566 files changed, 6761 insertions, 3839 deletions

diff --git a/drivers/acpi/nfit/mce.c b/drivers/acpi/nfit/mce.c
index 4c745bf389fe..161f91539ae6 100644
--- a/drivers/acpi/nfit/mce.c
+++ b/drivers/acpi/nfit/mce.c
@@ -42,7 +42,7 @@ static int nfit_handle_mce(struct notifier_block *nb, unsigned long val,
                 list_for_each_entry(nfit_spa, &acpi_desc->spas, list) {
                         struct acpi_nfit_system_address *spa = nfit_spa->spa;
 
-                        if (nfit_spa_type(spa) == NFIT_SPA_PM)
+                        if (nfit_spa_type(spa) != NFIT_SPA_PM)
                                 continue;
                         /* find the spa that covers the mce addr */
                         if (spa->address > mce->addr)
diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
index ad9fc84a8601..e878fc799af7 100644
--- a/drivers/acpi/scan.c
+++ b/drivers/acpi/scan.c
@@ -2054,7 +2054,7 @@ int __init acpi_scan_init(void)
 
 static struct acpi_probe_entry *ape;
 static int acpi_probe_count;
-static DEFINE_SPINLOCK(acpi_probe_lock);
+static DEFINE_MUTEX(acpi_probe_mutex);
 
 static int __init acpi_match_madt(struct acpi_subtable_header *header,
                                   const unsigned long end)
@@ -2073,7 +2073,7 @@ int __init __acpi_probe_device_table(struct acpi_probe_entry *ap_head, int nr)
         if (acpi_disabled)
                 return 0;
 
-        spin_lock(&acpi_probe_lock);
+        mutex_lock(&acpi_probe_mutex);
         for (ape = ap_head; nr; ape++, nr--) {
                 if (ACPI_COMPARE_NAME(ACPI_SIG_MADT, ape->id)) {
                         acpi_probe_count = 0;
@@ -2086,7 +2086,7 @@ int __init __acpi_probe_device_table(struct acpi_probe_entry *ap_head, int nr)
                                 count++;
                 }
         }
-        spin_unlock(&acpi_probe_lock);
+        mutex_unlock(&acpi_probe_mutex);
 
         return count;
 }
diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
index 7461a587b39b..dcf2c724fd06 100644
--- a/drivers/ata/libahci.c
+++ b/drivers/ata/libahci.c
@@ -2524,7 +2524,7 @@ static int ahci_host_activate_multi_irqs(struct ata_host *host,
 
                 /* Do not receive interrupts sent by dummy ports */
                 if (!pp) {
-                        disable_irq(irq + i);
+                        disable_irq(irq);
                         continue;
                 }
 
diff --git a/drivers/ata/pata_ninja32.c b/drivers/ata/pata_ninja32.c
index 633aa2934a18..44f97ad3c88d 100644
--- a/drivers/ata/pata_ninja32.c
+++ b/drivers/ata/pata_ninja32.c
@@ -144,7 +144,7 @@ static int ninja32_init_one(struct pci_dev *dev, const struct pci_device_id *id)
         ap->ioaddr.altstatus_addr = base + 0x1E;
         ap->ioaddr.bmdma_addr = base;
         ata_sff_std_ports(&ap->ioaddr);
-        ap->pflags = ATA_PFLAG_PIO32 | ATA_PFLAG_PIO32CHANGE;
+        ap->pflags |= ATA_PFLAG_PIO32 | ATA_PFLAG_PIO32CHANGE;
 
         ninja32_program(base);
         /* FIXME: Should we disable them at remove ? */
diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c
index e097d355cc04..82a081ea4317 100644
--- a/drivers/base/power/runtime.c
+++ b/drivers/base/power/runtime.c
@@ -301,7 +301,7 @@ static int rpm_idle(struct device *dev, int rpmflags)
         int (*callback)(struct device *);
         int retval;
 
-        trace_rpm_idle(dev, rpmflags);
+        trace_rpm_idle_rcuidle(dev, rpmflags);
         retval = rpm_check_suspend_allowed(dev);
         if (retval < 0)
                 ;       /* Conditions are wrong. */
@@ -337,7 +337,7 @@ static int rpm_idle(struct device *dev, int rpmflags)
                         dev->power.request_pending = true;
                         queue_work(pm_wq, &dev->power.work);
                 }
-                trace_rpm_return_int(dev, _THIS_IP_, 0);
+                trace_rpm_return_int_rcuidle(dev, _THIS_IP_, 0);
                 return 0;
         }
 
@@ -352,7 +352,7 @@ static int rpm_idle(struct device *dev, int rpmflags)
         wake_up_all(&dev->power.wait_queue);
 
  out:
-        trace_rpm_return_int(dev, _THIS_IP_, retval);
+        trace_rpm_return_int_rcuidle(dev, _THIS_IP_, retval);
         return retval ? retval : rpm_suspend(dev, rpmflags | RPM_AUTO);
 }
 
@@ -419,7 +419,7 @@ static int rpm_suspend(struct device *dev, int rpmflags)
         struct device *parent = NULL;
         int retval;
 
-        trace_rpm_suspend(dev, rpmflags);
+        trace_rpm_suspend_rcuidle(dev, rpmflags);
 
  repeat:
         retval = rpm_check_suspend_allowed(dev);
@@ -549,7 +549,7 @@ static int rpm_suspend(struct device *dev, int rpmflags)
         }
 
  out:
-        trace_rpm_return_int(dev, _THIS_IP_, retval);
+        trace_rpm_return_int_rcuidle(dev, _THIS_IP_, retval);
 
         return retval;
 
@@ -601,7 +601,7 @@ static int rpm_resume(struct device *dev, int rpmflags)
         struct device *parent = NULL;
         int retval = 0;
 
-        trace_rpm_resume(dev, rpmflags);
+        trace_rpm_resume_rcuidle(dev, rpmflags);
 
  repeat:
         if (dev->power.runtime_error)
@@ -764,7 +764,7 @@ static int rpm_resume(struct device *dev, int rpmflags)
                 spin_lock_irq(&dev->power.lock);
         }
 
-        trace_rpm_return_int(dev, _THIS_IP_, retval);
+        trace_rpm_return_int_rcuidle(dev, _THIS_IP_, retval);
 
         return retval;
 }
diff --git a/drivers/base/regmap/regcache-rbtree.c b/drivers/base/regmap/regcache-rbtree.c
index aa56af87d941..b11af3f2c1db 100644
--- a/drivers/base/regmap/regcache-rbtree.c
+++ b/drivers/base/regmap/regcache-rbtree.c
@@ -404,6 +404,7 @@ static int regcache_rbtree_write(struct regmap *map, unsigned int reg,
                 unsigned int new_base_reg, new_top_reg;
                 unsigned int min, max;
                 unsigned int max_dist;
+                unsigned int dist, best_dist = UINT_MAX;
 
                 max_dist = map->reg_stride * sizeof(*rbnode_tmp) /
                         map->cache_word_size;
@@ -423,24 +424,41 @@ static int regcache_rbtree_write(struct regmap *map, unsigned int reg,
                                 &base_reg, &top_reg);
 
                         if (base_reg <= max && top_reg >= min) {
-                                new_base_reg = min(reg, base_reg);
-                                new_top_reg = max(reg, top_reg);
-                        } else {
-                                if (max < base_reg)
-                                        node = node->rb_left;
+                                if (reg < base_reg)
+                                        dist = base_reg - reg;
+                                else if (reg > top_reg)
+                                        dist = reg - top_reg;
                                 else
-                                        node = node->rb_right;
-
-                                continue;
+                                        dist = 0;
+                                if (dist < best_dist) {
+                                        rbnode = rbnode_tmp;
+                                        best_dist = dist;
+                                        new_base_reg = min(reg, base_reg);
+                                        new_top_reg = max(reg, top_reg);
+                                }
                         }
 
-                        ret = regcache_rbtree_insert_to_block(map, rbnode_tmp,
+                        /*
+                         * Keep looking, we want to choose the closest block,
+                         * otherwise we might end up creating overlapping
+                         * blocks, which breaks the rbtree.
+                         */
+                        if (reg < base_reg)
+                                node = node->rb_left;
+                        else if (reg > top_reg)
+                                node = node->rb_right;
+                        else
+                                break;
+                }
+
+                if (rbnode) {
+                        ret = regcache_rbtree_insert_to_block(map, rbnode,
                                                               new_base_reg,
                                                               new_top_reg, reg,
                                                               value);
                         if (ret)
                                 return ret;
-                        rbtree_ctx->cached_rbnode = rbnode_tmp;
+                        rbtree_ctx->cached_rbnode = rbnode;
                         return 0;
                 }
 
diff --git a/drivers/base/regmap/regcache.c b/drivers/base/regmap/regcache.c
index df7ff7290821..4e582561e1e7 100644
--- a/drivers/base/regmap/regcache.c
+++ b/drivers/base/regmap/regcache.c
@@ -38,10 +38,11 @@ static int regcache_hw_init(struct regmap *map)
 
         /* calculate the size of reg_defaults */
         for (count = 0, i = 0; i < map->num_reg_defaults_raw; i++)
-                if (!regmap_volatile(map, i * map->reg_stride))
+                if (regmap_readable(map, i * map->reg_stride) &&
+                    !regmap_volatile(map, i * map->reg_stride))
                         count++;
 
-        /* all registers are volatile, so just bypass */
+        /* all registers are unreadable or volatile, so just bypass */
         if (!count) {
                 map->cache_bypass = true;
                 return 0;
diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
index 51fa7d66a393..e964d068874d 100644
--- a/drivers/base/regmap/regmap.c
+++ b/drivers/base/regmap/regmap.c
@@ -1474,6 +1474,12 @@ int _regmap_raw_write(struct regmap *map, unsigned int reg,
                 ret = map->bus->write(map->bus_context, buf, len);
 
                 kfree(buf);
+        } else if (ret != 0 && !map->cache_bypass && map->format.parse_val) {
+                /* regcache_drop_region() takes lock that we already have,
+                 * thus call map->cache_ops->drop() directly
+                 */
+                if (map->cache_ops && map->cache_ops->drop)
+                        map->cache_ops->drop(map, reg, reg + 1);
         }
 
         trace_regmap_hw_write_done(map, reg, val_len / map->format.val_bytes);
diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index b71a9c767009..e3d8e4ced4a2 100644
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -3706,22 +3706,21 @@ static int floppy_open(struct block_device *bdev, fmode_t mode)
         if (UFDCS->rawcmd == 1)
                 UFDCS->rawcmd = 2;
 
-        if (mode & (FMODE_READ|FMODE_WRITE)) {
-                UDRS->last_checked = 0;
-                clear_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags);
-                check_disk_change(bdev);
-                if (test_bit(FD_DISK_CHANGED_BIT, &UDRS->flags))
-                        goto out;
-                if (test_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags))
+        if (!(mode & FMODE_NDELAY)) {
+                if (mode & (FMODE_READ|FMODE_WRITE)) {
+                        UDRS->last_checked = 0;
+                        clear_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags);
+                        check_disk_change(bdev);
+                        if (test_bit(FD_DISK_CHANGED_BIT, &UDRS->flags))
+                                goto out;
+                        if (test_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags))
+                                goto out;
+                }
+                res = -EROFS;
+                if ((mode & FMODE_WRITE) &&
+                    !test_bit(FD_DISK_WRITABLE_BIT, &UDRS->flags))
                         goto out;
         }
-
-        res = -EROFS;
-
-        if ((mode & FMODE_WRITE) &&
-                        !test_bit(FD_DISK_WRITABLE_BIT, &UDRS->flags))
-                goto out;
-
         mutex_unlock(&open_lock);
         mutex_unlock(&floppy_mutex);
         return 0;
diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
index be4fea6a5dd3..88ef6d4729b4 100644
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -189,6 +189,8 @@ struct blkfront_info
         struct mutex mutex;
         struct xenbus_device *xbdev;
         struct gendisk *gd;
+        u16 sector_size;
+        unsigned int physical_sector_size;
         int vdevice;
         blkif_vdev_t handle;
         enum blkif_state connected;
@@ -910,9 +912,45 @@ static struct blk_mq_ops blkfront_mq_ops = {
         .map_queue = blk_mq_map_queue,
 };
 
+static void blkif_set_queue_limits(struct blkfront_info *info)
+{
+        struct request_queue *rq = info->rq;
+        struct gendisk *gd = info->gd;
+        unsigned int segments = info->max_indirect_segments ? :
+                                BLKIF_MAX_SEGMENTS_PER_REQUEST;
+
+        queue_flag_set_unlocked(QUEUE_FLAG_VIRT, rq);
+
+        if (info->feature_discard) {
+                queue_flag_set_unlocked(QUEUE_FLAG_DISCARD, rq);
+                blk_queue_max_discard_sectors(rq, get_capacity(gd));
+                rq->limits.discard_granularity = info->discard_granularity;
+                rq->limits.discard_alignment = info->discard_alignment;
+                if (info->feature_secdiscard)
+                        queue_flag_set_unlocked(QUEUE_FLAG_SECERASE, rq);
+        }
+
+        /* Hard sector size and max sectors impersonate the equiv. hardware. */
+        blk_queue_logical_block_size(rq, info->sector_size);
+        blk_queue_physical_block_size(rq, info->physical_sector_size);
+        blk_queue_max_hw_sectors(rq, (segments * XEN_PAGE_SIZE) / 512);
+
+        /* Each segment in a request is up to an aligned page in size. */
+        blk_queue_segment_boundary(rq, PAGE_SIZE - 1);
+        blk_queue_max_segment_size(rq, PAGE_SIZE);
+
+        /* Ensure a merged request will fit in a single I/O ring slot. */
+        blk_queue_max_segments(rq, segments / GRANTS_PER_PSEG);
+
+        /* Make sure buffer addresses are sector-aligned. */
+        blk_queue_dma_alignment(rq, 511);
+
+        /* Make sure we don't use bounce buffers. */
+        blk_queue_bounce_limit(rq, BLK_BOUNCE_ANY);
+}
+
 static int xlvbd_init_blk_queue(struct gendisk *gd, u16 sector_size,
-                                unsigned int physical_sector_size,
-                                unsigned int segments)
+                                unsigned int physical_sector_size)
 {
         struct request_queue *rq;
         struct blkfront_info *info = gd->private_data;
@@ -944,36 +982,11 @@ static int xlvbd_init_blk_queue(struct gendisk *gd, u16 sector_size,
         }
 
         rq->queuedata = info;
-        queue_flag_set_unlocked(QUEUE_FLAG_VIRT, rq);
-
-        if (info->feature_discard) {
-                queue_flag_set_unlocked(QUEUE_FLAG_DISCARD, rq);
-                blk_queue_max_discard_sectors(rq, get_capacity(gd));
-                rq->limits.discard_granularity = info->discard_granularity;
-                rq->limits.discard_alignment = info->discard_alignment;
-                if (info->feature_secdiscard)
-                        queue_flag_set_unlocked(QUEUE_FLAG_SECERASE, rq);
-        }
-
-        /* Hard sector size and max sectors impersonate the equiv. hardware. */
-        blk_queue_logical_block_size(rq, sector_size);
-        blk_queue_physical_block_size(rq, physical_sector_size);
-        blk_queue_max_hw_sectors(rq, (segments * XEN_PAGE_SIZE) / 512);
-
-        /* Each segment in a request is up to an aligned page in size. */
-        blk_queue_segment_boundary(rq, PAGE_SIZE - 1);
-        blk_queue_max_segment_size(rq, PAGE_SIZE);
-
-        /* Ensure a merged request will fit in a single I/O ring slot. */
-        blk_queue_max_segments(rq, segments / GRANTS_PER_PSEG);
-
-        /* Make sure buffer addresses are sector-aligned. */
-        blk_queue_dma_alignment(rq, 511);
-
-        /* Make sure we don't use bounce buffers. */
-        blk_queue_bounce_limit(rq, BLK_BOUNCE_ANY);
-
-        gd->queue = rq;
+        info->rq = gd->queue = rq;
+        info->gd = gd;
+        info->sector_size = sector_size;
+        info->physical_sector_size = physical_sector_size;
+        blkif_set_queue_limits(info);
 
         return 0;
 }
@@ -1136,16 +1149,11 @@ static int xlvbd_alloc_gendisk(blkif_sector_t capacity,
         gd->private_data = info;
         set_capacity(gd, capacity);
 
-        if (xlvbd_init_blk_queue(gd, sector_size, physical_sector_size,
-                                 info->max_indirect_segments ? :
-                                 BLKIF_MAX_SEGMENTS_PER_REQUEST)) {
+        if (xlvbd_init_blk_queue(gd, sector_size, physical_sector_size)) {
                 del_gendisk(gd);
                 goto release;
         }
 
-        info->rq = gd->queue;
-        info->gd = gd;
-
         xlvbd_flush(info);
 
         if (vdisk_info & VDISK_READONLY)
@@ -1315,7 +1323,7 @@ free_shadow:
                         rinfo->ring_ref[i] = GRANT_INVALID_REF;
                 }
         }
-        free_pages((unsigned long)rinfo->ring.sring, get_order(info->nr_ring_pages * PAGE_SIZE));
+        free_pages((unsigned long)rinfo->ring.sring, get_order(info->nr_ring_pages * XEN_PAGE_SIZE));
         rinfo->ring.sring = NULL;
 
         if (rinfo->irq)
@@ -2007,8 +2015,10 @@ static int blkif_recover(struct blkfront_info *info)
         struct split_bio *split_bio;
 
         blkfront_gather_backend_features(info);
+        /* Reset limits changed by blk_mq_update_nr_hw_queues(). */
+        blkif_set_queue_limits(info);
         segs = info->max_indirect_segments ? : BLKIF_MAX_SEGMENTS_PER_REQUEST;
-        blk_queue_max_segments(info->rq, segs);
+        blk_queue_max_segments(info->rq, segs / GRANTS_PER_PSEG);
 
         for (r_index = 0; r_index < info->nr_rings; r_index++) {
                 struct blkfront_ring_info *rinfo = &info->rinfo[r_index];
@@ -2432,7 +2442,7 @@ static void blkfront_connect(struct blkfront_info *info)
         if (err) {
                 xenbus_dev_fatal(info->xbdev, err, "xlvbd_add at %s",
                                  info->xbdev->otherend);
-                return;
+                goto fail;
         }
 
         xenbus_switch_state(info->xbdev, XenbusStateConnected);
@@ -2445,6 +2455,11 @@ static void blkfront_connect(struct blkfront_info *info)
         device_add_disk(&info->xbdev->dev, info->gd);
 
         info->is_ready = 1;
+        return;
+
+fail:
+        blkif_free(info, 0);
+        return;
 }
 
 /**
diff --git a/drivers/bus/arm-cci.c b/drivers/bus/arm-cci.c
index 5755907f836f..ffa7c9dcbd7a 100644
--- a/drivers/bus/arm-cci.c
+++ b/drivers/bus/arm-cci.c
@@ -551,7 +551,7 @@ static struct attribute *cci5xx_pmu_event_attrs[] = {
         CCI5xx_GLOBAL_EVENT_EXT_ATTR_ENTRY(cci_wrq, 0xB),
         CCI5xx_GLOBAL_EVENT_EXT_ATTR_ENTRY(cci_snoop_cd_hs, 0xC),
         CCI5xx_GLOBAL_EVENT_EXT_ATTR_ENTRY(cci_rq_stall_addr_hazard, 0xD),
-        CCI5xx_GLOBAL_EVENT_EXT_ATTR_ENTRY(cci_snopp_rq_stall_tt_full, 0xE),
+        CCI5xx_GLOBAL_EVENT_EXT_ATTR_ENTRY(cci_snoop_rq_stall_tt_full, 0xE),
         CCI5xx_GLOBAL_EVENT_EXT_ATTR_ENTRY(cci_snoop_rq_tzmp1_prot, 0xF),
         NULL
 };
diff --git a/drivers/bus/arm-ccn.c b/drivers/bus/arm-ccn.c
index 97a9185af433..884c0305e290 100644
--- a/drivers/bus/arm-ccn.c
+++ b/drivers/bus/arm-ccn.c
@@ -187,6 +187,7 @@ struct arm_ccn {
         struct arm_ccn_component *xp;
 
         struct arm_ccn_dt dt;
+        int mn_id;
 };
 
 static DEFINE_MUTEX(arm_ccn_mutex);
@@ -212,6 +213,7 @@ static int arm_ccn_node_to_xp_port(int node)
 #define CCN_CONFIG_TYPE(_config)        (((_config) >> 8) & 0xff)
 #define CCN_CONFIG_EVENT(_config)       (((_config) >> 16) & 0xff)
 #define CCN_CONFIG_PORT(_config)        (((_config) >> 24) & 0x3)
+#define CCN_CONFIG_BUS(_config)         (((_config) >> 24) & 0x3)
 #define CCN_CONFIG_VC(_config)          (((_config) >> 26) & 0x7)
 #define CCN_CONFIG_DIR(_config)         (((_config) >> 29) & 0x1)
 #define CCN_CONFIG_MASK(_config)        (((_config) >> 30) & 0xf)
@@ -241,6 +243,7 @@ static CCN_FORMAT_ATTR(xp, "config:0-7");
 static CCN_FORMAT_ATTR(type, "config:8-15");
 static CCN_FORMAT_ATTR(event, "config:16-23");
 static CCN_FORMAT_ATTR(port, "config:24-25");
+static CCN_FORMAT_ATTR(bus, "config:24-25");
 static CCN_FORMAT_ATTR(vc, "config:26-28");
 static CCN_FORMAT_ATTR(dir, "config:29-29");
 static CCN_FORMAT_ATTR(mask, "config:30-33");
@@ -253,6 +256,7 @@ static struct attribute *arm_ccn_pmu_format_attrs[] = {
         &arm_ccn_pmu_format_attr_type.attr.attr,
         &arm_ccn_pmu_format_attr_event.attr.attr,
         &arm_ccn_pmu_format_attr_port.attr.attr,
+        &arm_ccn_pmu_format_attr_bus.attr.attr,
         &arm_ccn_pmu_format_attr_vc.attr.attr,
         &arm_ccn_pmu_format_attr_dir.attr.attr,
         &arm_ccn_pmu_format_attr_mask.attr.attr,
@@ -328,6 +332,7 @@ struct arm_ccn_pmu_event {
 static ssize_t arm_ccn_pmu_event_show(struct device *dev,
                 struct device_attribute *attr, char *buf)
 {
+        struct arm_ccn *ccn = pmu_to_arm_ccn(dev_get_drvdata(dev));
         struct arm_ccn_pmu_event *event = container_of(attr,
                         struct arm_ccn_pmu_event, attr);
         ssize_t res;
@@ -349,10 +354,17 @@ static ssize_t arm_ccn_pmu_event_show(struct device *dev,
                 break;
         case CCN_TYPE_XP:
                 res += snprintf(buf + res, PAGE_SIZE - res,
-                                ",xp=?,port=?,vc=?,dir=?");
+                                ",xp=?,vc=?");
                 if (event->event == CCN_EVENT_WATCHPOINT)
                         res += snprintf(buf + res, PAGE_SIZE - res,
-                                        ",cmp_l=?,cmp_h=?,mask=?");
+                                        ",port=?,dir=?,cmp_l=?,cmp_h=?,mask=?");
+                else
+                        res += snprintf(buf + res, PAGE_SIZE - res,
+                                        ",bus=?");
+
+                break;
+        case CCN_TYPE_MN:
+                res += snprintf(buf + res, PAGE_SIZE - res, ",node=%d", ccn->mn_id);
                 break;
         default:
                 res += snprintf(buf + res, PAGE_SIZE - res, ",node=?");
@@ -383,9 +395,9 @@ static umode_t arm_ccn_pmu_events_is_visible(struct kobject *kobj,
 }
 
 static struct arm_ccn_pmu_event arm_ccn_pmu_events[] = {
-        CCN_EVENT_MN(eobarrier, "dir=0,vc=0,cmp_h=0x1c00", CCN_IDX_MASK_OPCODE),
-        CCN_EVENT_MN(ecbarrier, "dir=0,vc=0,cmp_h=0x1e00", CCN_IDX_MASK_OPCODE),
-        CCN_EVENT_MN(dvmop, "dir=0,vc=0,cmp_h=0x2800", CCN_IDX_MASK_OPCODE),
+        CCN_EVENT_MN(eobarrier, "dir=1,vc=0,cmp_h=0x1c00", CCN_IDX_MASK_OPCODE),
+        CCN_EVENT_MN(ecbarrier, "dir=1,vc=0,cmp_h=0x1e00", CCN_IDX_MASK_OPCODE),
+        CCN_EVENT_MN(dvmop, "dir=1,vc=0,cmp_h=0x2800", CCN_IDX_MASK_OPCODE),
         CCN_EVENT_HNI(txdatflits, "dir=1,vc=3", CCN_IDX_MASK_ANY),
         CCN_EVENT_HNI(rxdatflits, "dir=0,vc=3", CCN_IDX_MASK_ANY),
         CCN_EVENT_HNI(txreqflits, "dir=1,vc=0", CCN_IDX_MASK_ANY),
@@ -733,9 +745,10 @@ static int arm_ccn_pmu_event_init(struct perf_event *event)
 
         if (has_branch_stack(event) || event->attr.exclude_user ||
                         event->attr.exclude_kernel || event->attr.exclude_hv ||
-                        event->attr.exclude_idle) {
+                        event->attr.exclude_idle || event->attr.exclude_host ||
+                        event->attr.exclude_guest) {
                 dev_warn(ccn->dev, "Can't exclude execution levels!\n");
-                return -EOPNOTSUPP;
+                return -EINVAL;
         }
 
         if (event->cpu < 0) {
@@ -759,6 +772,12 @@ static int arm_ccn_pmu_event_init(struct perf_event *event)
 
         /* Validate node/xp vs topology */
         switch (type) {
+        case CCN_TYPE_MN:
+                if (node_xp != ccn->mn_id) {
+                        dev_warn(ccn->dev, "Invalid MN ID %d!\n", node_xp);
+                        return -EINVAL;
+                }
+                break;
         case CCN_TYPE_XP:
                 if (node_xp >= ccn->num_xps) {
                         dev_warn(ccn->dev, "Invalid XP ID %d!\n", node_xp);
@@ -886,6 +905,10 @@ static void arm_ccn_pmu_xp_dt_config(struct perf_event *event, int enable)
         struct arm_ccn_component *xp;
         u32 val, dt_cfg;
 
+        /* Nothing to do for cycle counter */
+        if (hw->idx == CCN_IDX_PMU_CYCLE_COUNTER)
+                return;
+
         if (CCN_CONFIG_TYPE(event->attr.config) == CCN_TYPE_XP)
                 xp = &ccn->xp[CCN_CONFIG_XP(event->attr.config)];
         else
@@ -917,38 +940,17 @@ static void arm_ccn_pmu_event_start(struct perf_event *event, int flags)
                         arm_ccn_pmu_read_counter(ccn, hw->idx));
         hw->state = 0;
 
-        /*
-         * Pin the timer, so that the overflows are handled by the chosen
-         * event->cpu (this is the same one as presented in "cpumask"
-         * attribute).
-         */
-        if (!ccn->irq)
-                hrtimer_start(&ccn->dt.hrtimer, arm_ccn_pmu_timer_period(),
-                                HRTIMER_MODE_REL_PINNED);
-
         /* Set the DT bus input, engaging the counter */
         arm_ccn_pmu_xp_dt_config(event, 1);
 }
 
 static void arm_ccn_pmu_event_stop(struct perf_event *event, int flags)
 {
-        struct arm_ccn *ccn = pmu_to_arm_ccn(event->pmu);
         struct hw_perf_event *hw = &event->hw;
-        u64 timeout;
 
         /* Disable counting, setting the DT bus to pass-through mode */
         arm_ccn_pmu_xp_dt_config(event, 0);
 
-        if (!ccn->irq)
-                hrtimer_cancel(&ccn->dt.hrtimer);
-
-        /* Let the DT bus drain */
-        timeout = arm_ccn_pmu_read_counter(ccn, CCN_IDX_PMU_CYCLE_COUNTER) +
-                        ccn->num_xps;
-        while (arm_ccn_pmu_read_counter(ccn, CCN_IDX_PMU_CYCLE_COUNTER) <
-                        timeout)
-                cpu_relax();
-
         if (flags & PERF_EF_UPDATE)
                 arm_ccn_pmu_event_update(event);
 
@@ -988,7 +990,7 @@ static void arm_ccn_pmu_xp_watchpoint_config(struct perf_event *event)
 
         /* Comparison values */
         writel(cmp_l & 0xffffffff, source->base + CCN_XP_DT_CMP_VAL_L(wp));
-        writel((cmp_l >> 32) & 0xefffffff,
+        writel((cmp_l >> 32) & 0x7fffffff,
                         source->base + CCN_XP_DT_CMP_VAL_L(wp) + 4);
         writel(cmp_h & 0xffffffff, source->base + CCN_XP_DT_CMP_VAL_H(wp));
         writel((cmp_h >> 32) & 0x0fffffff,
@@ -996,7 +998,7 @@ static void arm_ccn_pmu_xp_watchpoint_config(struct perf_event *event)
 
         /* Mask */
         writel(mask_l & 0xffffffff, source->base + CCN_XP_DT_CMP_MASK_L(wp));
-        writel((mask_l >> 32) & 0xefffffff,
+        writel((mask_l >> 32) & 0x7fffffff,
                         source->base + CCN_XP_DT_CMP_MASK_L(wp) + 4);
         writel(mask_h & 0xffffffff, source->base + CCN_XP_DT_CMP_MASK_H(wp));
         writel((mask_h >> 32) & 0x0fffffff,
@@ -1014,7 +1016,7 @@ static void arm_ccn_pmu_xp_event_config(struct perf_event *event)
         hw->event_base = CCN_XP_DT_CONFIG__DT_CFG__XP_PMU_EVENT(hw->config_base);
 
         id = (CCN_CONFIG_VC(event->attr.config) << 4) |
-                        (CCN_CONFIG_PORT(event->attr.config) << 3) |
+                        (CCN_CONFIG_BUS(event->attr.config) << 3) |
                         (CCN_CONFIG_EVENT(event->attr.config) << 0);
 
         val = readl(source->base + CCN_XP_PMU_EVENT_SEL);
@@ -1099,15 +1101,31 @@ static void arm_ccn_pmu_event_config(struct perf_event *event)
         spin_unlock(&ccn->dt.config_lock);
 }
 
+static int arm_ccn_pmu_active_counters(struct arm_ccn *ccn)
+{
+        return bitmap_weight(ccn->dt.pmu_counters_mask,
+                             CCN_NUM_PMU_EVENT_COUNTERS + 1);
+}
+
 static int arm_ccn_pmu_event_add(struct perf_event *event, int flags)
 {
         int err;
         struct hw_perf_event *hw = &event->hw;
+        struct arm_ccn *ccn = pmu_to_arm_ccn(event->pmu);
 
         err = arm_ccn_pmu_event_alloc(event);
         if (err)
                 return err;
 
+        /*
+         * Pin the timer, so that the overflows are handled by the chosen
+         * event->cpu (this is the same one as presented in "cpumask"
+         * attribute).
+         */
+        if (!ccn->irq && arm_ccn_pmu_active_counters(ccn) == 1)
+                hrtimer_start(&ccn->dt.hrtimer, arm_ccn_pmu_timer_period(),
+                              HRTIMER_MODE_REL_PINNED);
+
         arm_ccn_pmu_event_config(event);
 
         hw->state = PERF_HES_STOPPED;
@@ -1120,9 +1138,14 @@ static int arm_ccn_pmu_event_add(struct perf_event *event, int flags)
 
 static void arm_ccn_pmu_event_del(struct perf_event *event, int flags)
 {
+        struct arm_ccn *ccn = pmu_to_arm_ccn(event->pmu);
+
         arm_ccn_pmu_event_stop(event, PERF_EF_UPDATE);
 
         arm_ccn_pmu_event_release(event);
+
+        if (!ccn->irq && arm_ccn_pmu_active_counters(ccn) == 0)
+                hrtimer_cancel(&ccn->dt.hrtimer);
 }
 
 static void arm_ccn_pmu_event_read(struct perf_event *event)
@@ -1130,6 +1153,24 @@ static void arm_ccn_pmu_event_read(struct perf_event *event)
         arm_ccn_pmu_event_update(event);
 }
 
+static void arm_ccn_pmu_enable(struct pmu *pmu)
+{
+        struct arm_ccn *ccn = pmu_to_arm_ccn(pmu);
+
+        u32 val = readl(ccn->dt.base + CCN_DT_PMCR);
+        val |= CCN_DT_PMCR__PMU_EN;
+        writel(val, ccn->dt.base + CCN_DT_PMCR);
+}
+
+static void arm_ccn_pmu_disable(struct pmu *pmu)
+{
+        struct arm_ccn *ccn = pmu_to_arm_ccn(pmu);
+
+        u32 val = readl(ccn->dt.base + CCN_DT_PMCR);
+        val &= ~CCN_DT_PMCR__PMU_EN;
+        writel(val, ccn->dt.base + CCN_DT_PMCR);
+}
+
 static irqreturn_t arm_ccn_pmu_overflow_handler(struct arm_ccn_dt *dt)
 {
         u32 pmovsr = readl(dt->base + CCN_DT_PMOVSR);
@@ -1252,6 +1293,8 @@ static int arm_ccn_pmu_init(struct arm_ccn *ccn)
                 .start = arm_ccn_pmu_event_start,
                 .stop = arm_ccn_pmu_event_stop,
                 .read = arm_ccn_pmu_event_read,
+                .pmu_enable = arm_ccn_pmu_enable,
+                .pmu_disable = arm_ccn_pmu_disable,
         };
 
         /* No overflow interrupt? Have to use a timer instead. */
@@ -1361,6 +1404,8 @@ static int arm_ccn_init_nodes(struct arm_ccn *ccn, int region,
 
         switch (type) {
         case CCN_TYPE_MN:
+                ccn->mn_id = id;
+                return 0;
         case CCN_TYPE_DT:
                 return 0;
         case CCN_TYPE_XP:
@@ -1471,8 +1516,9 @@ static int arm_ccn_probe(struct platform_device *pdev)
                 /* Can set 'disable' bits, so can acknowledge interrupts */
                 writel(CCN_MN_ERRINT_STATUS__PMU_EVENTS__ENABLE,
                                 ccn->base + CCN_MN_ERRINT_STATUS);
-                err = devm_request_irq(ccn->dev, irq, arm_ccn_irq_handler, 0,
-                                dev_name(ccn->dev), ccn);
+                err = devm_request_irq(ccn->dev, irq, arm_ccn_irq_handler,
+                                       IRQF_NOBALANCING | IRQF_NO_THREAD,
+                                       dev_name(ccn->dev), ccn);
                 if (err)
                         return err;
 
diff --git a/drivers/bus/vexpress-config.c b/drivers/bus/vexpress-config.c
index c3cb76b363c6..9efdf1de4035 100644
--- a/drivers/bus/vexpress-config.c
+++ b/drivers/bus/vexpress-config.c
@@ -178,6 +178,7 @@ static int vexpress_config_populate(struct device_node *node)
 
         parent = class_find_device(vexpress_config_class, NULL, bridge,
                         vexpress_config_node_match);
+        of_node_put(bridge);
         if (WARN_ON(!parent))
                 return -ENODEV;
 
diff --git a/drivers/char/hw_random/Kconfig b/drivers/char/hw_random/Kconfig
index 56ad5a5936a9..8c0770bf8881 100644
--- a/drivers/char/hw_random/Kconfig
+++ b/drivers/char/hw_random/Kconfig
@@ -244,7 +244,7 @@ config HW_RANDOM_TX4939
 
 config HW_RANDOM_MXC_RNGA
         tristate "Freescale i.MX RNGA Random Number Generator"
-        depends on ARCH_HAS_RNGA
+        depends on SOC_IMX31
         default HW_RANDOM
         ---help---
           This driver provides kernel-side support for the Random Number
diff --git a/drivers/char/tpm/tpm2-cmd.c b/drivers/char/tpm/tpm2-cmd.c
index 08c7e23ed535..0c75c3f1689f 100644
--- a/drivers/char/tpm/tpm2-cmd.c
+++ b/drivers/char/tpm/tpm2-cmd.c
@@ -957,7 +957,7 @@ int tpm2_auto_startup(struct tpm_chip *chip)
                 goto out;
 
         rc = tpm2_do_selftest(chip);
-        if (rc != TPM2_RC_INITIALIZE) {
+        if (rc != 0 && rc != TPM2_RC_INITIALIZE) {
                 dev_err(&chip->dev, "TPM self test failed\n");
                 goto out;
         }
@@ -974,7 +974,6 @@ int tpm2_auto_startup(struct tpm_chip *chip)
                 }
         }
 
-        return rc;
 out:
         if (rc > 0)
                 rc = -ENODEV;
diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
index d2406fe25533..5da47e26a012 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -165,6 +165,12 @@ struct ports_device {
          */
         struct virtqueue *c_ivq, *c_ovq;
 
+        /*
+         * A control packet buffer for guest->host requests, protected
+         * by c_ovq_lock.
+         */
+        struct virtio_console_control cpkt;
+
         /* Array of per-port IO virtqueues */
         struct virtqueue **in_vqs, **out_vqs;
 
@@ -560,28 +566,29 @@ static ssize_t __send_control_msg(struct ports_device *portdev, u32 port_id,
                                   unsigned int event, unsigned int value)
 {
         struct scatterlist sg[1];
-        struct virtio_console_control cpkt;
         struct virtqueue *vq;
         unsigned int len;
 
         if (!use_multiport(portdev))
                 return 0;
 
-        cpkt.id = cpu_to_virtio32(portdev->vdev, port_id);
-        cpkt.event = cpu_to_virtio16(portdev->vdev, event);
-        cpkt.value = cpu_to_virtio16(portdev->vdev, value);
-
         vq = portdev->c_ovq;
 
-        sg_init_one(sg, &cpkt, sizeof(cpkt));
-
         spin_lock(&portdev->c_ovq_lock);
-        if (virtqueue_add_outbuf(vq, sg, 1, &cpkt, GFP_ATOMIC) == 0) {
+
+        portdev->cpkt.id = cpu_to_virtio32(portdev->vdev, port_id);
+        portdev->cpkt.event = cpu_to_virtio16(portdev->vdev, event);
+        portdev->cpkt.value = cpu_to_virtio16(portdev->vdev, value);
+
+        sg_init_one(sg, &portdev->cpkt, sizeof(struct virtio_console_control));
+
+        if (virtqueue_add_outbuf(vq, sg, 1, &portdev->cpkt, GFP_ATOMIC) == 0) {
                 virtqueue_kick(vq);
                 while (!virtqueue_get_buf(vq, &len)
                         && !virtqueue_is_broken(vq))
                         cpu_relax();
         }
+
         spin_unlock(&portdev->c_ovq_lock);
         return 0;
 }
diff --git a/drivers/clk/renesas/r8a7795-cpg-mssr.c b/drivers/clk/renesas/r8a7795-cpg-mssr.c
index d359c92e13a6..e38bf60c0ff4 100644
--- a/drivers/clk/renesas/r8a7795-cpg-mssr.c
+++ b/drivers/clk/renesas/r8a7795-cpg-mssr.c
@@ -69,6 +69,7 @@ static const struct cpg_core_clk r8a7795_core_clks[] __initconst = {
         DEF_FIXED(".s1",        CLK_S1,            CLK_PLL1_DIV2,  3, 1),
         DEF_FIXED(".s2",        CLK_S2,            CLK_PLL1_DIV2,  4, 1),
         DEF_FIXED(".s3",        CLK_S3,            CLK_PLL1_DIV2,  6, 1),
+        DEF_FIXED(".sdsrc",     CLK_SDSRC,         CLK_PLL1_DIV2,  2, 1),
 
         /* Core Clock Outputs */
         DEF_FIXED("ztr",        R8A7795_CLK_ZTR,   CLK_PLL1_DIV2,  6, 1),
@@ -87,10 +88,10 @@ static const struct cpg_core_clk r8a7795_core_clks[] __initconst = {
         DEF_FIXED("s3d2",       R8A7795_CLK_S3D2,  CLK_S3,         2, 1),
         DEF_FIXED("s3d4",       R8A7795_CLK_S3D4,  CLK_S3,         4, 1),
 
-        DEF_GEN3_SD("sd0",      R8A7795_CLK_SD0,   CLK_PLL1_DIV2, 0x0074),
-        DEF_GEN3_SD("sd1",      R8A7795_CLK_SD1,   CLK_PLL1_DIV2, 0x0078),
-        DEF_GEN3_SD("sd2",      R8A7795_CLK_SD2,   CLK_PLL1_DIV2, 0x0268),
-        DEF_GEN3_SD("sd3",      R8A7795_CLK_SD3,   CLK_PLL1_DIV2, 0x026c),
+        DEF_GEN3_SD("sd0",      R8A7795_CLK_SD0,   CLK_SDSRC,     0x0074),
+        DEF_GEN3_SD("sd1",      R8A7795_CLK_SD1,   CLK_SDSRC,     0x0078),
+        DEF_GEN3_SD("sd2",      R8A7795_CLK_SD2,   CLK_SDSRC,     0x0268),
+        DEF_GEN3_SD("sd3",      R8A7795_CLK_SD3,   CLK_SDSRC,     0x026c),
 
         DEF_FIXED("cl",         R8A7795_CLK_CL,    CLK_PLL1_DIV2, 48, 1),
         DEF_FIXED("cp",         R8A7795_CLK_CP,    CLK_EXTAL,      2, 1),
diff --git a/drivers/clk/rockchip/clk-rk3399.c b/drivers/clk/rockchip/clk-rk3399.c
index c109d80e7a8a..cdfabeb9a034 100644
--- a/drivers/clk/rockchip/clk-rk3399.c
+++ b/drivers/clk/rockchip/clk-rk3399.c
@@ -833,9 +833,9 @@ static struct rockchip_clk_branch rk3399_clk_branches[] __initdata = {
 
         /* perihp */
         GATE(0, "cpll_aclk_perihp_src", "cpll", CLK_IGNORE_UNUSED,
-                        RK3399_CLKGATE_CON(5), 0, GFLAGS),
-        GATE(0, "gpll_aclk_perihp_src", "gpll", CLK_IGNORE_UNUSED,
                         RK3399_CLKGATE_CON(5), 1, GFLAGS),
+        GATE(0, "gpll_aclk_perihp_src", "gpll", CLK_IGNORE_UNUSED,
+                        RK3399_CLKGATE_CON(5), 0, GFLAGS),
         COMPOSITE(ACLK_PERIHP, "aclk_perihp", mux_aclk_perihp_p, CLK_IGNORE_UNUSED,
                         RK3399_CLKSEL_CON(14), 7, 1, MFLAGS, 0, 5, DFLAGS,
                         RK3399_CLKGATE_CON(5), 2, GFLAGS),
@@ -923,9 +923,9 @@ static struct rockchip_clk_branch rk3399_clk_branches[] __initdata = {
                         RK3399_CLKGATE_CON(6), 14, GFLAGS),
 
         GATE(0, "cpll_aclk_emmc_src", "cpll", CLK_IGNORE_UNUSED,
-                        RK3399_CLKGATE_CON(6), 12, GFLAGS),
-        GATE(0, "gpll_aclk_emmc_src", "gpll", CLK_IGNORE_UNUSED,
                         RK3399_CLKGATE_CON(6), 13, GFLAGS),
+        GATE(0, "gpll_aclk_emmc_src", "gpll", CLK_IGNORE_UNUSED,
+                        RK3399_CLKGATE_CON(6), 12, GFLAGS),
         COMPOSITE_NOGATE(ACLK_EMMC, "aclk_emmc", mux_aclk_emmc_p, CLK_IGNORE_UNUSED,
                         RK3399_CLKSEL_CON(21), 7, 1, MFLAGS, 0, 5, DFLAGS),
         GATE(ACLK_EMMC_CORE, "aclk_emmccore", "aclk_emmc", CLK_IGNORE_UNUSED,
@@ -1071,7 +1071,7 @@ static struct rockchip_clk_branch rk3399_clk_branches[] __initdata = {
         /* vio */
         COMPOSITE(ACLK_VIO, "aclk_vio", mux_pll_src_cpll_gpll_ppll_p, CLK_IGNORE_UNUSED,
                         RK3399_CLKSEL_CON(42), 6, 2, MFLAGS, 0, 5, DFLAGS,
-                        RK3399_CLKGATE_CON(11), 10, GFLAGS),
+                        RK3399_CLKGATE_CON(11), 0, GFLAGS),
         COMPOSITE_NOMUX(PCLK_VIO, "pclk_vio", "aclk_vio", 0,
                         RK3399_CLKSEL_CON(43), 0, 5, DFLAGS,
                         RK3399_CLKGATE_CON(11), 1, GFLAGS),
@@ -1484,6 +1484,7 @@ static const char *const rk3399_cru_critical_clocks[] __initconst = {
         "hclk_perilp1",
         "hclk_perilp1_noc",
         "aclk_dmac0_perilp",
+        "aclk_emmc_noc",
         "gpll_hclk_perilp1_src",
         "gpll_aclk_perilp0_src",
         "gpll_aclk_perihp_src",
diff --git a/drivers/clk/sunxi-ng/ccu-sun8i-h3.c b/drivers/clk/sunxi-ng/ccu-sun8i-h3.c
index 9af359544110..267f99523fbe 100644
--- a/drivers/clk/sunxi-ng/ccu-sun8i-h3.c
+++ b/drivers/clk/sunxi-ng/ccu-sun8i-h3.c
@@ -783,14 +783,14 @@ static struct ccu_reset_map sun8i_h3_ccu_resets[] = {
         [RST_BUS_I2S1]          =  { 0x2d0, BIT(13) },
         [RST_BUS_I2S2]          =  { 0x2d0, BIT(14) },
 
-        [RST_BUS_I2C0]          =  { 0x2d4, BIT(0) },
-        [RST_BUS_I2C1]          =  { 0x2d4, BIT(1) },
-        [RST_BUS_I2C2]          =  { 0x2d4, BIT(2) },
-        [RST_BUS_UART0]         =  { 0x2d4, BIT(16) },
-        [RST_BUS_UART1]         =  { 0x2d4, BIT(17) },
-        [RST_BUS_UART2]         =  { 0x2d4, BIT(18) },
-        [RST_BUS_UART3]         =  { 0x2d4, BIT(19) },
-        [RST_BUS_SCR]           =  { 0x2d4, BIT(20) },
+        [RST_BUS_I2C0]          =  { 0x2d8, BIT(0) },
+        [RST_BUS_I2C1]          =  { 0x2d8, BIT(1) },
+        [RST_BUS_I2C2]          =  { 0x2d8, BIT(2) },
+        [RST_BUS_UART0]         =  { 0x2d8, BIT(16) },
+        [RST_BUS_UART1]         =  { 0x2d8, BIT(17) },
+        [RST_BUS_UART2]         =  { 0x2d8, BIT(18) },
+        [RST_BUS_UART3]         =  { 0x2d8, BIT(19) },
+        [RST_BUS_SCR]           =  { 0x2d8, BIT(20) },
 };
 
 static const struct sunxi_ccu_desc sun8i_h3_ccu_desc = {
diff --git a/drivers/clk/sunxi-ng/ccu_common.c b/drivers/clk/sunxi-ng/ccu_common.c
index fc17b5295e16..51d4bac97ab3 100644
--- a/drivers/clk/sunxi-ng/ccu_common.c
+++ b/drivers/clk/sunxi-ng/ccu_common.c
@@ -31,7 +31,7 @@ void ccu_helper_wait_for_lock(struct ccu_common *common, u32 lock)
                 return;
 
         WARN_ON(readl_relaxed_poll_timeout(common->base + common->reg, reg,
-                                           !(reg & lock), 100, 70000));
+                                           reg & lock, 100, 70000));
 }
 
 int sunxi_ccu_probe(struct device_node *node, void __iomem *reg,
diff --git a/drivers/clk/sunxi-ng/ccu_nk.c b/drivers/clk/sunxi-ng/ccu_nk.c
index 4470ffc8cf0d..d6fafb397489 100644
--- a/drivers/clk/sunxi-ng/ccu_nk.c
+++ b/drivers/clk/sunxi-ng/ccu_nk.c
@@ -14,9 +14,9 @@
 #include "ccu_gate.h"
 #include "ccu_nk.h"
 
-void ccu_nk_find_best(unsigned long parent, unsigned long rate,
-                      unsigned int max_n, unsigned int max_k,
-                      unsigned int *n, unsigned int *k)
+static void ccu_nk_find_best(unsigned long parent, unsigned long rate,
+                             unsigned int max_n, unsigned int max_k,
+                             unsigned int *n, unsigned int *k)
 {
         unsigned long best_rate = 0;
         unsigned int best_k = 0, best_n = 0;
diff --git a/drivers/clk/sunxi/clk-a10-pll2.c b/drivers/clk/sunxi/clk-a10-pll2.c
index 0ee1f363e4be..d8eab90ae661 100644
--- a/drivers/clk/sunxi/clk-a10-pll2.c
+++ b/drivers/clk/sunxi/clk-a10-pll2.c
@@ -73,7 +73,7 @@ static void __init sun4i_pll2_setup(struct device_node *node,
                                           SUN4I_PLL2_PRE_DIV_WIDTH,
                                           CLK_DIVIDER_ONE_BASED | CLK_DIVIDER_ALLOW_ZERO,
                                           &sun4i_a10_pll2_lock);
-        if (!prediv_clk) {
+        if (IS_ERR(prediv_clk)) {
                 pr_err("Couldn't register the prediv clock\n");
                 goto err_free_array;
         }
@@ -106,7 +106,7 @@ static void __init sun4i_pll2_setup(struct device_node *node,
                                           &mult->hw, &clk_multiplier_ops,
                                           &gate->hw, &clk_gate_ops,
                                           CLK_SET_RATE_PARENT);
-        if (!base_clk) {
+        if (IS_ERR(base_clk)) {
                 pr_err("Couldn't register the base multiplier clock\n");
                 goto err_free_multiplier;
         }
diff --git a/drivers/clk/sunxi/clk-sun8i-mbus.c b/drivers/clk/sunxi/clk-sun8i-mbus.c
index 411d3033a96e..b200ebf159ee 100644
--- a/drivers/clk/sunxi/clk-sun8i-mbus.c
+++ b/drivers/clk/sunxi/clk-sun8i-mbus.c
@@ -48,7 +48,7 @@ static void __init sun8i_a23_mbus_setup(struct device_node *node)
                 return;
 
         reg = of_io_request_and_map(node, 0, of_node_full_name(node));
-        if (!reg) {
+        if (IS_ERR(reg)) {
                 pr_err("Could not get registers for sun8i-mbus-clk\n");
                 goto err_free_parents;
         }
diff --git a/drivers/clk/tegra/clk-tegra114.c b/drivers/clk/tegra/clk-tegra114.c
index 64da7b79a6e4..933b5dd698b8 100644
--- a/drivers/clk/tegra/clk-tegra114.c
+++ b/drivers/clk/tegra/clk-tegra114.c
@@ -428,7 +428,7 @@ static struct tegra_clk_pll_params pll_d_params = {
         .div_nmp = &pllp_nmp,
         .freq_table = pll_d_freq_table,
         .flags = TEGRA_PLL_HAS_CPCON | TEGRA_PLL_SET_LFCON |
-                 TEGRA_PLL_USE_LOCK | TEGRA_PLL_HAS_LOCK_ENABLE,
+                 TEGRA_PLL_HAS_LOCK_ENABLE,
 };
 
 static struct tegra_clk_pll_params pll_d2_params = {
@@ -446,7 +446,7 @@ static struct tegra_clk_pll_params pll_d2_params = {
         .div_nmp = &pllp_nmp,
         .freq_table = pll_d_freq_table,
         .flags = TEGRA_PLL_HAS_CPCON | TEGRA_PLL_SET_LFCON |
-                 TEGRA_PLL_USE_LOCK | TEGRA_PLL_HAS_LOCK_ENABLE,
+                 TEGRA_PLL_HAS_LOCK_ENABLE,
 };
 
 static const struct pdiv_map pllu_p[] = {
diff --git a/drivers/clocksource/bcm_kona_timer.c b/drivers/clocksource/bcm_kona_timer.c
index 7e3fd375a627..92f6e4deee74 100644
--- a/drivers/clocksource/bcm_kona_timer.c
+++ b/drivers/clocksource/bcm_kona_timer.c
@@ -66,10 +66,10 @@ static void kona_timer_disable_and_clear(void __iomem *base)
 
 }
 
-static void
+static int
 kona_timer_get_counter(void __iomem *timer_base, uint32_t *msw, uint32_t *lsw)
 {
-        int loop_limit = 4;
+        int loop_limit = 3;
 
         /*
          * Read 64-bit free running counter
@@ -83,18 +83,19 @@ kona_timer_get_counter(void __iomem *timer_base, uint32_t *msw, uint32_t *lsw)
          *      if new hi-word is equal to previously read hi-word then stop.
          */
 
-        while (--loop_limit) {
+        do {
                 *msw = readl(timer_base + KONA_GPTIMER_STCHI_OFFSET);
                 *lsw = readl(timer_base + KONA_GPTIMER_STCLO_OFFSET);
                 if (*msw == readl(timer_base + KONA_GPTIMER_STCHI_OFFSET))
                         break;
-        }
+        } while (--loop_limit);
         if (!loop_limit) {
                 pr_err("bcm_kona_timer: getting counter failed.\n");
                 pr_err(" Timer will be impacted\n");
+                return -ETIMEDOUT;
         }
 
-        return;
+        return 0;
 }
 
 static int kona_timer_set_next_event(unsigned long clc,
@@ -112,8 +113,11 @@ static int kona_timer_set_next_event(unsigned long clc,
 
         uint32_t lsw, msw;
         uint32_t reg;
+        int ret;
 
-        kona_timer_get_counter(timers.tmr_regs, &msw, &lsw);
+        ret = kona_timer_get_counter(timers.tmr_regs, &msw, &lsw);
+        if (ret)
+                return ret;
 
         /* Load the "next" event tick value */
         writel(lsw + clc, timers.tmr_regs + KONA_GPTIMER_STCM0_OFFSET);
diff --git a/drivers/clocksource/mips-gic-timer.c b/drivers/clocksource/mips-gic-timer.c
index d91e8725917c..b4b3ab5a11ad 100644
--- a/drivers/clocksource/mips-gic-timer.c
+++ b/drivers/clocksource/mips-gic-timer.c
@@ -164,7 +164,7 @@ void __init gic_clocksource_init(unsigned int frequency)
         gic_start_count();
 }
 
-static void __init gic_clocksource_of_init(struct device_node *node)
+static int __init gic_clocksource_of_init(struct device_node *node)
 {
         struct clk *clk;
         int ret;
diff --git a/drivers/clocksource/pxa_timer.c b/drivers/clocksource/pxa_timer.c
index 937e10b84d58..3e1cb512f3ce 100644
--- a/drivers/clocksource/pxa_timer.c
+++ b/drivers/clocksource/pxa_timer.c
@@ -21,6 +21,8 @@
 #include <linux/of_irq.h>
 #include <linux/sched_clock.h>
 
+#include <clocksource/pxa.h>
+
 #include <asm/div64.h>
 
 #define OSMR0           0x00    /* OS Timer 0 Match Register */
diff --git a/drivers/clocksource/sun4i_timer.c b/drivers/clocksource/sun4i_timer.c
index 97669ee4df2a..c83452cacb41 100644
--- a/drivers/clocksource/sun4i_timer.c
+++ b/drivers/clocksource/sun4i_timer.c
@@ -123,12 +123,16 @@ static struct clock_event_device sun4i_clockevent = {
         .set_next_event = sun4i_clkevt_next_event,
 };
 
+static void sun4i_timer_clear_interrupt(void)
+{
+        writel(TIMER_IRQ_EN(0), timer_base + TIMER_IRQ_ST_REG);
+}
 
 static irqreturn_t sun4i_timer_interrupt(int irq, void *dev_id)
 {
         struct clock_event_device *evt = (struct clock_event_device *)dev_id;
 
-        writel(0x1, timer_base + TIMER_IRQ_ST_REG);
+        sun4i_timer_clear_interrupt();
         evt->event_handler(evt);
 
         return IRQ_HANDLED;
@@ -208,6 +212,9 @@ static int __init sun4i_timer_init(struct device_node *node)
         /* Make sure timer is stopped before playing with interrupts */
         sun4i_clkevt_time_stop(0);
 
+        /* clear timer0 interrupt */
+        sun4i_timer_clear_interrupt();
+
         sun4i_clockevent.cpumask = cpu_possible_mask;
         sun4i_clockevent.irq = irq;
 
diff --git a/drivers/clocksource/time-armada-370-xp.c b/drivers/clocksource/time-armada-370-xp.c
index 719b478d136e..3c39e6f45971 100644
--- a/drivers/clocksource/time-armada-370-xp.c
+++ b/drivers/clocksource/time-armada-370-xp.c
@@ -338,7 +338,6 @@ static int __init armada_xp_timer_init(struct device_node *np)
         struct clk *clk = of_clk_get_by_name(np, "fixed");
         int ret;
 
-        clk = of_clk_get(np, 0);
         if (IS_ERR(clk)) {
                 pr_err("Failed to get clock");
                 return PTR_ERR(clk);
diff --git a/drivers/clocksource/time-pistachio.c b/drivers/clocksource/time-pistachio.c
index a7d9a08e4b0e..a8e6c7df853d 100644
--- a/drivers/clocksource/time-pistachio.c
+++ b/drivers/clocksource/time-pistachio.c
@@ -202,10 +202,10 @@ static int __init pistachio_clksrc_of_init(struct device_node *node)
         rate = clk_get_rate(fast_clk);
 
         /* Disable irq's for clocksource usage */
-        gpt_writel(&pcs_gpt.base, 0, TIMER_IRQ_MASK, 0);
-        gpt_writel(&pcs_gpt.base, 0, TIMER_IRQ_MASK, 1);
-        gpt_writel(&pcs_gpt.base, 0, TIMER_IRQ_MASK, 2);
-        gpt_writel(&pcs_gpt.base, 0, TIMER_IRQ_MASK, 3);
+        gpt_writel(pcs_gpt.base, 0, TIMER_IRQ_MASK, 0);
+        gpt_writel(pcs_gpt.base, 0, TIMER_IRQ_MASK, 1);
+        gpt_writel(pcs_gpt.base, 0, TIMER_IRQ_MASK, 2);
+        gpt_writel(pcs_gpt.base, 0, TIMER_IRQ_MASK, 3);
 
         /* Enable timer block */
         writel(TIMER_ME_GLOBAL, pcs_gpt.base);
diff --git a/drivers/clocksource/timer-atmel-pit.c b/drivers/clocksource/timer-atmel-pit.c
index 1ffac0cb0cb7..7f0f5b26d8c5 100644
--- a/drivers/clocksource/timer-atmel-pit.c
+++ b/drivers/clocksource/timer-atmel-pit.c
@@ -240,6 +240,7 @@ static int __init at91sam926x_pit_common_init(struct pit_data *data)
 static int __init at91sam926x_pit_dt_init(struct device_node *node)
 {
         struct pit_data *data;
+        int ret;
 
         data = kzalloc(sizeof(*data), GFP_KERNEL);
         if (!data)
@@ -261,6 +262,12 @@ static int __init at91sam926x_pit_dt_init(struct device_node *node)
                 return PTR_ERR(data->mck);
         }
 
+        ret = clk_prepare_enable(data->mck);
+        if (ret) {
+                pr_err("Unable to enable mck\n");
+                return ret;
+        }
+
         /* Get the interrupts property */
         data->irq = irq_of_parse_and_map(node, 0);
         if (!data->irq) {
diff --git a/drivers/cpufreq/cpufreq-dt-platdev.c b/drivers/cpufreq/cpufreq-dt-platdev.c
index 0bb44d5b5df4..2ee40fd360ca 100644
--- a/drivers/cpufreq/cpufreq-dt-platdev.c
+++ b/drivers/cpufreq/cpufreq-dt-platdev.c
@@ -74,6 +74,8 @@ static const struct of_device_id machines[] __initconst = {
         { .compatible = "ti,omap5", },
 
         { .compatible = "xlnx,zynq-7000", },
+
+        { }
 };
 
 static int __init cpufreq_dt_platdev_init(void)
diff --git a/drivers/crypto/caam/caamalg.c b/drivers/crypto/caam/caamalg.c
index ea8189f4b021..b3044219772c 100644
--- a/drivers/crypto/caam/caamalg.c
+++ b/drivers/crypto/caam/caamalg.c
@@ -441,6 +441,9 @@ static int aead_set_sh_desc(struct crypto_aead *aead)
                                OP_ALG_AAI_CTR_MOD128);
         const bool is_rfc3686 = alg->caam.rfc3686;
 
+        if (!ctx->authsize)
+                return 0;
+
         /* NULL encryption / decryption */
         if (!ctx->enckeylen)
                 return aead_null_set_sh_desc(aead);
@@ -553,7 +556,10 @@ skip_enc:
 
         /* Read and write assoclen bytes */
         append_math_add(desc, VARSEQINLEN, ZERO, REG3, CAAM_CMD_SZ);
-        append_math_add(desc, VARSEQOUTLEN, ZERO, REG3, CAAM_CMD_SZ);
+        if (alg->caam.geniv)
+                append_math_add_imm_u32(desc, VARSEQOUTLEN, REG3, IMM, ivsize);
+        else
+                append_math_add(desc, VARSEQOUTLEN, ZERO, REG3, CAAM_CMD_SZ);
 
         /* Skip assoc data */
         append_seq_fifo_store(desc, 0, FIFOST_TYPE_SKIP | FIFOLDST_VLF);
@@ -562,6 +568,14 @@ skip_enc:
         append_seq_fifo_load(desc, 0, FIFOLD_CLASS_CLASS2 | FIFOLD_TYPE_MSG |
                              KEY_VLF);
 
+        if (alg->caam.geniv) {
+                append_seq_load(desc, ivsize, LDST_CLASS_1_CCB |
+                                LDST_SRCDST_BYTE_CONTEXT |
+                                (ctx1_iv_off << LDST_OFFSET_SHIFT));
+                append_move(desc, MOVE_SRC_CLASS1CTX | MOVE_DEST_CLASS2INFIFO |
+                            (ctx1_iv_off << MOVE_OFFSET_SHIFT) | ivsize);
+        }
+
         /* Load Counter into CONTEXT1 reg */
         if (is_rfc3686)
                 append_load_imm_u32(desc, be32_to_cpu(1), LDST_IMM |
@@ -614,7 +628,7 @@ skip_enc:
                 keys_fit_inline = true;
 
         /* aead_givencrypt shared descriptor */
-        desc = ctx->sh_desc_givenc;
+        desc = ctx->sh_desc_enc;
 
         /* Note: Context registers are saved. */
         init_sh_desc_key_aead(desc, ctx, keys_fit_inline, is_rfc3686);
@@ -645,13 +659,13 @@ copy_iv:
         append_operation(desc, ctx->class2_alg_type |
                          OP_ALG_AS_INITFINAL | OP_ALG_ENCRYPT);
 
-        /* ivsize + cryptlen = seqoutlen - authsize */
-        append_math_sub_imm_u32(desc, REG3, SEQOUTLEN, IMM, ctx->authsize);
-
         /* Read and write assoclen bytes */
         append_math_add(desc, VARSEQINLEN, ZERO, REG3, CAAM_CMD_SZ);
         append_math_add(desc, VARSEQOUTLEN, ZERO, REG3, CAAM_CMD_SZ);
 
+        /* ivsize + cryptlen = seqoutlen - authsize */
+        append_math_sub_imm_u32(desc, REG3, SEQOUTLEN, IMM, ctx->authsize);
+
         /* Skip assoc data */
         append_seq_fifo_store(desc, 0, FIFOST_TYPE_SKIP | FIFOLDST_VLF);
 
@@ -697,7 +711,7 @@ copy_iv:
         ctx->sh_desc_enc_dma = dma_map_single(jrdev, desc,
                                               desc_bytes(desc),
                                               DMA_TO_DEVICE);
-        if (dma_mapping_error(jrdev, ctx->sh_desc_givenc_dma)) {
+        if (dma_mapping_error(jrdev, ctx->sh_desc_enc_dma)) {
                 dev_err(jrdev, "unable to map shared descriptor\n");
                 return -ENOMEM;
         }
@@ -2147,7 +2161,7 @@ static void init_authenc_job(struct aead_request *req,
 
         init_aead_job(req, edesc, all_contig, encrypt);
 
-        if (ivsize && (is_rfc3686 || !(alg->caam.geniv && encrypt)))
+        if (ivsize && ((is_rfc3686 && encrypt) || !alg->caam.geniv))
                 append_load_as_imm(desc, req->iv, ivsize,
                                    LDST_CLASS_1_CCB |
                                    LDST_SRCDST_BYTE_CONTEXT |
@@ -2534,20 +2548,6 @@ static int aead_decrypt(struct aead_request *req)
         return ret;
 }
 
-static int aead_givdecrypt(struct aead_request *req)
-{
-        struct crypto_aead *aead = crypto_aead_reqtfm(req);
-        unsigned int ivsize = crypto_aead_ivsize(aead);
-
-        if (req->cryptlen < ivsize)
-                return -EINVAL;
-
-        req->cryptlen -= ivsize;
-        req->assoclen += ivsize;
-
-        return aead_decrypt(req);
-}
-
 /*
  * allocate and map the ablkcipher extended descriptor for ablkcipher
  */
@@ -3207,7 +3207,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = AES_BLOCK_SIZE,
                         .maxauthsize = MD5_DIGEST_SIZE,
                 },
@@ -3253,7 +3253,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = AES_BLOCK_SIZE,
                         .maxauthsize = SHA1_DIGEST_SIZE,
                 },
@@ -3299,7 +3299,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = AES_BLOCK_SIZE,
                         .maxauthsize = SHA224_DIGEST_SIZE,
                 },
@@ -3345,7 +3345,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = AES_BLOCK_SIZE,
                         .maxauthsize = SHA256_DIGEST_SIZE,
                 },
@@ -3391,7 +3391,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = AES_BLOCK_SIZE,
                         .maxauthsize = SHA384_DIGEST_SIZE,
                 },
@@ -3437,7 +3437,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = AES_BLOCK_SIZE,
                         .maxauthsize = SHA512_DIGEST_SIZE,
                 },
@@ -3483,7 +3483,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = DES3_EDE_BLOCK_SIZE,
                         .maxauthsize = MD5_DIGEST_SIZE,
                 },
@@ -3531,7 +3531,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = DES3_EDE_BLOCK_SIZE,
                         .maxauthsize = SHA1_DIGEST_SIZE,
                 },
@@ -3579,7 +3579,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = DES3_EDE_BLOCK_SIZE,
                         .maxauthsize = SHA224_DIGEST_SIZE,
                 },
@@ -3627,7 +3627,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = DES3_EDE_BLOCK_SIZE,
                         .maxauthsize = SHA256_DIGEST_SIZE,
                 },
@@ -3675,7 +3675,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = DES3_EDE_BLOCK_SIZE,
                         .maxauthsize = SHA384_DIGEST_SIZE,
                 },
@@ -3723,7 +3723,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = DES3_EDE_BLOCK_SIZE,
                         .maxauthsize = SHA512_DIGEST_SIZE,
                 },
@@ -3769,7 +3769,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = DES_BLOCK_SIZE,
                         .maxauthsize = MD5_DIGEST_SIZE,
                 },
@@ -3815,7 +3815,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = DES_BLOCK_SIZE,
                         .maxauthsize = SHA1_DIGEST_SIZE,
                 },
@@ -3861,7 +3861,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = DES_BLOCK_SIZE,
                         .maxauthsize = SHA224_DIGEST_SIZE,
                 },
@@ -3907,7 +3907,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = DES_BLOCK_SIZE,
                         .maxauthsize = SHA256_DIGEST_SIZE,
                 },
@@ -3953,7 +3953,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = DES_BLOCK_SIZE,
                         .maxauthsize = SHA384_DIGEST_SIZE,
                 },
@@ -3999,7 +3999,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = DES_BLOCK_SIZE,
                         .maxauthsize = SHA512_DIGEST_SIZE,
                 },
@@ -4048,7 +4048,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = CTR_RFC3686_IV_SIZE,
                         .maxauthsize = MD5_DIGEST_SIZE,
                 },
@@ -4099,7 +4099,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = CTR_RFC3686_IV_SIZE,
                         .maxauthsize = SHA1_DIGEST_SIZE,
                 },
@@ -4150,7 +4150,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = CTR_RFC3686_IV_SIZE,
                         .maxauthsize = SHA224_DIGEST_SIZE,
                 },
@@ -4201,7 +4201,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = CTR_RFC3686_IV_SIZE,
                         .maxauthsize = SHA256_DIGEST_SIZE,
                 },
@@ -4252,7 +4252,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = CTR_RFC3686_IV_SIZE,
                         .maxauthsize = SHA384_DIGEST_SIZE,
                 },
@@ -4303,7 +4303,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = CTR_RFC3686_IV_SIZE,
                         .maxauthsize = SHA512_DIGEST_SIZE,
                 },
diff --git a/drivers/crypto/caam/caamhash.c b/drivers/crypto/caam/caamhash.c
index f1ecc8df8d41..36365b3efdfd 100644
--- a/drivers/crypto/caam/caamhash.c
+++ b/drivers/crypto/caam/caamhash.c
@@ -1898,6 +1898,7 @@ caam_hash_alloc(struct caam_hash_template *template,
                          template->name);
                 snprintf(alg->cra_driver_name, CRYPTO_MAX_ALG_NAME, "%s",
                          template->driver_name);
+                t_alg->ahash_alg.setkey = NULL;
         }
         alg->cra_module = THIS_MODULE;
         alg->cra_init = caam_hash_cra_init;
diff --git a/drivers/crypto/qat/qat_common/qat_algs.c b/drivers/crypto/qat/qat_common/qat_algs.c
index 769148dbaeb3..20f35df8a01f 100644
--- a/drivers/crypto/qat/qat_common/qat_algs.c
+++ b/drivers/crypto/qat/qat_common/qat_algs.c
@@ -1260,8 +1260,8 @@ static struct crypto_alg qat_algs[] = { {
                         .setkey = qat_alg_ablkcipher_xts_setkey,
                         .decrypt = qat_alg_ablkcipher_decrypt,
                         .encrypt = qat_alg_ablkcipher_encrypt,
-                        .min_keysize = AES_MIN_KEY_SIZE,
-                        .max_keysize = AES_MAX_KEY_SIZE,
+                        .min_keysize = 2 * AES_MIN_KEY_SIZE,
+                        .max_keysize = 2 * AES_MAX_KEY_SIZE,
                         .ivsize = AES_BLOCK_SIZE,
                 },
         },
diff --git a/drivers/crypto/vmx/aes_xts.c b/drivers/crypto/vmx/aes_xts.c
index cfb25413917c..24353ec336c5 100644
--- a/drivers/crypto/vmx/aes_xts.c
+++ b/drivers/crypto/vmx/aes_xts.c
@@ -129,8 +129,8 @@ static int p8_aes_xts_crypt(struct blkcipher_desc *desc,
 
                 blkcipher_walk_init(&walk, dst, src, nbytes);
 
-                iv = (u8 *)walk.iv;
                 ret = blkcipher_walk_virt(desc, &walk);
+                iv = walk.iv;
                 memset(tweak, 0, AES_BLOCK_SIZE);
                 aes_p8_encrypt(iv, tweak, &ctx->tweak_key);
 
diff --git a/drivers/dax/dax.c b/drivers/dax/dax.c
index 803f3953b341..29f600f2c447 100644
--- a/drivers/dax/dax.c
+++ b/drivers/dax/dax.c
@@ -459,7 +459,7 @@ static int __dax_dev_pmd_fault(struct dax_dev *dax_dev,
         }
 
         pgoff = linear_page_index(vma, pmd_addr);
-        phys = pgoff_to_phys(dax_dev, pgoff, PAGE_SIZE);
+        phys = pgoff_to_phys(dax_dev, pgoff, PMD_SIZE);
         if (phys == -1) {
                 dev_dbg(dev, "%s: phys_to_pgoff(%#lx) failed\n", __func__,
                                 pgoff);
diff --git a/drivers/dax/pmem.c b/drivers/dax/pmem.c
index dfb168568af1..1f01e98c83c7 100644
--- a/drivers/dax/pmem.c
+++ b/drivers/dax/pmem.c
@@ -116,6 +116,9 @@ static int dax_pmem_probe(struct device *dev)
         if (rc)
                 return rc;
 
+        /* adjust the dax_region resource to the start of data */
+        res.start += le64_to_cpu(pfn_sb->dataoff);
+
         nd_region = to_nd_region(dev->parent);
         dax_region = alloc_dax_region(dev, nd_region->id, &res,
                         le32_to_cpu(pfn_sb->align), addr, PFN_DEV|PFN_MAP);
diff --git a/drivers/dma/at_xdmac.c b/drivers/dma/at_xdmac.c
index e434ffe7bc5c..832cbd647145 100644
--- a/drivers/dma/at_xdmac.c
+++ b/drivers/dma/at_xdmac.c
@@ -2067,7 +2067,7 @@ err_dma_unregister:
 err_clk_disable:
         clk_disable_unprepare(atxdmac->clk);
 err_free_irq:
-        free_irq(atxdmac->irq, atxdmac->dma.dev);
+        free_irq(atxdmac->irq, atxdmac);
         return ret;
 }
 
@@ -2081,7 +2081,7 @@ static int at_xdmac_remove(struct platform_device *pdev)
         dma_async_device_unregister(&atxdmac->dma);
         clk_disable_unprepare(atxdmac->clk);
 
-        free_irq(atxdmac->irq, atxdmac->dma.dev);
+        free_irq(atxdmac->irq, atxdmac);
 
         for (i = 0; i < atxdmac->dma.chancnt; i++) {
                 struct at_xdmac_chan *atchan = &atxdmac->chan[i];
diff --git a/drivers/dma/fsl_raid.c b/drivers/dma/fsl_raid.c
index aad167eaaee8..de2a2a2b1d75 100644
--- a/drivers/dma/fsl_raid.c
+++ b/drivers/dma/fsl_raid.c
@@ -836,6 +836,7 @@ static int fsl_re_probe(struct platform_device *ofdev)
                 rc = of_property_read_u32(np, "reg", &off);
                 if (rc) {
                         dev_err(dev, "Reg property not found in JQ node\n");
+                        of_node_put(np);
                         return -ENODEV;
                 }
                 /* Find out the Job Rings present under each JQ */
diff --git a/drivers/dma/img-mdc-dma.c b/drivers/dma/img-mdc-dma.c
index a4c53be482cf..624f1e1e9c55 100644
--- a/drivers/dma/img-mdc-dma.c
+++ b/drivers/dma/img-mdc-dma.c
@@ -861,7 +861,6 @@ static int mdc_dma_probe(struct platform_device *pdev)
 {
         struct mdc_dma *mdma;
         struct resource *res;
-        const struct of_device_id *match;
         unsigned int i;
         u32 val;
         int ret;
@@ -871,8 +870,7 @@ static int mdc_dma_probe(struct platform_device *pdev)
                 return -ENOMEM;
         platform_set_drvdata(pdev, mdma);
 
-        match = of_match_device(mdc_dma_of_match, &pdev->dev);
-        mdma->soc = match->data;
+        mdma->soc = of_device_get_match_data(&pdev->dev);
 
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         mdma->regs = devm_ioremap_resource(&pdev->dev, res);
diff --git a/drivers/dma/pxa_dma.c b/drivers/dma/pxa_dma.c
index dc7850a422b8..3f56f9ca4482 100644
--- a/drivers/dma/pxa_dma.c
+++ b/drivers/dma/pxa_dma.c
@@ -638,7 +638,7 @@ static bool pxad_try_hotchain(struct virt_dma_chan *vc,
                 vd_last_issued = list_entry(vc->desc_issued.prev,
                                             struct virt_dma_desc, node);
                 pxad_desc_chain(vd_last_issued, vd);
-                if (is_chan_running(chan) || is_desc_completed(vd_last_issued))
+                if (is_chan_running(chan) || is_desc_completed(vd))
                         return true;
         }
 
@@ -671,6 +671,7 @@ static irqreturn_t pxad_chan_handler(int irq, void *dev_id)
         struct virt_dma_desc *vd, *tmp;
         unsigned int dcsr;
         unsigned long flags;
+        bool vd_completed;
         dma_cookie_t last_started = 0;
 
         BUG_ON(!chan);
@@ -681,15 +682,17 @@ static irqreturn_t pxad_chan_handler(int irq, void *dev_id)
 
         spin_lock_irqsave(&chan->vc.lock, flags);
         list_for_each_entry_safe(vd, tmp, &chan->vc.desc_issued, node) {
+                vd_completed = is_desc_completed(vd);
                 dev_dbg(&chan->vc.chan.dev->device,
-                        "%s(): checking txd %p[%x]: completed=%d\n",
-                        __func__, vd, vd->tx.cookie, is_desc_completed(vd));
+                        "%s(): checking txd %p[%x]: completed=%d dcsr=0x%x\n",
+                        __func__, vd, vd->tx.cookie, vd_completed,
+                        dcsr);
                 last_started = vd->tx.cookie;
                 if (to_pxad_sw_desc(vd)->cyclic) {
                         vchan_cyclic_callback(vd);
                         break;
                 }
-                if (is_desc_completed(vd)) {
+                if (vd_completed) {
                         list_del(&vd->node);
                         vchan_cookie_complete(vd);
                 } else {
diff --git a/drivers/dma/sh/usb-dmac.c b/drivers/dma/sh/usb-dmac.c
index 749f1bd5d65d..06ecdc38cee0 100644
--- a/drivers/dma/sh/usb-dmac.c
+++ b/drivers/dma/sh/usb-dmac.c
@@ -600,27 +600,30 @@ static irqreturn_t usb_dmac_isr_channel(int irq, void *dev)
 {
         struct usb_dmac_chan *chan = dev;
         irqreturn_t ret = IRQ_NONE;
-        u32 mask = USB_DMACHCR_TE;
-        u32 check_bits = USB_DMACHCR_TE | USB_DMACHCR_SP;
+        u32 mask = 0;
         u32 chcr;
+        bool xfer_end = false;
 
         spin_lock(&chan->vc.lock);
 
         chcr = usb_dmac_chan_read(chan, USB_DMACHCR);
-        if (chcr & check_bits)
-                mask |= USB_DMACHCR_DE | check_bits;
+        if (chcr & (USB_DMACHCR_TE | USB_DMACHCR_SP)) {
+                mask |= USB_DMACHCR_DE | USB_DMACHCR_TE | USB_DMACHCR_SP;
+                if (chcr & USB_DMACHCR_DE)
+                        xfer_end = true;
+                ret |= IRQ_HANDLED;
+        }
         if (chcr & USB_DMACHCR_NULL) {
                 /* An interruption of TE will happen after we set FTE */
                 mask |= USB_DMACHCR_NULL;
                 chcr |= USB_DMACHCR_FTE;
                 ret |= IRQ_HANDLED;
         }
-        usb_dmac_chan_write(chan, USB_DMACHCR, chcr & ~mask);
+        if (mask)
+                usb_dmac_chan_write(chan, USB_DMACHCR, chcr & ~mask);
 
-        if (chcr & check_bits) {
+        if (xfer_end)
                 usb_dmac_isr_transfer_end(chan);
-                ret |= IRQ_HANDLED;
-        }
 
         spin_unlock(&chan->vc.lock);
 
diff --git a/drivers/edac/Kconfig b/drivers/edac/Kconfig
index d0c1dab9b435..dff1a4a6dc1b 100644
--- a/drivers/edac/Kconfig
+++ b/drivers/edac/Kconfig
@@ -251,6 +251,14 @@ config EDAC_SBRIDGE
           Support for error detection and correction the Intel
           Sandy Bridge, Ivy Bridge and Haswell Integrated Memory Controllers.
 
+config EDAC_SKX
+        tristate "Intel Skylake server Integrated MC"
+        depends on EDAC_MM_EDAC && PCI && X86_64 && X86_MCE_INTEL
+        depends on PCI_MMCONFIG
+        help
+          Support for error detection and correction the Intel
+          Skylake server Integrated Memory Controllers.
+
 config EDAC_MPC85XX
         tristate "Freescale MPC83xx / MPC85xx"
         depends on EDAC_MM_EDAC && FSL_SOC
diff --git a/drivers/edac/Makefile b/drivers/edac/Makefile
index f9e4a3e0e6e9..986049925b08 100644
--- a/drivers/edac/Makefile
+++ b/drivers/edac/Makefile
@@ -31,6 +31,7 @@ obj-$(CONFIG_EDAC_I5400)		+= i5400_edac.o
 obj-$(CONFIG_EDAC_I7300)                += i7300_edac.o
 obj-$(CONFIG_EDAC_I7CORE)               += i7core_edac.o
 obj-$(CONFIG_EDAC_SBRIDGE)              += sb_edac.o
+obj-$(CONFIG_EDAC_SKX)                  += skx_edac.o
 obj-$(CONFIG_EDAC_E7XXX)                += e7xxx_edac.o
 obj-$(CONFIG_EDAC_E752X)                += e752x_edac.o
 obj-$(CONFIG_EDAC_I82443BXGX)           += i82443bxgx_edac.o
diff --git a/drivers/edac/sb_edac.c b/drivers/edac/sb_edac.c
index 4fb2eb7c800d..ce0067b7a2f6 100644
--- a/drivers/edac/sb_edac.c
+++ b/drivers/edac/sb_edac.c
@@ -552,9 +552,9 @@ static const struct pci_id_table pci_dev_descr_haswell_table[] = {
 /* Knight's Landing Support */
 /*
  * KNL's memory channels are swizzled between memory controllers.
- * MC0 is mapped to CH3,5,6 and MC1 is mapped to CH0,1,2
+ * MC0 is mapped to CH3,4,5 and MC1 is mapped to CH0,1,2
  */
-#define knl_channel_remap(channel) ((channel + 3) % 6)
+#define knl_channel_remap(mc, chan) ((mc) ? (chan) : (chan) + 3)
 
 /* Memory controller, TAD tables, error injection - 2-8-0, 2-9-0 (2 of these) */
 #define PCI_DEVICE_ID_INTEL_KNL_IMC_MC       0x7840
@@ -1286,7 +1286,7 @@ static u32 knl_get_mc_route(int entry, u32 reg)
         mc = GET_BITFIELD(reg, entry*3, (entry*3)+2);
         chan = GET_BITFIELD(reg, (entry*2) + 18, (entry*2) + 18 + 1);
 
-        return knl_channel_remap(mc*3 + chan);
+        return knl_channel_remap(mc, chan);
 }
 
 /*
@@ -2997,8 +2997,15 @@ static void sbridge_mce_output_error(struct mem_ctl_info *mci,
                 } else {
                         char A = *("A");
 
-                        channel = knl_channel_remap(channel);
+                        /*
+                         * Reported channel is in range 0-2, so we can't map it
+                         * back to mc. To figure out mc we check machine check
+                         * bank register that reported this error.
+                         * bank15 means mc0 and bank16 means mc1.
+                         */
+                        channel = knl_channel_remap(m->bank == 16, channel);
                         channel_mask = 1 << channel;
+
                         snprintf(msg, sizeof(msg),
                                 "%s%s err_code:%04x:%04x channel:%d (DIMM_%c)",
                                 overflow ? " OVERFLOW" : "",
diff --git a/drivers/edac/skx_edac.c b/drivers/edac/skx_edac.c
new file mode 100644
index 000000000000..0ff4878c2aa1
--- /dev/null
+++ b/drivers/edac/skx_edac.c
@@ -0,0 +1,1121 @@
+/*
+ * EDAC driver for Intel(R) Xeon(R) Skylake processors
+ * Copyright (c) 2016, Intel Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ */
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/pci.h>
+#include <linux/pci_ids.h>
+#include <linux/slab.h>
+#include <linux/delay.h>
+#include <linux/edac.h>
+#include <linux/mmzone.h>
+#include <linux/smp.h>
+#include <linux/bitmap.h>
+#include <linux/math64.h>
+#include <linux/mod_devicetable.h>
+#include <asm/cpu_device_id.h>
+#include <asm/processor.h>
+#include <asm/mce.h>
+
+#include "edac_core.h"
+
+#define SKX_REVISION    " Ver: 1.0 "
+
+/*
+ * Debug macros
+ */
+#define skx_printk(level, fmt, arg...)                  \
+        edac_printk(level, "skx", fmt, ##arg)
+
+#define skx_mc_printk(mci, level, fmt, arg...)          \
+        edac_mc_chipset_printk(mci, level, "skx", fmt, ##arg)
+
+/*
+ * Get a bit field at register value <v>, from bit <lo> to bit <hi>
+ */
+#define GET_BITFIELD(v, lo, hi) \
+        (((v) & GENMASK_ULL((hi), (lo))) >> (lo))
+
+static LIST_HEAD(skx_edac_list);
+
+static u64 skx_tolm, skx_tohm;
+
+#define NUM_IMC                 2       /* memory controllers per socket */
+#define NUM_CHANNELS            3       /* channels per memory controller */
+#define NUM_DIMMS               2       /* Max DIMMS per channel */
+
+#define MASK26  0x3FFFFFF               /* Mask for 2^26 */
+#define MASK29  0x1FFFFFFF              /* Mask for 2^29 */
+
+/*
+ * Each cpu socket contains some pci devices that provide global
+ * information, and also some that are local to each of the two
+ * memory controllers on the die.
+ */
+struct skx_dev {
+        struct list_head        list;
+        u8                      bus[4];
+        struct pci_dev  *sad_all;
+        struct pci_dev  *util_all;
+        u32     mcroute;
+        struct skx_imc {
+                struct mem_ctl_info *mci;
+                u8      mc;     /* system wide mc# */
+                u8      lmc;    /* socket relative mc# */
+                u8      src_id, node_id;
+                struct skx_channel {
+                        struct pci_dev *cdev;
+                        struct skx_dimm {
+                                u8      close_pg;
+                                u8      bank_xor_enable;
+                                u8      fine_grain_bank;
+                                u8      rowbits;
+                                u8      colbits;
+                        } dimms[NUM_DIMMS];
+                } chan[NUM_CHANNELS];
+        } imc[NUM_IMC];
+};
+static int skx_num_sockets;
+
+struct skx_pvt {
+        struct skx_imc  *imc;
+};
+
+struct decoded_addr {
+        struct skx_dev *dev;
+        u64     addr;
+        int     socket;
+        int     imc;
+        int     channel;
+        u64     chan_addr;
+        int     sktways;
+        int     chanways;
+        int     dimm;
+        int     rank;
+        int     channel_rank;
+        u64     rank_address;
+        int     row;
+        int     column;
+        int     bank_address;
+        int     bank_group;
+};
+
+static struct skx_dev *get_skx_dev(u8 bus, u8 idx)
+{
+        struct skx_dev *d;
+
+        list_for_each_entry(d, &skx_edac_list, list) {
+                if (d->bus[idx] == bus)
+                        return d;
+        }
+
+        return NULL;
+}
+
+enum munittype {
+        CHAN0, CHAN1, CHAN2, SAD_ALL, UTIL_ALL, SAD
+};
+
+struct munit {
+        u16     did;
+        u16     devfn[NUM_IMC];
+        u8      busidx;
+        u8      per_socket;
+        enum munittype mtype;
+};
+
+/*
+ * List of PCI device ids that we need together with some device
+ * number and function numbers to tell which memory controller the
+ * device belongs to.
+ */
+static const struct munit skx_all_munits[] = {
+        { 0x2054, { }, 1, 1, SAD_ALL },
+        { 0x2055, { }, 1, 1, UTIL_ALL },
+        { 0x2040, { PCI_DEVFN(10, 0), PCI_DEVFN(12, 0) }, 2, 2, CHAN0 },
+        { 0x2044, { PCI_DEVFN(10, 4), PCI_DEVFN(12, 4) }, 2, 2, CHAN1 },
+        { 0x2048, { PCI_DEVFN(11, 0), PCI_DEVFN(13, 0) }, 2, 2, CHAN2 },
+        { 0x208e, { }, 1, 0, SAD },
+        { }
+};
+
+/*
+ * We use the per-socket device 0x2016 to count how many sockets are present,
+ * and to detemine which PCI buses are associated with each socket. Allocate
+ * and build the full list of all the skx_dev structures that we need here.
+ */
+static int get_all_bus_mappings(void)
+{
+        struct pci_dev *pdev, *prev;
+        struct skx_dev *d;
+        u32 reg;
+        int ndev = 0;
+
+        prev = NULL;
+        for (;;) {
+                pdev = pci_get_device(PCI_VENDOR_ID_INTEL, 0x2016, prev);
+                if (!pdev)
+                        break;
+                ndev++;
+                d = kzalloc(sizeof(*d), GFP_KERNEL);
+                if (!d) {
+                        pci_dev_put(pdev);
+                        return -ENOMEM;
+                }
+                pci_read_config_dword(pdev, 0xCC, &reg);
+                d->bus[0] =  GET_BITFIELD(reg, 0, 7);
+                d->bus[1] =  GET_BITFIELD(reg, 8, 15);
+                d->bus[2] =  GET_BITFIELD(reg, 16, 23);
+                d->bus[3] =  GET_BITFIELD(reg, 24, 31);
+                edac_dbg(2, "busses: %x, %x, %x, %x\n",
+                         d->bus[0], d->bus[1], d->bus[2], d->bus[3]);
+                list_add_tail(&d->list, &skx_edac_list);
+                skx_num_sockets++;
+                prev = pdev;
+        }
+
+        return ndev;
+}
+
+static int get_all_munits(const struct munit *m)
+{
+        struct pci_dev *pdev, *prev;
+        struct skx_dev *d;
+        u32 reg;
+        int i = 0, ndev = 0;
+
+        prev = NULL;
+        for (;;) {
+                pdev = pci_get_device(PCI_VENDOR_ID_INTEL, m->did, prev);
+                if (!pdev)
+                        break;
+                ndev++;
+                if (m->per_socket == NUM_IMC) {
+                        for (i = 0; i < NUM_IMC; i++)
+                                if (m->devfn[i] == pdev->devfn)
+                                        break;
+                        if (i == NUM_IMC)
+                                goto fail;
+                }
+                d = get_skx_dev(pdev->bus->number, m->busidx);
+                if (!d)
+                        goto fail;
+
+                /* Be sure that the device is enabled */
+                if (unlikely(pci_enable_device(pdev) < 0)) {
+                        skx_printk(KERN_ERR,
+                                "Couldn't enable %04x:%04x\n", PCI_VENDOR_ID_INTEL, m->did);
+                        goto fail;
+                }
+
+                switch (m->mtype) {
+                case CHAN0: case CHAN1: case CHAN2:
+                        pci_dev_get(pdev);
+                        d->imc[i].chan[m->mtype].cdev = pdev;
+                        break;
+                case SAD_ALL:
+                        pci_dev_get(pdev);
+                        d->sad_all = pdev;
+                        break;
+                case UTIL_ALL:
+                        pci_dev_get(pdev);
+                        d->util_all = pdev;
+                        break;
+                case SAD:
+                        /*
+                         * one of these devices per core, including cores
+                         * that don't exist on this SKU. Ignore any that
+                         * read a route table of zero, make sure all the
+                         * non-zero values match.
+                         */
+                        pci_read_config_dword(pdev, 0xB4, &reg);
+                        if (reg != 0) {
+                                if (d->mcroute == 0)
+                                        d->mcroute = reg;
+                                else if (d->mcroute != reg) {
+                                        skx_printk(KERN_ERR,
+                                                "mcroute mismatch\n");
+                                        goto fail;
+                                }
+                        }
+                        ndev--;
+                        break;
+                }
+
+                prev = pdev;
+        }
+
+        return ndev;
+fail:
+        pci_dev_put(pdev);
+        return -ENODEV;
+}
+
+const struct x86_cpu_id skx_cpuids[] = {
+        { X86_VENDOR_INTEL, 6, 0x55, 0, 0 },    /* Skylake */
+        { }
+};
+MODULE_DEVICE_TABLE(x86cpu, skx_cpuids);
+
+static u8 get_src_id(struct skx_dev *d)
+{
+        u32 reg;
+
+        pci_read_config_dword(d->util_all, 0xF0, &reg);
+
+        return GET_BITFIELD(reg, 12, 14);
+}
+
+static u8 skx_get_node_id(struct skx_dev *d)
+{
+        u32 reg;
+
+        pci_read_config_dword(d->util_all, 0xF4, &reg);
+
+        return GET_BITFIELD(reg, 0, 2);
+}
+
+static int get_dimm_attr(u32 reg, int lobit, int hibit, int add, int minval,
+                         int maxval, char *name)
+{
+        u32 val = GET_BITFIELD(reg, lobit, hibit);
+
+        if (val < minval || val > maxval) {
+                edac_dbg(2, "bad %s = %d (raw=%x)\n", name, val, reg);
+                return -EINVAL;
+        }
+        return val + add;
+}
+
+#define IS_DIMM_PRESENT(mtr)            GET_BITFIELD((mtr), 15, 15)
+
+#define numrank(reg) get_dimm_attr((reg), 12, 13, 0, 1, 2, "ranks")
+#define numrow(reg) get_dimm_attr((reg), 2, 4, 12, 1, 6, "rows")
+#define numcol(reg) get_dimm_attr((reg), 0, 1, 10, 0, 2, "cols")
+
+static int get_width(u32 mtr)
+{
+        switch (GET_BITFIELD(mtr, 8, 9)) {
+        case 0:
+                return DEV_X4;
+        case 1:
+                return DEV_X8;
+        case 2:
+                return DEV_X16;
+        }
+        return DEV_UNKNOWN;
+}
+
+static int skx_get_hi_lo(void)
+{
+        struct pci_dev *pdev;
+        u32 reg;
+
+        pdev = pci_get_device(PCI_VENDOR_ID_INTEL, 0x2034, NULL);
+        if (!pdev) {
+                edac_dbg(0, "Can't get tolm/tohm\n");
+                return -ENODEV;
+        }
+
+        pci_read_config_dword(pdev, 0xD0, &reg);
+        skx_tolm = reg;
+        pci_read_config_dword(pdev, 0xD4, &reg);
+        skx_tohm = reg;
+        pci_read_config_dword(pdev, 0xD8, &reg);
+        skx_tohm |= (u64)reg << 32;
+
+        pci_dev_put(pdev);
+        edac_dbg(2, "tolm=%llx tohm=%llx\n", skx_tolm, skx_tohm);
+
+        return 0;
+}
+
+static int get_dimm_info(u32 mtr, u32 amap, struct dimm_info *dimm,
+                         struct skx_imc *imc, int chan, int dimmno)
+{
+        int  banks = 16, ranks, rows, cols, npages;
+        u64 size;
+
+        if (!IS_DIMM_PRESENT(mtr))
+                return 0;
+        ranks = numrank(mtr);
+        rows = numrow(mtr);
+        cols = numcol(mtr);
+
+        /*
+         * Compute size in 8-byte (2^3) words, then shift to MiB (2^20)
+         */
+        size = ((1ull << (rows + cols + ranks)) * banks) >> (20 - 3);
+        npages = MiB_TO_PAGES(size);
+
+        edac_dbg(0, "mc#%d: channel %d, dimm %d, %lld Mb (%d pages) bank: %d, rank: %d, row: %#x, col: %#x\n",
+                 imc->mc, chan, dimmno, size, npages,
+                 banks, ranks, rows, cols);
+
+        imc->chan[chan].dimms[dimmno].close_pg = GET_BITFIELD(mtr, 0, 0);
+        imc->chan[chan].dimms[dimmno].bank_xor_enable = GET_BITFIELD(mtr, 9, 9);
+        imc->chan[chan].dimms[dimmno].fine_grain_bank = GET_BITFIELD(amap, 0, 0);
+        imc->chan[chan].dimms[dimmno].rowbits = rows;
+        imc->chan[chan].dimms[dimmno].colbits = cols;
+
+        dimm->nr_pages = npages;
+        dimm->grain = 32;
+        dimm->dtype = get_width(mtr);
+        dimm->mtype = MEM_DDR4;
+        dimm->edac_mode = EDAC_SECDED; /* likely better than this */
+        snprintf(dimm->label, sizeof(dimm->label), "CPU_SrcID#%u_MC#%u_Chan#%u_DIMM#%u",
+                 imc->src_id, imc->lmc, chan, dimmno);
+
+        return 1;
+}
+
+#define SKX_GET_MTMTR(dev, reg) \
+        pci_read_config_dword((dev), 0x87c, &reg)
+
+static bool skx_check_ecc(struct pci_dev *pdev)
+{
+        u32 mtmtr;
+
+        SKX_GET_MTMTR(pdev, mtmtr);
+
+        return !!GET_BITFIELD(mtmtr, 2, 2);
+}
+
+static int skx_get_dimm_config(struct mem_ctl_info *mci)
+{
+        struct skx_pvt *pvt = mci->pvt_info;
+        struct skx_imc *imc = pvt->imc;
+        struct dimm_info *dimm;
+        int i, j;
+        u32 mtr, amap;
+        int ndimms;
+
+        for (i = 0; i < NUM_CHANNELS; i++) {
+                ndimms = 0;
+                pci_read_config_dword(imc->chan[i].cdev, 0x8C, &amap);
+                for (j = 0; j < NUM_DIMMS; j++) {
+                        dimm = EDAC_DIMM_PTR(mci->layers, mci->dimms,
+                                             mci->n_layers, i, j, 0);
+                        pci_read_config_dword(imc->chan[i].cdev,
+                                        0x80 + 4*j, &mtr);
+                        ndimms += get_dimm_info(mtr, amap, dimm, imc, i, j);
+                }
+                if (ndimms && !skx_check_ecc(imc->chan[0].cdev)) {
+                        skx_printk(KERN_ERR, "ECC is disabled on imc %d\n", imc->mc);
+                        return -ENODEV;
+                }
+        }
+
+        return 0;
+}
+
+static void skx_unregister_mci(struct skx_imc *imc)
+{
+        struct mem_ctl_info *mci = imc->mci;
+
+        if (!mci)
+                return;
+
+        edac_dbg(0, "MC%d: mci = %p\n", imc->mc, mci);
+
+        /* Remove MC sysfs nodes */
+        edac_mc_del_mc(mci->pdev);
+
+        edac_dbg(1, "%s: free mci struct\n", mci->ctl_name);
+        kfree(mci->ctl_name);
+        edac_mc_free(mci);
+}
+
+static int skx_register_mci(struct skx_imc *imc)
+{
+        struct mem_ctl_info *mci;
+        struct edac_mc_layer layers[2];
+        struct pci_dev *pdev = imc->chan[0].cdev;
+        struct skx_pvt *pvt;
+        int rc;
+
+        /* allocate a new MC control structure */
+        layers[0].type = EDAC_MC_LAYER_CHANNEL;
+        layers[0].size = NUM_CHANNELS;
+        layers[0].is_virt_csrow = false;
+        layers[1].type = EDAC_MC_LAYER_SLOT;
+        layers[1].size = NUM_DIMMS;
+        layers[1].is_virt_csrow = true;
+        mci = edac_mc_alloc(imc->mc, ARRAY_SIZE(layers), layers,
+                            sizeof(struct skx_pvt));
+
+        if (unlikely(!mci))
+                return -ENOMEM;
+
+        edac_dbg(0, "MC#%d: mci = %p\n", imc->mc, mci);
+
+        /* Associate skx_dev and mci for future usage */
+        imc->mci = mci;
+        pvt = mci->pvt_info;
+        pvt->imc = imc;
+
+        mci->ctl_name = kasprintf(GFP_KERNEL, "Skylake Socket#%d IMC#%d",
+                                  imc->node_id, imc->lmc);
+        mci->mtype_cap = MEM_FLAG_DDR4;
+        mci->edac_ctl_cap = EDAC_FLAG_NONE;
+        mci->edac_cap = EDAC_FLAG_NONE;
+        mci->mod_name = "skx_edac.c";
+        mci->dev_name = pci_name(imc->chan[0].cdev);
+        mci->mod_ver = SKX_REVISION;
+        mci->ctl_page_to_phys = NULL;
+
+        rc = skx_get_dimm_config(mci);
+        if (rc < 0)
+                goto fail;
+
+        /* record ptr to the generic device */
+        mci->pdev = &pdev->dev;
+
+        /* add this new MC control structure to EDAC's list of MCs */
+        if (unlikely(edac_mc_add_mc(mci))) {
+                edac_dbg(0, "MC: failed edac_mc_add_mc()\n");
+                rc = -EINVAL;
+                goto fail;
+        }
+
+        return 0;
+
+fail:
+        kfree(mci->ctl_name);
+        edac_mc_free(mci);
+        imc->mci = NULL;
+        return rc;
+}
+
+#define SKX_MAX_SAD 24
+
+#define SKX_GET_SAD(d, i, reg)  \
+        pci_read_config_dword((d)->sad_all, 0x60 + 8 * (i), &reg)
+#define SKX_GET_ILV(d, i, reg)  \
+        pci_read_config_dword((d)->sad_all, 0x64 + 8 * (i), &reg)
+
+#define SKX_SAD_MOD3MODE(sad)   GET_BITFIELD((sad), 30, 31)
+#define SKX_SAD_MOD3(sad)       GET_BITFIELD((sad), 27, 27)
+#define SKX_SAD_LIMIT(sad)      (((u64)GET_BITFIELD((sad), 7, 26) << 26) | MASK26)
+#define SKX_SAD_MOD3ASMOD2(sad) GET_BITFIELD((sad), 5, 6)
+#define SKX_SAD_ATTR(sad)       GET_BITFIELD((sad), 3, 4)
+#define SKX_SAD_INTERLEAVE(sad) GET_BITFIELD((sad), 1, 2)
+#define SKX_SAD_ENABLE(sad)     GET_BITFIELD((sad), 0, 0)
+
+#define SKX_ILV_REMOTE(tgt)     (((tgt) & 8) == 0)
+#define SKX_ILV_TARGET(tgt)     ((tgt) & 7)
+
+static bool skx_sad_decode(struct decoded_addr *res)
+{
+        struct skx_dev *d = list_first_entry(&skx_edac_list, typeof(*d), list);
+        u64 addr = res->addr;
+        int i, idx, tgt, lchan, shift;
+        u32 sad, ilv;
+        u64 limit, prev_limit;
+        int remote = 0;
+
+        /* Simple sanity check for I/O space or out of range */
+        if (addr >= skx_tohm || (addr >= skx_tolm && addr < BIT_ULL(32))) {
+                edac_dbg(0, "Address %llx out of range\n", addr);
+                return false;
+        }
+
+restart:
+        prev_limit = 0;
+        for (i = 0; i < SKX_MAX_SAD; i++) {
+                SKX_GET_SAD(d, i, sad);
+                limit = SKX_SAD_LIMIT(sad);
+                if (SKX_SAD_ENABLE(sad)) {
+                        if (addr >= prev_limit && addr <= limit)
+                                goto sad_found;
+                }
+                prev_limit = limit + 1;
+        }
+        edac_dbg(0, "No SAD entry for %llx\n", addr);
+        return false;
+
+sad_found:
+        SKX_GET_ILV(d, i, ilv);
+
+        switch (SKX_SAD_INTERLEAVE(sad)) {
+        case 0:
+                idx = GET_BITFIELD(addr, 6, 8);
+                break;
+        case 1:
+                idx = GET_BITFIELD(addr, 8, 10);
+                break;
+        case 2:
+                idx = GET_BITFIELD(addr, 12, 14);
+                break;
+        case 3:
+                idx = GET_BITFIELD(addr, 30, 32);
+                break;
+        }
+
+        tgt = GET_BITFIELD(ilv, 4 * idx, 4 * idx + 3);
+
+        /* If point to another node, find it and start over */
+        if (SKX_ILV_REMOTE(tgt)) {
+                if (remote) {
+                        edac_dbg(0, "Double remote!\n");
+                        return false;
+                }
+                remote = 1;
+                list_for_each_entry(d, &skx_edac_list, list) {
+                        if (d->imc[0].src_id == SKX_ILV_TARGET(tgt))
+                                goto restart;
+                }
+                edac_dbg(0, "Can't find node %d\n", SKX_ILV_TARGET(tgt));
+                return false;
+        }
+
+        if (SKX_SAD_MOD3(sad) == 0)
+                lchan = SKX_ILV_TARGET(tgt);
+        else {
+                switch (SKX_SAD_MOD3MODE(sad)) {
+                case 0:
+                        shift = 6;
+                        break;
+                case 1:
+                        shift = 8;
+                        break;
+                case 2:
+                        shift = 12;
+                        break;
+                default:
+                        edac_dbg(0, "illegal mod3mode\n");
+                        return false;
+                }
+                switch (SKX_SAD_MOD3ASMOD2(sad)) {
+                case 0:
+                        lchan = (addr >> shift) % 3;
+                        break;
+                case 1:
+                        lchan = (addr >> shift) % 2;
+                        break;
+                case 2:
+                        lchan = (addr >> shift) % 2;
+                        lchan = (lchan << 1) | ~lchan;
+                        break;
+                case 3:
+                        lchan = ((addr >> shift) % 2) << 1;
+                        break;
+                }
+                lchan = (lchan << 1) | (SKX_ILV_TARGET(tgt) & 1);
+        }
+
+        res->dev = d;
+        res->socket = d->imc[0].src_id;
+        res->imc = GET_BITFIELD(d->mcroute, lchan * 3, lchan * 3 + 2);
+        res->channel = GET_BITFIELD(d->mcroute, lchan * 2 + 18, lchan * 2 + 19);
+
+        edac_dbg(2, "%llx: socket=%d imc=%d channel=%d\n",
+                 res->addr, res->socket, res->imc, res->channel);
+        return true;
+}
+
+#define SKX_MAX_TAD 8
+
+#define SKX_GET_TADBASE(d, mc, i, reg)                  \
+        pci_read_config_dword((d)->imc[mc].chan[0].cdev, 0x850 + 4 * (i), &reg)
+#define SKX_GET_TADWAYNESS(d, mc, i, reg)               \
+        pci_read_config_dword((d)->imc[mc].chan[0].cdev, 0x880 + 4 * (i), &reg)
+#define SKX_GET_TADCHNILVOFFSET(d, mc, ch, i, reg)      \
+        pci_read_config_dword((d)->imc[mc].chan[ch].cdev, 0x90 + 4 * (i), &reg)
+
+#define SKX_TAD_BASE(b)         ((u64)GET_BITFIELD((b), 12, 31) << 26)
+#define SKX_TAD_SKT_GRAN(b)     GET_BITFIELD((b), 4, 5)
+#define SKX_TAD_CHN_GRAN(b)     GET_BITFIELD((b), 6, 7)
+#define SKX_TAD_LIMIT(b)        (((u64)GET_BITFIELD((b), 12, 31) << 26) | MASK26)
+#define SKX_TAD_OFFSET(b)       ((u64)GET_BITFIELD((b), 4, 23) << 26)
+#define SKX_TAD_SKTWAYS(b)      (1 << GET_BITFIELD((b), 10, 11))
+#define SKX_TAD_CHNWAYS(b)      (GET_BITFIELD((b), 8, 9) + 1)
+
+/* which bit used for both socket and channel interleave */
+static int skx_granularity[] = { 6, 8, 12, 30 };
+
+static u64 skx_do_interleave(u64 addr, int shift, int ways, u64 lowbits)
+{
+        addr >>= shift;
+        addr /= ways;
+        addr <<= shift;
+
+        return addr | (lowbits & ((1ull << shift) - 1));
+}
+
+static bool skx_tad_decode(struct decoded_addr *res)
+{
+        int i;
+        u32 base, wayness, chnilvoffset;
+        int skt_interleave_bit, chn_interleave_bit;
+        u64 channel_addr;
+
+        for (i = 0; i < SKX_MAX_TAD; i++) {
+                SKX_GET_TADBASE(res->dev, res->imc, i, base);
+                SKX_GET_TADWAYNESS(res->dev, res->imc, i, wayness);
+                if (SKX_TAD_BASE(base) <= res->addr && res->addr <= SKX_TAD_LIMIT(wayness))
+                        goto tad_found;
+        }
+        edac_dbg(0, "No TAD entry for %llx\n", res->addr);
+        return false;
+
+tad_found:
+        res->sktways = SKX_TAD_SKTWAYS(wayness);
+        res->chanways = SKX_TAD_CHNWAYS(wayness);
+        skt_interleave_bit = skx_granularity[SKX_TAD_SKT_GRAN(base)];
+        chn_interleave_bit = skx_granularity[SKX_TAD_CHN_GRAN(base)];
+
+        SKX_GET_TADCHNILVOFFSET(res->dev, res->imc, res->channel, i, chnilvoffset);
+        channel_addr = res->addr - SKX_TAD_OFFSET(chnilvoffset);
+
+        if (res->chanways == 3 && skt_interleave_bit > chn_interleave_bit) {
+                /* Must handle channel first, then socket */
+                channel_addr = skx_do_interleave(channel_addr, chn_interleave_bit,
+                                                 res->chanways, channel_addr);
+                channel_addr = skx_do_interleave(channel_addr, skt_interleave_bit,
+                                                 res->sktways, channel_addr);
+        } else {
+                /* Handle socket then channel. Preserve low bits from original address */
+                channel_addr = skx_do_interleave(channel_addr, skt_interleave_bit,
+                                                 res->sktways, res->addr);
+                channel_addr = skx_do_interleave(channel_addr, chn_interleave_bit,
+                                                 res->chanways, res->addr);
+        }
+
+        res->chan_addr = channel_addr;
+
+        edac_dbg(2, "%llx: chan_addr=%llx sktways=%d chanways=%d\n",
+                 res->addr, res->chan_addr, res->sktways, res->chanways);
+        return true;
+}
+
+#define SKX_MAX_RIR 4
+
+#define SKX_GET_RIRWAYNESS(d, mc, ch, i, reg)           \
+        pci_read_config_dword((d)->imc[mc].chan[ch].cdev,       \
+                              0x108 + 4 * (i), &reg)
+#define SKX_GET_RIRILV(d, mc, ch, idx, i, reg)          \
+        pci_read_config_dword((d)->imc[mc].chan[ch].cdev,       \
+                              0x120 + 16 * idx + 4 * (i), &reg)
+
+#define SKX_RIR_VALID(b) GET_BITFIELD((b), 31, 31)
+#define SKX_RIR_LIMIT(b) (((u64)GET_BITFIELD((b), 1, 11) << 29) | MASK29)
+#define SKX_RIR_WAYS(b) (1 << GET_BITFIELD((b), 28, 29))
+#define SKX_RIR_CHAN_RANK(b) GET_BITFIELD((b), 16, 19)
+#define SKX_RIR_OFFSET(b) ((u64)(GET_BITFIELD((b), 2, 15) << 26))
+
+static bool skx_rir_decode(struct decoded_addr *res)
+{
+        int i, idx, chan_rank;
+        int shift;
+        u32 rirway, rirlv;
+        u64 rank_addr, prev_limit = 0, limit;
+
+        if (res->dev->imc[res->imc].chan[res->channel].dimms[0].close_pg)
+                shift = 6;
+        else
+                shift = 13;
+
+        for (i = 0; i < SKX_MAX_RIR; i++) {
+                SKX_GET_RIRWAYNESS(res->dev, res->imc, res->channel, i, rirway);
+                limit = SKX_RIR_LIMIT(rirway);
+                if (SKX_RIR_VALID(rirway)) {
+                        if (prev_limit <= res->chan_addr &&
+                            res->chan_addr <= limit)
+                                goto rir_found;
+                }
+                prev_limit = limit;
+        }
+        edac_dbg(0, "No RIR entry for %llx\n", res->addr);
+        return false;
+
+rir_found:
+        rank_addr = res->chan_addr >> shift;
+        rank_addr /= SKX_RIR_WAYS(rirway);
+        rank_addr <<= shift;
+        rank_addr |= res->chan_addr & GENMASK_ULL(shift - 1, 0);
+
+        res->rank_address = rank_addr;
+        idx = (res->chan_addr >> shift) % SKX_RIR_WAYS(rirway);
+
+        SKX_GET_RIRILV(res->dev, res->imc, res->channel, idx, i, rirlv);
+        res->rank_address = rank_addr - SKX_RIR_OFFSET(rirlv);
+        chan_rank = SKX_RIR_CHAN_RANK(rirlv);
+        res->channel_rank = chan_rank;
+        res->dimm = chan_rank / 4;
+        res->rank = chan_rank % 4;
+
+        edac_dbg(2, "%llx: dimm=%d rank=%d chan_rank=%d rank_addr=%llx\n",
+                 res->addr, res->dimm, res->rank,
+                 res->channel_rank, res->rank_address);
+        return true;
+}
+
+static u8 skx_close_row[] = {
+        15, 16, 17, 18, 20, 21, 22, 28, 10, 11, 12, 13, 29, 30, 31, 32, 33
+};
+static u8 skx_close_column[] = {
+        3, 4, 5, 14, 19, 23, 24, 25, 26, 27
+};
+static u8 skx_open_row[] = {
+        14, 15, 16, 20, 28, 21, 22, 23, 24, 25, 26, 27, 29, 30, 31, 32, 33
+};
+static u8 skx_open_column[] = {
+        3, 4, 5, 6, 7, 8, 9, 10, 11, 12
+};
+static u8 skx_open_fine_column[] = {
+        3, 4, 5, 7, 8, 9, 10, 11, 12, 13
+};
+
+static int skx_bits(u64 addr, int nbits, u8 *bits)
+{
+        int i, res = 0;
+
+        for (i = 0; i < nbits; i++)
+                res |= ((addr >> bits[i]) & 1) << i;
+        return res;
+}
+
+static int skx_bank_bits(u64 addr, int b0, int b1, int do_xor, int x0, int x1)
+{
+        int ret = GET_BITFIELD(addr, b0, b0) | (GET_BITFIELD(addr, b1, b1) << 1);
+
+        if (do_xor)
+                ret ^= GET_BITFIELD(addr, x0, x0) | (GET_BITFIELD(addr, x1, x1) << 1);
+
+        return ret;
+}
+
+static bool skx_mad_decode(struct decoded_addr *r)
+{
+        struct skx_dimm *dimm = &r->dev->imc[r->imc].chan[r->channel].dimms[r->dimm];
+        int bg0 = dimm->fine_grain_bank ? 6 : 13;
+
+        if (dimm->close_pg) {
+                r->row = skx_bits(r->rank_address, dimm->rowbits, skx_close_row);
+                r->column = skx_bits(r->rank_address, dimm->colbits, skx_close_column);
+                r->column |= 0x400; /* C10 is autoprecharge, always set */
+                r->bank_address = skx_bank_bits(r->rank_address, 8, 9, dimm->bank_xor_enable, 22, 28);
+                r->bank_group = skx_bank_bits(r->rank_address, 6, 7, dimm->bank_xor_enable, 20, 21);
+        } else {
+                r->row = skx_bits(r->rank_address, dimm->rowbits, skx_open_row);
+                if (dimm->fine_grain_bank)
+                        r->column = skx_bits(r->rank_address, dimm->colbits, skx_open_fine_column);
+                else
+                        r->column = skx_bits(r->rank_address, dimm->colbits, skx_open_column);
+                r->bank_address = skx_bank_bits(r->rank_address, 18, 19, dimm->bank_xor_enable, 22, 23);
+                r->bank_group = skx_bank_bits(r->rank_address, bg0, 17, dimm->bank_xor_enable, 20, 21);
+        }
+        r->row &= (1u << dimm->rowbits) - 1;
+
+        edac_dbg(2, "%llx: row=%x col=%x bank_addr=%d bank_group=%d\n",
+                 r->addr, r->row, r->column, r->bank_address,
+                 r->bank_group);
+        return true;
+}
+
+static bool skx_decode(struct decoded_addr *res)
+{
+
+        return skx_sad_decode(res) && skx_tad_decode(res) &&
+                skx_rir_decode(res) && skx_mad_decode(res);
+}
+
+#ifdef CONFIG_EDAC_DEBUG
+/*
+ * Debug feature. Make /sys/kernel/debug/skx_edac_test/addr.
+ * Write an address to this file to exercise the address decode
+ * logic in this driver.
+ */
+static struct dentry *skx_test;
+static u64 skx_fake_addr;
+
+static int debugfs_u64_set(void *data, u64 val)
+{
+        struct decoded_addr res;
+
+        res.addr = val;
+        skx_decode(&res);
+
+        return 0;
+}
+
+DEFINE_SIMPLE_ATTRIBUTE(fops_u64_wo, NULL, debugfs_u64_set, "%llu\n");
+
+static struct dentry *mydebugfs_create(const char *name, umode_t mode,
+                                       struct dentry *parent, u64 *value)
+{
+        return debugfs_create_file(name, mode, parent, value, &fops_u64_wo);
+}
+
+static void setup_skx_debug(void)
+{
+        skx_test = debugfs_create_dir("skx_edac_test", NULL);
+        mydebugfs_create("addr", S_IWUSR, skx_test, &skx_fake_addr);
+}
+
+static void teardown_skx_debug(void)
+{
+        debugfs_remove_recursive(skx_test);
+}
+#else
+static void setup_skx_debug(void)
+{
+}
+
+static void teardown_skx_debug(void)
+{
+}
+#endif /*CONFIG_EDAC_DEBUG*/
+
+static void skx_mce_output_error(struct mem_ctl_info *mci,
+                                 const struct mce *m,
+                                 struct decoded_addr *res)
+{
+        enum hw_event_mc_err_type tp_event;
+        char *type, *optype, msg[256];
+        bool ripv = GET_BITFIELD(m->mcgstatus, 0, 0);
+        bool overflow = GET_BITFIELD(m->status, 62, 62);
+        bool uncorrected_error = GET_BITFIELD(m->status, 61, 61);
+        bool recoverable;
+        u32 core_err_cnt = GET_BITFIELD(m->status, 38, 52);
+        u32 mscod = GET_BITFIELD(m->status, 16, 31);
+        u32 errcode = GET_BITFIELD(m->status, 0, 15);
+        u32 optypenum = GET_BITFIELD(m->status, 4, 6);
+
+        recoverable = GET_BITFIELD(m->status, 56, 56);
+
+        if (uncorrected_error) {
+                if (ripv) {
+                        type = "FATAL";
+                        tp_event = HW_EVENT_ERR_FATAL;
+                } else {
+                        type = "NON_FATAL";
+                        tp_event = HW_EVENT_ERR_UNCORRECTED;
+                }
+        } else {
+                type = "CORRECTED";
+                tp_event = HW_EVENT_ERR_CORRECTED;
+        }
+
+        /*
+         * According with Table 15-9 of the Intel Architecture spec vol 3A,
+         * memory errors should fit in this mask:
+         *      000f 0000 1mmm cccc (binary)
+         * where:
+         *      f = Correction Report Filtering Bit. If 1, subsequent errors
+         *          won't be shown
+         *      mmm = error type
+         *      cccc = channel
+         * If the mask doesn't match, report an error to the parsing logic
+         */
+        if (!((errcode & 0xef80) == 0x80)) {
+                optype = "Can't parse: it is not a mem";
+        } else {
+                switch (optypenum) {
+                case 0:
+                        optype = "generic undef request error";
+                        break;
+                case 1:
+                        optype = "memory read error";
+                        break;
+                case 2:
+                        optype = "memory write error";
+                        break;
+                case 3:
+                        optype = "addr/cmd error";
+                        break;
+                case 4:
+                        optype = "memory scrubbing error";
+                        break;
+                default:
+                        optype = "reserved";
+                        break;
+                }
+        }
+
+        snprintf(msg, sizeof(msg),
+                 "%s%s err_code:%04x:%04x socket:%d imc:%d rank:%d bg:%d ba:%d row:%x col:%x",
+                 overflow ? " OVERFLOW" : "",
+                 (uncorrected_error && recoverable) ? " recoverable" : "",
+                 mscod, errcode,
+                 res->socket, res->imc, res->rank,
+                 res->bank_group, res->bank_address, res->row, res->column);
+
+        edac_dbg(0, "%s\n", msg);
+
+        /* Call the helper to output message */
+        edac_mc_handle_error(tp_event, mci, core_err_cnt,
+                             m->addr >> PAGE_SHIFT, m->addr & ~PAGE_MASK, 0,
+                             res->channel, res->dimm, -1,
+                             optype, msg);
+}
+
+static int skx_mce_check_error(struct notifier_block *nb, unsigned long val,
+                               void *data)
+{
+        struct mce *mce = (struct mce *)data;
+        struct decoded_addr res;
+        struct mem_ctl_info *mci;
+        char *type;
+
+        if (get_edac_report_status() == EDAC_REPORTING_DISABLED)
+                return NOTIFY_DONE;
+
+        /* ignore unless this is memory related with an address */
+        if ((mce->status & 0xefff) >> 7 != 1 || !(mce->status & MCI_STATUS_ADDRV))
+                return NOTIFY_DONE;
+
+        res.addr = mce->addr;
+        if (!skx_decode(&res))
+                return NOTIFY_DONE;
+        mci = res.dev->imc[res.imc].mci;
+
+        if (mce->mcgstatus & MCG_STATUS_MCIP)
+                type = "Exception";
+        else
+                type = "Event";
+
+        skx_mc_printk(mci, KERN_DEBUG, "HANDLING MCE MEMORY ERROR\n");
+
+        skx_mc_printk(mci, KERN_DEBUG, "CPU %d: Machine Check %s: %Lx "
+                          "Bank %d: %016Lx\n", mce->extcpu, type,
+                          mce->mcgstatus, mce->bank, mce->status);
+        skx_mc_printk(mci, KERN_DEBUG, "TSC %llx ", mce->tsc);
+        skx_mc_printk(mci, KERN_DEBUG, "ADDR %llx ", mce->addr);
+        skx_mc_printk(mci, KERN_DEBUG, "MISC %llx ", mce->misc);
+
+        skx_mc_printk(mci, KERN_DEBUG, "PROCESSOR %u:%x TIME %llu SOCKET "
+                          "%u APIC %x\n", mce->cpuvendor, mce->cpuid,
+                          mce->time, mce->socketid, mce->apicid);
+
+        skx_mce_output_error(mci, mce, &res);
+
+        return NOTIFY_DONE;
+}
+
+static struct notifier_block skx_mce_dec = {
+        .notifier_call = skx_mce_check_error,
+};
+
+static void skx_remove(void)
+{
+        int i, j;
+        struct skx_dev *d, *tmp;
+
+        edac_dbg(0, "\n");
+
+        list_for_each_entry_safe(d, tmp, &skx_edac_list, list) {
+                list_del(&d->list);
+                for (i = 0; i < NUM_IMC; i++) {
+                        skx_unregister_mci(&d->imc[i]);
+                        for (j = 0; j < NUM_CHANNELS; j++)
+                                pci_dev_put(d->imc[i].chan[j].cdev);
+                }
+                pci_dev_put(d->util_all);
+                pci_dev_put(d->sad_all);
+
+                kfree(d);
+        }
+}
+
+/*
+ * skx_init:
+ *      make sure we are running on the correct cpu model
+ *      search for all the devices we need
+ *      check which DIMMs are present.
+ */
+int __init skx_init(void)
+{
+        const struct x86_cpu_id *id;
+        const struct munit *m;
+        int rc = 0, i;
+        u8 mc = 0, src_id, node_id;
+        struct skx_dev *d;
+
+        edac_dbg(2, "\n");
+
+        id = x86_match_cpu(skx_cpuids);
+        if (!id)
+                return -ENODEV;
+
+        rc = skx_get_hi_lo();
+        if (rc)
+                return rc;
+
+        rc = get_all_bus_mappings();
+        if (rc < 0)
+                goto fail;
+        if (rc == 0) {
+                edac_dbg(2, "No memory controllers found\n");
+                return -ENODEV;
+        }
+
+        for (m = skx_all_munits; m->did; m++) {
+                rc = get_all_munits(m);
+                if (rc < 0)
+                        goto fail;
+                if (rc != m->per_socket * skx_num_sockets) {
+                        edac_dbg(2, "Expected %d, got %d of %x\n",
+                                 m->per_socket * skx_num_sockets, rc, m->did);
+                        rc = -ENODEV;
+                        goto fail;
+                }
+        }
+
+        list_for_each_entry(d, &skx_edac_list, list) {
+                src_id = get_src_id(d);
+                node_id = skx_get_node_id(d);
+                edac_dbg(2, "src_id=%d node_id=%d\n", src_id, node_id);
+                for (i = 0; i < NUM_IMC; i++) {
+                        d->imc[i].mc = mc++;
+                        d->imc[i].lmc = i;
+                        d->imc[i].src_id = src_id;
+                        d->imc[i].node_id = node_id;
+                        rc = skx_register_mci(&d->imc[i]);
+                        if (rc < 0)
+                                goto fail;
+                }
+        }
+
+        /* Ensure that the OPSTATE is set correctly for POLL or NMI */
+        opstate_init();
+
+        setup_skx_debug();
+
+        mce_register_decode_chain(&skx_mce_dec);
+
+        return 0;
+fail:
+        skx_remove();
+        return rc;
+}
+
+static void __exit skx_exit(void)
+{
+        edac_dbg(2, "\n");
+        mce_unregister_decode_chain(&skx_mce_dec);
+        skx_remove();
+        teardown_skx_debug();
+}
+
+module_init(skx_init);
+module_exit(skx_exit);
+
+module_param(edac_op_state, int, 0444);
+MODULE_PARM_DESC(edac_op_state, "EDAC Error Reporting state: 0=Poll,1=NMI");
+
+MODULE_LICENSE("GPL v2");
+MODULE_AUTHOR("Tony Luck");
+MODULE_DESCRIPTION("MC Driver for Intel Skylake server processors");
diff --git a/drivers/firmware/arm_scpi.c b/drivers/firmware/arm_scpi.c
index 438893762076..ce2bc2a38101 100644
--- a/drivers/firmware/arm_scpi.c
+++ b/drivers/firmware/arm_scpi.c
@@ -709,9 +709,10 @@ static int scpi_probe(struct platform_device *pdev)
                 struct mbox_client *cl = &pchan->cl;
                 struct device_node *shmem = of_parse_phandle(np, "shmem", idx);
 
-                if (of_address_to_resource(shmem, 0, &res)) {
+                ret = of_address_to_resource(shmem, 0, &res);
+                of_node_put(shmem);
+                if (ret) {
                         dev_err(dev, "failed to get SCPI payload mem resource\n");
-                        ret = -EINVAL;
                         goto err;
                 }
 
diff --git a/drivers/firmware/dmi-id.c b/drivers/firmware/dmi-id.c
index 94a58a082b99..44c01390d035 100644
--- a/drivers/firmware/dmi-id.c
+++ b/drivers/firmware/dmi-id.c
@@ -229,14 +229,14 @@ static int __init dmi_id_init(void)
 
         ret = device_register(dmi_dev);
         if (ret)
-                goto fail_free_dmi_dev;
+                goto fail_put_dmi_dev;
 
         return 0;
 
-fail_free_dmi_dev:
-        kfree(dmi_dev);
-fail_class_unregister:
+fail_put_dmi_dev:
+        put_device(dmi_dev);
 
+fail_class_unregister:
         class_unregister(&dmi_class);
 
         return ret;
diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c
index 5a2631af7410..7dd2e2d37231 100644
--- a/drivers/firmware/efi/efi.c
+++ b/drivers/firmware/efi/efi.c
@@ -657,9 +657,12 @@ static int __init fdt_find_uefi_params(unsigned long node, const char *uname,
                 }
 
                 if (subnode) {
-                        node = of_get_flat_dt_subnode_by_name(node, subnode);
-                        if (node < 0)
+                        int err = of_get_flat_dt_subnode_by_name(node, subnode);
+
+                        if (err < 0)
                                 return 0;
+
+                        node = err;
                 }
 
                 return __find_uefi_params(node, info, dt_params[i].params);
diff --git a/drivers/firmware/efi/libstub/efi-stub-helper.c b/drivers/firmware/efi/libstub/efi-stub-helper.c
index 3bd127f95315..aded10662020 100644
--- a/drivers/firmware/efi/libstub/efi-stub-helper.c
+++ b/drivers/firmware/efi/libstub/efi-stub-helper.c
@@ -41,6 +41,8 @@ static unsigned long __chunk_size = EFI_READ_CHUNK_SIZE;
 #define EFI_ALLOC_ALIGN         EFI_PAGE_SIZE
 #endif
 
+#define EFI_MMAP_NR_SLACK_SLOTS 8
+
 struct file_info {
         efi_file_handle_t *handle;
         u64 size;
@@ -63,49 +65,62 @@ void efi_printk(efi_system_table_t *sys_table_arg, char *str)
         }
 }
 
+static inline bool mmap_has_headroom(unsigned long buff_size,
+                                     unsigned long map_size,
+                                     unsigned long desc_size)
+{
+        unsigned long slack = buff_size - map_size;
+
+        return slack / desc_size >= EFI_MMAP_NR_SLACK_SLOTS;
+}
+
 efi_status_t efi_get_memory_map(efi_system_table_t *sys_table_arg,
-                                efi_memory_desc_t **map,
-                                unsigned long *map_size,
-                                unsigned long *desc_size,
-                                u32 *desc_ver,
-                                unsigned long *key_ptr)
+                                struct efi_boot_memmap *map)
 {
         efi_memory_desc_t *m = NULL;
         efi_status_t status;
         unsigned long key;
         u32 desc_version;
 
-        *map_size = sizeof(*m) * 32;
+        *map->desc_size =       sizeof(*m);
+        *map->map_size =        *map->desc_size * 32;
+        *map->buff_size =       *map->map_size;
 again:
-        /*
-         * Add an additional efi_memory_desc_t because we're doing an
-         * allocation which may be in a new descriptor region.
-         */
-        *map_size += sizeof(*m);
         status = efi_call_early(allocate_pool, EFI_LOADER_DATA,
-                                *map_size, (void **)&m);
+                                *map->map_size, (void **)&m);
         if (status != EFI_SUCCESS)
                 goto fail;
 
-        *desc_size = 0;
+        *map->desc_size = 0;
         key = 0;
-        status = efi_call_early(get_memory_map, map_size, m,
-                                &key, desc_size, &desc_version);
-        if (status == EFI_BUFFER_TOO_SMALL) {
+        status = efi_call_early(get_memory_map, map->map_size, m,
+                                &key, map->desc_size, &desc_version);
+        if (status == EFI_BUFFER_TOO_SMALL ||
+            !mmap_has_headroom(*map->buff_size, *map->map_size,
+                               *map->desc_size)) {
                 efi_call_early(free_pool, m);
+                /*
+                 * Make sure there is some entries of headroom so that the
+                 * buffer can be reused for a new map after allocations are
+                 * no longer permitted.  Its unlikely that the map will grow to
+                 * exceed this headroom once we are ready to trigger
+                 * ExitBootServices()
+                 */
+                *map->map_size += *map->desc_size * EFI_MMAP_NR_SLACK_SLOTS;
+                *map->buff_size = *map->map_size;
                 goto again;
         }
 
         if (status != EFI_SUCCESS)
                 efi_call_early(free_pool, m);
 
-        if (key_ptr && status == EFI_SUCCESS)
-                *key_ptr = key;
-        if (desc_ver && status == EFI_SUCCESS)
-                *desc_ver = desc_version;
+        if (map->key_ptr && status == EFI_SUCCESS)
+                *map->key_ptr = key;
+        if (map->desc_ver && status == EFI_SUCCESS)
+                *map->desc_ver = desc_version;
 
 fail:
-        *map = m;
+        *map->map = m;
         return status;
 }
 
@@ -113,13 +128,20 @@ fail:
 unsigned long get_dram_base(efi_system_table_t *sys_table_arg)
 {
         efi_status_t status;
-        unsigned long map_size;
+        unsigned long map_size, buff_size;
         unsigned long membase  = EFI_ERROR;
         struct efi_memory_map map;
         efi_memory_desc_t *md;
+        struct efi_boot_memmap boot_map;
 
-        status = efi_get_memory_map(sys_table_arg, (efi_memory_desc_t **)&map.map,
-                                    &map_size, &map.desc_size, NULL, NULL);
+        boot_map.map =          (efi_memory_desc_t **)&map.map;
+        boot_map.map_size =     &map_size;
+        boot_map.desc_size =    &map.desc_size;
+        boot_map.desc_ver =     NULL;
+        boot_map.key_ptr =      NULL;
+        boot_map.buff_size =    &buff_size;
+
+        status = efi_get_memory_map(sys_table_arg, &boot_map);
         if (status != EFI_SUCCESS)
                 return membase;
 
@@ -144,15 +166,22 @@ efi_status_t efi_high_alloc(efi_system_table_t *sys_table_arg,
                             unsigned long size, unsigned long align,
                             unsigned long *addr, unsigned long max)
 {
-        unsigned long map_size, desc_size;
+        unsigned long map_size, desc_size, buff_size;
         efi_memory_desc_t *map;
         efi_status_t status;
         unsigned long nr_pages;
         u64 max_addr = 0;
         int i;
+        struct efi_boot_memmap boot_map;
+
+        boot_map.map =          &map;
+        boot_map.map_size =     &map_size;
+        boot_map.desc_size =    &desc_size;
+        boot_map.desc_ver =     NULL;
+        boot_map.key_ptr =      NULL;
+        boot_map.buff_size =    &buff_size;
 
-        status = efi_get_memory_map(sys_table_arg, &map, &map_size, &desc_size,
-                                    NULL, NULL);
+        status = efi_get_memory_map(sys_table_arg, &boot_map);
         if (status != EFI_SUCCESS)
                 goto fail;
 
@@ -230,14 +259,21 @@ efi_status_t efi_low_alloc(efi_system_table_t *sys_table_arg,
                            unsigned long size, unsigned long align,
                            unsigned long *addr)
 {
-        unsigned long map_size, desc_size;
+        unsigned long map_size, desc_size, buff_size;
         efi_memory_desc_t *map;
         efi_status_t status;
         unsigned long nr_pages;
         int i;
+        struct efi_boot_memmap boot_map;
 
-        status = efi_get_memory_map(sys_table_arg, &map, &map_size, &desc_size,
-                                    NULL, NULL);
+        boot_map.map =          &map;
+        boot_map.map_size =     &map_size;
+        boot_map.desc_size =    &desc_size;
+        boot_map.desc_ver =     NULL;
+        boot_map.key_ptr =      NULL;
+        boot_map.buff_size =    &buff_size;
+
+        status = efi_get_memory_map(sys_table_arg, &boot_map);
         if (status != EFI_SUCCESS)
                 goto fail;
 
@@ -704,3 +740,76 @@ char *efi_convert_cmdline(efi_system_table_t *sys_table_arg,
         *cmd_line_len = options_bytes;
         return (char *)cmdline_addr;
 }
+
+/*
+ * Handle calling ExitBootServices according to the requirements set out by the
+ * spec.  Obtains the current memory map, and returns that info after calling
+ * ExitBootServices.  The client must specify a function to perform any
+ * processing of the memory map data prior to ExitBootServices.  A client
+ * specific structure may be passed to the function via priv.  The client
+ * function may be called multiple times.
+ */
+efi_status_t efi_exit_boot_services(efi_system_table_t *sys_table_arg,
+                                    void *handle,
+                                    struct efi_boot_memmap *map,
+                                    void *priv,
+                                    efi_exit_boot_map_processing priv_func)
+{
+        efi_status_t status;
+
+        status = efi_get_memory_map(sys_table_arg, map);
+
+        if (status != EFI_SUCCESS)
+                goto fail;
+
+        status = priv_func(sys_table_arg, map, priv);
+        if (status != EFI_SUCCESS)
+                goto free_map;
+
+        status = efi_call_early(exit_boot_services, handle, *map->key_ptr);
+
+        if (status == EFI_INVALID_PARAMETER) {
+                /*
+                 * The memory map changed between efi_get_memory_map() and
+                 * exit_boot_services().  Per the UEFI Spec v2.6, Section 6.4:
+                 * EFI_BOOT_SERVICES.ExitBootServices we need to get the
+                 * updated map, and try again.  The spec implies one retry
+                 * should be sufficent, which is confirmed against the EDK2
+                 * implementation.  Per the spec, we can only invoke
+                 * get_memory_map() and exit_boot_services() - we cannot alloc
+                 * so efi_get_memory_map() cannot be used, and we must reuse
+                 * the buffer.  For all practical purposes, the headroom in the
+                 * buffer should account for any changes in the map so the call
+                 * to get_memory_map() is expected to succeed here.
+                 */
+                *map->map_size = *map->buff_size;
+                status = efi_call_early(get_memory_map,
+                                        map->map_size,
+                                        *map->map,
+                                        map->key_ptr,
+                                        map->desc_size,
+                                        map->desc_ver);
+
+                /* exit_boot_services() was called, thus cannot free */
+                if (status != EFI_SUCCESS)
+                        goto fail;
+
+                status = priv_func(sys_table_arg, map, priv);
+                /* exit_boot_services() was called, thus cannot free */
+                if (status != EFI_SUCCESS)
+                        goto fail;
+
+                status = efi_call_early(exit_boot_services, handle, *map->key_ptr);
+        }
+
+        /* exit_boot_services() was called, thus cannot free */
+        if (status != EFI_SUCCESS)
+                goto fail;
+
+        return EFI_SUCCESS;
+
+free_map:
+        efi_call_early(free_pool, *map->map);
+fail:
+        return status;
+}
diff --git a/drivers/firmware/efi/libstub/fdt.c b/drivers/firmware/efi/libstub/fdt.c
index e58abfa953cc..a6a93116a8f0 100644
--- a/drivers/firmware/efi/libstub/fdt.c
+++ b/drivers/firmware/efi/libstub/fdt.c
@@ -152,6 +152,27 @@ fdt_set_fail:
 #define EFI_FDT_ALIGN EFI_PAGE_SIZE
 #endif
 
+struct exit_boot_struct {
+        efi_memory_desc_t *runtime_map;
+        int *runtime_entry_count;
+};
+
+static efi_status_t exit_boot_func(efi_system_table_t *sys_table_arg,
+                                   struct efi_boot_memmap *map,
+                                   void *priv)
+{
+        struct exit_boot_struct *p = priv;
+        /*
+         * Update the memory map with virtual addresses. The function will also
+         * populate @runtime_map with copies of just the EFI_MEMORY_RUNTIME
+         * entries so that we can pass it straight to SetVirtualAddressMap()
+         */
+        efi_get_virtmap(*map->map, *map->map_size, *map->desc_size,
+                        p->runtime_map, p->runtime_entry_count);
+
+        return EFI_SUCCESS;
+}
+
 /*
  * Allocate memory for a new FDT, then add EFI, commandline, and
  * initrd related fields to the FDT.  This routine increases the
@@ -175,13 +196,22 @@ efi_status_t allocate_new_fdt_and_exit_boot(efi_system_table_t *sys_table,
                                             unsigned long fdt_addr,
                                             unsigned long fdt_size)
 {
-        unsigned long map_size, desc_size;
+        unsigned long map_size, desc_size, buff_size;
         u32 desc_ver;
         unsigned long mmap_key;
         efi_memory_desc_t *memory_map, *runtime_map;
         unsigned long new_fdt_size;
         efi_status_t status;
         int runtime_entry_count = 0;
+        struct efi_boot_memmap map;
+        struct exit_boot_struct priv;
+
+        map.map =       &runtime_map;
+        map.map_size =  &map_size;
+        map.desc_size = &desc_size;
+        map.desc_ver =  &desc_ver;
+        map.key_ptr =   &mmap_key;
+        map.buff_size = &buff_size;
 
         /*
          * Get a copy of the current memory map that we will use to prepare
@@ -189,8 +219,7 @@ efi_status_t allocate_new_fdt_and_exit_boot(efi_system_table_t *sys_table,
          * subsequent allocations adding entries, since they could not affect
          * the number of EFI_MEMORY_RUNTIME regions.
          */
-        status = efi_get_memory_map(sys_table, &runtime_map, &map_size,
-                                    &desc_size, &desc_ver, &mmap_key);
+        status = efi_get_memory_map(sys_table, &map);
         if (status != EFI_SUCCESS) {
                 pr_efi_err(sys_table, "Unable to retrieve UEFI memory map.\n");
                 return status;
@@ -199,6 +228,7 @@ efi_status_t allocate_new_fdt_and_exit_boot(efi_system_table_t *sys_table,
         pr_efi(sys_table,
                "Exiting boot services and installing virtual address map...\n");
 
+        map.map = &memory_map;
         /*
          * Estimate size of new FDT, and allocate memory for it. We
          * will allocate a bigger buffer if this ends up being too
@@ -218,8 +248,7 @@ efi_status_t allocate_new_fdt_and_exit_boot(efi_system_table_t *sys_table,
                  * we can get the memory map key  needed for
                  * exit_boot_services().
                  */
-                status = efi_get_memory_map(sys_table, &memory_map, &map_size,
-                                            &desc_size, &desc_ver, &mmap_key);
+                status = efi_get_memory_map(sys_table, &map);
                 if (status != EFI_SUCCESS)
                         goto fail_free_new_fdt;
 
@@ -250,16 +279,11 @@ efi_status_t allocate_new_fdt_and_exit_boot(efi_system_table_t *sys_table,
                 }
         }
 
-        /*
-         * Update the memory map with virtual addresses. The function will also
-         * populate @runtime_map with copies of just the EFI_MEMORY_RUNTIME
-         * entries so that we can pass it straight into SetVirtualAddressMap()
-         */
-        efi_get_virtmap(memory_map, map_size, desc_size, runtime_map,
-                        &runtime_entry_count);
-
-        /* Now we are ready to exit_boot_services.*/
-        status = sys_table->boottime->exit_boot_services(handle, mmap_key);
+        sys_table->boottime->free_pool(memory_map);
+        priv.runtime_map = runtime_map;
+        priv.runtime_entry_count = &runtime_entry_count;
+        status = efi_exit_boot_services(sys_table, handle, &map, &priv,
+                                        exit_boot_func);
 
         if (status == EFI_SUCCESS) {
                 efi_set_virtual_address_map_t *svam;
diff --git a/drivers/firmware/efi/libstub/random.c b/drivers/firmware/efi/libstub/random.c
index 53f6d3fe6d86..0c9f58c5ba50 100644
--- a/drivers/firmware/efi/libstub/random.c
+++ b/drivers/firmware/efi/libstub/random.c
@@ -73,12 +73,20 @@ efi_status_t efi_random_alloc(efi_system_table_t *sys_table_arg,
                               unsigned long random_seed)
 {
         unsigned long map_size, desc_size, total_slots = 0, target_slot;
+        unsigned long buff_size;
         efi_status_t status;
         efi_memory_desc_t *memory_map;
         int map_offset;
+        struct efi_boot_memmap map;
 
-        status = efi_get_memory_map(sys_table_arg, &memory_map, &map_size,
-                                    &desc_size, NULL, NULL);
+        map.map =       &memory_map;
+        map.map_size =  &map_size;
+        map.desc_size = &desc_size;
+        map.desc_ver =  NULL;
+        map.key_ptr =   NULL;
+        map.buff_size = &buff_size;
+
+        status = efi_get_memory_map(sys_table_arg, &map);
         if (status != EFI_SUCCESS)
                 return status;
 
diff --git a/drivers/gpio/Kconfig b/drivers/gpio/Kconfig
index 98dd47a30fc7..24caedb00a7a 100644
--- a/drivers/gpio/Kconfig
+++ b/drivers/gpio/Kconfig
@@ -50,6 +50,7 @@ config GPIO_DEVRES
 config OF_GPIO
         def_bool y
         depends on OF
+        depends on HAS_IOMEM
 
 config GPIO_ACPI
         def_bool y
@@ -188,7 +189,7 @@ config GPIO_EP93XX
 config GPIO_ETRAXFS
         bool "Axis ETRAX FS General I/O"
         depends on CRIS || COMPILE_TEST
-        depends on OF
+        depends on OF_GPIO
         select GPIO_GENERIC
         select GPIOLIB_IRQCHIP
         help
@@ -214,7 +215,7 @@ config GPIO_GENERIC_PLATFORM
 
 config GPIO_GRGPIO
         tristate "Aeroflex Gaisler GRGPIO support"
-        depends on OF
+        depends on OF_GPIO
         select GPIO_GENERIC
         select IRQ_DOMAIN
         help
@@ -312,7 +313,7 @@ config GPIO_MPC8XXX
 config GPIO_MVEBU
         def_bool y
         depends on PLAT_ORION
-        depends on OF
+        depends on OF_GPIO
         select GENERIC_IRQ_CHIP
 
 config GPIO_MXC
@@ -405,7 +406,7 @@ config GPIO_TEGRA
         bool "NVIDIA Tegra GPIO support"
         default ARCH_TEGRA
         depends on ARCH_TEGRA || COMPILE_TEST
-        depends on OF
+        depends on OF_GPIO
         help
           Say yes here to support GPIO pins on NVIDIA Tegra SoCs.
 
