crtc->base);
 
+        /*
+         * On VLV/CHV DSI the scanline counter would appear to
+         * increment approx. 1/3 of a scanline before start of vblank.
+         * The registers still get latched at start of vblank however.
+         * This means we must not write any registers on the first
+         * line of vblank (since not the whole line is actually in
+         * vblank). And unfortunately we can't use the interrupt to
+         * wait here since it will fire too soon. We could use the
+         * frame start interrupt instead since it will fire after the
+         * critical scanline, but that would require more changes
+         * in the interrupt code. So for now we'll just do the nasty
+         * thing and poll for the bad scanline to pass us by.
+         *
+         * FIXME figure out if BXT+ DSI suffers from this as well
+         */
+        while (need_vlv_dsi_wa && scanline == vblank_start)
+                scanline = intel_get_crtc_scanline(crtc);
+
         crtc->debug.scanline_start = scanline;
         crtc->debug.start_vbl_time = ktime_get();
         crtc->debug.start_vbl_count = intel_crtc_get_vblank_counter(crtc);
diff --git a/drivers/gpu/drm/i915/intel_uc.h b/drivers/gpu/drm/i915/intel_uc.h
index 4b7f73aeddac..f84115261ae7 100644
--- a/drivers/gpu/drm/i915/intel_uc.h
+++ b/drivers/gpu/drm/i915/intel_uc.h
@@ -59,8 +59,6 @@ struct drm_i915_gem_request;
  *                available in the work queue (note, the queue is shared,
  *                not per-engine). It is OK for this to be nonzero, but
  *                it should not be huge!
- *   q_fail: failed to enqueue a work item. This should never happen,
- *           because we check for space beforehand.
  *   b_fail: failed to ring the doorbell. This should never happen, unless
  *           somehow the hardware misbehaves, or maybe if the GuC firmware
  *           crashes? We probably need to reset the GPU to recover.
diff --git a/drivers/gpu/drm/i915/selftests/i915_gem_context.c b/drivers/gpu/drm/i915/selftests/i915_gem_context.c
index 1afb8b06e3e1..12b85b3278cd 100644
--- a/drivers/gpu/drm/i915/selftests/i915_gem_context.c
+++ b/drivers/gpu/drm/i915/selftests/i915_gem_context.c
@@ -320,7 +320,7 @@ static unsigned long max_dwords(struct drm_i915_gem_object *obj)
 static int igt_ctx_exec(void *arg)
 {
         struct drm_i915_private *i915 = arg;
-        struct drm_i915_gem_object *obj;
+        struct drm_i915_gem_object *obj = NULL;
         struct drm_file *file;
         IGT_TIMEOUT(end_time);
         LIST_HEAD(objects);
@@ -359,7 +359,7 @@ static int igt_ctx_exec(void *arg)
                 }
 
                 for_each_engine(engine, i915, id) {
-                        if (dw == 0) {
+                        if (!obj) {
                                 obj = create_test_object(ctx, file, &objects);
                                 if (IS_ERR(obj)) {
                                         err = PTR_ERR(obj);
@@ -376,8 +376,10 @@ static int igt_ctx_exec(void *arg)
                                 goto out_unlock;
                         }
 
-                        if (++dw == max_dwords(obj))
+                        if (++dw == max_dwords(obj)) {
+                                obj = NULL;
                                 dw = 0;
+                        }
                         ndwords++;
                 }
                 ncontexts++;
diff --git a/drivers/gpu/drm/imx/imx-ldb.c b/drivers/gpu/drm/imx/imx-ldb.c
index 8fb801fab039..8b05ecb8fdef 100644
--- a/drivers/gpu/drm/imx/imx-ldb.c
+++ b/drivers/gpu/drm/imx/imx-ldb.c
@@ -673,7 +673,7 @@ static int imx_ldb_bind(struct device *dev, struct device *master, void *data)
                 ret = drm_of_find_panel_or_bridge(child,
                                                   imx_ldb->lvds_mux ? 4 : 2, 0,
                                                   &channel->panel, &channel->bridge);
-                if (ret)
+                if (ret && ret != -ENODEV)
                         return ret;
 
                 /* panel ddc only if there is no bridge */
diff --git a/drivers/gpu/drm/mediatek/mtk_dsi.c b/drivers/gpu/drm/mediatek/mtk_dsi.c
index 808b995a990f..b5cc6e12334c 100644
--- a/drivers/gpu/drm/mediatek/mtk_dsi.c
+++ b/drivers/gpu/drm/mediatek/mtk_dsi.c
@@ -19,6 +19,7 @@
 #include <drm/drm_of.h>
 #include <linux/clk.h>
 #include <linux/component.h>
+#include <linux/iopoll.h>
 #include <linux/irq.h>
 #include <linux/of.h>
 #include <linux/of_platform.h>
@@ -900,16 +901,12 @@ static int mtk_dsi_host_detach(struct mipi_dsi_host *host,
 
 static void mtk_dsi_wait_for_idle(struct mtk_dsi *dsi)
 {
-        u32 timeout_ms = 500000; /* total 1s ~ 2s timeout */
-
-        while (timeout_ms--) {
-                if (!(readl(dsi->regs + DSI_INTSTA) & DSI_BUSY))
-                        break;
-
-                usleep_range(2, 4);
-        }
+        int ret;
+        u32 val;
 
-        if (timeout_ms == 0) {
+        ret = readl_poll_timeout(dsi->regs + DSI_INTSTA, val, !(val & DSI_BUSY),
+                                 4, 2000000);
+        if (ret) {
                 DRM_WARN("polling dsi wait not busy timeout!\n");
 
                 mtk_dsi_enable(dsi);
diff --git a/drivers/gpu/drm/mediatek/mtk_hdmi.c b/drivers/gpu/drm/mediatek/mtk_hdmi.c
index 41a1c03b0347..0a4ffd724146 100644
--- a/drivers/gpu/drm/mediatek/mtk_hdmi.c
+++ b/drivers/gpu/drm/mediatek/mtk_hdmi.c
@@ -1062,7 +1062,7 @@ static int mtk_hdmi_setup_vendor_specific_infoframe(struct mtk_hdmi *hdmi,
         }
 
         err = hdmi_vendor_infoframe_pack(&frame, buffer, sizeof(buffer));
-        if (err) {
+        if (err < 0) {
                 dev_err(hdmi->dev, "Failed to pack vendor infoframe: %zd\n",
                         err);
                 return err;
diff --git a/drivers/gpu/drm/meson/meson_drv.c b/drivers/gpu/drm/meson/meson_drv.c
index 75382f5f0fce..10b227d83e9a 100644
--- a/drivers/gpu/drm/meson/meson_drv.c
+++ b/drivers/gpu/drm/meson/meson_drv.c
@@ -152,7 +152,7 @@ static struct regmap_config meson_regmap_config = {
         .max_register   = 0x1000,
 };
 
-static int meson_drv_bind(struct device *dev)
+static int meson_drv_bind_master(struct device *dev, bool has_components)
 {
         struct platform_device *pdev = to_platform_device(dev);
         struct meson_drm *priv;
@@ -233,10 +233,12 @@ static int meson_drv_bind(struct device *dev)
         if (ret)
                 goto free_drm;
 
-        ret = component_bind_all(drm->dev, drm);
-        if (ret) {
-                dev_err(drm->dev, "Couldn't bind all components\n");
-                goto free_drm;
+        if (has_components) {
+                ret = component_bind_all(drm->dev, drm);
+                if (ret) {
+                        dev_err(drm->dev, "Couldn't bind all components\n");
+                        goto free_drm;
+                }
         }
 
         ret = meson_plane_create(priv);
@@ -276,6 +278,11 @@ free_drm:
         return ret;
 }
 
+static int meson_drv_bind(struct device *dev)
+{
+        return meson_drv_bind_master(dev, true);
+}
+
 static void meson_drv_unbind(struct device *dev)
 {
         struct drm_device *drm = dev_get_drvdata(dev);
@@ -357,6 +364,9 @@ static int meson_drv_probe(struct platform_device *pdev)
                 count += meson_probe_remote(pdev, &match, np, remote);
         }
 
+        if (count && !match)
+                return meson_drv_bind_master(&pdev->dev, false);
+
         /* If some endpoints were found, initialize the nodes */
         if (count) {
                 dev_info(&pdev->dev, "Queued %d outputs on vpu\n", count);
diff --git a/drivers/gpu/drm/mgag200/mgag200_mode.c b/drivers/gpu/drm/mgag200/mgag200_mode.c
index adb411a078e8..f4b53588e071 100644
--- a/drivers/gpu/drm/mgag200/mgag200_mode.c
+++ b/drivers/gpu/drm/mgag200/mgag200_mode.c
@@ -1173,7 +1173,10 @@ static int mga_crtc_mode_set(struct drm_crtc *crtc,
 
 
         if (IS_G200_SE(mdev)) {
-                if (mdev->unique_rev_id >= 0x02) {
+                if  (mdev->unique_rev_id >= 0x04) {
+                        WREG8(MGAREG_CRTCEXT_INDEX, 0x06);
+                        WREG8(MGAREG_CRTCEXT_DATA, 0);
+                } else if (mdev->unique_rev_id >= 0x02) {
                         u8 hi_pri_lvl;
                         u32 bpp;
                         u32 mb;
@@ -1639,6 +1642,10 @@ static int mga_vga_mode_valid(struct drm_connector *connector,
                         if (mga_vga_calculate_mode_bandwidth(mode, bpp)
                                 > (30100 * 1024))
                                 return MODE_BANDWIDTH;
+                } else {
+                        if (mga_vga_calculate_mode_bandwidth(mode, bpp)
+                                > (55000 * 1024))
+                                return MODE_BANDWIDTH;
                 }
         } else if (mdev->type == G200_WB) {
                 if (mode->hdisplay > 1280)
diff --git a/drivers/gpu/drm/msm/Kconfig b/drivers/gpu/drm/msm/Kconfig
index 5b8e23d051f2..0a31cd6d01ce 100644
--- a/drivers/gpu/drm/msm/Kconfig
+++ b/drivers/gpu/drm/msm/Kconfig
@@ -13,6 +13,7 @@ config DRM_MSM
         select QCOM_SCM
         select SND_SOC_HDMI_CODEC if SND_SOC
         select SYNC_FILE
+        select PM_OPP
         default y
         help
           DRM/KMS driver for MSM/snapdragon.
diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_mdss.c b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_mdss.c
index f8f48d014978..9c34d7824988 100644
--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_mdss.c
+++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_mdss.c
@@ -116,7 +116,7 @@ static int mdss_hw_irqdomain_map(struct irq_domain *d, unsigned int irq,
         return 0;
 }
 
-static struct irq_domain_ops mdss_hw_irqdomain_ops = {
+static const struct irq_domain_ops mdss_hw_irqdomain_ops = {
         .map = mdss_hw_irqdomain_map,
         .xlate = irq_domain_xlate_onecell,
 };
diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_plane.c b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_plane.c
index a38c5fe6cc19..7d3741215387 100644
--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_plane.c
+++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_plane.c
@@ -225,9 +225,10 @@ mdp5_plane_duplicate_state(struct drm_plane *plane)
 
         mdp5_state = kmemdup(to_mdp5_plane_state(plane->state),
                         sizeof(*mdp5_state), GFP_KERNEL);
+        if (!mdp5_state)
+                return NULL;
 
-        if (mdp5_state && mdp5_state->base.fb)
-                drm_framebuffer_reference(mdp5_state->base.fb);
+        __drm_atomic_helper_plane_duplicate_state(plane, &mdp5_state->base);
 
         return &mdp5_state->base;
 }
@@ -444,6 +445,10 @@ static int mdp5_plane_atomic_check_with_state(struct drm_crtc_state *crtc_state,
                         mdp5_pipe_release(state->state, old_hwpipe);
                         mdp5_pipe_release(state->state, old_right_hwpipe);
                 }
+        } else {
+                mdp5_pipe_release(state->state, mdp5_state->hwpipe);
+                mdp5_pipe_release(state->state, mdp5_state->r_hwpipe);
+                mdp5_state->hwpipe = mdp5_state->r_hwpipe = NULL;
         }
 
         return 0;
diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c
index 87b5695d4034..9d498eb81906 100644
--- a/drivers/gpu/drm/msm/msm_drv.c
+++ b/drivers/gpu/drm/msm/msm_drv.c
@@ -830,6 +830,7 @@ static struct drm_driver msm_driver = {
         .prime_fd_to_handle = drm_gem_prime_fd_to_handle,
         .gem_prime_export   = drm_gem_prime_export,
         .gem_prime_import   = drm_gem_prime_import,
+        .gem_prime_res_obj  = msm_gem_prime_res_obj,
         .gem_prime_pin      = msm_gem_prime_pin,
         .gem_prime_unpin    = msm_gem_prime_unpin,
         .gem_prime_get_sg_table = msm_gem_prime_get_sg_table,
diff --git a/drivers/gpu/drm/msm/msm_drv.h b/drivers/gpu/drm/msm/msm_drv.h
index 28b6f9ba5066..1b26ca626528 100644
--- a/drivers/gpu/drm/msm/msm_drv.h
+++ b/drivers/gpu/drm/msm/msm_drv.h
@@ -224,6 +224,7 @@ struct sg_table *msm_gem_prime_get_sg_table(struct drm_gem_object *obj);
 void *msm_gem_prime_vmap(struct drm_gem_object *obj);
 void msm_gem_prime_vunmap(struct drm_gem_object *obj, void *vaddr);
 int msm_gem_prime_mmap(struct drm_gem_object *obj, struct vm_area_struct *vma);
+struct reservation_object *msm_gem_prime_res_obj(struct drm_gem_object *obj);
 struct drm_gem_object *msm_gem_prime_import_sg_table(struct drm_device *dev,
                 struct dma_buf_attachment *attach, struct sg_table *sg);
 int msm_gem_prime_pin(struct drm_gem_object *obj);
diff --git a/drivers/gpu/drm/msm/msm_fence.c b/drivers/gpu/drm/msm/msm_fence.c
index 3f299c537b77..a2f89bac9c16 100644
--- a/drivers/gpu/drm/msm/msm_fence.c
+++ b/drivers/gpu/drm/msm/msm_fence.c
@@ -99,8 +99,8 @@ void msm_update_fence(struct msm_fence_context *fctx, uint32_t fence)
 }
 
 struct msm_fence {
-        struct msm_fence_context *fctx;
         struct dma_fence base;
+        struct msm_fence_context *fctx;
 };
 
 static inline struct msm_fence *to_msm_fence(struct dma_fence *fence)
@@ -130,19 +130,13 @@ static bool msm_fence_signaled(struct dma_fence *fence)
         return fence_completed(f->fctx, f->base.seqno);
 }
 
-static void msm_fence_release(struct dma_fence *fence)
-{
-        struct msm_fence *f = to_msm_fence(fence);
-        kfree_rcu(f, base.rcu);
-}
-
 static const struct dma_fence_ops msm_fence_ops = {
         .get_driver_name = msm_fence_get_driver_name,
         .get_timeline_name = msm_fence_get_timeline_name,
         .enable_signaling = msm_fence_enable_signaling,
         .signaled = msm_fence_signaled,
         .wait = dma_fence_default_wait,
-        .release = msm_fence_release,
+        .release = dma_fence_free,
 };
 
 struct dma_fence *
diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c
index 68e509b3b9e4..50289a23baf8 100644
--- a/drivers/gpu/drm/msm/msm_gem.c
+++ b/drivers/gpu/drm/msm/msm_gem.c
@@ -758,6 +758,8 @@ static int msm_gem_new_impl(struct drm_device *dev,
         struct msm_gem_object *msm_obj;
         bool use_vram = false;
 
+        WARN_ON(!mutex_is_locked(&dev->struct_mutex));
+
         switch (flags & MSM_BO_CACHE_MASK) {
         case MSM_BO_UNCACHED:
         case MSM_BO_CACHED:
@@ -853,7 +855,11 @@ struct drm_gem_object *msm_gem_import(struct drm_device *dev,
 
         size = PAGE_ALIGN(dmabuf->size);
 
+        /* Take mutex so we can modify the inactive list in msm_gem_new_impl */
+        mutex_lock(&dev->struct_mutex);
         ret = msm_gem_new_impl(dev, size, MSM_BO_WC, dmabuf->resv, &obj);
+        mutex_unlock(&dev->struct_mutex);
+
         if (ret)
                 goto fail;
 
diff --git a/drivers/gpu/drm/msm/msm_gem_prime.c b/drivers/gpu/drm/msm/msm_gem_prime.c
index 60bb290700ce..13403c6da6c7 100644
--- a/drivers/gpu/drm/msm/msm_gem_prime.c
+++ b/drivers/gpu/drm/msm/msm_gem_prime.c
@@ -70,3 +70,10 @@ void msm_gem_prime_unpin(struct drm_gem_object *obj)
         if (!obj->import_attach)
                 msm_gem_put_pages(obj);
 }
+
+struct reservation_object *msm_gem_prime_res_obj(struct drm_gem_object *obj)
+{
+        struct msm_gem_object *msm_obj = to_msm_bo(obj);
+
+        return msm_obj->resv;
+}
diff --git a/drivers/gpu/drm/msm/msm_gem_submit.c b/drivers/gpu/drm/msm/msm_gem_submit.c
index 1c545ebe6a5a..7832e6421d25 100644
--- a/drivers/gpu/drm/msm/msm_gem_submit.c
+++ b/drivers/gpu/drm/msm/msm_gem_submit.c
@@ -410,12 +410,11 @@ int msm_ioctl_gem_submit(struct drm_device *dev, void *data,
                 if (!in_fence)
                         return -EINVAL;
 
-                /* TODO if we get an array-fence due to userspace merging multiple
-                 * fences, we need a way to determine if all the backing fences
-                 * are from our own context..
+                /*
+                 * Wait if the fence is from a foreign context, or if the fence
+                 * array contains any fence from a foreign context.
                  */
-
-                if (in_fence->context != gpu->fctx->context) {
+                if (!dma_fence_match_context(in_fence, gpu->fctx->context)) {
                         ret = dma_fence_wait(in_fence, true);
                         if (ret)
                                 return ret;
@@ -496,8 +495,9 @@ int msm_ioctl_gem_submit(struct drm_device *dev, void *data,
                         goto out;
                 }
 
-                if ((submit_cmd.size + submit_cmd.submit_offset) >=
-                                msm_obj->base.size) {
+                if (!submit_cmd.size ||
+                        ((submit_cmd.size + submit_cmd.submit_offset) >
+                                msm_obj->base.size)) {
                         DRM_ERROR("invalid cmdstream size: %u\n", submit_cmd.size);
                         ret = -EINVAL;
                         goto out;
diff --git a/drivers/gpu/drm/msm/msm_gpu.c b/drivers/gpu/drm/msm/msm_gpu.c
index 97b9c38c6b3f..0fdc88d79ca8 100644
--- a/drivers/gpu/drm/msm/msm_gpu.c
+++ b/drivers/gpu/drm/msm/msm_gpu.c
@@ -549,9 +549,9 @@ static int get_clocks(struct platform_device *pdev, struct msm_gpu *gpu)
                 gpu->grp_clks[i] = get_clock(dev, name);
 
                 /* Remember the key clocks that we need to control later */
-                if (!strcmp(name, "core"))
+                if (!strcmp(name, "core") || !strcmp(name, "core_clk"))
                         gpu->core_clk = gpu->grp_clks[i];
-                else if (!strcmp(name, "rbbmtimer"))
+                else if (!strcmp(name, "rbbmtimer") || !strcmp(name, "rbbmtimer_clk"))
                         gpu->rbbmtimer_clk = gpu->grp_clks[i];
 
                 ++i;
diff --git a/drivers/gpu/drm/mxsfb/mxsfb_crtc.c b/drivers/gpu/drm/mxsfb/mxsfb_crtc.c
index 1144e0c9e894..0abe77675b76 100644
--- a/drivers/gpu/drm/mxsfb/mxsfb_crtc.c
+++ b/drivers/gpu/drm/mxsfb/mxsfb_crtc.c
@@ -35,6 +35,13 @@
 #include "mxsfb_drv.h"
 #include "mxsfb_regs.h"
 
+#define MXS_SET_ADDR            0x4
+#define MXS_CLR_ADDR            0x8
+#define MODULE_CLKGATE          BIT(30)
+#define MODULE_SFTRST           BIT(31)
+/* 1 second delay should be plenty of time for block reset */
+#define RESET_TIMEOUT           1000000
+
 static u32 set_hsync_pulse_width(struct mxsfb_drm_private *mxsfb, u32 val)
 {
         return (val & mxsfb->devdata->hs_wdth_mask) <<
@@ -159,6 +166,36 @@ static void mxsfb_disable_controller(struct mxsfb_drm_private *mxsfb)
                 clk_disable_unprepare(mxsfb->clk_disp_axi);
 }
 
+/*
+ * Clear the bit and poll it cleared.  This is usually called with
+ * a reset address and mask being either SFTRST(bit 31) or CLKGATE
+ * (bit 30).
+ */
+static int clear_poll_bit(void __iomem *addr, u32 mask)
+{
+        u32 reg;
+
+        writel(mask, addr + MXS_CLR_ADDR);
+        return readl_poll_timeout(addr, reg, !(reg & mask), 0, RESET_TIMEOUT);
+}
+
+static int mxsfb_reset_block(void __iomem *reset_addr)
+{
+        int ret;
+
+        ret = clear_poll_bit(reset_addr, MODULE_SFTRST);
+        if (ret)
+                return ret;
+
+        writel(MODULE_CLKGATE, reset_addr + MXS_CLR_ADDR);
+
+        ret = clear_poll_bit(reset_addr, MODULE_SFTRST);
+        if (ret)
+                return ret;
+
+        return clear_poll_bit(reset_addr, MODULE_CLKGATE);
+}
+
 static void mxsfb_crtc_mode_set_nofb(struct mxsfb_drm_private *mxsfb)
 {
         struct drm_display_mode *m = &mxsfb->pipe.crtc.state->adjusted_mode;
@@ -173,6 +210,11 @@ static void mxsfb_crtc_mode_set_nofb(struct mxsfb_drm_private *mxsfb)
          */
         mxsfb_enable_axi_clk(mxsfb);
 
+        /* Mandatory eLCDIF reset as per the Reference Manual */
+        err = mxsfb_reset_block(mxsfb->base);
+        if (err)
+                return;
+
         /* Clear the FIFOs */
         writel(CTRL1_FIFO_CLEAR, mxsfb->base + LCDC_CTRL1 + REG_SET);
 
diff --git a/drivers/gpu/drm/nouveau/include/nvkm/subdev/timer.h b/drivers/gpu/drm/nouveau/include/nvkm/subdev/timer.h
index 6a567fe347b3..820a4805916f 100644
--- a/drivers/gpu/drm/nouveau/include/nvkm/subdev/timer.h
+++ b/drivers/gpu/drm/nouveau/include/nvkm/subdev/timer.h
@@ -4,6 +4,7 @@
 
 struct nvkm_alarm {
         struct list_head head;
+        struct list_head exec;
         u64 timestamp;
         void (*func)(struct nvkm_alarm *);
 };
diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c
index 36268e1802b5..15a13d09d431 100644
--- a/drivers/gpu/drm/nouveau/nouveau_drm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_drm.c
@@ -80,7 +80,7 @@ int nouveau_modeset = -1;
 module_param_named(modeset, nouveau_modeset, int, 0400);
 
 MODULE_PARM_DESC(runpm, "disable (0), force enable (1), optimus only default (-1)");
-int nouveau_runtime_pm = -1;
+static int nouveau_runtime_pm = -1;
 module_param_named(runpm, nouveau_runtime_pm, int, 0400);
 
 static struct drm_driver driver_stub;
@@ -495,7 +495,7 @@ nouveau_drm_load(struct drm_device *dev, unsigned long flags)
         nouveau_fbcon_init(dev);
         nouveau_led_init(dev);
 
-        if (nouveau_runtime_pm != 0) {
+        if (nouveau_pmops_runtime()) {
                 pm_runtime_use_autosuspend(dev->dev);
                 pm_runtime_set_autosuspend_delay(dev->dev, 5000);
                 pm_runtime_set_active(dev->dev);
@@ -527,7 +527,7 @@ nouveau_drm_unload(struct drm_device *dev)
 {
         struct nouveau_drm *drm = nouveau_drm(dev);
 
-        if (nouveau_runtime_pm != 0) {
+        if (nouveau_pmops_runtime()) {
                 pm_runtime_get_sync(dev->dev);
                 pm_runtime_forbid(dev->dev);
         }
@@ -726,6 +726,14 @@ nouveau_pmops_thaw(struct device *dev)
         return nouveau_do_resume(drm_dev, false);
 }
 
+bool
+nouveau_pmops_runtime()
+{
+        if (nouveau_runtime_pm == -1)
+                return nouveau_is_optimus() || nouveau_is_v1_dsm();
+        return nouveau_runtime_pm == 1;
+}
+
 static int
 nouveau_pmops_runtime_suspend(struct device *dev)
 {
@@ -733,14 +741,7 @@ nouveau_pmops_runtime_suspend(struct device *dev)
         struct drm_device *drm_dev = pci_get_drvdata(pdev);
         int ret;
 
-        if (nouveau_runtime_pm == 0) {
-                pm_runtime_forbid(dev);
-                return -EBUSY;
-        }
-
-        /* are we optimus enabled? */
-        if (nouveau_runtime_pm == -1 && !nouveau_is_optimus() && !nouveau_is_v1_dsm()) {
-                DRM_DEBUG_DRIVER("failing to power off - not optimus\n");
+        if (!nouveau_pmops_runtime()) {
                 pm_runtime_forbid(dev);
                 return -EBUSY;
         }
@@ -765,8 +766,10 @@ nouveau_pmops_runtime_resume(struct device *dev)
         struct nvif_device *device = &nouveau_drm(drm_dev)->client.device;
         int ret;
 
-        if (nouveau_runtime_pm == 0)
-                return -EINVAL;
+        if (!nouveau_pmops_runtime()) {
+                pm_runtime_forbid(dev);
+                return -EBUSY;
+        }
 
         pci_set_power_state(pdev, PCI_D0);
         pci_restore_state(pdev);
@@ -796,14 +799,7 @@ nouveau_pmops_runtime_idle(struct device *dev)
         struct nouveau_drm *drm = nouveau_drm(drm_dev);
         struct drm_crtc *crtc;
 
-        if (nouveau_runtime_pm == 0) {
-                pm_runtime_forbid(dev);
-                return -EBUSY;
-        }
-
-        /* are we optimus enabled? */
-        if (nouveau_runtime_pm == -1 && !nouveau_is_optimus() && !nouveau_is_v1_dsm()) {
-                DRM_DEBUG_DRIVER("failing to power off - not optimus\n");
+        if (!nouveau_pmops_runtime()) {
                 pm_runtime_forbid(dev);
                 return -EBUSY;
         }
diff --git a/drivers/gpu/drm/nouveau/nouveau_drv.h b/drivers/gpu/drm/nouveau/nouveau_drv.h
index eadec2f49ad3..a11b6aaed325 100644
--- a/drivers/gpu/drm/nouveau/nouveau_drv.h
+++ b/drivers/gpu/drm/nouveau/nouveau_drv.h
@@ -108,8 +108,6 @@ nouveau_cli(struct drm_file *fpriv)
 #include <nvif/object.h>
 #include <nvif/device.h>
 
-extern int nouveau_runtime_pm;
-
 struct nouveau_drm {
         struct nouveau_cli client;
         struct drm_device *dev;
@@ -195,6 +193,7 @@ nouveau_drm(struct drm_device *dev)
 
 int nouveau_pmops_suspend(struct device *);
 int nouveau_pmops_resume(struct device *);
+bool nouveau_pmops_runtime(void);
 
 #include <nvkm/core/tegra.h>
 
diff --git a/drivers/gpu/drm/nouveau/nouveau_vga.c b/drivers/gpu/drm/nouveau/nouveau_vga.c
index a4aacbc0cec8..02fe0efb9e16 100644
--- a/drivers/gpu/drm/nouveau/nouveau_vga.c
+++ b/drivers/gpu/drm/nouveau/nouveau_vga.c
@@ -87,7 +87,7 @@ void
 nouveau_vga_init(struct nouveau_drm *drm)
 {
         struct drm_device *dev = drm->dev;
-        bool runtime = false;
+        bool runtime = nouveau_pmops_runtime();
 
         /* only relevant for PCI devices */
         if (!dev->pdev)
@@ -99,10 +99,6 @@ nouveau_vga_init(struct nouveau_drm *drm)
         if (pci_is_thunderbolt_attached(dev->pdev))
                 return;
 
-        if (nouveau_runtime_pm == 1)
-                runtime = true;
-        if ((nouveau_runtime_pm == -1) && (nouveau_is_optimus() || nouveau_is_v1_dsm()))
-                runtime = true;
         vga_switcheroo_register_client(dev->pdev, &nouveau_switcheroo_ops, runtime);
 
         if (runtime && nouveau_is_v1_dsm() && !nouveau_is_optimus())
@@ -113,18 +109,13 @@ void
 nouveau_vga_fini(struct nouveau_drm *drm)
 {
         struct drm_device *dev = drm->dev;
-        bool runtime = false;
+        bool runtime = nouveau_pmops_runtime();
 
         vga_client_register(dev->pdev, NULL, NULL, NULL);
 
         if (pci_is_thunderbolt_attached(dev->pdev))
                 return;
 
-        if (nouveau_runtime_pm == 1)
-                runtime = true;
-        if ((nouveau_runtime_pm == -1) && (nouveau_is_optimus() || nouveau_is_v1_dsm()))
-                runtime = true;
-
         vga_switcheroo_unregister_client(dev->pdev);
         if (runtime && nouveau_is_v1_dsm() && !nouveau_is_optimus())
                 vga_switcheroo_fini_domain_pm_ops(drm->dev->dev);
diff --git a/drivers/gpu/drm/nouveau/nv50_display.c b/drivers/gpu/drm/nouveau/nv50_display.c
index a7663249b3ba..06e564a9ccb2 100644
--- a/drivers/gpu/drm/nouveau/nv50_display.c
+++ b/drivers/gpu/drm/nouveau/nv50_display.c
@@ -2107,7 +2107,8 @@ nv50_head_atomic_check(struct drm_crtc *crtc, struct drm_crtc_state *state)
                                         asyc->set.dither = true;
                         }
                 } else {
-                        asyc->set.mask = ~0;
+                        if (asyc)
+                                asyc->set.mask = ~0;
                         asyh->set.mask = ~0;
                 }
 
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/timer/base.c b/drivers/gpu/drm/nouveau/nvkm/subdev/timer/base.c
index f2a86eae0a0d..2437f7d41ca2 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/timer/base.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/timer/base.c
@@ -50,7 +50,8 @@ nvkm_timer_alarm_trigger(struct nvkm_timer *tmr)
                 /* Move to completed list.  We'll drop the lock before
                  * executing the callback so it can reschedule itself.
                  */
-                list_move_tail(&alarm->head, &exec);
+                list_del_init(&alarm->head);
+                list_add(&alarm->exec, &exec);
         }
 
         /* Shut down interrupt if no more pending alarms. */
@@ -59,8 +60,8 @@ nvkm_timer_alarm_trigger(struct nvkm_timer *tmr)
         spin_unlock_irqrestore(&tmr->lock, flags);
 
         /* Execute completed callbacks. */
-        list_for_each_entry_safe(alarm, atemp, &exec, head) {
-                list_del_init(&alarm->head);
+        list_for_each_entry_safe(alarm, atemp, &exec, exec) {
+                list_del(&alarm->exec);
                 alarm->func(alarm);
         }
 }
diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
index 008c145b7f29..ca44233ceacc 100644
--- a/drivers/gpu/drm/radeon/cik.c
+++ b/drivers/gpu/drm/radeon/cik.c
@@ -9267,8 +9267,11 @@ static void dce8_program_watermarks(struct radeon_device *rdev,
         u32 tmp, wm_mask;
 
         if (radeon_crtc->base.enabled && num_heads && mode) {
-                active_time = 1000000UL * (u32)mode->crtc_hdisplay / (u32)mode->clock;
-                line_time = min((u32) (1000000UL * (u32)mode->crtc_htotal / (u32)mode->clock), (u32)65535);
+                active_time = (u32) div_u64((u64)mode->crtc_hdisplay * 1000000,
+                                            (u32)mode->clock);
+                line_time = (u32) div_u64((u64)mode->crtc_htotal * 1000000,
+                                          (u32)mode->clock);
+                line_time = min(line_time, (u32)65535);
 
                 /* watermark for high clocks */
                 if ((rdev->pm.pm_method == PM_METHOD_DPM) &&
diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
index 0bf103536404..534637203e70 100644
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -2266,8 +2266,11 @@ static void evergreen_program_watermarks(struct radeon_device *rdev,
         fixed20_12 a, b, c;
 
         if (radeon_crtc->base.enabled && num_heads && mode) {
-                active_time = 1000000UL * (u32)mode->crtc_hdisplay / (u32)mode->clock;
-                line_time = min((u32) (1000000UL * (u32)mode->crtc_htotal / (u32)mode->clock), (u32)65535);
+                active_time = (u32) div_u64((u64)mode->crtc_hdisplay * 1000000,
+                                            (u32)mode->clock);
+                line_time = (u32) div_u64((u64)mode->crtc_htotal * 1000000,
+                                          (u32)mode->clock);
+                line_time = min(line_time, (u32)65535);
                 priority_a_cnt = 0;
                 priority_b_cnt = 0;
                 dram_channels = evergreen_get_number_of_dram_channels(rdev);
diff --git a/drivers/gpu/drm/radeon/radeon_combios.c b/drivers/gpu/drm/radeon/radeon_combios.c
index 432480ff9d22..3178ba0c537c 100644
--- a/drivers/gpu/drm/radeon/radeon_combios.c
+++ b/drivers/gpu/drm/radeon/radeon_combios.c
@@ -3393,6 +3393,13 @@ void radeon_combios_asic_init(struct drm_device *dev)
             rdev->pdev->subsystem_vendor == 0x103c &&
             rdev->pdev->subsystem_device == 0x280a)
                 return;
+        /* quirk for rs4xx Toshiba Sattellite L20-183 latop to make it resume
+         * - it hangs on resume inside the dynclk 1 table.
+         */
+        if (rdev->family == CHIP_RS400 &&
+            rdev->pdev->subsystem_vendor == 0x1179 &&
+            rdev->pdev->subsystem_device == 0xff31)
+                return;
 
         /* DYN CLK 1 */
         table = combios_get_table_offset(dev, COMBIOS_DYN_CLK_1_TABLE);
diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
index 6ecf42783d4b..0a6444d72000 100644
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -136,6 +136,10 @@ static struct radeon_px_quirk radeon_px_quirk_list[] = {
          * https://bugzilla.kernel.org/show_bug.cgi?id=51381
          */
         { PCI_VENDOR_ID_ATI, 0x6840, 0x1043, 0x2122, RADEON_PX_QUIRK_DISABLE_PX },
+        /* Asus K53TK laptop with AMD A6-3420M APU and Radeon 7670m GPU
+         * https://bugs.freedesktop.org/show_bug.cgi?id=101491
+         */
+        { PCI_VENDOR_ID_ATI, 0x6741, 0x1043, 0x2122, RADEON_PX_QUIRK_DISABLE_PX },
         /* macbook pro 8.2 */
         { PCI_VENDOR_ID_ATI, 0x6741, PCI_VENDOR_ID_APPLE, 0x00e2, RADEON_PX_QUIRK_LONG_WAKEUP },
         { 0, 0, 0, 0, 0 },
diff --git a/drivers/gpu/drm/radeon/radeon_uvd.c b/drivers/gpu/drm/radeon/radeon_uvd.c
index 7431eb4a11b7..d34d1cf33895 100644
--- a/drivers/gpu/drm/radeon/radeon_uvd.c
+++ b/drivers/gpu/drm/radeon/radeon_uvd.c
@@ -621,7 +621,7 @@ static int radeon_uvd_cs_reloc(struct radeon_cs_parser *p,
         }
 
         /* TODO: is this still necessary on NI+ ? */
-        if ((cmd == 0 || cmd == 1 || cmd == 0x3) &&
+        if ((cmd == 0 || cmd == 0x3) &&
             (start >> 28) != (p->rdev->uvd.gpu_addr >> 28)) {
                 DRM_ERROR("msg/fb buffer %LX-%LX out of 256MB segment!\n",
                           start, end);
diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
index 76d1888528e6..5303f25d5280 100644
--- a/drivers/gpu/drm/radeon/si.c
+++ b/drivers/gpu/drm/radeon/si.c
@@ -2284,8 +2284,11 @@ static void dce6_program_watermarks(struct radeon_device *rdev,
         fixed20_12 a, b, c;
 
         if (radeon_crtc->base.enabled && num_heads && mode) {
-                active_time = 1000000UL * (u32)mode->crtc_hdisplay / (u32)mode->clock;
-                line_time = min((u32) (1000000UL * (u32)mode->crtc_htotal / (u32)mode->clock), (u32)65535);
+                active_time = (u32) div_u64((u64)mode->crtc_hdisplay * 1000000,
+                                            (u32)mode->clock);
+                line_time = (u32) div_u64((u64)mode->crtc_htotal * 1000000,
+                                          (u32)mode->clock);
+                line_time = min(line_time, (u32)65535);
                 priority_a_cnt = 0;
                 priority_b_cnt = 0;
 
diff --git a/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c b/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c
index d8fa7a9c9240..ce5f2d1f9994 100644
--- a/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c
+++ b/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c
@@ -245,8 +245,6 @@ rockchip_dp_drm_encoder_atomic_check(struct drm_encoder *encoder,
                                       struct drm_connector_state *conn_state)
 {
         struct rockchip_crtc_state *s = to_rockchip_crtc_state(crtc_state);
-        struct rockchip_dp_device *dp = to_dp(encoder);
-        int ret;
 
         /*
          * The hardware IC designed that VOP must output the RGB10 video
@@ -258,16 +256,6 @@ rockchip_dp_drm_encoder_atomic_check(struct drm_encoder *encoder,
 
         s->output_mode = ROCKCHIP_OUT_MODE_AAAA;
         s->output_type = DRM_MODE_CONNECTOR_eDP;
-        if (dp->data->chip_type == RK3399_EDP) {
-                /*
-                 * For RK3399, VOP Lit must code the out mode to RGB888,
-                 * VOP Big must code the out mode to RGB10.
-                 */
-                ret = drm_of_encoder_active_endpoint_id(dp->dev->of_node,
-                                                        encoder);
-                if (ret > 0)
-                        s->output_mode = ROCKCHIP_OUT_MODE_P888;
-        }
 
         return 0;
 }
diff --git a/drivers/gpu/drm/rockchip/cdn-dp-core.c b/drivers/gpu/drm/rockchip/cdn-dp-core.c
index a2169dd3d26b..14fa1f8351e8 100644
--- a/drivers/gpu/drm/rockchip/cdn-dp-core.c
+++ b/drivers/gpu/drm/rockchip/cdn-dp-core.c
@@ -615,7 +615,6 @@ static void cdn_dp_encoder_enable(struct drm_encoder *encoder)
 {
         struct cdn_dp_device *dp = encoder_to_dp(encoder);
         int ret, val;
-        struct rockchip_crtc_state *state;
 
         ret = drm_of_encoder_active_endpoint_id(dp->dev->of_node, encoder);
         if (ret < 0) {
@@ -625,14 +624,10 @@ static void cdn_dp_encoder_enable(struct drm_encoder *encoder)
 
         DRM_DEV_DEBUG_KMS(dp->dev, "vop %s output to cdn-dp\n",
                           (ret) ? "LIT" : "BIG");
-        state = to_rockchip_crtc_state(encoder->crtc->state);
-        if (ret) {
+        if (ret)
                 val = DP_SEL_VOP_LIT | (DP_SEL_VOP_LIT << 16);
-                state->output_mode = ROCKCHIP_OUT_MODE_P888;
-        } else {
+        else
                 val = DP_SEL_VOP_LIT << 16;
-                state->output_mode = ROCKCHIP_OUT_MODE_AAAA;
-        }
 
         ret = cdn_dp_grf_write(dp, GRF_SOC_CON9, val);
         if (ret)
diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
index 3f7a82d1e095..45589d6ce65e 100644
--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
+++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
@@ -875,6 +875,7 @@ static bool vop_crtc_mode_fixup(struct drm_crtc *crtc,
 static void vop_crtc_enable(struct drm_crtc *crtc)
 {
         struct vop *vop = to_vop(crtc);
+        const struct vop_data *vop_data = vop->data;
         struct rockchip_crtc_state *s = to_rockchip_crtc_state(crtc->state);
         struct drm_display_mode *adjusted_mode = &crtc->state->adjusted_mode;
         u16 hsync_len = adjusted_mode->hsync_end - adjusted_mode->hsync_start;
@@ -967,6 +968,13 @@ static void vop_crtc_enable(struct drm_crtc *crtc)
                 DRM_DEV_ERROR(vop->dev, "unsupported connector_type [%d]\n",
                               s->output_type);
         }
+
+        /*
+         * if vop is not support RGB10 output, need force RGB10 to RGB888.
+         */
+        if (s->output_mode == ROCKCHIP_OUT_MODE_AAAA &&
+            !(vop_data->feature & VOP_FEATURE_OUTPUT_RGB10))
+                s->output_mode = ROCKCHIP_OUT_MODE_P888;
         VOP_CTRL_SET(vop, out_mode, s->output_mode);
 
         VOP_CTRL_SET(vop, htotal_pw, (htotal << 16) | hsync_len);
diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop.h b/drivers/gpu/drm/rockchip/rockchip_drm_vop.h
index 5a4faa85dbd2..9979fd0c2282 100644
--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop.h
+++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop.h
@@ -142,6 +142,9 @@ struct vop_data {
         const struct vop_intr *intr;
         const struct vop_win_data *win;
         unsigned int win_size;
+
+#define VOP_FEATURE_OUTPUT_RGB10        BIT(0)
+        u64 feature;
 };
 
 /* interrupt define */
diff --git a/drivers/gpu/drm/rockchip/rockchip_vop_reg.c b/drivers/gpu/drm/rockchip/rockchip_vop_reg.c
index 0da44442aab0..bafd698a28b1 100644
--- a/drivers/gpu/drm/rockchip/rockchip_vop_reg.c
+++ b/drivers/gpu/drm/rockchip/rockchip_vop_reg.c
@@ -275,6 +275,7 @@ static const struct vop_intr rk3288_vop_intr = {
 static const struct vop_data rk3288_vop = {
         .init_table = rk3288_init_reg_table,
         .table_size = ARRAY_SIZE(rk3288_init_reg_table),
+        .feature = VOP_FEATURE_OUTPUT_RGB10,
         .intr = &rk3288_vop_intr,
         .ctrl = &rk3288_ctrl_data,
         .win = rk3288_vop_win_data,
@@ -343,6 +344,7 @@ static const struct vop_reg_data rk3399_init_reg_table[] = {
 static const struct vop_data rk3399_vop_big = {
         .init_table = rk3399_init_reg_table,
         .table_size = ARRAY_SIZE(rk3399_init_reg_table),
+        .feature = VOP_FEATURE_OUTPUT_RGB10,
         .intr = &rk3399_vop_intr,
         .ctrl = &rk3399_ctrl_data,
         /*
diff --git a/drivers/gpu/drm/tegra/drm.c b/drivers/gpu/drm/tegra/drm.c
index 9a1e34e48f64..81f86a67c10d 100644
--- a/drivers/gpu/drm/tegra/drm.c
+++ b/drivers/gpu/drm/tegra/drm.c
@@ -451,18 +451,6 @@ fail:
 
 
 #ifdef CONFIG_DRM_TEGRA_STAGING
-static struct tegra_drm_context *
-tegra_drm_file_get_context(struct tegra_drm_file *file, u32 id)
-{
-        struct tegra_drm_context *context;
-
-        mutex_lock(&file->lock);
-        context = idr_find(&file->contexts, id);
-        mutex_unlock(&file->lock);
-
-        return context;
-}
-
 static int tegra_gem_create(struct drm_device *drm, void *data,
                             struct drm_file *file)
 {
@@ -551,7 +539,7 @@ static int tegra_client_open(struct tegra_drm_file *fpriv,
         if (err < 0)
                 return err;
 
-        err = idr_alloc(&fpriv->contexts, context, 0, 0, GFP_KERNEL);
+        err = idr_alloc(&fpriv->contexts, context, 1, 0, GFP_KERNEL);
         if (err < 0) {
                 client->ops->close_channel(context);
                 return err;
@@ -606,7 +594,7 @@ static int tegra_close_channel(struct drm_device *drm, void *data,
 
         mutex_lock(&fpriv->lock);
 
-        context = tegra_drm_file_get_context(fpriv, args->context);
+        context = idr_find(&fpriv->contexts, args->context);
         if (!context) {
                 err = -EINVAL;
                 goto unlock;
@@ -631,7 +619,7 @@ static int tegra_get_syncpt(struct drm_device *drm, void *data,
 
         mutex_lock(&fpriv->lock);
 
-        context = tegra_drm_file_get_context(fpriv, args->context);
+        context = idr_find(&fpriv->contexts, args->context);
         if (!context) {
                 err = -ENODEV;
                 goto unlock;
@@ -660,7 +648,7 @@ static int tegra_submit(struct drm_device *drm, void *data,
 
         mutex_lock(&fpriv->lock);
 
-        context = tegra_drm_file_get_context(fpriv, args->context);
+        context = idr_find(&fpriv->contexts, args->context);
         if (!context) {
                 err = -ENODEV;
                 goto unlock;
@@ -685,7 +673,7 @@ static int tegra_get_syncpt_base(struct drm_device *drm, void *data,
 
         mutex_lock(&fpriv->lock);
 
-        context = tegra_drm_file_get_context(fpriv, args->context);
+        context = idr_find(&fpriv->contexts, args->context);
         if (!context) {
                 err = -ENODEV;
                 goto unlock;
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c b/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c
index 13db8a2851ed..1f013d45c9e9 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c
@@ -321,6 +321,7 @@ void vmw_cmdbuf_res_man_destroy(struct vmw_cmdbuf_res_manager *man)
         list_for_each_entry_safe(entry, next, &man->list, head)
                 vmw_cmdbuf_res_free(man, entry);
 
+        drm_ht_remove(&man->resources);
         kfree(man);
 }
 
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
index 130d51c5ec6a..4b948fba9eec 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
@@ -41,9 +41,9 @@
 #include <drm/ttm/ttm_module.h>
 #include "vmwgfx_fence.h"
 
-#define VMWGFX_DRIVER_DATE "20170221"
+#define VMWGFX_DRIVER_DATE "20170607"
 #define VMWGFX_DRIVER_MAJOR 2
-#define VMWGFX_DRIVER_MINOR 12
+#define VMWGFX_DRIVER_MINOR 13
 #define VMWGFX_DRIVER_PATCHLEVEL 0
 #define VMWGFX_FILE_PAGE_OFFSET 0x00100000
 #define VMWGFX_FIFO_STATIC_SIZE (1024*1024)
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
index b6a0806b06bf..a1c68e6a689e 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
@@ -368,6 +368,8 @@ static void *vmw_local_fifo_reserve(struct vmw_private *dev_priv,
                                 return fifo_state->static_buffer;
                         else {
                                 fifo_state->dynamic_buffer = vmalloc(bytes);
+                                if (!fifo_state->dynamic_buffer)
+                                        goto out_err;
                                 return fifo_state->dynamic_buffer;
                         }
                 }
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
index ef9f3a2a4030..1d2db5d912b0 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
@@ -274,108 +274,6 @@ void vmw_kms_cursor_post_execbuf(struct vmw_private *dev_priv)
 }
 
 
-
-/**
- * vmw_du_cursor_plane_update() - Update cursor image and location
- *
- * @plane: plane object to update
- * @crtc: owning CRTC of @plane
- * @fb: framebuffer to flip onto plane
- * @crtc_x: x offset of plane on crtc
- * @crtc_y: y offset of plane on crtc
- * @crtc_w: width of plane rectangle on crtc
- * @crtc_h: height of plane rectangle on crtc
- * @src_x: Not used
- * @src_y: Not used
- * @src_w: Not used
- * @src_h: Not used
- *
- *
- * RETURNS:
- * Zero on success, error code on failure
- */
-int vmw_du_cursor_plane_update(struct drm_plane *plane,
-                               struct drm_crtc *crtc,
-                               struct drm_framebuffer *fb,
-                               int crtc_x, int crtc_y,
-                               unsigned int crtc_w,
-                               unsigned int crtc_h,
-                               uint32_t src_x, uint32_t src_y,
-                               uint32_t src_w, uint32_t src_h)
-{
-        struct vmw_private *dev_priv = vmw_priv(crtc->dev);
-        struct vmw_display_unit *du = vmw_crtc_to_du(crtc);
-        struct vmw_surface *surface = NULL;
-        struct vmw_dma_buffer *dmabuf = NULL;
-        s32 hotspot_x, hotspot_y;
-        int ret;
-
-        hotspot_x = du->hotspot_x + fb->hot_x;
-        hotspot_y = du->hotspot_y + fb->hot_y;
-
-        /* A lot of the code assumes this */
-        if (crtc_w != 64 || crtc_h != 64) {
-                ret = -EINVAL;
-                goto out;
-        }
-
-        if (vmw_framebuffer_to_vfb(fb)->dmabuf)
-                dmabuf = vmw_framebuffer_to_vfbd(fb)->buffer;
-        else
-                surface = vmw_framebuffer_to_vfbs(fb)->surface;
-
-        if (surface && !surface->snooper.image) {
-                DRM_ERROR("surface not suitable for cursor\n");
-                ret = -EINVAL;
-                goto out;
-        }
-
-        /* setup new image */
-        ret = 0;
-        if (surface) {
-                /* vmw_user_surface_lookup takes one reference */
-                du->cursor_surface = surface;
-
-                du->cursor_age = du->cursor_surface->snooper.age;
-
-                ret = vmw_cursor_update_image(dev_priv, surface->snooper.image,
-                                              64, 64, hotspot_x, hotspot_y);
-        } else if (dmabuf) {
-                /* vmw_user_surface_lookup takes one reference */
-                du->cursor_dmabuf = dmabuf;
-
-                ret = vmw_cursor_update_dmabuf(dev_priv, dmabuf, crtc_w, crtc_h,
-                                               hotspot_x, hotspot_y);
-        } else {
-                vmw_cursor_update_position(dev_priv, false, 0, 0);
-                goto out;
-        }
-
-        if (!ret) {
-                du->cursor_x = crtc_x + du->set_gui_x;
-                du->cursor_y = crtc_y + du->set_gui_y;
-
-                vmw_cursor_update_position(dev_priv, true,
-                                           du->cursor_x + hotspot_x,
-                                           du->cursor_y + hotspot_y);
-        }
-
-out:
-        return ret;
-}
-
-
-int vmw_du_cursor_plane_disable(struct drm_plane *plane)
-{
-        if (plane->fb) {
-                drm_framebuffer_unreference(plane->fb);
-                plane->fb = NULL;
-        }
-
-        return -EINVAL;
-}
-
-
 void vmw_du_cursor_plane_destroy(struct drm_plane *plane)
 {
         vmw_cursor_update_position(plane->dev->dev_private, false, 0, 0);
@@ -473,18 +371,6 @@ vmw_du_cursor_plane_prepare_fb(struct drm_plane *plane,
 
 
 void
-vmw_du_cursor_plane_atomic_disable(struct drm_plane *plane,
-                                   struct drm_plane_state *old_state)
-{
-        struct drm_crtc *crtc = plane->state->crtc ?: old_state->crtc;
-        struct vmw_private *dev_priv = vmw_priv(crtc->dev);
-
-        drm_atomic_set_fb_for_plane(plane->state, NULL);
-        vmw_cursor_update_position(dev_priv, false, 0, 0);
-}
-
-
-void
 vmw_du_cursor_plane_atomic_update(struct drm_plane *plane,
                                   struct drm_plane_state *old_state)
 {
@@ -1498,6 +1384,7 @@ vmw_kms_new_framebuffer(struct vmw_private *dev_priv,
          */
         if (vmw_kms_srf_ok(dev_priv, mode_cmd->width, mode_cmd->height)  &&
             dmabuf && only_2d &&
+            mode_cmd->width > 64 &&  /* Don't create a proxy for cursor */
             dev_priv->active_display_unit == vmw_du_screen_target) {
                 ret = vmw_create_dmabuf_proxy(dev_priv->dev, mode_cmd,
                                               dmabuf, &surface);
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.h b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.h
index 13f2f1d2818a..5f8d678ae675 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.h
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.h
@@ -256,10 +256,6 @@ int vmw_du_crtc_gamma_set(struct drm_crtc *crtc,
                            u16 *r, u16 *g, u16 *b,
                            uint32_t size,
                            struct drm_modeset_acquire_ctx *ctx);
-int vmw_du_crtc_cursor_set2(struct drm_crtc *crtc, struct drm_file *file_priv,
-                            uint32_t handle, uint32_t width, uint32_t height,
-                            int32_t hot_x, int32_t hot_y);
-int vmw_du_crtc_cursor_move(struct drm_crtc *crtc, int x, int y);
 int vmw_du_connector_set_property(struct drm_connector *connector,
                                   struct drm_property *property,
                                   uint64_t val);
@@ -339,15 +335,6 @@ void vmw_kms_create_implicit_placement_property(struct vmw_private *dev_priv,
 /* Universal Plane Helpers */
 void vmw_du_primary_plane_destroy(struct drm_plane *plane);
 void vmw_du_cursor_plane_destroy(struct drm_plane *plane);
-int vmw_du_cursor_plane_disable(struct drm_plane *plane);
-int vmw_du_cursor_plane_update(struct drm_plane *plane,
-                               struct drm_crtc *crtc,
-                               struct drm_framebuffer *fb,
-                               int crtc_x, int crtc_y,
-                               unsigned int crtc_w,
-                               unsigned int crtc_h,
-                               uint32_t src_x, uint32_t src_y,
-                               uint32_t src_w, uint32_t src_h);
 
 /* Atomic Helpers */
 int vmw_du_primary_plane_atomic_check(struct drm_plane *plane,
@@ -356,8 +343,6 @@ int vmw_du_cursor_plane_atomic_check(struct drm_plane *plane,
                                      struct drm_plane_state *state);
 void vmw_du_cursor_plane_atomic_update(struct drm_plane *plane,
                                        struct drm_plane_state *old_state);
-void vmw_du_cursor_plane_atomic_disable(struct drm_plane *plane,
-                                        struct drm_plane_state *old_state);
 int vmw_du_cursor_plane_prepare_fb(struct drm_plane *plane,
                                    struct drm_plane_state *new_state);
 void vmw_du_plane_cleanup_fb(struct drm_plane *plane,
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c b/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c
index bad31bdf09b6..50be1f034f9e 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c
@@ -56,6 +56,8 @@ enum stdu_content_type {
  * @right: Right side of bounding box.
  * @top: Top side of bounding box.
  * @bottom: Bottom side of bounding box.
+ * @fb_left: Left side of the framebuffer/content bounding box
+ * @fb_top: Top of the framebuffer/content bounding box
  * @buf: DMA buffer when DMA-ing between buffer and screen targets.
  * @sid: Surface ID when copying between surface and screen targets.
  */
@@ -63,6 +65,7 @@ struct vmw_stdu_dirty {
         struct vmw_kms_dirty base;
         SVGA3dTransferType  transfer;
         s32 left, right, top, bottom;
+        s32 fb_left, fb_top;
         u32 pitch;
         union {
                 struct vmw_dma_buffer *buf;
@@ -647,7 +650,7 @@ static void vmw_stdu_dmabuf_fifo_commit(struct vmw_kms_dirty *dirty)
  *
  * @dirty: The closure structure.
  *
- * This function calculates the bounding box for all the incoming clips
+ * This function calculates the bounding box for all the incoming clips.
  */
 static void vmw_stdu_dmabuf_cpu_clip(struct vmw_kms_dirty *dirty)
 {
@@ -656,11 +659,19 @@ static void vmw_stdu_dmabuf_cpu_clip(struct vmw_kms_dirty *dirty)
 
         dirty->num_hits = 1;
 
-        /* Calculate bounding box */
+        /* Calculate destination bounding box */
         ddirty->left = min_t(s32, ddirty->left, dirty->unit_x1);
         ddirty->top = min_t(s32, ddirty->top, dirty->unit_y1);
         ddirty->right = max_t(s32, ddirty->right, dirty->unit_x2);
         ddirty->bottom = max_t(s32, ddirty->bottom, dirty->unit_y2);
+
+        /*
+         * Calculate content bounding box.  We only need the top-left
+         * coordinate because width and height will be the same as the
+         * destination bounding box above
+         */
+        ddirty->fb_left = min_t(s32, ddirty->fb_left, dirty->fb_x);
+        ddirty->fb_top  = min_t(s32, ddirty->fb_top, dirty->fb_y);
 }
 
 
@@ -697,11 +708,11 @@ static void vmw_stdu_dmabuf_cpu_commit(struct vmw_kms_dirty *dirty)
         /* Assume we are blitting from Host (display_srf) to Guest (dmabuf) */
         src_pitch = stdu->display_srf->base_size.width * stdu->cpp;
         src = ttm_kmap_obj_virtual(&stdu->host_map, &not_used);
-        src += dirty->unit_y1 * src_pitch + dirty->unit_x1 * stdu->cpp;
+        src += ddirty->top * src_pitch + ddirty->left * stdu->cpp;
 
         dst_pitch = ddirty->pitch;
         dst = ttm_kmap_obj_virtual(&stdu->guest_map, &not_used);
-        dst += dirty->fb_y * dst_pitch + dirty->fb_x * stdu->cpp;
+        dst += ddirty->fb_top * dst_pitch + ddirty->fb_left * stdu->cpp;
 
 
         /* Figure out the real direction */
@@ -760,7 +771,7 @@ static void vmw_stdu_dmabuf_cpu_commit(struct vmw_kms_dirty *dirty)
         }
 
 out_cleanup:
-        ddirty->left = ddirty->top = S32_MAX;
+        ddirty->left = ddirty->top = ddirty->fb_left = ddirty->fb_top = S32_MAX;
         ddirty->right = ddirty->bottom = S32_MIN;
 }
 
@@ -812,6 +823,7 @@ int vmw_kms_stdu_dma(struct vmw_private *dev_priv,
                 SVGA3D_READ_HOST_VRAM;
         ddirty.left = ddirty.top = S32_MAX;
         ddirty.right = ddirty.bottom = S32_MIN;
+        ddirty.fb_left = ddirty.fb_top = S32_MAX;
         ddirty.pitch = vfb->base.pitches[0];
         ddirty.buf = buf;
         ddirty.base.fifo_commit = vmw_stdu_dmabuf_fifo_commit;
@@ -1355,6 +1367,11 @@ vmw_stdu_primary_plane_atomic_update(struct drm_plane *plane,
                 DRM_ERROR("Failed to bind surface to STDU.\n");
         else
                 crtc->primary->fb = plane->state->fb;
+
+        ret = vmw_stdu_update_st(dev_priv, stdu);
+
+        if (ret)
+                DRM_ERROR("Failed to update STDU.\n");
 }
 
 
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
index 7681341fe32b..6b70bd259953 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
@@ -1274,11 +1274,14 @@ int vmw_gb_surface_define_ioctl(struct drm_device *dev, void *data,
         struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile;
         int ret;
         uint32_t size;
-        uint32_t backup_handle;
+        uint32_t backup_handle = 0;
 
         if (req->multisample_count != 0)
                 return -EINVAL;
 
+        if (req->mip_levels > DRM_VMW_MAX_MIP_LEVELS)
+                return -EINVAL;
+
         if (unlikely(vmw_user_surface_size == 0))
                 vmw_user_surface_size = ttm_round_pot(sizeof(*user_srf)) +
                         128;
@@ -1314,12 +1317,16 @@ int vmw_gb_surface_define_ioctl(struct drm_device *dev, void *data,
                 ret = vmw_user_dmabuf_lookup(tfile, req->buffer_handle,
                                              &res->backup,
                                              &user_srf->backup_base);
-                if (ret == 0 && res->backup->base.num_pages * PAGE_SIZE <
-                    res->backup_size) {
-                        DRM_ERROR("Surface backup buffer is too small.\n");
-                        vmw_dmabuf_unreference(&res->backup);
-                        ret = -EINVAL;
-                        goto out_unlock;
+                if (ret == 0) {
+                        if (res->backup->base.num_pages * PAGE_SIZE <
+                            res->backup_size) {
+                                DRM_ERROR("Surface backup buffer is too small.\n");
+                                vmw_dmabuf_unreference(&res->backup);
+                                ret = -EINVAL;
+                                goto out_unlock;
+                        } else {
+                                backup_handle = req->buffer_handle;
+                        }
                 }
         } else if (req->drm_surface_flags & drm_vmw_surface_flag_create_buffer)
                 ret = vmw_user_dmabuf_alloc(dev_priv, tfile,
@@ -1491,7 +1498,7 @@ int vmw_surface_gb_priv_define(struct drm_device *dev,
                                  dev_priv->stdu_max_height);
 
                 if (size.width > max_width || size.height > max_height) {
-                        DRM_ERROR("%ux%u\n, exeeds max surface size %ux%u",
+                        DRM_ERROR("%ux%u\n, exceeds max surface size %ux%u",
                                   size.width, size.height,
                                   max_width, max_height);
                         return -EINVAL;
diff --git a/drivers/gpu/host1x/dev.c b/drivers/gpu/host1x/dev.c
index f05ebb14fa63..ac65f52850a6 100644
--- a/drivers/gpu/host1x/dev.c
+++ b/drivers/gpu/host1x/dev.c
@@ -172,7 +172,7 @@ static int host1x_probe(struct platform_device *pdev)
 
         host->rst = devm_reset_control_get(&pdev->dev, "host1x");
         if (IS_ERR(host->rst)) {
-                err = PTR_ERR(host->clk);
+                err = PTR_ERR(host->rst);
                 dev_err(&pdev->dev, "failed to get reset: %d\n", err);
                 return err;
         }
diff --git a/drivers/gpu/ipu-v3/ipu-common.c b/drivers/gpu/ipu-v3/ipu-common.c
index 16d556816b5f..2fb5f432a54c 100644
--- a/drivers/gpu/ipu-v3/ipu-common.c
+++ b/drivers/gpu/ipu-v3/ipu-common.c
@@ -725,15 +725,16 @@ void ipu_set_ic_src_mux(struct ipu_soc *ipu, int csi_id, bool vdi)
         spin_lock_irqsave(&ipu->lock, flags);
 
         val = ipu_cm_read(ipu, IPU_CONF);
-        if (vdi) {
+        if (vdi)
                 val |= IPU_CONF_IC_INPUT;
-        } else {
+        else
                 val &= ~IPU_CONF_IC_INPUT;
-                if (csi_id == 1)
-                        val |= IPU_CONF_CSI_SEL;
-                else
-                        val &= ~IPU_CONF_CSI_SEL;
-        }
+
+        if (csi_id == 1)
+                val |= IPU_CONF_CSI_SEL;
+        else
+                val &= ~IPU_CONF_CSI_SEL;
+
         ipu_cm_write(ipu, val, IPU_CONF);
 
         spin_unlock_irqrestore(&ipu->lock, flags);
diff --git a/drivers/gpu/ipu-v3/ipu-pre.c b/drivers/gpu/ipu-v3/ipu-pre.c
index c55563379e2e..c35f74c83065 100644
--- a/drivers/gpu/ipu-v3/ipu-pre.c
+++ b/drivers/gpu/ipu-v3/ipu-pre.c
@@ -131,8 +131,6 @@ int ipu_pre_get(struct ipu_pre *pre)
         if (pre->in_use)
                 return -EBUSY;
 
-        clk_prepare_enable(pre->clk_axi);
-
         /* first get the engine out of reset and remove clock gating */
         writel(0, pre->regs + IPU_PRE_CTRL);
 
@@ -149,12 +147,7 @@ int ipu_pre_get(struct ipu_pre *pre)
 
 void ipu_pre_put(struct ipu_pre *pre)
 {
-        u32 val;
-
-        val = IPU_PRE_CTRL_SFTRST | IPU_PRE_CTRL_CLKGATE;
-        writel(val, pre->regs + IPU_PRE_CTRL);
-
-        clk_disable_unprepare(pre->clk_axi);
+        writel(IPU_PRE_CTRL_SFTRST, pre->regs + IPU_PRE_CTRL);
 
         pre->in_use = false;
 }
@@ -249,6 +242,8 @@ static int ipu_pre_probe(struct platform_device *pdev)
         if (!pre->buffer_virt)
                 return -ENOMEM;
 
+        clk_prepare_enable(pre->clk_axi);
+
         pre->dev = dev;
         platform_set_drvdata(pdev, pre);
         mutex_lock(&ipu_pre_list_mutex);
@@ -268,6 +263,8 @@ static int ipu_pre_remove(struct platform_device *pdev)
         available_pres--;
         mutex_unlock(&ipu_pre_list_mutex);
 
+        clk_disable_unprepare(pre->clk_axi);
+
         if (pre->buffer_virt)
                 gen_pool_free(pre->iram, (unsigned long)pre->buffer_virt,
                               IPU_PRE_MAX_WIDTH * IPU_PRE_NUM_SCANLINES * 4);
diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig
index fe40e5e499dd..687705c50794 100644
--- a/drivers/hid/Kconfig
+++ b/drivers/hid/Kconfig
@@ -275,10 +275,12 @@ config HID_EMS_FF
          - Trio Linker Plus II
 
 config HID_ELECOM
-        tristate "ELECOM BM084 bluetooth mouse"
+        tristate "ELECOM HID devices"
         depends on HID
         ---help---
-        Support for the ELECOM BM084 (bluetooth mouse).
+        Support for ELECOM devices:
+          - BM084 Bluetooth Mouse
+          - DEFT Trackball (Wired and wireless)
 
 config HID_ELO
         tristate "ELO USB 4000/4500 touchscreen"
diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c
index 16df6cc90235..a6268f2f7408 100644
--- a/drivers/hid/hid-asus.c
+++ b/drivers/hid/hid-asus.c
@@ -69,6 +69,7 @@ MODULE_DESCRIPTION("Asus HID Keyboard and TouchPad");
 #define QUIRK_IS_MULTITOUCH             BIT(3)
 #define QUIRK_NO_CONSUMER_USAGES        BIT(4)
 #define QUIRK_USE_KBD_BACKLIGHT         BIT(5)
+#define QUIRK_T100_KEYBOARD             BIT(6)
 
 #define I2C_KEYBOARD_QUIRKS                     (QUIRK_FIX_NOTEBOOK_REPORT | \
                                                  QUIRK_NO_INIT_REPORTS | \
@@ -536,6 +537,8 @@ static void asus_remove(struct hid_device *hdev)
                 drvdata->kbd_backlight->removed = true;
                 cancel_work_sync(&drvdata->kbd_backlight->work);
         }
+
+        hid_hw_stop(hdev);
 }
 
 static __u8 *asus_report_fixup(struct hid_device *hdev, __u8 *rdesc,
@@ -548,6 +551,12 @@ static __u8 *asus_report_fixup(struct hid_device *hdev, __u8 *rdesc,
                 hid_info(hdev, "Fixing up Asus notebook report descriptor\n");
                 rdesc[55] = 0xdd;
         }
+        if (drvdata->quirks & QUIRK_T100_KEYBOARD &&
+                 *rsize == 76 && rdesc[73] == 0x81 && rdesc[74] == 0x01) {
+                hid_info(hdev, "Fixing up Asus T100 keyb report descriptor\n");
+                rdesc[74] &= ~HID_MAIN_ITEM_CONSTANT;
+        }
+
         return rdesc;
 }
 
@@ -560,6 +569,9 @@ static const struct hid_device_id asus_devices[] = {
                 USB_DEVICE_ID_ASUSTEK_ROG_KEYBOARD1) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ASUSTEK,
                 USB_DEVICE_ID_ASUSTEK_ROG_KEYBOARD2), QUIRK_USE_KBD_BACKLIGHT },
+        { HID_USB_DEVICE(USB_VENDOR_ID_ASUSTEK,
+                USB_DEVICE_ID_ASUSTEK_T100_KEYBOARD),
+          QUIRK_T100_KEYBOARD | QUIRK_NO_CONSUMER_USAGES },
         { }
 };
 MODULE_DEVICE_TABLE(hid, asus_devices);
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 37084b645785..6e040692f1d8 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -826,11 +826,35 @@ static int hid_scan_report(struct hid_device *hid)
                                  * hid-rmi should take care of them,
                                  * not hid-generic
                                  */
-                                if (IS_ENABLED(CONFIG_HID_RMI))
-                                        hid->group = HID_GROUP_RMI;
+                                hid->group = HID_GROUP_RMI;
                 break;
         }
 
+        /* fall back to generic driver in case specific driver doesn't exist */
+        switch (hid->group) {
+        case HID_GROUP_MULTITOUCH_WIN_8:
+                /* fall-through */
+        case HID_GROUP_MULTITOUCH:
+                if (!IS_ENABLED(CONFIG_HID_MULTITOUCH))
+                        hid->group = HID_GROUP_GENERIC;
+                break;
+        case HID_GROUP_SENSOR_HUB:
+                if (!IS_ENABLED(CONFIG_HID_SENSOR_HUB))
+                        hid->group = HID_GROUP_GENERIC;
+                break;
+        case HID_GROUP_RMI:
+                if (!IS_ENABLED(CONFIG_HID_RMI))
+                        hid->group = HID_GROUP_GENERIC;
+                break;
+        case HID_GROUP_WACOM:
+                if (!IS_ENABLED(CONFIG_HID_WACOM))
+                        hid->group = HID_GROUP_GENERIC;
+                break;
+        case HID_GROUP_LOGITECH_DJ_DEVICE:
+                if (!IS_ENABLED(CONFIG_HID_LOGITECH_DJ))
+                        hid->group = HID_GROUP_GENERIC;
+                break;
+        }
         vfree(parser);
         return 0;
 }
@@ -1763,15 +1787,23 @@ EXPORT_SYMBOL_GPL(hid_disconnect);
  * used as a driver. See hid_scan_report().
  */
 static const struct hid_device_id hid_have_special_driver[] = {
+#if IS_ENABLED(CONFIG_HID_A4TECH)
         { HID_USB_DEVICE(USB_VENDOR_ID_A4TECH, USB_DEVICE_ID_A4TECH_WCP32PU) },
         { HID_USB_DEVICE(USB_VENDOR_ID_A4TECH, USB_DEVICE_ID_A4TECH_X5_005D) },
         { HID_USB_DEVICE(USB_VENDOR_ID_A4TECH, USB_DEVICE_ID_A4TECH_RP_649) },
+#endif
+#if IS_ENABLED(CONFIG_HID_ACCUTOUCH)
+        { HID_USB_DEVICE(USB_VENDOR_ID_ELO, USB_DEVICE_ID_ELO_ACCUTOUCH_2216) },
+#endif
+#if IS_ENABLED(CONFIG_HID_ACRUX)
         { HID_USB_DEVICE(USB_VENDOR_ID_ACRUX, 0x0802) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ACRUX, 0xf705) },
+#endif
+#if IS_ENABLED(CONFIG_HID_ALPS)
         { HID_DEVICE(HID_BUS_ANY, HID_GROUP_ANY, USB_VENDOR_ID_ALPS_JP, HID_DEVICE_ID_ALPS_U1_DUAL) },
+#endif
+#if IS_ENABLED(CONFIG_HID_APPLE)
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MIGHTYMOUSE) },
-        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGICMOUSE) },
-        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGICTRACKPAD) },
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_FOUNTAIN_ANSI) },
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_FOUNTAIN_ISO) },
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER_ANSI) },
@@ -1792,11 +1824,6 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER4_HF_ANSI) },
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER4_HF_ISO) },
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER4_HF_JIS) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_IRCONTROL) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_IRCONTROL2) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_IRCONTROL3) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_IRCONTROL4) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_IRCONTROL5) },
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_ANSI) },
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_ISO) },
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_JIS) },
@@ -1851,59 +1878,100 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_ANSI) },
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_FOUNTAIN_TP_ONLY) },
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER1_TP_ONLY) },
+#endif
+#if IS_ENABLED(CONFIG_HID_APPLEIR)
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_IRCONTROL) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_IRCONTROL2) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_IRCONTROL3) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_IRCONTROL4) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_IRCONTROL5) },
+#endif
+#if IS_ENABLED(CONFIG_HID_ASUS)
         { HID_I2C_DEVICE(USB_VENDOR_ID_ASUSTEK, USB_DEVICE_ID_ASUSTEK_I2C_KEYBOARD) },
         { HID_I2C_DEVICE(USB_VENDOR_ID_ASUSTEK, USB_DEVICE_ID_ASUSTEK_I2C_TOUCHPAD) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ASUSTEK, USB_DEVICE_ID_ASUSTEK_ROG_KEYBOARD1) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ASUSTEK, USB_DEVICE_ID_ASUSTEK_ROG_KEYBOARD2) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_ASUSTEK, USB_DEVICE_ID_ASUSTEK_T100_KEYBOARD) },
+#endif
+#if IS_ENABLED(CONFIG_HID_AUREAL)
         { HID_USB_DEVICE(USB_VENDOR_ID_AUREAL, USB_DEVICE_ID_AUREAL_W01RN) },
+#endif
+#if IS_ENABLED(CONFIG_HID_BELKIN)
         { HID_USB_DEVICE(USB_VENDOR_ID_BELKIN, USB_DEVICE_ID_FLIP_KVM) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_LABTEC, USB_DEVICE_ID_LABTEC_WIRELESS_KEYBOARD) },
+#endif
+#if IS_ENABLED(CONFIG_HID_BETOP_FF)
         { HID_USB_DEVICE(USB_VENDOR_ID_BETOP_2185BFM, 0x2208) },
         { HID_USB_DEVICE(USB_VENDOR_ID_BETOP_2185PC, 0x5506) },
         { HID_USB_DEVICE(USB_VENDOR_ID_BETOP_2185V2PC, 0x1850) },
         { HID_USB_DEVICE(USB_VENDOR_ID_BETOP_2185V2BFM, 0x5500) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_BTC, USB_DEVICE_ID_BTC_EMPREX_REMOTE) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_BTC, USB_DEVICE_ID_BTC_EMPREX_REMOTE_2) },
+#endif
+#if IS_ENABLED(CONFIG_HID_CHERRY)
         { HID_USB_DEVICE(USB_VENDOR_ID_CHERRY, USB_DEVICE_ID_CHERRY_CYMOTION) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CHERRY, USB_DEVICE_ID_CHERRY_CYMOTION_SOLAR) },
+#endif
+#if IS_ENABLED(CONFIG_HID_CHICONY)
         { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_TACTICAL_PAD) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_WIRELESS) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_WIRELESS2) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_AK1D) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_ACER_SWITCH12) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_JESS, USB_DEVICE_ID_JESS_ZEN_AIO_KBD) },
+#endif
+#if IS_ENABLED(CONFIG_HID_CMEDIA)
+        { HID_USB_DEVICE(USB_VENDOR_ID_CMEDIA, USB_DEVICE_ID_CM6533) },
+#endif
+#if IS_ENABLED(CONFIG_HID_CORSAIR)
         { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K90) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_SCIMITAR_PRO_RGB) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_CREATIVELABS, USB_DEVICE_ID_PRODIKEYS_PCMIDI) },
+#endif
+#if IS_ENABLED(CONFIG_HID_CP2112)
         { HID_USB_DEVICE(USB_VENDOR_ID_CYGNAL, USB_DEVICE_ID_CYGNAL_CP2112) },
+#endif
+#if IS_ENABLED(CONFIG_HID_CYPRESS)
         { HID_USB_DEVICE(USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_BARCODE_1) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_BARCODE_2) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_BARCODE_3) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_BARCODE_4) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_MOUSE) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_DELCOM, USB_DEVICE_ID_DELCOM_VISUAL_IND) },
+#endif
+#if IS_ENABLED(CONFIG_HID_DRAGONRISE)
         { HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, 0x0006) },
         { HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, 0x0011) },
-#if IS_ENABLED(CONFIG_HID_MAYFLASH)
-        { HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_PS3) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_DOLPHINBAR) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_GAMECUBE1) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_GAMECUBE2) },
 #endif
-        { HID_USB_DEVICE(USB_VENDOR_ID_DREAM_CHEEKY, USB_DEVICE_ID_DREAM_CHEEKY_WN) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_DREAM_CHEEKY, USB_DEVICE_ID_DREAM_CHEEKY_FA) },
+#if IS_ENABLED(CONFIG_HID_ELECOM)
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_BM084) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_DEFT_WIRED) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_DEFT_WIRELESS) },
+#endif
+#if IS_ENABLED(CONFIG_HID_ELO)
         { HID_USB_DEVICE(USB_VENDOR_ID_ELO, 0x0009) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ELO, 0x0030) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_ELO, USB_DEVICE_ID_ELO_ACCUTOUCH_2216) },
+#endif
+#if IS_ENABLED(CONFIG_HID_EMS_FF)
         { HID_USB_DEVICE(USB_VENDOR_ID_EMS, USB_DEVICE_ID_EMS_TRIO_LINKER_PLUS_II) },
+#endif
+#if IS_ENABLED(CONFIG_HID_EZKEY)
         { HID_USB_DEVICE(USB_VENDOR_ID_EZKEY, USB_DEVICE_ID_BTC_8193) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_GAMERON, USB_DEVICE_ID_GAMERON_DUAL_PSX_ADAPTOR) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_GAMERON, USB_DEVICE_ID_GAMERON_DUAL_PCS_ADAPTOR) },
+#endif
+#if IS_ENABLED(CONFIG_HID_GEMBIRD)
         { HID_USB_DEVICE(USB_VENDOR_ID_GEMBIRD, USB_DEVICE_ID_GEMBIRD_JPD_DUALFORCE2) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_GREENASIA, 0x0003) },
+#endif
+#if IS_ENABLED(CONFIG_HID_GFRM)
+        { HID_BLUETOOTH_DEVICE(0x58, 0x2000) },
+        { HID_BLUETOOTH_DEVICE(0x471, 0x2210) },
+#endif
+#if IS_ENABLED(CONFIG_HID_GREENASIA)
         { HID_USB_DEVICE(USB_VENDOR_ID_GREENASIA, 0x0012) },
+#endif
+#if IS_ENABLED(CONFIG_HID_GT683R)
+        { HID_USB_DEVICE(USB_VENDOR_ID_MSI, USB_DEVICE_ID_MSI_GT683R_LED_PANEL) },
+#endif
+#if IS_ENABLED(CONFIG_HID_GYRATION)
         { HID_USB_DEVICE(USB_VENDOR_ID_GYRATION, USB_DEVICE_ID_GYRATION_REMOTE) },
         { HID_USB_DEVICE(USB_VENDOR_ID_GYRATION, USB_DEVICE_ID_GYRATION_REMOTE_2) },
         { HID_USB_DEVICE(USB_VENDOR_ID_GYRATION, USB_DEVICE_ID_GYRATION_REMOTE_3) },
+#endif
+#if IS_ENABLED(CONFIG_HID_HOLTEK)
         { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK, USB_DEVICE_ID_HOLTEK_ON_LINE_GRIP) },
         { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT, USB_DEVICE_ID_HOLTEK_ALT_KEYBOARD) },
         { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT, USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A04A) },
@@ -1912,12 +1980,17 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT, USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A072) },
         { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT, USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A081) },
         { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT, USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A0C2) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_HUION, USB_DEVICE_ID_HUION_TABLET) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_JESS, USB_DEVICE_ID_JESS_ZEN_AIO_KBD) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_JESS2, USB_DEVICE_ID_JESS2_COLOR_RUMBLE_PAD) },
+#endif
+#if IS_ENABLED(CONFIG_HID_ICADE)
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ION, USB_DEVICE_ID_ICADE) },
+#endif
+#if IS_ENABLED(CONFIG_HID_KENSINGTON)
         { HID_USB_DEVICE(USB_VENDOR_ID_KENSINGTON, USB_DEVICE_ID_KS_SLIMBLADE) },
+#endif
+#if IS_ENABLED(CONFIG_HID_KEYTOUCH)
         { HID_USB_DEVICE(USB_VENDOR_ID_KEYTOUCH, USB_DEVICE_ID_KEYTOUCH_IEC) },
+#endif
+#if IS_ENABLED(CONFIG_HID_KYE)
         { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_GENIUS_GILA_GAMING_MOUSE) },
         { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_GENIUS_MANTICORE) },
         { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_GENIUS_GX_IMPERATOR) },
@@ -1927,21 +2000,29 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_MOUSEPEN_I608X_V2) },
         { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_EASYPEN_M610X) },
         { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_PENSKETCH_M912) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_LABTEC, USB_DEVICE_ID_LABTEC_WIRELESS_KEYBOARD) },
+#endif
+#if IS_ENABLED(CONFIG_HID_LCPOWER)
         { HID_USB_DEVICE(USB_VENDOR_ID_LCPOWER, USB_DEVICE_ID_LCPOWER_LC1000 ) },
+#endif
+#if IS_ENABLED(CONFIG_HID_LED)
+        { HID_USB_DEVICE(USB_VENDOR_ID_DELCOM, USB_DEVICE_ID_DELCOM_VISUAL_IND) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_DREAM_CHEEKY, USB_DEVICE_ID_DREAM_CHEEKY_WN) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_DREAM_CHEEKY, USB_DEVICE_ID_DREAM_CHEEKY_FA) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_MICROCHIP, USB_DEVICE_ID_LUXAFOR) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_RISO_KAGAKU, USB_DEVICE_ID_RI_KA_WEBMAIL) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_THINGM, USB_DEVICE_ID_BLINK1) },
+#endif
 #if IS_ENABLED(CONFIG_HID_LENOVO)
         { HID_USB_DEVICE(USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_TPKBD) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_CUSBKBD) },
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_CBTKBD) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_TPPRODOCK) },
 #endif
-        { HID_USB_DEVICE(USB_VENDOR_ID_LG, USB_DEVICE_ID_LG_MELFAS_MT) },
+#if IS_ENABLED(CONFIG_HID_LOGITECH)
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_MX3000_RECEIVER) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_S510_RECEIVER) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_S510_RECEIVER_2) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_RECEIVER) },
-        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_HARMONY_PS3) },
-        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_T651) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_DINOVO_DESKTOP) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_DINOVO_EDGE) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_DINOVO_MINI) },
@@ -1954,7 +2035,6 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_RUMBLEPAD) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_RUMBLEPAD2_2) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_G29_WHEEL) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_G920_WHEEL) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_WINGMAN_F3D) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_WINGMAN_FFG ) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_FORCE3D_PRO) },
@@ -1966,17 +2046,30 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_DFGT_WHEEL) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_G25_WHEEL) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_G27_WHEEL) },
-#if IS_ENABLED(CONFIG_HID_LOGITECH_DJ)
-        { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_UNIFYING_RECEIVER) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_UNIFYING_RECEIVER_2) },
-#endif
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_WII_WHEEL) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_RUMBLEPAD2) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_SPACETRAVELLER) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_SPACENAVIGATOR) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_MICROCHIP, USB_DEVICE_ID_PICOLCD) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_MICROCHIP, USB_DEVICE_ID_PICOLCD_BOOTLOADER) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_MICROCHIP, USB_DEVICE_ID_LUXAFOR) },
+#endif
+#if IS_ENABLED(CONFIG_HID_LOGITECH_HIDPP)
+        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_T651) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_G920_WHEEL) },
+#endif
+#if IS_ENABLED(CONFIG_HID_LOGITECH_DJ)
+        { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_UNIFYING_RECEIVER) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_UNIFYING_RECEIVER_2) },
+#endif
+#if IS_ENABLED(CONFIG_HID_MAGICMOUSE)
+        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGICMOUSE) },
+        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGICTRACKPAD) },
+#endif
+#if IS_ENABLED(CONFIG_HID_MAYFLASH)
+        { HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_PS3) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_DOLPHINBAR) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_GAMECUBE1) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_GAMECUBE2) },
+#endif
+#if IS_ENABLED(CONFIG_HID_MICROSOFT)
         { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_COMFORT_MOUSE_4500) },
         { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_COMFORT_KEYBOARD) },
         { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_SIDEWINDER_GV) },
@@ -1992,9 +2085,22 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_DIGITAL_MEDIA_600) },
         { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_DIGITAL_MEDIA_3KV1) },
         { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_POWER_COVER) },
+        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_PRESENTER_8K_BT) },
+#endif
+#if IS_ENABLED(CONFIG_HID_MONTEREY)
         { HID_USB_DEVICE(USB_VENDOR_ID_MONTEREY, USB_DEVICE_ID_GENIUS_KB29E) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_MSI, USB_DEVICE_ID_MSI_GT683R_LED_PANEL) },
+#endif
+#if IS_ENABLED(CONFIG_HID_MULTITOUCH)
+        { HID_USB_DEVICE(USB_VENDOR_ID_LG, USB_DEVICE_ID_LG_MELFAS_MT) },
+#endif
+#if IS_ENABLED(CONFIG_HID_WIIMOTE)
+        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_NINTENDO, USB_DEVICE_ID_NINTENDO_WIIMOTE) },
+        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_NINTENDO, USB_DEVICE_ID_NINTENDO_WIIMOTE2) },
+#endif
+#if IS_ENABLED(CONFIG_HID_NTI)
         { HID_USB_DEVICE(USB_VENDOR_ID_NTI, USB_DEVICE_ID_USB_SUN) },
+#endif
+#if IS_ENABLED(CONFIG_HID_NTRIG)
         { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN) },
         { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_1) },
         { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_2) },
@@ -2014,13 +2120,41 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_16) },
         { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_17) },
         { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_18) },
+#endif
+#if IS_ENABLED(CONFIG_HID_ORTEK)
         { HID_USB_DEVICE(USB_VENDOR_ID_ORTEK, USB_DEVICE_ID_ORTEK_PKB1700) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ORTEK, USB_DEVICE_ID_ORTEK_WKB2000) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_SKYCABLE, USB_DEVICE_ID_SKYCABLE_WIRELESS_PRESENTER) },
+#endif
+#if IS_ENABLED(CONFIG_HID_PANTHERLORD)
+        { HID_USB_DEVICE(USB_VENDOR_ID_GAMERON, USB_DEVICE_ID_GAMERON_DUAL_PSX_ADAPTOR) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_GAMERON, USB_DEVICE_ID_GAMERON_DUAL_PCS_ADAPTOR) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_GREENASIA, 0x0003) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_JESS2, USB_DEVICE_ID_JESS2_COLOR_RUMBLE_PAD) },
+#endif
+#if IS_ENABLED(CONFIG_HID_PENMOUNT)
         { HID_USB_DEVICE(USB_VENDOR_ID_PENMOUNT, USB_DEVICE_ID_PENMOUNT_6000) },
+#endif
+#if IS_ENABLED(CONFIG_HID_PETALYNX)
         { HID_USB_DEVICE(USB_VENDOR_ID_PETALYNX, USB_DEVICE_ID_PETALYNX_MAXTER_REMOTE) },
+#endif
+#if IS_ENABLED(CONFIG_HID_PICOLCD)
+        { HID_USB_DEVICE(USB_VENDOR_ID_MICROCHIP, USB_DEVICE_ID_PICOLCD) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_MICROCHIP, USB_DEVICE_ID_PICOLCD_BOOTLOADER) },
+#endif
+#if IS_ENABLED(CONFIG_HID_PLANTRONICS)
         { HID_USB_DEVICE(USB_VENDOR_ID_PLANTRONICS, HID_ANY_ID) },
+#endif
+#if IS_ENABLED(CONFIG_HID_PRIMAX)
         { HID_USB_DEVICE(USB_VENDOR_ID_PRIMAX, USB_DEVICE_ID_PRIMAX_KEYBOARD) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_RISO_KAGAKU, USB_DEVICE_ID_RI_KA_WEBMAIL) },
+#endif
+#if IS_ENABLED(CONFIG_HID_PRODIKEYS)
+        { HID_USB_DEVICE(USB_VENDOR_ID_CREATIVELABS, USB_DEVICE_ID_PRODIKEYS_PCMIDI) },
+#endif
+#if IS_ENABLED(CONFIG_HID_RMI)
+        { HID_USB_DEVICE(USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_X1_COVER) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_RAZER, USB_DEVICE_ID_RAZER_BLADE_14) },
+#endif
 #if IS_ENABLED(CONFIG_HID_ROCCAT)
         { HID_USB_DEVICE(USB_VENDOR_ID_ROCCAT, USB_DEVICE_ID_ROCCAT_ARVO) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ROCCAT, USB_DEVICE_ID_ROCCAT_ISKU) },
@@ -2048,9 +2182,21 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_MADCATZ, USB_DEVICE_ID_MADCATZ_RAT5) },
         { HID_USB_DEVICE(USB_VENDOR_ID_MADCATZ, USB_DEVICE_ID_MADCATZ_RAT9) },
 #endif
+#if IS_ENABLED(CONFIG_HID_SAMSUNG)
         { HID_USB_DEVICE(USB_VENDOR_ID_SAMSUNG, USB_DEVICE_ID_SAMSUNG_IR_REMOTE) },
         { HID_USB_DEVICE(USB_VENDOR_ID_SAMSUNG, USB_DEVICE_ID_SAMSUNG_WIRELESS_KBD_MOUSE) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_SKYCABLE, USB_DEVICE_ID_SKYCABLE_WIRELESS_PRESENTER) },
+#endif
+#if IS_ENABLED(CONFIG_HID_SMARTJOYPLUS)
+        { HID_USB_DEVICE(USB_VENDOR_ID_PLAYDOTCOM, USB_DEVICE_ID_PLAYDOTCOM_EMS_USBII) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP, USB_DEVICE_ID_SMARTJOY_PLUS) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP, USB_DEVICE_ID_SUPER_JOY_BOX_3) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP, USB_DEVICE_ID_DUAL_USB_JOYPAD) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP_LTD, USB_DEVICE_ID_SUPER_JOY_BOX_3_PRO) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP_LTD, USB_DEVICE_ID_SUPER_DUAL_BOX_PRO) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP_LTD, USB_DEVICE_ID_SUPER_JOY_BOX_5_PRO) },
+#endif
+#if IS_ENABLED(CONFIG_HID_SONY)
+        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_HARMONY_PS3) },
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_SMK, USB_DEVICE_ID_SMK_PS3_BDREMOTE) },
         { HID_USB_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_BUZZ_CONTROLLER) },
         { HID_USB_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_WIRELESS_BUZZ_CONTROLLER) },
@@ -2069,9 +2215,17 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_VAIO_VGX_MOUSE) },
         { HID_USB_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_VAIO_VGP_MOUSE) },
         { HID_USB_DEVICE(USB_VENDOR_ID_SINO_LITE, USB_DEVICE_ID_SINO_LITE_CONTROLLER) },
+#endif
+#if IS_ENABLED(CONFIG_HID_SPEEDLINK)
+        { HID_USB_DEVICE(USB_VENDOR_ID_X_TENSIONS, USB_DEVICE_ID_SPEEDLINK_VAD_CEZANNE) },
+#endif
+#if IS_ENABLED(CONFIG_HID_STEELSERIES)
         { HID_USB_DEVICE(USB_VENDOR_ID_STEELSERIES, USB_DEVICE_ID_STEELSERIES_SRWS1) },
+#endif
+#if IS_ENABLED(CONFIG_HID_SUNPLUS)
         { HID_USB_DEVICE(USB_VENDOR_ID_SUNPLUS, USB_DEVICE_ID_SUNPLUS_WDESKTOP) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_THINGM, USB_DEVICE_ID_BLINK1) },
+#endif
+#if IS_ENABLED(CONFIG_HID_THRUSTMASTER)
         { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb300) },
         { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb304) },
         { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb323) },
@@ -2080,12 +2234,25 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb653) },
         { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb654) },
         { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb65a) },
+#endif
+#if IS_ENABLED(CONFIG_HID_TIVO)
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_TIVO, USB_DEVICE_ID_TIVO_SLIDE_BT) },
         { HID_USB_DEVICE(USB_VENDOR_ID_TIVO, USB_DEVICE_ID_TIVO_SLIDE) },
         { HID_USB_DEVICE(USB_VENDOR_ID_TIVO, USB_DEVICE_ID_TIVO_SLIDE_PRO) },
+#endif
+#if IS_ENABLED(CONFIG_HID_TOPSEED)
+        { HID_USB_DEVICE(USB_VENDOR_ID_BTC, USB_DEVICE_ID_BTC_EMPREX_REMOTE) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_BTC, USB_DEVICE_ID_BTC_EMPREX_REMOTE_2) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_WIRELESS) },
         { HID_USB_DEVICE(USB_VENDOR_ID_TOPSEED, USB_DEVICE_ID_TOPSEED_CYBERLINK) },
         { HID_USB_DEVICE(USB_VENDOR_ID_TOPSEED2, USB_DEVICE_ID_TOPSEED2_RF_COMBO) },
+#endif
+#if IS_ENABLED(CONFIG_HID_TWINHAN)
         { HID_USB_DEVICE(USB_VENDOR_ID_TWINHAN, USB_DEVICE_ID_TWINHAN_IR_REMOTE) },
+#endif
+#if IS_ENABLED(CONFIG_HID_UCLOGIC)
+        { HID_USB_DEVICE(USB_VENDOR_ID_HUION, USB_DEVICE_ID_HUION_TABLET) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_HUION_TABLET) },
         { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_PF1209) },
         { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_WP4030U) },
         { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_WP5540U) },
@@ -2093,20 +2260,17 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_WP1062) },
         { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_WIRELESS_TABLET_TWHL850) },
         { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_TWHA60) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_THQ, USB_DEVICE_ID_THQ_PS3_UDRAW) },
         { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_YIYNOVA_TABLET) },
         { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UGEE_TABLET_81) },
         { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UGEE_TABLET_45) },
         { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_DRAWIMAGE_G3) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_UGTIZER, USB_DEVICE_ID_UGTIZER_TABLET_GP0610) },
         { HID_USB_DEVICE(USB_VENDOR_ID_UGEE, USB_DEVICE_ID_UGEE_TABLET_EX07S) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP, USB_DEVICE_ID_SMARTJOY_PLUS) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP, USB_DEVICE_ID_SUPER_JOY_BOX_3) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP, USB_DEVICE_ID_DUAL_USB_JOYPAD) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP_LTD, USB_DEVICE_ID_SUPER_JOY_BOX_3_PRO) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP_LTD, USB_DEVICE_ID_SUPER_DUAL_BOX_PRO) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP_LTD, USB_DEVICE_ID_SUPER_JOY_BOX_5_PRO) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_PLAYDOTCOM, USB_DEVICE_ID_PLAYDOTCOM_EMS_USBII) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_UGTIZER, USB_DEVICE_ID_UGTIZER_TABLET_GP0610) },
+#endif
+#if IS_ENABLED(CONFIG_HID_UDRAW_PS3)
+        { HID_USB_DEVICE(USB_VENDOR_ID_THQ, USB_DEVICE_ID_THQ_PS3_UDRAW) },
+#endif
+#if IS_ENABLED(CONFIG_HID_WALTOP)
         { HID_USB_DEVICE(USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_SLIM_TABLET_5_8_INCH) },
         { HID_USB_DEVICE(USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_SLIM_TABLET_12_1_INCH) },
         { HID_USB_DEVICE(USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_Q_PAD) },
@@ -2114,19 +2278,18 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_MEDIA_TABLET_10_6_INCH) },
         { HID_USB_DEVICE(USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_MEDIA_TABLET_14_1_INCH) },
         { HID_USB_DEVICE(USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_SIRIUS_BATTERY_FREE_TABLET) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_X_TENSIONS, USB_DEVICE_ID_SPEEDLINK_VAD_CEZANNE) },
+#endif
+#if IS_ENABLED(CONFIG_HID_XINMO)
         { HID_USB_DEVICE(USB_VENDOR_ID_XIN_MO, USB_DEVICE_ID_XIN_MO_DUAL_ARCADE) },
         { HID_USB_DEVICE(USB_VENDOR_ID_XIN_MO, USB_DEVICE_ID_THT_2P_ARCADE) },
+#endif
+#if IS_ENABLED(CONFIG_HID_ZEROPLUS)
         { HID_USB_DEVICE(USB_VENDOR_ID_ZEROPLUS, 0x0005) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ZEROPLUS, 0x0030) },
+#endif
+#if IS_ENABLED(CONFIG_HID_ZYDACRON)
         { HID_USB_DEVICE(USB_VENDOR_ID_ZYDACRON, USB_DEVICE_ID_ZYDACRON_REMOTE_CONTROL) },
-
-        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_PRESENTER_8K_BT) },
-        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_NINTENDO, USB_DEVICE_ID_NINTENDO_WIIMOTE) },
-        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_NINTENDO, USB_DEVICE_ID_NINTENDO_WIIMOTE2) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_RAZER, USB_DEVICE_ID_RAZER_BLADE_14) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_CMEDIA, USB_DEVICE_ID_CM6533) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_X1_COVER) },
+#endif
         { }
 };
 
diff --git a/drivers/hid/hid-elecom.c b/drivers/hid/hid-elecom.c
index 6e3848a8d8dd..e2c7465df69f 100644
--- a/drivers/hid/hid-elecom.c
+++ b/drivers/hid/hid-elecom.c
@@ -1,10 +1,8 @@
 /*
- *  HID driver for Elecom BM084 (bluetooth mouse).
- *  Removes a non-existing horizontal wheel from
- *  the HID descriptor.
- *  (This module is based on "hid-ortek".)
- *
+ *  HID driver for ELECOM devices.
  *  Copyright (c) 2010 Richard Nauber <Richard.Nauber@gmail.com>
+ *  Copyright (c) 2016 Yuxuan Shui <yshuiv7@gmail.com>
+ *  Copyright (c) 2017 Diego Elio Pettenò <flameeyes@flameeyes.eu>
  */
 
 /*
@@ -23,15 +21,61 @@
 static __u8 *elecom_report_fixup(struct hid_device *hdev, __u8 *rdesc,
                 unsigned int *rsize)
 {
-        if (*rsize >= 48 && rdesc[46] == 0x05 && rdesc[47] == 0x0c) {
-                hid_info(hdev, "Fixing up Elecom BM084 report descriptor\n");
-                rdesc[47] = 0x00;
+        switch (hdev->product) {
+        case USB_DEVICE_ID_ELECOM_BM084:
+                /* The BM084 Bluetooth mouse includes a non-existing horizontal
+                 * wheel in the HID descriptor. */
+                if (*rsize >= 48 && rdesc[46] == 0x05 && rdesc[47] == 0x0c) {
+                        hid_info(hdev, "Fixing up Elecom BM084 report descriptor\n");
+                        rdesc[47] = 0x00;
+                }
+                break;
+        case USB_DEVICE_ID_ELECOM_DEFT_WIRED:
+        case USB_DEVICE_ID_ELECOM_DEFT_WIRELESS:
+                /* The DEFT trackball has eight buttons, but its descriptor only
+                 * reports five, disabling the three Fn buttons on the top of
+                 * the mouse.
+                 *
+                 * Apply the following diff to the descriptor:
+                 *
+                 * Collection (Physical),              Collection (Physical),
+                 *     Report ID (1),                      Report ID (1),
+                 *     Report Count (5),           ->      Report Count (8),
+                 *     Report Size (1),                    Report Size (1),
+                 *     Usage Page (Button),                Usage Page (Button),
+                 *     Usage Minimum (01h),                Usage Minimum (01h),
+                 *     Usage Maximum (05h),        ->      Usage Maximum (08h),
+                 *     Logical Minimum (0),                Logical Minimum (0),
+                 *     Logical Maximum (1),                Logical Maximum (1),
+                 *     Input (Variable),                   Input (Variable),
+                 *     Report Count (1),           ->      Report Count (0),
+                 *     Report Size (3),                    Report Size (3),
+                 *     Input (Constant),                   Input (Constant),
+                 *     Report Size (16),                   Report Size (16),
+                 *     Report Count (2),                   Report Count (2),
+                 *     Usage Page (Desktop),               Usage Page (Desktop),
+                 *     Usage (X),                          Usage (X),
+                 *     Usage (Y),                          Usage (Y),
+                 *     Logical Minimum (-32768),           Logical Minimum (-32768),
+                 *     Logical Maximum (32767),            Logical Maximum (32767),
+                 *     Input (Variable, Relative),         Input (Variable, Relative),
+                 * End Collection,                     End Collection,
+                 */
+                if (*rsize == 213 && rdesc[13] == 5 && rdesc[21] == 5) {
+                        hid_info(hdev, "Fixing up Elecom DEFT Fn buttons\n");
+                        rdesc[13] = 8; /* Button/Variable Report Count */
+                        rdesc[21] = 8; /* Button/Variable Usage Maximum */
+                        rdesc[29] = 0; /* Button/Constant Report Count */
+                }
+                break;
         }
         return rdesc;
 }
 
 static const struct hid_device_id elecom_devices[] = {
-        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_BM084)},
+        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_BM084) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_DEFT_WIRED) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_DEFT_WIRELESS) },
         { }
 };
 MODULE_DEVICE_TABLE(hid, elecom_devices);
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 643390ba749d..4f9a3938189a 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -173,6 +173,7 @@
 #define USB_VENDOR_ID_ASUSTEK           0x0b05
 #define USB_DEVICE_ID_ASUSTEK_LCM       0x1726
 #define USB_DEVICE_ID_ASUSTEK_LCM2      0x175b
+#define USB_DEVICE_ID_ASUSTEK_T100_KEYBOARD     0x17e0
 #define USB_DEVICE_ID_ASUSTEK_I2C_KEYBOARD      0x8585
 #define USB_DEVICE_ID_ASUSTEK_I2C_TOUCHPAD      0x0101
 #define USB_DEVICE_ID_ASUSTEK_ROG_KEYBOARD1 0x1854
@@ -318,6 +319,9 @@
 #define USB_VENDOR_ID_DELCOM            0x0fc5
 #define USB_DEVICE_ID_DELCOM_VISUAL_IND 0xb080
 
+#define USB_VENDOR_ID_DELL                              0x413c
+#define USB_DEVICE_ID_DELL_PIXART_USB_OPTICAL_MOUSE     0x301a
+
 #define USB_VENDOR_ID_DELORME           0x1163
 #define USB_DEVICE_ID_DELORME_EARTHMATE 0x0100
 #define USB_DEVICE_ID_DELORME_EM_LT20   0x0200
@@ -358,6 +362,8 @@
 
 #define USB_VENDOR_ID_ELECOM            0x056e
 #define USB_DEVICE_ID_ELECOM_BM084      0x0061
+#define USB_DEVICE_ID_ELECOM_DEFT_WIRED 0x00fe
+#define USB_DEVICE_ID_ELECOM_DEFT_WIRELESS      0x00ff
 
 #define USB_VENDOR_ID_DREAM_CHEEKY      0x1d34
 #define USB_DEVICE_ID_DREAM_CHEEKY_WN   0x0004
diff --git a/drivers/hid/i2c-hid/i2c-hid.c b/drivers/hid/i2c-hid/i2c-hid.c
index 8daa8ce64ebb..fb55fb4c39fc 100644
--- a/drivers/hid/i2c-hid/i2c-hid.c
+++ b/drivers/hid/i2c-hid/i2c-hid.c
@@ -897,6 +897,15 @@ static int i2c_hid_acpi_pdata(struct i2c_client *client,
         return 0;
 }
 
+static void i2c_hid_acpi_fix_up_power(struct device *dev)
+{
+        acpi_handle handle = ACPI_HANDLE(dev);
+        struct acpi_device *adev;
+
+        if (handle && acpi_bus_get_device(handle, &adev) == 0)
+                acpi_device_fix_up_power(adev);
+}
+
 static const struct acpi_device_id i2c_hid_acpi_match[] = {
         {"ACPI0C50", 0 },
         {"PNP0C50", 0 },
@@ -909,6 +918,8 @@ static inline int i2c_hid_acpi_pdata(struct i2c_client *client,
 {
         return -ENODEV;
 }
+
+static inline void i2c_hid_acpi_fix_up_power(struct device *dev) {}
 #endif
 
 #ifdef CONFIG_OF
@@ -1030,6 +1041,8 @@ static int i2c_hid_probe(struct i2c_client *client,
         if (ret < 0)
                 goto err_regulator;
 
+        i2c_hid_acpi_fix_up_power(&client->dev);
+
         pm_runtime_get_noresume(&client->dev);
         pm_runtime_set_active(&client->dev);
         pm_runtime_enable(&client->dev);
diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
index 6316498b7812..a88e7c7bea0a 100644
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -85,6 +85,7 @@ static const struct hid_blacklist {
         { USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K65RGB_RAPIDFIRE, HID_QUIRK_NO_INIT_REPORTS | HID_QUIRK_ALWAYS_POLL },
         { USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_SCIMITAR_PRO_RGB, HID_QUIRK_NO_INIT_REPORTS | HID_QUIRK_ALWAYS_POLL },
         { USB_VENDOR_ID_CREATIVELABS, USB_DEVICE_ID_CREATIVE_SB_OMNI_SURROUND_51, HID_QUIRK_NOGET },
+        { USB_VENDOR_ID_DELL, USB_DEVICE_ID_DELL_PIXART_USB_OPTICAL_MOUSE, HID_QUIRK_ALWAYS_POLL },
         { USB_VENDOR_ID_DMI, USB_DEVICE_ID_DMI_ENC, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_WIIU, HID_QUIRK_MULTI_INPUT },
         { USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_PS3, HID_QUIRK_MULTI_INPUT },
diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
index 4b225fb19a16..e274c9dc32f3 100644
--- a/drivers/hid/wacom_wac.c
+++ b/drivers/hid/wacom_wac.c
@@ -1571,37 +1571,38 @@ static int wacom_tpc_irq(struct wacom_wac *wacom, size_t len)
 {
         unsigned char *data = wacom->data;
 
-        if (wacom->pen_input)
+        if (wacom->pen_input) {
                 dev_dbg(wacom->pen_input->dev.parent,
                         "%s: received report #%d\n", __func__, data[0]);
-        else if (wacom->touch_input)
+
+                if (len == WACOM_PKGLEN_PENABLED ||
+                    data[0] == WACOM_REPORT_PENABLED)
+                        return wacom_tpc_pen(wacom);
+        }
+        else if (wacom->touch_input) {
                 dev_dbg(wacom->touch_input->dev.parent,
                         "%s: received report #%d\n", __func__, data[0]);
 
-        switch (len) {
-        case WACOM_PKGLEN_TPC1FG:
-                return wacom_tpc_single_touch(wacom, len);
+                switch (len) {
+                case WACOM_PKGLEN_TPC1FG:
+                        return wacom_tpc_single_touch(wacom, len);
 
-        case WACOM_PKGLEN_TPC2FG:
-                return wacom_tpc_mt_touch(wacom);
+                case WACOM_PKGLEN_TPC2FG:
+                        return wacom_tpc_mt_touch(wacom);
 
-        case WACOM_PKGLEN_PENABLED:
-                return wacom_tpc_pen(wacom);
+                default:
+                        switch (data[0]) {
+                        case WACOM_REPORT_TPC1FG:
+                        case WACOM_REPORT_TPCHID:
+                        case WACOM_REPORT_TPCST:
+                        case WACOM_REPORT_TPC1FGE:
+                                return wacom_tpc_single_touch(wacom, len);
 
-        default:
-                switch (data[0]) {
-                case WACOM_REPORT_TPC1FG:
-                case WACOM_REPORT_TPCHID:
-                case WACOM_REPORT_TPCST:
-                case WACOM_REPORT_TPC1FGE:
-                        return wacom_tpc_single_touch(wacom, len);
-
-                case WACOM_REPORT_TPCMT:
-                case WACOM_REPORT_TPCMT2:
-                        return wacom_mt_touch(wacom);
+                        case WACOM_REPORT_TPCMT:
+                        case WACOM_REPORT_TPCMT2:
+                                return wacom_mt_touch(wacom);
 
-                case WACOM_REPORT_PENABLED:
-                        return wacom_tpc_pen(wacom);
+                        }
                 }
         }
 
diff --git a/drivers/hsi/clients/ssi_protocol.c b/drivers/hsi/clients/ssi_protocol.c
index 26b05106f0d3..93d28c0ec8bf 100644
--- a/drivers/hsi/clients/ssi_protocol.c
+++ b/drivers/hsi/clients/ssi_protocol.c
@@ -1066,7 +1066,7 @@ static void ssip_pn_setup(struct net_device *dev)
         dev->addr_len           = 1;
         dev->tx_queue_len       = SSIP_TXQUEUE_LEN;
 
-        dev->destructor         = free_netdev;
+        dev->needs_free_netdev  = true;
         dev->header_ops         = &phonet_header_ops;
 }
 
diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig
index 22d5eafd6815..5ef2814345ef 100644
--- a/drivers/hwmon/Kconfig
+++ b/drivers/hwmon/Kconfig
@@ -343,6 +343,7 @@ config SENSORS_ASB100
 
 config SENSORS_ASPEED
         tristate "ASPEED AST2400/AST2500 PWM and Fan tach driver"
+        select REGMAP
         help
           This driver provides support for ASPEED AST2400/AST2500 PWM
           and Fan Tacho controllers.
diff --git a/drivers/hwmon/aspeed-pwm-tacho.c b/drivers/hwmon/aspeed-pwm-tacho.c
index 48403a2115be..9de13d626c68 100644
--- a/drivers/hwmon/aspeed-pwm-tacho.c
+++ b/drivers/hwmon/aspeed-pwm-tacho.c
@@ -7,6 +7,7 @@
  */
 
 #include <linux/clk.h>
+#include <linux/errno.h>
 #include <linux/gpio/consumer.h>
 #include <linux/delay.h>
 #include <linux/hwmon.h>
@@ -494,7 +495,7 @@ static u32 aspeed_get_fan_tach_ch_measure_period(struct aspeed_pwm_tacho_data
         return clk / (clk_unit * div_h * div_l * tacho_div * tacho_unit);
 }
 
-static u32 aspeed_get_fan_tach_ch_rpm(struct aspeed_pwm_tacho_data *priv,
+static int aspeed_get_fan_tach_ch_rpm(struct aspeed_pwm_tacho_data *priv,
                                       u8 fan_tach_ch)
 {
         u32 raw_data, tach_div, clk_source, sec, val;
@@ -510,6 +511,9 @@ static u32 aspeed_get_fan_tach_ch_rpm(struct aspeed_pwm_tacho_data *priv,
         msleep(sec);
 
         regmap_read(priv->regmap, ASPEED_PTCR_RESULT, &val);
+        if (!(val & RESULT_STATUS_MASK))
+                return -ETIMEDOUT;
+
         raw_data = val & RESULT_VALUE_MASK;
         tach_div = priv->type_fan_tach_clock_division[type];
         tach_div = 0x4 << (tach_div * 2);
@@ -561,12 +565,14 @@ static ssize_t show_rpm(struct device *dev, struct device_attribute *attr,
 {
         struct sensor_device_attribute *sensor_attr = to_sensor_dev_attr(attr);
         int index = sensor_attr->index;
-        u32 rpm;
+        int rpm;
         struct aspeed_pwm_tacho_data *priv = dev_get_drvdata(dev);
 
         rpm = aspeed_get_fan_tach_ch_rpm(priv, index);
+        if (rpm < 0)
+                return rpm;
 
-        return sprintf(buf, "%u\n", rpm);
+        return sprintf(buf, "%d\n", rpm);
 }
 
 static umode_t pwm_is_visible(struct kobject *kobj,
@@ -591,24 +597,23 @@ static umode_t fan_dev_is_visible(struct kobject *kobj,
         return a->mode;
 }
 
-static SENSOR_DEVICE_ATTR(pwm0, 0644,
-                        show_pwm, set_pwm, 0);
 static SENSOR_DEVICE_ATTR(pwm1, 0644,
-                        show_pwm, set_pwm, 1);
+                        show_pwm, set_pwm, 0);
 static SENSOR_DEVICE_ATTR(pwm2, 0644,
-                        show_pwm, set_pwm, 2);
+                        show_pwm, set_pwm, 1);
 static SENSOR_DEVICE_ATTR(pwm3, 0644,
-                        show_pwm, set_pwm, 3);
+                        show_pwm, set_pwm, 2);
 static SENSOR_DEVICE_ATTR(pwm4, 0644,
-                        show_pwm, set_pwm, 4);
+                        show_pwm, set_pwm, 3);
 static SENSOR_DEVICE_ATTR(pwm5, 0644,
-                        show_pwm, set_pwm, 5);
+                        show_pwm, set_pwm, 4);
 static SENSOR_DEVICE_ATTR(pwm6, 0644,
-                        show_pwm, set_pwm, 6);
+                        show_pwm, set_pwm, 5);
 static SENSOR_DEVICE_ATTR(pwm7, 0644,
+                        show_pwm, set_pwm, 6);
+static SENSOR_DEVICE_ATTR(pwm8, 0644,
                         show_pwm, set_pwm, 7);
 static struct attribute *pwm_dev_attrs[] = {
-        &sensor_dev_attr_pwm0.dev_attr.attr,
         &sensor_dev_attr_pwm1.dev_attr.attr,
         &sensor_dev_attr_pwm2.dev_attr.attr,
         &sensor_dev_attr_pwm3.dev_attr.attr,
@@ -616,6 +621,7 @@ static struct attribute *pwm_dev_attrs[] = {
         &sensor_dev_attr_pwm5.dev_attr.attr,
         &sensor_dev_attr_pwm6.dev_attr.attr,
         &sensor_dev_attr_pwm7.dev_attr.attr,
+        &sensor_dev_attr_pwm8.dev_attr.attr,
         NULL,
 };
 
@@ -624,40 +630,39 @@ static const struct attribute_group pwm_dev_group = {
         .is_visible = pwm_is_visible,
 };
 
-static SENSOR_DEVICE_ATTR(fan0_input, 0444,
-                show_rpm, NULL, 0);
 static SENSOR_DEVICE_ATTR(fan1_input, 0444,
-                show_rpm, NULL, 1);
+                show_rpm, NULL, 0);
 static SENSOR_DEVICE_ATTR(fan2_input, 0444,
-                show_rpm, NULL, 2);
+                show_rpm, NULL, 1);
 static SENSOR_DEVICE_ATTR(fan3_input, 0444,
-                show_rpm, NULL, 3);
+                show_rpm, NULL, 2);
 static SENSOR_DEVICE_ATTR(fan4_input, 0444,
-                show_rpm, NULL, 4);
+                show_rpm, NULL, 3);
 static SENSOR_DEVICE_ATTR(fan5_input, 0444,
-                show_rpm, NULL, 5);
+                show_rpm, NULL, 4);
 static SENSOR_DEVICE_ATTR(fan6_input, 0444,
-                show_rpm, NULL, 6);
+                show_rpm, NULL, 5);
 static SENSOR_DEVICE_ATTR(fan7_input, 0444,
-                show_rpm, NULL, 7);
+                show_rpm, NULL, 6);
 static SENSOR_DEVICE_ATTR(fan8_input, 0444,
-                show_rpm, NULL, 8);
+                show_rpm, NULL, 7);
 static SENSOR_DEVICE_ATTR(fan9_input, 0444,
-                show_rpm, NULL, 9);
+                show_rpm, NULL, 8);
 static SENSOR_DEVICE_ATTR(fan10_input, 0444,
-                show_rpm, NULL, 10);
+                show_rpm, NULL, 9);
 static SENSOR_DEVICE_ATTR(fan11_input, 0444,
-                show_rpm, NULL, 11);
+                show_rpm, NULL, 10);
 static SENSOR_DEVICE_ATTR(fan12_input, 0444,
-                show_rpm, NULL, 12);
+                show_rpm, NULL, 11);
 static SENSOR_DEVICE_ATTR(fan13_input, 0444,
-                show_rpm, NULL, 13);
+                show_rpm, NULL, 12);
 static SENSOR_DEVICE_ATTR(fan14_input, 0444,
-                show_rpm, NULL, 14);
+                show_rpm, NULL, 13);
 static SENSOR_DEVICE_ATTR(fan15_input, 0444,
+                show_rpm, NULL, 14);
+static SENSOR_DEVICE_ATTR(fan16_input, 0444,
                 show_rpm, NULL, 15);
 static struct attribute *fan_dev_attrs[] = {
-        &sensor_dev_attr_fan0_input.dev_attr.attr,
         &sensor_dev_attr_fan1_input.dev_attr.attr,
         &sensor_dev_attr_fan2_input.dev_attr.attr,
         &sensor_dev_attr_fan3_input.dev_attr.attr,
@@ -673,6 +678,7 @@ static struct attribute *fan_dev_attrs[] = {
         &sensor_dev_attr_fan13_input.dev_attr.attr,
         &sensor_dev_attr_fan14_input.dev_attr.attr,
         &sensor_dev_attr_fan15_input.dev_attr.attr,
+        &sensor_dev_attr_fan16_input.dev_attr.attr,
         NULL
 };
 
@@ -802,7 +808,6 @@ static int aspeed_pwm_tacho_probe(struct platform_device *pdev)
                 if (ret)
                         return ret;
         }
-        of_node_put(np);
 
         priv->groups[0] = &pwm_dev_group;
         priv->groups[1] = &fan_dev_group;
diff --git a/drivers/i2c/busses/i2c-imx.c b/drivers/i2c/busses/i2c-imx.c
index 95ed17183e73..54a47b40546f 100644
--- a/drivers/i2c/busses/i2c-imx.c
+++ b/drivers/i2c/busses/i2c-imx.c
@@ -734,9 +734,9 @@ static int i2c_imx_dma_read(struct imx_i2c_struct *i2c_imx,
                  * the first read operation, otherwise the first read cost
                  * one extra clock cycle.
                  */
-                temp = readb(i2c_imx->base + IMX_I2C_I2CR);
+                temp = imx_i2c_read_reg(i2c_imx, IMX_I2C_I2CR);
                 temp |= I2CR_MTX;
-                writeb(temp, i2c_imx->base + IMX_I2C_I2CR);
+                imx_i2c_write_reg(temp, i2c_imx, IMX_I2C_I2CR);
         }
         msgs->buf[msgs->len-1] = imx_i2c_read_reg(i2c_imx, IMX_I2C_I2DR);
 
@@ -857,9 +857,9 @@ static int i2c_imx_read(struct imx_i2c_struct *i2c_imx, struct i2c_msg *msgs, bo
                                  * the first read operation, otherwise the first read cost
                                  * one extra clock cycle.
                                  */
-                                temp = readb(i2c_imx->base + IMX_I2C_I2CR);
+                                temp = imx_i2c_read_reg(i2c_imx, IMX_I2C_I2CR);
                                 temp |= I2CR_MTX;
-                                writeb(temp, i2c_imx->base + IMX_I2C_I2CR);
+                                imx_i2c_write_reg(temp, i2c_imx, IMX_I2C_I2CR);
                         }
                 } else if (i == (msgs->len - 2)) {
                         dev_dbg(&i2c_imx->adapter.dev,
diff --git a/drivers/i2c/busses/i2c-ismt.c b/drivers/i2c/busses/i2c-ismt.c
index f573448d2132..e98e44e584a4 100644
--- a/drivers/i2c/busses/i2c-ismt.c
+++ b/drivers/i2c/busses/i2c-ismt.c
@@ -584,7 +584,7 @@ static int ismt_access(struct i2c_adapter *adap, u16 addr,
 
         /* unmap the data buffer */
         if (dma_size != 0)
-                dma_unmap_single(&adap->dev, dma_addr, dma_size, dma_direction);
+                dma_unmap_single(dev, dma_addr, dma_size, dma_direction);
 
         if (unlikely(!time_left)) {
                 dev_err(dev, "completion wait timed out\n");
diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c
index 214bf2835d1f..8be3e6cb8fe6 100644
--- a/drivers/i2c/busses/i2c-rcar.c
+++ b/drivers/i2c/busses/i2c-rcar.c
@@ -319,7 +319,7 @@ static void rcar_i2c_dma_unmap(struct rcar_i2c_priv *priv)
         rcar_i2c_write(priv, ICFBSCR, TCYC06);
 
         dma_unmap_single(chan->device->dev, sg_dma_address(&priv->sg),
-                         priv->msg->len, priv->dma_direction);
+                         sg_dma_len(&priv->sg), priv->dma_direction);
 
         priv->dma_direction = DMA_NONE;
 }
diff --git a/drivers/iio/adc/bcm_iproc_adc.c b/drivers/iio/adc/bcm_iproc_adc.c
index 21d38c8af21e..7f4f9c4150e3 100644
--- a/drivers/iio/adc/bcm_iproc_adc.c
+++ b/drivers/iio/adc/bcm_iproc_adc.c
@@ -143,7 +143,7 @@ static void iproc_adc_reg_dump(struct iio_dev *indio_dev)
         iproc_adc_dbg_reg(dev, adc_priv, IPROC_SOFT_BYPASS_DATA);
 }
 
