340 files changed, 3599 insertions, 2091 deletions

diff --git a/drivers/acpi/acpi_watchdog.c b/drivers/acpi/acpi_watchdog.c
index bf22c29d2517..11b113f8e367 100644
--- a/drivers/acpi/acpi_watchdog.c
+++ b/drivers/acpi/acpi_watchdog.c
@@ -66,7 +66,7 @@ void __init acpi_watchdog_init(void)
         for (i = 0; i < wdat->entries; i++) {
                 const struct acpi_generic_address *gas;
                 struct resource_entry *rentry;
-                struct resource res;
+                struct resource res = {};
                 bool found;
 
                 gas = &entries[i].register_region;
diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c
index 077f9bad6f44..3c3a37b8503b 100644
--- a/drivers/acpi/apei/ghes.c
+++ b/drivers/acpi/apei/ghes.c
@@ -743,17 +743,19 @@ static int ghes_proc(struct ghes *ghes)
         }
         ghes_do_proc(ghes, ghes->estatus);
 
+out:
+        ghes_clear_estatus(ghes);
+
+        if (rc == -ENOENT)
+                return rc;
+
         /*
          * GHESv2 type HEST entries introduce support for error acknowledgment,
          * so only acknowledge the error if this support is present.
          */
-        if (is_hest_type_generic_v2(ghes)) {
-                rc = ghes_ack_error(ghes->generic_v2);
-                if (rc)
-                        return rc;
-        }
-out:
-        ghes_clear_estatus(ghes);
+        if (is_hest_type_generic_v2(ghes))
+                return ghes_ack_error(ghes->generic_v2);
+
         return rc;
 }
 
diff --git a/drivers/acpi/arm64/iort.c b/drivers/acpi/arm64/iort.c
index 9565d572f8dd..de56394dd161 100644
--- a/drivers/acpi/arm64/iort.c
+++ b/drivers/acpi/arm64/iort.c
@@ -1178,12 +1178,44 @@ dev_put:
         return ret;
 }
 
+static bool __init iort_enable_acs(struct acpi_iort_node *iort_node)
+{
+        if (iort_node->type == ACPI_IORT_NODE_PCI_ROOT_COMPLEX) {
+                struct acpi_iort_node *parent;
+                struct acpi_iort_id_mapping *map;
+                int i;
+
+                map = ACPI_ADD_PTR(struct acpi_iort_id_mapping, iort_node,
+                                   iort_node->mapping_offset);
+
+                for (i = 0; i < iort_node->mapping_count; i++, map++) {
+                        if (!map->output_reference)
+                                continue;
+
+                        parent = ACPI_ADD_PTR(struct acpi_iort_node,
+                                        iort_table,  map->output_reference);
+                        /*
+                         * If we detect a RC->SMMU mapping, make sure
+                         * we enable ACS on the system.
+                         */
+                        if ((parent->type == ACPI_IORT_NODE_SMMU) ||
+                                (parent->type == ACPI_IORT_NODE_SMMU_V3)) {
+                                pci_request_acs();
+                                return true;
+                        }
+                }
+        }
+
+        return false;
+}
+
 static void __init iort_init_platform_devices(void)
 {
         struct acpi_iort_node *iort_node, *iort_end;
         struct acpi_table_iort *iort;
         struct fwnode_handle *fwnode;
         int i, ret;
+        bool acs_enabled = false;
 
         /*
          * iort_table and iort both point to the start of IORT table, but
@@ -1203,6 +1235,9 @@ static void __init iort_init_platform_devices(void)
                         return;
                 }
 
+                if (!acs_enabled)
+                        acs_enabled = iort_enable_acs(iort_node);
+
                 if ((iort_node->type == ACPI_IORT_NODE_SMMU) ||
                         (iort_node->type == ACPI_IORT_NODE_SMMU_V3)) {
 
diff --git a/drivers/acpi/property.c b/drivers/acpi/property.c
index c1c216163de3..3fb8ff513461 100644
--- a/drivers/acpi/property.c
+++ b/drivers/acpi/property.c
@@ -908,11 +908,12 @@ struct fwnode_handle *acpi_get_next_subnode(const struct fwnode_handle *fwnode,
                                             struct fwnode_handle *child)
 {
         const struct acpi_device *adev = to_acpi_device_node(fwnode);
-        struct acpi_device *child_adev = NULL;
         const struct list_head *head;
         struct list_head *next;
 
         if (!child || is_acpi_device_node(child)) {
+                struct acpi_device *child_adev;
+
                 if (adev)
                         head = &adev->children;
                 else
@@ -922,8 +923,8 @@ struct fwnode_handle *acpi_get_next_subnode(const struct fwnode_handle *fwnode,
                         goto nondev;
 
                 if (child) {
-                        child_adev = to_acpi_device_node(child);
-                        next = child_adev->node.next;
+                        adev = to_acpi_device_node(child);
+                        next = adev->node.next;
                         if (next == head) {
                                 child = NULL;
                                 goto nondev;
@@ -941,8 +942,8 @@ struct fwnode_handle *acpi_get_next_subnode(const struct fwnode_handle *fwnode,
                 const struct acpi_data_node *data = to_acpi_data_node(fwnode);
                 struct acpi_data_node *dn;
 
-                if (child_adev)
-                        head = &child_adev->data.subnodes;
+                if (adev)
+                        head = &adev->data.subnodes;
                 else if (data)
                         head = &data->data.subnodes;
                 else
@@ -1293,3 +1294,16 @@ static int acpi_fwnode_graph_parse_endpoint(const struct fwnode_handle *fwnode,
 DECLARE_ACPI_FWNODE_OPS(acpi_device_fwnode_ops);
 DECLARE_ACPI_FWNODE_OPS(acpi_data_fwnode_ops);
 const struct fwnode_operations acpi_static_fwnode_ops;
+
+bool is_acpi_device_node(const struct fwnode_handle *fwnode)
+{
+        return !IS_ERR_OR_NULL(fwnode) &&
+                fwnode->ops == &acpi_device_fwnode_ops;
+}
+EXPORT_SYMBOL(is_acpi_device_node);
+
+bool is_acpi_data_node(const struct fwnode_handle *fwnode)
+{
+        return !IS_ERR_OR_NULL(fwnode) && fwnode->ops == &acpi_data_fwnode_ops;
+}
+EXPORT_SYMBOL(is_acpi_data_node);
diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index d055b3f2a207..ab34239a76ee 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -2217,7 +2217,7 @@ static void binder_transaction_buffer_release(struct binder_proc *proc,
                                        debug_id, (u64)fda->num_fds);
                                 continue;
                         }
-                        fd_array = (u32 *)(parent_buffer + fda->parent_offset);
+                        fd_array = (u32 *)(parent_buffer + (uintptr_t)fda->parent_offset);
                         for (fd_index = 0; fd_index < fda->num_fds; fd_index++)
                                 task_close_fd(proc, fd_array[fd_index]);
                 } break;
@@ -2326,7 +2326,6 @@ static int binder_translate_handle(struct flat_binder_object *fp,
                              (u64)node->ptr);
                 binder_node_unlock(node);
         } else {
-                int ret;
                 struct binder_ref_data dest_rdata;
 
                 binder_node_unlock(node);
@@ -2442,7 +2441,7 @@ static int binder_translate_fd_array(struct binder_fd_array_object *fda,
          */
         parent_buffer = parent->buffer -
                 binder_alloc_get_user_buffer_offset(&target_proc->alloc);
-        fd_array = (u32 *)(parent_buffer + fda->parent_offset);
+        fd_array = (u32 *)(parent_buffer + (uintptr_t)fda->parent_offset);
         if (!IS_ALIGNED((unsigned long)fd_array, sizeof(u32))) {
                 binder_user_error("%d:%d parent offset not aligned correctly.\n",
                                   proc->pid, thread->pid);
@@ -2508,7 +2507,7 @@ static int binder_fixup_parent(struct binder_transaction *t,
                                   proc->pid, thread->pid);
                 return -EINVAL;
         }
-        parent_buffer = (u8 *)(parent->buffer -
+        parent_buffer = (u8 *)((uintptr_t)parent->buffer -
                         binder_alloc_get_user_buffer_offset(
                                 &target_proc->alloc));
         *(binder_uintptr_t *)(parent_buffer + bp->parent_offset) = bp->buffer;
@@ -3083,6 +3082,7 @@ static void binder_transaction(struct binder_proc *proc,
 err_dead_proc_or_thread:
         return_error = BR_DEAD_REPLY;
         return_error_line = __LINE__;
+        binder_dequeue_work(proc, tcomplete);
 err_translate_failed:
 err_bad_object_type:
 err_bad_offset:
diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c
index 8fe165844e47..064f5e31ec55 100644
--- a/drivers/android/binder_alloc.c
+++ b/drivers/android/binder_alloc.c
@@ -913,6 +913,7 @@ enum lru_status binder_alloc_free_page(struct list_head *item,
         struct binder_alloc *alloc;
         uintptr_t page_addr;
         size_t index;
+        struct vm_area_struct *vma;
 
         alloc = page->alloc;
         if (!mutex_trylock(&alloc->mutex))
@@ -923,16 +924,22 @@ enum lru_status binder_alloc_free_page(struct list_head *item,
 
         index = page - alloc->pages;
         page_addr = (uintptr_t)alloc->buffer + index * PAGE_SIZE;
-        if (alloc->vma) {
+        vma = alloc->vma;
+        if (vma) {
                 mm = get_task_mm(alloc->tsk);
                 if (!mm)
                         goto err_get_task_mm_failed;
                 if (!down_write_trylock(&mm->mmap_sem))
                         goto err_down_write_mmap_sem_failed;
+        }
+
+        list_lru_isolate(lru, item);
+        spin_unlock(lock);
 
+        if (vma) {
                 trace_binder_unmap_user_start(alloc, index);
 
-                zap_page_range(alloc->vma,
+                zap_page_range(vma,
                                page_addr + alloc->user_buffer_offset,
                                PAGE_SIZE);
 
@@ -950,13 +957,12 @@ enum lru_status binder_alloc_free_page(struct list_head *item,
 
         trace_binder_unmap_kernel_end(alloc, index);
 
-        list_lru_isolate(lru, item);
-
+        spin_lock(lock);
         mutex_unlock(&alloc->mutex);
-        return LRU_REMOVED;
+        return LRU_REMOVED_RETRY;
 
 err_down_write_mmap_sem_failed:
-        mmput(mm);
+        mmput_async(mm);
 err_get_task_mm_failed:
 err_page_already_freed:
         mutex_unlock(&alloc->mutex);
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index cb9b0e9090e3..9f78bb03bb76 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -621,8 +621,11 @@ static void ahci_pci_save_initial_config(struct pci_dev *pdev,
 static int ahci_pci_reset_controller(struct ata_host *host)
 {
         struct pci_dev *pdev = to_pci_dev(host->dev);
+        int rc;
 
-        ahci_reset_controller(host);
+        rc = ahci_reset_controller(host);
+        if (rc)
+                return rc;
 
         if (pdev->vendor == PCI_VENDOR_ID_INTEL) {
                 struct ahci_host_priv *hpriv = host->private_data;
diff --git a/drivers/ata/ata_piix.c b/drivers/ata/ata_piix.c
index 8401c3b5be92..b702c20fbc2b 100644
--- a/drivers/ata/ata_piix.c
+++ b/drivers/ata/ata_piix.c
@@ -492,6 +492,7 @@ static const struct ich_laptop ich_laptop[] = {
         { 0x27DF, 0x152D, 0x0778 },     /* ICH7 on unknown Intel */
         { 0x24CA, 0x1025, 0x0061 },     /* ICH4 on ACER Aspire 2023WLMi */
         { 0x24CA, 0x1025, 0x003d },     /* ICH4 on ACER TM290 */
+        { 0x24CA, 0x10CF, 0x11AB },     /* ICH4M on Fujitsu-Siemens Lifebook S6120 */
         { 0x266F, 0x1025, 0x0066 },     /* ICH6 on ACER Aspire 1694WLMi */
         { 0x2653, 0x1043, 0x82D8 },     /* ICH6M on Asus Eee 701 */
         { 0x27df, 0x104d, 0x900e },     /* ICH7 on Sony TZ-90 */
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 1945a8ea2099..ee4c1ec9dca0 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -3234,19 +3234,19 @@ static const struct ata_timing ata_timing[] = {
 };
 
 #define ENOUGH(v, unit)         (((v)-1)/(unit)+1)
-#define EZ(v, unit)             ((v)?ENOUGH(v, unit):0)
+#define EZ(v, unit)             ((v)?ENOUGH(((v) * 1000), unit):0)
 
 static void ata_timing_quantize(const struct ata_timing *t, struct ata_timing *q, int T, int UT)
 {
-        q->setup        = EZ(t->setup      * 1000,  T);
-        q->act8b        = EZ(t->act8b      * 1000,  T);
-        q->rec8b        = EZ(t->rec8b      * 1000,  T);
-        q->cyc8b        = EZ(t->cyc8b      * 1000,  T);
-        q->active       = EZ(t->active     * 1000,  T);
-        q->recover      = EZ(t->recover    * 1000,  T);
-        q->dmack_hold   = EZ(t->dmack_hold * 1000,  T);
-        q->cycle        = EZ(t->cycle      * 1000,  T);
-        q->udma         = EZ(t->udma       * 1000, UT);
+        q->setup        = EZ(t->setup,       T);
+        q->act8b        = EZ(t->act8b,       T);
+        q->rec8b        = EZ(t->rec8b,       T);
+        q->cyc8b        = EZ(t->cyc8b,       T);
+        q->active       = EZ(t->active,      T);
+        q->recover      = EZ(t->recover,     T);
+        q->dmack_hold   = EZ(t->dmack_hold,  T);
+        q->cycle        = EZ(t->cycle,       T);
+        q->udma         = EZ(t->udma,       UT);
 }
 
 void ata_timing_merge(const struct ata_timing *a, const struct ata_timing *b,
diff --git a/drivers/auxdisplay/charlcd.c b/drivers/auxdisplay/charlcd.c
index cfeb049a01ef..642afd88870b 100644
--- a/drivers/auxdisplay/charlcd.c
+++ b/drivers/auxdisplay/charlcd.c
@@ -647,18 +647,25 @@ static ssize_t charlcd_write(struct file *file, const char __user *buf,
 static int charlcd_open(struct inode *inode, struct file *file)
 {
         struct charlcd_priv *priv = to_priv(the_charlcd);
+        int ret;
 
+        ret = -EBUSY;
         if (!atomic_dec_and_test(&charlcd_available))
-                return -EBUSY;  /* open only once at a time */
+                goto fail;      /* open only once at a time */
 
+        ret = -EPERM;
         if (file->f_mode & FMODE_READ)  /* device is write-only */
-                return -EPERM;
+                goto fail;
 
         if (priv->must_clear) {
                 charlcd_clear_display(&priv->lcd);
                 priv->must_clear = false;
         }
         return nonseekable_open(inode, file);
+
+ fail:
+        atomic_inc(&charlcd_available);
+        return ret;
 }
 
 static int charlcd_release(struct inode *inode, struct file *file)
diff --git a/drivers/auxdisplay/panel.c b/drivers/auxdisplay/panel.c
index df126dcdaf18..6911acd896d9 100644
--- a/drivers/auxdisplay/panel.c
+++ b/drivers/auxdisplay/panel.c
@@ -1105,14 +1105,21 @@ static ssize_t keypad_read(struct file *file,
 
 static int keypad_open(struct inode *inode, struct file *file)
 {
+        int ret;
+
+        ret = -EBUSY;
         if (!atomic_dec_and_test(&keypad_available))
-                return -EBUSY;  /* open only once at a time */
+                goto fail;      /* open only once at a time */
 
+        ret = -EPERM;
         if (file->f_mode & FMODE_WRITE) /* device is read-only */
-                return -EPERM;
+                goto fail;
 
         keypad_buflen = 0;      /* flush the buffer on opening */
         return 0;
+ fail:
+        atomic_inc(&keypad_available);
+        return ret;
 }
 
 static int keypad_release(struct inode *inode, struct file *file)
diff --git a/drivers/base/arch_topology.c b/drivers/base/arch_topology.c
index 41be9ff7d70a..6df7d6676a48 100644
--- a/drivers/base/arch_topology.c
+++ b/drivers/base/arch_topology.c
@@ -166,11 +166,11 @@ bool __init topology_parse_cpu_capacity(struct device_node *cpu_node, int cpu)
 }
 
 #ifdef CONFIG_CPU_FREQ
-static cpumask_var_t cpus_to_visit;
-static void parsing_done_workfn(struct work_struct *work);
-static DECLARE_WORK(parsing_done_work, parsing_done_workfn);
+static cpumask_var_t cpus_to_visit __initdata;
+static void __init parsing_done_workfn(struct work_struct *work);
+static __initdata DECLARE_WORK(parsing_done_work, parsing_done_workfn);
 
-static int
+static int __init
 init_cpu_capacity_callback(struct notifier_block *nb,
                            unsigned long val,
                            void *data)
@@ -206,7 +206,7 @@ init_cpu_capacity_callback(struct notifier_block *nb,
         return 0;
 }
 
-static struct notifier_block init_cpu_capacity_notifier = {
+static struct notifier_block init_cpu_capacity_notifier __initdata = {
         .notifier_call = init_cpu_capacity_callback,
 };
 
@@ -232,7 +232,7 @@ static int __init register_cpufreq_notifier(void)
 }
 core_initcall(register_cpufreq_notifier);
 
-static void parsing_done_workfn(struct work_struct *work)
+static void __init parsing_done_workfn(struct work_struct *work)
 {
         cpufreq_unregister_notifier(&init_cpu_capacity_notifier,
                                          CPUFREQ_POLICY_NOTIFIER);
diff --git a/drivers/base/dma-coherent.c b/drivers/base/dma-coherent.c
index a39b2166b145..744f64f43454 100644
--- a/drivers/base/dma-coherent.c
+++ b/drivers/base/dma-coherent.c
@@ -348,16 +348,15 @@ static int rmem_dma_device_init(struct reserved_mem *rmem, struct device *dev)
         struct dma_coherent_mem *mem = rmem->priv;
         int ret;
 
-        if (!mem)
-                return -ENODEV;
-
-        ret = dma_init_coherent_memory(rmem->base, rmem->base, rmem->size,
-                                       DMA_MEMORY_EXCLUSIVE, &mem);
-
-        if (ret) {
-                pr_err("Reserved memory: failed to init DMA memory pool at %pa, size %ld MiB\n",
-                        &rmem->base, (unsigned long)rmem->size / SZ_1M);
-                return ret;
+        if (!mem) {
+                ret = dma_init_coherent_memory(rmem->base, rmem->base,
+                                               rmem->size,
+                                               DMA_MEMORY_EXCLUSIVE, &mem);
+                if (ret) {
+                        pr_err("Reserved memory: failed to init DMA memory pool at %pa, size %ld MiB\n",
+                                &rmem->base, (unsigned long)rmem->size / SZ_1M);
+                        return ret;
+                }
         }
         mem->use_dev_dma_pfn_offset = true;
         rmem->priv = mem;
diff --git a/drivers/base/platform.c b/drivers/base/platform.c
index d1bd99271066..9045c5f3734e 100644
--- a/drivers/base/platform.c
+++ b/drivers/base/platform.c
@@ -868,7 +868,8 @@ static ssize_t driver_override_store(struct device *dev,
         struct platform_device *pdev = to_platform_device(dev);
         char *driver_override, *old, *cp;
 
-        if (count > PATH_MAX)
+        /* We need to keep extra room for a newline */
+        if (count >= (PAGE_SIZE - 1))
                 return -EINVAL;
 
         driver_override = kstrndup(buf, count, GFP_KERNEL);
diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c
index ea1732ed7a9d..770b1539a083 100644
--- a/drivers/base/power/main.c
+++ b/drivers/base/power/main.c
@@ -1860,10 +1860,13 @@ void device_pm_check_callbacks(struct device *dev)
 {
         spin_lock_irq(&dev->power.lock);
         dev->power.no_pm_callbacks =
-                (!dev->bus || pm_ops_is_empty(dev->bus->pm)) &&
-                (!dev->class || pm_ops_is_empty(dev->class->pm)) &&
+                (!dev->bus || (pm_ops_is_empty(dev->bus->pm) &&
+                 !dev->bus->suspend && !dev->bus->resume)) &&
+                (!dev->class || (pm_ops_is_empty(dev->class->pm) &&
+                 !dev->class->suspend && !dev->class->resume)) &&
                 (!dev->type || pm_ops_is_empty(dev->type->pm)) &&
                 (!dev->pm_domain || pm_ops_is_empty(&dev->pm_domain->ops)) &&
-                (!dev->driver || pm_ops_is_empty(dev->driver->pm));
+                (!dev->driver || (pm_ops_is_empty(dev->driver->pm) &&
+                 !dev->driver->suspend && !dev->driver->resume));
         spin_unlock_irq(&dev->power.lock);
 }
diff --git a/drivers/base/power/opp/core.c b/drivers/base/power/opp/core.c
index a8cc14fd8ae4..a6de32530693 100644
--- a/drivers/base/power/opp/core.c
+++ b/drivers/base/power/opp/core.c
@@ -1581,6 +1581,9 @@ static int _opp_set_availability(struct device *dev, unsigned long freq,
 
         opp->available = availability_req;
 
+        dev_pm_opp_get(opp);
+        mutex_unlock(&opp_table->lock);
+
         /* Notify the change of the OPP availability */
         if (availability_req)
                 blocking_notifier_call_chain(&opp_table->head, OPP_EVENT_ENABLE,
@@ -1589,8 +1592,12 @@ static int _opp_set_availability(struct device *dev, unsigned long freq,
                 blocking_notifier_call_chain(&opp_table->head,
                                              OPP_EVENT_DISABLE, opp);
 
+        dev_pm_opp_put(opp);
+        goto put_table;
+
 unlock:
         mutex_unlock(&opp_table->lock);
+put_table:
         dev_pm_opp_put_opp_table(opp_table);
         return r;
 }
diff --git a/drivers/base/power/qos.c b/drivers/base/power/qos.c
index f850daeffba4..277d43a83f53 100644
--- a/drivers/base/power/qos.c
+++ b/drivers/base/power/qos.c
@@ -277,11 +277,11 @@ void dev_pm_qos_constraints_destroy(struct device *dev)
         mutex_unlock(&dev_pm_qos_sysfs_mtx);
 }
 
-static bool dev_pm_qos_invalid_request(struct device *dev,
-                                       struct dev_pm_qos_request *req)
+static bool dev_pm_qos_invalid_req_type(struct device *dev,
+                                        enum dev_pm_qos_req_type type)
 {
-        return !req || (req->type == DEV_PM_QOS_LATENCY_TOLERANCE
-                        && !dev->power.set_latency_tolerance);
+        return type == DEV_PM_QOS_LATENCY_TOLERANCE &&
+               !dev->power.set_latency_tolerance;
 }
 
 static int __dev_pm_qos_add_request(struct device *dev,
@@ -290,7 +290,7 @@ static int __dev_pm_qos_add_request(struct device *dev,
 {
         int ret = 0;
 
-        if (!dev || dev_pm_qos_invalid_request(dev, req))
+        if (!dev || !req || dev_pm_qos_invalid_req_type(dev, type))
                 return -EINVAL;
 
         if (WARN(dev_pm_qos_request_active(req),
diff --git a/drivers/block/Kconfig b/drivers/block/Kconfig
index 4a438b8abe27..2dfe99b328f8 100644
--- a/drivers/block/Kconfig
+++ b/drivers/block/Kconfig
@@ -17,7 +17,7 @@ if BLK_DEV
 
 config BLK_DEV_NULL_BLK
         tristate "Null test block driver"
-        depends on CONFIGFS_FS
+        select CONFIGFS_FS
 
 config BLK_DEV_FD
         tristate "Normal floppy disk support"
diff --git a/drivers/block/brd.c b/drivers/block/brd.c
index bbd0d186cfc0..2d7178f7754e 100644
--- a/drivers/block/brd.c
+++ b/drivers/block/brd.c
@@ -342,7 +342,7 @@ static long __brd_direct_access(struct brd_device *brd, pgoff_t pgoff,
 
         if (!brd)
                 return -ENODEV;
-        page = brd_insert_page(brd, PFN_PHYS(pgoff) / 512);
+        page = brd_insert_page(brd, (sector_t)pgoff << PAGE_SECTORS_SHIFT);
         if (!page)
                 return -ENOSPC;
         *kaddr = page_address(page);
diff --git a/drivers/block/loop.h b/drivers/block/loop.h
index f68c1d50802f..1f3956702993 100644
--- a/drivers/block/loop.h
+++ b/drivers/block/loop.h
@@ -67,10 +67,8 @@ struct loop_device {
 struct loop_cmd {
         struct kthread_work work;
         struct request *rq;
-        union {
-                bool use_aio; /* use AIO interface to handle I/O */
-                atomic_t ref; /* only for aio */
-        };
+        bool use_aio; /* use AIO interface to handle I/O */
+        atomic_t ref; /* only for aio */
         long ret;
         struct kiocb iocb;
         struct bio_vec *bvec;
diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index 2aa87cbdede0..883dfebd3014 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -820,9 +820,13 @@ static blk_status_t nbd_queue_rq(struct blk_mq_hw_ctx *hctx,
          * appropriate.
          */
         ret = nbd_handle_cmd(cmd, hctx->queue_num);
+        if (ret < 0)
+                ret = BLK_STS_IOERR;
+        else if (!ret)
+                ret = BLK_STS_OK;
         complete(&cmd->send_complete);
 
-        return ret < 0 ? BLK_STS_IOERR : BLK_STS_OK;
+        return ret;
 }
 
 static int nbd_add_socket(struct nbd_device *nbd, unsigned long arg,
@@ -1194,6 +1198,12 @@ static int nbd_ioctl(struct block_device *bdev, fmode_t mode,
         if (!capable(CAP_SYS_ADMIN))
                 return -EPERM;
 
+        /* The block layer will pass back some non-nbd ioctls in case we have
+         * special handling for them, but we don't so just return an error.
+         */
+        if (_IOC_TYPE(cmd) != 0xab)
+                return -EINVAL;
+
         mutex_lock(&nbd->config_lock);
 
         /* Don't allow ioctl operations on a nbd device that was created with
diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
index 2981c27d3aae..f149d3e61234 100644
--- a/drivers/block/zram/zram_drv.c
+++ b/drivers/block/zram/zram_drv.c
@@ -766,27 +766,6 @@ static void zram_slot_unlock(struct zram *zram, u32 index)
         bit_spin_unlock(ZRAM_ACCESS, &zram->table[index].value);
 }
 
-static bool zram_same_page_read(struct zram *zram, u32 index,
-                                struct page *page,
-                                unsigned int offset, unsigned int len)
-{
-        zram_slot_lock(zram, index);
-        if (unlikely(!zram_get_handle(zram, index) ||
-                        zram_test_flag(zram, index, ZRAM_SAME))) {
-                void *mem;
-
-                zram_slot_unlock(zram, index);
-                mem = kmap_atomic(page);
-                zram_fill_page(mem + offset, len,
-                                        zram_get_element(zram, index));
-                kunmap_atomic(mem);
-                return true;
-        }
-        zram_slot_unlock(zram, index);
-
-        return false;
-}
-
 static void zram_meta_free(struct zram *zram, u64 disksize)
 {
         size_t num_pages = disksize >> PAGE_SHIFT;
@@ -884,11 +863,20 @@ static int __zram_bvec_read(struct zram *zram, struct page *page, u32 index,
                 zram_slot_unlock(zram, index);
         }
 
-        if (zram_same_page_read(zram, index, page, 0, PAGE_SIZE))
-                return 0;
-
         zram_slot_lock(zram, index);
         handle = zram_get_handle(zram, index);
+        if (!handle || zram_test_flag(zram, index, ZRAM_SAME)) {
+                unsigned long value;
+                void *mem;
+
+                value = handle ? zram_get_element(zram, index) : 0;
+                mem = kmap_atomic(page);
+                zram_fill_page(mem, PAGE_SIZE, value);
+                kunmap_atomic(mem);
+                zram_slot_unlock(zram, index);
+                return 0;
+        }
+
         size = zram_get_obj_size(zram, index);
 
         src = zs_map_object(zram->mem_pool, handle, ZS_MM_RO);
diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c
index fe597e6c55c4..1d6729be4cd6 100644
--- a/drivers/char/tpm/tpm-interface.c
+++ b/drivers/char/tpm/tpm-interface.c
@@ -455,7 +455,7 @@ ssize_t tpm_transmit(struct tpm_chip *chip, struct tpm_space *space,
                         goto out;
                 }
 
-                msleep(TPM_TIMEOUT);    /* CHECK */
+                tpm_msleep(TPM_TIMEOUT);
                 rmb();
         } while (time_before(jiffies, stop));
 
@@ -970,7 +970,7 @@ int tpm_do_selftest(struct tpm_chip *chip)
                         dev_info(
                             &chip->dev, HW_ERR
                             "TPM command timed out during continue self test");
-                        msleep(delay_msec);
+                        tpm_msleep(delay_msec);
                         continue;
                 }
 
@@ -985,7 +985,7 @@ int tpm_do_selftest(struct tpm_chip *chip)
                 }
                 if (rc != TPM_WARN_DOING_SELFTEST)
                         return rc;
-                msleep(delay_msec);
+                tpm_msleep(delay_msec);
         } while (--loops > 0);
 
         return rc;
@@ -1085,7 +1085,7 @@ again:
                 }
         } else {
                 do {
-                        msleep(TPM_TIMEOUT);
+                        tpm_msleep(TPM_TIMEOUT);
                         status = chip->ops->status(chip);
                         if ((status & mask) == mask)
                                 return 0;
@@ -1150,7 +1150,7 @@ int tpm_pm_suspend(struct device *dev)
                  */
                 if (rc != TPM_WARN_RETRY)
                         break;
-                msleep(TPM_TIMEOUT_RETRY);
+                tpm_msleep(TPM_TIMEOUT_RETRY);
         }
 
         if (rc)
diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h
index 04fbff2edbf3..2d5466a72e40 100644
--- a/drivers/char/tpm/tpm.h
+++ b/drivers/char/tpm/tpm.h
@@ -50,7 +50,8 @@ enum tpm_const {
 
 enum tpm_timeout {
         TPM_TIMEOUT = 5,        /* msecs */
-        TPM_TIMEOUT_RETRY = 100 /* msecs */
+        TPM_TIMEOUT_RETRY = 100, /* msecs */
+        TPM_TIMEOUT_RANGE_US = 300      /* usecs */
 };
 
 /* TPM addresses */
@@ -527,6 +528,12 @@ int tpm_pm_resume(struct device *dev);
 int wait_for_tpm_stat(struct tpm_chip *chip, u8 mask, unsigned long timeout,
                       wait_queue_head_t *queue, bool check_cancel);
 
+static inline void tpm_msleep(unsigned int delay_msec)
+{
+        usleep_range(delay_msec * 1000,
+                     (delay_msec * 1000) + TPM_TIMEOUT_RANGE_US);
+};
+
 struct tpm_chip *tpm_chip_find_get(int chip_num);
 __must_check int tpm_try_get_ops(struct tpm_chip *chip);
 void tpm_put_ops(struct tpm_chip *chip);
diff --git a/drivers/char/tpm/tpm2-cmd.c b/drivers/char/tpm/tpm2-cmd.c
index f7f34b2aa981..e1a41b788f08 100644
--- a/drivers/char/tpm/tpm2-cmd.c
+++ b/drivers/char/tpm/tpm2-cmd.c
@@ -899,7 +899,7 @@ static int tpm2_do_selftest(struct tpm_chip *chip)
                 if (rc != TPM2_RC_TESTING)
                         break;
 
-                msleep(delay_msec);
+                tpm_msleep(delay_msec);
         }
 
         return rc;
diff --git a/drivers/char/tpm/tpm_crb.c b/drivers/char/tpm/tpm_crb.c
index a4ac63a21d8a..8f0a98dea327 100644
--- a/drivers/char/tpm/tpm_crb.c
+++ b/drivers/char/tpm/tpm_crb.c
@@ -665,7 +665,7 @@ static const struct dev_pm_ops crb_pm = {
         SET_RUNTIME_PM_OPS(crb_pm_runtime_suspend, crb_pm_runtime_resume, NULL)
 };
 
-static struct acpi_device_id crb_device_ids[] = {
+static const struct acpi_device_id crb_device_ids[] = {
         {"MSFT0101", 0},
         {"", 0},
 };
diff --git a/drivers/char/tpm/tpm_ibmvtpm.c b/drivers/char/tpm/tpm_ibmvtpm.c
index f01d083eced2..25f6e2665385 100644
--- a/drivers/char/tpm/tpm_ibmvtpm.c
+++ b/drivers/char/tpm/tpm_ibmvtpm.c
@@ -32,26 +32,70 @@
 
 static const char tpm_ibmvtpm_driver_name[] = "tpm_ibmvtpm";
 
-static struct vio_device_id tpm_ibmvtpm_device_table[] = {
+static const struct vio_device_id tpm_ibmvtpm_device_table[] = {
         { "IBM,vtpm", "IBM,vtpm"},
         { "", "" }
 };
 MODULE_DEVICE_TABLE(vio, tpm_ibmvtpm_device_table);
 
 /**
+ *
+ * ibmvtpm_send_crq_word - Send a CRQ request
+ * @vdev:       vio device struct
+ * @w1:         pre-constructed first word of tpm crq (second word is reserved)
+ *
+ * Return:
+ *      0 - Success
+ *      Non-zero - Failure
+ */
+static int ibmvtpm_send_crq_word(struct vio_dev *vdev, u64 w1)
+{
+        return plpar_hcall_norets(H_SEND_CRQ, vdev->unit_address, w1, 0);
+}
+
+/**
+ *
  * ibmvtpm_send_crq - Send a CRQ request
  *
  * @vdev:       vio device struct
- * @w1:         first word
- * @w2:         second word
+ * @valid:      Valid field
+ * @msg:        Type field
+ * @len:        Length field
+ * @data:       Data field
+ *
+ * The ibmvtpm crq is defined as follows:
+ *
+ * Byte  |   0   |   1   |   2   |   3   |   4   |   5   |   6   |   7
+ * -----------------------------------------------------------------------
+ * Word0 | Valid | Type  |     Length    |              Data
+ * -----------------------------------------------------------------------
+ * Word1 |                Reserved
+ * -----------------------------------------------------------------------
+ *
+ * Which matches the following structure (on bigendian host):
+ *
+ * struct ibmvtpm_crq {
+ *         u8 valid;
+ *         u8 msg;
+ *         __be16 len;
+ *         __be32 data;
+ *         __be64 reserved;
+ * } __attribute__((packed, aligned(8)));
+ *
+ * However, the value is passed in a register so just compute the numeric value
+ * to load into the register avoiding byteswap altogether. Endian only affects
+ * memory loads and stores - registers are internally represented the same.
  *
  * Return:
- *      0 -Sucess
+ *      0 (H_SUCCESS) - Success
  *      Non-zero - Failure
  */
-static int ibmvtpm_send_crq(struct vio_dev *vdev, u64 w1, u64 w2)
+static int ibmvtpm_send_crq(struct vio_dev *vdev,
+                u8 valid, u8 msg, u16 len, u32 data)
 {
-        return plpar_hcall_norets(H_SEND_CRQ, vdev->unit_address, w1, w2);
+        u64 w1 = ((u64)valid << 56) | ((u64)msg << 48) | ((u64)len << 32) |
+                (u64)data;
+        return ibmvtpm_send_crq_word(vdev, w1);
 }
 
 /**
@@ -109,8 +153,6 @@ static int tpm_ibmvtpm_recv(struct tpm_chip *chip, u8 *buf, size_t count)
 static int tpm_ibmvtpm_send(struct tpm_chip *chip, u8 *buf, size_t count)
 {
         struct ibmvtpm_dev *ibmvtpm = dev_get_drvdata(&chip->dev);
-        struct ibmvtpm_crq crq;
-        __be64 *word = (__be64 *)&crq;
         int rc, sig;
 
         if (!ibmvtpm->rtce_buf) {
@@ -137,10 +179,6 @@ static int tpm_ibmvtpm_send(struct tpm_chip *chip, u8 *buf, size_t count)
         spin_lock(&ibmvtpm->rtce_lock);
         ibmvtpm->res_len = 0;
         memcpy((void *)ibmvtpm->rtce_buf, (void *)buf, count);
-        crq.valid = (u8)IBMVTPM_VALID_CMD;
-        crq.msg = (u8)VTPM_TPM_COMMAND;
-        crq.len = cpu_to_be16(count);
-        crq.data = cpu_to_be32(ibmvtpm->rtce_dma_handle);
 
         /*
          * set the processing flag before the Hcall, since we may get the
@@ -148,8 +186,9 @@ static int tpm_ibmvtpm_send(struct tpm_chip *chip, u8 *buf, size_t count)
          */
         ibmvtpm->tpm_processing_cmd = true;
 
-        rc = ibmvtpm_send_crq(ibmvtpm->vdev, be64_to_cpu(word[0]),
-                              be64_to_cpu(word[1]));
+        rc = ibmvtpm_send_crq(ibmvtpm->vdev,
+                        IBMVTPM_VALID_CMD, VTPM_TPM_COMMAND,
+                        count, ibmvtpm->rtce_dma_handle);
         if (rc != H_SUCCESS) {
                 dev_err(ibmvtpm->dev, "tpm_ibmvtpm_send failed rc=%d\n", rc);
                 rc = 0;
@@ -182,15 +221,10 @@ static u8 tpm_ibmvtpm_status(struct tpm_chip *chip)
  */
 static int ibmvtpm_crq_get_rtce_size(struct ibmvtpm_dev *ibmvtpm)
 {
-        struct ibmvtpm_crq crq;
-        u64 *buf = (u64 *) &crq;
         int rc;
 
-        crq.valid = (u8)IBMVTPM_VALID_CMD;
-        crq.msg = (u8)VTPM_GET_RTCE_BUFFER_SIZE;
-
-        rc = ibmvtpm_send_crq(ibmvtpm->vdev, cpu_to_be64(buf[0]),
-                              cpu_to_be64(buf[1]));
+        rc = ibmvtpm_send_crq(ibmvtpm->vdev,
+                        IBMVTPM_VALID_CMD, VTPM_GET_RTCE_BUFFER_SIZE, 0, 0);
         if (rc != H_SUCCESS)
                 dev_err(ibmvtpm->dev,
                         "ibmvtpm_crq_get_rtce_size failed rc=%d\n", rc);
@@ -210,15 +244,10 @@ static int ibmvtpm_crq_get_rtce_size(struct ibmvtpm_dev *ibmvtpm)
  */
 static int ibmvtpm_crq_get_version(struct ibmvtpm_dev *ibmvtpm)
 {
-        struct ibmvtpm_crq crq;
-        u64 *buf = (u64 *) &crq;
         int rc;
 
-        crq.valid = (u8)IBMVTPM_VALID_CMD;
-        crq.msg = (u8)VTPM_GET_VERSION;
-
-        rc = ibmvtpm_send_crq(ibmvtpm->vdev, cpu_to_be64(buf[0]),
-                              cpu_to_be64(buf[1]));
+        rc = ibmvtpm_send_crq(ibmvtpm->vdev,
+                        IBMVTPM_VALID_CMD, VTPM_GET_VERSION, 0, 0);
         if (rc != H_SUCCESS)
                 dev_err(ibmvtpm->dev,
                         "ibmvtpm_crq_get_version failed rc=%d\n", rc);
@@ -238,7 +267,7 @@ static int ibmvtpm_crq_send_init_complete(struct ibmvtpm_dev *ibmvtpm)
 {
         int rc;
 
-        rc = ibmvtpm_send_crq(ibmvtpm->vdev, INIT_CRQ_COMP_CMD, 0);
+        rc = ibmvtpm_send_crq_word(ibmvtpm->vdev, INIT_CRQ_COMP_CMD);
         if (rc != H_SUCCESS)
                 dev_err(ibmvtpm->dev,
                         "ibmvtpm_crq_send_init_complete failed rc=%d\n", rc);
@@ -258,7 +287,7 @@ static int ibmvtpm_crq_send_init(struct ibmvtpm_dev *ibmvtpm)
 {
         int rc;
 
-        rc = ibmvtpm_send_crq(ibmvtpm->vdev, INIT_CRQ_CMD, 0);
+        rc = ibmvtpm_send_crq_word(ibmvtpm->vdev, INIT_CRQ_CMD);
         if (rc != H_SUCCESS)
                 dev_err(ibmvtpm->dev,
                         "ibmvtpm_crq_send_init failed rc=%d\n", rc);
@@ -340,15 +369,10 @@ static int tpm_ibmvtpm_suspend(struct device *dev)
 {
         struct tpm_chip *chip = dev_get_drvdata(dev);
         struct ibmvtpm_dev *ibmvtpm = dev_get_drvdata(&chip->dev);
-        struct ibmvtpm_crq crq;
-        u64 *buf = (u64 *) &crq;
         int rc = 0;
 
-        crq.valid = (u8)IBMVTPM_VALID_CMD;
-        crq.msg = (u8)VTPM_PREPARE_TO_SUSPEND;
-
-        rc = ibmvtpm_send_crq(ibmvtpm->vdev, cpu_to_be64(buf[0]),
-                              cpu_to_be64(buf[1]));
+        rc = ibmvtpm_send_crq(ibmvtpm->vdev,
+                        IBMVTPM_VALID_CMD, VTPM_PREPARE_TO_SUSPEND, 0, 0);
         if (rc != H_SUCCESS)
                 dev_err(ibmvtpm->dev,
                         "tpm_ibmvtpm_suspend failed rc=%d\n", rc);
diff --git a/drivers/char/tpm/tpm_infineon.c b/drivers/char/tpm/tpm_infineon.c
index 3b1b9f9322d5..d8f10047fbba 100644
--- a/drivers/char/tpm/tpm_infineon.c
+++ b/drivers/char/tpm/tpm_infineon.c
@@ -191,7 +191,7 @@ static int wait(struct tpm_chip *chip, int wait_for_bit)
                 /* check the status-register if wait_for_bit is set */
                 if (status & 1 << wait_for_bit)
                         break;
-                msleep(TPM_MSLEEP_TIME);
+                tpm_msleep(TPM_MSLEEP_TIME);
         }
         if (i == TPM_MAX_TRIES) {       /* timeout occurs */
                 if (wait_for_bit == STAT_XFE)
@@ -226,7 +226,7 @@ static void tpm_wtx(struct tpm_chip *chip)
         wait_and_send(chip, TPM_CTRL_WTX);
         wait_and_send(chip, 0x00);
         wait_and_send(chip, 0x00);
-        msleep(TPM_WTX_MSLEEP_TIME);
+        tpm_msleep(TPM_WTX_MSLEEP_TIME);
 }
 
 static void tpm_wtx_abort(struct tpm_chip *chip)
@@ -237,7 +237,7 @@ static void tpm_wtx_abort(struct tpm_chip *chip)
         wait_and_send(chip, 0x00);
         wait_and_send(chip, 0x00);
         number_of_wtx = 0;
-        msleep(TPM_WTX_MSLEEP_TIME);
+        tpm_msleep(TPM_WTX_MSLEEP_TIME);
 }
 
 static int tpm_inf_recv(struct tpm_chip *chip, u8 * buf, size_t count)
diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c
index b617b2eeb080..63bc6c3b949e 100644
--- a/drivers/char/tpm/tpm_tis_core.c
+++ b/drivers/char/tpm/tpm_tis_core.c
@@ -51,7 +51,7 @@ static int wait_startup(struct tpm_chip *chip, int l)
 
                 if (access & TPM_ACCESS_VALID)
                         return 0;
-                msleep(TPM_TIMEOUT);
+                tpm_msleep(TPM_TIMEOUT);
         } while (time_before(jiffies, stop));
         return -1;
 }
@@ -117,7 +117,7 @@ again:
                 do {
                         if (check_locality(chip, l))
                                 return l;
-                        msleep(TPM_TIMEOUT);
+                        tpm_msleep(TPM_TIMEOUT);
                 } while (time_before(jiffies, stop));
         }
         return -1;
@@ -164,7 +164,7 @@ static int get_burstcount(struct tpm_chip *chip)
                 burstcnt = (value >> 8) & 0xFFFF;
                 if (burstcnt)
                         return burstcnt;
-                msleep(TPM_TIMEOUT);
+                tpm_msleep(TPM_TIMEOUT);
         } while (time_before(jiffies, stop));
         return -EBUSY;
 }
@@ -396,7 +396,7 @@ static int tpm_tis_send(struct tpm_chip *chip, u8 *buf, size_t len)
         priv->irq = irq;
         chip->flags |= TPM_CHIP_FLAG_IRQ;
         if (!priv->irq_tested)
-                msleep(1);
+                tpm_msleep(1);
         if (!priv->irq_tested)
                 disable_interrupts(chip);
         priv->irq_tested = true;
diff --git a/drivers/clk/clk-bulk.c b/drivers/clk/clk-bulk.c
index c834f5abfc49..4c10456f8a32 100644
--- a/drivers/clk/clk-bulk.c
+++ b/drivers/clk/clk-bulk.c
@@ -105,6 +105,7 @@ err:
 
         return  ret;
 }
+EXPORT_SYMBOL_GPL(clk_bulk_prepare);
 
 #endif /* CONFIG_HAVE_CLK_PREPARE */
 
diff --git a/drivers/clk/rockchip/clk-rk3128.c b/drivers/clk/rockchip/clk-rk3128.c
index 62d7854e4b87..5970a50671b9 100644
--- a/drivers/clk/rockchip/clk-rk3128.c
+++ b/drivers/clk/rockchip/clk-rk3128.c
@@ -315,13 +315,13 @@ static struct rockchip_clk_branch common_clk_branches[] __initdata = {
                         RK2928_CLKGATE_CON(10), 8, GFLAGS),
 
         GATE(SCLK_PVTM_CORE, "clk_pvtm_core", "xin24m", 0,
-                        RK2928_CLKGATE_CON(10), 8, GFLAGS),
+                        RK2928_CLKGATE_CON(10), 0, GFLAGS),
         GATE(SCLK_PVTM_GPU, "clk_pvtm_gpu", "xin24m", 0,
-                        RK2928_CLKGATE_CON(10), 8, GFLAGS),
+                        RK2928_CLKGATE_CON(10), 1, GFLAGS),
         GATE(SCLK_PVTM_FUNC, "clk_pvtm_func", "xin24m", 0,
-                        RK2928_CLKGATE_CON(10), 8, GFLAGS),
+                        RK2928_CLKGATE_CON(10), 2, GFLAGS),
         GATE(SCLK_MIPI_24M, "clk_mipi_24m", "xin24m", CLK_IGNORE_UNUSED,
-                        RK2928_CLKGATE_CON(10), 8, GFLAGS),
+                        RK2928_CLKGATE_CON(2), 15, GFLAGS),
 
         COMPOSITE(SCLK_SDMMC, "sclk_sdmmc0", mux_mmc_src_p, 0,
                         RK2928_CLKSEL_CON(11), 6, 2, MFLAGS, 0, 6, DFLAGS,
@@ -541,7 +541,7 @@ static struct rockchip_clk_branch common_clk_branches[] __initdata = {
         GATE(0, "pclk_grf", "pclk_cpu", CLK_IGNORE_UNUSED, RK2928_CLKGATE_CON(5), 4, GFLAGS),
         GATE(0, "pclk_mipiphy", "pclk_cpu", CLK_IGNORE_UNUSED, RK2928_CLKGATE_CON(5), 0, GFLAGS),
 
-        GATE(0, "pclk_pmu", "pclk_pmu_pre", CLK_IGNORE_UNUSED, RK2928_CLKGATE_CON(9), 2, GFLAGS),
+        GATE(0, "pclk_pmu", "pclk_pmu_pre", 0, RK2928_CLKGATE_CON(9), 2, GFLAGS),
         GATE(0, "pclk_pmu_niu", "pclk_pmu_pre", CLK_IGNORE_UNUSED, RK2928_CLKGATE_CON(9), 3, GFLAGS),
 
         /* PD_MMC */
@@ -577,6 +577,8 @@ static const char *const rk3128_critical_clocks[] __initconst = {
         "aclk_peri",
         "hclk_peri",
         "pclk_peri",
+        "pclk_pmu",
+        "sclk_timer5",
 };
 
 static struct rockchip_clk_provider *__init rk3128_common_clk_init(struct device_node *np)
diff --git a/drivers/clk/samsung/clk-exynos4.c b/drivers/clk/samsung/clk-exynos4.c
index e40b77583c47..d8d3cb67b402 100644
--- a/drivers/clk/samsung/clk-exynos4.c
+++ b/drivers/clk/samsung/clk-exynos4.c
@@ -294,6 +294,18 @@ static const struct samsung_clk_reg_dump src_mask_suspend_e4210[] = {
 #define PLL_ENABLED     (1 << 31)
 #define PLL_LOCKED      (1 << 29)
 
+static void exynos4_clk_enable_pll(u32 reg)
+{
+        u32 pll_con = readl(reg_base + reg);
+        pll_con |= PLL_ENABLED;
+        writel(pll_con, reg_base + reg);
+
+        while (!(pll_con & PLL_LOCKED)) {
+                cpu_relax();
+                pll_con = readl(reg_base + reg);
+        }
+}
+
 static void exynos4_clk_wait_for_pll(u32 reg)
 {
         u32 pll_con;
@@ -315,6 +327,9 @@ static int exynos4_clk_suspend(void)
         samsung_clk_save(reg_base, exynos4_save_pll,
                                 ARRAY_SIZE(exynos4_clk_pll_regs));
 
+        exynos4_clk_enable_pll(EPLL_CON0);
+        exynos4_clk_enable_pll(VPLL_CON0);
+
         if (exynos4_soc == EXYNOS4210) {
                 samsung_clk_save(reg_base, exynos4_save_soc,
                                         ARRAY_SIZE(exynos4210_clk_save));
diff --git a/drivers/clocksource/numachip.c b/drivers/clocksource/numachip.c
index 6a20dc8b253f..9a7d7f0f23fe 100644
--- a/drivers/clocksource/numachip.c
+++ b/drivers/clocksource/numachip.c
@@ -43,7 +43,7 @@ static int numachip2_set_next_event(unsigned long delta, struct clock_event_devi
         return 0;
 }
 
-static struct clock_event_device numachip2_clockevent = {
+static const struct clock_event_device numachip2_clockevent __initconst = {
         .name            = "numachip2",
         .rating          = 400,
         .set_next_event  = numachip2_set_next_event,
diff --git a/drivers/clocksource/timer-integrator-ap.c b/drivers/clocksource/timer-integrator-ap.c
index 2ff64d9d4fb3..62d24690ba02 100644
--- a/drivers/clocksource/timer-integrator-ap.c
+++ b/drivers/clocksource/timer-integrator-ap.c
@@ -36,8 +36,8 @@ static u64 notrace integrator_read_sched_clock(void)
         return -readl(sched_clk_base + TIMER_VALUE);
 }
 
-static int integrator_clocksource_init(unsigned long inrate,
-                                       void __iomem *base)
+static int __init integrator_clocksource_init(unsigned long inrate,
+                                              void __iomem *base)
 {
         u32 ctrl = TIMER_CTRL_ENABLE | TIMER_CTRL_PERIODIC;
         unsigned long rate = inrate;
diff --git a/drivers/cpufreq/cpufreq-dt-platdev.c b/drivers/cpufreq/cpufreq-dt-platdev.c
index a020da7940d6..a753c50e9e41 100644
--- a/drivers/cpufreq/cpufreq-dt-platdev.c
+++ b/drivers/cpufreq/cpufreq-dt-platdev.c
@@ -106,6 +106,22 @@ static const struct of_device_id whitelist[] __initconst = {
  * platforms using "operating-points-v2" property.
  */
 static const struct of_device_id blacklist[] __initconst = {
+        { .compatible = "calxeda,highbank", },
+        { .compatible = "calxeda,ecx-2000", },
+
+        { .compatible = "marvell,armadaxp", },
+
+        { .compatible = "nvidia,tegra124", },
+
+        { .compatible = "st,stih407", },
+        { .compatible = "st,stih410", },
+
+        { .compatible = "sigma,tango4", },
+
+        { .compatible = "ti,am33xx", },
+        { .compatible = "ti,am43", },
+        { .compatible = "ti,dra7", },
+
         { }
 };
 
diff --git a/drivers/cpufreq/ti-cpufreq.c b/drivers/cpufreq/ti-cpufreq.c
index b29cd3398463..4bf47de6101f 100644
--- a/drivers/cpufreq/ti-cpufreq.c
+++ b/drivers/cpufreq/ti-cpufreq.c
@@ -190,7 +190,7 @@ static int ti_cpufreq_setup_syscon_register(struct ti_cpufreq_data *opp_data)
 
 static const struct of_device_id ti_cpufreq_of_match[] = {
         { .compatible = "ti,am33xx", .data = &am3x_soc_data, },
-        { .compatible = "ti,am4372", .data = &am4x_soc_data, },
+        { .compatible = "ti,am43", .data = &am4x_soc_data, },
         { .compatible = "ti,dra7", .data = &dra7_soc_data },
         {},
 };
diff --git a/drivers/cpuidle/cpuidle-arm.c b/drivers/cpuidle/cpuidle-arm.c
index 7080c384ad5d..52a75053ee03 100644
--- a/drivers/cpuidle/cpuidle-arm.c
+++ b/drivers/cpuidle/cpuidle-arm.c
@@ -104,13 +104,13 @@ static int __init arm_idle_init(void)
                 ret = dt_init_idle_driver(drv, arm_idle_state_match, 1);
                 if (ret <= 0) {
                         ret = ret ? : -ENODEV;
-                        goto out_fail;
+                        goto init_fail;
                 }
 
                 ret = cpuidle_register_driver(drv);
                 if (ret) {
                         pr_err("Failed to register cpuidle driver\n");
-                        goto out_fail;
+                        goto init_fail;
                 }
 
                 /*
@@ -149,6 +149,8 @@ static int __init arm_idle_init(void)
         }
 
         return 0;
+init_fail:
+        kfree(drv);
 out_fail:
         while (--cpu >= 0) {
                 dev = per_cpu(cpuidle_devices, cpu);
diff --git a/drivers/crypto/caam/Kconfig b/drivers/crypto/caam/Kconfig
index e36aeacd7635..1eb852765469 100644
--- a/drivers/crypto/caam/Kconfig
+++ b/drivers/crypto/caam/Kconfig
@@ -1,6 +1,7 @@
 config CRYPTO_DEV_FSL_CAAM
         tristate "Freescale CAAM-Multicore driver backend"
         depends on FSL_SOC || ARCH_MXC || ARCH_LAYERSCAPE
+        select SOC_BUS
         help
           Enables the driver module for Freescale's Cryptographic Accelerator
           and Assurance Module (CAAM), also known as the SEC version 4 (SEC4).
@@ -141,10 +142,6 @@ config CRYPTO_DEV_FSL_CAAM_RNG_API
           To compile this as a module, choose M here: the module
           will be called caamrng.
 
-config CRYPTO_DEV_FSL_CAAM_IMX
-        def_bool SOC_IMX6 || SOC_IMX7D
-        depends on CRYPTO_DEV_FSL_CAAM
-
 config CRYPTO_DEV_FSL_CAAM_DEBUG
         bool "Enable debug output in CAAM driver"
         depends on CRYPTO_DEV_FSL_CAAM
diff --git a/drivers/crypto/caam/ctrl.c b/drivers/crypto/caam/ctrl.c
index dacb53fb690e..027e121c6f70 100644
--- a/drivers/crypto/caam/ctrl.c
+++ b/drivers/crypto/caam/ctrl.c
@@ -7,6 +7,7 @@
 #include <linux/device.h>
 #include <linux/of_address.h>
 #include <linux/of_irq.h>
+#include <linux/sys_soc.h>
 
 #include "compat.h"
 #include "regs.h"
@@ -19,6 +20,8 @@ bool caam_little_end;
 EXPORT_SYMBOL(caam_little_end);
 bool caam_dpaa2;
 EXPORT_SYMBOL(caam_dpaa2);
+bool caam_imx;
+EXPORT_SYMBOL(caam_imx);
 
 #ifdef CONFIG_CAAM_QI
 #include "qi.h"
@@ -28,19 +31,11 @@ EXPORT_SYMBOL(caam_dpaa2);
  * i.MX targets tend to have clock control subsystems that can
  * enable/disable clocking to our device.
  */
-#ifdef CONFIG_CRYPTO_DEV_FSL_CAAM_IMX
 static inline struct clk *caam_drv_identify_clk(struct device *dev,
                                                 char *clk_name)
 {
-        return devm_clk_get(dev, clk_name);
+        return caam_imx ? devm_clk_get(dev, clk_name) : NULL;
 }
-#else
-static inline struct clk *caam_drv_identify_clk(struct device *dev,
-                                                char *clk_name)
-{
-        return NULL;
-}
-#endif
 
 /*
  * Descriptor to instantiate RNG State Handle 0 in normal mode and
@@ -430,6 +425,10 @@ static int caam_probe(struct platform_device *pdev)
 {
         int ret, ring, gen_sk, ent_delay = RTSDCTL_ENT_DLY_MIN;
         u64 caam_id;
+        static const struct soc_device_attribute imx_soc[] = {
+                {.family = "Freescale i.MX"},
+                {},
+        };
         struct device *dev;
         struct device_node *nprop, *np;
         struct caam_ctrl __iomem *ctrl;
@@ -451,6 +450,8 @@ static int caam_probe(struct platform_device *pdev)
         dev_set_drvdata(dev, ctrlpriv);
         nprop = pdev->dev.of_node;
 
+        caam_imx = (bool)soc_device_match(imx_soc);
+
         /* Enable clocking */
         clk = caam_drv_identify_clk(&pdev->dev, "ipg");
         if (IS_ERR(clk)) {
diff --git a/drivers/crypto/caam/regs.h b/drivers/crypto/caam/regs.h
index 2b5efff9ec3c..17cfd23a38fa 100644
--- a/drivers/crypto/caam/regs.h
+++ b/drivers/crypto/caam/regs.h
@@ -67,6 +67,7 @@
  */
 
 extern bool caam_little_end;
+extern bool caam_imx;
 
 #define caam_to_cpu(len)                                \
 static inline u##len caam##len ## _to_cpu(u##len val)   \
@@ -154,13 +155,10 @@ static inline u64 rd_reg64(void __iomem *reg)
 #else /* CONFIG_64BIT */
 static inline void wr_reg64(void __iomem *reg, u64 data)
 {
-#ifndef CONFIG_CRYPTO_DEV_FSL_CAAM_IMX
-        if (caam_little_end) {
+        if (!caam_imx && caam_little_end) {
                 wr_reg32((u32 __iomem *)(reg) + 1, data >> 32);
                 wr_reg32((u32 __iomem *)(reg), data);
-        } else
-#endif
-        {
+        } else {
                 wr_reg32((u32 __iomem *)(reg), data >> 32);
                 wr_reg32((u32 __iomem *)(reg) + 1, data);
         }
@@ -168,41 +166,40 @@ static inline void wr_reg64(void __iomem *reg, u64 data)
 
 static inline u64 rd_reg64(void __iomem *reg)
 {
-#ifndef CONFIG_CRYPTO_DEV_FSL_CAAM_IMX
-        if (caam_little_end)
+        if (!caam_imx && caam_little_end)
                 return ((u64)rd_reg32((u32 __iomem *)(reg) + 1) << 32 |
                         (u64)rd_reg32((u32 __iomem *)(reg)));
-        else
-#endif
-                return ((u64)rd_reg32((u32 __iomem *)(reg)) << 32 |
-                        (u64)rd_reg32((u32 __iomem *)(reg) + 1));
+
+        return ((u64)rd_reg32((u32 __iomem *)(reg)) << 32 |
+                (u64)rd_reg32((u32 __iomem *)(reg) + 1));
 }
 #endif /* CONFIG_64BIT  */
 
+static inline u64 cpu_to_caam_dma64(dma_addr_t value)
+{
+        if (caam_imx)
+                return (((u64)cpu_to_caam32(lower_32_bits(value)) << 32) |
+                         (u64)cpu_to_caam32(upper_32_bits(value)));
+
+        return cpu_to_caam64(value);
+}
+
+static inline u64 caam_dma64_to_cpu(u64 value)
+{
+        if (caam_imx)
+                return (((u64)caam32_to_cpu(lower_32_bits(value)) << 32) |
+                         (u64)caam32_to_cpu(upper_32_bits(value)));
+
+        return caam64_to_cpu(value);
+}
+
 #ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT
-#ifdef CONFIG_SOC_IMX7D
-#define cpu_to_caam_dma(value) \
-                (((u64)cpu_to_caam32(lower_32_bits(value)) << 32) | \
-                  (u64)cpu_to_caam32(upper_32_bits(value)))
-#define caam_dma_to_cpu(value) \
-                (((u64)caam32_to_cpu(lower_32_bits(value)) << 32) | \
-                  (u64)caam32_to_cpu(upper_32_bits(value)))
-#else
-#define cpu_to_caam_dma(value) cpu_to_caam64(value)
-#define caam_dma_to_cpu(value) caam64_to_cpu(value)
-#endif /* CONFIG_SOC_IMX7D */
+#define cpu_to_caam_dma(value) cpu_to_caam_dma64(value)
+#define caam_dma_to_cpu(value) caam_dma64_to_cpu(value)
 #else
 #define cpu_to_caam_dma(value) cpu_to_caam32(value)
 #define caam_dma_to_cpu(value) caam32_to_cpu(value)
-#endif /* CONFIG_ARCH_DMA_ADDR_T_64BIT  */
-
-#ifdef CONFIG_CRYPTO_DEV_FSL_CAAM_IMX
-#define cpu_to_caam_dma64(value) \
-                (((u64)cpu_to_caam32(lower_32_bits(value)) << 32) | \
-                 (u64)cpu_to_caam32(upper_32_bits(value)))
-#else
-#define cpu_to_caam_dma64(value) cpu_to_caam64(value)
-#endif
+#endif /* CONFIG_ARCH_DMA_ADDR_T_64BIT */
 
 /*
  * jr_outentry
diff --git a/drivers/crypto/inside-secure/safexcel_cipher.c b/drivers/crypto/inside-secure/safexcel_cipher.c
index d2207ac5ba19..5438552bc6d7 100644
--- a/drivers/crypto/inside-secure/safexcel_cipher.c
+++ b/drivers/crypto/inside-secure/safexcel_cipher.c
@@ -386,7 +386,7 @@ static int safexcel_cipher_exit_inv(struct crypto_tfm *tfm)
         struct safexcel_cipher_ctx *ctx = crypto_tfm_ctx(tfm);
         struct safexcel_crypto_priv *priv = ctx->priv;
         struct skcipher_request req;
-        struct safexcel_inv_result result = { 0 };
+        struct safexcel_inv_result result = {};
         int ring = ctx->base.ring;
 
         memset(&req, 0, sizeof(struct skcipher_request));
diff --git a/drivers/crypto/inside-secure/safexcel_hash.c b/drivers/crypto/inside-secure/safexcel_hash.c
index 3f819399cd95..3980f946874f 100644
--- a/drivers/crypto/inside-secure/safexcel_hash.c
+++ b/drivers/crypto/inside-secure/safexcel_hash.c
@@ -419,7 +419,7 @@ static int safexcel_ahash_exit_inv(struct crypto_tfm *tfm)
         struct safexcel_ahash_ctx *ctx = crypto_tfm_ctx(tfm);
         struct safexcel_crypto_priv *priv = ctx->priv;
         struct ahash_request req;
-        struct safexcel_inv_result result = { 0 };
+        struct safexcel_inv_result result = {};
         int ring = ctx->base.ring;
 
         memset(&req, 0, sizeof(struct ahash_request));
diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
index 79791c690858..dff88838dce7 100644
--- a/drivers/crypto/talitos.c
+++ b/drivers/crypto/talitos.c
@@ -1756,9 +1756,9 @@ static int common_nonsnoop_hash(struct talitos_edesc *edesc,
                 req_ctx->swinit = 0;
         } else {
                 desc->ptr[1] = zero_entry;
-                /* Indicate next op is not the first. */
-                req_ctx->first = 0;
         }
+        /* Indicate next op is not the first. */
+        req_ctx->first = 0;
 
         /* HMAC key */
         if (ctx->keylen)
@@ -1769,7 +1769,7 @@ static int common_nonsnoop_hash(struct talitos_edesc *edesc,
 
         sg_count = edesc->src_nents ?: 1;
         if (is_sec1 && sg_count > 1)
-                sg_copy_to_buffer(areq->src, sg_count, edesc->buf, length);
+                sg_copy_to_buffer(req_ctx->psrc, sg_count, edesc->buf, length);
         else
                 sg_count = dma_map_sg(dev, req_ctx->psrc, sg_count,
                                       DMA_TO_DEVICE);
@@ -3057,7 +3057,8 @@ static struct talitos_crypto_alg *talitos_alg_alloc(struct device *dev,
                 t_alg->algt.alg.hash.final = ahash_final;
                 t_alg->algt.alg.hash.finup = ahash_finup;
                 t_alg->algt.alg.hash.digest = ahash_digest;
-                t_alg->algt.alg.hash.setkey = ahash_setkey;
+                if (!strncmp(alg->cra_name, "hmac", 4))
+                        t_alg->algt.alg.hash.setkey = ahash_setkey;
                 t_alg->algt.alg.hash.import = ahash_import;
                 t_alg->algt.alg.hash.export = ahash_export;
 
diff --git a/drivers/fpga/altera-cvp.c b/drivers/fpga/altera-cvp.c
index 08629ee69d11..00e73d28077c 100644
--- a/drivers/fpga/altera-cvp.c
+++ b/drivers/fpga/altera-cvp.c
@@ -361,12 +361,12 @@ static const struct fpga_manager_ops altera_cvp_ops = {
         .write_complete = altera_cvp_write_complete,
 };
 
-static ssize_t show_chkcfg(struct device_driver *dev, char *buf)
+static ssize_t chkcfg_show(struct device_driver *dev, char *buf)
 {
         return snprintf(buf, 3, "%d\n", altera_cvp_chkcfg);
 }
 
-static ssize_t store_chkcfg(struct device_driver *drv, const char *buf,
+static ssize_t chkcfg_store(struct device_driver *drv, const char *buf,
                             size_t count)
 {
         int ret;
@@ -378,7 +378,7 @@ static ssize_t store_chkcfg(struct device_driver *drv, const char *buf,
         return count;
 }
 
-static DRIVER_ATTR(chkcfg, 0600, show_chkcfg, store_chkcfg);
+static DRIVER_ATTR_RW(chkcfg);
 
 static int altera_cvp_probe(struct pci_dev *pdev,
                             const struct pci_device_id *dev_id);
diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c
index d228f5a99044..dbbe986f90f2 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c
@@ -636,7 +636,194 @@ static void gfx_v6_0_tiling_mode_table_init(struct amdgpu_device *adev)
                                 NUM_BANKS(ADDR_SURF_2_BANK);
                 for (reg_offset = 0; reg_offset < num_tile_mode_states; reg_offset++)
                         WREG32(mmGB_TILE_MODE0 + reg_offset, tilemode[reg_offset]);
-        } else if (adev->asic_type == CHIP_OLAND || adev->asic_type == CHIP_HAINAN) {
+        } else if (adev->asic_type == CHIP_OLAND) {
+                tilemode[0] =   MICRO_TILE_MODE(ADDR_SURF_DEPTH_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P4_8x16) |
+                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_64B) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_4) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_4);
+                tilemode[1] =   MICRO_TILE_MODE(ADDR_SURF_DEPTH_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P4_8x16) |
+                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_128B) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_4) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_4);
+                tilemode[2] =   MICRO_TILE_MODE(ADDR_SURF_DEPTH_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P4_8x16) |
+                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_256B) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_4) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_4);
+                tilemode[3] =   MICRO_TILE_MODE(ADDR_SURF_DEPTH_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P4_8x16) |
+                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_128B) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_4) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_4);
+                tilemode[4] =   MICRO_TILE_MODE(ADDR_SURF_DEPTH_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_1D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P4_8x16) |
+                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_64B) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_2) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_2);
+                tilemode[5] =   MICRO_TILE_MODE(ADDR_SURF_DEPTH_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P4_8x16) |
+                                TILE_SPLIT(split_equal_to_row_size) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_2) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_2);
+                tilemode[6] =   MICRO_TILE_MODE(ADDR_SURF_DEPTH_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P4_8x16) |
+                                TILE_SPLIT(split_equal_to_row_size) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_1) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_2);
+                tilemode[7] =   MICRO_TILE_MODE(ADDR_SURF_DEPTH_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P4_8x16) |
+                                TILE_SPLIT(split_equal_to_row_size) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_4) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_4);
+                tilemode[8] =   MICRO_TILE_MODE(ADDR_SURF_DISPLAY_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_LINEAR_ALIGNED) |
+                                PIPE_CONFIG(ADDR_SURF_P4_8x16) |
+                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_64B) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_2) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_2);
+                tilemode[9] =   MICRO_TILE_MODE(ADDR_SURF_DISPLAY_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_1D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P4_8x16) |
+                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_64B) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_2) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_2);
+                tilemode[10] =  MICRO_TILE_MODE(ADDR_SURF_DISPLAY_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P4_8x16) |
+                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_256B) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_4) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_4);
+                tilemode[11] =  MICRO_TILE_MODE(ADDR_SURF_DISPLAY_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P4_8x16) |
+                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_256B) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_2) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_2);
+                tilemode[12] =  MICRO_TILE_MODE(ADDR_SURF_DISPLAY_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P4_8x16) |
+                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_512B) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_1) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_2);
+                tilemode[13] =  MICRO_TILE_MODE(ADDR_SURF_THIN_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_1D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P4_8x16) |
+                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_64B) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_2) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_2);
+                tilemode[14] =  MICRO_TILE_MODE(ADDR_SURF_THIN_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P4_8x16) |
+                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_256B) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_4) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_2);
+                tilemode[15] =  MICRO_TILE_MODE(ADDR_SURF_THIN_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P4_8x16) |
+                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_256B) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_2) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_2);
+                tilemode[16] =  MICRO_TILE_MODE(ADDR_SURF_THIN_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P4_8x16) |
+                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_512B) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_1) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_2);
+                tilemode[17] =  MICRO_TILE_MODE(ADDR_SURF_THIN_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P4_8x16) |
+                                TILE_SPLIT(split_equal_to_row_size) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_1) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_2);
+                tilemode[21] =  MICRO_TILE_MODE(ADDR_SURF_THIN_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P8_32x32_8x16) |
+                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_256B) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_2) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_4) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_2);
+                tilemode[22] =  MICRO_TILE_MODE(ADDR_SURF_THIN_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P8_32x32_8x16) |
+                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_256B) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_4) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_4);
+                tilemode[23] =  MICRO_TILE_MODE(ADDR_SURF_THIN_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P8_32x32_8x16) |
+                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_256B) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_2) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_2);
+                tilemode[24] =  MICRO_TILE_MODE(ADDR_SURF_THIN_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P8_32x32_8x16) |
+                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_512B) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_1) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_2);
+                tilemode[25] =  MICRO_TILE_MODE(ADDR_SURF_THIN_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P8_32x32_8x16) |
+                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_1KB) |
+                                NUM_BANKS(ADDR_SURF_8_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_1) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_1);
+                for (reg_offset = 0; reg_offset < num_tile_mode_states; reg_offset++)
+                        WREG32(mmGB_TILE_MODE0 + reg_offset, tilemode[reg_offset]);
+        } else if (adev->asic_type == CHIP_HAINAN) {
                 tilemode[0] =   MICRO_TILE_MODE(ADDR_SURF_DEPTH_MICRO_TILING) |
                                 ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
                                 PIPE_CONFIG(ADDR_SURF_P2) |
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
index e4a8c2e52cb2..660b3fbade41 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
@@ -892,6 +892,8 @@ static int kfd_ioctl_get_tile_config(struct file *filep,
         int err = 0;
 
         dev = kfd_device_by_id(args->gpu_id);
+        if (!dev)
+                return -EINVAL;
 
         dev->kfd2kgd->get_tile_config(dev->kgd, &config);
 
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_events.c b/drivers/gpu/drm/amd/amdkfd/kfd_events.c
index 5979158c3f7b..944abfad39c1 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_events.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_events.c
@@ -292,7 +292,10 @@ static int create_signal_event(struct file *devkfd,
                                 struct kfd_event *ev)
 {
         if (p->signal_event_count == KFD_SIGNAL_EVENT_LIMIT) {
-                pr_warn("Signal event wasn't created because limit was reached\n");
+                if (!p->signal_event_limit_reached) {
+                        pr_warn("Signal event wasn't created because limit was reached\n");
+                        p->signal_event_limit_reached = true;
+                }
                 return -ENOMEM;
         }
 
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_kernel_queue.c b/drivers/gpu/drm/amd/amdkfd/kfd_kernel_queue.c
index 681b639f5133..ed71ad40e8f7 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_kernel_queue.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_kernel_queue.c
@@ -183,8 +183,8 @@ static void uninitialize(struct kernel_queue *kq)
 {
         if (kq->queue->properties.type == KFD_QUEUE_TYPE_HIQ)
                 kq->mqd->destroy_mqd(kq->mqd,
-                                        NULL,
-                                        false,
+                                        kq->queue->mqd,
+                                        KFD_PREEMPT_TYPE_WAVEFRONT_RESET,
                                         QUEUE_PREEMPT_DEFAULT_TIMEOUT_MS,
                                         kq->queue->pipe,
                                         kq->queue->queue);
@@ -210,6 +210,11 @@ static int acquire_packet_buffer(struct kernel_queue *kq,
         uint32_t wptr, rptr;
         unsigned int *queue_address;
 
+        /* When rptr == wptr, the buffer is empty.
+         * When rptr == wptr + 1, the buffer is full.
+         * It is always rptr that advances to the position of wptr, rather than
+         * the opposite. So we can only use up to queue_size_dwords - 1 dwords.
+         */
         rptr = *kq->rptr_kernel;
         wptr = *kq->wptr_kernel;
         queue_address = (unsigned int *)kq->pq_kernel_addr;
@@ -219,11 +224,10 @@ static int acquire_packet_buffer(struct kernel_queue *kq,
         pr_debug("wptr: %d\n", wptr);
         pr_debug("queue_address 0x%p\n", queue_address);
 
-        available_size = (rptr - 1 - wptr + queue_size_dwords) %
+        available_size = (rptr + queue_size_dwords - 1 - wptr) %
                                                         queue_size_dwords;
 
-        if (packet_size_in_dwords >= queue_size_dwords ||
-                        packet_size_in_dwords >= available_size) {
+        if (packet_size_in_dwords > available_size) {
                 /*
                  * make sure calling functions know
                  * acquire_packet_buffer() failed
@@ -233,6 +237,14 @@ static int acquire_packet_buffer(struct kernel_queue *kq,
         }
 
         if (wptr + packet_size_in_dwords >= queue_size_dwords) {
+                /* make sure after rolling back to position 0, there is
+                 * still enough space.
+                 */
+                if (packet_size_in_dwords >= rptr) {
+                        *buffer_ptr = NULL;
+                        return -ENOMEM;
+                }
+                /* fill nops, roll back and start at position 0 */
                 while (wptr > 0) {
                         queue_address[wptr] = kq->nop_packet;
                         wptr = (wptr + 1) % queue_size_dwords;
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
index b397ec726400..b87e96cee5fa 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
@@ -521,6 +521,7 @@ struct kfd_process {
         struct list_head signal_event_pages;
         u32 next_nonsignal_event_id;
         size_t signal_event_count;
+        bool signal_event_limit_reached;
 };
 
 /**
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c
index 1cae95e2b13a..03bec765b03d 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c
@@ -143,7 +143,6 @@ int pqm_create_queue(struct process_queue_manager *pqm,
         int num_queues = 0;
         struct queue *cur;
 
-        memset(&q_properties, 0, sizeof(struct queue_properties));
         memcpy(&q_properties, properties, sizeof(struct queue_properties));
         q = NULL;
         kq = NULL;
diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem.c b/drivers/gpu/drm/etnaviv/etnaviv_gem.c
index 5a634594a6ce..57881167ccd2 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_gem.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_gem.c
@@ -551,12 +551,15 @@ static const struct etnaviv_gem_ops etnaviv_gem_shmem_ops = {
 void etnaviv_gem_free_object(struct drm_gem_object *obj)
 {
         struct etnaviv_gem_object *etnaviv_obj = to_etnaviv_bo(obj);
+        struct etnaviv_drm_private *priv = obj->dev->dev_private;
         struct etnaviv_vram_mapping *mapping, *tmp;
 
         /* object should not be active */
         WARN_ON(is_active(etnaviv_obj));
 
+        mutex_lock(&priv->gem_lock);
         list_del(&etnaviv_obj->gem_node);
+        mutex_unlock(&priv->gem_lock);
 
         list_for_each_entry_safe(mapping, tmp, &etnaviv_obj->vram_list,
                                  obj_node) {
diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c b/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c
index 026ef4e02f85..46dfe0737f43 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c
@@ -445,8 +445,10 @@ int etnaviv_ioctl_gem_submit(struct drm_device *dev, void *data,
         cmdbuf->user_size = ALIGN(args->stream_size, 8);
 
         ret = etnaviv_gpu_submit(gpu, submit, cmdbuf);
-        if (ret == 0)
-                cmdbuf = NULL;
+        if (ret)
+                goto out;
+
+        cmdbuf = NULL;
 
         if (args->flags & ETNA_SUBMIT_FENCE_FD_OUT) {
                 /*
diff --git a/drivers/gpu/drm/exynos/exynos5433_drm_decon.c b/drivers/gpu/drm/exynos/exynos5433_drm_decon.c
index 730b8d9db187..6be5b53c3b27 100644
--- a/drivers/gpu/drm/exynos/exynos5433_drm_decon.c
+++ b/drivers/gpu/drm/exynos/exynos5433_drm_decon.c
@@ -14,6 +14,7 @@
 #include <linux/clk.h>
 #include <linux/component.h>
 #include <linux/iopoll.h>
+#include <linux/irq.h>
 #include <linux/mfd/syscon.h>
 #include <linux/of_device.h>
 #include <linux/of_gpio.h>
diff --git a/drivers/gpu/drm/exynos/exynos_drm_drv.c b/drivers/gpu/drm/exynos/exynos_drm_drv.c
index b1f7299600f0..e651a58c18cf 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_drv.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_drv.c
@@ -168,23 +168,19 @@ static struct drm_driver exynos_drm_driver = {
 static int exynos_drm_suspend(struct device *dev)
 {
         struct drm_device *drm_dev = dev_get_drvdata(dev);
-        struct drm_connector *connector;
-        struct drm_connector_list_iter conn_iter;
+        struct exynos_drm_private *private = drm_dev->dev_private;
 
         if (pm_runtime_suspended(dev) || !drm_dev)
                 return 0;
 
-        drm_connector_list_iter_begin(drm_dev, &conn_iter);
-        drm_for_each_connector_iter(connector, &conn_iter) {
-                int old_dpms = connector->dpms;
-
-                if (connector->funcs->dpms)
-                        connector->funcs->dpms(connector, DRM_MODE_DPMS_OFF);
-
-                /* Set the old mode back to the connector for resume */
-                connector->dpms = old_dpms;
+        drm_kms_helper_poll_disable(drm_dev);
+        exynos_drm_fbdev_suspend(drm_dev);
+        private->suspend_state = drm_atomic_helper_suspend(drm_dev);
+        if (IS_ERR(private->suspend_state)) {
+                exynos_drm_fbdev_resume(drm_dev);
+                drm_kms_helper_poll_enable(drm_dev);
+                return PTR_ERR(private->suspend_state);
         }
-        drm_connector_list_iter_end(&conn_iter);
 
         return 0;
 }
@@ -192,22 +188,14 @@ static int exynos_drm_suspend(struct device *dev)
 static int exynos_drm_resume(struct device *dev)
 {
         struct drm_device *drm_dev = dev_get_drvdata(dev);
-        struct drm_connector *connector;
-        struct drm_connector_list_iter conn_iter;
+        struct exynos_drm_private *private = drm_dev->dev_private;
 
         if (pm_runtime_suspended(dev) || !drm_dev)
                 return 0;
 