@@ -1099,7 +1100,7 @@ menu "SPI GPIO expanders"
 
 config GPIO_74X164
         tristate "74x164 serial-in/parallel-out 8-bits shift register"
-        depends on OF
+        depends on OF_GPIO
         help
           Driver for 74x164 compatible serial-in/parallel-out 8-outputs
           shift registers. This driver can be used to provide access
@@ -1130,6 +1131,7 @@ menu "SPI or I2C GPIO expanders"
 
 config GPIO_MCP23S08
         tristate "Microchip MCP23xxx I/O expander"
+        depends on OF_GPIO
         select GPIOLIB_IRQCHIP
         help
           SPI/I2C driver for Microchip MCP23S08/MCP23S17/MCP23008/MCP23017
diff --git a/drivers/gpio/gpio-max730x.c b/drivers/gpio/gpio-max730x.c
index 08807368f007..946d09195598 100644
--- a/drivers/gpio/gpio-max730x.c
+++ b/drivers/gpio/gpio-max730x.c
@@ -192,6 +192,10 @@ int __max730x_probe(struct max7301 *ts)
         ts->chip.parent = dev;
         ts->chip.owner = THIS_MODULE;
 
+        ret = gpiochip_add_data(&ts->chip, ts);
+        if (ret)
+                goto exit_destroy;
+
         /*
          * initialize pullups according to platform data and cache the
          * register values for later use.
@@ -213,10 +217,6 @@ int __max730x_probe(struct max7301 *ts)
                 }
         }
 
-        ret = gpiochip_add_data(&ts->chip, ts);
-        if (ret)
-                goto exit_destroy;
-
         return ret;
 
 exit_destroy:
diff --git a/drivers/gpio/gpio-mcp23s08.c b/drivers/gpio/gpio-mcp23s08.c
index ac22efc1840e..99d37b56c258 100644
--- a/drivers/gpio/gpio-mcp23s08.c
+++ b/drivers/gpio/gpio-mcp23s08.c
@@ -564,7 +564,7 @@ static int mcp23s08_probe_one(struct mcp23s08 *mcp, struct device *dev,
         mcp->chip.direction_output = mcp23s08_direction_output;
         mcp->chip.set = mcp23s08_set;
         mcp->chip.dbg_show = mcp23s08_dbg_show;
-#ifdef CONFIG_OF
+#ifdef CONFIG_OF_GPIO
         mcp->chip.of_gpio_n_cells = 2;
         mcp->chip.of_node = dev->of_node;
 #endif
diff --git a/drivers/gpio/gpio-sa1100.c b/drivers/gpio/gpio-sa1100.c
index 0c99e8fb9af3..8d8ee0ebf14c 100644
--- a/drivers/gpio/gpio-sa1100.c
+++ b/drivers/gpio/gpio-sa1100.c
@@ -155,7 +155,7 @@ static int sa1100_gpio_irqdomain_map(struct irq_domain *d,
 {
         irq_set_chip_and_handler(irq, &sa1100_gpio_irq_chip,
                                  handle_edge_irq);
-        irq_set_noprobe(irq);
+        irq_set_probe(irq);
 
         return 0;
 }
diff --git a/drivers/gpio/gpiolib-of.c b/drivers/gpio/gpiolib-of.c
index 75e7b3919ea7..a28feb3edf33 100644
--- a/drivers/gpio/gpiolib-of.c
+++ b/drivers/gpio/gpiolib-of.c
@@ -16,7 +16,6 @@
 #include <linux/errno.h>
 #include <linux/module.h>
 #include <linux/io.h>
-#include <linux/io-mapping.h>
 #include <linux/gpio/consumer.h>
 #include <linux/of.h>
 #include <linux/of_address.h>
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu.h b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
index 9d79e4ba0213..72c68dbb9821 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
@@ -407,7 +407,6 @@ unsigned amdgpu_fence_count_emitted(struct amdgpu_ring *ring);
 /*
  * BO.
  */
-
 struct amdgpu_bo_list_entry {
         struct amdgpu_bo                *robj;
         struct ttm_validate_buffer      tv;
@@ -620,9 +619,9 @@ int amdgpu_gart_table_vram_pin(struct amdgpu_device *adev);
 void amdgpu_gart_table_vram_unpin(struct amdgpu_device *adev);
 int amdgpu_gart_init(struct amdgpu_device *adev);
 void amdgpu_gart_fini(struct amdgpu_device *adev);
-void amdgpu_gart_unbind(struct amdgpu_device *adev, unsigned offset,
+void amdgpu_gart_unbind(struct amdgpu_device *adev, uint64_t offset,
                         int pages);
-int amdgpu_gart_bind(struct amdgpu_device *adev, unsigned offset,
+int amdgpu_gart_bind(struct amdgpu_device *adev, uint64_t offset,
                      int pages, struct page **pagelist,
                      dma_addr_t *dma_addr, uint32_t flags);
 int amdgpu_ttm_recover_gart(struct amdgpu_device *adev);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c
index 59961db9c390..8e6bf548d689 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c
@@ -348,6 +348,19 @@ bool amdgpu_atombios_get_connector_info_from_object_table(struct amdgpu_device *
                             (le16_to_cpu(path->usConnObjectId) &
                              OBJECT_TYPE_MASK) >> OBJECT_TYPE_SHIFT;
 
+                        /* Skip TV/CV support */
+                        if ((le16_to_cpu(path->usDeviceTag) ==
+                             ATOM_DEVICE_TV1_SUPPORT) ||
+                            (le16_to_cpu(path->usDeviceTag) ==
+                             ATOM_DEVICE_CV_SUPPORT))
+                                continue;
+
+                        if (con_obj_id >= ARRAY_SIZE(object_connector_convert)) {
+                                DRM_ERROR("invalid con_obj_id %d for device tag 0x%04x\n",
+                                          con_obj_id, le16_to_cpu(path->usDeviceTag));
+                                continue;
+                        }
+
                         connector_type =
                                 object_connector_convert[con_obj_id];
                         connector_object_id = con_obj_id;
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
index 550c5ee704ec..dae35a96a694 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
@@ -205,16 +205,7 @@ static int amdgpu_atpx_validate(struct amdgpu_atpx *atpx)
         atpx->is_hybrid = false;
         if (valid_bits & ATPX_MS_HYBRID_GFX_SUPPORTED) {
                 printk("ATPX Hybrid Graphics\n");
-#if 1
-                /* This is a temporary hack until the D3 cold support
-                 * makes it upstream.  The ATPX power_control method seems
-                 * to still work on even if the system should be using
-                 * the new standardized hybrid D3 cold ACPI interface.
-                 */
-                atpx->functions.power_cntl = true;
-#else
                 atpx->functions.power_cntl = false;
-#endif
                 atpx->is_hybrid = true;
         }
 
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c
index 921bce2df0b0..0feea347f680 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c
@@ -221,7 +221,7 @@ void amdgpu_gart_table_vram_free(struct amdgpu_device *adev)
  * Unbinds the requested pages from the gart page table and
  * replaces them with the dummy page (all asics).
  */
-void amdgpu_gart_unbind(struct amdgpu_device *adev, unsigned offset,
+void amdgpu_gart_unbind(struct amdgpu_device *adev, uint64_t offset,
                         int pages)
 {
         unsigned t;
@@ -268,7 +268,7 @@ void amdgpu_gart_unbind(struct amdgpu_device *adev, unsigned offset,
  * (all asics).
  * Returns 0 for success, -EINVAL for failure.
  */
-int amdgpu_gart_bind(struct amdgpu_device *adev, unsigned offset,
+int amdgpu_gart_bind(struct amdgpu_device *adev, uint64_t offset,
                      int pages, struct page **pagelist, dma_addr_t *dma_addr,
                      uint32_t flags)
 {
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c
index 4127e7ceace0..6a6c86c9c169 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c
@@ -295,7 +295,7 @@ void amdgpu_ib_pool_fini(struct amdgpu_device *adev)
 int amdgpu_ib_ring_tests(struct amdgpu_device *adev)
 {
         unsigned i;
-        int r;
+        int r, ret = 0;
 
         for (i = 0; i < AMDGPU_MAX_RINGS; ++i) {
                 struct amdgpu_ring *ring = adev->rings[i];
@@ -316,10 +316,11 @@ int amdgpu_ib_ring_tests(struct amdgpu_device *adev)
                         } else {
                                 /* still not good, but we can live with it */
                                 DRM_ERROR("amdgpu: failed testing IB on ring %d (%d).\n", i, r);
+                                ret = r;
                         }
                 }
         }
-        return 0;
+        return ret;
 }
 
 /*
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
index b63969d7887c..160a094e1a93 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
@@ -273,8 +273,8 @@ static int amdgpu_move_blit(struct ttm_buffer_object *bo,
 
         adev = amdgpu_get_adev(bo->bdev);
         ring = adev->mman.buffer_funcs_ring;
-        old_start = old_mem->start << PAGE_SHIFT;
-        new_start = new_mem->start << PAGE_SHIFT;
+        old_start = (u64)old_mem->start << PAGE_SHIFT;
+        new_start = (u64)new_mem->start << PAGE_SHIFT;
 
         switch (old_mem->mem_type) {
         case TTM_PL_TT:
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
index 25dd58a65905..cee7bc9a2314 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
@@ -1154,7 +1154,8 @@ int amdgpu_uvd_ring_test_ib(struct amdgpu_ring *ring, long timeout)
                 r = 0;
         }
 
-error:
         fence_put(fence);
+
+error:
         return r;
 }
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
index bd5af328154f..a6a48ed9562e 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
@@ -1593,7 +1593,7 @@ int amdgpu_vm_init(struct amdgpu_device *adev, struct amdgpu_vm *vm)
         r = amd_sched_entity_init(&ring->sched, &vm->entity,
                                   rq, amdgpu_sched_jobs);
         if (r)
-                return r;
+                goto err;
 
         vm->page_directory_fence = NULL;
 
@@ -1624,6 +1624,9 @@ error_free_page_directory:
 error_free_sched_entity:
         amd_sched_entity_fini(&ring->sched, &vm->entity);
 
+err:
+        drm_free_large(vm->page_tables);
+
         return r;
 }
 
diff --git a/drivers/gpu/drm/amd/amdgpu/cik_sdma.c b/drivers/gpu/drm/amd/amdgpu/cik_sdma.c
index e6d7bf9520a0..cb952acc7133 100644
--- a/drivers/gpu/drm/amd/amdgpu/cik_sdma.c
+++ b/drivers/gpu/drm/amd/amdgpu/cik_sdma.c
@@ -52,6 +52,7 @@ static void cik_sdma_set_ring_funcs(struct amdgpu_device *adev);
 static void cik_sdma_set_irq_funcs(struct amdgpu_device *adev);
 static void cik_sdma_set_buffer_funcs(struct amdgpu_device *adev);
 static void cik_sdma_set_vm_pte_funcs(struct amdgpu_device *adev);
+static int cik_sdma_soft_reset(void *handle);
 
 MODULE_FIRMWARE("radeon/bonaire_sdma.bin");
 MODULE_FIRMWARE("radeon/bonaire_sdma1.bin");
@@ -1014,6 +1015,8 @@ static int cik_sdma_resume(void *handle)
 {
         struct amdgpu_device *adev = (struct amdgpu_device *)handle;
 
+        cik_sdma_soft_reset(handle);
+
         return cik_sdma_hw_init(adev);
 }
 
diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c
index 32a676291e67..71116da9e782 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c
@@ -2927,8 +2927,7 @@ static int gfx_v7_0_cp_compute_resume(struct amdgpu_device *adev)
         u64 wb_gpu_addr;
         u32 *buf;
         struct bonaire_mqd *mqd;
-
-        gfx_v7_0_cp_compute_enable(adev, true);
+        struct amdgpu_ring *ring;
 
         /* fix up chicken bits */
         tmp = RREG32(mmCP_CPF_DEBUG);
@@ -2963,7 +2962,7 @@ static int gfx_v7_0_cp_compute_resume(struct amdgpu_device *adev)
 
         /* init the queues.  Just two for now. */
         for (i = 0; i < adev->gfx.num_compute_rings; i++) {
-                struct amdgpu_ring *ring = &adev->gfx.compute_ring[i];
+                ring = &adev->gfx.compute_ring[i];
 
                 if (ring->mqd_obj == NULL) {
                         r = amdgpu_bo_create(adev,
@@ -3142,6 +3141,13 @@ static int gfx_v7_0_cp_compute_resume(struct amdgpu_device *adev)
                 amdgpu_bo_unreserve(ring->mqd_obj);
 
                 ring->ready = true;
+        }
+
+        gfx_v7_0_cp_compute_enable(adev, true);
+
+        for (i = 0; i < adev->gfx.num_compute_rings; i++) {
+                ring = &adev->gfx.compute_ring[i];
+
                 r = amdgpu_ring_test_ring(ring);
                 if (r)
                         ring->ready = false;
diff --git a/drivers/gpu/drm/amd/amdgpu/sdma_v2_4.c b/drivers/gpu/drm/amd/amdgpu/sdma_v2_4.c
index 9ae307505190..565dab3c7218 100644
--- a/drivers/gpu/drm/amd/amdgpu/sdma_v2_4.c
+++ b/drivers/gpu/drm/amd/amdgpu/sdma_v2_4.c
@@ -710,7 +710,7 @@ static int sdma_v2_4_ring_test_ib(struct amdgpu_ring *ring, long timeout)
                 DRM_ERROR("amdgpu: IB test timed out\n");
                 r = -ETIMEDOUT;
                 goto err1;
-        } else if (r) {
+        } else if (r < 0) {
                 DRM_ERROR("amdgpu: fence wait failed (%ld).\n", r);
                 goto err1;
         }
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_doorbell.c b/drivers/gpu/drm/amd/amdkfd/kfd_doorbell.c
index ad494b875311..453c5d66e5c3 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_doorbell.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_doorbell.c
@@ -186,7 +186,7 @@ u32 __iomem *kfd_get_kernel_doorbell(struct kfd_dev *kfd,
                                                         sizeof(u32)) + inx;
 
         pr_debug("kfd: get kernel queue doorbell\n"
-                         "     doorbell offset   == 0x%08d\n"
+                         "     doorbell offset   == 0x%08X\n"
                          "     kernel address    == 0x%08lX\n",
                 *doorbell_off, (uintptr_t)(kfd->doorbell_kernel_ptr + inx));
 
diff --git a/drivers/gpu/drm/amd/scheduler/gpu_scheduler.c b/drivers/gpu/drm/amd/scheduler/gpu_scheduler.c
index ef312bb75fda..963a24d46a93 100644
--- a/drivers/gpu/drm/amd/scheduler/gpu_scheduler.c
+++ b/drivers/gpu/drm/amd/scheduler/gpu_scheduler.c
@@ -405,7 +405,7 @@ void amd_sched_job_recovery(struct amd_gpu_scheduler *sched)
         spin_lock(&sched->job_list_lock);
         s_job = list_first_entry_or_null(&sched->ring_mirror_list,
                                          struct amd_sched_job, node);
-        if (s_job)
+        if (s_job && sched->timeout != MAX_SCHEDULE_TIMEOUT)
                 schedule_delayed_work(&s_job->work_tdr, sched->timeout);
 
         list_for_each_entry_safe(s_job, tmp, &sched->ring_mirror_list, node) {
diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_crtc.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_crtc.c
index a978381ef95b..9b17a66cf0e1 100644
--- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_crtc.c
+++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_crtc.c
@@ -387,7 +387,7 @@ void atmel_hlcdc_crtc_irq(struct drm_crtc *c)
         atmel_hlcdc_crtc_finish_page_flip(drm_crtc_to_atmel_hlcdc_crtc(c));
 }
 
-void atmel_hlcdc_crtc_reset(struct drm_crtc *crtc)
+static void atmel_hlcdc_crtc_reset(struct drm_crtc *crtc)
 {
         struct atmel_hlcdc_crtc_state *state;
 
diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
index 72e6b7dd457b..9d4c030672f0 100644
--- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
+++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
@@ -320,19 +320,19 @@ atmel_hlcdc_plane_update_pos_and_size(struct atmel_hlcdc_plane *plane,
                         u32 *coeff_tab = heo_upscaling_ycoef;
                         u32 max_memsize;
 
-                        if (state->crtc_w < state->src_w)
+                        if (state->crtc_h < state->src_h)
                                 coeff_tab = heo_downscaling_ycoef;
                         for (i = 0; i < ARRAY_SIZE(heo_upscaling_ycoef); i++)
                                 atmel_hlcdc_layer_update_cfg(&plane->layer,
                                                              33 + i,
                                                              0xffffffff,
                                                              coeff_tab[i]);
-                        factor = ((8 * 256 * state->src_w) - (256 * 4)) /
-                                 state->crtc_w;
+                        factor = ((8 * 256 * state->src_h) - (256 * 4)) /
+                                 state->crtc_h;
                         factor++;
-                        max_memsize = ((factor * state->crtc_w) + (256 * 4)) /
+                        max_memsize = ((factor * state->crtc_h) + (256 * 4)) /
                                       2048;
-                        if (max_memsize > state->src_w)
+                        if (max_memsize > state->src_h)
                                 factor--;
                         factor_reg |= (factor << 16) | 0x80000000;
                 }
diff --git a/drivers/gpu/drm/drm_atomic.c b/drivers/gpu/drm/drm_atomic.c
index 904d29c012ad..23739609427d 100644
--- a/drivers/gpu/drm/drm_atomic.c
+++ b/drivers/gpu/drm/drm_atomic.c
@@ -475,7 +475,7 @@ int drm_atomic_crtc_set_property(struct drm_crtc *crtc,
                                         val,
                                         -1,
                                         &replaced);
-                state->color_mgmt_changed = replaced;
+                state->color_mgmt_changed |= replaced;
                 return ret;
         } else if (property == config->ctm_property) {
                 ret = drm_atomic_replace_property_blob_from_id(crtc,
@@ -483,7 +483,7 @@ int drm_atomic_crtc_set_property(struct drm_crtc *crtc,
                                         val,
                                         sizeof(struct drm_color_ctm),
                                         &replaced);
-                state->color_mgmt_changed = replaced;
+                state->color_mgmt_changed |= replaced;
                 return ret;
         } else if (property == config->gamma_lut_property) {
                 ret = drm_atomic_replace_property_blob_from_id(crtc,
@@ -491,7 +491,7 @@ int drm_atomic_crtc_set_property(struct drm_crtc *crtc,
                                         val,
                                         -1,
                                         &replaced);
-                state->color_mgmt_changed = replaced;
+                state->color_mgmt_changed |= replaced;
                 return ret;
         } else if (crtc->funcs->atomic_set_property)
                 return crtc->funcs->atomic_set_property(crtc, state, property, val);
diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
index 5e830281bebd..03414bde1f15 100644
--- a/drivers/gpu/drm/drm_fb_helper.c
+++ b/drivers/gpu/drm/drm_fb_helper.c
@@ -466,7 +466,7 @@ static bool drm_fb_helper_is_bound(struct drm_fb_helper *fb_helper)
 
         /* Sometimes user space wants everything disabled, so don't steal the
          * display if there's a master. */
-        if (lockless_dereference(dev->master))
+        if (READ_ONCE(dev->master))
                 return false;
 
         drm_for_each_crtc(crtc, dev) {
diff --git a/drivers/gpu/drm/exynos/exynos_drm_fb.c b/drivers/gpu/drm/exynos/exynos_drm_fb.c
index e0166403b4bd..40ce841eb952 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fb.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_fb.c
@@ -55,11 +55,11 @@ static int check_fb_gem_memory_type(struct drm_device *drm_dev,
         flags = exynos_gem->flags;
 
         /*
-         * without iommu support, not support physically non-continuous memory
-         * for framebuffer.
+         * Physically non-contiguous memory type for framebuffer is not
+         * supported without IOMMU.
          */
         if (IS_NONCONTIG_BUFFER(flags)) {
-                DRM_ERROR("cannot use this gem memory type for fb.\n");
+                DRM_ERROR("Non-contiguous GEM memory is not supported.\n");
                 return -EINVAL;
         }
 
diff --git a/drivers/gpu/drm/exynos/exynos_drm_fimc.c b/drivers/gpu/drm/exynos/exynos_drm_fimc.c
index 0525c56145db..147ef0d298cb 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fimc.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_fimc.c
@@ -1753,32 +1753,6 @@ static int fimc_clk_ctrl(struct fimc_context *ctx, bool enable)
         return 0;
 }
 
-#ifdef CONFIG_PM_SLEEP
-static int fimc_suspend(struct device *dev)
-{
-        struct fimc_context *ctx = get_fimc_context(dev);
-
-        DRM_DEBUG_KMS("id[%d]\n", ctx->id);
-
-        if (pm_runtime_suspended(dev))
-                return 0;
-
-        return fimc_clk_ctrl(ctx, false);
-}
-
-static int fimc_resume(struct device *dev)
-{
-        struct fimc_context *ctx = get_fimc_context(dev);
-
-        DRM_DEBUG_KMS("id[%d]\n", ctx->id);
-
-        if (!pm_runtime_suspended(dev))
-                return fimc_clk_ctrl(ctx, true);
-
-        return 0;
-}
-#endif
-
 static int fimc_runtime_suspend(struct device *dev)
 {
         struct fimc_context *ctx = get_fimc_context(dev);
@@ -1799,7 +1773,8 @@ static int fimc_runtime_resume(struct device *dev)
 #endif
 
 static const struct dev_pm_ops fimc_pm_ops = {
-        SET_SYSTEM_SLEEP_PM_OPS(fimc_suspend, fimc_resume)
+        SET_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend,
+                                pm_runtime_force_resume)
         SET_RUNTIME_PM_OPS(fimc_runtime_suspend, fimc_runtime_resume, NULL)
 };
 
diff --git a/drivers/gpu/drm/exynos/exynos_drm_g2d.c b/drivers/gpu/drm/exynos/exynos_drm_g2d.c
index 4bf00f57ffe8..6eca8bb88648 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_g2d.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_g2d.c
@@ -1475,8 +1475,8 @@ static int g2d_remove(struct platform_device *pdev)
         return 0;
 }
 
-#ifdef CONFIG_PM_SLEEP
-static int g2d_suspend(struct device *dev)
+#ifdef CONFIG_PM
+static int g2d_runtime_suspend(struct device *dev)
 {
         struct g2d_data *g2d = dev_get_drvdata(dev);
 
@@ -1490,25 +1490,6 @@ static int g2d_suspend(struct device *dev)
 
         flush_work(&g2d->runqueue_work);
 
-        return 0;
-}
-
-static int g2d_resume(struct device *dev)
-{
-        struct g2d_data *g2d = dev_get_drvdata(dev);
-
-        g2d->suspended = false;
-        g2d_exec_runqueue(g2d);
-
-        return 0;
-}
-#endif
-
-#ifdef CONFIG_PM
-static int g2d_runtime_suspend(struct device *dev)
-{
-        struct g2d_data *g2d = dev_get_drvdata(dev);
-
         clk_disable_unprepare(g2d->gate_clk);
 
         return 0;
@@ -1523,12 +1504,16 @@ static int g2d_runtime_resume(struct device *dev)
         if (ret < 0)
                 dev_warn(dev, "failed to enable clock.\n");
 
+        g2d->suspended = false;
+        g2d_exec_runqueue(g2d);
+
         return ret;
 }
 #endif
 
 static const struct dev_pm_ops g2d_pm_ops = {
-        SET_SYSTEM_SLEEP_PM_OPS(g2d_suspend, g2d_resume)
+        SET_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend,
+                                pm_runtime_force_resume)
         SET_RUNTIME_PM_OPS(g2d_runtime_suspend, g2d_runtime_resume, NULL)
 };
 
diff --git a/drivers/gpu/drm/exynos/exynos_drm_gsc.c b/drivers/gpu/drm/exynos/exynos_drm_gsc.c
index 5d20da8f957e..52a9d269484e 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_gsc.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_gsc.c
@@ -1760,34 +1760,7 @@ static int gsc_remove(struct platform_device *pdev)
         return 0;
 }
 
-#ifdef CONFIG_PM_SLEEP
-static int gsc_suspend(struct device *dev)
-{
-        struct gsc_context *ctx = get_gsc_context(dev);
-
-        DRM_DEBUG_KMS("id[%d]\n", ctx->id);
-
-        if (pm_runtime_suspended(dev))
-                return 0;
-
-        return gsc_clk_ctrl(ctx, false);
-}
-
-static int gsc_resume(struct device *dev)
-{
-        struct gsc_context *ctx = get_gsc_context(dev);
-
-        DRM_DEBUG_KMS("id[%d]\n", ctx->id);
-
-        if (!pm_runtime_suspended(dev))
-                return gsc_clk_ctrl(ctx, true);
-
-        return 0;
-}
-#endif
-
-#ifdef CONFIG_PM
-static int gsc_runtime_suspend(struct device *dev)
+static int __maybe_unused gsc_runtime_suspend(struct device *dev)
 {
         struct gsc_context *ctx = get_gsc_context(dev);
 
@@ -1796,7 +1769,7 @@ static int gsc_runtime_suspend(struct device *dev)
         return  gsc_clk_ctrl(ctx, false);
 }
 
-static int gsc_runtime_resume(struct device *dev)
+static int __maybe_unused gsc_runtime_resume(struct device *dev)
 {
         struct gsc_context *ctx = get_gsc_context(dev);
 
@@ -1804,10 +1777,10 @@ static int gsc_runtime_resume(struct device *dev)
 
         return  gsc_clk_ctrl(ctx, true);
 }
-#endif
 
 static const struct dev_pm_ops gsc_pm_ops = {
-        SET_SYSTEM_SLEEP_PM_OPS(gsc_suspend, gsc_resume)
+        SET_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend,
+                                pm_runtime_force_resume)
         SET_RUNTIME_PM_OPS(gsc_runtime_suspend, gsc_runtime_resume, NULL)
 };
 
diff --git a/drivers/gpu/drm/exynos/exynos_drm_rotator.c b/drivers/gpu/drm/exynos/exynos_drm_rotator.c
index 404367a430b5..6591e406084c 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_rotator.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_rotator.c
@@ -794,29 +794,6 @@ static int rotator_clk_crtl(struct rot_context *rot, bool enable)
         return 0;
 }
 
-
-#ifdef CONFIG_PM_SLEEP
-static int rotator_suspend(struct device *dev)
-{
-        struct rot_context *rot = dev_get_drvdata(dev);
-
-        if (pm_runtime_suspended(dev))
-                return 0;
-
-        return rotator_clk_crtl(rot, false);
-}
-
-static int rotator_resume(struct device *dev)
-{
-        struct rot_context *rot = dev_get_drvdata(dev);
-
-        if (!pm_runtime_suspended(dev))
-                return rotator_clk_crtl(rot, true);
-
-        return 0;
-}
-#endif
-
 static int rotator_runtime_suspend(struct device *dev)
 {
         struct rot_context *rot = dev_get_drvdata(dev);
@@ -833,7 +810,8 @@ static int rotator_runtime_resume(struct device *dev)
 #endif
 
 static const struct dev_pm_ops rotator_pm_ops = {
-        SET_SYSTEM_SLEEP_PM_OPS(rotator_suspend, rotator_resume)
+        SET_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend,
+                                pm_runtime_force_resume)
         SET_RUNTIME_PM_OPS(rotator_runtime_suspend, rotator_runtime_resume,
                                                                         NULL)
 };
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index c8bd02277b7d..2c8106758922 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -2616,6 +2616,8 @@ static void i915_gem_reset_engine(struct intel_engine_cs *engine)
         list_for_each_entry_continue(request, &engine->request_list, link)
                 if (request->ctx == incomplete_ctx)
                         reset_request(request);
+
+        engine->i915->gt.active_engines &= ~intel_engine_flag(engine);
 }
 
 void i915_gem_reset(struct drm_i915_private *dev_priv)
@@ -2626,6 +2628,7 @@ void i915_gem_reset(struct drm_i915_private *dev_priv)
 
         for_each_engine(engine, dev_priv)
                 i915_gem_reset_engine(engine);
+        mod_delayed_work(dev_priv->wq, &dev_priv->gt.idle_work, 0);
 
         i915_gem_restore_fences(&dev_priv->drm);
 }
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 497d99b88468..8d4c35d55b1b 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -3601,6 +3601,8 @@ void intel_finish_reset(struct drm_i915_private *dev_priv)
 
         dev_priv->modeset_restore_state = NULL;
 
+        dev_priv->modeset_restore_state = NULL;
+
         /* reset doesn't touch the display */
         if (!gpu_reset_clobbers_display(dev_priv)) {
                 if (!state) {
diff --git a/drivers/gpu/drm/imx/ipuv3-crtc.c b/drivers/gpu/drm/imx/ipuv3-crtc.c
index 9df29f1cb16a..4e1ae3fc462d 100644
--- a/drivers/gpu/drm/imx/ipuv3-crtc.c
+++ b/drivers/gpu/drm/imx/ipuv3-crtc.c
@@ -79,6 +79,8 @@ static void ipu_crtc_atomic_disable(struct drm_crtc *crtc,
 
         /* always disable planes on the CRTC */
         drm_atomic_helper_disable_planes_on_crtc(old_crtc_state, true);
+
+        drm_crtc_vblank_off(crtc);
 }
 
 static void imx_drm_crtc_reset(struct drm_crtc *crtc)
@@ -183,6 +185,8 @@ static int ipu_crtc_atomic_check(struct drm_crtc *crtc,
 static void ipu_crtc_atomic_begin(struct drm_crtc *crtc,
                                   struct drm_crtc_state *old_crtc_state)
 {
+        drm_crtc_vblank_on(crtc);
+
         spin_lock_irq(&crtc->dev->event_lock);
         if (crtc->state->event) {
                 WARN_ON(drm_crtc_vblank_get(crtc));
diff --git a/drivers/gpu/drm/mediatek/Kconfig b/drivers/gpu/drm/mediatek/Kconfig
index 23ac8041c562..294de4549922 100644
--- a/drivers/gpu/drm/mediatek/Kconfig
+++ b/drivers/gpu/drm/mediatek/Kconfig
@@ -2,6 +2,9 @@ config DRM_MEDIATEK
         tristate "DRM Support for Mediatek SoCs"
         depends on DRM
         depends on ARCH_MEDIATEK || (ARM && COMPILE_TEST)
+        depends on COMMON_CLK
+        depends on HAVE_ARM_SMCCC
+        depends on OF
         select DRM_GEM_CMA_HELPER
         select DRM_KMS_HELPER
         select DRM_MIPI_DSI
diff --git a/drivers/gpu/drm/msm/msm_drv.h b/drivers/gpu/drm/msm/msm_drv.h
index b4bc7f1ef717..d0da52f2a806 100644
--- a/drivers/gpu/drm/msm/msm_drv.h
+++ b/drivers/gpu/drm/msm/msm_drv.h
@@ -157,6 +157,12 @@ struct msm_drm_private {
         struct shrinker shrinker;
 
         struct msm_vblank_ctrl vblank_ctrl;
+
+        /* task holding struct_mutex.. currently only used in submit path
+         * to detect and reject faults from copy_from_user() for submit
+         * ioctl.
+         */
+        struct task_struct *struct_mutex_task;
 };
 
 struct msm_format {
diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c
index 0a9b5580b2e9..b6ac27e31929 100644
--- a/drivers/gpu/drm/msm/msm_gem.c
+++ b/drivers/gpu/drm/msm/msm_gem.c
@@ -196,11 +196,20 @@ int msm_gem_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
 {
         struct drm_gem_object *obj = vma->vm_private_data;
         struct drm_device *dev = obj->dev;
+        struct msm_drm_private *priv = dev->dev_private;
         struct page **pages;
         unsigned long pfn;
         pgoff_t pgoff;
         int ret;
 
+        /* This should only happen if userspace tries to pass a mmap'd
+         * but unfaulted gem bo vaddr into submit ioctl, triggering
+         * a page fault while struct_mutex is already held.  This is
+         * not a valid use-case so just bail.
+         */
+        if (priv->struct_mutex_task == current)
+                return VM_FAULT_SIGBUS;
+
         /* Make sure we don't parallel update on a fault, nor move or remove
          * something from beneath our feet
          */
diff --git a/drivers/gpu/drm/msm/msm_gem_submit.c b/drivers/gpu/drm/msm/msm_gem_submit.c
index 3ac14cd1e5b9..b6a0f37a65f3 100644
--- a/drivers/gpu/drm/msm/msm_gem_submit.c
+++ b/drivers/gpu/drm/msm/msm_gem_submit.c
@@ -66,6 +66,14 @@ void msm_gem_submit_free(struct msm_gem_submit *submit)
         kfree(submit);
 }
 
+static inline unsigned long __must_check
+copy_from_user_inatomic(void *to, const void __user *from, unsigned long n)
+{
+        if (access_ok(VERIFY_READ, from, n))
+                return __copy_from_user_inatomic(to, from, n);
+        return -EFAULT;
+}
+
 static int submit_lookup_objects(struct msm_gem_submit *submit,
                 struct drm_msm_gem_submit *args, struct drm_file *file)
 {
@@ -73,6 +81,7 @@ static int submit_lookup_objects(struct msm_gem_submit *submit,
         int ret = 0;
 
         spin_lock(&file->table_lock);
+        pagefault_disable();
 
         for (i = 0; i < args->nr_bos; i++) {
                 struct drm_msm_gem_submit_bo submit_bo;
@@ -86,10 +95,15 @@ static int submit_lookup_objects(struct msm_gem_submit *submit,
                  */
                 submit->bos[i].flags = 0;
 
-                ret = copy_from_user(&submit_bo, userptr, sizeof(submit_bo));
-                if (ret) {
-                        ret = -EFAULT;
-                        goto out_unlock;
+                ret = copy_from_user_inatomic(&submit_bo, userptr, sizeof(submit_bo));
+                if (unlikely(ret)) {
+                        pagefault_enable();
+                        spin_unlock(&file->table_lock);
+                        ret = copy_from_user(&submit_bo, userptr, sizeof(submit_bo));
+                        if (ret)
+                                goto out;
+                        spin_lock(&file->table_lock);
+                        pagefault_disable();
                 }
 
                 if (submit_bo.flags & ~MSM_SUBMIT_BO_FLAGS) {
@@ -129,9 +143,12 @@ static int submit_lookup_objects(struct msm_gem_submit *submit,
         }
 
 out_unlock:
-        submit->nr_bos = i;
+        pagefault_enable();
         spin_unlock(&file->table_lock);
 
+out:
+        submit->nr_bos = i;
+
         return ret;
 }
 
@@ -392,6 +409,7 @@ int msm_ioctl_gem_submit(struct drm_device *dev, void *data,
                         goto out_unlock;
                 }
         }
+        priv->struct_mutex_task = current;
 
         submit = submit_create(dev, gpu, args->nr_bos, args->nr_cmds);
         if (!submit) {
@@ -531,6 +549,7 @@ out:
 out_unlock:
         if (ret && (out_fence_fd >= 0))
                 put_unused_fd(out_fence_fd);
+        priv->struct_mutex_task = NULL;
         mutex_unlock(&dev->struct_mutex);
         return ret;
 }
diff --git a/drivers/gpu/drm/nouveau/nouveau_acpi.c b/drivers/gpu/drm/nouveau/nouveau_acpi.c
index f2ad17aa33f0..dc57b628e074 100644
--- a/drivers/gpu/drm/nouveau/nouveau_acpi.c
+++ b/drivers/gpu/drm/nouveau/nouveau_acpi.c
@@ -225,6 +225,17 @@ static bool nouveau_pr3_present(struct pci_dev *pdev)
         if (!parent_pdev)
                 return false;
 
+        if (!parent_pdev->bridge_d3) {
+                /*
+                 * Parent PCI bridge is currently not power managed.
+                 * Since userspace can change these afterwards to be on
+                 * the safe side we stick with _DSM and prevent usage of
+                 * _PR3 from the bridge.
+                 */
+                pci_d3cold_disable(pdev);
+                return false;
+        }
+
         parent_adev = ACPI_COMPANION(&parent_pdev->dev);
         if (!parent_adev)
                 return false;
diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
index 4824f70b0258..a4e9f35da3a2 100644
--- a/drivers/gpu/drm/radeon/atombios_crtc.c
+++ b/drivers/gpu/drm/radeon/atombios_crtc.c
@@ -627,7 +627,9 @@ static u32 atombios_adjust_pll(struct drm_crtc *crtc,
                         if (radeon_crtc->ss.refdiv) {
                                 radeon_crtc->pll_flags |= RADEON_PLL_USE_REF_DIV;
                                 radeon_crtc->pll_reference_div = radeon_crtc->ss.refdiv;
-                                if (rdev->family >= CHIP_RV770)
+                                if (ASIC_IS_AVIVO(rdev) &&
+                                    rdev->family != CHIP_RS780 &&
+                                    rdev->family != CHIP_RS880)
                                         radeon_crtc->pll_flags |= RADEON_PLL_USE_FRAC_FB_DIV;
                         }
                 }
diff --git a/drivers/gpu/drm/radeon/radeon_atpx_handler.c b/drivers/gpu/drm/radeon/radeon_atpx_handler.c
index a1321b2fa454..2fdcd04bc93f 100644
--- a/drivers/gpu/drm/radeon/radeon_atpx_handler.c
+++ b/drivers/gpu/drm/radeon/radeon_atpx_handler.c
@@ -203,16 +203,7 @@ static int radeon_atpx_validate(struct radeon_atpx *atpx)
         atpx->is_hybrid = false;
         if (valid_bits & ATPX_MS_HYBRID_GFX_SUPPORTED) {
                 printk("ATPX Hybrid Graphics\n");
-#if 1
-                /* This is a temporary hack until the D3 cold support
-                 * makes it upstream.  The ATPX power_control method seems
-                 * to still work on even if the system should be using
-                 * the new standardized hybrid D3 cold ACPI interface.
-                 */
-                atpx->functions.power_cntl = true;
-#else
                 atpx->functions.power_cntl = false;
-#endif
                 atpx->is_hybrid = true;
         }
 
diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c
index 27ee0ab0e1a7..455268214b89 100644
--- a/drivers/gpu/drm/radeon/radeon_ttm.c
+++ b/drivers/gpu/drm/radeon/radeon_ttm.c
@@ -264,8 +264,8 @@ static int radeon_move_blit(struct ttm_buffer_object *bo,
 
         rdev = radeon_get_rdev(bo->bdev);
         ridx = radeon_copy_ring_index(rdev);
-        old_start = old_mem->start << PAGE_SHIFT;
-        new_start = new_mem->start << PAGE_SHIFT;
+        old_start = (u64)old_mem->start << PAGE_SHIFT;
+        new_start = (u64)new_mem->start << PAGE_SHIFT;
 
         switch (old_mem->mem_type) {
         case TTM_PL_VRAM:
diff --git a/drivers/gpu/drm/tegra/dsi.c b/drivers/gpu/drm/tegra/dsi.c
index 3d228ad90e0f..3dea1216bafd 100644
--- a/drivers/gpu/drm/tegra/dsi.c
+++ b/drivers/gpu/drm/tegra/dsi.c
@@ -840,6 +840,21 @@ static const struct drm_encoder_funcs tegra_dsi_encoder_funcs = {
         .destroy = tegra_output_encoder_destroy,
 };
 
+static void tegra_dsi_unprepare(struct tegra_dsi *dsi)
+{
+        int err;
+
+        if (dsi->slave)
+                tegra_dsi_unprepare(dsi->slave);
+
+        err = tegra_mipi_disable(dsi->mipi);
+        if (err < 0)
+                dev_err(dsi->dev, "failed to disable MIPI calibration: %d\n",
+                        err);
+
+        pm_runtime_put(dsi->dev);
+}
+
 static void tegra_dsi_encoder_disable(struct drm_encoder *encoder)
 {
         struct tegra_output *output = encoder_to_output(encoder);
@@ -876,7 +891,26 @@ static void tegra_dsi_encoder_disable(struct drm_encoder *encoder)
 
         tegra_dsi_disable(dsi);
 
-        pm_runtime_put(dsi->dev);
+        tegra_dsi_unprepare(dsi);
+}
+
+static void tegra_dsi_prepare(struct tegra_dsi *dsi)
+{
+        int err;
+
+        pm_runtime_get_sync(dsi->dev);
+
+        err = tegra_mipi_enable(dsi->mipi);
+        if (err < 0)
+                dev_err(dsi->dev, "failed to enable MIPI calibration: %d\n",
+                        err);
+
+        err = tegra_dsi_pad_calibrate(dsi);
+        if (err < 0)
+                dev_err(dsi->dev, "MIPI calibration failed: %d\n", err);
+
+        if (dsi->slave)
+                tegra_dsi_prepare(dsi->slave);
 }
 
 static void tegra_dsi_encoder_enable(struct drm_encoder *encoder)
@@ -887,13 +921,8 @@ static void tegra_dsi_encoder_enable(struct drm_encoder *encoder)
         struct tegra_dsi *dsi = to_dsi(output);
         struct tegra_dsi_state *state;
         u32 value;
-        int err;
-
-        pm_runtime_get_sync(dsi->dev);
 
-        err = tegra_dsi_pad_calibrate(dsi);
-        if (err < 0)
-                dev_err(dsi->dev, "MIPI calibration failed: %d\n", err);
+        tegra_dsi_prepare(dsi);
 
         state = tegra_dsi_get_state(dsi);
 
diff --git a/drivers/gpu/drm/vc4/vc4_bo.c b/drivers/gpu/drm/vc4/vc4_bo.c
index 59adcf8532dd..3f6704cf6608 100644
--- a/drivers/gpu/drm/vc4/vc4_bo.c
+++ b/drivers/gpu/drm/vc4/vc4_bo.c
@@ -144,7 +144,7 @@ static struct list_head *vc4_get_cache_list_for_size(struct drm_device *dev,
         return &vc4->bo_cache.size_list[page_index];
 }
 
-void vc4_bo_cache_purge(struct drm_device *dev)
+static void vc4_bo_cache_purge(struct drm_device *dev)
 {
         struct vc4_dev *vc4 = to_vc4_dev(dev);
 
diff --git a/drivers/gpu/drm/vc4/vc4_drv.c b/drivers/gpu/drm/vc4/vc4_drv.c
index 3c9e7f64b926..8703f56b7947 100644
--- a/drivers/gpu/drm/vc4/vc4_drv.c
+++ b/drivers/gpu/drm/vc4/vc4_drv.c
@@ -58,21 +58,21 @@ static int vc4_get_param_ioctl(struct drm_device *dev, void *data,
         switch (args->param) {
         case DRM_VC4_PARAM_V3D_IDENT0:
                 ret = pm_runtime_get_sync(&vc4->v3d->pdev->dev);
-                if (ret)
+                if (ret < 0)
                         return ret;
                 args->value = V3D_READ(V3D_IDENT0);
                 pm_runtime_put(&vc4->v3d->pdev->dev);
                 break;
         case DRM_VC4_PARAM_V3D_IDENT1:
                 ret = pm_runtime_get_sync(&vc4->v3d->pdev->dev);
-                if (ret)
+                if (ret < 0)
                         return ret;
                 args->value = V3D_READ(V3D_IDENT1);
                 pm_runtime_put(&vc4->v3d->pdev->dev);
                 break;
         case DRM_VC4_PARAM_V3D_IDENT2:
                 ret = pm_runtime_get_sync(&vc4->v3d->pdev->dev);
-                if (ret)
+                if (ret < 0)
                         return ret;
                 args->value = V3D_READ(V3D_IDENT2);
                 pm_runtime_put(&vc4->v3d->pdev->dev);
diff --git a/drivers/gpu/drm/vc4/vc4_drv.h b/drivers/gpu/drm/vc4/vc4_drv.h
index 489e3de0c050..428e24919ef1 100644
--- a/drivers/gpu/drm/vc4/vc4_drv.h
+++ b/drivers/gpu/drm/vc4/vc4_drv.h
@@ -321,6 +321,15 @@ vc4_first_render_job(struct vc4_dev *vc4)
                                 struct vc4_exec_info, head);
 }
 
+static inline struct vc4_exec_info *
+vc4_last_render_job(struct vc4_dev *vc4)
+{
+        if (list_empty(&vc4->render_job_list))
+                return NULL;
+        return list_last_entry(&vc4->render_job_list,
+                               struct vc4_exec_info, head);
+}
+
 /**
  * struct vc4_texture_sample_info - saves the offsets into the UBO for texture
  * setup parameters.
diff --git a/drivers/gpu/drm/vc4/vc4_gem.c b/drivers/gpu/drm/vc4/vc4_gem.c
index 27c52ec35193..77daea6cb866 100644
--- a/drivers/gpu/drm/vc4/vc4_gem.c
+++ b/drivers/gpu/drm/vc4/vc4_gem.c
@@ -530,8 +530,8 @@ vc4_cl_lookup_bos(struct drm_device *dev,
                 return -EINVAL;
         }
 
-        exec->bo = kcalloc(exec->bo_count, sizeof(struct drm_gem_cma_object *),
-                           GFP_KERNEL);
+        exec->bo = drm_calloc_large(exec->bo_count,
+                                    sizeof(struct drm_gem_cma_object *));
         if (!exec->bo) {
                 DRM_ERROR("Failed to allocate validated BO pointers\n");
                 return -ENOMEM;
@@ -568,8 +568,8 @@ vc4_cl_lookup_bos(struct drm_device *dev,
         spin_unlock(&file_priv->table_lock);
 
 fail:
-        kfree(handles);
-        return 0;
+        drm_free_large(handles);
+        return ret;
 }
 
 static int
@@ -604,7 +604,7 @@ vc4_get_bcl(struct drm_device *dev, struct vc4_exec_info *exec)
          * read the contents back for validation, and I think the
          * bo->vaddr is uncached access.
          */
-        temp = kmalloc(temp_size, GFP_KERNEL);
+        temp = drm_malloc_ab(temp_size, 1);
         if (!temp) {
                 DRM_ERROR("Failed to allocate storage for copying "
                           "in bin/render CLs.\n");
@@ -671,7 +671,7 @@ vc4_get_bcl(struct drm_device *dev, struct vc4_exec_info *exec)
         ret = vc4_validate_shader_recs(dev, exec);
 
 fail:
-        kfree(temp);
+        drm_free_large(temp);
         return ret;
 }
 
@@ -684,7 +684,7 @@ vc4_complete_exec(struct drm_device *dev, struct vc4_exec_info *exec)
         if (exec->bo) {
                 for (i = 0; i < exec->bo_count; i++)
                         drm_gem_object_unreference_unlocked(&exec->bo[i]->base);
-                kfree(exec->bo);
+                drm_free_large(exec->bo);
         }
 
         while (!list_empty(&exec->unref_list)) {
@@ -938,8 +938,8 @@ vc4_gem_destroy(struct drm_device *dev)
                 vc4->overflow_mem = NULL;
         }
 
-        vc4_bo_cache_destroy(dev);
-
         if (vc4->hang_state)
                 vc4_free_hang_state(dev, vc4->hang_state);
+
+        vc4_bo_cache_destroy(dev);
 }
diff --git a/drivers/gpu/drm/vc4/vc4_irq.c b/drivers/gpu/drm/vc4/vc4_irq.c
index b0104a346a74..094bc6a475c1 100644
--- a/drivers/gpu/drm/vc4/vc4_irq.c
+++ b/drivers/gpu/drm/vc4/vc4_irq.c
@@ -83,8 +83,10 @@ vc4_overflow_mem_work(struct work_struct *work)
 
                 spin_lock_irqsave(&vc4->job_lock, irqflags);
                 current_exec = vc4_first_bin_job(vc4);
+                if (!current_exec)
+                        current_exec = vc4_last_render_job(vc4);
                 if (current_exec) {
-                        vc4->overflow_mem->seqno = vc4->finished_seqno + 1;
+                        vc4->overflow_mem->seqno = current_exec->seqno;
                         list_add_tail(&vc4->overflow_mem->unref_head,
                                       &current_exec->unref_list);
                         vc4->overflow_mem = NULL;
diff --git a/drivers/gpu/drm/vc4/vc4_validate_shaders.c b/drivers/gpu/drm/vc4/vc4_validate_shaders.c
index 46527e989ce3..2543cf5b8b51 100644
--- a/drivers/gpu/drm/vc4/vc4_validate_shaders.c
+++ b/drivers/gpu/drm/vc4/vc4_validate_shaders.c
@@ -309,8 +309,14 @@ validate_uniform_address_write(struct vc4_validated_shader_info *validated_shade
          * of uniforms on each side.  However, this scheme is easy to
          * validate so it's all we allow for now.
          */
-
-        if (QPU_GET_FIELD(inst, QPU_SIG) != QPU_SIG_NONE) {
+        switch (QPU_GET_FIELD(inst, QPU_SIG)) {
+        case QPU_SIG_NONE:
+        case QPU_SIG_SCOREBOARD_UNLOCK:
+        case QPU_SIG_COLOR_LOAD:
+        case QPU_SIG_LOAD_TMU0:
+        case QPU_SIG_LOAD_TMU1:
+                break;
+        default:
                 DRM_ERROR("uniforms address change must be "
                           "normal math\n");
                 return false;
diff --git a/drivers/gpu/host1x/mipi.c b/drivers/gpu/host1x/mipi.c
index 52a6fd224127..e00809d996a2 100644
--- a/drivers/gpu/host1x/mipi.c
+++ b/drivers/gpu/host1x/mipi.c
@@ -242,20 +242,6 @@ struct tegra_mipi_device *tegra_mipi_request(struct device *device)
         dev->pads = args.args[0];
         dev->device = device;
 
-        mutex_lock(&dev->mipi->lock);
-
-        if (dev->mipi->usage_count++ == 0) {
-                err = tegra_mipi_power_up(dev->mipi);
-                if (err < 0) {
-                        dev_err(dev->mipi->dev,
-                                "failed to power up MIPI bricks: %d\n",
-                                err);
-                        return ERR_PTR(err);
-                }
-        }
-
-        mutex_unlock(&dev->mipi->lock);
-
         return dev;
 
 put:
@@ -270,29 +256,42 @@ EXPORT_SYMBOL(tegra_mipi_request);
 
 void tegra_mipi_free(struct tegra_mipi_device *device)
 {
-        int err;
+        platform_device_put(device->pdev);
+        kfree(device);
+}
+EXPORT_SYMBOL(tegra_mipi_free);
 
-        mutex_lock(&device->mipi->lock);
+int tegra_mipi_enable(struct tegra_mipi_device *dev)
+{
+        int err = 0;
 
-        if (--device->mipi->usage_count == 0) {
-                err = tegra_mipi_power_down(device->mipi);
-                if (err < 0) {
-                        /*
-                         * Not much that can be done here, so an error message
-                         * will have to do.
-                         */
-                        dev_err(device->mipi->dev,
-                                "failed to power down MIPI bricks: %d\n",
-                                err);
-                }
-        }
+        mutex_lock(&dev->mipi->lock);
 
-        mutex_unlock(&device->mipi->lock);
+        if (dev->mipi->usage_count++ == 0)
+                err = tegra_mipi_power_up(dev->mipi);
+
+        mutex_unlock(&dev->mipi->lock);
+
+        return err;
 
-        platform_device_put(device->pdev);
-        kfree(device);
 }
-EXPORT_SYMBOL(tegra_mipi_free);
+EXPORT_SYMBOL(tegra_mipi_enable);
+
+int tegra_mipi_disable(struct tegra_mipi_device *dev)
+{
+        int err = 0;
+
+        mutex_lock(&dev->mipi->lock);
+
+        if (--dev->mipi->usage_count == 0)
+                err = tegra_mipi_power_down(dev->mipi);
+
+        mutex_unlock(&dev->mipi->lock);
+
+        return err;
+
+}
+EXPORT_SYMBOL(tegra_mipi_disable);
 
 static int tegra_mipi_wait(struct tegra_mipi *mipi)
 {
diff --git a/drivers/hwmon/it87.c b/drivers/hwmon/it87.c
index 730d84028260..4667012b46b7 100644
--- a/drivers/hwmon/it87.c
+++ b/drivers/hwmon/it87.c
@@ -491,7 +491,7 @@ struct it87_sio_data {
 struct it87_data {
         const struct attribute_group *groups[7];
         enum chips type;
-        u16 features;
+        u32 features;
         u8 peci_mask;
         u8 old_peci_mask;
 
@@ -2015,6 +2015,7 @@ static struct attribute *it87_attributes_in[] = {
         &sensor_dev_attr_in10_input.dev_attr.attr,      /* 41 */
         &sensor_dev_attr_in11_input.dev_attr.attr,      /* 41 */
         &sensor_dev_attr_in12_input.dev_attr.attr,      /* 41 */
+        NULL
 };
 
 static const struct attribute_group it87_group_in = {
diff --git a/drivers/i2c/busses/i2c-at91.c b/drivers/i2c/busses/i2c-at91.c
index f23372669f77..1bb97f658b47 100644
--- a/drivers/i2c/busses/i2c-at91.c
+++ b/drivers/i2c/busses/i2c-at91.c
@@ -38,6 +38,7 @@
 #define AT91_I2C_TIMEOUT        msecs_to_jiffies(100)   /* transfer timeout */
 #define AT91_I2C_DMA_THRESHOLD  8                       /* enable DMA if transfer size is bigger than this threshold */
 #define AUTOSUSPEND_TIMEOUT             2000
+#define AT91_I2C_MAX_ALT_CMD_DATA_SIZE  256
 
 /* AT91 TWI register definitions */
 #define AT91_TWI_CR             0x0000  /* Control Register */
@@ -141,6 +142,7 @@ struct at91_twi_dev {
         unsigned twi_cwgr_reg;
         struct at91_twi_pdata *pdata;
         bool use_dma;
+        bool use_alt_cmd;
         bool recv_len_abort;
         u32 fifo_size;
         struct at91_twi_dma dma;
@@ -269,7 +271,7 @@ static void at91_twi_write_next_byte(struct at91_twi_dev *dev)
 
         /* send stop when last byte has been written */
         if (--dev->buf_len == 0)
-                if (!dev->pdata->has_alt_cmd)
+                if (!dev->use_alt_cmd)
                         at91_twi_write(dev, AT91_TWI_CR, AT91_TWI_STOP);
 
         dev_dbg(dev->dev, "wrote 0x%x, to go %d\n", *dev->buf, dev->buf_len);
@@ -292,7 +294,7 @@ static void at91_twi_write_data_dma_callback(void *data)
          * we just have to enable TXCOMP one.
          */
         at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_TXCOMP);
-        if (!dev->pdata->has_alt_cmd)
+        if (!dev->use_alt_cmd)
                 at91_twi_write(dev, AT91_TWI_CR, AT91_TWI_STOP);
 }
 
@@ -410,7 +412,7 @@ static void at91_twi_read_next_byte(struct at91_twi_dev *dev)
         }
 
         /* send stop if second but last byte has been read */
-        if (!dev->pdata->has_alt_cmd && dev->buf_len == 1)
+        if (!dev->use_alt_cmd && dev->buf_len == 1)
                 at91_twi_write(dev, AT91_TWI_CR, AT91_TWI_STOP);
 
         dev_dbg(dev->dev, "read 0x%x, to go %d\n", *dev->buf, dev->buf_len);
@@ -426,7 +428,7 @@ static void at91_twi_read_data_dma_callback(void *data)
         dma_unmap_single(dev->dev, sg_dma_address(&dev->dma.sg[0]),
                          dev->buf_len, DMA_FROM_DEVICE);
 
-        if (!dev->pdata->has_alt_cmd) {
+        if (!dev->use_alt_cmd) {
                 /* The last two bytes have to be read without using dma */
                 dev->buf += dev->buf_len - 2;
                 dev->buf_len = 2;
@@ -443,7 +445,7 @@ static void at91_twi_read_data_dma(struct at91_twi_dev *dev)
         struct dma_chan *chan_rx = dma->chan_rx;
         size_t buf_len;
 
-        buf_len = (dev->pdata->has_alt_cmd) ? dev->buf_len : dev->buf_len - 2;
+        buf_len = (dev->use_alt_cmd) ? dev->buf_len : dev->buf_len - 2;
         dma->direction = DMA_FROM_DEVICE;
 
         /* Keep in mind that we won't use dma to read the last two bytes */
@@ -651,7 +653,7 @@ static int at91_do_twi_transfer(struct at91_twi_dev *dev)
                 unsigned start_flags = AT91_TWI_START;
 
                 /* if only one byte is to be read, immediately stop transfer */
-                if (!has_alt_cmd && dev->buf_len <= 1 &&
+                if (!dev->use_alt_cmd && dev->buf_len <= 1 &&
                     !(dev->msg->flags & I2C_M_RECV_LEN))
                         start_flags |= AT91_TWI_STOP;
                 at91_twi_write(dev, AT91_TWI_CR, start_flags);
@@ -745,7 +747,7 @@ static int at91_twi_xfer(struct i2c_adapter *adap, struct i2c_msg *msg, int num)
         int ret;
         unsigned int_addr_flag = 0;
         struct i2c_msg *m_start = msg;
-        bool is_read, use_alt_cmd = false;
+        bool is_read;
 
         dev_dbg(&adap->dev, "at91_xfer: processing %d messages:\n", num);
 
@@ -768,14 +770,16 @@ static int at91_twi_xfer(struct i2c_adapter *adap, struct i2c_msg *msg, int num)
                 at91_twi_write(dev, AT91_TWI_IADR, internal_address);
         }
 
+        dev->use_alt_cmd = false;
         is_read = (m_start->flags & I2C_M_RD);
         if (dev->pdata->has_alt_cmd) {
-                if (m_start->len > 0) {
+                if (m_start->len > 0 &&
+                    m_start->len < AT91_I2C_MAX_ALT_CMD_DATA_SIZE) {
                         at91_twi_write(dev, AT91_TWI_CR, AT91_TWI_ACMEN);
                         at91_twi_write(dev, AT91_TWI_ACR,
                                        AT91_TWI_ACR_DATAL(m_start->len) |
                                        ((is_read) ? AT91_TWI_ACR_DIR : 0));
-                        use_alt_cmd = true;
+                        dev->use_alt_cmd = true;
                 } else {
                         at91_twi_write(dev, AT91_TWI_CR, AT91_TWI_ACMDIS);
                 }
@@ -784,7 +788,7 @@ static int at91_twi_xfer(struct i2c_adapter *adap, struct i2c_msg *msg, int num)
         at91_twi_write(dev, AT91_TWI_MMR,
                        (m_start->addr << 16) |
                        int_addr_flag |
-                       ((!use_alt_cmd && is_read) ? AT91_TWI_MREAD : 0));
+                       ((!dev->use_alt_cmd && is_read) ? AT91_TWI_MREAD : 0));
 
         dev->buf_len = m_start->len;
         dev->buf = m_start->buf;
diff --git a/drivers/i2c/busses/i2c-bcm-iproc.c b/drivers/i2c/busses/i2c-bcm-iproc.c
index 19c843828fe2..95f7cac76f89 100644
--- a/drivers/i2c/busses/i2c-bcm-iproc.c
+++ b/drivers/i2c/busses/i2c-bcm-iproc.c
@@ -158,7 +158,7 @@ static irqreturn_t bcm_iproc_i2c_isr(int irq, void *data)
 
         if (status & BIT(IS_M_START_BUSY_SHIFT)) {
                 iproc_i2c->xfer_is_done = 1;
-                complete_all(&iproc_i2c->done);
+                complete(&iproc_i2c->done);
         }
 
         writel(status, iproc_i2c->base + IS_OFFSET);
diff --git a/drivers/i2c/busses/i2c-bcm-kona.c b/drivers/i2c/busses/i2c-bcm-kona.c
index ac9f47679c3a..258cb9a40ab3 100644
--- a/drivers/i2c/busses/i2c-bcm-kona.c
+++ b/drivers/i2c/busses/i2c-bcm-kona.c
@@ -229,7 +229,7 @@ static irqreturn_t bcm_kona_i2c_isr(int irq, void *devid)
                        dev->base + TXFCR_OFFSET);
 
         writel(status & ~ISR_RESERVED_MASK, dev->base + ISR_OFFSET);
-        complete_all(&dev->done);
+        complete(&dev->done);
 
         return IRQ_HANDLED;
 }
@@ -643,7 +643,7 @@ static int bcm_kona_i2c_xfer(struct i2c_adapter *adapter,
                         if (rc < 0) {
                                 dev_err(dev->device,
                                         "restart cmd failed rc = %d\n", rc);
-                                        goto xfer_send_stop;
+                                goto xfer_send_stop;
                         }
                 }
 
diff --git a/drivers/i2c/busses/i2c-brcmstb.c b/drivers/i2c/busses/i2c-brcmstb.c
index 3f5a4d71d3bf..385b57bfcb38 100644
--- a/drivers/i2c/busses/i2c-brcmstb.c
+++ b/drivers/i2c/busses/i2c-brcmstb.c
@@ -228,7 +228,7 @@ static irqreturn_t brcmstb_i2c_isr(int irq, void *devid)
                 return IRQ_NONE;
 
         brcmstb_i2c_enable_disable_irq(dev, INT_DISABLE);
-        complete_all(&dev->done);
+        complete(&dev->done);
 
         dev_dbg(dev->device, "isr handled");
         return IRQ_HANDLED;
diff --git a/drivers/i2c/busses/i2c-cadence.c b/drivers/i2c/busses/i2c-cadence.c
index 90bbd9f9dd8f..3c16a2f7c673 100644
--- a/drivers/i2c/busses/i2c-cadence.c
+++ b/drivers/i2c/busses/i2c-cadence.c
@@ -767,7 +767,7 @@ static int cdns_i2c_setclk(unsigned long clk_in, struct cdns_i2c *id)
  * depending on the scaling direction.
  *
  * Return:      NOTIFY_STOP if the rate change should be aborted, NOTIFY_OK
- *              to acknowedge the change, NOTIFY_DONE if the notification is
+ *              to acknowledge the change, NOTIFY_DONE if the notification is
  *              considered irrelevant.
  */
 static int cdns_i2c_clk_notifier_cb(struct notifier_block *nb, unsigned long
diff --git a/drivers/i2c/busses/i2c-cros-ec-tunnel.c b/drivers/i2c/busses/i2c-cros-ec-tunnel.c
index a0d95ff682ae..2d5ff86398d0 100644
--- a/drivers/i2c/busses/i2c-cros-ec-tunnel.c
+++ b/drivers/i2c/busses/i2c-cros-ec-tunnel.c
@@ -215,7 +215,7 @@ static int ec_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg i2c_msgs[],
         msg->outsize = request_len;
         msg->insize = response_len;
 
-        result = cros_ec_cmd_xfer(bus->ec, msg);
+        result = cros_ec_cmd_xfer_status(bus->ec, msg);
         if (result < 0) {
                 dev_err(dev, "Error transferring EC i2c message %d\n", result);
                 goto exit;
diff --git a/drivers/i2c/busses/i2c-designware-core.c b/drivers/i2c/busses/i2c-designware-core.c
index c6922b806fb7..fcd973d5131e 100644
--- a/drivers/i2c/busses/i2c-designware-core.c
+++ b/drivers/i2c/busses/i2c-designware-core.c
@@ -367,13 +367,17 @@ int i2c_dw_init(struct dw_i2c_dev *dev)
         dev_dbg(dev->dev, "Fast-mode HCNT:LCNT = %d:%d\n", hcnt, lcnt);
 
         /* Configure SDA Hold Time if required */
-        if (dev->sda_hold_time) {
-                reg = dw_readl(dev, DW_IC_COMP_VERSION);
-                if (reg >= DW_IC_SDA_HOLD_MIN_VERS)
+        reg = dw_readl(dev, DW_IC_COMP_VERSION);
+        if (reg >= DW_IC_SDA_HOLD_MIN_VERS) {
+                if (dev->sda_hold_time) {
                         dw_writel(dev, dev->sda_hold_time, DW_IC_SDA_HOLD);
-                else
-                        dev_warn(dev->dev,
-                                "Hardware too old to adjust SDA hold time.");
+                } else {
+                        /* Keep previous hold time setting if no one set it */
+                        dev->sda_hold_time = dw_readl(dev, DW_IC_SDA_HOLD);
+                }
+        } else {
+                dev_warn(dev->dev,
+                        "Hardware too old to adjust SDA hold time.\n");
         }
 
         /* Configure Tx/Rx FIFO threshold levels */
diff --git a/drivers/i2c/busses/i2c-eg20t.c b/drivers/i2c/busses/i2c-eg20t.c
index 137125b5eae7..5ce71ce7b6c4 100644
--- a/drivers/i2c/busses/i2c-eg20t.c
+++ b/drivers/i2c/busses/i2c-eg20t.c
@@ -773,13 +773,6 @@ static int pch_i2c_probe(struct pci_dev *pdev,
         /* Set the number of I2C channel instance */
         adap_info->ch_num = id->driver_data;
 
-        ret = request_irq(pdev->irq, pch_i2c_handler, IRQF_SHARED,
-                  KBUILD_MODNAME, adap_info);
-        if (ret) {
-                pch_pci_err(pdev, "request_irq FAILED\n");
-                goto err_request_irq;
-        }
-
         for (i = 0; i < adap_info->ch_num; i++) {
                 pch_adap = &adap_info->pch_data[i].pch_adapter;
                 adap_info->pch_i2c_suspended = false;
@@ -797,6 +790,17 @@ static int pch_i2c_probe(struct pci_dev *pdev,
 
                 pch_adap->dev.of_node = pdev->dev.of_node;
                 pch_adap->dev.parent = &pdev->dev;
+        }
+
+        ret = request_irq(pdev->irq, pch_i2c_handler, IRQF_SHARED,
+                  KBUILD_MODNAME, adap_info);
+        if (ret) {
+                pch_pci_err(pdev, "request_irq FAILED\n");
+                goto err_request_irq;
+        }
+
+        for (i = 0; i < adap_info->ch_num; i++) {
+                pch_adap = &adap_info->pch_data[i].pch_adapter;
 
                 pch_i2c_init(&adap_info->pch_data[i]);
 
diff --git a/drivers/i2c/busses/i2c-meson.c b/drivers/i2c/busses/i2c-meson.c
index 71d3929adf54..76e28980904f 100644
--- a/drivers/i2c/busses/i2c-meson.c
+++ b/drivers/i2c/busses/i2c-meson.c
@@ -211,7 +211,7 @@ static void meson_i2c_stop(struct meson_i2c *i2c)
                 meson_i2c_add_token(i2c, TOKEN_STOP);
         } else {
                 i2c->state = STATE_IDLE;
-                complete_all(&i2c->done);
+                complete(&i2c->done);
         }
 }
 
@@ -238,7 +238,7 @@ static irqreturn_t meson_i2c_irq(int irqno, void *dev_id)
                 dev_dbg(i2c->dev, "error bit set\n");
                 i2c->error = -ENXIO;
                 i2c->state = STATE_IDLE;
-                complete_all(&i2c->done);
+                complete(&i2c->done);
                 goto out;
         }
 
@@ -269,7 +269,7 @@ static irqreturn_t meson_i2c_irq(int irqno, void *dev_id)
                 break;
         case STATE_STOP:
                 i2c->state = STATE_IDLE;
-                complete_all(&i2c->done);
+                complete(&i2c->done);
                 break;
         case STATE_IDLE:
                 break;
diff --git a/drivers/i2c/busses/i2c-ocores.c b/drivers/i2c/busses/i2c-ocores.c
index dfa7a4b4a91d..ac88a524143e 100644
--- a/drivers/i2c/busses/i2c-ocores.c
+++ b/drivers/i2c/busses/i2c-ocores.c
@@ -379,6 +379,7 @@ static int ocores_i2c_of_probe(struct platform_device *pdev,
                         if (!clock_frequency_present) {
                                 dev_err(&pdev->dev,
                                         "Missing required parameter 'opencores,ip-clock-frequency'\n");
+                                clk_disable_unprepare(i2c->clk);
                                 return -ENODEV;
                         }
                         i2c->ip_clock_khz = clock_frequency / 1000;
@@ -467,20 +468,21 @@ static int ocores_i2c_probe(struct platform_device *pdev)
                 default:
                         dev_err(&pdev->dev, "Unsupported I/O width (%d)\n",
                                 i2c->reg_io_width);
-                        return -EINVAL;
+                        ret = -EINVAL;
+                        goto err_clk;
                 }
         }
 
         ret = ocores_init(&pdev->dev, i2c);
         if (ret)
-                return ret;
+                goto err_clk;
 
         init_waitqueue_head(&i2c->wait);
         ret = devm_request_irq(&pdev->dev, irq, ocores_isr, 0,
                                pdev->name, i2c);
         if (ret) {
                 dev_err(&pdev->dev, "Cannot claim IRQ\n");
-                return ret;
+                goto err_clk;
         }
 
         /* hook up driver to tree */
@@ -494,7 +496,7 @@ static int ocores_i2c_probe(struct platform_device *pdev)
         ret = i2c_add_adapter(&i2c->adap);
         if (ret) {
                 dev_err(&pdev->dev, "Failed to add adapter\n");
-                return ret;
+                goto err_clk;
         }
 
         /* add in known devices to the bus */
@@ -504,6 +506,10 @@ static int ocores_i2c_probe(struct platform_device *pdev)
         }
 
         return 0;
+
+err_clk:
+        clk_disable_unprepare(i2c->clk);
+        return ret;
 }
 
 static int ocores_i2c_remove(struct platform_device *pdev)
diff --git a/drivers/i2c/busses/i2c-qup.c b/drivers/i2c/busses/i2c-qup.c
index 501bd15cb78e..a8497cfdae6f 100644
--- a/drivers/i2c/busses/i2c-qup.c
+++ b/drivers/i2c/busses/i2c-qup.c
@@ -1599,7 +1599,8 @@ static int qup_i2c_pm_resume_runtime(struct device *device)
 #ifdef CONFIG_PM_SLEEP
 static int qup_i2c_suspend(struct device *device)
 {
-        qup_i2c_pm_suspend_runtime(device);
+        if (!pm_runtime_suspended(device))
+                return qup_i2c_pm_suspend_runtime(device);
         return 0;
 }
 
diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c
index 52407f3c9e1c..9bd849dacee8 100644
--- a/drivers/i2c/busses/i2c-rcar.c
+++ b/drivers/i2c/busses/i2c-rcar.c
@@ -378,7 +378,7 @@ static void rcar_i2c_dma(struct rcar_i2c_priv *priv)
         }
 
         dma_addr = dma_map_single(chan->device->dev, buf, len, dir);
-        if (dma_mapping_error(dev, dma_addr)) {
+        if (dma_mapping_error(chan->device->dev, dma_addr)) {
                 dev_dbg(dev, "dma map failed, using PIO\n");
                 return;
         }
diff --git a/drivers/i2c/busses/i2c-rk3x.c b/drivers/i2c/busses/i2c-rk3x.c
index 2bc8b01153d6..5c5b7cada8be 100644
--- a/drivers/i2c/busses/i2c-rk3x.c
+++ b/drivers/i2c/busses/i2c-rk3x.c
@@ -918,7 +918,7 @@ static void rk3x_i2c_adapt_div(struct rk3x_i2c *i2c, unsigned long clk_rate)
  * Code adapted from i2c-cadence.c.
  *
  * Return:      NOTIFY_STOP if the rate change should be aborted, NOTIFY_OK
- *              to acknowedge the change, NOTIFY_DONE if the notification is
+ *              to acknowledge the change, NOTIFY_DONE if the notification is
  *              considered irrelevant.
  */
 static int rk3x_i2c_clk_notifier_cb(struct notifier_block *nb, unsigned long
@@ -1111,6 +1111,15 @@ static int rk3x_i2c_xfer(struct i2c_adapter *adap,
         return ret < 0 ? ret : num;
 }
 
+static __maybe_unused int rk3x_i2c_resume(struct device *dev)
+{
+        struct rk3x_i2c *i2c = dev_get_drvdata(dev);
+
+        rk3x_i2c_adapt_div(i2c, clk_get_rate(i2c->clk));
+
+        return 0;
+}
+
 static u32 rk3x_i2c_func(struct i2c_adapter *adap)
 {
         return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL | I2C_FUNC_PROTOCOL_MANGLING;
@@ -1334,12 +1343,15 @@ static int rk3x_i2c_remove(struct platform_device *pdev)
         return 0;
 }
 
+static SIMPLE_DEV_PM_OPS(rk3x_i2c_pm_ops, NULL, rk3x_i2c_resume);
+
 static struct platform_driver rk3x_i2c_driver = {
         .probe   = rk3x_i2c_probe,
         .remove  = rk3x_i2c_remove,
         .driver  = {
                 .name  = "rk3x-i2c",
                 .of_match_table = rk3x_i2c_match,
+                .pm = &rk3x_i2c_pm_ops,
         },
 };
 
diff --git a/drivers/i2c/busses/i2c-sh_mobile.c b/drivers/i2c/busses/i2c-sh_mobile.c
index 6fb3e2645992..05b1eeab9cf5 100644
--- a/drivers/i2c/busses/i2c-sh_mobile.c
+++ b/drivers/i2c/busses/i2c-sh_mobile.c
@@ -610,7 +610,7 @@ static void sh_mobile_i2c_xfer_dma(struct sh_mobile_i2c_data *pd)
                 return;
 
         dma_addr = dma_map_single(chan->device->dev, pd->msg->buf, pd->msg->len, dir);
-        if (dma_mapping_error(pd->dev, dma_addr)) {
+        if (dma_mapping_error(chan->device->dev, dma_addr)) {
                 dev_dbg(pd->dev, "dma map failed, using PIO\n");
                 return;
         }
diff --git a/drivers/i2c/muxes/i2c-demux-pinctrl.c b/drivers/i2c/muxes/i2c-demux-pinctrl.c
index 8de073aed001..b3893f6282ba 100644
--- a/drivers/i2c/muxes/i2c-demux-pinctrl.c
+++ b/drivers/i2c/muxes/i2c-demux-pinctrl.c
@@ -37,8 +37,6 @@ struct i2c_demux_pinctrl_priv {
         struct i2c_demux_pinctrl_chan chan[];
 };
 
-static struct property status_okay = { .name = "status", .length = 3, .value = "ok" };
-
 static int i2c_demux_master_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[], int num)
 {
         struct i2c_demux_pinctrl_priv *priv = adap->algo_data;
@@ -68,7 +66,7 @@ static int i2c_demux_activate_master(struct i2c_demux_pinctrl_priv *priv, u32 ne
         adap = of_find_i2c_adapter_by_node(priv->chan[new_chan].parent_np);
         if (!adap) {
                 ret = -ENODEV;
-                goto err;
+                goto err_with_revert;
         }
 
         p = devm_pinctrl_get_select(adap->dev.parent, priv->bus_name);
@@ -103,8 +101,11 @@ static int i2c_demux_activate_master(struct i2c_demux_pinctrl_priv *priv, u32 ne
 
  err_with_put:
         i2c_put_adapter(adap);
+ err_with_revert:
+        of_changeset_revert(&priv->chan[new_chan].chgset);
  err:
         dev_err(priv->dev, "failed to setup demux-adapter %d (%d)\n", new_chan, ret);
+        priv->cur_chan = -EINVAL;
         return ret;
 }
 
@@ -190,6 +191,7 @@ static int i2c_demux_pinctrl_probe(struct platform_device *pdev)
 {
         struct device_node *np = pdev->dev.of_node;
         struct i2c_demux_pinctrl_priv *priv;
+        struct property *props;
         int num_chan, i, j, err;
 
         num_chan = of_count_phandle_with_args(np, "i2c-parent", NULL);
@@ -200,7 +202,10 @@ static int i2c_demux_pinctrl_probe(struct platform_device *pdev)
 
         priv = devm_kzalloc(&pdev->dev, sizeof(*priv)
                            + num_chan * sizeof(struct i2c_demux_pinctrl_chan), GFP_KERNEL);
-        if (!priv)
+
+        props = devm_kcalloc(&pdev->dev, num_chan, sizeof(*props), GFP_KERNEL);
+
+        if (!priv || !props)
                 return -ENOMEM;
 
         err = of_property_read_string(np, "i2c-bus-name", &priv->bus_name);
@@ -218,8 +223,12 @@ static int i2c_demux_pinctrl_probe(struct platform_device *pdev)
                 }
                 priv->chan[i].parent_np = adap_np;
 
+                props[i].name = devm_kstrdup(&pdev->dev, "status", GFP_KERNEL);
+                props[i].value = devm_kstrdup(&pdev->dev, "ok", GFP_KERNEL);
+                props[i].length = 3;
+
                 of_changeset_init(&priv->chan[i].chgset);
-                of_changeset_update_property(&priv->chan[i].chgset, adap_np, &status_okay);
+                of_changeset_update_property(&priv->chan[i].chgset, adap_np, &props[i]);
         }
 
         priv->num_chan = num_chan;
diff --git a/drivers/i2c/muxes/i2c-mux-pca954x.c b/drivers/i2c/muxes/i2c-mux-pca954x.c
index 528e755c468f..3278ebf1cc5c 100644
--- a/drivers/i2c/muxes/i2c-mux-pca954x.c
+++ b/drivers/i2c/muxes/i2c-mux-pca954x.c
@@ -164,7 +164,7 @@ static int pca954x_select_chan(struct i2c_mux_core *muxc, u32 chan)
         /* Only select the channel if its different from the last channel */
         if (data->last_chan != regval) {
                 ret = pca954x_reg_write(muxc->parent, client, regval);
-                data->last_chan = regval;
+                data->last_chan = ret ? 0 : regval;
         }
 
         return ret;
diff --git a/drivers/iio/accel/Kconfig b/drivers/iio/accel/Kconfig
index 89d78208de3f..78f148ea9d9f 100644
--- a/drivers/iio/accel/Kconfig
+++ b/drivers/iio/accel/Kconfig
@@ -20,6 +20,8 @@ config BMA180
 config BMA220
     tristate "Bosch BMA220 3-Axis Accelerometer Driver"
         depends on SPI
+        select IIO_BUFFER
+        select IIO_TRIGGERED_BUFFER
     help
       Say yes here to add support for the Bosch BMA220 triaxial
       acceleration sensor.
@@ -234,7 +236,8 @@ config STK8312
 config STK8BA50
         tristate "Sensortek STK8BA50 3-Axis Accelerometer Driver"
         depends on I2C
-        depends on IIO_TRIGGER
+        select IIO_BUFFER
+        select IIO_TRIGGERED_BUFFER
         help
           Say yes here to get support for the Sensortek STK8BA50 3-axis
           accelerometer.
diff --git a/drivers/iio/accel/bma220_spi.c b/drivers/iio/accel/bma220_spi.c
index 1098d10df8e8..5099f295dd37 100644
--- a/drivers/iio/accel/bma220_spi.c
+++ b/drivers/iio/accel/bma220_spi.c
@@ -253,7 +253,7 @@ static int bma220_probe(struct spi_device *spi)
         if (ret < 0)
                 return ret;
 
-        ret = iio_triggered_buffer_setup(indio_dev, NULL,
+        ret = iio_triggered_buffer_setup(indio_dev, iio_pollfunc_store_time,
                                          bma220_trigger_handler, NULL);
         if (ret < 0) {
                 dev_err(&spi->dev, "iio triggered buffer setup failed\n");
diff --git a/drivers/iio/accel/bmc150-accel-core.c b/drivers/iio/accel/bmc150-accel-core.c
index bf17aae66145..59b380dbf27f 100644
--- a/drivers/iio/accel/bmc150-accel-core.c
+++ b/drivers/iio/accel/bmc150-accel-core.c
@@ -67,6 +67,9 @@
 #define BMC150_ACCEL_REG_PMU_BW         0x10
 #define BMC150_ACCEL_DEF_BW                     125
 
+#define BMC150_ACCEL_REG_RESET                  0x14
+#define BMC150_ACCEL_RESET_VAL                  0xB6
+
 #define BMC150_ACCEL_REG_INT_MAP_0              0x19
 #define BMC150_ACCEL_INT_MAP_0_BIT_SLOPE        BIT(2)
 
@@ -1497,6 +1500,14 @@ static int bmc150_accel_chip_init(struct bmc150_accel_data *data)
         int ret, i;
         unsigned int val;
 
+        /*
+         * Reset chip to get it in a known good state. A delay of 1.8ms after
+         * reset is required according to the data sheets of supported chips.
+         */
+        regmap_write(data->regmap, BMC150_ACCEL_REG_RESET,
+                     BMC150_ACCEL_RESET_VAL);
+        usleep_range(1800, 2500);
+
         ret = regmap_read(data->regmap, BMC150_ACCEL_REG_CHIP_ID, &val);
         if (ret < 0) {
                 dev_err(dev, "Error: Reading chip id\n");
diff --git a/drivers/iio/accel/kxsd9.c b/drivers/iio/accel/kxsd9.c
index 3a9f106787d2..9d72d4bcf5e9 100644
--- a/drivers/iio/accel/kxsd9.c
+++ b/drivers/iio/accel/kxsd9.c
@@ -160,11 +160,13 @@ static int kxsd9_read_raw(struct iio_dev *indio_dev,
                 if (ret < 0)
                         goto error_ret;
                 *val = ret;
+                ret = IIO_VAL_INT;
                 break;
         case IIO_CHAN_INFO_SCALE:
                 ret = spi_w8r8(st->us, KXSD9_READ(KXSD9_REG_CTRL_C));
                 if (ret < 0)
                         goto error_ret;
+                *val = 0;
                 *val2 = kxsd9_micro_scales[ret & KXSD9_FS_MASK];
                 ret = IIO_VAL_INT_PLUS_MICRO;
                 break;
diff --git a/drivers/iio/adc/Kconfig b/drivers/iio/adc/Kconfig
index 1de31bdd4ce4..767577298ee3 100644
--- a/drivers/iio/adc/Kconfig
+++ b/drivers/iio/adc/Kconfig
@@ -389,6 +389,7 @@ config QCOM_SPMI_VADC
 config ROCKCHIP_SARADC
         tristate "Rockchip SARADC driver"
         depends on ARCH_ROCKCHIP || (ARM && COMPILE_TEST)
+        depends on RESET_CONTROLLER
         help
           Say yes here to build support for the SARADC found in SoCs from
           Rockchip.
diff --git a/drivers/iio/adc/ad799x.c b/drivers/iio/adc/ad799x.c
index b6163764489c..9704090b7908 100644
--- a/drivers/iio/adc/ad799x.c
+++ b/drivers/iio/adc/ad799x.c
@@ -527,6 +527,7 @@ static struct attribute_group ad799x_event_attrs_group = {
 static const struct iio_info ad7991_info = {
         .read_raw = &ad799x_read_raw,
         .driver_module = THIS_MODULE,
+        .update_scan_mode = ad799x_update_scan_mode,
 };
 
 static const struct iio_info ad7993_4_7_8_noirq_info = {
diff --git a/drivers/iio/adc/at91_adc.c b/drivers/iio/adc/at91_adc.c
index 52430ba171f3..0438c68015e8 100644
--- a/drivers/iio/adc/at91_adc.c
+++ b/drivers/iio/adc/at91_adc.c
@@ -381,8 +381,8 @@ static irqreturn_t at91_adc_rl_interrupt(int irq, void *private)
                 st->ts_bufferedmeasure = false;
                 input_report_key(st->ts_input, BTN_TOUCH, 0);
                 input_sync(st->ts_input);
-        } else if (status & AT91_ADC_EOC(3)) {
-                /* Conversion finished */
+        } else if (status & AT91_ADC_EOC(3) && st->ts_input) {
+                /* Conversion finished and we've a touchscreen */
                 if (st->ts_bufferedmeasure) {
                         /*
                          * Last measurement is always discarded, since it can
diff --git a/drivers/iio/adc/rockchip_saradc.c b/drivers/iio/adc/rockchip_saradc.c
index f9ad6c2d6821..85d701291654 100644
--- a/drivers/iio/adc/rockchip_saradc.c
+++ b/drivers/iio/adc/rockchip_saradc.c
@@ -21,6 +21,8 @@
 #include <linux/of_device.h>
 #include <linux/clk.h>
 #include <linux/completion.h>
+#include <linux/delay.h>
+#include <linux/reset.h>
 #include <linux/regulator/consumer.h>
 #include <linux/iio/iio.h>
 
@@ -53,6 +55,7 @@ struct rockchip_saradc {
         struct clk              *clk;
         struct completion       completion;
         struct regulator        *vref;
+        struct reset_control    *reset;
         const struct rockchip_saradc_data *data;
         u16                     last_val;
 };
@@ -190,6 +193,16 @@ static const struct of_device_id rockchip_saradc_match[] = {
 };
 MODULE_DEVICE_TABLE(of, rockchip_saradc_match);
 
+/**
+ * Reset SARADC Controller.
+ */
+static void rockchip_saradc_reset_controller(struct reset_control *reset)
+{
+        reset_control_assert(reset);
+        usleep_range(10, 20);
+        reset_control_deassert(reset);
+}
+
 static int rockchip_saradc_probe(struct platform_device *pdev)
 {
         struct rockchip_saradc *info = NULL;
@@ -218,6 +231,20 @@ static int rockchip_saradc_probe(struct platform_device *pdev)
         if (IS_ERR(info->regs))
                 return PTR_ERR(info->regs);
 
+        /*
+         * The reset should be an optional property, as it should work
+         * with old devicetrees as well
+         */
+        info->reset = devm_reset_control_get(&pdev->dev, "saradc-apb");
+        if (IS_ERR(info->reset)) {
+                ret = PTR_ERR(info->reset);
+                if (ret != -ENOENT)
+                        return ret;
+
+                dev_dbg(&pdev->dev, "no reset control found\n");
+                info->reset = NULL;
+        }
+
         init_completion(&info->completion);
 
         irq = platform_get_irq(pdev, 0);
@@ -252,6 +279,9 @@ static int rockchip_saradc_probe(struct platform_device *pdev)
                 return PTR_ERR(info->vref);
         }
 
+        if (info->reset)
+                rockchip_saradc_reset_controller(info->reset);
+
         /*
          * Use a default value for the converter clock.
          * This may become user-configurable in the future.
diff --git a/drivers/iio/adc/ti-ads1015.c b/drivers/iio/adc/ti-ads1015.c
index 1ef398770a1f..066abaf80201 100644
--- a/drivers/iio/adc/ti-ads1015.c
+++ b/drivers/iio/adc/ti-ads1015.c
@@ -489,7 +489,8 @@ static struct iio_info ads1115_info = {
 #ifdef CONFIG_OF
 static int ads1015_get_channels_config_of(struct i2c_client *client)
 {
-        struct ads1015_data *data = i2c_get_clientdata(client);
+        struct iio_dev *indio_dev = i2c_get_clientdata(client);
+        struct ads1015_data *data = iio_priv(indio_dev);
         struct device_node *node;
 
         if (!client->dev.of_node ||
diff --git a/drivers/iio/adc/ti_am335x_adc.c b/drivers/iio/adc/ti_am335x_adc.c
index 8a368756881b..c3cfacca2541 100644
--- a/drivers/iio/adc/ti_am335x_adc.c
+++ b/drivers/iio/adc/ti_am335x_adc.c
@@ -32,6 +32,7 @@
 
 struct tiadc_device {
         struct ti_tscadc_dev *mfd_tscadc;
+        struct mutex fifo1_lock; /* to protect fifo access */
         int channels;
         u8 channel_line[8];
         u8 channel_step[8];
@@ -359,6 +360,7 @@ static int tiadc_read_raw(struct iio_dev *indio_dev,
                 int *val, int *val2, long mask)
 {
         struct tiadc_device *adc_dev = iio_priv(indio_dev);
+        int ret = IIO_VAL_INT;
         int i, map_val;
         unsigned int fifo1count, read, stepid;
         bool found = false;
@@ -372,13 +374,14 @@ static int tiadc_read_raw(struct iio_dev *indio_dev,
         if (!step_en)
                 return -EINVAL;
 
+        mutex_lock(&adc_dev->fifo1_lock);
         fifo1count = tiadc_readl(adc_dev, REG_FIFO1CNT);
         while (fifo1count--)
                 tiadc_readl(adc_dev, REG_FIFO1);
 
         am335x_tsc_se_set_once(adc_dev->mfd_tscadc, step_en);
 
-        timeout = jiffies + usecs_to_jiffies
+        timeout = jiffies + msecs_to_jiffies
                                 (IDLE_TIMEOUT * adc_dev->channels);
         /* Wait for Fifo threshold interrupt */
         while (1) {
@@ -388,7 +391,8 @@ static int tiadc_read_raw(struct iio_dev *indio_dev,
 
                 if (time_after(jiffies, timeout)) {
                         am335x_tsc_se_adc_done(adc_dev->mfd_tscadc);
-                        return -EAGAIN;
+                        ret = -EAGAIN;
+                        goto err_unlock;
                 }
         }
         map_val = adc_dev->channel_step[chan->scan_index];
@@ -414,8 +418,11 @@ static int tiadc_read_raw(struct iio_dev *indio_dev,
         am335x_tsc_se_adc_done(adc_dev->mfd_tscadc);
 
         if (found == false)
-                return -EBUSY;
-        return IIO_VAL_INT;
+                ret =  -EBUSY;
+
+err_unlock:
+        mutex_unlock(&adc_dev->fifo1_lock);
+        return ret;
 }
 
 static const struct iio_info tiadc_info = {
@@ -483,6 +490,7 @@ static int tiadc_probe(struct platform_device *pdev)
 
         tiadc_step_config(indio_dev);
         tiadc_writel(adc_dev, REG_FIFO1THR, FIFO1_THRESHOLD);
+        mutex_init(&adc_dev->fifo1_lock);
 
         err = tiadc_channel_init(indio_dev, adc_dev->channels);
         if (err < 0)
diff --git a/drivers/iio/chemical/atlas-ph-sensor.c b/drivers/iio/chemical/atlas-ph-sensor.c
index ae038a59d256..407f141a1eee 100644
--- a/drivers/iio/chemical/atlas-ph-sensor.c
+++ b/drivers/iio/chemical/atlas-ph-sensor.c
@@ -434,7 +434,7 @@ static int atlas_read_raw(struct iio_dev *indio_dev,
                         break;
                 case IIO_ELECTRICALCONDUCTIVITY:
                         *val = 1; /* 0.00001 */
-                        *val = 100000;
+                        *val2 = 100000;
                         break;
                 case IIO_CONCENTRATION:
                         *val = 0; /* 0.000000001 */
diff --git a/drivers/iio/common/hid-sensors/hid-sensor-attributes.c b/drivers/iio/common/hid-sensors/hid-sensor-attributes.c
index e81f434760f4..dc33c1dd5191 100644
--- a/drivers/iio/common/hid-sensors/hid-sensor-attributes.c
+++ b/drivers/iio/common/hid-sensors/hid-sensor-attributes.c
@@ -56,8 +56,8 @@ static struct {
         {HID_USAGE_SENSOR_ALS, 0, 1, 0},
         {HID_USAGE_SENSOR_ALS, HID_USAGE_SENSOR_UNITS_LUX, 1, 0},
 
-        {HID_USAGE_SENSOR_PRESSURE, 0, 100000, 0},
-        {HID_USAGE_SENSOR_PRESSURE, HID_USAGE_SENSOR_UNITS_PASCAL, 1, 0},
+        {HID_USAGE_SENSOR_PRESSURE, 0, 100, 0},
+        {HID_USAGE_SENSOR_PRESSURE, HID_USAGE_SENSOR_UNITS_PASCAL, 0, 1000},
 };
 
 static int pow_10(unsigned power)
diff --git a/drivers/iio/dac/stx104.c b/drivers/iio/dac/stx104.c
index 792a97164cb2..bebbd00304ce 100644
--- a/drivers/iio/dac/stx104.c
+++ b/drivers/iio/dac/stx104.c
@@ -65,6 +65,16 @@ struct stx104_gpio {
         unsigned int out_state;
 };
 
+/**
+ * struct stx104_dev - STX104 device private data structure
+ * @indio_dev:  IIO device
+ * @chip:       instance of the gpio_chip
+ */
+struct stx104_dev {
+        struct iio_dev *indio_dev;
+        struct gpio_chip *chip;
+};
+
 static int stx104_read_raw(struct iio_dev *indio_dev,
         struct iio_chan_spec const *chan, int *val, int *val2, long mask)
 {
@@ -107,6 +117,7 @@ static const struct iio_chan_spec stx104_channels[STX104_NUM_CHAN] = {
 static int stx104_gpio_get_direction(struct gpio_chip *chip,
         unsigned int offset)
 {
+        /* GPIO 0-3 are input only, while the rest are output only */
         if (offset < 4)
                 return 1;
 
@@ -169,6 +180,7 @@ static int stx104_probe(struct device *dev, unsigned int id)
         struct iio_dev *indio_dev;
         struct stx104_iio *priv;
         struct stx104_gpio *stx104gpio;
+        struct stx104_dev *stx104dev;
         int err;
 
         indio_dev = devm_iio_device_alloc(dev, sizeof(*priv));
@@ -179,6 +191,10 @@ static int stx104_probe(struct device *dev, unsigned int id)
         if (!stx104gpio)
                 return -ENOMEM;
 
+        stx104dev = devm_kzalloc(dev, sizeof(*stx104dev), GFP_KERNEL);
+        if (!stx104dev)
+                return -ENOMEM;
+
         if (!devm_request_region(dev, base[id], STX104_EXTENT,
                 dev_name(dev))) {
                 dev_err(dev, "Unable to lock port addresses (0x%X-0x%X)\n",
@@ -199,12 +215,6 @@ static int stx104_probe(struct device *dev, unsigned int id)
         outw(0, base[id] + 4);
         outw(0, base[id] + 6);
 
-        err = devm_iio_device_register(dev, indio_dev);
-        if (err) {
-                dev_err(dev, "IIO device registering failed (%d)\n", err);
-                return err;
-        }
-
         stx104gpio->chip.label = dev_name(dev);
         stx104gpio->chip.parent = dev;
         stx104gpio->chip.owner = THIS_MODULE;
@@ -220,7 +230,9 @@ static int stx104_probe(struct device *dev, unsigned int id)
 
         spin_lock_init(&stx104gpio->lock);
 
-        dev_set_drvdata(dev, stx104gpio);
+        stx104dev->indio_dev = indio_dev;
+        stx104dev->chip = &stx104gpio->chip;
+        dev_set_drvdata(dev, stx104dev);
 
         err = gpiochip_add_data(&stx104gpio->chip, stx104gpio);
         if (err) {
@@ -228,14 +240,22 @@ static int stx104_probe(struct device *dev, unsigned int id)
                 return err;
         }
 
+        err = iio_device_register(indio_dev);
+        if (err) {
+                dev_err(dev, "IIO device registering failed (%d)\n", err);
+                gpiochip_remove(&stx104gpio->chip);
+                return err;
+        }
+
         return 0;
 }
 
 static int stx104_remove(struct device *dev, unsigned int id)
 {
-        struct stx104_gpio *const stx104gpio = dev_get_drvdata(dev);
+        struct stx104_dev *const stx104dev = dev_get_drvdata(dev);
 
-        gpiochip_remove(&stx104gpio->chip);
+        iio_device_unregister(stx104dev->indio_dev);
+        gpiochip_remove(stx104dev->chip);
 
         return 0;
 }
diff --git a/drivers/iio/humidity/Kconfig b/drivers/iio/humidity/Kconfig
index 738a86d9e4a9..d04124345992 100644
--- a/drivers/iio/humidity/Kconfig
+++ b/drivers/iio/humidity/Kconfig
@@ -6,6 +6,8 @@ menu "Humidity sensors"
 config AM2315
     tristate "Aosong AM2315 relative humidity and temperature sensor"
     depends on I2C
+    select IIO_BUFFER
+    select IIO_TRIGGERED_BUFFER
     help
       If you say yes here you get support for the Aosong AM2315
       relative humidity and ambient temperature sensor.
diff --git a/drivers/iio/humidity/am2315.c b/drivers/iio/humidity/am2315.c
index 3e200f69e886..ff96b6d0fdae 100644
--- a/drivers/iio/humidity/am2315.c
+++ b/drivers/iio/humidity/am2315.c
@@ -244,7 +244,7 @@ static int am2315_probe(struct i2c_client *client,
         indio_dev->channels = am2315_channels;
         indio_dev->num_channels = ARRAY_SIZE(am2315_channels);
 
-        ret = iio_triggered_buffer_setup(indio_dev, NULL,
+        ret = iio_triggered_buffer_setup(indio_dev, iio_pollfunc_store_time,
                                          am2315_trigger_handler, NULL);
         if (ret < 0) {
                 dev_err(&client->dev, "iio triggered buffer setup failed\n");
diff --git a/drivers/iio/humidity/hdc100x.c b/drivers/iio/humidity/hdc100x.c
index a03832a5fc95..e0c9c70c2a4a 100644
--- a/drivers/iio/humidity/hdc100x.c
+++ b/drivers/iio/humidity/hdc100x.c
@@ -142,7 +142,7 @@ static int hdc100x_get_measurement(struct hdc100x_data *data,
         struct i2c_client *client = data->client;
         int delay = data->adc_int_us[chan->address];
         int ret;
-        int val;
+        __be16 val;
 
         /* start measurement */
         ret = i2c_smbus_write_byte(client, chan->address);
@@ -154,26 +154,13 @@ static int hdc100x_get_measurement(struct hdc100x_data *data,
         /* wait for integration time to pass */
         usleep_range(delay, delay + 1000);
 
-        /*
-         * i2c_smbus_read_word_data cannot() be used here due to the command
-         * value not being understood and causes NAKs preventing any reading
-         * from being accessed.
-         */
-        ret = i2c_smbus_read_byte(client);
+        /* read measurement */
+        ret = i2c_master_recv(data->client, (char *)&val, sizeof(val));
         if (ret < 0) {
-                dev_err(&client->dev, "cannot read high byte measurement");
+                dev_err(&client->dev, "cannot read sensor data\n");
                 return ret;
         }
-        val = ret << 8;
-
-        ret = i2c_smbus_read_byte(client);
-        if (ret < 0) {
-                dev_err(&client->dev, "cannot read low byte measurement");
-                return ret;
-        }
-        val |= ret;
-
-        return val;
+        return be16_to_cpu(val);
 }
 
 static int hdc100x_get_heater_status(struct hdc100x_data *data)
@@ -272,8 +259,8 @@ static int hdc100x_probe(struct i2c_client *client,
         struct iio_dev *indio_dev;
         struct hdc100x_data *data;
 
-        if (!i2c_check_functionality(client->adapter,
-                                I2C_FUNC_SMBUS_WORD_DATA | I2C_FUNC_SMBUS_BYTE))
+        if (!i2c_check_functionality(client->adapter, I2C_FUNC_SMBUS_WORD_DATA |
+                                     I2C_FUNC_SMBUS_BYTE | I2C_FUNC_I2C))
                 return -EOPNOTSUPP;
 
         indio_dev = devm_iio_device_alloc(&client->dev, sizeof(*data));
diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio-buffer.c
index 90462fcf5436..158aaf44dd95 100644
--- a/drivers/iio/industrialio-buffer.c
+++ b/drivers/iio/industrialio-buffer.c
@@ -107,9 +107,10 @@ ssize_t iio_buffer_read_first_n_outer(struct file *filp, char __user *buf,
 {
         struct iio_dev *indio_dev = filp->private_data;
         struct iio_buffer *rb = indio_dev->buffer;
+        DEFINE_WAIT_FUNC(wait, woken_wake_function);
         size_t datum_size;
         size_t to_wait;
-        int ret;
+        int ret = 0;
 
         if (!indio_dev->info)
                 return -ENODEV;
@@ -131,19 +132,29 @@ ssize_t iio_buffer_read_first_n_outer(struct file *filp, char __user *buf,
         else
                 to_wait = min_t(size_t, n / datum_size, rb->watermark);
 
+        add_wait_queue(&rb->pollq, &wait);
         do {
-                ret = wait_event_interruptible(rb->pollq,
-                      iio_buffer_ready(indio_dev, rb, to_wait, n / datum_size));
-                if (ret)
-                        return ret;
+                if (!indio_dev->info) {
+                        ret = -ENODEV;
+                        break;
+                }
 
-                if (!indio_dev->info)
-                        return -ENODEV;
+                if (!iio_buffer_ready(indio_dev, rb, to_wait, n / datum_size)) {
+                        if (signal_pending(current)) {
+                                ret = -ERESTARTSYS;
+                                break;
+                        }
+
+                        wait_woken(&wait, TASK_INTERRUPTIBLE,
+                                   MAX_SCHEDULE_TIMEOUT);
+                        continue;
+                }
 
                 ret = rb->access->read_first_n(rb, n, buf);
                 if (ret == 0 && (filp->f_flags & O_NONBLOCK))
                         ret = -EAGAIN;
-         } while (ret == 0);
+        } while (ret == 0);
+        remove_wait_queue(&rb->pollq, &wait);
 
         return ret;
 }
diff --git a/drivers/iio/industrialio-core.c b/drivers/iio/industrialio-core.c
index f914d5d140e4..d2b889918c3e 100644
--- a/drivers/iio/industrialio-core.c
+++ b/drivers/iio/industrialio-core.c
@@ -613,9 +613,8 @@ ssize_t iio_format_value(char *buf, unsigned int type, int size, int *vals)
                         return sprintf(buf, "%d.%09u\n", vals[0], vals[1]);
         case IIO_VAL_FRACTIONAL:
                 tmp = div_s64((s64)vals[0] * 1000000000LL, vals[1]);
-                vals[1] = do_div(tmp, 1000000000LL);
-                vals[0] = tmp;
-                return sprintf(buf, "%d.%09u\n", vals[0], vals[1]);
+                vals[0] = (int)div_s64_rem(tmp, 1000000000, &vals[1]);
+                return sprintf(buf, "%d.%09u\n", vals[0], abs(vals[1]));
         case IIO_VAL_FRACTIONAL_LOG2:
                 tmp = (s64)vals[0] * 1000000000LL >> vals[1];
                 vals[1] = do_div(tmp, 1000000000LL);
diff --git a/drivers/iio/light/Kconfig b/drivers/iio/light/Kconfig
index 7c566f516572..3574945183fe 100644
--- a/drivers/iio/light/Kconfig
+++ b/drivers/iio/light/Kconfig
@@ -76,7 +76,6 @@ config BH1750
 config BH1780
         tristate "ROHM BH1780 ambient light sensor"
         depends on I2C
-        depends on !SENSORS_BH1780
         help
          Say Y here to build support for the ROHM BH1780GLI ambient
          light sensor.
@@ -238,6 +237,8 @@ config MAX44000
         tristate "MAX44000 Ambient and Infrared Proximity Sensor"
         depends on I2C
         select REGMAP_I2C
+        select IIO_BUFFER
+        select IIO_TRIGGERED_BUFFER
         help
          Say Y here if you want to build support for Maxim Integrated's
          MAX44000 ambient and infrared proximity sensor device.
diff --git a/drivers/iio/pressure/bmp280-core.c b/drivers/iio/pressure/bmp280-core.c
index 6943688e66df..e5a533cbd53f 100644
--- a/drivers/iio/pressure/bmp280-core.c
+++ b/drivers/iio/pressure/bmp280-core.c
@@ -970,7 +970,7 @@ int bmp280_common_probe(struct device *dev,
         data->vdda = devm_regulator_get(dev, "vdda");
         if (IS_ERR(data->vdda)) {
                 dev_err(dev, "failed to get VDDA regulator\n");
-                ret = PTR_ERR(data->vddd);
+                ret = PTR_ERR(data->vdda);
                 goto out_disable_vddd;
         }
         ret = regulator_enable(data->vdda);
@@ -1079,7 +1079,8 @@ EXPORT_SYMBOL(bmp280_common_remove);
 #ifdef CONFIG_PM
 static int bmp280_runtime_suspend(struct device *dev)
 {
-        struct bmp280_data *data = dev_get_drvdata(dev);
+        struct iio_dev *indio_dev = dev_get_drvdata(dev);
+        struct bmp280_data *data = iio_priv(indio_dev);
         int ret;
 
         ret = regulator_disable(data->vdda);
@@ -1090,7 +1091,8 @@ static int bmp280_runtime_suspend(struct device *dev)
 
 static int bmp280_runtime_resume(struct device *dev)
 {
-        struct bmp280_data *data = dev_get_drvdata(dev);
+        struct iio_dev *indio_dev = dev_get_drvdata(dev);
+        struct bmp280_data *data = iio_priv(indio_dev);
         int ret;
 
         ret = regulator_enable(data->vddd);
diff --git a/drivers/iio/proximity/as3935.c b/drivers/iio/proximity/as3935.c
index 2e3a70e1b245..5656deb17261 100644
--- a/drivers/iio/proximity/as3935.c
+++ b/drivers/iio/proximity/as3935.c
@@ -397,7 +397,7 @@ static int as3935_probe(struct spi_device *spi)
                 return ret;
         }
 
-        ret = iio_triggered_buffer_setup(indio_dev, NULL,
+        ret = iio_triggered_buffer_setup(indio_dev, iio_pollfunc_store_time,
                 &as3935_trigger_handler, NULL);
 
         if (ret) {
diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index e6dfa1bd3def..5f65a78b27c9 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -2462,18 +2462,24 @@ static int cma_resolve_iboe_route(struct rdma_id_private *id_priv)
 
         if (addr->dev_addr.bound_dev_if) {
                 ndev = dev_get_by_index(&init_net, addr->dev_addr.bound_dev_if);
-                if (!ndev)
-                        return -ENODEV;
+                if (!ndev) {
+                        ret = -ENODEV;
+                        goto err2;
+                }
 
                 if (ndev->flags & IFF_LOOPBACK) {
                         dev_put(ndev);
-                        if (!id_priv->id.device->get_netdev)
-                                return -EOPNOTSUPP;
+                        if (!id_priv->id.device->get_netdev) {
+                                ret = -EOPNOTSUPP;
+                                goto err2;
+                        }
 
                         ndev = id_priv->id.device->get_netdev(id_priv->id.device,
                                                               id_priv->id.port_num);
-                        if (!ndev)
-                                return -ENODEV;
+                        if (!ndev) {
+                                ret = -ENODEV;
+                                goto err2;
+                        }
                 }
 
                 route->path_rec->net = &init_net;
diff --git a/drivers/infiniband/core/multicast.c b/drivers/infiniband/core/multicast.c
index 3a3c5d73bbfc..51c79b2fb0b8 100644
--- a/drivers/infiniband/core/multicast.c
+++ b/drivers/infiniband/core/multicast.c
@@ -106,7 +106,6 @@ struct mcast_group {
         atomic_t                refcount;
         enum mcast_group_state  state;
         struct ib_sa_query      *query;
-        int                     query_id;
         u16                     pkey_index;
         u8                      leave_state;
         int                     retries;
@@ -340,11 +339,7 @@ static int send_join(struct mcast_group *group, struct mcast_member *member)
                                        member->multicast.comp_mask,
                                        3000, GFP_KERNEL, join_handler, group,
                                        &group->query);
-        if (ret >= 0) {
-                group->query_id = ret;
-                ret = 0;
-        }
-        return ret;
+        return (ret > 0) ? 0 : ret;
 }
 
 static int send_leave(struct mcast_group *group, u8 leave_state)
@@ -364,11 +359,7 @@ static int send_leave(struct mcast_group *group, u8 leave_state)
                                        IB_SA_MCMEMBER_REC_JOIN_STATE,
                                        3000, GFP_KERNEL, leave_handler,
                                        group, &group->query);
-        if (ret >= 0) {
-                group->query_id = ret;
-                ret = 0;
-        }
-        return ret;
+        return (ret > 0) ? 0 : ret;
 }
 
 static void join_group(struct mcast_group *group, struct mcast_member *member,
diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
index 3aca7f6171b4..80f988984f44 100644
--- a/drivers/infiniband/hw/cxgb4/cm.c
+++ b/drivers/infiniband/hw/cxgb4/cm.c
@@ -333,6 +333,8 @@ static void remove_ep_tid(struct c4iw_ep *ep)
 
         spin_lock_irqsave(&ep->com.dev->lock, flags);
         _remove_handle(ep->com.dev, &ep->com.dev->hwtid_idr, ep->hwtid, 0);
+        if (idr_is_empty(&ep->com.dev->hwtid_idr))
+                wake_up(&ep->com.dev->wait);
         spin_unlock_irqrestore(&ep->com.dev->lock, flags);
 }
 
@@ -1827,8 +1829,12 @@ static int process_mpa_request(struct c4iw_ep *ep, struct sk_buff *skb)
                                 (ep->mpa_pkt + sizeof(*mpa));
                         ep->ird = ntohs(mpa_v2_params->ird) &
                                 MPA_V2_IRD_ORD_MASK;
+                        ep->ird = min_t(u32, ep->ird,
+                                        cur_max_read_depth(ep->com.dev));
                         ep->ord = ntohs(mpa_v2_params->ord) &
                                 MPA_V2_IRD_ORD_MASK;
+                        ep->ord = min_t(u32, ep->ord,
+                                        cur_max_read_depth(ep->com.dev));
                         PDBG("%s initiator ird %u ord %u\n", __func__, ep->ird,
                              ep->ord);
                         if (ntohs(mpa_v2_params->ird) & MPA_V2_PEER2PEER_MODEL)
@@ -2113,8 +2119,10 @@ static int import_ep(struct c4iw_ep *ep, int iptype, __u8 *peer_ip,
                 }
                 ep->l2t = cxgb4_l2t_get(cdev->rdev.lldi.l2t,
                                         n, pdev, rt_tos2priority(tos));
-                if (!ep->l2t)
+                if (!ep->l2t) {
+                        dev_put(pdev);
                         goto out;
+                }
                 ep->mtu = pdev->mtu;
                 ep->tx_chan = cxgb4_port_chan(pdev);
                 ep->smac_idx = cxgb4_tp_smt_idx(adapter_type,
@@ -3136,7 +3144,7 @@ int c4iw_accept_cr(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
         if (ep->mpa_attr.version == 2 && ep->mpa_attr.enhanced_rdma_conn) {
                 if (conn_param->ord > ep->ird) {
                         if (RELAXED_IRD_NEGOTIATION) {
-                                ep->ord = ep->ird;
+                                conn_param->ord = ep->ird;
                         } else {
                                 ep->ird = conn_param->ird;
                                 ep->ord = conn_param->ord;
diff --git a/drivers/infiniband/hw/cxgb4/cq.c b/drivers/infiniband/hw/cxgb4/cq.c
index 812ab7278b8e..ac926c942fee 100644
--- a/drivers/infiniband/hw/cxgb4/cq.c
+++ b/drivers/infiniband/hw/cxgb4/cq.c
@@ -1016,15 +1016,15 @@ int c4iw_resize_cq(struct ib_cq *cq, int cqe, struct ib_udata *udata)
 int c4iw_arm_cq(struct ib_cq *ibcq, enum ib_cq_notify_flags flags)
 {
         struct c4iw_cq *chp;
-        int ret;
+        int ret = 0;
         unsigned long flag;
 
         chp = to_c4iw_cq(ibcq);
         spin_lock_irqsave(&chp->lock, flag);
-        ret = t4_arm_cq(&chp->cq,
-                        (flags & IB_CQ_SOLICITED_MASK) == IB_CQ_SOLICITED);
+        t4_arm_cq(&chp->cq,
+                  (flags & IB_CQ_SOLICITED_MASK) == IB_CQ_SOLICITED);
+        if (flags & IB_CQ_REPORT_MISSED_EVENTS)
+                ret = t4_cq_notempty(&chp->cq);
         spin_unlock_irqrestore(&chp->lock, flag);
-        if (ret && !(flags & IB_CQ_REPORT_MISSED_EVENTS))
-                ret = 0;
         return ret;
 }
diff --git a/drivers/infiniband/hw/cxgb4/device.c b/drivers/infiniband/hw/cxgb4/device.c
index 071d7332ec06..3c4b2126e0d1 100644
--- a/drivers/infiniband/hw/cxgb4/device.c
+++ b/drivers/infiniband/hw/cxgb4/device.c
@@ -872,9 +872,13 @@ static void c4iw_rdev_close(struct c4iw_rdev *rdev)
 static void c4iw_dealloc(struct uld_ctx *ctx)
 {
         c4iw_rdev_close(&ctx->dev->rdev);
+        WARN_ON_ONCE(!idr_is_empty(&ctx->dev->cqidr));
         idr_destroy(&ctx->dev->cqidr);
+        WARN_ON_ONCE(!idr_is_empty(&ctx->dev->qpidr));
         idr_destroy(&ctx->dev->qpidr);
+        WARN_ON_ONCE(!idr_is_empty(&ctx->dev->mmidr));
         idr_destroy(&ctx->dev->mmidr);
+        wait_event(ctx->dev->wait, idr_is_empty(&ctx->dev->hwtid_idr));
         idr_destroy(&ctx->dev->hwtid_idr);
         idr_destroy(&ctx->dev->stid_idr);
         idr_destroy(&ctx->dev->atid_idr);
@@ -992,6 +996,7 @@ static struct c4iw_dev *c4iw_alloc(const struct cxgb4_lld_info *infop)
         mutex_init(&devp->rdev.stats.lock);
         mutex_init(&devp->db_mutex);
         INIT_LIST_HEAD(&devp->db_fc_list);
+        init_waitqueue_head(&devp->wait);
         devp->avail_ird = devp->rdev.lldi.max_ird_adapter;
 
         if (c4iw_debugfs_root) {
diff --git a/drivers/infiniband/hw/cxgb4/iw_cxgb4.h b/drivers/infiniband/hw/cxgb4/iw_cxgb4.h
index aa47e0ae80bc..4b83b84f7ddf 100644
--- a/drivers/infiniband/hw/cxgb4/iw_cxgb4.h
+++ b/drivers/infiniband/hw/cxgb4/iw_cxgb4.h
@@ -263,6 +263,7 @@ struct c4iw_dev {
         struct idr stid_idr;
         struct list_head db_fc_list;
         u32 avail_ird;
+        wait_queue_head_t wait;
 };
 
 static inline struct c4iw_dev *to_c4iw_dev(struct ib_device *ibdev)
diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4/qp.c
index edb1172b6f54..690435229be7 100644
--- a/drivers/infiniband/hw/cxgb4/qp.c
+++ b/drivers/infiniband/hw/cxgb4/qp.c
@@ -683,7 +683,7 @@ static int build_inv_stag(union t4_wr *wqe, struct ib_send_wr *wr,
         return 0;
 }
 
-void _free_qp(struct kref *kref)
+static void _free_qp(struct kref *kref)
 {
         struct c4iw_qp *qhp;
 
diff --git a/drivers/infiniband/hw/cxgb4/t4.h b/drivers/infiniband/hw/cxgb4/t4.h
index 6126bbe36095..02173f4315fa 100644
--- a/drivers/infiniband/hw/cxgb4/t4.h
+++ b/drivers/infiniband/hw/cxgb4/t4.h
@@ -634,6 +634,11 @@ static inline int t4_valid_cqe(struct t4_cq *cq, struct t4_cqe *cqe)
         return (CQE_GENBIT(cqe) == cq->gen);
 }
 
+static inline int t4_cq_notempty(struct t4_cq *cq)
+{
+        return cq->sw_in_use || t4_valid_cqe(cq, &cq->queue[cq->cidx]);
+}
+
 static inline int t4_next_hw_cqe(struct t4_cq *cq, struct t4_cqe **cqe)
 {
         int ret;
diff --git a/drivers/infiniband/hw/hfi1/affinity.c b/drivers/infiniband/hw/hfi1/affinity.c
index 79575ee873f2..0566393e5aba 100644
--- a/drivers/infiniband/hw/hfi1/affinity.c
+++ b/drivers/infiniband/hw/hfi1/affinity.c
@@ -47,7 +47,6 @@
 #include <linux/topology.h>
 #include <linux/cpumask.h>
 #include <linux/module.h>
-#include <linux/cpumask.h>
 
 #include "hfi.h"
 #include "affinity.h"
@@ -682,7 +681,7 @@ int hfi1_set_sdma_affinity(struct hfi1_devdata *dd, const char *buf,
                            size_t count)
 {
         struct hfi1_affinity_node *entry;
-        struct cpumask mask;
+        cpumask_var_t mask;
         int ret, i;
 
         spin_lock(&node_affinity.lock);
@@ -692,19 +691,24 @@ int hfi1_set_sdma_affinity(struct hfi1_devdata *dd, const char *buf,
         if (!entry)
                 return -EINVAL;
 
-        ret = cpulist_parse(buf, &mask);
+        ret = zalloc_cpumask_var(&mask, GFP_KERNEL);
+        if (!ret)
+                return -ENOMEM;
+
+        ret = cpulist_parse(buf, mask);
         if (ret)
-                return ret;
+                goto out;
 
-        if (!cpumask_subset(&mask, cpu_online_mask) || cpumask_empty(&mask)) {
+        if (!cpumask_subset(mask, cpu_online_mask) || cpumask_empty(mask)) {
                 dd_dev_warn(dd, "Invalid CPU mask\n");
-                return -EINVAL;
+                ret = -EINVAL;
+                goto out;
         }
 
         mutex_lock(&sdma_affinity_mutex);
         /* reset the SDMA interrupt affinity details */
         init_cpu_mask_set(&entry->def_intr);
-        cpumask_copy(&entry->def_intr.mask, &mask);
+        cpumask_copy(&entry->def_intr.mask, mask);
         /*
          * Reassign the affinity for each SDMA interrupt.
          */
@@ -720,8 +724,9 @@ int hfi1_set_sdma_affinity(struct hfi1_devdata *dd, const char *buf,
                 if (ret)
                         break;
         }
-
         mutex_unlock(&sdma_affinity_mutex);
+out:
+        free_cpumask_var(mask);
         return ret ? ret : strnlen(buf, PAGE_SIZE);
 }
 
diff --git a/drivers/infiniband/hw/hfi1/chip.c b/drivers/infiniband/hw/hfi1/chip.c
index b32638d58ae8..cc38004cea42 100644
--- a/drivers/infiniband/hw/hfi1/chip.c
+++ b/drivers/infiniband/hw/hfi1/chip.c
@@ -9490,6 +9490,78 @@ static void init_lcb(struct hfi1_devdata *dd)
         write_csr(dd, DC_LCB_CFG_TX_FIFOS_RESET, 0x00);
 }
 
+/*
+ * Perform a test read on the QSFP.  Return 0 on success, -ERRNO
+ * on error.
+ */
+static int test_qsfp_read(struct hfi1_pportdata *ppd)
+{
+        int ret;
+        u8 status;
+
+        /* report success if not a QSFP */
+        if (ppd->port_type != PORT_TYPE_QSFP)
+                return 0;
+
+        /* read byte 2, the status byte */
+        ret = one_qsfp_read(ppd, ppd->dd->hfi1_id, 2, &status, 1);
+        if (ret < 0)
+                return ret;
+        if (ret != 1)
+                return -EIO;
+
+        return 0; /* success */
+}
+
+/*
+ * Values for QSFP retry.
+ *
+ * Give up after 10s (20 x 500ms).  The overall timeout was empirically
+ * arrived at from experience on a large cluster.
+ */
+#define MAX_QSFP_RETRIES 20
+#define QSFP_RETRY_WAIT 500 /* msec */
+
+/*
+ * Try a QSFP read.  If it fails, schedule a retry for later.
+ * Called on first link activation after driver load.
+ */
+static void try_start_link(struct hfi1_pportdata *ppd)
+{
+        if (test_qsfp_read(ppd)) {
+                /* read failed */
+                if (ppd->qsfp_retry_count >= MAX_QSFP_RETRIES) {
+                        dd_dev_err(ppd->dd, "QSFP not responding, giving up\n");
+                        return;
+                }
+                dd_dev_info(ppd->dd,
+                            "QSFP not responding, waiting and retrying %d\n",
+                            (int)ppd->qsfp_retry_count);
+                ppd->qsfp_retry_count++;
+                queue_delayed_work(ppd->hfi1_wq, &ppd->start_link_work,
+                                   msecs_to_jiffies(QSFP_RETRY_WAIT));
+                return;
+        }
+        ppd->qsfp_retry_count = 0;
+
+        /*
+         * Tune the SerDes to a ballpark setting for optimal signal and bit
+         * error rate.  Needs to be done before starting the link.
+         */
+        tune_serdes(ppd);
+        start_link(ppd);
+}
+
+/*
+ * Workqueue function to start the link after a delay.
+ */
+void handle_start_link(struct work_struct *work)
+{
+        struct hfi1_pportdata *ppd = container_of(work, struct hfi1_pportdata,
+                                                  start_link_work.work);
+        try_start_link(ppd);
+}
+
 int bringup_serdes(struct hfi1_pportdata *ppd)
 {
         struct hfi1_devdata *dd = ppd->dd;
@@ -9525,14 +9597,8 @@ int bringup_serdes(struct hfi1_pportdata *ppd)
                 set_qsfp_int_n(ppd, 1);
         }
 
-        /*
-         * Tune the SerDes to a ballpark setting for
-         * optimal signal and bit error rate
-         * Needs to be done before starting the link
-         */
-        tune_serdes(ppd);
-
-        return start_link(ppd);
+        try_start_link(ppd);
+        return 0;
 }
 
 void hfi1_quiet_serdes(struct hfi1_pportdata *ppd)
@@ -9549,6 +9615,10 @@ void hfi1_quiet_serdes(struct hfi1_pportdata *ppd)
         ppd->driver_link_ready = 0;
         ppd->link_enabled = 0;
 
+        ppd->qsfp_retry_count = MAX_QSFP_RETRIES; /* prevent more retries */
+        flush_delayed_work(&ppd->start_link_work);
+        cancel_delayed_work_sync(&ppd->start_link_work);
+
         ppd->offline_disabled_reason =
                         HFI1_ODR_MASK(OPA_LINKDOWN_REASON_SMA_DISABLED);
         set_link_down_reason(ppd, OPA_LINKDOWN_REASON_SMA_DISABLED, 0,
@@ -12865,7 +12935,7 @@ fail:
  */
 static int set_up_context_variables(struct hfi1_devdata *dd)
 {
-        int num_kernel_contexts;
+        unsigned long num_kernel_contexts;
         int total_contexts;
         int ret;
         unsigned ngroups;
@@ -12894,9 +12964,9 @@ static int set_up_context_variables(struct hfi1_devdata *dd)
          */
         if (num_kernel_contexts > (dd->chip_send_contexts - num_vls - 1)) {
                 dd_dev_err(dd,
-                           "Reducing # kernel rcv contexts to: %d, from %d\n",
+                           "Reducing # kernel rcv contexts to: %d, from %lu\n",
                            (int)(dd->chip_send_contexts - num_vls - 1),
-                           (int)num_kernel_contexts);
+                           num_kernel_contexts);
                 num_kernel_contexts = dd->chip_send_contexts - num_vls - 1;
         }
         /*
diff --git a/drivers/infiniband/hw/hfi1/chip.h b/drivers/infiniband/hw/hfi1/chip.h
index ed11107c50fe..e29573769efc 100644
--- a/drivers/infiniband/hw/hfi1/chip.h
+++ b/drivers/infiniband/hw/hfi1/chip.h
@@ -706,6 +706,7 @@ void handle_link_up(struct work_struct *work);
 void handle_link_down(struct work_struct *work);
 void handle_link_downgrade(struct work_struct *work);
 void handle_link_bounce(struct work_struct *work);
+void handle_start_link(struct work_struct *work);
 void handle_sma_message(struct work_struct *work);
 void reset_qsfp(struct hfi1_pportdata *ppd);
 void qsfp_event(struct work_struct *work);
diff --git a/drivers/infiniband/hw/hfi1/debugfs.c b/drivers/infiniband/hw/hfi1/debugfs.c
index dbab9d9cc288..5e9be16f6cd3 100644
--- a/drivers/infiniband/hw/hfi1/debugfs.c
+++ b/drivers/infiniband/hw/hfi1/debugfs.c
@@ -59,6 +59,40 @@
 
 static struct dentry *hfi1_dbg_root;
 
+/* wrappers to enforce srcu in seq file */
+static ssize_t hfi1_seq_read(
+        struct file *file,
+        char __user *buf,
+        size_t size,
+        loff_t *ppos)
+{
+        struct dentry *d = file->f_path.dentry;
+        int srcu_idx;
+        ssize_t r;
+
+        r = debugfs_use_file_start(d, &srcu_idx);
+        if (likely(!r))
+                r = seq_read(file, buf, size, ppos);
+        debugfs_use_file_finish(srcu_idx);
+        return r;
+}
+
+static loff_t hfi1_seq_lseek(
+        struct file *file,
+        loff_t offset,
+        int whence)
+{
+        struct dentry *d = file->f_path.dentry;
+        int srcu_idx;
+        loff_t r;
+
+        r = debugfs_use_file_start(d, &srcu_idx);
+        if (likely(!r))
+                r = seq_lseek(file, offset, whence);
+        debugfs_use_file_finish(srcu_idx);
+        return r;
+}
+
 #define private2dd(file) (file_inode(file)->i_private)
 #define private2ppd(file) (file_inode(file)->i_private)
 
@@ -87,8 +121,8 @@ static int _##name##_open(struct inode *inode, struct file *s) \
 static const struct file_operations _##name##_file_ops = { \
         .owner   = THIS_MODULE, \
         .open    = _##name##_open, \
-        .read    = seq_read, \
-        .llseek  = seq_lseek, \
+        .read    = hfi1_seq_read, \
+        .llseek  = hfi1_seq_lseek, \
         .release = seq_release \
 }
 
@@ -105,11 +139,9 @@ do { \
         DEBUGFS_FILE_CREATE(#name, parent, data, &_##name##_file_ops, S_IRUGO)
 
 static void *_opcode_stats_seq_start(struct seq_file *s, loff_t *pos)
-__acquires(RCU)
 {
         struct hfi1_opcode_stats_perctx *opstats;
 
-        rcu_read_lock();
         if (*pos >= ARRAY_SIZE(opstats->stats))
                 return NULL;
         return pos;
@@ -126,9 +158,7 @@ static void *_opcode_stats_seq_next(struct seq_file *s, void *v, loff_t *pos)
 }
 
 static void _opcode_stats_seq_stop(struct seq_file *s, void *v)
-__releases(RCU)
 {
-        rcu_read_unlock();
 }
 
 static int _opcode_stats_seq_show(struct seq_file *s, void *v)
@@ -223,28 +253,32 @@ DEBUGFS_SEQ_FILE_OPEN(ctx_stats)
 DEBUGFS_FILE_OPS(ctx_stats);
 
 static void *_qp_stats_seq_start(struct seq_file *s, loff_t *pos)
-__acquires(RCU)
+        __acquires(RCU)
 {
         struct qp_iter *iter;
         loff_t n = *pos;
 
-        rcu_read_lock();
         iter = qp_iter_init(s->private);
+
+        /* stop calls rcu_read_unlock */
+        rcu_read_lock();
+
         if (!iter)
                 return NULL;
 
-        while (n--) {
+        do {
                 if (qp_iter_next(iter)) {
                         kfree(iter);
                         return NULL;
                 }
-        }
+        } while (n--);
 
         return iter;
 }
 
 static void *_qp_stats_seq_next(struct seq_file *s, void *iter_ptr,
                                 loff_t *pos)
+        __must_hold(RCU)
 {
         struct qp_iter *iter = iter_ptr;
 
@@ -259,7 +293,7 @@ static void *_qp_stats_seq_next(struct seq_file *s, void *iter_ptr,
 }
 
 static void _qp_stats_seq_stop(struct seq_file *s, void *iter_ptr)
-__releases(RCU)
+        __releases(RCU)
 {
         rcu_read_unlock();
 }
@@ -281,12 +315,10 @@ DEBUGFS_SEQ_FILE_OPEN(qp_stats)
 DEBUGFS_FILE_OPS(qp_stats);
 
 static void *_sdes_seq_start(struct seq_file *s, loff_t *pos)
-__acquires(RCU)
 {
         struct hfi1_ibdev *ibd;
         struct hfi1_devdata *dd;
 
-        rcu_read_lock();
         ibd = (struct hfi1_ibdev *)s->private;
         dd = dd_from_dev(ibd);
         if (!dd->per_sdma || *pos >= dd->num_sdma)
@@ -306,9 +338,7 @@ static void *_sdes_seq_next(struct seq_file *s, void *v, loff_t *pos)
 }
 
 static void _sdes_seq_stop(struct seq_file *s, void *v)
-__releases(RCU)
 {
-        rcu_read_unlock();
 }
 
 static int _sdes_seq_show(struct seq_file *s, void *v)
@@ -335,11 +365,9 @@ static ssize_t dev_counters_read(struct file *file, char __user *buf,
         struct hfi1_devdata *dd;
         ssize_t rval;
 
-        rcu_read_lock();
         dd = private2dd(file);
         avail = hfi1_read_cntrs(dd, NULL, &counters);
         rval =  simple_read_from_buffer(buf, count, ppos, counters, avail);
-        rcu_read_unlock();
         return rval;
 }
 
@@ -352,11 +380,9 @@ static ssize_t dev_names_read(struct file *file, char __user *buf,
         struct hfi1_devdata *dd;
         ssize_t rval;
 
-        rcu_read_lock();
         dd = private2dd(file);
         avail = hfi1_read_cntrs(dd, &names, NULL);
         rval =  simple_read_from_buffer(buf, count, ppos, names, avail);
-        rcu_read_unlock();
         return rval;
 }
 
@@ -379,11 +405,9 @@ static ssize_t portnames_read(struct file *file, char __user *buf,
         struct hfi1_devdata *dd;
         ssize_t rval;
 
-        rcu_read_lock();
         dd = private2dd(file);
         avail = hfi1_read_portcntrs(dd->pport, &names, NULL);
         rval = simple_read_from_buffer(buf, count, ppos, names, avail);
-        rcu_read_unlock();
         return rval;
 }
 
@@ -396,11 +420,9 @@ static ssize_t portcntrs_debugfs_read(struct file *file, char __user *buf,
         struct hfi1_pportdata *ppd;
         ssize_t rval;
 
-        rcu_read_lock();
         ppd = private2ppd(file);
         avail = hfi1_read_portcntrs(ppd, NULL, &counters);
         rval = simple_read_from_buffer(buf, count, ppos, counters, avail);
-        rcu_read_unlock();
         return rval;
 }
 
@@ -430,16 +452,13 @@ static ssize_t asic_flags_read(struct file *file, char __user *buf,
         int used;
         int i;
 
-        rcu_read_lock();
         ppd = private2ppd(file);
         dd = ppd->dd;
         size = PAGE_SIZE;
         used = 0;
         tmp = kmalloc(size, GFP_KERNEL);
-        if (!tmp) {
-                rcu_read_unlock();
+        if (!tmp)
                 return -ENOMEM;
-        }
 
         scratch0 = read_csr(dd, ASIC_CFG_SCRATCH);
         used += scnprintf(tmp + used, size - used,
@@ -466,7 +485,6 @@ static ssize_t asic_flags_read(struct file *file, char __user *buf,
         used += scnprintf(tmp + used, size - used, "Write bits to clear\n");
 
         ret = simple_read_from_buffer(buf, count, ppos, tmp, used);
-        rcu_read_unlock();
         kfree(tmp);
         return ret;
 }
@@ -482,15 +500,12 @@ static ssize_t asic_flags_write(struct file *file, const char __user *buf,
         u64 scratch0;
         u64 clear;
 
-        rcu_read_lock();
         ppd = private2ppd(file);
         dd = ppd->dd;
 
         buff = kmalloc(count + 1, GFP_KERNEL);
-        if (!buff) {
-                ret = -ENOMEM;
-                goto do_return;
-        }
+        if (!buff)
+                return -ENOMEM;
 
         ret = copy_from_user(buff, buf, count);
         if (ret > 0) {
@@ -523,8 +538,6 @@ static ssize_t asic_flags_write(struct file *file, const char __user *buf,
 
  do_free:
         kfree(buff);
- do_return:
-        rcu_read_unlock();
         return ret;
 }
 
@@ -538,18 +551,14 @@ static ssize_t qsfp_debugfs_dump(struct file *file, char __user *buf,
         char *tmp;
         int ret;
 
-        rcu_read_lock();
         ppd = private2ppd(file);
         tmp = kmalloc(PAGE_SIZE, GFP_KERNEL);
-        if (!tmp) {
-                rcu_read_unlock();
+        if (!tmp)
                 return -ENOMEM;
-        }
 
         ret = qsfp_dump(ppd, tmp, PAGE_SIZE);
         if (ret > 0)
                 ret = simple_read_from_buffer(buf, count, ppos, tmp, ret);
-        rcu_read_unlock();
         kfree(tmp);
         return ret;
 }
@@ -565,7 +574,6 @@ static ssize_t __i2c_debugfs_write(struct file *file, const char __user *buf,
         int offset;
         int total_written;
 
-        rcu_read_lock();
         ppd = private2ppd(file);
 
         /* byte offset format: [offsetSize][i2cAddr][offsetHigh][offsetLow] */
@@ -573,16 +581,12 @@ static ssize_t __i2c_debugfs_write(struct file *file, const char __user *buf,
         offset = *ppos & 0xffff;
 
         /* explicitly reject invalid address 0 to catch cp and cat */
-        if (i2c_addr == 0) {
-                ret = -EINVAL;
-                goto _return;
-        }
+        if (i2c_addr == 0)
+                return -EINVAL;
 
         buff = kmalloc(count, GFP_KERNEL);
-        if (!buff) {
-                ret = -ENOMEM;
-                goto _return;
-        }
+        if (!buff)
+                return -ENOMEM;
 
         ret = copy_from_user(buff, buf, count);
         if (ret > 0) {
@@ -602,8 +606,6 @@ static ssize_t __i2c_debugfs_write(struct file *file, const char __user *buf,
 
  _free:
         kfree(buff);
- _return:
-        rcu_read_unlock();
         return ret;
 }
 
@@ -632,7 +634,6 @@ static ssize_t __i2c_debugfs_read(struct file *file, char __user *buf,
         int offset;
         int total_read;
 
-        rcu_read_lock();
         ppd = private2ppd(file);
 
         /* byte offset format: [offsetSize][i2cAddr][offsetHigh][offsetLow] */
@@ -640,16 +641,12 @@ static ssize_t __i2c_debugfs_read(struct file *file, char __user *buf,
         offset = *ppos & 0xffff;
 
         /* explicitly reject invalid address 0 to catch cp and cat */
-        if (i2c_addr == 0) {
-                ret = -EINVAL;
-                goto _return;
-        }
+        if (i2c_addr == 0)
+                return -EINVAL;
 
         buff = kmalloc(count, GFP_KERNEL);
-        if (!buff) {
-                ret = -ENOMEM;
-                goto _return;
-        }
+        if (!buff)
+                return -ENOMEM;
 
         total_read = i2c_read(ppd, target, i2c_addr, offset, buff, count);
         if (total_read < 0) {
@@ -669,8 +666,6 @@ static ssize_t __i2c_debugfs_read(struct file *file, char __user *buf,
 
  _free:
         kfree(buff);
- _return:
-        rcu_read_unlock();
         return ret;
 }
 
@@ -697,26 +692,20 @@ static ssize_t __qsfp_debugfs_write(struct file *file, const char __user *buf,
         int ret;
         int total_written;
 
-        rcu_read_lock();
-        if (*ppos + count > QSFP_PAGESIZE * 4) { /* base page + page00-page03 */
-                ret = -EINVAL;
-                goto _return;
-        }
+        if (*ppos + count > QSFP_PAGESIZE * 4) /* base page + page00-page03 */
+                return -EINVAL;
 
         ppd = private2ppd(file);
 
         buff = kmalloc(count, GFP_KERNEL);
-        if (!buff) {
-                ret = -ENOMEM;
-                goto _return;
-        }
+        if (!buff)
+                return -ENOMEM;
 
         ret = copy_from_user(buff, buf, count);
         if (ret > 0) {
                 ret = -EFAULT;
                 goto _free;
         }
-
         total_written = qsfp_write(ppd, target, *ppos, buff, count);
         if (total_written < 0) {
                 ret = total_written;
@@ -729,8 +718,6 @@ static ssize_t __qsfp_debugfs_write(struct file *file, const char __user *buf,
 
  _free:
         kfree(buff);
- _return:
-        rcu_read_unlock();
         return ret;
 }
 
@@ -757,7 +744,6 @@ static ssize_t __qsfp_debugfs_read(struct file *file, char __user *buf,
         int ret;
         int total_read;
 
-        rcu_read_lock();
         if (*ppos + count > QSFP_PAGESIZE * 4) { /* base page + page00-page03 */
                 ret = -EINVAL;
                 goto _return;
@@ -790,7 +776,6 @@ static ssize_t __qsfp_debugfs_read(struct file *file, char __user *buf,
  _free:
         kfree(buff);
  _return:
-        rcu_read_unlock();
         return ret;
 }
 
@@ -1006,7 +991,6 @@ void hfi1_dbg_ibdev_exit(struct hfi1_ibdev *ibd)
         debugfs_remove_recursive(ibd->hfi1_ibdev_dbg);
 out:
         ibd->hfi1_ibdev_dbg = NULL;
-        synchronize_rcu();
 }
 
 /*
@@ -1031,9 +1015,7 @@ static const char * const hfi1_statnames[] = {
 };
 
 static void *_driver_stats_names_seq_start(struct seq_file *s, loff_t *pos)
-__acquires(RCU)
 {
-        rcu_read_lock();
         if (*pos >= ARRAY_SIZE(hfi1_statnames))
                 return NULL;
         return pos;
@@ -1051,9 +1033,7 @@ static void *_driver_stats_names_seq_next(
 }
 
 static void _driver_stats_names_seq_stop(struct seq_file *s, void *v)
-__releases(RCU)
 {
-        rcu_read_unlock();
 }
 
 static int _driver_stats_names_seq_show(struct seq_file *s, void *v)
@@ -1069,9 +1049,7 @@ DEBUGFS_SEQ_FILE_OPEN(driver_stats_names)
 DEBUGFS_FILE_OPS(driver_stats_names);
 
 static void *_driver_stats_seq_start(struct seq_file *s, loff_t *pos)
-__acquires(RCU)
 {
-        rcu_read_lock();
         if (*pos >= ARRAY_SIZE(hfi1_statnames))
                 return NULL;
         return pos;
@@ -1086,9 +1064,7 @@ static void *_driver_stats_seq_next(struct seq_file *s, void *v, loff_t *pos)
 }
 
 static void _driver_stats_seq_stop(struct seq_file *s, void *v)
-__releases(RCU)
 {
-        rcu_read_unlock();
 }
 
 static u64 hfi1_sps_ints(void)
diff --git a/drivers/infiniband/hw/hfi1/driver.c b/drivers/infiniband/hw/hfi1/driver.c
index 8246dc7d0573..303f10555729 100644
--- a/drivers/infiniband/hw/hfi1/driver.c
+++ b/drivers/infiniband/hw/hfi1/driver.c
@@ -888,14 +888,15 @@ void set_all_slowpath(struct hfi1_devdata *dd)
 }
 
 static inline int set_armed_to_active(struct hfi1_ctxtdata *rcd,
-                                      struct hfi1_packet packet,
+                                      struct hfi1_packet *packet,
                                       struct hfi1_devdata *dd)
 {
         struct work_struct *lsaw = &rcd->ppd->linkstate_active_work;
-        struct hfi1_message_header *hdr = hfi1_get_msgheader(packet.rcd->dd,
-                                                             packet.rhf_addr);
+        struct hfi1_message_header *hdr = hfi1_get_msgheader(packet->rcd->dd,
+                                                             packet->rhf_addr);
+        u8 etype = rhf_rcv_type(packet->rhf);
 
-        if (hdr2sc(hdr, packet.rhf) != 0xf) {
+        if (etype == RHF_RCV_TYPE_IB && hdr2sc(hdr, packet->rhf) != 0xf) {
                 int hwstate = read_logical_state(dd);
 
                 if (hwstate != LSTATE_ACTIVE) {
@@ -979,7 +980,7 @@ int handle_receive_interrupt(struct hfi1_ctxtdata *rcd, int thread)
                         /* Auto activate link on non-SC15 packet receive */
                         if (unlikely(rcd->ppd->host_link_state ==
                                      HLS_UP_ARMED) &&
-                            set_armed_to_active(rcd, packet, dd))
+                            set_armed_to_active(rcd, &packet, dd))
                                 goto bail;
                         last = process_rcv_packet(&packet, thread);
                 }
diff --git a/drivers/infiniband/hw/hfi1/file_ops.c b/drivers/infiniband/hw/hfi1/file_ops.c
index 1ecbec192358..7e03ccd2554d 100644
--- a/drivers/infiniband/hw/hfi1/file_ops.c
+++ b/drivers/infiniband/hw/hfi1/file_ops.c
@@ -183,6 +183,7 @@ static int hfi1_file_open(struct inode *inode, struct file *fp)
         if (fd) {
                 fd->rec_cpu_num = -1; /* no cpu affinity by default */
                 fd->mm = current->mm;
+                atomic_inc(&fd->mm->mm_count);
         }
 
         fp->private_data = fd;
@@ -222,7 +223,7 @@ static long hfi1_file_ioctl(struct file *fp, unsigned int cmd,
                 ret = assign_ctxt(fp, &uinfo);
                 if (ret < 0)
                         return ret;
-                setup_ctxt(fp);
+                ret = setup_ctxt(fp);
                 if (ret)
                         return ret;
                 ret = user_init(fp);
@@ -779,6 +780,7 @@ static int hfi1_file_close(struct inode *inode, struct file *fp)
         mutex_unlock(&hfi1_mutex);
         hfi1_free_ctxtdata(dd, uctxt);
 done:
+        mmdrop(fdata->mm);
         kobject_put(&dd->kobj);
         kfree(fdata);
         return 0;
diff --git a/drivers/infiniband/hw/hfi1/hfi.h b/drivers/infiniband/hw/hfi1/hfi.h
index 1000e0fd96d9..325ec211370f 100644
--- a/drivers/infiniband/hw/hfi1/hfi.h
+++ b/drivers/infiniband/hw/hfi1/hfi.h
@@ -605,6 +605,7 @@ struct hfi1_pportdata {
         struct work_struct freeze_work;
         struct work_struct link_downgrade_work;
         struct work_struct link_bounce_work;
+        struct delayed_work start_link_work;
         /* host link state variables */
         struct mutex hls_lock;
         u32 host_link_state;
@@ -659,6 +660,7 @@ struct hfi1_pportdata {
         u8 linkinit_reason;
         u8 local_tx_rate;       /* rate given to 8051 firmware */
         u8 last_pstate;         /* info only */
+        u8 qsfp_retry_count;
 