-static irqreturn_t iproc_adc_interrupt_handler(int irq, void *data)
+static irqreturn_t iproc_adc_interrupt_thread(int irq, void *data)
 {
         u32 channel_intr_status;
         u32 intr_status;
@@ -167,7 +167,7 @@ static irqreturn_t iproc_adc_interrupt_handler(int irq, void *data)
         return IRQ_NONE;
 }
 
-static irqreturn_t iproc_adc_interrupt_thread(int irq, void *data)
+static irqreturn_t iproc_adc_interrupt_handler(int irq, void *data)
 {
         irqreturn_t retval = IRQ_NONE;
         struct iproc_adc_priv *adc_priv;
@@ -181,7 +181,7 @@ static irqreturn_t iproc_adc_interrupt_thread(int irq, void *data)
         adc_priv = iio_priv(indio_dev);
 
         regmap_read(adc_priv->regmap, IPROC_INTERRUPT_STATUS, &intr_status);
-        dev_dbg(&indio_dev->dev, "iproc_adc_interrupt_thread(),INTRPT_STS:%x\n",
+        dev_dbg(&indio_dev->dev, "iproc_adc_interrupt_handler(),INTRPT_STS:%x\n",
                         intr_status);
 
         intr_channels = (intr_status & IPROC_ADC_INTR_MASK) >> IPROC_ADC_INTR;
@@ -566,8 +566,8 @@ static int iproc_adc_probe(struct platform_device *pdev)
         }
 
         ret = devm_request_threaded_irq(&pdev->dev, adc_priv->irqno,
-                                iproc_adc_interrupt_thread,
                                 iproc_adc_interrupt_handler,
+                                iproc_adc_interrupt_thread,
                                 IRQF_SHARED, "iproc-adc", indio_dev);
         if (ret) {
                 dev_err(&pdev->dev, "request_irq error %d\n", ret);
diff --git a/drivers/iio/adc/max9611.c b/drivers/iio/adc/max9611.c
index ec82106480e1..b0526e4b9530 100644
--- a/drivers/iio/adc/max9611.c
+++ b/drivers/iio/adc/max9611.c
@@ -438,10 +438,10 @@ static ssize_t max9611_shunt_resistor_show(struct device *dev,
         struct max9611_dev *max9611 = iio_priv(dev_to_iio_dev(dev));
         unsigned int i, r;
 
-        i = max9611->shunt_resistor_uohm / 1000;
-        r = max9611->shunt_resistor_uohm % 1000;
+        i = max9611->shunt_resistor_uohm / 1000000;
+        r = max9611->shunt_resistor_uohm % 1000000;
 
-        return sprintf(buf, "%u.%03u\n", i, r);
+        return sprintf(buf, "%u.%06u\n", i, r);
 }
 
 static IIO_DEVICE_ATTR(in_power_shunt_resistor, 0444,
@@ -536,8 +536,8 @@ static int max9611_probe(struct i2c_client *client,
         int ret;
 
         indio_dev = devm_iio_device_alloc(&client->dev, sizeof(*max9611));
-        if (IS_ERR(indio_dev))
-                return PTR_ERR(indio_dev);
+        if (!indio_dev)
+                return -ENOMEM;
 
         i2c_set_clientdata(client, indio_dev);
 
diff --git a/drivers/iio/adc/meson_saradc.c b/drivers/iio/adc/meson_saradc.c
index dd4190b50df6..6066bbfc42fe 100644
--- a/drivers/iio/adc/meson_saradc.c
+++ b/drivers/iio/adc/meson_saradc.c
@@ -468,13 +468,13 @@ static void meson_sar_adc_unlock(struct iio_dev *indio_dev)
 static void meson_sar_adc_clear_fifo(struct iio_dev *indio_dev)
 {
         struct meson_sar_adc_priv *priv = iio_priv(indio_dev);
-        int count;
+        unsigned int count, tmp;
 
         for (count = 0; count < MESON_SAR_ADC_MAX_FIFO_SIZE; count++) {
                 if (!meson_sar_adc_get_fifo_count(indio_dev))
                         break;
 
-                regmap_read(priv->regmap, MESON_SAR_ADC_FIFO_RD, 0);
+                regmap_read(priv->regmap, MESON_SAR_ADC_FIFO_RD, &tmp);
         }
 }
 
diff --git a/drivers/iio/adc/mxs-lradc-adc.c b/drivers/iio/adc/mxs-lradc-adc.c
index b0c7d8ee5cb8..6888167ca1e6 100644
--- a/drivers/iio/adc/mxs-lradc-adc.c
+++ b/drivers/iio/adc/mxs-lradc-adc.c
@@ -718,9 +718,12 @@ static int mxs_lradc_adc_probe(struct platform_device *pdev)
         adc->dev = dev;
 
         iores = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (!iores)
+                return -EINVAL;
+
         adc->base = devm_ioremap(dev, iores->start, resource_size(iores));
-        if (IS_ERR(adc->base))
-                return PTR_ERR(adc->base);
+        if (!adc->base)
+                return -ENOMEM;
 
         init_completion(&adc->completion);
         spin_lock_init(&adc->lock);
diff --git a/drivers/iio/adc/sun4i-gpadc-iio.c b/drivers/iio/adc/sun4i-gpadc-iio.c
index b23527309088..81d4c39e414a 100644
--- a/drivers/iio/adc/sun4i-gpadc-iio.c
+++ b/drivers/iio/adc/sun4i-gpadc-iio.c
@@ -105,6 +105,8 @@ struct sun4i_gpadc_iio {
         bool                            no_irq;
         /* prevents concurrent reads of temperature and ADC */
         struct mutex                    mutex;
+        struct thermal_zone_device      *tzd;
+        struct device                   *sensor_device;
 };
 
 #define SUN4I_GPADC_ADC_CHANNEL(_channel, _name) {              \
@@ -502,7 +504,6 @@ static int sun4i_gpadc_probe_dt(struct platform_device *pdev,
 {
         struct sun4i_gpadc_iio *info = iio_priv(indio_dev);
         const struct of_device_id *of_dev;
-        struct thermal_zone_device *tzd;
         struct resource *mem;
         void __iomem *base;
         int ret;
@@ -532,13 +533,14 @@ static int sun4i_gpadc_probe_dt(struct platform_device *pdev,
         if (!IS_ENABLED(CONFIG_THERMAL_OF))
                 return 0;
 
-        tzd = devm_thermal_zone_of_sensor_register(&pdev->dev, 0, info,
-                                                   &sun4i_ts_tz_ops);
-        if (IS_ERR(tzd))
+        info->sensor_device = &pdev->dev;
+        info->tzd = thermal_zone_of_sensor_register(info->sensor_device, 0,
+                                                    info, &sun4i_ts_tz_ops);
+        if (IS_ERR(info->tzd))
                 dev_err(&pdev->dev, "could not register thermal sensor: %ld\n",
-                        PTR_ERR(tzd));
+                        PTR_ERR(info->tzd));
 
-        return PTR_ERR_OR_ZERO(tzd);
+        return PTR_ERR_OR_ZERO(info->tzd);
 }
 
 static int sun4i_gpadc_probe_mfd(struct platform_device *pdev,
@@ -584,15 +586,15 @@ static int sun4i_gpadc_probe_mfd(struct platform_device *pdev,
                  * of_node, and the device from this driver as third argument to
                  * return the temperature.
                  */
-                struct thermal_zone_device *tzd;
-                tzd = devm_thermal_zone_of_sensor_register(pdev->dev.parent, 0,
-                                                           info,
-                                                           &sun4i_ts_tz_ops);
-                if (IS_ERR(tzd)) {
+                info->sensor_device = pdev->dev.parent;
+                info->tzd = thermal_zone_of_sensor_register(info->sensor_device,
+                                                            0, info,
+                                                            &sun4i_ts_tz_ops);
+                if (IS_ERR(info->tzd)) {
                         dev_err(&pdev->dev,
                                 "could not register thermal sensor: %ld\n",
-                                PTR_ERR(tzd));
-                        return PTR_ERR(tzd);
+                                PTR_ERR(info->tzd));
+                        return PTR_ERR(info->tzd);
                 }
         } else {
                 indio_dev->num_channels =
@@ -688,7 +690,13 @@ static int sun4i_gpadc_remove(struct platform_device *pdev)
 
         pm_runtime_put(&pdev->dev);
         pm_runtime_disable(&pdev->dev);
-        if (!info->no_irq && IS_ENABLED(CONFIG_THERMAL_OF))
+
+        if (!IS_ENABLED(CONFIG_THERMAL_OF))
+                return 0;
+
+        thermal_zone_of_sensor_unregister(info->sensor_device, info->tzd);
+
+        if (!info->no_irq)
                 iio_map_array_unregister(indio_dev);
 
         return 0;
@@ -700,6 +708,7 @@ static const struct platform_device_id sun4i_gpadc_id[] = {
         { "sun6i-a31-gpadc-iio", (kernel_ulong_t)&sun6i_gpadc_data },
         { /* sentinel */ },
 };
+MODULE_DEVICE_TABLE(platform, sun4i_gpadc_id);
 
 static struct platform_driver sun4i_gpadc_driver = {
         .driver = {
@@ -711,6 +720,7 @@ static struct platform_driver sun4i_gpadc_driver = {
         .probe = sun4i_gpadc_probe,
         .remove = sun4i_gpadc_remove,
 };
+MODULE_DEVICE_TABLE(of, sun4i_gpadc_of_id);
 
 module_platform_driver(sun4i_gpadc_driver);
 
diff --git a/drivers/iio/adc/ti_am335x_adc.c b/drivers/iio/adc/ti_am335x_adc.c
index 4282ceca3d8f..6cbed7eb118a 100644
--- a/drivers/iio/adc/ti_am335x_adc.c
+++ b/drivers/iio/adc/ti_am335x_adc.c
@@ -614,7 +614,7 @@ static int tiadc_probe(struct platform_device *pdev)
                 return -EINVAL;
         }
 
-        indio_dev = devm_iio_device_alloc(&pdev->dev, sizeof(*indio_dev));
+        indio_dev = devm_iio_device_alloc(&pdev->dev, sizeof(*adc_dev));
         if (indio_dev == NULL) {
                 dev_err(&pdev->dev, "failed to allocate iio device\n");
                 return -ENOMEM;
diff --git a/drivers/iio/buffer/industrialio-buffer-dma.c b/drivers/iio/buffer/industrialio-buffer-dma.c
index dd99d273bae9..ff03324dee13 100644
--- a/drivers/iio/buffer/industrialio-buffer-dma.c
+++ b/drivers/iio/buffer/industrialio-buffer-dma.c
@@ -14,6 +14,7 @@
 #include <linux/sched.h>
 #include <linux/poll.h>
 #include <linux/iio/buffer.h>
+#include <linux/iio/buffer_impl.h>
 #include <linux/iio/buffer-dma.h>
 #include <linux/dma-mapping.h>
 #include <linux/sizes.h>
diff --git a/drivers/iio/buffer/industrialio-buffer-dmaengine.c b/drivers/iio/buffer/industrialio-buffer-dmaengine.c
index 9fabed47053d..2b5a320f42c5 100644
--- a/drivers/iio/buffer/industrialio-buffer-dmaengine.c
+++ b/drivers/iio/buffer/industrialio-buffer-dmaengine.c
@@ -14,6 +14,7 @@
 
 #include <linux/iio/iio.h>
 #include <linux/iio/buffer.h>
+#include <linux/iio/buffer_impl.h>
 #include <linux/iio/buffer-dma.h>
 #include <linux/iio/buffer-dmaengine.h>
 
diff --git a/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c b/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c
index 96dabbd2f004..88a7c5d4e4d2 100644
--- a/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c
+++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c
@@ -41,6 +41,7 @@ static const int accel_scale[] = {598, 1196, 2392, 4785};
 static const struct inv_mpu6050_reg_map reg_set_6500 = {
         .sample_rate_div        = INV_MPU6050_REG_SAMPLE_RATE_DIV,
         .lpf                    = INV_MPU6050_REG_CONFIG,
+        .accel_lpf              = INV_MPU6500_REG_ACCEL_CONFIG_2,
         .user_ctrl              = INV_MPU6050_REG_USER_CTRL,
         .fifo_en                = INV_MPU6050_REG_FIFO_EN,
         .gyro_config            = INV_MPU6050_REG_GYRO_CONFIG,
@@ -211,6 +212,37 @@ int inv_mpu6050_set_power_itg(struct inv_mpu6050_state *st, bool power_on)
 EXPORT_SYMBOL_GPL(inv_mpu6050_set_power_itg);
 
 /**
+ *  inv_mpu6050_set_lpf_regs() - set low pass filter registers, chip dependent
+ *
+ *  MPU60xx/MPU9150 use only 1 register for accelerometer + gyroscope
+ *  MPU6500 and above have a dedicated register for accelerometer
+ */
+static int inv_mpu6050_set_lpf_regs(struct inv_mpu6050_state *st,
+                                    enum inv_mpu6050_filter_e val)
+{
+        int result;
+
+        result = regmap_write(st->map, st->reg->lpf, val);
+        if (result)
+                return result;
+
+        switch (st->chip_type) {
+        case INV_MPU6050:
+        case INV_MPU6000:
+        case INV_MPU9150:
+                /* old chips, nothing to do */
+                result = 0;
+                break;
+        default:
+                /* set accel lpf */
+                result = regmap_write(st->map, st->reg->accel_lpf, val);
+                break;
+        }
+
+        return result;
+}
+
+/**
  *  inv_mpu6050_init_config() - Initialize hardware, disable FIFO.
  *
  *  Initial configuration:
@@ -233,8 +265,7 @@ static int inv_mpu6050_init_config(struct iio_dev *indio_dev)
         if (result)
                 return result;
 
-        d = INV_MPU6050_FILTER_20HZ;
-        result = regmap_write(st->map, st->reg->lpf, d);
+        result = inv_mpu6050_set_lpf_regs(st, INV_MPU6050_FILTER_20HZ);
         if (result)
                 return result;
 
@@ -537,6 +568,8 @@ error_write_raw:
  *                  would be alising. This function basically search for the
  *                  correct low pass parameters based on the fifo rate, e.g,
  *                  sampling frequency.
+ *
+ *  lpf is set automatically when setting sampling rate to avoid any aliases.
  */
 static int inv_mpu6050_set_lpf(struct inv_mpu6050_state *st, int rate)
 {
@@ -552,7 +585,7 @@ static int inv_mpu6050_set_lpf(struct inv_mpu6050_state *st, int rate)
         while ((h < hz[i]) && (i < ARRAY_SIZE(d) - 1))
                 i++;
         data = d[i];
-        result = regmap_write(st->map, st->reg->lpf, data);
+        result = inv_mpu6050_set_lpf_regs(st, data);
         if (result)
                 return result;
         st->chip_config.lpf = data;
diff --git a/drivers/iio/imu/inv_mpu6050/inv_mpu_iio.h b/drivers/iio/imu/inv_mpu6050/inv_mpu_iio.h
index ef13de7a2c20..953a0c09d568 100644
--- a/drivers/iio/imu/inv_mpu6050/inv_mpu_iio.h
+++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_iio.h
@@ -28,6 +28,7 @@
  *  struct inv_mpu6050_reg_map - Notable registers.
  *  @sample_rate_div:   Divider applied to gyro output rate.
  *  @lpf:               Configures internal low pass filter.
+ *  @accel_lpf:         Configures accelerometer low pass filter.
  *  @user_ctrl:         Enables/resets the FIFO.
  *  @fifo_en:           Determines which data will appear in FIFO.
  *  @gyro_config:       gyro config register.
@@ -47,6 +48,7 @@
 struct inv_mpu6050_reg_map {
         u8 sample_rate_div;
         u8 lpf;
+        u8 accel_lpf;
         u8 user_ctrl;
         u8 fifo_en;
         u8 gyro_config;
@@ -188,6 +190,7 @@ struct inv_mpu6050_state {
 #define INV_MPU6050_FIFO_THRESHOLD           500
 
 /* mpu6500 registers */
+#define INV_MPU6500_REG_ACCEL_CONFIG_2      0x1D
 #define INV_MPU6500_REG_ACCEL_OFFSET        0x77
 
 /* delay time in milliseconds */
diff --git a/drivers/iio/industrialio-trigger.c b/drivers/iio/industrialio-trigger.c
index 978e1592c2a3..4061fed93f1f 100644
--- a/drivers/iio/industrialio-trigger.c
+++ b/drivers/iio/industrialio-trigger.c
@@ -451,7 +451,8 @@ static ssize_t iio_trigger_write_current(struct device *dev,
         return len;
 
 out_trigger_put:
-        iio_trigger_put(trig);
+        if (trig)
+                iio_trigger_put(trig);
         return ret;
 }
 
diff --git a/drivers/iio/light/ltr501.c b/drivers/iio/light/ltr501.c
index b30e0c1c6cc4..67838edd8b37 100644
--- a/drivers/iio/light/ltr501.c
+++ b/drivers/iio/light/ltr501.c
@@ -74,9 +74,9 @@ static const int int_time_mapping[] = {100000, 50000, 200000, 400000};
 static const struct reg_field reg_field_it =
                                 REG_FIELD(LTR501_ALS_MEAS_RATE, 3, 4);
 static const struct reg_field reg_field_als_intr =
-                                REG_FIELD(LTR501_INTR, 0, 0);
-static const struct reg_field reg_field_ps_intr =
                                 REG_FIELD(LTR501_INTR, 1, 1);
+static const struct reg_field reg_field_ps_intr =
+                                REG_FIELD(LTR501_INTR, 0, 0);
 static const struct reg_field reg_field_als_rate =
                                 REG_FIELD(LTR501_ALS_MEAS_RATE, 0, 2);
 static const struct reg_field reg_field_ps_rate =
diff --git a/drivers/iio/proximity/as3935.c b/drivers/iio/proximity/as3935.c
index ddf9bee89f77..aa4df0dcc8c9 100644
--- a/drivers/iio/proximity/as3935.c
+++ b/drivers/iio/proximity/as3935.c
@@ -40,9 +40,9 @@
 #define AS3935_AFE_PWR_BIT      BIT(0)
 
 #define AS3935_INT              0x03
-#define AS3935_INT_MASK         0x07
+#define AS3935_INT_MASK         0x0f
 #define AS3935_EVENT_INT        BIT(3)
-#define AS3935_NOISE_INT        BIT(1)
+#define AS3935_NOISE_INT        BIT(0)
 
 #define AS3935_DATA             0x07
 #define AS3935_DATA_MASK        0x3F
@@ -215,7 +215,7 @@ static irqreturn_t as3935_trigger_handler(int irq, void *private)
 
         st->buffer[0] = val & AS3935_DATA_MASK;
         iio_push_to_buffers_with_timestamp(indio_dev, &st->buffer,
-                                           pf->timestamp);
+                                           iio_get_time_ns(indio_dev));
 err_read:
         iio_trigger_notify_done(indio_dev->trig);
 
@@ -244,7 +244,7 @@ static void as3935_event_work(struct work_struct *work)
 
         switch (val) {
         case AS3935_EVENT_INT:
-                iio_trigger_poll(st->trig);
+                iio_trigger_poll_chained(st->trig);
                 break;
         case AS3935_NOISE_INT:
                 dev_warn(&st->spi->dev, "noise level is too high\n");
@@ -269,8 +269,6 @@ static irqreturn_t as3935_interrupt_handler(int irq, void *private)
 
 static void calibrate_as3935(struct as3935_state *st)
 {
-        mutex_lock(&st->lock);
-
         /* mask disturber interrupt bit */
         as3935_write(st, AS3935_INT, BIT(5));
 
@@ -280,8 +278,6 @@ static void calibrate_as3935(struct as3935_state *st)
 
         mdelay(2);
         as3935_write(st, AS3935_TUNE_CAP, (st->tune_cap / TUNE_CAP_DIV));
-
-        mutex_unlock(&st->lock);
 }
 
 #ifdef CONFIG_PM_SLEEP
@@ -318,6 +314,8 @@ static int as3935_resume(struct device *dev)
         val &= ~AS3935_AFE_PWR_BIT;
         ret = as3935_write(st, AS3935_AFE_GAIN, val);
 
+        calibrate_as3935(st);
+
 err_resume:
         mutex_unlock(&st->lock);
 
diff --git a/drivers/infiniband/core/addr.c b/drivers/infiniband/core/addr.c
index 02971e239a18..ece6926fa2e6 100644
--- a/drivers/infiniband/core/addr.c
+++ b/drivers/infiniband/core/addr.c
@@ -449,12 +449,7 @@ static int addr6_resolve(struct sockaddr_in6 *src_in,
                 return ret;
 
         rt = (struct rt6_info *)dst;
-        if (ipv6_addr_any(&fl6.saddr)) {
-                ret = ipv6_dev_get_saddr(addr->net, ip6_dst_idev(dst)->dev,
-                                         &fl6.daddr, 0, &fl6.saddr);
-                if (ret)
-                        goto put;
-
+        if (ipv6_addr_any(&src_in->sin6_addr)) {
                 src_in->sin6_family = AF_INET6;
                 src_in->sin6_addr = fl6.saddr;
         }
@@ -471,9 +466,6 @@ static int addr6_resolve(struct sockaddr_in6 *src_in,
 
         *pdst = dst;
         return 0;
-put:
-        dst_release(dst);
-        return ret;
 }
 #else
 static int addr6_resolve(struct sockaddr_in6 *src_in,
diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c
index 1844770f3ae8..2b4d613a3474 100644
--- a/drivers/infiniband/core/cm.c
+++ b/drivers/infiniband/core/cm.c
@@ -1429,7 +1429,7 @@ static void cm_format_paths_from_req(struct cm_req_msg *req_msg,
         primary_path->packet_life_time =
                 cm_req_get_primary_local_ack_timeout(req_msg);
         primary_path->packet_life_time -= (primary_path->packet_life_time > 0);
-        sa_path_set_service_id(primary_path, req_msg->service_id);
+        primary_path->service_id = req_msg->service_id;
 
         if (req_msg->alt_local_lid) {
                 alt_path->dgid = req_msg->alt_local_gid;
@@ -1452,7 +1452,7 @@ static void cm_format_paths_from_req(struct cm_req_msg *req_msg,
                 alt_path->packet_life_time =
                         cm_req_get_alt_local_ack_timeout(req_msg);
                 alt_path->packet_life_time -= (alt_path->packet_life_time > 0);
-                sa_path_set_service_id(alt_path, req_msg->service_id);
+                alt_path->service_id = req_msg->service_id;
         }
 }
 
diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index 91b7a2fe5a55..31bb82d8ecd7 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -1140,7 +1140,7 @@ static void cma_save_ib_info(struct sockaddr *src_addr,
                         ib->sib_pkey = path->pkey;
                         ib->sib_flowinfo = path->flow_label;
                         memcpy(&ib->sib_addr, &path->sgid, 16);
-                        ib->sib_sid = sa_path_get_service_id(path);
+                        ib->sib_sid = path->service_id;
                         ib->sib_scope_id = 0;
                 } else {
                         ib->sib_pkey = listen_ib->sib_pkey;
@@ -1274,8 +1274,7 @@ static int cma_save_req_info(const struct ib_cm_event *ib_event,
                 memcpy(&req->local_gid, &req_param->primary_path->sgid,
                        sizeof(req->local_gid));
                 req->has_gid    = true;
-                req->service_id =
-                        sa_path_get_service_id(req_param->primary_path);
+                req->service_id = req_param->primary_path->service_id;
                 req->pkey       = be16_to_cpu(req_param->primary_path->pkey);
                 if (req->pkey != req_param->bth_pkey)
                         pr_warn_ratelimited("RDMA CMA: got different BTH P_Key (0x%x) and primary path P_Key (0x%x)\n"
@@ -1827,7 +1826,8 @@ static struct rdma_id_private *cma_new_conn_id(struct rdma_cm_id *listen_id,
         struct rdma_route *rt;
         const sa_family_t ss_family = listen_id->route.addr.src_addr.ss_family;
         struct sa_path_rec *path = ib_event->param.req_rcvd.primary_path;
-        const __be64 service_id = sa_path_get_service_id(path);
+        const __be64 service_id =
+                ib_event->param.req_rcvd.primary_path->service_id;
         int ret;
 
         id = rdma_create_id(listen_id->route.addr.dev_addr.net,
@@ -2345,9 +2345,8 @@ static int cma_query_ib_route(struct rdma_id_private *id_priv, int timeout_ms,
         path_rec.pkey = cpu_to_be16(ib_addr_get_pkey(dev_addr));
         path_rec.numb_path = 1;
         path_rec.reversible = 1;
-        sa_path_set_service_id(&path_rec,
-                               rdma_get_service_id(&id_priv->id,
-                                                   cma_dst_addr(id_priv)));
+        path_rec.service_id = rdma_get_service_id(&id_priv->id,
+                                                  cma_dst_addr(id_priv));
 
         comp_mask = IB_SA_PATH_REC_DGID | IB_SA_PATH_REC_SGID |
                     IB_SA_PATH_REC_PKEY | IB_SA_PATH_REC_NUMB_PATH |
diff --git a/drivers/infiniband/core/core_priv.h b/drivers/infiniband/core/core_priv.h
index cb7d372e4bdf..d92ab4eaa8f3 100644
--- a/drivers/infiniband/core/core_priv.h
+++ b/drivers/infiniband/core/core_priv.h
@@ -169,6 +169,16 @@ void ib_mad_cleanup(void);
 int ib_sa_init(void);
 void ib_sa_cleanup(void);
 
+int ibnl_init(void);
+void ibnl_cleanup(void);
+
+/**
+ * Check if there are any listeners to the netlink group
+ * @group: the netlink group ID
+ * Returns 0 on success or a negative for no listeners.
+ */
+int ibnl_chk_listeners(unsigned int group);
+
 int ib_nl_handle_resolve_resp(struct sk_buff *skb,
                               struct netlink_callback *cb);
 int ib_nl_handle_set_timeout(struct sk_buff *skb,
diff --git a/drivers/infiniband/core/netlink.c b/drivers/infiniband/core/netlink.c
index b784055423c8..94931c474d41 100644
--- a/drivers/infiniband/core/netlink.c
+++ b/drivers/infiniband/core/netlink.c
@@ -37,6 +37,7 @@
 #include <net/net_namespace.h>
 #include <net/sock.h>
 #include <rdma/rdma_netlink.h>
+#include "core_priv.h"
 
 struct ibnl_client {
         struct list_head                list;
@@ -55,7 +56,6 @@ int ibnl_chk_listeners(unsigned int group)
                 return -1;
         return 0;
 }
-EXPORT_SYMBOL(ibnl_chk_listeners);
 
 int ibnl_add_client(int index, int nops,
                     const struct ibnl_client_cbs cb_table[])
diff --git a/drivers/infiniband/core/sa_query.c b/drivers/infiniband/core/sa_query.c
index e335b09c022e..fb7aec4047c8 100644
--- a/drivers/infiniband/core/sa_query.c
+++ b/drivers/infiniband/core/sa_query.c
@@ -194,7 +194,7 @@ static u32 tid;
         .field_name          = "sa_path_rec:" #field
 
 static const struct ib_field path_rec_table[] = {
-        { PATH_REC_FIELD(ib.service_id),
+        { PATH_REC_FIELD(service_id),
           .offset_words = 0,
           .offset_bits  = 0,
           .size_bits    = 64 },
@@ -296,7 +296,7 @@ static const struct ib_field path_rec_table[] = {
         .field_name          = "sa_path_rec:" #field
 
 static const struct ib_field opa_path_rec_table[] = {
-        { OPA_PATH_REC_FIELD(opa.service_id),
+        { OPA_PATH_REC_FIELD(service_id),
           .offset_words = 0,
           .offset_bits  = 0,
           .size_bits    = 64 },
@@ -774,7 +774,7 @@ static void ib_nl_set_path_rec_attrs(struct sk_buff *skb,
 
         /* Now build the attributes */
         if (comp_mask & IB_SA_PATH_REC_SERVICE_ID) {
-                val64 = be64_to_cpu(sa_path_get_service_id(sa_rec));
+                val64 = be64_to_cpu(sa_rec->service_id);
                 nla_put(skb, RDMA_NLA_F_MANDATORY | LS_NLA_TYPE_SERVICE_ID,
                         sizeof(val64), &val64);
         }
diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c
index 3dbf811d3c51..21e60b1e2ff4 100644
--- a/drivers/infiniband/core/umem.c
+++ b/drivers/infiniband/core/umem.c
@@ -58,7 +58,7 @@ static void __ib_umem_release(struct ib_device *dev, struct ib_umem *umem, int d
         for_each_sg(umem->sg_head.sgl, sg, umem->npages, i) {
 
                 page = sg_page(sg);
-                if (umem->writable && dirty)
+                if (!PageDirty(page) && umem->writable && dirty)
                         set_page_dirty_lock(page);
                 put_page(page);
         }
diff --git a/drivers/infiniband/core/umem_odp.c b/drivers/infiniband/core/umem_odp.c
index 0780b1afefa9..8c4ec564e495 100644
--- a/drivers/infiniband/core/umem_odp.c
+++ b/drivers/infiniband/core/umem_odp.c
@@ -321,11 +321,15 @@ int ib_umem_odp_get(struct ib_ucontext *context, struct ib_umem *umem,
                 struct vm_area_struct *vma;
                 struct hstate *h;
 
+                down_read(&mm->mmap_sem);
                 vma = find_vma(mm, ib_umem_start(umem));
-                if (!vma || !is_vm_hugetlb_page(vma))
+                if (!vma || !is_vm_hugetlb_page(vma)) {
+                        up_read(&mm->mmap_sem);
                         return -EINVAL;
+                }
                 h = hstate_vma(vma);
                 umem->page_shift = huge_page_shift(h);
+                up_read(&mm->mmap_sem);
                 umem->hugetlb = 1;
         } else {
                 umem->hugetlb = 0;
diff --git a/drivers/infiniband/core/uverbs_marshall.c b/drivers/infiniband/core/uverbs_marshall.c
index 8b9587fe2303..94fd989c9060 100644
--- a/drivers/infiniband/core/uverbs_marshall.c
+++ b/drivers/infiniband/core/uverbs_marshall.c
@@ -96,11 +96,11 @@ void ib_copy_qp_attr_to_user(struct ib_uverbs_qp_attr *dst,
 }
 EXPORT_SYMBOL(ib_copy_qp_attr_to_user);
 
-void __ib_copy_path_rec_to_user(struct ib_user_path_rec *dst,
-                                struct sa_path_rec *src)
+static void __ib_copy_path_rec_to_user(struct ib_user_path_rec *dst,
+                                       struct sa_path_rec *src)
 {
-        memcpy(dst->dgid, src->dgid.raw, sizeof src->dgid);
-        memcpy(dst->sgid, src->sgid.raw, sizeof src->sgid);
+        memcpy(dst->dgid, src->dgid.raw, sizeof(src->dgid));
+        memcpy(dst->sgid, src->sgid.raw, sizeof(src->sgid));
 
         dst->dlid               = htons(ntohl(sa_path_get_dlid(src)));
         dst->slid               = htons(ntohl(sa_path_get_slid(src)));
diff --git a/drivers/infiniband/hw/bnxt_re/bnxt_re.h b/drivers/infiniband/hw/bnxt_re/bnxt_re.h
index ebf7be8d4139..08772836fded 100644
--- a/drivers/infiniband/hw/bnxt_re/bnxt_re.h
+++ b/drivers/infiniband/hw/bnxt_re/bnxt_re.h
@@ -56,6 +56,10 @@
 #define BNXT_RE_MAX_SRQC_COUNT          (64 * 1024)
 #define BNXT_RE_MAX_CQ_COUNT            (64 * 1024)
 
+#define BNXT_RE_UD_QP_HW_STALL          0x400000
+
+#define BNXT_RE_RQ_WQE_THRESHOLD        32
+
 struct bnxt_re_work {
         struct work_struct      work;
         unsigned long           event;
diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
index 7ba9e699d7ab..c7bd68311d0c 100644
--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
@@ -61,6 +61,48 @@
 #include "ib_verbs.h"
 #include <rdma/bnxt_re-abi.h>
 
+static int __from_ib_access_flags(int iflags)
+{
+        int qflags = 0;
+
+        if (iflags & IB_ACCESS_LOCAL_WRITE)
+                qflags |= BNXT_QPLIB_ACCESS_LOCAL_WRITE;
+        if (iflags & IB_ACCESS_REMOTE_READ)
+                qflags |= BNXT_QPLIB_ACCESS_REMOTE_READ;
+        if (iflags & IB_ACCESS_REMOTE_WRITE)
+                qflags |= BNXT_QPLIB_ACCESS_REMOTE_WRITE;
+        if (iflags & IB_ACCESS_REMOTE_ATOMIC)
+                qflags |= BNXT_QPLIB_ACCESS_REMOTE_ATOMIC;
+        if (iflags & IB_ACCESS_MW_BIND)
+                qflags |= BNXT_QPLIB_ACCESS_MW_BIND;
+        if (iflags & IB_ZERO_BASED)
+                qflags |= BNXT_QPLIB_ACCESS_ZERO_BASED;
+        if (iflags & IB_ACCESS_ON_DEMAND)
+                qflags |= BNXT_QPLIB_ACCESS_ON_DEMAND;
+        return qflags;
+};
+
+static enum ib_access_flags __to_ib_access_flags(int qflags)
+{
+        enum ib_access_flags iflags = 0;
+
+        if (qflags & BNXT_QPLIB_ACCESS_LOCAL_WRITE)
+                iflags |= IB_ACCESS_LOCAL_WRITE;
+        if (qflags & BNXT_QPLIB_ACCESS_REMOTE_WRITE)
+                iflags |= IB_ACCESS_REMOTE_WRITE;
+        if (qflags & BNXT_QPLIB_ACCESS_REMOTE_READ)
+                iflags |= IB_ACCESS_REMOTE_READ;
+        if (qflags & BNXT_QPLIB_ACCESS_REMOTE_ATOMIC)
+                iflags |= IB_ACCESS_REMOTE_ATOMIC;
+        if (qflags & BNXT_QPLIB_ACCESS_MW_BIND)
+                iflags |= IB_ACCESS_MW_BIND;
+        if (qflags & BNXT_QPLIB_ACCESS_ZERO_BASED)
+                iflags |= IB_ZERO_BASED;
+        if (qflags & BNXT_QPLIB_ACCESS_ON_DEMAND)
+                iflags |= IB_ACCESS_ON_DEMAND;
+        return iflags;
+};
+
 static int bnxt_re_build_sgl(struct ib_sge *ib_sg_list,
                              struct bnxt_qplib_sge *sg_list, int num)
 {
@@ -149,8 +191,8 @@ int bnxt_re_query_device(struct ib_device *ibdev,
         ib_attr->max_total_mcast_qp_attach = 0;
         ib_attr->max_ah = dev_attr->max_ah;
 
-        ib_attr->max_fmr = dev_attr->max_fmr;
-        ib_attr->max_map_per_fmr = 1;   /* ? */
+        ib_attr->max_fmr = 0;
+        ib_attr->max_map_per_fmr = 0;
 
         ib_attr->max_srq = dev_attr->max_srq;
         ib_attr->max_srq_wr = dev_attr->max_srq_wqes;
@@ -410,6 +452,158 @@ enum rdma_link_layer bnxt_re_get_link_layer(struct ib_device *ibdev,
         return IB_LINK_LAYER_ETHERNET;
 }
 
+#define BNXT_RE_FENCE_PBL_SIZE  DIV_ROUND_UP(BNXT_RE_FENCE_BYTES, PAGE_SIZE)
+
+static void bnxt_re_create_fence_wqe(struct bnxt_re_pd *pd)
+{
+        struct bnxt_re_fence_data *fence = &pd->fence;
+        struct ib_mr *ib_mr = &fence->mr->ib_mr;
+        struct bnxt_qplib_swqe *wqe = &fence->bind_wqe;
+
+        memset(wqe, 0, sizeof(*wqe));
+        wqe->type = BNXT_QPLIB_SWQE_TYPE_BIND_MW;
+        wqe->wr_id = BNXT_QPLIB_FENCE_WRID;
+        wqe->flags |= BNXT_QPLIB_SWQE_FLAGS_SIGNAL_COMP;
+        wqe->flags |= BNXT_QPLIB_SWQE_FLAGS_UC_FENCE;
+        wqe->bind.zero_based = false;
+        wqe->bind.parent_l_key = ib_mr->lkey;
+        wqe->bind.va = (u64)(unsigned long)fence->va;
+        wqe->bind.length = fence->size;
+        wqe->bind.access_cntl = __from_ib_access_flags(IB_ACCESS_REMOTE_READ);
+        wqe->bind.mw_type = SQ_BIND_MW_TYPE_TYPE1;
+
+        /* Save the initial rkey in fence structure for now;
+         * wqe->bind.r_key will be set at (re)bind time.
+         */
+        fence->bind_rkey = ib_inc_rkey(fence->mw->rkey);
+}
+
+static int bnxt_re_bind_fence_mw(struct bnxt_qplib_qp *qplib_qp)
+{
+        struct bnxt_re_qp *qp = container_of(qplib_qp, struct bnxt_re_qp,
+                                             qplib_qp);
+        struct ib_pd *ib_pd = qp->ib_qp.pd;
+        struct bnxt_re_pd *pd = container_of(ib_pd, struct bnxt_re_pd, ib_pd);
+        struct bnxt_re_fence_data *fence = &pd->fence;
+        struct bnxt_qplib_swqe *fence_wqe = &fence->bind_wqe;
+        struct bnxt_qplib_swqe wqe;
+        int rc;
+
+        memcpy(&wqe, fence_wqe, sizeof(wqe));
+        wqe.bind.r_key = fence->bind_rkey;
+        fence->bind_rkey = ib_inc_rkey(fence->bind_rkey);
+
+        dev_dbg(rdev_to_dev(qp->rdev),
+                "Posting bind fence-WQE: rkey: %#x QP: %d PD: %p\n",
+                wqe.bind.r_key, qp->qplib_qp.id, pd);
+        rc = bnxt_qplib_post_send(&qp->qplib_qp, &wqe);
+        if (rc) {
+                dev_err(rdev_to_dev(qp->rdev), "Failed to bind fence-WQE\n");
+                return rc;
+        }
+        bnxt_qplib_post_send_db(&qp->qplib_qp);
+
+        return rc;
+}
+
+static void bnxt_re_destroy_fence_mr(struct bnxt_re_pd *pd)
+{
+        struct bnxt_re_fence_data *fence = &pd->fence;
+        struct bnxt_re_dev *rdev = pd->rdev;
+        struct device *dev = &rdev->en_dev->pdev->dev;
+        struct bnxt_re_mr *mr = fence->mr;
+
+        if (fence->mw) {
+                bnxt_re_dealloc_mw(fence->mw);
+                fence->mw = NULL;
+        }
+        if (mr) {
+                if (mr->ib_mr.rkey)
+                        bnxt_qplib_dereg_mrw(&rdev->qplib_res, &mr->qplib_mr,
+                                             true);
+                if (mr->ib_mr.lkey)
+                        bnxt_qplib_free_mrw(&rdev->qplib_res, &mr->qplib_mr);
+                kfree(mr);
+                fence->mr = NULL;
+        }
+        if (fence->dma_addr) {
+                dma_unmap_single(dev, fence->dma_addr, BNXT_RE_FENCE_BYTES,
+                                 DMA_BIDIRECTIONAL);
+                fence->dma_addr = 0;
+        }
+}
+
+static int bnxt_re_create_fence_mr(struct bnxt_re_pd *pd)
+{
+        int mr_access_flags = IB_ACCESS_LOCAL_WRITE | IB_ACCESS_MW_BIND;
+        struct bnxt_re_fence_data *fence = &pd->fence;
+        struct bnxt_re_dev *rdev = pd->rdev;
+        struct device *dev = &rdev->en_dev->pdev->dev;
+        struct bnxt_re_mr *mr = NULL;
+        dma_addr_t dma_addr = 0;
+        struct ib_mw *mw;
+        u64 pbl_tbl;
+        int rc;
+
+        dma_addr = dma_map_single(dev, fence->va, BNXT_RE_FENCE_BYTES,
+                                  DMA_BIDIRECTIONAL);
+        rc = dma_mapping_error(dev, dma_addr);
+        if (rc) {
+                dev_err(rdev_to_dev(rdev), "Failed to dma-map fence-MR-mem\n");
+                rc = -EIO;
+                fence->dma_addr = 0;
+                goto fail;
+        }
+        fence->dma_addr = dma_addr;
+
+        /* Allocate a MR */
+        mr = kzalloc(sizeof(*mr), GFP_KERNEL);
+        if (!mr) {
+                rc = -ENOMEM;
+                goto fail;
+        }
+        fence->mr = mr;
+        mr->rdev = rdev;
+        mr->qplib_mr.pd = &pd->qplib_pd;
+        mr->qplib_mr.type = CMDQ_ALLOCATE_MRW_MRW_FLAGS_PMR;
+        mr->qplib_mr.flags = __from_ib_access_flags(mr_access_flags);
+        rc = bnxt_qplib_alloc_mrw(&rdev->qplib_res, &mr->qplib_mr);
+        if (rc) {
+                dev_err(rdev_to_dev(rdev), "Failed to alloc fence-HW-MR\n");
+                goto fail;
+        }
+
+        /* Register MR */
+        mr->ib_mr.lkey = mr->qplib_mr.lkey;
+        mr->qplib_mr.va = (u64)(unsigned long)fence->va;
+        mr->qplib_mr.total_size = BNXT_RE_FENCE_BYTES;
+        pbl_tbl = dma_addr;
+        rc = bnxt_qplib_reg_mr(&rdev->qplib_res, &mr->qplib_mr, &pbl_tbl,
+                               BNXT_RE_FENCE_PBL_SIZE, false);
+        if (rc) {
+                dev_err(rdev_to_dev(rdev), "Failed to register fence-MR\n");
+                goto fail;
+        }
+        mr->ib_mr.rkey = mr->qplib_mr.rkey;
+
+        /* Create a fence MW only for kernel consumers */
+        mw = bnxt_re_alloc_mw(&pd->ib_pd, IB_MW_TYPE_1, NULL);
+        if (!mw) {
+                dev_err(rdev_to_dev(rdev),
+                        "Failed to create fence-MW for PD: %p\n", pd);
+                rc = -EINVAL;
+                goto fail;
+        }
+        fence->mw = mw;
+
+        bnxt_re_create_fence_wqe(pd);
+        return 0;
+
+fail:
+        bnxt_re_destroy_fence_mr(pd);
+        return rc;
+}
+
 /* Protection Domains */
 int bnxt_re_dealloc_pd(struct ib_pd *ib_pd)
 {
@@ -417,6 +611,7 @@ int bnxt_re_dealloc_pd(struct ib_pd *ib_pd)
         struct bnxt_re_dev *rdev = pd->rdev;
         int rc;
 
+        bnxt_re_destroy_fence_mr(pd);
         if (ib_pd->uobject && pd->dpi.dbr) {
                 struct ib_ucontext *ib_uctx = ib_pd->uobject->context;
                 struct bnxt_re_ucontext *ucntx;
@@ -498,6 +693,10 @@ struct ib_pd *bnxt_re_alloc_pd(struct ib_device *ibdev,
                 }
         }
 
+        if (!udata)
+                if (bnxt_re_create_fence_mr(pd))
+                        dev_warn(rdev_to_dev(rdev),
+                                 "Failed to create Fence-MR\n");
         return &pd->ib_pd;
 dbfail:
         (void)bnxt_qplib_dealloc_pd(&rdev->qplib_res, &rdev->qplib_res.pd_tbl,
@@ -849,12 +1048,16 @@ static struct bnxt_re_qp *bnxt_re_create_shadow_qp
         /* Shadow QP SQ depth should be same as QP1 RQ depth */
         qp->qplib_qp.sq.max_wqe = qp1_qp->rq.max_wqe;
         qp->qplib_qp.sq.max_sge = 2;
+        /* Q full delta can be 1 since it is internal QP */
+        qp->qplib_qp.sq.q_full_delta = 1;
 
         qp->qplib_qp.scq = qp1_qp->scq;
         qp->qplib_qp.rcq = qp1_qp->rcq;
 
         qp->qplib_qp.rq.max_wqe = qp1_qp->rq.max_wqe;
         qp->qplib_qp.rq.max_sge = qp1_qp->rq.max_sge;
+        /* Q full delta can be 1 since it is internal QP */
+        qp->qplib_qp.rq.q_full_delta = 1;
 
         qp->qplib_qp.mtu = qp1_qp->mtu;
 
@@ -917,10 +1120,6 @@ struct ib_qp *bnxt_re_create_qp(struct ib_pd *ib_pd,
         qp->qplib_qp.sig_type = ((qp_init_attr->sq_sig_type ==
                                   IB_SIGNAL_ALL_WR) ? true : false);
 
-        entries = roundup_pow_of_two(qp_init_attr->cap.max_send_wr + 1);
-        qp->qplib_qp.sq.max_wqe = min_t(u32, entries,
-                                        dev_attr->max_qp_wqes + 1);
-
         qp->qplib_qp.sq.max_sge = qp_init_attr->cap.max_send_sge;
         if (qp->qplib_qp.sq.max_sge > dev_attr->max_qp_sges)
                 qp->qplib_qp.sq.max_sge = dev_attr->max_qp_sges;
@@ -959,6 +1158,9 @@ struct ib_qp *bnxt_re_create_qp(struct ib_pd *ib_pd,
                 qp->qplib_qp.rq.max_wqe = min_t(u32, entries,
                                                 dev_attr->max_qp_wqes + 1);
 
+                qp->qplib_qp.rq.q_full_delta = qp->qplib_qp.rq.max_wqe -
+                                                qp_init_attr->cap.max_recv_wr;
+
                 qp->qplib_qp.rq.max_sge = qp_init_attr->cap.max_recv_sge;
                 if (qp->qplib_qp.rq.max_sge > dev_attr->max_qp_sges)
                         qp->qplib_qp.rq.max_sge = dev_attr->max_qp_sges;
@@ -967,6 +1169,12 @@ struct ib_qp *bnxt_re_create_qp(struct ib_pd *ib_pd,
         qp->qplib_qp.mtu = ib_mtu_enum_to_int(iboe_get_mtu(rdev->netdev->mtu));
 
         if (qp_init_attr->qp_type == IB_QPT_GSI) {
+                /* Allocate 1 more than what's provided */
+                entries = roundup_pow_of_two(qp_init_attr->cap.max_send_wr + 1);
+                qp->qplib_qp.sq.max_wqe = min_t(u32, entries,
+                                                dev_attr->max_qp_wqes + 1);
+                qp->qplib_qp.sq.q_full_delta = qp->qplib_qp.sq.max_wqe -
+                                                qp_init_attr->cap.max_send_wr;
                 qp->qplib_qp.rq.max_sge = dev_attr->max_qp_sges;
                 if (qp->qplib_qp.rq.max_sge > dev_attr->max_qp_sges)
                         qp->qplib_qp.rq.max_sge = dev_attr->max_qp_sges;
@@ -1006,6 +1214,22 @@ struct ib_qp *bnxt_re_create_qp(struct ib_pd *ib_pd,
                 }
 
         } else {
+                /* Allocate 128 + 1 more than what's provided */
+                entries = roundup_pow_of_two(qp_init_attr->cap.max_send_wr +
+                                             BNXT_QPLIB_RESERVED_QP_WRS + 1);
+                qp->qplib_qp.sq.max_wqe = min_t(u32, entries,
+                                                dev_attr->max_qp_wqes +
+                                                BNXT_QPLIB_RESERVED_QP_WRS + 1);
+                qp->qplib_qp.sq.q_full_delta = BNXT_QPLIB_RESERVED_QP_WRS + 1;
+
+                /*
+                 * Reserving one slot for Phantom WQE. Application can
+                 * post one extra entry in this case. But allowing this to avoid
+                 * unexpected Queue full condition
+                 */
+
+                qp->qplib_qp.sq.q_full_delta -= 1;
+
                 qp->qplib_qp.max_rd_atomic = dev_attr->max_qp_rd_atom;
                 qp->qplib_qp.max_dest_rd_atomic = dev_attr->max_qp_init_rd_atom;
                 if (udata) {
@@ -1025,6 +1249,7 @@ struct ib_qp *bnxt_re_create_qp(struct ib_pd *ib_pd,
 
         qp->ib_qp.qp_num = qp->qplib_qp.id;
         spin_lock_init(&qp->sq_lock);
+        spin_lock_init(&qp->rq_lock);
 
         if (udata) {
                 struct bnxt_re_qp_resp resp;
@@ -1129,48 +1354,6 @@ static enum ib_mtu __to_ib_mtu(u32 mtu)
         }
 }
 
-static int __from_ib_access_flags(int iflags)
-{
-        int qflags = 0;
-
-        if (iflags & IB_ACCESS_LOCAL_WRITE)
-                qflags |= BNXT_QPLIB_ACCESS_LOCAL_WRITE;
-        if (iflags & IB_ACCESS_REMOTE_READ)
-                qflags |= BNXT_QPLIB_ACCESS_REMOTE_READ;
-        if (iflags & IB_ACCESS_REMOTE_WRITE)
-                qflags |= BNXT_QPLIB_ACCESS_REMOTE_WRITE;
-        if (iflags & IB_ACCESS_REMOTE_ATOMIC)
-                qflags |= BNXT_QPLIB_ACCESS_REMOTE_ATOMIC;
-        if (iflags & IB_ACCESS_MW_BIND)
-                qflags |= BNXT_QPLIB_ACCESS_MW_BIND;
-        if (iflags & IB_ZERO_BASED)
-                qflags |= BNXT_QPLIB_ACCESS_ZERO_BASED;
-        if (iflags & IB_ACCESS_ON_DEMAND)
-                qflags |= BNXT_QPLIB_ACCESS_ON_DEMAND;
-        return qflags;
-};
-
-static enum ib_access_flags __to_ib_access_flags(int qflags)
-{
-        enum ib_access_flags iflags = 0;
-
-        if (qflags & BNXT_QPLIB_ACCESS_LOCAL_WRITE)
-                iflags |= IB_ACCESS_LOCAL_WRITE;
-        if (qflags & BNXT_QPLIB_ACCESS_REMOTE_WRITE)
-                iflags |= IB_ACCESS_REMOTE_WRITE;
-        if (qflags & BNXT_QPLIB_ACCESS_REMOTE_READ)
-                iflags |= IB_ACCESS_REMOTE_READ;
-        if (qflags & BNXT_QPLIB_ACCESS_REMOTE_ATOMIC)
-                iflags |= IB_ACCESS_REMOTE_ATOMIC;
-        if (qflags & BNXT_QPLIB_ACCESS_MW_BIND)
-                iflags |= IB_ACCESS_MW_BIND;
-        if (qflags & BNXT_QPLIB_ACCESS_ZERO_BASED)
-                iflags |= IB_ZERO_BASED;
-        if (qflags & BNXT_QPLIB_ACCESS_ON_DEMAND)
-                iflags |= IB_ACCESS_ON_DEMAND;
-        return iflags;
-};
-
 static int bnxt_re_modify_shadow_qp(struct bnxt_re_dev *rdev,
                                     struct bnxt_re_qp *qp1_qp,
                                     int qp_attr_mask)
@@ -1378,11 +1561,21 @@ int bnxt_re_modify_qp(struct ib_qp *ib_qp, struct ib_qp_attr *qp_attr,
                 entries = roundup_pow_of_two(qp_attr->cap.max_send_wr);
                 qp->qplib_qp.sq.max_wqe = min_t(u32, entries,
                                                 dev_attr->max_qp_wqes + 1);
+                qp->qplib_qp.sq.q_full_delta = qp->qplib_qp.sq.max_wqe -
+                                                qp_attr->cap.max_send_wr;
+                /*
+                 * Reserving one slot for Phantom WQE. Some application can
+                 * post one extra entry in this case. Allowing this to avoid
+                 * unexpected Queue full condition
+                 */
+                qp->qplib_qp.sq.q_full_delta -= 1;
                 qp->qplib_qp.sq.max_sge = qp_attr->cap.max_send_sge;
                 if (qp->qplib_qp.rq.max_wqe) {
                         entries = roundup_pow_of_two(qp_attr->cap.max_recv_wr);
                         qp->qplib_qp.rq.max_wqe =
                                 min_t(u32, entries, dev_attr->max_qp_wqes + 1);
+                        qp->qplib_qp.rq.q_full_delta = qp->qplib_qp.rq.max_wqe -
+                                                       qp_attr->cap.max_recv_wr;
                         qp->qplib_qp.rq.max_sge = qp_attr->cap.max_recv_sge;
                 } else {
                         /* SRQ was used prior, just ignore the RQ caps */
@@ -1883,6 +2076,22 @@ static int bnxt_re_copy_wr_payload(struct bnxt_re_dev *rdev,
         return payload_sz;
 }
 
+static void bnxt_ud_qp_hw_stall_workaround(struct bnxt_re_qp *qp)
+{
+        if ((qp->ib_qp.qp_type == IB_QPT_UD ||
+             qp->ib_qp.qp_type == IB_QPT_GSI ||
+             qp->ib_qp.qp_type == IB_QPT_RAW_ETHERTYPE) &&
+             qp->qplib_qp.wqe_cnt == BNXT_RE_UD_QP_HW_STALL) {
+                int qp_attr_mask;
+                struct ib_qp_attr qp_attr;
+
+                qp_attr_mask = IB_QP_STATE;
+                qp_attr.qp_state = IB_QPS_RTS;
+                bnxt_re_modify_qp(&qp->ib_qp, &qp_attr, qp_attr_mask, NULL);
+                qp->qplib_qp.wqe_cnt = 0;
+        }
+}
+
 static int bnxt_re_post_send_shadow_qp(struct bnxt_re_dev *rdev,
                                        struct bnxt_re_qp *qp,
                                 struct ib_send_wr *wr)
@@ -1928,6 +2137,7 @@ bad:
                 wr = wr->next;
         }
         bnxt_qplib_post_send_db(&qp->qplib_qp);
+        bnxt_ud_qp_hw_stall_workaround(qp);
         spin_unlock_irqrestore(&qp->sq_lock, flags);
         return rc;
 }
@@ -2024,6 +2234,7 @@ bad:
                 wr = wr->next;
         }
         bnxt_qplib_post_send_db(&qp->qplib_qp);
+        bnxt_ud_qp_hw_stall_workaround(qp);
         spin_unlock_irqrestore(&qp->sq_lock, flags);
 
         return rc;
@@ -2071,7 +2282,10 @@ int bnxt_re_post_recv(struct ib_qp *ib_qp, struct ib_recv_wr *wr,
         struct bnxt_re_qp *qp = container_of(ib_qp, struct bnxt_re_qp, ib_qp);
         struct bnxt_qplib_swqe wqe;
         int rc = 0, payload_sz = 0;
+        unsigned long flags;
+        u32 count = 0;
 
+        spin_lock_irqsave(&qp->rq_lock, flags);
         while (wr) {
                 /* House keeping */
                 memset(&wqe, 0, sizeof(wqe));
@@ -2100,9 +2314,21 @@ int bnxt_re_post_recv(struct ib_qp *ib_qp, struct ib_recv_wr *wr,
                         *bad_wr = wr;
                         break;
                 }
+
+                /* Ring DB if the RQEs posted reaches a threshold value */
+                if (++count >= BNXT_RE_RQ_WQE_THRESHOLD) {
+                        bnxt_qplib_post_recv_db(&qp->qplib_qp);
+                        count = 0;
+                }
+
                 wr = wr->next;
         }
-        bnxt_qplib_post_recv_db(&qp->qplib_qp);
+
+        if (count)
+                bnxt_qplib_post_recv_db(&qp->qplib_qp);
+
+        spin_unlock_irqrestore(&qp->rq_lock, flags);
+
         return rc;
 }
 
@@ -2643,12 +2869,36 @@ static void bnxt_re_process_res_ud_wc(struct ib_wc *wc,
                 wc->opcode = IB_WC_RECV_RDMA_WITH_IMM;
 }
 
+static int send_phantom_wqe(struct bnxt_re_qp *qp)
+{
+        struct bnxt_qplib_qp *lib_qp = &qp->qplib_qp;
+        unsigned long flags;
+        int rc = 0;
+
+        spin_lock_irqsave(&qp->sq_lock, flags);
+
+        rc = bnxt_re_bind_fence_mw(lib_qp);
+        if (!rc) {
+                lib_qp->sq.phantom_wqe_cnt++;
+                dev_dbg(&lib_qp->sq.hwq.pdev->dev,
+                        "qp %#x sq->prod %#x sw_prod %#x phantom_wqe_cnt %d\n",
+                        lib_qp->id, lib_qp->sq.hwq.prod,
+                        HWQ_CMP(lib_qp->sq.hwq.prod, &lib_qp->sq.hwq),
+                        lib_qp->sq.phantom_wqe_cnt);
+        }
+
+        spin_unlock_irqrestore(&qp->sq_lock, flags);
+        return rc;
+}
+
 int bnxt_re_poll_cq(struct ib_cq *ib_cq, int num_entries, struct ib_wc *wc)
 {
         struct bnxt_re_cq *cq = container_of(ib_cq, struct bnxt_re_cq, ib_cq);
         struct bnxt_re_qp *qp;
         struct bnxt_qplib_cqe *cqe;
         int i, ncqe, budget;
+        struct bnxt_qplib_q *sq;
+        struct bnxt_qplib_qp *lib_qp;
         u32 tbl_idx;
         struct bnxt_re_sqp_entries *sqp_entry = NULL;
         unsigned long flags;
@@ -2661,7 +2911,21 @@ int bnxt_re_poll_cq(struct ib_cq *ib_cq, int num_entries, struct ib_wc *wc)
         }
         cqe = &cq->cql[0];
         while (budget) {
-                ncqe = bnxt_qplib_poll_cq(&cq->qplib_cq, cqe, budget);
+                lib_qp = NULL;
+                ncqe = bnxt_qplib_poll_cq(&cq->qplib_cq, cqe, budget, &lib_qp);
+                if (lib_qp) {
+                        sq = &lib_qp->sq;
+                        if (sq->send_phantom) {
+                                qp = container_of(lib_qp,
+                                                  struct bnxt_re_qp, qplib_qp);
+                                if (send_phantom_wqe(qp) == -ENOMEM)
+                                        dev_err(rdev_to_dev(cq->rdev),
+                                                "Phantom failed! Scheduled to send again\n");
+                                else
+                                        sq->send_phantom = false;
+                        }
+                }
+
                 if (!ncqe)
                         break;
 
@@ -2822,6 +3086,12 @@ int bnxt_re_dereg_mr(struct ib_mr *ib_mr)
         struct bnxt_re_dev *rdev = mr->rdev;
         int rc;
 
+        rc = bnxt_qplib_free_mrw(&rdev->qplib_res, &mr->qplib_mr);
+        if (rc) {
+                dev_err(rdev_to_dev(rdev), "Dereg MR failed: %#x\n", rc);
+                return rc;
+        }
+
         if (mr->npages && mr->pages) {
                 rc = bnxt_qplib_free_fast_reg_page_list(&rdev->qplib_res,
                                                         &mr->qplib_frpl);
@@ -2829,8 +3099,6 @@ int bnxt_re_dereg_mr(struct ib_mr *ib_mr)
                 mr->npages = 0;
                 mr->pages = NULL;
         }
-        rc = bnxt_qplib_free_mrw(&rdev->qplib_res, &mr->qplib_mr);
-
         if (!IS_ERR_OR_NULL(mr->ib_umem))
                 ib_umem_release(mr->ib_umem);
 
@@ -2914,97 +3182,52 @@ fail:
         return ERR_PTR(rc);
 }
 
-/* Fast Memory Regions */
-struct ib_fmr *bnxt_re_alloc_fmr(struct ib_pd *ib_pd, int mr_access_flags,
-                                 struct ib_fmr_attr *fmr_attr)
+struct ib_mw *bnxt_re_alloc_mw(struct ib_pd *ib_pd, enum ib_mw_type type,
+                               struct ib_udata *udata)
 {
         struct bnxt_re_pd *pd = container_of(ib_pd, struct bnxt_re_pd, ib_pd);
         struct bnxt_re_dev *rdev = pd->rdev;
-        struct bnxt_re_fmr *fmr;
+        struct bnxt_re_mw *mw;
         int rc;
 
-        if (fmr_attr->max_pages > MAX_PBL_LVL_2_PGS ||
-            fmr_attr->max_maps > rdev->dev_attr.max_map_per_fmr) {
-                dev_err(rdev_to_dev(rdev), "Allocate FMR exceeded Max limit");
+        mw = kzalloc(sizeof(*mw), GFP_KERNEL);
+        if (!mw)
                 return ERR_PTR(-ENOMEM);
-        }
-        fmr = kzalloc(sizeof(*fmr), GFP_KERNEL);
-        if (!fmr)
-                return ERR_PTR(-ENOMEM);
-
-        fmr->rdev = rdev;
-        fmr->qplib_fmr.pd = &pd->qplib_pd;
-        fmr->qplib_fmr.type = CMDQ_ALLOCATE_MRW_MRW_FLAGS_PMR;
+        mw->rdev = rdev;
+        mw->qplib_mw.pd = &pd->qplib_pd;
 
-        rc = bnxt_qplib_alloc_mrw(&rdev->qplib_res, &fmr->qplib_fmr);
-        if (rc)
+        mw->qplib_mw.type = (type == IB_MW_TYPE_1 ?
+                               CMDQ_ALLOCATE_MRW_MRW_FLAGS_MW_TYPE1 :
+                               CMDQ_ALLOCATE_MRW_MRW_FLAGS_MW_TYPE2B);
+        rc = bnxt_qplib_alloc_mrw(&rdev->qplib_res, &mw->qplib_mw);
+        if (rc) {
+                dev_err(rdev_to_dev(rdev), "Allocate MW failed!");
                 goto fail;
+        }
+        mw->ib_mw.rkey = mw->qplib_mw.rkey;
 
-        fmr->qplib_fmr.flags = __from_ib_access_flags(mr_access_flags);
-        fmr->ib_fmr.lkey = fmr->qplib_fmr.lkey;
-        fmr->ib_fmr.rkey = fmr->ib_fmr.lkey;
+        atomic_inc(&rdev->mw_count);
+        return &mw->ib_mw;
 
-        atomic_inc(&rdev->mr_count);
-        return &fmr->ib_fmr;
 fail:
-        kfree(fmr);
+        kfree(mw);
         return ERR_PTR(rc);
 }
 
-int bnxt_re_map_phys_fmr(struct ib_fmr *ib_fmr, u64 *page_list, int list_len,
-                         u64 iova)
+int bnxt_re_dealloc_mw(struct ib_mw *ib_mw)
 {
-        struct bnxt_re_fmr *fmr = container_of(ib_fmr, struct bnxt_re_fmr,
-                                             ib_fmr);
-        struct bnxt_re_dev *rdev = fmr->rdev;
+        struct bnxt_re_mw *mw = container_of(ib_mw, struct bnxt_re_mw, ib_mw);
+        struct bnxt_re_dev *rdev = mw->rdev;
         int rc;
 
-        fmr->qplib_fmr.va = iova;
-        fmr->qplib_fmr.total_size = list_len * PAGE_SIZE;
-
-        rc = bnxt_qplib_reg_mr(&rdev->qplib_res, &fmr->qplib_fmr, page_list,
-                               list_len, true);
-        if (rc)
-                dev_err(rdev_to_dev(rdev), "Failed to map FMR for lkey = 0x%x!",
-                        fmr->ib_fmr.lkey);
-        return rc;
-}
-
-int bnxt_re_unmap_fmr(struct list_head *fmr_list)
-{
-        struct bnxt_re_dev *rdev;
-        struct bnxt_re_fmr *fmr;
-        struct ib_fmr *ib_fmr;
-        int rc = 0;
-
-        /* Validate each FMRs inside the fmr_list */
-        list_for_each_entry(ib_fmr, fmr_list, list) {
-                fmr = container_of(ib_fmr, struct bnxt_re_fmr, ib_fmr);
-                rdev = fmr->rdev;
-
-                if (rdev) {
-                        rc = bnxt_qplib_dereg_mrw(&rdev->qplib_res,
-                                                  &fmr->qplib_fmr, true);
-                        if (rc)
-                                break;
-                }
+        rc = bnxt_qplib_free_mrw(&rdev->qplib_res, &mw->qplib_mw);
+        if (rc) {
+                dev_err(rdev_to_dev(rdev), "Free MW failed: %#x\n", rc);
+                return rc;
         }
-        return rc;
-}
-
-int bnxt_re_dealloc_fmr(struct ib_fmr *ib_fmr)
-{
-        struct bnxt_re_fmr *fmr = container_of(ib_fmr, struct bnxt_re_fmr,
-                                               ib_fmr);
-        struct bnxt_re_dev *rdev = fmr->rdev;
-        int rc;
 
-        rc = bnxt_qplib_free_mrw(&rdev->qplib_res, &fmr->qplib_fmr);
-        if (rc)
-                dev_err(rdev_to_dev(rdev), "Failed to free FMR");
-
-        kfree(fmr);
-        atomic_dec(&rdev->mr_count);
+        kfree(mw);
+        atomic_dec(&rdev->mw_count);
         return rc;
 }
 
diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.h b/drivers/infiniband/hw/bnxt_re/ib_verbs.h
index 5c3d71765454..6c160f6a5398 100644
--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.h
+++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.h
@@ -44,11 +44,23 @@ struct bnxt_re_gid_ctx {
         u32                     refcnt;
 };
 
+#define BNXT_RE_FENCE_BYTES     64
+struct bnxt_re_fence_data {
+        u32 size;
+        u8 va[BNXT_RE_FENCE_BYTES];
+        dma_addr_t dma_addr;
+        struct bnxt_re_mr *mr;
+        struct ib_mw *mw;
+        struct bnxt_qplib_swqe bind_wqe;
+        u32 bind_rkey;
+};
+
 struct bnxt_re_pd {
         struct bnxt_re_dev      *rdev;
         struct ib_pd            ib_pd;
         struct bnxt_qplib_pd    qplib_pd;
         struct bnxt_qplib_dpi   dpi;
+        struct bnxt_re_fence_data fence;
 };
 
 struct bnxt_re_ah {
@@ -62,6 +74,7 @@ struct bnxt_re_qp {
         struct bnxt_re_dev      *rdev;
         struct ib_qp            ib_qp;
         spinlock_t              sq_lock;        /* protect sq */
+        spinlock_t              rq_lock;        /* protect rq */
         struct bnxt_qplib_qp    qplib_qp;
         struct ib_umem          *sumem;
         struct ib_umem          *rumem;
@@ -181,12 +194,9 @@ int bnxt_re_map_mr_sg(struct ib_mr *ib_mr, struct scatterlist *sg, int sg_nents,
 struct ib_mr *bnxt_re_alloc_mr(struct ib_pd *ib_pd, enum ib_mr_type mr_type,
                                u32 max_num_sg);
 int bnxt_re_dereg_mr(struct ib_mr *mr);
-struct ib_fmr *bnxt_re_alloc_fmr(struct ib_pd *pd, int mr_access_flags,
-                                 struct ib_fmr_attr *fmr_attr);
-int bnxt_re_map_phys_fmr(struct ib_fmr *fmr, u64 *page_list, int list_len,
-                         u64 iova);
-int bnxt_re_unmap_fmr(struct list_head *fmr_list);
-int bnxt_re_dealloc_fmr(struct ib_fmr *fmr);
+struct ib_mw *bnxt_re_alloc_mw(struct ib_pd *ib_pd, enum ib_mw_type type,
+                               struct ib_udata *udata);
+int bnxt_re_dealloc_mw(struct ib_mw *mw);
 struct ib_mr *bnxt_re_reg_user_mr(struct ib_pd *pd, u64 start, u64 length,
                                   u64 virt_addr, int mr_access_flags,
                                   struct ib_udata *udata);
diff --git a/drivers/infiniband/hw/bnxt_re/main.c b/drivers/infiniband/hw/bnxt_re/main.c
index 5d355401179b..1fce5e73216b 100644
--- a/drivers/infiniband/hw/bnxt_re/main.c
+++ b/drivers/infiniband/hw/bnxt_re/main.c
@@ -507,10 +507,6 @@ static int bnxt_re_register_ib(struct bnxt_re_dev *rdev)
         ibdev->dereg_mr                 = bnxt_re_dereg_mr;
         ibdev->alloc_mr                 = bnxt_re_alloc_mr;
         ibdev->map_mr_sg                = bnxt_re_map_mr_sg;
-        ibdev->alloc_fmr                = bnxt_re_alloc_fmr;
-        ibdev->map_phys_fmr             = bnxt_re_map_phys_fmr;
-        ibdev->unmap_fmr                = bnxt_re_unmap_fmr;
-        ibdev->dealloc_fmr              = bnxt_re_dealloc_fmr;
 
         ibdev->reg_user_mr              = bnxt_re_reg_user_mr;
         ibdev->alloc_ucontext           = bnxt_re_alloc_ucontext;
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.c b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
index 43d08b5e9085..f05500bcdcf1 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.c
+++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
@@ -284,7 +284,7 @@ int bnxt_qplib_create_qp1(struct bnxt_qplib_res *res, struct bnxt_qplib_qp *qp)
 {
         struct bnxt_qplib_rcfw *rcfw = res->rcfw;
         struct cmdq_create_qp1 req;
-        struct creq_create_qp1_resp *resp;
+        struct creq_create_qp1_resp resp;
         struct bnxt_qplib_pbl *pbl;
         struct bnxt_qplib_q *sq = &qp->sq;
         struct bnxt_qplib_q *rq = &qp->rq;
@@ -394,31 +394,12 @@ int bnxt_qplib_create_qp1(struct bnxt_qplib_res *res, struct bnxt_qplib_qp *qp)
 
         req.pd_id = cpu_to_le32(qp->pd->id);
 
-        resp = (struct creq_create_qp1_resp *)
-                        bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
-                                                     NULL, 0);
-        if (!resp) {
-                dev_err(&res->pdev->dev, "QPLIB: FP: CREATE_QP1 send failed");
-                rc = -EINVAL;
-                goto fail;
-        }
-        if (!bnxt_qplib_rcfw_wait_for_resp(rcfw, le16_to_cpu(req.cookie))) {
-                /* Cmd timed out */
-                dev_err(&rcfw->pdev->dev, "QPLIB: FP: CREATE_QP1 timed out");
-                rc = -ETIMEDOUT;
-                goto fail;
-        }
-        if (resp->status ||
-            le16_to_cpu(resp->cookie) != le16_to_cpu(req.cookie)) {
-                dev_err(&rcfw->pdev->dev, "QPLIB: FP: CREATE_QP1 failed ");
-                dev_err(&rcfw->pdev->dev,
-                        "QPLIB: with status 0x%x cmdq 0x%x resp 0x%x",
-                        resp->status, le16_to_cpu(req.cookie),
-                        le16_to_cpu(resp->cookie));
-                rc = -EINVAL;
+        rc = bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
+                                          (void *)&resp, NULL, 0);
+        if (rc)
                 goto fail;
-        }
-        qp->id = le32_to_cpu(resp->xid);
+
+        qp->id = le32_to_cpu(resp.xid);
         qp->cur_qp_state = CMDQ_MODIFY_QP_NEW_STATE_RESET;
         sq->flush_in_progress = false;
         rq->flush_in_progress = false;
@@ -442,7 +423,7 @@ int bnxt_qplib_create_qp(struct bnxt_qplib_res *res, struct bnxt_qplib_qp *qp)
         struct bnxt_qplib_rcfw *rcfw = res->rcfw;
         struct sq_send *hw_sq_send_hdr, **hw_sq_send_ptr;
         struct cmdq_create_qp req;
-        struct creq_create_qp_resp *resp;
+        struct creq_create_qp_resp resp;
         struct bnxt_qplib_pbl *pbl;
         struct sq_psn_search **psn_search_ptr;
         unsigned long int psn_search, poff = 0;
@@ -627,31 +608,12 @@ int bnxt_qplib_create_qp(struct bnxt_qplib_res *res, struct bnxt_qplib_qp *qp)
         }
         req.pd_id = cpu_to_le32(qp->pd->id);
 
-        resp = (struct creq_create_qp_resp *)
-                        bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
-                                                     NULL, 0);
-        if (!resp) {
-                dev_err(&rcfw->pdev->dev, "QPLIB: FP: CREATE_QP send failed");
-                rc = -EINVAL;
-                goto fail;
-        }
-        if (!bnxt_qplib_rcfw_wait_for_resp(rcfw, le16_to_cpu(req.cookie))) {
-                /* Cmd timed out */
-                dev_err(&rcfw->pdev->dev, "QPLIB: FP: CREATE_QP timed out");
-                rc = -ETIMEDOUT;
-                goto fail;
-        }
-        if (resp->status ||
-            le16_to_cpu(resp->cookie) != le16_to_cpu(req.cookie)) {
-                dev_err(&rcfw->pdev->dev, "QPLIB: FP: CREATE_QP failed ");
-                dev_err(&rcfw->pdev->dev,
-                        "QPLIB: with status 0x%x cmdq 0x%x resp 0x%x",
-                        resp->status, le16_to_cpu(req.cookie),
-                        le16_to_cpu(resp->cookie));
-                rc = -EINVAL;
+        rc = bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
+                                          (void *)&resp, NULL, 0);
+        if (rc)
                 goto fail;
-        }
-        qp->id = le32_to_cpu(resp->xid);
+
+        qp->id = le32_to_cpu(resp.xid);
         qp->cur_qp_state = CMDQ_MODIFY_QP_NEW_STATE_RESET;
         sq->flush_in_progress = false;
         rq->flush_in_progress = false;
@@ -769,10 +731,11 @@ int bnxt_qplib_modify_qp(struct bnxt_qplib_res *res, struct bnxt_qplib_qp *qp)
 {
         struct bnxt_qplib_rcfw *rcfw = res->rcfw;
         struct cmdq_modify_qp req;
-        struct creq_modify_qp_resp *resp;
+        struct creq_modify_qp_resp resp;
         u16 cmd_flags = 0, pkey;
         u32 temp32[4];
         u32 bmask;
+        int rc;
 
         RCFW_CMD_PREP(req, MODIFY_QP, cmd_flags);
 
@@ -862,27 +825,10 @@ int bnxt_qplib_modify_qp(struct bnxt_qplib_res *res, struct bnxt_qplib_qp *qp)
 
         req.vlan_pcp_vlan_dei_vlan_id = cpu_to_le16(qp->vlan_id);
 
-        resp = (struct creq_modify_qp_resp *)
-                        bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
-                                                     NULL, 0);
-        if (!resp) {
-                dev_err(&rcfw->pdev->dev, "QPLIB: FP: MODIFY_QP send failed");
-                return -EINVAL;
-        }
-        if (!bnxt_qplib_rcfw_wait_for_resp(rcfw, le16_to_cpu(req.cookie))) {
-                /* Cmd timed out */
-                dev_err(&rcfw->pdev->dev, "QPLIB: FP: MODIFY_QP timed out");
-                return -ETIMEDOUT;
-        }
-        if (resp->status ||
-            le16_to_cpu(resp->cookie) != le16_to_cpu(req.cookie)) {
-                dev_err(&rcfw->pdev->dev, "QPLIB: FP: MODIFY_QP failed ");
-                dev_err(&rcfw->pdev->dev,
-                        "QPLIB: with status 0x%x cmdq 0x%x resp 0x%x",
-                        resp->status, le16_to_cpu(req.cookie),
-                        le16_to_cpu(resp->cookie));
-                return -EINVAL;
-        }
+        rc = bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
+                                          (void *)&resp, NULL, 0);
+        if (rc)
+                return rc;
         qp->cur_qp_state = qp->state;
         return 0;
 }
@@ -891,37 +837,26 @@ int bnxt_qplib_query_qp(struct bnxt_qplib_res *res, struct bnxt_qplib_qp *qp)
 {
         struct bnxt_qplib_rcfw *rcfw = res->rcfw;
         struct cmdq_query_qp req;
-        struct creq_query_qp_resp *resp;
+        struct creq_query_qp_resp resp;
+        struct bnxt_qplib_rcfw_sbuf *sbuf;
         struct creq_query_qp_resp_sb *sb;
         u16 cmd_flags = 0;
         u32 temp32[4];
-        int i;
+        int i, rc = 0;
 
         RCFW_CMD_PREP(req, QUERY_QP, cmd_flags);
 
+        sbuf = bnxt_qplib_rcfw_alloc_sbuf(rcfw, sizeof(*sb));
+        if (!sbuf)
+                return -ENOMEM;
+        sb = sbuf->sb;
+
         req.qp_cid = cpu_to_le32(qp->id);
         req.resp_size = sizeof(*sb) / BNXT_QPLIB_CMDQE_UNITS;
-        resp = (struct creq_query_qp_resp *)
-                        bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
-                                                     (void **)&sb, 0);
-        if (!resp) {
-                dev_err(&rcfw->pdev->dev, "QPLIB: FP: QUERY_QP send failed");
-                return -EINVAL;
-        }
-        if (!bnxt_qplib_rcfw_wait_for_resp(rcfw, le16_to_cpu(req.cookie))) {
-                /* Cmd timed out */
-                dev_err(&rcfw->pdev->dev, "QPLIB: FP: QUERY_QP timed out");
-                return -ETIMEDOUT;
-        }
-        if (resp->status ||
-            le16_to_cpu(resp->cookie) != le16_to_cpu(req.cookie)) {
-                dev_err(&rcfw->pdev->dev, "QPLIB: FP: QUERY_QP failed ");
-                dev_err(&rcfw->pdev->dev,
-                        "QPLIB: with status 0x%x cmdq 0x%x resp 0x%x",
-                        resp->status, le16_to_cpu(req.cookie),
-                        le16_to_cpu(resp->cookie));
-                return -EINVAL;
-        }
+        rc = bnxt_qplib_rcfw_send_message(rcfw, (void *)&req, (void *)&resp,
+                                          (void *)sbuf, 0);
+        if (rc)
+                goto bail;
         /* Extract the context from the side buffer */
         qp->state = sb->en_sqd_async_notify_state &
                         CREQ_QUERY_QP_RESP_SB_STATE_MASK;
@@ -976,7 +911,9 @@ int bnxt_qplib_query_qp(struct bnxt_qplib_res *res, struct bnxt_qplib_qp *qp)
         qp->dest_qpn = le32_to_cpu(sb->dest_qp_id);
         memcpy(qp->smac, sb->src_mac, 6);
         qp->vlan_id = le16_to_cpu(sb->vlan_pcp_vlan_dei_vlan_id);
-        return 0;
+bail:
+        bnxt_qplib_rcfw_free_sbuf(rcfw, sbuf);
+        return rc;
 }
 
 static void __clean_cq(struct bnxt_qplib_cq *cq, u64 qp)
@@ -1021,34 +958,18 @@ int bnxt_qplib_destroy_qp(struct bnxt_qplib_res *res,
 {
         struct bnxt_qplib_rcfw *rcfw = res->rcfw;
         struct cmdq_destroy_qp req;
-        struct creq_destroy_qp_resp *resp;
+        struct creq_destroy_qp_resp resp;
         unsigned long flags;
         u16 cmd_flags = 0;
+        int rc;
 
         RCFW_CMD_PREP(req, DESTROY_QP, cmd_flags);
 
         req.qp_cid = cpu_to_le32(qp->id);
-        resp = (struct creq_destroy_qp_resp *)
-                        bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
-                                                     NULL, 0);
-        if (!resp) {
-                dev_err(&rcfw->pdev->dev, "QPLIB: FP: DESTROY_QP send failed");
-                return -EINVAL;
-        }
-        if (!bnxt_qplib_rcfw_wait_for_resp(rcfw, le16_to_cpu(req.cookie))) {
-                /* Cmd timed out */
-                dev_err(&rcfw->pdev->dev, "QPLIB: FP: DESTROY_QP timed out");
-                return -ETIMEDOUT;
-        }
-        if (resp->status ||
-            le16_to_cpu(resp->cookie) != le16_to_cpu(req.cookie)) {
-                dev_err(&rcfw->pdev->dev, "QPLIB: FP: DESTROY_QP failed ");
-                dev_err(&rcfw->pdev->dev,
-                        "QPLIB: with status 0x%x cmdq 0x%x resp 0x%x",
-                        resp->status, le16_to_cpu(req.cookie),
-                        le16_to_cpu(resp->cookie));
-                return -EINVAL;
-        }
+        rc = bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
+                                          (void *)&resp, NULL, 0);
+        if (rc)
+                return rc;
 
         /* Must walk the associated CQs to nullified the QP ptr */
         spin_lock_irqsave(&qp->scq->hwq.lock, flags);
@@ -1162,8 +1083,12 @@ int bnxt_qplib_post_send(struct bnxt_qplib_qp *qp,
                 rc = -EINVAL;
                 goto done;
         }
-        if (HWQ_CMP((sq->hwq.prod + 1), &sq->hwq) ==
-            HWQ_CMP(sq->hwq.cons, &sq->hwq)) {
+
+        if (bnxt_qplib_queue_full(sq)) {
+                dev_err(&sq->hwq.pdev->dev,
+                        "QPLIB: prod = %#x cons = %#x qdepth = %#x delta = %#x",
+                        sq->hwq.prod, sq->hwq.cons, sq->hwq.max_elements,
+                        sq->q_full_delta);
                 rc = -ENOMEM;
                 goto done;
         }
@@ -1373,6 +1298,9 @@ int bnxt_qplib_post_send(struct bnxt_qplib_qp *qp,
         }
 
         sq->hwq.prod++;
+
+        qp->wqe_cnt++;
+
 done:
         return rc;
 }
@@ -1411,8 +1339,7 @@ int bnxt_qplib_post_recv(struct bnxt_qplib_qp *qp,
                 rc = -EINVAL;
                 goto done;
         }
-        if (HWQ_CMP((rq->hwq.prod + 1), &rq->hwq) ==
-            HWQ_CMP(rq->hwq.cons, &rq->hwq)) {
+        if (bnxt_qplib_queue_full(rq)) {
                 dev_err(&rq->hwq.pdev->dev,
                         "QPLIB: FP: QP (0x%x) RQ is full!", qp->id);
                 rc = -EINVAL;
@@ -1483,7 +1410,7 @@ int bnxt_qplib_create_cq(struct bnxt_qplib_res *res, struct bnxt_qplib_cq *cq)
 {
         struct bnxt_qplib_rcfw *rcfw = res->rcfw;
         struct cmdq_create_cq req;
-        struct creq_create_cq_resp *resp;
+        struct creq_create_cq_resp resp;
         struct bnxt_qplib_pbl *pbl;
         u16 cmd_flags = 0;
         int rc;
@@ -1525,30 +1452,12 @@ int bnxt_qplib_create_cq(struct bnxt_qplib_res *res, struct bnxt_qplib_cq *cq)
                         (cq->cnq_hw_ring_id & CMDQ_CREATE_CQ_CNQ_ID_MASK) <<
                          CMDQ_CREATE_CQ_CNQ_ID_SFT);
 
-        resp = (struct creq_create_cq_resp *)
-                        bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
-                                                     NULL, 0);
-        if (!resp) {
-                dev_err(&rcfw->pdev->dev, "QPLIB: FP: CREATE_CQ send failed");
-                return -EINVAL;
-        }
-        if (!bnxt_qplib_rcfw_wait_for_resp(rcfw, le16_to_cpu(req.cookie))) {
-                /* Cmd timed out */
-                dev_err(&rcfw->pdev->dev, "QPLIB: FP: CREATE_CQ timed out");
-                rc = -ETIMEDOUT;
-                goto fail;
-        }
-        if (resp->status ||
-            le16_to_cpu(resp->cookie) != le16_to_cpu(req.cookie)) {
-                dev_err(&rcfw->pdev->dev, "QPLIB: FP: CREATE_CQ failed ");
-                dev_err(&rcfw->pdev->dev,
-                        "QPLIB: with status 0x%x cmdq 0x%x resp 0x%x",
-                        resp->status, le16_to_cpu(req.cookie),
-                        le16_to_cpu(resp->cookie));
-                rc = -EINVAL;
+        rc = bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
+                                          (void *)&resp, NULL, 0);
+        if (rc)
                 goto fail;
-        }
-        cq->id = le32_to_cpu(resp->xid);
+
+        cq->id = le32_to_cpu(resp.xid);
         cq->dbr_base = res->dpi_tbl.dbr_bar_reg_iomem;
         cq->period = BNXT_QPLIB_QUEUE_START_PERIOD;
         init_waitqueue_head(&cq->waitq);
@@ -1566,33 +1475,17 @@ int bnxt_qplib_destroy_cq(struct bnxt_qplib_res *res, struct bnxt_qplib_cq *cq)
 {
         struct bnxt_qplib_rcfw *rcfw = res->rcfw;
         struct cmdq_destroy_cq req;
-        struct creq_destroy_cq_resp *resp;
+        struct creq_destroy_cq_resp resp;
         u16 cmd_flags = 0;
+        int rc;
 
         RCFW_CMD_PREP(req, DESTROY_CQ, cmd_flags);
 
         req.cq_cid = cpu_to_le32(cq->id);
-        resp = (struct creq_destroy_cq_resp *)
-                        bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
-                                                     NULL, 0);
-        if (!resp) {
-                dev_err(&rcfw->pdev->dev, "QPLIB: FP: DESTROY_CQ send failed");
-                return -EINVAL;
-        }
-        if (!bnxt_qplib_rcfw_wait_for_resp(rcfw, le16_to_cpu(req.cookie))) {
-                /* Cmd timed out */
-                dev_err(&rcfw->pdev->dev, "QPLIB: FP: DESTROY_CQ timed out");
-                return -ETIMEDOUT;
-        }
-        if (resp->status ||
-            le16_to_cpu(resp->cookie) != le16_to_cpu(req.cookie)) {
-                dev_err(&rcfw->pdev->dev, "QPLIB: FP: DESTROY_CQ failed ");
-                dev_err(&rcfw->pdev->dev,
-                        "QPLIB: with status 0x%x cmdq 0x%x resp 0x%x",
-                        resp->status, le16_to_cpu(req.cookie),
-                        le16_to_cpu(resp->cookie));
-                return -EINVAL;
-        }
+        rc = bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
+                                          (void *)&resp, NULL, 0);
+        if (rc)
+                return rc;
         bnxt_qplib_free_hwq(res->pdev, &cq->hwq);
         return 0;
 }
@@ -1664,14 +1557,113 @@ static int __flush_rq(struct bnxt_qplib_q *rq, struct bnxt_qplib_qp *qp,
         return rc;
 }
 
+/* Note: SQE is valid from sw_sq_cons up to cqe_sq_cons (exclusive)
+ *       CQE is track from sw_cq_cons to max_element but valid only if VALID=1
+ */
+static int do_wa9060(struct bnxt_qplib_qp *qp, struct bnxt_qplib_cq *cq,
+                     u32 cq_cons, u32 sw_sq_cons, u32 cqe_sq_cons)
+{
+        struct bnxt_qplib_q *sq = &qp->sq;
+        struct bnxt_qplib_swq *swq;
+        u32 peek_sw_cq_cons, peek_raw_cq_cons, peek_sq_cons_idx;
+        struct cq_base *peek_hwcqe, **peek_hw_cqe_ptr;
+        struct cq_req *peek_req_hwcqe;
+        struct bnxt_qplib_qp *peek_qp;
+        struct bnxt_qplib_q *peek_sq;
+        int i, rc = 0;
+
+        /* Normal mode */
+        /* Check for the psn_search marking before completing */
+        swq = &sq->swq[sw_sq_cons];
+        if (swq->psn_search &&
+            le32_to_cpu(swq->psn_search->flags_next_psn) & 0x80000000) {
+                /* Unmark */
+                swq->psn_search->flags_next_psn = cpu_to_le32
+                        (le32_to_cpu(swq->psn_search->flags_next_psn)
+                                     & ~0x80000000);
+                dev_dbg(&cq->hwq.pdev->dev,
+                        "FP: Process Req cq_cons=0x%x qp=0x%x sq cons sw=0x%x cqe=0x%x marked!\n",
+                        cq_cons, qp->id, sw_sq_cons, cqe_sq_cons);
+                sq->condition = true;
+                sq->send_phantom = true;
+
+                /* TODO: Only ARM if the previous SQE is ARMALL */
+                bnxt_qplib_arm_cq(cq, DBR_DBR_TYPE_CQ_ARMALL);
+
+                rc = -EAGAIN;
+                goto out;
+        }
+        if (sq->condition) {
+                /* Peek at the completions */
+                peek_raw_cq_cons = cq->hwq.cons;
+                peek_sw_cq_cons = cq_cons;
+                i = cq->hwq.max_elements;
+                while (i--) {
+                        peek_sw_cq_cons = HWQ_CMP((peek_sw_cq_cons), &cq->hwq);
+                        peek_hw_cqe_ptr = (struct cq_base **)cq->hwq.pbl_ptr;
+                        peek_hwcqe = &peek_hw_cqe_ptr[CQE_PG(peek_sw_cq_cons)]
+                                                     [CQE_IDX(peek_sw_cq_cons)];
+                        /* If the next hwcqe is VALID */
+                        if (CQE_CMP_VALID(peek_hwcqe, peek_raw_cq_cons,
+                                          cq->hwq.max_elements)) {
+                                /* If the next hwcqe is a REQ */
+                                if ((peek_hwcqe->cqe_type_toggle &
+                                    CQ_BASE_CQE_TYPE_MASK) ==
+                                    CQ_BASE_CQE_TYPE_REQ) {
+                                        peek_req_hwcqe = (struct cq_req *)
+                                                         peek_hwcqe;
+                                        peek_qp = (struct bnxt_qplib_qp *)
+                                                ((unsigned long)
+                                                 le64_to_cpu
+                                                 (peek_req_hwcqe->qp_handle));
+                                        peek_sq = &peek_qp->sq;
+                                        peek_sq_cons_idx = HWQ_CMP(le16_to_cpu(
+                                                peek_req_hwcqe->sq_cons_idx) - 1
+                                                , &sq->hwq);
+                                        /* If the hwcqe's sq's wr_id matches */
+                                        if (peek_sq == sq &&
+                                            sq->swq[peek_sq_cons_idx].wr_id ==
+                                            BNXT_QPLIB_FENCE_WRID) {
+                                                /*
+                                                 *  Unbreak only if the phantom
+                                                 *  comes back
+                                                 */
+                                                dev_dbg(&cq->hwq.pdev->dev,
+                                                        "FP:Got Phantom CQE");
+                                                sq->condition = false;
+                                                sq->single = true;
+                                                rc = 0;
+                                                goto out;
+                                        }
+                                }
+                                /* Valid but not the phantom, so keep looping */
+                        } else {
+                                /* Not valid yet, just exit and wait */
+                                rc = -EINVAL;
+                                goto out;
+                        }
+                        peek_sw_cq_cons++;
+                        peek_raw_cq_cons++;
+                }
+                dev_err(&cq->hwq.pdev->dev,
+                        "Should not have come here! cq_cons=0x%x qp=0x%x sq cons sw=0x%x hw=0x%x",
+                        cq_cons, qp->id, sw_sq_cons, cqe_sq_cons);
+                rc = -EINVAL;
+        }
+out:
+        return rc;
+}
+
 static int bnxt_qplib_cq_process_req(struct bnxt_qplib_cq *cq,
                                      struct cq_req *hwcqe,
-                                     struct bnxt_qplib_cqe **pcqe, int *budget)
+                                     struct bnxt_qplib_cqe **pcqe, int *budget,
+                                     u32 cq_cons, struct bnxt_qplib_qp **lib_qp)
 {
         struct bnxt_qplib_qp *qp;
         struct bnxt_qplib_q *sq;
         struct bnxt_qplib_cqe *cqe;
-        u32 sw_cons, cqe_cons;
+        u32 sw_sq_cons, cqe_sq_cons;
+        struct bnxt_qplib_swq *swq;
         int rc = 0;
 
         qp = (struct bnxt_qplib_qp *)((unsigned long)
@@ -1683,13 +1675,13 @@ static int bnxt_qplib_cq_process_req(struct bnxt_qplib_cq *cq,
         }
         sq = &qp->sq;
 
-        cqe_cons = HWQ_CMP(le16_to_cpu(hwcqe->sq_cons_idx), &sq->hwq);
-        if (cqe_cons > sq->hwq.max_elements) {
+        cqe_sq_cons = HWQ_CMP(le16_to_cpu(hwcqe->sq_cons_idx), &sq->hwq);
+        if (cqe_sq_cons > sq->hwq.max_elements) {
                 dev_err(&cq->hwq.pdev->dev,
                         "QPLIB: FP: CQ Process req reported ");
                 dev_err(&cq->hwq.pdev->dev,
                         "QPLIB: sq_cons_idx 0x%x which exceeded max 0x%x",
-                        cqe_cons, sq->hwq.max_elements);
+                        cqe_sq_cons, sq->hwq.max_elements);
                 return -EINVAL;
         }
         /* If we were in the middle of flushing the SQ, continue */
@@ -1698,53 +1690,74 @@ static int bnxt_qplib_cq_process_req(struct bnxt_qplib_cq *cq,
 
         /* Require to walk the sq's swq to fabricate CQEs for all previously
          * signaled SWQEs due to CQE aggregation from the current sq cons
-         * to the cqe_cons
+         * to the cqe_sq_cons
          */
         cqe = *pcqe;
         while (*budget) {
-                sw_cons = HWQ_CMP(sq->hwq.cons, &sq->hwq);
-                if (sw_cons == cqe_cons)
+                sw_sq_cons = HWQ_CMP(sq->hwq.cons, &sq->hwq);
+                if (sw_sq_cons == cqe_sq_cons)
+                        /* Done */
                         break;
+
+                swq = &sq->swq[sw_sq_cons];
                 memset(cqe, 0, sizeof(*cqe));
                 cqe->opcode = CQ_BASE_CQE_TYPE_REQ;
                 cqe->qp_handle = (u64)(unsigned long)qp;
                 cqe->src_qp = qp->id;
-                cqe->wr_id = sq->swq[sw_cons].wr_id;
-                cqe->type = sq->swq[sw_cons].type;
+                cqe->wr_id = swq->wr_id;
+                if (cqe->wr_id == BNXT_QPLIB_FENCE_WRID)
+                        goto skip;
+                cqe->type = swq->type;
 
                 /* For the last CQE, check for status.  For errors, regardless
                  * of the request being signaled or not, it must complete with
                  * the hwcqe error status
                  */
-                if (HWQ_CMP((sw_cons + 1), &sq->hwq) == cqe_cons &&
+                if (HWQ_CMP((sw_sq_cons + 1), &sq->hwq) == cqe_sq_cons &&
                     hwcqe->status != CQ_REQ_STATUS_OK) {
                         cqe->status = hwcqe->status;
                         dev_err(&cq->hwq.pdev->dev,
                                 "QPLIB: FP: CQ Processed Req ");
                         dev_err(&cq->hwq.pdev->dev,
                                 "QPLIB: wr_id[%d] = 0x%llx with status 0x%x",
-                                sw_cons, cqe->wr_id, cqe->status);
+                                sw_sq_cons, cqe->wr_id, cqe->status);
                         cqe++;
                         (*budget)--;
                         sq->flush_in_progress = true;
                         /* Must block new posting of SQ and RQ */
                         qp->state = CMDQ_MODIFY_QP_NEW_STATE_ERR;
+                        sq->condition = false;
+                        sq->single = false;
                 } else {
-                        if (sq->swq[sw_cons].flags &
-                            SQ_SEND_FLAGS_SIGNAL_COMP) {
+                        if (swq->flags & SQ_SEND_FLAGS_SIGNAL_COMP) {
+                                /* Before we complete, do WA 9060 */
+                                if (do_wa9060(qp, cq, cq_cons, sw_sq_cons,
+                                              cqe_sq_cons)) {
+                                        *lib_qp = qp;
+                                        goto out;
+                                }
                                 cqe->status = CQ_REQ_STATUS_OK;
                                 cqe++;
                                 (*budget)--;
                         }
                 }
+skip:
                 sq->hwq.cons++;
+                if (sq->single)
+                        break;
         }
+out:
         *pcqe = cqe;
-        if (!*budget && HWQ_CMP(sq->hwq.cons, &sq->hwq) != cqe_cons) {
+        if (HWQ_CMP(sq->hwq.cons, &sq->hwq) != cqe_sq_cons) {
                 /* Out of budget */
                 rc = -EAGAIN;
                 goto done;
         }
+        /*
+         * Back to normal completion mode only after it has completed all of
+         * the WC for this CQE
+         */
+        sq->single = false;
         if (!sq->flush_in_progress)
                 goto done;
 flush:
@@ -2074,7 +2087,7 @@ static int bnxt_qplib_cq_process_cutoff(struct bnxt_qplib_cq *cq,
 }
 
 int bnxt_qplib_poll_cq(struct bnxt_qplib_cq *cq, struct bnxt_qplib_cqe *cqe,
-                       int num_cqes)
+                       int num_cqes, struct bnxt_qplib_qp **lib_qp)
 {
         struct cq_base *hw_cqe, **hw_cqe_ptr;
         unsigned long flags;
@@ -2099,7 +2112,8 @@ int bnxt_qplib_poll_cq(struct bnxt_qplib_cq *cq, struct bnxt_qplib_cqe *cqe,
                 case CQ_BASE_CQE_TYPE_REQ:
                         rc = bnxt_qplib_cq_process_req(cq,
                                                        (struct cq_req *)hw_cqe,
-                                                       &cqe, &budget);
+                                                       &cqe, &budget,
+                                                       sw_cons, lib_qp);
                         break;
                 case CQ_BASE_CQE_TYPE_RES_RC:
                         rc = bnxt_qplib_cq_process_res_rc(cq,
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.h b/drivers/infiniband/hw/bnxt_re/qplib_fp.h
index f0150f8da1e3..36b7b7db0e3f 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.h
+++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.h
@@ -88,6 +88,7 @@ struct bnxt_qplib_swq {
 
 struct bnxt_qplib_swqe {
         /* General */
+#define BNXT_QPLIB_FENCE_WRID   0x46454E43      /* "FENC" */
         u64                             wr_id;
         u8                              reqs_type;
         u8                              type;
@@ -216,9 +217,16 @@ struct bnxt_qplib_q {
         struct scatterlist              *sglist;
         u32                             nmap;
         u32                             max_wqe;
+        u16                             q_full_delta;
         u16                             max_sge;
         u32                             psn;
         bool                            flush_in_progress;
+        bool                            condition;
+        bool                            single;
+        bool                            send_phantom;
+        u32                             phantom_wqe_cnt;
+        u32                             phantom_cqe_cnt;
+        u32                             next_cq_cons;
 };
 
 struct bnxt_qplib_qp {
@@ -242,6 +250,7 @@ struct bnxt_qplib_qp {
         u8                              timeout;
         u8                              retry_cnt;
         u8                              rnr_retry;
+        u64                             wqe_cnt;
         u32                             min_rnr_timer;
         u32                             max_rd_atomic;
         u32                             max_dest_rd_atomic;
@@ -301,6 +310,13 @@ struct bnxt_qplib_qp {
         (!!((hdr)->cqe_type_toggle & CQ_BASE_TOGGLE) ==         \
            !((raw_cons) & (cp_bit)))
 
+static inline bool bnxt_qplib_queue_full(struct bnxt_qplib_q *qplib_q)
+{
+        return HWQ_CMP((qplib_q->hwq.prod + qplib_q->q_full_delta),
+                       &qplib_q->hwq) == HWQ_CMP(qplib_q->hwq.cons,
+                                                 &qplib_q->hwq);
+}
+
 struct bnxt_qplib_cqe {
         u8                              status;
         u8                              type;
@@ -432,7 +448,7 @@ int bnxt_qplib_post_recv(struct bnxt_qplib_qp *qp,
 int bnxt_qplib_create_cq(struct bnxt_qplib_res *res, struct bnxt_qplib_cq *cq);
 int bnxt_qplib_destroy_cq(struct bnxt_qplib_res *res, struct bnxt_qplib_cq *cq);
 int bnxt_qplib_poll_cq(struct bnxt_qplib_cq *cq, struct bnxt_qplib_cqe *cqe,
-                       int num);
+                       int num, struct bnxt_qplib_qp **qp);
 void bnxt_qplib_req_notify_cq(struct bnxt_qplib_cq *cq, u32 arm_type);
 void bnxt_qplib_free_nq(struct bnxt_qplib_nq *nq);
 int bnxt_qplib_alloc_nq(struct pci_dev *pdev, struct bnxt_qplib_nq *nq);
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
index 23fb7260662b..16e42754dbec 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
+++ b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
@@ -39,72 +39,55 @@
 #include <linux/spinlock.h>
 #include <linux/pci.h>
 #include <linux/prefetch.h>
+#include <linux/delay.h>
+
 #include "roce_hsi.h"
 #include "qplib_res.h"
 #include "qplib_rcfw.h"
 static void bnxt_qplib_service_creq(unsigned long data);
 
 /* Hardware communication channel */
-int bnxt_qplib_rcfw_wait_for_resp(struct bnxt_qplib_rcfw *rcfw, u16 cookie)
+static int __wait_for_resp(struct bnxt_qplib_rcfw *rcfw, u16 cookie)
 {
         u16 cbit;
         int rc;
 
-        cookie &= RCFW_MAX_COOKIE_VALUE;
         cbit = cookie % RCFW_MAX_OUTSTANDING_CMD;
-        if (!test_bit(cbit, rcfw->cmdq_bitmap))
-                dev_warn(&rcfw->pdev->dev,
-                         "QPLIB: CMD bit %d for cookie 0x%x is not set?",
-                         cbit, cookie);
-
         rc = wait_event_timeout(rcfw->waitq,
                                 !test_bit(cbit, rcfw->cmdq_bitmap),
                                 msecs_to_jiffies(RCFW_CMD_WAIT_TIME_MS));
-        if (!rc) {
-                dev_warn(&rcfw->pdev->dev,
-                         "QPLIB: Bono Error: timeout %d msec, msg {0x%x}\n",
-                         RCFW_CMD_WAIT_TIME_MS, cookie);
-        }
-
-        return rc;
+        return rc ? 0 : -ETIMEDOUT;
 };
 
-int bnxt_qplib_rcfw_block_for_resp(struct bnxt_qplib_rcfw *rcfw, u16 cookie)
+static int __block_for_resp(struct bnxt_qplib_rcfw *rcfw, u16 cookie)
 {
-        u32 count = -1;
+        u32 count = RCFW_BLOCKED_CMD_WAIT_COUNT;
         u16 cbit;
 
-        cookie &= RCFW_MAX_COOKIE_VALUE;
         cbit = cookie % RCFW_MAX_OUTSTANDING_CMD;
         if (!test_bit(cbit, rcfw->cmdq_bitmap))
                 goto done;
         do {
+                mdelay(1); /* 1m sec */
                 bnxt_qplib_service_creq((unsigned long)rcfw);
         } while (test_bit(cbit, rcfw->cmdq_bitmap) && --count);
 done:
-        return count;
+        return count ? 0 : -ETIMEDOUT;
 };
 
-void *bnxt_qplib_rcfw_send_message(struct bnxt_qplib_rcfw *rcfw,
-                                   struct cmdq_base *req, void **crsbe,
-                                   u8 is_block)
+static int __send_message(struct bnxt_qplib_rcfw *rcfw, struct cmdq_base *req,
+                          struct creq_base *resp, void *sb, u8 is_block)
 {
-        struct bnxt_qplib_crsq *crsq = &rcfw->crsq;
         struct bnxt_qplib_cmdqe *cmdqe, **cmdq_ptr;
         struct bnxt_qplib_hwq *cmdq = &rcfw->cmdq;
-        struct bnxt_qplib_hwq *crsb = &rcfw->crsb;
-        struct bnxt_qplib_crsqe *crsqe = NULL;
-        struct bnxt_qplib_crsbe **crsb_ptr;
+        struct bnxt_qplib_crsq *crsqe;
         u32 sw_prod, cmdq_prod;
-        u8 retry_cnt = 0xFF;
-        dma_addr_t dma_addr;
         unsigned long flags;
         u32 size, opcode;
         u16 cookie, cbit;
         int pg, idx;
         u8 *preq;
 
-retry:
         opcode = req->opcode;
         if (!test_bit(FIRMWARE_INITIALIZED_FLAG, &rcfw->flags) &&
             (opcode != CMDQ_BASE_OPCODE_QUERY_FUNC &&
@@ -112,63 +95,50 @@ retry:
                 dev_err(&rcfw->pdev->dev,
                         "QPLIB: RCFW not initialized, reject opcode 0x%x",
                         opcode);
-                return NULL;
+                return -EINVAL;
         }
 
         if (test_bit(FIRMWARE_INITIALIZED_FLAG, &rcfw->flags) &&
             opcode == CMDQ_BASE_OPCODE_INITIALIZE_FW) {
                 dev_err(&rcfw->pdev->dev, "QPLIB: RCFW already initialized!");
-                return NULL;
+                return -EINVAL;
         }
 
         /* Cmdq are in 16-byte units, each request can consume 1 or more
          * cmdqe
          */
         spin_lock_irqsave(&cmdq->lock, flags);
-        if (req->cmd_size > cmdq->max_elements -
-            ((HWQ_CMP(cmdq->prod, cmdq) - HWQ_CMP(cmdq->cons, cmdq)) &
-             (cmdq->max_elements - 1))) {
+        if (req->cmd_size >= HWQ_FREE_SLOTS(cmdq)) {
                 dev_err(&rcfw->pdev->dev, "QPLIB: RCFW: CMDQ is full!");
                 spin_unlock_irqrestore(&cmdq->lock, flags);
-
-                if (!retry_cnt--)
-                        return NULL;
-                goto retry;
+                return -EAGAIN;
         }
 
-        retry_cnt = 0xFF;
 
-        cookie = atomic_inc_return(&rcfw->seq_num) & RCFW_MAX_COOKIE_VALUE;
+        cookie = rcfw->seq_num & RCFW_MAX_COOKIE_VALUE;
         cbit = cookie % RCFW_MAX_OUTSTANDING_CMD;
         if (is_block)
                 cookie |= RCFW_CMD_IS_BLOCKING;
+
+        set_bit(cbit, rcfw->cmdq_bitmap);
         req->cookie = cpu_to_le16(cookie);
-        if (test_and_set_bit(cbit, rcfw->cmdq_bitmap)) {
-                dev_err(&rcfw->pdev->dev,
-                        "QPLIB: RCFW MAX outstanding cmd reached!");
-                atomic_dec(&rcfw->seq_num);
+        crsqe = &rcfw->crsqe_tbl[cbit];
+        if (crsqe->resp) {
                 spin_unlock_irqrestore(&cmdq->lock, flags);
-
-                if (!retry_cnt--)
-                        return NULL;
-                goto retry;
+                return -EBUSY;
         }
-        /* Reserve a resp buffer slot if requested */
-        if (req->resp_size && crsbe) {
-                spin_lock(&crsb->lock);
-                sw_prod = HWQ_CMP(crsb->prod, crsb);
-                crsb_ptr = (struct bnxt_qplib_crsbe **)crsb->pbl_ptr;
-                *crsbe = (void *)&crsb_ptr[get_crsb_pg(sw_prod)]
-                                          [get_crsb_idx(sw_prod)];
-                bnxt_qplib_crsb_dma_next(crsb->pbl_dma_ptr, sw_prod, &dma_addr);
-                req->resp_addr = cpu_to_le64(dma_addr);
-                crsb->prod++;
-                spin_unlock(&crsb->lock);
-
-                req->resp_size = (sizeof(struct bnxt_qplib_crsbe) +
-                                  BNXT_QPLIB_CMDQE_UNITS - 1) /
-                                 BNXT_QPLIB_CMDQE_UNITS;
+        memset(resp, 0, sizeof(*resp));
+        crsqe->resp = (struct creq_qp_event *)resp;
+        crsqe->resp->cookie = req->cookie;
+        crsqe->req_size = req->cmd_size;
+        if (req->resp_size && sb) {
+                struct bnxt_qplib_rcfw_sbuf *sbuf = sb;
+
+                req->resp_addr = cpu_to_le64(sbuf->dma_addr);
+                req->resp_size = (sbuf->size + BNXT_QPLIB_CMDQE_UNITS - 1) /
+                                  BNXT_QPLIB_CMDQE_UNITS;
         }
+
         cmdq_ptr = (struct bnxt_qplib_cmdqe **)cmdq->pbl_ptr;
         preq = (u8 *)req;
         size = req->cmd_size * BNXT_QPLIB_CMDQE_UNITS;
@@ -190,23 +160,24 @@ retry:
                 preq += min_t(u32, size, sizeof(*cmdqe));
                 size -= min_t(u32, size, sizeof(*cmdqe));
                 cmdq->prod++;
+                rcfw->seq_num++;
         } while (size > 0);
 
+        rcfw->seq_num++;
+
         cmdq_prod = cmdq->prod;
         if (rcfw->flags & FIRMWARE_FIRST_FLAG) {
-                /* The very first doorbell write is required to set this flag
-                 * which prompts the FW to reset its internal pointers
+                /* The very first doorbell write
+                 * is required to set this flag
+                 * which prompts the FW to reset
+                 * its internal pointers
                  */
                 cmdq_prod |= FIRMWARE_FIRST_FLAG;
                 rcfw->flags &= ~FIRMWARE_FIRST_FLAG;
         }
-        sw_prod = HWQ_CMP(crsq->prod, crsq);
-        crsqe = &crsq->crsq[sw_prod];
-        memset(crsqe, 0, sizeof(*crsqe));
-        crsq->prod++;
-        crsqe->req_size = req->cmd_size;
 
         /* ring CMDQ DB */
+        wmb();
         writel(cmdq_prod, rcfw->cmdq_bar_reg_iomem +
                rcfw->cmdq_bar_reg_prod_off);
         writel(RCFW_CMDQ_TRIG_VAL, rcfw->cmdq_bar_reg_iomem +
@@ -214,9 +185,56 @@ retry:
 done:
         spin_unlock_irqrestore(&cmdq->lock, flags);
         /* Return the CREQ response pointer */
-        return crsqe ? &crsqe->qp_event : NULL;
+        return 0;
 }
 
+int bnxt_qplib_rcfw_send_message(struct bnxt_qplib_rcfw *rcfw,
+                                 struct cmdq_base *req,
+                                 struct creq_base *resp,
+                                 void *sb, u8 is_block)
+{
+        struct creq_qp_event *evnt = (struct creq_qp_event *)resp;
+        u16 cookie;
+        u8 opcode, retry_cnt = 0xFF;
+        int rc = 0;
+
+        do {
+                opcode = req->opcode;
+                rc = __send_message(rcfw, req, resp, sb, is_block);
+                cookie = le16_to_cpu(req->cookie) & RCFW_MAX_COOKIE_VALUE;
+                if (!rc)
+                        break;
+
+                if (!retry_cnt || (rc != -EAGAIN && rc != -EBUSY)) {
+                        /* send failed */
+                        dev_err(&rcfw->pdev->dev, "QPLIB: cmdq[%#x]=%#x send failed",
+                                cookie, opcode);
+                        return rc;
+                }
+                is_block ? mdelay(1) : usleep_range(500, 1000);
+
+        } while (retry_cnt--);
+
+        if (is_block)
+                rc = __block_for_resp(rcfw, cookie);
+        else
+                rc = __wait_for_resp(rcfw, cookie);
+        if (rc) {
+                /* timed out */
+                dev_err(&rcfw->pdev->dev, "QPLIB: cmdq[%#x]=%#x timedout (%d)msec",
+                        cookie, opcode, RCFW_CMD_WAIT_TIME_MS);
+                return rc;
+        }
+
+        if (evnt->status) {
+                /* failed with status */
+                dev_err(&rcfw->pdev->dev, "QPLIB: cmdq[%#x]=%#x status %#x",
+                        cookie, opcode, evnt->status);
+                rc = -EFAULT;
+        }
+
+        return rc;
+}
 /* Completions */
 static int bnxt_qplib_process_func_event(struct bnxt_qplib_rcfw *rcfw,
                                          struct creq_func_event *func_event)
@@ -260,12 +278,12 @@ static int bnxt_qplib_process_func_event(struct bnxt_qplib_rcfw *rcfw,
 static int bnxt_qplib_process_qp_event(struct bnxt_qplib_rcfw *rcfw,
                                        struct creq_qp_event *qp_event)
 {
-        struct bnxt_qplib_crsq *crsq = &rcfw->crsq;
         struct bnxt_qplib_hwq *cmdq = &rcfw->cmdq;
-        struct bnxt_qplib_crsqe *crsqe;
-        u16 cbit, cookie, blocked = 0;
+        struct bnxt_qplib_crsq *crsqe;
         unsigned long flags;
-        u32 sw_cons;
+        u16 cbit, blocked = 0;
+        u16 cookie;
+        __le16  mcookie;
 
         switch (qp_event->event) {
         case CREQ_QP_EVENT_EVENT_QP_ERROR_NOTIFICATION:
@@ -275,24 +293,31 @@ static int bnxt_qplib_process_qp_event(struct bnxt_qplib_rcfw *rcfw,
         default:
                 /* Command Response */
                 spin_lock_irqsave(&cmdq->lock, flags);
-                sw_cons = HWQ_CMP(crsq->cons, crsq);
-                crsqe = &crsq->crsq[sw_cons];
-                crsq->cons++;
-                memcpy(&crsqe->qp_event, qp_event, sizeof(crsqe->qp_event));
-
-                cookie = le16_to_cpu(crsqe->qp_event.cookie);
+                cookie = le16_to_cpu(qp_event->cookie);
+                mcookie = qp_event->cookie;
                 blocked = cookie & RCFW_CMD_IS_BLOCKING;
                 cookie &= RCFW_MAX_COOKIE_VALUE;
                 cbit = cookie % RCFW_MAX_OUTSTANDING_CMD;
+                crsqe = &rcfw->crsqe_tbl[cbit];
+                if (crsqe->resp &&
+                    crsqe->resp->cookie  == mcookie) {
+                        memcpy(crsqe->resp, qp_event, sizeof(*qp_event));
+                        crsqe->resp = NULL;
+                } else {
+                        dev_err(&rcfw->pdev->dev,
+                                "QPLIB: CMD %s resp->cookie = %#x, evnt->cookie = %#x",
+                                crsqe->resp ? "mismatch" : "collision",
+                                crsqe->resp ? crsqe->resp->cookie : 0, mcookie);
+                }
                 if (!test_and_clear_bit(cbit, rcfw->cmdq_bitmap))
                         dev_warn(&rcfw->pdev->dev,
                                  "QPLIB: CMD bit %d was not requested", cbit);
-
                 cmdq->cons += crsqe->req_size;
-                spin_unlock_irqrestore(&cmdq->lock, flags);
+                crsqe->req_size = 0;
+
                 if (!blocked)
                         wake_up(&rcfw->waitq);
-                break;
+                spin_unlock_irqrestore(&cmdq->lock, flags);
         }
         return 0;
 }
@@ -305,12 +330,12 @@ static void bnxt_qplib_service_creq(unsigned long data)
         struct creq_base *creqe, **creq_ptr;
         u32 sw_cons, raw_cons;
         unsigned long flags;
-        u32 type;
+        u32 type, budget = CREQ_ENTRY_POLL_BUDGET;
 
-        /* Service the CREQ until empty */
+        /* Service the CREQ until budget is over */
         spin_lock_irqsave(&creq->lock, flags);
         raw_cons = creq->cons;
-        while (1) {
+        while (budget > 0) {
                 sw_cons = HWQ_CMP(raw_cons, creq);
                 creq_ptr = (struct creq_base **)creq->pbl_ptr;
                 creqe = &creq_ptr[get_creq_pg(sw_cons)][get_creq_idx(sw_cons)];
@@ -320,15 +345,9 @@ static void bnxt_qplib_service_creq(unsigned long data)
                 type = creqe->type & CREQ_BASE_TYPE_MASK;
                 switch (type) {
                 case CREQ_BASE_TYPE_QP_EVENT:
-                        if (!bnxt_qplib_process_qp_event
-                            (rcfw, (struct creq_qp_event *)creqe))
-                                rcfw->creq_qp_event_processed++;
-                        else {
-                                dev_warn(&rcfw->pdev->dev, "QPLIB: crsqe with");
-                                dev_warn(&rcfw->pdev->dev,
-                                         "QPLIB: type = 0x%x not handled",
-                                         type);
-                        }
+                        bnxt_qplib_process_qp_event
+                                (rcfw, (struct creq_qp_event *)creqe);
+                        rcfw->creq_qp_event_processed++;
                         break;
                 case CREQ_BASE_TYPE_FUNC_EVENT:
                         if (!bnxt_qplib_process_func_event
@@ -346,7 +365,9 @@ static void bnxt_qplib_service_creq(unsigned long data)
                         break;
                 }
                 raw_cons++;
+                budget--;
         }
+
         if (creq->cons != raw_cons) {
                 creq->cons = raw_cons;
                 CREQ_DB_REARM(rcfw->creq_bar_reg_iomem, raw_cons,
@@ -375,23 +396,16 @@ static irqreturn_t bnxt_qplib_creq_irq(int irq, void *dev_instance)
 /* RCFW */
 int bnxt_qplib_deinit_rcfw(struct bnxt_qplib_rcfw *rcfw)
 {
-        struct creq_deinitialize_fw_resp *resp;
         struct cmdq_deinitialize_fw req;
+        struct creq_deinitialize_fw_resp resp;
         u16 cmd_flags = 0;
+        int rc;
 
         RCFW_CMD_PREP(req, DEINITIALIZE_FW, cmd_flags);
-        resp = (struct creq_deinitialize_fw_resp *)
-                        bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
-                                                     NULL, 0);
-        if (!resp)
-                return -EINVAL;
-
-        if (!bnxt_qplib_rcfw_wait_for_resp(rcfw, le16_to_cpu(req.cookie)))
-                return -ETIMEDOUT;
-
-        if (resp->status ||
-            le16_to_cpu(resp->cookie) != le16_to_cpu(req.cookie))
-                return -EFAULT;
+        rc = bnxt_qplib_rcfw_send_message(rcfw, (void *)&req, (void *)&resp,
+                                          NULL, 0);
+        if (rc)
+                return rc;
 
         clear_bit(FIRMWARE_INITIALIZED_FLAG, &rcfw->flags);
         return 0;
@@ -417,9 +431,10 @@ static int __get_pbl_pg_idx(struct bnxt_qplib_pbl *pbl)
 int bnxt_qplib_init_rcfw(struct bnxt_qplib_rcfw *rcfw,
                          struct bnxt_qplib_ctx *ctx, int is_virtfn)
 {
-        struct creq_initialize_fw_resp *resp;
         struct cmdq_initialize_fw req;
+        struct creq_initialize_fw_resp resp;
         u16 cmd_flags = 0, level;
+        int rc;
 
         RCFW_CMD_PREP(req, INITIALIZE_FW, cmd_flags);
 