-        drm_connector_list_iter_begin(drm_dev, &conn_iter);
-        drm_for_each_connector_iter(connector, &conn_iter) {
-                if (connector->funcs->dpms) {
-                        int dpms = connector->dpms;
-
-                        connector->dpms = DRM_MODE_DPMS_OFF;
-                        connector->funcs->dpms(connector, dpms);
-                }
-        }
-        drm_connector_list_iter_end(&conn_iter);
+        drm_atomic_helper_resume(drm_dev, private->suspend_state);
+        exynos_drm_fbdev_resume(drm_dev);
+        drm_kms_helper_poll_enable(drm_dev);
 
         return 0;
 }
diff --git a/drivers/gpu/drm/exynos/exynos_drm_drv.h b/drivers/gpu/drm/exynos/exynos_drm_drv.h
index cf131c2aa23e..f8bae4cb4823 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_drv.h
+++ b/drivers/gpu/drm/exynos/exynos_drm_drv.h
@@ -202,6 +202,7 @@ struct drm_exynos_file_private {
  */
 struct exynos_drm_private {
         struct drm_fb_helper *fb_helper;
+        struct drm_atomic_state *suspend_state;
 
         struct device *dma_dev;
         void *mapping;
diff --git a/drivers/gpu/drm/exynos/exynos_drm_fbdev.c b/drivers/gpu/drm/exynos/exynos_drm_fbdev.c
index c3a068409b48..dfb66ecf417b 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fbdev.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_fbdev.c
@@ -18,6 +18,8 @@
 #include <drm/drm_crtc_helper.h>
 #include <drm/exynos_drm.h>
 
+#include <linux/console.h>
+
 #include "exynos_drm_drv.h"
 #include "exynos_drm_fb.h"
 #include "exynos_drm_fbdev.h"
@@ -285,3 +287,21 @@ void exynos_drm_output_poll_changed(struct drm_device *dev)
 
         drm_fb_helper_hotplug_event(fb_helper);
 }
+
+void exynos_drm_fbdev_suspend(struct drm_device *dev)
+{
+        struct exynos_drm_private *private = dev->dev_private;
+
+        console_lock();
+        drm_fb_helper_set_suspend(private->fb_helper, 1);
+        console_unlock();
+}
+
+void exynos_drm_fbdev_resume(struct drm_device *dev)
+{
+        struct exynos_drm_private *private = dev->dev_private;
+
+        console_lock();
+        drm_fb_helper_set_suspend(private->fb_helper, 0);
+        console_unlock();
+}
diff --git a/drivers/gpu/drm/exynos/exynos_drm_fbdev.h b/drivers/gpu/drm/exynos/exynos_drm_fbdev.h
index 330eef87f718..645d1bb7f665 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fbdev.h
+++ b/drivers/gpu/drm/exynos/exynos_drm_fbdev.h
@@ -21,6 +21,8 @@ int exynos_drm_fbdev_init(struct drm_device *dev);
 void exynos_drm_fbdev_fini(struct drm_device *dev);
 void exynos_drm_fbdev_restore_mode(struct drm_device *dev);
 void exynos_drm_output_poll_changed(struct drm_device *dev);
+void exynos_drm_fbdev_suspend(struct drm_device *drm);
+void exynos_drm_fbdev_resume(struct drm_device *drm);
 
 #else
 
@@ -39,6 +41,14 @@ static inline void exynos_drm_fbdev_restore_mode(struct drm_device *dev)
 
 #define exynos_drm_output_poll_changed (NULL)
 
+static inline void exynos_drm_fbdev_suspend(struct drm_device *drm)
+{
+}
+
+static inline void exynos_drm_fbdev_resume(struct drm_device *drm)
+{
+}
+
 #endif
 
 #endif
diff --git a/drivers/gpu/drm/exynos/exynos_hdmi.c b/drivers/gpu/drm/exynos/exynos_hdmi.c
index 214fa5e51963..0109ff40b1db 100644
--- a/drivers/gpu/drm/exynos/exynos_hdmi.c
+++ b/drivers/gpu/drm/exynos/exynos_hdmi.c
@@ -944,22 +944,27 @@ static bool hdmi_mode_fixup(struct drm_encoder *encoder,
         struct drm_device *dev = encoder->dev;
         struct drm_connector *connector;
         struct drm_display_mode *m;
+        struct drm_connector_list_iter conn_iter;
         int mode_ok;
 
         drm_mode_set_crtcinfo(adjusted_mode, 0);
 
-        list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
+        drm_connector_list_iter_begin(dev, &conn_iter);
+        drm_for_each_connector_iter(connector, &conn_iter) {
                 if (connector->encoder == encoder)
                         break;
         }
+        if (connector)
+                drm_connector_get(connector);
+        drm_connector_list_iter_end(&conn_iter);
 
-        if (connector->encoder != encoder)
+        if (!connector)
                 return true;
 
         mode_ok = hdmi_mode_valid(connector, adjusted_mode);
 
         if (mode_ok == MODE_OK)
-                return true;
+                goto cleanup;
 
         /*
          * Find the most suitable mode and copy it to adjusted_mode.
@@ -979,6 +984,9 @@ static bool hdmi_mode_fixup(struct drm_encoder *encoder,
                 }
         }
 
+cleanup:
+        drm_connector_put(connector);
+
         return true;
 }
 
diff --git a/drivers/gpu/drm/i915/gvt/cfg_space.c b/drivers/gpu/drm/i915/gvt/cfg_space.c
index 40af17ec6312..ff3154fe6588 100644
--- a/drivers/gpu/drm/i915/gvt/cfg_space.c
+++ b/drivers/gpu/drm/i915/gvt/cfg_space.c
@@ -197,78 +197,65 @@ static int emulate_pci_command_write(struct intel_vgpu *vgpu,
 static int emulate_pci_bar_write(struct intel_vgpu *vgpu, unsigned int offset,
         void *p_data, unsigned int bytes)
 {
-        unsigned int bar_index =
-                (rounddown(offset, 8) % PCI_BASE_ADDRESS_0) / 8;
         u32 new = *(u32 *)(p_data);
         bool lo = IS_ALIGNED(offset, 8);
         u64 size;
         int ret = 0;
         bool mmio_enabled =
                 vgpu_cfg_space(vgpu)[PCI_COMMAND] & PCI_COMMAND_MEMORY;
+        struct intel_vgpu_pci_bar *bars = vgpu->cfg_space.bar;
 
-        if (WARN_ON(bar_index >= INTEL_GVT_PCI_BAR_MAX))
-                return -EINVAL;
-
+        /*
+         * Power-up software can determine how much address
+         * space the device requires by writing a value of
+         * all 1's to the register and then reading the value
+         * back. The device will return 0's in all don't-care
+         * address bits.
+         */
         if (new == 0xffffffff) {
-                /*
-                 * Power-up software can determine how much address
-                 * space the device requires by writing a value of
-                 * all 1's to the register and then reading the value
-                 * back. The device will return 0's in all don't-care
-                 * address bits.
-                 */
-                size = vgpu->cfg_space.bar[bar_index].size;
-                if (lo) {
-                        new = rounddown(new, size);
-                } else {
-                        u32 val = vgpu_cfg_space(vgpu)[rounddown(offset, 8)];
-                        /* for 32bit mode bar it returns all-0 in upper 32
-                         * bit, for 64bit mode bar it will calculate the
-                         * size with lower 32bit and return the corresponding
-                         * value
+                switch (offset) {
+                case PCI_BASE_ADDRESS_0:
+                case PCI_BASE_ADDRESS_1:
+                        size = ~(bars[INTEL_GVT_PCI_BAR_GTTMMIO].size -1);
+                        intel_vgpu_write_pci_bar(vgpu, offset,
+                                                size >> (lo ? 0 : 32), lo);
+                        /*
+                         * Untrap the BAR, since guest hasn't configured a
+                         * valid GPA
                          */
-                        if (val & PCI_BASE_ADDRESS_MEM_TYPE_64)
-                                new &= (~(size-1)) >> 32;
-                        else
-                                new = 0;
-                }
-                /*
-                 * Unmapp & untrap the BAR, since guest hasn't configured a
-                 * valid GPA
-                 */
-                switch (bar_index) {
-                case INTEL_GVT_PCI_BAR_GTTMMIO:
                         ret = trap_gttmmio(vgpu, false);
                         break;
-                case INTEL_GVT_PCI_BAR_APERTURE:
+                case PCI_BASE_ADDRESS_2:
+                case PCI_BASE_ADDRESS_3:
+                        size = ~(bars[INTEL_GVT_PCI_BAR_APERTURE].size -1);
+                        intel_vgpu_write_pci_bar(vgpu, offset,
+                                                size >> (lo ? 0 : 32), lo);
                         ret = map_aperture(vgpu, false);
                         break;
+                default:
+                        /* Unimplemented BARs */
+                        intel_vgpu_write_pci_bar(vgpu, offset, 0x0, false);
                 }
-                intel_vgpu_write_pci_bar(vgpu, offset, new, lo);
         } else {
-                /*
-                 * Unmapp & untrap the old BAR first, since guest has
-                 * re-configured the BAR
-                 */
-                switch (bar_index) {
-                case INTEL_GVT_PCI_BAR_GTTMMIO:
-                        ret = trap_gttmmio(vgpu, false);
+                switch (offset) {
+                case PCI_BASE_ADDRESS_0:
+                case PCI_BASE_ADDRESS_1:
+                        /*
+                         * Untrap the old BAR first, since guest has
+                         * re-configured the BAR
+                         */
+                        trap_gttmmio(vgpu, false);
+                        intel_vgpu_write_pci_bar(vgpu, offset, new, lo);
+                        ret = trap_gttmmio(vgpu, mmio_enabled);
                         break;
-                case INTEL_GVT_PCI_BAR_APERTURE:
-                        ret = map_aperture(vgpu, false);
+                case PCI_BASE_ADDRESS_2:
+                case PCI_BASE_ADDRESS_3:
+                        map_aperture(vgpu, false);
+                        intel_vgpu_write_pci_bar(vgpu, offset, new, lo);
+                        ret = map_aperture(vgpu, mmio_enabled);
                         break;
-                }
-                intel_vgpu_write_pci_bar(vgpu, offset, new, lo);
-                /* Track the new BAR */
-                if (mmio_enabled) {
-                        switch (bar_index) {
-                        case INTEL_GVT_PCI_BAR_GTTMMIO:
-                                ret = trap_gttmmio(vgpu, true);
-                                break;
-                        case INTEL_GVT_PCI_BAR_APERTURE:
-                                ret = map_aperture(vgpu, true);
-                                break;
-                        }
+                default:
+                        intel_vgpu_write_pci_bar(vgpu, offset, new, lo);
                 }
         }
         return ret;
@@ -299,10 +286,7 @@ int intel_vgpu_emulate_cfg_write(struct intel_vgpu *vgpu, unsigned int offset,
         }
 
         switch (rounddown(offset, 4)) {
-        case PCI_BASE_ADDRESS_0:
-        case PCI_BASE_ADDRESS_1:
-        case PCI_BASE_ADDRESS_2:
-        case PCI_BASE_ADDRESS_3:
+        case PCI_BASE_ADDRESS_0 ... PCI_BASE_ADDRESS_5:
                 if (WARN_ON(!IS_ALIGNED(offset, 4)))
                         return -EINVAL;
                 return emulate_pci_bar_write(vgpu, offset, p_data, bytes);
@@ -344,7 +328,6 @@ void intel_vgpu_init_cfg_space(struct intel_vgpu *vgpu,
         struct intel_gvt *gvt = vgpu->gvt;
         const struct intel_gvt_device_info *info = &gvt->device_info;
         u16 *gmch_ctl;
-        int i;
 
         memcpy(vgpu_cfg_space(vgpu), gvt->firmware.cfg_space,
                info->cfg_space_size);
@@ -371,13 +354,13 @@ void intel_vgpu_init_cfg_space(struct intel_vgpu *vgpu,
          */
         memset(vgpu_cfg_space(vgpu) + PCI_BASE_ADDRESS_1, 0, 4);
         memset(vgpu_cfg_space(vgpu) + PCI_BASE_ADDRESS_3, 0, 4);
+        memset(vgpu_cfg_space(vgpu) + PCI_BASE_ADDRESS_4, 0, 8);
         memset(vgpu_cfg_space(vgpu) + INTEL_GVT_PCI_OPREGION, 0, 4);
 
-        for (i = 0; i < INTEL_GVT_MAX_BAR_NUM; i++) {
-                vgpu->cfg_space.bar[i].size = pci_resource_len(
-                                              gvt->dev_priv->drm.pdev, i * 2);
-                vgpu->cfg_space.bar[i].tracked = false;
-        }
+        vgpu->cfg_space.bar[INTEL_GVT_PCI_BAR_GTTMMIO].size =
+                                pci_resource_len(gvt->dev_priv->drm.pdev, 0);
+        vgpu->cfg_space.bar[INTEL_GVT_PCI_BAR_APERTURE].size =
+                                pci_resource_len(gvt->dev_priv->drm.pdev, 2);
 }
 
 /**
diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index e21ce9c18b6e..b63893eeca73 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -839,7 +839,6 @@ static bool i915_get_crtc_scanoutpos(struct drm_device *dev, unsigned int pipe,
                                                                 pipe);
         int position;
         int vbl_start, vbl_end, hsync_start, htotal, vtotal;
-        bool in_vbl = true;
         unsigned long irqflags;
 
         if (WARN_ON(!mode->crtc_clock)) {
@@ -922,8 +921,6 @@ static bool i915_get_crtc_scanoutpos(struct drm_device *dev, unsigned int pipe,
 
         spin_unlock_irqrestore(&dev_priv->uncore.lock, irqflags);
 
-        in_vbl = position >= vbl_start && position < vbl_end;
-
         /*
          * While in vblank, position will be negative
          * counting up towards 0 at vbl_end. And outside
diff --git a/drivers/gpu/drm/i915/intel_audio.c b/drivers/gpu/drm/i915/intel_audio.c
index d805b6e6fe71..27743be5b768 100644
--- a/drivers/gpu/drm/i915/intel_audio.c
+++ b/drivers/gpu/drm/i915/intel_audio.c
@@ -606,11 +606,6 @@ void intel_audio_codec_enable(struct intel_encoder *intel_encoder,
                          connector->encoder->base.id,
                          connector->encoder->name);
 
-        /* ELD Conn_Type */
-        connector->eld[5] &= ~(3 << 2);
-        if (intel_crtc_has_dp_encoder(crtc_state))
-                connector->eld[5] |= (1 << 2);
-
         connector->eld[6] = drm_av_sync_delay(connector, adjusted_mode) / 2;
 
         if (dev_priv->display.audio_codec_enable)
diff --git a/drivers/gpu/drm/i915/intel_bios.c b/drivers/gpu/drm/i915/intel_bios.c
index 183e87e8ea31..00c6aee0a9a1 100644
--- a/drivers/gpu/drm/i915/intel_bios.c
+++ b/drivers/gpu/drm/i915/intel_bios.c
@@ -1163,6 +1163,13 @@ static void parse_ddi_port(struct drm_i915_private *dev_priv, enum port port,
         is_hdmi = is_dvi && (child->common.device_type & DEVICE_TYPE_NOT_HDMI_OUTPUT) == 0;
         is_edp = is_dp && (child->common.device_type & DEVICE_TYPE_INTERNAL_CONNECTOR);
 
+        if (port == PORT_A && is_dvi) {
+                DRM_DEBUG_KMS("VBT claims port A supports DVI%s, ignoring\n",
+                              is_hdmi ? "/HDMI" : "");
+                is_dvi = false;
+                is_hdmi = false;
+        }
+
         info->supports_dvi = is_dvi;
         info->supports_hdmi = is_hdmi;
         info->supports_dp = is_dp;
diff --git a/drivers/gpu/drm/i915/intel_csr.c b/drivers/gpu/drm/i915/intel_csr.c
index 965988f79a55..92c1f8e166dc 100644
--- a/drivers/gpu/drm/i915/intel_csr.c
+++ b/drivers/gpu/drm/i915/intel_csr.c
@@ -216,7 +216,7 @@ static void gen9_set_dc_state_debugmask(struct drm_i915_private *dev_priv)
 
         mask = DC_STATE_DEBUG_MASK_MEMORY_UP;
 
-        if (IS_BROXTON(dev_priv))
+        if (IS_GEN9_LP(dev_priv))
                 mask |= DC_STATE_DEBUG_MASK_CORES;
 
         /* The below bit doesn't need to be cleared ever afterwards */
diff --git a/drivers/gpu/drm/i915/intel_ddi.c b/drivers/gpu/drm/i915/intel_ddi.c
index 4b4fd1f8110b..476681d5940c 100644
--- a/drivers/gpu/drm/i915/intel_ddi.c
+++ b/drivers/gpu/drm/i915/intel_ddi.c
@@ -1655,7 +1655,8 @@ bool intel_ddi_get_hw_state(struct intel_encoder *encoder,
 out:
         if (ret && IS_GEN9_LP(dev_priv)) {
                 tmp = I915_READ(BXT_PHY_CTL(port));
-                if ((tmp & (BXT_PHY_LANE_POWERDOWN_ACK |
+                if ((tmp & (BXT_PHY_CMNLANE_POWERDOWN_ACK |
+                            BXT_PHY_LANE_POWERDOWN_ACK |
                             BXT_PHY_LANE_ENABLED)) != BXT_PHY_LANE_ENABLED)
                         DRM_ERROR("Port %c enabled but PHY powered down? "
                                   "(PHY_CTL %08x)\n", port_name(port), tmp);
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index f17275519484..64f7b51ed97c 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -12359,7 +12359,6 @@ static void intel_atomic_commit_tail(struct drm_atomic_state *state)
         struct drm_crtc_state *old_crtc_state, *new_crtc_state;
         struct drm_crtc *crtc;
         struct intel_crtc_state *intel_cstate;
-        bool hw_check = intel_state->modeset;
         u64 put_domains[I915_MAX_PIPES] = {};
         unsigned crtc_vblank_mask = 0;
         int i;
@@ -12376,7 +12375,6 @@ static void intel_atomic_commit_tail(struct drm_atomic_state *state)
 
                 if (needs_modeset(new_crtc_state) ||
                     to_intel_crtc_state(new_crtc_state)->update_pipe) {
-                        hw_check = true;
 
                         put_domains[to_intel_crtc(crtc)->pipe] =
                                 modeset_get_crtc_power_domains(crtc,
@@ -14030,7 +14028,7 @@ static int intel_framebuffer_init(struct intel_framebuffer *intel_fb,
 
                 if (mode_cmd->handles[i] != mode_cmd->handles[0]) {
                         DRM_DEBUG_KMS("bad plane %d handle\n", i);
-                        return -EINVAL;
+                        goto err;
                 }
 
                 stride_alignment = intel_fb_stride_alignment(fb, i);
diff --git a/drivers/gpu/drm/i915/intel_dpio_phy.c b/drivers/gpu/drm/i915/intel_dpio_phy.c
index 09b670929786..de38d014ed39 100644
--- a/drivers/gpu/drm/i915/intel_dpio_phy.c
+++ b/drivers/gpu/drm/i915/intel_dpio_phy.c
@@ -208,12 +208,6 @@ static const struct bxt_ddi_phy_info glk_ddi_phy_info[] = {
         },
 };
 
-static u32 bxt_phy_port_mask(const struct bxt_ddi_phy_info *phy_info)
-{
-        return (phy_info->dual_channel * BIT(phy_info->channel[DPIO_CH1].port)) |
-                BIT(phy_info->channel[DPIO_CH0].port);
-}
-
 static const struct bxt_ddi_phy_info *
 bxt_get_phy_list(struct drm_i915_private *dev_priv, int *count)
 {
@@ -313,7 +307,6 @@ bool bxt_ddi_phy_is_enabled(struct drm_i915_private *dev_priv,
                             enum dpio_phy phy)
 {
         const struct bxt_ddi_phy_info *phy_info;
-        enum port port;
 
         phy_info = bxt_get_phy_info(dev_priv, phy);
 
@@ -335,19 +328,6 @@ bool bxt_ddi_phy_is_enabled(struct drm_i915_private *dev_priv,
                 return false;
         }
 
-        for_each_port_masked(port, bxt_phy_port_mask(phy_info)) {
-                u32 tmp = I915_READ(BXT_PHY_CTL(port));
-
-                if (tmp & BXT_PHY_CMNLANE_POWERDOWN_ACK) {
-                        DRM_DEBUG_DRIVER("DDI PHY %d powered, but common lane "
-                                         "for port %c powered down "
-                                         "(PHY_CTL %08x)\n",
-                                         phy, port_name(port), tmp);
-
-                        return false;
-                }
-        }
-
         return true;
 }
 
diff --git a/drivers/gpu/drm/i915/intel_dsi.c b/drivers/gpu/drm/i915/intel_dsi.c
index f0c11aec5ea5..7442891762be 100644
--- a/drivers/gpu/drm/i915/intel_dsi.c
+++ b/drivers/gpu/drm/i915/intel_dsi.c
@@ -892,8 +892,6 @@ static void intel_dsi_disable(struct intel_encoder *encoder,
                               struct intel_crtc_state *old_crtc_state,
                               struct drm_connector_state *old_conn_state)
 {
-        struct drm_device *dev = encoder->base.dev;
-        struct drm_i915_private *dev_priv = dev->dev_private;
         struct intel_dsi *intel_dsi = enc_to_intel_dsi(&encoder->base);
         enum port port;
 
@@ -903,15 +901,6 @@ static void intel_dsi_disable(struct intel_encoder *encoder,
         intel_panel_disable_backlight(old_conn_state);
 
         /*
-         * Disable Device ready before the port shutdown in order
-         * to avoid split screen
-         */
-        if (IS_BROXTON(dev_priv)) {
-                for_each_dsi_port(port, intel_dsi->ports)
-                        I915_WRITE(MIPI_DEVICE_READY(port), 0);
-        }
-
-        /*
          * According to the spec we should send SHUTDOWN before
          * MIPI_SEQ_DISPLAY_OFF only for v3+ VBTs, but field testing
          * has shown that the v3 sequence works for v2 VBTs too
diff --git a/drivers/gpu/drm/i915/intel_modes.c b/drivers/gpu/drm/i915/intel_modes.c
index 951e834dd274..28a778b785ac 100644
--- a/drivers/gpu/drm/i915/intel_modes.c
+++ b/drivers/gpu/drm/i915/intel_modes.c
@@ -30,6 +30,21 @@
 #include "intel_drv.h"
 #include "i915_drv.h"
 
+static void intel_connector_update_eld_conn_type(struct drm_connector *connector)
+{
+        u8 conn_type;
+
+        if (connector->connector_type == DRM_MODE_CONNECTOR_DisplayPort ||
+            connector->connector_type == DRM_MODE_CONNECTOR_eDP) {
+                conn_type = DRM_ELD_CONN_TYPE_DP;
+        } else {
+                conn_type = DRM_ELD_CONN_TYPE_HDMI;
+        }
+
+        connector->eld[DRM_ELD_SAD_COUNT_CONN_TYPE] &= ~DRM_ELD_CONN_TYPE_MASK;
+        connector->eld[DRM_ELD_SAD_COUNT_CONN_TYPE] |= conn_type;
+}
+
 /**
  * intel_connector_update_modes - update connector from edid
  * @connector: DRM connector device to use
@@ -44,6 +59,8 @@ int intel_connector_update_modes(struct drm_connector *connector,
         ret = drm_add_edid_modes(connector, edid);
         drm_edid_to_eld(connector, edid);
 
+        intel_connector_update_eld_conn_type(connector);
+
         return ret;
 }
 
diff --git a/drivers/gpu/drm/i915/intel_panel.c b/drivers/gpu/drm/i915/intel_panel.c
index a17b1de7d7e0..3b1c5d783ee7 100644
--- a/drivers/gpu/drm/i915/intel_panel.c
+++ b/drivers/gpu/drm/i915/intel_panel.c
@@ -1699,6 +1699,8 @@ bxt_setup_backlight(struct intel_connector *connector, enum pipe unused)
         if (!panel->backlight.max)
                 return -ENODEV;
 
+        panel->backlight.min = get_backlight_min_vbt(connector);
+
         val = bxt_get_backlight(connector);
         val = intel_panel_compute_brightness(connector, val);
         panel->backlight.level = clamp(val, panel->backlight.min,
@@ -1735,6 +1737,8 @@ cnp_setup_backlight(struct intel_connector *connector, enum pipe unused)
         if (!panel->backlight.max)
                 return -ENODEV;
 
+        panel->backlight.min = get_backlight_min_vbt(connector);
+
         val = bxt_get_backlight(connector);
         val = intel_panel_compute_brightness(connector, val);
         panel->backlight.level = clamp(val, panel->backlight.min,
diff --git a/drivers/gpu/drm/i915/intel_runtime_pm.c b/drivers/gpu/drm/i915/intel_runtime_pm.c
index b66d8e136aa3..b3a087cb0860 100644
--- a/drivers/gpu/drm/i915/intel_runtime_pm.c
+++ b/drivers/gpu/drm/i915/intel_runtime_pm.c
@@ -2782,6 +2782,9 @@ static void cnl_display_core_init(struct drm_i915_private *dev_priv, bool resume
 
         /* 6. Enable DBUF */
         gen9_dbuf_enable(dev_priv);
+
+        if (resume && dev_priv->csr.dmc_payload)
+                intel_csr_load_program(dev_priv);
 }
 
 #undef CNL_PROCMON_IDX
diff --git a/drivers/gpu/drm/qxl/qxl_display.c b/drivers/gpu/drm/qxl/qxl_display.c
index 14c5613b4388..afbf50d0c08f 100644
--- a/drivers/gpu/drm/qxl/qxl_display.c
+++ b/drivers/gpu/drm/qxl/qxl_display.c
@@ -509,23 +509,25 @@ static void qxl_primary_atomic_update(struct drm_plane *plane,
             .y2 = qfb->base.height
         };
 
-        if (!old_state->fb) {
-                qxl_io_log(qdev,
-                           "create primary fb: %dx%d,%d,%d\n",
-                           bo->surf.width, bo->surf.height,
-                           bo->surf.stride, bo->surf.format);
+        if (old_state->fb) {
+                qfb_old = to_qxl_framebuffer(old_state->fb);
+                bo_old = gem_to_qxl_bo(qfb_old->obj);
+        } else {
+                bo_old = NULL;
+        }
 
-                qxl_io_create_primary(qdev, 0, bo);
-                bo->is_primary = true;
+        if (bo == bo_old)
                 return;
 
-        } else {
-                qfb_old = to_qxl_framebuffer(old_state->fb);
-                bo_old = gem_to_qxl_bo(qfb_old->obj);
+        if (bo_old && bo_old->is_primary) {
+                qxl_io_destroy_primary(qdev);
                 bo_old->is_primary = false;
         }
 
-        bo->is_primary = true;
+        if (!bo->is_primary) {
+                qxl_io_create_primary(qdev, 0, bo);
+                bo->is_primary = true;
+        }
         qxl_draw_dirty_fb(qdev, qfb, bo, 0, 0, &norect, 1, 1);
 }
 
@@ -534,13 +536,15 @@ static void qxl_primary_atomic_disable(struct drm_plane *plane,
 {
         struct qxl_device *qdev = plane->dev->dev_private;
 
-        if (old_state->fb)
-        {       struct qxl_framebuffer *qfb =
+        if (old_state->fb) {
+                struct qxl_framebuffer *qfb =
                         to_qxl_framebuffer(old_state->fb);
                 struct qxl_bo *bo = gem_to_qxl_bo(qfb->obj);
 
-                qxl_io_destroy_primary(qdev);
-                bo->is_primary = false;
+                if (bo->is_primary) {
+                        qxl_io_destroy_primary(qdev);
+                        bo->is_primary = false;
+                }
         }
 }
 
@@ -698,14 +702,15 @@ static void qxl_plane_cleanup_fb(struct drm_plane *plane,
         struct drm_gem_object *obj;
         struct qxl_bo *user_bo;
 
-        if (!plane->state->fb) {
-                /* we never executed prepare_fb, so there's nothing to
+        if (!old_state->fb) {
+                /*
+                 * we never executed prepare_fb, so there's nothing to
                  * unpin.
                  */
                 return;
         }
 
-        obj = to_qxl_framebuffer(plane->state->fb)->obj;
+        obj = to_qxl_framebuffer(old_state->fb)->obj;
         user_bo = gem_to_qxl_bo(obj);
         qxl_bo_unpin(user_bo);
 }
diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
index 997131d58c7f..ffc10cadcf34 100644
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -1663,7 +1663,7 @@ int radeon_suspend_kms(struct drm_device *dev, bool suspend,
         radeon_agp_suspend(rdev);
 
         pci_save_state(dev->pdev);
-        if (freeze && rdev->family >= CHIP_CEDAR) {
+        if (freeze && rdev->family >= CHIP_CEDAR && !(rdev->flags & RADEON_IS_IGP)) {
                 rdev->asic->asic_reset(rdev, true);
                 pci_restore_state(dev->pdev);
         } else if (suspend) {
diff --git a/drivers/gpu/drm/sun4i/Kconfig b/drivers/gpu/drm/sun4i/Kconfig
index 06f05302ee75..882d85db9053 100644
--- a/drivers/gpu/drm/sun4i/Kconfig
+++ b/drivers/gpu/drm/sun4i/Kconfig
@@ -26,7 +26,7 @@ config DRM_SUN4I_HDMI_CEC
        bool "Allwinner A10 HDMI CEC Support"
        depends on DRM_SUN4I_HDMI
        select CEC_CORE
-       depends on CEC_PIN
+       select CEC_PIN
        help
           Choose this option if you have an Allwinner SoC with an HDMI
           controller and want to use CEC.
diff --git a/drivers/gpu/drm/sun4i/sun4i_hdmi.h b/drivers/gpu/drm/sun4i/sun4i_hdmi.h
index 1457750988da..a1f8cba251a2 100644
--- a/drivers/gpu/drm/sun4i/sun4i_hdmi.h
+++ b/drivers/gpu/drm/sun4i/sun4i_hdmi.h
@@ -15,7 +15,7 @@
 #include <drm/drm_connector.h>
 #include <drm/drm_encoder.h>
 
-#include <media/cec.h>
+#include <media/cec-pin.h>
 
 #define SUN4I_HDMI_CTRL_REG             0x004
 #define SUN4I_HDMI_CTRL_ENABLE                  BIT(31)
diff --git a/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c b/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c
index 9ea6cd5a1370..3cf1a6932fac 100644
--- a/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c
+++ b/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c
@@ -302,26 +302,29 @@ static int sun4i_hdmi_bind(struct device *dev, struct device *master,
         hdmi->mod_clk = devm_clk_get(dev, "mod");
         if (IS_ERR(hdmi->mod_clk)) {
                 dev_err(dev, "Couldn't get the HDMI mod clock\n");
-                return PTR_ERR(hdmi->mod_clk);
+                ret = PTR_ERR(hdmi->mod_clk);
+                goto err_disable_bus_clk;
         }
         clk_prepare_enable(hdmi->mod_clk);
 
         hdmi->pll0_clk = devm_clk_get(dev, "pll-0");
         if (IS_ERR(hdmi->pll0_clk)) {
                 dev_err(dev, "Couldn't get the HDMI PLL 0 clock\n");
-                return PTR_ERR(hdmi->pll0_clk);
+                ret = PTR_ERR(hdmi->pll0_clk);
+                goto err_disable_mod_clk;
         }
 
         hdmi->pll1_clk = devm_clk_get(dev, "pll-1");
         if (IS_ERR(hdmi->pll1_clk)) {
                 dev_err(dev, "Couldn't get the HDMI PLL 1 clock\n");
-                return PTR_ERR(hdmi->pll1_clk);
+                ret = PTR_ERR(hdmi->pll1_clk);
+                goto err_disable_mod_clk;
         }
 
         ret = sun4i_tmds_create(hdmi);
         if (ret) {
                 dev_err(dev, "Couldn't create the TMDS clock\n");
-                return ret;
+                goto err_disable_mod_clk;
         }
 
         writel(SUN4I_HDMI_CTRL_ENABLE, hdmi->base + SUN4I_HDMI_CTRL_REG);
@@ -362,7 +365,7 @@ static int sun4i_hdmi_bind(struct device *dev, struct device *master,
         ret = sun4i_hdmi_i2c_create(dev, hdmi);
         if (ret) {
                 dev_err(dev, "Couldn't create the HDMI I2C adapter\n");
-                return ret;
+                goto err_disable_mod_clk;
         }
 
         drm_encoder_helper_add(&hdmi->encoder,
@@ -422,6 +425,10 @@ err_cleanup_connector:
         drm_encoder_cleanup(&hdmi->encoder);
 err_del_i2c_adapter:
         i2c_del_adapter(hdmi->i2c);
+err_disable_mod_clk:
+        clk_disable_unprepare(hdmi->mod_clk);
+err_disable_bus_clk:
+        clk_disable_unprepare(hdmi->bus_clk);
         return ret;
 }
 
@@ -434,6 +441,8 @@ static void sun4i_hdmi_unbind(struct device *dev, struct device *master,
         drm_connector_cleanup(&hdmi->connector);
         drm_encoder_cleanup(&hdmi->encoder);
         i2c_del_adapter(hdmi->i2c);
+        clk_disable_unprepare(hdmi->mod_clk);
+        clk_disable_unprepare(hdmi->bus_clk);
 }
 
 static const struct component_ops sun4i_hdmi_ops = {
diff --git a/drivers/gpu/drm/tegra/trace.h b/drivers/gpu/drm/tegra/trace.h
index e9b7cdad5c4c..5a1ab4046e92 100644
--- a/drivers/gpu/drm/tegra/trace.h
+++ b/drivers/gpu/drm/tegra/trace.h
@@ -63,6 +63,6 @@ DEFINE_EVENT(register_access, sor_readl,
 
 /* This part must be outside protection */
 #undef TRACE_INCLUDE_PATH
-#define TRACE_INCLUDE_PATH .
+#define TRACE_INCLUDE_PATH ../../drivers/gpu/drm/tegra
 #define TRACE_INCLUDE_FILE trace
 #include <trace/define_trace.h>
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index b397a14ab970..a98919199858 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -533,6 +533,7 @@
 #define USB_VENDOR_ID_IDEACOM           0x1cb6
 #define USB_DEVICE_ID_IDEACOM_IDC6650   0x6650
 #define USB_DEVICE_ID_IDEACOM_IDC6651   0x6651
+#define USB_DEVICE_ID_IDEACOM_IDC6680   0x6680
 
 #define USB_VENDOR_ID_ILITEK            0x222a
 #define USB_DEVICE_ID_ILITEK_MULTITOUCH 0x0001
@@ -660,6 +661,7 @@
 #define USB_DEVICE_ID_LENOVO_CBTKBD     0x6048
 #define USB_DEVICE_ID_LENOVO_TPPRODOCK  0x6067
 #define USB_DEVICE_ID_LENOVO_X1_COVER   0x6085
+#define USB_DEVICE_ID_LENOVO_X1_TAB     0x60a3
 
 #define USB_VENDOR_ID_LG                0x1fd2
 #define USB_DEVICE_ID_LG_MULTITOUCH     0x0064
diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
index 440b999304a5..9e8c4d2ba11d 100644
--- a/drivers/hid/hid-multitouch.c
+++ b/drivers/hid/hid-multitouch.c
@@ -930,6 +930,7 @@ static int mt_input_mapping(struct hid_device *hdev, struct hid_input *hi,
             field->application != HID_DG_PEN &&
             field->application != HID_DG_TOUCHPAD &&
             field->application != HID_GD_KEYBOARD &&
+            field->application != HID_GD_SYSTEM_CONTROL &&
             field->application != HID_CP_CONSUMER_CONTROL &&
             field->application != HID_GD_WIRELESS_RADIO_CTLS &&
             !(field->application == HID_VD_ASUS_CUSTOM_MEDIA_KEYS &&
@@ -1419,6 +1420,12 @@ static const struct hid_device_id mt_devices[] = {
                         USB_VENDOR_ID_ALPS_JP,
                         HID_DEVICE_ID_ALPS_U1_DUAL_3BTN_PTP) },
 
+        /* Lenovo X1 TAB Gen 2 */
+        { .driver_data = MT_CLS_WIN_8_DUAL,
+                HID_DEVICE(BUS_USB, HID_GROUP_MULTITOUCH_WIN_8,
+                           USB_VENDOR_ID_LENOVO,
+                           USB_DEVICE_ID_LENOVO_X1_TAB) },
+
         /* Anton devices */
         { .driver_data = MT_CLS_EXPORT_ALL_INPUTS,
                 MT_USB_DEVICE(USB_VENDOR_ID_ANTON,
diff --git a/drivers/hid/hid-rmi.c b/drivers/hid/hid-rmi.c
index 5b40c2614599..ef241d66562e 100644
--- a/drivers/hid/hid-rmi.c
+++ b/drivers/hid/hid-rmi.c
@@ -436,17 +436,24 @@ static int rmi_post_resume(struct hid_device *hdev)
         if (!(data->device_flags & RMI_DEVICE))
                 return 0;
 
-        ret = rmi_reset_attn_mode(hdev);
+        /* Make sure the HID device is ready to receive events */
+        ret = hid_hw_open(hdev);
         if (ret)
                 return ret;
 
+        ret = rmi_reset_attn_mode(hdev);
+        if (ret)
+                goto out;
+
         ret = rmi_driver_resume(rmi_dev, false);
         if (ret) {
                 hid_warn(hdev, "Failed to resume device: %d\n", ret);
-                return ret;
+                goto out;
         }
 
-        return 0;
+out:
+        hid_hw_close(hdev);
+        return ret;
 }
 #endif /* CONFIG_PM */
 
diff --git a/drivers/hid/hidraw.c b/drivers/hid/hidraw.c
index ec530454e6f6..5fbe0f81ab2e 100644
--- a/drivers/hid/hidraw.c
+++ b/drivers/hid/hidraw.c
@@ -337,8 +337,8 @@ static void drop_ref(struct hidraw *hidraw, int exists_bit)
                         kfree(hidraw);
                 } else {
                         /* close device for last reader */
-                        hid_hw_power(hidraw->hid, PM_HINT_NORMAL);
                         hid_hw_close(hidraw->hid);
+                        hid_hw_power(hidraw->hid, PM_HINT_NORMAL);
                 }
         }
 }
diff --git a/drivers/hid/i2c-hid/i2c-hid.c b/drivers/hid/i2c-hid/i2c-hid.c
index 77396145d2d0..9145c2129a96 100644
--- a/drivers/hid/i2c-hid/i2c-hid.c
+++ b/drivers/hid/i2c-hid/i2c-hid.c
@@ -543,7 +543,8 @@ static int i2c_hid_alloc_buffers(struct i2c_hid *ihid, size_t report_size)
 {
         /* the worst case is computed from the set_report command with a
          * reportID > 15 and the maximum report length */
-        int args_len = sizeof(__u8) + /* optional ReportID byte */
+        int args_len = sizeof(__u8) + /* ReportID */
+                       sizeof(__u8) + /* optional ReportID byte */
                        sizeof(__u16) + /* data register */
                        sizeof(__u16) + /* size of the report */
                        report_size; /* report */
diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
index a83fa76655b9..f489a5cfcb48 100644
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -99,6 +99,7 @@ static const struct hid_blacklist {
         { USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_LOGITECH_OEM_USB_OPTICAL_MOUSE_0A4A, HID_QUIRK_ALWAYS_POLL },
         { USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_LOGITECH_OEM_USB_OPTICAL_MOUSE_0B4A, HID_QUIRK_ALWAYS_POLL },
         { USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE, HID_QUIRK_ALWAYS_POLL },
+        { USB_VENDOR_ID_IDEACOM, USB_DEVICE_ID_IDEACOM_IDC6680, HID_QUIRK_MULTI_INPUT },
         { USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_C007, HID_QUIRK_ALWAYS_POLL },
         { USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_C077, HID_QUIRK_ALWAYS_POLL },
         { USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_KEYBOARD_G710_PLUS, HID_QUIRK_NOGET },
diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c
index e82a696a1d07..906e654fb0ba 100644
--- a/drivers/hid/wacom_sys.c
+++ b/drivers/hid/wacom_sys.c
@@ -668,8 +668,10 @@ static struct wacom_hdev_data *wacom_get_hdev_data(struct hid_device *hdev)
 
         /* Try to find an already-probed interface from the same device */
         list_for_each_entry(data, &wacom_udev_list, list) {
-                if (compare_device_paths(hdev, data->dev, '/'))
+                if (compare_device_paths(hdev, data->dev, '/')) {
+                        kref_get(&data->kref);
                         return data;
+                }
         }
 
         /* Fallback to finding devices that appear to be "siblings" */
@@ -766,6 +768,9 @@ static int wacom_led_control(struct wacom *wacom)
         if (!wacom->led.groups)
                 return -ENOTSUPP;
 
+        if (wacom->wacom_wac.features.type == REMOTE)
+                return -ENOTSUPP;
+
         if (wacom->wacom_wac.pid) { /* wireless connected */
                 report_id = WAC_CMD_WL_LED_CONTROL;
                 buf_size = 13;
diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
index bb17d7bbefd3..aa692e28b2cd 100644
--- a/drivers/hid/wacom_wac.c
+++ b/drivers/hid/wacom_wac.c
@@ -567,8 +567,8 @@ static int wacom_intuos_pad(struct wacom_wac *wacom)
                                 keys = data[9] & 0x07;
                         }
                 } else {
-                        buttons = ((data[6] & 0x10) << 10) |
-                                  ((data[5] & 0x10) << 9)  |
+                        buttons = ((data[6] & 0x10) << 5)  |
+                                  ((data[5] & 0x10) << 4)  |
                                   ((data[6] & 0x0F) << 4)  |
                                   (data[5] & 0x0F);
                 }
@@ -1227,11 +1227,17 @@ static void wacom_intuos_pro2_bt_pen(struct wacom_wac *wacom)
                         continue;
 
                 if (range) {
+                        /* Fix rotation alignment: userspace expects zero at left */
+                        int16_t rotation = (int16_t)get_unaligned_le16(&frame[9]);
+                        rotation += 1800/4;
+                        if (rotation > 899)
+                                rotation -= 1800;
+
                         input_report_abs(pen_input, ABS_X, get_unaligned_le16(&frame[1]));
                         input_report_abs(pen_input, ABS_Y, get_unaligned_le16(&frame[3]));
-                        input_report_abs(pen_input, ABS_TILT_X, frame[7]);
-                        input_report_abs(pen_input, ABS_TILT_Y, frame[8]);
-                        input_report_abs(pen_input, ABS_Z, get_unaligned_le16(&frame[9]));
+                        input_report_abs(pen_input, ABS_TILT_X, (char)frame[7]);
+                        input_report_abs(pen_input, ABS_TILT_Y, (char)frame[8]);
+                        input_report_abs(pen_input, ABS_Z, rotation);
                         input_report_abs(pen_input, ABS_WHEEL, get_unaligned_le16(&frame[11]));
                 }
                 input_report_abs(pen_input, ABS_PRESSURE, get_unaligned_le16(&frame[5]));
@@ -1319,12 +1325,19 @@ static void wacom_intuos_pro2_bt_pad(struct wacom_wac *wacom)
         unsigned char *data = wacom->data;
 
         int buttons = (data[282] << 1) | ((data[281] >> 6) & 0x01);
-        int ring = data[285];
-        int prox = buttons | (ring & 0x80);
+        int ring = data[285] & 0x7F;
+        bool ringstatus = data[285] & 0x80;
+        bool prox = buttons || ringstatus;
+
+        /* Fix touchring data: userspace expects 0 at left and increasing clockwise */
+        ring = 71 - ring;
+        ring += 3*72/16;
+        if (ring > 71)
+                ring -= 72;
 
         wacom_report_numbered_buttons(pad_input, 9, buttons);
 
-        input_report_abs(pad_input, ABS_WHEEL, (ring & 0x80) ? (ring & 0x7f) : 0);
+        input_report_abs(pad_input, ABS_WHEEL, ringstatus ? ring : 0);
 
         input_report_key(pad_input, wacom->tool[1], prox ? 1 : 0);
         input_report_abs(pad_input, ABS_MISC, prox ? PAD_DEVICE_ID : 0);
@@ -1616,6 +1629,20 @@ static int wacom_tpc_irq(struct wacom_wac *wacom, size_t len)
         return 0;
 }
 
+static int wacom_offset_rotation(struct input_dev *input, struct hid_usage *usage,
+                                 int value, int num, int denom)
+{
+        struct input_absinfo *abs = &input->absinfo[usage->code];
+        int range = (abs->maximum - abs->minimum + 1);
+
+        value += num*range/denom;
+        if (value > abs->maximum)
+                value -= range;
+        else if (value < abs->minimum)
+                value += range;
+        return value;
+}
+
 int wacom_equivalent_usage(int usage)
 {
         if ((usage & HID_USAGE_PAGE) == WACOM_HID_UP_WACOMDIGITIZER) {
@@ -1898,6 +1925,7 @@ static void wacom_wac_pad_event(struct hid_device *hdev, struct hid_field *field
         unsigned equivalent_usage = wacom_equivalent_usage(usage->hid);
         int i;
         bool is_touch_on = value;
+        bool do_report = false;
 
         /*
          * Avoid reporting this event and setting inrange_state if this usage
@@ -1912,6 +1940,29 @@ static void wacom_wac_pad_event(struct hid_device *hdev, struct hid_field *field
         }
 
         switch (equivalent_usage) {
+        case WACOM_HID_WD_TOUCHRING:
+                /*
+                 * Userspace expects touchrings to increase in value with
+                 * clockwise gestures and have their zero point at the
+                 * tablet's left. HID events "should" be clockwise-
+                 * increasing and zero at top, though the MobileStudio
+                 * Pro and 2nd-gen Intuos Pro don't do this...
+                 */
+                if (hdev->vendor == 0x56a &&
+                    (hdev->product == 0x34d || hdev->product == 0x34e ||  /* MobileStudio Pro */
+                     hdev->product == 0x357 || hdev->product == 0x358)) { /* Intuos Pro 2 */
+                        value = (field->logical_maximum - value);
+
+                        if (hdev->product == 0x357 || hdev->product == 0x358)
+                                value = wacom_offset_rotation(input, usage, value, 3, 16);
+                        else if (hdev->product == 0x34d || hdev->product == 0x34e)
+                                value = wacom_offset_rotation(input, usage, value, 1, 2);
+                }
+                else {
+                        value = wacom_offset_rotation(input, usage, value, 1, 4);
+                }
+                do_report = true;
+                break;
         case WACOM_HID_WD_TOUCHRINGSTATUS:
                 if (!value)
                         input_event(input, usage->type, usage->code, 0);
@@ -1945,10 +1996,14 @@ static void wacom_wac_pad_event(struct hid_device *hdev, struct hid_field *field
                                          value, i);
                  /* fall through*/
         default:
+                do_report = true;
+                break;
+        }
+
+        if (do_report) {
                 input_event(input, usage->type, usage->code, value);
                 if (value)
                         wacom_wac->hid_data.pad_input_event_flag = true;
-                break;
         }
 }
 
@@ -2086,22 +2141,34 @@ static void wacom_wac_pen_event(struct hid_device *hdev, struct hid_field *field
                 wacom_wac->hid_data.tipswitch |= value;
                 return;
         case HID_DG_TOOLSERIALNUMBER:
-                wacom_wac->serial[0] = (wacom_wac->serial[0] & ~0xFFFFFFFFULL);
-                wacom_wac->serial[0] |= (__u32)value;
+                if (value) {
+                        wacom_wac->serial[0] = (wacom_wac->serial[0] & ~0xFFFFFFFFULL);
+                        wacom_wac->serial[0] |= (__u32)value;
+                }
                 return;
+        case HID_DG_TWIST:
+                /*
+                 * Userspace expects pen twist to have its zero point when
+                 * the buttons/finger is on the tablet's left. HID values
+                 * are zero when buttons are toward the top.
+                 */
+                value = wacom_offset_rotation(input, usage, value, 1, 4);
+                break;
         case WACOM_HID_WD_SENSE:
                 wacom_wac->hid_data.sense_state = value;
                 return;
         case WACOM_HID_WD_SERIALHI:
-                wacom_wac->serial[0] = (wacom_wac->serial[0] & 0xFFFFFFFF);
-                wacom_wac->serial[0] |= ((__u64)value) << 32;
-                /*
-                 * Non-USI EMR devices may contain additional tool type
-                 * information here. See WACOM_HID_WD_TOOLTYPE case for
-                 * more details.
-                 */
-                if (value >> 20 == 1) {
-                        wacom_wac->id[0] |= value & 0xFFFFF;
+                if (value) {
+                        wacom_wac->serial[0] = (wacom_wac->serial[0] & 0xFFFFFFFF);
+                        wacom_wac->serial[0] |= ((__u64)value) << 32;
+                        /*
+                         * Non-USI EMR devices may contain additional tool type
+                         * information here. See WACOM_HID_WD_TOOLTYPE case for
+                         * more details.
+                         */
+                        if (value >> 20 == 1) {
+                                wacom_wac->id[0] |= value & 0xFFFFF;
+                        }
                 }
                 return;
         case WACOM_HID_WD_TOOLTYPE:
@@ -2205,7 +2272,7 @@ static void wacom_wac_pen_report(struct hid_device *hdev,
                 input_report_key(input, wacom_wac->tool[0], prox);
                 if (wacom_wac->serial[0]) {
                         input_event(input, EV_MSC, MSC_SERIAL, wacom_wac->serial[0]);
-                        input_report_abs(input, ABS_MISC, id);
+                        input_report_abs(input, ABS_MISC, prox ? id : 0);
                 }
 
                 wacom_wac->hid_data.tipswitch = false;
@@ -2216,6 +2283,7 @@ static void wacom_wac_pen_report(struct hid_device *hdev,
         if (!prox) {
                 wacom_wac->tool[0] = 0;
                 wacom_wac->id[0] = 0;
+                wacom_wac->serial[0] = 0;
         }
 }
 
diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c
index 060df71c2e8b..bcbb031f7263 100644
--- a/drivers/hv/channel_mgmt.c
+++ b/drivers/hv/channel_mgmt.c
@@ -936,14 +936,10 @@ static void vmbus_onoffer_rescind(struct vmbus_channel_message_header *hdr)
 
 void vmbus_hvsock_device_unregister(struct vmbus_channel *channel)
 {
-        mutex_lock(&vmbus_connection.channel_mutex);
-
         BUG_ON(!is_hvsock_channel(channel));
 
         channel->rescind = true;
         vmbus_device_unregister(channel->device_obj);
-
-        mutex_unlock(&vmbus_connection.channel_mutex);
 }
 EXPORT_SYMBOL_GPL(vmbus_hvsock_device_unregister);
 
diff --git a/drivers/hv/hv_fcopy.c b/drivers/hv/hv_fcopy.c
index daa75bd41f86..2364281d8593 100644
--- a/drivers/hv/hv_fcopy.c
+++ b/drivers/hv/hv_fcopy.c
@@ -170,6 +170,10 @@ static void fcopy_send_data(struct work_struct *dummy)
                 out_src = smsg_out;
                 break;
 
+        case WRITE_TO_FILE:
+                out_src = fcopy_transaction.fcopy_msg;
+                out_len = sizeof(struct hv_do_fcopy);
+                break;
         default:
                 out_src = fcopy_transaction.fcopy_msg;
                 out_len = fcopy_transaction.recv_len;
diff --git a/drivers/hwmon/xgene-hwmon.c b/drivers/hwmon/xgene-hwmon.c
index 9c0dbb8191ad..e1be61095532 100644
--- a/drivers/hwmon/xgene-hwmon.c
+++ b/drivers/hwmon/xgene-hwmon.c
@@ -630,7 +630,7 @@ static int xgene_hwmon_probe(struct platform_device *pdev)
                          sizeof(struct slimpro_resp_msg) * ASYNC_MSG_FIFO_SIZE,
                          GFP_KERNEL);
         if (rc)
-                goto out_mbox_free;
+                return -ENOMEM;
 
         INIT_WORK(&ctx->workq, xgene_hwmon_evt_work);
 
@@ -646,7 +646,8 @@ static int xgene_hwmon_probe(struct platform_device *pdev)
                 if (IS_ERR(ctx->mbox_chan)) {
                         dev_err(&pdev->dev,
                                 "SLIMpro mailbox channel request failed\n");
-                        return -ENODEV;
+                        rc = -ENODEV;
+                        goto out_mbox_free;
                 }
         } else {
                 struct acpi_pcct_hw_reduced *cppc_ss;
@@ -654,7 +655,8 @@ static int xgene_hwmon_probe(struct platform_device *pdev)
                 if (device_property_read_u32(&pdev->dev, "pcc-channel",
                                              &ctx->mbox_idx)) {
                         dev_err(&pdev->dev, "no pcc-channel property\n");
-                        return -ENODEV;
+                        rc = -ENODEV;
+                        goto out_mbox_free;
                 }
 
                 cl->rx_callback = xgene_hwmon_pcc_rx_cb;
@@ -662,7 +664,8 @@ static int xgene_hwmon_probe(struct platform_device *pdev)
                 if (IS_ERR(ctx->mbox_chan)) {
                         dev_err(&pdev->dev,
                                 "PPC channel request failed\n");
-                        return -ENODEV;
+                        rc = -ENODEV;
+                        goto out_mbox_free;
                 }
 
                 /*
@@ -675,13 +678,13 @@ static int xgene_hwmon_probe(struct platform_device *pdev)
                 if (!cppc_ss) {
                         dev_err(&pdev->dev, "PPC subspace not found\n");
                         rc = -ENODEV;
-                        goto out_mbox_free;
+                        goto out;
                 }
 
                 if (!ctx->mbox_chan->mbox->txdone_irq) {
                         dev_err(&pdev->dev, "PCC IRQ not supported\n");
                         rc = -ENODEV;
-                        goto out_mbox_free;
+                        goto out;
                 }
 
                 /*
@@ -696,14 +699,14 @@ static int xgene_hwmon_probe(struct platform_device *pdev)
                 } else {
                         dev_err(&pdev->dev, "Failed to get PCC comm region\n");
                         rc = -ENODEV;
-                        goto out_mbox_free;
+                        goto out;
                 }
 
                 if (!ctx->pcc_comm_addr) {
                         dev_err(&pdev->dev,
                                 "Failed to ioremap PCC comm region\n");
                         rc = -ENOMEM;
-                        goto out_mbox_free;
+                        goto out;
                 }
 
                 /*
diff --git a/drivers/hwtracing/intel_th/pci.c b/drivers/hwtracing/intel_th/pci.c
index bc9cebc30526..c2a2ce8ee541 100644
--- a/drivers/hwtracing/intel_th/pci.c
+++ b/drivers/hwtracing/intel_th/pci.c
@@ -144,6 +144,11 @@ static const struct pci_device_id intel_th_pci_id_table[] = {
                 .driver_data = (kernel_ulong_t)0,
         },
         {
+                /* Lewisburg PCH */
+                PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0xa1a6),
+                .driver_data = (kernel_ulong_t)0,
+        },
+        {
                 /* Gemini Lake */
                 PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x318e),
                 .driver_data = (kernel_ulong_t)&intel_th_2x,
@@ -158,6 +163,11 @@ static const struct pci_device_id intel_th_pci_id_table[] = {
                 PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x9da6),
                 .driver_data = (kernel_ulong_t)&intel_th_2x,
         },
+        {
+                /* Cedar Fork PCH */
+                PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x18e1),
+                .driver_data = (kernel_ulong_t)&intel_th_2x,
+        },
         { 0 },
 };
 
diff --git a/drivers/hwtracing/stm/core.c b/drivers/hwtracing/stm/core.c
index 9414900575d8..f129869e05a9 100644
--- a/drivers/hwtracing/stm/core.c
+++ b/drivers/hwtracing/stm/core.c
@@ -1119,7 +1119,7 @@ void stm_source_unregister_device(struct stm_source_data *data)
 
         stm_source_link_drop(src);
 
-        device_destroy(&stm_source_class, src->dev.devt);
+        device_unregister(&src->dev);
 }
 EXPORT_SYMBOL_GPL(stm_source_unregister_device);
 
diff --git a/drivers/i2c/busses/Kconfig b/drivers/i2c/busses/Kconfig
index c06dce2c1da7..45a3f3ca29b3 100644
--- a/drivers/i2c/busses/Kconfig
+++ b/drivers/i2c/busses/Kconfig
@@ -131,6 +131,7 @@ config I2C_I801
             Gemini Lake (SOC)
             Cannon Lake-H (PCH)
             Cannon Lake-LP (PCH)
+            Cedar Fork (PCH)
 
           This driver can also be built as a module.  If so, the module
           will be called i2c-i801.
diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c
index e114e4e00d29..9e12a53ef7b8 100644
--- a/drivers/i2c/busses/i2c-i801.c
+++ b/drivers/i2c/busses/i2c-i801.c
@@ -68,6 +68,7 @@
  * Gemini Lake (SOC)            0x31d4  32      hard    yes     yes     yes
  * Cannon Lake-H (PCH)          0xa323  32      hard    yes     yes     yes
  * Cannon Lake-LP (PCH)         0x9da3  32      hard    yes     yes     yes
+ * Cedar Fork (PCH)             0x18df  32      hard    yes     yes     yes
  *
  * Features supported by this driver:
  * Software PEC                         no
@@ -204,6 +205,7 @@
 
 /* Older devices have their ID defined in <linux/pci_ids.h> */
 #define PCI_DEVICE_ID_INTEL_BAYTRAIL_SMBUS              0x0f12
+#define PCI_DEVICE_ID_INTEL_CDF_SMBUS                   0x18df
 #define PCI_DEVICE_ID_INTEL_DNV_SMBUS                   0x19df
 #define PCI_DEVICE_ID_INTEL_COUGARPOINT_SMBUS           0x1c22
 #define PCI_DEVICE_ID_INTEL_PATSBURG_SMBUS              0x1d22
@@ -1025,6 +1027,7 @@ static const struct pci_device_id i801_ids[] = {
         { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_BRASWELL_SMBUS) },
         { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_SUNRISEPOINT_H_SMBUS) },
         { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_SMBUS) },
+        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CDF_SMBUS) },
         { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_DNV_SMBUS) },
         { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_BROXTON_SMBUS) },
         { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_LEWISBURG_SMBUS) },
@@ -1513,6 +1516,7 @@ static int i801_probe(struct pci_dev *dev, const struct pci_device_id *id)
         case PCI_DEVICE_ID_INTEL_CANNONLAKE_LP_SMBUS:
         case PCI_DEVICE_ID_INTEL_LEWISBURG_SMBUS:
         case PCI_DEVICE_ID_INTEL_LEWISBURG_SSKU_SMBUS:
+        case PCI_DEVICE_ID_INTEL_CDF_SMBUS:
         case PCI_DEVICE_ID_INTEL_DNV_SMBUS:
         case PCI_DEVICE_ID_INTEL_KABYLAKE_PCH_H_SMBUS:
                 priv->features |= FEATURE_I2C_BLOCK_READ;
diff --git a/drivers/i2c/busses/i2c-img-scb.c b/drivers/i2c/busses/i2c-img-scb.c
index 84fb35f6837f..eb1d91b986fd 100644
--- a/drivers/i2c/busses/i2c-img-scb.c
+++ b/drivers/i2c/busses/i2c-img-scb.c
@@ -1459,6 +1459,6 @@ static struct platform_driver img_scb_i2c_driver = {
 };
 module_platform_driver(img_scb_i2c_driver);
 
-MODULE_AUTHOR("James Hogan <james.hogan@imgtec.com>");
+MODULE_AUTHOR("James Hogan <jhogan@kernel.org>");
 MODULE_DESCRIPTION("IMG host I2C driver");
 MODULE_LICENSE("GPL v2");
diff --git a/drivers/i2c/busses/i2c-sprd.c b/drivers/i2c/busses/i2c-sprd.c
index 22e08ae1704f..25fcc3c1e32b 100644
--- a/drivers/i2c/busses/i2c-sprd.c
+++ b/drivers/i2c/busses/i2c-sprd.c
@@ -627,6 +627,7 @@ static const struct dev_pm_ops sprd_i2c_pm_ops = {
 
 static const struct of_device_id sprd_i2c_of_match[] = {
         { .compatible = "sprd,sc9860-i2c", },
+        {},
 };
 
 static struct platform_driver sprd_i2c_driver = {
diff --git a/drivers/i2c/busses/i2c-stm32f7.c b/drivers/i2c/busses/i2c-stm32f7.c
index 47c67b0ca896..d4a6e9c2e9aa 100644
--- a/drivers/i2c/busses/i2c-stm32f7.c
+++ b/drivers/i2c/busses/i2c-stm32f7.c
@@ -215,7 +215,7 @@ struct stm32f7_i2c_dev {
         unsigned int msg_num;
         unsigned int msg_id;
         struct stm32f7_i2c_msg f7_msg;
-        struct stm32f7_i2c_setup *setup;
+        struct stm32f7_i2c_setup setup;
         struct stm32f7_i2c_timings timing;
 };
 
@@ -265,7 +265,7 @@ static struct stm32f7_i2c_spec i2c_specs[] = {
         },
 };
 
-struct stm32f7_i2c_setup stm32f7_setup = {
+static const struct stm32f7_i2c_setup stm32f7_setup = {
         .rise_time = STM32F7_I2C_RISE_TIME_DEFAULT,
         .fall_time = STM32F7_I2C_FALL_TIME_DEFAULT,
         .dnf = STM32F7_I2C_DNF_DEFAULT,
@@ -537,7 +537,7 @@ static void stm32f7_i2c_hw_config(struct stm32f7_i2c_dev *i2c_dev)
         writel_relaxed(timing, i2c_dev->base + STM32F7_I2C_TIMINGR);
 
         /* Enable I2C */
-        if (i2c_dev->setup->analog_filter)
+        if (i2c_dev->setup.analog_filter)
                 stm32f7_i2c_clr_bits(i2c_dev->base + STM32F7_I2C_CR1,
                                      STM32F7_I2C_CR1_ANFOFF);
         else
@@ -887,22 +887,19 @@ static int stm32f7_i2c_probe(struct platform_device *pdev)
         }
 
         setup = of_device_get_match_data(&pdev->dev);
-        i2c_dev->setup->rise_time = setup->rise_time;
-        i2c_dev->setup->fall_time = setup->fall_time;
-        i2c_dev->setup->dnf = setup->dnf;
-        i2c_dev->setup->analog_filter = setup->analog_filter;
+        i2c_dev->setup = *setup;
 
         ret = device_property_read_u32(i2c_dev->dev, "i2c-scl-rising-time-ns",
                                        &rise_time);
         if (!ret)
-                i2c_dev->setup->rise_time = rise_time;
+                i2c_dev->setup.rise_time = rise_time;
 
         ret = device_property_read_u32(i2c_dev->dev, "i2c-scl-falling-time-ns",
                                        &fall_time);
         if (!ret)
-                i2c_dev->setup->fall_time = fall_time;
+                i2c_dev->setup.fall_time = fall_time;
 
-        ret = stm32f7_i2c_setup_timing(i2c_dev, i2c_dev->setup);
+        ret = stm32f7_i2c_setup_timing(i2c_dev, &i2c_dev->setup);
         if (ret)
                 goto clk_free;
 
diff --git a/drivers/ide/ide-probe.c b/drivers/ide/ide-probe.c
index 01b2adfd8226..eaf39e5db08b 100644
--- a/drivers/ide/ide-probe.c
+++ b/drivers/ide/ide-probe.c
@@ -1451,6 +1451,7 @@ int ide_host_register(struct ide_host *host, const struct ide_port_info *d,
                 if (hwif_init(hwif) == 0) {
                         printk(KERN_INFO "%s: failed to initialize IDE "
                                          "interface\n", hwif->name);
+                        device_unregister(hwif->portdev);
                         device_unregister(&hwif->gendev);
                         ide_disable_port(hwif);
                         continue;
diff --git a/drivers/ide/ide-scan-pci.c b/drivers/ide/ide-scan-pci.c
index 86aa88aeb3a6..acf874800ca4 100644
--- a/drivers/ide/ide-scan-pci.c
+++ b/drivers/ide/ide-scan-pci.c
@@ -56,6 +56,7 @@ static int __init ide_scan_pcidev(struct pci_dev *dev)
 {
         struct list_head *l;
         struct pci_driver *d;
+        int ret;
 
         list_for_each(l, &ide_pci_drivers) {
                 d = list_entry(l, struct pci_driver, node);
@@ -63,10 +64,14 @@ static int __init ide_scan_pcidev(struct pci_dev *dev)
                         const struct pci_device_id *id =
                                 pci_match_id(d->id_table, dev);
 
-                        if (id != NULL && d->probe(dev, id) >= 0) {
-                                dev->driver = d;
-                                pci_dev_get(dev);
-                                return 1;
+                        if (id != NULL) {
+                                pci_assign_irq(dev);
+                                ret = d->probe(dev, id);
+                                if (ret >= 0) {
+                                        dev->driver = d;
+                                        pci_dev_get(dev);
+                                        return 1;
+                                }
                         }
                 }
         }
diff --git a/drivers/ide/setup-pci.c b/drivers/ide/setup-pci.c
index 112d2fe1bcdb..fdc8e813170c 100644
--- a/drivers/ide/setup-pci.c
+++ b/drivers/ide/setup-pci.c
@@ -179,6 +179,7 @@ EXPORT_SYMBOL_GPL(ide_setup_pci_noise);
 /**
  *      ide_pci_enable  -       do PCI enables
  *      @dev: PCI device
+ *      @bars: PCI BARs mask
  *      @d: IDE port info
  *
  *      Enable the IDE PCI device. We attempt to enable the device in full
@@ -189,9 +190,10 @@ EXPORT_SYMBOL_GPL(ide_setup_pci_noise);
  *      Returns zero on success or an error code
  */
 
-static int ide_pci_enable(struct pci_dev *dev, const struct ide_port_info *d)
+static int ide_pci_enable(struct pci_dev *dev, int bars,
+                          const struct ide_port_info *d)
 {
-        int ret, bars;
+        int ret;
 
         if (pci_enable_device(dev)) {
                 ret = pci_enable_device_io(dev);
@@ -216,18 +218,6 @@ static int ide_pci_enable(struct pci_dev *dev, const struct ide_port_info *d)
                 goto out;
         }
 
-        if (d->host_flags & IDE_HFLAG_SINGLE)
-                bars = (1 << 2) - 1;
-        else
-                bars = (1 << 4) - 1;
-
-        if ((d->host_flags & IDE_HFLAG_NO_DMA) == 0) {
-                if (d->host_flags & IDE_HFLAG_CS5520)
-                        bars |= (1 << 2);
-                else
-                        bars |= (1 << 4);
-        }
-
         ret = pci_request_selected_regions(dev, bars, d->name);
         if (ret < 0)
                 printk(KERN_ERR "%s %s: can't reserve resources\n",
@@ -403,6 +393,7 @@ int ide_hwif_setup_dma(ide_hwif_t *hwif, const struct ide_port_info *d)
 /**
  *      ide_setup_pci_controller        -       set up IDE PCI
  *      @dev: PCI device
+ *      @bars: PCI BARs mask
  *      @d: IDE port info
  *      @noisy: verbose flag
  *
@@ -411,7 +402,7 @@ int ide_hwif_setup_dma(ide_hwif_t *hwif, const struct ide_port_info *d)
  *      and enables it if need be
  */
 
-static int ide_setup_pci_controller(struct pci_dev *dev,
+static int ide_setup_pci_controller(struct pci_dev *dev, int bars,
                                     const struct ide_port_info *d, int noisy)
 {
         int ret;
@@ -420,7 +411,7 @@ static int ide_setup_pci_controller(struct pci_dev *dev,
         if (noisy)
                 ide_setup_pci_noise(dev, d);
 
-        ret = ide_pci_enable(dev, d);
+        ret = ide_pci_enable(dev, bars, d);
         if (ret < 0)
                 goto out;
 
@@ -428,16 +419,20 @@ static int ide_setup_pci_controller(struct pci_dev *dev,
         if (ret < 0) {
                 printk(KERN_ERR "%s %s: error accessing PCI regs\n",
                         d->name, pci_name(dev));
-                goto out;
+                goto out_free_bars;
         }
         if (!(pcicmd & PCI_COMMAND_IO)) {       /* is device disabled? */
                 ret = ide_pci_configure(dev, d);
                 if (ret < 0)
-                        goto out;
+                        goto out_free_bars;
                 printk(KERN_INFO "%s %s: device enabled (Linux)\n",
                         d->name, pci_name(dev));
         }
 
+        goto out;
+
+out_free_bars:
+        pci_release_selected_regions(dev, bars);
 out:
         return ret;
 }
@@ -540,13 +535,28 @@ int ide_pci_init_two(struct pci_dev *dev1, struct pci_dev *dev2,
 {
         struct pci_dev *pdev[] = { dev1, dev2 };
         struct ide_host *host;
-        int ret, i, n_ports = dev2 ? 4 : 2;
+        int ret, i, n_ports = dev2 ? 4 : 2, bars;
         struct ide_hw hw[4], *hws[] = { NULL, NULL, NULL, NULL };
 
+        if (d->host_flags & IDE_HFLAG_SINGLE)
+                bars = (1 << 2) - 1;
+        else
+                bars = (1 << 4) - 1;
+
+        if ((d->host_flags & IDE_HFLAG_NO_DMA) == 0) {
+                if (d->host_flags & IDE_HFLAG_CS5520)
+                        bars |= (1 << 2);
+                else
+                        bars |= (1 << 4);
+        }
+
         for (i = 0; i < n_ports / 2; i++) {
-                ret = ide_setup_pci_controller(pdev[i], d, !i);
-                if (ret < 0)
+                ret = ide_setup_pci_controller(pdev[i], bars, d, !i);
+                if (ret < 0) {
+                        if (i == 1)
+                                pci_release_selected_regions(pdev[0], bars);
                         goto out;
+                }
 
                 ide_pci_setup_ports(pdev[i], d, &hw[i*2], &hws[i*2]);
         }
@@ -554,7 +564,7 @@ int ide_pci_init_two(struct pci_dev *dev1, struct pci_dev *dev2,
         host = ide_host_alloc(d, hws, n_ports);
         if (host == NULL) {
                 ret = -ENOMEM;
-                goto out;
+                goto out_free_bars;
         }
 
         host->dev[0] = &dev1->dev;
@@ -576,7 +586,7 @@ int ide_pci_init_two(struct pci_dev *dev1, struct pci_dev *dev2,
                  * do_ide_setup_pci_device() on the first device!
                  */
                 if (ret < 0)
-                        goto out;
+                        goto out_free_bars;
 
                 /* fixup IRQ */
                 if (ide_pci_is_in_compatibility_mode(pdev[i])) {
@@ -589,6 +599,13 @@ int ide_pci_init_two(struct pci_dev *dev1, struct pci_dev *dev2,
         ret = ide_host_register(host, d, hws);
         if (ret)
                 ide_host_free(host);
+        else
+                goto out;
+
+out_free_bars:
+        i = n_ports / 2;
+        while (i--)
+                pci_release_selected_regions(pdev[i], bars);
 out:
         return ret;
 }
diff --git a/drivers/infiniband/core/iwpm_msg.c b/drivers/infiniband/core/iwpm_msg.c
index 30825bb9b8e9..8861c052155a 100644
--- a/drivers/infiniband/core/iwpm_msg.c
+++ b/drivers/infiniband/core/iwpm_msg.c
@@ -100,6 +100,8 @@ int iwpm_register_pid(struct iwpm_dev_data *pm_msg, u8 nl_client)
         if (ret)
                 goto pid_query_error;
 
+        nlmsg_end(skb, nlh);
+
         pr_debug("%s: Multicasting a nlmsg (dev = %s ifname = %s iwpm = %s)\n",
                 __func__, pm_msg->dev_name, pm_msg->if_name, iwpm_ulib_name);
 
@@ -170,6 +172,8 @@ int iwpm_add_mapping(struct iwpm_sa_data *pm_msg, u8 nl_client)
                                 &pm_msg->loc_addr, IWPM_NLA_MANAGE_ADDR);
         if (ret)
                 goto add_mapping_error;
+
+        nlmsg_end(skb, nlh);
         nlmsg_request->req_buffer = pm_msg;
 
         ret = rdma_nl_unicast_wait(skb, iwpm_user_pid);
@@ -246,6 +250,8 @@ int iwpm_add_and_query_mapping(struct iwpm_sa_data *pm_msg, u8 nl_client)
                                 &pm_msg->rem_addr, IWPM_NLA_QUERY_REMOTE_ADDR);
         if (ret)
                 goto query_mapping_error;
+
+        nlmsg_end(skb, nlh);
         nlmsg_request->req_buffer = pm_msg;
 
         ret = rdma_nl_unicast_wait(skb, iwpm_user_pid);
@@ -308,6 +314,8 @@ int iwpm_remove_mapping(struct sockaddr_storage *local_addr, u8 nl_client)
         if (ret)
                 goto remove_mapping_error;
 
+        nlmsg_end(skb, nlh);
+
         ret = rdma_nl_unicast_wait(skb, iwpm_user_pid);
         if (ret) {
                 skb = NULL; /* skb is freed in the netlink send-op handling */
diff --git a/drivers/infiniband/core/iwpm_util.c b/drivers/infiniband/core/iwpm_util.c
index c81c55942626..3c4faadb8cdd 100644
--- a/drivers/infiniband/core/iwpm_util.c
+++ b/drivers/infiniband/core/iwpm_util.c
@@ -597,6 +597,9 @@ static int send_mapinfo_num(u32 mapping_num, u8 nl_client, int iwpm_pid)
                                 &mapping_num, IWPM_NLA_MAPINFO_SEND_NUM);
         if (ret)
                 goto mapinfo_num_error;
+
+        nlmsg_end(skb, nlh);
+
         ret = rdma_nl_unicast(skb, iwpm_pid);
         if (ret) {
                 skb = NULL;
@@ -678,6 +681,8 @@ int iwpm_send_mapinfo(u8 nl_client, int iwpm_pid)
                         if (ret)
                                 goto send_mapping_info_unlock;
 
+                        nlmsg_end(skb, nlh);
+
                         iwpm_print_sockaddr(&map_info->local_sockaddr,
                                 "send_mapping_info: Local sockaddr:");
                         iwpm_print_sockaddr(&map_info->mapped_sockaddr,
diff --git a/drivers/infiniband/core/security.c b/drivers/infiniband/core/security.c
index 70ad19c4c73e..88bdafb297f5 100644
--- a/drivers/infiniband/core/security.c
+++ b/drivers/infiniband/core/security.c
@@ -432,8 +432,10 @@ int ib_create_qp_security(struct ib_qp *qp, struct ib_device *dev)
         atomic_set(&qp->qp_sec->error_list_count, 0);
         init_completion(&qp->qp_sec->error_complete);
         ret = security_ib_alloc_security(&qp->qp_sec->security);
-        if (ret)
+        if (ret) {
                 kfree(qp->qp_sec);
+                qp->qp_sec = NULL;
+        }
 
         return ret;
 }
diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
index 4ab30d832ac5..52a2cf2d83aa 100644
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -3869,15 +3869,15 @@ int ib_uverbs_ex_query_device(struct ib_uverbs_file *file,
         resp.raw_packet_caps = attr.raw_packet_caps;
         resp.response_length += sizeof(resp.raw_packet_caps);
 
-        if (ucore->outlen < resp.response_length + sizeof(resp.xrq_caps))
+        if (ucore->outlen < resp.response_length + sizeof(resp.tm_caps))
                 goto end;
 
-        resp.xrq_caps.max_rndv_hdr_size = attr.xrq_caps.max_rndv_hdr_size;
-        resp.xrq_caps.max_num_tags      = attr.xrq_caps.max_num_tags;
-        resp.xrq_caps.max_ops           = attr.xrq_caps.max_ops;
-        resp.xrq_caps.max_sge           = attr.xrq_caps.max_sge;
-        resp.xrq_caps.flags             = attr.xrq_caps.flags;
-        resp.response_length += sizeof(resp.xrq_caps);
+        resp.tm_caps.max_rndv_hdr_size  = attr.tm_caps.max_rndv_hdr_size;
+        resp.tm_caps.max_num_tags       = attr.tm_caps.max_num_tags;
+        resp.tm_caps.max_ops            = attr.tm_caps.max_ops;
+        resp.tm_caps.max_sge            = attr.tm_caps.max_sge;
+        resp.tm_caps.flags              = attr.tm_caps.flags;
+        resp.response_length += sizeof(resp.tm_caps);
 end:
         err = ib_copy_to_udata(ucore, &resp, resp.response_length);
         return err;
diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c
index ee9e27dc799b..de57d6c11a25 100644
--- a/drivers/infiniband/core/verbs.c
+++ b/drivers/infiniband/core/verbs.c
@@ -1646,7 +1646,7 @@ static bool is_valid_mcast_lid(struct ib_qp *qp, u16 lid)
          */
         if (!ib_query_qp(qp, &attr, IB_QP_STATE | IB_QP_PORT, &init_attr)) {
                 if (attr.qp_state >= IB_QPS_INIT) {
-                        if (qp->device->get_link_layer(qp->device, attr.port_num) !=
+                        if (rdma_port_get_link_layer(qp->device, attr.port_num) !=
                             IB_LINK_LAYER_INFINIBAND)
                                 return true;
                         goto lid_check;
@@ -1655,7 +1655,7 @@ static bool is_valid_mcast_lid(struct ib_qp *qp, u16 lid)
 
         /* Can't get a quick answer, iterate over all ports */
         for (port = 0; port < qp->device->phys_port_cnt; port++)
-                if (qp->device->get_link_layer(qp->device, port) !=
+                if (rdma_port_get_link_layer(qp->device, port) !=
                     IB_LINK_LAYER_INFINIBAND)
                         num_eth_ports++;
 
diff --git a/drivers/infiniband/hw/bnxt_re/bnxt_re.h b/drivers/infiniband/hw/bnxt_re/bnxt_re.h
index b3ad37fec578..ecbac91b2e14 100644
--- a/drivers/infiniband/hw/bnxt_re/bnxt_re.h
+++ b/drivers/infiniband/hw/bnxt_re/bnxt_re.h
@@ -93,11 +93,13 @@ struct bnxt_re_dev {
         struct ib_device                ibdev;
         struct list_head                list;
         unsigned long                   flags;
-#define BNXT_RE_FLAG_NETDEV_REGISTERED  0
-#define BNXT_RE_FLAG_IBDEV_REGISTERED   1
-#define BNXT_RE_FLAG_GOT_MSIX           2
-#define BNXT_RE_FLAG_RCFW_CHANNEL_EN    8
-#define BNXT_RE_FLAG_QOS_WORK_REG       16
+#define BNXT_RE_FLAG_NETDEV_REGISTERED          0
+#define BNXT_RE_FLAG_IBDEV_REGISTERED           1
+#define BNXT_RE_FLAG_GOT_MSIX                   2
+#define BNXT_RE_FLAG_HAVE_L2_REF                3
+#define BNXT_RE_FLAG_RCFW_CHANNEL_EN            4
+#define BNXT_RE_FLAG_QOS_WORK_REG               5
+#define BNXT_RE_FLAG_TASK_IN_PROG               6
         struct net_device               *netdev;
         unsigned int                    version, major, minor;
         struct bnxt_en_dev              *en_dev;
@@ -108,6 +110,8 @@ struct bnxt_re_dev {
 
         struct delayed_work             worker;
         u8                              cur_prio_map;
+        u8                              active_speed;
+        u8                              active_width;
 