         /* placeholders for IB MAD packet settings */
         u8 overrun_threshold;
@@ -1272,9 +1274,26 @@ static inline int hdr2sc(struct hfi1_message_header *hdr, u64 rhf)
                ((!!(rhf_dc_info(rhf))) << 4);
 }
 
+#define HFI1_JKEY_WIDTH       16
+#define HFI1_JKEY_MASK        (BIT(16) - 1)
+#define HFI1_ADMIN_JKEY_RANGE 32
+
+/*
+ * J_KEYs are split and allocated in the following groups:
+ *   0 - 31    - users with administrator privileges
+ *  32 - 63    - kernel protocols using KDETH packets
+ *  64 - 65535 - all other users using KDETH packets
+ */
 static inline u16 generate_jkey(kuid_t uid)
 {
-        return from_kuid(current_user_ns(), uid) & 0xffff;
+        u16 jkey = from_kuid(current_user_ns(), uid) & HFI1_JKEY_MASK;
+
+        if (capable(CAP_SYS_ADMIN))
+                jkey &= HFI1_ADMIN_JKEY_RANGE - 1;
+        else if (jkey < 64)
+                jkey |= BIT(HFI1_JKEY_WIDTH - 1);
+
+        return jkey;
 }
 
 /*
@@ -1656,7 +1675,6 @@ struct cc_state *get_cc_state_protected(struct hfi1_pportdata *ppd)
 struct hfi1_devdata *hfi1_init_dd(struct pci_dev *,
                                   const struct pci_device_id *);
 void hfi1_free_devdata(struct hfi1_devdata *);
-void cc_state_reclaim(struct rcu_head *rcu);
 struct hfi1_devdata *hfi1_alloc_devdata(struct pci_dev *pdev, size_t extra);
 
 /* LED beaconing functions */
@@ -1788,7 +1806,7 @@ extern unsigned int hfi1_max_mtu;
 extern unsigned int hfi1_cu;
 extern unsigned int user_credit_return_threshold;
 extern int num_user_contexts;
-extern unsigned n_krcvqs;
+extern unsigned long n_krcvqs;
 extern uint krcvqs[];
 extern int krcvqsset;
 extern uint kdeth_qp;
diff --git a/drivers/infiniband/hw/hfi1/init.c b/drivers/infiniband/hw/hfi1/init.c
index a358d23ecd54..384b43d2fd49 100644
--- a/drivers/infiniband/hw/hfi1/init.c
+++ b/drivers/infiniband/hw/hfi1/init.c
@@ -94,7 +94,7 @@ module_param_array(krcvqs, uint, &krcvqsset, S_IRUGO);
 MODULE_PARM_DESC(krcvqs, "Array of the number of non-control kernel receive queues by VL");
 
 /* computed based on above array */
-unsigned n_krcvqs;
+unsigned long n_krcvqs;
 
 static unsigned hfi1_rcvarr_split = 25;
 module_param_named(rcvarr_split, hfi1_rcvarr_split, uint, S_IRUGO);
@@ -500,6 +500,7 @@ void hfi1_init_pportdata(struct pci_dev *pdev, struct hfi1_pportdata *ppd,
         INIT_WORK(&ppd->link_downgrade_work, handle_link_downgrade);
         INIT_WORK(&ppd->sma_message_work, handle_sma_message);
         INIT_WORK(&ppd->link_bounce_work, handle_link_bounce);
+        INIT_DELAYED_WORK(&ppd->start_link_work, handle_start_link);
         INIT_WORK(&ppd->linkstate_active_work, receive_interrupt_work);
         INIT_WORK(&ppd->qsfp_info.qsfp_work, qsfp_event);
 
@@ -1333,7 +1334,7 @@ static void cleanup_device_data(struct hfi1_devdata *dd)
                 spin_unlock(&ppd->cc_state_lock);
 
                 if (cc_state)
-                        call_rcu(&cc_state->rcu, cc_state_reclaim);
+                        kfree_rcu(cc_state, rcu);
         }
 
         free_credit_return(dd);
diff --git a/drivers/infiniband/hw/hfi1/mad.c b/drivers/infiniband/hw/hfi1/mad.c
index 1263abe01999..7ffc14f21523 100644
--- a/drivers/infiniband/hw/hfi1/mad.c
+++ b/drivers/infiniband/hw/hfi1/mad.c
@@ -1819,6 +1819,11 @@ static int __subn_get_opa_cable_info(struct opa_smp *smp, u32 am, u8 *data,
         u32 len = OPA_AM_CI_LEN(am) + 1;
         int ret;
 
+        if (dd->pport->port_type != PORT_TYPE_QSFP) {
+                smp->status |= IB_SMP_INVALID_FIELD;
+                return reply((struct ib_mad_hdr *)smp);
+        }
+
 #define __CI_PAGE_SIZE BIT(7) /* 128 bytes */
 #define __CI_PAGE_MASK ~(__CI_PAGE_SIZE - 1)
 #define __CI_PAGE_NUM(a) ((a) & __CI_PAGE_MASK)
@@ -2599,7 +2604,7 @@ static int pma_get_opa_datacounters(struct opa_pma_mad *pmp,
         u8 lq, num_vls;
         u8 res_lli, res_ler;
         u64 port_mask;
-        unsigned long port_num;
+        u8 port_num;
         unsigned long vl;
         u32 vl_select_mask;
         int vfi;
@@ -2633,9 +2638,9 @@ static int pma_get_opa_datacounters(struct opa_pma_mad *pmp,
          */
         port_mask = be64_to_cpu(req->port_select_mask[3]);
         port_num = find_first_bit((unsigned long *)&port_mask,
-                                  sizeof(port_mask));
+                                  sizeof(port_mask) * 8);
 
-        if ((u8)port_num != port) {
+        if (port_num != port) {
                 pmp->mad_hdr.status |= IB_SMP_INVALID_FIELD;
                 return reply((struct ib_mad_hdr *)pmp);
         }
@@ -2837,7 +2842,7 @@ static int pma_get_opa_porterrors(struct opa_pma_mad *pmp,
          */
         port_mask = be64_to_cpu(req->port_select_mask[3]);
         port_num = find_first_bit((unsigned long *)&port_mask,
-                                  sizeof(port_mask));
+                                  sizeof(port_mask) * 8);
 
         if (port_num != port) {
                 pmp->mad_hdr.status |= IB_SMP_INVALID_FIELD;
@@ -3010,7 +3015,7 @@ static int pma_get_opa_errorinfo(struct opa_pma_mad *pmp,
          */
         port_mask = be64_to_cpu(req->port_select_mask[3]);
         port_num = find_first_bit((unsigned long *)&port_mask,
-                                  sizeof(port_mask));
+                                  sizeof(port_mask) * 8);
 
         if (port_num != port) {
                 pmp->mad_hdr.status |= IB_SMP_INVALID_FIELD;
@@ -3247,7 +3252,7 @@ static int pma_set_opa_errorinfo(struct opa_pma_mad *pmp,
          */
         port_mask = be64_to_cpu(req->port_select_mask[3]);
         port_num = find_first_bit((unsigned long *)&port_mask,
-                                  sizeof(port_mask));
+                                  sizeof(port_mask) * 8);
 
         if (port_num != port) {
                 pmp->mad_hdr.status |= IB_SMP_INVALID_FIELD;
@@ -3398,7 +3403,7 @@ static void apply_cc_state(struct hfi1_pportdata *ppd)
 
         spin_unlock(&ppd->cc_state_lock);
 
-        call_rcu(&old_cc_state->rcu, cc_state_reclaim);
+        kfree_rcu(old_cc_state, rcu);
 }
 
 static int __subn_set_opa_cong_setting(struct opa_smp *smp, u32 am, u8 *data,
@@ -3553,13 +3558,6 @@ static int __subn_get_opa_cc_table(struct opa_smp *smp, u32 am, u8 *data,
         return reply((struct ib_mad_hdr *)smp);
 }
 
-void cc_state_reclaim(struct rcu_head *rcu)
-{
-        struct cc_state *cc_state = container_of(rcu, struct cc_state, rcu);
-
-        kfree(cc_state);
-}
-
 static int __subn_set_opa_cc_table(struct opa_smp *smp, u32 am, u8 *data,
                                    struct ib_device *ibdev, u8 port,
                                    u32 *resp_len)
diff --git a/drivers/infiniband/hw/hfi1/pio_copy.c b/drivers/infiniband/hw/hfi1/pio_copy.c
index 8c25e1b58849..3a1ef3056282 100644
--- a/drivers/infiniband/hw/hfi1/pio_copy.c
+++ b/drivers/infiniband/hw/hfi1/pio_copy.c
@@ -771,6 +771,9 @@ void seg_pio_copy_mid(struct pio_buf *pbuf, const void *from, size_t nbytes)
                         read_extra_bytes(pbuf, from, to_fill);
                         from += to_fill;
                         nbytes -= to_fill;
+                        /* may not be enough valid bytes left to align */
+                        if (extra > nbytes)
+                                extra = nbytes;
 
                         /* ...now write carry */
                         dest = pbuf->start + (pbuf->qw_written * sizeof(u64));
@@ -798,6 +801,15 @@ void seg_pio_copy_mid(struct pio_buf *pbuf, const void *from, size_t nbytes)
                         read_low_bytes(pbuf, from, extra);
                         from += extra;
                         nbytes -= extra;
+                        /*
+                         * If no bytes are left, return early - we are done.
+                         * NOTE: This short-circuit is *required* because
+                         * "extra" may have been reduced in size and "from"
+                         * is not aligned, as required when leaving this
+                         * if block.
+                         */
+                        if (nbytes == 0)
+                                return;
                 }
 
                 /* at this point, from is QW aligned */
diff --git a/drivers/infiniband/hw/hfi1/qp.c b/drivers/infiniband/hw/hfi1/qp.c
index a5aa3517e7d5..4e4d8317c281 100644
--- a/drivers/infiniband/hw/hfi1/qp.c
+++ b/drivers/infiniband/hw/hfi1/qp.c
@@ -656,10 +656,6 @@ struct qp_iter *qp_iter_init(struct hfi1_ibdev *dev)
 
         iter->dev = dev;
         iter->specials = dev->rdi.ibdev.phys_port_cnt * 2;
-        if (qp_iter_next(iter)) {
-                kfree(iter);
-                return NULL;
-        }
 
         return iter;
 }
diff --git a/drivers/infiniband/hw/hfi1/qsfp.c b/drivers/infiniband/hw/hfi1/qsfp.c
index a207717ade2a..4e95ad810847 100644
--- a/drivers/infiniband/hw/hfi1/qsfp.c
+++ b/drivers/infiniband/hw/hfi1/qsfp.c
@@ -706,8 +706,8 @@ int get_cable_info(struct hfi1_devdata *dd, u32 port_num, u32 addr, u32 len,
                    u8 *data)
 {
         struct hfi1_pportdata *ppd;
-        u32 excess_len = 0;
-        int ret = 0;
+        u32 excess_len = len;
+        int ret = 0, offset = 0;
 
         if (port_num > dd->num_pports || port_num < 1) {
                 dd_dev_info(dd, "%s: Invalid port number %d\n",
@@ -740,6 +740,34 @@ int get_cable_info(struct hfi1_devdata *dd, u32 port_num, u32 addr, u32 len,
         }
 
         memcpy(data, &ppd->qsfp_info.cache[addr], len);
+
+        if (addr <= QSFP_MONITOR_VAL_END &&
+            (addr + len) >= QSFP_MONITOR_VAL_START) {
+                /* Overlap with the dynamic channel monitor range */
+                if (addr < QSFP_MONITOR_VAL_START) {
+                        if (addr + len <= QSFP_MONITOR_VAL_END)
+                                len = addr + len - QSFP_MONITOR_VAL_START;
+                        else
+                                len = QSFP_MONITOR_RANGE;
+                        offset = QSFP_MONITOR_VAL_START - addr;
+                        addr = QSFP_MONITOR_VAL_START;
+                } else if (addr == QSFP_MONITOR_VAL_START) {
+                        offset = 0;
+                        if (addr + len > QSFP_MONITOR_VAL_END)
+                                len = QSFP_MONITOR_RANGE;
+                } else {
+                        offset = 0;
+                        if (addr + len > QSFP_MONITOR_VAL_END)
+                                len = QSFP_MONITOR_VAL_END - addr + 1;
+                }
+                /* Refresh the values of the dynamic monitors from the cable */
+                ret = one_qsfp_read(ppd, dd->hfi1_id, addr, data + offset, len);
+                if (ret != len) {
+                        ret = -EAGAIN;
+                        goto set_zeroes;
+                }
+        }
+
         return 0;
 
 set_zeroes:
diff --git a/drivers/infiniband/hw/hfi1/qsfp.h b/drivers/infiniband/hw/hfi1/qsfp.h
index 69275ebd9597..36cf52359848 100644
--- a/drivers/infiniband/hw/hfi1/qsfp.h
+++ b/drivers/infiniband/hw/hfi1/qsfp.h
@@ -74,6 +74,9 @@
 /* Defined fields that Intel requires of qualified cables */
 /* Byte 0 is Identifier, not checked */
 /* Byte 1 is reserved "status MSB" */
+#define QSFP_MONITOR_VAL_START 22
+#define QSFP_MONITOR_VAL_END 81
+#define QSFP_MONITOR_RANGE (QSFP_MONITOR_VAL_END - QSFP_MONITOR_VAL_START + 1)
 #define QSFP_TX_CTRL_BYTE_OFFS 86
 #define QSFP_PWR_CTRL_BYTE_OFFS 93
 #define QSFP_CDR_CTRL_BYTE_OFFS 98
diff --git a/drivers/infiniband/hw/hfi1/user_sdma.c b/drivers/infiniband/hw/hfi1/user_sdma.c
index 0ecf27903dc2..1694037d1eee 100644
--- a/drivers/infiniband/hw/hfi1/user_sdma.c
+++ b/drivers/infiniband/hw/hfi1/user_sdma.c
@@ -114,6 +114,8 @@ MODULE_PARM_DESC(sdma_comp_size, "Size of User SDMA completion ring. Default: 12
 #define KDETH_HCRC_LOWER_SHIFT    24
 #define KDETH_HCRC_LOWER_MASK     0xff
 
+#define AHG_KDETH_INTR_SHIFT 12
+
 #define PBC2LRH(x) ((((x) & 0xfff) << 2) - 4)
 #define LRH2PBC(x) ((((x) >> 2) + 1) & 0xfff)
 
@@ -1480,7 +1482,8 @@ static int set_txreq_header_ahg(struct user_sdma_request *req,
                 /* Clear KDETH.SH on last packet */
                 if (unlikely(tx->flags & TXREQ_FLAGS_REQ_LAST_PKT)) {
                         val |= cpu_to_le16(KDETH_GET(hdr->kdeth.ver_tid_offset,
-                                                                INTR) >> 16);
+                                                     INTR) <<
+                                           AHG_KDETH_INTR_SHIFT);
                         val &= cpu_to_le16(~(1U << 13));
                         AHG_HEADER_SET(req->ahg, diff, 7, 16, 14, val);
                 } else {
diff --git a/drivers/infiniband/hw/i40iw/i40iw.h b/drivers/infiniband/hw/i40iw/i40iw.h
index b738acdb9b02..8ec09e470f84 100644
--- a/drivers/infiniband/hw/i40iw/i40iw.h
+++ b/drivers/infiniband/hw/i40iw/i40iw.h
@@ -232,7 +232,7 @@ struct i40iw_device {
         struct i40e_client *client;
         struct i40iw_hw hw;
         struct i40iw_cm_core cm_core;
-        unsigned long *mem_resources;
+        u8 *mem_resources;
         unsigned long *allocated_qps;
         unsigned long *allocated_cqs;
         unsigned long *allocated_mrs;
@@ -435,8 +435,8 @@ static inline int i40iw_alloc_resource(struct i40iw_device *iwdev,
         *next = resource_num + 1;
         if (*next == max_resources)
                 *next = 0;
-        spin_unlock_irqrestore(&iwdev->resource_lock, flags);
         *req_resource_num = resource_num;
+        spin_unlock_irqrestore(&iwdev->resource_lock, flags);
 
         return 0;
 }
diff --git a/drivers/infiniband/hw/i40iw/i40iw_cm.c b/drivers/infiniband/hw/i40iw/i40iw_cm.c
index 5026dc79978a..7ca0638579c0 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_cm.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_cm.c
@@ -535,8 +535,8 @@ static struct i40iw_puda_buf *i40iw_form_cm_frame(struct i40iw_cm_node *cm_node,
                 buf += hdr_len;
         }
 
-        if (pd_len)
-                memcpy(buf, pdata->addr, pd_len);
+        if (pdata && pdata->addr)
+                memcpy(buf, pdata->addr, pdata->size);
 
         atomic_set(&sqbuf->refcount, 1);
 
@@ -3347,26 +3347,6 @@ int i40iw_cm_disconn(struct i40iw_qp *iwqp)
 }
 
 /**
- * i40iw_loopback_nop - Send a nop
- * @qp: associated hw qp
- */
-static void i40iw_loopback_nop(struct i40iw_sc_qp *qp)
-{
-        u64 *wqe;
-        u64 header;
-
-        wqe = qp->qp_uk.sq_base->elem;
-        set_64bit_val(wqe, 0, 0);
-        set_64bit_val(wqe, 8, 0);
-        set_64bit_val(wqe, 16, 0);
-
-        header = LS_64(I40IWQP_OP_NOP, I40IWQPSQ_OPCODE) |
-            LS_64(0, I40IWQPSQ_SIGCOMPL) |
-            LS_64(qp->qp_uk.swqe_polarity, I40IWQPSQ_VALID);
-        set_64bit_val(wqe, 24, header);
-}
-
-/**
  * i40iw_qp_disconnect - free qp and close cm
  * @iwqp: associate qp for the connection
  */
@@ -3638,7 +3618,7 @@ int i40iw_accept(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
         } else {
                 if (iwqp->page)
                         iwqp->sc_qp.qp_uk.sq_base = kmap(iwqp->page);
-                i40iw_loopback_nop(&iwqp->sc_qp);
+                dev->iw_priv_qp_ops->qp_send_lsmm(&iwqp->sc_qp, NULL, 0, 0);
         }
 
         if (iwqp->page)
diff --git a/drivers/infiniband/hw/i40iw/i40iw_hw.c b/drivers/infiniband/hw/i40iw/i40iw_hw.c
index 3ee0cad96bc6..0c92a40b3e86 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_hw.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_hw.c
@@ -265,6 +265,7 @@ void i40iw_next_iw_state(struct i40iw_qp *iwqp,
                 info.dont_send_fin = false;
         if (iwqp->sc_qp.term_flags && (state == I40IW_QP_STATE_ERROR))
                 info.reset_tcp_conn = true;
+        iwqp->hw_iwarp_state = state;
         i40iw_hw_modify_qp(iwqp->iwdev, iwqp, &info, 0);
 }
 
diff --git a/drivers/infiniband/hw/i40iw/i40iw_main.c b/drivers/infiniband/hw/i40iw/i40iw_main.c
index 6e9081380a27..445e230d5ff8 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_main.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_main.c
@@ -100,7 +100,7 @@ static struct notifier_block i40iw_net_notifier = {
         .notifier_call = i40iw_net_event
 };
 
-static int i40iw_notifiers_registered;
+static atomic_t i40iw_notifiers_registered;
 
 /**
  * i40iw_find_i40e_handler - find a handler given a client info
@@ -1342,12 +1342,11 @@ exit:
  */
 static void i40iw_register_notifiers(void)
 {
-        if (!i40iw_notifiers_registered) {
+        if (atomic_inc_return(&i40iw_notifiers_registered) == 1) {
                 register_inetaddr_notifier(&i40iw_inetaddr_notifier);
                 register_inet6addr_notifier(&i40iw_inetaddr6_notifier);
                 register_netevent_notifier(&i40iw_net_notifier);
         }
-        i40iw_notifiers_registered++;
 }
 
 /**
@@ -1429,8 +1428,7 @@ static void i40iw_deinit_device(struct i40iw_device *iwdev, bool reset, bool del
                         i40iw_del_macip_entry(iwdev, (u8)iwdev->mac_ip_table_idx);
                 /* fallthrough */
         case INET_NOTIFIER:
-                if (i40iw_notifiers_registered > 0) {
-                        i40iw_notifiers_registered--;
+                if (!atomic_dec_return(&i40iw_notifiers_registered)) {
                         unregister_netevent_notifier(&i40iw_net_notifier);
                         unregister_inetaddr_notifier(&i40iw_inetaddr_notifier);
                         unregister_inet6addr_notifier(&i40iw_inetaddr6_notifier);
@@ -1558,6 +1556,10 @@ static int i40iw_open(struct i40e_info *ldev, struct i40e_client *client)
         enum i40iw_status_code status;
         struct i40iw_handler *hdl;
 
+        hdl = i40iw_find_netdev(ldev->netdev);
+        if (hdl)
+                return 0;
+
         hdl = kzalloc(sizeof(*hdl), GFP_KERNEL);
         if (!hdl)
                 return -ENOMEM;
diff --git a/drivers/infiniband/hw/i40iw/i40iw_utils.c b/drivers/infiniband/hw/i40iw/i40iw_utils.c
index 0e8db0a35141..6fd043b1d714 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_utils.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_utils.c
@@ -673,8 +673,11 @@ enum i40iw_status_code i40iw_free_virt_mem(struct i40iw_hw *hw,
 {
         if (!mem)
                 return I40IW_ERR_PARAM;
+        /*
+         * mem->va points to the parent of mem, so both mem and mem->va
+         * can not be touched once mem->va is freed
+         */
         kfree(mem->va);
-        mem->va = NULL;
         return 0;
 }
 
diff --git a/drivers/infiniband/hw/i40iw/i40iw_verbs.c b/drivers/infiniband/hw/i40iw/i40iw_verbs.c
index 2360338877bf..6329c971c22f 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_verbs.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_verbs.c
@@ -794,7 +794,6 @@ static struct ib_qp *i40iw_create_qp(struct ib_pd *ibpd,
         return &iwqp->ibqp;
 error:
         i40iw_free_qp_resources(iwdev, iwqp, qp_num);
-        kfree(mem);
         return ERR_PTR(err_code);
 }
 
@@ -1926,8 +1925,7 @@ static int i40iw_dereg_mr(struct ib_mr *ib_mr)
                 }
                 if (iwpbl->pbl_allocated)
                         i40iw_free_pble(iwdev->pble_rsrc, palloc);
-                kfree(iwpbl->iwmr);
-                iwpbl->iwmr = NULL;
+                kfree(iwmr);
                 return 0;
         }
 
diff --git a/drivers/infiniband/hw/mlx4/cq.c b/drivers/infiniband/hw/mlx4/cq.c
index d6fc8a6e8c33..5df63dacaaa3 100644
--- a/drivers/infiniband/hw/mlx4/cq.c
+++ b/drivers/infiniband/hw/mlx4/cq.c
@@ -576,8 +576,8 @@ static int mlx4_ib_ipoib_csum_ok(__be16 status, __be16 checksum)
                 checksum == cpu_to_be16(0xffff);
 }
 
-static int use_tunnel_data(struct mlx4_ib_qp *qp, struct mlx4_ib_cq *cq, struct ib_wc *wc,
-                           unsigned tail, struct mlx4_cqe *cqe, int is_eth)
+static void use_tunnel_data(struct mlx4_ib_qp *qp, struct mlx4_ib_cq *cq, struct ib_wc *wc,
+                            unsigned tail, struct mlx4_cqe *cqe, int is_eth)
 {
         struct mlx4_ib_proxy_sqp_hdr *hdr;
 
@@ -600,8 +600,6 @@ static int use_tunnel_data(struct mlx4_ib_qp *qp, struct mlx4_ib_cq *cq, struct
                 wc->slid        = be16_to_cpu(hdr->tun.slid_mac_47_32);
                 wc->sl          = (u8) (be16_to_cpu(hdr->tun.sl_vid) >> 12);
         }
-
-        return 0;
 }
 
 static void mlx4_ib_qp_sw_comp(struct mlx4_ib_qp *qp, int num_entries,
@@ -689,12 +687,6 @@ repoll:
         is_error = (cqe->owner_sr_opcode & MLX4_CQE_OPCODE_MASK) ==
                 MLX4_CQE_OPCODE_ERROR;
 
-        if (unlikely((cqe->owner_sr_opcode & MLX4_CQE_OPCODE_MASK) == MLX4_OPCODE_NOP &&
-                     is_send)) {
-                pr_warn("Completion for NOP opcode detected!\n");
-                return -EINVAL;
-        }
-
         /* Resize CQ in progress */
         if (unlikely((cqe->owner_sr_opcode & MLX4_CQE_OPCODE_MASK) == MLX4_CQE_OPCODE_RESIZE)) {
                 if (cq->resize_buf) {
@@ -720,12 +712,6 @@ repoll:
                  */
                 mqp = __mlx4_qp_lookup(to_mdev(cq->ibcq.device)->dev,
                                        be32_to_cpu(cqe->vlan_my_qpn));
-                if (unlikely(!mqp)) {
-                        pr_warn("CQ %06x with entry for unknown QPN %06x\n",
-                               cq->mcq.cqn, be32_to_cpu(cqe->vlan_my_qpn) & MLX4_CQE_QPN_MASK);
-                        return -EINVAL;
-                }
-
                 *cur_qp = to_mibqp(mqp);
         }
 
@@ -738,11 +724,6 @@ repoll:
                 /* SRQ is also in the radix tree */
                 msrq = mlx4_srq_lookup(to_mdev(cq->ibcq.device)->dev,
                                        srq_num);
-                if (unlikely(!msrq)) {
-                        pr_warn("CQ %06x with entry for unknown SRQN %06x\n",
-                                cq->mcq.cqn, srq_num);
-                        return -EINVAL;
-                }
         }
 
         if (is_send) {
@@ -852,9 +833,11 @@ repoll:
                 if (mlx4_is_mfunc(to_mdev(cq->ibcq.device)->dev)) {
                         if ((*cur_qp)->mlx4_ib_qp_type &
                             (MLX4_IB_QPT_PROXY_SMI_OWNER |
-                             MLX4_IB_QPT_PROXY_SMI | MLX4_IB_QPT_PROXY_GSI))
-                                return use_tunnel_data(*cur_qp, cq, wc, tail,
-                                                       cqe, is_eth);
+                             MLX4_IB_QPT_PROXY_SMI | MLX4_IB_QPT_PROXY_GSI)) {
+                                use_tunnel_data(*cur_qp, cq, wc, tail, cqe,
+                                                is_eth);
+                                return 0;
+                        }
                 }
 
                 wc->slid           = be16_to_cpu(cqe->rlid);
@@ -891,7 +874,6 @@ int mlx4_ib_poll_cq(struct ib_cq *ibcq, int num_entries, struct ib_wc *wc)
         struct mlx4_ib_qp *cur_qp = NULL;
         unsigned long flags;
         int npolled;
-        int err = 0;
         struct mlx4_ib_dev *mdev = to_mdev(cq->ibcq.device);
 
         spin_lock_irqsave(&cq->lock, flags);
@@ -901,8 +883,7 @@ int mlx4_ib_poll_cq(struct ib_cq *ibcq, int num_entries, struct ib_wc *wc)
         }
 
         for (npolled = 0; npolled < num_entries; ++npolled) {
-                err = mlx4_ib_poll_one(cq, &cur_qp, wc + npolled);
-                if (err)
+                if (mlx4_ib_poll_one(cq, &cur_qp, wc + npolled))
                         break;
         }
 
@@ -911,10 +892,7 @@ int mlx4_ib_poll_cq(struct ib_cq *ibcq, int num_entries, struct ib_wc *wc)
 out:
         spin_unlock_irqrestore(&cq->lock, flags);
 
-        if (err == 0 || err == -EAGAIN)
-                return npolled;
-        else
-                return err;
+        return npolled;
 }
 
 int mlx4_ib_arm_cq(struct ib_cq *ibcq, enum ib_cq_notify_flags flags)
diff --git a/drivers/infiniband/hw/mlx4/mad.c b/drivers/infiniband/hw/mlx4/mad.c
index 9c2e53d28f98..0f21c3a25552 100644
--- a/drivers/infiniband/hw/mlx4/mad.c
+++ b/drivers/infiniband/hw/mlx4/mad.c
@@ -1128,6 +1128,27 @@ void handle_port_mgmt_change_event(struct work_struct *work)
 
                 /* Generate GUID changed event */
                 if (changed_attr & MLX4_EQ_PORT_INFO_GID_PFX_CHANGE_MASK) {
+                        if (mlx4_is_master(dev->dev)) {
+                                union ib_gid gid;
+                                int err = 0;
+
+                                if (!eqe->event.port_mgmt_change.params.port_info.gid_prefix)
+                                        err = __mlx4_ib_query_gid(&dev->ib_dev, port, 0, &gid, 1);
+                                else
+                                        gid.global.subnet_prefix =
+                                                eqe->event.port_mgmt_change.params.port_info.gid_prefix;
+                                if (err) {
+                                        pr_warn("Could not change QP1 subnet prefix for port %d: query_gid error (%d)\n",
+                                                port, err);
+                                } else {
+                                        pr_debug("Changing QP1 subnet prefix for port %d. old=0x%llx. new=0x%llx\n",
+                                                 port,
+                                                 (u64)atomic64_read(&dev->sriov.demux[port - 1].subnet_prefix),
+                                                 be64_to_cpu(gid.global.subnet_prefix));
+                                        atomic64_set(&dev->sriov.demux[port - 1].subnet_prefix,
+                                                     be64_to_cpu(gid.global.subnet_prefix));
+                                }
+                        }
                         mlx4_ib_dispatch_event(dev, port, IB_EVENT_GID_CHANGE);
                         /*if master, notify all slaves*/
                         if (mlx4_is_master(dev->dev))
@@ -2202,6 +2223,8 @@ int mlx4_ib_init_sriov(struct mlx4_ib_dev *dev)
                 if (err)
                         goto demux_err;
                 dev->sriov.demux[i].guid_cache[0] = gid.global.interface_id;
+                atomic64_set(&dev->sriov.demux[i].subnet_prefix,
+                             be64_to_cpu(gid.global.subnet_prefix));
                 err = alloc_pv_object(dev, mlx4_master_func_num(dev->dev), i + 1,
                                       &dev->sriov.sqps[i]);
                 if (err)
diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c
index 2af44c2de262..87ba9bca4181 100644
--- a/drivers/infiniband/hw/mlx4/main.c
+++ b/drivers/infiniband/hw/mlx4/main.c
@@ -2202,6 +2202,9 @@ static int mlx4_ib_alloc_diag_counters(struct mlx4_ib_dev *ibdev)
         bool per_port = !!(ibdev->dev->caps.flags2 &
                 MLX4_DEV_CAP_FLAG2_DIAG_PER_PORT);
 
+        if (mlx4_is_slave(ibdev->dev))
+                return 0;
+
         for (i = 0; i < MLX4_DIAG_COUNTERS_TYPES; i++) {
                 /* i == 1 means we are building port counters */
                 if (i && !per_port)
diff --git a/drivers/infiniband/hw/mlx4/mcg.c b/drivers/infiniband/hw/mlx4/mcg.c
index 8f7ad07915b0..097bfcc4ee99 100644
--- a/drivers/infiniband/hw/mlx4/mcg.c
+++ b/drivers/infiniband/hw/mlx4/mcg.c
@@ -489,7 +489,7 @@ static u8 get_leave_state(struct mcast_group *group)
                 if (!group->members[i])
                         leave_state |= (1 << i);
 
-        return leave_state & (group->rec.scope_join_state & 7);
+        return leave_state & (group->rec.scope_join_state & 0xf);
 }
 
 static int join_group(struct mcast_group *group, int slave, u8 join_mask)
@@ -564,8 +564,8 @@ static void mlx4_ib_mcg_timeout_handler(struct work_struct *work)
                 } else
                         mcg_warn_group(group, "DRIVER BUG\n");
         } else if (group->state == MCAST_LEAVE_SENT) {
-                if (group->rec.scope_join_state & 7)
-                        group->rec.scope_join_state &= 0xf8;
+                if (group->rec.scope_join_state & 0xf)
+                        group->rec.scope_join_state &= 0xf0;
                 group->state = MCAST_IDLE;
                 mutex_unlock(&group->lock);
                 if (release_group(group, 1))
@@ -605,7 +605,7 @@ static int handle_leave_req(struct mcast_group *group, u8 leave_mask,
 static int handle_join_req(struct mcast_group *group, u8 join_mask,
                            struct mcast_req *req)
 {
-        u8 group_join_state = group->rec.scope_join_state & 7;
+        u8 group_join_state = group->rec.scope_join_state & 0xf;
         int ref = 0;
         u16 status;
         struct ib_sa_mcmember_data *sa_data = (struct ib_sa_mcmember_data *)req->sa_mad.data;
@@ -690,8 +690,8 @@ static void mlx4_ib_mcg_work_handler(struct work_struct *work)
                         u8 cur_join_state;
 
                         resp_join_state = ((struct ib_sa_mcmember_data *)
-                                                group->response_sa_mad.data)->scope_join_state & 7;
-                        cur_join_state = group->rec.scope_join_state & 7;
+                                                group->response_sa_mad.data)->scope_join_state & 0xf;
+                        cur_join_state = group->rec.scope_join_state & 0xf;
 
                         if (method == IB_MGMT_METHOD_GET_RESP) {
                                 /* successfull join */
@@ -710,7 +710,7 @@ process_requests:
                 req = list_first_entry(&group->pending_list, struct mcast_req,
                                        group_list);
                 sa_data = (struct ib_sa_mcmember_data *)req->sa_mad.data;
-                req_join_state = sa_data->scope_join_state & 0x7;
+                req_join_state = sa_data->scope_join_state & 0xf;
 
                 /* For a leave request, we will immediately answer the VF, and
                  * update our internal counters. The actual leave will be sent
diff --git a/drivers/infiniband/hw/mlx4/mlx4_ib.h b/drivers/infiniband/hw/mlx4/mlx4_ib.h
index 7c5832ede4bd..686ab48ff644 100644
--- a/drivers/infiniband/hw/mlx4/mlx4_ib.h
+++ b/drivers/infiniband/hw/mlx4/mlx4_ib.h
@@ -448,7 +448,7 @@ struct mlx4_ib_demux_ctx {
         struct workqueue_struct *wq;
         struct workqueue_struct *ud_wq;
         spinlock_t ud_lock;
-        __be64 subnet_prefix;
+        atomic64_t subnet_prefix;
         __be64 guid_cache[128];
         struct mlx4_ib_dev *dev;
         /* the following lock protects both mcg_table and mcg_mgid0_list */
diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c
index 768085f59566..7fb9629bd12b 100644
--- a/drivers/infiniband/hw/mlx4/qp.c
+++ b/drivers/infiniband/hw/mlx4/qp.c
@@ -2493,24 +2493,27 @@ static int build_mlx_header(struct mlx4_ib_sqp *sqp, struct ib_ud_wr *wr,
                 sqp->ud_header.grh.flow_label    =
                         ah->av.ib.sl_tclass_flowlabel & cpu_to_be32(0xfffff);
                 sqp->ud_header.grh.hop_limit     = ah->av.ib.hop_limit;
-                if (is_eth)
+                if (is_eth) {
                         memcpy(sqp->ud_header.grh.source_gid.raw, sgid.raw, 16);
-                else {
-                if (mlx4_is_mfunc(to_mdev(ib_dev)->dev)) {
-                        /* When multi-function is enabled, the ib_core gid
-                         * indexes don't necessarily match the hw ones, so
-                         * we must use our own cache */
-                        sqp->ud_header.grh.source_gid.global.subnet_prefix =
-                                to_mdev(ib_dev)->sriov.demux[sqp->qp.port - 1].
-                                                       subnet_prefix;
-                        sqp->ud_header.grh.source_gid.global.interface_id =
-                                to_mdev(ib_dev)->sriov.demux[sqp->qp.port - 1].
-                                               guid_cache[ah->av.ib.gid_index];
-                } else
-                        ib_get_cached_gid(ib_dev,
-                                          be32_to_cpu(ah->av.ib.port_pd) >> 24,
-                                          ah->av.ib.gid_index,
-                                          &sqp->ud_header.grh.source_gid, NULL);
+                } else {
+                        if (mlx4_is_mfunc(to_mdev(ib_dev)->dev)) {
+                                /* When multi-function is enabled, the ib_core gid
+                                 * indexes don't necessarily match the hw ones, so
+                                 * we must use our own cache
+                                 */
+                                sqp->ud_header.grh.source_gid.global.subnet_prefix =
+                                        cpu_to_be64(atomic64_read(&(to_mdev(ib_dev)->sriov.
+                                                                    demux[sqp->qp.port - 1].
+                                                                    subnet_prefix)));
+                                sqp->ud_header.grh.source_gid.global.interface_id =
+                                        to_mdev(ib_dev)->sriov.demux[sqp->qp.port - 1].
+                                                       guid_cache[ah->av.ib.gid_index];
+                        } else {
+                                ib_get_cached_gid(ib_dev,
+                                                  be32_to_cpu(ah->av.ib.port_pd) >> 24,
+                                                  ah->av.ib.gid_index,
+                                                  &sqp->ud_header.grh.source_gid, NULL);
+                        }
                 }
                 memcpy(sqp->ud_header.grh.destination_gid.raw,
                        ah->av.ib.dgid, 16);
diff --git a/drivers/infiniband/hw/mlx5/cq.c b/drivers/infiniband/hw/mlx5/cq.c
index 308a358e5b46..e4fac9292e4a 100644
--- a/drivers/infiniband/hw/mlx5/cq.c
+++ b/drivers/infiniband/hw/mlx5/cq.c
@@ -553,12 +553,6 @@ repoll:
                  * from the table.
                  */
                 mqp = __mlx5_qp_lookup(dev->mdev, qpn);
-                if (unlikely(!mqp)) {
-                        mlx5_ib_warn(dev, "CQE@CQ %06x for unknown QPN %6x\n",
-                                     cq->mcq.cqn, qpn);
-                        return -EINVAL;
-                }
-
                 *cur_qp = to_mibqp(mqp);
         }
 
@@ -619,13 +613,6 @@ repoll:
                 read_lock(&dev->mdev->priv.mkey_table.lock);
                 mmkey = __mlx5_mr_lookup(dev->mdev,
                                          mlx5_base_mkey(be32_to_cpu(sig_err_cqe->mkey)));
-                if (unlikely(!mmkey)) {
-                        read_unlock(&dev->mdev->priv.mkey_table.lock);
-                        mlx5_ib_warn(dev, "CQE@CQ %06x for unknown MR %6x\n",
-                                     cq->mcq.cqn, be32_to_cpu(sig_err_cqe->mkey));
-                        return -EINVAL;
-                }
-
                 mr = to_mibmr(mmkey);
                 get_sig_err_item(sig_err_cqe, &mr->sig->err_item);
                 mr->sig->sig_err_exists = true;
@@ -676,7 +663,6 @@ int mlx5_ib_poll_cq(struct ib_cq *ibcq, int num_entries, struct ib_wc *wc)
         unsigned long flags;
         int soft_polled = 0;
         int npolled;
-        int err = 0;
 
         spin_lock_irqsave(&cq->lock, flags);
         if (mdev->state == MLX5_DEVICE_STATE_INTERNAL_ERROR) {
@@ -688,8 +674,7 @@ int mlx5_ib_poll_cq(struct ib_cq *ibcq, int num_entries, struct ib_wc *wc)
                 soft_polled = poll_soft_wc(cq, num_entries, wc);
 
         for (npolled = 0; npolled < num_entries - soft_polled; npolled++) {
-                err = mlx5_poll_one(cq, &cur_qp, wc + soft_polled + npolled);
-                if (err)
+                if (mlx5_poll_one(cq, &cur_qp, wc + soft_polled + npolled))
                         break;
         }
 
@@ -698,10 +683,7 @@ int mlx5_ib_poll_cq(struct ib_cq *ibcq, int num_entries, struct ib_wc *wc)
 out:
         spin_unlock_irqrestore(&cq->lock, flags);
 
-        if (err == 0 || err == -EAGAIN)
-                return soft_polled + npolled;
-        else
-                return err;
+        return soft_polled + npolled;
 }
 
 int mlx5_ib_arm_cq(struct ib_cq *ibcq, enum ib_cq_notify_flags flags)
diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
index a84bb766fc62..e19537cf44ab 100644
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -37,7 +37,6 @@
 #include <linux/pci.h>
 #include <linux/dma-mapping.h>
 #include <linux/slab.h>
-#include <linux/io-mapping.h>
 #if defined(CONFIG_X86)
 #include <asm/pat.h>
 #endif
@@ -289,7 +288,9 @@ __be16 mlx5_get_roce_udp_sport(struct mlx5_ib_dev *dev, u8 port_num,
 
 static int mlx5_use_mad_ifc(struct mlx5_ib_dev *dev)
 {
-        return !MLX5_CAP_GEN(dev->mdev, ib_virt);
+        if (MLX5_CAP_GEN(dev->mdev, port_type) == MLX5_CAP_PORT_TYPE_IB)
+                return !MLX5_CAP_GEN(dev->mdev, ib_virt);
+        return 0;
 }
 
 enum {
@@ -1429,6 +1430,13 @@ static int parse_flow_attr(u32 *match_c, u32 *match_v,
                                              dmac_47_16),
                                 ib_spec->eth.val.dst_mac);
 
+                ether_addr_copy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, outer_headers_c,
+                                             smac_47_16),
+                                ib_spec->eth.mask.src_mac);
+                ether_addr_copy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, outer_headers_v,
+                                             smac_47_16),
+                                ib_spec->eth.val.src_mac);
+
                 if (ib_spec->eth.mask.vlan_tag) {
                         MLX5_SET(fte_match_set_lyr_2_4, outer_headers_c,
                                  vlan_tag, 1);
@@ -1850,6 +1858,7 @@ static struct ib_flow *mlx5_ib_create_flow(struct ib_qp *qp,
                                            int domain)
 {
         struct mlx5_ib_dev *dev = to_mdev(qp->device);
+        struct mlx5_ib_qp *mqp = to_mqp(qp);
         struct mlx5_ib_flow_handler *handler = NULL;
         struct mlx5_flow_destination *dst = NULL;
         struct mlx5_ib_flow_prio *ft_prio;
@@ -1876,7 +1885,10 @@ static struct ib_flow *mlx5_ib_create_flow(struct ib_qp *qp,
         }
 
         dst->type = MLX5_FLOW_DESTINATION_TYPE_TIR;
-        dst->tir_num = to_mqp(qp)->raw_packet_qp.rq.tirn;
+        if (mqp->flags & MLX5_IB_QP_RSS)
+                dst->tir_num = mqp->rss_qp.tirn;
+        else
+                dst->tir_num = mqp->raw_packet_qp.rq.tirn;
 
         if (flow_attr->type == IB_FLOW_ATTR_NORMAL) {
                 if (flow_attr->flags & IB_FLOW_ATTR_FLAGS_DONT_TRAP)  {
diff --git a/drivers/infiniband/hw/mlx5/mem.c b/drivers/infiniband/hw/mlx5/mem.c
index 40df2cca0609..996b54e366b0 100644
--- a/drivers/infiniband/hw/mlx5/mem.c
+++ b/drivers/infiniband/hw/mlx5/mem.c
@@ -71,7 +71,7 @@ void mlx5_ib_cont_pages(struct ib_umem *umem, u64 addr, int *count, int *shift,
 
         addr = addr >> page_shift;
         tmp = (unsigned long)addr;
-        m = find_first_bit(&tmp, sizeof(tmp));
+        m = find_first_bit(&tmp, BITS_PER_LONG);
         skip = 1 << m;
         mask = skip - 1;
         i = 0;
@@ -81,7 +81,7 @@ void mlx5_ib_cont_pages(struct ib_umem *umem, u64 addr, int *count, int *shift,
                 for (k = 0; k < len; k++) {
                         if (!(i & mask)) {
                                 tmp = (unsigned long)pfn;
-                                m = min_t(unsigned long, m, find_first_bit(&tmp, sizeof(tmp)));
+                                m = min_t(unsigned long, m, find_first_bit(&tmp, BITS_PER_LONG));
                                 skip = 1 << m;
                                 mask = skip - 1;
                                 base = pfn;
@@ -89,7 +89,7 @@ void mlx5_ib_cont_pages(struct ib_umem *umem, u64 addr, int *count, int *shift,
                         } else {
                                 if (base + p != pfn) {
                                         tmp = (unsigned long)p;
-                                        m = find_first_bit(&tmp, sizeof(tmp));
+                                        m = find_first_bit(&tmp, BITS_PER_LONG);
                                         skip = 1 << m;
                                         mask = skip - 1;
                                         base = pfn;
diff --git a/drivers/infiniband/hw/mlx5/mlx5_ib.h b/drivers/infiniband/hw/mlx5/mlx5_ib.h
index 372385d0f993..95146f4aa3e3 100644
--- a/drivers/infiniband/hw/mlx5/mlx5_ib.h
+++ b/drivers/infiniband/hw/mlx5/mlx5_ib.h
@@ -402,6 +402,7 @@ enum mlx5_ib_qp_flags {
         /* QP uses 1 as its source QP number */
         MLX5_IB_QP_SQPN_QP1                     = 1 << 6,
         MLX5_IB_QP_CAP_SCATTER_FCS              = 1 << 7,
+        MLX5_IB_QP_RSS                          = 1 << 8,
 };
 
 struct mlx5_umr_wr {
diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
index 0dd7d93cac95..affc3f6598ca 100644
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -1449,6 +1449,7 @@ create_tir:
         kvfree(in);
         /* qpn is reserved for that QP */
         qp->trans_qp.base.mqp.qpn = 0;
+        qp->flags |= MLX5_IB_QP_RSS;
         return 0;
 
 err:
@@ -3658,12 +3659,8 @@ static int begin_wqe(struct mlx5_ib_qp *qp, void **seg,
                      struct ib_send_wr *wr, unsigned *idx,
                      int *size, int nreq)
 {
-        int err = 0;
-
-        if (unlikely(mlx5_wq_overflow(&qp->sq, nreq, qp->ibqp.send_cq))) {
-                err = -ENOMEM;
-                return err;
-        }
+        if (unlikely(mlx5_wq_overflow(&qp->sq, nreq, qp->ibqp.send_cq)))
+                return -ENOMEM;
 
         *idx = qp->sq.cur_post & (qp->sq.wqe_cnt - 1);
         *seg = mlx5_get_send_wqe(qp, *idx);
@@ -3679,7 +3676,7 @@ static int begin_wqe(struct mlx5_ib_qp *qp, void **seg,
         *seg += sizeof(**ctrl);
         *size = sizeof(**ctrl) / 16;
 
-        return err;
+        return 0;
 }
 
 static void finish_wqe(struct mlx5_ib_qp *qp,
@@ -3758,7 +3755,7 @@ int mlx5_ib_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                 num_sge = wr->num_sge;
                 if (unlikely(num_sge > qp->sq.max_gs)) {
                         mlx5_ib_warn(dev, "\n");
-                        err = -ENOMEM;
+                        err = -EINVAL;
                         *bad_wr = wr;
                         goto out;
                 }
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_hw.c b/drivers/infiniband/hw/ocrdma/ocrdma_hw.c
index 16740dcb876b..67fc0b6857e1 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_hw.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_hw.c
@@ -1156,18 +1156,18 @@ static void ocrdma_get_attr(struct ocrdma_dev *dev,
         attr->max_srq =
                 (rsp->max_srq_rpir_qps & OCRDMA_MBX_QUERY_CFG_MAX_SRQ_MASK) >>
                 OCRDMA_MBX_QUERY_CFG_MAX_SRQ_OFFSET;
-        attr->max_send_sge = ((rsp->max_write_send_sge &
+        attr->max_send_sge = ((rsp->max_recv_send_sge &
                                OCRDMA_MBX_QUERY_CFG_MAX_SEND_SGE_MASK) >>
                               OCRDMA_MBX_QUERY_CFG_MAX_SEND_SGE_SHIFT);
-        attr->max_recv_sge = (rsp->max_write_send_sge &
-                              OCRDMA_MBX_QUERY_CFG_MAX_SEND_SGE_MASK) >>
-            OCRDMA_MBX_QUERY_CFG_MAX_SEND_SGE_SHIFT;
+        attr->max_recv_sge = (rsp->max_recv_send_sge &
+                              OCRDMA_MBX_QUERY_CFG_MAX_RECV_SGE_MASK) >>
+            OCRDMA_MBX_QUERY_CFG_MAX_RECV_SGE_SHIFT;
         attr->max_srq_sge = (rsp->max_srq_rqe_sge &
                               OCRDMA_MBX_QUERY_CFG_MAX_SRQ_SGE_MASK) >>
             OCRDMA_MBX_QUERY_CFG_MAX_SRQ_SGE_OFFSET;
-        attr->max_rdma_sge = (rsp->max_write_send_sge &
-                              OCRDMA_MBX_QUERY_CFG_MAX_WRITE_SGE_MASK) >>
-            OCRDMA_MBX_QUERY_CFG_MAX_WRITE_SGE_SHIFT;
+        attr->max_rdma_sge = (rsp->max_wr_rd_sge &
+                              OCRDMA_MBX_QUERY_CFG_MAX_RD_SGE_MASK) >>
+            OCRDMA_MBX_QUERY_CFG_MAX_RD_SGE_SHIFT;
         attr->max_ord_per_qp = (rsp->max_ird_ord_per_qp &
                                 OCRDMA_MBX_QUERY_CFG_MAX_ORD_PER_QP_MASK) >>
             OCRDMA_MBX_QUERY_CFG_MAX_ORD_PER_QP_SHIFT;
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_sli.h b/drivers/infiniband/hw/ocrdma/ocrdma_sli.h
index 0efc9662c6d8..37df4481bb8f 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_sli.h
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_sli.h
@@ -554,9 +554,9 @@ enum {
         OCRDMA_MBX_QUERY_CFG_L3_TYPE_MASK               = 0x18,
         OCRDMA_MBX_QUERY_CFG_MAX_SEND_SGE_SHIFT         = 0,
         OCRDMA_MBX_QUERY_CFG_MAX_SEND_SGE_MASK          = 0xFFFF,
-        OCRDMA_MBX_QUERY_CFG_MAX_WRITE_SGE_SHIFT        = 16,
-        OCRDMA_MBX_QUERY_CFG_MAX_WRITE_SGE_MASK         = 0xFFFF <<
-                                OCRDMA_MBX_QUERY_CFG_MAX_WRITE_SGE_SHIFT,
+        OCRDMA_MBX_QUERY_CFG_MAX_RECV_SGE_SHIFT = 16,
+        OCRDMA_MBX_QUERY_CFG_MAX_RECV_SGE_MASK          = 0xFFFF <<
+                                OCRDMA_MBX_QUERY_CFG_MAX_RECV_SGE_SHIFT,
 
         OCRDMA_MBX_QUERY_CFG_MAX_ORD_PER_QP_SHIFT       = 0,
         OCRDMA_MBX_QUERY_CFG_MAX_ORD_PER_QP_MASK        = 0xFFFF,
@@ -612,6 +612,8 @@ enum {
         OCRDMA_MBX_QUERY_CFG_MAX_SRQ_SGE_OFFSET         = 0,
         OCRDMA_MBX_QUERY_CFG_MAX_SRQ_SGE_MASK           = 0xFFFF <<
                                 OCRDMA_MBX_QUERY_CFG_MAX_SRQ_SGE_OFFSET,
+        OCRDMA_MBX_QUERY_CFG_MAX_RD_SGE_SHIFT           = 0,
+        OCRDMA_MBX_QUERY_CFG_MAX_RD_SGE_MASK            = 0xFFFF,
 };
 
 struct ocrdma_mbx_query_config {
@@ -619,7 +621,7 @@ struct ocrdma_mbx_query_config {
         struct ocrdma_mbx_rsp rsp;
         u32 qp_srq_cq_ird_ord;
         u32 max_pd_ca_ack_delay;
-        u32 max_write_send_sge;
+        u32 max_recv_send_sge;
         u32 max_ird_ord_per_qp;
         u32 max_shared_ird_ord;
         u32 max_mr;
@@ -639,6 +641,8 @@ struct ocrdma_mbx_query_config {
         u32 max_wqes_rqes_per_q;
         u32 max_cq_cqes_per_cq;
         u32 max_srq_rqe_sge;
+        u32 max_wr_rd_sge;
+        u32 ird_pgsz_num_pages;
 };
 
 struct ocrdma_fw_ver_rsp {
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
index b1a3d91fe8b9..0aa854737e74 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
@@ -125,8 +125,8 @@ int ocrdma_query_device(struct ib_device *ibdev, struct ib_device_attr *attr,
                                         IB_DEVICE_SYS_IMAGE_GUID |
                                         IB_DEVICE_LOCAL_DMA_LKEY |
                                         IB_DEVICE_MEM_MGT_EXTENSIONS;
-        attr->max_sge = dev->attr.max_send_sge;
-        attr->max_sge_rd = attr->max_sge;
+        attr->max_sge = min(dev->attr.max_send_sge, dev->attr.max_recv_sge);
+        attr->max_sge_rd = dev->attr.max_rdma_sge;
         attr->max_cq = dev->attr.max_cq;
         attr->max_cqe = dev->attr.max_cqe;
         attr->max_mr = dev->attr.max_mr;
diff --git a/drivers/infiniband/hw/qib/qib_debugfs.c b/drivers/infiniband/hw/qib/qib_debugfs.c
index 5e75b43c596b..5bad8e3b40bb 100644
--- a/drivers/infiniband/hw/qib/qib_debugfs.c
+++ b/drivers/infiniband/hw/qib/qib_debugfs.c
@@ -189,27 +189,32 @@ static int _ctx_stats_seq_show(struct seq_file *s, void *v)
 DEBUGFS_FILE(ctx_stats)
 
 static void *_qp_stats_seq_start(struct seq_file *s, loff_t *pos)
+        __acquires(RCU)
 {
         struct qib_qp_iter *iter;
         loff_t n = *pos;
 
-        rcu_read_lock();
         iter = qib_qp_iter_init(s->private);
+
+        /* stop calls rcu_read_unlock */
+        rcu_read_lock();
+
         if (!iter)
                 return NULL;
 
-        while (n--) {
+        do {
                 if (qib_qp_iter_next(iter)) {
                         kfree(iter);
                         return NULL;
                 }
-        }
+        } while (n--);
 
         return iter;
 }
 
 static void *_qp_stats_seq_next(struct seq_file *s, void *iter_ptr,
                                    loff_t *pos)
+        __must_hold(RCU)
 {
         struct qib_qp_iter *iter = iter_ptr;
 
@@ -224,6 +229,7 @@ static void *_qp_stats_seq_next(struct seq_file *s, void *iter_ptr,
 }
 
 static void _qp_stats_seq_stop(struct seq_file *s, void *iter_ptr)
+        __releases(RCU)
 {
         rcu_read_unlock();
 }
diff --git a/drivers/infiniband/hw/qib/qib_fs.c b/drivers/infiniband/hw/qib/qib_fs.c
index fcdf37913a26..c3edc033f7c4 100644
--- a/drivers/infiniband/hw/qib/qib_fs.c
+++ b/drivers/infiniband/hw/qib/qib_fs.c
@@ -328,26 +328,12 @@ static ssize_t flash_write(struct file *file, const char __user *buf,
 
         pos = *ppos;
 
-        if (pos != 0) {
-                ret = -EINVAL;
-                goto bail;
-        }
-
-        if (count != sizeof(struct qib_flash)) {
-                ret = -EINVAL;
-                goto bail;
-        }
-
-        tmp = kmalloc(count, GFP_KERNEL);
-        if (!tmp) {
-                ret = -ENOMEM;
-                goto bail;
-        }
+        if (pos != 0 || count != sizeof(struct qib_flash))
+                return -EINVAL;
 
-        if (copy_from_user(tmp, buf, count)) {
-                ret = -EFAULT;
-                goto bail_tmp;
-        }
+        tmp = memdup_user(buf, count);
+        if (IS_ERR(tmp))
+                return PTR_ERR(tmp);
 
         dd = private2dd(file);
         if (qib_eeprom_write(dd, pos, tmp, count)) {
@@ -361,8 +347,6 @@ static ssize_t flash_write(struct file *file, const char __user *buf,
 
 bail_tmp:
         kfree(tmp);
-
-bail:
         return ret;
 }
 
diff --git a/drivers/infiniband/hw/qib/qib_qp.c b/drivers/infiniband/hw/qib/qib_qp.c
index 9cc0aae1d781..f9b8cd2354d1 100644
--- a/drivers/infiniband/hw/qib/qib_qp.c
+++ b/drivers/infiniband/hw/qib/qib_qp.c
@@ -573,10 +573,6 @@ struct qib_qp_iter *qib_qp_iter_init(struct qib_ibdev *dev)
                 return NULL;
 
         iter->dev = dev;
-        if (qib_qp_iter_next(iter)) {
-                kfree(iter);
-                return NULL;
-        }
 
         return iter;
 }
diff --git a/drivers/infiniband/hw/usnic/usnic_ib_main.c b/drivers/infiniband/hw/usnic/usnic_ib_main.c
index c229b9f4a52d..0a89a955550b 100644
--- a/drivers/infiniband/hw/usnic/usnic_ib_main.c
+++ b/drivers/infiniband/hw/usnic/usnic_ib_main.c
@@ -664,7 +664,8 @@ static int __init usnic_ib_init(void)
                 return err;
         }
 
-        if (pci_register_driver(&usnic_ib_pci_driver)) {
+        err = pci_register_driver(&usnic_ib_pci_driver);
+        if (err) {
                 usnic_err("Unable to register with PCI\n");
                 goto out_umem_fini;
         }
diff --git a/drivers/infiniband/sw/rdmavt/mr.c b/drivers/infiniband/sw/rdmavt/mr.c
index 80c4b6b401b8..46b64970058e 100644
--- a/drivers/infiniband/sw/rdmavt/mr.c
+++ b/drivers/infiniband/sw/rdmavt/mr.c
@@ -294,7 +294,7 @@ static void __rvt_free_mr(struct rvt_mr *mr)
 {
         rvt_deinit_mregion(&mr->mr);
         rvt_free_lkey(&mr->mr);
-        vfree(mr);
+        kfree(mr);
 }
 
 /**
diff --git a/drivers/infiniband/sw/rdmavt/qp.c b/drivers/infiniband/sw/rdmavt/qp.c
index bdb540f25a88..870b4f212fbc 100644
--- a/drivers/infiniband/sw/rdmavt/qp.c
+++ b/drivers/infiniband/sw/rdmavt/qp.c
@@ -873,7 +873,8 @@ bail_qpn:
         free_qpn(&rdi->qp_dev->qpn_table, qp->ibqp.qp_num);
 
 bail_rq_wq:
-        vfree(qp->r_rq.wq);
+        if (!qp->ip)
+                vfree(qp->r_rq.wq);
 
 bail_driver_priv:
         rdi->driver_f.qp_priv_free(rdi, qp);
diff --git a/drivers/infiniband/sw/rxe/rxe.c b/drivers/infiniband/sw/rxe/rxe.c
index 55f0e8f0ca79..ddd59270ff6d 100644
--- a/drivers/infiniband/sw/rxe/rxe.c
+++ b/drivers/infiniband/sw/rxe/rxe.c
@@ -362,15 +362,34 @@ static int __init rxe_module_init(void)
                 return err;
         }
 
-        err = rxe_net_init();
+        err = rxe_net_ipv4_init();
         if (err) {
-                pr_err("rxe: unable to init\n");
+                pr_err("rxe: unable to init ipv4 tunnel\n");
                 rxe_cache_exit();
-                return err;
+                goto exit;
+        }
+
+        err = rxe_net_ipv6_init();
+        if (err) {
+                pr_err("rxe: unable to init ipv6 tunnel\n");
+                rxe_cache_exit();
+                goto exit;
         }
+
+        err = register_netdevice_notifier(&rxe_net_notifier);
+        if (err) {
+                pr_err("rxe: Failed to rigister netdev notifier\n");
+                goto exit;
+        }
+
         pr_info("rxe: loaded\n");
 
         return 0;
+
+exit:
+        rxe_release_udp_tunnel(recv_sockets.sk4);
+        rxe_release_udp_tunnel(recv_sockets.sk6);
+        return err;
 }
 
 static void __exit rxe_module_exit(void)
diff --git a/drivers/infiniband/sw/rxe/rxe_comp.c b/drivers/infiniband/sw/rxe/rxe_comp.c
index 36f67de44095..1c59ef2c67aa 100644
--- a/drivers/infiniband/sw/rxe/rxe_comp.c
+++ b/drivers/infiniband/sw/rxe/rxe_comp.c
@@ -689,7 +689,14 @@ int rxe_completer(void *arg)
                                         qp->req.need_retry = 1;
                                         rxe_run_task(&qp->req.task, 1);
                                 }
+
+                                if (pkt) {
+                                        rxe_drop_ref(pkt->qp);
+                                        kfree_skb(skb);
+                                }
+
                                 goto exit;
+
                         } else {
                                 wqe->status = IB_WC_RETRY_EXC_ERR;
                                 state = COMPST_ERROR;
@@ -716,6 +723,12 @@ int rxe_completer(void *arg)
                 case COMPST_ERROR:
                         do_complete(qp, wqe);
                         rxe_qp_error(qp);
+
+                        if (pkt) {
+                                rxe_drop_ref(pkt->qp);
+                                kfree_skb(skb);
+                        }
+
                         goto exit;
                 }
         }
diff --git a/drivers/infiniband/sw/rxe/rxe_net.c b/drivers/infiniband/sw/rxe/rxe_net.c
index 0b8d2ea8b41d..eedf2f1cafdf 100644
--- a/drivers/infiniband/sw/rxe/rxe_net.c
+++ b/drivers/infiniband/sw/rxe/rxe_net.c
@@ -275,9 +275,10 @@ static struct socket *rxe_setup_udp_tunnel(struct net *net, __be16 port,
         return sock;
 }
 
-static void rxe_release_udp_tunnel(struct socket *sk)
+void rxe_release_udp_tunnel(struct socket *sk)
 {
-        udp_tunnel_sock_release(sk);
+        if (sk)
+                udp_tunnel_sock_release(sk);
 }
 
 static void prepare_udp_hdr(struct sk_buff *skb, __be16 src_port,
@@ -658,51 +659,45 @@ out:
         return NOTIFY_OK;
 }
 
-static struct notifier_block rxe_net_notifier = {
+struct notifier_block rxe_net_notifier = {
         .notifier_call = rxe_notify,
 };
 
-int rxe_net_init(void)
+int rxe_net_ipv4_init(void)
 {
-        int err;
-
         spin_lock_init(&dev_list_lock);
 
-        recv_sockets.sk6 = rxe_setup_udp_tunnel(&init_net,
-                        htons(ROCE_V2_UDP_DPORT), true);
-        if (IS_ERR(recv_sockets.sk6)) {
-                recv_sockets.sk6 = NULL;
-                pr_err("rxe: Failed to create IPv6 UDP tunnel\n");
-                return -1;
-        }
-
         recv_sockets.sk4 = rxe_setup_udp_tunnel(&init_net,
-                        htons(ROCE_V2_UDP_DPORT), false);
+                                htons(ROCE_V2_UDP_DPORT), false);
         if (IS_ERR(recv_sockets.sk4)) {
-                rxe_release_udp_tunnel(recv_sockets.sk6);
                 recv_sockets.sk4 = NULL;
-                recv_sockets.sk6 = NULL;
                 pr_err("rxe: Failed to create IPv4 UDP tunnel\n");
                 return -1;
         }
 
-        err = register_netdevice_notifier(&rxe_net_notifier);
-        if (err) {
-                rxe_release_udp_tunnel(recv_sockets.sk6);
-                rxe_release_udp_tunnel(recv_sockets.sk4);
-                pr_err("rxe: Failed to rigister netdev notifier\n");
-        }
-
-        return err;
+        return 0;
 }
 
-void rxe_net_exit(void)
+int rxe_net_ipv6_init(void)
 {
-        if (recv_sockets.sk6)
-                rxe_release_udp_tunnel(recv_sockets.sk6);
+#if IS_ENABLED(CONFIG_IPV6)
 
-        if (recv_sockets.sk4)
-                rxe_release_udp_tunnel(recv_sockets.sk4);
+        spin_lock_init(&dev_list_lock);
 
+        recv_sockets.sk6 = rxe_setup_udp_tunnel(&init_net,
+                                                htons(ROCE_V2_UDP_DPORT), true);
+        if (IS_ERR(recv_sockets.sk6)) {
+                recv_sockets.sk6 = NULL;
+                pr_err("rxe: Failed to create IPv6 UDP tunnel\n");
+                return -1;
+        }
+#endif
+        return 0;
+}
+
+void rxe_net_exit(void)
+{
+        rxe_release_udp_tunnel(recv_sockets.sk6);
+        rxe_release_udp_tunnel(recv_sockets.sk4);
         unregister_netdevice_notifier(&rxe_net_notifier);
 }
diff --git a/drivers/infiniband/sw/rxe/rxe_net.h b/drivers/infiniband/sw/rxe/rxe_net.h
index 7b06f76d16cc..0daf7f09e5b5 100644
--- a/drivers/infiniband/sw/rxe/rxe_net.h
+++ b/drivers/infiniband/sw/rxe/rxe_net.h
@@ -44,10 +44,13 @@ struct rxe_recv_sockets {
 };
 
 extern struct rxe_recv_sockets recv_sockets;
+extern struct notifier_block rxe_net_notifier;
+void rxe_release_udp_tunnel(struct socket *sk);
 
 struct rxe_dev *rxe_net_add(struct net_device *ndev);
 
-int rxe_net_init(void);
+int rxe_net_ipv4_init(void);
+int rxe_net_ipv6_init(void);
 void rxe_net_exit(void);
 
 #endif /* RXE_NET_H */
diff --git a/drivers/infiniband/sw/rxe/rxe_recv.c b/drivers/infiniband/sw/rxe/rxe_recv.c
index 3d464c23e08b..144d2f129fcd 100644
--- a/drivers/infiniband/sw/rxe/rxe_recv.c
+++ b/drivers/infiniband/sw/rxe/rxe_recv.c
@@ -312,7 +312,7 @@ static void rxe_rcv_mcast_pkt(struct rxe_dev *rxe, struct sk_buff *skb)
                  * make a copy of the skb to post to the next qp
                  */
                 skb_copy = (mce->qp_list.next != &mcg->qp_list) ?
-                                skb_clone(skb, GFP_KERNEL) : NULL;
+                                skb_clone(skb, GFP_ATOMIC) : NULL;
 
                 pkt->qp = qp;
                 rxe_add_ref(qp);
diff --git a/drivers/infiniband/sw/rxe/rxe_req.c b/drivers/infiniband/sw/rxe/rxe_req.c
index 33b2d9d77021..13a848a518e8 100644
--- a/drivers/infiniband/sw/rxe/rxe_req.c
+++ b/drivers/infiniband/sw/rxe/rxe_req.c
@@ -511,24 +511,21 @@ static int fill_packet(struct rxe_qp *qp, struct rxe_send_wqe *wqe,
 }
 
 static void update_wqe_state(struct rxe_qp *qp,
-                             struct rxe_send_wqe *wqe,
-                             struct rxe_pkt_info *pkt,
-                             enum wqe_state *prev_state)
+                struct rxe_send_wqe *wqe,
+                struct rxe_pkt_info *pkt)
 {
-        enum wqe_state prev_state_ = wqe->state;
-
         if (pkt->mask & RXE_END_MASK) {
                 if (qp_type(qp) == IB_QPT_RC)
                         wqe->state = wqe_state_pending;
         } else {
                 wqe->state = wqe_state_processing;
         }
-
-        *prev_state = prev_state_;
 }
 
-static void update_state(struct rxe_qp *qp, struct rxe_send_wqe *wqe,
-                         struct rxe_pkt_info *pkt, int payload)
+static void update_wqe_psn(struct rxe_qp *qp,
+                           struct rxe_send_wqe *wqe,
+                           struct rxe_pkt_info *pkt,
+                           int payload)
 {
         /* number of packets left to send including current one */
         int num_pkt = (wqe->dma.resid + payload + qp->mtu - 1) / qp->mtu;
@@ -546,9 +543,34 @@ static void update_state(struct rxe_qp *qp, struct rxe_send_wqe *wqe,
                 qp->req.psn = (wqe->first_psn + num_pkt) & BTH_PSN_MASK;
         else
                 qp->req.psn = (qp->req.psn + 1) & BTH_PSN_MASK;
+}
 
-        qp->req.opcode = pkt->opcode;
+static void save_state(struct rxe_send_wqe *wqe,
+                       struct rxe_qp *qp,
+                       struct rxe_send_wqe *rollback_wqe,
+                       struct rxe_qp *rollback_qp)
+{
+        rollback_wqe->state     = wqe->state;
+        rollback_wqe->first_psn = wqe->first_psn;
+        rollback_wqe->last_psn  = wqe->last_psn;
+        rollback_qp->req.psn    = qp->req.psn;
+}
 
+static void rollback_state(struct rxe_send_wqe *wqe,
+                           struct rxe_qp *qp,
+                           struct rxe_send_wqe *rollback_wqe,
+                           struct rxe_qp *rollback_qp)
+{
+        wqe->state     = rollback_wqe->state;
+        wqe->first_psn = rollback_wqe->first_psn;
+        wqe->last_psn  = rollback_wqe->last_psn;
+        qp->req.psn    = rollback_qp->req.psn;
+}
+
+static void update_state(struct rxe_qp *qp, struct rxe_send_wqe *wqe,
+                         struct rxe_pkt_info *pkt, int payload)
+{
+        qp->req.opcode = pkt->opcode;
 
         if (pkt->mask & RXE_END_MASK)
                 qp->req.wqe_index = next_index(qp->sq.queue, qp->req.wqe_index);
@@ -571,7 +593,8 @@ int rxe_requester(void *arg)
         int mtu;
         int opcode;
         int ret;
-        enum wqe_state prev_state;
+        struct rxe_qp rollback_qp;
+        struct rxe_send_wqe rollback_wqe;
 
 next_wqe:
         if (unlikely(!qp->valid || qp->req.state == QP_STATE_ERROR))
@@ -688,13 +711,21 @@ next_wqe:
                 goto err;
         }
 
-        update_wqe_state(qp, wqe, &pkt, &prev_state);
+        /*
+         * To prevent a race on wqe access between requester and completer,
+         * wqe members state and psn need to be set before calling
+         * rxe_xmit_packet().
+         * Otherwise, completer might initiate an unjustified retry flow.
+         */
+        save_state(wqe, qp, &rollback_wqe, &rollback_qp);
+        update_wqe_state(qp, wqe, &pkt);
+        update_wqe_psn(qp, wqe, &pkt, payload);
         ret = rxe_xmit_packet(to_rdev(qp->ibqp.device), qp, &pkt, skb);
         if (ret) {
                 qp->need_req_skb = 1;
                 kfree_skb(skb);
 
-                wqe->state = prev_state;
+                rollback_state(wqe, qp, &rollback_wqe, &rollback_qp);
 
                 if (ret == -EAGAIN) {
                         rxe_run_task(&qp->req.task, 1);
diff --git a/drivers/infiniband/sw/rxe/rxe_resp.c b/drivers/infiniband/sw/rxe/rxe_resp.c
index ebb03b46e2ad..3e0f0f2baace 100644
--- a/drivers/infiniband/sw/rxe/rxe_resp.c
+++ b/drivers/infiniband/sw/rxe/rxe_resp.c
@@ -972,11 +972,13 @@ static int send_atomic_ack(struct rxe_qp *qp, struct rxe_pkt_info *pkt,
         free_rd_atomic_resource(qp, res);
         rxe_advance_resp_resource(qp);
 
+        memcpy(SKB_TO_PKT(skb), &ack_pkt, sizeof(skb->cb));
+
         res->type = RXE_ATOMIC_MASK;
         res->atomic.skb = skb;
-        res->first_psn = qp->resp.psn;
-        res->last_psn = qp->resp.psn;
-        res->cur_psn = qp->resp.psn;
+        res->first_psn = ack_pkt.psn;
+        res->last_psn  = ack_pkt.psn;
+        res->cur_psn   = ack_pkt.psn;
 
         rc = rxe_xmit_packet(rxe, qp, &ack_pkt, skb_copy);
         if (rc) {
@@ -1116,8 +1118,7 @@ static enum resp_states duplicate_request(struct rxe_qp *qp,
                                 rc = RESPST_CLEANUP;
                                 goto out;
                         }
-                        bth_set_psn(SKB_TO_PKT(skb_copy),
-                                    qp->resp.psn - 1);
+
                         /* Resend the result. */
                         rc = rxe_xmit_packet(to_rdev(qp->ibqp.device), qp,
                                              pkt, skb_copy);
diff --git a/drivers/infiniband/ulp/ipoib/ipoib.h b/drivers/infiniband/ulp/ipoib/ipoib.h
index 4f7d9b48df64..9dbfcc0ab577 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib.h
+++ b/drivers/infiniband/ulp/ipoib/ipoib.h
@@ -478,6 +478,7 @@ void ipoib_send(struct net_device *dev, struct sk_buff *skb,
                 struct ipoib_ah *address, u32 qpn);
 void ipoib_reap_ah(struct work_struct *work);
 
+struct ipoib_path *__path_find(struct net_device *dev, void *gid);
 void ipoib_mark_paths_invalid(struct net_device *dev);
 void ipoib_flush_paths(struct net_device *dev);
 int ipoib_check_sm_sendonly_fullmember_support(struct ipoib_dev_priv *priv);
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
index 951d9abcca8b..4ad297d3de89 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
@@ -1318,6 +1318,8 @@ void ipoib_cm_destroy_tx(struct ipoib_cm_tx *tx)
         }
 }
 
+#define QPN_AND_OPTIONS_OFFSET  4
+
 static void ipoib_cm_tx_start(struct work_struct *work)
 {
         struct ipoib_dev_priv *priv = container_of(work, struct ipoib_dev_priv,
@@ -1326,6 +1328,7 @@ static void ipoib_cm_tx_start(struct work_struct *work)
         struct ipoib_neigh *neigh;
         struct ipoib_cm_tx *p;
         unsigned long flags;
+        struct ipoib_path *path;
         int ret;
 
         struct ib_sa_path_rec pathrec;
@@ -1338,7 +1341,19 @@ static void ipoib_cm_tx_start(struct work_struct *work)
                 p = list_entry(priv->cm.start_list.next, typeof(*p), list);
                 list_del_init(&p->list);
                 neigh = p->neigh;
+
                 qpn = IPOIB_QPN(neigh->daddr);
+                /*
+                 * As long as the search is with these 2 locks,
+                 * path existence indicates its validity.
+                 */
+                path = __path_find(dev, neigh->daddr + QPN_AND_OPTIONS_OFFSET);
+                if (!path) {
+                        pr_info("%s ignore not valid path %pI6\n",
+                                __func__,
+                                neigh->daddr + QPN_AND_OPTIONS_OFFSET);
+                        goto free_neigh;
+                }
                 memcpy(&pathrec, &p->path->pathrec, sizeof pathrec);
 
                 spin_unlock_irqrestore(&priv->lock, flags);
@@ -1350,6 +1365,7 @@ static void ipoib_cm_tx_start(struct work_struct *work)
                 spin_lock_irqsave(&priv->lock, flags);
 
                 if (ret) {
+free_neigh:
                         neigh = p->neigh;
                         if (neigh) {
                                 neigh->cm = NULL;
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
index dc6d241b9406..be11d5d5b8c1 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
@@ -1161,8 +1161,17 @@ static void __ipoib_ib_dev_flush(struct ipoib_dev_priv *priv,
         }
 
         if (level == IPOIB_FLUSH_LIGHT) {
+                int oper_up;
                 ipoib_mark_paths_invalid(dev);
+                /* Set IPoIB operation as down to prevent races between:
+                 * the flush flow which leaves MCG and on the fly joins
+                 * which can happen during that time. mcast restart task
+                 * should deal with join requests we missed.
+                 */
+                oper_up = test_and_clear_bit(IPOIB_FLAG_OPER_UP, &priv->flags);
                 ipoib_mcast_dev_flush(dev);
+                if (oper_up)
+                        set_bit(IPOIB_FLAG_OPER_UP, &priv->flags);
                 ipoib_flush_ah(dev);
         }
 
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index 74bcaa064226..cc1c1b062ea5 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -485,7 +485,7 @@ int ipoib_set_mode(struct net_device *dev, const char *buf)
         return -EINVAL;
 }
 
-static struct ipoib_path *__path_find(struct net_device *dev, void *gid)
+struct ipoib_path *__path_find(struct net_device *dev, void *gid)
 {
         struct ipoib_dev_priv *priv = netdev_priv(dev);
         struct rb_node *n = priv->path_tree.rb_node;
diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
index ba6be060a476..cae9bbcc27e7 100644
--- a/drivers/infiniband/ulp/isert/ib_isert.c
+++ b/drivers/infiniband/ulp/isert/ib_isert.c
@@ -403,6 +403,7 @@ isert_init_conn(struct isert_conn *isert_conn)
         INIT_LIST_HEAD(&isert_conn->node);
         init_completion(&isert_conn->login_comp);
         init_completion(&isert_conn->login_req_comp);
+        init_waitqueue_head(&isert_conn->rem_wait);
         kref_init(&isert_conn->kref);
         mutex_init(&isert_conn->mutex);
         INIT_WORK(&isert_conn->release_work, isert_release_work);
@@ -448,7 +449,7 @@ isert_alloc_login_buf(struct isert_conn *isert_conn,
 
         isert_conn->login_rsp_buf = kzalloc(ISER_RX_PAYLOAD_SIZE, GFP_KERNEL);
         if (!isert_conn->login_rsp_buf) {
-                isert_err("Unable to allocate isert_conn->login_rspbuf\n");
+                ret = -ENOMEM;
                 goto out_unmap_login_req_buf;
         }
 
@@ -578,7 +579,8 @@ isert_connect_release(struct isert_conn *isert_conn)
         BUG_ON(!device);
 
         isert_free_rx_descriptors(isert_conn);
-        if (isert_conn->cm_id)
+        if (isert_conn->cm_id &&
+            !isert_conn->dev_removed)
                 rdma_destroy_id(isert_conn->cm_id);
 
         if (isert_conn->qp) {
@@ -593,7 +595,10 @@ isert_connect_release(struct isert_conn *isert_conn)
 
         isert_device_put(device);
 
-        kfree(isert_conn);
+        if (isert_conn->dev_removed)
+                wake_up_interruptible(&isert_conn->rem_wait);
+        else
+                kfree(isert_conn);
 }
 
 static void
@@ -753,6 +758,7 @@ static int
 isert_cma_handler(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
 {
         struct isert_np *isert_np = cma_id->context;
+        struct isert_conn *isert_conn;
         int ret = 0;
 
         isert_info("%s (%d): status %d id %p np %p\n",
@@ -773,10 +779,21 @@ isert_cma_handler(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
                 break;
         case RDMA_CM_EVENT_ADDR_CHANGE:    /* FALLTHRU */
         case RDMA_CM_EVENT_DISCONNECTED:   /* FALLTHRU */
-        case RDMA_CM_EVENT_DEVICE_REMOVAL: /* FALLTHRU */
         case RDMA_CM_EVENT_TIMEWAIT_EXIT:  /* FALLTHRU */
                 ret = isert_disconnected_handler(cma_id, event->event);
                 break;
+        case RDMA_CM_EVENT_DEVICE_REMOVAL:
+                isert_conn = cma_id->qp->qp_context;
+                isert_conn->dev_removed = true;
+                isert_disconnected_handler(cma_id, event->event);
+                wait_event_interruptible(isert_conn->rem_wait,
+                                         isert_conn->state == ISER_CONN_DOWN);
+                kfree(isert_conn);
+                /*
+                 * return non-zero from the callback to destroy
+                 * the rdma cm id
+                 */
+                return 1;
         case RDMA_CM_EVENT_REJECTED:       /* FALLTHRU */
         case RDMA_CM_EVENT_UNREACHABLE:    /* FALLTHRU */
         case RDMA_CM_EVENT_CONNECT_ERROR:
diff --git a/drivers/infiniband/ulp/isert/ib_isert.h b/drivers/infiniband/ulp/isert/ib_isert.h
index fc791efe3a10..c02ada57d7f5 100644
--- a/drivers/infiniband/ulp/isert/ib_isert.h
+++ b/drivers/infiniband/ulp/isert/ib_isert.h
@@ -158,6 +158,8 @@ struct isert_conn {
         struct work_struct      release_work;
         bool                    logout_posted;
         bool                    snd_w_inv;
+        wait_queue_head_t       rem_wait;
+        bool                    dev_removed;
 };
 
 #define ISERT_MAX_CQ 64
diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c
index dfa23b075a88..883bbfe08e0e 100644
--- a/drivers/infiniband/ulp/srpt/ib_srpt.c
+++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
@@ -522,6 +522,11 @@ static int srpt_refresh_port(struct srpt_port *sport)
         if (ret)
                 goto err_query_port;
 
+        snprintf(sport->port_guid, sizeof(sport->port_guid),
+                "0x%016llx%016llx",
+                be64_to_cpu(sport->gid.global.subnet_prefix),
+                be64_to_cpu(sport->gid.global.interface_id));
+
         if (!sport->mad_agent) {
                 memset(&reg_req, 0, sizeof(reg_req));
                 reg_req.mgmt_class = IB_MGMT_CLASS_DEVICE_MGMT;
@@ -2548,10 +2553,6 @@ static void srpt_add_one(struct ib_device *device)
                                sdev->device->name, i);
                         goto err_ring;
                 }
-                snprintf(sport->port_guid, sizeof(sport->port_guid),
-                        "0x%016llx%016llx",
-                        be64_to_cpu(sport->gid.global.subnet_prefix),
-                        be64_to_cpu(sport->gid.global.interface_id));
         }
 
         spin_lock(&srpt_dev_lock);
diff --git a/drivers/input/keyboard/tegra-kbc.c b/drivers/input/keyboard/tegra-kbc.c
index 7d61439be5f2..0c07e1023a46 100644
--- a/drivers/input/keyboard/tegra-kbc.c
+++ b/drivers/input/keyboard/tegra-kbc.c
@@ -376,7 +376,7 @@ static int tegra_kbc_start(struct tegra_kbc *kbc)
         /* Reset the KBC controller to clear all previous status.*/
         reset_control_assert(kbc->rst);
         udelay(100);
-        reset_control_assert(kbc->rst);
+        reset_control_deassert(kbc->rst);
         udelay(100);
 
         tegra_kbc_config_pins(kbc);
diff --git a/drivers/input/rmi4/rmi_driver.c b/drivers/input/rmi4/rmi_driver.c
index faa295ec4f31..c83bce89028b 100644
--- a/drivers/input/rmi4/rmi_driver.c
+++ b/drivers/input/rmi4/rmi_driver.c
@@ -553,7 +553,6 @@ int rmi_read_register_desc(struct rmi_device *d, u16 addr,
                 goto free_struct_buff;
 
         reg = find_first_bit(rdesc->presense_map, RMI_REG_DESC_PRESENSE_BITS);
-        map_offset = 0;
         for (i = 0; i < rdesc->num_registers; i++) {
                 struct rmi_register_desc_item *item = &rdesc->registers[i];
                 int reg_size = struct_buf[offset];
@@ -576,6 +575,8 @@ int rmi_read_register_desc(struct rmi_device *d, u16 addr,
                 item->reg = reg;
                 item->reg_size = reg_size;
 
+                map_offset = 0;
+
                 do {
                         for (b = 0; b < 7; b++) {
                                 if (struct_buf[offset] & (0x1 << b))
diff --git a/drivers/input/serio/i8042.c b/drivers/input/serio/i8042.c
index b4d34086e73f..405252a884dd 100644
--- a/drivers/input/serio/i8042.c
+++ b/drivers/input/serio/i8042.c
@@ -1305,6 +1305,7 @@ static int __init i8042_create_aux_port(int idx)
         serio->write            = i8042_aux_write;
         serio->start            = i8042_start;
         serio->stop             = i8042_stop;
+        serio->ps2_cmd_mutex    = &i8042_mutex;
         serio->port_data        = port;
         serio->dev.parent       = &i8042_platform_device->dev;
         if (idx < 0) {
diff --git a/drivers/input/touchscreen/ads7846.c b/drivers/input/touchscreen/ads7846.c
index a61b2153ab8c..1ce3ecbe37f8 100644
--- a/drivers/input/touchscreen/ads7846.c
+++ b/drivers/input/touchscreen/ads7846.c
@@ -1473,7 +1473,6 @@ static int ads7846_remove(struct spi_device *spi)
 
         ads784x_hwmon_unregister(spi, ts);
 
-        regulator_disable(ts->reg);
         regulator_put(ts->reg);
 
         if (!ts->get_pendown_state) {
diff --git a/drivers/input/touchscreen/silead.c b/drivers/input/touchscreen/silead.c
index 7379fe153cf9..f502c8488be8 100644
--- a/drivers/input/touchscreen/silead.c
+++ b/drivers/input/touchscreen/silead.c
@@ -390,9 +390,10 @@ static void silead_ts_read_props(struct i2c_client *client)
                 data->max_fingers = 5; /* Most devices handle up-to 5 fingers */
         }
 
-        error = device_property_read_string(dev, "touchscreen-fw-name", &str);
+        error = device_property_read_string(dev, "firmware-name", &str);
         if (!error)
-                snprintf(data->fw_name, sizeof(data->fw_name), "%s", str);
+                snprintf(data->fw_name, sizeof(data->fw_name),
+                         "silead/%s", str);
         else
                 dev_dbg(dev, "Firmware file name read error. Using default.");
 }
@@ -410,14 +411,14 @@ static int silead_ts_set_default_fw_name(struct silead_ts_data *data,
                 if (!acpi_id)
                         return -ENODEV;
 
-                snprintf(data->fw_name, sizeof(data->fw_name), "%s.fw",
-                        acpi_id->id);
+                snprintf(data->fw_name, sizeof(data->fw_name),
+                         "silead/%s.fw", acpi_id->id);
 
                 for (i = 0; i < strlen(data->fw_name); i++)
                         data->fw_name[i] = tolower(data->fw_name[i]);
         } else {
-                snprintf(data->fw_name, sizeof(data->fw_name), "%s.fw",
-                        id->name);
+                snprintf(data->fw_name, sizeof(data->fw_name),
+                         "silead/%s.fw", id->name);
         }
 
         return 0;
@@ -426,7 +427,8 @@ static int silead_ts_set_default_fw_name(struct silead_ts_data *data,
 static int silead_ts_set_default_fw_name(struct silead_ts_data *data,
                                          const struct i2c_device_id *id)
 {
-        snprintf(data->fw_name, sizeof(data->fw_name), "%s.fw", id->name);
+        snprintf(data->fw_name, sizeof(data->fw_name),
+                 "silead/%s.fw", id->name);
         return 0;
 }
 #endif
@@ -464,7 +466,7 @@ static int silead_ts_probe(struct i2c_client *client,
                 return -ENODEV;
 
         /* Power GPIO pin */
-        data->gpio_power = gpiod_get_optional(dev, "power", GPIOD_OUT_LOW);
+        data->gpio_power = devm_gpiod_get_optional(dev, "power", GPIOD_OUT_LOW);
         if (IS_ERR(data->gpio_power)) {
                 if (PTR_ERR(data->gpio_power) != -EPROBE_DEFER)
                         dev_err(dev, "Shutdown GPIO request failed\n");
diff --git a/drivers/iommu/arm-smmu-v3.c b/drivers/iommu/arm-smmu-v3.c
index ce801170d5f2..641e88761319 100644
--- a/drivers/iommu/arm-smmu-v3.c
+++ b/drivers/iommu/arm-smmu-v3.c
@@ -879,7 +879,7 @@ static void arm_smmu_cmdq_skip_err(struct arm_smmu_device *smmu)
          * We may have concurrent producers, so we need to be careful
          * not to touch any of the shadow cmdq state.
          */
-        queue_read(cmd, Q_ENT(q, idx), q->ent_dwords);
+        queue_read(cmd, Q_ENT(q, cons), q->ent_dwords);
         dev_err(smmu->dev, "skipping command in error state:\n");
         for (i = 0; i < ARRAY_SIZE(cmd); ++i)
                 dev_err(smmu->dev, "\t0x%016llx\n", (unsigned long long)cmd[i]);
@@ -890,7 +890,7 @@ static void arm_smmu_cmdq_skip_err(struct arm_smmu_device *smmu)
                 return;
         }
 
-        queue_write(cmd, Q_ENT(q, idx), q->ent_dwords);
+        queue_write(Q_ENT(q, cons), cmd, q->ent_dwords);
 }
 
 static void arm_smmu_cmdq_issue_cmd(struct arm_smmu_device *smmu,
@@ -1034,6 +1034,9 @@ static void arm_smmu_write_strtab_ent(struct arm_smmu_device *smmu, u32 sid,
                 case STRTAB_STE_0_CFG_S2_TRANS:
                         ste_live = true;
                         break;
+                case STRTAB_STE_0_CFG_ABORT:
+                        if (disable_bypass)
+                                break;
                 default:
                         BUG(); /* STE corruption */
                 }
diff --git a/drivers/iommu/arm-smmu.c b/drivers/iommu/arm-smmu.c
index 4f49fe29f202..2db74ebc3240 100644
--- a/drivers/iommu/arm-smmu.c
+++ b/drivers/iommu/arm-smmu.c
@@ -686,8 +686,7 @@ static struct iommu_gather_ops arm_smmu_gather_ops = {
 
 static irqreturn_t arm_smmu_context_fault(int irq, void *dev)
 {
-        int flags, ret;
-        u32 fsr, fsynr, resume;
+        u32 fsr, fsynr;
         unsigned long iova;
         struct iommu_domain *domain = dev;
         struct arm_smmu_domain *smmu_domain = to_smmu_domain(domain);
@@ -701,34 +700,15 @@ static irqreturn_t arm_smmu_context_fault(int irq, void *dev)
         if (!(fsr & FSR_FAULT))
                 return IRQ_NONE;
 
-        if (fsr & FSR_IGN)
-                dev_err_ratelimited(smmu->dev,
-                                    "Unexpected context fault (fsr 0x%x)\n",
-                                    fsr);
-
         fsynr = readl_relaxed(cb_base + ARM_SMMU_CB_FSYNR0);
-        flags = fsynr & FSYNR0_WNR ? IOMMU_FAULT_WRITE : IOMMU_FAULT_READ;
-
         iova = readq_relaxed(cb_base + ARM_SMMU_CB_FAR);
-        if (!report_iommu_fault(domain, smmu->dev, iova, flags)) {
-                ret = IRQ_HANDLED;
-                resume = RESUME_RETRY;
-        } else {
-                dev_err_ratelimited(smmu->dev,
-                    "Unhandled context fault: iova=0x%08lx, fsynr=0x%x, cb=%d\n",
-                    iova, fsynr, cfg->cbndx);
-                ret = IRQ_NONE;
-                resume = RESUME_TERMINATE;
-        }
-
-        /* Clear the faulting FSR */
-        writel(fsr, cb_base + ARM_SMMU_CB_FSR);
 
-        /* Retry or terminate any stalled transactions */
-        if (fsr & FSR_SS)
-                writel_relaxed(resume, cb_base + ARM_SMMU_CB_RESUME);
+        dev_err_ratelimited(smmu->dev,
+        "Unhandled context fault: fsr=0x%x, iova=0x%08lx, fsynr=0x%x, cb=%d\n",
+                            fsr, iova, fsynr, cfg->cbndx);
 
-        return ret;
+        writel(fsr, cb_base + ARM_SMMU_CB_FSR);
+        return IRQ_HANDLED;
 }
 
 static irqreturn_t arm_smmu_global_fault(int irq, void *dev)
@@ -837,7 +817,7 @@ static void arm_smmu_init_context_bank(struct arm_smmu_domain *smmu_domain,
         }
 
         /* SCTLR */
-        reg = SCTLR_CFCFG | SCTLR_CFIE | SCTLR_CFRE | SCTLR_M | SCTLR_EAE_SBOP;
+        reg = SCTLR_CFIE | SCTLR_CFRE | SCTLR_M | SCTLR_EAE_SBOP;
         if (stage1)
                 reg |= SCTLR_S1_ASIDPNE;
 #ifdef __BIG_ENDIAN
diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c
index 08a1e2f3690f..00c8a08d56e7 100644
--- a/drivers/iommu/dma-iommu.c
+++ b/drivers/iommu/dma-iommu.c
@@ -68,7 +68,8 @@ void iommu_put_dma_cookie(struct iommu_domain *domain)
         if (!iovad)
                 return;
 
-        put_iova_domain(iovad);
+        if (iovad->granule)
+                put_iova_domain(iovad);
         kfree(iovad);
         domain->iova_cookie = NULL;
 }
@@ -151,12 +152,15 @@ int dma_direction_to_prot(enum dma_data_direction dir, bool coherent)
         }
 }
 
-static struct iova *__alloc_iova(struct iova_domain *iovad, size_t size,
+static struct iova *__alloc_iova(struct iommu_domain *domain, size_t size,
                 dma_addr_t dma_limit)
 {
+        struct iova_domain *iovad = domain->iova_cookie;
         unsigned long shift = iova_shift(iovad);
         unsigned long length = iova_align(iovad, size) >> shift;
 
+        if (domain->geometry.force_aperture)
+                dma_limit = min(dma_limit, domain->geometry.aperture_end);
         /*
          * Enforce size-alignment to be safe - there could perhaps be an
          * attribute to control this per-device, or at least per-domain...
@@ -314,7 +318,7 @@ struct page **iommu_dma_alloc(struct device *dev, size_t size, gfp_t gfp,
         if (!pages)
                 return NULL;
 
-        iova = __alloc_iova(iovad, size, dev->coherent_dma_mask);
+        iova = __alloc_iova(domain, size, dev->coherent_dma_mask);
         if (!iova)
                 goto out_free_pages;
 
@@ -386,7 +390,7 @@ dma_addr_t iommu_dma_map_page(struct device *dev, struct page *page,
         phys_addr_t phys = page_to_phys(page) + offset;
         size_t iova_off = iova_offset(iovad, phys);
         size_t len = iova_align(iovad, size + iova_off);
-        struct iova *iova = __alloc_iova(iovad, len, dma_get_mask(dev));
+        struct iova *iova = __alloc_iova(domain, len, dma_get_mask(dev));
 
         if (!iova)
                 return DMA_ERROR_CODE;
@@ -538,7 +542,7 @@ int iommu_dma_map_sg(struct device *dev, struct scatterlist *sg,
                 prev = s;
         }
 
-        iova = __alloc_iova(iovad, iova_len, dma_get_mask(dev));
+        iova = __alloc_iova(domain, iova_len, dma_get_mask(dev));
         if (!iova)
                 goto out_restore_sg;
 
diff --git a/drivers/iommu/io-pgtable-arm-v7s.c b/drivers/iommu/io-pgtable-arm-v7s.c
index 8c6139986d7d..def8ca1c982d 100644
--- a/drivers/iommu/io-pgtable-arm-v7s.c
+++ b/drivers/iommu/io-pgtable-arm-v7s.c
@@ -286,12 +286,14 @@ static int arm_v7s_pte_to_prot(arm_v7s_iopte pte, int lvl)
         int prot = IOMMU_READ;
         arm_v7s_iopte attr = pte >> ARM_V7S_ATTR_SHIFT(lvl);
 
-        if (attr & ARM_V7S_PTE_AP_RDONLY)
+        if (!(attr & ARM_V7S_PTE_AP_RDONLY))
                 prot |= IOMMU_WRITE;
         if ((attr & (ARM_V7S_TEX_MASK << ARM_V7S_TEX_SHIFT)) == 0)
                 prot |= IOMMU_MMIO;
         else if (pte & ARM_V7S_ATTR_C)
                 prot |= IOMMU_CACHE;
+        if (pte & ARM_V7S_ATTR_XN(lvl))
+                prot |= IOMMU_NOEXEC;
 
         return prot;
 }
diff --git a/drivers/iommu/mtk_iommu.h b/drivers/iommu/mtk_iommu.h
index 9ed0a8462ccf..3dab13b4a211 100644
--- a/drivers/iommu/mtk_iommu.h
+++ b/drivers/iommu/mtk_iommu.h
@@ -55,19 +55,19 @@ struct mtk_iommu_data {
         bool                            enable_4GB;
 };
 
-static int compare_of(struct device *dev, void *data)
+static inline int compare_of(struct device *dev, void *data)
 {
         return dev->of_node == data;
 }
 
-static int mtk_iommu_bind(struct device *dev)
+static inline int mtk_iommu_bind(struct device *dev)
 {
         struct mtk_iommu_data *data = dev_get_drvdata(dev);
 
         return component_bind_all(dev, &data->smi_imu);
 }
 
-static void mtk_iommu_unbind(struct device *dev)
+static inline void mtk_iommu_unbind(struct device *dev)
 {
         struct mtk_iommu_data *data = dev_get_drvdata(dev);
 
diff --git a/drivers/irqchip/irq-atmel-aic.c b/drivers/irqchip/irq-atmel-aic.c
index 112e17c2768b..37f952dd9fc9 100644
--- a/drivers/irqchip/irq-atmel-aic.c
+++ b/drivers/irqchip/irq-atmel-aic.c
@@ -176,6 +176,7 @@ static int aic_irq_domain_xlate(struct irq_domain *d,
 {
         struct irq_domain_chip_generic *dgc = d->gc;
         struct irq_chip_generic *gc;
+        unsigned long flags;
         unsigned smr;
         int idx;
         int ret;
@@ -194,11 +195,11 @@ static int aic_irq_domain_xlate(struct irq_domain *d,
 
         gc = dgc->gc[idx];
 
-        irq_gc_lock(gc);
+        irq_gc_lock_irqsave(gc, flags);
         smr = irq_reg_readl(gc, AT91_AIC_SMR(*out_hwirq));
         aic_common_set_priority(intspec[2], &smr);
         irq_reg_writel(gc, smr, AT91_AIC_SMR(*out_hwirq));
-        irq_gc_unlock(gc);
+        irq_gc_unlock_irqrestore(gc, flags);
 
         return ret;
 }
diff --git a/drivers/irqchip/irq-atmel-aic5.c b/drivers/irqchip/irq-atmel-aic5.c
index 4f0d068e1abe..2a624d87a035 100644
--- a/drivers/irqchip/irq-atmel-aic5.c
+++ b/drivers/irqchip/irq-atmel-aic5.c
@@ -258,6 +258,7 @@ static int aic5_irq_domain_xlate(struct irq_domain *d,
                                  unsigned int *out_type)
 {
         struct irq_chip_generic *bgc = irq_get_domain_generic_chip(d, 0);
+        unsigned long flags;
         unsigned smr;
         int ret;
 
@@ -269,12 +270,12 @@ static int aic5_irq_domain_xlate(struct irq_domain *d,
         if (ret)
                 return ret;
 
-        irq_gc_lock(bgc);
+        irq_gc_lock_irqsave(bgc, flags);
         irq_reg_writel(bgc, *out_hwirq, AT91_AIC5_SSR);
         smr = irq_reg_readl(bgc, AT91_AIC5_SMR);
         aic_common_set_priority(intspec[2], &smr);
         irq_reg_writel(bgc, smr, AT91_AIC5_SMR);
-        irq_gc_unlock(bgc);
+        irq_gc_unlock_irqrestore(bgc, flags);
 
         return ret;
 }
diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index 7ceaba81efb4..36b9c28a5c91 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -1545,7 +1545,12 @@ static int its_force_quiescent(void __iomem *base)
         u32 val;
 
         val = readl_relaxed(base + GITS_CTLR);
-        if (val & GITS_CTLR_QUIESCENT)
+        /*
+         * GIC architecture specification requires the ITS to be both
+         * disabled and quiescent for writes to GITS_BASER<n> or
+         * GITS_CBASER to not have UNPREDICTABLE results.
+         */
+        if ((val & GITS_CTLR_QUIESCENT) && !(val & GITS_CTLR_ENABLE))
                 return 0;
 
         /* Disable the generation of all interrupts to this ITS */
diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c
index 6fc56c3466b0..da6c0ba61d4f 100644
--- a/drivers/irqchip/irq-gic-v3.c
+++ b/drivers/irqchip/irq-gic-v3.c
@@ -548,7 +548,7 @@ static int gic_starting_cpu(unsigned int cpu)
 static u16 gic_compute_target_list(int *base_cpu, const struct cpumask *mask,
                                    unsigned long cluster_id)
 {
-        int cpu = *base_cpu;
+        int next_cpu, cpu = *base_cpu;
         unsigned long mpidr = cpu_logical_map(cpu);
         u16 tlist = 0;
 
@@ -562,9 +562,10 @@ static u16 gic_compute_target_list(int *base_cpu, const struct cpumask *mask,
 
                 tlist |= 1 << (mpidr & 0xf);
 
-                cpu = cpumask_next(cpu, mask);
-                if (cpu >= nr_cpu_ids)
+                next_cpu = cpumask_next(cpu, mask);
+                if (next_cpu >= nr_cpu_ids)
                         goto out;
+                cpu = next_cpu;
 
                 mpidr = cpu_logical_map(cpu);
 
@@ -667,13 +668,20 @@ static int gic_set_affinity(struct irq_data *d, const struct cpumask *mask_val,
 #endif
 
 #ifdef CONFIG_CPU_PM
+/* Check whether it's single security state view */
+static bool gic_dist_security_disabled(void)
+{
+        return readl_relaxed(gic_data.dist_base + GICD_CTLR) & GICD_CTLR_DS;
+}
+
 static int gic_cpu_pm_notifier(struct notifier_block *self,
                                unsigned long cmd, void *v)
 {
         if (cmd == CPU_PM_EXIT) {
-                gic_enable_redist(true);
+                if (gic_dist_security_disabled())
+                        gic_enable_redist(true);
                 gic_cpu_sys_reg_init();
-        } else if (cmd == CPU_PM_ENTER) {
+        } else if (cmd == CPU_PM_ENTER && gic_dist_security_disabled()) {
                 gic_write_grpen1(0);
                 gic_enable_redist(false);
         }
diff --git a/drivers/irqchip/irq-gic.c b/drivers/irqchip/irq-gic.c
index c2cab572c511..390fac59c6bc 100644
--- a/drivers/irqchip/irq-gic.c
+++ b/drivers/irqchip/irq-gic.c
@@ -769,6 +769,13 @@ static void gic_raise_softirq(const struct cpumask *mask, unsigned int irq)
         int cpu;
         unsigned long flags, map = 0;
 
+        if (unlikely(nr_cpu_ids == 1)) {
+                /* Only one CPU? let's do a self-IPI... */
+                writel_relaxed(2 << 24 | irq,
+                               gic_data_dist_base(&gic_data[0]) + GIC_DIST_SOFTINT);
+                return;
+        }
+
         raw_spin_lock_irqsave(&irq_controller_lock, flags);
 
         /* Convert our logical CPU mask into a physical one. */
diff --git a/drivers/irqchip/irq-mips-gic.c b/drivers/irqchip/irq-mips-gic.c
index c5f33c3bd228..6185696405d5 100644
--- a/drivers/irqchip/irq-mips-gic.c
+++ b/drivers/irqchip/irq-mips-gic.c
@@ -638,27 +638,6 @@ static int gic_local_irq_domain_map(struct irq_domain *d, unsigned int virq,
         if (!gic_local_irq_is_routable(intr))
                 return -EPERM;
 
-        /*
-         * HACK: These are all really percpu interrupts, but the rest
-         * of the MIPS kernel code does not use the percpu IRQ API for
-         * the CP0 timer and performance counter interrupts.
-         */
-        switch (intr) {
-        case GIC_LOCAL_INT_TIMER:
-        case GIC_LOCAL_INT_PERFCTR:
-        case GIC_LOCAL_INT_FDC:
-                irq_set_chip_and_handler(virq,
-                                         &gic_all_vpes_local_irq_controller,
-                                         handle_percpu_irq);
-                break;
-        default:
-                irq_set_chip_and_handler(virq,
-                                         &gic_local_irq_controller,
-                                         handle_percpu_devid_irq);
-                irq_set_percpu_devid(virq);
-                break;
-        }
-
         spin_lock_irqsave(&gic_lock, flags);
         for (i = 0; i < gic_vpes; i++) {
                 u32 val = GIC_MAP_TO_PIN_MSK | gic_cpu_pin;
@@ -713,9 +692,6 @@ static int gic_shared_irq_domain_map(struct irq_domain *d, unsigned int virq,
         unsigned long flags;
         int i;
 
-        irq_set_chip_and_handler(virq, &gic_level_irq_controller,
-                                 handle_level_irq);
-
         spin_lock_irqsave(&gic_lock, flags);
         gic_map_to_pin(intr, gic_cpu_pin);
         gic_map_to_vpe(intr, mips_cm_vp_id(vpe));
@@ -727,12 +703,42 @@ static int gic_shared_irq_domain_map(struct irq_domain *d, unsigned int virq,
         return 0;
 }
 
-static int gic_irq_domain_map(struct irq_domain *d, unsigned int virq,
-                              irq_hw_number_t hw)
+static int gic_setup_dev_chip(struct irq_domain *d, unsigned int virq,
+                              unsigned int hwirq)
 {
-        if (GIC_HWIRQ_TO_LOCAL(hw) < GIC_NUM_LOCAL_INTRS)
-                return gic_local_irq_domain_map(d, virq, hw);
-        return gic_shared_irq_domain_map(d, virq, hw, 0);
+        struct irq_chip *chip;
+        int err;
+
+        if (hwirq >= GIC_SHARED_HWIRQ_BASE) {
+                err = irq_domain_set_hwirq_and_chip(d, virq, hwirq,
+                                                    &gic_level_irq_controller,
+                                                    NULL);
+        } else {
+                switch (GIC_HWIRQ_TO_LOCAL(hwirq)) {
+                case GIC_LOCAL_INT_TIMER:
+                case GIC_LOCAL_INT_PERFCTR:
+                case GIC_LOCAL_INT_FDC:
+                        /*
+                         * HACK: These are all really percpu interrupts, but
+                         * the rest of the MIPS kernel code does not use the
+                         * percpu IRQ API for them.
+                         */
+                        chip = &gic_all_vpes_local_irq_controller;
+                        irq_set_handler(virq, handle_percpu_irq);
+                        break;
+
+                default:
+                        chip = &gic_local_irq_controller;
+                        irq_set_handler(virq, handle_percpu_devid_irq);
+                        irq_set_percpu_devid(virq);
+                        break;
+                }
+
+                err = irq_domain_set_hwirq_and_chip(d, virq, hwirq,
+                                                    chip, NULL);
+        }
+
+        return err;
 }
 
 static int gic_irq_domain_alloc(struct irq_domain *d, unsigned int virq,
@@ -743,15 +749,12 @@ static int gic_irq_domain_alloc(struct irq_domain *d, unsigned int virq,
         int cpu, ret, i;
 
         if (spec->type == GIC_DEVICE) {
-                /* verify that it doesn't conflict with an IPI irq */
-                if (test_bit(spec->hwirq, ipi_resrv))
+                /* verify that shared irqs don't conflict with an IPI irq */
+                if ((spec->hwirq >= GIC_SHARED_HWIRQ_BASE) &&
+                    test_bit(GIC_HWIRQ_TO_SHARED(spec->hwirq), ipi_resrv))
                         return -EBUSY;
 
-                hwirq = GIC_SHARED_TO_HWIRQ(spec->hwirq);
-
-                return irq_domain_set_hwirq_and_chip(d, virq, hwirq,
-                                                     &gic_level_irq_controller,
-                                                     NULL);
+                return gic_setup_dev_chip(d, virq, spec->hwirq);
         } else {
                 base_hwirq = find_first_bit(ipi_resrv, gic_shared_intrs);
                 if (base_hwirq == gic_shared_intrs) {
@@ -771,11 +774,13 @@ static int gic_irq_domain_alloc(struct irq_domain *d, unsigned int virq,
                         hwirq = GIC_SHARED_TO_HWIRQ(base_hwirq + i);
 
                         ret = irq_domain_set_hwirq_and_chip(d, virq + i, hwirq,
-                                                            &gic_edge_irq_controller,
+                                                            &gic_level_irq_controller,
                                                             NULL);
                         if (ret)
                                 goto error;
 
+                        irq_set_handler(virq + i, handle_level_irq);
+
                         ret = gic_shared_irq_domain_map(d, virq + i, hwirq, cpu);
                         if (ret)
                                 goto error;
@@ -818,7 +823,6 @@ int gic_irq_domain_match(struct irq_domain *d, struct device_node *node,
 }
 
 static const struct irq_domain_ops gic_irq_domain_ops = {
-        .map = gic_irq_domain_map,
         .alloc = gic_irq_domain_alloc,
         .free = gic_irq_domain_free,
         .match = gic_irq_domain_match,
@@ -849,29 +853,20 @@ static int gic_dev_domain_alloc(struct irq_domain *d, unsigned int virq,
         struct irq_fwspec *fwspec = arg;
         struct gic_irq_spec spec = {
                 .type = GIC_DEVICE,
-                .hwirq = fwspec->param[1],
         };
         int i, ret;
-        bool is_shared = fwspec->param[0] == GIC_SHARED;
 
-        if (is_shared) {
-                ret = irq_domain_alloc_irqs_parent(d, virq, nr_irqs, &spec);
-                if (ret)
-                        return ret;
-        }
-
-        for (i = 0; i < nr_irqs; i++) {
-                irq_hw_number_t hwirq;
+        if (fwspec->param[0] == GIC_SHARED)
+                spec.hwirq = GIC_SHARED_TO_HWIRQ(fwspec->param[1]);
+        else
+                spec.hwirq = GIC_LOCAL_TO_HWIRQ(fwspec->param[1]);
 
-                if (is_shared)
-                        hwirq = GIC_SHARED_TO_HWIRQ(spec.hwirq + i);
-                else
-                        hwirq = GIC_LOCAL_TO_HWIRQ(spec.hwirq + i);
+        ret = irq_domain_alloc_irqs_parent(d, virq, nr_irqs, &spec);
+        if (ret)
+                return ret;
 
-                ret = irq_domain_set_hwirq_and_chip(d, virq + i,
-                                                    hwirq,
-                                                    &gic_level_irq_controller,
-                                                    NULL);
+        for (i = 0; i < nr_irqs; i++) {
+                ret = gic_setup_dev_chip(d, virq + i, spec.hwirq + i);
                 if (ret)
                         goto error;
         }
@@ -890,10 +885,20 @@ void gic_dev_domain_free(struct irq_domain *d, unsigned int virq,
         return;
 }
 
+static void gic_dev_domain_activate(struct irq_domain *domain,
+                                    struct irq_data *d)
+{
+        if (GIC_HWIRQ_TO_LOCAL(d->hwirq) < GIC_NUM_LOCAL_INTRS)
+                gic_local_irq_domain_map(domain, d->irq, d->hwirq);
+        else
+                gic_shared_irq_domain_map(domain, d->irq, d->hwirq, 0);
+}
+
 static struct irq_domain_ops gic_dev_domain_ops = {
         .xlate = gic_dev_domain_xlate,
         .alloc = gic_dev_domain_alloc,
         .free = gic_dev_domain_free,
+        .activate = gic_dev_domain_activate,
 };
 
 static int gic_ipi_domain_xlate(struct irq_domain *d, struct device_node *ctrlr,
diff --git a/drivers/macintosh/ams/ams-i2c.c b/drivers/macintosh/ams/ams-i2c.c
index 978eda8d6678..8a3ba565106f 100644
--- a/drivers/macintosh/ams/ams-i2c.c
+++ b/drivers/macintosh/ams/ams-i2c.c
@@ -73,7 +73,6 @@ MODULE_DEVICE_TABLE(i2c, ams_id);
 static struct i2c_driver ams_i2c_driver = {
         .driver = {
                 .name   = "ams",
-                .owner  = THIS_MODULE,
         },
         .probe          = ams_i2c_probe,
         .remove         = ams_i2c_remove,
diff --git a/drivers/macintosh/windfarm_pm112.c b/drivers/macintosh/windfarm_pm112.c
index 3024685e4cca..96d16fca68b2 100644
--- a/drivers/macintosh/windfarm_pm112.c
+++ b/drivers/macintosh/windfarm_pm112.c
@@ -668,7 +668,6 @@ static struct platform_driver wf_pm112_driver = {
         .remove = wf_pm112_remove,
         .driver = {
                 .name = "windfarm",
-                .owner  = THIS_MODULE,
         },
 };
 
diff --git a/drivers/macintosh/windfarm_pm72.c b/drivers/macintosh/windfarm_pm72.c
index 2f506b9d5a52..e88cfb36a74d 100644
--- a/drivers/macintosh/windfarm_pm72.c
+++ b/drivers/macintosh/windfarm_pm72.c
@@ -789,7 +789,6 @@ static struct platform_driver wf_pm72_driver = {
         .remove = wf_pm72_remove,
         .driver = {
                 .name = "windfarm",
-                .owner  = THIS_MODULE,
         },
 };
 
diff --git a/drivers/macintosh/windfarm_rm31.c b/drivers/macintosh/windfarm_rm31.c
index 82fc86a90c1a..bdfcb8a8bfbb 100644
--- a/drivers/macintosh/windfarm_rm31.c
+++ b/drivers/macintosh/windfarm_rm31.c
@@ -682,7 +682,6 @@ static struct platform_driver wf_rm31_driver = {
         .remove = wf_rm31_remove,
         .driver = {
                 .name = "windfarm",
-                .owner  = THIS_MODULE,
         },
 };
 
diff --git a/drivers/mailbox/Kconfig b/drivers/mailbox/Kconfig
index 97c372908e78..7817d40d81e7 100644
--- a/drivers/mailbox/Kconfig
+++ b/drivers/mailbox/Kconfig
@@ -127,6 +127,7 @@ config XGENE_SLIMPRO_MBOX
 config BCM_PDC_MBOX
         tristate "Broadcom PDC Mailbox"
         depends on ARM64 || COMPILE_TEST
+        depends on HAS_DMA
         default ARCH_BCM_IPROC
         help
           Mailbox implementation for the Broadcom PDC ring manager,
diff --git a/drivers/mailbox/bcm-pdc-mailbox.c b/drivers/mailbox/bcm-pdc-mailbox.c
index cbe0c1ee4ba9..c19dd820ea9b 100644
--- a/drivers/mailbox/bcm-pdc-mailbox.c
+++ b/drivers/mailbox/bcm-pdc-mailbox.c
@@ -469,7 +469,7 @@ static const struct file_operations pdc_debugfs_stats = {
  * this directory for a SPU.
  * @pdcs: PDC state structure
  */
-void pdc_setup_debugfs(struct pdc_state *pdcs)
+static void pdc_setup_debugfs(struct pdc_state *pdcs)
 {
         char spu_stats_name[16];
 
@@ -485,7 +485,7 @@ void pdc_setup_debugfs(struct pdc_state *pdcs)
                                                   &pdc_debugfs_stats);
 }
 
-void pdc_free_debugfs(void)
+static void pdc_free_debugfs(void)
 {
         if (debugfs_dir && simple_empty(debugfs_dir)) {
                 debugfs_remove_recursive(debugfs_dir);
@@ -1191,10 +1191,11 @@ static void pdc_shutdown(struct mbox_chan *chan)
 {
         struct pdc_state *pdcs = chan->con_priv;
 
-        if (pdcs)
-                dev_dbg(&pdcs->pdev->dev,
-                        "Shutdown mailbox channel for PDC %u", pdcs->pdc_idx);
+        if (!pdcs)
+                return;
 
+        dev_dbg(&pdcs->pdev->dev,
+                "Shutdown mailbox channel for PDC %u", pdcs->pdc_idx);
         pdc_ring_free(pdcs);
 }
 
diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
index 95a4ca6ce6ff..849ad441cd76 100644
--- a/drivers/md/bcache/super.c
+++ b/drivers/md/bcache/super.c
@@ -760,7 +760,8 @@ static int bcache_device_init(struct bcache_device *d, unsigned block_size,
         if (!d->nr_stripes ||
             d->nr_stripes > INT_MAX ||
             d->nr_stripes > SIZE_MAX / sizeof(atomic_t)) {
-                pr_err("nr_stripes too large");
+                pr_err("nr_stripes too large or invalid: %u (start sector beyond end of disk?)",
+                        (unsigned)d->nr_stripes);
                 return -ENOMEM;
         }
 
@@ -1820,7 +1821,7 @@ static int cache_alloc(struct cache *ca)
         free = roundup_pow_of_two(ca->sb.nbuckets) >> 10;
 
         if (!init_fifo(&ca->free[RESERVE_BTREE], 8, GFP_KERNEL) ||
-            !init_fifo(&ca->free[RESERVE_PRIO], prio_buckets(ca), GFP_KERNEL) ||
+            !init_fifo_exact(&ca->free[RESERVE_PRIO], prio_buckets(ca), GFP_KERNEL) ||
             !init_fifo(&ca->free[RESERVE_MOVINGGC], free, GFP_KERNEL) ||
             !init_fifo(&ca->free[RESERVE_NONE], free, GFP_KERNEL) ||
             !init_fifo(&ca->free_inc,   free << 2, GFP_KERNEL) ||
@@ -1844,7 +1845,7 @@ static int register_cache(struct cache_sb *sb, struct page *sb_page,
                                 struct block_device *bdev, struct cache *ca)
 {
         char name[BDEVNAME_SIZE];
-        const char *err = NULL;
+        const char *err = NULL; /* must be set for any error case */
         int ret = 0;
 
         memcpy(&ca->sb, sb, sizeof(struct cache_sb));
@@ -1861,8 +1862,13 @@ static int register_cache(struct cache_sb *sb, struct page *sb_page,
                 ca->discard = CACHE_DISCARD(&ca->sb);
 
         ret = cache_alloc(ca);
-        if (ret != 0)
+        if (ret != 0) {
+                if (ret == -ENOMEM)
+                        err = "cache_alloc(): -ENOMEM";
+                else
+                        err = "cache_alloc(): unknown error";
                 goto err;
+        }
 
         if (kobject_add(&ca->kobj, &part_to_dev(bdev->bd_part)->kobj, "bcache")) {
                 err = "error calling kobject_add";
diff --git a/drivers/md/bitmap.c b/drivers/md/bitmap.c
index 6fff794e0c72..13041ee37ad6 100644
--- a/drivers/md/bitmap.c
+++ b/drivers/md/bitmap.c
@@ -2183,19 +2183,29 @@ location_show(struct mddev *mddev, char *page)
 static ssize_t
 location_store(struct mddev *mddev, const char *buf, size_t len)
 {
+        int rv;
 
+        rv = mddev_lock(mddev);
+        if (rv)
+                return rv;
         if (mddev->pers) {
-                if (!mddev->pers->quiesce)
-                        return -EBUSY;
-                if (mddev->recovery || mddev->sync_thread)
-                        return -EBUSY;
+                if (!mddev->pers->quiesce) {
+                        rv = -EBUSY;
+                        goto out;
+                }
+                if (mddev->recovery || mddev->sync_thread) {
+                        rv = -EBUSY;
+                        goto out;
+                }
         }
 
         if (mddev->bitmap || mddev->bitmap_info.file ||
             mddev->bitmap_info.offset) {
                 /* bitmap already configured.  Only option is to clear it */
-                if (strncmp(buf, "none", 4) != 0)
-                        return -EBUSY;
+                if (strncmp(buf, "none", 4) != 0) {
+                        rv = -EBUSY;
+                        goto out;
+                }
                 if (mddev->pers) {
                         mddev->pers->quiesce(mddev, 1);
                         bitmap_destroy(mddev);
@@ -2214,21 +2224,25 @@ location_store(struct mddev *mddev, const char *buf, size_t len)
                         /* nothing to be done */;
                 else if (strncmp(buf, "file:", 5) == 0) {
                         /* Not supported yet */
-                        return -EINVAL;
+                        rv = -EINVAL;
+                        goto out;
                 } else {
-                        int rv;
                         if (buf[0] == '+')
                                 rv = kstrtoll(buf+1, 10, &offset);
                         else
                                 rv = kstrtoll(buf, 10, &offset);
                         if (rv)
-                                return rv;
-                        if (offset == 0)
-                                return -EINVAL;
+                                goto out;
+                        if (offset == 0) {
+                                rv = -EINVAL;
+                                goto out;
+                        }
                         if (mddev->bitmap_info.external == 0 &&
                             mddev->major_version == 0 &&
-                            offset != mddev->bitmap_info.default_offset)
-                                return -EINVAL;
+                            offset != mddev->bitmap_info.default_offset) {
+                                rv = -EINVAL;
+                                goto out;
+                        }
                         mddev->bitmap_info.offset = offset;
                         if (mddev->pers) {
                                 struct bitmap *bitmap;
@@ -2245,7 +2259,7 @@ location_store(struct mddev *mddev, const char *buf, size_t len)
                                 mddev->pers->quiesce(mddev, 0);
                                 if (rv) {
                                         bitmap_destroy(mddev);
-                                        return rv;
+                                        goto out;
                                 }
                         }
                 }
@@ -2257,6 +2271,11 @@ location_store(struct mddev *mddev, const char *buf, size_t len)
                 set_bit(MD_CHANGE_DEVS, &mddev->flags);
                 md_wakeup_thread(mddev->thread);
         }
+        rv = 0;
+out:
+        mddev_unlock(mddev);
+        if (rv)
+                return rv;
         return len;
 }
 
diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c
index 6571c81465e1..8625040bae92 100644
--- a/drivers/md/dm-bufio.c
+++ b/drivers/md/dm-bufio.c
@@ -1879,7 +1879,7 @@ static int __init dm_bufio_init(void)
         __cache_size_refresh();
         mutex_unlock(&dm_bufio_clients_lock);
 
-        dm_bufio_wq = create_singlethread_workqueue("dm_bufio_cache");
+        dm_bufio_wq = alloc_workqueue("dm_bufio_cache", WQ_MEM_RECLAIM, 0);
         if (!dm_bufio_wq)
                 return -ENOMEM;
 
diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
index 4e9784b4e0ac..874295757caa 100644
--- a/drivers/md/dm-crypt.c
+++ b/drivers/md/dm-crypt.c
@@ -181,7 +181,7 @@ struct crypt_config {
         u8 key[0];
 };
 
-#define MIN_IOS        16
+#define MIN_IOS        64
 
 static void clone_init(struct dm_crypt_io *, struct bio *);
 static void kcryptd_queue_crypt(struct dm_crypt_io *io);
@@ -1453,7 +1453,7 @@ static int crypt_alloc_tfms(struct crypt_config *cc, char *ciphermode)
         unsigned i;
         int err;
 
-        cc->tfms = kmalloc(cc->tfms_count * sizeof(struct crypto_skcipher *),
+        cc->tfms = kzalloc(cc->tfms_count * sizeof(struct crypto_skcipher *),
                            GFP_KERNEL);
         if (!cc->tfms)
                 return -ENOMEM;
@@ -1924,6 +1924,13 @@ static int crypt_map(struct dm_target *ti, struct bio *bio)
                 return DM_MAPIO_REMAPPED;
         }
 
+        /*
+         * Check if bio is too large, split as needed.
+         */
+        if (unlikely(bio->bi_iter.bi_size > (BIO_MAX_PAGES << PAGE_SHIFT)) &&
+            bio_data_dir(bio) == WRITE)
+                dm_accept_partial_bio(bio, ((BIO_MAX_PAGES << PAGE_SHIFT) >> SECTOR_SHIFT));
+
         io = dm_per_bio_data(bio, cc->per_bio_data_size);
         crypt_io_init(io, cc, bio, dm_target_offset(ti, bio->bi_iter.bi_sector));
         io->ctx.req = (struct skcipher_request *)(io + 1);
diff --git a/drivers/md/dm-flakey.c b/drivers/md/dm-flakey.c
index 97e446d54a15..6a2e8dd44a1b 100644
--- a/drivers/md/dm-flakey.c
+++ b/drivers/md/dm-flakey.c
@@ -289,15 +289,13 @@ static int flakey_map(struct dm_target *ti, struct bio *bio)
                 pb->bio_submitted = true;
 
                 /*
-                 * Map reads as normal only if corrupt_bio_byte set.
+                 * Error reads if neither corrupt_bio_byte or drop_writes are set.
+                 * Otherwise, flakey_end_io() will decide if the reads should be modified.
                  */
                 if (bio_data_dir(bio) == READ) {
-                        /* If flags were specified, only corrupt those that match. */
-                        if (fc->corrupt_bio_byte && (fc->corrupt_bio_rw == READ) &&
-                            all_corrupt_bio_flags_match(bio, fc))
-                                goto map_bio;
-                        else
+                        if (!fc->corrupt_bio_byte && !test_bit(DROP_WRITES, &fc->flags))
                                 return -EIO;
+                        goto map_bio;
                 }
 
                 /*
@@ -334,14 +332,21 @@ static int flakey_end_io(struct dm_target *ti, struct bio *bio, int error)
         struct flakey_c *fc = ti->private;
         struct per_bio_data *pb = dm_per_bio_data(bio, sizeof(struct per_bio_data));
 
-        /*
-         * Corrupt successful READs while in down state.
-         */
         if (!error && pb->bio_submitted && (bio_data_dir(bio) == READ)) {
-                if (fc->corrupt_bio_byte)
+                if (fc->corrupt_bio_byte && (fc->corrupt_bio_rw == READ) &&
+                    all_corrupt_bio_flags_match(bio, fc)) {
+                        /*
+                         * Corrupt successful matching READs while in down state.
+                         */
                         corrupt_bio_data(bio, fc);
-                else
+
+                } else if (!test_bit(DROP_WRITES, &fc->flags)) {
+                        /*
+                         * Error read during the down_interval if drop_writes
+                         * wasn't configured.
+                         */
                         return -EIO;
+                }
         }
 
         return error;
diff --git a/drivers/md/dm-log-writes.c b/drivers/md/dm-log-writes.c
index 4ab68033f9d1..49e4d8d4558f 100644
--- a/drivers/md/dm-log-writes.c
+++ b/drivers/md/dm-log-writes.c
@@ -259,12 +259,12 @@ static int log_one_block(struct log_writes_c *lc,
                 goto out;
         sector++;
 
-        bio = bio_alloc(GFP_KERNEL, block->vec_cnt);
+        atomic_inc(&lc->io_blocks);
+        bio = bio_alloc(GFP_KERNEL, min(block->vec_cnt, BIO_MAX_PAGES));
         if (!bio) {
                 DMERR("Couldn't alloc log bio");
                 goto error;
         }
-        atomic_inc(&lc->io_blocks);
         bio->bi_iter.bi_size = 0;
         bio->bi_iter.bi_sector = sector;
         bio->bi_bdev = lc->logdev->bdev;
@@ -282,7 +282,7 @@ static int log_one_block(struct log_writes_c *lc,
                 if (ret != block->vecs[i].bv_len) {
                         atomic_inc(&lc->io_blocks);
                         submit_bio(bio);
-                        bio = bio_alloc(GFP_KERNEL, block->vec_cnt - i);
+                        bio = bio_alloc(GFP_KERNEL, min(block->vec_cnt - i, BIO_MAX_PAGES));
                         if (!bio) {
                                 DMERR("Couldn't alloc log bio");
                                 goto error;
@@ -459,9 +459,9 @@ static int log_writes_ctr(struct dm_target *ti, unsigned int argc, char **argv)
                 goto bad;
         }
 
-        ret = -EINVAL;
         lc->log_kthread = kthread_run(log_writes_kthread, lc, "log-write");
-        if (!lc->log_kthread) {
+        if (IS_ERR(lc->log_kthread)) {
+                ret = PTR_ERR(lc->log_kthread);
                 ti->error = "Couldn't alloc kthread";
                 dm_put_device(ti, lc->dev);
                 dm_put_device(ti, lc->logdev);
diff --git a/drivers/md/dm-log.c b/drivers/md/dm-log.c
index 4ca2d1df5b44..07fc1ad42ec5 100644
--- a/drivers/md/dm-log.c
+++ b/drivers/md/dm-log.c
@@ -291,9 +291,10 @@ static void header_from_disk(struct log_header_core *core, struct log_header_dis
         core->nr_regions = le64_to_cpu(disk->nr_regions);
 }
 
-static int rw_header(struct log_c *lc, int rw)
+static int rw_header(struct log_c *lc, int op)
 {
-        lc->io_req.bi_op = rw;
+        lc->io_req.bi_op = op;
+        lc->io_req.bi_op_flags = 0;
 
         return dm_io(&lc->io_req, 1, &lc->header_location, NULL);
 }
@@ -316,7 +317,7 @@ static int read_header(struct log_c *log)
 {
         int r;
 
-        r = rw_header(log, READ);
+        r = rw_header(log, REQ_OP_READ);
         if (r)
                 return r;
 
@@ -630,7 +631,7 @@ static int disk_resume(struct dm_dirty_log *log)
         header_to_disk(&lc->header, lc->disk_header);
 
         /* write the new header */
-        r = rw_header(lc, WRITE);
+        r = rw_header(lc, REQ_OP_WRITE);
         if (!r) {
                 r = flush_header(lc);
                 if (r)
@@ -698,7 +699,7 @@ static int disk_flush(struct dm_dirty_log *log)
                         log_clear_bit(lc, lc->clean_bits, i);
         }
 
-        r = rw_header(lc, WRITE);
+        r = rw_header(lc, REQ_OP_WRITE);
         if (r)
                 fail_log_device(lc);
         else {
diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c
index 1b9795d75ef8..8abde6b8cedc 100644
--- a/drivers/md/dm-raid.c
+++ b/drivers/md/dm-raid.c
@@ -191,7 +191,6 @@ struct raid_dev {
 #define RT_FLAG_RS_BITMAP_LOADED        2
 #define RT_FLAG_UPDATE_SBS              3
 #define RT_FLAG_RESHAPE_RS              4
-#define RT_FLAG_KEEP_RS_FROZEN          5
 
 /* Array elements of 64 bit needed for rebuild/failed disk bits */
 #define DISKS_ARRAY_ELEMS ((MAX_RAID_DEVICES + (sizeof(uint64_t) * 8 - 1)) / sizeof(uint64_t) / 8)
@@ -861,6 +860,9 @@ static int validate_region_size(struct raid_set *rs, unsigned long region_size)
 {
         unsigned long min_region_size = rs->ti->len / (1 << 21);
 
+        if (rs_is_raid0(rs))
+                return 0;
+
         if (!region_size) {
                 /*
                  * Choose a reasonable default.  All figures in sectors.
@@ -930,6 +932,8 @@ static int validate_raid_redundancy(struct raid_set *rs)
                         rebuild_cnt++;
 
         switch (rs->raid_type->level) {
+        case 0:
+                break;
         case 1:
                 if (rebuild_cnt >= rs->md.raid_disks)
                         goto too_many;
@@ -2335,6 +2339,13 @@ static int analyse_superblocks(struct dm_target *ti, struct raid_set *rs)
                 case 0:
                         break;
                 default:
+                        /*
+                         * We have to keep any raid0 data/metadata device pairs or
+                         * the MD raid0 personality will fail to start the array.
+                         */
+                        if (rs_is_raid0(rs))
+                                continue;
+
                         dev = container_of(rdev, struct raid_dev, rdev);
                         if (dev->meta_dev)
                                 dm_put_device(ti, dev->meta_dev);
@@ -2579,7 +2590,6 @@ static int rs_prepare_reshape(struct raid_set *rs)
                 } else {
                         /* Process raid1 without delta_disks */
                         mddev->raid_disks = rs->raid_disks;
-                        set_bit(RT_FLAG_KEEP_RS_FROZEN, &rs->runtime_flags);
                         reshape = false;
                 }
         } else {
@@ -2590,7 +2600,6 @@ static int rs_prepare_reshape(struct raid_set *rs)
         if (reshape) {
                 set_bit(RT_FLAG_RESHAPE_RS, &rs->runtime_flags);
                 set_bit(RT_FLAG_UPDATE_SBS, &rs->runtime_flags);
-                set_bit(RT_FLAG_KEEP_RS_FROZEN, &rs->runtime_flags);
         } else if (mddev->raid_disks < rs->raid_disks)
                 /* Create new superblocks and bitmaps, if any new disks */
                 set_bit(RT_FLAG_UPDATE_SBS, &rs->runtime_flags);
@@ -2902,7 +2911,6 @@ static int raid_ctr(struct dm_target *ti, unsigned int argc, char **argv)
                         goto bad;
 
                 set_bit(RT_FLAG_UPDATE_SBS, &rs->runtime_flags);
-                set_bit(RT_FLAG_KEEP_RS_FROZEN, &rs->runtime_flags);
                 /* Takeover ain't recovery, so disable recovery */
                 rs_setup_recovery(rs, MaxSector);
                 rs_set_new(rs);
@@ -3386,21 +3394,28 @@ static void raid_postsuspend(struct dm_target *ti)
 {
         struct raid_set *rs = ti->private;
 
-        if (test_and_clear_bit(RT_FLAG_RS_RESUMED, &rs->runtime_flags)) {
-                if (!rs->md.suspended)
-                        mddev_suspend(&rs->md);
-                rs->md.ro = 1;
-        }
+        if (!rs->md.suspended)
+                mddev_suspend(&rs->md);
+
+        rs->md.ro = 1;
 }
 
 static void attempt_restore_of_faulty_devices(struct raid_set *rs)
 {
         int i;
-        uint64_t failed_devices, cleared_failed_devices = 0;
+        uint64_t cleared_failed_devices[DISKS_ARRAY_ELEMS];
         unsigned long flags;
+        bool cleared = false;
         struct dm_raid_superblock *sb;
+        struct mddev *mddev = &rs->md;
         struct md_rdev *r;
 
+        /* RAID personalities have to provide hot add/remove methods or we need to bail out. */
+        if (!mddev->pers || !mddev->pers->hot_add_disk || !mddev->pers->hot_remove_disk)
+                return;
+
+        memset(cleared_failed_devices, 0, sizeof(cleared_failed_devices));
+
         for (i = 0; i < rs->md.raid_disks; i++) {
                 r = &rs->dev[i].rdev;
                 if (test_bit(Faulty, &r->flags) && r->sb_page &&
@@ -3420,7 +3435,7 @@ static void attempt_restore_of_faulty_devices(struct raid_set *rs)
                          * ourselves.
                          */
                         if ((r->raid_disk >= 0) &&
-                            (r->mddev->pers->hot_remove_disk(r->mddev, r) != 0))
+                            (mddev->pers->hot_remove_disk(mddev, r) != 0))
                                 /* Failed to revive this device, try next */
                                 continue;
 
@@ -3430,22 +3445,30 @@ static void attempt_restore_of_faulty_devices(struct raid_set *rs)
                         clear_bit(Faulty, &r->flags);
                         clear_bit(WriteErrorSeen, &r->flags);
                         clear_bit(In_sync, &r->flags);
-                        if (r->mddev->pers->hot_add_disk(r->mddev, r)) {
+                        if (mddev->pers->hot_add_disk(mddev, r)) {
                                 r->raid_disk = -1;
                                 r->saved_raid_disk = -1;
                                 r->flags = flags;
                         } else {
                                 r->recovery_offset = 0;
-                                cleared_failed_devices |= 1 << i;
+                                set_bit(i, (void *) cleared_failed_devices);
+                                cleared = true;
                         }
                 }
         }
-        if (cleared_failed_devices) {
+
+        /* If any failed devices could be cleared, update all sbs failed_devices bits */
+        if (cleared) {
+                uint64_t failed_devices[DISKS_ARRAY_ELEMS];
+
                 rdev_for_each(r, &rs->md) {
                         sb = page_address(r->sb_page);
-                        failed_devices = le64_to_cpu(sb->failed_devices);
-                        failed_devices &= ~cleared_failed_devices;
-                        sb->failed_devices = cpu_to_le64(failed_devices);
+                        sb_retrieve_failed_devices(sb, failed_devices);
+
+                        for (i = 0; i < DISKS_ARRAY_ELEMS; i++)
+                                failed_devices[i] &= ~cleared_failed_devices[i];
+
+                        sb_update_failed_devices(sb, failed_devices);
                 }
         }
 }
@@ -3610,26 +3633,15 @@ static void raid_resume(struct dm_target *ti)
                  * devices are reachable again.
                  */
                 attempt_restore_of_faulty_devices(rs);
-        } else {
-                mddev->ro = 0;
-                mddev->in_sync = 0;
+        }
 
-                /*
-                 * When passing in flags to the ctr, we expect userspace
-                 * to reset them because they made it to the superblocks
-                 * and reload the mapping anyway.
-                 *
-                 * -> only unfreeze recovery in case of a table reload or
-                 *    we'll have a bogus recovery/reshape position
-                 *    retrieved from the superblock by the ctr because
-                 *    the ongoing recovery/reshape will change it after read.
-                 */
-                if (!test_bit(RT_FLAG_KEEP_RS_FROZEN, &rs->runtime_flags))
-                        clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
+        mddev->ro = 0;
+        mddev->in_sync = 0;
 
-                if (mddev->suspended)
-                        mddev_resume(mddev);
-        }
+        clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
+
+        if (mddev->suspended)
+                mddev_resume(mddev);
 }
 
 static struct target_type raid_target = {
diff --git a/drivers/md/dm-round-robin.c b/drivers/md/dm-round-robin.c
index 4ace1da17db8..6c25213ab38c 100644
--- a/drivers/md/dm-round-robin.c
+++ b/drivers/md/dm-round-robin.c
@@ -210,14 +210,17 @@ static struct dm_path *rr_select_path(struct path_selector *ps, size_t nr_bytes)
         struct path_info *pi = NULL;
         struct dm_path *current_path = NULL;
 
+        local_irq_save(flags);
         current_path = *this_cpu_ptr(s->current_path);
         if (current_path) {
                 percpu_counter_dec(&s->repeat_count);
-                if (percpu_counter_read_positive(&s->repeat_count) > 0)
+                if (percpu_counter_read_positive(&s->repeat_count) > 0) {
+                        local_irq_restore(flags);
                         return current_path;
+                }
         }
 
-        spin_lock_irqsave(&s->lock, flags);
+        spin_lock(&s->lock);
         if (!list_empty(&s->valid_paths)) {
                 pi = list_entry(s->valid_paths.next, struct path_info, list);
                 list_move_tail(&pi->list, &s->valid_paths);
diff --git a/drivers/md/md-cluster.c b/drivers/md/md-cluster.c
index 41573f1f626f..34a840d9df76 100644
--- a/drivers/md/md-cluster.c
+++ b/drivers/md/md-cluster.c
@@ -834,8 +834,10 @@ static int join(struct mddev *mddev, int nodes)
                 goto err;
         }
         cinfo->ack_lockres = lockres_init(mddev, "ack", ack_bast, 0);
-        if (!cinfo->ack_lockres)
+        if (!cinfo->ack_lockres) {
+                ret = -ENOMEM;
                 goto err;
+        }
         /* get sync CR lock on ACK. */
         if (dlm_lock_sync(cinfo->ack_lockres, DLM_LOCK_CR))
                 pr_err("md-cluster: failed to get a sync CR lock on ACK!(%d)\n",
@@ -849,8 +851,10 @@ static int join(struct mddev *mddev, int nodes)
         pr_info("md-cluster: Joined cluster %s slot %d\n", str, cinfo->slot_number);
         snprintf(str, 64, "bitmap%04d", cinfo->slot_number - 1);
         cinfo->bitmap_lockres = lockres_init(mddev, str, NULL, 1);
-        if (!cinfo->bitmap_lockres)
+        if (!cinfo->bitmap_lockres) {
+                ret = -ENOMEM;
                 goto err;
+        }
         if (dlm_lock_sync(cinfo->bitmap_lockres, DLM_LOCK_PW)) {
                 pr_err("Failed to get bitmap lock\n");
                 ret = -EINVAL;
@@ -858,8 +862,10 @@ static int join(struct mddev *mddev, int nodes)
         }
 
         cinfo->resync_lockres = lockres_init(mddev, "resync", NULL, 0);
-        if (!cinfo->resync_lockres)
+        if (!cinfo->resync_lockres) {
+                ret = -ENOMEM;
                 goto err;
+        }
 
         return 0;
 err:
diff --git a/drivers/md/md.c b/drivers/md/md.c
index d646f6e444f0..915e84d631a2 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -1604,11 +1604,8 @@ static int super_1_validate(struct mddev *mddev, struct md_rdev *rdev)
                         mddev->new_chunk_sectors = mddev->chunk_sectors;
                 }
 
-                if (le32_to_cpu(sb->feature_map) & MD_FEATURE_JOURNAL) {
+                if (le32_to_cpu(sb->feature_map) & MD_FEATURE_JOURNAL)
                         set_bit(MD_HAS_JOURNAL, &mddev->flags);
-                        if (mddev->recovery_cp == MaxSector)
-                                set_bit(MD_JOURNAL_CLEAN, &mddev->flags);
-                }
         } else if (mddev->pers == NULL) {
                 /* Insist of good event counter while assembling, except for
                  * spares (which don't need an event count) */
@@ -5851,6 +5848,9 @@ static int get_array_info(struct mddev *mddev, void __user *arg)
                         working++;
                         if (test_bit(In_sync, &rdev->flags))
                                 insync++;
+                        else if (test_bit(Journal, &rdev->flags))
+                                /* TODO: add journal count to md_u.h */
+                                ;
                         else
                                 spare++;
                 }
@@ -7610,16 +7610,12 @@ EXPORT_SYMBOL(unregister_md_cluster_operations);
 
 int md_setup_cluster(struct mddev *mddev, int nodes)
 {
-        int err;
-
-        err = request_module("md-cluster");
-        if (err) {
-                pr_err("md-cluster module not found.\n");
-                return -ENOENT;
-        }
-
+        if (!md_cluster_ops)
+                request_module("md-cluster");
         spin_lock(&pers_lock);
+        /* ensure module won't be unloaded */
         if (!md_cluster_ops || !try_module_get(md_cluster_mod)) {
+                pr_err("can't find md-cluster module or get it's reference.\n");
                 spin_unlock(&pers_lock);
                 return -ENOENT;
         }
@@ -7862,6 +7858,7 @@ void md_do_sync(struct md_thread *thread)
          */
 
         do {
+                int mddev2_minor = -1;
                 mddev->curr_resync = 2;
 
         try_again:
@@ -7891,10 +7888,14 @@ void md_do_sync(struct md_thread *thread)
                                 prepare_to_wait(&resync_wait, &wq, TASK_INTERRUPTIBLE);
                                 if (!test_bit(MD_RECOVERY_INTR, &mddev->recovery) &&
                                     mddev2->curr_resync >= mddev->curr_resync) {
-                                        printk(KERN_INFO "md: delaying %s of %s"
-                                               " until %s has finished (they"
-                                               " share one or more physical units)\n",
-                                               desc, mdname(mddev), mdname(mddev2));
+                                        if (mddev2_minor != mddev2->md_minor) {
+                                                mddev2_minor = mddev2->md_minor;
+                                                printk(KERN_INFO "md: delaying %s of %s"
+                                                       " until %s has finished (they"
+                                                       " share one or more physical units)\n",
+                                                       desc, mdname(mddev),
+                                                       mdname(mddev2));
+                                        }
                                         mddev_put(mddev2);
                                         if (signal_pending(current))
                                                 flush_signals(current);
@@ -8275,16 +8276,13 @@ no_add:
 static void md_start_sync(struct work_struct *ws)
 {
         struct mddev *mddev = container_of(ws, struct mddev, del_work);
-        int ret = 0;
 
         mddev->sync_thread = md_register_thread(md_do_sync,
                                                 mddev,
                                                 "resync");
         if (!mddev->sync_thread) {
-                if (!(mddev_is_clustered(mddev) && ret == -EAGAIN))
-                        printk(KERN_ERR "%s: could not start resync"
-                               " thread...\n",
-                               mdname(mddev));
+                printk(KERN_ERR "%s: could not start resync thread...\n",
+                       mdname(mddev));
                 /* leave the spares where they are, it shouldn't hurt */
                 clear_bit(MD_RECOVERY_SYNC, &mddev->recovery);
                 clear_bit(MD_RECOVERY_RESHAPE, &mddev->recovery);
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 0e4efcd10795..be1a9fca3b2d 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -1064,6 +1064,8 @@ static void __make_request(struct mddev *mddev, struct bio *bio)
         int max_sectors;
         int sectors;
 