@@ -482,37 +497,19 @@ int bnxt_qplib_init_rcfw(struct bnxt_qplib_rcfw *rcfw,
 
 skip_ctx_setup:
         req.stat_ctx_id = cpu_to_le32(ctx->stats.fw_id);
-        resp = (struct creq_initialize_fw_resp *)
-                        bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
-                                                     NULL, 0);
-        if (!resp) {
-                dev_err(&rcfw->pdev->dev,
-                        "QPLIB: RCFW: INITIALIZE_FW send failed");
-                return -EINVAL;
-        }
-        if (!bnxt_qplib_rcfw_wait_for_resp(rcfw, le16_to_cpu(req.cookie))) {
-                /* Cmd timed out */
-                dev_err(&rcfw->pdev->dev,
-                        "QPLIB: RCFW: INITIALIZE_FW timed out");
-                return -ETIMEDOUT;
-        }
-        if (resp->status ||
-            le16_to_cpu(resp->cookie) != le16_to_cpu(req.cookie)) {
-                dev_err(&rcfw->pdev->dev,
-                        "QPLIB: RCFW: INITIALIZE_FW failed");
-                return -EINVAL;
-        }
+        rc = bnxt_qplib_rcfw_send_message(rcfw, (void *)&req, (void *)&resp,
+                                          NULL, 0);
+        if (rc)
+                return rc;
         set_bit(FIRMWARE_INITIALIZED_FLAG, &rcfw->flags);
         return 0;
 }
 
 void bnxt_qplib_free_rcfw_channel(struct bnxt_qplib_rcfw *rcfw)
 {
-        bnxt_qplib_free_hwq(rcfw->pdev, &rcfw->crsb);
-        kfree(rcfw->crsq.crsq);
+        kfree(rcfw->crsqe_tbl);
         bnxt_qplib_free_hwq(rcfw->pdev, &rcfw->cmdq);
         bnxt_qplib_free_hwq(rcfw->pdev, &rcfw->creq);
-
         rcfw->pdev = NULL;
 }
 
@@ -539,21 +536,11 @@ int bnxt_qplib_alloc_rcfw_channel(struct pci_dev *pdev,
                 goto fail;
         }
 
-        rcfw->crsq.max_elements = rcfw->cmdq.max_elements;
-        rcfw->crsq.crsq = kcalloc(rcfw->crsq.max_elements,
-                                  sizeof(*rcfw->crsq.crsq), GFP_KERNEL);
-        if (!rcfw->crsq.crsq)
+        rcfw->crsqe_tbl = kcalloc(rcfw->cmdq.max_elements,
+                                  sizeof(*rcfw->crsqe_tbl), GFP_KERNEL);
+        if (!rcfw->crsqe_tbl)
                 goto fail;
 
-        rcfw->crsb.max_elements = BNXT_QPLIB_CRSBE_MAX_CNT;
-        if (bnxt_qplib_alloc_init_hwq(rcfw->pdev, &rcfw->crsb, NULL, 0,
-                                      &rcfw->crsb.max_elements,
-                                      BNXT_QPLIB_CRSBE_UNITS, 0, PAGE_SIZE,
-                                      HWQ_TYPE_CTX)) {
-                dev_err(&rcfw->pdev->dev,
-                        "QPLIB: HW channel CRSB allocation failed");
-                goto fail;
-        }
         return 0;
 
 fail:
@@ -606,7 +593,7 @@ int bnxt_qplib_enable_rcfw_channel(struct pci_dev *pdev,
         int rc;
 
         /* General */
-        atomic_set(&rcfw->seq_num, 0);
+        rcfw->seq_num = 0;
         rcfw->flags = FIRMWARE_FIRST_FLAG;
         bmap_size = BITS_TO_LONGS(RCFW_MAX_OUTSTANDING_CMD *
                                   sizeof(unsigned long));
@@ -636,10 +623,6 @@ int bnxt_qplib_enable_rcfw_channel(struct pci_dev *pdev,
 
         rcfw->cmdq_bar_reg_trig_off = RCFW_COMM_TRIG_OFFSET;
 
-        /* CRSQ */
-        rcfw->crsq.prod = 0;
-        rcfw->crsq.cons = 0;
-
         /* CREQ */
         rcfw->creq_bar_reg = RCFW_COMM_CONS_PCI_BAR_REGION;
         res_base = pci_resource_start(pdev, rcfw->creq_bar_reg);
@@ -692,3 +675,34 @@ int bnxt_qplib_enable_rcfw_channel(struct pci_dev *pdev,
         __iowrite32_copy(rcfw->cmdq_bar_reg_iomem, &init, sizeof(init) / 4);
         return 0;
 }
+
+struct bnxt_qplib_rcfw_sbuf *bnxt_qplib_rcfw_alloc_sbuf(
+                struct bnxt_qplib_rcfw *rcfw,
+                u32 size)
+{
+        struct bnxt_qplib_rcfw_sbuf *sbuf;
+
+        sbuf = kzalloc(sizeof(*sbuf), GFP_ATOMIC);
+        if (!sbuf)
+                return NULL;
+
+        sbuf->size = size;
+        sbuf->sb = dma_zalloc_coherent(&rcfw->pdev->dev, sbuf->size,
+                                       &sbuf->dma_addr, GFP_ATOMIC);
+        if (!sbuf->sb)
+                goto bail;
+
+        return sbuf;
+bail:
+        kfree(sbuf);
+        return NULL;
+}
+
+void bnxt_qplib_rcfw_free_sbuf(struct bnxt_qplib_rcfw *rcfw,
+                               struct bnxt_qplib_rcfw_sbuf *sbuf)
+{
+        if (sbuf->sb)
+                dma_free_coherent(&rcfw->pdev->dev, sbuf->size,
+                                  sbuf->sb, sbuf->dma_addr);
+        kfree(sbuf);
+}
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h
index d3567d75bf58..09ce121770cd 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h
+++ b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h
@@ -73,6 +73,7 @@
 #define RCFW_MAX_OUTSTANDING_CMD        BNXT_QPLIB_CMDQE_MAX_CNT
 #define RCFW_MAX_COOKIE_VALUE           0x7FFF
 #define RCFW_CMD_IS_BLOCKING            0x8000
+#define RCFW_BLOCKED_CMD_WAIT_COUNT     0x4E20
 
 /* Cmdq contains a fix number of a 16-Byte slots */
 struct bnxt_qplib_cmdqe {
@@ -94,32 +95,6 @@ struct bnxt_qplib_crsbe {
         u8                      data[1024];
 };
 
-/* CRSQ SB */
-#define BNXT_QPLIB_CRSBE_MAX_CNT        4
-#define BNXT_QPLIB_CRSBE_UNITS          sizeof(struct bnxt_qplib_crsbe)
-#define BNXT_QPLIB_CRSBE_CNT_PER_PG     (PAGE_SIZE / BNXT_QPLIB_CRSBE_UNITS)
-
-#define MAX_CRSB_IDX                    (BNXT_QPLIB_CRSBE_MAX_CNT - 1)
-#define MAX_CRSB_IDX_PER_PG             (BNXT_QPLIB_CRSBE_CNT_PER_PG - 1)
-
-static inline u32 get_crsb_pg(u32 val)
-{
-        return (val & ~MAX_CRSB_IDX_PER_PG) / BNXT_QPLIB_CRSBE_CNT_PER_PG;
-}
-
-static inline u32 get_crsb_idx(u32 val)
-{
-        return val & MAX_CRSB_IDX_PER_PG;
-}
-
-static inline void bnxt_qplib_crsb_dma_next(dma_addr_t *pg_map_arr,
-                                            u32 prod, dma_addr_t *dma_addr)
-{
-                *dma_addr = pg_map_arr[(prod) / BNXT_QPLIB_CRSBE_CNT_PER_PG];
-                *dma_addr += ((prod) % BNXT_QPLIB_CRSBE_CNT_PER_PG) *
-                              BNXT_QPLIB_CRSBE_UNITS;
-}
-
 /* CREQ */
 /* Allocate 1 per QP for async error notification for now */
 #define BNXT_QPLIB_CREQE_MAX_CNT        (64 * 1024)
@@ -158,17 +133,19 @@ static inline u32 get_creq_idx(u32 val)
 #define CREQ_DB(db, raw_cons, cp_bit)                           \
         writel(CREQ_DB_CP_FLAGS | ((raw_cons) & ((cp_bit) - 1)), db)
 
+#define CREQ_ENTRY_POLL_BUDGET          0x100
+
 /* HWQ */
-struct bnxt_qplib_crsqe {
-        struct creq_qp_event    qp_event;
+
+struct bnxt_qplib_crsq {
+        struct creq_qp_event    *resp;
         u32                     req_size;
 };
 
-struct bnxt_qplib_crsq {
-        struct bnxt_qplib_crsqe *crsq;
-        u32                     prod;
-        u32                     cons;
-        u32                     max_elements;
+struct bnxt_qplib_rcfw_sbuf {
+        void *sb;
+        dma_addr_t dma_addr;
+        u32 size;
 };
 
 /* RCFW Communication Channels */
@@ -185,7 +162,7 @@ struct bnxt_qplib_rcfw {
         wait_queue_head_t       waitq;
         int                     (*aeq_handler)(struct bnxt_qplib_rcfw *,
                                                struct creq_func_event *);
-        atomic_t                seq_num;
+        u32                     seq_num;
 
         /* Bar region info */
         void __iomem            *cmdq_bar_reg_iomem;
@@ -203,8 +180,7 @@ struct bnxt_qplib_rcfw {
 
         /* Actual Cmd and Resp Queues */
         struct bnxt_qplib_hwq   cmdq;
-        struct bnxt_qplib_crsq  crsq;
-        struct bnxt_qplib_hwq   crsb;
+        struct bnxt_qplib_crsq  *crsqe_tbl;
 };
 
 void bnxt_qplib_free_rcfw_channel(struct bnxt_qplib_rcfw *rcfw);
@@ -219,11 +195,14 @@ int bnxt_qplib_enable_rcfw_channel(struct pci_dev *pdev,
                                         (struct bnxt_qplib_rcfw *,
                                          struct creq_func_event *));
 
-int bnxt_qplib_rcfw_block_for_resp(struct bnxt_qplib_rcfw *rcfw, u16 cookie);
-int bnxt_qplib_rcfw_wait_for_resp(struct bnxt_qplib_rcfw *rcfw, u16 cookie);
-void *bnxt_qplib_rcfw_send_message(struct bnxt_qplib_rcfw *rcfw,
-                                   struct cmdq_base *req, void **crsbe,
-                                   u8 is_block);
+struct bnxt_qplib_rcfw_sbuf *bnxt_qplib_rcfw_alloc_sbuf(
+                                struct bnxt_qplib_rcfw *rcfw,
+                                u32 size);
+void bnxt_qplib_rcfw_free_sbuf(struct bnxt_qplib_rcfw *rcfw,
+                               struct bnxt_qplib_rcfw_sbuf *sbuf);
+int bnxt_qplib_rcfw_send_message(struct bnxt_qplib_rcfw *rcfw,
+                                 struct cmdq_base *req, struct creq_base *resp,
+                                 void *sbuf, u8 is_block);
 
 int bnxt_qplib_deinit_rcfw(struct bnxt_qplib_rcfw *rcfw);
 int bnxt_qplib_init_rcfw(struct bnxt_qplib_rcfw *rcfw,
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_res.h b/drivers/infiniband/hw/bnxt_re/qplib_res.h
index 6277d802ca4b..2e4855509719 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_res.h
+++ b/drivers/infiniband/hw/bnxt_re/qplib_res.h
@@ -48,6 +48,10 @@ extern const struct bnxt_qplib_gid bnxt_qplib_gid_zero;
 
 #define HWQ_CMP(idx, hwq)       ((idx) & ((hwq)->max_elements - 1))
 
+#define HWQ_FREE_SLOTS(hwq)     (hwq->max_elements - \
+                                ((HWQ_CMP(hwq->prod, hwq)\
+                                - HWQ_CMP(hwq->cons, hwq))\
+                                & (hwq->max_elements - 1)))
 enum bnxt_qplib_hwq_type {
         HWQ_TYPE_CTX,
         HWQ_TYPE_QUEUE,
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_sp.c b/drivers/infiniband/hw/bnxt_re/qplib_sp.c
index 7b31eccedf11..fde18cf0e406 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_sp.c
+++ b/drivers/infiniband/hw/bnxt_re/qplib_sp.c
@@ -55,37 +55,30 @@ int bnxt_qplib_get_dev_attr(struct bnxt_qplib_rcfw *rcfw,
                             struct bnxt_qplib_dev_attr *attr)
 {
         struct cmdq_query_func req;
-        struct creq_query_func_resp *resp;
+        struct creq_query_func_resp resp;
+        struct bnxt_qplib_rcfw_sbuf *sbuf;
         struct creq_query_func_resp_sb *sb;
         u16 cmd_flags = 0;
         u32 temp;
         u8 *tqm_alloc;
-        int i;
+        int i, rc = 0;
 
         RCFW_CMD_PREP(req, QUERY_FUNC, cmd_flags);
 
-        req.resp_size = sizeof(*sb) / BNXT_QPLIB_CMDQE_UNITS;
-        resp = (struct creq_query_func_resp *)
-                bnxt_qplib_rcfw_send_message(rcfw, (void *)&req, (void **)&sb,
-                                             0);
-        if (!resp) {
-                dev_err(&rcfw->pdev->dev, "QPLIB: SP: QUERY_FUNC send failed");
-                return -EINVAL;
-        }
-        if (!bnxt_qplib_rcfw_wait_for_resp(rcfw, le16_to_cpu(req.cookie))) {
-                /* Cmd timed out */
-                dev_err(&rcfw->pdev->dev, "QPLIB: SP: QUERY_FUNC timed out");
-                return -ETIMEDOUT;
-        }
-        if (resp->status ||
-            le16_to_cpu(resp->cookie) != le16_to_cpu(req.cookie)) {
-                dev_err(&rcfw->pdev->dev, "QPLIB: SP: QUERY_FUNC failed ");
+        sbuf = bnxt_qplib_rcfw_alloc_sbuf(rcfw, sizeof(*sb));
+        if (!sbuf) {
                 dev_err(&rcfw->pdev->dev,
-                        "QPLIB: with status 0x%x cmdq 0x%x resp 0x%x",
-                        resp->status, le16_to_cpu(req.cookie),
-                        le16_to_cpu(resp->cookie));
-                return -EINVAL;
+                        "QPLIB: SP: QUERY_FUNC alloc side buffer failed");
+                return -ENOMEM;
         }
+
+        sb = sbuf->sb;
+        req.resp_size = sizeof(*sb) / BNXT_QPLIB_CMDQE_UNITS;
+        rc = bnxt_qplib_rcfw_send_message(rcfw, (void *)&req, (void *)&resp,
+                                          (void *)sbuf, 0);
+        if (rc)
+                goto bail;
+
         /* Extract the context from the side buffer */
         attr->max_qp = le32_to_cpu(sb->max_qp);
         attr->max_qp_rd_atom =
@@ -95,6 +88,11 @@ int bnxt_qplib_get_dev_attr(struct bnxt_qplib_rcfw *rcfw,
                 sb->max_qp_init_rd_atom > BNXT_QPLIB_MAX_OUT_RD_ATOM ?
                 BNXT_QPLIB_MAX_OUT_RD_ATOM : sb->max_qp_init_rd_atom;
         attr->max_qp_wqes = le16_to_cpu(sb->max_qp_wr);
+        /*
+         * 128 WQEs needs to be reserved for the HW (8916). Prevent
+         * reporting the max number
+         */
+        attr->max_qp_wqes -= BNXT_QPLIB_RESERVED_QP_WRS;
         attr->max_qp_sges = sb->max_sge;
         attr->max_cq = le32_to_cpu(sb->max_cq);
         attr->max_cq_wqes = le32_to_cpu(sb->max_cqe);
@@ -130,7 +128,10 @@ int bnxt_qplib_get_dev_attr(struct bnxt_qplib_rcfw *rcfw,
                 attr->tqm_alloc_reqs[i * 4 + 2] = *(++tqm_alloc);
                 attr->tqm_alloc_reqs[i * 4 + 3] = *(++tqm_alloc);
         }
-        return 0;
+
+bail:
+        bnxt_qplib_rcfw_free_sbuf(rcfw, sbuf);
+        return rc;
 }
 
 /* SGID */
@@ -178,8 +179,9 @@ int bnxt_qplib_del_sgid(struct bnxt_qplib_sgid_tbl *sgid_tbl,
         /* Remove GID from the SGID table */
         if (update) {
                 struct cmdq_delete_gid req;
-                struct creq_delete_gid_resp *resp;
+                struct creq_delete_gid_resp resp;
                 u16 cmd_flags = 0;
+                int rc;
 
                 RCFW_CMD_PREP(req, DELETE_GID, cmd_flags);
                 if (sgid_tbl->hw_id[index] == 0xFFFF) {
@@ -188,31 +190,10 @@ int bnxt_qplib_del_sgid(struct bnxt_qplib_sgid_tbl *sgid_tbl,
                         return -EINVAL;
                 }
                 req.gid_index = cpu_to_le16(sgid_tbl->hw_id[index]);
-                resp = (struct creq_delete_gid_resp *)
-                        bnxt_qplib_rcfw_send_message(rcfw, (void *)&req, NULL,
-                                                     0);
-                if (!resp) {
-                        dev_err(&res->pdev->dev,
-                                "QPLIB: SP: DELETE_GID send failed");
-                        return -EINVAL;
-                }
-                if (!bnxt_qplib_rcfw_wait_for_resp(rcfw,
-                                                   le16_to_cpu(req.cookie))) {
-                        /* Cmd timed out */
-                        dev_err(&res->pdev->dev,
-                                "QPLIB: SP: DELETE_GID timed out");
-                        return -ETIMEDOUT;
-                }
-                if (resp->status ||
-                    le16_to_cpu(resp->cookie) != le16_to_cpu(req.cookie)) {
-                        dev_err(&res->pdev->dev,
-                                "QPLIB: SP: DELETE_GID failed ");
-                        dev_err(&res->pdev->dev,
-                                "QPLIB: with status 0x%x cmdq 0x%x resp 0x%x",
-                                resp->status, le16_to_cpu(req.cookie),
-                                le16_to_cpu(resp->cookie));
-                        return -EINVAL;
-                }
+                rc = bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
+                                                  (void *)&resp, NULL, 0);
+                if (rc)
+                        return rc;
         }
         memcpy(&sgid_tbl->tbl[index], &bnxt_qplib_gid_zero,
                sizeof(bnxt_qplib_gid_zero));
@@ -234,7 +215,7 @@ int bnxt_qplib_add_sgid(struct bnxt_qplib_sgid_tbl *sgid_tbl,
                                                    struct bnxt_qplib_res,
                                                    sgid_tbl);
         struct bnxt_qplib_rcfw *rcfw = res->rcfw;
-        int i, free_idx, rc = 0;
+        int i, free_idx;
 
         if (!sgid_tbl) {
                 dev_err(&res->pdev->dev, "QPLIB: SGID table not allocated");
@@ -266,10 +247,11 @@ int bnxt_qplib_add_sgid(struct bnxt_qplib_sgid_tbl *sgid_tbl,
         }
         if (update) {
                 struct cmdq_add_gid req;
-                struct creq_add_gid_resp *resp;
+                struct creq_add_gid_resp resp;
                 u16 cmd_flags = 0;
                 u32 temp32[4];
                 u16 temp16[3];
+                int rc;
 
                 RCFW_CMD_PREP(req, ADD_GID, cmd_flags);
 
@@ -290,31 +272,11 @@ int bnxt_qplib_add_sgid(struct bnxt_qplib_sgid_tbl *sgid_tbl,
                 req.src_mac[1] = cpu_to_be16(temp16[1]);
                 req.src_mac[2] = cpu_to_be16(temp16[2]);
 
-                resp = (struct creq_add_gid_resp *)
-                        bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
-                                                     NULL, 0);
-                if (!resp) {
-                        dev_err(&res->pdev->dev,
-                                "QPLIB: SP: ADD_GID send failed");
-                        return -EINVAL;
-                }
-                if (!bnxt_qplib_rcfw_wait_for_resp(rcfw,
-                                                   le16_to_cpu(req.cookie))) {
-                        /* Cmd timed out */
-                        dev_err(&res->pdev->dev,
-                                "QPIB: SP: ADD_GID timed out");
-                        return -ETIMEDOUT;
-                }
-                if (resp->status ||
-                    le16_to_cpu(resp->cookie) != le16_to_cpu(req.cookie)) {
-                        dev_err(&res->pdev->dev, "QPLIB: SP: ADD_GID failed ");
-                        dev_err(&res->pdev->dev,
-                                "QPLIB: with status 0x%x cmdq 0x%x resp 0x%x",
-                                resp->status, le16_to_cpu(req.cookie),
-                                le16_to_cpu(resp->cookie));
-                        return -EINVAL;
-                }
-                sgid_tbl->hw_id[free_idx] = le32_to_cpu(resp->xid);
+                rc = bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
+                                                  (void *)&resp, NULL, 0);
+                if (rc)
+                        return rc;
+                sgid_tbl->hw_id[free_idx] = le32_to_cpu(resp.xid);
         }
         /* Add GID to the sgid_tbl */
         memcpy(&sgid_tbl->tbl[free_idx], gid, sizeof(*gid));
@@ -325,7 +287,7 @@ int bnxt_qplib_add_sgid(struct bnxt_qplib_sgid_tbl *sgid_tbl,
 
         *index = free_idx;
         /* unlock */
-        return rc;
+        return 0;
 }
 
 /* pkeys */
@@ -422,10 +384,11 @@ int bnxt_qplib_create_ah(struct bnxt_qplib_res *res, struct bnxt_qplib_ah *ah)
 {
         struct bnxt_qplib_rcfw *rcfw = res->rcfw;
         struct cmdq_create_ah req;
-        struct creq_create_ah_resp *resp;
+        struct creq_create_ah_resp resp;
         u16 cmd_flags = 0;
         u32 temp32[4];
         u16 temp16[3];
+        int rc;
 
         RCFW_CMD_PREP(req, CREATE_AH, cmd_flags);
 
@@ -450,28 +413,12 @@ int bnxt_qplib_create_ah(struct bnxt_qplib_res *res, struct bnxt_qplib_ah *ah)
         req.dest_mac[1] = cpu_to_le16(temp16[1]);
         req.dest_mac[2] = cpu_to_le16(temp16[2]);
 
-        resp = (struct creq_create_ah_resp *)
-                        bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
-                                                     NULL, 1);
-        if (!resp) {
-                dev_err(&rcfw->pdev->dev, "QPLIB: SP: CREATE_AH send failed");
-                return -EINVAL;
-        }
-        if (!bnxt_qplib_rcfw_block_for_resp(rcfw, le16_to_cpu(req.cookie))) {
-                /* Cmd timed out */
-                dev_err(&rcfw->pdev->dev, "QPLIB: SP: CREATE_AH timed out");
-                return -ETIMEDOUT;
-        }
-        if (resp->status ||
-            le16_to_cpu(resp->cookie) != le16_to_cpu(req.cookie)) {
-                dev_err(&rcfw->pdev->dev, "QPLIB: SP: CREATE_AH failed ");
-                dev_err(&rcfw->pdev->dev,
-                        "QPLIB: with status 0x%x cmdq 0x%x resp 0x%x",
-                        resp->status, le16_to_cpu(req.cookie),
-                        le16_to_cpu(resp->cookie));
-                return -EINVAL;
-        }
-        ah->id = le32_to_cpu(resp->xid);
+        rc = bnxt_qplib_rcfw_send_message(rcfw, (void *)&req, (void *)&resp,
+                                          NULL, 1);
+        if (rc)
+                return rc;
+
+        ah->id = le32_to_cpu(resp.xid);
         return 0;
 }
 
@@ -479,35 +426,19 @@ int bnxt_qplib_destroy_ah(struct bnxt_qplib_res *res, struct bnxt_qplib_ah *ah)
 {
         struct bnxt_qplib_rcfw *rcfw = res->rcfw;
         struct cmdq_destroy_ah req;
-        struct creq_destroy_ah_resp *resp;
+        struct creq_destroy_ah_resp resp;
         u16 cmd_flags = 0;
+        int rc;
 
         /* Clean up the AH table in the device */
         RCFW_CMD_PREP(req, DESTROY_AH, cmd_flags);
 
         req.ah_cid = cpu_to_le32(ah->id);
 
-        resp = (struct creq_destroy_ah_resp *)
-                        bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
-                                                     NULL, 1);
-        if (!resp) {
-                dev_err(&rcfw->pdev->dev, "QPLIB: SP: DESTROY_AH send failed");
-                return -EINVAL;
-        }
-        if (!bnxt_qplib_rcfw_block_for_resp(rcfw, le16_to_cpu(req.cookie))) {
-                /* Cmd timed out */
-                dev_err(&rcfw->pdev->dev, "QPLIB: SP: DESTROY_AH timed out");
-                return -ETIMEDOUT;
-        }
-        if (resp->status ||
-            le16_to_cpu(resp->cookie) != le16_to_cpu(req.cookie)) {
-                dev_err(&rcfw->pdev->dev, "QPLIB: SP: DESTROY_AH failed ");
-                dev_err(&rcfw->pdev->dev,
-                        "QPLIB: with status 0x%x cmdq 0x%x resp 0x%x",
-                        resp->status, le16_to_cpu(req.cookie),
-                        le16_to_cpu(resp->cookie));
-                return -EINVAL;
-        }
+        rc = bnxt_qplib_rcfw_send_message(rcfw, (void *)&req, (void *)&resp,
+                                          NULL, 1);
+        if (rc)
+                return rc;
         return 0;
 }
 
@@ -516,8 +447,9 @@ int bnxt_qplib_free_mrw(struct bnxt_qplib_res *res, struct bnxt_qplib_mrw *mrw)
 {
         struct bnxt_qplib_rcfw *rcfw = res->rcfw;
         struct cmdq_deallocate_key req;
-        struct creq_deallocate_key_resp *resp;
+        struct creq_deallocate_key_resp resp;
         u16 cmd_flags = 0;
+        int rc;
 
         if (mrw->lkey == 0xFFFFFFFF) {
                 dev_info(&res->pdev->dev,
@@ -536,27 +468,11 @@ int bnxt_qplib_free_mrw(struct bnxt_qplib_res *res, struct bnxt_qplib_mrw *mrw)
         else
                 req.key = cpu_to_le32(mrw->lkey);
 
-        resp = (struct creq_deallocate_key_resp *)
-                        bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
-                                                     NULL, 0);
-        if (!resp) {
-                dev_err(&res->pdev->dev, "QPLIB: SP: FREE_MR send failed");
-                return -EINVAL;
-        }
-        if (!bnxt_qplib_rcfw_wait_for_resp(rcfw, le16_to_cpu(req.cookie))) {
-                /* Cmd timed out */
-                dev_err(&res->pdev->dev, "QPLIB: SP: FREE_MR timed out");
-                return -ETIMEDOUT;
-        }
-        if (resp->status ||
-            le16_to_cpu(resp->cookie) != le16_to_cpu(req.cookie)) {
-                dev_err(&res->pdev->dev, "QPLIB: SP: FREE_MR failed ");
-                dev_err(&res->pdev->dev,
-                        "QPLIB: with status 0x%x cmdq 0x%x resp 0x%x",
-                        resp->status, le16_to_cpu(req.cookie),
-                        le16_to_cpu(resp->cookie));
-                return -EINVAL;
-        }
+        rc = bnxt_qplib_rcfw_send_message(rcfw, (void *)&req, (void *)&resp,
+                                          NULL, 0);
+        if (rc)
+                return rc;
+
         /* Free the qplib's MRW memory */
         if (mrw->hwq.max_elements)
                 bnxt_qplib_free_hwq(res->pdev, &mrw->hwq);
@@ -568,9 +484,10 @@ int bnxt_qplib_alloc_mrw(struct bnxt_qplib_res *res, struct bnxt_qplib_mrw *mrw)
 {
         struct bnxt_qplib_rcfw *rcfw = res->rcfw;
         struct cmdq_allocate_mrw req;
-        struct creq_allocate_mrw_resp *resp;
+        struct creq_allocate_mrw_resp resp;
         u16 cmd_flags = 0;
         unsigned long tmp;
+        int rc;
 
         RCFW_CMD_PREP(req, ALLOCATE_MRW, cmd_flags);
 
@@ -584,33 +501,17 @@ int bnxt_qplib_alloc_mrw(struct bnxt_qplib_res *res, struct bnxt_qplib_mrw *mrw)
         tmp = (unsigned long)mrw;
         req.mrw_handle = cpu_to_le64(tmp);
 
-        resp = (struct creq_allocate_mrw_resp *)
-                        bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
-                                                     NULL, 0);
-        if (!resp) {
-                dev_err(&rcfw->pdev->dev, "QPLIB: SP: ALLOC_MRW send failed");
-                return -EINVAL;
-        }
-        if (!bnxt_qplib_rcfw_wait_for_resp(rcfw, le16_to_cpu(req.cookie))) {
-                /* Cmd timed out */
-                dev_err(&rcfw->pdev->dev, "QPLIB: SP: ALLOC_MRW timed out");
-                return -ETIMEDOUT;
-        }
-        if (resp->status ||
-            le16_to_cpu(resp->cookie) != le16_to_cpu(req.cookie)) {
-                dev_err(&rcfw->pdev->dev, "QPLIB: SP: ALLOC_MRW failed ");
-                dev_err(&rcfw->pdev->dev,
-                        "QPLIB: with status 0x%x cmdq 0x%x resp 0x%x",
-                        resp->status, le16_to_cpu(req.cookie),
-                        le16_to_cpu(resp->cookie));
-                return -EINVAL;
-        }
+        rc = bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
+                                          (void *)&resp, NULL, 0);
+        if (rc)
+                return rc;
+
         if ((mrw->type == CMDQ_ALLOCATE_MRW_MRW_FLAGS_MW_TYPE1)  ||
             (mrw->type == CMDQ_ALLOCATE_MRW_MRW_FLAGS_MW_TYPE2A) ||
             (mrw->type == CMDQ_ALLOCATE_MRW_MRW_FLAGS_MW_TYPE2B))
-                mrw->rkey = le32_to_cpu(resp->xid);
+                mrw->rkey = le32_to_cpu(resp.xid);
         else
-                mrw->lkey = le32_to_cpu(resp->xid);
+                mrw->lkey = le32_to_cpu(resp.xid);
         return 0;
 }
 
@@ -619,40 +520,17 @@ int bnxt_qplib_dereg_mrw(struct bnxt_qplib_res *res, struct bnxt_qplib_mrw *mrw,
 {
         struct bnxt_qplib_rcfw *rcfw = res->rcfw;
         struct cmdq_deregister_mr req;
-        struct creq_deregister_mr_resp *resp;
+        struct creq_deregister_mr_resp resp;
         u16 cmd_flags = 0;
         int rc;
 
         RCFW_CMD_PREP(req, DEREGISTER_MR, cmd_flags);
 
         req.lkey = cpu_to_le32(mrw->lkey);
-        resp = (struct creq_deregister_mr_resp *)
-                        bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
-                                                     NULL, block);
-        if (!resp) {
-                dev_err(&rcfw->pdev->dev, "QPLIB: SP: DEREG_MR send failed");
-                return -EINVAL;
-        }
-        if (block)
-                rc = bnxt_qplib_rcfw_block_for_resp(rcfw,
-                                                    le16_to_cpu(req.cookie));
-        else
-                rc = bnxt_qplib_rcfw_wait_for_resp(rcfw,
-                                                   le16_to_cpu(req.cookie));
-        if (!rc) {
-                /* Cmd timed out */
-                dev_err(&res->pdev->dev, "QPLIB: SP: DEREG_MR timed out");
-                return -ETIMEDOUT;
-        }
-        if (resp->status ||
-            le16_to_cpu(resp->cookie) != le16_to_cpu(req.cookie)) {
-                dev_err(&rcfw->pdev->dev, "QPLIB: SP: DEREG_MR failed ");
-                dev_err(&rcfw->pdev->dev,
-                        "QPLIB: with status 0x%x cmdq 0x%x resp 0x%x",
-                        resp->status, le16_to_cpu(req.cookie),
-                        le16_to_cpu(resp->cookie));
-                return -EINVAL;
-        }
+        rc = bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
+                                          (void *)&resp, NULL, block);
+        if (rc)
+                return rc;
 
         /* Free the qplib's MR memory */
         if (mrw->hwq.max_elements) {
@@ -669,7 +547,7 @@ int bnxt_qplib_reg_mr(struct bnxt_qplib_res *res, struct bnxt_qplib_mrw *mr,
 {
         struct bnxt_qplib_rcfw *rcfw = res->rcfw;
         struct cmdq_register_mr req;
-        struct creq_register_mr_resp *resp;
+        struct creq_register_mr_resp resp;
         u16 cmd_flags = 0, level;
         int pg_ptrs, pages, i, rc;
         dma_addr_t **pbl_ptr;
@@ -730,36 +608,11 @@ int bnxt_qplib_reg_mr(struct bnxt_qplib_res *res, struct bnxt_qplib_mrw *mr,
         req.key = cpu_to_le32(mr->lkey);
         req.mr_size = cpu_to_le64(mr->total_size);
 
-        resp = (struct creq_register_mr_resp *)
-                        bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
-                                                     NULL, block);
-        if (!resp) {
-                dev_err(&res->pdev->dev, "SP: REG_MR send failed");
-                rc = -EINVAL;
-                goto fail;
-        }
-        if (block)
-                rc = bnxt_qplib_rcfw_block_for_resp(rcfw,
-                                                    le16_to_cpu(req.cookie));
-        else
-                rc = bnxt_qplib_rcfw_wait_for_resp(rcfw,
-                                                   le16_to_cpu(req.cookie));
-        if (!rc) {
-                /* Cmd timed out */
-                dev_err(&res->pdev->dev, "SP: REG_MR timed out");
-                rc = -ETIMEDOUT;
-                goto fail;
-        }
-        if (resp->status ||
-            le16_to_cpu(resp->cookie) != le16_to_cpu(req.cookie)) {
-                dev_err(&res->pdev->dev, "QPLIB: SP: REG_MR failed ");
-                dev_err(&res->pdev->dev,
-                        "QPLIB: SP: with status 0x%x cmdq 0x%x resp 0x%x",
-                        resp->status, le16_to_cpu(req.cookie),
-                        le16_to_cpu(resp->cookie));
-                rc = -EINVAL;
+        rc = bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
+                                          (void *)&resp, NULL, block);
+        if (rc)
                 goto fail;
-        }
+
         return 0;
 
 fail:
@@ -804,35 +657,15 @@ int bnxt_qplib_map_tc2cos(struct bnxt_qplib_res *res, u16 *cids)
 {
         struct bnxt_qplib_rcfw *rcfw = res->rcfw;
         struct cmdq_map_tc_to_cos req;
-        struct creq_map_tc_to_cos_resp *resp;
+        struct creq_map_tc_to_cos_resp resp;
         u16 cmd_flags = 0;
-        int tleft;
+        int rc = 0;
 
         RCFW_CMD_PREP(req, MAP_TC_TO_COS, cmd_flags);
         req.cos0 = cpu_to_le16(cids[0]);
         req.cos1 = cpu_to_le16(cids[1]);
 
-        resp = bnxt_qplib_rcfw_send_message(rcfw, (void *)&req, NULL, 0);
-        if (!resp) {
-                dev_err(&res->pdev->dev, "QPLIB: SP: MAP_TC2COS send failed");
-                return -EINVAL;
-        }
-
-        tleft = bnxt_qplib_rcfw_block_for_resp(rcfw, le16_to_cpu(req.cookie));
-        if (!tleft) {
-                dev_err(&res->pdev->dev, "QPLIB: SP: MAP_TC2COS timed out");
-                return -ETIMEDOUT;
-        }
-
-        if (resp->status ||
-            le16_to_cpu(resp->cookie) != le16_to_cpu(req.cookie)) {
-                dev_err(&res->pdev->dev, "QPLIB: SP: MAP_TC2COS failed ");
-                dev_err(&res->pdev->dev,
-                        "QPLIB: with status 0x%x cmdq 0x%x resp 0x%x",
-                        resp->status, le16_to_cpu(req.cookie),
-                        le16_to_cpu(resp->cookie));
-                return -EINVAL;
-        }
-
+        rc = bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
+                                          (void *)&resp, NULL, 0);
         return 0;
 }
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_sp.h b/drivers/infiniband/hw/bnxt_re/qplib_sp.h
index 1442a617e968..a543f959098b 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_sp.h
+++ b/drivers/infiniband/hw/bnxt_re/qplib_sp.h
@@ -40,6 +40,8 @@
 #ifndef __BNXT_QPLIB_SP_H__
 #define __BNXT_QPLIB_SP_H__
 
+#define BNXT_QPLIB_RESERVED_QP_WRS      128
+
 struct bnxt_qplib_dev_attr {
         char                            fw_ver[32];
         u16                             max_sgid;
diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
index b6fe45924c6e..0910faf3587b 100644
--- a/drivers/infiniband/hw/cxgb4/cm.c
+++ b/drivers/infiniband/hw/cxgb4/cm.c
@@ -488,6 +488,7 @@ static int _put_ep_safe(struct c4iw_dev *dev, struct sk_buff *skb)
 
         ep = *((struct c4iw_ep **)(skb->cb + 2 * sizeof(void *)));
         release_ep_resources(ep);
+        kfree_skb(skb);
         return 0;
 }
 
@@ -498,6 +499,7 @@ static int _put_pass_ep_safe(struct c4iw_dev *dev, struct sk_buff *skb)
         ep = *((struct c4iw_ep **)(skb->cb + 2 * sizeof(void *)));
         c4iw_put_ep(&ep->parent_ep->com);
         release_ep_resources(ep);
+        kfree_skb(skb);
         return 0;
 }
 
@@ -569,11 +571,13 @@ static void abort_arp_failure(void *handle, struct sk_buff *skb)
 
         pr_debug("%s rdev %p\n", __func__, rdev);
         req->cmd = CPL_ABORT_NO_RST;
+        skb_get(skb);
         ret = c4iw_ofld_send(rdev, skb);
         if (ret) {
                 __state_set(&ep->com, DEAD);
                 queue_arp_failure_cpl(ep, skb, FAKE_CPL_PUT_EP_SAFE);
-        }
+        } else
+                kfree_skb(skb);
 }
 
 static int send_flowc(struct c4iw_ep *ep)
@@ -2517,7 +2521,8 @@ static int pass_accept_req(struct c4iw_dev *dev, struct sk_buff *skb)
                 goto reject;
         }
 
-        hdrs = sizeof(struct iphdr) + sizeof(struct tcphdr) +
+        hdrs = ((iptype == 4) ? sizeof(struct iphdr) : sizeof(struct ipv6hdr)) +
+               sizeof(struct tcphdr) +
                ((enable_tcp_timestamps && req->tcpopt.tstamp) ? 12 : 0);
         if (peer_mss && child_ep->mtu > (peer_mss + hdrs))
                 child_ep->mtu = peer_mss + hdrs;
diff --git a/drivers/infiniband/hw/cxgb4/device.c b/drivers/infiniband/hw/cxgb4/device.c
index 329fb65e8fb0..ae0b79aeea2e 100644
--- a/drivers/infiniband/hw/cxgb4/device.c
+++ b/drivers/infiniband/hw/cxgb4/device.c
@@ -767,7 +767,7 @@ void c4iw_release_dev_ucontext(struct c4iw_rdev *rdev,
                 kfree(entry);
         }
 
-        list_for_each_safe(pos, nxt, &uctx->qpids) {
+        list_for_each_safe(pos, nxt, &uctx->cqids) {
                 entry = list_entry(pos, struct c4iw_qid_list, entry);
                 list_del_init(&entry->entry);
                 kfree(entry);
@@ -880,13 +880,15 @@ static int c4iw_rdev_open(struct c4iw_rdev *rdev)
         rdev->free_workq = create_singlethread_workqueue("iw_cxgb4_free");
         if (!rdev->free_workq) {
                 err = -ENOMEM;
-                goto err_free_status_page;
+                goto err_free_status_page_and_wr_log;
         }
 
         rdev->status_page->db_off = 0;
 
         return 0;
-err_free_status_page:
+err_free_status_page_and_wr_log:
+        if (c4iw_wr_log && rdev->wr_log)
+                kfree(rdev->wr_log);
         free_page((unsigned long)rdev->status_page);
 destroy_ocqp_pool:
         c4iw_ocqp_pool_destroy(rdev);
@@ -903,9 +905,11 @@ static void c4iw_rdev_close(struct c4iw_rdev *rdev)
 {
         destroy_workqueue(rdev->free_workq);
         kfree(rdev->wr_log);
+        c4iw_release_dev_ucontext(rdev, &rdev->uctx);
         free_page((unsigned long)rdev->status_page);
         c4iw_pblpool_destroy(rdev);
         c4iw_rqtpool_destroy(rdev);
+        c4iw_ocqp_pool_destroy(rdev);
         c4iw_destroy_resource(&rdev->resource);
 }
 
@@ -971,7 +975,7 @@ static struct c4iw_dev *c4iw_alloc(const struct cxgb4_lld_info *infop)
                  devp->rdev.lldi.sge_egrstatuspagesize);
 
         devp->rdev.hw_queue.t4_eq_status_entries =
-                devp->rdev.lldi.sge_ingpadboundary > 64 ? 2 : 1;
+                devp->rdev.lldi.sge_egrstatuspagesize / 64;
         devp->rdev.hw_queue.t4_max_eq_size = 65520;
         devp->rdev.hw_queue.t4_max_iq_size = 65520;
         devp->rdev.hw_queue.t4_max_rq_size = 8192 -
diff --git a/drivers/infiniband/hw/hfi1/chip.c b/drivers/infiniband/hw/hfi1/chip.c
index 5d6b1eeaa9a0..2ba00b89df6a 100644
--- a/drivers/infiniband/hw/hfi1/chip.c
+++ b/drivers/infiniband/hw/hfi1/chip.c
@@ -6312,25 +6312,38 @@ static void handle_8051_request(struct hfi1_pportdata *ppd)
         }
 }
 
-static void write_global_credit(struct hfi1_devdata *dd,
-                                u8 vau, u16 total, u16 shared)
+/*
+ * Set up allocation unit vaulue.
+ */
+void set_up_vau(struct hfi1_devdata *dd, u8 vau)
 {
-        write_csr(dd, SEND_CM_GLOBAL_CREDIT,
-                  ((u64)total <<
-                   SEND_CM_GLOBAL_CREDIT_TOTAL_CREDIT_LIMIT_SHIFT) |
-                  ((u64)shared <<
-                   SEND_CM_GLOBAL_CREDIT_SHARED_LIMIT_SHIFT) |
-                  ((u64)vau << SEND_CM_GLOBAL_CREDIT_AU_SHIFT));
+        u64 reg = read_csr(dd, SEND_CM_GLOBAL_CREDIT);
+
+        /* do not modify other values in the register */
+        reg &= ~SEND_CM_GLOBAL_CREDIT_AU_SMASK;
+        reg |= (u64)vau << SEND_CM_GLOBAL_CREDIT_AU_SHIFT;
+        write_csr(dd, SEND_CM_GLOBAL_CREDIT, reg);
 }
 
 /*
  * Set up initial VL15 credits of the remote.  Assumes the rest of
- * the CM credit registers are zero from a previous global or credit reset .
+ * the CM credit registers are zero from a previous global or credit reset.
+ * Shared limit for VL15 will always be 0.
  */
-void set_up_vl15(struct hfi1_devdata *dd, u8 vau, u16 vl15buf)
+void set_up_vl15(struct hfi1_devdata *dd, u16 vl15buf)
 {
-        /* leave shared count at zero for both global and VL15 */
-        write_global_credit(dd, vau, vl15buf, 0);
+        u64 reg = read_csr(dd, SEND_CM_GLOBAL_CREDIT);
+
+        /* set initial values for total and shared credit limit */
+        reg &= ~(SEND_CM_GLOBAL_CREDIT_TOTAL_CREDIT_LIMIT_SMASK |
+                 SEND_CM_GLOBAL_CREDIT_SHARED_LIMIT_SMASK);
+
+        /*
+         * Set total limit to be equal to VL15 credits.
+         * Leave shared limit at 0.
+         */
+        reg |= (u64)vl15buf << SEND_CM_GLOBAL_CREDIT_TOTAL_CREDIT_LIMIT_SHIFT;
+        write_csr(dd, SEND_CM_GLOBAL_CREDIT, reg);
 
         write_csr(dd, SEND_CM_CREDIT_VL15, (u64)vl15buf
                   << SEND_CM_CREDIT_VL15_DEDICATED_LIMIT_VL_SHIFT);
@@ -6348,9 +6361,11 @@ void reset_link_credits(struct hfi1_devdata *dd)
         for (i = 0; i < TXE_NUM_DATA_VL; i++)
                 write_csr(dd, SEND_CM_CREDIT_VL + (8 * i), 0);
         write_csr(dd, SEND_CM_CREDIT_VL15, 0);
-        write_global_credit(dd, 0, 0, 0);
+        write_csr(dd, SEND_CM_GLOBAL_CREDIT, 0);
         /* reset the CM block */
         pio_send_control(dd, PSC_CM_RESET);
+        /* reset cached value */
+        dd->vl15buf_cached = 0;
 }
 
 /* convert a vCU to a CU */
@@ -6839,24 +6854,35 @@ void handle_link_up(struct work_struct *work)
 {
         struct hfi1_pportdata *ppd = container_of(work, struct hfi1_pportdata,
                                                   link_up_work);
+        struct hfi1_devdata *dd = ppd->dd;
+
         set_link_state(ppd, HLS_UP_INIT);
 
         /* cache the read of DC_LCB_STS_ROUND_TRIP_LTP_CNT */
-        read_ltp_rtt(ppd->dd);
+        read_ltp_rtt(dd);
         /*
          * OPA specifies that certain counters are cleared on a transition
          * to link up, so do that.
          */
-        clear_linkup_counters(ppd->dd);
+        clear_linkup_counters(dd);
         /*
          * And (re)set link up default values.
          */
         set_linkup_defaults(ppd);
 
+        /*
+         * Set VL15 credits. Use cached value from verify cap interrupt.
+         * In case of quick linkup or simulator, vl15 value will be set by
+         * handle_linkup_change. VerifyCap interrupt handler will not be
+         * called in those scenarios.
+         */
+        if (!(quick_linkup || dd->icode == ICODE_FUNCTIONAL_SIMULATOR))
+                set_up_vl15(dd, dd->vl15buf_cached);
+
         /* enforce link speed enabled */
         if ((ppd->link_speed_active & ppd->link_speed_enabled) == 0) {
                 /* oops - current speed is not enabled, bounce */
-                dd_dev_err(ppd->dd,
+                dd_dev_err(dd,
                            "Link speed active 0x%x is outside enabled 0x%x, downing link\n",
                            ppd->link_speed_active, ppd->link_speed_enabled);
                 set_link_down_reason(ppd, OPA_LINKDOWN_REASON_SPEED_POLICY, 0,
@@ -7357,7 +7383,14 @@ void handle_verify_cap(struct work_struct *work)
          */
         if (vau == 0)
                 vau = 1;
-        set_up_vl15(dd, vau, vl15buf);
+        set_up_vau(dd, vau);
+
+        /*
+         * Set VL15 credits to 0 in global credit register. Cache remote VL15
+         * credits value and wait for link-up interrupt ot set it.
+         */
+        set_up_vl15(dd, 0);
+        dd->vl15buf_cached = vl15buf;
 
         /* set up the LCB CRC mode */
         crc_mask = ppd->port_crc_mode_enabled & partner_supported_crc;
diff --git a/drivers/infiniband/hw/hfi1/chip_registers.h b/drivers/infiniband/hw/hfi1/chip_registers.h
index 5bfa839d1c48..793514f1d15f 100644
--- a/drivers/infiniband/hw/hfi1/chip_registers.h
+++ b/drivers/infiniband/hw/hfi1/chip_registers.h
@@ -839,7 +839,9 @@
 #define SEND_CM_CTRL_FORCE_CREDIT_MODE_SMASK 0x8ull
 #define SEND_CM_CTRL_RESETCSR 0x0000000000000020ull
 #define SEND_CM_GLOBAL_CREDIT (TXE + 0x000000000508)
+#define SEND_CM_GLOBAL_CREDIT_AU_MASK 0x7ull
 #define SEND_CM_GLOBAL_CREDIT_AU_SHIFT 16
+#define SEND_CM_GLOBAL_CREDIT_AU_SMASK 0x70000ull
 #define SEND_CM_GLOBAL_CREDIT_RESETCSR 0x0000094000030000ull
 #define SEND_CM_GLOBAL_CREDIT_SHARED_LIMIT_MASK 0xFFFFull
 #define SEND_CM_GLOBAL_CREDIT_SHARED_LIMIT_SHIFT 0
diff --git a/drivers/infiniband/hw/hfi1/hfi.h b/drivers/infiniband/hw/hfi1/hfi.h
index da322e6668cc..414a04a481c2 100644
--- a/drivers/infiniband/hw/hfi1/hfi.h
+++ b/drivers/infiniband/hw/hfi1/hfi.h
@@ -1045,6 +1045,14 @@ struct hfi1_devdata {
         /* initial vl15 credits to use */
         u16 vl15_init;
 
+        /*
+         * Cached value for vl15buf, read during verify cap interrupt. VL15
+         * credits are to be kept at 0 and set when handling the link-up
+         * interrupt. This removes the possibility of receiving VL15 MAD
+         * packets before this HFI is ready.
+         */
+        u16 vl15buf_cached;
+
         /* Misc small ints */
         u8 n_krcv_queues;
         u8 qos_shift;
@@ -1598,7 +1606,8 @@ int hfi1_rcvbuf_validate(u32 size, u8 type, u16 *encode);
 int fm_get_table(struct hfi1_pportdata *ppd, int which, void *t);
 int fm_set_table(struct hfi1_pportdata *ppd, int which, void *t);
 
-void set_up_vl15(struct hfi1_devdata *dd, u8 vau, u16 vl15buf);
+void set_up_vau(struct hfi1_devdata *dd, u8 vau);
+void set_up_vl15(struct hfi1_devdata *dd, u16 vl15buf);
 void reset_link_credits(struct hfi1_devdata *dd);
 void assign_remote_cm_au_table(struct hfi1_devdata *dd, u8 vcu);
 
diff --git a/drivers/infiniband/hw/hfi1/intr.c b/drivers/infiniband/hw/hfi1/intr.c
index ba265d0ae93b..04a5082d5ac5 100644
--- a/drivers/infiniband/hw/hfi1/intr.c
+++ b/drivers/infiniband/hw/hfi1/intr.c
@@ -130,7 +130,8 @@ void handle_linkup_change(struct hfi1_devdata *dd, u32 linkup)
                  * the remote values.  Both sides must be using the values.
                  */
                 if (quick_linkup || dd->icode == ICODE_FUNCTIONAL_SIMULATOR) {
-                        set_up_vl15(dd, dd->vau, dd->vl15_init);
+                        set_up_vau(dd, dd->vau);
+                        set_up_vl15(dd, dd->vl15_init);
                         assign_remote_cm_au_table(dd, dd->vcu);
                 }
 
diff --git a/drivers/infiniband/hw/hfi1/pcie.c b/drivers/infiniband/hw/hfi1/pcie.c
index 93faf86d54b6..6a9f6f9819e1 100644
--- a/drivers/infiniband/hw/hfi1/pcie.c
+++ b/drivers/infiniband/hw/hfi1/pcie.c
@@ -207,8 +207,8 @@ int hfi1_pcie_ddinit(struct hfi1_devdata *dd, struct pci_dev *pdev)
         /*
          * Save BARs and command to rewrite after device reset.
          */
-        dd->pcibar0 = addr;
-        dd->pcibar1 = addr >> 32;
+        pci_read_config_dword(dd->pcidev, PCI_BASE_ADDRESS_0, &dd->pcibar0);
+        pci_read_config_dword(dd->pcidev, PCI_BASE_ADDRESS_1, &dd->pcibar1);
         pci_read_config_dword(dd->pcidev, PCI_ROM_ADDRESS, &dd->pci_rom);
         pci_read_config_word(dd->pcidev, PCI_COMMAND, &dd->pci_command);
         pcie_capability_read_word(dd->pcidev, PCI_EXP_DEVCTL, &dd->pcie_devctl);
diff --git a/drivers/infiniband/hw/hfi1/rc.c b/drivers/infiniband/hw/hfi1/rc.c
index 069bdaf061ab..1080778a1f7c 100644
--- a/drivers/infiniband/hw/hfi1/rc.c
+++ b/drivers/infiniband/hw/hfi1/rc.c
@@ -2159,8 +2159,11 @@ send_last:
                 ret = hfi1_rvt_get_rwqe(qp, 1);
                 if (ret < 0)
                         goto nack_op_err;
-                if (!ret)
+                if (!ret) {
+                        /* peer will send again */
+                        rvt_put_ss(&qp->r_sge);
                         goto rnr_nak;
+                }
                 wc.ex.imm_data = ohdr->u.rc.imm_data;
                 wc.wc_flags = IB_WC_WITH_IMM;
                 goto send_last;
diff --git a/drivers/infiniband/hw/hfi1/sysfs.c b/drivers/infiniband/hw/hfi1/sysfs.c
index 50d140d25e38..2f3bbcac1e34 100644
--- a/drivers/infiniband/hw/hfi1/sysfs.c
+++ b/drivers/infiniband/hw/hfi1/sysfs.c
@@ -196,7 +196,8 @@ static const struct sysfs_ops port_cc_sysfs_ops = {
 };
 
 static struct attribute *port_cc_default_attributes[] = {
-        &cc_prescan_attr.attr
+        &cc_prescan_attr.attr,
+        NULL
 };
 
 static struct kobj_type port_cc_ktype = {
diff --git a/drivers/infiniband/hw/i40iw/i40iw_cm.c b/drivers/infiniband/hw/i40iw/i40iw_cm.c
index f3bc01bce483..6ae98aa7f74e 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_cm.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_cm.c
@@ -784,7 +784,6 @@ static void i40iw_build_mpa_v2(struct i40iw_cm_node *cm_node,
         }
 
         ctrl_ird |= IETF_PEER_TO_PEER;
-        ctrl_ird |= IETF_FLPDU_ZERO_LEN;
 
         switch (mpa_key) {
         case MPA_KEY_REQUEST:
@@ -2446,8 +2445,8 @@ static void i40iw_handle_rcv_mpa(struct i40iw_cm_node *cm_node,
                 } else {
                         type = I40IW_CM_EVENT_CONNECTED;
                         cm_node->state = I40IW_CM_STATE_OFFLOADED;
-                        i40iw_send_ack(cm_node);
                 }
+                i40iw_send_ack(cm_node);
                 break;
         default:
                 pr_err("%s wrong cm_node state =%d\n", __func__, cm_node->state);
diff --git a/drivers/infiniband/hw/i40iw/i40iw_ctrl.c b/drivers/infiniband/hw/i40iw/i40iw_ctrl.c
index f82483b3d1e7..a027e2072477 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_ctrl.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_ctrl.c
@@ -285,28 +285,20 @@ void i40iw_change_l2params(struct i40iw_sc_vsi *vsi, struct i40iw_l2params *l2pa
         struct i40iw_sc_dev *dev = vsi->dev;
         struct i40iw_sc_qp *qp = NULL;
         bool qs_handle_change = false;
-        bool mss_change = false;
         unsigned long flags;
         u16 qs_handle;
         int i;
 
-        if (vsi->mss != l2params->mss) {
-                mss_change = true;
-                vsi->mss = l2params->mss;
-        }
+        vsi->mss = l2params->mss;
 
         i40iw_fill_qos_list(l2params->qs_handle_list);
         for (i = 0; i < I40IW_MAX_USER_PRIORITY; i++) {
                 qs_handle = l2params->qs_handle_list[i];
                 if (vsi->qos[i].qs_handle != qs_handle)
                         qs_handle_change = true;
-                else if (!mss_change)
-                        continue;       /* no MSS nor qs handle change */
                 spin_lock_irqsave(&vsi->qos[i].lock, flags);
                 qp = i40iw_get_qp(&vsi->qos[i].qplist, qp);
                 while (qp) {
-                        if (mss_change)
-                                i40iw_qp_mss_modify(dev, qp);
                         if (qs_handle_change) {
                                 qp->qs_handle = qs_handle;
                                 /* issue cqp suspend command */
@@ -2395,7 +2387,6 @@ static enum i40iw_status_code i40iw_sc_qp_modify(
 
         set_64bit_val(wqe,
                       8,
-                      LS_64(info->new_mss, I40IW_CQPSQ_QP_NEWMSS) |
                       LS_64(term_len, I40IW_CQPSQ_QP_TERMLEN));
 
         set_64bit_val(wqe, 16, qp->hw_host_ctx_pa);
@@ -2410,7 +2401,6 @@ static enum i40iw_status_code i40iw_sc_qp_modify(
                  LS_64(info->cq_num_valid, I40IW_CQPSQ_QP_CQNUMVALID) |
                  LS_64(info->force_loopback, I40IW_CQPSQ_QP_FORCELOOPBACK) |
                  LS_64(qp->qp_type, I40IW_CQPSQ_QP_QPTYPE) |
-                 LS_64(info->mss_change, I40IW_CQPSQ_QP_MSSCHANGE) |
                  LS_64(info->static_rsrc, I40IW_CQPSQ_QP_STATRSRC) |
                  LS_64(info->remove_hash_idx, I40IW_CQPSQ_QP_REMOVEHASHENTRY) |
                  LS_64(term_actions, I40IW_CQPSQ_QP_TERMACT) |
diff --git a/drivers/infiniband/hw/i40iw/i40iw_main.c b/drivers/infiniband/hw/i40iw/i40iw_main.c
index 2728af3103ce..a3f18a22f5ed 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_main.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_main.c
@@ -1319,13 +1319,13 @@ static enum i40iw_status_code i40iw_initialize_dev(struct i40iw_device *iwdev,
         status = i40iw_obj_aligned_mem(iwdev, &mem, I40IW_QUERY_FPM_BUF_SIZE,
                                        I40IW_FPM_QUERY_BUF_ALIGNMENT_MASK);
         if (status)
-                goto exit;
+                goto error;
         info.fpm_query_buf_pa = mem.pa;
         info.fpm_query_buf = mem.va;
         status = i40iw_obj_aligned_mem(iwdev, &mem, I40IW_COMMIT_FPM_BUF_SIZE,
                                        I40IW_FPM_COMMIT_BUF_ALIGNMENT_MASK);
         if (status)
-                goto exit;
+                goto error;
         info.fpm_commit_buf_pa = mem.pa;
         info.fpm_commit_buf = mem.va;
         info.hmc_fn_id = ldev->fid;
@@ -1347,11 +1347,9 @@ static enum i40iw_status_code i40iw_initialize_dev(struct i40iw_device *iwdev,
         info.exception_lan_queue = 1;
         info.vchnl_send = i40iw_virtchnl_send;
         status = i40iw_device_init(&iwdev->sc_dev, &info);
-exit:
-        if (status) {
-                kfree(iwdev->hmc_info_mem);
-                iwdev->hmc_info_mem = NULL;
-        }
+
+        if (status)
+                goto error;
         memset(&vsi_info, 0, sizeof(vsi_info));
         vsi_info.dev = &iwdev->sc_dev;
         vsi_info.back_vsi = (void *)iwdev;
@@ -1362,11 +1360,19 @@ exit:
                 memset(&stats_info, 0, sizeof(stats_info));
                 stats_info.fcn_id = ldev->fid;
                 stats_info.pestat = kzalloc(sizeof(*stats_info.pestat), GFP_KERNEL);
+                if (!stats_info.pestat) {
+                        status = I40IW_ERR_NO_MEMORY;
+                        goto error;
+                }
                 stats_info.stats_initialize = true;
                 if (stats_info.pestat)
                         i40iw_vsi_stats_init(&iwdev->vsi, &stats_info);
         }
         return status;
+error:
+        kfree(iwdev->hmc_info_mem);
+        iwdev->hmc_info_mem = NULL;
+        return status;
 }
 
 /**
diff --git a/drivers/infiniband/hw/i40iw/i40iw_osdep.h b/drivers/infiniband/hw/i40iw/i40iw_osdep.h
index aa66c1c63dfa..f27be3e7830b 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_osdep.h
+++ b/drivers/infiniband/hw/i40iw/i40iw_osdep.h
@@ -199,7 +199,6 @@ void i40iw_cqp_spawn_worker(struct i40iw_sc_dev *dev,
                             struct i40iw_virtchnl_work_info *work_info, u32 iw_vf_idx);
 void *i40iw_remove_head(struct list_head *list);
 void i40iw_qp_suspend_resume(struct i40iw_sc_dev *dev, struct i40iw_sc_qp *qp, bool suspend);
-void i40iw_qp_mss_modify(struct i40iw_sc_dev *dev, struct i40iw_sc_qp *qp);
 
 void i40iw_term_modify_qp(struct i40iw_sc_qp *qp, u8 next_state, u8 term, u8 term_len);
 void i40iw_terminate_done(struct i40iw_sc_qp *qp, int timeout_occurred);
diff --git a/drivers/infiniband/hw/i40iw/i40iw_type.h b/drivers/infiniband/hw/i40iw/i40iw_type.h
index 7b76259752b0..959ec81fba99 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_type.h
+++ b/drivers/infiniband/hw/i40iw/i40iw_type.h
@@ -541,7 +541,6 @@ struct i40iw_create_qp_info {
 struct i40iw_modify_qp_info {
         u64 rx_win0;
         u64 rx_win1;
-        u16 new_mss;
         u8 next_iwarp_state;
         u8 termlen;
         bool ord_valid;
@@ -554,7 +553,6 @@ struct i40iw_modify_qp_info {
         bool dont_send_term;
         bool dont_send_fin;
         bool cached_var_valid;
-        bool mss_change;
         bool force_loopback;
 };
 
diff --git a/drivers/infiniband/hw/i40iw/i40iw_utils.c b/drivers/infiniband/hw/i40iw/i40iw_utils.c
index 409a3781e735..56d986924a4c 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_utils.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_utils.c
@@ -757,23 +757,6 @@ void i40iw_qp_suspend_resume(struct i40iw_sc_dev *dev, struct i40iw_sc_qp *qp, b
 }
 
 /**
- * i40iw_qp_mss_modify - modify mss for qp
- * @dev: hardware control device structure
- * @qp: hardware control qp
- */
-void i40iw_qp_mss_modify(struct i40iw_sc_dev *dev, struct i40iw_sc_qp *qp)
-{
-        struct i40iw_device *iwdev = (struct i40iw_device *)dev->back_dev;
-        struct i40iw_qp *iwqp = (struct i40iw_qp *)qp->back_qp;
-        struct i40iw_modify_qp_info info;
-
-        memset(&info, 0, sizeof(info));
-        info.mss_change = true;
-        info.new_mss = qp->vsi->mss;
-        i40iw_hw_modify_qp(iwdev, iwqp, &info, false);
-}
-
-/**
  * i40iw_term_modify_qp - modify qp for term message
  * @qp: hardware control qp
  * @next_state: qp's next state
diff --git a/drivers/infiniband/hw/i40iw/i40iw_virtchnl.c b/drivers/infiniband/hw/i40iw/i40iw_virtchnl.c
index f4d13683a403..48fd327f876b 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_virtchnl.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_virtchnl.c
@@ -443,10 +443,7 @@ enum i40iw_status_code i40iw_vchnl_recv_pf(struct i40iw_sc_dev *dev,
         if (!dev->vchnl_up)
                 return I40IW_ERR_NOT_READY;
         if (vchnl_msg->iw_op_code == I40IW_VCHNL_OP_GET_VER) {
-                if (vchnl_msg->iw_op_ver != I40IW_VCHNL_OP_GET_VER_V0)
-                        vchnl_pf_send_get_ver_resp(dev, vf_id, vchnl_msg);
-                else
-                        vchnl_pf_send_get_ver_resp(dev, vf_id, vchnl_msg);
+                vchnl_pf_send_get_ver_resp(dev, vf_id, vchnl_msg);
                 return I40IW_SUCCESS;
         }
         for (iw_vf_idx = 0; iw_vf_idx < I40IW_MAX_PE_ENABLED_VF_COUNT; iw_vf_idx++) {
diff --git a/drivers/infiniband/hw/mlx4/mad.c b/drivers/infiniband/hw/mlx4/mad.c
index b4694717f6f3..21d31cb1325f 100644
--- a/drivers/infiniband/hw/mlx4/mad.c
+++ b/drivers/infiniband/hw/mlx4/mad.c
@@ -1578,6 +1578,7 @@ static void mlx4_ib_multiplex_mad(struct mlx4_ib_demux_pv_ctx *ctx, struct ib_wc
         if (port < 0)
                 return;
         ah.av.ib.port_pd = cpu_to_be32(port << 24 | (be32_to_cpu(ah.av.ib.port_pd) & 0xffffff));
+        ah.ibah.type = rdma_ah_find_type(&dev->ib_dev, port);
 
         mlx4_ib_query_ah(&ah.ibah, &ah_attr);
         if (rdma_ah_get_ah_flags(&ah_attr) & IB_AH_GRH)
diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
index d45772da0963..9ecc089d4529 100644
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -2979,6 +2979,18 @@ error_0:
         return ret;
 }
 
+static u8 mlx5_get_umr_fence(u8 umr_fence_cap)
+{
+        switch (umr_fence_cap) {
+        case MLX5_CAP_UMR_FENCE_NONE:
+                return MLX5_FENCE_MODE_NONE;
+        case MLX5_CAP_UMR_FENCE_SMALL:
+                return MLX5_FENCE_MODE_INITIATOR_SMALL;
+        default:
+                return MLX5_FENCE_MODE_STRONG_ORDERING;
+        }
+}
+
 static int create_dev_resources(struct mlx5_ib_resources *devr)
 {
         struct ib_srq_init_attr attr;
@@ -3680,8 +3692,10 @@ static void *mlx5_ib_add(struct mlx5_core_dev *mdev)
         dev->ib_dev.check_mr_status     = mlx5_ib_check_mr_status;
         dev->ib_dev.get_port_immutable  = mlx5_port_immutable;
         dev->ib_dev.get_dev_fw_str      = get_dev_fw_str;
-        dev->ib_dev.alloc_rdma_netdev   = mlx5_ib_alloc_rdma_netdev;
-        dev->ib_dev.free_rdma_netdev    = mlx5_ib_free_rdma_netdev;
+        if (MLX5_CAP_GEN(mdev, ipoib_enhanced_offloads)) {
+                dev->ib_dev.alloc_rdma_netdev   = mlx5_ib_alloc_rdma_netdev;
+                dev->ib_dev.free_rdma_netdev    = mlx5_ib_free_rdma_netdev;
+        }
         if (mlx5_core_is_pf(mdev)) {
                 dev->ib_dev.get_vf_config       = mlx5_ib_get_vf_config;
                 dev->ib_dev.set_vf_link_state   = mlx5_ib_set_vf_link_state;
@@ -3693,6 +3707,8 @@ static void *mlx5_ib_add(struct mlx5_core_dev *mdev)
 
         mlx5_ib_internal_fill_odp_caps(dev);
 
+        dev->umr_fence = mlx5_get_umr_fence(MLX5_CAP_GEN(mdev, umr_fence));
+
         if (MLX5_CAP_GEN(mdev, imaicl)) {
                 dev->ib_dev.alloc_mw            = mlx5_ib_alloc_mw;
                 dev->ib_dev.dealloc_mw          = mlx5_ib_dealloc_mw;
diff --git a/drivers/infiniband/hw/mlx5/mlx5_ib.h b/drivers/infiniband/hw/mlx5/mlx5_ib.h
index 38c877bc45e5..bdcf25410c99 100644
--- a/drivers/infiniband/hw/mlx5/mlx5_ib.h
+++ b/drivers/infiniband/hw/mlx5/mlx5_ib.h
@@ -349,7 +349,7 @@ struct mlx5_ib_qp {
         struct mlx5_ib_wq       rq;
 
         u8                      sq_signal_bits;
-        u8                      fm_cache;
+        u8                      next_fence;
         struct mlx5_ib_wq       sq;
 
         /* serialize qp state modifications
@@ -654,6 +654,7 @@ struct mlx5_ib_dev {
         struct mlx5_ib_port     *port;
         struct mlx5_sq_bfreg     bfreg;
         struct mlx5_sq_bfreg     fp_bfreg;
+        u8                              umr_fence;
 };
 
 static inline struct mlx5_ib_cq *to_mibcq(struct mlx5_core_cq *mcq)
diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
index 93959e1e43a3..ebb6768684de 100644
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -3738,24 +3738,6 @@ static void dump_wqe(struct mlx5_ib_qp *qp, int idx, int size_16)
         }
 }
 
-static u8 get_fence(u8 fence, struct ib_send_wr *wr)
-{
-        if (unlikely(wr->opcode == IB_WR_LOCAL_INV &&
-                     wr->send_flags & IB_SEND_FENCE))
-                return MLX5_FENCE_MODE_STRONG_ORDERING;
-
-        if (unlikely(fence)) {
-                if (wr->send_flags & IB_SEND_FENCE)
-                        return MLX5_FENCE_MODE_SMALL_AND_FENCE;
-                else
-                        return fence;
-        } else if (unlikely(wr->send_flags & IB_SEND_FENCE)) {
-                return MLX5_FENCE_MODE_FENCE;
-        }
-
-        return 0;
-}
-
 static int begin_wqe(struct mlx5_ib_qp *qp, void **seg,
                      struct mlx5_wqe_ctrl_seg **ctrl,
                      struct ib_send_wr *wr, unsigned *idx,
@@ -3784,8 +3766,7 @@ static int begin_wqe(struct mlx5_ib_qp *qp, void **seg,
 static void finish_wqe(struct mlx5_ib_qp *qp,
                        struct mlx5_wqe_ctrl_seg *ctrl,
                        u8 size, unsigned idx, u64 wr_id,
-                       int nreq, u8 fence, u8 next_fence,
-                       u32 mlx5_opcode)
+                       int nreq, u8 fence, u32 mlx5_opcode)
 {
         u8 opmod = 0;
 
@@ -3793,7 +3774,6 @@ static void finish_wqe(struct mlx5_ib_qp *qp,
                                              mlx5_opcode | ((u32)opmod << 24));
         ctrl->qpn_ds = cpu_to_be32(size | (qp->trans_qp.base.mqp.qpn << 8));
         ctrl->fm_ce_se |= fence;
-        qp->fm_cache = next_fence;
         if (unlikely(qp->wq_sig))
                 ctrl->signature = wq_sig(ctrl);
 
@@ -3853,7 +3833,6 @@ int mlx5_ib_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                         goto out;
                 }
 
-                fence = qp->fm_cache;
                 num_sge = wr->num_sge;
                 if (unlikely(num_sge > qp->sq.max_gs)) {
                         mlx5_ib_warn(dev, "\n");
@@ -3870,6 +3849,19 @@ int mlx5_ib_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                         goto out;
                 }
 
+                if (wr->opcode == IB_WR_LOCAL_INV ||
+                    wr->opcode == IB_WR_REG_MR) {
+                        fence = dev->umr_fence;
+                        next_fence = MLX5_FENCE_MODE_INITIATOR_SMALL;
+                } else if (wr->send_flags & IB_SEND_FENCE) {
+                        if (qp->next_fence)
+                                fence = MLX5_FENCE_MODE_SMALL_AND_FENCE;
+                        else
+                                fence = MLX5_FENCE_MODE_FENCE;
+                } else {
+                        fence = qp->next_fence;
+                }
+
                 switch (ibqp->qp_type) {
                 case IB_QPT_XRC_INI:
                         xrc = seg;
@@ -3896,7 +3888,6 @@ int mlx5_ib_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                                 goto out;
 
                         case IB_WR_LOCAL_INV:
-                                next_fence = MLX5_FENCE_MODE_INITIATOR_SMALL;
                                 qp->sq.wr_data[idx] = IB_WR_LOCAL_INV;
                                 ctrl->imm = cpu_to_be32(wr->ex.invalidate_rkey);
                                 set_linv_wr(qp, &seg, &size);
@@ -3904,7 +3895,6 @@ int mlx5_ib_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                                 break;
 
                         case IB_WR_REG_MR:
-                                next_fence = MLX5_FENCE_MODE_INITIATOR_SMALL;
                                 qp->sq.wr_data[idx] = IB_WR_REG_MR;
                                 ctrl->imm = cpu_to_be32(reg_wr(wr)->key);
                                 err = set_reg_wr(qp, reg_wr(wr), &seg, &size);
@@ -3927,9 +3917,8 @@ int mlx5_ib_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                                         goto out;
                                 }
 
-                                finish_wqe(qp, ctrl, size, idx, wr->wr_id,
-                                           nreq, get_fence(fence, wr),
-                                           next_fence, MLX5_OPCODE_UMR);
+                                finish_wqe(qp, ctrl, size, idx, wr->wr_id, nreq,
+                                           fence, MLX5_OPCODE_UMR);
                                 /*
                                  * SET_PSV WQEs are not signaled and solicited
                                  * on error
@@ -3954,9 +3943,8 @@ int mlx5_ib_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                                         goto out;
                                 }
 
-                                finish_wqe(qp, ctrl, size, idx, wr->wr_id,
-                                           nreq, get_fence(fence, wr),
-                                           next_fence, MLX5_OPCODE_SET_PSV);
+                                finish_wqe(qp, ctrl, size, idx, wr->wr_id, nreq,
+                                           fence, MLX5_OPCODE_SET_PSV);
                                 err = begin_wqe(qp, &seg, &ctrl, wr,
                                                 &idx, &size, nreq);
                                 if (err) {
@@ -3966,7 +3954,6 @@ int mlx5_ib_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                                         goto out;
                                 }
 
-                                next_fence = MLX5_FENCE_MODE_INITIATOR_SMALL;
                                 err = set_psv_wr(&sig_handover_wr(wr)->sig_attrs->wire,
                                                  mr->sig->psv_wire.psv_idx, &seg,
                                                  &size);
@@ -3976,9 +3963,9 @@ int mlx5_ib_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                                         goto out;
                                 }
 
-                                finish_wqe(qp, ctrl, size, idx, wr->wr_id,
-                                           nreq, get_fence(fence, wr),
-                                           next_fence, MLX5_OPCODE_SET_PSV);
+                                finish_wqe(qp, ctrl, size, idx, wr->wr_id, nreq,
+                                           fence, MLX5_OPCODE_SET_PSV);
+                                qp->next_fence = MLX5_FENCE_MODE_INITIATOR_SMALL;
                                 num_sge = 0;
                                 goto skip_psv;
 
@@ -4089,8 +4076,8 @@ int mlx5_ib_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                         }
                 }
 
-                finish_wqe(qp, ctrl, size, idx, wr->wr_id, nreq,
-                           get_fence(fence, wr), next_fence,
+                qp->next_fence = next_fence;
+                finish_wqe(qp, ctrl, size, idx, wr->wr_id, nreq, fence,
                            mlx5_ib_opcode[wr->opcode]);
 skip_psv:
                 if (0)
diff --git a/drivers/infiniband/hw/nes/nes_cm.c b/drivers/infiniband/hw/nes/nes_cm.c
index fb983df7c157..30b256a2c54e 100644
--- a/drivers/infiniband/hw/nes/nes_cm.c
+++ b/drivers/infiniband/hw/nes/nes_cm.c
@@ -610,7 +610,6 @@ static void build_mpa_v2(struct nes_cm_node *cm_node,
                 ctrl_ord = cm_node->ord_size & IETF_NO_IRD_ORD;
         }
         ctrl_ird |= IETF_PEER_TO_PEER;
-        ctrl_ird |= IETF_FLPDU_ZERO_LEN;
 
         switch (mpa_key) {
         case MPA_KEY_REQUEST:
@@ -1826,7 +1825,7 @@ static void handle_rcv_mpa(struct nes_cm_node *cm_node, struct sk_buff *skb)
                         type = NES_CM_EVENT_CONNECTED;
                         cm_node->state = NES_CM_STATE_TSA;
                 }
-
+                send_ack(cm_node, NULL);
                 break;
         default:
                 WARN_ON(1);
diff --git a/drivers/infiniband/hw/qedr/qedr.h b/drivers/infiniband/hw/qedr/qedr.h
index aa08c76a4245..d961f79b317c 100644
--- a/drivers/infiniband/hw/qedr/qedr.h
+++ b/drivers/infiniband/hw/qedr/qedr.h
@@ -58,7 +58,10 @@
 #define QEDR_MSG_QP   "  QP"
 #define QEDR_MSG_GSI  " GSI"
 
-#define QEDR_CQ_MAGIC_NUMBER   (0x11223344)
+#define QEDR_CQ_MAGIC_NUMBER    (0x11223344)
+
+#define FW_PAGE_SIZE            (RDMA_RING_PAGE_SIZE)
+#define FW_PAGE_SHIFT           (12)
 
 struct qedr_dev;
 
diff --git a/drivers/infiniband/hw/qedr/qedr_cm.c b/drivers/infiniband/hw/qedr/qedr_cm.c
index 3d7705cec770..d86dbe814d98 100644
--- a/drivers/infiniband/hw/qedr/qedr_cm.c
+++ b/drivers/infiniband/hw/qedr/qedr_cm.c
@@ -270,11 +270,13 @@ static inline int qedr_gsi_build_header(struct qedr_dev *dev,
                 return rc;
         }
 
-        vlan_id = rdma_vlan_dev_vlan_id(sgid_attr.ndev);
-        if (vlan_id < VLAN_CFI_MASK)
-                has_vlan = true;
-        if (sgid_attr.ndev)
+        if (sgid_attr.ndev) {
+                vlan_id = rdma_vlan_dev_vlan_id(sgid_attr.ndev);
+                if (vlan_id < VLAN_CFI_MASK)
+                        has_vlan = true;
+
                 dev_put(sgid_attr.ndev);
+        }
 
         if (!memcmp(&sgid, &zgid, sizeof(sgid))) {
                 DP_ERR(dev, "gsi post send: GID not found GID index %d\n",
diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c
index 17685cfea6a2..d6723c365c7f 100644
--- a/drivers/infiniband/hw/qedr/verbs.c
+++ b/drivers/infiniband/hw/qedr/verbs.c
@@ -653,14 +653,15 @@ static int qedr_prepare_pbl_tbl(struct qedr_dev *dev,
 
 static void qedr_populate_pbls(struct qedr_dev *dev, struct ib_umem *umem,
                                struct qedr_pbl *pbl,
-                               struct qedr_pbl_info *pbl_info)
+                               struct qedr_pbl_info *pbl_info, u32 pg_shift)
 {
         int shift, pg_cnt, pages, pbe_cnt, total_num_pbes = 0;
+        u32 fw_pg_cnt, fw_pg_per_umem_pg;
         struct qedr_pbl *pbl_tbl;
         struct scatterlist *sg;
         struct regpair *pbe;
+        u64 pg_addr;
         int entry;
-        u32 addr;
 
         if (!pbl_info->num_pbes)
                 return;
@@ -683,29 +684,35 @@ static void qedr_populate_pbls(struct qedr_dev *dev, struct ib_umem *umem,
 
         shift = umem->page_shift;
 
+        fw_pg_per_umem_pg = BIT(umem->page_shift - pg_shift);
+
         for_each_sg(umem->sg_head.sgl, sg, umem->nmap, entry) {
                 pages = sg_dma_len(sg) >> shift;
+                pg_addr = sg_dma_address(sg);
                 for (pg_cnt = 0; pg_cnt < pages; pg_cnt++) {
-                        /* store the page address in pbe */
-                        pbe->lo = cpu_to_le32(sg_dma_address(sg) +
-                                              (pg_cnt << shift));
-                        addr = upper_32_bits(sg_dma_address(sg) +
-                                             (pg_cnt << shift));
-                        pbe->hi = cpu_to_le32(addr);
-                        pbe_cnt++;
-                        total_num_pbes++;
-                        pbe++;
-
-                        if (total_num_pbes == pbl_info->num_pbes)
-                                return;
-
-                        /* If the given pbl is full storing the pbes,
-                         * move to next pbl.
-                         */
-                        if (pbe_cnt == (pbl_info->pbl_size / sizeof(u64))) {
-                                pbl_tbl++;
-                                pbe = (struct regpair *)pbl_tbl->va;
-                                pbe_cnt = 0;
+                        for (fw_pg_cnt = 0; fw_pg_cnt < fw_pg_per_umem_pg;) {
+                                pbe->lo = cpu_to_le32(pg_addr);
+                                pbe->hi = cpu_to_le32(upper_32_bits(pg_addr));
+
+                                pg_addr += BIT(pg_shift);
+                                pbe_cnt++;
+                                total_num_pbes++;
+                                pbe++;
+
+                                if (total_num_pbes == pbl_info->num_pbes)
+                                        return;
+
+                                /* If the given pbl is full storing the pbes,
+                                 * move to next pbl.
+                                 */
+                                if (pbe_cnt ==
+                                    (pbl_info->pbl_size / sizeof(u64))) {
+                                        pbl_tbl++;
+                                        pbe = (struct regpair *)pbl_tbl->va;
+                                        pbe_cnt = 0;
+                                }
+
+                                fw_pg_cnt++;
                         }
                 }
         }
@@ -754,7 +761,7 @@ static inline int qedr_init_user_queue(struct ib_ucontext *ib_ctx,
                                        u64 buf_addr, size_t buf_len,
                                        int access, int dmasync)
 {
-        int page_cnt;
+        u32 fw_pages;
         int rc;
 
         q->buf_addr = buf_addr;
@@ -766,8 +773,10 @@ static inline int qedr_init_user_queue(struct ib_ucontext *ib_ctx,
                 return PTR_ERR(q->umem);
         }
 
-        page_cnt = ib_umem_page_count(q->umem);
-        rc = qedr_prepare_pbl_tbl(dev, &q->pbl_info, page_cnt, 0);
+        fw_pages = ib_umem_page_count(q->umem) <<
+            (q->umem->page_shift - FW_PAGE_SHIFT);
+
+        rc = qedr_prepare_pbl_tbl(dev, &q->pbl_info, fw_pages, 0);
         if (rc)
                 goto err0;
 
@@ -777,7 +786,8 @@ static inline int qedr_init_user_queue(struct ib_ucontext *ib_ctx,
                 goto err0;
         }
 
-        qedr_populate_pbls(dev, q->umem, q->pbl_tbl, &q->pbl_info);
+                qedr_populate_pbls(dev, q->umem, q->pbl_tbl, &q->pbl_info,
+                                   FW_PAGE_SHIFT);
 
         return 0;
 
@@ -2226,7 +2236,7 @@ struct ib_mr *qedr_reg_user_mr(struct ib_pd *ibpd, u64 start, u64 len,
                 goto err1;
 
         qedr_populate_pbls(dev, mr->umem, mr->info.pbl_table,
-                           &mr->info.pbl_info);
+                           &mr->info.pbl_info, mr->umem->page_shift);
 
         rc = dev->ops->rdma_alloc_tid(dev->rdma_ctx, &mr->hw_mr.itid);
         if (rc) {
@@ -3209,6 +3219,10 @@ static int process_req(struct qedr_dev *dev, struct qedr_qp *qp,
                 case IB_WC_REG_MR:
                         qp->wqe_wr_id[qp->sq.cons].mr->info.completed++;
                         break;
+                case IB_WC_RDMA_READ:
+                case IB_WC_SEND:
+                        wc->byte_len = qp->wqe_wr_id[qp->sq.cons].bytes_len;
+                        break;
                 default:
                         break;
                 }
diff --git a/drivers/infiniband/hw/qib/qib_rc.c b/drivers/infiniband/hw/qib/qib_rc.c
index fc8b88514da5..4ddbcac5eabe 100644
--- a/drivers/infiniband/hw/qib/qib_rc.c
+++ b/drivers/infiniband/hw/qib/qib_rc.c
@@ -1956,8 +1956,10 @@ send_last:
                 ret = qib_get_rwqe(qp, 1);
                 if (ret < 0)
                         goto nack_op_err;
-                if (!ret)
+                if (!ret) {
+                        rvt_put_ss(&qp->r_sge);
                         goto rnr_nak;
+                }
                 wc.ex.imm_data = ohdr->u.rc.imm_data;
                 hdrsize += 4;
                 wc.wc_flags = IB_WC_WITH_IMM;
diff --git a/drivers/infiniband/sw/rxe/rxe.h b/drivers/infiniband/sw/rxe/rxe.h
index ecdba2fce083..1ac5b8551a4d 100644
--- a/drivers/infiniband/sw/rxe/rxe.h
+++ b/drivers/infiniband/sw/rxe/rxe.h
@@ -68,6 +68,7 @@
 static inline u32 rxe_crc32(struct rxe_dev *rxe,
                             u32 crc, void *next, size_t len)
 {
+        u32 retval;
         int err;
 
         SHASH_DESC_ON_STACK(shash, rxe->tfm);
@@ -81,7 +82,9 @@ static inline u32 rxe_crc32(struct rxe_dev *rxe,
                 return crc32_le(crc, next, len);
         }
 
-        return *(u32 *)shash_desc_ctx(shash);
+        retval = *(u32 *)shash_desc_ctx(shash);
+        barrier_data(shash_desc_ctx(shash));
+        return retval;
 }
 
 int rxe_set_mtu(struct rxe_dev *rxe, unsigned int dev_mtu);
diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.c b/drivers/infiniband/sw/rxe/rxe_verbs.c
index 83d709e74dfb..073e66783f1d 100644
--- a/drivers/infiniband/sw/rxe/rxe_verbs.c
+++ b/drivers/infiniband/sw/rxe/rxe_verbs.c
@@ -740,13 +740,8 @@ static int init_send_wqe(struct rxe_qp *qp, struct ib_send_wr *ibwr,
 
                 sge = ibwr->sg_list;
                 for (i = 0; i < num_sge; i++, sge++) {
-                        if (qp->is_user && copy_from_user(p, (__user void *)
-                                            (uintptr_t)sge->addr, sge->length))
-                                return -EFAULT;
-
-                        else if (!qp->is_user)
-                                memcpy(p, (void *)(uintptr_t)sge->addr,
-                                       sge->length);
+                        memcpy(p, (void *)(uintptr_t)sge->addr,
+                                        sge->length);
 
                         p += sge->length;
                 }
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ethtool.c b/drivers/infiniband/ulp/ipoib/ipoib_ethtool.c
index 874b24366e4d..7871379342f4 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_ethtool.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_ethtool.c
@@ -178,7 +178,7 @@ static inline int ib_speed_enum_to_int(int speed)
 static int ipoib_get_link_ksettings(struct net_device *netdev,
                                     struct ethtool_link_ksettings *cmd)
 {
-        struct ipoib_dev_priv *priv = netdev_priv(netdev);
+        struct ipoib_dev_priv *priv = ipoib_priv(netdev);
         struct ib_port_attr attr;
         int ret, speed, width;
 
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
index 0060b2f9f659..efe7402f4885 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
@@ -863,7 +863,6 @@ dev_stop:
         set_bit(IPOIB_STOP_REAPER, &priv->flags);
         cancel_delayed_work(&priv->ah_reap_task);
         set_bit(IPOIB_FLAG_INITIALIZED, &priv->flags);
-        napi_enable(&priv->napi);
         ipoib_ib_dev_stop(dev);
         return -1;
 }
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index 2869d1adb1de..1015a63de6ae 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -1590,12 +1590,14 @@ static void ipoib_neigh_hash_uninit(struct net_device *dev)
         wait_for_completion(&priv->ntbl.deleted);
 }
 
-void ipoib_dev_uninit_default(struct net_device *dev)
+static void ipoib_dev_uninit_default(struct net_device *dev)
 {
         struct ipoib_dev_priv *priv = ipoib_priv(dev);
 
         ipoib_transport_dev_cleanup(dev);
 
+        netif_napi_del(&priv->napi);
+
         ipoib_cm_dev_cleanup(dev);
 
         kfree(priv->rx_ring);
@@ -1649,6 +1651,7 @@ out_rx_ring_cleanup:
         kfree(priv->rx_ring);
 
 out:
+        netif_napi_del(&priv->napi);
         return -ENOMEM;
 }
 
@@ -2237,6 +2240,7 @@ event_failed:
 
 device_init_failed:
         free_netdev(priv->dev);
+        kfree(priv);
 
 alloc_mem_failed:
         return ERR_PTR(result);
@@ -2277,7 +2281,7 @@ static void ipoib_add_one(struct ib_device *device)
 
 static void ipoib_remove_one(struct ib_device *device, void *client_data)
 {
-        struct ipoib_dev_priv *priv, *tmp;
+        struct ipoib_dev_priv *priv, *tmp, *cpriv, *tcpriv;
         struct list_head *dev_list = client_data;
 
         if (!dev_list)
@@ -2300,7 +2304,14 @@ static void ipoib_remove_one(struct ib_device *device, void *client_data)
                 flush_workqueue(priv->wq);
 
                 unregister_netdev(priv->dev);
-                free_netdev(priv->dev);
+                if (device->free_rdma_netdev)
+                        device->free_rdma_netdev(priv->dev);
+                else
+                        free_netdev(priv->dev);
+
+                list_for_each_entry_safe(cpriv, tcpriv, &priv->child_intfs, list)
+                        kfree(cpriv);
+
                 kfree(priv);
         }
 
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_vlan.c b/drivers/infiniband/ulp/ipoib/ipoib_vlan.c
index 36dc4fcaa3cd..081b33deff1b 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_vlan.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_vlan.c
@@ -133,13 +133,13 @@ int ipoib_vlan_add(struct net_device *pdev, unsigned short pkey)
         snprintf(intf_name, sizeof intf_name, "%s.%04x",
                  ppriv->dev->name, pkey);
 
+        if (!rtnl_trylock())
+                return restart_syscall();
+
         priv = ipoib_intf_alloc(ppriv->ca, ppriv->port, intf_name);
         if (!priv)
                 return -ENOMEM;
 
-        if (!rtnl_trylock())
-                return restart_syscall();
-
         down_write(&ppriv->vlan_rwsem);
 
         /*
@@ -167,8 +167,10 @@ out:
 
         rtnl_unlock();
 
-        if (result)
+        if (result) {
                 free_netdev(priv->dev);
+                kfree(priv);
+        }
 
         return result;
 }
@@ -209,6 +211,7 @@ int ipoib_vlan_delete(struct net_device *pdev, unsigned short pkey)
 
         if (dev) {
                 free_netdev(dev);
+                kfree(priv);
                 return 0;
         }
 
diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
index def723a5df29..2354c742caa1 100644
--- a/drivers/infiniband/ulp/srp/ib_srp.c
+++ b/drivers/infiniband/ulp/srp/ib_srp.c
@@ -320,7 +320,7 @@ static int srp_new_cm_id(struct srp_rdma_ch *ch)
         ch->path.sgid = target->sgid;
         ch->path.dgid = target->orig_dgid;
         ch->path.pkey = target->pkey;
-        sa_path_set_service_id(&ch->path, target->service_id);
+        ch->path.service_id = target->service_id;
 
         return 0;
 }
@@ -575,7 +575,7 @@ static int srp_create_ch_ib(struct srp_rdma_ch *ch)
         return 0;
 
 err_qp:
-        srp_destroy_qp(ch, qp);
+        ib_destroy_qp(qp);
 
 err_send_cq:
         ib_free_cq(send_cq);
diff --git a/drivers/input/input.c b/drivers/input/input.c
index 7e6842bd525c..d268fdc23c64 100644
--- a/drivers/input/input.c
+++ b/drivers/input/input.c
@@ -1398,7 +1398,7 @@ static struct attribute *input_dev_attrs[] = {
         NULL
 };
 
-static struct attribute_group input_dev_attr_group = {
+static const struct attribute_group input_dev_attr_group = {
         .attrs  = input_dev_attrs,
 };
 
@@ -1425,7 +1425,7 @@ static struct attribute *input_dev_id_attrs[] = {
         NULL
 };
 
-static struct attribute_group input_dev_id_attr_group = {
+static const struct attribute_group input_dev_id_attr_group = {
         .name   = "id",
         .attrs  = input_dev_id_attrs,
 };
@@ -1495,7 +1495,7 @@ static struct attribute *input_dev_caps_attrs[] = {
         NULL
 };
 
-static struct attribute_group input_dev_caps_attr_group = {
+static const struct attribute_group input_dev_caps_attr_group = {
         .name   = "capabilities",
         .attrs  = input_dev_caps_attrs,
 };
diff --git a/drivers/input/joystick/iforce/iforce-serio.c b/drivers/input/joystick/iforce/iforce-serio.c
index 46d5041d2d9d..154e827b559b 100644
--- a/drivers/input/joystick/iforce/iforce-serio.c
+++ b/drivers/input/joystick/iforce/iforce-serio.c
@@ -164,7 +164,7 @@ static void iforce_serio_disconnect(struct serio *serio)
         kfree(iforce);
 }
 
-static struct serio_device_id iforce_serio_ids[] = {
+static const struct serio_device_id iforce_serio_ids[] = {
         {
                 .type   = SERIO_RS232,
                 .proto  = SERIO_IFORCE,
diff --git a/drivers/input/joystick/iforce/iforce-usb.c b/drivers/input/joystick/iforce/iforce-usb.c
index db64adfbe1af..e8724f1a4a25 100644
--- a/drivers/input/joystick/iforce/iforce-usb.c
+++ b/drivers/input/joystick/iforce/iforce-usb.c
@@ -209,7 +209,7 @@ static void iforce_usb_disconnect(struct usb_interface *intf)
         kfree(iforce);
 }
 
-static struct usb_device_id iforce_usb_ids [] = {
+static const struct usb_device_id iforce_usb_ids[] = {
         { USB_DEVICE(0x044f, 0xa01c) },         /* Thrustmaster Motor Sport GT */
         { USB_DEVICE(0x046d, 0xc281) },         /* Logitech WingMan Force */
         { USB_DEVICE(0x046d, 0xc291) },         /* Logitech WingMan Formula Force */
diff --git a/drivers/input/joystick/magellan.c b/drivers/input/joystick/magellan.c
index c5358ba1f571..a9d0e3edca94 100644
--- a/drivers/input/joystick/magellan.c
+++ b/drivers/input/joystick/magellan.c
@@ -198,7 +198,7 @@ static int magellan_connect(struct serio *serio, struct serio_driver *drv)
  * The serio driver structure.
  */
 
-static struct serio_device_id magellan_serio_ids[] = {
+static const struct serio_device_id magellan_serio_ids[] = {
         {
                 .type   = SERIO_RS232,
                 .proto  = SERIO_MAGELLAN,
diff --git a/drivers/input/joystick/spaceball.c b/drivers/input/joystick/spaceball.c
index f4445a4e8d6a..e9712a1b7cad 100644
--- a/drivers/input/joystick/spaceball.c
+++ b/drivers/input/joystick/spaceball.c
@@ -272,7 +272,7 @@ static int spaceball_connect(struct serio *serio, struct serio_driver *drv)
  * The serio driver structure.
  */
 
-static struct serio_device_id spaceball_serio_ids[] = {
+static const struct serio_device_id spaceball_serio_ids[] = {
         {
                 .type   = SERIO_RS232,
                 .proto  = SERIO_SPACEBALL,
diff --git a/drivers/input/joystick/spaceorb.c b/drivers/input/joystick/spaceorb.c
index f2667820e8c5..05da0ed514e2 100644
--- a/drivers/input/joystick/spaceorb.c
+++ b/drivers/input/joystick/spaceorb.c
@@ -213,7 +213,7 @@ static int spaceorb_connect(struct serio *serio, struct serio_driver *drv)
  * The serio driver structure.
  */
 
-static struct serio_device_id spaceorb_serio_ids[] = {
+static const struct serio_device_id spaceorb_serio_ids[] = {
         {
                 .type   = SERIO_RS232,
                 .proto  = SERIO_SPACEORB,
diff --git a/drivers/input/joystick/stinger.c b/drivers/input/joystick/stinger.c
index 099c6d7b5e08..cb10e7b097ae 100644
--- a/drivers/input/joystick/stinger.c
+++ b/drivers/input/joystick/stinger.c
@@ -184,7 +184,7 @@ static int stinger_connect(struct serio *serio, struct serio_driver *drv)
  * The serio driver structure.
  */
 
-static struct serio_device_id stinger_serio_ids[] = {
+static const struct serio_device_id stinger_serio_ids[] = {
         {
                 .type   = SERIO_RS232,
                 .proto  = SERIO_STINGER,
diff --git a/drivers/input/joystick/twidjoy.c b/drivers/input/joystick/twidjoy.c
index 7f7e5ab3f9e3..e60cb004cb8c 100644
--- a/drivers/input/joystick/twidjoy.c
+++ b/drivers/input/joystick/twidjoy.c
@@ -233,7 +233,7 @@ static int twidjoy_connect(struct serio *serio, struct serio_driver *drv)
  * The serio driver structure.
  */
 
-static struct serio_device_id twidjoy_serio_ids[] = {
+static const struct serio_device_id twidjoy_serio_ids[] = {
         {
                 .type   = SERIO_RS232,
                 .proto  = SERIO_TWIDJOY,
diff --git a/drivers/input/joystick/warrior.c b/drivers/input/joystick/warrior.c
index e13a9144a25d..ef5391ba4470 100644
--- a/drivers/input/joystick/warrior.c
+++ b/drivers/input/joystick/warrior.c
@@ -193,7 +193,7 @@ static int warrior_connect(struct serio *serio, struct serio_driver *drv)
  * The serio driver structure.
  */
 
-static struct serio_device_id warrior_serio_ids[] = {
+static const struct serio_device_id warrior_serio_ids[] = {
         {
                 .type   = SERIO_RS232,
                 .proto  = SERIO_WARRIOR,
diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
index ca0e19ae7a90..f8e34ef643c7 100644
--- a/drivers/input/joystick/xpad.c
+++ b/drivers/input/joystick/xpad.c
@@ -408,7 +408,7 @@ static const signed short xpad_abs_triggers[] = {
 #define XPAD_XBOXONE_VENDOR(vend) \
         { XPAD_XBOXONE_VENDOR_PROTOCOL(vend, 208) }
 
-static struct usb_device_id xpad_table[] = {
+static const struct usb_device_id xpad_table[] = {
         { USB_INTERFACE_INFO('X', 'B', 0) },    /* X-Box USB-IF not approved class */
         XPAD_XBOX360_VENDOR(0x044f),            /* Thrustmaster X-Box 360 controllers */
         XPAD_XBOX360_VENDOR(0x045e),            /* Microsoft X-Box 360 controllers */
diff --git a/drivers/input/joystick/zhenhua.c b/drivers/input/joystick/zhenhua.c
index 4a8258bf13fd..5c6d5de743f1 100644
--- a/drivers/input/joystick/zhenhua.c
+++ b/drivers/input/joystick/zhenhua.c
@@ -192,7 +192,7 @@ static int zhenhua_connect(struct serio *serio, struct serio_driver *drv)
  * The serio driver structure.
  */
 
-static struct serio_device_id zhenhua_serio_ids[] = {
+static const struct serio_device_id zhenhua_serio_ids[] = {
         {
                 .type   = SERIO_RS232,
                 .proto  = SERIO_ZHENHUA,
diff --git a/drivers/input/keyboard/atkbd.c b/drivers/input/keyboard/atkbd.c
index ec876b5b1382..7e75835e220f 100644
--- a/drivers/input/keyboard/atkbd.c
+++ b/drivers/input/keyboard/atkbd.c
@@ -1270,7 +1270,7 @@ static int atkbd_reconnect(struct serio *serio)
         return retval;
 }
 
-static struct serio_device_id atkbd_serio_ids[] = {
+static const struct serio_device_id atkbd_serio_ids[] = {
         {
                 .type   = SERIO_8042,
                 .proto  = SERIO_ANY,
diff --git a/drivers/input/keyboard/gpio_keys.c b/drivers/input/keyboard/gpio_keys.c
index a047b9af8369..e9f0ebf3267a 100644
--- a/drivers/input/keyboard/gpio_keys.c
+++ b/drivers/input/keyboard/gpio_keys.c
@@ -353,7 +353,7 @@ static struct attribute *gpio_keys_attrs[] = {
         NULL,
 };
 
-static struct attribute_group gpio_keys_attr_group = {
+static const struct attribute_group gpio_keys_attr_group = {
         .attrs = gpio_keys_attrs,
 };
 
@@ -827,7 +827,7 @@ static int gpio_keys_probe(struct platform_device *pdev)
 
         fwnode_handle_put(child);
 
-        error = sysfs_create_group(&dev->kobj, &gpio_keys_attr_group);
+        error = devm_device_add_group(dev, &gpio_keys_attr_group);
         if (error) {
                 dev_err(dev, "Unable to export keys/switches, error: %d\n",
                         error);
@@ -838,23 +838,12 @@ static int gpio_keys_probe(struct platform_device *pdev)
         if (error) {
                 dev_err(dev, "Unable to register input device, error: %d\n",
                         error);
-                goto err_remove_group;
+                return error;
         }
 
         device_init_wakeup(dev, wakeup);
 
         return 0;
-
-err_remove_group:
-        sysfs_remove_group(&dev->kobj, &gpio_keys_attr_group);
-        return error;
-}
-
-static int gpio_keys_remove(struct platform_device *pdev)
-{
-        sysfs_remove_group(&pdev->dev.kobj, &gpio_keys_attr_group);
-
-        return 0;
 }
 
 static int __maybe_unused gpio_keys_suspend(struct device *dev)
@@ -912,7 +901,6 @@ static SIMPLE_DEV_PM_OPS(gpio_keys_pm_ops, gpio_keys_suspend, gpio_keys_resume);
 
 static struct platform_driver gpio_keys_device_driver = {
         .probe          = gpio_keys_probe,
-        .remove         = gpio_keys_remove,
         .driver         = {
                 .name   = "gpio-keys",
                 .pm     = &gpio_keys_pm_ops,
diff --git a/drivers/input/keyboard/hil_kbd.c b/drivers/input/keyboard/hil_kbd.c
index 5b152f25a8e1..bb29a7c9a1c0 100644
--- a/drivers/input/keyboard/hil_kbd.c
+++ b/drivers/input/keyboard/hil_kbd.c
@@ -559,7 +559,7 @@ static int hil_dev_connect(struct serio *serio, struct serio_driver *drv)
         return error;
 }
 
-static struct serio_device_id hil_dev_ids[] = {
+static const struct serio_device_id hil_dev_ids[] = {
         {
                 .type = SERIO_HIL_MLC,
                 .proto = SERIO_HIL,
diff --git a/drivers/input/keyboard/lkkbd.c b/drivers/input/keyboard/lkkbd.c
index 9fcd9f1d5dc8..471d53815c6d 100644
--- a/drivers/input/keyboard/lkkbd.c
+++ b/drivers/input/keyboard/lkkbd.c
@@ -707,7 +707,7 @@ static void lkkbd_disconnect(struct serio *serio)
         kfree(lk);
 }
 
-static struct serio_device_id lkkbd_serio_ids[] = {
+static const struct serio_device_id lkkbd_serio_ids[] = {
         {
                 .type   = SERIO_RS232,
                 .proto  = SERIO_LKKBD,
diff --git a/drivers/input/keyboard/newtonkbd.c b/drivers/input/keyboard/newtonkbd.c
index 20f044377990..fb9b8e23ab93 100644
--- a/drivers/input/keyboard/newtonkbd.c
+++ b/drivers/input/keyboard/newtonkbd.c
@@ -142,7 +142,7 @@ static void nkbd_disconnect(struct serio *serio)
         kfree(nkbd);
 }
 
-static struct serio_device_id nkbd_serio_ids[] = {
+static const struct serio_device_id nkbd_serio_ids[] = {
         {
                 .type   = SERIO_RS232,
                 .proto  = SERIO_NEWTON,
diff --git a/drivers/input/keyboard/pxa27x_keypad.c b/drivers/input/keyboard/pxa27x_keypad.c
index 3841fa30db33..d0bdaeadf86d 100644
--- a/drivers/input/keyboard/pxa27x_keypad.c
+++ b/drivers/input/keyboard/pxa27x_keypad.c
@@ -644,9 +644,12 @@ static void pxa27x_keypad_config(struct pxa27x_keypad *keypad)
 static int pxa27x_keypad_open(struct input_dev *dev)
 {
         struct pxa27x_keypad *keypad = input_get_drvdata(dev);
-
+        int ret;
         /* Enable unit clock */
-        clk_prepare_enable(keypad->clk);
+        ret = clk_prepare_enable(keypad->clk);
+        if (ret)
+                return ret;
+
         pxa27x_keypad_config(keypad);
 
         return 0;
@@ -683,6 +686,7 @@ static int pxa27x_keypad_resume(struct device *dev)
         struct platform_device *pdev = to_platform_device(dev);
         struct pxa27x_keypad *keypad = platform_get_drvdata(pdev);
         struct input_dev *input_dev = keypad->input_dev;
+        int ret = 0;
 
         /*
          * If the keypad is used as wake up source, the clock is not turned
@@ -695,14 +699,15 @@ static int pxa27x_keypad_resume(struct device *dev)
 
                 if (input_dev->users) {
                         /* Enable unit clock */
-                        clk_prepare_enable(keypad->clk);
-                        pxa27x_keypad_config(keypad);
+                        ret = clk_prepare_enable(keypad->clk);
+                        if (!ret)
+                                pxa27x_keypad_config(keypad);
                 }
 
                 mutex_unlock(&input_dev->mutex);
         }
 
-        return 0;
+        return ret;
 }
 #endif
 
diff --git a/drivers/input/keyboard/stowaway.c b/drivers/input/keyboard/stowaway.c
index a6e0d565e306..8b6de9a692dc 100644
--- a/drivers/input/keyboard/stowaway.c
+++ b/drivers/input/keyboard/stowaway.c
@@ -146,7 +146,7 @@ static void skbd_disconnect(struct serio *serio)
         kfree(skbd);
 }
 
-static struct serio_device_id skbd_serio_ids[] = {
+static const struct serio_device_id skbd_serio_ids[] = {
         {
                 .type   = SERIO_RS232,
                 .proto  = SERIO_STOWAWAY,
diff --git a/drivers/input/keyboard/sunkbd.c b/drivers/input/keyboard/sunkbd.c
index dc6bb9d5b4f0..c95707ea2656 100644
--- a/drivers/input/keyboard/sunkbd.c
+++ b/drivers/input/keyboard/sunkbd.c
@@ -339,7 +339,7 @@ static void sunkbd_disconnect(struct serio *serio)
         kfree(sunkbd);
 }
 
-static struct serio_device_id sunkbd_serio_ids[] = {
+static const struct serio_device_id sunkbd_serio_ids[] = {
         {
                 .type   = SERIO_RS232,
                 .proto  = SERIO_SUNKBD,
diff --git a/drivers/input/keyboard/tegra-kbc.c b/drivers/input/keyboard/tegra-kbc.c
index 0c07e1023a46..edc1385ca00b 100644
--- a/drivers/input/keyboard/tegra-kbc.c
+++ b/drivers/input/keyboard/tegra-kbc.c
@@ -370,8 +370,11 @@ static int tegra_kbc_start(struct tegra_kbc *kbc)
 {
         unsigned int debounce_cnt;
         u32 val = 0;
+        int ret;
 
-        clk_prepare_enable(kbc->clk);
+        ret = clk_prepare_enable(kbc->clk);
+        if (ret)
+                return ret;
 
         /* Reset the KBC controller to clear all previous status.*/
         reset_control_assert(kbc->rst);
diff --git a/drivers/input/keyboard/xtkbd.c b/drivers/input/keyboard/xtkbd.c
index 7c2325bd7408..8f64b9ded8d0 100644
--- a/drivers/input/keyboard/xtkbd.c
+++ b/drivers/input/keyboard/xtkbd.c
@@ -145,7 +145,7 @@ static void xtkbd_disconnect(struct serio *serio)
         kfree(xtkbd);
 }
 
-static struct serio_device_id xtkbd_serio_ids[] = {
+static const struct serio_device_id xtkbd_serio_ids[] = {
         {
                 .type   = SERIO_XT,
                 .proto  = SERIO_ANY,
diff --git a/drivers/input/misc/Kconfig b/drivers/input/misc/Kconfig
index 3872488c3fd7..f47e836eaa0f 100644
--- a/drivers/input/misc/Kconfig
+++ b/drivers/input/misc/Kconfig
@@ -581,6 +581,17 @@ config INPUT_PWM_BEEPER
           To compile this driver as a module, choose M here: the module will be
           called pwm-beeper.
 