         /* FP Notification Queue (CQ & SRQ) */
         struct tasklet_struct           nq_task;
diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
index 01eee15bbd65..0d89621d9fe8 100644
--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
@@ -259,14 +259,9 @@ int bnxt_re_query_port(struct ib_device *ibdev, u8 port_num,
         port_attr->sm_sl = 0;
         port_attr->subnet_timeout = 0;
         port_attr->init_type_reply = 0;
-        /* call the underlying netdev's ethtool hooks to query speed settings
-         * for which we acquire rtnl_lock _only_ if it's registered with
-         * IB stack to avoid race in the NETDEV_UNREG path
-         */
-        if (test_bit(BNXT_RE_FLAG_IBDEV_REGISTERED, &rdev->flags))
-                if (ib_get_eth_speed(ibdev, port_num, &port_attr->active_speed,
-                                     &port_attr->active_width))
-                        return -EINVAL;
+        port_attr->active_speed = rdev->active_speed;
+        port_attr->active_width = rdev->active_width;
+
         return 0;
 }
 
@@ -319,6 +314,7 @@ int bnxt_re_del_gid(struct ib_device *ibdev, u8 port_num,
         struct bnxt_re_gid_ctx *ctx, **ctx_tbl;
         struct bnxt_re_dev *rdev = to_bnxt_re_dev(ibdev, ibdev);
         struct bnxt_qplib_sgid_tbl *sgid_tbl = &rdev->qplib_res.sgid_tbl;
+        struct bnxt_qplib_gid *gid_to_del;
 
         /* Delete the entry from the hardware */
         ctx = *context;
@@ -328,11 +324,25 @@ int bnxt_re_del_gid(struct ib_device *ibdev, u8 port_num,
         if (sgid_tbl && sgid_tbl->active) {
                 if (ctx->idx >= sgid_tbl->max)
                         return -EINVAL;
+                gid_to_del = &sgid_tbl->tbl[ctx->idx];
+                /* DEL_GID is called in WQ context(netdevice_event_work_handler)
+                 * or via the ib_unregister_device path. In the former case QP1
+                 * may not be destroyed yet, in which case just return as FW
+                 * needs that entry to be present and will fail it's deletion.
+                 * We could get invoked again after QP1 is destroyed OR get an
+                 * ADD_GID call with a different GID value for the same index
+                 * where we issue MODIFY_GID cmd to update the GID entry -- TBD
+                 */
+                if (ctx->idx == 0 &&
+                    rdma_link_local_addr((struct in6_addr *)gid_to_del) &&
+                    ctx->refcnt == 1 && rdev->qp1_sqp) {
+                        dev_dbg(rdev_to_dev(rdev),
+                                "Trying to delete GID0 while QP1 is alive\n");
+                        return -EFAULT;
+                }
                 ctx->refcnt--;
                 if (!ctx->refcnt) {
-                        rc = bnxt_qplib_del_sgid(sgid_tbl,
-                                                 &sgid_tbl->tbl[ctx->idx],
-                                                 true);
+                        rc = bnxt_qplib_del_sgid(sgid_tbl, gid_to_del, true);
                         if (rc) {
                                 dev_err(rdev_to_dev(rdev),
                                         "Failed to remove GID: %#x", rc);
@@ -816,6 +826,8 @@ int bnxt_re_destroy_qp(struct ib_qp *ib_qp)
 
                 kfree(rdev->sqp_ah);
                 kfree(rdev->qp1_sqp);
+                rdev->qp1_sqp = NULL;
+                rdev->sqp_ah = NULL;
         }
 
         if (!IS_ERR_OR_NULL(qp->rumem))
@@ -1436,11 +1448,14 @@ int bnxt_re_modify_qp(struct ib_qp *ib_qp, struct ib_qp_attr *qp_attr,
                 qp->qplib_qp.modify_flags |=
                                 CMDQ_MODIFY_QP_MODIFY_MASK_PATH_MTU;
                 qp->qplib_qp.path_mtu = __from_ib_mtu(qp_attr->path_mtu);
+                qp->qplib_qp.mtu = ib_mtu_enum_to_int(qp_attr->path_mtu);
         } else if (qp_attr->qp_state == IB_QPS_RTR) {
                 qp->qplib_qp.modify_flags |=
                         CMDQ_MODIFY_QP_MODIFY_MASK_PATH_MTU;
                 qp->qplib_qp.path_mtu =
                         __from_ib_mtu(iboe_get_mtu(rdev->netdev->mtu));
+                qp->qplib_qp.mtu =
+                        ib_mtu_enum_to_int(iboe_get_mtu(rdev->netdev->mtu));
         }
 
         if (qp_attr_mask & IB_QP_TIMEOUT) {
@@ -1551,43 +1566,46 @@ int bnxt_re_query_qp(struct ib_qp *ib_qp, struct ib_qp_attr *qp_attr,
 {
         struct bnxt_re_qp *qp = container_of(ib_qp, struct bnxt_re_qp, ib_qp);
         struct bnxt_re_dev *rdev = qp->rdev;
-        struct bnxt_qplib_qp qplib_qp;
+        struct bnxt_qplib_qp *qplib_qp;
         int rc;
 
-        memset(&qplib_qp, 0, sizeof(struct bnxt_qplib_qp));
-        qplib_qp.id = qp->qplib_qp.id;
-        qplib_qp.ah.host_sgid_index = qp->qplib_qp.ah.host_sgid_index;
+        qplib_qp = kzalloc(sizeof(*qplib_qp), GFP_KERNEL);
+        if (!qplib_qp)
+                return -ENOMEM;
+
+        qplib_qp->id = qp->qplib_qp.id;
+        qplib_qp->ah.host_sgid_index = qp->qplib_qp.ah.host_sgid_index;
 
-        rc = bnxt_qplib_query_qp(&rdev->qplib_res, &qplib_qp);
+        rc = bnxt_qplib_query_qp(&rdev->qplib_res, qplib_qp);
         if (rc) {
                 dev_err(rdev_to_dev(rdev), "Failed to query HW QP");
-                return rc;
+                goto out;
         }
-        qp_attr->qp_state = __to_ib_qp_state(qplib_qp.state);
-        qp_attr->en_sqd_async_notify = qplib_qp.en_sqd_async_notify ? 1 : 0;
-        qp_attr->qp_access_flags = __to_ib_access_flags(qplib_qp.access);
-        qp_attr->pkey_index = qplib_qp.pkey_index;
-        qp_attr->qkey = qplib_qp.qkey;
+        qp_attr->qp_state = __to_ib_qp_state(qplib_qp->state);
+        qp_attr->en_sqd_async_notify = qplib_qp->en_sqd_async_notify ? 1 : 0;
+        qp_attr->qp_access_flags = __to_ib_access_flags(qplib_qp->access);
+        qp_attr->pkey_index = qplib_qp->pkey_index;
+        qp_attr->qkey = qplib_qp->qkey;
         qp_attr->ah_attr.type = RDMA_AH_ATTR_TYPE_ROCE;
-        rdma_ah_set_grh(&qp_attr->ah_attr, NULL, qplib_qp.ah.flow_label,
-                        qplib_qp.ah.host_sgid_index,
-                        qplib_qp.ah.hop_limit,
-                        qplib_qp.ah.traffic_class);
-        rdma_ah_set_dgid_raw(&qp_attr->ah_attr, qplib_qp.ah.dgid.data);
-        rdma_ah_set_sl(&qp_attr->ah_attr, qplib_qp.ah.sl);
-        ether_addr_copy(qp_attr->ah_attr.roce.dmac, qplib_qp.ah.dmac);
-        qp_attr->path_mtu = __to_ib_mtu(qplib_qp.path_mtu);
-        qp_attr->timeout = qplib_qp.timeout;
-        qp_attr->retry_cnt = qplib_qp.retry_cnt;
-        qp_attr->rnr_retry = qplib_qp.rnr_retry;
-        qp_attr->min_rnr_timer = qplib_qp.min_rnr_timer;
-        qp_attr->rq_psn = qplib_qp.rq.psn;
-        qp_attr->max_rd_atomic = qplib_qp.max_rd_atomic;
-        qp_attr->sq_psn = qplib_qp.sq.psn;
-        qp_attr->max_dest_rd_atomic = qplib_qp.max_dest_rd_atomic;
-        qp_init_attr->sq_sig_type = qplib_qp.sig_type ? IB_SIGNAL_ALL_WR :
-                                                        IB_SIGNAL_REQ_WR;
-        qp_attr->dest_qp_num = qplib_qp.dest_qpn;
+        rdma_ah_set_grh(&qp_attr->ah_attr, NULL, qplib_qp->ah.flow_label,
+                        qplib_qp->ah.host_sgid_index,
+                        qplib_qp->ah.hop_limit,
+                        qplib_qp->ah.traffic_class);
+        rdma_ah_set_dgid_raw(&qp_attr->ah_attr, qplib_qp->ah.dgid.data);
+        rdma_ah_set_sl(&qp_attr->ah_attr, qplib_qp->ah.sl);
+        ether_addr_copy(qp_attr->ah_attr.roce.dmac, qplib_qp->ah.dmac);
+        qp_attr->path_mtu = __to_ib_mtu(qplib_qp->path_mtu);
+        qp_attr->timeout = qplib_qp->timeout;
+        qp_attr->retry_cnt = qplib_qp->retry_cnt;
+        qp_attr->rnr_retry = qplib_qp->rnr_retry;
+        qp_attr->min_rnr_timer = qplib_qp->min_rnr_timer;
+        qp_attr->rq_psn = qplib_qp->rq.psn;
+        qp_attr->max_rd_atomic = qplib_qp->max_rd_atomic;
+        qp_attr->sq_psn = qplib_qp->sq.psn;
+        qp_attr->max_dest_rd_atomic = qplib_qp->max_dest_rd_atomic;
+        qp_init_attr->sq_sig_type = qplib_qp->sig_type ? IB_SIGNAL_ALL_WR :
+                                                         IB_SIGNAL_REQ_WR;
+        qp_attr->dest_qp_num = qplib_qp->dest_qpn;
 
         qp_attr->cap.max_send_wr = qp->qplib_qp.sq.max_wqe;
         qp_attr->cap.max_send_sge = qp->qplib_qp.sq.max_sge;
@@ -1596,7 +1614,9 @@ int bnxt_re_query_qp(struct ib_qp *ib_qp, struct ib_qp_attr *qp_attr,
         qp_attr->cap.max_inline_data = qp->qplib_qp.max_inline_data;
         qp_init_attr->cap = qp_attr->cap;
 
-        return 0;
+out:
+        kfree(qplib_qp);
+        return rc;
 }
 
 /* Routine for sending QP1 packets for RoCE V1 an V2
@@ -1908,6 +1928,7 @@ static int bnxt_re_build_atomic_wqe(struct ib_send_wr *wr,
         switch (wr->opcode) {
         case IB_WR_ATOMIC_CMP_AND_SWP:
                 wqe->type = BNXT_QPLIB_SWQE_TYPE_ATOMIC_CMP_AND_SWP;
+                wqe->atomic.cmp_data = atomic_wr(wr)->compare_add;
                 wqe->atomic.swap_data = atomic_wr(wr)->swap;
                 break;
         case IB_WR_ATOMIC_FETCH_AND_ADD:
@@ -3062,7 +3083,7 @@ int bnxt_re_dereg_mr(struct ib_mr *ib_mr)
                 return rc;
         }
 
-        if (mr->npages && mr->pages) {
+        if (mr->pages) {
                 rc = bnxt_qplib_free_fast_reg_page_list(&rdev->qplib_res,
                                                         &mr->qplib_frpl);
                 kfree(mr->pages);
diff --git a/drivers/infiniband/hw/bnxt_re/main.c b/drivers/infiniband/hw/bnxt_re/main.c
index 82d1cbc27aee..e7450ea92aa9 100644
--- a/drivers/infiniband/hw/bnxt_re/main.c
+++ b/drivers/infiniband/hw/bnxt_re/main.c
@@ -1161,6 +1161,8 @@ static int bnxt_re_ib_reg(struct bnxt_re_dev *rdev)
                 }
         }
         set_bit(BNXT_RE_FLAG_IBDEV_REGISTERED, &rdev->flags);
+        ib_get_eth_speed(&rdev->ibdev, 1, &rdev->active_speed,
+                         &rdev->active_width);
         bnxt_re_dispatch_event(&rdev->ibdev, NULL, 1, IB_EVENT_PORT_ACTIVE);
         bnxt_re_dispatch_event(&rdev->ibdev, NULL, 1, IB_EVENT_GID_CHANGE);
 
@@ -1255,10 +1257,14 @@ static void bnxt_re_task(struct work_struct *work)
                 else if (netif_carrier_ok(rdev->netdev))
                         bnxt_re_dispatch_event(&rdev->ibdev, NULL, 1,
                                                IB_EVENT_PORT_ACTIVE);
+                ib_get_eth_speed(&rdev->ibdev, 1, &rdev->active_speed,
+                                 &rdev->active_width);
                 break;
         default:
                 break;
         }
+        smp_mb__before_atomic();
+        clear_bit(BNXT_RE_FLAG_TASK_IN_PROG, &rdev->flags);
         kfree(re_work);
 }
 
@@ -1317,6 +1323,11 @@ static int bnxt_re_netdev_event(struct notifier_block *notifier,
                 break;
 
         case NETDEV_UNREGISTER:
+                /* netdev notifier will call NETDEV_UNREGISTER again later since
+                 * we are still holding the reference to the netdev
+                 */
+                if (test_bit(BNXT_RE_FLAG_TASK_IN_PROG, &rdev->flags))
+                        goto exit;
                 bnxt_re_ib_unreg(rdev, false);
                 bnxt_re_remove_one(rdev);
                 bnxt_re_dev_unreg(rdev);
@@ -1335,6 +1346,7 @@ static int bnxt_re_netdev_event(struct notifier_block *notifier,
                         re_work->vlan_dev = (real_dev == netdev ?
                                              NULL : netdev);
                         INIT_WORK(&re_work->work, bnxt_re_task);
+                        set_bit(BNXT_RE_FLAG_TASK_IN_PROG, &rdev->flags);
                         queue_work(bnxt_re_wq, &re_work->work);
                 }
         }
@@ -1375,6 +1387,22 @@ err_netdev:
 
 static void __exit bnxt_re_mod_exit(void)
 {
+        struct bnxt_re_dev *rdev;
+        LIST_HEAD(to_be_deleted);
+
+        mutex_lock(&bnxt_re_dev_lock);
+        /* Free all adapter allocated resources */
+        if (!list_empty(&bnxt_re_dev_list))
+                list_splice_init(&bnxt_re_dev_list, &to_be_deleted);
+        mutex_unlock(&bnxt_re_dev_lock);
+
+        list_for_each_entry(rdev, &to_be_deleted, list) {
+                dev_info(rdev_to_dev(rdev), "Unregistering Device");
+                bnxt_re_dev_stop(rdev);
+                bnxt_re_ib_unreg(rdev, true);
+                bnxt_re_remove_one(rdev);
+                bnxt_re_dev_unreg(rdev);
+        }
         unregister_netdevice_notifier(&bnxt_re_netdev_notifier);
         if (bnxt_re_wq)
                 destroy_workqueue(bnxt_re_wq);
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
index 391bb7006e8f..2bdb1562bd21 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
+++ b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
@@ -107,6 +107,9 @@ static int __send_message(struct bnxt_qplib_rcfw *rcfw, struct cmdq_base *req,
                 return -EINVAL;
         }
 
+        if (test_bit(FIRMWARE_TIMED_OUT, &rcfw->flags))
+                return -ETIMEDOUT;
+
         /* Cmdq are in 16-byte units, each request can consume 1 or more
          * cmdqe
          */
@@ -226,6 +229,7 @@ int bnxt_qplib_rcfw_send_message(struct bnxt_qplib_rcfw *rcfw,
                 /* timed out */
                 dev_err(&rcfw->pdev->dev, "QPLIB: cmdq[%#x]=%#x timedout (%d)msec",
                         cookie, opcode, RCFW_CMD_WAIT_TIME_MS);
+                set_bit(FIRMWARE_TIMED_OUT, &rcfw->flags);
                 return rc;
         }
 
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h
index 0ed312f17c8d..85b16da287f9 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h
+++ b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h
@@ -162,8 +162,9 @@ struct bnxt_qplib_rcfw {
         unsigned long           *cmdq_bitmap;
         u32                     bmap_size;
         unsigned long           flags;
-#define FIRMWARE_INITIALIZED_FLAG       1
+#define FIRMWARE_INITIALIZED_FLAG       BIT(0)
 #define FIRMWARE_FIRST_FLAG             BIT(31)
+#define FIRMWARE_TIMED_OUT              BIT(3)
         wait_queue_head_t       waitq;
         int                     (*aeq_handler)(struct bnxt_qplib_rcfw *,
                                                struct creq_func_event *);
diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
index ceaa2fa54d32..daf7a56e5d7e 100644
--- a/drivers/infiniband/hw/cxgb4/cm.c
+++ b/drivers/infiniband/hw/cxgb4/cm.c
@@ -2333,9 +2333,14 @@ static int close_listsrv_rpl(struct c4iw_dev *dev, struct sk_buff *skb)
         unsigned int stid = GET_TID(rpl);
         struct c4iw_listen_ep *ep = get_ep_from_stid(dev, stid);
 
+        if (!ep) {
+                pr_debug("%s stid %d lookup failure!\n", __func__, stid);
+                goto out;
+        }
         pr_debug("%s ep %p\n", __func__, ep);
         c4iw_wake_up(&ep->com.wr_wait, status2errno(rpl->status));
         c4iw_put_ep(&ep->com);
+out:
         return 0;
 }
 
@@ -2594,9 +2599,9 @@ fail:
         c4iw_put_ep(&child_ep->com);
 reject:
         reject_cr(dev, hwtid, skb);
+out:
         if (parent_ep)
                 c4iw_put_ep(&parent_ep->com);
-out:
         return 0;
 }
 
@@ -3457,7 +3462,7 @@ int c4iw_create_listen(struct iw_cm_id *cm_id, int backlog)
                 cm_id->provider_data = ep;
                 goto out;
         }
-
+        remove_handle(ep->com.dev, &ep->com.dev->stid_idr, ep->stid);
         cxgb4_free_stid(ep->com.dev->rdev.lldi.tids, ep->stid,
                         ep->com.local_addr.ss_family);
 fail2:
diff --git a/drivers/infiniband/hw/hfi1/chip.c b/drivers/infiniband/hw/hfi1/chip.c
index b2ed4b9cda6e..0be42787759f 100644
--- a/drivers/infiniband/hw/hfi1/chip.c
+++ b/drivers/infiniband/hw/hfi1/chip.c
@@ -1066,6 +1066,8 @@ static int read_idle_sma(struct hfi1_devdata *dd, u64 *data);
 static int thermal_init(struct hfi1_devdata *dd);
 
 static void update_statusp(struct hfi1_pportdata *ppd, u32 state);
+static int wait_phys_link_offline_substates(struct hfi1_pportdata *ppd,
+                                            int msecs);
 static int wait_logical_linkstate(struct hfi1_pportdata *ppd, u32 state,
                                   int msecs);
 static void log_state_transition(struct hfi1_pportdata *ppd, u32 state);
@@ -8238,6 +8240,7 @@ static irqreturn_t general_interrupt(int irq, void *data)
         u64 regs[CCE_NUM_INT_CSRS];
         u32 bit;
         int i;
+        irqreturn_t handled = IRQ_NONE;
 
         this_cpu_inc(*dd->int_counter);
 
@@ -8258,9 +8261,10 @@ static irqreturn_t general_interrupt(int irq, void *data)
         for_each_set_bit(bit, (unsigned long *)&regs[0],
                          CCE_NUM_INT_CSRS * 64) {
                 is_interrupt(dd, bit);
+                handled = IRQ_HANDLED;
         }
 
-        return IRQ_HANDLED;
+        return handled;
 }
 
 static irqreturn_t sdma_interrupt(int irq, void *data)
@@ -9413,7 +9417,7 @@ static void set_qsfp_int_n(struct hfi1_pportdata *ppd, u8 enable)
         write_csr(dd, dd->hfi1_id ? ASIC_QSFP2_MASK : ASIC_QSFP1_MASK, mask);
 }
 
-void reset_qsfp(struct hfi1_pportdata *ppd)
+int reset_qsfp(struct hfi1_pportdata *ppd)
 {
         struct hfi1_devdata *dd = ppd->dd;
         u64 mask, qsfp_mask;
@@ -9443,6 +9447,13 @@ void reset_qsfp(struct hfi1_pportdata *ppd)
          * for alarms and warnings
          */
         set_qsfp_int_n(ppd, 1);
+
+        /*
+         * After the reset, AOC transmitters are enabled by default. They need
+         * to be turned off to complete the QSFP setup before they can be
+         * enabled again.
+         */
+        return set_qsfp_tx(ppd, 0);
 }
 
 static int handle_qsfp_error_conditions(struct hfi1_pportdata *ppd,
@@ -10305,6 +10316,7 @@ static int goto_offline(struct hfi1_pportdata *ppd, u8 rem_reason)
 {
         struct hfi1_devdata *dd = ppd->dd;
         u32 previous_state;
+        int offline_state_ret;
         int ret;
 
         update_lcb_cache(dd);
@@ -10326,28 +10338,11 @@ static int goto_offline(struct hfi1_pportdata *ppd, u8 rem_reason)
                 ppd->offline_disabled_reason =
                 HFI1_ODR_MASK(OPA_LINKDOWN_REASON_TRANSIENT);
 
-        /*
-         * Wait for offline transition. It can take a while for
-         * the link to go down.
-         */
-        ret = wait_physical_linkstate(ppd, PLS_OFFLINE, 10000);
-        if (ret < 0)
-                return ret;
-
-        /*
-         * Now in charge of LCB - must be after the physical state is
-         * offline.quiet and before host_link_state is changed.
-         */
-        set_host_lcb_access(dd);
-        write_csr(dd, DC_LCB_ERR_EN, ~0ull); /* watch LCB errors */
-
-        /* make sure the logical state is also down */
-        ret = wait_logical_linkstate(ppd, IB_PORT_DOWN, 1000);
-        if (ret)
-                force_logical_link_state_down(ppd);
-
-        ppd->host_link_state = HLS_LINK_COOLDOWN; /* LCB access allowed */
+        offline_state_ret = wait_phys_link_offline_substates(ppd, 10000);
+        if (offline_state_ret < 0)
+                return offline_state_ret;
 
+        /* Disabling AOC transmitters */
         if (ppd->port_type == PORT_TYPE_QSFP &&
             ppd->qsfp_info.limiting_active &&
             qsfp_mod_present(ppd)) {
@@ -10365,6 +10360,30 @@ static int goto_offline(struct hfi1_pportdata *ppd, u8 rem_reason)
         }
 
         /*
+         * Wait for the offline.Quiet transition if it hasn't happened yet. It
+         * can take a while for the link to go down.
+         */
+        if (offline_state_ret != PLS_OFFLINE_QUIET) {
+                ret = wait_physical_linkstate(ppd, PLS_OFFLINE, 30000);
+                if (ret < 0)
+                        return ret;
+        }
+
+        /*
+         * Now in charge of LCB - must be after the physical state is
+         * offline.quiet and before host_link_state is changed.
+         */
+        set_host_lcb_access(dd);
+        write_csr(dd, DC_LCB_ERR_EN, ~0ull); /* watch LCB errors */
+
+        /* make sure the logical state is also down */
+        ret = wait_logical_linkstate(ppd, IB_PORT_DOWN, 1000);
+        if (ret)
+                force_logical_link_state_down(ppd);
+
+        ppd->host_link_state = HLS_LINK_COOLDOWN; /* LCB access allowed */
+
+        /*
          * The LNI has a mandatory wait time after the physical state
          * moves to Offline.Quiet.  The wait time may be different
          * depending on how the link went down.  The 8051 firmware
@@ -10396,6 +10415,9 @@ static int goto_offline(struct hfi1_pportdata *ppd, u8 rem_reason)
                         & (HLS_DN_POLL | HLS_VERIFY_CAP | HLS_GOING_UP)) {
                 /* went down while attempting link up */
                 check_lni_states(ppd);
+
+                /* The QSFP doesn't need to be reset on LNI failure */
+                ppd->qsfp_info.reset_needed = 0;
         }
 
         /* the active link width (downgrade) is 0 on link down */
@@ -12804,6 +12826,39 @@ static int wait_physical_linkstate(struct hfi1_pportdata *ppd, u32 state,
         return 0;
 }
 
+/*
+ * wait_phys_link_offline_quiet_substates - wait for any offline substate
+ * @ppd: port device
+ * @msecs: the number of milliseconds to wait
+ *
+ * Wait up to msecs milliseconds for any offline physical link
+ * state change to occur.
+ * Returns 0 if at least one state is reached, otherwise -ETIMEDOUT.
+ */
+static int wait_phys_link_offline_substates(struct hfi1_pportdata *ppd,
+                                            int msecs)
+{
+        u32 read_state;
+        unsigned long timeout;
+
+        timeout = jiffies + msecs_to_jiffies(msecs);
+        while (1) {
+                read_state = read_physical_state(ppd->dd);
+                if ((read_state & 0xF0) == PLS_OFFLINE)
+                        break;
+                if (time_after(jiffies, timeout)) {
+                        dd_dev_err(ppd->dd,
+                                   "timeout waiting for phy link offline.quiet substates. Read state 0x%x, %dms\n",
+                                   read_state, msecs);
+                        return -ETIMEDOUT;
+                }
+                usleep_range(1950, 2050); /* sleep 2ms-ish */
+        }
+
+        log_state_transition(ppd, read_state);
+        return read_state;
+}
+
 #define CLEAR_STATIC_RATE_CONTROL_SMASK(r) \
 (r &= ~SEND_CTXT_CHECK_ENABLE_DISALLOW_PBC_STATIC_RATE_CONTROL_SMASK)
 
diff --git a/drivers/infiniband/hw/hfi1/chip.h b/drivers/infiniband/hw/hfi1/chip.h
index b8345a60a0fb..50b8645d0b87 100644
--- a/drivers/infiniband/hw/hfi1/chip.h
+++ b/drivers/infiniband/hw/hfi1/chip.h
@@ -204,6 +204,7 @@
 #define PLS_OFFLINE_READY_TO_QUIET_LT      0x92
 #define PLS_OFFLINE_REPORT_FAILURE                 0x93
 #define PLS_OFFLINE_READY_TO_QUIET_BCC     0x94
+#define PLS_OFFLINE_QUIET_DURATION         0x95
 #define PLS_POLLING                                0x20
 #define PLS_POLLING_QUIET                          0x20
 #define PLS_POLLING_ACTIVE                         0x21
@@ -722,7 +723,7 @@ void handle_link_downgrade(struct work_struct *work);
 void handle_link_bounce(struct work_struct *work);
 void handle_start_link(struct work_struct *work);
 void handle_sma_message(struct work_struct *work);
-void reset_qsfp(struct hfi1_pportdata *ppd);
+int reset_qsfp(struct hfi1_pportdata *ppd);
 void qsfp_event(struct work_struct *work);
 void start_freeze_handling(struct hfi1_pportdata *ppd, int flags);
 int send_idle_sma(struct hfi1_devdata *dd, u64 message);
diff --git a/drivers/infiniband/hw/hfi1/eprom.c b/drivers/infiniband/hw/hfi1/eprom.c
index d46b17107901..1613af1c58d9 100644
--- a/drivers/infiniband/hw/hfi1/eprom.c
+++ b/drivers/infiniband/hw/hfi1/eprom.c
@@ -204,7 +204,10 @@ done_asic:
         return ret;
 }
 
-/* magic character sequence that trails an image */
+/* magic character sequence that begins an image */
+#define IMAGE_START_MAGIC "APO="
+
+/* magic character sequence that might trail an image */
 #define IMAGE_TRAIL_MAGIC "egamiAPO"
 
 /* EPROM file types */
@@ -250,6 +253,7 @@ static int read_partition_platform_config(struct hfi1_devdata *dd, void **data,
 {
         void *buffer;
         void *p;
+        u32 length;
         int ret;
 
         buffer = kmalloc(P1_SIZE, GFP_KERNEL);
@@ -262,15 +266,21 @@ static int read_partition_platform_config(struct hfi1_devdata *dd, void **data,
                 return ret;
         }
 
-        /* scan for image magic that may trail the actual data */
-        p = strnstr(buffer, IMAGE_TRAIL_MAGIC, P1_SIZE);
-        if (!p) {
+        /* config partition is valid only if it starts with IMAGE_START_MAGIC */
+        if (memcmp(buffer, IMAGE_START_MAGIC, strlen(IMAGE_START_MAGIC))) {
                 kfree(buffer);
                 return -ENOENT;
         }
 
+        /* scan for image magic that may trail the actual data */
+        p = strnstr(buffer, IMAGE_TRAIL_MAGIC, P1_SIZE);
+        if (p)
+                length = p - buffer;
+        else
+                length = P1_SIZE;
+
         *data = buffer;
-        *size = p - buffer;
+        *size = length;
         return 0;
 }
 
diff --git a/drivers/infiniband/hw/hfi1/file_ops.c b/drivers/infiniband/hw/hfi1/file_ops.c
index 2bc89260235a..d9a1e9893136 100644
--- a/drivers/infiniband/hw/hfi1/file_ops.c
+++ b/drivers/infiniband/hw/hfi1/file_ops.c
@@ -930,15 +930,8 @@ static int assign_ctxt(struct hfi1_filedata *fd, struct hfi1_user_info *uinfo)
         switch (ret) {
         case 0:
                 ret = setup_base_ctxt(fd, uctxt);
-                if (uctxt->subctxt_cnt) {
-                        /*
-                         * Base context is done (successfully or not), notify
-                         * anybody using a sub-context that is waiting for
-                         * this completion.
-                         */
-                        clear_bit(HFI1_CTXT_BASE_UNINIT, &uctxt->event_flags);
-                        wake_up(&uctxt->wait);
-                }
+                if (ret)
+                        deallocate_ctxt(uctxt);
                 break;
         case 1:
                 ret = complete_subctxt(fd);
@@ -1305,25 +1298,25 @@ static int setup_base_ctxt(struct hfi1_filedata *fd,
         /* Now allocate the RcvHdr queue and eager buffers. */
         ret = hfi1_create_rcvhdrq(dd, uctxt);
         if (ret)
-                return ret;
+                goto done;
 
         ret = hfi1_setup_eagerbufs(uctxt);
         if (ret)
-                goto setup_failed;
+                goto done;
 
         /* If sub-contexts are enabled, do the appropriate setup */
         if (uctxt->subctxt_cnt)
                 ret = setup_subctxt(uctxt);
         if (ret)
-                goto setup_failed;
+                goto done;
 
         ret = hfi1_alloc_ctxt_rcv_groups(uctxt);
         if (ret)
-                goto setup_failed;
+                goto done;
 
         ret = init_user_ctxt(fd, uctxt);
         if (ret)
-                goto setup_failed;
+                goto done;
 
         user_init(uctxt);
 
@@ -1331,12 +1324,22 @@ static int setup_base_ctxt(struct hfi1_filedata *fd,
         fd->uctxt = uctxt;
         hfi1_rcd_get(uctxt);
 
-        return 0;
+done:
+        if (uctxt->subctxt_cnt) {
+                /*
+                 * On error, set the failed bit so sub-contexts will clean up
+                 * correctly.
+                 */
+                if (ret)
+                        set_bit(HFI1_CTXT_BASE_FAILED, &uctxt->event_flags);
 
-setup_failed:
-        /* Set the failed bit so sub-context init can do the right thing */
-        set_bit(HFI1_CTXT_BASE_FAILED, &uctxt->event_flags);
-        deallocate_ctxt(uctxt);
+                /*
+                 * Base context is done (successfully or not), notify anybody
+                 * using a sub-context that is waiting for this completion.
+                 */
+                clear_bit(HFI1_CTXT_BASE_UNINIT, &uctxt->event_flags);
+                wake_up(&uctxt->wait);
+        }
 
         return ret;
 }
diff --git a/drivers/infiniband/hw/hfi1/pcie.c b/drivers/infiniband/hw/hfi1/pcie.c
index 82447b7cdda1..09e50fd2a08f 100644
--- a/drivers/infiniband/hw/hfi1/pcie.c
+++ b/drivers/infiniband/hw/hfi1/pcie.c
@@ -68,7 +68,7 @@
 /*
  * Code to adjust PCIe capabilities.
  */
-static int tune_pcie_caps(struct hfi1_devdata *);
+static void tune_pcie_caps(struct hfi1_devdata *);
 
 /*
  * Do all the common PCIe setup and initialization.
@@ -351,7 +351,7 @@ int pcie_speeds(struct hfi1_devdata *dd)
  */
 int request_msix(struct hfi1_devdata *dd, u32 msireq)
 {
-        int nvec, ret;
+        int nvec;
 
         nvec = pci_alloc_irq_vectors(dd->pcidev, 1, msireq,
                                      PCI_IRQ_MSIX | PCI_IRQ_LEGACY);
@@ -360,12 +360,7 @@ int request_msix(struct hfi1_devdata *dd, u32 msireq)
                 return nvec;
         }
 
-        ret = tune_pcie_caps(dd);
-        if (ret) {
-                dd_dev_err(dd, "tune_pcie_caps() failed: %d\n", ret);
-                pci_free_irq_vectors(dd->pcidev);
-                return ret;
-        }
+        tune_pcie_caps(dd);
 
         /* check for legacy IRQ */
         if (nvec == 1 && !dd->pcidev->msix_enabled)
@@ -502,7 +497,7 @@ uint aspm_mode = ASPM_MODE_DISABLED;
 module_param_named(aspm, aspm_mode, uint, S_IRUGO);
 MODULE_PARM_DESC(aspm, "PCIe ASPM: 0: disable, 1: enable, 2: dynamic");
 
-static int tune_pcie_caps(struct hfi1_devdata *dd)
+static void tune_pcie_caps(struct hfi1_devdata *dd)
 {
         struct pci_dev *parent;
         u16 rc_mpss, rc_mps, ep_mpss, ep_mps;
@@ -513,22 +508,14 @@ static int tune_pcie_caps(struct hfi1_devdata *dd)
          * Turn on extended tags in DevCtl in case the BIOS has turned it off
          * to improve WFR SDMA bandwidth
          */
-        ret = pcie_capability_read_word(dd->pcidev,
-                                        PCI_EXP_DEVCTL, &ectl);
-        if (ret) {
-                dd_dev_err(dd, "Unable to read from PCI config\n");
-                return ret;
-        }
-
-        if (!(ectl & PCI_EXP_DEVCTL_EXT_TAG)) {
+        ret = pcie_capability_read_word(dd->pcidev, PCI_EXP_DEVCTL, &ectl);
+        if ((!ret) && !(ectl & PCI_EXP_DEVCTL_EXT_TAG)) {
                 dd_dev_info(dd, "Enabling PCIe extended tags\n");
                 ectl |= PCI_EXP_DEVCTL_EXT_TAG;
                 ret = pcie_capability_write_word(dd->pcidev,
                                                  PCI_EXP_DEVCTL, ectl);
-                if (ret) {
-                        dd_dev_err(dd, "Unable to write to PCI config\n");
-                        return ret;
-                }
+                if (ret)
+                        dd_dev_info(dd, "Unable to write to PCI config\n");
         }
         /* Find out supported and configured values for parent (root) */
         parent = dd->pcidev->bus->self;
@@ -536,15 +523,22 @@ static int tune_pcie_caps(struct hfi1_devdata *dd)
          * The driver cannot perform the tuning if it does not have
          * access to the upstream component.
          */
-        if (!parent)
-                return -EINVAL;
+        if (!parent) {
+                dd_dev_info(dd, "Parent not found\n");
+                return;
+        }
         if (!pci_is_root_bus(parent->bus)) {
                 dd_dev_info(dd, "Parent not root\n");
-                return -EINVAL;
+                return;
+        }
+        if (!pci_is_pcie(parent)) {
+                dd_dev_info(dd, "Parent is not PCI Express capable\n");
+                return;
+        }
+        if (!pci_is_pcie(dd->pcidev)) {
+                dd_dev_info(dd, "PCI device is not PCI Express capable\n");
+                return;
         }
-
-        if (!pci_is_pcie(parent) || !pci_is_pcie(dd->pcidev))
-                return -EINVAL;
         rc_mpss = parent->pcie_mpss;
         rc_mps = ffs(pcie_get_mps(parent)) - 8;
         /* Find out supported and configured values for endpoint (us) */
@@ -590,8 +584,6 @@ static int tune_pcie_caps(struct hfi1_devdata *dd)
                 ep_mrrs = max_mrrs;
                 pcie_set_readrq(dd->pcidev, ep_mrrs);
         }
-
-        return 0;
 }
 
 /* End of PCIe capability tuning */
diff --git a/drivers/infiniband/hw/hfi1/platform.c b/drivers/infiniband/hw/hfi1/platform.c
index a8af96d2b1b0..d486355880cb 100644
--- a/drivers/infiniband/hw/hfi1/platform.c
+++ b/drivers/infiniband/hw/hfi1/platform.c
@@ -790,7 +790,9 @@ static int tune_active_qsfp(struct hfi1_pportdata *ppd, u32 *ptr_tx_preset,
          * reuse of stale settings established in our previous pass through.
          */
         if (ppd->qsfp_info.reset_needed) {
-                reset_qsfp(ppd);
+                ret = reset_qsfp(ppd);
+                if (ret)
+                        return ret;
                 refresh_qsfp_cache(ppd, &ppd->qsfp_info);
         } else {
                 ppd->qsfp_info.reset_needed = 1;
diff --git a/drivers/infiniband/hw/i40iw/i40iw.h b/drivers/infiniband/hw/i40iw/i40iw.h
index 9b1566468744..a65e4cbdce2f 100644
--- a/drivers/infiniband/hw/i40iw/i40iw.h
+++ b/drivers/infiniband/hw/i40iw/i40iw.h
@@ -201,7 +201,6 @@ enum init_completion_state {
         CEQ_CREATED,
         ILQ_CREATED,
         IEQ_CREATED,
-        INET_NOTIFIER,
         IP_ADDR_REGISTERED,
         RDMA_DEV_REGISTERED
 };
diff --git a/drivers/infiniband/hw/i40iw/i40iw_cm.c b/drivers/infiniband/hw/i40iw/i40iw_cm.c
index 14f36ba4e5be..5230dd3c938c 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_cm.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_cm.c
@@ -1504,23 +1504,40 @@ static void i40iw_add_hte_node(struct i40iw_cm_core *cm_core,
 }
 
 /**
- * listen_port_in_use - determine if port is in use
- * @port: Listen port number
+ * i40iw_port_in_use - determine if port is in use
+ * @port: port number
+ * @active_side: flag for listener side vs active side
  */
-static bool i40iw_listen_port_in_use(struct i40iw_cm_core *cm_core, u16 port)
+static bool i40iw_port_in_use(struct i40iw_cm_core *cm_core, u16 port, bool active_side)
 {
         struct i40iw_cm_listener *listen_node;
+        struct i40iw_cm_node *cm_node;
         unsigned long flags;
         bool ret = false;
 
-        spin_lock_irqsave(&cm_core->listen_list_lock, flags);
-        list_for_each_entry(listen_node, &cm_core->listen_nodes, list) {
-                if (listen_node->loc_port == port) {
-                        ret = true;
-                        break;
+        if (active_side) {
+                /* search connected node list */
+                spin_lock_irqsave(&cm_core->ht_lock, flags);
+                list_for_each_entry(cm_node, &cm_core->connected_nodes, list) {
+                        if (cm_node->loc_port == port) {
+                                ret = true;
+                                break;
+                        }
+                }
+                        if (!ret)
+                                clear_bit(port, cm_core->active_side_ports);
+                spin_unlock_irqrestore(&cm_core->ht_lock, flags);
+        } else {
+                spin_lock_irqsave(&cm_core->listen_list_lock, flags);
+                list_for_each_entry(listen_node, &cm_core->listen_nodes, list) {
+                        if (listen_node->loc_port == port) {
+                                ret = true;
+                                break;
+                        }
                 }
+                spin_unlock_irqrestore(&cm_core->listen_list_lock, flags);
         }
-        spin_unlock_irqrestore(&cm_core->listen_list_lock, flags);
+
         return ret;
 }
 
@@ -1868,7 +1885,7 @@ static int i40iw_dec_refcnt_listen(struct i40iw_cm_core *cm_core,
                 spin_unlock_irqrestore(&cm_core->listen_list_lock, flags);
 
                 if (listener->iwdev) {
-                        if (apbvt_del && !i40iw_listen_port_in_use(cm_core, listener->loc_port))
+                        if (apbvt_del && !i40iw_port_in_use(cm_core, listener->loc_port, false))
                                 i40iw_manage_apbvt(listener->iwdev,
                                                    listener->loc_port,
                                                    I40IW_MANAGE_APBVT_DEL);
@@ -2247,21 +2264,21 @@ static void i40iw_rem_ref_cm_node(struct i40iw_cm_node *cm_node)
         if (cm_node->listener) {
                 i40iw_dec_refcnt_listen(cm_core, cm_node->listener, 0, true);
         } else {
-                if (!i40iw_listen_port_in_use(cm_core, cm_node->loc_port) &&
-                    cm_node->apbvt_set) {
+                if (!i40iw_port_in_use(cm_core, cm_node->loc_port, true) && cm_node->apbvt_set) {
                         i40iw_manage_apbvt(cm_node->iwdev,
                                            cm_node->loc_port,
                                            I40IW_MANAGE_APBVT_DEL);
-                        i40iw_get_addr_info(cm_node, &nfo);
-                        if (cm_node->qhash_set) {
-                                i40iw_manage_qhash(cm_node->iwdev,
-                                                   &nfo,
-                                                   I40IW_QHASH_TYPE_TCP_ESTABLISHED,
-                                                   I40IW_QHASH_MANAGE_TYPE_DELETE,
-                                                   NULL,
-                                                   false);
-                                cm_node->qhash_set = 0;
-                        }
+                        cm_node->apbvt_set = 0;
+                }
+                i40iw_get_addr_info(cm_node, &nfo);
+                if (cm_node->qhash_set) {
+                        i40iw_manage_qhash(cm_node->iwdev,
+                                           &nfo,
+                                           I40IW_QHASH_TYPE_TCP_ESTABLISHED,
+                                           I40IW_QHASH_MANAGE_TYPE_DELETE,
+                                           NULL,
+                                           false);
+                        cm_node->qhash_set = 0;
                 }
         }
 
@@ -3255,7 +3272,8 @@ static void i40iw_init_tcp_ctx(struct i40iw_cm_node *cm_node,
         tcp_info->snd_mss = cpu_to_le32(((u32)cm_node->tcp_cntxt.mss));
         if (cm_node->vlan_id < VLAN_TAG_PRESENT) {
                 tcp_info->insert_vlan_tag = true;
-                tcp_info->vlan_tag = cpu_to_le16(cm_node->vlan_id);
+                tcp_info->vlan_tag = cpu_to_le16(((u16)cm_node->user_pri << I40IW_VLAN_PRIO_SHIFT) |
+                                                  cm_node->vlan_id);
         }
         if (cm_node->ipv4) {
                 tcp_info->src_port = cpu_to_le16(cm_node->loc_port);
@@ -3737,10 +3755,8 @@ int i40iw_connect(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
         struct sockaddr_in *raddr;
         struct sockaddr_in6 *laddr6;
         struct sockaddr_in6 *raddr6;
-        bool qhash_set = false;
-        int apbvt_set = 0;
-        int err = 0;
-        enum i40iw_status_code status;
+        int ret = 0;
+        unsigned long flags;
 
         ibqp = i40iw_get_qp(cm_id->device, conn_param->qpn);
         if (!ibqp)
@@ -3789,32 +3805,6 @@ int i40iw_connect(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
         cm_info.user_pri = rt_tos2priority(cm_id->tos);
         i40iw_debug(&iwdev->sc_dev, I40IW_DEBUG_DCB, "%s TOS:[%d] UP:[%d]\n",
                     __func__, cm_id->tos, cm_info.user_pri);
-        if ((cm_info.ipv4 && (laddr->sin_addr.s_addr != raddr->sin_addr.s_addr)) ||
-            (!cm_info.ipv4 && memcmp(laddr6->sin6_addr.in6_u.u6_addr32,
-                                     raddr6->sin6_addr.in6_u.u6_addr32,
-                                     sizeof(laddr6->sin6_addr.in6_u.u6_addr32)))) {
-                status = i40iw_manage_qhash(iwdev,
-                                            &cm_info,
-                                            I40IW_QHASH_TYPE_TCP_ESTABLISHED,
-                                            I40IW_QHASH_MANAGE_TYPE_ADD,
-                                            NULL,
-                                            true);
-                if (status)
-                        return -EINVAL;
-                qhash_set = true;
-        }
-        status = i40iw_manage_apbvt(iwdev, cm_info.loc_port, I40IW_MANAGE_APBVT_ADD);
-        if (status) {
-                i40iw_manage_qhash(iwdev,
-                                   &cm_info,
-                                   I40IW_QHASH_TYPE_TCP_ESTABLISHED,
-                                   I40IW_QHASH_MANAGE_TYPE_DELETE,
-                                   NULL,
-                                   false);
-                return -EINVAL;
-        }
-
-        apbvt_set = 1;
         cm_id->add_ref(cm_id);
         cm_node = i40iw_create_cm_node(&iwdev->cm_core, iwdev,
                                        conn_param->private_data_len,
@@ -3822,17 +3812,40 @@ int i40iw_connect(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
                                        &cm_info);
 
         if (IS_ERR(cm_node)) {
-                err = PTR_ERR(cm_node);
-                goto err_out;
+                ret = PTR_ERR(cm_node);
+                cm_id->rem_ref(cm_id);
+                return ret;
+        }
+
+        if ((cm_info.ipv4 && (laddr->sin_addr.s_addr != raddr->sin_addr.s_addr)) ||
+            (!cm_info.ipv4 && memcmp(laddr6->sin6_addr.in6_u.u6_addr32,
+                                     raddr6->sin6_addr.in6_u.u6_addr32,
+                                     sizeof(laddr6->sin6_addr.in6_u.u6_addr32)))) {
+                if (i40iw_manage_qhash(iwdev, &cm_info, I40IW_QHASH_TYPE_TCP_ESTABLISHED,
+                                       I40IW_QHASH_MANAGE_TYPE_ADD, NULL, true)) {
+                        ret = -EINVAL;
+                        goto err;
+                }
+                cm_node->qhash_set = true;
         }
 
+        spin_lock_irqsave(&iwdev->cm_core.ht_lock, flags);
+        if (!test_and_set_bit(cm_info.loc_port, iwdev->cm_core.active_side_ports)) {
+                spin_unlock_irqrestore(&iwdev->cm_core.ht_lock, flags);
+                if (i40iw_manage_apbvt(iwdev, cm_info.loc_port, I40IW_MANAGE_APBVT_ADD)) {
+                        ret =  -EINVAL;
+                        goto err;
+                }
+        } else {
+                spin_unlock_irqrestore(&iwdev->cm_core.ht_lock, flags);
+        }
+
+        cm_node->apbvt_set = true;
         i40iw_record_ird_ord(cm_node, (u16)conn_param->ird, (u16)conn_param->ord);
         if (cm_node->send_rdma0_op == SEND_RDMA_READ_ZERO &&
             !cm_node->ord_size)
                 cm_node->ord_size = 1;
 
-        cm_node->apbvt_set = apbvt_set;
-        cm_node->qhash_set = qhash_set;
         iwqp->cm_node = cm_node;
         cm_node->iwqp = iwqp;
         iwqp->cm_id = cm_id;
@@ -3840,11 +3853,9 @@ int i40iw_connect(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
 
         if (cm_node->state != I40IW_CM_STATE_OFFLOADED) {
                 cm_node->state = I40IW_CM_STATE_SYN_SENT;
-                err = i40iw_send_syn(cm_node, 0);
-                if (err) {
-                        i40iw_rem_ref_cm_node(cm_node);
-                        goto err_out;
-                }
+                ret = i40iw_send_syn(cm_node, 0);
+                if (ret)
+                        goto err;
         }
 
         i40iw_debug(cm_node->dev,
@@ -3853,9 +3864,10 @@ int i40iw_connect(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
                     cm_node->rem_port,
                     cm_node,
                     cm_node->cm_id);
+
         return 0;
 
-err_out:
+err:
         if (cm_info.ipv4)
                 i40iw_debug(&iwdev->sc_dev,
                             I40IW_DEBUG_CM,
@@ -3867,22 +3879,10 @@ err_out:
                             "Api - connect() FAILED: dest addr=%pI6",
                             cm_info.rem_addr);
 
-        if (qhash_set)
-                i40iw_manage_qhash(iwdev,
-                                   &cm_info,
-                                   I40IW_QHASH_TYPE_TCP_ESTABLISHED,
-                                   I40IW_QHASH_MANAGE_TYPE_DELETE,
-                                   NULL,
-                                   false);
-
-        if (apbvt_set && !i40iw_listen_port_in_use(&iwdev->cm_core,
-                                                   cm_info.loc_port))
-                i40iw_manage_apbvt(iwdev,
-                                   cm_info.loc_port,
-                                   I40IW_MANAGE_APBVT_DEL);
+        i40iw_rem_ref_cm_node(cm_node);
         cm_id->rem_ref(cm_id);
         iwdev->cm_core.stats_connect_errs++;
-        return err;
+        return ret;
 }
 
 /**
diff --git a/drivers/infiniband/hw/i40iw/i40iw_cm.h b/drivers/infiniband/hw/i40iw/i40iw_cm.h
index 2e52e38ffcf3..45abef76295b 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_cm.h
+++ b/drivers/infiniband/hw/i40iw/i40iw_cm.h
@@ -71,6 +71,9 @@
 #define I40IW_HW_IRD_SETTING_32 32
 #define I40IW_HW_IRD_SETTING_64 64
 
+#define MAX_PORTS               65536
+#define I40IW_VLAN_PRIO_SHIFT   13
+
 enum ietf_mpa_flags {
         IETF_MPA_FLAGS_MARKERS = 0x80,  /* receive Markers */
         IETF_MPA_FLAGS_CRC = 0x40,      /* receive Markers */
@@ -411,6 +414,8 @@ struct i40iw_cm_core {
         spinlock_t ht_lock; /* manage hash table */
         spinlock_t listen_list_lock; /* listen list */
 
+        unsigned long active_side_ports[BITS_TO_LONGS(MAX_PORTS)];
+
         u64     stats_nodes_created;
         u64     stats_nodes_destroyed;
         u64     stats_listen_created;
diff --git a/drivers/infiniband/hw/i40iw/i40iw_ctrl.c b/drivers/infiniband/hw/i40iw/i40iw_ctrl.c
index d1f5345f04f0..42ca5346777d 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_ctrl.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_ctrl.c
@@ -48,7 +48,7 @@
  * @wqe: cqp wqe for header
  * @header: header for the cqp wqe
  */
-static inline void i40iw_insert_wqe_hdr(u64 *wqe, u64 header)
+void i40iw_insert_wqe_hdr(u64 *wqe, u64 header)
 {
         wmb();            /* make sure WQE is populated before polarity is set */
         set_64bit_val(wqe, 24, header);
diff --git a/drivers/infiniband/hw/i40iw/i40iw_main.c b/drivers/infiniband/hw/i40iw/i40iw_main.c
index cc742c3132c6..27590ae21881 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_main.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_main.c
@@ -99,8 +99,6 @@ static struct notifier_block i40iw_net_notifier = {
         .notifier_call = i40iw_net_event
 };
 
-static atomic_t i40iw_notifiers_registered;
-
 /**
  * i40iw_find_i40e_handler - find a handler given a client info
  * @ldev: pointer to a client info
@@ -1376,11 +1374,20 @@ error:
  */
 static void i40iw_register_notifiers(void)
 {
-        if (atomic_inc_return(&i40iw_notifiers_registered) == 1) {
-                register_inetaddr_notifier(&i40iw_inetaddr_notifier);
-                register_inet6addr_notifier(&i40iw_inetaddr6_notifier);
-                register_netevent_notifier(&i40iw_net_notifier);
-        }
+        register_inetaddr_notifier(&i40iw_inetaddr_notifier);
+        register_inet6addr_notifier(&i40iw_inetaddr6_notifier);
+        register_netevent_notifier(&i40iw_net_notifier);
+}
+
+/**
+ * i40iw_unregister_notifiers - unregister tcp ip notifiers
+ */
+
+static void i40iw_unregister_notifiers(void)
+{
+        unregister_netevent_notifier(&i40iw_net_notifier);
+        unregister_inetaddr_notifier(&i40iw_inetaddr_notifier);
+        unregister_inet6addr_notifier(&i40iw_inetaddr6_notifier);
 }
 
 /**
@@ -1400,6 +1407,11 @@ static enum i40iw_status_code i40iw_save_msix_info(struct i40iw_device *iwdev,
         u32 i;
         u32 size;
 
+        if (!ldev->msix_count) {
+                i40iw_pr_err("No MSI-X vectors\n");
+                return I40IW_ERR_CONFIG;
+        }
+
         iwdev->msix_count = ldev->msix_count;
 
         size = sizeof(struct i40iw_msix_vector) * iwdev->msix_count;
@@ -1462,12 +1474,6 @@ static void i40iw_deinit_device(struct i40iw_device *iwdev)
                 if (!iwdev->reset)
                         i40iw_del_macip_entry(iwdev, (u8)iwdev->mac_ip_table_idx);
                 /* fallthrough */
-        case INET_NOTIFIER:
-                if (!atomic_dec_return(&i40iw_notifiers_registered)) {
-                        unregister_netevent_notifier(&i40iw_net_notifier);
-                        unregister_inetaddr_notifier(&i40iw_inetaddr_notifier);
-                        unregister_inet6addr_notifier(&i40iw_inetaddr6_notifier);
-                }
                 /* fallthrough */
         case PBLE_CHUNK_MEM:
                 i40iw_destroy_pble_pool(dev, iwdev->pble_rsrc);
@@ -1550,7 +1556,7 @@ static enum i40iw_status_code i40iw_setup_init_state(struct i40iw_handler *hdl,
 
         status = i40iw_save_msix_info(iwdev, ldev);
         if (status)
-                goto exit;
+                return status;
         iwdev->hw.dev_context = (void *)ldev->pcidev;
         iwdev->hw.hw_addr = ldev->hw_addr;
         status = i40iw_allocate_dma_mem(&iwdev->hw,
@@ -1667,8 +1673,6 @@ static int i40iw_open(struct i40e_info *ldev, struct i40e_client *client)
                         break;
                 iwdev->init_state = PBLE_CHUNK_MEM;
                 iwdev->virtchnl_wq = alloc_ordered_workqueue("iwvch", WQ_MEM_RECLAIM);
-                i40iw_register_notifiers();
-                iwdev->init_state = INET_NOTIFIER;
                 status = i40iw_add_mac_ip(iwdev);
                 if (status)
                         break;
@@ -2018,6 +2022,8 @@ static int __init i40iw_init_module(void)
         i40iw_client.type = I40E_CLIENT_IWARP;
         spin_lock_init(&i40iw_handler_lock);
         ret = i40e_register_client(&i40iw_client);
+        i40iw_register_notifiers();
+
         return ret;
 }
 
@@ -2029,6 +2035,7 @@ static int __init i40iw_init_module(void)
  */
 static void __exit i40iw_exit_module(void)
 {
+        i40iw_unregister_notifiers();
         i40e_unregister_client(&i40iw_client);
 }
 
diff --git a/drivers/infiniband/hw/i40iw/i40iw_p.h b/drivers/infiniband/hw/i40iw/i40iw_p.h
index e217a1259f57..5498ad01c280 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_p.h
+++ b/drivers/infiniband/hw/i40iw/i40iw_p.h
@@ -59,6 +59,8 @@ enum i40iw_status_code i40iw_sc_mr_fast_register(struct i40iw_sc_qp *qp,
                                                  struct i40iw_fast_reg_stag_info *info,
                                                  bool post_sq);
 
+void i40iw_insert_wqe_hdr(u64 *wqe, u64 header);
+
 /* HMC/FPM functions */
 enum i40iw_status_code i40iw_sc_init_iw_hmc(struct i40iw_sc_dev *dev,
                                             u8 hmc_fn_id);
diff --git a/drivers/infiniband/hw/i40iw/i40iw_puda.c b/drivers/infiniband/hw/i40iw/i40iw_puda.c
index c2cab20c4bc5..59f70676f0e0 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_puda.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_puda.c
@@ -123,12 +123,11 @@ static void i40iw_puda_post_recvbuf(struct i40iw_puda_rsrc *rsrc, u32 wqe_idx,
                 get_64bit_val(wqe, 24, &offset24);
 
         offset24 = (offset24) ? 0 : LS_64(1, I40IWQPSQ_VALID);
-        set_64bit_val(wqe, 24, offset24);
 
         set_64bit_val(wqe, 0, buf->mem.pa);
         set_64bit_val(wqe, 8,
                       LS_64(buf->mem.size, I40IWQPSQ_FRAG_LEN));
-        set_64bit_val(wqe, 24, offset24);
+        i40iw_insert_wqe_hdr(wqe, offset24);
 }
 
 /**
@@ -409,9 +408,7 @@ enum i40iw_status_code i40iw_puda_send(struct i40iw_sc_qp *qp,
         set_64bit_val(wqe, 8, LS_64(info->len, I40IWQPSQ_FRAG_LEN));
         set_64bit_val(wqe, 16, header[0]);
 
-        /* Ensure all data is written before writing valid bit */
-        wmb();
-        set_64bit_val(wqe, 24, header[1]);
+        i40iw_insert_wqe_hdr(wqe, header[1]);
 
         i40iw_debug_buf(qp->dev, I40IW_DEBUG_PUDA, "PUDA SEND WQE", wqe, 32);
         i40iw_qp_post_wr(&qp->qp_uk);
@@ -539,7 +536,7 @@ static enum i40iw_status_code i40iw_puda_qp_wqe(struct i40iw_sc_dev *dev, struct
                  LS_64(2, I40IW_CQPSQ_QP_NEXTIWSTATE) |
                  LS_64(cqp->polarity, I40IW_CQPSQ_WQEVALID);
 
-        set_64bit_val(wqe, 24, header);
+        i40iw_insert_wqe_hdr(wqe, header);
 
         i40iw_debug_buf(cqp->dev, I40IW_DEBUG_PUDA, "PUDA CQE", wqe, 32);
         i40iw_sc_cqp_post_sq(cqp);
@@ -655,7 +652,7 @@ static enum i40iw_status_code i40iw_puda_cq_wqe(struct i40iw_sc_dev *dev, struct
             LS_64(1, I40IW_CQPSQ_CQ_ENCEQEMASK) |
             LS_64(1, I40IW_CQPSQ_CQ_CEQIDVALID) |
             LS_64(cqp->polarity, I40IW_CQPSQ_WQEVALID);
-        set_64bit_val(wqe, 24, header);
+        i40iw_insert_wqe_hdr(wqe, header);
 
         i40iw_debug_buf(dev, I40IW_DEBUG_PUDA, "PUDA CQE",
                         wqe, I40IW_CQP_WQE_SIZE * 8);
diff --git a/drivers/infiniband/hw/i40iw/i40iw_utils.c b/drivers/infiniband/hw/i40iw/i40iw_utils.c
index 62f1f45b8737..e52dbbb4165e 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_utils.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_utils.c
@@ -160,7 +160,7 @@ int i40iw_inetaddr_event(struct notifier_block *notifier,
                 return NOTIFY_DONE;
 
         iwdev = &hdl->device;
-        if (iwdev->init_state < INET_NOTIFIER)
+        if (iwdev->init_state < IP_ADDR_REGISTERED || iwdev->closing)
                 return NOTIFY_DONE;
 
         netdev = iwdev->ldev->netdev;
@@ -217,7 +217,7 @@ int i40iw_inet6addr_event(struct notifier_block *notifier,
                 return NOTIFY_DONE;
 
         iwdev = &hdl->device;
-        if (iwdev->init_state < INET_NOTIFIER)
+        if (iwdev->init_state < IP_ADDR_REGISTERED || iwdev->closing)
                 return NOTIFY_DONE;
 
         netdev = iwdev->ldev->netdev;
@@ -266,7 +266,7 @@ int i40iw_net_event(struct notifier_block *notifier, unsigned long event, void *
                 if (!iwhdl)
                         return NOTIFY_DONE;
                 iwdev = &iwhdl->device;
-                if (iwdev->init_state < INET_NOTIFIER)
+                if (iwdev->init_state < IP_ADDR_REGISTERED || iwdev->closing)
                         return NOTIFY_DONE;
                 p = (__be32 *)neigh->primary_key;
                 i40iw_copy_ip_ntohl(local_ipaddr, p);
diff --git a/drivers/infiniband/hw/i40iw/i40iw_verbs.c b/drivers/infiniband/hw/i40iw/i40iw_verbs.c
index 1aa411034a27..62be0a41ad0b 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_verbs.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_verbs.c
@@ -826,12 +826,14 @@ static int i40iw_query_qp(struct ib_qp *ibqp,
         attr->cap.max_inline_data = I40IW_MAX_INLINE_DATA_SIZE;
         attr->cap.max_send_sge = I40IW_MAX_WQ_FRAGMENT_COUNT;
         attr->cap.max_recv_sge = I40IW_MAX_WQ_FRAGMENT_COUNT;
+        attr->port_num = 1;
         init_attr->event_handler = iwqp->ibqp.event_handler;
         init_attr->qp_context = iwqp->ibqp.qp_context;
         init_attr->send_cq = iwqp->ibqp.send_cq;
         init_attr->recv_cq = iwqp->ibqp.recv_cq;
         init_attr->srq = iwqp->ibqp.srq;
         init_attr->cap = attr->cap;
+        init_attr->port_num = 1;
         return 0;
 }
 
@@ -1027,7 +1029,19 @@ int i40iw_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr,
                                 iwqp->hw_tcp_state = I40IW_TCP_STATE_CLOSED;
                                 iwqp->last_aeq = I40IW_AE_RESET_SENT;
                                 spin_unlock_irqrestore(&iwqp->lock, flags);
+                                i40iw_cm_disconn(iwqp);
                         }
+                } else {
+                        spin_lock_irqsave(&iwqp->lock, flags);
+                        if (iwqp->cm_id) {
+                                if (atomic_inc_return(&iwqp->close_timer_started) == 1) {
+                                        iwqp->cm_id->add_ref(iwqp->cm_id);
+                                        i40iw_schedule_cm_timer(iwqp->cm_node,
+                                                                (struct i40iw_puda_buf *)iwqp,
+                                                                 I40IW_TIMER_TYPE_CLOSE, 1, 0);
+                                }
+                        }
+                        spin_unlock_irqrestore(&iwqp->lock, flags);
                 }
         }
         return 0;
diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
index ab3c562d5ba7..552f7bd4ecc3 100644
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -778,13 +778,13 @@ static int mlx5_ib_query_device(struct ib_device *ibdev,
         }
 
         if (MLX5_CAP_GEN(mdev, tag_matching)) {
-                props->xrq_caps.max_rndv_hdr_size = MLX5_TM_MAX_RNDV_MSG_SIZE;
-                props->xrq_caps.max_num_tags =
+                props->tm_caps.max_rndv_hdr_size = MLX5_TM_MAX_RNDV_MSG_SIZE;
+                props->tm_caps.max_num_tags =
                         (1 << MLX5_CAP_GEN(mdev, log_tag_matching_list_sz)) - 1;
-                props->xrq_caps.flags = IB_TM_CAP_RC;
-                props->xrq_caps.max_ops =
+                props->tm_caps.flags = IB_TM_CAP_RC;
+                props->tm_caps.max_ops =
                         1 << MLX5_CAP_GEN(mdev, log_max_qp_sz);
-                props->xrq_caps.max_sge = MLX5_TM_MAX_SGE;
+                props->tm_caps.max_sge = MLX5_TM_MAX_SGE;
         }
 
         if (field_avail(typeof(resp), cqe_comp_caps, uhw->outlen)) {
@@ -3837,11 +3837,13 @@ static int delay_drop_debugfs_init(struct mlx5_ib_dev *dev)
         if (!dbg)
                 return -ENOMEM;
 
+        dev->delay_drop.dbg = dbg;
+
         dbg->dir_debugfs =
                 debugfs_create_dir("delay_drop",
                                    dev->mdev->priv.dbg_root);
         if (!dbg->dir_debugfs)
-                return -ENOMEM;
+                goto out_debugfs;
 
         dbg->events_cnt_debugfs =
                 debugfs_create_atomic_t("num_timeout_events", 0400,
@@ -3865,8 +3867,6 @@ static int delay_drop_debugfs_init(struct mlx5_ib_dev *dev)
         if (!dbg->timeout_debugfs)
                 goto out_debugfs;
 
-        dev->delay_drop.dbg = dbg;
-
         return 0;
 
 out_debugfs:
@@ -4174,9 +4174,9 @@ err_bfreg:
 err_uar_page:
         mlx5_put_uars_page(dev->mdev, dev->mdev->priv.uar);
 
-err_cnt:
-        mlx5_ib_cleanup_cong_debugfs(dev);
 err_cong:
+        mlx5_ib_cleanup_cong_debugfs(dev);
+err_cnt:
         if (MLX5_CAP_GEN(dev->mdev, max_qp_cnt))
                 mlx5_ib_dealloc_counters(dev);
 
diff --git a/drivers/infiniband/hw/mlx5/mem.c b/drivers/infiniband/hw/mlx5/mem.c
index 914f212e7ef6..f3dbd75a0a96 100644
--- a/drivers/infiniband/hw/mlx5/mem.c
+++ b/drivers/infiniband/hw/mlx5/mem.c
@@ -50,13 +50,9 @@ void mlx5_ib_cont_pages(struct ib_umem *umem, u64 addr,
 {
         unsigned long tmp;
         unsigned long m;
-        int i, k;
-        u64 base = 0;
-        int p = 0;
-        int skip;
-        int mask;
-        u64 len;
-        u64 pfn;
+        u64 base = ~0, p = 0;
+        u64 len, pfn;
+        int i = 0;
         struct scatterlist *sg;
         int entry;
         unsigned long page_shift = umem->page_shift;
@@ -76,33 +72,24 @@ void mlx5_ib_cont_pages(struct ib_umem *umem, u64 addr,
         m = find_first_bit(&tmp, BITS_PER_LONG);
         if (max_page_shift)
                 m = min_t(unsigned long, max_page_shift - page_shift, m);
-        skip = 1 << m;
-        mask = skip - 1;
-        i = 0;
+
         for_each_sg(umem->sg_head.sgl, sg, umem->nmap, entry) {
                 len = sg_dma_len(sg) >> page_shift;
                 pfn = sg_dma_address(sg) >> page_shift;
-                for (k = 0; k < len; k++) {
-                        if (!(i & mask)) {
-                                tmp = (unsigned long)pfn;
-                                m = min_t(unsigned long, m, find_first_bit(&tmp, BITS_PER_LONG));
-                                skip = 1 << m;
-                                mask = skip - 1;
-                                base = pfn;
-                                p = 0;
-                        } else {
-                                if (base + p != pfn) {
-                                        tmp = (unsigned long)p;
-                                        m = find_first_bit(&tmp, BITS_PER_LONG);
-                                        skip = 1 << m;
-                                        mask = skip - 1;
-                                        base = pfn;
-                                        p = 0;
-                                }
-                        }
-                        p++;
-                        i++;
+                if (base + p != pfn) {
+                        /* If either the offset or the new
+                         * base are unaligned update m
+                         */
+                        tmp = (unsigned long)(pfn | p);
+                        if (!IS_ALIGNED(tmp, 1 << m))
+                                m = find_first_bit(&tmp, BITS_PER_LONG);
+
+                        base = pfn;
+                        p = 0;
                 }
+
+                p += len;
+                i += len;
         }
 
         if (i) {
diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c
index 0e2789d9bb4d..37bbc543847a 100644
--- a/drivers/infiniband/hw/mlx5/mr.c
+++ b/drivers/infiniband/hw/mlx5/mr.c
@@ -47,7 +47,8 @@ enum {
 
 #define MLX5_UMR_ALIGN 2048
 
-static int clean_mr(struct mlx5_ib_mr *mr);
+static int clean_mr(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr);
+static int dereg_mr(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr);
 static int mr_cache_max_order(struct mlx5_ib_dev *dev);
 static int unreg_umr(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr);
 
@@ -1270,8 +1271,9 @@ struct ib_mr *mlx5_ib_reg_user_mr(struct ib_pd *pd, u64 start, u64 length,
 
                 err = mlx5_ib_update_xlt(mr, 0, ncont, page_shift,
                                          update_xlt_flags);
+
                 if (err) {
-                        mlx5_ib_dereg_mr(&mr->ibmr);
+                        dereg_mr(dev, mr);
                         return ERR_PTR(err);
                 }
         }
@@ -1356,7 +1358,7 @@ int mlx5_ib_rereg_user_mr(struct ib_mr *ib_mr, int flags, u64 start,
                 err = mr_umem_get(pd, addr, len, access_flags, &mr->umem,
                                   &npages, &page_shift, &ncont, &order);
                 if (err < 0) {
-                        clean_mr(mr);
+                        clean_mr(dev, mr);
                         return err;
                 }
         }
@@ -1410,7 +1412,7 @@ int mlx5_ib_rereg_user_mr(struct ib_mr *ib_mr, int flags, u64 start,
                 if (err) {
                         mlx5_ib_warn(dev, "Failed to rereg UMR\n");
                         ib_umem_release(mr->umem);
-                        clean_mr(mr);
+                        clean_mr(dev, mr);
                         return err;
                 }
         }
@@ -1469,9 +1471,8 @@ mlx5_free_priv_descs(struct mlx5_ib_mr *mr)
         }
 }
 
-static int clean_mr(struct mlx5_ib_mr *mr)
+static int clean_mr(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr)
 {
-        struct mlx5_ib_dev *dev = to_mdev(mr->ibmr.device);
         int allocated_from_cache = mr->allocated_from_cache;
         int err;
 
@@ -1507,10 +1508,8 @@ static int clean_mr(struct mlx5_ib_mr *mr)
         return 0;
 }
 
-int mlx5_ib_dereg_mr(struct ib_mr *ibmr)
+static int dereg_mr(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr)
 {
-        struct mlx5_ib_dev *dev = to_mdev(ibmr->device);
-        struct mlx5_ib_mr *mr = to_mmr(ibmr);
         int npages = mr->npages;
         struct ib_umem *umem = mr->umem;
 
@@ -1539,7 +1538,7 @@ int mlx5_ib_dereg_mr(struct ib_mr *ibmr)
         }
 #endif
 
-        clean_mr(mr);
+        clean_mr(dev, mr);
 
         if (umem) {
                 ib_umem_release(umem);
@@ -1549,6 +1548,14 @@ int mlx5_ib_dereg_mr(struct ib_mr *ibmr)
         return 0;
 }
 
+int mlx5_ib_dereg_mr(struct ib_mr *ibmr)
+{
+        struct mlx5_ib_dev *dev = to_mdev(ibmr->device);
+        struct mlx5_ib_mr *mr = to_mmr(ibmr);
+
+        return dereg_mr(dev, mr);
+}
+
 struct ib_mr *mlx5_ib_alloc_mr(struct ib_pd *pd,
                                enum ib_mr_type mr_type,
                                u32 max_num_sg)
diff --git a/drivers/infiniband/hw/nes/nes_verbs.c b/drivers/infiniband/hw/nes/nes_verbs.c
index f0dc5f4aa177..442b9bdc0f03 100644
--- a/drivers/infiniband/hw/nes/nes_verbs.c
+++ b/drivers/infiniband/hw/nes/nes_verbs.c
@@ -3232,7 +3232,7 @@ static int nes_post_send(struct ib_qp *ibqp, struct ib_send_wr *ib_wr,
                                             mr->ibmr.iova);
                         set_wqe_32bit_value(wqe->wqe_words,
                                             NES_IWARP_SQ_FMR_WQE_LENGTH_LOW_IDX,
-                                            mr->ibmr.length);
+                                            lower_32_bits(mr->ibmr.length));
                         set_wqe_32bit_value(wqe->wqe_words,
                                             NES_IWARP_SQ_FMR_WQE_LENGTH_HIGH_IDX, 0);
                         set_wqe_32bit_value(wqe->wqe_words,
@@ -3274,7 +3274,7 @@ static int nes_post_send(struct ib_qp *ibqp, struct ib_send_wr *ib_wr,
                                             mr->npages * 8);
 
                         nes_debug(NES_DBG_IW_TX, "SQ_REG_MR: iova_start: %llx, "
-                                  "length: %d, rkey: %0x, pgl_paddr: %llx, "
+                                  "length: %lld, rkey: %0x, pgl_paddr: %llx, "
                                   "page_list_len: %u, wqe_misc: %x\n",
                                   (unsigned long long) mr->ibmr.iova,
                                   mr->ibmr.length,
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_hw.c b/drivers/infiniband/hw/ocrdma/ocrdma_hw.c
index dcb5942f9fb5..65b166cc7437 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_hw.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_hw.c
@@ -252,7 +252,10 @@ static int ocrdma_get_mbx_errno(u32 status)
                 case OCRDMA_MBX_ADDI_STATUS_INSUFFICIENT_RESOURCES:
                         err_num = -EAGAIN;
                         break;
+                default:
+                        err_num = -EFAULT;
                 }
+                break;
         default:
                 err_num = -EFAULT;
         }
diff --git a/drivers/infiniband/hw/qedr/qedr.h b/drivers/infiniband/hw/qedr/qedr.h
index b2bb42e2805d..254083b524bd 100644
--- a/drivers/infiniband/hw/qedr/qedr.h
+++ b/drivers/infiniband/hw/qedr/qedr.h
@@ -387,7 +387,7 @@ struct qedr_qp {
                 u8 wqe_size;
 
                 u8 smac[ETH_ALEN];
-                u16 vlan_id;
+                u16 vlan;
                 int rc;
         } *rqe_wr_id;
 
diff --git a/drivers/infiniband/hw/qedr/qedr_cm.c b/drivers/infiniband/hw/qedr/qedr_cm.c
index 4689e802b332..ad8965397cf7 100644
--- a/drivers/infiniband/hw/qedr/qedr_cm.c
+++ b/drivers/infiniband/hw/qedr/qedr_cm.c
@@ -105,7 +105,7 @@ void qedr_ll2_complete_rx_packet(void *cxt,
 
         qp->rqe_wr_id[qp->rq.gsi_cons].rc = data->u.data_length_error ?
                 -EINVAL : 0;
-        qp->rqe_wr_id[qp->rq.gsi_cons].vlan_id = data->vlan;
+        qp->rqe_wr_id[qp->rq.gsi_cons].vlan = data->vlan;
         /* note: length stands for data length i.e. GRH is excluded */
         qp->rqe_wr_id[qp->rq.gsi_cons].sg_list[0].length =
                 data->length.data_length;
@@ -694,6 +694,7 @@ int qedr_gsi_poll_cq(struct ib_cq *ibcq, int num_entries, struct ib_wc *wc)
         struct qedr_cq *cq = get_qedr_cq(ibcq);
         struct qedr_qp *qp = dev->gsi_qp;
         unsigned long flags;
+        u16 vlan_id;
         int i = 0;
 
         spin_lock_irqsave(&cq->cq_lock, flags);
@@ -712,9 +713,14 @@ int qedr_gsi_poll_cq(struct ib_cq *ibcq, int num_entries, struct ib_wc *wc)
                 wc[i].wc_flags |= IB_WC_GRH | IB_WC_IP_CSUM_OK;
                 ether_addr_copy(wc[i].smac, qp->rqe_wr_id[qp->rq.cons].smac);
                 wc[i].wc_flags |= IB_WC_WITH_SMAC;
-                if (qp->rqe_wr_id[qp->rq.cons].vlan_id) {
+
+                vlan_id = qp->rqe_wr_id[qp->rq.cons].vlan &
+                          VLAN_VID_MASK;
+                if (vlan_id) {
                         wc[i].wc_flags |= IB_WC_WITH_VLAN;
-                        wc[i].vlan_id = qp->rqe_wr_id[qp->rq.cons].vlan_id;
+                        wc[i].vlan_id = vlan_id;
+                        wc[i].sl = (qp->rqe_wr_id[qp->rq.cons].vlan &
+                                    VLAN_PRIO_MASK) >> VLAN_PRIO_SHIFT;
                 }
 
                 qedr_inc_sw_cons(&qp->rq);
diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma.h b/drivers/infiniband/hw/vmw_pvrdma/pvrdma.h
index 663a0c301c43..984aa3484928 100644
--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma.h
+++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma.h
@@ -416,9 +416,34 @@ static inline enum ib_wc_status pvrdma_wc_status_to_ib(
         return (enum ib_wc_status)status;
 }
 
-static inline int pvrdma_wc_opcode_to_ib(int opcode)
-{
-        return opcode;
+static inline int pvrdma_wc_opcode_to_ib(unsigned int opcode)
+{
+        switch (opcode) {
+        case PVRDMA_WC_SEND:
+                return IB_WC_SEND;
+        case PVRDMA_WC_RDMA_WRITE:
+                return IB_WC_RDMA_WRITE;
+        case PVRDMA_WC_RDMA_READ:
+                return IB_WC_RDMA_READ;
+        case PVRDMA_WC_COMP_SWAP:
+                return IB_WC_COMP_SWAP;
+        case PVRDMA_WC_FETCH_ADD:
+                return IB_WC_FETCH_ADD;
+        case PVRDMA_WC_LOCAL_INV:
+                return IB_WC_LOCAL_INV;
+        case PVRDMA_WC_FAST_REG_MR:
+                return IB_WC_REG_MR;
+        case PVRDMA_WC_MASKED_COMP_SWAP:
+                return IB_WC_MASKED_COMP_SWAP;
+        case PVRDMA_WC_MASKED_FETCH_ADD:
+                return IB_WC_MASKED_FETCH_ADD;
+        case PVRDMA_WC_RECV:
+                return IB_WC_RECV;
+        case PVRDMA_WC_RECV_RDMA_WITH_IMM:
+                return IB_WC_RECV_RDMA_WITH_IMM;
+        default:
+                return IB_WC_SEND;
+        }
 }
 
 static inline int pvrdma_wc_flags_to_ib(int flags)
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
index 14b62f7472b4..7774654c2ccb 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
@@ -823,12 +823,18 @@ void ipoib_cm_handle_tx_wc(struct net_device *dev, struct ib_wc *wc)
             wc->status != IB_WC_WR_FLUSH_ERR) {
                 struct ipoib_neigh *neigh;
 