+        md_write_start(mddev, bio);
+
         /*
          * Register the new request and wait if the reconstruction
          * thread has put up a bar for new requests.
@@ -1445,8 +1447,6 @@ static void raid10_make_request(struct mddev *mddev, struct bio *bio)
                 return;
         }
 
-        md_write_start(mddev, bio);
-
         do {
 
                 /*
@@ -2465,20 +2465,21 @@ static int narrow_write_error(struct r10bio *r10_bio, int i)
 
         while (sect_to_write) {
                 struct bio *wbio;
+                sector_t wsector;
                 if (sectors > sect_to_write)
                         sectors = sect_to_write;
                 /* Write at 'sector' for 'sectors' */
                 wbio = bio_clone_mddev(bio, GFP_NOIO, mddev);
                 bio_trim(wbio, sector - bio->bi_iter.bi_sector, sectors);
-                wbio->bi_iter.bi_sector = (r10_bio->devs[i].addr+
-                                   choose_data_offset(r10_bio, rdev) +
-                                   (sector - r10_bio->sector));
+                wsector = r10_bio->devs[i].addr + (sector - r10_bio->sector);
+                wbio->bi_iter.bi_sector = wsector +
+                                   choose_data_offset(r10_bio, rdev);
                 wbio->bi_bdev = rdev->bdev;
                 bio_set_op_attrs(wbio, REQ_OP_WRITE, 0);
 
                 if (submit_bio_wait(wbio) < 0)
                         /* Failure! */
-                        ok = rdev_set_badblocks(rdev, sector,
+                        ok = rdev_set_badblocks(rdev, wsector,
                                                 sectors, 0)
                                 && ok;
 
diff --git a/drivers/md/raid5-cache.c b/drivers/md/raid5-cache.c
index 51f76ddbe265..1b1ab4a1d132 100644
--- a/drivers/md/raid5-cache.c
+++ b/drivers/md/raid5-cache.c
@@ -96,7 +96,6 @@ struct r5l_log {
         spinlock_t no_space_stripes_lock;
 
         bool need_cache_flush;
-        bool in_teardown;
 };
 
 /*
@@ -704,31 +703,22 @@ static void r5l_write_super_and_discard_space(struct r5l_log *log,
 
         mddev = log->rdev->mddev;
         /*
-         * This is to avoid a deadlock. r5l_quiesce holds reconfig_mutex and
-         * wait for this thread to finish. This thread waits for
-         * MD_CHANGE_PENDING clear, which is supposed to be done in
-         * md_check_recovery(). md_check_recovery() tries to get
-         * reconfig_mutex. Since r5l_quiesce already holds the mutex,
-         * md_check_recovery() fails, so the PENDING never get cleared. The
-         * in_teardown check workaround this issue.
+         * Discard could zero data, so before discard we must make sure
+         * superblock is updated to new log tail. Updating superblock (either
+         * directly call md_update_sb() or depend on md thread) must hold
+         * reconfig mutex. On the other hand, raid5_quiesce is called with
+         * reconfig_mutex hold. The first step of raid5_quiesce() is waitting
+         * for all IO finish, hence waitting for reclaim thread, while reclaim
+         * thread is calling this function and waitting for reconfig mutex. So
+         * there is a deadlock. We workaround this issue with a trylock.
+         * FIXME: we could miss discard if we can't take reconfig mutex
          */
-        if (!log->in_teardown) {
-                set_mask_bits(&mddev->flags, 0,
-                              BIT(MD_CHANGE_DEVS) | BIT(MD_CHANGE_PENDING));
-                md_wakeup_thread(mddev->thread);
-                wait_event(mddev->sb_wait,
-                        !test_bit(MD_CHANGE_PENDING, &mddev->flags) ||
-                        log->in_teardown);
-                /*
-                 * r5l_quiesce could run after in_teardown check and hold
-                 * mutex first. Superblock might get updated twice.
-                 */
-                if (log->in_teardown)
-                        md_update_sb(mddev, 1);
-        } else {
-                WARN_ON(!mddev_is_locked(mddev));
-                md_update_sb(mddev, 1);
-        }
+        set_mask_bits(&mddev->flags, 0,
+                BIT(MD_CHANGE_DEVS) | BIT(MD_CHANGE_PENDING));
+        if (!mddev_trylock(mddev))
+                return;
+        md_update_sb(mddev, 1);
+        mddev_unlock(mddev);
 
         /* discard IO error really doesn't matter, ignore it */
         if (log->last_checkpoint < end) {
@@ -827,7 +817,6 @@ void r5l_quiesce(struct r5l_log *log, int state)
         if (!log || state == 2)
                 return;
         if (state == 0) {
-                log->in_teardown = 0;
                 /*
                  * This is a special case for hotadd. In suspend, the array has
                  * no journal. In resume, journal is initialized as well as the
@@ -838,11 +827,6 @@ void r5l_quiesce(struct r5l_log *log, int state)
                 log->reclaim_thread = md_register_thread(r5l_reclaim_thread,
                                         log->rdev->mddev, "reclaim");
         } else if (state == 1) {
-                /*
-                 * at this point all stripes are finished, so io_unit is at
-                 * least in STRIPE_END state
-                 */
-                log->in_teardown = 1;
                 /* make sure r5l_write_super_and_discard_space exits */
                 mddev = log->rdev->mddev;
                 wake_up(&mddev->sb_wait);
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 8912407a4dd0..ee7fc3701700 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -659,6 +659,7 @@ raid5_get_active_stripe(struct r5conf *conf, sector_t sector,
 {
         struct stripe_head *sh;
         int hash = stripe_hash_locks_hash(sector);
+        int inc_empty_inactive_list_flag;
 
         pr_debug("get_stripe, sector %llu\n", (unsigned long long)sector);
 
@@ -703,7 +704,12 @@ raid5_get_active_stripe(struct r5conf *conf, sector_t sector,
                                         atomic_inc(&conf->active_stripes);
                                 BUG_ON(list_empty(&sh->lru) &&
                                        !test_bit(STRIPE_EXPANDING, &sh->state));
+                                inc_empty_inactive_list_flag = 0;
+                                if (!list_empty(conf->inactive_list + hash))
+                                        inc_empty_inactive_list_flag = 1;
                                 list_del_init(&sh->lru);
+                                if (list_empty(conf->inactive_list + hash) && inc_empty_inactive_list_flag)
+                                        atomic_inc(&conf->empty_inactive_list_nr);
                                 if (sh->group) {
                                         sh->group->stripes_cnt--;
                                         sh->group = NULL;
@@ -762,6 +768,7 @@ static void stripe_add_to_batch_list(struct r5conf *conf, struct stripe_head *sh
         sector_t head_sector, tmp_sec;
         int hash;
         int dd_idx;
+        int inc_empty_inactive_list_flag;
 
         /* Don't cross chunks, so stripe pd_idx/qd_idx is the same */
         tmp_sec = sh->sector;
@@ -779,7 +786,12 @@ static void stripe_add_to_batch_list(struct r5conf *conf, struct stripe_head *sh
                                 atomic_inc(&conf->active_stripes);
                         BUG_ON(list_empty(&head->lru) &&
                                !test_bit(STRIPE_EXPANDING, &head->state));
+                        inc_empty_inactive_list_flag = 0;
+                        if (!list_empty(conf->inactive_list + hash))
+                                inc_empty_inactive_list_flag = 1;
                         list_del_init(&head->lru);
+                        if (list_empty(conf->inactive_list + hash) && inc_empty_inactive_list_flag)
+                                atomic_inc(&conf->empty_inactive_list_nr);
                         if (head->group) {
                                 head->group->stripes_cnt--;
                                 head->group = NULL;
@@ -993,7 +1005,6 @@ again:
 
                         set_bit(STRIPE_IO_STARTED, &sh->state);
 
-                        bio_reset(bi);
                         bi->bi_bdev = rdev->bdev;
                         bio_set_op_attrs(bi, op, op_flags);
                         bi->bi_end_io = op_is_write(op)
@@ -1045,7 +1056,6 @@ again:
 
                         set_bit(STRIPE_IO_STARTED, &sh->state);
 
-                        bio_reset(rbi);
                         rbi->bi_bdev = rrdev->bdev;
                         bio_set_op_attrs(rbi, op, op_flags);
                         BUG_ON(!op_is_write(op));
@@ -1978,9 +1988,11 @@ static void raid_run_ops(struct stripe_head *sh, unsigned long ops_request)
         put_cpu();
 }
 
-static struct stripe_head *alloc_stripe(struct kmem_cache *sc, gfp_t gfp)
+static struct stripe_head *alloc_stripe(struct kmem_cache *sc, gfp_t gfp,
+        int disks)
 {
         struct stripe_head *sh;
+        int i;
 
         sh = kmem_cache_zalloc(sc, gfp);
         if (sh) {
@@ -1989,6 +2001,17 @@ static struct stripe_head *alloc_stripe(struct kmem_cache *sc, gfp_t gfp)
                 INIT_LIST_HEAD(&sh->batch_list);
                 INIT_LIST_HEAD(&sh->lru);
                 atomic_set(&sh->count, 1);
+                for (i = 0; i < disks; i++) {
+                        struct r5dev *dev = &sh->dev[i];
+
+                        bio_init(&dev->req);
+                        dev->req.bi_io_vec = &dev->vec;
+                        dev->req.bi_max_vecs = 1;
+
+                        bio_init(&dev->rreq);
+                        dev->rreq.bi_io_vec = &dev->rvec;
+                        dev->rreq.bi_max_vecs = 1;
+                }
         }
         return sh;
 }
@@ -1996,7 +2019,7 @@ static int grow_one_stripe(struct r5conf *conf, gfp_t gfp)
 {
         struct stripe_head *sh;
 
-        sh = alloc_stripe(conf->slab_cache, gfp);
+        sh = alloc_stripe(conf->slab_cache, gfp, conf->pool_size);
         if (!sh)
                 return 0;
 
@@ -2167,7 +2190,7 @@ static int resize_stripes(struct r5conf *conf, int newsize)
         mutex_lock(&conf->cache_size_mutex);
 
         for (i = conf->max_nr_stripes; i; i--) {
-                nsh = alloc_stripe(sc, GFP_KERNEL);
+                nsh = alloc_stripe(sc, GFP_KERNEL, newsize);
                 if (!nsh)
                         break;
 
@@ -2299,6 +2322,7 @@ static void raid5_end_read_request(struct bio * bi)
                 (unsigned long long)sh->sector, i, atomic_read(&sh->count),
                 bi->bi_error);
         if (i == disks) {
+                bio_reset(bi);
                 BUG();
                 return;
         }
@@ -2399,6 +2423,7 @@ static void raid5_end_read_request(struct bio * bi)
                 }
         }
         rdev_dec_pending(rdev, conf->mddev);
+        bio_reset(bi);
         clear_bit(R5_LOCKED, &sh->dev[i].flags);
         set_bit(STRIPE_HANDLE, &sh->state);
         raid5_release_stripe(sh);
@@ -2436,6 +2461,7 @@ static void raid5_end_write_request(struct bio *bi)
                 (unsigned long long)sh->sector, i, atomic_read(&sh->count),
                 bi->bi_error);
         if (i == disks) {
+                bio_reset(bi);
                 BUG();
                 return;
         }
@@ -2472,6 +2498,7 @@ static void raid5_end_write_request(struct bio *bi)
         if (sh->batch_head && bi->bi_error && !replacement)
                 set_bit(STRIPE_BATCH_ERR, &sh->batch_head->state);
 
+        bio_reset(bi);
         if (!test_and_clear_bit(R5_DOUBLE_LOCKED, &sh->dev[i].flags))
                 clear_bit(R5_LOCKED, &sh->dev[i].flags);
         set_bit(STRIPE_HANDLE, &sh->state);
@@ -2485,16 +2512,6 @@ static void raid5_build_block(struct stripe_head *sh, int i, int previous)
 {
         struct r5dev *dev = &sh->dev[i];
 
-        bio_init(&dev->req);
-        dev->req.bi_io_vec = &dev->vec;
-        dev->req.bi_max_vecs = 1;
-        dev->req.bi_private = sh;
-
-        bio_init(&dev->rreq);
-        dev->rreq.bi_io_vec = &dev->rvec;
-        dev->rreq.bi_max_vecs = 1;
-        dev->rreq.bi_private = sh;
-
         dev->flags = 0;
         dev->sector = raid5_compute_blocknr(sh, i, previous);
 }
@@ -4628,7 +4645,9 @@ finish:
         }
 
         if (!bio_list_empty(&s.return_bi)) {
-                if (test_bit(MD_CHANGE_PENDING, &conf->mddev->flags)) {
+                if (test_bit(MD_CHANGE_PENDING, &conf->mddev->flags) &&
+                                (s.failed <= conf->max_degraded ||
+                                        conf->mddev->external == 0)) {
                         spin_lock_irq(&conf->device_lock);
                         bio_list_merge(&conf->return_bi, &s.return_bi);
                         spin_unlock_irq(&conf->device_lock);
@@ -6620,6 +6639,16 @@ static struct r5conf *setup_conf(struct mddev *mddev)
         }
 
         conf->min_nr_stripes = NR_STRIPES;
+        if (mddev->reshape_position != MaxSector) {
+                int stripes = max_t(int,
+                        ((mddev->chunk_sectors << 9) / STRIPE_SIZE) * 4,
+                        ((mddev->new_chunk_sectors << 9) / STRIPE_SIZE) * 4);
+                conf->min_nr_stripes = max(NR_STRIPES, stripes);
+                if (conf->min_nr_stripes != NR_STRIPES)
+                        printk(KERN_INFO
+                                "md/raid:%s: force stripe size %d for reshape\n",
+                                mdname(mddev), conf->min_nr_stripes);
+        }
         memory = conf->min_nr_stripes * (sizeof(struct stripe_head) +
                  max_disks * ((sizeof(struct bio) + PAGE_SIZE))) / 1024;
         atomic_set(&conf->empty_inactive_list_nr, NR_STRIPE_HASH_LOCKS);
@@ -6826,11 +6855,14 @@ static int raid5_run(struct mddev *mddev)
         if (IS_ERR(conf))
                 return PTR_ERR(conf);
 
-        if (test_bit(MD_HAS_JOURNAL, &mddev->flags) && !journal_dev) {
-                printk(KERN_ERR "md/raid:%s: journal disk is missing, force array readonly\n",
-                       mdname(mddev));
-                mddev->ro = 1;
-                set_disk_ro(mddev->gendisk, 1);
+        if (test_bit(MD_HAS_JOURNAL, &mddev->flags)) {
+                if (!journal_dev) {
+                        pr_err("md/raid:%s: journal disk is missing, force array readonly\n",
+                               mdname(mddev));
+                        mddev->ro = 1;
+                        set_disk_ro(mddev->gendisk, 1);
+                } else if (mddev->recovery_cp == MaxSector)
+                        set_bit(MD_JOURNAL_CLEAN, &mddev->flags);
         }
 
         conf->min_offset_diff = min_offset_diff;
diff --git a/drivers/media/cec-edid.c b/drivers/media/cec-edid.c
index 70018247bdda..5719b991e340 100644
--- a/drivers/media/cec-edid.c
+++ b/drivers/media/cec-edid.c
@@ -70,7 +70,10 @@ static unsigned int cec_get_edid_spa_location(const u8 *edid, unsigned int size)
                                 u8 tag = edid[i] >> 5;
                                 u8 len = edid[i] & 0x1f;
 
-                                if (tag == 3 && len >= 5 && i + len <= end)
+                                if (tag == 3 && len >= 5 && i + len <= end &&
+                                    edid[i + 1] == 0x03 &&
+                                    edid[i + 2] == 0x0c &&
+                                    edid[i + 3] == 0x00)
                                         return i + 4;
                                 i += len + 1;
                         } while (i < end);
diff --git a/drivers/media/pci/cx23885/cx23885-417.c b/drivers/media/pci/cx23885/cx23885-417.c
index efec2d1a7afd..4d080da7afaf 100644
--- a/drivers/media/pci/cx23885/cx23885-417.c
+++ b/drivers/media/pci/cx23885/cx23885-417.c
@@ -1552,6 +1552,7 @@ int cx23885_417_register(struct cx23885_dev *dev)
         q->mem_ops = &vb2_dma_sg_memops;
         q->timestamp_flags = V4L2_BUF_FLAG_TIMESTAMP_MONOTONIC;
         q->lock = &dev->lock;
+        q->dev = &dev->pci->dev;
 
         err = vb2_queue_init(q);
         if (err < 0)
diff --git a/drivers/media/pci/saa7134/saa7134-dvb.c b/drivers/media/pci/saa7134/saa7134-dvb.c
index db987e5b93eb..59a4b5f7724e 100644
--- a/drivers/media/pci/saa7134/saa7134-dvb.c
+++ b/drivers/media/pci/saa7134/saa7134-dvb.c
@@ -1238,6 +1238,7 @@ static int dvb_init(struct saa7134_dev *dev)
         q->buf_struct_size = sizeof(struct saa7134_buf);
         q->timestamp_flags = V4L2_BUF_FLAG_TIMESTAMP_MONOTONIC;
         q->lock = &dev->lock;
+        q->dev = &dev->pci->dev;
         ret = vb2_queue_init(q);
         if (ret) {
                 vb2_dvb_dealloc_frontends(&dev->frontends);
diff --git a/drivers/media/pci/saa7134/saa7134-empress.c b/drivers/media/pci/saa7134/saa7134-empress.c
index ca417a454d67..791a5161809b 100644
--- a/drivers/media/pci/saa7134/saa7134-empress.c
+++ b/drivers/media/pci/saa7134/saa7134-empress.c
@@ -295,6 +295,7 @@ static int empress_init(struct saa7134_dev *dev)
         q->buf_struct_size = sizeof(struct saa7134_buf);
         q->timestamp_flags = V4L2_BUF_FLAG_TIMESTAMP_MONOTONIC;
         q->lock = &dev->lock;
+        q->dev = &dev->pci->dev;
         err = vb2_queue_init(q);
         if (err)
                 return err;
diff --git a/drivers/media/platform/Kconfig b/drivers/media/platform/Kconfig
index f25344bc7912..552b635cfce7 100644
--- a/drivers/media/platform/Kconfig
+++ b/drivers/media/platform/Kconfig
@@ -169,7 +169,7 @@ config VIDEO_MEDIATEK_VPU
 config VIDEO_MEDIATEK_VCODEC
         tristate "Mediatek Video Codec driver"
         depends on MTK_IOMMU || COMPILE_TEST
-        depends on VIDEO_DEV && VIDEO_V4L2
+        depends on VIDEO_DEV && VIDEO_V4L2 && HAS_DMA
         depends on ARCH_MEDIATEK || COMPILE_TEST
         select VIDEOBUF2_DMA_CONTIG
         select V4L2_MEM2MEM_DEV
diff --git a/drivers/media/platform/mtk-vcodec/mtk_vcodec_drv.h b/drivers/media/platform/mtk-vcodec/mtk_vcodec_drv.h
index 94f0a425be42..3a8e6958adae 100644
--- a/drivers/media/platform/mtk-vcodec/mtk_vcodec_drv.h
+++ b/drivers/media/platform/mtk-vcodec/mtk_vcodec_drv.h
@@ -23,7 +23,6 @@
 #include <media/v4l2-ioctl.h>
 #include <media/videobuf2-core.h>
 
-#include "mtk_vcodec_util.h"
 
 #define MTK_VCODEC_DRV_NAME     "mtk_vcodec_drv"
 #define MTK_VCODEC_ENC_NAME     "mtk-vcodec-enc"
diff --git a/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc.c b/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc.c
index 3ed3f2d31df5..2c5719ac23b2 100644
--- a/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc.c
+++ b/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc.c
@@ -487,7 +487,6 @@ static int vidioc_venc_s_fmt_out(struct file *file, void *priv,
         struct mtk_q_data *q_data;
         int ret, i;
         struct mtk_video_fmt *fmt;
-        unsigned int pitch_w_div16;
         struct v4l2_pix_format_mplane *pix_fmt_mp = &f->fmt.pix_mp;
 
         vq = v4l2_m2m_get_vq(ctx->m2m_ctx, f->type);
@@ -530,15 +529,6 @@ static int vidioc_venc_s_fmt_out(struct file *file, void *priv,
         q_data->coded_width = f->fmt.pix_mp.width;
         q_data->coded_height = f->fmt.pix_mp.height;
 
-        pitch_w_div16 = DIV_ROUND_UP(q_data->visible_width, 16);
-        if (pitch_w_div16 % 8 != 0) {
-                /* Adjust returned width/height, so application could correctly
-                 * allocate hw required memory
-                 */
-                q_data->visible_height += 32;
-                vidioc_try_fmt(f, q_data->fmt);
-        }
-
         q_data->field = f->fmt.pix_mp.field;
         ctx->colorspace = f->fmt.pix_mp.colorspace;
         ctx->ycbcr_enc = f->fmt.pix_mp.ycbcr_enc;
@@ -878,7 +868,8 @@ static int mtk_venc_encode_header(void *priv)
 {
         struct mtk_vcodec_ctx *ctx = priv;
         int ret;
-        struct vb2_buffer *dst_buf;
+        struct vb2_buffer *src_buf, *dst_buf;
+        struct vb2_v4l2_buffer *dst_vb2_v4l2, *src_vb2_v4l2;
         struct mtk_vcodec_mem bs_buf;
         struct venc_done_result enc_result;
 
@@ -911,6 +902,15 @@ static int mtk_venc_encode_header(void *priv)
                 mtk_v4l2_err("venc_if_encode failed=%d", ret);
                 return -EINVAL;
         }
+        src_buf = v4l2_m2m_next_src_buf(ctx->m2m_ctx);
+        if (src_buf) {
+                src_vb2_v4l2 = to_vb2_v4l2_buffer(src_buf);
+                dst_vb2_v4l2 = to_vb2_v4l2_buffer(dst_buf);
+                dst_buf->timestamp = src_buf->timestamp;
+                dst_vb2_v4l2->timecode = src_vb2_v4l2->timecode;
+        } else {
+                mtk_v4l2_err("No timestamp for the header buffer.");
+        }
 
         ctx->state = MTK_STATE_HEADER;
         dst_buf->planes[0].bytesused = enc_result.bs_size;
@@ -1003,7 +1003,7 @@ static void mtk_venc_worker(struct work_struct *work)
         struct mtk_vcodec_mem bs_buf;
         struct venc_done_result enc_result;
         int ret, i;
-        struct vb2_v4l2_buffer *vb2_v4l2;
+        struct vb2_v4l2_buffer *dst_vb2_v4l2, *src_vb2_v4l2;
 
         /* check dst_buf, dst_buf may be removed in device_run
          * to stored encdoe header so we need check dst_buf and
@@ -1043,9 +1043,14 @@ static void mtk_venc_worker(struct work_struct *work)
         ret = venc_if_encode(ctx, VENC_START_OPT_ENCODE_FRAME,
                              &frm_buf, &bs_buf, &enc_result);
 
-        vb2_v4l2 = container_of(dst_buf, struct vb2_v4l2_buffer, vb2_buf);
+        src_vb2_v4l2 = to_vb2_v4l2_buffer(src_buf);
+        dst_vb2_v4l2 = to_vb2_v4l2_buffer(dst_buf);
+
+        dst_buf->timestamp = src_buf->timestamp;
+        dst_vb2_v4l2->timecode = src_vb2_v4l2->timecode;
+
         if (enc_result.is_key_frm)
-                vb2_v4l2->flags |= V4L2_BUF_FLAG_KEYFRAME;
+                dst_vb2_v4l2->flags |= V4L2_BUF_FLAG_KEYFRAME;
 
         if (ret) {
                 v4l2_m2m_buf_done(to_vb2_v4l2_buffer(src_buf),
@@ -1217,7 +1222,7 @@ int mtk_vcodec_enc_ctrls_setup(struct mtk_vcodec_ctx *ctx)
                         0, V4L2_MPEG_VIDEO_HEADER_MODE_SEPARATE);
         v4l2_ctrl_new_std_menu(handler, ops, V4L2_CID_MPEG_VIDEO_H264_PROFILE,
                         V4L2_MPEG_VIDEO_H264_PROFILE_HIGH,
-                        0, V4L2_MPEG_VIDEO_H264_PROFILE_MAIN);
+                        0, V4L2_MPEG_VIDEO_H264_PROFILE_HIGH);
         v4l2_ctrl_new_std_menu(handler, ops, V4L2_CID_MPEG_VIDEO_H264_LEVEL,
                         V4L2_MPEG_VIDEO_H264_LEVEL_4_2,
                         0, V4L2_MPEG_VIDEO_H264_LEVEL_4_0);
@@ -1288,5 +1293,10 @@ int mtk_venc_lock(struct mtk_vcodec_ctx *ctx)
 
 void mtk_vcodec_enc_release(struct mtk_vcodec_ctx *ctx)
 {
-        venc_if_deinit(ctx);
+        int ret = venc_if_deinit(ctx);
+
+        if (ret)
+                mtk_v4l2_err("venc_if_deinit failed=%d", ret);
+
+        ctx->state = MTK_STATE_FREE;
 }
diff --git a/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_drv.c b/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_drv.c
index c7806ecda2dd..5cd2151431bf 100644
--- a/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_drv.c
+++ b/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_drv.c
@@ -218,11 +218,15 @@ static int fops_vcodec_release(struct file *file)
         mtk_v4l2_debug(1, "[%d] encoder", ctx->id);
         mutex_lock(&dev->dev_mutex);
 
+        /*
+         * Call v4l2_m2m_ctx_release to make sure the worker thread is not
+         * running after venc_if_deinit.
+         */
+        v4l2_m2m_ctx_release(ctx->m2m_ctx);
         mtk_vcodec_enc_release(ctx);
         v4l2_fh_del(&ctx->fh);
         v4l2_fh_exit(&ctx->fh);
         v4l2_ctrl_handler_free(&ctx->ctrl_hdl);
-        v4l2_m2m_ctx_release(ctx->m2m_ctx);
 
         list_del_init(&ctx->list);
         dev->num_instances--;
diff --git a/drivers/media/platform/mtk-vcodec/mtk_vcodec_intr.h b/drivers/media/platform/mtk-vcodec/mtk_vcodec_intr.h
index 33e890f5aa9c..12131855b46a 100644
--- a/drivers/media/platform/mtk-vcodec/mtk_vcodec_intr.h
+++ b/drivers/media/platform/mtk-vcodec/mtk_vcodec_intr.h
@@ -16,7 +16,6 @@
 #define _MTK_VCODEC_INTR_H_
 
 #define MTK_INST_IRQ_RECEIVED           0x1
-#define MTK_INST_WORK_THREAD_ABORT_DONE 0x2
 
 struct mtk_vcodec_ctx;
 
diff --git a/drivers/media/platform/mtk-vcodec/venc/venc_h264_if.c b/drivers/media/platform/mtk-vcodec/venc/venc_h264_if.c
index 9a600525b3c1..63d4be4ff327 100644
--- a/drivers/media/platform/mtk-vcodec/venc/venc_h264_if.c
+++ b/drivers/media/platform/mtk-vcodec/venc/venc_h264_if.c
@@ -61,6 +61,8 @@ enum venc_h264_bs_mode {
 
 /*
  * struct venc_h264_vpu_config - Structure for h264 encoder configuration
+ *                               AP-W/R : AP is writer/reader on this item
+ *                               VPU-W/R: VPU is write/reader on this item
  * @input_fourcc: input fourcc
  * @bitrate: target bitrate (in bps)
  * @pic_w: picture width. Picture size is visible stream resolution, in pixels,
@@ -94,13 +96,13 @@ struct venc_h264_vpu_config {
 
 /*
  * struct venc_h264_vpu_buf - Structure for buffer information
- * @align: buffer alignment (in bytes)
+ *                            AP-W/R : AP is writer/reader on this item
+ *                            VPU-W/R: VPU is write/reader on this item
  * @iova: IO virtual address
  * @vpua: VPU side memory addr which is used by RC_CODE
  * @size: buffer size (in bytes)
  */
 struct venc_h264_vpu_buf {
-        u32 align;
         u32 iova;
         u32 vpua;
         u32 size;
@@ -108,6 +110,8 @@ struct venc_h264_vpu_buf {
 
 /*
  * struct venc_h264_vsi - Structure for VPU driver control and info share
+ *                        AP-W/R : AP is writer/reader on this item
+ *                        VPU-W/R: VPU is write/reader on this item
  * This structure is allocated in VPU side and shared to AP side.
  * @config: h264 encoder configuration
  * @work_bufs: working buffer information in VPU side
@@ -150,12 +154,6 @@ struct venc_h264_inst {
         struct mtk_vcodec_ctx *ctx;
 };
 
-static inline void h264_write_reg(struct venc_h264_inst *inst, u32 addr,
-                                  u32 val)
-{
-        writel(val, inst->hw_base + addr);
-}
-
 static inline u32 h264_read_reg(struct venc_h264_inst *inst, u32 addr)
 {
         return readl(inst->hw_base + addr);
@@ -214,6 +212,8 @@ static unsigned int h264_get_level(struct venc_h264_inst *inst,
                 return 40;
         case V4L2_MPEG_VIDEO_H264_LEVEL_4_1:
                 return 41;
+        case V4L2_MPEG_VIDEO_H264_LEVEL_4_2:
+                return 42;
         default:
                 mtk_vcodec_debug(inst, "unsupported level %d", level);
                 return 31;
diff --git a/drivers/media/platform/mtk-vcodec/venc/venc_vp8_if.c b/drivers/media/platform/mtk-vcodec/venc/venc_vp8_if.c
index 60bbcd2a0510..6d9758479f9a 100644
--- a/drivers/media/platform/mtk-vcodec/venc/venc_vp8_if.c
+++ b/drivers/media/platform/mtk-vcodec/venc/venc_vp8_if.c
@@ -56,6 +56,8 @@ enum venc_vp8_vpu_work_buf {
 
 /*
  * struct venc_vp8_vpu_config - Structure for vp8 encoder configuration
+ *                              AP-W/R : AP is writer/reader on this item
+ *                              VPU-W/R: VPU is write/reader on this item
  * @input_fourcc: input fourcc
  * @bitrate: target bitrate (in bps)
  * @pic_w: picture width. Picture size is visible stream resolution, in pixels,
@@ -83,14 +85,14 @@ struct venc_vp8_vpu_config {
 };
 
 /*
- * struct venc_vp8_vpu_buf -Structure for buffer information
- * @align: buffer alignment (in bytes)
+ * struct venc_vp8_vpu_buf - Structure for buffer information
+ *                           AP-W/R : AP is writer/reader on this item
+ *                           VPU-W/R: VPU is write/reader on this item
  * @iova: IO virtual address
  * @vpua: VPU side memory addr which is used by RC_CODE
  * @size: buffer size (in bytes)
  */
 struct venc_vp8_vpu_buf {
-        u32 align;
         u32 iova;
         u32 vpua;
         u32 size;
@@ -98,6 +100,8 @@ struct venc_vp8_vpu_buf {
 
 /*
  * struct venc_vp8_vsi - Structure for VPU driver control and info share
+ *                       AP-W/R : AP is writer/reader on this item
+ *                       VPU-W/R: VPU is write/reader on this item
  * This structure is allocated in VPU side and shared to AP side.
  * @config: vp8 encoder configuration
  * @work_bufs: working buffer information in VPU side
@@ -138,12 +142,6 @@ struct venc_vp8_inst {
         struct mtk_vcodec_ctx *ctx;
 };
 
-static inline void vp8_enc_write_reg(struct venc_vp8_inst *inst, u32 addr,
-                                     u32 val)
-{
-        writel(val, inst->hw_base + addr);
-}
-
 static inline u32 vp8_enc_read_reg(struct venc_vp8_inst *inst, u32 addr)
 {
         return readl(inst->hw_base + addr);
diff --git a/drivers/media/platform/rcar-fcp.c b/drivers/media/platform/rcar-fcp.c
index 6a7bcc3028b1..bc50c69ee0c5 100644
--- a/drivers/media/platform/rcar-fcp.c
+++ b/drivers/media/platform/rcar-fcp.c
@@ -99,10 +99,16 @@ EXPORT_SYMBOL_GPL(rcar_fcp_put);
  */
 int rcar_fcp_enable(struct rcar_fcp_device *fcp)
 {
+        int error;
+
         if (!fcp)
                 return 0;
 
-        return pm_runtime_get_sync(fcp->dev);
+        error = pm_runtime_get_sync(fcp->dev);
+        if (error < 0)
+                return error;
+
+        return 0;
 }
 EXPORT_SYMBOL_GPL(rcar_fcp_enable);
 
diff --git a/drivers/memory/omap-gpmc.c b/drivers/memory/omap-gpmc.c
index 869c83fb3c5d..f00f3e742265 100644
--- a/drivers/memory/omap-gpmc.c
+++ b/drivers/memory/omap-gpmc.c
@@ -2185,7 +2185,7 @@ static int gpmc_probe_dt(struct platform_device *pdev)
         return 0;
 }
 
-static int gpmc_probe_dt_children(struct platform_device *pdev)
+static void gpmc_probe_dt_children(struct platform_device *pdev)
 {
         int ret;
         struct device_node *child;
@@ -2200,11 +2200,11 @@ static int gpmc_probe_dt_children(struct platform_device *pdev)
                 else
                         ret = gpmc_probe_generic_child(pdev, child);
 
-                if (ret)
-                        return ret;
+                if (ret) {
+                        dev_err(&pdev->dev, "failed to probe DT child '%s': %d\n",
+                                child->name, ret);
+                }
         }
-
-        return 0;
 }
 #else
 static int gpmc_probe_dt(struct platform_device *pdev)
@@ -2212,9 +2212,8 @@ static int gpmc_probe_dt(struct platform_device *pdev)
         return 0;
 }
 
-static int gpmc_probe_dt_children(struct platform_device *pdev)
+static void gpmc_probe_dt_children(struct platform_device *pdev)
 {
-        return 0;
 }
 #endif /* CONFIG_OF */
 
@@ -2369,16 +2368,10 @@ static int gpmc_probe(struct platform_device *pdev)
                 goto setup_irq_failed;
         }
 
-        rc = gpmc_probe_dt_children(pdev);
-        if (rc < 0) {
-                dev_err(gpmc->dev, "failed to probe DT children\n");
-                goto dt_children_failed;
-        }
+        gpmc_probe_dt_children(pdev);
 
         return 0;
 
-dt_children_failed:
-        gpmc_free_irq(gpmc);
 setup_irq_failed:
         gpmc_gpio_exit(gpmc);
 gpio_init_failed:
diff --git a/drivers/misc/Kconfig b/drivers/misc/Kconfig
index a216b4667742..d00252828966 100644
--- a/drivers/misc/Kconfig
+++ b/drivers/misc/Kconfig
@@ -345,16 +345,6 @@ config SENSORS_TSL2550
           This driver can also be built as a module.  If so, the module
           will be called tsl2550.
 
-config SENSORS_BH1780
-        tristate "ROHM BH1780GLI ambient light sensor"
-        depends on I2C && SYSFS
-        help
-          If you say yes here you get support for the ROHM BH1780GLI
-          ambient light sensor.
-
-          This driver can also be built as a module.  If so, the module
-          will be called bh1780gli.
-
 config SENSORS_BH1770
          tristate "BH1770GLC / SFH7770 combined ALS - Proximity sensor"
          depends on I2C
diff --git a/drivers/misc/Makefile b/drivers/misc/Makefile
index 7410c6d9a34d..fb32516ddfe2 100644
--- a/drivers/misc/Makefile
+++ b/drivers/misc/Makefile
@@ -19,7 +19,6 @@ obj-$(CONFIG_TIFM_CORE)       	+= tifm_core.o
 obj-$(CONFIG_TIFM_7XX1)         += tifm_7xx1.o
 obj-$(CONFIG_PHANTOM)           += phantom.o
 obj-$(CONFIG_QCOM_COINCELL)     += qcom-coincell.o
-obj-$(CONFIG_SENSORS_BH1780)    += bh1780gli.o
 obj-$(CONFIG_SENSORS_BH1770)    += bh1770glc.o
 obj-$(CONFIG_SENSORS_APDS990X)  += apds990x.o
 obj-$(CONFIG_SGI_IOC4)          += ioc4.o
diff --git a/drivers/misc/bh1780gli.c b/drivers/misc/bh1780gli.c
deleted file mode 100644
index 7f90ce5a569a..000000000000
--- a/drivers/misc/bh1780gli.c
+++ /dev/null
@@ -1,259 +0,0 @@
-/*
- * bh1780gli.c
- * ROHM Ambient Light Sensor Driver
- *
- * Copyright (C) 2010 Texas Instruments
- * Author: Hemanth V <hemanthv@ti.com>
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License version 2 as published by
- * the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-#include <linux/i2c.h>
-#include <linux/slab.h>
-#include <linux/mutex.h>
-#include <linux/platform_device.h>
-#include <linux/delay.h>
-#include <linux/module.h>
-#include <linux/of.h>
-
-#define BH1780_REG_CONTROL      0x80
-#define BH1780_REG_PARTID       0x8A
-#define BH1780_REG_MANFID       0x8B
-#define BH1780_REG_DLOW 0x8C
-#define BH1780_REG_DHIGH        0x8D
-
-#define BH1780_REVMASK          (0xf)
-#define BH1780_POWMASK          (0x3)
-#define BH1780_POFF             (0x0)
-#define BH1780_PON              (0x3)
-
-/* power on settling time in ms */
-#define BH1780_PON_DELAY        2
-
-struct bh1780_data {
-        struct i2c_client *client;
-        int power_state;
-        /* lock for sysfs operations */
-        struct mutex lock;
-};
-
-static int bh1780_write(struct bh1780_data *ddata, u8 reg, u8 val, char *msg)
-{
-        int ret = i2c_smbus_write_byte_data(ddata->client, reg, val);
-        if (ret < 0)
-                dev_err(&ddata->client->dev,
-                        "i2c_smbus_write_byte_data failed error %d Register (%s)\n",
-                        ret, msg);
-        return ret;
-}
-
-static int bh1780_read(struct bh1780_data *ddata, u8 reg, char *msg)
-{
-        int ret = i2c_smbus_read_byte_data(ddata->client, reg);
-        if (ret < 0)
-                dev_err(&ddata->client->dev,
-                        "i2c_smbus_read_byte_data failed error %d Register (%s)\n",
-                        ret, msg);
-        return ret;
-}
-
-static ssize_t bh1780_show_lux(struct device *dev,
-                                struct device_attribute *attr, char *buf)
-{
-        struct platform_device *pdev = to_platform_device(dev);
-        struct bh1780_data *ddata = platform_get_drvdata(pdev);
-        int lsb, msb;
-
-        lsb = bh1780_read(ddata, BH1780_REG_DLOW, "DLOW");
-        if (lsb < 0)
-                return lsb;
-
-        msb = bh1780_read(ddata, BH1780_REG_DHIGH, "DHIGH");
-        if (msb < 0)
-                return msb;
-
-        return sprintf(buf, "%d\n", (msb << 8) | lsb);
-}
-
-static ssize_t bh1780_show_power_state(struct device *dev,
-                                        struct device_attribute *attr,
-                                        char *buf)
-{
-        struct platform_device *pdev = to_platform_device(dev);
-        struct bh1780_data *ddata = platform_get_drvdata(pdev);
-        int state;
-
-        state = bh1780_read(ddata, BH1780_REG_CONTROL, "CONTROL");
-        if (state < 0)
-                return state;
-
-        return sprintf(buf, "%d\n", state & BH1780_POWMASK);
-}
-
-static ssize_t bh1780_store_power_state(struct device *dev,
-                                        struct device_attribute *attr,
-                                        const char *buf, size_t count)
-{
-        struct platform_device *pdev = to_platform_device(dev);
-        struct bh1780_data *ddata = platform_get_drvdata(pdev);
-        unsigned long val;
-        int error;
-
-        error = kstrtoul(buf, 0, &val);
-        if (error)
-                return error;
-
-        if (val < BH1780_POFF || val > BH1780_PON)
-                return -EINVAL;
-
-        mutex_lock(&ddata->lock);
-
-        error = bh1780_write(ddata, BH1780_REG_CONTROL, val, "CONTROL");
-        if (error < 0) {
-                mutex_unlock(&ddata->lock);
-                return error;
-        }
-
-        msleep(BH1780_PON_DELAY);
-        ddata->power_state = val;
-        mutex_unlock(&ddata->lock);
-
-        return count;
-}
-
-static DEVICE_ATTR(lux, S_IRUGO, bh1780_show_lux, NULL);
-
-static DEVICE_ATTR(power_state, S_IWUSR | S_IRUGO,
-                bh1780_show_power_state, bh1780_store_power_state);
-
-static struct attribute *bh1780_attributes[] = {
-        &dev_attr_power_state.attr,
-        &dev_attr_lux.attr,
-        NULL
-};
-
-static const struct attribute_group bh1780_attr_group = {
-        .attrs = bh1780_attributes,
-};
-
-static int bh1780_probe(struct i2c_client *client,
-                                                const struct i2c_device_id *id)
-{
-        int ret;
-        struct bh1780_data *ddata;
-        struct i2c_adapter *adapter = to_i2c_adapter(client->dev.parent);
-
-        if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_BYTE))
-                return -EIO;
-
-        ddata = devm_kzalloc(&client->dev, sizeof(struct bh1780_data),
-                             GFP_KERNEL);
-        if (ddata == NULL)
-                return -ENOMEM;
-
-        ddata->client = client;
-        i2c_set_clientdata(client, ddata);
-
-        ret = bh1780_read(ddata, BH1780_REG_PARTID, "PART ID");
-        if (ret < 0)
-                return ret;
-
-        dev_info(&client->dev, "Ambient Light Sensor, Rev : %d\n",
-                        (ret & BH1780_REVMASK));
-
-        mutex_init(&ddata->lock);
-
-        return sysfs_create_group(&client->dev.kobj, &bh1780_attr_group);
-}
-
-static int bh1780_remove(struct i2c_client *client)
-{
-        sysfs_remove_group(&client->dev.kobj, &bh1780_attr_group);
-
-        return 0;
-}
-
-#ifdef CONFIG_PM_SLEEP
-static int bh1780_suspend(struct device *dev)
-{
-        struct bh1780_data *ddata;
-        int state, ret;
-        struct i2c_client *client = to_i2c_client(dev);
-
-        ddata = i2c_get_clientdata(client);
-        state = bh1780_read(ddata, BH1780_REG_CONTROL, "CONTROL");
-        if (state < 0)
-                return state;
-
-        ddata->power_state = state & BH1780_POWMASK;
-
-        ret = bh1780_write(ddata, BH1780_REG_CONTROL, BH1780_POFF,
-                                "CONTROL");
-
-        if (ret < 0)
-                return ret;
-
-        return 0;
-}
-
-static int bh1780_resume(struct device *dev)
-{
-        struct bh1780_data *ddata;
-        int state, ret;
-        struct i2c_client *client = to_i2c_client(dev);
-
-        ddata = i2c_get_clientdata(client);
-        state = ddata->power_state;
-        ret = bh1780_write(ddata, BH1780_REG_CONTROL, state,
-                                "CONTROL");
-
-        if (ret < 0)
-                return ret;
-
-        return 0;
-}
-#endif /* CONFIG_PM_SLEEP */
-
-static SIMPLE_DEV_PM_OPS(bh1780_pm, bh1780_suspend, bh1780_resume);
-
-static const struct i2c_device_id bh1780_id[] = {
-        { "bh1780", 0 },
-        { },
-};
-
-MODULE_DEVICE_TABLE(i2c, bh1780_id);
-
-#ifdef CONFIG_OF
-static const struct of_device_id of_bh1780_match[] = {
-        { .compatible = "rohm,bh1780gli", },
-        {},
-};
-
-MODULE_DEVICE_TABLE(of, of_bh1780_match);
-#endif
-
-static struct i2c_driver bh1780_driver = {
-        .probe          = bh1780_probe,
-        .remove         = bh1780_remove,
-        .id_table       = bh1780_id,
-        .driver = {
-                .name = "bh1780",
-                .pm     = &bh1780_pm,
-                .of_match_table = of_match_ptr(of_bh1780_match),
-        },
-};
-
-module_i2c_driver(bh1780_driver);
-
-MODULE_DESCRIPTION("BH1780GLI Ambient Light Sensor Driver");
-MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Hemanth V <hemanthv@ti.com>");
diff --git a/drivers/misc/cxl/vphb.c b/drivers/misc/cxl/vphb.c
index 7ada5f1b7bb6..3519acebfdab 100644
--- a/drivers/misc/cxl/vphb.c
+++ b/drivers/misc/cxl/vphb.c
@@ -230,6 +230,11 @@ int cxl_pci_vphb_add(struct cxl_afu *afu)
         if (phb->bus == NULL)
                 return -ENXIO;
 
+        /* Set release hook on root bus */
+        pci_set_host_bridge_release(to_pci_host_bridge(phb->bus->bridge),
+                                    pcibios_free_controller_deferred,
+                                    (void *) phb);
+
         /* Claim resources. This might need some rework as well depending
          * whether we are doing probe-only or not, like assigning unassigned
          * resources etc...
@@ -256,7 +261,10 @@ void cxl_pci_vphb_remove(struct cxl_afu *afu)
         afu->phb = NULL;
 
         pci_remove_root_bus(phb->bus);
-        pcibios_free_controller(phb);
+        /*
+         * We don't free phb here - that's handled by
+         * pcibios_free_controller_deferred()
+         */
 }
 
 static bool _cxl_pci_is_vphb_device(struct pci_controller *phb)
diff --git a/drivers/misc/lkdtm_rodata.c b/drivers/misc/lkdtm_rodata.c
index 166b1db3969f..3564477b8c2d 100644
--- a/drivers/misc/lkdtm_rodata.c
+++ b/drivers/misc/lkdtm_rodata.c
@@ -4,7 +4,7 @@
  */
 #include "lkdtm.h"
 
-void lkdtm_rodata_do_nothing(void)
+void notrace lkdtm_rodata_do_nothing(void)
 {
         /* Does nothing. We just want an architecture agnostic "return". */
 }
diff --git a/drivers/misc/lkdtm_usercopy.c b/drivers/misc/lkdtm_usercopy.c
index 5525a204db93..1dd611423d8b 100644
--- a/drivers/misc/lkdtm_usercopy.c
+++ b/drivers/misc/lkdtm_usercopy.c
@@ -9,7 +9,15 @@
 #include <linux/uaccess.h>
 #include <asm/cacheflush.h>
 
-static size_t cache_size = 1024;
+/*
+ * Many of the tests here end up using const sizes, but those would
+ * normally be ignored by hardened usercopy, so force the compiler
+ * into choosing the non-const path to make sure we trigger the
+ * hardened usercopy checks by added "unconst" to all the const copies,
+ * and making sure "cache_size" isn't optimized into a const.
+ */
+static volatile size_t unconst = 0;
+static volatile size_t cache_size = 1024;
 static struct kmem_cache *bad_cache;
 
 static const unsigned char test_text[] = "This is a test.\n";
@@ -67,14 +75,14 @@ static noinline void do_usercopy_stack(bool to_user, bool bad_frame)
         if (to_user) {
                 pr_info("attempting good copy_to_user of local stack\n");
                 if (copy_to_user((void __user *)user_addr, good_stack,
-                                 sizeof(good_stack))) {
+                                 unconst + sizeof(good_stack))) {
                         pr_warn("copy_to_user failed unexpectedly?!\n");
                         goto free_user;
                 }
 
                 pr_info("attempting bad copy_to_user of distant stack\n");
                 if (copy_to_user((void __user *)user_addr, bad_stack,
-                                 sizeof(good_stack))) {
+                                 unconst + sizeof(good_stack))) {
                         pr_warn("copy_to_user failed, but lacked Oops\n");
                         goto free_user;
                 }
@@ -88,14 +96,14 @@ static noinline void do_usercopy_stack(bool to_user, bool bad_frame)
 
                 pr_info("attempting good copy_from_user of local stack\n");
                 if (copy_from_user(good_stack, (void __user *)user_addr,
-                                   sizeof(good_stack))) {
+                                   unconst + sizeof(good_stack))) {
                         pr_warn("copy_from_user failed unexpectedly?!\n");
                         goto free_user;
                 }
 
                 pr_info("attempting bad copy_from_user of distant stack\n");
                 if (copy_from_user(bad_stack, (void __user *)user_addr,
-                                   sizeof(good_stack))) {
+                                   unconst + sizeof(good_stack))) {
                         pr_warn("copy_from_user failed, but lacked Oops\n");
                         goto free_user;
                 }
@@ -109,7 +117,7 @@ static void do_usercopy_heap_size(bool to_user)
 {
         unsigned long user_addr;
         unsigned char *one, *two;
-        const size_t size = 1024;
+        size_t size = unconst + 1024;
 
         one = kmalloc(size, GFP_KERNEL);
         two = kmalloc(size, GFP_KERNEL);
@@ -285,13 +293,14 @@ void lkdtm_USERCOPY_KERNEL(void)
 
         pr_info("attempting good copy_to_user from kernel rodata\n");
         if (copy_to_user((void __user *)user_addr, test_text,
-                         sizeof(test_text))) {
+                         unconst + sizeof(test_text))) {
                 pr_warn("copy_to_user failed unexpectedly?!\n");
                 goto free_user;
         }
 
         pr_info("attempting bad copy_to_user from kernel text\n");
-        if (copy_to_user((void __user *)user_addr, vm_mmap, PAGE_SIZE)) {
+        if (copy_to_user((void __user *)user_addr, vm_mmap,
+                         unconst + PAGE_SIZE)) {
                 pr_warn("copy_to_user failed, but lacked Oops\n");
                 goto free_user;
         }
diff --git a/drivers/misc/mei/hw-me.c b/drivers/misc/mei/hw-me.c
index e2fb44cc5c37..dc3a854e02d3 100644
--- a/drivers/misc/mei/hw-me.c
+++ b/drivers/misc/mei/hw-me.c
@@ -1263,8 +1263,14 @@ static bool mei_me_fw_type_nm(struct pci_dev *pdev)
 static bool mei_me_fw_type_sps(struct pci_dev *pdev)
 {
         u32 reg;
-        /* Read ME FW Status check for SPS Firmware */
-        pci_read_config_dword(pdev, PCI_CFG_HFS_1, &reg);
+        unsigned int devfn;
+
+        /*
+         * Read ME FW Status register to check for SPS Firmware
+         * The SPS FW is only signaled in pci function 0
+         */
+        devfn = PCI_DEVFN(PCI_SLOT(pdev->devfn), 0);
+        pci_bus_read_config_dword(pdev->bus, devfn, PCI_CFG_HFS_1, &reg);
         trace_mei_pci_cfg_read(&pdev->dev, "PCI_CFG_HFS_1", PCI_CFG_HFS_1, reg);
         /* if bits [19:16] = 15, running SPS Firmware */
         return (reg & 0xf0000) == 0xf0000;
diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c
index 64e64da6da44..71cea9b296b2 100644
--- a/drivers/misc/mei/pci-me.c
+++ b/drivers/misc/mei/pci-me.c
@@ -85,8 +85,8 @@ static const struct pci_device_id mei_me_pci_tbl[] = {
 
         {MEI_PCI_DEVICE(MEI_DEV_ID_SPT, mei_me_pch8_cfg)},
         {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_2, mei_me_pch8_cfg)},
-        {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H, mei_me_pch8_cfg)},
-        {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H_2, mei_me_pch8_cfg)},
+        {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H, mei_me_pch8_sps_cfg)},
+        {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H_2, mei_me_pch8_sps_cfg)},
 
         {MEI_PCI_DEVICE(MEI_DEV_ID_BXT_M, mei_me_pch8_cfg)},
         {MEI_PCI_DEVICE(MEI_DEV_ID_APL_I, mei_me_pch8_cfg)},
diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c
index 48a5dd740f3b..2206d4477dbb 100644
--- a/drivers/mmc/card/block.c
+++ b/drivers/mmc/card/block.c
@@ -1726,6 +1726,7 @@ static u8 mmc_blk_prep_packed_list(struct mmc_queue *mq, struct request *req)
                         break;
 
                 if (req_op(next) == REQ_OP_DISCARD ||
+                    req_op(next) == REQ_OP_SECURE_ERASE ||
                     req_op(next) == REQ_OP_FLUSH)
                         break;
 
@@ -2150,6 +2151,7 @@ static int mmc_blk_issue_rq(struct mmc_queue *mq, struct request *req)
         struct mmc_card *card = md->queue.card;
         struct mmc_host *host = card->host;
         unsigned long flags;
+        bool req_is_special = mmc_req_is_special(req);
 
         if (req && !mq->mqrq_prev->req)
                 /* claim host only for the first request */
@@ -2190,8 +2192,7 @@ static int mmc_blk_issue_rq(struct mmc_queue *mq, struct request *req)
         }
 
 out:
-        if ((!req && !(mq->flags & MMC_QUEUE_NEW_REQUEST)) ||
-            mmc_req_is_special(req))
+        if ((!req && !(mq->flags & MMC_QUEUE_NEW_REQUEST)) || req_is_special)
                 /*
                  * Release host when there are no more requests
                  * and after special request(discard, flush) is done.
diff --git a/drivers/mmc/card/queue.c b/drivers/mmc/card/queue.c
index bf14642a576a..708057261b38 100644
--- a/drivers/mmc/card/queue.c
+++ b/drivers/mmc/card/queue.c
@@ -33,7 +33,8 @@ static int mmc_prep_request(struct request_queue *q, struct request *req)
         /*
          * We only like normal block requests and discards.
          */
-        if (req->cmd_type != REQ_TYPE_FS && req_op(req) != REQ_OP_DISCARD) {
+        if (req->cmd_type != REQ_TYPE_FS && req_op(req) != REQ_OP_DISCARD &&
+            req_op(req) != REQ_OP_SECURE_ERASE) {
                 blk_dump_rq_flags(req, "MMC bad request");
                 return BLKPREP_KILL;
         }
@@ -64,6 +65,8 @@ static int mmc_queue_thread(void *d)
                 spin_unlock_irq(q->queue_lock);
 
                 if (req || mq->mqrq_prev->req) {
+                        bool req_is_special = mmc_req_is_special(req);
+
                         set_current_state(TASK_RUNNING);
                         mq->issue_fn(mq, req);
                         cond_resched();
@@ -79,7 +82,7 @@ static int mmc_queue_thread(void *d)
                          * has been finished. Do not assign it to previous
                          * request.
                          */
-                        if (mmc_req_is_special(req))
+                        if (req_is_special)
                                 mq->mqrq_cur->req = NULL;
 
                         mq->mqrq_prev->brq.mrq.data = NULL;
diff --git a/drivers/mmc/card/queue.h b/drivers/mmc/card/queue.h
index d62531124d54..fee5e1271465 100644
--- a/drivers/mmc/card/queue.h
+++ b/drivers/mmc/card/queue.h
@@ -4,7 +4,9 @@
 static inline bool mmc_req_is_special(struct request *req)
 {
         return req &&
-                (req_op(req) == REQ_OP_FLUSH || req_op(req) == REQ_OP_DISCARD);
+                (req_op(req) == REQ_OP_FLUSH ||
+                 req_op(req) == REQ_OP_DISCARD ||
+                 req_op(req) == REQ_OP_SECURE_ERASE);
 }
 
 struct request;
diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c
index 32380d5d4f6b..767af2026f8b 100644
--- a/drivers/mmc/host/dw_mmc.c
+++ b/drivers/mmc/host/dw_mmc.c
@@ -1112,11 +1112,12 @@ static void dw_mci_setup_bus(struct dw_mci_slot *slot, bool force_clkinit)
 
                 div = (host->bus_hz != clock) ? DIV_ROUND_UP(div, 2) : 0;
 
-                dev_info(&slot->mmc->class_dev,
-                         "Bus speed (slot %d) = %dHz (slot req %dHz, actual %dHZ div = %d)\n",
-                         slot->id, host->bus_hz, clock,
-                         div ? ((host->bus_hz / div) >> 1) :
-                         host->bus_hz, div);
+                if (clock != slot->__clk_old || force_clkinit)
+                        dev_info(&slot->mmc->class_dev,
+                                 "Bus speed (slot %d) = %dHz (slot req %dHz, actual %dHZ div = %d)\n",
+                                 slot->id, host->bus_hz, clock,
+                                 div ? ((host->bus_hz / div) >> 1) :
+                                 host->bus_hz, div);
 
                 /* disable clock */
                 mci_writel(host, CLKENA, 0);
@@ -1139,6 +1140,9 @@ static void dw_mci_setup_bus(struct dw_mci_slot *slot, bool force_clkinit)
 
                 /* inform CIU */
                 mci_send_cmd(slot, sdmmc_cmd_bits, 0);
+
+                /* keep the last clock value that was requested from core */
+                slot->__clk_old = clock;
         }
 
         host->current_speed = clock;
diff --git a/drivers/mmc/host/dw_mmc.h b/drivers/mmc/host/dw_mmc.h
index 9e740bc232a8..e8cd2dec3263 100644
--- a/drivers/mmc/host/dw_mmc.h
+++ b/drivers/mmc/host/dw_mmc.h
@@ -249,6 +249,8 @@ extern int dw_mci_resume(struct dw_mci *host);
  * @queue_node: List node for placing this node in the @queue list of
  *      &struct dw_mci.
  * @clock: Clock rate configured by set_ios(). Protected by host->lock.
+ * @__clk_old: The last clock value that was requested from core.
+ *      Keeping track of this helps us to avoid spamming the console.
  * @flags: Random state bits associated with the slot.
  * @id: Number of this slot.
  * @sdio_id: Number of this slot in the SDIO interrupt registers.
@@ -263,6 +265,7 @@ struct dw_mci_slot {
         struct list_head        queue_node;
 
         unsigned int            clock;
+        unsigned int            __clk_old;
 
         unsigned long           flags;
 #define DW_MMC_CARD_PRESENT     0
diff --git a/drivers/mmc/host/omap.c b/drivers/mmc/host/omap.c
index f23d65eb070d..be3c49fa7382 100644
--- a/drivers/mmc/host/omap.c
+++ b/drivers/mmc/host/omap.c
@@ -1016,14 +1016,16 @@ mmc_omap_prepare_data(struct mmc_omap_host *host, struct mmc_request *req)
 
                 /* Only reconfigure if we have a different burst size */
                 if (*bp != burst) {
-                        struct dma_slave_config cfg;
-
-                        cfg.src_addr = host->phys_base + OMAP_MMC_REG(host, DATA);
-                        cfg.dst_addr = host->phys_base + OMAP_MMC_REG(host, DATA);
-                        cfg.src_addr_width = DMA_SLAVE_BUSWIDTH_2_BYTES;
-                        cfg.dst_addr_width = DMA_SLAVE_BUSWIDTH_2_BYTES;
-                        cfg.src_maxburst = burst;
-                        cfg.dst_maxburst = burst;
+                        struct dma_slave_config cfg = {
+                                .src_addr = host->phys_base +
+                                            OMAP_MMC_REG(host, DATA),
+                                .dst_addr = host->phys_base +
+                                            OMAP_MMC_REG(host, DATA),
+                                .src_addr_width = DMA_SLAVE_BUSWIDTH_2_BYTES,
+                                .dst_addr_width = DMA_SLAVE_BUSWIDTH_2_BYTES,
+                                .src_maxburst = burst,
+                                .dst_maxburst = burst,
+                        };
 
                         if (dmaengine_slave_config(c, &cfg))
                                 goto use_pio;
diff --git a/drivers/mmc/host/omap_hsmmc.c b/drivers/mmc/host/omap_hsmmc.c
index 24ebc9a8de89..5f2f24a7360d 100644
--- a/drivers/mmc/host/omap_hsmmc.c
+++ b/drivers/mmc/host/omap_hsmmc.c
@@ -1409,11 +1409,18 @@ static int omap_hsmmc_pre_dma_transfer(struct omap_hsmmc_host *host,
 static int omap_hsmmc_setup_dma_transfer(struct omap_hsmmc_host *host,
                                         struct mmc_request *req)
 {
-        struct dma_slave_config cfg;
         struct dma_async_tx_descriptor *tx;
         int ret = 0, i;
         struct mmc_data *data = req->data;
         struct dma_chan *chan;
+        struct dma_slave_config cfg = {
+                .src_addr = host->mapbase + OMAP_HSMMC_DATA,
+                .dst_addr = host->mapbase + OMAP_HSMMC_DATA,
+                .src_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES,
+                .dst_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES,
+                .src_maxburst = data->blksz / 4,
+                .dst_maxburst = data->blksz / 4,
+        };
 
         /* Sanity check: all the SG entries must be aligned by block size. */
         for (i = 0; i < data->sg_len; i++) {
@@ -1433,13 +1440,6 @@ static int omap_hsmmc_setup_dma_transfer(struct omap_hsmmc_host *host,
 
         chan = omap_hsmmc_get_dma_chan(host, data);
 
-        cfg.src_addr = host->mapbase + OMAP_HSMMC_DATA;
-        cfg.dst_addr = host->mapbase + OMAP_HSMMC_DATA;
-        cfg.src_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
-        cfg.dst_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
-        cfg.src_maxburst = data->blksz / 4;
-        cfg.dst_maxburst = data->blksz / 4;
-
         ret = dmaengine_slave_config(chan, &cfg);
         if (ret)
                 return ret;
diff --git a/drivers/mmc/host/sdhci-st.c b/drivers/mmc/host/sdhci-st.c
index c95ba83366a0..ed92ce729dde 100644
--- a/drivers/mmc/host/sdhci-st.c
+++ b/drivers/mmc/host/sdhci-st.c
@@ -28,6 +28,7 @@
 
 struct st_mmc_platform_data {
         struct  reset_control *rstc;
+        struct  clk *icnclk;
         void __iomem *top_ioaddr;
 };
 
@@ -353,7 +354,7 @@ static int sdhci_st_probe(struct platform_device *pdev)
         struct sdhci_host *host;
         struct st_mmc_platform_data *pdata;
         struct sdhci_pltfm_host *pltfm_host;
-        struct clk *clk;
+        struct clk *clk, *icnclk;
         int ret = 0;
         u16 host_version;
         struct resource *res;
@@ -365,6 +366,11 @@ static int sdhci_st_probe(struct platform_device *pdev)
                 return PTR_ERR(clk);
         }
 
+        /* ICN clock isn't compulsory, but use it if it's provided. */
+        icnclk = devm_clk_get(&pdev->dev, "icn");
+        if (IS_ERR(icnclk))
+                icnclk = NULL;
+
         rstc = devm_reset_control_get(&pdev->dev, NULL);
         if (IS_ERR(rstc))
                 rstc = NULL;
@@ -389,6 +395,7 @@ static int sdhci_st_probe(struct platform_device *pdev)
         }
 
         clk_prepare_enable(clk);
+        clk_prepare_enable(icnclk);
 
         /* Configure the FlashSS Top registers for setting eMMC TX/RX delay */
         res = platform_get_resource_byname(pdev, IORESOURCE_MEM,
@@ -400,6 +407,7 @@ static int sdhci_st_probe(struct platform_device *pdev)
         }
 
         pltfm_host->clk = clk;
+        pdata->icnclk = icnclk;
 
         /* Configure the Arasan HC inside the flashSS */
         st_mmcss_cconfig(np, host);
@@ -422,6 +430,7 @@ static int sdhci_st_probe(struct platform_device *pdev)
         return 0;
 
 err_out:
+        clk_disable_unprepare(icnclk);
         clk_disable_unprepare(clk);
 err_of:
         sdhci_pltfm_free(pdev);
@@ -442,6 +451,8 @@ static int sdhci_st_remove(struct platform_device *pdev)
 
         ret = sdhci_pltfm_unregister(pdev);
 
+        clk_disable_unprepare(pdata->icnclk);
+
         if (rstc)
                 reset_control_assert(rstc);
 
@@ -462,6 +473,7 @@ static int sdhci_st_suspend(struct device *dev)
         if (pdata->rstc)
                 reset_control_assert(pdata->rstc);
 
+        clk_disable_unprepare(pdata->icnclk);
         clk_disable_unprepare(pltfm_host->clk);
 out:
         return ret;
@@ -475,6 +487,7 @@ static int sdhci_st_resume(struct device *dev)
         struct device_node *np = dev->of_node;
 
         clk_prepare_enable(pltfm_host->clk);
+        clk_prepare_enable(pdata->icnclk);
 
         if (pdata->rstc)
                 reset_control_deassert(pdata->rstc);
diff --git a/drivers/mtd/nand/mtk_ecc.c b/drivers/mtd/nand/mtk_ecc.c
index 25a4fbd4d24a..d54f666417e1 100644
--- a/drivers/mtd/nand/mtk_ecc.c
+++ b/drivers/mtd/nand/mtk_ecc.c
@@ -366,7 +366,8 @@ int mtk_ecc_encode(struct mtk_ecc *ecc, struct mtk_ecc_config *config,
                    u8 *data, u32 bytes)
 {
         dma_addr_t addr;
-        u32 *p, len, i;
+        u8 *p;
+        u32 len, i, val;
         int ret = 0;
 
         addr = dma_map_single(ecc->dev, data, bytes, DMA_TO_DEVICE);
@@ -392,11 +393,14 @@ int mtk_ecc_encode(struct mtk_ecc *ecc, struct mtk_ecc_config *config,
 
         /* Program ECC bytes to OOB: per sector oob = FDM + ECC + SPARE */
         len = (config->strength * ECC_PARITY_BITS + 7) >> 3;
-        p = (u32 *)(data + bytes);
+        p = data + bytes;
 
         /* write the parity bytes generated by the ECC back to the OOB region */
-        for (i = 0; i < len; i++)
-                p[i] = readl(ecc->regs + ECC_ENCPAR(i));
+        for (i = 0; i < len; i++) {
+                if ((i % 4) == 0)
+                        val = readl(ecc->regs + ECC_ENCPAR(i / 4));
+                p[i] = (val >> ((i % 4) * 8)) & 0xff;
+        }
 timeout:
 
         dma_unmap_single(ecc->dev, addr, bytes, DMA_TO_DEVICE);
diff --git a/drivers/mtd/nand/mtk_nand.c b/drivers/mtd/nand/mtk_nand.c
index ddaa2acb9dd7..5223a2182ee4 100644
--- a/drivers/mtd/nand/mtk_nand.c
+++ b/drivers/mtd/nand/mtk_nand.c
@@ -93,6 +93,9 @@
 #define         NFI_FSM_MASK            (0xf << 16)
 #define NFI_ADDRCNTR            (0x70)
 #define         CNTR_MASK               GENMASK(16, 12)
+#define         ADDRCNTR_SEC_SHIFT      (12)
+#define         ADDRCNTR_SEC(val) \
+                (((val) & CNTR_MASK) >> ADDRCNTR_SEC_SHIFT)
 #define NFI_STRADDR             (0x80)
 #define NFI_BYTELEN             (0x84)
 #define NFI_CSEL                (0x90)
@@ -699,7 +702,7 @@ static int mtk_nfc_do_write_page(struct mtd_info *mtd, struct nand_chip *chip,
         }
 
         ret = readl_poll_timeout_atomic(nfc->regs + NFI_ADDRCNTR, reg,
-                                        (reg & CNTR_MASK) >= chip->ecc.steps,
+                                        ADDRCNTR_SEC(reg) >= chip->ecc.steps,
                                         10, MTK_TIMEOUT);
         if (ret)
                 dev_err(dev, "hwecc write timeout\n");
@@ -902,7 +905,7 @@ static int mtk_nfc_read_subpage(struct mtd_info *mtd, struct nand_chip *chip,
                 dev_warn(nfc->dev, "read ahb/dma done timeout\n");
 
         rc = readl_poll_timeout_atomic(nfc->regs + NFI_BYTELEN, reg,
-                                       (reg & CNTR_MASK) >= sectors, 10,
+                                       ADDRCNTR_SEC(reg) >= sectors, 10,
                                        MTK_TIMEOUT);
         if (rc < 0) {
                 dev_err(nfc->dev, "subpage done timeout\n");
diff --git a/drivers/mtd/nand/mxc_nand.c b/drivers/mtd/nand/mxc_nand.c
index 5173fadc9a4e..57cbe2b83849 100644
--- a/drivers/mtd/nand/mxc_nand.c
+++ b/drivers/mtd/nand/mxc_nand.c
@@ -943,7 +943,7 @@ static int mxc_v2_ooblayout_free(struct mtd_info *mtd, int section,
         struct nand_chip *nand_chip = mtd_to_nand(mtd);
         int stepsize = nand_chip->ecc.bytes == 9 ? 16 : 26;
 
-        if (section > nand_chip->ecc.steps)
+        if (section >= nand_chip->ecc.steps)
                 return -ERANGE;
 
         if (!section) {
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 1f276fa30ba6..9599ed6f1213 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -152,7 +152,7 @@ module_param(lacp_rate, charp, 0);
 MODULE_PARM_DESC(lacp_rate, "LACPDU tx rate to request from 802.3ad partner; "
                             "0 for slow, 1 for fast");
 module_param(ad_select, charp, 0);
-MODULE_PARM_DESC(ad_select, "803.ad aggregation selection logic; "
+MODULE_PARM_DESC(ad_select, "802.3ad aggregation selection logic; "
                             "0 for stable (default), 1 for bandwidth, "
                             "2 for count");
 module_param(min_links, int, 0);
@@ -1341,9 +1341,10 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
                             slave_dev->name);
         }
 
-        /* already enslaved */
-        if (slave_dev->flags & IFF_SLAVE) {
-                netdev_dbg(bond_dev, "Error: Device was already enslaved\n");
+        /* already in-use? */
+        if (netdev_is_rx_handler_busy(slave_dev)) {
+                netdev_err(bond_dev,
+                           "Error: Device is in use and cannot be enslaved\n");
                 return -EBUSY;
         }
 
diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
index 41c0fc9f3b14..16f7cadda5c3 100644
--- a/drivers/net/can/flexcan.c
+++ b/drivers/net/can/flexcan.c
@@ -1268,11 +1268,10 @@ static int __maybe_unused flexcan_suspend(struct device *device)
         struct flexcan_priv *priv = netdev_priv(dev);
         int err;
 
-        err = flexcan_chip_disable(priv);
-        if (err)
-                return err;
-
         if (netif_running(dev)) {
+                err = flexcan_chip_disable(priv);
+                if (err)
+                        return err;
                 netif_stop_queue(dev);
                 netif_device_detach(dev);
         }
@@ -1285,13 +1284,17 @@ static int __maybe_unused flexcan_resume(struct device *device)
 {
         struct net_device *dev = dev_get_drvdata(device);
         struct flexcan_priv *priv = netdev_priv(dev);
+        int err;
 
         priv->can.state = CAN_STATE_ERROR_ACTIVE;
         if (netif_running(dev)) {
                 netif_device_attach(dev);
                 netif_start_queue(dev);
+                err = flexcan_chip_enable(priv);
+                if (err)
+                        return err;
         }
-        return flexcan_chip_enable(priv);
+        return 0;
 }
 
 static SIMPLE_DEV_PM_OPS(flexcan_pm_ops, flexcan_suspend, flexcan_resume);
diff --git a/drivers/net/can/ifi_canfd/ifi_canfd.c b/drivers/net/can/ifi_canfd/ifi_canfd.c
index 2d1d22eec750..368bb0710d8f 100644
--- a/drivers/net/can/ifi_canfd/ifi_canfd.c
+++ b/drivers/net/can/ifi_canfd/ifi_canfd.c
@@ -81,6 +81,10 @@
 #define IFI_CANFD_TIME_SET_TIMEA_4_12_6_6       BIT(15)
 
 #define IFI_CANFD_TDELAY                        0x1c
+#define IFI_CANFD_TDELAY_DEFAULT                0xb
+#define IFI_CANFD_TDELAY_MASK                   0x3fff
+#define IFI_CANFD_TDELAY_ABS                    BIT(14)
+#define IFI_CANFD_TDELAY_EN                     BIT(15)
 
 #define IFI_CANFD_ERROR                         0x20
 #define IFI_CANFD_ERROR_TX_OFFSET               0
@@ -641,7 +645,7 @@ static void ifi_canfd_set_bittiming(struct net_device *ndev)
         struct ifi_canfd_priv *priv = netdev_priv(ndev);
         const struct can_bittiming *bt = &priv->can.bittiming;
         const struct can_bittiming *dbt = &priv->can.data_bittiming;
-        u16 brp, sjw, tseg1, tseg2;
+        u16 brp, sjw, tseg1, tseg2, tdc;
 
         /* Configure bit timing */
         brp = bt->brp - 2;
@@ -664,6 +668,11 @@ static void ifi_canfd_set_bittiming(struct net_device *ndev)
                (brp << IFI_CANFD_TIME_PRESCALE_OFF) |
                (sjw << IFI_CANFD_TIME_SJW_OFF_7_9_8_8),
                priv->base + IFI_CANFD_FTIME);
+
+        /* Configure transmitter delay */
+        tdc = (dbt->brp * (dbt->phase_seg1 + 1)) & IFI_CANFD_TDELAY_MASK;
+        writel(IFI_CANFD_TDELAY_EN | IFI_CANFD_TDELAY_ABS | tdc,
+               priv->base + IFI_CANFD_TDELAY);
 }
 
 static void ifi_canfd_set_filter(struct net_device *ndev, const u32 id,
diff --git a/drivers/net/dsa/b53/b53_regs.h b/drivers/net/dsa/b53/b53_regs.h
index 8f12bddd5dc9..a0b453ea34c9 100644
--- a/drivers/net/dsa/b53/b53_regs.h
+++ b/drivers/net/dsa/b53/b53_regs.h
@@ -258,7 +258,7 @@
  * BCM5325 and BCM5365 share most definitions below
  */
 #define B53_ARLTBL_MAC_VID_ENTRY(n)     (0x10 * (n))
-#define   ARLTBL_MAC_MASK               0xffffffffffff
+#define   ARLTBL_MAC_MASK               0xffffffffffffULL
 #define   ARLTBL_VID_S                  48
 #define   ARLTBL_VID_MASK_25            0xff
 #define   ARLTBL_VID_MASK               0xfff
diff --git a/drivers/net/dsa/bcm_sf2.h b/drivers/net/dsa/bcm_sf2.h
index 463bed8cbe4c..dd446e466699 100644
--- a/drivers/net/dsa/bcm_sf2.h
+++ b/drivers/net/dsa/bcm_sf2.h
@@ -205,8 +205,8 @@ static inline void name##_writeq(struct bcm_sf2_priv *priv, u64 val,	\
 static inline void intrl2_##which##_mask_clear(struct bcm_sf2_priv *priv, \
                                                 u32 mask)               \
 {                                                                       \
-        intrl2_##which##_writel(priv, mask, INTRL2_CPU_MASK_CLEAR);     \
         priv->irq##which##_mask &= ~(mask);                             \
+        intrl2_##which##_writel(priv, mask, INTRL2_CPU_MASK_CLEAR);     \
 }                                                                       \
 static inline void intrl2_##which##_mask_set(struct bcm_sf2_priv *priv, \
                                                 u32 mask)               \
diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
index d36aedde8cb9..710679067594 100644
--- a/drivers/net/dsa/mv88e6xxx/chip.c
+++ b/drivers/net/dsa/mv88e6xxx/chip.c
@@ -2656,15 +2656,19 @@ static int mv88e6xxx_setup_port(struct mv88e6xxx_chip *chip, int port)
                         return ret;
         }
 
+        /* Rate Control: disable ingress rate limiting. */
         if (mv88e6xxx_6352_family(chip) || mv88e6xxx_6351_family(chip) ||
             mv88e6xxx_6165_family(chip) || mv88e6xxx_6097_family(chip) ||
-            mv88e6xxx_6185_family(chip) || mv88e6xxx_6095_family(chip) ||
             mv88e6xxx_6320_family(chip)) {
-                /* Rate Control: disable ingress rate limiting. */
                 ret = _mv88e6xxx_reg_write(chip, REG_PORT(port),
                                            PORT_RATE_CONTROL, 0x0001);
                 if (ret)
                         return ret;
+        } else if (mv88e6xxx_6185_family(chip) || mv88e6xxx_6095_family(chip)) {
+                ret = _mv88e6xxx_reg_write(chip, REG_PORT(port),
+                                           PORT_RATE_CONTROL, 0x0000);
+                if (ret)
+                        return ret;
         }
 
         /* Port Control 1: disable trunking, disable sending
@@ -3187,6 +3191,7 @@ static int mv88e6xxx_set_addr(struct dsa_switch *ds, u8 *addr)
         return err;
 }
 
+#ifdef CONFIG_NET_DSA_HWMON
 static int mv88e6xxx_mdio_page_read(struct dsa_switch *ds, int port, int page,
                                     int reg)
 {
@@ -3212,6 +3217,7 @@ static int mv88e6xxx_mdio_page_write(struct dsa_switch *ds, int port, int page,
 
         return ret;
 }
+#endif
 
 static int mv88e6xxx_port_to_mdio_addr(struct mv88e6xxx_chip *chip, int port)
 {
diff --git a/drivers/net/ethernet/apm/xgene/xgene_enet_hw.c b/drivers/net/ethernet/apm/xgene/xgene_enet_hw.c
index 37a0f463b8de..18bb9556dd00 100644
--- a/drivers/net/ethernet/apm/xgene/xgene_enet_hw.c
+++ b/drivers/net/ethernet/apm/xgene/xgene_enet_hw.c
@@ -793,6 +793,8 @@ int xgene_enet_phy_connect(struct net_device *ndev)
                         netdev_err(ndev, "Could not connect to PHY\n");
                         return  -ENODEV;
                 }
+#else
+                return -ENODEV;
 #endif
         }
 
diff --git a/drivers/net/ethernet/arc/emac_main.c b/drivers/net/ethernet/arc/emac_main.c
index 4bff0f3040df..b0da9693f28a 100644
--- a/drivers/net/ethernet/arc/emac_main.c
+++ b/drivers/net/ethernet/arc/emac_main.c
@@ -771,8 +771,10 @@ int arc_emac_probe(struct net_device *ndev, int interface)
         priv->dev = dev;
 
         priv->regs = devm_ioremap_resource(dev, &res_regs);
-        if (IS_ERR(priv->regs))
-                return PTR_ERR(priv->regs);
+        if (IS_ERR(priv->regs)) {
+                err = PTR_ERR(priv->regs);
+                goto out_put_node;
+        }
 
         dev_dbg(dev, "Registers base address is 0x%p\n", priv->regs);
 
diff --git a/drivers/net/ethernet/atheros/alx/main.c b/drivers/net/ethernet/atheros/alx/main.c
index 6453148d066a..4eb17daefc4f 100644
--- a/drivers/net/ethernet/atheros/alx/main.c
+++ b/drivers/net/ethernet/atheros/alx/main.c
@@ -1545,6 +1545,8 @@ static const struct pci_device_id alx_pci_tbl[] = {
           .driver_data = ALX_DEV_QUIRK_MSI_INTX_DISABLE_BUG },
         { PCI_VDEVICE(ATTANSIC, ALX_DEV_ID_E2400),
           .driver_data = ALX_DEV_QUIRK_MSI_INTX_DISABLE_BUG },
+        { PCI_VDEVICE(ATTANSIC, ALX_DEV_ID_E2500),
+          .driver_data = ALX_DEV_QUIRK_MSI_INTX_DISABLE_BUG },
         { PCI_VDEVICE(ATTANSIC, ALX_DEV_ID_AR8162),
           .driver_data = ALX_DEV_QUIRK_MSI_INTX_DISABLE_BUG },
         { PCI_VDEVICE(ATTANSIC, ALX_DEV_ID_AR8171) },
diff --git a/drivers/net/ethernet/atheros/alx/reg.h b/drivers/net/ethernet/atheros/alx/reg.h
index 0959e6824cb6..1fc2d852249f 100644
--- a/drivers/net/ethernet/atheros/alx/reg.h
+++ b/drivers/net/ethernet/atheros/alx/reg.h
@@ -38,6 +38,7 @@
 #define ALX_DEV_ID_AR8161                               0x1091
 #define ALX_DEV_ID_E2200                                0xe091
 #define ALX_DEV_ID_E2400                                0xe0a1
+#define ALX_DEV_ID_E2500                                0xe0b1
 #define ALX_DEV_ID_AR8162                               0x1090
 #define ALX_DEV_ID_AR8171                               0x10A1
 #define ALX_DEV_ID_AR8172                               0x10A0
diff --git a/drivers/net/ethernet/broadcom/bgmac-bcma.c b/drivers/net/ethernet/broadcom/bgmac-bcma.c
index 9a9745c4047c..625235db644f 100644
--- a/drivers/net/ethernet/broadcom/bgmac-bcma.c
+++ b/drivers/net/ethernet/broadcom/bgmac-bcma.c
@@ -159,7 +159,7 @@ static int bgmac_probe(struct bcma_device *core)
 
         if (!bgmac_is_bcm4707_family(core)) {
                 mii_bus = bcma_mdio_mii_register(core, bgmac->phyaddr);
-                if (!IS_ERR(mii_bus)) {
+                if (IS_ERR(mii_bus)) {
                         err = PTR_ERR(mii_bus);
                         goto err;
                 }
diff --git a/drivers/net/ethernet/broadcom/bnx2.c b/drivers/net/ethernet/broadcom/bnx2.c
index 8fc3f3c137f8..505ceaf451e2 100644
--- a/drivers/net/ethernet/broadcom/bnx2.c
+++ b/drivers/net/ethernet/broadcom/bnx2.c
@@ -6356,10 +6356,6 @@ bnx2_open(struct net_device *dev)
         struct bnx2 *bp = netdev_priv(dev);
         int rc;
 
-        rc = bnx2_request_firmware(bp);
-        if (rc < 0)
-                goto out;
-
         netif_carrier_off(dev);
 
         bnx2_disable_int(bp);
@@ -6428,7 +6424,6 @@ open_err:
         bnx2_free_irq(bp);
         bnx2_free_mem(bp);
         bnx2_del_napi(bp);
-        bnx2_release_firmware(bp);
         goto out;
 }
 
@@ -8575,6 +8570,12 @@ bnx2_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
 
         pci_set_drvdata(pdev, dev);
 
+        rc = bnx2_request_firmware(bp);
+        if (rc < 0)
+                goto error;
+
+
+        bnx2_reset_chip(bp, BNX2_DRV_MSG_CODE_RESET);
         memcpy(dev->dev_addr, bp->mac_addr, ETH_ALEN);
 
         dev->hw_features = NETIF_F_IP_CSUM | NETIF_F_SG |
@@ -8607,6 +8608,7 @@ bnx2_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         return 0;
 
 error:
+        bnx2_release_firmware(bp);
         pci_iounmap(pdev, bp->regview);
         pci_release_regions(pdev);
         pci_disable_device(pdev);
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index 97e892511666..fa3386bb14f7 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -772,6 +772,11 @@ void bnx2x_fw_dump_lvl(struct bnx2x *bp, const char *lvl)
                 (bp->common.bc_ver & 0xff00) >> 8,
                 (bp->common.bc_ver & 0xff));
 
+        if (pci_channel_offline(bp->pdev)) {
+                BNX2X_ERR("Cannot dump MCP info while in PCI error\n");
+                return;
+        }
+
         val = REG_RD(bp, MCP_REG_MCPR_CPU_PROGRAM_COUNTER);
         if (val == REG_RD(bp, MCP_REG_MCPR_CPU_PROGRAM_COUNTER))
                 BNX2X_ERR("%s" "MCP PC at 0x%x\n", lvl, val);
@@ -9415,10 +9420,16 @@ unload_error:
         /* Release IRQs */
         bnx2x_free_irq(bp);
 
-        /* Reset the chip */
-        rc = bnx2x_reset_hw(bp, reset_code);
-        if (rc)
-                BNX2X_ERR("HW_RESET failed\n");
+        /* Reset the chip, unless PCI function is offline. If we reach this
+         * point following a PCI error handling, it means device is really
+         * in a bad state and we're about to remove it, so reset the chip
+         * is not a good idea.
+         */
+        if (!pci_channel_offline(bp->pdev)) {
+                rc = bnx2x_reset_hw(bp, reset_code);
+                if (rc)
+                        BNX2X_ERR("HW_RESET failed\n");
+        }
 
         /* Report UNLOAD_DONE to MCP */
         bnx2x_send_unload_done(bp, keep_link);
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index 2cf79100c9cb..228c964e709a 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -353,8 +353,8 @@ static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 push_len = (length + sizeof(*tx_push) + 7) / 8;
                 if (push_len > 16) {
                         __iowrite64_copy(txr->tx_doorbell, tx_push_buf, 16);
-                        __iowrite64_copy(txr->tx_doorbell + 4, tx_push_buf + 1,
-                                         push_len - 16);
+                        __iowrite32_copy(txr->tx_doorbell + 4, tx_push_buf + 1,
+                                         (push_len - 16) << 1);
                 } else {
                         __iowrite64_copy(txr->tx_doorbell, tx_push_buf,
                                          push_len);
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index ff300f7cf529..a2551bcd1027 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -12552,10 +12552,6 @@ static int tg3_get_rxnfc(struct net_device *dev, struct ethtool_rxnfc *info,
                                 info->data = TG3_RSS_MAX_NUM_QS;
                 }
 
-                /* The first interrupt vector only
-                 * handles link interrupts.
-                 */
-                info->data -= 1;
                 return 0;
 
         default:
@@ -14014,7 +14010,9 @@ static int tg3_set_coalesce(struct net_device *dev, struct ethtool_coalesce *ec)
         }
 
         if ((ec->rx_coalesce_usecs > MAX_RXCOL_TICKS) ||
+            (!ec->rx_coalesce_usecs) ||
             (ec->tx_coalesce_usecs > MAX_TXCOL_TICKS) ||
+            (!ec->tx_coalesce_usecs) ||
             (ec->rx_max_coalesced_frames > MAX_RXMAX_FRAMES) ||
             (ec->tx_max_coalesced_frames > MAX_TXMAX_FRAMES) ||
             (ec->rx_coalesce_usecs_irq > max_rxcoal_tick_int) ||
@@ -14025,16 +14023,6 @@ static int tg3_set_coalesce(struct net_device *dev, struct ethtool_coalesce *ec)
             (ec->stats_block_coalesce_usecs < min_stat_coal_ticks))
                 return -EINVAL;
 
-        /* No rx interrupts will be generated if both are zero */
-        if ((ec->rx_coalesce_usecs == 0) &&
-            (ec->rx_max_coalesced_frames == 0))
-                return -EINVAL;
-
-        /* No tx interrupts will be generated if both are zero */
-        if ((ec->tx_coalesce_usecs == 0) &&
-            (ec->tx_max_coalesced_frames == 0))
-                return -EINVAL;
-
         /* Only copy relevant parameters, ignore all others. */
         tp->coal.rx_coalesce_usecs = ec->rx_coalesce_usecs;
         tp->coal.tx_coalesce_usecs = ec->tx_coalesce_usecs;
diff --git a/drivers/net/ethernet/brocade/bna/bnad_ethtool.c b/drivers/net/ethernet/brocade/bna/bnad_ethtool.c
index 0e4fdc3dd729..31f61a744d66 100644
--- a/drivers/net/ethernet/brocade/bna/bnad_ethtool.c
+++ b/drivers/net/ethernet/brocade/bna/bnad_ethtool.c
@@ -31,15 +31,10 @@
 #define BNAD_NUM_TXF_COUNTERS 12
 #define BNAD_NUM_RXF_COUNTERS 10
 #define BNAD_NUM_CQ_COUNTERS (3 + 5)
-#define BNAD_NUM_RXQ_COUNTERS 6
+#define BNAD_NUM_RXQ_COUNTERS 7
 #define BNAD_NUM_TXQ_COUNTERS 5
 
-#define BNAD_ETHTOOL_STATS_NUM                                          \
-        (sizeof(struct rtnl_link_stats64) / sizeof(u64) +       \
-        sizeof(struct bnad_drv_stats) / sizeof(u64) +           \
-        offsetof(struct bfi_enet_stats, rxf_stats[0]) / sizeof(u64))
-
-static const char *bnad_net_stats_strings[BNAD_ETHTOOL_STATS_NUM] = {
+static const char *bnad_net_stats_strings[] = {
         "rx_packets",
         "tx_packets",
         "rx_bytes",
@@ -50,22 +45,10 @@ static const char *bnad_net_stats_strings[BNAD_ETHTOOL_STATS_NUM] = {
         "tx_dropped",
         "multicast",
         "collisions",
-
         "rx_length_errors",
-        "rx_over_errors",
         "rx_crc_errors",
         "rx_frame_errors",
-        "rx_fifo_errors",
-        "rx_missed_errors",
-
-        "tx_aborted_errors",
-        "tx_carrier_errors",
         "tx_fifo_errors",
-        "tx_heartbeat_errors",
-        "tx_window_errors",
-
-        "rx_compressed",
-        "tx_compressed",
 
         "netif_queue_stop",
         "netif_queue_wakeup",
@@ -254,6 +237,8 @@ static const char *bnad_net_stats_strings[BNAD_ETHTOOL_STATS_NUM] = {
         "fc_tx_fid_parity_errors",
 };
 
+#define BNAD_ETHTOOL_STATS_NUM  ARRAY_SIZE(bnad_net_stats_strings)
+
 static int
 bnad_get_settings(struct net_device *netdev, struct ethtool_cmd *cmd)
 {
@@ -658,6 +643,8 @@ bnad_get_strings(struct net_device *netdev, u32 stringset, u8 *string)
                                 string += ETH_GSTRING_LEN;
                                 sprintf(string, "rxq%d_allocbuf_failed", q_num);
                                 string += ETH_GSTRING_LEN;
+                                sprintf(string, "rxq%d_mapbuf_failed", q_num);
+                                string += ETH_GSTRING_LEN;
                                 sprintf(string, "rxq%d_producer_index", q_num);
                                 string += ETH_GSTRING_LEN;
                                 sprintf(string, "rxq%d_consumer_index", q_num);
@@ -678,6 +665,9 @@ bnad_get_strings(struct net_device *netdev, u32 stringset, u8 *string)
                                         sprintf(string, "rxq%d_allocbuf_failed",
                                                                 q_num);
                                         string += ETH_GSTRING_LEN;
+                                        sprintf(string, "rxq%d_mapbuf_failed",
+                                                q_num);
+                                        string += ETH_GSTRING_LEN;
                                         sprintf(string, "rxq%d_producer_index",
                                                                 q_num);
                                         string += ETH_GSTRING_LEN;
@@ -854,9 +844,9 @@ bnad_get_ethtool_stats(struct net_device *netdev, struct ethtool_stats *stats,
                        u64 *buf)
 {
         struct bnad *bnad = netdev_priv(netdev);
-        int i, j, bi;
+        int i, j, bi = 0;
         unsigned long flags;
-        struct rtnl_link_stats64 *net_stats64;
+        struct rtnl_link_stats64 net_stats64;
         u64 *stats64;
         u32 bmap;
 
@@ -871,14 +861,25 @@ bnad_get_ethtool_stats(struct net_device *netdev, struct ethtool_stats *stats,
          * under the same lock
          */
         spin_lock_irqsave(&bnad->bna_lock, flags);
-        bi = 0;
-        memset(buf, 0, stats->n_stats * sizeof(u64));
-
-        net_stats64 = (struct rtnl_link_stats64 *)buf;
-        bnad_netdev_qstats_fill(bnad, net_stats64);
-        bnad_netdev_hwstats_fill(bnad, net_stats64);
 
-        bi = sizeof(*net_stats64) / sizeof(u64);
+        memset(&net_stats64, 0, sizeof(net_stats64));
+        bnad_netdev_qstats_fill(bnad, &net_stats64);
+        bnad_netdev_hwstats_fill(bnad, &net_stats64);
+
+        buf[bi++] = net_stats64.rx_packets;
+        buf[bi++] = net_stats64.tx_packets;
+        buf[bi++] = net_stats64.rx_bytes;
+        buf[bi++] = net_stats64.tx_bytes;
+        buf[bi++] = net_stats64.rx_errors;
+        buf[bi++] = net_stats64.tx_errors;
+        buf[bi++] = net_stats64.rx_dropped;
+        buf[bi++] = net_stats64.tx_dropped;
+        buf[bi++] = net_stats64.multicast;
+        buf[bi++] = net_stats64.collisions;
+        buf[bi++] = net_stats64.rx_length_errors;
+        buf[bi++] = net_stats64.rx_crc_errors;
+        buf[bi++] = net_stats64.rx_frame_errors;
+        buf[bi++] = net_stats64.tx_fifo_errors;
 
         /* Get netif_queue_stopped from stack */
         bnad->stats.drv_stats.netif_queue_stopped = netif_queue_stopped(netdev);
diff --git a/drivers/net/ethernet/cadence/macb.c b/drivers/net/ethernet/cadence/macb.c
index 89c0cfa9719f..d954a97b0b0b 100644
--- a/drivers/net/ethernet/cadence/macb.c
+++ b/drivers/net/ethernet/cadence/macb.c
@@ -1323,6 +1323,24 @@ dma_error:
         return 0;
 }
 
+static inline int macb_clear_csum(struct sk_buff *skb)
+{
+        /* no change for packets without checksum offloading */
+        if (skb->ip_summed != CHECKSUM_PARTIAL)
+                return 0;
+
+        /* make sure we can modify the header */
+        if (unlikely(skb_cow_head(skb, 0)))
+                return -1;
+
+        /* initialize checksum field
+         * This is required - at least for Zynq, which otherwise calculates
+         * wrong UDP header checksums for UDP packets with UDP data len <=2
+         */
+        *(__sum16 *)(skb_checksum_start(skb) + skb->csum_offset) = 0;
+        return 0;
+}
+
 static int macb_start_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         u16 queue_index = skb_get_queue_mapping(skb);
@@ -1362,6 +1380,11 @@ static int macb_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 return NETDEV_TX_BUSY;
         }
 
+        if (macb_clear_csum(skb)) {
+                dev_kfree_skb_any(skb);
+                return NETDEV_TX_OK;
+        }
+
         /* Map socket buffer for DMA transfer */
         if (!macb_tx_map(bp, queue, skb)) {
                 dev_kfree_skb_any(skb);
diff --git a/drivers/net/ethernet/cadence/macb.h b/drivers/net/ethernet/cadence/macb.h
index 36893d8958d4..b6fcf10621b6 100644
--- a/drivers/net/ethernet/cadence/macb.h
+++ b/drivers/net/ethernet/cadence/macb.h
@@ -403,11 +403,11 @@
 #define MACB_CAPS_USRIO_DEFAULT_IS_MII_GMII     0x00000004
 #define MACB_CAPS_NO_GIGABIT_HALF               0x00000008
 #define MACB_CAPS_USRIO_DISABLED                0x00000010
+#define MACB_CAPS_JUMBO                         0x00000020
 #define MACB_CAPS_FIFO_MODE                     0x10000000
 #define MACB_CAPS_GIGABIT_MODE_AVAILABLE        0x20000000
 #define MACB_CAPS_SG_DISABLED                   0x40000000
 #define MACB_CAPS_MACB_IS_GEM                   0x80000000
-#define MACB_CAPS_JUMBO                         0x00000010
 
 /* Bit manipulation macros */
 #define MACB_BIT(name)                                  \
diff --git a/drivers/net/ethernet/cavium/thunder/nic.h b/drivers/net/ethernet/cavium/thunder/nic.h
index 83025bb4737c..e29815d9e6f4 100644
--- a/drivers/net/ethernet/cavium/thunder/nic.h
+++ b/drivers/net/ethernet/cavium/thunder/nic.h
@@ -279,6 +279,7 @@ struct nicvf {
         u8                      sqs_id;
         bool                    sqs_mode;
         bool                    hw_tso;
+        bool                    t88;
 
         /* Receive buffer alloc */
         u32                     rb_page_offset;
diff --git a/drivers/net/ethernet/cavium/thunder/nic_main.c b/drivers/net/ethernet/cavium/thunder/nic_main.c
index 16ed20357c5c..85cc782b9060 100644
--- a/drivers/net/ethernet/cavium/thunder/nic_main.c
+++ b/drivers/net/ethernet/cavium/thunder/nic_main.c
@@ -251,9 +251,14 @@ static void nic_set_tx_pkt_pad(struct nicpf *nic, int size)
         int lmac;
         u64 lmac_cfg;
 
-        /* Max value that can be set is 60 */
-        if (size > 60)
-                size = 60;
+        /* There is a issue in HW where-in while sending GSO sized
+         * pkts as part of TSO, if pkt len falls below this size
+         * NIC will zero PAD packet and also updates IP total length.
+         * Hence set this value to lessthan min pkt size of MAC+IP+TCP
+         * headers, BGX will do the padding to transmit 64 byte pkt.
+         */
+        if (size > 52)
+                size = 52;
 
         for (lmac = 0; lmac < (MAX_BGX_PER_CN88XX * MAX_LMAC_PER_BGX); lmac++) {
                 lmac_cfg = nic_reg_read(nic, NIC_PF_LMAC_0_7_CFG | (lmac << 3));
diff --git a/drivers/net/ethernet/cavium/thunder/nic_reg.h b/drivers/net/ethernet/cavium/thunder/nic_reg.h
index afb10e326b4f..fab35a593898 100644
--- a/drivers/net/ethernet/cavium/thunder/nic_reg.h
+++ b/drivers/net/ethernet/cavium/thunder/nic_reg.h
@@ -170,7 +170,6 @@
 #define   NIC_QSET_SQ_0_7_DOOR                  (0x010838)
 #define   NIC_QSET_SQ_0_7_STATUS                (0x010840)
 #define   NIC_QSET_SQ_0_7_DEBUG                 (0x010848)
-#define   NIC_QSET_SQ_0_7_CNM_CHG               (0x010860)
 #define   NIC_QSET_SQ_0_7_STAT_0_1              (0x010900)
 
 #define   NIC_QSET_RBDR_0_1_CFG                 (0x010C00)
diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_ethtool.c b/drivers/net/ethernet/cavium/thunder/nicvf_ethtool.c
index d2d8ef270142..ad4fddb55421 100644
--- a/drivers/net/ethernet/cavium/thunder/nicvf_ethtool.c
+++ b/drivers/net/ethernet/cavium/thunder/nicvf_ethtool.c
@@ -382,7 +382,10 @@ static void nicvf_get_regs(struct net_device *dev,
                 p[i++] = nicvf_queue_reg_read(nic, NIC_QSET_SQ_0_7_DOOR, q);
                 p[i++] = nicvf_queue_reg_read(nic, NIC_QSET_SQ_0_7_STATUS, q);
                 p[i++] = nicvf_queue_reg_read(nic, NIC_QSET_SQ_0_7_DEBUG, q);
-                p[i++] = nicvf_queue_reg_read(nic, NIC_QSET_SQ_0_7_CNM_CHG, q);
+                /* Padding, was NIC_QSET_SQ_0_7_CNM_CHG, which
+                 * produces bus errors when read
+                 */
+                p[i++] = 0;
                 p[i++] = nicvf_queue_reg_read(nic, NIC_QSET_SQ_0_7_STAT_0_1, q);
                 reg_offset = NIC_QSET_SQ_0_7_STAT_0_1 | (1 << 3);
                 p[i++] = nicvf_queue_reg_read(nic, reg_offset, q);
diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_main.c b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
index a19e73f11d73..3240349615bd 100644
--- a/drivers/net/ethernet/cavium/thunder/nicvf_main.c
+++ b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
@@ -513,6 +513,7 @@ static void nicvf_snd_pkt_handler(struct net_device *netdev,
         struct nicvf *nic = netdev_priv(netdev);
         struct snd_queue *sq;
         struct sq_hdr_subdesc *hdr;
+        struct sq_hdr_subdesc *tso_sqe;
 
         sq = &nic->qs->sq[cqe_tx->sq_idx];
 
@@ -527,17 +528,21 @@ static void nicvf_snd_pkt_handler(struct net_device *netdev,
 
         nicvf_check_cqe_tx_errs(nic, cq, cqe_tx);
         skb = (struct sk_buff *)sq->skbuff[cqe_tx->sqe_ptr];
-        /* For TSO offloaded packets only one SQE will have a valid SKB */
         if (skb) {
+                /* Check for dummy descriptor used for HW TSO offload on 88xx */
+                if (hdr->dont_send) {
+                        /* Get actual TSO descriptors and free them */
+                        tso_sqe =
+                         (struct sq_hdr_subdesc *)GET_SQ_DESC(sq, hdr->rsvd2);
+                        nicvf_put_sq_desc(sq, tso_sqe->subdesc_cnt + 1);
+                }
                 nicvf_put_sq_desc(sq, hdr->subdesc_cnt + 1);
                 prefetch(skb);
                 dev_consume_skb_any(skb);
                 sq->skbuff[cqe_tx->sqe_ptr] = (u64)NULL;
         } else {
-                /* In case of HW TSO, HW sends a CQE for each segment of a TSO
-                 * packet instead of a single CQE for the whole TSO packet
-                 * transmitted. Each of this CQE points to the same SQE, so
-                 * avoid freeing same SQE multiple times.
+                /* In case of SW TSO on 88xx, only last segment will have
+                 * a SKB attached, so just free SQEs here.
                  */
                 if (!nic->hw_tso)
                         nicvf_put_sq_desc(sq, hdr->subdesc_cnt + 1);
@@ -1502,6 +1507,7 @@ static int nicvf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         struct net_device *netdev;
         struct nicvf *nic;
         int    err, qcount;
+        u16    sdevid;
 
         err = pci_enable_device(pdev);
         if (err) {
@@ -1575,6 +1581,10 @@ static int nicvf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         if (!pass1_silicon(nic->pdev))
                 nic->hw_tso = true;
 
+        pci_read_config_word(nic->pdev, PCI_SUBSYSTEM_ID, &sdevid);
+        if (sdevid == 0xA134)
+                nic->t88 = true;
+
         /* Check if this VF is in QS only mode */
         if (nic->sqs_mode)
                 return 0;
diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_queues.c b/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
index 0ff8e60deccb..dda3ea3f3bb6 100644
--- a/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
+++ b/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
@@ -938,6 +938,8 @@ static int nicvf_tso_count_subdescs(struct sk_buff *skb)
         return num_edescs + sh->gso_segs;
 }
 
+#define POST_CQE_DESC_COUNT 2
+
 /* Get the number of SQ descriptors needed to xmit this skb */
 static int nicvf_sq_subdesc_required(struct nicvf *nic, struct sk_buff *skb)
 {
@@ -948,6 +950,10 @@ static int nicvf_sq_subdesc_required(struct nicvf *nic, struct sk_buff *skb)
                 return subdesc_cnt;
         }
 
+        /* Dummy descriptors to get TSO pkt completion notification */
+        if (nic->t88 && nic->hw_tso && skb_shinfo(skb)->gso_size)
+                subdesc_cnt += POST_CQE_DESC_COUNT;
+
         if (skb_shinfo(skb)->nr_frags)
                 subdesc_cnt += skb_shinfo(skb)->nr_frags;
 
@@ -965,14 +971,21 @@ nicvf_sq_add_hdr_subdesc(struct nicvf *nic, struct snd_queue *sq, int qentry,
         struct sq_hdr_subdesc *hdr;
 
         hdr = (struct sq_hdr_subdesc *)GET_SQ_DESC(sq, qentry);
-        sq->skbuff[qentry] = (u64)skb;
-
         memset(hdr, 0, SND_QUEUE_DESC_SIZE);
         hdr->subdesc_type = SQ_DESC_TYPE_HEADER;
-        /* Enable notification via CQE after processing SQE */
-        hdr->post_cqe = 1;
-        /* No of subdescriptors following this */
-        hdr->subdesc_cnt = subdesc_cnt;
+
+        if (nic->t88 && nic->hw_tso && skb_shinfo(skb)->gso_size) {
+                /* post_cqe = 0, to avoid HW posting a CQE for every TSO
+                 * segment transmitted on 88xx.
+                 */
+                hdr->subdesc_cnt = subdesc_cnt - POST_CQE_DESC_COUNT;
+        } else {
+                sq->skbuff[qentry] = (u64)skb;
+                /* Enable notification via CQE after processing SQE */
+                hdr->post_cqe = 1;
+                /* No of subdescriptors following this */
+                hdr->subdesc_cnt = subdesc_cnt;
+        }
         hdr->tot_len = len;
 
         /* Offload checksum calculation to HW */
@@ -1023,6 +1036,37 @@ static inline void nicvf_sq_add_gather_subdesc(struct snd_queue *sq, int qentry,
         gather->addr = data;
 }
 
+/* Add HDR + IMMEDIATE subdescriptors right after descriptors of a TSO
+ * packet so that a CQE is posted as a notifation for transmission of
+ * TSO packet.
+ */
+static inline void nicvf_sq_add_cqe_subdesc(struct snd_queue *sq, int qentry,
+                                            int tso_sqe, struct sk_buff *skb)
+{
+        struct sq_imm_subdesc *imm;
+        struct sq_hdr_subdesc *hdr;
+
+        sq->skbuff[qentry] = (u64)skb;
+
+        hdr = (struct sq_hdr_subdesc *)GET_SQ_DESC(sq, qentry);
+        memset(hdr, 0, SND_QUEUE_DESC_SIZE);
+        hdr->subdesc_type = SQ_DESC_TYPE_HEADER;
+        /* Enable notification via CQE after processing SQE */
+        hdr->post_cqe = 1;
+        /* There is no packet to transmit here */
+        hdr->dont_send = 1;
+        hdr->subdesc_cnt = POST_CQE_DESC_COUNT - 1;
+        hdr->tot_len = 1;
+        /* Actual TSO header SQE index, needed for cleanup */
+        hdr->rsvd2 = tso_sqe;
+
+        qentry = nicvf_get_nxt_sqentry(sq, qentry);
+        imm = (struct sq_imm_subdesc *)GET_SQ_DESC(sq, qentry);
+        memset(imm, 0, SND_QUEUE_DESC_SIZE);
+        imm->subdesc_type = SQ_DESC_TYPE_IMMEDIATE;
+        imm->len = 1;
+}
+
 /* Segment a TSO packet into 'gso_size' segments and append
  * them to SQ for transfer
  */
@@ -1096,7 +1140,7 @@ static int nicvf_sq_append_tso(struct nicvf *nic, struct snd_queue *sq,
 int nicvf_sq_append_skb(struct nicvf *nic, struct sk_buff *skb)
 {
         int i, size;
-        int subdesc_cnt;
+        int subdesc_cnt, tso_sqe = 0;
         int sq_num, qentry;
         struct queue_set *qs;
         struct snd_queue *sq;
@@ -1131,6 +1175,7 @@ int nicvf_sq_append_skb(struct nicvf *nic, struct sk_buff *skb)
         /* Add SQ header subdesc */
         nicvf_sq_add_hdr_subdesc(nic, sq, qentry, subdesc_cnt - 1,
                                  skb, skb->len);
+        tso_sqe = qentry;
 
         /* Add SQ gather subdescs */
         qentry = nicvf_get_nxt_sqentry(sq, qentry);
@@ -1154,6 +1199,11 @@ int nicvf_sq_append_skb(struct nicvf *nic, struct sk_buff *skb)
         }
 
 doorbell:
+        if (nic->t88 && skb_shinfo(skb)->gso_size) {
+                qentry = nicvf_get_nxt_sqentry(sq, qentry);
+                nicvf_sq_add_cqe_subdesc(sq, qentry, tso_sqe, skb);
+        }
+
         /* make sure all memory stores are done before ringing doorbell */
         smp_wmb();
 
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h b/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
index 2e2aa9fec9bb..edd23386b47d 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
@@ -419,8 +419,8 @@ struct link_config {
         unsigned short supported;        /* link capabilities */
         unsigned short advertising;      /* advertised capabilities */
         unsigned short lp_advertising;   /* peer advertised capabilities */
-        unsigned short requested_speed;  /* speed user has requested */
-        unsigned short speed;            /* actual link speed */
+        unsigned int   requested_speed;  /* speed user has requested */
+        unsigned int   speed;            /* actual link speed */
         unsigned char  requested_fc;     /* flow control user has requested */
         unsigned char  fc;               /* actual link flow control */
         unsigned char  autoneg;          /* autonegotiating? */
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index c45de49dc963..3ceafb55d6da 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -4305,10 +4305,17 @@ static const struct pci_error_handlers cxgb4_eeh = {
         .resume         = eeh_resume,
 };
 
+/* Return true if the Link Configuration supports "High Speeds" (those greater
+ * than 1Gb/s).
+ */
 static inline bool is_x_10g_port(const struct link_config *lc)
 {
-        return (lc->supported & FW_PORT_CAP_SPEED_10G) != 0 ||
-               (lc->supported & FW_PORT_CAP_SPEED_40G) != 0;
+        unsigned int speeds, high_speeds;
+
+        speeds = FW_PORT_CAP_SPEED_V(FW_PORT_CAP_SPEED_G(lc->supported));
+        high_speeds = speeds & ~(FW_PORT_CAP_SPEED_100M | FW_PORT_CAP_SPEED_1G);
+
+        return high_speeds != 0;
 }
 
 static inline void init_rspq(struct adapter *adap, struct sge_rspq *q,
@@ -4335,6 +4342,11 @@ static void cfg_queues(struct adapter *adap)
 #endif
         int ciq_size;
 
+        /* Reduce memory usage in kdump environment, disable all offload.
+         */
+        if (is_kdump_kernel())
+                adap->params.offload = 0;
+
         for_each_port(adap, i)
                 n10g += is_x_10g_port(&adap2pinfo(adap, i)->link_cfg);
 #ifdef CONFIG_CHELSIO_T4_DCB
@@ -4365,11 +4377,6 @@ static void cfg_queues(struct adapter *adap)
         if (q10g > netif_get_num_default_rss_queues())
                 q10g = netif_get_num_default_rss_queues();
 
-        /* Reduce memory usage in kdump environment, disable all offload.
-         */
-        if (is_kdump_kernel())
-                adap->params.offload = 0;
-
         for_each_port(adap, i) {
                 struct port_info *pi = adap2pinfo(adap, i);
 
@@ -4756,8 +4763,12 @@ static void print_port_info(const struct net_device *dev)
                 bufp += sprintf(bufp, "1000/");
         if (pi->link_cfg.supported & FW_PORT_CAP_SPEED_10G)
                 bufp += sprintf(bufp, "10G/");
+        if (pi->link_cfg.supported & FW_PORT_CAP_SPEED_25G)
+                bufp += sprintf(bufp, "25G/");
         if (pi->link_cfg.supported & FW_PORT_CAP_SPEED_40G)
                 bufp += sprintf(bufp, "40G/");
+        if (pi->link_cfg.supported & FW_PORT_CAP_SPEED_100G)
+                bufp += sprintf(bufp, "100G/");
         if (bufp != buf)
                 --bufp;
         sprintf(bufp, "BASE-%s", t4_get_port_type_description(pi->port_type));
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
index dc92c80a75f4..660204bff726 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
@@ -3627,7 +3627,8 @@ void t4_ulprx_read_la(struct adapter *adap, u32 *la_buf)
 }
 
 #define ADVERT_MASK (FW_PORT_CAP_SPEED_100M | FW_PORT_CAP_SPEED_1G |\
-                     FW_PORT_CAP_SPEED_10G | FW_PORT_CAP_SPEED_40G | \
+                     FW_PORT_CAP_SPEED_10G | FW_PORT_CAP_SPEED_25G | \
+                     FW_PORT_CAP_SPEED_40G | FW_PORT_CAP_SPEED_100G | \
                      FW_PORT_CAP_ANEG)
 
 /**
@@ -7196,8 +7197,12 @@ void t4_handle_get_port_info(struct port_info *pi, const __be64 *rpl)
                 speed = 1000;
         else if (stat & FW_PORT_CMD_LSPEED_V(FW_PORT_CAP_SPEED_10G))
                 speed = 10000;
+        else if (stat & FW_PORT_CMD_LSPEED_V(FW_PORT_CAP_SPEED_25G))
+                speed = 25000;
         else if (stat & FW_PORT_CMD_LSPEED_V(FW_PORT_CAP_SPEED_40G))
                 speed = 40000;
+        else if (stat & FW_PORT_CMD_LSPEED_V(FW_PORT_CAP_SPEED_100G))
+                speed = 100000;
 
         lc = &pi->link_cfg;
 
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4fw_api.h b/drivers/net/ethernet/chelsio/cxgb4/t4fw_api.h
index a89b30720e38..30507d44422c 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4fw_api.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4fw_api.h
@@ -2265,6 +2265,12 @@ enum fw_port_cap {
         FW_PORT_CAP_802_3_ASM_DIR       = 0x8000,
 };
 
+#define FW_PORT_CAP_SPEED_S     0
+#define FW_PORT_CAP_SPEED_M     0x3f
+#define FW_PORT_CAP_SPEED_V(x)  ((x) << FW_PORT_CAP_SPEED_S)
+#define FW_PORT_CAP_SPEED_G(x) \
+        (((x) >> FW_PORT_CAP_SPEED_S) & FW_PORT_CAP_SPEED_M)
+
 enum fw_port_mdi {
         FW_PORT_CAP_MDI_UNCHANGED,
         FW_PORT_CAP_MDI_AUTO,
diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_common.h b/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_common.h
index 8ee541431e8b..17a2bbcf93f0 100644
--- a/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_common.h
+++ b/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_common.h
@@ -108,8 +108,8 @@ struct link_config {
         unsigned int   supported;        /* link capabilities */
         unsigned int   advertising;      /* advertised capabilities */
         unsigned short lp_advertising;   /* peer advertised capabilities */
-        unsigned short requested_speed;  /* speed user has requested */
-        unsigned short speed;            /* actual link speed */
+        unsigned int   requested_speed;  /* speed user has requested */
+        unsigned int   speed;            /* actual link speed */
         unsigned char  requested_fc;     /* flow control user has requested */
         unsigned char  fc;               /* actual link flow control */
         unsigned char  autoneg;          /* autonegotiating? */
@@ -271,10 +271,17 @@ static inline bool is_10g_port(const struct link_config *lc)
         return (lc->supported & FW_PORT_CAP_SPEED_10G) != 0;
 }
 
+/* Return true if the Link Configuration supports "High Speeds" (those greater
+ * than 1Gb/s).
+ */
 static inline bool is_x_10g_port(const struct link_config *lc)
 {
-        return (lc->supported & FW_PORT_CAP_SPEED_10G) != 0 ||
-                (lc->supported & FW_PORT_CAP_SPEED_40G) != 0;
+        unsigned int speeds, high_speeds;
+
+        speeds = FW_PORT_CAP_SPEED_V(FW_PORT_CAP_SPEED_G(lc->supported));
+        high_speeds = speeds & ~(FW_PORT_CAP_SPEED_100M | FW_PORT_CAP_SPEED_1G);
+
+        return high_speeds != 0;
 }
 
 static inline unsigned int core_ticks_per_usec(const struct adapter *adapter)
diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_hw.c b/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_hw.c
index 427bfa71388b..b5622b1689e9 100644
--- a/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_hw.c
+++ b/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_hw.c
@@ -314,8 +314,9 @@ int t4vf_wr_mbox_core(struct adapter *adapter, const void *cmd, int size,
 }
 
 #define ADVERT_MASK (FW_PORT_CAP_SPEED_100M | FW_PORT_CAP_SPEED_1G |\
-                     FW_PORT_CAP_SPEED_10G | FW_PORT_CAP_SPEED_40G | \
-                     FW_PORT_CAP_SPEED_100G | FW_PORT_CAP_ANEG)
+                     FW_PORT_CAP_SPEED_10G | FW_PORT_CAP_SPEED_25G | \
+                     FW_PORT_CAP_SPEED_40G | FW_PORT_CAP_SPEED_100G | \
+                     FW_PORT_CAP_ANEG)
 
 /**
  *      init_link_config - initialize a link's SW state
@@ -1712,8 +1713,12 @@ int t4vf_handle_fw_rpl(struct adapter *adapter, const __be64 *rpl)
                         speed = 1000;
                 else if (stat & FW_PORT_CMD_LSPEED_V(FW_PORT_CAP_SPEED_10G))
                         speed = 10000;
+                else if (stat & FW_PORT_CMD_LSPEED_V(FW_PORT_CAP_SPEED_25G))
+                        speed = 25000;
                 else if (stat & FW_PORT_CMD_LSPEED_V(FW_PORT_CAP_SPEED_40G))
                         speed = 40000;
+                else if (stat & FW_PORT_CMD_LSPEED_V(FW_PORT_CAP_SPEED_100G))
+                        speed = 100000;
 
                 /*
                  * Scan all of our "ports" (Virtual Interfaces) looking for
diff --git a/drivers/net/ethernet/davicom/dm9000.c b/drivers/net/ethernet/davicom/dm9000.c
index 1471e16ba719..f45385f5c6e5 100644
--- a/drivers/net/ethernet/davicom/dm9000.c
+++ b/drivers/net/ethernet/davicom/dm9000.c
@@ -1299,6 +1299,7 @@ static int
 dm9000_open(struct net_device *dev)
 {
         struct board_info *db = netdev_priv(dev);
+        unsigned int irq_flags = irq_get_trigger_type(dev->irq);
 
         if (netif_msg_ifup(db))
                 dev_dbg(db->dev, "enabling %s\n", dev->name);
@@ -1306,9 +1307,11 @@ dm9000_open(struct net_device *dev)
         /* If there is no IRQ type specified, tell the user that this is a
          * problem
          */
-        if (irq_get_trigger_type(dev->irq) == IRQF_TRIGGER_NONE)
+        if (irq_flags == IRQF_TRIGGER_NONE)
                 dev_warn(db->dev, "WARNING: no IRQ resource flags set.\n");
 
+        irq_flags |= IRQF_SHARED;
+
         /* GPIO0 on pre-activate PHY, Reg 1F is not set by reset */
         iow(db, DM9000_GPR, 0); /* REG_1F bit0 activate phyxcer */
         mdelay(1); /* delay needs by DM9000B */
@@ -1316,8 +1319,7 @@ dm9000_open(struct net_device *dev)
         /* Initialize DM9000 board */
         dm9000_init_dm9000(dev);
 
-        if (request_irq(dev->irq, dm9000_interrupt, IRQF_SHARED,
-                        dev->name, dev))
+        if (request_irq(dev->irq, dm9000_interrupt, irq_flags, dev->name, dev))
                 return -EAGAIN;
         /* Now that we have an interrupt handler hooked up we can unmask
          * our interrupts
diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c
index d20935dc8399..4b4f5bc0e279 100644
--- a/drivers/net/ethernet/freescale/gianfar.c
+++ b/drivers/net/ethernet/freescale/gianfar.c
@@ -2922,17 +2922,25 @@ static bool gfar_add_rx_frag(struct gfar_rx_buff *rxb, u32 lstatus,
 {
         unsigned int size = lstatus & BD_LENGTH_MASK;
         struct page *page = rxb->page;
+        bool last = !!(lstatus & BD_LFLAG(RXBD_LAST));
 
         /* Remove the FCS from the packet length */
-        if (likely(lstatus & BD_LFLAG(RXBD_LAST)))
+        if (last)
                 size -= ETH_FCS_LEN;
 
-        if (likely(first))
+        if (likely(first)) {
                 skb_put(skb, size);
-        else
-                skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, page,
-                                rxb->page_offset + RXBUF_ALIGNMENT,
-                                size, GFAR_RXB_TRUESIZE);
+        } else {
+                /* the last fragments' length contains the full frame length */
+                if (last)
+                        size -= skb->len;
+
+                /* in case the last fragment consisted only of the FCS */
+                if (size > 0)
+                        skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, page,
+                                        rxb->page_offset + RXBUF_ALIGNMENT,
+                                        size, GFAR_RXB_TRUESIZE);
+        }
 
         /* try reuse page */
         if (unlikely(page_count(page) != 1))
diff --git a/drivers/net/ethernet/freescale/gianfar.h b/drivers/net/ethernet/freescale/gianfar.h
index 373fd094f2f3..6e8a9c8467b9 100644
--- a/drivers/net/ethernet/freescale/gianfar.h
+++ b/drivers/net/ethernet/freescale/gianfar.h
@@ -100,7 +100,8 @@ extern const char gfar_driver_version[];
 #define DEFAULT_RX_LFC_THR  16
 #define DEFAULT_LFC_PTVVAL  4
 
-#define GFAR_RXB_SIZE 1536
+/* prevent fragmenation by HW in DSA environments */
+#define GFAR_RXB_SIZE roundup(1536 + 8, 64)
 #define GFAR_SKBFRAG_SIZE (RXBUF_ALIGNMENT + GFAR_RXB_SIZE \
                           + SKB_DATA_ALIGN(sizeof(struct skb_shared_info)))
 #define GFAR_RXB_TRUESIZE 2048
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c
index 1235c7f2564b..1e1eb92998fb 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c
@@ -17,7 +17,7 @@ static const struct mac_stats_string g_gmac_stats_string[] = {
         {"gmac_rx_octets_total_ok", MAC_STATS_FIELD_OFF(rx_good_bytes)},
         {"gmac_rx_octets_bad", MAC_STATS_FIELD_OFF(rx_bad_bytes)},
         {"gmac_rx_uc_pkts", MAC_STATS_FIELD_OFF(rx_uc_pkts)},
-        {"gamc_rx_mc_pkts", MAC_STATS_FIELD_OFF(rx_mc_pkts)},
+        {"gmac_rx_mc_pkts", MAC_STATS_FIELD_OFF(rx_mc_pkts)},
         {"gmac_rx_bc_pkts", MAC_STATS_FIELD_OFF(rx_bc_pkts)},
         {"gmac_rx_pkts_64octets", MAC_STATS_FIELD_OFF(rx_64bytes)},
         {"gmac_rx_pkts_65to127", MAC_STATS_FIELD_OFF(rx_65to127)},
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c
index ff8b6a468b24..6ea872287307 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c
@@ -328,9 +328,10 @@ static void hns_ppe_init_hw(struct hns_ppe_cb *ppe_cb)
 static void hns_ppe_uninit_hw(struct hns_ppe_cb *ppe_cb)
 {
         u32 port;
-        struct dsaf_device *dsaf_dev = ppe_cb->ppe_common_cb->dsaf_dev;
 
         if (ppe_cb->ppe_common_cb) {
+                struct dsaf_device *dsaf_dev = ppe_cb->ppe_common_cb->dsaf_dev;
+
                 port = ppe_cb->index;
                 dsaf_dev->misc_op->ppe_srst(dsaf_dev, port, 0);
         }
diff --git a/drivers/net/ethernet/ibm/emac/core.c b/drivers/net/ethernet/ibm/emac/core.c
index 4c9771d57d6e..7af09cbc53f0 100644
--- a/drivers/net/ethernet/ibm/emac/core.c
+++ b/drivers/net/ethernet/ibm/emac/core.c
@@ -977,7 +977,37 @@ static void emac_set_multicast_list(struct net_device *ndev)
                 dev->mcast_pending = 1;
                 return;
         }
+
+        mutex_lock(&dev->link_lock);
         __emac_set_multicast_list(dev);
+        mutex_unlock(&dev->link_lock);
+}
+
+static int emac_set_mac_address(struct net_device *ndev, void *sa)
+{
+        struct emac_instance *dev = netdev_priv(ndev);
+        struct sockaddr *addr = sa;
+        struct emac_regs __iomem *p = dev->emacp;
+
+        if (!is_valid_ether_addr(addr->sa_data))
+               return -EADDRNOTAVAIL;
+
+        mutex_lock(&dev->link_lock);
+
+        memcpy(ndev->dev_addr, addr->sa_data, ndev->addr_len);
+
+        emac_rx_disable(dev);
+        emac_tx_disable(dev);
+        out_be32(&p->iahr, (ndev->dev_addr[0] << 8) | ndev->dev_addr[1]);
+        out_be32(&p->ialr, (ndev->dev_addr[2] << 24) |
+                (ndev->dev_addr[3] << 16) | (ndev->dev_addr[4] << 8) |
+                ndev->dev_addr[5]);
+        emac_tx_enable(dev);
+        emac_rx_enable(dev);
+
+        mutex_unlock(&dev->link_lock);
+
+        return 0;
 }
 
 static int emac_resize_rx_ring(struct emac_instance *dev, int new_mtu)
@@ -2686,7 +2716,7 @@ static const struct net_device_ops emac_netdev_ops = {
         .ndo_do_ioctl           = emac_ioctl,
         .ndo_tx_timeout         = emac_tx_timeout,
         .ndo_validate_addr      = eth_validate_addr,
-        .ndo_set_mac_address    = eth_mac_addr,
+        .ndo_set_mac_address    = emac_set_mac_address,
         .ndo_start_xmit         = emac_start_xmit,
         .ndo_change_mtu         = eth_change_mtu,
 };
@@ -2699,7 +2729,7 @@ static const struct net_device_ops emac_gige_netdev_ops = {
         .ndo_do_ioctl           = emac_ioctl,
         .ndo_tx_timeout         = emac_tx_timeout,
         .ndo_validate_addr      = eth_validate_addr,
-        .ndo_set_mac_address    = eth_mac_addr,
+        .ndo_set_mac_address    = emac_set_mac_address,
         .ndo_start_xmit         = emac_start_xmit_sg,
         .ndo_change_mtu         = emac_change_mtu,
 };
diff --git a/drivers/net/ethernet/intel/e1000e/82571.c b/drivers/net/ethernet/intel/e1000e/82571.c
index 7fd4d54599e4..6b03c8553e59 100644
--- a/drivers/net/ethernet/intel/e1000e/82571.c
+++ b/drivers/net/ethernet/intel/e1000e/82571.c
@@ -2032,7 +2032,8 @@ const struct e1000_info e1000_82574_info = {
                                   | FLAG2_DISABLE_ASPM_L0S
                                   | FLAG2_DISABLE_ASPM_L1
                                   | FLAG2_NO_DISABLE_RX
-                                  | FLAG2_DMA_BURST,
+                                  | FLAG2_DMA_BURST
+                                  | FLAG2_CHECK_SYSTIM_OVERFLOW,
         .pba                    = 32,
         .max_hw_frame_size      = DEFAULT_JUMBO,
         .get_variants           = e1000_get_variants_82571,
@@ -2053,7 +2054,8 @@ const struct e1000_info e1000_82583_info = {
                                   | FLAG_HAS_CTRLEXT_ON_LOAD,
         .flags2                 = FLAG2_DISABLE_ASPM_L0S
                                   | FLAG2_DISABLE_ASPM_L1
-                                  | FLAG2_NO_DISABLE_RX,
+                                  | FLAG2_NO_DISABLE_RX
+                                  | FLAG2_CHECK_SYSTIM_OVERFLOW,
         .pba                    = 32,
         .max_hw_frame_size      = DEFAULT_JUMBO,
         .get_variants           = e1000_get_variants_82571,
diff --git a/drivers/net/ethernet/intel/e1000e/e1000.h b/drivers/net/ethernet/intel/e1000e/e1000.h
index ef96cd11d6d2..879cca47b021 100644
--- a/drivers/net/ethernet/intel/e1000e/e1000.h
+++ b/drivers/net/ethernet/intel/e1000e/e1000.h
@@ -452,6 +452,7 @@ s32 e1000e_get_base_timinca(struct e1000_adapter *adapter, u32 *timinca);
 #define FLAG2_PCIM2PCI_ARBITER_WA         BIT(11)
 #define FLAG2_DFLT_CRC_STRIPPING          BIT(12)
 #define FLAG2_CHECK_RX_HWTSTAMP           BIT(13)
+#define FLAG2_CHECK_SYSTIM_OVERFLOW       BIT(14)
 
 #define E1000_RX_DESC_PS(R, i)      \
         (&(((union e1000_rx_desc_packet_split *)((R).desc))[i]))
diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.c b/drivers/net/ethernet/intel/e1000e/ich8lan.c
index 3e11322d8d58..f3aaca743ea3 100644
--- a/drivers/net/ethernet/intel/e1000e/ich8lan.c
+++ b/drivers/net/ethernet/intel/e1000e/ich8lan.c
@@ -5885,7 +5885,8 @@ const struct e1000_info e1000_pch_lpt_info = {
                                   | FLAG_HAS_JUMBO_FRAMES
                                   | FLAG_APME_IN_WUC,
         .flags2                 = FLAG2_HAS_PHY_STATS
-                                  | FLAG2_HAS_EEE,
+                                  | FLAG2_HAS_EEE
+                                  | FLAG2_CHECK_SYSTIM_OVERFLOW,
         .pba                    = 26,
         .max_hw_frame_size      = 9022,
         .get_variants           = e1000_get_variants_ich8lan,
diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
index 02f443958f31..7017281ba2dc 100644
--- a/drivers/net/ethernet/intel/e1000e/netdev.c
+++ b/drivers/net/ethernet/intel/e1000e/netdev.c
@@ -4303,6 +4303,42 @@ void e1000e_reinit_locked(struct e1000_adapter *adapter)
 }
 
 /**
+ * e1000e_sanitize_systim - sanitize raw cycle counter reads
+ * @hw: pointer to the HW structure
+ * @systim: cycle_t value read, sanitized and returned
+ *
+ * Errata for 82574/82583 possible bad bits read from SYSTIMH/L:
+ * check to see that the time is incrementing at a reasonable
+ * rate and is a multiple of incvalue.
+ **/
+static cycle_t e1000e_sanitize_systim(struct e1000_hw *hw, cycle_t systim)
+{
+        u64 time_delta, rem, temp;
+        cycle_t systim_next;
+        u32 incvalue;
+        int i;
+
+        incvalue = er32(TIMINCA) & E1000_TIMINCA_INCVALUE_MASK;
+        for (i = 0; i < E1000_MAX_82574_SYSTIM_REREADS; i++) {
+                /* latch SYSTIMH on read of SYSTIML */
+                systim_next = (cycle_t)er32(SYSTIML);
+                systim_next |= (cycle_t)er32(SYSTIMH) << 32;
+
+                time_delta = systim_next - systim;
+                temp = time_delta;
+                /* VMWare users have seen incvalue of zero, don't div / 0 */
+                rem = incvalue ? do_div(temp, incvalue) : (time_delta != 0);
+
+                systim = systim_next;
+
+                if ((time_delta < E1000_82574_SYSTIM_EPSILON) && (rem == 0))
+                        break;
+        }
+
+        return systim;
+}
+
+/**
  * e1000e_cyclecounter_read - read raw cycle counter (used by time counter)
  * @cc: cyclecounter structure
  **/
@@ -4312,7 +4348,7 @@ static cycle_t e1000e_cyclecounter_read(const struct cyclecounter *cc)
                                                      cc);
         struct e1000_hw *hw = &adapter->hw;
         u32 systimel, systimeh;
-        cycle_t systim, systim_next;
+        cycle_t systim;
         /* SYSTIMH latching upon SYSTIML read does not work well.
          * This means that if SYSTIML overflows after we read it but before
          * we read SYSTIMH, the value of SYSTIMH has been incremented and we
@@ -4335,33 +4371,9 @@ static cycle_t e1000e_cyclecounter_read(const struct cyclecounter *cc)
         systim = (cycle_t)systimel;
         systim |= (cycle_t)systimeh << 32;
 
-        if ((hw->mac.type == e1000_82574) || (hw->mac.type == e1000_82583)) {
-                u64 time_delta, rem, temp;
-                u32 incvalue;
-                int i;
-
-                /* errata for 82574/82583 possible bad bits read from SYSTIMH/L
-                 * check to see that the time is incrementing at a reasonable
-                 * rate and is a multiple of incvalue
-                 */
-                incvalue = er32(TIMINCA) & E1000_TIMINCA_INCVALUE_MASK;
-                for (i = 0; i < E1000_MAX_82574_SYSTIM_REREADS; i++) {
-                        /* latch SYSTIMH on read of SYSTIML */
-                        systim_next = (cycle_t)er32(SYSTIML);
-                        systim_next |= (cycle_t)er32(SYSTIMH) << 32;
-
-                        time_delta = systim_next - systim;
-                        temp = time_delta;
-                        /* VMWare users have seen incvalue of zero, don't div / 0 */
-                        rem = incvalue ? do_div(temp, incvalue) : (time_delta != 0);
-
-                        systim = systim_next;
+        if (adapter->flags2 & FLAG2_CHECK_SYSTIM_OVERFLOW)
+                systim = e1000e_sanitize_systim(hw, systim);
 
-                        if ((time_delta < E1000_82574_SYSTIM_EPSILON) &&
-                            (rem == 0))
-                                break;
-                }
-        }
         return systim;
 }
 
diff --git a/drivers/net/ethernet/intel/i40e/i40e_client.c b/drivers/net/ethernet/intel/i40e/i40e_client.c
index e1370c556a3c..618f18436618 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_client.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_client.c
@@ -199,6 +199,7 @@ void i40e_notify_client_of_l2_param_changes(struct i40e_vsi *vsi)
 void i40e_notify_client_of_netdev_open(struct i40e_vsi *vsi)
 {
         struct i40e_client_instance *cdev;
+        int ret = 0;
 
         if (!vsi)
                 return;
@@ -211,7 +212,14 @@ void i40e_notify_client_of_netdev_open(struct i40e_vsi *vsi)
                                         "Cannot locate client instance open routine\n");
                                 continue;
                         }
-                        cdev->client->ops->open(&cdev->lan_info, cdev->client);
+                        if (!(test_bit(__I40E_CLIENT_INSTANCE_OPENED,
+                                       &cdev->state))) {
+                                ret = cdev->client->ops->open(&cdev->lan_info,
+                                                              cdev->client);
+                                if (!ret)
+                                        set_bit(__I40E_CLIENT_INSTANCE_OPENED,
+                                                &cdev->state);
+                        }
                 }
         }
         mutex_unlock(&i40e_client_instance_mutex);
@@ -407,12 +415,14 @@ struct i40e_vsi *i40e_vsi_lookup(struct i40e_pf *pf,
  * i40e_client_add_instance - add a client instance struct to the instance list
  * @pf: pointer to the board struct
  * @client: pointer to a client struct in the client list.
+ * @existing: if there was already an existing instance
  *
- * Returns cdev ptr on success, NULL on failure
+ * Returns cdev ptr on success or if already exists, NULL on failure
  **/
 static
 struct i40e_client_instance *i40e_client_add_instance(struct i40e_pf *pf,
-                                                      struct i40e_client *client)
+                                                     struct i40e_client *client,
+                                                     bool *existing)
 {
         struct i40e_client_instance *cdev;
         struct netdev_hw_addr *mac = NULL;
@@ -421,7 +431,7 @@ struct i40e_client_instance *i40e_client_add_instance(struct i40e_pf *pf,
         mutex_lock(&i40e_client_instance_mutex);
         list_for_each_entry(cdev, &i40e_client_instances, list) {
                 if ((cdev->lan_info.pf == pf) && (cdev->client == client)) {
-                        cdev = NULL;
+                        *existing = true;
                         goto out;
                 }
         }
@@ -505,6 +515,7 @@ void i40e_client_subtask(struct i40e_pf *pf)
 {
         struct i40e_client_instance *cdev;
         struct i40e_client *client;
+        bool existing = false;
         int ret = 0;
 
         if (!(pf->flags & I40E_FLAG_SERVICE_CLIENT_REQUESTED))
@@ -528,18 +539,25 @@ void i40e_client_subtask(struct i40e_pf *pf)
                         /* check if L2 VSI is up, if not we are not ready */
                         if (test_bit(__I40E_DOWN, &pf->vsi[pf->lan_vsi]->state))
                                 continue;
+                } else {
+                        dev_warn(&pf->pdev->dev, "This client %s is being instanciated at probe\n",
+                                 client->name);
                 }
 
                 /* Add the client instance to the instance list */
-                cdev = i40e_client_add_instance(pf, client);
+                cdev = i40e_client_add_instance(pf, client, &existing);
                 if (!cdev)
                         continue;
 
-                /* Also up the ref_cnt of no. of instances of this client */
-                atomic_inc(&client->ref_cnt);
-                dev_info(&pf->pdev->dev, "Added instance of Client %s to PF%d bus=0x%02x func=0x%02x\n",
-                         client->name, pf->hw.pf_id,
-                         pf->hw.bus.device, pf->hw.bus.func);
+                if (!existing) {
+                        /* Also up the ref_cnt for no. of instances of this
+                         * client.
+                         */
+                        atomic_inc(&client->ref_cnt);
+                        dev_info(&pf->pdev->dev, "Added instance of Client %s to PF%d bus=0x%02x func=0x%02x\n",
+                                 client->name, pf->hw.pf_id,
+                                 pf->hw.bus.device, pf->hw.bus.func);
+                }
 
                 /* Send an Open request to the client */
                 atomic_inc(&cdev->ref_cnt);
@@ -588,7 +606,8 @@ int i40e_lan_add_device(struct i40e_pf *pf)
                  pf->hw.pf_id, pf->hw.bus.device, pf->hw.bus.func);
 
         /* Since in some cases register may have happened before a device gets
-         * added, we can schedule a subtask to go initiate the clients.
+         * added, we can schedule a subtask to go initiate the clients if
+         * they can be launched at probe time.
          */
         pf->flags |= I40E_FLAG_SERVICE_CLIENT_REQUESTED;
         i40e_service_event_schedule(pf);
diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
index 81c99e1be708..d0b3a1bb82ca 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
@@ -4554,23 +4554,38 @@ static u8 i40e_get_iscsi_tc_map(struct i40e_pf *pf)
  **/
 static u8 i40e_dcb_get_num_tc(struct i40e_dcbx_config *dcbcfg)
 {
+        int i, tc_unused = 0;
         u8 num_tc = 0;
-        int i;
+        u8 ret = 0;
 
         /* Scan the ETS Config Priority Table to find
          * traffic class enabled for a given priority
-         * and use the traffic class index to get the
-         * number of traffic classes enabled
+         * and create a bitmask of enabled TCs
          */
-        for (i = 0; i < I40E_MAX_USER_PRIORITY; i++) {
-                if (dcbcfg->etscfg.prioritytable[i] > num_tc)
-                        num_tc = dcbcfg->etscfg.prioritytable[i];
-        }
+        for (i = 0; i < I40E_MAX_USER_PRIORITY; i++)
+                num_tc |= BIT(dcbcfg->etscfg.prioritytable[i]);
 
-        /* Traffic class index starts from zero so
-         * increment to return the actual count
+        /* Now scan the bitmask to check for
+         * contiguous TCs starting with TC0
          */
-        return num_tc + 1;
+        for (i = 0; i < I40E_MAX_TRAFFIC_CLASS; i++) {
+                if (num_tc & BIT(i)) {
+                        if (!tc_unused) {
+                                ret++;
+                        } else {
+                                pr_err("Non-contiguous TC - Disabling DCB\n");
+                                return 1;
+                        }
+                } else {
+                        tc_unused = 1;
+                }
+        }
+
+        /* There is always at least TC0 */
+        if (!ret)
+                ret = 1;
+
+        return ret;
 }
 
 /**
@@ -5098,9 +5113,13 @@ static int i40e_init_pf_dcb(struct i40e_pf *pf)
                                        DCB_CAP_DCBX_VER_IEEE;
 
                         pf->flags |= I40E_FLAG_DCB_CAPABLE;
-                        /* Enable DCB tagging only when more than one TC */
+                        /* Enable DCB tagging only when more than one TC
+                         * or explicitly disable if only one TC
+                         */
                         if (i40e_dcb_get_num_tc(&hw->local_dcbx_config) > 1)
                                 pf->flags |= I40E_FLAG_DCB_ENABLED;
+                        else
+                                pf->flags &= ~I40E_FLAG_DCB_ENABLED;
                         dev_dbg(&pf->pdev->dev,
                                 "DCBX offload is supported for this PF.\n");
                 }
@@ -5416,7 +5435,6 @@ int i40e_open(struct net_device *netdev)
         wr32(&pf->hw, I40E_GLLAN_TSOMSK_L, be32_to_cpu(TCP_FLAG_CWR) >> 16);
 
         udp_tunnel_get_rx_info(netdev);
-        i40e_notify_client_of_netdev_open(vsi);
 
         return 0;
 }
@@ -5702,7 +5720,7 @@ static int i40e_handle_lldp_event(struct i40e_pf *pf,
         u8 type;
 
         /* Not DCB capable or capability disabled */
-        if (!(pf->flags & I40E_FLAG_DCB_CAPABLE))
+        if (!(pf->flags & I40E_FLAG_DCB_ENABLED))
                 return ret;
 
         /* Ignore if event is not for Nearest Bridge */
@@ -7882,6 +7900,7 @@ static int i40e_init_interrupt_scheme(struct i40e_pf *pf)
 #endif
                                        I40E_FLAG_RSS_ENABLED    |
                                        I40E_FLAG_DCB_CAPABLE    |
+                                       I40E_FLAG_DCB_ENABLED    |
                                        I40E_FLAG_SRIOV_ENABLED  |
                                        I40E_FLAG_FD_SB_ENABLED  |
                                        I40E_FLAG_FD_ATR_ENABLED |
@@ -10488,6 +10507,7 @@ static void i40e_determine_queue_usage(struct i40e_pf *pf)
                                I40E_FLAG_FD_SB_ENABLED  |
                                I40E_FLAG_FD_ATR_ENABLED |
                                I40E_FLAG_DCB_CAPABLE    |
+                               I40E_FLAG_DCB_ENABLED    |
                                I40E_FLAG_SRIOV_ENABLED  |
                                I40E_FLAG_VMDQ_ENABLED);
         } else if (!(pf->flags & (I40E_FLAG_RSS_ENABLED |
@@ -10511,7 +10531,8 @@ static void i40e_determine_queue_usage(struct i40e_pf *pf)
                 /* Not enough queues for all TCs */
                 if ((pf->flags & I40E_FLAG_DCB_CAPABLE) &&
                     (queues_left < I40E_MAX_TRAFFIC_CLASS)) {
-                        pf->flags &= ~I40E_FLAG_DCB_CAPABLE;
+                        pf->flags &= ~(I40E_FLAG_DCB_CAPABLE |
+                                        I40E_FLAG_DCB_ENABLED);
                         dev_info(&pf->pdev->dev, "not enough queues for DCB. DCB is disabled.\n");
                 }
                 pf->num_lan_qps = max_t(int, pf->rss_size_max,
@@ -10908,7 +10929,7 @@ static int i40e_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         err = i40e_init_pf_dcb(pf);
         if (err) {
                 dev_info(&pdev->dev, "DCB init failed %d, disabled\n", err);
-                pf->flags &= ~I40E_FLAG_DCB_CAPABLE;
+                pf->flags &= ~(I40E_FLAG_DCB_CAPABLE & I40E_FLAG_DCB_ENABLED);
                 /* Continue without DCB enabled */
         }
 #endif /* CONFIG_I40E_DCB */
diff --git a/drivers/net/ethernet/intel/igb/igb_ptp.c b/drivers/net/ethernet/intel/igb/igb_ptp.c
index e61b647f5f2a..336c103ae374 100644
--- a/drivers/net/ethernet/intel/igb/igb_ptp.c
+++ b/drivers/net/ethernet/intel/igb/igb_ptp.c
@@ -744,7 +744,8 @@ static void igb_ptp_tx_hwtstamp(struct igb_adapter *adapter)
                 }
         }
 