+config INPUT_RK805_PWRKEY
+        tristate "Rockchip RK805 PMIC power key support"
+        depends on MFD_RK808
+        help
+          Select this option to enable power key driver for RK805.
+
+          If unsure, say N.
+
+          To compile this driver as a module, choose M here: the module will be
+          called rk805_pwrkey.
+
 config INPUT_GPIO_ROTARY_ENCODER
         tristate "Rotary encoders connected to GPIO pins"
         depends on GPIOLIB || COMPILE_TEST
diff --git a/drivers/input/misc/Makefile b/drivers/input/misc/Makefile
index b923a9828c88..1072e0760c19 100644
--- a/drivers/input/misc/Makefile
+++ b/drivers/input/misc/Makefile
@@ -64,6 +64,7 @@ obj-$(CONFIG_INPUT_REGULATOR_HAPTIC)	+= regulator-haptic.o
 obj-$(CONFIG_INPUT_RETU_PWRBUTTON)      += retu-pwrbutton.o
 obj-$(CONFIG_INPUT_AXP20X_PEK)          += axp20x-pek.o
 obj-$(CONFIG_INPUT_GPIO_ROTARY_ENCODER) += rotary_encoder.o
+obj-$(CONFIG_INPUT_RK805_PWRKEY)        += rk805-pwrkey.o
 obj-$(CONFIG_INPUT_SGI_BTNS)            += sgi_btns.o
 obj-$(CONFIG_INPUT_SIRFSOC_ONKEY)       += sirfsoc-onkey.o
 obj-$(CONFIG_INPUT_SOC_BUTTON_ARRAY)    += soc_button_array.o
diff --git a/drivers/input/misc/ati_remote2.c b/drivers/input/misc/ati_remote2.c
index 1c5914cae853..ebf4448b31b9 100644
--- a/drivers/input/misc/ati_remote2.c
+++ b/drivers/input/misc/ati_remote2.c
@@ -110,7 +110,7 @@ static const struct kernel_param_ops param_ops_mode_mask = {
 module_param(mode_mask, mode_mask, 0644);
 MODULE_PARM_DESC(mode_mask, "Bitmask of modes to accept <4:PC><3:AUX4><2:AUX3><1:AUX2><0:AUX1>");
 
-static struct usb_device_id ati_remote2_id_table[] = {
+static const struct usb_device_id ati_remote2_id_table[] = {
         { USB_DEVICE(0x0471, 0x0602) }, /* ATI Remote Wonder II */
         { }
 };
diff --git a/drivers/input/misc/axp20x-pek.c b/drivers/input/misc/axp20x-pek.c
index 38c79ebff033..6cee5adc3b5c 100644
--- a/drivers/input/misc/axp20x-pek.c
+++ b/drivers/input/misc/axp20x-pek.c
@@ -29,9 +29,17 @@
 #define AXP20X_PEK_STARTUP_MASK         (0xc0)
 #define AXP20X_PEK_SHUTDOWN_MASK        (0x03)
 
+struct axp20x_info {
+        const struct axp20x_time *startup_time;
+        unsigned int startup_mask;
+        const struct axp20x_time *shutdown_time;
+        unsigned int shutdown_mask;
+};
+
 struct axp20x_pek {
         struct axp20x_dev *axp20x;
         struct input_dev *input;
+        struct axp20x_info *info;
         int irq_dbr;
         int irq_dbf;
 };
@@ -48,6 +56,13 @@ static const struct axp20x_time startup_time[] = {
         { .time = 2000, .idx = 3 },
 };
 
+static const struct axp20x_time axp221_startup_time[] = {
+        { .time = 128,  .idx = 0 },
+        { .time = 1000, .idx = 1 },
+        { .time = 2000, .idx = 2 },
+        { .time = 3000, .idx = 3 },
+};
+
 static const struct axp20x_time shutdown_time[] = {
         { .time = 4000,  .idx = 0 },
         { .time = 6000,  .idx = 1 },
@@ -55,31 +70,25 @@ static const struct axp20x_time shutdown_time[] = {
         { .time = 10000, .idx = 3 },
 };
 
-struct axp20x_pek_ext_attr {
-        const struct axp20x_time *p_time;
-        unsigned int mask;
-};
-
-static struct axp20x_pek_ext_attr axp20x_pek_startup_ext_attr = {
-        .p_time = startup_time,
-        .mask   = AXP20X_PEK_STARTUP_MASK,
+static const struct axp20x_info axp20x_info = {
+        .startup_time = startup_time,
+        .startup_mask = AXP20X_PEK_STARTUP_MASK,
+        .shutdown_time = shutdown_time,
+        .shutdown_mask = AXP20X_PEK_SHUTDOWN_MASK,
 };
 
-static struct axp20x_pek_ext_attr axp20x_pek_shutdown_ext_attr = {
-        .p_time = shutdown_time,
-        .mask   = AXP20X_PEK_SHUTDOWN_MASK,
+static const struct axp20x_info axp221_info = {
+        .startup_time = axp221_startup_time,
+        .startup_mask = AXP20X_PEK_STARTUP_MASK,
+        .shutdown_time = shutdown_time,
+        .shutdown_mask = AXP20X_PEK_SHUTDOWN_MASK,
 };
 
-static struct axp20x_pek_ext_attr *get_axp_ext_attr(struct device_attribute *attr)
-{
-        return container_of(attr, struct dev_ext_attribute, attr)->var;
-}
-
-static ssize_t axp20x_show_ext_attr(struct device *dev,
-                                    struct device_attribute *attr, char *buf)
+static ssize_t axp20x_show_attr(struct device *dev,
+                                const struct axp20x_time *time,
+                                unsigned int mask, char *buf)
 {
         struct axp20x_pek *axp20x_pek = dev_get_drvdata(dev);
-        struct axp20x_pek_ext_attr *axp20x_ea = get_axp_ext_attr(attr);
         unsigned int val;
         int ret, i;
 
@@ -87,22 +96,42 @@ static ssize_t axp20x_show_ext_attr(struct device *dev,
         if (ret != 0)
                 return ret;
 
-        val &= axp20x_ea->mask;
-        val >>= ffs(axp20x_ea->mask) - 1;
+        val &= mask;
+        val >>= ffs(mask) - 1;
 
         for (i = 0; i < 4; i++)
-                if (val == axp20x_ea->p_time[i].idx)
-                        val = axp20x_ea->p_time[i].time;
+                if (val == time[i].idx)
+                        val = time[i].time;
 
         return sprintf(buf, "%u\n", val);
 }
 
-static ssize_t axp20x_store_ext_attr(struct device *dev,
-                                     struct device_attribute *attr,
-                                     const char *buf, size_t count)
+static ssize_t axp20x_show_attr_startup(struct device *dev,
+                                        struct device_attribute *attr,
+                                        char *buf)
+{
+        struct axp20x_pek *axp20x_pek = dev_get_drvdata(dev);
+
+        return axp20x_show_attr(dev, axp20x_pek->info->startup_time,
+                                axp20x_pek->info->startup_mask, buf);
+}
+
+static ssize_t axp20x_show_attr_shutdown(struct device *dev,
+                                         struct device_attribute *attr,
+                                         char *buf)
+{
+        struct axp20x_pek *axp20x_pek = dev_get_drvdata(dev);
+
+        return axp20x_show_attr(dev, axp20x_pek->info->shutdown_time,
+                                axp20x_pek->info->shutdown_mask, buf);
+}
+
+static ssize_t axp20x_store_attr(struct device *dev,
+                                 const struct axp20x_time *time,
+                                 unsigned int mask, const char *buf,
+                                 size_t count)
 {
         struct axp20x_pek *axp20x_pek = dev_get_drvdata(dev);
-        struct axp20x_pek_ext_attr *axp20x_ea = get_axp_ext_attr(attr);
         char val_str[20];
         size_t len;
         int ret, i;
@@ -123,39 +152,52 @@ static ssize_t axp20x_store_ext_attr(struct device *dev,
         for (i = 3; i >= 0; i--) {
                 unsigned int err;
 
-                err = abs(axp20x_ea->p_time[i].time - val);
+                err = abs(time[i].time - val);
                 if (err < best_err) {
                         best_err = err;
-                        idx = axp20x_ea->p_time[i].idx;
+                        idx = time[i].idx;
                 }
 
                 if (!err)
                         break;
         }
 
-        idx <<= ffs(axp20x_ea->mask) - 1;
-        ret = regmap_update_bits(axp20x_pek->axp20x->regmap,
-                                 AXP20X_PEK_KEY,
-                                 axp20x_ea->mask, idx);
+        idx <<= ffs(mask) - 1;
+        ret = regmap_update_bits(axp20x_pek->axp20x->regmap, AXP20X_PEK_KEY,
+                                 mask, idx);
         if (ret != 0)
                 return -EINVAL;
 
         return count;
 }
 
-static struct dev_ext_attribute axp20x_dev_attr_startup = {
-        .attr   = __ATTR(startup, 0644, axp20x_show_ext_attr, axp20x_store_ext_attr),
-        .var    = &axp20x_pek_startup_ext_attr,
-};
+static ssize_t axp20x_store_attr_startup(struct device *dev,
+                                         struct device_attribute *attr,
+                                         const char *buf, size_t count)
+{
+        struct axp20x_pek *axp20x_pek = dev_get_drvdata(dev);
 
-static struct dev_ext_attribute axp20x_dev_attr_shutdown = {
-        .attr   = __ATTR(shutdown, 0644, axp20x_show_ext_attr, axp20x_store_ext_attr),
-        .var    = &axp20x_pek_shutdown_ext_attr,
-};
+        return axp20x_store_attr(dev, axp20x_pek->info->startup_time,
+                                 axp20x_pek->info->startup_mask, buf, count);
+}
+
+static ssize_t axp20x_store_attr_shutdown(struct device *dev,
+                                          struct device_attribute *attr,
+                                          const char *buf, size_t count)
+{
+        struct axp20x_pek *axp20x_pek = dev_get_drvdata(dev);
+
+        return axp20x_store_attr(dev, axp20x_pek->info->shutdown_time,
+                                 axp20x_pek->info->shutdown_mask, buf, count);
+}
+
+DEVICE_ATTR(startup, 0644, axp20x_show_attr_startup, axp20x_store_attr_startup);
+DEVICE_ATTR(shutdown, 0644, axp20x_show_attr_shutdown,
+            axp20x_store_attr_shutdown);
 
 static struct attribute *axp20x_attributes[] = {
-        &axp20x_dev_attr_startup.attr.attr,
-        &axp20x_dev_attr_shutdown.attr.attr,
+        &dev_attr_startup.attr,
+        &dev_attr_shutdown.attr,
         NULL,
 };
 
@@ -182,13 +224,6 @@ static irqreturn_t axp20x_pek_irq(int irq, void *pwr)
         return IRQ_HANDLED;
 }
 
-static void axp20x_remove_sysfs_group(void *_data)
-{
-        struct device *dev = _data;
-
-        sysfs_remove_group(&dev->kobj, &axp20x_attribute_group);
-}
-
 static int axp20x_pek_probe_input_device(struct axp20x_pek *axp20x_pek,
                                          struct platform_device *pdev)
 {
@@ -298,8 +333,14 @@ static bool axp20x_pek_should_register_input(struct axp20x_pek *axp20x_pek,
 static int axp20x_pek_probe(struct platform_device *pdev)
 {
         struct axp20x_pek *axp20x_pek;
+        const struct platform_device_id *match = platform_get_device_id(pdev);
         int error;
 
+        if (!match) {
+                dev_err(&pdev->dev, "Failed to get platform_device_id\n");
+                return -EINVAL;
+        }
+
         axp20x_pek = devm_kzalloc(&pdev->dev, sizeof(struct axp20x_pek),
                                   GFP_KERNEL);
         if (!axp20x_pek)
@@ -313,18 +354,11 @@ static int axp20x_pek_probe(struct platform_device *pdev)
                         return error;
         }
 
-        error = sysfs_create_group(&pdev->dev.kobj, &axp20x_attribute_group);
-        if (error) {
-                dev_err(&pdev->dev, "Failed to create sysfs attributes: %d\n",
-                        error);
-                return error;
-        }
+        axp20x_pek->info = (struct axp20x_info *)match->driver_data;
 
-        error = devm_add_action(&pdev->dev,
-                                axp20x_remove_sysfs_group, &pdev->dev);
+        error = devm_device_add_group(&pdev->dev, &axp20x_attribute_group);
         if (error) {
-                axp20x_remove_sysfs_group(&pdev->dev);
-                dev_err(&pdev->dev, "Failed to add sysfs cleanup action: %d\n",
+                dev_err(&pdev->dev, "Failed to create sysfs attributes: %d\n",
                         error);
                 return error;
         }
@@ -358,8 +392,21 @@ static const struct dev_pm_ops axp20x_pek_pm_ops = {
 #endif
 };
 
+static const struct platform_device_id axp_pek_id_match[] = {
+        {
+                .name = "axp20x-pek",
+                .driver_data = (kernel_ulong_t)&axp20x_info,
+        },
+        {
+                .name = "axp221-pek",
+                .driver_data = (kernel_ulong_t)&axp221_info,
+        },
+        { /* sentinel */ }
+};
+
 static struct platform_driver axp20x_pek_driver = {
         .probe          = axp20x_pek_probe,
+        .id_table       = axp_pek_id_match,
         .driver         = {
                 .name           = "axp20x-pek",
                 .pm             = &axp20x_pek_pm_ops,
diff --git a/drivers/input/misc/ims-pcu.c b/drivers/input/misc/ims-pcu.c
index f4e8fbec6a94..6bf82ea8c918 100644
--- a/drivers/input/misc/ims-pcu.c
+++ b/drivers/input/misc/ims-pcu.c
@@ -1261,7 +1261,7 @@ static umode_t ims_pcu_is_attr_visible(struct kobject *kobj,
         return mode;
 }
 
-static struct attribute_group ims_pcu_attr_group = {
+static const struct attribute_group ims_pcu_attr_group = {
         .is_visible     = ims_pcu_is_attr_visible,
         .attrs          = ims_pcu_attrs,
 };
@@ -1480,7 +1480,7 @@ static struct attribute *ims_pcu_ofn_attrs[] = {
         NULL
 };
 
-static struct attribute_group ims_pcu_ofn_attr_group = {
+static const struct attribute_group ims_pcu_ofn_attr_group = {
         .name   = "ofn",
         .attrs  = ims_pcu_ofn_attrs,
 };
diff --git a/drivers/input/misc/keyspan_remote.c b/drivers/input/misc/keyspan_remote.c
index a3fe4a990cc9..77c47d6325fe 100644
--- a/drivers/input/misc/keyspan_remote.c
+++ b/drivers/input/misc/keyspan_remote.c
@@ -85,7 +85,7 @@ static const unsigned short keyspan_key_table[] = {
 };
 
 /* table of devices that work with this driver */
-static struct usb_device_id keyspan_table[] = {
+static const struct usb_device_id keyspan_table[] = {
         { USB_DEVICE(USB_KEYSPAN_VENDOR_ID, USB_KEYSPAN_PRODUCT_UIA11) },
         { }                                     /* Terminating entry */
 };
diff --git a/drivers/input/misc/pcspkr.c b/drivers/input/misc/pcspkr.c
index 72b1fc3ab910..56ddba21de84 100644
--- a/drivers/input/misc/pcspkr.c
+++ b/drivers/input/misc/pcspkr.c
@@ -18,25 +18,30 @@
 #include <linux/input.h>
 #include <linux/platform_device.h>
 #include <linux/timex.h>
-#include <asm/io.h>
+#include <linux/io.h>
 
 MODULE_AUTHOR("Vojtech Pavlik <vojtech@ucw.cz>");
 MODULE_DESCRIPTION("PC Speaker beeper driver");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS("platform:pcspkr");
 
-static int pcspkr_event(struct input_dev *dev, unsigned int type, unsigned int code, int value)
+static int pcspkr_event(struct input_dev *dev, unsigned int type,
+                        unsigned int code, int value)
 {
         unsigned int count = 0;
         unsigned long flags;
 
         if (type != EV_SND)
-                return -1;
+                return -EINVAL;
 
         switch (code) {
-                case SND_BELL: if (value) value = 1000;
-                case SND_TONE: break;
-                default: return -1;
+        case SND_BELL:
+                if (value)
+                        value = 1000;
+        case SND_TONE:
+                break;
+        default:
+                return -EINVAL;
         }
 
         if (value > 20 && value < 32767)
diff --git a/drivers/input/misc/powermate.c b/drivers/input/misc/powermate.c
index 84909a12ff36..5c8c79623c87 100644
--- a/drivers/input/misc/powermate.c
+++ b/drivers/input/misc/powermate.c
@@ -432,7 +432,7 @@ static void powermate_disconnect(struct usb_interface *intf)
         }
 }
 
-static struct usb_device_id powermate_devices [] = {
+static const struct usb_device_id powermate_devices[] = {
         { USB_DEVICE(POWERMATE_VENDOR, POWERMATE_PRODUCT_NEW) },
         { USB_DEVICE(POWERMATE_VENDOR, POWERMATE_PRODUCT_OLD) },
         { USB_DEVICE(CONTOUR_VENDOR, CONTOUR_JOG) },
diff --git a/drivers/input/misc/rk805-pwrkey.c b/drivers/input/misc/rk805-pwrkey.c
new file mode 100644
index 000000000000..921003963a53
--- /dev/null
+++ b/drivers/input/misc/rk805-pwrkey.c
@@ -0,0 +1,111 @@
+/*
+ * Rockchip RK805 PMIC Power Key driver
+ *
+ * Copyright (c) 2017, Fuzhou Rockchip Electronics Co., Ltd
+ *
+ * Author: Joseph Chen <chenjh@rock-chips.com>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under  the terms of the GNU General  Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.
+ */
+
+#include <linux/errno.h>
+#include <linux/init.h>
+#include <linux/input.h>
+#include <linux/interrupt.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/platform_device.h>
+
+static irqreturn_t pwrkey_fall_irq(int irq, void *_pwr)
+{
+        struct input_dev *pwr = _pwr;
+
+        input_report_key(pwr, KEY_POWER, 1);
+        input_sync(pwr);
+
+        return IRQ_HANDLED;
+}
+
+static irqreturn_t pwrkey_rise_irq(int irq, void *_pwr)
+{
+        struct input_dev *pwr = _pwr;
+
+        input_report_key(pwr, KEY_POWER, 0);
+        input_sync(pwr);
+
+        return IRQ_HANDLED;
+}
+
+static int rk805_pwrkey_probe(struct platform_device *pdev)
+{
+        struct input_dev *pwr;
+        int fall_irq, rise_irq;
+        int err;
+
+        pwr = devm_input_allocate_device(&pdev->dev);
+        if (!pwr) {
+                dev_err(&pdev->dev, "Can't allocate power button\n");
+                return -ENOMEM;
+        }
+
+        pwr->name = "rk805 pwrkey";
+        pwr->phys = "rk805_pwrkey/input0";
+        pwr->id.bustype = BUS_HOST;
+        input_set_capability(pwr, EV_KEY, KEY_POWER);
+
+        fall_irq = platform_get_irq(pdev, 0);
+        if (fall_irq < 0) {
+                dev_err(&pdev->dev, "Can't get fall irq: %d\n", fall_irq);
+                return fall_irq;
+        }
+
+        rise_irq = platform_get_irq(pdev, 1);
+        if (rise_irq < 0) {
+                dev_err(&pdev->dev, "Can't get rise irq: %d\n", rise_irq);
+                return rise_irq;
+        }
+
+        err = devm_request_any_context_irq(&pwr->dev, fall_irq,
+                                           pwrkey_fall_irq,
+                                           IRQF_TRIGGER_FALLING | IRQF_ONESHOT,
+                                           "rk805_pwrkey_fall", pwr);
+        if (err < 0) {
+                dev_err(&pdev->dev, "Can't register fall irq: %d\n", err);
+                return err;
+        }
+
+        err = devm_request_any_context_irq(&pwr->dev, rise_irq,
+                                           pwrkey_rise_irq,
+                                           IRQF_TRIGGER_RISING | IRQF_ONESHOT,
+                                           "rk805_pwrkey_rise", pwr);
+        if (err < 0) {
+                dev_err(&pdev->dev, "Can't register rise irq: %d\n", err);
+                return err;
+        }
+
+        err = input_register_device(pwr);
+        if (err) {
+                dev_err(&pdev->dev, "Can't register power button: %d\n", err);
+                return err;
+        }
+
+        platform_set_drvdata(pdev, pwr);
+        device_init_wakeup(&pdev->dev, true);
+
+        return 0;
+}
+
+static struct platform_driver rk805_pwrkey_driver = {
+        .probe  = rk805_pwrkey_probe,
+        .driver = {
+                .name = "rk805-pwrkey",
+        },
+};
+module_platform_driver(rk805_pwrkey_driver);
+
+MODULE_AUTHOR("Joseph Chen <chenjh@rock-chips.com>");
+MODULE_DESCRIPTION("RK805 PMIC Power Key driver");
+MODULE_LICENSE("GPL");
diff --git a/drivers/input/misc/xen-kbdfront.c b/drivers/input/misc/xen-kbdfront.c
index fa130e7b734c..6bf56bb5f8d9 100644
--- a/drivers/input/misc/xen-kbdfront.c
+++ b/drivers/input/misc/xen-kbdfront.c
@@ -84,17 +84,20 @@ static void xenkbd_handle_key_event(struct xenkbd_info *info,
                                     struct xenkbd_key *key)
 {
         struct input_dev *dev;
+        int value = key->pressed;
 
         if (test_bit(key->keycode, info->ptr->keybit)) {
                 dev = info->ptr;
         } else if (test_bit(key->keycode, info->kbd->keybit)) {
                 dev = info->kbd;
+                if (key->pressed && test_bit(key->keycode, info->kbd->key))
+                        value = 2; /* Mark as autorepeat */
         } else {
                 pr_warn("unhandled keycode 0x%x\n", key->keycode);
                 return;
         }
 
-        input_report_key(dev, key->keycode, key->pressed);
+        input_event(dev, EV_KEY, key->keycode, value);
         input_sync(dev);
 }
 
diff --git a/drivers/input/misc/yealink.c b/drivers/input/misc/yealink.c
index 6e7ff9561d92..a1e0ff59d2f2 100644
--- a/drivers/input/misc/yealink.c
+++ b/drivers/input/misc/yealink.c
@@ -798,7 +798,7 @@ static struct attribute *yld_attributes[] = {
         NULL
 };
 
-static struct attribute_group yld_attr_group = {
+static const struct attribute_group yld_attr_group = {
         .attrs = yld_attributes
 };
 
diff --git a/drivers/input/mouse/appletouch.c b/drivers/input/mouse/appletouch.c
index ef234c9b2f2f..81a695d0b4e0 100644
--- a/drivers/input/mouse/appletouch.c
+++ b/drivers/input/mouse/appletouch.c
@@ -125,7 +125,7 @@ static const struct atp_info geyser4_info = {
  *  According to Info.plist Geyser IV is the same as Geyser III.)
  */
 
-static struct usb_device_id atp_table[] = {
+static const struct usb_device_id atp_table[] = {
         /* PowerBooks Feb 2005, iBooks G4 */
         ATP_DEVICE(0x020e, fountain_info),      /* FOUNTAIN ANSI */
         ATP_DEVICE(0x020f, fountain_info),      /* FOUNTAIN ISO */
diff --git a/drivers/input/mouse/byd.c b/drivers/input/mouse/byd.c
index b27aa637f877..b64b81599f7e 100644
--- a/drivers/input/mouse/byd.c
+++ b/drivers/input/mouse/byd.c
@@ -344,7 +344,7 @@ static int byd_reset_touchpad(struct psmouse *psmouse)
         u8 param[4];
         size_t i;
 
-        const struct {
+        static const struct {
                 u16 command;
                 u8 arg;
         } seq[] = {
diff --git a/drivers/input/mouse/elan_i2c.h b/drivers/input/mouse/elan_i2c.h
index 61c202436250..599544c1a91c 100644
--- a/drivers/input/mouse/elan_i2c.h
+++ b/drivers/input/mouse/elan_i2c.h
@@ -58,7 +58,7 @@ struct elan_transport_ops {
 
         int (*get_version)(struct i2c_client *client, bool iap, u8 *version);
         int (*get_sm_version)(struct i2c_client *client,
-                              u16 *ic_type, u8 *version);
+                              u16 *ic_type, u8 *version, u8 *clickpad);
         int (*get_checksum)(struct i2c_client *client, bool iap, u16 *csum);
         int (*get_product_id)(struct i2c_client *client, u16 *id);
 
diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c
index cfbc8ba4c96c..0e761d079dc4 100644
--- a/drivers/input/mouse/elan_i2c_core.c
+++ b/drivers/input/mouse/elan_i2c_core.c
@@ -95,6 +95,7 @@ struct elan_tp_data {
         u8                      min_baseline;
         u8                      max_baseline;
         bool                    baseline_ready;
+        u8                      clickpad;
 };
 
 static int elan_get_fwinfo(u16 ic_type, u16 *validpage_count,
@@ -213,7 +214,7 @@ static int elan_query_product(struct elan_tp_data *data)
                 return error;
 
         error = data->ops->get_sm_version(data->client, &data->ic_type,
-                                          &data->sm_version);
+                                          &data->sm_version, &data->clickpad);
         if (error)
                 return error;
 
@@ -923,6 +924,7 @@ static void elan_report_absolute(struct elan_tp_data *data, u8 *packet)
         }
 
         input_report_key(input, BTN_LEFT, tp_info & 0x01);
+        input_report_key(input, BTN_RIGHT, tp_info & 0x02);
         input_report_abs(input, ABS_DISTANCE, hover_event != 0);
         input_mt_report_pointer_emulation(input, true);
         input_sync(input);
@@ -991,7 +993,10 @@ static int elan_setup_input_device(struct elan_tp_data *data)
 
         __set_bit(EV_ABS, input->evbit);
         __set_bit(INPUT_PROP_POINTER, input->propbit);
-        __set_bit(INPUT_PROP_BUTTONPAD, input->propbit);
+        if (data->clickpad)
+                __set_bit(INPUT_PROP_BUTTONPAD, input->propbit);
+        else
+                __set_bit(BTN_RIGHT, input->keybit);
         __set_bit(BTN_LEFT, input->keybit);
 
         /* Set up ST parameters */
diff --git a/drivers/input/mouse/elan_i2c_i2c.c b/drivers/input/mouse/elan_i2c_i2c.c
index 80172f25974d..15b1330606c1 100644
--- a/drivers/input/mouse/elan_i2c_i2c.c
+++ b/drivers/input/mouse/elan_i2c_i2c.c
@@ -288,7 +288,8 @@ static int elan_i2c_get_version(struct i2c_client *client,
 }
 
 static int elan_i2c_get_sm_version(struct i2c_client *client,
-                                   u16 *ic_type, u8 *version)
+                                   u16 *ic_type, u8 *version,
+                                   u8 *clickpad)
 {
         int error;
         u8 pattern_ver;
@@ -317,6 +318,7 @@ static int elan_i2c_get_sm_version(struct i2c_client *client,
                         return error;
                 }
                 *version = val[1];
+                *clickpad = val[0] & 0x10;
         } else {
                 error = elan_i2c_read_cmd(client, ETP_I2C_OSM_VERSION_CMD, val);
                 if (error) {
@@ -326,6 +328,15 @@ static int elan_i2c_get_sm_version(struct i2c_client *client,
                 }
                 *version = val[0];
                 *ic_type = val[1];
+
+                error = elan_i2c_read_cmd(client, ETP_I2C_NSM_VERSION_CMD,
+                                          val);
+                if (error) {
+                        dev_err(&client->dev, "failed to get SM version: %d\n",
+                                error);
+                        return error;
+                }
+                *clickpad = val[0] & 0x10;
         }
 
         return 0;
diff --git a/drivers/input/mouse/elan_i2c_smbus.c b/drivers/input/mouse/elan_i2c_smbus.c
index df7a57ca7331..29f99529b187 100644
--- a/drivers/input/mouse/elan_i2c_smbus.c
+++ b/drivers/input/mouse/elan_i2c_smbus.c
@@ -166,7 +166,8 @@ static int elan_smbus_get_version(struct i2c_client *client,
 }
 
 static int elan_smbus_get_sm_version(struct i2c_client *client,
-                                     u16 *ic_type, u8 *version)
+                                     u16 *ic_type, u8 *version,
+                                     u8 *clickpad)
 {
         int error;
         u8 val[3];
@@ -180,6 +181,7 @@ static int elan_smbus_get_sm_version(struct i2c_client *client,
 
         *version = val[0];
         *ic_type = val[1];
+        *clickpad = val[0] & 0x10;
         return 0;
 }
 
diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
index 791993215ea3..6428d6f4d568 100644
--- a/drivers/input/mouse/elantech.c
+++ b/drivers/input/mouse/elantech.c
@@ -1377,7 +1377,7 @@ static struct attribute *elantech_attrs[] = {
         NULL
 };
 
-static struct attribute_group elantech_attr_group = {
+static const struct attribute_group elantech_attr_group = {
         .attrs = elantech_attrs,
 };
 
diff --git a/drivers/input/mouse/psmouse-base.c b/drivers/input/mouse/psmouse-base.c
index f73b47b8c578..6a5649e52eed 100644
--- a/drivers/input/mouse/psmouse-base.c
+++ b/drivers/input/mouse/psmouse-base.c
@@ -101,7 +101,7 @@ static struct attribute *psmouse_attributes[] = {
         NULL
 };
 
-static struct attribute_group psmouse_attribute_group = {
+static const struct attribute_group psmouse_attribute_group = {
         .attrs  = psmouse_attributes,
 };
 
diff --git a/drivers/input/mouse/synaptics_usb.c b/drivers/input/mouse/synaptics_usb.c
index 6bcc0189c1c9..cb7d15d826d0 100644
--- a/drivers/input/mouse/synaptics_usb.c
+++ b/drivers/input/mouse/synaptics_usb.c
@@ -525,7 +525,7 @@ static int synusb_reset_resume(struct usb_interface *intf)
         return synusb_resume(intf);
 }
 
-static struct usb_device_id synusb_idtable[] = {
+static const struct usb_device_id synusb_idtable[] = {
         { USB_DEVICE_SYNAPTICS(TP, SYNUSB_TOUCHPAD) },
         { USB_DEVICE_SYNAPTICS(INT_TP, SYNUSB_TOUCHPAD) },
         { USB_DEVICE_SYNAPTICS(CPAD,
diff --git a/drivers/input/mousedev.c b/drivers/input/mousedev.c
index 0e0ff84088fd..2d7f691ec71c 100644
--- a/drivers/input/mousedev.c
+++ b/drivers/input/mousedev.c
@@ -15,6 +15,7 @@
 #define MOUSEDEV_MINORS         31
 #define MOUSEDEV_MIX            63
 
+#include <linux/bitops.h>
 #include <linux/sched.h>
 #include <linux/slab.h>
 #include <linux/poll.h>
@@ -103,7 +104,7 @@ struct mousedev_client {
         spinlock_t packet_lock;
         int pos_x, pos_y;
 
-        signed char ps2[6];
+        u8 ps2[6];
         unsigned char ready, buffer, bufsiz;
         unsigned char imexseq, impsseq;
         enum mousedev_emul mode;
@@ -291,11 +292,10 @@ static void mousedev_notify_readers(struct mousedev *mousedev,
                 }
 
                 client->pos_x += packet->dx;
-                client->pos_x = client->pos_x < 0 ?
-                        0 : (client->pos_x >= xres ? xres : client->pos_x);
+                client->pos_x = clamp_val(client->pos_x, 0, xres);
+
                 client->pos_y += packet->dy;
-                client->pos_y = client->pos_y < 0 ?
-                        0 : (client->pos_y >= yres ? yres : client->pos_y);
+                client->pos_y = clamp_val(client->pos_y, 0, yres);
 
                 p->dx += packet->dx;
                 p->dy += packet->dy;
@@ -571,44 +571,50 @@ static int mousedev_open(struct inode *inode, struct file *file)
         return error;
 }
 
-static inline int mousedev_limit_delta(int delta, int limit)
-{
-        return delta > limit ? limit : (delta < -limit ? -limit : delta);
-}
-
-static void mousedev_packet(struct mousedev_client *client,
-                            signed char *ps2_data)
+static void mousedev_packet(struct mousedev_client *client, u8 *ps2_data)
 {
         struct mousedev_motion *p = &client->packets[client->tail];
+        s8 dx, dy, dz;
+
+        dx = clamp_val(p->dx, -127, 127);
+        p->dx -= dx;
+
+        dy = clamp_val(p->dy, -127, 127);
+        p->dy -= dy;
 
-        ps2_data[0] = 0x08 |
-                ((p->dx < 0) << 4) | ((p->dy < 0) << 5) | (p->buttons & 0x07);
-        ps2_data[1] = mousedev_limit_delta(p->dx, 127);
-        ps2_data[2] = mousedev_limit_delta(p->dy, 127);
-        p->dx -= ps2_data[1];
-        p->dy -= ps2_data[2];
+        ps2_data[0] = BIT(3);
+        ps2_data[0] |= ((dx & BIT(7)) >> 3) | ((dy & BIT(7)) >> 2);
+        ps2_data[0] |= p->buttons & 0x07;
+        ps2_data[1] = dx;
+        ps2_data[2] = dy;
 
         switch (client->mode) {
         case MOUSEDEV_EMUL_EXPS:
-                ps2_data[3] = mousedev_limit_delta(p->dz, 7);
-                p->dz -= ps2_data[3];
-                ps2_data[3] = (ps2_data[3] & 0x0f) | ((p->buttons & 0x18) << 1);
+                dz = clamp_val(p->dz, -7, 7);
+                p->dz -= dz;
+
+                ps2_data[3] = (dz & 0x0f) | ((p->buttons & 0x18) << 1);
                 client->bufsiz = 4;
                 break;
 
         case MOUSEDEV_EMUL_IMPS:
-                ps2_data[0] |=
-                        ((p->buttons & 0x10) >> 3) | ((p->buttons & 0x08) >> 1);
-                ps2_data[3] = mousedev_limit_delta(p->dz, 127);
-                p->dz -= ps2_data[3];
+                dz = clamp_val(p->dz, -127, 127);
+                p->dz -= dz;
+
+                ps2_data[0] |= ((p->buttons & 0x10) >> 3) |
+                               ((p->buttons & 0x08) >> 1);
+                ps2_data[3] = dz;
+
                 client->bufsiz = 4;
                 break;
 
         case MOUSEDEV_EMUL_PS2:
         default:
-                ps2_data[0] |=
-                        ((p->buttons & 0x10) >> 3) | ((p->buttons & 0x08) >> 1);
                 p->dz = 0;
+
+                ps2_data[0] |= ((p->buttons & 0x10) >> 3) |
+                               ((p->buttons & 0x08) >> 1);
+
                 client->bufsiz = 3;
                 break;
         }
@@ -714,7 +720,7 @@ static ssize_t mousedev_read(struct file *file, char __user *buffer,
 {
         struct mousedev_client *client = file->private_data;
         struct mousedev *mousedev = client->mousedev;
-        signed char data[sizeof(client->ps2)];
+        u8 data[sizeof(client->ps2)];
         int retval = 0;
 
         if (!client->ready && !client->buffer && mousedev->exist &&
diff --git a/drivers/input/rmi4/rmi_f01.c b/drivers/input/rmi4/rmi_f01.c
index 7f7e9176f7ea..ae966e333a2f 100644
--- a/drivers/input/rmi4/rmi_f01.c
+++ b/drivers/input/rmi4/rmi_f01.c
@@ -334,7 +334,7 @@ static struct attribute *rmi_f01_attrs[] = {
         NULL
 };
 
-static struct attribute_group rmi_f01_attr_group = {
+static const struct attribute_group rmi_f01_attr_group = {
         .attrs = rmi_f01_attrs,
 };
 
@@ -570,18 +570,14 @@ static int rmi_f01_probe(struct rmi_function *fn)
 
         dev_set_drvdata(&fn->dev, f01);
 
-        error = sysfs_create_group(&fn->rmi_dev->dev.kobj, &rmi_f01_attr_group);
+        error = devm_device_add_group(&fn->rmi_dev->dev, &rmi_f01_attr_group);
         if (error)
-                dev_warn(&fn->dev, "Failed to create sysfs group: %d\n", error);
+                dev_warn(&fn->dev,
+                         "Failed to create attribute group: %d\n", error);
 
         return 0;
 }
 
-static void rmi_f01_remove(struct rmi_function *fn)
-{
-        sysfs_remove_group(&fn->rmi_dev->dev.kobj, &rmi_f01_attr_group);
-}
-
 static int rmi_f01_config(struct rmi_function *fn)
 {
         struct f01_data *f01 = dev_get_drvdata(&fn->dev);
@@ -721,7 +717,6 @@ struct rmi_function_handler rmi_f01_handler = {
         },
         .func           = 0x01,
         .probe          = rmi_f01_probe,
-        .remove         = rmi_f01_remove,
         .config         = rmi_f01_config,
         .attention      = rmi_f01_attention,
         .suspend        = rmi_f01_suspend,
diff --git a/drivers/input/rmi4/rmi_f34.c b/drivers/input/rmi4/rmi_f34.c
index b8ee78e0d61f..4cfe9703a8e7 100644
--- a/drivers/input/rmi4/rmi_f34.c
+++ b/drivers/input/rmi4/rmi_f34.c
@@ -516,7 +516,7 @@ static struct attribute *rmi_firmware_attrs[] = {
         NULL
 };
 
-static struct attribute_group rmi_firmware_attr_group = {
+static const struct attribute_group rmi_firmware_attr_group = {
         .attrs = rmi_firmware_attrs,
 };
 
diff --git a/drivers/input/serio/Kconfig b/drivers/input/serio/Kconfig
index c3d05b4d3118..21488c048fa3 100644
--- a/drivers/input/serio/Kconfig
+++ b/drivers/input/serio/Kconfig
@@ -292,6 +292,17 @@ config SERIO_SUN4I_PS2
           To compile this driver as a module, choose M here: the
           module will be called sun4i-ps2.
 
+config SERIO_GPIO_PS2
+        tristate "GPIO PS/2 bit banging driver"
+        depends on GPIOLIB
+        help
+          Say Y here if you want PS/2 bit banging support via GPIO.
+
+          To compile this driver as a module, choose M here: the
+          module will be called ps2-gpio.
+
+          If you are unsure, say N.
+
 config USERIO
         tristate "User space serio port driver support"
         help
diff --git a/drivers/input/serio/Makefile b/drivers/input/serio/Makefile
index 2374ef9b33d7..767bd9b6e1ed 100644
--- a/drivers/input/serio/Makefile
+++ b/drivers/input/serio/Makefile
@@ -30,4 +30,5 @@ obj-$(CONFIG_SERIO_APBPS2)	+= apbps2.o
 obj-$(CONFIG_SERIO_OLPC_APSP)   += olpc_apsp.o
 obj-$(CONFIG_HYPERV_KEYBOARD)   += hyperv-keyboard.o
 obj-$(CONFIG_SERIO_SUN4I_PS2)   += sun4i-ps2.o
+obj-$(CONFIG_SERIO_GPIO_PS2)    += ps2-gpio.o
 obj-$(CONFIG_USERIO)            += userio.o
diff --git a/drivers/input/serio/ambakmi.c b/drivers/input/serio/ambakmi.c
index c6606cacb6a7..ff3875cf3da1 100644
--- a/drivers/input/serio/ambakmi.c
+++ b/drivers/input/serio/ambakmi.c
@@ -187,7 +187,7 @@ static int __maybe_unused amba_kmi_resume(struct device *dev)
 
 static SIMPLE_DEV_PM_OPS(amba_kmi_dev_pm_ops, NULL, amba_kmi_resume);
 
-static struct amba_id amba_kmi_idtable[] = {
+static const struct amba_id amba_kmi_idtable[] = {
         {
                 .id     = 0x00041050,
                 .mask   = 0x000fffff,
diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
index f932a83b4990..ae81e57e13b9 100644
--- a/drivers/input/serio/i8042-x86ia64io.h
+++ b/drivers/input/serio/i8042-x86ia64io.h
@@ -927,7 +927,7 @@ static int i8042_pnp_aux_probe(struct pnp_dev *dev, const struct pnp_device_id *
         return 0;
 }
 
-static struct pnp_device_id pnp_kbd_devids[] = {
+static const struct pnp_device_id pnp_kbd_devids[] = {
         { .id = "PNP0300", .driver_data = 0 },
         { .id = "PNP0301", .driver_data = 0 },
         { .id = "PNP0302", .driver_data = 0 },
@@ -957,7 +957,7 @@ static struct pnp_driver i8042_pnp_kbd_driver = {
         },
 };
 
-static struct pnp_device_id pnp_aux_devids[] = {
+static const struct pnp_device_id pnp_aux_devids[] = {
         { .id = "AUI0200", .driver_data = 0 },
         { .id = "FJC6000", .driver_data = 0 },
         { .id = "FJC6001", .driver_data = 0 },
diff --git a/drivers/input/serio/ps2-gpio.c b/drivers/input/serio/ps2-gpio.c
new file mode 100644
index 000000000000..b50e3817f3c4
--- /dev/null
+++ b/drivers/input/serio/ps2-gpio.c
@@ -0,0 +1,453 @@
+/*
+ * GPIO based serio bus driver for bit banging the PS/2 protocol
+ *
+ * Author: Danilo Krummrich <danilokrummrich@dk-develop.de>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/gpio/consumer.h>
+#include <linux/interrupt.h>
+#include <linux/module.h>
+#include <linux/serio.h>
+#include <linux/slab.h>
+#include <linux/platform_device.h>
+#include <linux/workqueue.h>
+#include <linux/completion.h>
+#include <linux/mutex.h>
+#include <linux/preempt.h>
+#include <linux/property.h>
+#include <linux/of.h>
+#include <linux/jiffies.h>
+#include <linux/delay.h>
+
+#define DRIVER_NAME             "ps2-gpio"
+
+#define PS2_MODE_RX             0
+#define PS2_MODE_TX             1
+
+#define PS2_START_BIT           0
+#define PS2_DATA_BIT0           1
+#define PS2_DATA_BIT1           2
+#define PS2_DATA_BIT2           3
+#define PS2_DATA_BIT3           4
+#define PS2_DATA_BIT4           5
+#define PS2_DATA_BIT5           6
+#define PS2_DATA_BIT6           7
+#define PS2_DATA_BIT7           8
+#define PS2_PARITY_BIT          9
+#define PS2_STOP_BIT            10
+#define PS2_TX_TIMEOUT          11
+#define PS2_ACK_BIT             12
+
+#define PS2_DEV_RET_ACK         0xfa
+#define PS2_DEV_RET_NACK        0xfe
+
+#define PS2_CMD_RESEND          0xfe
+
+struct ps2_gpio_data {
+        struct device *dev;
+        struct serio *serio;
+        unsigned char mode;
+        struct gpio_desc *gpio_clk;
+        struct gpio_desc *gpio_data;
+        bool write_enable;
+        int irq;
+        unsigned char rx_cnt;
+        unsigned char rx_byte;
+        unsigned char tx_cnt;
+        unsigned char tx_byte;
+        struct completion tx_done;
+        struct mutex tx_mutex;
+        struct delayed_work tx_work;
+};
+
+static int ps2_gpio_open(struct serio *serio)
+{
+        struct ps2_gpio_data *drvdata = serio->port_data;
+
+        enable_irq(drvdata->irq);
+        return 0;
+}
+
+static void ps2_gpio_close(struct serio *serio)
+{
+        struct ps2_gpio_data *drvdata = serio->port_data;
+
+        disable_irq(drvdata->irq);
+}
+
+static int __ps2_gpio_write(struct serio *serio, unsigned char val)
+{
+        struct ps2_gpio_data *drvdata = serio->port_data;
+
+        disable_irq_nosync(drvdata->irq);
+        gpiod_direction_output(drvdata->gpio_clk, 0);
+
+        drvdata->mode = PS2_MODE_TX;
+        drvdata->tx_byte = val;
+
+        schedule_delayed_work(&drvdata->tx_work, usecs_to_jiffies(200));
+
+        return 0;
+}
+
+static int ps2_gpio_write(struct serio *serio, unsigned char val)
+{
+        struct ps2_gpio_data *drvdata = serio->port_data;
+        int ret = 0;
+
+        if (in_task()) {
+                mutex_lock(&drvdata->tx_mutex);
+                __ps2_gpio_write(serio, val);
+                if (!wait_for_completion_timeout(&drvdata->tx_done,
+                                                 msecs_to_jiffies(10000)))
+                        ret = SERIO_TIMEOUT;
+                mutex_unlock(&drvdata->tx_mutex);
+        } else {
+                __ps2_gpio_write(serio, val);
+        }
+
+        return ret;
+}
+
+static void ps2_gpio_tx_work_fn(struct work_struct *work)
+{
+        struct delayed_work *dwork = to_delayed_work(work);
+        struct ps2_gpio_data *drvdata = container_of(dwork,
+                                                    struct ps2_gpio_data,
+                                                    tx_work);
+
+        enable_irq(drvdata->irq);
+        gpiod_direction_output(drvdata->gpio_data, 0);
+        gpiod_direction_input(drvdata->gpio_clk);
+}
+
+static irqreturn_t ps2_gpio_irq_rx(struct ps2_gpio_data *drvdata)
+{
+        unsigned char byte, cnt;
+        int data;
+        int rxflags = 0;
+        static unsigned long old_jiffies;
+
+        byte = drvdata->rx_byte;
+        cnt = drvdata->rx_cnt;
+
+        if (old_jiffies == 0)
+                old_jiffies = jiffies;
+
+        if ((jiffies - old_jiffies) > usecs_to_jiffies(100)) {
+                dev_err(drvdata->dev,
+                        "RX: timeout, probably we missed an interrupt\n");
+                goto err;
+        }
+        old_jiffies = jiffies;
+
+        data = gpiod_get_value(drvdata->gpio_data);
+        if (unlikely(data < 0)) {
+                dev_err(drvdata->dev, "RX: failed to get data gpio val: %d\n",
+                        data);
+                goto err;
+        }
+
+        switch (cnt) {
+        case PS2_START_BIT:
+                /* start bit should be low */
+                if (unlikely(data)) {
+                        dev_err(drvdata->dev, "RX: start bit should be low\n");
+                        goto err;
+                }
+                break;
+        case PS2_DATA_BIT0:
+        case PS2_DATA_BIT1:
+        case PS2_DATA_BIT2:
+        case PS2_DATA_BIT3:
+        case PS2_DATA_BIT4:
+        case PS2_DATA_BIT5:
+        case PS2_DATA_BIT6:
+        case PS2_DATA_BIT7:
+                /* processing data bits */
+                if (data)
+                        byte |= (data << (cnt - 1));
+                break;
+        case PS2_PARITY_BIT:
+                /* check odd parity */
+                if (!((hweight8(byte) & 1) ^ data)) {
+                        rxflags |= SERIO_PARITY;
+                        dev_warn(drvdata->dev, "RX: parity error\n");
+                        if (!drvdata->write_enable)
+                                goto err;
+                }
+
+                /* Do not send spurious ACK's and NACK's when write fn is
+                 * not provided.
+                 */
+                if (!drvdata->write_enable) {
+                        if (byte == PS2_DEV_RET_NACK)
+                                goto err;
+                        else if (byte == PS2_DEV_RET_ACK)
+                                break;
+                }
+
+                /* Let's send the data without waiting for the stop bit to be
+                 * sent. It may happen that we miss the stop bit. When this
+                 * happens we have no way to recover from this, certainly
+                 * missing the parity bit would be recognized when processing
+                 * the stop bit. When missing both, data is lost.
+                 */
+                serio_interrupt(drvdata->serio, byte, rxflags);
+                dev_dbg(drvdata->dev, "RX: sending byte 0x%x\n", byte);
+                break;
+        case PS2_STOP_BIT:
+                /* stop bit should be high */
+                if (unlikely(!data)) {
+                        dev_err(drvdata->dev, "RX: stop bit should be high\n");
+                        goto err;
+                }
+                cnt = byte = 0;
+                old_jiffies = 0;
+                goto end; /* success */
+        default:
+                dev_err(drvdata->dev, "RX: got out of sync with the device\n");
+                goto err;
+        }
+
+        cnt++;
+        goto end; /* success */
+
+err:
+        cnt = byte = 0;
+        old_jiffies = 0;
+        __ps2_gpio_write(drvdata->serio, PS2_CMD_RESEND);
+end:
+        drvdata->rx_cnt = cnt;
+        drvdata->rx_byte = byte;
+        return IRQ_HANDLED;
+}
+
+static irqreturn_t ps2_gpio_irq_tx(struct ps2_gpio_data *drvdata)
+{
+        unsigned char byte, cnt;
+        int data;
+        static unsigned long old_jiffies;
+
+        cnt = drvdata->tx_cnt;
+        byte = drvdata->tx_byte;
+
+        if (old_jiffies == 0)
+                old_jiffies = jiffies;
+
+        if ((jiffies - old_jiffies) > usecs_to_jiffies(100)) {
+                dev_err(drvdata->dev,
+                        "TX: timeout, probably we missed an interrupt\n");
+                goto err;
+        }
+        old_jiffies = jiffies;
+
+        switch (cnt) {
+        case PS2_START_BIT:
+                /* should never happen */
+                dev_err(drvdata->dev,
+                        "TX: start bit should have been sent already\n");
+                goto err;
+        case PS2_DATA_BIT0:
+        case PS2_DATA_BIT1:
+        case PS2_DATA_BIT2:
+        case PS2_DATA_BIT3:
+        case PS2_DATA_BIT4:
+        case PS2_DATA_BIT5:
+        case PS2_DATA_BIT6:
+        case PS2_DATA_BIT7:
+                data = byte & BIT(cnt - 1);
+                gpiod_set_value(drvdata->gpio_data, data);
+                break;
+        case PS2_PARITY_BIT:
+                /* do odd parity */
+                data = !(hweight8(byte) & 1);
+                gpiod_set_value(drvdata->gpio_data, data);
+                break;
+        case PS2_STOP_BIT:
+                /* release data line to generate stop bit */
+                gpiod_direction_input(drvdata->gpio_data);
+                break;
+        case PS2_TX_TIMEOUT:
+                /* Devices generate one extra clock pulse before sending the
+                 * acknowledgment.
+                 */
+                break;
+        case PS2_ACK_BIT:
+                gpiod_direction_input(drvdata->gpio_data);
+                data = gpiod_get_value(drvdata->gpio_data);
+                if (data) {
+                        dev_warn(drvdata->dev, "TX: received NACK, retry\n");
+                        goto err;
+                }
+
+                drvdata->mode = PS2_MODE_RX;
+                complete(&drvdata->tx_done);
+
+                cnt = 1;
+                old_jiffies = 0;
+                goto end; /* success */
+        default:
+                /* Probably we missed the stop bit. Therefore we release data
+                 * line and try again.
+                 */
+                gpiod_direction_input(drvdata->gpio_data);
+                dev_err(drvdata->dev, "TX: got out of sync with the device\n");
+                goto err;
+        }
+
+        cnt++;
+        goto end; /* success */
+
+err:
+        cnt = 1;
+        old_jiffies = 0;
+        gpiod_direction_input(drvdata->gpio_data);
+        __ps2_gpio_write(drvdata->serio, drvdata->tx_byte);
+end:
+        drvdata->tx_cnt = cnt;
+        return IRQ_HANDLED;
+}
+
+static irqreturn_t ps2_gpio_irq(int irq, void *dev_id)
+{
+        struct ps2_gpio_data *drvdata = dev_id;
+
+        return drvdata->mode ? ps2_gpio_irq_tx(drvdata) :
+                ps2_gpio_irq_rx(drvdata);
+}
+
+static int ps2_gpio_get_props(struct device *dev,
+                                 struct ps2_gpio_data *drvdata)
+{
+        drvdata->gpio_data = devm_gpiod_get(dev, "data", GPIOD_IN);
+        if (IS_ERR(drvdata->gpio_data)) {
+                dev_err(dev, "failed to request data gpio: %ld",
+                        PTR_ERR(drvdata->gpio_data));
+                return PTR_ERR(drvdata->gpio_data);
+        }
+
+        drvdata->gpio_clk = devm_gpiod_get(dev, "clk", GPIOD_IN);
+        if (IS_ERR(drvdata->gpio_clk)) {
+                dev_err(dev, "failed to request clock gpio: %ld",
+                        PTR_ERR(drvdata->gpio_clk));
+                return PTR_ERR(drvdata->gpio_clk);
+        }
+
+        drvdata->write_enable = device_property_read_bool(dev,
+                                "write-enable");
+
+        return 0;
+}
+
+static int ps2_gpio_probe(struct platform_device *pdev)
+{
+        struct ps2_gpio_data *drvdata;
+        struct serio *serio;
+        struct device *dev = &pdev->dev;
+        int error;
+
+        drvdata = devm_kzalloc(dev, sizeof(struct ps2_gpio_data), GFP_KERNEL);
+        serio = kzalloc(sizeof(struct serio), GFP_KERNEL);
+        if (!drvdata || !serio) {
+                error = -ENOMEM;
+                goto err_free_serio;
+        }
+
+        error = ps2_gpio_get_props(dev, drvdata);
+        if (error)
+                goto err_free_serio;
+
+        if (gpiod_cansleep(drvdata->gpio_data) ||
+            gpiod_cansleep(drvdata->gpio_clk)) {
+                dev_err(dev, "GPIO data or clk are connected via slow bus\n");
+                error = -EINVAL;
+        }
+
+        drvdata->irq = platform_get_irq(pdev, 0);
+        if (drvdata->irq < 0) {
+                dev_err(dev, "failed to get irq from platform resource: %d\n",
+                        drvdata->irq);
+                error = drvdata->irq;
+                goto err_free_serio;
+        }
+
+        error = devm_request_irq(dev, drvdata->irq, ps2_gpio_irq,
+                                 IRQF_NO_THREAD, DRIVER_NAME, drvdata);
+        if (error) {
+                dev_err(dev, "failed to request irq %d: %d\n",
+                        drvdata->irq, error);
+                goto err_free_serio;
+        }
+
+        /* Keep irq disabled until serio->open is called. */
+        disable_irq(drvdata->irq);
+
+        serio->id.type = SERIO_8042;
+        serio->open = ps2_gpio_open;
+        serio->close = ps2_gpio_close;
+        /* Write can be enabled in platform/dt data, but possibly it will not
+         * work because of the tough timings.
+         */
+        serio->write = drvdata->write_enable ? ps2_gpio_write : NULL;
+        serio->port_data = drvdata;
+        serio->dev.parent = dev;
+        strlcpy(serio->name, dev_name(dev), sizeof(serio->name));
+        strlcpy(serio->phys, dev_name(dev), sizeof(serio->phys));
+
+        drvdata->serio = serio;
+        drvdata->dev = dev;
+        drvdata->mode = PS2_MODE_RX;
+
+        /* Tx count always starts at 1, as the start bit is sent implicitly by
+         * host-to-device communication initialization.
+         */
+        drvdata->tx_cnt = 1;
+
+        INIT_DELAYED_WORK(&drvdata->tx_work, ps2_gpio_tx_work_fn);
+        init_completion(&drvdata->tx_done);
+        mutex_init(&drvdata->tx_mutex);
+
+        serio_register_port(serio);
+        platform_set_drvdata(pdev, drvdata);
+
+        return 0;       /* success */
+
+err_free_serio:
+        kfree(serio);
+        return error;
+}
+
+static int ps2_gpio_remove(struct platform_device *pdev)
+{
+        struct ps2_gpio_data *drvdata = platform_get_drvdata(pdev);
+
+        serio_unregister_port(drvdata->serio);
+        return 0;
+}
+
+#if defined(CONFIG_OF)
+static const struct of_device_id ps2_gpio_match[] = {
+        { .compatible = "ps2-gpio", },
+        { },
+};
+MODULE_DEVICE_TABLE(of, ps2_gpio_match);
+#endif
+
+static struct platform_driver ps2_gpio_driver = {
+        .probe          = ps2_gpio_probe,
+        .remove         = ps2_gpio_remove,
+        .driver = {
+                .name = DRIVER_NAME,
+                .of_match_table = of_match_ptr(ps2_gpio_match),
+        },
+};
+module_platform_driver(ps2_gpio_driver);
+
+MODULE_AUTHOR("Danilo Krummrich <danilokrummrich@dk-develop.de>");
+MODULE_DESCRIPTION("GPIO PS2 driver");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/input/serio/serio.c b/drivers/input/serio/serio.c
index 30d6230d48f7..24a90c8db5b3 100644
--- a/drivers/input/serio/serio.c
+++ b/drivers/input/serio/serio.c
@@ -469,7 +469,7 @@ static struct attribute *serio_device_id_attrs[] = {
         NULL
 };
 
-static struct attribute_group serio_id_attr_group = {
+static const struct attribute_group serio_id_attr_group = {
         .name   = "id",
         .attrs  = serio_device_id_attrs,
 };
@@ -489,7 +489,7 @@ static struct attribute *serio_device_attrs[] = {
         NULL
 };
 
-static struct attribute_group serio_device_attr_group = {
+static const struct attribute_group serio_device_attr_group = {
         .attrs  = serio_device_attrs,
 };
 
diff --git a/drivers/input/serio/serio_raw.c b/drivers/input/serio/serio_raw.c
index 71ef5d65a0c6..516f9fe77a17 100644
--- a/drivers/input/serio/serio_raw.c
+++ b/drivers/input/serio/serio_raw.c
@@ -410,7 +410,7 @@ static void serio_raw_disconnect(struct serio *serio)
         serio_set_drvdata(serio, NULL);
 }
 
-static struct serio_device_id serio_raw_serio_ids[] = {
+static const struct serio_device_id serio_raw_serio_ids[] = {
         {
                 .type   = SERIO_8042,
                 .proto  = SERIO_ANY,
diff --git a/drivers/input/serio/xilinx_ps2.c b/drivers/input/serio/xilinx_ps2.c
index 14c40892ed82..07de1b49293c 100644
--- a/drivers/input/serio/xilinx_ps2.c
+++ b/drivers/input/serio/xilinx_ps2.c
@@ -45,8 +45,10 @@
 #define XPS2_STATUS_RX_FULL     0x00000001 /* Receive Full  */
 #define XPS2_STATUS_TX_FULL     0x00000002 /* Transmit Full  */
 
-/* Bit definitions for ISR/IER registers. Both the registers have the same bit
- * definitions and are only defined once. */
+/*
+ * Bit definitions for ISR/IER registers. Both the registers have the same bit
+ * definitions and are only defined once.
+ */
 #define XPS2_IPIXR_WDT_TOUT     0x00000001 /* Watchdog Timeout Interrupt */
 #define XPS2_IPIXR_TX_NOACK     0x00000002 /* Transmit No ACK Interrupt */
 #define XPS2_IPIXR_TX_ACK       0x00000004 /* Transmit ACK (Data) Interrupt */
@@ -292,8 +294,10 @@ static int xps2_of_probe(struct platform_device *ofdev)
         /* Disable all the interrupts, just in case */
         out_be32(drvdata->base_address + XPS2_IPIER_OFFSET, 0);
 
-        /* Reset the PS2 device and abort any current transaction, to make sure
-         * we have the PS2 in a good state */
+        /*
+         * Reset the PS2 device and abort any current transaction,
+         * to make sure we have the PS2 in a good state.
+         */
         out_be32(drvdata->base_address + XPS2_SRST_OFFSET, XPS2_SRST_RESET);
 
         dev_info(dev, "Xilinx PS2 at 0x%08llX mapped to 0x%p, irq=%d\n",
diff --git a/drivers/input/tablet/acecad.c b/drivers/input/tablet/acecad.c
index e86e377a90f5..aebb3f9090cd 100644
--- a/drivers/input/tablet/acecad.c
+++ b/drivers/input/tablet/acecad.c
@@ -260,7 +260,7 @@ static void usb_acecad_disconnect(struct usb_interface *intf)
         kfree(acecad);
 }
 
-static struct usb_device_id usb_acecad_id_table [] = {
+static const struct usb_device_id usb_acecad_id_table[] = {
         { USB_DEVICE(USB_VENDOR_ID_ACECAD, USB_DEVICE_ID_FLAIR), .driver_info = 0 },
         { USB_DEVICE(USB_VENDOR_ID_ACECAD, USB_DEVICE_ID_302),   .driver_info = 1 },
         { }
diff --git a/drivers/input/tablet/aiptek.c b/drivers/input/tablet/aiptek.c
index d67547bded3e..0b55e1f375b3 100644
--- a/drivers/input/tablet/aiptek.c
+++ b/drivers/input/tablet/aiptek.c
@@ -1676,7 +1676,7 @@ static struct attribute *aiptek_attributes[] = {
         NULL
 };
 
-static struct attribute_group aiptek_attribute_group = {
+static const struct attribute_group aiptek_attribute_group = {
         .attrs  = aiptek_attributes,
 };
 
diff --git a/drivers/input/tablet/kbtab.c b/drivers/input/tablet/kbtab.c
index 4d9d64908b59..a41c3ff7c9af 100644
--- a/drivers/input/tablet/kbtab.c
+++ b/drivers/input/tablet/kbtab.c
@@ -88,7 +88,7 @@ static void kbtab_irq(struct urb *urb)
                         __func__, retval);
 }
 
-static struct usb_device_id kbtab_ids[] = {
+static const struct usb_device_id kbtab_ids[] = {
         { USB_DEVICE(USB_VENDOR_ID_KBGEAR, 0x1001), .driver_info = 0 },
         { }
 };
diff --git a/drivers/input/tablet/wacom_serial4.c b/drivers/input/tablet/wacom_serial4.c
index 20ab802461e7..38bfaca48eab 100644
--- a/drivers/input/tablet/wacom_serial4.c
+++ b/drivers/input/tablet/wacom_serial4.c
@@ -594,7 +594,7 @@ free_device:
         return err;
 }
 
-static struct serio_device_id wacom_serio_ids[] = {
+static const struct serio_device_id wacom_serio_ids[] = {
         {
                 .type   = SERIO_RS232,
                 .proto  = SERIO_WACOM_IV,
diff --git a/drivers/input/touchscreen/ads7846.c b/drivers/input/touchscreen/ads7846.c
index 735a0be1ad95..a2f45aefce08 100644
--- a/drivers/input/touchscreen/ads7846.c
+++ b/drivers/input/touchscreen/ads7846.c
@@ -499,7 +499,7 @@ static struct attribute *ads7846_attributes[] = {
         NULL,
 };
 
-static struct attribute_group ads7846_attr_group = {
+static const struct attribute_group ads7846_attr_group = {
         .attrs = ads7846_attributes,
         .is_visible = ads7846_is_visible,
 };
@@ -599,7 +599,7 @@ static struct attribute *ads784x_attributes[] = {
         NULL,
 };
 
-static struct attribute_group ads784x_attr_group = {
+static const struct attribute_group ads784x_attr_group = {
         .attrs = ads784x_attributes,
 };
 
diff --git a/drivers/input/touchscreen/atmel_mxt_ts.c b/drivers/input/touchscreen/atmel_mxt_ts.c
index dd042a9b0aaa..7659bc48f1db 100644
--- a/drivers/input/touchscreen/atmel_mxt_ts.c
+++ b/drivers/input/touchscreen/atmel_mxt_ts.c
@@ -28,6 +28,7 @@
 #include <linux/interrupt.h>
 #include <linux/of.h>
 #include <linux/slab.h>
+#include <linux/gpio/consumer.h>
 #include <asm/unaligned.h>
 #include <media/v4l2-device.h>
 #include <media/v4l2-ioctl.h>
@@ -300,6 +301,7 @@ struct mxt_data {
         u8 multitouch;
         struct t7_config t7_cfg;
         struct mxt_dbg dbg;
+        struct gpio_desc *reset_gpio;
 
         /* Cached parameters from object table */
         u16 T5_address;
@@ -3117,11 +3119,9 @@ static int mxt_probe(struct i2c_client *client, const struct i2c_device_id *id)
         if (IS_ERR(pdata))
                 return PTR_ERR(pdata);
 
-        data = kzalloc(sizeof(struct mxt_data), GFP_KERNEL);
-        if (!data) {
-                dev_err(&client->dev, "Failed to allocate memory\n");
+        data = devm_kzalloc(&client->dev, sizeof(struct mxt_data), GFP_KERNEL);
+        if (!data)
                 return -ENOMEM;
-        }
 
         snprintf(data->phys, sizeof(data->phys), "i2c-%u-%04x/input0",
                  client->adapter->nr, client->addr);
@@ -3135,19 +3135,40 @@ static int mxt_probe(struct i2c_client *client, const struct i2c_device_id *id)
         init_completion(&data->reset_completion);
         init_completion(&data->crc_completion);
 
-        error = request_threaded_irq(client->irq, NULL, mxt_interrupt,
-                                     pdata->irqflags | IRQF_ONESHOT,
-                                     client->name, data);
+        data->reset_gpio = devm_gpiod_get_optional(&client->dev,
+                                                   "reset", GPIOD_OUT_LOW);
+        if (IS_ERR(data->reset_gpio)) {
+                error = PTR_ERR(data->reset_gpio);
+                dev_err(&client->dev, "Failed to get reset gpio: %d\n", error);
+                return error;
+        }
+
+        error = devm_request_threaded_irq(&client->dev, client->irq,
+                                          NULL, mxt_interrupt,
+                                          pdata->irqflags | IRQF_ONESHOT,
+                                          client->name, data);
         if (error) {
                 dev_err(&client->dev, "Failed to register interrupt\n");
-                goto err_free_mem;
+                return error;
+        }
+
+        if (data->reset_gpio) {
+                data->in_bootloader = true;
+                msleep(MXT_RESET_TIME);
+                reinit_completion(&data->bl_completion);
+                gpiod_set_value(data->reset_gpio, 1);
+                error = mxt_wait_for_completion(data, &data->bl_completion,
+                                                MXT_RESET_TIMEOUT);
+                if (error)
+                        return error;
+                data->in_bootloader = false;
         }
 
         disable_irq(client->irq);
 
         error = mxt_initialize(data);
         if (error)
-                goto err_free_irq;
+                return error;
 
         error = sysfs_create_group(&client->dev.kobj, &mxt_attr_group);
         if (error) {
@@ -3161,10 +3182,6 @@ static int mxt_probe(struct i2c_client *client, const struct i2c_device_id *id)
 err_free_object:
         mxt_free_input_device(data);
         mxt_free_object_table(data);
-err_free_irq:
-        free_irq(client->irq, data);
-err_free_mem:
-        kfree(data);
         return error;
 }
 
@@ -3172,11 +3189,10 @@ static int mxt_remove(struct i2c_client *client)
 {
         struct mxt_data *data = i2c_get_clientdata(client);
 
+        disable_irq(data->irq);
         sysfs_remove_group(&client->dev.kobj, &mxt_attr_group);
-        free_irq(data->irq, data);
         mxt_free_input_device(data);
         mxt_free_object_table(data);
-        kfree(data);
 
         return 0;
 }
diff --git a/drivers/input/touchscreen/dynapro.c b/drivers/input/touchscreen/dynapro.c
index 86237a910876..5b1b66fffbe3 100644
--- a/drivers/input/touchscreen/dynapro.c
+++ b/drivers/input/touchscreen/dynapro.c
@@ -164,7 +164,7 @@ static int dynapro_connect(struct serio *serio, struct serio_driver *drv)
  * The serio driver structure.
  */
 
-static struct serio_device_id dynapro_serio_ids[] = {
+static const struct serio_device_id dynapro_serio_ids[] = {
         {
                 .type   = SERIO_RS232,
                 .proto  = SERIO_DYNAPRO,
diff --git a/drivers/input/touchscreen/elants_i2c.c b/drivers/input/touchscreen/elants_i2c.c
index 872750eeca93..0f4cda7282a2 100644
--- a/drivers/input/touchscreen/elants_i2c.c
+++ b/drivers/input/touchscreen/elants_i2c.c
@@ -1066,7 +1066,7 @@ static struct attribute *elants_attributes[] = {
         NULL
 };
 
-static struct attribute_group elants_attribute_group = {
+static const struct attribute_group elants_attribute_group = {
         .attrs = elants_attributes,
 };
 
diff --git a/drivers/input/touchscreen/elo.c b/drivers/input/touchscreen/elo.c
index 8051a4b704ea..83433e8efff7 100644
--- a/drivers/input/touchscreen/elo.c
+++ b/drivers/input/touchscreen/elo.c
@@ -381,7 +381,7 @@ static int elo_connect(struct serio *serio, struct serio_driver *drv)
  * The serio driver structure.
  */
 
-static struct serio_device_id elo_serio_ids[] = {
+static const struct serio_device_id elo_serio_ids[] = {
         {
                 .type   = SERIO_RS232,
                 .proto  = SERIO_ELO,
diff --git a/drivers/input/touchscreen/fujitsu_ts.c b/drivers/input/touchscreen/fujitsu_ts.c
index d0e46a7e183b..a0fbb454499d 100644
--- a/drivers/input/touchscreen/fujitsu_ts.c
+++ b/drivers/input/touchscreen/fujitsu_ts.c
@@ -151,7 +151,7 @@ static int fujitsu_connect(struct serio *serio, struct serio_driver *drv)
 /*
  * The serio driver structure.
  */
-static struct serio_device_id fujitsu_serio_ids[] = {
+static const struct serio_device_id fujitsu_serio_ids[] = {
         {
                 .type   = SERIO_RS232,
                 .proto  = SERIO_FUJITSU,
diff --git a/drivers/input/touchscreen/gunze.c b/drivers/input/touchscreen/gunze.c
index e2ee62615273..481586909d28 100644
--- a/drivers/input/touchscreen/gunze.c
+++ b/drivers/input/touchscreen/gunze.c
@@ -162,7 +162,7 @@ static int gunze_connect(struct serio *serio, struct serio_driver *drv)
  * The serio driver structure.
  */
 
-static struct serio_device_id gunze_serio_ids[] = {
+static const struct serio_device_id gunze_serio_ids[] = {
         {
                 .type   = SERIO_RS232,
                 .proto  = SERIO_GUNZE,
diff --git a/drivers/input/touchscreen/hampshire.c b/drivers/input/touchscreen/hampshire.c
index ecb1e0e01328..eb052d559e54 100644
--- a/drivers/input/touchscreen/hampshire.c
+++ b/drivers/input/touchscreen/hampshire.c
@@ -163,7 +163,7 @@ static int hampshire_connect(struct serio *serio, struct serio_driver *drv)
  * The serio driver structure.
  */
 
-static struct serio_device_id hampshire_serio_ids[] = {
+static const struct serio_device_id hampshire_serio_ids[] = {
         {
                 .type   = SERIO_RS232,
                 .proto  = SERIO_HAMPSHIRE,
diff --git a/drivers/input/touchscreen/inexio.c b/drivers/input/touchscreen/inexio.c
index adb80b65a259..b9bc56233ccc 100644
--- a/drivers/input/touchscreen/inexio.c
+++ b/drivers/input/touchscreen/inexio.c
@@ -165,7 +165,7 @@ static int inexio_connect(struct serio *serio, struct serio_driver *drv)
  * The serio driver structure.
  */
 
-static struct serio_device_id inexio_serio_ids[] = {
+static const struct serio_device_id inexio_serio_ids[] = {
         {
                 .type   = SERIO_RS232,
                 .proto  = SERIO_INEXIO,
diff --git a/drivers/input/touchscreen/mtouch.c b/drivers/input/touchscreen/mtouch.c
index 9b5552a26169..a3707fad4d1c 100644
--- a/drivers/input/touchscreen/mtouch.c
+++ b/drivers/input/touchscreen/mtouch.c
@@ -178,7 +178,7 @@ static int mtouch_connect(struct serio *serio, struct serio_driver *drv)
  * The serio driver structure.
  */
 
-static struct serio_device_id mtouch_serio_ids[] = {
+static const struct serio_device_id mtouch_serio_ids[] = {
         {
                 .type   = SERIO_RS232,
                 .proto  = SERIO_MICROTOUCH,
diff --git a/drivers/input/touchscreen/mxs-lradc-ts.c b/drivers/input/touchscreen/mxs-lradc-ts.c
index 58c016cd6809..3707e927f770 100644
--- a/drivers/input/touchscreen/mxs-lradc-ts.c
+++ b/drivers/input/touchscreen/mxs-lradc-ts.c
@@ -30,7 +30,7 @@
 #include <linux/of_irq.h>
 #include <linux/platform_device.h>
 
-const char *mxs_lradc_ts_irq_names[] = {
+static const char * const mxs_lradc_ts_irq_names[] = {
         "mxs-lradc-touchscreen",
         "mxs-lradc-channel6",
         "mxs-lradc-channel7",
@@ -630,9 +630,11 @@ static int mxs_lradc_ts_probe(struct platform_device *pdev)
         spin_lock_init(&ts->lock);
 
         iores = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (!iores)
+                return -EINVAL;
         ts->base = devm_ioremap(dev, iores->start, resource_size(iores));
-        if (IS_ERR(ts->base))
-                return PTR_ERR(ts->base);
+        if (!ts->base)
+                return -ENOMEM;
 
         ret = of_property_read_u32(node, "fsl,lradc-touchscreen-wires",
                                    &ts_wires);
diff --git a/drivers/input/touchscreen/penmount.c b/drivers/input/touchscreen/penmount.c
index 417d87379265..6e6d7fd98cd2 100644
--- a/drivers/input/touchscreen/penmount.c
+++ b/drivers/input/touchscreen/penmount.c
@@ -293,7 +293,7 @@ static int pm_connect(struct serio *serio, struct serio_driver *drv)
  * The serio driver structure.
  */
 
-static struct serio_device_id pm_serio_ids[] = {
+static const struct serio_device_id pm_serio_ids[] = {
         {
                 .type   = SERIO_RS232,
                 .proto  = SERIO_PENMOUNT,
diff --git a/drivers/input/touchscreen/raydium_i2c_ts.c b/drivers/input/touchscreen/raydium_i2c_ts.c
index 1252e49ccfa1..4f1d3fd5d412 100644
--- a/drivers/input/touchscreen/raydium_i2c_ts.c
+++ b/drivers/input/touchscreen/raydium_i2c_ts.c
@@ -939,7 +939,7 @@ static struct attribute *raydium_i2c_attributes[] = {
         NULL
 };
 
-static struct attribute_group raydium_i2c_attribute_group = {
+static const struct attribute_group raydium_i2c_attribute_group = {
         .attrs = raydium_i2c_attributes,
 };
 
diff --git a/drivers/input/touchscreen/sun4i-ts.c b/drivers/input/touchscreen/sun4i-ts.c
index d07dd29d4848..d2e14d9e5975 100644
--- a/drivers/input/touchscreen/sun4i-ts.c
+++ b/drivers/input/touchscreen/sun4i-ts.c
@@ -206,7 +206,7 @@ static int sun4i_get_tz_temp(void *data, int *temp)
         return sun4i_get_temp(data, temp);
 }
 
-static struct thermal_zone_of_device_ops sun4i_ts_tz_ops = {
+static const struct thermal_zone_of_device_ops sun4i_ts_tz_ops = {
         .get_temp = sun4i_get_tz_temp,
 };
 
diff --git a/drivers/input/touchscreen/sur40.c b/drivers/input/touchscreen/sur40.c
index 128e5bd74720..f16f8358c70a 100644
--- a/drivers/input/touchscreen/sur40.c
+++ b/drivers/input/touchscreen/sur40.c
@@ -59,7 +59,7 @@ struct sur40_blob {
         __le16 blob_id;
 
         u8 action;         /* 0x02 = enter/exit, 0x03 = update (?) */
-        u8 unknown;        /* always 0x01 or 0x02 (no idea what this is?) */
+        u8 type;           /* bitmask (0x01 blob,  0x02 touch, 0x04 tag) */
 
         __le16 bb_pos_x;   /* upper left corner of bounding box */
         __le16 bb_pos_y;
@@ -133,12 +133,19 @@ struct sur40_image_header {
 
 /* control commands */
 #define SUR40_GET_VERSION 0xb0 /* 12 bytes string    */
-#define SUR40_UNKNOWN1    0xb3 /*  5 bytes           */
-#define SUR40_UNKNOWN2    0xc1 /* 24 bytes           */
+#define SUR40_ACCEL_CAPS  0xb3 /*  5 bytes           */
+#define SUR40_SENSOR_CAPS 0xc1 /* 24 bytes           */
+
+#define SUR40_POKE        0xc5 /* poke register byte */
+#define SUR40_PEEK        0xc4 /* 48 bytes registers */
 
 #define SUR40_GET_STATE   0xc5 /*  4 bytes state (?) */
 #define SUR40_GET_SENSORS 0xb1 /*  8 bytes sensors   */
 
+#define SUR40_BLOB      0x01
+#define SUR40_TOUCH     0x02
+#define SUR40_TAG       0x04
+
 static const struct v4l2_pix_format sur40_pix_format[] = {
         {
                 .pixelformat = V4L2_TCH_FMT_TU08,
@@ -238,11 +245,11 @@ static int sur40_init(struct sur40_state *dev)
         if (result < 0)
                 goto error;
 
-        result = sur40_command(dev, SUR40_UNKNOWN2,    0x00, buffer, 24);
+        result = sur40_command(dev, SUR40_SENSOR_CAPS, 0x00, buffer, 24);
         if (result < 0)
                 goto error;
 
-        result = sur40_command(dev, SUR40_UNKNOWN1,    0x00, buffer,  5);
+        result = sur40_command(dev, SUR40_ACCEL_CAPS, 0x00, buffer, 5);
         if (result < 0)
                 goto error;
 
@@ -289,20 +296,24 @@ static void sur40_close(struct input_polled_dev *polldev)
 static void sur40_report_blob(struct sur40_blob *blob, struct input_dev *input)
 {
         int wide, major, minor;
+        int bb_size_x, bb_size_y, pos_x, pos_y, ctr_x, ctr_y, slotnum;
 
-        int bb_size_x = le16_to_cpu(blob->bb_size_x);
-        int bb_size_y = le16_to_cpu(blob->bb_size_y);
-
-        int pos_x = le16_to_cpu(blob->pos_x);
-        int pos_y = le16_to_cpu(blob->pos_y);
-
-        int ctr_x = le16_to_cpu(blob->ctr_x);
-        int ctr_y = le16_to_cpu(blob->ctr_y);
+        if (blob->type != SUR40_TOUCH)
+                return;
 
-        int slotnum = input_mt_get_slot_by_key(input, blob->blob_id);
+        slotnum = input_mt_get_slot_by_key(input, blob->blob_id);
         if (slotnum < 0 || slotnum >= MAX_CONTACTS)
                 return;
 
+        bb_size_x = le16_to_cpu(blob->bb_size_x);
+        bb_size_y = le16_to_cpu(blob->bb_size_y);
+
+        pos_x = le16_to_cpu(blob->pos_x);
+        pos_y = le16_to_cpu(blob->pos_y);
+
+        ctr_x = le16_to_cpu(blob->ctr_x);
+        ctr_y = le16_to_cpu(blob->ctr_y);
+
         input_mt_slot(input, slotnum);
         input_mt_report_slot_state(input, MT_TOOL_FINGER, 1);
         wide = (bb_size_x > bb_size_y);
@@ -367,10 +378,13 @@ static void sur40_poll(struct input_polled_dev *polldev)
                 /*
                  * Sanity check. when video data is also being retrieved, the
                  * packet ID will usually increase in the middle of a series
-                 * instead of at the end.
-                 */
+                 * instead of at the end. However, the data is still consistent,
+                 * so the packet ID is probably just valid for the first packet
+                 * in a series.
+
                 if (packet_id != le32_to_cpu(header->packet_id))
                         dev_dbg(sur40->dev, "packet ID mismatch\n");
+                 */
 
                 packet_blobs = result / sizeof(struct sur40_blob);
                 dev_dbg(sur40->dev, "received %d blobs\n", packet_blobs);
diff --git a/drivers/input/touchscreen/touchit213.c b/drivers/input/touchscreen/touchit213.c
index c27cf8f3d1ca..98a16698be8e 100644
--- a/drivers/input/touchscreen/touchit213.c
+++ b/drivers/input/touchscreen/touchit213.c
@@ -192,7 +192,7 @@ static int touchit213_connect(struct serio *serio, struct serio_driver *drv)
  * The serio driver structure.
  */
 
-static struct serio_device_id touchit213_serio_ids[] = {
+static const struct serio_device_id touchit213_serio_ids[] = {
         {
                 .type   = SERIO_RS232,
                 .proto  = SERIO_TOUCHIT213,
diff --git a/drivers/input/touchscreen/touchright.c b/drivers/input/touchscreen/touchright.c
index 4000e5205407..45c325c33f21 100644
--- a/drivers/input/touchscreen/touchright.c
+++ b/drivers/input/touchscreen/touchright.c
@@ -152,7 +152,7 @@ static int tr_connect(struct serio *serio, struct serio_driver *drv)
  * The serio driver structure.
  */
 
-static struct serio_device_id tr_serio_ids[] = {
+static const struct serio_device_id tr_serio_ids[] = {
         {
                 .type   = SERIO_RS232,
                 .proto  = SERIO_TOUCHRIGHT,
diff --git a/drivers/input/touchscreen/touchwin.c b/drivers/input/touchscreen/touchwin.c
index ba90f447df75..2ba6b4ca28cb 100644
--- a/drivers/input/touchscreen/touchwin.c
+++ b/drivers/input/touchscreen/touchwin.c
@@ -159,7 +159,7 @@ static int tw_connect(struct serio *serio, struct serio_driver *drv)
  * The serio driver structure.
  */
 
-static struct serio_device_id tw_serio_ids[] = {
+static const struct serio_device_id tw_serio_ids[] = {
         {
                 .type   = SERIO_RS232,
                 .proto  = SERIO_TOUCHWIN,
diff --git a/drivers/input/touchscreen/tsc40.c b/drivers/input/touchscreen/tsc40.c
index 29687872cb94..d4ae4ba84c1f 100644
--- a/drivers/input/touchscreen/tsc40.c
+++ b/drivers/input/touchscreen/tsc40.c
@@ -141,7 +141,7 @@ static void tsc_disconnect(struct serio *serio)
         serio_set_drvdata(serio, NULL);
 }
 
-static struct serio_device_id tsc_serio_ids[] = {
+static const struct serio_device_id tsc_serio_ids[] = {
         {
                 .type   = SERIO_RS232,
                 .proto  = SERIO_TSC40,
diff --git a/drivers/input/touchscreen/wacom_w8001.c b/drivers/input/touchscreen/wacom_w8001.c
index 85e95725d0df..3715d1eace92 100644
--- a/drivers/input/touchscreen/wacom_w8001.c
+++ b/drivers/input/touchscreen/wacom_w8001.c
@@ -681,7 +681,7 @@ fail1:
         return err;
 }
 
-static struct serio_device_id w8001_serio_ids[] = {
+static const struct serio_device_id w8001_serio_ids[] = {
         {
                 .type   = SERIO_RS232,
                 .proto  = SERIO_W8001,
diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
index 63cacf5d6cf2..0f1219fa8561 100644
--- a/drivers/iommu/amd_iommu.c
+++ b/drivers/iommu/amd_iommu.c
@@ -3879,11 +3879,9 @@ static void irte_ga_prepare(void *entry,
                             u8 vector, u32 dest_apicid, int devid)
 {
         struct irte_ga *irte = (struct irte_ga *) entry;
-        struct iommu_dev_data *dev_data = search_dev_data(devid);
 
         irte->lo.val                      = 0;
         irte->hi.val                      = 0;
-        irte->lo.fields_remap.guest_mode  = dev_data ? dev_data->use_vapic : 0;
         irte->lo.fields_remap.int_type    = delivery_mode;
         irte->lo.fields_remap.dm          = dest_mode;
         irte->hi.fields.vector            = vector;
@@ -3939,10 +3937,10 @@ static void irte_ga_set_affinity(void *entry, u16 devid, u16 index,
         struct irte_ga *irte = (struct irte_ga *) entry;
         struct iommu_dev_data *dev_data = search_dev_data(devid);
 
-        if (!dev_data || !dev_data->use_vapic) {
+        if (!dev_data || !dev_data->use_vapic ||
+            !irte->lo.fields_remap.guest_mode) {
                 irte->hi.fields.vector = vector;
                 irte->lo.fields_remap.destination = dest_apicid;
-                irte->lo.fields_remap.guest_mode = 0;
                 modify_irte_ga(devid, index, irte, NULL);
         }
 }
diff --git a/drivers/iommu/of_iommu.c b/drivers/iommu/of_iommu.c
index 9f44ee8ea1bc..19779b88a479 100644
--- a/drivers/iommu/of_iommu.c
+++ b/drivers/iommu/of_iommu.c
@@ -118,6 +118,7 @@ static const struct iommu_ops
 
         ops = iommu_ops_from_fwnode(fwnode);
         if ((ops && !ops->of_xlate) ||
+            !of_device_is_available(iommu_spec->np) ||
             (!ops && !of_iommu_driver_present(iommu_spec->np)))
                 return NULL;
 
@@ -236,6 +237,12 @@ const struct iommu_ops *of_iommu_configure(struct device *dev,
                         ops = ERR_PTR(err);
         }
 
+        /* Ignore all other errors apart from EPROBE_DEFER */
+        if (IS_ERR(ops) && (PTR_ERR(ops) != -EPROBE_DEFER)) {
+                dev_dbg(dev, "Adding to IOMMU failed: %ld\n", PTR_ERR(ops));
+                ops = NULL;
+        }
+
         return ops;
 }
 
diff --git a/drivers/irqchip/irq-mips-gic.c b/drivers/irqchip/irq-mips-gic.c
index eb7fbe159963..929f8558bf1c 100644
--- a/drivers/irqchip/irq-mips-gic.c
+++ b/drivers/irqchip/irq-mips-gic.c
@@ -140,7 +140,7 @@ static inline void gic_map_to_vpe(unsigned int intr, unsigned int vpe)
 }
 
 #ifdef CONFIG_CLKSRC_MIPS_GIC
-u64 gic_read_count(void)
+u64 notrace gic_read_count(void)
 {
         unsigned int hi, hi2, lo;
 
@@ -167,7 +167,7 @@ unsigned int gic_get_count_width(void)
         return bits;
 }
 
-void gic_write_compare(u64 cnt)
+void notrace gic_write_compare(u64 cnt)
 {
         if (mips_cm_is64) {
                 gic_write(GIC_REG(VPE_LOCAL, GIC_VPE_COMPARE), cnt);
@@ -179,7 +179,7 @@ void gic_write_compare(u64 cnt)
         }
 }
 
-void gic_write_cpu_compare(u64 cnt, int cpu)
+void notrace gic_write_cpu_compare(u64 cnt, int cpu)
 {
         unsigned long flags;
 
diff --git a/drivers/irqchip/irq-xtensa-mx.c b/drivers/irqchip/irq-xtensa-mx.c
index bb3ac5fe5846..72a391e01011 100644
--- a/drivers/irqchip/irq-xtensa-mx.c
+++ b/drivers/irqchip/irq-xtensa-mx.c
@@ -142,7 +142,7 @@ static struct irq_chip xtensa_mx_irq_chip = {
 int __init xtensa_mx_init_legacy(struct device_node *interrupt_parent)
 {
         struct irq_domain *root_domain =
-                irq_domain_add_legacy(NULL, NR_IRQS, 0, 0,
+                irq_domain_add_legacy(NULL, NR_IRQS - 1, 1, 0,
                                 &xtensa_mx_irq_domain_ops,
                                 &xtensa_mx_irq_chip);
         irq_set_default_host(root_domain);
diff --git a/drivers/irqchip/irq-xtensa-pic.c b/drivers/irqchip/irq-xtensa-pic.c
index 472ae1770964..f728755fa292 100644
--- a/drivers/irqchip/irq-xtensa-pic.c
+++ b/drivers/irqchip/irq-xtensa-pic.c
@@ -89,7 +89,7 @@ static struct irq_chip xtensa_irq_chip = {
 int __init xtensa_pic_init_legacy(struct device_node *interrupt_parent)
 {
         struct irq_domain *root_domain =
-                irq_domain_add_legacy(NULL, NR_IRQS, 0, 0,
+                irq_domain_add_legacy(NULL, NR_IRQS - 1, 1, 0,
                                 &xtensa_irq_domain_ops, &xtensa_irq_chip);
         irq_set_default_host(root_domain);
         return 0;
diff --git a/drivers/isdn/i4l/isdn_ppp.c b/drivers/isdn/i4l/isdn_ppp.c
index d07dd5196ffc..8aa158a09180 100644
--- a/drivers/isdn/i4l/isdn_ppp.c
+++ b/drivers/isdn/i4l/isdn_ppp.c
@@ -2364,7 +2364,7 @@ static struct ippp_ccp_reset_state *isdn_ppp_ccp_reset_alloc_state(struct ippp_s
                        id);
                 return NULL;
         } else {
-                rs = kzalloc(sizeof(struct ippp_ccp_reset_state), GFP_KERNEL);
+                rs = kzalloc(sizeof(struct ippp_ccp_reset_state), GFP_ATOMIC);
                 if (!rs)
                         return NULL;
                 rs->state = CCPResetIdle;
diff --git a/drivers/isdn/mISDN/stack.c b/drivers/isdn/mISDN/stack.c
index 8b7faea2ddf8..422dced7c90a 100644
--- a/drivers/isdn/mISDN/stack.c
+++ b/drivers/isdn/mISDN/stack.c
@@ -75,7 +75,7 @@ send_socklist(struct mISDN_sock_list *sl, struct sk_buff *skb)
                 if (sk->sk_state != MISDN_BOUND)
                         continue;
                 if (!cskb)
-                        cskb = skb_copy(skb, GFP_KERNEL);
+                        cskb = skb_copy(skb, GFP_ATOMIC);
                 if (!cskb) {
                         printk(KERN_WARNING "%s no skb\n", __func__);
                         break;
diff --git a/drivers/leds/leds-bcm6328.c b/drivers/leds/leds-bcm6328.c
index 1548259297c1..2cfd9389ee96 100644
--- a/drivers/leds/leds-bcm6328.c
+++ b/drivers/leds/leds-bcm6328.c
@@ -242,7 +242,7 @@ static int bcm6328_hwled(struct device *dev, struct device_node *nc, u32 reg,
 
                 spin_lock_irqsave(lock, flags);
                 val = bcm6328_led_read(addr);
-                val |= (BIT(reg) << (((sel % 4) * 4) + 16));
+                val |= (BIT(reg % 4) << (((sel % 4) * 4) + 16));
                 bcm6328_led_write(addr, val);
                 spin_unlock_irqrestore(lock, flags);
         }
@@ -269,7 +269,7 @@ static int bcm6328_hwled(struct device *dev, struct device_node *nc, u32 reg,
 
                 spin_lock_irqsave(lock, flags);
                 val = bcm6328_led_read(addr);
-                val |= (BIT(reg) << ((sel % 4) * 4));
+                val |= (BIT(reg % 4) << ((sel % 4) * 4));
                 bcm6328_led_write(addr, val);
                 spin_unlock_irqrestore(lock, flags);
         }
diff --git a/drivers/leds/trigger/ledtrig-heartbeat.c b/drivers/leds/trigger/ledtrig-heartbeat.c
index afa3b4099214..e95ea65380c8 100644
--- a/drivers/leds/trigger/ledtrig-heartbeat.c
+++ b/drivers/leds/trigger/ledtrig-heartbeat.c
@@ -20,7 +20,6 @@
 #include <linux/sched/loadavg.h>
 #include <linux/leds.h>
 #include <linux/reboot.h>
-#include <linux/suspend.h>
 #include "../leds.h"
 
 static int panic_heartbeats;
@@ -163,30 +162,6 @@ static struct led_trigger heartbeat_led_trigger = {
         .deactivate = heartbeat_trig_deactivate,
 };
 
-static int heartbeat_pm_notifier(struct notifier_block *nb,
-                                 unsigned long pm_event, void *unused)
-{
-        int rc;
-
-        switch (pm_event) {
-        case PM_SUSPEND_PREPARE:
-        case PM_HIBERNATION_PREPARE:
-        case PM_RESTORE_PREPARE:
-                led_trigger_unregister(&heartbeat_led_trigger);
-                break;
-        case PM_POST_SUSPEND:
-        case PM_POST_HIBERNATION:
-        case PM_POST_RESTORE:
-                rc = led_trigger_register(&heartbeat_led_trigger);
-                if (rc)
-                        pr_err("could not re-register heartbeat trigger\n");
-                break;
-        default:
-                break;
-        }
-        return NOTIFY_DONE;
-}
-
 static int heartbeat_reboot_notifier(struct notifier_block *nb,
                                      unsigned long code, void *unused)
 {
@@ -201,10 +176,6 @@ static int heartbeat_panic_notifier(struct notifier_block *nb,
         return NOTIFY_DONE;
 }
 
-static struct notifier_block heartbeat_pm_nb = {
-        .notifier_call = heartbeat_pm_notifier,
-};
-
 static struct notifier_block heartbeat_reboot_nb = {
         .notifier_call = heartbeat_reboot_notifier,
 };
@@ -221,14 +192,12 @@ static int __init heartbeat_trig_init(void)
                 atomic_notifier_chain_register(&panic_notifier_list,
                                                &heartbeat_panic_nb);
                 register_reboot_notifier(&heartbeat_reboot_nb);
-                register_pm_notifier(&heartbeat_pm_nb);
         }
         return rc;
 }
 
 static void __exit heartbeat_trig_exit(void)
 {
-        unregister_pm_notifier(&heartbeat_pm_nb);
         unregister_reboot_notifier(&heartbeat_reboot_nb);
         atomic_notifier_chain_unregister(&panic_notifier_list,
                                          &heartbeat_panic_nb);
diff --git a/drivers/md/bitmap.c b/drivers/md/bitmap.c
index bf7419a56454..f4eace5ea184 100644
--- a/drivers/md/bitmap.c
+++ b/drivers/md/bitmap.c
@@ -485,10 +485,10 @@ void bitmap_print_sb(struct bitmap *bitmap)
         pr_debug("         magic: %08x\n", le32_to_cpu(sb->magic));
         pr_debug("       version: %d\n", le32_to_cpu(sb->version));
         pr_debug("          uuid: %08x.%08x.%08x.%08x\n",
-                 *(__u32 *)(sb->uuid+0),
-                 *(__u32 *)(sb->uuid+4),
-                 *(__u32 *)(sb->uuid+8),
-                 *(__u32 *)(sb->uuid+12));
+                 le32_to_cpu(*(__u32 *)(sb->uuid+0)),
+                 le32_to_cpu(*(__u32 *)(sb->uuid+4)),
+                 le32_to_cpu(*(__u32 *)(sb->uuid+8)),
+                 le32_to_cpu(*(__u32 *)(sb->uuid+12)));
         pr_debug("        events: %llu\n",
                  (unsigned long long) le64_to_cpu(sb->events));
         pr_debug("events cleared: %llu\n",
diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c
index cd8139593ccd..840c1496b2b1 100644
--- a/drivers/md/dm-bufio.c
+++ b/drivers/md/dm-bufio.c
@@ -1334,7 +1334,7 @@ int dm_bufio_issue_flush(struct dm_bufio_client *c)
 {
         struct dm_io_request io_req = {
                 .bi_op = REQ_OP_WRITE,
-                .bi_op_flags = REQ_PREFLUSH,
+                .bi_op_flags = REQ_PREFLUSH | REQ_SYNC,
                 .mem.type = DM_IO_KMEM,
                 .mem.ptr.addr = NULL,
                 .client = c->dm_io,
diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c
index c7f7c8d76576..93b181088168 100644
--- a/drivers/md/dm-integrity.c
+++ b/drivers/md/dm-integrity.c
@@ -783,7 +783,8 @@ static void write_journal(struct dm_integrity_c *ic, unsigned commit_start, unsi
                         for (i = 0; i < commit_sections; i++)
                                 rw_section_mac(ic, commit_start + i, true);
                 }
-                rw_journal(ic, REQ_OP_WRITE, REQ_FUA, commit_start, commit_sections, &io_comp);
+                rw_journal(ic, REQ_OP_WRITE, REQ_FUA | REQ_SYNC, commit_start,
+                           commit_sections, &io_comp);
         } else {
                 unsigned to_end;
                 io_comp.in_flight = (atomic_t)ATOMIC_INIT(2);
@@ -1104,10 +1105,13 @@ static void schedule_autocommit(struct dm_integrity_c *ic)
 static void submit_flush_bio(struct dm_integrity_c *ic, struct dm_integrity_io *dio)
 {
         struct bio *bio;
-        spin_lock_irq(&ic->endio_wait.lock);
+        unsigned long flags;
+
+        spin_lock_irqsave(&ic->endio_wait.lock, flags);
         bio = dm_bio_from_per_bio_data(dio, sizeof(struct dm_integrity_io));
         bio_list_add(&ic->flush_bio_list, bio);
-        spin_unlock_irq(&ic->endio_wait.lock);
+        spin_unlock_irqrestore(&ic->endio_wait.lock, flags);
+
         queue_work(ic->commit_wq, &ic->commit_work);
 }
 
@@ -2374,21 +2378,6 @@ static void dm_integrity_set(struct dm_target *ti, struct dm_integrity_c *ic)
         blk_queue_max_integrity_segments(disk->queue, UINT_MAX);
 }
 
-/* FIXME: use new kvmalloc */
-static void *dm_integrity_kvmalloc(size_t size, gfp_t gfp)
-{
-        void *ptr = NULL;
-
-        if (size <= PAGE_SIZE)
-                ptr = kmalloc(size, GFP_KERNEL | gfp);
-        if (!ptr && size <= KMALLOC_MAX_SIZE)
-                ptr = kmalloc(size, GFP_KERNEL | __GFP_NOWARN | __GFP_NORETRY | gfp);
-        if (!ptr)
-                ptr = __vmalloc(size, GFP_KERNEL | gfp, PAGE_KERNEL);
-
-        return ptr;
-}
-
 static void dm_integrity_free_page_list(struct dm_integrity_c *ic, struct page_list *pl)
 {
         unsigned i;
@@ -2407,7 +2396,7 @@ static struct page_list *dm_integrity_alloc_page_list(struct dm_integrity_c *ic)
         struct page_list *pl;
         unsigned i;
 
-        pl = dm_integrity_kvmalloc(page_list_desc_size, __GFP_ZERO);
+        pl = kvmalloc(page_list_desc_size, GFP_KERNEL | __GFP_ZERO);
         if (!pl)
                 return NULL;
 
@@ -2437,7 +2426,7 @@ static struct scatterlist **dm_integrity_alloc_journal_scatterlist(struct dm_int
         struct scatterlist **sl;
         unsigned i;
 
-        sl = dm_integrity_kvmalloc(ic->journal_sections * sizeof(struct scatterlist *), __GFP_ZERO);
+        sl = kvmalloc(ic->journal_sections * sizeof(struct scatterlist *), GFP_KERNEL | __GFP_ZERO);
         if (!sl)
                 return NULL;
 
@@ -2453,7 +2442,7 @@ static struct scatterlist **dm_integrity_alloc_journal_scatterlist(struct dm_int
 
                 n_pages = (end_index - start_index + 1);
 
-                s = dm_integrity_kvmalloc(n_pages * sizeof(struct scatterlist), 0);
+                s = kvmalloc(n_pages * sizeof(struct scatterlist), GFP_KERNEL);
                 if (!s) {
                         dm_integrity_free_journal_scatterlist(ic, sl);
                         return NULL;
@@ -2617,7 +2606,7 @@ static int create_journal(struct dm_integrity_c *ic, char **error)
                                 goto bad;
                         }
 
-                        sg = dm_integrity_kvmalloc((ic->journal_pages + 1) * sizeof(struct scatterlist), 0);
+                        sg = kvmalloc((ic->journal_pages + 1) * sizeof(struct scatterlist), GFP_KERNEL);
                         if (!sg) {
                                 *error = "Unable to allocate sg list";
                                 r = -ENOMEM;
@@ -2673,7 +2662,7 @@ static int create_journal(struct dm_integrity_c *ic, char **error)
                                 r = -ENOMEM;
                                 goto bad;
                         }
-                        ic->sk_requests = dm_integrity_kvmalloc(ic->journal_sections * sizeof(struct skcipher_request *), __GFP_ZERO);
+                        ic->sk_requests = kvmalloc(ic->journal_sections * sizeof(struct skcipher_request *), GFP_KERNEL | __GFP_ZERO);
                         if (!ic->sk_requests) {
                                 *error = "Unable to allocate sk requests";
                                 r = -ENOMEM;
@@ -2740,7 +2729,7 @@ retest_commit_id:
                 r = -ENOMEM;
                 goto bad;
         }
-        ic->journal_tree = dm_integrity_kvmalloc(journal_tree_size, 0);
+        ic->journal_tree = kvmalloc(journal_tree_size, GFP_KERNEL);
         if (!ic->journal_tree) {
                 *error = "Could not allocate memory for journal tree";
                 r = -ENOMEM;
@@ -3054,6 +3043,11 @@ static int dm_integrity_ctr(struct dm_target *ti, unsigned argc, char **argv)
                 ti->error = "The device is too small";
                 goto bad;
         }
+        if (ti->len > ic->provided_data_sectors) {
+                r = -EINVAL;
+                ti->error = "Not enough provided sectors for requested mapping size";
+                goto bad;
+        }
 
         if (!buffer_sectors)
                 buffer_sectors = 1;
diff --git a/drivers/md/dm-io.c b/drivers/md/dm-io.c
index 3702e502466d..8d5ca30f6551 100644
--- a/drivers/md/dm-io.c
+++ b/drivers/md/dm-io.c
@@ -317,8 +317,8 @@ static void do_region(int op, int op_flags, unsigned region,
         else if (op == REQ_OP_WRITE_SAME)
                 special_cmd_max_sectors = q->limits.max_write_same_sectors;
         if ((op == REQ_OP_DISCARD || op == REQ_OP_WRITE_ZEROES ||
-             op == REQ_OP_WRITE_SAME)  &&
-            special_cmd_max_sectors == 0) {
+             op == REQ_OP_WRITE_SAME) && special_cmd_max_sectors == 0) {
+                atomic_inc(&io->count);
                 dec_count(io, region, -EOPNOTSUPP);
                 return;
         }
diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
index 0555b4410e05..41852ae287a5 100644
--- a/drivers/md/dm-ioctl.c
+++ b/drivers/md/dm-ioctl.c
@@ -1710,12 +1710,13 @@ static int copy_params(struct dm_ioctl __user *user, struct dm_ioctl *param_kern
         }
 
         /*
-         * Try to avoid low memory issues when a device is suspended.
+         * Use __GFP_HIGH to avoid low memory issues when a device is
+         * suspended and the ioctl is needed to resume it.
          * Use kmalloc() rather than vmalloc() when we can.
          */
         dmi = NULL;
         noio_flag = memalloc_noio_save();
-        dmi = kvmalloc(param_kernel->data_size, GFP_KERNEL);
+        dmi = kvmalloc(param_kernel->data_size, GFP_KERNEL | __GFP_HIGH);
         memalloc_noio_restore(noio_flag);
 
         if (!dmi) {
diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c
index 7d893228c40f..b4b75dad816a 100644
--- a/drivers/md/dm-raid.c
+++ b/drivers/md/dm-raid.c
@@ -1927,7 +1927,7 @@ struct dm_raid_superblock {
         /********************************************************************
          * BELOW FOLLOW V1.9.0 EXTENSIONS TO THE PRISTINE SUPERBLOCK FORMAT!!!
          *
-         * FEATURE_FLAG_SUPPORTS_V190 in the features member indicates that those exist
+         * FEATURE_FLAG_SUPPORTS_V190 in the compat_features member indicates that those exist
          */
 
         __le32 flags; /* Flags defining array states for reshaping */
@@ -2092,6 +2092,11 @@ static void super_sync(struct mddev *mddev, struct md_rdev *rdev)
         sb->layout = cpu_to_le32(mddev->layout);
         sb->stripe_sectors = cpu_to_le32(mddev->chunk_sectors);
 
+        /********************************************************************
+         * BELOW FOLLOW V1.9.0 EXTENSIONS TO THE PRISTINE SUPERBLOCK FORMAT!!!
+         *
+         * FEATURE_FLAG_SUPPORTS_V190 in the compat_features member indicates that those exist
+         */
         sb->new_level = cpu_to_le32(mddev->new_level);
         sb->new_layout = cpu_to_le32(mddev->new_layout);
         sb->new_stripe_sectors = cpu_to_le32(mddev->new_chunk_sectors);
@@ -2438,8 +2443,14 @@ static int super_validate(struct raid_set *rs, struct md_rdev *rdev)
         mddev->bitmap_info.default_offset = mddev->bitmap_info.offset;
 
         if (!test_and_clear_bit(FirstUse, &rdev->flags)) {
-                /* Retrieve device size stored in superblock to be prepared for shrink */
-                rdev->sectors = le64_to_cpu(sb->sectors);
+                /*
+                 * Retrieve rdev size stored in superblock to be prepared for shrink.
+                 * Check extended superblock members are present otherwise the size
+                 * will not be set!
+                 */
+                if (le32_to_cpu(sb->compat_features) & FEATURE_FLAG_SUPPORTS_V190)
+                        rdev->sectors = le64_to_cpu(sb->sectors);
+
                 rdev->recovery_offset = le64_to_cpu(sb->disk_recovery_offset);
                 if (rdev->recovery_offset == MaxSector)
                         set_bit(In_sync, &rdev->flags);
diff --git a/drivers/md/dm-raid1.c b/drivers/md/dm-raid1.c
index a95cbb80fb34..4da8858856fb 100644
--- a/drivers/md/dm-raid1.c
+++ b/drivers/md/dm-raid1.c
@@ -145,6 +145,7 @@ static void dispatch_bios(void *context, struct bio_list *bio_list)
 
 struct dm_raid1_bio_record {
         struct mirror *m;
+        /* if details->bi_bdev == NULL, details were not saved */
         struct dm_bio_details details;
         region_t write_region;
 };
@@ -260,7 +261,7 @@ static int mirror_flush(struct dm_target *ti)
         struct mirror *m;
         struct dm_io_request io_req = {
                 .bi_op = REQ_OP_WRITE,
-                .bi_op_flags = REQ_PREFLUSH,
+                .bi_op_flags = REQ_PREFLUSH | REQ_SYNC,
                 .mem.type = DM_IO_KMEM,
                 .mem.ptr.addr = NULL,
                 .client = ms->io_client,
@@ -1198,6 +1199,8 @@ static int mirror_map(struct dm_target *ti, struct bio *bio)
         struct dm_raid1_bio_record *bio_record =
           dm_per_bio_data(bio, sizeof(struct dm_raid1_bio_record));
 
+        bio_record->details.bi_bdev = NULL;
+
         if (rw == WRITE) {
                 /* Save region for mirror_end_io() handler */
                 bio_record->write_region = dm_rh_bio_to_region(ms->rh, bio);
@@ -1256,12 +1259,22 @@ static int mirror_end_io(struct dm_target *ti, struct bio *bio, int error)
         }
 
         if (error == -EOPNOTSUPP)
-                return error;
+                goto out;
 
         if ((error == -EWOULDBLOCK) && (bio->bi_opf & REQ_RAHEAD))
-                return error;
+                goto out;
 
         if (unlikely(error)) {
+                if (!bio_record->details.bi_bdev) {
+                        /*
+                         * There wasn't enough memory to record necessary
+                         * information for a retry or there was no other
+                         * mirror in-sync.
+                         */
+                        DMERR_LIMIT("Mirror read failed.");
+                        return -EIO;
+                }
+
                 m = bio_record->m;
 
                 DMERR("Mirror read failed from %s. Trying alternative device.",
@@ -1277,6 +1290,7 @@ static int mirror_end_io(struct dm_target *ti, struct bio *bio, int error)
                         bd = &bio_record->details;
 
                         dm_bio_restore(bd, bio);
+                        bio_record->details.bi_bdev = NULL;
                         bio->bi_error = 0;
 
                         queue_bio(ms, bio, rw);
@@ -1285,6 +1299,9 @@ static int mirror_end_io(struct dm_target *ti, struct bio *bio, int error)
                 DMERR("All replicated volumes dead, failing I/O");
         }
 
+out:
+        bio_record->details.bi_bdev = NULL;
+
         return error;
 }
 
diff --git a/drivers/md/dm-snap-persistent.c b/drivers/md/dm-snap-persistent.c
index b93476c3ba3f..c5534d294773 100644
--- a/drivers/md/dm-snap-persistent.c
+++ b/drivers/md/dm-snap-persistent.c
@@ -741,7 +741,8 @@ static void persistent_commit_exception(struct dm_exception_store *store,
         /*
          * Commit exceptions to disk.
          */
-        if (ps->valid && area_io(ps, REQ_OP_WRITE, REQ_PREFLUSH | REQ_FUA))
+        if (ps->valid && area_io(ps, REQ_OP_WRITE,
+                                 REQ_PREFLUSH | REQ_FUA | REQ_SYNC))
                 ps->valid = 0;
 
         /*
diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
index 17ad50daed08..28808e5ec0fd 100644
--- a/drivers/md/dm-thin.c
+++ b/drivers/md/dm-thin.c
@@ -1094,6 +1094,19 @@ static void process_prepared_discard_passdown_pt1(struct dm_thin_new_mapping *m)
                 return;
         }
 
+        /*
+         * Increment the unmapped blocks.  This prevents a race between the
+         * passdown io and reallocation of freed blocks.
+         */
+        r = dm_pool_inc_data_range(pool->pmd, m->data_block, data_end);
+        if (r) {
+                metadata_operation_failed(pool, "dm_pool_inc_data_range", r);
+                bio_io_error(m->bio);
+                cell_defer_no_holder(tc, m->cell);
+                mempool_free(m, pool->mapping_pool);
+                return;
+        }
+
         discard_parent = bio_alloc(GFP_NOIO, 1);
         if (!discard_parent) {
                 DMWARN("%s: unable to allocate top level discard bio for passdown. Skipping passdown.",
@@ -1114,19 +1127,6 @@ static void process_prepared_discard_passdown_pt1(struct dm_thin_new_mapping *m)
                         end_discard(&op, r);
                 }
         }
-
-        /*
-         * Increment the unmapped blocks.  This prevents a race between the
-         * passdown io and reallocation of freed blocks.
-         */
-        r = dm_pool_inc_data_range(pool->pmd, m->data_block, data_end);
-        if (r) {
-                metadata_operation_failed(pool, "dm_pool_inc_data_range", r);
-                bio_io_error(m->bio);
-                cell_defer_no_holder(tc, m->cell);
-                mempool_free(m, pool->mapping_pool);
-                return;
-        }
 }
 
 static void process_prepared_discard_passdown_pt2(struct dm_thin_new_mapping *m)
diff --git a/drivers/md/dm-verity-target.c b/drivers/md/dm-verity-target.c
index 97de961a3bfc..1ec9b2c51c07 100644
--- a/drivers/md/dm-verity-target.c
+++ b/drivers/md/dm-verity-target.c
@@ -166,7 +166,7 @@ static int verity_hash_init(struct dm_verity *v, struct ahash_request *req,
                 return r;
         }
 
-        if (likely(v->version >= 1))
+        if (likely(v->salt_size && (v->version >= 1)))
                 r = verity_hash_update(v, req, v->salt, v->salt_size, res);
 
         return r;
@@ -177,7 +177,7 @@ static int verity_hash_final(struct dm_verity *v, struct ahash_request *req,
 {
         int r;
 
-        if (unlikely(!v->version)) {
+        if (unlikely(v->salt_size && (!v->version))) {
                 r = verity_hash_update(v, req, v->salt, v->salt_size, res);
 
                 if (r < 0) {
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index 6ef9500226c0..37ccd73c79ec 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -1657,7 +1657,7 @@ static struct mapped_device *alloc_dev(int minor)
 
         bio_init(&md->flush_bio, NULL, 0);
         md->flush_bio.bi_bdev = md->bdev;
-        md->flush_bio.bi_opf = REQ_OP_WRITE | REQ_PREFLUSH;
+        md->flush_bio.bi_opf = REQ_OP_WRITE | REQ_PREFLUSH | REQ_SYNC;
 
         dm_stats_init(&md->stats);
 
diff --git a/drivers/md/md-cluster.c b/drivers/md/md-cluster.c
index 7299ce2f08a8..03082e17c65c 100644
--- a/drivers/md/md-cluster.c
+++ b/drivers/md/md-cluster.c
@@ -1311,8 +1311,10 @@ static int add_new_disk(struct mddev *mddev, struct md_rdev *rdev)
         cmsg.raid_slot = cpu_to_le32(rdev->desc_nr);
         lock_comm(cinfo, 1);
         ret = __sendmsg(cinfo, &cmsg);
-        if (ret)
+        if (ret) {
+                unlock_comm(cinfo);
                 return ret;
+        }
         cinfo->no_new_dev_lockres->flags |= DLM_LKF_NOQUEUE;
         ret = dlm_lock_sync(cinfo->no_new_dev_lockres, DLM_LOCK_EX);
         cinfo->no_new_dev_lockres->flags &= ~DLM_LKF_NOQUEUE;
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 10367ffe92e3..87edc342ccb3 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -765,7 +765,7 @@ void md_super_write(struct mddev *mddev, struct md_rdev *rdev,
             test_bit(FailFast, &rdev->flags) &&
             !test_bit(LastDev, &rdev->flags))
                 ff = MD_FAILFAST;
-        bio->bi_opf = REQ_OP_WRITE | REQ_PREFLUSH | REQ_FUA | ff;
+        bio->bi_opf = REQ_OP_WRITE | REQ_SYNC | REQ_PREFLUSH | REQ_FUA | ff;
 
         atomic_inc(&mddev->pending_writes);
         submit_bio(bio);
@@ -5174,6 +5174,18 @@ static void mddev_delayed_delete(struct work_struct *ws)
 
 static void no_op(struct percpu_ref *r) {}
 
+int mddev_init_writes_pending(struct mddev *mddev)
+{
+        if (mddev->writes_pending.percpu_count_ptr)
+                return 0;
+        if (percpu_ref_init(&mddev->writes_pending, no_op, 0, GFP_KERNEL) < 0)
+                return -ENOMEM;
+        /* We want to start with the refcount at zero */
+        percpu_ref_put(&mddev->writes_pending);
+        return 0;
+}
+EXPORT_SYMBOL_GPL(mddev_init_writes_pending);
+
 static int md_alloc(dev_t dev, char *name)
 {
         /*
@@ -5239,10 +5251,6 @@ static int md_alloc(dev_t dev, char *name)
         blk_queue_make_request(mddev->queue, md_make_request);
         blk_set_stacking_limits(&mddev->queue->limits);
 
-        if (percpu_ref_init(&mddev->writes_pending, no_op, 0, GFP_KERNEL) < 0)
-                goto abort;
-        /* We want to start with the refcount at zero */
-        percpu_ref_put(&mddev->writes_pending);
         disk = alloc_disk(1 << shift);
         if (!disk) {
                 blk_cleanup_queue(mddev->queue);
diff --git a/drivers/md/md.h b/drivers/md/md.h
index 11f15146ce51..0fa1de42c42b 100644
--- a/drivers/md/md.h
+++ b/drivers/md/md.h
@@ -648,6 +648,7 @@ extern void md_unregister_thread(struct md_thread **threadp);
 extern void md_wakeup_thread(struct md_thread *thread);
 extern void md_check_recovery(struct mddev *mddev);
 extern void md_reap_sync_thread(struct mddev *mddev);
+extern int mddev_init_writes_pending(struct mddev *mddev);
 extern void md_write_start(struct mddev *mddev, struct bio *bi);
 extern void md_write_inc(struct mddev *mddev, struct bio *bi);
 extern void md_write_end(struct mddev *mddev);
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index af5056d56878..e1a7e3d4c5e4 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -3063,6 +3063,8 @@ static int raid1_run(struct mddev *mddev)
                         mdname(mddev));
                 return -EIO;
         }
+        if (mddev_init_writes_pending(mddev) < 0)
+                return -ENOMEM;
         /*
          * copy the already verified devices into our private RAID1
          * bookkeeping area. [whatever we allocate in run(),
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 4343d7ff9916..797ed60abd5e 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -3611,6 +3611,9 @@ static int raid10_run(struct mddev *mddev)
         int first = 1;
         bool discard_supported = false;
 
+        if (mddev_init_writes_pending(mddev) < 0)
+                return -ENOMEM;
+
         if (mddev->private == NULL) {
                 conf = setup_conf(mddev);
                 if (IS_ERR(conf))
diff --git a/drivers/md/raid5-cache.c b/drivers/md/raid5-cache.c
index 4c00bc248287..0a7af8b0a80a 100644
--- a/drivers/md/raid5-cache.c
+++ b/drivers/md/raid5-cache.c
@@ -1782,7 +1782,7 @@ static int r5l_log_write_empty_meta_block(struct r5l_log *log, sector_t pos,
         mb->checksum = cpu_to_le32(crc32c_le(log->uuid_checksum,
                                              mb, PAGE_SIZE));
         if (!sync_page_io(log->rdev, pos, PAGE_SIZE, page, REQ_OP_WRITE,
-                          REQ_FUA, false)) {
+                          REQ_SYNC | REQ_FUA, false)) {
                 __free_page(page);
                 return -EIO;
         }
@@ -2388,7 +2388,7 @@ r5c_recovery_rewrite_data_only_stripes(struct r5l_log *log,
                 mb->checksum = cpu_to_le32(crc32c_le(log->uuid_checksum,
                                                      mb, PAGE_SIZE));
                 sync_page_io(log->rdev, ctx->pos, PAGE_SIZE, page,
-                             REQ_OP_WRITE, REQ_FUA, false);
+                             REQ_OP_WRITE, REQ_SYNC | REQ_FUA, false);
                 sh->log_start = ctx->pos;
                 list_add_tail(&sh->r5c, &log->stripe_in_journal_list);
                 atomic_inc(&log->stripe_in_journal_count);
diff --git a/drivers/md/raid5-ppl.c b/drivers/md/raid5-ppl.c
index 5d25bebf3328..ccce92e68d7f 100644
--- a/drivers/md/raid5-ppl.c
+++ b/drivers/md/raid5-ppl.c
@@ -907,8 +907,8 @@ static int ppl_write_empty_header(struct ppl_log *log)
         pplhdr->checksum = cpu_to_le32(~crc32c_le(~0, pplhdr, PAGE_SIZE));
 
         if (!sync_page_io(rdev, rdev->ppl.sector - rdev->data_offset,
-                          PPL_HEADER_SIZE, page, REQ_OP_WRITE | REQ_FUA, 0,
-                          false)) {
+                          PPL_HEADER_SIZE, page, REQ_OP_WRITE | REQ_SYNC |
+                          REQ_FUA, 0, false)) {
                 md_error(rdev->mddev, rdev);
                 ret = -EIO;
         }
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 9c4f7659f8b1..ec0f951ae19f 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -4085,10 +4085,15 @@ static void handle_parity_checks5(struct r5conf *conf, struct stripe_head *sh,
                         set_bit(STRIPE_INSYNC, &sh->state);
                 else {
                         atomic64_add(STRIPE_SECTORS, &conf->mddev->resync_mismatches);
-                        if (test_bit(MD_RECOVERY_CHECK, &conf->mddev->recovery))
+                        if (test_bit(MD_RECOVERY_CHECK, &conf->mddev->recovery)) {
                                 /* don't try to repair!! */
                                 set_bit(STRIPE_INSYNC, &sh->state);
-                        else {
+                                pr_warn_ratelimited("%s: mismatch sector in range "
+                                                    "%llu-%llu\n", mdname(conf->mddev),
+                                                    (unsigned long long) sh->sector,
+                                                    (unsigned long long) sh->sector +
+                                                    STRIPE_SECTORS);
+                        } else {
                                 sh->check_state = check_state_compute_run;
                                 set_bit(STRIPE_COMPUTE_RUN, &sh->state);
                                 set_bit(STRIPE_OP_COMPUTE_BLK, &s->ops_request);
@@ -4237,10 +4242,15 @@ static void handle_parity_checks6(struct r5conf *conf, struct stripe_head *sh,
                         }
                 } else {
                         atomic64_add(STRIPE_SECTORS, &conf->mddev->resync_mismatches);
-                        if (test_bit(MD_RECOVERY_CHECK, &conf->mddev->recovery))
+                        if (test_bit(MD_RECOVERY_CHECK, &conf->mddev->recovery)) {
                                 /* don't try to repair!! */
                                 set_bit(STRIPE_INSYNC, &sh->state);
-                        else {
+                                pr_warn_ratelimited("%s: mismatch sector in range "
+                                                    "%llu-%llu\n", mdname(conf->mddev),
+                                                    (unsigned long long) sh->sector,
+                                                    (unsigned long long) sh->sector +
+                                                    STRIPE_SECTORS);
+                        } else {
                                 int *target = &sh->ops.target;
 
                                 sh->ops.target = -1;
@@ -7108,6 +7118,9 @@ static int raid5_run(struct mddev *mddev)
         long long min_offset_diff = 0;
         int first = 1;
 
+        if (mddev_init_writes_pending(mddev) < 0)
+                return -ENOMEM;
+
         if (mddev->recovery_cp != MaxSector)
                 pr_notice("md/raid:%s: not clean -- starting background reconstruction\n",
                           mdname(mddev));
diff --git a/drivers/media/Kconfig b/drivers/media/Kconfig
index b72edd27f880..55d9c2b82b7e 100644
--- a/drivers/media/Kconfig
+++ b/drivers/media/Kconfig
@@ -2,6 +2,12 @@
 # Multimedia device configuration
 #
 
+config CEC_CORE
+        tristate
+
+config CEC_NOTIFIER
+        bool
+
 menuconfig MEDIA_SUPPORT
         tristate "Multimedia support"
         depends on HAS_IOMEM
diff --git a/drivers/media/Makefile b/drivers/media/Makefile
index 523fea3648ad..044503aa8801 100644
--- a/drivers/media/Makefile
+++ b/drivers/media/Makefile
@@ -4,8 +4,6 @@
 
 media-objs      := media-device.o media-devnode.o media-entity.o
 
-obj-$(CONFIG_CEC_CORE) += cec/
-
 #
 # I2C drivers should come before other drivers, otherwise they'll fail
 # when compiled as builtin drivers
@@ -26,6 +24,8 @@ obj-$(CONFIG_DVB_CORE)  += dvb-core/
 # There are both core and drivers at RC subtree - merge before drivers
 obj-y += rc/
 
+obj-$(CONFIG_CEC_CORE) += cec/
+
 #
 # Finally, merge the drivers that require the core
 #
diff --git a/drivers/media/cec/Kconfig b/drivers/media/cec/Kconfig
index f944d93e3167..43428cec3a01 100644
--- a/drivers/media/cec/Kconfig
+++ b/drivers/media/cec/Kconfig
@@ -1,19 +1,6 @@
-config CEC_CORE
-        tristate
-        depends on MEDIA_CEC_SUPPORT
-        default y
-
-config MEDIA_CEC_NOTIFIER
-        bool
-
 config MEDIA_CEC_RC
         bool "HDMI CEC RC integration"
         depends on CEC_CORE && RC_CORE
+        depends on CEC_CORE=m || RC_CORE=y
         ---help---
           Pass on CEC remote control messages to the RC framework.
-
-config MEDIA_CEC_DEBUG
-        bool "HDMI CEC debugfs interface"
-        depends on CEC_CORE && DEBUG_FS
-        ---help---
-          Turns on the DebugFS interface for CEC devices.
diff --git a/drivers/media/cec/Makefile b/drivers/media/cec/Makefile
index 402a6c62a3e8..eaf408e64669 100644
--- a/drivers/media/cec/Makefile
+++ b/drivers/media/cec/Makefile
@@ -1,6 +1,6 @@
 cec-objs := cec-core.o cec-adap.o cec-api.o cec-edid.o
 
-ifeq ($(CONFIG_MEDIA_CEC_NOTIFIER),y)
+ifeq ($(CONFIG_CEC_NOTIFIER),y)
   cec-objs += cec-notifier.o
 endif
 
diff --git a/drivers/media/cec/cec-adap.c b/drivers/media/cec/cec-adap.c
index f5fe01c9da8a..9dfc79800c71 100644
--- a/drivers/media/cec/cec-adap.c
+++ b/drivers/media/cec/cec-adap.c
@@ -1864,7 +1864,7 @@ void cec_monitor_all_cnt_dec(struct cec_adapter *adap)
                 WARN_ON(call_op(adap, adap_monitor_all_enable, 0));
 }
 
-#ifdef CONFIG_MEDIA_CEC_DEBUG
+#ifdef CONFIG_DEBUG_FS
 /*
  * Log the current state of the CEC adapter.
  * Very useful for debugging.
diff --git a/drivers/media/cec/cec-api.c b/drivers/media/cec/cec-api.c
index 0860fb458757..999926f731c8 100644
--- a/drivers/media/cec/cec-api.c
+++ b/drivers/media/cec/cec-api.c
@@ -271,16 +271,10 @@ static long cec_receive(struct cec_adapter *adap, struct cec_fh *fh,
                         bool block, struct cec_msg __user *parg)
 {
         struct cec_msg msg = {};
-        long err = 0;
+        long err;
 
         if (copy_from_user(&msg, parg, sizeof(msg)))
                 return -EFAULT;
-        mutex_lock(&adap->lock);
-        if (!adap->is_configured && fh->mode_follower < CEC_MODE_MONITOR)
-                err = -ENONET;
-        mutex_unlock(&adap->lock);
-        if (err)
-                return err;
 
         err = cec_receive_msg(fh, &msg, block);
         if (err)
diff --git a/drivers/media/cec/cec-core.c b/drivers/media/cec/cec-core.c
index f9ebff90f8eb..2f87748ba4fc 100644
--- a/drivers/media/cec/cec-core.c
+++ b/drivers/media/cec/cec-core.c
@@ -187,7 +187,7 @@ static void cec_devnode_unregister(struct cec_devnode *devnode)
         put_device(&devnode->dev);
 }
 
-#ifdef CONFIG_MEDIA_CEC_NOTIFIER
+#ifdef CONFIG_CEC_NOTIFIER
 static void cec_cec_notify(struct cec_adapter *adap, u16 pa)
 {
         cec_s_phys_addr(adap, pa, false);
@@ -323,7 +323,7 @@ int cec_register_adapter(struct cec_adapter *adap,
         }
 
         dev_set_drvdata(&adap->devnode.dev, adap);
-#ifdef CONFIG_MEDIA_CEC_DEBUG
+#ifdef CONFIG_DEBUG_FS
         if (!top_cec_dir)
                 return 0;
 
@@ -355,7 +355,7 @@ void cec_unregister_adapter(struct cec_adapter *adap)
         adap->rc = NULL;
 #endif
         debugfs_remove_recursive(adap->cec_dir);
-#ifdef CONFIG_MEDIA_CEC_NOTIFIER
+#ifdef CONFIG_CEC_NOTIFIER
         if (adap->notifier)
                 cec_notifier_unregister(adap->notifier);
 #endif
@@ -395,7 +395,7 @@ static int __init cec_devnode_init(void)
                 return ret;
         }
 
-#ifdef CONFIG_MEDIA_CEC_DEBUG
+#ifdef CONFIG_DEBUG_FS
         top_cec_dir = debugfs_create_dir("cec", NULL);
         if (IS_ERR_OR_NULL(top_cec_dir)) {
                 pr_warn("cec: Failed to create debugfs cec dir\n");
diff --git a/drivers/media/i2c/Kconfig b/drivers/media/i2c/Kconfig
index fd181c99ce11..aaa9471c7d11 100644
--- a/drivers/media/i2c/Kconfig
+++ b/drivers/media/i2c/Kconfig
@@ -220,7 +220,8 @@ config VIDEO_ADV7604
 
 config VIDEO_ADV7604_CEC
         bool "Enable Analog Devices ADV7604 CEC support"
-        depends on VIDEO_ADV7604 && CEC_CORE
+        depends on VIDEO_ADV7604
+        select CEC_CORE
         ---help---
           When selected the adv7604 will support the optional
           HDMI CEC feature.
@@ -240,7 +241,8 @@ config VIDEO_ADV7842
 
 config VIDEO_ADV7842_CEC
         bool "Enable Analog Devices ADV7842 CEC support"
-        depends on VIDEO_ADV7842 && CEC_CORE
+        depends on VIDEO_ADV7842
+        select CEC_CORE
         ---help---
           When selected the adv7842 will support the optional
           HDMI CEC feature.
@@ -478,7 +480,8 @@ config VIDEO_ADV7511
 
 config VIDEO_ADV7511_CEC
         bool "Enable Analog Devices ADV7511 CEC support"
-        depends on VIDEO_ADV7511 && CEC_CORE
+        depends on VIDEO_ADV7511
+        select CEC_CORE
         ---help---
           When selected the adv7511 will support the optional
           HDMI CEC feature.
diff --git a/drivers/media/i2c/tc358743.c b/drivers/media/i2c/tc358743.c
index acef4eca269f..3251cba89e8f 100644
--- a/drivers/media/i2c/tc358743.c
+++ b/drivers/media/i2c/tc358743.c
@@ -223,7 +223,7 @@ static void i2c_wr8(struct v4l2_subdev *sd, u16 reg, u8 val)
 static void i2c_wr8_and_or(struct v4l2_subdev *sd, u16 reg,
                 u8 mask, u8 val)
 {
-        i2c_wrreg(sd, reg, (i2c_rdreg(sd, reg, 2) & mask) | val, 2);
+        i2c_wrreg(sd, reg, (i2c_rdreg(sd, reg, 1) & mask) | val, 1);
 }
 
 static u16 i2c_rd16(struct v4l2_subdev *sd, u16 reg)
diff --git a/drivers/media/platform/Kconfig b/drivers/media/platform/Kconfig
index ac026ee1ca07..041cb80a26b1 100644
--- a/drivers/media/platform/Kconfig
+++ b/drivers/media/platform/Kconfig
@@ -501,8 +501,9 @@ if CEC_PLATFORM_DRIVERS
 
 config VIDEO_SAMSUNG_S5P_CEC
        tristate "Samsung S5P CEC driver"
-       depends on CEC_CORE && (PLAT_S5P || ARCH_EXYNOS || COMPILE_TEST)
-       select MEDIA_CEC_NOTIFIER
+       depends on PLAT_S5P || ARCH_EXYNOS || COMPILE_TEST
+       select CEC_CORE
+       select CEC_NOTIFIER
        ---help---
          This is a driver for Samsung S5P HDMI CEC interface. It uses the
          generic CEC framework interface.
@@ -511,8 +512,9 @@ config VIDEO_SAMSUNG_S5P_CEC
 
 config VIDEO_STI_HDMI_CEC
        tristate "STMicroelectronics STiH4xx HDMI CEC driver"
-       depends on CEC_CORE && (ARCH_STI || COMPILE_TEST)
-       select MEDIA_CEC_NOTIFIER
+       depends on ARCH_STI || COMPILE_TEST
+       select CEC_CORE
+       select CEC_NOTIFIER
        ---help---
          This is a driver for STIH4xx HDMI CEC interface. It uses the
          generic CEC framework interface.
diff --git a/drivers/media/platform/mtk-vcodec/vdec/vdec_h264_if.c b/drivers/media/platform/mtk-vcodec/vdec/vdec_h264_if.c
index 57a842ff3097..b7731b18ecae 100644
--- a/drivers/media/platform/mtk-vcodec/vdec/vdec_h264_if.c
+++ b/drivers/media/platform/mtk-vcodec/vdec/vdec_h264_if.c
@@ -493,10 +493,10 @@ static int vdec_h264_get_param(unsigned long h_vdec,
 }
 
 static struct vdec_common_if vdec_h264_if = {
-        vdec_h264_init,
-        vdec_h264_decode,
-        vdec_h264_get_param,
-        vdec_h264_deinit,
+        .init           = vdec_h264_init,
+        .decode         = vdec_h264_decode,
+        .get_param      = vdec_h264_get_param,
+        .deinit         = vdec_h264_deinit,
 };
 
 struct vdec_common_if *get_h264_dec_comm_if(void);
diff --git a/drivers/media/platform/mtk-vcodec/vdec/vdec_vp8_if.c b/drivers/media/platform/mtk-vcodec/vdec/vdec_vp8_if.c
index 6e7a62ae0842..b9fad6a48879 100644
--- a/drivers/media/platform/mtk-vcodec/vdec/vdec_vp8_if.c
+++ b/drivers/media/platform/mtk-vcodec/vdec/vdec_vp8_if.c
@@ -620,10 +620,10 @@ static void vdec_vp8_deinit(unsigned long h_vdec)
 }
 
 static struct vdec_common_if vdec_vp8_if = {
-        vdec_vp8_init,
-        vdec_vp8_decode,
-        vdec_vp8_get_param,
-        vdec_vp8_deinit,
+        .init           = vdec_vp8_init,
+        .decode         = vdec_vp8_decode,
+        .get_param      = vdec_vp8_get_param,
+        .deinit         = vdec_vp8_deinit,
 };
 
 struct vdec_common_if *get_vp8_dec_comm_if(void);
diff --git a/drivers/media/platform/mtk-vcodec/vdec/vdec_vp9_if.c b/drivers/media/platform/mtk-vcodec/vdec/vdec_vp9_if.c
index 5539b1853f16..1daee1207469 100644
--- a/drivers/media/platform/mtk-vcodec/vdec/vdec_vp9_if.c
+++ b/drivers/media/platform/mtk-vcodec/vdec/vdec_vp9_if.c
@@ -979,10 +979,10 @@ static int vdec_vp9_get_param(unsigned long h_vdec,
 }
 
 static struct vdec_common_if vdec_vp9_if = {
-        vdec_vp9_init,
-        vdec_vp9_decode,
-        vdec_vp9_get_param,
-        vdec_vp9_deinit,
+        .init           = vdec_vp9_init,
+        .decode         = vdec_vp9_decode,
+        .get_param      = vdec_vp9_get_param,
+        .deinit         = vdec_vp9_deinit,
 };
 
 struct vdec_common_if *get_vp9_dec_comm_if(void);
diff --git a/drivers/media/platform/vivid/Kconfig b/drivers/media/platform/vivid/Kconfig
index b36ac19dc6e4..154de92dd809 100644
--- a/drivers/media/platform/vivid/Kconfig
+++ b/drivers/media/platform/vivid/Kconfig
@@ -26,7 +26,8 @@ config VIDEO_VIVID
 
 config VIDEO_VIVID_CEC
         bool "Enable CEC emulation support"
-        depends on VIDEO_VIVID && CEC_CORE
+        depends on VIDEO_VIVID
+        select CEC_CORE
         ---help---
           When selected the vivid module will emulate the optional
           HDMI CEC feature.
diff --git a/drivers/media/rc/rc-ir-raw.c b/drivers/media/rc/rc-ir-raw.c
index 90f66dc7c0d7..a2fc1a1d58b0 100644
--- a/drivers/media/rc/rc-ir-raw.c
+++ b/drivers/media/rc/rc-ir-raw.c
@@ -211,7 +211,7 @@ EXPORT_SYMBOL_GPL(ir_raw_event_set_idle);
  */
 void ir_raw_event_handle(struct rc_dev *dev)
 {
-        if (!dev->raw)
+        if (!dev->raw || !dev->raw->thread)
                 return;
 
         wake_up_process(dev->raw->thread);
@@ -490,6 +490,7 @@ int ir_raw_event_register(struct rc_dev *dev)
 {
         int rc;
         struct ir_raw_handler *handler;
+        struct task_struct *thread;
 
         if (!dev)
                 return -EINVAL;
@@ -507,13 +508,15 @@ int ir_raw_event_register(struct rc_dev *dev)
          * because the event is coming from userspace
          */
         if (dev->driver_type != RC_DRIVER_IR_RAW_TX) {
-                dev->raw->thread = kthread_run(ir_raw_event_thread, dev->raw,
-                                               "rc%u", dev->minor);
+                thread = kthread_run(ir_raw_event_thread, dev->raw, "rc%u",
+                                     dev->minor);
 