-                if (wc->status != IB_WC_RNR_RETRY_EXC_ERR)
-                        ipoib_warn(priv, "failed cm send event (status=%d, wrid=%d vend_err %x)\n",
-                                   wc->status, wr_id, wc->vendor_err);
+                /* IB_WC[_RNR]_RETRY_EXC_ERR error is part of the life cycle,
+                 * so don't make waves.
+                 */
+                if (wc->status == IB_WC_RNR_RETRY_EXC_ERR ||
+                    wc->status == IB_WC_RETRY_EXC_ERR)
+                        ipoib_dbg(priv,
+                                  "%s: failed cm send event (status=%d, wrid=%d vend_err 0x%x)\n",
+                                   __func__, wc->status, wr_id, wc->vendor_err);
                 else
-                        ipoib_dbg(priv, "failed cm send event (status=%d, wrid=%d vend_err %x)\n",
-                                  wc->status, wr_id, wc->vendor_err);
+                        ipoib_warn(priv,
+                                    "%s: failed cm send event (status=%d, wrid=%d vend_err 0x%x)\n",
+                                   __func__, wc->status, wr_id, wc->vendor_err);
 
                 spin_lock_irqsave(&priv->lock, flags);
                 neigh = tx->neigh;
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
index 2e075377242e..6cd61638b441 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
@@ -1000,19 +1000,6 @@ static inline int update_parent_pkey(struct ipoib_dev_priv *priv)
                  */
                 priv->dev->broadcast[8] = priv->pkey >> 8;
                 priv->dev->broadcast[9] = priv->pkey & 0xff;
-
-                /*
-                 * Update the broadcast address in the priv->broadcast object,
-                 * in case it already exists, otherwise no one will do that.
-                 */
-                if (priv->broadcast) {
-                        spin_lock_irq(&priv->lock);
-                        memcpy(priv->broadcast->mcmember.mgid.raw,
-                               priv->dev->broadcast + 4,
-                        sizeof(union ib_gid));
-                        spin_unlock_irq(&priv->lock);
-                }
-
                 return 0;
         }
 
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index bac95b509a9b..dcc77014018d 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -2180,6 +2180,7 @@ static struct net_device *ipoib_add_port(const char *format,
 {
         struct ipoib_dev_priv *priv;
         struct ib_port_attr attr;
+        struct rdma_netdev *rn;
         int result = -ENOMEM;
 
         priv = ipoib_intf_alloc(hca, port, format);
@@ -2279,7 +2280,8 @@ register_failed:
         ipoib_dev_cleanup(priv->dev);
 
 device_init_failed:
-        free_netdev(priv->dev);
+        rn = netdev_priv(priv->dev);
+        rn->free_rdma_netdev(priv->dev);
         kfree(priv);
 
 alloc_mem_failed:
@@ -2328,7 +2330,7 @@ static void ipoib_remove_one(struct ib_device *device, void *client_data)
                 return;
 
         list_for_each_entry_safe(priv, tmp, dev_list, list) {
-                struct rdma_netdev *rn = netdev_priv(priv->dev);
+                struct rdma_netdev *parent_rn = netdev_priv(priv->dev);
 
                 ib_unregister_event_handler(&priv->event_handler);
                 flush_workqueue(ipoib_workqueue);
@@ -2350,10 +2352,15 @@ static void ipoib_remove_one(struct ib_device *device, void *client_data)
                 unregister_netdev(priv->dev);
                 mutex_unlock(&priv->sysfs_mutex);
 
-                rn->free_rdma_netdev(priv->dev);
+                parent_rn->free_rdma_netdev(priv->dev);
+
+                list_for_each_entry_safe(cpriv, tcpriv, &priv->child_intfs, list) {
+                        struct rdma_netdev *child_rn;
 
-                list_for_each_entry_safe(cpriv, tcpriv, &priv->child_intfs, list)
+                        child_rn = netdev_priv(cpriv->dev);
+                        child_rn->free_rdma_netdev(cpriv->dev);
                         kfree(cpriv);
+                }
 
                 kfree(priv);
         }
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_vlan.c b/drivers/infiniband/ulp/ipoib/ipoib_vlan.c
index 9927cd6b7082..55a9b71ed05a 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_vlan.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_vlan.c
@@ -141,14 +141,17 @@ int ipoib_vlan_add(struct net_device *pdev, unsigned short pkey)
                 return restart_syscall();
         }
 
-        priv = ipoib_intf_alloc(ppriv->ca, ppriv->port, intf_name);
-        if (!priv) {
+        if (!down_write_trylock(&ppriv->vlan_rwsem)) {
                 rtnl_unlock();
                 mutex_unlock(&ppriv->sysfs_mutex);
-                return -ENOMEM;
+                return restart_syscall();
         }
 
-        down_write(&ppriv->vlan_rwsem);
+        priv = ipoib_intf_alloc(ppriv->ca, ppriv->port, intf_name);
+        if (!priv) {
+                result = -ENOMEM;
+                goto out;
+        }
 
         /*
          * First ensure this isn't a duplicate. We check the parent device and
@@ -175,8 +178,11 @@ out:
         rtnl_unlock();
         mutex_unlock(&ppriv->sysfs_mutex);
 
-        if (result) {
-                free_netdev(priv->dev);
+        if (result && priv) {
+                struct rdma_netdev *rn;
+
+                rn = netdev_priv(priv->dev);
+                rn->free_rdma_netdev(priv->dev);
                 kfree(priv);
         }
 
@@ -204,7 +210,12 @@ int ipoib_vlan_delete(struct net_device *pdev, unsigned short pkey)
                 return restart_syscall();
         }
 
-        down_write(&ppriv->vlan_rwsem);
+        if (!down_write_trylock(&ppriv->vlan_rwsem)) {
+                rtnl_unlock();
+                mutex_unlock(&ppriv->sysfs_mutex);
+                return restart_syscall();
+        }
+
         list_for_each_entry_safe(priv, tpriv, &ppriv->child_intfs, list) {
                 if (priv->pkey == pkey &&
                     priv->child_type == IPOIB_LEGACY_CHILD) {
@@ -224,7 +235,10 @@ int ipoib_vlan_delete(struct net_device *pdev, unsigned short pkey)
         mutex_unlock(&ppriv->sysfs_mutex);
 
         if (dev) {
-                free_netdev(dev);
+                struct rdma_netdev *rn;
+
+                rn = netdev_priv(dev);
+                rn->free_rdma_netdev(priv->dev);
                 kfree(priv);
                 return 0;
         }
diff --git a/drivers/infiniband/ulp/iser/iser_memory.c b/drivers/infiniband/ulp/iser/iser_memory.c
index 9c3e9ab53a41..322209d5ff58 100644
--- a/drivers/infiniband/ulp/iser/iser_memory.c
+++ b/drivers/infiniband/ulp/iser/iser_memory.c
@@ -154,7 +154,7 @@ static void iser_dump_page_vec(struct iser_page_vec *page_vec)
 {
         int i;
 
-        iser_err("page vec npages %d data length %d\n",
+        iser_err("page vec npages %d data length %lld\n",
                  page_vec->npages, page_vec->fake_mr.length);
         for (i = 0; i < page_vec->npages; i++)
                 iser_err("vec[%d]: %llx\n", i, page_vec->pages[i]);
diff --git a/drivers/input/ff-core.c b/drivers/input/ff-core.c
index 8f2042432c85..66a46c84e28f 100644
--- a/drivers/input/ff-core.c
+++ b/drivers/input/ff-core.c
@@ -237,9 +237,15 @@ int input_ff_erase(struct input_dev *dev, int effect_id, struct file *file)
 EXPORT_SYMBOL_GPL(input_ff_erase);
 
 /*
- * flush_effects - erase all effects owned by a file handle
+ * input_ff_flush - erase all effects owned by a file handle
+ * @dev: input device to erase effect from
+ * @file: purported owner of the effects
+ *
+ * This function erases all force-feedback effects associated with
+ * the given owner from specified device. Note that @file may be %NULL,
+ * in which case all effects will be erased.
  */
-static int flush_effects(struct input_dev *dev, struct file *file)
+int input_ff_flush(struct input_dev *dev, struct file *file)
 {
         struct ff_device *ff = dev->ff;
         int i;
@@ -255,6 +261,7 @@ static int flush_effects(struct input_dev *dev, struct file *file)
 
         return 0;
 }
+EXPORT_SYMBOL_GPL(input_ff_flush);
 
 /**
  * input_ff_event() - generic handler for force-feedback events
@@ -343,7 +350,7 @@ int input_ff_create(struct input_dev *dev, unsigned int max_effects)
         mutex_init(&ff->mutex);
 
         dev->ff = ff;
-        dev->flush = flush_effects;
+        dev->flush = input_ff_flush;
         dev->event = input_ff_event;
         __set_bit(EV_FF, dev->evbit);
 
diff --git a/drivers/input/misc/uinput.c b/drivers/input/misc/uinput.c
index 022be0e22eba..443151de90c6 100644
--- a/drivers/input/misc/uinput.c
+++ b/drivers/input/misc/uinput.c
@@ -98,14 +98,15 @@ static int uinput_request_reserve_slot(struct uinput_device *udev,
                                         uinput_request_alloc_id(udev, request));
 }
 
-static void uinput_request_done(struct uinput_device *udev,
-                                struct uinput_request *request)
+static void uinput_request_release_slot(struct uinput_device *udev,
+                                        unsigned int id)
 {
         /* Mark slot as available */
-        udev->requests[request->id] = NULL;
-        wake_up(&udev->requests_waitq);
+        spin_lock(&udev->requests_lock);
+        udev->requests[id] = NULL;
+        spin_unlock(&udev->requests_lock);
 
-        complete(&request->done);
+        wake_up(&udev->requests_waitq);
 }
 
 static int uinput_request_send(struct uinput_device *udev,
@@ -138,20 +139,22 @@ static int uinput_request_send(struct uinput_device *udev,
 static int uinput_request_submit(struct uinput_device *udev,
                                  struct uinput_request *request)
 {
-        int error;
+        int retval;
 
-        error = uinput_request_reserve_slot(udev, request);
-        if (error)
-                return error;
+        retval = uinput_request_reserve_slot(udev, request);
+        if (retval)
+                return retval;
 
-        error = uinput_request_send(udev, request);
-        if (error) {
-                uinput_request_done(udev, request);
-                return error;
-        }
+        retval = uinput_request_send(udev, request);
+        if (retval)
+                goto out;
 
         wait_for_completion(&request->done);
-        return request->retval;
+        retval = request->retval;
+
+ out:
+        uinput_request_release_slot(udev, request->id);
+        return retval;
 }
 
 /*
@@ -169,7 +172,7 @@ static void uinput_flush_requests(struct uinput_device *udev)
                 request = udev->requests[i];
                 if (request) {
                         request->retval = -ENODEV;
-                        uinput_request_done(udev, request);
+                        complete(&request->done);
                 }
         }
 
@@ -230,6 +233,18 @@ static int uinput_dev_erase_effect(struct input_dev *dev, int effect_id)
         return uinput_request_submit(udev, &request);
 }
 
+static int uinput_dev_flush(struct input_dev *dev, struct file *file)
+{
+        /*
+         * If we are called with file == NULL that means we are tearing
+         * down the device, and therefore we can not handle FF erase
+         * requests: either we are handling UI_DEV_DESTROY (and holding
+         * the udev->mutex), or the file descriptor is closed and there is
+         * nobody on the other side anymore.
+         */
+        return file ? input_ff_flush(dev, file) : 0;
+}
+
 static void uinput_destroy_device(struct uinput_device *udev)
 {
         const char *name, *phys;
@@ -297,6 +312,12 @@ static int uinput_create_device(struct uinput_device *udev)
                 dev->ff->playback = uinput_dev_playback;
                 dev->ff->set_gain = uinput_dev_set_gain;
                 dev->ff->set_autocenter = uinput_dev_set_autocenter;
+                /*
+                 * The standard input_ff_flush() implementation does
+                 * not quite work for uinput as we can't reasonably
+                 * handle FF requests during device teardown.
+                 */
+                dev->flush = uinput_dev_flush;
         }
 
         error = input_register_device(udev->dev);
@@ -939,7 +960,7 @@ static long uinput_ioctl_handler(struct file *file, unsigned int cmd,
                         }
 
                         req->retval = ff_up.retval;
-                        uinput_request_done(udev, req);
+                        complete(&req->done);
                         goto out;
 
                 case UI_END_FF_ERASE:
@@ -955,7 +976,7 @@ static long uinput_ioctl_handler(struct file *file, unsigned int cmd,
                         }
 
                         req->retval = ff_erase.retval;
-                        uinput_request_done(udev, req);
+                        complete(&req->done);
                         goto out;
         }
 
diff --git a/drivers/input/mouse/elan_i2c_i2c.c b/drivers/input/mouse/elan_i2c_i2c.c
index 15b1330606c1..e19eb60b3d2f 100644
--- a/drivers/input/mouse/elan_i2c_i2c.c
+++ b/drivers/input/mouse/elan_i2c_i2c.c
@@ -598,7 +598,7 @@ static int elan_i2c_write_fw_block(struct i2c_client *client,
         }
 
         /* Wait for F/W to update one page ROM data. */
-        msleep(20);
+        msleep(35);
 
         error = elan_i2c_read_cmd(client, ETP_I2C_IAP_CTRL_CMD, val);
         if (error) {
diff --git a/drivers/iommu/Kconfig b/drivers/iommu/Kconfig
index 49bd2ab8c507..f3a21343e636 100644
--- a/drivers/iommu/Kconfig
+++ b/drivers/iommu/Kconfig
@@ -278,7 +278,7 @@ config EXYNOS_IOMMU_DEBUG
 config IPMMU_VMSA
         bool "Renesas VMSA-compatible IPMMU"
         depends on ARM || IOMMU_DMA
-        depends on ARCH_RENESAS || COMPILE_TEST
+        depends on ARCH_RENESAS || (COMPILE_TEST && !GENERIC_ATOMIC64)
         select IOMMU_API
         select IOMMU_IO_PGTABLE_LPAE
         select ARM_DMA_USE_IOMMU
@@ -373,7 +373,8 @@ config MTK_IOMMU_V1
 config QCOM_IOMMU
         # Note: iommu drivers cannot (yet?) be built as modules
         bool "Qualcomm IOMMU Support"
-        depends on ARCH_QCOM || COMPILE_TEST
+        depends on ARCH_QCOM || (COMPILE_TEST && !GENERIC_ATOMIC64)
+        depends on HAS_DMA
         select IOMMU_API
         select IOMMU_IO_PGTABLE_LPAE
         select ARM_DMA_USE_IOMMU
diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c
index 382de42b8359..6fe2d0346073 100644
--- a/drivers/iommu/amd_iommu_init.c
+++ b/drivers/iommu/amd_iommu_init.c
@@ -874,7 +874,7 @@ static bool copy_device_table(void)
                 hi = readl(iommu->mmio_base + MMIO_DEV_TABLE_OFFSET + 4);
                 entry = (((u64) hi) << 32) + lo;
                 if (last_entry && last_entry != entry) {
-                        pr_err("IOMMU:%d should use the same dev table as others!/n",
+                        pr_err("IOMMU:%d should use the same dev table as others!\n",
                                 iommu->index);
                         return false;
                 }
@@ -882,7 +882,7 @@ static bool copy_device_table(void)
 
                 old_devtb_size = ((entry & ~PAGE_MASK) + 1) << 12;
                 if (old_devtb_size != dev_table_size) {
-                        pr_err("The device table size of IOMMU:%d is not expected!/n",
+                        pr_err("The device table size of IOMMU:%d is not expected!\n",
                                 iommu->index);
                         return false;
                 }
@@ -890,7 +890,7 @@ static bool copy_device_table(void)
 
         old_devtb_phys = entry & PAGE_MASK;
         if (old_devtb_phys >= 0x100000000ULL) {
-                pr_err("The address of old device table is above 4G, not trustworthy!/n");
+                pr_err("The address of old device table is above 4G, not trustworthy!\n");
                 return false;
         }
         old_devtb = memremap(old_devtb_phys, dev_table_size, MEMREMAP_WB);
@@ -901,7 +901,7 @@ static bool copy_device_table(void)
         old_dev_tbl_cpy = (void *)__get_free_pages(gfp_flag,
                                 get_order(dev_table_size));
         if (old_dev_tbl_cpy == NULL) {
-                pr_err("Failed to allocate memory for copying old device table!/n");
+                pr_err("Failed to allocate memory for copying old device table!\n");
                 return false;
         }
 
diff --git a/drivers/iommu/dmar.c b/drivers/iommu/dmar.c
index ca5ebaeafd6a..57c920c1372d 100644
--- a/drivers/iommu/dmar.c
+++ b/drivers/iommu/dmar.c
@@ -497,7 +497,7 @@ static int dmar_parse_one_rhsa(struct acpi_dmar_header *header, void *arg)
 #define dmar_parse_one_rhsa             dmar_res_noop
 #endif
 
-static void __init
+static void
 dmar_table_print_dmar_entry(struct acpi_dmar_header *header)
 {
         struct acpi_dmar_hardware_unit *drhd;
diff --git a/drivers/iommu/io-pgtable-arm-v7s.c b/drivers/iommu/io-pgtable-arm-v7s.c
index d665d0dc16e8..6961fc393f0b 100644
--- a/drivers/iommu/io-pgtable-arm-v7s.c
+++ b/drivers/iommu/io-pgtable-arm-v7s.c
@@ -245,7 +245,7 @@ static void __arm_v7s_free_table(void *table, int lvl,
 static void __arm_v7s_pte_sync(arm_v7s_iopte *ptep, int num_entries,
                                struct io_pgtable_cfg *cfg)
 {
-        if (!(cfg->quirks & IO_PGTABLE_QUIRK_NO_DMA))
+        if (cfg->quirks & IO_PGTABLE_QUIRK_NO_DMA)
                 return;
 
         dma_sync_single_for_device(cfg->iommu_dev, __arm_v7s_dma_addr(ptep),
diff --git a/drivers/iommu/mtk_iommu.c b/drivers/iommu/mtk_iommu.c
index bd515be5b380..16d33ac19db0 100644
--- a/drivers/iommu/mtk_iommu.c
+++ b/drivers/iommu/mtk_iommu.c
@@ -371,7 +371,8 @@ static int mtk_iommu_map(struct iommu_domain *domain, unsigned long iova,
         int ret;
 
         spin_lock_irqsave(&dom->pgtlock, flags);
-        ret = dom->iop->map(dom->iop, iova, paddr, size, prot);
+        ret = dom->iop->map(dom->iop, iova, paddr & DMA_BIT_MASK(32),
+                            size, prot);
         spin_unlock_irqrestore(&dom->pgtlock, flags);
 
         return ret;
diff --git a/drivers/iommu/of_iommu.c b/drivers/iommu/of_iommu.c
index e60e3dba85a0..50947ebb6d17 100644
--- a/drivers/iommu/of_iommu.c
+++ b/drivers/iommu/of_iommu.c
@@ -157,10 +157,7 @@ static int of_pci_iommu_init(struct pci_dev *pdev, u16 alias, void *data)
 
         err = of_iommu_xlate(info->dev, &iommu_spec);
         of_node_put(iommu_spec.np);
-        if (err)
-                return err;
-
-        return info->np == pdev->bus->dev.of_node;
+        return err;
 }
 
 const struct iommu_ops *of_iommu_configure(struct device *dev,
diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c
index 519149ec9053..b5df99c6f680 100644
--- a/drivers/irqchip/irq-gic-v3.c
+++ b/drivers/irqchip/irq-gic-v3.c
@@ -1042,7 +1042,7 @@ static int get_cpu_number(struct device_node *dn)
 {
         const __be32 *cell;
         u64 hwid;
-        int i;
+        int cpu;
 
         cell = of_get_property(dn, "reg", NULL);
         if (!cell)
@@ -1056,9 +1056,9 @@ static int get_cpu_number(struct device_node *dn)
         if (hwid & ~MPIDR_HWID_BITMASK)
                 return -1;
 
-        for (i = 0; i < num_possible_cpus(); i++)
-                if (cpu_logical_map(i) == hwid)
-                        return i;
+        for_each_possible_cpu(cpu)
+                if (cpu_logical_map(cpu) == hwid)
+                        return cpu;
 
         return -1;
 }
diff --git a/drivers/irqchip/irq-gic-v4.c b/drivers/irqchip/irq-gic-v4.c
index 2370e6d9e603..cd0bcc3b7e33 100644
--- a/drivers/irqchip/irq-gic-v4.c
+++ b/drivers/irqchip/irq-gic-v4.c
@@ -173,7 +173,9 @@ int its_map_vlpi(int irq, struct its_vlpi_map *map)
 {
         struct its_cmd_info info = {
                 .cmd_type = MAP_VLPI,
-                .map      = map,
+                {
+                        .map      = map,
+                },
         };
 
         /*
@@ -189,7 +191,9 @@ int its_get_vlpi(int irq, struct its_vlpi_map *map)
 {
         struct its_cmd_info info = {
                 .cmd_type = GET_VLPI,
-                .map      = map,
+                {
+                        .map      = map,
+                },
         };
 
         return irq_set_vcpu_affinity(irq, &info);
@@ -205,7 +209,9 @@ int its_prop_update_vlpi(int irq, u8 config, bool inv)
 {
         struct its_cmd_info info = {
                 .cmd_type = inv ? PROP_UPDATE_AND_INV_VLPI : PROP_UPDATE_VLPI,
-                .config   = config,
+                {
+                        .config   = config,
+                },
         };
 
         return irq_set_vcpu_affinity(irq, &info);
diff --git a/drivers/irqchip/irq-mips-gic.c b/drivers/irqchip/irq-mips-gic.c
index 6e52a88bbd9e..c90976d7e53c 100644
--- a/drivers/irqchip/irq-mips-gic.c
+++ b/drivers/irqchip/irq-mips-gic.c
@@ -169,20 +169,19 @@ static void gic_mask_irq(struct irq_data *d)
 {
         unsigned int intr = GIC_HWIRQ_TO_SHARED(d->hwirq);
 
-        write_gic_rmask(BIT(intr));
+        write_gic_rmask(intr);
         gic_clear_pcpu_masks(intr);
 }
 
 static void gic_unmask_irq(struct irq_data *d)
 {
-        struct cpumask *affinity = irq_data_get_affinity_mask(d);
         unsigned int intr = GIC_HWIRQ_TO_SHARED(d->hwirq);
         unsigned int cpu;
 
-        write_gic_smask(BIT(intr));
+        write_gic_smask(intr);
 
         gic_clear_pcpu_masks(intr);
-        cpu = cpumask_first_and(affinity, cpu_online_mask);
+        cpu = cpumask_first(irq_data_get_effective_affinity_mask(d));
         set_bit(intr, per_cpu_ptr(pcpu_masks, cpu));
 }
 
@@ -420,13 +419,17 @@ static int gic_shared_irq_domain_map(struct irq_domain *d, unsigned int virq,
                                      irq_hw_number_t hw, unsigned int cpu)
 {
         int intr = GIC_HWIRQ_TO_SHARED(hw);
+        struct irq_data *data;
         unsigned long flags;
 
+        data = irq_get_irq_data(virq);
+
         spin_lock_irqsave(&gic_lock, flags);
         write_gic_map_pin(intr, GIC_MAP_PIN_MAP_TO_PIN | gic_cpu_pin);
         write_gic_map_vp(intr, BIT(mips_cm_vp_id(cpu)));
         gic_clear_pcpu_masks(intr);
         set_bit(intr, per_cpu_ptr(pcpu_masks, cpu));
+        irq_data_update_effective_affinity(data, cpumask_of(cpu));
         spin_unlock_irqrestore(&gic_lock, flags);
 
         return 0;
@@ -645,7 +648,7 @@ static int __init gic_of_init(struct device_node *node,
 
         /* Find the first available CPU vector. */
         i = 0;
-        reserved = (C_SW0 | C_SW1) >> __fls(C_SW0);
+        reserved = (C_SW0 | C_SW1) >> __ffs(C_SW0);
         while (!of_property_read_u32_index(node, "mti,reserved-cpu-vectors",
                                            i++, &cpu_vec))
                 reserved |= BIT(cpu_vec);
@@ -684,11 +687,11 @@ static int __init gic_of_init(struct device_node *node,
 
         gicconfig = read_gic_config();
         gic_shared_intrs = gicconfig & GIC_CONFIG_NUMINTERRUPTS;
-        gic_shared_intrs >>= __fls(GIC_CONFIG_NUMINTERRUPTS);
+        gic_shared_intrs >>= __ffs(GIC_CONFIG_NUMINTERRUPTS);
         gic_shared_intrs = (gic_shared_intrs + 1) * 8;
 
         gic_vpes = gicconfig & GIC_CONFIG_PVPS;
-        gic_vpes >>= __fls(GIC_CONFIG_PVPS);
+        gic_vpes >>= __ffs(GIC_CONFIG_PVPS);
         gic_vpes = gic_vpes + 1;
 
         if (cpu_has_veic) {
@@ -767,7 +770,7 @@ static int __init gic_of_init(struct device_node *node,
         for (i = 0; i < gic_shared_intrs; i++) {
                 change_gic_pol(i, GIC_POL_ACTIVE_HIGH);
                 change_gic_trig(i, GIC_TRIG_LEVEL);
-                write_gic_rmask(BIT(i));
+                write_gic_rmask(i);
         }
 
         for (i = 0; i < gic_vpes; i++) {
diff --git a/drivers/isdn/i4l/isdn_ppp.c b/drivers/isdn/i4l/isdn_ppp.c
index 6c44609fd83a..cd2b3c69771a 100644
--- a/drivers/isdn/i4l/isdn_ppp.c
+++ b/drivers/isdn/i4l/isdn_ppp.c
@@ -825,7 +825,6 @@ isdn_ppp_write(int min, struct file *file, const char __user *buf, int count)
         isdn_net_local *lp;
         struct ippp_struct *is;
         int proto;
-        unsigned char protobuf[4];
 
         is = file->private_data;
 
@@ -839,24 +838,28 @@ isdn_ppp_write(int min, struct file *file, const char __user *buf, int count)
         if (!lp)
                 printk(KERN_DEBUG "isdn_ppp_write: lp == NULL\n");
         else {
-                /*
-                 * Don't reset huptimer for
-                 * LCP packets. (Echo requests).
-                 */
-                if (copy_from_user(protobuf, buf, 4))
-                        return -EFAULT;
-                proto = PPP_PROTOCOL(protobuf);
-                if (proto != PPP_LCP)
-                        lp->huptimer = 0;
+                if (lp->isdn_device < 0 || lp->isdn_channel < 0) {
+                        unsigned char protobuf[4];
+                        /*
+                         * Don't reset huptimer for
+                         * LCP packets. (Echo requests).
+                         */
+                        if (copy_from_user(protobuf, buf, 4))
+                                return -EFAULT;
+
+                        proto = PPP_PROTOCOL(protobuf);
+                        if (proto != PPP_LCP)
+                                lp->huptimer = 0;
 
-                if (lp->isdn_device < 0 || lp->isdn_channel < 0)
                         return 0;
+                }
 
                 if ((dev->drv[lp->isdn_device]->flags & DRV_FLAG_RUNNING) &&
                     lp->dialstate == 0 &&
                     (lp->flags & ISDN_NET_CONNECTED)) {
                         unsigned short hl;
                         struct sk_buff *skb;
+                        unsigned char *cpy_buf;
                         /*
                          * we need to reserve enough space in front of
                          * sk_buff. old call to dev_alloc_skb only reserved
@@ -869,11 +872,21 @@ isdn_ppp_write(int min, struct file *file, const char __user *buf, int count)
                                 return count;
                         }
                         skb_reserve(skb, hl);
-                        if (copy_from_user(skb_put(skb, count), buf, count))
+                        cpy_buf = skb_put(skb, count);
+                        if (copy_from_user(cpy_buf, buf, count))
                         {
                                 kfree_skb(skb);
                                 return -EFAULT;
                         }
+
+                        /*
+                         * Don't reset huptimer for
+                         * LCP packets. (Echo requests).
+                         */
+                        proto = PPP_PROTOCOL(cpy_buf);
+                        if (proto != PPP_LCP)
+                                lp->huptimer = 0;
+
                         if (is->debug & 0x40) {
                                 printk(KERN_DEBUG "ppp xmit: len %d\n", (int) skb->len);
                                 isdn_ppp_frame_log("xmit", skb->data, skb->len, 32, is->unit, lp->ppp_slot);
diff --git a/drivers/leds/leds-as3645a.c b/drivers/leds/leds-as3645a.c
index bbbbe0898233..9a257f969300 100644
--- a/drivers/leds/leds-as3645a.c
+++ b/drivers/leds/leds-as3645a.c
@@ -112,6 +112,10 @@
 #define AS_PEAK_mA_TO_REG(a) \
         ((min_t(u32, AS_PEAK_mA_MAX, a) - 1250) / 250)
 
+/* LED numbers for Devicetree */
+#define AS_LED_FLASH                            0
+#define AS_LED_INDICATOR                        1
+
 enum as_mode {
         AS_MODE_EXT_TORCH = 0 << AS_CONTROL_MODE_SETTING_SHIFT,
         AS_MODE_INDICATOR = 1 << AS_CONTROL_MODE_SETTING_SHIFT,
@@ -491,10 +495,29 @@ static int as3645a_parse_node(struct as3645a *flash,
                               struct device_node *node)
 {
         struct as3645a_config *cfg = &flash->cfg;
+        struct device_node *child;
         const char *name;
         int rval;
 
-        flash->flash_node = of_get_child_by_name(node, "flash");
+        for_each_child_of_node(node, child) {
+                u32 id = 0;
+
+                of_property_read_u32(child, "reg", &id);
+
+                switch (id) {
+                case AS_LED_FLASH:
+                        flash->flash_node = of_node_get(child);
+                        break;
+                case AS_LED_INDICATOR:
+                        flash->indicator_node = of_node_get(child);
+                        break;
+                default:
+                        dev_warn(&flash->client->dev,
+                                 "unknown LED %u encountered, ignoring\n", id);
+                        break;
+                }
+        }
+
         if (!flash->flash_node) {
                 dev_err(&flash->client->dev, "can't find flash node\n");
                 return -ENODEV;
@@ -534,11 +557,10 @@ static int as3645a_parse_node(struct as3645a *flash,
         of_property_read_u32(flash->flash_node, "voltage-reference",
                              &cfg->voltage_reference);
 
-        of_property_read_u32(flash->flash_node, "peak-current-limit",
+        of_property_read_u32(flash->flash_node, "ams,input-max-microamp",
                              &cfg->peak);
         cfg->peak = AS_PEAK_mA_TO_REG(cfg->peak);
 
-        flash->indicator_node = of_get_child_by_name(node, "indicator");
         if (!flash->indicator_node) {
                 dev_warn(&flash->client->dev,
                          "can't find indicator node\n");
@@ -721,6 +743,7 @@ static int as3645a_remove(struct i2c_client *client)
         as3645a_set_control(flash, AS_MODE_EXT_TORCH, false);
 
         v4l2_flash_release(flash->vf);
+        v4l2_flash_release(flash->vfind);
 
         led_classdev_flash_unregister(&flash->fled);
         led_classdev_unregister(&flash->iled_cdev);
diff --git a/drivers/md/bcache/closure.c b/drivers/md/bcache/closure.c
index 7d5286b05036..1841d0359bac 100644
--- a/drivers/md/bcache/closure.c
+++ b/drivers/md/bcache/closure.c
@@ -64,7 +64,7 @@ EXPORT_SYMBOL(closure_put);
 void __closure_wake_up(struct closure_waitlist *wait_list)
 {
         struct llist_node *list;
-        struct closure *cl;
+        struct closure *cl, *t;
         struct llist_node *reverse = NULL;
 
         list = llist_del_all(&wait_list->list);
@@ -73,7 +73,7 @@ void __closure_wake_up(struct closure_waitlist *wait_list)
         reverse = llist_reverse_order(list);
 
         /* Then do the wakeups */
-        llist_for_each_entry(cl, reverse, list) {
+        llist_for_each_entry_safe(cl, t, reverse, list) {
                 closure_set_waiting(cl, 0);
                 closure_sub(cl, CLOSURE_WAITING + 1);
         }
diff --git a/drivers/md/dm-core.h b/drivers/md/dm-core.h
index 24eddbdf2ab4..203144762f36 100644
--- a/drivers/md/dm-core.h
+++ b/drivers/md/dm-core.h
@@ -149,5 +149,6 @@ static inline bool dm_message_test_buffer_overflow(char *result, unsigned maxlen
 
 extern atomic_t dm_global_event_nr;
 extern wait_queue_head_t dm_global_eventq;
+void dm_issue_global_event(void);
 
 #endif
diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
index a55ffd4f5933..96ab46512e1f 100644
--- a/drivers/md/dm-crypt.c
+++ b/drivers/md/dm-crypt.c
@@ -2466,6 +2466,7 @@ static int crypt_ctr_cipher_old(struct dm_target *ti, char *cipher_in, char *key
                 kfree(cipher_api);
                 return ret;
         }
+        kfree(cipher_api);
 
         return 0;
 bad_mem:
@@ -2584,6 +2585,10 @@ static int crypt_ctr_optional(struct dm_target *ti, unsigned int argc, char **ar
                                 ti->error = "Invalid feature value for sector_size";
                                 return -EINVAL;
                         }
+                        if (ti->len & ((cc->sector_size >> SECTOR_SHIFT) - 1)) {
+                                ti->error = "Device size is not multiple of sector_size feature";
+                                return -EINVAL;
+                        }
                         cc->sector_shift = __ffs(cc->sector_size) - SECTOR_SHIFT;
                 } else if (!strcasecmp(opt_string, "iv_large_sectors"))
                         set_bit(CRYPT_IV_LARGE_SECTORS, &cc->cipher_flags);
diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
index 8756a6850431..e52676fa9832 100644
--- a/drivers/md/dm-ioctl.c
+++ b/drivers/md/dm-ioctl.c
@@ -477,9 +477,13 @@ static int remove_all(struct file *filp, struct dm_ioctl *param, size_t param_si
  * Round up the ptr to an 8-byte boundary.
  */
 #define ALIGN_MASK 7
+static inline size_t align_val(size_t val)
+{
+        return (val + ALIGN_MASK) & ~ALIGN_MASK;
+}
 static inline void *align_ptr(void *ptr)
 {
-        return (void *) (((size_t) (ptr + ALIGN_MASK)) & ~ALIGN_MASK);
+        return (void *)align_val((size_t)ptr);
 }
 
 /*
@@ -505,7 +509,7 @@ static int list_devices(struct file *filp, struct dm_ioctl *param, size_t param_
         struct hash_cell *hc;
         size_t len, needed = 0;
         struct gendisk *disk;
-        struct dm_name_list *nl, *old_nl = NULL;
+        struct dm_name_list *orig_nl, *nl, *old_nl = NULL;
         uint32_t *event_nr;
 
         down_write(&_hash_lock);
@@ -516,17 +520,15 @@ static int list_devices(struct file *filp, struct dm_ioctl *param, size_t param_
          */
         for (i = 0; i < NUM_BUCKETS; i++) {
                 list_for_each_entry (hc, _name_buckets + i, name_list) {
-                        needed += sizeof(struct dm_name_list);
-                        needed += strlen(hc->name) + 1;
-                        needed += ALIGN_MASK;
-                        needed += (sizeof(uint32_t) + ALIGN_MASK) & ~ALIGN_MASK;
+                        needed += align_val(offsetof(struct dm_name_list, name) + strlen(hc->name) + 1);
+                        needed += align_val(sizeof(uint32_t));
                 }
         }
 
         /*
          * Grab our output buffer.
          */
-        nl = get_result_buffer(param, param_size, &len);
+        nl = orig_nl = get_result_buffer(param, param_size, &len);
         if (len < needed) {
                 param->flags |= DM_BUFFER_FULL_FLAG;
                 goto out;
@@ -549,11 +551,16 @@ static int list_devices(struct file *filp, struct dm_ioctl *param, size_t param_
                         strcpy(nl->name, hc->name);
 
                         old_nl = nl;
-                        event_nr = align_ptr(((void *) (nl + 1)) + strlen(hc->name) + 1);
+                        event_nr = align_ptr(nl->name + strlen(hc->name) + 1);
                         *event_nr = dm_get_event_nr(hc->md);
                         nl = align_ptr(event_nr + 1);
                 }
         }
+        /*
+         * If mismatch happens, security may be compromised due to buffer
+         * overflow, so it's better to crash.
+         */
+        BUG_ON((char *)nl - (char *)orig_nl != needed);
 
  out:
         up_write(&_hash_lock);
@@ -1621,7 +1628,8 @@ static int target_message(struct file *filp, struct dm_ioctl *param, size_t para
  * which has a variable size, is not used by the function processing
  * the ioctl.
  */
-#define IOCTL_FLAGS_NO_PARAMS   1
+#define IOCTL_FLAGS_NO_PARAMS           1
+#define IOCTL_FLAGS_ISSUE_GLOBAL_EVENT  2
 
 /*-----------------------------------------------------------------
  * Implementation of open/close/ioctl on the special char
@@ -1635,12 +1643,12 @@ static ioctl_fn lookup_ioctl(unsigned int cmd, int *ioctl_flags)
                 ioctl_fn fn;
         } _ioctls[] = {
                 {DM_VERSION_CMD, 0, NULL}, /* version is dealt with elsewhere */
-                {DM_REMOVE_ALL_CMD, IOCTL_FLAGS_NO_PARAMS, remove_all},
+                {DM_REMOVE_ALL_CMD, IOCTL_FLAGS_NO_PARAMS | IOCTL_FLAGS_ISSUE_GLOBAL_EVENT, remove_all},
                 {DM_LIST_DEVICES_CMD, 0, list_devices},
 
-                {DM_DEV_CREATE_CMD, IOCTL_FLAGS_NO_PARAMS, dev_create},
-                {DM_DEV_REMOVE_CMD, IOCTL_FLAGS_NO_PARAMS, dev_remove},
-                {DM_DEV_RENAME_CMD, 0, dev_rename},
+                {DM_DEV_CREATE_CMD, IOCTL_FLAGS_NO_PARAMS | IOCTL_FLAGS_ISSUE_GLOBAL_EVENT, dev_create},
+                {DM_DEV_REMOVE_CMD, IOCTL_FLAGS_NO_PARAMS | IOCTL_FLAGS_ISSUE_GLOBAL_EVENT, dev_remove},
+                {DM_DEV_RENAME_CMD, IOCTL_FLAGS_ISSUE_GLOBAL_EVENT, dev_rename},
                 {DM_DEV_SUSPEND_CMD, IOCTL_FLAGS_NO_PARAMS, dev_suspend},
                 {DM_DEV_STATUS_CMD, IOCTL_FLAGS_NO_PARAMS, dev_status},
                 {DM_DEV_WAIT_CMD, 0, dev_wait},
@@ -1869,6 +1877,9 @@ static int ctl_ioctl(struct file *file, uint command, struct dm_ioctl __user *us
             unlikely(ioctl_flags & IOCTL_FLAGS_NO_PARAMS))
                 DMERR("ioctl %d tried to output some data but has IOCTL_FLAGS_NO_PARAMS set", cmd);
 
+        if (!r && ioctl_flags & IOCTL_FLAGS_ISSUE_GLOBAL_EVENT)
+                dm_issue_global_event();
+
         /*
          * Copy the results back to userland.
          */
diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c
index 5bfe285ea9d1..2245d06d2045 100644
--- a/drivers/md/dm-raid.c
+++ b/drivers/md/dm-raid.c
@@ -3238,7 +3238,7 @@ static int raid_map(struct dm_target *ti, struct bio *bio)
         if (unlikely(bio_end_sector(bio) > mddev->array_sectors))
                 return DM_MAPIO_REQUEUE;
 
-        mddev->pers->make_request(mddev, bio);
+        md_handle_request(mddev, bio);
 
         return DM_MAPIO_SUBMITTED;
 }
@@ -3297,11 +3297,10 @@ static const char *__raid_dev_status(struct raid_set *rs, struct md_rdev *rdev,
 static sector_t rs_get_progress(struct raid_set *rs,
                                 sector_t resync_max_sectors, bool *array_in_sync)
 {
-        sector_t r, recovery_cp, curr_resync_completed;
+        sector_t r, curr_resync_completed;
         struct mddev *mddev = &rs->md;
 
         curr_resync_completed = mddev->curr_resync_completed ?: mddev->recovery_cp;
-        recovery_cp = mddev->recovery_cp;
         *array_in_sync = false;
 
         if (rs_is_raid0(rs)) {
@@ -3330,9 +3329,11 @@ static sector_t rs_get_progress(struct raid_set *rs,
                 } else if (test_bit(MD_RECOVERY_RUNNING, &mddev->recovery))
                         r = curr_resync_completed;
                 else
-                        r = recovery_cp;
+                        r = mddev->recovery_cp;
 
-                if (r == MaxSector) {
+                if ((r == MaxSector) ||
+                    (test_bit(MD_RECOVERY_DONE, &mddev->recovery) &&
+                     (mddev->curr_resync_completed == resync_max_sectors))) {
                         /*
                          * Sync complete.
                          */
@@ -3892,7 +3893,7 @@ static void raid_resume(struct dm_target *ti)
 
 static struct target_type raid_target = {
         .name = "raid",
-        .version = {1, 12, 1},
+        .version = {1, 13, 0},
         .module = THIS_MODULE,
         .ctr = raid_ctr,
         .dtr = raid_dtr,
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index 6e54145969c5..4be85324f44d 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -52,6 +52,12 @@ static struct workqueue_struct *deferred_remove_workqueue;
 atomic_t dm_global_event_nr = ATOMIC_INIT(0);
 DECLARE_WAIT_QUEUE_HEAD(dm_global_eventq);
 
+void dm_issue_global_event(void)
+{
+        atomic_inc(&dm_global_event_nr);
+        wake_up(&dm_global_eventq);
+}
+
 /*
  * One of these is allocated per bio.
  */
@@ -1865,9 +1871,8 @@ static void event_callback(void *context)
         dm_send_uevents(&uevents, &disk_to_dev(md->disk)->kobj);
 
         atomic_inc(&md->event_nr);
-        atomic_inc(&dm_global_event_nr);
         wake_up(&md->eventq);
-        wake_up(&dm_global_eventq);
+        dm_issue_global_event();
 }
 
 /*
@@ -2283,6 +2288,7 @@ struct dm_table *dm_swap_table(struct mapped_device *md, struct dm_table *table)
         }
 
         map = __bind(md, table, &limits);
+        dm_issue_global_event();
 
 out:
         mutex_unlock(&md->suspend_lock);
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 08fcaebc61bd..0ff1bbf6c90e 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -266,6 +266,37 @@ static DEFINE_SPINLOCK(all_mddevs_lock);
  * call has finished, the bio has been linked into some internal structure
  * and so is visible to ->quiesce(), so we don't need the refcount any more.
  */
+void md_handle_request(struct mddev *mddev, struct bio *bio)
+{
+check_suspended:
+        rcu_read_lock();
+        if (mddev->suspended) {
+                DEFINE_WAIT(__wait);
+                for (;;) {
+                        prepare_to_wait(&mddev->sb_wait, &__wait,
+                                        TASK_UNINTERRUPTIBLE);
+                        if (!mddev->suspended)
+                                break;
+                        rcu_read_unlock();
+                        schedule();
+                        rcu_read_lock();
+                }
+                finish_wait(&mddev->sb_wait, &__wait);
+        }
+        atomic_inc(&mddev->active_io);
+        rcu_read_unlock();
+
+        if (!mddev->pers->make_request(mddev, bio)) {
+                atomic_dec(&mddev->active_io);
+                wake_up(&mddev->sb_wait);
+                goto check_suspended;
+        }
+
+        if (atomic_dec_and_test(&mddev->active_io) && mddev->suspended)
+                wake_up(&mddev->sb_wait);
+}
+EXPORT_SYMBOL(md_handle_request);
+
 static blk_qc_t md_make_request(struct request_queue *q, struct bio *bio)
 {
         const int rw = bio_data_dir(bio);
@@ -285,23 +316,6 @@ static blk_qc_t md_make_request(struct request_queue *q, struct bio *bio)
                 bio_endio(bio);
                 return BLK_QC_T_NONE;
         }
-check_suspended:
-        rcu_read_lock();
-        if (mddev->suspended) {
-                DEFINE_WAIT(__wait);
-                for (;;) {
-                        prepare_to_wait(&mddev->sb_wait, &__wait,
-                                        TASK_UNINTERRUPTIBLE);
-                        if (!mddev->suspended)
-                                break;
-                        rcu_read_unlock();
-                        schedule();
-                        rcu_read_lock();
-                }
-                finish_wait(&mddev->sb_wait, &__wait);
-        }
-        atomic_inc(&mddev->active_io);
-        rcu_read_unlock();
 
         /*
          * save the sectors now since our bio can
@@ -310,20 +324,14 @@ check_suspended:
         sectors = bio_sectors(bio);
         /* bio could be mergeable after passing to underlayer */
         bio->bi_opf &= ~REQ_NOMERGE;
-        if (!mddev->pers->make_request(mddev, bio)) {
-                atomic_dec(&mddev->active_io);
-                wake_up(&mddev->sb_wait);
-                goto check_suspended;
-        }
+
+        md_handle_request(mddev, bio);
 
         cpu = part_stat_lock();
         part_stat_inc(cpu, &mddev->gendisk->part0, ios[rw]);
         part_stat_add(cpu, &mddev->gendisk->part0, sectors[rw], sectors);
         part_stat_unlock();
 
-        if (atomic_dec_and_test(&mddev->active_io) && mddev->suspended)
-                wake_up(&mddev->sb_wait);
-
         return BLK_QC_T_NONE;
 }
 
@@ -439,16 +447,22 @@ static void md_submit_flush_data(struct work_struct *ws)
         struct mddev *mddev = container_of(ws, struct mddev, flush_work);
         struct bio *bio = mddev->flush_bio;
 
+        /*
+         * must reset flush_bio before calling into md_handle_request to avoid a
+         * deadlock, because other bios passed md_handle_request suspend check
+         * could wait for this and below md_handle_request could wait for those
+         * bios because of suspend check
+         */
+        mddev->flush_bio = NULL;
+        wake_up(&mddev->sb_wait);
+
         if (bio->bi_iter.bi_size == 0)
                 /* an empty barrier - all done */
                 bio_endio(bio);
         else {
                 bio->bi_opf &= ~REQ_PREFLUSH;
-                mddev->pers->make_request(mddev, bio);
+                md_handle_request(mddev, bio);
         }
-
-        mddev->flush_bio = NULL;
-        wake_up(&mddev->sb_wait);
 }
 
 void md_flush_request(struct mddev *mddev, struct bio *bio)
diff --git a/drivers/md/md.h b/drivers/md/md.h
index 561d22b9a9a8..d8287d3cd1bf 100644
--- a/drivers/md/md.h
+++ b/drivers/md/md.h
@@ -692,6 +692,7 @@ extern void md_stop_writes(struct mddev *mddev);
 extern int md_rdev_init(struct md_rdev *rdev);
 extern void md_rdev_clear(struct md_rdev *rdev);
 
+extern void md_handle_request(struct mddev *mddev, struct bio *bio);
 extern void mddev_suspend(struct mddev *mddev);
 extern void mddev_resume(struct mddev *mddev);
 extern struct bio *bio_alloc_mddev(gfp_t gfp_mask, int nr_iovecs,
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 4188a4881148..928e24a07133 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -811,6 +811,14 @@ static void stripe_add_to_batch_list(struct r5conf *conf, struct stripe_head *sh
                         spin_unlock(&head->batch_head->batch_lock);
                         goto unlock_out;
                 }
+                /*
+                 * We must assign batch_head of this stripe within the
+                 * batch_lock, otherwise clear_batch_ready of batch head
+                 * stripe could clear BATCH_READY bit of this stripe and
+                 * this stripe->batch_head doesn't get assigned, which
+                 * could confuse clear_batch_ready for this stripe
+                 */
+                sh->batch_head = head->batch_head;
 
                 /*
                  * at this point, head's BATCH_READY could be cleared, but we
@@ -818,8 +826,6 @@ static void stripe_add_to_batch_list(struct r5conf *conf, struct stripe_head *sh
                  */
                 list_add(&sh->batch_list, &head->batch_list);
                 spin_unlock(&head->batch_head->batch_lock);
-
-                sh->batch_head = head->batch_head;
         } else {
                 head->batch_head = head;
                 sh->batch_head = head->batch_head;
@@ -4599,7 +4605,8 @@ static void break_stripe_batch_list(struct stripe_head *head_sh,
 
                 set_mask_bits(&sh->state, ~(STRIPE_EXPAND_SYNC_FLAGS |
                                             (1 << STRIPE_PREREAD_ACTIVE) |
-                                            (1 << STRIPE_DEGRADED)),
+                                            (1 << STRIPE_DEGRADED) |
+                                            (1 << STRIPE_ON_UNPLUG_LIST)),
                               head_sh->state & (1 << STRIPE_INSYNC));
 
                 sh->check_state = head_sh->check_state;
@@ -6568,14 +6575,17 @@ static ssize_t
 raid5_store_group_thread_cnt(struct mddev *mddev, const char *page, size_t len)
 {
         struct r5conf *conf;
-        unsigned long new;
+        unsigned int new;
         int err;
         struct r5worker_group *new_groups, *old_groups;
         int group_cnt, worker_cnt_per_group;
 
         if (len >= PAGE_SIZE)
                 return -EINVAL;
-        if (kstrtoul(page, 10, &new))
+        if (kstrtouint(page, 10, &new))
+                return -EINVAL;
+        /* 8192 should be big enough */
+        if (new > 8192)
                 return -EINVAL;
 
         err = mddev_lock(mddev);
diff --git a/drivers/media/rc/ir-sharp-decoder.c b/drivers/media/rc/ir-sharp-decoder.c
index ed43a4212479..129b558acc92 100644
--- a/drivers/media/rc/ir-sharp-decoder.c
+++ b/drivers/media/rc/ir-sharp-decoder.c
@@ -245,5 +245,5 @@ module_init(ir_sharp_decode_init);
 module_exit(ir_sharp_decode_exit);
 
 MODULE_LICENSE("GPL");
-MODULE_AUTHOR("James Hogan <james.hogan@imgtec.com>");
+MODULE_AUTHOR("James Hogan <jhogan@kernel.org>");
 MODULE_DESCRIPTION("Sharp IR protocol decoder");
diff --git a/drivers/misc/cxl/cxllib.c b/drivers/misc/cxl/cxllib.c
index 5dba23ca2e5f..dc9bc1807fdf 100644
--- a/drivers/misc/cxl/cxllib.c
+++ b/drivers/misc/cxl/cxllib.c
@@ -219,8 +219,17 @@ int cxllib_handle_fault(struct mm_struct *mm, u64 addr, u64 size, u64 flags)
 
         down_read(&mm->mmap_sem);
 
-        for (dar = addr; dar < addr + size; dar += page_size) {
-                if (!vma || dar < vma->vm_start || dar > vma->vm_end) {
+        vma = find_vma(mm, addr);
+        if (!vma) {
+                pr_err("Can't find vma for addr %016llx\n", addr);
+                rc = -EFAULT;
+                goto out;
+        }
+        /* get the size of the pages allocated */
+        page_size = vma_kernel_pagesize(vma);
+
+        for (dar = (addr & ~(page_size - 1)); dar < (addr + size); dar += page_size) {
+                if (dar < vma->vm_start || dar >= vma->vm_end) {
                         vma = find_vma(mm, addr);
                         if (!vma) {
                                 pr_err("Can't find vma for addr %016llx\n", addr);
diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
index 29fc1e662891..2ad7b5c69156 100644
--- a/drivers/mmc/core/block.c
+++ b/drivers/mmc/core/block.c
@@ -1634,8 +1634,6 @@ static void mmc_blk_data_prep(struct mmc_queue *mq, struct mmc_queue_req *mqrq,
         }
 
         mqrq->areq.mrq = &brq->mrq;
-
-        mmc_queue_bounce_pre(mqrq);
 }
 
 static void mmc_blk_rw_rq_prep(struct mmc_queue_req *mqrq,
@@ -1829,7 +1827,6 @@ static void mmc_blk_issue_rw_rq(struct mmc_queue *mq, struct request *new_req)
                 brq = &mq_rq->brq;
                 old_req = mmc_queue_req_to_req(mq_rq);
                 type = rq_data_dir(old_req) == READ ? MMC_BLK_READ : MMC_BLK_WRITE;
-                mmc_queue_bounce_post(mq_rq);
 
                 switch (status) {
                 case MMC_BLK_SUCCESS:
diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c
index a7eb623f8daa..36217ad5e9b1 100644
--- a/drivers/mmc/core/mmc.c
+++ b/drivers/mmc/core/mmc.c
@@ -1286,6 +1286,23 @@ out_err:
         return err;
 }
 
+static void mmc_select_driver_type(struct mmc_card *card)
+{
+        int card_drv_type, drive_strength, drv_type;
+
+        card_drv_type = card->ext_csd.raw_driver_strength |
+                        mmc_driver_type_mask(0);
+
+        drive_strength = mmc_select_drive_strength(card,
+                                                   card->ext_csd.hs200_max_dtr,
+                                                   card_drv_type, &drv_type);
+
+        card->drive_strength = drive_strength;
+
+        if (drv_type)
+                mmc_set_driver_type(card->host, drv_type);
+}
+
 static int mmc_select_hs400es(struct mmc_card *card)
 {
         struct mmc_host *host = card->host;
@@ -1341,6 +1358,8 @@ static int mmc_select_hs400es(struct mmc_card *card)
                 goto out_err;
         }
 
+        mmc_select_driver_type(card);
+
         /* Switch card to HS400 */
         val = EXT_CSD_TIMING_HS400 |
               card->drive_strength << EXT_CSD_DRV_STR_SHIFT;
@@ -1374,23 +1393,6 @@ out_err:
         return err;
 }
 
-static void mmc_select_driver_type(struct mmc_card *card)
-{
-        int card_drv_type, drive_strength, drv_type;
-
-        card_drv_type = card->ext_csd.raw_driver_strength |
-                        mmc_driver_type_mask(0);
-
-        drive_strength = mmc_select_drive_strength(card,
-                                                   card->ext_csd.hs200_max_dtr,
-                                                   card_drv_type, &drv_type);
-
-        card->drive_strength = drive_strength;
-
-        if (drv_type)
-                mmc_set_driver_type(card->host, drv_type);
-}
-
 /*
  * For device supporting HS200 mode, the following sequence
  * should be done before executing the tuning process.
diff --git a/drivers/mmc/core/queue.c b/drivers/mmc/core/queue.c
index affa7370ba82..0a4e77a5ba33 100644
--- a/drivers/mmc/core/queue.c
+++ b/drivers/mmc/core/queue.c
@@ -23,8 +23,6 @@
 #include "core.h"
 #include "card.h"
 
-#define MMC_QUEUE_BOUNCESZ      65536
-
 /*
  * Prepare a MMC request. This just filters out odd stuff.
  */
@@ -150,26 +148,6 @@ static void mmc_queue_setup_discard(struct request_queue *q,
                 queue_flag_set_unlocked(QUEUE_FLAG_SECERASE, q);
 }
 
-static unsigned int mmc_queue_calc_bouncesz(struct mmc_host *host)
-{
-        unsigned int bouncesz = MMC_QUEUE_BOUNCESZ;
-
-        if (host->max_segs != 1 || (host->caps & MMC_CAP_NO_BOUNCE_BUFF))
-                return 0;
-
-        if (bouncesz > host->max_req_size)
-                bouncesz = host->max_req_size;
-        if (bouncesz > host->max_seg_size)
-                bouncesz = host->max_seg_size;
-        if (bouncesz > host->max_blk_count * 512)
-                bouncesz = host->max_blk_count * 512;
-
-        if (bouncesz <= 512)
-                return 0;
-
-        return bouncesz;
-}
-
 /**
  * mmc_init_request() - initialize the MMC-specific per-request data
  * @q: the request queue
@@ -184,26 +162,9 @@ static int mmc_init_request(struct request_queue *q, struct request *req,
         struct mmc_card *card = mq->card;
         struct mmc_host *host = card->host;
 
-        if (card->bouncesz) {
-                mq_rq->bounce_buf = kmalloc(card->bouncesz, gfp);
-                if (!mq_rq->bounce_buf)
-                        return -ENOMEM;
-                if (card->bouncesz > 512) {
-                        mq_rq->sg = mmc_alloc_sg(1, gfp);
-                        if (!mq_rq->sg)
-                                return -ENOMEM;
-                        mq_rq->bounce_sg = mmc_alloc_sg(card->bouncesz / 512,
-                                                        gfp);
-                        if (!mq_rq->bounce_sg)
-                                return -ENOMEM;
-                }
-        } else {
-                mq_rq->bounce_buf = NULL;
-                mq_rq->bounce_sg = NULL;
-                mq_rq->sg = mmc_alloc_sg(host->max_segs, gfp);
-                if (!mq_rq->sg)
-                        return -ENOMEM;
-        }
+        mq_rq->sg = mmc_alloc_sg(host->max_segs, gfp);
+        if (!mq_rq->sg)
+                return -ENOMEM;
 
         return 0;
 }
@@ -212,13 +173,6 @@ static void mmc_exit_request(struct request_queue *q, struct request *req)
 {
         struct mmc_queue_req *mq_rq = req_to_mmc_queue_req(req);
 
-        /* It is OK to kfree(NULL) so this will be smooth */
-        kfree(mq_rq->bounce_sg);
-        mq_rq->bounce_sg = NULL;
-
-        kfree(mq_rq->bounce_buf);
-        mq_rq->bounce_buf = NULL;
-
         kfree(mq_rq->sg);
         mq_rq->sg = NULL;
 }
@@ -265,18 +219,11 @@ int mmc_init_queue(struct mmc_queue *mq, struct mmc_card *card,
         if (mmc_can_erase(card))
                 mmc_queue_setup_discard(mq->queue, card);
 
-        card->bouncesz = mmc_queue_calc_bouncesz(host);
-        if (card->bouncesz) {
-                blk_queue_max_hw_sectors(mq->queue, card->bouncesz / 512);
-                blk_queue_max_segments(mq->queue, card->bouncesz / 512);
-                blk_queue_max_segment_size(mq->queue, card->bouncesz);
-        } else {
-                blk_queue_bounce_limit(mq->queue, limit);
-                blk_queue_max_hw_sectors(mq->queue,
-                        min(host->max_blk_count, host->max_req_size / 512));
-                blk_queue_max_segments(mq->queue, host->max_segs);
-                blk_queue_max_segment_size(mq->queue, host->max_seg_size);
-        }
+        blk_queue_bounce_limit(mq->queue, limit);
+        blk_queue_max_hw_sectors(mq->queue,
+                min(host->max_blk_count, host->max_req_size / 512));
+        blk_queue_max_segments(mq->queue, host->max_segs);
+        blk_queue_max_segment_size(mq->queue, host->max_seg_size);
 
         sema_init(&mq->thread_sem, 1);
 
@@ -365,56 +312,7 @@ void mmc_queue_resume(struct mmc_queue *mq)
  */
 unsigned int mmc_queue_map_sg(struct mmc_queue *mq, struct mmc_queue_req *mqrq)
 {
-        unsigned int sg_len;
-        size_t buflen;
-        struct scatterlist *sg;
         struct request *req = mmc_queue_req_to_req(mqrq);
-        int i;
-
-        if (!mqrq->bounce_buf)
-                return blk_rq_map_sg(mq->queue, req, mqrq->sg);
-
-        sg_len = blk_rq_map_sg(mq->queue, req, mqrq->bounce_sg);
-
-        mqrq->bounce_sg_len = sg_len;
-
-        buflen = 0;
-        for_each_sg(mqrq->bounce_sg, sg, sg_len, i)
-                buflen += sg->length;
-
-        sg_init_one(mqrq->sg, mqrq->bounce_buf, buflen);
-
-        return 1;
-}
-
-/*
- * If writing, bounce the data to the buffer before the request
- * is sent to the host driver
- */
-void mmc_queue_bounce_pre(struct mmc_queue_req *mqrq)
-{
-        if (!mqrq->bounce_buf)
-                return;
-
-        if (rq_data_dir(mmc_queue_req_to_req(mqrq)) != WRITE)
-                return;
-
-        sg_copy_to_buffer(mqrq->bounce_sg, mqrq->bounce_sg_len,
-                mqrq->bounce_buf, mqrq->sg[0].length);
-}
-
-/*
- * If reading, bounce the data from the buffer after the request
- * has been handled by the host driver
- */
-void mmc_queue_bounce_post(struct mmc_queue_req *mqrq)
-{
-        if (!mqrq->bounce_buf)
-                return;
-
-        if (rq_data_dir(mmc_queue_req_to_req(mqrq)) != READ)
-                return;
 
-        sg_copy_from_buffer(mqrq->bounce_sg, mqrq->bounce_sg_len,
-                mqrq->bounce_buf, mqrq->sg[0].length);
+        return blk_rq_map_sg(mq->queue, req, mqrq->sg);
 }
diff --git a/drivers/mmc/core/queue.h b/drivers/mmc/core/queue.h
index 04fc89360a7a..f18d3f656baa 100644
--- a/drivers/mmc/core/queue.h
+++ b/drivers/mmc/core/queue.h
@@ -49,9 +49,6 @@ enum mmc_drv_op {
 struct mmc_queue_req {
         struct mmc_blk_request  brq;
         struct scatterlist      *sg;
-        char                    *bounce_buf;
-        struct scatterlist      *bounce_sg;
-        unsigned int            bounce_sg_len;
         struct mmc_async_req    areq;
         enum mmc_drv_op         drv_op;
         int                     drv_op_result;
@@ -81,11 +78,8 @@ extern int mmc_init_queue(struct mmc_queue *, struct mmc_card *, spinlock_t *,
 extern void mmc_cleanup_queue(struct mmc_queue *);
 extern void mmc_queue_suspend(struct mmc_queue *);
 extern void mmc_queue_resume(struct mmc_queue *);
-
 extern unsigned int mmc_queue_map_sg(struct mmc_queue *,
                                      struct mmc_queue_req *);
-extern void mmc_queue_bounce_pre(struct mmc_queue_req *);
-extern void mmc_queue_bounce_post(struct mmc_queue_req *);
 
 extern int mmc_access_rpmb(struct mmc_queue *);
 
diff --git a/drivers/mmc/host/Kconfig b/drivers/mmc/host/Kconfig
index 02179ed2a40d..8c15637178ff 100644
--- a/drivers/mmc/host/Kconfig
+++ b/drivers/mmc/host/Kconfig
@@ -5,7 +5,7 @@
 comment "MMC/SD/SDIO Host Controller Drivers"
 
 config MMC_DEBUG
-        bool "MMC host drivers debugginG"
+        bool "MMC host drivers debugging"
         depends on MMC != n
         help
           This is an option for use by developers; most people should
diff --git a/drivers/mmc/host/cavium-thunderx.c b/drivers/mmc/host/cavium-thunderx.c
index b9cc95998799..eee08d81b242 100644
--- a/drivers/mmc/host/cavium-thunderx.c
+++ b/drivers/mmc/host/cavium-thunderx.c
@@ -7,6 +7,7 @@
  *
  * Copyright (C) 2016 Cavium Inc.
  */
+#include <linux/device.h>
 #include <linux/dma-mapping.h>
 #include <linux/interrupt.h>
 #include <linux/mmc/mmc.h>
@@ -149,8 +150,11 @@ error:
         for (i = 0; i < CAVIUM_MAX_MMC; i++) {
                 if (host->slot[i])
                         cvm_mmc_of_slot_remove(host->slot[i]);
-                if (host->slot_pdev[i])
+                if (host->slot_pdev[i]) {
+                        get_device(&host->slot_pdev[i]->dev);
                         of_platform_device_destroy(&host->slot_pdev[i]->dev, NULL);
+                        put_device(&host->slot_pdev[i]->dev);
+                }
         }
         clk_disable_unprepare(host->clk);
         return ret;
diff --git a/drivers/mmc/host/cavium.c b/drivers/mmc/host/cavium.c
index 27fb625cbcf3..fbd29f00fca0 100644
--- a/drivers/mmc/host/cavium.c
+++ b/drivers/mmc/host/cavium.c
@@ -1038,7 +1038,7 @@ int cvm_mmc_of_slot_probe(struct device *dev, struct cvm_mmc_host *host)
          */
         mmc->caps |= MMC_CAP_MMC_HIGHSPEED | MMC_CAP_SD_HIGHSPEED |
                      MMC_CAP_ERASE | MMC_CAP_CMD23 | MMC_CAP_POWER_OFF_CARD |
-                     MMC_CAP_3_3V_DDR | MMC_CAP_NO_BOUNCE_BUFF;
+                     MMC_CAP_3_3V_DDR;
 
         if (host->use_sg)
                 mmc->max_segs = 16;
diff --git a/drivers/mmc/host/meson-gx-mmc.c b/drivers/mmc/host/meson-gx-mmc.c
index c885c2d4b904..85745ef179e2 100644
--- a/drivers/mmc/host/meson-gx-mmc.c
+++ b/drivers/mmc/host/meson-gx-mmc.c
@@ -531,8 +531,7 @@ static int meson_mmc_clk_init(struct meson_host *host)
         div->shift = __ffs(CLK_DIV_MASK);
         div->width = __builtin_popcountl(CLK_DIV_MASK);
         div->hw.init = &init;
-        div->flags = (CLK_DIVIDER_ONE_BASED |
-                      CLK_DIVIDER_ROUND_CLOSEST);
+        div->flags = CLK_DIVIDER_ONE_BASED;
 
         clk = devm_clk_register(host->dev, &div->hw);
         if (WARN_ON(IS_ERR(clk)))
@@ -717,6 +716,22 @@ static int meson_mmc_clk_phase_tuning(struct mmc_host *mmc, u32 opcode,
 static int meson_mmc_execute_tuning(struct mmc_host *mmc, u32 opcode)
 {
         struct meson_host *host = mmc_priv(mmc);
+        int ret;
+
+        /*
+         * If this is the initial tuning, try to get a sane Rx starting
+         * phase before doing the actual tuning.
+         */
+        if (!mmc->doing_retune) {
+                ret = meson_mmc_clk_phase_tuning(mmc, opcode, host->rx_clk);
+
+                if (ret)
+                        return ret;
+        }
+
+        ret = meson_mmc_clk_phase_tuning(mmc, opcode, host->tx_clk);
+        if (ret)
+                return ret;
 
         return meson_mmc_clk_phase_tuning(mmc, opcode, host->rx_clk);
 }
@@ -746,6 +761,11 @@ static void meson_mmc_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
         case MMC_POWER_UP:
                 if (!IS_ERR(mmc->supply.vmmc))
                         mmc_regulator_set_ocr(mmc, mmc->supply.vmmc, ios->vdd);
+
+                /* Reset phases */
+                clk_set_phase(host->rx_clk, 0);
+                clk_set_phase(host->tx_clk, 270);
+
                 break;
 
         case MMC_POWER_ON:
@@ -759,8 +779,6 @@ static void meson_mmc_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
                                 host->vqmmc_enabled = true;
                 }
 
-                /* Reset rx phase */
-                clk_set_phase(host->rx_clk, 0);
                 break;
         }
 
diff --git a/drivers/mmc/host/pxamci.c b/drivers/mmc/host/pxamci.c
index 59ab194cb009..c763b404510f 100644
--- a/drivers/mmc/host/pxamci.c
+++ b/drivers/mmc/host/pxamci.c
@@ -702,11 +702,7 @@ static int pxamci_probe(struct platform_device *pdev)
 
         pxamci_init_ocr(host);
 
-        /*
-         * This architecture used to disable bounce buffers through its
-         * defconfig, now it is done at runtime as a host property.
-         */
-        mmc->caps = MMC_CAP_NO_BOUNCE_BUFF;
+        mmc->caps = 0;
         host->cmdat = 0;
         if (!cpu_is_pxa25x()) {
                 mmc->caps |= MMC_CAP_4_BIT_DATA | MMC_CAP_SDIO_IRQ;
diff --git a/drivers/mmc/host/sdhci-pci-core.c b/drivers/mmc/host/sdhci-pci-core.c
index bbaddf18a1b3..d0ccc6729fd2 100644
--- a/drivers/mmc/host/sdhci-pci-core.c
+++ b/drivers/mmc/host/sdhci-pci-core.c
@@ -392,6 +392,7 @@ static const struct sdhci_pci_fixes sdhci_intel_pch_sdio = {
 
 enum {
         INTEL_DSM_FNS           =  0,
+        INTEL_DSM_V18_SWITCH    =  3,
         INTEL_DSM_DRV_STRENGTH  =  9,
         INTEL_DSM_D3_RETUNE     = 10,
 };
@@ -557,6 +558,19 @@ static void intel_hs400_enhanced_strobe(struct mmc_host *mmc,
         sdhci_writel(host, val, INTEL_HS400_ES_REG);
 }
 
+static void sdhci_intel_voltage_switch(struct sdhci_host *host)
+{
+        struct sdhci_pci_slot *slot = sdhci_priv(host);
+        struct intel_host *intel_host = sdhci_pci_priv(slot);
+        struct device *dev = &slot->chip->pdev->dev;
+        u32 result = 0;
+        int err;
+
+        err = intel_dsm(intel_host, dev, INTEL_DSM_V18_SWITCH, &result);
+        pr_debug("%s: %s DSM error %d result %u\n",
+                 mmc_hostname(host->mmc), __func__, err, result);
+}
+
 static const struct sdhci_ops sdhci_intel_byt_ops = {
         .set_clock              = sdhci_set_clock,
         .set_power              = sdhci_intel_set_power,
@@ -565,6 +579,7 @@ static const struct sdhci_ops sdhci_intel_byt_ops = {
         .reset                  = sdhci_reset,
         .set_uhs_signaling      = sdhci_set_uhs_signaling,
         .hw_reset               = sdhci_pci_hw_reset,
+        .voltage_switch         = sdhci_intel_voltage_switch,
 };
 
 static void byt_read_dsm(struct sdhci_pci_slot *slot)
diff --git a/drivers/mmc/host/sdhci-xenon.c b/drivers/mmc/host/sdhci-xenon.c
index 2eec2e652c53..0842bbc2d7ad 100644
--- a/drivers/mmc/host/sdhci-xenon.c
+++ b/drivers/mmc/host/sdhci-xenon.c
@@ -466,6 +466,7 @@ static int xenon_probe(struct platform_device *pdev)
 {
         struct sdhci_pltfm_host *pltfm_host;
         struct sdhci_host *host;
+        struct xenon_priv *priv;
         int err;
 
         host = sdhci_pltfm_init(pdev, &sdhci_xenon_pdata,
@@ -474,6 +475,7 @@ static int xenon_probe(struct platform_device *pdev)
                 return PTR_ERR(host);
 
         pltfm_host = sdhci_priv(host);
+        priv = sdhci_pltfm_priv(pltfm_host);
 
         /*
          * Link Xenon specific mmc_host_ops function,
@@ -491,9 +493,20 @@ static int xenon_probe(struct platform_device *pdev)
         if (err)
                 goto free_pltfm;
 
+        priv->axi_clk = devm_clk_get(&pdev->dev, "axi");
+        if (IS_ERR(priv->axi_clk)) {
+                err = PTR_ERR(priv->axi_clk);
+                if (err == -EPROBE_DEFER)
+                        goto err_clk;
+        } else {
+                err = clk_prepare_enable(priv->axi_clk);
+                if (err)
+                        goto err_clk;
+        }
+
         err = mmc_of_parse(host->mmc);
         if (err)
-                goto err_clk;
+                goto err_clk_axi;
 
         sdhci_get_of_property(pdev);
 
@@ -502,11 +515,11 @@ static int xenon_probe(struct platform_device *pdev)
         /* Xenon specific dt parse */
         err = xenon_probe_dt(pdev);
         if (err)
-                goto err_clk;
+                goto err_clk_axi;
 
         err = xenon_sdhc_prepare(host);
         if (err)
-                goto err_clk;
+                goto err_clk_axi;
 
         pm_runtime_get_noresume(&pdev->dev);
         pm_runtime_set_active(&pdev->dev);
@@ -527,6 +540,8 @@ remove_sdhc:
         pm_runtime_disable(&pdev->dev);
         pm_runtime_put_noidle(&pdev->dev);
         xenon_sdhc_unprepare(host);
+err_clk_axi:
+        clk_disable_unprepare(priv->axi_clk);
 err_clk:
         clk_disable_unprepare(pltfm_host->clk);
 free_pltfm:
@@ -538,6 +553,7 @@ static int xenon_remove(struct platform_device *pdev)
 {
         struct sdhci_host *host = platform_get_drvdata(pdev);
         struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
+        struct xenon_priv *priv = sdhci_pltfm_priv(pltfm_host);
 
         pm_runtime_get_sync(&pdev->dev);
         pm_runtime_disable(&pdev->dev);
@@ -546,7 +562,7 @@ static int xenon_remove(struct platform_device *pdev)
         sdhci_remove_host(host, 0);
 
         xenon_sdhc_unprepare(host);
-
+        clk_disable_unprepare(priv->axi_clk);
         clk_disable_unprepare(pltfm_host->clk);
 
         sdhci_pltfm_free(pdev);
diff --git a/drivers/mmc/host/sdhci-xenon.h b/drivers/mmc/host/sdhci-xenon.h
index 2bc0510c0769..9994995c7c56 100644
--- a/drivers/mmc/host/sdhci-xenon.h
+++ b/drivers/mmc/host/sdhci-xenon.h
@@ -83,6 +83,7 @@ struct xenon_priv {
         unsigned char   bus_width;
         unsigned char   timing;
         unsigned int    clock;
+        struct clk      *axi_clk;
 
         int             phy_type;
         /*
diff --git a/drivers/mmc/host/tmio_mmc_core.c b/drivers/mmc/host/tmio_mmc_core.c
index 12cf8288d663..a7293e186e03 100644
--- a/drivers/mmc/host/tmio_mmc_core.c
+++ b/drivers/mmc/host/tmio_mmc_core.c
@@ -129,50 +129,6 @@ static int tmio_mmc_next_sg(struct tmio_mmc_host *host)
 
 #define CMDREQ_TIMEOUT  5000
 
-#ifdef CONFIG_MMC_DEBUG
-
-#define STATUS_TO_TEXT(a, status, i) \
-        do { \
-                if ((status) & TMIO_STAT_##a) { \
-                        if ((i)++) \
-                                printk(KERN_DEBUG " | "); \
-                        printk(KERN_DEBUG #a); \
-                } \
-        } while (0)
-
-static void pr_debug_status(u32 status)
-{
-        int i = 0;
-
-        pr_debug("status: %08x = ", status);
-        STATUS_TO_TEXT(CARD_REMOVE, status, i);
-        STATUS_TO_TEXT(CARD_INSERT, status, i);
-        STATUS_TO_TEXT(SIGSTATE, status, i);
-        STATUS_TO_TEXT(WRPROTECT, status, i);
-        STATUS_TO_TEXT(CARD_REMOVE_A, status, i);
-        STATUS_TO_TEXT(CARD_INSERT_A, status, i);
-        STATUS_TO_TEXT(SIGSTATE_A, status, i);
-        STATUS_TO_TEXT(CMD_IDX_ERR, status, i);
-        STATUS_TO_TEXT(STOPBIT_ERR, status, i);
-        STATUS_TO_TEXT(ILL_FUNC, status, i);
-        STATUS_TO_TEXT(CMD_BUSY, status, i);
-        STATUS_TO_TEXT(CMDRESPEND, status, i);
-        STATUS_TO_TEXT(DATAEND, status, i);
-        STATUS_TO_TEXT(CRCFAIL, status, i);
-        STATUS_TO_TEXT(DATATIMEOUT, status, i);
-        STATUS_TO_TEXT(CMDTIMEOUT, status, i);
-        STATUS_TO_TEXT(RXOVERFLOW, status, i);
-        STATUS_TO_TEXT(TXUNDERRUN, status, i);
-        STATUS_TO_TEXT(RXRDY, status, i);
-        STATUS_TO_TEXT(TXRQ, status, i);
-        STATUS_TO_TEXT(ILL_ACCESS, status, i);
-        printk("\n");
-}
-
-#else
-#define pr_debug_status(s)  do { } while (0)
-#endif
-
 static void tmio_mmc_enable_sdio_irq(struct mmc_host *mmc, int enable)
 {
         struct tmio_mmc_host *host = mmc_priv(mmc);
@@ -762,9 +718,6 @@ irqreturn_t tmio_mmc_irq(int irq, void *devid)
         status = sd_ctrl_read16_and_16_as_32(host, CTL_STATUS);
         ireg = status & TMIO_MASK_IRQ & ~host->sdcard_irq_mask;
 
-        pr_debug_status(status);
-        pr_debug_status(ireg);
-
         /* Clear the status except the interrupt status */
         sd_ctrl_write32_as_16_and_16(host, CTL_STATUS, TMIO_MASK_IRQ);
 
diff --git a/drivers/mtd/mtdpart.c b/drivers/mtd/mtdpart.c
index 5736b0c90b33..a308e707392d 100644
--- a/drivers/mtd/mtdpart.c
+++ b/drivers/mtd/mtdpart.c
@@ -581,6 +581,14 @@ static struct mtd_part *allocate_partition(struct mtd_info *parent,
                 slave->mtd.erasesize = parent->erasesize;
         }
 
+        /*
+         * Slave erasesize might differ from the master one if the master
+         * exposes several regions with different erasesize. Adjust
+         * wr_alignment accordingly.
+         */
+        if (!(slave->mtd.flags & MTD_NO_ERASE))
+                wr_alignment = slave->mtd.erasesize;
+
         tmp = slave->offset;
         remainder = do_div(tmp, wr_alignment);
         if ((slave->mtd.flags & MTD_WRITEABLE) && remainder) {
diff --git a/drivers/mtd/nand/atmel/pmecc.c b/drivers/mtd/nand/atmel/pmecc.c
index 146af8218314..8268636675ef 100644
--- a/drivers/mtd/nand/atmel/pmecc.c
+++ b/drivers/mtd/nand/atmel/pmecc.c
@@ -363,7 +363,7 @@ atmel_pmecc_create_user(struct atmel_pmecc *pmecc,
         size += (req->ecc.strength + 1) * sizeof(u16);
         /* Reserve space for mu, dmu and delta. */
         size = ALIGN(size, sizeof(s32));
-        size += (req->ecc.strength + 1) * sizeof(s32);
+        size += (req->ecc.strength + 1) * sizeof(s32) * 3;
 
         user = kzalloc(size, GFP_KERNEL);
         if (!user)
diff --git a/drivers/mtd/nand/lpc32xx_mlc.c b/drivers/mtd/nand/lpc32xx_mlc.c
index c3bb358ef01e..5796468db653 100644
--- a/drivers/mtd/nand/lpc32xx_mlc.c
+++ b/drivers/mtd/nand/lpc32xx_mlc.c
@@ -707,7 +707,7 @@ static int lpc32xx_nand_probe(struct platform_device *pdev)
         }
         res = clk_prepare_enable(host->clk);
         if (res)
-                goto err_exit1;
+                goto err_put_clk;
 
         nand_chip->cmd_ctrl = lpc32xx_nand_cmd_ctrl;
         nand_chip->dev_ready = lpc32xx_nand_device_ready;
@@ -814,6 +814,7 @@ err_exit3:
                 dma_release_channel(host->dma_chan);
 err_exit2:
         clk_disable_unprepare(host->clk);
+err_put_clk:
         clk_put(host->clk);
 err_exit1:
         lpc32xx_wp_enable(host);
diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c
index bcc8cef1c615..12edaae17d81 100644
--- a/drivers/mtd/nand/nand_base.c
+++ b/drivers/mtd/nand/nand_base.c
@@ -2668,7 +2668,7 @@ static uint8_t *nand_fill_oob(struct mtd_info *mtd, uint8_t *oob, size_t len,
 static int nand_do_write_ops(struct mtd_info *mtd, loff_t to,
                              struct mtd_oob_ops *ops)
 {
-        int chipnr, realpage, page, blockmask, column;
+        int chipnr, realpage, page, column;
         struct nand_chip *chip = mtd_to_nand(mtd);
         uint32_t writelen = ops->len;
 