-        shhwtstamps.hwtstamp = ktime_sub_ns(shhwtstamps.hwtstamp, adjust);
+        shhwtstamps.hwtstamp =
+                ktime_add_ns(shhwtstamps.hwtstamp, adjust);
 
         skb_tstamp_tx(adapter->ptp_tx_skb, &shhwtstamps);
         dev_kfree_skb_any(adapter->ptp_tx_skb);
@@ -767,13 +768,32 @@ void igb_ptp_rx_pktstamp(struct igb_q_vector *q_vector,
                          struct sk_buff *skb)
 {
         __le64 *regval = (__le64 *)va;
+        struct igb_adapter *adapter = q_vector->adapter;
+        int adjust = 0;
 
         /* The timestamp is recorded in little endian format.
          * DWORD: 0        1        2        3
          * Field: Reserved Reserved SYSTIML  SYSTIMH
          */
-        igb_ptp_systim_to_hwtstamp(q_vector->adapter, skb_hwtstamps(skb),
+        igb_ptp_systim_to_hwtstamp(adapter, skb_hwtstamps(skb),
                                    le64_to_cpu(regval[1]));
+
+        /* adjust timestamp for the RX latency based on link speed */
+        if (adapter->hw.mac.type == e1000_i210) {
+                switch (adapter->link_speed) {
+                case SPEED_10:
+                        adjust = IGB_I210_RX_LATENCY_10;
+                        break;
+                case SPEED_100:
+                        adjust = IGB_I210_RX_LATENCY_100;
+                        break;
+                case SPEED_1000:
+                        adjust = IGB_I210_RX_LATENCY_1000;
+                        break;
+                }
+        }
+        skb_hwtstamps(skb)->hwtstamp =
+                ktime_sub_ns(skb_hwtstamps(skb)->hwtstamp, adjust);
 }
 
 /**
@@ -825,7 +845,7 @@ void igb_ptp_rx_rgtstamp(struct igb_q_vector *q_vector,
                 }
         }
         skb_hwtstamps(skb)->hwtstamp =
-                ktime_add_ns(skb_hwtstamps(skb)->hwtstamp, adjust);
+                ktime_sub_ns(skb_hwtstamps(skb)->hwtstamp, adjust);
 
         /* Update the last_rx_timestamp timer in order to enable watchdog check
          * for error case of latched timestamp on a dropped packet.
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c
index b4217f30e89c..c47b605e8651 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c
@@ -2958,8 +2958,10 @@ s32 ixgbe_clear_vmdq_generic(struct ixgbe_hw *hw, u32 rar, u32 vmdq)
         }
 
         /* was that the last pool using this rar? */
-        if (mpsar_lo == 0 && mpsar_hi == 0 && rar != 0)
+        if (mpsar_lo == 0 && mpsar_hi == 0 &&
+            rar != 0 && rar != hw->mac.san_mac_rar_index)
                 hw->mac.ops.clear_rar(hw, rar);
+
         return 0;
 }
 
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index 5418c69a7463..b4f03748adc0 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -4100,6 +4100,8 @@ static void ixgbe_vlan_promisc_enable(struct ixgbe_adapter *adapter)
         struct ixgbe_hw *hw = &adapter->hw;
         u32 vlnctrl, i;
 
+        vlnctrl = IXGBE_READ_REG(hw, IXGBE_VLNCTRL);
+
         switch (hw->mac.type) {
         case ixgbe_mac_82599EB:
         case ixgbe_mac_X540:
@@ -4112,8 +4114,7 @@ static void ixgbe_vlan_promisc_enable(struct ixgbe_adapter *adapter)
                 /* fall through */
         case ixgbe_mac_82598EB:
                 /* legacy case, we can just disable VLAN filtering */
-                vlnctrl = IXGBE_READ_REG(hw, IXGBE_VLNCTRL);
-                vlnctrl &= ~(IXGBE_VLNCTRL_VFE | IXGBE_VLNCTRL_CFIEN);
+                vlnctrl &= ~IXGBE_VLNCTRL_VFE;
                 IXGBE_WRITE_REG(hw, IXGBE_VLNCTRL, vlnctrl);
                 return;
         }
@@ -4125,6 +4126,10 @@ static void ixgbe_vlan_promisc_enable(struct ixgbe_adapter *adapter)
         /* Set flag so we don't redo unnecessary work */
         adapter->flags2 |= IXGBE_FLAG2_VLAN_PROMISC;
 
+        /* For VMDq and SR-IOV we must leave VLAN filtering enabled */
+        vlnctrl |= IXGBE_VLNCTRL_VFE;
+        IXGBE_WRITE_REG(hw, IXGBE_VLNCTRL, vlnctrl);
+
         /* Add PF to all active pools */
         for (i = IXGBE_VLVF_ENTRIES; --i;) {
                 u32 reg_offset = IXGBE_VLVFB(i * 2 + VMDQ_P(0) / 32);
@@ -4191,6 +4196,11 @@ static void ixgbe_vlan_promisc_disable(struct ixgbe_adapter *adapter)
         struct ixgbe_hw *hw = &adapter->hw;
         u32 vlnctrl, i;
 
+        /* Set VLAN filtering to enabled */
+        vlnctrl = IXGBE_READ_REG(hw, IXGBE_VLNCTRL);
+        vlnctrl |= IXGBE_VLNCTRL_VFE;
+        IXGBE_WRITE_REG(hw, IXGBE_VLNCTRL, vlnctrl);
+
         switch (hw->mac.type) {
         case ixgbe_mac_82599EB:
         case ixgbe_mac_X540:
@@ -4202,10 +4212,6 @@ static void ixgbe_vlan_promisc_disable(struct ixgbe_adapter *adapter)
                         break;
                 /* fall through */
         case ixgbe_mac_82598EB:
-                vlnctrl = IXGBE_READ_REG(hw, IXGBE_VLNCTRL);
-                vlnctrl &= ~IXGBE_VLNCTRL_CFIEN;
-                vlnctrl |= IXGBE_VLNCTRL_VFE;
-                IXGBE_WRITE_REG(hw, IXGBE_VLNCTRL, vlnctrl);
                 return;
         }
 
@@ -8390,12 +8396,14 @@ static int parse_tc_actions(struct ixgbe_adapter *adapter,
                             struct tcf_exts *exts, u64 *action, u8 *queue)
 {
         const struct tc_action *a;
+        LIST_HEAD(actions);
         int err;
 
         if (tc_no_actions(exts))
                 return -EINVAL;
 
-        tc_for_each_action(a, exts) {
+        tcf_exts_to_list(exts, &actions);
+        list_for_each_entry(a, &actions, list) {
 
                 /* Drop action */
                 if (is_tcf_gact_shot(a)) {
@@ -9517,6 +9525,7 @@ skip_sriov:
 
         /* copy netdev features into list of user selectable features */
         netdev->hw_features |= netdev->features |
+                               NETIF_F_HW_VLAN_CTAG_FILTER |
                                NETIF_F_HW_VLAN_CTAG_RX |
                                NETIF_F_HW_VLAN_CTAG_TX |
                                NETIF_F_RXALL |
diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
index b57ae3afb994..3743af8f1ded 100644
--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
@@ -50,6 +50,10 @@ static const struct mtk_ethtool_stats {
         MTK_ETHTOOL_STAT(rx_flow_control_packets),
 };
 
+static const char * const mtk_clks_source_name[] = {
+        "ethif", "esw", "gp1", "gp2"
+};
+
 void mtk_w32(struct mtk_eth *eth, u32 val, unsigned reg)
 {
         __raw_writel(val, eth->base + reg);
@@ -245,12 +249,16 @@ static int mtk_phy_connect(struct mtk_mac *mac)
         case PHY_INTERFACE_MODE_MII:
                 ge_mode = 1;
                 break;
-        case PHY_INTERFACE_MODE_RMII:
+        case PHY_INTERFACE_MODE_REVMII:
                 ge_mode = 2;
                 break;
+        case PHY_INTERFACE_MODE_RMII:
+                if (!mac->id)
+                        goto err_phy;
+                ge_mode = 3;
+                break;
         default:
-                dev_err(eth->dev, "invalid phy_mode\n");
-                return -1;
+                goto err_phy;
         }
 
         /* put the gmac into the right mode */
@@ -263,19 +271,31 @@ static int mtk_phy_connect(struct mtk_mac *mac)
         mac->phy_dev->autoneg = AUTONEG_ENABLE;
         mac->phy_dev->speed = 0;
         mac->phy_dev->duplex = 0;
+
+        if (of_phy_is_fixed_link(mac->of_node))
+                mac->phy_dev->supported |=
+                SUPPORTED_Pause | SUPPORTED_Asym_Pause;
+
         mac->phy_dev->supported &= PHY_GBIT_FEATURES | SUPPORTED_Pause |
                                    SUPPORTED_Asym_Pause;
         mac->phy_dev->advertising = mac->phy_dev->supported |
                                     ADVERTISED_Autoneg;
         phy_start_aneg(mac->phy_dev);
 
+        of_node_put(np);
+
         return 0;
+
+err_phy:
+        of_node_put(np);
+        dev_err(eth->dev, "invalid phy_mode\n");
+        return -EINVAL;
 }
 
 static int mtk_mdio_init(struct mtk_eth *eth)
 {
         struct device_node *mii_np;
-        int err;
+        int ret;
 
         mii_np = of_get_child_by_name(eth->dev->of_node, "mdio-bus");
         if (!mii_np) {
@@ -284,13 +304,13 @@ static int mtk_mdio_init(struct mtk_eth *eth)
         }
 
         if (!of_device_is_available(mii_np)) {
-                err = 0;
+                ret = -ENODEV;
                 goto err_put_node;
         }
 
-        eth->mii_bus = mdiobus_alloc();
+        eth->mii_bus = devm_mdiobus_alloc(eth->dev);
         if (!eth->mii_bus) {
-                err = -ENOMEM;
+                ret = -ENOMEM;
                 goto err_put_node;
         }
 
@@ -301,19 +321,11 @@ static int mtk_mdio_init(struct mtk_eth *eth)
         eth->mii_bus->parent = eth->dev;
 
         snprintf(eth->mii_bus->id, MII_BUS_ID_SIZE, "%s", mii_np->name);
-        err = of_mdiobus_register(eth->mii_bus, mii_np);
-        if (err)
-                goto err_free_bus;
-
-        return 0;
-
-err_free_bus:
-        mdiobus_free(eth->mii_bus);
+        ret = of_mdiobus_register(eth->mii_bus, mii_np);
 
 err_put_node:
         of_node_put(mii_np);
-        eth->mii_bus = NULL;
-        return err;
+        return ret;
 }
 
 static void mtk_mdio_cleanup(struct mtk_eth *eth)
@@ -322,8 +334,6 @@ static void mtk_mdio_cleanup(struct mtk_eth *eth)
                 return;
 
         mdiobus_unregister(eth->mii_bus);
-        of_node_put(eth->mii_bus->dev.of_node);
-        mdiobus_free(eth->mii_bus);
 }
 
 static inline void mtk_irq_disable(struct mtk_eth *eth, u32 mask)
@@ -542,15 +552,15 @@ static inline struct mtk_tx_buf *mtk_desc_to_tx_buf(struct mtk_tx_ring *ring,
         return &ring->buf[idx];
 }
 
-static void mtk_tx_unmap(struct device *dev, struct mtk_tx_buf *tx_buf)
+static void mtk_tx_unmap(struct mtk_eth *eth, struct mtk_tx_buf *tx_buf)
 {
         if (tx_buf->flags & MTK_TX_FLAGS_SINGLE0) {
-                dma_unmap_single(dev,
+                dma_unmap_single(eth->dev,
                                  dma_unmap_addr(tx_buf, dma_addr0),
                                  dma_unmap_len(tx_buf, dma_len0),
                                  DMA_TO_DEVICE);
         } else if (tx_buf->flags & MTK_TX_FLAGS_PAGE0) {
-                dma_unmap_page(dev,
+                dma_unmap_page(eth->dev,
                                dma_unmap_addr(tx_buf, dma_addr0),
                                dma_unmap_len(tx_buf, dma_len0),
                                DMA_TO_DEVICE);
@@ -572,14 +582,15 @@ static int mtk_tx_map(struct sk_buff *skb, struct net_device *dev,
         dma_addr_t mapped_addr;
         unsigned int nr_frags;
         int i, n_desc = 1;
-        u32 txd4 = 0;
+        u32 txd4 = 0, fport;
 
         itxd = ring->next_free;
         if (itxd == ring->last_free)
                 return -ENOMEM;
 
         /* set the forward port */
-        txd4 |= (mac->id + 1) << TX_DMA_FPORT_SHIFT;
+        fport = (mac->id + 1) << TX_DMA_FPORT_SHIFT;
+        txd4 |= fport;
 
         tx_buf = mtk_desc_to_tx_buf(ring, itxd);
         memset(tx_buf, 0, sizeof(*tx_buf));
@@ -595,9 +606,9 @@ static int mtk_tx_map(struct sk_buff *skb, struct net_device *dev,
         if (skb_vlan_tag_present(skb))
                 txd4 |= TX_DMA_INS_VLAN | skb_vlan_tag_get(skb);
 
-        mapped_addr = dma_map_single(&dev->dev, skb->data,
+        mapped_addr = dma_map_single(eth->dev, skb->data,
                                      skb_headlen(skb), DMA_TO_DEVICE);
-        if (unlikely(dma_mapping_error(&dev->dev, mapped_addr)))
+        if (unlikely(dma_mapping_error(eth->dev, mapped_addr)))
                 return -ENOMEM;
 
         WRITE_ONCE(itxd->txd1, mapped_addr);
@@ -623,10 +634,10 @@ static int mtk_tx_map(struct sk_buff *skb, struct net_device *dev,
 
                         n_desc++;
                         frag_map_size = min(frag_size, MTK_TX_DMA_BUF_LEN);
-                        mapped_addr = skb_frag_dma_map(&dev->dev, frag, offset,
+                        mapped_addr = skb_frag_dma_map(eth->dev, frag, offset,
                                                        frag_map_size,
                                                        DMA_TO_DEVICE);
-                        if (unlikely(dma_mapping_error(&dev->dev, mapped_addr)))
+                        if (unlikely(dma_mapping_error(eth->dev, mapped_addr)))
                                 goto err_dma;
 
                         if (i == nr_frags - 1 &&
@@ -637,7 +648,7 @@ static int mtk_tx_map(struct sk_buff *skb, struct net_device *dev,
                         WRITE_ONCE(txd->txd3, (TX_DMA_SWC |
                                                TX_DMA_PLEN0(frag_map_size) |
                                                last_frag * TX_DMA_LS0));
-                        WRITE_ONCE(txd->txd4, 0);
+                        WRITE_ONCE(txd->txd4, fport);
 
                         tx_buf->skb = (struct sk_buff *)MTK_DMA_DUMMY_DESC;
                         tx_buf = mtk_desc_to_tx_buf(ring, txd);
@@ -679,7 +690,7 @@ err_dma:
                 tx_buf = mtk_desc_to_tx_buf(ring, itxd);
 
                 /* unmap dma */
-                mtk_tx_unmap(&dev->dev, tx_buf);
+                mtk_tx_unmap(eth, tx_buf);
 
                 itxd->txd3 = TX_DMA_LS0 | TX_DMA_OWNER_CPU;
                 itxd = mtk_qdma_phys_to_virt(ring, itxd->txd2);
@@ -836,11 +847,11 @@ static int mtk_poll_rx(struct napi_struct *napi, int budget,
                         netdev->stats.rx_dropped++;
                         goto release_desc;
                 }
-                dma_addr = dma_map_single(&eth->netdev[mac]->dev,
+                dma_addr = dma_map_single(eth->dev,
                                           new_data + NET_SKB_PAD,
                                           ring->buf_size,
                                           DMA_FROM_DEVICE);
-                if (unlikely(dma_mapping_error(&netdev->dev, dma_addr))) {
+                if (unlikely(dma_mapping_error(eth->dev, dma_addr))) {
                         skb_free_frag(new_data);
                         netdev->stats.rx_dropped++;
                         goto release_desc;
@@ -849,13 +860,13 @@ static int mtk_poll_rx(struct napi_struct *napi, int budget,
                 /* receive data */
                 skb = build_skb(data, ring->frag_size);
                 if (unlikely(!skb)) {
-                        put_page(virt_to_head_page(new_data));
+                        skb_free_frag(new_data);
                         netdev->stats.rx_dropped++;
                         goto release_desc;
                 }
                 skb_reserve(skb, NET_SKB_PAD + NET_IP_ALIGN);
 
-                dma_unmap_single(&netdev->dev, trxd.rxd1,
+                dma_unmap_single(eth->dev, trxd.rxd1,
                                  ring->buf_size, DMA_FROM_DEVICE);
                 pktlen = RX_DMA_GET_PLEN0(trxd.rxd2);
                 skb->dev = netdev;
@@ -937,7 +948,7 @@ static int mtk_poll_tx(struct mtk_eth *eth, int budget)
                         done[mac]++;
                         budget--;
                 }
-                mtk_tx_unmap(eth->dev, tx_buf);
+                mtk_tx_unmap(eth, tx_buf);
 
                 ring->last_free = desc;
                 atomic_inc(&ring->free_count);
@@ -1092,7 +1103,7 @@ static void mtk_tx_clean(struct mtk_eth *eth)
 
         if (ring->buf) {
                 for (i = 0; i < MTK_DMA_SIZE; i++)
-                        mtk_tx_unmap(eth->dev, &ring->buf[i]);
+                        mtk_tx_unmap(eth, &ring->buf[i]);
                 kfree(ring->buf);
                 ring->buf = NULL;
         }
@@ -1490,10 +1501,7 @@ static void mtk_uninit(struct net_device *dev)
         struct mtk_eth *eth = mac->hw;
 
         phy_disconnect(mac->phy_dev);
-        mtk_mdio_cleanup(eth);
         mtk_irq_disable(eth, ~0);
-        free_irq(eth->irq[1], dev);
-        free_irq(eth->irq[2], dev);
 }
 
 static int mtk_do_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
@@ -1751,6 +1759,7 @@ static int mtk_add_mac(struct mtk_eth *eth, struct device_node *np)
                 goto free_netdev;
         }
         spin_lock_init(&mac->hw_stats->stats_lock);
+        u64_stats_init(&mac->hw_stats->syncp);
         mac->hw_stats->reg_offset = id * MTK_STAT_OFFSET;
 
         SET_NETDEV_DEV(eth->netdev[id], eth->dev);
@@ -1796,6 +1805,7 @@ static int mtk_probe(struct platform_device *pdev)
         if (!eth)
                 return -ENOMEM;
 
+        eth->dev = &pdev->dev;
         eth->base = devm_ioremap_resource(&pdev->dev, res);
         if (IS_ERR(eth->base))
                 return PTR_ERR(eth->base);
@@ -1830,21 +1840,21 @@ static int mtk_probe(struct platform_device *pdev)
                         return -ENXIO;
                 }
         }
+        for (i = 0; i < ARRAY_SIZE(eth->clks); i++) {
+                eth->clks[i] = devm_clk_get(eth->dev,
+                                            mtk_clks_source_name[i]);
+                if (IS_ERR(eth->clks[i])) {
+                        if (PTR_ERR(eth->clks[i]) == -EPROBE_DEFER)
+                                return -EPROBE_DEFER;
+                        return -ENODEV;
+                }
+        }
 
-        eth->clk_ethif = devm_clk_get(&pdev->dev, "ethif");
-        eth->clk_esw = devm_clk_get(&pdev->dev, "esw");
-        eth->clk_gp1 = devm_clk_get(&pdev->dev, "gp1");
-        eth->clk_gp2 = devm_clk_get(&pdev->dev, "gp2");
-        if (IS_ERR(eth->clk_esw) || IS_ERR(eth->clk_gp1) ||
-            IS_ERR(eth->clk_gp2) || IS_ERR(eth->clk_ethif))
-                return -ENODEV;
-
-        clk_prepare_enable(eth->clk_ethif);
-        clk_prepare_enable(eth->clk_esw);
-        clk_prepare_enable(eth->clk_gp1);
-        clk_prepare_enable(eth->clk_gp2);
+        clk_prepare_enable(eth->clks[MTK_CLK_ETHIF]);
+        clk_prepare_enable(eth->clks[MTK_CLK_ESW]);
+        clk_prepare_enable(eth->clks[MTK_CLK_GP1]);
+        clk_prepare_enable(eth->clks[MTK_CLK_GP2]);
 
-        eth->dev = &pdev->dev;
         eth->msg_enable = netif_msg_init(mtk_msg_level, MTK_DEFAULT_MSG_ENABLE);
         INIT_WORK(&eth->pending_work, mtk_pending_work);
 
@@ -1886,15 +1896,24 @@ err_free_dev:
 static int mtk_remove(struct platform_device *pdev)
 {
         struct mtk_eth *eth = platform_get_drvdata(pdev);
+        int i;
 
-        clk_disable_unprepare(eth->clk_ethif);
-        clk_disable_unprepare(eth->clk_esw);
-        clk_disable_unprepare(eth->clk_gp1);
-        clk_disable_unprepare(eth->clk_gp2);
+        /* stop all devices to make sure that dma is properly shut down */
+        for (i = 0; i < MTK_MAC_COUNT; i++) {
+                if (!eth->netdev[i])
+                        continue;
+                mtk_stop(eth->netdev[i]);
+        }
+
+        clk_disable_unprepare(eth->clks[MTK_CLK_ETHIF]);
+        clk_disable_unprepare(eth->clks[MTK_CLK_ESW]);
+        clk_disable_unprepare(eth->clks[MTK_CLK_GP1]);
+        clk_disable_unprepare(eth->clks[MTK_CLK_GP2]);
 
         netif_napi_del(&eth->tx_napi);
         netif_napi_del(&eth->rx_napi);
         mtk_cleanup(eth);
+        mtk_mdio_cleanup(eth);
         platform_set_drvdata(pdev, NULL);
 
         return 0;
@@ -1904,6 +1923,7 @@ const struct of_device_id of_mtk_match[] = {
         { .compatible = "mediatek,mt7623-eth" },
         {},
 };
+MODULE_DEVICE_TABLE(of, of_mtk_match);
 
 static struct platform_driver mtk_driver = {
         .probe = mtk_probe,
diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.h b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
index f82e3acb947b..6e1ade7a25c5 100644
--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
@@ -290,6 +290,17 @@ enum mtk_tx_flags {
         MTK_TX_FLAGS_PAGE0      = 0x02,
 };
 
+/* This enum allows us to identify how the clock is defined on the array of the
+ * clock in the order
+ */
+enum mtk_clks_map {
+        MTK_CLK_ETHIF,
+        MTK_CLK_ESW,
+        MTK_CLK_GP1,
+        MTK_CLK_GP2,
+        MTK_CLK_MAX
+};
+
 /* struct mtk_tx_buf -  This struct holds the pointers to the memory pointed at
  *                      by the TX descriptor    s
  * @skb:                The SKB pointer of the packet being sent
@@ -370,10 +381,7 @@ struct mtk_rx_ring {
  * @scratch_ring:       Newer SoCs need memory for a second HW managed TX ring
  * @phy_scratch_ring:   physical address of scratch_ring
  * @scratch_head:       The scratch memory that scratch_ring points to.
- * @clk_ethif:          The ethif clock
- * @clk_esw:            The switch clock
- * @clk_gp1:            The gmac1 clock
- * @clk_gp2:            The gmac2 clock
+ * @clks:               clock array for all clocks required
  * @mii_bus:            If there is a bus we need to create an instance for it
  * @pending_work:       The workqueue used to reset the dma ring
  */
@@ -400,10 +408,8 @@ struct mtk_eth {
         struct mtk_tx_dma               *scratch_ring;
         dma_addr_t                      phy_scratch_ring;
         void                            *scratch_head;
-        struct clk                      *clk_ethif;
-        struct clk                      *clk_esw;
-        struct clk                      *clk_gp1;
-        struct clk                      *clk_gp2;
+        struct clk                      *clks[MTK_CLK_MAX];
+
         struct mii_bus                  *mii_bus;
         struct work_struct              pending_work;
 };
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_dcb_nl.c b/drivers/net/ethernet/mellanox/mlx4/en_dcb_nl.c
index 99c6bbdff501..b04760a5034b 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_dcb_nl.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_dcb_nl.c
@@ -94,7 +94,7 @@ static u8 mlx4_en_dcbnl_getcap(struct net_device *dev, int capid, u8 *cap)
                 *cap = true;
                 break;
         case DCB_CAP_ATTR_DCBX:
-                *cap = priv->cee_params.dcbx_cap;
+                *cap = priv->dcbx_cap;
                 break;
         case DCB_CAP_ATTR_PFC_TCS:
                 *cap = 1 <<  mlx4_max_tc(priv->mdev->dev);
@@ -111,14 +111,14 @@ static u8 mlx4_en_dcbnl_getpfcstate(struct net_device *netdev)
 {
         struct mlx4_en_priv *priv = netdev_priv(netdev);
 
-        return priv->cee_params.dcb_cfg.pfc_state;
+        return priv->cee_config.pfc_state;
 }
 
 static void mlx4_en_dcbnl_setpfcstate(struct net_device *netdev, u8 state)
 {
         struct mlx4_en_priv *priv = netdev_priv(netdev);
 
-        priv->cee_params.dcb_cfg.pfc_state = state;
+        priv->cee_config.pfc_state = state;
 }
 
 static void mlx4_en_dcbnl_get_pfc_cfg(struct net_device *netdev, int priority,
@@ -126,7 +126,7 @@ static void mlx4_en_dcbnl_get_pfc_cfg(struct net_device *netdev, int priority,
 {
         struct mlx4_en_priv *priv = netdev_priv(netdev);
 
-        *setting = priv->cee_params.dcb_cfg.tc_config[priority].dcb_pfc;
+        *setting = priv->cee_config.dcb_pfc[priority];
 }
 
 static void mlx4_en_dcbnl_set_pfc_cfg(struct net_device *netdev, int priority,
@@ -134,8 +134,8 @@ static void mlx4_en_dcbnl_set_pfc_cfg(struct net_device *netdev, int priority,
 {
         struct mlx4_en_priv *priv = netdev_priv(netdev);
 
-        priv->cee_params.dcb_cfg.tc_config[priority].dcb_pfc = setting;
-        priv->cee_params.dcb_cfg.pfc_state = true;
+        priv->cee_config.dcb_pfc[priority] = setting;
+        priv->cee_config.pfc_state = true;
 }
 
 static int mlx4_en_dcbnl_getnumtcs(struct net_device *netdev, int tcid, u8 *num)
@@ -157,13 +157,11 @@ static u8 mlx4_en_dcbnl_set_all(struct net_device *netdev)
 {
         struct mlx4_en_priv *priv = netdev_priv(netdev);
         struct mlx4_en_dev *mdev = priv->mdev;
-        struct mlx4_en_cee_config *dcb_cfg = &priv->cee_params.dcb_cfg;
-        int err = 0;
 
-        if (!(priv->cee_params.dcbx_cap & DCB_CAP_DCBX_VER_CEE))
-                return -EINVAL;
+        if (!(priv->dcbx_cap & DCB_CAP_DCBX_VER_CEE))
+                return 1;
 
-        if (dcb_cfg->pfc_state) {
+        if (priv->cee_config.pfc_state) {
                 int tc;
 
                 priv->prof->rx_pause = 0;
@@ -171,7 +169,7 @@ static u8 mlx4_en_dcbnl_set_all(struct net_device *netdev)
                 for (tc = 0; tc < CEE_DCBX_MAX_PRIO; tc++) {
                         u8 tc_mask = 1 << tc;
 
-                        switch (dcb_cfg->tc_config[tc].dcb_pfc) {
+                        switch (priv->cee_config.dcb_pfc[tc]) {
                         case pfc_disabled:
                                 priv->prof->tx_ppp &= ~tc_mask;
                                 priv->prof->rx_ppp &= ~tc_mask;
@@ -199,15 +197,17 @@ static u8 mlx4_en_dcbnl_set_all(struct net_device *netdev)
                 en_dbg(DRV, priv, "Set pfc off\n");
         }
 
-        err = mlx4_SET_PORT_general(mdev->dev, priv->port,
-                                    priv->rx_skb_size + ETH_FCS_LEN,
-                                    priv->prof->tx_pause,
-                                    priv->prof->tx_ppp,
-                                    priv->prof->rx_pause,
-                                    priv->prof->rx_ppp);
-        if (err)
+        if (mlx4_SET_PORT_general(mdev->dev, priv->port,
+                                  priv->rx_skb_size + ETH_FCS_LEN,
+                                  priv->prof->tx_pause,
+                                  priv->prof->tx_ppp,
+                                  priv->prof->rx_pause,
+                                  priv->prof->rx_ppp)) {
                 en_err(priv, "Failed setting pause params\n");
-        return err;
+                return 1;
+        }
+
+        return 0;
 }
 
 static u8 mlx4_en_dcbnl_get_state(struct net_device *dev)
@@ -225,7 +225,7 @@ static u8 mlx4_en_dcbnl_set_state(struct net_device *dev, u8 state)
         struct mlx4_en_priv *priv = netdev_priv(dev);
         int num_tcs = 0;
 
-        if (!(priv->cee_params.dcbx_cap & DCB_CAP_DCBX_VER_CEE))
+        if (!(priv->dcbx_cap & DCB_CAP_DCBX_VER_CEE))
                 return 1;
 
         if (!!(state) == !!(priv->flags & MLX4_EN_FLAG_DCB_ENABLED))
@@ -238,7 +238,10 @@ static u8 mlx4_en_dcbnl_set_state(struct net_device *dev, u8 state)
                 priv->flags &= ~MLX4_EN_FLAG_DCB_ENABLED;
         }
 
-        return mlx4_en_setup_tc(dev, num_tcs);
+        if (mlx4_en_setup_tc(dev, num_tcs))
+                return 1;
+
+        return 0;
 }
 
 /* On success returns a non-zero 802.1p user priority bitmap
@@ -252,7 +255,7 @@ static int mlx4_en_dcbnl_getapp(struct net_device *netdev, u8 idtype, u16 id)
                                 .selector = idtype,
                                 .protocol = id,
                              };
-        if (!(priv->cee_params.dcbx_cap & DCB_CAP_DCBX_VER_CEE))
+        if (!(priv->dcbx_cap & DCB_CAP_DCBX_VER_CEE))
                 return 0;
 
         return dcb_getapp(netdev, &app);
@@ -264,7 +267,7 @@ static int mlx4_en_dcbnl_setapp(struct net_device *netdev, u8 idtype,
         struct mlx4_en_priv *priv = netdev_priv(netdev);
         struct dcb_app app;
 
-        if (!(priv->cee_params.dcbx_cap & DCB_CAP_DCBX_VER_CEE))
+        if (!(priv->dcbx_cap & DCB_CAP_DCBX_VER_CEE))
                 return -EINVAL;
 
         memset(&app, 0, sizeof(struct dcb_app));
@@ -433,7 +436,7 @@ static u8 mlx4_en_dcbnl_getdcbx(struct net_device *dev)
 {
         struct mlx4_en_priv *priv = netdev_priv(dev);
 
-        return priv->cee_params.dcbx_cap;
+        return priv->dcbx_cap;
 }
 
 static u8 mlx4_en_dcbnl_setdcbx(struct net_device *dev, u8 mode)
@@ -442,7 +445,7 @@ static u8 mlx4_en_dcbnl_setdcbx(struct net_device *dev, u8 mode)
         struct ieee_ets ets = {0};
         struct ieee_pfc pfc = {0};
 
-        if (mode == priv->cee_params.dcbx_cap)
+        if (mode == priv->dcbx_cap)
                 return 0;
 
         if ((mode & DCB_CAP_DCBX_LLD_MANAGED) ||
@@ -451,7 +454,7 @@ static u8 mlx4_en_dcbnl_setdcbx(struct net_device *dev, u8 mode)
             !(mode & DCB_CAP_DCBX_HOST))
                 goto err;
 
-        priv->cee_params.dcbx_cap = mode;
+        priv->dcbx_cap = mode;
 
         ets.ets_cap = IEEE_8021QAZ_MAX_TCS;
         pfc.pfc_cap = IEEE_8021QAZ_MAX_TCS;
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
index 4198e9bf89d0..fedb829276f4 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
@@ -71,10 +71,11 @@ int mlx4_en_setup_tc(struct net_device *dev, u8 up)
 #ifdef CONFIG_MLX4_EN_DCB
         if (!mlx4_is_slave(priv->mdev->dev)) {
                 if (up) {
-                        priv->flags |= MLX4_EN_FLAG_DCB_ENABLED;
+                        if (priv->dcbx_cap)
+                                priv->flags |= MLX4_EN_FLAG_DCB_ENABLED;
                 } else {
                         priv->flags &= ~MLX4_EN_FLAG_DCB_ENABLED;
-                        priv->cee_params.dcb_cfg.pfc_state = false;
+                        priv->cee_config.pfc_state = false;
                 }
         }
 #endif /* CONFIG_MLX4_EN_DCB */
@@ -3048,9 +3049,6 @@ int mlx4_en_init_netdev(struct mlx4_en_dev *mdev, int port,
         struct mlx4_en_priv *priv;
         int i;
         int err;
-#ifdef CONFIG_MLX4_EN_DCB
-        struct tc_configuration *tc;
-#endif
 
         dev = alloc_etherdev_mqs(sizeof(struct mlx4_en_priv),
                                  MAX_TX_RINGS, MAX_RX_RINGS);
@@ -3117,16 +3115,13 @@ int mlx4_en_init_netdev(struct mlx4_en_dev *mdev, int port,
         priv->msg_enable = MLX4_EN_MSG_LEVEL;
 #ifdef CONFIG_MLX4_EN_DCB
         if (!mlx4_is_slave(priv->mdev->dev)) {
-                priv->cee_params.dcbx_cap = DCB_CAP_DCBX_VER_CEE |
-                                            DCB_CAP_DCBX_HOST |
-                                            DCB_CAP_DCBX_VER_IEEE;
+                priv->dcbx_cap = DCB_CAP_DCBX_VER_CEE | DCB_CAP_DCBX_HOST |
+                        DCB_CAP_DCBX_VER_IEEE;
                 priv->flags |= MLX4_EN_DCB_ENABLED;
-                priv->cee_params.dcb_cfg.pfc_state = false;
+                priv->cee_config.pfc_state = false;
 
-                for (i = 0; i < MLX4_EN_NUM_UP; i++) {
-                        tc = &priv->cee_params.dcb_cfg.tc_config[i];
-                        tc->dcb_pfc = pfc_disabled;
-                }
+                for (i = 0; i < MLX4_EN_NUM_UP; i++)
+                        priv->cee_config.dcb_pfc[i] = pfc_disabled;
 
                 if (mdev->dev->caps.flags2 & MLX4_DEV_CAP_FLAG2_ETS_CFG) {
                         dev->dcbnl_ops = &mlx4_en_dcbnl_ops;
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_tx.c b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
index 9df87ca0515a..e2509bba3e7c 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_tx.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
@@ -818,7 +818,7 @@ netdev_tx_t mlx4_en_xmit(struct sk_buff *skb, struct net_device *dev)
         real_size = get_real_size(skb, shinfo, dev, &lso_header_size,
                                   &inline_ok, &fragptr);
         if (unlikely(!real_size))
-                goto tx_drop;
+                goto tx_drop_count;
 
         /* Align descriptor to TXBB size */
         desc_size = ALIGN(real_size, TXBB_SIZE);
@@ -826,7 +826,7 @@ netdev_tx_t mlx4_en_xmit(struct sk_buff *skb, struct net_device *dev)
         if (unlikely(nr_txbb > MAX_DESC_TXBBS)) {
                 if (netif_msg_tx_err(priv))
                         en_warn(priv, "Oversized header or SG list\n");
-                goto tx_drop;
+                goto tx_drop_count;
         }
 
         bf_ok = ring->bf_enabled;
@@ -1071,9 +1071,10 @@ tx_drop_unmap:
                                PCI_DMA_TODEVICE);
         }
 
+tx_drop_count:
+        ring->tx_dropped++;
 tx_drop:
         dev_kfree_skb_any(skb);
-        ring->tx_dropped++;
         return NETDEV_TX_OK;
 }
 
@@ -1106,7 +1107,7 @@ netdev_tx_t mlx4_en_xmit_frame(struct mlx4_en_rx_alloc *frame,
                 goto tx_drop;
 
         if (mlx4_en_is_tx_ring_full(ring))
-                goto tx_drop;
+                goto tx_drop_count;
 
         /* fetch ring->cons far ahead before needing it to avoid stall */
         ring_cons = READ_ONCE(ring->cons);
@@ -1176,7 +1177,8 @@ netdev_tx_t mlx4_en_xmit_frame(struct mlx4_en_rx_alloc *frame,
 
         return NETDEV_TX_OK;
 
-tx_drop:
+tx_drop_count:
         ring->tx_dropped++;
+tx_drop:
         return NETDEV_TX_BUSY;
 }
diff --git a/drivers/net/ethernet/mellanox/mlx4/eq.c b/drivers/net/ethernet/mellanox/mlx4/eq.c
index f613977455e0..cf8f8a72a801 100644
--- a/drivers/net/ethernet/mellanox/mlx4/eq.c
+++ b/drivers/net/ethernet/mellanox/mlx4/eq.c
@@ -1305,8 +1305,8 @@ int mlx4_init_eq_table(struct mlx4_dev *dev)
         return 0;
 
 err_out_unmap:
-        while (i >= 0)
-                mlx4_free_eq(dev, &priv->eq_table.eq[i--]);
+        while (i > 0)
+                mlx4_free_eq(dev, &priv->eq_table.eq[--i]);
 #ifdef CONFIG_RFS_ACCEL
         for (i = 1; i <= dev->caps.num_ports; i++) {
                 if (mlx4_priv(dev)->port[i].rmap) {
diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
index 75dd2e3d3059..7183ac4135d2 100644
--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -2970,6 +2970,7 @@ static int mlx4_init_port_info(struct mlx4_dev *dev, int port)
                 mlx4_err(dev, "Failed to create mtu file for port %d\n", port);
                 device_remove_file(&info->dev->persist->pdev->dev,
                                    &info->port_attr);
+                devlink_port_unregister(&info->devlink_port);
                 info->port = -1;
         }
 
@@ -2984,6 +2985,8 @@ static void mlx4_cleanup_port_info(struct mlx4_port_info *info)
         device_remove_file(&info->dev->persist->pdev->dev, &info->port_attr);
         device_remove_file(&info->dev->persist->pdev->dev,
                            &info->port_mtu_attr);
+        devlink_port_unregister(&info->devlink_port);
+
 #ifdef CONFIG_RFS_ACCEL
         free_irq_cpu_rmap(info->rmap);
         info->rmap = NULL;
diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
index 2c2913dcae98..9099dbd04951 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
@@ -482,20 +482,10 @@ enum dcb_pfc_type {
         pfc_enabled_rx
 };
 
-struct tc_configuration {
-        enum dcb_pfc_type  dcb_pfc;
-};
-
 struct mlx4_en_cee_config {
         bool    pfc_state;
-        struct  tc_configuration tc_config[MLX4_EN_NUM_UP];
+        enum    dcb_pfc_type dcb_pfc[MLX4_EN_NUM_UP];
 };
-
-struct mlx4_en_cee_params {
-        u8 dcbx_cap;
-        struct mlx4_en_cee_config dcb_cfg;
-};
-
 #endif
 
 struct ethtool_flow_id {
@@ -624,7 +614,8 @@ struct mlx4_en_priv {
         struct ieee_ets ets;
         u16 maxrate[IEEE_8021QAZ_MAX_TCS];
         enum dcbnl_cndd_states cndd_state[IEEE_8021QAZ_MAX_TCS];
-        struct mlx4_en_cee_params cee_params;
+        struct mlx4_en_cee_config cee_config;
+        u8 dcbx_cap;
 #endif
 #ifdef CONFIG_RFS_ACCEL
         spinlock_t filters_lock;
diff --git a/drivers/net/ethernet/mellanox/mlx4/port.c b/drivers/net/ethernet/mellanox/mlx4/port.c
index 3d2095e5c61c..c5b2064297a1 100644
--- a/drivers/net/ethernet/mellanox/mlx4/port.c
+++ b/drivers/net/ethernet/mellanox/mlx4/port.c
@@ -52,7 +52,7 @@
 
 #define MLX4_FLAG_V_IGNORE_FCS_MASK             0x2
 #define MLX4_IGNORE_FCS_MASK                    0x1
-#define MLNX4_TX_MAX_NUMBER                     8
+#define MLX4_TC_MAX_NUMBER                      8
 
 void mlx4_init_mac_table(struct mlx4_dev *dev, struct mlx4_mac_table *table)
 {
@@ -2022,7 +2022,7 @@ int mlx4_max_tc(struct mlx4_dev *dev)
         u8 num_tc = dev->caps.max_tc_eth;
 
         if (!num_tc)
-                num_tc = MLNX4_TX_MAX_NUMBER;
+                num_tc = MLX4_TC_MAX_NUMBER;
 
         return num_tc;
 }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
index d6e2a1cae19a..c2ec01a22d55 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
@@ -143,13 +143,14 @@ static struct mlx5_cmd_layout *get_inst(struct mlx5_cmd *cmd, int idx)
         return cmd->cmd_buf + (idx << cmd->log_stride);
 }
 
-static u8 xor8_buf(void *buf, int len)
+static u8 xor8_buf(void *buf, size_t offset, int len)
 {
         u8 *ptr = buf;
         u8 sum = 0;
         int i;
+        int end = len + offset;
 
-        for (i = 0; i < len; i++)
+        for (i = offset; i < end; i++)
                 sum ^= ptr[i];
 
         return sum;
@@ -157,41 +158,49 @@ static u8 xor8_buf(void *buf, int len)
 
 static int verify_block_sig(struct mlx5_cmd_prot_block *block)
 {
-        if (xor8_buf(block->rsvd0, sizeof(*block) - sizeof(block->data) - 1) != 0xff)
+        size_t rsvd0_off = offsetof(struct mlx5_cmd_prot_block, rsvd0);
+        int xor_len = sizeof(*block) - sizeof(block->data) - 1;
+
+        if (xor8_buf(block, rsvd0_off, xor_len) != 0xff)
                 return -EINVAL;
 
-        if (xor8_buf(block, sizeof(*block)) != 0xff)
+        if (xor8_buf(block, 0, sizeof(*block)) != 0xff)
                 return -EINVAL;
 
         return 0;
 }
 
-static void calc_block_sig(struct mlx5_cmd_prot_block *block, u8 token,
-                           int csum)
+static void calc_block_sig(struct mlx5_cmd_prot_block *block)
 {
-        block->token = token;
-        if (csum) {
-                block->ctrl_sig = ~xor8_buf(block->rsvd0, sizeof(*block) -
-                                            sizeof(block->data) - 2);
-                block->sig = ~xor8_buf(block, sizeof(*block) - 1);
-        }
+        int ctrl_xor_len = sizeof(*block) - sizeof(block->data) - 2;
+        size_t rsvd0_off = offsetof(struct mlx5_cmd_prot_block, rsvd0);
+
+        block->ctrl_sig = ~xor8_buf(block, rsvd0_off, ctrl_xor_len);
+        block->sig = ~xor8_buf(block, 0, sizeof(*block) - 1);
 }
 
-static void calc_chain_sig(struct mlx5_cmd_msg *msg, u8 token, int csum)
+static void calc_chain_sig(struct mlx5_cmd_msg *msg)
 {
         struct mlx5_cmd_mailbox *next = msg->next;
-
-        while (next) {
-                calc_block_sig(next->buf, token, csum);
+        int size = msg->len;
+        int blen = size - min_t(int, sizeof(msg->first.data), size);
+        int n = (blen + MLX5_CMD_DATA_BLOCK_SIZE - 1)
+                / MLX5_CMD_DATA_BLOCK_SIZE;
+        int i = 0;
+
+        for (i = 0; i < n && next; i++)  {
+                calc_block_sig(next->buf);
                 next = next->next;
         }
 }
 
 static void set_signature(struct mlx5_cmd_work_ent *ent, int csum)
 {
-        ent->lay->sig = ~xor8_buf(ent->lay, sizeof(*ent->lay));
-        calc_chain_sig(ent->in, ent->token, csum);
-        calc_chain_sig(ent->out, ent->token, csum);
+        ent->lay->sig = ~xor8_buf(ent->lay, 0,  sizeof(*ent->lay));
+        if (csum) {
+                calc_chain_sig(ent->in);
+                calc_chain_sig(ent->out);
+        }
 }
 
 static void poll_timeout(struct mlx5_cmd_work_ent *ent)
@@ -222,12 +231,17 @@ static int verify_signature(struct mlx5_cmd_work_ent *ent)
         struct mlx5_cmd_mailbox *next = ent->out->next;
         int err;
         u8 sig;
+        int size = ent->out->len;
+        int blen = size - min_t(int, sizeof(ent->out->first.data), size);
+        int n = (blen + MLX5_CMD_DATA_BLOCK_SIZE - 1)
+                / MLX5_CMD_DATA_BLOCK_SIZE;
+        int i = 0;
 
-        sig = xor8_buf(ent->lay, sizeof(*ent->lay));
+        sig = xor8_buf(ent->lay, 0, sizeof(*ent->lay));
         if (sig != 0xff)
                 return -EINVAL;
 
-        while (next) {
+        for (i = 0; i < n && next; i++) {
                 err = verify_block_sig(next->buf);
                 if (err)
                         return err;
@@ -656,7 +670,6 @@ static void cmd_work_handler(struct work_struct *work)
                 spin_unlock_irqrestore(&cmd->alloc_lock, flags);
         }
 
-        ent->token = alloc_token(cmd);
         cmd->ent_arr[ent->idx] = ent;
         lay = get_inst(cmd, ent->idx);
         ent->lay = lay;
@@ -766,7 +779,8 @@ static u8 *get_status_ptr(struct mlx5_outbox_hdr *out)
 static int mlx5_cmd_invoke(struct mlx5_core_dev *dev, struct mlx5_cmd_msg *in,
                            struct mlx5_cmd_msg *out, void *uout, int uout_size,
                            mlx5_cmd_cbk_t callback,
-                           void *context, int page_queue, u8 *status)
+                           void *context, int page_queue, u8 *status,
+                           u8 token)
 {
         struct mlx5_cmd *cmd = &dev->cmd;
         struct mlx5_cmd_work_ent *ent;
@@ -783,6 +797,8 @@ static int mlx5_cmd_invoke(struct mlx5_core_dev *dev, struct mlx5_cmd_msg *in,
         if (IS_ERR(ent))
                 return PTR_ERR(ent);
 
+        ent->token = token;
+
         if (!callback)
                 init_completion(&ent->done);
 
@@ -854,7 +870,8 @@ static const struct file_operations fops = {
         .write  = dbg_write,
 };
 
-static int mlx5_copy_to_msg(struct mlx5_cmd_msg *to, void *from, int size)
+static int mlx5_copy_to_msg(struct mlx5_cmd_msg *to, void *from, int size,
+                            u8 token)
 {
         struct mlx5_cmd_prot_block *block;
         struct mlx5_cmd_mailbox *next;
@@ -880,6 +897,7 @@ static int mlx5_copy_to_msg(struct mlx5_cmd_msg *to, void *from, int size)
                 memcpy(block->data, from, copy);
                 from += copy;
                 size -= copy;
+                block->token = token;
                 next = next->next;
         }
 
@@ -949,7 +967,8 @@ static void free_cmd_box(struct mlx5_core_dev *dev,
 }
 
 static struct mlx5_cmd_msg *mlx5_alloc_cmd_msg(struct mlx5_core_dev *dev,
-                                               gfp_t flags, int size)
+                                               gfp_t flags, int size,
+                                               u8 token)
 {
         struct mlx5_cmd_mailbox *tmp, *head = NULL;
         struct mlx5_cmd_prot_block *block;
@@ -978,6 +997,7 @@ static struct mlx5_cmd_msg *mlx5_alloc_cmd_msg(struct mlx5_core_dev *dev,
                 tmp->next = head;
                 block->next = cpu_to_be64(tmp->next ? tmp->next->dma : 0);
                 block->block_num = cpu_to_be32(n - i - 1);
+                block->token = token;
                 head = tmp;
         }
         msg->next = head;
@@ -1352,7 +1372,7 @@ static struct mlx5_cmd_msg *alloc_msg(struct mlx5_core_dev *dev, int in_size,
         }
 
         if (IS_ERR(msg))
-                msg = mlx5_alloc_cmd_msg(dev, gfp, in_size);
+                msg = mlx5_alloc_cmd_msg(dev, gfp, in_size, 0);
 
         return msg;
 }
@@ -1377,6 +1397,7 @@ static int cmd_exec(struct mlx5_core_dev *dev, void *in, int in_size, void *out,
         int err;
         u8 status = 0;
         u32 drv_synd;
+        u8 token;
 
         if (pci_channel_offline(dev->pdev) ||
             dev->state == MLX5_DEVICE_STATE_INTERNAL_ERROR) {
@@ -1395,20 +1416,22 @@ static int cmd_exec(struct mlx5_core_dev *dev, void *in, int in_size, void *out,
                 return err;
         }
 
-        err = mlx5_copy_to_msg(inb, in, in_size);
+        token = alloc_token(&dev->cmd);
+
+        err = mlx5_copy_to_msg(inb, in, in_size, token);
         if (err) {
                 mlx5_core_warn(dev, "err %d\n", err);
                 goto out_in;
         }
 
-        outb = mlx5_alloc_cmd_msg(dev, gfp, out_size);
+        outb = mlx5_alloc_cmd_msg(dev, gfp, out_size, token);
         if (IS_ERR(outb)) {
                 err = PTR_ERR(outb);
                 goto out_in;
         }
 
         err = mlx5_cmd_invoke(dev, inb, outb, out, out_size, callback, context,
-                              pages_queue, &status);
+                              pages_queue, &status, token);
         if (err)
                 goto out_out;
 
@@ -1476,7 +1499,7 @@ static int create_msg_cache(struct mlx5_core_dev *dev)
         INIT_LIST_HEAD(&cmd->cache.med.head);
 
         for (i = 0; i < NUM_LONG_LISTS; i++) {
-                msg = mlx5_alloc_cmd_msg(dev, GFP_KERNEL, LONG_LIST_SIZE);
+                msg = mlx5_alloc_cmd_msg(dev, GFP_KERNEL, LONG_LIST_SIZE, 0);
                 if (IS_ERR(msg)) {
                         err = PTR_ERR(msg);
                         goto ex_err;
@@ -1486,7 +1509,7 @@ static int create_msg_cache(struct mlx5_core_dev *dev)
         }
 
         for (i = 0; i < NUM_MED_LISTS; i++) {
-                msg = mlx5_alloc_cmd_msg(dev, GFP_KERNEL, MED_LIST_SIZE);
+                msg = mlx5_alloc_cmd_msg(dev, GFP_KERNEL, MED_LIST_SIZE, 0);
                 if (IS_ERR(msg)) {
                         err = PTR_ERR(msg);
                         goto ex_err;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h
index 1b495efa7490..bf722aa88cf0 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h
@@ -73,8 +73,12 @@
 #define MLX5_MPWRQ_PAGES_PER_WQE                BIT(MLX5_MPWRQ_WQE_PAGE_ORDER)
 #define MLX5_MPWRQ_STRIDES_PER_PAGE             (MLX5_MPWRQ_NUM_STRIDES >> \
                                                  MLX5_MPWRQ_WQE_PAGE_ORDER)
-#define MLX5_CHANNEL_MAX_NUM_MTTS (ALIGN(MLX5_MPWRQ_PAGES_PER_WQE, 8) * \
-                                   BIT(MLX5E_PARAMS_MAXIMUM_LOG_RQ_SIZE_MPW))
+
+#define MLX5_MTT_OCTW(npages) (ALIGN(npages, 8) / 2)
+#define MLX5E_REQUIRED_MTTS(rqs, wqes)\
+        (rqs * wqes * ALIGN(MLX5_MPWRQ_PAGES_PER_WQE, 8))
+#define MLX5E_VALID_NUM_MTTS(num_mtts) (MLX5_MTT_OCTW(num_mtts) <= U16_MAX)
+
 #define MLX5_UMR_ALIGN                          (2048)
 #define MLX5_MPWRQ_SMALL_PACKET_THRESHOLD       (128)
 
@@ -219,9 +223,8 @@ struct mlx5e_tstamp {
 };
 
 enum {
-        MLX5E_RQ_STATE_POST_WQES_ENABLE,
+        MLX5E_RQ_STATE_FLUSH,
         MLX5E_RQ_STATE_UMR_WQE_IN_PROGRESS,
-        MLX5E_RQ_STATE_FLUSH_TIMEOUT,
         MLX5E_RQ_STATE_AM,
 };
 
@@ -304,6 +307,7 @@ struct mlx5e_rq {
 
         unsigned long          state;
         int                    ix;
+        u32                    mpwqe_mtt_offset;
 
         struct mlx5e_rx_am     am; /* Adaptive Moderation */
 
@@ -365,9 +369,8 @@ struct mlx5e_sq_dma {
 };
 
 enum {
-        MLX5E_SQ_STATE_WAKE_TXQ_ENABLE,
+        MLX5E_SQ_STATE_FLUSH,
         MLX5E_SQ_STATE_BF_ENABLE,
-        MLX5E_SQ_STATE_TX_TIMEOUT,
 };
 
 struct mlx5e_ico_wqe_info {
@@ -698,7 +701,6 @@ int mlx5e_napi_poll(struct napi_struct *napi, int budget);
 bool mlx5e_poll_tx_cq(struct mlx5e_cq *cq, int napi_budget);
 int mlx5e_poll_rx_cq(struct mlx5e_cq *cq, int budget);
 void mlx5e_free_tx_descs(struct mlx5e_sq *sq);
-void mlx5e_free_rx_descs(struct mlx5e_rq *rq);
 
 void mlx5e_handle_rx_cqe(struct mlx5e_rq *rq, struct mlx5_cqe64 *cqe);
 void mlx5e_handle_rx_cqe_mpwrq(struct mlx5e_rq *rq, struct mlx5_cqe64 *cqe);
@@ -814,11 +816,6 @@ static inline int mlx5e_get_max_num_channels(struct mlx5_core_dev *mdev)
                      MLX5E_MAX_NUM_CHANNELS);
 }
 
-static inline int mlx5e_get_mtt_octw(int npages)
-{
-        return ALIGN(npages, 8) / 2;
-}
-
 extern const struct ethtool_ops mlx5e_ethtool_ops;
 #ifdef CONFIG_MLX5_CORE_EN_DCB
 extern const struct dcbnl_rtnl_ops mlx5e_dcbnl_ops;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_common.c b/drivers/net/ethernet/mellanox/mlx5/core/en_common.c
index 673043ccd76c..9cce153e1035 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_common.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_common.c
@@ -139,7 +139,7 @@ int mlx5e_refresh_tirs_self_loopback_enable(struct mlx5_core_dev *mdev)
         struct mlx5e_tir *tir;
         void *in;
         int inlen;
-        int err;
+        int err = 0;
 
         inlen = MLX5_ST_SZ_BYTES(modify_tir_in);
         in = mlx5_vzalloc(inlen);
@@ -151,10 +151,11 @@ int mlx5e_refresh_tirs_self_loopback_enable(struct mlx5_core_dev *mdev)
         list_for_each_entry(tir, &mdev->mlx5e_res.td.tirs_list, list) {
                 err = mlx5_core_modify_tir(mdev, tir->tirn, in, inlen);
                 if (err)
-                        return err;
+                        goto out;
         }
 
+out:
         kvfree(in);
 
-        return 0;
+        return err;
 }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
index caa9a3ccc3f3..762af16ed021 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
@@ -127,29 +127,40 @@ int mlx5e_dcbnl_ieee_setets_core(struct mlx5e_priv *priv, struct ieee_ets *ets)
         return mlx5_set_port_tc_bw_alloc(mdev, tc_tx_bw);
 }
 
-static int mlx5e_dbcnl_validate_ets(struct ieee_ets *ets)
+static int mlx5e_dbcnl_validate_ets(struct net_device *netdev,
+                                    struct ieee_ets *ets)
 {
         int bw_sum = 0;
         int i;
 
         /* Validate Priority */
         for (i = 0; i < IEEE_8021QAZ_MAX_TCS; i++) {
-                if (ets->prio_tc[i] >= MLX5E_MAX_PRIORITY)
+                if (ets->prio_tc[i] >= MLX5E_MAX_PRIORITY) {
+                        netdev_err(netdev,
+                                   "Failed to validate ETS: priority value greater than max(%d)\n",
+                                    MLX5E_MAX_PRIORITY);
                         return -EINVAL;
+                }
         }
 
         /* Validate Bandwidth Sum */
         for (i = 0; i < IEEE_8021QAZ_MAX_TCS; i++) {
                 if (ets->tc_tsa[i] == IEEE_8021QAZ_TSA_ETS) {
-                        if (!ets->tc_tx_bw[i])
+                        if (!ets->tc_tx_bw[i]) {
+                                netdev_err(netdev,
+                                           "Failed to validate ETS: BW 0 is illegal\n");
                                 return -EINVAL;
+                        }
 
                         bw_sum += ets->tc_tx_bw[i];
                 }
         }
 
-        if (bw_sum != 0 && bw_sum != 100)
+        if (bw_sum != 0 && bw_sum != 100) {
+                netdev_err(netdev,
+                           "Failed to validate ETS: BW sum is illegal\n");
                 return -EINVAL;
+        }
         return 0;
 }
 
@@ -159,7 +170,7 @@ static int mlx5e_dcbnl_ieee_setets(struct net_device *netdev,
         struct mlx5e_priv *priv = netdev_priv(netdev);
         int err;
 
-        err = mlx5e_dbcnl_validate_ets(ets);
+        err = mlx5e_dbcnl_validate_ets(netdev, ets);
         if (err)
                 return err;
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
index 4a3757e60441..7a346bb2ed00 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
@@ -331,7 +331,7 @@ static void mlx5e_get_ethtool_stats(struct net_device *dev,
         if (mlx5e_query_global_pause_combined(priv)) {
                 for (i = 0; i < NUM_PPORT_PER_PRIO_PFC_COUNTERS; i++) {
                         data[idx++] = MLX5E_READ_CTR64_BE(&priv->stats.pport.per_prio_counters[0],
-                                                          pport_per_prio_pfc_stats_desc, 0);
+                                                          pport_per_prio_pfc_stats_desc, i);
                 }
         }
 
@@ -352,15 +352,61 @@ static void mlx5e_get_ethtool_stats(struct net_device *dev,
                                                                    sq_stats_desc, j);
 }
 
+static u32 mlx5e_rx_wqes_to_packets(struct mlx5e_priv *priv, int rq_wq_type,
+                                    int num_wqe)
+{
+        int packets_per_wqe;
+        int stride_size;
+        int num_strides;
+        int wqe_size;
+
+        if (rq_wq_type != MLX5_WQ_TYPE_LINKED_LIST_STRIDING_RQ)
+                return num_wqe;
+
+        stride_size = 1 << priv->params.mpwqe_log_stride_sz;
+        num_strides = 1 << priv->params.mpwqe_log_num_strides;
+        wqe_size = stride_size * num_strides;
+
+        packets_per_wqe = wqe_size /
+                          ALIGN(ETH_DATA_LEN, stride_size);
+        return (1 << (order_base_2(num_wqe * packets_per_wqe) - 1));
+}
+
+static u32 mlx5e_packets_to_rx_wqes(struct mlx5e_priv *priv, int rq_wq_type,
+                                    int num_packets)
+{
+        int packets_per_wqe;
+        int stride_size;
+        int num_strides;
+        int wqe_size;
+        int num_wqes;
+
+        if (rq_wq_type != MLX5_WQ_TYPE_LINKED_LIST_STRIDING_RQ)
+                return num_packets;
+
+        stride_size = 1 << priv->params.mpwqe_log_stride_sz;
+        num_strides = 1 << priv->params.mpwqe_log_num_strides;
+        wqe_size = stride_size * num_strides;
+
+        num_packets = (1 << order_base_2(num_packets));
+
+        packets_per_wqe = wqe_size /
+                          ALIGN(ETH_DATA_LEN, stride_size);
+        num_wqes = DIV_ROUND_UP(num_packets, packets_per_wqe);
+        return 1 << (order_base_2(num_wqes));
+}
+
 static void mlx5e_get_ringparam(struct net_device *dev,
                                 struct ethtool_ringparam *param)
 {
         struct mlx5e_priv *priv = netdev_priv(dev);
         int rq_wq_type = priv->params.rq_wq_type;
 
-        param->rx_max_pending = 1 << mlx5_max_log_rq_size(rq_wq_type);
+        param->rx_max_pending = mlx5e_rx_wqes_to_packets(priv, rq_wq_type,
+                                                         1 << mlx5_max_log_rq_size(rq_wq_type));
         param->tx_max_pending = 1 << MLX5E_PARAMS_MAXIMUM_LOG_SQ_SIZE;
-        param->rx_pending     = 1 << priv->params.log_rq_size;
+        param->rx_pending = mlx5e_rx_wqes_to_packets(priv, rq_wq_type,
+                                                     1 << priv->params.log_rq_size);
         param->tx_pending     = 1 << priv->params.log_sq_size;
 }
 
@@ -370,9 +416,13 @@ static int mlx5e_set_ringparam(struct net_device *dev,
         struct mlx5e_priv *priv = netdev_priv(dev);
         bool was_opened;
         int rq_wq_type = priv->params.rq_wq_type;
+        u32 rx_pending_wqes;
+        u32 min_rq_size;
+        u32 max_rq_size;
         u16 min_rx_wqes;
         u8 log_rq_size;
         u8 log_sq_size;
+        u32 num_mtts;
         int err = 0;
 
         if (param->rx_jumbo_pending) {
@@ -385,18 +435,36 @@ static int mlx5e_set_ringparam(struct net_device *dev,
                             __func__);
                 return -EINVAL;
         }
-        if (param->rx_pending < (1 << mlx5_min_log_rq_size(rq_wq_type))) {
+
+        min_rq_size = mlx5e_rx_wqes_to_packets(priv, rq_wq_type,
+                                               1 << mlx5_min_log_rq_size(rq_wq_type));
+        max_rq_size = mlx5e_rx_wqes_to_packets(priv, rq_wq_type,
+                                               1 << mlx5_max_log_rq_size(rq_wq_type));
+        rx_pending_wqes = mlx5e_packets_to_rx_wqes(priv, rq_wq_type,
+                                                   param->rx_pending);
+
+        if (param->rx_pending < min_rq_size) {
                 netdev_info(dev, "%s: rx_pending (%d) < min (%d)\n",
                             __func__, param->rx_pending,
-                            1 << mlx5_min_log_rq_size(rq_wq_type));
+                            min_rq_size);
                 return -EINVAL;
         }
-        if (param->rx_pending > (1 << mlx5_max_log_rq_size(rq_wq_type))) {
+        if (param->rx_pending > max_rq_size) {
                 netdev_info(dev, "%s: rx_pending (%d) > max (%d)\n",
                             __func__, param->rx_pending,
-                            1 << mlx5_max_log_rq_size(rq_wq_type));
+                            max_rq_size);
                 return -EINVAL;
         }
+
+        num_mtts = MLX5E_REQUIRED_MTTS(priv->params.num_channels,
+                                       rx_pending_wqes);
+        if (priv->params.rq_wq_type == MLX5_WQ_TYPE_LINKED_LIST_STRIDING_RQ &&
+            !MLX5E_VALID_NUM_MTTS(num_mtts)) {
+                netdev_info(dev, "%s: rx_pending (%d) request can't be satisfied, try to reduce.\n",
+                            __func__, param->rx_pending);
+                return -EINVAL;
+        }
+
         if (param->tx_pending < (1 << MLX5E_PARAMS_MINIMUM_LOG_SQ_SIZE)) {
                 netdev_info(dev, "%s: tx_pending (%d) < min (%d)\n",
                             __func__, param->tx_pending,
@@ -410,9 +478,9 @@ static int mlx5e_set_ringparam(struct net_device *dev,
                 return -EINVAL;
         }
 
-        log_rq_size = order_base_2(param->rx_pending);
+        log_rq_size = order_base_2(rx_pending_wqes);
         log_sq_size = order_base_2(param->tx_pending);
-        min_rx_wqes = mlx5_min_rx_wqes(rq_wq_type, param->rx_pending);
+        min_rx_wqes = mlx5_min_rx_wqes(rq_wq_type, rx_pending_wqes);
 
         if (log_rq_size == priv->params.log_rq_size &&
             log_sq_size == priv->params.log_sq_size &&
@@ -454,6 +522,7 @@ static int mlx5e_set_channels(struct net_device *dev,
         unsigned int count = ch->combined_count;
         bool arfs_enabled;
         bool was_opened;
+        u32 num_mtts;
         int err = 0;
 
         if (!count) {
@@ -472,6 +541,14 @@ static int mlx5e_set_channels(struct net_device *dev,
                 return -EINVAL;
         }
 
+        num_mtts = MLX5E_REQUIRED_MTTS(count, BIT(priv->params.log_rq_size));
+        if (priv->params.rq_wq_type == MLX5_WQ_TYPE_LINKED_LIST_STRIDING_RQ &&
+            !MLX5E_VALID_NUM_MTTS(num_mtts)) {
+                netdev_info(dev, "%s: rx count (%d) request can't be satisfied, try to reduce.\n",
+                            __func__, count);
+                return -EINVAL;
+        }
+
         if (priv->params.num_channels == count)
                 return 0;
 
@@ -582,9 +659,10 @@ out:
 static void ptys2ethtool_supported_link(unsigned long *supported_modes,
                                         u32 eth_proto_cap)
 {
+        unsigned long proto_cap = eth_proto_cap;
         int proto;
 
-        for_each_set_bit(proto, (unsigned long *)&eth_proto_cap, MLX5E_LINK_MODES_NUMBER)
+        for_each_set_bit(proto, &proto_cap, MLX5E_LINK_MODES_NUMBER)
                 bitmap_or(supported_modes, supported_modes,
                           ptys2ethtool_table[proto].supported,
                           __ETHTOOL_LINK_MODE_MASK_NBITS);
@@ -593,9 +671,10 @@ static void ptys2ethtool_supported_link(unsigned long *supported_modes,
 static void ptys2ethtool_adver_link(unsigned long *advertising_modes,
                                     u32 eth_proto_cap)
 {
+        unsigned long proto_cap = eth_proto_cap;
         int proto;
 
-        for_each_set_bit(proto, (unsigned long *)&eth_proto_cap, MLX5E_LINK_MODES_NUMBER)
+        for_each_set_bit(proto, &proto_cap, MLX5E_LINK_MODES_NUMBER)
                 bitmap_or(advertising_modes, advertising_modes,
                           ptys2ethtool_table[proto].advertised,
                           __ETHTOOL_LINK_MODE_MASK_NBITS);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index 870bea37c57c..2459c7f3db8d 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -39,13 +39,6 @@
 #include "eswitch.h"
 #include "vxlan.h"
 
-enum {
-        MLX5_EN_QP_FLUSH_TIMEOUT_MS     = 5000,
-        MLX5_EN_QP_FLUSH_MSLEEP_QUANT   = 20,
-        MLX5_EN_QP_FLUSH_MAX_ITER       = MLX5_EN_QP_FLUSH_TIMEOUT_MS /
-                                          MLX5_EN_QP_FLUSH_MSLEEP_QUANT,
-};
-
 struct mlx5e_rq_param {
         u32                     rqc[MLX5_ST_SZ_DW(rqc)];
         struct mlx5_wq_param    wq;
@@ -162,6 +155,7 @@ static void mlx5e_update_sw_counters(struct mlx5e_priv *priv)
                         s->tx_queue_stopped     += sq_stats->stopped;
                         s->tx_queue_wake        += sq_stats->wake;
                         s->tx_queue_dropped     += sq_stats->dropped;
+                        s->tx_xmit_more         += sq_stats->xmit_more;
                         s->tx_csum_partial_inner += sq_stats->csum_partial_inner;
                         tx_offload_none         += sq_stats->csum_none;
                 }
@@ -340,6 +334,9 @@ static int mlx5e_create_rq(struct mlx5e_channel *c,
                 rq->alloc_wqe = mlx5e_alloc_rx_mpwqe;
                 rq->dealloc_wqe = mlx5e_dealloc_rx_mpwqe;
 
+                rq->mpwqe_mtt_offset = c->ix *
+                        MLX5E_REQUIRED_MTTS(1, BIT(priv->params.log_rq_size));
+
                 rq->mpwqe_stride_sz = BIT(priv->params.mpwqe_log_stride_sz);
                 rq->mpwqe_num_strides = BIT(priv->params.mpwqe_log_num_strides);
                 rq->wqe_sz = rq->mpwqe_stride_sz * rq->mpwqe_num_strides;
@@ -428,7 +425,6 @@ static int mlx5e_enable_rq(struct mlx5e_rq *rq, struct mlx5e_rq_param *param)
 
         MLX5_SET(rqc,  rqc, cqn,                rq->cq.mcq.cqn);
         MLX5_SET(rqc,  rqc, state,              MLX5_RQC_STATE_RST);
-        MLX5_SET(rqc,  rqc, flush_in_error_en,  1);
         MLX5_SET(rqc,  rqc, vsd, priv->params.vlan_strip_disable);
         MLX5_SET(wq,   wq,  log_wq_pg_sz,       rq->wq_ctrl.buf.page_shift -
                                                 MLX5_ADAPTER_PAGE_SHIFT);
@@ -525,6 +521,27 @@ static int mlx5e_wait_for_min_rx_wqes(struct mlx5e_rq *rq)
         return -ETIMEDOUT;
 }
 
+static void mlx5e_free_rx_descs(struct mlx5e_rq *rq)
+{
+        struct mlx5_wq_ll *wq = &rq->wq;
+        struct mlx5e_rx_wqe *wqe;
+        __be16 wqe_ix_be;
+        u16 wqe_ix;
+
+        /* UMR WQE (if in progress) is always at wq->head */
+        if (test_bit(MLX5E_RQ_STATE_UMR_WQE_IN_PROGRESS, &rq->state))
+                mlx5e_free_rx_fragmented_mpwqe(rq, &rq->wqe_info[wq->head]);
+
+        while (!mlx5_wq_ll_is_empty(wq)) {
+                wqe_ix_be = *wq->tail_next;
+                wqe_ix    = be16_to_cpu(wqe_ix_be);
+                wqe       = mlx5_wq_ll_get_wqe(&rq->wq, wqe_ix);
+                rq->dealloc_wqe(rq, wqe_ix);
+                mlx5_wq_ll_pop(&rq->wq, wqe_ix_be,
+                               &wqe->next.next_wqe_index);
+        }
+}
+
 static int mlx5e_open_rq(struct mlx5e_channel *c,
                          struct mlx5e_rq_param *param,
                          struct mlx5e_rq *rq)
@@ -548,8 +565,6 @@ static int mlx5e_open_rq(struct mlx5e_channel *c,
         if (param->am_enabled)
                 set_bit(MLX5E_RQ_STATE_AM, &c->rq.state);
 
-        set_bit(MLX5E_RQ_STATE_POST_WQES_ENABLE, &rq->state);
-
         sq->ico_wqe_info[pi].opcode     = MLX5_OPCODE_NOP;
         sq->ico_wqe_info[pi].num_wqebbs = 1;
         mlx5e_send_nop(sq, true); /* trigger mlx5e_post_rx_wqes() */
@@ -566,23 +581,8 @@ err_destroy_rq:
 
 static void mlx5e_close_rq(struct mlx5e_rq *rq)
 {
-        int tout = 0;
-        int err;
-
-        clear_bit(MLX5E_RQ_STATE_POST_WQES_ENABLE, &rq->state);
+        set_bit(MLX5E_RQ_STATE_FLUSH, &rq->state);
         napi_synchronize(&rq->channel->napi); /* prevent mlx5e_post_rx_wqes */
-
-        err = mlx5e_modify_rq_state(rq, MLX5_RQC_STATE_RDY, MLX5_RQC_STATE_ERR);
-        while (!mlx5_wq_ll_is_empty(&rq->wq) && !err &&
-               tout++ < MLX5_EN_QP_FLUSH_MAX_ITER)
-                msleep(MLX5_EN_QP_FLUSH_MSLEEP_QUANT);
-
-        if (err || tout == MLX5_EN_QP_FLUSH_MAX_ITER)
-                set_bit(MLX5E_RQ_STATE_FLUSH_TIMEOUT, &rq->state);
-
-        /* avoid destroying rq before mlx5e_poll_rx_cq() is done with it */
-        napi_synchronize(&rq->channel->napi);
-
         cancel_work_sync(&rq->am.work);
 
         mlx5e_disable_rq(rq);
@@ -821,7 +821,6 @@ static int mlx5e_open_sq(struct mlx5e_channel *c,
                 goto err_disable_sq;
 
         if (sq->txq) {
-                set_bit(MLX5E_SQ_STATE_WAKE_TXQ_ENABLE, &sq->state);
                 netdev_tx_reset_queue(sq->txq);
                 netif_tx_start_queue(sq->txq);
         }
@@ -845,38 +844,20 @@ static inline void netif_tx_disable_queue(struct netdev_queue *txq)
 
 static void mlx5e_close_sq(struct mlx5e_sq *sq)
 {
-        int tout = 0;
-        int err;
+        set_bit(MLX5E_SQ_STATE_FLUSH, &sq->state);
+        /* prevent netif_tx_wake_queue */
+        napi_synchronize(&sq->channel->napi);
 
         if (sq->txq) {
-                clear_bit(MLX5E_SQ_STATE_WAKE_TXQ_ENABLE, &sq->state);
-                /* prevent netif_tx_wake_queue */
-                napi_synchronize(&sq->channel->napi);
                 netif_tx_disable_queue(sq->txq);
 
-                /* ensure hw is notified of all pending wqes */
+                /* last doorbell out, godspeed .. */
                 if (mlx5e_sq_has_room_for(sq, 1))
                         mlx5e_send_nop(sq, true);
-
-                err = mlx5e_modify_sq(sq, MLX5_SQC_STATE_RDY,
-                                      MLX5_SQC_STATE_ERR, false, 0);
-                if (err)
-                        set_bit(MLX5E_SQ_STATE_TX_TIMEOUT, &sq->state);
-        }
-
-        /* wait till sq is empty, unless a TX timeout occurred on this SQ */
-        while (sq->cc != sq->pc &&
-               !test_bit(MLX5E_SQ_STATE_TX_TIMEOUT, &sq->state)) {
-                msleep(MLX5_EN_QP_FLUSH_MSLEEP_QUANT);
-                if (tout++ > MLX5_EN_QP_FLUSH_MAX_ITER)
-                        set_bit(MLX5E_SQ_STATE_TX_TIMEOUT, &sq->state);
         }
 
-        /* avoid destroying sq before mlx5e_poll_tx_cq() is done with it */
-        napi_synchronize(&sq->channel->napi);
-
-        mlx5e_free_tx_descs(sq);
         mlx5e_disable_sq(sq);
+        mlx5e_free_tx_descs(sq);
         mlx5e_destroy_sq(sq);
 }
 
@@ -1826,10 +1807,6 @@ int mlx5e_open_locked(struct net_device *netdev)
         netif_set_real_num_tx_queues(netdev, num_txqs);
         netif_set_real_num_rx_queues(netdev, priv->params.num_channels);
 
-        err = mlx5e_set_dev_port_mtu(netdev);
-        if (err)
-                goto err_clear_state_opened_flag;
-
         err = mlx5e_open_channels(priv);
         if (err) {
                 netdev_err(netdev, "%s: mlx5e_open_channels failed, %d\n",
@@ -2573,6 +2550,7 @@ static int mlx5e_change_mtu(struct net_device *netdev, int new_mtu)
         u16 max_mtu;
         u16 min_mtu;
         int err = 0;
+        bool reset;
 
         mlx5_query_port_max_mtu(mdev, &max_mtu, 1);
 
@@ -2588,13 +2566,18 @@ static int mlx5e_change_mtu(struct net_device *netdev, int new_mtu)
 
         mutex_lock(&priv->state_lock);
 
+        reset = !priv->params.lro_en &&
+                (priv->params.rq_wq_type !=
+                 MLX5_WQ_TYPE_LINKED_LIST_STRIDING_RQ);
+
         was_opened = test_bit(MLX5E_STATE_OPENED, &priv->state);
-        if (was_opened)
+        if (was_opened && reset)
                 mlx5e_close_locked(netdev);
 
         netdev->mtu = new_mtu;
+        mlx5e_set_dev_port_mtu(netdev);
 
-        if (was_opened)
+        if (was_opened && reset)
                 err = mlx5e_open_locked(netdev);
 
         mutex_unlock(&priv->state_lock);
@@ -2794,7 +2777,7 @@ static void mlx5e_tx_timeout(struct net_device *dev)
                 if (!netif_xmit_stopped(netdev_get_tx_queue(dev, i)))
                         continue;
                 sched_work = true;
-                set_bit(MLX5E_SQ_STATE_TX_TIMEOUT, &sq->state);
+                set_bit(MLX5E_SQ_STATE_FLUSH, &sq->state);
                 netdev_err(dev, "TX timeout on queue: %d, SQ: 0x%x, CQ: 0x%x, SQ Cons: 0x%x SQ Prod: 0x%x\n",
                            i, sq->sqn, sq->cq.mcq.cqn, sq->cc, sq->pc);
         }
@@ -3231,8 +3214,8 @@ static int mlx5e_create_umr_mkey(struct mlx5e_priv *priv)
         struct mlx5_create_mkey_mbox_in *in;
         struct mlx5_mkey_seg *mkc;
         int inlen = sizeof(*in);
-        u64 npages =
-                priv->profile->max_nch(mdev) * MLX5_CHANNEL_MAX_NUM_MTTS;
+        u64 npages = MLX5E_REQUIRED_MTTS(priv->profile->max_nch(mdev),
+                                         BIT(MLX5E_PARAMS_MAXIMUM_LOG_RQ_SIZE_MPW));
         int err;
 
         in = mlx5_vzalloc(inlen);
@@ -3246,10 +3229,12 @@ static int mlx5e_create_umr_mkey(struct mlx5e_priv *priv)
                      MLX5_PERM_LOCAL_WRITE |
                      MLX5_ACCESS_MODE_MTT;
 
+        npages = min_t(u32, ALIGN(U16_MAX, 4) * 2, npages);
+
         mkc->qpn_mkey7_0 = cpu_to_be32(0xffffff << 8);
         mkc->flags_pd = cpu_to_be32(mdev->mlx5e_res.pdn);
         mkc->len = cpu_to_be64(npages << PAGE_SHIFT);
-        mkc->xlt_oct_size = cpu_to_be32(mlx5e_get_mtt_octw(npages));
+        mkc->xlt_oct_size = cpu_to_be32(MLX5_MTT_OCTW(npages));
         mkc->log2_page_size = PAGE_SHIFT;
 
         err = mlx5_core_create_mkey(mdev, &priv->umr_mkey, in, inlen, NULL,
@@ -3385,6 +3370,7 @@ static void mlx5e_nic_enable(struct mlx5e_priv *priv)
         queue_work(priv->wq, &priv->set_rx_mode_work);
 
         if (MLX5_CAP_GEN(mdev, vport_group_manager)) {
+                mlx5_query_nic_vport_mac_address(mdev, 0, rep.hw_id);
                 rep.load = mlx5e_nic_rep_load;
                 rep.unload = mlx5e_nic_rep_unload;
                 rep.vport = 0;
@@ -3463,6 +3449,8 @@ void *mlx5e_create_netdev(struct mlx5_core_dev *mdev,
 
         mlx5e_init_l2_addr(priv);
 
+        mlx5e_set_dev_port_mtu(netdev);
+
         err = register_netdev(netdev);
         if (err) {
                 mlx5_core_err(mdev, "register_netdev failed, %d\n", err);
@@ -3501,16 +3489,20 @@ static void mlx5e_register_vport_rep(struct mlx5_core_dev *mdev)
         struct mlx5_eswitch *esw = mdev->priv.eswitch;
         int total_vfs = MLX5_TOTAL_VPORTS(mdev);
         int vport;
+        u8 mac[ETH_ALEN];
 
         if (!MLX5_CAP_GEN(mdev, vport_group_manager))
                 return;
 
+        mlx5_query_nic_vport_mac_address(mdev, 0, mac);
+
         for (vport = 1; vport < total_vfs; vport++) {
                 struct mlx5_eswitch_rep rep;
 
                 rep.load = mlx5e_vport_rep_load;
                 rep.unload = mlx5e_vport_rep_unload;
                 rep.vport = vport;
+                ether_addr_copy(rep.hw_id, mac);
                 mlx5_eswitch_register_vport_rep(esw, &rep);
         }
 }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
index 1c7d8b8314bf..134de4a11f1d 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
@@ -135,17 +135,16 @@ static const struct ethtool_ops mlx5e_rep_ethtool_ops = {
 int mlx5e_attr_get(struct net_device *dev, struct switchdev_attr *attr)
 {
         struct mlx5e_priv *priv = netdev_priv(dev);
+        struct mlx5_eswitch_rep *rep = priv->ppriv;
         struct mlx5_eswitch *esw = priv->mdev->priv.eswitch;
-        u8 mac[ETH_ALEN];
 
         if (esw->mode == SRIOV_NONE)
                 return -EOPNOTSUPP;
 
         switch (attr->id) {
         case SWITCHDEV_ATTR_ID_PORT_PARENT_ID:
-                mlx5_query_nic_vport_mac_address(priv->mdev, 0, mac);
                 attr->u.ppid.id_len = ETH_ALEN;
-                memcpy(&attr->u.ppid.id, &mac, ETH_ALEN);
+                ether_addr_copy(attr->u.ppid.id, rep->hw_id);
                 break;
         default:
                 return -EOPNOTSUPP;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
index 9f2a16a507e0..e7c969df3dad 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
@@ -324,9 +324,9 @@ mlx5e_copy_skb_header_fragmented_mpwqe(struct device *pdev,
         }
 }
 
-static u16 mlx5e_get_wqe_mtt_offset(u16 rq_ix, u16 wqe_ix)
+static u32 mlx5e_get_wqe_mtt_offset(struct mlx5e_rq *rq, u16 wqe_ix)
 {
-        return rq_ix * MLX5_CHANNEL_MAX_NUM_MTTS +
+        return rq->mpwqe_mtt_offset +
                 wqe_ix * ALIGN(MLX5_MPWRQ_PAGES_PER_WQE, 8);
 }
 
@@ -340,7 +340,7 @@ static void mlx5e_build_umr_wqe(struct mlx5e_rq *rq,
         struct mlx5_wqe_data_seg      *dseg = &wqe->data;
         struct mlx5e_mpw_info *wi = &rq->wqe_info[ix];
         u8 ds_cnt = DIV_ROUND_UP(sizeof(*wqe), MLX5_SEND_WQE_DS);
-        u16 umr_wqe_mtt_offset = mlx5e_get_wqe_mtt_offset(rq->ix, ix);
+        u32 umr_wqe_mtt_offset = mlx5e_get_wqe_mtt_offset(rq, ix);
 
         memset(wqe, 0, sizeof(*wqe));
         cseg->opmod_idx_opcode =
@@ -353,9 +353,9 @@ static void mlx5e_build_umr_wqe(struct mlx5e_rq *rq,
 
         ucseg->flags = MLX5_UMR_TRANSLATION_OFFSET_EN;
         ucseg->klm_octowords =
-                cpu_to_be16(mlx5e_get_mtt_octw(MLX5_MPWRQ_PAGES_PER_WQE));
+                cpu_to_be16(MLX5_MTT_OCTW(MLX5_MPWRQ_PAGES_PER_WQE));
         ucseg->bsf_octowords =
-                cpu_to_be16(mlx5e_get_mtt_octw(umr_wqe_mtt_offset));
+                cpu_to_be16(MLX5_MTT_OCTW(umr_wqe_mtt_offset));
         ucseg->mkey_mask     = cpu_to_be64(MLX5_MKEY_MASK_FREE);
 
         dseg->lkey = sq->mkey_be;
@@ -423,7 +423,7 @@ static int mlx5e_alloc_rx_fragmented_mpwqe(struct mlx5e_rq *rq,
 {
         struct mlx5e_mpw_info *wi = &rq->wqe_info[ix];
         int mtt_sz = mlx5e_get_wqe_mtt_sz();
-        u32 dma_offset = mlx5e_get_wqe_mtt_offset(rq->ix, ix) << PAGE_SHIFT;
+        u64 dma_offset = (u64)mlx5e_get_wqe_mtt_offset(rq, ix) << PAGE_SHIFT;
         int i;
 
         wi->umr.dma_info = kmalloc(sizeof(*wi->umr.dma_info) *
@@ -506,6 +506,12 @@ void mlx5e_post_rx_fragmented_mpwqe(struct mlx5e_rq *rq)
         struct mlx5e_rx_wqe *wqe = mlx5_wq_ll_get_wqe(wq, wq->head);
 
         clear_bit(MLX5E_RQ_STATE_UMR_WQE_IN_PROGRESS, &rq->state);
+
+        if (unlikely(test_bit(MLX5E_RQ_STATE_FLUSH, &rq->state))) {
+                mlx5e_free_rx_fragmented_mpwqe(rq, &rq->wqe_info[wq->head]);
+                return;
+        }
+
         mlx5_wq_ll_push(wq, be16_to_cpu(wqe->next.next_wqe_index));
         rq->stats.mpwqe_frag++;
 
@@ -595,26 +601,9 @@ void mlx5e_dealloc_rx_mpwqe(struct mlx5e_rq *rq, u16 ix)
         wi->free_wqe(rq, wi);
 }
 
-void mlx5e_free_rx_descs(struct mlx5e_rq *rq)
-{
-        struct mlx5_wq_ll *wq = &rq->wq;
-        struct mlx5e_rx_wqe *wqe;
-        __be16 wqe_ix_be;
-        u16 wqe_ix;
-
-        while (!mlx5_wq_ll_is_empty(wq)) {
-                wqe_ix_be = *wq->tail_next;
-                wqe_ix    = be16_to_cpu(wqe_ix_be);
-                wqe       = mlx5_wq_ll_get_wqe(&rq->wq, wqe_ix);
-                rq->dealloc_wqe(rq, wqe_ix);
-                mlx5_wq_ll_pop(&rq->wq, wqe_ix_be,
-                               &wqe->next.next_wqe_index);
-        }
-}
-
 #define RQ_CANNOT_POST(rq) \
-                (!test_bit(MLX5E_RQ_STATE_POST_WQES_ENABLE, &rq->state) || \
-                 test_bit(MLX5E_RQ_STATE_UMR_WQE_IN_PROGRESS, &rq->state))
+        (test_bit(MLX5E_RQ_STATE_FLUSH, &rq->state) || \
+         test_bit(MLX5E_RQ_STATE_UMR_WQE_IN_PROGRESS, &rq->state))
 
 bool mlx5e_post_rx_wqes(struct mlx5e_rq *rq)
 {
@@ -648,24 +637,32 @@ bool mlx5e_post_rx_wqes(struct mlx5e_rq *rq)
 static void mlx5e_lro_update_hdr(struct sk_buff *skb, struct mlx5_cqe64 *cqe,
                                  u32 cqe_bcnt)
 {
-        struct ethhdr   *eth    = (struct ethhdr *)(skb->data);
-        struct iphdr    *ipv4   = (struct iphdr *)(skb->data + ETH_HLEN);
-        struct ipv6hdr  *ipv6   = (struct ipv6hdr *)(skb->data + ETH_HLEN);
+        struct ethhdr   *eth = (struct ethhdr *)(skb->data);
+        struct iphdr    *ipv4;
+        struct ipv6hdr  *ipv6;
         struct tcphdr   *tcp;
+        int network_depth = 0;
+        __be16 proto;
+        u16 tot_len;
 
         u8 l4_hdr_type = get_cqe_l4_hdr_type(cqe);
         int tcp_ack = ((CQE_L4_HDR_TYPE_TCP_ACK_NO_DATA  == l4_hdr_type) ||
                        (CQE_L4_HDR_TYPE_TCP_ACK_AND_DATA == l4_hdr_type));
 
-        u16 tot_len = cqe_bcnt - ETH_HLEN;
+        skb->mac_len = ETH_HLEN;
+        proto = __vlan_get_protocol(skb, eth->h_proto, &network_depth);
+
+        ipv4 = (struct iphdr *)(skb->data + network_depth);
+        ipv6 = (struct ipv6hdr *)(skb->data + network_depth);
+        tot_len = cqe_bcnt - network_depth;
 
-        if (eth->h_proto == htons(ETH_P_IP)) {
-                tcp = (struct tcphdr *)(skb->data + ETH_HLEN +
+        if (proto == htons(ETH_P_IP)) {
+                tcp = (struct tcphdr *)(skb->data + network_depth +
                                         sizeof(struct iphdr));
                 ipv6 = NULL;
                 skb_shinfo(skb)->gso_type = SKB_GSO_TCPV4;
         } else {
-                tcp = (struct tcphdr *)(skb->data + ETH_HLEN +
+                tcp = (struct tcphdr *)(skb->data + network_depth +
                                         sizeof(struct ipv6hdr));
                 ipv4 = NULL;
                 skb_shinfo(skb)->gso_type = SKB_GSO_TCPV6;
@@ -916,7 +913,7 @@ int mlx5e_poll_rx_cq(struct mlx5e_cq *cq, int budget)
         struct mlx5e_rq *rq = container_of(cq, struct mlx5e_rq, cq);
         int work_done = 0;
 
-        if (unlikely(test_bit(MLX5E_RQ_STATE_FLUSH_TIMEOUT, &rq->state)))
+        if (unlikely(test_bit(MLX5E_RQ_STATE_FLUSH, &rq->state)))
                 return 0;
 
         if (cq->decmprs_left)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h
index 7b9d8a989b52..499487ce3b53 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h
@@ -70,6 +70,7 @@ struct mlx5e_sw_stats {
         u64 tx_queue_stopped;
         u64 tx_queue_wake;
         u64 tx_queue_dropped;
+        u64 tx_xmit_more;
         u64 rx_wqe_err;
         u64 rx_mpwqe_filler;
         u64 rx_mpwqe_frag;
@@ -101,6 +102,7 @@ static const struct counter_desc sw_stats_desc[] = {
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_queue_stopped) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_queue_wake) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_queue_dropped) },
+        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_xmit_more) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_wqe_err) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_mpwqe_filler) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_mpwqe_frag) },
@@ -298,6 +300,7 @@ struct mlx5e_sq_stats {
         /* commonly accessed in data path */
         u64 packets;
         u64 bytes;
+        u64 xmit_more;
         u64 tso_packets;
         u64 tso_bytes;
         u64 tso_inner_packets;
@@ -324,6 +327,7 @@ static const struct counter_desc sq_stats_desc[] = {
         { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, stopped) },
         { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, wake) },
         { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, dropped) },
+        { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, xmit_more) },
 };
 
 #define NUM_SW_COUNTERS                 ARRAY_SIZE(sw_stats_desc)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
index 0f19b01e3fff..22cfc4ac1837 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
@@ -170,7 +170,7 @@ static int parse_cls_flower(struct mlx5e_priv *priv, struct mlx5_flow_spec *spec
         if (dissector_uses_key(f->dissector, FLOW_DISSECTOR_KEY_CONTROL)) {
                 struct flow_dissector_key_control *key =
                         skb_flow_dissector_target(f->dissector,
-                                                  FLOW_DISSECTOR_KEY_BASIC,
+                                                  FLOW_DISSECTOR_KEY_CONTROL,
                                                   f->key);
                 addr_type = key->addr_type;
         }
@@ -318,6 +318,7 @@ static int parse_tc_nic_actions(struct mlx5e_priv *priv, struct tcf_exts *exts,
                                 u32 *action, u32 *flow_tag)
 {
         const struct tc_action *a;
+        LIST_HEAD(actions);
 
         if (tc_no_actions(exts))
                 return -EINVAL;
@@ -325,7 +326,8 @@ static int parse_tc_nic_actions(struct mlx5e_priv *priv, struct tcf_exts *exts,
         *flow_tag = MLX5_FS_DEFAULT_FLOW_TAG;
         *action = 0;
 
-        tc_for_each_action(a, exts) {
+        tcf_exts_to_list(exts, &actions);
+        list_for_each_entry(a, &actions, list) {
                 /* Only support a single action per rule */
                 if (*action)
                         return -EINVAL;
@@ -362,13 +364,15 @@ static int parse_tc_fdb_actions(struct mlx5e_priv *priv, struct tcf_exts *exts,
                                 u32 *action, u32 *dest_vport)
 {
         const struct tc_action *a;
+        LIST_HEAD(actions);
 
         if (tc_no_actions(exts))
                 return -EINVAL;
 
         *action = 0;
 
-        tc_for_each_action(a, exts) {
+        tcf_exts_to_list(exts, &actions);
+        list_for_each_entry(a, &actions, list) {
                 /* Only support a single action per rule */
                 if (*action)
                         return -EINVAL;
@@ -503,6 +507,7 @@ int mlx5e_stats_flower(struct mlx5e_priv *priv,
         struct mlx5e_tc_flow *flow;
         struct tc_action *a;
         struct mlx5_fc *counter;
+        LIST_HEAD(actions);
         u64 bytes;
         u64 packets;
         u64 lastuse;
@@ -518,7 +523,8 @@ int mlx5e_stats_flower(struct mlx5e_priv *priv,
 
         mlx5_fc_query_cached(counter, &bytes, &packets, &lastuse);
 
-        tc_for_each_action(a, f->exts)
+        tcf_exts_to_list(f->exts, &actions);
+        list_for_each_entry(a, &actions, list)
                 tcf_action_stats_update(a, bytes, packets, lastuse);
 
         return 0;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
index e073bf59890d..eb0e72537f10 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
@@ -356,6 +356,7 @@ static netdev_tx_t mlx5e_sq_xmit(struct mlx5e_sq *sq, struct sk_buff *skb)
                 sq->stats.stopped++;
         }
 
+        sq->stats.xmit_more += skb->xmit_more;
         if (!skb->xmit_more || netif_xmit_stopped(sq->txq)) {
                 int bf_sz = 0;
 
@@ -394,35 +395,6 @@ netdev_tx_t mlx5e_xmit(struct sk_buff *skb, struct net_device *dev)
         return mlx5e_sq_xmit(sq, skb);
 }
 
-void mlx5e_free_tx_descs(struct mlx5e_sq *sq)
-{
-        struct mlx5e_tx_wqe_info *wi;
-        struct sk_buff *skb;
-        u16 ci;
-        int i;
-
-        while (sq->cc != sq->pc) {
-                ci = sq->cc & sq->wq.sz_m1;
-                skb = sq->skb[ci];
-                wi = &sq->wqe_info[ci];
-
-                if (!skb) { /* nop */
-                        sq->cc++;
-                        continue;
-                }
-
-                for (i = 0; i < wi->num_dma; i++) {
-                        struct mlx5e_sq_dma *dma =
-                                mlx5e_dma_get(sq, sq->dma_fifo_cc++);
-
-                        mlx5e_tx_dma_unmap(sq->pdev, dma);
-                }
-
-                dev_kfree_skb_any(skb);
-                sq->cc += wi->num_wqebbs;
-        }
-}
-
 bool mlx5e_poll_tx_cq(struct mlx5e_cq *cq, int napi_budget)
 {
         struct mlx5e_sq *sq;
@@ -434,7 +406,7 @@ bool mlx5e_poll_tx_cq(struct mlx5e_cq *cq, int napi_budget)
 
         sq = container_of(cq, struct mlx5e_sq, cq);
 
-        if (unlikely(test_bit(MLX5E_SQ_STATE_TX_TIMEOUT, &sq->state)))
+        if (unlikely(test_bit(MLX5E_SQ_STATE_FLUSH, &sq->state)))
                 return false;
 
         npkts = 0;
@@ -512,11 +484,39 @@ bool mlx5e_poll_tx_cq(struct mlx5e_cq *cq, int napi_budget)
         netdev_tx_completed_queue(sq->txq, npkts, nbytes);
 
         if (netif_tx_queue_stopped(sq->txq) &&
-            mlx5e_sq_has_room_for(sq, MLX5E_SQ_STOP_ROOM) &&
-            likely(test_bit(MLX5E_SQ_STATE_WAKE_TXQ_ENABLE, &sq->state))) {
-                                netif_tx_wake_queue(sq->txq);
-                                sq->stats.wake++;
+            mlx5e_sq_has_room_for(sq, MLX5E_SQ_STOP_ROOM)) {
+                netif_tx_wake_queue(sq->txq);
+                sq->stats.wake++;
         }
 
         return (i == MLX5E_TX_CQ_POLL_BUDGET);
 }
+
+void mlx5e_free_tx_descs(struct mlx5e_sq *sq)
+{
+        struct mlx5e_tx_wqe_info *wi;
+        struct sk_buff *skb;
+        u16 ci;
+        int i;
+
+        while (sq->cc != sq->pc) {
+                ci = sq->cc & sq->wq.sz_m1;
+                skb = sq->skb[ci];
+                wi = &sq->wqe_info[ci];
+
+                if (!skb) { /* nop */
+                        sq->cc++;
+                        continue;
+                }
+
+                for (i = 0; i < wi->num_dma; i++) {
+                        struct mlx5e_sq_dma *dma =
+                                mlx5e_dma_get(sq, sq->dma_fifo_cc++);
+
+                        mlx5e_tx_dma_unmap(sq->pdev, dma);
+                }
+
+                dev_kfree_skb_any(skb);
+                sq->cc += wi->num_wqebbs;
+        }
+}
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_txrx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_txrx.c
index 64ae2e800daa..9bf33bb69210 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_txrx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_txrx.c
@@ -51,16 +51,18 @@ struct mlx5_cqe64 *mlx5e_get_cqe(struct mlx5e_cq *cq)
 
 static void mlx5e_poll_ico_cq(struct mlx5e_cq *cq)
 {
+        struct mlx5e_sq *sq = container_of(cq, struct mlx5e_sq, cq);
         struct mlx5_wq_cyc *wq;
         struct mlx5_cqe64 *cqe;
-        struct mlx5e_sq *sq;
         u16 sqcc;
 
+        if (unlikely(test_bit(MLX5E_SQ_STATE_FLUSH, &sq->state)))
+                return;
+
         cqe = mlx5e_get_cqe(cq);
         if (likely(!cqe))
                 return;
 
-        sq = container_of(cq, struct mlx5e_sq, cq);
         wq = &sq->wq;
 
         /* sq->cc must be updated only after mlx5_cqwq_update_db_record(),
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
index f6d667797ee1..b247949df135 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
@@ -1451,7 +1451,8 @@ static void esw_enable_vport(struct mlx5_eswitch *esw, int vport_num,
 
         esw_debug(esw->dev, "Enabling VPORT(%d)\n", vport_num);
 
-        if (vport_num) { /* Only VFs need ACLs for VST and spoofchk filtering */
+        /* Only VFs need ACLs for VST and spoofchk filtering */
+        if (vport_num && esw->mode == SRIOV_LEGACY) {
                 esw_vport_ingress_config(esw, vport);
                 esw_vport_egress_config(esw, vport);
         }
@@ -1502,7 +1503,7 @@ static void esw_disable_vport(struct mlx5_eswitch *esw, int vport_num)
          */
         esw_vport_change_handle_locked(vport);
         vport->enabled_events = 0;
-        if (vport_num) {
+        if (vport_num && esw->mode == SRIOV_LEGACY) {
                 esw_vport_disable_egress_acl(esw, vport);
                 esw_vport_disable_ingress_acl(esw, vport);
         }
@@ -1553,6 +1554,7 @@ int mlx5_eswitch_enable_sriov(struct mlx5_eswitch *esw, int nvfs, int mode)
 
 abort:
         esw_enable_vport(esw, 0, UC_ADDR_CHANGE);
+        esw->mode = SRIOV_NONE;
         return err;
 }
 
@@ -1767,7 +1769,7 @@ int mlx5_eswitch_set_vport_mac(struct mlx5_eswitch *esw,
                                vport, err);
 
         mutex_lock(&esw->state_lock);
-        if (evport->enabled)
+        if (evport->enabled && esw->mode == SRIOV_LEGACY)
                 err = esw_vport_ingress_config(esw, evport);
         mutex_unlock(&esw->state_lock);
         return err;
@@ -1839,7 +1841,7 @@ int mlx5_eswitch_set_vport_vlan(struct mlx5_eswitch *esw,
         mutex_lock(&esw->state_lock);
         evport->vlan = vlan;
         evport->qos = qos;
-        if (evport->enabled) {
+        if (evport->enabled && esw->mode == SRIOV_LEGACY) {
                 err = esw_vport_ingress_config(esw, evport);
                 if (err)
                         goto out;
@@ -1868,10 +1870,11 @@ int mlx5_eswitch_set_vport_spoofchk(struct mlx5_eswitch *esw,
         mutex_lock(&esw->state_lock);
         pschk = evport->spoofchk;
         evport->spoofchk = spoofchk;
-        if (evport->enabled)
+        if (evport->enabled && esw->mode == SRIOV_LEGACY) {
                 err = esw_vport_ingress_config(esw, evport);
-        if (err)
-                evport->spoofchk = pschk;
+                if (err)
+                        evport->spoofchk = pschk;
+        }
         mutex_unlock(&esw->state_lock);
 
         return err;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h
index c0b05603fc31..a96140971d77 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h
@@ -174,6 +174,7 @@ struct mlx5_eswitch_rep {
         void                  *priv_data;
         struct list_head       vport_sqs_list;
         bool                   valid;
+        u8                     hw_id[ETH_ALEN];
 };
 
 struct mlx5_esw_offload {
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
index a357e8eeeed8..7de40e6b0c25 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
@@ -113,7 +113,7 @@ mlx5_eswitch_add_send_to_vport_rule(struct mlx5_eswitch *esw, int vport, u32 sqn
         dest.type = MLX5_FLOW_DESTINATION_TYPE_VPORT;
         dest.vport_num = vport;
 
-        flow_rule = mlx5_add_flow_rule(esw->fdb_table.fdb, spec,
+        flow_rule = mlx5_add_flow_rule(esw->fdb_table.offloads.fdb, spec,
                                        MLX5_FLOW_CONTEXT_ACTION_FWD_DEST,
                                        0, &dest);
         if (IS_ERR(flow_rule))
@@ -446,7 +446,7 @@ out:
 
 static int esw_offloads_start(struct mlx5_eswitch *esw)
 {
-        int err, num_vfs = esw->dev->priv.sriov.num_vfs;
+        int err, err1, num_vfs = esw->dev->priv.sriov.num_vfs;
 
         if (esw->mode != SRIOV_LEGACY) {
                 esw_warn(esw->dev, "Can't set offloads mode, SRIOV legacy not enabled\n");
@@ -455,8 +455,12 @@ static int esw_offloads_start(struct mlx5_eswitch *esw)
 
         mlx5_eswitch_disable_sriov(esw);
         err = mlx5_eswitch_enable_sriov(esw, num_vfs, SRIOV_OFFLOADS);
-        if (err)
-                esw_warn(esw->dev, "Failed set eswitch to offloads, err %d\n", err);
+        if (err) {
+                esw_warn(esw->dev, "Failed setting eswitch to offloads, err %d\n", err);
+                err1 = mlx5_eswitch_enable_sriov(esw, num_vfs, SRIOV_LEGACY);
+                if (err1)
+                        esw_warn(esw->dev, "Failed setting eswitch back to legacy, err %d\n", err);
+        }
         return err;
 }
 
@@ -508,12 +512,16 @@ create_ft_err:
 
 static int esw_offloads_stop(struct mlx5_eswitch *esw)
 {
-        int err, num_vfs = esw->dev->priv.sriov.num_vfs;
+        int err, err1, num_vfs = esw->dev->priv.sriov.num_vfs;
 
         mlx5_eswitch_disable_sriov(esw);
         err = mlx5_eswitch_enable_sriov(esw, num_vfs, SRIOV_LEGACY);
-        if (err)
-                esw_warn(esw->dev, "Failed set eswitch legacy mode. err %d\n", err);
+        if (err) {
+                esw_warn(esw->dev, "Failed setting eswitch to legacy, err %d\n", err);
+                err1 = mlx5_eswitch_enable_sriov(esw, num_vfs, SRIOV_OFFLOADS);
+                if (err1)
+                        esw_warn(esw->dev, "Failed setting eswitch back to offloads, err %d\n", err);
+        }
 
         return err;
 }
@@ -535,7 +543,7 @@ void esw_offloads_cleanup(struct mlx5_eswitch *esw, int nvports)
         esw_destroy_offloads_fdb_table(esw);
 }
 
-static int mlx5_esw_mode_from_devlink(u16 mode, u16 *mlx5_mode)
+static int esw_mode_from_devlink(u16 mode, u16 *mlx5_mode)
 {
         switch (mode) {
         case DEVLINK_ESWITCH_MODE_LEGACY:
@@ -551,6 +559,22 @@ static int mlx5_esw_mode_from_devlink(u16 mode, u16 *mlx5_mode)
         return 0;
 }
 
+static int esw_mode_to_devlink(u16 mlx5_mode, u16 *mode)
+{
+        switch (mlx5_mode) {
+        case SRIOV_LEGACY:
+                *mode = DEVLINK_ESWITCH_MODE_LEGACY;
+                break;
+        case SRIOV_OFFLOADS:
+                *mode = DEVLINK_ESWITCH_MODE_SWITCHDEV;
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
 int mlx5_devlink_eswitch_mode_set(struct devlink *devlink, u16 mode)
 {
         struct mlx5_core_dev *dev;
@@ -566,7 +590,7 @@ int mlx5_devlink_eswitch_mode_set(struct devlink *devlink, u16 mode)
         if (cur_mlx5_mode == SRIOV_NONE)
                 return -EOPNOTSUPP;
 
-        if (mlx5_esw_mode_from_devlink(mode, &mlx5_mode))
+        if (esw_mode_from_devlink(mode, &mlx5_mode))
                 return -EINVAL;
 
         if (cur_mlx5_mode == mlx5_mode)
@@ -592,9 +616,7 @@ int mlx5_devlink_eswitch_mode_get(struct devlink *devlink, u16 *mode)
         if (dev->priv.eswitch->mode == SRIOV_NONE)
                 return -EOPNOTSUPP;
 
-        *mode = dev->priv.eswitch->mode;
-
-        return 0;
+        return esw_mode_to_devlink(dev->priv.eswitch->mode, mode);
 }
 
 void mlx5_eswitch_register_vport_rep(struct mlx5_eswitch *esw,
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c
index 9134010e2921..287ade151ec8 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c
@@ -425,11 +425,11 @@ struct mlx5_cmd_fc_bulk *
 mlx5_cmd_fc_bulk_alloc(struct mlx5_core_dev *dev, u16 id, int num)
 {
         struct mlx5_cmd_fc_bulk *b;
-        int outlen = sizeof(*b) +
+        int outlen =
                 MLX5_ST_SZ_BYTES(query_flow_counter_out) +
                 MLX5_ST_SZ_BYTES(traffic_counter) * num;
 
-        b = kzalloc(outlen, GFP_KERNEL);
+        b = kzalloc(sizeof(*b) + outlen, GFP_KERNEL);
         if (!b)
                 return NULL;
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
index 75bb8c864557..3d6c1f65e586 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
@@ -80,7 +80,7 @@
                            LEFTOVERS_NUM_PRIOS)
 
 #define ETHTOOL_PRIO_NUM_LEVELS 1
-#define ETHTOOL_NUM_PRIOS 10
+#define ETHTOOL_NUM_PRIOS 11
 #define ETHTOOL_MIN_LEVEL (KERNEL_MIN_LEVEL + ETHTOOL_NUM_PRIOS)
 /* Vlan, mac, ttc, aRFS */
 #define KERNEL_NIC_PRIO_NUM_LEVELS 4
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_counters.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_counters.c
index c2877e9de8a1..3a9195b4169d 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_counters.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_counters.c
@@ -126,12 +126,21 @@ static struct rb_node *mlx5_fc_stats_query(struct mlx5_core_dev *dev,
         for (node = &first->node; node; node = rb_next(node)) {
                 struct mlx5_fc *counter = rb_entry(node, struct mlx5_fc, node);
                 struct mlx5_fc_cache *c = &counter->cache;
+                u64 packets;
+                u64 bytes;
 
                 if (counter->id > last_id)
                         break;
 
                 mlx5_cmd_fc_bulk_get(dev, b,
-                                     counter->id, &c->packets, &c->bytes);
+                                     counter->id, &packets, &bytes);
+
+                if (c->packets == packets)
+                        continue;
+
+                c->packets = packets;
+                c->bytes = bytes;
+                c->lastuse = jiffies;
         }
 
 out:
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
index 4f491d43e77d..2385bae92672 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
@@ -1420,36 +1420,12 @@ static pci_ers_result_t mlx5_pci_err_detected(struct pci_dev *pdev,
         dev_info(&pdev->dev, "%s was called\n", __func__);
         mlx5_enter_error_state(dev);
         mlx5_unload_one(dev, priv);
+        pci_save_state(pdev);
         mlx5_pci_disable_device(dev);
         return state == pci_channel_io_perm_failure ?
                 PCI_ERS_RESULT_DISCONNECT : PCI_ERS_RESULT_NEED_RESET;
 }
 
-static pci_ers_result_t mlx5_pci_slot_reset(struct pci_dev *pdev)
-{
-        struct mlx5_core_dev *dev = pci_get_drvdata(pdev);
-        int err = 0;
-
-        dev_info(&pdev->dev, "%s was called\n", __func__);
-
-        err = mlx5_pci_enable_device(dev);
-        if (err) {
-                dev_err(&pdev->dev, "%s: mlx5_pci_enable_device failed with error code: %d\n"
-                        , __func__, err);
-                return PCI_ERS_RESULT_DISCONNECT;
-        }
-        pci_set_master(pdev);
-        pci_set_power_state(pdev, PCI_D0);
-        pci_restore_state(pdev);
-
-        return err ? PCI_ERS_RESULT_DISCONNECT : PCI_ERS_RESULT_RECOVERED;
-}
-
-void mlx5_disable_device(struct mlx5_core_dev *dev)
-{
-        mlx5_pci_err_detected(dev->pdev, 0);
-}
-
 /* wait for the device to show vital signs by waiting
  * for the health counter to start counting.
  */
@@ -1477,21 +1453,44 @@ static int wait_vital(struct pci_dev *pdev)
         return -ETIMEDOUT;
 }
 
-static void mlx5_pci_resume(struct pci_dev *pdev)
+static pci_ers_result_t mlx5_pci_slot_reset(struct pci_dev *pdev)
 {
         struct mlx5_core_dev *dev = pci_get_drvdata(pdev);
-        struct mlx5_priv *priv = &dev->priv;
         int err;
 
         dev_info(&pdev->dev, "%s was called\n", __func__);
 
-        pci_save_state(pdev);
-        err = wait_vital(pdev);
+        err = mlx5_pci_enable_device(dev);
         if (err) {
+                dev_err(&pdev->dev, "%s: mlx5_pci_enable_device failed with error code: %d\n"
+                        , __func__, err);
+                return PCI_ERS_RESULT_DISCONNECT;
+        }
+
+        pci_set_master(pdev);
+        pci_restore_state(pdev);
+
+        if (wait_vital(pdev)) {
                 dev_err(&pdev->dev, "%s: wait_vital timed out\n", __func__);
-                return;
+                return PCI_ERS_RESULT_DISCONNECT;
         }
 
+        return PCI_ERS_RESULT_RECOVERED;
+}
+
+void mlx5_disable_device(struct mlx5_core_dev *dev)
+{
+        mlx5_pci_err_detected(dev->pdev, 0);
+}
+
+static void mlx5_pci_resume(struct pci_dev *pdev)
+{
+        struct mlx5_core_dev *dev = pci_get_drvdata(pdev);
+        struct mlx5_priv *priv = &dev->priv;
+        int err;
+
+        dev_info(&pdev->dev, "%s was called\n", __func__);
+
         err = mlx5_load_one(dev, priv);
         if (err)
                 dev_err(&pdev->dev, "%s: mlx5_load_one failed with error code: %d\n"
diff --git a/drivers/net/ethernet/mellanox/mlxsw/port.h b/drivers/net/ethernet/mellanox/mlxsw/port.h
index f33b997f2b61..af371a82c35b 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/port.h
+++ b/drivers/net/ethernet/mellanox/mlxsw/port.h
@@ -56,6 +56,7 @@
 #define MLXSW_PORT_PHY_BITS_MASK        (MLXSW_PORT_MAX_PHY_PORTS - 1)
 
 #define MLXSW_PORT_CPU_PORT             0x0
+#define MLXSW_PORT_ROUTER_PORT          (MLXSW_PORT_MAX_PHY_PORTS + 2)
 
 #define MLXSW_PORT_DONT_CARE            (MLXSW_PORT_MAX_PORTS)
 
diff --git a/drivers/net/ethernet/mellanox/mlxsw/reg.h b/drivers/net/ethernet/mellanox/mlxsw/reg.h
index 7ca9201f7dcb..1721098eef13 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/reg.h
+++ b/drivers/net/ethernet/mellanox/mlxsw/reg.h
@@ -3383,6 +3383,15 @@ MLXSW_ITEM32(reg, ritr, ipv4_fe, 0x04, 29, 1);
  */
 MLXSW_ITEM32(reg, ritr, ipv6_fe, 0x04, 28, 1);
 
+/* reg_ritr_lb_en
+ * Loop-back filter enable for unicast packets.
+ * If the flag is set then loop-back filter for unicast packets is
+ * implemented on the RIF. Multicast packets are always subject to
+ * loop-back filtering.
+ * Access: RW
+ */
+MLXSW_ITEM32(reg, ritr, lb_en, 0x04, 24, 1);
+
 /* reg_ritr_virtual_router
  * Virtual router ID associated with the router interface.
  * Access: RW
@@ -3484,6 +3493,7 @@ static inline void mlxsw_reg_ritr_pack(char *payload, bool enable,
         mlxsw_reg_ritr_op_set(payload, op);
         mlxsw_reg_ritr_rif_set(payload, rif);
         mlxsw_reg_ritr_ipv4_fe_set(payload, 1);
+        mlxsw_reg_ritr_lb_en_set(payload, 1);
         mlxsw_reg_ritr_mtu_set(payload, mtu);
         mlxsw_reg_ritr_if_mac_memcpy_to(payload, mac);
 }
@@ -4000,6 +4010,7 @@ static inline void mlxsw_reg_ralue_pack(char *payload,
 {
         MLXSW_REG_ZERO(ralue, payload);
         mlxsw_reg_ralue_protocol_set(payload, protocol);
+        mlxsw_reg_ralue_op_set(payload, op);
         mlxsw_reg_ralue_virtual_router_set(payload, virtual_router);
         mlxsw_reg_ralue_prefix_len_set(payload, prefix_len);
         mlxsw_reg_ralue_entry_type_set(payload,
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
index c3e61500819d..d48873bcbddf 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
@@ -56,6 +56,7 @@
 #include <generated/utsrelease.h>
 #include <net/pkt_cls.h>
 #include <net/tc_act/tc_mirred.h>
+#include <net/netevent.h>
 
 #include "spectrum.h"
 #include "core.h"
@@ -942,8 +943,8 @@ static void mlxsw_sp_port_vport_destroy(struct mlxsw_sp_port *mlxsw_sp_vport)
         kfree(mlxsw_sp_vport);
 }
 
-int mlxsw_sp_port_add_vid(struct net_device *dev, __be16 __always_unused proto,
-                          u16 vid)
+static int mlxsw_sp_port_add_vid(struct net_device *dev,
+                                 __be16 __always_unused proto, u16 vid)
 {
         struct mlxsw_sp_port *mlxsw_sp_port = netdev_priv(dev);
         struct mlxsw_sp_port *mlxsw_sp_vport;
@@ -956,16 +957,12 @@ int mlxsw_sp_port_add_vid(struct net_device *dev, __be16 __always_unused proto,
         if (!vid)
                 return 0;
 
-        if (mlxsw_sp_port_vport_find(mlxsw_sp_port, vid)) {
-                netdev_warn(dev, "VID=%d already configured\n", vid);
+        if (mlxsw_sp_port_vport_find(mlxsw_sp_port, vid))
                 return 0;
-        }
 
         mlxsw_sp_vport = mlxsw_sp_port_vport_create(mlxsw_sp_port, vid);
-        if (!mlxsw_sp_vport) {
-                netdev_err(dev, "Failed to create vPort for VID=%d\n", vid);
+        if (!mlxsw_sp_vport)
                 return -ENOMEM;
-        }
 
         /* When adding the first VLAN interface on a bridged port we need to
          * transition all the active 802.1Q bridge VLANs to use explicit
@@ -973,24 +970,17 @@ int mlxsw_sp_port_add_vid(struct net_device *dev, __be16 __always_unused proto,
          */
         if (list_is_singular(&mlxsw_sp_port->vports_list)) {
                 err = mlxsw_sp_port_vp_mode_trans(mlxsw_sp_port);
-                if (err) {
-                        netdev_err(dev, "Failed to set to Virtual mode\n");
+                if (err)
                         goto err_port_vp_mode_trans;
-                }
         }
 
         err = mlxsw_sp_port_vid_learning_set(mlxsw_sp_vport, vid, false);
-        if (err) {
-                netdev_err(dev, "Failed to disable learning for VID=%d\n", vid);
+        if (err)
                 goto err_port_vid_learning_set;
-        }
 
         err = mlxsw_sp_port_vlan_set(mlxsw_sp_vport, vid, vid, true, untagged);
-        if (err) {
-                netdev_err(dev, "Failed to set VLAN membership for VID=%d\n",
-                           vid);
+        if (err)
                 goto err_port_add_vid;
-        }
 
         return 0;
 
@@ -1010,7 +1000,6 @@ static int mlxsw_sp_port_kill_vid(struct net_device *dev,
         struct mlxsw_sp_port *mlxsw_sp_port = netdev_priv(dev);
         struct mlxsw_sp_port *mlxsw_sp_vport;
         struct mlxsw_sp_fid *f;
-        int err;
 
         /* VLAN 0 is removed from HW filter when device goes down, but
          * it is reserved in our case, so simply return.
@@ -1019,23 +1008,12 @@ static int mlxsw_sp_port_kill_vid(struct net_device *dev,
                 return 0;
 
         mlxsw_sp_vport = mlxsw_sp_port_vport_find(mlxsw_sp_port, vid);
-        if (!mlxsw_sp_vport) {
-                netdev_warn(dev, "VID=%d does not exist\n", vid);
+        if (WARN_ON(!mlxsw_sp_vport))
                 return 0;
-        }
 
-        err = mlxsw_sp_port_vlan_set(mlxsw_sp_vport, vid, vid, false, false);
-        if (err) {
-                netdev_err(dev, "Failed to set VLAN membership for VID=%d\n",
-                           vid);
-                return err;
-        }
+        mlxsw_sp_port_vlan_set(mlxsw_sp_vport, vid, vid, false, false);
 
-        err = mlxsw_sp_port_vid_learning_set(mlxsw_sp_vport, vid, true);
-        if (err) {
-                netdev_err(dev, "Failed to enable learning for VID=%d\n", vid);
-                return err;
-        }
+        mlxsw_sp_port_vid_learning_set(mlxsw_sp_vport, vid, true);
 
         /* Drop FID reference. If this was the last reference the
          * resources will be freed.
@@ -1048,13 +1026,8 @@ static int mlxsw_sp_port_kill_vid(struct net_device *dev,
          * transition all active 802.1Q bridge VLANs to use VID to FID
          * mappings and set port's mode to VLAN mode.
          */
-        if (list_is_singular(&mlxsw_sp_port->vports_list)) {
-                err = mlxsw_sp_port_vlan_mode_trans(mlxsw_sp_port);
-                if (err) {
-                        netdev_err(dev, "Failed to set to VLAN mode\n");
-                        return err;
-                }
-        }
+        if (list_is_singular(&mlxsw_sp_port->vports_list))
+                mlxsw_sp_port_vlan_mode_trans(mlxsw_sp_port);
 
         mlxsw_sp_port_vport_destroy(mlxsw_sp_vport);
 
@@ -1149,6 +1122,7 @@ static int mlxsw_sp_port_add_cls_matchall(struct mlxsw_sp_port *mlxsw_sp_port,
                                           bool ingress)
 {
         const struct tc_action *a;
+        LIST_HEAD(actions);
         int err;
 
         if (!tc_single_action(cls->exts)) {
@@ -1156,7 +1130,8 @@ static int mlxsw_sp_port_add_cls_matchall(struct mlxsw_sp_port *mlxsw_sp_port,
                 return -ENOTSUPP;
         }
 
-        tc_for_each_action(a, cls->exts) {
+        tcf_exts_to_list(cls->exts, &actions);
+        list_for_each_entry(a, &actions, list) {
                 if (!is_tcf_mirred_mirror(a) || protocol != htons(ETH_P_ALL))
                         return -ENOTSUPP;
 
@@ -2076,6 +2051,18 @@ static int mlxsw_sp_port_ets_init(struct mlxsw_sp_port *mlxsw_sp_port)
         return 0;
 }
 
+static int mlxsw_sp_port_pvid_vport_create(struct mlxsw_sp_port *mlxsw_sp_port)
+{
+        mlxsw_sp_port->pvid = 1;
+
+        return mlxsw_sp_port_add_vid(mlxsw_sp_port->dev, 0, 1);
+}
+
+static int mlxsw_sp_port_pvid_vport_destroy(struct mlxsw_sp_port *mlxsw_sp_port)
+{
+        return mlxsw_sp_port_kill_vid(mlxsw_sp_port->dev, 0, 1);
+}
+
 static int mlxsw_sp_port_create(struct mlxsw_sp *mlxsw_sp, u8 local_port,
                                 bool split, u8 module, u8 width, u8 lane)
 {
@@ -2119,6 +2106,13 @@ static int mlxsw_sp_port_create(struct mlxsw_sp *mlxsw_sp, u8 local_port,
         dev->netdev_ops = &mlxsw_sp_port_netdev_ops;
         dev->ethtool_ops = &mlxsw_sp_port_ethtool_ops;
 
+        err = mlxsw_sp_port_swid_set(mlxsw_sp_port, 0);
+        if (err) {
+                dev_err(mlxsw_sp->bus_info->dev, "Port %d: Failed to set SWID\n",
+                        mlxsw_sp_port->local_port);
+                goto err_port_swid_set;
+        }
+
         err = mlxsw_sp_port_dev_addr_init(mlxsw_sp_port);
         if (err) {
                 dev_err(mlxsw_sp->bus_info->dev, "Port %d: Unable to init port mac address\n",
@@ -2144,13 +2138,6 @@ static int mlxsw_sp_port_create(struct mlxsw_sp *mlxsw_sp, u8 local_port,
                 goto err_port_system_port_mapping_set;
         }
 
-        err = mlxsw_sp_port_swid_set(mlxsw_sp_port, 0);
-        if (err) {
-                dev_err(mlxsw_sp->bus_info->dev, "Port %d: Failed to set SWID\n",
-                        mlxsw_sp_port->local_port);
-                goto err_port_swid_set;
-        }
-
         err = mlxsw_sp_port_speed_by_width_set(mlxsw_sp_port, width);
         if (err) {
                 dev_err(mlxsw_sp->bus_info->dev, "Port %d: Failed to enable speeds\n",
@@ -2191,7 +2178,15 @@ static int mlxsw_sp_port_create(struct mlxsw_sp *mlxsw_sp, u8 local_port,
                 goto err_port_dcb_init;
         }
 
+        err = mlxsw_sp_port_pvid_vport_create(mlxsw_sp_port);
+        if (err) {
+                dev_err(mlxsw_sp->bus_info->dev, "Port %d: Failed to create PVID vPort\n",
+                        mlxsw_sp_port->local_port);
+                goto err_port_pvid_vport_create;
+        }
+
         mlxsw_sp_port_switchdev_init(mlxsw_sp_port);
+        mlxsw_sp->ports[local_port] = mlxsw_sp_port;
         err = register_netdev(dev);
         if (err) {
                 dev_err(mlxsw_sp->bus_info->dev, "Port %d: Failed to register netdev\n",
@@ -2208,27 +2203,26 @@ static int mlxsw_sp_port_create(struct mlxsw_sp *mlxsw_sp, u8 local_port,
                 goto err_core_port_init;
         }
 
-        err = mlxsw_sp_port_vlan_init(mlxsw_sp_port);
-        if (err)
-                goto err_port_vlan_init;
-
-        mlxsw_sp->ports[local_port] = mlxsw_sp_port;
         return 0;
 
-err_port_vlan_init:
-        mlxsw_core_port_fini(&mlxsw_sp_port->core_port);
 err_core_port_init:
         unregister_netdev(dev);
 err_register_netdev:
+        mlxsw_sp->ports[local_port] = NULL;
+        mlxsw_sp_port_switchdev_fini(mlxsw_sp_port);
+        mlxsw_sp_port_pvid_vport_destroy(mlxsw_sp_port);
+err_port_pvid_vport_create:
+        mlxsw_sp_port_dcb_fini(mlxsw_sp_port);
 err_port_dcb_init:
 err_port_ets_init:
 err_port_buffers_init:
 err_port_admin_status_set:
 err_port_mtu_set:
 err_port_speed_by_width_set:
-err_port_swid_set:
 err_port_system_port_mapping_set:
 err_dev_addr_init:
+        mlxsw_sp_port_swid_set(mlxsw_sp_port, MLXSW_PORT_SWID_DISABLED_PORT);
+err_port_swid_set:
         free_percpu(mlxsw_sp_port->pcpu_stats);
 err_alloc_stats:
         kfree(mlxsw_sp_port->untagged_vlans);
@@ -2245,12 +2239,12 @@ static void mlxsw_sp_port_remove(struct mlxsw_sp *mlxsw_sp, u8 local_port)
 
         if (!mlxsw_sp_port)
                 return;
-        mlxsw_sp->ports[local_port] = NULL;
         mlxsw_core_port_fini(&mlxsw_sp_port->core_port);
         unregister_netdev(mlxsw_sp_port->dev); /* This calls ndo_stop */
-        mlxsw_sp_port_dcb_fini(mlxsw_sp_port);
-        mlxsw_sp_port_kill_vid(mlxsw_sp_port->dev, 0, 1);
+        mlxsw_sp->ports[local_port] = NULL;
         mlxsw_sp_port_switchdev_fini(mlxsw_sp_port);
+        mlxsw_sp_port_pvid_vport_destroy(mlxsw_sp_port);
+        mlxsw_sp_port_dcb_fini(mlxsw_sp_port);
         mlxsw_sp_port_swid_set(mlxsw_sp_port, MLXSW_PORT_SWID_DISABLED_PORT);
         mlxsw_sp_port_module_unmap(mlxsw_sp, mlxsw_sp_port->local_port);
         free_percpu(mlxsw_sp_port->pcpu_stats);
@@ -2662,6 +2656,26 @@ static const struct mlxsw_rx_listener mlxsw_sp_rx_listener[] = {
         {
                 .func = mlxsw_sp_rx_listener_func,
                 .local_port = MLXSW_PORT_DONT_CARE,
+                .trap_id = MLXSW_TRAP_ID_MTUERROR,
+        },
+        {
+                .func = mlxsw_sp_rx_listener_func,
+                .local_port = MLXSW_PORT_DONT_CARE,
+                .trap_id = MLXSW_TRAP_ID_TTLERROR,
+        },
+        {
+                .func = mlxsw_sp_rx_listener_func,
+                .local_port = MLXSW_PORT_DONT_CARE,
+                .trap_id = MLXSW_TRAP_ID_LBERROR,
+        },
+        {
+                .func = mlxsw_sp_rx_listener_func,
+                .local_port = MLXSW_PORT_DONT_CARE,
+                .trap_id = MLXSW_TRAP_ID_OSPF,
+        },
+        {
+                .func = mlxsw_sp_rx_listener_func,
+                .local_port = MLXSW_PORT_DONT_CARE,
                 .trap_id = MLXSW_TRAP_ID_IP2ME,
         },
         {
@@ -3311,6 +3325,39 @@ static struct mlxsw_sp_fid *mlxsw_sp_bridge_fid_get(struct mlxsw_sp *mlxsw_sp,
         return mlxsw_sp_fid_find(mlxsw_sp, fid);
 }
 
+static enum mlxsw_flood_table_type mlxsw_sp_flood_table_type_get(u16 fid)
+{
+        return mlxsw_sp_fid_is_vfid(fid) ? MLXSW_REG_SFGC_TABLE_TYPE_FID :
+               MLXSW_REG_SFGC_TABLE_TYPE_FID_OFFEST;
+}
+
+static u16 mlxsw_sp_flood_table_index_get(u16 fid)
+{
+        return mlxsw_sp_fid_is_vfid(fid) ? mlxsw_sp_fid_to_vfid(fid) : fid;
+}
+
+static int mlxsw_sp_router_port_flood_set(struct mlxsw_sp *mlxsw_sp, u16 fid,
+                                          bool set)
+{
+        enum mlxsw_flood_table_type table_type;
+        char *sftr_pl;
+        u16 index;
+        int err;
+
+        sftr_pl = kmalloc(MLXSW_REG_SFTR_LEN, GFP_KERNEL);
+        if (!sftr_pl)
+                return -ENOMEM;
+
+        table_type = mlxsw_sp_flood_table_type_get(fid);
+        index = mlxsw_sp_flood_table_index_get(fid);
+        mlxsw_reg_sftr_pack(sftr_pl, MLXSW_SP_FLOOD_TABLE_BM, index, table_type,
+                            1, MLXSW_PORT_ROUTER_PORT, set);
+        err = mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(sftr), sftr_pl);
+
+        kfree(sftr_pl);
+        return err;
+}
+
 static enum mlxsw_reg_ritr_if_type mlxsw_sp_rif_type_get(u16 fid)
 {
         if (mlxsw_sp_fid_is_vfid(fid))
@@ -3347,10 +3394,14 @@ static int mlxsw_sp_rif_bridge_create(struct mlxsw_sp *mlxsw_sp,
         if (rif == MLXSW_SP_RIF_MAX)
                 return -ERANGE;
 
-        err = mlxsw_sp_rif_bridge_op(mlxsw_sp, l3_dev, f->fid, rif, true);
+        err = mlxsw_sp_router_port_flood_set(mlxsw_sp, f->fid, true);
         if (err)
                 return err;
 
+        err = mlxsw_sp_rif_bridge_op(mlxsw_sp, l3_dev, f->fid, rif, true);
+        if (err)
+                goto err_rif_bridge_op;
+
         err = mlxsw_sp_rif_fdb_op(mlxsw_sp, l3_dev->dev_addr, f->fid, true);
         if (err)
                 goto err_rif_fdb_op;
@@ -3372,6 +3423,8 @@ err_rif_alloc:
         mlxsw_sp_rif_fdb_op(mlxsw_sp, l3_dev->dev_addr, f->fid, false);
 err_rif_fdb_op:
         mlxsw_sp_rif_bridge_op(mlxsw_sp, l3_dev, f->fid, rif, false);
+err_rif_bridge_op:
+        mlxsw_sp_router_port_flood_set(mlxsw_sp, f->fid, false);
         return err;
 }
 
@@ -3391,6 +3444,8 @@ void mlxsw_sp_rif_bridge_destroy(struct mlxsw_sp *mlxsw_sp,
 
         mlxsw_sp_rif_bridge_op(mlxsw_sp, l3_dev, f->fid, rif, false);
 
+        mlxsw_sp_router_port_flood_set(mlxsw_sp, f->fid, false);
+
         netdev_dbg(l3_dev, "RIF=%d destroyed\n", rif);
 }
 
@@ -4487,18 +4542,26 @@ static struct notifier_block mlxsw_sp_inetaddr_nb __read_mostly = {
         .priority = 10, /* Must be called before FIB notifier block */
 };
 
+static struct notifier_block mlxsw_sp_router_netevent_nb __read_mostly = {
+        .notifier_call = mlxsw_sp_router_netevent_event,
+};
+
 static int __init mlxsw_sp_module_init(void)
 {
         int err;
 
         register_netdevice_notifier(&mlxsw_sp_netdevice_nb);
         register_inetaddr_notifier(&mlxsw_sp_inetaddr_nb);
+        register_netevent_notifier(&mlxsw_sp_router_netevent_nb);
+
         err = mlxsw_core_driver_register(&mlxsw_sp_driver);
         if (err)
                 goto err_core_driver_register;
         return 0;
 
 err_core_driver_register:
+        unregister_netevent_notifier(&mlxsw_sp_router_netevent_nb);
+        unregister_inetaddr_notifier(&mlxsw_sp_inetaddr_nb);
         unregister_netdevice_notifier(&mlxsw_sp_netdevice_nb);
         return err;
 }
@@ -4506,6 +4569,7 @@ err_core_driver_register:
 static void __exit mlxsw_sp_module_exit(void)
 {
         mlxsw_core_driver_unregister(&mlxsw_sp_driver);
+        unregister_netevent_notifier(&mlxsw_sp_router_netevent_nb);
         unregister_inetaddr_notifier(&mlxsw_sp_inetaddr_nb);
         unregister_netdevice_notifier(&mlxsw_sp_netdevice_nb);
 }
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.h b/drivers/net/ethernet/mellanox/mlxsw/spectrum.h
index f69aa37d1521..ac48abebe904 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.h
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.h
@@ -536,8 +536,6 @@ int mlxsw_sp_port_vid_to_fid_set(struct mlxsw_sp_port *mlxsw_sp_port,
                                  u16 vid);
 int mlxsw_sp_port_vlan_set(struct mlxsw_sp_port *mlxsw_sp_port, u16 vid_begin,
                            u16 vid_end, bool is_member, bool untagged);
-int mlxsw_sp_port_add_vid(struct net_device *dev, __be16 __always_unused proto,
-                          u16 vid);
 int mlxsw_sp_vport_flood_set(struct mlxsw_sp_port *mlxsw_sp_vport, u16 fid,
                              bool set);
 void mlxsw_sp_port_active_vlans_del(struct mlxsw_sp_port *mlxsw_sp_port);
@@ -589,6 +587,8 @@ int mlxsw_sp_router_neigh_construct(struct net_device *dev,
                                     struct neighbour *n);
 void mlxsw_sp_router_neigh_destroy(struct net_device *dev,
                                    struct neighbour *n);
+int mlxsw_sp_router_netevent_event(struct notifier_block *unused,
+                                   unsigned long event, void *ptr);
 
 int mlxsw_sp_kvdl_alloc(struct mlxsw_sp *mlxsw_sp, unsigned int entry_count);
 void mlxsw_sp_kvdl_free(struct mlxsw_sp *mlxsw_sp, int entry_index);
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c
index 074cdda7b6f3..953b214f38d0 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c
@@ -330,7 +330,7 @@ static const struct mlxsw_sp_sb_cm mlxsw_sp_cpu_port_sb_cms[] = {
         MLXSW_SP_CPU_PORT_SB_CM,
         MLXSW_SP_CPU_PORT_SB_CM,
         MLXSW_SP_CPU_PORT_SB_CM,
-        MLXSW_SP_CPU_PORT_SB_CM,
+        MLXSW_SP_SB_CM(MLXSW_SP_BYTES_TO_CELLS(10000), 0, 0),
         MLXSW_SP_CPU_PORT_SB_CM,
         MLXSW_SP_CPU_PORT_SB_CM,
         MLXSW_SP_CPU_PORT_SB_CM,
@@ -717,22 +717,18 @@ int mlxsw_sp_sb_tc_pool_bind_set(struct mlxsw_core_port *mlxsw_core_port,
         u8 local_port = mlxsw_sp_port->local_port;
         u8 pg_buff = tc_index;
         enum mlxsw_reg_sbxx_dir dir = pool_type;
-        u8 pool = pool_index;
+        u8 pool = pool_get(pool_index);
         u32 max_buff;
         int err;
 
+        if (dir != dir_get(pool_index))
+                return -EINVAL;
+
         err = mlxsw_sp_sb_threshold_in(mlxsw_sp, pool, dir,
                                        threshold, &max_buff);
         if (err)
                 return err;
 
-        if (pool_type == DEVLINK_SB_POOL_TYPE_EGRESS) {
-                if (pool < MLXSW_SP_SB_POOL_COUNT)
-                        return -EINVAL;
-                pool -= MLXSW_SP_SB_POOL_COUNT;
-        } else if (pool >= MLXSW_SP_SB_POOL_COUNT) {
-                return -EINVAL;
-        }
         return mlxsw_sp_sb_cm_write(mlxsw_sp, local_port, pg_buff, dir,
                                     0, max_buff, pool);
 }
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_dcb.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_dcb.c
index 01cfb7512827..b6ed7f7c531e 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_dcb.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_dcb.c
@@ -341,6 +341,8 @@ static int mlxsw_sp_port_pfc_set(struct mlxsw_sp_port *mlxsw_sp_port,
         char pfcc_pl[MLXSW_REG_PFCC_LEN];
 
         mlxsw_reg_pfcc_pack(pfcc_pl, mlxsw_sp_port->local_port);
+        mlxsw_reg_pfcc_pprx_set(pfcc_pl, mlxsw_sp_port->link.rx_pause);
+        mlxsw_reg_pfcc_pptx_set(pfcc_pl, mlxsw_sp_port->link.tx_pause);
         mlxsw_reg_pfcc_prio_pack(pfcc_pl, pfc->pfc_en);
 
         return mlxsw_reg_write(mlxsw_sp_port->mlxsw_sp->core, MLXSW_REG(pfcc),
@@ -351,17 +353,17 @@ static int mlxsw_sp_dcbnl_ieee_setpfc(struct net_device *dev,
                                       struct ieee_pfc *pfc)
 {
         struct mlxsw_sp_port *mlxsw_sp_port = netdev_priv(dev);
+        bool pause_en = mlxsw_sp_port_is_pause_en(mlxsw_sp_port);
         int err;
 
-        if ((mlxsw_sp_port->link.tx_pause || mlxsw_sp_port->link.rx_pause) &&
-            pfc->pfc_en) {
+        if (pause_en && pfc->pfc_en) {
                 netdev_err(dev, "PAUSE frames already enabled on port\n");
                 return -EINVAL;
         }
 
         err = __mlxsw_sp_port_headroom_set(mlxsw_sp_port, dev->mtu,
                                            mlxsw_sp_port->dcb.ets->prio_tc,
-                                           false, pfc);
+                                           pause_en, pfc);
         if (err) {
                 netdev_err(dev, "Failed to configure port's headroom for PFC\n");
                 return err;
@@ -380,7 +382,7 @@ static int mlxsw_sp_dcbnl_ieee_setpfc(struct net_device *dev,
 
 err_port_pfc_set:
         __mlxsw_sp_port_headroom_set(mlxsw_sp_port, dev->mtu,
-                                     mlxsw_sp_port->dcb.ets->prio_tc, false,
+                                     mlxsw_sp_port->dcb.ets->prio_tc, pause_en,
                                      mlxsw_sp_port->dcb.pfc);
         return err;
 }
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
index 81418d629231..3f5c51da6d3e 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
@@ -107,6 +107,7 @@ mlxsw_sp_prefix_usage_clear(struct mlxsw_sp_prefix_usage *prefix_usage,
 }
 
 struct mlxsw_sp_fib_key {
+        struct net_device *dev;
         unsigned char addr[sizeof(struct in6_addr)];
         unsigned char prefix_len;
 };
@@ -123,7 +124,7 @@ struct mlxsw_sp_fib_entry {
         struct rhash_head ht_node;
         struct mlxsw_sp_fib_key key;
         enum mlxsw_sp_fib_entry_type type;
-        u8 added:1;
+        unsigned int ref_count;
         u16 rif; /* used for action local */
         struct mlxsw_sp_vr *vr;
         struct list_head nexthop_group_node;
@@ -171,13 +172,15 @@ static void mlxsw_sp_fib_entry_remove(struct mlxsw_sp_fib *fib,
 
 static struct mlxsw_sp_fib_entry *
 mlxsw_sp_fib_entry_create(struct mlxsw_sp_fib *fib, const void *addr,
-                          size_t addr_len, unsigned char prefix_len)
+                          size_t addr_len, unsigned char prefix_len,
+                          struct net_device *dev)
 {
         struct mlxsw_sp_fib_entry *fib_entry;
 
         fib_entry = kzalloc(sizeof(*fib_entry), GFP_KERNEL);
         if (!fib_entry)
                 return NULL;
+        fib_entry->key.dev = dev;
         memcpy(fib_entry->key.addr, addr, addr_len);
         fib_entry->key.prefix_len = prefix_len;
         return fib_entry;
@@ -190,10 +193,13 @@ static void mlxsw_sp_fib_entry_destroy(struct mlxsw_sp_fib_entry *fib_entry)
 
 static struct mlxsw_sp_fib_entry *
 mlxsw_sp_fib_entry_lookup(struct mlxsw_sp_fib *fib, const void *addr,
-                          size_t addr_len, unsigned char prefix_len)
+                          size_t addr_len, unsigned char prefix_len,
+                          struct net_device *dev)
 {
-        struct mlxsw_sp_fib_key key = {{ 0 } };
+        struct mlxsw_sp_fib_key key;
 
+        memset(&key, 0, sizeof(key));
+        key.dev = dev;
         memcpy(key.addr, addr, addr_len);
         key.prefix_len = prefix_len;
         return rhashtable_lookup_fast(&fib->ht, &key, mlxsw_sp_fib_ht_params);
@@ -657,7 +663,7 @@ int mlxsw_sp_router_neigh_construct(struct net_device *dev,
                 return 0;
         }
 
-        r = mlxsw_sp_rif_find_by_dev(mlxsw_sp, dev);
+        r = mlxsw_sp_rif_find_by_dev(mlxsw_sp, n->dev);
         if (WARN_ON(!r))
                 return -EINVAL;
 
@@ -938,8 +944,8 @@ static void mlxsw_sp_router_neigh_update_hw(struct work_struct *work)
         mlxsw_sp_port_dev_put(mlxsw_sp_port);
 }
 
-static int mlxsw_sp_router_netevent_event(struct notifier_block *unused,
-                                          unsigned long event, void *ptr)
+int mlxsw_sp_router_netevent_event(struct notifier_block *unused,
+                                   unsigned long event, void *ptr)
 {
         struct mlxsw_sp_neigh_entry *neigh_entry;
         struct mlxsw_sp_port *mlxsw_sp_port;
@@ -1009,10 +1015,6 @@ static int mlxsw_sp_router_netevent_event(struct notifier_block *unused,
         return NOTIFY_DONE;
 }
 
-static struct notifier_block mlxsw_sp_router_netevent_nb __read_mostly = {
-        .notifier_call = mlxsw_sp_router_netevent_event,
-};
-
 static int mlxsw_sp_neigh_init(struct mlxsw_sp *mlxsw_sp)
 {
         int err;
@@ -1027,10 +1029,6 @@ static int mlxsw_sp_neigh_init(struct mlxsw_sp *mlxsw_sp)
          */
         mlxsw_sp_router_neighs_update_interval_init(mlxsw_sp);
 