-                if (IS_ERR(dev->raw->thread)) {
-                        rc = PTR_ERR(dev->raw->thread);
+                if (IS_ERR(thread)) {
+                        rc = PTR_ERR(thread);
                         goto out;
                 }
+
+                dev->raw->thread = thread;
         }
 
         mutex_lock(&ir_raw_handler_lock);
diff --git a/drivers/media/rc/sir_ir.c b/drivers/media/rc/sir_ir.c
index e12ec50bf0bf..90a5f8fd5eea 100644
--- a/drivers/media/rc/sir_ir.c
+++ b/drivers/media/rc/sir_ir.c
@@ -183,9 +183,15 @@ static irqreturn_t sir_interrupt(int irq, void *dev_id)
         static unsigned long delt;
         unsigned long deltintr;
         unsigned long flags;
+        int counter = 0;
         int iir, lsr;
 
         while ((iir = inb(io + UART_IIR) & UART_IIR_ID)) {
+                if (++counter > 256) {
+                        dev_err(&sir_ir_dev->dev, "Trapped in interrupt");
+                        break;
+                }
+
                 switch (iir & UART_IIR_ID) { /* FIXME toto treba preriedit */
                 case UART_IIR_MSI:
                         (void)inb(io + UART_MSR);
diff --git a/drivers/media/usb/pulse8-cec/Kconfig b/drivers/media/usb/pulse8-cec/Kconfig
index 8937f3986a01..18ead44824ba 100644
--- a/drivers/media/usb/pulse8-cec/Kconfig
+++ b/drivers/media/usb/pulse8-cec/Kconfig
@@ -1,6 +1,7 @@
 config USB_PULSE8_CEC
         tristate "Pulse Eight HDMI CEC"
-        depends on USB_ACM && CEC_CORE
+        depends on USB_ACM
+        select CEC_CORE
         select SERIO
         select SERIO_SERPORT
         ---help---
diff --git a/drivers/media/usb/rainshadow-cec/Kconfig b/drivers/media/usb/rainshadow-cec/Kconfig
index 3eb86607efb8..030ef01b1ff0 100644
--- a/drivers/media/usb/rainshadow-cec/Kconfig
+++ b/drivers/media/usb/rainshadow-cec/Kconfig
@@ -1,6 +1,7 @@
 config USB_RAINSHADOW_CEC
         tristate "RainShadow Tech HDMI CEC"
-        depends on USB_ACM && CEC_CORE
+        depends on USB_ACM
+        select CEC_CORE
         select SERIO
         select SERIO_SERPORT
         ---help---
diff --git a/drivers/media/usb/rainshadow-cec/rainshadow-cec.c b/drivers/media/usb/rainshadow-cec/rainshadow-cec.c
index 541ca543f71f..4126552c9055 100644
--- a/drivers/media/usb/rainshadow-cec/rainshadow-cec.c
+++ b/drivers/media/usb/rainshadow-cec/rainshadow-cec.c
@@ -119,7 +119,7 @@ static void rain_irq_work_handler(struct work_struct *work)
 
         while (true) {
                 unsigned long flags;
-                bool exit_loop;
+                bool exit_loop = false;
                 char data;
 
                 spin_lock_irqsave(&rain->buf_lock, flags);
@@ -336,6 +336,7 @@ static int rain_connect(struct serio *serio, struct serio_driver *drv)
         serio_set_drvdata(serio, rain);
         INIT_WORK(&rain->work, rain_irq_work_handler);
         mutex_init(&rain->write_lock);
+        spin_lock_init(&rain->buf_lock);
 
         err = serio_open(serio, drv);
         if (err)
diff --git a/drivers/media/v4l2-core/videobuf2-core.c b/drivers/media/v4l2-core/videobuf2-core.c
index 94afbbf92807..c0175ea7e7ad 100644
--- a/drivers/media/v4l2-core/videobuf2-core.c
+++ b/drivers/media/v4l2-core/videobuf2-core.c
@@ -868,7 +868,7 @@ EXPORT_SYMBOL_GPL(vb2_core_create_bufs);
 
 void *vb2_plane_vaddr(struct vb2_buffer *vb, unsigned int plane_no)
 {
-        if (plane_no > vb->num_planes || !vb->planes[plane_no].mem_priv)
+        if (plane_no >= vb->num_planes || !vb->planes[plane_no].mem_priv)
                 return NULL;
 
         return call_ptr_memop(vb, vaddr, vb->planes[plane_no].mem_priv);
diff --git a/drivers/memory/atmel-ebi.c b/drivers/memory/atmel-ebi.c
index 35910f945bfa..99e644cda4d1 100644
--- a/drivers/memory/atmel-ebi.c
+++ b/drivers/memory/atmel-ebi.c
@@ -581,7 +581,7 @@ static int atmel_ebi_probe(struct platform_device *pdev)
         return of_platform_populate(np, NULL, NULL, dev);
 }
 
-static int atmel_ebi_resume(struct device *dev)
+static __maybe_unused int atmel_ebi_resume(struct device *dev)
 {
         struct atmel_ebi *ebi = dev_get_drvdata(dev);
         struct atmel_ebi_dev *ebid;
diff --git a/drivers/mfd/arizona-core.c b/drivers/mfd/arizona-core.c
index 75488e65cd96..8d46e3ad9529 100644
--- a/drivers/mfd/arizona-core.c
+++ b/drivers/mfd/arizona-core.c
@@ -245,8 +245,7 @@ static int arizona_poll_reg(struct arizona *arizona,
         int ret;
 
         ret = regmap_read_poll_timeout(arizona->regmap,
-                                       ARIZONA_INTERRUPT_RAW_STATUS_5, val,
-                                       ((val & mask) == target),
+                                       reg, val, ((val & mask) == target),
                                        ARIZONA_REG_POLL_DELAY_US,
                                        timeout_ms * 1000);
         if (ret)
diff --git a/drivers/misc/cxl/context.c b/drivers/misc/cxl/context.c
index 4472ce11f98d..8c32040b9c09 100644
--- a/drivers/misc/cxl/context.c
+++ b/drivers/misc/cxl/context.c
@@ -45,7 +45,7 @@ int cxl_context_init(struct cxl_context *ctx, struct cxl_afu *afu, bool master)
         mutex_init(&ctx->mapping_lock);
         ctx->mapping = NULL;
 
-        if (cxl_is_psl8(afu)) {
+        if (cxl_is_power8()) {
                 spin_lock_init(&ctx->sste_lock);
 
                 /*
@@ -189,7 +189,7 @@ int cxl_context_iomap(struct cxl_context *ctx, struct vm_area_struct *vma)
                 if (start + len > ctx->afu->adapter->ps_size)
                         return -EINVAL;
 
-                if (cxl_is_psl9(ctx->afu)) {
+                if (cxl_is_power9()) {
                         /*
                          * Make sure there is a valid problem state
                          * area space for this AFU.
@@ -324,7 +324,7 @@ static void reclaim_ctx(struct rcu_head *rcu)
 {
         struct cxl_context *ctx = container_of(rcu, struct cxl_context, rcu);
 
-        if (cxl_is_psl8(ctx->afu))
+        if (cxl_is_power8())
                 free_page((u64)ctx->sstp);
         if (ctx->ff_page)
                 __free_page(ctx->ff_page);
diff --git a/drivers/misc/cxl/cxl.h b/drivers/misc/cxl/cxl.h
index c8568ea7c518..a03f8e7535e5 100644
--- a/drivers/misc/cxl/cxl.h
+++ b/drivers/misc/cxl/cxl.h
@@ -357,6 +357,7 @@ static const cxl_p2n_reg_t CXL_PSL_WED_An     = {0x0A0};
 #define CXL_PSL9_DSISR_An_PF_RGP  0x0000000000000090ULL  /* PTE not found (Radix Guest (parent)) 0b10010000 */
 #define CXL_PSL9_DSISR_An_PF_HRH  0x0000000000000094ULL  /* PTE not found (HPT/Radix Host)       0b10010100 */
 #define CXL_PSL9_DSISR_An_PF_STEG 0x000000000000009CULL  /* PTE not found (STEG VA)              0b10011100 */
+#define CXL_PSL9_DSISR_An_URTCH   0x00000000000000B4ULL  /* Unsupported Radix Tree Configuration 0b10110100 */
 
 /****** CXL_PSL_TFC_An ******************************************************/
 #define CXL_PSL_TFC_An_A  (1ull << (63-28)) /* Acknowledge non-translation fault */
@@ -844,24 +845,15 @@ static inline bool cxl_is_power8(void)
 
 static inline bool cxl_is_power9(void)
 {
-        /* intermediate solution */
-        if (!cxl_is_power8() &&
-           (cpu_has_feature(CPU_FTRS_POWER9) ||
-            cpu_has_feature(CPU_FTR_POWER9_DD1)))
+        if (pvr_version_is(PVR_POWER9))
                 return true;
         return false;
 }
 
-static inline bool cxl_is_psl8(struct cxl_afu *afu)
+static inline bool cxl_is_power9_dd1(void)
 {
-        if (afu->adapter->caia_major == 1)
-                return true;
-        return false;
-}
-
-static inline bool cxl_is_psl9(struct cxl_afu *afu)
-{
-        if (afu->adapter->caia_major == 2)
+        if ((pvr_version_is(PVR_POWER9)) &&
+            cpu_has_feature(CPU_FTR_POWER9_DD1))
                 return true;
         return false;
 }
diff --git a/drivers/misc/cxl/fault.c b/drivers/misc/cxl/fault.c
index 5344448f514e..c79e39bad7a4 100644
--- a/drivers/misc/cxl/fault.c
+++ b/drivers/misc/cxl/fault.c
@@ -187,7 +187,7 @@ static struct mm_struct *get_mem_context(struct cxl_context *ctx)
 
 static bool cxl_is_segment_miss(struct cxl_context *ctx, u64 dsisr)
 {
-        if ((cxl_is_psl8(ctx->afu)) && (dsisr & CXL_PSL_DSISR_An_DS))
+        if ((cxl_is_power8() && (dsisr & CXL_PSL_DSISR_An_DS)))
                 return true;
 
         return false;
@@ -195,16 +195,23 @@ static bool cxl_is_segment_miss(struct cxl_context *ctx, u64 dsisr)
 
 static bool cxl_is_page_fault(struct cxl_context *ctx, u64 dsisr)
 {
-        if ((cxl_is_psl8(ctx->afu)) && (dsisr & CXL_PSL_DSISR_An_DM))
-                return true;
+        u64 crs; /* Translation Checkout Response Status */
 
-        if ((cxl_is_psl9(ctx->afu)) &&
-           ((dsisr & CXL_PSL9_DSISR_An_CO_MASK) &
-                (CXL_PSL9_DSISR_An_PF_SLR | CXL_PSL9_DSISR_An_PF_RGC |
-                 CXL_PSL9_DSISR_An_PF_RGP | CXL_PSL9_DSISR_An_PF_HRH |
-                 CXL_PSL9_DSISR_An_PF_STEG)))
+        if ((cxl_is_power8()) && (dsisr & CXL_PSL_DSISR_An_DM))
                 return true;
 
+        if (cxl_is_power9()) {
+                crs = (dsisr & CXL_PSL9_DSISR_An_CO_MASK);
+                if ((crs == CXL_PSL9_DSISR_An_PF_SLR) ||
+                    (crs == CXL_PSL9_DSISR_An_PF_RGC) ||
+                    (crs == CXL_PSL9_DSISR_An_PF_RGP) ||
+                    (crs == CXL_PSL9_DSISR_An_PF_HRH) ||
+                    (crs == CXL_PSL9_DSISR_An_PF_STEG) ||
+                    (crs == CXL_PSL9_DSISR_An_URTCH)) {
+                        return true;
+                }
+        }
+
         return false;
 }
 
diff --git a/drivers/misc/cxl/file.c b/drivers/misc/cxl/file.c
index 17b433f1ce23..0761271d68c5 100644
--- a/drivers/misc/cxl/file.c
+++ b/drivers/misc/cxl/file.c
@@ -159,11 +159,8 @@ static long afu_ioctl_start_work(struct cxl_context *ctx,
 
         /* Do this outside the status_mutex to avoid a circular dependency with
          * the locking in cxl_mmap_fault() */
-        if (copy_from_user(&work, uwork,
-                           sizeof(struct cxl_ioctl_start_work))) {
-                rc = -EFAULT;
-                goto out;
-        }
+        if (copy_from_user(&work, uwork, sizeof(work)))
+                return -EFAULT;
 
         mutex_lock(&ctx->status_mutex);
         if (ctx->status != OPENED) {
diff --git a/drivers/misc/cxl/main.c b/drivers/misc/cxl/main.c
index 1703655072b1..c1ba0d42cbc8 100644
--- a/drivers/misc/cxl/main.c
+++ b/drivers/misc/cxl/main.c
@@ -329,8 +329,15 @@ static int __init init_cxl(void)
 
         cxl_debugfs_init();
 
-        if ((rc = register_cxl_calls(&cxl_calls)))
-                goto err;
+        /*
+         * we don't register the callback on P9. slb callack is only
+         * used for the PSL8 MMU and CX4.
+         */
+        if (cxl_is_power8()) {
+                rc = register_cxl_calls(&cxl_calls);
+                if (rc)
+                        goto err;
+        }
 
         if (cpu_has_feature(CPU_FTR_HVMODE)) {
                 cxl_ops = &cxl_native_ops;
@@ -347,7 +354,8 @@ static int __init init_cxl(void)
 
         return 0;
 err1:
-        unregister_cxl_calls(&cxl_calls);
+        if (cxl_is_power8())
+                unregister_cxl_calls(&cxl_calls);
 err:
         cxl_debugfs_exit();
         cxl_file_exit();
@@ -366,7 +374,8 @@ static void exit_cxl(void)
 
         cxl_debugfs_exit();
         cxl_file_exit();
-        unregister_cxl_calls(&cxl_calls);
+        if (cxl_is_power8())
+                unregister_cxl_calls(&cxl_calls);
         idr_destroy(&cxl_adapter_idr);
 }
 
diff --git a/drivers/misc/cxl/native.c b/drivers/misc/cxl/native.c
index 871a2f09c718..2b2f8894149d 100644
--- a/drivers/misc/cxl/native.c
+++ b/drivers/misc/cxl/native.c
@@ -105,11 +105,16 @@ static int native_afu_reset(struct cxl_afu *afu)
                            CXL_AFU_Cntl_An_RS_MASK | CXL_AFU_Cntl_An_ES_MASK,
                            false);
 
-        /* Re-enable any masked interrupts */
-        serr = cxl_p1n_read(afu, CXL_PSL_SERR_An);
-        serr &= ~CXL_PSL_SERR_An_IRQ_MASKS;
-        cxl_p1n_write(afu, CXL_PSL_SERR_An, serr);
-
+        /*
+         * Re-enable any masked interrupts when the AFU is not
+         * activated to avoid side effects after attaching a process
+         * in dedicated mode.
+         */
+        if (afu->current_mode == 0) {
+                serr = cxl_p1n_read(afu, CXL_PSL_SERR_An);
+                serr &= ~CXL_PSL_SERR_An_IRQ_MASKS;
+                cxl_p1n_write(afu, CXL_PSL_SERR_An, serr);
+        }
 
         return rc;
 }
@@ -139,9 +144,9 @@ int cxl_psl_purge(struct cxl_afu *afu)
 
         pr_devel("PSL purge request\n");
 
-        if (cxl_is_psl8(afu))
+        if (cxl_is_power8())
                 trans_fault = CXL_PSL_DSISR_TRANS;
-        if (cxl_is_psl9(afu))
+        if (cxl_is_power9())
                 trans_fault = CXL_PSL9_DSISR_An_TF;
 
         if (!cxl_ops->link_ok(afu->adapter, afu)) {
@@ -603,7 +608,7 @@ static u64 calculate_sr(struct cxl_context *ctx)
                 if (!test_tsk_thread_flag(current, TIF_32BIT))
                         sr |= CXL_PSL_SR_An_SF;
         }
-        if (cxl_is_psl9(ctx->afu)) {
+        if (cxl_is_power9()) {
                 if (radix_enabled())
                         sr |= CXL_PSL_SR_An_XLAT_ror;
                 else
@@ -1117,10 +1122,10 @@ static irqreturn_t native_handle_psl_slice_error(struct cxl_context *ctx,
 
 static bool cxl_is_translation_fault(struct cxl_afu *afu, u64 dsisr)
 {
-        if ((cxl_is_psl8(afu)) && (dsisr & CXL_PSL_DSISR_TRANS))
+        if ((cxl_is_power8()) && (dsisr & CXL_PSL_DSISR_TRANS))
                 return true;
 
-        if ((cxl_is_psl9(afu)) && (dsisr & CXL_PSL9_DSISR_An_TF))
+        if ((cxl_is_power9()) && (dsisr & CXL_PSL9_DSISR_An_TF))
                 return true;
 
         return false;
@@ -1194,10 +1199,10 @@ static void native_irq_wait(struct cxl_context *ctx)
                 if (ph != ctx->pe)
                         return;
                 dsisr = cxl_p2n_read(ctx->afu, CXL_PSL_DSISR_An);
-                if (cxl_is_psl8(ctx->afu) &&
+                if (cxl_is_power8() &&
                    ((dsisr & CXL_PSL_DSISR_PENDING) == 0))
                         return;
-                if (cxl_is_psl9(ctx->afu) &&
+                if (cxl_is_power9() &&
                    ((dsisr & CXL_PSL9_DSISR_PENDING) == 0))
                         return;
                 /*
@@ -1302,13 +1307,16 @@ int cxl_native_register_psl_err_irq(struct cxl *adapter)
 
 void cxl_native_release_psl_err_irq(struct cxl *adapter)
 {
-        if (adapter->native->err_virq != irq_find_mapping(NULL, adapter->native->err_hwirq))
+        if (adapter->native->err_virq == 0 ||
+            adapter->native->err_virq !=
+            irq_find_mapping(NULL, adapter->native->err_hwirq))
                 return;
 
         cxl_p1_write(adapter, CXL_PSL_ErrIVTE, 0x0000000000000000);
         cxl_unmap_irq(adapter->native->err_virq, adapter);
         cxl_ops->release_one_irq(adapter, adapter->native->err_hwirq);
         kfree(adapter->irq_name);
+        adapter->native->err_virq = 0;
 }
 
 int cxl_native_register_serr_irq(struct cxl_afu *afu)
@@ -1346,13 +1354,15 @@ int cxl_native_register_serr_irq(struct cxl_afu *afu)
 
 void cxl_native_release_serr_irq(struct cxl_afu *afu)
 {
-        if (afu->serr_virq != irq_find_mapping(NULL, afu->serr_hwirq))
+        if (afu->serr_virq == 0 ||
+            afu->serr_virq != irq_find_mapping(NULL, afu->serr_hwirq))
                 return;
 
         cxl_p1n_write(afu, CXL_PSL_SERR_An, 0x0000000000000000);
         cxl_unmap_irq(afu->serr_virq, afu);
         cxl_ops->release_one_irq(afu->adapter, afu->serr_hwirq);
         kfree(afu->err_irq_name);
+        afu->serr_virq = 0;
 }
 
 int cxl_native_register_psl_irq(struct cxl_afu *afu)
@@ -1375,12 +1385,15 @@ int cxl_native_register_psl_irq(struct cxl_afu *afu)
 
 void cxl_native_release_psl_irq(struct cxl_afu *afu)
 {
-        if (afu->native->psl_virq != irq_find_mapping(NULL, afu->native->psl_hwirq))
+        if (afu->native->psl_virq == 0 ||
+            afu->native->psl_virq !=
+            irq_find_mapping(NULL, afu->native->psl_hwirq))
                 return;
 
         cxl_unmap_irq(afu->native->psl_virq, afu);
         cxl_ops->release_one_irq(afu->adapter, afu->native->psl_hwirq);
         kfree(afu->psl_irq_name);
+        afu->native->psl_virq = 0;
 }
 
 static void recover_psl_err(struct cxl_afu *afu, u64 errstat)
diff --git a/drivers/misc/cxl/pci.c b/drivers/misc/cxl/pci.c
index 6dc1ee5b92c9..1eb9859809bf 100644
--- a/drivers/misc/cxl/pci.c
+++ b/drivers/misc/cxl/pci.c
@@ -436,7 +436,7 @@ static int init_implementation_adapter_regs_psl9(struct cxl *adapter, struct pci
         /* nMMU_ID Defaults to: b’000001001’*/
         xsl_dsnctl |= ((u64)0x09 << (63-28));
 
-        if (cxl_is_power9() && !cpu_has_feature(CPU_FTR_POWER9_DD1)) {
+        if (!(cxl_is_power9_dd1())) {
                 /*
                  * Used to identify CAPI packets which should be sorted into
                  * the Non-Blocking queues by the PHB. This field should match
@@ -491,7 +491,7 @@ static int init_implementation_adapter_regs_psl9(struct cxl *adapter, struct pci
         cxl_p1_write(adapter, CXL_PSL9_APCDEDTYPE, 0x40000003FFFF0000ULL);
 
         /* Disable vc dd1 fix */
-        if ((cxl_is_power9() && cpu_has_feature(CPU_FTR_POWER9_DD1)))
+        if (cxl_is_power9_dd1())
                 cxl_p1_write(adapter, CXL_PSL9_GP_CT, 0x0400000000000001ULL);
 
         return 0;
@@ -1439,8 +1439,7 @@ int cxl_pci_reset(struct cxl *adapter)
          * The adapter is about to be reset, so ignore errors.
          * Not supported on P9 DD1
          */
-        if ((cxl_is_power8()) ||
-            ((cxl_is_power9() && !cpu_has_feature(CPU_FTR_POWER9_DD1))))
+        if ((cxl_is_power8()) || (!(cxl_is_power9_dd1())))
                 cxl_data_cache_flush(adapter);
 
         /* pcie_warm_reset requests a fundamental pci reset which includes a
@@ -1750,7 +1749,6 @@ static const struct cxl_service_layer_ops psl9_ops = {
         .debugfs_add_adapter_regs = cxl_debugfs_add_adapter_regs_psl9,
         .debugfs_add_afu_regs = cxl_debugfs_add_afu_regs_psl9,
         .psl_irq_dump_registers = cxl_native_irq_dump_regs_psl9,
-        .err_irq_dump_registers = cxl_native_err_irq_dump_regs,
         .debugfs_stop_trace = cxl_stop_trace_psl9,
         .write_timebase_ctrl = write_timebase_ctrl_psl9,
         .timebase_read = timebase_read_psl9,
@@ -1889,8 +1887,7 @@ static void cxl_pci_remove_adapter(struct cxl *adapter)
          * Flush adapter datacache as its about to be removed.
          * Not supported on P9 DD1.
          */
-        if ((cxl_is_power8()) ||
-            ((cxl_is_power9() && !cpu_has_feature(CPU_FTR_POWER9_DD1))))
+        if ((cxl_is_power8()) || (!(cxl_is_power9_dd1())))
                 cxl_data_cache_flush(adapter);
 
         cxl_deconfigure_adapter(adapter);
diff --git a/drivers/misc/mei/bus.c b/drivers/misc/mei/bus.c
index d1928fdd0f43..07aad8576334 100644
--- a/drivers/misc/mei/bus.c
+++ b/drivers/misc/mei/bus.c
@@ -763,8 +763,10 @@ static ssize_t modalias_show(struct device *dev, struct device_attribute *a,
 {
         struct mei_cl_device *cldev = to_mei_cl_device(dev);
         const uuid_le *uuid = mei_me_cl_uuid(cldev->me_cl);
+        u8 version = mei_me_cl_ver(cldev->me_cl);
 
-        return scnprintf(buf, PAGE_SIZE, "mei:%s:%pUl:", cldev->name, uuid);
+        return scnprintf(buf, PAGE_SIZE, "mei:%s:%pUl:%02X:",
+                         cldev->name, uuid, version);
 }
 static DEVICE_ATTR_RO(modalias);
 
diff --git a/drivers/misc/sgi-xp/xp.h b/drivers/misc/sgi-xp/xp.h
index c862cd4583cc..b8069eec18cb 100644
--- a/drivers/misc/sgi-xp/xp.h
+++ b/drivers/misc/sgi-xp/xp.h
@@ -309,6 +309,9 @@ static inline enum xp_retval
 xpc_send(short partid, int ch_number, u32 flags, void *payload,
          u16 payload_size)
 {
+        if (!xpc_interface.send)
+                return xpNotLoaded;
+
         return xpc_interface.send(partid, ch_number, flags, payload,
                                   payload_size);
 }
@@ -317,6 +320,9 @@ static inline enum xp_retval
 xpc_send_notify(short partid, int ch_number, u32 flags, void *payload,
                 u16 payload_size, xpc_notify_func func, void *key)
 {
+        if (!xpc_interface.send_notify)
+                return xpNotLoaded;
+
         return xpc_interface.send_notify(partid, ch_number, flags, payload,
                                          payload_size, func, key);
 }
@@ -324,12 +330,16 @@ xpc_send_notify(short partid, int ch_number, u32 flags, void *payload,
 static inline void
 xpc_received(short partid, int ch_number, void *payload)
 {
-        return xpc_interface.received(partid, ch_number, payload);
+        if (xpc_interface.received)
+                xpc_interface.received(partid, ch_number, payload);
 }
 
 static inline enum xp_retval
 xpc_partid_to_nasids(short partid, void *nasids)
 {
+        if (!xpc_interface.partid_to_nasids)
+                return xpNotLoaded;
+
         return xpc_interface.partid_to_nasids(partid, nasids);
 }
 
diff --git a/drivers/misc/sgi-xp/xp_main.c b/drivers/misc/sgi-xp/xp_main.c
index 01be66d02ca8..6d7f557fd1c1 100644
--- a/drivers/misc/sgi-xp/xp_main.c
+++ b/drivers/misc/sgi-xp/xp_main.c
@@ -69,23 +69,9 @@ struct xpc_registration xpc_registrations[XPC_MAX_NCHANNELS];
 EXPORT_SYMBOL_GPL(xpc_registrations);
 
 /*
- * Initialize the XPC interface to indicate that XPC isn't loaded.
+ * Initialize the XPC interface to NULL to indicate that XPC isn't loaded.
  */
-static enum xp_retval
-xpc_notloaded(void)
-{
-        return xpNotLoaded;
-}
-
-struct xpc_interface xpc_interface = {
-        (void (*)(int))xpc_notloaded,
-        (void (*)(int))xpc_notloaded,
-        (enum xp_retval(*)(short, int, u32, void *, u16))xpc_notloaded,
-        (enum xp_retval(*)(short, int, u32, void *, u16, xpc_notify_func,
-                           void *))xpc_notloaded,
-        (void (*)(short, int, void *))xpc_notloaded,
-        (enum xp_retval(*)(short, void *))xpc_notloaded
-};
+struct xpc_interface xpc_interface = { };
 EXPORT_SYMBOL_GPL(xpc_interface);
 
 /*
@@ -115,17 +101,7 @@ EXPORT_SYMBOL_GPL(xpc_set_interface);
 void
 xpc_clear_interface(void)
 {
-        xpc_interface.connect = (void (*)(int))xpc_notloaded;
-        xpc_interface.disconnect = (void (*)(int))xpc_notloaded;
-        xpc_interface.send = (enum xp_retval(*)(short, int, u32, void *, u16))
-            xpc_notloaded;
-        xpc_interface.send_notify = (enum xp_retval(*)(short, int, u32, void *,
-                                                       u16, xpc_notify_func,
-                                                       void *))xpc_notloaded;
-        xpc_interface.received = (void (*)(short, int, void *))
-            xpc_notloaded;
-        xpc_interface.partid_to_nasids = (enum xp_retval(*)(short, void *))
-            xpc_notloaded;
+        memset(&xpc_interface, 0, sizeof(xpc_interface));
 }
 EXPORT_SYMBOL_GPL(xpc_clear_interface);
 
@@ -188,7 +164,8 @@ xpc_connect(int ch_number, xpc_channel_func func, void *key, u16 payload_size,
 
         mutex_unlock(&registration->mutex);
 
-        xpc_interface.connect(ch_number);
+        if (xpc_interface.connect)
+                xpc_interface.connect(ch_number);
 
         return xpSuccess;
 }
@@ -237,7 +214,8 @@ xpc_disconnect(int ch_number)
         registration->assigned_limit = 0;
         registration->idle_limit = 0;
 
-        xpc_interface.disconnect(ch_number);
+        if (xpc_interface.disconnect)
+                xpc_interface.disconnect(ch_number);
 
         mutex_unlock(&registration->mutex);
 
diff --git a/drivers/mmc/host/meson-gx-mmc.c b/drivers/mmc/host/meson-gx-mmc.c
index 1842ed341af1..de962c2d5e00 100644
--- a/drivers/mmc/host/meson-gx-mmc.c
+++ b/drivers/mmc/host/meson-gx-mmc.c
@@ -210,6 +210,15 @@ static void meson_mmc_get_transfer_mode(struct mmc_host *mmc,
         int i;
         bool use_desc_chain_mode = true;
 
+        /*
+         * Broken SDIO with AP6255-based WiFi on Khadas VIM Pro has been
+         * reported. For some strange reason this occurs in descriptor
+         * chain mode only. So let's fall back to bounce buffer mode
+         * for command SD_IO_RW_EXTENDED.
+         */
+        if (mrq->cmd->opcode == SD_IO_RW_EXTENDED)
+                return;
+
         for_each_sg(data->sg, sg, data->sg_len, i)
                 /* check for 8 byte alignment */
                 if (sg->offset & 7) {
diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c
index d474378ed810..b1dd12729f19 100644
--- a/drivers/mtd/nand/nand_base.c
+++ b/drivers/mtd/nand/nand_base.c
@@ -202,7 +202,7 @@ static int nand_ooblayout_free_lp_hamming(struct mtd_info *mtd, int section,
         return 0;
 }
 
-const struct mtd_ooblayout_ops nand_ooblayout_lp_hamming_ops = {
+static const struct mtd_ooblayout_ops nand_ooblayout_lp_hamming_ops = {
         .ecc = nand_ooblayout_ecc_lp_hamming,
         .free = nand_ooblayout_free_lp_hamming,
 };
@@ -4361,7 +4361,7 @@ int nand_scan_ident(struct mtd_info *mtd, int maxchips,
         /* Initialize the ->data_interface field. */
         ret = nand_init_data_interface(chip);
         if (ret)
-                return ret;
+                goto err_nand_init;
 
         /*
          * Setup the data interface correctly on the chip and controller side.
@@ -4373,7 +4373,7 @@ int nand_scan_ident(struct mtd_info *mtd, int maxchips,
          */
         ret = nand_setup_data_interface(chip);
         if (ret)
-                return ret;
+                goto err_nand_init;
 
         nand_maf_id = chip->id.data[0];
         nand_dev_id = chip->id.data[1];
@@ -4404,6 +4404,12 @@ int nand_scan_ident(struct mtd_info *mtd, int maxchips,
         mtd->size = i * chip->chipsize;
 
         return 0;
+
+err_nand_init:
+        /* Free manufacturer priv data. */
+        nand_manufacturer_cleanup(chip);
+
+        return ret;
 }
 EXPORT_SYMBOL(nand_scan_ident);
 
@@ -4574,18 +4580,23 @@ int nand_scan_tail(struct mtd_info *mtd)
 
         /* New bad blocks should be marked in OOB, flash-based BBT, or both */
         if (WARN_ON((chip->bbt_options & NAND_BBT_NO_OOB_BBM) &&
-                   !(chip->bbt_options & NAND_BBT_USE_FLASH)))
-                return -EINVAL;
+                   !(chip->bbt_options & NAND_BBT_USE_FLASH))) {
+                ret = -EINVAL;
+                goto err_ident;
+        }
 
         if (invalid_ecc_page_accessors(chip)) {
                 pr_err("Invalid ECC page accessors setup\n");
-                return -EINVAL;
+                ret = -EINVAL;
+                goto err_ident;
         }
 
         if (!(chip->options & NAND_OWN_BUFFERS)) {
                 nbuf = kzalloc(sizeof(*nbuf), GFP_KERNEL);
-                if (!nbuf)
-                        return -ENOMEM;
+                if (!nbuf) {
+                        ret = -ENOMEM;
+                        goto err_ident;
+                }
 
                 nbuf->ecccalc = kmalloc(mtd->oobsize, GFP_KERNEL);
                 if (!nbuf->ecccalc) {
@@ -4608,8 +4619,10 @@ int nand_scan_tail(struct mtd_info *mtd)
 
                 chip->buffers = nbuf;
         } else {
-                if (!chip->buffers)
-                        return -ENOMEM;
+                if (!chip->buffers) {
+                        ret = -ENOMEM;
+                        goto err_ident;
+                }
         }
 
         /* Set the internal oob buffer location, just after the page data */
@@ -4842,7 +4855,11 @@ int nand_scan_tail(struct mtd_info *mtd)
                 return 0;
 
         /* Build bad block table */
-        return chip->scan_bbt(mtd);
+        ret = chip->scan_bbt(mtd);
+        if (ret)
+                goto err_free;
+        return 0;
+
 err_free:
         if (nbuf) {
                 kfree(nbuf->databuf);
@@ -4850,6 +4867,13 @@ err_free:
                 kfree(nbuf->ecccalc);
                 kfree(nbuf);
         }
+
+err_ident:
+        /* Clean up nand_scan_ident(). */
+
+        /* Free manufacturer priv data. */
+        nand_manufacturer_cleanup(chip);
+
         return ret;
 }
 EXPORT_SYMBOL(nand_scan_tail);
diff --git a/drivers/mtd/nand/nand_ids.c b/drivers/mtd/nand/nand_ids.c
index 9d5ca0e540b5..92e2cf8e9ff9 100644
--- a/drivers/mtd/nand/nand_ids.c
+++ b/drivers/mtd/nand/nand_ids.c
@@ -6,7 +6,6 @@
  * published by the Free Software Foundation.
  *
  */
-#include <linux/module.h>
 #include <linux/mtd/nand.h>
 #include <linux/sizes.h>
 
diff --git a/drivers/mtd/nand/nand_samsung.c b/drivers/mtd/nand/nand_samsung.c
index 9cfc4035a420..1e0755997762 100644
--- a/drivers/mtd/nand/nand_samsung.c
+++ b/drivers/mtd/nand/nand_samsung.c
@@ -84,6 +84,9 @@ static void samsung_nand_decode_id(struct nand_chip *chip)
                         case 7:
                                 chip->ecc_strength_ds = 60;
                                 break;
+                        default:
+                                WARN(1, "Could not decode ECC info");
+                                chip->ecc_step_ds = 0;
                         }
                 }
         } else {
diff --git a/drivers/mtd/nand/tango_nand.c b/drivers/mtd/nand/tango_nand.c
index 05b6e1065203..49b286c6c10f 100644
--- a/drivers/mtd/nand/tango_nand.c
+++ b/drivers/mtd/nand/tango_nand.c
@@ -55,10 +55,10 @@
  * byte 1 for other packets in the page (PKT_N, for N > 0)
  * ERR_COUNT_PKT_N is the max error count over all but the first packet.
  */
-#define DECODE_OK_PKT_0(v)      ((v) & BIT(7))
-#define DECODE_OK_PKT_N(v)      ((v) & BIT(15))
 #define ERR_COUNT_PKT_0(v)      (((v) >> 0) & 0x3f)
 #define ERR_COUNT_PKT_N(v)      (((v) >> 8) & 0x3f)
+#define DECODE_FAIL_PKT_0(v)    (((v) & BIT(7)) == 0)
+#define DECODE_FAIL_PKT_N(v)    (((v) & BIT(15)) == 0)
 
 /* Offsets relative to pbus_base */
 #define PBUS_CS_CTRL    0x83c
@@ -193,6 +193,8 @@ static int check_erased_page(struct nand_chip *chip, u8 *buf)
                                                   chip->ecc.strength);
                 if (res < 0)
                         mtd->ecc_stats.failed++;
+                else
+                        mtd->ecc_stats.corrected += res;
 
                 bitflips = max(res, bitflips);
                 buf += pkt_size;
@@ -202,9 +204,11 @@ static int check_erased_page(struct nand_chip *chip, u8 *buf)
         return bitflips;
 }
 
-static int decode_error_report(struct tango_nfc *nfc)
+static int decode_error_report(struct nand_chip *chip)
 {
         u32 status, res;
+        struct mtd_info *mtd = nand_to_mtd(chip);
+        struct tango_nfc *nfc = to_tango_nfc(chip->controller);
 
         status = readl_relaxed(nfc->reg_base + NFC_XFER_STATUS);
         if (status & PAGE_IS_EMPTY)
@@ -212,10 +216,14 @@ static int decode_error_report(struct tango_nfc *nfc)
 
         res = readl_relaxed(nfc->mem_base + ERROR_REPORT);
 
-        if (DECODE_OK_PKT_0(res) && DECODE_OK_PKT_N(res))
-                return max(ERR_COUNT_PKT_0(res), ERR_COUNT_PKT_N(res));
+        if (DECODE_FAIL_PKT_0(res) || DECODE_FAIL_PKT_N(res))
+                return -EBADMSG;
+
+        /* ERR_COUNT_PKT_N is max, not sum, but that's all we have */
+        mtd->ecc_stats.corrected +=
+                ERR_COUNT_PKT_0(res) + ERR_COUNT_PKT_N(res);
 
-        return -EBADMSG;
+        return max(ERR_COUNT_PKT_0(res), ERR_COUNT_PKT_N(res));
 }
 
 static void tango_dma_callback(void *arg)
@@ -282,7 +290,7 @@ static int tango_read_page(struct mtd_info *mtd, struct nand_chip *chip,
         if (err)
                 return err;
 
-        res = decode_error_report(nfc);
+        res = decode_error_report(chip);
         if (res < 0) {
                 chip->ecc.read_oob_raw(mtd, chip, page);
                 res = check_erased_page(chip, buf);
@@ -663,6 +671,7 @@ static const struct of_device_id tango_nand_ids[] = {
         { .compatible = "sigma,smp8758-nand" },
         { /* sentinel */ }
 };
+MODULE_DEVICE_TABLE(of, tango_nand_ids);
 
 static struct platform_driver tango_nand_driver = {
         .probe  = tango_nand_probe,
diff --git a/drivers/net/arcnet/arcnet.c b/drivers/net/arcnet/arcnet.c
index 62ee439d5882..53a1cb551def 100644
--- a/drivers/net/arcnet/arcnet.c
+++ b/drivers/net/arcnet/arcnet.c
@@ -756,6 +756,7 @@ irqreturn_t arcnet_interrupt(int irq, void *dev_id)
         struct net_device *dev = dev_id;
         struct arcnet_local *lp;
         int recbuf, status, diagstatus, didsomething, boguscount;
+        unsigned long flags;
         int retval = IRQ_NONE;
 
         arc_printk(D_DURING, dev, "\n");
@@ -765,7 +766,7 @@ irqreturn_t arcnet_interrupt(int irq, void *dev_id)
         lp = netdev_priv(dev);
         BUG_ON(!lp);
 
-        spin_lock(&lp->lock);
+        spin_lock_irqsave(&lp->lock, flags);
 
         /* RESET flag was enabled - if device is not running, we must
          * clear it right away (but nothing else).
@@ -774,7 +775,7 @@ irqreturn_t arcnet_interrupt(int irq, void *dev_id)
                 if (lp->hw.status(dev) & RESETflag)
                         lp->hw.command(dev, CFLAGScmd | RESETclear);
                 lp->hw.intmask(dev, 0);
-                spin_unlock(&lp->lock);
+                spin_unlock_irqrestore(&lp->lock, flags);
                 return retval;
         }
 
@@ -998,7 +999,7 @@ irqreturn_t arcnet_interrupt(int irq, void *dev_id)
         udelay(1);
         lp->hw.intmask(dev, lp->intmask);
 
-        spin_unlock(&lp->lock);
+        spin_unlock_irqrestore(&lp->lock, flags);
         return retval;
 }
 EXPORT_SYMBOL(arcnet_interrupt);
diff --git a/drivers/net/arcnet/capmode.c b/drivers/net/arcnet/capmode.c
index 2056878fb087..4fa2e46b48d3 100644
--- a/drivers/net/arcnet/capmode.c
+++ b/drivers/net/arcnet/capmode.c
@@ -212,7 +212,7 @@ static int ack_tx(struct net_device *dev, int acked)
         ackpkt->soft.cap.proto = 0; /* using protocol 0 for acknowledge */
         ackpkt->soft.cap.mes.ack = acked;
 
-        arc_printk(D_PROTO, dev, "Ackknowledge for cap packet %x.\n",
+        arc_printk(D_PROTO, dev, "Acknowledge for cap packet %x.\n",
                    *((int *)&ackpkt->soft.cap.cookie[0]));
 
         ackskb->protocol = cpu_to_be16(ETH_P_ARCNET);
diff --git a/drivers/net/arcnet/com20020-pci.c b/drivers/net/arcnet/com20020-pci.c
index 239de38fbd6a..47f80b83dcf4 100644
--- a/drivers/net/arcnet/com20020-pci.c
+++ b/drivers/net/arcnet/com20020-pci.c
@@ -135,6 +135,7 @@ static int com20020pci_probe(struct pci_dev *pdev,
         for (i = 0; i < ci->devcount; i++) {
                 struct com20020_pci_channel_map *cm = &ci->chan_map_tbl[i];
                 struct com20020_dev *card;
+                int dev_id_mask = 0xf;
 
                 dev = alloc_arcdev(device);
                 if (!dev) {
@@ -166,6 +167,7 @@ static int com20020pci_probe(struct pci_dev *pdev,
                 arcnet_outb(0x00, ioaddr, COM20020_REG_W_COMMAND);
                 arcnet_inb(ioaddr, COM20020_REG_R_DIAGSTAT);
 
+                SET_NETDEV_DEV(dev, &pdev->dev);
                 dev->base_addr = ioaddr;
                 dev->dev_addr[0] = node;
                 dev->irq = pdev->irq;
@@ -179,8 +181,8 @@ static int com20020pci_probe(struct pci_dev *pdev,
 
                 /* Get the dev_id from the PLX rotary coder */
                 if (!strncmp(ci->name, "EAE PLX-PCI MA1", 15))
-                        dev->dev_id = 0xc;
-                dev->dev_id ^= inb(priv->misc + ci->rotary) >> 4;
+                        dev_id_mask = 0x3;
+                dev->dev_id = (inb(priv->misc + ci->rotary) >> 4) & dev_id_mask;
 
                 snprintf(dev->name, sizeof(dev->name), "arc%d-%d", dev->dev_id, i);
 
diff --git a/drivers/net/arcnet/com20020.c b/drivers/net/arcnet/com20020.c
index 13d9ad4b3f5c..78043a9c5981 100644
--- a/drivers/net/arcnet/com20020.c
+++ b/drivers/net/arcnet/com20020.c
@@ -246,8 +246,6 @@ int com20020_found(struct net_device *dev, int shared)
                 return -ENODEV;
         }
 
-        dev->base_addr = ioaddr;
-
         arc_printk(D_NORMAL, dev, "%s: station %02Xh found at %03lXh, IRQ %d.\n",
                    lp->card_name, dev->dev_addr[0], dev->base_addr, dev->irq);
 
diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
index b44a6aeb346d..e5386ab706ec 100644
--- a/drivers/net/bonding/bond_3ad.c
+++ b/drivers/net/bonding/bond_3ad.c
@@ -90,10 +90,13 @@ enum ad_link_speed_type {
         AD_LINK_SPEED_100MBPS,
         AD_LINK_SPEED_1000MBPS,
         AD_LINK_SPEED_2500MBPS,
+        AD_LINK_SPEED_5000MBPS,
         AD_LINK_SPEED_10000MBPS,
+        AD_LINK_SPEED_14000MBPS,
         AD_LINK_SPEED_20000MBPS,
         AD_LINK_SPEED_25000MBPS,
         AD_LINK_SPEED_40000MBPS,
+        AD_LINK_SPEED_50000MBPS,
         AD_LINK_SPEED_56000MBPS,
         AD_LINK_SPEED_100000MBPS,
 };
@@ -259,10 +262,13 @@ static inline int __check_agg_selection_timer(struct port *port)
  *     %AD_LINK_SPEED_100MBPS,
  *     %AD_LINK_SPEED_1000MBPS,
  *     %AD_LINK_SPEED_2500MBPS,
+ *     %AD_LINK_SPEED_5000MBPS,
  *     %AD_LINK_SPEED_10000MBPS
+ *     %AD_LINK_SPEED_14000MBPS,
  *     %AD_LINK_SPEED_20000MBPS
  *     %AD_LINK_SPEED_25000MBPS
  *     %AD_LINK_SPEED_40000MBPS
+ *     %AD_LINK_SPEED_50000MBPS
  *     %AD_LINK_SPEED_56000MBPS
  *     %AD_LINK_SPEED_100000MBPS
  */
@@ -296,10 +302,18 @@ static u16 __get_link_speed(struct port *port)
                         speed = AD_LINK_SPEED_2500MBPS;
                         break;
 
+                case SPEED_5000:
+                        speed = AD_LINK_SPEED_5000MBPS;
+                        break;
+
                 case SPEED_10000:
                         speed = AD_LINK_SPEED_10000MBPS;
                         break;
 
+                case SPEED_14000:
+                        speed = AD_LINK_SPEED_14000MBPS;
+                        break;
+
                 case SPEED_20000:
                         speed = AD_LINK_SPEED_20000MBPS;
                         break;
@@ -312,6 +326,10 @@ static u16 __get_link_speed(struct port *port)
                         speed = AD_LINK_SPEED_40000MBPS;
                         break;
 
+                case SPEED_50000:
+                        speed = AD_LINK_SPEED_50000MBPS;
+                        break;
+
                 case SPEED_56000:
                         speed = AD_LINK_SPEED_56000MBPS;
                         break;
@@ -707,9 +725,15 @@ static u32 __get_agg_bandwidth(struct aggregator *aggregator)
                 case AD_LINK_SPEED_2500MBPS:
                         bandwidth = nports * 2500;
                         break;
+                case AD_LINK_SPEED_5000MBPS:
+                        bandwidth = nports * 5000;
+                        break;
                 case AD_LINK_SPEED_10000MBPS:
                         bandwidth = nports * 10000;
                         break;
+                case AD_LINK_SPEED_14000MBPS:
+                        bandwidth = nports * 14000;
+                        break;
                 case AD_LINK_SPEED_20000MBPS:
                         bandwidth = nports * 20000;
                         break;
@@ -719,6 +743,9 @@ static u32 __get_agg_bandwidth(struct aggregator *aggregator)
                 case AD_LINK_SPEED_40000MBPS:
                         bandwidth = nports * 40000;
                         break;
+                case AD_LINK_SPEED_50000MBPS:
+                        bandwidth = nports * 50000;
+                        break;
                 case AD_LINK_SPEED_56000MBPS:
                         bandwidth = nports * 56000;
                         break;
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 2359478b977f..8ab6bdbe1682 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -4192,7 +4192,6 @@ static void bond_destructor(struct net_device *bond_dev)
         struct bonding *bond = netdev_priv(bond_dev);
         if (bond->wq)
                 destroy_workqueue(bond->wq);
-        free_netdev(bond_dev);
 }
 
 void bond_setup(struct net_device *bond_dev)
@@ -4212,7 +4211,8 @@ void bond_setup(struct net_device *bond_dev)
         bond_dev->netdev_ops = &bond_netdev_ops;
         bond_dev->ethtool_ops = &bond_ethtool_ops;
 
-        bond_dev->destructor = bond_destructor;
+        bond_dev->needs_free_netdev = true;
+        bond_dev->priv_destructor = bond_destructor;
 
         SET_NETDEV_DEVTYPE(bond_dev, &bond_type);
 
@@ -4736,7 +4736,7 @@ int bond_create(struct net *net, const char *name)
 
         rtnl_unlock();
         if (res < 0)
-                bond_destructor(bond_dev);
+                free_netdev(bond_dev);
         return res;
 }
 
diff --git a/drivers/net/caif/caif_hsi.c b/drivers/net/caif/caif_hsi.c
index ddabce759456..71a7c3b44fdd 100644
--- a/drivers/net/caif/caif_hsi.c
+++ b/drivers/net/caif/caif_hsi.c
@@ -1121,7 +1121,7 @@ static void cfhsi_setup(struct net_device *dev)
         dev->flags = IFF_POINTOPOINT | IFF_NOARP;
         dev->mtu = CFHSI_MAX_CAIF_FRAME_SZ;
         dev->priv_flags |= IFF_NO_QUEUE;
-        dev->destructor = free_netdev;
+        dev->needs_free_netdev = true;
         dev->netdev_ops = &cfhsi_netdevops;
         for (i = 0; i < CFHSI_PRIO_LAST; ++i)
                 skb_queue_head_init(&cfhsi->qhead[i]);
diff --git a/drivers/net/caif/caif_serial.c b/drivers/net/caif/caif_serial.c
index c2dea4916e5d..76e1d3545105 100644
--- a/drivers/net/caif/caif_serial.c
+++ b/drivers/net/caif/caif_serial.c
@@ -428,7 +428,7 @@ static void caifdev_setup(struct net_device *dev)
         dev->flags = IFF_POINTOPOINT | IFF_NOARP;
         dev->mtu = CAIF_MAX_MTU;
         dev->priv_flags |= IFF_NO_QUEUE;
-        dev->destructor = free_netdev;
+        dev->needs_free_netdev = true;
         skb_queue_head_init(&serdev->head);
         serdev->common.link_select = CAIF_LINK_LOW_LATENCY;
         serdev->common.use_frag = true;
diff --git a/drivers/net/caif/caif_spi.c b/drivers/net/caif/caif_spi.c
index 3a529fbe539f..fc21afe852b9 100644
--- a/drivers/net/caif/caif_spi.c
+++ b/drivers/net/caif/caif_spi.c
@@ -712,7 +712,7 @@ static void cfspi_setup(struct net_device *dev)
         dev->flags = IFF_NOARP | IFF_POINTOPOINT;
         dev->priv_flags |= IFF_NO_QUEUE;
         dev->mtu = SPI_MAX_PAYLOAD_SIZE;
-        dev->destructor = free_netdev;
+        dev->needs_free_netdev = true;
         skb_queue_head_init(&cfspi->qhead);
         skb_queue_head_init(&cfspi->chead);
         cfspi->cfdev.link_select = CAIF_LINK_HIGH_BANDW;
diff --git a/drivers/net/caif/caif_virtio.c b/drivers/net/caif/caif_virtio.c
index 6122768c8644..1794ea0420b7 100644
--- a/drivers/net/caif/caif_virtio.c
+++ b/drivers/net/caif/caif_virtio.c
@@ -617,7 +617,7 @@ static void cfv_netdev_setup(struct net_device *netdev)
         netdev->tx_queue_len = 100;
         netdev->flags = IFF_POINTOPOINT | IFF_NOARP;
         netdev->mtu = CFV_DEF_MTU_SIZE;
-        netdev->destructor = free_netdev;
+        netdev->needs_free_netdev = true;
 }
 
 /* Create debugfs counters for the device */
diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
index 611d16a7061d..ae4ed03dc642 100644
--- a/drivers/net/can/dev.c
+++ b/drivers/net/can/dev.c
@@ -391,6 +391,9 @@ void can_change_state(struct net_device *dev, struct can_frame *cf,
         can_update_state_error_stats(dev, new_state);
         priv->state = new_state;
 
+        if (!cf)
+                return;
+
         if (unlikely(new_state == CAN_STATE_BUS_OFF)) {
                 cf->can_id |= CAN_ERR_BUSOFF;
                 return;
diff --git a/drivers/net/can/peak_canfd/peak_canfd.c b/drivers/net/can/peak_canfd/peak_canfd.c
index 0d57be5ea97b..85268be0c913 100644
--- a/drivers/net/can/peak_canfd/peak_canfd.c
+++ b/drivers/net/can/peak_canfd/peak_canfd.c
@@ -489,7 +489,7 @@ int peak_canfd_handle_msgs_list(struct peak_canfd_priv *priv,
                                 struct pucan_rx_msg *msg_list, int msg_count)
 {
         void *msg_ptr = msg_list;
-        int i, msg_size;
+        int i, msg_size = 0;
 
         for (i = 0; i < msg_count; i++) {
                 msg_size = peak_canfd_handle_msg(priv, msg_ptr);
diff --git a/drivers/net/can/slcan.c b/drivers/net/can/slcan.c
index eb7173713bbc..6a6e896e52fa 100644
--- a/drivers/net/can/slcan.c
+++ b/drivers/net/can/slcan.c
@@ -417,7 +417,7 @@ static int slc_open(struct net_device *dev)
 static void slc_free_netdev(struct net_device *dev)
 {
         int i = dev->base_addr;
-        free_netdev(dev);
+
         slcan_devs[i] = NULL;
 }
 
@@ -436,7 +436,8 @@ static const struct net_device_ops slc_netdev_ops = {
 static void slc_setup(struct net_device *dev)
 {
         dev->netdev_ops         = &slc_netdev_ops;
-        dev->destructor         = slc_free_netdev;
+        dev->needs_free_netdev  = true;
+        dev->priv_destructor    = slc_free_netdev;
 
         dev->hard_header_len    = 0;
         dev->addr_len           = 0;
@@ -761,8 +762,6 @@ static void __exit slcan_exit(void)
                 if (sl->tty) {
                         printk(KERN_ERR "%s: tty discipline still running\n",
                                dev->name);
-                        /* Intentionally leak the control block. */
-                        dev->destructor = NULL;
                 }
 
                 unregister_netdev(dev);
diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c
index eecee7f8dfb7..afcc1312dbaf 100644
--- a/drivers/net/can/usb/gs_usb.c
+++ b/drivers/net/can/usb/gs_usb.c
@@ -265,6 +265,8 @@ static int gs_cmd_reset(struct gs_usb *gsusb, struct gs_can *gsdev)
                              sizeof(*dm),
                              1000);
 
+        kfree(dm);
+
         return rc;
 }
 
diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_core.c b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
index 57913dbbae0a..1ca76e03e965 100644
--- a/drivers/net/can/usb/peak_usb/pcan_usb_core.c
+++ b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
@@ -908,8 +908,6 @@ static int peak_usb_probe(struct usb_interface *intf,
         const struct peak_usb_adapter *peak_usb_adapter = NULL;
         int i, err = -ENOMEM;
 
-        usb_dev = interface_to_usbdev(intf);
-
         /* get corresponding PCAN-USB adapter */
         for (i = 0; i < ARRAY_SIZE(peak_usb_adapters_list); i++)
                 if (peak_usb_adapters_list[i]->device_id == usb_id_product) {
@@ -920,7 +918,7 @@ static int peak_usb_probe(struct usb_interface *intf,
         if (!peak_usb_adapter) {
                 /* should never come except device_id bad usage in this file */
                 pr_err("%s: didn't find device id. 0x%x in devices list\n",
-                        PCAN_USB_DRIVER_NAME, usb_dev->descriptor.idProduct);
+                        PCAN_USB_DRIVER_NAME, usb_id_product);
                 return -ENODEV;
         }
 
diff --git a/drivers/net/can/vcan.c b/drivers/net/can/vcan.c
index facca33d53e9..a8cb33264ff1 100644
--- a/drivers/net/can/vcan.c
+++ b/drivers/net/can/vcan.c
@@ -152,7 +152,7 @@ static const struct net_device_ops vcan_netdev_ops = {
 static void vcan_setup(struct net_device *dev)
 {
         dev->type               = ARPHRD_CAN;
-        dev->mtu                = CAN_MTU;
+        dev->mtu                = CANFD_MTU;
         dev->hard_header_len    = 0;
         dev->addr_len           = 0;
         dev->tx_queue_len       = 0;
@@ -163,7 +163,7 @@ static void vcan_setup(struct net_device *dev)
                 dev->flags |= IFF_ECHO;
 
         dev->netdev_ops         = &vcan_netdev_ops;
-        dev->destructor         = free_netdev;
+        dev->needs_free_netdev  = true;
 }
 
 static struct rtnl_link_ops vcan_link_ops __read_mostly = {
diff --git a/drivers/net/can/vxcan.c b/drivers/net/can/vxcan.c
index 7fbb24795681..cfe889e8f172 100644
--- a/drivers/net/can/vxcan.c
+++ b/drivers/net/can/vxcan.c
@@ -150,13 +150,13 @@ static const struct net_device_ops vxcan_netdev_ops = {
 static void vxcan_setup(struct net_device *dev)
 {
         dev->type               = ARPHRD_CAN;
-        dev->mtu                = CAN_MTU;
+        dev->mtu                = CANFD_MTU;
         dev->hard_header_len    = 0;
         dev->addr_len           = 0;
         dev->tx_queue_len       = 0;
         dev->flags              = (IFF_NOARP|IFF_ECHO);
         dev->netdev_ops         = &vxcan_netdev_ops;
-        dev->destructor         = free_netdev;
+        dev->needs_free_netdev  = true;
 }
 
 /* forward declaration for rtnl_create_link() */
diff --git a/drivers/net/dsa/mv88e6xxx/global2.h b/drivers/net/dsa/mv88e6xxx/global2.h
index 96046bb12ca1..14c0be98e0a4 100644
--- a/drivers/net/dsa/mv88e6xxx/global2.h
+++ b/drivers/net/dsa/mv88e6xxx/global2.h
@@ -114,13 +114,13 @@ static inline int mv88e6xxx_g2_set_eeprom16(struct mv88e6xxx_chip *chip,
         return -EOPNOTSUPP;
 }
 
-int mv88e6xxx_g2_pvt_write(struct mv88e6xxx_chip *chip, int src_dev,
-                           int src_port, u16 data)
+static inline int mv88e6xxx_g2_pvt_write(struct mv88e6xxx_chip *chip,
+                                         int src_dev, int src_port, u16 data)
 {
         return -EOPNOTSUPP;
 }
 
-int mv88e6xxx_g2_misc_4_bit_port(struct mv88e6xxx_chip *chip)
+static inline int mv88e6xxx_g2_misc_4_bit_port(struct mv88e6xxx_chip *chip)
 {
         return -EOPNOTSUPP;
 }
diff --git a/drivers/net/dummy.c b/drivers/net/dummy.c
index 149244aac20a..9905b52fe293 100644
--- a/drivers/net/dummy.c
+++ b/drivers/net/dummy.c
@@ -328,7 +328,6 @@ static void dummy_free_netdev(struct net_device *dev)
         struct dummy_priv *priv = netdev_priv(dev);
 
         kfree(priv->vfinfo);
-        free_netdev(dev);
 }
 
 static void dummy_setup(struct net_device *dev)
@@ -338,7 +337,8 @@ static void dummy_setup(struct net_device *dev)
         /* Initialize the device structure. */
         dev->netdev_ops = &dummy_netdev_ops;
         dev->ethtool_ops = &dummy_ethtool_ops;
-        dev->destructor = dummy_free_netdev;
+        dev->needs_free_netdev = true;
+        dev->priv_destructor = dummy_free_netdev;
 
         /* Fill in device structure with ethernet-generic values. */
         dev->flags |= IFF_NOARP;
diff --git a/drivers/net/ethernet/amazon/ena/ena_com.c b/drivers/net/ethernet/amazon/ena/ena_com.c
index 08d11cede9c9..f5b237e0bd60 100644
--- a/drivers/net/ethernet/amazon/ena/ena_com.c
+++ b/drivers/net/ethernet/amazon/ena/ena_com.c
@@ -61,6 +61,8 @@
 
 #define ENA_MMIO_READ_TIMEOUT 0xFFFFFFFF
 
+#define ENA_REGS_ADMIN_INTR_MASK 1
+
 /*****************************************************************************/
 /*****************************************************************************/
 /*****************************************************************************/
@@ -232,11 +234,9 @@ static struct ena_comp_ctx *__ena_com_submit_admin_cmd(struct ena_com_admin_queu
         tail_masked = admin_queue->sq.tail & queue_size_mask;
 
         /* In case of queue FULL */
-        cnt = admin_queue->sq.tail - admin_queue->sq.head;
+        cnt = atomic_read(&admin_queue->outstanding_cmds);
         if (cnt >= admin_queue->q_depth) {
-                pr_debug("admin queue is FULL (tail %d head %d depth: %d)\n",
-                         admin_queue->sq.tail, admin_queue->sq.head,
-                         admin_queue->q_depth);
+                pr_debug("admin queue is full.\n");
                 admin_queue->stats.out_of_space++;
                 return ERR_PTR(-ENOSPC);
         }
@@ -508,15 +508,20 @@ static int ena_com_comp_status_to_errno(u8 comp_status)
 static int ena_com_wait_and_process_admin_cq_polling(struct ena_comp_ctx *comp_ctx,
                                                      struct ena_com_admin_queue *admin_queue)
 {
-        unsigned long flags;
-        u32 start_time;
+        unsigned long flags, timeout;
         int ret;
 
-        start_time = ((u32)jiffies_to_usecs(jiffies));
+        timeout = jiffies + ADMIN_CMD_TIMEOUT_US;
+
+        while (1) {
+                spin_lock_irqsave(&admin_queue->q_lock, flags);
+                ena_com_handle_admin_completion(admin_queue);
+                spin_unlock_irqrestore(&admin_queue->q_lock, flags);
+
+                if (comp_ctx->status != ENA_CMD_SUBMITTED)
+                        break;
 
-        while (comp_ctx->status == ENA_CMD_SUBMITTED) {
-                if ((((u32)jiffies_to_usecs(jiffies)) - start_time) >
-                    ADMIN_CMD_TIMEOUT_US) {
+                if (time_is_before_jiffies(timeout)) {
                         pr_err("Wait for completion (polling) timeout\n");
                         /* ENA didn't have any completion */
                         spin_lock_irqsave(&admin_queue->q_lock, flags);
@@ -528,10 +533,6 @@ static int ena_com_wait_and_process_admin_cq_polling(struct ena_comp_ctx *comp_c
                         goto err;
                 }
 
-                spin_lock_irqsave(&admin_queue->q_lock, flags);
-                ena_com_handle_admin_completion(admin_queue);
-                spin_unlock_irqrestore(&admin_queue->q_lock, flags);
-
                 msleep(100);
         }
 
@@ -1455,6 +1456,12 @@ void ena_com_admin_destroy(struct ena_com_dev *ena_dev)
 
 void ena_com_set_admin_polling_mode(struct ena_com_dev *ena_dev, bool polling)
 {
+        u32 mask_value = 0;
+
+        if (polling)
+                mask_value = ENA_REGS_ADMIN_INTR_MASK;
+
+        writel(mask_value, ena_dev->reg_bar + ENA_REGS_INTR_MASK_OFF);
         ena_dev->admin_queue.polling = polling;
 }
 
diff --git a/drivers/net/ethernet/amazon/ena/ena_ethtool.c b/drivers/net/ethernet/amazon/ena/ena_ethtool.c
index 67b2338f8fb3..3ee55e2fd694 100644
--- a/drivers/net/ethernet/amazon/ena/ena_ethtool.c
+++ b/drivers/net/ethernet/amazon/ena/ena_ethtool.c
@@ -80,7 +80,6 @@ static const struct ena_stats ena_stats_tx_strings[] = {
         ENA_STAT_TX_ENTRY(tx_poll),
         ENA_STAT_TX_ENTRY(doorbells),
         ENA_STAT_TX_ENTRY(prepare_ctx_err),
-        ENA_STAT_TX_ENTRY(missing_tx_comp),
         ENA_STAT_TX_ENTRY(bad_req_id),
 };
 
@@ -94,6 +93,7 @@ static const struct ena_stats ena_stats_rx_strings[] = {
         ENA_STAT_RX_ENTRY(dma_mapping_err),
         ENA_STAT_RX_ENTRY(bad_desc_num),
         ENA_STAT_RX_ENTRY(rx_copybreak_pkt),
+        ENA_STAT_RX_ENTRY(empty_rx_ring),
 };
 
 static const struct ena_stats ena_stats_ena_com_strings[] = {
diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c b/drivers/net/ethernet/amazon/ena/ena_netdev.c
index 7c1214d78855..4f16ed38bcf3 100644
--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
+++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
@@ -190,6 +190,7 @@ static void ena_init_io_rings(struct ena_adapter *adapter)
                 rxr->sgl_size = adapter->max_rx_sgl_size;
                 rxr->smoothed_interval =
                         ena_com_get_nonadaptive_moderation_interval_rx(ena_dev);
+                rxr->empty_rx_queue = 0;
         }
 }
 
@@ -1078,6 +1079,26 @@ inline void ena_adjust_intr_moderation(struct ena_ring *rx_ring,
         rx_ring->per_napi_bytes = 0;
 }
 
+static inline void ena_unmask_interrupt(struct ena_ring *tx_ring,
+                                        struct ena_ring *rx_ring)
+{
+        struct ena_eth_io_intr_reg intr_reg;
+
+        /* Update intr register: rx intr delay,
+         * tx intr delay and interrupt unmask
+         */
+        ena_com_update_intr_reg(&intr_reg,
+                                rx_ring->smoothed_interval,
+                                tx_ring->smoothed_interval,
+                                true);
+
+        /* It is a shared MSI-X.
+         * Tx and Rx CQ have pointer to it.
+         * So we use one of them to reach the intr reg
+         */
+        ena_com_unmask_intr(rx_ring->ena_com_io_cq, &intr_reg);
+}
+
 static inline void ena_update_ring_numa_node(struct ena_ring *tx_ring,
                                              struct ena_ring *rx_ring)
 {
@@ -1108,7 +1129,6 @@ static int ena_io_poll(struct napi_struct *napi, int budget)
 {
         struct ena_napi *ena_napi = container_of(napi, struct ena_napi, napi);
         struct ena_ring *tx_ring, *rx_ring;
-        struct ena_eth_io_intr_reg intr_reg;
 
         u32 tx_work_done;
         u32 rx_work_done;
@@ -1149,22 +1169,9 @@ static int ena_io_poll(struct napi_struct *napi, int budget)
                         if (ena_com_get_adaptive_moderation_enabled(rx_ring->ena_dev))
                                 ena_adjust_intr_moderation(rx_ring, tx_ring);
 
-                        /* Update intr register: rx intr delay,
-                         * tx intr delay and interrupt unmask
-                         */
-                        ena_com_update_intr_reg(&intr_reg,
-                                                rx_ring->smoothed_interval,
-                                                tx_ring->smoothed_interval,
-                                                true);
-
-                        /* It is a shared MSI-X.
-                         * Tx and Rx CQ have pointer to it.
-                         * So we use one of them to reach the intr reg
-                         */
-                        ena_com_unmask_intr(rx_ring->ena_com_io_cq, &intr_reg);
+                        ena_unmask_interrupt(tx_ring, rx_ring);
                 }
 
-
                 ena_update_ring_numa_node(tx_ring, rx_ring);
 
                 ret = rx_work_done;
@@ -1485,6 +1492,11 @@ static int ena_up_complete(struct ena_adapter *adapter)
 
         ena_napi_enable_all(adapter);
 
+        /* Enable completion queues interrupt */
+        for (i = 0; i < adapter->num_queues; i++)
+                ena_unmask_interrupt(&adapter->tx_ring[i],
+                                     &adapter->rx_ring[i]);
+
         /* schedule napi in case we had pending packets
          * from the last time we disable napi
          */
@@ -1532,6 +1544,7 @@ static int ena_create_io_tx_queue(struct ena_adapter *adapter, int qid)
                           "Failed to get TX queue handlers. TX queue num %d rc: %d\n",
                           qid, rc);
                 ena_com_destroy_io_queue(ena_dev, ena_qid);
+                return rc;
         }
 
         ena_com_update_numa_node(tx_ring->ena_com_io_cq, ctx.numa_node);
@@ -1596,6 +1609,7 @@ static int ena_create_io_rx_queue(struct ena_adapter *adapter, int qid)
                           "Failed to get RX queue handlers. RX queue num %d rc: %d\n",
                           qid, rc);
                 ena_com_destroy_io_queue(ena_dev, ena_qid);
+                return rc;
         }
 
         ena_com_update_numa_node(rx_ring->ena_com_io_cq, ctx.numa_node);
@@ -1981,6 +1995,7 @@ static netdev_tx_t ena_start_xmit(struct sk_buff *skb, struct net_device *dev)
 
         tx_info->tx_descs = nb_hw_desc;
         tx_info->last_jiffies = jiffies;
+        tx_info->print_once = 0;
 
         tx_ring->next_to_use = ENA_TX_RING_IDX_NEXT(next_to_use,
                 tx_ring->ring_size);
@@ -2550,13 +2565,44 @@ err:
                 "Reset attempt failed. Can not reset the device\n");
 }
 
-static void check_for_missing_tx_completions(struct ena_adapter *adapter)
+static int check_missing_comp_in_queue(struct ena_adapter *adapter,
+                                       struct ena_ring *tx_ring)
 {
         struct ena_tx_buffer *tx_buf;
         unsigned long last_jiffies;
+        u32 missed_tx = 0;
+        int i;
+
+        for (i = 0; i < tx_ring->ring_size; i++) {
+                tx_buf = &tx_ring->tx_buffer_info[i];
+                last_jiffies = tx_buf->last_jiffies;
+                if (unlikely(last_jiffies &&
+                             time_is_before_jiffies(last_jiffies + TX_TIMEOUT))) {
+                        if (!tx_buf->print_once)
+                                netif_notice(adapter, tx_err, adapter->netdev,
+                                             "Found a Tx that wasn't completed on time, qid %d, index %d.\n",
+                                             tx_ring->qid, i);
+
+                        tx_buf->print_once = 1;
+                        missed_tx++;
+
+                        if (unlikely(missed_tx > MAX_NUM_OF_TIMEOUTED_PACKETS)) {
+                                netif_err(adapter, tx_err, adapter->netdev,
+                                          "The number of lost tx completions is above the threshold (%d > %d). Reset the device\n",
+                                          missed_tx, MAX_NUM_OF_TIMEOUTED_PACKETS);
+                                set_bit(ENA_FLAG_TRIGGER_RESET, &adapter->flags);
+                                return -EIO;
+                        }
+                }
+        }
+
+        return 0;
+}
+
+static void check_for_missing_tx_completions(struct ena_adapter *adapter)
+{
         struct ena_ring *tx_ring;
-        int i, j, budget;
-        u32 missed_tx;
+        int i, budget, rc;
 
         /* Make sure the driver doesn't turn the device in other process */
         smp_rmb();
@@ -2572,31 +2618,9 @@ static void check_for_missing_tx_completions(struct ena_adapter *adapter)
         for (i = adapter->last_monitored_tx_qid; i < adapter->num_queues; i++) {
                 tx_ring = &adapter->tx_ring[i];
 
-                for (j = 0; j < tx_ring->ring_size; j++) {
-                        tx_buf = &tx_ring->tx_buffer_info[j];
-                        last_jiffies = tx_buf->last_jiffies;
-                        if (unlikely(last_jiffies && time_is_before_jiffies(last_jiffies + TX_TIMEOUT))) {
-                                netif_notice(adapter, tx_err, adapter->netdev,
-                                             "Found a Tx that wasn't completed on time, qid %d, index %d.\n",
-                                             tx_ring->qid, j);
-
-                                u64_stats_update_begin(&tx_ring->syncp);
-                                missed_tx = tx_ring->tx_stats.missing_tx_comp++;
-                                u64_stats_update_end(&tx_ring->syncp);
-
-                                /* Clear last jiffies so the lost buffer won't
-                                 * be counted twice.
-                                 */
-                                tx_buf->last_jiffies = 0;
-
-                                if (unlikely(missed_tx > MAX_NUM_OF_TIMEOUTED_PACKETS)) {
-                                        netif_err(adapter, tx_err, adapter->netdev,
-                                                  "The number of lost tx completion is above the threshold (%d > %d). Reset the device\n",
-                                                  missed_tx, MAX_NUM_OF_TIMEOUTED_PACKETS);
-                                        set_bit(ENA_FLAG_TRIGGER_RESET, &adapter->flags);
-                                }
-                        }
-                }
+                rc = check_missing_comp_in_queue(adapter, tx_ring);
+                if (unlikely(rc))
+                        return;
 
                 budget--;
                 if (!budget)
@@ -2606,6 +2630,58 @@ static void check_for_missing_tx_completions(struct ena_adapter *adapter)
         adapter->last_monitored_tx_qid = i % adapter->num_queues;
 }
 
+/* trigger napi schedule after 2 consecutive detections */
+#define EMPTY_RX_REFILL 2
+/* For the rare case where the device runs out of Rx descriptors and the
+ * napi handler failed to refill new Rx descriptors (due to a lack of memory
+ * for example).
+ * This case will lead to a deadlock:
+ * The device won't send interrupts since all the new Rx packets will be dropped
+ * The napi handler won't allocate new Rx descriptors so the device will be
+ * able to send new packets.
+ *
+ * This scenario can happen when the kernel's vm.min_free_kbytes is too small.
+ * It is recommended to have at least 512MB, with a minimum of 128MB for
+ * constrained environment).
+ *
+ * When such a situation is detected - Reschedule napi
+ */
+static void check_for_empty_rx_ring(struct ena_adapter *adapter)
+{
+        struct ena_ring *rx_ring;
+        int i, refill_required;
+
+        if (!test_bit(ENA_FLAG_DEV_UP, &adapter->flags))
+                return;
+
+        if (test_bit(ENA_FLAG_TRIGGER_RESET, &adapter->flags))
+                return;
+
+        for (i = 0; i < adapter->num_queues; i++) {
+                rx_ring = &adapter->rx_ring[i];
+
+                refill_required =
+                        ena_com_sq_empty_space(rx_ring->ena_com_io_sq);
+                if (unlikely(refill_required == (rx_ring->ring_size - 1))) {
+                        rx_ring->empty_rx_queue++;
+
+                        if (rx_ring->empty_rx_queue >= EMPTY_RX_REFILL) {
+                                u64_stats_update_begin(&rx_ring->syncp);
+                                rx_ring->rx_stats.empty_rx_ring++;
+                                u64_stats_update_end(&rx_ring->syncp);
+
+                                netif_err(adapter, drv, adapter->netdev,
+                                          "trigger refill for ring %d\n", i);
+
+                                napi_schedule(rx_ring->napi);
+                                rx_ring->empty_rx_queue = 0;
+                        }
+                } else {
+                        rx_ring->empty_rx_queue = 0;
+                }
+        }
+}
+
 /* Check for keep alive expiration */
 static void check_for_missing_keep_alive(struct ena_adapter *adapter)
 {
@@ -2660,6 +2736,8 @@ static void ena_timer_service(unsigned long data)
 
         check_for_missing_tx_completions(adapter);
 
+        check_for_empty_rx_ring(adapter);
+
         if (debug_area)
                 ena_dump_stats_to_buf(adapter, debug_area);
 
@@ -2840,6 +2918,11 @@ static void ena_release_bars(struct ena_com_dev *ena_dev, struct pci_dev *pdev)
 {
         int release_bars;
 
+        if (ena_dev->mem_bar)
+                devm_iounmap(&pdev->dev, ena_dev->mem_bar);
+
+        devm_iounmap(&pdev->dev, ena_dev->reg_bar);
+
         release_bars = pci_select_bars(pdev, IORESOURCE_MEM) & ENA_BAR_MASK;
         pci_release_selected_regions(pdev, release_bars);
 }
@@ -2927,8 +3010,9 @@ static int ena_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
                 goto err_free_ena_dev;
         }
 
-        ena_dev->reg_bar = ioremap(pci_resource_start(pdev, ENA_REG_BAR),
-                                   pci_resource_len(pdev, ENA_REG_BAR));
+        ena_dev->reg_bar = devm_ioremap(&pdev->dev,
+                                        pci_resource_start(pdev, ENA_REG_BAR),
+                                        pci_resource_len(pdev, ENA_REG_BAR));
         if (!ena_dev->reg_bar) {
                 dev_err(&pdev->dev, "failed to remap regs bar\n");
                 rc = -EFAULT;
@@ -2948,8 +3032,9 @@ static int ena_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         ena_set_push_mode(pdev, ena_dev, &get_feat_ctx);
 
         if (ena_dev->tx_mem_queue_type == ENA_ADMIN_PLACEMENT_POLICY_DEV) {
-                ena_dev->mem_bar = ioremap_wc(pci_resource_start(pdev, ENA_MEM_BAR),
-                                              pci_resource_len(pdev, ENA_MEM_BAR));
+                ena_dev->mem_bar = devm_ioremap_wc(&pdev->dev,
+                                                   pci_resource_start(pdev, ENA_MEM_BAR),
+                                                   pci_resource_len(pdev, ENA_MEM_BAR));
                 if (!ena_dev->mem_bar) {
                         rc = -EFAULT;
                         goto err_device_destroy;
diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.h b/drivers/net/ethernet/amazon/ena/ena_netdev.h
index 0e22bce6239d..a4d3d5e21068 100644
--- a/drivers/net/ethernet/amazon/ena/ena_netdev.h
+++ b/drivers/net/ethernet/amazon/ena/ena_netdev.h
@@ -45,7 +45,7 @@
 
 #define DRV_MODULE_VER_MAJOR    1
 #define DRV_MODULE_VER_MINOR    1
-#define DRV_MODULE_VER_SUBMINOR 2
+#define DRV_MODULE_VER_SUBMINOR 7
 
 #define DRV_MODULE_NAME         "ena"
 #ifndef DRV_MODULE_VERSION
@@ -146,7 +146,18 @@ struct ena_tx_buffer {
         u32 tx_descs;
         /* num of buffers used by this skb */
         u32 num_of_bufs;
-        /* Save the last jiffies to detect missing tx packets */
+
+        /* Used for detect missing tx packets to limit the number of prints */
+        u32 print_once;
+        /* Save the last jiffies to detect missing tx packets
+         *
+         * sets to non zero value on ena_start_xmit and set to zero on
+         * napi and timer_Service_routine.
+         *
+         * while this value is not protected by lock,
+         * a given packet is not expected to be handled by ena_start_xmit
+         * and by napi/timer_service at the same time.
+         */
         unsigned long last_jiffies;
         struct ena_com_buf bufs[ENA_PKT_MAX_BUFS];
 } ____cacheline_aligned;
@@ -170,7 +181,6 @@ struct ena_stats_tx {
         u64 napi_comp;
         u64 tx_poll;
         u64 doorbells;
-        u64 missing_tx_comp;
         u64 bad_req_id;
 };
 
@@ -184,6 +194,7 @@ struct ena_stats_rx {
         u64 dma_mapping_err;
         u64 bad_desc_num;
         u64 rx_copybreak_pkt;
+        u64 empty_rx_ring;
 };
 
 struct ena_ring {
@@ -231,6 +242,7 @@ struct ena_ring {
                 struct ena_stats_tx tx_stats;
                 struct ena_stats_rx rx_stats;
         };
+        int empty_rx_queue;
 } ____cacheline_aligned;
 
 struct ena_stats_dev {
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-desc.c b/drivers/net/ethernet/amd/xgbe/xgbe-desc.c
index b3bc87fe3764..0a98c369df20 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-desc.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-desc.c
@@ -324,7 +324,7 @@ static int xgbe_map_rx_buffer(struct xgbe_prv_data *pdata,
                               struct xgbe_ring *ring,
                               struct xgbe_ring_data *rdata)
 {
-        int order, ret;
+        int ret;
 
         if (!ring->rx_hdr_pa.pages) {
                 ret = xgbe_alloc_pages(pdata, &ring->rx_hdr_pa, GFP_ATOMIC, 0);
@@ -333,9 +333,8 @@ static int xgbe_map_rx_buffer(struct xgbe_prv_data *pdata,
         }
 
         if (!ring->rx_buf_pa.pages) {
-                order = max_t(int, PAGE_ALLOC_COSTLY_ORDER - 1, 0);
                 ret = xgbe_alloc_pages(pdata, &ring->rx_buf_pa, GFP_ATOMIC,
-                                       order);
+                                       PAGE_ALLOC_COSTLY_ORDER);
                 if (ret)
                         return ret;
         }
diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.h b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.h
index b8e3d88f0879..a66aee51ab5b 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.h
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.h
@@ -193,9 +193,6 @@ int hw_atl_utils_hw_get_regs(struct aq_hw_s *self,
                              struct aq_hw_caps_s *aq_hw_caps,
                              u32 *regs_buff);
 
-int hw_atl_utils_hw_get_settings(struct aq_hw_s *self,
-                                 struct ethtool_cmd *cmd);
-
 int hw_atl_utils_hw_set_power(struct aq_hw_s *self,
                               unsigned int power_state);
 
diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
index 099b374c1b17..5274501428e4 100644
--- a/drivers/net/ethernet/broadcom/bcmsysport.c
+++ b/drivers/net/ethernet/broadcom/bcmsysport.c
@@ -2026,9 +2026,12 @@ static int bcm_sysport_probe(struct platform_device *pdev)
         priv->num_rx_desc_words = params->num_rx_desc_words;
 
         priv->irq0 = platform_get_irq(pdev, 0);
-        if (!priv->is_lite)
+        if (!priv->is_lite) {
                 priv->irq1 = platform_get_irq(pdev, 1);
-        priv->wol_irq = platform_get_irq(pdev, 2);
+                priv->wol_irq = platform_get_irq(pdev, 2);
+        } else {
+                priv->wol_irq = platform_get_irq(pdev, 1);
+        }
         if (priv->irq0 <= 0 || (priv->irq1 <= 0 && !priv->is_lite)) {
                 dev_err(&pdev->dev, "invalid interrupts\n");
                 ret = -EINVAL;
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
index eccb3d1b6abb..f619c4cac51f 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -1926,7 +1926,7 @@ u16 bnx2x_select_queue(struct net_device *dev, struct sk_buff *skb,
         }
 
         /* select a non-FCoE queue */
-        return fallback(dev, skb) % BNX2X_NUM_ETH_QUEUES(bp);
+        return fallback(dev, skb) % (BNX2X_NUM_ETH_QUEUES(bp) * bp->max_cos);
 }
 
 void bnx2x_set_num_queues(struct bnx2x *bp)
@@ -3883,15 +3883,26 @@ netdev_tx_t bnx2x_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 /* when transmitting in a vf, start bd must hold the ethertype
                  * for fw to enforce it
                  */
+                u16 vlan_tci = 0;
 #ifndef BNX2X_STOP_ON_ERROR
-                if (IS_VF(bp))
+                if (IS_VF(bp)) {
 #endif
-                        tx_start_bd->vlan_or_ethertype =
-                                cpu_to_le16(ntohs(eth->h_proto));
+                        /* Still need to consider inband vlan for enforced */
+                        if (__vlan_get_tag(skb, &vlan_tci)) {
+                                tx_start_bd->vlan_or_ethertype =
+                                        cpu_to_le16(ntohs(eth->h_proto));
+                        } else {
+                                tx_start_bd->bd_flags.as_bitfield |=
+                                        (X_ETH_INBAND_VLAN <<
+                                         ETH_TX_BD_FLAGS_VLAN_MODE_SHIFT);
+                                tx_start_bd->vlan_or_ethertype =
+                                        cpu_to_le16(vlan_tci);
+                        }
 #ifndef BNX2X_STOP_ON_ERROR
-                else
+                } else {
                         /* used by FW for packet accounting */
                         tx_start_bd->vlan_or_ethertype = cpu_to_le16(pkt_prod);
+                }
 #endif
         }
 
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index a851f95c307a..349a46593abf 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -12729,7 +12729,7 @@ static int bnx2x_set_mc_list(struct bnx2x *bp)
         } else {
                 /* If no mc addresses are required, flush the configuration */
                 rc = bnx2x_config_mcast(bp, &rparam, BNX2X_MCAST_CMD_DEL);
-                if (rc)
+                if (rc < 0)
                         BNX2X_ERR("Failed to clear multicast configuration %d\n",
                                   rc);
         }
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
index bdfd53b46bc5..9ca994d0bab6 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
@@ -901,6 +901,8 @@ static void bnx2x_vf_flr(struct bnx2x *bp, struct bnx2x_virtf *vf)
         /* release VF resources */
         bnx2x_vf_free_resc(bp, vf);
 
+        vf->malicious = false;
+
         /* re-open the mailbox */
         bnx2x_vf_enable_mbx(bp, vf->abs_vfid);
         return;
@@ -1822,9 +1824,11 @@ get_vf:
                    vf->abs_vfid, qidx);
                 bnx2x_vf_handle_rss_update_eqe(bp, vf);
         case EVENT_RING_OPCODE_VF_FLR:
-        case EVENT_RING_OPCODE_MALICIOUS_VF:
                 /* Do nothing for now */
                 return 0;
+        case EVENT_RING_OPCODE_MALICIOUS_VF:
+                vf->malicious = true;
+                return 0;
         }
 
         return 0;
@@ -1905,6 +1909,13 @@ void bnx2x_iov_adjust_stats_req(struct bnx2x *bp)
                         continue;
                 }
 
+                if (vf->malicious) {
+                        DP_AND((BNX2X_MSG_IOV | BNX2X_MSG_STATS),
+                               "vf %d malicious so no stats for it\n",
+                               vf->abs_vfid);
+                        continue;
+                }
+
                 DP_AND((BNX2X_MSG_IOV | BNX2X_MSG_STATS),
                        "add addresses for vf %d\n", vf->abs_vfid);
                 for_each_vfq(vf, j) {
@@ -3042,7 +3053,7 @@ void bnx2x_vf_pci_dealloc(struct bnx2x *bp)
 {
         BNX2X_PCI_FREE(bp->vf2pf_mbox, bp->vf2pf_mbox_mapping,
                        sizeof(struct bnx2x_vf_mbx_msg));
-        BNX2X_PCI_FREE(bp->vf2pf_mbox, bp->pf2vf_bulletin_mapping,
+        BNX2X_PCI_FREE(bp->pf2vf_bulletin, bp->pf2vf_bulletin_mapping,
                        sizeof(union pf_vf_bulletin));
 }
 
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h
index 888d0b6632e8..53466f6cebab 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h
@@ -141,6 +141,7 @@ struct bnx2x_virtf {
 #define VF_RESET        3       /* VF FLR'd, pending cleanup */
 
         bool flr_clnup_stage;   /* true during flr cleanup */
+        bool malicious;         /* true if FW indicated so, until FLR */
 
         /* dma */
         dma_addr_t fw_stat_map;
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index 03f55daecb20..74e8e215524d 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -1301,10 +1301,11 @@ static inline struct sk_buff *bnxt_tpa_end(struct bnxt *bp,
                 cp_cons = NEXT_CMP(cp_cons);
         }
 
-        if (unlikely(agg_bufs > MAX_SKB_FRAGS)) {
+        if (unlikely(agg_bufs > MAX_SKB_FRAGS || TPA_END_ERRORS(tpa_end1))) {
                 bnxt_abort_tpa(bp, bnapi, cp_cons, agg_bufs);
-                netdev_warn(bp->dev, "TPA frags %d exceeded MAX_SKB_FRAGS %d\n",
-                            agg_bufs, (int)MAX_SKB_FRAGS);
+                if (agg_bufs > MAX_SKB_FRAGS)
+                        netdev_warn(bp->dev, "TPA frags %d exceeded MAX_SKB_FRAGS %d\n",
+                                    agg_bufs, (int)MAX_SKB_FRAGS);
                 return NULL;
         }
 
@@ -1562,6 +1563,45 @@ next_rx_no_prod:
         return rc;
 }
 
+/* In netpoll mode, if we are using a combined completion ring, we need to
+ * discard the rx packets and recycle the buffers.
+ */
+static int bnxt_force_rx_discard(struct bnxt *bp, struct bnxt_napi *bnapi,
+                                 u32 *raw_cons, u8 *event)
+{
+        struct bnxt_cp_ring_info *cpr = &bnapi->cp_ring;
+        u32 tmp_raw_cons = *raw_cons;
+        struct rx_cmp_ext *rxcmp1;
+        struct rx_cmp *rxcmp;
+        u16 cp_cons;
+        u8 cmp_type;
+
+        cp_cons = RING_CMP(tmp_raw_cons);
+        rxcmp = (struct rx_cmp *)
+                        &cpr->cp_desc_ring[CP_RING(cp_cons)][CP_IDX(cp_cons)];
+
+        tmp_raw_cons = NEXT_RAW_CMP(tmp_raw_cons);
+        cp_cons = RING_CMP(tmp_raw_cons);
+        rxcmp1 = (struct rx_cmp_ext *)
+                        &cpr->cp_desc_ring[CP_RING(cp_cons)][CP_IDX(cp_cons)];
+
+        if (!RX_CMP_VALID(rxcmp1, tmp_raw_cons))
+                return -EBUSY;
+
+        cmp_type = RX_CMP_TYPE(rxcmp);
+        if (cmp_type == CMP_TYPE_RX_L2_CMP) {
+                rxcmp1->rx_cmp_cfa_code_errors_v2 |=
+                        cpu_to_le32(RX_CMPL_ERRORS_CRC_ERROR);
+        } else if (cmp_type == CMP_TYPE_RX_L2_TPA_END_CMP) {
+                struct rx_tpa_end_cmp_ext *tpa_end1;
+
+                tpa_end1 = (struct rx_tpa_end_cmp_ext *)rxcmp1;
+                tpa_end1->rx_tpa_end_cmp_errors_v2 |=
+                        cpu_to_le32(RX_TPA_END_CMP_ERRORS);
+        }
+        return bnxt_rx_pkt(bp, bnapi, raw_cons, event);
+}
+
 #define BNXT_GET_EVENT_PORT(data)       \
         ((data) &                       \
          ASYNC_EVENT_CMPL_PORT_CONN_NOT_ALLOWED_EVENT_DATA1_PORT_ID_MASK)
@@ -1744,7 +1784,11 @@ static int bnxt_poll_work(struct bnxt *bp, struct bnxt_napi *bnapi, int budget)
                         if (unlikely(tx_pkts > bp->tx_wake_thresh))
                                 rx_pkts = budget;
                 } else if ((TX_CMP_TYPE(txcmp) & 0x30) == 0x10) {
-                        rc = bnxt_rx_pkt(bp, bnapi, &raw_cons, &event);
+                        if (likely(budget))
+                                rc = bnxt_rx_pkt(bp, bnapi, &raw_cons, &event);
+                        else
+                                rc = bnxt_force_rx_discard(bp, bnapi, &raw_cons,
+                                                           &event);
                         if (likely(rc >= 0))
                                 rx_pkts += rc;
                         else if (rc == -EBUSY)  /* partial completion */
@@ -6663,12 +6707,11 @@ static void bnxt_poll_controller(struct net_device *dev)
         struct bnxt *bp = netdev_priv(dev);
         int i;
 
-        for (i = 0; i < bp->cp_nr_rings; i++) {
-                struct bnxt_irq *irq = &bp->irq_tbl[i];
+        /* Only process tx rings/combined rings in netpoll mode. */
+        for (i = 0; i < bp->tx_nr_rings; i++) {
+                struct bnxt_tx_ring_info *txr = &bp->tx_ring[i];
 
-                disable_irq(irq->vector);
-                irq->handler(irq->vector, bp->bnapi[i]);
-                enable_irq(irq->vector);
+                napi_schedule(&txr->bnapi->napi);
         }
 }
 #endif
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
index 3ef42dbc6327..d46a85041083 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
@@ -374,12 +374,16 @@ struct rx_tpa_end_cmp_ext {
 
         __le32 rx_tpa_end_cmp_errors_v2;
         #define RX_TPA_END_CMP_V2                               (0x1 << 0)
-        #define RX_TPA_END_CMP_ERRORS                           (0x7fff << 1)
+        #define RX_TPA_END_CMP_ERRORS                           (0x3 << 1)
         #define RX_TPA_END_CMPL_ERRORS_SHIFT                     1
 
         u32 rx_tpa_end_cmp_start_opaque;
 };
 
+#define TPA_END_ERRORS(rx_tpa_end_ext)                                  \
+        ((rx_tpa_end_ext)->rx_tpa_end_cmp_errors_v2 &                   \
+         cpu_to_le32(RX_TPA_END_CMP_ERRORS))
+
 #define DB_IDX_MASK                                             0xffffff
 #define DB_IDX_VALID                                            (0x1 << 26)
 #define DB_IRQ_DIS                                              (0x1 << 27)
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index 38a5c6764bb5..53309f659951 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -2171,9 +2171,10 @@ static int cxgb_up(struct adapter *adap)
 {
         int err;
 
+        mutex_lock(&uld_mutex);
         err = setup_sge_queues(adap);
         if (err)
-                goto out;
+                goto rel_lock;
         err = setup_rss(adap);
         if (err)
                 goto freeq;
@@ -2196,23 +2197,28 @@ static int cxgb_up(struct adapter *adap)
                 if (err)
                         goto irq_err;
         }
+
         enable_rx(adap);
         t4_sge_start(adap);
         t4_intr_enable(adap);
         adap->flags |= FULL_INIT_DONE;
+        mutex_unlock(&uld_mutex);
+
         notify_ulds(adap, CXGB4_STATE_UP);
 #if IS_ENABLED(CONFIG_IPV6)
         update_clip(adap);
 #endif
         /* Initialize hash mac addr list*/
         INIT_LIST_HEAD(&adap->mac_hlist);
- out:
         return err;
+
  irq_err:
         dev_err(adap->pdev_dev, "request_irq failed, err %d\n", err);
  freeq:
         t4_free_sge_resources(adap);
-        goto out;
+ rel_lock:
+        mutex_unlock(&uld_mutex);
+        return err;
 }
 
 static void cxgb_down(struct adapter *adapter)
@@ -2771,6 +2777,9 @@ void t4_fatal_err(struct adapter *adap)
 {
         int port;
 
+        if (pci_channel_offline(adap->pdev))
+                return;
+
         /* Disable the SGE since ULDs are going to free resources that
          * could be exposed to the adapter.  RDMA MWs for example...
          */
@@ -3882,9 +3891,10 @@ static pci_ers_result_t eeh_err_detected(struct pci_dev *pdev,
         spin_lock(&adap->stats_lock);
         for_each_port(adap, i) {
                 struct net_device *dev = adap->port[i];
-
-                netif_device_detach(dev);
-                netif_carrier_off(dev);
+                if (dev) {
+                        netif_device_detach(dev);
+                        netif_carrier_off(dev);
+                }
         }
         spin_unlock(&adap->stats_lock);
         disable_interrupts(adap);
@@ -3963,12 +3973,13 @@ static void eeh_resume(struct pci_dev *pdev)
         rtnl_lock();
         for_each_port(adap, i) {
                 struct net_device *dev = adap->port[i];
-
-                if (netif_running(dev)) {
-                        link_start(dev);
-                        cxgb_set_rxmode(dev);
+                if (dev) {
+                        if (netif_running(dev)) {
+                                link_start(dev);
+                                cxgb_set_rxmode(dev);
+                        }
+                        netif_device_attach(dev);
                 }
-                netif_device_attach(dev);
         }
         rtnl_unlock();
 }
@@ -4516,7 +4527,7 @@ static void dummy_setup(struct net_device *dev)
         /* Initialize the device structure. */
         dev->netdev_ops = &cxgb4_mgmt_netdev_ops;
         dev->ethtool_ops = &cxgb4_mgmt_ethtool_ops;
-        dev->destructor = free_netdev;
+        dev->needs_free_netdev = true;
 }
 
 static int config_mgmt_dev(struct pci_dev *pdev)
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
index aded42b96f6d..3a34aa629f7d 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
@@ -4557,8 +4557,13 @@ void t4_intr_enable(struct adapter *adapter)
  */
 void t4_intr_disable(struct adapter *adapter)
 {
-        u32 whoami = t4_read_reg(adapter, PL_WHOAMI_A);
-        u32 pf = CHELSIO_CHIP_VERSION(adapter->params.chip) <= CHELSIO_T5 ?
+        u32 whoami, pf;
+
+        if (pci_channel_offline(adapter->pdev))
+                return;
+
+        whoami = t4_read_reg(adapter, PL_WHOAMI_A);
+        pf = CHELSIO_CHIP_VERSION(adapter->params.chip) <= CHELSIO_T5 ?
                         SOURCEPF_G(whoami) : T6_SOURCEPF_G(whoami);
 
         t4_write_reg(adapter, MYPF_REG(PL_PF_INT_ENABLE_A), 0);
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4fw_version.h b/drivers/net/ethernet/chelsio/cxgb4/t4fw_version.h
index 3549d3876278..f2d623a7aee0 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4fw_version.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4fw_version.h
@@ -37,7 +37,7 @@
 
 #define T4FW_VERSION_MAJOR 0x01
 #define T4FW_VERSION_MINOR 0x10
-#define T4FW_VERSION_MICRO 0x2B
+#define T4FW_VERSION_MICRO 0x2D
 #define T4FW_VERSION_BUILD 0x00
 
 #define T4FW_MIN_VERSION_MAJOR 0x01
@@ -46,7 +46,7 @@
 
 #define T5FW_VERSION_MAJOR 0x01
 #define T5FW_VERSION_MINOR 0x10
-#define T5FW_VERSION_MICRO 0x2B
+#define T5FW_VERSION_MICRO 0x2D
 #define T5FW_VERSION_BUILD 0x00
 
 #define T5FW_MIN_VERSION_MAJOR 0x00
@@ -55,7 +55,7 @@
 
 #define T6FW_VERSION_MAJOR 0x01
 #define T6FW_VERSION_MINOR 0x10
-#define T6FW_VERSION_MICRO 0x2B
+#define T6FW_VERSION_MICRO 0x2D
 #define T6FW_VERSION_BUILD 0x00
 
 #define T6FW_MIN_VERSION_MAJOR 0x00
diff --git a/drivers/net/ethernet/ethoc.c b/drivers/net/ethernet/ethoc.c
index e863ba74d005..8bb0db990c8f 100644
--- a/drivers/net/ethernet/ethoc.c
+++ b/drivers/net/ethernet/ethoc.c
@@ -739,6 +739,8 @@ static int ethoc_open(struct net_device *dev)
         if (ret)
                 return ret;
 
+        napi_enable(&priv->napi);
+
         ethoc_init_ring(priv, dev->mem_start);
         ethoc_reset(priv);
 
@@ -754,7 +756,6 @@ static int ethoc_open(struct net_device *dev)
         priv->old_duplex = -1;
 
         phy_start(dev->phydev);
-        napi_enable(&priv->napi);
 
         if (netif_msg_ifup(priv)) {
                 dev_info(&dev->dev, "I/O: %08lx Memory: %08lx-%08lx\n",
diff --git a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
index 9a520e4f0df9..290ad0563320 100644
--- a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
+++ b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
@@ -2647,7 +2647,7 @@ static int dpaa_eth_probe(struct platform_device *pdev)
         priv->buf_layout[TX].priv_data_size = DPAA_TX_PRIV_DATA_SIZE; /* Tx */
 
         /* device used for DMA mapping */
-        arch_setup_dma_ops(dev, 0, 0, NULL, false);
+        set_dma_ops(dev, get_dma_ops(&pdev->dev));
         err = dma_coerce_mask_and_coherent(dev, DMA_BIT_MASK(40));
         if (err) {
                 dev_err(dev, "dma_coerce_mask_and_coherent() failed\n");
diff --git a/drivers/net/ethernet/freescale/fman/Kconfig b/drivers/net/ethernet/freescale/fman/Kconfig
index dc0850b3b517..8870a9a798ca 100644
--- a/drivers/net/ethernet/freescale/fman/Kconfig
+++ b/drivers/net/ethernet/freescale/fman/Kconfig
@@ -2,6 +2,7 @@ config FSL_FMAN
         tristate "FMan support"
         depends on FSL_SOC || ARCH_LAYERSCAPE || COMPILE_TEST
         select GENERIC_ALLOCATOR
+        depends on HAS_DMA
         select PHYLIB
         default n
         help
diff --git a/drivers/net/ethernet/freescale/fman/mac.c b/drivers/net/ethernet/freescale/fman/mac.c
index 0b31f8502ada..6e67d22fd0d5 100644
--- a/drivers/net/ethernet/freescale/fman/mac.c
+++ b/drivers/net/ethernet/freescale/fman/mac.c
@@ -623,6 +623,8 @@ static struct platform_device *dpaa_eth_add_device(int fman_id,
                 goto no_mem;
         }
 
+        set_dma_ops(&pdev->dev, get_dma_ops(priv->dev));
+
         ret = platform_device_add_data(pdev, &data, sizeof(data));
         if (ret)
                 goto err;
diff --git a/drivers/net/ethernet/freescale/fsl_pq_mdio.c b/drivers/net/ethernet/freescale/fsl_pq_mdio.c
index 446c7b374ff5..a10de1e9c157 100644
--- a/drivers/net/ethernet/freescale/fsl_pq_mdio.c
+++ b/drivers/net/ethernet/freescale/fsl_pq_mdio.c
@@ -381,7 +381,7 @@ static int fsl_pq_mdio_probe(struct platform_device *pdev)
 {
         const struct of_device_id *id =
                 of_match_device(fsl_pq_mdio_match, &pdev->dev);
-        const struct fsl_pq_mdio_data *data = id->data;
+        const struct fsl_pq_mdio_data *data;
         struct device_node *np = pdev->dev.of_node;
         struct resource res;
         struct device_node *tbi;
@@ -389,6 +389,13 @@ static int fsl_pq_mdio_probe(struct platform_device *pdev)
         struct mii_bus *new_bus;
         int err;
 
+        if (!id) {
+                dev_err(&pdev->dev, "Failed to match device\n");
+                return -ENODEV;
+        }
+
+        data = id->data;
+
         dev_dbg(&pdev->dev, "found %s compatible node\n", id->compatible);
 
         new_bus = mdiobus_alloc_size(sizeof(*priv));
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c b/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c
index b8fab149690f..e95795b3c841 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c
@@ -288,9 +288,15 @@ static int hns_nic_config_phy_loopback(struct phy_device *phy_dev, u8 en)
 
                 /* Force 1000M Link, Default is 0x0200 */
                 phy_write(phy_dev, 7, 0x20C);
-                phy_write(phy_dev, HNS_PHY_PAGE_REG, 0);
 
-                /* Enable PHY loop-back */
+                /* Powerup Fiber */
+                phy_write(phy_dev, HNS_PHY_PAGE_REG, 1);
+                val = phy_read(phy_dev, COPPER_CONTROL_REG);
+                val &= ~PHY_POWER_DOWN;
+                phy_write(phy_dev, COPPER_CONTROL_REG, val);
+
+                /* Enable Phy Loopback */
+                phy_write(phy_dev, HNS_PHY_PAGE_REG, 0);
                 val = phy_read(phy_dev, COPPER_CONTROL_REG);
                 val |= PHY_LOOP_BACK;
                 val &= ~PHY_POWER_DOWN;
@@ -299,6 +305,12 @@ static int hns_nic_config_phy_loopback(struct phy_device *phy_dev, u8 en)
                 phy_write(phy_dev, HNS_PHY_PAGE_REG, 0xFA);
                 phy_write(phy_dev, 1, 0x400);
                 phy_write(phy_dev, 7, 0x200);
+
+                phy_write(phy_dev, HNS_PHY_PAGE_REG, 1);
+                val = phy_read(phy_dev, COPPER_CONTROL_REG);
+                val |= PHY_POWER_DOWN;
+                phy_write(phy_dev, COPPER_CONTROL_REG, val);
+
                 phy_write(phy_dev, HNS_PHY_PAGE_REG, 0);
                 phy_write(phy_dev, 9, 0xF00);
 
diff --git a/drivers/net/ethernet/ibm/emac/core.c b/drivers/net/ethernet/ibm/emac/core.c
index 508923f39ccf..259e69a52ec5 100644
--- a/drivers/net/ethernet/ibm/emac/core.c
+++ b/drivers/net/ethernet/ibm/emac/core.c
@@ -343,6 +343,7 @@ static int emac_reset(struct emac_instance *dev)
 {
         struct emac_regs __iomem *p = dev->emacp;
         int n = 20;
+        bool __maybe_unused try_internal_clock = false;
 
         DBG(dev, "reset" NL);
 
@@ -355,6 +356,7 @@ static int emac_reset(struct emac_instance *dev)
         }
 
 #ifdef CONFIG_PPC_DCR_NATIVE
+do_retry:
         /*
          * PPC460EX/GT Embedded Processor Advanced User's Manual
          * section 28.10.1 Mode Register 0 (EMACx_MR0) states:
@@ -362,10 +364,19 @@ static int emac_reset(struct emac_instance *dev)
          * of the EMAC. If none is present, select the internal clock
          * (SDR0_ETH_CFG[EMACx_PHY_CLK] = 1).
          * After a soft reset, select the external clock.
+         *
+         * The AR8035-A PHY Meraki MR24 does not provide a TX Clk if the
+         * ethernet cable is not attached. This causes the reset to timeout
+         * and the PHY detection code in emac_init_phy() is unable to
+         * communicate and detect the AR8035-A PHY. As a result, the emac
+         * driver bails out early and the user has no ethernet.
+         * In order to stay compatible with existing configurations, the
+         * driver will temporarily switch to the internal clock, after
+         * the first reset fails.
          */
         if (emac_has_feature(dev, EMAC_FTR_460EX_PHY_CLK_FIX)) {
-                if (dev->phy_address == 0xffffffff &&
-                    dev->phy_map == 0xffffffff) {
+                if (try_internal_clock || (dev->phy_address == 0xffffffff &&
+                                           dev->phy_map == 0xffffffff)) {
                         /* No PHY: select internal loop clock before reset */
                         dcri_clrset(SDR0, SDR0_ETH_CFG,
                                     0, SDR0_ETH_CFG_ECS << dev->cell_index);
@@ -383,8 +394,15 @@ static int emac_reset(struct emac_instance *dev)
 
 #ifdef CONFIG_PPC_DCR_NATIVE
         if (emac_has_feature(dev, EMAC_FTR_460EX_PHY_CLK_FIX)) {
-                if (dev->phy_address == 0xffffffff &&
-                    dev->phy_map == 0xffffffff) {
+                if (!n && !try_internal_clock) {
+                        /* first attempt has timed out. */
+                        n = 20;
+                        try_internal_clock = true;
+                        goto do_retry;
+                }
+
+                if (try_internal_clock || (dev->phy_address == 0xffffffff &&
+                                           dev->phy_map == 0xffffffff)) {
                         /* No PHY: restore external clock source after reset */
                         dcri_clrset(SDR0, SDR0_ETH_CFG,
                                     SDR0_ETH_CFG_ECS << dev->cell_index, 0);
@@ -2460,20 +2478,24 @@ static int emac_mii_bus_reset(struct mii_bus *bus)
         return emac_reset(dev);
 }
 
+static int emac_mdio_phy_start_aneg(struct mii_phy *phy,
+                                    struct phy_device *phy_dev)
+{
+        phy_dev->autoneg = phy->autoneg;
+        phy_dev->speed = phy->speed;
+        phy_dev->duplex = phy->duplex;
+        phy_dev->advertising = phy->advertising;
+        return phy_start_aneg(phy_dev);
+}
+
 static int emac_mdio_setup_aneg(struct mii_phy *phy, u32 advertise)
 {
         struct net_device *ndev = phy->dev;
         struct emac_instance *dev = netdev_priv(ndev);
 
-        dev->phy.autoneg = AUTONEG_ENABLE;
-        dev->phy.speed = SPEED_1000;
-        dev->phy.duplex = DUPLEX_FULL;
-        dev->phy.advertising = advertise;
         phy->autoneg = AUTONEG_ENABLE;
-        phy->speed = dev->phy.speed;
-        phy->duplex = dev->phy.duplex;
         phy->advertising = advertise;
-        return phy_start_aneg(dev->phy_dev);
+        return emac_mdio_phy_start_aneg(phy, dev->phy_dev);
 }
 
 static int emac_mdio_setup_forced(struct mii_phy *phy, int speed, int fd)
@@ -2481,13 +2503,10 @@ static int emac_mdio_setup_forced(struct mii_phy *phy, int speed, int fd)
         struct net_device *ndev = phy->dev;
         struct emac_instance *dev = netdev_priv(ndev);
 
-        dev->phy.autoneg =  AUTONEG_DISABLE;
-        dev->phy.speed = speed;
-        dev->phy.duplex = fd;
         phy->autoneg = AUTONEG_DISABLE;
         phy->speed = speed;
         phy->duplex = fd;
-        return phy_start_aneg(dev->phy_dev);
+        return emac_mdio_phy_start_aneg(phy, dev->phy_dev);
 }
 
 static int emac_mdio_poll_link(struct mii_phy *phy)
@@ -2509,16 +2528,17 @@ static int emac_mdio_read_link(struct mii_phy *phy)
 {
         struct net_device *ndev = phy->dev;
         struct emac_instance *dev = netdev_priv(ndev);
+        struct phy_device *phy_dev = dev->phy_dev;
         int res;
 
-        res = phy_read_status(dev->phy_dev);
+        res = phy_read_status(phy_dev);
         if (res)
                 return res;
 
-        dev->phy.speed = phy->speed;
-        dev->phy.duplex = phy->duplex;
-        dev->phy.pause = phy->pause;
-        dev->phy.asym_pause = phy->asym_pause;
+        phy->speed = phy_dev->speed;
+        phy->duplex = phy_dev->duplex;
+        phy->pause = phy_dev->pause;
+        phy->asym_pause = phy_dev->asym_pause;
         return 0;
 }
 
@@ -2528,13 +2548,6 @@ static int emac_mdio_init_phy(struct mii_phy *phy)
         struct emac_instance *dev = netdev_priv(ndev);
 
         phy_start(dev->phy_dev);
-        dev->phy.autoneg = phy->autoneg;
-        dev->phy.speed = phy->speed;
-        dev->phy.duplex = phy->duplex;
-        dev->phy.advertising = phy->advertising;
-        dev->phy.pause = phy->pause;
-        dev->phy.asym_pause = phy->asym_pause;
-
         return phy_init_hw(dev->phy_dev);
 }
 
diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
index 4f2d329dba99..c0fbeb387db4 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.c
+++ b/drivers/net/ethernet/ibm/ibmvnic.c
@@ -81,7 +81,7 @@
 static const char ibmvnic_driver_name[] = "ibmvnic";
 static const char ibmvnic_driver_string[] = "IBM System i/p Virtual NIC Driver";
 
-MODULE_AUTHOR("Santiago Leon <santi_leon@yahoo.com>");
+MODULE_AUTHOR("Santiago Leon");
 MODULE_DESCRIPTION("IBM System i/p Virtual NIC Driver");
 MODULE_LICENSE("GPL");
 MODULE_VERSION(IBMVNIC_DRIVER_VERSION);
@@ -1468,6 +1468,11 @@ static void ibmvnic_netpoll_controller(struct net_device *dev)
 }
 #endif
 
+static int ibmvnic_change_mtu(struct net_device *netdev, int new_mtu)
+{
+        return -EOPNOTSUPP;
+}
+
 static const struct net_device_ops ibmvnic_netdev_ops = {
         .ndo_open               = ibmvnic_open,
         .ndo_stop               = ibmvnic_close,
@@ -1479,6 +1484,7 @@ static const struct net_device_ops ibmvnic_netdev_ops = {
 #ifdef CONFIG_NET_POLL_CONTROLLER
         .ndo_poll_controller    = ibmvnic_netpoll_controller,
 #endif
+        .ndo_change_mtu         = ibmvnic_change_mtu,
 };
 
 /* ethtool functions */
diff --git a/drivers/net/ethernet/intel/i40e/i40e.h b/drivers/net/ethernet/intel/i40e/i40e.h
index cdde3cc28fb5..44d9610f7a15 100644
--- a/drivers/net/ethernet/intel/i40e/i40e.h
+++ b/drivers/net/ethernet/intel/i40e/i40e.h
@@ -399,6 +399,7 @@ struct i40e_pf {
 #define I40E_FLAG_RX_CSUM_ENABLED               BIT_ULL(1)
 #define I40E_FLAG_MSI_ENABLED                   BIT_ULL(2)
 #define I40E_FLAG_MSIX_ENABLED                  BIT_ULL(3)
+#define I40E_FLAG_HW_ATR_EVICT_ENABLED          BIT_ULL(4)
 #define I40E_FLAG_RSS_ENABLED                   BIT_ULL(6)
 #define I40E_FLAG_VMDQ_ENABLED                  BIT_ULL(7)
 #define I40E_FLAG_IWARP_ENABLED                 BIT_ULL(10)
diff --git a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
index 7a8eb486b9ea..894c8e57ba00 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
@@ -224,7 +224,7 @@ static const struct i40e_priv_flags i40e_gstrings_priv_flags[] = {
         I40E_PRIV_FLAG("LinkPolling", I40E_FLAG_LINK_POLLING_ENABLED, 0),
         I40E_PRIV_FLAG("flow-director-atr", I40E_FLAG_FD_ATR_ENABLED, 0),
         I40E_PRIV_FLAG("veb-stats", I40E_FLAG_VEB_STATS_ENABLED, 0),
-        I40E_PRIV_FLAG("hw-atr-eviction", I40E_FLAG_HW_ATR_EVICT_CAPABLE, 0),
+        I40E_PRIV_FLAG("hw-atr-eviction", I40E_FLAG_HW_ATR_EVICT_ENABLED, 0),
         I40E_PRIV_FLAG("legacy-rx", I40E_FLAG_LEGACY_RX, 0),
 };
 
@@ -4092,7 +4092,7 @@ flags_complete:
 
         /* Only allow ATR evict on hardware that is capable of handling it */
         if (pf->flags & I40E_FLAG_HW_ATR_EVICT_CAPABLE)
-                pf->flags &= ~I40E_FLAG_HW_ATR_EVICT_CAPABLE;
+                pf->flags &= ~I40E_FLAG_HW_ATR_EVICT_ENABLED;
 
         if (changed_flags & I40E_FLAG_TRUE_PROMISC_SUPPORT) {
                 u16 sw_flags = 0, valid_flags = 0;
diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
index d5c9c9e06ff5..a7a4b28b4144 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
@@ -295,7 +295,7 @@ struct i40e_vsi *i40e_find_vsi_from_id(struct i40e_pf *pf, u16 id)
  **/
 void i40e_service_event_schedule(struct i40e_pf *pf)
 {
-        if (!test_bit(__I40E_VSI_DOWN, pf->state) &&
+        if (!test_bit(__I40E_DOWN, pf->state) &&
             !test_bit(__I40E_RESET_RECOVERY_PENDING, pf->state))
                 queue_work(i40e_wq, &pf->service_task);
 }
@@ -3611,7 +3611,7 @@ static irqreturn_t i40e_intr(int irq, void *data)
                  * this is not a performance path and napi_schedule()
                  * can deal with rescheduling.
                  */
-                if (!test_bit(__I40E_VSI_DOWN, pf->state))
+                if (!test_bit(__I40E_DOWN, pf->state))
                         napi_schedule_irqoff(&q_vector->napi);
         }
 
@@ -3687,7 +3687,7 @@ static irqreturn_t i40e_intr(int irq, void *data)
 enable_intr:
         /* re-enable interrupt causes */
         wr32(hw, I40E_PFINT_ICR0_ENA, ena_mask);
-        if (!test_bit(__I40E_VSI_DOWN, pf->state)) {
+        if (!test_bit(__I40E_DOWN, pf->state)) {
                 i40e_service_event_schedule(pf);
                 i40e_irq_dynamic_enable_icr0(pf, false);
         }
@@ -6203,7 +6203,7 @@ static void i40e_fdir_reinit_subtask(struct i40e_pf *pf)
 {
 
         /* if interface is down do nothing */
-        if (test_bit(__I40E_VSI_DOWN, pf->state))
+        if (test_bit(__I40E_DOWN, pf->state))
                 return;
 
         if (test_bit(__I40E_FD_FLUSH_REQUESTED, pf->state))
@@ -6344,7 +6344,7 @@ static void i40e_watchdog_subtask(struct i40e_pf *pf)
         int i;
 
         /* if interface is down do nothing */
-        if (test_bit(__I40E_VSI_DOWN, pf->state) ||
+        if (test_bit(__I40E_DOWN, pf->state) ||
             test_bit(__I40E_CONFIG_BUSY, pf->state))
                 return;
 
@@ -6399,9 +6399,9 @@ static void i40e_reset_subtask(struct i40e_pf *pf)
                 reset_flags |= BIT(__I40E_GLOBAL_RESET_REQUESTED);
                 clear_bit(__I40E_GLOBAL_RESET_REQUESTED, pf->state);
         }
-        if (test_bit(__I40E_VSI_DOWN_REQUESTED, pf->state)) {
-                reset_flags |= BIT(__I40E_VSI_DOWN_REQUESTED);
-                clear_bit(__I40E_VSI_DOWN_REQUESTED, pf->state);
+        if (test_bit(__I40E_DOWN_REQUESTED, pf->state)) {
+                reset_flags |= BIT(__I40E_DOWN_REQUESTED);
+                clear_bit(__I40E_DOWN_REQUESTED, pf->state);
         }
 
         /* If there's a recovery already waiting, it takes
@@ -6415,7 +6415,7 @@ static void i40e_reset_subtask(struct i40e_pf *pf)
 