@@ -2704,7 +2704,6 @@ static int nand_do_write_ops(struct mtd_info *mtd, loff_t to,
 
         realpage = (int)(to >> chip->page_shift);
         page = realpage & chip->pagemask;
-        blockmask = (1 << (chip->phys_erase_shift - chip->page_shift)) - 1;
 
         /* Invalidate the page cache, when we write to the cached page */
         if (to <= ((loff_t)chip->pagebuf << chip->page_shift) &&
diff --git a/drivers/mtd/spi-nor/spi-nor.c b/drivers/mtd/spi-nor/spi-nor.c
index cf1d4a15e10a..19c000722cbc 100644
--- a/drivers/mtd/spi-nor/spi-nor.c
+++ b/drivers/mtd/spi-nor/spi-nor.c
@@ -1784,7 +1784,7 @@ spi_nor_set_pp_settings(struct spi_nor_pp_command *pp,
  * @nor:        pointer to a 'struct spi_nor'
  * @addr:       offset in the SFDP area to start reading data from
  * @len:        number of bytes to read
- * @buf:        buffer where the SFDP data are copied into
+ * @buf:        buffer where the SFDP data are copied into (dma-safe memory)
  *
  * Whatever the actual numbers of bytes for address and dummy cycles are
  * for (Fast) Read commands, the Read SFDP (5Ah) instruction is always
@@ -1829,6 +1829,36 @@ read_err:
         return ret;
 }
 
+/**
+ * spi_nor_read_sfdp_dma_unsafe() - read Serial Flash Discoverable Parameters.
+ * @nor:        pointer to a 'struct spi_nor'
+ * @addr:       offset in the SFDP area to start reading data from
+ * @len:        number of bytes to read
+ * @buf:        buffer where the SFDP data are copied into
+ *
+ * Wrap spi_nor_read_sfdp() using a kmalloc'ed bounce buffer as @buf is now not
+ * guaranteed to be dma-safe.
+ *
+ * Return: -ENOMEM if kmalloc() fails, the return code of spi_nor_read_sfdp()
+ *          otherwise.
+ */
+static int spi_nor_read_sfdp_dma_unsafe(struct spi_nor *nor, u32 addr,
+                                        size_t len, void *buf)
+{
+        void *dma_safe_buf;
+        int ret;
+
+        dma_safe_buf = kmalloc(len, GFP_KERNEL);
+        if (!dma_safe_buf)
+                return -ENOMEM;
+
+        ret = spi_nor_read_sfdp(nor, addr, len, dma_safe_buf);
+        memcpy(buf, dma_safe_buf, len);
+        kfree(dma_safe_buf);
+
+        return ret;
+}
+
 struct sfdp_parameter_header {
         u8              id_lsb;
         u8              minor;
@@ -2101,7 +2131,7 @@ static int spi_nor_parse_bfpt(struct spi_nor *nor,
                     bfpt_header->length * sizeof(u32));
         addr = SFDP_PARAM_HEADER_PTP(bfpt_header);
         memset(&bfpt, 0, sizeof(bfpt));
-        err = spi_nor_read_sfdp(nor,  addr, len, &bfpt);
+        err = spi_nor_read_sfdp_dma_unsafe(nor,  addr, len, &bfpt);
         if (err < 0)
                 return err;
 
@@ -2127,6 +2157,15 @@ static int spi_nor_parse_bfpt(struct spi_nor *nor,
         params->size = bfpt.dwords[BFPT_DWORD(2)];
         if (params->size & BIT(31)) {
                 params->size &= ~BIT(31);
+
+                /*
+                 * Prevent overflows on params->size. Anyway, a NOR of 2^64
+                 * bits is unlikely to exist so this error probably means
+                 * the BFPT we are reading is corrupted/wrong.
+                 */
+                if (params->size > 63)
+                        return -EINVAL;
+
                 params->size = 1ULL << params->size;
         } else {
                 params->size++;
@@ -2243,7 +2282,7 @@ static int spi_nor_parse_sfdp(struct spi_nor *nor,
         int i, err;
 
         /* Get the SFDP header. */
-        err = spi_nor_read_sfdp(nor, 0, sizeof(header), &header);
+        err = spi_nor_read_sfdp_dma_unsafe(nor, 0, sizeof(header), &header);
         if (err < 0)
                 return err;
 
diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
index c6678aa9b4ef..d74c7335c512 100644
--- a/drivers/net/dsa/mv88e6xxx/chip.c
+++ b/drivers/net/dsa/mv88e6xxx/chip.c
@@ -1100,6 +1100,10 @@ static int mv88e6xxx_port_check_hw_vlan(struct dsa_switch *ds, int port,
         };
         int i, err;
 
+        /* DSA and CPU ports have to be members of multiple vlans */
+        if (dsa_is_dsa_port(ds, port) || dsa_is_cpu_port(ds, port))
+                return 0;
+
         if (!vid_begin)
                 return -EOPNOTSUPP;
 
@@ -3947,7 +3951,9 @@ static void mv88e6xxx_remove(struct mdio_device *mdiodev)
         if (chip->irq > 0) {
                 if (chip->info->g2_irqs > 0)
                         mv88e6xxx_g2_irq_free(chip);
+                mutex_lock(&chip->reg_lock);
                 mv88e6xxx_g1_irq_free(chip);
+                mutex_unlock(&chip->reg_lock);
         }
 }
 
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h b/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h
index 214986436ece..0fdaaa643073 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h
@@ -51,6 +51,10 @@
 
 #define AQ_CFG_SKB_FRAGS_MAX   32U
 
+/* Number of descriptors available in one ring to resume this ring queue
+ */
+#define AQ_CFG_RESTART_DESC_THRES   (AQ_CFG_SKB_FRAGS_MAX * 2)
+
 #define AQ_CFG_NAPI_WEIGHT     64U
 
 #define AQ_CFG_MULTICAST_ADDRESS_MAX     32U
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
index 6ac9e2602d6d..0a5bb4114eb4 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
@@ -119,6 +119,35 @@ int aq_nic_cfg_start(struct aq_nic_s *self)
         return 0;
 }
 
+static int aq_nic_update_link_status(struct aq_nic_s *self)
+{
+        int err = self->aq_hw_ops.hw_get_link_status(self->aq_hw);
+
+        if (err)
+                return err;
+
+        if (self->link_status.mbps != self->aq_hw->aq_link_status.mbps)
+                pr_info("%s: link change old %d new %d\n",
+                        AQ_CFG_DRV_NAME, self->link_status.mbps,
+                        self->aq_hw->aq_link_status.mbps);
+
+        self->link_status = self->aq_hw->aq_link_status;
+        if (!netif_carrier_ok(self->ndev) && self->link_status.mbps) {
+                aq_utils_obj_set(&self->header.flags,
+                                 AQ_NIC_FLAG_STARTED);
+                aq_utils_obj_clear(&self->header.flags,
+                                   AQ_NIC_LINK_DOWN);
+                netif_carrier_on(self->ndev);
+                netif_tx_wake_all_queues(self->ndev);
+        }
+        if (netif_carrier_ok(self->ndev) && !self->link_status.mbps) {
+                netif_carrier_off(self->ndev);
+                netif_tx_disable(self->ndev);
+                aq_utils_obj_set(&self->header.flags, AQ_NIC_LINK_DOWN);
+        }
+        return 0;
+}
+
 static void aq_nic_service_timer_cb(unsigned long param)
 {
         struct aq_nic_s *self = (struct aq_nic_s *)param;
@@ -131,26 +160,13 @@ static void aq_nic_service_timer_cb(unsigned long param)
         if (aq_utils_obj_test(&self->header.flags, AQ_NIC_FLAGS_IS_NOT_READY))
                 goto err_exit;
 
-        err = self->aq_hw_ops.hw_get_link_status(self->aq_hw);
-        if (err < 0)
+        err = aq_nic_update_link_status(self);
+        if (err)
                 goto err_exit;
 
-        self->link_status = self->aq_hw->aq_link_status;
-
         self->aq_hw_ops.hw_interrupt_moderation_set(self->aq_hw,
                     self->aq_nic_cfg.is_interrupt_moderation);
 
-        if (self->link_status.mbps) {
-                aq_utils_obj_set(&self->header.flags,
-                                 AQ_NIC_FLAG_STARTED);
-                aq_utils_obj_clear(&self->header.flags,
-                                   AQ_NIC_LINK_DOWN);
-                netif_carrier_on(self->ndev);
-        } else {
-                netif_carrier_off(self->ndev);
-                aq_utils_obj_set(&self->header.flags, AQ_NIC_LINK_DOWN);
-        }
-
         memset(&stats_rx, 0U, sizeof(struct aq_ring_stats_rx_s));
         memset(&stats_tx, 0U, sizeof(struct aq_ring_stats_tx_s));
         for (i = AQ_DIMOF(self->aq_vec); i--;) {
@@ -214,7 +230,6 @@ struct aq_nic_s *aq_nic_alloc_cold(const struct net_device_ops *ndev_ops,
         SET_NETDEV_DEV(ndev, dev);
 
         ndev->if_port = port;
-        ndev->min_mtu = ETH_MIN_MTU;
         self->ndev = ndev;
 
         self->aq_pci_func = aq_pci_func;
@@ -241,7 +256,6 @@ err_exit:
 int aq_nic_ndev_register(struct aq_nic_s *self)
 {
         int err = 0;
-        unsigned int i = 0U;
 
         if (!self->ndev) {
                 err = -EINVAL;
@@ -263,8 +277,7 @@ int aq_nic_ndev_register(struct aq_nic_s *self)
 
         netif_carrier_off(self->ndev);
 
-        for (i = AQ_CFG_VECS_MAX; i--;)
-                aq_nic_ndev_queue_stop(self, i);
+        netif_tx_disable(self->ndev);
 
         err = register_netdev(self->ndev);
         if (err < 0)
@@ -283,6 +296,7 @@ int aq_nic_ndev_init(struct aq_nic_s *self)
         self->ndev->features = aq_hw_caps->hw_features;
         self->ndev->priv_flags = aq_hw_caps->hw_priv_flags;
         self->ndev->mtu = aq_nic_cfg->mtu - ETH_HLEN;
+        self->ndev->max_mtu = self->aq_hw_caps.mtu - ETH_FCS_LEN - ETH_HLEN;
 
         return 0;
 }
@@ -318,12 +332,8 @@ struct aq_nic_s *aq_nic_alloc_hot(struct net_device *ndev)
                 err = -EINVAL;
                 goto err_exit;
         }
-        if (netif_running(ndev)) {
-                unsigned int i;
-
-                for (i = AQ_CFG_VECS_MAX; i--;)
-                        netif_stop_subqueue(ndev, i);
-        }
+        if (netif_running(ndev))
+                netif_tx_disable(ndev);
 
         for (self->aq_vecs = 0; self->aq_vecs < self->aq_nic_cfg.vecs;
                 self->aq_vecs++) {
@@ -383,16 +393,6 @@ err_exit:
         return err;
 }
 
-void aq_nic_ndev_queue_start(struct aq_nic_s *self, unsigned int idx)
-{
-        netif_start_subqueue(self->ndev, idx);
-}
-
-void aq_nic_ndev_queue_stop(struct aq_nic_s *self, unsigned int idx)
-{
-        netif_stop_subqueue(self->ndev, idx);
-}
-
 int aq_nic_start(struct aq_nic_s *self)
 {
         struct aq_vec_s *aq_vec = NULL;
@@ -451,10 +451,6 @@ int aq_nic_start(struct aq_nic_s *self)
                         goto err_exit;
         }
 
-        for (i = 0U, aq_vec = self->aq_vec[0];
-                self->aq_vecs > i; ++i, aq_vec = self->aq_vec[i])
-                aq_nic_ndev_queue_start(self, i);
-
         err = netif_set_real_num_tx_queues(self->ndev, self->aq_vecs);
         if (err < 0)
                 goto err_exit;
@@ -463,6 +459,8 @@ int aq_nic_start(struct aq_nic_s *self)
         if (err < 0)
                 goto err_exit;
 
+        netif_tx_start_all_queues(self->ndev);
+
 err_exit:
         return err;
 }
@@ -475,6 +473,7 @@ static unsigned int aq_nic_map_skb(struct aq_nic_s *self,
         unsigned int nr_frags = skb_shinfo(skb)->nr_frags;
         unsigned int frag_count = 0U;
         unsigned int dx = ring->sw_tail;
+        struct aq_ring_buff_s *first = NULL;
         struct aq_ring_buff_s *dx_buff = &ring->buff_ring[dx];
 
         if (unlikely(skb_is_gso(skb))) {
@@ -485,6 +484,7 @@ static unsigned int aq_nic_map_skb(struct aq_nic_s *self,
                 dx_buff->len_l4 = tcp_hdrlen(skb);
                 dx_buff->mss = skb_shinfo(skb)->gso_size;
                 dx_buff->is_txc = 1U;
+                dx_buff->eop_index = 0xffffU;
 
                 dx_buff->is_ipv6 =
                         (ip_hdr(skb)->version == 6) ? 1U : 0U;
@@ -504,6 +504,7 @@ static unsigned int aq_nic_map_skb(struct aq_nic_s *self,
         if (unlikely(dma_mapping_error(aq_nic_get_dev(self), dx_buff->pa)))
                 goto exit;
 
+        first = dx_buff;
         dx_buff->len_pkt = skb->len;
         dx_buff->is_sop = 1U;
         dx_buff->is_mapped = 1U;
@@ -532,40 +533,46 @@ static unsigned int aq_nic_map_skb(struct aq_nic_s *self,
 
         for (; nr_frags--; ++frag_count) {
                 unsigned int frag_len = 0U;
+                unsigned int buff_offset = 0U;
+                unsigned int buff_size = 0U;
                 dma_addr_t frag_pa;
                 skb_frag_t *frag = &skb_shinfo(skb)->frags[frag_count];
 
                 frag_len = skb_frag_size(frag);
-                frag_pa = skb_frag_dma_map(aq_nic_get_dev(self), frag, 0,
-                                           frag_len, DMA_TO_DEVICE);
 
-                if (unlikely(dma_mapping_error(aq_nic_get_dev(self), frag_pa)))
-                        goto mapping_error;
+                while (frag_len) {
+                        if (frag_len > AQ_CFG_TX_FRAME_MAX)
+                                buff_size = AQ_CFG_TX_FRAME_MAX;
+                        else
+                                buff_size = frag_len;
+
+                        frag_pa = skb_frag_dma_map(aq_nic_get_dev(self),
+                                                   frag,
+                                                   buff_offset,
+                                                   buff_size,
+                                                   DMA_TO_DEVICE);
+
+                        if (unlikely(dma_mapping_error(aq_nic_get_dev(self),
+                                                       frag_pa)))
+                                goto mapping_error;
 
-                while (frag_len > AQ_CFG_TX_FRAME_MAX) {
                         dx = aq_ring_next_dx(ring, dx);
                         dx_buff = &ring->buff_ring[dx];
 
                         dx_buff->flags = 0U;
-                        dx_buff->len = AQ_CFG_TX_FRAME_MAX;
+                        dx_buff->len = buff_size;
                         dx_buff->pa = frag_pa;
                         dx_buff->is_mapped = 1U;
+                        dx_buff->eop_index = 0xffffU;
+
+                        frag_len -= buff_size;
+                        buff_offset += buff_size;
 
-                        frag_len -= AQ_CFG_TX_FRAME_MAX;
-                        frag_pa += AQ_CFG_TX_FRAME_MAX;
                         ++ret;
                 }
-
-                dx = aq_ring_next_dx(ring, dx);
-                dx_buff = &ring->buff_ring[dx];
-
-                dx_buff->flags = 0U;
-                dx_buff->len = frag_len;
-                dx_buff->pa = frag_pa;
-                dx_buff->is_mapped = 1U;
-                ++ret;
         }
 
+        first->eop_index = dx;
         dx_buff->is_eop = 1U;
         dx_buff->skb = skb;
         goto exit;
@@ -602,7 +609,6 @@ int aq_nic_xmit(struct aq_nic_s *self, struct sk_buff *skb)
         unsigned int vec = skb->queue_mapping % self->aq_nic_cfg.vecs;
         unsigned int tc = 0U;
         int err = NETDEV_TX_OK;
-        bool is_nic_in_bad_state;
 
         frags = skb_shinfo(skb)->nr_frags + 1;
 
@@ -613,13 +619,10 @@ int aq_nic_xmit(struct aq_nic_s *self, struct sk_buff *skb)
                 goto err_exit;
         }
 
-        is_nic_in_bad_state = aq_utils_obj_test(&self->header.flags,
-                                                AQ_NIC_FLAGS_IS_NOT_TX_READY) ||
-                                                (aq_ring_avail_dx(ring) <
-                                                AQ_CFG_SKB_FRAGS_MAX);
+        aq_ring_update_queue_state(ring);
 
-        if (is_nic_in_bad_state) {
-                aq_nic_ndev_queue_stop(self, ring->idx);
+        /* Above status update may stop the queue. Check this. */
+        if (__netif_subqueue_stopped(self->ndev, ring->idx)) {
                 err = NETDEV_TX_BUSY;
                 goto err_exit;
         }
@@ -631,9 +634,6 @@ int aq_nic_xmit(struct aq_nic_s *self, struct sk_buff *skb)
                                                       ring,
                                                       frags);
                 if (err >= 0) {
-                        if (aq_ring_avail_dx(ring) < AQ_CFG_SKB_FRAGS_MAX + 1)
-                                aq_nic_ndev_queue_stop(self, ring->idx);
-
                         ++ring->stats.tx.packets;
                         ring->stats.tx.bytes += skb->len;
                 }
@@ -693,16 +693,9 @@ int aq_nic_set_multicast_list(struct aq_nic_s *self, struct net_device *ndev)
 
 int aq_nic_set_mtu(struct aq_nic_s *self, int new_mtu)
 {
-        int err = 0;
-
-        if (new_mtu > self->aq_hw_caps.mtu) {
-                err = -EINVAL;
-                goto err_exit;
-        }
         self->aq_nic_cfg.mtu = new_mtu;
 
-err_exit:
-        return err;
+        return 0;
 }
 
 int aq_nic_set_mac(struct aq_nic_s *self, struct net_device *ndev)
@@ -905,9 +898,7 @@ int aq_nic_stop(struct aq_nic_s *self)
         struct aq_vec_s *aq_vec = NULL;
         unsigned int i = 0U;
 
-        for (i = 0U, aq_vec = self->aq_vec[0];
-                self->aq_vecs > i; ++i, aq_vec = self->aq_vec[i])
-                aq_nic_ndev_queue_stop(self, i);
+        netif_tx_disable(self->ndev);
 
         del_timer_sync(&self->service_timer);
 
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_nic.h b/drivers/net/ethernet/aquantia/atlantic/aq_nic.h
index 7fc2a5ecb2b7..0ddd556ff901 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.h
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.h
@@ -83,8 +83,6 @@ struct net_device *aq_nic_get_ndev(struct aq_nic_s *self);
 int aq_nic_init(struct aq_nic_s *self);
 int aq_nic_cfg_start(struct aq_nic_s *self);
 int aq_nic_ndev_register(struct aq_nic_s *self);
-void aq_nic_ndev_queue_start(struct aq_nic_s *self, unsigned int idx);
-void aq_nic_ndev_queue_stop(struct aq_nic_s *self, unsigned int idx);
 void aq_nic_ndev_free(struct aq_nic_s *self);
 int aq_nic_start(struct aq_nic_s *self);
 int aq_nic_xmit(struct aq_nic_s *self, struct sk_buff *skb);
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
index 4eee1996a825..0654e0c76bc2 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
@@ -104,6 +104,38 @@ int aq_ring_init(struct aq_ring_s *self)
         return 0;
 }
 
+static inline bool aq_ring_dx_in_range(unsigned int h, unsigned int i,
+                                       unsigned int t)
+{
+        return (h < t) ? ((h < i) && (i < t)) : ((h < i) || (i < t));
+}
+
+void aq_ring_update_queue_state(struct aq_ring_s *ring)
+{
+        if (aq_ring_avail_dx(ring) <= AQ_CFG_SKB_FRAGS_MAX)
+                aq_ring_queue_stop(ring);
+        else if (aq_ring_avail_dx(ring) > AQ_CFG_RESTART_DESC_THRES)
+                aq_ring_queue_wake(ring);
+}
+
+void aq_ring_queue_wake(struct aq_ring_s *ring)
+{
+        struct net_device *ndev = aq_nic_get_ndev(ring->aq_nic);
+
+        if (__netif_subqueue_stopped(ndev, ring->idx)) {
+                netif_wake_subqueue(ndev, ring->idx);
+                ring->stats.tx.queue_restarts++;
+        }
+}
+
+void aq_ring_queue_stop(struct aq_ring_s *ring)
+{
+        struct net_device *ndev = aq_nic_get_ndev(ring->aq_nic);
+
+        if (!__netif_subqueue_stopped(ndev, ring->idx))
+                netif_stop_subqueue(ndev, ring->idx);
+}
+
 void aq_ring_tx_clean(struct aq_ring_s *self)
 {
         struct device *dev = aq_nic_get_dev(self->aq_nic);
@@ -113,23 +145,28 @@ void aq_ring_tx_clean(struct aq_ring_s *self)
                 struct aq_ring_buff_s *buff = &self->buff_ring[self->sw_head];
 
                 if (likely(buff->is_mapped)) {
-                        if (unlikely(buff->is_sop))
+                        if (unlikely(buff->is_sop)) {
+                                if (!buff->is_eop &&
+                                    buff->eop_index != 0xffffU &&
+                                    (!aq_ring_dx_in_range(self->sw_head,
+                                                buff->eop_index,
+                                                self->hw_head)))
+                                        break;
+
                                 dma_unmap_single(dev, buff->pa, buff->len,
                                                  DMA_TO_DEVICE);
-                        else
+                        } else {
                                 dma_unmap_page(dev, buff->pa, buff->len,
                                                DMA_TO_DEVICE);
+                        }
                 }
 
                 if (unlikely(buff->is_eop))
                         dev_kfree_skb_any(buff->skb);
-        }
-}
 
-static inline unsigned int aq_ring_dx_in_range(unsigned int h, unsigned int i,
-                                               unsigned int t)
-{
-        return (h < t) ? ((h < i) && (i < t)) : ((h < i) || (i < t));
+                buff->pa = 0U;
+                buff->eop_index = 0xffffU;
+        }
 }
 
 #define AQ_SKB_ALIGN SKB_DATA_ALIGN(sizeof(struct skb_shared_info))
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ring.h b/drivers/net/ethernet/aquantia/atlantic/aq_ring.h
index 782176c5f4f8..5844078764bd 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_ring.h
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_ring.h
@@ -65,7 +65,7 @@ struct __packed aq_ring_buff_s {
         };
         union {
                 struct {
-                        u32 len:16;
+                        u16 len;
                         u32 is_ip_cso:1;
                         u32 is_udp_cso:1;
                         u32 is_tcp_cso:1;
@@ -77,8 +77,10 @@ struct __packed aq_ring_buff_s {
                         u32 is_cleaned:1;
                         u32 is_error:1;
                         u32 rsvd3:6;
+                        u16 eop_index;
+                        u16 rsvd4;
                 };
-                u32 flags;
+                u64 flags;
         };
 };
 
@@ -94,6 +96,7 @@ struct aq_ring_stats_tx_s {
         u64 errors;
         u64 packets;
         u64 bytes;
+        u64 queue_restarts;
 };
 
 union aq_ring_stats_s {
@@ -147,6 +150,9 @@ struct aq_ring_s *aq_ring_rx_alloc(struct aq_ring_s *self,
 int aq_ring_init(struct aq_ring_s *self);
 void aq_ring_rx_deinit(struct aq_ring_s *self);
 void aq_ring_free(struct aq_ring_s *self);
+void aq_ring_update_queue_state(struct aq_ring_s *ring);
+void aq_ring_queue_wake(struct aq_ring_s *ring);
+void aq_ring_queue_stop(struct aq_ring_s *ring);
 void aq_ring_tx_clean(struct aq_ring_s *self);
 int aq_ring_rx_clean(struct aq_ring_s *self,
                      struct napi_struct *napi,
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_vec.c b/drivers/net/ethernet/aquantia/atlantic/aq_vec.c
index ebf588004c46..305ff8ffac2c 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_vec.c
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_vec.c
@@ -59,12 +59,7 @@ static int aq_vec_poll(struct napi_struct *napi, int budget)
                         if (ring[AQ_VEC_TX_ID].sw_head !=
                             ring[AQ_VEC_TX_ID].hw_head) {
                                 aq_ring_tx_clean(&ring[AQ_VEC_TX_ID]);
-
-                                if (aq_ring_avail_dx(&ring[AQ_VEC_TX_ID]) >
-                                    AQ_CFG_SKB_FRAGS_MAX) {
-                                        aq_nic_ndev_queue_start(self->aq_nic,
-                                                ring[AQ_VEC_TX_ID].idx);
-                                }
+                                aq_ring_update_queue_state(&ring[AQ_VEC_TX_ID]);
                                 was_tx_cleaned = true;
                         }
 
@@ -364,6 +359,7 @@ void aq_vec_add_stats(struct aq_vec_s *self,
                 stats_tx->packets += tx->packets;
                 stats_tx->bytes += tx->bytes;
                 stats_tx->errors += tx->errors;
+                stats_tx->queue_restarts += tx->queue_restarts;
         }
 }
 
diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0_internal.h b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0_internal.h
index f3957e930340..fcf89e25a773 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0_internal.h
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0_internal.h
@@ -16,7 +16,7 @@
 
 #include "../aq_common.h"
 
-#define HW_ATL_B0_MTU_JUMBO (16000U)
+#define HW_ATL_B0_MTU_JUMBO  16352U
 #define HW_ATL_B0_MTU        1514U
 
 #define HW_ATL_B0_TX_RINGS 4U
diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c
index 4f5ec9a0fbfb..bf734b32e44b 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c
@@ -351,8 +351,7 @@ int hw_atl_utils_mpi_get_link_status(struct aq_hw_s *self)
                         break;
 
                 default:
-                        link_status->mbps = 0U;
-                        break;
+                        return -EBUSY;
                 }
         }
 
diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
index c3c53f6cd9e6..83eec9a8c275 100644
--- a/drivers/net/ethernet/broadcom/bcmsysport.c
+++ b/drivers/net/ethernet/broadcom/bcmsysport.c
@@ -432,6 +432,27 @@ static void bcm_sysport_update_mib_counters(struct bcm_sysport_priv *priv)
         netif_dbg(priv, hw, priv->netdev, "updated MIB counters\n");
 }
 
+static void bcm_sysport_update_tx_stats(struct bcm_sysport_priv *priv,
+                                        u64 *tx_bytes, u64 *tx_packets)
+{
+        struct bcm_sysport_tx_ring *ring;
+        u64 bytes = 0, packets = 0;
+        unsigned int start;
+        unsigned int q;
+
+        for (q = 0; q < priv->netdev->num_tx_queues; q++) {
+                ring = &priv->tx_rings[q];
+                do {
+                        start = u64_stats_fetch_begin_irq(&priv->syncp);
+                        bytes = ring->bytes;
+                        packets = ring->packets;
+                } while (u64_stats_fetch_retry_irq(&priv->syncp, start));
+
+                *tx_bytes += bytes;
+                *tx_packets += packets;
+        }
+}
+
 static void bcm_sysport_get_stats(struct net_device *dev,
                                   struct ethtool_stats *stats, u64 *data)
 {
@@ -439,11 +460,16 @@ static void bcm_sysport_get_stats(struct net_device *dev,
         struct bcm_sysport_stats64 *stats64 = &priv->stats64;
         struct u64_stats_sync *syncp = &priv->syncp;
         struct bcm_sysport_tx_ring *ring;
+        u64 tx_bytes = 0, tx_packets = 0;
         unsigned int start;
         int i, j;
 
-        if (netif_running(dev))
+        if (netif_running(dev)) {
                 bcm_sysport_update_mib_counters(priv);
+                bcm_sysport_update_tx_stats(priv, &tx_bytes, &tx_packets);
+                stats64->tx_bytes = tx_bytes;
+                stats64->tx_packets = tx_packets;
+        }
 
         for (i =  0, j = 0; i < BCM_SYSPORT_STATS_LEN; i++) {
                 const struct bcm_sysport_stats *s;
@@ -461,12 +487,13 @@ static void bcm_sysport_get_stats(struct net_device *dev,
                         continue;
                 p += s->stat_offset;
 
-                if (s->stat_sizeof == sizeof(u64))
+                if (s->stat_sizeof == sizeof(u64) &&
+                    s->type == BCM_SYSPORT_STAT_NETDEV64) {
                         do {
                                 start = u64_stats_fetch_begin_irq(syncp);
                                 data[i] = *(u64 *)p;
                         } while (u64_stats_fetch_retry_irq(syncp, start));
-                else
+                } else
                         data[i] = *(u32 *)p;
                 j++;
         }
@@ -1716,27 +1743,12 @@ static void bcm_sysport_get_stats64(struct net_device *dev,
 {
         struct bcm_sysport_priv *priv = netdev_priv(dev);
         struct bcm_sysport_stats64 *stats64 = &priv->stats64;
-        struct bcm_sysport_tx_ring *ring;
-        u64 tx_packets = 0, tx_bytes = 0;
         unsigned int start;
-        unsigned int q;
 
         netdev_stats_to_stats64(stats, &dev->stats);
 
-        for (q = 0; q < dev->num_tx_queues; q++) {
-                ring = &priv->tx_rings[q];
-                do {
-                        start = u64_stats_fetch_begin_irq(&priv->syncp);
-                        tx_bytes = ring->bytes;
-                        tx_packets = ring->packets;
-                } while (u64_stats_fetch_retry_irq(&priv->syncp, start));
-
-                stats->tx_bytes += tx_bytes;
-                stats->tx_packets += tx_packets;
-        }
-
-        stats64->tx_bytes = stats->tx_bytes;
-        stats64->tx_packets = stats->tx_packets;
+        bcm_sysport_update_tx_stats(priv, &stats->tx_bytes,
+                                    &stats->tx_packets);
 
         do {
                 start = u64_stats_fetch_begin_irq(&priv->syncp);
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
index ccd699fb2d70..7dd3d131043a 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
@@ -750,6 +750,10 @@ int bnxt_tc_setup_flower(struct bnxt *bp, u16 src_fid,
 {
         int rc = 0;
 
+        if (!is_classid_clsact_ingress(cls_flower->common.classid) ||
+            cls_flower->common.chain_index)
+                return -EOPNOTSUPP;
+
         switch (cls_flower->command) {
         case TC_CLSFLOWER_REPLACE:
                 rc = bnxt_tc_add_flow(bp, src_fid, cls_flower);
diff --git a/drivers/net/ethernet/broadcom/cnic.c b/drivers/net/ethernet/broadcom/cnic.c
index cec94bbb2ea5..8bc126a156e8 100644
--- a/drivers/net/ethernet/broadcom/cnic.c
+++ b/drivers/net/ethernet/broadcom/cnic.c
@@ -1278,7 +1278,7 @@ static int cnic_alloc_bnx2x_resc(struct cnic_dev *dev)
 
         ret = cnic_alloc_dma(dev, kwq_16_dma, pages, 0);
         if (ret)
-                return -ENOMEM;
+                goto error;
 
         n = CNIC_PAGE_SIZE / CNIC_KWQ16_DATA_SIZE;
         for (i = 0, j = 0; i < cp->max_cid_space; i++) {
diff --git a/drivers/net/ethernet/freescale/fec.h b/drivers/net/ethernet/freescale/fec.h
index 38c7b21e5d63..ede1876a9a19 100644
--- a/drivers/net/ethernet/freescale/fec.h
+++ b/drivers/net/ethernet/freescale/fec.h
@@ -374,8 +374,8 @@ struct bufdesc_ex {
 #define FEC_ENET_TS_AVAIL       ((uint)0x00010000)
 #define FEC_ENET_TS_TIMER       ((uint)0x00008000)
 
-#define FEC_DEFAULT_IMASK (FEC_ENET_TXF | FEC_ENET_RXF | FEC_ENET_MII | FEC_ENET_TS_TIMER)
-#define FEC_NAPI_IMASK  (FEC_ENET_MII | FEC_ENET_TS_TIMER)
+#define FEC_DEFAULT_IMASK (FEC_ENET_TXF | FEC_ENET_RXF | FEC_ENET_MII)
+#define FEC_NAPI_IMASK  FEC_ENET_MII
 #define FEC_RX_DISABLED_IMASK (FEC_DEFAULT_IMASK & (~FEC_ENET_RXF))
 
 /* ENET interrupt coalescing macro define */
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index 56f56d6ada9c..3dc2d771a222 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -1559,14 +1559,14 @@ fec_enet_collect_events(struct fec_enet_private *fep, uint int_events)
         if (int_events == 0)
                 return false;
 
-        if (int_events & FEC_ENET_RXF)
+        if (int_events & FEC_ENET_RXF_0)
                 fep->work_rx |= (1 << 2);
         if (int_events & FEC_ENET_RXF_1)
                 fep->work_rx |= (1 << 0);
         if (int_events & FEC_ENET_RXF_2)
                 fep->work_rx |= (1 << 1);
 
-        if (int_events & FEC_ENET_TXF)
+        if (int_events & FEC_ENET_TXF_0)
                 fep->work_tx |= (1 << 2);
         if (int_events & FEC_ENET_TXF_1)
                 fep->work_tx |= (1 << 0);
@@ -1604,8 +1604,8 @@ fec_enet_interrupt(int irq, void *dev_id)
         }
 
         if (fep->ptp_clock)
-                fec_ptp_check_pps_event(fep);
-
+                if (fec_ptp_check_pps_event(fep))
+                        ret = IRQ_HANDLED;
         return ret;
 }
 
diff --git a/drivers/net/ethernet/hisilicon/hns3/hnae3.c b/drivers/net/ethernet/hisilicon/hns3/hnae3.c
index 59efbd605416..5bcb2238acb2 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hnae3.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hnae3.c
@@ -37,20 +37,15 @@ static bool hnae3_client_match(enum hnae3_client_type client_type,
 }
 
 static int hnae3_match_n_instantiate(struct hnae3_client *client,
-                                     struct hnae3_ae_dev *ae_dev,
-                                     bool is_reg, bool *matched)
+                                     struct hnae3_ae_dev *ae_dev, bool is_reg)
 {
         int ret;
 
-        *matched = false;
-
         /* check if this client matches the type of ae_dev */
         if (!(hnae3_client_match(client->type, ae_dev->dev_type) &&
               hnae_get_bit(ae_dev->flag, HNAE3_DEV_INITED_B))) {
                 return 0;
         }
-        /* there is a match of client and dev */
-        *matched = true;
 
         /* now, (un-)instantiate client by calling lower layer */
         if (is_reg) {
@@ -69,7 +64,6 @@ int hnae3_register_client(struct hnae3_client *client)
 {
         struct hnae3_client *client_tmp;
         struct hnae3_ae_dev *ae_dev;
-        bool matched;
         int ret = 0;
 
         mutex_lock(&hnae3_common_lock);
@@ -86,7 +80,7 @@ int hnae3_register_client(struct hnae3_client *client)
                 /* if the client could not be initialized on current port, for
                  * any error reasons, move on to next available port
                  */
-                ret = hnae3_match_n_instantiate(client, ae_dev, true, &matched);
+                ret = hnae3_match_n_instantiate(client, ae_dev, true);
                 if (ret)
                         dev_err(&ae_dev->pdev->dev,
                                 "match and instantiation failed for port\n");
@@ -102,12 +96,11 @@ EXPORT_SYMBOL(hnae3_register_client);
 void hnae3_unregister_client(struct hnae3_client *client)
 {
         struct hnae3_ae_dev *ae_dev;
-        bool matched;
 
         mutex_lock(&hnae3_common_lock);
         /* un-initialize the client on every matched port */
         list_for_each_entry(ae_dev, &hnae3_ae_dev_list, node) {
-                hnae3_match_n_instantiate(client, ae_dev, false, &matched);
+                hnae3_match_n_instantiate(client, ae_dev, false);
         }
 
         list_del(&client->node);
@@ -124,7 +117,6 @@ int hnae3_register_ae_algo(struct hnae3_ae_algo *ae_algo)
         const struct pci_device_id *id;
         struct hnae3_ae_dev *ae_dev;
         struct hnae3_client *client;
-        bool matched;
         int ret = 0;
 
         mutex_lock(&hnae3_common_lock);
@@ -151,13 +143,10 @@ int hnae3_register_ae_algo(struct hnae3_ae_algo *ae_algo)
                  * initialize the figure out client instance
                  */
                 list_for_each_entry(client, &hnae3_client_list, node) {
-                        ret = hnae3_match_n_instantiate(client, ae_dev, true,
-                                                        &matched);
+                        ret = hnae3_match_n_instantiate(client, ae_dev, true);
                         if (ret)
                                 dev_err(&ae_dev->pdev->dev,
                                         "match and instantiation failed\n");
-                        if (matched)
-                                break;
                 }
         }
 
@@ -175,7 +164,6 @@ void hnae3_unregister_ae_algo(struct hnae3_ae_algo *ae_algo)
         const struct pci_device_id *id;
         struct hnae3_ae_dev *ae_dev;
         struct hnae3_client *client;
-        bool matched;
 
         mutex_lock(&hnae3_common_lock);
         /* Check if there are matched ae_dev */
@@ -187,12 +175,8 @@ void hnae3_unregister_ae_algo(struct hnae3_ae_algo *ae_algo)
                 /* check the client list for the match with this ae_dev type and
                  * un-initialize the figure out client instance
                  */
-                list_for_each_entry(client, &hnae3_client_list, node) {
-                        hnae3_match_n_instantiate(client, ae_dev, false,
-                                                  &matched);
-                        if (matched)
-                                break;
-                }
+                list_for_each_entry(client, &hnae3_client_list, node)
+                        hnae3_match_n_instantiate(client, ae_dev, false);
 
                 ae_algo->ops->uninit_ae_dev(ae_dev);
                 hnae_set_bit(ae_dev->flag, HNAE3_DEV_INITED_B, 0);
@@ -212,7 +196,6 @@ int hnae3_register_ae_dev(struct hnae3_ae_dev *ae_dev)
         const struct pci_device_id *id;
         struct hnae3_ae_algo *ae_algo;
         struct hnae3_client *client;
-        bool matched;
         int ret = 0;
 
         mutex_lock(&hnae3_common_lock);
@@ -246,13 +229,10 @@ int hnae3_register_ae_dev(struct hnae3_ae_dev *ae_dev)
          * initialize the figure out client instance
          */
         list_for_each_entry(client, &hnae3_client_list, node) {
-                ret = hnae3_match_n_instantiate(client, ae_dev, true,
-                                                &matched);
+                ret = hnae3_match_n_instantiate(client, ae_dev, true);
                 if (ret)
                         dev_err(&ae_dev->pdev->dev,
                                 "match and instantiation failed\n");
-                if (matched)
-                        break;
         }
 
 out_err:
@@ -270,7 +250,6 @@ void hnae3_unregister_ae_dev(struct hnae3_ae_dev *ae_dev)
         const struct pci_device_id *id;
         struct hnae3_ae_algo *ae_algo;
         struct hnae3_client *client;
-        bool matched;
 
         mutex_lock(&hnae3_common_lock);
         /* Check if there are matched ae_algo */
@@ -279,12 +258,8 @@ void hnae3_unregister_ae_dev(struct hnae3_ae_dev *ae_dev)
                 if (!id)
                         continue;
 
-                list_for_each_entry(client, &hnae3_client_list, node) {
-                        hnae3_match_n_instantiate(client, ae_dev, false,
-                                                  &matched);
-                        if (matched)
-                                break;
-                }
+                list_for_each_entry(client, &hnae3_client_list, node)
+                        hnae3_match_n_instantiate(client, ae_dev, false);
 
                 ae_algo->ops->uninit_ae_dev(ae_dev);
                 hnae_set_bit(ae_dev->flag, HNAE3_DEV_INITED_B, 0);
diff --git a/drivers/net/ethernet/hisilicon/hns3/hnae3.h b/drivers/net/ethernet/hisilicon/hns3/hnae3.h
index b2f28ae81273..1a01cadfe5f3 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hnae3.h
+++ b/drivers/net/ethernet/hisilicon/hns3/hnae3.h
@@ -49,7 +49,17 @@
 #define HNAE3_CLASS_NAME_SIZE 16
 
 #define HNAE3_DEV_INITED_B                      0x0
-#define HNAE_DEV_SUPPORT_ROCE_B                 0x1
+#define HNAE3_DEV_SUPPORT_ROCE_B                0x1
+#define HNAE3_DEV_SUPPORT_DCB_B                 0x2
+
+#define HNAE3_DEV_SUPPORT_ROCE_DCB_BITS (BIT(HNAE3_DEV_SUPPORT_DCB_B) |\
+                BIT(HNAE3_DEV_SUPPORT_ROCE_B))
+
+#define hnae3_dev_roce_supported(hdev) \
+        hnae_get_bit(hdev->ae_dev->flag, HNAE3_DEV_SUPPORT_ROCE_B)
+
+#define hnae3_dev_dcb_supported(hdev) \
+        hnae_get_bit(hdev->ae_dev->flag, HNAE3_DEV_SUPPORT_DCB_B)
 
 #define ring_ptr_move_fw(ring, p) \
         ((ring)->p = ((ring)->p + 1) % (ring)->desc_num)
@@ -366,12 +376,12 @@ struct hnae3_ae_algo {
 struct hnae3_tc_info {
         u16     tqp_offset;     /* TQP offset from base TQP */
         u16     tqp_count;      /* Total TQPs */
-        u8      up;             /* user priority */
         u8      tc;             /* TC index */
         bool    enable;         /* If this TC is enable or not */
 };
 
 #define HNAE3_MAX_TC            8
+#define HNAE3_MAX_USER_PRIO     8
 struct hnae3_knic_private_info {
         struct net_device *netdev; /* Set by KNIC client when init instance */
         u16 rss_size;              /* Allocated RSS queues */
@@ -379,6 +389,7 @@ struct hnae3_knic_private_info {
         u16 num_desc;
 
         u8 num_tc;                 /* Total number of enabled TCs */
+        u8 prio_tc[HNAE3_MAX_USER_PRIO];  /* TC indexed by prio */
         struct hnae3_tc_info tc_info[HNAE3_MAX_TC]; /* Idx of array is HW TC */
 
         u16 num_tqps;             /* total number of TQPs in this handle */
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h
index 91ae0135ee50..758cf3948131 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h
@@ -238,7 +238,7 @@ struct hclge_tqp_map {
         u8 rsv[18];
 };
 
-#define HCLGE_VECTOR_ELEMENTS_PER_CMD   11
+#define HCLGE_VECTOR_ELEMENTS_PER_CMD   10
 
 enum hclge_int_type {
         HCLGE_INT_TX,
@@ -252,8 +252,12 @@ struct hclge_ctrl_vector_chain {
 #define HCLGE_INT_TYPE_S        0
 #define HCLGE_INT_TYPE_M        0x3
 #define HCLGE_TQP_ID_S          2
-#define HCLGE_TQP_ID_M          (0x3fff << HCLGE_TQP_ID_S)
+#define HCLGE_TQP_ID_M          (0x7ff << HCLGE_TQP_ID_S)
+#define HCLGE_INT_GL_IDX_S      13
+#define HCLGE_INT_GL_IDX_M      (0x3 << HCLGE_INT_GL_IDX_S)
         __le16 tqp_type_and_id[HCLGE_VECTOR_ELEMENTS_PER_CMD];
+        u8 vfid;
+        u8 rsv;
 };
 
 #define HCLGE_TC_NUM            8
@@ -266,7 +270,8 @@ struct hclge_tx_buff_alloc {
 
 struct hclge_rx_priv_buff {
         __le16 buf_num[HCLGE_TC_NUM];
-        u8 rsv[8];
+        __le16 shared_buf;
+        u8 rsv[6];
 };
 
 struct hclge_query_version {
@@ -684,6 +689,7 @@ struct hclge_reset_tqp_queue {
 #define HCLGE_DEFAULT_TX_BUF            0x4000   /* 16k  bytes */
 #define HCLGE_TOTAL_PKT_BUF             0x108000 /* 1.03125M bytes */
 #define HCLGE_DEFAULT_DV                0xA000   /* 40k byte */
+#define HCLGE_DEFAULT_NON_DCB_DV        0x7800  /* 30K byte */
 
 #define HCLGE_TYPE_CRQ                  0
 #define HCLGE_TYPE_CSQ                  1
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
index bb45365fb817..c1cdbfd83bdb 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
@@ -46,17 +46,7 @@ static const struct pci_device_id ae_algo_pci_tbl[] = {
         {PCI_VDEVICE(HUAWEI, HNAE3_DEV_ID_50GE_RDMA), 0},
         {PCI_VDEVICE(HUAWEI, HNAE3_DEV_ID_50GE_RDMA_MACSEC), 0},
         {PCI_VDEVICE(HUAWEI, HNAE3_DEV_ID_100G_RDMA_MACSEC), 0},
-        /* Required last entry */
-        {0, }
-};
-
-static const struct pci_device_id roce_pci_tbl[] = {
-        {PCI_VDEVICE(HUAWEI, HNAE3_DEV_ID_25GE_RDMA), 0},
-        {PCI_VDEVICE(HUAWEI, HNAE3_DEV_ID_25GE_RDMA_MACSEC), 0},
-        {PCI_VDEVICE(HUAWEI, HNAE3_DEV_ID_50GE_RDMA), 0},
-        {PCI_VDEVICE(HUAWEI, HNAE3_DEV_ID_50GE_RDMA_MACSEC), 0},
-        {PCI_VDEVICE(HUAWEI, HNAE3_DEV_ID_100G_RDMA_MACSEC), 0},
-        /* Required last entry */
+        /* required last entry */
         {0, }
 };
 
@@ -894,7 +884,7 @@ static int hclge_query_pf_resource(struct hclge_dev *hdev)
         hdev->num_tqps = __le16_to_cpu(req->tqp_num);
         hdev->pkt_buf_size = __le16_to_cpu(req->buf_size) << HCLGE_BUF_UNIT_S;
 
-        if (hnae_get_bit(hdev->ae_dev->flag, HNAE_DEV_SUPPORT_ROCE_B)) {
+        if (hnae3_dev_roce_supported(hdev)) {
                 hdev->num_roce_msix =
                 hnae_get_field(__le16_to_cpu(req->pf_intr_vector_number),
                                HCLGE_PF_VEC_NUM_M, HCLGE_PF_VEC_NUM_S);
@@ -1063,9 +1053,9 @@ static int hclge_configure(struct hclge_dev *hdev)
         hdev->base_tqp_pid = 0;
         hdev->rss_size_max = 1;
         hdev->rx_buf_len = cfg.rx_buf_len;
-        for (i = 0; i < ETH_ALEN; i++)
-                hdev->hw.mac.mac_addr[i] = cfg.mac_addr[i];
+        ether_addr_copy(hdev->hw.mac.mac_addr, cfg.mac_addr);
         hdev->hw.mac.media_type = cfg.media_type;
+        hdev->hw.mac.phy_addr = cfg.phy_addr;
         hdev->num_desc = cfg.tqp_desc_num;
         hdev->tm_info.num_pg = 1;
         hdev->tm_info.num_tc = cfg.tc_num;
@@ -1454,7 +1444,11 @@ static bool  hclge_is_rx_buf_ok(struct hclge_dev *hdev, u32 rx_all)
         tc_num = hclge_get_tc_num(hdev);
         pfc_enable_num = hclge_get_pfc_enalbe_num(hdev);
 
-        shared_buf_min = 2 * hdev->mps + HCLGE_DEFAULT_DV;
+        if (hnae3_dev_dcb_supported(hdev))
+                shared_buf_min = 2 * hdev->mps + HCLGE_DEFAULT_DV;
+        else
+                shared_buf_min = 2 * hdev->mps + HCLGE_DEFAULT_NON_DCB_DV;
+
         shared_buf_tc = pfc_enable_num * hdev->mps +
                         (tc_num - pfc_enable_num) * hdev->mps / 2 +
                         hdev->mps;
@@ -1495,6 +1489,16 @@ int hclge_rx_buffer_calc(struct hclge_dev *hdev, u32 tx_size)
         struct hclge_priv_buf *priv;
         int i;
 
+        /* When DCB is not supported, rx private
+         * buffer is not allocated.
+         */
+        if (!hnae3_dev_dcb_supported(hdev)) {
+                if (!hclge_is_rx_buf_ok(hdev, rx_all))
+                        return -ENOMEM;
+
+                return 0;
+        }
+
         /* step 1, try to alloc private buffer for all enabled tc */
         for (i = 0; i < HCLGE_MAX_TC_NUM; i++) {
                 priv = &hdev->priv_buf[i];
@@ -1510,6 +1514,11 @@ int hclge_rx_buffer_calc(struct hclge_dev *hdev, u32 tx_size)
                                 priv->wl.high = 2 * hdev->mps;
                                 priv->buf_size = priv->wl.high;
                         }
+                } else {
+                        priv->enable = 0;
+                        priv->wl.low = 0;
+                        priv->wl.high = 0;
+                        priv->buf_size = 0;
                 }
         }
 
@@ -1522,8 +1531,15 @@ int hclge_rx_buffer_calc(struct hclge_dev *hdev, u32 tx_size)
         for (i = 0; i < HCLGE_MAX_TC_NUM; i++) {
                 priv = &hdev->priv_buf[i];
 
-                if (hdev->hw_tc_map & BIT(i))
-                        priv->enable = 1;
+                priv->enable = 0;
+                priv->wl.low = 0;
+                priv->wl.high = 0;
+                priv->buf_size = 0;
+
+                if (!(hdev->hw_tc_map & BIT(i)))
+                        continue;
+
+                priv->enable = 1;
 
                 if (hdev->tm_info.hw_pfc_map & BIT(i)) {
                         priv->wl.low = 128;
@@ -1616,6 +1632,10 @@ static int hclge_rx_priv_buf_alloc(struct hclge_dev *hdev)
                         cpu_to_le16(true << HCLGE_TC0_PRI_BUF_EN_B);
         }
 
+        req->shared_buf =
+                cpu_to_le16((hdev->s_buf.buf_size >> HCLGE_BUF_UNIT_S) |
+                            (1 << HCLGE_TC0_PRI_BUF_EN_B));
+
         ret = hclge_cmd_send(&hdev->hw, &desc, 1);
         if (ret) {
                 dev_err(&hdev->pdev->dev,
@@ -1782,18 +1802,22 @@ int hclge_buffer_alloc(struct hclge_dev *hdev)
                 return ret;
         }
 
-        ret = hclge_rx_priv_wl_config(hdev);
-        if (ret) {
-                dev_err(&hdev->pdev->dev,
-                        "could not configure rx private waterline %d\n", ret);
-                return ret;
-        }
+        if (hnae3_dev_dcb_supported(hdev)) {
+                ret = hclge_rx_priv_wl_config(hdev);
+                if (ret) {
+                        dev_err(&hdev->pdev->dev,
+                                "could not configure rx private waterline %d\n",
+                                ret);
+                        return ret;
+                }
 
-        ret = hclge_common_thrd_config(hdev);
-        if (ret) {
-                dev_err(&hdev->pdev->dev,
-                        "could not configure common threshold %d\n", ret);
-                return ret;
+                ret = hclge_common_thrd_config(hdev);
+                if (ret) {
+                        dev_err(&hdev->pdev->dev,
+                                "could not configure common threshold %d\n",
+                                ret);
+                        return ret;
+                }
         }
 
         ret = hclge_common_wl_config(hdev);
@@ -2582,6 +2606,7 @@ static int hclge_rss_init_hw(struct hclge_dev *hdev)
         u16 tc_valid[HCLGE_MAX_TC_NUM];
         u16 tc_size[HCLGE_MAX_TC_NUM];
         u32 *rss_indir = NULL;
+        u16 rss_size = 0, roundup_size;
         const u8 *key;
         int i, ret, j;
 
@@ -2596,7 +2621,13 @@ static int hclge_rss_init_hw(struct hclge_dev *hdev)
         for (j = 0; j < hdev->num_vmdq_vport + 1; j++) {
                 for (i = 0; i < HCLGE_RSS_IND_TBL_SIZE; i++) {
                         vport[j].rss_indirection_tbl[i] =
-                                i % hdev->rss_size_max;
+                                i % vport[j].alloc_rss_size;
+
+                        /* vport 0 is for PF */
+                        if (j != 0)
+                                continue;
+
+                        rss_size = vport[j].alloc_rss_size;
                         rss_indir[i] = vport[j].rss_indirection_tbl[i];
                 }
         }
@@ -2613,42 +2644,32 @@ static int hclge_rss_init_hw(struct hclge_dev *hdev)
         if (ret)
                 goto err;
 
+        /* Each TC have the same queue size, and tc_size set to hardware is
+         * the log2 of roundup power of two of rss_size, the acutal queue
+         * size is limited by indirection table.
+         */
+        if (rss_size > HCLGE_RSS_TC_SIZE_7 || rss_size == 0) {
+                dev_err(&hdev->pdev->dev,
+                        "Configure rss tc size failed, invalid TC_SIZE = %d\n",
+                        rss_size);
+                ret = -EINVAL;
+                goto err;
+        }
+
+        roundup_size = roundup_pow_of_two(rss_size);
+        roundup_size = ilog2(roundup_size);
+
         for (i = 0; i < HCLGE_MAX_TC_NUM; i++) {
-                if (hdev->hw_tc_map & BIT(i))
-                        tc_valid[i] = 1;
-                else
-                        tc_valid[i] = 0;
+                tc_valid[i] = 0;
 
-                switch (hdev->rss_size_max) {
-                case HCLGE_RSS_TC_SIZE_0:
-                        tc_size[i] = 0;
-                        break;
-                case HCLGE_RSS_TC_SIZE_1:
-                        tc_size[i] = 1;
-                        break;
-                case HCLGE_RSS_TC_SIZE_2:
-                        tc_size[i] = 2;
-                        break;
-                case HCLGE_RSS_TC_SIZE_3:
-                        tc_size[i] = 3;
-                        break;
-                case HCLGE_RSS_TC_SIZE_4:
-                        tc_size[i] = 4;
-                        break;
-                case HCLGE_RSS_TC_SIZE_5:
-                        tc_size[i] = 5;
-                        break;
-                case HCLGE_RSS_TC_SIZE_6:
-                        tc_size[i] = 6;
-                        break;
-                case HCLGE_RSS_TC_SIZE_7:
-                        tc_size[i] = 7;
-                        break;
-                default:
-                        break;
-                }
-                tc_offset[i] = hdev->rss_size_max * i;
+                if (!(hdev->hw_tc_map & BIT(i)))
+                        continue;
+
+                tc_valid[i] = 1;
+                tc_size[i] = roundup_size;
+                tc_offset[i] = rss_size * i;
         }
+
         ret = hclge_set_rss_tc_mode(hdev, tc_valid, tc_size, tc_offset);
 
 err:
@@ -2679,7 +2700,11 @@ int hclge_map_vport_ring_to_vector(struct hclge_vport *vport, int vector_id,
                                hnae_get_bit(node->flag, HNAE3_RING_TYPE_B));
                 hnae_set_field(req->tqp_type_and_id[i], HCLGE_TQP_ID_M,
                                HCLGE_TQP_ID_S,  node->tqp_index);
+                hnae_set_field(req->tqp_type_and_id[i], HCLGE_INT_GL_IDX_M,
+                               HCLGE_INT_GL_IDX_S,
+                               hnae_get_bit(node->flag, HNAE3_RING_TYPE_B));
                 req->tqp_type_and_id[i] = cpu_to_le16(req->tqp_type_and_id[i]);
+                req->vfid = vport->vport_id;
 
                 if (++i >= HCLGE_VECTOR_ELEMENTS_PER_CMD) {
                         req->int_cause_num = HCLGE_VECTOR_ELEMENTS_PER_CMD;
@@ -2763,8 +2788,12 @@ static int hclge_unmap_ring_from_vector(
                                hnae_get_bit(node->flag, HNAE3_RING_TYPE_B));
                 hnae_set_field(req->tqp_type_and_id[i], HCLGE_TQP_ID_M,
                                HCLGE_TQP_ID_S,  node->tqp_index);
+                hnae_set_field(req->tqp_type_and_id[i], HCLGE_INT_GL_IDX_M,
+                               HCLGE_INT_GL_IDX_S,
+                               hnae_get_bit(node->flag, HNAE3_RING_TYPE_B));
 
                 req->tqp_type_and_id[i] = cpu_to_le16(req->tqp_type_and_id[i]);
+                req->vfid = vport->vport_id;
 
                 if (++i >= HCLGE_VECTOR_ELEMENTS_PER_CMD) {
                         req->int_cause_num = HCLGE_VECTOR_ELEMENTS_PER_CMD;
@@ -2778,7 +2807,7 @@ static int hclge_unmap_ring_from_vector(
                         }
                         i = 0;
                         hclge_cmd_setup_basic_desc(&desc,
-                                                   HCLGE_OPC_ADD_RING_TO_VECTOR,
+                                                   HCLGE_OPC_DEL_RING_TO_VECTOR,
                                                    false);
                         req->int_vector_id = vector_id;
                 }
@@ -3665,6 +3694,7 @@ static int hclge_init_vlan_config(struct hclge_dev *hdev)
 {
 #define HCLGE_VLAN_TYPE_VF_TABLE   0
 #define HCLGE_VLAN_TYPE_PORT_TABLE 1
+        struct hnae3_handle *handle;
         int ret;
 
         ret = hclge_set_vlan_filter_ctrl(hdev, HCLGE_VLAN_TYPE_VF_TABLE,
@@ -3674,8 +3704,11 @@ static int hclge_init_vlan_config(struct hclge_dev *hdev)
 
         ret = hclge_set_vlan_filter_ctrl(hdev, HCLGE_VLAN_TYPE_PORT_TABLE,
                                          true);
+        if (ret)
+                return ret;
 
-        return ret;
+        handle = &hdev->vport[0].nic;
+        return hclge_set_port_vlan_filter(handle, htons(ETH_P_8021Q), 0, false);
 }
 
 static int hclge_set_mtu(struct hnae3_handle *handle, int new_mtu)
@@ -3920,8 +3953,7 @@ static int hclge_init_client_instance(struct hnae3_client *client,
                                 goto err;
 
                         if (hdev->roce_client &&
-                            hnae_get_bit(hdev->ae_dev->flag,
-                                         HNAE_DEV_SUPPORT_ROCE_B)) {
+                            hnae3_dev_roce_supported(hdev)) {
                                 struct hnae3_client *rc = hdev->roce_client;
 
                                 ret = hclge_init_roce_base_info(vport);
@@ -3944,8 +3976,7 @@ static int hclge_init_client_instance(struct hnae3_client *client,
 
                         break;
                 case HNAE3_CLIENT_ROCE:
-                        if (hnae_get_bit(hdev->ae_dev->flag,
-                                         HNAE_DEV_SUPPORT_ROCE_B)) {
+                        if (hnae3_dev_roce_supported(hdev)) {
                                 hdev->roce_client = client;
                                 vport->roce.client = client;
                         }
@@ -4057,7 +4088,6 @@ static void hclge_pci_uninit(struct hclge_dev *hdev)
 static int hclge_init_ae_dev(struct hnae3_ae_dev *ae_dev)
 {
         struct pci_dev *pdev = ae_dev->pdev;
-        const struct pci_device_id *id;
         struct hclge_dev *hdev;
         int ret;
 
@@ -4072,10 +4102,6 @@ static int hclge_init_ae_dev(struct hnae3_ae_dev *ae_dev)
         hdev->ae_dev = ae_dev;
         ae_dev->priv = hdev;
 
-        id = pci_match_id(roce_pci_tbl, ae_dev->pdev);
-        if (id)
-                hnae_set_bit(ae_dev->flag, HNAE_DEV_SUPPORT_ROCE_B, 1);
-
         ret = hclge_pci_init(hdev);
         if (ret) {
                 dev_err(&pdev->dev, "PCI init failed\n");
@@ -4138,12 +4164,6 @@ static int hclge_init_ae_dev(struct hnae3_ae_dev *ae_dev)
                 return ret;
         }
 
-        ret = hclge_rss_init_hw(hdev);
-        if (ret) {
-                dev_err(&pdev->dev, "Rss init fail, ret =%d\n", ret);
-                return  ret;
-        }
-
         ret = hclge_init_vlan_config(hdev);
         if (ret) {
                 dev_err(&pdev->dev, "VLAN init fail, ret =%d\n", ret);
@@ -4156,6 +4176,12 @@ static int hclge_init_ae_dev(struct hnae3_ae_dev *ae_dev)
                 return ret;
         }
 
+        ret = hclge_rss_init_hw(hdev);
+        if (ret) {
+                dev_err(&pdev->dev, "Rss init fail, ret =%d\n", ret);
+                return ret;
+        }
+
         setup_timer(&hdev->service_timer, hclge_service_timer,
                     (unsigned long)hdev);
         INIT_WORK(&hdev->service_task, hclge_service_task);
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h
index edb10ad075eb..9fcfd9395424 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h
@@ -176,7 +176,6 @@ struct hclge_pg_info {
 struct hclge_tc_info {
         u8 tc_id;
         u8 tc_sch_mode;         /* 0: sp; 1: dwrr */
-        u8 up;
         u8 pgid;
         u32 bw_limit;
 };
@@ -197,6 +196,7 @@ struct hclge_tm_info {
         u8 num_tc;
         u8 num_pg;      /* It must be 1 if vNET-Base schd */
         u8 pg_dwrr[HCLGE_PG_NUM];
+        u8 prio_tc[HNAE3_MAX_USER_PRIO];
         struct hclge_pg_info pg_info[HCLGE_PG_NUM];
         struct hclge_tc_info tc_info[HNAE3_MAX_TC];
         enum hclge_fc_mode fc_mode;
@@ -477,6 +477,7 @@ struct hclge_vport {
         u8  rss_hash_key[HCLGE_RSS_KEY_SIZE]; /* User configured hash keys */
         /* User configured lookup table entries */
         u8  rss_indirection_tbl[HCLGE_RSS_IND_TBL_SIZE];
+        u16 alloc_rss_size;
 
         u16 qs_offset;
         u16 bw_limit;           /* VSI BW Limit (0 = disabled) */
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
index 1c577d268f00..73a75d7cc551 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
@@ -128,9 +128,7 @@ static int hclge_fill_pri_array(struct hclge_dev *hdev, u8 *pri, u8 pri_id)
 {
         u8 tc;
 
-        for (tc = 0; tc < hdev->tm_info.num_tc; tc++)
-                if (hdev->tm_info.tc_info[tc].up == pri_id)
-                        break;
+        tc = hdev->tm_info.prio_tc[pri_id];
 
         if (tc >= hdev->tm_info.num_tc)
                 return -EINVAL;
@@ -158,7 +156,7 @@ static int hclge_up_to_tc_map(struct hclge_dev *hdev)
 
         hclge_cmd_setup_basic_desc(&desc, HCLGE_OPC_PRI_TO_TC_MAPPING, false);
 
-        for (pri_id = 0; pri_id < hdev->tm_info.num_tc; pri_id++) {
+        for (pri_id = 0; pri_id < HNAE3_MAX_USER_PRIO; pri_id++) {
                 ret = hclge_fill_pri_array(hdev, pri, pri_id);
                 if (ret)
                         return ret;
@@ -280,11 +278,11 @@ static int hclge_tm_pg_shapping_cfg(struct hclge_dev *hdev,
 
         shap_cfg_cmd->pg_id = pg_id;
 
-        hclge_tm_set_feild(shap_cfg_cmd->pg_shapping_para, IR_B, ir_b);
-        hclge_tm_set_feild(shap_cfg_cmd->pg_shapping_para, IR_U, ir_u);
-        hclge_tm_set_feild(shap_cfg_cmd->pg_shapping_para, IR_S, ir_s);
-        hclge_tm_set_feild(shap_cfg_cmd->pg_shapping_para, BS_B, bs_b);
-        hclge_tm_set_feild(shap_cfg_cmd->pg_shapping_para, BS_S, bs_s);
+        hclge_tm_set_field(shap_cfg_cmd->pg_shapping_para, IR_B, ir_b);
+        hclge_tm_set_field(shap_cfg_cmd->pg_shapping_para, IR_U, ir_u);
+        hclge_tm_set_field(shap_cfg_cmd->pg_shapping_para, IR_S, ir_s);
+        hclge_tm_set_field(shap_cfg_cmd->pg_shapping_para, BS_B, bs_b);
+        hclge_tm_set_field(shap_cfg_cmd->pg_shapping_para, BS_S, bs_s);
 
         return hclge_cmd_send(&hdev->hw, &desc, 1);
 }
@@ -307,11 +305,11 @@ static int hclge_tm_pri_shapping_cfg(struct hclge_dev *hdev,
 
         shap_cfg_cmd->pri_id = pri_id;
 
-        hclge_tm_set_feild(shap_cfg_cmd->pri_shapping_para, IR_B, ir_b);
-        hclge_tm_set_feild(shap_cfg_cmd->pri_shapping_para, IR_U, ir_u);
-        hclge_tm_set_feild(shap_cfg_cmd->pri_shapping_para, IR_S, ir_s);
-        hclge_tm_set_feild(shap_cfg_cmd->pri_shapping_para, BS_B, bs_b);
-        hclge_tm_set_feild(shap_cfg_cmd->pri_shapping_para, BS_S, bs_s);
+        hclge_tm_set_field(shap_cfg_cmd->pri_shapping_para, IR_B, ir_b);
+        hclge_tm_set_field(shap_cfg_cmd->pri_shapping_para, IR_U, ir_u);
+        hclge_tm_set_field(shap_cfg_cmd->pri_shapping_para, IR_S, ir_s);
+        hclge_tm_set_field(shap_cfg_cmd->pri_shapping_para, BS_B, bs_b);
+        hclge_tm_set_field(shap_cfg_cmd->pri_shapping_para, BS_S, bs_s);
 
         return hclge_cmd_send(&hdev->hw, &desc, 1);
 }
@@ -397,6 +395,7 @@ static void hclge_tm_vport_tc_info_update(struct hclge_vport *vport)
                         kinfo->num_tqps / kinfo->num_tc);
         vport->qs_offset = hdev->tm_info.num_tc * vport->vport_id;
         vport->dwrr = 100;  /* 100 percent as init */
+        vport->alloc_rss_size = kinfo->rss_size;
 
         for (i = 0; i < kinfo->num_tc; i++) {
                 if (hdev->hw_tc_map & BIT(i)) {
@@ -404,16 +403,17 @@ static void hclge_tm_vport_tc_info_update(struct hclge_vport *vport)
                         kinfo->tc_info[i].tqp_offset = i * kinfo->rss_size;
                         kinfo->tc_info[i].tqp_count = kinfo->rss_size;
                         kinfo->tc_info[i].tc = i;
-                        kinfo->tc_info[i].up = hdev->tm_info.tc_info[i].up;
                 } else {
                         /* Set to default queue if TC is disable */
                         kinfo->tc_info[i].enable = false;
                         kinfo->tc_info[i].tqp_offset = 0;
                         kinfo->tc_info[i].tqp_count = 1;
                         kinfo->tc_info[i].tc = 0;
-                        kinfo->tc_info[i].up = 0;
                 }
         }
+
+        memcpy(kinfo->prio_tc, hdev->tm_info.prio_tc,
+               FIELD_SIZEOF(struct hnae3_knic_private_info, prio_tc));
 }
 
 static void hclge_tm_vport_info_update(struct hclge_dev *hdev)
@@ -435,12 +435,15 @@ static void hclge_tm_tc_info_init(struct hclge_dev *hdev)
         for (i = 0; i < hdev->tm_info.num_tc; i++) {
                 hdev->tm_info.tc_info[i].tc_id = i;
                 hdev->tm_info.tc_info[i].tc_sch_mode = HCLGE_SCH_MODE_DWRR;
-                hdev->tm_info.tc_info[i].up = i;
                 hdev->tm_info.tc_info[i].pgid = 0;
                 hdev->tm_info.tc_info[i].bw_limit =
                         hdev->tm_info.pg_info[0].bw_limit;
         }
 
+        for (i = 0; i < HNAE3_MAX_USER_PRIO; i++)
+                hdev->tm_info.prio_tc[i] =
+                        (i >= hdev->tm_info.num_tc) ? 0 : i;
+
         hdev->flag &= ~HCLGE_FLAG_DCB_ENABLE;
 }
 
@@ -976,6 +979,10 @@ int hclge_pause_setup_hw(struct hclge_dev *hdev)
         if (ret)
                 return ret;
 
+        /* Only DCB-supported dev supports qset back pressure setting */
+        if (!hnae3_dev_dcb_supported(hdev))
+                return 0;
+
         for (i = 0; i < hdev->tm_info.num_tc; i++) {
                 ret = hclge_tm_qs_bp_cfg(hdev, i);
                 if (ret)
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.h b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.h
index 7e67337dfaf2..85158b0d73fe 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.h
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.h
@@ -94,10 +94,10 @@ struct hclge_bp_to_qs_map_cmd {
         u32 rsvd1;
 };
 
-#define hclge_tm_set_feild(dest, string, val) \
+#define hclge_tm_set_field(dest, string, val) \
                         hnae_set_field((dest), (HCLGE_TM_SHAP_##string##_MSK), \
                                        (HCLGE_TM_SHAP_##string##_LSH), val)
-#define hclge_tm_get_feild(src, string) \
+#define hclge_tm_get_field(src, string) \
                         hnae_get_field((src), (HCLGE_TM_SHAP_##string##_MSK), \
                                        (HCLGE_TM_SHAP_##string##_LSH))
 
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hns3_enet.c
index 1c3e29447891..35369e1c8036 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hns3_enet.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hns3_enet.c
@@ -41,11 +41,16 @@ static struct hnae3_client client;
 static const struct pci_device_id hns3_pci_tbl[] = {
         {PCI_VDEVICE(HUAWEI, HNAE3_DEV_ID_GE), 0},
         {PCI_VDEVICE(HUAWEI, HNAE3_DEV_ID_25GE), 0},
-        {PCI_VDEVICE(HUAWEI, HNAE3_DEV_ID_25GE_RDMA), 0},
-        {PCI_VDEVICE(HUAWEI, HNAE3_DEV_ID_25GE_RDMA_MACSEC), 0},
-        {PCI_VDEVICE(HUAWEI, HNAE3_DEV_ID_50GE_RDMA), 0},
-        {PCI_VDEVICE(HUAWEI, HNAE3_DEV_ID_50GE_RDMA_MACSEC), 0},
-        {PCI_VDEVICE(HUAWEI, HNAE3_DEV_ID_100G_RDMA_MACSEC), 0},
+        {PCI_VDEVICE(HUAWEI, HNAE3_DEV_ID_25GE_RDMA),
+         HNAE3_DEV_SUPPORT_ROCE_DCB_BITS},
+        {PCI_VDEVICE(HUAWEI, HNAE3_DEV_ID_25GE_RDMA_MACSEC),
+         HNAE3_DEV_SUPPORT_ROCE_DCB_BITS},
+        {PCI_VDEVICE(HUAWEI, HNAE3_DEV_ID_50GE_RDMA),
+         HNAE3_DEV_SUPPORT_ROCE_DCB_BITS},
+        {PCI_VDEVICE(HUAWEI, HNAE3_DEV_ID_50GE_RDMA_MACSEC),
+         HNAE3_DEV_SUPPORT_ROCE_DCB_BITS},
+        {PCI_VDEVICE(HUAWEI, HNAE3_DEV_ID_100G_RDMA_MACSEC),
+         HNAE3_DEV_SUPPORT_ROCE_DCB_BITS},
         /* required last entry */
         {0, }
 };
@@ -1348,6 +1353,7 @@ static int hns3_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         }
 
         ae_dev->pdev = pdev;
+        ae_dev->flag = ent->driver_data;
         ae_dev->dev_type = HNAE3_DEV_KNIC;
         pci_set_drvdata(pdev, ae_dev);
 
@@ -2705,10 +2711,11 @@ static void hns3_init_mac_addr(struct net_device *netdev)
                 eth_hw_addr_random(netdev);
                 dev_warn(priv->dev, "using random MAC address %pM\n",
                          netdev->dev_addr);
-                /* Also copy this new MAC address into hdev */
-                if (h->ae_algo->ops->set_mac_addr)
-                        h->ae_algo->ops->set_mac_addr(h, netdev->dev_addr);
         }
+
+        if (h->ae_algo->ops->set_mac_addr)
+                h->ae_algo->ops->set_mac_addr(h, netdev->dev_addr);
+
 }
 
 static void hns3_nic_set_priv_ops(struct net_device *netdev)
diff --git a/drivers/net/ethernet/ibm/emac/mal.c b/drivers/net/ethernet/ibm/emac/mal.c
index 2c74baa2398a..fff09dcf9e34 100644
--- a/drivers/net/ethernet/ibm/emac/mal.c
+++ b/drivers/net/ethernet/ibm/emac/mal.c
@@ -402,7 +402,7 @@ static int mal_poll(struct napi_struct *napi, int budget)
         unsigned long flags;
 
         MAL_DBG2(mal, "poll(%d)" NL, budget);
- again:
+
         /* Process TX skbs */
         list_for_each(l, &mal->poll_list) {
                 struct mal_commac *mc =
@@ -451,7 +451,6 @@ static int mal_poll(struct napi_struct *napi, int budget)
                         spin_lock_irqsave(&mal->lock, flags);
                         mal_disable_eob_irq(mal);
                         spin_unlock_irqrestore(&mal->lock, flags);
-                        goto again;
                 }
                 mc->ops->poll_tx(mc->dev);
         }
diff --git a/drivers/net/ethernet/marvell/mvpp2.c b/drivers/net/ethernet/marvell/mvpp2.c
index dd0ee2691c86..9c86cb7cb988 100644
--- a/drivers/net/ethernet/marvell/mvpp2.c
+++ b/drivers/net/ethernet/marvell/mvpp2.c
@@ -333,7 +333,7 @@
 #define     MVPP2_GMAC_INBAND_AN_MASK           BIT(0)
 #define     MVPP2_GMAC_FLOW_CTRL_MASK           GENMASK(2, 1)
 #define     MVPP2_GMAC_PCS_ENABLE_MASK          BIT(3)
-#define     MVPP2_GMAC_PORT_RGMII_MASK          BIT(4)
+#define     MVPP2_GMAC_INTERNAL_CLK_MASK        BIT(4)
 #define     MVPP2_GMAC_DISABLE_PADDING          BIT(5)
 #define     MVPP2_GMAC_PORT_RESET_MASK          BIT(6)
 #define MVPP2_GMAC_AUTONEG_CONFIG               0xc
@@ -676,6 +676,7 @@ enum mvpp2_tag_type {
 #define MVPP2_PRS_RI_L3_MCAST                   BIT(15)
 #define MVPP2_PRS_RI_L3_BCAST                   (BIT(15) | BIT(16))
 #define MVPP2_PRS_RI_IP_FRAG_MASK               0x20000
+#define MVPP2_PRS_RI_IP_FRAG_TRUE               BIT(17)
 #define MVPP2_PRS_RI_UDF3_MASK                  0x300000
 #define MVPP2_PRS_RI_UDF3_RX_SPECIAL            BIT(21)
 #define MVPP2_PRS_RI_L4_PROTO_MASK              0x1c00000
@@ -792,6 +793,7 @@ struct mvpp2 {
         struct clk *pp_clk;
         struct clk *gop_clk;
         struct clk *mg_clk;
+        struct clk *axi_clk;
 
         /* List of pointers to port structures */
         struct mvpp2_port **port_list;
@@ -2315,7 +2317,7 @@ static int mvpp2_prs_ip4_proto(struct mvpp2 *priv, unsigned short proto,
             (proto != IPPROTO_IGMP))
                 return -EINVAL;
 
-        /* Fragmented packet */
+        /* Not fragmented packet */
         tid = mvpp2_prs_tcam_first_free(priv, MVPP2_PE_FIRST_FREE_TID,
                                         MVPP2_PE_LAST_FREE_TID);
         if (tid < 0)
@@ -2334,8 +2336,12 @@ static int mvpp2_prs_ip4_proto(struct mvpp2 *priv, unsigned short proto,
                                   MVPP2_PRS_SRAM_OP_SEL_UDF_ADD);
         mvpp2_prs_sram_ai_update(&pe, MVPP2_PRS_IPV4_DIP_AI_BIT,
                                  MVPP2_PRS_IPV4_DIP_AI_BIT);
-        mvpp2_prs_sram_ri_update(&pe, ri | MVPP2_PRS_RI_IP_FRAG_MASK,
-                                 ri_mask | MVPP2_PRS_RI_IP_FRAG_MASK);
+        mvpp2_prs_sram_ri_update(&pe, ri, ri_mask | MVPP2_PRS_RI_IP_FRAG_MASK);
+
+        mvpp2_prs_tcam_data_byte_set(&pe, 2, 0x00,
+                                     MVPP2_PRS_TCAM_PROTO_MASK_L);
+        mvpp2_prs_tcam_data_byte_set(&pe, 3, 0x00,
+                                     MVPP2_PRS_TCAM_PROTO_MASK);
 
         mvpp2_prs_tcam_data_byte_set(&pe, 5, proto, MVPP2_PRS_TCAM_PROTO_MASK);
         mvpp2_prs_tcam_ai_update(&pe, 0, MVPP2_PRS_IPV4_DIP_AI_BIT);
@@ -2346,7 +2352,7 @@ static int mvpp2_prs_ip4_proto(struct mvpp2 *priv, unsigned short proto,
         mvpp2_prs_shadow_set(priv, pe.index, MVPP2_PRS_LU_IP4);
         mvpp2_prs_hw_write(priv, &pe);
 
-        /* Not fragmented packet */
+        /* Fragmented packet */
         tid = mvpp2_prs_tcam_first_free(priv, MVPP2_PE_FIRST_FREE_TID,
                                         MVPP2_PE_LAST_FREE_TID);
         if (tid < 0)
@@ -2358,8 +2364,11 @@ static int mvpp2_prs_ip4_proto(struct mvpp2 *priv, unsigned short proto,
         pe.sram.word[MVPP2_PRS_SRAM_RI_CTRL_WORD] = 0x0;
         mvpp2_prs_sram_ri_update(&pe, ri, ri_mask);
 
-        mvpp2_prs_tcam_data_byte_set(&pe, 2, 0x00, MVPP2_PRS_TCAM_PROTO_MASK_L);
-        mvpp2_prs_tcam_data_byte_set(&pe, 3, 0x00, MVPP2_PRS_TCAM_PROTO_MASK);
+        mvpp2_prs_sram_ri_update(&pe, ri | MVPP2_PRS_RI_IP_FRAG_TRUE,
+                                 ri_mask | MVPP2_PRS_RI_IP_FRAG_MASK);
+
+        mvpp2_prs_tcam_data_byte_set(&pe, 2, 0x00, 0x0);
+        mvpp2_prs_tcam_data_byte_set(&pe, 3, 0x00, 0x0);
 
         /* Update shadow table and hw entry */
         mvpp2_prs_shadow_set(priv, pe.index, MVPP2_PRS_LU_IP4);
@@ -4591,7 +4600,6 @@ static void mvpp2_port_mii_gmac_configure(struct mvpp2_port *port)
                 val |= MVPP2_GMAC_INBAND_AN_MASK | MVPP2_GMAC_PCS_ENABLE_MASK;
         } else if (phy_interface_mode_is_rgmii(port->phy_interface)) {
                 val &= ~MVPP2_GMAC_PCS_ENABLE_MASK;
-                val |= MVPP2_GMAC_PORT_RGMII_MASK;
         }
         writel(val, port->base + MVPP2_GMAC_CTRL_2_REG);
 