-        err = register_netevent_notifier(&mlxsw_sp_router_netevent_nb);
-        if (err)
-                goto err_register_netevent_notifier;
-
         /* Create the delayed works for the activity_update */
         INIT_DELAYED_WORK(&mlxsw_sp->router.neighs_update.dw,
                           mlxsw_sp_router_neighs_update_work);
@@ -1039,17 +1037,12 @@ static int mlxsw_sp_neigh_init(struct mlxsw_sp *mlxsw_sp)
         mlxsw_core_schedule_dw(&mlxsw_sp->router.neighs_update.dw, 0);
         mlxsw_core_schedule_dw(&mlxsw_sp->router.nexthop_probe_dw, 0);
         return 0;
-
-err_register_netevent_notifier:
-        rhashtable_destroy(&mlxsw_sp->router.neigh_ht);
-        return err;
 }
 
 static void mlxsw_sp_neigh_fini(struct mlxsw_sp *mlxsw_sp)
 {
         cancel_delayed_work_sync(&mlxsw_sp->router.neighs_update.dw);
         cancel_delayed_work_sync(&mlxsw_sp->router.nexthop_probe_dw);
-        unregister_netevent_notifier(&mlxsw_sp_router_netevent_nb);
         rhashtable_destroy(&mlxsw_sp->router.neigh_ht);
 }
 
@@ -1524,7 +1517,14 @@ int mlxsw_sp_router_init(struct mlxsw_sp *mlxsw_sp)
                 return err;
         mlxsw_sp_lpm_init(mlxsw_sp);
         mlxsw_sp_vrs_init(mlxsw_sp);
-        return mlxsw_sp_neigh_init(mlxsw_sp);
+        err = mlxsw_sp_neigh_init(mlxsw_sp);
+        if (err)
+                goto err_neigh_init;
+        return 0;
+
+err_neigh_init:
+        __mlxsw_sp_router_fini(mlxsw_sp);
+        return err;
 }
 
 void mlxsw_sp_router_fini(struct mlxsw_sp *mlxsw_sp)
@@ -1626,11 +1626,8 @@ static int mlxsw_sp_fib_entry_op(struct mlxsw_sp *mlxsw_sp,
 static int mlxsw_sp_fib_entry_update(struct mlxsw_sp *mlxsw_sp,
                                      struct mlxsw_sp_fib_entry *fib_entry)
 {
-        enum mlxsw_reg_ralue_op op;
-
-        op = !fib_entry->added ? MLXSW_REG_RALUE_OP_WRITE_WRITE :
-                                 MLXSW_REG_RALUE_OP_WRITE_UPDATE;
-        return mlxsw_sp_fib_entry_op(mlxsw_sp, fib_entry, op);
+        return mlxsw_sp_fib_entry_op(mlxsw_sp, fib_entry,
+                                     MLXSW_REG_RALUE_OP_WRITE_WRITE);
 }
 
 static int mlxsw_sp_fib_entry_del(struct mlxsw_sp *mlxsw_sp,
@@ -1651,9 +1648,10 @@ static void mlxsw_sp_router_fib4_add_info_destroy(void const *data)
         const struct mlxsw_sp_router_fib4_add_info *info = data;
         struct mlxsw_sp_fib_entry *fib_entry = info->fib_entry;
         struct mlxsw_sp *mlxsw_sp = info->mlxsw_sp;
+        struct mlxsw_sp_vr *vr = fib_entry->vr;
 
         mlxsw_sp_fib_entry_destroy(fib_entry);
-        mlxsw_sp_vr_put(mlxsw_sp, fib_entry->vr);
+        mlxsw_sp_vr_put(mlxsw_sp, vr);
         kfree(info);
 }
 
@@ -1694,34 +1692,93 @@ mlxsw_sp_router_fib4_entry_fini(struct mlxsw_sp *mlxsw_sp,
         mlxsw_sp_nexthop_group_put(mlxsw_sp, fib_entry);
 }
 
-static int
-mlxsw_sp_router_fib4_add_prepare(struct mlxsw_sp_port *mlxsw_sp_port,
-                                 const struct switchdev_obj_ipv4_fib *fib4,
-                                 struct switchdev_trans *trans)
+static struct mlxsw_sp_fib_entry *
+mlxsw_sp_fib_entry_get(struct mlxsw_sp *mlxsw_sp,
+                       const struct switchdev_obj_ipv4_fib *fib4)
 {
-        struct mlxsw_sp *mlxsw_sp = mlxsw_sp_port->mlxsw_sp;
-        struct mlxsw_sp_router_fib4_add_info *info;
         struct mlxsw_sp_fib_entry *fib_entry;
+        struct fib_info *fi = fib4->fi;
         struct mlxsw_sp_vr *vr;
         int err;
 
         vr = mlxsw_sp_vr_get(mlxsw_sp, fib4->dst_len, fib4->tb_id,
                              MLXSW_SP_L3_PROTO_IPV4);
         if (IS_ERR(vr))
-                return PTR_ERR(vr);
+                return ERR_CAST(vr);
 
+        fib_entry = mlxsw_sp_fib_entry_lookup(vr->fib, &fib4->dst,
+                                              sizeof(fib4->dst),
+                                              fib4->dst_len, fi->fib_dev);
+        if (fib_entry) {
+                /* Already exists, just take a reference */
+                fib_entry->ref_count++;
+                return fib_entry;
+        }
         fib_entry = mlxsw_sp_fib_entry_create(vr->fib, &fib4->dst,
-                                              sizeof(fib4->dst), fib4->dst_len);
+                                              sizeof(fib4->dst),
+                                              fib4->dst_len, fi->fib_dev);
         if (!fib_entry) {
                 err = -ENOMEM;
                 goto err_fib_entry_create;
         }
         fib_entry->vr = vr;
+        fib_entry->ref_count = 1;
 
         err = mlxsw_sp_router_fib4_entry_init(mlxsw_sp, fib4, fib_entry);
         if (err)
                 goto err_fib4_entry_init;
 
+        return fib_entry;
+
+err_fib4_entry_init:
+        mlxsw_sp_fib_entry_destroy(fib_entry);
+err_fib_entry_create:
+        mlxsw_sp_vr_put(mlxsw_sp, vr);
+
+        return ERR_PTR(err);
+}
+
+static struct mlxsw_sp_fib_entry *
+mlxsw_sp_fib_entry_find(struct mlxsw_sp *mlxsw_sp,
+                        const struct switchdev_obj_ipv4_fib *fib4)
+{
+        struct mlxsw_sp_vr *vr;
+
+        vr = mlxsw_sp_vr_find(mlxsw_sp, fib4->tb_id, MLXSW_SP_L3_PROTO_IPV4);
+        if (!vr)
+                return NULL;
+
+        return mlxsw_sp_fib_entry_lookup(vr->fib, &fib4->dst,
+                                         sizeof(fib4->dst), fib4->dst_len,
+                                         fib4->fi->fib_dev);
+}
+
+void mlxsw_sp_fib_entry_put(struct mlxsw_sp *mlxsw_sp,
+                            struct mlxsw_sp_fib_entry *fib_entry)
+{
+        struct mlxsw_sp_vr *vr = fib_entry->vr;
+
+        if (--fib_entry->ref_count == 0) {
+                mlxsw_sp_router_fib4_entry_fini(mlxsw_sp, fib_entry);
+                mlxsw_sp_fib_entry_destroy(fib_entry);
+        }
+        mlxsw_sp_vr_put(mlxsw_sp, vr);
+}
+
+static int
+mlxsw_sp_router_fib4_add_prepare(struct mlxsw_sp_port *mlxsw_sp_port,
+                                 const struct switchdev_obj_ipv4_fib *fib4,
+                                 struct switchdev_trans *trans)
+{
+        struct mlxsw_sp *mlxsw_sp = mlxsw_sp_port->mlxsw_sp;
+        struct mlxsw_sp_router_fib4_add_info *info;
+        struct mlxsw_sp_fib_entry *fib_entry;
+        int err;
+
+        fib_entry = mlxsw_sp_fib_entry_get(mlxsw_sp, fib4);
+        if (IS_ERR(fib_entry))
+                return PTR_ERR(fib_entry);
+
         info = kmalloc(sizeof(*info), GFP_KERNEL);
         if (!info) {
                 err = -ENOMEM;
@@ -1735,11 +1792,7 @@ mlxsw_sp_router_fib4_add_prepare(struct mlxsw_sp_port *mlxsw_sp_port,
         return 0;
 
 err_alloc_info:
-        mlxsw_sp_router_fib4_entry_fini(mlxsw_sp, fib_entry);
-err_fib4_entry_init:
-        mlxsw_sp_fib_entry_destroy(fib_entry);
-err_fib_entry_create:
-        mlxsw_sp_vr_put(mlxsw_sp, vr);
+        mlxsw_sp_fib_entry_put(mlxsw_sp, fib_entry);
         return err;
 }
 
@@ -1758,11 +1811,14 @@ mlxsw_sp_router_fib4_add_commit(struct mlxsw_sp_port *mlxsw_sp_port,
         fib_entry = info->fib_entry;
         kfree(info);
 
+        if (fib_entry->ref_count != 1)
+                return 0;
+
         vr = fib_entry->vr;
-        err = mlxsw_sp_fib_entry_insert(fib_entry->vr->fib, fib_entry);
+        err = mlxsw_sp_fib_entry_insert(vr->fib, fib_entry);
         if (err)
                 goto err_fib_entry_insert;
-        err = mlxsw_sp_fib_entry_update(mlxsw_sp, fib_entry);
+        err = mlxsw_sp_fib_entry_update(mlxsw_sp_port->mlxsw_sp, fib_entry);
         if (err)
                 goto err_fib_entry_add;
         return 0;
@@ -1770,9 +1826,7 @@ mlxsw_sp_router_fib4_add_commit(struct mlxsw_sp_port *mlxsw_sp_port,
 err_fib_entry_add:
         mlxsw_sp_fib_entry_remove(vr->fib, fib_entry);
 err_fib_entry_insert:
-        mlxsw_sp_router_fib4_entry_fini(mlxsw_sp, fib_entry);
-        mlxsw_sp_fib_entry_destroy(fib_entry);
-        mlxsw_sp_vr_put(mlxsw_sp, vr);
+        mlxsw_sp_fib_entry_put(mlxsw_sp, fib_entry);
         return err;
 }
 
@@ -1792,23 +1846,18 @@ int mlxsw_sp_router_fib4_del(struct mlxsw_sp_port *mlxsw_sp_port,
 {
         struct mlxsw_sp *mlxsw_sp = mlxsw_sp_port->mlxsw_sp;
         struct mlxsw_sp_fib_entry *fib_entry;
-        struct mlxsw_sp_vr *vr;
 
-        vr = mlxsw_sp_vr_find(mlxsw_sp, fib4->tb_id, MLXSW_SP_L3_PROTO_IPV4);
-        if (!vr) {
-                dev_warn(mlxsw_sp->bus_info->dev, "Failed to find virtual router for FIB4 entry being removed.\n");
-                return -ENOENT;
-        }
-        fib_entry = mlxsw_sp_fib_entry_lookup(vr->fib, &fib4->dst,
-                                              sizeof(fib4->dst), fib4->dst_len);
+        fib_entry = mlxsw_sp_fib_entry_find(mlxsw_sp, fib4);
         if (!fib_entry) {
                 dev_warn(mlxsw_sp->bus_info->dev, "Failed to find FIB4 entry being removed.\n");
                 return -ENOENT;
         }
-        mlxsw_sp_fib_entry_del(mlxsw_sp_port->mlxsw_sp, fib_entry);
-        mlxsw_sp_fib_entry_remove(vr->fib, fib_entry);
-        mlxsw_sp_router_fib4_entry_fini(mlxsw_sp, fib_entry);
-        mlxsw_sp_fib_entry_destroy(fib_entry);
-        mlxsw_sp_vr_put(mlxsw_sp, vr);
+
+        if (fib_entry->ref_count == 1) {
+                mlxsw_sp_fib_entry_del(mlxsw_sp, fib_entry);
+                mlxsw_sp_fib_entry_remove(fib_entry->vr->fib, fib_entry);
+        }
+
+        mlxsw_sp_fib_entry_put(mlxsw_sp, fib_entry);
         return 0;
 }
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
index a1ad5e6bdfa8..7b654c517b91 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
@@ -167,8 +167,8 @@ static int mlxsw_sp_port_attr_stp_state_set(struct mlxsw_sp_port *mlxsw_sp_port,
 }
 
 static int __mlxsw_sp_port_flood_set(struct mlxsw_sp_port *mlxsw_sp_port,
-                                     u16 idx_begin, u16 idx_end, bool set,
-                                     bool only_uc)
+                                     u16 idx_begin, u16 idx_end, bool uc_set,
+                                     bool bm_set)
 {
         struct mlxsw_sp *mlxsw_sp = mlxsw_sp_port->mlxsw_sp;
         u16 local_port = mlxsw_sp_port->local_port;
@@ -187,28 +187,22 @@ static int __mlxsw_sp_port_flood_set(struct mlxsw_sp_port *mlxsw_sp_port,
                 return -ENOMEM;
 
         mlxsw_reg_sftr_pack(sftr_pl, MLXSW_SP_FLOOD_TABLE_UC, idx_begin,
-                            table_type, range, local_port, set);
+                            table_type, range, local_port, uc_set);
         err = mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(sftr), sftr_pl);
         if (err)
                 goto buffer_out;
 
-        /* Flooding control allows one to decide whether a given port will
-         * flood unicast traffic for which there is no FDB entry.
-         */
-        if (only_uc)
-                goto buffer_out;
-
         mlxsw_reg_sftr_pack(sftr_pl, MLXSW_SP_FLOOD_TABLE_BM, idx_begin,
-                            table_type, range, local_port, set);
+                            table_type, range, local_port, bm_set);
         err = mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(sftr), sftr_pl);
         if (err)
                 goto err_flood_bm_set;
-        else
-                goto buffer_out;
+
+        goto buffer_out;
 
 err_flood_bm_set:
         mlxsw_reg_sftr_pack(sftr_pl, MLXSW_SP_FLOOD_TABLE_UC, idx_begin,
-                            table_type, range, local_port, !set);
+                            table_type, range, local_port, !uc_set);
         mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(sftr), sftr_pl);
 buffer_out:
         kfree(sftr_pl);
@@ -257,8 +251,7 @@ int mlxsw_sp_vport_flood_set(struct mlxsw_sp_port *mlxsw_sp_vport, u16 fid,
          * the start of the vFIDs range.
          */
         vfid = mlxsw_sp_fid_to_vfid(fid);
-        return __mlxsw_sp_port_flood_set(mlxsw_sp_vport, vfid, vfid, set,
-                                         false);
+        return __mlxsw_sp_port_flood_set(mlxsw_sp_vport, vfid, vfid, set, set);
 }
 
 static int mlxsw_sp_port_attr_br_flags_set(struct mlxsw_sp_port *mlxsw_sp_port,
@@ -450,6 +443,8 @@ void mlxsw_sp_fid_destroy(struct mlxsw_sp *mlxsw_sp, struct mlxsw_sp_fid *f)
 
         kfree(f);
 
+        mlxsw_sp_fid_map(mlxsw_sp, fid, false);
+
         mlxsw_sp_fid_op(mlxsw_sp, fid, false);
 }
 
@@ -458,6 +453,9 @@ static int __mlxsw_sp_port_fid_join(struct mlxsw_sp_port *mlxsw_sp_port,
 {
         struct mlxsw_sp_fid *f;
 
+        if (test_bit(fid, mlxsw_sp_port->active_vlans))
+                return 0;
+
         f = mlxsw_sp_fid_find(mlxsw_sp_port->mlxsw_sp, fid);
         if (!f) {
                 f = mlxsw_sp_fid_create(mlxsw_sp_port->mlxsw_sp, fid);
@@ -515,7 +513,7 @@ static int mlxsw_sp_port_fid_join(struct mlxsw_sp_port *mlxsw_sp_port,
         }
 
         err = __mlxsw_sp_port_flood_set(mlxsw_sp_port, fid_begin, fid_end,
-                                        true, false);
+                                        mlxsw_sp_port->uc_flood, true);
         if (err)
                 goto err_port_flood_set;
 
@@ -997,13 +995,13 @@ static int mlxsw_sp_port_obj_add(struct net_device *dev,
 }
 
 static int __mlxsw_sp_port_vlans_del(struct mlxsw_sp_port *mlxsw_sp_port,
-                                     u16 vid_begin, u16 vid_end, bool init)
+                                     u16 vid_begin, u16 vid_end)
 {
         struct net_device *dev = mlxsw_sp_port->dev;
         u16 vid, pvid;
         int err;
 
-        if (!init && !mlxsw_sp_port->bridged)
+        if (!mlxsw_sp_port->bridged)
                 return -EINVAL;
 
         err = __mlxsw_sp_port_vlans_set(mlxsw_sp_port, vid_begin, vid_end,
@@ -1014,9 +1012,6 @@ static int __mlxsw_sp_port_vlans_del(struct mlxsw_sp_port *mlxsw_sp_port,
                 return err;
         }
 
-        if (init)
-                goto out;
-
         pvid = mlxsw_sp_port->pvid;
         if (pvid >= vid_begin && pvid <= vid_end) {
                 err = mlxsw_sp_port_pvid_set(mlxsw_sp_port, 0);
@@ -1028,7 +1023,6 @@ static int __mlxsw_sp_port_vlans_del(struct mlxsw_sp_port *mlxsw_sp_port,
 
         mlxsw_sp_port_fid_leave(mlxsw_sp_port, vid_begin, vid_end);
 
-out:
         /* Changing activity bits only if HW operation succeded */
         for (vid = vid_begin; vid <= vid_end; vid++)
                 clear_bit(vid, mlxsw_sp_port->active_vlans);
@@ -1039,8 +1033,8 @@ out:
 static int mlxsw_sp_port_vlans_del(struct mlxsw_sp_port *mlxsw_sp_port,
                                    const struct switchdev_obj_port_vlan *vlan)
 {
-        return __mlxsw_sp_port_vlans_del(mlxsw_sp_port,
-                                         vlan->vid_begin, vlan->vid_end, false);
+        return __mlxsw_sp_port_vlans_del(mlxsw_sp_port, vlan->vid_begin,
+                                         vlan->vid_end);
 }
 
 void mlxsw_sp_port_active_vlans_del(struct mlxsw_sp_port *mlxsw_sp_port)
@@ -1048,7 +1042,7 @@ void mlxsw_sp_port_active_vlans_del(struct mlxsw_sp_port *mlxsw_sp_port)
         u16 vid;
 
         for_each_set_bit(vid, mlxsw_sp_port->active_vlans, VLAN_N_VID)
-                __mlxsw_sp_port_vlans_del(mlxsw_sp_port, vid, vid, false);
+                __mlxsw_sp_port_vlans_del(mlxsw_sp_port, vid, vid);
 }
 
 static int
@@ -1546,32 +1540,6 @@ void mlxsw_sp_switchdev_fini(struct mlxsw_sp *mlxsw_sp)
         mlxsw_sp_fdb_fini(mlxsw_sp);
 }
 
-int mlxsw_sp_port_vlan_init(struct mlxsw_sp_port *mlxsw_sp_port)
-{
-        struct net_device *dev = mlxsw_sp_port->dev;
-        int err;
-
-        /* Allow only untagged packets to ingress and tag them internally
-         * with VID 1.
-         */
-        mlxsw_sp_port->pvid = 1;
-        err = __mlxsw_sp_port_vlans_del(mlxsw_sp_port, 0, VLAN_N_VID - 1,
-                                        true);
-        if (err) {
-                netdev_err(dev, "Unable to init VLANs\n");
-                return err;
-        }
-
-        /* Add implicit VLAN interface in the device, so that untagged
-         * packets will be classified to the default vFID.
-         */
-        err = mlxsw_sp_port_add_vid(dev, 0, 1);
-        if (err)
-                netdev_err(dev, "Failed to configure default vFID\n");
-
-        return err;
-}
-
 void mlxsw_sp_port_switchdev_init(struct mlxsw_sp_port *mlxsw_sp_port)
 {
         mlxsw_sp_port->dev->switchdev_ops = &mlxsw_sp_port_switchdev_ops;
diff --git a/drivers/net/ethernet/mellanox/mlxsw/trap.h b/drivers/net/ethernet/mellanox/mlxsw/trap.h
index 470d7696e9fe..ed8e30186400 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/trap.h
+++ b/drivers/net/ethernet/mellanox/mlxsw/trap.h
@@ -56,6 +56,10 @@ enum {
         MLXSW_TRAP_ID_IGMP_V3_REPORT = 0x34,
         MLXSW_TRAP_ID_ARPBC = 0x50,
         MLXSW_TRAP_ID_ARPUC = 0x51,
+        MLXSW_TRAP_ID_MTUERROR = 0x52,
+        MLXSW_TRAP_ID_TTLERROR = 0x53,
+        MLXSW_TRAP_ID_LBERROR = 0x54,
+        MLXSW_TRAP_ID_OSPF = 0x55,
         MLXSW_TRAP_ID_IP2ME = 0x5F,
         MLXSW_TRAP_ID_RTR_INGRESS0 = 0x70,
         MLXSW_TRAP_ID_HOST_MISS_IPV4 = 0x90,
diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
index 88678c172b19..39dadfca84ef 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
+++ b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
@@ -41,7 +41,6 @@
  *          Chris Telfer <chris.telfer@netronome.com>
  */
 
-#include <linux/version.h>
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/init.h>
@@ -1441,10 +1440,6 @@ static int nfp_net_rx(struct nfp_net_rx_ring *rx_ring, int budget)
 
                 nfp_net_set_hash(nn->netdev, skb, rxd);
 
-                /* Pad small frames to minimum */
-                if (skb_put_padto(skb, 60))
-                        break;
-
                 /* Stats update */
                 u64_stats_update_begin(&r_vec->rx_sync);
                 r_vec->rx_pkts++;
@@ -2049,12 +2044,16 @@ static int nfp_net_netdev_open(struct net_device *netdev)
 
         nn->rx_rings = kcalloc(nn->num_rx_rings, sizeof(*nn->rx_rings),
                                GFP_KERNEL);
-        if (!nn->rx_rings)
+        if (!nn->rx_rings) {
+                err = -ENOMEM;
                 goto err_free_lsc;
+        }
         nn->tx_rings = kcalloc(nn->num_tx_rings, sizeof(*nn->tx_rings),
                                GFP_KERNEL);
-        if (!nn->tx_rings)
+        if (!nn->tx_rings) {
+                err = -ENOMEM;
                 goto err_free_rx_rings;
+        }
 
         for (r = 0; r < nn->num_r_vecs; r++) {
                 err = nfp_net_prepare_vector(nn, &nn->r_vecs[r], r);
diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
index 7d7933d00b8f..4c9897220969 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
+++ b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
@@ -40,7 +40,6 @@
  *          Brad Petrus <brad.petrus@netronome.com>
  */
 
-#include <linux/version.h>
 #include <linux/kernel.h>
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
diff --git a/drivers/net/ethernet/netronome/nfp/nfp_netvf_main.c b/drivers/net/ethernet/netronome/nfp/nfp_netvf_main.c
index 37abef016a0a..f7062cb648e1 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_netvf_main.c
+++ b/drivers/net/ethernet/netronome/nfp/nfp_netvf_main.c
@@ -38,7 +38,6 @@
  *         Rolf Neugebauer <rolf.neugebauer@netronome.com>
  */
 
-#include <linux/version.h>
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/init.h>
@@ -134,7 +133,7 @@ static int nfp_netvf_pci_probe(struct pci_dev *pdev,
         }
 
         nfp_net_get_fw_version(&fw_ver, ctrl_bar);
-        if (fw_ver.class != NFP_NET_CFG_VERSION_CLASS_GENERIC) {
+        if (fw_ver.resv || fw_ver.class != NFP_NET_CFG_VERSION_CLASS_GENERIC) {
                 dev_err(&pdev->dev, "Unknown Firmware ABI %d.%d.%d.%d\n",
                         fw_ver.resv, fw_ver.class, fw_ver.major, fw_ver.minor);
                 err = -EINVAL;
@@ -142,9 +141,7 @@ static int nfp_netvf_pci_probe(struct pci_dev *pdev,
         }
 
         /* Determine stride */
-        if (nfp_net_fw_ver_eq(&fw_ver, 0, 0, 0, 0) ||
-            nfp_net_fw_ver_eq(&fw_ver, 0, 0, 0, 1) ||
-            nfp_net_fw_ver_eq(&fw_ver, 0, 0, 0x12, 0x48)) {
+        if (nfp_net_fw_ver_eq(&fw_ver, 0, 0, 0, 1)) {
                 stride = 2;
                 tx_bar_no = NFP_NET_Q0_BAR;
                 rx_bar_no = NFP_NET_Q1_BAR;
diff --git a/drivers/net/ethernet/nxp/lpc_eth.c b/drivers/net/ethernet/nxp/lpc_eth.c
index 4d4ecba0aad9..8e13ec84c538 100644
--- a/drivers/net/ethernet/nxp/lpc_eth.c
+++ b/drivers/net/ethernet/nxp/lpc_eth.c
@@ -475,14 +475,6 @@ static void __lpc_get_mac(struct netdata_local *pldat, u8 *mac)
         mac[5] = tmp >> 8;
 }
 
-static void __lpc_eth_clock_enable(struct netdata_local *pldat, bool enable)
-{
-        if (enable)
-                clk_prepare_enable(pldat->clk);
-        else
-                clk_disable_unprepare(pldat->clk);
-}
-
 static void __lpc_params_setup(struct netdata_local *pldat)
 {
         u32 tmp;
@@ -1056,7 +1048,7 @@ static int lpc_eth_close(struct net_device *ndev)
         writel(0, LPC_ENET_MAC2(pldat->net_base));
         spin_unlock_irqrestore(&pldat->lock, flags);
 
-        __lpc_eth_clock_enable(pldat, false);
+        clk_disable_unprepare(pldat->clk);
 
         return 0;
 }
@@ -1197,11 +1189,14 @@ static int lpc_eth_ioctl(struct net_device *ndev, struct ifreq *req, int cmd)
 static int lpc_eth_open(struct net_device *ndev)
 {
         struct netdata_local *pldat = netdev_priv(ndev);
+        int ret;
 
         if (netif_msg_ifup(pldat))
                 dev_dbg(&pldat->pdev->dev, "enabling %s\n", ndev->name);
 
-        __lpc_eth_clock_enable(pldat, true);
+        ret = clk_prepare_enable(pldat->clk);
+        if (ret)
+                return ret;
 
         /* Suspended PHY makes LPC ethernet core block, so resume now */
         phy_resume(ndev->phydev);
@@ -1320,7 +1315,9 @@ static int lpc_eth_drv_probe(struct platform_device *pdev)
         }
 
         /* Enable network clock */
-        __lpc_eth_clock_enable(pldat, true);
+        ret = clk_prepare_enable(pldat->clk);
+        if (ret)
+                goto err_out_clk_put;
 
         /* Map IO space */
         pldat->net_base = ioremap(res->start, resource_size(res));
@@ -1454,6 +1451,7 @@ err_out_iounmap:
         iounmap(pldat->net_base);
 err_out_disable_clocks:
         clk_disable_unprepare(pldat->clk);
+err_out_clk_put:
         clk_put(pldat->clk);
 err_out_free_dev:
         free_netdev(ndev);
diff --git a/drivers/net/ethernet/qlogic/qed/qed.h b/drivers/net/ethernet/qlogic/qed/qed.h
index 35e53771533f..45ab74676573 100644
--- a/drivers/net/ethernet/qlogic/qed/qed.h
+++ b/drivers/net/ethernet/qlogic/qed/qed.h
@@ -561,9 +561,18 @@ struct qed_dev {
 static inline u8 qed_concrete_to_sw_fid(struct qed_dev *cdev,
                                         u32 concrete_fid)
 {
+        u8 vfid = GET_FIELD(concrete_fid, PXP_CONCRETE_FID_VFID);
         u8 pfid = GET_FIELD(concrete_fid, PXP_CONCRETE_FID_PFID);
+        u8 vf_valid = GET_FIELD(concrete_fid,
+                                PXP_CONCRETE_FID_VFVALID);
+        u8 sw_fid;
 
-        return pfid;
+        if (vf_valid)
+                sw_fid = vfid + MAX_NUM_PFS;
+        else
+                sw_fid = pfid;
+
+        return sw_fid;
 }
 
 #define PURE_LB_TC 8
diff --git a/drivers/net/ethernet/qlogic/qed/qed_dcbx.c b/drivers/net/ethernet/qlogic/qed/qed_dcbx.c
index d0dc28f93c0e..3656d2fd673d 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_dcbx.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_dcbx.c
@@ -19,6 +19,7 @@
 #include "qed_dcbx.h"
 #include "qed_hsi.h"
 #include "qed_sp.h"
+#include "qed_sriov.h"
 #ifdef CONFIG_DCB
 #include <linux/qed/qed_eth_if.h>
 #endif
@@ -52,40 +53,94 @@ static bool qed_dcbx_app_ethtype(u32 app_info_bitmap)
                   DCBX_APP_SF_ETHTYPE);
 }
 
+static bool qed_dcbx_ieee_app_ethtype(u32 app_info_bitmap)
+{
+        u8 mfw_val = QED_MFW_GET_FIELD(app_info_bitmap, DCBX_APP_SF_IEEE);
+
+        /* Old MFW */
+        if (mfw_val == DCBX_APP_SF_IEEE_RESERVED)
+                return qed_dcbx_app_ethtype(app_info_bitmap);
+
+        return !!(mfw_val == DCBX_APP_SF_IEEE_ETHTYPE);
+}
+
 static bool qed_dcbx_app_port(u32 app_info_bitmap)
 {
         return !!(QED_MFW_GET_FIELD(app_info_bitmap, DCBX_APP_SF) ==
                   DCBX_APP_SF_PORT);
 }
 
-static bool qed_dcbx_default_tlv(u32 app_info_bitmap, u16 proto_id)
+static bool qed_dcbx_ieee_app_port(u32 app_info_bitmap, u8 type)
 {
-        return !!(qed_dcbx_app_ethtype(app_info_bitmap) &&
-                  proto_id == QED_ETH_TYPE_DEFAULT);
+        u8 mfw_val = QED_MFW_GET_FIELD(app_info_bitmap, DCBX_APP_SF_IEEE);
+
+        /* Old MFW */
+        if (mfw_val == DCBX_APP_SF_IEEE_RESERVED)
+                return qed_dcbx_app_port(app_info_bitmap);
+
+        return !!(mfw_val == type || mfw_val == DCBX_APP_SF_IEEE_TCP_UDP_PORT);
 }
 
-static bool qed_dcbx_iscsi_tlv(u32 app_info_bitmap, u16 proto_id)
+static bool qed_dcbx_default_tlv(u32 app_info_bitmap, u16 proto_id, bool ieee)
 {
-        return !!(qed_dcbx_app_port(app_info_bitmap) &&
-                  proto_id == QED_TCP_PORT_ISCSI);
+        bool ethtype;
+
+        if (ieee)
+                ethtype = qed_dcbx_ieee_app_ethtype(app_info_bitmap);
+        else
+                ethtype = qed_dcbx_app_ethtype(app_info_bitmap);
+
+        return !!(ethtype && (proto_id == QED_ETH_TYPE_DEFAULT));
 }
 
-static bool qed_dcbx_fcoe_tlv(u32 app_info_bitmap, u16 proto_id)
+static bool qed_dcbx_iscsi_tlv(u32 app_info_bitmap, u16 proto_id, bool ieee)
 {
-        return !!(qed_dcbx_app_ethtype(app_info_bitmap) &&
-                  proto_id == QED_ETH_TYPE_FCOE);
+        bool port;
+
+        if (ieee)
+                port = qed_dcbx_ieee_app_port(app_info_bitmap,
+                                              DCBX_APP_SF_IEEE_TCP_PORT);
+        else
+                port = qed_dcbx_app_port(app_info_bitmap);
+
+        return !!(port && (proto_id == QED_TCP_PORT_ISCSI));
 }
 
-static bool qed_dcbx_roce_tlv(u32 app_info_bitmap, u16 proto_id)
+static bool qed_dcbx_fcoe_tlv(u32 app_info_bitmap, u16 proto_id, bool ieee)
 {
-        return !!(qed_dcbx_app_ethtype(app_info_bitmap) &&
-                  proto_id == QED_ETH_TYPE_ROCE);
+        bool ethtype;
+
+        if (ieee)
+                ethtype = qed_dcbx_ieee_app_ethtype(app_info_bitmap);
+        else
+                ethtype = qed_dcbx_app_ethtype(app_info_bitmap);
+
+        return !!(ethtype && (proto_id == QED_ETH_TYPE_FCOE));
 }
 
-static bool qed_dcbx_roce_v2_tlv(u32 app_info_bitmap, u16 proto_id)
+static bool qed_dcbx_roce_tlv(u32 app_info_bitmap, u16 proto_id, bool ieee)
 {
-        return !!(qed_dcbx_app_port(app_info_bitmap) &&
-                  proto_id == QED_UDP_PORT_TYPE_ROCE_V2);
+        bool ethtype;
+
+        if (ieee)
+                ethtype = qed_dcbx_ieee_app_ethtype(app_info_bitmap);
+        else
+                ethtype = qed_dcbx_app_ethtype(app_info_bitmap);
+
+        return !!(ethtype && (proto_id == QED_ETH_TYPE_ROCE));
+}
+
+static bool qed_dcbx_roce_v2_tlv(u32 app_info_bitmap, u16 proto_id, bool ieee)
+{
+        bool port;
+
+        if (ieee)
+                port = qed_dcbx_ieee_app_port(app_info_bitmap,
+                                              DCBX_APP_SF_IEEE_UDP_PORT);
+        else
+                port = qed_dcbx_app_port(app_info_bitmap);
+
+        return !!(port && (proto_id == QED_UDP_PORT_TYPE_ROCE_V2));
 }
 
 static void
@@ -164,17 +219,17 @@ qed_dcbx_update_app_info(struct qed_dcbx_results *p_data,
 static bool
 qed_dcbx_get_app_protocol_type(struct qed_hwfn *p_hwfn,
                                u32 app_prio_bitmap,
-                               u16 id, enum dcbx_protocol_type *type)
+                               u16 id, enum dcbx_protocol_type *type, bool ieee)
 {
-        if (qed_dcbx_fcoe_tlv(app_prio_bitmap, id)) {
+        if (qed_dcbx_fcoe_tlv(app_prio_bitmap, id, ieee)) {
                 *type = DCBX_PROTOCOL_FCOE;
-        } else if (qed_dcbx_roce_tlv(app_prio_bitmap, id)) {
+        } else if (qed_dcbx_roce_tlv(app_prio_bitmap, id, ieee)) {
                 *type = DCBX_PROTOCOL_ROCE;
-        } else if (qed_dcbx_iscsi_tlv(app_prio_bitmap, id)) {
+        } else if (qed_dcbx_iscsi_tlv(app_prio_bitmap, id, ieee)) {
                 *type = DCBX_PROTOCOL_ISCSI;
-        } else if (qed_dcbx_default_tlv(app_prio_bitmap, id)) {
+        } else if (qed_dcbx_default_tlv(app_prio_bitmap, id, ieee)) {
                 *type = DCBX_PROTOCOL_ETH;
-        } else if (qed_dcbx_roce_v2_tlv(app_prio_bitmap, id)) {
+        } else if (qed_dcbx_roce_v2_tlv(app_prio_bitmap, id, ieee)) {
                 *type = DCBX_PROTOCOL_ROCE_V2;
         } else {
                 *type = DCBX_MAX_PROTOCOL_TYPE;
@@ -194,17 +249,18 @@ static int
 qed_dcbx_process_tlv(struct qed_hwfn *p_hwfn,
                      struct qed_dcbx_results *p_data,
                      struct dcbx_app_priority_entry *p_tbl,
-                     u32 pri_tc_tbl, int count, bool dcbx_enabled)
+                     u32 pri_tc_tbl, int count, u8 dcbx_version)
 {
         u8 tc, priority_map;
         enum dcbx_protocol_type type;
+        bool enable, ieee;
         u16 protocol_id;
         int priority;
-        bool enable;
         int i;
 
         DP_VERBOSE(p_hwfn, QED_MSG_DCB, "Num APP entries = %d\n", count);
 
+        ieee = (dcbx_version == DCBX_CONFIG_VERSION_IEEE);
         /* Parse APP TLV */
         for (i = 0; i < count; i++) {
                 protocol_id = QED_MFW_GET_FIELD(p_tbl[i].entry,
@@ -219,7 +275,7 @@ qed_dcbx_process_tlv(struct qed_hwfn *p_hwfn,
 
                 tc = QED_DCBX_PRIO2TC(pri_tc_tbl, priority);
                 if (qed_dcbx_get_app_protocol_type(p_hwfn, p_tbl[i].entry,
-                                                   protocol_id, &type)) {
+                                                   protocol_id, &type, ieee)) {
                         /* ETH always have the enable bit reset, as it gets
                          * vlan information per packet. For other protocols,
                          * should be set according to the dcbx_enabled
@@ -275,15 +331,12 @@ static int qed_dcbx_process_mib_info(struct qed_hwfn *p_hwfn)
         struct dcbx_ets_feature *p_ets;
         struct qed_hw_info *p_info;
         u32 pri_tc_tbl, flags;
-        bool dcbx_enabled;
+        u8 dcbx_version;
         int num_entries;
         int rc = 0;
 
-        /* If DCBx version is non zero, then negotiation was
-         * successfuly performed
-         */
         flags = p_hwfn->p_dcbx_info->operational.flags;
-        dcbx_enabled = !!QED_MFW_GET_FIELD(flags, DCBX_CONFIG_VERSION);
+        dcbx_version = QED_MFW_GET_FIELD(flags, DCBX_CONFIG_VERSION);
 
         p_app = &p_hwfn->p_dcbx_info->operational.features.app;
         p_tbl = p_app->app_pri_tbl;
@@ -295,13 +348,13 @@ static int qed_dcbx_process_mib_info(struct qed_hwfn *p_hwfn)
         num_entries = QED_MFW_GET_FIELD(p_app->flags, DCBX_APP_NUM_ENTRIES);
 
         rc = qed_dcbx_process_tlv(p_hwfn, &data, p_tbl, pri_tc_tbl,
-                                  num_entries, dcbx_enabled);
+                                  num_entries, dcbx_version);
         if (rc)
                 return rc;
 
         p_info->num_tc = QED_MFW_GET_FIELD(p_ets->flags, DCBX_ETS_MAX_TCS);
         data.pf_id = p_hwfn->rel_pf_id;
-        data.dcbx_enabled = dcbx_enabled;
+        data.dcbx_enabled = !!dcbx_version;
 
         qed_dcbx_dp_protocol(p_hwfn, &data);
 
@@ -400,7 +453,7 @@ static void
 qed_dcbx_get_app_data(struct qed_hwfn *p_hwfn,
                       struct dcbx_app_priority_feature *p_app,
                       struct dcbx_app_priority_entry *p_tbl,
-                      struct qed_dcbx_params *p_params)
+                      struct qed_dcbx_params *p_params, bool ieee)
 {
         struct qed_app_entry *entry;
         u8 pri_map;
@@ -414,15 +467,46 @@ qed_dcbx_get_app_data(struct qed_hwfn *p_hwfn,
                                                       DCBX_APP_NUM_ENTRIES);
         for (i = 0; i < DCBX_MAX_APP_PROTOCOL; i++) {
                 entry = &p_params->app_entry[i];
-                entry->ethtype = !(QED_MFW_GET_FIELD(p_tbl[i].entry,
-                                                     DCBX_APP_SF));
+                if (ieee) {
+                        u8 sf_ieee;
+                        u32 val;
+
+                        sf_ieee = QED_MFW_GET_FIELD(p_tbl[i].entry,
+                                                    DCBX_APP_SF_IEEE);
+                        switch (sf_ieee) {
+                        case DCBX_APP_SF_IEEE_RESERVED:
+                                /* Old MFW */
+                                val = QED_MFW_GET_FIELD(p_tbl[i].entry,
+                                                        DCBX_APP_SF);
+                                entry->sf_ieee = val ?
+                                    QED_DCBX_SF_IEEE_TCP_UDP_PORT :
+                                    QED_DCBX_SF_IEEE_ETHTYPE;
+                                break;
+                        case DCBX_APP_SF_IEEE_ETHTYPE:
+                                entry->sf_ieee = QED_DCBX_SF_IEEE_ETHTYPE;
+                                break;
+                        case DCBX_APP_SF_IEEE_TCP_PORT:
+                                entry->sf_ieee = QED_DCBX_SF_IEEE_TCP_PORT;
+                                break;
+                        case DCBX_APP_SF_IEEE_UDP_PORT:
+                                entry->sf_ieee = QED_DCBX_SF_IEEE_UDP_PORT;
+                                break;
+                        case DCBX_APP_SF_IEEE_TCP_UDP_PORT:
+                                entry->sf_ieee = QED_DCBX_SF_IEEE_TCP_UDP_PORT;
+                                break;
+                        }
+                } else {
+                        entry->ethtype = !(QED_MFW_GET_FIELD(p_tbl[i].entry,
+                                                             DCBX_APP_SF));
+                }
+
                 pri_map = QED_MFW_GET_FIELD(p_tbl[i].entry, DCBX_APP_PRI_MAP);
                 entry->prio = ffs(pri_map) - 1;
                 entry->proto_id = QED_MFW_GET_FIELD(p_tbl[i].entry,
                                                     DCBX_APP_PROTOCOL_ID);
                 qed_dcbx_get_app_protocol_type(p_hwfn, p_tbl[i].entry,
                                                entry->proto_id,
-                                               &entry->proto_type);
+                                               &entry->proto_type, ieee);
         }
 
         DP_VERBOSE(p_hwfn, QED_MSG_DCB,
@@ -483,7 +567,7 @@ qed_dcbx_get_ets_data(struct qed_hwfn *p_hwfn,
         bw_map[1] = be32_to_cpu(p_ets->tc_bw_tbl[1]);
         tsa_map[0] = be32_to_cpu(p_ets->tc_tsa_tbl[0]);
         tsa_map[1] = be32_to_cpu(p_ets->tc_tsa_tbl[1]);
-        pri_map = be32_to_cpu(p_ets->pri_tc_tbl[0]);
+        pri_map = p_ets->pri_tc_tbl[0];
         for (i = 0; i < QED_MAX_PFC_PRIORITIES; i++) {
                 p_params->ets_tc_bw_tbl[i] = ((u8 *)bw_map)[i];
                 p_params->ets_tc_tsa_tbl[i] = ((u8 *)tsa_map)[i];
@@ -500,9 +584,9 @@ qed_dcbx_get_common_params(struct qed_hwfn *p_hwfn,
                            struct dcbx_app_priority_feature *p_app,
                            struct dcbx_app_priority_entry *p_tbl,
                            struct dcbx_ets_feature *p_ets,
-                           u32 pfc, struct qed_dcbx_params *p_params)
+                           u32 pfc, struct qed_dcbx_params *p_params, bool ieee)
 {
-        qed_dcbx_get_app_data(p_hwfn, p_app, p_tbl, p_params);
+        qed_dcbx_get_app_data(p_hwfn, p_app, p_tbl, p_params, ieee);
         qed_dcbx_get_ets_data(p_hwfn, p_ets, p_params);
         qed_dcbx_get_pfc_data(p_hwfn, pfc, p_params);
 }
@@ -516,7 +600,7 @@ qed_dcbx_get_local_params(struct qed_hwfn *p_hwfn,
         p_feat = &p_hwfn->p_dcbx_info->local_admin.features;
         qed_dcbx_get_common_params(p_hwfn, &p_feat->app,
                                    p_feat->app.app_pri_tbl, &p_feat->ets,
-                                   p_feat->pfc, &params->local.params);
+                                   p_feat->pfc, &params->local.params, false);
         params->local.valid = true;
 }
 
@@ -529,7 +613,7 @@ qed_dcbx_get_remote_params(struct qed_hwfn *p_hwfn,
         p_feat = &p_hwfn->p_dcbx_info->remote.features;
         qed_dcbx_get_common_params(p_hwfn, &p_feat->app,
                                    p_feat->app.app_pri_tbl, &p_feat->ets,
-                                   p_feat->pfc, &params->remote.params);
+                                   p_feat->pfc, &params->remote.params, false);
         params->remote.valid = true;
 }
 
@@ -574,7 +658,8 @@ qed_dcbx_get_operational_params(struct qed_hwfn *p_hwfn,
 
         qed_dcbx_get_common_params(p_hwfn, &p_feat->app,
                                    p_feat->app.app_pri_tbl, &p_feat->ets,
-                                   p_feat->pfc, &params->operational.params);
+                                   p_feat->pfc, &params->operational.params,
+                                   p_operational->ieee);
         qed_dcbx_get_priority_info(p_hwfn, &p_operational->app_prio, p_results);
         err = QED_MFW_GET_FIELD(p_feat->app.flags, DCBX_APP_ERROR);
         p_operational->err = err;
@@ -861,6 +946,9 @@ static int qed_dcbx_query_params(struct qed_hwfn *p_hwfn,
         struct qed_ptt *p_ptt;
         int rc;
 
+        if (IS_VF(p_hwfn->cdev))
+                return -EINVAL;
+
         p_ptt = qed_ptt_acquire(p_hwfn);
         if (!p_ptt)
                 return -EBUSY;
@@ -900,6 +988,7 @@ qed_dcbx_set_pfc_data(struct qed_hwfn *p_hwfn,
                 if (p_params->pfc.prio[i])
                         pfc_map |= BIT(i);
 
+        *pfc &= ~DCBX_PFC_PRI_EN_BITMAP_MASK;
         *pfc |= (pfc_map << DCBX_PFC_PRI_EN_BITMAP_SHIFT);
 
         DP_VERBOSE(p_hwfn, QED_MSG_DCB, "pfc = 0x%x\n", *pfc);
@@ -944,7 +1033,6 @@ qed_dcbx_set_ets_data(struct qed_hwfn *p_hwfn,
                 val = (((u32)p_params->ets_pri_tc_tbl[i]) << ((7 - i) * 4));
                 p_ets->pri_tc_tbl[0] |= val;
         }
-        p_ets->pri_tc_tbl[0] = cpu_to_be32(p_ets->pri_tc_tbl[0]);
         for (i = 0; i < 2; i++) {
                 p_ets->tc_bw_tbl[i] = cpu_to_be32(p_ets->tc_bw_tbl[i]);
                 p_ets->tc_tsa_tbl[i] = cpu_to_be32(p_ets->tc_tsa_tbl[i]);
@@ -954,7 +1042,7 @@ qed_dcbx_set_ets_data(struct qed_hwfn *p_hwfn,
 static void
 qed_dcbx_set_app_data(struct qed_hwfn *p_hwfn,
                       struct dcbx_app_priority_feature *p_app,
-                      struct qed_dcbx_params *p_params)
+                      struct qed_dcbx_params *p_params, bool ieee)
 {
         u32 *entry;
         int i;
@@ -975,12 +1063,45 @@ qed_dcbx_set_app_data(struct qed_hwfn *p_hwfn,
 
         for (i = 0; i < DCBX_MAX_APP_PROTOCOL; i++) {
                 entry = &p_app->app_pri_tbl[i].entry;
-                *entry &= ~DCBX_APP_SF_MASK;
-                if (p_params->app_entry[i].ethtype)
-                        *entry |= ((u32)DCBX_APP_SF_ETHTYPE <<
-                                   DCBX_APP_SF_SHIFT);
-                else
-                        *entry |= ((u32)DCBX_APP_SF_PORT << DCBX_APP_SF_SHIFT);
+                *entry = 0;
+                if (ieee) {
+                        *entry &= ~(DCBX_APP_SF_IEEE_MASK | DCBX_APP_SF_MASK);
+                        switch (p_params->app_entry[i].sf_ieee) {
+                        case QED_DCBX_SF_IEEE_ETHTYPE:
+                                *entry |= ((u32)DCBX_APP_SF_IEEE_ETHTYPE <<
+                                           DCBX_APP_SF_IEEE_SHIFT);
+                                *entry |= ((u32)DCBX_APP_SF_ETHTYPE <<
+                                           DCBX_APP_SF_SHIFT);
+                                break;
+                        case QED_DCBX_SF_IEEE_TCP_PORT:
+                                *entry |= ((u32)DCBX_APP_SF_IEEE_TCP_PORT <<
+                                           DCBX_APP_SF_IEEE_SHIFT);
+                                *entry |= ((u32)DCBX_APP_SF_PORT <<
+                                           DCBX_APP_SF_SHIFT);
+                                break;
+                        case QED_DCBX_SF_IEEE_UDP_PORT:
+                                *entry |= ((u32)DCBX_APP_SF_IEEE_UDP_PORT <<
+                                           DCBX_APP_SF_IEEE_SHIFT);
+                                *entry |= ((u32)DCBX_APP_SF_PORT <<
+                                           DCBX_APP_SF_SHIFT);
+                                break;
+                        case QED_DCBX_SF_IEEE_TCP_UDP_PORT:
+                                *entry |= ((u32)DCBX_APP_SF_IEEE_TCP_UDP_PORT <<
+                                           DCBX_APP_SF_IEEE_SHIFT);
+                                *entry |= ((u32)DCBX_APP_SF_PORT <<
+                                           DCBX_APP_SF_SHIFT);
+                                break;
+                        }
+                } else {
+                        *entry &= ~DCBX_APP_SF_MASK;
+                        if (p_params->app_entry[i].ethtype)
+                                *entry |= ((u32)DCBX_APP_SF_ETHTYPE <<
+                                           DCBX_APP_SF_SHIFT);
+                        else
+                                *entry |= ((u32)DCBX_APP_SF_PORT <<
+                                           DCBX_APP_SF_SHIFT);
+                }
+
                 *entry &= ~DCBX_APP_PROTOCOL_ID_MASK;
                 *entry |= ((u32)p_params->app_entry[i].proto_id <<
                            DCBX_APP_PROTOCOL_ID_SHIFT);
@@ -995,15 +1116,19 @@ qed_dcbx_set_local_params(struct qed_hwfn *p_hwfn,
                           struct dcbx_local_params *local_admin,
                           struct qed_dcbx_set *params)
 {
+        bool ieee = false;
+
         local_admin->flags = 0;
         memcpy(&local_admin->features,
                &p_hwfn->p_dcbx_info->operational.features,
                sizeof(local_admin->features));
 
-        if (params->enabled)
+        if (params->enabled) {
                 local_admin->config = params->ver_num;
-        else
+                ieee = !!(params->ver_num & DCBX_CONFIG_VERSION_IEEE);
+        } else {
                 local_admin->config = DCBX_CONFIG_VERSION_DISABLED;
+        }
 
         if (params->override_flags & QED_DCBX_OVERRIDE_PFC_CFG)
                 qed_dcbx_set_pfc_data(p_hwfn, &local_admin->features.pfc,
@@ -1015,7 +1140,7 @@ qed_dcbx_set_local_params(struct qed_hwfn *p_hwfn,
 
         if (params->override_flags & QED_DCBX_OVERRIDE_APP_CFG)
                 qed_dcbx_set_app_data(p_hwfn, &local_admin->features.app,
-                                      &params->config.params);
+                                      &params->config.params, ieee);
 }
 
 int qed_dcbx_config_params(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt,
@@ -1064,7 +1189,7 @@ int qed_dcbx_get_config_params(struct qed_hwfn *p_hwfn,
                 return 0;
         }
 
-        dcbx_info = kmalloc(sizeof(*dcbx_info), GFP_KERNEL);
+        dcbx_info = kzalloc(sizeof(*dcbx_info), GFP_KERNEL);
         if (!dcbx_info) {
                 DP_ERR(p_hwfn, "Failed to allocate struct qed_dcbx_info\n");
                 return -ENOMEM;
@@ -1101,7 +1226,7 @@ static struct qed_dcbx_get *qed_dcbnl_get_dcbx(struct qed_hwfn *hwfn,
 {
         struct qed_dcbx_get *dcbx_info;
 
-        dcbx_info = kmalloc(sizeof(*dcbx_info), GFP_KERNEL);
+        dcbx_info = kzalloc(sizeof(*dcbx_info), GFP_KERNEL);
         if (!dcbx_info) {
                 DP_ERR(hwfn->cdev, "Failed to allocate memory for dcbx_info\n");
                 return NULL;
@@ -1596,8 +1721,10 @@ static int qed_dcbnl_setapp(struct qed_dev *cdev,
                 if ((entry->ethtype == ethtype) && (entry->proto_id == idval))
                         break;
                 /* First empty slot */
-                if (!entry->proto_id)
+                if (!entry->proto_id) {
+                        dcbx_set.config.params.num_app_entries++;
                         break;
+                }
         }
 
         if (i == QED_DCBX_MAX_APP_PROTOCOL) {
@@ -2117,8 +2244,10 @@ int qed_dcbnl_ieee_setapp(struct qed_dev *cdev, struct dcb_app *app)
                     (entry->proto_id == app->protocol))
                         break;
                 /* First empty slot */
-                if (!entry->proto_id)
+                if (!entry->proto_id) {
+                        dcbx_set.config.params.num_app_entries++;
                         break;
+                }
         }
 
         if (i == QED_DCBX_MAX_APP_PROTOCOL) {
diff --git a/drivers/net/ethernet/qlogic/qed/qed_hsi.h b/drivers/net/ethernet/qlogic/qed/qed_hsi.h
index 592784019994..6f9d3b831a2a 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_hsi.h
+++ b/drivers/net/ethernet/qlogic/qed/qed_hsi.h
@@ -6850,6 +6850,14 @@ struct dcbx_app_priority_entry {
 #define DCBX_APP_SF_SHIFT               8
 #define DCBX_APP_SF_ETHTYPE             0
 #define DCBX_APP_SF_PORT                1
+#define DCBX_APP_SF_IEEE_MASK           0x0000f000
+#define DCBX_APP_SF_IEEE_SHIFT          12
+#define DCBX_APP_SF_IEEE_RESERVED       0
+#define DCBX_APP_SF_IEEE_ETHTYPE        1
+#define DCBX_APP_SF_IEEE_TCP_PORT       2
+#define DCBX_APP_SF_IEEE_UDP_PORT       3
+#define DCBX_APP_SF_IEEE_TCP_UDP_PORT   4
+
 #define DCBX_APP_PROTOCOL_ID_MASK       0xffff0000
 #define DCBX_APP_PROTOCOL_ID_SHIFT      16
 };
diff --git a/drivers/net/ethernet/qlogic/qed/qed_mcp.c b/drivers/net/ethernet/qlogic/qed/qed_mcp.c
index a240f26344a4..f776a77794c5 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_mcp.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_mcp.c
@@ -1153,8 +1153,8 @@ qed_mcp_send_drv_version(struct qed_hwfn *p_hwfn,
         p_drv_version = &union_data.drv_version;
         p_drv_version->version = p_ver->version;
 
-        for (i = 0; i < MCP_DRV_VER_STR_SIZE - 1; i += 4) {
-                val = cpu_to_be32(p_ver->name[i]);
+        for (i = 0; i < (MCP_DRV_VER_STR_SIZE - 4) / sizeof(u32); i++) {
+                val = cpu_to_be32(*((u32 *)&p_ver->name[i * sizeof(u32)]));
                 *(__be32 *)&p_drv_version->name[i * sizeof(u32)] = val;
         }
 
diff --git a/drivers/net/ethernet/qlogic/qede/qede_main.c b/drivers/net/ethernet/qlogic/qede/qede_main.c
index e4bd02e46e57..9544e4c41359 100644
--- a/drivers/net/ethernet/qlogic/qede/qede_main.c
+++ b/drivers/net/ethernet/qlogic/qede/qede_main.c
@@ -722,11 +722,14 @@ netdev_tx_t qede_start_xmit(struct sk_buff *skb,
         txq->tx_db.data.bd_prod =
                 cpu_to_le16(qed_chain_get_prod_idx(&txq->tx_pbl));
 
-        if (!skb->xmit_more || netif_tx_queue_stopped(netdev_txq))
+        if (!skb->xmit_more || netif_xmit_stopped(netdev_txq))
                 qede_update_tx_producer(txq);
 
         if (unlikely(qed_chain_get_elem_left(&txq->tx_pbl)
                       < (MAX_SKB_FRAGS + 1))) {
+                if (skb->xmit_more)
+                        qede_update_tx_producer(txq);
+
                 netif_tx_stop_queue(netdev_txq);
                 DP_VERBOSE(edev, NETIF_MSG_TX_QUEUED,
                            "Stop queue was called\n");
@@ -2517,7 +2520,8 @@ static int __qede_probe(struct pci_dev *pdev, u32 dp_module, u8 dp_level,
         edev->ops->register_ops(cdev, &qede_ll_ops, edev);
 
 #ifdef CONFIG_DCB
-        qede_set_dcbnl_ops(edev->ndev);
+        if (!IS_VF(edev))
+                qede_set_dcbnl_ops(edev->ndev);
 #endif
 
         INIT_DELAYED_WORK(&edev->sp_task, qede_sp_task);
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
index fd973f4f16c7..49bad00a0f8f 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
@@ -37,8 +37,8 @@
 
 #define _QLCNIC_LINUX_MAJOR 5
 #define _QLCNIC_LINUX_MINOR 3
-#define _QLCNIC_LINUX_SUBVERSION 64
-#define QLCNIC_LINUX_VERSIONID  "5.3.64"
+#define _QLCNIC_LINUX_SUBVERSION 65
+#define QLCNIC_LINUX_VERSIONID  "5.3.65"
 #define QLCNIC_DRV_IDC_VER  0x01
 #define QLCNIC_DRIVER_VERSION  ((_QLCNIC_LINUX_MAJOR << 16) |\
                  (_QLCNIC_LINUX_MINOR << 8) | (_QLCNIC_LINUX_SUBVERSION))
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c
index 87c642d3b075..fedd7366713c 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c
@@ -102,7 +102,6 @@
 #define QLCNIC_RESPONSE_DESC    0x05
 #define QLCNIC_LRO_DESC         0x12
 
-#define QLCNIC_TX_POLL_BUDGET           128
 #define QLCNIC_TCP_HDR_SIZE             20
 #define QLCNIC_TCP_TS_OPTION_SIZE       12
 #define QLCNIC_FETCH_RING_ID(handle)    ((handle) >> 63)
@@ -2008,7 +2007,6 @@ static int qlcnic_83xx_msix_tx_poll(struct napi_struct *napi, int budget)
         struct qlcnic_host_tx_ring *tx_ring;
         struct qlcnic_adapter *adapter;
 
-        budget = QLCNIC_TX_POLL_BUDGET;
         tx_ring = container_of(napi, struct qlcnic_host_tx_ring, napi);
         adapter = tx_ring->adapter;
         work_done = qlcnic_process_cmd_ring(adapter, tx_ring, budget);
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov.h
index 017d8c2c8285..24061b9b92e8 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov.h
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov.h
@@ -156,10 +156,8 @@ struct qlcnic_vf_info {
         spinlock_t                      vlan_list_lock; /* Lock for VLAN list */
 };
 
-struct qlcnic_async_work_list {
+struct qlcnic_async_cmd {
         struct list_head        list;
-        struct work_struct      work;
-        void                    *ptr;
         struct qlcnic_cmd_args  *cmd;
 };
 
@@ -168,7 +166,10 @@ struct qlcnic_back_channel {
         struct workqueue_struct *bc_trans_wq;
         struct workqueue_struct *bc_async_wq;
         struct workqueue_struct *bc_flr_wq;
-        struct list_head        async_list;
+        struct qlcnic_adapter   *adapter;
+        struct list_head        async_cmd_list;
+        struct work_struct      vf_async_work;
+        spinlock_t              queue_lock; /* async_cmd_list queue lock */
 };
 
 struct qlcnic_sriov {
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
index 7327b729ba2e..d7107055ec60 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
@@ -29,6 +29,7 @@
 #define QLC_83XX_VF_RESET_FAIL_THRESH   8
 #define QLC_BC_CMD_MAX_RETRY_CNT        5
 
+static void qlcnic_sriov_handle_async_issue_cmd(struct work_struct *work);
 static void qlcnic_sriov_vf_free_mac_list(struct qlcnic_adapter *);
 static int qlcnic_sriov_alloc_bc_mbx_args(struct qlcnic_cmd_args *, u32);
 static void qlcnic_sriov_vf_poll_dev_state(struct work_struct *);
@@ -177,7 +178,10 @@ int qlcnic_sriov_init(struct qlcnic_adapter *adapter, int num_vfs)
         }
 
         bc->bc_async_wq =  wq;
-        INIT_LIST_HEAD(&bc->async_list);
+        INIT_LIST_HEAD(&bc->async_cmd_list);
+        INIT_WORK(&bc->vf_async_work, qlcnic_sriov_handle_async_issue_cmd);
+        spin_lock_init(&bc->queue_lock);
+        bc->adapter = adapter;
 
         for (i = 0; i < num_vfs; i++) {
                 vf = &sriov->vf_info[i];
@@ -1517,17 +1521,21 @@ static void qlcnic_vf_add_mc_list(struct net_device *netdev, const u8 *mac,
 
 void qlcnic_sriov_cleanup_async_list(struct qlcnic_back_channel *bc)
 {
-        struct list_head *head = &bc->async_list;
-        struct qlcnic_async_work_list *entry;
+        struct list_head *head = &bc->async_cmd_list;
+        struct qlcnic_async_cmd *entry;
 
         flush_workqueue(bc->bc_async_wq);
+        cancel_work_sync(&bc->vf_async_work);
+
+        spin_lock(&bc->queue_lock);
         while (!list_empty(head)) {
-                entry = list_entry(head->next, struct qlcnic_async_work_list,
+                entry = list_entry(head->next, struct qlcnic_async_cmd,
                                    list);
-                cancel_work_sync(&entry->work);
                 list_del(&entry->list);
+                kfree(entry->cmd);
                 kfree(entry);
         }
+        spin_unlock(&bc->queue_lock);
 }
 
 void qlcnic_sriov_vf_set_multi(struct net_device *netdev)
@@ -1587,57 +1595,64 @@ void qlcnic_sriov_vf_set_multi(struct net_device *netdev)
 
 static void qlcnic_sriov_handle_async_issue_cmd(struct work_struct *work)
 {
-        struct qlcnic_async_work_list *entry;
-        struct qlcnic_adapter *adapter;
+        struct qlcnic_async_cmd *entry, *tmp;
+        struct qlcnic_back_channel *bc;
         struct qlcnic_cmd_args *cmd;
+        struct list_head *head;
+        LIST_HEAD(del_list);
+
+        bc = container_of(work, struct qlcnic_back_channel, vf_async_work);
+        head = &bc->async_cmd_list;
+
+        spin_lock(&bc->queue_lock);
+        list_splice_init(head, &del_list);
+        spin_unlock(&bc->queue_lock);
+
+        list_for_each_entry_safe(entry, tmp, &del_list, list) {
+                list_del(&entry->list);
+                cmd = entry->cmd;
+                __qlcnic_sriov_issue_cmd(bc->adapter, cmd);
+                kfree(entry);
+        }
+
+        if (!list_empty(head))
+                queue_work(bc->bc_async_wq, &bc->vf_async_work);
 
-        entry = container_of(work, struct qlcnic_async_work_list, work);
-        adapter = entry->ptr;
-        cmd = entry->cmd;
-        __qlcnic_sriov_issue_cmd(adapter, cmd);
         return;
 }
 
-static struct qlcnic_async_work_list *
-qlcnic_sriov_get_free_node_async_work(struct qlcnic_back_channel *bc)
+static struct qlcnic_async_cmd *
+qlcnic_sriov_alloc_async_cmd(struct qlcnic_back_channel *bc,
+                             struct qlcnic_cmd_args *cmd)
 {
-        struct list_head *node;
-        struct qlcnic_async_work_list *entry = NULL;
-        u8 empty = 0;
+        struct qlcnic_async_cmd *entry = NULL;
 
-        list_for_each(node, &bc->async_list) {
-                entry = list_entry(node, struct qlcnic_async_work_list, list);
-                if (!work_pending(&entry->work)) {
-                        empty = 1;
-                        break;
-                }
-        }
+        entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
+        if (!entry)
+                return NULL;
 
-        if (!empty) {
-                entry = kzalloc(sizeof(struct qlcnic_async_work_list),
-                                GFP_ATOMIC);
-                if (entry == NULL)
-                        return NULL;
-                list_add_tail(&entry->list, &bc->async_list);
-        }
+        entry->cmd = cmd;
+
+        spin_lock(&bc->queue_lock);
+        list_add_tail(&entry->list, &bc->async_cmd_list);
+        spin_unlock(&bc->queue_lock);
 
         return entry;
 }
 
 static void qlcnic_sriov_schedule_async_cmd(struct qlcnic_back_channel *bc,
-                                            work_func_t func, void *data,
                                             struct qlcnic_cmd_args *cmd)
 {
-        struct qlcnic_async_work_list *entry = NULL;
+        struct qlcnic_async_cmd *entry = NULL;
 
-        entry = qlcnic_sriov_get_free_node_async_work(bc);
-        if (!entry)
+        entry = qlcnic_sriov_alloc_async_cmd(bc, cmd);
+        if (!entry) {
+                qlcnic_free_mbx_args(cmd);
+                kfree(cmd);
                 return;
+        }
 
-        entry->ptr = data;
-        entry->cmd = cmd;
-        INIT_WORK(&entry->work, func);
-        queue_work(bc->bc_async_wq, &entry->work);
+        queue_work(bc->bc_async_wq, &bc->vf_async_work);
 }
 
 static int qlcnic_sriov_async_issue_cmd(struct qlcnic_adapter *adapter,
@@ -1649,8 +1664,8 @@ static int qlcnic_sriov_async_issue_cmd(struct qlcnic_adapter *adapter,
         if (adapter->need_fw_reset)
                 return -EIO;
 
-        qlcnic_sriov_schedule_async_cmd(bc, qlcnic_sriov_handle_async_issue_cmd,
-                                        adapter, cmd);
+        qlcnic_sriov_schedule_async_cmd(bc, cmd);
+
         return 0;
 }
 
diff --git a/drivers/net/ethernet/realtek/8139cp.c b/drivers/net/ethernet/realtek/8139cp.c
index deae10d7426d..5297bf77211c 100644
--- a/drivers/net/ethernet/realtek/8139cp.c
+++ b/drivers/net/ethernet/realtek/8139cp.c
@@ -467,8 +467,8 @@ static int cp_rx_poll(struct napi_struct *napi, int budget)
         unsigned int rx_tail = cp->rx_tail;
         int rx;
 
-rx_status_loop:
         rx = 0;
+rx_status_loop:
         cpw16(IntrStatus, cp_rx_intr_mask);
 
         while (rx < budget) {
diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
index 799d58d86e6d..054e795df90f 100644
--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -201,9 +201,14 @@ static const u16 sh_eth_offset_fast_rz[SH_ETH_MAX_REGISTER_OFFSET] = {
 
         [ARSTR]         = 0x0000,
         [TSU_CTRST]     = 0x0004,
+        [TSU_FWSLC]     = 0x0038,
         [TSU_VTAG0]     = 0x0058,
         [TSU_ADSBSY]    = 0x0060,
         [TSU_TEN]       = 0x0064,
+        [TSU_POST1]     = 0x0070,
+        [TSU_POST2]     = 0x0074,
+        [TSU_POST3]     = 0x0078,
+        [TSU_POST4]     = 0x007c,
         [TSU_ADRH0]     = 0x0100,
 
         [TXNLCR0]       = 0x0080,
@@ -2786,6 +2791,8 @@ static void sh_eth_tsu_init(struct sh_eth_private *mdp)
 {
         if (sh_eth_is_rz_fast_ether(mdp)) {
                 sh_eth_tsu_write(mdp, 0, TSU_TEN); /* Disable all CAM entry */
+                sh_eth_tsu_write(mdp, TSU_FWSLC_POSTENU | TSU_FWSLC_POSTENL,
+                                 TSU_FWSLC);    /* Enable POST registers */
                 return;
         }
 
diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c
index f658fee74f18..e00a669e9e09 100644
--- a/drivers/net/ethernet/sfc/ef10.c
+++ b/drivers/net/ethernet/sfc/ef10.c
@@ -1517,13 +1517,14 @@ static void efx_ef10_get_stat_mask(struct efx_nic *efx, unsigned long *mask)
         }
 
 #if BITS_PER_LONG == 64
+        BUILD_BUG_ON(BITS_TO_LONGS(EF10_STAT_COUNT) != 2);
         mask[0] = raw_mask[0];
         mask[1] = raw_mask[1];
 #else
+        BUILD_BUG_ON(BITS_TO_LONGS(EF10_STAT_COUNT) != 3);
         mask[0] = raw_mask[0] & 0xffffffff;
         mask[1] = raw_mask[0] >> 32;
         mask[2] = raw_mask[1] & 0xffffffff;
-        mask[3] = raw_mask[1] >> 32;
 #endif
 }
 
diff --git a/drivers/net/ethernet/smsc/smc91x.c b/drivers/net/ethernet/smsc/smc91x.c
index 726b80f45906..503a3b6dce91 100644
--- a/drivers/net/ethernet/smsc/smc91x.c
+++ b/drivers/net/ethernet/smsc/smc91x.c
@@ -2275,6 +2275,13 @@ static int smc_drv_probe(struct platform_device *pdev)
         if (pd) {
                 memcpy(&lp->cfg, pd, sizeof(lp->cfg));
                 lp->io_shift = SMC91X_IO_SHIFT(lp->cfg.flags);
+
+                if (!SMC_8BIT(lp) && !SMC_16BIT(lp)) {
+                        dev_err(&pdev->dev,
+                                "at least one of 8-bit or 16-bit access support is required.\n");
+                        ret = -ENXIO;
+                        goto out_free_netdev;
+                }
         }
 
 #if IS_BUILTIN(CONFIG_OF)
diff --git a/drivers/net/ethernet/smsc/smc91x.h b/drivers/net/ethernet/smsc/smc91x.h
index 1a55c7976df0..ea8465467469 100644
--- a/drivers/net/ethernet/smsc/smc91x.h
+++ b/drivers/net/ethernet/smsc/smc91x.h
@@ -37,6 +37,27 @@
 #include <linux/smc91x.h>
 
 /*
+ * Any 16-bit access is performed with two 8-bit accesses if the hardware
+ * can't do it directly. Most registers are 16-bit so those are mandatory.
+ */
+#define SMC_outw_b(x, a, r)                                             \
+        do {                                                            \
+                unsigned int __val16 = (x);                             \
+                unsigned int __reg = (r);                               \
+                SMC_outb(__val16, a, __reg);                            \
+                SMC_outb(__val16 >> 8, a, __reg + (1 << SMC_IO_SHIFT)); \
+        } while (0)
+
+#define SMC_inw_b(a, r)                                                 \
+        ({                                                              \
+                unsigned int __val16;                                   \
+                unsigned int __reg = r;                                 \
+                __val16  = SMC_inb(a, __reg);                           \
+                __val16 |= SMC_inb(a, __reg + (1 << SMC_IO_SHIFT)) << 8; \
+                __val16;                                                \
+        })
+
+/*
  * Define your architecture specific bus configuration parameters here.
  */
 
@@ -55,10 +76,30 @@
 #define SMC_IO_SHIFT            (lp->io_shift)
 
 #define SMC_inb(a, r)           readb((a) + (r))
-#define SMC_inw(a, r)           readw((a) + (r))
+#define SMC_inw(a, r)                                                   \
+        ({                                                              \
+                unsigned int __smc_r = r;                               \
+                SMC_16BIT(lp) ? readw((a) + __smc_r) :                  \
+                SMC_8BIT(lp) ? SMC_inw_b(a, __smc_r) :                  \
+                ({ BUG(); 0; });                                        \
+        })
+
 #define SMC_inl(a, r)           readl((a) + (r))
 #define SMC_outb(v, a, r)       writeb(v, (a) + (r))
+#define SMC_outw(v, a, r)                                               \
+        do {                                                            \
+                unsigned int __v = v, __smc_r = r;                      \
+                if (SMC_16BIT(lp))                                      \
+                        __SMC_outw(__v, a, __smc_r);                    \
+                else if (SMC_8BIT(lp))                                  \
+                        SMC_outw_b(__v, a, __smc_r);                    \
+                else                                                    \
+                        BUG();                                          \
+        } while (0)
+
 #define SMC_outl(v, a, r)       writel(v, (a) + (r))
+#define SMC_insb(a, r, p, l)    readsb((a) + (r), p, l)
+#define SMC_outsb(a, r, p, l)   writesb((a) + (r), p, l)
 #define SMC_insw(a, r, p, l)    readsw((a) + (r), p, l)
 #define SMC_outsw(a, r, p, l)   writesw((a) + (r), p, l)
 #define SMC_insl(a, r, p, l)    readsl((a) + (r), p, l)
@@ -66,7 +107,7 @@
 #define SMC_IRQ_FLAGS           (-1)    /* from resource */
 
 /* We actually can't write halfwords properly if not word aligned */
-static inline void SMC_outw(u16 val, void __iomem *ioaddr, int reg)
+static inline void __SMC_outw(u16 val, void __iomem *ioaddr, int reg)
 {
         if ((machine_is_mainstone() || machine_is_stargate2() ||
              machine_is_pxa_idp()) && reg & 2) {
@@ -416,24 +457,8 @@ smc_pxa_dma_insw(void __iomem *ioaddr, struct smc_local *lp, int reg, int dma,
 
 #if ! SMC_CAN_USE_16BIT
 
-/*
- * Any 16-bit access is performed with two 8-bit accesses if the hardware
- * can't do it directly. Most registers are 16-bit so those are mandatory.
- */
-#define SMC_outw(x, ioaddr, reg)                                        \
-        do {                                                            \
-                unsigned int __val16 = (x);                             \
-                SMC_outb( __val16, ioaddr, reg );                       \
-                SMC_outb( __val16 >> 8, ioaddr, reg + (1 << SMC_IO_SHIFT));\
-        } while (0)
-#define SMC_inw(ioaddr, reg)                                            \
-        ({                                                              \
-                unsigned int __val16;                                   \
-                __val16 =  SMC_inb( ioaddr, reg );                      \
-                __val16 |= SMC_inb( ioaddr, reg + (1 << SMC_IO_SHIFT)) << 8; \
-                __val16;                                                \
-        })
-
+#define SMC_outw(x, ioaddr, reg)        SMC_outw_b(x, ioaddr, reg)
+#define SMC_inw(ioaddr, reg)            SMC_inw_b(ioaddr, reg)
 #define SMC_insw(a, r, p, l)            BUG()
 #define SMC_outsw(a, r, p, l)           BUG()
 
@@ -445,7 +470,9 @@ smc_pxa_dma_insw(void __iomem *ioaddr, struct smc_local *lp, int reg, int dma,
 #endif
 
 #if ! SMC_CAN_USE_8BIT
+#undef SMC_inb
 #define SMC_inb(ioaddr, reg)            ({ BUG(); 0; })
+#undef SMC_outb
 #define SMC_outb(x, ioaddr, reg)        BUG()
 #define SMC_insb(a, r, p, l)            BUG()
 #define SMC_outsb(a, r, p, l)           BUG()
diff --git a/drivers/net/ethernet/smsc/smsc911x.c b/drivers/net/ethernet/smsc/smsc911x.c
index ca3134540d2d..4f8910b7db2e 100644
--- a/drivers/net/ethernet/smsc/smsc911x.c
+++ b/drivers/net/ethernet/smsc/smsc911x.c
@@ -1099,15 +1099,8 @@ static int smsc911x_mii_init(struct platform_device *pdev,
                 goto err_out_free_bus_2;
         }
 
-        if (smsc911x_mii_probe(dev) < 0) {
-                SMSC_WARN(pdata, probe, "Error registering mii bus");
-                goto err_out_unregister_bus_3;
-        }
-
         return 0;
 
-err_out_unregister_bus_3:
-        mdiobus_unregister(pdata->mii_bus);
 err_out_free_bus_2:
         mdiobus_free(pdata->mii_bus);
 err_out_1:
@@ -1514,23 +1507,90 @@ static void smsc911x_disable_irq_chip(struct net_device *dev)
         smsc911x_reg_write(pdata, INT_STS, 0xFFFFFFFF);
 }
 
+static irqreturn_t smsc911x_irqhandler(int irq, void *dev_id)
+{
+        struct net_device *dev = dev_id;
+        struct smsc911x_data *pdata = netdev_priv(dev);
+        u32 intsts = smsc911x_reg_read(pdata, INT_STS);
+        u32 inten = smsc911x_reg_read(pdata, INT_EN);
+        int serviced = IRQ_NONE;
+        u32 temp;
+
+        if (unlikely(intsts & inten & INT_STS_SW_INT_)) {
+                temp = smsc911x_reg_read(pdata, INT_EN);
+                temp &= (~INT_EN_SW_INT_EN_);
+                smsc911x_reg_write(pdata, INT_EN, temp);
+                smsc911x_reg_write(pdata, INT_STS, INT_STS_SW_INT_);
+                pdata->software_irq_signal = 1;
+                smp_wmb();
+                serviced = IRQ_HANDLED;
+        }
+
+        if (unlikely(intsts & inten & INT_STS_RXSTOP_INT_)) {
+                /* Called when there is a multicast update scheduled and
+                 * it is now safe to complete the update */
+                SMSC_TRACE(pdata, intr, "RX Stop interrupt");
+                smsc911x_reg_write(pdata, INT_STS, INT_STS_RXSTOP_INT_);
+                if (pdata->multicast_update_pending)
+                        smsc911x_rx_multicast_update_workaround(pdata);
+                serviced = IRQ_HANDLED;
+        }
+
+        if (intsts & inten & INT_STS_TDFA_) {
+                temp = smsc911x_reg_read(pdata, FIFO_INT);
+                temp |= FIFO_INT_TX_AVAIL_LEVEL_;
+                smsc911x_reg_write(pdata, FIFO_INT, temp);
+                smsc911x_reg_write(pdata, INT_STS, INT_STS_TDFA_);
+                netif_wake_queue(dev);
+                serviced = IRQ_HANDLED;
+        }
+
+        if (unlikely(intsts & inten & INT_STS_RXE_)) {
+                SMSC_TRACE(pdata, intr, "RX Error interrupt");
+                smsc911x_reg_write(pdata, INT_STS, INT_STS_RXE_);
+                serviced = IRQ_HANDLED;
+        }
+
+        if (likely(intsts & inten & INT_STS_RSFL_)) {
+                if (likely(napi_schedule_prep(&pdata->napi))) {
+                        /* Disable Rx interrupts */
+                        temp = smsc911x_reg_read(pdata, INT_EN);
+                        temp &= (~INT_EN_RSFL_EN_);
+                        smsc911x_reg_write(pdata, INT_EN, temp);
+                        /* Schedule a NAPI poll */
+                        __napi_schedule(&pdata->napi);
+                } else {
+                        SMSC_WARN(pdata, rx_err, "napi_schedule_prep failed");
+                }
+                serviced = IRQ_HANDLED;
+        }
+
+        return serviced;
+}
+
 static int smsc911x_open(struct net_device *dev)
 {
         struct smsc911x_data *pdata = netdev_priv(dev);
         unsigned int timeout;
         unsigned int temp;
         unsigned int intcfg;
+        int retval;
+        int irq_flags;
 
-        /* if the phy is not yet registered, retry later*/
+        /* find and start the given phy */
         if (!dev->phydev) {
-                SMSC_WARN(pdata, hw, "phy_dev is NULL");
-                return -EAGAIN;
+                retval = smsc911x_mii_probe(dev);
+                if (retval < 0) {
+                        SMSC_WARN(pdata, probe, "Error starting phy");
+                        goto out;
+                }
         }
 
         /* Reset the LAN911x */
-        if (smsc911x_soft_reset(pdata)) {
+        retval = smsc911x_soft_reset(pdata);
+        if (retval) {
                 SMSC_WARN(pdata, hw, "soft reset failed");
-                return -EIO;
+                goto mii_free_out;
         }
 
         smsc911x_reg_write(pdata, HW_CFG, 0x00050000);
@@ -1586,6 +1646,15 @@ static int smsc911x_open(struct net_device *dev)
         pdata->software_irq_signal = 0;
         smp_wmb();
 
+        irq_flags = irq_get_trigger_type(dev->irq);
+        retval = request_irq(dev->irq, smsc911x_irqhandler,
+                             irq_flags | IRQF_SHARED, dev->name, dev);
+        if (retval) {
+                SMSC_WARN(pdata, probe,
+                          "Unable to claim requested irq: %d", dev->irq);
+                goto mii_free_out;
+        }
+
         temp = smsc911x_reg_read(pdata, INT_EN);
         temp |= INT_EN_SW_INT_EN_;
         smsc911x_reg_write(pdata, INT_EN, temp);
@@ -1600,7 +1669,8 @@ static int smsc911x_open(struct net_device *dev)
         if (!pdata->software_irq_signal) {
                 netdev_warn(dev, "ISR failed signaling test (IRQ %d)\n",
                             dev->irq);
-                return -ENODEV;
+                retval = -ENODEV;
+                goto irq_stop_out;
         }
         SMSC_TRACE(pdata, ifup, "IRQ handler passed test using IRQ %d",
                    dev->irq);
@@ -1646,6 +1716,14 @@ static int smsc911x_open(struct net_device *dev)
 
         netif_start_queue(dev);
         return 0;
+
+irq_stop_out:
+        free_irq(dev->irq, dev);
+mii_free_out:
+        phy_disconnect(dev->phydev);
+        dev->phydev = NULL;
+out:
+        return retval;
 }
 
 /* Entry point for stopping the interface */
@@ -1667,9 +1745,15 @@ static int smsc911x_stop(struct net_device *dev)
         dev->stats.rx_dropped += smsc911x_reg_read(pdata, RX_DROP);
         smsc911x_tx_update_txcounters(dev);
 
+        free_irq(dev->irq, dev);
+
         /* Bring the PHY down */
-        if (dev->phydev)
+        if (dev->phydev) {
                 phy_stop(dev->phydev);
+                phy_disconnect(dev->phydev);
+                dev->phydev = NULL;
+        }
+        netif_carrier_off(dev);
 
         SMSC_TRACE(pdata, ifdown, "Interface stopped");
         return 0;
@@ -1811,67 +1895,6 @@ static void smsc911x_set_multicast_list(struct net_device *dev)
         spin_unlock_irqrestore(&pdata->mac_lock, flags);
 }
 
-static irqreturn_t smsc911x_irqhandler(int irq, void *dev_id)
-{
-        struct net_device *dev = dev_id;
-        struct smsc911x_data *pdata = netdev_priv(dev);
-        u32 intsts = smsc911x_reg_read(pdata, INT_STS);
-        u32 inten = smsc911x_reg_read(pdata, INT_EN);
-        int serviced = IRQ_NONE;
-        u32 temp;
-
-        if (unlikely(intsts & inten & INT_STS_SW_INT_)) {
-                temp = smsc911x_reg_read(pdata, INT_EN);
-                temp &= (~INT_EN_SW_INT_EN_);
-                smsc911x_reg_write(pdata, INT_EN, temp);
-                smsc911x_reg_write(pdata, INT_STS, INT_STS_SW_INT_);
-                pdata->software_irq_signal = 1;
-                smp_wmb();
-                serviced = IRQ_HANDLED;
-        }
-
-        if (unlikely(intsts & inten & INT_STS_RXSTOP_INT_)) {
-                /* Called when there is a multicast update scheduled and
-                 * it is now safe to complete the update */
-                SMSC_TRACE(pdata, intr, "RX Stop interrupt");
-                smsc911x_reg_write(pdata, INT_STS, INT_STS_RXSTOP_INT_);
-                if (pdata->multicast_update_pending)
-                        smsc911x_rx_multicast_update_workaround(pdata);
-                serviced = IRQ_HANDLED;
-        }
-
-        if (intsts & inten & INT_STS_TDFA_) {
-                temp = smsc911x_reg_read(pdata, FIFO_INT);
-                temp |= FIFO_INT_TX_AVAIL_LEVEL_;
-                smsc911x_reg_write(pdata, FIFO_INT, temp);
-                smsc911x_reg_write(pdata, INT_STS, INT_STS_TDFA_);
-                netif_wake_queue(dev);
-                serviced = IRQ_HANDLED;
-        }
-
-        if (unlikely(intsts & inten & INT_STS_RXE_)) {
-                SMSC_TRACE(pdata, intr, "RX Error interrupt");
-                smsc911x_reg_write(pdata, INT_STS, INT_STS_RXE_);
-                serviced = IRQ_HANDLED;
-        }
-
-        if (likely(intsts & inten & INT_STS_RSFL_)) {
-                if (likely(napi_schedule_prep(&pdata->napi))) {
-                        /* Disable Rx interrupts */
-                        temp = smsc911x_reg_read(pdata, INT_EN);
-                        temp &= (~INT_EN_RSFL_EN_);
-                        smsc911x_reg_write(pdata, INT_EN, temp);
-                        /* Schedule a NAPI poll */
-                        __napi_schedule(&pdata->napi);
-                } else {
-                        SMSC_WARN(pdata, rx_err, "napi_schedule_prep failed");
-                }
-                serviced = IRQ_HANDLED;
-        }
-
-        return serviced;
-}
-
 #ifdef CONFIG_NET_POLL_CONTROLLER
 static void smsc911x_poll_controller(struct net_device *dev)
 {
@@ -2291,16 +2314,14 @@ static int smsc911x_drv_remove(struct platform_device *pdev)
         pdata = netdev_priv(dev);
         BUG_ON(!pdata);
         BUG_ON(!pdata->ioaddr);
-        BUG_ON(!dev->phydev);
+        WARN_ON(dev->phydev);
 
         SMSC_TRACE(pdata, ifdown, "Stopping driver");
 
-        phy_disconnect(dev->phydev);
         mdiobus_unregister(pdata->mii_bus);
         mdiobus_free(pdata->mii_bus);
 
         unregister_netdev(dev);
-        free_irq(dev->irq, dev);
         res = platform_get_resource_byname(pdev, IORESOURCE_MEM,
                                            "smsc911x-memory");
         if (!res)
@@ -2385,8 +2406,7 @@ static int smsc911x_drv_probe(struct platform_device *pdev)
         struct smsc911x_data *pdata;
         struct smsc911x_platform_config *config = dev_get_platdata(&pdev->dev);
         struct resource *res;
-        unsigned int intcfg = 0;
-        int res_size, irq, irq_flags;
+        int res_size, irq;
         int retval;
 
         res = platform_get_resource_byname(pdev, IORESOURCE_MEM,
@@ -2425,7 +2445,6 @@ static int smsc911x_drv_probe(struct platform_device *pdev)
 
         pdata = netdev_priv(dev);
         dev->irq = irq;
-        irq_flags = irq_get_trigger_type(irq);
         pdata->ioaddr = ioremap_nocache(res->start, res_size);
 
         pdata->dev = dev;
@@ -2472,43 +2491,23 @@ static int smsc911x_drv_probe(struct platform_device *pdev)
         if (retval < 0)
                 goto out_disable_resources;
 
-        /* configure irq polarity and type before connecting isr */
-        if (pdata->config.irq_polarity == SMSC911X_IRQ_POLARITY_ACTIVE_HIGH)
-                intcfg |= INT_CFG_IRQ_POL_;
-
-        if (pdata->config.irq_type == SMSC911X_IRQ_TYPE_PUSH_PULL)
-                intcfg |= INT_CFG_IRQ_TYPE_;
-
-        smsc911x_reg_write(pdata, INT_CFG, intcfg);
-
-        /* Ensure interrupts are globally disabled before connecting ISR */
-        smsc911x_disable_irq_chip(dev);
+        netif_carrier_off(dev);
 
-        retval = request_irq(dev->irq, smsc911x_irqhandler,
-                             irq_flags | IRQF_SHARED, dev->name, dev);
+        retval = smsc911x_mii_init(pdev, dev);
         if (retval) {
-                SMSC_WARN(pdata, probe,
-                          "Unable to claim requested irq: %d", dev->irq);
+                SMSC_WARN(pdata, probe, "Error %i initialising mii", retval);
                 goto out_disable_resources;
         }
 
-        netif_carrier_off(dev);
-
         retval = register_netdev(dev);
         if (retval) {
                 SMSC_WARN(pdata, probe, "Error %i registering device", retval);
-                goto out_free_irq;
+                goto out_disable_resources;
         } else {
                 SMSC_TRACE(pdata, probe,
                            "Network interface: \"%s\"", dev->name);
         }
 
-        retval = smsc911x_mii_init(pdev, dev);
-        if (retval) {
-                SMSC_WARN(pdata, probe, "Error %i initialising mii", retval);
-                goto out_unregister_netdev_5;
-        }
-
         spin_lock_irq(&pdata->mac_lock);
 
         /* Check if mac address has been specified when bringing interface up */
@@ -2544,10 +2543,6 @@ static int smsc911x_drv_probe(struct platform_device *pdev)
 
         return 0;
 
-out_unregister_netdev_5:
-        unregister_netdev(dev);
-out_free_irq:
-        free_irq(dev->irq, dev);
 out_disable_resources:
         pm_runtime_put(&pdev->dev);
         pm_runtime_disable(&pdev->dev);
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c b/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c
index cbefe9e2207c..885a5e64519d 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c
@@ -261,7 +261,7 @@ static void dwmac1000_pmt(struct mac_device_info *hw, unsigned long mode)
         }
         if (mode & WAKE_UCAST) {
                 pr_debug("GMAC: WOL on global unicast\n");
-                pmt |= global_unicast;
+                pmt |= power_down | global_unicast | wake_up_frame_en;
         }
 
         writel(pmt, ioaddr + GMAC_PMT);
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
index df5580dcdfed..51019b794be5 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
@@ -102,7 +102,7 @@ static void dwmac4_pmt(struct mac_device_info *hw, unsigned long mode)
         }
         if (mode & WAKE_UCAST) {
                 pr_debug("GMAC: WOL on global unicast\n");
-                pmt |= global_unicast;
+                pmt |= power_down | global_unicast | wake_up_frame_en;
         }
 
         writel(pmt, ioaddr + GMAC_PMT);
diff --git a/drivers/net/ethernet/synopsys/dwc_eth_qos.c b/drivers/net/ethernet/synopsys/dwc_eth_qos.c
index 9f159a775af3..4490ebaed127 100644
--- a/drivers/net/ethernet/synopsys/dwc_eth_qos.c
+++ b/drivers/net/ethernet/synopsys/dwc_eth_qos.c
@@ -1246,7 +1246,7 @@ static int dwceqos_mii_init(struct net_local *lp)
         lp->mii_bus->read  = &dwceqos_mdio_read;
         lp->mii_bus->write = &dwceqos_mdio_write;
         lp->mii_bus->priv = lp;
-        lp->mii_bus->parent = &lp->ndev->dev;
+        lp->mii_bus->parent = &lp->pdev->dev;
 
         of_address_to_resource(lp->pdev->dev.of_node, 0, &res);
         snprintf(lp->mii_bus->id, MII_BUS_ID_SIZE, "%.8llx",
@@ -1622,13 +1622,7 @@ static void dwceqos_init_hw(struct net_local *lp)
                 DWCEQOS_MMC_CTRL_RSTONRD);
         dwceqos_enable_mmc_interrupt(lp);
 
-        /* Enable Interrupts */
-        dwceqos_write(lp, REG_DWCEQOS_DMA_CH0_IE,
-                      DWCEQOS_DMA_CH0_IE_NIE |
-                      DWCEQOS_DMA_CH0_IE_RIE | DWCEQOS_DMA_CH0_IE_TIE |
-                      DWCEQOS_DMA_CH0_IE_AIE |
-                      DWCEQOS_DMA_CH0_IE_FBEE);
-
+        dwceqos_write(lp, REG_DWCEQOS_DMA_CH0_IE, 0);
         dwceqos_write(lp, REG_DWCEQOS_MAC_IE, 0);
 
         dwceqos_write(lp, REG_DWCEQOS_MAC_CFG, DWCEQOS_MAC_CFG_IPC |
@@ -1905,6 +1899,15 @@ static int dwceqos_open(struct net_device *ndev)
         netif_start_queue(ndev);
         tasklet_enable(&lp->tx_bdreclaim_tasklet);
 
+        /* Enable Interrupts -- do this only after we enable NAPI and the
+         * tasklet.
+         */
+        dwceqos_write(lp, REG_DWCEQOS_DMA_CH0_IE,
+                      DWCEQOS_DMA_CH0_IE_NIE |
+                      DWCEQOS_DMA_CH0_IE_RIE | DWCEQOS_DMA_CH0_IE_TIE |
+                      DWCEQOS_DMA_CH0_IE_AIE |
+                      DWCEQOS_DMA_CH0_IE_FBEE);
+
         return 0;
 }
 
@@ -2850,25 +2853,17 @@ static int dwceqos_probe(struct platform_device *pdev)
 
         ndev->features = ndev->hw_features;
 
-        netif_napi_add(ndev, &lp->napi, dwceqos_rx_poll, NAPI_POLL_WEIGHT);
-
-        ret = register_netdev(ndev);
-        if (ret) {
-                dev_err(&pdev->dev, "Cannot register net device, aborting.\n");
-                goto err_out_clk_dis_aper;
-        }
-
         lp->phy_ref_clk = devm_clk_get(&pdev->dev, "phy_ref_clk");
         if (IS_ERR(lp->phy_ref_clk)) {
                 dev_err(&pdev->dev, "phy_ref_clk clock not found.\n");
                 ret = PTR_ERR(lp->phy_ref_clk);
-                goto err_out_unregister_netdev;
+                goto err_out_clk_dis_aper;
         }
 
         ret = clk_prepare_enable(lp->phy_ref_clk);
         if (ret) {
                 dev_err(&pdev->dev, "Unable to enable device clock.\n");
-                goto err_out_unregister_netdev;
+                goto err_out_clk_dis_aper;
         }
 
         lp->phy_node = of_parse_phandle(lp->pdev->dev.of_node,
@@ -2877,7 +2872,7 @@ static int dwceqos_probe(struct platform_device *pdev)
                 ret = of_phy_register_fixed_link(lp->pdev->dev.of_node);
                 if (ret < 0) {
                         dev_err(&pdev->dev, "invalid fixed-link");
-                        goto err_out_unregister_clk_notifier;
+                        goto err_out_clk_dis_phy;
                 }
 
                 lp->phy_node = of_node_get(lp->pdev->dev.of_node);
@@ -2886,7 +2881,7 @@ static int dwceqos_probe(struct platform_device *pdev)
         ret = of_get_phy_mode(lp->pdev->dev.of_node);
         if (ret < 0) {
                 dev_err(&lp->pdev->dev, "error in getting phy i/f\n");
-                goto err_out_unregister_clk_notifier;
+                goto err_out_clk_dis_phy;
         }
 
         lp->phy_interface = ret;
@@ -2894,14 +2889,14 @@ static int dwceqos_probe(struct platform_device *pdev)
         ret = dwceqos_mii_init(lp);
         if (ret) {
                 dev_err(&lp->pdev->dev, "error in dwceqos_mii_init\n");
-                goto err_out_unregister_clk_notifier;
+                goto err_out_clk_dis_phy;
         }
 
         ret = dwceqos_mii_probe(ndev);
         if (ret != 0) {
                 netdev_err(ndev, "mii_probe fail.\n");
                 ret = -ENXIO;
-                goto err_out_unregister_clk_notifier;
+                goto err_out_clk_dis_phy;
         }
 
         dwceqos_set_umac_addr(lp, lp->ndev->dev_addr, 0);
@@ -2919,7 +2914,7 @@ static int dwceqos_probe(struct platform_device *pdev)
         if (ret) {
                 dev_err(&lp->pdev->dev, "Unable to retrieve DT, error %d\n",
                         ret);
-                goto err_out_unregister_clk_notifier;
+                goto err_out_clk_dis_phy;
         }
         dev_info(&lp->pdev->dev, "pdev->id %d, baseaddr 0x%08lx, irq %d\n",
                  pdev->id, ndev->base_addr, ndev->irq);
@@ -2929,18 +2924,24 @@ static int dwceqos_probe(struct platform_device *pdev)
         if (ret) {
                 dev_err(&lp->pdev->dev, "Unable to request IRQ %d, error %d\n",
                         ndev->irq, ret);
-                goto err_out_unregister_clk_notifier;
+                goto err_out_clk_dis_phy;
         }
 
         if (netif_msg_probe(lp))
                 netdev_dbg(ndev, "net_local@%p\n", lp);
 
+        netif_napi_add(ndev, &lp->napi, dwceqos_rx_poll, NAPI_POLL_WEIGHT);
+
+        ret = register_netdev(ndev);
+        if (ret) {
+                dev_err(&pdev->dev, "Cannot register net device, aborting.\n");
+                        goto err_out_clk_dis_phy;
+        }
+
         return 0;
 
-err_out_unregister_clk_notifier:
+err_out_clk_dis_phy:
         clk_disable_unprepare(lp->phy_ref_clk);
-err_out_unregister_netdev:
-        unregister_netdev(ndev);
 err_out_clk_dis_aper:
         clk_disable_unprepare(lp->apb_pclk);
 err_out_free_netdev:
diff --git a/drivers/net/ethernet/tehuti/tehuti.c b/drivers/net/ethernet/tehuti/tehuti.c
index 7452b5f9d024..7108c68f16d3 100644
--- a/drivers/net/ethernet/tehuti/tehuti.c
+++ b/drivers/net/ethernet/tehuti/tehuti.c
@@ -1987,7 +1987,7 @@ bdx_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         if ((readl(nic->regs + FPGA_VER) & 0xFFF) >= 378) {
                 err = pci_enable_msi(pdev);
                 if (err)
-                        pr_err("Can't eneble msi. error is %d\n", err);
+                        pr_err("Can't enable msi. error is %d\n", err);
                 else
                         nic->irq_type = IRQ_MSI;
         } else
diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
index c51f34693eae..f85d605e4560 100644
--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -734,6 +734,7 @@ static void cpsw_rx_handler(void *token, int len, int status)
                 netif_receive_skb(skb);
                 ndev->stats.rx_bytes += len;
                 ndev->stats.rx_packets++;
+                kmemleak_not_leak(new_skb);
         } else {
                 ndev->stats.rx_dropped++;
                 new_skb = skb;
@@ -1325,6 +1326,7 @@ static int cpsw_ndo_open(struct net_device *ndev)
                                 kfree_skb(skb);
                                 goto err_cleanup;
                         }
+                        kmemleak_not_leak(skb);
                 }
                 /* continue even if we didn't manage to submit all
                  * receive descs
diff --git a/drivers/net/ethernet/tundra/tsi108_eth.c b/drivers/net/ethernet/tundra/tsi108_eth.c
index 01a77145a0fa..8fd131207ee1 100644
--- a/drivers/net/ethernet/tundra/tsi108_eth.c
+++ b/drivers/net/ethernet/tundra/tsi108_eth.c
@@ -166,6 +166,7 @@ static struct platform_driver tsi_eth_driver = {
 
 static void tsi108_timed_checker(unsigned long dev_ptr);
 
+#ifdef DEBUG
 static void dump_eth_one(struct net_device *dev)
 {
         struct tsi108_prv_data *data = netdev_priv(dev);
@@ -190,6 +191,7 @@ static void dump_eth_one(struct net_device *dev)
                TSI_READ(TSI108_EC_RXESTAT),
                TSI_READ(TSI108_EC_RXERR), data->rxpending);
 }
+#endif
 
 /* Synchronization is needed between the thread and up/down events.
  * Note that the PHY is accessed through the same registers for both
diff --git a/drivers/net/ethernet/xilinx/xilinx_emaclite.c b/drivers/net/ethernet/xilinx/xilinx_emaclite.c
index 3cee84a24815..93dc10b10c09 100644
--- a/drivers/net/ethernet/xilinx/xilinx_emaclite.c
+++ b/drivers/net/ethernet/xilinx/xilinx_emaclite.c
@@ -1131,11 +1131,13 @@ static int xemaclite_of_probe(struct platform_device *ofdev)
         lp->rx_ping_pong = get_bool(ofdev, "xlnx,rx-ping-pong");
         mac_address = of_get_mac_address(ofdev->dev.of_node);
 
-        if (mac_address)
+        if (mac_address) {
                 /* Set the MAC address. */
                 memcpy(ndev->dev_addr, mac_address, ETH_ALEN);
-        else
-                dev_warn(dev, "No MAC address found\n");
+        } else {
+                dev_warn(dev, "No MAC address found, using random\n");
+                eth_hw_addr_random(ndev);
+        }
 
         /* Clear the Tx CSR's in case this is a restart */
         __raw_writel(0, lp->base_addr + XEL_TSR_OFFSET);
diff --git a/drivers/net/hyperv/hyperv_net.h b/drivers/net/hyperv/hyperv_net.h
index 467fb8b4d083..591af71eae56 100644
--- a/drivers/net/hyperv/hyperv_net.h
+++ b/drivers/net/hyperv/hyperv_net.h
@@ -644,12 +644,6 @@ struct netvsc_reconfig {
         u32 event;
 };
 
-struct garp_wrk {
-        struct work_struct dwrk;
-        struct net_device *netdev;
-        struct netvsc_device *netvsc_dev;
-};
-
 /* The context of the netvsc device  */
 struct net_device_context {
         /* point back to our device context */
@@ -667,7 +661,6 @@ struct net_device_context {
 
         struct work_struct work;
         u32 msg_enable; /* debug level */
-        struct garp_wrk gwrk;
 
         struct netvsc_stats __percpu *tx_stats;
         struct netvsc_stats __percpu *rx_stats;
@@ -678,6 +671,15 @@ struct net_device_context {
 
         /* the device is going away */
         bool start_remove;
+
+        /* State to manage the associated VF interface. */
+        struct net_device *vf_netdev;
+        bool vf_inject;
+        atomic_t vf_use_cnt;
+        /* 1: allocated, serial number is valid. 0: not allocated */
+        u32 vf_alloc;
+        /* Serial number of the VF to team with */
+        u32 vf_serial;
 };
 
 /* Per netvsc device */
@@ -733,15 +735,7 @@ struct netvsc_device {
         u32 max_pkt; /* max number of pkt in one send, e.g. 8 */
         u32 pkt_align; /* alignment bytes, e.g. 8 */
 
-        /* 1: allocated, serial number is valid. 0: not allocated */
-        u32 vf_alloc;
-        /* Serial number of the VF to team with */
-        u32 vf_serial;
         atomic_t open_cnt;
-        /* State to manage the associated VF interface. */
-        bool vf_inject;
-        struct net_device *vf_netdev;
-        atomic_t vf_use_cnt;
 };
 
 static inline struct netvsc_device *
diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c
index 20e09174ff62..410fb8e81376 100644
--- a/drivers/net/hyperv/netvsc.c
+++ b/drivers/net/hyperv/netvsc.c
@@ -77,13 +77,9 @@ static struct netvsc_device *alloc_net_device(void)
         init_waitqueue_head(&net_device->wait_drain);
         net_device->destroy = false;
         atomic_set(&net_device->open_cnt, 0);
-        atomic_set(&net_device->vf_use_cnt, 0);
         net_device->max_pkt = RNDIS_MAX_PKT_DEFAULT;
         net_device->pkt_align = RNDIS_PKT_ALIGN_DEFAULT;
 
-        net_device->vf_netdev = NULL;
-        net_device->vf_inject = false;
-
         return net_device;
 }
 
@@ -1106,16 +1102,16 @@ static void netvsc_send_table(struct hv_device *hdev,
                 nvscdev->send_table[i] = tab[i];
 }
 
-static void netvsc_send_vf(struct netvsc_device *nvdev,
+static void netvsc_send_vf(struct net_device_context *net_device_ctx,
                            struct nvsp_message *nvmsg)
 {
-        nvdev->vf_alloc = nvmsg->msg.v4_msg.vf_assoc.allocated;
-        nvdev->vf_serial = nvmsg->msg.v4_msg.vf_assoc.serial;
+        net_device_ctx->vf_alloc = nvmsg->msg.v4_msg.vf_assoc.allocated;
+        net_device_ctx->vf_serial = nvmsg->msg.v4_msg.vf_assoc.serial;
 }
 
 static inline void netvsc_receive_inband(struct hv_device *hdev,
-                                         struct netvsc_device *nvdev,
-                                         struct nvsp_message *nvmsg)
+                                 struct net_device_context *net_device_ctx,
+                                 struct nvsp_message *nvmsg)
 {
         switch (nvmsg->hdr.msg_type) {
         case NVSP_MSG5_TYPE_SEND_INDIRECTION_TABLE:
@@ -1123,7 +1119,7 @@ static inline void netvsc_receive_inband(struct hv_device *hdev,
                 break;
 
         case NVSP_MSG4_TYPE_SEND_VF_ASSOCIATION:
-                netvsc_send_vf(nvdev, nvmsg);
+                netvsc_send_vf(net_device_ctx, nvmsg);
                 break;
         }
 }
@@ -1136,6 +1132,7 @@ static void netvsc_process_raw_pkt(struct hv_device *device,
                                    struct vmpacket_descriptor *desc)
 {
         struct nvsp_message *nvmsg;
+        struct net_device_context *net_device_ctx = netdev_priv(ndev);
 
         nvmsg = (struct nvsp_message *)((unsigned long)
                 desc + (desc->offset8 << 3));
@@ -1150,7 +1147,7 @@ static void netvsc_process_raw_pkt(struct hv_device *device,
                 break;
 
         case VM_PKT_DATA_INBAND:
-                netvsc_receive_inband(device, net_device, nvmsg);
+                netvsc_receive_inband(device, net_device_ctx, nvmsg);
                 break;
 
         default:
diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index 41bd952cc28d..3ba29fc80d05 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -658,20 +658,19 @@ int netvsc_recv_callback(struct hv_device *device_obj,
         struct sk_buff *skb;
         struct sk_buff *vf_skb;
         struct netvsc_stats *rx_stats;
-        struct netvsc_device *netvsc_dev = net_device_ctx->nvdev;
         u32 bytes_recvd = packet->total_data_buflen;
         int ret = 0;
 
         if (!net || net->reg_state != NETREG_REGISTERED)
                 return NVSP_STAT_FAIL;
 
-        if (READ_ONCE(netvsc_dev->vf_inject)) {
-                atomic_inc(&netvsc_dev->vf_use_cnt);
-                if (!READ_ONCE(netvsc_dev->vf_inject)) {
+        if (READ_ONCE(net_device_ctx->vf_inject)) {
+                atomic_inc(&net_device_ctx->vf_use_cnt);
+                if (!READ_ONCE(net_device_ctx->vf_inject)) {
                         /*
                          * We raced; just move on.
                          */
-                        atomic_dec(&netvsc_dev->vf_use_cnt);
+                        atomic_dec(&net_device_ctx->vf_use_cnt);
                         goto vf_injection_done;
                 }
 
@@ -683,17 +682,19 @@ int netvsc_recv_callback(struct hv_device *device_obj,
                  * the host). Deliver these via the VF interface
                  * in the guest.
                  */
-                vf_skb = netvsc_alloc_recv_skb(netvsc_dev->vf_netdev, packet,
-                                               csum_info, *data, vlan_tci);
+                vf_skb = netvsc_alloc_recv_skb(net_device_ctx->vf_netdev,
+                                               packet, csum_info, *data,
+                                               vlan_tci);
                 if (vf_skb != NULL) {
-                        ++netvsc_dev->vf_netdev->stats.rx_packets;
-                        netvsc_dev->vf_netdev->stats.rx_bytes += bytes_recvd;
+                        ++net_device_ctx->vf_netdev->stats.rx_packets;
+                        net_device_ctx->vf_netdev->stats.rx_bytes +=
+                                bytes_recvd;
                         netif_receive_skb(vf_skb);
                 } else {
                         ++net->stats.rx_dropped;
                         ret = NVSP_STAT_FAIL;
                 }
-                atomic_dec(&netvsc_dev->vf_use_cnt);
+                atomic_dec(&net_device_ctx->vf_use_cnt);
                 return ret;
         }
 
@@ -1150,17 +1151,6 @@ static void netvsc_free_netdev(struct net_device *netdev)
         free_netdev(netdev);
 }
 
-static void netvsc_notify_peers(struct work_struct *wrk)
-{
-        struct garp_wrk *gwrk;
-
-        gwrk = container_of(wrk, struct garp_wrk, dwrk);
-
-        netdev_notify_peers(gwrk->netdev);
-
-        atomic_dec(&gwrk->netvsc_dev->vf_use_cnt);
-}
-
 static struct net_device *get_netvsc_net_device(char *mac)
 {
         struct net_device *dev, *found = NULL;
@@ -1203,7 +1193,7 @@ static int netvsc_register_vf(struct net_device *vf_netdev)
 
         net_device_ctx = netdev_priv(ndev);
         netvsc_dev = net_device_ctx->nvdev;
-        if (netvsc_dev == NULL)
+        if (!netvsc_dev || net_device_ctx->vf_netdev)
                 return NOTIFY_DONE;
 
         netdev_info(ndev, "VF registering: %s\n", vf_netdev->name);
@@ -1211,10 +1201,23 @@ static int netvsc_register_vf(struct net_device *vf_netdev)
          * Take a reference on the module.
          */
         try_module_get(THIS_MODULE);
-        netvsc_dev->vf_netdev = vf_netdev;
+        net_device_ctx->vf_netdev = vf_netdev;
         return NOTIFY_OK;
 }
 
+static void netvsc_inject_enable(struct net_device_context *net_device_ctx)
+{
+        net_device_ctx->vf_inject = true;
+}
+
+static void netvsc_inject_disable(struct net_device_context *net_device_ctx)
+{
+        net_device_ctx->vf_inject = false;
+
+        /* Wait for currently active users to drain out. */
+        while (atomic_read(&net_device_ctx->vf_use_cnt) != 0)
+                udelay(50);
+}
 
 static int netvsc_vf_up(struct net_device *vf_netdev)
 {
@@ -1233,11 +1236,11 @@ static int netvsc_vf_up(struct net_device *vf_netdev)
         net_device_ctx = netdev_priv(ndev);
         netvsc_dev = net_device_ctx->nvdev;
 
-        if ((netvsc_dev == NULL) || (netvsc_dev->vf_netdev == NULL))
+        if (!netvsc_dev || !net_device_ctx->vf_netdev)
                 return NOTIFY_DONE;
 
         netdev_info(ndev, "VF up: %s\n", vf_netdev->name);
-        netvsc_dev->vf_inject = true;
+        netvsc_inject_enable(net_device_ctx);
 
         /*
          * Open the device before switching data path.
@@ -1252,15 +1255,8 @@ static int netvsc_vf_up(struct net_device *vf_netdev)
 
         netif_carrier_off(ndev);
 
-        /*
-         * Now notify peers. We are scheduling work to
-         * notify peers; take a reference to prevent
-         * the VF interface from vanishing.
-         */
-        atomic_inc(&netvsc_dev->vf_use_cnt);
-        net_device_ctx->gwrk.netdev = vf_netdev;
-        net_device_ctx->gwrk.netvsc_dev = netvsc_dev;
-        schedule_work(&net_device_ctx->gwrk.dwrk);
+        /* Now notify peers through VF device. */
+        call_netdevice_notifiers(NETDEV_NOTIFY_PEERS, vf_netdev);
 
         return NOTIFY_OK;
 }
@@ -1283,29 +1279,18 @@ static int netvsc_vf_down(struct net_device *vf_netdev)
         net_device_ctx = netdev_priv(ndev);
         netvsc_dev = net_device_ctx->nvdev;
 
-        if ((netvsc_dev == NULL) || (netvsc_dev->vf_netdev == NULL))
+        if (!netvsc_dev || !net_device_ctx->vf_netdev)
                 return NOTIFY_DONE;
 
         netdev_info(ndev, "VF down: %s\n", vf_netdev->name);
-        netvsc_dev->vf_inject = false;
-        /*
-         * Wait for currently active users to
-         * drain out.
-         */
-
-        while (atomic_read(&netvsc_dev->vf_use_cnt) != 0)
-                udelay(50);
+        netvsc_inject_disable(net_device_ctx);
         netvsc_switch_datapath(ndev, false);
         netdev_info(ndev, "Data path switched from VF: %s\n", vf_netdev->name);
         rndis_filter_close(netvsc_dev);
         netif_carrier_on(ndev);
-        /*
-         * Notify peers.
-         */
-        atomic_inc(&netvsc_dev->vf_use_cnt);
-        net_device_ctx->gwrk.netdev = ndev;
-        net_device_ctx->gwrk.netvsc_dev = netvsc_dev;
-        schedule_work(&net_device_ctx->gwrk.dwrk);
+
+        /* Now notify peers through netvsc device. */
+        call_netdevice_notifiers(NETDEV_NOTIFY_PEERS, ndev);
 
         return NOTIFY_OK;
 }
@@ -1327,11 +1312,11 @@ static int netvsc_unregister_vf(struct net_device *vf_netdev)
 
         net_device_ctx = netdev_priv(ndev);
         netvsc_dev = net_device_ctx->nvdev;
-        if (netvsc_dev == NULL)
+        if (!netvsc_dev || !net_device_ctx->vf_netdev)
                 return NOTIFY_DONE;
         netdev_info(ndev, "VF unregistering: %s\n", vf_netdev->name);
-
-        netvsc_dev->vf_netdev = NULL;
+        netvsc_inject_disable(net_device_ctx);
+        net_device_ctx->vf_netdev = NULL;
         module_put(THIS_MODULE);
         return NOTIFY_OK;
 }
@@ -1377,11 +1362,14 @@ static int netvsc_probe(struct hv_device *dev,
 
         INIT_DELAYED_WORK(&net_device_ctx->dwork, netvsc_link_change);
         INIT_WORK(&net_device_ctx->work, do_set_multicast);
-        INIT_WORK(&net_device_ctx->gwrk.dwrk, netvsc_notify_peers);
 
         spin_lock_init(&net_device_ctx->lock);
         INIT_LIST_HEAD(&net_device_ctx->reconfig_events);
 
+        atomic_set(&net_device_ctx->vf_use_cnt, 0);
+        net_device_ctx->vf_netdev = NULL;
+        net_device_ctx->vf_inject = false;
+
         net->netdev_ops = &device_ops;
 
         net->hw_features = NETVSC_HW_FEATURES;
@@ -1494,8 +1482,13 @@ static int netvsc_netdev_event(struct notifier_block *this,
 {
         struct net_device *event_dev = netdev_notifier_info_to_dev(ptr);
 
-        /* Avoid Vlan, Bonding dev with same MAC registering as VF */
-        if (event_dev->priv_flags & (IFF_802_1Q_VLAN | IFF_BONDING))
+        /* Avoid Vlan dev with same MAC registering as VF */
+        if (event_dev->priv_flags & IFF_802_1Q_VLAN)
+                return NOTIFY_DONE;
+
+        /* Avoid Bonding master dev with same MAC registering as VF */
+        if (event_dev->priv_flags & IFF_BONDING &&
+            event_dev->flags & IFF_MASTER)
                 return NOTIFY_DONE;
 
         switch (event) {
diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c
index d13e6e15d7b5..351e701eb043 100644
--- a/drivers/net/macsec.c
+++ b/drivers/net/macsec.c
@@ -270,6 +270,7 @@ struct macsec_dev {
         struct pcpu_secy_stats __percpu *stats;
         struct list_head secys;
         struct gro_cells gro_cells;
+        unsigned int nest_level;
 };
 
 /**
@@ -2699,6 +2700,8 @@ static netdev_tx_t macsec_start_xmit(struct sk_buff *skb,
 
 #define MACSEC_FEATURES \
         (NETIF_F_SG | NETIF_F_HIGHDMA | NETIF_F_FRAGLIST)
+static struct lock_class_key macsec_netdev_addr_lock_key;
+
 static int macsec_dev_init(struct net_device *dev)
 {
         struct macsec_dev *macsec = macsec_priv(dev);
@@ -2910,6 +2913,13 @@ static int macsec_get_iflink(const struct net_device *dev)
         return macsec_priv(dev)->real_dev->ifindex;
 }
 
+
+static int macsec_get_nest_level(struct net_device *dev)
+{
+        return macsec_priv(dev)->nest_level;
+}
+
+
 static const struct net_device_ops macsec_netdev_ops = {
         .ndo_init               = macsec_dev_init,
         .ndo_uninit             = macsec_dev_uninit,
@@ -2923,6 +2933,7 @@ static const struct net_device_ops macsec_netdev_ops = {
         .ndo_start_xmit         = macsec_start_xmit,
         .ndo_get_stats64        = macsec_get_stats64,
         .ndo_get_iflink         = macsec_get_iflink,
+        .ndo_get_lock_subclass  = macsec_get_nest_level,
 };
 
 static const struct device_type macsec_type = {
@@ -3047,22 +3058,31 @@ static void macsec_del_dev(struct macsec_dev *macsec)
         }
 }
 
+static void macsec_common_dellink(struct net_device *dev, struct list_head *head)
+{
+        struct macsec_dev *macsec = macsec_priv(dev);
+        struct net_device *real_dev = macsec->real_dev;
+
+        unregister_netdevice_queue(dev, head);
+        list_del_rcu(&macsec->secys);
+        macsec_del_dev(macsec);
+        netdev_upper_dev_unlink(real_dev, dev);
+
+        macsec_generation++;
+}
+
 static void macsec_dellink(struct net_device *dev, struct list_head *head)
 {
         struct macsec_dev *macsec = macsec_priv(dev);
         struct net_device *real_dev = macsec->real_dev;
         struct macsec_rxh_data *rxd = macsec_data_rtnl(real_dev);
 
-        macsec_generation++;
+        macsec_common_dellink(dev, head);
 
-        unregister_netdevice_queue(dev, head);
-        list_del_rcu(&macsec->secys);
         if (list_empty(&rxd->secys)) {
                 netdev_rx_handler_unregister(real_dev);
                 kfree(rxd);
         }
-
-        macsec_del_dev(macsec);
 }
 
 static int register_macsec_dev(struct net_device *real_dev,
@@ -3181,6 +3201,16 @@ static int macsec_newlink(struct net *net, struct net_device *dev,
 
         dev_hold(real_dev);
 
+        macsec->nest_level = dev_get_nest_level(real_dev) + 1;
+        netdev_lockdep_set_classes(dev);
+        lockdep_set_class_and_subclass(&dev->addr_list_lock,
+                                       &macsec_netdev_addr_lock_key,
+                                       macsec_get_nest_level(dev));
+
+        err = netdev_upper_dev_link(real_dev, dev);
+        if (err < 0)
+                goto unregister;
+
         /* need to be already registered so that ->init has run and
          * the MAC addr is set
          */
@@ -3193,12 +3223,12 @@ static int macsec_newlink(struct net *net, struct net_device *dev,
 
         if (rx_handler && sci_exists(real_dev, sci)) {
                 err = -EBUSY;
-                goto unregister;
+                goto unlink;
         }
 
         err = macsec_add_dev(dev, sci, icv_len);
         if (err)
-                goto unregister;
+                goto unlink;
 
         if (data)
                 macsec_changelink_common(dev, data);
@@ -3213,6 +3243,8 @@ static int macsec_newlink(struct net *net, struct net_device *dev,
 
 del_dev:
         macsec_del_dev(macsec);
+unlink:
+        netdev_upper_dev_unlink(real_dev, dev);
 unregister:
         unregister_netdevice(dev);
         return err;
@@ -3382,8 +3414,12 @@ static int macsec_notify(struct notifier_block *this, unsigned long event,
 
                 rxd = macsec_data_rtnl(real_dev);
                 list_for_each_entry_safe(m, n, &rxd->secys, secys) {
-                        macsec_dellink(m->secy.netdev, &head);
+                        macsec_common_dellink(m->secy.netdev, &head);
                 }
+
+                netdev_rx_handler_unregister(real_dev);
+                kfree(rxd);
+
                 unregister_netdevice_many(&head);
                 break;
         }
diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
index cd9b53834bf6..3234fcdea317 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -1315,7 +1315,7 @@ int macvlan_common_newlink(struct net *src_net, struct net_device *dev,
         vlan->dev      = dev;
         vlan->port     = port;
         vlan->set_features = MACVLAN_FEATURES;
-        vlan->nest_level = dev_get_nest_level(lowerdev, netif_is_macvlan) + 1;
+        vlan->nest_level = dev_get_nest_level(lowerdev) + 1;
 
         vlan->mode     = MACVLAN_MODE_VEPA;
         if (data && data[IFLA_MACVLAN_MODE])
diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
index a38c0dac514b..070e3290aa6e 100644
--- a/drivers/net/macvtap.c
+++ b/drivers/net/macvtap.c
@@ -275,7 +275,6 @@ static void macvtap_put_queue(struct macvtap_queue *q)
         rtnl_unlock();
 
         synchronize_rcu();
-        skb_array_cleanup(&q->skb_array);
         sock_put(&q->sk);
 }
 
@@ -533,10 +532,8 @@ static void macvtap_sock_write_space(struct sock *sk)
 static void macvtap_sock_destruct(struct sock *sk)
 {
         struct macvtap_queue *q = container_of(sk, struct macvtap_queue, sk);
-        struct sk_buff *skb;
 
-        while ((skb = skb_array_consume(&q->skb_array)) != NULL)
-                kfree_skb(skb);
+        skb_array_cleanup(&q->skb_array);
 }
 
 static int macvtap_open(struct inode *inode, struct file *file)
diff --git a/drivers/net/phy/Kconfig b/drivers/net/phy/Kconfig
index 47a64342cc16..b4863e4e522b 100644
--- a/drivers/net/phy/Kconfig
+++ b/drivers/net/phy/Kconfig
@@ -303,6 +303,7 @@ config MDIO_HISI_FEMAC
 
 config MDIO_XGENE
         tristate "APM X-Gene SoC MDIO bus controller"
+        depends on ARCH_XGENE || COMPILE_TEST
         help
           This module provides a driver for the MDIO busses found in the
           APM X-Gene SoC's.
diff --git a/drivers/net/phy/mdio-xgene.c b/drivers/net/phy/mdio-xgene.c
index 775674808249..92af182951be 100644
--- a/drivers/net/phy/mdio-xgene.c
+++ b/drivers/net/phy/mdio-xgene.c
@@ -424,10 +424,8 @@ static int xgene_mdio_remove(struct platform_device *pdev)
         mdiobus_unregister(mdio_bus);
         mdiobus_free(mdio_bus);
 
-        if (dev->of_node) {
-                if (IS_ERR(pdata->clk))
-                        clk_disable_unprepare(pdata->clk);
-        }
+        if (dev->of_node)
+                clk_disable_unprepare(pdata->clk);
 
         return 0;
 }
diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c
index 1882d9828c99..885ac9cbab5a 100644
--- a/drivers/net/phy/micrel.c
+++ b/drivers/net/phy/micrel.c
@@ -677,17 +677,28 @@ static void kszphy_get_stats(struct phy_device *phydev,
                 data[i] = kszphy_get_stat(phydev, i);
 }
 
-static int kszphy_resume(struct phy_device *phydev)
+static int kszphy_suspend(struct phy_device *phydev)
 {
-        int value;
+        /* Disable PHY Interrupts */
+        if (phy_interrupt_is_valid(phydev)) {
+                phydev->interrupts = PHY_INTERRUPT_DISABLED;
+                if (phydev->drv->config_intr)
+                        phydev->drv->config_intr(phydev);
+        }
 
-        mutex_lock(&phydev->lock);
+        return genphy_suspend(phydev);
+}
 
-        value = phy_read(phydev, MII_BMCR);
-        phy_write(phydev, MII_BMCR, value & ~BMCR_PDOWN);
+static int kszphy_resume(struct phy_device *phydev)
+{
+        genphy_resume(phydev);
 
-        kszphy_config_intr(phydev);
-        mutex_unlock(&phydev->lock);
+        /* Enable PHY Interrupts */
+        if (phy_interrupt_is_valid(phydev)) {
+                phydev->interrupts = PHY_INTERRUPT_ENABLED;
+                if (phydev->drv->config_intr)
+                        phydev->drv->config_intr(phydev);
+        }
 
         return 0;
 }
@@ -900,7 +911,7 @@ static struct phy_driver ksphy_driver[] = {
         .get_sset_count = kszphy_get_sset_count,
         .get_strings    = kszphy_get_strings,
         .get_stats      = kszphy_get_stats,
-        .suspend        = genphy_suspend,
+        .suspend        = kszphy_suspend,
         .resume         = kszphy_resume,
 }, {
         .phy_id         = PHY_ID_KSZ8061,
@@ -953,7 +964,7 @@ static struct phy_driver ksphy_driver[] = {
         .get_strings    = kszphy_get_strings,
         .get_stats      = kszphy_get_stats,
         .suspend        = genphy_suspend,
-        .resume         = genphy_resume,
+        .resume         = kszphy_resume,
 }, {
         .phy_id         = PHY_ID_KSZ8873MLL,
         .phy_id_mask    = MICREL_PHY_ID_MASK,
diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
index c5dc2c363f96..c6f66832a1a6 100644
--- a/drivers/net/phy/phy.c
+++ b/drivers/net/phy/phy.c
@@ -722,8 +722,10 @@ phy_err:
 int phy_start_interrupts(struct phy_device *phydev)
 {
         atomic_set(&phydev->irq_disable, 0);
-        if (request_irq(phydev->irq, phy_interrupt, 0, "phy_interrupt",
-                        phydev) < 0) {
+        if (request_irq(phydev->irq, phy_interrupt,
+                                IRQF_SHARED,
+                                "phy_interrupt",
+                                phydev) < 0) {
                 pr_warn("%s: Can't get IRQ %d (PHY)\n",
                         phydev->mdio.bus->name, phydev->irq);
                 phydev->irq = PHY_POLL;
diff --git a/drivers/net/team/team_mode_loadbalance.c b/drivers/net/team/team_mode_loadbalance.c
index cdb19b385d42..b228bea7931f 100644
--- a/drivers/net/team/team_mode_loadbalance.c
+++ b/drivers/net/team/team_mode_loadbalance.c
@@ -14,9 +14,23 @@
 #include <linux/init.h>
 #include <linux/errno.h>
 #include <linux/netdevice.h>
+#include <linux/etherdevice.h>
 #include <linux/filter.h>
 #include <linux/if_team.h>
 
+static rx_handler_result_t lb_receive(struct team *team, struct team_port *port,
+                                      struct sk_buff *skb)
+{
+        if (unlikely(skb->protocol == htons(ETH_P_SLOW))) {
+                /* LACPDU packets should go to exact delivery */
+                const unsigned char *dest = eth_hdr(skb)->h_dest;
+
+                if (is_link_local_ether_addr(dest) && dest[5] == 0x02)
+                        return RX_HANDLER_EXACT;
+        }
+        return RX_HANDLER_ANOTHER;
+}
+
 struct lb_priv;
 
 typedef struct team_port *lb_select_tx_port_func_t(struct team *,
@@ -652,6 +666,7 @@ static const struct team_mode_ops lb_mode_ops = {
         .port_enter             = lb_port_enter,
         .port_leave             = lb_port_leave,
         .port_disabled          = lb_port_disabled,
+        .receive                = lb_receive,
         .transmit               = lb_transmit,
 };
 
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 9c8b5bc2b9d8..6f9df375c5d4 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -894,11 +894,7 @@ static netdev_tx_t tun_net_xmit(struct sk_buff *skb, struct net_device *dev)
         if (unlikely(skb_orphan_frags(skb, GFP_ATOMIC)))
                 goto drop;
 
-        if (skb->sk && sk_fullsock(skb->sk)) {
-                sock_tx_timestamp(skb->sk, skb->sk->sk_tsflags,
-                                  &skb_shinfo(skb)->tx_flags);
-                sw_tx_timestamp(skb);
-        }
+        skb_tx_timestamp(skb);
 
         /* Orphan the skb - required as we might hang on to it
          * for indefinite time.
diff --git a/drivers/net/usb/kaweth.c b/drivers/net/usb/kaweth.c
index 770212baaf05..528b9c9c4e60 100644
--- a/drivers/net/usb/kaweth.c
+++ b/drivers/net/usb/kaweth.c
@@ -1009,6 +1009,7 @@ static int kaweth_probe(
         struct net_device *netdev;
         const eth_addr_t bcast_addr = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
         int result = 0;
+        int rv = -EIO;
 
         dev_dbg(dev,
                 "Kawasaki Device Probe (Device number:%d): 0x%4.4x:0x%4.4x:0x%4.4x\n",
@@ -1029,6 +1030,7 @@ static int kaweth_probe(
         kaweth = netdev_priv(netdev);
         kaweth->dev = udev;
         kaweth->net = netdev;
+        kaweth->intf = intf;
 
         spin_lock_init(&kaweth->device_lock);
         init_waitqueue_head(&kaweth->term_wait);
@@ -1048,6 +1050,10 @@ static int kaweth_probe(
                 /* Download the firmware */
                 dev_info(dev, "Downloading firmware...\n");
                 kaweth->firmware_buf = (__u8 *)__get_free_page(GFP_KERNEL);
+                if (!kaweth->firmware_buf) {
+                        rv = -ENOMEM;
+                        goto err_free_netdev;
+                }
                 if ((result = kaweth_download_firmware(kaweth,
                                                       "kaweth/new_code.bin",
                                                       100,
@@ -1139,8 +1145,6 @@ err_fw:
 
         dev_dbg(dev, "Initializing net device.\n");
 
-        kaweth->intf = intf;
-
         kaweth->tx_urb = usb_alloc_urb(0, GFP_KERNEL);
         if (!kaweth->tx_urb)
                 goto err_free_netdev;
@@ -1204,7 +1208,7 @@ err_only_tx:
 err_free_netdev:
         free_netdev(netdev);
 
-        return -EIO;
+        return rv;
 }
 
 /****************************************************************
diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index f41a8ad4740e..c254248863d4 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -32,7 +32,7 @@
 #define NETNEXT_VERSION         "08"
 
 /* Information for net */
-#define NET_VERSION             "5"
+#define NET_VERSION             "6"
 
 #define DRIVER_VERSION          "v1." NETNEXT_VERSION "." NET_VERSION
 #define DRIVER_AUTHOR "Realtek linux nic maintainers <nic_swsd@realtek.com>"
@@ -2552,6 +2552,77 @@ static void r8152_aldps_en(struct r8152 *tp, bool enable)
         }
 }
 
+static inline void r8152_mmd_indirect(struct r8152 *tp, u16 dev, u16 reg)
+{
+        ocp_reg_write(tp, OCP_EEE_AR, FUN_ADDR | dev);
+        ocp_reg_write(tp, OCP_EEE_DATA, reg);
+        ocp_reg_write(tp, OCP_EEE_AR, FUN_DATA | dev);
+}
+
+static u16 r8152_mmd_read(struct r8152 *tp, u16 dev, u16 reg)
+{
+        u16 data;
+
+        r8152_mmd_indirect(tp, dev, reg);
+        data = ocp_reg_read(tp, OCP_EEE_DATA);
+        ocp_reg_write(tp, OCP_EEE_AR, 0x0000);
+
+        return data;
+}
+
+static void r8152_mmd_write(struct r8152 *tp, u16 dev, u16 reg, u16 data)
+{
+        r8152_mmd_indirect(tp, dev, reg);
+        ocp_reg_write(tp, OCP_EEE_DATA, data);
+        ocp_reg_write(tp, OCP_EEE_AR, 0x0000);
+}
+
+static void r8152_eee_en(struct r8152 *tp, bool enable)
+{
+        u16 config1, config2, config3;
+        u32 ocp_data;
+
+        ocp_data = ocp_read_word(tp, MCU_TYPE_PLA, PLA_EEE_CR);
+        config1 = ocp_reg_read(tp, OCP_EEE_CONFIG1) & ~sd_rise_time_mask;
+        config2 = ocp_reg_read(tp, OCP_EEE_CONFIG2);
+        config3 = ocp_reg_read(tp, OCP_EEE_CONFIG3) & ~fast_snr_mask;
+
+        if (enable) {
+                ocp_data |= EEE_RX_EN | EEE_TX_EN;
+                config1 |= EEE_10_CAP | EEE_NWAY_EN | TX_QUIET_EN | RX_QUIET_EN;
+                config1 |= sd_rise_time(1);
+                config2 |= RG_DACQUIET_EN | RG_LDVQUIET_EN;
+                config3 |= fast_snr(42);
+        } else {
+                ocp_data &= ~(EEE_RX_EN | EEE_TX_EN);
+                config1 &= ~(EEE_10_CAP | EEE_NWAY_EN | TX_QUIET_EN |
+                             RX_QUIET_EN);
+                config1 |= sd_rise_time(7);
+                config2 &= ~(RG_DACQUIET_EN | RG_LDVQUIET_EN);
+                config3 |= fast_snr(511);
+        }
+
+        ocp_write_word(tp, MCU_TYPE_PLA, PLA_EEE_CR, ocp_data);
+        ocp_reg_write(tp, OCP_EEE_CONFIG1, config1);
+        ocp_reg_write(tp, OCP_EEE_CONFIG2, config2);
+        ocp_reg_write(tp, OCP_EEE_CONFIG3, config3);
+}
+
+static void r8152b_enable_eee(struct r8152 *tp)
+{
+        r8152_eee_en(tp, true);
+        r8152_mmd_write(tp, MDIO_MMD_AN, MDIO_AN_EEE_ADV, MDIO_EEE_100TX);
+}
+
+static void r8152b_enable_fc(struct r8152 *tp)
+{
+        u16 anar;
+
+        anar = r8152_mdio_read(tp, MII_ADVERTISE);
+        anar |= ADVERTISE_PAUSE_CAP | ADVERTISE_PAUSE_ASYM;
+        r8152_mdio_write(tp, MII_ADVERTISE, anar);
+}
+
 static void rtl8152_disable(struct r8152 *tp)
 {
         r8152_aldps_en(tp, false);
@@ -2561,13 +2632,9 @@ static void rtl8152_disable(struct r8152 *tp)
 
 static void r8152b_hw_phy_cfg(struct r8152 *tp)
 {
-        u16 data;
-
-        data = r8152_mdio_read(tp, MII_BMCR);
-        if (data & BMCR_PDOWN) {
-                data &= ~BMCR_PDOWN;
-                r8152_mdio_write(tp, MII_BMCR, data);
-        }
+        r8152b_enable_eee(tp);
+        r8152_aldps_en(tp, true);
+        r8152b_enable_fc(tp);
 
         set_bit(PHY_RESET, &tp->flags);
 }
@@ -2701,20 +2768,52 @@ static void r8152b_enter_oob(struct r8152 *tp)
         ocp_write_dword(tp, MCU_TYPE_PLA, PLA_RCR, ocp_data);
 }
 
+static void r8153_aldps_en(struct r8152 *tp, bool enable)
+{
+        u16 data;
+
+        data = ocp_reg_read(tp, OCP_POWER_CFG);
+        if (enable) {
+                data |= EN_ALDPS;
+                ocp_reg_write(tp, OCP_POWER_CFG, data);
+        } else {
+                data &= ~EN_ALDPS;
+                ocp_reg_write(tp, OCP_POWER_CFG, data);
+                msleep(20);
+        }
+}
+
+static void r8153_eee_en(struct r8152 *tp, bool enable)
+{
+        u32 ocp_data;
+        u16 config;
+
+        ocp_data = ocp_read_word(tp, MCU_TYPE_PLA, PLA_EEE_CR);
+        config = ocp_reg_read(tp, OCP_EEE_CFG);
+
+        if (enable) {
+                ocp_data |= EEE_RX_EN | EEE_TX_EN;
+                config |= EEE10_EN;
+        } else {
+                ocp_data &= ~(EEE_RX_EN | EEE_TX_EN);
+                config &= ~EEE10_EN;
+        }
+
+        ocp_write_word(tp, MCU_TYPE_PLA, PLA_EEE_CR, ocp_data);
+        ocp_reg_write(tp, OCP_EEE_CFG, config);
+}
+
 static void r8153_hw_phy_cfg(struct r8152 *tp)
 {
         u32 ocp_data;
         u16 data;
 
-        if (tp->version == RTL_VER_03 || tp->version == RTL_VER_04 ||
-            tp->version == RTL_VER_05)
-                ocp_reg_write(tp, OCP_ADC_CFG, CKADSEL_L | ADC_EN | EN_EMI_L);
+        /* disable ALDPS before updating the PHY parameters */
+        r8153_aldps_en(tp, false);
 
-        data = r8152_mdio_read(tp, MII_BMCR);
-        if (data & BMCR_PDOWN) {
-                data &= ~BMCR_PDOWN;
-                r8152_mdio_write(tp, MII_BMCR, data);
-        }
+        /* disable EEE before updating the PHY parameters */
+        r8153_eee_en(tp, false);
+        ocp_reg_write(tp, OCP_EEE_ADV, 0);
 
         if (tp->version == RTL_VER_03) {
                 data = ocp_reg_read(tp, OCP_EEE_CFG);
@@ -2745,6 +2844,12 @@ static void r8153_hw_phy_cfg(struct r8152 *tp)
         sram_write(tp, SRAM_10M_AMP1, 0x00af);
         sram_write(tp, SRAM_10M_AMP2, 0x0208);
 
+        r8153_eee_en(tp, true);
+        ocp_reg_write(tp, OCP_EEE_ADV, MDIO_EEE_1000T | MDIO_EEE_100TX);
+
+        r8153_aldps_en(tp, true);
+        r8152b_enable_fc(tp);
+
         set_bit(PHY_RESET, &tp->flags);
 }
 
@@ -2866,21 +2971,6 @@ static void r8153_enter_oob(struct r8152 *tp)
         ocp_write_dword(tp, MCU_TYPE_PLA, PLA_RCR, ocp_data);
 }
 
-static void r8153_aldps_en(struct r8152 *tp, bool enable)
-{
-        u16 data;
-
-        data = ocp_reg_read(tp, OCP_POWER_CFG);
-        if (enable) {
-                data |= EN_ALDPS;
-                ocp_reg_write(tp, OCP_POWER_CFG, data);
-        } else {
-                data &= ~EN_ALDPS;
-                ocp_reg_write(tp, OCP_POWER_CFG, data);
-                msleep(20);
-        }
-}
-
 static void rtl8153_disable(struct r8152 *tp)
 {
         r8153_aldps_en(tp, false);
@@ -3246,103 +3336,6 @@ static int rtl8152_close(struct net_device *netdev)
         return res;
 }
 
-static inline void r8152_mmd_indirect(struct r8152 *tp, u16 dev, u16 reg)
-{
-        ocp_reg_write(tp, OCP_EEE_AR, FUN_ADDR | dev);
-        ocp_reg_write(tp, OCP_EEE_DATA, reg);
-        ocp_reg_write(tp, OCP_EEE_AR, FUN_DATA | dev);
-}
-
-static u16 r8152_mmd_read(struct r8152 *tp, u16 dev, u16 reg)
-{
-        u16 data;
-
-        r8152_mmd_indirect(tp, dev, reg);
-        data = ocp_reg_read(tp, OCP_EEE_DATA);
-        ocp_reg_write(tp, OCP_EEE_AR, 0x0000);
-
-        return data;
-}
-
-static void r8152_mmd_write(struct r8152 *tp, u16 dev, u16 reg, u16 data)
-{
-        r8152_mmd_indirect(tp, dev, reg);
-        ocp_reg_write(tp, OCP_EEE_DATA, data);
-        ocp_reg_write(tp, OCP_EEE_AR, 0x0000);
-}
-
-static void r8152_eee_en(struct r8152 *tp, bool enable)
-{
-        u16 config1, config2, config3;
-        u32 ocp_data;
-
-        ocp_data = ocp_read_word(tp, MCU_TYPE_PLA, PLA_EEE_CR);
-        config1 = ocp_reg_read(tp, OCP_EEE_CONFIG1) & ~sd_rise_time_mask;
-        config2 = ocp_reg_read(tp, OCP_EEE_CONFIG2);
-        config3 = ocp_reg_read(tp, OCP_EEE_CONFIG3) & ~fast_snr_mask;
-
-        if (enable) {
-                ocp_data |= EEE_RX_EN | EEE_TX_EN;
-                config1 |= EEE_10_CAP | EEE_NWAY_EN | TX_QUIET_EN | RX_QUIET_EN;
-                config1 |= sd_rise_time(1);
-                config2 |= RG_DACQUIET_EN | RG_LDVQUIET_EN;
-                config3 |= fast_snr(42);
-        } else {
-                ocp_data &= ~(EEE_RX_EN | EEE_TX_EN);
-                config1 &= ~(EEE_10_CAP | EEE_NWAY_EN | TX_QUIET_EN |
-                             RX_QUIET_EN);
-                config1 |= sd_rise_time(7);
-                config2 &= ~(RG_DACQUIET_EN | RG_LDVQUIET_EN);
-                config3 |= fast_snr(511);
-        }
-
-        ocp_write_word(tp, MCU_TYPE_PLA, PLA_EEE_CR, ocp_data);
-        ocp_reg_write(tp, OCP_EEE_CONFIG1, config1);
-        ocp_reg_write(tp, OCP_EEE_CONFIG2, config2);
-        ocp_reg_write(tp, OCP_EEE_CONFIG3, config3);
-}
-
-static void r8152b_enable_eee(struct r8152 *tp)
-{
-        r8152_eee_en(tp, true);
-        r8152_mmd_write(tp, MDIO_MMD_AN, MDIO_AN_EEE_ADV, MDIO_EEE_100TX);
-}
-
-static void r8153_eee_en(struct r8152 *tp, bool enable)
-{
-        u32 ocp_data;
-        u16 config;
-
-        ocp_data = ocp_read_word(tp, MCU_TYPE_PLA, PLA_EEE_CR);
-        config = ocp_reg_read(tp, OCP_EEE_CFG);
-
-        if (enable) {
-                ocp_data |= EEE_RX_EN | EEE_TX_EN;
-                config |= EEE10_EN;
-        } else {
-                ocp_data &= ~(EEE_RX_EN | EEE_TX_EN);
-                config &= ~EEE10_EN;
-        }
-
-        ocp_write_word(tp, MCU_TYPE_PLA, PLA_EEE_CR, ocp_data);
-        ocp_reg_write(tp, OCP_EEE_CFG, config);
-}
-
-static void r8153_enable_eee(struct r8152 *tp)
-{
-        r8153_eee_en(tp, true);
-        ocp_reg_write(tp, OCP_EEE_ADV, MDIO_EEE_1000T | MDIO_EEE_100TX);
-}
-
-static void r8152b_enable_fc(struct r8152 *tp)
-{
-        u16 anar;
-
-        anar = r8152_mdio_read(tp, MII_ADVERTISE);
-        anar |= ADVERTISE_PAUSE_CAP | ADVERTISE_PAUSE_ASYM;
-        r8152_mdio_write(tp, MII_ADVERTISE, anar);
-}
-
 static void rtl_tally_reset(struct r8152 *tp)
 {
         u32 ocp_data;
@@ -3355,10 +3348,17 @@ static void rtl_tally_reset(struct r8152 *tp)
 static void r8152b_init(struct r8152 *tp)
 {
         u32 ocp_data;
+        u16 data;
 
         if (test_bit(RTL8152_UNPLUG, &tp->flags))
                 return;
 
+        data = r8152_mdio_read(tp, MII_BMCR);
+        if (data & BMCR_PDOWN) {
+                data &= ~BMCR_PDOWN;
+                r8152_mdio_write(tp, MII_BMCR, data);
+        }
+
         r8152_aldps_en(tp, false);
 
         if (tp->version == RTL_VER_01) {
@@ -3380,9 +3380,6 @@ static void r8152b_init(struct r8152 *tp)
                    SPDWN_RXDV_MSK | SPDWN_LINKCHG_MSK;
         ocp_write_word(tp, MCU_TYPE_PLA, PLA_GPHY_INTR_IMR, ocp_data);
 
-        r8152b_enable_eee(tp);
-        r8152_aldps_en(tp, true);
-        r8152b_enable_fc(tp);
         rtl_tally_reset(tp);
 
         /* enable rx aggregation */
@@ -3394,12 +3391,12 @@ static void r8152b_init(struct r8152 *tp)
 static void r8153_init(struct r8152 *tp)
 {
         u32 ocp_data;
+        u16 data;
         int i;
 
         if (test_bit(RTL8152_UNPLUG, &tp->flags))
                 return;
 