         /* If we're already down or resetting, just bail */
         if (reset_flags &&
-            !test_bit(__I40E_VSI_DOWN, pf->state) &&
+            !test_bit(__I40E_DOWN, pf->state) &&
             !test_bit(__I40E_CONFIG_BUSY, pf->state)) {
                 rtnl_lock();
                 i40e_do_reset(pf, reset_flags, true);
@@ -7002,7 +7002,7 @@ static void i40e_rebuild(struct i40e_pf *pf, bool reinit, bool lock_acquired)
         u32 val;
         int v;
 
-        if (test_bit(__I40E_VSI_DOWN, pf->state))
+        if (test_bit(__I40E_DOWN, pf->state))
                 goto clear_recovery;
         dev_dbg(&pf->pdev->dev, "Rebuilding internal switch\n");
 
@@ -8821,11 +8821,12 @@ static int i40e_sw_init(struct i40e_pf *pf)
                     (pf->hw.aq.api_min_ver > 4))) {
                 /* Supported in FW API version higher than 1.4 */
                 pf->flags |= I40E_FLAG_GENEVE_OFFLOAD_CAPABLE;
-                pf->flags = I40E_FLAG_HW_ATR_EVICT_CAPABLE;
-        } else {
-                pf->flags = I40E_FLAG_HW_ATR_EVICT_CAPABLE;
         }
 
+        /* Enable HW ATR eviction if possible */
+        if (pf->flags & I40E_FLAG_HW_ATR_EVICT_CAPABLE)
+                pf->flags |= I40E_FLAG_HW_ATR_EVICT_ENABLED;
+
         pf->eeprom_version = 0xDEAD;
         pf->lan_veb = I40E_NO_VEB;
         pf->lan_vsi = I40E_NO_VSI;
@@ -9767,7 +9768,7 @@ int i40e_vsi_release(struct i40e_vsi *vsi)
                 return -ENODEV;
         }
         if (vsi == pf->vsi[pf->lan_vsi] &&
-            !test_bit(__I40E_VSI_DOWN, pf->state)) {
+            !test_bit(__I40E_DOWN, pf->state)) {
                 dev_info(&pf->pdev->dev, "Can't remove PF VSI\n");
                 return -ENODEV;
         }
@@ -11003,7 +11004,7 @@ static int i40e_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         }
         pf->next_vsi = 0;
         pf->pdev = pdev;
-        set_bit(__I40E_VSI_DOWN, pf->state);
+        set_bit(__I40E_DOWN, pf->state);
 
         hw = &pf->hw;
         hw->back = pf;
@@ -11293,7 +11294,7 @@ static int i40e_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
          * before setting up the misc vector or we get a race and the vector
          * ends up disabled forever.
          */
-        clear_bit(__I40E_VSI_DOWN, pf->state);
+        clear_bit(__I40E_DOWN, pf->state);
 
         /* In case of MSIX we are going to setup the misc vector right here
          * to handle admin queue events etc. In case of legacy and MSI
@@ -11448,7 +11449,7 @@ static int i40e_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 
         /* Unwind what we've done if something failed in the setup */
 err_vsis:
-        set_bit(__I40E_VSI_DOWN, pf->state);
+        set_bit(__I40E_DOWN, pf->state);
         i40e_clear_interrupt_scheme(pf);
         kfree(pf->vsi);
 err_switch_setup:
@@ -11500,7 +11501,7 @@ static void i40e_remove(struct pci_dev *pdev)
 
         /* no more scheduling of any task */
         set_bit(__I40E_SUSPENDED, pf->state);
-        set_bit(__I40E_VSI_DOWN, pf->state);
+        set_bit(__I40E_DOWN, pf->state);
         if (pf->service_timer.data)
                 del_timer_sync(&pf->service_timer);
         if (pf->service_task.func)
@@ -11740,7 +11741,7 @@ static void i40e_shutdown(struct pci_dev *pdev)
         struct i40e_hw *hw = &pf->hw;
 
         set_bit(__I40E_SUSPENDED, pf->state);
-        set_bit(__I40E_VSI_DOWN, pf->state);
+        set_bit(__I40E_DOWN, pf->state);
         rtnl_lock();
         i40e_prep_for_reset(pf, true);
         rtnl_unlock();
@@ -11789,7 +11790,7 @@ static int i40e_suspend(struct pci_dev *pdev, pm_message_t state)
         int retval = 0;
 
         set_bit(__I40E_SUSPENDED, pf->state);
-        set_bit(__I40E_VSI_DOWN, pf->state);
+        set_bit(__I40E_DOWN, pf->state);
 
         if (pf->wol_en && (pf->flags & I40E_FLAG_WOL_MC_MAGIC_PKT_WAKE))
                 i40e_enable_mc_magic_wake(pf);
@@ -11841,7 +11842,7 @@ static int i40e_resume(struct pci_dev *pdev)
 
         /* handling the reset will rebuild the device state */
         if (test_and_clear_bit(__I40E_SUSPENDED, pf->state)) {
-                clear_bit(__I40E_VSI_DOWN, pf->state);
+                clear_bit(__I40E_DOWN, pf->state);
                 rtnl_lock();
                 i40e_reset_and_rebuild(pf, false, true);
                 rtnl_unlock();
diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.c b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
index 29321a6167a6..77115c25d96f 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
@@ -1854,7 +1854,8 @@ static struct sk_buff *i40e_build_skb(struct i40e_ring *rx_ring,
 #if (PAGE_SIZE < 8192)
         unsigned int truesize = i40e_rx_pg_size(rx_ring) / 2;
 #else
-        unsigned int truesize = SKB_DATA_ALIGN(size);
+        unsigned int truesize = SKB_DATA_ALIGN(sizeof(struct skb_shared_info)) +
+                                SKB_DATA_ALIGN(I40E_SKB_PAD + size);
 #endif
         struct sk_buff *skb;
 
@@ -2340,7 +2341,7 @@ static void i40e_atr(struct i40e_ring *tx_ring, struct sk_buff *skb,
         /* Due to lack of space, no more new filters can be programmed */
         if (th->syn && (pf->flags & I40E_FLAG_FD_ATR_AUTO_DISABLED))
                 return;
-        if (pf->flags & I40E_FLAG_HW_ATR_EVICT_CAPABLE) {
+        if (pf->flags & I40E_FLAG_HW_ATR_EVICT_ENABLED) {
                 /* HW ATR eviction will take care of removing filters on FIN
                  * and RST packets.
                  */
@@ -2402,7 +2403,7 @@ static void i40e_atr(struct i40e_ring *tx_ring, struct sk_buff *skb,
                         I40E_TXD_FLTR_QW1_CNTINDEX_SHIFT) &
                         I40E_TXD_FLTR_QW1_CNTINDEX_MASK;
 
-        if (pf->flags & I40E_FLAG_HW_ATR_EVICT_CAPABLE)
+        if (pf->flags & I40E_FLAG_HW_ATR_EVICT_ENABLED)
                 dtype_cmd |= I40E_TXD_FLTR_QW1_ATR_MASK;
 
         fdir_desc->qindex_flex_ptype_vsi = cpu_to_le32(flex_ptype);
diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
index 95c23fbaa211..0fb38ca78900 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
@@ -3017,10 +3017,12 @@ int i40e_ndo_set_vf_port_vlan(struct net_device *netdev, int vf_id,
                                            VLAN_VID_MASK));
         }
 
+        spin_unlock_bh(&vsi->mac_filter_hash_lock);
         if (vlan_id || qos)
                 ret = i40e_vsi_add_pvid(vsi, vlanprio);
         else
                 i40e_vsi_remove_pvid(vsi);
+        spin_lock_bh(&vsi->mac_filter_hash_lock);
 
         if (vlan_id) {
                 dev_info(&pf->pdev->dev, "Setting VLAN %d, QOS 0x%x on VF %d\n",
diff --git a/drivers/net/ethernet/intel/i40evf/i40e_txrx.c b/drivers/net/ethernet/intel/i40evf/i40e_txrx.c
index dfe241a12ad0..12b02e530503 100644
--- a/drivers/net/ethernet/intel/i40evf/i40e_txrx.c
+++ b/drivers/net/ethernet/intel/i40evf/i40e_txrx.c
@@ -1190,7 +1190,8 @@ static struct sk_buff *i40e_build_skb(struct i40e_ring *rx_ring,
 #if (PAGE_SIZE < 8192)
         unsigned int truesize = i40e_rx_pg_size(rx_ring) / 2;
 #else
-        unsigned int truesize = SKB_DATA_ALIGN(size);
+        unsigned int truesize = SKB_DATA_ALIGN(sizeof(struct skb_shared_info)) +
+                                SKB_DATA_ALIGN(I40E_SKB_PAD + size);
 #endif
         struct sk_buff *skb;
 
diff --git a/drivers/net/ethernet/marvell/mvpp2.c b/drivers/net/ethernet/marvell/mvpp2.c
index 9b875d776b29..33c901622ed5 100644
--- a/drivers/net/ethernet/marvell/mvpp2.c
+++ b/drivers/net/ethernet/marvell/mvpp2.c
@@ -3719,7 +3719,7 @@ static void mvpp2_bm_bufs_get_addrs(struct device *dev, struct mvpp2 *priv,
                                     dma_addr_t *dma_addr,
                                     phys_addr_t *phys_addr)
 {
-        int cpu = smp_processor_id();
+        int cpu = get_cpu();
 
         *dma_addr = mvpp2_percpu_read(priv, cpu,
                                       MVPP2_BM_PHY_ALLOC_REG(bm_pool->id));
@@ -3740,6 +3740,8 @@ static void mvpp2_bm_bufs_get_addrs(struct device *dev, struct mvpp2 *priv,
                 if (sizeof(phys_addr_t) == 8)
                         *phys_addr |= (u64)phys_addr_highbits << 32;
         }
+
+        put_cpu();
 }
 
 /* Free all buffers from the pool */
@@ -3920,18 +3922,12 @@ static inline u32 mvpp2_bm_cookie_pool_set(u32 cookie, int pool)
         return bm;
 }
 
-/* Get pool number from a BM cookie */
-static inline int mvpp2_bm_cookie_pool_get(unsigned long cookie)
-{
-        return (cookie >> MVPP2_BM_COOKIE_POOL_OFFS) & 0xFF;
-}
-
 /* Release buffer to BM */
 static inline void mvpp2_bm_pool_put(struct mvpp2_port *port, int pool,
                                      dma_addr_t buf_dma_addr,
                                      phys_addr_t buf_phys_addr)
 {
-        int cpu = smp_processor_id();
+        int cpu = get_cpu();
 
         if (port->priv->hw_version == MVPP22) {
                 u32 val = 0;
@@ -3958,15 +3954,15 @@ static inline void mvpp2_bm_pool_put(struct mvpp2_port *port, int pool,
                            MVPP2_BM_VIRT_RLS_REG, buf_phys_addr);
         mvpp2_percpu_write(port->priv, cpu,
                            MVPP2_BM_PHY_RLS_REG(pool), buf_dma_addr);
+
+        put_cpu();
 }
 
 /* Refill BM pool */
-static void mvpp2_pool_refill(struct mvpp2_port *port, u32 bm,
+static void mvpp2_pool_refill(struct mvpp2_port *port, int pool,
                               dma_addr_t dma_addr,
                               phys_addr_t phys_addr)
 {
-        int pool = mvpp2_bm_cookie_pool_get(bm);
-
         mvpp2_bm_pool_put(port, pool, dma_addr, phys_addr);
 }
 
@@ -4186,8 +4182,6 @@ static void mvpp22_port_mii_set(struct mvpp2_port *port)
 {
         u32 val;
 
-        return;
-
         /* Only GOP port 0 has an XLG MAC */
         if (port->gop_id == 0) {
                 val = readl(port->base + MVPP22_XLG_CTRL3_REG);
@@ -4515,21 +4509,6 @@ static void mvpp2_rxq_offset_set(struct mvpp2_port *port,
         mvpp2_write(port->priv, MVPP2_RXQ_CONFIG_REG(prxq), val);
 }
 
-/* Obtain BM cookie information from descriptor */
-static u32 mvpp2_bm_cookie_build(struct mvpp2_port *port,
-                                 struct mvpp2_rx_desc *rx_desc)
-{
-        int cpu = smp_processor_id();
-        int pool;
-
-        pool = (mvpp2_rxdesc_status_get(port, rx_desc) &
-                MVPP2_RXD_BM_POOL_ID_MASK) >>
-                MVPP2_RXD_BM_POOL_ID_OFFS;
-
-        return ((pool & 0xFF) << MVPP2_BM_COOKIE_POOL_OFFS) |
-               ((cpu & 0xFF) << MVPP2_BM_COOKIE_CPU_OFFS);
-}
-
 /* Tx descriptors helper methods */
 
 /* Get pointer to next Tx descriptor to be processed (send) by HW */
@@ -4757,7 +4736,7 @@ static void mvpp2_txp_max_tx_size_set(struct mvpp2_port *port)
 static void mvpp2_rx_pkts_coal_set(struct mvpp2_port *port,
                                    struct mvpp2_rx_queue *rxq)
 {
-        int cpu = smp_processor_id();
+        int cpu = get_cpu();
 
         if (rxq->pkts_coal > MVPP2_OCCUPIED_THRESH_MASK)
                 rxq->pkts_coal = MVPP2_OCCUPIED_THRESH_MASK;
@@ -4765,6 +4744,8 @@ static void mvpp2_rx_pkts_coal_set(struct mvpp2_port *port,
         mvpp2_percpu_write(port->priv, cpu, MVPP2_RXQ_NUM_REG, rxq->id);
         mvpp2_percpu_write(port->priv, cpu, MVPP2_RXQ_THRESH_REG,
                            rxq->pkts_coal);
+
+        put_cpu();
 }
 
 static u32 mvpp2_usec_to_cycles(u32 usec, unsigned long clk_hz)
@@ -4945,7 +4926,7 @@ static int mvpp2_rxq_init(struct mvpp2_port *port,
         mvpp2_write(port->priv, MVPP2_RXQ_STATUS_REG(rxq->id), 0);
 
         /* Set Rx descriptors queue starting address - indirect access */
-        cpu = smp_processor_id();
+        cpu = get_cpu();
         mvpp2_percpu_write(port->priv, cpu, MVPP2_RXQ_NUM_REG, rxq->id);
         if (port->priv->hw_version == MVPP21)
                 rxq_dma = rxq->descs_dma;
@@ -4954,6 +4935,7 @@ static int mvpp2_rxq_init(struct mvpp2_port *port,
         mvpp2_percpu_write(port->priv, cpu, MVPP2_RXQ_DESC_ADDR_REG, rxq_dma);
         mvpp2_percpu_write(port->priv, cpu, MVPP2_RXQ_DESC_SIZE_REG, rxq->size);
         mvpp2_percpu_write(port->priv, cpu, MVPP2_RXQ_INDEX_REG, 0);
+        put_cpu();
 
         /* Set Offset */
         mvpp2_rxq_offset_set(port, rxq->id, NET_SKB_PAD);
@@ -4980,9 +4962,13 @@ static void mvpp2_rxq_drop_pkts(struct mvpp2_port *port,
 
         for (i = 0; i < rx_received; i++) {
                 struct mvpp2_rx_desc *rx_desc = mvpp2_rxq_next_desc_get(rxq);
-                u32 bm = mvpp2_bm_cookie_build(port, rx_desc);
+                u32 status = mvpp2_rxdesc_status_get(port, rx_desc);
+                int pool;
+
+                pool = (status & MVPP2_RXD_BM_POOL_ID_MASK) >>
+                        MVPP2_RXD_BM_POOL_ID_OFFS;
 
-                mvpp2_pool_refill(port, bm,
+                mvpp2_pool_refill(port, pool,
                                   mvpp2_rxdesc_dma_addr_get(port, rx_desc),
                                   mvpp2_rxdesc_cookie_get(port, rx_desc));
         }
@@ -5012,10 +4998,11 @@ static void mvpp2_rxq_deinit(struct mvpp2_port *port,
          * free descriptor number
          */
         mvpp2_write(port->priv, MVPP2_RXQ_STATUS_REG(rxq->id), 0);
-        cpu = smp_processor_id();
+        cpu = get_cpu();
         mvpp2_percpu_write(port->priv, cpu, MVPP2_RXQ_NUM_REG, rxq->id);
         mvpp2_percpu_write(port->priv, cpu, MVPP2_RXQ_DESC_ADDR_REG, 0);
         mvpp2_percpu_write(port->priv, cpu, MVPP2_RXQ_DESC_SIZE_REG, 0);
+        put_cpu();
 }
 
 /* Create and initialize a Tx queue */
@@ -5038,7 +5025,7 @@ static int mvpp2_txq_init(struct mvpp2_port *port,
         txq->last_desc = txq->size - 1;
 
         /* Set Tx descriptors queue starting address - indirect access */
-        cpu = smp_processor_id();
+        cpu = get_cpu();
         mvpp2_percpu_write(port->priv, cpu, MVPP2_TXQ_NUM_REG, txq->id);
         mvpp2_percpu_write(port->priv, cpu, MVPP2_TXQ_DESC_ADDR_REG,
                            txq->descs_dma);
@@ -5063,6 +5050,7 @@ static int mvpp2_txq_init(struct mvpp2_port *port,
         mvpp2_percpu_write(port->priv, cpu, MVPP2_TXQ_PREF_BUF_REG,
                            MVPP2_PREF_BUF_PTR(desc) | MVPP2_PREF_BUF_SIZE_16 |
                            MVPP2_PREF_BUF_THRESH(desc_per_txq / 2));
+        put_cpu();
 
         /* WRR / EJP configuration - indirect access */
         tx_port_num = mvpp2_egress_port(port);
@@ -5133,10 +5121,11 @@ static void mvpp2_txq_deinit(struct mvpp2_port *port,
         mvpp2_write(port->priv, MVPP2_TXQ_SCHED_TOKEN_CNTR_REG(txq->id), 0);
 
         /* Set Tx descriptors queue starting address and size */
-        cpu = smp_processor_id();
+        cpu = get_cpu();
         mvpp2_percpu_write(port->priv, cpu, MVPP2_TXQ_NUM_REG, txq->id);
         mvpp2_percpu_write(port->priv, cpu, MVPP2_TXQ_DESC_ADDR_REG, 0);
         mvpp2_percpu_write(port->priv, cpu, MVPP2_TXQ_DESC_SIZE_REG, 0);
+        put_cpu();
 }
 
 /* Cleanup Tx ports */
@@ -5146,7 +5135,7 @@ static void mvpp2_txq_clean(struct mvpp2_port *port, struct mvpp2_tx_queue *txq)
         int delay, pending, cpu;
         u32 val;
 
-        cpu = smp_processor_id();
+        cpu = get_cpu();
         mvpp2_percpu_write(port->priv, cpu, MVPP2_TXQ_NUM_REG, txq->id);
         val = mvpp2_percpu_read(port->priv, cpu, MVPP2_TXQ_PREF_BUF_REG);
         val |= MVPP2_TXQ_DRAIN_EN_MASK;
@@ -5173,6 +5162,7 @@ static void mvpp2_txq_clean(struct mvpp2_port *port, struct mvpp2_tx_queue *txq)
 
         val &= ~MVPP2_TXQ_DRAIN_EN_MASK;
         mvpp2_percpu_write(port->priv, cpu, MVPP2_TXQ_PREF_BUF_REG, val);
+        put_cpu();
 
         for_each_present_cpu(cpu) {
                 txq_pcpu = per_cpu_ptr(txq->pcpu, cpu);
@@ -5420,7 +5410,7 @@ static void mvpp2_rx_csum(struct mvpp2_port *port, u32 status,
 
 /* Reuse skb if possible, or allocate a new skb and add it to BM pool */
 static int mvpp2_rx_refill(struct mvpp2_port *port,
-                           struct mvpp2_bm_pool *bm_pool, u32 bm)
+                           struct mvpp2_bm_pool *bm_pool, int pool)
 {
         dma_addr_t dma_addr;
         phys_addr_t phys_addr;
@@ -5432,7 +5422,7 @@ static int mvpp2_rx_refill(struct mvpp2_port *port,
         if (!buf)
                 return -ENOMEM;
 
-        mvpp2_pool_refill(port, bm, dma_addr, phys_addr);
+        mvpp2_pool_refill(port, pool, dma_addr, phys_addr);
 
         return 0;
 }
@@ -5490,7 +5480,7 @@ static int mvpp2_rx(struct mvpp2_port *port, int rx_todo,
                 unsigned int frag_size;
                 dma_addr_t dma_addr;
                 phys_addr_t phys_addr;
-                u32 bm, rx_status;
+                u32 rx_status;
                 int pool, rx_bytes, err;
                 void *data;
 
@@ -5502,8 +5492,8 @@ static int mvpp2_rx(struct mvpp2_port *port, int rx_todo,
                 phys_addr = mvpp2_rxdesc_cookie_get(port, rx_desc);
                 data = (void *)phys_to_virt(phys_addr);
 
-                bm = mvpp2_bm_cookie_build(port, rx_desc);
-                pool = mvpp2_bm_cookie_pool_get(bm);
+                pool = (rx_status & MVPP2_RXD_BM_POOL_ID_MASK) >>
+                        MVPP2_RXD_BM_POOL_ID_OFFS;
                 bm_pool = &port->priv->bm_pools[pool];
 
                 /* In case of an error, release the requested buffer pointer
@@ -5516,7 +5506,7 @@ err_drop_frame:
                         dev->stats.rx_errors++;
                         mvpp2_rx_error(port, rx_desc);
                         /* Return the buffer to the pool */
-                        mvpp2_pool_refill(port, bm, dma_addr, phys_addr);
+                        mvpp2_pool_refill(port, pool, dma_addr, phys_addr);
                         continue;
                 }
 
@@ -5531,7 +5521,7 @@ err_drop_frame:
                         goto err_drop_frame;
                 }
 
-                err = mvpp2_rx_refill(port, bm_pool, bm);
+                err = mvpp2_rx_refill(port, bm_pool, pool);
                 if (err) {
                         netdev_err(port->dev, "failed to refill BM pools\n");
                         goto err_drop_frame;
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
index ae5fdc2df654..ffbcb27c05e5 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
@@ -1562,11 +1562,6 @@ static int mlx4_en_flow_replace(struct net_device *dev,
                 qpn = priv->drop_qp.qpn;
         else if (cmd->fs.ring_cookie & EN_ETHTOOL_QP_ATTACH) {
                 qpn = cmd->fs.ring_cookie & (EN_ETHTOOL_QP_ATTACH - 1);
-                if (qpn < priv->rss_map.base_qpn ||
-                    qpn >= priv->rss_map.base_qpn + priv->rx_ring_num) {
-                        en_warn(priv, "rxnfc: QP (0x%x) doesn't exist\n", qpn);
-                        return -EINVAL;
-                }
         } else {
                 if (cmd->fs.ring_cookie >= priv->rx_ring_num) {
                         en_warn(priv, "rxnfc: RX ring (%llu) doesn't exist\n",
diff --git a/drivers/net/ethernet/mellanox/mlx4/mcg.c b/drivers/net/ethernet/mellanox/mlx4/mcg.c
index 1a670b681555..0710b3677464 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mcg.c
+++ b/drivers/net/ethernet/mellanox/mlx4/mcg.c
@@ -35,6 +35,7 @@
 #include <linux/etherdevice.h>
 
 #include <linux/mlx4/cmd.h>
+#include <linux/mlx4/qp.h>
 #include <linux/export.h>
 
 #include "mlx4.h"
@@ -985,16 +986,21 @@ int mlx4_flow_attach(struct mlx4_dev *dev,
         if (IS_ERR(mailbox))
                 return PTR_ERR(mailbox);
 
+        if (!mlx4_qp_lookup(dev, rule->qpn)) {
+                mlx4_err_rule(dev, "QP doesn't exist\n", rule);
+                ret = -EINVAL;
+                goto out;
+        }
+
         trans_rule_ctrl_to_hw(rule, mailbox->buf);
 
         size += sizeof(struct mlx4_net_trans_rule_hw_ctrl);
 
         list_for_each_entry(cur, &rule->list, list) {
                 ret = parse_trans_rule(dev, cur, mailbox->buf + size);
-                if (ret < 0) {
-                        mlx4_free_cmd_mailbox(dev, mailbox);
-                        return ret;
-                }
+                if (ret < 0)
+                        goto out;
+
                 size += ret;
         }
 
@@ -1021,6 +1027,7 @@ int mlx4_flow_attach(struct mlx4_dev *dev,
                 }
         }
 
+out:
         mlx4_free_cmd_mailbox(dev, mailbox);
 
         return ret;
diff --git a/drivers/net/ethernet/mellanox/mlx4/qp.c b/drivers/net/ethernet/mellanox/mlx4/qp.c
index 2d6abd4662b1..5a310d313e94 100644
--- a/drivers/net/ethernet/mellanox/mlx4/qp.c
+++ b/drivers/net/ethernet/mellanox/mlx4/qp.c
@@ -384,6 +384,19 @@ static void mlx4_qp_free_icm(struct mlx4_dev *dev, int qpn)
                 __mlx4_qp_free_icm(dev, qpn);
 }
 
+struct mlx4_qp *mlx4_qp_lookup(struct mlx4_dev *dev, u32 qpn)
+{
+        struct mlx4_qp_table *qp_table = &mlx4_priv(dev)->qp_table;
+        struct mlx4_qp *qp;
+
+        spin_lock(&qp_table->lock);
+
+        qp = __mlx4_qp_lookup(dev, qpn);
+
+        spin_unlock(&qp_table->lock);
+        return qp;
+}
+
 int mlx4_qp_alloc(struct mlx4_dev *dev, int qpn, struct mlx4_qp *qp, gfp_t gfp)
 {
         struct mlx4_priv *priv = mlx4_priv(dev);
@@ -471,6 +484,12 @@ int mlx4_update_qp(struct mlx4_dev *dev, u32 qpn,
         }
 
         if (attr & MLX4_UPDATE_QP_QOS_VPORT) {
+                if (!(dev->caps.flags2 & MLX4_DEV_CAP_FLAG2_QOS_VPP)) {
+                        mlx4_warn(dev, "Granular QoS per VF is not enabled\n");
+                        err = -EOPNOTSUPP;
+                        goto out;
+                }
+
                 qp_mask |= 1ULL << MLX4_UPD_QP_MASK_QOS_VPP;
                 cmd->qp_context.qos_vport = params->qos_vport;
         }
diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
index 07516545474f..812783865205 100644
--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
+++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
@@ -5255,6 +5255,13 @@ void mlx4_delete_all_resources_for_slave(struct mlx4_dev *dev, int slave)
         mutex_unlock(&priv->mfunc.master.res_tracker.slave_list[slave].mutex);
 }
 
+static void update_qos_vpp(struct mlx4_update_qp_context *ctx,
+                           struct mlx4_vf_immed_vlan_work *work)
+{
+        ctx->qp_mask |= cpu_to_be64(1ULL << MLX4_UPD_QP_MASK_QOS_VPP);
+        ctx->qp_context.qos_vport = work->qos_vport;
+}
+
 void mlx4_vf_immed_vlan_work_handler(struct work_struct *_work)
 {
         struct mlx4_vf_immed_vlan_work *work =
@@ -5369,11 +5376,10 @@ void mlx4_vf_immed_vlan_work_handler(struct work_struct *_work)
                                         qp->sched_queue & 0xC7;
                                 upd_context->qp_context.pri_path.sched_queue |=
                                         ((work->qos & 0x7) << 3);
-                                upd_context->qp_mask |=
-                                        cpu_to_be64(1ULL <<
-                                                    MLX4_UPD_QP_MASK_QOS_VPP);
-                                upd_context->qp_context.qos_vport =
-                                        work->qos_vport;
+
+                                if (dev->caps.flags2 &
+                                    MLX4_DEV_CAP_FLAG2_QOS_VPP)
+                                        update_qos_vpp(upd_context, work);
                         }
 
                         err = mlx4_cmd(dev, mailbox->dma,
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h
index 2fd044b23875..944fc1742464 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h
@@ -458,13 +458,15 @@ struct mlx5e_mpw_info {
 
 struct mlx5e_rx_am_stats {
         int ppms; /* packets per msec */
+        int bpms; /* bytes per msec */
         int epms; /* events per msec */
 };
 
 struct mlx5e_rx_am_sample {
-        ktime_t         time;
-        unsigned int    pkt_ctr;
-        u16             event_ctr;
+        ktime_t time;
+        u32     pkt_ctr;
+        u32     byte_ctr;
+        u16     event_ctr;
 };
 
 struct mlx5e_rx_am { /* Adaptive Moderation */
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
index 8209affa75c3..16486dff1493 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
@@ -1242,11 +1242,11 @@ static int mlx5e_get_ts_info(struct net_device *dev,
                                  SOF_TIMESTAMPING_RX_HARDWARE |
                                  SOF_TIMESTAMPING_RAW_HARDWARE;
 
-        info->tx_types = (BIT(1) << HWTSTAMP_TX_OFF) |
-                         (BIT(1) << HWTSTAMP_TX_ON);
+        info->tx_types = BIT(HWTSTAMP_TX_OFF) |
+                         BIT(HWTSTAMP_TX_ON);
 
-        info->rx_filters = (BIT(1) << HWTSTAMP_FILTER_NONE) |
-                           (BIT(1) << HWTSTAMP_FILTER_ALL);
+        info->rx_filters = BIT(HWTSTAMP_FILTER_NONE) |
+                           BIT(HWTSTAMP_FILTER_ALL);
 
         return 0;
 }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index 41cd22a223dc..277f4de30375 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -4241,7 +4241,8 @@ struct net_device *mlx5e_create_netdev(struct mlx5_core_dev *mdev,
         return netdev;
 
 err_cleanup_nic:
-        profile->cleanup(priv);
+        if (profile->cleanup)
+                profile->cleanup(priv);
         free_netdev(netdev);
 
         return NULL;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
index 79462c0368a0..46984a52a94b 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
@@ -791,6 +791,8 @@ static void mlx5e_build_rep_params(struct mlx5_core_dev *mdev,
         params->tx_max_inline         = mlx5e_get_max_inline_cap(mdev);
         params->num_tc                = 1;
         params->lro_wqe_sz            = MLX5E_PARAMS_DEFAULT_LRO_WQE_SZ;
+
+        mlx5_query_min_inline(mdev, &params->tx_min_inline_mode);
 }
 
 static void mlx5e_build_rep_netdev(struct net_device *netdev)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx_am.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx_am.c
index 02dd3a95ed8f..acf32fe952cd 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx_am.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx_am.c
@@ -183,28 +183,27 @@ static void mlx5e_am_exit_parking(struct mlx5e_rx_am *am)
         mlx5e_am_step(am);
 }
 
+#define IS_SIGNIFICANT_DIFF(val, ref) \
+        (((100 * abs((val) - (ref))) / (ref)) > 10) /* more than 10% difference */
+
 static int mlx5e_am_stats_compare(struct mlx5e_rx_am_stats *curr,
                                   struct mlx5e_rx_am_stats *prev)
 {
-        int diff;
-
-        if (!prev->ppms)
-                return curr->ppms ? MLX5E_AM_STATS_BETTER :
+        if (!prev->bpms)
+                return curr->bpms ? MLX5E_AM_STATS_BETTER :
                                     MLX5E_AM_STATS_SAME;
 
-        diff = curr->ppms - prev->ppms;
-        if (((100 * abs(diff)) / prev->ppms) > 10) /* more than 10% diff */
-                return (diff > 0) ? MLX5E_AM_STATS_BETTER :
-                                    MLX5E_AM_STATS_WORSE;
+        if (IS_SIGNIFICANT_DIFF(curr->bpms, prev->bpms))
+                return (curr->bpms > prev->bpms) ? MLX5E_AM_STATS_BETTER :
+                                                   MLX5E_AM_STATS_WORSE;
 
-        if (!prev->epms)
-                return curr->epms ? MLX5E_AM_STATS_WORSE :
-                                    MLX5E_AM_STATS_SAME;
+        if (IS_SIGNIFICANT_DIFF(curr->ppms, prev->ppms))
+                return (curr->ppms > prev->ppms) ? MLX5E_AM_STATS_BETTER :
+                                                   MLX5E_AM_STATS_WORSE;
 
-        diff = curr->epms - prev->epms;
-        if (((100 * abs(diff)) / prev->epms) > 10) /* more than 10% diff */
-                return (diff < 0) ? MLX5E_AM_STATS_BETTER :
-                                    MLX5E_AM_STATS_WORSE;
+        if (IS_SIGNIFICANT_DIFF(curr->epms, prev->epms))
+                return (curr->epms < prev->epms) ? MLX5E_AM_STATS_BETTER :
+                                                   MLX5E_AM_STATS_WORSE;
 
         return MLX5E_AM_STATS_SAME;
 }
@@ -266,10 +265,13 @@ static void mlx5e_am_sample(struct mlx5e_rq *rq,
 {
         s->time      = ktime_get();
         s->pkt_ctr   = rq->stats.packets;
+        s->byte_ctr  = rq->stats.bytes;
         s->event_ctr = rq->cq.event_ctr;
 }
 
 #define MLX5E_AM_NEVENTS 64
+#define BITS_PER_TYPE(type) (sizeof(type) * BITS_PER_BYTE)
+#define BIT_GAP(bits, end, start) ((((end) - (start)) + BIT_ULL(bits)) & (BIT_ULL(bits) - 1))
 
 static void mlx5e_am_calc_stats(struct mlx5e_rx_am_sample *start,
                                 struct mlx5e_rx_am_sample *end,
@@ -277,13 +279,17 @@ static void mlx5e_am_calc_stats(struct mlx5e_rx_am_sample *start,
 {
         /* u32 holds up to 71 minutes, should be enough */
         u32 delta_us = ktime_us_delta(end->time, start->time);
-        unsigned int npkts = end->pkt_ctr - start->pkt_ctr;
+        u32 npkts = BIT_GAP(BITS_PER_TYPE(u32), end->pkt_ctr, start->pkt_ctr);
+        u32 nbytes = BIT_GAP(BITS_PER_TYPE(u32), end->byte_ctr,
+                             start->byte_ctr);
 
         if (!delta_us)
                 return;
 
-        curr_stats->ppms =            (npkts * USEC_PER_MSEC) / delta_us;
-        curr_stats->epms = (MLX5E_AM_NEVENTS * USEC_PER_MSEC) / delta_us;
+        curr_stats->ppms = DIV_ROUND_UP(npkts * USEC_PER_MSEC, delta_us);
+        curr_stats->bpms = DIV_ROUND_UP(nbytes * USEC_PER_MSEC, delta_us);
+        curr_stats->epms = DIV_ROUND_UP(MLX5E_AM_NEVENTS * USEC_PER_MSEC,
+                                        delta_us);
 }
 
 void mlx5e_rx_am_work(struct work_struct *work)
@@ -308,7 +314,8 @@ void mlx5e_rx_am(struct mlx5e_rq *rq)
 
         switch (am->state) {
         case MLX5E_AM_MEASURE_IN_PROGRESS:
-                nevents = rq->cq.event_ctr - am->start_sample.event_ctr;
+                nevents = BIT_GAP(BITS_PER_TYPE(u16), rq->cq.event_ctr,
+                                  am->start_sample.event_ctr);
                 if (nevents < MLX5E_AM_NEVENTS)
                         break;
                 mlx5e_am_sample(rq, &end_sample);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h
index 53e4992d6511..f81c3aa60b46 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h
@@ -417,20 +417,13 @@ struct mlx5e_stats {
 };
 
 static const struct counter_desc mlx5e_pme_status_desc[] = {
-        { "module_plug", 0 },
         { "module_unplug", 8 },
 };
 
 static const struct counter_desc mlx5e_pme_error_desc[] = {
-        { "module_pwr_budget_exd", 0 },  /* power budget exceed */
-        { "module_long_range", 8 },      /* long range for non MLNX cable */
-        { "module_bus_stuck", 16 },      /* bus stuck (I2C or data shorted) */
-        { "module_no_eeprom", 24 },      /* no eeprom/retry time out */
-        { "module_enforce_part", 32 },   /* enforce part number list */
-        { "module_unknown_id", 40 },     /* unknown identifier */
-        { "module_high_temp", 48 },      /* high temperature */
+        { "module_bus_stuck", 16 },       /* bus stuck (I2C or data shorted) */
+        { "module_high_temp", 48 },       /* high temperature */
         { "module_bad_shorted", 56 },    /* bad or shorted cable/module */
-        { "module_unknown_status", 64 },
 };
 
 #endif /* __MLX5_EN_STATS_H__ */
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
index ec63158ab643..9df9fc0d26f5 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
@@ -895,7 +895,6 @@ static struct mlx5_fields fields[] = {
         {MLX5_ACTION_IN_FIELD_OUT_SMAC_15_0,  2, offsetof(struct pedit_headers, eth.h_source[4])},
         {MLX5_ACTION_IN_FIELD_OUT_ETHERTYPE,  2, offsetof(struct pedit_headers, eth.h_proto)},
 
-        {MLX5_ACTION_IN_FIELD_OUT_IP_DSCP, 1, offsetof(struct pedit_headers, ip4.tos)},
         {MLX5_ACTION_IN_FIELD_OUT_IP_TTL,  1, offsetof(struct pedit_headers, ip4.ttl)},
         {MLX5_ACTION_IN_FIELD_OUT_SIPV4,   4, offsetof(struct pedit_headers, ip4.saddr)},
         {MLX5_ACTION_IN_FIELD_OUT_DIPV4,   4, offsetof(struct pedit_headers, ip4.daddr)},
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
index f991f669047e..a53e982a6863 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
@@ -906,21 +906,34 @@ static int esw_inline_mode_to_devlink(u8 mlx5_mode, u8 *mode)
         return 0;
 }
 
-int mlx5_devlink_eswitch_mode_set(struct devlink *devlink, u16 mode)
+static int mlx5_devlink_eswitch_check(struct devlink *devlink)
 {
-        struct mlx5_core_dev *dev;
-        u16 cur_mlx5_mode, mlx5_mode = 0;
+        struct mlx5_core_dev *dev = devlink_priv(devlink);
 
-        dev = devlink_priv(devlink);
+        if (MLX5_CAP_GEN(dev, port_type) != MLX5_CAP_PORT_TYPE_ETH)
+                return -EOPNOTSUPP;
 
         if (!MLX5_CAP_GEN(dev, vport_group_manager))
                 return -EOPNOTSUPP;
 
-        cur_mlx5_mode = dev->priv.eswitch->mode;
-
-        if (cur_mlx5_mode == SRIOV_NONE)
+        if (dev->priv.eswitch->mode == SRIOV_NONE)
                 return -EOPNOTSUPP;
 
+        return 0;
+}
+
+int mlx5_devlink_eswitch_mode_set(struct devlink *devlink, u16 mode)
+{
+        struct mlx5_core_dev *dev = devlink_priv(devlink);
+        u16 cur_mlx5_mode, mlx5_mode = 0;
+        int err;
+
+        err = mlx5_devlink_eswitch_check(devlink);
+        if (err)
+                return err;
+
+        cur_mlx5_mode = dev->priv.eswitch->mode;
+
         if (esw_mode_from_devlink(mode, &mlx5_mode))
                 return -EINVAL;
 
@@ -937,15 +950,12 @@ int mlx5_devlink_eswitch_mode_set(struct devlink *devlink, u16 mode)
 
 int mlx5_devlink_eswitch_mode_get(struct devlink *devlink, u16 *mode)
 {
-        struct mlx5_core_dev *dev;
-
-        dev = devlink_priv(devlink);
-
-        if (!MLX5_CAP_GEN(dev, vport_group_manager))
-                return -EOPNOTSUPP;
+        struct mlx5_core_dev *dev = devlink_priv(devlink);
+        int err;
 
-        if (dev->priv.eswitch->mode == SRIOV_NONE)
-                return -EOPNOTSUPP;
+        err = mlx5_devlink_eswitch_check(devlink);
+        if (err)
+                return err;
 
         return esw_mode_to_devlink(dev->priv.eswitch->mode, mode);
 }
@@ -954,15 +964,12 @@ int mlx5_devlink_eswitch_inline_mode_set(struct devlink *devlink, u8 mode)
 {
         struct mlx5_core_dev *dev = devlink_priv(devlink);
         struct mlx5_eswitch *esw = dev->priv.eswitch;
-        int num_vports = esw->enabled_vports;
         int err, vport;
         u8 mlx5_mode;
 
-        if (!MLX5_CAP_GEN(dev, vport_group_manager))
-                return -EOPNOTSUPP;
-
-        if (esw->mode == SRIOV_NONE)
-                return -EOPNOTSUPP;
+        err = mlx5_devlink_eswitch_check(devlink);
+        if (err)
+                return err;
 
         switch (MLX5_CAP_ETH(dev, wqe_inline_mode)) {
         case MLX5_CAP_INLINE_MODE_NOT_REQUIRED:
@@ -985,7 +992,7 @@ int mlx5_devlink_eswitch_inline_mode_set(struct devlink *devlink, u8 mode)
         if (err)
                 goto out;
 
-        for (vport = 1; vport < num_vports; vport++) {
+        for (vport = 1; vport < esw->enabled_vports; vport++) {
                 err = mlx5_modify_nic_vport_min_inline(dev, vport, mlx5_mode);
                 if (err) {
                         esw_warn(dev, "Failed to set min inline on vport %d\n",
@@ -1010,12 +1017,11 @@ int mlx5_devlink_eswitch_inline_mode_get(struct devlink *devlink, u8 *mode)
 {
         struct mlx5_core_dev *dev = devlink_priv(devlink);
         struct mlx5_eswitch *esw = dev->priv.eswitch;
+        int err;
 
-        if (!MLX5_CAP_GEN(dev, vport_group_manager))
-                return -EOPNOTSUPP;
-
-        if (esw->mode == SRIOV_NONE)
-                return -EOPNOTSUPP;
+        err = mlx5_devlink_eswitch_check(devlink);
+        if (err)
+                return err;
 
         return esw_inline_mode_to_devlink(esw->offloads.inline_mode, mode);
 }
@@ -1062,11 +1068,9 @@ int mlx5_devlink_eswitch_encap_mode_set(struct devlink *devlink, u8 encap)
         struct mlx5_eswitch *esw = dev->priv.eswitch;
         int err;
 
-        if (!MLX5_CAP_GEN(dev, vport_group_manager))
-                return -EOPNOTSUPP;
-
-        if (esw->mode == SRIOV_NONE)
-                return -EOPNOTSUPP;
+        err = mlx5_devlink_eswitch_check(devlink);
+        if (err)
+                return err;
 
         if (encap != DEVLINK_ESWITCH_ENCAP_MODE_NONE &&
             (!MLX5_CAP_ESW_FLOWTABLE_FDB(dev, encap) ||
@@ -1105,12 +1109,11 @@ int mlx5_devlink_eswitch_encap_mode_get(struct devlink *devlink, u8 *encap)
 {
         struct mlx5_core_dev *dev = devlink_priv(devlink);
         struct mlx5_eswitch *esw = dev->priv.eswitch;
+        int err;
 
-        if (!MLX5_CAP_GEN(dev, vport_group_manager))
-                return -EOPNOTSUPP;
-
-        if (esw->mode == SRIOV_NONE)
-                return -EOPNOTSUPP;
+        err = mlx5_devlink_eswitch_check(devlink);
+        if (err)
+                return err;
 
         *encap = esw->offloads.encap;
         return 0;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
index 0e487e8ca634..8f5125ccd8d4 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
@@ -862,7 +862,7 @@ struct mlx5_flow_table *mlx5_create_vport_flow_table(struct mlx5_flow_namespace
         ft_attr.level   = level;
         ft_attr.prio    = prio;
 
-        return __mlx5_create_flow_table(ns, &ft_attr, FS_FT_OP_MOD_NORMAL, 0);
+        return __mlx5_create_flow_table(ns, &ft_attr, FS_FT_OP_MOD_NORMAL, vport);
 }
 
 struct mlx5_flow_table*
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/health.c b/drivers/net/ethernet/mellanox/mlx5/core/health.c
index 44f59b1d6f0f..f27f84ffbc85 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/health.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/health.c
@@ -275,10 +275,8 @@ static void poll_health(unsigned long data)
         struct mlx5_core_health *health = &dev->priv.health;
         u32 count;
 
-        if (dev->state == MLX5_DEVICE_STATE_INTERNAL_ERROR) {
-                mod_timer(&health->timer, get_next_poll_jiffies());
-                return;
-        }
+        if (dev->state == MLX5_DEVICE_STATE_INTERNAL_ERROR)
+                goto out;
 
         count = ioread32be(health->health_counter);
         if (count == health->prev)
@@ -290,8 +288,6 @@ static void poll_health(unsigned long data)
         if (health->miss_counter == MAX_MISSES) {
                 dev_err(&dev->pdev->dev, "device's health compromised - reached miss count\n");
                 print_health_info(dev);
-        } else {
-                mod_timer(&health->timer, get_next_poll_jiffies());
         }
 
         if (in_fatal(dev) && !health->sick) {
@@ -305,6 +301,9 @@ static void poll_health(unsigned long data)
                                 "new health works are not permitted at this stage\n");
                 spin_unlock(&health->wq_lock);
         }
+
+out:
+        mod_timer(&health->timer, get_next_poll_jiffies());
 }
 
 void mlx5_start_health_poll(struct mlx5_core_dev *dev)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
index fe5546bb4153..13be264587f1 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
@@ -175,8 +175,9 @@ static struct mlx5_profile profile[] = {
         },
 };
 
-#define FW_INIT_TIMEOUT_MILI    2000
-#define FW_INIT_WAIT_MS         2
+#define FW_INIT_TIMEOUT_MILI            2000
+#define FW_INIT_WAIT_MS                 2
+#define FW_PRE_INIT_TIMEOUT_MILI        10000
 
 static int wait_fw_init(struct mlx5_core_dev *dev, u32 max_wait_mili)
 {
@@ -537,8 +538,10 @@ static int handle_hca_cap(struct mlx5_core_dev *dev)
         /* disable cmdif checksum */
         MLX5_SET(cmd_hca_cap, set_hca_cap, cmdif_checksum, 0);
 
-        /* If the HCA supports 4K UARs use it */
-        if (MLX5_CAP_GEN_MAX(dev, uar_4k))
+        /* Enable 4K UAR only when HCA supports it and page size is bigger
+         * than 4K.
+         */
+        if (MLX5_CAP_GEN_MAX(dev, uar_4k) && PAGE_SIZE > 4096)
                 MLX5_SET(cmd_hca_cap, set_hca_cap, uar_4k, 1);
 
         MLX5_SET(cmd_hca_cap, set_hca_cap, log_uar_page_sz, PAGE_SHIFT - 12);
@@ -621,10 +624,9 @@ static int mlx5_irq_set_affinity_hint(struct mlx5_core_dev *mdev, int i)
         cpumask_set_cpu(cpumask_local_spread(i, priv->numa_node),
                         priv->irq_info[i].mask);
 
-#ifdef CONFIG_SMP
-        if (irq_set_affinity_hint(irq, priv->irq_info[i].mask))
+        if (IS_ENABLED(CONFIG_SMP) &&
+            irq_set_affinity_hint(irq, priv->irq_info[i].mask))
                 mlx5_core_warn(mdev, "irq_set_affinity_hint failed, irq 0x%.4x", irq);
-#endif
 
         return 0;
 }
@@ -1012,6 +1014,15 @@ static int mlx5_load_one(struct mlx5_core_dev *dev, struct mlx5_priv *priv,
          */
         dev->state = MLX5_DEVICE_STATE_UP;
 
+        /* wait for firmware to accept initialization segments configurations
+         */
+        err = wait_fw_init(dev, FW_PRE_INIT_TIMEOUT_MILI);
+        if (err) {
+                dev_err(&dev->pdev->dev, "Firmware over %d MS in pre-initializing state, aborting\n",
+                        FW_PRE_INIT_TIMEOUT_MILI);
+                goto out;
+        }
+
         err = mlx5_cmd_init(dev);
         if (err) {
                 dev_err(&pdev->dev, "Failed initializing command interface, aborting\n");
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
index 9f89c4137d21..0744452a0b18 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
@@ -3334,6 +3334,9 @@ static int mlxsw_sp_inetaddr_vlan_event(struct net_device *vlan_dev,
         struct mlxsw_sp *mlxsw_sp = mlxsw_sp_lower_get(vlan_dev);
         u16 vid = vlan_dev_vlan_id(vlan_dev);
 
+        if (netif_is_bridge_port(vlan_dev))
+                return 0;
+
         if (mlxsw_sp_port_dev_check(real_dev))
                 return mlxsw_sp_inetaddr_vport_event(vlan_dev, real_dev, event,
                                                      vid);
diff --git a/drivers/net/ethernet/qlogic/qed/qed_debug.c b/drivers/net/ethernet/qlogic/qed/qed_debug.c
index 483241b4b05d..a672f6a860dc 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_debug.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_debug.c
@@ -2956,7 +2956,7 @@ static u32 qed_grc_dump_ctx_data(struct qed_hwfn *p_hwfn,
                                 qed_wr(p_hwfn,
                                        p_ptt,
                                        s_storm_defs[storm_id].cm_ctx_wr_addr,
-                                       BIT(9) | lid);
+                                       (i << 9) | lid);
                                 *(dump_buf + offset) = qed_rd(p_hwfn,
                                                               p_ptt,
                                                               rd_reg_addr);
diff --git a/drivers/net/ethernet/qlogic/qed/qed_main.c b/drivers/net/ethernet/qlogic/qed/qed_main.c
index 537d1236a4fe..715b3aaf83ac 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_main.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_main.c
@@ -1730,7 +1730,8 @@ void qed_get_protocol_stats(struct qed_dev *cdev,
                 qed_get_protocol_stats_iscsi(cdev, &stats->iscsi_stats);
                 break;
         default:
-                DP_ERR(cdev, "Invalid protocol type = %d\n", type);
+                DP_VERBOSE(cdev, QED_MSG_SP,
+                           "Invalid protocol type = %d\n", type);
                 return;
         }
 }
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
index 7245b1072518..81312924df14 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
@@ -1824,22 +1824,44 @@ struct qlcnic_hardware_ops {
         u32 (*get_cap_size)(void *, int);
         void (*set_sys_info)(void *, int, u32);
         void (*store_cap_mask)(void *, u32);
+        bool (*encap_rx_offload) (struct qlcnic_adapter *adapter);
+        bool (*encap_tx_offload) (struct qlcnic_adapter *adapter);
 };
 
 extern struct qlcnic_nic_template qlcnic_vf_ops;
 
-static inline bool qlcnic_encap_tx_offload(struct qlcnic_adapter *adapter)
+static inline bool qlcnic_83xx_encap_tx_offload(struct qlcnic_adapter *adapter)
 {
         return adapter->ahw->extra_capability[0] &
                QLCNIC_83XX_FW_CAPAB_ENCAP_TX_OFFLOAD;
 }
 
-static inline bool qlcnic_encap_rx_offload(struct qlcnic_adapter *adapter)
+static inline bool qlcnic_83xx_encap_rx_offload(struct qlcnic_adapter *adapter)
 {
         return adapter->ahw->extra_capability[0] &
                QLCNIC_83XX_FW_CAPAB_ENCAP_RX_OFFLOAD;
 }
 
+static inline bool qlcnic_82xx_encap_tx_offload(struct qlcnic_adapter *adapter)
+{
+        return false;
+}
+
+static inline bool qlcnic_82xx_encap_rx_offload(struct qlcnic_adapter *adapter)
+{
+        return false;
+}
+
+static inline bool qlcnic_encap_rx_offload(struct qlcnic_adapter *adapter)
+{
+        return adapter->ahw->hw_ops->encap_rx_offload(adapter);
+}
+
+static inline bool qlcnic_encap_tx_offload(struct qlcnic_adapter *adapter)
+{
+        return adapter->ahw->hw_ops->encap_tx_offload(adapter);
+}
+
 static inline int qlcnic_start_firmware(struct qlcnic_adapter *adapter)
 {
         return adapter->nic_ops->start_firmware(adapter);
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
index 4fb68797630e..f7080d0ab874 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
@@ -242,6 +242,8 @@ static struct qlcnic_hardware_ops qlcnic_83xx_hw_ops = {
         .get_cap_size                   = qlcnic_83xx_get_cap_size,
         .set_sys_info                   = qlcnic_83xx_set_sys_info,
         .store_cap_mask                 = qlcnic_83xx_store_cap_mask,
+        .encap_rx_offload               = qlcnic_83xx_encap_rx_offload,
+        .encap_tx_offload               = qlcnic_83xx_encap_tx_offload,
 };
 
 static struct qlcnic_nic_template qlcnic_83xx_ops = {
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.c
index 838cc0ceafd8..7848cf04b29a 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.c
@@ -341,7 +341,7 @@ qlcnic_pcie_sem_lock(struct qlcnic_adapter *adapter, int sem, u32 id_reg)
                         }
                         return -EIO;
                 }
-                usleep_range(1000, 1500);
+                udelay(1200);
         }
 
         if (id_reg)
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
index b6628aaa6e4a..1b5f7d57b6f8 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
@@ -632,6 +632,8 @@ static struct qlcnic_hardware_ops qlcnic_hw_ops = {
         .get_cap_size                   = qlcnic_82xx_get_cap_size,
         .set_sys_info                   = qlcnic_82xx_set_sys_info,
         .store_cap_mask                 = qlcnic_82xx_store_cap_mask,
+        .encap_rx_offload               = qlcnic_82xx_encap_rx_offload,
+        .encap_tx_offload               = qlcnic_82xx_encap_tx_offload,
 };
 
 static int qlcnic_check_multi_tx_capability(struct qlcnic_adapter *adapter)
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
index 2f656f395f39..c58180f40844 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
@@ -77,6 +77,8 @@ static struct qlcnic_hardware_ops qlcnic_sriov_vf_hw_ops = {
         .free_mac_list                  = qlcnic_sriov_vf_free_mac_list,
         .enable_sds_intr                = qlcnic_83xx_enable_sds_intr,
         .disable_sds_intr               = qlcnic_83xx_disable_sds_intr,
+        .encap_rx_offload               = qlcnic_83xx_encap_rx_offload,
+        .encap_tx_offload               = qlcnic_83xx_encap_tx_offload,
 };
 
 static struct qlcnic_nic_template qlcnic_sriov_vf_ops = {
diff --git a/drivers/net/ethernet/qualcomm/emac/emac-mac.c b/drivers/net/ethernet/qualcomm/emac/emac-mac.c
index cc065ffbe4b5..bcd4708b3745 100644
--- a/drivers/net/ethernet/qualcomm/emac/emac-mac.c
+++ b/drivers/net/ethernet/qualcomm/emac/emac-mac.c
@@ -931,7 +931,7 @@ int emac_mac_up(struct emac_adapter *adpt)
         emac_mac_config(adpt);
         emac_mac_rx_descs_refill(adpt, &adpt->rx_q);
 
-        adpt->phydev->irq = PHY_IGNORE_INTERRUPT;
+        adpt->phydev->irq = PHY_POLL;
         ret = phy_connect_direct(netdev, adpt->phydev, emac_adjust_link,
                                  PHY_INTERFACE_MODE_SGMII);
         if (ret) {
diff --git a/drivers/net/ethernet/qualcomm/emac/emac-phy.c b/drivers/net/ethernet/qualcomm/emac/emac-phy.c
index 441c19366489..18461fcb9815 100644
--- a/drivers/net/ethernet/qualcomm/emac/emac-phy.c
+++ b/drivers/net/ethernet/qualcomm/emac/emac-phy.c
@@ -13,15 +13,11 @@
 /* Qualcomm Technologies, Inc. EMAC PHY Controller driver.
  */
 
-#include <linux/module.h>
-#include <linux/of.h>
-#include <linux/of_net.h>
 #include <linux/of_mdio.h>
 #include <linux/phy.h>
 #include <linux/iopoll.h>
 #include <linux/acpi.h>
 #include "emac.h"
-#include "emac-mac.h"
 
 /* EMAC base register offsets */
 #define EMAC_MDIO_CTRL                                        0x001414
@@ -52,62 +48,10 @@
 
 #define MDIO_WAIT_TIMES                                           1000
 
-#define EMAC_LINK_SPEED_DEFAULT (\
-                EMAC_LINK_SPEED_10_HALF  |\
-                EMAC_LINK_SPEED_10_FULL  |\
-                EMAC_LINK_SPEED_100_HALF |\
-                EMAC_LINK_SPEED_100_FULL |\
-                EMAC_LINK_SPEED_1GB_FULL)
-
-/**
- * emac_phy_mdio_autopoll_disable() - disable mdio autopoll
- * @adpt: the emac adapter
- *
- * The autopoll feature takes over the MDIO bus.  In order for
- * the PHY driver to be able to talk to the PHY over the MDIO
- * bus, we need to temporarily disable the autopoll feature.
- */
-static int emac_phy_mdio_autopoll_disable(struct emac_adapter *adpt)
-{
-        u32 val;
-
-        /* disable autopoll */
-        emac_reg_update32(adpt->base + EMAC_MDIO_CTRL, MDIO_AP_EN, 0);
-
-        /* wait for any mdio polling to complete */
-        if (!readl_poll_timeout(adpt->base + EMAC_MDIO_CTRL, val,
-                                !(val & MDIO_BUSY), 100, MDIO_WAIT_TIMES * 100))
-                return 0;
-
-        /* failed to disable; ensure it is enabled before returning */
-        emac_reg_update32(adpt->base + EMAC_MDIO_CTRL, 0, MDIO_AP_EN);
-
-        return -EBUSY;
-}
-
-/**
- * emac_phy_mdio_autopoll_disable() - disable mdio autopoll
- * @adpt: the emac adapter
- *
- * The EMAC has the ability to poll the external PHY on the MDIO
- * bus for link state changes.  This eliminates the need for the
- * driver to poll the phy.  If if the link state does change,
- * the EMAC issues an interrupt on behalf of the PHY.
- */
-static void emac_phy_mdio_autopoll_enable(struct emac_adapter *adpt)
-{
-        emac_reg_update32(adpt->base + EMAC_MDIO_CTRL, 0, MDIO_AP_EN);
-}
-
 static int emac_mdio_read(struct mii_bus *bus, int addr, int regnum)
 {
         struct emac_adapter *adpt = bus->priv;
         u32 reg;
-        int ret;
-
-        ret = emac_phy_mdio_autopoll_disable(adpt);
-        if (ret)
-                return ret;
 
         emac_reg_update32(adpt->base + EMAC_PHY_STS, PHY_ADDR_BMSK,
                           (addr << PHY_ADDR_SHFT));
@@ -122,24 +66,15 @@ static int emac_mdio_read(struct mii_bus *bus, int addr, int regnum)
         if (readl_poll_timeout(adpt->base + EMAC_MDIO_CTRL, reg,
                                !(reg & (MDIO_START | MDIO_BUSY)),
                                100, MDIO_WAIT_TIMES * 100))
-                ret = -EIO;
-        else
-                ret = (reg >> MDIO_DATA_SHFT) & MDIO_DATA_BMSK;
+                return -EIO;
 
-        emac_phy_mdio_autopoll_enable(adpt);
-
-        return ret;
+        return (reg >> MDIO_DATA_SHFT) & MDIO_DATA_BMSK;
 }
 
 static int emac_mdio_write(struct mii_bus *bus, int addr, int regnum, u16 val)
 {
         struct emac_adapter *adpt = bus->priv;
         u32 reg;
-        int ret;
-
-        ret = emac_phy_mdio_autopoll_disable(adpt);
-        if (ret)
-                return ret;
 
         emac_reg_update32(adpt->base + EMAC_PHY_STS, PHY_ADDR_BMSK,
                           (addr << PHY_ADDR_SHFT));
@@ -155,11 +90,9 @@ static int emac_mdio_write(struct mii_bus *bus, int addr, int regnum, u16 val)
         if (readl_poll_timeout(adpt->base + EMAC_MDIO_CTRL, reg,
                                !(reg & (MDIO_START | MDIO_BUSY)), 100,
                                MDIO_WAIT_TIMES * 100))
-                ret = -EIO;
+                return -EIO;
 
-        emac_phy_mdio_autopoll_enable(adpt);
-
-        return ret;
+        return 0;
 }
 
 /* Configure the MDIO bus and connect the external PHY */
diff --git a/drivers/net/ethernet/qualcomm/emac/emac.c b/drivers/net/ethernet/qualcomm/emac/emac.c
index 28a8cdc36485..98a326faea29 100644
--- a/drivers/net/ethernet/qualcomm/emac/emac.c
+++ b/drivers/net/ethernet/qualcomm/emac/emac.c
@@ -50,19 +50,7 @@
 #define DMAR_DLY_CNT_DEF                                    15
 #define DMAW_DLY_CNT_DEF                                     4
 
-#define IMR_NORMAL_MASK         (\
-                ISR_ERROR       |\
-                ISR_GPHY_LINK   |\
-                ISR_TX_PKT      |\
-                GPHY_WAKEUP_INT)
-
-#define IMR_EXTENDED_MASK       (\
-                SW_MAN_INT      |\
-                ISR_OVER        |\
-                ISR_ERROR       |\
-                ISR_GPHY_LINK   |\
-                ISR_TX_PKT      |\
-                GPHY_WAKEUP_INT)
+#define IMR_NORMAL_MASK         (ISR_ERROR | ISR_OVER | ISR_TX_PKT)
 
 #define ISR_TX_PKT      (\
         TX_PKT_INT      |\
@@ -70,10 +58,6 @@
         TX_PKT_INT2     |\
         TX_PKT_INT3)
 
-#define ISR_GPHY_LINK        (\
-        GPHY_LINK_UP_INT     |\
-        GPHY_LINK_DOWN_INT)
-
 #define ISR_OVER        (\
         RFD0_UR_INT     |\
         RFD1_UR_INT     |\
@@ -187,10 +171,6 @@ irqreturn_t emac_isr(int _irq, void *data)
         if (status & ISR_OVER)
                 net_warn_ratelimited("warning: TX/RX overflow\n");
 
-        /* link event */
-        if (status & ISR_GPHY_LINK)
-                phy_mac_interrupt(adpt->phydev, !!(status & GPHY_LINK_UP_INT));
-
 exit:
         /* enable the interrupt */
         writel(irq->mask, adpt->base + EMAC_INT_MASK);
diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c
index 3cd7989c007d..784782da3a85 100644
--- a/drivers/net/ethernet/renesas/ravb_main.c
+++ b/drivers/net/ethernet/renesas/ravb_main.c
@@ -230,18 +230,6 @@ static void ravb_ring_free(struct net_device *ndev, int q)
         int ring_size;
         int i;
 
-        /* Free RX skb ringbuffer */
-        if (priv->rx_skb[q]) {
-                for (i = 0; i < priv->num_rx_ring[q]; i++)
-                        dev_kfree_skb(priv->rx_skb[q][i]);
-        }
-        kfree(priv->rx_skb[q]);
-        priv->rx_skb[q] = NULL;
-
-        /* Free aligned TX buffers */
-        kfree(priv->tx_align[q]);
-        priv->tx_align[q] = NULL;
-
         if (priv->rx_ring[q]) {
                 for (i = 0; i < priv->num_rx_ring[q]; i++) {
                         struct ravb_ex_rx_desc *desc = &priv->rx_ring[q][i];
@@ -270,6 +258,18 @@ static void ravb_ring_free(struct net_device *ndev, int q)
                 priv->tx_ring[q] = NULL;
         }
 
+        /* Free RX skb ringbuffer */
+        if (priv->rx_skb[q]) {
+                for (i = 0; i < priv->num_rx_ring[q]; i++)
+                        dev_kfree_skb(priv->rx_skb[q][i]);
+        }
+        kfree(priv->rx_skb[q]);
+        priv->rx_skb[q] = NULL;
+
+        /* Free aligned TX buffers */
+        kfree(priv->tx_align[q]);
+        priv->tx_align[q] = NULL;
+
         /* Free TX skb ringbuffer.
          * SKBs are freed by ravb_tx_free() call above.
          */
diff --git a/drivers/net/ethernet/rocker/rocker_ofdpa.c b/drivers/net/ethernet/rocker/rocker_ofdpa.c
index 2ae852454780..a9ce82d3e9cf 100644
--- a/drivers/net/ethernet/rocker/rocker_ofdpa.c
+++ b/drivers/net/ethernet/rocker/rocker_ofdpa.c
@@ -1505,8 +1505,8 @@ static int ofdpa_port_ipv4_nh(struct ofdpa_port *ofdpa_port,
                 *index = entry->index;
                 resolved = false;
         } else if (removing) {
-                ofdpa_neigh_del(trans, found);
                 *index = found->index;
+                ofdpa_neigh_del(trans, found);
         } else if (updating) {
                 ofdpa_neigh_update(found, trans, NULL, false);
                 resolved = !is_zero_ether_addr(found->eth_dst);
diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c
index 78efb2822b86..78f9e43420e0 100644
--- a/drivers/net/ethernet/sfc/ef10.c
+++ b/drivers/net/ethernet/sfc/ef10.c
@@ -4172,7 +4172,7 @@ found:
          * recipients
          */
         if (is_mc_recip) {
-                MCDI_DECLARE_BUF(inbuf, MC_CMD_FILTER_OP_IN_LEN);
+                MCDI_DECLARE_BUF(inbuf, MC_CMD_FILTER_OP_EXT_IN_LEN);
                 unsigned int depth, i;
 
                 memset(inbuf, 0, sizeof(inbuf));
@@ -4320,7 +4320,7 @@ static int efx_ef10_filter_remove_internal(struct efx_nic *efx,
                         efx_ef10_filter_set_entry(table, filter_idx, NULL, 0);
                 } else {
                         efx_mcdi_display_error(efx, MC_CMD_FILTER_OP,
-                                               MC_CMD_FILTER_OP_IN_LEN,
+                                               MC_CMD_FILTER_OP_EXT_IN_LEN,
                                                NULL, 0, rc);
                 }
         }
@@ -4453,7 +4453,7 @@ static s32 efx_ef10_filter_rfs_insert(struct efx_nic *efx,
                                       struct efx_filter_spec *spec)
 {
         struct efx_ef10_filter_table *table = efx->filter_state;
-        MCDI_DECLARE_BUF(inbuf, MC_CMD_FILTER_OP_IN_LEN);
+        MCDI_DECLARE_BUF(inbuf, MC_CMD_FILTER_OP_EXT_IN_LEN);
         struct efx_filter_spec *saved_spec;
         unsigned int hash, i, depth = 1;
         bool replacing = false;
@@ -4940,7 +4940,7 @@ not_restored:
 static void efx_ef10_filter_table_remove(struct efx_nic *efx)
 {
         struct efx_ef10_filter_table *table = efx->filter_state;
-        MCDI_DECLARE_BUF(inbuf, MC_CMD_FILTER_OP_IN_LEN);
+        MCDI_DECLARE_BUF(inbuf, MC_CMD_FILTER_OP_EXT_IN_LEN);
         struct efx_filter_spec *spec;
         unsigned int filter_idx;
         int rc;
@@ -5105,6 +5105,7 @@ static int efx_ef10_filter_insert_addr_list(struct efx_nic *efx,
 
         /* Insert/renew filters */
         for (i = 0; i < addr_count; i++) {
+                EFX_WARN_ON_PARANOID(ids[i] != EFX_EF10_FILTER_ID_INVALID);
                 efx_filter_init_rx(&spec, EFX_FILTER_PRI_AUTO, filter_flags, 0);
                 efx_filter_set_eth_local(&spec, vlan->vid, addr_list[i].addr);
                 rc = efx_ef10_filter_insert(efx, &spec, true);
@@ -5122,11 +5123,11 @@ static int efx_ef10_filter_insert_addr_list(struct efx_nic *efx,
                                 }
                                 return rc;
                         } else {
-                                /* mark as not inserted, and carry on */
-                                rc = EFX_EF10_FILTER_ID_INVALID;
+                                /* keep invalid ID, and carry on */
                         }
+                } else {
+                        ids[i] = efx_ef10_filter_get_unsafe_id(rc);
                 }
-                ids[i] = efx_ef10_filter_get_unsafe_id(rc);
         }
 
         if (multicast && rollback) {
diff --git a/drivers/net/ethernet/sfc/ef10_sriov.c b/drivers/net/ethernet/sfc/ef10_sriov.c
index b7e4345c990d..019cef1d3cf7 100644
--- a/drivers/net/ethernet/sfc/ef10_sriov.c
+++ b/drivers/net/ethernet/sfc/ef10_sriov.c
@@ -661,8 +661,6 @@ restore_filters:
                 up_write(&vf->efx->filter_sem);
                 mutex_unlock(&vf->efx->mac_lock);
 
-                up_write(&vf->efx->filter_sem);
-
                 rc2 = efx_net_open(vf->efx->net_dev);
                 if (rc2)
                         goto reset_nic;
diff --git a/drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.c b/drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.c
index 489ef146201e..6a9c954492f2 100644
--- a/drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.c
+++ b/drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.c
@@ -37,6 +37,7 @@
 #define TSE_PCS_CONTROL_AN_EN_MASK                      BIT(12)
 #define TSE_PCS_CONTROL_REG                             0x00
 #define TSE_PCS_CONTROL_RESTART_AN_MASK                 BIT(9)
+#define TSE_PCS_CTRL_AUTONEG_SGMII                      0x1140
 #define TSE_PCS_IF_MODE_REG                             0x28
 #define TSE_PCS_LINK_TIMER_0_REG                        0x24
 #define TSE_PCS_LINK_TIMER_1_REG                        0x26
@@ -65,6 +66,7 @@
 #define TSE_PCS_SW_RESET_TIMEOUT                        100
 #define TSE_PCS_USE_SGMII_AN_MASK                       BIT(1)
 #define TSE_PCS_USE_SGMII_ENA                           BIT(0)
+#define TSE_PCS_IF_USE_SGMII                            0x03
 
 #define SGMII_ADAPTER_CTRL_REG                          0x00
 #define SGMII_ADAPTER_DISABLE                           0x0001
@@ -101,7 +103,9 @@ int tse_pcs_init(void __iomem *base, struct tse_pcs *pcs)
 {
         int ret = 0;
 
-        writew(TSE_PCS_USE_SGMII_ENA, base + TSE_PCS_IF_MODE_REG);
+        writew(TSE_PCS_IF_USE_SGMII, base + TSE_PCS_IF_MODE_REG);
+
+        writew(TSE_PCS_CTRL_AUTONEG_SGMII, base + TSE_PCS_CONTROL_REG);
 
         writew(TSE_PCS_SGMII_LINK_TIMER_0, base + TSE_PCS_LINK_TIMER_0_REG);
         writew(TSE_PCS_SGMII_LINK_TIMER_1, base + TSE_PCS_LINK_TIMER_1_REG);
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c
index aa6476439aee..e0ef02f9503b 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c
@@ -214,13 +214,13 @@ static int dwmac4_wrback_get_tx_timestamp_status(struct dma_desc *p)
 {
         /* Context type from W/B descriptor must be zero */
         if (le32_to_cpu(p->des3) & TDES3_CONTEXT_TYPE)
-                return -EINVAL;
+                return 0;
 
         /* Tx Timestamp Status is 1 so des0 and des1'll have valid values */
         if (le32_to_cpu(p->des3) & TDES3_TIMESTAMP_STATUS)
-                return 0;
+                return 1;
 
-        return 1;
+        return 0;
 }
 
 static inline u64 dwmac4_get_timestamp(void *desc, u32 ats)
@@ -282,7 +282,10 @@ static int dwmac4_wrback_get_rx_timestamp_status(void *desc, u32 ats)
                 }
         }
 exit:
-        return ret;
+        if (likely(ret == 0))
+                return 1;
+
+        return 0;
 }
 
 static void dwmac4_rd_init_rx_desc(struct dma_desc *p, int disable_rx_ic,
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index a74c481401c4..6e4cbc6ce0ef 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -434,14 +434,14 @@ static void stmmac_get_tx_hwtstamp(struct stmmac_priv *priv,
                 return;
 
         /* check tx tstamp status */
-        if (!priv->hw->desc->get_tx_timestamp_status(p)) {
+        if (priv->hw->desc->get_tx_timestamp_status(p)) {
                 /* get the valid tstamp */
                 ns = priv->hw->desc->get_timestamp(p, priv->adv_ts);
 
                 memset(&shhwtstamp, 0, sizeof(struct skb_shared_hwtstamps));
                 shhwtstamp.hwtstamp = ns_to_ktime(ns);
 
-                netdev_info(priv->dev, "get valid TX hw timestamp %llu\n", ns);
+                netdev_dbg(priv->dev, "get valid TX hw timestamp %llu\n", ns);
                 /* pass tstamp to stack */
                 skb_tstamp_tx(skb, &shhwtstamp);
         }
@@ -468,19 +468,19 @@ static void stmmac_get_rx_hwtstamp(struct stmmac_priv *priv, struct dma_desc *p,
                 return;
 
         /* Check if timestamp is available */
-        if (!priv->hw->desc->get_rx_timestamp_status(p, priv->adv_ts)) {
+        if (priv->hw->desc->get_rx_timestamp_status(p, priv->adv_ts)) {
                 /* For GMAC4, the valid timestamp is from CTX next desc. */
                 if (priv->plat->has_gmac4)
                         ns = priv->hw->desc->get_timestamp(np, priv->adv_ts);
                 else
                         ns = priv->hw->desc->get_timestamp(p, priv->adv_ts);
 
-                netdev_info(priv->dev, "get valid RX hw timestamp %llu\n", ns);
+                netdev_dbg(priv->dev, "get valid RX hw timestamp %llu\n", ns);
                 shhwtstamp = skb_hwtstamps(skb);
                 memset(shhwtstamp, 0, sizeof(struct skb_shared_hwtstamps));
                 shhwtstamp->hwtstamp = ns_to_ktime(ns);
         } else  {
-                netdev_err(priv->dev, "cannot get RX hw timestamp\n");
+                netdev_dbg(priv->dev, "cannot get RX hw timestamp\n");
         }
 }
 
@@ -546,7 +546,10 @@ static int stmmac_hwtstamp_ioctl(struct net_device *dev, struct ifreq *ifr)
                         /* PTP v1, UDP, any kind of event packet */
                         config.rx_filter = HWTSTAMP_FILTER_PTP_V1_L4_EVENT;
                         /* take time stamp for all event messages */
-                        snap_type_sel = PTP_TCR_SNAPTYPSEL_1;
+                        if (priv->plat->has_gmac4)
+                                snap_type_sel = PTP_GMAC4_TCR_SNAPTYPSEL_1;
+                        else
+                                snap_type_sel = PTP_TCR_SNAPTYPSEL_1;
 
                         ptp_over_ipv4_udp = PTP_TCR_TSIPV4ENA;
                         ptp_over_ipv6_udp = PTP_TCR_TSIPV6ENA;
@@ -578,7 +581,10 @@ static int stmmac_hwtstamp_ioctl(struct net_device *dev, struct ifreq *ifr)
                         config.rx_filter = HWTSTAMP_FILTER_PTP_V2_L4_EVENT;
                         ptp_v2 = PTP_TCR_TSVER2ENA;
                         /* take time stamp for all event messages */
-                        snap_type_sel = PTP_TCR_SNAPTYPSEL_1;
+                        if (priv->plat->has_gmac4)
+                                snap_type_sel = PTP_GMAC4_TCR_SNAPTYPSEL_1;
+                        else
+                                snap_type_sel = PTP_TCR_SNAPTYPSEL_1;
 
                         ptp_over_ipv4_udp = PTP_TCR_TSIPV4ENA;
                         ptp_over_ipv6_udp = PTP_TCR_TSIPV6ENA;
@@ -612,7 +618,10 @@ static int stmmac_hwtstamp_ioctl(struct net_device *dev, struct ifreq *ifr)
                         config.rx_filter = HWTSTAMP_FILTER_PTP_V2_EVENT;
                         ptp_v2 = PTP_TCR_TSVER2ENA;
                         /* take time stamp for all event messages */
-                        snap_type_sel = PTP_TCR_SNAPTYPSEL_1;
+                        if (priv->plat->has_gmac4)
+                                snap_type_sel = PTP_GMAC4_TCR_SNAPTYPSEL_1;
+                        else
+                                snap_type_sel = PTP_TCR_SNAPTYPSEL_1;
 
                         ptp_over_ipv4_udp = PTP_TCR_TSIPV4ENA;
                         ptp_over_ipv6_udp = PTP_TCR_TSIPV6ENA;
@@ -1208,7 +1217,7 @@ static int init_dma_rx_desc_rings(struct net_device *dev, gfp_t flags)
         u32 rx_count = priv->plat->rx_queues_to_use;
         unsigned int bfsize = 0;
         int ret = -ENOMEM;
-        u32 queue;
+        int queue;
         int i;
 
         if (priv->hw->mode->set_16kib_bfsize)
@@ -2724,7 +2733,7 @@ static void stmmac_tso_allocator(struct stmmac_priv *priv, unsigned int des,
 
                 priv->hw->desc->prepare_tso_tx_desc(desc, 0, buff_size,
                         0, 1,
-                        (last_segment) && (buff_size < TSO_MAX_BUFF_SIZE),
+                        (last_segment) && (tmp_len <= TSO_MAX_BUFF_SIZE),
                         0, 0);
 
                 tmp_len -= TSO_MAX_BUFF_SIZE;
@@ -2822,7 +2831,6 @@ static netdev_tx_t stmmac_tso_xmit(struct sk_buff *skb, struct net_device *dev)
 
         tx_q->tx_skbuff_dma[first_entry].buf = des;
         tx_q->tx_skbuff_dma[first_entry].len = skb_headlen(skb);
-        tx_q->tx_skbuff[first_entry] = skb;
 
         first->des0 = cpu_to_le32(des);
 
@@ -2856,6 +2864,14 @@ static netdev_tx_t stmmac_tso_xmit(struct sk_buff *skb, struct net_device *dev)
 
         tx_q->tx_skbuff_dma[tx_q->cur_tx].last_segment = true;
 
+        /* Only the last descriptor gets to point to the skb. */
+        tx_q->tx_skbuff[tx_q->cur_tx] = skb;
+
+        /* We've used all descriptors we need for this skb, however,
+         * advance cur_tx so that it references a fresh descriptor.
+         * ndo_start_xmit will fill this descriptor the next time it's
+         * called and stmmac_tx_clean may clean up to this descriptor.
+         */
         tx_q->cur_tx = STMMAC_GET_ENTRY(tx_q->cur_tx, DMA_TX_SIZE);
 
         if (unlikely(stmmac_tx_avail(priv, queue) <= (MAX_SKB_FRAGS + 1))) {
@@ -2947,7 +2963,8 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)
         int i, csum_insertion = 0, is_jumbo = 0;
         u32 queue = skb_get_queue_mapping(skb);
         int nfrags = skb_shinfo(skb)->nr_frags;
-        unsigned int entry, first_entry;
+        int entry;
+        unsigned int first_entry;
         struct dma_desc *desc, *first;
         struct stmmac_tx_queue *tx_q;
         unsigned int enh_desc;
@@ -2988,8 +3005,6 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)
 
         first = desc;
 
-        tx_q->tx_skbuff[first_entry] = skb;
-
         enh_desc = priv->plat->enh_desc;
         /* To program the descriptors according to the size of the frame */
         if (enh_desc)
@@ -3037,8 +3052,15 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)
                                                 skb->len);
         }
 
-        entry = STMMAC_GET_ENTRY(entry, DMA_TX_SIZE);
+        /* Only the last descriptor gets to point to the skb. */
+        tx_q->tx_skbuff[entry] = skb;
 
+        /* We've used all descriptors we need for this skb, however,
+         * advance cur_tx so that it references a fresh descriptor.
+         * ndo_start_xmit will fill this descriptor the next time it's
+         * called and stmmac_tx_clean may clean up to this descriptor.
+         */
+        entry = STMMAC_GET_ENTRY(entry, DMA_TX_SIZE);
         tx_q->cur_tx = entry;
 
         if (netif_msg_pktdata(priv)) {
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.h b/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.h
index 48fb72fc423c..f4b31d69f60e 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.h
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.h
@@ -59,7 +59,8 @@
 /* Enable Snapshot for Messages Relevant to Master */
 #define PTP_TCR_TSMSTRENA       BIT(15)
 /* Select PTP packets for Taking Snapshots */
-#define PTP_TCR_SNAPTYPSEL_1    GENMASK(17, 16)
+#define PTP_TCR_SNAPTYPSEL_1    BIT(16)
+#define PTP_GMAC4_TCR_SNAPTYPSEL_1      GENMASK(17, 16)
 /* Enable MAC address for PTP Frame Filtering */
 #define PTP_TCR_TSENMACADDR     BIT(18)
 
diff --git a/drivers/net/ethernet/ti/cpsw-common.c b/drivers/net/ethernet/ti/cpsw-common.c
index 1562ab4151e1..56ba411421f0 100644
--- a/drivers/net/ethernet/ti/cpsw-common.c
+++ b/drivers/net/ethernet/ti/cpsw-common.c
@@ -90,7 +90,7 @@ int ti_cm_get_macid(struct device *dev, int slave, u8 *mac_addr)
         if (of_device_is_compatible(dev->of_node, "ti,dm816-emac"))
                 return cpsw_am33xx_cm_get_macid(dev, 0x30, slave, mac_addr);
 
-        if (of_machine_is_compatible("ti,am4372"))
+        if (of_machine_is_compatible("ti,am43"))
                 return cpsw_am33xx_cm_get_macid(dev, 0x630, slave, mac_addr);
 
         if (of_machine_is_compatible("ti,dra7"))
diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c
index 959fd12d2e67..199459bd6961 100644
--- a/drivers/net/geneve.c
+++ b/drivers/net/geneve.c
@@ -1007,7 +1007,7 @@ static void geneve_setup(struct net_device *dev)
 
         dev->netdev_ops = &geneve_netdev_ops;
         dev->ethtool_ops = &geneve_ethtool_ops;
-        dev->destructor = free_netdev;
+        dev->needs_free_netdev = true;
 
         SET_NETDEV_DEVTYPE(dev, &geneve_type);
 
@@ -1133,7 +1133,7 @@ static int geneve_configure(struct net *net, struct net_device *dev,
 
         /* make enough headroom for basic scenario */
         encap_len = GENEVE_BASE_HLEN + ETH_HLEN;
-        if (ip_tunnel_info_af(info) == AF_INET) {
+        if (!metadata && ip_tunnel_info_af(info) == AF_INET) {
                 encap_len += sizeof(struct iphdr);
                 dev->max_mtu -= sizeof(struct iphdr);
         } else {
diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c
index 7b652bb7ebe4..ca110cd2a4e4 100644
--- a/drivers/net/gtp.c
+++ b/drivers/net/gtp.c
@@ -611,7 +611,7 @@ static const struct net_device_ops gtp_netdev_ops = {
 static void gtp_link_setup(struct net_device *dev)
 {
         dev->netdev_ops         = &gtp_netdev_ops;
-        dev->destructor         = free_netdev;
+        dev->needs_free_netdev  = true;
 
         dev->hard_header_len = 0;
         dev->addr_len = 0;
diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c
index 922bf440e9f1..021a8ec411ab 100644
--- a/drivers/net/hamradio/6pack.c
+++ b/drivers/net/hamradio/6pack.c
@@ -311,7 +311,7 @@ static void sp_setup(struct net_device *dev)
 {
         /* Finish setting up the DEVICE info. */
         dev->netdev_ops         = &sp_netdev_ops;
-        dev->destructor         = free_netdev;
+        dev->needs_free_netdev  = true;
         dev->mtu                = SIXP_MTU;
         dev->hard_header_len    = AX25_MAX_HEADER_LEN;
         dev->header_ops         = &ax25_header_ops;
diff --git a/drivers/net/hamradio/bpqether.c b/drivers/net/hamradio/bpqether.c
index f62e7f325cf9..78a6414c5fd9 100644
--- a/drivers/net/hamradio/bpqether.c
+++ b/drivers/net/hamradio/bpqether.c
@@ -476,7 +476,7 @@ static const struct net_device_ops bpq_netdev_ops = {
 static void bpq_setup(struct net_device *dev)
 {
         dev->netdev_ops      = &bpq_netdev_ops;
-        dev->destructor      = free_netdev;
+        dev->needs_free_netdev = true;
 
         memcpy(dev->broadcast, &ax25_bcast, AX25_ADDR_LEN);
         memcpy(dev->dev_addr,  &ax25_defaddr, AX25_ADDR_LEN);
diff --git a/drivers/net/hamradio/hdlcdrv.c b/drivers/net/hamradio/hdlcdrv.c
index 8c3633c1d078..97e3bc60c3e7 100644
--- a/drivers/net/hamradio/hdlcdrv.c
+++ b/drivers/net/hamradio/hdlcdrv.c
@@ -576,6 +576,8 @@ static int hdlcdrv_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
         case HDLCDRVCTL_CALIBRATE:
                 if(!capable(CAP_SYS_RAWIO))
                         return -EPERM;
+                if (s->par.bitrate <= 0)
+                        return -EINVAL;
                 if (bi.data.calibrate > INT_MAX / s->par.bitrate)
                         return -EINVAL;
                 s->hdlctx.calibrate = bi.data.calibrate * s->par.bitrate / 16;
diff --git a/drivers/net/hyperv/hyperv_net.h b/drivers/net/hyperv/hyperv_net.h
index 262b2ea576a3..6066f1bcaf2d 100644
--- a/drivers/net/hyperv/hyperv_net.h
+++ b/drivers/net/hyperv/hyperv_net.h
@@ -171,6 +171,8 @@ struct rndis_device {
         spinlock_t request_lock;
         struct list_head req_list;
 
+        struct work_struct mcast_work;
+
         u8 hw_mac_adr[ETH_ALEN];
         u8 rss_key[NETVSC_HASH_KEYLEN];
         u16 ind_table[ITAB_NUM];
@@ -201,6 +203,7 @@ int rndis_filter_open(struct netvsc_device *nvdev);
 int rndis_filter_close(struct netvsc_device *nvdev);
 int rndis_filter_device_add(struct hv_device *dev,
                             struct netvsc_device_info *info);
+void rndis_filter_update(struct netvsc_device *nvdev);
 void rndis_filter_device_remove(struct hv_device *dev,
                                 struct netvsc_device *nvdev);
 int rndis_filter_set_rss_param(struct rndis_device *rdev,
@@ -211,7 +214,6 @@ int rndis_filter_receive(struct net_device *ndev,
                          struct vmbus_channel *channel,
                          void *data, u32 buflen);
 
-int rndis_filter_set_packet_filter(struct rndis_device *dev, u32 new_filter);
 int rndis_filter_set_device_mac(struct net_device *ndev, char *mac);
 
 void netvsc_switch_datapath(struct net_device *nv_dev, bool vf);
@@ -696,7 +698,6 @@ struct net_device_context {
         /* list protection */
         spinlock_t lock;
 
-        struct work_struct work;
         u32 msg_enable; /* debug level */
 
         u32 tx_checksum_mask;
diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index 4421a6d00375..643c539a08ba 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -56,37 +56,12 @@ static int debug = -1;
 module_param(debug, int, S_IRUGO);
 MODULE_PARM_DESC(debug, "Debug level (0=none,...,16=all)");
 
-static void do_set_multicast(struct work_struct *w)
-{
-        struct net_device_context *ndevctx =
-                container_of(w, struct net_device_context, work);
-        struct hv_device *device_obj = ndevctx->device_ctx;
-        struct net_device *ndev = hv_get_drvdata(device_obj);
-        struct netvsc_device *nvdev = rcu_dereference(ndevctx->nvdev);
-        struct rndis_device *rdev;
-
-        if (!nvdev)
-                return;
-
-        rdev = nvdev->extension;
-        if (rdev == NULL)
-                return;
-
-        if (ndev->flags & IFF_PROMISC)
-                rndis_filter_set_packet_filter(rdev,
-                        NDIS_PACKET_TYPE_PROMISCUOUS);
-        else
-                rndis_filter_set_packet_filter(rdev,
-                        NDIS_PACKET_TYPE_BROADCAST |
-                        NDIS_PACKET_TYPE_ALL_MULTICAST |
-                        NDIS_PACKET_TYPE_DIRECTED);
-}
-
 static void netvsc_set_multicast_list(struct net_device *net)
 {
         struct net_device_context *net_device_ctx = netdev_priv(net);
+        struct netvsc_device *nvdev = rtnl_dereference(net_device_ctx->nvdev);
 
-        schedule_work(&net_device_ctx->work);
+        rndis_filter_update(nvdev);
 }
 
 static int netvsc_open(struct net_device *net)
@@ -123,8 +98,6 @@ static int netvsc_close(struct net_device *net)
 
         netif_tx_disable(net);
 
-        /* Make sure netvsc_set_multicast_list doesn't re-enable filter! */
-        cancel_work_sync(&net_device_ctx->work);
         ret = rndis_filter_close(nvdev);
         if (ret != 0) {
                 netdev_err(net, "unable to close device (ret %d).\n", ret);
@@ -803,7 +776,7 @@ static int netvsc_set_channels(struct net_device *net,
             channels->rx_count || channels->tx_count || channels->other_count)
                 return -EINVAL;
 
-        if (count > net->num_tx_queues || count > net->num_rx_queues)
+        if (count > net->num_tx_queues || count > VRSS_CHANNEL_MAX)
                 return -EINVAL;
 
         if (!nvdev || nvdev->destroy)
@@ -1028,7 +1001,7 @@ static const struct {
 static int netvsc_get_sset_count(struct net_device *dev, int string_set)
 {
         struct net_device_context *ndc = netdev_priv(dev);
-        struct netvsc_device *nvdev = rcu_dereference(ndc->nvdev);
+        struct netvsc_device *nvdev = rtnl_dereference(ndc->nvdev);
 
         if (!nvdev)
                 return -ENODEV;
@@ -1158,11 +1131,22 @@ netvsc_get_rxnfc(struct net_device *dev, struct ethtool_rxnfc *info,
 }
 
 #ifdef CONFIG_NET_POLL_CONTROLLER
-static void netvsc_poll_controller(struct net_device *net)
+static void netvsc_poll_controller(struct net_device *dev)
 {
-        /* As netvsc_start_xmit() works synchronous we don't have to
-         * trigger anything here.
-         */
+        struct net_device_context *ndc = netdev_priv(dev);
+        struct netvsc_device *ndev;
+        int i;
+
+        rcu_read_lock();
+        ndev = rcu_dereference(ndc->nvdev);
+        if (ndev) {
+                for (i = 0; i < ndev->num_chn; i++) {
+                        struct netvsc_channel *nvchan = &ndev->chan_table[i];
+
+                        napi_schedule(&nvchan->napi);
+                }
+        }
+        rcu_read_unlock();
 }
 #endif
 
@@ -1219,7 +1203,7 @@ static int netvsc_set_rxfh(struct net_device *dev, const u32 *indir,
         rndis_dev = ndev->extension;
         if (indir) {
                 for (i = 0; i < ITAB_NUM; i++)
-                        if (indir[i] >= dev->num_rx_queues)
+                        if (indir[i] >= VRSS_CHANNEL_MAX)
                                 return -EINVAL;
 
                 for (i = 0; i < ITAB_NUM; i++)
@@ -1552,7 +1536,6 @@ static int netvsc_probe(struct hv_device *dev,
         hv_set_drvdata(dev, net);
 
         INIT_DELAYED_WORK(&net_device_ctx->dwork, netvsc_link_change);
-        INIT_WORK(&net_device_ctx->work, do_set_multicast);
 
         spin_lock_init(&net_device_ctx->lock);
         INIT_LIST_HEAD(&net_device_ctx->reconfig_events);
@@ -1622,7 +1605,6 @@ static int netvsc_remove(struct hv_device *dev)
         netif_device_detach(net);
 
         cancel_delayed_work_sync(&ndev_ctx->dwork);
-        cancel_work_sync(&ndev_ctx->work);
 
         /*
          * Call to the vsc driver to let it know that the device is being
diff --git a/drivers/net/hyperv/rndis_filter.c b/drivers/net/hyperv/rndis_filter.c
index f9d5b0b8209a..cb79cd081f42 100644
--- a/drivers/net/hyperv/rndis_filter.c
+++ b/drivers/net/hyperv/rndis_filter.c
@@ -31,6 +31,7 @@
 
 #include "hyperv_net.h"
 
+static void rndis_set_multicast(struct work_struct *w);
 
 #define RNDIS_EXT_LEN PAGE_SIZE
 struct rndis_request {
@@ -76,6 +77,7 @@ static struct rndis_device *get_rndis_device(void)
         spin_lock_init(&device->request_lock);
 
         INIT_LIST_HEAD(&device->req_list);
+        INIT_WORK(&device->mcast_work, rndis_set_multicast);
 
         device->state = RNDIS_DEV_UNINITIALIZED;
 
@@ -815,7 +817,8 @@ static int rndis_filter_query_link_speed(struct rndis_device *dev)
         return ret;
 }
 
-int rndis_filter_set_packet_filter(struct rndis_device *dev, u32 new_filter)
+static int rndis_filter_set_packet_filter(struct rndis_device *dev,
+                                          u32 new_filter)
 {
         struct rndis_request *request;
         struct rndis_set_request *set;
@@ -846,6 +849,28 @@ int rndis_filter_set_packet_filter(struct rndis_device *dev, u32 new_filter)
         return ret;
 }
 
+static void rndis_set_multicast(struct work_struct *w)
+{
+        struct rndis_device *rdev
+                = container_of(w, struct rndis_device, mcast_work);
+
+        if (rdev->ndev->flags & IFF_PROMISC)
+                rndis_filter_set_packet_filter(rdev,
+                                               NDIS_PACKET_TYPE_PROMISCUOUS);
+        else
+                rndis_filter_set_packet_filter(rdev,
+                                               NDIS_PACKET_TYPE_BROADCAST |
+                                               NDIS_PACKET_TYPE_ALL_MULTICAST |
+                                               NDIS_PACKET_TYPE_DIRECTED);
+}
+
+void rndis_filter_update(struct netvsc_device *nvdev)
+{
+        struct rndis_device *rdev = nvdev->extension;
+
+        schedule_work(&rdev->mcast_work);
+}
+
 static int rndis_filter_init_device(struct rndis_device *dev)
 {
         struct rndis_request *request;
@@ -973,6 +998,9 @@ static int rndis_filter_close_device(struct rndis_device *dev)
         if (dev->state != RNDIS_DEV_DATAINITIALIZED)
                 return 0;
 
+        /* Make sure rndis_set_multicast doesn't re-enable filter! */
+        cancel_work_sync(&dev->mcast_work);
+
         ret = rndis_filter_set_packet_filter(dev, 0);
         if (ret == -ENODEV)
                 ret = 0;
diff --git a/drivers/net/ifb.c b/drivers/net/ifb.c
index 312fce7302d3..144ea5ae8ab4 100644
--- a/drivers/net/ifb.c
+++ b/drivers/net/ifb.c
@@ -207,7 +207,6 @@ static void ifb_dev_free(struct net_device *dev)
                 __skb_queue_purge(&txp->tq);
         }
         kfree(dp->tx_private);
-        free_netdev(dev);
 }
 
 static void ifb_setup(struct net_device *dev)
@@ -230,7 +229,8 @@ static void ifb_setup(struct net_device *dev)
         dev->priv_flags &= ~IFF_TX_SKB_SHARING;
         netif_keep_dst(dev);
         eth_hw_addr_random(dev);
-        dev->destructor = ifb_dev_free;
+        dev->needs_free_netdev = true;
+        dev->priv_destructor = ifb_dev_free;
 }
 
 static netdev_tx_t ifb_xmit(struct sk_buff *skb, struct net_device *dev)
diff --git a/drivers/net/ipvlan/ipvlan_main.c b/drivers/net/ipvlan/ipvlan_main.c
index 618ed88fad0f..7c7680c8f0e3 100644
--- a/drivers/net/ipvlan/ipvlan_main.c
+++ b/drivers/net/ipvlan/ipvlan_main.c
@@ -632,7 +632,7 @@ void ipvlan_link_setup(struct net_device *dev)
         dev->priv_flags &= ~(IFF_XMIT_DST_RELEASE | IFF_TX_SKB_SHARING);
         dev->priv_flags |= IFF_UNICAST_FLT | IFF_NO_QUEUE;
         dev->netdev_ops = &ipvlan_netdev_ops;
-        dev->destructor = free_netdev;
+        dev->needs_free_netdev = true;
         dev->header_ops = &ipvlan_header_ops;
         dev->ethtool_ops = &ipvlan_ethtool_ops;
 }
diff --git a/drivers/net/loopback.c b/drivers/net/loopback.c
index 224f65cb576b..30612497643c 100644
--- a/drivers/net/loopback.c
+++ b/drivers/net/loopback.c
@@ -159,7 +159,6 @@ static void loopback_dev_free(struct net_device *dev)
 {
         dev_net(dev)->loopback_dev = NULL;
         free_percpu(dev->lstats);
-        free_netdev(dev);
 }
 
 static const struct net_device_ops loopback_ops = {
@@ -196,7 +195,8 @@ static void loopback_setup(struct net_device *dev)
         dev->ethtool_ops        = &loopback_ethtool_ops;
         dev->header_ops         = &eth_header_ops;
         dev->netdev_ops         = &loopback_ops;
-        dev->destructor         = loopback_dev_free;
+        dev->needs_free_netdev  = true;
+        dev->priv_destructor    = loopback_dev_free;
 }
 
 /* Setup and register the loopback device. */
diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c
index cdc347be68f2..79411675f0e6 100644
--- a/drivers/net/macsec.c
+++ b/drivers/net/macsec.c
@@ -2996,7 +2996,6 @@ static void macsec_free_netdev(struct net_device *dev)
         free_percpu(macsec->secy.tx_sc.stats);
 
         dev_put(real_dev);
-        free_netdev(dev);
 }
 
 static void macsec_setup(struct net_device *dev)
@@ -3006,7 +3005,8 @@ static void macsec_setup(struct net_device *dev)
         dev->max_mtu = ETH_MAX_MTU;
         dev->priv_flags |= IFF_NO_QUEUE;
         dev->netdev_ops = &macsec_netdev_ops;
-        dev->destructor = macsec_free_netdev;
+        dev->needs_free_netdev = true;
+        dev->priv_destructor = macsec_free_netdev;
         SET_NETDEV_DEVTYPE(dev, &macsec_type);
 
         eth_zero_addr(dev->broadcast);
diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
index 346ad2ff3998..72b801803aa4 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -39,16 +39,20 @@
 #define MACVLAN_HASH_SIZE       (1<<MACVLAN_HASH_BITS)
 #define MACVLAN_BC_QUEUE_LEN    1000
 
+#define MACVLAN_F_PASSTHRU      1
+#define MACVLAN_F_ADDRCHANGE    2
+
 struct macvlan_port {
         struct net_device       *dev;
         struct hlist_head       vlan_hash[MACVLAN_HASH_SIZE];
         struct list_head        vlans;
         struct sk_buff_head     bc_queue;
         struct work_struct      bc_work;
-        bool                    passthru;
+        u32                     flags;
         int                     count;
         struct hlist_head       vlan_source_hash[MACVLAN_HASH_SIZE];
         DECLARE_BITMAP(mc_filter, MACVLAN_MC_FILTER_SZ);
+        unsigned char           perm_addr[ETH_ALEN];
 };
 
 struct macvlan_source_entry {
@@ -66,6 +70,31 @@ struct macvlan_skb_cb {
 
 static void macvlan_port_destroy(struct net_device *dev);
 
+static inline bool macvlan_passthru(const struct macvlan_port *port)
+{
+        return port->flags & MACVLAN_F_PASSTHRU;
+}
+
+static inline void macvlan_set_passthru(struct macvlan_port *port)
+{
+        port->flags |= MACVLAN_F_PASSTHRU;
+}
+
+static inline bool macvlan_addr_change(const struct macvlan_port *port)
+{
+        return port->flags & MACVLAN_F_ADDRCHANGE;
+}
+
+static inline void macvlan_set_addr_change(struct macvlan_port *port)
+{
+        port->flags |= MACVLAN_F_ADDRCHANGE;
+}
+
+static inline void macvlan_clear_addr_change(struct macvlan_port *port)
+{
+        port->flags &= ~MACVLAN_F_ADDRCHANGE;
+}
+
 /* Hash Ethernet address */
 static u32 macvlan_eth_hash(const unsigned char *addr)
 {
@@ -181,11 +210,12 @@ static void macvlan_hash_change_addr(struct macvlan_dev *vlan,
 static bool macvlan_addr_busy(const struct macvlan_port *port,
                               const unsigned char *addr)
 {
-        /* Test to see if the specified multicast address is
+        /* Test to see if the specified address is
          * currently in use by the underlying device or
          * another macvlan.
          */
-        if (ether_addr_equal_64bits(port->dev->dev_addr, addr))
+        if (!macvlan_passthru(port) && !macvlan_addr_change(port) &&
+            ether_addr_equal_64bits(port->dev->dev_addr, addr))
                 return true;
 
         if (macvlan_hash_lookup(port, addr))
@@ -445,7 +475,7 @@ static rx_handler_result_t macvlan_handle_frame(struct sk_buff **pskb)
         }
 
         macvlan_forward_source(skb, port, eth->h_source);
-        if (port->passthru)
+        if (macvlan_passthru(port))
                 vlan = list_first_or_null_rcu(&port->vlans,
                                               struct macvlan_dev, list);
         else
@@ -574,7 +604,7 @@ static int macvlan_open(struct net_device *dev)
         struct net_device *lowerdev = vlan->lowerdev;
         int err;
 
-        if (vlan->port->passthru) {
+        if (macvlan_passthru(vlan->port)) {
                 if (!(vlan->flags & MACVLAN_FLAG_NOPROMISC)) {
                         err = dev_set_promiscuity(lowerdev, 1);
                         if (err < 0)
@@ -649,7 +679,7 @@ static int macvlan_stop(struct net_device *dev)
         dev_uc_unsync(lowerdev, dev);
         dev_mc_unsync(lowerdev, dev);
 
-        if (vlan->port->passthru) {
+        if (macvlan_passthru(vlan->port)) {
                 if (!(vlan->flags & MACVLAN_FLAG_NOPROMISC))
                         dev_set_promiscuity(lowerdev, -1);
                 goto hash_del;
@@ -672,6 +702,7 @@ static int macvlan_sync_address(struct net_device *dev, unsigned char *addr)
 {
         struct macvlan_dev *vlan = netdev_priv(dev);
         struct net_device *lowerdev = vlan->lowerdev;
+        struct macvlan_port *port = vlan->port;
         int err;
 
         if (!(dev->flags & IFF_UP)) {
@@ -682,7 +713,7 @@ static int macvlan_sync_address(struct net_device *dev, unsigned char *addr)
                 if (macvlan_addr_busy(vlan->port, addr))
                         return -EBUSY;
 
-                if (!vlan->port->passthru) {
+                if (!macvlan_passthru(port)) {
                         err = dev_uc_add(lowerdev, addr);
                         if (err)
                                 return err;
@@ -692,6 +723,15 @@ static int macvlan_sync_address(struct net_device *dev, unsigned char *addr)
 
                 macvlan_hash_change_addr(vlan, addr);
         }
+        if (macvlan_passthru(port) && !macvlan_addr_change(port)) {
+                /* Since addr_change isn't set, we are here due to lower
+                 * device change.  Save the lower-dev address so we can
+                 * restore it later.
+                 */
+                ether_addr_copy(vlan->port->perm_addr,
+                                lowerdev->dev_addr);
+        }
+        macvlan_clear_addr_change(port);
         return 0;
 }
 
@@ -703,7 +743,12 @@ static int macvlan_set_mac_address(struct net_device *dev, void *p)
         if (!is_valid_ether_addr(addr->sa_data))
                 return -EADDRNOTAVAIL;
 
+        /* If the addresses are the same, this is a no-op */
+        if (ether_addr_equal(dev->dev_addr, addr->sa_data))
+                return 0;
+
         if (vlan->mode == MACVLAN_MODE_PASSTHRU) {
+                macvlan_set_addr_change(vlan->port);
                 dev_set_mac_address(vlan->lowerdev, addr);
                 return 0;
         }
@@ -928,7 +973,7 @@ static int macvlan_fdb_add(struct ndmsg *ndm, struct nlattr *tb[],
         /* Support unicast filter only on passthru devices.
          * Multicast filter should be allowed on all devices.
          */
-        if (!vlan->port->passthru && is_unicast_ether_addr(addr))
+        if (!macvlan_passthru(vlan->port) && is_unicast_ether_addr(addr))
                 return -EOPNOTSUPP;
 
         if (flags & NLM_F_REPLACE)
@@ -952,7 +997,7 @@ static int macvlan_fdb_del(struct ndmsg *ndm, struct nlattr *tb[],
         /* Support unicast filter only on passthru devices.
          * Multicast filter should be allowed on all devices.
          */
-        if (!vlan->port->passthru && is_unicast_ether_addr(addr))
+        if (!macvlan_passthru(vlan->port) && is_unicast_ether_addr(addr))
                 return -EOPNOTSUPP;
 
         if (is_unicast_ether_addr(addr))
@@ -1092,7 +1137,7 @@ void macvlan_common_setup(struct net_device *dev)
         netif_keep_dst(dev);
         dev->priv_flags        |= IFF_UNICAST_FLT;
         dev->netdev_ops         = &macvlan_netdev_ops;
-        dev->destructor         = free_netdev;
+        dev->needs_free_netdev  = true;
         dev->header_ops         = &macvlan_hard_header_ops;
         dev->ethtool_ops        = &macvlan_ethtool_ops;
 }
@@ -1120,8 +1165,8 @@ static int macvlan_port_create(struct net_device *dev)
         if (port == NULL)
                 return -ENOMEM;
 
-        port->passthru = false;
         port->dev = dev;
+        ether_addr_copy(port->perm_addr, dev->dev_addr);
         INIT_LIST_HEAD(&port->vlans);
         for (i = 0; i < MACVLAN_HASH_SIZE; i++)
                 INIT_HLIST_HEAD(&port->vlan_hash[i]);
@@ -1161,6 +1206,18 @@ static void macvlan_port_destroy(struct net_device *dev)
                 kfree_skb(skb);
         }
 
+        /* If the lower device address has been changed by passthru
+         * macvlan, put it back.
+         */
+        if (macvlan_passthru(port) &&
+            !ether_addr_equal(port->dev->dev_addr, port->perm_addr)) {
+                struct sockaddr sa;
+
+                sa.sa_family = port->dev->type;
+                memcpy(&sa.sa_data, port->perm_addr, port->dev->addr_len);
+                dev_set_mac_address(port->dev, &sa);
+        }
+
         kfree(port);
 }
 
@@ -1326,7 +1383,7 @@ int macvlan_common_newlink(struct net *src_net, struct net_device *dev,
         port = macvlan_port_get_rtnl(lowerdev);
 
         /* Only 1 macvlan device can be created in passthru mode */
-        if (port->passthru) {
+        if (macvlan_passthru(port)) {
                 /* The macvlan port must be not created this time,
                  * still goto destroy_macvlan_port for readability.
                  */
@@ -1352,7 +1409,7 @@ int macvlan_common_newlink(struct net *src_net, struct net_device *dev,
                         err = -EINVAL;
                         goto destroy_macvlan_port;
                 }
-                port->passthru = true;
+                macvlan_set_passthru(port);
                 eth_hw_addr_inherit(dev, lowerdev);
         }
 
@@ -1434,7 +1491,7 @@ static int macvlan_changelink(struct net_device *dev,
         if (data && data[IFLA_MACVLAN_FLAGS]) {
                 __u16 flags = nla_get_u16(data[IFLA_MACVLAN_FLAGS]);
                 bool promisc = (flags ^ vlan->flags) & MACVLAN_FLAG_NOPROMISC;
-                if (vlan->port->passthru && promisc) {
+                if (macvlan_passthru(vlan->port) && promisc) {
                         int err;
 
                         if (flags & MACVLAN_FLAG_NOPROMISC)
@@ -1597,7 +1654,7 @@ static int macvlan_device_event(struct notifier_block *unused,
                 }
                 break;
         case NETDEV_CHANGEADDR:
-                if (!port->passthru)
+                if (!macvlan_passthru(port))
                         return NOTIFY_DONE;
 
                 vlan = list_first_entry_or_null(&port->vlans,
diff --git a/drivers/net/netconsole.c b/drivers/net/netconsole.c
index 06ee6395117f..0e27920c2b6b 100644
--- a/drivers/net/netconsole.c
+++ b/drivers/net/netconsole.c
@@ -358,7 +358,7 @@ static ssize_t enabled_store(struct config_item *item,
                 if (err)
                         goto out_unlock;
 
-                pr_info("netconsole: network logging started\n");
+                pr_info("network logging started\n");
         } else {        /* false */
                 /* We need to disable the netconsole before cleaning it up
                  * otherwise we might end up in write_msg() with
diff --git a/drivers/net/nlmon.c b/drivers/net/nlmon.c
index b91603835d26..c4b3362da4a2 100644
--- a/drivers/net/nlmon.c
+++ b/drivers/net/nlmon.c
@@ -113,7 +113,7 @@ static void nlmon_setup(struct net_device *dev)
 
         dev->netdev_ops = &nlmon_ops;
         dev->ethtool_ops = &nlmon_ethtool_ops;
-        dev->destructor = free_netdev;
+        dev->needs_free_netdev = true;
 
         dev->features = NETIF_F_SG | NETIF_F_FRAGLIST |
                         NETIF_F_HIGHDMA | NETIF_F_LLTX;
diff --git a/drivers/net/phy/Kconfig b/drivers/net/phy/Kconfig
index c360dd6ead22..3ab6c58d4be6 100644
--- a/drivers/net/phy/Kconfig
+++ b/drivers/net/phy/Kconfig
@@ -127,6 +127,7 @@ config MDIO_THUNDER
         tristate "ThunderX SOCs MDIO buses"
         depends on 64BIT
         depends on PCI
+        depends on !(MDIO_DEVICE=y && PHYLIB=m)
         select MDIO_CAVIUM
         help
           This driver supports the MDIO interfaces found on Cavium
diff --git a/drivers/net/phy/dp83640.c b/drivers/net/phy/dp83640.c
index ed0d10f54f26..c3065236ffcc 100644
--- a/drivers/net/phy/dp83640.c
+++ b/drivers/net/phy/dp83640.c
@@ -908,7 +908,7 @@ static void decode_txts(struct dp83640_private *dp83640,
         if (overflow) {
                 pr_debug("tx timestamp queue overflow, count %d\n", overflow);
                 while (skb) {
-                        skb_complete_tx_timestamp(skb, NULL);
+                        kfree_skb(skb);
                         skb = skb_dequeue(&dp83640->tx_queue);
                 }
                 return;
diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c
index 9097e42bec2e..57297ba23987 100644
--- a/drivers/net/phy/marvell.c
+++ b/drivers/net/phy/marvell.c
@@ -1127,8 +1127,6 @@ static int marvell_read_status_page(struct phy_device *phydev, int page)
                 if (adv < 0)
                         return adv;
 
-                lpa &= adv;
-
                 if (status & MII_M1011_PHY_STATUS_FULLDUPLEX)
                         phydev->duplex = DUPLEX_FULL;
                 else
diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c
index 8e73f5f36e71..f99c21f78b63 100644
--- a/drivers/net/phy/mdio_bus.c
+++ b/drivers/net/phy/mdio_bus.c
@@ -658,6 +658,18 @@ static int mdio_bus_match(struct device *dev, struct device_driver *drv)
         return 0;
 }
 
+static int mdio_uevent(struct device *dev, struct kobj_uevent_env *env)
+{
+        int rc;
+
+        /* Some devices have extra OF data and an OF-style MODALIAS */
+        rc = of_device_uevent_modalias(dev, env);
+        if (rc != -ENODEV)
+                return rc;
+
+        return 0;
+}
+
 #ifdef CONFIG_PM
 static int mdio_bus_suspend(struct device *dev)
 {
@@ -708,6 +720,7 @@ static const struct dev_pm_ops mdio_bus_pm_ops = {
 struct bus_type mdio_bus_type = {
         .name           = "mdio_bus",
         .match          = mdio_bus_match,
+        .uevent         = mdio_uevent,
         .pm             = MDIO_BUS_PM_OPS,
 };
 EXPORT_SYMBOL(mdio_bus_type);
diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c
index 6a5fd18f062c..8b2038844ba9 100644
--- a/drivers/net/phy/micrel.c
+++ b/drivers/net/phy/micrel.c
@@ -268,23 +268,12 @@ out:
         return ret;
 }
 
-static int kszphy_config_init(struct phy_device *phydev)
+/* Some config bits need to be set again on resume, handle them here. */
+static int kszphy_config_reset(struct phy_device *phydev)
 {
         struct kszphy_priv *priv = phydev->priv;
-        const struct kszphy_type *type;
         int ret;
 
-        if (!priv)
-                return 0;
-
-        type = priv->type;
-
-        if (type->has_broadcast_disable)
-                kszphy_broadcast_disable(phydev);
-
-        if (type->has_nand_tree_disable)
-                kszphy_nand_tree_disable(phydev);
-
         if (priv->rmii_ref_clk_sel) {
                 ret = kszphy_rmii_clk_sel(phydev, priv->rmii_ref_clk_sel_val);
                 if (ret) {
@@ -295,11 +284,30 @@ static int kszphy_config_init(struct phy_device *phydev)
         }
 
         if (priv->led_mode >= 0)
-                kszphy_setup_led(phydev, type->led_mode_reg, priv->led_mode);
+                kszphy_setup_led(phydev, priv->type->led_mode_reg, priv->led_mode);
 
         return 0;
 }
 
+static int kszphy_config_init(struct phy_device *phydev)
+{
+        struct kszphy_priv *priv = phydev->priv;
+        const struct kszphy_type *type;
+
+        if (!priv)
+                return 0;
+
+        type = priv->type;
+
+        if (type->has_broadcast_disable)
+                kszphy_broadcast_disable(phydev);
+
+        if (type->has_nand_tree_disable)
+                kszphy_nand_tree_disable(phydev);
+
+        return kszphy_config_reset(phydev);
+}
+
 static int ksz8041_config_init(struct phy_device *phydev)
 {
         struct device_node *of_node = phydev->mdio.dev.of_node;
@@ -611,6 +619,8 @@ static int ksz9031_read_status(struct phy_device *phydev)
         if ((regval & 0xFF) == 0xFF) {
                 phy_init_hw(phydev);
                 phydev->link = 0;
+                if (phydev->drv->config_intr && phy_interrupt_is_valid(phydev))
+                        phydev->drv->config_intr(phydev);
         }
 
         return 0;
@@ -700,8 +710,14 @@ static int kszphy_suspend(struct phy_device *phydev)
 
 static int kszphy_resume(struct phy_device *phydev)
 {
+        int ret;
+
         genphy_resume(phydev);
 
+        ret = kszphy_config_reset(phydev);
+        if (ret)
+                return ret;
+
         /* Enable PHY Interrupts */
         if (phy_interrupt_is_valid(phydev)) {
                 phydev->interrupts = PHY_INTERRUPT_ENABLED;
diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
index 82ab8fb82587..eebb0e1c70ff 100644
--- a/drivers/net/phy/phy.c
+++ b/drivers/net/phy/phy.c
@@ -54,6 +54,8 @@ static const char *phy_speed_to_str(int speed)
                 return "5Gbps";
         case SPEED_10000:
                 return "10Gbps";
+        case SPEED_14000:
+                return "14Gbps";
         case SPEED_20000:
                 return "20Gbps";
         case SPEED_25000:
@@ -241,7 +243,7 @@ static const struct phy_setting settings[] = {
  * phy_lookup_setting - lookup a PHY setting
  * @speed: speed to match
  * @duplex: duplex to match
- * @feature: allowed link modes
+ * @features: allowed link modes
  * @exact: an exact match is required
  *
  * Search the settings array for a setting that matches the speed and
diff --git a/drivers/net/slip/slip.c b/drivers/net/slip/slip.c
index 1da31dc47f86..74b907206aa7 100644
--- a/drivers/net/slip/slip.c
+++ b/drivers/net/slip/slip.c
@@ -629,7 +629,7 @@ static void sl_uninit(struct net_device *dev)
 static void sl_free_netdev(struct net_device *dev)
 {
         int i = dev->base_addr;
-        free_netdev(dev);
+
         slip_devs[i] = NULL;
 }
 
@@ -651,7 +651,8 @@ static const struct net_device_ops sl_netdev_ops = {
 static void sl_setup(struct net_device *dev)
 {
         dev->netdev_ops         = &sl_netdev_ops;
-        dev->destructor         = sl_free_netdev;
+        dev->needs_free_netdev  = true;
+        dev->priv_destructor    = sl_free_netdev;
 
         dev->hard_header_len    = 0;
         dev->addr_len           = 0;
@@ -1369,8 +1370,6 @@ static void __exit slip_exit(void)
                 if (sl->tty) {
                         printk(KERN_ERR "%s: tty discipline still running\n",
                                dev->name);
-                        /* Intentionally leak the control block. */
-                        dev->destructor = NULL;
                 }
 
                 unregister_netdev(dev);
diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
index 6c5d5ef46f75..fba8c136aa7c 100644
--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -1643,7 +1643,6 @@ static void team_destructor(struct net_device *dev)
         struct team *team = netdev_priv(dev);
 
         free_percpu(team->pcpu_stats);
-        free_netdev(dev);
 }
 
 static int team_open(struct net_device *dev)
@@ -2079,7 +2078,8 @@ static void team_setup(struct net_device *dev)
 
         dev->netdev_ops = &team_netdev_ops;
         dev->ethtool_ops = &team_ethtool_ops;
-        dev->destructor = team_destructor;
+        dev->needs_free_netdev = true;
+        dev->priv_destructor = team_destructor;
         dev->priv_flags &= ~(IFF_XMIT_DST_RELEASE | IFF_TX_SKB_SHARING);
         dev->priv_flags |= IFF_NO_QUEUE;
         dev->priv_flags |= IFF_TEAM;
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index bbd707b9ef7a..9ee7d4275640 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1560,7 +1560,6 @@ static void tun_free_netdev(struct net_device *dev)
         free_percpu(tun->pcpu_stats);
         tun_flow_uninit(tun);
         security_tun_dev_free_security(tun->security);
-        free_netdev(dev);
 }
 
 static void tun_setup(struct net_device *dev)
@@ -1571,7 +1570,8 @@ static void tun_setup(struct net_device *dev)
         tun->group = INVALID_GID;
 
         dev->ethtool_ops = &tun_ethtool_ops;
-        dev->destructor = tun_free_netdev;
+        dev->needs_free_netdev = true;
+        dev->priv_destructor = tun_free_netdev;
         /* We prefer our own queue length */
         dev->tx_queue_len = TUN_READQ_SIZE;
 }
diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c
index 51cf60092a18..4037ab27734a 100644
--- a/drivers/net/usb/ax88179_178a.c
+++ b/drivers/net/usb/ax88179_178a.c
@@ -1722,6 +1722,18 @@ static const struct driver_info lenovo_info = {
         .tx_fixup = ax88179_tx_fixup,
 };
 
+static const struct driver_info belkin_info = {
+        .description = "Belkin USB Ethernet Adapter",
+        .bind   = ax88179_bind,
+        .unbind = ax88179_unbind,
+        .status = ax88179_status,
+        .link_reset = ax88179_link_reset,
+        .reset  = ax88179_reset,
+        .flags  = FLAG_ETHER | FLAG_FRAMING_AX,
+        .rx_fixup = ax88179_rx_fixup,
+        .tx_fixup = ax88179_tx_fixup,
+};
+
 static const struct usb_device_id products[] = {
 {
         /* ASIX AX88179 10/100/1000 */
@@ -1751,6 +1763,10 @@ static const struct usb_device_id products[] = {
         /* Lenovo OneLinkDock Gigabit LAN */
         USB_DEVICE(0x17ef, 0x304b),
         .driver_info = (unsigned long)&lenovo_info,
+}, {
+        /* Belkin B2B128 USB 3.0 Hub + Gigabit Ethernet Adapter */
+        USB_DEVICE(0x050d, 0x0128),
+        .driver_info = (unsigned long)&belkin_info,
 },
         { },
 };
diff --git a/drivers/net/usb/cdc-phonet.c b/drivers/net/usb/cdc-phonet.c
index eb52de8205f0..c7a350bbaaa7 100644
--- a/drivers/net/usb/cdc-phonet.c
+++ b/drivers/net/usb/cdc-phonet.c
@@ -298,7 +298,7 @@ static void usbpn_setup(struct net_device *dev)
         dev->addr_len           = 1;
         dev->tx_queue_len       = 3;
 