@@ -7496,7 +7504,7 @@ static void mvpp2_port_copy_mac_addr(struct net_device *dev, struct mvpp2 *priv,
 /* Ports initialization */
 static int mvpp2_port_probe(struct platform_device *pdev,
                             struct device_node *port_node,
-                            struct mvpp2 *priv)
+                            struct mvpp2 *priv, int index)
 {
         struct device_node *phy_node;
         struct phy *comphy;
@@ -7670,7 +7678,7 @@ static int mvpp2_port_probe(struct platform_device *pdev,
         }
         netdev_info(dev, "Using %s mac address %pM\n", mac_from, dev->dev_addr);
 
-        priv->port_list[id] = port;
+        priv->port_list[index] = port;
         return 0;
 
 err_free_port_pcpu:
@@ -7963,6 +7971,18 @@ static int mvpp2_probe(struct platform_device *pdev)
                 err = clk_prepare_enable(priv->mg_clk);
                 if (err < 0)
                         goto err_gop_clk;
+
+                priv->axi_clk = devm_clk_get(&pdev->dev, "axi_clk");
+                if (IS_ERR(priv->axi_clk)) {
+                        err = PTR_ERR(priv->axi_clk);
+                        if (err == -EPROBE_DEFER)
+                                goto err_gop_clk;
+                        priv->axi_clk = NULL;
+                } else {
+                        err = clk_prepare_enable(priv->axi_clk);
+                        if (err < 0)
+                                goto err_gop_clk;
+                }
         }
 
         /* Get system's tclk rate */
@@ -8005,16 +8025,19 @@ static int mvpp2_probe(struct platform_device *pdev)
         }
 
         /* Initialize ports */
+        i = 0;
         for_each_available_child_of_node(dn, port_node) {
-                err = mvpp2_port_probe(pdev, port_node, priv);
+                err = mvpp2_port_probe(pdev, port_node, priv, i);
                 if (err < 0)
                         goto err_mg_clk;
+                i++;
         }
 
         platform_set_drvdata(pdev, priv);
         return 0;
 
 err_mg_clk:
+        clk_disable_unprepare(priv->axi_clk);
         if (priv->hw_version == MVPP22)
                 clk_disable_unprepare(priv->mg_clk);
 err_gop_clk:
@@ -8052,6 +8075,7 @@ static int mvpp2_remove(struct platform_device *pdev)
                                   aggr_txq->descs_dma);
         }
 
+        clk_disable_unprepare(priv->axi_clk);
         clk_disable_unprepare(priv->mg_clk);
         clk_disable_unprepare(priv->pp_clk);
         clk_disable_unprepare(priv->gop_clk);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/diag/fs_tracepoint.h b/drivers/net/ethernet/mellanox/mlx5/core/diag/fs_tracepoint.h
index 1e3a6c3e4132..80eef4163f52 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/diag/fs_tracepoint.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/diag/fs_tracepoint.h
@@ -139,7 +139,7 @@ TRACE_EVENT(mlx5_fs_del_fg,
         {MLX5_FLOW_CONTEXT_ACTION_FWD_NEXT_PRIO, "NEXT_PRIO"}
 
 TRACE_EVENT(mlx5_fs_set_fte,
-            TP_PROTO(const struct fs_fte *fte, bool new_fte),
+            TP_PROTO(const struct fs_fte *fte, int new_fte),
             TP_ARGS(fte, new_fte),
             TP_STRUCT__entry(
                 __field(const struct fs_fte *, fte)
@@ -149,7 +149,7 @@ TRACE_EVENT(mlx5_fs_set_fte,
                 __field(u32, action)
                 __field(u32, flow_tag)
                 __field(u8,  mask_enable)
-                __field(bool, new_fte)
+                __field(int, new_fte)
                 __array(u32, mask_outer, MLX5_ST_SZ_DW(fte_match_set_lyr_2_4))
                 __array(u32, mask_inner, MLX5_ST_SZ_DW(fte_match_set_lyr_2_4))
                 __array(u32, mask_misc, MLX5_ST_SZ_DW(fte_match_set_misc))
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c
index f11fd07ac4dd..850cdc980ab5 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c
@@ -291,7 +291,7 @@ void mlx5e_enable_vlan_filter(struct mlx5e_priv *priv)
         priv->fs.vlan.filter_disabled = false;
         if (priv->netdev->flags & IFF_PROMISC)
                 return;
-        mlx5e_del_any_vid_rules(priv);
+        mlx5e_del_vlan_rule(priv, MLX5E_VLAN_RULE_TYPE_ANY_CTAG_VID, 0);
 }
 
 void mlx5e_disable_vlan_filter(struct mlx5e_priv *priv)
@@ -302,7 +302,7 @@ void mlx5e_disable_vlan_filter(struct mlx5e_priv *priv)
         priv->fs.vlan.filter_disabled = true;
         if (priv->netdev->flags & IFF_PROMISC)
                 return;
-        mlx5e_add_any_vid_rules(priv);
+        mlx5e_add_vlan_rule(priv, MLX5E_VLAN_RULE_TYPE_ANY_CTAG_VID, 0);
 }
 
 int mlx5e_vlan_rx_add_vid(struct net_device *dev, __always_unused __be16 proto,
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index dfc29720ab77..cc11bbbd0309 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -184,7 +184,6 @@ static void mlx5e_update_sw_counters(struct mlx5e_priv *priv)
         struct mlx5e_sw_stats temp, *s = &temp;
         struct mlx5e_rq_stats *rq_stats;
         struct mlx5e_sq_stats *sq_stats;
-        u64 tx_offload_none = 0;
         int i, j;
 
         memset(s, 0, sizeof(*s));
@@ -199,6 +198,7 @@ static void mlx5e_update_sw_counters(struct mlx5e_priv *priv)
                 s->rx_lro_bytes += rq_stats->lro_bytes;
                 s->rx_csum_none += rq_stats->csum_none;
                 s->rx_csum_complete += rq_stats->csum_complete;
+                s->rx_csum_unnecessary += rq_stats->csum_unnecessary;
                 s->rx_csum_unnecessary_inner += rq_stats->csum_unnecessary_inner;
                 s->rx_xdp_drop += rq_stats->xdp_drop;
                 s->rx_xdp_tx += rq_stats->xdp_tx;
@@ -229,14 +229,11 @@ static void mlx5e_update_sw_counters(struct mlx5e_priv *priv)
                         s->tx_queue_dropped     += sq_stats->dropped;
                         s->tx_xmit_more         += sq_stats->xmit_more;
                         s->tx_csum_partial_inner += sq_stats->csum_partial_inner;
-                        tx_offload_none         += sq_stats->csum_none;
+                        s->tx_csum_none         += sq_stats->csum_none;
+                        s->tx_csum_partial      += sq_stats->csum_partial;
                 }
         }
 
-        /* Update calculated offload counters */
-        s->tx_csum_partial = s->tx_packets - tx_offload_none - s->tx_csum_partial_inner;
-        s->rx_csum_unnecessary = s->rx_packets - s->rx_csum_none - s->rx_csum_complete;
-
         s->link_down_events_phy = MLX5_GET(ppcnt_reg,
                                 priv->stats.pport.phy_counters,
                                 counter_set.phys_layer_cntrs.link_down_events);
@@ -3333,8 +3330,8 @@ static int mlx5e_handle_feature(struct net_device *netdev,
 
         err = feature_handler(netdev, enable);
         if (err) {
-                netdev_err(netdev, "%s feature 0x%llx failed err %d\n",
-                           enable ? "Enable" : "Disable", feature, err);
+                netdev_err(netdev, "%s feature %pNF failed, err %d\n",
+                           enable ? "Enable" : "Disable", &feature, err);
                 return err;
         }
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
index f1dd638384d3..15a1687483cc 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
@@ -627,6 +627,7 @@ static inline void mlx5e_handle_csum(struct net_device *netdev,
 
         if (lro) {
                 skb->ip_summed = CHECKSUM_UNNECESSARY;
+                rq->stats.csum_unnecessary++;
                 return;
         }
 
@@ -644,7 +645,9 @@ static inline void mlx5e_handle_csum(struct net_device *netdev,
                         skb->csum_level = 1;
                         skb->encapsulation = 1;
                         rq->stats.csum_unnecessary_inner++;
+                        return;
                 }
+                rq->stats.csum_unnecessary++;
                 return;
         }
 csum_none:
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h
index 6d199ffb1c0b..f8637213afc0 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h
@@ -68,6 +68,7 @@ struct mlx5e_sw_stats {
         u64 rx_xdp_drop;
         u64 rx_xdp_tx;
         u64 rx_xdp_tx_full;
+        u64 tx_csum_none;
         u64 tx_csum_partial;
         u64 tx_csum_partial_inner;
         u64 tx_queue_stopped;
@@ -108,6 +109,7 @@ static const struct counter_desc sw_stats_desc[] = {
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_xdp_drop) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_xdp_tx) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_xdp_tx_full) },
+        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_csum_none) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_csum_partial) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_csum_partial_inner) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_queue_stopped) },
@@ -339,6 +341,7 @@ struct mlx5e_rq_stats {
         u64 packets;
         u64 bytes;
         u64 csum_complete;
+        u64 csum_unnecessary;
         u64 csum_unnecessary_inner;
         u64 csum_none;
         u64 lro_packets;
@@ -363,6 +366,7 @@ static const struct counter_desc rq_stats_desc[] = {
         { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, packets) },
         { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, bytes) },
         { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, csum_complete) },
+        { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, csum_unnecessary) },
         { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, csum_unnecessary_inner) },
         { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, csum_none) },
         { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, xdp_drop) },
@@ -392,6 +396,7 @@ struct mlx5e_sq_stats {
         u64 tso_bytes;
         u64 tso_inner_packets;
         u64 tso_inner_bytes;
+        u64 csum_partial;
         u64 csum_partial_inner;
         u64 nop;
         /* less likely accessed in data path */
@@ -408,6 +413,7 @@ static const struct counter_desc sq_stats_desc[] = {
         { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, tso_bytes) },
         { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, tso_inner_packets) },
         { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, tso_inner_bytes) },
+        { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, csum_partial) },
         { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, csum_partial_inner) },
         { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, nop) },
         { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, csum_none) },
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
index da503e6411da..1aa2028ed995 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
@@ -1317,6 +1317,69 @@ static bool csum_offload_supported(struct mlx5e_priv *priv, u32 action, u32 upda
         return true;
 }
 
+static bool modify_header_match_supported(struct mlx5_flow_spec *spec,
+                                          struct tcf_exts *exts)
+{
+        const struct tc_action *a;
+        bool modify_ip_header;
+        LIST_HEAD(actions);
+        u8 htype, ip_proto;
+        void *headers_v;
+        u16 ethertype;
+        int nkeys, i;
+
+        headers_v = MLX5_ADDR_OF(fte_match_param, spec->match_value, outer_headers);
+        ethertype = MLX5_GET(fte_match_set_lyr_2_4, headers_v, ethertype);
+
+        /* for non-IP we only re-write MACs, so we're okay */
+        if (ethertype != ETH_P_IP && ethertype != ETH_P_IPV6)
+                goto out_ok;
+
+        modify_ip_header = false;
+        tcf_exts_to_list(exts, &actions);
+        list_for_each_entry(a, &actions, list) {
+                if (!is_tcf_pedit(a))
+                        continue;
+
+                nkeys = tcf_pedit_nkeys(a);
+                for (i = 0; i < nkeys; i++) {
+                        htype = tcf_pedit_htype(a, i);
+                        if (htype == TCA_PEDIT_KEY_EX_HDR_TYPE_IP4 ||
+                            htype == TCA_PEDIT_KEY_EX_HDR_TYPE_IP6) {
+                                modify_ip_header = true;
+                                break;
+                        }
+                }
+        }
+
+        ip_proto = MLX5_GET(fte_match_set_lyr_2_4, headers_v, ip_protocol);
+        if (modify_ip_header && ip_proto != IPPROTO_TCP && ip_proto != IPPROTO_UDP) {
+                pr_info("can't offload re-write of ip proto %d\n", ip_proto);
+                return false;
+        }
+
+out_ok:
+        return true;
+}
+
+static bool actions_match_supported(struct mlx5e_priv *priv,
+                                    struct tcf_exts *exts,
+                                    struct mlx5e_tc_flow_parse_attr *parse_attr,
+                                    struct mlx5e_tc_flow *flow)
+{
+        u32 actions;
+
+        if (flow->flags & MLX5E_TC_FLOW_ESWITCH)
+                actions = flow->esw_attr->action;
+        else
+                actions = flow->nic_attr->action;
+
+        if (actions & MLX5_FLOW_CONTEXT_ACTION_MOD_HDR)
+                return modify_header_match_supported(&parse_attr->spec, exts);
+
+        return true;
+}
+
 static int parse_tc_nic_actions(struct mlx5e_priv *priv, struct tcf_exts *exts,
                                 struct mlx5e_tc_flow_parse_attr *parse_attr,
                                 struct mlx5e_tc_flow *flow)
@@ -1378,6 +1441,9 @@ static int parse_tc_nic_actions(struct mlx5e_priv *priv, struct tcf_exts *exts,
                 return -EINVAL;
         }
 
+        if (!actions_match_supported(priv, exts, parse_attr, flow))
+                return -EOPNOTSUPP;
+
         return 0;
 }
 
@@ -1564,7 +1630,7 @@ static int mlx5e_create_encap_header_ipv4(struct mlx5e_priv *priv,
                 break;
         default:
                 err = -EOPNOTSUPP;
-                goto out;
+                goto free_encap;
         }
         fl4.flowi4_tos = tun_key->tos;
         fl4.daddr = tun_key->u.ipv4.dst;
@@ -1573,7 +1639,7 @@ static int mlx5e_create_encap_header_ipv4(struct mlx5e_priv *priv,
         err = mlx5e_route_lookup_ipv4(priv, mirred_dev, &out_dev,
                                       &fl4, &n, &ttl);
         if (err)
-                goto out;
+                goto free_encap;
 
         /* used by mlx5e_detach_encap to lookup a neigh hash table
          * entry in the neigh hash table when a user deletes a rule
@@ -1590,7 +1656,7 @@ static int mlx5e_create_encap_header_ipv4(struct mlx5e_priv *priv,
          */
         err = mlx5e_rep_encap_entry_attach(netdev_priv(out_dev), e);
         if (err)
-                goto out;
+                goto free_encap;
 
         read_lock_bh(&n->lock);
         nud_state = n->nud_state;
@@ -1630,8 +1696,9 @@ static int mlx5e_create_encap_header_ipv4(struct mlx5e_priv *priv,
 
 destroy_neigh_entry:
         mlx5e_rep_encap_entry_detach(netdev_priv(e->out_dev), e);
-out:
+free_encap:
         kfree(encap_header);
+out:
         if (n)
                 neigh_release(n);
         return err;
@@ -1668,7 +1735,7 @@ static int mlx5e_create_encap_header_ipv6(struct mlx5e_priv *priv,
                 break;
         default:
                 err = -EOPNOTSUPP;
-                goto out;
+                goto free_encap;
         }
 
         fl6.flowlabel = ip6_make_flowinfo(RT_TOS(tun_key->tos), tun_key->label);
@@ -1678,7 +1745,7 @@ static int mlx5e_create_encap_header_ipv6(struct mlx5e_priv *priv,
         err = mlx5e_route_lookup_ipv6(priv, mirred_dev, &out_dev,
                                       &fl6, &n, &ttl);
         if (err)
-                goto out;
+                goto free_encap;
 
         /* used by mlx5e_detach_encap to lookup a neigh hash table
          * entry in the neigh hash table when a user deletes a rule
@@ -1695,7 +1762,7 @@ static int mlx5e_create_encap_header_ipv6(struct mlx5e_priv *priv,
          */
         err = mlx5e_rep_encap_entry_attach(netdev_priv(out_dev), e);
         if (err)
-                goto out;
+                goto free_encap;
 
         read_lock_bh(&n->lock);
         nud_state = n->nud_state;
@@ -1736,8 +1803,9 @@ static int mlx5e_create_encap_header_ipv6(struct mlx5e_priv *priv,
 
 destroy_neigh_entry:
         mlx5e_rep_encap_entry_detach(netdev_priv(e->out_dev), e);
-out:
+free_encap:
         kfree(encap_header);
+out:
         if (n)
                 neigh_release(n);
         return err;
@@ -1791,6 +1859,7 @@ vxlan_encap_offload_err:
                 }
         }
 
+        /* must verify if encap is valid or not */
         if (found)
                 goto attach_flow;
 
@@ -1817,6 +1886,8 @@ attach_flow:
         *encap_dev = e->out_dev;
         if (e->flags & MLX5_ENCAP_ENTRY_VALID)
                 attr->encap_id = e->encap_id;
+        else
+                err = -EAGAIN;
 
         return err;
 
@@ -1934,6 +2005,10 @@ static int parse_tc_fdb_actions(struct mlx5e_priv *priv, struct tcf_exts *exts,
 
                 return -EINVAL;
         }
+
+        if (!actions_match_supported(priv, exts, parse_attr, flow))
+                return -EOPNOTSUPP;
+
         return err;
 }
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
index fee43e40fa16..1d6925d4369a 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
@@ -193,6 +193,7 @@ mlx5e_txwqe_build_eseg_csum(struct mlx5e_txqsq *sq, struct sk_buff *skb, struct
                         sq->stats.csum_partial_inner++;
                 } else {
                         eseg->cs_flags |= MLX5_ETH_WQE_L4_CSUM;
+                        sq->stats.csum_partial++;
                 }
         } else
                 sq->stats.csum_none++;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fpga/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/fpga/cmd.c
index e37453d838db..c0fd2212e890 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fpga/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fpga/cmd.c
@@ -71,11 +71,11 @@ int mlx5_fpga_access_reg(struct mlx5_core_dev *dev, u8 size, u64 addr,
         return 0;
 }
 
-int mlx5_fpga_caps(struct mlx5_core_dev *dev, u32 *caps)
+int mlx5_fpga_caps(struct mlx5_core_dev *dev)
 {
         u32 in[MLX5_ST_SZ_DW(fpga_cap)] = {0};
 
-        return mlx5_core_access_reg(dev, in, sizeof(in), caps,
+        return mlx5_core_access_reg(dev, in, sizeof(in), dev->caps.fpga,
                                     MLX5_ST_SZ_BYTES(fpga_cap),
                                     MLX5_REG_FPGA_CAP, 0, 0);
 }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fpga/cmd.h b/drivers/net/ethernet/mellanox/mlx5/core/fpga/cmd.h
index 94bdfd47c3f0..d05233c9b4f6 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fpga/cmd.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fpga/cmd.h
@@ -65,7 +65,7 @@ struct mlx5_fpga_qp_counters {
         u64 rx_total_drop;
 };
 
-int mlx5_fpga_caps(struct mlx5_core_dev *dev, u32 *caps);
+int mlx5_fpga_caps(struct mlx5_core_dev *dev);
 int mlx5_fpga_query(struct mlx5_core_dev *dev, struct mlx5_fpga_query *query);
 int mlx5_fpga_ctrl_op(struct mlx5_core_dev *dev, u8 op);
 int mlx5_fpga_access_reg(struct mlx5_core_dev *dev, u8 size, u64 addr,
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fpga/core.c b/drivers/net/ethernet/mellanox/mlx5/core/fpga/core.c
index 9034e9960a76..dc8970346521 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fpga/core.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fpga/core.c
@@ -139,8 +139,7 @@ int mlx5_fpga_device_start(struct mlx5_core_dev *mdev)
         if (err)
                 goto out;
 
-        err = mlx5_fpga_caps(fdev->mdev,
-                             fdev->mdev->caps.hca_cur[MLX5_CAP_FPGA]);
+        err = mlx5_fpga_caps(fdev->mdev);
         if (err)
                 goto out;
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c
index e0d0efd903bc..36ecc2b2e187 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c
@@ -293,6 +293,9 @@ static int mlx5_cmd_set_fte(struct mlx5_core_dev *dev,
         }
 
         if (fte->action & MLX5_FLOW_CONTEXT_ACTION_COUNT) {
+                int max_list_size = BIT(MLX5_CAP_FLOWTABLE_TYPE(dev,
+                                        log_max_flow_counter,
+                                        ft->type));
                 int list_size = 0;
 
                 list_for_each_entry(dst, &fte->node.children, node.list) {
@@ -305,12 +308,17 @@ static int mlx5_cmd_set_fte(struct mlx5_core_dev *dev,
                         in_dests += MLX5_ST_SZ_BYTES(dest_format_struct);
                         list_size++;
                 }
+                if (list_size > max_list_size) {
+                        err = -EINVAL;
+                        goto err_out;
+                }
 
                 MLX5_SET(flow_context, in_flow_context, flow_counter_list_size,
                          list_size);
         }
 
         err = mlx5_cmd_exec(dev, in, inlen, out, sizeof(out));
+err_out:
         kvfree(in);
         return err;
 }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.h b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.h
index 5509a752f98e..48dd78975062 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.h
@@ -52,6 +52,7 @@ enum fs_flow_table_type {
         FS_FT_FDB             = 0X4,
         FS_FT_SNIFFER_RX        = 0X5,
         FS_FT_SNIFFER_TX        = 0X6,
+        FS_FT_MAX_TYPE = FS_FT_SNIFFER_TX,
 };
 
 enum fs_flow_table_op_mod {
@@ -260,4 +261,14 @@ void mlx5_cleanup_fs(struct mlx5_core_dev *dev);
 #define fs_for_each_dst(pos, fte)                       \
         fs_list_for_each_entry(pos, &(fte)->node.children)
 
+#define MLX5_CAP_FLOWTABLE_TYPE(mdev, cap, type) (              \
+        (type == FS_FT_NIC_RX) ? MLX5_CAP_FLOWTABLE_NIC_RX(mdev, cap) :         \
+        (type == FS_FT_ESW_EGRESS_ACL) ? MLX5_CAP_ESW_EGRESS_ACL(mdev, cap) :           \
+        (type == FS_FT_ESW_INGRESS_ACL) ? MLX5_CAP_ESW_INGRESS_ACL(mdev, cap) :         \
+        (type == FS_FT_FDB) ? MLX5_CAP_ESW_FLOWTABLE_FDB(mdev, cap) :           \
+        (type == FS_FT_SNIFFER_RX) ? MLX5_CAP_FLOWTABLE_SNIFFER_RX(mdev, cap) :         \
+        (type == FS_FT_SNIFFER_TX) ? MLX5_CAP_FLOWTABLE_SNIFFER_TX(mdev, cap) :         \
+        (BUILD_BUG_ON_ZERO(FS_FT_SNIFFER_TX != FS_FT_MAX_TYPE))\
+        )
+
 #endif
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c
index 85298051a3e4..145e392ab849 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c
@@ -572,12 +572,13 @@ void mlx5_rdma_netdev_free(struct net_device *netdev)
 {
         struct mlx5e_priv          *priv    = mlx5i_epriv(netdev);
         const struct mlx5e_profile *profile = priv->profile;
+        struct mlx5_core_dev       *mdev    = priv->mdev;
 
         mlx5e_detach_netdev(priv);
         profile->cleanup(priv);
         destroy_workqueue(priv->wq);
         free_netdev(netdev);
 
-        mlx5e_destroy_mdev_resources(priv->mdev);
+        mlx5e_destroy_mdev_resources(mdev);
 }
 EXPORT_SYMBOL(mlx5_rdma_netdev_free);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/sriov.c b/drivers/net/ethernet/mellanox/mlx5/core/sriov.c
index 6c48e9959b65..2a8b529ce6dd 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/sriov.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/sriov.c
@@ -109,7 +109,7 @@ static int mlx5_device_enable_sriov(struct mlx5_core_dev *dev, int num_vfs)
                                 mlx5_core_warn(dev,
                                                "failed to restore VF %d settings, err %d\n",
                                                vf, err);
-                        continue;
+                                continue;
                         }
                 }
                 mlx5_core_dbg(dev, "successfully enabled VF* %d\n", vf);
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
index 2cfb3f5d092d..032089efc1a0 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
@@ -2723,6 +2723,7 @@ static void mlxsw_sp_nexthop_type_fini(struct mlxsw_sp *mlxsw_sp,
                 mlxsw_sp_nexthop_rif_fini(nh);
                 break;
         case MLXSW_SP_NEXTHOP_TYPE_IPIP:
+                mlxsw_sp_nexthop_rif_fini(nh);
                 mlxsw_sp_nexthop_ipip_fini(mlxsw_sp, nh);
                 break;
         }
@@ -2742,7 +2743,11 @@ static int mlxsw_sp_nexthop4_type_init(struct mlxsw_sp *mlxsw_sp,
             router->ipip_ops_arr[ipipt]->can_offload(mlxsw_sp, dev,
                                                      MLXSW_SP_L3_PROTO_IPV4)) {
                 nh->type = MLXSW_SP_NEXTHOP_TYPE_IPIP;
-                return mlxsw_sp_nexthop_ipip_init(mlxsw_sp, ipipt, nh, dev);
+                err = mlxsw_sp_nexthop_ipip_init(mlxsw_sp, ipipt, nh, dev);
+                if (err)
+                        return err;
+                mlxsw_sp_nexthop_rif_init(nh, &nh->ipip_entry->ol_lb->common);
+                return 0;
         }
 
         nh->type = MLXSW_SP_NEXTHOP_TYPE_ETH;
@@ -4009,7 +4014,11 @@ static int mlxsw_sp_nexthop6_type_init(struct mlxsw_sp *mlxsw_sp,
             router->ipip_ops_arr[ipipt]->can_offload(mlxsw_sp, dev,
                                                      MLXSW_SP_L3_PROTO_IPV6)) {
                 nh->type = MLXSW_SP_NEXTHOP_TYPE_IPIP;
-                return mlxsw_sp_nexthop_ipip_init(mlxsw_sp, ipipt, nh, dev);
+                err = mlxsw_sp_nexthop_ipip_init(mlxsw_sp, ipipt, nh, dev);
+                if (err)
+                        return err;
+                mlxsw_sp_nexthop_rif_init(nh, &nh->ipip_entry->ol_lb->common);
+                return 0;
         }
 
         nh->type = MLXSW_SP_NEXTHOP_TYPE_ETH;
@@ -5068,6 +5077,7 @@ mlxsw_sp_rif_create(struct mlxsw_sp *mlxsw_sp,
         vr = mlxsw_sp_vr_get(mlxsw_sp, tb_id ? : RT_TABLE_MAIN);
         if (IS_ERR(vr))
                 return ERR_CAST(vr);
+        vr->rif_count++;
 
         err = mlxsw_sp_rif_index_alloc(mlxsw_sp, &rif_index);
         if (err)
@@ -5099,7 +5109,6 @@ mlxsw_sp_rif_create(struct mlxsw_sp *mlxsw_sp,
 
         mlxsw_sp_rif_counters_alloc(rif);
         mlxsw_sp->router->rifs[rif_index] = rif;
-        vr->rif_count++;
 
         return rif;
 
@@ -5110,6 +5119,7 @@ err_fid_get:
         kfree(rif);
 err_rif_alloc:
 err_rif_index_alloc:
+        vr->rif_count--;
         mlxsw_sp_vr_put(vr);
         return ERR_PTR(err);
 }
@@ -5124,7 +5134,6 @@ void mlxsw_sp_rif_destroy(struct mlxsw_sp_rif *rif)
         mlxsw_sp_router_rif_gone_sync(mlxsw_sp, rif);
         vr = &mlxsw_sp->router->vrs[rif->vr_id];
 
-        vr->rif_count--;
         mlxsw_sp->router->rifs[rif->rif_index] = NULL;
         mlxsw_sp_rif_counters_free(rif);
         ops->deconfigure(rif);
@@ -5132,6 +5141,7 @@ void mlxsw_sp_rif_destroy(struct mlxsw_sp_rif *rif)
                 /* Loopback RIFs are not associated with a FID. */
                 mlxsw_sp_fid_put(fid);
         kfree(rif);
+        vr->rif_count--;
         mlxsw_sp_vr_put(vr);
 }
 
diff --git a/drivers/net/ethernet/qualcomm/emac/emac-ethtool.c b/drivers/net/ethernet/qualcomm/emac/emac-ethtool.c
index bbe24639aa5a..c8c6231b87f3 100644
--- a/drivers/net/ethernet/qualcomm/emac/emac-ethtool.c
+++ b/drivers/net/ethernet/qualcomm/emac/emac-ethtool.c
@@ -88,6 +88,8 @@ static void emac_set_msglevel(struct net_device *netdev, u32 data)
 static int emac_get_sset_count(struct net_device *netdev, int sset)
 {
         switch (sset) {
+        case ETH_SS_PRIV_FLAGS:
+                return 1;
         case ETH_SS_STATS:
                 return EMAC_STATS_LEN;
         default:
@@ -100,6 +102,10 @@ static void emac_get_strings(struct net_device *netdev, u32 stringset, u8 *data)
         unsigned int i;
 
         switch (stringset) {
+        case ETH_SS_PRIV_FLAGS:
+                strcpy(data, "single-pause-mode");
+                break;
+
         case ETH_SS_STATS:
                 for (i = 0; i < EMAC_STATS_LEN; i++) {
                         strlcpy(data, emac_ethtool_stat_strings[i],
@@ -230,6 +236,27 @@ static int emac_get_regs_len(struct net_device *netdev)
         return EMAC_MAX_REG_SIZE * sizeof(u32);
 }
 
+#define EMAC_PRIV_ENABLE_SINGLE_PAUSE   BIT(0)
+
+static int emac_set_priv_flags(struct net_device *netdev, u32 flags)
+{
+        struct emac_adapter *adpt = netdev_priv(netdev);
+
+        adpt->single_pause_mode = !!(flags & EMAC_PRIV_ENABLE_SINGLE_PAUSE);
+
+        if (netif_running(netdev))
+                return emac_reinit_locked(adpt);
+
+        return 0;
+}
+
+static u32 emac_get_priv_flags(struct net_device *netdev)
+{
+        struct emac_adapter *adpt = netdev_priv(netdev);
+
+        return adpt->single_pause_mode ? EMAC_PRIV_ENABLE_SINGLE_PAUSE : 0;
+}
+
 static const struct ethtool_ops emac_ethtool_ops = {
         .get_link_ksettings = phy_ethtool_get_link_ksettings,
         .set_link_ksettings = phy_ethtool_set_link_ksettings,
@@ -253,6 +280,9 @@ static const struct ethtool_ops emac_ethtool_ops = {
 
         .get_regs_len    = emac_get_regs_len,
         .get_regs        = emac_get_regs,
+
+        .set_priv_flags = emac_set_priv_flags,
+        .get_priv_flags = emac_get_priv_flags,
 };
 
 void emac_set_ethtool_ops(struct net_device *netdev)
diff --git a/drivers/net/ethernet/qualcomm/emac/emac-mac.c b/drivers/net/ethernet/qualcomm/emac/emac-mac.c
index bcd4708b3745..3ed9033e56db 100644
--- a/drivers/net/ethernet/qualcomm/emac/emac-mac.c
+++ b/drivers/net/ethernet/qualcomm/emac/emac-mac.c
@@ -551,6 +551,28 @@ static void emac_mac_start(struct emac_adapter *adpt)
         mac &= ~(HUGEN | VLAN_STRIP | TPAUSE | SIMR | HUGE | MULTI_ALL |
                  DEBUG_MODE | SINGLE_PAUSE_MODE);
 
+        /* Enable single-pause-frame mode if requested.
+         *
+         * If enabled, the EMAC will send a single pause frame when the RX
+         * queue is full.  This normally leads to packet loss because
+         * the pause frame disables the remote MAC only for 33ms (the quanta),
+         * and then the remote MAC continues sending packets even though
+         * the RX queue is still full.
+         *
+         * If disabled, the EMAC sends a pause frame every 31ms until the RX
+         * queue is no longer full.  Normally, this is the preferred
+         * method of operation.  However, when the system is hung (e.g.
+         * cores are halted), the EMAC interrupt handler is never called
+         * and so the RX queue fills up quickly and stays full.  The resuling
+         * non-stop "flood" of pause frames sometimes has the effect of
+         * disabling nearby switches.  In some cases, other nearby switches
+         * are also affected, shutting down the entire network.
+         *
+         * The user can enable or disable single-pause-frame mode
+         * via ethtool.
+         */
+        mac |= adpt->single_pause_mode ? SINGLE_PAUSE_MODE : 0;
+
         writel_relaxed(csr1, adpt->csr + EMAC_EMAC_WRAPPER_CSR1);
 
         writel_relaxed(mac, adpt->base + EMAC_MAC_CTRL);
@@ -876,7 +898,8 @@ static void emac_mac_rx_descs_refill(struct emac_adapter *adpt,
 
                 curr_rxbuf->dma_addr =
                         dma_map_single(adpt->netdev->dev.parent, skb->data,
-                                       curr_rxbuf->length, DMA_FROM_DEVICE);
+                                       adpt->rxbuf_size, DMA_FROM_DEVICE);
+
                 ret = dma_mapping_error(adpt->netdev->dev.parent,
                                         curr_rxbuf->dma_addr);
                 if (ret) {
diff --git a/drivers/net/ethernet/qualcomm/emac/emac.c b/drivers/net/ethernet/qualcomm/emac/emac.c
index 60850bfa3d32..759543512117 100644
--- a/drivers/net/ethernet/qualcomm/emac/emac.c
+++ b/drivers/net/ethernet/qualcomm/emac/emac.c
@@ -443,6 +443,9 @@ static void emac_init_adapter(struct emac_adapter *adpt)
 
         /* default to automatic flow control */
         adpt->automatic = true;
+
+        /* Disable single-pause-frame mode by default */
+        adpt->single_pause_mode = false;
 }
 
 /* Get the clock */
diff --git a/drivers/net/ethernet/qualcomm/emac/emac.h b/drivers/net/ethernet/qualcomm/emac/emac.h
index 8ee4ec6aef2e..d7c9f44209d4 100644
--- a/drivers/net/ethernet/qualcomm/emac/emac.h
+++ b/drivers/net/ethernet/qualcomm/emac/emac.h
@@ -363,6 +363,9 @@ struct emac_adapter {
         bool                            tx_flow_control;
         bool                            rx_flow_control;
 
+        /* True == use single-pause-frame mode. */
+        bool                            single_pause_mode;
+
         /* Ring parameter */
         u8                              tpd_burst;
         u8                              rfd_burst;
diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
index 98f22551eb45..1e33aea59f50 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
@@ -51,10 +51,7 @@ struct rmnet_walk_data {
 
 static int rmnet_is_real_dev_registered(const struct net_device *real_dev)
 {
-        rx_handler_func_t *rx_handler;
-
-        rx_handler = rcu_dereference(real_dev->rx_handler);
-        return (rx_handler == rmnet_rx_handler);
+        return rcu_access_pointer(real_dev->rx_handler) == rmnet_rx_handler;
 }
 
 /* Needs rtnl lock */
diff --git a/drivers/net/ethernet/realtek/8139too.c b/drivers/net/ethernet/realtek/8139too.c
index ca22f2898664..d24b47b8e0b2 100644
--- a/drivers/net/ethernet/realtek/8139too.c
+++ b/drivers/net/ethernet/realtek/8139too.c
@@ -2135,11 +2135,12 @@ static int rtl8139_poll(struct napi_struct *napi, int budget)
         if (likely(RTL_R16(IntrStatus) & RxAckBits))
                 work_done += rtl8139_rx(dev, tp, budget);
 
-        if (work_done < budget && napi_complete_done(napi, work_done)) {
+        if (work_done < budget) {
                 unsigned long flags;
 
                 spin_lock_irqsave(&tp->lock, flags);
-                RTL_W16_F(IntrMask, rtl8139_intr_mask);
+                if (napi_complete_done(napi, work_done))
+                        RTL_W16_F(IntrMask, rtl8139_intr_mask);
                 spin_unlock_irqrestore(&tp->lock, flags);
         }
         spin_unlock(&tp->rx_lock);
diff --git a/drivers/net/ethernet/rocker/rocker_tlv.h b/drivers/net/ethernet/rocker/rocker_tlv.h
index a63ef82e7c72..dfae3c9d57c6 100644
--- a/drivers/net/ethernet/rocker/rocker_tlv.h
+++ b/drivers/net/ethernet/rocker/rocker_tlv.h
@@ -139,40 +139,52 @@ rocker_tlv_start(struct rocker_desc_info *desc_info)
 int rocker_tlv_put(struct rocker_desc_info *desc_info,
                    int attrtype, int attrlen, const void *data);
 
-static inline int rocker_tlv_put_u8(struct rocker_desc_info *desc_info,
-                                    int attrtype, u8 value)
+static inline int
+rocker_tlv_put_u8(struct rocker_desc_info *desc_info, int attrtype, u8 value)
 {
-        return rocker_tlv_put(desc_info, attrtype, sizeof(u8), &value);
+        u8 tmp = value; /* work around GCC PR81715 */
+
+        return rocker_tlv_put(desc_info, attrtype, sizeof(u8), &tmp);
 }
 
-static inline int rocker_tlv_put_u16(struct rocker_desc_info *desc_info,
-                                     int attrtype, u16 value)
+static inline int
+rocker_tlv_put_u16(struct rocker_desc_info *desc_info, int attrtype, u16 value)
 {
-        return rocker_tlv_put(desc_info, attrtype, sizeof(u16), &value);
+        u16 tmp = value;
+
+        return rocker_tlv_put(desc_info, attrtype, sizeof(u16), &tmp);
 }
 
-static inline int rocker_tlv_put_be16(struct rocker_desc_info *desc_info,
-                                      int attrtype, __be16 value)
+static inline int
+rocker_tlv_put_be16(struct rocker_desc_info *desc_info, int attrtype, __be16 value)
 {
-        return rocker_tlv_put(desc_info, attrtype, sizeof(__be16), &value);
+        __be16 tmp = value;
+
+        return rocker_tlv_put(desc_info, attrtype, sizeof(__be16), &tmp);
 }
 
-static inline int rocker_tlv_put_u32(struct rocker_desc_info *desc_info,
-                                     int attrtype, u32 value)
+static inline int
+rocker_tlv_put_u32(struct rocker_desc_info *desc_info, int attrtype, u32 value)
 {
-        return rocker_tlv_put(desc_info, attrtype, sizeof(u32), &value);
+        u32 tmp = value;
+
+        return rocker_tlv_put(desc_info, attrtype, sizeof(u32), &tmp);
 }
 
-static inline int rocker_tlv_put_be32(struct rocker_desc_info *desc_info,
-                                      int attrtype, __be32 value)
+static inline int
+rocker_tlv_put_be32(struct rocker_desc_info *desc_info, int attrtype, __be32 value)
 {
-        return rocker_tlv_put(desc_info, attrtype, sizeof(__be32), &value);
+        __be32 tmp = value;
+
+        return rocker_tlv_put(desc_info, attrtype, sizeof(__be32), &tmp);
 }
 
-static inline int rocker_tlv_put_u64(struct rocker_desc_info *desc_info,
-                                     int attrtype, u64 value)
+static inline int
+rocker_tlv_put_u64(struct rocker_desc_info *desc_info, int attrtype, u64 value)
 {
-        return rocker_tlv_put(desc_info, attrtype, sizeof(u64), &value);
+        u64 tmp = value;
+
+        return rocker_tlv_put(desc_info, attrtype, sizeof(u64), &tmp);
 }
 
 static inline struct rocker_tlv *
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-dwc-qos-eth.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-dwc-qos-eth.c
index dd6a2f9791cc..5efef8001edf 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-dwc-qos-eth.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-dwc-qos-eth.c
@@ -511,6 +511,7 @@ static struct platform_driver dwc_eth_dwmac_driver = {
         .remove = dwc_eth_dwmac_remove,
         .driver = {
                 .name           = "dwc-eth-dwmac",
+                .pm             = &stmmac_pltfr_pm_ops,
                 .of_match_table = dwc_eth_dwmac_match,
         },
 };
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c
index 99823f54696a..13133b30b575 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c
@@ -83,6 +83,117 @@ struct rk_priv_data {
         (((tx) ? soc##_GMAC_TXCLK_DLY_ENABLE : soc##_GMAC_TXCLK_DLY_DISABLE) | \
          ((rx) ? soc##_GMAC_RXCLK_DLY_ENABLE : soc##_GMAC_RXCLK_DLY_DISABLE))
 
+#define RK3128_GRF_MAC_CON0     0x0168
+#define RK3128_GRF_MAC_CON1     0x016c
+
+/* RK3128_GRF_MAC_CON0 */
+#define RK3128_GMAC_TXCLK_DLY_ENABLE   GRF_BIT(14)
+#define RK3128_GMAC_TXCLK_DLY_DISABLE  GRF_CLR_BIT(14)
+#define RK3128_GMAC_RXCLK_DLY_ENABLE   GRF_BIT(15)
+#define RK3128_GMAC_RXCLK_DLY_DISABLE  GRF_CLR_BIT(15)
+#define RK3128_GMAC_CLK_RX_DL_CFG(val) HIWORD_UPDATE(val, 0x7F, 7)
+#define RK3128_GMAC_CLK_TX_DL_CFG(val) HIWORD_UPDATE(val, 0x7F, 0)
+
+/* RK3128_GRF_MAC_CON1 */
+#define RK3128_GMAC_PHY_INTF_SEL_RGMII  \
+                (GRF_BIT(6) | GRF_CLR_BIT(7) | GRF_CLR_BIT(8))
+#define RK3128_GMAC_PHY_INTF_SEL_RMII   \
+                (GRF_CLR_BIT(6) | GRF_CLR_BIT(7) | GRF_BIT(8))
+#define RK3128_GMAC_FLOW_CTRL          GRF_BIT(9)
+#define RK3128_GMAC_FLOW_CTRL_CLR      GRF_CLR_BIT(9)
+#define RK3128_GMAC_SPEED_10M          GRF_CLR_BIT(10)
+#define RK3128_GMAC_SPEED_100M         GRF_BIT(10)
+#define RK3128_GMAC_RMII_CLK_25M       GRF_BIT(11)
+#define RK3128_GMAC_RMII_CLK_2_5M      GRF_CLR_BIT(11)
+#define RK3128_GMAC_CLK_125M           (GRF_CLR_BIT(12) | GRF_CLR_BIT(13))
+#define RK3128_GMAC_CLK_25M            (GRF_BIT(12) | GRF_BIT(13))
+#define RK3128_GMAC_CLK_2_5M           (GRF_CLR_BIT(12) | GRF_BIT(13))
+#define RK3128_GMAC_RMII_MODE          GRF_BIT(14)
+#define RK3128_GMAC_RMII_MODE_CLR      GRF_CLR_BIT(14)
+
+static void rk3128_set_to_rgmii(struct rk_priv_data *bsp_priv,
+                                int tx_delay, int rx_delay)
+{
+        struct device *dev = &bsp_priv->pdev->dev;
+
+        if (IS_ERR(bsp_priv->grf)) {
+                dev_err(dev, "Missing rockchip,grf property\n");
+                return;
+        }
+
+        regmap_write(bsp_priv->grf, RK3128_GRF_MAC_CON1,
+                     RK3128_GMAC_PHY_INTF_SEL_RGMII |
+                     RK3128_GMAC_RMII_MODE_CLR);
+        regmap_write(bsp_priv->grf, RK3128_GRF_MAC_CON0,
+                     DELAY_ENABLE(RK3128, tx_delay, rx_delay) |
+                     RK3128_GMAC_CLK_RX_DL_CFG(rx_delay) |
+                     RK3128_GMAC_CLK_TX_DL_CFG(tx_delay));
+}
+
+static void rk3128_set_to_rmii(struct rk_priv_data *bsp_priv)
+{
+        struct device *dev = &bsp_priv->pdev->dev;
+
+        if (IS_ERR(bsp_priv->grf)) {
+                dev_err(dev, "Missing rockchip,grf property\n");
+                return;
+        }
+
+        regmap_write(bsp_priv->grf, RK3128_GRF_MAC_CON1,
+                     RK3128_GMAC_PHY_INTF_SEL_RMII | RK3128_GMAC_RMII_MODE);
+}
+
+static void rk3128_set_rgmii_speed(struct rk_priv_data *bsp_priv, int speed)
+{
+        struct device *dev = &bsp_priv->pdev->dev;
+
+        if (IS_ERR(bsp_priv->grf)) {
+                dev_err(dev, "Missing rockchip,grf property\n");
+                return;
+        }
+
+        if (speed == 10)
+                regmap_write(bsp_priv->grf, RK3128_GRF_MAC_CON1,
+                             RK3128_GMAC_CLK_2_5M);
+        else if (speed == 100)
+                regmap_write(bsp_priv->grf, RK3128_GRF_MAC_CON1,
+                             RK3128_GMAC_CLK_25M);
+        else if (speed == 1000)
+                regmap_write(bsp_priv->grf, RK3128_GRF_MAC_CON1,
+                             RK3128_GMAC_CLK_125M);
+        else
+                dev_err(dev, "unknown speed value for RGMII! speed=%d", speed);
+}
+
+static void rk3128_set_rmii_speed(struct rk_priv_data *bsp_priv, int speed)
+{
+        struct device *dev = &bsp_priv->pdev->dev;
+
+        if (IS_ERR(bsp_priv->grf)) {
+                dev_err(dev, "Missing rockchip,grf property\n");
+                return;
+        }
+
+        if (speed == 10) {
+                regmap_write(bsp_priv->grf, RK3128_GRF_MAC_CON1,
+                             RK3128_GMAC_RMII_CLK_2_5M |
+                             RK3128_GMAC_SPEED_10M);
+        } else if (speed == 100) {
+                regmap_write(bsp_priv->grf, RK3128_GRF_MAC_CON1,
+                             RK3128_GMAC_RMII_CLK_25M |
+                             RK3128_GMAC_SPEED_100M);
+        } else {
+                dev_err(dev, "unknown speed value for RMII! speed=%d", speed);
+        }
+}
+
+static const struct rk_gmac_ops rk3128_ops = {
+        .set_to_rgmii = rk3128_set_to_rgmii,
+        .set_to_rmii = rk3128_set_to_rmii,
+        .set_rgmii_speed = rk3128_set_rgmii_speed,
+        .set_rmii_speed = rk3128_set_rmii_speed,
+};
+
 #define RK3228_GRF_MAC_CON0     0x0900
 #define RK3228_GRF_MAC_CON1     0x0904
 
@@ -1313,6 +1424,7 @@ static int rk_gmac_resume(struct device *dev)
 static SIMPLE_DEV_PM_OPS(rk_gmac_pm_ops, rk_gmac_suspend, rk_gmac_resume);
 
 static const struct of_device_id rk_gmac_dwmac_match[] = {
+        { .compatible = "rockchip,rk3128-gmac", .data = &rk3128_ops },
         { .compatible = "rockchip,rk3228-gmac", .data = &rk3228_ops },
         { .compatible = "rockchip,rk3288-gmac", .data = &rk3288_ops },
         { .compatible = "rockchip,rk3328-gmac", .data = &rk3328_ops },
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
index c4407e8e39a3..2f7d7ec59962 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
@@ -296,6 +296,7 @@ static void dwmac4_pmt(struct mac_device_info *hw, unsigned long mode)
 {
         void __iomem *ioaddr = hw->pcsr;
         unsigned int pmt = 0;
+        u32 config;
 
         if (mode & WAKE_MAGIC) {
                 pr_debug("GMAC: WOL Magic frame\n");
@@ -306,6 +307,12 @@ static void dwmac4_pmt(struct mac_device_info *hw, unsigned long mode)
                 pmt |= power_down | global_unicast | wake_up_frame_en;
         }
 
+        if (pmt) {
+                /* The receiver must be enabled for WOL before powering down */
+                config = readl(ioaddr + GMAC_CONFIG);
+                config |= GMAC_CONFIG_RE;
+                writel(config, ioaddr + GMAC_CONFIG);
+        }
         writel(pmt, ioaddr + GMAC_PMT);
 }
 
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
index a366b3747eeb..8a280b48e3a9 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
@@ -315,6 +315,7 @@ static int stmmac_dt_phy(struct plat_stmmacenet_data *plat,
                 { .compatible = "allwinner,sun8i-h3-emac" },
                 { .compatible = "allwinner,sun8i-v3s-emac" },
                 { .compatible = "allwinner,sun50i-a64-emac" },
+                {},
         };
 
         /* If phy-handle property is passed from DT, use it as the PHY */
diff --git a/drivers/net/hyperv/hyperv_net.h b/drivers/net/hyperv/hyperv_net.h
index d98cdfb1536b..5176be76ca7d 100644
--- a/drivers/net/hyperv/hyperv_net.h
+++ b/drivers/net/hyperv/hyperv_net.h
@@ -150,6 +150,8 @@ struct netvsc_device_info {
         u32  num_chn;
         u32  send_sections;
         u32  recv_sections;
+        u32  send_section_size;
+        u32  recv_section_size;
 };
 
 enum rndis_device_state {
diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c
index a5511b7326af..8d5077fb0492 100644
--- a/drivers/net/hyperv/netvsc.c
+++ b/drivers/net/hyperv/netvsc.c
@@ -76,9 +76,6 @@ static struct netvsc_device *alloc_net_device(void)
         net_device->max_pkt = RNDIS_MAX_PKT_DEFAULT;
         net_device->pkt_align = RNDIS_PKT_ALIGN_DEFAULT;
 
-        net_device->recv_section_size = NETVSC_RECV_SECTION_SIZE;
-        net_device->send_section_size = NETVSC_SEND_SECTION_SIZE;
-
         init_completion(&net_device->channel_init_wait);
         init_waitqueue_head(&net_device->subchan_open);
         INIT_WORK(&net_device->subchan_work, rndis_set_subchannel);
@@ -262,7 +259,7 @@ static int netvsc_init_buf(struct hv_device *device,
         int ret = 0;
 
         /* Get receive buffer area. */
-        buf_size = device_info->recv_sections * net_device->recv_section_size;
+        buf_size = device_info->recv_sections * device_info->recv_section_size;
         buf_size = roundup(buf_size, PAGE_SIZE);
 
         net_device->recv_buf = vzalloc(buf_size);
@@ -344,7 +341,7 @@ static int netvsc_init_buf(struct hv_device *device,
                 goto cleanup;
 
         /* Now setup the send buffer. */
-        buf_size = device_info->send_sections * net_device->send_section_size;
+        buf_size = device_info->send_sections * device_info->send_section_size;
         buf_size = round_up(buf_size, PAGE_SIZE);
 
         net_device->send_buf = vzalloc(buf_size);
diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index d4902ee5f260..a32ae02e1b6c 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -848,7 +848,9 @@ static int netvsc_set_channels(struct net_device *net,
         device_info.num_chn = count;
         device_info.ring_size = ring_size;
         device_info.send_sections = nvdev->send_section_cnt;
+        device_info.send_section_size = nvdev->send_section_size;
         device_info.recv_sections = nvdev->recv_section_cnt;
+        device_info.recv_section_size = nvdev->recv_section_size;
 
         rndis_filter_device_remove(dev, nvdev);
 
@@ -963,7 +965,9 @@ static int netvsc_change_mtu(struct net_device *ndev, int mtu)
         device_info.ring_size = ring_size;
         device_info.num_chn = nvdev->num_chn;
         device_info.send_sections = nvdev->send_section_cnt;
+        device_info.send_section_size = nvdev->send_section_size;
         device_info.recv_sections = nvdev->recv_section_cnt;
+        device_info.recv_section_size = nvdev->recv_section_size;
 
         rndis_filter_device_remove(hdev, nvdev);
 
@@ -1485,7 +1489,9 @@ static int netvsc_set_ringparam(struct net_device *ndev,
         device_info.num_chn = nvdev->num_chn;
         device_info.ring_size = ring_size;
         device_info.send_sections = new_tx;
+        device_info.send_section_size = nvdev->send_section_size;
         device_info.recv_sections = new_rx;
+        device_info.recv_section_size = nvdev->recv_section_size;
 
         netif_device_detach(ndev);
         was_opened = rndis_filter_opened(nvdev);
@@ -1934,7 +1940,9 @@ static int netvsc_probe(struct hv_device *dev,
         device_info.ring_size = ring_size;
         device_info.num_chn = VRSS_CHANNEL_DEFAULT;
         device_info.send_sections = NETVSC_DEFAULT_TX;
+        device_info.send_section_size = NETVSC_SEND_SECTION_SIZE;
         device_info.recv_sections = NETVSC_DEFAULT_RX;
+        device_info.recv_section_size = NETVSC_RECV_SECTION_SIZE;
 
         nvdev = rndis_filter_device_add(dev, &device_info);
         if (IS_ERR(nvdev)) {
diff --git a/drivers/net/phy/Kconfig b/drivers/net/phy/Kconfig
index a9d16a3af514..cd931cf9dcc2 100644
--- a/drivers/net/phy/Kconfig
+++ b/drivers/net/phy/Kconfig
@@ -160,15 +160,6 @@ config MDIO_XGENE
 
 endif
 
-menuconfig PHYLIB
-        tristate "PHY Device support and infrastructure"
-        depends on NETDEVICES
-        select MDIO_DEVICE
-        help
-          Ethernet controllers are usually attached to PHY
-          devices.  This option provides infrastructure for
-          managing PHY devices.
-
 config PHYLINK
         tristate
         depends on NETDEVICES
@@ -179,6 +170,15 @@ config PHYLINK
           configuration links, PHYs, and Serdes links with MAC level
           autonegotiation modes.
 
+menuconfig PHYLIB
+        tristate "PHY Device support and infrastructure"
+        depends on NETDEVICES
+        select MDIO_DEVICE
+        help
+          Ethernet controllers are usually attached to PHY
+          devices.  This option provides infrastructure for
+          managing PHY devices.
+
 if PHYLIB
 
 config SWPHY
diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
index e842d2cd1ee7..2b1e67bc1e73 100644
--- a/drivers/net/phy/phy.c
+++ b/drivers/net/phy/phy.c
@@ -373,7 +373,8 @@ void phy_ethtool_ksettings_get(struct phy_device *phydev,
                 cmd->base.port = PORT_BNC;
         else
                 cmd->base.port = PORT_MII;
-
+        cmd->base.transceiver = phy_is_internal(phydev) ?
+                                XCVR_INTERNAL : XCVR_EXTERNAL;
         cmd->base.phy_address = phydev->mdio.addr;
         cmd->base.autoneg = phydev->autoneg;
         cmd->base.eth_tp_mdix_ctrl = phydev->mdix_ctrl;
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index 8cf0c5901f95..67f25ac29025 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -879,7 +879,7 @@ void phy_attached_print(struct phy_device *phydev, const char *fmt, ...)
 {
         const char *drv_name = phydev->drv ? phydev->drv->name : "unbound";
         char *irq_str;
-        char irq_num[4];
+        char irq_num[8];
 
         switch(phydev->irq) {
         case PHY_POLL:
diff --git a/drivers/net/phy/xilinx_gmii2rgmii.c b/drivers/net/phy/xilinx_gmii2rgmii.c
index d15dd3938ba8..2e5150b0b8d5 100644
--- a/drivers/net/phy/xilinx_gmii2rgmii.c
+++ b/drivers/net/phy/xilinx_gmii2rgmii.c
@@ -44,7 +44,7 @@ static int xgmiitorgmii_read_status(struct phy_device *phydev)
         priv->phy_drv->read_status(phydev);
 
         val = mdiobus_read(phydev->mdio.bus, priv->addr, XILINX_GMII2RGMII_REG);
-        val &= XILINX_GMII2RGMII_SPEED_MASK;
+        val &= ~XILINX_GMII2RGMII_SPEED_MASK;
 
         if (phydev->speed == SPEED_1000)
                 val |= BMCR_SPEED1000;
diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
index a404552555d4..c3f77e3b7819 100644
--- a/drivers/net/ppp/ppp_generic.c
+++ b/drivers/net/ppp/ppp_generic.c
@@ -120,7 +120,7 @@ struct ppp {
         int             n_channels;     /* how many channels are attached 54 */
         spinlock_t      rlock;          /* lock for receive side 58 */
         spinlock_t      wlock;          /* lock for transmit side 5c */
-        int             *xmit_recursion __percpu; /* xmit recursion detect */
+        int __percpu    *xmit_recursion; /* xmit recursion detect */
         int             mru;            /* max receive unit 60 */
         unsigned int    flags;          /* control bits 64 */
         unsigned int    xstate;         /* transmit state bits 68 */
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 3c9985f29950..5ce580f413b9 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1496,11 +1496,13 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
         switch (tun->flags & TUN_TYPE_MASK) {
         case IFF_TUN:
                 if (tun->flags & IFF_NO_PI) {
-                        switch (skb->data[0] & 0xf0) {
-                        case 0x40:
+                        u8 ip_version = skb->len ? (skb->data[0] >> 4) : 0;
+
+                        switch (ip_version) {
+                        case 4:
                                 pi.proto = htons(ETH_P_IP);
                                 break;
-                        case 0x60:
+                        case 6:
                                 pi.proto = htons(ETH_P_IPV6);
                                 break;
                         default:
diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
index 8ab281b478f2..29c7e2ec0dcb 100644
--- a/drivers/net/usb/cdc_ether.c
+++ b/drivers/net/usb/cdc_ether.c
@@ -54,11 +54,19 @@ static int is_wireless_rndis(struct usb_interface_descriptor *desc)
                 desc->bInterfaceProtocol == 3);
 }
 
+static int is_novatel_rndis(struct usb_interface_descriptor *desc)
+{
+        return (desc->bInterfaceClass == USB_CLASS_MISC &&
+                desc->bInterfaceSubClass == 4 &&
+                desc->bInterfaceProtocol == 1);
+}
+
 #else
 
 #define is_rndis(desc)          0
 #define is_activesync(desc)     0
 #define is_wireless_rndis(desc) 0
+#define is_novatel_rndis(desc)  0
 
 #endif
 
@@ -150,7 +158,8 @@ int usbnet_generic_cdc_bind(struct usbnet *dev, struct usb_interface *intf)
          */
         rndis = (is_rndis(&intf->cur_altsetting->desc) ||
                  is_activesync(&intf->cur_altsetting->desc) ||
-                 is_wireless_rndis(&intf->cur_altsetting->desc));
+                 is_wireless_rndis(&intf->cur_altsetting->desc) ||
+                 is_novatel_rndis(&intf->cur_altsetting->desc));
 
         memset(info, 0, sizeof(*info));
         info->control = intf;
@@ -547,6 +556,7 @@ static const struct driver_info wwan_info = {
 #define REALTEK_VENDOR_ID       0x0bda
 #define SAMSUNG_VENDOR_ID       0x04e8
 #define LENOVO_VENDOR_ID        0x17ef
+#define LINKSYS_VENDOR_ID       0x13b1
 #define NVIDIA_VENDOR_ID        0x0955
 #define HP_VENDOR_ID            0x03f0
 #define MICROSOFT_VENDOR_ID     0x045e
@@ -737,6 +747,15 @@ static const struct usb_device_id	products[] = {
         .driver_info = 0,
 },
 
+#if IS_ENABLED(CONFIG_USB_RTL8152)
+/* Linksys USB3GIGV1 Ethernet Adapter */
+{
+        USB_DEVICE_AND_INTERFACE_INFO(LINKSYS_VENDOR_ID, 0x0041, USB_CLASS_COMM,
+                        USB_CDC_SUBCLASS_ETHERNET, USB_CDC_PROTO_NONE),
+        .driver_info = 0,
+},
+#endif
+
 /* ThinkPad USB-C Dock (based on Realtek RTL8153) */
 {
         USB_DEVICE_AND_INTERFACE_INFO(LENOVO_VENDOR_ID, 0x3062, USB_CLASS_COMM,
diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
index b99a7fb09f8e..0161f77641fa 100644
--- a/drivers/net/usb/lan78xx.c
+++ b/drivers/net/usb/lan78xx.c
@@ -1265,30 +1265,45 @@ static int lan78xx_ethtool_get_eeprom(struct net_device *netdev,
                                       struct ethtool_eeprom *ee, u8 *data)
 {
         struct lan78xx_net *dev = netdev_priv(netdev);
+        int ret;
+
+        ret = usb_autopm_get_interface(dev->intf);
+        if (ret)
+                return ret;
 
         ee->magic = LAN78XX_EEPROM_MAGIC;
 
-        return lan78xx_read_raw_eeprom(dev, ee->offset, ee->len, data);
+        ret = lan78xx_read_raw_eeprom(dev, ee->offset, ee->len, data);
+
+        usb_autopm_put_interface(dev->intf);
+
+        return ret;
 }
 
 static int lan78xx_ethtool_set_eeprom(struct net_device *netdev,
                                       struct ethtool_eeprom *ee, u8 *data)
 {
         struct lan78xx_net *dev = netdev_priv(netdev);
+        int ret;
+
+        ret = usb_autopm_get_interface(dev->intf);
+        if (ret)
+                return ret;
 
-        /* Allow entire eeprom update only */
-        if ((ee->magic == LAN78XX_EEPROM_MAGIC) &&
-            (ee->offset == 0) &&
-            (ee->len == 512) &&
-            (data[0] == EEPROM_INDICATOR))
-                return lan78xx_write_raw_eeprom(dev, ee->offset, ee->len, data);
+        /* Invalid EEPROM_INDICATOR at offset zero will result in a failure
+         * to load data from EEPROM
+         */
+        if (ee->magic == LAN78XX_EEPROM_MAGIC)
+                ret = lan78xx_write_raw_eeprom(dev, ee->offset, ee->len, data);
         else if ((ee->magic == LAN78XX_OTP_MAGIC) &&
                  (ee->offset == 0) &&
                  (ee->len == 512) &&
                  (data[0] == OTP_INDICATOR_1))
-                return lan78xx_write_raw_otp(dev, ee->offset, ee->len, data);
+                ret = lan78xx_write_raw_otp(dev, ee->offset, ee->len, data);
+
+        usb_autopm_put_interface(dev->intf);
 
-        return -EINVAL;
+        return ret;
 }
 
 static void lan78xx_get_strings(struct net_device *netdev, u32 stringset,
@@ -2434,7 +2449,6 @@ static int lan78xx_reset(struct lan78xx_net *dev)
         /* LAN7801 only has RGMII mode */
         if (dev->chipid == ID_REV_CHIP_ID_7801_)
                 buf &= ~MAC_CR_GMII_EN_;
-        buf |= MAC_CR_AUTO_DUPLEX_ | MAC_CR_AUTO_SPEED_;
         ret = lan78xx_write_reg(dev, MAC_CR, buf);
 
         ret = lan78xx_read_reg(dev, MAC_TX, &buf);
diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index ceb78e2ea4f0..941ece08ba78 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -613,6 +613,7 @@ enum rtl8152_flags {
 #define VENDOR_ID_MICROSOFT             0x045e
 #define VENDOR_ID_SAMSUNG               0x04e8
 #define VENDOR_ID_LENOVO                0x17ef
+#define VENDOR_ID_LINKSYS               0x13b1
 #define VENDOR_ID_NVIDIA                0x0955
 
 #define MCU_TYPE_PLA                    0x0100
@@ -5316,6 +5317,7 @@ static const struct usb_device_id rtl8152_table[] = {
         {REALTEK_USB_DEVICE(VENDOR_ID_LENOVO,  0x7205)},
         {REALTEK_USB_DEVICE(VENDOR_ID_LENOVO,  0x720c)},
         {REALTEK_USB_DEVICE(VENDOR_ID_LENOVO,  0x7214)},
+        {REALTEK_USB_DEVICE(VENDOR_ID_LINKSYS, 0x0041)},
         {REALTEK_USB_DEVICE(VENDOR_ID_NVIDIA,  0x09ff)},
         {}
 };
diff --git a/drivers/net/usb/rndis_host.c b/drivers/net/usb/rndis_host.c
index a151f267aebb..b807c91abe1d 100644
--- a/drivers/net/usb/rndis_host.c
+++ b/drivers/net/usb/rndis_host.c
@@ -632,6 +632,10 @@ static const struct usb_device_id	products [] = {
         /* RNDIS for tethering */
         USB_INTERFACE_INFO(USB_CLASS_WIRELESS_CONTROLLER, 1, 3),
         .driver_info = (unsigned long) &rndis_info,
+}, {
+        /* Novatel Verizon USB730L */
+        USB_INTERFACE_INFO(USB_CLASS_MISC, 4, 1),
+        .driver_info = (unsigned long) &rndis_info,
 },
         { },            // END
 };
diff --git a/drivers/net/wireless/ath/ath10k/pci.c b/drivers/net/wireless/ath/ath10k/pci.c
index bc1633945a56..195dafb98131 100644
--- a/drivers/net/wireless/ath/ath10k/pci.c
+++ b/drivers/net/wireless/ath/ath10k/pci.c
@@ -3396,9 +3396,7 @@ static void ath10k_pci_remove(struct pci_dev *pdev)
 
 MODULE_DEVICE_TABLE(pci, ath10k_pci_id_table);
 
-#ifdef CONFIG_PM
-
-static int ath10k_pci_pm_suspend(struct device *dev)
+static __maybe_unused int ath10k_pci_pm_suspend(struct device *dev)
 {
         struct ath10k *ar = dev_get_drvdata(dev);
         int ret;
@@ -3414,7 +3412,7 @@ static int ath10k_pci_pm_suspend(struct device *dev)
         return ret;
 }
 
-static int ath10k_pci_pm_resume(struct device *dev)
+static __maybe_unused int ath10k_pci_pm_resume(struct device *dev)
 {
         struct ath10k *ar = dev_get_drvdata(dev);
         int ret;
@@ -3433,7 +3431,6 @@ static int ath10k_pci_pm_resume(struct device *dev)
 static SIMPLE_DEV_PM_OPS(ath10k_pci_pm_ops,
                          ath10k_pci_pm_suspend,
                          ath10k_pci_pm_resume);
-#endif
 
 static struct pci_driver ath10k_pci_driver = {
         .name = "ath10k_pci",
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
index aaed4ab503ad..4157c90ad973 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
@@ -980,7 +980,7 @@ static void brcmf_escan_prep(struct brcmf_cfg80211_info *cfg,
 
         eth_broadcast_addr(params_le->bssid);
         params_le->bss_type = DOT11_BSSTYPE_ANY;
-        params_le->scan_type = 0;
+        params_le->scan_type = BRCMF_SCANTYPE_ACTIVE;
         params_le->channel_num = 0;
         params_le->nprobes = cpu_to_le32(-1);
         params_le->active_time = cpu_to_le32(-1);
@@ -988,12 +988,9 @@ static void brcmf_escan_prep(struct brcmf_cfg80211_info *cfg,
         params_le->home_time = cpu_to_le32(-1);
         memset(&params_le->ssid_le, 0, sizeof(params_le->ssid_le));
 
-        /* if request is null exit so it will be all channel broadcast scan */
-        if (!request)
-                return;
-
         n_ssids = request->n_ssids;
         n_channels = request->n_channels;
+
         /* Copy channel array if applicable */
         brcmf_dbg(SCAN, "### List of channelspecs to scan ### %d\n",
                   n_channels);
@@ -1030,16 +1027,8 @@ static void brcmf_escan_prep(struct brcmf_cfg80211_info *cfg,
                         ptr += sizeof(ssid_le);
                 }
         } else {
-                brcmf_dbg(SCAN, "Broadcast scan %p\n", request->ssids);
-                if ((request->ssids) && request->ssids->ssid_len) {
-                        brcmf_dbg(SCAN, "SSID %s len=%d\n",
-                                  params_le->ssid_le.SSID,
-                                  request->ssids->ssid_len);
-                        params_le->ssid_le.SSID_len =
-                                cpu_to_le32(request->ssids->ssid_len);
-                        memcpy(&params_le->ssid_le.SSID, request->ssids->ssid,
-                                request->ssids->ssid_len);
-                }
+                brcmf_dbg(SCAN, "Performing passive scan\n");
+                params_le->scan_type = BRCMF_SCANTYPE_PASSIVE;
         }
         /* Adding mask to channel numbers */
         params_le->channel_num =
@@ -3162,6 +3151,7 @@ brcmf_cfg80211_escan_handler(struct brcmf_if *ifp,
         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
         s32 status;
         struct brcmf_escan_result_le *escan_result_le;
+        u32 escan_buflen;
         struct brcmf_bss_info_le *bss_info_le;
         struct brcmf_bss_info_le *bss = NULL;
         u32 bi_length;
@@ -3181,11 +3171,23 @@ brcmf_cfg80211_escan_handler(struct brcmf_if *ifp,
 
         if (status == BRCMF_E_STATUS_PARTIAL) {
                 brcmf_dbg(SCAN, "ESCAN Partial result\n");
+                if (e->datalen < sizeof(*escan_result_le)) {
+                        brcmf_err("invalid event data length\n");
+                        goto exit;
+                }
                 escan_result_le = (struct brcmf_escan_result_le *) data;
                 if (!escan_result_le) {
                         brcmf_err("Invalid escan result (NULL pointer)\n");
                         goto exit;
                 }
+                escan_buflen = le32_to_cpu(escan_result_le->buflen);
+                if (escan_buflen > BRCMF_ESCAN_BUF_SIZE ||
+                    escan_buflen > e->datalen ||
+                    escan_buflen < sizeof(*escan_result_le)) {
+                        brcmf_err("Invalid escan buffer length: %d\n",
+                                  escan_buflen);
+                        goto exit;
+                }
                 if (le16_to_cpu(escan_result_le->bss_count) != 1) {
                         brcmf_err("Invalid bss_count %d: ignoring\n",
                                   escan_result_le->bss_count);
@@ -3202,9 +3204,8 @@ brcmf_cfg80211_escan_handler(struct brcmf_if *ifp,
                 }
 
                 bi_length = le32_to_cpu(bss_info_le->length);
-                if (bi_length != (le32_to_cpu(escan_result_le->buflen) -
-                                        WL_ESCAN_RESULTS_FIXED_SIZE)) {
-                        brcmf_err("Invalid bss_info length %d: ignoring\n",
+                if (bi_length != escan_buflen - WL_ESCAN_RESULTS_FIXED_SIZE) {
+                        brcmf_err("Ignoring invalid bss_info length: %d\n",
                                   bi_length);
                         goto exit;
                 }
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
index 8391989b1882..e0d22fedb2b4 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
@@ -45,6 +45,11 @@
 #define BRCMF_SCAN_PARAMS_COUNT_MASK    0x0000ffff
 #define BRCMF_SCAN_PARAMS_NSSID_SHIFT   16
 
+/* scan type definitions */
+#define BRCMF_SCANTYPE_DEFAULT          0xFF
+#define BRCMF_SCANTYPE_ACTIVE           0
+#define BRCMF_SCANTYPE_PASSIVE          1
+
 #define BRCMF_WSEC_MAX_PSK_LEN          32
 #define BRCMF_WSEC_PASSPHRASE           BIT(0)
 
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
index 5de19ea10575..b205a7bfb828 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
@@ -2167,7 +2167,7 @@ out:
          * 1. We are not using a unified image
          * 2. We are using a unified image but had an error while exiting D3
          */
-        set_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status);
+        set_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED, &mvm->status);
         set_bit(IWL_MVM_STATUS_D3_RECONFIG, &mvm->status);
         /*
          * When switching images we return 1, which causes mac80211
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
index 15f2d826bb4b..3bcaa82f59b2 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
@@ -1546,6 +1546,11 @@ static void iwl_mvm_mc_iface_iterator(void *_data, u8 *mac,
         struct iwl_mvm_mc_iter_data *data = _data;
         struct iwl_mvm *mvm = data->mvm;
         struct iwl_mcast_filter_cmd *cmd = mvm->mcast_filter_cmd;
+        struct iwl_host_cmd hcmd = {
+                .id = MCAST_FILTER_CMD,
+                .flags = CMD_ASYNC,
+                .dataflags[0] = IWL_HCMD_DFL_NOCOPY,
+        };
         int ret, len;
 
         /* if we don't have free ports, mcast frames will be dropped */
@@ -1560,7 +1565,10 @@ static void iwl_mvm_mc_iface_iterator(void *_data, u8 *mac,
         memcpy(cmd->bssid, vif->bss_conf.bssid, ETH_ALEN);
         len = roundup(sizeof(*cmd) + cmd->count * ETH_ALEN, 4);
 
-        ret = iwl_mvm_send_cmd_pdu(mvm, MCAST_FILTER_CMD, CMD_ASYNC, len, cmd);
+        hcmd.len[0] = len;
+        hcmd.data[0] = cmd;
+
+        ret = iwl_mvm_send_cmd(mvm, &hcmd);
         if (ret)
                 IWL_ERR(mvm, "mcast filter cmd error. ret=%d\n", ret);
 }
@@ -1635,6 +1643,12 @@ static void iwl_mvm_configure_filter(struct ieee80211_hw *hw,
         if (!cmd)
                 goto out;
 
+        if (changed_flags & FIF_ALLMULTI)
+                cmd->pass_all = !!(*total_flags & FIF_ALLMULTI);
+
+        if (cmd->pass_all)
+                cmd->count = 0;
+
         iwl_mvm_recalc_multicast(mvm);
 out:
         mutex_unlock(&mvm->mutex);
@@ -2563,7 +2577,7 @@ static void iwl_mvm_purge_deferred_tx_frames(struct iwl_mvm *mvm,
                          * queues, so we should never get a second deferred
                          * frame for the RA/TID.
                          */
-                        iwl_mvm_start_mac_queues(mvm, info->hw_queue);
+                        iwl_mvm_start_mac_queues(mvm, BIT(info->hw_queue));
                         ieee80211_free_txskb(mvm->hw, skb);
                 }
         }
@@ -3975,6 +3989,43 @@ out_unlock:
         return ret;
 }
 
+static void iwl_mvm_flush_no_vif(struct iwl_mvm *mvm, u32 queues, bool drop)
+{
+        if (drop) {
+                if (iwl_mvm_has_new_tx_api(mvm))
+                        /* TODO new tx api */
+                        WARN_ONCE(1,
+                                  "Need to implement flush TX queue\n");
+                else
+                        iwl_mvm_flush_tx_path(mvm,
+                                iwl_mvm_flushable_queues(mvm) & queues,
+                                0);
+        } else {
+                if (iwl_mvm_has_new_tx_api(mvm)) {
+                        struct ieee80211_sta *sta;
+                        int i;
+
+                        mutex_lock(&mvm->mutex);
+
+                        for (i = 0; i < ARRAY_SIZE(mvm->fw_id_to_mac_id); i++) {
+                                sta = rcu_dereference_protected(
+                                                mvm->fw_id_to_mac_id[i],
+                                                lockdep_is_held(&mvm->mutex));
+                                if (IS_ERR_OR_NULL(sta))
+                                        continue;
+
+                                iwl_mvm_wait_sta_queues_empty(mvm,
+                                                iwl_mvm_sta_from_mac80211(sta));
+                        }
+
+                        mutex_unlock(&mvm->mutex);
+                } else {
+                        iwl_trans_wait_tx_queues_empty(mvm->trans,
+                                                       queues);
+                }
+        }
+}
+
 static void iwl_mvm_mac_flush(struct ieee80211_hw *hw,
                               struct ieee80211_vif *vif, u32 queues, bool drop)
 {
@@ -3985,7 +4036,12 @@ static void iwl_mvm_mac_flush(struct ieee80211_hw *hw,
         int i;
         u32 msk = 0;
 
-        if (!vif || vif->type != NL80211_IFTYPE_STATION)
+        if (!vif) {
+                iwl_mvm_flush_no_vif(mvm, queues, drop);
+                return;
+        }
+
+        if (vif->type != NL80211_IFTYPE_STATION)
                 return;
 
         /* Make sure we're done with the deferred traffic before flushing */
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
index ba7bd049d3d4..0fe723ca844e 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
@@ -661,7 +661,8 @@ static void rs_tl_turn_on_agg(struct iwl_mvm *mvm, struct iwl_mvm_sta *mvmsta,
             (lq_sta->tx_agg_tid_en & BIT(tid)) &&
             (tid_data->tx_count_last >= IWL_MVM_RS_AGG_START_THRESHOLD)) {
                 IWL_DEBUG_RATE(mvm, "try to aggregate tid %d\n", tid);
-                rs_tl_turn_on_agg_for_tid(mvm, lq_sta, tid, sta);
+                if (rs_tl_turn_on_agg_for_tid(mvm, lq_sta, tid, sta) == 0)
+                        tid_data->state = IWL_AGG_QUEUED;
         }
 }
 
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
index 67ffd9774712..77f77bc5d083 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
@@ -672,11 +672,12 @@ static bool iwl_mvm_reorder(struct iwl_mvm *mvm,
          * If there was a significant jump in the nssn - adjust.
          * If the SN is smaller than the NSSN it might need to first go into
          * the reorder buffer, in which case we just release up to it and the
-         * rest of the function will take of storing it and releasing up to the
-         * nssn
+         * rest of the function will take care of storing it and releasing up to
+         * the nssn
          */
         if (!iwl_mvm_is_sn_less(nssn, buffer->head_sn + buffer->buf_size,
-                                buffer->buf_size)) {
+                                buffer->buf_size) ||
+            !ieee80211_sn_less(sn, buffer->head_sn + buffer->buf_size)) {
                 u16 min_sn = ieee80211_sn_less(sn, nssn) ? sn : nssn;
 
                 iwl_mvm_release_frames(mvm, sta, napi, buffer, min_sn);
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
index 50983615dce6..774122fed454 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
@@ -555,7 +555,7 @@ static int iwl_mvm_lmac_scan_abort(struct iwl_mvm *mvm)
         struct iwl_host_cmd cmd = {
                 .id = SCAN_OFFLOAD_ABORT_CMD,
         };
-        u32 status;
+        u32 status = CAN_ABORT_STATUS;
 
         ret = iwl_mvm_send_cmd_status(mvm, &cmd, &status);
         if (ret)
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
index 411a2055dc45..c4a343534c5e 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
@@ -1285,7 +1285,7 @@ static int iwl_mvm_add_int_sta_common(struct iwl_mvm *mvm,
 {
         struct iwl_mvm_add_sta_cmd cmd;
         int ret;
-        u32 status;
+        u32 status = ADD_STA_SUCCESS;
 
         lockdep_assert_held(&mvm->mutex);
 
@@ -2385,8 +2385,10 @@ int iwl_mvm_sta_tx_agg_start(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
         if (WARN_ON_ONCE(tid >= IWL_MAX_TID_COUNT))
                 return -EINVAL;
 
-        if (mvmsta->tid_data[tid].state != IWL_AGG_OFF) {
-                IWL_ERR(mvm, "Start AGG when state is not IWL_AGG_OFF %d!\n",
+        if (mvmsta->tid_data[tid].state != IWL_AGG_QUEUED &&
+            mvmsta->tid_data[tid].state != IWL_AGG_OFF) {
+                IWL_ERR(mvm,
+                        "Start AGG when state is not IWL_AGG_QUEUED or IWL_AGG_OFF %d!\n",
                         mvmsta->tid_data[tid].state);
                 return -ENXIO;
         }
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.h b/drivers/net/wireless/intel/iwlwifi/mvm/sta.h
index d13893806513..aedabe101cf0 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.h
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.h
@@ -281,6 +281,7 @@ struct iwl_mvm_vif;
  * These states relate to a specific RA / TID.
  *
  * @IWL_AGG_OFF: aggregation is not used
+ * @IWL_AGG_QUEUED: aggregation start work has been queued
  * @IWL_AGG_STARTING: aggregation are starting (between start and oper)
  * @IWL_AGG_ON: aggregation session is up
  * @IWL_EMPTYING_HW_QUEUE_ADDBA: establishing a BA session - waiting for the
@@ -290,6 +291,7 @@ struct iwl_mvm_vif;
  */
 enum iwl_mvm_agg_state {
         IWL_AGG_OFF = 0,
+        IWL_AGG_QUEUED,
         IWL_AGG_STARTING,
         IWL_AGG_ON,
         IWL_EMPTYING_HW_QUEUE_ADDBA,
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tt.c b/drivers/net/wireless/intel/iwlwifi/mvm/tt.c
index 8876c2abc440..4d907f60bce9 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/tt.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/tt.c
@@ -529,6 +529,7 @@ int iwl_mvm_ctdp_command(struct iwl_mvm *mvm, u32 op, u32 state)
 
         lockdep_assert_held(&mvm->mutex);
 