-        r8153_aldps_en(tp, false);
         r8153_u1u2en(tp, false);
 
         for (i = 0; i < 500; i++) {
@@ -3416,6 +3413,23 @@ static void r8153_init(struct r8152 *tp)
                 msleep(20);
         }
 
+        if (tp->version == RTL_VER_03 || tp->version == RTL_VER_04 ||
+            tp->version == RTL_VER_05)
+                ocp_reg_write(tp, OCP_ADC_CFG, CKADSEL_L | ADC_EN | EN_EMI_L);
+
+        data = r8152_mdio_read(tp, MII_BMCR);
+        if (data & BMCR_PDOWN) {
+                data &= ~BMCR_PDOWN;
+                r8152_mdio_write(tp, MII_BMCR, data);
+        }
+
+        for (i = 0; i < 500; i++) {
+                ocp_data = ocp_reg_read(tp, OCP_PHY_STATUS) & PHY_STAT_MASK;
+                if (ocp_data == PHY_STAT_LAN_ON)
+                        break;
+                msleep(20);
+        }
+
         usb_disable_lpm(tp->udev);
         r8153_u2p3en(tp, false);
 
@@ -3483,9 +3497,6 @@ static void r8153_init(struct r8152 *tp)
         ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL3, 0);
         ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL4, 0);
 
-        r8153_enable_eee(tp);
-        r8153_aldps_en(tp, true);
-        r8152b_enable_fc(tp);
         rtl_tally_reset(tp);
         r8153_u2p3en(tp, true);
 }
diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
index c68fe495d3f9..4244b9d4418e 100644
--- a/drivers/net/vmxnet3/vmxnet3_drv.c
+++ b/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -914,7 +914,9 @@ vmxnet3_copy_hdr(struct sk_buff *skb, struct vmxnet3_tx_queue *tq,
 {
         struct Vmxnet3_TxDataDesc *tdd;
 
-        tdd = tq->data_ring.base + tq->tx_ring.next2fill;
+        tdd = (struct Vmxnet3_TxDataDesc *)((u8 *)tq->data_ring.base +
+                                            tq->tx_ring.next2fill *
+                                            tq->txdata_desc_size);
 
         memcpy(tdd->data, skb->data, ctx->copy_size);
         netdev_dbg(adapter->netdev,
diff --git a/drivers/net/vmxnet3/vmxnet3_int.h b/drivers/net/vmxnet3/vmxnet3_int.h
index 74fc03072b87..7dc37a090549 100644
--- a/drivers/net/vmxnet3/vmxnet3_int.h
+++ b/drivers/net/vmxnet3/vmxnet3_int.h
@@ -69,10 +69,10 @@
 /*
  * Version numbers
  */
-#define VMXNET3_DRIVER_VERSION_STRING   "1.4.9.0-k"
+#define VMXNET3_DRIVER_VERSION_STRING   "1.4.a.0-k"
 
 /* a 32-bit int, each byte encode a verion number in VMXNET3_DRIVER_VERSION */
-#define VMXNET3_DRIVER_VERSION_NUM      0x01040900
+#define VMXNET3_DRIVER_VERSION_NUM      0x01040a00
 
 #if defined(CONFIG_PCI_MSI)
         /* RSS only makes sense if MSI-X is supported. */
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index da4e3d6632f6..6e65832051d6 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -1811,7 +1811,7 @@ static struct rtable *vxlan_get_route(struct vxlan_dev *vxlan,
         fl4.flowi4_mark = skb->mark;
         fl4.flowi4_proto = IPPROTO_UDP;
         fl4.daddr = daddr;
-        fl4.saddr = vxlan->cfg.saddr.sin.sin_addr.s_addr;
+        fl4.saddr = *saddr;
 
         rt = ip_route_output_key(vxlan->net, &fl4);
         if (!IS_ERR(rt)) {
@@ -1847,7 +1847,7 @@ static struct dst_entry *vxlan6_get_route(struct vxlan_dev *vxlan,
         memset(&fl6, 0, sizeof(fl6));
         fl6.flowi6_oif = oif;
         fl6.daddr = *daddr;
-        fl6.saddr = vxlan->cfg.saddr.sin6.sin6_addr;
+        fl6.saddr = *saddr;
         fl6.flowlabel = ip6_make_flowinfo(RT_TOS(tos), label);
         fl6.flowi6_mark = skb->mark;
         fl6.flowi6_proto = IPPROTO_UDP;
@@ -1920,7 +1920,8 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
         struct rtable *rt = NULL;
         const struct iphdr *old_iph;
         union vxlan_addr *dst;
-        union vxlan_addr remote_ip;
+        union vxlan_addr remote_ip, local_ip;
+        union vxlan_addr *src;
         struct vxlan_metadata _md;
         struct vxlan_metadata *md = &_md;
         __be16 src_port = 0, dst_port;
@@ -1938,6 +1939,7 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
                 dst_port = rdst->remote_port ? rdst->remote_port : vxlan->cfg.dst_port;
                 vni = rdst->remote_vni;
                 dst = &rdst->remote_ip;
+                src = &vxlan->cfg.saddr;
                 dst_cache = &rdst->dst_cache;
         } else {
                 if (!info) {
@@ -1948,11 +1950,15 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
                 dst_port = info->key.tp_dst ? : vxlan->cfg.dst_port;
                 vni = vxlan_tun_id_to_vni(info->key.tun_id);
                 remote_ip.sa.sa_family = ip_tunnel_info_af(info);
-                if (remote_ip.sa.sa_family == AF_INET)
+                if (remote_ip.sa.sa_family == AF_INET) {
                         remote_ip.sin.sin_addr.s_addr = info->key.u.ipv4.dst;
-                else
+                        local_ip.sin.sin_addr.s_addr = info->key.u.ipv4.src;
+                } else {
                         remote_ip.sin6.sin6_addr = info->key.u.ipv6.dst;
+                        local_ip.sin6.sin6_addr = info->key.u.ipv6.src;
+                }
                 dst = &remote_ip;
+                src = &local_ip;
                 dst_cache = &info->dst_cache;
         }
 
@@ -1992,15 +1998,14 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
         }
 
         if (dst->sa.sa_family == AF_INET) {
-                __be32 saddr;
-
                 if (!vxlan->vn4_sock)
                         goto drop;
                 sk = vxlan->vn4_sock->sock->sk;
 
                 rt = vxlan_get_route(vxlan, skb,
                                      rdst ? rdst->remote_ifindex : 0, tos,
-                                     dst->sin.sin_addr.s_addr, &saddr,
+                                     dst->sin.sin_addr.s_addr,
+                                     &src->sin.sin_addr.s_addr,
                                      dst_cache, info);
                 if (IS_ERR(rt)) {
                         netdev_dbg(dev, "no route to %pI4\n",
@@ -2017,7 +2022,7 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
                 }
 
                 /* Bypass encapsulation if the destination is local */
-                if (rt->rt_flags & RTCF_LOCAL &&
+                if (!info && rt->rt_flags & RTCF_LOCAL &&
                     !(rt->rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST))) {
                         struct vxlan_dev *dst_vxlan;
 
@@ -2043,13 +2048,12 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
                 if (err < 0)
                         goto xmit_tx_error;
 
-                udp_tunnel_xmit_skb(rt, sk, skb, saddr,
+                udp_tunnel_xmit_skb(rt, sk, skb, src->sin.sin_addr.s_addr,
                                     dst->sin.sin_addr.s_addr, tos, ttl, df,
                                     src_port, dst_port, xnet, !udp_sum);
 #if IS_ENABLED(CONFIG_IPV6)
         } else {
                 struct dst_entry *ndst;
-                struct in6_addr saddr;
                 u32 rt6i_flags;
 
                 if (!vxlan->vn6_sock)
@@ -2058,7 +2062,8 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
 
                 ndst = vxlan6_get_route(vxlan, skb,
                                         rdst ? rdst->remote_ifindex : 0, tos,
-                                        label, &dst->sin6.sin6_addr, &saddr,
+                                        label, &dst->sin6.sin6_addr,
+                                        &src->sin6.sin6_addr,
                                         dst_cache, info);
                 if (IS_ERR(ndst)) {
                         netdev_dbg(dev, "no route to %pI6\n",
@@ -2077,7 +2082,7 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
 
                 /* Bypass encapsulation if the destination is local */
                 rt6i_flags = ((struct rt6_info *)ndst)->rt6i_flags;
-                if (rt6i_flags & RTF_LOCAL &&
+                if (!info && rt6i_flags & RTF_LOCAL &&
                     !(rt6i_flags & (RTCF_BROADCAST | RTCF_MULTICAST))) {
                         struct vxlan_dev *dst_vxlan;
 
@@ -2104,7 +2109,8 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
                         return;
                 }
                 udp_tunnel6_xmit_skb(ndst, sk, skb, dev,
-                                     &saddr, &dst->sin6.sin6_addr, tos, ttl,
+                                     &src->sin6.sin6_addr,
+                                     &dst->sin6.sin6_addr, tos, ttl,
                                      label, src_port, dst_port, !udp_sum);
 #endif
         }
@@ -2776,14 +2782,15 @@ static int vxlan_dev_configure(struct net *src_net, struct net_device *dev,
         struct net_device *lowerdev = NULL;
 
         if (conf->flags & VXLAN_F_GPE) {
-                if (conf->flags & ~VXLAN_F_ALLOWED_GPE)
-                        return -EINVAL;
                 /* For now, allow GPE only together with COLLECT_METADATA.
                  * This can be relaxed later; in such case, the other side
                  * of the PtP link will have to be provided.
                  */
-                if (!(conf->flags & VXLAN_F_COLLECT_METADATA))
+                if ((conf->flags & ~VXLAN_F_ALLOWED_GPE) ||
+                    !(conf->flags & VXLAN_F_COLLECT_METADATA)) {
+                        pr_info("unsupported combination of extensions\n");
                         return -EINVAL;
+                }
 
                 vxlan_raw_setup(dev);
         } else {
@@ -2836,6 +2843,9 @@ static int vxlan_dev_configure(struct net *src_net, struct net_device *dev,
                         dev->mtu = lowerdev->mtu - (use_ipv6 ? VXLAN6_HEADROOM : VXLAN_HEADROOM);
 
                 needed_headroom = lowerdev->hard_header_len;
+        } else if (vxlan_addr_multicast(&dst->remote_ip)) {
+                pr_info("multicast destination requires interface to be specified\n");
+                return -EINVAL;
         }
 
         if (conf->mtu) {
@@ -2868,8 +2878,10 @@ static int vxlan_dev_configure(struct net *src_net, struct net_device *dev,
                      tmp->cfg.saddr.sa.sa_family == AF_INET6) == use_ipv6 &&
                     tmp->cfg.dst_port == vxlan->cfg.dst_port &&
                     (tmp->flags & VXLAN_F_RCV_FLAGS) ==
-                    (vxlan->flags & VXLAN_F_RCV_FLAGS))
-                return -EEXIST;
+                    (vxlan->flags & VXLAN_F_RCV_FLAGS)) {
+                        pr_info("duplicate VNI %u\n", be32_to_cpu(conf->vni));
+                        return -EEXIST;
+                }
         }
 
         dev->ethtool_ops = &vxlan_ethtool_ops;
@@ -2903,7 +2915,6 @@ static int vxlan_newlink(struct net *src_net, struct net_device *dev,
                          struct nlattr *tb[], struct nlattr *data[])
 {
         struct vxlan_config conf;
-        int err;
 
         memset(&conf, 0, sizeof(conf));
 
@@ -3012,26 +3023,7 @@ static int vxlan_newlink(struct net *src_net, struct net_device *dev,
         if (tb[IFLA_MTU])
                 conf.mtu = nla_get_u32(tb[IFLA_MTU]);
 
-        err = vxlan_dev_configure(src_net, dev, &conf);
-        switch (err) {
-        case -ENODEV:
-                pr_info("ifindex %d does not exist\n", conf.remote_ifindex);
-                break;
-
-        case -EPERM:
-                pr_info("IPv6 is disabled via sysctl\n");
-                break;
-
-        case -EEXIST:
-                pr_info("duplicate VNI %u\n", be32_to_cpu(conf.vni));
-                break;
-
-        case -EINVAL:
-                pr_info("unsupported combination of extensions\n");
-                break;
-        }
-
-        return err;
+        return vxlan_dev_configure(src_net, dev, &conf);
 }
 
 static void vxlan_dellink(struct net_device *dev, struct list_head *head)
diff --git a/drivers/net/wireless/ath/ath10k/htt_rx.c b/drivers/net/wireless/ath/ath10k/htt_rx.c
index 78db5d679f19..24c8d65bcf34 100644
--- a/drivers/net/wireless/ath/ath10k/htt_rx.c
+++ b/drivers/net/wireless/ath/ath10k/htt_rx.c
@@ -1525,7 +1525,7 @@ static void ath10k_htt_rx_h_filter(struct ath10k *ar,
 static int ath10k_htt_rx_handle_amsdu(struct ath10k_htt *htt)
 {
         struct ath10k *ar = htt->ar;
-        static struct ieee80211_rx_status rx_status;
+        struct ieee80211_rx_status *rx_status = &htt->rx_status;
         struct sk_buff_head amsdu;
         int ret;
 
@@ -1549,11 +1549,11 @@ static int ath10k_htt_rx_handle_amsdu(struct ath10k_htt *htt)
                 return ret;
         }
 
-        ath10k_htt_rx_h_ppdu(ar, &amsdu, &rx_status, 0xffff);
+        ath10k_htt_rx_h_ppdu(ar, &amsdu, rx_status, 0xffff);
         ath10k_htt_rx_h_unchain(ar, &amsdu, ret > 0);
-        ath10k_htt_rx_h_filter(ar, &amsdu, &rx_status);
-        ath10k_htt_rx_h_mpdu(ar, &amsdu, &rx_status);
-        ath10k_htt_rx_h_deliver(ar, &amsdu, &rx_status);
+        ath10k_htt_rx_h_filter(ar, &amsdu, rx_status);
+        ath10k_htt_rx_h_mpdu(ar, &amsdu, rx_status);
+        ath10k_htt_rx_h_deliver(ar, &amsdu, rx_status);
 
         return 0;
 }
diff --git a/drivers/net/wireless/ath/ath10k/pci.c b/drivers/net/wireless/ath/ath10k/pci.c
index 9a22c478dd1b..07933c51a850 100644
--- a/drivers/net/wireless/ath/ath10k/pci.c
+++ b/drivers/net/wireless/ath/ath10k/pci.c
@@ -3162,7 +3162,6 @@ static int ath10k_pci_probe(struct pci_dev *pdev,
                 pci_hard_reset = ath10k_pci_qca988x_chip_reset;
                 break;
         case QCA9887_1_0_DEVICE_ID:
-                dev_warn(&pdev->dev, "QCA9887 support is still experimental, there are likely bugs. You have been warned.\n");
                 hw_rev = ATH10K_HW_QCA9887;
                 pci_ps = false;
                 pci_soft_reset = ath10k_pci_warm_reset;
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index d1d0c06d627c..14b13f07cd1f 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -2482,6 +2482,8 @@ int ath9k_hw_fill_cap_info(struct ath_hw *ah)
                 return -EINVAL;
         }
 
+        ath9k_gpio_cap_init(ah);
+
         if (AR_SREV_9485(ah) ||
             AR_SREV_9285(ah) ||
             AR_SREV_9330(ah) ||
@@ -2531,8 +2533,6 @@ int ath9k_hw_fill_cap_info(struct ath_hw *ah)
         else
                 pCap->hw_caps &= ~ATH9K_HW_CAP_HT;
 
-        ath9k_gpio_cap_init(ah);
-
         if (AR_SREV_9160_10_OR_LATER(ah) || AR_SREV_9100(ah))
                 pCap->rts_aggr_limit = ATH_AMPDU_LIMIT_MAX;
         else
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index a394622c9022..7cb65c303f8d 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -718,9 +718,12 @@ static int ath9k_start(struct ieee80211_hw *hw)
         if (!ath_complete_reset(sc, false))
                 ah->reset_power_on = false;
 
-        if (ah->led_pin >= 0)
+        if (ah->led_pin >= 0) {
                 ath9k_hw_set_gpio(ah, ah->led_pin,
                                   (ah->config.led_active_high) ? 1 : 0);
+                ath9k_hw_gpio_request_out(ah, ah->led_pin, NULL,
+                                          AR_GPIO_OUTPUT_MUX_AS_OUTPUT);
+        }
 
         /*
          * Reset key cache to sane defaults (all entries cleared) instead of
@@ -864,9 +867,11 @@ static void ath9k_stop(struct ieee80211_hw *hw)
 
         spin_lock_bh(&sc->sc_pcu_lock);
 
-        if (ah->led_pin >= 0)
+        if (ah->led_pin >= 0) {
                 ath9k_hw_set_gpio(ah, ah->led_pin,
                                   (ah->config.led_active_high) ? 0 : 1);
+                ath9k_hw_gpio_request_in(ah, ah->led_pin, NULL);
+        }
 
         ath_prepare_reset(sc);
 
@@ -1154,6 +1159,7 @@ void ath9k_calculate_summary_state(struct ath_softc *sc,
                 bool changed = (iter_data.primary_sta != ctx->primary_sta);
 
                 if (iter_data.primary_sta) {
+                        iter_data.primary_beacon_vif = iter_data.primary_sta;
                         iter_data.beacons = true;
                         ath9k_set_assoc_state(sc, iter_data.primary_sta,
                                               changed);
@@ -1563,13 +1569,13 @@ static int ath9k_sta_state(struct ieee80211_hw *hw,
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
         int ret = 0;
 
-        if (old_state == IEEE80211_STA_AUTH &&
-            new_state == IEEE80211_STA_ASSOC) {
+        if (old_state == IEEE80211_STA_NOTEXIST &&
+            new_state == IEEE80211_STA_NONE) {
                 ret = ath9k_sta_add(hw, vif, sta);
                 ath_dbg(common, CONFIG,
                         "Add station: %pM\n", sta->addr);
-        } else if (old_state == IEEE80211_STA_ASSOC &&
-                   new_state == IEEE80211_STA_AUTH) {
+        } else if (old_state == IEEE80211_STA_NONE &&
+                   new_state == IEEE80211_STA_NOTEXIST) {
                 ret = ath9k_sta_remove(hw, vif, sta);
                 ath_dbg(common, CONFIG,
                         "Remove station: %pM\n", sta->addr);
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
index 2628d5e12c64..b8aec5e5ef93 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
@@ -4527,7 +4527,7 @@ brcmf_cfg80211_start_ap(struct wiphy *wiphy, struct net_device *ndev,
                                 (u8 *)&settings->beacon.head[ie_offset],
                                 settings->beacon.head_len - ie_offset,
                                 WLAN_EID_SSID);
-                if (!ssid_ie)
+                if (!ssid_ie || ssid_ie->len > IEEE80211_MAX_SSID_LEN)
                         return -EINVAL;
 
                 memcpy(ssid_le.SSID, ssid_ie->data, ssid_ie->len);
@@ -5635,7 +5635,7 @@ static s32 brcmf_notify_vif_event(struct brcmf_if *ifp,
                   ifevent->action, ifevent->flags, ifevent->ifidx,
                   ifevent->bsscfgidx);
 
-        mutex_lock(&event->vif_event_lock);
+        spin_lock(&event->vif_event_lock);
         event->action = ifevent->action;
         vif = event->vif;
 
@@ -5643,7 +5643,7 @@ static s32 brcmf_notify_vif_event(struct brcmf_if *ifp,
         case BRCMF_E_IF_ADD:
                 /* waiting process may have timed out */
                 if (!cfg->vif_event.vif) {
-                        mutex_unlock(&event->vif_event_lock);
+                        spin_unlock(&event->vif_event_lock);
                         return -EBADF;
                 }
 
@@ -5654,24 +5654,24 @@ static s32 brcmf_notify_vif_event(struct brcmf_if *ifp,
                         ifp->ndev->ieee80211_ptr = &vif->wdev;
                         SET_NETDEV_DEV(ifp->ndev, wiphy_dev(cfg->wiphy));
                 }
-                mutex_unlock(&event->vif_event_lock);
+                spin_unlock(&event->vif_event_lock);
                 wake_up(&event->vif_wq);
                 return 0;
 
         case BRCMF_E_IF_DEL:
-                mutex_unlock(&event->vif_event_lock);
+                spin_unlock(&event->vif_event_lock);
                 /* event may not be upon user request */
                 if (brcmf_cfg80211_vif_event_armed(cfg))
                         wake_up(&event->vif_wq);
                 return 0;
 
         case BRCMF_E_IF_CHANGE:
-                mutex_unlock(&event->vif_event_lock);
+                spin_unlock(&event->vif_event_lock);
                 wake_up(&event->vif_wq);
                 return 0;
 
         default:
-                mutex_unlock(&event->vif_event_lock);
+                spin_unlock(&event->vif_event_lock);
                 break;
         }
         return -EINVAL;
@@ -5792,7 +5792,7 @@ static void wl_deinit_priv(struct brcmf_cfg80211_info *cfg)
 static void init_vif_event(struct brcmf_cfg80211_vif_event *event)
 {
         init_waitqueue_head(&event->vif_wq);
-        mutex_init(&event->vif_event_lock);
+        spin_lock_init(&event->vif_event_lock);
 }
 
 static s32 brcmf_dongle_roam(struct brcmf_if *ifp)
@@ -6691,9 +6691,9 @@ static inline bool vif_event_equals(struct brcmf_cfg80211_vif_event *event,
 {
         u8 evt_action;
 
-        mutex_lock(&event->vif_event_lock);
+        spin_lock(&event->vif_event_lock);
         evt_action = event->action;
-        mutex_unlock(&event->vif_event_lock);
+        spin_unlock(&event->vif_event_lock);
         return evt_action == action;
 }
 
@@ -6702,10 +6702,10 @@ void brcmf_cfg80211_arm_vif_event(struct brcmf_cfg80211_info *cfg,
 {
         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
 
-        mutex_lock(&event->vif_event_lock);
+        spin_lock(&event->vif_event_lock);
         event->vif = vif;
         event->action = 0;
-        mutex_unlock(&event->vif_event_lock);
+        spin_unlock(&event->vif_event_lock);
 }
 
 bool brcmf_cfg80211_vif_event_armed(struct brcmf_cfg80211_info *cfg)
@@ -6713,9 +6713,9 @@ bool brcmf_cfg80211_vif_event_armed(struct brcmf_cfg80211_info *cfg)
         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
         bool armed;
 
-        mutex_lock(&event->vif_event_lock);
+        spin_lock(&event->vif_event_lock);
         armed = event->vif != NULL;
-        mutex_unlock(&event->vif_event_lock);
+        spin_unlock(&event->vif_event_lock);
 
         return armed;
 }
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h
index 7d77f869b7f1..8889832c17e0 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h
@@ -227,7 +227,7 @@ struct escan_info {
  */
 struct brcmf_cfg80211_vif_event {
         wait_queue_head_t vif_wq;
-        struct mutex vif_event_lock;
+        spinlock_t vif_event_lock;
         u8 action;
         struct brcmf_cfg80211_vif *vif;
 };
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
index 8d16f0204985..65e8c8766441 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
@@ -743,7 +743,7 @@ static void brcmf_del_if(struct brcmf_pub *drvr, s32 bsscfgidx,
                  * serious troublesome side effects. The p2p module will clean
                  * up the ifp if needed.
                  */
-                brcmf_p2p_ifp_removed(ifp);
+                brcmf_p2p_ifp_removed(ifp, rtnl_locked);
                 kfree(ifp);
         }
 }
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
index 66f942f7448e..de19c7c92bc6 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
@@ -2297,7 +2297,7 @@ int brcmf_p2p_del_vif(struct wiphy *wiphy, struct wireless_dev *wdev)
         return err;
 }
 
-void brcmf_p2p_ifp_removed(struct brcmf_if *ifp)
+void brcmf_p2p_ifp_removed(struct brcmf_if *ifp, bool rtnl_locked)
 {
         struct brcmf_cfg80211_info *cfg;
         struct brcmf_cfg80211_vif *vif;
@@ -2306,9 +2306,11 @@ void brcmf_p2p_ifp_removed(struct brcmf_if *ifp)
         vif = ifp->vif;
         cfg = wdev_to_cfg(&vif->wdev);
         cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif = NULL;
-        rtnl_lock();
+        if (!rtnl_locked)
+                rtnl_lock();
         cfg80211_unregister_wdev(&vif->wdev);
-        rtnl_unlock();
+        if (!rtnl_locked)
+                rtnl_unlock();
         brcmf_free_vif(vif);
 }
 
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h
index a3bd18c2360b..8ce9447533ef 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h
@@ -155,7 +155,7 @@ struct wireless_dev *brcmf_p2p_add_vif(struct wiphy *wiphy, const char *name,
 int brcmf_p2p_del_vif(struct wiphy *wiphy, struct wireless_dev *wdev);
 int brcmf_p2p_ifchange(struct brcmf_cfg80211_info *cfg,
                        enum brcmf_fil_p2p_if_types if_type);
-void brcmf_p2p_ifp_removed(struct brcmf_if *ifp);
+void brcmf_p2p_ifp_removed(struct brcmf_if *ifp, bool rtnl_locked);
 int brcmf_p2p_start_device(struct wiphy *wiphy, struct wireless_dev *wdev);
 void brcmf_p2p_stop_device(struct wiphy *wiphy, struct wireless_dev *wdev);
 int brcmf_p2p_scan_prep(struct wiphy *wiphy,
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c
index 1abcabb9b6cd..46b52bf705fb 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c
@@ -960,5 +960,6 @@ int iwl_mvm_start_fw_dbg_conf(struct iwl_mvm *mvm, u8 conf_id)
         }
 
         mvm->fw_dbg_conf = conf_id;
-        return ret;
+
+        return 0;
 }
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.h b/drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.h
index f7dff7612c9c..e9f1be9da7d4 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.h
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.h
@@ -105,7 +105,8 @@ iwl_fw_dbg_trigger_vif_match(struct iwl_fw_dbg_trigger_tlv *trig,
 {
         u32 trig_vif = le32_to_cpu(trig->vif_type);
 
-        return trig_vif == IWL_FW_DBG_CONF_VIF_ANY || vif->type == trig_vif;
+        return trig_vif == IWL_FW_DBG_CONF_VIF_ANY ||
+               ieee80211_vif_type_p2p(vif) == trig_vif;
 }
 
 static inline bool
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
index 6d6064534d59..5dd77e336617 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
@@ -624,6 +624,7 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
         hw->wiphy->features |= NL80211_FEATURE_P2P_GO_CTWIN |
                                NL80211_FEATURE_LOW_PRIORITY_SCAN |
                                NL80211_FEATURE_P2P_GO_OPPPS |
+                               NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE |
                                NL80211_FEATURE_DYNAMIC_SMPS |
                                NL80211_FEATURE_STATIC_SMPS |
                                NL80211_FEATURE_SUPPORTS_WMM_ADMISSION;
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
index b4fc86d5d7ef..6a615bb73042 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
@@ -467,6 +467,8 @@ struct iwl_mvm_vif {
 static inline struct iwl_mvm_vif *
 iwl_mvm_vif_from_mac80211(struct ieee80211_vif *vif)
 {
+        if (!vif)
+                return NULL;
         return (void *)vif->drv_priv;
 }
 
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
index c6585ab48df3..b3a87a31de30 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
@@ -513,6 +513,15 @@ int iwl_mvm_tx_skb_non_sta(struct iwl_mvm *mvm, struct sk_buff *skb)
         int hdrlen = ieee80211_hdrlen(hdr->frame_control);
         int queue;
 
+        /* IWL_MVM_OFFCHANNEL_QUEUE is used for ROC packets that can be used
+         * in 2 different types of vifs, P2P & STATION. P2P uses the offchannel
+         * queue. STATION (HS2.0) uses the auxiliary context of the FW,
+         * and hence needs to be sent on the aux queue
+         */
+        if (IEEE80211_SKB_CB(skb)->hw_queue == IWL_MVM_OFFCHANNEL_QUEUE &&
+            skb_info->control.vif->type == NL80211_IFTYPE_STATION)
+                IEEE80211_SKB_CB(skb)->hw_queue = mvm->aux_queue;
+
         memcpy(&info, skb->cb, sizeof(info));
 
         if (WARN_ON_ONCE(info.flags & IEEE80211_TX_CTL_AMPDU))
@@ -526,16 +535,6 @@ int iwl_mvm_tx_skb_non_sta(struct iwl_mvm *mvm, struct sk_buff *skb)
         /* This holds the amsdu headers length */
         skb_info->driver_data[0] = (void *)(uintptr_t)0;
 
-        /*
-         * IWL_MVM_OFFCHANNEL_QUEUE is used for ROC packets that can be used
-         * in 2 different types of vifs, P2P & STATION. P2P uses the offchannel
-         * queue. STATION (HS2.0) uses the auxiliary context of the FW,
-         * and hence needs to be sent on the aux queue
-         */
-        if (IEEE80211_SKB_CB(skb)->hw_queue == IWL_MVM_OFFCHANNEL_QUEUE &&
-            info.control.vif->type == NL80211_IFTYPE_STATION)
-                IEEE80211_SKB_CB(skb)->hw_queue = mvm->aux_queue;
-
         queue = info.hw_queue;
 
         /*
diff --git a/drivers/net/wireless/marvell/mwifiex/11n_aggr.c b/drivers/net/wireless/marvell/mwifiex/11n_aggr.c
index dc49c3de1f25..c47d6366875d 100644
--- a/drivers/net/wireless/marvell/mwifiex/11n_aggr.c
+++ b/drivers/net/wireless/marvell/mwifiex/11n_aggr.c
@@ -205,7 +205,8 @@ mwifiex_11n_aggregate_pkt(struct mwifiex_private *priv,
 
         do {
                 /* Check if AMSDU can accommodate this MSDU */
-                if (skb_tailroom(skb_aggr) < (skb_src->len + LLC_SNAP_LEN))
+                if ((skb_aggr->len + skb_src->len + LLC_SNAP_LEN) >
+                    adapter->tx_buf_size)
                         break;
 
                 skb_src = skb_dequeue(&pra_list->skb_head);
diff --git a/drivers/net/wireless/ti/wlcore/main.c b/drivers/net/wireless/ti/wlcore/main.c
index 1d689169da76..9e1f2d9c9865 100644
--- a/drivers/net/wireless/ti/wlcore/main.c
+++ b/drivers/net/wireless/ti/wlcore/main.c
@@ -5700,10 +5700,11 @@ out:
         mutex_unlock(&wl->mutex);
 }
 
-static u32 wlcore_op_get_expected_throughput(struct ieee80211_sta *sta)
+static u32 wlcore_op_get_expected_throughput(struct ieee80211_hw *hw,
+                                             struct ieee80211_sta *sta)
 {
         struct wl1271_station *wl_sta = (struct wl1271_station *)sta->drv_priv;
-        struct wl1271 *wl = wl_sta->wl;
+        struct wl1271 *wl = hw->priv;
         u8 hlid = wl_sta->hlid;
 
         /* return in units of Kbps */
diff --git a/drivers/net/xen-netback/xenbus.c b/drivers/net/xen-netback/xenbus.c
index 6a31f2610c23..daf4c7867102 100644
--- a/drivers/net/xen-netback/xenbus.c
+++ b/drivers/net/xen-netback/xenbus.c
@@ -271,6 +271,11 @@ static int netback_probe(struct xenbus_device *dev,
         be->dev = dev;
         dev_set_drvdata(&dev->dev, be);
 
+        be->state = XenbusStateInitialising;
+        err = xenbus_switch_state(dev, XenbusStateInitialising);
+        if (err)
+                goto fail;
+
         sg = 1;
 
         do {
@@ -383,11 +388,6 @@ static int netback_probe(struct xenbus_device *dev,
 
         be->hotplug_script = script;
 
-        err = xenbus_switch_state(dev, XenbusStateInitWait);
-        if (err)
-                goto fail;
-
-        be->state = XenbusStateInitWait;
 
         /* This kicks hotplug scripts, so do it immediately. */
         err = backend_create_xenvif(be);
@@ -492,20 +492,20 @@ static inline void backend_switch_state(struct backend_info *be,
 
 /* Handle backend state transitions:
  *
- * The backend state starts in InitWait and the following transitions are
+ * The backend state starts in Initialising and the following transitions are
  * allowed.
  *
- * InitWait -> Connected
- *
- *    ^    \         |
- *    |     \        |
- *    |      \       |
- *    |       \      |
- *    |        \     |
- *    |         \    |
- *    |          V   V
+ * Initialising -> InitWait -> Connected
+ *          \
+ *           \        ^    \         |
+ *            \       |     \        |
+ *             \      |      \       |
+ *              \     |       \      |
+ *               \    |        \     |
+ *                \   |         \    |
+ *                 V  |          V   V
  *
- *  Closed  <-> Closing
+ *                  Closed  <-> Closing
  *
  * The state argument specifies the eventual state of the backend and the
  * function transitions to that state via the shortest path.
@@ -515,6 +515,20 @@ static void set_backend_state(struct backend_info *be,
 {
         while (be->state != state) {
                 switch (be->state) {
+                case XenbusStateInitialising:
+                        switch (state) {
+                        case XenbusStateInitWait:
+                        case XenbusStateConnected:
+                        case XenbusStateClosing:
+                                backend_switch_state(be, XenbusStateInitWait);
+                                break;
+                        case XenbusStateClosed:
+                                backend_switch_state(be, XenbusStateClosed);
+                                break;
+                        default:
+                                BUG();
+                        }
+                        break;
                 case XenbusStateClosed:
                         switch (state) {
                         case XenbusStateInitWait:
diff --git a/drivers/nvdimm/bus.c b/drivers/nvdimm/bus.c
index 458daf927336..935866fe5ec2 100644
--- a/drivers/nvdimm/bus.c
+++ b/drivers/nvdimm/bus.c
@@ -185,8 +185,12 @@ long nvdimm_clear_poison(struct device *dev, phys_addr_t phys,
                 return -ENXIO;
 
         nd_desc = nvdimm_bus->nd_desc;
+        /*
+         * if ndctl does not exist, it's PMEM_LEGACY and
+         * we want to just pretend everything is handled.
+         */
         if (!nd_desc->ndctl)
-                return -ENXIO;
+                return len;
 
         memset(&ars_cap, 0, sizeof(ars_cap));
         ars_cap.address = phys;
diff --git a/drivers/nvme/host/Kconfig b/drivers/nvme/host/Kconfig
index db39d53cdfb9..f7d37a62f874 100644
--- a/drivers/nvme/host/Kconfig
+++ b/drivers/nvme/host/Kconfig
@@ -30,8 +30,8 @@ config NVME_FABRICS
 
 config NVME_RDMA
         tristate "NVM Express over Fabrics RDMA host driver"
-        depends on INFINIBAND
-        depends on BLK_DEV_NVME
+        depends on INFINIBAND && BLOCK
+        select NVME_CORE
         select NVME_FABRICS
         select SG_POOL
         help
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index 7ff2e820bbf4..2feacc70bf61 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -81,10 +81,12 @@ EXPORT_SYMBOL_GPL(nvme_cancel_request);
 bool nvme_change_ctrl_state(struct nvme_ctrl *ctrl,
                 enum nvme_ctrl_state new_state)
 {
-        enum nvme_ctrl_state old_state = ctrl->state;
+        enum nvme_ctrl_state old_state;
         bool changed = false;
 
         spin_lock_irq(&ctrl->lock);
+
+        old_state = ctrl->state;
         switch (new_state) {
         case NVME_CTRL_LIVE:
                 switch (old_state) {
@@ -140,11 +142,12 @@ bool nvme_change_ctrl_state(struct nvme_ctrl *ctrl,
         default:
                 break;
         }
-        spin_unlock_irq(&ctrl->lock);
 
         if (changed)
                 ctrl->state = new_state;
 
+        spin_unlock_irq(&ctrl->lock);
+
         return changed;
 }
 EXPORT_SYMBOL_GPL(nvme_change_ctrl_state);
@@ -608,7 +611,7 @@ int nvme_get_features(struct nvme_ctrl *dev, unsigned fid, unsigned nsid,
 
         ret = __nvme_submit_sync_cmd(dev->admin_q, &c, &cqe, NULL, 0, 0,
                         NVME_QID_ANY, 0, 0);
-        if (ret >= 0)
+        if (ret >= 0 && result)
                 *result = le32_to_cpu(cqe.result);
         return ret;
 }
@@ -628,7 +631,7 @@ int nvme_set_features(struct nvme_ctrl *dev, unsigned fid, unsigned dword11,
 
         ret = __nvme_submit_sync_cmd(dev->admin_q, &c, &cqe, NULL, 0, 0,
                         NVME_QID_ANY, 0, 0);
-        if (ret >= 0)
+        if (ret >= 0 && result)
                 *result = le32_to_cpu(cqe.result);
         return ret;
 }
diff --git a/drivers/nvme/host/fabrics.c b/drivers/nvme/host/fabrics.c
index dc996761042f..4eff49174466 100644
--- a/drivers/nvme/host/fabrics.c
+++ b/drivers/nvme/host/fabrics.c
@@ -47,8 +47,10 @@ static struct nvmf_host *nvmf_host_add(const char *hostnqn)
 
         mutex_lock(&nvmf_hosts_mutex);
         host = __nvmf_host_find(hostnqn);
-        if (host)
+        if (host) {
+                kref_get(&host->ref);
                 goto out_unlock;
+        }
 
         host = kmalloc(sizeof(*host), GFP_KERNEL);
         if (!host)
@@ -56,7 +58,7 @@ static struct nvmf_host *nvmf_host_add(const char *hostnqn)
 
         kref_init(&host->ref);
         memcpy(host->nqn, hostnqn, NVMF_NQN_SIZE);
-        uuid_le_gen(&host->id);
+        uuid_be_gen(&host->id);
 
         list_add_tail(&host->list, &nvmf_hosts);
 out_unlock:
@@ -73,9 +75,9 @@ static struct nvmf_host *nvmf_host_default(void)
                 return NULL;
 
         kref_init(&host->ref);
-        uuid_le_gen(&host->id);
+        uuid_be_gen(&host->id);
         snprintf(host->nqn, NVMF_NQN_SIZE,
-                "nqn.2014-08.org.nvmexpress:NVMf:uuid:%pUl", &host->id);
+                "nqn.2014-08.org.nvmexpress:NVMf:uuid:%pUb", &host->id);
 
         mutex_lock(&nvmf_hosts_mutex);
         list_add_tail(&host->list, &nvmf_hosts);
@@ -363,7 +365,14 @@ int nvmf_connect_admin_queue(struct nvme_ctrl *ctrl)
         cmd.connect.opcode = nvme_fabrics_command;
         cmd.connect.fctype = nvme_fabrics_type_connect;
         cmd.connect.qid = 0;
-        cmd.connect.sqsize = cpu_to_le16(ctrl->sqsize);
+
+        /*
+         * fabrics spec sets a minimum of depth 32 for admin queue,
+         * so set the queue with this depth always until
+         * justification otherwise.
+         */
+        cmd.connect.sqsize = cpu_to_le16(NVMF_AQ_DEPTH - 1);
+
         /*
          * Set keep-alive timeout in seconds granularity (ms * 1000)
          * and add a grace period for controller kato enforcement
@@ -375,7 +384,7 @@ int nvmf_connect_admin_queue(struct nvme_ctrl *ctrl)
         if (!data)
                 return -ENOMEM;
 
-        memcpy(&data->hostid, &ctrl->opts->host->id, sizeof(uuid_le));
+        memcpy(&data->hostid, &ctrl->opts->host->id, sizeof(uuid_be));
         data->cntlid = cpu_to_le16(0xffff);
         strncpy(data->subsysnqn, ctrl->opts->subsysnqn, NVMF_NQN_SIZE);
         strncpy(data->hostnqn, ctrl->opts->host->nqn, NVMF_NQN_SIZE);
@@ -434,7 +443,7 @@ int nvmf_connect_io_queue(struct nvme_ctrl *ctrl, u16 qid)
         if (!data)
                 return -ENOMEM;
 
-        memcpy(&data->hostid, &ctrl->opts->host->id, sizeof(uuid_le));
+        memcpy(&data->hostid, &ctrl->opts->host->id, sizeof(uuid_be));
         data->cntlid = cpu_to_le16(ctrl->cntlid);
         strncpy(data->subsysnqn, ctrl->opts->subsysnqn, NVMF_NQN_SIZE);
         strncpy(data->hostnqn, ctrl->opts->host->nqn, NVMF_NQN_SIZE);
diff --git a/drivers/nvme/host/fabrics.h b/drivers/nvme/host/fabrics.h
index 89df52c8be97..46e460aee52d 100644
--- a/drivers/nvme/host/fabrics.h
+++ b/drivers/nvme/host/fabrics.h
@@ -34,7 +34,7 @@ struct nvmf_host {
         struct kref             ref;
         struct list_head        list;
         char                    nqn[NVMF_NQN_SIZE];
-        uuid_le                 id;
+        uuid_be                 id;
 };
 
 /**
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index 8dcf5a960951..60f7eab11865 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -1693,7 +1693,12 @@ static void nvme_dev_disable(struct nvme_dev *dev, bool shutdown)
                 nvme_suspend_queue(dev->queues[i]);
 
         if (csts & NVME_CSTS_CFS || !(csts & NVME_CSTS_RDY)) {
-                nvme_suspend_queue(dev->queues[0]);
+                /* A device might become IO incapable very soon during
+                 * probe, before the admin queue is configured. Thus,
+                 * queue_count can be 0 here.
+                 */
+                if (dev->queue_count)
+                        nvme_suspend_queue(dev->queues[0]);
         } else {
                 nvme_disable_io_queues(dev);
                 nvme_disable_admin_queue(dev, shutdown);
@@ -2112,6 +2117,8 @@ static const struct pci_device_id nvme_id_table[] = {
                 .driver_data = NVME_QUIRK_IDENTIFY_CNS, },
         { PCI_DEVICE(0x1c58, 0x0003),   /* HGST adapter */
                 .driver_data = NVME_QUIRK_DELAY_BEFORE_CHK_RDY, },
+        { PCI_DEVICE(0x1c5f, 0x0540),   /* Memblaze Pblaze4 adapter */
+                .driver_data = NVME_QUIRK_DELAY_BEFORE_CHK_RDY, },
         { PCI_DEVICE_CLASS(PCI_CLASS_STORAGE_EXPRESS, 0xffffff) },
         { PCI_DEVICE(PCI_VENDOR_ID_APPLE, 0x2001) },
         { 0, }
diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
index 8d2875b4c56d..fbdb2267e460 100644
--- a/drivers/nvme/host/rdma.c
+++ b/drivers/nvme/host/rdma.c
@@ -43,10 +43,6 @@
 
 #define NVME_RDMA_MAX_INLINE_SEGMENTS   1
 
-#define NVME_RDMA_MAX_PAGES_PER_MR      512
-
-#define NVME_RDMA_DEF_RECONNECT_DELAY   20
-
 /*
  * We handle AEN commands ourselves and don't even let the
  * block layer know about them.
@@ -77,7 +73,6 @@ struct nvme_rdma_request {
         u32                     num_sge;
         int                     nents;
         bool                    inline_data;
-        bool                    need_inval;
         struct ib_reg_wr        reg_wr;
         struct ib_cqe           reg_cqe;
         struct nvme_rdma_queue  *queue;
@@ -87,6 +82,8 @@ struct nvme_rdma_request {
 
 enum nvme_rdma_queue_flags {
         NVME_RDMA_Q_CONNECTED = (1 << 0),
+        NVME_RDMA_IB_QUEUE_ALLOCATED = (1 << 1),
+        NVME_RDMA_Q_DELETING = (1 << 2),
 };
 
 struct nvme_rdma_queue {
@@ -286,7 +283,7 @@ static int nvme_rdma_reinit_request(void *data, struct request *rq)
         struct nvme_rdma_request *req = blk_mq_rq_to_pdu(rq);
         int ret = 0;
 
-        if (!req->need_inval)
+        if (!req->mr->need_inval)
                 goto out;
 
         ib_dereg_mr(req->mr);
@@ -296,9 +293,10 @@ static int nvme_rdma_reinit_request(void *data, struct request *rq)
         if (IS_ERR(req->mr)) {
                 ret = PTR_ERR(req->mr);
                 req->mr = NULL;
+                goto out;
         }
 
-        req->need_inval = false;
+        req->mr->need_inval = false;
 
 out:
         return ret;
@@ -485,9 +483,14 @@ out_err:
 
 static void nvme_rdma_destroy_queue_ib(struct nvme_rdma_queue *queue)
 {
-        struct nvme_rdma_device *dev = queue->device;
-        struct ib_device *ibdev = dev->dev;
+        struct nvme_rdma_device *dev;
+        struct ib_device *ibdev;
+
+        if (!test_and_clear_bit(NVME_RDMA_IB_QUEUE_ALLOCATED, &queue->flags))
+                return;
 
+        dev = queue->device;
+        ibdev = dev->dev;
         rdma_destroy_qp(queue->cm_id);
         ib_free_cq(queue->ib_cq);
 
@@ -538,6 +541,7 @@ static int nvme_rdma_create_queue_ib(struct nvme_rdma_queue *queue,
                 ret = -ENOMEM;
                 goto out_destroy_qp;
         }
+        set_bit(NVME_RDMA_IB_QUEUE_ALLOCATED, &queue->flags);
 
         return 0;
 
@@ -590,11 +594,13 @@ static int nvme_rdma_init_queue(struct nvme_rdma_ctrl *ctrl,
                 goto out_destroy_cm_id;
         }
 
+        clear_bit(NVME_RDMA_Q_DELETING, &queue->flags);
         set_bit(NVME_RDMA_Q_CONNECTED, &queue->flags);
 
         return 0;
 
 out_destroy_cm_id:
+        nvme_rdma_destroy_queue_ib(queue);
         rdma_destroy_id(queue->cm_id);
         return ret;
 }
@@ -613,7 +619,7 @@ static void nvme_rdma_free_queue(struct nvme_rdma_queue *queue)
 
 static void nvme_rdma_stop_and_free_queue(struct nvme_rdma_queue *queue)
 {
-        if (!test_and_clear_bit(NVME_RDMA_Q_CONNECTED, &queue->flags))
+        if (test_and_set_bit(NVME_RDMA_Q_DELETING, &queue->flags))
                 return;
         nvme_rdma_stop_queue(queue);
         nvme_rdma_free_queue(queue);
@@ -645,7 +651,8 @@ static int nvme_rdma_init_io_queues(struct nvme_rdma_ctrl *ctrl)
         int i, ret;
 
         for (i = 1; i < ctrl->queue_count; i++) {
-                ret = nvme_rdma_init_queue(ctrl, i, ctrl->ctrl.sqsize);
+                ret = nvme_rdma_init_queue(ctrl, i,
+                                           ctrl->ctrl.opts->queue_size);
                 if (ret) {
                         dev_info(ctrl->ctrl.device,
                                 "failed to initialize i/o queue: %d\n", ret);
@@ -656,7 +663,7 @@ static int nvme_rdma_init_io_queues(struct nvme_rdma_ctrl *ctrl)
         return 0;
 
 out_free_queues:
-        for (; i >= 1; i--)
+        for (i--; i >= 1; i--)
                 nvme_rdma_stop_and_free_queue(&ctrl->queues[i]);
 
         return ret;
@@ -765,8 +772,13 @@ static void nvme_rdma_error_recovery_work(struct work_struct *work)
 {
         struct nvme_rdma_ctrl *ctrl = container_of(work,
                         struct nvme_rdma_ctrl, err_work);
+        int i;
 
         nvme_stop_keep_alive(&ctrl->ctrl);
+
+        for (i = 0; i < ctrl->queue_count; i++)
+                clear_bit(NVME_RDMA_Q_CONNECTED, &ctrl->queues[i].flags);
+
         if (ctrl->queue_count > 1)
                 nvme_stop_queues(&ctrl->ctrl);
         blk_mq_stop_hw_queues(ctrl->ctrl.admin_q);
@@ -849,7 +861,7 @@ static void nvme_rdma_unmap_data(struct nvme_rdma_queue *queue,
         if (!blk_rq_bytes(rq))
                 return;
 
-        if (req->need_inval) {
+        if (req->mr->need_inval) {
                 res = nvme_rdma_inv_rkey(queue, req);
                 if (res < 0) {
                         dev_err(ctrl->ctrl.device,
@@ -935,7 +947,7 @@ static int nvme_rdma_map_sg_fr(struct nvme_rdma_queue *queue,
                              IB_ACCESS_REMOTE_READ |
                              IB_ACCESS_REMOTE_WRITE;
 
-        req->need_inval = true;
+        req->mr->need_inval = true;
 
         sg->addr = cpu_to_le64(req->mr->iova);
         put_unaligned_le24(req->mr->length, sg->length);
@@ -958,7 +970,7 @@ static int nvme_rdma_map_data(struct nvme_rdma_queue *queue,
 
         req->num_sge = 1;
         req->inline_data = false;
-        req->need_inval = false;
+        req->mr->need_inval = false;
 
         c->common.flags |= NVME_CMD_SGL_METABUF;
 
@@ -1145,7 +1157,7 @@ static int nvme_rdma_process_nvme_rsp(struct nvme_rdma_queue *queue,
 
         if ((wc->wc_flags & IB_WC_WITH_INVALIDATE) &&
             wc->ex.invalidate_rkey == req->mr->rkey)
-                req->need_inval = false;
+                req->mr->need_inval = false;
 
         blk_mq_complete_request(rq, status);
 
@@ -1278,8 +1290,22 @@ static int nvme_rdma_route_resolved(struct nvme_rdma_queue *queue)
 
         priv.recfmt = cpu_to_le16(NVME_RDMA_CM_FMT_1_0);
         priv.qid = cpu_to_le16(nvme_rdma_queue_idx(queue));
-        priv.hrqsize = cpu_to_le16(queue->queue_size);
-        priv.hsqsize = cpu_to_le16(queue->queue_size);
+        /*
+         * set the admin queue depth to the minimum size
+         * specified by the Fabrics standard.
+         */
+        if (priv.qid == 0) {
+                priv.hrqsize = cpu_to_le16(NVMF_AQ_DEPTH);
+                priv.hsqsize = cpu_to_le16(NVMF_AQ_DEPTH - 1);
+        } else {
+                /*
+                 * current interpretation of the fabrics spec
+                 * is at minimum you make hrqsize sqsize+1, or a
+                 * 1's based representation of sqsize.
+                 */
+                priv.hrqsize = cpu_to_le16(queue->queue_size);
+                priv.hsqsize = cpu_to_le16(queue->ctrl->ctrl.sqsize);
+        }
 
         ret = rdma_connect(queue->cm_id, &param);
         if (ret) {
@@ -1295,58 +1321,6 @@ out_destroy_queue_ib:
         return ret;
 }
 
-/**
- * nvme_rdma_device_unplug() - Handle RDMA device unplug
- * @queue:      Queue that owns the cm_id that caught the event
- *
- * DEVICE_REMOVAL event notifies us that the RDMA device is about
- * to unplug so we should take care of destroying our RDMA resources.
- * This event will be generated for each allocated cm_id.
- *
- * In our case, the RDMA resources are managed per controller and not
- * only per queue. So the way we handle this is we trigger an implicit
- * controller deletion upon the first DEVICE_REMOVAL event we see, and
- * hold the event inflight until the controller deletion is completed.
- *
- * One exception that we need to handle is the destruction of the cm_id
- * that caught the event. Since we hold the callout until the controller
- * deletion is completed, we'll deadlock if the controller deletion will
- * call rdma_destroy_id on this queue's cm_id. Thus, we claim ownership
- * of destroying this queue before-hand, destroy the queue resources,
- * then queue the controller deletion which won't destroy this queue and
- * we destroy the cm_id implicitely by returning a non-zero rc to the callout.
- */
-static int nvme_rdma_device_unplug(struct nvme_rdma_queue *queue)
-{
-        struct nvme_rdma_ctrl *ctrl = queue->ctrl;
-        int ret;
-
-        /* Own the controller deletion */
-        if (!nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_DELETING))
-                return 0;
-
-        dev_warn(ctrl->ctrl.device,
-                "Got rdma device removal event, deleting ctrl\n");
-
-        /* Get rid of reconnect work if its running */
-        cancel_delayed_work_sync(&ctrl->reconnect_work);
-
-        /* Disable the queue so ctrl delete won't free it */
-        if (test_and_clear_bit(NVME_RDMA_Q_CONNECTED, &queue->flags)) {
-                /* Free this queue ourselves */
-                nvme_rdma_stop_queue(queue);
-                nvme_rdma_destroy_queue_ib(queue);
-
-                /* Return non-zero so the cm_id will destroy implicitly */
-                ret = 1;
-        }
-
-        /* Queue controller deletion */
-        queue_work(nvme_rdma_wq, &ctrl->delete_work);
-        flush_work(&ctrl->delete_work);
-        return ret;
-}
-
 static int nvme_rdma_cm_handler(struct rdma_cm_id *cm_id,
                 struct rdma_cm_event *ev)
 {
@@ -1388,8 +1362,8 @@ static int nvme_rdma_cm_handler(struct rdma_cm_id *cm_id,
                 nvme_rdma_error_recovery(queue->ctrl);
                 break;
         case RDMA_CM_EVENT_DEVICE_REMOVAL:
-                /* return 1 means impliciy CM ID destroy */
-                return nvme_rdma_device_unplug(queue);
+                /* device removal is handled via the ib_client API */
+                break;
         default:
                 dev_err(queue->ctrl->ctrl.device,
                         "Unexpected RDMA CM event (%d)\n", ev->event);
@@ -1461,7 +1435,7 @@ static int nvme_rdma_queue_rq(struct blk_mq_hw_ctx *hctx,
         if (rq->cmd_type == REQ_TYPE_FS && req_op(rq) == REQ_OP_FLUSH)
                 flush = true;
         ret = nvme_rdma_post_send(queue, sqe, req->sge, req->num_sge,
-                        req->need_inval ? &req->reg_wr.wr : NULL, flush);
+                        req->mr->need_inval ? &req->reg_wr.wr : NULL, flush);
         if (ret) {
                 nvme_rdma_unmap_data(queue, rq);
                 goto err;
@@ -1690,15 +1664,19 @@ static int __nvme_rdma_del_ctrl(struct nvme_rdma_ctrl *ctrl)
 static int nvme_rdma_del_ctrl(struct nvme_ctrl *nctrl)
 {
         struct nvme_rdma_ctrl *ctrl = to_rdma_ctrl(nctrl);
-        int ret;
+        int ret = 0;
 
+        /*
+         * Keep a reference until all work is flushed since
+         * __nvme_rdma_del_ctrl can free the ctrl mem
+         */
+        if (!kref_get_unless_zero(&ctrl->ctrl.kref))
+                return -EBUSY;
         ret = __nvme_rdma_del_ctrl(ctrl);
-        if (ret)
-                return ret;
-
-        flush_work(&ctrl->delete_work);
-
-        return 0;
+        if (!ret)
+                flush_work(&ctrl->delete_work);
+        nvme_put_ctrl(&ctrl->ctrl);
+        return ret;
 }
 
 static void nvme_rdma_remove_ctrl_work(struct work_struct *work)
@@ -1816,7 +1794,7 @@ static int nvme_rdma_create_io_queues(struct nvme_rdma_ctrl *ctrl)
 
         memset(&ctrl->tag_set, 0, sizeof(ctrl->tag_set));
         ctrl->tag_set.ops = &nvme_rdma_mq_ops;
-        ctrl->tag_set.queue_depth = ctrl->ctrl.sqsize;
+        ctrl->tag_set.queue_depth = ctrl->ctrl.opts->queue_size;
         ctrl->tag_set.reserved_tags = 1; /* fabric connect */
         ctrl->tag_set.numa_node = NUMA_NO_NODE;
         ctrl->tag_set.flags = BLK_MQ_F_SHOULD_MERGE;
@@ -1914,7 +1892,7 @@ static struct nvme_ctrl *nvme_rdma_create_ctrl(struct device *dev,
         spin_lock_init(&ctrl->lock);
 
         ctrl->queue_count = opts->nr_io_queues + 1; /* +1 for admin queue */
-        ctrl->ctrl.sqsize = opts->queue_size;
+        ctrl->ctrl.sqsize = opts->queue_size - 1;
         ctrl->ctrl.kato = opts->kato;
 
         ret = -ENOMEM;
@@ -1995,27 +1973,57 @@ static struct nvmf_transport_ops nvme_rdma_transport = {
         .create_ctrl    = nvme_rdma_create_ctrl,
 };
 
+static void nvme_rdma_add_one(struct ib_device *ib_device)
+{
+}
+
+static void nvme_rdma_remove_one(struct ib_device *ib_device, void *client_data)
+{
+        struct nvme_rdma_ctrl *ctrl;
+
+        /* Delete all controllers using this device */
+        mutex_lock(&nvme_rdma_ctrl_mutex);
+        list_for_each_entry(ctrl, &nvme_rdma_ctrl_list, list) {
+                if (ctrl->device->dev != ib_device)
+                        continue;
+                dev_info(ctrl->ctrl.device,
+                        "Removing ctrl: NQN \"%s\", addr %pISp\n",
+                        ctrl->ctrl.opts->subsysnqn, &ctrl->addr);
+                __nvme_rdma_del_ctrl(ctrl);
+        }
+        mutex_unlock(&nvme_rdma_ctrl_mutex);
+
+        flush_workqueue(nvme_rdma_wq);
+}
+
+static struct ib_client nvme_rdma_ib_client = {
+        .name   = "nvme_rdma",
+        .add = nvme_rdma_add_one,
+        .remove = nvme_rdma_remove_one
+};
+
 static int __init nvme_rdma_init_module(void)
 {
+        int ret;
+
         nvme_rdma_wq = create_workqueue("nvme_rdma_wq");
         if (!nvme_rdma_wq)
                 return -ENOMEM;
 
+        ret = ib_register_client(&nvme_rdma_ib_client);
+        if (ret) {
+                destroy_workqueue(nvme_rdma_wq);
+                return ret;
+        }
+
         nvmf_register_transport(&nvme_rdma_transport);
         return 0;
 }
 
 static void __exit nvme_rdma_cleanup_module(void)
 {
-        struct nvme_rdma_ctrl *ctrl;
-
         nvmf_unregister_transport(&nvme_rdma_transport);
-
-        mutex_lock(&nvme_rdma_ctrl_mutex);
-        list_for_each_entry(ctrl, &nvme_rdma_ctrl_list, list)
-                __nvme_rdma_del_ctrl(ctrl);
-        mutex_unlock(&nvme_rdma_ctrl_mutex);
-
+        ib_unregister_client(&nvme_rdma_ib_client);
         destroy_workqueue(nvme_rdma_wq);
 }
 
diff --git a/drivers/nvme/target/Kconfig b/drivers/nvme/target/Kconfig
index a5c31cbeb481..3a5b9d0576cb 100644
--- a/drivers/nvme/target/Kconfig
+++ b/drivers/nvme/target/Kconfig
@@ -15,8 +15,8 @@ config NVME_TARGET
 
 config NVME_TARGET_LOOP
         tristate "NVMe loopback device support"
-        depends on BLK_DEV_NVME
         depends on NVME_TARGET
+        select NVME_CORE
         select NVME_FABRICS
         select SG_POOL
         help
diff --git a/drivers/nvme/target/loop.c b/drivers/nvme/target/loop.c
index 7affd40a6b33..395e60dad835 100644
--- a/drivers/nvme/target/loop.c
+++ b/drivers/nvme/target/loop.c
@@ -556,7 +556,7 @@ static int nvme_loop_create_io_queues(struct nvme_loop_ctrl *ctrl)
 
         memset(&ctrl->tag_set, 0, sizeof(ctrl->tag_set));
         ctrl->tag_set.ops = &nvme_loop_mq_ops;
-        ctrl->tag_set.queue_depth = ctrl->ctrl.sqsize;
+        ctrl->tag_set.queue_depth = ctrl->ctrl.opts->queue_size;
         ctrl->tag_set.reserved_tags = 1; /* fabric connect */
         ctrl->tag_set.numa_node = NUMA_NO_NODE;
         ctrl->tag_set.flags = BLK_MQ_F_SHOULD_MERGE;
@@ -620,7 +620,7 @@ static struct nvme_ctrl *nvme_loop_create_ctrl(struct device *dev,
 
         ret = -ENOMEM;
 
-        ctrl->ctrl.sqsize = opts->queue_size;
+        ctrl->ctrl.sqsize = opts->queue_size - 1;
         ctrl->ctrl.kato = opts->kato;
 
         ctrl->queues = kcalloc(opts->nr_io_queues + 1, sizeof(*ctrl->queues),
diff --git a/drivers/nvme/target/rdma.c b/drivers/nvme/target/rdma.c
index b4d648536c3e..1cbe6e053b5b 100644
--- a/drivers/nvme/target/rdma.c
+++ b/drivers/nvme/target/rdma.c
@@ -978,10 +978,11 @@ static void nvmet_rdma_release_queue_work(struct work_struct *w)
                 container_of(w, struct nvmet_rdma_queue, release_work);
         struct rdma_cm_id *cm_id = queue->cm_id;
         struct nvmet_rdma_device *dev = queue->dev;
+        enum nvmet_rdma_queue_state state = queue->state;
 
         nvmet_rdma_free_queue(queue);
 
-        if (queue->state != NVMET_RDMA_IN_DEVICE_REMOVAL)
+        if (state != NVMET_RDMA_IN_DEVICE_REMOVAL)
                 rdma_destroy_id(cm_id);
 
         kref_put(&dev->ref, nvmet_rdma_free_dev);
@@ -1003,10 +1004,10 @@ nvmet_rdma_parse_cm_connect_req(struct rdma_conn_param *conn,
         queue->host_qid = le16_to_cpu(req->qid);
 
         /*
-         * req->hsqsize corresponds to our recv queue size
+         * req->hsqsize corresponds to our recv queue size plus 1
          * req->hrqsize corresponds to our send queue size
          */
-        queue->recv_queue_size = le16_to_cpu(req->hsqsize);
+        queue->recv_queue_size = le16_to_cpu(req->hsqsize) + 1;
         queue->send_queue_size = le16_to_cpu(req->hrqsize);
 
         if (!queue->host_qid && queue->recv_queue_size > NVMF_AQ_DEPTH)
diff --git a/drivers/of/base.c b/drivers/of/base.c
index 7792266db259..3ce69536a7b3 100644
--- a/drivers/of/base.c
+++ b/drivers/of/base.c
@@ -1631,8 +1631,7 @@ static int __of_parse_phandle_with_args(const struct device_node *np,
          */
 
  err:
-        if (it.node)
-                of_node_put(it.node);
+        of_node_put(it.node);
         return rc;
 }
 
@@ -2343,20 +2342,13 @@ struct device_node *of_graph_get_endpoint_by_regs(
         const struct device_node *parent, int port_reg, int reg)
 {
         struct of_endpoint endpoint;
-        struct device_node *node, *prev_node = NULL;
-
-        while (1) {
-                node = of_graph_get_next_endpoint(parent, prev_node);
-                of_node_put(prev_node);
-                if (!node)
-                        break;
+        struct device_node *node = NULL;
 
+        for_each_endpoint_of_node(parent, node) {
                 of_graph_parse_endpoint(node, &endpoint);
                 if (((port_reg == -1) || (endpoint.port == port_reg)) &&
                         ((reg == -1) || (endpoint.id == reg)))
                         return node;
-
-                prev_node = node;
         }
 
         return NULL;
diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
index 55f1b8391149..085c6389afd1 100644
--- a/drivers/of/fdt.c
+++ b/drivers/of/fdt.c
@@ -517,7 +517,7 @@ static void *__unflatten_device_tree(const void *blob,
                 pr_warning("End of tree marker overwritten: %08x\n",
                            be32_to_cpup(mem + size));
 
-        if (detached) {
+        if (detached && mynodes) {
                 of_node_set_flag(*mynodes, OF_DETACHED);
                 pr_debug("unflattened tree is detached\n");
         }
diff --git a/drivers/of/irq.c b/drivers/of/irq.c
index 89a71c6074fc..a2e68f740eda 100644
--- a/drivers/of/irq.c
+++ b/drivers/of/irq.c
@@ -544,12 +544,15 @@ void __init of_irq_init(const struct of_device_id *matches)
 
                         list_del(&desc->list);
 
+                        of_node_set_flag(desc->dev, OF_POPULATED);
+
                         pr_debug("of_irq_init: init %s (%p), parent %p\n",
                                  desc->dev->full_name,
                                  desc->dev, desc->interrupt_parent);
                         ret = desc->irq_init_cb(desc->dev,
                                                 desc->interrupt_parent);
                         if (ret) {
+                                of_node_clear_flag(desc->dev, OF_POPULATED);
                                 kfree(desc);
                                 continue;
                         }
@@ -559,8 +562,6 @@ void __init of_irq_init(const struct of_device_id *matches)
                          * its children can get processed in a subsequent pass.
                          */
                         list_add_tail(&desc->list, &intc_parent_list);
-
-                        of_node_set_flag(desc->dev, OF_POPULATED);
                 }
 
                 /* Get the next pending parent that might have children */
diff --git a/drivers/of/platform.c b/drivers/of/platform.c
index 8aa197691074..f39ccd5aa701 100644
--- a/drivers/of/platform.c
+++ b/drivers/of/platform.c
@@ -497,6 +497,7 @@ int of_platform_default_populate(struct device_node *root,
 }
 EXPORT_SYMBOL_GPL(of_platform_default_populate);
 
+#ifndef CONFIG_PPC
 static int __init of_platform_default_populate_init(void)
 {
         struct device_node *node;
@@ -521,6 +522,7 @@ static int __init of_platform_default_populate_init(void)
         return 0;
 }
 arch_initcall_sync(of_platform_default_populate_init);
+#endif
 
 static int of_platform_device_destroy(struct device *dev, void *data)
 {
diff --git a/drivers/pci/host-bridge.c b/drivers/pci/host-bridge.c
index 5f4a2e04c8d7..add66236215c 100644
--- a/drivers/pci/host-bridge.c
+++ b/drivers/pci/host-bridge.c
@@ -44,6 +44,7 @@ void pci_set_host_bridge_release(struct pci_host_bridge *bridge,
         bridge->release_fn = release_fn;
         bridge->release_data = release_data;
 }
+EXPORT_SYMBOL_GPL(pci_set_host_bridge_release);
 
 void pcibios_resource_to_bus(struct pci_bus *bus, struct pci_bus_region *region,
                              struct resource *res)
diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
index eafa6138a6b8..98f12223c734 100644
--- a/drivers/pci/msi.c
+++ b/drivers/pci/msi.c
@@ -1069,7 +1069,7 @@ static int __pci_enable_msi_range(struct pci_dev *dev, int minvec, int maxvec,
                 nvec = maxvec;
 
         for (;;) {
-                if (!(flags & PCI_IRQ_NOAFFINITY)) {
+                if (flags & PCI_IRQ_AFFINITY) {
                         dev->irq_affinity = irq_create_affinity_mask(&nvec);
                         if (nvec < minvec)
                                 return -ENOSPC;
@@ -1105,7 +1105,7 @@ static int __pci_enable_msi_range(struct pci_dev *dev, int minvec, int maxvec,
  **/
 int pci_enable_msi_range(struct pci_dev *dev, int minvec, int maxvec)
 {
-        return __pci_enable_msi_range(dev, minvec, maxvec, PCI_IRQ_NOAFFINITY);
+        return __pci_enable_msi_range(dev, minvec, maxvec, 0);
 }
 EXPORT_SYMBOL(pci_enable_msi_range);
 
@@ -1120,7 +1120,7 @@ static int __pci_enable_msix_range(struct pci_dev *dev,
                 return -ERANGE;
 
         for (;;) {
-                if (!(flags & PCI_IRQ_NOAFFINITY)) {
+                if (flags & PCI_IRQ_AFFINITY) {
                         dev->irq_affinity = irq_create_affinity_mask(&nvec);
                         if (nvec < minvec)
                                 return -ENOSPC;
@@ -1160,8 +1160,7 @@ static int __pci_enable_msix_range(struct pci_dev *dev,
 int pci_enable_msix_range(struct pci_dev *dev, struct msix_entry *entries,
                 int minvec, int maxvec)
 {
-        return __pci_enable_msix_range(dev, entries, minvec, maxvec,
-                        PCI_IRQ_NOAFFINITY);
+        return __pci_enable_msix_range(dev, entries, minvec, maxvec, 0);
 }
 EXPORT_SYMBOL(pci_enable_msix_range);
 
@@ -1187,22 +1186,25 @@ int pci_alloc_irq_vectors(struct pci_dev *dev, unsigned int min_vecs,
 {
         int vecs = -ENOSPC;
 
-        if (!(flags & PCI_IRQ_NOMSIX)) {
+        if (flags & PCI_IRQ_MSIX) {
                 vecs = __pci_enable_msix_range(dev, NULL, min_vecs, max_vecs,
                                 flags);
                 if (vecs > 0)
                         return vecs;
         }
 
-        if (!(flags & PCI_IRQ_NOMSI)) {
+        if (flags & PCI_IRQ_MSI) {
                 vecs = __pci_enable_msi_range(dev, min_vecs, max_vecs, flags);
                 if (vecs > 0)
                         return vecs;
         }
 
         /* use legacy irq if allowed */
-        if (!(flags & PCI_IRQ_NOLEGACY) && min_vecs == 1)
+        if ((flags & PCI_IRQ_LEGACY) && min_vecs == 1) {
+                pci_intx(dev, 1);
                 return 1;
+        }
+
         return vecs;
 }
 EXPORT_SYMBOL(pci_alloc_irq_vectors);
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index 37ff0158e45f..44e0ff37480b 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -3327,9 +3327,9 @@ static void quirk_apple_wait_for_thunderbolt(struct pci_dev *dev)
         if (nhi->vendor != PCI_VENDOR_ID_INTEL
                     || (nhi->device != PCI_DEVICE_ID_INTEL_LIGHT_RIDGE &&
                         nhi->device != PCI_DEVICE_ID_INTEL_CACTUS_RIDGE_4C &&
+                        nhi->device != PCI_DEVICE_ID_INTEL_FALCON_RIDGE_2C_NHI &&
                         nhi->device != PCI_DEVICE_ID_INTEL_FALCON_RIDGE_4C_NHI)
-                    || nhi->subsystem_vendor != 0x2222
-                    || nhi->subsystem_device != 0x1111)
+                    || nhi->class != PCI_CLASS_SYSTEM_OTHER << 8)
                 goto out;
         dev_info(&dev->dev, "quirk: waiting for thunderbolt to reestablish PCI tunnels...\n");
         device_pm_wait_for_dev(&dev->dev, &nhi->dev);
@@ -3344,6 +3344,9 @@ DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_INTEL,
                                PCI_DEVICE_ID_INTEL_CACTUS_RIDGE_4C,
                                quirk_apple_wait_for_thunderbolt);
 DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_INTEL,
+                               PCI_DEVICE_ID_INTEL_FALCON_RIDGE_2C_BRIDGE,
+                               quirk_apple_wait_for_thunderbolt);
+DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_INTEL,
                                PCI_DEVICE_ID_INTEL_FALCON_RIDGE_4C_BRIDGE,
                                quirk_apple_wait_for_thunderbolt);
 #endif
diff --git a/drivers/pci/remove.c b/drivers/pci/remove.c
index d1ef7acf6930..f9357e09e9b3 100644
--- a/drivers/pci/remove.c
+++ b/drivers/pci/remove.c
@@ -40,6 +40,7 @@ static void pci_destroy_dev(struct pci_dev *dev)
         list_del(&dev->bus_list);
         up_write(&pci_bus_sem);
 
+        pci_bridge_d3_device_removed(dev);
         pci_free_resources(dev);
         put_device(&dev->dev);
 }
@@ -96,8 +97,6 @@ static void pci_remove_bus_device(struct pci_dev *dev)
                 dev->subordinate = NULL;
         }
 
-        pci_bridge_d3_device_removed(dev);
-
         pci_destroy_dev(dev);
 }
 
diff --git a/drivers/pcmcia/ds.c b/drivers/pcmcia/ds.c
index 489ea1098c96..69b5e811ea2b 100644
--- a/drivers/pcmcia/ds.c
+++ b/drivers/pcmcia/ds.c
@@ -977,7 +977,7 @@ static int pcmcia_bus_uevent(struct device *dev, struct kobj_uevent_env *env)
 
 /************************ runtime PM support ***************************/
 
-static int pcmcia_dev_suspend(struct device *dev, pm_message_t state);
+static int pcmcia_dev_suspend(struct device *dev);
 static int pcmcia_dev_resume(struct device *dev);
 
 static int runtime_suspend(struct device *dev)
@@ -985,7 +985,7 @@ static int runtime_suspend(struct device *dev)
         int rc;
 
         device_lock(dev);
-        rc = pcmcia_dev_suspend(dev, PMSG_SUSPEND);
+        rc = pcmcia_dev_suspend(dev);
         device_unlock(dev);
         return rc;
 }
@@ -1135,7 +1135,7 @@ ATTRIBUTE_GROUPS(pcmcia_dev);
 
 /* PM support, also needed for reset */
 
-static int pcmcia_dev_suspend(struct device *dev, pm_message_t state)
+static int pcmcia_dev_suspend(struct device *dev)
 {
         struct pcmcia_device *p_dev = to_pcmcia_dev(dev);
         struct pcmcia_driver *p_drv = NULL;
@@ -1410,6 +1410,9 @@ static struct class_interface pcmcia_bus_interface __refdata = {
         .remove_dev = &pcmcia_bus_remove_socket,
 };
 
+static const struct dev_pm_ops pcmcia_bus_pm_ops = {
+        SET_SYSTEM_SLEEP_PM_OPS(pcmcia_dev_suspend, pcmcia_dev_resume)
+};
 
 struct bus_type pcmcia_bus_type = {
         .name = "pcmcia",
@@ -1418,8 +1421,7 @@ struct bus_type pcmcia_bus_type = {
         .dev_groups = pcmcia_dev_groups,
         .probe = pcmcia_device_probe,
         .remove = pcmcia_device_remove,
-        .suspend = pcmcia_dev_suspend,
-        .resume = pcmcia_dev_resume,
+        .pm = &pcmcia_bus_pm_ops,
 };
 
 
diff --git a/drivers/pcmcia/pxa2xx_base.c b/drivers/pcmcia/pxa2xx_base.c
index 483f919e0d2e..91b5f5724cba 100644
--- a/drivers/pcmcia/pxa2xx_base.c
+++ b/drivers/pcmcia/pxa2xx_base.c
@@ -214,9 +214,8 @@ pxa2xx_pcmcia_frequency_change(struct soc_pcmcia_socket *skt,
 }
 #endif
 
-void pxa2xx_configure_sockets(struct device *dev)
+void pxa2xx_configure_sockets(struct device *dev, struct pcmcia_low_level *ops)
 {
-        struct pcmcia_low_level *ops = dev->platform_data;
         /*
          * We have at least one socket, so set MECR:CIT
          * (Card Is There)
@@ -322,7 +321,7 @@ static int pxa2xx_drv_pcmcia_probe(struct platform_device *dev)
                         goto err1;
         }
 
-        pxa2xx_configure_sockets(&dev->dev);
+        pxa2xx_configure_sockets(&dev->dev, ops);
         dev_set_drvdata(&dev->dev, sinfo);
 
         return 0;
@@ -348,7 +347,9 @@ static int pxa2xx_drv_pcmcia_remove(struct platform_device *dev)
 
 static int pxa2xx_drv_pcmcia_resume(struct device *dev)
 {
-        pxa2xx_configure_sockets(dev);
+        struct pcmcia_low_level *ops = (struct pcmcia_low_level *)dev->platform_data;
+
+        pxa2xx_configure_sockets(dev, ops);
         return 0;
 }
 
diff --git a/drivers/pcmcia/pxa2xx_base.h b/drivers/pcmcia/pxa2xx_base.h
index b609b45469ed..e58c7a415418 100644
--- a/drivers/pcmcia/pxa2xx_base.h
+++ b/drivers/pcmcia/pxa2xx_base.h
@@ -1,4 +1,4 @@
 int pxa2xx_drv_pcmcia_add_one(struct soc_pcmcia_socket *skt);
 void pxa2xx_drv_pcmcia_ops(struct pcmcia_low_level *ops);
-void pxa2xx_configure_sockets(struct device *dev);
+void pxa2xx_configure_sockets(struct device *dev, struct pcmcia_low_level *ops);
 
diff --git a/drivers/pcmcia/sa1111_badge4.c b/drivers/pcmcia/sa1111_badge4.c
index 12f0dd091477..2f490930430d 100644
--- a/drivers/pcmcia/sa1111_badge4.c
+++ b/drivers/pcmcia/sa1111_badge4.c
@@ -134,20 +134,14 @@ static struct pcmcia_low_level badge4_pcmcia_ops = {
 
 int pcmcia_badge4_init(struct sa1111_dev *dev)
 {
-        int ret = -ENODEV;
-
-        if (machine_is_badge4()) {
-                printk(KERN_INFO
-                       "%s: badge4_pcmvcc=%d, badge4_pcmvpp=%d, badge4_cfvcc=%d\n",
-                       __func__,
-                       badge4_pcmvcc, badge4_pcmvpp, badge4_cfvcc);
-
-                sa11xx_drv_pcmcia_ops(&badge4_pcmcia_ops);
-                ret = sa1111_pcmcia_add(dev, &badge4_pcmcia_ops,
-                                sa11xx_drv_pcmcia_add_one);
-        }
-
-        return ret;
+        printk(KERN_INFO
+               "%s: badge4_pcmvcc=%d, badge4_pcmvpp=%d, badge4_cfvcc=%d\n",
+               __func__,
+               badge4_pcmvcc, badge4_pcmvpp, badge4_cfvcc);
+
+        sa11xx_drv_pcmcia_ops(&badge4_pcmcia_ops);
+        return sa1111_pcmcia_add(dev, &badge4_pcmcia_ops,
+                                 sa11xx_drv_pcmcia_add_one);
 }
 
 static int __init pcmv_setup(char *s)
diff --git a/drivers/pcmcia/sa1111_generic.c b/drivers/pcmcia/sa1111_generic.c
index a1531feb8460..3d95dffcff7a 100644
--- a/drivers/pcmcia/sa1111_generic.c
+++ b/drivers/pcmcia/sa1111_generic.c
@@ -18,6 +18,7 @@
 
 #include <mach/hardware.h>
 #include <asm/hardware/sa1111.h>
+#include <asm/mach-types.h>
 #include <asm/irq.h>
 
 #include "sa1111_generic.h"
@@ -203,19 +204,30 @@ static int pcmcia_probe(struct sa1111_dev *dev)
         sa1111_writel(PCSSR_S0_SLEEP | PCSSR_S1_SLEEP, base + PCSSR);
         sa1111_writel(PCCR_S0_FLT | PCCR_S1_FLT, base + PCCR);
 
+        ret = -ENODEV;
 #ifdef CONFIG_SA1100_BADGE4
-        pcmcia_badge4_init(dev);
+        if (machine_is_badge4())
+                ret = pcmcia_badge4_init(dev);
 #endif
 #ifdef CONFIG_SA1100_JORNADA720
-        pcmcia_jornada720_init(dev);
+        if (machine_is_jornada720())
+                ret = pcmcia_jornada720_init(dev);
 #endif
 #ifdef CONFIG_ARCH_LUBBOCK
-        pcmcia_lubbock_init(dev);
+        if (machine_is_lubbock())
+                ret = pcmcia_lubbock_init(dev);
 #endif
 #ifdef CONFIG_ASSABET_NEPONSET
-        pcmcia_neponset_init(dev);
+        if (machine_is_assabet())
+                ret = pcmcia_neponset_init(dev);
 #endif
-        return 0;
+
+        if (ret) {
+                release_mem_region(dev->res.start, 512);
+                sa1111_disable_device(dev);
+        }
+
+        return ret;
 }
 
 static int pcmcia_remove(struct sa1111_dev *dev)
diff --git a/drivers/pcmcia/sa1111_jornada720.c b/drivers/pcmcia/sa1111_jornada720.c
index c2c30580c83f..480a3ede27c8 100644
--- a/drivers/pcmcia/sa1111_jornada720.c
+++ b/drivers/pcmcia/sa1111_jornada720.c
@@ -94,22 +94,17 @@ static struct pcmcia_low_level jornada720_pcmcia_ops = {
 
 int pcmcia_jornada720_init(struct sa1111_dev *sadev)
 {
-        int ret = -ENODEV;
+        unsigned int pin = GPIO_A0 | GPIO_A1 | GPIO_A2 | GPIO_A3;
 
-        if (machine_is_jornada720()) {
-                unsigned int pin = GPIO_A0 | GPIO_A1 | GPIO_A2 | GPIO_A3;
+        /* Fixme: why messing around with SA11x0's GPIO1? */
+        GRER |= 0x00000002;
 
-                GRER |= 0x00000002;
+        /* Set GPIO_A<3:1> to be outputs for PCMCIA/CF power controller: */
+        sa1111_set_io_dir(sadev, pin, 0, 0);
+        sa1111_set_io(sadev, pin, 0);
+        sa1111_set_sleep_io(sadev, pin, 0);
 
-                /* Set GPIO_A<3:1> to be outputs for PCMCIA/CF power controller: */
-                sa1111_set_io_dir(sadev, pin, 0, 0);
-                sa1111_set_io(sadev, pin, 0);
-                sa1111_set_sleep_io(sadev, pin, 0);
-
-                sa11xx_drv_pcmcia_ops(&jornada720_pcmcia_ops);
-                ret = sa1111_pcmcia_add(sadev, &jornada720_pcmcia_ops,
-                                sa11xx_drv_pcmcia_add_one);
-        }
-
-        return ret;
+        sa11xx_drv_pcmcia_ops(&jornada720_pcmcia_ops);
+        return sa1111_pcmcia_add(sadev, &jornada720_pcmcia_ops,
+                                 sa11xx_drv_pcmcia_add_one);
 }
diff --git a/drivers/pcmcia/sa1111_lubbock.c b/drivers/pcmcia/sa1111_lubbock.c
index c5caf5790451..e741f499c875 100644
--- a/drivers/pcmcia/sa1111_lubbock.c
+++ b/drivers/pcmcia/sa1111_lubbock.c
@@ -210,27 +210,21 @@ static struct pcmcia_low_level lubbock_pcmcia_ops = {
 
 int pcmcia_lubbock_init(struct sa1111_dev *sadev)
 {
-        int ret = -ENODEV;
-
-        if (machine_is_lubbock()) {
-                /*
-                 * Set GPIO_A<3:0> to be outputs for the MAX1600,
-                 * and switch to standby mode.
-                 */
-                sa1111_set_io_dir(sadev, GPIO_A0|GPIO_A1|GPIO_A2|GPIO_A3, 0, 0);
-                sa1111_set_io(sadev, GPIO_A0|GPIO_A1|GPIO_A2|GPIO_A3, 0);
-                sa1111_set_sleep_io(sadev, GPIO_A0|GPIO_A1|GPIO_A2|GPIO_A3, 0);
-
-                /* Set CF Socket 1 power to standby mode. */
-                lubbock_set_misc_wr((1 << 15) | (1 << 14), 0);
+        /*
+         * Set GPIO_A<3:0> to be outputs for the MAX1600,
+         * and switch to standby mode.
+         */
+        sa1111_set_io_dir(sadev, GPIO_A0|GPIO_A1|GPIO_A2|GPIO_A3, 0, 0);
+        sa1111_set_io(sadev, GPIO_A0|GPIO_A1|GPIO_A2|GPIO_A3, 0);
+        sa1111_set_sleep_io(sadev, GPIO_A0|GPIO_A1|GPIO_A2|GPIO_A3, 0);
 
-                pxa2xx_drv_pcmcia_ops(&lubbock_pcmcia_ops);
-                pxa2xx_configure_sockets(&sadev->dev);
-                ret = sa1111_pcmcia_add(sadev, &lubbock_pcmcia_ops,
-                                pxa2xx_drv_pcmcia_add_one);
-        }
+        /* Set CF Socket 1 power to standby mode. */
+        lubbock_set_misc_wr((1 << 15) | (1 << 14), 0);
 
-        return ret;
+        pxa2xx_drv_pcmcia_ops(&lubbock_pcmcia_ops);
+        pxa2xx_configure_sockets(&sadev->dev, &lubbock_pcmcia_ops);
+        return sa1111_pcmcia_add(sadev, &lubbock_pcmcia_ops,
+                                 pxa2xx_drv_pcmcia_add_one);
 }
 
 MODULE_LICENSE("GPL");
diff --git a/drivers/pcmcia/sa1111_neponset.c b/drivers/pcmcia/sa1111_neponset.c
index 1d78739c4c07..019c395eb4bf 100644
--- a/drivers/pcmcia/sa1111_neponset.c
+++ b/drivers/pcmcia/sa1111_neponset.c
@@ -110,20 +110,14 @@ static struct pcmcia_low_level neponset_pcmcia_ops = {
 
 int pcmcia_neponset_init(struct sa1111_dev *sadev)
 {
-        int ret = -ENODEV;
-
-        if (machine_is_assabet()) {
-                /*
-                 * Set GPIO_A<3:0> to be outputs for the MAX1600,
-                 * and switch to standby mode.
-                 */
-                sa1111_set_io_dir(sadev, GPIO_A0|GPIO_A1|GPIO_A2|GPIO_A3, 0, 0);
-                sa1111_set_io(sadev, GPIO_A0|GPIO_A1|GPIO_A2|GPIO_A3, 0);
-                sa1111_set_sleep_io(sadev, GPIO_A0|GPIO_A1|GPIO_A2|GPIO_A3, 0);
-                sa11xx_drv_pcmcia_ops(&neponset_pcmcia_ops);
-                ret = sa1111_pcmcia_add(sadev, &neponset_pcmcia_ops,
-                                sa11xx_drv_pcmcia_add_one);
-        }
-
-        return ret;
+        /*
+         * Set GPIO_A<3:0> to be outputs for the MAX1600,
+         * and switch to standby mode.
+         */
+        sa1111_set_io_dir(sadev, GPIO_A0|GPIO_A1|GPIO_A2|GPIO_A3, 0, 0);
+        sa1111_set_io(sadev, GPIO_A0|GPIO_A1|GPIO_A2|GPIO_A3, 0);
+        sa1111_set_sleep_io(sadev, GPIO_A0|GPIO_A1|GPIO_A2|GPIO_A3, 0);
+        sa11xx_drv_pcmcia_ops(&neponset_pcmcia_ops);
+        return sa1111_pcmcia_add(sadev, &neponset_pcmcia_ops,
+                                 sa11xx_drv_pcmcia_add_one);
 }
diff --git a/drivers/pcmcia/sa11xx_base.c b/drivers/pcmcia/sa11xx_base.c
index 9f6ec87b9f9e..48140ac73ed6 100644
--- a/drivers/pcmcia/sa11xx_base.c
+++ b/drivers/pcmcia/sa11xx_base.c
@@ -144,19 +144,19 @@ static int
 sa1100_pcmcia_show_timing(struct soc_pcmcia_socket *skt, char *buf)
 {
         struct soc_pcmcia_timing timing;
-        unsigned int clock = clk_get_rate(skt->clk);
+        unsigned int clock = clk_get_rate(skt->clk) / 1000;
         unsigned long mecr = MECR;
         char *p = buf;
 
         soc_common_pcmcia_get_timing(skt, &timing);
 
-        p+=sprintf(p, "I/O      : %u (%u)\n", timing.io,
+        p+=sprintf(p, "I/O      : %uns (%uns)\n", timing.io,
                    sa1100_pcmcia_cmd_time(clock, MECR_BSIO_GET(mecr, skt->nr)));
 
-        p+=sprintf(p, "attribute: %u (%u)\n", timing.attr,
+        p+=sprintf(p, "attribute: %uns (%uns)\n", timing.attr,
                    sa1100_pcmcia_cmd_time(clock, MECR_BSA_GET(mecr, skt->nr)));
 
-        p+=sprintf(p, "common   : %u (%u)\n", timing.mem,
+        p+=sprintf(p, "common   : %uns (%uns)\n", timing.mem,
                    sa1100_pcmcia_cmd_time(clock, MECR_BSM_GET(mecr, skt->nr)));
 
         return p - buf;
diff --git a/drivers/pcmcia/soc_common.c b/drivers/pcmcia/soc_common.c
index eed5e9c05353..d5ca760c4eb2 100644
--- a/drivers/pcmcia/soc_common.c
+++ b/drivers/pcmcia/soc_common.c
@@ -235,7 +235,7 @@ static unsigned int soc_common_pcmcia_skt_state(struct soc_pcmcia_socket *skt)
         stat |= skt->cs_state.Vcc ? SS_POWERON : 0;
 
         if (skt->cs_state.flags & SS_IOCARD)
-                stat |= state.bvd1 ? SS_STSCHG : 0;
+                stat |= state.bvd1 ? 0 : SS_STSCHG;
         else {
                 if (state.bvd1 == 0)
                         stat |= SS_BATDEAD;
diff --git a/drivers/perf/arm_pmu.c b/drivers/perf/arm_pmu.c
index c494613c1909..f5e1008a223d 100644
--- a/drivers/perf/arm_pmu.c
+++ b/drivers/perf/arm_pmu.c
@@ -925,6 +925,7 @@ static int of_pmu_irq_cfg(struct arm_pmu *pmu)
                         if (i > 0 && spi != using_spi) {
                                 pr_err("PPI/SPI IRQ type mismatch for %s!\n",
                                         dn->name);
+                                of_node_put(dn);
                                 kfree(irqs);
                                 return -EINVAL;
                         }
@@ -969,7 +970,7 @@ static int of_pmu_irq_cfg(struct arm_pmu *pmu)
         if (cpumask_weight(&pmu->supported_cpus) == 0) {
                 int irq = platform_get_irq(pdev, 0);
 
-                if (irq_is_percpu(irq)) {
+                if (irq >= 0 && irq_is_percpu(irq)) {
                         /* If using PPIs, check the affinity of the partition */
                         int ret;
 
diff --git a/drivers/phy/phy-brcm-sata.c b/drivers/phy/phy-brcm-sata.c
index 18d662610075..8ffc44afdb75 100644
--- a/drivers/phy/phy-brcm-sata.c
+++ b/drivers/phy/phy-brcm-sata.c
@@ -367,7 +367,7 @@ static int brcm_sata_phy_init(struct phy *phy)
                 rc = -ENODEV;
         };
 
-        return 0;
+        return rc;
 }
 
 static const struct phy_ops phy_ops = {
diff --git a/drivers/phy/phy-sun4i-usb.c b/drivers/phy/phy-sun4i-usb.c
index 0a45bc6088ae..8c7eb335622e 100644
--- a/drivers/phy/phy-sun4i-usb.c
+++ b/drivers/phy/phy-sun4i-usb.c
@@ -40,6 +40,7 @@
 #include <linux/power_supply.h>
 #include <linux/regulator/consumer.h>
 #include <linux/reset.h>
+#include <linux/usb/of.h>
 #include <linux/workqueue.h>
 
 #define REG_ISCR                        0x00
@@ -110,6 +111,7 @@ struct sun4i_usb_phy_cfg {
 struct sun4i_usb_phy_data {
         void __iomem *base;
         const struct sun4i_usb_phy_cfg *cfg;
+        enum usb_dr_mode dr_mode;
         struct mutex mutex;
         struct sun4i_usb_phy {
                 struct phy *phy;
@@ -120,6 +122,7 @@ struct sun4i_usb_phy_data {
                 bool regulator_on;
                 int index;
         } phys[MAX_PHYS];
+        int first_phy;
         /* phy0 / otg related variables */
         struct extcon_dev *extcon;
         bool phy0_init;
@@ -285,16 +288,10 @@ static int sun4i_usb_phy_init(struct phy *_phy)
                 sun4i_usb_phy0_update_iscr(_phy, 0, ISCR_DPDM_PULLUP_EN);
                 sun4i_usb_phy0_update_iscr(_phy, 0, ISCR_ID_PULLUP_EN);
 
-                if (data->id_det_gpio) {
-                        /* OTG mode, force ISCR and cable state updates */
-                        data->id_det = -1;
-                        data->vbus_det = -1;
-                        queue_delayed_work(system_wq, &data->detect, 0);
-                } else {
-                        /* Host only mode */
-                        sun4i_usb_phy0_set_id_detect(_phy, 0);
-                        sun4i_usb_phy0_set_vbus_detect(_phy, 1);
-                }
+                /* Force ISCR and cable state updates */
+                data->id_det = -1;
+                data->vbus_det = -1;
+                queue_delayed_work(system_wq, &data->detect, 0);
         }
 
         return 0;
@@ -319,6 +316,19 @@ static int sun4i_usb_phy_exit(struct phy *_phy)
         return 0;
 }
 
+static int sun4i_usb_phy0_get_id_det(struct sun4i_usb_phy_data *data)
+{
+        switch (data->dr_mode) {
+        case USB_DR_MODE_OTG:
+                return gpiod_get_value_cansleep(data->id_det_gpio);
+        case USB_DR_MODE_HOST:
+                return 0;
+        case USB_DR_MODE_PERIPHERAL:
+        default:
+                return 1;
+        }
+}
+
 static int sun4i_usb_phy0_get_vbus_det(struct sun4i_usb_phy_data *data)
 {
         if (data->vbus_det_gpio)
@@ -432,7 +442,10 @@ static void sun4i_usb_phy0_id_vbus_det_scan(struct work_struct *work)
         struct phy *phy0 = data->phys[0].phy;
         int id_det, vbus_det, id_notify = 0, vbus_notify = 0;
 
-        id_det = gpiod_get_value_cansleep(data->id_det_gpio);
+        if (phy0 == NULL)
+                return;
+
+        id_det = sun4i_usb_phy0_get_id_det(data);
         vbus_det = sun4i_usb_phy0_get_vbus_det(data);
 
         mutex_lock(&phy0->mutex);
@@ -448,7 +461,8 @@ static void sun4i_usb_phy0_id_vbus_det_scan(struct work_struct *work)
                  * without vbus detection report vbus low for long enough for
                  * the musb-ip to end the current device session.
                  */
-                if (!sun4i_usb_phy0_have_vbus_det(data) && id_det == 0) {
+                if (data->dr_mode == USB_DR_MODE_OTG &&
+                    !sun4i_usb_phy0_have_vbus_det(data) && id_det == 0) {
                         sun4i_usb_phy0_set_vbus_detect(phy0, 0);
                         msleep(200);
                         sun4i_usb_phy0_set_vbus_detect(phy0, 1);
@@ -474,7 +488,8 @@ static void sun4i_usb_phy0_id_vbus_det_scan(struct work_struct *work)
                  * without vbus detection report vbus low for long enough to
                  * the musb-ip to end the current host session.
                  */
-                if (!sun4i_usb_phy0_have_vbus_det(data) && id_det == 1) {
+                if (data->dr_mode == USB_DR_MODE_OTG &&
+                    !sun4i_usb_phy0_have_vbus_det(data) && id_det == 1) {
                         mutex_lock(&phy0->mutex);
                         sun4i_usb_phy0_set_vbus_detect(phy0, 0);
                         msleep(1000);
@@ -519,7 +534,8 @@ static struct phy *sun4i_usb_phy_xlate(struct device *dev,
 {
         struct sun4i_usb_phy_data *data = dev_get_drvdata(dev);
 
-        if (args->args[0] >= data->cfg->num_phys)
+        if (args->args[0] < data->first_phy ||
+            args->args[0] >= data->cfg->num_phys)
                 return ERR_PTR(-ENODEV);
 
         return data->phys[args->args[0]].phy;
@@ -593,13 +609,17 @@ static int sun4i_usb_phy_probe(struct platform_device *pdev)
                         return -EPROBE_DEFER;
         }
 
-        /* vbus_det without id_det makes no sense, and is not supported */
-        if (sun4i_usb_phy0_have_vbus_det(data) && !data->id_det_gpio) {
-                dev_err(dev, "usb0_id_det missing or invalid\n");
-                return -ENODEV;
-        }
-
-        if (data->id_det_gpio) {
+        data->dr_mode = of_usb_get_dr_mode_by_phy(np, 0);
+        switch (data->dr_mode) {
+        case USB_DR_MODE_OTG:
+                /* otg without id_det makes no sense, and is not supported */
+                if (!data->id_det_gpio) {
+                        dev_err(dev, "usb0_id_det missing or invalid\n");
+                        return -ENODEV;
+                }
+                /* fall through */
+        case USB_DR_MODE_HOST:
+        case USB_DR_MODE_PERIPHERAL:
                 data->extcon = devm_extcon_dev_allocate(dev,
                                                         sun4i_usb_phy0_cable);
                 if (IS_ERR(data->extcon))
@@ -610,9 +630,13 @@ static int sun4i_usb_phy_probe(struct platform_device *pdev)
                         dev_err(dev, "failed to register extcon: %d\n", ret);
                         return ret;
                 }
+                break;
+        default:
+                dev_info(dev, "dr_mode unknown, not registering usb phy0\n");
+                data->first_phy = 1;
         }
 
-        for (i = 0; i < data->cfg->num_phys; i++) {
+        for (i = data->first_phy; i < data->cfg->num_phys; i++) {
                 struct sun4i_usb_phy *phy = data->phys + i;
                 char name[16];
 
diff --git a/drivers/phy/phy-sun9i-usb.c b/drivers/phy/phy-sun9i-usb.c
index ac4f31abefe3..28fce4bce638 100644
--- a/drivers/phy/phy-sun9i-usb.c
+++ b/drivers/phy/phy-sun9i-usb.c
@@ -141,9 +141,9 @@ static int sun9i_usb_phy_probe(struct platform_device *pdev)
                 }
 
                 phy->hsic_clk = devm_clk_get(dev, "hsic_12M");
-                if (IS_ERR(phy->clk)) {
+                if (IS_ERR(phy->hsic_clk)) {
                         dev_err(dev, "failed to get hsic_12M clock\n");
-                        return PTR_ERR(phy->clk);
+                        return PTR_ERR(phy->hsic_clk);
                 }
 
                 phy->reset = devm_reset_control_get(dev, "hsic");
diff --git a/drivers/pinctrl/intel/pinctrl-cherryview.c b/drivers/pinctrl/intel/pinctrl-cherryview.c
index 5749a4eee746..0fe8fad25e4d 100644
--- a/drivers/pinctrl/intel/pinctrl-cherryview.c
+++ b/drivers/pinctrl/intel/pinctrl-cherryview.c
@@ -1539,12 +1539,11 @@ static int chv_gpio_probe(struct chv_pinctrl *pctrl, int irq)
                 offset += range->npins;
         }
 
-        /* Mask and clear all interrupts */
-        chv_writel(0, pctrl->regs + CHV_INTMASK);
+        /* Clear all interrupts */
         chv_writel(0xffff, pctrl->regs + CHV_INTSTAT);
 
         ret = gpiochip_irqchip_add(chip, &chv_gpio_irqchip, 0,
-                                   handle_simple_irq, IRQ_TYPE_NONE);
+                                   handle_bad_irq, IRQ_TYPE_NONE);
         if (ret) {
                 dev_err(pctrl->dev, "failed to add IRQ chip\n");
                 goto fail;
diff --git a/drivers/pinctrl/intel/pinctrl-merrifield.c b/drivers/pinctrl/intel/pinctrl-merrifield.c
index eb4990ff26ca..7fb765642ee7 100644
--- a/drivers/pinctrl/intel/pinctrl-merrifield.c
+++ b/drivers/pinctrl/intel/pinctrl-merrifield.c
@@ -11,6 +11,7 @@
 
 #include <linux/bitops.h>
 #include <linux/err.h>
+#include <linux/io.h>
 #include <linux/module.h>
 #include <linux/platform_device.h>
 #include <linux/pinctrl/pinconf.h>
diff --git a/drivers/pinctrl/meson/pinctrl-meson.c b/drivers/pinctrl/meson/pinctrl-meson.c
index 11623c6b0cb3..44e69c963f5d 100644
--- a/drivers/pinctrl/meson/pinctrl-meson.c
+++ b/drivers/pinctrl/meson/pinctrl-meson.c
@@ -727,13 +727,7 @@ static int meson_pinctrl_probe(struct platform_device *pdev)
                 return PTR_ERR(pc->pcdev);
         }
 
-        ret = meson_gpiolib_register(pc);
-        if (ret) {
-                pinctrl_unregister(pc->pcdev);
-                return ret;
-        }
-
-        return 0;
+        return meson_gpiolib_register(pc);
 }
 
 static struct platform_driver meson_pinctrl_driver = {
diff --git a/drivers/pinctrl/pinctrl-amd.c b/drivers/pinctrl/pinctrl-amd.c
index 634b4d30eefb..b3e772390ab6 100644
--- a/drivers/pinctrl/pinctrl-amd.c
+++ b/drivers/pinctrl/pinctrl-amd.c
@@ -43,17 +43,6 @@ static int amd_gpio_direction_input(struct gpio_chip *gc, unsigned offset)
 
         spin_lock_irqsave(&gpio_dev->lock, flags);
         pin_reg = readl(gpio_dev->base + offset * 4);
-        /*
-         * Suppose BIOS or Bootloader sets specific debounce for the
-         * GPIO. if not, set debounce to be  2.75ms and remove glitch.
-        */
-        if ((pin_reg & DB_TMR_OUT_MASK) == 0) {
-                pin_reg |= 0xf;
-                pin_reg |= BIT(DB_TMR_OUT_UNIT_OFF);
-                pin_reg |= DB_TYPE_REMOVE_GLITCH << DB_CNTRL_OFF;
-                pin_reg &= ~BIT(DB_TMR_LARGE_OFF);
-        }
-
         pin_reg &= ~BIT(OUTPUT_ENABLE_OFF);
         writel(pin_reg, gpio_dev->base + offset * 4);
         spin_unlock_irqrestore(&gpio_dev->lock, flags);
@@ -326,15 +315,6 @@ static void amd_gpio_irq_enable(struct irq_data *d)
 
         spin_lock_irqsave(&gpio_dev->lock, flags);
         pin_reg = readl(gpio_dev->base + (d->hwirq)*4);
-        /*
-                Suppose BIOS or Bootloader sets specific debounce for the
-                GPIO. if not, set debounce to be  2.75ms.
-        */
-        if ((pin_reg & DB_TMR_OUT_MASK) == 0) {
-                pin_reg |= 0xf;
-                pin_reg |= BIT(DB_TMR_OUT_UNIT_OFF);
-                pin_reg &= ~BIT(DB_TMR_LARGE_OFF);
-        }
         pin_reg |= BIT(INTERRUPT_ENABLE_OFF);
         pin_reg |= BIT(INTERRUPT_MASK_OFF);
         writel(pin_reg, gpio_dev->base + (d->hwirq)*4);
diff --git a/drivers/pinctrl/pinctrl-pistachio.c b/drivers/pinctrl/pinctrl-pistachio.c
index c6d410ef8de0..55375b1b3cc8 100644
--- a/drivers/pinctrl/pinctrl-pistachio.c
+++ b/drivers/pinctrl/pinctrl-pistachio.c
@@ -809,17 +809,17 @@ static const struct pistachio_pin_group pistachio_groups[] = {
                            PADS_FUNCTION_SELECT2, 12, 0x3),
         MFIO_MUX_PIN_GROUP(83, MIPS_PLL_LOCK, MIPS_TRACE_DATA, USB_DEBUG,
                            PADS_FUNCTION_SELECT2, 14, 0x3),
-        MFIO_MUX_PIN_GROUP(84, SYS_PLL_LOCK, MIPS_TRACE_DATA, USB_DEBUG,
+        MFIO_MUX_PIN_GROUP(84, AUDIO_PLL_LOCK, MIPS_TRACE_DATA, USB_DEBUG,
                            PADS_FUNCTION_SELECT2, 16, 0x3),
-        MFIO_MUX_PIN_GROUP(85, WIFI_PLL_LOCK, MIPS_TRACE_DATA, SDHOST_DEBUG,
+        MFIO_MUX_PIN_GROUP(85, RPU_V_PLL_LOCK, MIPS_TRACE_DATA, SDHOST_DEBUG,
                            PADS_FUNCTION_SELECT2, 18, 0x3),
-        MFIO_MUX_PIN_GROUP(86, BT_PLL_LOCK, MIPS_TRACE_DATA, SDHOST_DEBUG,
+        MFIO_MUX_PIN_GROUP(86, RPU_L_PLL_LOCK, MIPS_TRACE_DATA, SDHOST_DEBUG,
                            PADS_FUNCTION_SELECT2, 20, 0x3),
-        MFIO_MUX_PIN_GROUP(87, RPU_V_PLL_LOCK, DREQ2, SOCIF_DEBUG,
+        MFIO_MUX_PIN_GROUP(87, SYS_PLL_LOCK, DREQ2, SOCIF_DEBUG,
                            PADS_FUNCTION_SELECT2, 22, 0x3),
-        MFIO_MUX_PIN_GROUP(88, RPU_L_PLL_LOCK, DREQ3, SOCIF_DEBUG,
+        MFIO_MUX_PIN_GROUP(88, WIFI_PLL_LOCK, DREQ3, SOCIF_DEBUG,
                            PADS_FUNCTION_SELECT2, 24, 0x3),
-        MFIO_MUX_PIN_GROUP(89, AUDIO_PLL_LOCK, DREQ4, DREQ5,
+        MFIO_MUX_PIN_GROUP(89, BT_PLL_LOCK, DREQ4, DREQ5,
                            PADS_FUNCTION_SELECT2, 26, 0x3),
         PIN_GROUP(TCK, "tck"),
         PIN_GROUP(TRSTN, "trstn"),
@@ -1432,7 +1432,6 @@ static int pistachio_pinctrl_probe(struct platform_device *pdev)
 {
         struct pistachio_pinctrl *pctl;
         struct resource *res;
-        int ret;
 
         pctl = devm_kzalloc(&pdev->dev, sizeof(*pctl), GFP_KERNEL);
         if (!pctl)
@@ -1464,13 +1463,7 @@ static int pistachio_pinctrl_probe(struct platform_device *pdev)
                 return PTR_ERR(pctl->pctldev);
         }
 
-        ret = pistachio_gpio_register(pctl);
-        if (ret < 0) {
-                pinctrl_unregister(pctl->pctldev);
-                return ret;
-        }
-
-        return 0;
+        return pistachio_gpio_register(pctl);
 }
 
 static struct platform_driver pistachio_pinctrl_driver = {
diff --git a/drivers/pinctrl/sunxi/pinctrl-sun8i-a23.c b/drivers/pinctrl/sunxi/pinctrl-sun8i-a23.c
index ce483b03a263..f9d661e5c14a 100644
--- a/drivers/pinctrl/sunxi/pinctrl-sun8i-a23.c
+++ b/drivers/pinctrl/sunxi/pinctrl-sun8i-a23.c
@@ -485,12 +485,12 @@ static const struct sunxi_desc_pin sun8i_a23_pins[] = {
         SUNXI_PIN(SUNXI_PINCTRL_PIN(G, 8),
                   SUNXI_FUNCTION(0x0, "gpio_in"),
                   SUNXI_FUNCTION(0x1, "gpio_out"),
-                  SUNXI_FUNCTION(0x2, "uart2"),         /* RTS */
+                  SUNXI_FUNCTION(0x2, "uart1"),         /* RTS */
                   SUNXI_FUNCTION_IRQ_BANK(0x4, 2, 8)),  /* PG_EINT8 */
         SUNXI_PIN(SUNXI_PINCTRL_PIN(G, 9),
                   SUNXI_FUNCTION(0x0, "gpio_in"),
                   SUNXI_FUNCTION(0x1, "gpio_out"),
-                  SUNXI_FUNCTION(0x2, "uart2"),         /* CTS */
+                  SUNXI_FUNCTION(0x2, "uart1"),         /* CTS */
                   SUNXI_FUNCTION_IRQ_BANK(0x4, 2, 9)),  /* PG_EINT9 */
         SUNXI_PIN(SUNXI_PINCTRL_PIN(G, 10),
                   SUNXI_FUNCTION(0x0, "gpio_in"),
diff --git a/drivers/pinctrl/sunxi/pinctrl-sun8i-a33.c b/drivers/pinctrl/sunxi/pinctrl-sun8i-a33.c
index 3040abe6f73a..3131cac2b76f 100644
--- a/drivers/pinctrl/sunxi/pinctrl-sun8i-a33.c
+++ b/drivers/pinctrl/sunxi/pinctrl-sun8i-a33.c
@@ -407,12 +407,12 @@ static const struct sunxi_desc_pin sun8i_a33_pins[] = {
         SUNXI_PIN(SUNXI_PINCTRL_PIN(G, 8),
                   SUNXI_FUNCTION(0x0, "gpio_in"),
                   SUNXI_FUNCTION(0x1, "gpio_out"),
-                  SUNXI_FUNCTION(0x2, "uart2"),         /* RTS */
+                  SUNXI_FUNCTION(0x2, "uart1"),         /* RTS */
                   SUNXI_FUNCTION_IRQ_BANK(0x4, 1, 8)),  /* PG_EINT8 */
         SUNXI_PIN(SUNXI_PINCTRL_PIN(G, 9),
                   SUNXI_FUNCTION(0x0, "gpio_in"),
                   SUNXI_FUNCTION(0x1, "gpio_out"),
-                  SUNXI_FUNCTION(0x2, "uart2"),         /* CTS */
+                  SUNXI_FUNCTION(0x2, "uart1"),         /* CTS */
                   SUNXI_FUNCTION_IRQ_BANK(0x4, 1, 9)),  /* PG_EINT9 */
         SUNXI_PIN(SUNXI_PINCTRL_PIN(G, 10),
                   SUNXI_FUNCTION(0x0, "gpio_in"),
diff --git a/drivers/platform/olpc/olpc-ec.c b/drivers/platform/olpc/olpc-ec.c
index f99b183d5296..374a8028fec7 100644
--- a/drivers/platform/olpc/olpc-ec.c
+++ b/drivers/platform/olpc/olpc-ec.c
@@ -1,6 +1,8 @@
 /*
  * Generic driver for the OLPC Embedded Controller.
  *
+ * Author: Andres Salomon <dilinger@queued.net>
+ *
  * Copyright (C) 2011-2012 One Laptop per Child Foundation.
  *
  * Licensed under the GPL v2 or later.
@@ -12,7 +14,7 @@
 #include <linux/platform_device.h>
 #include <linux/slab.h>
 #include <linux/workqueue.h>
-#include <linux/module.h>
+#include <linux/init.h>
 #include <linux/list.h>
 #include <linux/olpc-ec.h>
 #include <asm/olpc.h>
@@ -326,8 +328,4 @@ static int __init olpc_ec_init_module(void)
 {
         return platform_driver_register(&olpc_ec_plat_driver);
 }
-
 arch_initcall(olpc_ec_init_module);
-
-MODULE_AUTHOR("Andres Salomon <dilinger@queued.net>");
-MODULE_LICENSE("GPL");
diff --git a/drivers/platform/x86/intel_pmic_gpio.c b/drivers/platform/x86/intel_pmic_gpio.c
index 63b371d6ee55..91ae58510d92 100644
--- a/drivers/platform/x86/intel_pmic_gpio.c
+++ b/drivers/platform/x86/intel_pmic_gpio.c
@@ -1,6 +1,8 @@
 /* Moorestown PMIC GPIO (access through IPC) driver
  * Copyright (c) 2008 - 2009, Intel Corporation.
  *
+ * Author: Alek Du <alek.du@intel.com>
+ *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
@@ -21,7 +23,6 @@
 
 #define pr_fmt(fmt) "%s: " fmt, __func__
 
-#include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/interrupt.h>
 #include <linux/delay.h>
@@ -322,9 +323,4 @@ static int __init platform_pmic_gpio_init(void)
 {
         return platform_driver_register(&platform_pmic_gpio_driver);
 }
-
 subsys_initcall(platform_pmic_gpio_init);
-
-MODULE_AUTHOR("Alek Du <alek.du@intel.com>");
-MODULE_DESCRIPTION("Intel Moorestown PMIC GPIO driver");
-MODULE_LICENSE("GPL v2");
diff --git a/drivers/power/max17042_battery.c b/drivers/power/max17042_battery.c
index 9c65f134d447..da7a75f82489 100644
--- a/drivers/power/max17042_battery.c
+++ b/drivers/power/max17042_battery.c
@@ -457,13 +457,16 @@ static inline void max17042_write_model_data(struct max17042_chip *chip,
 }
 
 static inline void max17042_read_model_data(struct max17042_chip *chip,
-                                        u8 addr, u32 *data, int size)
+                                        u8 addr, u16 *data, int size)
 {
         struct regmap *map = chip->regmap;
         int i;
+        u32 tmp;
 
-        for (i = 0; i < size; i++)
-                regmap_read(map, addr + i, &data[i]);
+        for (i = 0; i < size; i++) {
+                regmap_read(map, addr + i, &tmp);
+                data[i] = (u16)tmp;
+        }
 }
 
 static inline int max17042_model_data_compare(struct max17042_chip *chip,
@@ -486,7 +489,7 @@ static int max17042_init_model(struct max17042_chip *chip)
 {
         int ret;
         int table_size = ARRAY_SIZE(chip->pdata->config_data->cell_char_tbl);
-        u32 *temp_data;
+        u16 *temp_data;
 
         temp_data = kcalloc(table_size, sizeof(*temp_data), GFP_KERNEL);
         if (!temp_data)
@@ -501,7 +504,7 @@ static int max17042_init_model(struct max17042_chip *chip)
         ret = max17042_model_data_compare(
                 chip,
                 chip->pdata->config_data->cell_char_tbl,
-                (u16 *)temp_data,
+                temp_data,
                 table_size);
 
         max10742_lock_model(chip);
@@ -514,7 +517,7 @@ static int max17042_verify_model_lock(struct max17042_chip *chip)
 {
         int i;
         int table_size = ARRAY_SIZE(chip->pdata->config_data->cell_char_tbl);
-        u32 *temp_data;
+        u16 *temp_data;
         int ret = 0;
 
         temp_data = kcalloc(table_size, sizeof(*temp_data), GFP_KERNEL);
diff --git a/drivers/power/reset/Kconfig b/drivers/power/reset/Kconfig
index 3bfac539334b..c74c3f67b8da 100644
--- a/drivers/power/reset/Kconfig
+++ b/drivers/power/reset/Kconfig
@@ -200,8 +200,8 @@ config REBOOT_MODE
 config SYSCON_REBOOT_MODE
         tristate "Generic SYSCON regmap reboot mode driver"
         depends on OF
+        depends on MFD_SYSCON
         select REBOOT_MODE
-        select MFD_SYSCON
         help
           Say y here will enable reboot mode driver. This will
           get reboot mode arguments and store it in SYSCON mapped
diff --git a/drivers/power/reset/hisi-reboot.c b/drivers/power/reset/hisi-reboot.c
index 9ab7f562a83b..f69387e12c1e 100644
--- a/drivers/power/reset/hisi-reboot.c
+++ b/drivers/power/reset/hisi-reboot.c
@@ -53,13 +53,16 @@ static int hisi_reboot_probe(struct platform_device *pdev)
 
         if (of_property_read_u32(np, "reboot-offset", &reboot_offset) < 0) {
                 pr_err("failed to find reboot-offset property\n");
+                iounmap(base);
                 return -EINVAL;
         }
 
         err = register_restart_handler(&hisi_restart_nb);
-        if (err)
+        if (err) {
                 dev_err(&pdev->dev, "cannot register restart handler (err=%d)\n",
                         err);
+                iounmap(base);
+        }
 
         return err;
 }
diff --git a/drivers/power/tps65217_charger.c b/drivers/power/tps65217_charger.c
index 73dfae41def8..4c56e54af6ac 100644
--- a/drivers/power/tps65217_charger.c
+++ b/drivers/power/tps65217_charger.c
@@ -206,6 +206,7 @@ static int tps65217_charger_probe(struct platform_device *pdev)
         if (!charger)
                 return -ENOMEM;
 
+        platform_set_drvdata(pdev, charger);
         charger->tps = tps;
         charger->dev = &pdev->dev;
 
diff --git a/drivers/rapidio/devices/tsi721.c b/drivers/rapidio/devices/tsi721.c
index 32f0f014a067..9d19b9a62011 100644
--- a/drivers/rapidio/devices/tsi721.c
+++ b/drivers/rapidio/devices/tsi721.c
@@ -1161,7 +1161,7 @@ static int tsi721_rio_map_inb_mem(struct rio_mport *mport, dma_addr_t lstart,
                 } else if (ibw_start < (ib_win->rstart + ib_win->size) &&
                            (ibw_start + ibw_size) > ib_win->rstart) {
                         /* Return error if address translation involved */
-                        if (direct && ib_win->xlat) {
+                        if (!direct || ib_win->xlat) {
                                 ret = -EFAULT;
                                 break;
                         }
diff --git a/drivers/rapidio/rio_cm.c b/drivers/rapidio/rio_cm.c
index 3fa17ac8df54..cebc296463ad 100644
--- a/drivers/rapidio/rio_cm.c
+++ b/drivers/rapidio/rio_cm.c
@@ -2247,17 +2247,30 @@ static int rio_cm_shutdown(struct notifier_block *nb, unsigned long code,
 {
         struct rio_channel *ch;
         unsigned int i;
+        LIST_HEAD(list);
 
         riocm_debug(EXIT, ".");
 
+        /*
+         * If there are any channels left in connected state send
+         * close notification to the connection partner.
+         * First build a list of channels that require a closing
+         * notification because function riocm_send_close() should
+         * be called outside of spinlock protected code.
+         */
         spin_lock_bh(&idr_lock);
         idr_for_each_entry(&ch_idr, ch, i) {
-                riocm_debug(EXIT, "close ch %d", ch->id);
-                if (ch->state == RIO_CM_CONNECTED)
-                        riocm_send_close(ch);
+                if (ch->state == RIO_CM_CONNECTED) {
+                        riocm_debug(EXIT, "close ch %d", ch->id);
+                        idr_remove(&ch_idr, ch->id);
+                        list_add(&ch->ch_node, &list);
+                }
         }
         spin_unlock_bh(&idr_lock);
 
+        list_for_each_entry(ch, &list, ch_node)
+                riocm_send_close(ch);
+
         return NOTIFY_DONE;
 }
 
diff --git a/drivers/regulator/max14577-regulator.c b/drivers/regulator/max14577-regulator.c
index b2daa6641417..c9ff26199711 100644
--- a/drivers/regulator/max14577-regulator.c
+++ b/drivers/regulator/max14577-regulator.c
@@ -2,7 +2,7 @@
  * max14577.c - Regulator driver for the Maxim 14577/77836
  *
  * Copyright (C) 2013,2014 Samsung Electronics
- * Krzysztof Kozlowski <k.kozlowski@samsung.com>
+ * Krzysztof Kozlowski <krzk@kernel.org>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -331,7 +331,7 @@ static void __exit max14577_regulator_exit(void)
 }
 module_exit(max14577_regulator_exit);
 
-MODULE_AUTHOR("Krzysztof Kozlowski <k.kozlowski@samsung.com>");
+MODULE_AUTHOR("Krzysztof Kozlowski <krzk@kernel.org>");
 MODULE_DESCRIPTION("Maxim 14577/77836 regulator driver");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS("platform:max14577-regulator");
diff --git a/drivers/regulator/max77693-regulator.c b/drivers/regulator/max77693-regulator.c
index de730fd3f8a5..cfbb9512e486 100644
--- a/drivers/regulator/max77693-regulator.c
+++ b/drivers/regulator/max77693-regulator.c
@@ -3,7 +3,7 @@
  *
  * Copyright (C) 2013-2015 Samsung Electronics
  * Jonghwa Lee <jonghwa3.lee@samsung.com>
- * Krzysztof Kozlowski <k.kozlowski.k@gmail.com>
+ * Krzysztof Kozlowski <krzk@kernel.org>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -314,5 +314,5 @@ module_exit(max77693_pmic_cleanup);
 
 MODULE_DESCRIPTION("MAXIM 77693/77843 regulator driver");
 MODULE_AUTHOR("Jonghwa Lee <jonghwa3.lee@samsung.com>");
-MODULE_AUTHOR("Krzysztof Kozlowski <k.kozlowski.k@gmail.com>");
+MODULE_AUTHOR("Krzysztof Kozlowski <krzk@kernel.org>");
 MODULE_LICENSE("GPL");
diff --git a/drivers/regulator/qcom_smd-regulator.c b/drivers/regulator/qcom_smd-regulator.c
index 5022fa8d10c6..8ed46a9a55c8 100644
--- a/drivers/regulator/qcom_smd-regulator.c
+++ b/drivers/regulator/qcom_smd-regulator.c
@@ -178,20 +178,21 @@ static const struct regulator_desc pma8084_hfsmps = {
 static const struct regulator_desc pma8084_ftsmps = {
         .linear_ranges = (struct regulator_linear_range[]) {
                 REGULATOR_LINEAR_RANGE(350000,  0, 184, 5000),
-                REGULATOR_LINEAR_RANGE(700000, 185, 339, 10000),
+                REGULATOR_LINEAR_RANGE(1280000, 185, 261, 10000),
         },
         .n_linear_ranges = 2,
-        .n_voltages = 340,
+        .n_voltages = 262,
         .ops = &rpm_smps_ldo_ops,
 };
 
 static const struct regulator_desc pma8084_pldo = {
         .linear_ranges = (struct regulator_linear_range[]) {
-                REGULATOR_LINEAR_RANGE(750000,  0,  30, 25000),
-                REGULATOR_LINEAR_RANGE(1500000, 31, 99, 50000),
+                REGULATOR_LINEAR_RANGE( 750000,  0,  63, 12500),
+                REGULATOR_LINEAR_RANGE(1550000, 64, 126, 25000),
+                REGULATOR_LINEAR_RANGE(3100000, 127, 163, 50000),
         },
-        .n_linear_ranges = 2,
-        .n_voltages = 100,
+        .n_linear_ranges = 3,
+        .n_voltages = 164,
         .ops = &rpm_smps_ldo_ops,
 };
 
@@ -221,29 +222,30 @@ static const struct regulator_desc pm8x41_hfsmps = {
 static const struct regulator_desc pm8841_ftsmps = {
         .linear_ranges = (struct regulator_linear_range[]) {
                 REGULATOR_LINEAR_RANGE(350000,  0, 184, 5000),
-                REGULATOR_LINEAR_RANGE(700000, 185, 339, 10000),
+                REGULATOR_LINEAR_RANGE(1280000, 185, 261, 10000),
         },
         .n_linear_ranges = 2,
-        .n_voltages = 340,
+        .n_voltages = 262,
         .ops = &rpm_smps_ldo_ops,
 };
 
 static const struct regulator_desc pm8941_boost = {
         .linear_ranges = (struct regulator_linear_range[]) {
-                REGULATOR_LINEAR_RANGE(4000000, 0, 15, 100000),
+                REGULATOR_LINEAR_RANGE(4000000, 0, 30, 50000),
         },
         .n_linear_ranges = 1,
-        .n_voltages = 16,
+        .n_voltages = 31,
         .ops = &rpm_smps_ldo_ops,
 };
 
 static const struct regulator_desc pm8941_pldo = {
         .linear_ranges = (struct regulator_linear_range[]) {
-                REGULATOR_LINEAR_RANGE( 750000,  0,  30, 25000),
-                REGULATOR_LINEAR_RANGE(1500000, 31, 99, 50000),
+                REGULATOR_LINEAR_RANGE( 750000,  0,  63, 12500),
+                REGULATOR_LINEAR_RANGE(1550000, 64, 126, 25000),
+                REGULATOR_LINEAR_RANGE(3100000, 127, 163, 50000),
         },
-        .n_linear_ranges = 2,
-        .n_voltages = 100,
+        .n_linear_ranges = 3,
+        .n_voltages = 164,
         .ops = &rpm_smps_ldo_ops,
 };
 
diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
index 8973d34ce5ba..fb1b56a71475 100644
--- a/drivers/s390/block/dasd.c
+++ b/drivers/s390/block/dasd.c
@@ -1643,9 +1643,18 @@ void dasd_int_handler(struct ccw_device *cdev, unsigned long intparm,
         u8 *sense = NULL;
         int expires;
 
+        cqr = (struct dasd_ccw_req *) intparm;
         if (IS_ERR(irb)) {
                 switch (PTR_ERR(irb)) {
                 case -EIO:
+                        if (cqr && cqr->status == DASD_CQR_CLEAR_PENDING) {
+                                device = (struct dasd_device *) cqr->startdev;
+                                cqr->status = DASD_CQR_CLEARED;
+                                dasd_device_clear_timer(device);
+                                wake_up(&dasd_flush_wq);
+                                dasd_schedule_device_bh(device);
+                                return;
+                        }
                         break;
                 case -ETIMEDOUT:
                         DBF_EVENT_DEVID(DBF_WARNING, cdev, "%s: "
@@ -1661,7 +1670,6 @@ void dasd_int_handler(struct ccw_device *cdev, unsigned long intparm,
         }
 
         now = get_tod_clock();
-        cqr = (struct dasd_ccw_req *) intparm;
         /* check for conditions that should be handled immediately */
         if (!cqr ||
             !(scsw_dstat(&irb->scsw) == (DEV_STAT_CHN_END | DEV_STAT_DEV_END) &&
diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c
index fd2eff440098..98bbec44bcd0 100644
--- a/drivers/s390/block/dasd_eckd.c
+++ b/drivers/s390/block/dasd_eckd.c
@@ -5078,6 +5078,8 @@ static int dasd_eckd_read_message_buffer(struct dasd_device *device,
                 return PTR_ERR(cqr);
         }
 
+        cqr->lpm = lpum;
+retry:
         cqr->startdev = device;
         cqr->memdev = device;
         cqr->block = NULL;
@@ -5122,6 +5124,14 @@ static int dasd_eckd_read_message_buffer(struct dasd_device *device,
                         (prssdp + 1);
                 memcpy(messages, message_buf,
                        sizeof(struct dasd_rssd_messages));
+        } else if (cqr->lpm) {
+                /*
+                 * on z/VM we might not be able to do I/O on the requested path
+                 * but instead we get the required information on any path
+                 * so retry with open path mask
+                 */
+                cqr->lpm = 0;
+                goto retry;
         } else
                 DBF_EVENT_DEVID(DBF_WARNING, device->cdev,
                                 "Reading messages failed with rc=%d\n"
diff --git a/drivers/s390/cio/device.c b/drivers/s390/cio/device.c
index 7ada078ffdd0..6a58bc8f46e2 100644
--- a/drivers/s390/cio/device.c
+++ b/drivers/s390/cio/device.c
@@ -762,7 +762,6 @@ static int io_subchannel_initialize_dev(struct subchannel *sch,
         priv->state = DEV_STATE_NOT_OPER;
         priv->dev_id.devno = sch->schib.pmcw.dev;
         priv->dev_id.ssid = sch->schid.ssid;
-        priv->schid = sch->schid;
 
         INIT_WORK(&priv->todo_work, ccw_device_todo);
         INIT_LIST_HEAD(&priv->cmb_list);
@@ -1000,7 +999,6 @@ static int ccw_device_move_to_sch(struct ccw_device *cdev,
         put_device(&old_sch->dev);
         /* Initialize new subchannel. */
         spin_lock_irq(sch->lock);
-        cdev->private->schid = sch->schid;
         cdev->ccwlock = sch->lock;
         if (!sch_is_pseudo_sch(sch))
                 sch_set_cdev(sch, cdev);
diff --git a/drivers/s390/cio/device_status.c b/drivers/s390/cio/device_status.c
index 15b56a15db15..9bc3512374c9 100644
--- a/drivers/s390/cio/device_status.c
+++ b/drivers/s390/cio/device_status.c
@@ -26,6 +26,7 @@
 static void
 ccw_device_msg_control_check(struct ccw_device *cdev, struct irb *irb)
 {
+        struct subchannel *sch = to_subchannel(cdev->dev.parent);
         char dbf_text[15];
 
         if (!scsw_is_valid_cstat(&irb->scsw) ||
@@ -36,10 +37,10 @@ ccw_device_msg_control_check(struct ccw_device *cdev, struct irb *irb)
                       "received"
                       " ... device %04x on subchannel 0.%x.%04x, dev_stat "
                       ": %02X sch_stat : %02X\n",
-                      cdev->private->dev_id.devno, cdev->private->schid.ssid,
-                      cdev->private->schid.sch_no,
+                      cdev->private->dev_id.devno, sch->schid.ssid,
+                      sch->schid.sch_no,
                       scsw_dstat(&irb->scsw), scsw_cstat(&irb->scsw));
-        sprintf(dbf_text, "chk%x", cdev->private->schid.sch_no);
+        sprintf(dbf_text, "chk%x", sch->schid.sch_no);
         CIO_TRACE_EVENT(0, dbf_text);
         CIO_HEX_EVENT(0, irb, sizeof(struct irb));
 }
diff --git a/drivers/s390/cio/io_sch.h b/drivers/s390/cio/io_sch.h
index 8975060af96c..220f49145b2f 100644
--- a/drivers/s390/cio/io_sch.h
+++ b/drivers/s390/cio/io_sch.h
@@ -120,7 +120,6 @@ struct ccw_device_private {
         int state;              /* device state */
         atomic_t onoff;
         struct ccw_dev_id dev_id;       /* device id */
-        struct subchannel_id schid;     /* subchannel number */
         struct ccw_request req;         /* internal I/O request */
         int iretry;
         u8 pgid_valid_mask;     /* mask of valid PGIDs */
diff --git a/drivers/s390/cio/qdio_main.c b/drivers/s390/cio/qdio_main.c
index 4bb5262f7aee..71bf9bded485 100644
--- a/drivers/s390/cio/qdio_main.c
+++ b/drivers/s390/cio/qdio_main.c
@@ -686,6 +686,15 @@ static void qdio_kick_handler(struct qdio_q *q)
         q->qdio_error = 0;
 }
 
+static inline int qdio_tasklet_schedule(struct qdio_q *q)
+{
+        if (likely(q->irq_ptr->state == QDIO_IRQ_STATE_ACTIVE)) {
+                tasklet_schedule(&q->tasklet);
+                return 0;
+        }
+        return -EPERM;
+}
+
 static void __qdio_inbound_processing(struct qdio_q *q)
 {
         qperf_inc(q, tasklet_inbound);
@@ -698,10 +707,8 @@ static void __qdio_inbound_processing(struct qdio_q *q)
         if (!qdio_inbound_q_done(q)) {
                 /* means poll time is not yet over */
                 qperf_inc(q, tasklet_inbound_resched);
-                if (likely(q->irq_ptr->state != QDIO_IRQ_STATE_STOPPED)) {
-                        tasklet_schedule(&q->tasklet);
+                if (!qdio_tasklet_schedule(q))
                         return;
-                }
         }
 
         qdio_stop_polling(q);
@@ -711,8 +718,7 @@ static void __qdio_inbound_processing(struct qdio_q *q)
          */
         if (!qdio_inbound_q_done(q)) {
                 qperf_inc(q, tasklet_inbound_resched2);
-                if (likely(q->irq_ptr->state != QDIO_IRQ_STATE_STOPPED))
-                        tasklet_schedule(&q->tasklet);
+                qdio_tasklet_schedule(q);
         }
 }
 
@@ -869,16 +875,15 @@ static void __qdio_outbound_processing(struct qdio_q *q)
          * is noticed and outbound_handler is called after some time.
          */
         if (qdio_outbound_q_done(q))
-                del_timer(&q->u.out.timer);
+                del_timer_sync(&q->u.out.timer);
         else
-                if (!timer_pending(&q->u.out.timer))
+                if (!timer_pending(&q->u.out.timer) &&
+                    likely(q->irq_ptr->state == QDIO_IRQ_STATE_ACTIVE))
                         mod_timer(&q->u.out.timer, jiffies + 10 * HZ);
         return;
 
 sched:
-        if (unlikely(q->irq_ptr->state == QDIO_IRQ_STATE_STOPPED))
-                return;
-        tasklet_schedule(&q->tasklet);
+        qdio_tasklet_schedule(q);
 }
 
 /* outbound tasklet */
@@ -892,9 +897,7 @@ void qdio_outbound_timer(unsigned long data)
 {
         struct qdio_q *q = (struct qdio_q *)data;
 
-        if (unlikely(q->irq_ptr->state == QDIO_IRQ_STATE_STOPPED))
-                return;
-        tasklet_schedule(&q->tasklet);
+        qdio_tasklet_schedule(q);
 }
 
 static inline void qdio_check_outbound_after_thinint(struct qdio_q *q)
@@ -907,7 +910,7 @@ static inline void qdio_check_outbound_after_thinint(struct qdio_q *q)
 
         for_each_output_queue(q->irq_ptr, out, i)
                 if (!qdio_outbound_q_done(out))
-                        tasklet_schedule(&out->tasklet);
+                        qdio_tasklet_schedule(out);
 }
 
 static void __tiqdio_inbound_processing(struct qdio_q *q)
@@ -929,10 +932,8 @@ static void __tiqdio_inbound_processing(struct qdio_q *q)
 
         if (!qdio_inbound_q_done(q)) {
                 qperf_inc(q, tasklet_inbound_resched);
-                if (likely(q->irq_ptr->state != QDIO_IRQ_STATE_STOPPED)) {
-                        tasklet_schedule(&q->tasklet);
+                if (!qdio_tasklet_schedule(q))
                         return;
-                }
         }
 
         qdio_stop_polling(q);
@@ -942,8 +943,7 @@ static void __tiqdio_inbound_processing(struct qdio_q *q)
          */
         if (!qdio_inbound_q_done(q)) {
                 qperf_inc(q, tasklet_inbound_resched2);
-                if (likely(q->irq_ptr->state != QDIO_IRQ_STATE_STOPPED))
-                        tasklet_schedule(&q->tasklet);
+                qdio_tasklet_schedule(q);
         }
 }
 
@@ -977,7 +977,7 @@ static void qdio_int_handler_pci(struct qdio_irq *irq_ptr)
         int i;
         struct qdio_q *q;
 
-        if (unlikely(irq_ptr->state == QDIO_IRQ_STATE_STOPPED))
+        if (unlikely(irq_ptr->state != QDIO_IRQ_STATE_ACTIVE))
                 return;
 
         for_each_input_queue(irq_ptr, q, i) {
@@ -1003,7 +1003,7 @@ static void qdio_int_handler_pci(struct qdio_irq *irq_ptr)
                         continue;
                 if (need_siga_sync(q) && need_siga_sync_out_after_pci(q))
                         qdio_siga_sync_q(q);
-                tasklet_schedule(&q->tasklet);
+                qdio_tasklet_schedule(q);
         }
 }
 
@@ -1066,10 +1066,12 @@ void qdio_int_handler(struct ccw_device *cdev, unsigned long intparm,
                       struct irb *irb)
 {
         struct qdio_irq *irq_ptr = cdev->private->qdio_data;
+        struct subchannel_id schid;
         int cstat, dstat;
 
         if (!intparm || !irq_ptr) {
-                DBF_ERROR("qint:%4x", cdev->private->schid.sch_no);
+                ccw_device_get_schid(cdev, &schid);
+                DBF_ERROR("qint:%4x", schid.sch_no);
                 return;
         }
 
@@ -1122,12 +1124,14 @@ void qdio_int_handler(struct ccw_device *cdev, unsigned long intparm,
 int qdio_get_ssqd_desc(struct ccw_device *cdev,
                        struct qdio_ssqd_desc *data)
 {
+        struct subchannel_id schid;
 
         if (!cdev || !cdev->private)
                 return -EINVAL;
 
-        DBF_EVENT("get ssqd:%4x", cdev->private->schid.sch_no);
-        return qdio_setup_get_ssqd(NULL, &cdev->private->schid, data);
+        ccw_device_get_schid(cdev, &schid);
+        DBF_EVENT("get ssqd:%4x", schid.sch_no);
+        return qdio_setup_get_ssqd(NULL, &schid, data);
 }
 EXPORT_SYMBOL_GPL(qdio_get_ssqd_desc);
 
@@ -1141,7 +1145,7 @@ static void qdio_shutdown_queues(struct ccw_device *cdev)
                 tasklet_kill(&q->tasklet);
 
         for_each_output_queue(irq_ptr, q, i) {
-                del_timer(&q->u.out.timer);
+                del_timer_sync(&q->u.out.timer);
                 tasklet_kill(&q->tasklet);
         }
 }
@@ -1154,14 +1158,15 @@ static void qdio_shutdown_queues(struct ccw_device *cdev)
 int qdio_shutdown(struct ccw_device *cdev, int how)
 {
         struct qdio_irq *irq_ptr = cdev->private->qdio_data;
+        struct subchannel_id schid;
         int rc;
-        unsigned long flags;
 
         if (!irq_ptr)
                 return -ENODEV;
 
         WARN_ON_ONCE(irqs_disabled());
-        DBF_EVENT("qshutdown:%4x", cdev->private->schid.sch_no);
+        ccw_device_get_schid(cdev, &schid);
+        DBF_EVENT("qshutdown:%4x", schid.sch_no);
 
         mutex_lock(&irq_ptr->setup_mutex);
         /*
@@ -1184,7 +1189,7 @@ int qdio_shutdown(struct ccw_device *cdev, int how)
         qdio_shutdown_debug_entries(irq_ptr);
 
         /* cleanup subchannel */
-        spin_lock_irqsave(get_ccwdev_lock(cdev), flags);
+        spin_lock_irq(get_ccwdev_lock(cdev));
 
         if (how & QDIO_FLAG_CLEANUP_USING_CLEAR)
                 rc = ccw_device_clear(cdev, QDIO_DOING_CLEANUP);
@@ -1198,12 +1203,12 @@ int qdio_shutdown(struct ccw_device *cdev, int how)
         }
 
         qdio_set_state(irq_ptr, QDIO_IRQ_STATE_CLEANUP);
-        spin_unlock_irqrestore(get_ccwdev_lock(cdev), flags);
+        spin_unlock_irq(get_ccwdev_lock(cdev));
         wait_event_interruptible_timeout(cdev->private->wait_q,
                 irq_ptr->state == QDIO_IRQ_STATE_INACTIVE ||
                 irq_ptr->state == QDIO_IRQ_STATE_ERR,
                 10 * HZ);
-        spin_lock_irqsave(get_ccwdev_lock(cdev), flags);
+        spin_lock_irq(get_ccwdev_lock(cdev));
 
 no_cleanup:
         qdio_shutdown_thinint(irq_ptr);
@@ -1211,7 +1216,7 @@ no_cleanup:
         /* restore interrupt handler */
         if ((void *)cdev->handler == (void *)qdio_int_handler)
                 cdev->handler = irq_ptr->orig_handler;
-        spin_unlock_irqrestore(get_ccwdev_lock(cdev), flags);
+        spin_unlock_irq(get_ccwdev_lock(cdev));
 
         qdio_set_state(irq_ptr, QDIO_IRQ_STATE_INACTIVE);
         mutex_unlock(&irq_ptr->setup_mutex);
@@ -1228,11 +1233,13 @@ EXPORT_SYMBOL_GPL(qdio_shutdown);
 int qdio_free(struct ccw_device *cdev)
 {
         struct qdio_irq *irq_ptr = cdev->private->qdio_data;
+        struct subchannel_id schid;
 
         if (!irq_ptr)
                 return -ENODEV;
 
-        DBF_EVENT("qfree:%4x", cdev->private->schid.sch_no);
+        ccw_device_get_schid(cdev, &schid);
+        DBF_EVENT("qfree:%4x", schid.sch_no);
         DBF_DEV_EVENT(DBF_ERR, irq_ptr, "dbf abandoned");
         mutex_lock(&irq_ptr->setup_mutex);
 
@@ -1251,9 +1258,11 @@ EXPORT_SYMBOL_GPL(qdio_free);
  */
 int qdio_allocate(struct qdio_initialize *init_data)
 {
+        struct subchannel_id schid;
         struct qdio_irq *irq_ptr;
 
-        DBF_EVENT("qallocate:%4x", init_data->cdev->private->schid.sch_no);
+        ccw_device_get_schid(init_data->cdev, &schid);
+        DBF_EVENT("qallocate:%4x", schid.sch_no);
 
         if ((init_data->no_input_qs && !init_data->input_handler) ||
             (init_data->no_output_qs && !init_data->output_handler))
@@ -1331,20 +1340,18 @@ static void qdio_detect_hsicq(struct qdio_irq *irq_ptr)
  */
 int qdio_establish(struct qdio_initialize *init_data)
 {
-        struct qdio_irq *irq_ptr;
         struct ccw_device *cdev = init_data->cdev;
-        unsigned long saveflags;
+        struct subchannel_id schid;
+        struct qdio_irq *irq_ptr;
         int rc;
 
-        DBF_EVENT("qestablish:%4x", cdev->private->schid.sch_no);
+        ccw_device_get_schid(cdev, &schid);
+        DBF_EVENT("qestablish:%4x", schid.sch_no);
 
         irq_ptr = cdev->private->qdio_data;
         if (!irq_ptr)
                 return -ENODEV;
 
-        if (cdev->private->state != DEV_STATE_ONLINE)
-                return -EINVAL;
-
         mutex_lock(&irq_ptr->setup_mutex);
         qdio_setup_irq(init_data);
 
@@ -1361,17 +1368,14 @@ int qdio_establish(struct qdio_initialize *init_data)
         irq_ptr->ccw.count = irq_ptr->equeue.count;
         irq_ptr->ccw.cda = (u32)((addr_t)irq_ptr->qdr);
 
-        spin_lock_irqsave(get_ccwdev_lock(cdev), saveflags);
+        spin_lock_irq(get_ccwdev_lock(cdev));
         ccw_device_set_options_mask(cdev, 0);
 
         rc = ccw_device_start(cdev, &irq_ptr->ccw, QDIO_DOING_ESTABLISH, 0, 0);
+        spin_unlock_irq(get_ccwdev_lock(cdev));
         if (rc) {
                 DBF_ERROR("%4x est IO ERR", irq_ptr->schid.sch_no);
                 DBF_ERROR("rc:%4x", rc);
-        }
-        spin_unlock_irqrestore(get_ccwdev_lock(cdev), saveflags);
-
-        if (rc) {
                 mutex_unlock(&irq_ptr->setup_mutex);
                 qdio_shutdown(cdev, QDIO_FLAG_CLEANUP_USING_CLEAR);
                 return rc;
@@ -1407,19 +1411,17 @@ EXPORT_SYMBOL_GPL(qdio_establish);
  */
 int qdio_activate(struct ccw_device *cdev)
 {
+        struct subchannel_id schid;
         struct qdio_irq *irq_ptr;
         int rc;
-        unsigned long saveflags;
 
-        DBF_EVENT("qactivate:%4x", cdev->private->schid.sch_no);
+        ccw_device_get_schid(cdev, &schid);
+        DBF_EVENT("qactivate:%4x", schid.sch_no);
 
         irq_ptr = cdev->private->qdio_data;
         if (!irq_ptr)
                 return -ENODEV;
 
-        if (cdev->private->state != DEV_STATE_ONLINE)
-                return -EINVAL;
-
         mutex_lock(&irq_ptr->setup_mutex);
         if (irq_ptr->state == QDIO_IRQ_STATE_INACTIVE) {
                 rc = -EBUSY;
@@ -1431,19 +1433,17 @@ int qdio_activate(struct ccw_device *cdev)
         irq_ptr->ccw.count = irq_ptr->aqueue.count;
         irq_ptr->ccw.cda = 0;
 