-        dev->destructor         = free_netdev;
+        dev->needs_free_netdev  = true;
 }
 
 /*
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 8f923a147fa9..32a22f4e8356 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -123,7 +123,7 @@ static void qmimux_setup(struct net_device *dev)
         dev->addr_len        = 0;
         dev->flags           = IFF_POINTOPOINT | IFF_NOARP | IFF_MULTICAST;
         dev->netdev_ops      = &qmimux_netdev_ops;
-        dev->destructor      = free_netdev;
+        dev->needs_free_netdev = true;
 }
 
 static struct net_device *qmimux_find_dev(struct usbnet *dev, u8 mux_id)
@@ -1192,6 +1192,8 @@ static const struct usb_device_id products[] = {
         {QMI_FIXED_INTF(0x1199, 0x9056, 8)},    /* Sierra Wireless Modem */
         {QMI_FIXED_INTF(0x1199, 0x9057, 8)},
         {QMI_FIXED_INTF(0x1199, 0x9061, 8)},    /* Sierra Wireless Modem */
+        {QMI_FIXED_INTF(0x1199, 0x9063, 8)},    /* Sierra Wireless EM7305 */
+        {QMI_FIXED_INTF(0x1199, 0x9063, 10)},   /* Sierra Wireless EM7305 */
         {QMI_FIXED_INTF(0x1199, 0x9071, 8)},    /* Sierra Wireless MC74xx */
         {QMI_FIXED_INTF(0x1199, 0x9071, 10)},   /* Sierra Wireless MC74xx */
         {QMI_FIXED_INTF(0x1199, 0x9079, 8)},    /* Sierra Wireless EM74xx */
@@ -1206,6 +1208,8 @@ static const struct usb_device_id products[] = {
         {QMI_FIXED_INTF(0x1bc7, 0x1100, 3)},    /* Telit ME910 */
         {QMI_FIXED_INTF(0x1bc7, 0x1200, 5)},    /* Telit LE920 */
         {QMI_QUIRK_SET_DTR(0x1bc7, 0x1201, 2)}, /* Telit LE920, LE920A4 */
+        {QMI_FIXED_INTF(0x1c9e, 0x9801, 3)},    /* Telewell TW-3G HSPA+ */
+        {QMI_FIXED_INTF(0x1c9e, 0x9803, 4)},    /* Telewell TW-3G HSPA+ */
         {QMI_FIXED_INTF(0x1c9e, 0x9b01, 3)},    /* XS Stick W100-2 from 4G Systems */
         {QMI_FIXED_INTF(0x0b3c, 0xc000, 4)},    /* Olivetti Olicard 100 */
         {QMI_FIXED_INTF(0x0b3c, 0xc001, 4)},    /* Olivetti Olicard 120 */
diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index ddc62cb69be8..1a419a45e2a2 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -4368,6 +4368,8 @@ static u8 rtl_get_version(struct usb_interface *intf)
                 break;
         }
 
+        dev_dbg(&intf->dev, "Detected version 0x%04x\n", version);
+
         return version;
 }
 
diff --git a/drivers/net/veth.c b/drivers/net/veth.c
index 38f0f03a29c8..364fa9d11d1a 100644
--- a/drivers/net/veth.c
+++ b/drivers/net/veth.c
@@ -222,7 +222,6 @@ static int veth_dev_init(struct net_device *dev)
 static void veth_dev_free(struct net_device *dev)
 {
         free_percpu(dev->vstats);
-        free_netdev(dev);
 }
 
 #ifdef CONFIG_NET_POLL_CONTROLLER
@@ -317,7 +316,8 @@ static void veth_setup(struct net_device *dev)
                                NETIF_F_HW_VLAN_STAG_TX |
                                NETIF_F_HW_VLAN_CTAG_RX |
                                NETIF_F_HW_VLAN_STAG_RX);
-        dev->destructor = veth_dev_free;
+        dev->needs_free_netdev = true;
+        dev->priv_destructor = veth_dev_free;
         dev->max_mtu = ETH_MAX_MTU;
 
         dev->hw_features = VETH_FEATURES;
@@ -383,7 +383,7 @@ static int veth_newlink(struct net *src_net, struct net_device *dev,
                 tbp = tb;
         }
 
-        if (tbp[IFLA_IFNAME]) {
+        if (ifmp && tbp[IFLA_IFNAME]) {
                 nla_strlcpy(ifname, tbp[IFLA_IFNAME], IFNAMSIZ);
                 name_assign_type = NET_NAME_USER;
         } else {
@@ -402,7 +402,7 @@ static int veth_newlink(struct net *src_net, struct net_device *dev,
                 return PTR_ERR(peer);
         }
 
-        if (tbp[IFLA_ADDRESS] == NULL)
+        if (!ifmp || !tbp[IFLA_ADDRESS])
                 eth_hw_addr_random(peer);
 
         if (ifmp && (dev->ifindex != 0))
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 3e9246cc49c3..143d8a95a60d 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -869,7 +869,7 @@ static unsigned int get_mergeable_buf_len(struct receive_queue *rq,
         unsigned int len;
 
         len = hdr_len + clamp_t(unsigned int, ewma_pkt_len_read(avg_pkt_len),
-                                rq->min_buf_len - hdr_len, PAGE_SIZE - hdr_len);
+                                rq->min_buf_len, PAGE_SIZE - hdr_len);
         return ALIGN(len, L1_CACHE_BYTES);
 }
 
@@ -1797,6 +1797,7 @@ static void virtnet_freeze_down(struct virtio_device *vdev)
         flush_work(&vi->config_work);
 
         netif_device_detach(vi->dev);
+        netif_tx_disable(vi->dev);
         cancel_delayed_work_sync(&vi->refill);
 
         if (netif_running(vi->dev)) {
@@ -2144,7 +2145,8 @@ static unsigned int mergeable_min_buf_len(struct virtnet_info *vi, struct virtqu
         unsigned int buf_len = hdr_len + ETH_HLEN + VLAN_HLEN + packet_len;
         unsigned int min_buf_len = DIV_ROUND_UP(buf_len, rq_size);
 
-        return max(min_buf_len, hdr_len);
+        return max(max(min_buf_len, hdr_len) - hdr_len,
+                   (unsigned int)GOOD_PACKET_LEN);
 }
 
 static int virtnet_find_vqs(struct virtnet_info *vi)
diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c
index db882493875c..022c0b5f9844 100644
--- a/drivers/net/vrf.c
+++ b/drivers/net/vrf.c
@@ -36,12 +36,14 @@
 #include <net/addrconf.h>
 #include <net/l3mdev.h>
 #include <net/fib_rules.h>
+#include <net/netns/generic.h>
 
 #define DRV_NAME        "vrf"
 #define DRV_VERSION     "1.0"
 
 #define FIB_RULE_PREF  1000       /* default preference for FIB rules */
-static bool add_fib_rules = true;
+
+static unsigned int vrf_net_id;
 
 struct net_vrf {
         struct rtable __rcu     *rth;
@@ -1348,7 +1350,7 @@ static void vrf_setup(struct net_device *dev)
         dev->netdev_ops = &vrf_netdev_ops;
         dev->l3mdev_ops = &vrf_l3mdev_ops;
         dev->ethtool_ops = &vrf_ethtool_ops;
-        dev->destructor = free_netdev;
+        dev->needs_free_netdev = true;
 
         /* Fill in device structure with ethernet-generic values. */
         eth_hw_addr_random(dev);
@@ -1394,6 +1396,8 @@ static int vrf_newlink(struct net *src_net, struct net_device *dev,
                        struct nlattr *tb[], struct nlattr *data[])
 {
         struct net_vrf *vrf = netdev_priv(dev);
+        bool *add_fib_rules;
+        struct net *net;
         int err;
 
         if (!data || !data[IFLA_VRF_TABLE])
@@ -1409,13 +1413,15 @@ static int vrf_newlink(struct net *src_net, struct net_device *dev,
         if (err)
                 goto out;
 
-        if (add_fib_rules) {
+        net = dev_net(dev);
+        add_fib_rules = net_generic(net, vrf_net_id);
+        if (*add_fib_rules) {
                 err = vrf_add_fib_rules(dev);
                 if (err) {
                         unregister_netdevice(dev);
                         goto out;
                 }
-                add_fib_rules = false;
+                *add_fib_rules = false;
         }
 
 out:
@@ -1498,16 +1504,38 @@ static struct notifier_block vrf_notifier_block __read_mostly = {
         .notifier_call = vrf_device_event,
 };
 
+/* Initialize per network namespace state */
+static int __net_init vrf_netns_init(struct net *net)
+{
+        bool *add_fib_rules = net_generic(net, vrf_net_id);
+
+        *add_fib_rules = true;
+
+        return 0;
+}
+
+static struct pernet_operations vrf_net_ops __net_initdata = {
+        .init = vrf_netns_init,
+        .id   = &vrf_net_id,
+        .size = sizeof(bool),
+};
+
 static int __init vrf_init_module(void)
 {
         int rc;
 
         register_netdevice_notifier(&vrf_notifier_block);
 
-        rc = rtnl_link_register(&vrf_link_ops);
+        rc = register_pernet_subsys(&vrf_net_ops);
         if (rc < 0)
                 goto error;
 
+        rc = rtnl_link_register(&vrf_link_ops);
+        if (rc < 0) {
+                unregister_pernet_subsys(&vrf_net_ops);
+                goto error;
+        }
+
         return 0;
 
 error:
diff --git a/drivers/net/vsockmon.c b/drivers/net/vsockmon.c
index 7f0136f2dd9d..c28bdce14fd5 100644
--- a/drivers/net/vsockmon.c
+++ b/drivers/net/vsockmon.c
@@ -135,7 +135,7 @@ static void vsockmon_setup(struct net_device *dev)
 
         dev->netdev_ops = &vsockmon_ops;
         dev->ethtool_ops = &vsockmon_ethtool_ops;
-        dev->destructor = free_netdev;
+        dev->needs_free_netdev = true;
 
         dev->features = NETIF_F_SG | NETIF_F_FRAGLIST |
                         NETIF_F_HIGHDMA | NETIF_F_LLTX;
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index 328b4712683c..5fa798a5c9a6 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -59,6 +59,8 @@ static const u8 all_zeros_mac[ETH_ALEN + 2];
 
 static int vxlan_sock_add(struct vxlan_dev *vxlan);
 
+static void vxlan_vs_del_dev(struct vxlan_dev *vxlan);
+
 /* per-network namespace private data for this module */
 struct vxlan_net {
         struct list_head  vxlan_list;
@@ -740,6 +742,22 @@ static void vxlan_fdb_destroy(struct vxlan_dev *vxlan, struct vxlan_fdb *f)
         call_rcu(&f->rcu, vxlan_fdb_free);
 }
 
+static void vxlan_dst_free(struct rcu_head *head)
+{
+        struct vxlan_rdst *rd = container_of(head, struct vxlan_rdst, rcu);
+
+        dst_cache_destroy(&rd->dst_cache);
+        kfree(rd);
+}
+
+static void vxlan_fdb_dst_destroy(struct vxlan_dev *vxlan, struct vxlan_fdb *f,
+                                  struct vxlan_rdst *rd)
+{
+        list_del_rcu(&rd->list);
+        vxlan_fdb_notify(vxlan, f, rd, RTM_DELNEIGH);
+        call_rcu(&rd->rcu, vxlan_dst_free);
+}
+
 static int vxlan_fdb_parse(struct nlattr *tb[], struct vxlan_dev *vxlan,
                            union vxlan_addr *ip, __be16 *port, __be32 *src_vni,
                            __be32 *vni, u32 *ifindex)
@@ -864,9 +882,7 @@ static int __vxlan_fdb_delete(struct vxlan_dev *vxlan,
          * otherwise destroy the fdb entry
          */
         if (rd && !list_is_singular(&f->remotes)) {
-                list_del_rcu(&rd->list);
-                vxlan_fdb_notify(vxlan, f, rd, RTM_DELNEIGH);
-                kfree_rcu(rd, rcu);
+                vxlan_fdb_dst_destroy(vxlan, f, rd);
                 goto out;
         }
 
@@ -1067,6 +1083,8 @@ static void vxlan_sock_release(struct vxlan_dev *vxlan)
         rcu_assign_pointer(vxlan->vn4_sock, NULL);
         synchronize_net();
 
+        vxlan_vs_del_dev(vxlan);
+
         if (__vxlan_sock_release_prep(sock4)) {
                 udp_tunnel_sock_release(sock4->sock);
                 kfree(sock4);
@@ -2342,6 +2360,15 @@ static void vxlan_cleanup(unsigned long arg)
         mod_timer(&vxlan->age_timer, next_timer);
 }
 
+static void vxlan_vs_del_dev(struct vxlan_dev *vxlan)
+{
+        struct vxlan_net *vn = net_generic(vxlan->net, vxlan_net_id);
+
+        spin_lock(&vn->sock_lock);
+        hlist_del_init_rcu(&vxlan->hlist);
+        spin_unlock(&vn->sock_lock);
+}
+
 static void vxlan_vs_add_dev(struct vxlan_sock *vs, struct vxlan_dev *vxlan)
 {
         struct vxlan_net *vn = net_generic(vxlan->net, vxlan_net_id);
@@ -2584,7 +2611,7 @@ static void vxlan_setup(struct net_device *dev)
         eth_hw_addr_random(dev);
         ether_setup(dev);
 
-        dev->destructor = free_netdev;
+        dev->needs_free_netdev = true;
         SET_NETDEV_DEVTYPE(dev, &vxlan_type);
 
         dev->features   |= NETIF_F_LLTX;
@@ -3286,15 +3313,9 @@ static int vxlan_changelink(struct net_device *dev, struct nlattr *tb[],
 static void vxlan_dellink(struct net_device *dev, struct list_head *head)
 {
         struct vxlan_dev *vxlan = netdev_priv(dev);
-        struct vxlan_net *vn = net_generic(vxlan->net, vxlan_net_id);
 
         vxlan_flush(vxlan, true);
 
-        spin_lock(&vn->sock_lock);
-        if (!hlist_unhashed(&vxlan->hlist))
-                hlist_del_rcu(&vxlan->hlist);
-        spin_unlock(&vn->sock_lock);
-
         gro_cells_destroy(&vxlan->gro_cells);
         list_del(&vxlan->next);
         unregister_netdevice_queue(dev, head);
diff --git a/drivers/net/wan/dlci.c b/drivers/net/wan/dlci.c
index 65ee2a6f248c..a0d76f70c428 100644
--- a/drivers/net/wan/dlci.c
+++ b/drivers/net/wan/dlci.c
@@ -475,7 +475,7 @@ static void dlci_setup(struct net_device *dev)
         dev->flags              = 0;
         dev->header_ops         = &dlci_header_ops;
         dev->netdev_ops         = &dlci_netdev_ops;
-        dev->destructor         = free_netdev;
+        dev->needs_free_netdev  = true;
 
         dlp->receive            = dlci_receive;
 
diff --git a/drivers/net/wan/hdlc_fr.c b/drivers/net/wan/hdlc_fr.c
index eb915281197e..78596e42a3f3 100644
--- a/drivers/net/wan/hdlc_fr.c
+++ b/drivers/net/wan/hdlc_fr.c
@@ -1106,7 +1106,7 @@ static int fr_add_pvc(struct net_device *frad, unsigned int dlci, int type)
                 return -EIO;
         }
 
-        dev->destructor = free_netdev;
+        dev->needs_free_netdev = true;
         *get_dev_p(pvc, type) = dev;
         if (!used) {
                 state(hdlc)->dce_changed = 1;
diff --git a/drivers/net/wan/lapbether.c b/drivers/net/wan/lapbether.c
index 9df9ed62beff..63f749078a1f 100644
--- a/drivers/net/wan/lapbether.c
+++ b/drivers/net/wan/lapbether.c
@@ -306,7 +306,7 @@ static const struct net_device_ops lapbeth_netdev_ops = {
 static void lapbeth_setup(struct net_device *dev)
 {
         dev->netdev_ops      = &lapbeth_netdev_ops;
-        dev->destructor      = free_netdev;
+        dev->needs_free_netdev = true;
         dev->type            = ARPHRD_X25;
         dev->hard_header_len = 3;
         dev->mtu             = 1000;
diff --git a/drivers/net/wireless/ath/ath6kl/main.c b/drivers/net/wireless/ath/ath6kl/main.c
index 91ee542de3d7..b90c77ef792e 100644
--- a/drivers/net/wireless/ath/ath6kl/main.c
+++ b/drivers/net/wireless/ath/ath6kl/main.c
@@ -1287,7 +1287,7 @@ void init_netdev(struct net_device *dev)
         struct ath6kl *ar = ath6kl_priv(dev);
 
         dev->netdev_ops = &ath6kl_netdev_ops;
-        dev->destructor = free_netdev;
+        dev->needs_free_netdev = true;
         dev->watchdog_timeo = ATH6KL_TX_TIMEOUT;
 
         dev->needed_headroom = ETH_HLEN;
diff --git a/drivers/net/wireless/ath/wcn36xx/main.c b/drivers/net/wireless/ath/wcn36xx/main.c
index d5e993dc9b23..517a315e259b 100644
--- a/drivers/net/wireless/ath/wcn36xx/main.c
+++ b/drivers/net/wireless/ath/wcn36xx/main.c
@@ -1271,6 +1271,8 @@ static int wcn36xx_remove(struct platform_device *pdev)
         qcom_smem_state_put(wcn->tx_enable_state);
         qcom_smem_state_put(wcn->tx_rings_empty_state);
 
+        rpmsg_destroy_ept(wcn->smd_channel);
+
         iounmap(wcn->dxe_base);
         iounmap(wcn->ccu_base);
 
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
index cd1d6730eab7..617199c0e5a0 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
@@ -5225,7 +5225,6 @@ void brcmf_cfg80211_free_netdev(struct net_device *ndev)
 
         if (vif)
                 brcmf_free_vif(vif);
-        free_netdev(ndev);
 }
 
 static bool brcmf_is_linkup(const struct brcmf_event_msg *e)
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
index a3d82368f1a9..511d190c6cca 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
@@ -624,7 +624,8 @@ struct brcmf_if *brcmf_add_if(struct brcmf_pub *drvr, s32 bsscfgidx, s32 ifidx,
                 if (!ndev)
                         return ERR_PTR(-ENOMEM);
 
-                ndev->destructor = brcmf_cfg80211_free_netdev;
+                ndev->needs_free_netdev = true;
+                ndev->priv_destructor = brcmf_cfg80211_free_netdev;
                 ifp = netdev_priv(ndev);
                 ifp->ndev = ndev;
                 /* store mapping ifidx to bsscfgidx */
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
index c7c1e9906500..d231042f19d6 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
@@ -442,7 +442,7 @@ struct brcmf_fw {
         const char *nvram_name;
         u16 domain_nr;
         u16 bus_nr;
-        void (*done)(struct device *dev, const struct firmware *fw,
+        void (*done)(struct device *dev, int err, const struct firmware *fw,
                      void *nvram_image, u32 nvram_len);
 };
 
@@ -477,52 +477,51 @@ static void brcmf_fw_request_nvram_done(const struct firmware *fw, void *ctx)
         if (!nvram && !(fwctx->flags & BRCMF_FW_REQ_NV_OPTIONAL))
                 goto fail;
 
-        fwctx->done(fwctx->dev, fwctx->code, nvram, nvram_length);
+        fwctx->done(fwctx->dev, 0, fwctx->code, nvram, nvram_length);
         kfree(fwctx);
         return;
 
 fail:
         brcmf_dbg(TRACE, "failed: dev=%s\n", dev_name(fwctx->dev));
         release_firmware(fwctx->code);
-        device_release_driver(fwctx->dev);
+        fwctx->done(fwctx->dev, -ENOENT, NULL, NULL, 0);
         kfree(fwctx);
 }
 
 static void brcmf_fw_request_code_done(const struct firmware *fw, void *ctx)
 {
         struct brcmf_fw *fwctx = ctx;
-        int ret;
+        int ret = 0;
 
         brcmf_dbg(TRACE, "enter: dev=%s\n", dev_name(fwctx->dev));
-        if (!fw)
+        if (!fw) {
+                ret = -ENOENT;
                 goto fail;
-
-        /* only requested code so done here */
-        if (!(fwctx->flags & BRCMF_FW_REQUEST_NVRAM)) {
-                fwctx->done(fwctx->dev, fw, NULL, 0);
-                kfree(fwctx);
-                return;
         }
+        /* only requested code so done here */
+        if (!(fwctx->flags & BRCMF_FW_REQUEST_NVRAM))
+                goto done;
+
         fwctx->code = fw;
         ret = request_firmware_nowait(THIS_MODULE, true, fwctx->nvram_name,
                                       fwctx->dev, GFP_KERNEL, fwctx,
                                       brcmf_fw_request_nvram_done);
 
-        if (!ret)
-                return;
-
-        brcmf_fw_request_nvram_done(NULL, fwctx);
+        /* pass NULL to nvram callback for bcm47xx fallback */
+        if (ret)
+                brcmf_fw_request_nvram_done(NULL, fwctx);
         return;
 
 fail:
         brcmf_dbg(TRACE, "failed: dev=%s\n", dev_name(fwctx->dev));
-        device_release_driver(fwctx->dev);
+done:
+        fwctx->done(fwctx->dev, ret, fw, NULL, 0);
         kfree(fwctx);
 }
 
 int brcmf_fw_get_firmwares_pcie(struct device *dev, u16 flags,
                                 const char *code, const char *nvram,
-                                void (*fw_cb)(struct device *dev,
+                                void (*fw_cb)(struct device *dev, int err,
                                               const struct firmware *fw,
                                               void *nvram_image, u32 nvram_len),
                                 u16 domain_nr, u16 bus_nr)
@@ -555,7 +554,7 @@ int brcmf_fw_get_firmwares_pcie(struct device *dev, u16 flags,
 
 int brcmf_fw_get_firmwares(struct device *dev, u16 flags,
                            const char *code, const char *nvram,
-                           void (*fw_cb)(struct device *dev,
+                           void (*fw_cb)(struct device *dev, int err,
                                          const struct firmware *fw,
                                          void *nvram_image, u32 nvram_len))
 {
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.h
index d3c9f0d52ae3..8fa4b7e1ab3d 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.h
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.h
@@ -73,13 +73,13 @@ void brcmf_fw_nvram_free(void *nvram);
  */
 int brcmf_fw_get_firmwares_pcie(struct device *dev, u16 flags,
                                 const char *code, const char *nvram,
-                                void (*fw_cb)(struct device *dev,
+                                void (*fw_cb)(struct device *dev, int err,
                                               const struct firmware *fw,
                                               void *nvram_image, u32 nvram_len),
                                 u16 domain_nr, u16 bus_nr);
 int brcmf_fw_get_firmwares(struct device *dev, u16 flags,
                            const char *code, const char *nvram,
-                           void (*fw_cb)(struct device *dev,
+                           void (*fw_cb)(struct device *dev, int err,
                                          const struct firmware *fw,
                                          void *nvram_image, u32 nvram_len));
 
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
index 72373e59308e..f59642b2c935 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
@@ -2145,7 +2145,7 @@ void brcmf_fws_add_interface(struct brcmf_if *ifp)
         struct brcmf_fws_info *fws = drvr_to_fws(ifp->drvr);
         struct brcmf_fws_mac_descriptor *entry;
 
-        if (!ifp->ndev || fws->fcmode == BRCMF_FWS_FCMODE_NONE)
+        if (!ifp->ndev || !brcmf_fws_queue_skbs(fws))
                 return;
 
         entry = &fws->desc.iface[ifp->ifidx];
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
index f36b96dc6acd..f878706613e6 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
@@ -1650,16 +1650,23 @@ static const struct brcmf_buscore_ops brcmf_pcie_buscore_ops = {
         .write32 = brcmf_pcie_buscore_write32,
 };
 
-static void brcmf_pcie_setup(struct device *dev, const struct firmware *fw,
+static void brcmf_pcie_setup(struct device *dev, int ret,
+                             const struct firmware *fw,
                              void *nvram, u32 nvram_len)
 {
-        struct brcmf_bus *bus = dev_get_drvdata(dev);
-        struct brcmf_pciedev *pcie_bus_dev = bus->bus_priv.pcie;
-        struct brcmf_pciedev_info *devinfo = pcie_bus_dev->devinfo;
+        struct brcmf_bus *bus;
+        struct brcmf_pciedev *pcie_bus_dev;
+        struct brcmf_pciedev_info *devinfo;
         struct brcmf_commonring **flowrings;
-        int ret;
         u32 i;
 
+        /* check firmware loading result */
+        if (ret)
+                goto fail;
+
+        bus = dev_get_drvdata(dev);
+        pcie_bus_dev = bus->bus_priv.pcie;
+        devinfo = pcie_bus_dev->devinfo;
         brcmf_pcie_attach(devinfo);
 
         /* Some of the firmwares have the size of the memory of the device
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
index fc64b8913aa6..5653d6dd38f6 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
@@ -3422,7 +3422,7 @@ static int brcmf_sdio_bus_preinit(struct device *dev)
                 /* otherwise, set txglomalign */
                 value = sdiodev->settings->bus.sdio.sd_sgentry_align;
                 /* SDIO ADMA requires at least 32 bit alignment */
-                value = max_t(u32, value, 4);
+                value = max_t(u32, value, ALIGNMENT);
                 err = brcmf_iovar_data_set(dev, "bus:txglomalign", &value,
                                            sizeof(u32));
         }
@@ -3982,21 +3982,26 @@ static const struct brcmf_bus_ops brcmf_sdio_bus_ops = {
         .get_memdump = brcmf_sdio_bus_get_memdump,
 };
 
-static void brcmf_sdio_firmware_callback(struct device *dev,
+static void brcmf_sdio_firmware_callback(struct device *dev, int err,
                                          const struct firmware *code,
                                          void *nvram, u32 nvram_len)
 {
-        struct brcmf_bus *bus_if = dev_get_drvdata(dev);
-        struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
-        struct brcmf_sdio *bus = sdiodev->bus;
-        int err = 0;
+        struct brcmf_bus *bus_if;
+        struct brcmf_sdio_dev *sdiodev;
+        struct brcmf_sdio *bus;
         u8 saveclk;
 
-        brcmf_dbg(TRACE, "Enter: dev=%s\n", dev_name(dev));
+        brcmf_dbg(TRACE, "Enter: dev=%s, err=%d\n", dev_name(dev), err);
+        bus_if = dev_get_drvdata(dev);
+        sdiodev = bus_if->bus_priv.sdio;
+        if (err)
+                goto fail;
 
         if (!bus_if->drvr)
                 return;
 
+        bus = sdiodev->bus;
+
         /* try to download image and nvram to the dongle */
         bus->alp_only = true;
         err = brcmf_sdio_download_firmware(bus, code, nvram, nvram_len);
@@ -4083,6 +4088,7 @@ release:
 fail:
         brcmf_dbg(TRACE, "failed: dev=%s, err=%d\n", dev_name(dev), err);
         device_release_driver(dev);
+        device_release_driver(&sdiodev->func[2]->dev);
 }
 
 struct brcmf_sdio *brcmf_sdio_probe(struct brcmf_sdio_dev *sdiodev)
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
index e4d545f9edee..0eea48e73331 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
@@ -1159,17 +1159,18 @@ fail:
         return ret;
 }
 
-static void brcmf_usb_probe_phase2(struct device *dev,
+static void brcmf_usb_probe_phase2(struct device *dev, int ret,
                                    const struct firmware *fw,
                                    void *nvram, u32 nvlen)
 {
         struct brcmf_bus *bus = dev_get_drvdata(dev);
-        struct brcmf_usbdev_info *devinfo;
-        int ret;
+        struct brcmf_usbdev_info *devinfo = bus->bus_priv.usb->devinfo;
+
+        if (ret)
+                goto error;
 
         brcmf_dbg(USB, "Start fw downloading\n");
 
-        devinfo = bus->bus_priv.usb->devinfo;
         ret = check_file(fw->data);
         if (ret < 0) {
                 brcmf_err("invalid firmware\n");
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-7000.c b/drivers/net/wireless/intel/iwlwifi/iwl-7000.c
index 3b3e076571d6..45e2efc70d19 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-7000.c
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-7000.c
@@ -79,8 +79,8 @@
 /* Lowest firmware API version supported */
 #define IWL7260_UCODE_API_MIN   17
 #define IWL7265_UCODE_API_MIN   17
-#define IWL7265D_UCODE_API_MIN  17
-#define IWL3168_UCODE_API_MIN   20
+#define IWL7265D_UCODE_API_MIN  22
+#define IWL3168_UCODE_API_MIN   22
 
 /* NVM versions */
 #define IWL7260_NVM_VERSION             0x0a1d
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-8000.c b/drivers/net/wireless/intel/iwlwifi/iwl-8000.c
index b9718c0cf174..89137717c1fc 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-8000.c
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-8000.c
@@ -74,8 +74,8 @@
 #define IWL8265_UCODE_API_MAX   30
 
 /* Lowest firmware API version supported */
-#define IWL8000_UCODE_API_MIN   17
-#define IWL8265_UCODE_API_MIN   20
+#define IWL8000_UCODE_API_MIN   22
+#define IWL8265_UCODE_API_MIN   22
 
 /* NVM versions */
 #define IWL8000_NVM_VERSION             0x0a1d
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-prph.h b/drivers/net/wireless/intel/iwlwifi/iwl-prph.h
index 306bc967742e..77efbb78e867 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-prph.h
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-prph.h
@@ -370,6 +370,7 @@
 #define MON_DMARB_RD_DATA_ADDR          (0xa03c5c)
 
 #define DBGC_IN_SAMPLE                  (0xa03c00)
+#define DBGC_OUT_CTRL                   (0xa03c0c)
 
 /* enable the ID buf for read */
 #define WFPM_PS_CTL_CLR                 0xA0300C
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw-api-rs.h b/drivers/net/wireless/intel/iwlwifi/mvm/fw-api-rs.h
index 1b7d265ffb0a..a10c6aae9ab9 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw-api-rs.h
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw-api-rs.h
@@ -307,6 +307,11 @@ enum {
 /* Bit 1-3: LQ command color. Used to match responses to LQ commands */
 #define LQ_FLAG_COLOR_POS               1
 #define LQ_FLAG_COLOR_MSK               (7 << LQ_FLAG_COLOR_POS)
+#define LQ_FLAG_COLOR_GET(_f)           (((_f) & LQ_FLAG_COLOR_MSK) >>\
+                                         LQ_FLAG_COLOR_POS)
+#define LQ_FLAGS_COLOR_INC(_c)          ((((_c) + 1) << LQ_FLAG_COLOR_POS) &\
+                                         LQ_FLAG_COLOR_MSK)
+#define LQ_FLAG_COLOR_SET(_f, _c)       ((_c) | ((_f) & ~LQ_FLAG_COLOR_MSK))
 
 /* Bit 4-5: Tx RTS BW Signalling
  * (0) No RTS BW signalling
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw-api-tx.h b/drivers/net/wireless/intel/iwlwifi/mvm/fw-api-tx.h
index 81b98915b1a4..1360ebfdc51b 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw-api-tx.h
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw-api-tx.h
@@ -519,8 +519,11 @@ struct agg_tx_status {
  * bit-7 invalid rate indication
  */
 #define TX_RES_INIT_RATE_INDEX_MSK 0x0f
+#define TX_RES_RATE_TABLE_COLOR_POS 4
 #define TX_RES_RATE_TABLE_COLOR_MSK 0x70
 #define TX_RES_INV_RATE_INDEX_MSK 0x80
+#define TX_RES_RATE_TABLE_COL_GET(_f) (((_f) & TX_RES_RATE_TABLE_COLOR_MSK) >>\
+                                       TX_RES_RATE_TABLE_COLOR_POS)
 
 #define IWL_MVM_TX_RES_GET_TID(_ra_tid) ((_ra_tid) & 0x0f)
 #define IWL_MVM_TX_RES_GET_RA(_ra_tid) ((_ra_tid) >> 4)
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c
index 7b86a4f1b574..c8712e6eea74 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c
@@ -1002,14 +1002,6 @@ int iwl_mvm_fw_dbg_collect_trig(struct iwl_mvm *mvm,
         return 0;
 }
 
-static inline void iwl_mvm_restart_early_start(struct iwl_mvm *mvm)
-{
-        if (mvm->cfg->device_family == IWL_DEVICE_FAMILY_7000)
-                iwl_clear_bits_prph(mvm->trans, MON_BUFF_SAMPLE_CTL, 0x100);
-        else
-                iwl_write_prph(mvm->trans, DBGC_IN_SAMPLE, 1);
-}
-
 int iwl_mvm_start_fw_dbg_conf(struct iwl_mvm *mvm, u8 conf_id)
 {
         u8 *ptr;
@@ -1023,10 +1015,8 @@ int iwl_mvm_start_fw_dbg_conf(struct iwl_mvm *mvm, u8 conf_id)
         /* EARLY START - firmware's configuration is hard coded */
         if ((!mvm->fw->dbg_conf_tlv[conf_id] ||
              !mvm->fw->dbg_conf_tlv[conf_id]->num_of_hcmds) &&
-            conf_id == FW_DBG_START_FROM_ALIVE) {
-                iwl_mvm_restart_early_start(mvm);
+            conf_id == FW_DBG_START_FROM_ALIVE)
                 return 0;
-        }
 
         if (!mvm->fw->dbg_conf_tlv[conf_id])
                 return -EINVAL;
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
index 0f1831b41915..fd2fc46e2fe5 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
@@ -1040,7 +1040,7 @@ static int iwl_mvm_mac_ctxt_send_beacon(struct iwl_mvm *mvm,
                 struct iwl_mac_beacon_cmd_v6 beacon_cmd_v6;
                 struct iwl_mac_beacon_cmd_v7 beacon_cmd;
         } u = {};
-        struct iwl_mac_beacon_cmd beacon_cmd;
+        struct iwl_mac_beacon_cmd beacon_cmd = {};
         struct ieee80211_tx_info *info;
         u32 beacon_skb_len;
         u32 rate, tx_flags;
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
index 4e74a6b90e70..52f8d7a6a7dc 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
@@ -1730,8 +1730,11 @@ int iwl_mvm_find_free_queue(struct iwl_mvm *mvm, u8 sta_id, u8 minq, u8 maxq);
  */
 static inline u32 iwl_mvm_flushable_queues(struct iwl_mvm *mvm)
 {
+        u32 cmd_queue = iwl_mvm_is_dqa_supported(mvm) ? IWL_MVM_DQA_CMD_QUEUE :
+                IWL_MVM_CMD_QUEUE;
+
         return ((BIT(mvm->cfg->base_params->num_of_queues) - 1) &
-                ~BIT(IWL_MVM_CMD_QUEUE));
+                ~BIT(cmd_queue));
 }
 
 static inline
@@ -1753,6 +1756,7 @@ static inline void iwl_mvm_stop_device(struct iwl_mvm *mvm)
         if (!iwl_mvm_has_new_tx_api(mvm))
                 iwl_free_fw_paging(mvm);
         mvm->ucode_loaded = false;
+        mvm->fw_dbg_conf = FW_DBG_INVALID;
         iwl_trans_stop_device(mvm->trans);
 }
 
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
index 9ffff6ed8133..3da5ec40aaea 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
@@ -1149,21 +1149,37 @@ static void iwl_mvm_fw_error_dump_wk(struct work_struct *work)
 
         mutex_lock(&mvm->mutex);
 
-        /* stop recording */
         if (mvm->cfg->device_family == IWL_DEVICE_FAMILY_7000) {
+                /* stop recording */
                 iwl_set_bits_prph(mvm->trans, MON_BUFF_SAMPLE_CTL, 0x100);
+
+                iwl_mvm_fw_error_dump(mvm);
+
+                /* start recording again if the firmware is not crashed */
+                if (!test_bit(STATUS_FW_ERROR, &mvm->trans->status) &&
+                    mvm->fw->dbg_dest_tlv)
+                        iwl_clear_bits_prph(mvm->trans,
+                                            MON_BUFF_SAMPLE_CTL, 0x100);
         } else {
+                u32 in_sample = iwl_read_prph(mvm->trans, DBGC_IN_SAMPLE);
+                u32 out_ctrl = iwl_read_prph(mvm->trans, DBGC_OUT_CTRL);
+
+                /* stop recording */
                 iwl_write_prph(mvm->trans, DBGC_IN_SAMPLE, 0);
-                /* wait before we collect the data till the DBGC stop */
                 udelay(100);
-        }
+                iwl_write_prph(mvm->trans, DBGC_OUT_CTRL, 0);
+                /* wait before we collect the data till the DBGC stop */
+                udelay(500);
 
-        iwl_mvm_fw_error_dump(mvm);
+                iwl_mvm_fw_error_dump(mvm);
 
-        /* start recording again if the firmware is not crashed */
-        WARN_ON_ONCE((!test_bit(STATUS_FW_ERROR, &mvm->trans->status)) &&
-                     mvm->fw->dbg_dest_tlv &&
-                     iwl_mvm_start_fw_dbg_conf(mvm, mvm->fw_dbg_conf));
+                /* start recording again if the firmware is not crashed */
+                if (!test_bit(STATUS_FW_ERROR, &mvm->trans->status) &&
+                    mvm->fw->dbg_dest_tlv) {
+                        iwl_write_prph(mvm->trans, DBGC_IN_SAMPLE, in_sample);
+                        iwl_write_prph(mvm->trans, DBGC_OUT_CTRL, out_ctrl);
+                }
+        }
 
         mutex_unlock(&mvm->mutex);
 
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
index 7788eefcd2bd..aa785cf3cf68 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
@@ -2,7 +2,7 @@
  *
  * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
- * Copyright(c) 2016 Intel Deutschland GmbH
+ * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of version 2 of the GNU General Public License as
@@ -1083,34 +1083,6 @@ static void rs_get_lower_rate_down_column(struct iwl_lq_sta *lq_sta,
                 rs_get_lower_rate_in_column(lq_sta, rate);
 }
 
-/* Check if both rates are identical
- * allow_ant_mismatch enables matching a SISO rate on ANT_A or ANT_B
- * with a rate indicating STBC/BFER and ANT_AB.
- */
-static inline bool rs_rate_equal(struct rs_rate *a,
-                                 struct rs_rate *b,
-                                 bool allow_ant_mismatch)
-
-{
-        bool ant_match = (a->ant == b->ant) && (a->stbc == b->stbc) &&
-                (a->bfer == b->bfer);
-
-        if (allow_ant_mismatch) {
-                if (a->stbc || a->bfer) {
-                        WARN_ONCE(a->ant != ANT_AB, "stbc %d bfer %d ant %d",
-                                  a->stbc, a->bfer, a->ant);
-                        ant_match |= (b->ant == ANT_A || b->ant == ANT_B);
-                } else if (b->stbc || b->bfer) {
-                        WARN_ONCE(b->ant != ANT_AB, "stbc %d bfer %d ant %d",
-                                  b->stbc, b->bfer, b->ant);
-                        ant_match |= (a->ant == ANT_A || a->ant == ANT_B);
-                }
-        }
-
-        return (a->type == b->type) && (a->bw == b->bw) && (a->sgi == b->sgi) &&
-                (a->ldpc == b->ldpc) && (a->index == b->index) && ant_match;
-}
-
 /* Check if both rates share the same column */
 static inline bool rs_rate_column_match(struct rs_rate *a,
                                         struct rs_rate *b)
@@ -1182,12 +1154,12 @@ void iwl_mvm_rs_tx_status(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
         u32 lq_hwrate;
         struct rs_rate lq_rate, tx_resp_rate;
         struct iwl_scale_tbl_info *curr_tbl, *other_tbl, *tmp_tbl;
-        u8 reduced_txp = (uintptr_t)info->status.status_driver_data[0];
+        u32 tlc_info = (uintptr_t)info->status.status_driver_data[0];
+        u8 reduced_txp = tlc_info & RS_DRV_DATA_TXP_MSK;
+        u8 lq_color = RS_DRV_DATA_LQ_COLOR_GET(tlc_info);
         u32 tx_resp_hwrate = (uintptr_t)info->status.status_driver_data[1];
         struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
         struct iwl_lq_sta *lq_sta = &mvmsta->lq_sta;
-        bool allow_ant_mismatch = fw_has_api(&mvm->fw->ucode_capa,
-                                             IWL_UCODE_TLV_API_LQ_SS_PARAMS);
 
         /* Treat uninitialized rate scaling data same as non-existing. */
         if (!lq_sta) {
@@ -1262,10 +1234,10 @@ void iwl_mvm_rs_tx_status(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
         rs_rate_from_ucode_rate(lq_hwrate, info->band, &lq_rate);
 
         /* Here we actually compare this rate to the latest LQ command */
-        if (!rs_rate_equal(&tx_resp_rate, &lq_rate, allow_ant_mismatch)) {
+        if (lq_color != LQ_FLAG_COLOR_GET(table->flags)) {
                 IWL_DEBUG_RATE(mvm,
-                               "initial tx resp rate 0x%x does not match 0x%x\n",
-                               tx_resp_hwrate, lq_hwrate);
+                               "tx resp color 0x%x does not match 0x%x\n",
+                               lq_color, LQ_FLAG_COLOR_GET(table->flags));
 
                 /*
                  * Since rates mis-match, the last LQ command may have failed.
@@ -3326,6 +3298,7 @@ static void rs_build_rates_table(struct iwl_mvm *mvm,
         u8 valid_tx_ant = 0;
         struct iwl_lq_cmd *lq_cmd = &lq_sta->lq;
         bool toggle_ant = false;
+        u32 color;
 
         memcpy(&rate, initial_rate, sizeof(rate));
 
@@ -3380,6 +3353,9 @@ static void rs_build_rates_table(struct iwl_mvm *mvm,
                                  num_rates, num_retries, valid_tx_ant,
                                  toggle_ant);
 
+        /* update the color of the LQ command (as a counter at bits 1-3) */
+        color = LQ_FLAGS_COLOR_INC(LQ_FLAG_COLOR_GET(lq_cmd->flags));
+        lq_cmd->flags = LQ_FLAG_COLOR_SET(lq_cmd->flags, color);
 }
 
 struct rs_bfer_active_iter_data {
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rs.h b/drivers/net/wireless/intel/iwlwifi/mvm/rs.h
index ee207f2c0a90..3abde1cb0303 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rs.h
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rs.h
@@ -2,6 +2,7 @@
  *
  * Copyright(c) 2003 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2015 Intel Mobile Communications GmbH
+ * Copyright(c) 2017 Intel Deutschland GmbH
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of version 2 of the GNU General Public License as
@@ -357,6 +358,20 @@ struct iwl_lq_sta {
         } pers;
 };
 
+/* ieee80211_tx_info's status_driver_data[0] is packed with lq color and txp
+ * Note, it's iwlmvm <-> mac80211 interface.
+ * bits 0-7: reduced tx power
+ * bits 8-10: LQ command's color
+ */
+#define RS_DRV_DATA_TXP_MSK 0xff
+#define RS_DRV_DATA_LQ_COLOR_POS 8
+#define RS_DRV_DATA_LQ_COLOR_MSK (7 << RS_DRV_DATA_LQ_COLOR_POS)
+#define RS_DRV_DATA_LQ_COLOR_GET(_f) (((_f) & RS_DRV_DATA_LQ_COLOR_MSK) >>\
+                                      RS_DRV_DATA_LQ_COLOR_POS)
+#define RS_DRV_DATA_PACK(_c, _p) ((void *)(uintptr_t)\
+                                  (((uintptr_t)_p) |\
+                                   ((_c) << RS_DRV_DATA_LQ_COLOR_POS)))
+
 /* Initialize station's rate scaling information after adding station */
 void iwl_mvm_rs_rate_init(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
                           enum nl80211_band band, bool init);
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
index f5c786ddc526..614d67810d05 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
@@ -2120,7 +2120,8 @@ int iwl_mvm_add_mcast_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
         if (!iwl_mvm_is_dqa_supported(mvm))
                 return 0;
 
-        if (WARN_ON(vif->type != NL80211_IFTYPE_AP))
+        if (WARN_ON(vif->type != NL80211_IFTYPE_AP &&
+                    vif->type != NL80211_IFTYPE_ADHOC))
                 return -ENOTSUPP;
 
         /*
@@ -2155,6 +2156,16 @@ int iwl_mvm_add_mcast_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
                 mvmvif->cab_queue = queue;
         } else if (!fw_has_api(&mvm->fw->ucode_capa,
                                IWL_UCODE_TLV_API_STA_TYPE)) {
+                /*
+                 * In IBSS, ieee80211_check_queues() sets the cab_queue to be
+                 * invalid, so make sure we use the queue we want.
+                 * Note that this is done here as we want to avoid making DQA
+                 * changes in mac80211 layer.
+                 */
+                if (vif->type == NL80211_IFTYPE_ADHOC) {
+                        vif->cab_queue = IWL_MVM_DQA_GCAST_QUEUE;
+                        mvmvif->cab_queue = vif->cab_queue;
+                }
                 iwl_mvm_enable_txq(mvm, vif->cab_queue, vif->cab_queue, 0,
                                    &cfg, timeout);
         }
@@ -3321,18 +3332,15 @@ int iwl_mvm_remove_sta_key(struct iwl_mvm *mvm,
 
         /* Get the station from the mvm local station table */
         mvm_sta = iwl_mvm_get_key_sta(mvm, vif, sta);
-        if (!mvm_sta) {
-                IWL_ERR(mvm, "Failed to find station\n");
-                return -EINVAL;
-        }
-        sta_id = mvm_sta->sta_id;
+        if (mvm_sta)
+                sta_id = mvm_sta->sta_id;
 
         IWL_DEBUG_WEP(mvm, "mvm remove dynamic key: idx=%d sta=%d\n",
                       keyconf->keyidx, sta_id);
 
-        if (keyconf->cipher == WLAN_CIPHER_SUITE_AES_CMAC ||
-            keyconf->cipher == WLAN_CIPHER_SUITE_BIP_GMAC_128 ||
-            keyconf->cipher == WLAN_CIPHER_SUITE_BIP_GMAC_256)
+        if (mvm_sta && (keyconf->cipher == WLAN_CIPHER_SUITE_AES_CMAC ||
+                        keyconf->cipher == WLAN_CIPHER_SUITE_BIP_GMAC_128 ||
+                        keyconf->cipher == WLAN_CIPHER_SUITE_BIP_GMAC_256))
                 return iwl_mvm_send_sta_igtk(mvm, keyconf, sta_id, true);
 
         if (!__test_and_clear_bit(keyconf->hw_key_idx, mvm->fw_key_table)) {
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.h b/drivers/net/wireless/intel/iwlwifi/mvm/sta.h
index 2716cb5483bf..ad62b67dceb2 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.h
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.h
@@ -313,6 +313,7 @@ enum iwl_mvm_agg_state {
  *      This is basically (last acked packet++).
  * @rate_n_flags: Rate at which Tx was attempted. Holds the data between the
  *      Tx response (TX_CMD), and the block ack notification (COMPRESSED_BA).
+ * @lq_color: the color of the LQ command as it appears in tx response.
  * @amsdu_in_ampdu_allowed: true if A-MSDU in A-MPDU is allowed.
  * @state: state of the BA agreement establishment / tear down.
  * @txq_id: Tx queue used by the BA session / DQA
@@ -331,6 +332,7 @@ struct iwl_mvm_tid_data {
         u16 next_reclaimed;
         /* The rest is Tx AGG related */
         u32 rate_n_flags;
+        u8 lq_color;
         bool amsdu_in_ampdu_allowed;
         enum iwl_mvm_agg_state state;
         u16 txq_id;
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tt.c b/drivers/net/wireless/intel/iwlwifi/mvm/tt.c
index f9cbd197246f..506d58104e1c 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/tt.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/tt.c
@@ -790,11 +790,13 @@ static int iwl_mvm_tcool_set_cur_state(struct thermal_cooling_device *cdev,
         struct iwl_mvm *mvm = (struct iwl_mvm *)(cdev->devdata);
         int ret;
 
-        if (!mvm->ucode_loaded || !(mvm->cur_ucode == IWL_UCODE_REGULAR))
-                return -EIO;
-
         mutex_lock(&mvm->mutex);
 
+        if (!mvm->ucode_loaded || !(mvm->cur_ucode == IWL_UCODE_REGULAR)) {
+                ret = -EIO;
+                goto unlock;
+        }
+
         if (new_state >= ARRAY_SIZE(iwl_mvm_cdev_budgets)) {
                 ret = -EINVAL;
                 goto unlock;
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
index bcaceb64a6e8..f21901cd4a4f 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
@@ -1323,6 +1323,7 @@ static void iwl_mvm_rx_tx_cmd_single(struct iwl_mvm *mvm,
         struct iwl_mvm_sta *mvmsta;
         struct sk_buff_head skbs;
         u8 skb_freed = 0;
+        u8 lq_color;
         u16 next_reclaimed, seq_ctl;
         bool is_ndp = false;
 
@@ -1405,8 +1406,9 @@ static void iwl_mvm_rx_tx_cmd_single(struct iwl_mvm *mvm,
                 info->status.tx_time =
                         le16_to_cpu(tx_resp->wireless_media_time);
                 BUILD_BUG_ON(ARRAY_SIZE(info->status.status_driver_data) < 1);
+                lq_color = TX_RES_RATE_TABLE_COL_GET(tx_resp->tlc_info);
                 info->status.status_driver_data[0] =
-                                (void *)(uintptr_t)tx_resp->reduced_tpc;
+                        RS_DRV_DATA_PACK(lq_color, tx_resp->reduced_tpc);
 
                 ieee80211_tx_status(mvm->hw, skb);
         }
@@ -1638,6 +1640,9 @@ static void iwl_mvm_rx_tx_cmd_agg(struct iwl_mvm *mvm,
                         le32_to_cpu(tx_resp->initial_rate);
                 mvmsta->tid_data[tid].tx_time =
                         le16_to_cpu(tx_resp->wireless_media_time);
+                mvmsta->tid_data[tid].lq_color =
+                        (tx_resp->tlc_info & TX_RES_RATE_TABLE_COLOR_MSK) >>
+                        TX_RES_RATE_TABLE_COLOR_POS;
         }
 
         rcu_read_unlock();
@@ -1707,6 +1712,11 @@ static void iwl_mvm_tx_reclaim(struct iwl_mvm *mvm, int sta_id, int tid,
         iwl_mvm_check_ratid_empty(mvm, sta, tid);
 
         freed = 0;
+
+        /* pack lq color from tid_data along the reduced txp */
+        ba_info->status.status_driver_data[0] =
+                RS_DRV_DATA_PACK(tid_data->lq_color,
+                                 ba_info->status.status_driver_data[0]);
         ba_info->status.status_driver_data[1] = (void *)(uintptr_t)rate;
 
         skb_queue_walk(&reclaimed_skbs, skb) {
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
index 70acf850a9f1..93cbc7a69bcd 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
@@ -2803,7 +2803,8 @@ static struct iwl_trans_dump_data
 #ifdef CONFIG_PM_SLEEP
 static int iwl_trans_pcie_suspend(struct iwl_trans *trans)
 {
-        if (trans->runtime_pm_mode == IWL_PLAT_PM_MODE_D0I3)
+        if (trans->runtime_pm_mode == IWL_PLAT_PM_MODE_D0I3 &&
+            (trans->system_pm_mode == IWL_PLAT_PM_MODE_D0I3))
                 return iwl_pci_fw_enter_d0i3(trans);
 
         return 0;
@@ -2811,7 +2812,8 @@ static int iwl_trans_pcie_suspend(struct iwl_trans *trans)
 
 static void iwl_trans_pcie_resume(struct iwl_trans *trans)
 {
-        if (trans->runtime_pm_mode == IWL_PLAT_PM_MODE_D0I3)
+        if (trans->runtime_pm_mode == IWL_PLAT_PM_MODE_D0I3 &&
+            (trans->system_pm_mode == IWL_PLAT_PM_MODE_D0I3))
                 iwl_pci_fw_exit_d0i3(trans);
 }
 #endif /* CONFIG_PM_SLEEP */
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c b/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
index 9fb46a6f47cf..9c9bfbbabdf1 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
@@ -906,7 +906,7 @@ int iwl_trans_pcie_dyn_txq_alloc(struct iwl_trans *trans,
 
         if (WARN_ON(iwl_rx_packet_payload_len(hcmd.resp_pkt) != sizeof(*rsp))) {
                 ret = -EINVAL;
-                goto error;
+                goto error_free_resp;
         }
 
         rsp = (void *)hcmd.resp_pkt->data;
@@ -915,13 +915,13 @@ int iwl_trans_pcie_dyn_txq_alloc(struct iwl_trans *trans,
         if (qid > ARRAY_SIZE(trans_pcie->txq)) {
                 WARN_ONCE(1, "queue index %d unsupported", qid);
                 ret = -EIO;
-                goto error;
+                goto error_free_resp;
         }
 
         if (test_and_set_bit(qid, trans_pcie->queue_used)) {
                 WARN_ONCE(1, "queue %d already used", qid);
                 ret = -EIO;
-                goto error;
+                goto error_free_resp;
         }
 
         txq->id = qid;
@@ -934,8 +934,11 @@ int iwl_trans_pcie_dyn_txq_alloc(struct iwl_trans *trans,
                            (txq->write_ptr) | (qid << 16));
         IWL_DEBUG_TX_QUEUES(trans, "Activate queue %d\n", qid);
 
+        iwl_free_resp(&hcmd);
         return qid;
 
+error_free_resp:
+        iwl_free_resp(&hcmd);
 error:
         iwl_pcie_gen2_txq_free_memory(trans, txq);
         return ret;
diff --git a/drivers/net/wireless/intersil/hostap/hostap_main.c b/drivers/net/wireless/intersil/hostap/hostap_main.c
index 544fc09dcb62..1372b20f931e 100644
--- a/drivers/net/wireless/intersil/hostap/hostap_main.c
+++ b/drivers/net/wireless/intersil/hostap/hostap_main.c
@@ -73,7 +73,7 @@ struct net_device * hostap_add_interface(struct local_info *local,
         dev->mem_end = mdev->mem_end;
 
         hostap_setup_dev(dev, local, type);
-        dev->destructor = free_netdev;
+        dev->needs_free_netdev = true;
 
         sprintf(dev->name, "%s%s", prefix, name);
         if (!rtnl_locked)
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index 002b25cff5b6..c854a557998b 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -2861,7 +2861,7 @@ static const struct net_device_ops hwsim_netdev_ops = {
 static void hwsim_mon_setup(struct net_device *dev)
 {
         dev->netdev_ops = &hwsim_netdev_ops;
-        dev->destructor = free_netdev;
+        dev->needs_free_netdev = true;
         ether_setup(dev);
         dev->priv_flags |= IFF_NO_QUEUE;
         dev->type = ARPHRD_IEEE80211_RADIOTAP;
diff --git a/drivers/net/wireless/marvell/mwifiex/main.c b/drivers/net/wireless/marvell/mwifiex/main.c
index dd87b9ff64c3..39b6b5e3f6e0 100644
--- a/drivers/net/wireless/marvell/mwifiex/main.c
+++ b/drivers/net/wireless/marvell/mwifiex/main.c
@@ -1280,7 +1280,7 @@ void mwifiex_init_priv_params(struct mwifiex_private *priv,
                               struct net_device *dev)
 {
         dev->netdev_ops = &mwifiex_netdev_ops;
-        dev->destructor = free_netdev;
+        dev->needs_free_netdev = true;
         /* Initialize private structure */
         priv->current_key_index = 0;
         priv->media_connected = false;
diff --git a/drivers/net/xen-netback/common.h b/drivers/net/xen-netback/common.h
index 530586be05b4..5b1d2e8402d9 100644
--- a/drivers/net/xen-netback/common.h
+++ b/drivers/net/xen-netback/common.h
@@ -199,6 +199,7 @@ struct xenvif_queue { /* Per-queue data for xenvif */
         unsigned long   remaining_credit;
         struct timer_list credit_timeout;
         u64 credit_window_start;
+        bool rate_limited;
 
         /* Statistics */
         struct xenvif_stats stats;
diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
index 8397f6c92451..e322a862ddfe 100644
--- a/drivers/net/xen-netback/interface.c
+++ b/drivers/net/xen-netback/interface.c
@@ -106,7 +106,11 @@ static int xenvif_poll(struct napi_struct *napi, int budget)
 
         if (work_done < budget) {
                 napi_complete_done(napi, work_done);
-                xenvif_napi_schedule_or_enable_events(queue);
+                /* If the queue is rate-limited, it shall be
+                 * rescheduled in the timer callback.
+                 */
+                if (likely(!queue->rate_limited))
+                        xenvif_napi_schedule_or_enable_events(queue);
         }
 
         return work_done;
diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index 602d408fa25e..5042ff8d449a 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -180,6 +180,7 @@ static void tx_add_credit(struct xenvif_queue *queue)
                 max_credit = ULONG_MAX; /* wrapped: clamp to ULONG_MAX */
 
         queue->remaining_credit = min(max_credit, max_burst);
+        queue->rate_limited = false;
 }
 
 void xenvif_tx_credit_callback(unsigned long data)
@@ -686,8 +687,10 @@ static bool tx_credit_exceeded(struct xenvif_queue *queue, unsigned size)
                 msecs_to_jiffies(queue->credit_usec / 1000);
 
         /* Timer could already be pending in rare cases. */
-        if (timer_pending(&queue->credit_timeout))
+        if (timer_pending(&queue->credit_timeout)) {
+                queue->rate_limited = true;
                 return true;
+        }
 
         /* Passed the point where we can replenish credit? */
         if (time_after_eq64(now, next_credit)) {
@@ -702,6 +705,7 @@ static bool tx_credit_exceeded(struct xenvif_queue *queue, unsigned size)
                 mod_timer(&queue->credit_timeout,
                           next_credit);
                 queue->credit_window_start = next_credit;
+                queue->rate_limited = true;
 
                 return true;
         }
diff --git a/drivers/ntb/hw/intel/ntb_hw_intel.c b/drivers/ntb/hw/intel/ntb_hw_intel.c
index c00238491673..7b3b6fd63d7d 100644
--- a/drivers/ntb/hw/intel/ntb_hw_intel.c
+++ b/drivers/ntb/hw/intel/ntb_hw_intel.c
@@ -2878,7 +2878,7 @@ static const struct intel_ntb_reg skx_reg = {
         .link_is_up             = xeon_link_is_up,
         .db_ioread              = skx_db_ioread,
         .db_iowrite             = skx_db_iowrite,
-        .db_size                = sizeof(u64),
+        .db_size                = sizeof(u32),
         .ntb_ctl                = SKX_NTBCNTL_OFFSET,
         .mw_bar                 = {2, 4},
 };
diff --git a/drivers/ntb/ntb_transport.c b/drivers/ntb/ntb_transport.c
index 02ca45fdd892..10e5bf460139 100644
--- a/drivers/ntb/ntb_transport.c
+++ b/drivers/ntb/ntb_transport.c
@@ -177,14 +177,12 @@ struct ntb_transport_qp {
         u64 rx_err_ver;
         u64 rx_memcpy;
         u64 rx_async;
-        u64 dma_rx_prep_err;
         u64 tx_bytes;
         u64 tx_pkts;
         u64 tx_ring_full;
         u64 tx_err_no_buf;
         u64 tx_memcpy;
         u64 tx_async;
-        u64 dma_tx_prep_err;
 };
 
 struct ntb_transport_mw {
@@ -254,8 +252,6 @@ enum {
 #define QP_TO_MW(nt, qp)        ((qp) % nt->mw_count)
 #define NTB_QP_DEF_NUM_ENTRIES  100
 #define NTB_LINK_DOWN_TIMEOUT   10
-#define DMA_RETRIES             20
-#define DMA_OUT_RESOURCE_TO     msecs_to_jiffies(50)
 
 static void ntb_transport_rxc_db(unsigned long data);
 static const struct ntb_ctx_ops ntb_transport_ops;
@@ -516,12 +512,6 @@ static ssize_t debugfs_read(struct file *filp, char __user *ubuf, size_t count,
         out_offset += snprintf(buf + out_offset, out_count - out_offset,
                                "free tx - \t%u\n",
                                ntb_transport_tx_free_entry(qp));
-        out_offset += snprintf(buf + out_offset, out_count - out_offset,
-                               "DMA tx prep err - \t%llu\n",
-                               qp->dma_tx_prep_err);
-        out_offset += snprintf(buf + out_offset, out_count - out_offset,
-                               "DMA rx prep err - \t%llu\n",
-                               qp->dma_rx_prep_err);
 
         out_offset += snprintf(buf + out_offset, out_count - out_offset,
                                "\n");
@@ -623,7 +613,7 @@ static int ntb_transport_setup_qp_mw(struct ntb_transport_ctx *nt,
         if (!mw->virt_addr)
                 return -ENOMEM;
 
-        if (qp_count % mw_count && mw_num + 1 < qp_count / mw_count)
+        if (mw_num < qp_count % mw_count)
                 num_qps_mw = qp_count / mw_count + 1;
         else
                 num_qps_mw = qp_count / mw_count;
@@ -768,8 +758,6 @@ static void ntb_qp_link_down_reset(struct ntb_transport_qp *qp)
         qp->tx_err_no_buf = 0;
         qp->tx_memcpy = 0;
         qp->tx_async = 0;
-        qp->dma_tx_prep_err = 0;
-        qp->dma_rx_prep_err = 0;
 }
 
 static void ntb_qp_link_cleanup(struct ntb_transport_qp *qp)
@@ -1000,7 +988,7 @@ static int ntb_transport_init_queue(struct ntb_transport_ctx *nt,
         qp->event_handler = NULL;
         ntb_qp_link_down_reset(qp);
 
-        if (qp_count % mw_count && mw_num + 1 < qp_count / mw_count)
+        if (mw_num < qp_count % mw_count)
                 num_qps_mw = qp_count / mw_count + 1;
         else
                 num_qps_mw = qp_count / mw_count;
@@ -1128,8 +1116,8 @@ static int ntb_transport_probe(struct ntb_client *self, struct ntb_dev *ndev)
         qp_count = ilog2(qp_bitmap);
         if (max_num_clients && max_num_clients < qp_count)
                 qp_count = max_num_clients;
-        else if (mw_count < qp_count)
-                qp_count = mw_count;
+        else if (nt->mw_count < qp_count)
+                qp_count = nt->mw_count;
 
         qp_bitmap &= BIT_ULL(qp_count) - 1;
 
@@ -1317,7 +1305,6 @@ static int ntb_async_rx_submit(struct ntb_queue_entry *entry, void *offset)
         struct dmaengine_unmap_data *unmap;
         dma_cookie_t cookie;
         void *buf = entry->buf;
-        int retries = 0;
 
         len = entry->len;
         device = chan->device;
@@ -1346,22 +1333,11 @@ static int ntb_async_rx_submit(struct ntb_queue_entry *entry, void *offset)
 
         unmap->from_cnt = 1;
 
-        for (retries = 0; retries < DMA_RETRIES; retries++) {
-                txd = device->device_prep_dma_memcpy(chan,
-                                                     unmap->addr[1],
-                                                     unmap->addr[0], len,
-                                                     DMA_PREP_INTERRUPT);
-                if (txd)
-                        break;
-
-                set_current_state(TASK_INTERRUPTIBLE);
-                schedule_timeout(DMA_OUT_RESOURCE_TO);
-        }
-
-        if (!txd) {
-                qp->dma_rx_prep_err++;
+        txd = device->device_prep_dma_memcpy(chan, unmap->addr[1],
+                                             unmap->addr[0], len,
+                                             DMA_PREP_INTERRUPT);
+        if (!txd)
                 goto err_get_unmap;
-        }
 
         txd->callback_result = ntb_rx_copy_callback;
         txd->callback_param = entry;
@@ -1606,7 +1582,6 @@ static int ntb_async_tx_submit(struct ntb_transport_qp *qp,
         struct dmaengine_unmap_data *unmap;
         dma_addr_t dest;
         dma_cookie_t cookie;
-        int retries = 0;
 
         device = chan->device;
         dest = qp->tx_mw_phys + qp->tx_max_frame * entry->tx_index;
@@ -1628,21 +1603,10 @@ static int ntb_async_tx_submit(struct ntb_transport_qp *qp,
 
         unmap->to_cnt = 1;
 
-        for (retries = 0; retries < DMA_RETRIES; retries++) {
-                txd = device->device_prep_dma_memcpy(chan, dest,
-                                                     unmap->addr[0], len,
-                                                     DMA_PREP_INTERRUPT);
-                if (txd)
-                        break;
-
-                set_current_state(TASK_INTERRUPTIBLE);
-                schedule_timeout(DMA_OUT_RESOURCE_TO);
-        }
-
-        if (!txd) {
-                qp->dma_tx_prep_err++;
+        txd = device->device_prep_dma_memcpy(chan, dest, unmap->addr[0], len,
+                                             DMA_PREP_INTERRUPT);
+        if (!txd)
                 goto err_get_unmap;
-        }
 
         txd->callback_result = ntb_tx_copy_callback;
         txd->callback_param = entry;
diff --git a/drivers/ntb/test/ntb_perf.c b/drivers/ntb/test/ntb_perf.c
index 434e1d474f33..5cab2831ce99 100644
--- a/drivers/ntb/test/ntb_perf.c
+++ b/drivers/ntb/test/ntb_perf.c
@@ -90,11 +90,11 @@ MODULE_PARM_DESC(max_mw_size, "Limit size of large memory windows");
 
 static unsigned int seg_order = 19; /* 512K */
 module_param(seg_order, uint, 0644);
-MODULE_PARM_DESC(seg_order, "size order [n^2] of buffer segment for testing");
+MODULE_PARM_DESC(seg_order, "size order [2^n] of buffer segment for testing");
 
 static unsigned int run_order = 32; /* 4G */
 module_param(run_order, uint, 0644);
-MODULE_PARM_DESC(run_order, "size order [n^2] of total data to transfer");
+MODULE_PARM_DESC(run_order, "size order [2^n] of total data to transfer");
 
 static bool use_dma; /* default to 0 */
 module_param(use_dma, bool, 0644);
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index a60926410438..903d5813023a 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -56,7 +56,7 @@ MODULE_PARM_DESC(max_retries, "max number of retries a command may have");
 static int nvme_char_major;
 module_param(nvme_char_major, int, 0);
 
-static unsigned long default_ps_max_latency_us = 25000;
+static unsigned long default_ps_max_latency_us = 100000;
 module_param(default_ps_max_latency_us, ulong, 0644);
 MODULE_PARM_DESC(default_ps_max_latency_us,
                  "max power saving latency for new devices; use PM QOS to change per device");
@@ -1342,7 +1342,7 @@ static void nvme_configure_apst(struct nvme_ctrl *ctrl)
          * transitioning between power states.  Therefore, when running
          * in any given state, we will enter the next lower-power
          * non-operational state after waiting 50 * (enlat + exlat)
-         * microseconds, as long as that state's total latency is under
+         * microseconds, as long as that state's exit latency is under
          * the requested maximum latency.
          *
          * We will not autonomously enter any non-operational state for
@@ -1387,7 +1387,7 @@ static void nvme_configure_apst(struct nvme_ctrl *ctrl)
                  * lowest-power state, not the number of states.
                  */
                 for (state = (int)ctrl->npss; state >= 0; state--) {
-                        u64 total_latency_us, transition_ms;
+                        u64 total_latency_us, exit_latency_us, transition_ms;
 
                         if (target)
                                 table->entries[state] = target;
@@ -1408,12 +1408,15 @@ static void nvme_configure_apst(struct nvme_ctrl *ctrl)
                               NVME_PS_FLAGS_NON_OP_STATE))
                                 continue;
 
-                        total_latency_us =
-                                (u64)le32_to_cpu(ctrl->psd[state].entry_lat) +
-                                + le32_to_cpu(ctrl->psd[state].exit_lat);
-                        if (total_latency_us > ctrl->ps_max_latency_us)
+                        exit_latency_us =
+                                (u64)le32_to_cpu(ctrl->psd[state].exit_lat);
+                        if (exit_latency_us > ctrl->ps_max_latency_us)
                                 continue;
 
+                        total_latency_us =
+                                exit_latency_us +
+                                le32_to_cpu(ctrl->psd[state].entry_lat);
+
                         /*
                          * This state is good.  Use it as the APST idle
                          * target for higher power states.
@@ -2438,6 +2441,10 @@ void nvme_kill_queues(struct nvme_ctrl *ctrl)
         struct nvme_ns *ns;
 
         mutex_lock(&ctrl->namespaces_mutex);
+
+        /* Forcibly start all queues to avoid having stuck requests */
+        blk_mq_start_hw_queues(ctrl->admin_q);
+
         list_for_each_entry(ns, &ctrl->namespaces, list) {
                 /*
                  * Revalidating a dead namespace sets capacity to 0. This will
diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
index 5b14cbefb724..92964cef0f4b 100644
--- a/drivers/nvme/host/fc.c
+++ b/drivers/nvme/host/fc.c
@@ -1139,6 +1139,7 @@ nvme_fc_xmt_disconnect_assoc(struct nvme_fc_ctrl *ctrl)
 /* *********************** NVME Ctrl Routines **************************** */
 
 static void __nvme_fc_final_op_cleanup(struct request *rq);
+static void nvme_fc_error_recovery(struct nvme_fc_ctrl *ctrl, char *errmsg);
 
 static int
 nvme_fc_reinit_request(void *data, struct request *rq)
@@ -1265,7 +1266,7 @@ nvme_fc_fcpio_done(struct nvmefc_fcp_req *req)
         struct nvme_command *sqe = &op->cmd_iu.sqe;
         __le16 status = cpu_to_le16(NVME_SC_SUCCESS << 1);
         union nvme_result result;
-        bool complete_rq;
+        bool complete_rq, terminate_assoc = true;
 
         /*
          * WARNING:
@@ -1294,6 +1295,14 @@ nvme_fc_fcpio_done(struct nvmefc_fcp_req *req)
          * fabricate a CQE, the following fields will not be set as they
          * are not referenced:
          *      cqe.sqid,  cqe.sqhd,  cqe.command_id
+         *
+         * Failure or error of an individual i/o, in a transport
+         * detected fashion unrelated to the nvme completion status,
+         * potentially cause the initiator and target sides to get out
+         * of sync on SQ head/tail (aka outstanding io count allowed).
+         * Per FC-NVME spec, failure of an individual command requires
+         * the connection to be terminated, which in turn requires the
+         * association to be terminated.
          */
 
         fc_dma_sync_single_for_cpu(ctrl->lport->dev, op->fcp_req.rspdma,
@@ -1359,6 +1368,8 @@ nvme_fc_fcpio_done(struct nvmefc_fcp_req *req)
                 goto done;
         }
 
+        terminate_assoc = false;
+
 done:
         if (op->flags & FCOP_FLAGS_AEN) {
                 nvme_complete_async_event(&queue->ctrl->ctrl, status, &result);
@@ -1366,7 +1377,7 @@ done:
                 atomic_set(&op->state, FCPOP_STATE_IDLE);
                 op->flags = FCOP_FLAGS_AEN;     /* clear other flags */
                 nvme_fc_ctrl_put(ctrl);
-                return;
+                goto check_error;
         }
 
         complete_rq = __nvme_fc_fcpop_chk_teardowns(ctrl, op);
@@ -1379,6 +1390,10 @@ done:
                 nvme_end_request(rq, status, result);
         } else
                 __nvme_fc_final_op_cleanup(rq);
+
+check_error:
+        if (terminate_assoc)
+                nvme_fc_error_recovery(ctrl, "transport detected io error");
 }
 
 static int
@@ -2791,6 +2806,7 @@ nvme_fc_init_ctrl(struct device *dev, struct nvmf_ctrl_options *opts,
                 ctrl->ctrl.opts = NULL;
                 /* initiate nvme ctrl ref counting teardown */
                 nvme_uninit_ctrl(&ctrl->ctrl);
+                nvme_put_ctrl(&ctrl->ctrl);
 
                 /* as we're past the point where we transition to the ref
                  * counting teardown path, if we return a bad pointer here,
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index d52701df7245..40c7581caeb0 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -1367,7 +1367,7 @@ static bool nvme_should_reset(struct nvme_dev *dev, u32 csts)
         bool nssro = dev->subsystem && (csts & NVME_CSTS_NSSRO);
 
         /* If there is a reset ongoing, we shouldn't reset again. */
-        if (work_busy(&dev->reset_work))
+        if (dev->ctrl.state == NVME_CTRL_RESETTING)
                 return false;
 
         /* We shouldn't reset unless the controller is on fatal error state
@@ -1805,7 +1805,8 @@ static void nvme_dev_disable(struct nvme_dev *dev, bool shutdown)
         if (pci_is_enabled(pdev)) {
                 u32 csts = readl(dev->bar + NVME_REG_CSTS);
 
-                if (dev->ctrl.state == NVME_CTRL_LIVE)
+                if (dev->ctrl.state == NVME_CTRL_LIVE ||
+                    dev->ctrl.state == NVME_CTRL_RESETTING)
                         nvme_start_freeze(&dev->ctrl);
                 dead = !!((csts & NVME_CSTS_CFS) || !(csts & NVME_CSTS_RDY) ||
                         pdev->error_state  != pci_channel_io_normal);
@@ -1903,7 +1904,7 @@ static void nvme_reset_work(struct work_struct *work)
         bool was_suspend = !!(dev->ctrl.ctrl_config & NVME_CC_SHN_NORMAL);
         int result = -ENODEV;
 
-        if (WARN_ON(dev->ctrl.state == NVME_CTRL_RESETTING))
+        if (WARN_ON(dev->ctrl.state != NVME_CTRL_RESETTING))
                 goto out;
 
         /*
@@ -1913,9 +1914,6 @@ static void nvme_reset_work(struct work_struct *work)
         if (dev->ctrl.ctrl_config & NVME_CC_ENABLE)
                 nvme_dev_disable(dev, false);
 
-        if (!nvme_change_ctrl_state(&dev->ctrl, NVME_CTRL_RESETTING))
-                goto out;
-
         result = nvme_pci_enable(dev);
         if (result)
                 goto out;
@@ -2009,8 +2007,8 @@ static int nvme_reset(struct nvme_dev *dev)
 {
         if (!dev->ctrl.admin_q || blk_queue_dying(dev->ctrl.admin_q))
                 return -ENODEV;
-        if (work_busy(&dev->reset_work))
-                return -ENODEV;
+        if (!nvme_change_ctrl_state(&dev->ctrl, NVME_CTRL_RESETTING))
+                return -EBUSY;
         if (!queue_work(nvme_workq, &dev->reset_work))
                 return -EBUSY;
         return 0;
@@ -2136,6 +2134,7 @@ static int nvme_probe(struct pci_dev *pdev, const struct pci_device_id *id)
         if (result)
                 goto release_pools;
 
+        nvme_change_ctrl_state(&dev->ctrl, NVME_CTRL_RESETTING);
         dev_info(dev->ctrl.device, "pci function %s\n", dev_name(&pdev->dev));
 
         queue_work(nvme_workq, &dev->reset_work);
@@ -2179,6 +2178,7 @@ static void nvme_remove(struct pci_dev *pdev)
 
         nvme_change_ctrl_state(&dev->ctrl, NVME_CTRL_DELETING);
 
+        cancel_work_sync(&dev->reset_work);
         pci_set_drvdata(pdev, NULL);
 
         if (!pci_device_is_present(pdev)) {
diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
index 28bd255c144d..24397d306d53 100644
--- a/drivers/nvme/host/rdma.c
+++ b/drivers/nvme/host/rdma.c
@@ -753,28 +753,26 @@ static void nvme_rdma_reconnect_ctrl_work(struct work_struct *work)
         if (ret)
                 goto requeue;
 
-        blk_mq_start_stopped_hw_queues(ctrl->ctrl.admin_q, true);
-
         ret = nvmf_connect_admin_queue(&ctrl->ctrl);
         if (ret)
-                goto stop_admin_q;
+                goto requeue;
 
         set_bit(NVME_RDMA_Q_LIVE, &ctrl->queues[0].flags);
 
         ret = nvme_enable_ctrl(&ctrl->ctrl, ctrl->cap);
         if (ret)
-                goto stop_admin_q;
+                goto requeue;
 
         nvme_start_keep_alive(&ctrl->ctrl);
 
         if (ctrl->queue_count > 1) {
                 ret = nvme_rdma_init_io_queues(ctrl);
                 if (ret)
-                        goto stop_admin_q;
+                        goto requeue;
 
                 ret = nvme_rdma_connect_io_queues(ctrl);
                 if (ret)
-                        goto stop_admin_q;
+                        goto requeue;
         }
 
         changed = nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_LIVE);
@@ -782,7 +780,6 @@ static void nvme_rdma_reconnect_ctrl_work(struct work_struct *work)
         ctrl->ctrl.opts->nr_reconnects = 0;
 
         if (ctrl->queue_count > 1) {
-                nvme_start_queues(&ctrl->ctrl);
                 nvme_queue_scan(&ctrl->ctrl);
                 nvme_queue_async_events(&ctrl->ctrl);
         }
@@ -791,8 +788,6 @@ static void nvme_rdma_reconnect_ctrl_work(struct work_struct *work)
 
         return;
 
-stop_admin_q:
-        blk_mq_stop_hw_queues(ctrl->ctrl.admin_q);
 requeue:
         dev_info(ctrl->ctrl.device, "Failed reconnect attempt %d\n",
                         ctrl->ctrl.opts->nr_reconnects);
@@ -823,6 +818,13 @@ static void nvme_rdma_error_recovery_work(struct work_struct *work)
         blk_mq_tagset_busy_iter(&ctrl->admin_tag_set,
                                 nvme_cancel_request, &ctrl->ctrl);
 
+        /*
+         * queues are not a live anymore, so restart the queues to fail fast
+         * new IO
+         */
+        blk_mq_start_stopped_hw_queues(ctrl->ctrl.admin_q, true);
+        nvme_start_queues(&ctrl->ctrl);
+
         nvme_rdma_reconnect_or_remove(ctrl);
 }
 
@@ -1433,7 +1435,7 @@ nvme_rdma_timeout(struct request *rq, bool reserved)
 /*
  * We cannot accept any other command until the Connect command has completed.
  */
-static inline bool nvme_rdma_queue_is_ready(struct nvme_rdma_queue *queue,
+static inline int nvme_rdma_queue_is_ready(struct nvme_rdma_queue *queue,
                 struct request *rq)
 {
         if (unlikely(!test_bit(NVME_RDMA_Q_LIVE, &queue->flags))) {
@@ -1441,11 +1443,22 @@ static inline bool nvme_rdma_queue_is_ready(struct nvme_rdma_queue *queue,
 
                 if (!blk_rq_is_passthrough(rq) ||
                     cmd->common.opcode != nvme_fabrics_command ||
-                    cmd->fabrics.fctype != nvme_fabrics_type_connect)
-                        return false;
+                    cmd->fabrics.fctype != nvme_fabrics_type_connect) {
+                        /*
+                         * reconnecting state means transport disruption, which
+                         * can take a long time and even might fail permanently,
+                         * so we can't let incoming I/O be requeued forever.
+                         * fail it fast to allow upper layers a chance to
+                         * failover.
+                         */
+                        if (queue->ctrl->ctrl.state == NVME_CTRL_RECONNECTING)
+                                return -EIO;
+                        else
+                                return -EAGAIN;
+                }
         }
 
-        return true;
+        return 0;
 }
 
 static int nvme_rdma_queue_rq(struct blk_mq_hw_ctx *hctx,
@@ -1463,8 +1476,9 @@ static int nvme_rdma_queue_rq(struct blk_mq_hw_ctx *hctx,
 
         WARN_ON_ONCE(rq->tag < 0);
 
-        if (!nvme_rdma_queue_is_ready(queue, rq))
-                return BLK_MQ_RQ_QUEUE_BUSY;
+        ret = nvme_rdma_queue_is_ready(queue, rq);
+        if (unlikely(ret))
+                goto err;
 
         dev = queue->device->dev;
         ib_dma_sync_single_for_cpu(dev, sqe->dma,
diff --git a/drivers/of/device.c b/drivers/of/device.c
index 9416d052cb89..28c38c756f92 100644
--- a/drivers/of/device.c
+++ b/drivers/of/device.c
@@ -144,8 +144,8 @@ int of_dma_configure(struct device *dev, struct device_node *np)
                 coherent ? " " : " not ");
 
         iommu = of_iommu_configure(dev, np);
-        if (IS_ERR(iommu))
-                return PTR_ERR(iommu);
+        if (IS_ERR(iommu) && PTR_ERR(iommu) == -EPROBE_DEFER)
+                return -EPROBE_DEFER;
 
         dev_dbg(dev, "device is%sbehind an iommu\n",
                 iommu ? " " : " not ");
diff --git a/drivers/pci/access.c b/drivers/pci/access.c
index 74cf5fffb1e1..c80e37a69305 100644
--- a/drivers/pci/access.c
+++ b/drivers/pci/access.c
@@ -896,7 +896,7 @@ int pci_read_config_byte(const struct pci_dev *dev, int where, u8 *val)
 {
         if (pci_dev_is_disconnected(dev)) {
                 *val = ~0;
-                return -ENODEV;
+                return PCIBIOS_DEVICE_NOT_FOUND;
         }
         return pci_bus_read_config_byte(dev->bus, dev->devfn, where, val);
 }
@@ -906,7 +906,7 @@ int pci_read_config_word(const struct pci_dev *dev, int where, u16 *val)
 {
         if (pci_dev_is_disconnected(dev)) {
                 *val = ~0;
-                return -ENODEV;
+                return PCIBIOS_DEVICE_NOT_FOUND;
         }
         return pci_bus_read_config_word(dev->bus, dev->devfn, where, val);
 }
@@ -917,7 +917,7 @@ int pci_read_config_dword(const struct pci_dev *dev, int where,
 {
         if (pci_dev_is_disconnected(dev)) {
                 *val = ~0;
-                return -ENODEV;
+                return PCIBIOS_DEVICE_NOT_FOUND;
         }
         return pci_bus_read_config_dword(dev->bus, dev->devfn, where, val);
 }
@@ -926,7 +926,7 @@ EXPORT_SYMBOL(pci_read_config_dword);
 int pci_write_config_byte(const struct pci_dev *dev, int where, u8 val)
 {
         if (pci_dev_is_disconnected(dev))
-                return -ENODEV;
+                return PCIBIOS_DEVICE_NOT_FOUND;
         return pci_bus_write_config_byte(dev->bus, dev->devfn, where, val);
 }
 EXPORT_SYMBOL(pci_write_config_byte);
@@ -934,7 +934,7 @@ EXPORT_SYMBOL(pci_write_config_byte);
 int pci_write_config_word(const struct pci_dev *dev, int where, u16 val)
 {
         if (pci_dev_is_disconnected(dev))
-                return -ENODEV;
+                return PCIBIOS_DEVICE_NOT_FOUND;
         return pci_bus_write_config_word(dev->bus, dev->devfn, where, val);
 }
 EXPORT_SYMBOL(pci_write_config_word);
@@ -943,7 +943,7 @@ int pci_write_config_dword(const struct pci_dev *dev, int where,
                                          u32 val)
 {
         if (pci_dev_is_disconnected(dev))
-                return -ENODEV;
+                return PCIBIOS_DEVICE_NOT_FOUND;
         return pci_bus_write_config_dword(dev->bus, dev->devfn, where, val);
 }
 EXPORT_SYMBOL(pci_write_config_dword);
diff --git a/drivers/pci/endpoint/functions/Kconfig b/drivers/pci/endpoint/functions/Kconfig
index 175edad42d2f..2942066607e0 100644
--- a/drivers/pci/endpoint/functions/Kconfig
+++ b/drivers/pci/endpoint/functions/Kconfig
@@ -5,6 +5,7 @@
 config PCI_EPF_TEST
         tristate "PCI Endpoint Test driver"
         depends on PCI_ENDPOINT
+        select CRC32
         help
            Enable this configuration option to enable the test driver
            for PCI Endpoint.
diff --git a/drivers/perf/arm_pmu_acpi.c b/drivers/perf/arm_pmu_acpi.c
index 34c862f213c7..0a9b78705ee8 100644
--- a/drivers/perf/arm_pmu_acpi.c
+++ b/drivers/perf/arm_pmu_acpi.c
@@ -29,6 +29,17 @@ static int arm_pmu_acpi_register_irq(int cpu)
                 return -EINVAL;
 
         gsi = gicc->performance_interrupt;
+
+        /*
+         * Per the ACPI spec, the MADT cannot describe a PMU that doesn't
+         * have an interrupt. QEMU advertises this by using a GSI of zero,
+         * which is not known to be valid on any hardware despite being
+         * valid per the spec. Take the pragmatic approach and reject a
+         * GSI of zero for now.
+         */
+        if (!gsi)
+                return 0;
+
         if (gicc->flags & ACPI_MADT_PERFORMANCE_IRQ_MODE)
                 trigger = ACPI_EDGE_SENSITIVE;
         else
diff --git a/drivers/phy/phy-qcom-qmp.c b/drivers/phy/phy-qcom-qmp.c
index 727e23be7cac..78ca62897784 100644
--- a/drivers/phy/phy-qcom-qmp.c
+++ b/drivers/phy/phy-qcom-qmp.c
@@ -844,7 +844,7 @@ static int qcom_qmp_phy_vreg_init(struct device *dev)
         int num = qmp->cfg->num_vregs;
         int i;
 
-        qmp->vregs = devm_kcalloc(dev, num, sizeof(qmp->vregs), GFP_KERNEL);
+        qmp->vregs = devm_kcalloc(dev, num, sizeof(*qmp->vregs), GFP_KERNEL);
         if (!qmp->vregs)
                 return -ENOMEM;
 
@@ -983,16 +983,16 @@ int qcom_qmp_phy_create(struct device *dev, struct device_node *np, int id)
          * Resources are indexed as: tx -> 0; rx -> 1; pcs -> 2.
          */
         qphy->tx = of_iomap(np, 0);
-        if (IS_ERR(qphy->tx))
-                return PTR_ERR(qphy->tx);
+        if (!qphy->tx)
+                return -ENOMEM;
 
         qphy->rx = of_iomap(np, 1);
-        if (IS_ERR(qphy->rx))
-                return PTR_ERR(qphy->rx);
+        if (!qphy->rx)
+                return -ENOMEM;
 
         qphy->pcs = of_iomap(np, 2);
-        if (IS_ERR(qphy->pcs))
-                return PTR_ERR(qphy->pcs);
+        if (!qphy->pcs)
+                return -ENOMEM;
 
         /*
          * Get PHY's Pipe clock, if any. USB3 and PCIe are PIPE3
diff --git a/drivers/pinctrl/core.c b/drivers/pinctrl/core.c
index 1653cbda6a82..bd459a93b0e7 100644
--- a/drivers/pinctrl/core.c
+++ b/drivers/pinctrl/core.c
@@ -680,30 +680,16 @@ EXPORT_SYMBOL_GPL(pinctrl_generic_remove_group);
  * pinctrl_generic_free_groups() - removes all pin groups
  * @pctldev: pin controller device
  *
- * Note that the caller must take care of locking.
+ * Note that the caller must take care of locking. The pinctrl groups
+ * are allocated with devm_kzalloc() so no need to free them here.
  */
 static void pinctrl_generic_free_groups(struct pinctrl_dev *pctldev)
 {
         struct radix_tree_iter iter;
-        struct group_desc *group;
-        unsigned long *indices;
         void **slot;
-        int i = 0;
-
-        indices = devm_kzalloc(pctldev->dev, sizeof(*indices) *
-                               pctldev->num_groups, GFP_KERNEL);
-        if (!indices)
-                return;
 
         radix_tree_for_each_slot(slot, &pctldev->pin_group_tree, &iter, 0)
-                indices[i++] = iter.index;
-
-        for (i = 0; i < pctldev->num_groups; i++) {
-                group = radix_tree_lookup(&pctldev->pin_group_tree,
-                                          indices[i]);
-                radix_tree_delete(&pctldev->pin_group_tree, indices[i]);
-                devm_kfree(pctldev->dev, group);
-        }
+                radix_tree_delete(&pctldev->pin_group_tree, iter.index);
 
         pctldev->num_groups = 0;
 }
diff --git a/drivers/pinctrl/freescale/pinctrl-mxs.c b/drivers/pinctrl/freescale/pinctrl-mxs.c
index 41b5b07d5a2b..6852010a6d70 100644
--- a/drivers/pinctrl/freescale/pinctrl-mxs.c
+++ b/drivers/pinctrl/freescale/pinctrl-mxs.c
@@ -194,6 +194,16 @@ static int mxs_pinctrl_get_func_groups(struct pinctrl_dev *pctldev,
         return 0;
 }
 
+static void mxs_pinctrl_rmwl(u32 value, u32 mask, u8 shift, void __iomem *reg)
+{
+        u32 tmp;
+
+        tmp = readl(reg);
+        tmp &= ~(mask << shift);
+        tmp |= value << shift;
+        writel(tmp, reg);
+}
+
 static int mxs_pinctrl_set_mux(struct pinctrl_dev *pctldev, unsigned selector,
                                unsigned group)
 {
@@ -211,8 +221,7 @@ static int mxs_pinctrl_set_mux(struct pinctrl_dev *pctldev, unsigned selector,
                 reg += bank * 0x20 + pin / 16 * 0x10;
                 shift = pin % 16 * 2;
 
-                writel(0x3 << shift, reg + CLR);
-                writel(g->muxsel[i] << shift, reg + SET);
+                mxs_pinctrl_rmwl(g->muxsel[i], 0x3, shift, reg);
         }
 
         return 0;
@@ -279,8 +288,7 @@ static int mxs_pinconf_group_set(struct pinctrl_dev *pctldev,
                         /* mA */
                         if (config & MA_PRESENT) {
                                 shift = pin % 8 * 4;
-                                writel(0x3 << shift, reg + CLR);
-                                writel(ma << shift, reg + SET);
+                                mxs_pinctrl_rmwl(ma, 0x3, shift, reg);
                         }
 
                         /* vol */
diff --git a/drivers/pinctrl/intel/pinctrl-cherryview.c b/drivers/pinctrl/intel/pinctrl-cherryview.c
index 2debba62fac9..20f1b4493994 100644
--- a/drivers/pinctrl/intel/pinctrl-cherryview.c
+++ b/drivers/pinctrl/intel/pinctrl-cherryview.c
@@ -1539,15 +1539,29 @@ static void chv_gpio_irq_handler(struct irq_desc *desc)
  * is not listed below.
  */
 static const struct dmi_system_id chv_no_valid_mask[] = {
+        /* See https://bugzilla.kernel.org/show_bug.cgi?id=194945 */
         {
-                /* See https://bugzilla.kernel.org/show_bug.cgi?id=194945 */
-                .ident = "Acer Chromebook (CYAN)",
+                .ident = "Intel_Strago based Chromebooks (All models)",
                 .matches = {
                         DMI_MATCH(DMI_SYS_VENDOR, "GOOGLE"),
-                        DMI_MATCH(DMI_PRODUCT_NAME, "Edgar"),
-                        DMI_MATCH(DMI_BIOS_DATE, "05/21/2016"),
+                        DMI_MATCH(DMI_PRODUCT_FAMILY, "Intel_Strago"),
                 },
-        }
+        },
+        {
+                .ident = "Acer Chromebook R11 (Cyan)",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "GOOGLE"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Cyan"),
+                },
+        },
+        {
+                .ident = "Samsung Chromebook 3 (Celes)",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "GOOGLE"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Celes"),
+                },
+        },
+        {}
 };
 
 static int chv_gpio_probe(struct chv_pinctrl *pctrl, int irq)
diff --git a/drivers/pinctrl/pinconf-generic.c b/drivers/pinctrl/pinconf-generic.c
index 0d6b7f4b82af..720a19fd38d2 100644
--- a/drivers/pinctrl/pinconf-generic.c
+++ b/drivers/pinctrl/pinconf-generic.c
@@ -35,7 +35,6 @@ static const struct pin_config_item conf_items[] = {
         PCONFDUMP(PIN_CONFIG_BIAS_PULL_PIN_DEFAULT,
                                 "input bias pull to pin specific state", NULL, false),
         PCONFDUMP(PIN_CONFIG_BIAS_PULL_UP, "input bias pull up", NULL, false),
-        PCONFDUMP(PIN_CONFIG_BIDIRECTIONAL, "bi-directional pin operations", NULL, false),
         PCONFDUMP(PIN_CONFIG_DRIVE_OPEN_DRAIN, "output drive open drain", NULL, false),
         PCONFDUMP(PIN_CONFIG_DRIVE_OPEN_SOURCE, "output drive open source", NULL, false),
         PCONFDUMP(PIN_CONFIG_DRIVE_PUSH_PULL, "output drive push pull", NULL, false),
@@ -161,7 +160,6 @@ static const struct pinconf_generic_params dt_params[] = {
         { "bias-pull-up", PIN_CONFIG_BIAS_PULL_UP, 1 },
         { "bias-pull-pin-default", PIN_CONFIG_BIAS_PULL_PIN_DEFAULT, 1 },
         { "bias-pull-down", PIN_CONFIG_BIAS_PULL_DOWN, 1 },
-        { "bi-directional", PIN_CONFIG_BIDIRECTIONAL, 1 },
         { "drive-open-drain", PIN_CONFIG_DRIVE_OPEN_DRAIN, 0 },
         { "drive-open-source", PIN_CONFIG_DRIVE_OPEN_SOURCE, 0 },
         { "drive-push-pull", PIN_CONFIG_DRIVE_PUSH_PULL, 0 },
@@ -174,7 +172,6 @@ static const struct pinconf_generic_params dt_params[] = {
         { "input-schmitt-enable", PIN_CONFIG_INPUT_SCHMITT_ENABLE, 1 },
         { "low-power-disable", PIN_CONFIG_LOW_POWER_MODE, 0 },
         { "low-power-enable", PIN_CONFIG_LOW_POWER_MODE, 1 },
-        { "output-enable", PIN_CONFIG_OUTPUT, 1, },
         { "output-high", PIN_CONFIG_OUTPUT, 1, },
         { "output-low", PIN_CONFIG_OUTPUT, 0, },
         { "power-source", PIN_CONFIG_POWER_SOURCE, 0 },
diff --git a/drivers/pinctrl/pinctrl-amd.c b/drivers/pinctrl/pinctrl-amd.c
index 1482d132fbb8..e432ec887479 100644
--- a/drivers/pinctrl/pinctrl-amd.c
+++ b/drivers/pinctrl/pinctrl-amd.c
@@ -495,64 +495,54 @@ static struct irq_chip amd_gpio_irqchip = {
         .flags        = IRQCHIP_SKIP_SET_WAKE,
 };
 
-static void amd_gpio_irq_handler(struct irq_desc *desc)
+#define PIN_IRQ_PENDING (BIT(INTERRUPT_STS_OFF) | BIT(WAKE_STS_OFF))
+
+static irqreturn_t amd_gpio_irq_handler(int irq, void *dev_id)
 {
-        u32 i;
-        u32 off;
-        u32 reg;
-        u32 pin_reg;
-        u64 reg64;
-        int handled = 0;
-        unsigned int irq;
+        struct amd_gpio *gpio_dev = dev_id;
+        struct gpio_chip *gc = &gpio_dev->gc;
+        irqreturn_t ret = IRQ_NONE;
+        unsigned int i, irqnr;
         unsigned long flags;
-        struct irq_chip *chip = irq_desc_get_chip(desc);
-        struct gpio_chip *gc = irq_desc_get_handler_data(desc);
-        struct amd_gpio *gpio_dev = gpiochip_get_data(gc);
+        u32 *regs, regval;
+        u64 status, mask;
 
-        chained_irq_enter(chip, desc);
-        /*enable GPIO interrupt again*/
+        /* Read the wake status */
         raw_spin_lock_irqsave(&gpio_dev->lock, flags);
-        reg = readl(gpio_dev->base + WAKE_INT_STATUS_REG1);
-        reg64 = reg;
-        reg64 = reg64 << 32;
-
-        reg = readl(gpio_dev->base + WAKE_INT_STATUS_REG0);
-        reg64 |= reg;
+        status = readl(gpio_dev->base + WAKE_INT_STATUS_REG1);
+        status <<= 32;
+        status |= readl(gpio_dev->base + WAKE_INT_STATUS_REG0);
         raw_spin_unlock_irqrestore(&gpio_dev->lock, flags);
 
-        /*
-         * first 46 bits indicates interrupt status.
-         * one bit represents four interrupt sources.
-        */
-        for (off = 0; off < 46 ; off++) {
-                if (reg64 & BIT(off)) {
-                        for (i = 0; i < 4; i++) {
-                                pin_reg = readl(gpio_dev->base +
-                                                (off * 4 + i) * 4);
-                                if ((pin_reg & BIT(INTERRUPT_STS_OFF)) ||
-                                        (pin_reg & BIT(WAKE_STS_OFF))) {
-                                        irq = irq_find_mapping(gc->irqdomain,
-                                                                off * 4 + i);
-                                        generic_handle_irq(irq);
-                                        writel(pin_reg,
-                                                gpio_dev->base
-                                                + (off * 4 + i) * 4);
-                                        handled++;
-                                }
-                        }
+        /* Bit 0-45 contain the relevant status bits */
+        status &= (1ULL << 46) - 1;
+        regs = gpio_dev->base;
+        for (mask = 1, irqnr = 0; status; mask <<= 1, regs += 4, irqnr += 4) {
+                if (!(status & mask))
+                        continue;
+                status &= ~mask;
+
+                /* Each status bit covers four pins */
+                for (i = 0; i < 4; i++) {
+                        regval = readl(regs + i);
+                        if (!(regval & PIN_IRQ_PENDING))
+                                continue;
+                        irq = irq_find_mapping(gc->irqdomain, irqnr + i);
+                        generic_handle_irq(irq);
+                        /* Clear interrupt */
+                        writel(regval, regs + i);
+                        ret = IRQ_HANDLED;
                 }
         }
 
-        if (handled == 0)
-                handle_bad_irq(desc);
-
+        /* Signal EOI to the GPIO unit */
         raw_spin_lock_irqsave(&gpio_dev->lock, flags);
-        reg = readl(gpio_dev->base + WAKE_INT_MASTER_REG);
-        reg |= EOI_MASK;
-        writel(reg, gpio_dev->base + WAKE_INT_MASTER_REG);
+        regval = readl(gpio_dev->base + WAKE_INT_MASTER_REG);
+        regval |= EOI_MASK;
+        writel(regval, gpio_dev->base + WAKE_INT_MASTER_REG);
         raw_spin_unlock_irqrestore(&gpio_dev->lock, flags);
 
-        chained_irq_exit(chip, desc);
+        return ret;
 }
 
 static int amd_get_groups_count(struct pinctrl_dev *pctldev)
@@ -821,10 +811,11 @@ static int amd_gpio_probe(struct platform_device *pdev)
                 goto out2;
         }
 
-        gpiochip_set_chained_irqchip(&gpio_dev->gc,
-                                 &amd_gpio_irqchip,
-                                 irq_base,
-                                 amd_gpio_irq_handler);
+        ret = devm_request_irq(&pdev->dev, irq_base, amd_gpio_irq_handler, 0,
+                               KBUILD_MODNAME, gpio_dev);
+        if (ret)
+                goto out2;
+
         platform_set_drvdata(pdev, gpio_dev);
 
         dev_dbg(&pdev->dev, "amd gpio driver loaded\n");
diff --git a/drivers/pinctrl/pinctrl-rockchip.c b/drivers/pinctrl/pinctrl-rockchip.c
index f141aa0430b1..9dd981ddbb17 100644
--- a/drivers/pinctrl/pinctrl-rockchip.c
+++ b/drivers/pinctrl/pinctrl-rockchip.c
@@ -143,9 +143,6 @@ struct rockchip_drv {
  * @gpio_chip: gpiolib chip
  * @grange: gpio range
  * @slock: spinlock for the gpio bank
- * @irq_lock: bus lock for irq chip
- * @new_irqs: newly configured irqs which must be muxed as GPIOs in
- *      irq_bus_sync_unlock()
  */
 struct rockchip_pin_bank {
         void __iomem                    *reg_base;
@@ -168,8 +165,6 @@ struct rockchip_pin_bank {
         struct pinctrl_gpio_range       grange;
         raw_spinlock_t                  slock;
         u32                             toggle_edge_mode;
-        struct mutex                    irq_lock;
-        u32                             new_irqs;
 };
 
 #define PIN_BANK(id, pins, label)                       \
@@ -2134,12 +2129,11 @@ static int rockchip_irq_set_type(struct irq_data *d, unsigned int type)
         int ret;
 
         /* make sure the pin is configured as gpio input */
-        ret = rockchip_verify_mux(bank, d->hwirq, RK_FUNC_GPIO);
+        ret = rockchip_set_mux(bank, d->hwirq, RK_FUNC_GPIO);
         if (ret < 0)
                 return ret;
 
-        bank->new_irqs |= mask;
-
+        clk_enable(bank->clk);
         raw_spin_lock_irqsave(&bank->slock, flags);
 
         data = readl_relaxed(bank->reg_base + GPIO_SWPORT_DDR);
@@ -2197,6 +2191,7 @@ static int rockchip_irq_set_type(struct irq_data *d, unsigned int type)
         default:
                 irq_gc_unlock(gc);
                 raw_spin_unlock_irqrestore(&bank->slock, flags);
+                clk_disable(bank->clk);
                 return -EINVAL;
         }
 
@@ -2205,6 +2200,7 @@ static int rockchip_irq_set_type(struct irq_data *d, unsigned int type)
 
         irq_gc_unlock(gc);
         raw_spin_unlock_irqrestore(&bank->slock, flags);
+        clk_disable(bank->clk);
 
         return 0;
 }
@@ -2248,34 +2244,6 @@ static void rockchip_irq_disable(struct irq_data *d)
         clk_disable(bank->clk);
 }
 
-static void rockchip_irq_bus_lock(struct irq_data *d)
-{
-        struct irq_chip_generic *gc = irq_data_get_irq_chip_data(d);
-        struct rockchip_pin_bank *bank = gc->private;
-
-        clk_enable(bank->clk);
-        mutex_lock(&bank->irq_lock);
-}
-
-static void rockchip_irq_bus_sync_unlock(struct irq_data *d)
-{
-        struct irq_chip_generic *gc = irq_data_get_irq_chip_data(d);
-        struct rockchip_pin_bank *bank = gc->private;
-
-        while (bank->new_irqs) {
-                unsigned int irq = __ffs(bank->new_irqs);
-                int ret;
-
-                ret = rockchip_set_mux(bank, irq, RK_FUNC_GPIO);
-                WARN_ON(ret < 0);
-
-                bank->new_irqs &= ~BIT(irq);
-        }
-
-        mutex_unlock(&bank->irq_lock);
-        clk_disable(bank->clk);
-}
-
 static int rockchip_interrupts_register(struct platform_device *pdev,
                                                 struct rockchip_pinctrl *info)
 {
@@ -2342,9 +2310,6 @@ static int rockchip_interrupts_register(struct platform_device *pdev,
                 gc->chip_types[0].chip.irq_suspend = rockchip_irq_suspend;
                 gc->chip_types[0].chip.irq_resume = rockchip_irq_resume;
                 gc->chip_types[0].chip.irq_set_type = rockchip_irq_set_type;
-                gc->chip_types[0].chip.irq_bus_lock = rockchip_irq_bus_lock;
-                gc->chip_types[0].chip.irq_bus_sync_unlock =
-                                                rockchip_irq_bus_sync_unlock;
                 gc->wake_enabled = IRQ_MSK(bank->nr_pins);
 
                 irq_set_chained_handler_and_data(bank->irq,
@@ -2518,7 +2483,6 @@ static struct rockchip_pin_ctrl *rockchip_pinctrl_get_soc_data(
                 int bank_pins = 0;
 
                 raw_spin_lock_init(&bank->slock);
-                mutex_init(&bank->irq_lock);
                 bank->drvdata = d;
                 bank->pin_base = ctrl->nr_pins;
                 ctrl->nr_pins += bank->nr_pins;
diff --git a/drivers/pinctrl/pinmux.c b/drivers/pinctrl/pinmux.c
index 9fd6d9087dc5..16b3ae5e4f44 100644
--- a/drivers/pinctrl/pinmux.c
+++ b/drivers/pinctrl/pinmux.c
@@ -826,30 +826,17 @@ EXPORT_SYMBOL_GPL(pinmux_generic_remove_function);
  * pinmux_generic_free_functions() - removes all functions
  * @pctldev: pin controller device
  *
- * Note that the caller must take care of locking.
+ * Note that the caller must take care of locking. The pinctrl
+ * functions are allocated with devm_kzalloc() so no need to free
+ * them here.
  */
 void pinmux_generic_free_functions(struct pinctrl_dev *pctldev)
 {
         struct radix_tree_iter iter;
-        struct function_desc *function;
-        unsigned long *indices;
         void **slot;
-        int i = 0;
-
-        indices = devm_kzalloc(pctldev->dev, sizeof(*indices) *
-                               pctldev->num_functions, GFP_KERNEL);
-        if (!indices)
-                return;
 
         radix_tree_for_each_slot(slot, &pctldev->pin_function_tree, &iter, 0)
-                indices[i++] = iter.index;
-
-        for (i = 0; i < pctldev->num_functions; i++) {
-                function = radix_tree_lookup(&pctldev->pin_function_tree,
-                                             indices[i]);
-                radix_tree_delete(&pctldev->pin_function_tree, indices[i]);
-                devm_kfree(pctldev->dev, function);
-        }
+                radix_tree_delete(&pctldev->pin_function_tree, iter.index);
 
         pctldev->num_functions = 0;
 }
diff --git a/drivers/pinctrl/stm32/pinctrl-stm32.c b/drivers/pinctrl/stm32/pinctrl-stm32.c
index d3c5f5dfbbd7..222b6685b09f 100644
--- a/drivers/pinctrl/stm32/pinctrl-stm32.c
+++ b/drivers/pinctrl/stm32/pinctrl-stm32.c
@@ -798,7 +798,7 @@ static int stm32_pconf_parse_conf(struct pinctrl_dev *pctldev,
                 break;
         case PIN_CONFIG_OUTPUT:
                 __stm32_gpio_set(bank, offset, arg);
-                ret = stm32_pmx_gpio_set_direction(pctldev, NULL, pin, false);
+                ret = stm32_pmx_gpio_set_direction(pctldev, range, pin, false);
                 break;
         default:
                 ret = -EINVAL;
diff --git a/drivers/pinctrl/sunxi/pinctrl-sun8i-a83t.c b/drivers/pinctrl/sunxi/pinctrl-sun8i-a83t.c
index 9aec1d2232dd..6624499eae72 100644
--- a/drivers/pinctrl/sunxi/pinctrl-sun8i-a83t.c
+++ b/drivers/pinctrl/sunxi/pinctrl-sun8i-a83t.c
@@ -394,7 +394,7 @@ static const struct sunxi_desc_pin sun8i_a83t_pins[] = {
         SUNXI_PIN(SUNXI_PINCTRL_PIN(E, 18),
                   SUNXI_FUNCTION(0x0, "gpio_in"),
                   SUNXI_FUNCTION(0x1, "gpio_out"),
-                  SUNXI_FUNCTION(0x3, "owa")),          /* DOUT */
+                  SUNXI_FUNCTION(0x3, "spdif")),        /* DOUT */
         SUNXI_PIN(SUNXI_PINCTRL_PIN(E, 19),
                   SUNXI_FUNCTION(0x0, "gpio_in"),
                   SUNXI_FUNCTION(0x1, "gpio_out")),
diff --git a/drivers/platform/goldfish/goldfish_pipe.c b/drivers/platform/goldfish/goldfish_pipe.c
index 2de1e603bd2b..5f3672153b12 100644
--- a/drivers/platform/goldfish/goldfish_pipe.c
+++ b/drivers/platform/goldfish/goldfish_pipe.c
@@ -704,7 +704,7 @@ static int get_free_pipe_id_locked(struct goldfish_pipe_dev *dev)
                 /* Reallocate the array */
                 u32 new_capacity = 2 * dev->pipes_capacity;
                 struct goldfish_pipe **pipes =
-                        kcalloc(new_capacity, sizeof(*pipes), GFP_KERNEL);
+                        kcalloc(new_capacity, sizeof(*pipes), GFP_ATOMIC);
                 if (!pipes)
                         return -ENOMEM;
                 memcpy(pipes, dev->pipes, sizeof(*pipes) * dev->pipes_capacity);
diff --git a/drivers/platform/x86/intel_telemetry_debugfs.c b/drivers/platform/x86/intel_telemetry_debugfs.c
index ef29f18b1951..4cc2f4ea0a25 100644
--- a/drivers/platform/x86/intel_telemetry_debugfs.c
+++ b/drivers/platform/x86/intel_telemetry_debugfs.c
@@ -97,11 +97,9 @@
         } \
 }
 
-#ifdef CONFIG_PM_SLEEP
 static u8 suspend_prep_ok;
 static u32 suspend_shlw_ctr_temp, suspend_deep_ctr_temp;
 static u64 suspend_shlw_res_temp, suspend_deep_res_temp;
-#endif
 
 struct telemetry_susp_stats {
         u32 shlw_swake_ctr;
@@ -807,7 +805,6 @@ static const struct file_operations telem_ioss_trc_verb_ops = {
         .release        = single_release,
 };
 
-#ifdef CONFIG_PM_SLEEP
 static int pm_suspend_prep_cb(void)
 {
         struct telemetry_evtlog evtlog[TELEM_MAX_OS_ALLOCATED_EVENTS];
@@ -937,7 +934,6 @@ static int pm_notification(struct notifier_block *this,
 static struct notifier_block pm_notifier = {
         .notifier_call = pm_notification,
 };
-#endif /* CONFIG_PM_SLEEP */
 
 static int __init telemetry_debugfs_init(void)
 {
@@ -960,14 +956,13 @@ static int __init telemetry_debugfs_init(void)
         if (err < 0)
                 return -EINVAL;
 
-
-#ifdef CONFIG_PM_SLEEP
         register_pm_notifier(&pm_notifier);
-#endif /* CONFIG_PM_SLEEP */
 
         debugfs_conf->telemetry_dbg_dir = debugfs_create_dir("telemetry", NULL);
-        if (!debugfs_conf->telemetry_dbg_dir)
-                return -ENOMEM;
+        if (!debugfs_conf->telemetry_dbg_dir) {
+                err = -ENOMEM;
+                goto out_pm;
+        }
 
         f = debugfs_create_file("pss_info", S_IFREG | S_IRUGO,
                                 debugfs_conf->telemetry_dbg_dir, NULL,
@@ -1014,6 +1009,8 @@ static int __init telemetry_debugfs_init(void)
 out:
         debugfs_remove_recursive(debugfs_conf->telemetry_dbg_dir);
         debugfs_conf->telemetry_dbg_dir = NULL;
+out_pm:
+        unregister_pm_notifier(&pm_notifier);
 
         return err;
 }
@@ -1022,6 +1019,7 @@ static void __exit telemetry_debugfs_exit(void)
 {
         debugfs_remove_recursive(debugfs_conf->telemetry_dbg_dir);
         debugfs_conf->telemetry_dbg_dir = NULL;
+        unregister_pm_notifier(&pm_notifier);
 }
 
 late_initcall(telemetry_debugfs_init);
diff --git a/drivers/reset/hisilicon/hi6220_reset.c b/drivers/reset/hisilicon/hi6220_reset.c
index 35ce53edabf9..d5e5229308f2 100644
--- a/drivers/reset/hisilicon/hi6220_reset.c
+++ b/drivers/reset/hisilicon/hi6220_reset.c
@@ -155,3 +155,5 @@ static int __init hi6220_reset_init(void)
 }
 
 postcore_initcall(hi6220_reset_init);
+
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/s390/cio/vfio_ccw_ops.c b/drivers/s390/cio/vfio_ccw_ops.c
index e72abbc18ee3..a66a317f3e4f 100644
--- a/drivers/s390/cio/vfio_ccw_ops.c
+++ b/drivers/s390/cio/vfio_ccw_ops.c
@@ -70,14 +70,14 @@ static ssize_t name_show(struct kobject *kobj, struct device *dev, char *buf)
 {
         return sprintf(buf, "I/O subchannel (Non-QDIO)\n");
 }
-MDEV_TYPE_ATTR_RO(name);
+static MDEV_TYPE_ATTR_RO(name);
 
 static ssize_t device_api_show(struct kobject *kobj, struct device *dev,
                                char *buf)
 {
         return sprintf(buf, "%s\n", VFIO_DEVICE_API_CCW_STRING);
 }
-MDEV_TYPE_ATTR_RO(device_api);
+static MDEV_TYPE_ATTR_RO(device_api);
 
 static ssize_t available_instances_show(struct kobject *kobj,
                                         struct device *dev, char *buf)
@@ -86,7 +86,7 @@ static ssize_t available_instances_show(struct kobject *kobj,
 
         return sprintf(buf, "%d\n", atomic_read(&private->avail));
 }
-MDEV_TYPE_ATTR_RO(available_instances);
+static MDEV_TYPE_ATTR_RO(available_instances);
 
 static struct attribute *mdev_types_attrs[] = {
         &mdev_type_attr_name.attr,
@@ -100,7 +100,7 @@ static struct attribute_group mdev_type_group = {
         .attrs = mdev_types_attrs,
 };
 
-struct attribute_group *mdev_type_groups[] = {
+static struct attribute_group *mdev_type_groups[] = {
         &mdev_type_group,
         NULL,
 };
@@ -152,7 +152,7 @@ static int vfio_ccw_mdev_open(struct mdev_device *mdev)
                                       &events, &private->nb);
 }
 
-void vfio_ccw_mdev_release(struct mdev_device *mdev)
+static void vfio_ccw_mdev_release(struct mdev_device *mdev)
 {
         struct vfio_ccw_private *private =
                 dev_get_drvdata(mdev_parent_dev(mdev));
@@ -233,7 +233,7 @@ static int vfio_ccw_mdev_get_region_info(struct vfio_region_info *info,
         }
 }
 
-int vfio_ccw_mdev_get_irq_info(struct vfio_irq_info *info)
+static int vfio_ccw_mdev_get_irq_info(struct vfio_irq_info *info)
 {
         if (info->index != VFIO_CCW_IO_IRQ_INDEX)
                 return -EINVAL;
diff --git a/drivers/s390/crypto/ap_bus.c b/drivers/s390/crypto/ap_bus.c
index 9be4596d8a08..ea099910b4e9 100644
--- a/drivers/s390/crypto/ap_bus.c
+++ b/drivers/s390/crypto/ap_bus.c
@@ -668,10 +668,28 @@ static int ap_device_probe(struct device *dev)
         struct ap_driver *ap_drv = to_ap_drv(dev->driver);
         int rc;
 
+        /* Add queue/card to list of active queues/cards */
+        spin_lock_bh(&ap_list_lock);
+        if (is_card_dev(dev))
+                list_add(&to_ap_card(dev)->list, &ap_card_list);
+        else
+                list_add(&to_ap_queue(dev)->list,
+                         &to_ap_queue(dev)->card->queues);
+        spin_unlock_bh(&ap_list_lock);
+
         ap_dev->drv = ap_drv;
         rc = ap_drv->probe ? ap_drv->probe(ap_dev) : -ENODEV;
-        if (rc)
+
+        if (rc) {
+                spin_lock_bh(&ap_list_lock);
+                if (is_card_dev(dev))
+                        list_del_init(&to_ap_card(dev)->list);
+                else
+                        list_del_init(&to_ap_queue(dev)->list);
+                spin_unlock_bh(&ap_list_lock);
                 ap_dev->drv = NULL;
+        }
+
         return rc;
 }
 
@@ -680,14 +698,17 @@ static int ap_device_remove(struct device *dev)
         struct ap_device *ap_dev = to_ap_dev(dev);
         struct ap_driver *ap_drv = ap_dev->drv;
 
+        if (ap_drv->remove)
+                ap_drv->remove(ap_dev);
+
+        /* Remove queue/card from list of active queues/cards */
         spin_lock_bh(&ap_list_lock);
         if (is_card_dev(dev))
                 list_del_init(&to_ap_card(dev)->list);
         else
                 list_del_init(&to_ap_queue(dev)->list);
         spin_unlock_bh(&ap_list_lock);
-        if (ap_drv->remove)
-                ap_drv->remove(ap_dev);
+
         return 0;
 }
 
@@ -1056,10 +1077,6 @@ static void ap_scan_bus(struct work_struct *unused)
                                 }
                                 /* get it and thus adjust reference counter */
                                 get_device(&ac->ap_dev.device);
-                                /* Add card device to card list */
-                                spin_lock_bh(&ap_list_lock);
-                                list_add(&ac->list, &ap_card_list);
-                                spin_unlock_bh(&ap_list_lock);
                         }
                         /* now create the new queue device */
                         aq = ap_queue_create(qid, type);
@@ -1070,10 +1087,6 @@ static void ap_scan_bus(struct work_struct *unused)
                         aq->ap_dev.device.parent = &ac->ap_dev.device;
                         dev_set_name(&aq->ap_dev.device,
                                      "%02x.%04x", id, dom);
-                        /* Add queue device to card queue list */
-                        spin_lock_bh(&ap_list_lock);
-                        list_add(&aq->list, &ac->queues);
-                        spin_unlock_bh(&ap_list_lock);
                         /* Start with a device reset */
                         spin_lock_bh(&aq->lock);
                         ap_wait(ap_sm_event(aq, AP_EVENT_POLL));
@@ -1081,9 +1094,6 @@ static void ap_scan_bus(struct work_struct *unused)
                         /* Register device */
                         rc = device_register(&aq->ap_dev.device);
                         if (rc) {
-                                spin_lock_bh(&ap_list_lock);
-                                list_del_init(&aq->list);
-                                spin_unlock_bh(&ap_list_lock);
                                 put_device(&aq->ap_dev.device);
                                 continue;
                         }
diff --git a/drivers/s390/crypto/ap_card.c b/drivers/s390/crypto/ap_card.c
index cfa161ccc74e..836efac96813 100644
--- a/drivers/s390/crypto/ap_card.c
+++ b/drivers/s390/crypto/ap_card.c
@@ -160,7 +160,14 @@ static struct device_type ap_card_type = {
 
 static void ap_card_device_release(struct device *dev)
 {
-        kfree(to_ap_card(dev));
+        struct ap_card *ac = to_ap_card(dev);
+
+        if (!list_empty(&ac->list)) {
+                spin_lock_bh(&ap_list_lock);
+                list_del_init(&ac->list);
+                spin_unlock_bh(&ap_list_lock);
+        }
+        kfree(ac);
 }
 
 struct ap_card *ap_card_create(int id, int queue_depth, int device_type,
diff --git a/drivers/s390/crypto/ap_queue.c b/drivers/s390/crypto/ap_queue.c
index 480c58a63769..0f1a5d02acb0 100644
--- a/drivers/s390/crypto/ap_queue.c
+++ b/drivers/s390/crypto/ap_queue.c
@@ -584,7 +584,14 @@ static struct device_type ap_queue_type = {
 
 static void ap_queue_device_release(struct device *dev)
 {
-        kfree(to_ap_queue(dev));
+        struct ap_queue *aq = to_ap_queue(dev);
+
+        if (!list_empty(&aq->list)) {
+                spin_lock_bh(&ap_list_lock);
+                list_del_init(&aq->list);
+                spin_unlock_bh(&ap_list_lock);
+        }
+        kfree(aq);
 }
 
 struct ap_queue *ap_queue_create(ap_qid_t qid, int device_type)
diff --git a/drivers/s390/net/netiucv.c b/drivers/s390/net/netiucv.c
index dba94b486f05..fa732bd86729 100644
--- a/drivers/s390/net/netiucv.c
+++ b/drivers/s390/net/netiucv.c
@@ -1954,7 +1954,6 @@ static void netiucv_free_netdevice(struct net_device *dev)
                 privptr->conn = NULL; privptr->fsm = NULL;
                 /* privptr gets freed by free_netdev() */
         }
-        free_netdev(dev);
 }
 