+        status = 0;
         ret = iwl_mvm_send_cmd_pdu_status(mvm, WIDE_ID(PHY_OPS_GROUP,
                                                        CTDP_CONFIG_CMD),
                                           sizeof(cmd), &cmd, &status);
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
index 172b5e63d3fb..6f2e2af23219 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
@@ -564,8 +564,8 @@ static int iwl_mvm_get_ctrl_vif_queue(struct iwl_mvm *mvm,
         case NL80211_IFTYPE_AP:
         case NL80211_IFTYPE_ADHOC:
                 /*
-                 * Handle legacy hostapd as well, where station will be added
-                 * only just before sending the association response.
+                 * Non-bufferable frames use the broadcast station, thus they
+                 * use the probe queue.
                  * Also take care of the case where we send a deauth to a
                  * station that we don't have, or similarly an association
                  * response (with non-success status) for a station we can't
@@ -573,9 +573,9 @@ static int iwl_mvm_get_ctrl_vif_queue(struct iwl_mvm *mvm,
                  * Also, disassociate frames might happen, particular with
                  * reason 7 ("Class 3 frame received from nonassociated STA").
                  */
-                if (ieee80211_is_probe_resp(fc) || ieee80211_is_auth(fc) ||
-                    ieee80211_is_deauth(fc) || ieee80211_is_assoc_resp(fc) ||
-                    ieee80211_is_disassoc(fc))
+                if (ieee80211_is_mgmt(fc) &&
+                    (!ieee80211_is_bufferable_mmpdu(fc) ||
+                     ieee80211_is_deauth(fc) || ieee80211_is_disassoc(fc)))
                         return mvm->probe_queue;
                 if (info->hw_queue == info->control.vif->cab_queue)
                         return mvmvif->cab_queue;
diff --git a/drivers/net/wireless/quantenna/qtnfmac/cfg80211.c b/drivers/net/wireless/quantenna/qtnfmac/cfg80211.c
index 856fa6e8327e..a450bc6bc774 100644
--- a/drivers/net/wireless/quantenna/qtnfmac/cfg80211.c
+++ b/drivers/net/wireless/quantenna/qtnfmac/cfg80211.c
@@ -115,6 +115,8 @@ int qtnf_del_virtual_intf(struct wiphy *wiphy, struct wireless_dev *wdev)
 
         vif = qtnf_netdev_get_priv(wdev->netdev);
 
+        qtnf_scan_done(vif->mac, true);
+
         if (qtnf_cmd_send_del_intf(vif))
                 pr_err("VIF%u.%u: failed to delete VIF\n", vif->mac->macid,
                        vif->vifid);
@@ -335,6 +337,8 @@ static int qtnf_stop_ap(struct wiphy *wiphy, struct net_device *dev)
         struct qtnf_vif *vif = qtnf_netdev_get_priv(dev);
         int ret;
 
+        qtnf_scan_done(vif->mac, true);
+
         ret = qtnf_cmd_send_stop_ap(vif);
         if (ret) {
                 pr_err("VIF%u.%u: failed to stop AP operation in FW\n",
@@ -570,8 +574,6 @@ qtnf_del_station(struct wiphy *wiphy, struct net_device *dev,
             !qtnf_sta_list_lookup(&vif->sta_list, params->mac))
                 return 0;
 
-        qtnf_scan_done(vif->mac, true);
-
         ret = qtnf_cmd_send_del_sta(vif, params);
         if (ret)
                 pr_err("VIF%u.%u: failed to delete STA %pM\n",
@@ -1134,8 +1136,9 @@ void qtnf_virtual_intf_cleanup(struct net_device *ndev)
                 }
 
                 vif->sta_state = QTNF_STA_DISCONNECTED;
-                qtnf_scan_done(mac, true);
         }
+
+        qtnf_scan_done(mac, true);
 }
 
 void qtnf_cfg80211_vif_reset(struct qtnf_vif *vif)
diff --git a/drivers/net/wireless/quantenna/qtnfmac/cfg80211.h b/drivers/net/wireless/quantenna/qtnfmac/cfg80211.h
index 6a4af52522b8..66db26613b1f 100644
--- a/drivers/net/wireless/quantenna/qtnfmac/cfg80211.h
+++ b/drivers/net/wireless/quantenna/qtnfmac/cfg80211.h
@@ -34,6 +34,9 @@ static inline void qtnf_scan_done(struct qtnf_wmac *mac, bool aborted)
                 .aborted = aborted,
         };
 
+        if (timer_pending(&mac->scan_timeout))
+                del_timer_sync(&mac->scan_timeout);
+
         mutex_lock(&mac->mac_lock);
 
         if (mac->scan_req) {
diff --git a/drivers/net/wireless/quantenna/qtnfmac/event.c b/drivers/net/wireless/quantenna/qtnfmac/event.c
index 0fc2814eafad..43d2e7fd6e02 100644
--- a/drivers/net/wireless/quantenna/qtnfmac/event.c
+++ b/drivers/net/wireless/quantenna/qtnfmac/event.c
@@ -345,8 +345,6 @@ qtnf_event_handle_scan_complete(struct qtnf_wmac *mac,
                 return -EINVAL;
         }
 
-        if (timer_pending(&mac->scan_timeout))
-                del_timer_sync(&mac->scan_timeout);
         qtnf_scan_done(mac, le32_to_cpu(status->flags) & QLINK_SCAN_ABORTED);
 
         return 0;
diff --git a/drivers/net/wireless/quantenna/qtnfmac/pearl/pcie.c b/drivers/net/wireless/quantenna/qtnfmac/pearl/pcie.c
index 502e72b7cdcc..69131965a298 100644
--- a/drivers/net/wireless/quantenna/qtnfmac/pearl/pcie.c
+++ b/drivers/net/wireless/quantenna/qtnfmac/pearl/pcie.c
@@ -661,14 +661,18 @@ static int qtnf_pcie_data_tx(struct qtnf_bus *bus, struct sk_buff *skb)
         struct qtnf_pcie_bus_priv *priv = (void *)get_bus_priv(bus);
         dma_addr_t txbd_paddr, skb_paddr;
         struct qtnf_tx_bd *txbd;
+        unsigned long flags;
         int len, i;
         u32 info;
         int ret = 0;
 
+        spin_lock_irqsave(&priv->tx0_lock, flags);
+
         if (!qtnf_tx_queue_ready(priv)) {
                 if (skb->dev)
                         netif_stop_queue(skb->dev);
 
+                spin_unlock_irqrestore(&priv->tx0_lock, flags);
                 return NETDEV_TX_BUSY;
         }
 
@@ -717,8 +721,10 @@ tx_done:
                 dev_kfree_skb_any(skb);
         }
 
-        qtnf_pcie_data_tx_reclaim(priv);
         priv->tx_done_count++;
+        spin_unlock_irqrestore(&priv->tx0_lock, flags);
+
+        qtnf_pcie_data_tx_reclaim(priv);
 
         return NETDEV_TX_OK;
 }
@@ -1247,6 +1253,7 @@ static int qtnf_pcie_probe(struct pci_dev *pdev, const struct pci_device_id *id)
         strcpy(bus->fwname, QTN_PCI_PEARL_FW_NAME);
         init_completion(&bus->request_firmware_complete);
         mutex_init(&bus->bus_lock);
+        spin_lock_init(&pcie_priv->tx0_lock);
         spin_lock_init(&pcie_priv->irq_lock);
         spin_lock_init(&pcie_priv->tx_reclaim_lock);
 
diff --git a/drivers/net/wireless/quantenna/qtnfmac/pearl/pcie_bus_priv.h b/drivers/net/wireless/quantenna/qtnfmac/pearl/pcie_bus_priv.h
index e76a23716ee0..86ac1ccedb52 100644
--- a/drivers/net/wireless/quantenna/qtnfmac/pearl/pcie_bus_priv.h
+++ b/drivers/net/wireless/quantenna/qtnfmac/pearl/pcie_bus_priv.h
@@ -34,6 +34,8 @@ struct qtnf_pcie_bus_priv {
 
         /* lock for tx reclaim operations */
         spinlock_t tx_reclaim_lock;
+        /* lock for tx0 operations */
+        spinlock_t tx0_lock;
         u8 msi_enabled;
         int mps;
 
diff --git a/drivers/nvdimm/namespace_devs.c b/drivers/nvdimm/namespace_devs.c
index 1427a386a033..3e4d1e7998da 100644
--- a/drivers/nvdimm/namespace_devs.c
+++ b/drivers/nvdimm/namespace_devs.c
@@ -1417,6 +1417,15 @@ static int btt_claim_class(struct device *dev)
                 struct nvdimm_drvdata *ndd = to_ndd(nd_mapping);
                 struct nd_namespace_index *nsindex;
 
+                /*
+                 * If any of the DIMMs do not support labels the only
+                 * possible BTT format is v1.
+                 */
+                if (!ndd) {
+                        loop_bitmask = 0;
+                        break;
+                }
+
                 nsindex = to_namespace_index(ndd, ndd->ns_current);
                 if (nsindex == NULL)
                         loop_bitmask |= 1;
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index acc816b67582..5a14cc7f28ee 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -134,8 +134,6 @@ static inline bool nvme_req_needs_retry(struct request *req)
                 return false;
         if (nvme_req(req)->status & NVME_SC_DNR)
                 return false;
-        if (jiffies - req->start_time >= req->timeout)
-                return false;
         if (nvme_req(req)->retries >= nvme_max_retries)
                 return false;
         return true;
@@ -2138,7 +2136,7 @@ static umode_t nvme_ns_attrs_are_visible(struct kobject *kobj,
         struct nvme_ns *ns = nvme_get_ns_from_dev(dev);
 
         if (a == &dev_attr_uuid.attr) {
-                if (uuid_is_null(&ns->uuid) ||
+                if (uuid_is_null(&ns->uuid) &&
                     !memchr_inv(ns->nguid, 0, sizeof(ns->nguid)))
                         return 0;
         }
@@ -2590,7 +2588,7 @@ static void nvme_async_event_work(struct work_struct *work)
                 container_of(work, struct nvme_ctrl, async_event_work);
 
         spin_lock_irq(&ctrl->lock);
-        while (ctrl->event_limit > 0) {
+        while (ctrl->state == NVME_CTRL_LIVE && ctrl->event_limit > 0) {
                 int aer_idx = --ctrl->event_limit;
 
                 spin_unlock_irq(&ctrl->lock);
@@ -2677,7 +2675,8 @@ void nvme_complete_async_event(struct nvme_ctrl *ctrl, __le16 status,
                 /*FALLTHRU*/
         case NVME_SC_ABORT_REQ:
                 ++ctrl->event_limit;
-                queue_work(nvme_wq, &ctrl->async_event_work);
+                if (ctrl->state == NVME_CTRL_LIVE)
+                        queue_work(nvme_wq, &ctrl->async_event_work);
                 break;
         default:
                 break;
@@ -2692,7 +2691,7 @@ void nvme_complete_async_event(struct nvme_ctrl *ctrl, __le16 status,
                 nvme_queue_scan(ctrl);
                 break;
         case NVME_AER_NOTICE_FW_ACT_STARTING:
-                schedule_work(&ctrl->fw_act_work);
+                queue_work(nvme_wq, &ctrl->fw_act_work);
                 break;
         default:
                 dev_warn(ctrl->device, "async event result %08x\n", result);
diff --git a/drivers/nvme/host/fabrics.c b/drivers/nvme/host/fabrics.c
index 47307752dc65..555c976cc2ee 100644
--- a/drivers/nvme/host/fabrics.c
+++ b/drivers/nvme/host/fabrics.c
@@ -565,6 +565,7 @@ static int nvmf_parse_options(struct nvmf_ctrl_options *opts,
         opts->queue_size = NVMF_DEF_QUEUE_SIZE;
         opts->nr_io_queues = num_online_cpus();
         opts->reconnect_delay = NVMF_DEF_RECONNECT_DELAY;
+        opts->kato = NVME_DEFAULT_KATO;
 
         options = o = kstrdup(buf, GFP_KERNEL);
         if (!options)
@@ -655,21 +656,22 @@ static int nvmf_parse_options(struct nvmf_ctrl_options *opts,
                                 goto out;
                         }
 
-                        if (opts->discovery_nqn) {
-                                pr_err("Discovery controllers cannot accept keep_alive_tmo != 0\n");
-                                ret = -EINVAL;
-                                goto out;
-                        }
-
                         if (token < 0) {
                                 pr_err("Invalid keep_alive_tmo %d\n", token);
                                 ret = -EINVAL;
                                 goto out;
-                        } else if (token == 0) {
+                        } else if (token == 0 && !opts->discovery_nqn) {
                                 /* Allowed for debug */
                                 pr_warn("keep_alive_tmo 0 won't execute keep alives!!!\n");
                         }
                         opts->kato = token;
+
+                        if (opts->discovery_nqn && opts->kato) {
+                                pr_err("Discovery controllers cannot accept KATO != 0\n");
+                                ret = -EINVAL;
+                                goto out;
+                        }
+
                         break;
                 case NVMF_OPT_CTRL_LOSS_TMO:
                         if (match_int(args, &token)) {
@@ -762,8 +764,6 @@ static int nvmf_parse_options(struct nvmf_ctrl_options *opts,
         uuid_copy(&opts->host->id, &hostid);
 
 out:
-        if (!opts->discovery_nqn && !opts->kato)
-                opts->kato = NVME_DEFAULT_KATO;
         kfree(options);
         return ret;
 }
diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
index d2e882c0f496..af075e998944 100644
--- a/drivers/nvme/host/fc.c
+++ b/drivers/nvme/host/fc.c
@@ -1376,7 +1376,7 @@ nvme_fc_fcpio_done(struct nvmefc_fcp_req *req)
         if (atomic_read(&op->state) == FCPOP_STATE_ABORTED)
                 status = cpu_to_le16((NVME_SC_ABORT_REQ | NVME_SC_DNR) << 1);
         else if (freq->status)
-                status = cpu_to_le16(NVME_SC_FC_TRANSPORT_ERROR << 1);
+                status = cpu_to_le16(NVME_SC_INTERNAL << 1);
 
         /*
          * For the linux implementation, if we have an unsuccesful
@@ -1404,7 +1404,7 @@ nvme_fc_fcpio_done(struct nvmefc_fcp_req *req)
                  */
                 if (freq->transferred_length !=
                         be32_to_cpu(op->cmd_iu.data_len)) {
-                        status = cpu_to_le16(NVME_SC_FC_TRANSPORT_ERROR << 1);
+                        status = cpu_to_le16(NVME_SC_INTERNAL << 1);
                         goto done;
                 }
                 result.u64 = 0;
@@ -1421,7 +1421,7 @@ nvme_fc_fcpio_done(struct nvmefc_fcp_req *req)
                                         freq->transferred_length ||
                              op->rsp_iu.status_code ||
                              sqe->common.command_id != cqe->command_id)) {
-                        status = cpu_to_le16(NVME_SC_FC_TRANSPORT_ERROR << 1);
+                        status = cpu_to_le16(NVME_SC_INTERNAL << 1);
                         goto done;
                 }
                 result = cqe->result;
@@ -1429,7 +1429,7 @@ nvme_fc_fcpio_done(struct nvmefc_fcp_req *req)
                 break;
 
         default:
-                status = cpu_to_le16(NVME_SC_FC_TRANSPORT_ERROR << 1);
+                status = cpu_to_le16(NVME_SC_INTERNAL << 1);
                 goto done;
         }
 
@@ -1989,16 +1989,17 @@ nvme_fc_start_fcp_op(struct nvme_fc_ctrl *ctrl, struct nvme_fc_queue *queue,
          * as well as those by FC-NVME spec.
          */
         WARN_ON_ONCE(sqe->common.metadata);
-        WARN_ON_ONCE(sqe->common.dptr.prp1);
-        WARN_ON_ONCE(sqe->common.dptr.prp2);
         sqe->common.flags |= NVME_CMD_SGL_METABUF;
 
         /*
-         * format SQE DPTR field per FC-NVME rules
-         *    type=data block descr; subtype=offset;
-         *    offset is currently 0.
+         * format SQE DPTR field per FC-NVME rules:
+         *    type=0x5     Transport SGL Data Block Descriptor
+         *    subtype=0xA  Transport-specific value
+         *    address=0
+         *    length=length of the data series
          */
-        sqe->rw.dptr.sgl.type = NVME_SGL_FMT_OFFSET;
+        sqe->rw.dptr.sgl.type = (NVME_TRANSPORT_SGL_DATA_DESC << 4) |
+                                        NVME_SGL_FMT_TRANSPORT_A;
         sqe->rw.dptr.sgl.length = cpu_to_le32(data_len);
         sqe->rw.dptr.sgl.addr = 0;
 
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index 4a2121335f48..3f5a04c586ce 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -24,6 +24,7 @@
 #include <linux/mm.h>
 #include <linux/module.h>
 #include <linux/mutex.h>
+#include <linux/once.h>
 #include <linux/pci.h>
 #include <linux/poison.h>
 #include <linux/t10-pi.h>
@@ -93,7 +94,7 @@ struct nvme_dev {
         struct mutex shutdown_lock;
         bool subsystem;
         void __iomem *cmb;
-        dma_addr_t cmb_dma_addr;
+        pci_bus_addr_t cmb_bus_addr;
         u64 cmb_size;
         u32 cmbsz;
         u32 cmbloc;
@@ -540,6 +541,20 @@ static void nvme_dif_complete(u32 p, u32 v, struct t10_pi_tuple *pi)
 }
 #endif
 
+static void nvme_print_sgl(struct scatterlist *sgl, int nents)
+{
+        int i;
+        struct scatterlist *sg;
+
+        for_each_sg(sgl, sg, nents, i) {
+                dma_addr_t phys = sg_phys(sg);
+                pr_warn("sg[%d] phys_addr:%pad offset:%d length:%d "
+                        "dma_address:%pad dma_length:%d\n",
+                        i, &phys, sg->offset, sg->length, &sg_dma_address(sg),
+                        sg_dma_len(sg));
+        }
+}
+
 static blk_status_t nvme_setup_prps(struct nvme_dev *dev, struct request *req)
 {
         struct nvme_iod *iod = blk_mq_rq_to_pdu(req);
@@ -622,19 +637,10 @@ static blk_status_t nvme_setup_prps(struct nvme_dev *dev, struct request *req)
         return BLK_STS_OK;
 
  bad_sgl:
-        if (WARN_ONCE(1, "Invalid SGL for payload:%d nents:%d\n",
-                                blk_rq_payload_bytes(req), iod->nents)) {
-                for_each_sg(iod->sg, sg, iod->nents, i) {
-                        dma_addr_t phys = sg_phys(sg);
-                        pr_warn("sg[%d] phys_addr:%pad offset:%d length:%d "
-                               "dma_address:%pad dma_length:%d\n", i, &phys,
-                                        sg->offset, sg->length,
-                                        &sg_dma_address(sg),
-                                        sg_dma_len(sg));
-                }
-        }
+        WARN(DO_ONCE(nvme_print_sgl, iod->sg, iod->nents),
+                        "Invalid SGL for payload:%d nents:%d\n",
+                        blk_rq_payload_bytes(req), iod->nents);
         return BLK_STS_IOERR;
-
 }
 
 static blk_status_t nvme_map_data(struct nvme_dev *dev, struct request *req,
@@ -1220,7 +1226,7 @@ static int nvme_alloc_sq_cmds(struct nvme_dev *dev, struct nvme_queue *nvmeq,
         if (qid && dev->cmb && use_cmb_sqes && NVME_CMB_SQS(dev->cmbsz)) {
                 unsigned offset = (qid - 1) * roundup(SQ_SIZE(depth),
                                                       dev->ctrl.page_size);
-                nvmeq->sq_dma_addr = dev->cmb_dma_addr + offset;
+                nvmeq->sq_dma_addr = dev->cmb_bus_addr + offset;
                 nvmeq->sq_cmds_io = dev->cmb + offset;
         } else {
                 nvmeq->sq_cmds = dma_alloc_coherent(dev->dev, SQ_SIZE(depth),
@@ -1313,11 +1319,11 @@ static int nvme_create_queue(struct nvme_queue *nvmeq, int qid)
         if (result < 0)
                 goto release_cq;
 
+        nvme_init_queue(nvmeq, qid);
         result = queue_request_irq(nvmeq);
         if (result < 0)
                 goto release_sq;
 
-        nvme_init_queue(nvmeq, qid);
         return result;
 
  release_sq:
@@ -1464,6 +1470,7 @@ static int nvme_pci_configure_admin_queue(struct nvme_dev *dev)
                 return result;
 
         nvmeq->cq_vector = 0;
+        nvme_init_queue(nvmeq, 0);
         result = queue_request_irq(nvmeq);
         if (result) {
                 nvmeq->cq_vector = -1;
@@ -1520,7 +1527,7 @@ static void __iomem *nvme_map_cmb(struct nvme_dev *dev)
         resource_size_t bar_size;
         struct pci_dev *pdev = to_pci_dev(dev->dev);
         void __iomem *cmb;
-        dma_addr_t dma_addr;
+        int bar;
 
         dev->cmbsz = readl(dev->bar + NVME_REG_CMBSZ);
         if (!(NVME_CMB_SZ(dev->cmbsz)))
@@ -1533,7 +1540,8 @@ static void __iomem *nvme_map_cmb(struct nvme_dev *dev)
         szu = (u64)1 << (12 + 4 * NVME_CMB_SZU(dev->cmbsz));
         size = szu * NVME_CMB_SZ(dev->cmbsz);
         offset = szu * NVME_CMB_OFST(dev->cmbloc);
-        bar_size = pci_resource_len(pdev, NVME_CMB_BIR(dev->cmbloc));
+        bar = NVME_CMB_BIR(dev->cmbloc);
+        bar_size = pci_resource_len(pdev, bar);
 
         if (offset > bar_size)
                 return NULL;
@@ -1546,12 +1554,11 @@ static void __iomem *nvme_map_cmb(struct nvme_dev *dev)
         if (size > bar_size - offset)
                 size = bar_size - offset;
 
-        dma_addr = pci_resource_start(pdev, NVME_CMB_BIR(dev->cmbloc)) + offset;
-        cmb = ioremap_wc(dma_addr, size);
+        cmb = ioremap_wc(pci_resource_start(pdev, bar) + offset, size);
         if (!cmb)
                 return NULL;
 
-        dev->cmb_dma_addr = dma_addr;
+        dev->cmb_bus_addr = pci_bus_address(pdev, bar) + offset;
         dev->cmb_size = size;
         return cmb;
 }
@@ -2156,7 +2163,6 @@ static void nvme_reset_work(struct work_struct *work)
         if (result)
                 goto out;
 
-        nvme_init_queue(dev->queues[0], 0);
         result = nvme_alloc_admin_tags(dev);
         if (result)
                 goto out;
diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
index 58983000964b..92a03ff5fb4d 100644
--- a/drivers/nvme/host/rdma.c
+++ b/drivers/nvme/host/rdma.c
@@ -942,7 +942,12 @@ static void nvme_rdma_reconnect_ctrl_work(struct work_struct *work)
         }
 
         changed = nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_LIVE);
-        WARN_ON_ONCE(!changed);
+        if (!changed) {
+                /* state change failure is ok if we're in DELETING state */
+                WARN_ON_ONCE(ctrl->ctrl.state != NVME_CTRL_DELETING);
+                return;
+        }
+
         ctrl->ctrl.nr_reconnects = 0;
 
         nvme_start_ctrl(&ctrl->ctrl);
@@ -962,7 +967,7 @@ static void nvme_rdma_error_recovery_work(struct work_struct *work)
         struct nvme_rdma_ctrl *ctrl = container_of(work,
                         struct nvme_rdma_ctrl, err_work);
 
-        nvme_stop_ctrl(&ctrl->ctrl);
+        nvme_stop_keep_alive(&ctrl->ctrl);
 
         if (ctrl->ctrl.queue_count > 1) {
                 nvme_stop_queues(&ctrl->ctrl);
diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c
index 7c23eaf8e563..1b208beeef50 100644
--- a/drivers/nvme/target/core.c
+++ b/drivers/nvme/target/core.c
@@ -390,10 +390,10 @@ static void __nvmet_req_complete(struct nvmet_req *req, u16 status)
         if (status)
                 nvmet_set_status(req, status);
 
-        /* XXX: need to fill in something useful for sq_head */
-        req->rsp->sq_head = 0;
-        if (likely(req->sq)) /* may happen during early failure */
-                req->rsp->sq_id = cpu_to_le16(req->sq->qid);
+        if (req->sq->size)
+                req->sq->sqhd = (req->sq->sqhd + 1) % req->sq->size;
+        req->rsp->sq_head = cpu_to_le16(req->sq->sqhd);
+        req->rsp->sq_id = cpu_to_le16(req->sq->qid);
         req->rsp->command_id = req->cmd->common.command_id;
 
         if (req->ns)
@@ -420,6 +420,7 @@ void nvmet_cq_setup(struct nvmet_ctrl *ctrl, struct nvmet_cq *cq,
 void nvmet_sq_setup(struct nvmet_ctrl *ctrl, struct nvmet_sq *sq,
                 u16 qid, u16 size)
 {
+        sq->sqhd = 0;
         sq->qid = qid;
         sq->size = size;
 
diff --git a/drivers/nvme/target/fabrics-cmd.c b/drivers/nvme/target/fabrics-cmd.c
index 859a66725291..db3bf6b8bf9e 100644
--- a/drivers/nvme/target/fabrics-cmd.c
+++ b/drivers/nvme/target/fabrics-cmd.c
@@ -109,9 +109,14 @@ static u16 nvmet_install_queue(struct nvmet_ctrl *ctrl, struct nvmet_req *req)
                 pr_warn("queue already connected!\n");
                 return NVME_SC_CONNECT_CTRL_BUSY | NVME_SC_DNR;
         }
+        if (!sqsize) {
+                pr_warn("queue size zero!\n");
+                return NVME_SC_CONNECT_INVALID_PARAM | NVME_SC_DNR;
+        }
 
-        nvmet_cq_setup(ctrl, req->cq, qid, sqsize);
-        nvmet_sq_setup(ctrl, req->sq, qid, sqsize);
+        /* note: convert queue size from 0's-based value to 1's-based value */
+        nvmet_cq_setup(ctrl, req->cq, qid, sqsize + 1);
+        nvmet_sq_setup(ctrl, req->sq, qid, sqsize + 1);
         return 0;
 }
 
diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c
index 421e43bf1dd7..58e010bdda3e 100644
--- a/drivers/nvme/target/fc.c
+++ b/drivers/nvme/target/fc.c
@@ -148,7 +148,7 @@ struct nvmet_fc_tgt_assoc {
         u32                             a_id;
         struct nvmet_fc_tgtport         *tgtport;
         struct list_head                a_list;
-        struct nvmet_fc_tgt_queue       *queues[NVMET_NR_QUEUES];
+        struct nvmet_fc_tgt_queue       *queues[NVMET_NR_QUEUES + 1];
         struct kref                     ref;
 };
 
@@ -608,7 +608,7 @@ nvmet_fc_alloc_target_queue(struct nvmet_fc_tgt_assoc *assoc,
         unsigned long flags;
         int ret;
 
-        if (qid >= NVMET_NR_QUEUES)
+        if (qid > NVMET_NR_QUEUES)
                 return NULL;
 
         queue = kzalloc((sizeof(*queue) +
@@ -783,6 +783,9 @@ nvmet_fc_find_target_queue(struct nvmet_fc_tgtport *tgtport,
         u16 qid = nvmet_fc_getqueueid(connection_id);
         unsigned long flags;
 
+        if (qid > NVMET_NR_QUEUES)
+                return NULL;
+
         spin_lock_irqsave(&tgtport->lock, flags);
         list_for_each_entry(assoc, &tgtport->assoc_list, a_list) {
                 if (association_id == assoc->association_id) {
@@ -888,7 +891,7 @@ nvmet_fc_delete_target_assoc(struct nvmet_fc_tgt_assoc *assoc)
         int i;
 
         spin_lock_irqsave(&tgtport->lock, flags);
-        for (i = NVMET_NR_QUEUES - 1; i >= 0; i--) {
+        for (i = NVMET_NR_QUEUES; i >= 0; i--) {
                 queue = assoc->queues[i];
                 if (queue) {
                         if (!nvmet_fc_tgt_q_get(queue))
@@ -1910,8 +1913,7 @@ nvmet_fc_transfer_fcp_data(struct nvmet_fc_tgtport *tgtport,
                         spin_lock_irqsave(&fod->flock, flags);
                         fod->writedataactive = false;
                         spin_unlock_irqrestore(&fod->flock, flags);
-                        nvmet_req_complete(&fod->req,
-                                        NVME_SC_FC_TRANSPORT_ERROR);
+                        nvmet_req_complete(&fod->req, NVME_SC_INTERNAL);
                 } else /* NVMET_FCOP_READDATA or NVMET_FCOP_READDATA_RSP */ {
                         fcpreq->fcp_error = ret;
                         fcpreq->transferred_length = 0;
@@ -1929,8 +1931,7 @@ __nvmet_fc_fod_op_abort(struct nvmet_fc_fcp_iod *fod, bool abort)
         /* if in the middle of an io and we need to tear down */
         if (abort) {
                 if (fcpreq->op == NVMET_FCOP_WRITEDATA) {
-                        nvmet_req_complete(&fod->req,
-                                        NVME_SC_FC_TRANSPORT_ERROR);
+                        nvmet_req_complete(&fod->req, NVME_SC_INTERNAL);
                         return true;
                 }
 
@@ -1968,8 +1969,7 @@ nvmet_fc_fod_op_done(struct nvmet_fc_fcp_iod *fod)
                         fod->abort = true;
                         spin_unlock(&fod->flock);
 
-                        nvmet_req_complete(&fod->req,
-                                        NVME_SC_FC_TRANSPORT_ERROR);
+                        nvmet_req_complete(&fod->req, NVME_SC_INTERNAL);
                         return;
                 }
 
@@ -2533,13 +2533,17 @@ nvmet_fc_remove_port(struct nvmet_port *port)
 {
         struct nvmet_fc_tgtport *tgtport = port->priv;
         unsigned long flags;
+        bool matched = false;
 
         spin_lock_irqsave(&nvmet_fc_tgtlock, flags);
         if (tgtport->port == port) {
-                nvmet_fc_tgtport_put(tgtport);
+                matched = true;
                 tgtport->port = NULL;
         }
         spin_unlock_irqrestore(&nvmet_fc_tgtlock, flags);
+
+        if (matched)
+                nvmet_fc_tgtport_put(tgtport);
 }
 
 static struct nvmet_fabrics_ops nvmet_fc_tgt_fcp_ops = {
diff --git a/drivers/nvme/target/fcloop.c b/drivers/nvme/target/fcloop.c
index 1cb9847ec261..7b75d9de55ab 100644
--- a/drivers/nvme/target/fcloop.c
+++ b/drivers/nvme/target/fcloop.c
@@ -224,8 +224,6 @@ struct fcloop_nport {
         struct fcloop_lport *lport;
         struct list_head nport_list;
         struct kref ref;
-        struct completion rport_unreg_done;
-        struct completion tport_unreg_done;
         u64 node_name;
         u64 port_name;
         u32 port_role;
@@ -576,7 +574,7 @@ fcloop_tgt_fcp_abort(struct nvmet_fc_target_port *tgtport,
         tfcp_req->aborted = true;
         spin_unlock(&tfcp_req->reqlock);
 
-        tfcp_req->status = NVME_SC_FC_TRANSPORT_ABORTED;
+        tfcp_req->status = NVME_SC_INTERNAL;
 
         /*
          * nothing more to do. If io wasn't active, the transport should
@@ -631,6 +629,32 @@ fcloop_fcp_abort(struct nvme_fc_local_port *localport,
 }
 
 static void
+fcloop_nport_free(struct kref *ref)
+{
+        struct fcloop_nport *nport =
+                container_of(ref, struct fcloop_nport, ref);
+        unsigned long flags;
+
+        spin_lock_irqsave(&fcloop_lock, flags);
+        list_del(&nport->nport_list);
+        spin_unlock_irqrestore(&fcloop_lock, flags);
+
+        kfree(nport);
+}
+
+static void
+fcloop_nport_put(struct fcloop_nport *nport)
+{
+        kref_put(&nport->ref, fcloop_nport_free);
+}
+
+static int
+fcloop_nport_get(struct fcloop_nport *nport)
+{
+        return kref_get_unless_zero(&nport->ref);
+}
+
+static void
 fcloop_localport_delete(struct nvme_fc_local_port *localport)
 {
         struct fcloop_lport *lport = localport->private;
@@ -644,8 +668,7 @@ fcloop_remoteport_delete(struct nvme_fc_remote_port *remoteport)
 {
         struct fcloop_rport *rport = remoteport->private;
 
-        /* release any threads waiting for the unreg to complete */
-        complete(&rport->nport->rport_unreg_done);
+        fcloop_nport_put(rport->nport);
 }
 
 static void
@@ -653,8 +676,7 @@ fcloop_targetport_delete(struct nvmet_fc_target_port *targetport)
 {
         struct fcloop_tport *tport = targetport->private;
 
-        /* release any threads waiting for the unreg to complete */
-        complete(&tport->nport->tport_unreg_done);
+        fcloop_nport_put(tport->nport);
 }
 
 #define FCLOOP_HW_QUEUES                4
@@ -722,6 +744,7 @@ fcloop_create_local_port(struct device *dev, struct device_attribute *attr,
                 goto out_free_opts;
         }
 
+        memset(&pinfo, 0, sizeof(pinfo));
         pinfo.node_name = opts->wwnn;
         pinfo.port_name = opts->wwpn;
         pinfo.port_role = opts->roles;
@@ -804,32 +827,6 @@ fcloop_delete_local_port(struct device *dev, struct device_attribute *attr,
         return ret ? ret : count;
 }
 
-static void
-fcloop_nport_free(struct kref *ref)
-{
-        struct fcloop_nport *nport =
-                container_of(ref, struct fcloop_nport, ref);
-        unsigned long flags;
-
-        spin_lock_irqsave(&fcloop_lock, flags);
-        list_del(&nport->nport_list);
-        spin_unlock_irqrestore(&fcloop_lock, flags);
-
-        kfree(nport);
-}
-
-static void
-fcloop_nport_put(struct fcloop_nport *nport)
-{
-        kref_put(&nport->ref, fcloop_nport_free);
-}
-
-static int
-fcloop_nport_get(struct fcloop_nport *nport)
-{
-        return kref_get_unless_zero(&nport->ref);
-}
-
 static struct fcloop_nport *
 fcloop_alloc_nport(const char *buf, size_t count, bool remoteport)
 {
@@ -938,6 +935,7 @@ fcloop_create_remote_port(struct device *dev, struct device_attribute *attr,
         if (!nport)
                 return -EIO;
 
+        memset(&pinfo, 0, sizeof(pinfo));
         pinfo.node_name = nport->node_name;
         pinfo.port_name = nport->port_name;
         pinfo.port_role = nport->port_role;
@@ -979,24 +977,12 @@ __unlink_remote_port(struct fcloop_nport *nport)
 }
 
 static int
-__wait_remoteport_unreg(struct fcloop_nport *nport, struct fcloop_rport *rport)
+__remoteport_unreg(struct fcloop_nport *nport, struct fcloop_rport *rport)
 {
-        int ret;
-
         if (!rport)
                 return -EALREADY;
 
-        init_completion(&nport->rport_unreg_done);
-
-        ret = nvme_fc_unregister_remoteport(rport->remoteport);
-        if (ret)
-                return ret;
-
-        wait_for_completion(&nport->rport_unreg_done);
-
-        fcloop_nport_put(nport);
-
-        return ret;
+        return nvme_fc_unregister_remoteport(rport->remoteport);
 }
 
 static ssize_t
@@ -1029,7 +1015,7 @@ fcloop_delete_remote_port(struct device *dev, struct device_attribute *attr,
         if (!nport)
                 return -ENOENT;
 
-        ret = __wait_remoteport_unreg(nport, rport);
+        ret = __remoteport_unreg(nport, rport);
 
         return ret ? ret : count;
 }
@@ -1086,24 +1072,12 @@ __unlink_target_port(struct fcloop_nport *nport)
 }
 
 static int
-__wait_targetport_unreg(struct fcloop_nport *nport, struct fcloop_tport *tport)
+__targetport_unreg(struct fcloop_nport *nport, struct fcloop_tport *tport)
 {
-        int ret;
-
         if (!tport)
                 return -EALREADY;
 
-        init_completion(&nport->tport_unreg_done);
-
-        ret = nvmet_fc_unregister_targetport(tport->targetport);
-        if (ret)
-                return ret;
-
-        wait_for_completion(&nport->tport_unreg_done);
-
-        fcloop_nport_put(nport);
-
-        return ret;
+        return nvmet_fc_unregister_targetport(tport->targetport);
 }
 
 static ssize_t
@@ -1136,7 +1110,7 @@ fcloop_delete_target_port(struct device *dev, struct device_attribute *attr,
         if (!nport)
                 return -ENOENT;
 
-        ret = __wait_targetport_unreg(nport, tport);
+        ret = __targetport_unreg(nport, tport);
 
         return ret ? ret : count;
 }
@@ -1223,11 +1197,11 @@ static void __exit fcloop_exit(void)
 
                 spin_unlock_irqrestore(&fcloop_lock, flags);
 
-                ret = __wait_targetport_unreg(nport, tport);
+                ret = __targetport_unreg(nport, tport);
                 if (ret)
                         pr_warn("%s: Failed deleting target port\n", __func__);
 
-                ret = __wait_remoteport_unreg(nport, rport);
+                ret = __remoteport_unreg(nport, rport);
                 if (ret)
                         pr_warn("%s: Failed deleting remote port\n", __func__);
 
diff --git a/drivers/nvme/target/nvmet.h b/drivers/nvme/target/nvmet.h
index 7d261ab894f4..7b8e20adf760 100644
--- a/drivers/nvme/target/nvmet.h
+++ b/drivers/nvme/target/nvmet.h
@@ -74,6 +74,7 @@ struct nvmet_sq {
         struct percpu_ref       ref;
         u16                     qid;
         u16                     size;
+        u16                     sqhd;
         struct completion       free_done;
         struct completion       confirm_done;
 };
diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c
index de54c7f5048a..d12e5de78e70 100644
--- a/drivers/nvmem/core.c
+++ b/drivers/nvmem/core.c
@@ -135,7 +135,7 @@ static ssize_t bin_attr_nvmem_write(struct file *filp, struct kobject *kobj,
 
         /* Stop the user from writing */
         if (pos >= nvmem->size)
-                return 0;
+                return -EFBIG;
 
         if (count < nvmem->word_size)
                 return -EINVAL;
@@ -789,6 +789,7 @@ struct nvmem_cell *of_nvmem_cell_get(struct device_node *np,
                 return ERR_PTR(-EINVAL);
 
         nvmem = __nvmem_device_get(nvmem_np, NULL, NULL);
+        of_node_put(nvmem_np);
         if (IS_ERR(nvmem))
                 return ERR_CAST(nvmem);
 
diff --git a/drivers/pci/endpoint/functions/pci-epf-test.c b/drivers/pci/endpoint/functions/pci-epf-test.c
index 4ddc6e8f9fe7..f9308c2f22e6 100644
--- a/drivers/pci/endpoint/functions/pci-epf-test.c
+++ b/drivers/pci/endpoint/functions/pci-epf-test.c
@@ -251,9 +251,8 @@ err:
         return ret;
 }
 
-static void pci_epf_test_raise_irq(struct pci_epf_test *epf_test)
+static void pci_epf_test_raise_irq(struct pci_epf_test *epf_test, u8 irq)
 {
-        u8 irq;
         u8 msi_count;
         struct pci_epf *epf = epf_test->epf;
         struct pci_epc *epc = epf->epc;
@@ -262,7 +261,6 @@ static void pci_epf_test_raise_irq(struct pci_epf_test *epf_test)
 
         reg->status |= STATUS_IRQ_RAISED;
         msi_count = pci_epc_get_msi(epc);
-        irq = (reg->command & MSI_NUMBER_MASK) >> MSI_NUMBER_SHIFT;
         if (irq > msi_count || msi_count <= 0)
                 pci_epc_raise_irq(epc, PCI_EPC_IRQ_LEGACY, 0);
         else
@@ -289,6 +287,8 @@ static void pci_epf_test_cmd_handler(struct work_struct *work)
         reg->command = 0;
         reg->status = 0;
 
+        irq = (command & MSI_NUMBER_MASK) >> MSI_NUMBER_SHIFT;
+
         if (command & COMMAND_RAISE_LEGACY_IRQ) {
                 reg->status = STATUS_IRQ_RAISED;
                 pci_epc_raise_irq(epc, PCI_EPC_IRQ_LEGACY, 0);
@@ -301,7 +301,7 @@ static void pci_epf_test_cmd_handler(struct work_struct *work)
                         reg->status |= STATUS_WRITE_FAIL;
                 else
                         reg->status |= STATUS_WRITE_SUCCESS;
-                pci_epf_test_raise_irq(epf_test);
+                pci_epf_test_raise_irq(epf_test, irq);
                 goto reset_handler;
         }
 
@@ -311,7 +311,7 @@ static void pci_epf_test_cmd_handler(struct work_struct *work)
                         reg->status |= STATUS_READ_SUCCESS;
                 else
                         reg->status |= STATUS_READ_FAIL;
-                pci_epf_test_raise_irq(epf_test);
+                pci_epf_test_raise_irq(epf_test, irq);
                 goto reset_handler;
         }
 
@@ -321,13 +321,12 @@ static void pci_epf_test_cmd_handler(struct work_struct *work)
                         reg->status |= STATUS_COPY_SUCCESS;
                 else
                         reg->status |= STATUS_COPY_FAIL;
-                pci_epf_test_raise_irq(epf_test);
+                pci_epf_test_raise_irq(epf_test, irq);
                 goto reset_handler;
         }
 
         if (command & COMMAND_RAISE_MSI_IRQ) {
                 msi_count = pci_epc_get_msi(epc);
-                irq = (command & MSI_NUMBER_MASK) >> MSI_NUMBER_SHIFT;
                 if (irq > msi_count || msi_count <= 0)
                         goto reset_handler;
                 reg->status = STATUS_IRQ_RAISED;
diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
index 1eecfa301f7f..8e075ea2743e 100644
--- a/drivers/pci/pci-sysfs.c
+++ b/drivers/pci/pci-sysfs.c
@@ -686,7 +686,7 @@ static ssize_t driver_override_store(struct device *dev,
                                      const char *buf, size_t count)
 {
         struct pci_dev *pdev = to_pci_dev(dev);
-        char *driver_override, *old = pdev->driver_override, *cp;
+        char *driver_override, *old, *cp;
 
         /* We need to keep extra room for a newline */
         if (count >= (PAGE_SIZE - 1))
@@ -700,12 +700,15 @@ static ssize_t driver_override_store(struct device *dev,
         if (cp)
                 *cp = '\0';
 
+        device_lock(dev);
+        old = pdev->driver_override;
         if (strlen(driver_override)) {
                 pdev->driver_override = driver_override;
         } else {
                 kfree(driver_override);
                 pdev->driver_override = NULL;
         }
+        device_unlock(dev);
 
         kfree(old);
 
@@ -716,8 +719,12 @@ static ssize_t driver_override_show(struct device *dev,
                                     struct device_attribute *attr, char *buf)
 {
         struct pci_dev *pdev = to_pci_dev(dev);
+        ssize_t len;
 
-        return snprintf(buf, PAGE_SIZE, "%s\n", pdev->driver_override);
+        device_lock(dev);
+        len = snprintf(buf, PAGE_SIZE, "%s\n", pdev->driver_override);
+        device_unlock(dev);
+        return len;
 }
 static DEVICE_ATTR_RW(driver_override);
 
diff --git a/drivers/perf/arm_pmu_acpi.c b/drivers/perf/arm_pmu_acpi.c
index 0a9b78705ee8..3303dd8d8eb5 100644
--- a/drivers/perf/arm_pmu_acpi.c
+++ b/drivers/perf/arm_pmu_acpi.c
@@ -235,6 +235,7 @@ int arm_pmu_acpi_probe(armpmu_init_fn init_fn)
                 ret = armpmu_register(pmu);
                 if (ret) {
                         pr_warn("Failed to register PMU for CPU%d\n", cpu);
+                        kfree(pmu->name);
                         return ret;
                 }
         }
diff --git a/drivers/platform/x86/fujitsu-laptop.c b/drivers/platform/x86/fujitsu-laptop.c
index 85de30f93a9c..56a8195096a2 100644
--- a/drivers/platform/x86/fujitsu-laptop.c
+++ b/drivers/platform/x86/fujitsu-laptop.c
@@ -254,10 +254,12 @@ static int bl_update_status(struct backlight_device *b)
 {
         struct acpi_device *device = bl_get_data(b);
 
-        if (b->props.power == FB_BLANK_POWERDOWN)
-                call_fext_func(fext, FUNC_BACKLIGHT, 0x1, 0x4, 0x3);
-        else
-                call_fext_func(fext, FUNC_BACKLIGHT, 0x1, 0x4, 0x0);
+        if (fext) {
+                if (b->props.power == FB_BLANK_POWERDOWN)
+                        call_fext_func(fext, FUNC_BACKLIGHT, 0x1, 0x4, 0x3);
+                else
+                        call_fext_func(fext, FUNC_BACKLIGHT, 0x1, 0x4, 0x0);
+        }
 
         return set_lcd_level(device, b->props.brightness);
 }
diff --git a/drivers/rapidio/devices/tsi721.c b/drivers/rapidio/devices/tsi721.c
index 315a4be8dc1e..9a68914100ad 100644
--- a/drivers/rapidio/devices/tsi721.c
+++ b/drivers/rapidio/devices/tsi721.c
@@ -51,6 +51,8 @@ module_param(mbox_sel, byte, S_IRUGO);
 MODULE_PARM_DESC(mbox_sel,
                  "RIO Messaging MBOX Selection Mask (default: 0x0f = all)");
 
+static DEFINE_SPINLOCK(tsi721_maint_lock);
+
 static void tsi721_omsg_handler(struct tsi721_device *priv, int ch);
 static void tsi721_imsg_handler(struct tsi721_device *priv, int ch);
 
@@ -124,12 +126,15 @@ static int tsi721_maint_dma(struct tsi721_device *priv, u32 sys_size,
         void __iomem *regs = priv->regs + TSI721_DMAC_BASE(priv->mdma.ch_id);
         struct tsi721_dma_desc *bd_ptr;
         u32 rd_count, swr_ptr, ch_stat;
+        unsigned long flags;
         int i, err = 0;
         u32 op = do_wr ? MAINT_WR : MAINT_RD;
 
         if (offset > (RIO_MAINT_SPACE_SZ - len) || (len != sizeof(u32)))
                 return -EINVAL;
 
+        spin_lock_irqsave(&tsi721_maint_lock, flags);
+
         bd_ptr = priv->mdma.bd_base;
 
         rd_count = ioread32(regs + TSI721_DMAC_DRDCNT);
@@ -197,7 +202,9 @@ static int tsi721_maint_dma(struct tsi721_device *priv, u32 sys_size,
          */
         swr_ptr = ioread32(regs + TSI721_DMAC_DSWP);
         iowrite32(swr_ptr, regs + TSI721_DMAC_DSRP);
+
 err_out:
+        spin_unlock_irqrestore(&tsi721_maint_lock, flags);
 
         return err;
 }
diff --git a/drivers/rapidio/rio-access.c b/drivers/rapidio/rio-access.c
index a3824baca2e5..3ee9af83b638 100644
--- a/drivers/rapidio/rio-access.c
+++ b/drivers/rapidio/rio-access.c
@@ -14,16 +14,8 @@
 #include <linux/module.h>
 
 /*
- * These interrupt-safe spinlocks protect all accesses to RIO
- * configuration space and doorbell access.
- */
-static DEFINE_SPINLOCK(rio_config_lock);
-static DEFINE_SPINLOCK(rio_doorbell_lock);
-
-/*
  *  Wrappers for all RIO configuration access functions.  They just check
- *  alignment, do locking and call the low-level functions pointed to
- *  by rio_mport->ops.
+ *  alignment and call the low-level functions pointed to by rio_mport->ops.
  */
 
 #define RIO_8_BAD 0
@@ -44,13 +36,10 @@ int __rio_local_read_config_##size \
         (struct rio_mport *mport, u32 offset, type *value)              \
 {                                                                       \
         int res;                                                        \
-        unsigned long flags;                                            \
         u32 data = 0;                                                   \
         if (RIO_##size##_BAD) return RIO_BAD_SIZE;                      \
-        spin_lock_irqsave(&rio_config_lock, flags);                     \
         res = mport->ops->lcread(mport, mport->id, offset, len, &data); \
         *value = (type)data;                                            \
-        spin_unlock_irqrestore(&rio_config_lock, flags);                \
         return res;                                                     \
 }
 
@@ -67,13 +56,8 @@ int __rio_local_read_config_##size \
 int __rio_local_write_config_##size \
         (struct rio_mport *mport, u32 offset, type value)               \
 {                                                                       \
-        int res;                                                        \
-        unsigned long flags;                                            \
         if (RIO_##size##_BAD) return RIO_BAD_SIZE;                      \
-        spin_lock_irqsave(&rio_config_lock, flags);                     \
-        res = mport->ops->lcwrite(mport, mport->id, offset, len, value);\
-        spin_unlock_irqrestore(&rio_config_lock, flags);                \
-        return res;                                                     \
+        return mport->ops->lcwrite(mport, mport->id, offset, len, value);\
 }
 
 RIO_LOP_READ(8, u8, 1)
@@ -104,13 +88,10 @@ int rio_mport_read_config_##size \
         (struct rio_mport *mport, u16 destid, u8 hopcount, u32 offset, type *value)     \
 {                                                                       \
         int res;                                                        \
-        unsigned long flags;                                            \
         u32 data = 0;                                                   \
         if (RIO_##size##_BAD) return RIO_BAD_SIZE;                      \
-        spin_lock_irqsave(&rio_config_lock, flags);                     \
         res = mport->ops->cread(mport, mport->id, destid, hopcount, offset, len, &data); \
         *value = (type)data;                                            \
-        spin_unlock_irqrestore(&rio_config_lock, flags);                \
         return res;                                                     \
 }
 
@@ -127,13 +108,9 @@ int rio_mport_read_config_##size \
 int rio_mport_write_config_##size \
         (struct rio_mport *mport, u16 destid, u8 hopcount, u32 offset, type value)      \
 {                                                                       \
-        int res;                                                        \
-        unsigned long flags;                                            \
         if (RIO_##size##_BAD) return RIO_BAD_SIZE;                      \
-        spin_lock_irqsave(&rio_config_lock, flags);                     \
-        res = mport->ops->cwrite(mport, mport->id, destid, hopcount, offset, len, value); \
-        spin_unlock_irqrestore(&rio_config_lock, flags);                \
-        return res;                                                     \
+        return mport->ops->cwrite(mport, mport->id, destid, hopcount,   \
+                        offset, len, value);                            \
 }
 
 RIO_OP_READ(8, u8, 1)
@@ -162,14 +139,7 @@ EXPORT_SYMBOL_GPL(rio_mport_write_config_32);
  */
 int rio_mport_send_doorbell(struct rio_mport *mport, u16 destid, u16 data)
 {
-        int res;
-        unsigned long flags;
-
-        spin_lock_irqsave(&rio_doorbell_lock, flags);
-        res = mport->ops->dsend(mport, mport->id, destid, data);
-        spin_unlock_irqrestore(&rio_doorbell_lock, flags);
-
-        return res;
+        return mport->ops->dsend(mport, mport->id, destid, data);
 }
 
 EXPORT_SYMBOL_GPL(rio_mport_send_doorbell);
diff --git a/drivers/reset/Kconfig b/drivers/reset/Kconfig
index e0c393214264..e2baecbb9dd3 100644
--- a/drivers/reset/Kconfig
+++ b/drivers/reset/Kconfig
@@ -34,11 +34,12 @@ config RESET_BERLIN
         help
           This enables the reset controller driver for Marvell Berlin SoCs.
 
-config RESET_HSDK_V1
-        bool "HSDK v1 Reset Driver"
-        default n
+config RESET_HSDK
+        bool "Synopsys HSDK Reset Driver"
+        depends on HAS_IOMEM
+        depends on ARC_SOC_HSDK || COMPILE_TEST
         help
-          This enables the reset controller driver for HSDK v1.
+          This enables the reset controller driver for HSDK board.
 
 config RESET_IMX7
         bool "i.MX7 Reset Driver" if COMPILE_TEST
diff --git a/drivers/reset/Makefile b/drivers/reset/Makefile
index d368367110e5..af1c15c330b3 100644
--- a/drivers/reset/Makefile
+++ b/drivers/reset/Makefile
@@ -5,7 +5,7 @@ obj-$(CONFIG_ARCH_TEGRA) += tegra/
 obj-$(CONFIG_RESET_A10SR) += reset-a10sr.o
 obj-$(CONFIG_RESET_ATH79) += reset-ath79.o
 obj-$(CONFIG_RESET_BERLIN) += reset-berlin.o
-obj-$(CONFIG_RESET_HSDK_V1) += reset-hsdk-v1.o
+obj-$(CONFIG_RESET_HSDK) += reset-hsdk.o
 obj-$(CONFIG_RESET_IMX7) += reset-imx7.o
 obj-$(CONFIG_RESET_LANTIQ) += reset-lantiq.o
 obj-$(CONFIG_RESET_LPC18XX) += reset-lpc18xx.o
diff --git a/drivers/reset/reset-hsdk-v1.c b/drivers/reset/reset-hsdk.c
index bca13e4bf622..8bce391c6943 100644
--- a/drivers/reset/reset-hsdk-v1.c
+++ b/drivers/reset/reset-hsdk.c
@@ -1,7 +1,7 @@
 /*
  * Copyright (C) 2017 Synopsys.
  *
- * Synopsys HSDKv1 SDP reset driver.
+ * Synopsys HSDK Development platform reset driver.
  *
  * This file is licensed under the terms of the GNU General Public
  * License version 2. This program is licensed "as is" without any
@@ -18,9 +18,9 @@
 #include <linux/slab.h>
 #include <linux/types.h>
 
-#define to_hsdkv1_rst(p)        container_of((p), struct hsdkv1_rst, rcdev)
+#define to_hsdk_rst(p)  container_of((p), struct hsdk_rst, rcdev)
 
-struct hsdkv1_rst {
+struct hsdk_rst {
         void __iomem                    *regs_ctl;
         void __iomem                    *regs_rst;
         spinlock_t                      lock;
@@ -49,12 +49,12 @@ static const u32 rst_map[] = {
 #define CGU_IP_SW_RESET_RESET           BIT(0)
 #define SW_RESET_TIMEOUT                10000
 
-static void hsdkv1_reset_config(struct hsdkv1_rst *rst, unsigned long id)
+static void hsdk_reset_config(struct hsdk_rst *rst, unsigned long id)
 {
         writel(rst_map[id], rst->regs_ctl + CGU_SYS_RST_CTRL);
 }
 
-static int hsdkv1_reset_do(struct hsdkv1_rst *rst)
+static int hsdk_reset_do(struct hsdk_rst *rst)
 {
         u32 reg;
 
@@ -69,28 +69,28 @@ static int hsdkv1_reset_do(struct hsdkv1_rst *rst)
                 !(reg & CGU_IP_SW_RESET_RESET), 5, SW_RESET_TIMEOUT);
 }
 
-static int hsdkv1_reset_reset(struct reset_controller_dev *rcdev,
+static int hsdk_reset_reset(struct reset_controller_dev *rcdev,
                               unsigned long id)
 {
-        struct hsdkv1_rst *rst = to_hsdkv1_rst(rcdev);
+        struct hsdk_rst *rst = to_hsdk_rst(rcdev);
         unsigned long flags;
         int ret;
 
         spin_lock_irqsave(&rst->lock, flags);
-        hsdkv1_reset_config(rst, id);
-        ret = hsdkv1_reset_do(rst);
+        hsdk_reset_config(rst, id);
+        ret = hsdk_reset_do(rst);
         spin_unlock_irqrestore(&rst->lock, flags);
 
         return ret;
 }
 
-static const struct reset_control_ops hsdkv1_reset_ops = {
-        .reset  = hsdkv1_reset_reset,
+static const struct reset_control_ops hsdk_reset_ops = {
+        .reset  = hsdk_reset_reset,
 };
 
-static int hsdkv1_reset_probe(struct platform_device *pdev)
+static int hsdk_reset_probe(struct platform_device *pdev)
 {
-        struct hsdkv1_rst *rst;
+        struct hsdk_rst *rst;
         struct resource *mem;
 
         rst = devm_kzalloc(&pdev->dev, sizeof(*rst), GFP_KERNEL);
@@ -110,7 +110,7 @@ static int hsdkv1_reset_probe(struct platform_device *pdev)
         spin_lock_init(&rst->lock);
 
         rst->rcdev.owner = THIS_MODULE;
-        rst->rcdev.ops = &hsdkv1_reset_ops;
+        rst->rcdev.ops = &hsdk_reset_ops;
         rst->rcdev.of_node = pdev->dev.of_node;
         rst->rcdev.nr_resets = HSDK_MAX_RESETS;
         rst->rcdev.of_reset_n_cells = 1;
@@ -118,20 +118,20 @@ static int hsdkv1_reset_probe(struct platform_device *pdev)
         return reset_controller_register(&rst->rcdev);
 }
 
-static const struct of_device_id hsdkv1_reset_dt_match[] = {
-        { .compatible = "snps,hsdk-v1.0-reset" },
+static const struct of_device_id hsdk_reset_dt_match[] = {
+        { .compatible = "snps,hsdk-reset" },
         { },
 };
 
-static struct platform_driver hsdkv1_reset_driver = {
-        .probe  = hsdkv1_reset_probe,
+static struct platform_driver hsdk_reset_driver = {
+        .probe  = hsdk_reset_probe,
         .driver = {
-                .name = "hsdk-v1.0-reset",
-                .of_match_table = hsdkv1_reset_dt_match,
+                .name = "hsdk-reset",
+                .of_match_table = hsdk_reset_dt_match,
         },
 };
-builtin_platform_driver(hsdkv1_reset_driver);
+builtin_platform_driver(hsdk_reset_driver);
 
 MODULE_AUTHOR("Eugeniy Paltsev <Eugeniy.Paltsev@synopsys.com>");
-MODULE_DESCRIPTION("Synopsys HSDKv1 SDP reset driver");
+MODULE_DESCRIPTION("Synopsys HSDK SDP reset driver");
 MODULE_LICENSE("GPL v2");
diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
index ea19b4ff87a2..29f35e29d480 100644
--- a/drivers/s390/block/dasd.c
+++ b/drivers/s390/block/dasd.c
@@ -1644,7 +1644,9 @@ void dasd_generic_handle_state_change(struct dasd_device *device)
         dasd_schedule_device_bh(device);
         if (device->block) {
                 dasd_schedule_block_bh(device->block);
-                blk_mq_run_hw_queues(device->block->request_queue, true);
+                if (device->block->request_queue)
+                        blk_mq_run_hw_queues(device->block->request_queue,
+                                             true);
         }
 }
 EXPORT_SYMBOL_GPL(dasd_generic_handle_state_change);
@@ -3759,7 +3761,9 @@ int dasd_generic_path_operational(struct dasd_device *device)
         dasd_schedule_device_bh(device);
         if (device->block) {
                 dasd_schedule_block_bh(device->block);
-                blk_mq_run_hw_queues(device->block->request_queue, true);
+                if (device->block->request_queue)
+                        blk_mq_run_hw_queues(device->block->request_queue,
+                                             true);
                 }
 
         if (!device->stopped)
@@ -4025,7 +4029,9 @@ int dasd_generic_restore_device(struct ccw_device *cdev)
 
         if (device->block) {
                 dasd_schedule_block_bh(device->block);
-                blk_mq_run_hw_queues(device->block->request_queue, true);
+                if (device->block->request_queue)
+                        blk_mq_run_hw_queues(device->block->request_queue,
+                                             true);
         }
 
         clear_bit(DASD_FLAG_SUSPENDED, &device->flags);
diff --git a/drivers/s390/block/scm_blk.c b/drivers/s390/block/scm_blk.c
index 2e7fd966c515..eb51893c74a4 100644
--- a/drivers/s390/block/scm_blk.c
+++ b/drivers/s390/block/scm_blk.c
@@ -249,7 +249,7 @@ static void scm_request_requeue(struct scm_request *scmrq)
 static void scm_request_finish(struct scm_request *scmrq)
 {
         struct scm_blk_dev *bdev = scmrq->bdev;
-        int *error;
+        blk_status_t *error;
         int i;
 
         for (i = 0; i < nr_requests_per_io && scmrq->request[i]; i++) {
@@ -415,7 +415,7 @@ void scm_blk_irq(struct scm_device *scmdev, void *data, blk_status_t error)
 
 static void scm_blk_request_done(struct request *req)
 {
-        int *error = blk_mq_rq_to_pdu(req);
+        blk_status_t *error = blk_mq_rq_to_pdu(req);
 
         blk_mq_end_request(req, *error);
 }
@@ -450,7 +450,7 @@ int scm_blk_dev_setup(struct scm_blk_dev *bdev, struct scm_device *scmdev)
         atomic_set(&bdev->queued_reqs, 0);
 
         bdev->tag_set.ops = &scm_mq_ops;
-        bdev->tag_set.cmd_size = sizeof(int);
+        bdev->tag_set.cmd_size = sizeof(blk_status_t);
         bdev->tag_set.nr_hw_queues = nr_requests;
         bdev->tag_set.queue_depth = nr_requests_per_io * nr_requests;
         bdev->tag_set.flags = BLK_MQ_F_SHOULD_MERGE;
diff --git a/drivers/s390/cio/device.c b/drivers/s390/cio/device.c
index 489b583f263d..e5c32f4b5287 100644
--- a/drivers/s390/cio/device.c
+++ b/drivers/s390/cio/device.c
@@ -1225,10 +1225,16 @@ static int device_is_disconnected(struct ccw_device *cdev)
 static int recovery_check(struct device *dev, void *data)
 {
         struct ccw_device *cdev = to_ccwdev(dev);
+        struct subchannel *sch;
         int *redo = data;
 
         spin_lock_irq(cdev->ccwlock);
         switch (cdev->private->state) {
+        case DEV_STATE_ONLINE:
+                sch = to_subchannel(cdev->dev.parent);
+                if ((sch->schib.pmcw.pam & sch->opm) == sch->vpm)
+                        break;
+                /* fall through */
         case DEV_STATE_DISCONNECTED:
                 CIO_MSG_EVENT(3, "recovery: trigger 0.%x.%04x\n",
                               cdev->private->dev_id.ssid,
@@ -1260,7 +1266,7 @@ static void recovery_work_func(struct work_struct *unused)
                 }
                 spin_unlock_irq(&recovery_lock);
         } else
-                CIO_MSG_EVENT(4, "recovery: end\n");
+                CIO_MSG_EVENT(3, "recovery: end\n");
 }
 
 static DECLARE_WORK(recovery_work, recovery_work_func);
@@ -1274,11 +1280,11 @@ static void recovery_func(unsigned long data)
         schedule_work(&recovery_work);
 }
 
-static void ccw_device_schedule_recovery(void)
+void ccw_device_schedule_recovery(void)
 {
         unsigned long flags;
 
-        CIO_MSG_EVENT(4, "recovery: schedule\n");
+        CIO_MSG_EVENT(3, "recovery: schedule\n");
         spin_lock_irqsave(&recovery_lock, flags);
         if (!timer_pending(&recovery_timer) || (recovery_phase != 0)) {
                 recovery_phase = 0;
diff --git a/drivers/s390/cio/device.h b/drivers/s390/cio/device.h
index ec497af99dd8..69cb70f080a5 100644
--- a/drivers/s390/cio/device.h
+++ b/drivers/s390/cio/device.h
@@ -134,6 +134,7 @@ void ccw_device_set_disconnected(struct ccw_device *cdev);
 void ccw_device_set_notoper(struct ccw_device *cdev);
 
 void ccw_device_set_timeout(struct ccw_device *, int);
+void ccw_device_schedule_recovery(void);
 
 /* Channel measurement facility related */
 void retry_set_schib(struct ccw_device *cdev);
diff --git a/drivers/s390/cio/device_fsm.c b/drivers/s390/cio/device_fsm.c
index 12016e32e519..f98ea674c3d8 100644
--- a/drivers/s390/cio/device_fsm.c
+++ b/drivers/s390/cio/device_fsm.c
@@ -476,6 +476,17 @@ static void create_fake_irb(struct irb *irb, int type)
         }
 }
 
+static void ccw_device_handle_broken_paths(struct ccw_device *cdev)
+{
+        struct subchannel *sch = to_subchannel(cdev->dev.parent);
+        u8 broken_paths = (sch->schib.pmcw.pam & sch->opm) ^ sch->vpm;
+
+        if (broken_paths && (cdev->private->path_broken_mask != broken_paths))
+                ccw_device_schedule_recovery();
+
+        cdev->private->path_broken_mask = broken_paths;
+}
+
 void ccw_device_verify_done(struct ccw_device *cdev, int err)
 {
         struct subchannel *sch;
@@ -508,6 +519,7 @@ callback:
                         memset(&cdev->private->irb, 0, sizeof(struct irb));
                 }
                 ccw_device_report_path_events(cdev);
+                ccw_device_handle_broken_paths(cdev);
                 break;
         case -ETIME:
         case -EUSERS:
diff --git a/drivers/s390/cio/io_sch.h b/drivers/s390/cio/io_sch.h
index 220f49145b2f..9a1b56b2df3e 100644
--- a/drivers/s390/cio/io_sch.h
+++ b/drivers/s390/cio/io_sch.h
@@ -131,6 +131,8 @@ struct ccw_device_private {
                                    not operable */
         u8 path_gone_mask;      /* mask of paths, that became unavailable */
         u8 path_new_mask;       /* mask of paths, that became available */
+        u8 path_broken_mask;    /* mask of paths, which were found to be
+                                   unusable */
         struct {
                 unsigned int fast:1;    /* post with "channel end" */
                 unsigned int repall:1;  /* report every interrupt status */
diff --git a/drivers/scsi/aacraid/aachba.c b/drivers/scsi/aacraid/aachba.c
index a64285ab0728..af3e4d3f9735 100644
--- a/drivers/scsi/aacraid/aachba.c
+++ b/drivers/scsi/aacraid/aachba.c
@@ -699,13 +699,13 @@ static void _aac_probe_container1(void * context, struct fib * fibptr)
         int status;
 
         dresp = (struct aac_mount *) fib_data(fibptr);
-        if (!(fibptr->dev->supplement_adapter_info.supported_options2 &
-            AAC_OPTION_VARIABLE_BLOCK_SIZE))
+        if (!aac_supports_2T(fibptr->dev)) {
                 dresp->mnt[0].capacityhigh = 0;
-        if ((le32_to_cpu(dresp->status) != ST_OK) ||
-            (le32_to_cpu(dresp->mnt[0].vol) != CT_NONE)) {
-                _aac_probe_container2(context, fibptr);
-                return;
+                if ((le32_to_cpu(dresp->status) == ST_OK) &&
+                        (le32_to_cpu(dresp->mnt[0].vol) != CT_NONE)) {
+                        _aac_probe_container2(context, fibptr);
+                        return;
+                }
         }
         scsicmd = (struct scsi_cmnd *) context;
 
diff --git a/drivers/scsi/aacraid/aacraid.h b/drivers/scsi/aacraid/aacraid.h
index 92fabf2b0c24..403a639574e5 100644
--- a/drivers/scsi/aacraid/aacraid.h
+++ b/drivers/scsi/aacraid/aacraid.h
@@ -2701,6 +2701,11 @@ static inline int aac_is_src(struct aac_dev *dev)
         return 0;
 }
 
+static inline int aac_supports_2T(struct aac_dev *dev)
+{
+        return (dev->adapter_info.options & AAC_OPT_NEW_COMM_64);
+}
+
 char * get_container_type(unsigned type);
 extern int numacb;
 extern char aac_driver_version[];
diff --git a/drivers/scsi/aacraid/linit.c b/drivers/scsi/aacraid/linit.c
index 87cc4a93e637..62beb2596466 100644
--- a/drivers/scsi/aacraid/linit.c
+++ b/drivers/scsi/aacraid/linit.c
@@ -906,12 +906,14 @@ static int aac_eh_dev_reset(struct scsi_cmnd *cmd)
 
         bus = aac_logical_to_phys(scmd_channel(cmd));
         cid = scmd_id(cmd);
-        info = &aac->hba_map[bus][cid];
-        if (bus >= AAC_MAX_BUSES || cid >= AAC_MAX_TARGETS ||
-            info->devtype != AAC_DEVTYPE_NATIVE_RAW)
+
+        if (bus >= AAC_MAX_BUSES || cid >= AAC_MAX_TARGETS)
                 return FAILED;
 
-        if (info->reset_state > 0)
+        info = &aac->hba_map[bus][cid];
+
+        if (info->devtype != AAC_DEVTYPE_NATIVE_RAW &&
+            info->reset_state > 0)
                 return FAILED;
 
         pr_err("%s: Host adapter reset request. SCSI hang ?\n",
@@ -962,12 +964,14 @@ static int aac_eh_target_reset(struct scsi_cmnd *cmd)
 
         bus = aac_logical_to_phys(scmd_channel(cmd));
         cid = scmd_id(cmd);
-        info = &aac->hba_map[bus][cid];
-        if (bus >= AAC_MAX_BUSES || cid >= AAC_MAX_TARGETS ||
-            info->devtype != AAC_DEVTYPE_NATIVE_RAW)
+
+        if (bus >= AAC_MAX_BUSES || cid >= AAC_MAX_TARGETS)
                 return FAILED;
 
-        if (info->reset_state > 0)
+        info = &aac->hba_map[bus][cid];
+
+        if (info->devtype != AAC_DEVTYPE_NATIVE_RAW &&
+            info->reset_state > 0)
                 return FAILED;
 
         pr_err("%s: Host adapter reset request. SCSI hang ?\n",
diff --git a/drivers/scsi/aacraid/src.c b/drivers/scsi/aacraid/src.c
index 48c2b2b34b72..0c9361c87ec8 100644
--- a/drivers/scsi/aacraid/src.c
+++ b/drivers/scsi/aacraid/src.c
@@ -740,6 +740,8 @@ static void aac_send_iop_reset(struct aac_dev *dev)
         aac_set_intx_mode(dev);
 
         src_writel(dev, MUnit.IDR, IOP_SRC_RESET_MASK);
+
+        msleep(5000);
 }
 
 static void aac_send_hardware_soft_reset(struct aac_dev *dev)
diff --git a/drivers/scsi/arm/acornscsi.c b/drivers/scsi/arm/acornscsi.c
index 690816f3c6af..421fe869a11e 100644
--- a/drivers/scsi/arm/acornscsi.c
+++ b/drivers/scsi/arm/acornscsi.c
@@ -2725,9 +2725,9 @@ int acornscsi_abort(struct scsi_cmnd *SCpnt)
  * Params   : SCpnt  - command causing reset
  * Returns  : one of SCSI_RESET_ macros
  */
-int acornscsi_host_reset(struct Scsi_Host *shpnt)
+int acornscsi_host_reset(struct scsi_cmnd *SCpnt)
 {
-        AS_Host *host = (AS_Host *)shpnt->hostdata;
+        AS_Host *host = (AS_Host *)SCpnt->device->host->hostdata;
         struct scsi_cmnd *SCptr;
     
     host->stats.resets += 1;
@@ -2741,7 +2741,7 @@ int acornscsi_host_reset(struct Scsi_Host *shpnt)
 
         printk(KERN_WARNING "acornscsi_reset: ");
         print_sbic_status(asr, ssr, host->scsi.phase);
-        for (devidx = 0; devidx < 9; devidx ++) {
+        for (devidx = 0; devidx < 9; devidx++)
             acornscsi_dumplog(host, devidx);
     }
 #endif
diff --git a/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c b/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c
index 785fb42f6650..2799a6b08f73 100644
--- a/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c
+++ b/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c
@@ -3767,7 +3767,7 @@ static int ibmvscsis_write_pending(struct se_cmd *se_cmd)
          */
         if ((vscsi->flags & (CLIENT_FAILED | RESPONSE_Q_DOWN))) {
                 pr_err("write_pending failed since: %d\n", vscsi->flags);
-                return 0;
+                return -EIO;
         }
 
         rc = srp_transfer_data(cmd, &vio_iu(iue)->srp.cmd, ibmvscsis_rdma,
diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
index bd4605a34f54..c62e8d111fd9 100644
--- a/drivers/scsi/libiscsi.c
+++ b/drivers/scsi/libiscsi.c
@@ -2851,9 +2851,6 @@ EXPORT_SYMBOL_GPL(iscsi_session_setup);
 /**
  * iscsi_session_teardown - destroy session, host, and cls_session
  * @cls_session: iscsi session
- *
- * The driver must have called iscsi_remove_session before
- * calling this.
  */
 void iscsi_session_teardown(struct iscsi_cls_session *cls_session)
 {
@@ -2863,6 +2860,8 @@ void iscsi_session_teardown(struct iscsi_cls_session *cls_session)
 
         iscsi_pool_free(&session->cmdpool);
 
+        iscsi_remove_session(cls_session);
+
         kfree(session->password);
         kfree(session->password_in);
         kfree(session->username);
@@ -2877,7 +2876,8 @@ void iscsi_session_teardown(struct iscsi_cls_session *cls_session)
         kfree(session->portal_type);
         kfree(session->discovery_parent_type);
 
-        iscsi_destroy_session(cls_session);
+        iscsi_free_session(cls_session);
+
         iscsi_host_dec_session_cnt(shost);
         module_put(owner);
 }
diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
index 7e7ae786121b..100bc4c8798d 100644
--- a/drivers/scsi/lpfc/lpfc_init.c
+++ b/drivers/scsi/lpfc/lpfc_init.c
@@ -6131,6 +6131,7 @@ lpfc_sli4_driver_resource_setup(struct lpfc_hba *phba)
                                 "Extents and RPI headers enabled.\n");
                 }
                 mempool_free(mboxq, phba->mbox_mem_pool);
+                rc = -EIO;
                 goto out_free_bsmbx;
         }
 
diff --git a/drivers/scsi/lpfc/lpfc_nvme.c b/drivers/scsi/lpfc/lpfc_nvme.c
index 79ba3ce063a4..23bdb1ca106e 100644
--- a/drivers/scsi/lpfc/lpfc_nvme.c
+++ b/drivers/scsi/lpfc/lpfc_nvme.c
@@ -884,7 +884,7 @@ out_err:
                                          wcqe->total_data_placed);
                         nCmd->transferred_length = 0;
                         nCmd->rcv_rsplen = 0;
-                        nCmd->status = NVME_SC_FC_TRANSPORT_ERROR;
+                        nCmd->status = NVME_SC_INTERNAL;
                 }
         }
 
diff --git a/drivers/scsi/qla2xxx/qla_nvme.c b/drivers/scsi/qla2xxx/qla_nvme.c
index 1f59e7a74c7b..6b33a1f24f56 100644
--- a/drivers/scsi/qla2xxx/qla_nvme.c
+++ b/drivers/scsi/qla2xxx/qla_nvme.c
@@ -180,7 +180,7 @@ static void qla_nvme_sp_done(void *ptr, int res)
                 goto rel;
 
         if (unlikely(res == QLA_FUNCTION_FAILED))
-                fd->status = NVME_SC_FC_TRANSPORT_ERROR;
+                fd->status = NVME_SC_INTERNAL;
         else
                 fd->status = 0;
 
diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c
index 38942050b265..dab876c65473 100644
--- a/drivers/scsi/scsi_error.c
+++ b/drivers/scsi/scsi_error.c
@@ -580,7 +580,8 @@ int scsi_check_sense(struct scsi_cmnd *scmd)
                 if (sshdr.asc == 0x20 || /* Invalid command operation code */
                     sshdr.asc == 0x21 || /* Logical block address out of range */
                     sshdr.asc == 0x24 || /* Invalid field in cdb */
-                    sshdr.asc == 0x26) { /* Parameter value invalid */
+                    sshdr.asc == 0x26 || /* Parameter value invalid */
+                    sshdr.asc == 0x27) { /* Write protected */
                         set_host_byte(scmd, DID_TARGET_FAILURE);
                 }
                 return SUCCESS;
diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
index e7818afeda2b..15590a063ad9 100644
--- a/drivers/scsi/scsi_scan.c
+++ b/drivers/scsi/scsi_scan.c
@@ -956,6 +956,9 @@ static int scsi_add_lun(struct scsi_device *sdev, unsigned char *inq_result,
         if (*bflags & BLIST_NO_DIF)
                 sdev->no_dif = 1;
 
+        if (*bflags & BLIST_UNMAP_LIMIT_WS)
+                sdev->unmap_limit_for_ws = 1;
+
         sdev->eh_timeout = SCSI_DEFAULT_EH_TIMEOUT;
 
         if (*bflags & BLIST_TRY_VPD_PAGES)
diff --git a/drivers/scsi/scsi_transport_fc.c b/drivers/scsi/scsi_transport_fc.c
index 3c6bc0081fcb..cbd4495d0ff9 100644
--- a/drivers/scsi/scsi_transport_fc.c
+++ b/drivers/scsi/scsi_transport_fc.c
@@ -2739,7 +2739,8 @@ fc_remote_port_add(struct Scsi_Host *shost, int channel,
 
         list_for_each_entry(rport, &fc_host->rports, peers) {
 
-                if ((rport->port_state == FC_PORTSTATE_BLOCKED) &&
+                if ((rport->port_state == FC_PORTSTATE_BLOCKED ||
+                     rport->port_state == FC_PORTSTATE_NOTPRESENT) &&
                         (rport->channel == channel)) {
 
                         switch (fc_host->tgtid_bind_type) {
@@ -2876,7 +2877,6 @@ fc_remote_port_add(struct Scsi_Host *shost, int channel,
                         memcpy(&rport->port_name, &ids->port_name,
                                 sizeof(rport->port_name));
                         rport->port_id = ids->port_id;
-                        rport->roles = ids->roles;
                         rport->port_state = FC_PORTSTATE_ONLINE;
                         rport->flags &= ~FC_RPORT_FAST_FAIL_TIMEDOUT;
 
@@ -2885,15 +2885,7 @@ fc_remote_port_add(struct Scsi_Host *shost, int channel,
                                                 fci->f->dd_fcrport_size);
                         spin_unlock_irqrestore(shost->host_lock, flags);
 