-        spin_lock_irqsave(get_ccwdev_lock(cdev), saveflags);
+        spin_lock_irq(get_ccwdev_lock(cdev));
         ccw_device_set_options(cdev, CCWDEV_REPORT_ALL);
 
         rc = ccw_device_start(cdev, &irq_ptr->ccw, QDIO_DOING_ACTIVATE,
                               0, DOIO_DENY_PREFETCH);
+        spin_unlock_irq(get_ccwdev_lock(cdev));
         if (rc) {
                 DBF_ERROR("%4x act IO ERR", irq_ptr->schid.sch_no);
                 DBF_ERROR("rc:%4x", rc);
-        }
-        spin_unlock_irqrestore(get_ccwdev_lock(cdev), saveflags);
-
-        if (rc)
                 goto out;
+        }
 
         if (is_thinint_irq(irq_ptr))
                 tiqdio_add_input_queues(irq_ptr);
@@ -1585,10 +1585,11 @@ static int handle_outbound(struct qdio_q *q, unsigned int callflags,
 
         /* in case of SIGA errors we must process the error immediately */
         if (used >= q->u.out.scan_threshold || rc)
-                tasklet_schedule(&q->tasklet);
+                qdio_tasklet_schedule(q);
         else
                 /* free the SBALs in case of no further traffic */
-                if (!timer_pending(&q->u.out.timer))
+                if (!timer_pending(&q->u.out.timer) &&
+                    likely(q->irq_ptr->state == QDIO_IRQ_STATE_ACTIVE))
                         mod_timer(&q->u.out.timer, jiffies + HZ);
         return rc;
 }
diff --git a/drivers/s390/net/qeth_core.h b/drivers/s390/net/qeth_core.h
index bf40063de202..6d4b68c483f3 100644
--- a/drivers/s390/net/qeth_core.h
+++ b/drivers/s390/net/qeth_core.h
@@ -999,6 +999,7 @@ struct qeth_cmd_buffer *qeth_get_setassparms_cmd(struct qeth_card *,
                                                  __u16, __u16,
                                                  enum qeth_prot_versions);
 int qeth_set_features(struct net_device *, netdev_features_t);
+int qeth_recover_features(struct net_device *);
 netdev_features_t qeth_fix_features(struct net_device *, netdev_features_t);
 
 /* exports for OSN */
diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
index 7dba6c8537a1..20cf29613043 100644
--- a/drivers/s390/net/qeth_core_main.c
+++ b/drivers/s390/net/qeth_core_main.c
@@ -3619,7 +3619,8 @@ static void qeth_qdio_cq_handler(struct qeth_card *card,
                 int e;
 
                 e = 0;
-                while (buffer->element[e].addr) {
+                while ((e < QDIO_MAX_ELEMENTS_PER_BUFFER) &&
+                       buffer->element[e].addr) {
                         unsigned long phys_aob_addr;
 
                         phys_aob_addr = (unsigned long) buffer->element[e].addr;
@@ -6131,6 +6132,35 @@ static int qeth_set_ipa_tso(struct qeth_card *card, int on)
         return rc;
 }
 
+/* try to restore device features on a device after recovery */
+int qeth_recover_features(struct net_device *dev)
+{
+        struct qeth_card *card = dev->ml_priv;
+        netdev_features_t recover = dev->features;
+
+        if (recover & NETIF_F_IP_CSUM) {
+                if (qeth_set_ipa_csum(card, 1, IPA_OUTBOUND_CHECKSUM))
+                        recover ^= NETIF_F_IP_CSUM;
+        }
+        if (recover & NETIF_F_RXCSUM) {
+                if (qeth_set_ipa_csum(card, 1, IPA_INBOUND_CHECKSUM))
+                        recover ^= NETIF_F_RXCSUM;
+        }
+        if (recover & NETIF_F_TSO) {
+                if (qeth_set_ipa_tso(card, 1))
+                        recover ^= NETIF_F_TSO;
+        }
+
+        if (recover == dev->features)
+                return 0;
+
+        dev_warn(&card->gdev->dev,
+                 "Device recovery failed to restore all offload features\n");
+        dev->features = recover;
+        return -EIO;
+}
+EXPORT_SYMBOL_GPL(qeth_recover_features);
+
 int qeth_set_features(struct net_device *dev, netdev_features_t features)
 {
         struct qeth_card *card = dev->ml_priv;
diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c
index 7bc20c5188bc..bb27058fa9f0 100644
--- a/drivers/s390/net/qeth_l2_main.c
+++ b/drivers/s390/net/qeth_l2_main.c
@@ -1124,14 +1124,11 @@ static int qeth_l2_setup_netdev(struct qeth_card *card)
                         card->dev->hw_features |= NETIF_F_RXCSUM;
                         card->dev->vlan_features |= NETIF_F_RXCSUM;
                 }
-                /* Turn on SG per default */
-                card->dev->features |= NETIF_F_SG;
         }
         card->info.broadcast_capable = 1;
         qeth_l2_request_initial_mac(card);
         card->dev->gso_max_size = (QETH_MAX_BUFFER_ELEMENTS(card) - 1) *
                                   PAGE_SIZE;
-        card->dev->gso_max_segs = (QETH_MAX_BUFFER_ELEMENTS(card) - 1);
         SET_NETDEV_DEV(card->dev, &card->gdev->dev);
         netif_napi_add(card->dev, &card->napi, qeth_l2_poll, QETH_NAPI_WEIGHT);
         netif_carrier_off(card->dev);
@@ -1246,6 +1243,9 @@ contin:
                 }
                 /* this also sets saved unicast addresses */
                 qeth_l2_set_rx_mode(card->dev);
+                rtnl_lock();
+                qeth_recover_features(card->dev);
+                rtnl_unlock();
         }
         /* let user_space know that device is online */
         kobject_uevent(&gdev->dev.kobj, KOBJ_CHANGE);
diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c
index 72934666fedf..272d9e7419be 100644
--- a/drivers/s390/net/qeth_l3_main.c
+++ b/drivers/s390/net/qeth_l3_main.c
@@ -257,6 +257,11 @@ int qeth_l3_delete_ip(struct qeth_card *card, struct qeth_ipaddr *tmp_addr)
         if (addr->in_progress)
                 return -EINPROGRESS;
 
+        if (!qeth_card_hw_is_reachable(card)) {
+                addr->disp_flag = QETH_DISP_ADDR_DELETE;
+                return 0;
+        }
+
         rc = qeth_l3_deregister_addr_entry(card, addr);
 
         hash_del(&addr->hnode);
@@ -296,6 +301,11 @@ int qeth_l3_add_ip(struct qeth_card *card, struct qeth_ipaddr *tmp_addr)
                 hash_add(card->ip_htable, &addr->hnode,
                                 qeth_l3_ipaddr_hash(addr));
 
+                if (!qeth_card_hw_is_reachable(card)) {
+                        addr->disp_flag = QETH_DISP_ADDR_ADD;
+                        return 0;
+                }
+
                 /* qeth_l3_register_addr_entry can go to sleep
                  * if we add a IPV4 addr. It is caused by the reason
                  * that SETIP ipa cmd starts ARP staff for IPV4 addr.
@@ -390,12 +400,16 @@ static void qeth_l3_recover_ip(struct qeth_card *card)
         int i;
         int rc;
 
-        QETH_CARD_TEXT(card, 4, "recoverip");
+        QETH_CARD_TEXT(card, 4, "recovrip");
 
         spin_lock_bh(&card->ip_lock);
 
         hash_for_each_safe(card->ip_htable, i, tmp, addr, hnode) {
-                if (addr->disp_flag == QETH_DISP_ADDR_ADD) {
+                if (addr->disp_flag == QETH_DISP_ADDR_DELETE) {
+                        qeth_l3_deregister_addr_entry(card, addr);
+                        hash_del(&addr->hnode);
+                        kfree(addr);
+                } else if (addr->disp_flag == QETH_DISP_ADDR_ADD) {
                         if (addr->proto == QETH_PROT_IPV4) {
                                 addr->in_progress = 1;
                                 spin_unlock_bh(&card->ip_lock);
@@ -407,10 +421,8 @@ static void qeth_l3_recover_ip(struct qeth_card *card)
 
                         if (!rc) {
                                 addr->disp_flag = QETH_DISP_ADDR_DO_NOTHING;
-                                if (addr->ref_counter < 1) {
+                                if (addr->ref_counter < 1)
                                         qeth_l3_delete_ip(card, addr);
-                                        kfree(addr);
-                                }
                         } else {
                                 hash_del(&addr->hnode);
                                 kfree(addr);
@@ -689,7 +701,7 @@ int qeth_l3_add_vipa(struct qeth_card *card, enum qeth_prot_versions proto,
 
         spin_lock_bh(&card->ip_lock);
 
-        if (!qeth_l3_ip_from_hash(card, ipaddr))
+        if (qeth_l3_ip_from_hash(card, ipaddr))
                 rc = -EEXIST;
         else
                 qeth_l3_add_ip(card, ipaddr);
@@ -757,7 +769,7 @@ int qeth_l3_add_rxip(struct qeth_card *card, enum qeth_prot_versions proto,
 
         spin_lock_bh(&card->ip_lock);
 
-        if (!qeth_l3_ip_from_hash(card, ipaddr))
+        if (qeth_l3_ip_from_hash(card, ipaddr))
                 rc = -EEXIST;
         else
                 qeth_l3_add_ip(card, ipaddr);
@@ -3108,7 +3120,6 @@ static int qeth_l3_setup_netdev(struct qeth_card *card)
                                 card->dev->vlan_features = NETIF_F_SG |
                                         NETIF_F_RXCSUM | NETIF_F_IP_CSUM |
                                         NETIF_F_TSO;
-                                card->dev->features = NETIF_F_SG;
                         }
                 }
         } else if (card->info.type == QETH_CARD_TYPE_IQD) {
@@ -3136,7 +3147,6 @@ static int qeth_l3_setup_netdev(struct qeth_card *card)
         netif_keep_dst(card->dev);
         card->dev->gso_max_size = (QETH_MAX_BUFFER_ELEMENTS(card) - 1) *
                                   PAGE_SIZE;
-        card->dev->gso_max_segs = (QETH_MAX_BUFFER_ELEMENTS(card) - 1);
 
         SET_NETDEV_DEV(card->dev, &card->gdev->dev);
         netif_napi_add(card->dev, &card->napi, qeth_l3_poll, QETH_NAPI_WEIGHT);
@@ -3269,6 +3279,7 @@ contin:
                 else
                         dev_open(card->dev);
                 qeth_l3_set_multicast_list(card->dev);
+                qeth_recover_features(card->dev);
                 rtnl_unlock();
         }
         qeth_trace_features(card);
diff --git a/drivers/s390/net/qeth_l3_sys.c b/drivers/s390/net/qeth_l3_sys.c
index 65645b11fc19..0e00a5ce0f00 100644
--- a/drivers/s390/net/qeth_l3_sys.c
+++ b/drivers/s390/net/qeth_l3_sys.c
@@ -297,7 +297,9 @@ static ssize_t qeth_l3_dev_hsuid_store(struct device *dev,
                 addr->u.a6.pfxlen = 0;
                 addr->type = QETH_IP_TYPE_NORMAL;
 
+                spin_lock_bh(&card->ip_lock);
                 qeth_l3_delete_ip(card, addr);
+                spin_unlock_bh(&card->ip_lock);
                 kfree(addr);
         }
 
@@ -329,7 +331,10 @@ static ssize_t qeth_l3_dev_hsuid_store(struct device *dev,
                 addr->type = QETH_IP_TYPE_NORMAL;
         } else
                 return -ENOMEM;
+
+        spin_lock_bh(&card->ip_lock);
         qeth_l3_add_ip(card, addr);
+        spin_unlock_bh(&card->ip_lock);
         kfree(addr);
 
         return count;
diff --git a/drivers/scsi/aacraid/commctrl.c b/drivers/scsi/aacraid/commctrl.c
index b381b3718a98..5648b715fed9 100644
--- a/drivers/scsi/aacraid/commctrl.c
+++ b/drivers/scsi/aacraid/commctrl.c
@@ -63,7 +63,7 @@ static int ioctl_send_fib(struct aac_dev * dev, void __user *arg)
         struct fib *fibptr;
         struct hw_fib * hw_fib = (struct hw_fib *)0;
         dma_addr_t hw_fib_pa = (dma_addr_t)0LL;
-        unsigned size;
+        unsigned int size, osize;
         int retval;
 
         if (dev->in_reset) {
@@ -87,7 +87,8 @@ static int ioctl_send_fib(struct aac_dev * dev, void __user *arg)
          *      will not overrun the buffer when we copy the memory. Return
          *      an error if we would.
          */
-        size = le16_to_cpu(kfib->header.Size) + sizeof(struct aac_fibhdr);
+        osize = size = le16_to_cpu(kfib->header.Size) +
+                sizeof(struct aac_fibhdr);
         if (size < le16_to_cpu(kfib->header.SenderSize))
                 size = le16_to_cpu(kfib->header.SenderSize);
         if (size > dev->max_fib_size) {
@@ -118,6 +119,14 @@ static int ioctl_send_fib(struct aac_dev * dev, void __user *arg)
                 goto cleanup;
         }
 
+        /* Sanity check the second copy */
+        if ((osize != le16_to_cpu(kfib->header.Size) +
+                sizeof(struct aac_fibhdr))
+                || (size < le16_to_cpu(kfib->header.SenderSize))) {
+                retval = -EINVAL;
+                goto cleanup;
+        }
+
         if (kfib->header.Command == cpu_to_le16(TakeABreakPt)) {
                 aac_adapter_interrupt(dev);
                 /*
diff --git a/drivers/scsi/constants.c b/drivers/scsi/constants.c
index 83458f7a2824..6dc96c8dfe75 100644
--- a/drivers/scsi/constants.c
+++ b/drivers/scsi/constants.c
@@ -361,8 +361,9 @@ static const char * const snstext[] = {
 
 /* Get sense key string or NULL if not available */
 const char *
-scsi_sense_key_string(unsigned char key) {
-        if (key <= 0xE)
+scsi_sense_key_string(unsigned char key)
+{
+        if (key < ARRAY_SIZE(snstext))
                 return snstext[key];
         return NULL;
 }
diff --git a/drivers/scsi/fcoe/fcoe_ctlr.c b/drivers/scsi/fcoe/fcoe_ctlr.c
index a569c65f22b1..dcf36537a767 100644
--- a/drivers/scsi/fcoe/fcoe_ctlr.c
+++ b/drivers/scsi/fcoe/fcoe_ctlr.c
@@ -2923,7 +2923,7 @@ static int fcoe_ctlr_vlan_recv(struct fcoe_ctlr *fip, struct sk_buff *skb)
         mutex_unlock(&fip->ctlr_mutex);
 
 drop:
-        kfree(skb);
+        kfree_skb(skb);
         return rc;
 }
 
diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
index 2dab3dc2aa69..c1ed25adb17e 100644
--- a/drivers/scsi/megaraid/megaraid_sas_base.c
+++ b/drivers/scsi/megaraid/megaraid_sas_base.c
@@ -5037,7 +5037,7 @@ static int megasas_init_fw(struct megasas_instance *instance)
         /* Find first memory bar */
         bar_list = pci_select_bars(instance->pdev, IORESOURCE_MEM);
         instance->bar = find_first_bit(&bar_list, sizeof(unsigned long));
-        if (pci_request_selected_regions(instance->pdev, instance->bar,
+        if (pci_request_selected_regions(instance->pdev, 1<<instance->bar,
                                          "megasas: LSI")) {
                 dev_printk(KERN_DEBUG, &instance->pdev->dev, "IO memory region busy!\n");
                 return -EBUSY;
@@ -5339,7 +5339,7 @@ fail_ready_state:
         iounmap(instance->reg_set);
 
       fail_ioremap:
-        pci_release_selected_regions(instance->pdev, instance->bar);
+        pci_release_selected_regions(instance->pdev, 1<<instance->bar);
 
         return -EINVAL;
 }
@@ -5360,7 +5360,7 @@ static void megasas_release_mfi(struct megasas_instance *instance)
 
         iounmap(instance->reg_set);
 
-        pci_release_selected_regions(instance->pdev, instance->bar);
+        pci_release_selected_regions(instance->pdev, 1<<instance->bar);
 }
 
 /**
diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.c b/drivers/scsi/megaraid/megaraid_sas_fusion.c
index ec837544f784..52d8bbf7feb5 100644
--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c
+++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c
@@ -2603,7 +2603,7 @@ megasas_release_fusion(struct megasas_instance *instance)
 
         iounmap(instance->reg_set);
 
-        pci_release_selected_regions(instance->pdev, instance->bar);
+        pci_release_selected_regions(instance->pdev, 1<<instance->bar);
 }
 
 /**
diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c
index 751f13edece0..750f82c339d4 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_base.c
+++ b/drivers/scsi/mpt3sas/mpt3sas_base.c
@@ -2188,6 +2188,17 @@ mpt3sas_base_map_resources(struct MPT3SAS_ADAPTER *ioc)
         } else
                 ioc->msix96_vector = 0;
 
+        if (ioc->is_warpdrive) {
+                ioc->reply_post_host_index[0] = (resource_size_t __iomem *)
+                    &ioc->chip->ReplyPostHostIndex;
+
+                for (i = 1; i < ioc->cpu_msix_table_sz; i++)
+                        ioc->reply_post_host_index[i] =
+                        (resource_size_t __iomem *)
+                        ((u8 __iomem *)&ioc->chip->Doorbell + (0x4000 + ((i - 1)
+                        * 4)));
+        }
+
         list_for_each_entry(reply_q, &ioc->reply_queue_list, list)
                 pr_info(MPT3SAS_FMT "%s: IRQ %d\n",
                     reply_q->name,  ((ioc->msix_enable) ? "PCI-MSI-X enabled" :
@@ -5280,17 +5291,6 @@ mpt3sas_base_attach(struct MPT3SAS_ADAPTER *ioc)
         if (r)
                 goto out_free_resources;
 
-        if (ioc->is_warpdrive) {
-                ioc->reply_post_host_index[0] = (resource_size_t __iomem *)
-                    &ioc->chip->ReplyPostHostIndex;
-
-                for (i = 1; i < ioc->cpu_msix_table_sz; i++)
-                        ioc->reply_post_host_index[i] =
-                        (resource_size_t __iomem *)
-                        ((u8 __iomem *)&ioc->chip->Doorbell + (0x4000 + ((i - 1)
-                        * 4)));
-        }
-
         pci_set_drvdata(ioc->pdev, ioc->shost);
         r = _base_get_ioc_facts(ioc, CAN_SLEEP);
         if (r)
diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c
index eaccd651ccda..246456925335 100644
--- a/drivers/scsi/scsi_devinfo.c
+++ b/drivers/scsi/scsi_devinfo.c
@@ -246,6 +246,10 @@ static struct {
         {"IBM", "Universal Xport", "*", BLIST_NO_ULD_ATTACH},
         {"SUN", "Universal Xport", "*", BLIST_NO_ULD_ATTACH},
         {"DELL", "Universal Xport", "*", BLIST_NO_ULD_ATTACH},
+        {"STK", "Universal Xport", "*", BLIST_NO_ULD_ATTACH},
+        {"NETAPP", "Universal Xport", "*", BLIST_NO_ULD_ATTACH},
+        {"LSI", "Universal Xport", "*", BLIST_NO_ULD_ATTACH},
+        {"ENGENIO", "Universal Xport", "*", BLIST_NO_ULD_ATTACH},
         {"SMSC", "USB 2 HS-CF", NULL, BLIST_SPARSELUN | BLIST_INQUIRY_36},
         {"SONY", "CD-ROM CDU-8001", NULL, BLIST_BORKEN},
         {"SONY", "TSL", NULL, BLIST_FORCELUN},          /* DDS3 & DDS4 autoloaders */
diff --git a/drivers/scsi/scsi_transport_sas.c b/drivers/scsi/scsi_transport_sas.c
index 3f0ff072184b..60b651bfaa01 100644
--- a/drivers/scsi/scsi_transport_sas.c
+++ b/drivers/scsi/scsi_transport_sas.c
@@ -341,22 +341,6 @@ static int do_sas_phy_delete(struct device *dev, void *data)
 }
 
 /**
- * is_sas_attached - check if device is SAS attached
- * @sdev: scsi device to check
- *
- * returns true if the device is SAS attached
- */
-int is_sas_attached(struct scsi_device *sdev)
-{
-        struct Scsi_Host *shost = sdev->host;
-
-        return shost->transportt->host_attrs.ac.class ==
-                &sas_host_class.class;
-}
-EXPORT_SYMBOL(is_sas_attached);
-
-
-/**
  * sas_remove_children  -  tear down a devices SAS data structures
  * @dev:        device belonging to the sas object
  *
diff --git a/drivers/scsi/ses.c b/drivers/scsi/ses.c
index 53ef1cb6418e..8c9a35c91705 100644
--- a/drivers/scsi/ses.c
+++ b/drivers/scsi/ses.c
@@ -587,7 +587,7 @@ static void ses_match_to_enclosure(struct enclosure_device *edev,
 
         ses_enclosure_data_process(edev, to_scsi_device(edev->edev.parent), 0);
 
-        if (is_sas_attached(sdev))
+        if (scsi_is_sas_rphy(&sdev->sdev_gendev))
                 efd.addr = sas_get_address(sdev);
 
         if (efd.addr) {
@@ -778,6 +778,8 @@ static void ses_intf_remove_enclosure(struct scsi_device *sdev)
         if (!edev)
                 return;
 
+        enclosure_unregister(edev);
+
         ses_dev = edev->scratch;
         edev->scratch = NULL;
 
@@ -789,7 +791,6 @@ static void ses_intf_remove_enclosure(struct scsi_device *sdev)
         kfree(edev->component[0].scratch);
 
         put_device(&edev->edev);
-        enclosure_unregister(edev);
 }
 
 static void ses_intf_remove(struct device *cdev,
diff --git a/drivers/scsi/wd719x.c b/drivers/scsi/wd719x.c
index e3da1a2fdb66..2a9da2e0ea6b 100644
--- a/drivers/scsi/wd719x.c
+++ b/drivers/scsi/wd719x.c
@@ -962,7 +962,7 @@ static void wd719x_pci_remove(struct pci_dev *pdev)
         scsi_host_put(sh);
 }
 
-static DEFINE_PCI_DEVICE_TABLE(wd719x_pci_table) = {
+static const struct pci_device_id wd719x_pci_table[] = {
         { PCI_DEVICE(PCI_VENDOR_ID_WD, 0x3296) },
         {}
 };
diff --git a/drivers/spi/spi-img-spfi.c b/drivers/spi/spi-img-spfi.c
index 823cbc92d1e7..7a37090dabbe 100644
--- a/drivers/spi/spi-img-spfi.c
+++ b/drivers/spi/spi-img-spfi.c
@@ -720,8 +720,6 @@ static int img_spfi_remove(struct platform_device *pdev)
                 clk_disable_unprepare(spfi->sys_clk);
         }
 
-        spi_master_put(master);
-
         return 0;
 }
 
diff --git a/drivers/spi/spi-mt65xx.c b/drivers/spi/spi-mt65xx.c
index 0be89e052428..899d7a8f0889 100644
--- a/drivers/spi/spi-mt65xx.c
+++ b/drivers/spi/spi-mt65xx.c
@@ -685,7 +685,6 @@ static int mtk_spi_remove(struct platform_device *pdev)
         pm_runtime_disable(&pdev->dev);
 
         mtk_spi_reset(mdata);
-        spi_master_put(master);
 
         return 0;
 }
diff --git a/drivers/spi/spi-pxa2xx-pci.c b/drivers/spi/spi-pxa2xx-pci.c
index f3df522db93b..58d2d48e16a5 100644
--- a/drivers/spi/spi-pxa2xx-pci.c
+++ b/drivers/spi/spi-pxa2xx-pci.c
@@ -214,6 +214,7 @@ static int pxa2xx_spi_pci_probe(struct pci_dev *dev,
                 return PTR_ERR(ssp->clk);
 
         memset(&pi, 0, sizeof(pi));
+        pi.fwnode = dev->dev.fwnode;
         pi.parent = &dev->dev;
         pi.name = "pxa2xx-spi";
         pi.id = ssp->port_id;
diff --git a/drivers/spi/spi-qup.c b/drivers/spi/spi-qup.c
index c338ef1136f6..7f1555621f8e 100644
--- a/drivers/spi/spi-qup.c
+++ b/drivers/spi/spi-qup.c
@@ -1030,7 +1030,6 @@ static int spi_qup_remove(struct platform_device *pdev)
 
         pm_runtime_put_noidle(&pdev->dev);
         pm_runtime_disable(&pdev->dev);
-        spi_master_put(master);
 
         return 0;
 }
diff --git a/drivers/spi/spi-sh-msiof.c b/drivers/spi/spi-sh-msiof.c
index 0f83ad1d5a58..1de3a772eb7d 100644
--- a/drivers/spi/spi-sh-msiof.c
+++ b/drivers/spi/spi-sh-msiof.c
@@ -262,6 +262,9 @@ static void sh_msiof_spi_set_clk_regs(struct sh_msiof_spi_priv *p,
 
         for (k = 0; k < ARRAY_SIZE(sh_msiof_spi_div_table); k++) {
                 brps = DIV_ROUND_UP(div, sh_msiof_spi_div_table[k].div);
+                /* SCR_BRDV_DIV_1 is valid only if BRPS is x 1/1 or x 1/2 */
+                if (sh_msiof_spi_div_table[k].div == 1 && brps > 2)
+                        continue;
                 if (brps <= 32) /* max of brdv is 32 */
                         break;
         }
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index 51ad42fad567..200ca228d885 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -960,7 +960,7 @@ static int spi_transfer_one_message(struct spi_master *master,
         struct spi_transfer *xfer;
         bool keep_cs = false;
         int ret = 0;
-        unsigned long ms = 1;
+        unsigned long long ms = 1;
         struct spi_statistics *statm = &master->statistics;
         struct spi_statistics *stats = &msg->spi->statistics;
 
@@ -991,9 +991,13 @@ static int spi_transfer_one_message(struct spi_master *master,
 
                         if (ret > 0) {
                                 ret = 0;
-                                ms = xfer->len * 8 * 1000 / xfer->speed_hz;
+                                ms = 8LL * 1000LL * xfer->len;
+                                do_div(ms, xfer->speed_hz);
                                 ms += ms + 100; /* some tolerance */
 
+                                if (ms > UINT_MAX)
+                                        ms = UINT_MAX;
+
                                 ms = wait_for_completion_timeout(&master->xfer_completion,
                                                                  msecs_to_jiffies(ms));
                         }
@@ -1159,6 +1163,7 @@ static void __spi_pump_messages(struct spi_master *master, bool in_kthread)
                 if (ret < 0) {
                         dev_err(&master->dev, "Failed to power device: %d\n",
                                 ret);
+                        mutex_unlock(&master->io_mutex);
                         return;
                 }
         }
@@ -1174,6 +1179,7 @@ static void __spi_pump_messages(struct spi_master *master, bool in_kthread)
 
                         if (master->auto_runtime_pm)
                                 pm_runtime_put(master->dev.parent);
+                        mutex_unlock(&master->io_mutex);
                         return;
                 }
         }
diff --git a/drivers/staging/comedi/drivers/adv_pci1760.c b/drivers/staging/comedi/drivers/adv_pci1760.c
index d7dd1e55e347..9f525ff7290c 100644
--- a/drivers/staging/comedi/drivers/adv_pci1760.c
+++ b/drivers/staging/comedi/drivers/adv_pci1760.c
@@ -196,6 +196,7 @@ static int pci1760_pwm_ns_to_div(unsigned int flags, unsigned int ns)
                 break;
         case CMDF_ROUND_DOWN:
                 divisor = ns / PCI1760_PWM_TIMEBASE;
+                break;
         default:
                 return -EINVAL;
         }
diff --git a/drivers/staging/comedi/drivers/comedi_test.c b/drivers/staging/comedi/drivers/comedi_test.c
index 4ab186669f0c..ec5b9a23494d 100644
--- a/drivers/staging/comedi/drivers/comedi_test.c
+++ b/drivers/staging/comedi/drivers/comedi_test.c
@@ -56,11 +56,6 @@
 
 #define N_CHANS 8
 
-enum waveform_state_bits {
-        WAVEFORM_AI_RUNNING,
-        WAVEFORM_AO_RUNNING
-};
-
 /* Data unique to this driver */
 struct waveform_private {
         struct timer_list ai_timer;     /* timer for AI commands */
@@ -68,7 +63,6 @@ struct waveform_private {
         unsigned int wf_amplitude;      /* waveform amplitude in microvolts */
         unsigned int wf_period;         /* waveform period in microseconds */
         unsigned int wf_current;        /* current time in waveform period */
-        unsigned long state_bits;
         unsigned int ai_scan_period;    /* AI scan period in usec */
         unsigned int ai_convert_period; /* AI conversion period in usec */
         struct timer_list ao_timer;     /* timer for AO commands */
@@ -191,10 +185,6 @@ static void waveform_ai_timer(unsigned long arg)
         unsigned int nsamples;
         unsigned int time_increment;
 
-        /* check command is still active */
-        if (!test_bit(WAVEFORM_AI_RUNNING, &devpriv->state_bits))
-                return;
-
         now = ktime_to_us(ktime_get());
         nsamples = comedi_nsamples_left(s, UINT_MAX);
 
@@ -386,11 +376,6 @@ static int waveform_ai_cmd(struct comedi_device *dev,
          */
         devpriv->ai_timer.expires =
                 jiffies + usecs_to_jiffies(devpriv->ai_convert_period) + 1;
-
-        /* mark command as active */
-        smp_mb__before_atomic();
-        set_bit(WAVEFORM_AI_RUNNING, &devpriv->state_bits);
-        smp_mb__after_atomic();
         add_timer(&devpriv->ai_timer);
         return 0;
 }
@@ -400,11 +385,12 @@ static int waveform_ai_cancel(struct comedi_device *dev,
 {
         struct waveform_private *devpriv = dev->private;
 
-        /* mark command as no longer active */
-        clear_bit(WAVEFORM_AI_RUNNING, &devpriv->state_bits);
-        smp_mb__after_atomic();
-        /* cannot call del_timer_sync() as may be called from timer routine */
-        del_timer(&devpriv->ai_timer);
+        if (in_softirq()) {
+                /* Assume we were called from the timer routine itself. */
+                del_timer(&devpriv->ai_timer);
+        } else {
+                del_timer_sync(&devpriv->ai_timer);
+        }
         return 0;
 }
 
@@ -436,10 +422,6 @@ static void waveform_ao_timer(unsigned long arg)
         u64 scans_since;
         unsigned int scans_avail = 0;
 
-        /* check command is still active */
-        if (!test_bit(WAVEFORM_AO_RUNNING, &devpriv->state_bits))
-                return;
-
         /* determine number of scan periods since last time */
         now = ktime_to_us(ktime_get());
         scans_since = now - devpriv->ao_last_scan_time;
@@ -518,11 +500,6 @@ static int waveform_ao_inttrig_start(struct comedi_device *dev,
         devpriv->ao_last_scan_time = ktime_to_us(ktime_get());
         devpriv->ao_timer.expires =
                 jiffies + usecs_to_jiffies(devpriv->ao_scan_period);
-
-        /* mark command as active */
-        smp_mb__before_atomic();
-        set_bit(WAVEFORM_AO_RUNNING, &devpriv->state_bits);
-        smp_mb__after_atomic();
         add_timer(&devpriv->ao_timer);
 
         return 1;
@@ -608,11 +585,12 @@ static int waveform_ao_cancel(struct comedi_device *dev,
         struct waveform_private *devpriv = dev->private;
 
         s->async->inttrig = NULL;
-        /* mark command as no longer active */
-        clear_bit(WAVEFORM_AO_RUNNING, &devpriv->state_bits);
-        smp_mb__after_atomic();
-        /* cannot call del_timer_sync() as may be called from timer routine */
-        del_timer(&devpriv->ao_timer);
+        if (in_softirq()) {
+                /* Assume we were called from the timer routine itself. */
+                del_timer(&devpriv->ao_timer);
+        } else {
+                del_timer_sync(&devpriv->ao_timer);
+        }
         return 0;
 }
 
diff --git a/drivers/staging/comedi/drivers/daqboard2000.c b/drivers/staging/comedi/drivers/daqboard2000.c
index 65daef0c00d5..0f4eb954aa80 100644
--- a/drivers/staging/comedi/drivers/daqboard2000.c
+++ b/drivers/staging/comedi/drivers/daqboard2000.c
@@ -634,7 +634,7 @@ static const void *daqboard2000_find_boardinfo(struct comedi_device *dev,
         const struct daq200_boardtype *board;
         int i;
 
-        if (pcidev->subsystem_device != PCI_VENDOR_ID_IOTECH)
+        if (pcidev->subsystem_vendor != PCI_VENDOR_ID_IOTECH)
                 return NULL;
 
         for (i = 0; i < ARRAY_SIZE(boardtypes); i++) {
diff --git a/drivers/staging/comedi/drivers/dt2811.c b/drivers/staging/comedi/drivers/dt2811.c
index 904f637797b6..8bbd93814340 100644
--- a/drivers/staging/comedi/drivers/dt2811.c
+++ b/drivers/staging/comedi/drivers/dt2811.c
@@ -588,8 +588,8 @@ static int dt2811_attach(struct comedi_device *dev, struct comedi_devconfig *it)
         s = &dev->subdevices[0];
         s->type         = COMEDI_SUBD_AI;
         s->subdev_flags = SDF_READABLE |
-                          (it->options[2] == 1) ? SDF_DIFF :
-                          (it->options[2] == 2) ? SDF_COMMON : SDF_GROUND;
+                          ((it->options[2] == 1) ? SDF_DIFF :
+                           (it->options[2] == 2) ? SDF_COMMON : SDF_GROUND);
         s->n_chan       = (it->options[2] == 1) ? 8 : 16;
         s->maxdata      = 0x0fff;
         s->range_table  = board->is_pgh ? &dt2811_pgh_ai_ranges
diff --git a/drivers/staging/comedi/drivers/ni_mio_common.c b/drivers/staging/comedi/drivers/ni_mio_common.c
index 8dabb19519a5..0f97d7b611d7 100644
--- a/drivers/staging/comedi/drivers/ni_mio_common.c
+++ b/drivers/staging/comedi/drivers/ni_mio_common.c
@@ -2772,7 +2772,15 @@ static int ni_ao_inttrig(struct comedi_device *dev,
         int i;
         static const int timeout = 1000;
 
-        if (trig_num != cmd->start_arg)
+        /*
+         * Require trig_num == cmd->start_arg when cmd->start_src == TRIG_INT.
+         * For backwards compatibility, also allow trig_num == 0 when
+         * cmd->start_src != TRIG_INT (i.e. when cmd->start_src == TRIG_EXT);
+         * in that case, the internal trigger is being used as a pre-trigger
+         * before the external trigger.
+         */
+        if (!(trig_num == cmd->start_arg ||
+              (trig_num == 0 && cmd->start_src != TRIG_INT)))
                 return -EINVAL;
 
         /*
@@ -5480,7 +5488,7 @@ static int ni_E_init(struct comedi_device *dev,
                 s->maxdata      = (devpriv->is_m_series) ? 0xffffffff
                                                          : 0x00ffffff;
                 s->insn_read    = ni_tio_insn_read;
-                s->insn_write   = ni_tio_insn_read;
+                s->insn_write   = ni_tio_insn_write;
                 s->insn_config  = ni_tio_insn_config;
 #ifdef PCIDMA
                 if (dev->irq && devpriv->mite) {
diff --git a/drivers/staging/iio/impedance-analyzer/ad5933.c b/drivers/staging/iio/impedance-analyzer/ad5933.c
index 170ac980abcb..24c348d2f5bb 100644
--- a/drivers/staging/iio/impedance-analyzer/ad5933.c
+++ b/drivers/staging/iio/impedance-analyzer/ad5933.c
@@ -419,6 +419,7 @@ static ssize_t ad5933_store(struct device *dev,
         mutex_lock(&indio_dev->mlock);
         switch ((u32)this_attr->address) {
         case AD5933_OUT_RANGE:
+                ret = -EINVAL;
                 for (i = 0; i < 4; i++)
                         if (val == st->range_avail[i]) {
                                 st->ctrl_hb &= ~AD5933_CTRL_RANGE(0x3);
@@ -426,7 +427,6 @@ static ssize_t ad5933_store(struct device *dev,
                                 ret = ad5933_cmd(st, 0);
                                 break;
                         }
-                ret = -EINVAL;
                 break;
         case AD5933_IN_PGA_GAIN:
                 if (sysfs_streq(buf, "1")) {
diff --git a/drivers/staging/lustre/lustre/llite/namei.c b/drivers/staging/lustre/lustre/llite/namei.c
index 3664bfd0178b..2c4dc69731e8 100644
--- a/drivers/staging/lustre/lustre/llite/namei.c
+++ b/drivers/staging/lustre/lustre/llite/namei.c
@@ -388,6 +388,7 @@ static int ll_lookup_it_finish(struct ptlrpc_request *request,
         struct inode *inode = NULL;
         __u64 bits = 0;
         int rc = 0;
+        struct dentry *alias;
 
         /* NB 1 request reference will be taken away by ll_intent_lock()
          * when I return
@@ -412,26 +413,12 @@ static int ll_lookup_it_finish(struct ptlrpc_request *request,
                  */
         }
 
-        /* Only hash *de if it is unhashed (new dentry).
-         * Atoimc_open may passing hashed dentries for open.
-         */
-        if (d_unhashed(*de)) {
-                struct dentry *alias;
-
-                alias = ll_splice_alias(inode, *de);
-                if (IS_ERR(alias)) {
-                        rc = PTR_ERR(alias);
-                        goto out;
-                }
-                *de = alias;
-        } else if (!it_disposition(it, DISP_LOOKUP_NEG)  &&
-                   !it_disposition(it, DISP_OPEN_CREATE)) {
-                /* With DISP_OPEN_CREATE dentry will be
-                 * instantiated in ll_create_it.
-                 */
-                LASSERT(!d_inode(*de));
-                d_instantiate(*de, inode);
+        alias = ll_splice_alias(inode, *de);
+        if (IS_ERR(alias)) {
+                rc = PTR_ERR(alias);
+                goto out;
         }
+        *de = alias;
 
         if (!it_disposition(it, DISP_LOOKUP_NEG)) {
                 /* we have lookup look - unhide dentry */
@@ -587,6 +574,24 @@ static int ll_atomic_open(struct inode *dir, struct dentry *dentry,
                dentry, PFID(ll_inode2fid(dir)), dir, file, open_flags, mode,
                *opened);
 
+        /* Only negative dentries enter here */
+        LASSERT(!d_inode(dentry));
+
+        if (!d_in_lookup(dentry)) {
+                /* A valid negative dentry that just passed revalidation,
+                 * there's little point to try and open it server-side,
+                 * even though there's a minuscle chance it might succeed.
+                 * Either way it's a valid race to just return -ENOENT here.
+                 */
+                if (!(open_flags & O_CREAT))
+                        return -ENOENT;
+
+                /* Otherwise we just unhash it to be rehashed afresh via
+                 * lookup if necessary
+                 */
+                d_drop(dentry);
+        }
+
         it = kzalloc(sizeof(*it), GFP_NOFS);
         if (!it)
                 return -ENOMEM;
diff --git a/drivers/staging/media/cec/TODO b/drivers/staging/media/cec/TODO
index a10d4f82b954..13224694a8ae 100644
--- a/drivers/staging/media/cec/TODO
+++ b/drivers/staging/media/cec/TODO
@@ -12,6 +12,7 @@ Hopefully this will happen later in 2016.
 
 Other TODOs:
 
+- There are two possible replies to CEC_MSG_INITIATE_ARC. How to handle that?
 - Add a flag to inhibit passing CEC RC messages to the rc subsystem.
   Applications should be able to choose this when calling S_LOG_ADDRS.
 - If the reply field of cec_msg is set then when the reply arrives it
diff --git a/drivers/staging/media/cec/cec-adap.c b/drivers/staging/media/cec/cec-adap.c
index b2393bbacb26..946986f3ac0d 100644
--- a/drivers/staging/media/cec/cec-adap.c
+++ b/drivers/staging/media/cec/cec-adap.c
@@ -124,10 +124,10 @@ static void cec_queue_event(struct cec_adapter *adap,
         u64 ts = ktime_get_ns();
         struct cec_fh *fh;
 
-        mutex_lock(&adap->devnode.fhs_lock);
+        mutex_lock(&adap->devnode.lock);
         list_for_each_entry(fh, &adap->devnode.fhs, list)
                 cec_queue_event_fh(fh, ev, ts);
-        mutex_unlock(&adap->devnode.fhs_lock);
+        mutex_unlock(&adap->devnode.lock);
 }
 
 /*
@@ -191,12 +191,12 @@ static void cec_queue_msg_monitor(struct cec_adapter *adap,
         u32 monitor_mode = valid_la ? CEC_MODE_MONITOR :
                                       CEC_MODE_MONITOR_ALL;
 
-        mutex_lock(&adap->devnode.fhs_lock);
+        mutex_lock(&adap->devnode.lock);
         list_for_each_entry(fh, &adap->devnode.fhs, list) {
                 if (fh->mode_follower >= monitor_mode)
                         cec_queue_msg_fh(fh, msg);
         }
-        mutex_unlock(&adap->devnode.fhs_lock);
+        mutex_unlock(&adap->devnode.lock);
 }
 
 /*
@@ -207,12 +207,12 @@ static void cec_queue_msg_followers(struct cec_adapter *adap,
 {
         struct cec_fh *fh;
 
-        mutex_lock(&adap->devnode.fhs_lock);
+        mutex_lock(&adap->devnode.lock);
         list_for_each_entry(fh, &adap->devnode.fhs, list) {
                 if (fh->mode_follower == CEC_MODE_FOLLOWER)
                         cec_queue_msg_fh(fh, msg);
         }
-        mutex_unlock(&adap->devnode.fhs_lock);
+        mutex_unlock(&adap->devnode.lock);
 }
 
 /* Notify userspace of an adapter state change. */
@@ -851,6 +851,9 @@ void cec_received_msg(struct cec_adapter *adap, struct cec_msg *msg)
         if (!valid_la || msg->len <= 1)
                 return;
 
+        if (adap->log_addrs.log_addr_mask == 0)
+                return;
+
         /*
          * Process the message on the protocol level. If is_reply is true,
          * then cec_receive_notify() won't pass on the reply to the listener(s)
@@ -1047,11 +1050,17 @@ static int cec_config_thread_func(void *arg)
                         dprintk(1, "could not claim LA %d\n", i);
         }
 
+        if (adap->log_addrs.log_addr_mask == 0 &&
+            !(las->flags & CEC_LOG_ADDRS_FL_ALLOW_UNREG_FALLBACK))
+                goto unconfigure;
+
 configured:
         if (adap->log_addrs.log_addr_mask == 0) {
                 /* Fall back to unregistered */
                 las->log_addr[0] = CEC_LOG_ADDR_UNREGISTERED;
                 las->log_addr_mask = 1 << las->log_addr[0];
+                for (i = 1; i < las->num_log_addrs; i++)
+                        las->log_addr[i] = CEC_LOG_ADDR_INVALID;
         }
         adap->is_configured = true;
         adap->is_configuring = false;
@@ -1070,6 +1079,8 @@ configured:
                         cec_report_features(adap, i);
                 cec_report_phys_addr(adap, i);
         }
+        for (i = las->num_log_addrs; i < CEC_MAX_LOG_ADDRS; i++)
+                las->log_addr[i] = CEC_LOG_ADDR_INVALID;
         mutex_lock(&adap->lock);
         adap->kthread_config = NULL;
         mutex_unlock(&adap->lock);
@@ -1398,7 +1409,6 @@ static int cec_receive_notify(struct cec_adapter *adap, struct cec_msg *msg,
         u8 init_laddr = cec_msg_initiator(msg);
         u8 devtype = cec_log_addr2dev(adap, dest_laddr);
         int la_idx = cec_log_addr2idx(adap, dest_laddr);
-        bool is_directed = la_idx >= 0;
         bool from_unregistered = init_laddr == 0xf;
         struct cec_msg tx_cec_msg = { };
 
@@ -1560,7 +1570,7 @@ static int cec_receive_notify(struct cec_adapter *adap, struct cec_msg *msg,
                  * Unprocessed messages are aborted if userspace isn't doing
                  * any processing either.
                  */
-                if (is_directed && !is_reply && !adap->follower_cnt &&
+                if (!is_broadcast && !is_reply && !adap->follower_cnt &&
                     !adap->cec_follower && msg->msg[1] != CEC_MSG_FEATURE_ABORT)
                         return cec_feature_abort(adap, msg);
                 break;
diff --git a/drivers/staging/media/cec/cec-api.c b/drivers/staging/media/cec/cec-api.c
index 7be7615a0fdf..e274e2f22398 100644
--- a/drivers/staging/media/cec/cec-api.c
+++ b/drivers/staging/media/cec/cec-api.c
@@ -162,7 +162,7 @@ static long cec_adap_s_log_addrs(struct cec_adapter *adap, struct cec_fh *fh,
                 return -ENOTTY;
         if (copy_from_user(&log_addrs, parg, sizeof(log_addrs)))
                 return -EFAULT;
-        log_addrs.flags = 0;
+        log_addrs.flags &= CEC_LOG_ADDRS_FL_ALLOW_UNREG_FALLBACK;
         mutex_lock(&adap->lock);
         if (!adap->is_configuring &&
             (!log_addrs.num_log_addrs || !adap->is_configured) &&
@@ -435,7 +435,7 @@ static long cec_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
         void __user *parg = (void __user *)arg;
 
         if (!devnode->registered)
-                return -EIO;
+                return -ENODEV;
 
         switch (cmd) {
         case CEC_ADAP_G_CAPS:
@@ -508,14 +508,14 @@ static int cec_open(struct inode *inode, struct file *filp)
 
         filp->private_data = fh;
 
-        mutex_lock(&devnode->fhs_lock);
+        mutex_lock(&devnode->lock);
         /* Queue up initial state events */
         ev_state.state_change.phys_addr = adap->phys_addr;
         ev_state.state_change.log_addr_mask = adap->log_addrs.log_addr_mask;
         cec_queue_event_fh(fh, &ev_state, 0);
 
         list_add(&fh->list, &devnode->fhs);
-        mutex_unlock(&devnode->fhs_lock);
+        mutex_unlock(&devnode->lock);
 
         return 0;
 }
@@ -540,9 +540,9 @@ static int cec_release(struct inode *inode, struct file *filp)
                 cec_monitor_all_cnt_dec(adap);
         mutex_unlock(&adap->lock);
 
-        mutex_lock(&devnode->fhs_lock);
+        mutex_lock(&devnode->lock);
         list_del(&fh->list);
-        mutex_unlock(&devnode->fhs_lock);
+        mutex_unlock(&devnode->lock);
 
         /* Unhook pending transmits from this filehandle. */
         mutex_lock(&adap->lock);
diff --git a/drivers/staging/media/cec/cec-core.c b/drivers/staging/media/cec/cec-core.c
index 112a5fae12f5..3b1e4d2b190d 100644
--- a/drivers/staging/media/cec/cec-core.c
+++ b/drivers/staging/media/cec/cec-core.c
@@ -51,31 +51,29 @@ int cec_get_device(struct cec_devnode *devnode)
 {
         /*
          * Check if the cec device is available. This needs to be done with
-         * the cec_devnode_lock held to prevent an open/unregister race:
+         * the devnode->lock held to prevent an open/unregister race:
          * without the lock, the device could be unregistered and freed between
          * the devnode->registered check and get_device() calls, leading to
          * a crash.
          */
-        mutex_lock(&cec_devnode_lock);
+        mutex_lock(&devnode->lock);
         /*
          * return ENXIO if the cec device has been removed
          * already or if it is not registered anymore.
          */
         if (!devnode->registered) {
-                mutex_unlock(&cec_devnode_lock);
+                mutex_unlock(&devnode->lock);
                 return -ENXIO;
         }
         /* and increase the device refcount */
         get_device(&devnode->dev);
-        mutex_unlock(&cec_devnode_lock);
+        mutex_unlock(&devnode->lock);
         return 0;
 }
 
 void cec_put_device(struct cec_devnode *devnode)
 {
-        mutex_lock(&cec_devnode_lock);
         put_device(&devnode->dev);
-        mutex_unlock(&cec_devnode_lock);
 }
 
 /* Called when the last user of the cec device exits. */
@@ -84,11 +82,10 @@ static void cec_devnode_release(struct device *cd)
         struct cec_devnode *devnode = to_cec_devnode(cd);
 
         mutex_lock(&cec_devnode_lock);
-
         /* Mark device node number as free */
         clear_bit(devnode->minor, cec_devnode_nums);
-
         mutex_unlock(&cec_devnode_lock);
+
         cec_delete_adapter(to_cec_adapter(devnode));
 }
 
@@ -117,7 +114,7 @@ static int __must_check cec_devnode_register(struct cec_devnode *devnode,
 
         /* Initialization */
         INIT_LIST_HEAD(&devnode->fhs);
-        mutex_init(&devnode->fhs_lock);
+        mutex_init(&devnode->lock);
 
         /* Part 1: Find a free minor number */
         mutex_lock(&cec_devnode_lock);
@@ -160,7 +157,9 @@ static int __must_check cec_devnode_register(struct cec_devnode *devnode,
 cdev_del:
         cdev_del(&devnode->cdev);
 clr_bit:
+        mutex_lock(&cec_devnode_lock);
         clear_bit(devnode->minor, cec_devnode_nums);
+        mutex_unlock(&cec_devnode_lock);
         return ret;
 }
 
@@ -177,17 +176,21 @@ static void cec_devnode_unregister(struct cec_devnode *devnode)
 {
         struct cec_fh *fh;
 
+        mutex_lock(&devnode->lock);
+
         /* Check if devnode was never registered or already unregistered */
-        if (!devnode->registered || devnode->unregistered)
+        if (!devnode->registered || devnode->unregistered) {
+                mutex_unlock(&devnode->lock);
                 return;
+        }
 
-        mutex_lock(&devnode->fhs_lock);
         list_for_each_entry(fh, &devnode->fhs, list)
                 wake_up_interruptible(&fh->wait);
-        mutex_unlock(&devnode->fhs_lock);
 
         devnode->registered = false;
         devnode->unregistered = true;
+        mutex_unlock(&devnode->lock);
+
         device_del(&devnode->dev);
         cdev_del(&devnode->cdev);
         put_device(&devnode->dev);
diff --git a/drivers/staging/media/pulse8-cec/pulse8-cec.c b/drivers/staging/media/pulse8-cec/pulse8-cec.c
index 94f8590492dc..ed8bd95ad6d0 100644
--- a/drivers/staging/media/pulse8-cec/pulse8-cec.c
+++ b/drivers/staging/media/pulse8-cec/pulse8-cec.c
@@ -114,14 +114,11 @@ static void pulse8_irq_work_handler(struct work_struct *work)
                 cec_transmit_done(pulse8->adap, CEC_TX_STATUS_OK,
                                   0, 0, 0, 0);
                 break;
-        case MSGCODE_TRANSMIT_FAILED_LINE:
-                cec_transmit_done(pulse8->adap, CEC_TX_STATUS_ARB_LOST,
-                                  1, 0, 0, 0);
-                break;
         case MSGCODE_TRANSMIT_FAILED_ACK:
                 cec_transmit_done(pulse8->adap, CEC_TX_STATUS_NACK,
                                   0, 1, 0, 0);
                 break;
+        case MSGCODE_TRANSMIT_FAILED_LINE:
         case MSGCODE_TRANSMIT_FAILED_TIMEOUT_DATA:
         case MSGCODE_TRANSMIT_FAILED_TIMEOUT_LINE:
                 cec_transmit_done(pulse8->adap, CEC_TX_STATUS_ERROR,
@@ -170,6 +167,9 @@ static irqreturn_t pulse8_interrupt(struct serio *serio, unsigned char data,
                 case MSGCODE_TRANSMIT_FAILED_TIMEOUT_LINE:
                         schedule_work(&pulse8->work);
                         break;
+                case MSGCODE_HIGH_ERROR:
+                case MSGCODE_LOW_ERROR:
+                case MSGCODE_RECEIVE_FAILED:
                 case MSGCODE_TIMEOUT_ERROR:
                         break;
                 case MSGCODE_COMMAND_ACCEPTED:
@@ -388,7 +388,7 @@ static int pulse8_cec_adap_transmit(struct cec_adapter *adap, u8 attempts,
         int err;
 
         cmd[0] = MSGCODE_TRANSMIT_IDLETIME;
-        cmd[1] = 3;
+        cmd[1] = signal_free_time;
         err = pulse8_send_and_wait(pulse8, cmd, 2,
                                    MSGCODE_COMMAND_ACCEPTED, 1);
         cmd[0] = MSGCODE_TRANSMIT_ACK_POLARITY;
diff --git a/drivers/staging/wilc1000/host_interface.c b/drivers/staging/wilc1000/host_interface.c
index 0b1760cba6e3..78f524fcd214 100644
--- a/drivers/staging/wilc1000/host_interface.c
+++ b/drivers/staging/wilc1000/host_interface.c
@@ -3363,7 +3363,7 @@ int wilc_init(struct net_device *dev, struct host_if_drv **hif_drv_handler)
                 if (!hif_workqueue) {
                         netdev_err(vif->ndev, "Failed to create workqueue\n");
                         result = -ENOMEM;
-                        goto _fail_mq_;
+                        goto _fail_;
                 }
 
                 setup_timer(&periodic_rssi, GetPeriodicRSSI,
@@ -3391,7 +3391,6 @@ int wilc_init(struct net_device *dev, struct host_if_drv **hif_drv_handler)
 
         clients_count++;
 
-_fail_mq_:
         destroy_workqueue(hif_workqueue);
 _fail_:
         return result;
diff --git a/drivers/staging/wilc1000/linux_wlan.c b/drivers/staging/wilc1000/linux_wlan.c
index 3a66255f14fc..32215110d597 100644
--- a/drivers/staging/wilc1000/linux_wlan.c
+++ b/drivers/staging/wilc1000/linux_wlan.c
@@ -648,7 +648,7 @@ void wilc1000_wlan_deinit(struct net_device *dev)
                         mutex_unlock(&wl->hif_cs);
                 }
                 if (&wl->txq_event)
-                        wait_for_completion(&wl->txq_event);
+                        complete(&wl->txq_event);
 
                 wlan_deinitialize_threads(dev);
                 deinit_irq(dev);
diff --git a/drivers/staging/wilc1000/wilc_wfi_cfgoperations.c b/drivers/staging/wilc1000/wilc_wfi_cfgoperations.c
index 9092600a1794..2c2e8aca8305 100644
--- a/drivers/staging/wilc1000/wilc_wfi_cfgoperations.c
+++ b/drivers/staging/wilc1000/wilc_wfi_cfgoperations.c
@@ -1191,7 +1191,7 @@ static int get_station(struct wiphy *wiphy, struct net_device *dev,
         struct wilc_priv *priv;
         struct wilc_vif *vif;
         u32 i = 0;
-        u32 associatedsta = 0;
+        u32 associatedsta = ~0;
         u32 inactive_time = 0;
         priv = wiphy_priv(wiphy);
         vif = netdev_priv(dev);
@@ -1204,7 +1204,7 @@ static int get_station(struct wiphy *wiphy, struct net_device *dev,
                         }
                 }
 
-                if (associatedsta == -1) {
+                if (associatedsta == ~0) {
                         netdev_err(dev, "sta required is not associated\n");
                         return -ENOENT;
                 }
diff --git a/drivers/thermal/cpu_cooling.c b/drivers/thermal/cpu_cooling.c
index 3788ed74c9ab..a32b41783b77 100644
--- a/drivers/thermal/cpu_cooling.c
+++ b/drivers/thermal/cpu_cooling.c
@@ -740,12 +740,22 @@ static int cpufreq_power2state(struct thermal_cooling_device *cdev,
 }
 
 /* Bind cpufreq callbacks to thermal cooling device ops */
+
 static struct thermal_cooling_device_ops cpufreq_cooling_ops = {
         .get_max_state = cpufreq_get_max_state,
         .get_cur_state = cpufreq_get_cur_state,
         .set_cur_state = cpufreq_set_cur_state,
 };
 
+static struct thermal_cooling_device_ops cpufreq_power_cooling_ops = {
+        .get_max_state          = cpufreq_get_max_state,
+        .get_cur_state          = cpufreq_get_cur_state,
+        .set_cur_state          = cpufreq_set_cur_state,
+        .get_requested_power    = cpufreq_get_requested_power,
+        .state2power            = cpufreq_state2power,
+        .power2state            = cpufreq_power2state,
+};
+
 /* Notifier for cpufreq policy change */
 static struct notifier_block thermal_cpufreq_notifier_block = {
         .notifier_call = cpufreq_thermal_notifier,
@@ -795,6 +805,7 @@ __cpufreq_cooling_register(struct device_node *np,
         struct cpumask temp_mask;
         unsigned int freq, i, num_cpus;
         int ret;
+        struct thermal_cooling_device_ops *cooling_ops;
 
         cpumask_and(&temp_mask, clip_cpus, cpu_online_mask);
         policy = cpufreq_cpu_get(cpumask_first(&temp_mask));
@@ -850,10 +861,6 @@ __cpufreq_cooling_register(struct device_node *np,
         cpumask_copy(&cpufreq_dev->allowed_cpus, clip_cpus);
 
         if (capacitance) {
-                cpufreq_cooling_ops.get_requested_power =
-                        cpufreq_get_requested_power;
-                cpufreq_cooling_ops.state2power = cpufreq_state2power;
-                cpufreq_cooling_ops.power2state = cpufreq_power2state;
                 cpufreq_dev->plat_get_static_power = plat_static_func;
 
                 ret = build_dyn_power_table(cpufreq_dev, capacitance);
@@ -861,6 +868,10 @@ __cpufreq_cooling_register(struct device_node *np,
                         cool_dev = ERR_PTR(ret);
                         goto free_table;
                 }
+
+                cooling_ops = &cpufreq_power_cooling_ops;
+        } else {
+                cooling_ops = &cpufreq_cooling_ops;
         }
 
         ret = get_idr(&cpufreq_idr, &cpufreq_dev->id);
@@ -885,7 +896,7 @@ __cpufreq_cooling_register(struct device_node *np,
                  cpufreq_dev->id);
 
         cool_dev = thermal_of_cooling_device_register(np, dev_name, cpufreq_dev,
-                                                      &cpufreq_cooling_ops);
+                                                      cooling_ops);
         if (IS_ERR(cool_dev))
                 goto remove_idr;
 
diff --git a/drivers/thermal/imx_thermal.c b/drivers/thermal/imx_thermal.c
index c5547bd711db..e473548b5d28 100644
--- a/drivers/thermal/imx_thermal.c
+++ b/drivers/thermal/imx_thermal.c
@@ -471,8 +471,6 @@ MODULE_DEVICE_TABLE(of, of_imx_thermal_match);
 
 static int imx_thermal_probe(struct platform_device *pdev)
 {
-        const struct of_device_id *of_id =
-                of_match_device(of_imx_thermal_match, &pdev->dev);
         struct imx_thermal_data *data;
         struct regmap *map;
         int measure_freq;
@@ -490,7 +488,7 @@ static int imx_thermal_probe(struct platform_device *pdev)
         }
         data->tempmon = map;
 
-        data->socdata = of_id->data;
+        data->socdata = of_device_get_match_data(&pdev->dev);
 
         /* make sure the IRQ flag is clear before enabling irq on i.MX6SX */
         if (data->socdata->version == TEMPMON_IMX6SX) {
diff --git a/drivers/thermal/int340x_thermal/int3406_thermal.c b/drivers/thermal/int340x_thermal/int3406_thermal.c
index a578cd257db4..1891f34ab7fc 100644
--- a/drivers/thermal/int340x_thermal/int3406_thermal.c
+++ b/drivers/thermal/int340x_thermal/int3406_thermal.c
@@ -225,7 +225,6 @@ static struct platform_driver int3406_thermal_driver = {
         .remove = int3406_thermal_remove,
         .driver = {
                    .name = "int3406 thermal",
-                   .owner = THIS_MODULE,
                    .acpi_match_table = int3406_thermal_match,
                    },
 };
diff --git a/drivers/thermal/rcar_thermal.c b/drivers/thermal/rcar_thermal.c
index 71a339271fa5..5f817923f374 100644
--- a/drivers/thermal/rcar_thermal.c
+++ b/drivers/thermal/rcar_thermal.c
@@ -504,6 +504,7 @@ static int rcar_thermal_probe(struct platform_device *pdev)
                 if (IS_ERR(priv->zone)) {
                         dev_err(dev, "can't register thermal zone\n");
                         ret = PTR_ERR(priv->zone);
+                        priv->zone = NULL;
                         goto error_unregister;
                 }
 
diff --git a/drivers/thunderbolt/nhi.c b/drivers/thunderbolt/nhi.c
index 9c15344b657a..a8c20413dbda 100644
--- a/drivers/thunderbolt/nhi.c
+++ b/drivers/thunderbolt/nhi.c
@@ -651,6 +651,12 @@ static struct pci_device_id nhi_ids[] = {
         {
                 .class = PCI_CLASS_SYSTEM_OTHER << 8, .class_mask = ~0,
                 .vendor = PCI_VENDOR_ID_INTEL,
+                .device = PCI_DEVICE_ID_INTEL_FALCON_RIDGE_2C_NHI,
+                .subvendor = PCI_ANY_ID, .subdevice = PCI_ANY_ID,
+        },
+        {
+                .class = PCI_CLASS_SYSTEM_OTHER << 8, .class_mask = ~0,
+                .vendor = PCI_VENDOR_ID_INTEL,
                 .device = PCI_DEVICE_ID_INTEL_FALCON_RIDGE_4C_NHI,
                 .subvendor = PCI_ANY_ID, .subdevice = PCI_ANY_ID,
         },
diff --git a/drivers/thunderbolt/switch.c b/drivers/thunderbolt/switch.c
index 1e116f53d6dd..9840fdecb73b 100644
--- a/drivers/thunderbolt/switch.c
+++ b/drivers/thunderbolt/switch.c
@@ -372,7 +372,9 @@ struct tb_switch *tb_switch_alloc(struct tb *tb, u64 route)
 
         if (sw->config.device_id != PCI_DEVICE_ID_INTEL_LIGHT_RIDGE &&
             sw->config.device_id != PCI_DEVICE_ID_INTEL_CACTUS_RIDGE_4C &&
-            sw->config.device_id != PCI_DEVICE_ID_INTEL_PORT_RIDGE)
+            sw->config.device_id != PCI_DEVICE_ID_INTEL_PORT_RIDGE &&
+            sw->config.device_id != PCI_DEVICE_ID_INTEL_FALCON_RIDGE_2C_BRIDGE &&
+            sw->config.device_id != PCI_DEVICE_ID_INTEL_FALCON_RIDGE_4C_BRIDGE)
                 tb_sw_warn(sw, "unsupported switch device id %#x\n",
                            sw->config.device_id);
 
diff --git a/drivers/tty/serial/8250/8250.h b/drivers/tty/serial/8250/8250.h
index 122e0e4029fe..1a16feac9a36 100644
--- a/drivers/tty/serial/8250/8250.h
+++ b/drivers/tty/serial/8250/8250.h
@@ -15,8 +15,6 @@
 #include <linux/serial_reg.h>
 #include <linux/dmaengine.h>
 
-#include "../serial_mctrl_gpio.h"
-
 struct uart_8250_dma {
         int (*tx_dma)(struct uart_8250_port *p);
         int (*rx_dma)(struct uart_8250_port *p);
@@ -133,43 +131,12 @@ void serial8250_em485_destroy(struct uart_8250_port *p);
 
 static inline void serial8250_out_MCR(struct uart_8250_port *up, int value)
 {
-        int mctrl_gpio = 0;
-
         serial_out(up, UART_MCR, value);
-
-        if (value & UART_MCR_RTS)
-                mctrl_gpio |= TIOCM_RTS;
-        if (value & UART_MCR_DTR)
-                mctrl_gpio |= TIOCM_DTR;
-
-        mctrl_gpio_set(up->gpios, mctrl_gpio);
 }
 
 static inline int serial8250_in_MCR(struct uart_8250_port *up)
 {
-        int mctrl, mctrl_gpio = 0;
-
-        mctrl = serial_in(up, UART_MCR);
-
-        /* save current MCR values */
-        if (mctrl & UART_MCR_RTS)
-                mctrl_gpio |= TIOCM_RTS;
-        if (mctrl & UART_MCR_DTR)
-                mctrl_gpio |= TIOCM_DTR;
-
-        mctrl_gpio = mctrl_gpio_get_outputs(up->gpios, &mctrl_gpio);
-
-        if (mctrl_gpio & TIOCM_RTS)
-                mctrl |= UART_MCR_RTS;
-        else
-                mctrl &= ~UART_MCR_RTS;
-
-        if (mctrl_gpio & TIOCM_DTR)
-                mctrl |= UART_MCR_DTR;
-        else
-                mctrl &= ~UART_MCR_DTR;
-
-        return mctrl;
+        return serial_in(up, UART_MCR);
 }
 
 #if defined(__alpha__) && !defined(CONFIG_PCI)
diff --git a/drivers/tty/serial/8250/8250_core.c b/drivers/tty/serial/8250/8250_core.c
index 13ad5c3d2e68..dcf43f66404f 100644
--- a/drivers/tty/serial/8250/8250_core.c
+++ b/drivers/tty/serial/8250/8250_core.c
@@ -974,8 +974,6 @@ int serial8250_register_8250_port(struct uart_8250_port *up)
 
         uart = serial8250_find_match_or_unused(&up->port);
         if (uart && uart->port.type != PORT_8250_CIR) {
-                struct mctrl_gpios *gpios;
-
                 if (uart->port.dev)
                         uart_remove_one_port(&serial8250_reg, &uart->port);
 
@@ -1013,13 +1011,6 @@ int serial8250_register_8250_port(struct uart_8250_port *up)
                 if (up->port.flags & UPF_FIXED_TYPE)
                         uart->port.type = up->port.type;
 
-                gpios = mctrl_gpio_init(&uart->port, 0);
-                if (IS_ERR(gpios)) {
-                        if (PTR_ERR(gpios) != -ENOSYS)
-                                return PTR_ERR(gpios);
-                } else
-                        uart->gpios = gpios;
-
                 serial8250_set_defaults(uart);
 
                 /* Possibly override default I/O functions.  */
diff --git a/drivers/tty/serial/8250/8250_fintek.c b/drivers/tty/serial/8250/8250_fintek.c
index 737b4b3957b0..0facc789fe7d 100644
--- a/drivers/tty/serial/8250/8250_fintek.c
+++ b/drivers/tty/serial/8250/8250_fintek.c
@@ -31,7 +31,7 @@
 #define IO_ADDR2 0x60
 #define LDN 0x7
 
-#define IRQ_MODE        0x70
+#define FINTEK_IRQ_MODE 0x70
 #define IRQ_SHARE       BIT(4)
 #define IRQ_MODE_MASK   (BIT(6) | BIT(5))
 #define IRQ_LEVEL_LOW   0
@@ -195,7 +195,7 @@ static int fintek_8250_set_irq_mode(struct fintek_8250 *pdata, bool level_mode)
         outb(LDN, pdata->base_port + ADDR_PORT);
         outb(pdata->index, pdata->base_port + DATA_PORT);
 
-        outb(IRQ_MODE, pdata->base_port + ADDR_PORT);
+        outb(FINTEK_IRQ_MODE, pdata->base_port + ADDR_PORT);
         tmp = inb(pdata->base_port + DATA_PORT);
 
         tmp &= ~IRQ_MODE_MASK;
diff --git a/drivers/tty/serial/8250/8250_mid.c b/drivers/tty/serial/8250/8250_mid.c
index 339de9cd0866..20c5db2f4264 100644
--- a/drivers/tty/serial/8250/8250_mid.c
+++ b/drivers/tty/serial/8250/8250_mid.c
@@ -168,6 +168,9 @@ static void mid8250_set_termios(struct uart_port *p,
         unsigned long w = BIT(24) - 1;
         unsigned long mul, div;
 
+        /* Gracefully handle the B0 case: fall back to B9600 */
+        fuart = fuart ? fuart : 9600 * 16;
+
         if (mid->board->freq < fuart) {
                 /* Find prescaler value that satisfies Fuart < Fref */
                 if (mid->board->freq > baud)
diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c
index e14982f36a04..61ad6c3b20a0 100644
--- a/drivers/tty/serial/8250/8250_omap.c
+++ b/drivers/tty/serial/8250/8250_omap.c
@@ -134,21 +134,18 @@ static void omap8250_set_mctrl(struct uart_port *port, unsigned int mctrl)
 
         serial8250_do_set_mctrl(port, mctrl);
 
-        if (IS_ERR_OR_NULL(mctrl_gpio_to_gpiod(up->gpios,
-                                                UART_GPIO_RTS))) {
-                /*
-                 * Turn off autoRTS if RTS is lowered and restore autoRTS
-                 * setting if RTS is raised
-                 */
-                lcr = serial_in(up, UART_LCR);
-                serial_out(up, UART_LCR, UART_LCR_CONF_MODE_B);
-                if ((mctrl & TIOCM_RTS) && (port->status & UPSTAT_AUTORTS))
-                        priv->efr |= UART_EFR_RTS;
-                else
-                        priv->efr &= ~UART_EFR_RTS;
-                serial_out(up, UART_EFR, priv->efr);
-                serial_out(up, UART_LCR, lcr);
-        }
+        /*
+         * Turn off autoRTS if RTS is lowered and restore autoRTS setting
+         * if RTS is raised
+         */
+        lcr = serial_in(up, UART_LCR);
+        serial_out(up, UART_LCR, UART_LCR_CONF_MODE_B);
+        if ((mctrl & TIOCM_RTS) && (port->status & UPSTAT_AUTORTS))
+                priv->efr |= UART_EFR_RTS;
+        else
+                priv->efr &= ~UART_EFR_RTS;
+        serial_out(up, UART_EFR, priv->efr);
+        serial_out(up, UART_LCR, lcr);
 }
 
 /*
@@ -449,9 +446,7 @@ static void omap_8250_set_termios(struct uart_port *port,
         priv->efr = 0;
         up->port.status &= ~(UPSTAT_AUTOCTS | UPSTAT_AUTORTS | UPSTAT_AUTOXOFF);
 
-        if (termios->c_cflag & CRTSCTS && up->port.flags & UPF_HARD_FLOW
-                && IS_ERR_OR_NULL(mctrl_gpio_to_gpiod(up->gpios,
-                                                        UART_GPIO_RTS))) {
+        if (termios->c_cflag & CRTSCTS && up->port.flags & UPF_HARD_FLOW) {
                 /* Enable AUTOCTS (autoRTS is enabled when RTS is raised) */
                 up->port.status |= UPSTAT_AUTOCTS | UPSTAT_AUTORTS;
                 priv->efr |= UART_EFR_CTS;
diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c
index 20ebaea5c414..bc51b32b2774 100644
--- a/drivers/tty/serial/8250/8250_pci.c
+++ b/drivers/tty/serial/8250/8250_pci.c
@@ -1950,6 +1950,43 @@ pci_wch_ch38x_setup(struct serial_private *priv,
 #define PCI_DEVICE_ID_PERICOM_PI7C9X7954        0x7954
 #define PCI_DEVICE_ID_PERICOM_PI7C9X7958        0x7958
 
+#define PCI_VENDOR_ID_ACCESIO                   0x494f
+#define PCI_DEVICE_ID_ACCESIO_PCIE_COM_2SDB     0x1051
+#define PCI_DEVICE_ID_ACCESIO_MPCIE_COM_2S      0x1053
+#define PCI_DEVICE_ID_ACCESIO_PCIE_COM_4SDB     0x105C
+#define PCI_DEVICE_ID_ACCESIO_MPCIE_COM_4S      0x105E
+#define PCI_DEVICE_ID_ACCESIO_PCIE_COM232_2DB   0x1091
+#define PCI_DEVICE_ID_ACCESIO_MPCIE_COM232_2    0x1093
+#define PCI_DEVICE_ID_ACCESIO_PCIE_COM232_4DB   0x1099
+#define PCI_DEVICE_ID_ACCESIO_MPCIE_COM232_4    0x109B
+#define PCI_DEVICE_ID_ACCESIO_PCIE_COM_2SMDB    0x10D1
+#define PCI_DEVICE_ID_ACCESIO_MPCIE_COM_2SM     0x10D3
+#define PCI_DEVICE_ID_ACCESIO_PCIE_COM_4SMDB    0x10DA
+#define PCI_DEVICE_ID_ACCESIO_MPCIE_COM_4SM     0x10DC
+#define PCI_DEVICE_ID_ACCESIO_MPCIE_ICM485_1    0x1108
+#define PCI_DEVICE_ID_ACCESIO_MPCIE_ICM422_2    0x1110
+#define PCI_DEVICE_ID_ACCESIO_MPCIE_ICM485_2    0x1111
+#define PCI_DEVICE_ID_ACCESIO_MPCIE_ICM422_4    0x1118
+#define PCI_DEVICE_ID_ACCESIO_MPCIE_ICM485_4    0x1119
+#define PCI_DEVICE_ID_ACCESIO_PCIE_ICM_2S       0x1152
+#define PCI_DEVICE_ID_ACCESIO_PCIE_ICM_4S       0x115A
+#define PCI_DEVICE_ID_ACCESIO_PCIE_ICM232_2     0x1190
+#define PCI_DEVICE_ID_ACCESIO_MPCIE_ICM232_2    0x1191
+#define PCI_DEVICE_ID_ACCESIO_PCIE_ICM232_4     0x1198
+#define PCI_DEVICE_ID_ACCESIO_MPCIE_ICM232_4    0x1199
+#define PCI_DEVICE_ID_ACCESIO_PCIE_ICM_2SM      0x11D0
+#define PCI_DEVICE_ID_ACCESIO_PCIE_COM422_4     0x105A
+#define PCI_DEVICE_ID_ACCESIO_PCIE_COM485_4     0x105B
+#define PCI_DEVICE_ID_ACCESIO_PCIE_COM422_8     0x106A
+#define PCI_DEVICE_ID_ACCESIO_PCIE_COM485_8     0x106B
+#define PCI_DEVICE_ID_ACCESIO_PCIE_COM232_4     0x1098
+#define PCI_DEVICE_ID_ACCESIO_PCIE_COM232_8     0x10A9
+#define PCI_DEVICE_ID_ACCESIO_PCIE_COM_4SM      0x10D9
+#define PCI_DEVICE_ID_ACCESIO_PCIE_COM_8SM      0x10E9
+#define PCI_DEVICE_ID_ACCESIO_PCIE_ICM_4SM      0x11D8
+
+
+
 /* Unknown vendors/cards - this should not be in linux/pci_ids.h */
 #define PCI_SUBDEVICE_ID_UNKNOWN_0x1584 0x1584
 #define PCI_SUBDEVICE_ID_UNKNOWN_0x1588 0x1588
@@ -5113,6 +5150,108 @@ static struct pci_device_id serial_pci_tbl[] = {
                 0,
                 0, pbn_pericom_PI7C9X7958 },
         /*
+         * ACCES I/O Products quad
+         */
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM_2SDB,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_COM_2S,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM_4SDB,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_COM_4S,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM232_2DB,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_COM232_2,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM232_4DB,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_COM232_4,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM_2SMDB,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_COM_2SM,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM_4SMDB,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_COM_4SM,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_ICM485_1,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_ICM422_2,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_ICM485_2,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_ICM422_4,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_ICM485_4,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_ICM_2S,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_ICM_4S,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_ICM232_2,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_ICM232_2,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_ICM232_4,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_ICM232_4,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_ICM_2SM,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM422_4,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7958 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM485_4,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7958 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM422_8,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7958 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM485_8,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7958 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM232_4,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7958 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM232_8,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7958 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM_4SM,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7958 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM_8SM,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7958 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_ICM_4SM,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7958 },
+        /*
          * Topic TP560 Data/Fax/Voice 56k modem (reported by Evan Clarke)
          */
         {       PCI_VENDOR_ID_TOPIC, PCI_DEVICE_ID_TOPIC_TP560,
diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c
index 7481b95c6d84..bdfa659b9606 100644
--- a/drivers/tty/serial/8250/8250_port.c
+++ b/drivers/tty/serial/8250/8250_port.c
@@ -1618,8 +1618,6 @@ static void serial8250_disable_ms(struct uart_port *port)
         if (up->bugs & UART_BUG_NOMSR)
                 return;
 
-        mctrl_gpio_disable_ms(up->gpios);
-
         up->ier &= ~UART_IER_MSI;
         serial_port_out(port, UART_IER, up->ier);
 }
@@ -1632,8 +1630,6 @@ static void serial8250_enable_ms(struct uart_port *port)
         if (up->bugs & UART_BUG_NOMSR)
                 return;
 
-        mctrl_gpio_enable_ms(up->gpios);
-
         up->ier |= UART_IER_MSI;
 
         serial8250_rpm_get(up);
@@ -1917,8 +1913,7 @@ unsigned int serial8250_do_get_mctrl(struct uart_port *port)
                 ret |= TIOCM_DSR;
         if (status & UART_MSR_CTS)
                 ret |= TIOCM_CTS;
-
-        return mctrl_gpio_get(up->gpios, &ret);
+        return ret;
 }
 EXPORT_SYMBOL_GPL(serial8250_do_get_mctrl);
 
diff --git a/drivers/tty/serial/8250/Kconfig b/drivers/tty/serial/8250/Kconfig
index c9ec839a5ddf..7c6f7afca5dd 100644
--- a/drivers/tty/serial/8250/Kconfig
+++ b/drivers/tty/serial/8250/Kconfig
@@ -6,7 +6,6 @@
 config SERIAL_8250
         tristate "8250/16550 and compatible serial support"
         select SERIAL_CORE
-        select SERIAL_MCTRL_GPIO if GPIOLIB
         ---help---
           This selects whether you want to include the driver for the standard
           serial ports.  The standard answer is Y.  People who might say N
diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c
index 065f5d97aa67..b93356834bb5 100644
--- a/drivers/usb/chipidea/udc.c
+++ b/drivers/usb/chipidea/udc.c
@@ -949,6 +949,15 @@ static int isr_setup_status_phase(struct ci_hdrc *ci)
         int retval;
         struct ci_hw_ep *hwep;
 
+        /*
+         * Unexpected USB controller behavior, caused by bad signal integrity
+         * or ground reference problems, can lead to isr_setup_status_phase
+         * being called with ci->status equal to NULL.
+         * If this situation occurs, you should review your USB hardware design.
+         */
+        if (WARN_ON_ONCE(!ci->status))
+                return -EPIPE;
+
         hwep = (ci->ep0_dir == TX) ? ci->ep0out : ci->ep0in;
         ci->status->context = ci;
         ci->status->complete = isr_setup_status_complete;
@@ -1596,8 +1605,11 @@ static int ci_udc_pullup(struct usb_gadget *_gadget, int is_on)
 {
         struct ci_hdrc *ci = container_of(_gadget, struct ci_hdrc, gadget);
 
-        /* Data+ pullup controlled by OTG state machine in OTG fsm mode */
-        if (ci_otg_is_fsm_mode(ci))
+        /*
+         * Data+ pullup controlled by OTG state machine in OTG fsm mode;
+         * and don't touch Data+ in host mode for dual role config.
+         */
+        if (ci_otg_is_fsm_mode(ci) || ci->role == CI_ROLE_HOST)
                 return 0;
 
         pm_runtime_get_sync(&ci->gadget.dev);
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 71912301ef7f..0f3f62e81e5b 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1354,7 +1354,6 @@ made_compressed_probe:
         spin_lock_init(&acm->write_lock);
         spin_lock_init(&acm->read_lock);
         mutex_init(&acm->mutex);
-        acm->rx_endpoint = usb_rcvbulkpipe(usb_dev, epread->bEndpointAddress);
         acm->is_int_ep = usb_endpoint_xfer_int(epread);
         if (acm->is_int_ep)
                 acm->bInterval = epread->bInterval;
@@ -1394,14 +1393,14 @@ made_compressed_probe:
                 urb->transfer_dma = rb->dma;
                 if (acm->is_int_ep) {
                         usb_fill_int_urb(urb, acm->dev,
-                                         acm->rx_endpoint,
+                                         usb_rcvintpipe(usb_dev, epread->bEndpointAddress),
                                          rb->base,
                                          acm->readsize,
                                          acm_read_bulk_callback, rb,
                                          acm->bInterval);
                 } else {
                         usb_fill_bulk_urb(urb, acm->dev,
-                                          acm->rx_endpoint,
+                                          usb_rcvbulkpipe(usb_dev, epread->bEndpointAddress),
                                           rb->base,
                                           acm->readsize,
                                           acm_read_bulk_callback, rb);
diff --git a/drivers/usb/class/cdc-acm.h b/drivers/usb/class/cdc-acm.h
index 05ce308d5d2a..1f1eabfd8462 100644
--- a/drivers/usb/class/cdc-acm.h
+++ b/drivers/usb/class/cdc-acm.h
@@ -96,7 +96,6 @@ struct acm {
         struct acm_rb read_buffers[ACM_NR];
         struct acm_wb *putbuffer;                       /* for acm_tty_put_char() */
         int rx_buflimit;
-        int rx_endpoint;
         spinlock_t read_lock;
         int write_used;                                 /* number of non-empty write buffers */
         int transmitting;
diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
index 31ccdccd7a04..a2d90aca779f 100644
--- a/drivers/usb/core/config.c
+++ b/drivers/usb/core/config.c
@@ -171,6 +171,31 @@ static void usb_parse_ss_endpoint_companion(struct device *ddev, int cfgno,
                                                         ep, buffer, size);
 }
 
+static const unsigned short low_speed_maxpacket_maxes[4] = {
+        [USB_ENDPOINT_XFER_CONTROL] = 8,
+        [USB_ENDPOINT_XFER_ISOC] = 0,
+        [USB_ENDPOINT_XFER_BULK] = 0,
+        [USB_ENDPOINT_XFER_INT] = 8,
+};
+static const unsigned short full_speed_maxpacket_maxes[4] = {
+        [USB_ENDPOINT_XFER_CONTROL] = 64,
+        [USB_ENDPOINT_XFER_ISOC] = 1023,
+        [USB_ENDPOINT_XFER_BULK] = 64,
+        [USB_ENDPOINT_XFER_INT] = 64,
+};
+static const unsigned short high_speed_maxpacket_maxes[4] = {
+        [USB_ENDPOINT_XFER_CONTROL] = 64,
+        [USB_ENDPOINT_XFER_ISOC] = 1024,
+        [USB_ENDPOINT_XFER_BULK] = 512,
+        [USB_ENDPOINT_XFER_INT] = 1024,
+};
+static const unsigned short super_speed_maxpacket_maxes[4] = {
+        [USB_ENDPOINT_XFER_CONTROL] = 512,
+        [USB_ENDPOINT_XFER_ISOC] = 1024,
+        [USB_ENDPOINT_XFER_BULK] = 1024,
+        [USB_ENDPOINT_XFER_INT] = 1024,
+};
+
 static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
     int asnum, struct usb_host_interface *ifp, int num_ep,
     unsigned char *buffer, int size)
@@ -179,6 +204,8 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
         struct usb_endpoint_descriptor *d;
         struct usb_host_endpoint *endpoint;
         int n, i, j, retval;
+        unsigned int maxp;
+        const unsigned short *maxpacket_maxes;
 
         d = (struct usb_endpoint_descriptor *) buffer;
         buffer += d->bLength;
@@ -213,8 +240,10 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
         memcpy(&endpoint->desc, d, n);
         INIT_LIST_HEAD(&endpoint->urb_list);
 
-        /* Fix up bInterval values outside the legal range. Use 32 ms if no
-         * proper value can be guessed. */
+        /*
+         * Fix up bInterval values outside the legal range.
+         * Use 10 or 8 ms if no proper value can be guessed.
+         */
         i = 0;          /* i = min, j = max, n = default */
         j = 255;
         if (usb_endpoint_xfer_int(d)) {
@@ -223,13 +252,15 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
                 case USB_SPEED_SUPER_PLUS:
                 case USB_SPEED_SUPER:
                 case USB_SPEED_HIGH:
-                        /* Many device manufacturers are using full-speed
+                        /*
+                         * Many device manufacturers are using full-speed
                          * bInterval values in high-speed interrupt endpoint
-                         * descriptors. Try to fix those and fall back to a
-                         * 32 ms default value otherwise. */
+                         * descriptors. Try to fix those and fall back to an
+                         * 8-ms default value otherwise.
+                         */
                         n = fls(d->bInterval*8);
                         if (n == 0)
-                                n = 9;  /* 32 ms = 2^(9-1) uframes */
+                                n = 7;  /* 8 ms = 2^(7-1) uframes */
                         j = 16;
 
                         /*
@@ -244,10 +275,12 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
                         }
                         break;
                 default:                /* USB_SPEED_FULL or _LOW */
-                        /* For low-speed, 10 ms is the official minimum.
+                        /*
+                         * For low-speed, 10 ms is the official minimum.
                          * But some "overclocked" devices might want faster
-                         * polling so we'll allow it. */
-                        n = 32;
+                         * polling so we'll allow it.
+                         */
+                        n = 10;
                         break;
                 }
         } else if (usb_endpoint_xfer_isoc(d)) {
@@ -255,10 +288,10 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
                 j = 16;
                 switch (to_usb_device(ddev)->speed) {
                 case USB_SPEED_HIGH:
-                        n = 9;          /* 32 ms = 2^(9-1) uframes */
+                        n = 7;          /* 8 ms = 2^(7-1) uframes */
                         break;
                 default:                /* USB_SPEED_FULL */
-                        n = 6;          /* 32 ms = 2^(6-1) frames */
+                        n = 4;          /* 8 ms = 2^(4-1) frames */
                         break;
                 }
         }
@@ -286,6 +319,42 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
                         endpoint->desc.wMaxPacketSize = cpu_to_le16(8);
         }
 
+        /* Validate the wMaxPacketSize field */
+        maxp = usb_endpoint_maxp(&endpoint->desc);
+
+        /* Find the highest legal maxpacket size for this endpoint */
+        i = 0;          /* additional transactions per microframe */
+        switch (to_usb_device(ddev)->speed) {
+        case USB_SPEED_LOW:
+                maxpacket_maxes = low_speed_maxpacket_maxes;
+                break;
+        case USB_SPEED_FULL:
+                maxpacket_maxes = full_speed_maxpacket_maxes;
+                break;
+        case USB_SPEED_HIGH:
+                /* Bits 12..11 are allowed only for HS periodic endpoints */
+                if (usb_endpoint_xfer_int(d) || usb_endpoint_xfer_isoc(d)) {
+                        i = maxp & (BIT(12) | BIT(11));
+                        maxp &= ~i;
+                }
+                /* fallthrough */
+        default:
+                maxpacket_maxes = high_speed_maxpacket_maxes;
+                break;
+        case USB_SPEED_SUPER:
+        case USB_SPEED_SUPER_PLUS:
+                maxpacket_maxes = super_speed_maxpacket_maxes;
+                break;
+        }
+        j = maxpacket_maxes[usb_endpoint_type(&endpoint->desc)];
+
+        if (maxp > j) {
+                dev_warn(ddev, "config %d interface %d altsetting %d endpoint 0x%X has invalid maxpacket %d, setting to %d\n",
+                    cfgno, inum, asnum, d->bEndpointAddress, maxp, j);
+                maxp = j;
+                endpoint->desc.wMaxPacketSize = cpu_to_le16(i | maxp);
+        }
+
         /*
          * Some buggy high speed devices have bulk endpoints using
          * maxpacket sizes other than 512.  High speed HCDs may not
@@ -293,9 +362,6 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
          */
         if (to_usb_device(ddev)->speed == USB_SPEED_HIGH
                         && usb_endpoint_xfer_bulk(d)) {
-                unsigned maxp;
-
-                maxp = usb_endpoint_maxp(&endpoint->desc) & 0x07ff;
                 if (maxp != 512)
                         dev_warn(ddev, "config %d interface %d altsetting %d "
                                 "bulk endpoint 0x%X has invalid maxpacket %d\n",
diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index e9f5043a2167..09c8d9ca61ae 100644
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -241,7 +241,8 @@ static int usbdev_mmap(struct file *file, struct vm_area_struct *vma)
                 goto error_decrease_mem;
         }
 
-        mem = usb_alloc_coherent(ps->dev, size, GFP_USER, &dma_handle);
+        mem = usb_alloc_coherent(ps->dev, size, GFP_USER | __GFP_NOWARN,
+                        &dma_handle);
         if (!mem) {
                 ret = -ENOMEM;
                 goto error_free_usbm;
@@ -1708,11 +1709,17 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb
         as->urb->start_frame = uurb->start_frame;
         as->urb->number_of_packets = number_of_packets;
         as->urb->stream_id = stream_id;
-        if (uurb->type == USBDEVFS_URB_TYPE_ISO ||
-                        ps->dev->speed == USB_SPEED_HIGH)
-                as->urb->interval = 1 << min(15, ep->desc.bInterval - 1);
-        else
-                as->urb->interval = ep->desc.bInterval;
+
+        if (ep->desc.bInterval) {
+                if (uurb->type == USBDEVFS_URB_TYPE_ISO ||
+                                ps->dev->speed == USB_SPEED_HIGH ||
+                                ps->dev->speed >= USB_SPEED_SUPER)
+                        as->urb->interval = 1 <<
+                                        min(15, ep->desc.bInterval - 1);
+                else
+                        as->urb->interval = ep->desc.bInterval;
+        }
+
         as->urb->context = as;
         as->urb->complete = async_completed;
         for (totlen = u = 0; u < number_of_packets; u++) {
@@ -2582,7 +2589,9 @@ static unsigned int usbdev_poll(struct file *file,
         if (file->f_mode & FMODE_WRITE && !list_empty(&ps->async_completed))
                 mask |= POLLOUT | POLLWRNORM;
         if (!connected(ps))
-                mask |= POLLERR | POLLHUP;
+                mask |= POLLHUP;
+        if (list_empty(&ps->list))
+                mask |= POLLERR;
         return mask;
 }
 
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index bee13517676f..1d5fc32d06d0 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -1052,14 +1052,11 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
 
         /* Continue a partial initialization */
         if (type == HUB_INIT2 || type == HUB_INIT3) {
-                device_lock(hub->intfdev);
+                device_lock(&hdev->dev);
 
                 /* Was the hub disconnected while we were waiting? */
-                if (hub->disconnected) {
-                        device_unlock(hub->intfdev);
-                        kref_put(&hub->kref, hub_release);
-                        return;
-                }
+                if (hub->disconnected)
+                        goto disconnected;
                 if (type == HUB_INIT2)
                         goto init2;
                 goto init3;
@@ -1262,7 +1259,7 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
                         queue_delayed_work(system_power_efficient_wq,
                                         &hub->init_work,
                                         msecs_to_jiffies(delay));
-                        device_unlock(hub->intfdev);
+                        device_unlock(&hdev->dev);
                         return;         /* Continues at init3: below */
                 } else {
                         msleep(delay);
@@ -1281,12 +1278,12 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
         /* Scan all ports that need attention */
         kick_hub_wq(hub);
 
-        /* Allow autosuspend if it was suppressed */
-        if (type <= HUB_INIT3)
+        if (type == HUB_INIT2 || type == HUB_INIT3) {
+                /* Allow autosuspend if it was suppressed */
+ disconnected:
                 usb_autopm_put_interface_async(to_usb_interface(hub->intfdev));
-
-        if (type == HUB_INIT2 || type == HUB_INIT3)
-                device_unlock(hub->intfdev);
+                device_unlock(&hdev->dev);
+        }
 
         kref_put(&hub->kref, hub_release);
 }
@@ -1315,8 +1312,6 @@ static void hub_quiesce(struct usb_hub *hub, enum hub_quiescing_type type)
         struct usb_device *hdev = hub->hdev;
         int i;
 
-        cancel_delayed_work_sync(&hub->init_work);
-
         /* hub_wq and related activity won't re-trigger */
         hub->quiescing = 1;
 
diff --git a/drivers/usb/dwc2/core.h b/drivers/usb/dwc2/core.h
index 9fae0291cd69..d64551243789 100644
--- a/drivers/usb/dwc2/core.h
+++ b/drivers/usb/dwc2/core.h
@@ -868,6 +868,7 @@ struct dwc2_hsotg {
         void *priv;
         int     irq;
         struct clk *clk;
+        struct reset_control *reset;
 
         unsigned int queuing_high_bandwidth:1;
         unsigned int srp_success:1;
diff --git a/drivers/usb/dwc2/platform.c b/drivers/usb/dwc2/platform.c
index fc6f5251de5d..530959a8a6d1 100644
--- a/drivers/usb/dwc2/platform.c
+++ b/drivers/usb/dwc2/platform.c
@@ -45,6 +45,7 @@
 #include <linux/platform_device.h>
 #include <linux/phy/phy.h>
 #include <linux/platform_data/s3c-hsotg.h>
+#include <linux/reset.h>
 
 #include <linux/usb/of.h>
 
@@ -337,6 +338,24 @@ static int dwc2_lowlevel_hw_init(struct dwc2_hsotg *hsotg)
 {
         int i, ret;
 
+        hsotg->reset = devm_reset_control_get_optional(hsotg->dev, "dwc2");
+        if (IS_ERR(hsotg->reset)) {
+                ret = PTR_ERR(hsotg->reset);
+                switch (ret) {
+                case -ENOENT:
+                case -ENOTSUPP:
+                        hsotg->reset = NULL;
+                        break;
+                default:
+                        dev_err(hsotg->dev, "error getting reset control %d\n",
+                                ret);
+                        return ret;
+                }
+        }
+
+        if (hsotg->reset)
+                reset_control_deassert(hsotg->reset);
+
         /* Set default UTMI width */
         hsotg->phyif = GUSBCFG_PHYIF16;
 
@@ -434,6 +453,9 @@ static int dwc2_driver_remove(struct platform_device *dev)
         if (hsotg->ll_hw_enabled)
                 dwc2_lowlevel_hw_disable(hsotg);
 
+        if (hsotg->reset)
+                reset_control_assert(hsotg->reset);
+
         return 0;
 }
 
diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
index 946643157b78..35d092456bec 100644
--- a/drivers/usb/dwc3/core.c
+++ b/drivers/usb/dwc3/core.c
@@ -1192,6 +1192,7 @@ static int dwc3_runtime_resume(struct device *dev)
         }
 
         pm_runtime_mark_last_busy(dev);
+        pm_runtime_put(dev);
 
         return 0;
 }
diff --git a/drivers/usb/dwc3/debug.h b/drivers/usb/dwc3/debug.h
index 22dfc3dd6a13..33ab2a203c1b 100644
--- a/drivers/usb/dwc3/debug.h
+++ b/drivers/usb/dwc3/debug.h
@@ -192,7 +192,7 @@ dwc3_ep_event_string(const struct dwc3_event_depevt *event)
         int ret;
 
         ret = sprintf(str, "ep%d%s: ", epnum >> 1,
-                        (epnum & 1) ? "in" : "in");
+                        (epnum & 1) ? "in" : "out");
         if (ret < 0)
                 return "UNKNOWN";
 
diff --git a/drivers/usb/dwc3/dwc3-of-simple.c b/drivers/usb/dwc3/dwc3-of-simple.c
index 974335377d9f..e56d59b19a0e 100644
--- a/drivers/usb/dwc3/dwc3-of-simple.c
+++ b/drivers/usb/dwc3/dwc3-of-simple.c
@@ -61,6 +61,7 @@ static int dwc3_of_simple_probe(struct platform_device *pdev)
         if (!simple->clks)
                 return -ENOMEM;
 
+        platform_set_drvdata(pdev, simple);
         simple->dev = dev;
 
         for (i = 0; i < simple->num_clocks; i++) {
diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c
index 45f5a232d9fb..6df0f5dad9a4 100644
--- a/drivers/usb/dwc3/dwc3-pci.c
+++ b/drivers/usb/dwc3/dwc3-pci.c
@@ -37,6 +37,7 @@
 #define PCI_DEVICE_ID_INTEL_BXT                 0x0aaa
 #define PCI_DEVICE_ID_INTEL_BXT_M               0x1aaa
 #define PCI_DEVICE_ID_INTEL_APL                 0x5aaa
+#define PCI_DEVICE_ID_INTEL_KBP                 0xa2b0
 
 static const struct acpi_gpio_params reset_gpios = { 0, 0, false };
 static const struct acpi_gpio_params cs_gpios = { 1, 0, false };
@@ -227,6 +228,7 @@ static const struct pci_device_id dwc3_pci_id_table[] = {
         { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_BXT), },
         { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_BXT_M), },
         { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_APL), },
+        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_KBP), },
         { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_NL_USB), },
         {  }    /* Terminating Entry */
 };
@@ -241,6 +243,15 @@ static int dwc3_pci_runtime_suspend(struct device *dev)
         return -EBUSY;
 }
 
+static int dwc3_pci_runtime_resume(struct device *dev)
+{
+        struct platform_device *dwc3 = dev_get_drvdata(dev);
+
+        return pm_runtime_get(&dwc3->dev);
+}
+#endif /* CONFIG_PM */
+
+#ifdef CONFIG_PM_SLEEP
 static int dwc3_pci_pm_dummy(struct device *dev)
 {
         /*
@@ -253,11 +264,11 @@ static int dwc3_pci_pm_dummy(struct device *dev)
          */
         return 0;
 }
-#endif /* CONFIG_PM */
+#endif /* CONFIG_PM_SLEEP */
 
 static struct dev_pm_ops dwc3_pci_dev_pm_ops = {
         SET_SYSTEM_SLEEP_PM_OPS(dwc3_pci_pm_dummy, dwc3_pci_pm_dummy)
-        SET_RUNTIME_PM_OPS(dwc3_pci_runtime_suspend, dwc3_pci_pm_dummy,
+        SET_RUNTIME_PM_OPS(dwc3_pci_runtime_suspend, dwc3_pci_runtime_resume,
                 NULL)
 };
 
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 8f8c2157910e..122e64df2f4d 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -829,7 +829,7 @@ static void dwc3_prepare_one_trb(struct dwc3_ep *dep,
         if (!req->request.no_interrupt && !chain)
                 trb->ctrl |= DWC3_TRB_CTRL_IOC | DWC3_TRB_CTRL_ISP_IMI;
 
-        if (last)
+        if (last && !usb_endpoint_xfer_isoc(dep->endpoint.desc))
                 trb->ctrl |= DWC3_TRB_CTRL_LST;
 
         if (chain)
@@ -1433,7 +1433,7 @@ static int dwc3_gadget_get_frame(struct usb_gadget *g)
 
 static int __dwc3_gadget_wakeup(struct dwc3 *dwc)
 {
-        unsigned long           timeout;
+        int                     retries;
 
         int                     ret;
         u32                     reg;
@@ -1484,9 +1484,9 @@ static int __dwc3_gadget_wakeup(struct dwc3 *dwc)
         }
 
         /* poll until Link State changes to ON */
-        timeout = jiffies + msecs_to_jiffies(100);
+        retries = 20000;
 
-        while (!time_after(jiffies, timeout)) {
+        while (retries--) {
                 reg = dwc3_readl(dwc->regs, DWC3_DSTS);
 
                 /* in HS, means ON */
@@ -1955,7 +1955,8 @@ static void dwc3_gadget_free_endpoints(struct dwc3 *dwc)
 
 static int __dwc3_cleanup_done_trbs(struct dwc3 *dwc, struct dwc3_ep *dep,
                 struct dwc3_request *req, struct dwc3_trb *trb,
-                const struct dwc3_event_depevt *event, int status)
+                const struct dwc3_event_depevt *event, int status,
+                int chain)
 {
         unsigned int            count;
         unsigned int            s_pkt = 0;
@@ -1964,17 +1965,22 @@ static int __dwc3_cleanup_done_trbs(struct dwc3 *dwc, struct dwc3_ep *dep,
         dep->queued_requests--;
         trace_dwc3_complete_trb(dep, trb);
 
+        /*
+         * If we're in the middle of series of chained TRBs and we
+         * receive a short transfer along the way, DWC3 will skip
+         * through all TRBs including the last TRB in the chain (the
+         * where CHN bit is zero. DWC3 will also avoid clearing HWO
+         * bit and SW has to do it manually.
+         *
+         * We're going to do that here to avoid problems of HW trying
+         * to use bogus TRBs for transfers.
+         */
+        if (chain && (trb->ctrl & DWC3_TRB_CTRL_HWO))
+                trb->ctrl &= ~DWC3_TRB_CTRL_HWO;
+
         if ((trb->ctrl & DWC3_TRB_CTRL_HWO) && status != -ESHUTDOWN)
-                /*
-                 * We continue despite the error. There is not much we
-                 * can do. If we don't clean it up we loop forever. If
-                 * we skip the TRB then it gets overwritten after a
-                 * while since we use them in a ring buffer. A BUG()
-                 * would help. Lets hope that if this occurs, someone
-                 * fixes the root cause instead of looking away :)
-                 */
-                dev_err(dwc->dev, "%s's TRB (%p) still owned by HW\n",
-                                dep->name, trb);
+                return 1;
+
         count = trb->size & DWC3_TRB_SIZE_MASK;
 
         if (dep->direction) {
@@ -2013,15 +2019,7 @@ static int __dwc3_cleanup_done_trbs(struct dwc3 *dwc, struct dwc3_ep *dep,
                         s_pkt = 1;
         }
 
-        /*
-         * We assume here we will always receive the entire data block
-         * which we should receive. Meaning, if we program RX to
-         * receive 4K but we receive only 2K, we assume that's all we
-         * should receive and we simply bounce the request back to the
-         * gadget driver for further processing.
-         */
-        req->request.actual += req->request.length - count;
-        if (s_pkt)
+        if (s_pkt && !chain)
                 return 1;
         if ((event->status & DEPEVT_STATUS_LST) &&
                         (trb->ctrl & (DWC3_TRB_CTRL_LST |
@@ -2040,13 +2038,17 @@ static int dwc3_cleanup_done_reqs(struct dwc3 *dwc, struct dwc3_ep *dep,
         struct dwc3_trb         *trb;
         unsigned int            slot;
         unsigned int            i;
+        int                     count = 0;
         int                     ret;
 
         do {
+                int chain;
+
                 req = next_request(&dep->started_list);
                 if (WARN_ON_ONCE(!req))
                         return 1;
 
+                chain = req->request.num_mapped_sgs > 0;
                 i = 0;
                 do {
                         slot = req->first_trb_index + i;
@@ -2054,13 +2056,22 @@ static int dwc3_cleanup_done_reqs(struct dwc3 *dwc, struct dwc3_ep *dep,
                                 slot++;
                         slot %= DWC3_TRB_NUM;
                         trb = &dep->trb_pool[slot];
+                        count += trb->size & DWC3_TRB_SIZE_MASK;
 
                         ret = __dwc3_cleanup_done_trbs(dwc, dep, req, trb,
-                                        event, status);
+                                        event, status, chain);
                         if (ret)
                                 break;
                 } while (++i < req->request.num_mapped_sgs);
 
+                /*
+                 * We assume here we will always receive the entire data block
+                 * which we should receive. Meaning, if we program RX to
+                 * receive 4K but we receive only 2K, we assume that's all we
+                 * should receive and we simply bounce the request back to the
+                 * gadget driver for further processing.
+                 */
+                req->request.actual += req->request.length - count;
                 dwc3_gadget_giveback(dep, req, status);
 
                 if (ret)
diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
index eb648485a58c..5ebe6af7976e 100644
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -1913,6 +1913,8 @@ unknown:
                         break;
 
                 case USB_RECIP_ENDPOINT:
+                        if (!cdev->config)
+                                break;
                         endp = ((w_index & 0x80) >> 3) | (w_index & 0x0f);
                         list_for_each_entry(f, &cdev->config->functions, list) {
                                 if (test_bit(endp, f->endpoints))
@@ -2124,14 +2126,14 @@ int composite_os_desc_req_prepare(struct usb_composite_dev *cdev,
 
         cdev->os_desc_req = usb_ep_alloc_request(ep0, GFP_KERNEL);
         if (!cdev->os_desc_req) {
-                ret = PTR_ERR(cdev->os_desc_req);
+                ret = -ENOMEM;
                 goto end;
         }
 
         /* OS feature descriptor length <= 4kB */
         cdev->os_desc_req->buf = kmalloc(4096, GFP_KERNEL);
         if (!cdev->os_desc_req->buf) {
-                ret = PTR_ERR(cdev->os_desc_req->buf);
+                ret = -ENOMEM;
                 kfree(cdev->os_desc_req);
                 goto end;
         }
diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
index 70cf3477f951..f9237fe2be05 100644
--- a/drivers/usb/gadget/configfs.c
+++ b/drivers/usb/gadget/configfs.c
@@ -1490,7 +1490,9 @@ void unregister_gadget_item(struct config_item *item)
 {
         struct gadget_info *gi = to_gadget_info(item);
 
+        mutex_lock(&gi->lock);
         unregister_gadget(gi);
+        mutex_unlock(&gi->lock);
 }
 EXPORT_SYMBOL_GPL(unregister_gadget_item);
 
diff --git a/drivers/usb/gadget/function/f_eem.c b/drivers/usb/gadget/function/f_eem.c
index d58bfc32be9e..007ec6e4a5d4 100644
--- a/drivers/usb/gadget/function/f_eem.c
+++ b/drivers/usb/gadget/function/f_eem.c
@@ -341,11 +341,15 @@ static struct sk_buff *eem_wrap(struct gether *port, struct sk_buff *skb)
 {
         struct sk_buff  *skb2 = NULL;
         struct usb_ep   *in = port->in_ep;
-        int             padlen = 0;
-        u16             len = skb->len;
+        int             headroom, tailroom, padlen = 0;
+        u16             len;
 
-        int headroom = skb_headroom(skb);
-        int tailroom = skb_tailroom(skb);
+        if (!skb)
+                return NULL;
+
+        len = skb->len;
+        headroom = skb_headroom(skb);
+        tailroom = skb_tailroom(skb);
 
         /* When (len + EEM_HLEN + ETH_FCS_LEN) % in->maxpacket) is 0,
          * stick two bytes of zero-length EEM packet on the end.
diff --git a/drivers/usb/gadget/function/f_rndis.c b/drivers/usb/gadget/function/f_rndis.c
index c8005823b190..16562e461121 100644
--- a/drivers/usb/gadget/function/f_rndis.c
+++ b/drivers/usb/gadget/function/f_rndis.c
@@ -374,6 +374,9 @@ static struct sk_buff *rndis_add_header(struct gether *port,
 {
         struct sk_buff *skb2;
 
+        if (!skb)
+                return NULL;
+
         skb2 = skb_realloc_headroom(skb, sizeof(struct rndis_packet_msg_type));
         rndis_add_hdr(skb2);
 
diff --git a/drivers/usb/gadget/function/rndis.c b/drivers/usb/gadget/function/rndis.c
index 943c21aafd3b..ab6ac1b74ac0 100644
--- a/drivers/usb/gadget/function/rndis.c
+++ b/drivers/usb/gadget/function/rndis.c
@@ -680,6 +680,12 @@ static int rndis_reset_response(struct rndis_params *params,
 {
         rndis_reset_cmplt_type *resp;
         rndis_resp_t *r;
+        u8 *xbuf;
+        u32 length;
+
+        /* drain the response queue */
+        while ((xbuf = rndis_get_next_response(params, &length)))
+                rndis_free_response(params, xbuf);
 
         r = rndis_add_response(params, sizeof(rndis_reset_cmplt_type));
         if (!r)
diff --git a/drivers/usb/gadget/function/u_ether.c b/drivers/usb/gadget/function/u_ether.c
index a3f7e7c55ebb..5f562c1ec795 100644
--- a/drivers/usb/gadget/function/u_ether.c
+++ b/drivers/usb/gadget/function/u_ether.c
@@ -556,7 +556,8 @@ static netdev_tx_t eth_start_xmit(struct sk_buff *skb,
                         /* Multi frame CDC protocols may store the frame for
                          * later which is not a dropped frame.
                          */
-                        if (dev->port_usb->supports_multi_frame)
+                        if (dev->port_usb &&
+                                        dev->port_usb->supports_multi_frame)
                                 goto multiframe;
                         goto drop;
                 }
diff --git a/drivers/usb/gadget/function/u_serial.c b/drivers/usb/gadget/function/u_serial.c
index 6ded6345cd09..e0cd1e4c8892 100644
--- a/drivers/usb/gadget/function/u_serial.c
+++ b/drivers/usb/gadget/function/u_serial.c
@@ -375,10 +375,15 @@ __acquires(&port->port_lock)
 */
 {
         struct list_head        *pool = &port->write_pool;
-        struct usb_ep           *in = port->port_usb->in;
+        struct usb_ep           *in;
         int                     status = 0;
         bool                    do_tty_wake = false;
 
+        if (!port->port_usb)
+                return status;
+
+        in = port->port_usb->in;
+
         while (!port->write_busy && !list_empty(pool)) {
                 struct usb_request      *req;
                 int                     len;
diff --git a/drivers/usb/gadget/function/uvc_configfs.c b/drivers/usb/gadget/function/uvc_configfs.c
index 66753ba7a42e..31125a4a2658 100644
--- a/drivers/usb/gadget/function/uvc_configfs.c
+++ b/drivers/usb/gadget/function/uvc_configfs.c
@@ -2023,7 +2023,7 @@ static int uvcg_streaming_class_allow_link(struct config_item *src,
         if (!data) {
                 kfree(*class_array);
                 *class_array = NULL;
-                ret = PTR_ERR(data);
+                ret = -ENOMEM;
                 goto unlock;
         }
         cl_arr = *class_array;
diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
index aa3707bdebb4..16104b5ebdcb 100644
--- a/drivers/usb/gadget/legacy/inode.c
+++ b/drivers/usb/gadget/legacy/inode.c
@@ -542,7 +542,7 @@ static ssize_t ep_aio(struct kiocb *iocb,
          */
         spin_lock_irq(&epdata->dev->lock);
         value = -ENODEV;
-        if (unlikely(epdata->ep))
+        if (unlikely(epdata->ep == NULL))
                 goto fail;
 
         req = usb_ep_alloc_request(epdata->ep, GFP_ATOMIC);
@@ -606,7 +606,7 @@ ep_read_iter(struct kiocb *iocb, struct iov_iter *to)
         }
         if (is_sync_kiocb(iocb)) {
                 value = ep_io(epdata, buf, len);
-                if (value >= 0 && copy_to_iter(buf, value, to))
+                if (value >= 0 && (copy_to_iter(buf, value, to) != value))
                         value = -EFAULT;
         } else {
                 struct kiocb_priv *priv = kzalloc(sizeof *priv, GFP_KERNEL);
diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c
index ff8685ea7219..40c04bb25f2f 100644
--- a/drivers/usb/gadget/udc/core.c
+++ b/drivers/usb/gadget/udc/core.c
@@ -827,7 +827,7 @@ void usb_gadget_unmap_request_by_dev(struct device *dev,
                 return;
 
         if (req->num_mapped_sgs) {
-                dma_unmap_sg(dev, req->sg, req->num_mapped_sgs,
+                dma_unmap_sg(dev, req->sg, req->num_sgs,
                                 is_in ? DMA_TO_DEVICE : DMA_FROM_DEVICE);
 
                 req->num_mapped_sgs = 0;
@@ -1145,7 +1145,7 @@ int usb_add_gadget_udc_release(struct device *parent, struct usb_gadget *gadget,
                         if (ret != -EPROBE_DEFER)
                                 list_del(&driver->pending);
                         if (ret)
-                                goto err4;
+                                goto err5;
                         break;
                 }
         }
@@ -1154,6 +1154,9 @@ int usb_add_gadget_udc_release(struct device *parent, struct usb_gadget *gadget,
 
         return 0;
 
+err5:
+        device_del(&udc->dev);
+
 err4:
         list_del(&udc->list);
         mutex_unlock(&udc_lock);
diff --git a/drivers/usb/gadget/udc/fsl_qe_udc.c b/drivers/usb/gadget/udc/fsl_qe_udc.c
index 93d28cb00b76..8bb011ea78f7 100644
--- a/drivers/usb/gadget/udc/fsl_qe_udc.c
+++ b/drivers/usb/gadget/udc/fsl_qe_udc.c
@@ -1878,11 +1878,8 @@ static int qe_get_frame(struct usb_gadget *gadget)
 
         tmp = in_be16(&udc->usb_param->frame_n);
         if (tmp & 0x8000)
-                tmp = tmp & 0x07ff;
-        else
-                tmp = -EINVAL;
-
-        return (int)tmp;
+                return tmp & 0x07ff;
+        return -EINVAL;
 }
 
 static int fsl_qe_start(struct usb_gadget *gadget,
@@ -2053,7 +2050,7 @@ static void setup_received_handle(struct qe_udc *udc,
                         struct qe_ep *ep;
 
                         if (wValue != 0 || wLength != 0
-                                || pipe > USB_MAX_ENDPOINTS)
+                                || pipe >= USB_MAX_ENDPOINTS)
                                 break;
                         ep = &udc->eps[pipe];
 
diff --git a/drivers/usb/gadget/udc/renesas_usb3.c b/drivers/usb/gadget/udc/renesas_usb3.c
index 93a3bec81df7..fb8fc34827ab 100644
--- a/drivers/usb/gadget/udc/renesas_usb3.c
+++ b/drivers/usb/gadget/udc/renesas_usb3.c
@@ -106,6 +106,7 @@
 
 /* DRD_CON */
 #define DRD_CON_PERI_CON        BIT(24)
+#define DRD_CON_VBOUT           BIT(0)
 
 /* USB_INT_ENA_1 and USB_INT_STA_1 */
 #define USB_INT_1_B3_PLLWKUP    BIT(31)
@@ -363,6 +364,7 @@ static void usb3_init_epc_registers(struct renesas_usb3 *usb3)
 {
         /* FIXME: How to change host / peripheral mode as well? */
         usb3_set_bit(usb3, DRD_CON_PERI_CON, USB3_DRD_CON);
+        usb3_clear_bit(usb3, DRD_CON_VBOUT, USB3_DRD_CON);
 
         usb3_write(usb3, ~0, USB3_USB_INT_STA_1);
         usb3_enable_irq_1(usb3, USB_INT_1_VBUS_CNG);
diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
index a962b89b65a6..1e5f529d51a2 100644
--- a/drivers/usb/host/ehci-hcd.c
+++ b/drivers/usb/host/ehci-hcd.c
@@ -332,11 +332,11 @@ static void ehci_turn_off_all_ports(struct ehci_hcd *ehci)
         int     port = HCS_N_PORTS(ehci->hcs_params);
 
         while (port--) {
-                ehci_writel(ehci, PORT_RWC_BITS,
-                                &ehci->regs->port_status[port]);
                 spin_unlock_irq(&ehci->lock);
                 ehci_port_power(ehci, port, false);
                 spin_lock_irq(&ehci->lock);
+                ehci_writel(ehci, PORT_RWC_BITS,
+                                &ehci->regs->port_status[port]);
         }
 }
 
diff --git a/drivers/usb/host/max3421-hcd.c b/drivers/usb/host/max3421-hcd.c
index c369c29e496d..2f7690092a7f 100644
--- a/drivers/usb/host/max3421-hcd.c
+++ b/drivers/usb/host/max3421-hcd.c
@@ -1675,7 +1675,7 @@ max3421_gpout_set_value(struct usb_hcd *hcd, u8 pin_number, u8 value)
         if (pin_number > 7)
                 return;
 
-        mask = 1u << pin_number;
+        mask = 1u << (pin_number % 4);
         idx = pin_number / 4;
 
         if (value)
diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index d61fcc48099e..730b9fd26685 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -386,6 +386,9 @@ static int xhci_stop_device(struct xhci_hcd *xhci, int slot_id, int suspend)
 
         ret = 0;
         virt_dev = xhci->devs[slot_id];
+        if (!virt_dev)
+                return -ENODEV;
+
         cmd = xhci_alloc_command(xhci, false, true, GFP_NOIO);
         if (!cmd) {
                 xhci_dbg(xhci, "Couldn't allocate command structure.\n");
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index 4fd041bec332..d7b0f97abbad 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -314,11 +314,12 @@ static void xhci_pci_remove(struct pci_dev *dev)
                 usb_remove_hcd(xhci->shared_hcd);
                 usb_put_hcd(xhci->shared_hcd);
         }
-        usb_hcd_pci_remove(dev);
 
         /* Workaround for spurious wakeups at shutdown with HSW */
         if (xhci->quirks & XHCI_SPURIOUS_WAKEUP)
                 pci_set_power_state(dev, PCI_D3hot);
+
+        usb_hcd_pci_remove(dev);
 }
 
 #ifdef CONFIG_PM
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 918e0c739b79..797137e26549 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -850,6 +850,10 @@ void xhci_stop_endpoint_command_watchdog(unsigned long arg)
         spin_lock_irqsave(&xhci->lock, flags);
 
         ep->stop_cmds_pending--;
+        if (xhci->xhc_state & XHCI_STATE_REMOVING) {
+                spin_unlock_irqrestore(&xhci->lock, flags);
+                return;
+        }
         if (xhci->xhc_state & XHCI_STATE_DYING) {
                 xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,
                                 "Stop EP timer ran, but another timer marked "
@@ -903,7 +907,7 @@ void xhci_stop_endpoint_command_watchdog(unsigned long arg)
         spin_unlock_irqrestore(&xhci->lock, flags);
         xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,
                         "Calling usb_hc_died()");
-        usb_hc_died(xhci_to_hcd(xhci)->primary_hcd);
+        usb_hc_died(xhci_to_hcd(xhci));
         xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,
                         "xHCI host controller is dead.");
 }
@@ -1334,12 +1338,6 @@ static void handle_cmd_completion(struct xhci_hcd *xhci,
 
         cmd = list_entry(xhci->cmd_list.next, struct xhci_command, cmd_list);
 
-        if (cmd->command_trb != xhci->cmd_ring->dequeue) {
-                xhci_err(xhci,
-                         "Command completion event does not match command\n");
-                return;
-        }
-
         del_timer(&xhci->cmd_timer);
 
         trace_xhci_cmd_completion(cmd_trb, (struct xhci_generic_trb *) event);
@@ -1351,6 +1349,13 @@ static void handle_cmd_completion(struct xhci_hcd *xhci,
                 xhci_handle_stopped_cmd_ring(xhci, cmd);
                 return;
         }
+
+        if (cmd->command_trb != xhci->cmd_ring->dequeue) {
+                xhci_err(xhci,
+                         "Command completion event does not match command\n");
+                return;
+        }
+
         /*
          * Host aborted the command ring, check if the current command was
          * supposed to be aborted, otherwise continue normally.
@@ -3243,7 +3248,8 @@ int xhci_queue_bulk_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
         send_addr = addr;
 
         /* Queue the TRBs, even if they are zero-length */
-        for (enqd_len = 0; enqd_len < full_len; enqd_len += trb_buff_len) {
+        for (enqd_len = 0; first_trb || enqd_len < full_len;
+                        enqd_len += trb_buff_len) {
                 field = TRB_TYPE(TRB_NORMAL);
 
                 /* TRB buffer should not cross 64KB boundaries */
diff --git a/drivers/usb/misc/ftdi-elan.c b/drivers/usb/misc/ftdi-elan.c
index 52c27cab78c3..9b5b3b2281ca 100644
--- a/drivers/usb/misc/ftdi-elan.c
+++ b/drivers/usb/misc/ftdi-elan.c
@@ -665,7 +665,7 @@ static ssize_t ftdi_elan_read(struct file *file, char __user *buffer,
 {
         char data[30 *3 + 4];
         char *d = data;
-        int m = (sizeof(data) - 1) / 3;
+        int m = (sizeof(data) - 1) / 3 - 1;
         int bytes_read = 0;
         int retry_on_empty = 10;
         int retry_on_timeout = 5;
@@ -1684,7 +1684,7 @@ wait:if (ftdi->disconnected > 0) {
                         int i = 0;
                         char data[30 *3 + 4];
                         char *d = data;
-                        int m = (sizeof(data) - 1) / 3;
+                        int m = (sizeof(data) - 1) / 3 - 1;
                         int l = 0;
                         struct u132_target *target = &ftdi->target[ed];
                         struct u132_command *command = &ftdi->command[
@@ -1876,7 +1876,7 @@ more:{
                 if (packet_bytes > 2) {
                         char diag[30 *3 + 4];
                         char *d = diag;
-                        int m = (sizeof(diag) - 1) / 3;
+                        int m = (sizeof(diag) - 1) / 3 - 1;
                         char *b = ftdi->bulk_in_buffer;
                         int bytes_read = 0;
                         diag[0] = 0;
@@ -2053,7 +2053,7 @@ static int ftdi_elan_synchronize(struct usb_ftdi *ftdi)
                         if (packet_bytes > 2) {
                                 char diag[30 *3 + 4];
                                 char *d = diag;
-                                int m = (sizeof(diag) - 1) / 3;
+                                int m = (sizeof(diag) - 1) / 3 - 1;
                                 char *b = ftdi->bulk_in_buffer;
                                 int bytes_read = 0;
                                 unsigned char c = 0;
@@ -2155,7 +2155,7 @@ more:{
                 if (packet_bytes > 2) {
                         char diag[30 *3 + 4];
                         char *d = diag;
-                        int m = (sizeof(diag) - 1) / 3;
+                        int m = (sizeof(diag) - 1) / 3 - 1;
                         char *b = ftdi->bulk_in_buffer;
                         int bytes_read = 0;
                         diag[0] = 0;
diff --git a/drivers/usb/misc/usbtest.c b/drivers/usb/misc/usbtest.c
index 6b978f04b8d7..5c8210dc6fd9 100644
--- a/drivers/usb/misc/usbtest.c
+++ b/drivers/usb/misc/usbtest.c
@@ -585,7 +585,6 @@ static void sg_timeout(unsigned long _req)
 {
         struct usb_sg_request   *req = (struct usb_sg_request *) _req;
 
-        req->status = -ETIMEDOUT;
         usb_sg_cancel(req);
 }
 
@@ -616,8 +615,10 @@ static int perform_sglist(
                 mod_timer(&sg_timer, jiffies +
                                 msecs_to_jiffies(SIMPLE_IO_TIMEOUT));
                 usb_sg_wait(req);
-                del_timer_sync(&sg_timer);
-                retval = req->status;
+                if (!del_timer_sync(&sg_timer))
+                        retval = -ETIMEDOUT;
+                else
+                        retval = req->status;
 
                 /* FIXME check resulting data pattern */
 
@@ -2602,7 +2603,7 @@ usbtest_ioctl(struct usb_interface *intf, unsigned int code, void *buf)
         ktime_get_ts64(&start);
 
         retval = usbtest_do_ioctl(intf, param_32);
-        if (retval)
+        if (retval < 0)
                 goto free_mutex;
 
         ktime_get_ts64(&end);
diff --git a/drivers/usb/musb/Kconfig b/drivers/usb/musb/Kconfig
index 886526b5fcdd..73cfa13fc0dc 100644
--- a/drivers/usb/musb/Kconfig
+++ b/drivers/usb/musb/Kconfig
@@ -87,7 +87,7 @@ config USB_MUSB_DA8XX
 config USB_MUSB_TUSB6010
         tristate "TUSB6010"
         depends on HAS_IOMEM
-        depends on ARCH_OMAP2PLUS || COMPILE_TEST
+        depends on (ARCH_OMAP2PLUS || COMPILE_TEST) && !BLACKFIN
         depends on NOP_USB_XCEIV = USB_MUSB_HDRC # both built-in or both modules
 
 config USB_MUSB_OMAP2PLUS
diff --git a/drivers/usb/musb/musb_virthub.c b/drivers/usb/musb/musb_virthub.c
index 192248f974ec..fe08e776fec3 100644
--- a/drivers/usb/musb/musb_virthub.c
+++ b/drivers/usb/musb/musb_virthub.c
@@ -290,6 +290,7 @@ int musb_hub_control(
         u32             temp;
         int             retval = 0;
         unsigned long   flags;
+        bool            start_musb = false;
 
         spin_lock_irqsave(&musb->lock, flags);
 
@@ -390,7 +391,7 @@ int musb_hub_control(
                          * logic relating to VBUS power-up.
                          */
                         if (!hcd->self.is_b_host && musb_has_gadget(musb))
-                                musb_start(musb);
+                                start_musb = true;
                         break;
                 case USB_PORT_FEAT_RESET:
                         musb_port_reset(musb, true);
@@ -451,5 +452,9 @@ error:
                 retval = -EPIPE;
         }
         spin_unlock_irqrestore(&musb->lock, flags);
+
+        if (start_musb)
+                musb_start(musb);
+
         return retval;
 }
diff --git a/drivers/usb/phy/phy-generic.c b/drivers/usb/phy/phy-generic.c
index 980c9dee09eb..427efb5eebae 100644
--- a/drivers/usb/phy/phy-generic.c
+++ b/drivers/usb/phy/phy-generic.c
@@ -144,14 +144,18 @@ static irqreturn_t nop_gpio_vbus_thread(int irq, void *data)
 int usb_gen_phy_init(struct usb_phy *phy)
 {
         struct usb_phy_generic *nop = dev_get_drvdata(phy->dev);
+        int ret;
 
         if (!IS_ERR(nop->vcc)) {
                 if (regulator_enable(nop->vcc))
                         dev_err(phy->dev, "Failed to enable power\n");
         }
 
-        if (!IS_ERR(nop->clk))
-                clk_prepare_enable(nop->clk);
+        if (!IS_ERR(nop->clk)) {
+                ret = clk_prepare_enable(nop->clk);
+                if (ret)
+                        return ret;
+        }
 
         nop_reset(nop);
 
diff --git a/drivers/usb/phy/phy-omap-otg.c b/drivers/usb/phy/phy-omap-otg.c
index 6f6d2a7fd5a0..6523af4f8f93 100644
--- a/drivers/usb/phy/phy-omap-otg.c
+++ b/drivers/usb/phy/phy-omap-otg.c
@@ -140,6 +140,8 @@ static int omap_otg_probe(struct platform_device *pdev)
                  (rev >> 4) & 0xf, rev & 0xf, config->extcon, otg_dev->id,
                  otg_dev->vbus);
 
+        platform_set_drvdata(pdev, otg_dev);
+
         return 0;
 }
 
diff --git a/drivers/usb/renesas_usbhs/common.c b/drivers/usb/renesas_usbhs/common.c
index 8fbbc2d32371..ac67bab9124c 100644
--- a/drivers/usb/renesas_usbhs/common.c
+++ b/drivers/usb/renesas_usbhs/common.c
@@ -514,7 +514,8 @@ static struct renesas_usbhs_platform_info *usbhs_parse_dt(struct device *dev)
         if (gpio > 0)
                 dparam->enable_gpio = gpio;
 
-        if (dparam->type == USBHS_TYPE_RCAR_GEN2)
+        if (dparam->type == USBHS_TYPE_RCAR_GEN2 ||
+            dparam->type == USBHS_TYPE_RCAR_GEN3)
                 dparam->has_usb_dmac = 1;
 
         return info;
diff --git a/drivers/usb/renesas_usbhs/fifo.c b/drivers/usb/renesas_usbhs/fifo.c
index 280ed5ff021b..857e78337324 100644
--- a/drivers/usb/renesas_usbhs/fifo.c
+++ b/drivers/usb/renesas_usbhs/fifo.c
@@ -871,7 +871,7 @@ static int usbhsf_dma_prepare_push(struct usbhs_pkt *pkt, int *is_done)
 
         /* use PIO if packet is less than pio_dma_border or pipe is DCP */
         if ((len < usbhs_get_dparam(priv, pio_dma_border)) ||
-            usbhs_pipe_is_dcp(pipe))
+            usbhs_pipe_type_is(pipe, USB_ENDPOINT_XFER_ISOC))
                 goto usbhsf_pio_prepare_push;
 
         /* check data length if this driver don't use USB-DMAC */
@@ -976,7 +976,7 @@ static int usbhsf_dma_prepare_pop_with_usb_dmac(struct usbhs_pkt *pkt,
 
         /* use PIO if packet is less than pio_dma_border or pipe is DCP */
         if ((pkt->length < usbhs_get_dparam(priv, pio_dma_border)) ||
-            usbhs_pipe_is_dcp(pipe))
+            usbhs_pipe_type_is(pipe, USB_ENDPOINT_XFER_ISOC))
                 goto usbhsf_pio_prepare_pop;
 
         fifo = usbhsf_get_dma_fifo(priv, pkt);
diff --git a/drivers/usb/renesas_usbhs/mod.c b/drivers/usb/renesas_usbhs/mod.c
index d4be5d594896..28965ef4f824 100644
--- a/drivers/usb/renesas_usbhs/mod.c
+++ b/drivers/usb/renesas_usbhs/mod.c
@@ -282,9 +282,16 @@ static irqreturn_t usbhs_interrupt(int irq, void *data)
         if (usbhs_mod_is_host(priv))
                 usbhs_write(priv, INTSTS1, ~irq_state.intsts1 & INTSTS1_MAGIC);
 
-        usbhs_write(priv, BRDYSTS, ~irq_state.brdysts);
+        /*
+         * The driver should not clear the xxxSTS after the line of
+         * "call irq callback functions" because each "if" statement is
+         * possible to call the callback function for avoiding any side effects.
+         */
+        if (irq_state.intsts0 & BRDY)
+                usbhs_write(priv, BRDYSTS, ~irq_state.brdysts);
         usbhs_write(priv, NRDYSTS, ~irq_state.nrdysts);
-        usbhs_write(priv, BEMPSTS, ~irq_state.bempsts);
+        if (irq_state.intsts0 & BEMP)
+                usbhs_write(priv, BEMPSTS, ~irq_state.bempsts);
 
         /*
          * call irq callback functions
diff --git a/drivers/usb/renesas_usbhs/mod_gadget.c b/drivers/usb/renesas_usbhs/mod_gadget.c
index 50f3363cc382..c4c64740a3e7 100644
--- a/drivers/usb/renesas_usbhs/mod_gadget.c
+++ b/drivers/usb/renesas_usbhs/mod_gadget.c
@@ -617,10 +617,13 @@ static int usbhsg_ep_enable(struct usb_ep *ep,
                  * use dmaengine if possible.
                  * It will use pio handler if impossible.
                  */
-                if (usb_endpoint_dir_in(desc))
+                if (usb_endpoint_dir_in(desc)) {
                         pipe->handler = &usbhs_fifo_dma_push_handler;
-                else
+                } else {
                         pipe->handler = &usbhs_fifo_dma_pop_handler;
+                        usbhs_xxxsts_clear(priv, BRDYSTS,
+                                           usbhs_pipe_number(pipe));
+                }
 
                 ret = 0;
         }
@@ -1073,7 +1076,7 @@ int usbhs_mod_gadget_probe(struct usbhs_priv *priv)
 
         gpriv->transceiver = usb_get_phy(USB_PHY_TYPE_UNDEFINED);
         dev_info(dev, "%stransceiver found\n",
-                 gpriv->transceiver ? "" : "no ");
+                 !IS_ERR(gpriv->transceiver) ? "" : "no ");
 
         /*
          * CAUTION
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 00820809139a..b2d767e743fc 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -648,6 +648,8 @@ static const struct usb_device_id id_table_combined[] = {
         { USB_DEVICE(FTDI_VID, FTDI_ELV_TFD128_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_ELV_FM3RX_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_ELV_WS777_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_PALMSENS_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_IVIUM_XSTAT_PID) },
         { USB_DEVICE(FTDI_VID, LINX_SDMUSBQSS_PID) },
         { USB_DEVICE(FTDI_VID, LINX_MASTERDEVEL2_PID) },
         { USB_DEVICE(FTDI_VID, LINX_FUTURE_0_PID) },
@@ -1008,6 +1010,7 @@ static const struct usb_device_id id_table_combined[] = {
         { USB_DEVICE(ICPDAS_VID, ICPDAS_I7560U_PID) },
         { USB_DEVICE(ICPDAS_VID, ICPDAS_I7561U_PID) },
         { USB_DEVICE(ICPDAS_VID, ICPDAS_I7563U_PID) },
+        { USB_DEVICE(WICED_VID, WICED_USB20706V2_PID) },
         { }                                     /* Terminating entry */
 };
 
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index c5d6c1e73e8e..f87a938cf005 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -406,6 +406,12 @@
 #define FTDI_4N_GALAXY_DE_3_PID 0xF3C2
 
 /*
+ * Ivium Technologies product IDs
+ */
+#define FTDI_PALMSENS_PID       0xf440
+#define FTDI_IVIUM_XSTAT_PID    0xf441
+
+/*
  * Linx Technologies product ids
  */
 #define LINX_SDMUSBQSS_PID      0xF448  /* Linx SDM-USB-QS-S */
@@ -673,6 +679,12 @@
 #define INTREPID_NEOVI_PID      0x0701
 
 /*
+ * WICED USB UART
+ */
+#define WICED_VID               0x0A5C
+#define WICED_USB20706V2_PID    0x6422
+
+/*
  * Definitions for ID TECH (www.idt-net.com) devices
  */
 #define IDTECH_VID              0x0ACD  /* ID TECH Vendor ID */
diff --git a/drivers/usb/serial/mos7720.c b/drivers/usb/serial/mos7720.c
index 5608af4a369d..de9992b492b0 100644
--- a/drivers/usb/serial/mos7720.c
+++ b/drivers/usb/serial/mos7720.c
@@ -1252,7 +1252,7 @@ static int mos7720_write(struct tty_struct *tty, struct usb_serial_port *port,
 
         if (urb->transfer_buffer == NULL) {
                 urb->transfer_buffer = kmalloc(URB_TRANSFER_BUFFER_SIZE,
-                                               GFP_KERNEL);
+                                               GFP_ATOMIC);
                 if (!urb->transfer_buffer)
                         goto exit;
         }
diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c
index ed378fb232e7..57426d703a09 100644
--- a/drivers/usb/serial/mos7840.c
+++ b/drivers/usb/serial/mos7840.c
@@ -1340,8 +1340,8 @@ static int mos7840_write(struct tty_struct *tty, struct usb_serial_port *port,
         }
 
         if (urb->transfer_buffer == NULL) {
-                urb->transfer_buffer =
-                    kmalloc(URB_TRANSFER_BUFFER_SIZE, GFP_KERNEL);
+                urb->transfer_buffer = kmalloc(URB_TRANSFER_BUFFER_SIZE,
+                                               GFP_ATOMIC);
                 if (!urb->transfer_buffer)
                         goto exit;
         }
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 8e07536c233a..9894e341c6ac 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -274,6 +274,12 @@ static void option_instat_callback(struct urb *urb);
 #define TELIT_PRODUCT_LE920                     0x1200
 #define TELIT_PRODUCT_LE910                     0x1201
 #define TELIT_PRODUCT_LE910_USBCFG4             0x1206
+#define TELIT_PRODUCT_LE920A4_1207              0x1207
+#define TELIT_PRODUCT_LE920A4_1208              0x1208
+#define TELIT_PRODUCT_LE920A4_1211              0x1211
+#define TELIT_PRODUCT_LE920A4_1212              0x1212
+#define TELIT_PRODUCT_LE920A4_1213              0x1213
+#define TELIT_PRODUCT_LE920A4_1214              0x1214
 
 /* ZTE PRODUCTS */
 #define ZTE_VENDOR_ID                           0x19d2
@@ -519,6 +525,12 @@ static void option_instat_callback(struct urb *urb);
 #define VIATELECOM_VENDOR_ID                    0x15eb
 #define VIATELECOM_PRODUCT_CDS7                 0x0001
 
+/* WeTelecom products */
+#define WETELECOM_VENDOR_ID                     0x22de
+#define WETELECOM_PRODUCT_WMD200                0x6801
+#define WETELECOM_PRODUCT_6802                  0x6802
+#define WETELECOM_PRODUCT_WMD300                0x6803
+
 struct option_blacklist_info {
         /* bitmask of interface numbers blacklisted for send_setup */
         const unsigned long sendsetup;
@@ -628,6 +640,11 @@ static const struct option_blacklist_info telit_le920_blacklist = {
         .reserved = BIT(1) | BIT(5),
 };
 
+static const struct option_blacklist_info telit_le920a4_blacklist_1 = {
+        .sendsetup = BIT(0),
+        .reserved = BIT(1),
+};
+
 static const struct option_blacklist_info telit_le922_blacklist_usbcfg0 = {
         .sendsetup = BIT(2),
         .reserved = BIT(0) | BIT(1) | BIT(3),
@@ -1203,6 +1220,16 @@ static const struct usb_device_id option_ids[] = {
                 .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 },
         { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920),
                 .driver_info = (kernel_ulong_t)&telit_le920_blacklist },
+        { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1207) },
+        { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1208),
+                .driver_info = (kernel_ulong_t)&telit_le920a4_blacklist_1 },
+        { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1211),
+                .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 },
+        { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1212),
+                .driver_info = (kernel_ulong_t)&telit_le920a4_blacklist_1 },
+        { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1213, 0xff) },
+        { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1214),
+                .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0002, 0xff, 0xff, 0xff),
                 .driver_info = (kernel_ulong_t)&net_intf1_blacklist },
@@ -1966,9 +1993,13 @@ static const struct usb_device_id option_ids[] = {
           .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
         { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */
         { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */
+        { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x7e11, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/A3 */
         { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) },                /* OLICARD300 - MT6225 */
         { USB_DEVICE(INOVIA_VENDOR_ID, INOVIA_SEW858) },
         { USB_DEVICE(VIATELECOM_VENDOR_ID, VIATELECOM_PRODUCT_CDS7) },
+        { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_WMD200, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_6802, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_WMD300, 0xff, 0xff, 0xff) },
         { } /* Terminating entry */
 };
 MODULE_DEVICE_TABLE(usb, option_ids);
diff --git a/drivers/usb/serial/usb-serial-simple.c b/drivers/usb/serial/usb-serial-simple.c
index a204782ae530..e98b6e57b703 100644
--- a/drivers/usb/serial/usb-serial-simple.c
+++ b/drivers/usb/serial/usb-serial-simple.c
@@ -54,7 +54,8 @@ DEVICE(funsoft, FUNSOFT_IDS);
 /* Infineon Flashloader driver */
 #define FLASHLOADER_IDS()               \
         { USB_DEVICE_INTERFACE_CLASS(0x058b, 0x0041, USB_CLASS_CDC_DATA) }, \
-        { USB_DEVICE(0x8087, 0x0716) }
+        { USB_DEVICE(0x8087, 0x0716) }, \
+        { USB_DEVICE(0x8087, 0x0801) }
 DEVICE(flashloader, FLASHLOADER_IDS);
 
 /* Google Serial USB SubClass */
diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
index b1b9bac44016..d213cf44a7e4 100644
--- a/drivers/usb/serial/usb-serial.c
+++ b/drivers/usb/serial/usb-serial.c
@@ -1433,7 +1433,7 @@ int usb_serial_register_drivers(struct usb_serial_driver *const serial_drivers[]
 
         rc = usb_register(udriver);
         if (rc)
-                return rc;
+                goto failed_usb_register;
 
         for (sd = serial_drivers; *sd; ++sd) {
                 (*sd)->usb_driver = udriver;
@@ -1451,6 +1451,8 @@ int usb_serial_register_drivers(struct usb_serial_driver *const serial_drivers[]
         while (sd-- > serial_drivers)
                 usb_serial_deregister(*sd);
         usb_deregister(udriver);
+failed_usb_register:
+        kfree(udriver);
         return rc;
 }
 EXPORT_SYMBOL_GPL(usb_serial_register_drivers);
diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
index 9d6320e8ff3e..6e29d053843d 100644
--- a/drivers/vhost/scsi.c
+++ b/drivers/vhost/scsi.c
@@ -88,7 +88,7 @@ struct vhost_scsi_cmd {
         struct scatterlist *tvc_prot_sgl;
         struct page **tvc_upages;
         /* Pointer to response header iovec */
-        struct iovec *tvc_resp_iov;
+        struct iovec tvc_resp_iov;
         /* Pointer to vhost_scsi for our device */
         struct vhost_scsi *tvc_vhost;
         /* Pointer to vhost_virtqueue for the cmd */
@@ -547,7 +547,7 @@ static void vhost_scsi_complete_cmd_work(struct vhost_work *work)
                 memcpy(v_rsp.sense, cmd->tvc_sense_buf,
                        se_cmd->scsi_sense_length);
 
-                iov_iter_init(&iov_iter, READ, cmd->tvc_resp_iov,
+                iov_iter_init(&iov_iter, READ, &cmd->tvc_resp_iov,
                               cmd->tvc_in_iovs, sizeof(v_rsp));
                 ret = copy_to_iter(&v_rsp, sizeof(v_rsp), &iov_iter);
                 if (likely(ret == sizeof(v_rsp))) {
@@ -1044,7 +1044,7 @@ vhost_scsi_handle_vq(struct vhost_scsi *vs, struct vhost_virtqueue *vq)
                 }
                 cmd->tvc_vhost = vs;
                 cmd->tvc_vq = vq;
-                cmd->tvc_resp_iov = &vq->iov[out];
+                cmd->tvc_resp_iov = vq->iov[out];
                 cmd->tvc_in_iovs = in;
 
                 pr_debug("vhost_scsi got command opcode: %#02x, lun: %d\n",
diff --git a/drivers/vhost/test.c b/drivers/vhost/test.c
index 388eec4e1a90..97fb2f8fa930 100644
--- a/drivers/vhost/test.c
+++ b/drivers/vhost/test.c
@@ -220,20 +220,20 @@ static long vhost_test_reset_owner(struct vhost_test *n)
 {
         void *priv = NULL;
         long err;
-        struct vhost_memory *memory;
+        struct vhost_umem *umem;
 
         mutex_lock(&n->dev.mutex);
         err = vhost_dev_check_owner(&n->dev);
         if (err)
                 goto done;
-        memory = vhost_dev_reset_owner_prepare();
-        if (!memory) {
+        umem = vhost_dev_reset_owner_prepare();
+        if (!umem) {
                 err = -ENOMEM;
                 goto done;
         }
         vhost_test_stop(n, &priv);
         vhost_test_flush(n);
-        vhost_dev_reset_owner(&n->dev, memory);
+        vhost_dev_reset_owner(&n->dev, umem);
 done:
         mutex_unlock(&n->dev.mutex);
         return err;
diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
index e383ecdaca59..ed9c9eeedfe5 100644
--- a/drivers/virtio/virtio_ring.c
+++ b/drivers/virtio/virtio_ring.c
@@ -167,7 +167,7 @@ static bool vring_use_dma_api(struct virtio_device *vdev)
  * making all of the arch DMA ops work on the vring device itself
  * is a mess.  For now, we use the parent device for DMA ops.
  */
-struct device *vring_dma_dev(const struct vring_virtqueue *vq)
+static struct device *vring_dma_dev(const struct vring_virtqueue *vq)
 {
         return vq->vq.vdev->dev.parent;
 }
diff --git a/drivers/xen/xenbus/xenbus_dev_frontend.c b/drivers/xen/xenbus/xenbus_dev_frontend.c
index 7487971f9f78..c1010f018bd8 100644
--- a/drivers/xen/xenbus/xenbus_dev_frontend.c
+++ b/drivers/xen/xenbus/xenbus_dev_frontend.c
@@ -316,7 +316,7 @@ static int xenbus_write_transaction(unsigned msg_type,
                         rc = -ENOMEM;
                         goto out;
                 }
-        } else {
+        } else if (msg_type == XS_TRANSACTION_END) {
                 list_for_each_entry(trans, &u->transactions, list)
                         if (trans->handle.id == u->u.msg.tx_id)
                                 break;