 /**
@@ -1972,7 +1971,8 @@ static void netiucv_setup_netdevice(struct net_device *dev)
         dev->mtu                 = NETIUCV_MTU_DEFAULT;
         dev->min_mtu             = 576;
         dev->max_mtu             = NETIUCV_MTU_MAX;
-        dev->destructor          = netiucv_free_netdevice;
+        dev->needs_free_netdev   = true;
+        dev->priv_destructor     = netiucv_free_netdevice;
         dev->hard_header_len     = NETIUCV_HDRLEN;
         dev->addr_len            = 0;
         dev->type                = ARPHRD_SLIP;
diff --git a/drivers/scsi/bnx2fc/bnx2fc.h b/drivers/scsi/bnx2fc/bnx2fc.h
index 4fc8ed5fe067..1f424e40afdf 100644
--- a/drivers/scsi/bnx2fc/bnx2fc.h
+++ b/drivers/scsi/bnx2fc/bnx2fc.h
@@ -191,6 +191,7 @@ struct bnx2fc_hba {
         struct bnx2fc_cmd_mgr *cmd_mgr;
         spinlock_t hba_lock;
         struct mutex hba_mutex;
+        struct mutex hba_stats_mutex;
         unsigned long adapter_state;
                 #define ADAPTER_STATE_UP                0
                 #define ADAPTER_STATE_GOING_DOWN        1
diff --git a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
index 93b5a0012417..902722dc4ce3 100644
--- a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
+++ b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
@@ -663,15 +663,17 @@ static struct fc_host_statistics *bnx2fc_get_host_stats(struct Scsi_Host *shost)
         if (!fw_stats)
                 return NULL;
 
+        mutex_lock(&hba->hba_stats_mutex);
+
         bnx2fc_stats = fc_get_host_stats(shost);
 
         init_completion(&hba->stat_req_done);
         if (bnx2fc_send_stat_req(hba))
-                return bnx2fc_stats;
+                goto unlock_stats_mutex;
         rc = wait_for_completion_timeout(&hba->stat_req_done, (2 * HZ));
         if (!rc) {
                 BNX2FC_HBA_DBG(lport, "FW stat req timed out\n");
-                return bnx2fc_stats;
+                goto unlock_stats_mutex;
         }
         BNX2FC_STATS(hba, rx_stat2, fc_crc_cnt);
         bnx2fc_stats->invalid_crc_count += hba->bfw_stats.fc_crc_cnt;
@@ -693,6 +695,9 @@ static struct fc_host_statistics *bnx2fc_get_host_stats(struct Scsi_Host *shost)
 
         memcpy(&hba->prev_stats, hba->stats_buffer,
                sizeof(struct fcoe_statistics_params));
+
+unlock_stats_mutex:
+        mutex_unlock(&hba->hba_stats_mutex);
         return bnx2fc_stats;
 }
 
@@ -1340,6 +1345,7 @@ static struct bnx2fc_hba *bnx2fc_hba_create(struct cnic_dev *cnic)
         }
         spin_lock_init(&hba->hba_lock);
         mutex_init(&hba->hba_mutex);
+        mutex_init(&hba->hba_stats_mutex);
 
         hba->cnic = cnic;
 
diff --git a/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c b/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c
index 1076c1578322..0aae094ab91c 100644
--- a/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c
+++ b/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c
@@ -1595,7 +1595,6 @@ static void release_offload_resources(struct cxgbi_sock *csk)
                 cxgbi_sock_put(csk);
         }
         csk->dst = NULL;
-        csk->cdev = NULL;
 }
 
 static int init_act_open(struct cxgbi_sock *csk)
diff --git a/drivers/scsi/cxgbi/libcxgbi.c b/drivers/scsi/cxgbi/libcxgbi.c
index bd7d39ecbd24..e4c83b7c96a8 100644
--- a/drivers/scsi/cxgbi/libcxgbi.c
+++ b/drivers/scsi/cxgbi/libcxgbi.c
@@ -867,7 +867,8 @@ static void need_active_close(struct cxgbi_sock *csk)
         log_debug(1 << CXGBI_DBG_SOCK, "csk 0x%p,%u,0x%lx,%u.\n",
                 csk, (csk)->state, (csk)->flags, (csk)->tid);
         spin_lock_bh(&csk->lock);
-        dst_confirm(csk->dst);
+        if (csk->dst)
+                dst_confirm(csk->dst);
         data_lost = skb_queue_len(&csk->receive_queue);
         __skb_queue_purge(&csk->receive_queue);
 
@@ -882,7 +883,8 @@ static void need_active_close(struct cxgbi_sock *csk)
         }
 
         if (close_req) {
-                if (data_lost)
+                if (!cxgbi_sock_flag(csk, CTPF_LOGOUT_RSP_RCVD) ||
+                    data_lost)
                         csk->cdev->csk_send_abort_req(csk);
                 else
                         csk->cdev->csk_send_close_req(csk);
@@ -1186,9 +1188,10 @@ static int cxgbi_sock_send_pdus(struct cxgbi_sock *csk, struct sk_buff *skb)
                                 cxgbi_ulp_extra_len(cxgbi_skcb_ulp_mode(skb));
                 skb = next;
         }
-done:
+
         if (likely(skb_queue_len(&csk->write_queue)))
                 cdev->csk_push_tx_frames(csk, 1);
+done:
         spin_unlock_bh(&csk->lock);
         return copied;
 
@@ -1568,9 +1571,12 @@ static inline int read_pdu_skb(struct iscsi_conn *conn,
         }
 }
 
-static int skb_read_pdu_bhs(struct iscsi_conn *conn, struct sk_buff *skb)
+static int
+skb_read_pdu_bhs(struct cxgbi_sock *csk, struct iscsi_conn *conn,
+                 struct sk_buff *skb)
 {
         struct iscsi_tcp_conn *tcp_conn = conn->dd_data;
+        int err;
 
         log_debug(1 << CXGBI_DBG_PDU_RX,
                 "conn 0x%p, skb 0x%p, len %u, flag 0x%lx.\n",
@@ -1608,7 +1614,16 @@ static int skb_read_pdu_bhs(struct iscsi_conn *conn, struct sk_buff *skb)
                 }
         }
 
-        return read_pdu_skb(conn, skb, 0, 0);
+        err = read_pdu_skb(conn, skb, 0, 0);
+        if (likely(err >= 0)) {
+                struct iscsi_hdr *hdr = (struct iscsi_hdr *)skb->data;
+                u8 opcode = hdr->opcode & ISCSI_OPCODE_MASK;
+
+                if (unlikely(opcode == ISCSI_OP_LOGOUT_RSP))
+                        cxgbi_sock_set_flag(csk, CTPF_LOGOUT_RSP_RCVD);
+        }
+
+        return err;
 }
 
 static int skb_read_pdu_data(struct iscsi_conn *conn, struct sk_buff *lskb,
@@ -1713,7 +1728,7 @@ void cxgbi_conn_pdu_ready(struct cxgbi_sock *csk)
                         cxgbi_skcb_rx_pdulen(skb));
 
                 if (cxgbi_skcb_test_flag(skb, SKCBF_RX_COALESCED)) {
-                        err = skb_read_pdu_bhs(conn, skb);
+                        err = skb_read_pdu_bhs(csk, conn, skb);
                         if (err < 0) {
                                 pr_err("coalesced bhs, csk 0x%p, skb 0x%p,%u, "
                                         "f 0x%lx, plen %u.\n",
@@ -1731,7 +1746,7 @@ void cxgbi_conn_pdu_ready(struct cxgbi_sock *csk)
                                         cxgbi_skcb_flags(skb),
                                         cxgbi_skcb_rx_pdulen(skb));
                 } else {
-                        err = skb_read_pdu_bhs(conn, skb);
+                        err = skb_read_pdu_bhs(csk, conn, skb);
                         if (err < 0) {
                                 pr_err("bhs, csk 0x%p, skb 0x%p,%u, "
                                         "f 0x%lx, plen %u.\n",
@@ -1873,6 +1888,11 @@ int cxgbi_conn_alloc_pdu(struct iscsi_task *task, u8 opcode)
         tcp_task->dd_data = tdata;
         task->hdr = NULL;
 
+        if (tdata->skb) {
+                kfree_skb(tdata->skb);
+                tdata->skb = NULL;
+        }
+
         if (SKB_MAX_HEAD(cdev->skb_tx_rsvd) > (512 * MAX_SKB_FRAGS) &&
             (opcode == ISCSI_OP_SCSI_DATA_OUT ||
              (opcode == ISCSI_OP_SCSI_CMD &&
@@ -1890,6 +1910,7 @@ int cxgbi_conn_alloc_pdu(struct iscsi_task *task, u8 opcode)
                 return -ENOMEM;
         }
 
+        skb_get(tdata->skb);
         skb_reserve(tdata->skb, cdev->skb_tx_rsvd);
         task->hdr = (struct iscsi_hdr *)tdata->skb->data;
         task->hdr_max = SKB_TX_ISCSI_PDU_HEADER_MAX; /* BHS + AHS */
@@ -2035,9 +2056,9 @@ int cxgbi_conn_xmit_pdu(struct iscsi_task *task)
         unsigned int datalen;
         int err;
 
-        if (!skb) {
+        if (!skb || cxgbi_skcb_test_flag(skb, SKCBF_TX_DONE)) {
                 log_debug(1 << CXGBI_DBG_ISCSI | 1 << CXGBI_DBG_PDU_TX,
-                        "task 0x%p, skb NULL.\n", task);
+                        "task 0x%p, skb 0x%p\n", task, skb);
                 return 0;
         }
 
@@ -2050,7 +2071,6 @@ int cxgbi_conn_xmit_pdu(struct iscsi_task *task)
         }
 
         datalen = skb->data_len;
-        tdata->skb = NULL;
 
         /* write ppod first if using ofldq to write ppod */
         if (ttinfo->flags & CXGBI_PPOD_INFO_FLAG_VALID) {
@@ -2078,6 +2098,7 @@ int cxgbi_conn_xmit_pdu(struct iscsi_task *task)
                         pdulen += ISCSI_DIGEST_SIZE;
 
                 task->conn->txdata_octets += pdulen;
+                cxgbi_skcb_set_flag(skb, SKCBF_TX_DONE);
                 return 0;
         }
 
@@ -2086,7 +2107,6 @@ int cxgbi_conn_xmit_pdu(struct iscsi_task *task)
                         "task 0x%p, skb 0x%p, len %u/%u, %d EAGAIN.\n",
                         task, skb, skb->len, skb->data_len, err);
                 /* reset skb to send when we are called again */
-                tdata->skb = skb;
                 return err;
         }
 
@@ -2094,7 +2114,8 @@ int cxgbi_conn_xmit_pdu(struct iscsi_task *task)
                 "itt 0x%x, skb 0x%p, len %u/%u, xmit err %d.\n",
                 task->itt, skb, skb->len, skb->data_len, err);
 
-        kfree_skb(skb);
+        __kfree_skb(tdata->skb);
+        tdata->skb = NULL;
 
         iscsi_conn_printk(KERN_ERR, task->conn, "xmit err %d.\n", err);
         iscsi_conn_failure(task->conn, ISCSI_ERR_XMIT_FAILED);
@@ -2113,8 +2134,10 @@ void cxgbi_cleanup_task(struct iscsi_task *task)
 
         tcp_task->dd_data = NULL;
         /*  never reached the xmit task callout */
-        if (tdata->skb)
-                __kfree_skb(tdata->skb);
+        if (tdata->skb) {
+                kfree_skb(tdata->skb);
+                tdata->skb = NULL;
+        }
 
         task_release_itt(task, task->hdr_itt);
         memset(tdata, 0, sizeof(*tdata));
@@ -2714,6 +2737,9 @@ EXPORT_SYMBOL_GPL(cxgbi_attr_is_visible);
 static int __init libcxgbi_init_module(void)
 {
         pr_info("%s", version);
+
+        BUILD_BUG_ON(FIELD_SIZEOF(struct sk_buff, cb) <
+                     sizeof(struct cxgbi_skb_cb));
         return 0;
 }
 
diff --git a/drivers/scsi/cxgbi/libcxgbi.h b/drivers/scsi/cxgbi/libcxgbi.h
index 18e0ea83d361..37f07aaab1e4 100644
--- a/drivers/scsi/cxgbi/libcxgbi.h
+++ b/drivers/scsi/cxgbi/libcxgbi.h
@@ -187,6 +187,7 @@ enum cxgbi_sock_flags {
         CTPF_HAS_ATID,          /* reserved atid */
         CTPF_HAS_TID,           /* reserved hw tid */
         CTPF_OFFLOAD_DOWN,      /* offload function off */
+        CTPF_LOGOUT_RSP_RCVD,   /* received logout response */
 };
 
 struct cxgbi_skb_rx_cb {
@@ -195,7 +196,8 @@ struct cxgbi_skb_rx_cb {
 };
 
 struct cxgbi_skb_tx_cb {
-        void *l2t;
+        void *handle;
+        void *arp_err_handler;
         struct sk_buff *wr_next;
 };
 
@@ -203,6 +205,7 @@ enum cxgbi_skcb_flags {
         SKCBF_TX_NEED_HDR,      /* packet needs a header */
         SKCBF_TX_MEM_WRITE,     /* memory write */
         SKCBF_TX_FLAG_COMPL,    /* wr completion flag */
+        SKCBF_TX_DONE,          /* skb tx done */
         SKCBF_RX_COALESCED,     /* received whole pdu */
         SKCBF_RX_HDR,           /* received pdu header */
         SKCBF_RX_DATA,          /* received pdu payload */
@@ -215,13 +218,13 @@ enum cxgbi_skcb_flags {
 };
 
 struct cxgbi_skb_cb {
-        unsigned char ulp_mode;
-        unsigned long flags;
-        unsigned int seq;
         union {
                 struct cxgbi_skb_rx_cb rx;
                 struct cxgbi_skb_tx_cb tx;
         };
+        unsigned char ulp_mode;
+        unsigned long flags;
+        unsigned int seq;
 };
 
 #define CXGBI_SKB_CB(skb)       ((struct cxgbi_skb_cb *)&((skb)->cb[0]))
@@ -374,11 +377,9 @@ static inline void cxgbi_sock_enqueue_wr(struct cxgbi_sock *csk,
         cxgbi_skcb_tx_wr_next(skb) = NULL;
         /*
          * We want to take an extra reference since both us and the driver
-         * need to free the packet before it's really freed. We know there's
-         * just one user currently so we use atomic_set rather than skb_get
-         * to avoid the atomic op.
+         * need to free the packet before it's really freed.
          */
-        atomic_set(&skb->users, 2);
+        skb_get(skb);
 
         if (!csk->wr_pending_head)
                 csk->wr_pending_head = skb;
diff --git a/drivers/scsi/device_handler/scsi_dh_rdac.c b/drivers/scsi/device_handler/scsi_dh_rdac.c
index 3cbab8710e58..2ceff585f189 100644
--- a/drivers/scsi/device_handler/scsi_dh_rdac.c
+++ b/drivers/scsi/device_handler/scsi_dh_rdac.c
@@ -265,18 +265,16 @@ static unsigned int rdac_failover_get(struct rdac_controller *ctlr,
                                       struct list_head *list,
                                       unsigned char *cdb)
 {
-        struct scsi_device *sdev = ctlr->ms_sdev;
-        struct rdac_dh_data *h = sdev->handler_data;
         struct rdac_mode_common *common;
         unsigned data_size;
         struct rdac_queue_data *qdata;
         u8 *lun_table;
 
-        if (h->ctlr->use_ms10) {
+        if (ctlr->use_ms10) {
                 struct rdac_pg_expanded *rdac_pg;
 
                 data_size = sizeof(struct rdac_pg_expanded);
-                rdac_pg = &h->ctlr->mode_select.expanded;
+                rdac_pg = &ctlr->mode_select.expanded;
                 memset(rdac_pg, 0, data_size);
                 common = &rdac_pg->common;
                 rdac_pg->page_code = RDAC_PAGE_CODE_REDUNDANT_CONTROLLER + 0x40;
@@ -288,7 +286,7 @@ static unsigned int rdac_failover_get(struct rdac_controller *ctlr,
                 struct rdac_pg_legacy *rdac_pg;
 
                 data_size = sizeof(struct rdac_pg_legacy);
-                rdac_pg = &h->ctlr->mode_select.legacy;
+                rdac_pg = &ctlr->mode_select.legacy;
                 memset(rdac_pg, 0, data_size);
                 common = &rdac_pg->common;
                 rdac_pg->page_code = RDAC_PAGE_CODE_REDUNDANT_CONTROLLER;
@@ -304,7 +302,7 @@ static unsigned int rdac_failover_get(struct rdac_controller *ctlr,
         }
 
         /* Prepare the command. */
-        if (h->ctlr->use_ms10) {
+        if (ctlr->use_ms10) {
                 cdb[0] = MODE_SELECT_10;
                 cdb[7] = data_size >> 8;
                 cdb[8] = data_size & 0xff;
diff --git a/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c b/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c
index d390325c99ec..abf6026645dd 100644
--- a/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c
+++ b/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c
@@ -1170,6 +1170,8 @@ static struct ibmvscsis_cmd *ibmvscsis_get_free_cmd(struct scsi_info *vscsi)
                 cmd = list_first_entry_or_null(&vscsi->free_cmd,
                                                struct ibmvscsis_cmd, list);
                 if (cmd) {
+                        if (cmd->abort_cmd)
+                                cmd->abort_cmd = NULL;
                         cmd->flags &= ~(DELAY_SEND);
                         list_del(&cmd->list);
                         cmd->iue = iue;
@@ -1774,6 +1776,7 @@ static void ibmvscsis_send_messages(struct scsi_info *vscsi)
                                 if (cmd->abort_cmd) {
                                         retry = true;
                                         cmd->abort_cmd->flags &= ~(DELAY_SEND);
+                                        cmd->abort_cmd = NULL;
                                 }
 
                                 /*
@@ -1788,6 +1791,25 @@ static void ibmvscsis_send_messages(struct scsi_info *vscsi)
                                         list_del(&cmd->list);
                                         ibmvscsis_free_cmd_resources(vscsi,
                                                                      cmd);
+                                        /*
+                                         * With a successfully aborted op
+                                         * through LIO we want to increment the
+                                         * the vscsi credit so that when we dont
+                                         * send a rsp to the original scsi abort
+                                         * op (h_send_crq), but the tm rsp to
+                                         * the abort is sent, the credit is
+                                         * correctly sent with the abort tm rsp.
+                                         * We would need 1 for the abort tm rsp
+                                         * and 1 credit for the aborted scsi op.
+                                         * Thus we need to increment here.
+                                         * Also we want to increment the credit
+                                         * here because we want to make sure
+                                         * cmd is actually released first
+                                         * otherwise the client will think it
+                                         * it can send a new cmd, and we could
+                                         * find ourselves short of cmd elements.
+                                         */
+                                        vscsi->credit += 1;
                                 } else {
                                         iue = cmd->iue;
 
@@ -2962,10 +2984,7 @@ static long srp_build_response(struct scsi_info *vscsi,
 
         rsp->opcode = SRP_RSP;
 
-        if (vscsi->credit > 0 && vscsi->state == SRP_PROCESSING)
-                rsp->req_lim_delta = cpu_to_be32(vscsi->credit);
-        else
-                rsp->req_lim_delta = cpu_to_be32(1 + vscsi->credit);
+        rsp->req_lim_delta = cpu_to_be32(1 + vscsi->credit);
         rsp->tag = cmd->rsp.tag;
         rsp->flags = 0;
 
diff --git a/drivers/scsi/lpfc/lpfc_crtn.h b/drivers/scsi/lpfc/lpfc_crtn.h
index 8912767e7bc8..da669dce12fe 100644
--- a/drivers/scsi/lpfc/lpfc_crtn.h
+++ b/drivers/scsi/lpfc/lpfc_crtn.h
@@ -127,7 +127,7 @@ int lpfc_disc_state_machine(struct lpfc_vport *, struct lpfc_nodelist *, void *,
 void lpfc_do_scr_ns_plogi(struct lpfc_hba *, struct lpfc_vport *);
 int lpfc_check_sparm(struct lpfc_vport *, struct lpfc_nodelist *,
                      struct serv_parm *, uint32_t, int);
-int lpfc_els_abort(struct lpfc_hba *, struct lpfc_nodelist *);
+void lpfc_els_abort(struct lpfc_hba *, struct lpfc_nodelist *);
 void lpfc_more_plogi(struct lpfc_vport *);
 void lpfc_more_adisc(struct lpfc_vport *);
 void lpfc_end_rscn(struct lpfc_vport *);
diff --git a/drivers/scsi/lpfc/lpfc_ct.c b/drivers/scsi/lpfc/lpfc_ct.c
index f2cd19c6c2df..24ce96dcc94d 100644
--- a/drivers/scsi/lpfc/lpfc_ct.c
+++ b/drivers/scsi/lpfc/lpfc_ct.c
@@ -978,9 +978,10 @@ lpfc_cmpl_ct_cmd_gft_id(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,
                                          ndlp, did, ndlp->nlp_fc4_type,
                                          FC_TYPE_FCP, FC_TYPE_NVME);
                         ndlp->nlp_prev_state = NLP_STE_REG_LOGIN_ISSUE;
+
+                        lpfc_nlp_set_state(vport, ndlp, NLP_STE_PRLI_ISSUE);
+                        lpfc_issue_els_prli(vport, ndlp, 0);
                 }
-                lpfc_nlp_set_state(vport, ndlp, NLP_STE_PRLI_ISSUE);
-                lpfc_issue_els_prli(vport, ndlp, 0);
         } else
                 lpfc_printf_vlog(vport, KERN_ERR, LOG_DISCOVERY,
                                  "3065 GFT_ID failed x%08x\n", irsp->ulpStatus);
diff --git a/drivers/scsi/lpfc/lpfc_nportdisc.c b/drivers/scsi/lpfc/lpfc_nportdisc.c
index bff3de053df4..f74cb0142fd4 100644
--- a/drivers/scsi/lpfc/lpfc_nportdisc.c
+++ b/drivers/scsi/lpfc/lpfc_nportdisc.c
@@ -206,7 +206,7 @@ lpfc_check_elscmpl_iocb(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,
  * associated with a LPFC_NODELIST entry. This
  * routine effectively results in a "software abort".
  */
-int
+void
 lpfc_els_abort(struct lpfc_hba *phba, struct lpfc_nodelist *ndlp)
 {
         LIST_HEAD(abort_list);
@@ -215,6 +215,10 @@ lpfc_els_abort(struct lpfc_hba *phba, struct lpfc_nodelist *ndlp)
 
         pring = lpfc_phba_elsring(phba);
 
+        /* In case of error recovery path, we might have a NULL pring here */
+        if (!pring)
+                return;
+
         /* Abort outstanding I/O on NPort <nlp_DID> */
         lpfc_printf_vlog(ndlp->vport, KERN_INFO, LOG_DISCOVERY,
                          "2819 Abort outstanding I/O on NPort x%x "
@@ -273,7 +277,6 @@ lpfc_els_abort(struct lpfc_hba *phba, struct lpfc_nodelist *ndlp)
                               IOSTAT_LOCAL_REJECT, IOERR_SLI_ABORTED);
 
         lpfc_cancel_retry_delay_tmo(phba->pport, ndlp);
-        return 0;
 }
 
 static int
diff --git a/drivers/scsi/lpfc/lpfc_nvmet.c b/drivers/scsi/lpfc/lpfc_nvmet.c
index 074a6b5e7763..518b15e6f222 100644
--- a/drivers/scsi/lpfc/lpfc_nvmet.c
+++ b/drivers/scsi/lpfc/lpfc_nvmet.c
@@ -799,8 +799,8 @@ lpfc_nvmet_xmt_fcp_release(struct nvmet_fc_target_port *tgtport,
         }
         spin_unlock_irqrestore(&ctxp->ctxlock, flags);
 
-        lpfc_nvmeio_data(phba, "NVMET FCP FREE: xri x%x ste %d\n", ctxp->oxid,
-                         ctxp->state, 0);
+        lpfc_nvmeio_data(phba, "NVMET FCP FREE: xri x%x ste %d abt %d\n", ctxp->oxid,
+                         ctxp->state, aborting);
 
         atomic_inc(&lpfc_nvmep->xmt_fcp_release);
 
diff --git a/drivers/scsi/qedi/qedi.h b/drivers/scsi/qedi/qedi.h
index 5ca3e8c28a3f..32632c9b2276 100644
--- a/drivers/scsi/qedi/qedi.h
+++ b/drivers/scsi/qedi/qedi.h
@@ -38,7 +38,7 @@ struct qedi_endpoint;
 #define QEDI_MAX_ISCSI_TASK             4096
 #define QEDI_MAX_TASK_NUM               0x0FFF
 #define QEDI_MAX_ISCSI_CONNS_PER_HBA    1024
-#define QEDI_ISCSI_MAX_BDS_PER_CMD      256     /* Firmware max BDs is 256 */
+#define QEDI_ISCSI_MAX_BDS_PER_CMD      255     /* Firmware max BDs is 255 */
 #define MAX_OUSTANDING_TASKS_PER_CON    1024
 
 #define QEDI_MAX_BD_LEN         0xffff
@@ -63,6 +63,7 @@ struct qedi_endpoint;
 #define QEDI_PAGE_MASK          (~((QEDI_PAGE_SIZE) - 1))
 
 #define QEDI_PAGE_SIZE          4096
+#define QEDI_HW_DMA_BOUNDARY    0xfff
 #define QEDI_PATH_HANDLE        0xFE0000000UL
 
 struct qedi_uio_ctrl {
diff --git a/drivers/scsi/qedi/qedi_fw.c b/drivers/scsi/qedi/qedi_fw.c
index d6978cbc56f0..507512cc478b 100644
--- a/drivers/scsi/qedi/qedi_fw.c
+++ b/drivers/scsi/qedi/qedi_fw.c
@@ -870,7 +870,6 @@ static void qedi_process_cmd_cleanup_resp(struct qedi_ctx *qedi,
                 QEDI_ERR(&qedi->dbg_ctx,
                          "Delayed or untracked cleanup response, itt=0x%x, tid=0x%x, cid=0x%x, task=%p\n",
                          protoitt, cqe->itid, qedi_conn->iscsi_conn_id, task);
-                WARN_ON(1);
         }
 }
 
@@ -1494,6 +1493,8 @@ static int qedi_send_iscsi_tmf(struct qedi_conn *qedi_conn,
         tmf_hdr = (struct iscsi_tm *)mtask->hdr;
         qedi_cmd = (struct qedi_cmd *)mtask->dd_data;
         ep = qedi_conn->ep;
+        if (!ep)
+                return -ENODEV;
 
         tid = qedi_get_task_idx(qedi);
         if (tid == -1)
diff --git a/drivers/scsi/qedi/qedi_iscsi.c b/drivers/scsi/qedi/qedi_iscsi.c
index 3548d46f9b27..87f0af358b33 100644
--- a/drivers/scsi/qedi/qedi_iscsi.c
+++ b/drivers/scsi/qedi/qedi_iscsi.c
@@ -59,6 +59,7 @@ struct scsi_host_template qedi_host_template = {
         .this_id = -1,
         .sg_tablesize = QEDI_ISCSI_MAX_BDS_PER_CMD,
         .max_sectors = 0xffff,
+        .dma_boundary = QEDI_HW_DMA_BOUNDARY,
         .cmd_per_lun = 128,
         .use_clustering = ENABLE_CLUSTERING,
         .shost_attrs = qedi_shost_attrs,
@@ -1223,8 +1224,12 @@ static int qedi_set_path(struct Scsi_Host *shost, struct iscsi_path *path_data)
 
         iscsi_cid = (u32)path_data->handle;
         qedi_ep = qedi->ep_tbl[iscsi_cid];
-        QEDI_INFO(&qedi->dbg_ctx, QEDI_LOG_CONN,
+        QEDI_INFO(&qedi->dbg_ctx, QEDI_LOG_INFO,
                   "iscsi_cid=0x%x, qedi_ep=%p\n", iscsi_cid, qedi_ep);
+        if (!qedi_ep) {
+                ret = -EINVAL;
+                goto set_path_exit;
+        }
 
         if (!is_valid_ether_addr(&path_data->mac_addr[0])) {
                 QEDI_NOTICE(&qedi->dbg_ctx, "dst mac NOT VALID\n");
diff --git a/drivers/scsi/qedi/qedi_main.c b/drivers/scsi/qedi/qedi_main.c
index 92775a8b74b1..879d3b7462f9 100644
--- a/drivers/scsi/qedi/qedi_main.c
+++ b/drivers/scsi/qedi/qedi_main.c
@@ -151,6 +151,11 @@ static int qedi_uio_close(struct uio_info *uinfo, struct inode *inode)
 
 static void __qedi_free_uio_rings(struct qedi_uio_dev *udev)
 {
+        if (udev->uctrl) {
+                free_page((unsigned long)udev->uctrl);
+                udev->uctrl = NULL;
+        }
+
         if (udev->ll2_ring) {
                 free_page((unsigned long)udev->ll2_ring);
                 udev->ll2_ring = NULL;
@@ -169,7 +174,6 @@ static void __qedi_free_uio(struct qedi_uio_dev *udev)
         __qedi_free_uio_rings(udev);
 
         pci_dev_put(udev->pdev);
-        kfree(udev->uctrl);
         kfree(udev);
 }
 
@@ -208,6 +212,11 @@ static int __qedi_alloc_uio_rings(struct qedi_uio_dev *udev)
         if (udev->ll2_ring || udev->ll2_buf)
                 return rc;
 
+        /* Memory for control area.  */
+        udev->uctrl = (void *)get_zeroed_page(GFP_KERNEL);
+        if (!udev->uctrl)
+                return -ENOMEM;
+
         /* Allocating memory for LL2 ring  */
         udev->ll2_ring_size = QEDI_PAGE_SIZE;
         udev->ll2_ring = (void *)get_zeroed_page(GFP_KERNEL | __GFP_COMP);
@@ -237,7 +246,6 @@ exit_alloc_ring:
 static int qedi_alloc_uio_rings(struct qedi_ctx *qedi)
 {
         struct qedi_uio_dev *udev = NULL;
-        struct qedi_uio_ctrl *uctrl = NULL;
         int rc = 0;
 
         list_for_each_entry(udev, &qedi_udev_list, list) {
@@ -258,21 +266,14 @@ static int qedi_alloc_uio_rings(struct qedi_ctx *qedi)
                 goto err_udev;
         }
 
-        uctrl = kzalloc(sizeof(*uctrl), GFP_KERNEL);
-        if (!uctrl) {
-                rc = -ENOMEM;
-                goto err_uctrl;
-        }
-
         udev->uio_dev = -1;
 
         udev->qedi = qedi;
         udev->pdev = qedi->pdev;
-        udev->uctrl = uctrl;
 
         rc = __qedi_alloc_uio_rings(udev);
         if (rc)
-                goto err_uio_rings;
+                goto err_uctrl;
 
         list_add(&udev->list, &qedi_udev_list);
 
@@ -283,8 +284,6 @@ static int qedi_alloc_uio_rings(struct qedi_ctx *qedi)
         udev->rx_pkt = udev->ll2_buf + LL2_SINGLE_BUF_SIZE;
         return 0;
 
- err_uio_rings:
-        kfree(uctrl);
  err_uctrl:
         kfree(udev);
  err_udev:
@@ -828,6 +827,8 @@ static int qedi_set_iscsi_pf_param(struct qedi_ctx *qedi)
         qedi->pf_params.iscsi_pf_params.num_uhq_pages_in_ring = num_sq_pages;
         qedi->pf_params.iscsi_pf_params.num_queues = qedi->num_queues;
         qedi->pf_params.iscsi_pf_params.debug_mode = qedi_fw_debug;
+        qedi->pf_params.iscsi_pf_params.two_msl_timer = 4000;
+        qedi->pf_params.iscsi_pf_params.max_fin_rt = 2;
 
         for (log_page_size = 0 ; log_page_size < 32 ; log_page_size++) {
                 if ((1 << log_page_size) == PAGE_SIZE)
@@ -1498,11 +1499,9 @@ err_idx:
 
 void qedi_clear_task_idx(struct qedi_ctx *qedi, int idx)
 {
-        if (!test_and_clear_bit(idx, qedi->task_idx_map)) {
+        if (!test_and_clear_bit(idx, qedi->task_idx_map))
                 QEDI_ERR(&qedi->dbg_ctx,
                          "FW task context, already cleared, tid=0x%x\n", idx);
-                WARN_ON(1);
-        }
 }
 
 void qedi_update_itt_map(struct qedi_ctx *qedi, u32 tid, u32 proto_itt,
diff --git a/drivers/scsi/qla2xxx/qla_bsg.c b/drivers/scsi/qla2xxx/qla_bsg.c
index 16d1cd50feed..ca3420de5a01 100644
--- a/drivers/scsi/qla2xxx/qla_bsg.c
+++ b/drivers/scsi/qla2xxx/qla_bsg.c
@@ -730,6 +730,8 @@ qla2x00_process_loopback(struct bsg_job *bsg_job)
                 return -EIO;
         }
 
+        memset(&elreq, 0, sizeof(elreq));
+
         elreq.req_sg_cnt = dma_map_sg(&ha->pdev->dev,
                 bsg_job->request_payload.sg_list, bsg_job->request_payload.sg_cnt,
                 DMA_TO_DEVICE);
@@ -795,10 +797,9 @@ qla2x00_process_loopback(struct bsg_job *bsg_job)
 
         if (atomic_read(&vha->loop_state) == LOOP_READY &&
             (ha->current_topology == ISP_CFG_F ||
-            ((IS_QLA81XX(ha) || IS_QLA8031(ha) || IS_QLA8044(ha)) &&
-            le32_to_cpu(*(uint32_t *)req_data) == ELS_OPCODE_BYTE
-            && req_data_len == MAX_ELS_FRAME_PAYLOAD)) &&
-                elreq.options == EXTERNAL_LOOPBACK) {
+            (le32_to_cpu(*(uint32_t *)req_data) == ELS_OPCODE_BYTE &&
+             req_data_len == MAX_ELS_FRAME_PAYLOAD)) &&
+            elreq.options == EXTERNAL_LOOPBACK) {
                 type = "FC_BSG_HST_VENDOR_ECHO_DIAG";
                 ql_dbg(ql_dbg_user, vha, 0x701e,
                     "BSG request type: %s.\n", type);
diff --git a/drivers/scsi/qla2xxx/qla_dbg.c b/drivers/scsi/qla2xxx/qla_dbg.c
index 51b4179469d1..88748a6ab73f 100644
--- a/drivers/scsi/qla2xxx/qla_dbg.c
+++ b/drivers/scsi/qla2xxx/qla_dbg.c
@@ -1131,7 +1131,7 @@ qla24xx_fw_dump(scsi_qla_host_t *vha, int hardware_locked)
 
         /* Mailbox registers. */
         mbx_reg = &reg->mailbox0;
-        for (cnt = 0; cnt < sizeof(fw->mailbox_reg) / 2; cnt++, dmp_reg++)
+        for (cnt = 0; cnt < sizeof(fw->mailbox_reg) / 2; cnt++, mbx_reg++)
                 fw->mailbox_reg[cnt] = htons(RD_REG_WORD(mbx_reg));
 
         /* Transfer sequence registers. */
@@ -2090,7 +2090,7 @@ qla83xx_fw_dump(scsi_qla_host_t *vha, int hardware_locked)
 
         /* Mailbox registers. */
         mbx_reg = &reg->mailbox0;
-        for (cnt = 0; cnt < sizeof(fw->mailbox_reg) / 2; cnt++, dmp_reg++)
+        for (cnt = 0; cnt < sizeof(fw->mailbox_reg) / 2; cnt++, mbx_reg++)
                 fw->mailbox_reg[cnt] = htons(RD_REG_WORD(mbx_reg));
 
         /* Transfer sequence registers. */
diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h
index ae119018dfaa..eddbc1218a39 100644
--- a/drivers/scsi/qla2xxx/qla_def.h
+++ b/drivers/scsi/qla2xxx/qla_def.h
@@ -3425,6 +3425,7 @@ struct qla_hw_data {
         uint8_t         max_req_queues;
         uint8_t         max_rsp_queues;
         uint8_t         max_qpairs;
+        uint8_t         num_qpairs;
         struct qla_qpair *base_qpair;
         struct qla_npiv_entry *npiv_info;
         uint16_t        nvram_npiv_size;
diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
index 034743309ada..0391fc317003 100644
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -7543,12 +7543,13 @@ struct qla_qpair *qla2xxx_create_qpair(struct scsi_qla_host *vha, int qos, int v
                 /* Assign available que pair id */
                 mutex_lock(&ha->mq_lock);
                 qpair_id = find_first_zero_bit(ha->qpair_qid_map, ha->max_qpairs);
-                if (qpair_id >= ha->max_qpairs) {
+                if (ha->num_qpairs >= ha->max_qpairs) {
                         mutex_unlock(&ha->mq_lock);
                         ql_log(ql_log_warn, vha, 0x0183,
                             "No resources to create additional q pair.\n");
                         goto fail_qid_map;
                 }
+                ha->num_qpairs++;
                 set_bit(qpair_id, ha->qpair_qid_map);
                 ha->queue_pair_map[qpair_id] = qpair;
                 qpair->id = qpair_id;
@@ -7635,6 +7636,7 @@ fail_rsp:
 fail_msix:
         ha->queue_pair_map[qpair_id] = NULL;
         clear_bit(qpair_id, ha->qpair_qid_map);
+        ha->num_qpairs--;
         mutex_unlock(&ha->mq_lock);
 fail_qid_map:
         kfree(qpair);
@@ -7660,6 +7662,7 @@ int qla2xxx_delete_qpair(struct scsi_qla_host *vha, struct qla_qpair *qpair)
         mutex_lock(&ha->mq_lock);
         ha->queue_pair_map[qpair->id] = NULL;
         clear_bit(qpair->id, ha->qpair_qid_map);
+        ha->num_qpairs--;
         list_del(&qpair->qp_list_elem);
         if (list_empty(&vha->qp_list))
                 vha->flags.qpairs_available = 0;
diff --git a/drivers/scsi/qla2xxx/qla_inline.h b/drivers/scsi/qla2xxx/qla_inline.h
index 66df6cec59da..c61a6a871c8e 100644
--- a/drivers/scsi/qla2xxx/qla_inline.h
+++ b/drivers/scsi/qla2xxx/qla_inline.h
@@ -129,28 +129,16 @@ qla2x00_clear_loop_id(fc_port_t *fcport) {
 }
 
 static inline void
-qla2x00_clean_dsd_pool(struct qla_hw_data *ha, srb_t *sp,
-        struct qla_tgt_cmd *tc)
+qla2x00_clean_dsd_pool(struct qla_hw_data *ha, struct crc_context *ctx)
 {
-        struct dsd_dma *dsd_ptr, *tdsd_ptr;
-        struct crc_context *ctx;
-
-        if (sp)
-                ctx = (struct crc_context *)GET_CMD_CTX_SP(sp);
-        else if (tc)
-                ctx = (struct crc_context *)tc->ctx;
-        else {
-                BUG();
-                return;
-        }
+        struct dsd_dma *dsd, *tdsd;
 
         /* clean up allocated prev pool */
-        list_for_each_entry_safe(dsd_ptr, tdsd_ptr,
-            &ctx->dsd_list, list) {
-                dma_pool_free(ha->dl_dma_pool, dsd_ptr->dsd_addr,
-                    dsd_ptr->dsd_list_dma);
-                list_del(&dsd_ptr->list);
-                kfree(dsd_ptr);
+        list_for_each_entry_safe(dsd, tdsd, &ctx->dsd_list, list) {
+                dma_pool_free(ha->dl_dma_pool, dsd->dsd_addr,
+                    dsd->dsd_list_dma);
+                list_del(&dsd->list);
+                kfree(dsd);
         }
         INIT_LIST_HEAD(&ctx->dsd_list);
 }
diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
index aac03504d9a3..2572121b765b 100644
--- a/drivers/scsi/qla2xxx/qla_isr.c
+++ b/drivers/scsi/qla2xxx/qla_isr.c
@@ -3282,7 +3282,7 @@ msix_register_fail:
         }
 
         /* Enable MSI-X vector for response queue update for queue 0 */
-        if (IS_QLA83XX(ha) || IS_QLA27XX(ha)) {
+        if (IS_QLA25XX(ha) || IS_QLA83XX(ha) || IS_QLA27XX(ha)) {
                 if (ha->msixbase && ha->mqiobase &&
                     (ha->max_rsp_queues > 1 || ha->max_req_queues > 1 ||
                      ql2xmqsupport))
diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c
index a113ab3592a7..cba1fc5e8be9 100644
--- a/drivers/scsi/qla2xxx/qla_mbx.c
+++ b/drivers/scsi/qla2xxx/qla_mbx.c
@@ -3676,15 +3676,6 @@ qla24xx_report_id_acquisition(scsi_qla_host_t *vha,
                                 qlt_update_host_map(vha, id);
                         }
 
-                        fc_host_port_name(vha->host) =
-                            wwn_to_u64(vha->port_name);
-
-                        if (qla_ini_mode_enabled(vha))
-                                ql_dbg(ql_dbg_mbx, vha, 0x1018,
-                                    "FA-WWN portname %016llx (%x)\n",
-                                    fc_host_port_name(vha->host),
-                                    rptid_entry->vp_status);
-
                         set_bit(REGISTER_FC4_NEEDED, &vha->dpc_flags);
                         set_bit(REGISTER_FDMI_NEEDED, &vha->dpc_flags);
                 } else {
@@ -4821,9 +4812,9 @@ qla2x00_echo_test(scsi_qla_host_t *vha, struct msg_echo_lb *mreq,
 
         memset(mcp->mb, 0 , sizeof(mcp->mb));
         mcp->mb[0] = MBC_DIAGNOSTIC_ECHO;
-        mcp->mb[1] = mreq->options | BIT_6;     /* BIT_6 specifies 64bit address */
+        /* BIT_6 specifies 64bit address */
+        mcp->mb[1] = mreq->options | BIT_15 | BIT_6;
         if (IS_CNA_CAPABLE(ha)) {
-                mcp->mb[1] |= BIT_15;
                 mcp->mb[2] = vha->fcoe_fcf_idx;
         }
         mcp->mb[16] = LSW(mreq->rcv_dma);
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index 1c7957903283..79f050256c55 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -630,29 +630,34 @@ qla2x00_sp_free_dma(void *ptr)
                 sp->flags &= ~SRB_CRC_PROT_DMA_VALID;
         }
 
+        if (!ctx)
+                goto end;
+
         if (sp->flags & SRB_CRC_CTX_DSD_VALID) {
                 /* List assured to be having elements */
-                qla2x00_clean_dsd_pool(ha, sp, NULL);
+                qla2x00_clean_dsd_pool(ha, ctx);
                 sp->flags &= ~SRB_CRC_CTX_DSD_VALID;
         }
 
         if (sp->flags & SRB_CRC_CTX_DMA_VALID) {
-                dma_pool_free(ha->dl_dma_pool, ctx,
-                    ((struct crc_context *)ctx)->crc_ctx_dma);
+                struct crc_context *ctx0 = ctx;
+
+                dma_pool_free(ha->dl_dma_pool, ctx0, ctx0->crc_ctx_dma);
                 sp->flags &= ~SRB_CRC_CTX_DMA_VALID;
         }
 
         if (sp->flags & SRB_FCP_CMND_DMA_VALID) {
-                struct ct6_dsd *ctx1 = (struct ct6_dsd *)ctx;
+                struct ct6_dsd *ctx1 = ctx;
 
                 dma_pool_free(ha->fcp_cmnd_dma_pool, ctx1->fcp_cmnd,
-                        ctx1->fcp_cmnd_dma);
+                    ctx1->fcp_cmnd_dma);
                 list_splice(&ctx1->dsd_list, &ha->gbl_dsd_list);
                 ha->gbl_dsd_inuse -= ctx1->dsd_use_cnt;
                 ha->gbl_dsd_avail += ctx1->dsd_use_cnt;
                 mempool_free(ctx1, ha->ctx_mempool);
         }
 
+end:
         CMD_SP(cmd) = NULL;
         qla2x00_rel_sp(sp);
 }
@@ -699,21 +704,24 @@ qla2xxx_qpair_sp_free_dma(void *ptr)
                 sp->flags &= ~SRB_CRC_PROT_DMA_VALID;
         }
 
+        if (!ctx)
+                goto end;
+
         if (sp->flags & SRB_CRC_CTX_DSD_VALID) {
                 /* List assured to be having elements */
-                qla2x00_clean_dsd_pool(ha, sp, NULL);
+                qla2x00_clean_dsd_pool(ha, ctx);
                 sp->flags &= ~SRB_CRC_CTX_DSD_VALID;
         }
 
         if (sp->flags & SRB_CRC_CTX_DMA_VALID) {
-                dma_pool_free(ha->dl_dma_pool, ctx,
-                    ((struct crc_context *)ctx)->crc_ctx_dma);
+                struct crc_context *ctx0 = ctx;
+
+                dma_pool_free(ha->dl_dma_pool, ctx, ctx0->crc_ctx_dma);
                 sp->flags &= ~SRB_CRC_CTX_DMA_VALID;
         }
 
         if (sp->flags & SRB_FCP_CMND_DMA_VALID) {
-                struct ct6_dsd *ctx1 = (struct ct6_dsd *)ctx;
-
+                struct ct6_dsd *ctx1 = ctx;
                 dma_pool_free(ha->fcp_cmnd_dma_pool, ctx1->fcp_cmnd,
                     ctx1->fcp_cmnd_dma);
                 list_splice(&ctx1->dsd_list, &ha->gbl_dsd_list);
@@ -721,7 +729,7 @@ qla2xxx_qpair_sp_free_dma(void *ptr)
                 ha->gbl_dsd_avail += ctx1->dsd_use_cnt;
                 mempool_free(ctx1, ha->ctx_mempool);
         }
-
+end:
         CMD_SP(cmd) = NULL;
         qla2xxx_rel_qpair_sp(sp->qpair, sp);
 }
@@ -1632,7 +1640,7 @@ qla2x00_loop_reset(scsi_qla_host_t *vha)
 void
 qla2x00_abort_all_cmds(scsi_qla_host_t *vha, int res)
 {
-        int que, cnt;
+        int que, cnt, status;
         unsigned long flags;
         srb_t *sp;
         struct qla_hw_data *ha = vha->hw;
@@ -1662,8 +1670,12 @@ qla2x00_abort_all_cmds(scsi_qla_host_t *vha, int res)
                                          */
                                         sp_get(sp);
                                         spin_unlock_irqrestore(&ha->hardware_lock, flags);
-                                        qla2xxx_eh_abort(GET_CMD_SP(sp));
+                                        status = qla2xxx_eh_abort(GET_CMD_SP(sp));
                                         spin_lock_irqsave(&ha->hardware_lock, flags);
+                                        /* Get rid of extra reference if immediate exit
+                                         * from ql2xxx_eh_abort */
+                                        if (status == FAILED && (qla2x00_isp_reg_stat(ha)))
+                                                atomic_dec(&sp->ref_count);
                                 }
                                 req->outstanding_cmds[cnt] = NULL;
                                 sp->done(sp, res);
@@ -2623,10 +2635,10 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
 
         if (mem_only) {
                 if (pci_enable_device_mem(pdev))
-                        goto probe_out;
+                        return ret;
         } else {
                 if (pci_enable_device(pdev))
-                        goto probe_out;
+                        return ret;
         }
 
         /* This may fail but that's ok */
@@ -2636,7 +2648,7 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
         if (!ha) {
                 ql_log_pci(ql_log_fatal, pdev, 0x0009,
                     "Unable to allocate memory for ha.\n");
-                goto probe_out;
+                goto disable_device;
         }
         ql_dbg_pci(ql_dbg_init, pdev, 0x000a,
             "Memory allocated for ha=%p.\n", ha);
@@ -3254,7 +3266,7 @@ iospace_config_failed:
         pci_release_selected_regions(ha->pdev, ha->bars);
         kfree(ha);
 
-probe_out:
+disable_device:
         pci_disable_device(pdev);
         return ret;
 }
diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
index 0e03ca2ab3e5..e766d8412384 100644
--- a/drivers/scsi/qla2xxx/qla_target.c
+++ b/drivers/scsi/qla2xxx/qla_target.c
@@ -2245,11 +2245,13 @@ static void qlt_unmap_sg(struct scsi_qla_host *vha, struct qla_tgt_cmd *cmd)
                 pci_unmap_sg(ha->pdev, cmd->prot_sg, cmd->prot_sg_cnt,
                         cmd->dma_data_direction);
 
+        if (!cmd->ctx)
+                return;
+
         if (cmd->ctx_dsd_alloced)
-                qla2x00_clean_dsd_pool(ha, NULL, cmd);
+                qla2x00_clean_dsd_pool(ha, cmd->ctx);
 
-        if (cmd->ctx)
-                dma_pool_free(ha->dl_dma_pool, cmd->ctx, cmd->ctx->crc_ctx_dma);
+        dma_pool_free(ha->dl_dma_pool, cmd->ctx, cmd->ctx->crc_ctx_dma);
 }
 
 static int qlt_check_reserve_free_req(struct scsi_qla_host *vha,
diff --git a/drivers/scsi/qla2xxx/qla_tmpl.c b/drivers/scsi/qla2xxx/qla_tmpl.c
index 8a58ef3adab4..c197972a3e2d 100644
--- a/drivers/scsi/qla2xxx/qla_tmpl.c
+++ b/drivers/scsi/qla2xxx/qla_tmpl.c
@@ -371,7 +371,7 @@ qla27xx_fwdt_entry_t262(struct scsi_qla_host *vha,
                 goto done;
         }
 
-        if (end <= start || start == 0 || end == 0) {
+        if (end < start || start == 0 || end == 0) {
                 ql_dbg(ql_dbg_misc, vha, 0xd023,
                     "%s: unusable range (start=%x end=%x)\n", __func__,
                     ent->t262.end_addr, ent->t262.start_addr);
diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c
index 17249c3650fe..dc095a292c61 100644
--- a/drivers/scsi/scsi_debug.c
+++ b/drivers/scsi/scsi_debug.c
@@ -1404,7 +1404,7 @@ static int resp_inquiry(struct scsi_cmnd *scp, struct sdebug_dev_info *devip)
         arr[4] = SDEBUG_LONG_INQ_SZ - 5;
         arr[5] = (int)have_dif_prot;    /* PROTECT bit */
         if (sdebug_vpd_use_hostno == 0)
-                arr[5] = 0x10; /* claim: implicit TGPS */
+                arr[5] |= 0x10; /* claim: implicit TPGS */
         arr[6] = 0x10; /* claim: MultiP */
         /* arr[6] |= 0x40; ... claim: EncServ (enclosure services) */
         arr[7] = 0xa; /* claim: LINKED + CMDQUE */
diff --git a/drivers/staging/ccree/Kconfig b/drivers/staging/ccree/Kconfig
index ae627049c499..4be87f503e3b 100644
--- a/drivers/staging/ccree/Kconfig
+++ b/drivers/staging/ccree/Kconfig
@@ -1,6 +1,6 @@
 config CRYPTO_DEV_CCREE
         tristate "Support for ARM TrustZone CryptoCell C7XX family of Crypto accelerators"
-        depends on CRYPTO_HW && OF && HAS_DMA
+        depends on CRYPTO && CRYPTO_HW && OF && HAS_DMA
         default n
         select CRYPTO_HASH
         select CRYPTO_BLKCIPHER
diff --git a/drivers/staging/ccree/ssi_buffer_mgr.c b/drivers/staging/ccree/ssi_buffer_mgr.c
index 038e2ff5e545..6471d3d2d375 100644
--- a/drivers/staging/ccree/ssi_buffer_mgr.c
+++ b/drivers/staging/ccree/ssi_buffer_mgr.c
@@ -216,7 +216,8 @@ void ssi_buffer_mgr_copy_scatterlist_portion(
         uint32_t nents, lbytes;
 
         nents = ssi_buffer_mgr_get_sgl_nents(sg, end, &lbytes, NULL);
-        sg_copy_buffer(sg, nents, (void *)dest, (end - to_skip), 0, (direct == SSI_SG_TO_BUF));
+        sg_copy_buffer(sg, nents, (void *)dest, (end - to_skip + 1), to_skip,
+                       (direct == SSI_SG_TO_BUF));
 }
 
 static inline int ssi_buffer_mgr_render_buff_to_mlli(
diff --git a/drivers/staging/iio/cdc/ad7152.c b/drivers/staging/iio/cdc/ad7152.c
index dc6ecd824365..ff10d1f0a7e4 100644
--- a/drivers/staging/iio/cdc/ad7152.c
+++ b/drivers/staging/iio/cdc/ad7152.c
@@ -231,16 +231,12 @@ static int ad7152_write_raw_samp_freq(struct device *dev, int val)
         if (i >= ARRAY_SIZE(ad7152_filter_rate_table))
                 i = ARRAY_SIZE(ad7152_filter_rate_table) - 1;
 
-        mutex_lock(&chip->state_lock);
         ret = i2c_smbus_write_byte_data(chip->client,
                                         AD7152_REG_CFG2, AD7152_CFG2_OSR(i));
-        if (ret < 0) {
-                mutex_unlock(&chip->state_lock);
+        if (ret < 0)
                 return ret;
-        }
 
         chip->filter_rate_setup = i;
-        mutex_unlock(&chip->state_lock);
 
         return ret;
 }
diff --git a/drivers/staging/lustre/lustre/lov/lov_pack.c b/drivers/staging/lustre/lustre/lov/lov_pack.c
index 2e1bd47337fd..e6727cefde05 100644
--- a/drivers/staging/lustre/lustre/lov/lov_pack.c
+++ b/drivers/staging/lustre/lustre/lov/lov_pack.c
@@ -293,18 +293,10 @@ int lov_getstripe(struct lov_object *obj, struct lov_stripe_md *lsm,
         size_t lmmk_size;
         size_t lum_size;
         int rc;
-        mm_segment_t seg;
 
         if (!lsm)
                 return -ENODATA;
 
-        /*
-         * "Switch to kernel segment" to allow copying from kernel space by
-         * copy_{to,from}_user().
-         */
-        seg = get_fs();
-        set_fs(KERNEL_DS);
-
         if (lsm->lsm_magic != LOV_MAGIC_V1 && lsm->lsm_magic != LOV_MAGIC_V3) {
                 CERROR("bad LSM MAGIC: 0x%08X != 0x%08X nor 0x%08X\n",
                        lsm->lsm_magic, LOV_MAGIC_V1, LOV_MAGIC_V3);
@@ -406,6 +398,5 @@ int lov_getstripe(struct lov_object *obj, struct lov_stripe_md *lsm,
 out_free:
         kvfree(lmmk);
 out:
-        set_fs(seg);
         return rc;
 }
diff --git a/drivers/staging/media/atomisp/i2c/Makefile b/drivers/staging/media/atomisp/i2c/Makefile
index 8ea01904c0ea..466517c7c8e6 100644
--- a/drivers/staging/media/atomisp/i2c/Makefile
+++ b/drivers/staging/media/atomisp/i2c/Makefile
@@ -19,5 +19,3 @@ obj-$(CONFIG_VIDEO_AP1302)     += ap1302.o
 
 obj-$(CONFIG_VIDEO_LM3554) += lm3554.o
 
-ccflags-y += -Werror
-
diff --git a/drivers/staging/media/atomisp/i2c/imx/Makefile b/drivers/staging/media/atomisp/i2c/imx/Makefile
index 1d7f7ab94cac..6b13a3a66e49 100644
--- a/drivers/staging/media/atomisp/i2c/imx/Makefile
+++ b/drivers/staging/media/atomisp/i2c/imx/Makefile
@@ -4,5 +4,3 @@ imx1x5-objs := imx.o drv201.o ad5816g.o dw9714.o dw9719.o dw9718.o vcm.o otp.o o
 
 ov8858_driver-objs := ../ov8858.o dw9718.o vcm.o
 obj-$(CONFIG_VIDEO_OV8858)     += ov8858_driver.o
-
-ccflags-y += -Werror
diff --git a/drivers/staging/media/atomisp/i2c/ov5693/Makefile b/drivers/staging/media/atomisp/i2c/ov5693/Makefile
index fceb9e9b881b..c9c0e1245858 100644
--- a/drivers/staging/media/atomisp/i2c/ov5693/Makefile
+++ b/drivers/staging/media/atomisp/i2c/ov5693/Makefile
@@ -1,3 +1 @@
 obj-$(CONFIG_VIDEO_OV5693) += ov5693.o
-
-ccflags-y += -Werror
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/Makefile b/drivers/staging/media/atomisp/pci/atomisp2/Makefile
index 3fa7c1c1479f..f126a89a08e9 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/Makefile
+++ b/drivers/staging/media/atomisp/pci/atomisp2/Makefile
@@ -351,5 +351,5 @@ DEFINES := -DHRT_HW -DHRT_ISP_CSS_CUSTOM_HOST -DHRT_USE_VIR_ADDRS -D__HOST__
 DEFINES += -DATOMISP_POSTFIX=\"css2400b0_v21\" -DISP2400B0
 DEFINES += -DSYSTEM_hive_isp_css_2400_system -DISP2400
 
-ccflags-y += $(INCLUDES) $(DEFINES) -fno-common -Werror
+ccflags-y += $(INCLUDES) $(DEFINES) -fno-common
 
diff --git a/drivers/staging/rtl8188eu/os_dep/mon.c b/drivers/staging/rtl8188eu/os_dep/mon.c
index cfe37eb026d6..859d0d6051cd 100644
--- a/drivers/staging/rtl8188eu/os_dep/mon.c
+++ b/drivers/staging/rtl8188eu/os_dep/mon.c
@@ -152,7 +152,7 @@ static const struct net_device_ops mon_netdev_ops = {
 static void mon_setup(struct net_device *dev)
 {
         dev->netdev_ops = &mon_netdev_ops;
-        dev->destructor = free_netdev;
+        dev->needs_free_netdev = true;
         ether_setup(dev);
         dev->priv_flags |= IFF_NO_QUEUE;
         dev->type = ARPHRD_IEEE80211;
diff --git a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
index 36c3189fc4b7..bd4352fe2de3 100644
--- a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
+++ b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
@@ -2667,7 +2667,8 @@ static int rtw_cfg80211_add_monitor_if (struct adapter *padapter, char *name, st
         mon_ndev->type = ARPHRD_IEEE80211_RADIOTAP;
         strncpy(mon_ndev->name, name, IFNAMSIZ);
         mon_ndev->name[IFNAMSIZ - 1] = 0;
-        mon_ndev->destructor = rtw_ndev_destructor;
+        mon_ndev->needs_free_netdev = true;
+        mon_ndev->priv_destructor = rtw_ndev_destructor;
 
         mon_ndev->netdev_ops = &rtw_cfg80211_monitor_if_ops;
 
diff --git a/drivers/staging/rtl8723bs/os_dep/os_intfs.c b/drivers/staging/rtl8723bs/os_dep/os_intfs.c
index f83cfc76505c..021589913681 100644
--- a/drivers/staging/rtl8723bs/os_dep/os_intfs.c
+++ b/drivers/staging/rtl8723bs/os_dep/os_intfs.c
@@ -1207,8 +1207,6 @@ void rtw_ndev_destructor(struct net_device *ndev)
 
         if (ndev->ieee80211_ptr)
                 kfree((u8 *)ndev->ieee80211_ptr);
-
-        free_netdev(ndev);
 }
 
 void rtw_dev_unload(struct adapter *padapter)
diff --git a/drivers/staging/rtl8723bs/os_dep/osdep_service.c b/drivers/staging/rtl8723bs/os_dep/osdep_service.c
index 02db59e8b593..aa16d1ab955b 100644
--- a/drivers/staging/rtl8723bs/os_dep/osdep_service.c
+++ b/drivers/staging/rtl8723bs/os_dep/osdep_service.c
@@ -160,7 +160,7 @@ static int isFileReadable(char *path)
                 oldfs = get_fs(); set_fs(get_ds());
 
                 if (1!=readFile(fp, &buf, 1))
-                        ret = PTR_ERR(fp);
+                        ret = -EINVAL;
 
                 set_fs(oldfs);
                 filp_close(fp, NULL);
diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
index 26a9bcd5ee6a..3fdca2cdd8da 100644
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -1279,6 +1279,18 @@ iscsit_get_immediate_data(struct iscsi_cmd *cmd, struct iscsi_scsi_req *hdr,
          */
         if (dump_payload)
                 goto after_immediate_data;
+        /*
+         * Check for underflow case where both EDTL and immediate data payload
+         * exceeds what is presented by CDB's TRANSFER LENGTH, and what has
+         * already been set in target_cmd_size_check() as se_cmd->data_length.
+         *
+         * For this special case, fail the command and dump the immediate data
+         * payload.
+         */
+        if (cmd->first_burst_len > cmd->se_cmd.data_length) {
+                cmd->sense_reason = TCM_INVALID_CDB_FIELD;
+                goto after_immediate_data;
+        }
 
         immed_ret = iscsit_handle_immediate_data(cmd, hdr,
                                         cmd->first_burst_len);
@@ -3790,6 +3802,8 @@ int iscsi_target_tx_thread(void *arg)
 {
         int ret = 0;
         struct iscsi_conn *conn = arg;
+        bool conn_freed = false;
+
         /*
          * Allow ourselves to be interrupted by SIGINT so that a
          * connection recovery / failure event can be triggered externally.
@@ -3815,12 +3829,14 @@ get_immediate:
                         goto transport_err;
 
                 ret = iscsit_handle_response_queue(conn);
-                if (ret == 1)
+                if (ret == 1) {
                         goto get_immediate;
-                else if (ret == -ECONNRESET)
+                } else if (ret == -ECONNRESET) {
+                        conn_freed = true;
                         goto out;
-                else if (ret < 0)
+                } else if (ret < 0) {
                         goto transport_err;
+                }
         }
 
 transport_err:
@@ -3830,8 +3846,13 @@ transport_err:
          * responsible for cleaning up the early connection failure.
          */
         if (conn->conn_state != TARG_CONN_STATE_IN_LOGIN)
-                iscsit_take_action_for_connection_exit(conn);
+                iscsit_take_action_for_connection_exit(conn, &conn_freed);
 out:
+        if (!conn_freed) {
+                while (!kthread_should_stop()) {
+                        msleep(100);
+                }
+        }
         return 0;
 }
 
@@ -4004,6 +4025,7 @@ int iscsi_target_rx_thread(void *arg)
 {
         int rc;
         struct iscsi_conn *conn = arg;
+        bool conn_freed = false;
 
         /*
          * Allow ourselves to be interrupted by SIGINT so that a
@@ -4016,7 +4038,7 @@ int iscsi_target_rx_thread(void *arg)
          */
         rc = wait_for_completion_interruptible(&conn->rx_login_comp);
         if (rc < 0 || iscsi_target_check_conn_state(conn))
-                return 0;
+                goto out;
 
         if (!conn->conn_transport->iscsit_get_rx_pdu)
                 return 0;
@@ -4025,7 +4047,15 @@ int iscsi_target_rx_thread(void *arg)
 
         if (!signal_pending(current))
                 atomic_set(&conn->transport_failed, 1);
-        iscsit_take_action_for_connection_exit(conn);
+        iscsit_take_action_for_connection_exit(conn, &conn_freed);
+
+out:
+        if (!conn_freed) {
+                while (!kthread_should_stop()) {
+                        msleep(100);
+                }
+        }
+
         return 0;
 }
 
@@ -4405,8 +4435,11 @@ static void iscsit_logout_post_handler_closesession(
          * always sleep waiting for RX/TX thread shutdown to complete
          * within iscsit_close_connection().
          */
-        if (!conn->conn_transport->rdma_shutdown)
+        if (!conn->conn_transport->rdma_shutdown) {
                 sleep = cmpxchg(&conn->tx_thread_active, true, false);
+                if (!sleep)
+                        return;
+        }
 
         atomic_set(&conn->conn_logout_remove, 0);
         complete(&conn->conn_logout_comp);
@@ -4422,8 +4455,11 @@ static void iscsit_logout_post_handler_samecid(
 {
         int sleep = 1;
 
-        if (!conn->conn_transport->rdma_shutdown)
+        if (!conn->conn_transport->rdma_shutdown) {
                 sleep = cmpxchg(&conn->tx_thread_active, true, false);
+                if (!sleep)
+                        return;
+        }
 
         atomic_set(&conn->conn_logout_remove, 0);
         complete(&conn->conn_logout_comp);
diff --git a/drivers/target/iscsi/iscsi_target_erl0.c b/drivers/target/iscsi/iscsi_target_erl0.c
index 9a96e17bf7cd..7fe2aa73cff6 100644
--- a/drivers/target/iscsi/iscsi_target_erl0.c
+++ b/drivers/target/iscsi/iscsi_target_erl0.c
@@ -930,8 +930,10 @@ static void iscsit_handle_connection_cleanup(struct iscsi_conn *conn)
         }
 }
 
-void iscsit_take_action_for_connection_exit(struct iscsi_conn *conn)
+void iscsit_take_action_for_connection_exit(struct iscsi_conn *conn, bool *conn_freed)
 {
+        *conn_freed = false;
+
         spin_lock_bh(&conn->state_lock);
         if (atomic_read(&conn->connection_exit)) {
                 spin_unlock_bh(&conn->state_lock);
@@ -942,6 +944,7 @@ void iscsit_take_action_for_connection_exit(struct iscsi_conn *conn)
         if (conn->conn_state == TARG_CONN_STATE_IN_LOGOUT) {
                 spin_unlock_bh(&conn->state_lock);
                 iscsit_close_connection(conn);
+                *conn_freed = true;
                 return;
         }
 
@@ -955,4 +958,5 @@ void iscsit_take_action_for_connection_exit(struct iscsi_conn *conn)
         spin_unlock_bh(&conn->state_lock);
 
         iscsit_handle_connection_cleanup(conn);
+        *conn_freed = true;
 }
diff --git a/drivers/target/iscsi/iscsi_target_erl0.h b/drivers/target/iscsi/iscsi_target_erl0.h
index 60e69e2af6ed..3822d9cd1230 100644
--- a/drivers/target/iscsi/iscsi_target_erl0.h
+++ b/drivers/target/iscsi/iscsi_target_erl0.h
@@ -15,6 +15,6 @@ extern int iscsit_stop_time2retain_timer(struct iscsi_session *);
 extern void iscsit_connection_reinstatement_rcfr(struct iscsi_conn *);
 extern void iscsit_cause_connection_reinstatement(struct iscsi_conn *, int);
 extern void iscsit_fall_back_to_erl0(struct iscsi_session *);
-extern void iscsit_take_action_for_connection_exit(struct iscsi_conn *);
+extern void iscsit_take_action_for_connection_exit(struct iscsi_conn *, bool *);
 
 #endif   /*** ISCSI_TARGET_ERL0_H ***/
diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c
index 66238477137b..92b96b51d506 100644
--- a/drivers/target/iscsi/iscsi_target_login.c
+++ b/drivers/target/iscsi/iscsi_target_login.c
@@ -1464,5 +1464,9 @@ int iscsi_target_login_thread(void *arg)
                         break;
         }
 
+        while (!kthread_should_stop()) {
+                msleep(100);
+        }
+
         return 0;
 }
diff --git a/drivers/target/iscsi/iscsi_target_nego.c b/drivers/target/iscsi/iscsi_target_nego.c
index 7ccc9c1cbfd1..6f88b31242b0 100644
--- a/drivers/target/iscsi/iscsi_target_nego.c
+++ b/drivers/target/iscsi/iscsi_target_nego.c
@@ -493,14 +493,60 @@ static void iscsi_target_restore_sock_callbacks(struct iscsi_conn *conn)
 
 static int iscsi_target_do_login(struct iscsi_conn *, struct iscsi_login *);
 
-static bool iscsi_target_sk_state_check(struct sock *sk)
+static bool __iscsi_target_sk_check_close(struct sock *sk)
 {
         if (sk->sk_state == TCP_CLOSE_WAIT || sk->sk_state == TCP_CLOSE) {
-                pr_debug("iscsi_target_sk_state_check: TCP_CLOSE_WAIT|TCP_CLOSE,"
+                pr_debug("__iscsi_target_sk_check_close: TCP_CLOSE_WAIT|TCP_CLOSE,"
                         "returning FALSE\n");
-                return false;
+                return true;
         }
-        return true;
+        return false;
+}
+
+static bool iscsi_target_sk_check_close(struct iscsi_conn *conn)
+{
+        bool state = false;
+
+        if (conn->sock) {
+                struct sock *sk = conn->sock->sk;
+
+                read_lock_bh(&sk->sk_callback_lock);
+                state = (__iscsi_target_sk_check_close(sk) ||
+                         test_bit(LOGIN_FLAGS_CLOSED, &conn->login_flags));
+                read_unlock_bh(&sk->sk_callback_lock);
+        }
+        return state;
+}
+
+static bool iscsi_target_sk_check_flag(struct iscsi_conn *conn, unsigned int flag)
+{
+        bool state = false;
+
+        if (conn->sock) {
+                struct sock *sk = conn->sock->sk;
+
+                read_lock_bh(&sk->sk_callback_lock);
+                state = test_bit(flag, &conn->login_flags);
+                read_unlock_bh(&sk->sk_callback_lock);
+        }
+        return state;
+}
+
+static bool iscsi_target_sk_check_and_clear(struct iscsi_conn *conn, unsigned int flag)
+{
+        bool state = false;
+
+        if (conn->sock) {
+                struct sock *sk = conn->sock->sk;
+
+                write_lock_bh(&sk->sk_callback_lock);
+                state = (__iscsi_target_sk_check_close(sk) ||
+                         test_bit(LOGIN_FLAGS_CLOSED, &conn->login_flags));
+                if (!state)
+                        clear_bit(flag, &conn->login_flags);
+                write_unlock_bh(&sk->sk_callback_lock);
+        }
+        return state;
 }
 
 static void iscsi_target_login_drop(struct iscsi_conn *conn, struct iscsi_login *login)
@@ -540,6 +586,20 @@ static void iscsi_target_do_login_rx(struct work_struct *work)
 
         pr_debug("entering iscsi_target_do_login_rx, conn: %p, %s:%d\n",
                         conn, current->comm, current->pid);
+        /*
+         * If iscsi_target_do_login_rx() has been invoked by ->sk_data_ready()
+         * before initial PDU processing in iscsi_target_start_negotiation()
+         * has completed, go ahead and retry until it's cleared.
+         *
+         * Otherwise if the TCP connection drops while this is occuring,
+         * iscsi_target_start_negotiation() will detect the failure, call
+         * cancel_delayed_work_sync(&conn->login_work), and cleanup the
+         * remaining iscsi connection resources from iscsi_np process context.
+         */
+        if (iscsi_target_sk_check_flag(conn, LOGIN_FLAGS_INITIAL_PDU)) {
+                schedule_delayed_work(&conn->login_work, msecs_to_jiffies(10));
+                return;
+        }
 
         spin_lock(&tpg->tpg_state_lock);
         state = (tpg->tpg_state == TPG_STATE_ACTIVE);
@@ -547,26 +607,12 @@ static void iscsi_target_do_login_rx(struct work_struct *work)
 
         if (!state) {
                 pr_debug("iscsi_target_do_login_rx: tpg_state != TPG_STATE_ACTIVE\n");
-                iscsi_target_restore_sock_callbacks(conn);
-                iscsi_target_login_drop(conn, login);
-                iscsit_deaccess_np(np, tpg, tpg_np);
-                return;
+                goto err;
         }
 
-        if (conn->sock) {
-                struct sock *sk = conn->sock->sk;
-
-                read_lock_bh(&sk->sk_callback_lock);
-                state = iscsi_target_sk_state_check(sk);
-                read_unlock_bh(&sk->sk_callback_lock);
-
-                if (!state) {
-                        pr_debug("iscsi_target_do_login_rx, TCP state CLOSE\n");
-                        iscsi_target_restore_sock_callbacks(conn);
-                        iscsi_target_login_drop(conn, login);
-                        iscsit_deaccess_np(np, tpg, tpg_np);
-                        return;
-                }
+        if (iscsi_target_sk_check_close(conn)) {
+                pr_debug("iscsi_target_do_login_rx, TCP state CLOSE\n");
+                goto err;
         }
 
         conn->login_kworker = current;
@@ -584,34 +630,29 @@ static void iscsi_target_do_login_rx(struct work_struct *work)
         flush_signals(current);
         conn->login_kworker = NULL;
 
-        if (rc < 0) {
-                iscsi_target_restore_sock_callbacks(conn);
-                iscsi_target_login_drop(conn, login);
-                iscsit_deaccess_np(np, tpg, tpg_np);
-                return;
-        }
+        if (rc < 0)
+                goto err;
 
         pr_debug("iscsi_target_do_login_rx after rx_login_io, %p, %s:%d\n",
                         conn, current->comm, current->pid);
 
         rc = iscsi_target_do_login(conn, login);
         if (rc < 0) {
-                iscsi_target_restore_sock_callbacks(conn);
-                iscsi_target_login_drop(conn, login);
-                iscsit_deaccess_np(np, tpg, tpg_np);
+                goto err;
         } else if (!rc) {
-                if (conn->sock) {
-                        struct sock *sk = conn->sock->sk;
-
-                        write_lock_bh(&sk->sk_callback_lock);
-                        clear_bit(LOGIN_FLAGS_READ_ACTIVE, &conn->login_flags);
-                        write_unlock_bh(&sk->sk_callback_lock);
-                }
+                if (iscsi_target_sk_check_and_clear(conn, LOGIN_FLAGS_READ_ACTIVE))
+                        goto err;
         } else if (rc == 1) {
                 iscsi_target_nego_release(conn);
                 iscsi_post_login_handler(np, conn, zero_tsih);
                 iscsit_deaccess_np(np, tpg, tpg_np);
         }
+        return;
+
+err:
+        iscsi_target_restore_sock_callbacks(conn);
+        iscsi_target_login_drop(conn, login);
+        iscsit_deaccess_np(np, tpg, tpg_np);
 }
 
 static void iscsi_target_do_cleanup(struct work_struct *work)
@@ -659,31 +700,54 @@ static void iscsi_target_sk_state_change(struct sock *sk)
                 orig_state_change(sk);
                 return;
         }
+        state = __iscsi_target_sk_check_close(sk);
+        pr_debug("__iscsi_target_sk_close_change: state: %d\n", state);
+
         if (test_bit(LOGIN_FLAGS_READ_ACTIVE, &conn->login_flags)) {
                 pr_debug("Got LOGIN_FLAGS_READ_ACTIVE=1 sk_state_change"
                          " conn: %p\n", conn);
+                if (state)
+                        set_bit(LOGIN_FLAGS_CLOSED, &conn->login_flags);
                 write_unlock_bh(&sk->sk_callback_lock);
                 orig_state_change(sk);
                 return;
         }
-        if (test_and_set_bit(LOGIN_FLAGS_CLOSED, &conn->login_flags)) {
+        if (test_bit(LOGIN_FLAGS_CLOSED, &conn->login_flags)) {
                 pr_debug("Got LOGIN_FLAGS_CLOSED=1 sk_state_change conn: %p\n",
                          conn);
                 write_unlock_bh(&sk->sk_callback_lock);
                 orig_state_change(sk);
                 return;
         }
+        /*
+         * If the TCP connection has dropped, go ahead and set LOGIN_FLAGS_CLOSED,
+         * but only queue conn->login_work -> iscsi_target_do_login_rx()
+         * processing if LOGIN_FLAGS_INITIAL_PDU has already been cleared.
+         *
+         * When iscsi_target_do_login_rx() runs, iscsi_target_sk_check_close()
+         * will detect the dropped TCP connection from delayed workqueue context.
+         *
+         * If LOGIN_FLAGS_INITIAL_PDU is still set, which means the initial
+         * iscsi_target_start_negotiation() is running, iscsi_target_do_login()
+         * via iscsi_target_sk_check_close() or iscsi_target_start_negotiation()
+         * via iscsi_target_sk_check_and_clear() is responsible for detecting the
+         * dropped TCP connection in iscsi_np process context, and cleaning up
+         * the remaining iscsi connection resources.
+         */
+        if (state) {
+                pr_debug("iscsi_target_sk_state_change got failed state\n");
+                set_bit(LOGIN_FLAGS_CLOSED, &conn->login_flags);
+                state = test_bit(LOGIN_FLAGS_INITIAL_PDU, &conn->login_flags);
+                write_unlock_bh(&sk->sk_callback_lock);
 
-        state = iscsi_target_sk_state_check(sk);
-        write_unlock_bh(&sk->sk_callback_lock);
-
-        pr_debug("iscsi_target_sk_state_change: state: %d\n", state);
+                orig_state_change(sk);
 
-        if (!state) {
-                pr_debug("iscsi_target_sk_state_change got failed state\n");
-                schedule_delayed_work(&conn->login_cleanup_work, 0);
+                if (!state)
+                        schedule_delayed_work(&conn->login_work, 0);
                 return;
         }
+        write_unlock_bh(&sk->sk_callback_lock);
+
         orig_state_change(sk);
 }
 
@@ -946,6 +1010,15 @@ static int iscsi_target_do_login(struct iscsi_conn *conn, struct iscsi_login *lo
                         if (iscsi_target_handle_csg_one(conn, login) < 0)
                                 return -1;
                         if (login_rsp->flags & ISCSI_FLAG_LOGIN_TRANSIT) {
+                                /*
+                                 * Check to make sure the TCP connection has not
+                                 * dropped asynchronously while session reinstatement
+                                 * was occuring in this kthread context, before
+                                 * transitioning to full feature phase operation.
+                                 */
+                                if (iscsi_target_sk_check_close(conn))
+                                        return -1;
+
                                 login->tsih = conn->sess->tsih;
                                 login->login_complete = 1;
                                 iscsi_target_restore_sock_callbacks(conn);
@@ -972,21 +1045,6 @@ static int iscsi_target_do_login(struct iscsi_conn *conn, struct iscsi_login *lo
                 break;
         }
 
-        if (conn->sock) {
-                struct sock *sk = conn->sock->sk;
-                bool state;
-
-                read_lock_bh(&sk->sk_callback_lock);
-                state = iscsi_target_sk_state_check(sk);
-                read_unlock_bh(&sk->sk_callback_lock);
-
-                if (!state) {
-                        pr_debug("iscsi_target_do_login() failed state for"
-                                 " conn: %p\n", conn);
-                        return -1;
-                }
-        }
-
         return 0;
 }
 
@@ -1255,10 +1313,22 @@ int iscsi_target_start_negotiation(
 
                 write_lock_bh(&sk->sk_callback_lock);
                 set_bit(LOGIN_FLAGS_READY, &conn->login_flags);
+                set_bit(LOGIN_FLAGS_INITIAL_PDU, &conn->login_flags);
                 write_unlock_bh(&sk->sk_callback_lock);
         }
-
+        /*
+         * If iscsi_target_do_login returns zero to signal more PDU
+         * exchanges are required to complete the login, go ahead and
+         * clear LOGIN_FLAGS_INITIAL_PDU but only if the TCP connection
+         * is still active.
+         *
+         * Otherwise if TCP connection dropped asynchronously, go ahead
+         * and perform connection cleanup now.
+         */
         ret = iscsi_target_do_login(conn, login);
+        if (!ret && iscsi_target_sk_check_and_clear(conn, LOGIN_FLAGS_INITIAL_PDU))
+                ret = -1;
+
         if (ret < 0) {
                 cancel_delayed_work_sync(&conn->login_work);
                 cancel_delayed_work_sync(&conn->login_cleanup_work);
diff --git a/drivers/target/target_core_internal.h b/drivers/target/target_core_internal.h
index 9ab7090f7c83..0912de7c0cf8 100644
--- a/drivers/target/target_core_internal.h
+++ b/drivers/target/target_core_internal.h
@@ -136,7 +136,7 @@ int	init_se_kmem_caches(void);
 void    release_se_kmem_caches(void);
 u32     scsi_get_new_index(scsi_index_t);
 void    transport_subsystem_check_init(void);
-void    transport_cmd_finish_abort(struct se_cmd *, int);
+int     transport_cmd_finish_abort(struct se_cmd *, int);
 unsigned char *transport_dump_cmd_direction(struct se_cmd *);
 void    transport_dump_dev_state(struct se_device *, char *, int *);
 void    transport_dump_dev_info(struct se_device *, struct se_lun *,
diff --git a/drivers/target/target_core_tmr.c b/drivers/target/target_core_tmr.c
index dce1e1b47316..13f47bf4d16b 100644
--- a/drivers/target/target_core_tmr.c
+++ b/drivers/target/target_core_tmr.c
@@ -75,7 +75,7 @@ void core_tmr_release_req(struct se_tmr_req *tmr)
         kfree(tmr);
 }
 
-static void core_tmr_handle_tas_abort(struct se_cmd *cmd, int tas)
+static int core_tmr_handle_tas_abort(struct se_cmd *cmd, int tas)
 {
         unsigned long flags;
         bool remove = true, send_tas;
@@ -91,7 +91,7 @@ static void core_tmr_handle_tas_abort(struct se_cmd *cmd, int tas)
                 transport_send_task_abort(cmd);
         }
 
-        transport_cmd_finish_abort(cmd, remove);
+        return transport_cmd_finish_abort(cmd, remove);
 }
 
 static int target_check_cdb_and_preempt(struct list_head *list,
@@ -184,8 +184,8 @@ void core_tmr_abort_task(
                 cancel_work_sync(&se_cmd->work);
                 transport_wait_for_tasks(se_cmd);
 
-                transport_cmd_finish_abort(se_cmd, true);
-                target_put_sess_cmd(se_cmd);
+                if (!transport_cmd_finish_abort(se_cmd, true))
+                        target_put_sess_cmd(se_cmd);
 
                 printk("ABORT_TASK: Sending TMR_FUNCTION_COMPLETE for"
                                 " ref_tag: %llu\n", ref_tag);
@@ -281,8 +281,8 @@ static void core_tmr_drain_tmr_list(
                 cancel_work_sync(&cmd->work);
                 transport_wait_for_tasks(cmd);
 
-                transport_cmd_finish_abort(cmd, 1);
-                target_put_sess_cmd(cmd);
+                if (!transport_cmd_finish_abort(cmd, 1))
+                        target_put_sess_cmd(cmd);
         }
 }
 
@@ -380,8 +380,8 @@ static void core_tmr_drain_state_list(
                 cancel_work_sync(&cmd->work);
                 transport_wait_for_tasks(cmd);
 
-                core_tmr_handle_tas_abort(cmd, tas);
-                target_put_sess_cmd(cmd);
+                if (!core_tmr_handle_tas_abort(cmd, tas))
+                        target_put_sess_cmd(cmd);
         }
 }
 
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index 37f57357d4a0..f1b3a46bdcaf 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -651,9 +651,10 @@ static void transport_lun_remove_cmd(struct se_cmd *cmd)
                 percpu_ref_put(&lun->lun_ref);
 }
 
-void transport_cmd_finish_abort(struct se_cmd *cmd, int remove)
+int transport_cmd_finish_abort(struct se_cmd *cmd, int remove)
 {
         bool ack_kref = (cmd->se_cmd_flags & SCF_ACK_KREF);
+        int ret = 0;
 
         if (cmd->se_cmd_flags & SCF_SE_LUN_CMD)
                 transport_lun_remove_cmd(cmd);
@@ -665,9 +666,11 @@ void transport_cmd_finish_abort(struct se_cmd *cmd, int remove)
                 cmd->se_tfo->aborted_task(cmd);
 
         if (transport_cmd_check_stop_to_fabric(cmd))
-                return;
+                return 1;
         if (remove && ack_kref)
-                transport_put_cmd(cmd);
+                ret = transport_put_cmd(cmd);
+
+        return ret;
 }
 
 static void target_complete_failure_work(struct work_struct *work)
@@ -1160,15 +1163,28 @@ target_cmd_size_check(struct se_cmd *cmd, unsigned int size)
         if (cmd->unknown_data_length) {
                 cmd->data_length = size;
         } else if (size != cmd->data_length) {
-                pr_warn("TARGET_CORE[%s]: Expected Transfer Length:"
+                pr_warn_ratelimited("TARGET_CORE[%s]: Expected Transfer Length:"
                         " %u does not match SCSI CDB Length: %u for SAM Opcode:"
                         " 0x%02x\n", cmd->se_tfo->get_fabric_name(),
                                 cmd->data_length, size, cmd->t_task_cdb[0]);
 
-                if (cmd->data_direction == DMA_TO_DEVICE &&
-                    cmd->se_cmd_flags & SCF_SCSI_DATA_CDB) {
-                        pr_err("Rejecting underflow/overflow WRITE data\n");
-                        return TCM_INVALID_CDB_FIELD;
+                if (cmd->data_direction == DMA_TO_DEVICE) {
+                        if (cmd->se_cmd_flags & SCF_SCSI_DATA_CDB) {
+                                pr_err_ratelimited("Rejecting underflow/overflow"
+                                                   " for WRITE data CDB\n");
+                                return TCM_INVALID_CDB_FIELD;
+                        }
+                        /*
+                         * Some fabric drivers like iscsi-target still expect to
+                         * always reject overflow writes.  Reject this case until
+                         * full fabric driver level support for overflow writes
+                         * is introduced tree-wide.
+                         */
+                        if (size > cmd->data_length) {
+                                pr_err_ratelimited("Rejecting overflow for"
+                                                   " WRITE control CDB\n");
+                                return TCM_INVALID_CDB_FIELD;
+                        }
                 }
                 /*
                  * Reject READ_* or WRITE_* with overflow/underflow for
diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c
index 9045837f748b..beb5f098f32d 100644
--- a/drivers/target/target_core_user.c
+++ b/drivers/target/target_core_user.c
@@ -97,7 +97,7 @@ struct tcmu_hba {
 
 struct tcmu_dev {
         struct list_head node;
-
+        struct kref kref;
         struct se_device se_dev;
 
         char *name;
@@ -969,6 +969,7 @@ static struct se_device *tcmu_alloc_device(struct se_hba *hba, const char *name)
         udev = kzalloc(sizeof(struct tcmu_dev), GFP_KERNEL);
         if (!udev)
                 return NULL;
+        kref_init(&udev->kref);
 
         udev->name = kstrdup(name, GFP_KERNEL);
         if (!udev->name) {
@@ -1145,6 +1146,24 @@ static int tcmu_open(struct uio_info *info, struct inode *inode)
         return 0;
 }
 
+static void tcmu_dev_call_rcu(struct rcu_head *p)
+{
+        struct se_device *dev = container_of(p, struct se_device, rcu_head);
+        struct tcmu_dev *udev = TCMU_DEV(dev);
+
+        kfree(udev->uio_info.name);
+        kfree(udev->name);
+        kfree(udev);
+}
+
+static void tcmu_dev_kref_release(struct kref *kref)
+{
+        struct tcmu_dev *udev = container_of(kref, struct tcmu_dev, kref);
+        struct se_device *dev = &udev->se_dev;
+
+        call_rcu(&dev->rcu_head, tcmu_dev_call_rcu);
+}
+
 static int tcmu_release(struct uio_info *info, struct inode *inode)
 {
         struct tcmu_dev *udev = container_of(info, struct tcmu_dev, uio_info);
@@ -1152,7 +1171,8 @@ static int tcmu_release(struct uio_info *info, struct inode *inode)
         clear_bit(TCMU_DEV_BIT_OPEN, &udev->flags);
 
         pr_debug("close\n");
-
+        /* release ref from configure */
+        kref_put(&udev->kref, tcmu_dev_kref_release);
         return 0;
 }
 
@@ -1272,6 +1292,12 @@ static int tcmu_configure_device(struct se_device *dev)
                 dev->dev_attrib.hw_max_sectors = 128;
         dev->dev_attrib.hw_queue_depth = 128;
 
+        /*
+         * Get a ref incase userspace does a close on the uio device before
+         * LIO has initiated tcmu_free_device.
+         */
+        kref_get(&udev->kref);
+
         ret = tcmu_netlink_event(TCMU_CMD_ADDED_DEVICE, udev->uio_info.name,
                                  udev->uio_info.uio_dev->minor);
         if (ret)
@@ -1284,11 +1310,13 @@ static int tcmu_configure_device(struct se_device *dev)
         return 0;
 
 err_netlink:
+        kref_put(&udev->kref, tcmu_dev_kref_release);
         uio_unregister_device(&udev->uio_info);
 err_register:
         vfree(udev->mb_addr);
 err_vzalloc:
         kfree(info->name);
+        info->name = NULL;
 
         return ret;
 }
@@ -1302,14 +1330,6 @@ static int tcmu_check_and_free_pending_cmd(struct tcmu_cmd *cmd)
         return -EINVAL;
 }
 
-static void tcmu_dev_call_rcu(struct rcu_head *p)
-{
-        struct se_device *dev = container_of(p, struct se_device, rcu_head);
-        struct tcmu_dev *udev = TCMU_DEV(dev);
-
-        kfree(udev);
-}
-
 static bool tcmu_dev_configured(struct tcmu_dev *udev)
 {
         return udev->uio_info.uio_dev ? true : false;
@@ -1364,10 +1384,10 @@ static void tcmu_free_device(struct se_device *dev)
                                    udev->uio_info.uio_dev->minor);
 
                 uio_unregister_device(&udev->uio_info);
-                kfree(udev->uio_info.name);
-                kfree(udev->name);
         }
-        call_rcu(&dev->rcu_head, tcmu_dev_call_rcu);
+
+        /* release ref from init */
+        kref_put(&udev->kref, tcmu_dev_kref_release);
 }
 
 enum {
diff --git a/drivers/tty/tty_port.c b/drivers/tty/tty_port.c
index 4fb3165384c4..6b137194069f 100644
--- a/drivers/tty/tty_port.c
+++ b/drivers/tty/tty_port.c
@@ -34,9 +34,7 @@ static int tty_port_default_receive_buf(struct tty_port *port,
         if (!disc)
                 return 0;
 
-        mutex_lock(&tty->atomic_write_lock);
         ret = tty_ldisc_receive_buf(disc, p, (char *)f, count);
-        mutex_unlock(&tty->atomic_write_lock);
 
         tty_ldisc_deref(disc);
 
diff --git a/drivers/usb/chipidea/core.c b/drivers/usb/chipidea/core.c
index 9e217b1361ea..fe4fe2440729 100644
--- a/drivers/usb/chipidea/core.c
+++ b/drivers/usb/chipidea/core.c
@@ -843,7 +843,10 @@ static ssize_t ci_role_show(struct device *dev, struct device_attribute *attr,
 {
         struct ci_hdrc *ci = dev_get_drvdata(dev);
 
-        return sprintf(buf, "%s\n", ci_role(ci)->name);
+        if (ci->role != CI_ROLE_END)
+                return sprintf(buf, "%s\n", ci_role(ci)->name);
+
+        return 0;
 }
 
 static ssize_t ci_role_store(struct device *dev,
diff --git a/drivers/usb/chipidea/debug.c b/drivers/usb/chipidea/debug.c
index 6d23eede4d8c..1c31e8a08810 100644
--- a/drivers/usb/chipidea/debug.c
+++ b/drivers/usb/chipidea/debug.c
@@ -294,7 +294,8 @@ static int ci_role_show(struct seq_file *s, void *data)
 {
         struct ci_hdrc *ci = s->private;
 
-        seq_printf(s, "%s\n", ci_role(ci)->name);
+        if (ci->role != CI_ROLE_END)
+                seq_printf(s, "%s\n", ci_role(ci)->name);
 
         return 0;
 }
diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c
index 56d2d3213076..d68b125796f9 100644
--- a/drivers/usb/chipidea/udc.c
+++ b/drivers/usb/chipidea/udc.c
@@ -1993,6 +1993,7 @@ static void udc_id_switch_for_host(struct ci_hdrc *ci)
 int ci_hdrc_gadget_init(struct ci_hdrc *ci)
 {
         struct ci_role_driver *rdrv;
+        int ret;
 
         if (!hw_read(ci, CAP_DCCPARAMS, DCCPARAMS_DC))
                 return -ENXIO;
@@ -2005,7 +2006,10 @@ int ci_hdrc_gadget_init(struct ci_hdrc *ci)
         rdrv->stop      = udc_id_switch_for_host;
         rdrv->irq       = udc_irq;
         rdrv->name      = "gadget";
-        ci->roles[CI_ROLE_GADGET] = rdrv;
 
-        return udc_start(ci);
+        ret = udc_start(ci);
+        if (!ret)
+                ci->roles[CI_ROLE_GADGET] = rdrv;
+
+        return ret;
 }
diff --git a/drivers/usb/chipidea/usbmisc_imx.c b/drivers/usb/chipidea/usbmisc_imx.c
index e77a4ed4f021..9f4a0185dd60 100644
--- a/drivers/usb/chipidea/usbmisc_imx.c
+++ b/drivers/usb/chipidea/usbmisc_imx.c
@@ -108,6 +108,8 @@ struct imx_usbmisc {
         const struct usbmisc_ops *ops;
 };
 
+static inline bool is_imx53_usbmisc(struct imx_usbmisc_data *data);
+
 static int usbmisc_imx25_init(struct imx_usbmisc_data *data)
 {
         struct imx_usbmisc *usbmisc = dev_get_drvdata(data->dev);
@@ -242,10 +244,15 @@ static int usbmisc_imx53_init(struct imx_usbmisc_data *data)
                         val = readl(reg) | MX53_USB_UHx_CTRL_WAKE_UP_EN
                                 | MX53_USB_UHx_CTRL_ULPI_INT_EN;
                         writel(val, reg);
-                        /* Disable internal 60Mhz clock */
-                        reg = usbmisc->base + MX53_USB_CLKONOFF_CTRL_OFFSET;
-                        val = readl(reg) | MX53_USB_CLKONOFF_CTRL_H2_INT60CKOFF;
-                        writel(val, reg);
+                        if (is_imx53_usbmisc(data)) {
+                                /* Disable internal 60Mhz clock */
+                                reg = usbmisc->base +
+                                        MX53_USB_CLKONOFF_CTRL_OFFSET;
+                                val = readl(reg) |
+                                        MX53_USB_CLKONOFF_CTRL_H2_INT60CKOFF;
+                                writel(val, reg);
+                        }
+
                 }
                 if (data->disable_oc) {
                         reg = usbmisc->base + MX53_USB_UH2_CTRL_OFFSET;
@@ -267,10 +274,15 @@ static int usbmisc_imx53_init(struct imx_usbmisc_data *data)
                         val = readl(reg) | MX53_USB_UHx_CTRL_WAKE_UP_EN
                                 | MX53_USB_UHx_CTRL_ULPI_INT_EN;
                         writel(val, reg);
-                        /* Disable internal 60Mhz clock */
-                        reg = usbmisc->base + MX53_USB_CLKONOFF_CTRL_OFFSET;
-                        val = readl(reg) | MX53_USB_CLKONOFF_CTRL_H3_INT60CKOFF;
-                        writel(val, reg);
+
+                        if (is_imx53_usbmisc(data)) {
+                                /* Disable internal 60Mhz clock */
+                                reg = usbmisc->base +
+                                        MX53_USB_CLKONOFF_CTRL_OFFSET;
+                                val = readl(reg) |
+                                        MX53_USB_CLKONOFF_CTRL_H3_INT60CKOFF;
+                                writel(val, reg);
+                        }
                 }
                 if (data->disable_oc) {
                         reg = usbmisc->base + MX53_USB_UH3_CTRL_OFFSET;
@@ -456,6 +468,10 @@ static const struct usbmisc_ops imx27_usbmisc_ops = {
         .init = usbmisc_imx27_init,
 };
 
+static const struct usbmisc_ops imx51_usbmisc_ops = {
+        .init = usbmisc_imx53_init,
+};
+
 static const struct usbmisc_ops imx53_usbmisc_ops = {
         .init = usbmisc_imx53_init,
 };
@@ -479,6 +495,13 @@ static const struct usbmisc_ops imx7d_usbmisc_ops = {
         .set_wakeup = usbmisc_imx7d_set_wakeup,
 };
 
+static inline bool is_imx53_usbmisc(struct imx_usbmisc_data *data)
+{
+        struct imx_usbmisc *usbmisc = dev_get_drvdata(data->dev);
+
+        return usbmisc->ops == &imx53_usbmisc_ops;
+}
+
 int imx_usbmisc_init(struct imx_usbmisc_data *data)
 {
         struct imx_usbmisc *usbmisc;
@@ -536,7 +559,7 @@ static const struct of_device_id usbmisc_imx_dt_ids[] = {
         },
         {
                 .compatible = "fsl,imx51-usbmisc",
-                .data = &imx53_usbmisc_ops,
+                .data = &imx51_usbmisc_ops,
         },
         {
                 .compatible = "fsl,imx53-usbmisc",
diff --git a/drivers/usb/dwc2/params.c b/drivers/usb/dwc2/params.c
index 9cd8722f24f6..a3ffe97170ff 100644
--- a/drivers/usb/dwc2/params.c
+++ b/drivers/usb/dwc2/params.c
@@ -144,6 +144,8 @@ const struct of_device_id dwc2_of_match_table[] = {
         { .compatible = "lantiq,xrx200-usb", .data = dwc2_set_ltq_params },
         { .compatible = "snps,dwc2" },
         { .compatible = "samsung,s3c6400-hsotg" },
+        { .compatible = "amlogic,meson8-usb",
+          .data = dwc2_set_amlogic_params },
         { .compatible = "amlogic,meson8b-usb",
           .data = dwc2_set_amlogic_params },
         { .compatible = "amlogic,meson-gxbb-usb",
diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
index 49d685ad0da9..45b554032332 100644
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -315,6 +315,9 @@ void usb_remove_function(struct usb_configuration *c, struct usb_function *f)
         list_del(&f->list);
         if (f->unbind)
                 f->unbind(c, f);
+
+        if (f->bind_deactivated)
+                usb_function_activate(f);
 }
 EXPORT_SYMBOL_GPL(usb_remove_function);
 
@@ -956,12 +959,8 @@ static void remove_config(struct usb_composite_dev *cdev,
 
                 f = list_first_entry(&config->functions,
                                 struct usb_function, list);
-                list_del(&f->list);
-                if (f->unbind) {
-                        DBG(cdev, "unbind function '%s'/%p\n", f->name, f);
-                        f->unbind(config, f);
-                        /* may free memory for "f" */
-                }
+
+                usb_remove_function(config, f);
         }
         list_del(&config->list);
         if (config->unbind) {
diff --git a/drivers/usb/gadget/function/f_mass_storage.c b/drivers/usb/gadget/function/f_mass_storage.c
index 4c8aacc232c0..74d57d6994da 100644
--- a/drivers/usb/gadget/function/f_mass_storage.c
+++ b/drivers/usb/gadget/function/f_mass_storage.c
@@ -396,7 +396,11 @@ static int fsg_set_halt(struct fsg_dev *fsg, struct usb_ep *ep)
 /* Caller must hold fsg->lock */
 static void wakeup_thread(struct fsg_common *common)
 {
-        smp_wmb();      /* ensure the write of bh->state is complete */
+        /*
+         * Ensure the reading of thread_wakeup_needed
+         * and the writing of bh->state are completed
+         */
+        smp_mb();
         /* Tell the main thread that something has happened */
         common->thread_wakeup_needed = 1;
         if (common->thread_task)
@@ -627,7 +631,12 @@ static int sleep_thread(struct fsg_common *common, bool can_freeze)
         }
         __set_current_state(TASK_RUNNING);
         common->thread_wakeup_needed = 0;
-        smp_rmb();      /* ensure the latest bh->state is visible */
+
+        /*
+         * Ensure the writing of thread_wakeup_needed
+         * and the reading of bh->state are completed
+         */
+        smp_mb();
         return rc;
 }
 
diff --git a/drivers/usb/gadget/function/f_phonet.c b/drivers/usb/gadget/function/f_phonet.c
index b4058f0000e4..6a1ce6a55158 100644
--- a/drivers/usb/gadget/function/f_phonet.c
+++ b/drivers/usb/gadget/function/f_phonet.c
@@ -281,7 +281,7 @@ static void pn_net_setup(struct net_device *dev)
         dev->tx_queue_len       = 1;
 
         dev->netdev_ops         = &pn_netdev_ops;
-        dev->destructor         = free_netdev;
+        dev->needs_free_netdev  = true;
         dev->header_ops         = &phonet_header_ops;
 }
 
diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
index b9ca0a26cbd9..684900fcfe24 100644
--- a/drivers/usb/gadget/legacy/inode.c
+++ b/drivers/usb/gadget/legacy/inode.c
@@ -1183,8 +1183,10 @@ dev_release (struct inode *inode, struct file *fd)
 
         /* closing ep0 === shutdown all */
 
-        if (dev->gadget_registered)
+        if (dev->gadget_registered) {
                 usb_gadget_unregister_driver (&gadgetfs_driver);
+                dev->gadget_registered = false;
+        }
 
         /* at this point "good" hardware has disconnected the
          * device from USB; the host won't see it any more.
@@ -1677,9 +1679,10 @@ static void
 gadgetfs_suspend (struct usb_gadget *gadget)
 {
         struct dev_data         *dev = get_gadget_data (gadget);
+        unsigned long           flags;
 
         INFO (dev, "suspended from state %d\n", dev->state);
-        spin_lock (&dev->lock);
+        spin_lock_irqsave(&dev->lock, flags);
         switch (dev->state) {
         case STATE_DEV_SETUP:           // VERY odd... host died??
         case STATE_DEV_CONNECTED:
@@ -1690,7 +1693,7 @@ gadgetfs_suspend (struct usb_gadget *gadget)
         default:
                 break;
         }
-        spin_unlock (&dev->lock);
+        spin_unlock_irqrestore(&dev->lock, flags);
 }
 
 static struct usb_gadget_driver gadgetfs_driver = {
diff --git a/drivers/usb/gadget/udc/dummy_hcd.c b/drivers/usb/gadget/udc/dummy_hcd.c
index ccabb51cb98d..7635fd7cc328 100644
--- a/drivers/usb/gadget/udc/dummy_hcd.c
+++ b/drivers/usb/gadget/udc/dummy_hcd.c
@@ -442,23 +442,16 @@ static void set_link_state(struct dummy_hcd *dum_hcd)
                 /* Report reset and disconnect events to the driver */
                 if (dum->driver && (disconnect || reset)) {
                         stop_activity(dum);
-                        spin_unlock(&dum->lock);
                         if (reset)
                                 usb_gadget_udc_reset(&dum->gadget, dum->driver);
                         else
                                 dum->driver->disconnect(&dum->gadget);
-                        spin_lock(&dum->lock);
                 }
         } else if (dum_hcd->active != dum_hcd->old_active) {
-                if (dum_hcd->old_active && dum->driver->suspend) {
-                        spin_unlock(&dum->lock);
+                if (dum_hcd->old_active && dum->driver->suspend)
                         dum->driver->suspend(&dum->gadget);
-                        spin_lock(&dum->lock);
-                } else if (!dum_hcd->old_active &&  dum->driver->resume) {
-                        spin_unlock(&dum->lock);
+                else if (!dum_hcd->old_active &&  dum->driver->resume)
                         dum->driver->resume(&dum->gadget);
-                        spin_lock(&dum->lock);
-                }
         }
 
         dum_hcd->old_status = dum_hcd->port_status;
@@ -983,7 +976,9 @@ static int dummy_udc_stop(struct usb_gadget *g)
         struct dummy_hcd        *dum_hcd = gadget_to_dummy_hcd(g);
         struct dummy            *dum = dum_hcd->dum;
 
+        spin_lock_irq(&dum->lock);
         dum->driver = NULL;
+        spin_unlock_irq(&dum->lock);
 
         return 0;
 }
diff --git a/drivers/usb/gadget/udc/net2280.c b/drivers/usb/gadget/udc/net2280.c
index 6cf07857eaca..f2cbd7f8005e 100644
--- a/drivers/usb/gadget/udc/net2280.c
+++ b/drivers/usb/gadget/udc/net2280.c
@@ -2470,11 +2470,8 @@ static void stop_activity(struct net2280 *dev, struct usb_gadget_driver *driver)
                 nuke(&dev->ep[i]);
 
         /* report disconnect; the driver is already quiesced */
-        if (driver) {
-                spin_unlock(&dev->lock);
+        if (driver)
                 driver->disconnect(&dev->gadget);
-                spin_lock(&dev->lock);
-        }
 
         usb_reinit(dev);
 }
@@ -3348,8 +3345,6 @@ next_endpoints:
                 BIT(PCI_RETRY_ABORT_INTERRUPT))
 
 static void handle_stat1_irqs(struct net2280 *dev, u32 stat)
-__releases(dev->lock)
-__acquires(dev->lock)
 {
         struct net2280_ep       *ep;
         u32                     tmp, num, mask, scratch;
@@ -3390,14 +3385,12 @@ __acquires(dev->lock)
                         if (disconnect || reset) {
                                 stop_activity(dev, dev->driver);
                                 ep0_start(dev);
-                                spin_unlock(&dev->lock);
                                 if (reset)
                                         usb_gadget_udc_reset
                                                 (&dev->gadget, dev->driver);
                                 else
                                         (dev->driver->disconnect)
                                                 (&dev->gadget);
-                                spin_lock(&dev->lock);
                                 return;
                         }
                 }
diff --git a/drivers/usb/gadget/udc/renesas_usb3.c b/drivers/usb/gadget/udc/renesas_usb3.c
index 5a2d845fb1a6..cd4c88529721 100644
--- a/drivers/usb/gadget/udc/renesas_usb3.c
+++ b/drivers/usb/gadget/udc/renesas_usb3.c
@@ -623,7 +623,6 @@ static void renesas_usb3_stop_controller(struct renesas_usb3 *usb3)
 {
         usb3_disconnect(usb3);
         usb3_write(usb3, 0, USB3_P0_INT_ENA);
-        usb3_write(usb3, 0, USB3_PN_INT_ENA);
         usb3_write(usb3, 0, USB3_USB_OTG_INT_ENA);
         usb3_write(usb3, 0, USB3_USB_INT_ENA_1);
         usb3_write(usb3, 0, USB3_USB_INT_ENA_2);
@@ -1475,7 +1474,13 @@ static void usb3_request_done_pipen(struct renesas_usb3 *usb3,
                                     struct renesas_usb3_request *usb3_req,
                                     int status)
 {
-        usb3_pn_stop(usb3);
+        unsigned long flags;
+
+        spin_lock_irqsave(&usb3->lock, flags);
+        if (usb3_pn_change(usb3, usb3_ep->num))
+                usb3_pn_stop(usb3);
+        spin_unlock_irqrestore(&usb3->lock, flags);
+
         usb3_disable_pipe_irq(usb3, usb3_ep->num);
         usb3_request_done(usb3_ep, usb3_req, status);
 
@@ -1504,30 +1509,46 @@ static void usb3_irq_epc_pipen_bfrdy(struct renesas_usb3 *usb3, int num)
 {
         struct renesas_usb3_ep *usb3_ep = usb3_get_ep(usb3, num);
         struct renesas_usb3_request *usb3_req = usb3_get_request(usb3_ep);
+        bool done = false;
 
         if (!usb3_req)
                 return;
 
+        spin_lock(&usb3->lock);
+        if (usb3_pn_change(usb3, num))
+                goto out;
+
         if (usb3_ep->dir_in) {
                 /* Do not stop the IN pipe here to detect LSTTR interrupt */
                 if (!usb3_write_pipe(usb3_ep, usb3_req, USB3_PN_WRITE))
                         usb3_clear_bit(usb3, PN_INT_BFRDY, USB3_PN_INT_ENA);
         } else {
                 if (!usb3_read_pipe(usb3_ep, usb3_req, USB3_PN_READ))
-                        usb3_request_done_pipen(usb3, usb3_ep, usb3_req, 0);
+                        done = true;
         }
+
+out:
+        /* need to unlock because usb3_request_done_pipen() locks it */
+        spin_unlock(&usb3->lock);
+
+        if (done)
+                usb3_request_done_pipen(usb3, usb3_ep, usb3_req, 0);
 }
 
 static void usb3_irq_epc_pipen(struct renesas_usb3 *usb3, int num)
 {
         u32 pn_int_sta;
 
-        if (usb3_pn_change(usb3, num) < 0)
+        spin_lock(&usb3->lock);
+        if (usb3_pn_change(usb3, num) < 0) {
+                spin_unlock(&usb3->lock);
                 return;
+        }
 
         pn_int_sta = usb3_read(usb3, USB3_PN_INT_STA);
         pn_int_sta &= usb3_read(usb3, USB3_PN_INT_ENA);
         usb3_write(usb3, pn_int_sta, USB3_PN_INT_STA);
+        spin_unlock(&usb3->lock);
         if (pn_int_sta & PN_INT_LSTTR)
                 usb3_irq_epc_pipen_lsttr(usb3, num);
         if (pn_int_sta & PN_INT_BFRDY)
@@ -1660,6 +1681,7 @@ static int usb3_disable_pipe_n(struct renesas_usb3_ep *usb3_ep)
 
         spin_lock_irqsave(&usb3->lock, flags);
         if (!usb3_pn_change(usb3, usb3_ep->num)) {
+                usb3_write(usb3, 0, USB3_PN_INT_ENA);
                 usb3_write(usb3, 0, USB3_PN_RAMMAP);
                 usb3_clear_bit(usb3, PN_CON_EN, USB3_PN_CON);
         }
@@ -1799,6 +1821,9 @@ static int renesas_usb3_start(struct usb_gadget *gadget,
         /* hook up the driver */
         usb3->driver = driver;
 
+        pm_runtime_enable(usb3_to_dev(usb3));
+        pm_runtime_get_sync(usb3_to_dev(usb3));
+
         renesas_usb3_init_controller(usb3);
 
         return 0;
@@ -1807,14 +1832,14 @@ static int renesas_usb3_start(struct usb_gadget *gadget,
 static int renesas_usb3_stop(struct usb_gadget *gadget)
 {
         struct renesas_usb3 *usb3 = gadget_to_renesas_usb3(gadget);
-        unsigned long flags;
 
-        spin_lock_irqsave(&usb3->lock, flags);
         usb3->softconnect = false;
         usb3->gadget.speed = USB_SPEED_UNKNOWN;
         usb3->driver = NULL;
         renesas_usb3_stop_controller(usb3);
-        spin_unlock_irqrestore(&usb3->lock, flags);
+
+        pm_runtime_put(usb3_to_dev(usb3));
+        pm_runtime_disable(usb3_to_dev(usb3));
 
         return 0;
 }
@@ -1891,9 +1916,6 @@ static int renesas_usb3_remove(struct platform_device *pdev)
 
         device_remove_file(&pdev->dev, &dev_attr_role);
 
-        pm_runtime_put(&pdev->dev);
-        pm_runtime_disable(&pdev->dev);
-
         usb_del_gadget_udc(&usb3->gadget);
 
         __renesas_usb3_ep_free_request(usb3->ep0_req);
@@ -2099,9 +2121,6 @@ static int renesas_usb3_probe(struct platform_device *pdev)
 
         usb3->workaround_for_vbus = priv->workaround_for_vbus;
 
-        pm_runtime_enable(&pdev->dev);
-        pm_runtime_get_sync(&pdev->dev);
-
         dev_info(&pdev->dev, "probed\n");
 
         return 0;
diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
index 1f1687e888d6..fddf2731f798 100644
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -2119,11 +2119,12 @@ static void xhci_add_in_port(struct xhci_hcd *xhci, unsigned int num_ports,
 {
         u32 temp, port_offset, port_count;
         int i;
-        u8 major_revision;
+        u8 major_revision, minor_revision;
         struct xhci_hub *rhub;
 
         temp = readl(addr);
         major_revision = XHCI_EXT_PORT_MAJOR(temp);
+        minor_revision = XHCI_EXT_PORT_MINOR(temp);
 
         if (major_revision == 0x03) {
                 rhub = &xhci->usb3_rhub;
@@ -2137,7 +2138,9 @@ static void xhci_add_in_port(struct xhci_hcd *xhci, unsigned int num_ports,
                 return;
         }
         rhub->maj_rev = XHCI_EXT_PORT_MAJOR(temp);
-        rhub->min_rev = XHCI_EXT_PORT_MINOR(temp);
+
+        if (rhub->min_rev < minor_revision)
+                rhub->min_rev = minor_revision;
 
         /* Port offset and count in the third dword, see section 7.2 */
         temp = readl(addr + 2);
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index fcf1f3f63e7a..1bcf971141c0 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -201,6 +201,9 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
         if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
                         pdev->device == 0x1042)
                 xhci->quirks |= XHCI_BROKEN_STREAMS;
+        if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
+                        pdev->device == 0x1142)
+                xhci->quirks |= XHCI_TRUST_TX_LENGTH;
 
         if (pdev->vendor == PCI_VENDOR_ID_TI && pdev->device == 0x8241)
                 xhci->quirks |= XHCI_LIMIT_ENDPOINT_INTERVAL_7;
diff --git a/drivers/usb/musb/musb_dsps.c b/drivers/usb/musb/musb_dsps.c
index 9c7ee26ef388..bc6a9be2ccc5 100644
--- a/drivers/usb/musb/musb_dsps.c
+++ b/drivers/usb/musb/musb_dsps.c
@@ -245,6 +245,11 @@ static int dsps_check_status(struct musb *musb, void *unused)
                 dsps_mod_timer_optional(glue);
                 break;
         case OTG_STATE_A_WAIT_BCON:
+                /* keep VBUS on for host-only mode */
+                if (musb->port_mode == MUSB_PORT_MODE_HOST) {
+                        dsps_mod_timer_optional(glue);
+                        break;
+                }
                 musb_writeb(musb->mregs, MUSB_DEVCTL, 0);
                 skip_session = 1;
                 /* fall */
diff --git a/drivers/video/fbdev/core/fbmon.c b/drivers/video/fbdev/core/fbmon.c
index 687ebb053438..41d7979d81c5 100644
--- a/drivers/video/fbdev/core/fbmon.c
+++ b/drivers/video/fbdev/core/fbmon.c
@@ -1048,7 +1048,7 @@ void fb_edid_add_monspecs(unsigned char *edid, struct fb_monspecs *specs)
 
         for (i = 0; i < (128 - edid[2]) / DETAILED_TIMING_DESCRIPTION_SIZE;
              i++, block += DETAILED_TIMING_DESCRIPTION_SIZE)
-                if (PIXEL_CLOCK)
+                if (PIXEL_CLOCK != 0)
                         edt[num++] = block - edid;
 
         /* Yikes, EDID data is totally useless */
diff --git a/drivers/video/fbdev/smscufx.c b/drivers/video/fbdev/smscufx.c
index ec2e7e353685..449fceaf79d5 100644
--- a/drivers/video/fbdev/smscufx.c
+++ b/drivers/video/fbdev/smscufx.c
@@ -1646,8 +1646,9 @@ static int ufx_usb_probe(struct usb_interface *interface,
         dev_dbg(dev->gdev, "%s %s - serial #%s\n",
                 usbdev->manufacturer, usbdev->product, usbdev->serial);
         dev_dbg(dev->gdev, "vid_%04x&pid_%04x&rev_%04x driver's ufx_data struct at %p\n",
-                usbdev->descriptor.idVendor, usbdev->descriptor.idProduct,
-                usbdev->descriptor.bcdDevice, dev);
+                le16_to_cpu(usbdev->descriptor.idVendor),
+                le16_to_cpu(usbdev->descriptor.idProduct),
+                le16_to_cpu(usbdev->descriptor.bcdDevice), dev);
         dev_dbg(dev->gdev, "console enable=%d\n", console);
         dev_dbg(dev->gdev, "fb_defio enable=%d\n", fb_defio);
 
diff --git a/drivers/video/fbdev/udlfb.c b/drivers/video/fbdev/udlfb.c
index 6a3c353de7c3..05ef657235df 100644
--- a/drivers/video/fbdev/udlfb.c
+++ b/drivers/video/fbdev/udlfb.c
@@ -1105,8 +1105,8 @@ static int dlfb_ops_blank(int blank_mode, struct fb_info *info)
         char *bufptr;
         struct urb *urb;
 
-        pr_info("/dev/fb%d FB_BLANK mode %d --> %d\n",
-                info->node, dev->blank_mode, blank_mode);
+        pr_debug("/dev/fb%d FB_BLANK mode %d --> %d\n",
+                 info->node, dev->blank_mode, blank_mode);
 
         if ((dev->blank_mode == FB_BLANK_POWERDOWN) &&
             (blank_mode != FB_BLANK_POWERDOWN)) {
@@ -1613,8 +1613,9 @@ static int dlfb_usb_probe(struct usb_interface *interface,
         pr_info("%s %s - serial #%s\n",
                 usbdev->manufacturer, usbdev->product, usbdev->serial);
         pr_info("vid_%04x&pid_%04x&rev_%04x driver's dlfb_data struct at %p\n",
-                usbdev->descriptor.idVendor, usbdev->descriptor.idProduct,
-                usbdev->descriptor.bcdDevice, dev);
+                le16_to_cpu(usbdev->descriptor.idVendor),
+                le16_to_cpu(usbdev->descriptor.idProduct),
+                le16_to_cpu(usbdev->descriptor.bcdDevice), dev);
         pr_info("console enable=%d\n", console);
         pr_info("fb_defio enable=%d\n", fb_defio);
         pr_info("shadow enable=%d\n", shadow);
diff --git a/drivers/video/fbdev/via/viafbdev.c b/drivers/video/fbdev/via/viafbdev.c
index f9718f012aae..badee04ef496 100644
--- a/drivers/video/fbdev/via/viafbdev.c
+++ b/drivers/video/fbdev/via/viafbdev.c
@@ -1630,16 +1630,14 @@ static void viafb_init_proc(struct viafb_shared *shared)
 }
 static void viafb_remove_proc(struct viafb_shared *shared)
 {
-        struct proc_dir_entry *viafb_entry = shared->proc_entry,
-                *iga1_entry = shared->iga1_proc_entry,
-                *iga2_entry = shared->iga2_proc_entry;
+        struct proc_dir_entry *viafb_entry = shared->proc_entry;
 
         if (!viafb_entry)
                 return;
 
-        remove_proc_entry("output_devices", iga2_entry);
+        remove_proc_entry("output_devices", shared->iga2_proc_entry);
         remove_proc_entry("iga2", viafb_entry);
-        remove_proc_entry("output_devices", iga1_entry);
+        remove_proc_entry("output_devices", shared->iga1_proc_entry);
         remove_proc_entry("iga1", viafb_entry);
         remove_proc_entry("supported_output_devices", viafb_entry);
 
diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c
index 408c174ef0d5..22caf808bfab 100644
--- a/drivers/virtio/virtio_balloon.c
+++ b/drivers/virtio/virtio_balloon.c
@@ -663,6 +663,12 @@ static int virtballoon_restore(struct virtio_device *vdev)
 }
 #endif
 
+static int virtballoon_validate(struct virtio_device *vdev)
+{
+        __virtio_clear_bit(vdev, VIRTIO_F_IOMMU_PLATFORM);
+        return 0;
+}
+
 static unsigned int features[] = {
         VIRTIO_BALLOON_F_MUST_TELL_HOST,
         VIRTIO_BALLOON_F_STATS_VQ,
@@ -675,6 +681,7 @@ static struct virtio_driver virtio_balloon_driver = {
         .driver.name =  KBUILD_MODNAME,
         .driver.owner = THIS_MODULE,
         .id_table =     id_table,
+        .validate =     virtballoon_validate,
         .probe =        virtballoon_probe,
         .remove =       virtballoon_remove,
         .config_changed = virtballoon_changed,
diff --git a/drivers/xen/privcmd.c b/drivers/xen/privcmd.c
index 7a92a5e1d40c..feca75b07fdd 100644
--- a/drivers/xen/privcmd.c
+++ b/drivers/xen/privcmd.c
@@ -362,8 +362,8 @@ static int mmap_batch_fn(void *data, int nr, void *state)
                                 st->global_error = 1;
                 }
         }
-        st->va += PAGE_SIZE * nr;
-        st->index += nr;
+        st->va += XEN_PAGE_SIZE * nr;
+        st->index += nr / XEN_PFN_PER_PAGE;
 
         return 0;
 }