-                        if (ids->roles & FC_PORT_ROLE_FCP_TARGET) {
-                                scsi_target_unblock(&rport->dev, SDEV_RUNNING);
-
-                                /* initiate a scan of the target */
-                                spin_lock_irqsave(shost->host_lock, flags);
-                                rport->flags |= FC_RPORT_SCAN_PENDING;
-                                scsi_queue_work(shost, &rport->scan_work);
-                                spin_unlock_irqrestore(shost->host_lock, flags);
-                        }
+                        fc_remote_port_rolechg(rport, ids->roles);
                         return rport;
                 }
         }
@@ -3571,7 +3563,7 @@ fc_vport_sched_delete(struct work_struct *work)
 static enum blk_eh_timer_return
 fc_bsg_job_timeout(struct request *req)
 {
-        struct bsg_job *job = (void *) req->special;
+        struct bsg_job *job = blk_mq_rq_to_pdu(req);
         struct Scsi_Host *shost = fc_bsg_to_shost(job);
         struct fc_rport *rport = fc_bsg_to_rport(job);
         struct fc_internal *i = to_fc_internal(shost->transportt);
diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
index 8934f19bce8e..7404d26895f5 100644
--- a/drivers/scsi/scsi_transport_iscsi.c
+++ b/drivers/scsi/scsi_transport_iscsi.c
@@ -2211,22 +2211,6 @@ void iscsi_free_session(struct iscsi_cls_session *session)
 EXPORT_SYMBOL_GPL(iscsi_free_session);
 
 /**
- * iscsi_destroy_session - destroy iscsi session
- * @session: iscsi_session
- *
- * Can be called by a LLD or iscsi_transport. There must not be
- * any running connections.
- */
-int iscsi_destroy_session(struct iscsi_cls_session *session)
-{
-        iscsi_remove_session(session);
-        ISCSI_DBG_TRANS_SESSION(session, "Completing session destruction\n");
-        iscsi_free_session(session);
-        return 0;
-}
-EXPORT_SYMBOL_GPL(iscsi_destroy_session);
-
-/**
  * iscsi_create_conn - create iscsi class connection
  * @session: iscsi cls session
  * @dd_size: private driver data size
@@ -3689,7 +3673,7 @@ iscsi_if_rx(struct sk_buff *skb)
                 uint32_t group;
 
                 nlh = nlmsg_hdr(skb);
-                if (nlh->nlmsg_len < sizeof(*nlh) ||
+                if (nlh->nlmsg_len < sizeof(*nlh) + sizeof(*ev) ||
                     skb->len < nlh->nlmsg_len) {
                         break;
                 }
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index 11c1738c2100..d175c5c5ccf8 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -715,13 +715,21 @@ static void sd_config_discard(struct scsi_disk *sdkp, unsigned int mode)
                 break;
 
         case SD_LBP_WS16:
-                max_blocks = min_not_zero(sdkp->max_ws_blocks,
-                                          (u32)SD_MAX_WS16_BLOCKS);
+                if (sdkp->device->unmap_limit_for_ws)
+                        max_blocks = sdkp->max_unmap_blocks;
+                else
+                        max_blocks = sdkp->max_ws_blocks;
+
+                max_blocks = min_not_zero(max_blocks, (u32)SD_MAX_WS16_BLOCKS);
                 break;
 
         case SD_LBP_WS10:
-                max_blocks = min_not_zero(sdkp->max_ws_blocks,
-                                          (u32)SD_MAX_WS10_BLOCKS);
+                if (sdkp->device->unmap_limit_for_ws)
+                        max_blocks = sdkp->max_unmap_blocks;
+                else
+                        max_blocks = sdkp->max_ws_blocks;
+
+                max_blocks = min_not_zero(max_blocks, (u32)SD_MAX_WS10_BLOCKS);
                 break;
 
         case SD_LBP_ZERO:
@@ -2915,8 +2923,6 @@ static void sd_read_block_limits(struct scsi_disk *sdkp)
                                 sd_config_discard(sdkp, SD_LBP_WS16);
                         else if (sdkp->lbpws10)
                                 sd_config_discard(sdkp, SD_LBP_WS10);
-                        else if (sdkp->lbpu && sdkp->max_unmap_blocks)
-                                sd_config_discard(sdkp, SD_LBP_UNMAP);
                         else
                                 sd_config_discard(sdkp, SD_LBP_DISABLE);
                 }
@@ -3101,8 +3107,6 @@ static int sd_revalidate_disk(struct gendisk *disk)
                 sd_read_security(sdkp, buffer);
         }
 
-        sdkp->first_scan = 0;
-
         /*
          * We now have all cache related info, determine how we deal
          * with flush requests.
@@ -3117,7 +3121,7 @@ static int sd_revalidate_disk(struct gendisk *disk)
         q->limits.max_dev_sectors = logical_to_sectors(sdp, dev_max);
 
         /*
-         * Use the device's preferred I/O size for reads and writes
+         * Determine the device's preferred I/O size for reads and writes
          * unless the reported value is unreasonably small, large, or
          * garbage.
          */
@@ -3131,8 +3135,19 @@ static int sd_revalidate_disk(struct gendisk *disk)
                 rw_max = min_not_zero(logical_to_sectors(sdp, dev_max),
                                       (sector_t)BLK_DEF_MAX_SECTORS);
 
-        /* Combine with controller limits */
-        q->limits.max_sectors = min(rw_max, queue_max_hw_sectors(q));
+        /* Do not exceed controller limit */
+        rw_max = min(rw_max, queue_max_hw_sectors(q));
+
+        /*
+         * Only update max_sectors if previously unset or if the current value
+         * exceeds the capabilities of the hardware.
+         */
+        if (sdkp->first_scan ||
+            q->limits.max_sectors > q->limits.max_dev_sectors ||
+            q->limits.max_sectors > q->limits.max_hw_sectors)
+                q->limits.max_sectors = rw_max;
+
+        sdkp->first_scan = 0;
 
         set_capacity(disk, logical_to_sectors(sdp, sdkp->capacity));
         sd_config_write_same(sdkp);
diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
index cf0e71db9e51..0419c2298eab 100644
--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -828,6 +828,39 @@ static int max_sectors_bytes(struct request_queue *q)
         return max_sectors << 9;
 }
 
+static void
+sg_fill_request_table(Sg_fd *sfp, sg_req_info_t *rinfo)
+{
+        Sg_request *srp;
+        int val;
+        unsigned int ms;
+
+        val = 0;
+        list_for_each_entry(srp, &sfp->rq_list, entry) {
+                if (val > SG_MAX_QUEUE)
+                        break;
+                rinfo[val].req_state = srp->done + 1;
+                rinfo[val].problem =
+                        srp->header.masked_status &
+                        srp->header.host_status &
+                        srp->header.driver_status;
+                if (srp->done)
+                        rinfo[val].duration =
+                                srp->header.duration;
+                else {
+                        ms = jiffies_to_msecs(jiffies);
+                        rinfo[val].duration =
+                                (ms > srp->header.duration) ?
+                                (ms - srp->header.duration) : 0;
+                }
+                rinfo[val].orphan = srp->orphan;
+                rinfo[val].sg_io_owned = srp->sg_io_owned;
+                rinfo[val].pack_id = srp->header.pack_id;
+                rinfo[val].usr_ptr = srp->header.usr_ptr;
+                val++;
+        }
+}
+
 static long
 sg_ioctl(struct file *filp, unsigned int cmd_in, unsigned long arg)
 {
@@ -1012,38 +1045,13 @@ sg_ioctl(struct file *filp, unsigned int cmd_in, unsigned long arg)
                         return -EFAULT;
                 else {
                         sg_req_info_t *rinfo;
-                        unsigned int ms;
 
-                        rinfo = kmalloc(SZ_SG_REQ_INFO * SG_MAX_QUEUE,
-                                                                GFP_KERNEL);
+                        rinfo = kzalloc(SZ_SG_REQ_INFO * SG_MAX_QUEUE,
+                                        GFP_KERNEL);
                         if (!rinfo)
                                 return -ENOMEM;
                         read_lock_irqsave(&sfp->rq_list_lock, iflags);
-                        val = 0;
-                        list_for_each_entry(srp, &sfp->rq_list, entry) {
-                                if (val >= SG_MAX_QUEUE)
-                                        break;
-                                memset(&rinfo[val], 0, SZ_SG_REQ_INFO);
-                                rinfo[val].req_state = srp->done + 1;
-                                rinfo[val].problem =
-                                        srp->header.masked_status &
-                                        srp->header.host_status &
-                                        srp->header.driver_status;
-                                if (srp->done)
-                                        rinfo[val].duration =
-                                                srp->header.duration;
-                                else {
-                                        ms = jiffies_to_msecs(jiffies);
-                                        rinfo[val].duration =
-                                                (ms > srp->header.duration) ?
-                                                (ms - srp->header.duration) : 0;
-                                }
-                                rinfo[val].orphan = srp->orphan;
-                                rinfo[val].sg_io_owned = srp->sg_io_owned;
-                                rinfo[val].pack_id = srp->header.pack_id;
-                                rinfo[val].usr_ptr = srp->header.usr_ptr;
-                                val++;
-                        }
+                        sg_fill_request_table(sfp, rinfo);
                         read_unlock_irqrestore(&sfp->rq_list_lock, iflags);
                         result = __copy_to_user(p, rinfo,
                                                 SZ_SG_REQ_INFO * SG_MAX_QUEUE);
diff --git a/drivers/tty/mxser.c b/drivers/tty/mxser.c
index 1c0c9553bc05..7dd38047ba23 100644
--- a/drivers/tty/mxser.c
+++ b/drivers/tty/mxser.c
@@ -246,11 +246,11 @@ struct mxser_port {
         unsigned char err_shadow;
 
         struct async_icount icount; /* kernel counters for 4 input interrupts */
-        int timeout;
+        unsigned int timeout;
 
         int read_status_mask;
         int ignore_status_mask;
-        int xmit_fifo_size;
+        unsigned int xmit_fifo_size;
         int xmit_head;
         int xmit_tail;
         int xmit_cnt;
@@ -572,8 +572,9 @@ static void mxser_dtr_rts(struct tty_port *port, int on)
 static int mxser_set_baud(struct tty_struct *tty, long newspd)
 {
         struct mxser_port *info = tty->driver_data;
-        int quot = 0, baud;
+        unsigned int quot = 0, baud;
         unsigned char cval;
+        u64 timeout;
 
         if (!info->ioaddr)
                 return -1;
@@ -594,8 +595,13 @@ static int mxser_set_baud(struct tty_struct *tty, long newspd)
                 quot = 0;
         }
 
-        info->timeout = ((info->xmit_fifo_size * HZ * 10 * quot) / info->baud_base);
-        info->timeout += HZ / 50;       /* Add .02 seconds of slop */
+        /*
+         * worst case (128 * 1000 * 10 * 18432) needs 35 bits, so divide in the
+         * u64 domain
+         */
+        timeout = (u64)info->xmit_fifo_size * HZ * 10 * quot;
+        do_div(timeout, info->baud_base);
+        info->timeout = timeout + HZ / 50; /* Add .02 seconds of slop */
 
         if (quot) {
                 info->MCR |= UART_MCR_DTR;
diff --git a/drivers/tty/serial/bcm63xx_uart.c b/drivers/tty/serial/bcm63xx_uart.c
index 583c9a0c7ecc..8c48c3784831 100644
--- a/drivers/tty/serial/bcm63xx_uart.c
+++ b/drivers/tty/serial/bcm63xx_uart.c
@@ -507,9 +507,14 @@ static void bcm_uart_set_termios(struct uart_port *port,
 {
         unsigned int ctl, baud, quot, ier;
         unsigned long flags;
+        int tries;
 
         spin_lock_irqsave(&port->lock, flags);
 
+        /* Drain the hot tub fully before we power it off for the winter. */
+        for (tries = 3; !bcm_uart_tx_empty(port) && tries; tries--)
+                mdelay(10);
+
         /* disable uart while changing speed */
         bcm_uart_disable(port);
         bcm_uart_flush(port);
diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
index 849c1f9991ce..f0252184291e 100644
--- a/drivers/tty/serial/fsl_lpuart.c
+++ b/drivers/tty/serial/fsl_lpuart.c
@@ -1276,7 +1276,6 @@ static void rx_dma_timer_init(struct lpuart_port *sport)
 static int lpuart_startup(struct uart_port *port)
 {
         struct lpuart_port *sport = container_of(port, struct lpuart_port, port);
-        int ret;
         unsigned long flags;
         unsigned char temp;
 
@@ -1291,11 +1290,6 @@ static int lpuart_startup(struct uart_port *port)
         sport->rxfifo_size = 0x1 << (((temp >> UARTPFIFO_RXSIZE_OFF) &
                 UARTPFIFO_FIFOSIZE_MASK) + 1);
 
-        ret = devm_request_irq(port->dev, port->irq, lpuart_int, 0,
-                                DRIVER_NAME, sport);
-        if (ret)
-                return ret;
-
         spin_lock_irqsave(&sport->port.lock, flags);
 
         lpuart_setup_watermark(sport);
@@ -1333,7 +1327,6 @@ static int lpuart_startup(struct uart_port *port)
 static int lpuart32_startup(struct uart_port *port)
 {
         struct lpuart_port *sport = container_of(port, struct lpuart_port, port);
-        int ret;
         unsigned long flags;
         unsigned long temp;
 
@@ -1346,11 +1339,6 @@ static int lpuart32_startup(struct uart_port *port)
         sport->rxfifo_size = 0x1 << (((temp >> UARTFIFO_RXSIZE_OFF) &
                 UARTFIFO_FIFOSIZE_MASK) - 1);
 
-        ret = devm_request_irq(port->dev, port->irq, lpuart32_int, 0,
-                                DRIVER_NAME, sport);
-        if (ret)
-                return ret;
-
         spin_lock_irqsave(&sport->port.lock, flags);
 
         lpuart32_setup_watermark(sport);
@@ -1380,8 +1368,6 @@ static void lpuart_shutdown(struct uart_port *port)
 
         spin_unlock_irqrestore(&port->lock, flags);
 
-        devm_free_irq(port->dev, port->irq, sport);
-
         if (sport->lpuart_dma_rx_use) {
                 del_timer_sync(&sport->lpuart_timer);
                 lpuart_dma_rx_free(&sport->port);
@@ -1400,7 +1386,6 @@ static void lpuart_shutdown(struct uart_port *port)
 
 static void lpuart32_shutdown(struct uart_port *port)
 {
-        struct lpuart_port *sport = container_of(port, struct lpuart_port, port);
         unsigned long temp;
         unsigned long flags;
 
@@ -1413,8 +1398,6 @@ static void lpuart32_shutdown(struct uart_port *port)
         lpuart32_write(port, temp, UARTCTRL);
 
         spin_unlock_irqrestore(&port->lock, flags);
-
-        devm_free_irq(port->dev, port->irq, sport);
 }
 
 static void
@@ -2212,16 +2195,22 @@ static int lpuart_probe(struct platform_device *pdev)
 
         platform_set_drvdata(pdev, &sport->port);
 
-        if (lpuart_is_32(sport))
+        if (lpuart_is_32(sport)) {
                 lpuart_reg.cons = LPUART32_CONSOLE;
-        else
+                ret = devm_request_irq(&pdev->dev, sport->port.irq, lpuart32_int, 0,
+                                        DRIVER_NAME, sport);
+        } else {
                 lpuart_reg.cons = LPUART_CONSOLE;
+                ret = devm_request_irq(&pdev->dev, sport->port.irq, lpuart_int, 0,
+                                        DRIVER_NAME, sport);
+        }
+
+        if (ret)
+                goto failed_irq_request;
 
         ret = uart_add_one_port(&lpuart_reg, &sport->port);
-        if (ret) {
-                clk_disable_unprepare(sport->clk);
-                return ret;
-        }
+        if (ret)
+                goto failed_attach_port;
 
         sport->dma_tx_chan = dma_request_slave_channel(sport->port.dev, "tx");
         if (!sport->dma_tx_chan)
@@ -2240,6 +2229,11 @@ static int lpuart_probe(struct platform_device *pdev)
         }
 
         return 0;
+
+failed_attach_port:
+failed_irq_request:
+        clk_disable_unprepare(sport->clk);
+        return ret;
 }
 
 static int lpuart_remove(struct platform_device *pdev)
diff --git a/drivers/tty/serial/sccnxp.c b/drivers/tty/serial/sccnxp.c
index cdd2f942317c..b9c7a904c1ea 100644
--- a/drivers/tty/serial/sccnxp.c
+++ b/drivers/tty/serial/sccnxp.c
@@ -889,7 +889,16 @@ static int sccnxp_probe(struct platform_device *pdev)
                         goto err_out;
                 uartclk = 0;
         } else {
-                clk_prepare_enable(clk);
+                ret = clk_prepare_enable(clk);
+                if (ret)
+                        goto err_out;
+
+                ret = devm_add_action_or_reset(&pdev->dev,
+                                (void(*)(void *))clk_disable_unprepare,
+                                clk);
+                if (ret)
+                        goto err_out;
+
                 uartclk = clk_get_rate(clk);
         }
 
@@ -988,7 +997,7 @@ static int sccnxp_probe(struct platform_device *pdev)
         uart_unregister_driver(&s->uart);
 err_out:
         if (!IS_ERR(s->regulator))
-                return regulator_disable(s->regulator);
+                regulator_disable(s->regulator);
 
         return ret;
 }
diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
index 5aacea1978a5..3e865dbf878c 100644
--- a/drivers/usb/class/cdc-wdm.c
+++ b/drivers/usb/class/cdc-wdm.c
@@ -190,8 +190,10 @@ static void wdm_in_callback(struct urb *urb)
         /*
          * only set a new error if there is no previous error.
          * Errors are only cleared during read/open
+         * Avoid propagating -EPIPE (stall) to userspace since it is
+         * better handled as an empty read
          */
-        if (desc->rerr  == 0)
+        if (desc->rerr == 0 && status != -EPIPE)
                 desc->rerr = status;
 
         if (length + desc->length > desc->wMaxCommand) {
diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
index 4be52c602e9b..68b54bd88d1e 100644
--- a/drivers/usb/core/config.c
+++ b/drivers/usb/core/config.c
@@ -643,15 +643,23 @@ static int usb_parse_configuration(struct usb_device *dev, int cfgidx,
 
                 } else if (header->bDescriptorType ==
                                 USB_DT_INTERFACE_ASSOCIATION) {
+                        struct usb_interface_assoc_descriptor *d;
+
+                        d = (struct usb_interface_assoc_descriptor *)header;
+                        if (d->bLength < USB_DT_INTERFACE_ASSOCIATION_SIZE) {
+                                dev_warn(ddev,
+                                         "config %d has an invalid interface association descriptor of length %d, skipping\n",
+                                         cfgno, d->bLength);
+                                continue;
+                        }
+
                         if (iad_num == USB_MAXIADS) {
                                 dev_warn(ddev, "found more Interface "
                                                "Association Descriptors "
                                                "than allocated for in "
                                                "configuration %d\n", cfgno);
                         } else {
-                                config->intf_assoc[iad_num] =
-                                        (struct usb_interface_assoc_descriptor
-                                        *)header;
+                                config->intf_assoc[iad_num] = d;
                                 iad_num++;
                         }
 
@@ -852,7 +860,7 @@ int usb_get_configuration(struct usb_device *dev)
                 }
 
                 if (dev->quirks & USB_QUIRK_DELAY_INIT)
-                        msleep(100);
+                        msleep(200);
 
                 result = usb_get_descriptor(dev, USB_DT_CONFIG, cfgno,
                     bigbuffer, length);
diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index 318bb3b96687..4664e543cf2f 100644
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -140,6 +140,9 @@ module_param(usbfs_memory_mb, uint, 0644);
 MODULE_PARM_DESC(usbfs_memory_mb,
                 "maximum MB allowed for usbfs buffers (0 = no limit)");
 
+/* Hard limit, necessary to avoid arithmetic overflow */
+#define USBFS_XFER_MAX         (UINT_MAX / 2 - 1000000)
+
 static atomic64_t usbfs_memory_usage;   /* Total memory currently allocated */
 
 /* Check whether it's okay to allocate more memory for a transfer */
@@ -1460,6 +1463,8 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb
                                 USBDEVFS_URB_ZERO_PACKET |
                                 USBDEVFS_URB_NO_INTERRUPT))
                 return -EINVAL;
+        if ((unsigned int)uurb->buffer_length >= USBFS_XFER_MAX)
+                return -EINVAL;
         if (uurb->buffer_length > 0 && !uurb->buffer)
                 return -EINVAL;
         if (!(uurb->type == USBDEVFS_URB_TYPE_CONTROL &&
@@ -1571,7 +1576,11 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb
                         totlen += isopkt[u].length;
                 }
                 u *= sizeof(struct usb_iso_packet_descriptor);
-                uurb->buffer_length = totlen;
+                if (totlen <= uurb->buffer_length)
+                        uurb->buffer_length = totlen;
+                else
+                        WARN_ONCE(1, "uurb->buffer_length is too short %d vs %d",
+                                  totlen, uurb->buffer_length);
                 break;
 
         default:
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 41eaf0b52518..b5c733613823 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -4838,7 +4838,7 @@ static void hub_port_connect(struct usb_hub *hub, int port1, u16 portstatus,
                         goto loop;
 
                 if (udev->quirks & USB_QUIRK_DELAY_INIT)
-                        msleep(1000);
+                        msleep(2000);
 
                 /* consecutive bus-powered hubs aren't reliable; they can
                  * violate the voltage drop budget.  if the new child has
diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
index 4c38ea41ae96..371a07d874a3 100644
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -2069,6 +2069,10 @@ int cdc_parse_cdc_header(struct usb_cdc_parsed_header *hdr,
                         elength = 1;
                         goto next_desc;
                 }
+                if ((buflen < elength) || (elength < 3)) {
+                        dev_err(&intf->dev, "invalid descriptor buffer length\n");
+                        break;
+                }
                 if (buffer[1] != USB_DT_CS_INTERFACE) {
                         dev_err(&intf->dev, "skipping garbage\n");
                         goto next_desc;
diff --git a/drivers/usb/dwc3/dwc3-of-simple.c b/drivers/usb/dwc3/dwc3-of-simple.c
index 4cef7d4f9cd0..a26d1fde0f5e 100644
--- a/drivers/usb/dwc3/dwc3-of-simple.c
+++ b/drivers/usb/dwc3/dwc3-of-simple.c
@@ -177,6 +177,7 @@ static const struct of_device_id of_dwc3_simple_match[] = {
         { .compatible = "rockchip,rk3399-dwc3" },
         { .compatible = "xlnx,zynqmp-dwc3" },
         { .compatible = "cavium,octeon-7130-usb-uctl" },
+        { .compatible = "sprd,sc9860-dwc3" },
         { /* Sentinel */ }
 };
 MODULE_DEVICE_TABLE(of, of_dwc3_simple_match);
diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c
index 827e376bfa97..75e6cb044eb2 100644
--- a/drivers/usb/dwc3/ep0.c
+++ b/drivers/usb/dwc3/ep0.c
@@ -990,6 +990,8 @@ static void __dwc3_ep0_do_control_data(struct dwc3 *dwc,
                                          DWC3_TRBCTL_CONTROL_DATA,
                                          true);
 
+                req->trb = &dwc->ep0_trb[dep->trb_enqueue - 1];
+
                 /* Now prepare one extra TRB to align transfer size */
                 dwc3_ep0_prepare_one_trb(dep, dwc->bounce_addr,
                                          maxpacket - rem,
@@ -1015,6 +1017,8 @@ static void __dwc3_ep0_do_control_data(struct dwc3 *dwc,
                                          DWC3_TRBCTL_CONTROL_DATA,
                                          true);
 
+                req->trb = &dwc->ep0_trb[dep->trb_enqueue - 1];
+
                 /* Now prepare one extra TRB to align transfer size */
                 dwc3_ep0_prepare_one_trb(dep, dwc->bounce_addr,
                                          0, DWC3_TRBCTL_CONTROL_DATA,
@@ -1029,6 +1033,9 @@ static void __dwc3_ep0_do_control_data(struct dwc3 *dwc,
                 dwc3_ep0_prepare_one_trb(dep, req->request.dma,
                                 req->request.length, DWC3_TRBCTL_CONTROL_DATA,
                                 false);
+
+                req->trb = &dwc->ep0_trb[dep->trb_enqueue];
+
                 ret = dwc3_ep0_start_trans(dep);
         }
 
diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index 9990944a7245..8b342587f8ad 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -46,7 +46,8 @@
 static void ffs_data_get(struct ffs_data *ffs);
 static void ffs_data_put(struct ffs_data *ffs);
 /* Creates new ffs_data object. */
-static struct ffs_data *__must_check ffs_data_new(void) __attribute__((malloc));
+static struct ffs_data *__must_check ffs_data_new(const char *dev_name)
+        __attribute__((malloc));
 
 /* Opened counter handling. */
 static void ffs_data_opened(struct ffs_data *ffs);
@@ -780,11 +781,12 @@ static void ffs_epfile_async_io_complete(struct usb_ep *_ep,
                                          struct usb_request *req)
 {
         struct ffs_io_data *io_data = req->context;
+        struct ffs_data *ffs = io_data->ffs;
 
         ENTER();
 
         INIT_WORK(&io_data->work, ffs_user_copy_worker);
-        schedule_work(&io_data->work);
+        queue_work(ffs->io_completion_wq, &io_data->work);
 }
 
 static void __ffs_epfile_read_buffer_free(struct ffs_epfile *epfile)
@@ -1500,7 +1502,7 @@ ffs_fs_mount(struct file_system_type *t, int flags,
         if (unlikely(ret < 0))
                 return ERR_PTR(ret);
 
-        ffs = ffs_data_new();
+        ffs = ffs_data_new(dev_name);
         if (unlikely(!ffs))
                 return ERR_PTR(-ENOMEM);
         ffs->file_perms = data.perms;
@@ -1610,6 +1612,7 @@ static void ffs_data_put(struct ffs_data *ffs)
                 BUG_ON(waitqueue_active(&ffs->ev.waitq) ||
                        waitqueue_active(&ffs->ep0req_completion.wait) ||
                        waitqueue_active(&ffs->wait));
+                destroy_workqueue(ffs->io_completion_wq);
                 kfree(ffs->dev_name);
                 kfree(ffs);
         }
@@ -1642,7 +1645,7 @@ static void ffs_data_closed(struct ffs_data *ffs)
         ffs_data_put(ffs);
 }
 
-static struct ffs_data *ffs_data_new(void)
+static struct ffs_data *ffs_data_new(const char *dev_name)
 {
         struct ffs_data *ffs = kzalloc(sizeof *ffs, GFP_KERNEL);
         if (unlikely(!ffs))
@@ -1650,6 +1653,12 @@ static struct ffs_data *ffs_data_new(void)
 
         ENTER();
 
+        ffs->io_completion_wq = alloc_ordered_workqueue("%s", 0, dev_name);
+        if (!ffs->io_completion_wq) {
+                kfree(ffs);
+                return NULL;
+        }
+
         refcount_set(&ffs->ref, 1);
         atomic_set(&ffs->opened, 0);
         ffs->state = FFS_READ_DESCRIPTORS;
diff --git a/drivers/usb/gadget/function/f_mass_storage.c b/drivers/usb/gadget/function/f_mass_storage.c
index d6bd0244b008..5153e29870c3 100644
--- a/drivers/usb/gadget/function/f_mass_storage.c
+++ b/drivers/usb/gadget/function/f_mass_storage.c
@@ -307,8 +307,6 @@ struct fsg_common {
         struct completion       thread_notifier;
         struct task_struct      *thread_task;
 
-        /* Callback functions. */
-        const struct fsg_operations     *ops;
         /* Gadget's private data. */
         void                    *private_data;
 
@@ -2438,6 +2436,7 @@ static void handle_exception(struct fsg_common *common)
 static int fsg_main_thread(void *common_)
 {
         struct fsg_common       *common = common_;
+        int                     i;
 
         /*
          * Allow the thread to be killed by a signal, but set the signal mask
@@ -2476,21 +2475,16 @@ static int fsg_main_thread(void *common_)
         common->thread_task = NULL;
         spin_unlock_irq(&common->lock);
 
-        if (!common->ops || !common->ops->thread_exits
-         || common->ops->thread_exits(common) < 0) {
-                int i;
+        /* Eject media from all LUNs */
 
-                down_write(&common->filesem);
-                for (i = 0; i < ARRAY_SIZE(common->luns); i++) {
-                        struct fsg_lun *curlun = common->luns[i];
-                        if (!curlun || !fsg_lun_is_open(curlun))
-                                continue;
+        down_write(&common->filesem);
+        for (i = 0; i < ARRAY_SIZE(common->luns); i++) {
+                struct fsg_lun *curlun = common->luns[i];
 
+                if (curlun && fsg_lun_is_open(curlun))
                         fsg_lun_close(curlun);
-                        curlun->unit_attention_data = SS_MEDIUM_NOT_PRESENT;
-                }
-                up_write(&common->filesem);
         }
+        up_write(&common->filesem);
 
         /* Let fsg_unbind() know the thread has exited */
         complete_and_exit(&common->thread_notifier, 0);
@@ -2681,13 +2675,6 @@ void fsg_common_remove_luns(struct fsg_common *common)
 }
 EXPORT_SYMBOL_GPL(fsg_common_remove_luns);
 
-void fsg_common_set_ops(struct fsg_common *common,
-                        const struct fsg_operations *ops)
-{
-        common->ops = ops;
-}
-EXPORT_SYMBOL_GPL(fsg_common_set_ops);
-
 void fsg_common_free_buffers(struct fsg_common *common)
 {
         _fsg_common_free_buffers(common->buffhds, common->fsg_num_buffers);
diff --git a/drivers/usb/gadget/function/f_mass_storage.h b/drivers/usb/gadget/function/f_mass_storage.h
index d3902313b8ac..dc05ca0c4359 100644
--- a/drivers/usb/gadget/function/f_mass_storage.h
+++ b/drivers/usb/gadget/function/f_mass_storage.h
@@ -60,17 +60,6 @@ struct fsg_module_parameters {
 struct fsg_common;
 
 /* FSF callback functions */
-struct fsg_operations {
-        /*
-         * Callback function to call when thread exits.  If no
-         * callback is set or it returns value lower then zero MSF
-         * will force eject all LUNs it operates on (including those
-         * marked as non-removable or with prevent_medium_removal flag
-         * set).
-         */
-        int (*thread_exits)(struct fsg_common *common);
-};
-
 struct fsg_lun_opts {
         struct config_group group;
         struct fsg_lun *lun;
@@ -142,9 +131,6 @@ void fsg_common_remove_lun(struct fsg_lun *lun);
 
 void fsg_common_remove_luns(struct fsg_common *common);
 
-void fsg_common_set_ops(struct fsg_common *common,
-                        const struct fsg_operations *ops);
-
 int fsg_common_create_lun(struct fsg_common *common, struct fsg_lun_config *cfg,
                           unsigned int id, const char *name,
                           const char **name_pfx);
diff --git a/drivers/usb/gadget/function/f_printer.c b/drivers/usb/gadget/function/f_printer.c
index 8df244fc9d80..ea0da35a44e2 100644
--- a/drivers/usb/gadget/function/f_printer.c
+++ b/drivers/usb/gadget/function/f_printer.c
@@ -555,6 +555,7 @@ printer_write(struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
         size_t                  size;   /* Amount of data in a TX request. */
         size_t                  bytes_copied = 0;
         struct usb_request      *req;
+        int                     value;
 
         DBG(dev, "printer_write trying to send %d bytes\n", (int)len);
 
@@ -634,7 +635,11 @@ printer_write(struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
                         return -EAGAIN;
                 }
 
-                if (usb_ep_queue(dev->in_ep, req, GFP_ATOMIC)) {
+                /* here, we unlock, and only unlock, to avoid deadlock. */
+                spin_unlock(&dev->lock);
+                value = usb_ep_queue(dev->in_ep, req, GFP_ATOMIC);
+                spin_lock(&dev->lock);
+                if (value) {
                         list_add(&req->list, &dev->tx_reqs);
                         spin_unlock_irqrestore(&dev->lock, flags);
                         mutex_unlock(&dev->lock_printer_io);
diff --git a/drivers/usb/gadget/function/u_fs.h b/drivers/usb/gadget/function/u_fs.h
index 540f1c48c1a8..79f70ebf85dc 100644
--- a/drivers/usb/gadget/function/u_fs.h
+++ b/drivers/usb/gadget/function/u_fs.h
@@ -279,6 +279,7 @@ struct ffs_data {
         }                               file_perms;
 
         struct eventfd_ctx *ffs_eventfd;
+        struct workqueue_struct *io_completion_wq;
         bool no_disconnect;
         struct work_struct reset_work;
 
diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
index 684900fcfe24..5c28bee327e1 100644
--- a/drivers/usb/gadget/legacy/inode.c
+++ b/drivers/usb/gadget/legacy/inode.c
@@ -28,7 +28,7 @@
 #include <linux/aio.h>
 #include <linux/uio.h>
 #include <linux/refcount.h>
-
+#include <linux/delay.h>
 #include <linux/device.h>
 #include <linux/moduleparam.h>
 
@@ -116,6 +116,7 @@ enum ep0_state {
 struct dev_data {
         spinlock_t                      lock;
         refcount_t                      count;
+        int                             udc_usage;
         enum ep0_state                  state;          /* P: lock */
         struct usb_gadgetfs_event       event [N_EVENT];
         unsigned                        ev_next;
@@ -513,9 +514,9 @@ static void ep_aio_complete(struct usb_ep *ep, struct usb_request *req)
                 INIT_WORK(&priv->work, ep_user_copy_worker);
                 schedule_work(&priv->work);
         }
-        spin_unlock(&epdata->dev->lock);
 
         usb_ep_free_request(ep, req);
+        spin_unlock(&epdata->dev->lock);
         put_ep(epdata);
 }
 
@@ -939,9 +940,11 @@ ep0_read (struct file *fd, char __user *buf, size_t len, loff_t *ptr)
                         struct usb_request      *req = dev->req;
 
                         if ((retval = setup_req (ep, req, 0)) == 0) {
+                                ++dev->udc_usage;
                                 spin_unlock_irq (&dev->lock);
                                 retval = usb_ep_queue (ep, req, GFP_KERNEL);
                                 spin_lock_irq (&dev->lock);
+                                --dev->udc_usage;
                         }
                         dev->state = STATE_DEV_CONNECTED;
 
@@ -983,11 +986,14 @@ ep0_read (struct file *fd, char __user *buf, size_t len, loff_t *ptr)
                                 retval = -EIO;
                         else {
                                 len = min (len, (size_t)dev->req->actual);
-// FIXME don't call this with the spinlock held ...
+                                ++dev->udc_usage;
+                                spin_unlock_irq(&dev->lock);
                                 if (copy_to_user (buf, dev->req->buf, len))
                                         retval = -EFAULT;
                                 else
                                         retval = len;
+                                spin_lock_irq(&dev->lock);
+                                --dev->udc_usage;
                                 clean_req (dev->gadget->ep0, dev->req);
                                 /* NOTE userspace can't yet choose to stall */
                         }
@@ -1131,6 +1137,7 @@ ep0_write (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
                         retval = setup_req (dev->gadget->ep0, dev->req, len);
                         if (retval == 0) {
                                 dev->state = STATE_DEV_CONNECTED;
+                                ++dev->udc_usage;
                                 spin_unlock_irq (&dev->lock);
                                 if (copy_from_user (dev->req->buf, buf, len))
                                         retval = -EFAULT;
@@ -1142,6 +1149,7 @@ ep0_write (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
                                                 GFP_KERNEL);
                                 }
                                 spin_lock_irq(&dev->lock);
+                                --dev->udc_usage;
                                 if (retval < 0) {
                                         clean_req (dev->gadget->ep0, dev->req);
                                 } else
@@ -1243,9 +1251,21 @@ static long dev_ioctl (struct file *fd, unsigned code, unsigned long value)
         struct usb_gadget       *gadget = dev->gadget;
         long ret = -ENOTTY;
 
-        if (gadget->ops->ioctl)
+        spin_lock_irq(&dev->lock);
+        if (dev->state == STATE_DEV_OPENED ||
+                        dev->state == STATE_DEV_UNBOUND) {
+                /* Not bound to a UDC */
+        } else if (gadget->ops->ioctl) {
+                ++dev->udc_usage;
+                spin_unlock_irq(&dev->lock);
+
                 ret = gadget->ops->ioctl (gadget, code, value);
 
+                spin_lock_irq(&dev->lock);
+                --dev->udc_usage;
+        }
+        spin_unlock_irq(&dev->lock);
+
         return ret;
 }
 
@@ -1463,10 +1483,12 @@ delegate:
                                 if (value < 0)
                                         break;
 
+                                ++dev->udc_usage;
                                 spin_unlock (&dev->lock);
                                 value = usb_ep_queue (gadget->ep0, dev->req,
                                                         GFP_KERNEL);
                                 spin_lock (&dev->lock);
+                                --dev->udc_usage;
                                 if (value < 0) {
                                         clean_req (gadget->ep0, dev->req);
                                         break;
@@ -1490,8 +1512,12 @@ delegate:
                 req->length = value;
                 req->zero = value < w_length;
 
+                ++dev->udc_usage;
                 spin_unlock (&dev->lock);
                 value = usb_ep_queue (gadget->ep0, req, GFP_KERNEL);
+                spin_lock(&dev->lock);
+                --dev->udc_usage;
+                spin_unlock(&dev->lock);
                 if (value < 0) {
                         DBG (dev, "ep_queue --> %d\n", value);
                         req->status = 0;
@@ -1518,21 +1544,24 @@ static void destroy_ep_files (struct dev_data *dev)
                 /* break link to FS */
                 ep = list_first_entry (&dev->epfiles, struct ep_data, epfiles);
                 list_del_init (&ep->epfiles);
+                spin_unlock_irq (&dev->lock);
+
                 dentry = ep->dentry;
                 ep->dentry = NULL;
                 parent = d_inode(dentry->d_parent);
 
                 /* break link to controller */
+                mutex_lock(&ep->lock);
                 if (ep->state == STATE_EP_ENABLED)
                         (void) usb_ep_disable (ep->ep);
                 ep->state = STATE_EP_UNBOUND;
                 usb_ep_free_request (ep->ep, ep->req);
                 ep->ep = NULL;
+                mutex_unlock(&ep->lock);
+
                 wake_up (&ep->wait);
                 put_ep (ep);
 
-                spin_unlock_irq (&dev->lock);
-
                 /* break link to dcache */
                 inode_lock(parent);
                 d_delete (dentry);
@@ -1603,6 +1632,11 @@ gadgetfs_unbind (struct usb_gadget *gadget)
 
         spin_lock_irq (&dev->lock);
         dev->state = STATE_DEV_UNBOUND;
+        while (dev->udc_usage > 0) {
+                spin_unlock_irq(&dev->lock);
+                usleep_range(1000, 2000);
+                spin_lock_irq(&dev->lock);
+        }
         spin_unlock_irq (&dev->lock);
 
         destroy_ep_files (dev);
diff --git a/drivers/usb/gadget/legacy/mass_storage.c b/drivers/usb/gadget/legacy/mass_storage.c
index e99ab57ee3e5..fcba59782f26 100644
--- a/drivers/usb/gadget/legacy/mass_storage.c
+++ b/drivers/usb/gadget/legacy/mass_storage.c
@@ -107,15 +107,6 @@ static unsigned int fsg_num_buffers = CONFIG_USB_GADGET_STORAGE_NUM_BUFFERS;
 
 FSG_MODULE_PARAMETERS(/* no prefix */, mod_data);
 
-static unsigned long msg_registered;
-static void msg_cleanup(void);
-
-static int msg_thread_exits(struct fsg_common *common)
-{
-        msg_cleanup();
-        return 0;
-}
-
 static int msg_do_config(struct usb_configuration *c)
 {
         struct fsg_opts *opts;
@@ -154,9 +145,6 @@ static struct usb_configuration msg_config_driver = {
 
 static int msg_bind(struct usb_composite_dev *cdev)
 {
-        static const struct fsg_operations ops = {
-                .thread_exits = msg_thread_exits,
-        };
         struct fsg_opts *opts;
         struct fsg_config config;
         int status;
@@ -173,8 +161,6 @@ static int msg_bind(struct usb_composite_dev *cdev)
         if (status)
                 goto fail;
 
-        fsg_common_set_ops(opts->common, &ops);
-
         status = fsg_common_set_cdev(opts->common, cdev, config.can_stall);
         if (status)
                 goto fail_set_cdev;
@@ -256,18 +242,12 @@ MODULE_LICENSE("GPL");
 
 static int __init msg_init(void)
 {
-        int ret;
-
-        ret = usb_composite_probe(&msg_driver);
-        set_bit(0, &msg_registered);
-
-        return ret;
+        return usb_composite_probe(&msg_driver);
 }
 module_init(msg_init);
 
-static void msg_cleanup(void)
+static void __exit msg_cleanup(void)
 {
-        if (test_and_clear_bit(0, &msg_registered))
-                usb_composite_unregister(&msg_driver);
+        usb_composite_unregister(&msg_driver);
 }
 module_exit(msg_cleanup);
diff --git a/drivers/usb/gadget/udc/Kconfig b/drivers/usb/gadget/udc/Kconfig
index 7cd5c969fcbe..1e9567091d86 100644
--- a/drivers/usb/gadget/udc/Kconfig
+++ b/drivers/usb/gadget/udc/Kconfig
@@ -273,6 +273,7 @@ config USB_SNP_CORE
 config USB_SNP_UDC_PLAT
         tristate "Synopsys USB 2.0 Device controller"
         depends on USB_GADGET && OF && HAS_DMA
+        depends on EXTCON || EXTCON=n
         select USB_GADGET_DUALSPEED
         select USB_SNP_CORE
         default ARCH_BCM_IPROC
diff --git a/drivers/usb/gadget/udc/atmel_usba_udc.c b/drivers/usb/gadget/udc/atmel_usba_udc.c
index 98d71400f8a1..a884c022df7a 100644
--- a/drivers/usb/gadget/udc/atmel_usba_udc.c
+++ b/drivers/usb/gadget/udc/atmel_usba_udc.c
@@ -29,6 +29,8 @@
 #include <linux/of_gpio.h>
 
 #include "atmel_usba_udc.h"
+#define USBA_VBUS_IRQFLAGS (IRQF_ONESHOT \
+                           | IRQF_TRIGGER_FALLING | IRQF_TRIGGER_RISING)
 
 #ifdef CONFIG_USB_GADGET_DEBUG_FS
 #include <linux/debugfs.h>
@@ -2361,7 +2363,7 @@ static int usba_udc_probe(struct platform_device *pdev)
                                         IRQ_NOAUTOEN);
                         ret = devm_request_threaded_irq(&pdev->dev,
                                         gpio_to_irq(udc->vbus_pin), NULL,
-                                        usba_vbus_irq_thread, IRQF_ONESHOT,
+                                        usba_vbus_irq_thread, USBA_VBUS_IRQFLAGS,
                                         "atmel_usba_udc", udc);
                         if (ret) {
                                 udc->vbus_pin = -ENODEV;
diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c
index 75c51ca4ee0f..d41d07aae0ce 100644
--- a/drivers/usb/gadget/udc/core.c
+++ b/drivers/usb/gadget/udc/core.c
@@ -1320,8 +1320,7 @@ static int udc_bind_to_driver(struct usb_udc *udc, struct usb_gadget_driver *dri
         udc->dev.driver = &driver->driver;
         udc->gadget->dev.driver = &driver->driver;
 
-        if (driver->max_speed < udc->gadget->max_speed)
-                usb_gadget_udc_set_speed(udc, driver->max_speed);
+        usb_gadget_udc_set_speed(udc, driver->max_speed);
 
         ret = driver->bind(udc->gadget, driver);
         if (ret)
diff --git a/drivers/usb/gadget/udc/dummy_hcd.c b/drivers/usb/gadget/udc/dummy_hcd.c
index a030d7923d7d..b17618a55f1b 100644
--- a/drivers/usb/gadget/udc/dummy_hcd.c
+++ b/drivers/usb/gadget/udc/dummy_hcd.c
@@ -237,6 +237,8 @@ struct dummy_hcd {
 
         struct usb_device               *udev;
         struct list_head                urbp_list;
+        struct urbp                     *next_frame_urbp;
+
         u32                             stream_en_ep;
         u8                              num_stream[30 / 2];
 
@@ -253,11 +255,13 @@ struct dummy {
          */
         struct dummy_ep                 ep[DUMMY_ENDPOINTS];
         int                             address;
+        int                             callback_usage;
         struct usb_gadget               gadget;
         struct usb_gadget_driver        *driver;
         struct dummy_request            fifo_req;
         u8                              fifo_buf[FIFO_SIZE];
         u16                             devstatus;
+        unsigned                        ints_enabled:1;
         unsigned                        udc_suspended:1;
         unsigned                        pullup:1;
 
@@ -375,11 +379,10 @@ static void set_link_state_by_speed(struct dummy_hcd *dum_hcd)
                              USB_PORT_STAT_CONNECTION) == 0)
                                 dum_hcd->port_status |=
                                         (USB_PORT_STAT_C_CONNECTION << 16);
-                        if ((dum_hcd->port_status &
-                             USB_PORT_STAT_ENABLE) == 1 &&
-                                (dum_hcd->port_status &
-                                 USB_SS_PORT_LS_U0) == 1 &&
-                                dum_hcd->rh_state != DUMMY_RH_SUSPENDED)
+                        if ((dum_hcd->port_status & USB_PORT_STAT_ENABLE) &&
+                            (dum_hcd->port_status &
+                             USB_PORT_STAT_LINK_STATE) == USB_SS_PORT_LS_U0 &&
+                            dum_hcd->rh_state != DUMMY_RH_SUSPENDED)
                                 dum_hcd->active = 1;
                 }
         } else {
@@ -440,18 +443,27 @@ static void set_link_state(struct dummy_hcd *dum_hcd)
                                 (~dum_hcd->old_status) & dum_hcd->port_status;
 
                 /* Report reset and disconnect events to the driver */
-                if (dum->driver && (disconnect || reset)) {
+                if (dum->ints_enabled && (disconnect || reset)) {
                         stop_activity(dum);
+                        ++dum->callback_usage;
+                        spin_unlock(&dum->lock);
                         if (reset)
                                 usb_gadget_udc_reset(&dum->gadget, dum->driver);
                         else
                                 dum->driver->disconnect(&dum->gadget);
+                        spin_lock(&dum->lock);
+                        --dum->callback_usage;
                 }
-        } else if (dum_hcd->active != dum_hcd->old_active) {
+        } else if (dum_hcd->active != dum_hcd->old_active &&
+                        dum->ints_enabled) {
+                ++dum->callback_usage;
+                spin_unlock(&dum->lock);
                 if (dum_hcd->old_active && dum->driver->suspend)
                         dum->driver->suspend(&dum->gadget);
                 else if (!dum_hcd->old_active &&  dum->driver->resume)
                         dum->driver->resume(&dum->gadget);
+                spin_lock(&dum->lock);
+                --dum->callback_usage;
         }
 
         dum_hcd->old_status = dum_hcd->port_status;
@@ -972,8 +984,11 @@ static int dummy_udc_start(struct usb_gadget *g,
          * can't enumerate without help from the driver we're binding.
          */
 
+        spin_lock_irq(&dum->lock);
         dum->devstatus = 0;
         dum->driver = driver;
+        dum->ints_enabled = 1;
+        spin_unlock_irq(&dum->lock);
 
         return 0;
 }
@@ -984,6 +999,16 @@ static int dummy_udc_stop(struct usb_gadget *g)
         struct dummy            *dum = dum_hcd->dum;
 
         spin_lock_irq(&dum->lock);
+        dum->ints_enabled = 0;
+        stop_activity(dum);
+
+        /* emulate synchronize_irq(): wait for callbacks to finish */
+        while (dum->callback_usage > 0) {
+                spin_unlock_irq(&dum->lock);
+                usleep_range(1000, 2000);
+                spin_lock_irq(&dum->lock);
+        }
+
         dum->driver = NULL;
         spin_unlock_irq(&dum->lock);
 
@@ -1037,7 +1062,12 @@ static int dummy_udc_probe(struct platform_device *pdev)
         memzero_explicit(&dum->gadget, sizeof(struct usb_gadget));
         dum->gadget.name = gadget_name;
         dum->gadget.ops = &dummy_ops;
-        dum->gadget.max_speed = USB_SPEED_SUPER;
+        if (mod_data.is_super_speed)
+                dum->gadget.max_speed = USB_SPEED_SUPER;
+        else if (mod_data.is_high_speed)
+                dum->gadget.max_speed = USB_SPEED_HIGH;
+        else
+                dum->gadget.max_speed = USB_SPEED_FULL;
 
         dum->gadget.dev.parent = &pdev->dev;
         init_dummy_udc_hw(dum);
@@ -1246,6 +1276,8 @@ static int dummy_urb_enqueue(
 
         list_add_tail(&urbp->urbp_list, &dum_hcd->urbp_list);
         urb->hcpriv = urbp;
+        if (!dum_hcd->next_frame_urbp)
+                dum_hcd->next_frame_urbp = urbp;
         if (usb_pipetype(urb->pipe) == PIPE_CONTROL)
                 urb->error_count = 1;           /* mark as a new urb */
 
@@ -1521,6 +1553,8 @@ static struct dummy_ep *find_endpoint(struct dummy *dum, u8 address)
         if (!is_active((dum->gadget.speed == USB_SPEED_SUPER ?
                         dum->ss_hcd : dum->hs_hcd)))
                 return NULL;
+        if (!dum->ints_enabled)
+                return NULL;
         if ((address & ~USB_DIR_IN) == 0)
                 return &dum->ep[0];
         for (i = 1; i < DUMMY_ENDPOINTS; i++) {
@@ -1762,6 +1796,7 @@ static void dummy_timer(unsigned long _dum_hcd)
                 spin_unlock_irqrestore(&dum->lock, flags);
                 return;
         }
+        dum_hcd->next_frame_urbp = NULL;
 
         for (i = 0; i < DUMMY_ENDPOINTS; i++) {
                 if (!ep_info[i].name)
@@ -1778,6 +1813,10 @@ restart:
                 int                     type;
                 int                     status = -EINPROGRESS;
 
+                /* stop when we reach URBs queued after the timer interrupt */
+                if (urbp == dum_hcd->next_frame_urbp)
+                        break;
+
                 urb = urbp->urb;
                 if (urb->unlinked)
                         goto return_urb;
@@ -1857,10 +1896,12 @@ restart:
                          * until setup() returns; no reentrancy issues etc.
                          */
                         if (value > 0) {
+                                ++dum->callback_usage;
                                 spin_unlock(&dum->lock);
                                 value = dum->driver->setup(&dum->gadget,
                                                 &setup);
                                 spin_lock(&dum->lock);
+                                --dum->callback_usage;
 
                                 if (value >= 0) {
                                         /* no delays (max 64KB data stage) */
@@ -2561,8 +2602,6 @@ static struct hc_driver dummy_hcd = {
         .product_desc =         "Dummy host controller",
         .hcd_priv_size =        sizeof(struct dummy_hcd),
 
-        .flags =                HCD_USB3 | HCD_SHARED,
-
         .reset =                dummy_setup,
         .start =                dummy_start,
         .stop =                 dummy_stop,
@@ -2591,8 +2630,12 @@ static int dummy_hcd_probe(struct platform_device *pdev)
         dev_info(&pdev->dev, "%s, driver " DRIVER_VERSION "\n", driver_desc);
         dum = *((void **)dev_get_platdata(&pdev->dev));
 
-        if (!mod_data.is_super_speed)
+        if (mod_data.is_super_speed)
+                dummy_hcd.flags = HCD_USB3 | HCD_SHARED;
+        else if (mod_data.is_high_speed)
                 dummy_hcd.flags = HCD_USB2;
+        else
+                dummy_hcd.flags = HCD_USB11;
         hs_hcd = usb_create_hcd(&dummy_hcd, &pdev->dev, dev_name(&pdev->dev));
         if (!hs_hcd)
                 return -ENOMEM;
diff --git a/drivers/usb/gadget/udc/renesas_usb3.c b/drivers/usb/gadget/udc/renesas_usb3.c
index df37c1e6e9d5..63a206122058 100644
--- a/drivers/usb/gadget/udc/renesas_usb3.c
+++ b/drivers/usb/gadget/udc/renesas_usb3.c
@@ -1038,7 +1038,7 @@ static int usb3_write_pipe(struct renesas_usb3_ep *usb3_ep,
                         usb3_ep->ep.maxpacket);
         u8 *buf = usb3_req->req.buf + usb3_req->req.actual;
         u32 tmp = 0;
-        bool is_last;
+        bool is_last = !len ? true : false;
 
         if (usb3_wait_pipe_status(usb3_ep, PX_STA_BUFSTS) < 0)
                 return -EBUSY;
@@ -1059,7 +1059,8 @@ static int usb3_write_pipe(struct renesas_usb3_ep *usb3_ep,
                 usb3_write(usb3, tmp, fifo_reg);
         }
 
-        is_last = usb3_is_transfer_complete(usb3_ep, usb3_req);
+        if (!is_last)
+                is_last = usb3_is_transfer_complete(usb3_ep, usb3_req);
         /* Send the data */
         usb3_set_px_con_send(usb3_ep, len, is_last);
 
@@ -1150,7 +1151,8 @@ static void usb3_start_pipe0(struct renesas_usb3_ep *usb3_ep,
                 usb3_set_p0_con_for_ctrl_read_data(usb3);
         } else {
                 usb3_clear_bit(usb3, P0_MOD_DIR, USB3_P0_MOD);
-                usb3_set_p0_con_for_ctrl_write_data(usb3);
+                if (usb3_req->req.length)
+                        usb3_set_p0_con_for_ctrl_write_data(usb3);
         }
 
         usb3_p0_xfer(usb3_ep, usb3_req);
@@ -2053,7 +2055,16 @@ static u32 usb3_calc_ramarea(int ram_size)
 static u32 usb3_calc_rammap_val(struct renesas_usb3_ep *usb3_ep,
                                 const struct usb_endpoint_descriptor *desc)
 {
-        return usb3_ep->rammap_val | PN_RAMMAP_MPKT(usb_endpoint_maxp(desc));
+        int i;
+        const u32 max_packet_array[] = {8, 16, 32, 64, 512};
+        u32 mpkt = PN_RAMMAP_MPKT(1024);
+
+        for (i = 0; i < ARRAY_SIZE(max_packet_array); i++) {
+                if (usb_endpoint_maxp(desc) <= max_packet_array[i])
+                        mpkt = PN_RAMMAP_MPKT(max_packet_array[i]);
+        }
+
+        return usb3_ep->rammap_val | mpkt;
 }
 
 static int usb3_enable_pipe_n(struct renesas_usb3_ep *usb3_ep,
diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
index 658d9d1f9ea3..6dda3623a276 100644
--- a/drivers/usb/host/pci-quirks.c
+++ b/drivers/usb/host/pci-quirks.c
@@ -447,7 +447,7 @@ static int usb_asmedia_wait_write(struct pci_dev *pdev)
                 if ((value & ASMT_CONTROL_WRITE_BIT) == 0)
                         return 0;
 
-                usleep_range(40, 60);
+                udelay(50);
         }
 
         dev_warn(&pdev->dev, "%s: check_write_ready timeout", __func__);
@@ -1022,7 +1022,7 @@ EXPORT_SYMBOL_GPL(usb_disable_xhci_ports);
  *
  * Takes care of the handoff between the Pre-OS (i.e. BIOS) and the OS.
  * It signals to the BIOS that the OS wants control of the host controller,
- * and then waits 5 seconds for the BIOS to hand over control.
+ * and then waits 1 second for the BIOS to hand over control.
  * If we timeout, assume the BIOS is broken and take control anyway.
  */
 static void quirk_usb_handoff_xhci(struct pci_dev *pdev)
@@ -1069,9 +1069,9 @@ static void quirk_usb_handoff_xhci(struct pci_dev *pdev)
         if (val & XHCI_HC_BIOS_OWNED) {
                 writel(val | XHCI_HC_OS_OWNED, base + ext_cap_offset);
 
-                /* Wait for 5 seconds with 10 microsecond polling interval */
+                /* Wait for 1 second with 10 microsecond polling interval */
                 timeout = handshake(base + ext_cap_offset, XHCI_HC_BIOS_OWNED,
-                                0, 5000, 10);
+                                0, 1000000, 10);
 
                 /* Assume a buggy BIOS and take HC ownership anyway */
                 if (timeout) {
@@ -1100,7 +1100,7 @@ hc_init:
          * operational or runtime registers.  Wait 5 seconds and no more.
          */
         timeout = handshake(op_reg_base + XHCI_STS_OFFSET, XHCI_STS_CNR, 0,
-                        5000, 10);
+                        5000000, 10);
         /* Assume a buggy HC and start HC initialization anyway */
         if (timeout) {
                 val = readl(op_reg_base + XHCI_STS_OFFSET);
diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index ad89a6d4111b..da9158f171cb 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -112,7 +112,7 @@ static int xhci_create_usb3_bos_desc(struct xhci_hcd *xhci, char *buf,
 
         /* If PSI table exists, add the custom speed attributes from it */
         if (usb3_1 && xhci->usb3_rhub.psi_count) {
-                u32 ssp_cap_base, bm_attrib, psi;
+                u32 ssp_cap_base, bm_attrib, psi, psi_mant, psi_exp;
                 int offset;
 
                 ssp_cap_base = USB_DT_BOS_SIZE + USB_DT_USB_SS_CAP_SIZE;
@@ -139,6 +139,15 @@ static int xhci_create_usb3_bos_desc(struct xhci_hcd *xhci, char *buf,
                 for (i = 0; i < xhci->usb3_rhub.psi_count; i++) {
                         psi = xhci->usb3_rhub.psi[i];
                         psi &= ~USB_SSP_SUBLINK_SPEED_RSVD;
+                        psi_exp = XHCI_EXT_PORT_PSIE(psi);
+                        psi_mant = XHCI_EXT_PORT_PSIM(psi);
+
+                        /* Shift to Gbps and set SSP Link BIT(14) if 10Gpbs */
+                        for (; psi_exp < 3; psi_exp++)
+                                psi_mant /= 1000;
+                        if (psi_mant >= 10)
+                                psi |= BIT(14);
+
                         if ((psi & PLT_MASK) == PLT_SYM) {
                         /* Symmetric, create SSA RX and TX from one PSI entry */
                                 put_unaligned_le32(psi, &buf[offset]);
@@ -1506,9 +1515,6 @@ int xhci_bus_suspend(struct usb_hcd *hcd)
                                 t2 |= PORT_WKOC_E | PORT_WKCONN_E;
                                 t2 &= ~PORT_WKDISC_E;
                         }
-                        if ((xhci->quirks & XHCI_U2_DISABLE_WAKE) &&
-                            (hcd->speed < HCD_USB3))
-                                t2 &= ~PORT_WAKE_BITS;
                 } else
                         t2 &= ~PORT_WAKE_BITS;
 
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index 8071c8fdd15e..76f392954733 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -54,11 +54,6 @@
 #define PCI_DEVICE_ID_INTEL_APL_XHCI                    0x5aa8
 #define PCI_DEVICE_ID_INTEL_DNV_XHCI                    0x19d0
 
-#define PCI_DEVICE_ID_AMD_PROMONTORYA_4                 0x43b9
-#define PCI_DEVICE_ID_AMD_PROMONTORYA_3                 0x43ba
-#define PCI_DEVICE_ID_AMD_PROMONTORYA_2                 0x43bb
-#define PCI_DEVICE_ID_AMD_PROMONTORYA_1                 0x43bc
-
 #define PCI_DEVICE_ID_ASMEDIA_1042A_XHCI                0x1142
 
 static const char hcd_name[] = "xhci_hcd";
@@ -142,13 +137,6 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
         if (pdev->vendor == PCI_VENDOR_ID_AMD)
                 xhci->quirks |= XHCI_TRUST_TX_LENGTH;
 
-        if ((pdev->vendor == PCI_VENDOR_ID_AMD) &&
-                ((pdev->device == PCI_DEVICE_ID_AMD_PROMONTORYA_4) ||
-                (pdev->device == PCI_DEVICE_ID_AMD_PROMONTORYA_3) ||
-                (pdev->device == PCI_DEVICE_ID_AMD_PROMONTORYA_2) ||
-                (pdev->device == PCI_DEVICE_ID_AMD_PROMONTORYA_1)))
-                xhci->quirks |= XHCI_U2_DISABLE_WAKE;
-
         if (pdev->vendor == PCI_VENDOR_ID_INTEL) {
                 xhci->quirks |= XHCI_LPM_SUPPORT;
                 xhci->quirks |= XHCI_INTEL_HOST;
diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
index 163bafde709f..1cb6eaef4ae1 100644
--- a/drivers/usb/host/xhci-plat.c
+++ b/drivers/usb/host/xhci-plat.c
@@ -178,14 +178,18 @@ static int xhci_plat_probe(struct platform_device *pdev)
          * 2. xhci_plat is child of a device from firmware (dwc3-plat)
          * 3. xhci_plat is grandchild of a pci device (dwc3-pci)
          */
-        sysdev = &pdev->dev;
-        if (sysdev->parent && !sysdev->of_node && sysdev->parent->of_node)
-                sysdev = sysdev->parent;
+        for (sysdev = &pdev->dev; sysdev; sysdev = sysdev->parent) {
+                if (is_of_node(sysdev->fwnode) ||
+                        is_acpi_device_node(sysdev->fwnode))
+                        break;
 #ifdef CONFIG_PCI
-        else if (sysdev->parent && sysdev->parent->parent &&
-                 sysdev->parent->parent->bus == &pci_bus_type)
-                sysdev = sysdev->parent->parent;
+                else if (sysdev->bus == &pci_bus_type)
+                        break;
 #endif
+        }
+
+        if (!sysdev)
+                sysdev = &pdev->dev;
 
         /* Try to set 64-bit DMA first */
         if (WARN_ON(!sysdev->dma_mask))
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index b2ff1ff1a02f..ee198ea47f49 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -1703,7 +1703,8 @@ static int xhci_add_endpoint(struct usb_hcd *hcd, struct usb_device *udev,
         if (xhci->quirks & XHCI_MTK_HOST) {
                 ret = xhci_mtk_add_ep_quirk(hcd, udev, ep);
                 if (ret < 0) {
-                        xhci_free_endpoint_ring(xhci, virt_dev, ep_index);
+                        xhci_ring_free(xhci, virt_dev->eps[ep_index].new_ring);
+                        virt_dev->eps[ep_index].new_ring = NULL;
                         return ret;
                 }
         }
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index 2abaa4d6d39d..2b48aa4f6b76 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -735,6 +735,8 @@ struct xhci_ep_ctx {
 #define EP_MAXPSTREAMS(p)       (((p) << 10) & EP_MAXPSTREAMS_MASK)
 /* Endpoint is set up with a Linear Stream Array (vs. Secondary Stream Array) */
 #define EP_HAS_LSA              (1 << 15)
+/* hosts with LEC=1 use bits 31:24 as ESIT high bits. */
+#define CTX_TO_MAX_ESIT_PAYLOAD_HI(p)   (((p) >> 24) & 0xff)
 
 /* ep_info2 bitmasks */
 /*
@@ -1681,7 +1683,7 @@ struct xhci_bus_state {
 
 static inline unsigned int hcd_index(struct usb_hcd *hcd)
 {
-        if (hcd->speed == HCD_USB3)
+        if (hcd->speed >= HCD_USB3)
                 return 0;
         else
                 return 1;
@@ -1826,7 +1828,7 @@ struct xhci_hcd {
 /* For controller with a broken Port Disable implementation */
 #define XHCI_BROKEN_PORT_PED    (1 << 25)
 #define XHCI_LIMIT_ENDPOINT_INTERVAL_7  (1 << 26)
-#define XHCI_U2_DISABLE_WAKE    (1 << 27)
+/* Reserved. It was XHCI_U2_DISABLE_WAKE */
 #define XHCI_ASMEDIA_MODIFY_FLOWCONTROL (1 << 28)
 
         unsigned int            num_active_eps;
@@ -2540,8 +2542,8 @@ static inline const char *xhci_decode_ep_context(u32 info, u32 info2, u64 deq,
         u8 lsa;
         u8 hid;
 
-        esit = EP_MAX_ESIT_PAYLOAD_HI(info) << 16 |
-                EP_MAX_ESIT_PAYLOAD_LO(tx_info);
+        esit = CTX_TO_MAX_ESIT_PAYLOAD_HI(info) << 16 |
+                CTX_TO_MAX_ESIT_PAYLOAD(tx_info);
 
         ep_state = info & EP_STATE_MASK;
         max_pstr = info & EP_MAXPSTREAMS_MASK;
diff --git a/drivers/usb/renesas_usbhs/fifo.c b/drivers/usb/renesas_usbhs/fifo.c
index d1af831f43eb..68f26904c316 100644
--- a/drivers/usb/renesas_usbhs/fifo.c
+++ b/drivers/usb/renesas_usbhs/fifo.c
@@ -282,11 +282,26 @@ static void usbhsf_fifo_clear(struct usbhs_pipe *pipe,
                               struct usbhs_fifo *fifo)
 {
         struct usbhs_priv *priv = usbhs_pipe_to_priv(pipe);
+        int ret = 0;
 
-        if (!usbhs_pipe_is_dcp(pipe))
-                usbhsf_fifo_barrier(priv, fifo);
+        if (!usbhs_pipe_is_dcp(pipe)) {
+                /*
+                 * This driver checks the pipe condition first to avoid -EBUSY
+                 * from usbhsf_fifo_barrier() with about 10 msec delay in
+                 * the interrupt handler if the pipe is RX direction and empty.
+                 */
+                if (usbhs_pipe_is_dir_in(pipe))
+                        ret = usbhs_pipe_is_accessible(pipe);
+                if (!ret)
+                        ret = usbhsf_fifo_barrier(priv, fifo);
+        }
 
-        usbhs_write(priv, fifo->ctr, BCLR);
+        /*
+         * if non-DCP pipe, this driver should set BCLR when
+         * usbhsf_fifo_barrier() returns 0.
+         */
+        if (!ret)
+                usbhs_write(priv, fifo->ctr, BCLR);
 }
 
 static int usbhsf_fifo_rcv_len(struct usbhs_priv *priv,
diff --git a/drivers/usb/storage/transport.c b/drivers/usb/storage/transport.c
index 1a59f335b063..a3ccb899df60 100644
--- a/drivers/usb/storage/transport.c
+++ b/drivers/usb/storage/transport.c
@@ -834,13 +834,25 @@ Retry_Sense:
                         if (result == USB_STOR_TRANSPORT_GOOD) {
                                 srb->result = SAM_STAT_GOOD;
                                 srb->sense_buffer[0] = 0x0;
+                        }
+
+                        /*
+                         * ATA-passthru commands use sense data to report
+                         * the command completion status, and often devices
+                         * return Check Condition status when nothing is
+                         * wrong.
+                         */
+                        else if (srb->cmnd[0] == ATA_16 ||
+                                        srb->cmnd[0] == ATA_12) {
+                                /* leave the data alone */
+                        }
 
                         /*
                          * If there was a problem, report an unspecified
                          * hardware error to prevent the higher layers from
                          * entering an infinite retry loop.
                          */
-                        } else {
+                        else {
                                 srb->result = DID_ERROR << 16;
                                 if ((sshdr.response_code & 0x72) == 0x72)
                                         srb->sense_buffer[1] = HARDWARE_ERROR;
diff --git a/drivers/usb/storage/uas-detect.h b/drivers/usb/storage/uas-detect.h
index f58caa9e6a27..a155cd02bce2 100644
--- a/drivers/usb/storage/uas-detect.h
+++ b/drivers/usb/storage/uas-detect.h
@@ -9,7 +9,8 @@ static int uas_is_interface(struct usb_host_interface *intf)
                 intf->desc.bInterfaceProtocol == USB_PR_UAS);
 }
 
-static int uas_find_uas_alt_setting(struct usb_interface *intf)
+static struct usb_host_interface *uas_find_uas_alt_setting(
+                struct usb_interface *intf)
 {
         int i;
 
@@ -17,10 +18,10 @@ static int uas_find_uas_alt_setting(struct usb_interface *intf)
                 struct usb_host_interface *alt = &intf->altsetting[i];
 
                 if (uas_is_interface(alt))
-                        return alt->desc.bAlternateSetting;
+                        return alt;
         }
 
-        return -ENODEV;
+        return NULL;
 }
 
 static int uas_find_endpoints(struct usb_host_interface *alt,
@@ -58,14 +59,14 @@ static int uas_use_uas_driver(struct usb_interface *intf,
         struct usb_device *udev = interface_to_usbdev(intf);
         struct usb_hcd *hcd = bus_to_hcd(udev->bus);
         unsigned long flags = id->driver_info;
-        int r, alt;
-
+        struct usb_host_interface *alt;
+        int r;
 
         alt = uas_find_uas_alt_setting(intf);
-        if (alt < 0)
+        if (!alt)
                 return 0;
 
-        r = uas_find_endpoints(&intf->altsetting[alt], eps);
+        r = uas_find_endpoints(alt, eps);
         if (r < 0)
                 return 0;
 
diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c
index cfb1e3bbd434..63cf981ed81c 100644
--- a/drivers/usb/storage/uas.c
+++ b/drivers/usb/storage/uas.c
@@ -873,14 +873,14 @@ MODULE_DEVICE_TABLE(usb, uas_usb_ids);
 static int uas_switch_interface(struct usb_device *udev,
                                 struct usb_interface *intf)
 {
-        int alt;
+        struct usb_host_interface *alt;
 
         alt = uas_find_uas_alt_setting(intf);
-        if (alt < 0)
-                return alt;
+        if (!alt)
+                return -ENODEV;
 
-        return usb_set_interface(udev,
-                        intf->altsetting[0].desc.bInterfaceNumber, alt);
+        return usb_set_interface(udev, alt->desc.bInterfaceNumber,
+                        alt->desc.bAlternateSetting);
 }
 
 static int uas_configure_endpoints(struct uas_dev_info *devinfo)
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index 5a70c33ef0e0..eb06d88b41d6 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -1459,6 +1459,13 @@ UNUSUAL_DEV( 0x0bc2, 0x3010, 0x0000, 0x0000,
                 USB_SC_DEVICE, USB_PR_DEVICE, NULL,
                 US_FL_SANE_SENSE ),
 
+/* Reported by Kris Lindgren <kris.lindgren@gmail.com> */
+UNUSUAL_DEV( 0x0bc2, 0x3332, 0x0000, 0x9999,
+                "Seagate",
+                "External",
+                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+                US_FL_NO_WP_DETECT ),
+
 UNUSUAL_DEV(  0x0d49, 0x7310, 0x0000, 0x9999,
                 "Maxtor",
                 "USB to SATA",
diff --git a/drivers/uwb/hwa-rc.c b/drivers/uwb/hwa-rc.c
index 35a1e777b449..9a53912bdfe9 100644
--- a/drivers/uwb/hwa-rc.c
+++ b/drivers/uwb/hwa-rc.c
@@ -825,6 +825,8 @@ static int hwarc_probe(struct usb_interface *iface,
 
         if (iface->cur_altsetting->desc.bNumEndpoints < 1)
                 return -ENODEV;
+        if (!usb_endpoint_xfer_int(&iface->cur_altsetting->endpoint[0].desc))
+                return -ENODEV;
 
         result = -ENOMEM;
         uwb_rc = uwb_rc_alloc();
diff --git a/drivers/uwb/uwbd.c b/drivers/uwb/uwbd.c
index 01c20a260a8b..39dd4ef53c77 100644
--- a/drivers/uwb/uwbd.c
+++ b/drivers/uwb/uwbd.c
@@ -302,18 +302,22 @@ static int uwbd(void *param)
 /** Start the UWB daemon */
 void uwbd_start(struct uwb_rc *rc)
 {
-        rc->uwbd.task = kthread_run(uwbd, rc, "uwbd");
-        if (rc->uwbd.task == NULL)
+        struct task_struct *task = kthread_run(uwbd, rc, "uwbd");
+        if (IS_ERR(task)) {
+                rc->uwbd.task = NULL;
                 printk(KERN_ERR "UWB: Cannot start management daemon; "
                        "UWB won't work\n");
-        else
+        } else {
+                rc->uwbd.task = task;
                 rc->uwbd.pid = rc->uwbd.task->pid;
+        }
 }
 
 /* Stop the UWB daemon and free any unprocessed events */
 void uwbd_stop(struct uwb_rc *rc)
 {
-        kthread_stop(rc->uwbd.task);
+        if (rc->uwbd.task)
+                kthread_stop(rc->uwbd.task);
         uwbd_flush(rc);
 }
 
diff --git a/drivers/xen/xen-pciback/conf_space_header.c b/drivers/xen/xen-pciback/conf_space_header.c
index 5fbfd9cfb6d6..5b3d57fc82d3 100644
--- a/drivers/xen/xen-pciback/conf_space_header.c
+++ b/drivers/xen/xen-pciback/conf_space_header.c
@@ -169,6 +169,9 @@ static int rom_write(struct pci_dev *dev, int offset, u32 value, void *data)
 static int bar_write(struct pci_dev *dev, int offset, u32 value, void *data)
 {
         struct pci_bar_info *bar = data;
+        unsigned int pos = (offset - PCI_BASE_ADDRESS_0) / 4;
+        const struct resource *res = dev->resource;
+        u32 mask;
 
         if (unlikely(!bar)) {
                 pr_warn(DRV_NAME ": driver data not found for %s\n",
@@ -179,7 +182,13 @@ static int bar_write(struct pci_dev *dev, int offset, u32 value, void *data)
         /* A write to obtain the length must happen as a 32-bit write.
          * This does not (yet) support writing individual bytes
          */
-        if (value == ~0)
+        if (res[pos].flags & IORESOURCE_IO)
+                mask = ~PCI_BASE_ADDRESS_IO_MASK;
+        else if (pos && (res[pos - 1].flags & IORESOURCE_MEM_64))
+                mask = 0;
+        else
+                mask = ~PCI_BASE_ADDRESS_MEM_MASK;
+        if ((value | mask) == ~0U)
                 bar->which = 1;
         else {
                 u32 tmpval;
diff --git a/drivers/xen/xenbus/xenbus_client.c b/drivers/xen/xenbus/xenbus_client.c
index 82a8866758ee..a1c17000129b 100644
--- a/drivers/xen/xenbus/xenbus_client.c
+++ b/drivers/xen/xenbus/xenbus_client.c
@@ -519,64 +519,6 @@ static int __xenbus_map_ring(struct xenbus_device *dev,
         return err;
 }
 
-static int xenbus_map_ring_valloc_pv(struct xenbus_device *dev,
-                                     grant_ref_t *gnt_refs,
-                                     unsigned int nr_grefs,
-                                     void **vaddr)
-{
-        struct xenbus_map_node *node;
-        struct vm_struct *area;
-        pte_t *ptes[XENBUS_MAX_RING_GRANTS];
-        phys_addr_t phys_addrs[XENBUS_MAX_RING_GRANTS];
-        int err = GNTST_okay;
-        int i;
-        bool leaked;
-
-        *vaddr = NULL;
-
-        if (nr_grefs > XENBUS_MAX_RING_GRANTS)
-                return -EINVAL;
-
-        node = kzalloc(sizeof(*node), GFP_KERNEL);
-        if (!node)
-                return -ENOMEM;
-
-        area = alloc_vm_area(XEN_PAGE_SIZE * nr_grefs, ptes);
-        if (!area) {
-                kfree(node);
-                return -ENOMEM;
-        }
-
-        for (i = 0; i < nr_grefs; i++)
-                phys_addrs[i] = arbitrary_virt_to_machine(ptes[i]).maddr;
-
-        err = __xenbus_map_ring(dev, gnt_refs, nr_grefs, node->handles,
-                                phys_addrs,
-                                GNTMAP_host_map | GNTMAP_contains_pte,
-                                &leaked);
-        if (err)
-                goto failed;
-
-        node->nr_handles = nr_grefs;
-        node->pv.area = area;
-
-        spin_lock(&xenbus_valloc_lock);
-        list_add(&node->next, &xenbus_valloc_pages);
-        spin_unlock(&xenbus_valloc_lock);
-
-        *vaddr = area->addr;
-        return 0;
-
-failed:
-        if (!leaked)
-                free_vm_area(area);
-        else
-                pr_alert("leaking VM area %p size %u page(s)", area, nr_grefs);
-
-        kfree(node);
-        return err;
-}
-
 struct map_ring_valloc_hvm
 {
         unsigned int idx;
@@ -725,6 +667,65 @@ int xenbus_unmap_ring_vfree(struct xenbus_device *dev, void *vaddr)
 }
 EXPORT_SYMBOL_GPL(xenbus_unmap_ring_vfree);
 
+#ifdef CONFIG_XEN_PV
+static int xenbus_map_ring_valloc_pv(struct xenbus_device *dev,
+                                     grant_ref_t *gnt_refs,
+                                     unsigned int nr_grefs,
+                                     void **vaddr)
+{
+        struct xenbus_map_node *node;
+        struct vm_struct *area;
+        pte_t *ptes[XENBUS_MAX_RING_GRANTS];
+        phys_addr_t phys_addrs[XENBUS_MAX_RING_GRANTS];
+        int err = GNTST_okay;
+        int i;
+        bool leaked;
+
+        *vaddr = NULL;
+
+        if (nr_grefs > XENBUS_MAX_RING_GRANTS)
+                return -EINVAL;
+
+        node = kzalloc(sizeof(*node), GFP_KERNEL);
+        if (!node)
+                return -ENOMEM;
+
+        area = alloc_vm_area(XEN_PAGE_SIZE * nr_grefs, ptes);
+        if (!area) {
+                kfree(node);
+                return -ENOMEM;
+        }
+
+        for (i = 0; i < nr_grefs; i++)
+                phys_addrs[i] = arbitrary_virt_to_machine(ptes[i]).maddr;
+
+        err = __xenbus_map_ring(dev, gnt_refs, nr_grefs, node->handles,
+                                phys_addrs,
+                                GNTMAP_host_map | GNTMAP_contains_pte,
+                                &leaked);
+        if (err)
+                goto failed;
+
+        node->nr_handles = nr_grefs;
+        node->pv.area = area;
+
+        spin_lock(&xenbus_valloc_lock);
+        list_add(&node->next, &xenbus_valloc_pages);
+        spin_unlock(&xenbus_valloc_lock);
+
+        *vaddr = area->addr;
+        return 0;
+
+failed:
+        if (!leaked)
+                free_vm_area(area);
+        else
+                pr_alert("leaking VM area %p size %u page(s)", area, nr_grefs);
+
+        kfree(node);
+        return err;
+}
+
 static int xenbus_unmap_ring_vfree_pv(struct xenbus_device *dev, void *vaddr)
 {
         struct xenbus_map_node *node;
@@ -788,6 +789,12 @@ static int xenbus_unmap_ring_vfree_pv(struct xenbus_device *dev, void *vaddr)
         return err;
 }
 
+static const struct xenbus_ring_ops ring_ops_pv = {
+        .map = xenbus_map_ring_valloc_pv,
+        .unmap = xenbus_unmap_ring_vfree_pv,
+};
+#endif
+
 struct unmap_ring_vfree_hvm
 {
         unsigned int idx;
@@ -916,11 +923,6 @@ enum xenbus_state xenbus_read_driver_state(const char *path)
 }
 EXPORT_SYMBOL_GPL(xenbus_read_driver_state);
 
-static const struct xenbus_ring_ops ring_ops_pv = {
-        .map = xenbus_map_ring_valloc_pv,
-        .unmap = xenbus_unmap_ring_vfree_pv,
-};
-
 static const struct xenbus_ring_ops ring_ops_hvm = {
         .map = xenbus_map_ring_valloc_hvm,
         .unmap = xenbus_unmap_ring_vfree_hvm,
@@ -928,8 +930,10 @@ static const struct xenbus_ring_ops ring_ops_hvm = {
 
 void __init xenbus_ring_ops_init(void)
 {
+#ifdef CONFIG_XEN_PV
         if (!xen_feature(XENFEAT_auto_translated_physmap))
                 ring_ops = &ring_ops_pv;
         else
+#endif
                 ring_ops = &ring_ops_hvm;
 }